diff --git a/.claude/commands/goal.md b/.claude/commands/goal.md
new file mode 100644
index 000000000..73fcac858
--- /dev/null
+++ b/.claude/commands/goal.md
@@ -0,0 +1,29 @@
+---
+description: Execute the next step of the Notary retirement and Evidence onboarding plan
+argument-hint: [DoD item id, e.g. B5, or a workstream letter; empty picks the next item]
+---
+
+Work the tracked plan at `plans/notary-retirement-and-evidence-onboarding.md`.
+
+1. Read the plan in full: decisions, constraints, DoD checklist, dependency
+   order, status log. The decisions are settled; do not relitigate them.
+2. Select work. If `$ARGUMENTS` names a DoD item or workstream, target it.
+   Otherwise pick the first unchecked item whose dependencies are satisfied,
+   preferring workstream B (onboarding is the standing priority).
+3. Announce the selected item and its intended shape in one short message,
+   then execute. Only stop for input when the item is security-sensitive,
+   requires a decision the plan reserves for Jeremi (A1's Mint-for-Relay
+   branch, G4 re-approval), or turns out to conflict with a constraint.
+4. For code: TDD, failing test first. The frozen Evidence V1 rules in
+   `AGENTS.md` and `products/evidence/AGENTS.md` apply; composition work
+   must not touch Evidence production code.
+5. Verify with the gates listed in the plan's Verification section for every
+   area touched. All must pass; paste the evidence in the report.
+6. Update the plan file in the same commit as the work: tick the DoD
+   checkbox, append a dated status log line (absolute dates).
+7. Commit with `git commit -s` and a conventional prefix. Stage only files
+   belonging to this item; never sweep unrelated worktree changes.
+8. Report: what changed, verification evidence, and the next unblocked item.
+
+Never: modify frozen Evidence V1 contracts, hand-edit generated artifacts,
+scrub Notary from history pages, or log secrets.
diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 000000000..3a329f85c
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,5 @@
+.git
+.cargo-home
+target
+scratch
+docs/site/node_modules
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a38b94bf0..b66e1a7d9 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -30,21 +30,6 @@ updates:
           - minor
           - patch
 
-  # The conformance helper lock is a pip-compile requirements file. Its direct
-  # input remains byte-bound to the reviewed upstream suite requirements.
-  - package-ecosystem: pip
-    directory: "/release/conformance/openid"
-    schedule:
-      interval: weekly
-      day: wednesday
-      time: "08:30"
-      timezone: Etc/UTC
-    open-pull-requests-limit: 1
-    groups:
-      conformance-python:
-        patterns:
-          - "*"
-
   # Pinned GitHub Actions used by the workflows.
   - package-ecosystem: github-actions
     directory: "/"
@@ -64,9 +49,7 @@ updates:
   - package-ecosystem: docker
     directories:
       - "/release/docker"
-      - "/release/conformance/openid"
       - "/crates/registry-relay"
-      - "/products/notary"
     schedule:
       interval: weekly
       day: wednesday
@@ -77,18 +60,3 @@ updates:
       docker-images:
         patterns:
           - "*"
-
-  # Docker Compose image pins use a distinct Dependabot ecosystem from
-  # Dockerfiles. Both override filenames match Dependabot's Compose matcher.
-  - package-ecosystem: docker-compose
-    directory: "/release/conformance/openid"
-    schedule:
-      interval: weekly
-      day: wednesday
-      time: "11:30"
-      timezone: Etc/UTC
-    open-pull-requests-limit: 1
-    groups:
-      docker-compose-images:
-        patterns:
-          - "*"
diff --git a/.github/scripts/ci_changes.py b/.github/scripts/ci_changes.py
index 2f8767da9..683bf0062 100644
--- a/.github/scripts/ci_changes.py
+++ b/.github/scripts/ci_changes.py
@@ -15,17 +15,14 @@
     "platform": (
         "registry-platform-audit",
         "registry-platform-authcommon",
-        "registry-platform-cache",
         "registry-platform-canonical-json",
         "registry-platform-config",
         "registry-platform-crypto",
         "registry-platform-httpsec",
         "registry-platform-httputil",
-        "registry-platform-oid4vci",
         "registry-platform-oidc",
         "registry-platform-ops",
         "registry-platform-pdp",
-        "registry-platform-replay",
         "registry-platform-sdjwt",
         "registry-platform-testing",
     ),
@@ -33,15 +30,9 @@
         "registry-manifest-cli",
         "registry-manifest-core",
     ),
-    "notary": (
-        "registry-notary",
-        "registry-notary-client",
-        "registry-notary-core",
-        "registry-notary-server",
-        "registry-notary-worker-harness",
-        "xtask",
-    ),
     "relay": ("registry-relay",),
+    "evidence": ("registry-evidence", "registry-evidencectl"),
+    "mint": ("registry-mint",),
     "developer-tools": (
         "registry-config-report",
         "registry-language-server",
@@ -49,15 +40,41 @@
     "registryctl": ("registryctl",),
 }
 
-NOTARY_PACKAGES = frozenset(SHARDS["notary"])
+EVIDENCE_PACKAGES = frozenset(SHARDS["evidence"])
 PLATFORM_PACKAGES = frozenset(SHARDS["platform"])
 MANIFEST_PACKAGES = frozenset(SHARDS["manifest"])
 TUTORIAL_PACKAGES = frozenset(
     package
-    for shard in ("platform", "manifest", "notary", "relay", "registryctl")
+    for shard in ("platform", "manifest", "relay", "registryctl")
     for package in SHARDS[shard]
 ) | {"registry-config-report"}
 
+# Every input the Evidence tutorial gate replays or is built from. The tutorial
+# pages and helper scripts here must stay in step with the gate's own registry
+# and the helpers it invokes, which test_ci_changes.py enforces: a tutorial or
+# helper CI does not watch is one that rots silently.
+EVIDENCE_TUTORIAL_INPUTS = frozenset(
+    {
+        "Cargo.lock",
+        "Cargo.toml",
+        "docs/site/package-lock.json",
+        "docs/site/package.json",
+        "docs/site/scripts/check-evidence-tutorials.sh",
+        "docs/site/scripts/check-evidence-tutorials.test.mjs",
+        "docs/site/scripts/evidence-tutorial-fence.sh",
+        "docs/site/scripts/registryctl-tutorial.mjs",
+        "docs/site/src/content/docs/tutorials/assert-a-role-bound-relationship.mdx",
+        "docs/site/src/content/docs/tutorials/first-evidence-assertion.mdx",
+        "docs/site/src/content/docs/tutorials/refuse-unsafe-evidence-requests.mdx",
+        "docs/site/src/content/docs/tutorials/return-a-governed-value.mdx",
+        "docs/site/src/content/docs/tutorials/verify-an-assertion-as-a-consumer.mdx",
+    }
+)
+
+# The gate also builds and runs `mint`, because one tutorial serves assertions
+# to a caller holding a real Mint-issued token.
+EVIDENCE_TUTORIAL_PACKAGES = EVIDENCE_PACKAGES | frozenset(SHARDS["mint"])
+
 ROOT_RUST_INPUTS = {
     "Cargo.lock",
     "Cargo.toml",
@@ -307,8 +324,8 @@ def classify(
             if package is not None:
                 seeds.add(package)
                 continue
-            if path.startswith("products/notary/"):
-                seeds.update(NOTARY_PACKAGES)
+            if path.startswith("products/evidence/"):
+                seeds.update(EVIDENCE_PACKAGES)
             elif path.startswith("products/manifest/"):
                 seeds.update(MANIFEST_PACKAGES)
             elif path.startswith("products/platform/"):
@@ -387,7 +404,6 @@ def classify(
             "crates/registry-relay/openapi/*",
             "crates/registry-relay/src/api/openapi.rs",
             "crates/registryctl/assets/project-starters/*",
-            "crates/registry-notary-server/src/standalone/activation.rs",
             "crates/registry-platform-ops/src/lib.rs",
             "crates/registry-relay/src/consultation/*",
             "crates/registryctl/schemas/project-reports/*",
@@ -396,8 +412,6 @@ def classify(
             "crates/registryctl/tests/fixtures/project-reports/*",
             "docs/site/*",
             "products/manifest/docs/*",
-            "products/notary/docs/*",
-            "products/notary/openapi/*",
             *AUTHORING_REFERENCE_PATTERNS,
         )
         or path
@@ -472,18 +486,13 @@ def classify(
             "docs/site/src/content/docs/tutorials/use-your-spreadsheet.mdx",
             "docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx",
             "docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx",
-            "release/docker/Dockerfile.registry-notary",
             "release/docker/Dockerfile.registry-relay",
         }
-        or path.startswith("products/notary/")
         for path in paths
     )
     tutorial_source_under_test = any(
         matches(
             path,
-            "crates/registry-notary/src/*",
-            "crates/registry-notary-core/src/*",
-            "crates/registry-notary-server/src/*",
             "crates/registryctl/src/templates/*",
         )
         or path
@@ -503,6 +512,12 @@ def classify(
         or bool(affected & TUTORIAL_PACKAGES)
     )
 
+    evidence_tutorial = (
+        complete
+        or any(path in EVIDENCE_TUTORIAL_INPUTS for path in paths)
+        or bool(affected & EVIDENCE_TUTORIAL_PACKAGES)
+    )
+
     matrix = []
     for shard_name, shard_packages in SHARDS.items():
         selected = sorted(affected.intersection(shard_packages))
@@ -521,8 +536,8 @@ def classify(
         "rust_packages": sorted(affected),
         "platform": platform,
         "platform_hygiene": platform_hygiene,
-        "notary_contracts": bool(affected & NOTARY_PACKAGES),
         "relay_contracts": "registry-relay" in affected,
+        "evidence_contracts": bool(affected & EVIDENCE_PACKAGES),
         "project_authoring": "registryctl" in affected,
         "release_tool": release_tool,
         "release_source_proof": release_source_proof,
@@ -530,6 +545,7 @@ def classify(
         "docs_archives": docs_archives,
         "editors": editors,
         "registryctl_tutorial": registryctl_tutorial,
+        "evidence_tutorial": evidence_tutorial,
     }
 
 
diff --git a/.github/scripts/test_ci_changes.py b/.github/scripts/test_ci_changes.py
index 764f44cb3..af939aa72 100644
--- a/.github/scripts/test_ci_changes.py
+++ b/.github/scripts/test_ci_changes.py
@@ -7,13 +7,13 @@
 import re
 import subprocess
 import tempfile
-import tomllib
 import unittest
 from pathlib import Path
 
 from ci_changes import (
     AUTHORING_REFERENCE_CONTRACT_SOURCES,
     AUTHORING_REFERENCE_INPUTS,
+    EVIDENCE_TUTORIAL_INPUTS,
     RELEASE_SECURITY_WORKFLOWS,
     SHARDS,
     Workspace,
@@ -24,6 +24,49 @@
 from run_cargo_packages import command_args, package_args
 
 
+class CiRetirementTest(unittest.TestCase):
+    def test_current_ci_surfaces_do_not_reference_retired_notary(self) -> None:
+        current_ci_surfaces = (
+            Path(".github/dependabot.yml"),
+            Path(".github/scripts/ci_changes.py"),
+            Path(".github/workflows/ci.yml"),
+            Path(".github/workflows/nightly-rust-coverage.yml"),
+            Path(".github/workflows/nightly-security.yml"),
+        )
+        for path in current_ci_surfaces:
+            with self.subTest(path=path):
+                self.assertNotRegex(path.read_text(encoding="utf-8"), r"(?i)notary")
+
+        self.assertFalse(
+            Path(".github/workflows/notary-postgres-conformance.yml").exists()
+        )
+
+
+class PlatformRetirementTest(unittest.TestCase):
+    def test_orphan_platform_crates_and_oid4vci_fuzz_surface_are_absent(self) -> None:
+        retired_crates = (
+            "registry-platform-cache",
+            "registry-platform-oid4vci",
+            "registry-platform-replay",
+            "registry-platform-sts",
+        )
+        for crate in retired_crates:
+            with self.subTest(crate=crate):
+                self.assertNotIn(crate, SHARDS["platform"])
+                self.assertFalse(Path("crates", crate).exists())
+
+        self.assertIn("registry-platform-pdp", SHARDS["platform"])
+        self.assertIn("registry-platform-testing", SHARDS["platform"])
+        self.assertFalse(
+            Path(
+                "products/platform/fuzz/fuzz_targets/oid4vci_request_and_proof.rs"
+            ).exists()
+        )
+        self.assertFalse(
+            Path("products/platform/fuzz/corpus/oid4vci_request_and_proof").exists()
+        )
+
+
 class CiChangesTest(unittest.TestCase):
     @classmethod
     def setUpClass(cls) -> None:
@@ -58,6 +101,81 @@ def test_example_pr_runs_only_affected_rust_shards(self) -> None:
         self.assertTrue(outputs["registryctl_tutorial"])
         self.assertFalse(outputs["platform"])
 
+    def test_evidence_tutorial_inputs_cover_every_registered_tutorial(self) -> None:
+        # The gate's registry is the source of truth for which tutorials exist.
+        # A tutorial missing here would not trigger the job that replays it, so
+        # it could break without any pull request noticing.
+        gate = (
+            Path(__file__).resolve().parents[2]
+            / "docs/site/scripts/check-evidence-tutorials.sh"
+        )
+        registry = re.search(
+            r"^EVIDENCE_TUTORIALS=\((.*?)^\)", gate.read_text(), re.DOTALL | re.MULTILINE
+        )
+        if registry is None:
+            self.fail("the gate must declare EVIDENCE_TUTORIALS")
+        slugs = registry.group(1).split()
+        self.assertTrue(slugs, "the gate must register at least one tutorial")
+        for slug in slugs:
+            with self.subTest(slug=slug):
+                self.assertIn(
+                    f"docs/site/src/content/docs/tutorials/{slug}.mdx",
+                    EVIDENCE_TUTORIAL_INPUTS,
+                )
+
+    def test_evidence_tutorial_inputs_cover_every_helper_the_gate_invokes(self) -> None:
+        # Same reasoning as the tutorial registry above, one layer down. The gate
+        # delegates to sibling scripts, and a change to one of those changes what
+        # every tutorial replay does. A helper missing here routes the change
+        # past the job that would have caught it.
+        gate = (
+            Path(__file__).resolve().parents[2]
+            / "docs/site/scripts/check-evidence-tutorials.sh"
+        )
+        helpers = set(
+            re.findall(r"scripts/([A-Za-z0-9._-]+\.(?:sh|mjs))", gate.read_text())
+        )
+        self.assertTrue(helpers, "the gate must invoke at least one helper")
+        for helper in sorted(helpers):
+            with self.subTest(helper=helper):
+                self.assertIn(f"docs/site/scripts/{helper}", EVIDENCE_TUTORIAL_INPUTS)
+
+    def test_evidence_tutorial_routing(self) -> None:
+        infrastructure = (
+            "docs/site/scripts/check-evidence-tutorials.sh",
+            "docs/site/scripts/check-evidence-tutorials.test.mjs",
+            "docs/site/src/content/docs/tutorials/first-evidence-assertion.mdx",
+            "docs/site/package.json",
+        )
+        for path in infrastructure:
+            with self.subTest(path=path):
+                self.assertTrue(
+                    classify(self.workspace, (path,))["evidence_tutorial"]
+                )
+        self.assertTrue(
+            classify(self.workspace, ("crates/registry-evidence/src/runtime.rs",))[
+                "evidence_tutorial"
+            ]
+        )
+        self.assertTrue(
+            classify(self.workspace, ("crates/registry-evidencectl/src/scaffold.rs",))[
+                "evidence_tutorial"
+            ]
+        )
+        # The gate runs `mint` too, so a Mint change that breaks the served
+        # tutorial has to reach the job that replays it.
+        self.assertTrue(
+            classify(self.workspace, ("crates/registry-mint/src/lib.rs",))[
+                "evidence_tutorial"
+            ]
+        )
+        self.assertFalse(
+            classify(
+                self.workspace,
+                ("docs/site/src/content/docs/tutorials/author-registry-project.mdx",),
+            )["evidence_tutorial"]
+        )
+
     def test_reverse_dependencies_are_included(self) -> None:
         outputs = classify(
             self.workspace,
@@ -65,7 +183,6 @@ def test_reverse_dependencies_are_included(self) -> None:
         )
         self.assertIn("registry-platform-crypto", outputs["rust_packages"])
         self.assertIn("registry-relay", outputs["rust_packages"])
-        self.assertIn("registry-notary", outputs["rust_packages"])
         self.assertTrue(outputs["registryctl_tutorial"])
 
     def test_ci_workflow_change_runs_the_complete_matrix(self) -> None:
@@ -85,6 +202,44 @@ def test_docs_only_change_skips_rust(self) -> None:
         self.assertTrue(outputs["docs"])
         self.assertFalse(outputs["docs_archives"])
 
+    def test_evidence_code_and_product_contracts_select_its_shards_and_drift_gate(self) -> None:
+        for path in (
+            "crates/registry-evidence/src/source.rs",
+            "products/evidence/contracts/source-contract.yaml",
+            "products/evidence/reference/request-adapter/ADAPTER-API.md",
+            "products/evidence/reference/request-adapter/deployment-projects/dhis2-adult-status/bundle/fixtures/cases.yaml",
+        ):
+            with self.subTest(path=path):
+                outputs = classify(self.workspace, (path,))
+                self.assertTrue(outputs["evidence_contracts"])
+                self.assertIn("registry-evidence", outputs["rust_packages"])
+                # registry-mint dev-depends on registry-evidence so its
+                # compatibility test proves Evidence accepts a minted token.
+                # Changing Evidence must therefore run the mint shard too.
+                self.assertEqual(
+                    {entry["name"] for entry in outputs["rust_matrix"]["include"]},
+                    {"evidence", "mint"},
+                )
+
+    def test_current_contract_gates_replace_the_retired_notary_gate(self) -> None:
+        workflow = Path(".github/workflows/ci.yml").read_text(encoding="utf-8")
+        self.assertIn("\n  evidence-contracts:\n", workflow)
+        self.assertIn("products/evidence/scripts/check-contracts.sh", workflow)
+        self.assertIn(
+            "products/evidence/scripts/check-source-neutrality.sh", workflow
+        )
+        self.assertIn("\n  relay-contracts:\n", workflow)
+        self.assertIn("name: Relay OpenAPI contract", workflow)
+        self.assertNotIn("\n  notary-contracts:\n", workflow)
+        self.assertNotIn("notary_contracts", workflow)
+
+        rust_result = workflow.split("\n  rust-result:\n", 1)[1].split(
+            "\n  project-authoring-determinism:\n", 1
+        )[0]
+        self.assertIn("\n      - evidence-contracts\n", rust_result)
+        self.assertIn("\n      - relay-contracts\n", rust_result)
+        self.assertNotIn("\n      - notary-contracts\n", rust_result)
+
     def test_archive_content_is_immutable_during_routine_docs_changes(self) -> None:
         current_content = classify(
             self.workspace,
@@ -177,11 +332,9 @@ def test_authoring_reference_source_contract_has_independent_ci_coverage(self) -
                 "crates/registryctl/schemas/project-authoring/fixture.schema.json",
                 "crates/registryctl/schemas/project-authoring/entity.schema.json",
                 "schemas/registry-relay.config.schema.json",
-                "schemas/registry-notary.config.schema.json",
                 "crates/registryctl/schemas/project-authoring/parity-coverage.json",
                 "crates/registryctl/schemas/project-authoring/documentation-intent.json",
                 "crates/registry-relay/config/documentation-intent.json",
-                "crates/registry-notary-core/config/documentation-intent.json",
             ),
         )
         validate_authoring_reference_routing(
@@ -248,7 +401,6 @@ def test_public_project_authoring_modules_run_docs(self) -> None:
 
     def test_diagnostic_reference_inputs_run_docs(self) -> None:
         inputs = (
-            "crates/registry-notary-server/src/standalone/activation.rs",
             "crates/registry-platform-ops/src/lib.rs",
             "crates/registry-relay/src/consultation/**",
             "crates/registry-relay/src/process_startup.rs",
@@ -290,14 +442,6 @@ def test_first_country_docs_and_journey_routing_matrix(self) -> None:
                     "registryctl_tutorial": True,
                 },
             ),
-            (
-                "crates/registryctl/src/templates/notary_addon/registry-stack.yaml",
-                {
-                    "docs": True,
-                    "project_authoring": True,
-                    "registryctl_tutorial": True,
-                },
-            ),
             (
                 "crates/registryctl/schemas/project-reports/registry.project.explanation.v1.schema.json",
                 {
@@ -370,38 +514,6 @@ def test_first_country_docs_and_journey_routing_matrix(self) -> None:
                     "registryctl_tutorial": True,
                 },
             ),
-            (
-                "crates/registry-notary-server/src/standalone/activation.rs",
-                {
-                    "docs": True,
-                    "notary_contracts": True,
-                    "registryctl_tutorial": True,
-                },
-            ),
-            (
-                "crates/registry-notary/src/config_loader.rs",
-                {
-                    "docs": False,
-                    "notary_contracts": True,
-                    "registryctl_tutorial": True,
-                },
-            ),
-            (
-                "crates/registry-notary-core/src/config/root.rs",
-                {
-                    "docs": True,
-                    "notary_contracts": True,
-                    "registryctl_tutorial": True,
-                },
-            ),
-            (
-                "crates/registry-notary-server/src/runtime/evaluation.rs",
-                {
-                    "docs": False,
-                    "notary_contracts": True,
-                    "registryctl_tutorial": True,
-                },
-            ),
             (
                 "crates/registry-platform-ops/src/lib.rs",
                 {
@@ -491,14 +603,6 @@ def test_tutorial_package_dependencies_route_the_source_journey(self) -> None:
                 "README.md",
                 {"docs": False, "rust": False, "registryctl_tutorial": False},
             ),
-            (
-                "crates/registry-notary-client/src/lib.rs",
-                {
-                    "docs": False,
-                    "notary_contracts": True,
-                    "registryctl_tutorial": True,
-                },
-            ),
         )
 
         for path, expected in cases:
@@ -578,30 +682,6 @@ def test_unrelated_workflow_does_not_select_release_checks(self) -> None:
         self.assertFalse(outputs["release_tool"])
         self.assertFalse(outputs["release_source_proof"])
 
-    def test_nightly_notary_fuzz_inventory_matches_declared_targets(self) -> None:
-        workflow = Path(".github/workflows/nightly-security.yml").read_text(
-            encoding="utf-8"
-        )
-        target_block = re.search(
-            r"name: Run notary fuzz smoke.*?for target in \\\n"
-            r"(?P<targets>.*?)\n\s*do",
-            workflow,
-            flags=re.DOTALL,
-        )
-        self.assertIsNotNone(target_block)
-        configured = re.findall(
-            r"^\s+([a-z][a-z0-9_]*)",
-            target_block["targets"],
-            re.MULTILINE,
-        )
-
-        manifest = tomllib.loads(
-            Path("products/notary/fuzz/Cargo.toml").read_text(encoding="utf-8")
-        )
-        declared = [target["name"] for target in manifest["bin"]]
-        self.assertCountEqual(configured, declared)
-
-
 class RunCargoPackagesTest(unittest.TestCase):
     def test_builds_a_direct_cargo_argument_vector(self) -> None:
         packages = package_args('["registry-relay","registryctl"]')
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dee59cb8d..e3d56b884 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -43,8 +43,8 @@ jobs:
       rust_packages: ${{ steps.filter.outputs.rust_packages }}
       platform: ${{ steps.filter.outputs.platform }}
       platform_hygiene: ${{ steps.filter.outputs.platform_hygiene }}
-      notary_contracts: ${{ steps.filter.outputs.notary_contracts }}
       relay_contracts: ${{ steps.filter.outputs.relay_contracts }}
+      evidence_contracts: ${{ steps.filter.outputs.evidence_contracts }}
       project_authoring: ${{ steps.filter.outputs.project_authoring }}
       release_tool: ${{ steps.filter.outputs.release_tool }}
       release_source_proof: ${{ steps.filter.outputs.release_source_proof }}
@@ -52,6 +52,7 @@ jobs:
       docs_archives: ${{ steps.filter.outputs.docs_archives }}
       editors: ${{ steps.filter.outputs.editors }}
       registryctl_tutorial: ${{ steps.filter.outputs.registryctl_tutorial }}
+      evidence_tutorial: ${{ steps.filter.outputs.evidence_tutorial }}
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -116,20 +117,17 @@ jobs:
           set -euo pipefail
           "${RUNNER_TEMP}/bin/actionlint"
 
-      - name: Check advisory checker copies
-        run: python3 release/scripts/check_advisory_checker_copies.py
-
       - name: Test advisory baseline checkers
-        run: |
-          python3 -m unittest products/notary/tests/advisory_baseline_check_test.py
-          python3 -m unittest crates/registry-relay/tests/advisory_baseline_check_test.py
-
-      - name: Test advisory checker copy guard
-        run: python3 -m unittest release/scripts/test_check_advisory_checker_copies.py
+        run: python3 -m unittest crates/registry-relay/tests/advisory_baseline_check_test.py
 
       - name: Check Debian 13 image contract
         run: python3 release/scripts/check-debian13-images.py
 
+      - name: Test Mint demonstration support scripts
+        run: |
+          python3 -m unittest discover \
+            --start-directory crates/registry-mint/demo/support
+
   secrets:
     name: Secret scan
     runs-on: ubuntu-24.04
@@ -273,7 +271,6 @@ jobs:
       matrix:
         target:
           - authcommon_parsers
-          - oid4vci_request_and_proof
           - sdjwt_holder_proof
           - sdjwt_issuance
     steps:
@@ -437,17 +434,16 @@ jobs:
           df -h /
           du -sh target 2>/dev/null || true
 
-  notary-contracts:
-    name: Notary API contracts
+  evidence-contracts:
+    name: Evidence contracts and source neutrality
     needs: changes
-    if: needs.changes.outputs.notary_contracts == 'true'
+    if: needs.changes.outputs.evidence_contracts == 'true'
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
-          fetch-depth: 0
           persist-credentials: false
           submodules: false
 
@@ -458,37 +454,11 @@ jobs:
           cache-targets: false
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
-      - name: Install just
-        uses: taiki-e/install-action@25435dc8dd3baed7417e0c96d3fe89013a5b2e09 # v2.81.3
-        with:
-          tool: just@1.51.0
+      - name: Reproduce Evidence generated contracts
+        run: products/evidence/scripts/check-contracts.sh
 
-      - name: Install pinned oasdiff
-        shell: bash
-        run: |
-          set -euo pipefail
-          mkdir -p "${RUNNER_TEMP}/bin"
-          curl --fail --silent --show-error --location \
-            --output "${RUNNER_TEMP}/oasdiff.tar.gz" \
-            "https://github.com/oasdiff/oasdiff/releases/download/v${OASDIFF_VERSION}/oasdiff_${OASDIFF_VERSION}_linux_amd64.tar.gz"
-          echo "${OASDIFF_LINUX_X64_SHA256}  ${RUNNER_TEMP}/oasdiff.tar.gz" | sha256sum -c -
-          tar -xzf "${RUNNER_TEMP}/oasdiff.tar.gz" -C "${RUNNER_TEMP}/bin" oasdiff
-          chmod +x "${RUNNER_TEMP}/bin/oasdiff"
-          echo "${RUNNER_TEMP}/bin" >> "${GITHUB_PATH}"
-
-      - name: Notary OpenAPI baseline
-        working-directory: products/notary
-        run: just openapi-check
-
-      - name: Notary OpenAPI contract
-        working-directory: products/notary
-        env:
-          OPENAPI_CONTRACT_BASE_REF: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || github.event.before }}
-        run: just openapi-contract
-
-      - name: Notary exposure check
-        working-directory: products/notary
-        run: just exposure-check
+      - name: Enforce Evidence source-product neutrality
+        run: products/evidence/scripts/check-source-neutrality.sh
 
   relay-contracts:
     name: Relay API contracts
@@ -552,7 +522,7 @@ jobs:
       - rust-policy
       - rust-quality
       - rust-tests
-      - notary-contracts
+      - evidence-contracts
       - relay-contracts
     runs-on: ubuntu-24.04
     env:
@@ -711,15 +681,9 @@ jobs:
       - name: Test OpenID conformance runner
         run: python3 -m unittest release/scripts/test_openid_conformance_runner.py
 
-      - name: Test external integration evidence runner
-        run: python3 -m unittest release/scripts/test_integration_e2_runner.py
-
       - name: Test conformance candidate binding
         run: python3 -m unittest release/scripts/test_conformance_candidate.py
 
-      - name: Validate external integration evidence packet
-        run: python3 release/scripts/integration-e2-runner.py validate
-
       - name: Test Relay OIDC smoke
         run: python3 -m unittest release/scripts/test_relay_oidc_smoke.py
 
@@ -957,6 +921,82 @@ jobs:
             target/registryctl-tutorial-source \
             2>/dev/null || true
 
+  evidence-tutorials:
+    name: Evidence tutorials from source
+    needs: changes
+    if: needs.changes.outputs.evidence_tutorial == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 40
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          fetch-depth: 0
+          submodules: false
+
+      - name: Assert amd64 runner
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ "$(uname -m)" == "x86_64" ]]
+
+      - name: Setup Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: 22.12.0
+          cache: npm
+          cache-dependency-path: docs/site/package-lock.json
+
+      - name: Cache Cargo registry
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          shared-key: workspace-registry
+          cache-targets: false
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+
+      - name: Test the tutorial gate helpers
+        working-directory: docs/site
+        run: npm run test:tutorial:evidence
+
+      - name: Check tutorial command drift
+        working-directory: docs/site
+        run: npm run check:tutorial:evidence:dry-run
+
+      - name: Build the Evidence toolset under test
+        shell: bash
+        run: |
+          set -euo pipefail
+          CARGO_TARGET_DIR="target/evidence-tutorial-source" \
+            cargo build --locked --profile ci \
+            -p registry-evidence -p registry-evidencectl -p registry-mint
+
+      - name: Test the exact local Evidence lifecycle
+        shell: bash
+        env:
+          EVIDENCE_BIN: ${{ github.workspace }}/target/evidence-tutorial-source/ci/evidence
+          MINT_BIN: ${{ github.workspace }}/target/evidence-tutorial-source/ci/mint
+        run: |
+          set -euo pipefail
+          CARGO_TARGET_DIR="target/evidence-tutorial-source" \
+            cargo test --locked --profile ci \
+            -p registry-evidencectl --test dev_lifecycle -- \
+            --ignored --test-threads=1
+
+      - name: Execute the Evidence tutorials in a clean container
+        shell: bash
+        run: |
+          set -euo pipefail
+          # The image is the repository's pinned release-builder digest, used
+          # here only as a clean Debian userland: the gate exercises a shell
+          # and coreutils, and the toolset binaries are mounted in prebuilt.
+          docker run --rm \
+            --mount "type=bind,src=${PWD},dst=/work,readonly" \
+            --env EVIDENCE_BIN=/work/target/evidence-tutorial-source/ci/evidence \
+            --env EVIDENCECTL_BIN=/work/target/evidence-tutorial-source/ci/evidencectl \
+            --env MINT_BIN=/work/target/evidence-tutorial-source/ci/mint \
+            rust:1.95-trixie@sha256:f49565f188ee00bc2a18dd418183f2c5f23ef7d6e691890517ed341a598f67c3 \
+            bash /work/docs/site/scripts/check-evidence-tutorials.sh
+
   docs:
     name: Docs checks
     needs: changes
@@ -1130,6 +1170,7 @@ jobs:
       - release-tool
       - release-source-proof
       - registryctl-tutorials
+      - evidence-tutorials
       - docs
       - editor-extensions
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/nightly-rust-coverage.yml b/.github/workflows/nightly-rust-coverage.yml
index 711846f9f..b1317291e 100644
--- a/.github/workflows/nightly-rust-coverage.yml
+++ b/.github/workflows/nightly-rust-coverage.yml
@@ -57,7 +57,6 @@ jobs:
           flags = {
               "platform": "platform",
               "manifest": "manifest-unit",
-              "notary": "notary-unit",
               "relay": "relay-unit",
               "developer-tools": "developer-tools",
               "registryctl": "registryctl-unit",
@@ -72,19 +71,6 @@ jobs:
               }
               for name, packages in SHARDS.items()
           ]
-          matrix.append(
-              {
-                  "name": "notary-cel",
-                  "packages": "registry-notary registry-notary-server",
-                  "all_features": "false",
-                  "features": (
-                      "registry-notary/registry-notary-cel,"
-                      "registry-notary-server/cel-worker-fixture"
-                  ),
-                  "flag": "notary-cel",
-              }
-          )
-
           with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
               output.write(f"matrix={json.dumps({'include': matrix})}\n")
           PY
@@ -292,12 +278,3 @@ jobs:
         run: |
           df -h /
           du -sh "${CARGO_TARGET_DIR}" 2>/dev/null || true
-
-  notary-postgres:
-    name: Notary PostgreSQL coverage
-    permissions:
-      contents: read
-      id-token: write
-    uses: ./.github/workflows/notary-postgres-conformance.yml
-    with:
-      strict_coverage: true
diff --git a/.github/workflows/nightly-security.yml b/.github/workflows/nightly-security.yml
index 65165d86a..491ed049f 100644
--- a/.github/workflows/nightly-security.yml
+++ b/.github/workflows/nightly-security.yml
@@ -56,19 +56,22 @@ jobs:
               Cargo.toml|Cargo.lock|deny.toml|rust-toolchain*)
                 return 0
                 ;;
-              crates/registry-relay/*|crates/registry-notary*/*)
+              crates/registry-relay/*)
                 return 0
                 ;;
               crates/registry-platform-authcommon/*|crates/registry-platform-crypto/*)
                 return 0
                 ;;
-              crates/registry-platform-cache/*|crates/registry-platform-oid4vci/*|crates/registry-platform-replay/*|crates/registry-platform-sdjwt/*)
+              crates/registry-platform-sdjwt/*)
                 return 0
                 ;;
               crates/registry-manifest-core/*|crates/registry-manifest-cli/*)
                 return 0
                 ;;
-              products/notary/*|products/platform/*|products/manifest/*|release/docker/*)
+              products/platform/*|products/manifest/*|release/docker/*)
+                return 0
+                ;;
+              docker/*|.dockerignore)
                 return 0
                 ;;
               *)
@@ -118,9 +121,7 @@ jobs:
         run: |
           python3 -m unittest \
             crates/registry-relay/tests/security_assurance_check_test.py \
-            crates/registry-relay/tests/advisory_baseline_check_test.py \
-            products/notary/tests/security_assurance_check_test.py \
-            products/notary/tests/advisory_baseline_check_test.py
+            crates/registry-relay/tests/advisory_baseline_check_test.py
 
       - name: Relay exposure and container checks
         working-directory: crates/registry-relay
@@ -129,14 +130,7 @@ jobs:
           python3 scripts/check_security_assurance.py dockerfile-secrets
           python3 scripts/check_security_assurance.py openapi-strategy
 
-      - name: Notary container and OpenAPI checks
-        working-directory: products/notary
-        run: |
-          python3 scripts/check_security_assurance.py manifest
-          python3 scripts/check_security_assurance.py dockerfile-secrets
-          python3 scripts/check_security_assurance.py openapi-baseline
-
-      - name: Release image Dockerfile checks
+      - name: Release and adopter image Dockerfile checks
         run: |
           python3 - <<'PY'
           import re
@@ -147,7 +141,11 @@ jobs:
               r"\b(?:COPY|ADD)\b(?=.*(?:\.env|\.pem|\.key|\.p12|jwk|secret|credential))|\"d\"\s*:",
               re.IGNORECASE,
           )
+          # The adopter image is scanned beside the release ones: it is built from
+          # the same tree by anyone following the local-run docs, so baking key or
+          # credential material into it would leak just as widely.
           paths = sorted(Path("release/docker").glob("Dockerfile.registry-*"))
+          paths += sorted(Path("docker").glob("Dockerfile"))
           if not paths:
               print("security assurance check failed: no release Dockerfiles found", file=sys.stderr)
               sys.exit(1)
@@ -161,55 +159,6 @@ jobs:
                       sys.exit(1)
           PY
 
-  notary-fuzz:
-    name: Notary fuzz smoke
-    needs: changes
-    if: needs.changes.outputs.run == 'true'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        with:
-          persist-credentials: false
-          submodules: false
-
-      - name: Install Rust nightly
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # nightly
-        with:
-          toolchain: nightly
-
-      - name: Cache Cargo registry and build artifacts
-        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
-
-      - name: Install cargo-fuzz
-        uses: taiki-e/install-action@25435dc8dd3baed7417e0c96d3fe89013a5b2e09 # v2.81.3
-        with:
-          tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }}
-
-      - name: Run notary fuzz smoke
-        working-directory: products/notary
-        run: |
-          set -euo pipefail
-          for target in \
-            core_request_bodies
-          do
-            mkdir -p "fuzz/artifacts/${target}"
-            cargo +nightly fuzz run --fuzz-dir fuzz --target x86_64-unknown-linux-gnu "${target}" -- \
-              -max_total_time=60 \
-              -rss_limit_mb=1024 \
-              -artifact_prefix="fuzz/artifacts/${target}/" \
-              -print_final_stats=1
-          done
-
-      - name: Upload notary fuzz artifacts
-        if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: nightly-notary-fuzz-artifacts
-          path: products/notary/fuzz/artifacts
-          if-no-files-found: ignore
-
   platform-fuzz:
     name: Platform fuzz smoke
     needs: changes
@@ -242,7 +191,6 @@ jobs:
           set -euo pipefail
           for target in \
             authcommon_parsers \
-            oid4vci_request_and_proof \
             sdjwt_holder_proof \
             sdjwt_issuance
           do
@@ -317,7 +265,6 @@ jobs:
     needs:
       - changes
       - assurance
-      - notary-fuzz
       - platform-fuzz
       - manifest-fuzz
     if: needs.changes.outputs.run == 'true'
diff --git a/.github/workflows/notary-postgres-conformance.yml b/.github/workflows/notary-postgres-conformance.yml
deleted file mode 100644
index a256e1cd9..000000000
--- a/.github/workflows/notary-postgres-conformance.yml
+++ /dev/null
@@ -1,241 +0,0 @@
-name: Notary PostgreSQL conformance
-
-on:
-  workflow_call:
-    inputs:
-      strict_coverage:
-        description: Run coverage and fail the caller when the Codecov upload fails.
-        required: false
-        type: boolean
-        default: false
-  pull_request:
-    branches:
-      - main
-      - release/1.0
-    paths:
-      - .github/workflows/notary-postgres-conformance.yml
-      - Cargo.lock
-      - Cargo.toml
-      - rust-toolchain.toml
-      - crates/registry-notary/**
-      - crates/registry-notary-core/**
-      - crates/registry-notary-server/**
-      - crates/registry-notary-worker-harness/**
-      - crates/registry-platform-audit/**
-      - crates/registry-platform-authcommon/**
-      - crates/registry-platform-cache/**
-      - crates/registry-platform-crypto/**
-      - crates/registry-platform-ops/**
-      - crates/registry-platform-replay/**
-      - products/notary/scripts/postgresql-conformance.sh
-  merge_group:
-    types:
-      - checks_requested
-  push:
-    branches:
-      - main
-    paths:
-      - .github/workflows/notary-postgres-conformance.yml
-      - Cargo.lock
-      - Cargo.toml
-      - rust-toolchain.toml
-      - crates/registry-notary/**
-      - crates/registry-notary-core/**
-      - crates/registry-notary-server/**
-      - crates/registry-notary-worker-harness/**
-      - crates/registry-platform-audit/**
-      - crates/registry-platform-authcommon/**
-      - crates/registry-platform-cache/**
-      - crates/registry-platform-crypto/**
-      - crates/registry-platform-ops/**
-      - crates/registry-platform-replay/**
-      - products/notary/scripts/postgresql-conformance.sh
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  CARGO_LLVM_COV_VERSION: "0.8.7"
-  CARGO_TERM_COLOR: always
-  CARGO_TARGET_DIR: target/notary-postgres-conformance
-
-jobs:
-  state-plane:
-    name: Notary state plane (PostgreSQL ${{ matrix.postgresql }})
-    if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - postgresql: "16"
-            source_image: postgres:16.13-alpine
-            target_image: postgres:16.14-alpine
-          - postgresql: "17"
-            source_image: postgres:17.9-alpine
-            target_image: postgres:17.10-alpine
-          - postgresql: "18"
-            source_image: postgres:18.3-alpine
-            target_image: postgres:18.4-alpine
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-          submodules: false
-
-      - name: Cache Cargo registry and build artifacts
-        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
-        with:
-          key: notary-postgresql-pr-${{ matrix.postgresql }}
-
-      - name: Build Registry Notary with CEL support
-        run: cargo build --locked -p registry-notary --features registry-notary-cel
-
-      - name: Precompile PostgreSQL conformance tests before service startup
-        run: cargo test --locked -p registry-notary-server --lib --no-run
-
-      - name: Run Notary PostgreSQL conformance
-        env:
-          NOTARY_BIN: target/notary-postgres-conformance/debug/registry-notary
-          NOTARY_POSTGRES_SOURCE_IMAGE: ${{ matrix.source_image }}
-          NOTARY_POSTGRES_TARGET_IMAGE: ${{ matrix.target_image }}
-        run: |
-          set -euo pipefail
-          diagnostics="${RUNNER_TEMP}/notary-postgresql-${{ matrix.postgresql }}-docker-events.log"
-          docker events --format '{{json .}}' >"${diagnostics}" &
-          events_pid=$!
-          trap 'kill "${events_pid}" 2>/dev/null || true; wait "${events_pid}" 2>/dev/null || true' EXIT
-          products/notary/scripts/postgresql-conformance.sh "${{ matrix.postgresql }}"
-
-      - name: Report PostgreSQL Docker diagnostics
-        if: failure()
-        run: |
-          set -euo pipefail
-          diagnostics="${RUNNER_TEMP}/notary-postgresql-${{ matrix.postgresql }}-docker-events.log"
-          if [[ -s "${diagnostics}" ]]; then
-            sed -n '1,400p' "${diagnostics}"
-          else
-            echo "No Docker events were captured."
-          fi
-          docker ps --all --no-trunc
-          docker version
-
-  state-plane-coverage:
-    name: Notary state plane (PostgreSQL ${{ matrix.postgresql }})
-    if: >-
-      github.event_name == 'push' ||
-      github.event_name == 'workflow_dispatch' ||
-      inputs.strict_coverage
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    permissions:
-      contents: read
-      id-token: write
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - postgresql: "16"
-            source_image: postgres:16.13-alpine
-            target_image: postgres:16.14-alpine
-          - postgresql: "17"
-            source_image: postgres:17.9-alpine
-            target_image: postgres:17.10-alpine
-          - postgresql: "18"
-            source_image: postgres:18.3-alpine
-            target_image: postgres:18.4-alpine
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-          submodules: false
-
-      - name: Cache Cargo registry and build artifacts
-        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
-        with:
-          key: notary-postgresql-coverage-${{ matrix.postgresql }}
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-
-      - name: Install pinned coverage tool
-        uses: taiki-e/install-action@25435dc8dd3baed7417e0c96d3fe89013a5b2e09 # v2.81.3
-        with:
-          tool: cargo-llvm-cov@${{ env.CARGO_LLVM_COV_VERSION }}
-
-      - name: Build Registry Notary with CEL support
-        run: |
-          set -euo pipefail
-          cargo llvm-cov clean --workspace
-          eval "$(cargo llvm-cov show-env --sh)"
-          cargo build --locked -p registry-notary --features registry-notary-cel
-
-      - name: Precompile PostgreSQL conformance tests before service startup
-        run: |
-          set -euo pipefail
-          eval "$(cargo llvm-cov show-env --sh)"
-          cargo test --locked -p registry-notary-server --lib --no-run
-
-      - name: Run Notary PostgreSQL conformance
-        env:
-          NOTARY_BIN: target/notary-postgres-conformance/debug/registry-notary
-          NOTARY_POSTGRES_SOURCE_IMAGE: ${{ matrix.source_image }}
-          NOTARY_POSTGRES_TARGET_IMAGE: ${{ matrix.target_image }}
-        run: |
-          set -euo pipefail
-          diagnostics="${RUNNER_TEMP}/notary-postgresql-${{ matrix.postgresql }}-docker-events.log"
-          docker events --format '{{json .}}' >"${diagnostics}" &
-          events_pid=$!
-          trap 'kill "${events_pid}" 2>/dev/null || true; wait "${events_pid}" 2>/dev/null || true' EXIT
-          eval "$(cargo llvm-cov show-env --sh)"
-          products/notary/scripts/postgresql-conformance.sh "${{ matrix.postgresql }}"
-
-      - name: Report Notary PostgreSQL coverage
-        run: |
-          set -euo pipefail
-          eval "$(cargo llvm-cov show-env --sh)"
-          coverage_dir="target/notary-postgres-conformance/coverage"
-          mkdir -p "${coverage_dir}"
-          cargo llvm-cov report --locked \
-            -p registry-notary \
-            -p registry-notary-server
-          cargo llvm-cov report --locked \
-            -p registry-notary \
-            -p registry-notary-server \
-            --lcov \
-            --output-path "${coverage_dir}/notary-postgresql-${{ matrix.postgresql }}.lcov"
-
-      - name: Upload Notary PostgreSQL coverage
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: notary-postgresql-${{ matrix.postgresql }}-coverage
-          path: target/notary-postgres-conformance/coverage/
-          if-no-files-found: error
-
-      - name: Upload Notary PostgreSQL coverage to Codecov
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
-        with:
-          disable_search: true
-          fail_ci_if_error: ${{ inputs.strict_coverage }}
-          files: target/notary-postgres-conformance/coverage/notary-postgresql-${{ matrix.postgresql }}.lcov
-          flags: notary-postgres
-          name: notary-postgresql-${{ matrix.postgresql }}
-          use_oidc: true
-          version: v11.3.1
-
-      - name: Report PostgreSQL Docker diagnostics
-        if: failure()
-        run: |
-          set -euo pipefail
-          diagnostics="${RUNNER_TEMP}/notary-postgresql-${{ matrix.postgresql }}-docker-events.log"
-          if [[ -s "${diagnostics}" ]]; then
-            sed -n '1,400p' "${diagnostics}"
-          else
-            echo "No Docker events were captured."
-          fi
-          docker ps --all --no-trunc
-          docker version
diff --git a/.github/workflows/release-canary.yml b/.github/workflows/release-canary.yml
index b3cc70b9e..ef41ddb81 100644
--- a/.github/workflows/release-canary.yml
+++ b/.github/workflows/release-canary.yml
@@ -56,7 +56,6 @@ jobs:
           printf 'canary docs\n' > canary/bundle-root/registry-docs-${tag}.tar.gz
           printf '{"spdxVersion":"SPDX-2.3","name":"release-canary"}\n' \
             > canary/bundle-root/registry-stack-${tag}.sbom.spdx.json
-          notary_ref="ghcr.io/registrystack/registry-notary-candidate@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
           relay_ref="ghcr.io/registrystack/registry-relay-candidate@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
           postgresql_ref="$(tr -d '\n' < release/registryctl-postgresql-image.ref)"
           printf '%s\n' "${postgresql_ref}" \
@@ -84,7 +83,6 @@ jobs:
                 }
               }' > "${evidence_root}/grype/${name}.grype.json"
           }
-          write_image_reports registry-notary "${notary_ref}"
           write_image_reports registry-relay "${relay_ref}"
           write_image_reports postgresql "${postgresql_ref}"
           postgresql_digest="${postgresql_ref##*@}"
@@ -106,15 +104,12 @@ jobs:
             schema_version:"registry-stack.advisory-verdict.v2",
             verdict:"passed",
             subjects:[
-              "registry-notary-image",
               "registry-relay-image",
               "postgresql-runtime"
             ]
           }' > "${evidence_root}/advisory-verdict.json"
           cp "${evidence_root}/grype/registry-relay.grype.json" \
             canary/bundle-root/security/registry-relay.grype.json
-          cp "${evidence_root}/grype/registry-notary.grype.json" \
-            canary/bundle-root/security/registry-notary.grype.json
           cp "${evidence_root}/advisory-verdict.json" \
             canary/bundle-root/security/advisory-verdict.json
           evidence_name="registry-stack-${tag}-security-evidence.tar.gz"
@@ -127,7 +122,6 @@ jobs:
           sbom_sha="$(sha256sum canary/bundle-root/registry-stack-${tag}.sbom.spdx.json | awk '{print $1}')"
           evidence_sha="$(sha256sum "canary/bundle-root/${evidence_name}" | awk '{print $1}')"
           relay_scan_sha="$(sha256sum canary/bundle-root/security/registry-relay.grype.json | awk '{print $1}')"
-          notary_scan_sha="$(sha256sum canary/bundle-root/security/registry-notary.grype.json | awk '{print $1}')"
           advisory_sha="$(sha256sum canary/bundle-root/security/advisory-verdict.json | awk '{print $1}')"
           payload_size="$(stat -c %s canary/bundle-root/registryctl-${tag}-linux-amd64)"
           docs_size="$(stat -c %s canary/bundle-root/registry-docs-${tag}.tar.gz)"
@@ -159,7 +153,6 @@ jobs:
             --arg evidence_sha "${evidence_sha}" \
             --argjson evidence_size "${evidence_size}" \
             --arg relay_scan_sha "${relay_scan_sha}" \
-            --arg notary_scan_sha "${notary_scan_sha}" \
             --arg advisory_sha "${advisory_sha}" \
             --arg bundle_sha "${bundle_sha}" \
             --argjson bundle_size "${bundle_size}" \
@@ -209,14 +202,6 @@ jobs:
                 }
               ],
               images: [
-                {
-                  name: "registry-notary",
-                  candidate_ref:
-                    "ghcr.io/registrystack/registry-notary-candidate@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-                  digest:
-                    "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-                  final_ref: ("ghcr.io/registrystack/registry-notary:" + $tag)
-                },
                 {
                   name: "registry-relay",
                   candidate_ref:
@@ -235,12 +220,6 @@ jobs:
                 sha256: $sbom_sha
               },
               scans: [
-                {
-                  image: "registry-notary",
-                  name: "security/registry-notary.grype.json",
-                  sha256: $notary_scan_sha,
-                  status: "passed"
-                },
                 {
                   image: "registry-relay",
                   name: "security/registry-relay.grype.json",
@@ -305,7 +284,6 @@ jobs:
           python3 release/scripts/release_candidate.py verify-canary \
             --metadata canary/trusted-canary-run.json \
             --workflow-revision "${workflow_revision}"
-          python3 products/notary/tests/advisory_baseline_check_test.py
           python3 crates/registry-relay/tests/advisory_baseline_check_test.py
           jq -n \
             --arg tag "${tag}" \
diff --git a/.github/workflows/release-candidate.yml b/.github/workflows/release-candidate.yml
index cee2b431e..04eb23950 100644
--- a/.github/workflows/release-candidate.yml
+++ b/.github/workflows/release-candidate.yml
@@ -131,7 +131,7 @@ jobs:
             echo "GitHub Release destination is not absent" >&2
             exit 1
           fi
-          for package in registry-notary registry-relay; do
+          for package in registry-relay; do
             versions="${RUNNER_TEMP}/${package}-versions.json"
             gh api --paginate --slurp \
               "/orgs/${IMAGE_NAMESPACE}/packages/container/${package}/versions?per_page=100" \
@@ -187,8 +187,6 @@ jobs:
           REGISTRY_RELEASE_SOURCE_MODE=monorepo \
             release/scripts/check-release-source-model.sh
           release/scripts/check-debian13-images.py
-          python3 -m unittest \
-            release/scripts/test_check_advisory_checker_copies.py
 
   build-canonical:
     name: Build Linux payload, private images, and docs once
@@ -240,7 +238,7 @@ jobs:
         run: |
           set -euo pipefail
           mkdir -p dist/images
-          for name in registry-notary registry-relay; do
+          for name in registry-relay; do
             package="${name}-candidate"
             candidate="${REGISTRY}/${IMAGE_NAMESPACE}/${package}:candidate-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
             metadata="dist/images/${name}.metadata.json"
@@ -372,7 +370,8 @@ jobs:
           rustup toolchain install 1.95.0 \
             --profile minimal --target "${{ matrix.target }}"
           cargo build --release --locked \
-            -p registryctl --target "${{ matrix.target }}"
+            -p registryctl -p registry-evidence -p registry-evidencectl \
+            -p registry-mint --target "${{ matrix.target }}"
           mkdir -p platform
           asset="registryctl-${{ needs.validate.outputs.tag }}-${{ matrix.asset }}"
           cp "target/${{ matrix.target }}/release/registryctl" "platform/${asset}"
@@ -380,6 +379,12 @@ jobs:
           release/scripts/registry-release verify-registryctl-binary-version \
             "platform/${asset}" \
             --version "${{ needs.validate.outputs.version }}"
+          for evidence_binary in evidence evidencectl mint; do
+            asset="${evidence_binary}-${{ needs.validate.outputs.tag }}-${{ matrix.asset }}"
+            cp "target/${{ matrix.target }}/release/${evidence_binary}" \
+              "platform/${asset}"
+            chmod 0755 "platform/${asset}"
+          done
           mkdir -p candidate-platform
           mv platform candidate-platform/platform
 
@@ -470,7 +475,7 @@ jobs:
         run: |
           set -euo pipefail
           canonical="inputs/candidate-canonical-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
-          for name in registry-notary registry-relay; do
+          for name in registry-relay; do
             expected_label_args=()
             if [[ "${name}" == registry-relay ]]; then
               expected_label_args+=(
@@ -496,7 +501,7 @@ jobs:
           printf '%s' "${GH_TOKEN}" \
             | oras login "${REGISTRY}" \
                 --username "${GITHUB_ACTOR}" --password-stdin
-          for name in registry-notary registry-relay; do
+          for name in registry-relay; do
             package="${name}-candidate"
             test "$(
               gh api "/orgs/${IMAGE_NAMESPACE}/packages/container/${package}" \
@@ -589,7 +594,7 @@ jobs:
               exit 1
             fi
           }
-          for name in registry-notary registry-relay; do
+          for name in registry-relay; do
             candidate_ref="$(tr -d '\n' < "${canonical}/dist/images/${name}.digest")"
             digest="${candidate_ref##*@}"
             test "$(crane digest "${candidate_ref}")" = "${digest}"
@@ -639,10 +644,6 @@ jobs:
             echo "Exported PostgreSQL rootfs contains a forbidden special file" >&2
             exit 1
           fi
-          python3 products/notary/scripts/check_advisory_baselines.py \
-            grype candidate/security/grype/registry-notary.grype.json \
-            --syft-report candidate/security/syft/registry-notary.syft.json \
-            --subject registry-notary-image
           python3 crates/registry-relay/scripts/check_advisory_baselines.py \
             grype candidate/security/grype/registry-relay.grype.json \
             --syft-report candidate/security/syft/registry-relay.syft.json \
@@ -657,7 +658,6 @@ jobs:
             schema_version: "registry-stack.advisory-verdict.v2",
             verdict: "passed",
             subjects: [
-              "registry-notary-image",
               "registry-relay-image",
               "postgresql-runtime"
             ]
@@ -680,7 +680,22 @@ jobs:
           installer="registryctl-${{ needs.validate.outputs.tag }}-install.sh"
           cp crates/registryctl/install.sh "candidate/bundle-root/${installer}"
           chmod 0755 "candidate/bundle-root/${installer}"
-          for name in registry-notary registry-relay; do
+          evidencectl_installer="evidencectl-${{ needs.validate.outputs.tag }}-install.sh"
+          awk -v version="${{ needs.validate.outputs.tag }}" '
+            $0 == "default_version=\"\"" {
+              print "default_version=\"" version "\""
+              rendered = 1
+              next
+            }
+            { print }
+            END { if (!rendered) exit 1 }
+          ' crates/registry-evidencectl/install.sh \
+            > "candidate/bundle-root/${evidencectl_installer}"
+          chmod 0755 "candidate/bundle-root/${evidencectl_installer}"
+          cp "candidate/bundle-root/${evidencectl_installer}" \
+            candidate/bundle-root/evidencectl-install.sh
+          chmod 0755 candidate/bundle-root/evidencectl-install.sh
+          for name in registry-relay; do
             candidate_ref="$(tr -d '\n' < "${canonical}/dist/images/${name}.digest")"
             digest="${candidate_ref##*@}"
             printf '%s\n' "${REGISTRY}/${IMAGE_NAMESPACE}/${name}@${digest}" \
@@ -689,7 +704,6 @@ jobs:
           release/scripts/registry-release render-registryctl-image-lock \
             "${{ needs.validate.outputs.manifest }}" \
             --relay-digest "${RUNNER_TEMP}/registry-relay.release.digest" \
-            --notary-digest "${RUNNER_TEMP}/registry-notary.release.digest" \
             --postgresql-ref-file release/registryctl-postgresql-image.ref \
             --tag-target "${{ needs.validate.outputs.source_sha }}" \
             --source-sha "${{ needs.validate.outputs.source_sha }}" \
@@ -702,7 +716,7 @@ jobs:
             "candidate/bundle-root/registry-stack-${{ needs.validate.outputs.tag }}-security-evidence.tar.gz" \
             -C candidate/security \
               images image-sbom syft grype advisory-verdict.json
-          for name in registry-notary registry-relay; do
+          for name in registry-relay; do
             cp "candidate/security/grype/${name}.grype.json" \
               candidate/bundle-root/
           done
@@ -727,8 +741,6 @@ jobs:
                 "candidate/bundle-root/registryctl-${{ needs.validate.outputs.tag }}-image-lock.json" \
               --relay-image-index \
                 "${RUNNER_TEMP}/registry-relay.index.json" \
-              --notary-image-index \
-                "${RUNNER_TEMP}/registry-notary.index.json" \
               --postgresql-image-index \
                 "${RUNNER_TEMP}/postgresql.index.json" \
               --output "${RUNNER_TEMP}/registry-release-lock.payload.json"
@@ -773,7 +785,7 @@ jobs:
                 done | jq -s .
           )"
           images="$(
-            for name in registry-notary registry-relay; do
+            for name in registry-relay; do
               candidate_ref="$(tr -d '\n' < "${canonical}/dist/images/${name}.digest")"
               digest="${candidate_ref##*@}"
               jq -n \
@@ -785,7 +797,7 @@ jobs:
             done | jq -s .
           )"
           scans="$(
-            for name in registry-notary registry-relay; do
+            for name in registry-relay; do
               file="candidate/bundle-root/${name}.grype.json"
               jq -n \
                 --arg image "${name}" \
diff --git a/.github/workflows/release-repeatability.yml b/.github/workflows/release-repeatability.yml
index 3d0d90c3d..cab59437f 100644
--- a/.github/workflows/release-repeatability.yml
+++ b/.github/workflows/release-repeatability.yml
@@ -128,13 +128,39 @@ jobs:
         run: |
           set -euo pipefail
           mkdir -p proof
-          expected=(
-            "registry-manifest-${TAG}-linux-amd64"
-            "registry-notary-${TAG}-linux-amd64"
-            "registry-notary-cel-worker-${TAG}-linux-amd64"
-            "registry-relay-${TAG}-linux-amd64"
-            "registry-relay-rhai-worker-${TAG}-linux-amd64"
-            "registryctl-${TAG}-linux-amd64"
+          mapfile -t expected < <(
+            python3 - "source" "${TAG}" <<'PY'
+          import glob
+          import sys
+
+          import yaml
+
+          root, tag = sys.argv[1:]
+          version = tag.removeprefix("v")
+          matches = []
+          for path in glob.glob(f"{root}/release/manifests/registry-stack-*.yaml"):
+              with open(path, encoding="utf-8") as handle:
+                  data = yaml.safe_load(handle)
+              if str(data.get("stack", {}).get("version", "")) == version:
+                  matches.append(data)
+          if len(matches) != 1:
+              raise SystemExit(f"expected one release manifest for {version}")
+          artifacts = matches[0].get("artifacts", {})
+          binary_names = {
+              "evidence": "evidence",
+              "evidencectl": "evidencectl",
+              "mint": "mint",
+              "registry-manifest-cli": "registry-manifest",
+              "registry-notary": "registry-notary",
+              "registry-notary-cel-worker": "registry-notary-cel-worker",
+              "registry-relay": "registry-relay",
+              "registry-relay-rhai-worker": "registry-relay-rhai-worker",
+              "registryctl": "registryctl",
+          }
+          for artifact, asset in sorted(binary_names.items()):
+              if artifact in artifacts:
+                  print(f"{asset}-{tag}-linux-amd64")
+          PY
           )
           for asset in "${expected[@]}"; do
             test -s "published/${asset}"
@@ -177,7 +203,11 @@ jobs:
           set -euo pipefail
           image_lock="published/registryctl-${TAG}-image-lock.json"
           mkdir -p proof/image-layouts
-          for name in registry-notary registry-relay; do
+          mapfile -t product_images < <(
+            jq -er '.images | keys[] | select(startswith("registry-"))' \
+              "${image_lock}"
+          )
+          for name in "${product_images[@]}"; do
             published_ref="$(jq -er --arg name "${name}" '.images[$name]' "${image_lock}")"
             published_layout="proof/image-layouts/${name}-published"
             rebuilt_layout="${GITHUB_WORKSPACE}/proof/image-layouts/${name}-rebuilt"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7f6944b45..66cfa473a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -795,7 +795,7 @@ jobs:
           PY
           )"
           mkdir -p "${RUNNER_TEMP}/release-image-indexes"
-          for name in registry-notary registry-relay; do
+          for name in registry-relay; do
             index_digest="$(jq -er --arg name "${name}" \
               '.images[] | select(.name == $name) | .digest
                | select(test("^sha256:[0-9a-f]{64}$"))' "${candidate}")"
@@ -817,7 +817,6 @@ jobs:
           release/scripts/registry-release render-registryctl-image-lock \
             "${release_manifest}" \
             --relay-digest "${RUNNER_TEMP}/registry-relay.release.digest" \
-            --notary-digest "${RUNNER_TEMP}/registry-notary.release.digest" \
             --postgresql-ref-file release/registryctl-postgresql-image.ref \
             --tag-target "${{ needs.verify.outputs.source_sha }}" \
             --source-sha "${{ needs.verify.outputs.workflow_revision }}" \
diff --git a/.gitignore b/.gitignore
index 73396c81e..69648d06c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,8 +10,15 @@ __pycache__/
 
 .DS_Store
 
-# Local agent tooling (private skills are symlinked here; never commit)
-/.claude/
+# Local agent tooling (private skills are symlinked here; never commit).
+# Only the shared project commands in /.claude/commands/ are tracked.
+/.claude/*
+!/.claude/commands/
 /.playwright-mcp/
 /worktrees/
 /*.png
+
+# Evidence local operator material. Never commit credentials or curl artifacts.
+/products/evidence/.env
+/products/evidence/.first-curl/
+/products/evidence/.sd-jwt-vc-demo/
diff --git a/.gitleaks.toml b/.gitleaks.toml
index 31c6096ba..97cb27724 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -16,30 +16,17 @@ paths = ["^editors/vscode/\\.vscode-test/"]
 [[allowlists]]
 description = "Allow synthetic JWT fixtures used only by the platform fuzz harnesses."
 paths = [
-  "^products/platform/fuzz/corpus/oid4vci_request_and_proof/credential_request\\.json$",
-  "^products/platform/fuzz/corpus/oid4vci_request_and_proof/valid-proof-jwt$",
   "^products/platform/fuzz/corpus/sdjwt_holder_proof/holder_proof\\.jwt$",
   "^products/platform/fuzz/corpus/sdjwt_holder_proof/valid-holder-proof-jwt$",
 ]
 
-[[allowlists]]
-description = "Allow fixed identifiers and JWTs in the public Notary OpenAPI example."
-regexTarget = "match"
-regexes = [
-  '''credential:01HX7Y5F2WAJ7ZP0Q4M5K9E8NC''',
-  '''eyJhbGciOiJFZERTQSIsInR5cCI6ImRjK3NkLWp3dCIsImtpZCI6ImRpZDp3ZWI6YWdyaWN1bHR1cmUuZGVtby5leGFtcGxlLmdvdi''',
-]
-
 [[allowlists]]
 description = "Allow fixed non-secret values used by tests and configuration examples."
 regexTarget = "line"
 regexes = [
-  '''oid4vci_preauth_enabled:\s*self\.oid4vci\.enabled''',
-  '''std::env::set_var\(SECRET_ENV,\s*"0123456789abcdef0123456789abcdef"\)''',
   '''let key = Pkcs1RsaPrivateKey''',
   '''chain_key_epoch_id:\s*[a-z0-9-]+-chain-1''',
   '''"dci_crvs_api":\s*"5e31d1e381d4bd8c7c74112d714fd49d263c6df7"''',
-  '''"key_path":\s*"oid4vci\.(?:enabled|nonce\.ttl_seconds|proof\.max_age_seconds)"''',
   '''"AKIAABCDEFGHIJKLMNOP"''',
   '''"eyJhbGciOiJSUzI1NiJ9\.eyJzdWIiOiJzdWJqZWN0In0\.abcdefghijklmnop"''',
 ]
@@ -49,9 +36,3 @@ description = "Allow synthetic OpenCRVS response JWTs used by registryctl projec
 paths = [
   "^crates/registryctl/tests/fixtures/project-authoring/opencrvs(?:-country-variant)?/integrations/birth-record/fixtures/bodies/(?:ambiguous|match|no-match)\\.json$",
 ]
-
-[[allowlists]]
-description = "Allow synthetic Notary holder-proof fixtures generated from repository test keys."
-paths = [
-  "^products/notary/tests/fixtures/sd_jwt_vc/holder-proof-(?:eddsa|es256-unsupported|mismatch)\\.(?:jwt|sd-jwt)$",
-]
diff --git a/AGENTS.md b/AGENTS.md
index 0c669b6b8..aedfc5ed8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -3,31 +3,103 @@
 This is the Registry Stack monorepo: registry-facing services over data
 institutions already hold. Pre-1.0; APIs and deployment contracts may change.
 
-Two runtime patterns anchor everything:
+Two independent runtime patterns are relevant:
 
 - **Registry Relay** exposes protected, scoped, read-only HTTP APIs over
   existing sources.
-- **Registry Notary** certifies evidence: claim evaluation, credential
-  issuance, disclosure policy, audit provenance.
+- **Evidence** returns signed, minimum-disclosure assertions from fixed
+  requests to authoritative sources.
+
+The two patterns compose without merging their product boundaries: Evidence
+may use a Relay-protected API as a fixed HTTP source.
 
 Registry Manifest describes sources portably; Relay is its consumer in code
-(Notary does not depend on the manifest crates). `registry-platform-*` crates
-are shared primitives. `registryctl` is adopter tooling.
+and `registry-platform-*` crates are shared primitives. `registryctl` is Relay
+adopter tooling; `registry-evidencectl` is Evidence adopter tooling.
+
+Registry Mint is a supporting service, not a third pattern: it issues the
+access tokens a resource server such as Evidence verifies, for deployments with
+no identity provider. The dependency runs one way only. Mint's tests drive
+Evidence's authenticator; Evidence does not depend on Mint.
 
 ## Repository map
 
 | Area | Owns |
 |---|---|
 | `crates/registry-relay` | Protected read APIs (Relay) |
-| `crates/registry-notary*` | Evidence gateway: server, core, client, source adapters, worker harness (Notary) |
+| `crates/registry-evidence` | Single-crate Evidence runtime and `evidence` binary |
+| `crates/registry-evidencectl` | Evidence adopter tooling (`evidencectl`): key material, incomplete OpenAPI authoring workspaces, fixture runs for complete projects |
+| `crates/registry-mint` | Short-lived access tokens for registered clients, and the `mint` binary |
 | `crates/registry-manifest-*` | Manifest core types and CLI |
-| `crates/registry-platform-*` | Shared primitives: audit, authcommon, cache, config, crypto, httpsec, httputil, oid4vci, oidc, ops, pdp, replay, sdjwt, sts, testing |
-| `crates/registryctl` | Adopter tooling |
+| `crates/registry-platform-*` | Shared primitives used by the maintained runtimes and tooling |
+| `crates/registryctl` | Relay adopter tooling |
 | `products/` | Product-owned specs, examples, fixtures, docs (not crates) |
 | `docs/site/` | Public docs site (Astro). Has its own `AGENTS.md`; read it before touching this subtree |
 | `release/` | Release manifests, schemas, notes, validation and conformance tooling, and the release source-model proof |
 | `external/` | Notes on inputs that intentionally stay out of this tree (e.g. Crosswalk stays a pinned git dependency) |
 
+## Evidence product boundary
+
+Evidence is its own minimum-disclosure assertion product, not a Relay mode.
+Evidence may consume a Relay-protected API through its ordinary fixed HTTP
+source contract, but it does not inherit Relay's authorization or policy
+model. Evidence serializes the same stateless assertion as a signed flattened
+JWS or, under its own frozen profile, as an SD-JWT VC response. The latter is a
+second encoding of one response, never a credential lifecycle.
+
+The runtime implementation is one `registry-evidence` crate and one `evidence`
+binary. It may reuse narrowly applicable `registry-platform-*`
+primitives such as audit, crypto, OIDC, HTTP security, SD-JWT serialization,
+and testing.
+
+`registry-evidencectl` (`evidencectl`) is adopter tooling beside the runtime,
+like `registryctl` is for the rest of the stack. It sits outside the frozen
+Version 1 runtime contract: it generates key material, starts incomplete
+OpenAPI authoring workspaces, and drives fixture runs for complete deployment
+projects, but it shells out to the `evidence` binary for every Evidence semantic
+decision and never re-implements evaluation, signing, or verification. Its
+source is covered by the same source-product and domain neutrality checks as
+the runtime.
+
+Evidence configuration and scripts are trusted, startup-only deployment
+artifacts. Rust owns authentication, authorization, fixed source execution,
+bounded script execution, output validation, evidence construction, signing,
+and audit. Rhai owns bounded request preparation, source extraction, and
+requirement-specific derivation, using only deterministic, bounded,
+domain-neutral primitives supplied by Rust.
+Adult status, residence region, professional licence status, and legal-parent
+relationship are coequal full-path Evidence acceptance definitions. None may
+become a Rust domain type, built-in operation, special route, or implementation
+phase.
+
+Evidence implementation changes require its approved Version 1 contracts,
+schedule, and Definition of Done to remain aligned in tracked product material.
+Do not call the product implemented when only one assertion case or a subset of
+that DoD passes. Stop before the approved concept's non-goals and future
+profiles.
+
+Evidence source compatibility is proven with sanitized local mocks in ordinary
+tests. Public demo checks are opt-in, ignored, read-only local tests after the
+mock suite passes. Credentials, tokens, live responses, demo-subject
+identifiers, and human login or two-factor details must not be committed,
+logged, placed in snapshots, or passed on command lines.
+The provider-published shared credentials for the public DHIS2 demo at
+`https://play.im.dhis2.org/stable-2-43-1/` are a documentation-only exception:
+public tutorials may state them and place them in ignored, owner-only local
+files.
+The provider-published human login credentials and synthetic Josh Hoeger record
+identifiers for the public OpenCRVS Farajaland integration demo are a second
+documentation-only exception. Public tutorials may state them so readers can
+inspect the same synthetic record, use its stated selectors in tutorial
+commands, and create their own Record Search client.
+The exceptions do not cover OAuth client credentials created by a reader,
+tokens, live responses, real identifiers, other demo-subject identifiers in
+tracked files, logs, or snapshots.
+
+DHIS2 and OpenCRVS names and behavior are test-only. Evidence production code,
+dependencies, Cargo features, public configuration schemas, routes, and CLI
+options must remain source-product neutral.
+
 The adopter demo is maintained separately in
 [`registrystack/solmara-lab`](https://github.com/registrystack/solmara-lab).
 
@@ -48,16 +120,21 @@ Root CI's `rust` job runs `cargo fmt --check`, `cargo check --locked
 --workspace --all-targets`, `cargo clippy --workspace --all-targets --
 -D warnings`, `cargo test --locked --workspace`, the full `cargo deny check`
 (advisories included; unresolvable RUSTSEC advisories carry scoped ignores in
-`deny.toml` with review triggers), and the OpenAPI drift checks for both
-products (`just openapi-check` from `products/notary`, `just openapi-contract`
-from `crates/registry-relay`). cargo-deny needs v0.19+ to parse this
-`deny.toml`; CI pins 0.19.8.
+`deny.toml` with review triggers), and the Relay OpenAPI drift check
+(`just openapi-contract` from `crates/registry-relay`). cargo-deny needs v0.19+
+to parse this `deny.toml`; CI pins 0.19.8.
+
+Evidence-specific contracts and source neutrality:
+
+```bash
+products/evidence/scripts/check-contracts.sh
+products/evidence/scripts/check-source-neutrality.sh
+```
 
 Release source checks:
 
 ```bash
 python3 -m unittest release/scripts/test_registry_release.py
-python3 -m unittest release/scripts/test_openid_conformance_runner.py
 release/scripts/registry-release validate release/manifests/<current>.yaml
 REGISTRY_RELEASE_SOURCE_MODE=monorepo release/scripts/check-release-source-model.sh
 python3 -m unittest release/scripts/test_check_release_source_model.py
@@ -68,7 +145,7 @@ Docs site (from `docs/site/`): `npm test` and `npm run check`.
 ## Rules that bite
 
 - Every commit needs a DCO sign-off: `git commit -s`.
-- Commit subjects: imperative mood; `fix(notary):` / `feat(relay):` style
+- Commit subjects: imperative mood; `feat(relay):` and `feat(evidence):` style
   prefixes are the norm for product-scoped changes.
 - History may be rewritten during review (session commits get squashed). In
   durable docs, cite only commits reachable from pushed `main`, and prefer
@@ -76,7 +153,7 @@ Docs site (from `docs/site/`): `npm test` and `npm run check`.
 - Major functionality and bug fixes require automated tests with the change.
 - Keep a change scoped to one owning area (`crates/`, `products/`,
   `docs/site/`, `release/`).
-- Changes to authentication, authorization, credential issuance, signing,
+- Changes to authentication, authorization, assertion evaluation or signing,
   audit integrity, release provenance, deployment defaults, or data
   minimization are security-sensitive and need explicit review notes.
 - Generated outputs (OpenAPI under `docs/site/openapi/`, `docs/site`
@@ -84,7 +161,7 @@ Docs site (from `docs/site/`): `npm test` and `npm run check`.
   generator commands, never hand-edited, and must be bit-for-bit repeatable.
   If you change an HTTP endpoint, regenerating and committing the OpenAPI
   documents is part of the change, not a follow-up.
-- Suspected vulnerabilities (credential disclosure, auth bypass, audit
+- Suspected vulnerabilities (minimum-disclosure failure, auth bypass, audit
   redaction failure, connector data leakage, signing key handling) go through
   `SECURITY.md`, never public issues or PRs.
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index b3e9a5a77..0e10d131d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -55,10 +55,10 @@ Every pull request should make the review path clear:
   check was skipped and why.
 - Include tests for major functionality and bug fixes. If a test cannot be
   added, explain why in the pull request.
-- Treat changes to authentication, authorization, credential issuance, signing,
-  audit integrity, release provenance, deployment defaults, or data minimization
-  as security-sensitive. These changes need explicit maintainer review notes,
-  even when the maintainer is also the author.
+- Treat changes to authentication, authorization, assertion evaluation or
+  signing, audit integrity, release provenance, deployment defaults, or data
+  minimization as security-sensitive. These changes need explicit maintainer
+  review notes, even when the maintainer is also the author.
 
 ## Dependency Changes
 
@@ -129,7 +129,6 @@ cargo check --locked --workspace --all-targets
 cargo clippy --workspace --all-targets -- -D warnings
 cargo test --locked --workspace
 cargo deny check
-(cd products/notary && just openapi-check)
 (cd crates/registry-relay && just openapi-contract)
 ```
 
@@ -144,8 +143,7 @@ These checks require Python 3.11 or later.
 
 ```bash
 python3 -m unittest release/scripts/test_registry_release.py
-python3 -m unittest release/scripts/test_openid_conformance_runner.py
-release/scripts/registry-release validate release/manifests/registry-stack-beta-17.yaml
+release/scripts/registry-release validate release/manifests/registry-stack-beta-27.yaml
 release/scripts/registry-release audit release/manifests/import-map-2026-06-24.yaml
 REGISTRY_RELEASE_SOURCE_MODE=monorepo release/scripts/check-release-source-model.sh
 python3 -m unittest release/scripts/test_check_release_source_model.py
@@ -183,6 +181,7 @@ same source can reproduce it exactly.
 
 ## Security Reports
 
-Do not open public issues or pull requests for suspected credential disclosure,
-auth bypass, audit redaction failure, source connector data leakage, signing key
-handling bugs, or other vulnerabilities. Follow [SECURITY.md](SECURITY.md).
+Do not open public issues or pull requests for suspected minimum-disclosure
+failure, auth bypass, audit redaction failure, source connector data leakage,
+signing key handling bugs, or other vulnerabilities. Follow
+[SECURITY.md](SECURITY.md).
diff --git a/Cargo.lock b/Cargo.lock
index 9ce5ee5cf..f712f3345 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1155,6 +1155,15 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
 
+[[package]]
+name = "convert_case"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9"
+dependencies = [
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "cookie"
 version = "0.18.1"
@@ -1306,6 +1315,33 @@ version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
+[[package]]
+name = "crossterm"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8b9f2e4c67f833b660cdb0a3523065869fb35570177239812ed4c905aeff87b"
+dependencies = [
+ "bitflags 2.13.0",
+ "crossterm_winapi",
+ "derive_more",
+ "document-features",
+ "mio",
+ "parking_lot",
+ "rustix",
+ "signal-hook",
+ "signal-hook-mio",
+ "winapi",
+]
+
+[[package]]
+name = "crossterm_winapi"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acdd7c62a3665c7f6830a51635d9ac9b23ed385797f70a83bb8bafe9c572ab2b"
+dependencies = [
+ "winapi",
+]
+
 [[package]]
 name = "crosswalk-cel"
 version = "0.2.0"
@@ -1437,28 +1473,6 @@ dependencies = [
  "hybrid-array",
 ]
 
-[[package]]
-name = "cryptoki"
-version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff765b99fc49f3116c9a908484486a2b92fd73c48da45c3a69716471c6cc56c6"
-dependencies = [
- "bitflags 2.13.0",
- "cryptoki-sys",
- "libloading",
- "log",
- "secrecy",
-]
-
-[[package]]
-name = "cryptoki-sys"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1fd850498411e4057f1cba79e6e2bc7cbe960544c1046ab46d4685c403a1121"
-dependencies = [
- "libloading",
-]
-
 [[package]]
 name = "csv"
 version = "1.4.0"
@@ -2251,9 +2265,6 @@ name = "deadpool-runtime"
 version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "092966b41edc516079bdf31ec78a2e0588d1d0c08f78b91d8307215928642b2b"
-dependencies = [
- "tokio",
-]
 
 [[package]]
 name = "debug_unsafe"
@@ -2325,6 +2336,28 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "derive_more"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+dependencies = [
+ "derive_more-impl",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+dependencies = [
+ "convert_case",
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "syn",
+]
+
 [[package]]
 name = "diff"
 version = "0.1.13"
@@ -2366,6 +2399,15 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "document-features"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
+dependencies = [
+ "litrs",
+]
+
 [[package]]
 name = "dunce"
 version = "1.0.5"
@@ -2821,6 +2863,15 @@ dependencies = [
  "slab",
 ]
 
+[[package]]
+name = "fuzzy-matcher"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54614a3312934d066701a80f20f15fa3b56d67ac7722b39eea5b4c9dd1d66c94"
+dependencies = [
+ "thread_local",
+]
+
 [[package]]
 name = "generic-array"
 version = "0.12.4"
@@ -3607,6 +3658,20 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "inquire"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6654738b8024300cf062d04a1c13c10c8e2cea598ec1c47dc9b6641159429756"
+dependencies = [
+ "bitflags 2.13.0",
+ "crossterm",
+ "dyn-clone",
+ "fuzzy-matcher",
+ "unicode-segmentation",
+ "unicode-width",
+]
+
 [[package]]
 name = "insta"
 version = "1.48.0"
@@ -3962,16 +4027,6 @@ version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
-[[package]]
-name = "libloading"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
-dependencies = [
- "cfg-if",
- "windows-link",
-]
-
 [[package]]
 name = "liblzma"
 version = "0.4.6"
@@ -4025,6 +4080,12 @@ version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
 
+[[package]]
+name = "litrs"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
+
 [[package]]
 name = "lock_api"
 version = "0.4.14"
@@ -4153,6 +4214,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
 dependencies = [
  "libc",
+ "log",
  "wasi 0.11.1+wasi-snapshot-preview1",
  "windows-sys 0.61.2",
 ]
@@ -5345,207 +5407,153 @@ dependencies = [
 ]
 
 [[package]]
-name = "registry-language-server"
-version = "0.16.3"
-dependencies = [
- "anyhow",
- "serde_json",
- "tempfile",
- "tokio",
- "tower-lsp-server",
- "tree-sitter",
- "tree-sitter-yaml",
-]
-
-[[package]]
-name = "registry-manifest-cli"
-version = "0.16.3"
-dependencies = [
- "registry-manifest-core",
- "serde",
- "serde_json",
- "serde_yaml_ng",
- "unsafe-libyaml",
-]
-
-[[package]]
-name = "registry-manifest-core"
-version = "0.16.3"
-dependencies = [
- "oxiri",
- "oxjsonld",
- "registry-platform-canonical-json",
- "serde",
- "serde_json",
- "serde_path_to_error",
- "serde_yaml_ng",
- "sha2 0.11.0",
- "thiserror 2.0.18",
-]
-
-[[package]]
-name = "registry-notary"
+name = "registry-evidence"
 version = "0.16.3"
 dependencies = [
+ "assert-json-diff",
+ "async-trait",
  "axum",
  "axum-test",
  "base64",
+ "bytes",
  "chrono",
+ "chrono-tz 0.10.4",
  "clap",
+ "criterion",
  "ed25519-dalek",
- "getrandom 0.4.3",
- "hyper",
- "hyper-util",
+ "fs2",
+ "http",
  "jsonschema 0.18.3",
- "registry-config-report",
- "registry-notary-core",
- "registry-notary-server",
+ "jsonwebtoken",
+ "rand_core 0.6.4",
+ "rcgen",
  "registry-platform-audit",
- "registry-platform-authcommon",
- "registry-platform-config",
  "registry-platform-crypto",
- "registry-platform-ops",
+ "registry-platform-httpsec",
+ "registry-platform-httputil",
+ "registry-platform-oidc",
+ "registry-platform-sdjwt",
  "reqwest 0.12.28",
+ "rhai",
+ "rustix",
+ "schemars 1.2.1",
+ "serde",
  "serde_json",
  "serde_norway",
  "sha2 0.11.0",
  "tempfile",
+ "thiserror 2.0.18",
  "time",
  "tokio",
+ "tokio-rustls",
  "tower",
  "tower-http 0.7.0",
  "tracing",
  "tracing-subscriber",
  "ulid",
+ "url",
+ "utoipa",
  "wiremock",
+ "zeroize",
 ]
 
 [[package]]
-name = "registry-notary-client"
+name = "registry-evidencectl"
 version = "0.16.3"
 dependencies = [
- "async-trait",
- "axum",
- "axum-test",
+ "anyhow",
  "base64",
- "flate2",
- "registry-notary-core",
- "registry-notary-server",
+ "chrono",
+ "clap",
+ "ed25519-dalek",
+ "getrandom 0.4.3",
+ "inquire",
  "registry-platform-crypto",
- "registry-platform-httputil",
- "registry-platform-oid4vci",
- "registry-platform-sdjwt",
- "reqwest 0.12.28",
- "secrecy",
+ "rhai",
+ "rustix",
  "serde",
  "serde_json",
  "serde_norway",
- "sha2 0.11.0",
+ "signal-hook",
+ "tempfile",
+ "ureq",
+ "url",
+ "zeroize",
+]
+
+[[package]]
+name = "registry-language-server"
+version = "0.16.3"
+dependencies = [
+ "anyhow",
+ "serde_json",
  "tempfile",
- "thiserror 2.0.18",
- "time",
  "tokio",
- "tracing",
+ "tower-lsp-server",
+ "tree-sitter",
+ "tree-sitter-yaml",
 ]
 
 [[package]]
-name = "registry-notary-core"
+name = "registry-manifest-cli"
 version = "0.16.3"
 dependencies = [
- "base64",
- "humantime-serde",
- "ipnet",
- "registry-platform-authcommon",
- "registry-platform-config",
- "registry-platform-crypto",
- "registry-platform-httputil",
- "registry-platform-oid4vci",
- "registry-platform-ops",
- "registry-platform-sdjwt",
- "schemars 1.2.1",
+ "registry-manifest-core",
  "serde",
  "serde_json",
- "serde_norway",
+ "serde_yaml_ng",
+ "unsafe-libyaml",
+]
+
+[[package]]
+name = "registry-manifest-core"
+version = "0.16.3"
+dependencies = [
+ "oxiri",
+ "oxjsonld",
+ "registry-platform-canonical-json",
+ "serde",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_yaml_ng",
  "sha2 0.11.0",
- "tempfile",
  "thiserror 2.0.18",
- "time",
- "tokio",
- "ulid",
- "url",
- "utoipa",
 ]
 
 [[package]]
-name = "registry-notary-server"
+name = "registry-mint"
 version = "0.16.3"
 dependencies = [
  "async-trait",
- "aws-lc-rs",
  "axum",
  "axum-test",
  "base64",
- "chrono",
- "criterion",
- "crosswalk-core",
- "cryptoki",
- "deadpool",
- "getrandom 0.4.3",
- "hex",
- "hmac 0.13.0",
- "jsonschema 0.18.3",
+ "clap",
+ "ed25519-dalek",
+ "http",
  "jsonwebtoken",
- "native-tls",
- "postgres-native-tls",
- "registry-notary-client",
- "registry-notary-core",
- "registry-notary-worker-harness",
+ "registry-evidence",
  "registry-platform-audit",
- "registry-platform-authcommon",
- "registry-platform-cache",
- "registry-platform-config",
+ "registry-platform-canonical-json",
  "registry-platform-crypto",
- "registry-platform-httpsec",
- "registry-platform-httputil",
- "registry-platform-oid4vci",
  "registry-platform-oidc",
- "registry-platform-ops",
- "registry-platform-pdp",
- "registry-platform-replay",
- "registry-platform-sdjwt",
- "registry-platform-testing",
  "reqwest 0.12.28",
  "rustix",
  "serde",
  "serde_json",
  "serde_norway",
- "sha2 0.11.0",
- "subtle",
  "tempfile",
  "thiserror 2.0.18",
  "time",
  "tokio",
- "tokio-postgres",
  "tower-http 0.7.0",
  "tracing",
+ "tracing-subscriber",
  "ulid",
- "utoipa",
- "wiremock",
+ "url",
  "zeroize",
 ]
 
-[[package]]
-name = "registry-notary-worker-harness"
-version = "0.16.3"
-dependencies = [
- "libc",
- "serde",
- "serde_json",
- "thiserror 2.0.18",
- "tokio",
- "tracing",
-]
-
 [[package]]
 name = "registry-platform-audit"
 version = "0.16.3"
@@ -5553,6 +5561,7 @@ dependencies = [
  "async-trait",
  "hmac 0.13.0",
  "registry-platform-canonical-json",
+ "rustix",
  "serde",
  "serde_json",
  "sha2 0.11.0",
@@ -5581,17 +5590,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "registry-platform-cache"
-version = "0.16.3"
-dependencies = [
- "async-trait",
- "sha2 0.11.0",
- "thiserror 2.0.18",
- "time",
- "tokio",
-]
-
 [[package]]
 name = "registry-platform-canonical-json"
 version = "0.16.3"
@@ -5682,21 +5680,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "registry-platform-oid4vci"
-version = "0.16.3"
-dependencies = [
- "base64",
- "registry-platform-crypto",
- "registry-platform-replay",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "thiserror 2.0.18",
- "time",
- "tokio",
-]
-
 [[package]]
 name = "registry-platform-oidc"
 version = "0.16.3"
@@ -5737,18 +5720,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "registry-platform-replay"
-version = "0.16.3"
-dependencies = [
- "async-trait",
- "getrandom 0.4.3",
- "registry-platform-cache",
- "thiserror 2.0.18",
- "time",
- "tokio",
-]
-
 [[package]]
 name = "registry-platform-sdjwt"
 version = "0.16.3"
@@ -5779,14 +5750,11 @@ dependencies = [
  "registry-platform-crypto",
  "registry-platform-httpsec",
  "registry-platform-httputil",
- "registry-platform-oid4vci",
  "registry-platform-oidc",
- "registry-platform-replay",
  "reqwest 0.12.28",
  "serde_json",
  "tempfile",
  "thiserror 2.0.18",
- "time",
  "tokio",
  "tower",
  "wiremock",
@@ -5834,8 +5802,6 @@ dependencies = [
  "rcgen",
  "registry-config-report",
  "registry-manifest-core",
- "registry-notary-core",
- "registry-notary-server",
  "registry-platform-audit",
  "registry-platform-authcommon",
  "registry-platform-config",
@@ -5895,8 +5861,6 @@ dependencies = [
  "regex",
  "registry-config-report",
  "registry-language-server",
- "registry-notary-core",
- "registry-notary-server",
  "registry-platform-authcommon",
  "registry-platform-config",
  "registry-platform-crypto",
@@ -6287,6 +6251,7 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
 dependencies = [
+ "chrono",
  "dyn-clone",
  "ref-cast",
  "schemars_derive",
@@ -6326,15 +6291,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "secrecy"
-version = "0.10.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e891af845473308773346dc847b2c23ee78fe442e0472ac50e22a18a93d3ae5a"
-dependencies = [
- "zeroize",
-]
-
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -6629,6 +6585,27 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d7f45b8998ced5134fb1d75732c77842a3e888f19c1ff98481822e8fbfbf930b"
 
+[[package]]
+name = "signal-hook"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2"
+dependencies = [
+ "libc",
+ "signal-hook-registry",
+]
+
+[[package]]
+name = "signal-hook-mio"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b75a19a7a740b25bc7944bdee6172368f988763b744e3d4dfe753f6b4ece40cc"
+dependencies = [
+ "libc",
+ "mio",
+ "signal-hook",
+]
+
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.8"
@@ -8346,17 +8323,6 @@ dependencies = [
  "der",
 ]
 
-[[package]]
-name = "xtask"
-version = "0.1.0"
-dependencies = [
- "base64",
- "registry-platform-crypto",
- "registry-platform-sdjwt",
- "serde_json",
- "tokio",
-]
-
 [[package]]
 name = "yansi"
 version = "1.0.1"
diff --git a/Cargo.toml b/Cargo.toml
index 57a857047..e4ab5d2e0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,40 +1,29 @@
 [workspace]
 members = [
     "crates/registry-config-report",
+    "crates/registry-evidence",
+    "crates/registry-evidencectl",
     "crates/registry-platform-audit",
     "crates/registry-platform-authcommon",
-    "crates/registry-platform-cache",
     "crates/registry-platform-canonical-json",
     "crates/registry-platform-config",
     "crates/registry-platform-crypto",
     "crates/registry-platform-httpsec",
     "crates/registry-platform-httputil",
-    "crates/registry-platform-oid4vci",
     "crates/registry-platform-oidc",
     "crates/registry-platform-ops",
     "crates/registry-platform-pdp",
-    "crates/registry-platform-replay",
     "crates/registry-platform-sdjwt",
     "crates/registry-platform-testing",
     "crates/registry-manifest-core",
     "crates/registry-manifest-cli",
-    "crates/registry-notary-core",
-    "crates/registry-notary-client",
-    "crates/registry-notary-server",
-    "crates/registry-notary",
-    "crates/registry-notary-worker-harness",
+    "crates/registry-mint",
     "crates/registry-relay",
     "crates/registry-language-server",
     "crates/registryctl",
-    "products/notary/xtask",
 ]
 exclude = [
-    # Parked until Assisted Access or the delegation profile work supplies a
-    # release-surface consumer (#298). Keep the source in git, but out of
-    # workspace CI.
-    "crates/registry-platform-sts",
     "products/platform/fuzz",
-    "products/notary/fuzz",
     "products/manifest/fuzz",
 ]
 resolver = "2"
@@ -52,26 +41,21 @@ unsafe_code = "forbid"
 
 [workspace.dependencies]
 registry-config-report = { path = "crates/registry-config-report", version = "0.16.3" }
+registry-evidence = { path = "crates/registry-evidence", version = "0.16.3" }
 registry-language-server = { path = "crates/registry-language-server", version = "0.16.3" }
 registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.16.3" }
-registry-notary-client = { path = "crates/registry-notary-client", version = "0.16.3" }
-registry-notary-core = { path = "crates/registry-notary-core", version = "0.16.3" }
+registry-mint = { path = "crates/registry-mint", version = "0.16.3" }
 registry-relay = { path = "crates/registry-relay", version = "0.16.3" }
-registry-notary-server = { path = "crates/registry-notary-server", version = "0.16.3", default-features = false }
-registry-notary-worker-harness = { path = "crates/registry-notary-worker-harness", version = "0.16.3" }
 registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.16.3" }
 registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.16.3" }
-registry-platform-cache = { path = "crates/registry-platform-cache", version = "0.16.3" }
 registry-platform-canonical-json = { path = "crates/registry-platform-canonical-json", version = "0.16.3" }
 registry-platform-config = { path = "crates/registry-platform-config", version = "0.16.3" }
 registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.16.3" }
 registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.16.3" }
 registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.16.3" }
-registry-platform-oid4vci = { path = "crates/registry-platform-oid4vci", version = "0.16.3" }
 registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.16.3" }
 registry-platform-ops = { path = "crates/registry-platform-ops", version = "0.16.3" }
 registry-platform-pdp = { path = "crates/registry-platform-pdp", version = "0.16.3" }
-registry-platform-replay = { path = "crates/registry-platform-replay", version = "0.16.3" }
 registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.16.3" }
 registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.16.3" }
 
@@ -90,13 +74,12 @@ bytes = { version = "1" }
 calamine = { version = "0.36" }
 cel = { version = "0.13" }
 chrono = { version = "0.4" }
+chrono-tz = { version = "0.10.4" }
 clap = { version = "4", features = ["derive", "env"] }
 crc32fast = { version = "1.4" }
 criterion = { version = "0.8", features = ["html_reports", "async_tokio"] }
-cryptoki = { version = "0.12" }
 csv = { version = "1" }
 datafusion = { version = "53.1" }
-deadpool = { version = "0.12.3", default-features = false, features = ["managed", "rt_tokio_1"] }
 ed25519-dalek = { version = "2", features = ["pkcs8", "rand_core"] }
 fs2 = { version = "0.4" }
 futures = { version = "0.3" }
@@ -112,6 +95,7 @@ http = { version = "1" }
 humantime-serde = { version = "1" }
 hyper = { version = "1", features = ["http1", "http2", "server"] }
 hyper-util = { version = "0.1", features = ["server-auto", "tokio"] }
+inquire = { version = "0.9.4" }
 insta = { version = "1", features = ["json"] }
 ipnet = { version = "2" }
 jsonschema = { version = "0.18", features = ["draft202012"] }
@@ -125,11 +109,10 @@ proptest = { version = "1" }
 rand_core = { version = "0.6", features = ["std"] }
 rcgen = { version = "0.13", default-features = false, features = ["ring", "zeroize"] }
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "rustls-tls-native-roots"] }
-rhai = { version = "1.25.1", features = ["sync", "serde"] }
+rhai = { version = "=1.25.1", features = ["sync", "serde"] }
 rustix = { version = "1", features = ["fs", "process"] }
 rustls-native-certs = { version = "0.8.4" }
 ryu-js = { version = "=1.0.3" }
-secrecy = { version = "0.10" }
 serde = { version = "1", features = ["derive"] }
 serde_json = { version = "1" }
 schemars = { version = "=1.2.1" }
@@ -138,6 +121,7 @@ serde_path_to_error = { version = "0.1" }
 serde-saphyr = { version = "0.0.26" }
 serde_yaml_ng = { version = "0.10.0" }
 sha2 = { version = "0.11" }
+signal-hook = { version = "0.3" }
 subtle = { version = "2" }
 tempfile = { version = "3" }
 thiserror = { version = "2" }
diff --git a/README.md b/README.md
index 6d9d00460..58ba2b99e 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
 
 Registry Stack helps institutions build registry-facing services over data they
-already hold: protected read APIs, governed evidence responses, credentials, and
+already hold: protected read APIs, signed minimum-disclosure assertions, and
 audit records, without turning the registry into a shared database.
 
 This repository is the monorepo source of truth for Registry Stack product code,
@@ -25,8 +25,8 @@ release manifests, and docs.
 |---|---|
 | Understand the product | [registrystack.org](https://registrystack.org/) |
 | Read the technical docs | [docs.registrystack.org](https://docs.registrystack.org/) |
+| Get a first minimum-disclosure assertion | [Evidence quickstart](https://docs.registrystack.org/dev/start/evidence-quickstart/) |
 | Build and run the maintained HTTP project | [Registry Stack 1.0 first run](https://docs.registrystack.org/dev/tutorials/author-registry-project/) |
-| Move a pre-1.0 project | [Pre-1.0 cutover](https://docs.registrystack.org/dev/start/pre-1.0-cutover/) |
 | Install VS Code or Zed integration | [Editor integrations](editors/README.md) |
 | Work on the monorepo | See [Development](#development) |
 | Review the public roadmap | [ROADMAP.md](ROADMAP.md) |
@@ -34,39 +34,45 @@ release manifests, and docs.
 
 ## What It Includes
 
-Registry Stack is organized around two runtime patterns:
+Registry Stack contains two independent runtime patterns:
 
 - **Protected Registry APIs:** scoped, read-only HTTP APIs over existing files,
   extracts, databases, or legacy registry systems. Registry Relay implements
   this surface.
-- **Evidence Gateway:** governed evidence responses, claim evaluation,
-  credential issuance, disclosure policy, and audit provenance. Registry Notary
-  implements claim evaluation and credential issuance; governed Registry Relay
-  routes use the same Policy Decision Point pattern for protected reads.
+- **Evidence:** a small service that returns signed, minimum-disclosure
+  assertions from fixed authoritative-source requests. Its first version
+  excludes credential lifecycles, documents, federation, and a general policy
+  engine.
 
-The stack also includes Registry Manifest for portable metadata, Registry
-Platform shared primitives, `registryctl` adopter tooling, and release tooling
-for validating the public source model.
+Evidence can use a Relay-protected API as one of its fixed sources. The stack
+also includes Registry Mint for short-lived access tokens, Registry Manifest
+for portable metadata, Registry Platform shared primitives, `registryctl` and
+`evidencectl` adopter tooling, and release tooling for validating the public
+source model.
 
 ```mermaid
 flowchart LR
     source["Existing registry source<br/>file, extract, database, platform"]
     manifest["Registry Manifest<br/>describe"]
     relay["Registry Relay<br/>expose protected reads"]
-    notary["Registry Notary<br/>certify evidence"]
-    caller["Approved service, verifier, or wallet"]
+    evidence["Evidence<br/>minimum-disclosure assertions"]
+    mint["Registry Mint<br/>issue short-lived tokens"]
+    caller["Approved service or verifier"]
 
     source --> relay
     manifest --> relay
     relay --> caller
-    relay --> notary
-    notary --> caller
+    source -. fixed request .-> evidence
+    relay -. protected fixed request .-> evidence
+    evidence -. signed assertion .-> caller
+    mint -. access token .-> caller
 ```
 
 ## Repository Layout
 
-- `crates/`: Rust crates and runnable binaries for Platform, Manifest, Notary,
-  Relay, `registryctl`, and shared release tooling.
+- `crates/`: Rust crates and runnable binaries for Platform, Manifest, Relay,
+  Evidence, Mint, `registryctl`, and `evidencectl`. Evidence lives in one
+  `crates/registry-evidence` crate with one `evidence` binary.
 - `products/`: product-owned docs, examples, Docker inputs, specs, security
   material, scripts, performance harnesses, and fixtures that are not normal
   workspace crates.
@@ -98,8 +104,7 @@ Release source checks:
 
 ```bash
 python3 -m unittest release/scripts/test_registry_release.py
-python3 -m unittest release/scripts/test_openid_conformance_runner.py
-release/scripts/registry-release validate release/manifests/registry-stack-beta-6.yaml
+release/scripts/registry-release validate release/manifests/registry-stack-beta-27.yaml
 release/scripts/registry-release audit release/manifests/import-map-2026-06-24.yaml
 REGISTRY_RELEASE_SOURCE_MODE=monorepo release/scripts/check-release-source-model.sh
 python3 -m unittest release/scripts/test_check_release_source_model.py
@@ -158,8 +163,8 @@ described in [CONTRIBUTING.md](CONTRIBUTING.md#issue-labels).
 ## Security
 
 Report vulnerabilities privately. See [SECURITY.md](SECURITY.md) before opening
-a public issue for suspected credential disclosure, auth bypass, audit redaction
-failure, source connector data leakage, or signing key handling bugs.
+a public issue for suspected minimum-disclosure failure, auth bypass, audit
+redaction failure, source connector data leakage, or signing key handling bugs.
 
 ## License
 
diff --git a/ROADMAP.md b/ROADMAP.md
index 03a435898..9f32bcaf8 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -24,7 +24,7 @@ Public issues remain the source of truth for work selection:
 
 ## October 2026 To March 2027
 
-- Harden Registry Relay and Registry Notary deployment profiles for pilot
+- Harden Registry Relay and Evidence deployment profiles for pilot
   operators, especially configuration diagnostics, audit posture, and
   verification commands.
 - Expand coverage for governed registry reads, evidence issuance, sidecar
diff --git a/codecov.yml b/codecov.yml
index fab47399a..6d9f6ab15 100644
--- a/codecov.yml
+++ b/codecov.yml
@@ -8,9 +8,9 @@ coverage:
         flags:
           - platform
         informational: true
-      notary-postgres:
+      relay-postgres:
         flags:
-          - notary-postgres
+          - relay-postgres
         informational: true
     patch:
       default: off
@@ -18,9 +18,9 @@ coverage:
         flags:
           - platform
         informational: true
-      notary-postgres:
+      relay-postgres:
         flags:
-          - notary-postgres
+          - relay-postgres
         informational: true
 
 flags:
@@ -28,24 +28,10 @@ flags:
     paths:
       - "crates/registry-platform-*/**"
     carryforward: true
-  notary-postgres:
-    paths:
-      - "crates/registry-notary/"
-      - "crates/registry-notary-server/"
-    carryforward: true
   manifest-unit:
     paths:
       - "crates/registry-manifest-*/**"
     carryforward: true
-  notary-unit:
-    paths:
-      - "crates/registry-notary*/**"
-      - "products/notary/xtask/**"
-    carryforward: true
-  notary-cel:
-    paths:
-      - "crates/registry-notary*/**"
-    carryforward: true
   relay-unit:
     paths:
       - "crates/registry-relay/**"
diff --git a/crates/registry-config-report/fixtures/diagnostics/registry-notary.error.json b/crates/registry-config-report/fixtures/diagnostics/registry-notary.error.json
deleted file mode 100644
index 09e8a570e..000000000
--- a/crates/registry-config-report/fixtures/diagnostics/registry-notary.error.json
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-  "schema_version": "registry.config.diagnostic_report.v1",
-  "product": "registry-notary",
-  "config_schema_version": "registry.notary.config.v1",
-  "source": {
-    "kind": "local_file",
-    "path": "notary/config.yaml"
-  },
-  "status": "error",
-  "summary": {
-    "error_count": 2,
-    "warning_count": 0
-  },
-  "diagnostics": [
-    {
-      "code": "notary.config.claim_source_missing",
-      "severity": "error",
-      "path": "/claim_sources/0",
-      "message": "Claim source local-relay must declare a source kind.",
-      "documentation_key": "notary.config.claim_sources"
-    },
-    {
-      "code": "notary.config.signer_required",
-      "severity": "error",
-      "path": "/issuer/signer",
-      "message": "Issuer signer configuration is required."
-    }
-  ],
-  "required_env": [
-    {
-      "name": "REGISTRY_NOTARY_SIGNING_KEY",
-      "classification": "secret",
-      "status": "not_checked"
-    }
-  ],
-  "context_constraints": [],
-  "audit_shipping": {
-    "sink_type": "file",
-    "shipping_target_configured": false,
-    "shipping_target": "none",
-    "shipping_health": null,
-    "shipping_observed_at": null
-  },
-  "generated_at": "2026-06-20T00:00:00Z"
-}
diff --git a/crates/registry-config-report/fixtures/diagnostics/registry-notary.ok.json b/crates/registry-config-report/fixtures/diagnostics/registry-notary.ok.json
deleted file mode 100644
index a7293ebb8..000000000
--- a/crates/registry-config-report/fixtures/diagnostics/registry-notary.ok.json
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  "schema_version": "registry.config.diagnostic_report.v1",
-  "product": "registry-notary",
-  "config_schema_version": "registry.notary.config.v1",
-  "source": {
-    "kind": "generated_file",
-    "path": "notary/config.yaml"
-  },
-  "status": "ok",
-  "summary": {
-    "error_count": 0,
-    "warning_count": 0
-  },
-  "diagnostics": [],
-  "required_env": [
-    {
-      "name": "REGISTRY_NOTARY_SIGNING_KEY",
-      "classification": "secret",
-      "status": "present"
-    },
-    {
-      "name": "REGISTRY_NOTARY_ISSUER_DID",
-      "classification": "public",
-      "status": "present"
-    }
-  ],
-  "context_constraints": [],
-  "audit_shipping": {
-    "sink_type": "file",
-    "shipping_target_configured": true,
-    "shipping_target": "declared_external",
-    "shipping_health": "unverified",
-    "shipping_observed_at": "2026-06-19T23:59:00Z"
-  },
-  "hashes": {
-    "internal_config_hash": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-    "posture_safe_config_hash": "sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
-  },
-  "generated_at": "2026-06-20T00:00:00Z"
-}
diff --git a/crates/registry-config-report/src/lib.rs b/crates/registry-config-report/src/lib.rs
index fef01a4fd..c2a3133e4 100644
--- a/crates/registry-config-report/src/lib.rs
+++ b/crates/registry-config-report/src/lib.rs
@@ -27,12 +27,6 @@ pub const RELAY_DIAGNOSTIC_OK_FIXTURE_V1: &str =
 pub const RELAY_DIAGNOSTIC_ERROR_FIXTURE_V1: &str =
     include_str!("../fixtures/diagnostics/registry-relay.error.json");
 
-pub const NOTARY_DIAGNOSTIC_OK_FIXTURE_V1: &str =
-    include_str!("../fixtures/diagnostics/registry-notary.ok.json");
-
-pub const NOTARY_DIAGNOSTIC_ERROR_FIXTURE_V1: &str =
-    include_str!("../fixtures/diagnostics/registry-notary.error.json");
-
 pub const CONFIG_EXPLANATION_FIXTURE_V1: &str =
     include_str!("../fixtures/explanations/registry-relay.explanation.json");
 
diff --git a/crates/registry-config-report/tests/report_contract.rs b/crates/registry-config-report/tests/report_contract.rs
index 8eb198910..4779ecc5d 100644
--- a/crates/registry-config-report/tests/report_contract.rs
+++ b/crates/registry-config-report/tests/report_contract.rs
@@ -2,7 +2,6 @@ use registry_config_report::{
     redact_config_value, ConfigDiagnosticReport, ConfigExplanation, ConfigExplanationDocument,
     ConfigHashes, ConfigValueClassification, RedactedConfig, RegistryctlValidationReport,
     RequiredEnvStatus, RequiredEnvVar, CONFIG_EXPLANATION_FIXTURE_V1, CONFIG_EXPLANATION_SCHEMA_V1,
-    NOTARY_DIAGNOSTIC_ERROR_FIXTURE_V1, NOTARY_DIAGNOSTIC_OK_FIXTURE_V1,
     PRODUCT_DIAGNOSTIC_REPORT_SCHEMA_V1, REDACTED_VALUE, REDACTION_INPUT_FIXTURE_V1,
     REGISTRYCTL_VALIDATION_FIXTURE_V1, REGISTRYCTL_VALIDATION_REPORT_SCHEMA_V1,
     REGISTRYCTL_VALIDATION_REPORT_SCHEMA_VERSION_V1, RELAY_DIAGNOSTIC_ERROR_FIXTURE_V1,
@@ -128,8 +127,6 @@ fn product_diagnostic_schema_validates_canonical_product_fixtures() {
     for fixture in [
         RELAY_DIAGNOSTIC_OK_FIXTURE_V1,
         RELAY_DIAGNOSTIC_ERROR_FIXTURE_V1,
-        NOTARY_DIAGNOSTIC_OK_FIXTURE_V1,
-        NOTARY_DIAGNOSTIC_ERROR_FIXTURE_V1,
     ] {
         assert_valid(PRODUCT_DIAGNOSTIC_REPORT_SCHEMA_V1, &parse(fixture));
     }
@@ -154,17 +151,21 @@ fn product_diagnostic_schema_rejects_wrong_schema_unknown_status_and_bad_hash()
 
 #[test]
 fn product_diagnostic_schema_accepts_optional_declared_audit_shipping() {
-    // Canonical fixtures carry the declared audit shipping state the products'
-    // doctor reports emit; the strict schema accepts it.
-    let report = parse(NOTARY_DIAGNOSTIC_OK_FIXTURE_V1);
-    assert_eq!(report["audit_shipping"]["sink_type"], "file");
+    // The canonical fixture carries the declared audit shipping state the
+    // products' doctor reports emit; the strict schema accepts it.
+    let report = parse(RELAY_DIAGNOSTIC_OK_FIXTURE_V1);
+    assert_eq!(report["audit_shipping"]["sink_type"], "stdout");
     assert_eq!(report["audit_shipping"]["shipping_target_configured"], true);
-    assert_eq!(
-        report["audit_shipping"]["shipping_target"],
-        "declared_external"
-    );
+    assert_eq!(report["audit_shipping"]["shipping_target"], "stdout");
     assert_valid(PRODUCT_DIAGNOSTIC_REPORT_SCHEMA_V1, &report);
 
+    // A local sink that declares off-host shipping is the other accepted
+    // declared state.
+    let mut declared_external = report.clone();
+    declared_external["audit_shipping"]["sink_type"] = json!("file");
+    declared_external["audit_shipping"]["shipping_target"] = json!("declared_external");
+    assert_valid(PRODUCT_DIAGNOSTIC_REPORT_SCHEMA_V1, &declared_external);
+
     // The section is optional: a report may omit it (e.g. when config is
     // unavailable) and still validate.
     let mut without = report.clone();
@@ -197,9 +198,7 @@ fn product_diagnostic_schema_accepts_observed_audit_shipping_fields() {
     // validate under the strict schema.
     for fixture in [
         RELAY_DIAGNOSTIC_OK_FIXTURE_V1,
-        NOTARY_DIAGNOSTIC_OK_FIXTURE_V1,
         RELAY_DIAGNOSTIC_ERROR_FIXTURE_V1,
-        NOTARY_DIAGNOSTIC_ERROR_FIXTURE_V1,
     ] {
         let report = parse(fixture);
         assert!(report["audit_shipping"].get("shipping_health").is_some());
@@ -210,7 +209,7 @@ fn product_diagnostic_schema_accepts_observed_audit_shipping_fields() {
     }
 
     // An observed health plus timestamp validates.
-    let mut with_health = parse(NOTARY_DIAGNOSTIC_OK_FIXTURE_V1);
+    let mut with_health = parse(RELAY_DIAGNOSTIC_OK_FIXTURE_V1);
     with_health["audit_shipping"]["shipping_health"] = json!("stale");
     with_health["audit_shipping"]["shipping_observed_at"] = json!("2026-06-19T23:00:00Z");
     assert_valid(PRODUCT_DIAGNOSTIC_REPORT_SCHEMA_V1, &with_health);
@@ -231,7 +230,7 @@ fn product_diagnostic_schema_accepts_observed_audit_shipping_fields() {
 
     // Even alongside the new observed fields, unknown fields inside
     // audit_shipping still fail.
-    let mut unknown = parse(NOTARY_DIAGNOSTIC_OK_FIXTURE_V1);
+    let mut unknown = parse(RELAY_DIAGNOSTIC_OK_FIXTURE_V1);
     unknown["audit_shipping"]["backlog_depth"] = json!(3);
     assert_invalid(PRODUCT_DIAGNOSTIC_REPORT_SCHEMA_V1, &unknown);
 }
@@ -288,8 +287,6 @@ fn registryctl_schema_rejects_lossy_embedded_product_report() {
 fn serde_types_round_trip_canonical_fixtures() {
     round_trip::<ConfigDiagnosticReport>(RELAY_DIAGNOSTIC_OK_FIXTURE_V1);
     round_trip::<ConfigDiagnosticReport>(RELAY_DIAGNOSTIC_ERROR_FIXTURE_V1);
-    round_trip::<ConfigDiagnosticReport>(NOTARY_DIAGNOSTIC_OK_FIXTURE_V1);
-    round_trip::<ConfigDiagnosticReport>(NOTARY_DIAGNOSTIC_ERROR_FIXTURE_V1);
     let _: ConfigExplanation = decode(CONFIG_EXPLANATION_FIXTURE_V1);
     let _: ConfigExplanationDocument = decode(CONFIG_EXPLANATION_FIXTURE_V1);
     round_trip::<RegistryctlValidationReport>(REGISTRYCTL_VALIDATION_FIXTURE_V1);
@@ -387,8 +384,6 @@ fn diagnostic_report_round_trip_preserves_audit_shipping_section() {
     for fixture in [
         RELAY_DIAGNOSTIC_OK_FIXTURE_V1,
         RELAY_DIAGNOSTIC_ERROR_FIXTURE_V1,
-        NOTARY_DIAGNOSTIC_OK_FIXTURE_V1,
-        NOTARY_DIAGNOSTIC_ERROR_FIXTURE_V1,
     ] {
         let original = parse(fixture);
         let decoded: ConfigDiagnosticReport = decode(fixture);
diff --git a/crates/registry-evidence/Cargo.toml b/crates/registry-evidence/Cargo.toml
new file mode 100644
index 000000000..cf748e311
--- /dev/null
+++ b/crates/registry-evidence/Cargo.toml
@@ -0,0 +1,69 @@
+[package]
+name = "registry-evidence"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+description = "Minimum-disclosure signed assertion evidence service."
+repository.workspace = true
+publish = false
+
+[[bin]]
+name = "evidence"
+path = "src/main.rs"
+
+[lints]
+workspace = true
+
+[dependencies]
+async-trait.workspace = true
+axum.workspace = true
+base64.workspace = true
+bytes.workspace = true
+chrono = { workspace = true, features = ["serde"] }
+chrono-tz.workspace = true
+clap.workspace = true
+ed25519-dalek.workspace = true
+fs2.workspace = true
+http.workspace = true
+jsonschema.workspace = true
+jsonwebtoken.workspace = true
+registry-platform-audit.workspace = true
+registry-platform-crypto.workspace = true
+registry-platform-httpsec.workspace = true
+registry-platform-httputil.workspace = true
+registry-platform-oidc.workspace = true
+registry-platform-sdjwt.workspace = true
+reqwest.workspace = true
+rand_core.workspace = true
+rhai.workspace = true
+rustix.workspace = true
+schemars = { workspace = true, features = ["chrono04"] }
+serde.workspace = true
+serde_json.workspace = true
+serde_norway.workspace = true
+sha2.workspace = true
+thiserror.workspace = true
+time.workspace = true
+tokio.workspace = true
+tower.workspace = true
+tower-http.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+ulid.workspace = true
+url.workspace = true
+utoipa.workspace = true
+zeroize.workspace = true
+
+[dev-dependencies]
+assert-json-diff.workspace = true
+axum-test.workspace = true
+criterion.workspace = true
+rcgen.workspace = true
+tempfile.workspace = true
+tokio-rustls.workspace = true
+wiremock.workspace = true
+
+[[bench]]
+name = "audit_bench"
+harness = false
diff --git a/crates/registry-evidence/README.md b/crates/registry-evidence/README.md
new file mode 100644
index 000000000..2616cc318
--- /dev/null
+++ b/crates/registry-evidence/README.md
@@ -0,0 +1,53 @@
+# registry-evidence
+
+`registry-evidence` is the single-crate Evidence Version 1 runtime. It loads
+one immutable operator-controlled bundle, evaluates fixed requirements through
+bounded Rhai extraction and derivation, and returns minimum-disclosure
+assertion evidence.
+
+The `evidence` binary takes a runtime file and one subcommand:
+
+```text
+evidence --runtime <path> check
+evidence --runtime <path> evaluate --fixture <bundle-relative path>
+evidence --runtime <path> serve
+evidence verify --jws <file> --jwks <file> --policy <file> [--at <rfc3339-utc>]
+```
+
+`check` validates and compiles the complete immutable bundle. `evaluate` runs
+one bundle-owned fixture without source or credential access. `verify`
+re-verifies a stored signed response offline against a pinned trusted JWKS
+file and a complete relying-procedure policy document, reporting cryptographic
+authenticity separately from current validity; it needs no runtime file and
+never touches the network. `serve` starts the native HTTP service:
+
+```text
+POST /v1/evidence
+GET  /v1/evidence-definitions
+GET  /health
+GET  /openapi.json
+GET  /ready
+GET  /.well-known/evidence/jwks.json
+```
+
+`GET /openapi.json` returns the generated public contract as
+`application/openapi+json`. It is unauthenticated and byte-identical to the
+released artifact under `products/evidence/generated/`, so it describes no
+deployment, definition, or authority.
+
+`POST /v1/evidence` requires a `requestNonce`: the canonical unpadded base64url
+encoding of exactly 32 random bytes, freshly generated per request. The runtime
+echoes it into the Evidence payload and covers it by the signature. It is never
+stored, never uniqueness-checked, and never reaches authorization, rate limits,
+Rhai, source requests, logs, metrics, traces, or audit.
+
+Signed flattened JWS (`application/jose+json`) is the mandatory default and the
+only later-verifiable format. The exact
+`application/vnd.registrystack.evidence-unsigned+json` selects a self-identifying
+unsigned envelope, and only when both the bundle and the one complete matched
+grant permit that format. Signing failure never falls back to unsigned output.
+
+The normative product contracts and verification commands live under
+`products/evidence/`. Evidence is independent from Registry Notary and has no
+credential, replay, policy-engine, document, federation, worker, or OOTS
+subsystem.
diff --git a/crates/registry-evidence/benches/audit_bench.rs b/crates/registry-evidence/benches/audit_bench.rs
new file mode 100644
index 000000000..03120a5e0
--- /dev/null
+++ b/crates/registry-evidence/benches/audit_bench.rs
@@ -0,0 +1,174 @@
+// SPDX-License-Identifier: Apache-2.0
+//! Microbenchmarks for the durable Evidence audit chain.
+//!
+//! These measure the real filesystem path through the shared
+//! `DurableSegmentedAuditLog`, because the cost that decides service throughput
+//! is the durable `fsync` that covers each append, not the chain hashing.
+//!
+//! Covers:
+//! - one sequential append, the latency floor a request pays per audit record;
+//! - concurrent appends, which show whether added concurrency raises append
+//!   throughput or merely queues behind the same serialized `fsync`;
+//! - event construction and serialization alone, for scale against the I/O.
+//!
+//! The `record_bytes` line printed on startup reports the on-disk size of one
+//! representative record, which is what sizes the audit file against its
+//! configured ceiling.
+
+use std::{hint::black_box, sync::Arc};
+
+use criterion::{criterion_group, criterion_main, BenchmarkId, Criterion, Throughput};
+use registry_evidence::audit::{
+    AuditAuthority, AuditDecision, AuditPhase, AuditSubject, AuthorityKind, EvidenceAuditEvent,
+    EvidenceAuditLog, ResponseProtection,
+};
+use registry_evidence::config::AssuranceProfile;
+use tokio::{runtime::Runtime, task::JoinSet};
+
+/// Far above anything an individual benchmark run appends, so the file-size
+/// ceiling never interferes with the measurement.
+const BENCH_MAXIMUM_FILE_BYTES: u64 = 64 * 1024 * 1024 * 1024;
+const BENCH_SECRET: [u8; 64] = [0x5a; 64];
+const CONCURRENCY_LEVELS: [usize; 4] = [1, 8, 32, 128];
+
+/// Build a pseudonym of the shape the runtime actually writes, so records are
+/// representative in size rather than artificially short.
+fn pseudonym(seed: u8) -> String {
+    let digest: String = (0u8..32)
+        .map(|byte| format!("{:02x}", byte ^ seed))
+        .collect();
+    format!("hmac-sha256:v1:{digest}")
+}
+
+fn sample_event() -> EvidenceAuditEvent {
+    EvidenceAuditEvent::new(
+        AssuranceProfile::EvidenceGrade,
+        "evidence.request.evaluate".to_string(),
+        AuditPhase::AccessAttempt,
+        "adult-status".to_string(),
+        "2026-08-01T00:00:00Z/1".to_string(),
+        "age-verification".to_string(),
+        pseudonym(0x11),
+        AuditAuthority {
+            kind: AuthorityKind::Statutory,
+            grant_pseudonym: Some(pseudonym(0x22)),
+        },
+        vec![AuditSubject {
+            role: "subject".to_string(),
+            selector_profile: "national-identifier".to_string(),
+            selector_bundle_pseudonym: Some(pseudonym(0x33)),
+        }],
+        ResponseProtection::Signed,
+        AuditDecision::Authorized,
+        12,
+    )
+}
+
+fn runtime() -> Runtime {
+    tokio::runtime::Builder::new_multi_thread()
+        .enable_all()
+        .build()
+        .expect("tokio runtime")
+}
+
+/// Initialize a durable log over a fresh temporary file. The `TempDir` is
+/// returned because dropping it would delete the file out from under the sink.
+fn durable_log(runtime: &Runtime) -> (tempfile::TempDir, Arc<EvidenceAuditLog>) {
+    let directory = tempfile::tempdir().expect("temp dir");
+    let path = directory.path().join("audit.jsonl");
+    let log = runtime.block_on(async {
+        EvidenceAuditLog::initialize(path, BENCH_MAXIMUM_FILE_BYTES, BENCH_SECRET.to_vec(), 1)
+            .await
+            .expect("initialize audit log")
+    });
+    (directory, Arc::new(log))
+}
+
+/// Report the on-disk size of a single record. This is the number that decides
+/// how quickly a deployment reaches its configured audit file ceiling.
+fn report_record_bytes(runtime: &Runtime) {
+    let directory = tempfile::tempdir().expect("temp dir");
+    let path = directory.path().join("audit.jsonl");
+    runtime.block_on(async {
+        let log =
+            EvidenceAuditLog::initialize(&path, BENCH_MAXIMUM_FILE_BYTES, BENCH_SECRET.to_vec(), 1)
+                .await
+                .expect("initialize audit log");
+        log.append(sample_event()).await.expect("append");
+    });
+    let bytes = std::fs::metadata(&path).expect("metadata").len();
+    eprintln!("audit/record_bytes: {bytes}");
+}
+
+/// One append at a time: the per-record cost a request pays, dominated by the
+/// `fsync` in the sink write path.
+fn benchmark_sequential_append(c: &mut Criterion) {
+    let runtime = runtime();
+    report_record_bytes(&runtime);
+    let (_directory, log) = durable_log(&runtime);
+
+    let mut group = c.benchmark_group("audit/durable_append");
+    group.throughput(Throughput::Elements(1));
+    group.bench_function("sequential", |b| {
+        b.to_async(&runtime)
+            .iter(|| async { log.append(black_box(sample_event())).await.expect("append") });
+    });
+    group.finish();
+}
+
+/// Many appends in flight at once. Because the sink holds its state mutex
+/// across the blocking write and `fsync`, throughput here is expected to stay
+/// flat as concurrency rises: the extra callers queue rather than batch.
+fn benchmark_concurrent_append(c: &mut Criterion) {
+    let runtime = runtime();
+    let (_directory, log) = durable_log(&runtime);
+
+    let mut group = c.benchmark_group("audit/durable_append_concurrent");
+    for concurrency in CONCURRENCY_LEVELS {
+        group.throughput(Throughput::Elements(concurrency as u64));
+        group.bench_with_input(
+            BenchmarkId::from_parameter(concurrency),
+            &concurrency,
+            |b, &concurrency| {
+                b.to_async(&runtime).iter(|| {
+                    let log = Arc::clone(&log);
+                    async move {
+                        let mut appends = JoinSet::new();
+                        for _ in 0..concurrency {
+                            let log = Arc::clone(&log);
+                            appends.spawn(async move {
+                                log.append(sample_event()).await.expect("append")
+                            });
+                        }
+                        while let Some(result) = appends.join_next().await {
+                            black_box(result.expect("join"));
+                        }
+                    }
+                });
+            },
+        );
+    }
+    group.finish();
+}
+
+/// Event construction and JSON serialization with no I/O, for scale against
+/// the durable append measurements.
+fn benchmark_event_serialization(c: &mut Criterion) {
+    let mut group = c.benchmark_group("audit/event");
+    group.bench_function("construct", |b| b.iter(|| black_box(sample_event())));
+    let event = sample_event();
+    group.bench_function("serialize", |b| {
+        b.iter(|| serde_json::to_value(black_box(&event)).expect("serialize"));
+    });
+    group.finish();
+}
+
+criterion_group! {
+    name = benches;
+    config = Criterion::default().sample_size(50);
+    targets =
+        benchmark_sequential_append,
+        benchmark_concurrent_append,
+        benchmark_event_serialization
+}
+criterion_main!(benches);
diff --git a/crates/registry-evidence/examples/evidence-contracts.rs b/crates/registry-evidence/examples/evidence-contracts.rs
new file mode 100644
index 000000000..77c05ac05
--- /dev/null
+++ b/crates/registry-evidence/examples/evidence-contracts.rs
@@ -0,0 +1,28 @@
+//! Generate deterministic Evidence Version 1 public contract artifacts.
+
+use std::{env, path::PathBuf, process::ExitCode};
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(message) => {
+            eprintln!("evidence contract generation failed: {message}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run() -> Result<(), String> {
+    let mut arguments = env::args_os().skip(1);
+    if arguments.next().as_deref() != Some(std::ffi::OsStr::new("--output")) {
+        return Err("usage: evidence-contracts --output <directory>".to_string());
+    }
+    let output = arguments
+        .next()
+        .map(PathBuf::from)
+        .ok_or_else(|| "usage: evidence-contracts --output <directory>".to_string())?;
+    if arguments.next().is_some() {
+        return Err("usage: evidence-contracts --output <directory>".to_string());
+    }
+    registry_evidence::contracts::write_documents(&output).map_err(|error| error.to_string())
+}
diff --git a/crates/registry-evidence/src/audit.rs b/crates/registry-evidence/src/audit.rs
new file mode 100644
index 000000000..4fdcae9c8
--- /dev/null
+++ b/crates/registry-evidence/src/audit.rs
@@ -0,0 +1,2289 @@
+//! Fail-closed native Evidence audit with a durable keyed JSONL chain.
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    io::{Error as IoError, ErrorKind},
+    path::{Path, PathBuf},
+    sync::Arc,
+};
+
+#[cfg(test)]
+use std::io::{Seek, SeekFrom, Write};
+#[cfg(test)]
+use std::sync::atomic::Ordering;
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+pub use registry_platform_audit::segmented_audit_paths as audit_segment_paths;
+use registry_platform_audit::{
+    verify_segmented_audit_chain, visit_stopped_segmented_audit_chain, AuditChainHasher,
+    AuditEnvelope, AuditError, AuditHashSecret, AuditKeyHasher, DurableSegmentedAuditLog,
+};
+use registry_platform_crypto::canonicalize_json;
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+
+use crate::config::AssuranceProfile;
+
+const AUDIT_SCHEMA: &str = "registry.evidence.audit/v1";
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum AuditPhase {
+    AccessAttempt,
+    DisclosureRelease,
+    Denial,
+    TransientFailure,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum AuditDecision {
+    Authorized,
+    Released,
+    NoMatch,
+    Ambiguous,
+    FactMissing,
+    DependencyFailure,
+    EvaluationFailure,
+    SigningFailure,
+}
+
+/// Closed non-secret response-protection mode resolved with authorization.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum ResponseProtection {
+    Signed,
+    Unsigned,
+    SdJwtVc,
+}
+
+impl ResponseProtection {
+    /// Report whether release under this mode is cryptographically protected
+    /// and therefore records the signing key identifier.
+    pub fn is_signed(self) -> bool {
+        matches!(self, Self::Signed | Self::SdJwtVc)
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum AuthorityKind {
+    Statutory,
+    Organizational,
+    Consent,
+    Delegated,
+    ExplicitRequest,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct AuditAuthority {
+    pub kind: AuthorityKind,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub grant_pseudonym: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct AuditSubject {
+    pub role: String,
+    pub selector_profile: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub selector_bundle_pseudonym: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct EvidenceAuditEvent {
+    pub schema: String,
+    pub assurance_profile: AssuranceProfile,
+    pub event_id: String,
+    pub occurred_at: String,
+    pub operation: String,
+    pub phase: AuditPhase,
+    pub requirement: String,
+    pub bundle_revision: String,
+    pub purpose: String,
+    pub requester_pseudonym: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub actor_pseudonym: Option<String>,
+    pub authority: AuditAuthority,
+    pub subjects: Vec<AuditSubject>,
+    pub response_protection: ResponseProtection,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_id: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub adapter_id: Option<String>,
+    pub decision: AuditDecision,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub disclosed_concepts: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub evidence_id: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub signing_key_id: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub safe_error_category: Option<String>,
+    pub duration_milliseconds: u64,
+}
+
+impl EvidenceAuditEvent {
+    #[allow(clippy::too_many_arguments)]
+    pub fn new(
+        assurance_profile: AssuranceProfile,
+        operation: String,
+        phase: AuditPhase,
+        requirement: String,
+        bundle_revision: String,
+        purpose: String,
+        requester_pseudonym: String,
+        authority: AuditAuthority,
+        subjects: Vec<AuditSubject>,
+        response_protection: ResponseProtection,
+        decision: AuditDecision,
+        duration_milliseconds: u64,
+    ) -> Self {
+        Self {
+            schema: AUDIT_SCHEMA.to_owned(),
+            assurance_profile,
+            event_id: format!("urn:ulid:{}", ulid::Ulid::new()),
+            occurred_at: chrono::Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Millis, true),
+            operation,
+            phase,
+            requirement,
+            bundle_revision,
+            purpose,
+            requester_pseudonym,
+            actor_pseudonym: None,
+            authority,
+            subjects,
+            response_protection,
+            source_id: None,
+            adapter_id: None,
+            decision,
+            disclosed_concepts: None,
+            evidence_id: None,
+            signing_key_id: None,
+            safe_error_category: None,
+            duration_milliseconds,
+        }
+    }
+
+    pub fn validate_phase_fields(&self) -> Result<(), EvidenceAuditError> {
+        let any_release_field = self.disclosed_concepts.is_some() || self.evidence_id.is_some();
+        let all_release_fields = self.disclosed_concepts.is_some() && self.evidence_id.is_some();
+        if (self.phase == AuditPhase::DisclosureRelease && !all_release_fields)
+            || (self.phase != AuditPhase::DisclosureRelease && any_release_field)
+        {
+            return Err(EvidenceAuditError::InvalidEvent);
+        }
+        // A signing key identity exists exactly for cryptographically
+        // protected disclosure release.
+        let signing_key_required =
+            self.phase == AuditPhase::DisclosureRelease && self.response_protection.is_signed();
+        if self.signing_key_id.is_some() != signing_key_required {
+            return Err(EvidenceAuditError::InvalidEvent);
+        }
+        let phase_decision_is_native = matches!(
+            (self.phase, self.decision),
+            (AuditPhase::AccessAttempt, AuditDecision::Authorized)
+                | (AuditPhase::DisclosureRelease, AuditDecision::Released)
+                | (
+                    AuditPhase::Denial,
+                    AuditDecision::NoMatch | AuditDecision::Ambiguous | AuditDecision::FactMissing
+                )
+                | (
+                    AuditPhase::TransientFailure,
+                    AuditDecision::DependencyFailure
+                        | AuditDecision::EvaluationFailure
+                        | AuditDecision::SigningFailure
+                )
+        );
+        let concepts_are_valid = self.disclosed_concepts.as_ref().is_none_or(|concepts| {
+            concepts.len() <= 16
+                && concepts.iter().all(|concept| valid_uri(concept))
+                && concepts.iter().collect::<BTreeSet<_>>().len() == concepts.len()
+        });
+        if self.schema != AUDIT_SCHEMA
+            || !phase_decision_is_native
+            || !valid_uri(&self.event_id)
+            || chrono::DateTime::parse_from_rfc3339(&self.occurred_at).is_err()
+            || !valid_uri(&self.requirement)
+            || !valid_revision(&self.bundle_revision)
+            || !valid_purpose(&self.purpose, 128)
+            || !valid_pseudonym(&self.requester_pseudonym)
+            || self
+                .actor_pseudonym
+                .as_ref()
+                .is_some_and(|value| !valid_pseudonym(value))
+            || self
+                .authority
+                .grant_pseudonym
+                .as_ref()
+                .is_some_and(|value| !valid_pseudonym(value))
+            || self.subjects.is_empty()
+            || self.subjects.len() > 8
+            || !(16..=128).contains(&self.operation.len())
+            || self.subjects.iter().any(|subject| {
+                !valid_local_name(&subject.role, 64)
+                    || !valid_local_name(&subject.selector_profile, 128)
+                    || subject
+                        .selector_bundle_pseudonym
+                        .as_ref()
+                        .is_some_and(|value| !valid_pseudonym(value))
+            })
+            || self
+                .source_id
+                .as_ref()
+                .is_some_and(|value| !valid_local_name(value, 128))
+            || self
+                .adapter_id
+                .as_ref()
+                .is_some_and(|value| !valid_local_name(value, 128))
+            || !concepts_are_valid
+            || self
+                .evidence_id
+                .as_ref()
+                .is_some_and(|value| !valid_uri(value))
+            || self.signing_key_id.as_ref().is_some_and(|value| {
+                value.is_empty() || value.len() > 256 || value.chars().any(char::is_control)
+            })
+            || self
+                .safe_error_category
+                .as_ref()
+                .is_some_and(|value| !valid_local_name(value, 128))
+            || self.duration_milliseconds > 86_400_000
+        {
+            return Err(EvidenceAuditError::InvalidEvent);
+        }
+        Ok(())
+    }
+}
+
+fn valid_uri(value: &str) -> bool {
+    !value.is_empty() && value.len() <= 512 && url::Url::parse(value).is_ok()
+}
+
+fn valid_revision(value: &str) -> bool {
+    value.strip_prefix("sha256:").is_some_and(|digest| {
+        digest.len() == 64
+            && digest
+                .bytes()
+                .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
+    })
+}
+
+fn valid_purpose(value: &str, maximum: usize) -> bool {
+    let mut bytes = value.bytes();
+    matches!(bytes.next(), Some(b'a'..=b'z'))
+        && value.len() <= maximum
+        && bytes.all(|byte| {
+            byte.is_ascii_lowercase()
+                || byte.is_ascii_digit()
+                || matches!(byte, b'.' | b'_' | b':' | b'-')
+        })
+}
+
+fn valid_local_name(value: &str, maximum: usize) -> bool {
+    let mut bytes = value.bytes();
+    matches!(bytes.next(), Some(b'a'..=b'z'))
+        && value.len() <= maximum
+        && bytes.all(|byte| {
+            byte.is_ascii_lowercase() || byte.is_ascii_digit() || matches!(byte, b'.' | b'_' | b'-')
+        })
+}
+
+fn valid_pseudonym(value: &str) -> bool {
+    let Some(rest) = value.strip_prefix("hmac-sha256:v") else {
+        return false;
+    };
+    let Some((version, digest)) = rest.split_once(':') else {
+        return false;
+    };
+    !version.is_empty()
+        && !version.starts_with('0')
+        && version.bytes().all(|byte| byte.is_ascii_digit())
+        && digest.len() == 64
+        && digest
+            .bytes()
+            .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
+}
+
+#[derive(Debug, Error)]
+pub enum EvidenceAuditError {
+    #[error("audit configuration is invalid")]
+    Configuration,
+    #[error("audit event is invalid")]
+    InvalidEvent,
+    #[error("audit initialization or write failed")]
+    Audit(#[from] AuditError),
+    /// A span of sealed history is absent. Reported separately from a hash
+    /// break so an operator can tell deliberate archival from tampering.
+    #[error("audit chain is missing sealed segment {sequence}")]
+    SegmentMissing { sequence: u64 },
+}
+
+/// The chain's on-disk footprint, sealed segments and the active segment
+/// together.
+///
+/// Rotation never deletes a sealed segment, so this only falls when an
+/// operator archives one. That is why it is measured by walking the segment
+/// directory rather than accumulated in a counter: a counter would keep
+/// reporting bytes an operator had already reclaimed.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct AuditStorageUsage {
+    pub segments: usize,
+    pub bytes: u64,
+}
+
+pub struct EvidenceAuditLog {
+    sink: Arc<DurableSegmentedAuditLog>,
+    key_hasher: AuditKeyHasher,
+    key_version: u32,
+}
+
+impl std::fmt::Debug for EvidenceAuditLog {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("EvidenceAuditLog")
+            .field("path", &self.sink.path())
+            .field("key_version", &self.key_version)
+            .finish_non_exhaustive()
+    }
+}
+
+impl EvidenceAuditLog {
+    pub async fn initialize(
+        path: impl Into<PathBuf>,
+        maximum_file_bytes: u64,
+        master_secret: Vec<u8>,
+        key_version: u32,
+    ) -> Result<Self, EvidenceAuditError> {
+        if maximum_file_bytes == 0 || key_version == 0 {
+            return Err(EvidenceAuditError::Configuration);
+        }
+        let path = path.into();
+        if !path.is_absolute() {
+            return Err(AuditError::Io(IoError::new(
+                ErrorKind::InvalidInput,
+                "audit path must be absolute",
+            ))
+            .into());
+        }
+        if !path.parent().is_some_and(Path::is_dir) {
+            return Err(AuditError::Io(IoError::new(
+                ErrorKind::NotFound,
+                "audit parent directory is unavailable",
+            ))
+            .into());
+        }
+        let secret = AuditHashSecret::new(master_secret)?;
+        let chain_hasher = AuditChainHasher::keyed(secret.clone());
+        let key_hasher = AuditKeyHasher::Keyed(secret);
+        let sink = Arc::new(
+            DurableSegmentedAuditLog::initialize(path, maximum_file_bytes, chain_hasher).await?,
+        );
+        Ok(Self {
+            sink,
+            key_hasher,
+            key_version,
+        })
+    }
+
+    pub fn pseudonym(
+        &self,
+        class: &str,
+        scope: &str,
+        protected_input: &[u8],
+    ) -> Result<String, EvidenceAuditError> {
+        if protected_input.is_empty() {
+            return Err(EvidenceAuditError::InvalidEvent);
+        }
+        let transient = URL_SAFE_NO_PAD.encode(protected_input);
+        let digest = self
+            .key_hasher
+            .audit_reference_hash(class, scope, &transient)
+            .map_err(|_| EvidenceAuditError::InvalidEvent)?;
+        let digest = digest
+            .strip_prefix("hmac-sha256:")
+            .ok_or(EvidenceAuditError::InvalidEvent)?;
+        Ok(format!("hmac-sha256:v{}:{digest}", self.key_version))
+    }
+
+    /// Measure the chain's footprint for the capacity gauge.
+    ///
+    /// This walks the audit directory, so it runs on the blocking pool: the
+    /// number of sealed segments grows without bound and the caller is a
+    /// scrape handler on the async runtime. A segment that disappears midway
+    /// through the walk is skipped rather than failing the read, because an
+    /// operator archiving history concurrently is expected, not an error.
+    pub async fn storage_usage(&self) -> Result<AuditStorageUsage, EvidenceAuditError> {
+        let path = self.sink.path().to_path_buf();
+        tokio::task::spawn_blocking(move || {
+            let segments = audit_segment_paths(&path)?;
+            let mut bytes = 0u64;
+            let mut counted = 0usize;
+            for segment in &segments {
+                match std::fs::symlink_metadata(segment) {
+                    Ok(metadata) => {
+                        counted += 1;
+                        bytes = bytes.saturating_add(metadata.len());
+                    }
+                    Err(error) if error.kind() == ErrorKind::NotFound => {}
+                    Err(error) => return Err(AuditError::Io(error)),
+                }
+            }
+            Ok(AuditStorageUsage {
+                segments: counted,
+                bytes,
+            })
+        })
+        .await
+        .map_err(|error| AuditError::Io(IoError::other(error)))?
+        .map_err(EvidenceAuditError::from)
+    }
+
+    pub async fn append(
+        &self,
+        event: EvidenceAuditEvent,
+    ) -> Result<AuditEnvelope, EvidenceAuditError> {
+        event.validate_phase_fields()?;
+        let record = serde_json::to_value(event).map_err(AuditError::Json)?;
+        self.sink
+            .append_record(record)
+            .await
+            .map_err(EvidenceAuditError::Audit)
+    }
+
+    pub async fn ready(&self) -> bool {
+        self.sink.ready().await
+    }
+
+    /// Durable writes performed so far, for proving that concurrent appends
+    /// share them rather than each paying an `fsync`.
+    #[cfg(test)]
+    pub(crate) fn durable_writes(&self) -> usize {
+        usize::try_from(self.sink.durable_writes()).unwrap_or(usize::MAX)
+    }
+
+    #[cfg(test)]
+    fn startup_verifications(&self) -> u64 {
+        self.sink.startup_verifications()
+    }
+}
+
+/// Result of an out-of-band verification pass over a whole audit chain.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct AuditChainSummary {
+    /// Segments actually replayed.
+    pub segments: usize,
+    pub records: usize,
+    pub head: Option<[u8; 32]>,
+    /// Sequence of the oldest and newest sealed segments, absent when the chain
+    /// has never rotated.
+    pub first_sequence: Option<u64>,
+    pub last_sequence: Option<u64>,
+    /// Whether the active segment was replayed. False when a running writer
+    /// holds the chain, in which case only sealed history was proven.
+    pub active_verified: bool,
+}
+
+pub const LOCAL_AUDIT_OPERATION_VIEW_SCHEMA_V1: &str = "registry.evidence.local-audit-operation/v1";
+
+/// Minimized verified view of one native audit operation.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct LocalAuditOperationView {
+    schema: &'static str,
+    operation: String,
+    events: Vec<LocalAuditOperationEvent>,
+    #[serde(skip)]
+    assurance_profile: AssuranceProfile,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct LocalAuditOperationEvent {
+    occurred_at: String,
+    phase: AuditPhase,
+    decision: AuditDecision,
+    requirement: String,
+    purpose: String,
+    requester_pseudonym: String,
+    response_protection: ResponseProtection,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    disclosed_concepts: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    evidence_id: Option<String>,
+}
+
+#[derive(Clone, Copy)]
+struct LocalAuditInspectionBounds {
+    maximum_segments: usize,
+    maximum_records: usize,
+    maximum_output_bytes: usize,
+}
+
+impl LocalAuditInspectionBounds {
+    const DEFAULT: Self = Self {
+        maximum_segments: 1024,
+        maximum_records: 10_000,
+        maximum_output_bytes: 256 * 1024,
+    };
+}
+
+struct PendingLocalOperation {
+    event: EvidenceAuditEvent,
+    view: LocalAuditOperationEvent,
+}
+
+#[derive(Default)]
+struct LocalAuditCollector {
+    bounds: Option<LocalAuditInspectionBounds>,
+    records: usize,
+    pending: BTreeMap<String, PendingLocalOperation>,
+    completed: BTreeSet<String>,
+    last_operation: Option<String>,
+    last_completed: Option<LocalAuditOperationView>,
+}
+
+impl LocalAuditCollector {
+    fn new(bounds: LocalAuditInspectionBounds) -> Self {
+        Self {
+            bounds: Some(bounds),
+            ..Self::default()
+        }
+    }
+
+    fn collect(&mut self, envelope: AuditEnvelope) -> Result<(), AuditError> {
+        let bounds = self.bounds.ok_or_else(invalid_audit_data)?;
+        self.records = self.records.checked_add(1).ok_or_else(file_size_error)?;
+        if self.records > bounds.maximum_records {
+            return Err(file_size_error());
+        }
+        let event: EvidenceAuditEvent =
+            serde_json::from_value(envelope.record).map_err(|_| invalid_audit_data())?;
+        event
+            .validate_phase_fields()
+            .map_err(|_| invalid_audit_data())?;
+        let operation = event.operation.clone();
+        self.last_operation = Some(operation.clone());
+        let view = LocalAuditOperationEvent::from(&event);
+
+        if event.phase == AuditPhase::AccessAttempt {
+            if self.completed.contains(&operation)
+                || self
+                    .pending
+                    .insert(operation, PendingLocalOperation { event, view })
+                    .is_some()
+            {
+                return Err(invalid_audit_data());
+            }
+            return Ok(());
+        }
+
+        let access = self
+            .pending
+            .remove(&operation)
+            .ok_or_else(invalid_audit_data)?;
+        if !coherent_operation_pair(&access.event, &event)
+            || !self.completed.insert(operation.clone())
+        {
+            return Err(invalid_audit_data());
+        }
+        self.last_completed = Some(LocalAuditOperationView {
+            schema: LOCAL_AUDIT_OPERATION_VIEW_SCHEMA_V1,
+            operation,
+            events: vec![access.view, view],
+            assurance_profile: access.event.assurance_profile,
+        });
+        Ok(())
+    }
+
+    fn finish(mut self) -> Result<LocalAuditOperationView, EvidenceAuditError> {
+        let bounds = self.bounds.take().ok_or(EvidenceAuditError::InvalidEvent)?;
+        let last = self
+            .last_operation
+            .take()
+            .ok_or(EvidenceAuditError::InvalidEvent)?;
+        let view = if let Some(pending) = self.pending.remove(&last) {
+            LocalAuditOperationView {
+                schema: LOCAL_AUDIT_OPERATION_VIEW_SCHEMA_V1,
+                operation: last,
+                events: vec![pending.view],
+                assurance_profile: pending.event.assurance_profile,
+            }
+        } else {
+            self.last_completed
+                .take()
+                .filter(|completed| completed.operation == last)
+                .ok_or(EvidenceAuditError::InvalidEvent)?
+        };
+        if view.events.first().is_none_or(|event| {
+            event.phase != AuditPhase::AccessAttempt || event.decision != AuditDecision::Authorized
+        }) || view.assurance_profile != AssuranceProfile::Local
+        {
+            return Err(EvidenceAuditError::InvalidEvent);
+        }
+        let serialized = serde_json::to_value(&view).map_err(AuditError::Json)?;
+        if canonicalize_json(&serialized)
+            .map_err(|_| invalid_audit_data())?
+            .len()
+            > bounds.maximum_output_bytes
+        {
+            return Err(EvidenceAuditError::Configuration);
+        }
+        Ok(view)
+    }
+}
+
+impl From<&EvidenceAuditEvent> for LocalAuditOperationEvent {
+    fn from(event: &EvidenceAuditEvent) -> Self {
+        Self {
+            occurred_at: event.occurred_at.clone(),
+            phase: event.phase,
+            decision: event.decision,
+            requirement: event.requirement.clone(),
+            purpose: event.purpose.clone(),
+            requester_pseudonym: event.requester_pseudonym.clone(),
+            response_protection: event.response_protection,
+            disclosed_concepts: event.disclosed_concepts.clone(),
+            evidence_id: event.evidence_id.clone(),
+        }
+    }
+}
+
+fn coherent_operation_pair(access: &EvidenceAuditEvent, terminal: &EvidenceAuditEvent) -> bool {
+    let occurred_in_order = chrono::DateTime::parse_from_rfc3339(&access.occurred_at)
+        .ok()
+        .zip(chrono::DateTime::parse_from_rfc3339(&terminal.occurred_at).ok())
+        .is_some_and(|(access, terminal)| access <= terminal);
+    occurred_in_order
+        && access.operation == terminal.operation
+        && access.assurance_profile == terminal.assurance_profile
+        && access.requirement == terminal.requirement
+        && access.bundle_revision == terminal.bundle_revision
+        && access.purpose == terminal.purpose
+        && access.requester_pseudonym == terminal.requester_pseudonym
+        && access.actor_pseudonym == terminal.actor_pseudonym
+        && access.authority == terminal.authority
+        && access.subjects == terminal.subjects
+        && access.response_protection == terminal.response_protection
+        && access.source_id == terminal.source_id
+        && access.adapter_id == terminal.adapter_id
+}
+
+/// Verify the whole stopped local chain and derive the last operation from the
+/// exact verified envelopes in that one replay.
+pub fn verified_last_local_audit_operation(
+    path: &Path,
+    master_secret: &AuditHashSecret,
+) -> Result<LocalAuditOperationView, EvidenceAuditError> {
+    verified_last_local_audit_operation_with_bounds(
+        path,
+        master_secret,
+        LocalAuditInspectionBounds::DEFAULT,
+    )
+}
+
+fn verified_last_local_audit_operation_with_bounds(
+    path: &Path,
+    master_secret: &AuditHashSecret,
+    bounds: LocalAuditInspectionBounds,
+) -> Result<LocalAuditOperationView, EvidenceAuditError> {
+    if bounds.maximum_segments == 0
+        || bounds.maximum_records == 0
+        || bounds.maximum_output_bytes == 0
+    {
+        return Err(EvidenceAuditError::Configuration);
+    }
+
+    let hasher = AuditChainHasher::keyed(master_secret.clone());
+    let mut collector = LocalAuditCollector::new(bounds);
+    visit_stopped_segmented_audit_chain(
+        path,
+        &hasher,
+        bounds.maximum_segments,
+        bounds.maximum_records,
+        |envelope| collector.collect(envelope),
+    )
+    .map_err(map_platform_audit_error)?;
+    collector.finish()
+}
+
+/// Verify every retained segment, including the active segment when no writer is running.
+pub fn verify_audit_chain(
+    path: &Path,
+    master_secret: &AuditHashSecret,
+) -> Result<AuditChainSummary, EvidenceAuditError> {
+    let summary =
+        verify_segmented_audit_chain(path, &AuditChainHasher::keyed(master_secret.clone()))
+            .map_err(map_platform_audit_error)?;
+    Ok(AuditChainSummary {
+        segments: summary.segments,
+        records: summary.records,
+        head: summary.last_hash,
+        first_sequence: summary.first_sequence,
+        last_sequence: summary.last_sequence,
+        active_verified: summary.active_verified,
+    })
+}
+
+fn map_platform_audit_error(error: AuditError) -> EvidenceAuditError {
+    match error {
+        AuditError::SegmentMissing { sequence } => EvidenceAuditError::SegmentMissing { sequence },
+        error => EvidenceAuditError::Audit(error),
+    }
+}
+
+fn invalid_audit_data() -> AuditError {
+    AuditError::Io(IoError::new(
+        ErrorKind::InvalidData,
+        "audit record is invalid",
+    ))
+}
+
+fn file_size_error() -> AuditError {
+    AuditError::Io(IoError::other("audit file size bound exceeded"))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn event(log: &EvidenceAuditLog) -> EvidenceAuditEvent {
+        EvidenceAuditEvent::new(
+            AssuranceProfile::EvidenceGrade,
+            "01K1EXAMPLE0000000000000000".to_string(),
+            AuditPhase::AccessAttempt,
+            "urn:example:requirement:v1".to_string(),
+            format!("sha256:{}", "0".repeat(64)),
+            "casework".to_string(),
+            log.pseudonym("requester-v1", "urn:example:trust", b"principal-canary")
+                .expect("pseudonym builds"),
+            AuditAuthority {
+                kind: AuthorityKind::Statutory,
+                grant_pseudonym: None,
+            },
+            vec![AuditSubject {
+                role: "subject".to_string(),
+                selector_profile: "person-v1".to_string(),
+                selector_bundle_pseudonym: Some(
+                    log.pseudonym("subject-v1", "casework", b"selector-canary")
+                        .expect("pseudonym builds"),
+                ),
+            }],
+            ResponseProtection::Signed,
+            AuditDecision::Authorized,
+            5,
+        )
+    }
+
+    #[test]
+    fn frozen_audit_fixture_matches_native_event_shape_and_phase_rules() {
+        let fixture: serde_json::Value = serde_norway::from_slice(include_bytes!(
+            "../../../products/evidence/fixtures/conformance/audit-events.yaml"
+        ))
+        .expect("frozen audit fixture parses");
+        assert_eq!(
+            fixture["fixture"],
+            serde_json::json!("registry.evidence.audit-events/v1")
+        );
+        assert_eq!(fixture["synthetic_only"], serde_json::json!(true));
+
+        let access = EvidenceAuditEvent {
+            schema: AUDIT_SCHEMA.to_owned(),
+            assurance_profile: AssuranceProfile::EvidenceGrade,
+            event_id: "urn:example:fixture:audit:access-001".to_owned(),
+            occurred_at: "2026-08-02T00:00:00Z".to_owned(),
+            operation: "fixture-operation-00000001".to_owned(),
+            phase: AuditPhase::AccessAttempt,
+            requirement: "urn:example:fixture:requirement:property:v1".to_owned(),
+            bundle_revision:
+                "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+                    .to_owned(),
+            purpose: "fixture-procedure".to_owned(),
+            requester_pseudonym:
+                "hmac-sha256:v1:1111111111111111111111111111111111111111111111111111111111111111"
+                    .to_owned(),
+            actor_pseudonym: None,
+            authority: AuditAuthority {
+                kind: AuthorityKind::Statutory,
+                grant_pseudonym: None,
+            },
+            subjects: vec![AuditSubject {
+                role: "subject".to_owned(),
+                selector_profile: "opaque-record-v1".to_owned(),
+                selector_bundle_pseudonym: Some(
+                    "hmac-sha256:v1:2222222222222222222222222222222222222222222222222222222222222222"
+                        .to_owned(),
+                ),
+            }],
+            response_protection: ResponseProtection::Signed,
+            source_id: Some("source-a".to_owned()),
+            adapter_id: Some("adapter-a".to_owned()),
+            decision: AuditDecision::Authorized,
+            disclosed_concepts: None,
+            evidence_id: None,
+            signing_key_id: None,
+            safe_error_category: None,
+            duration_milliseconds: 2,
+        };
+        access
+            .validate_phase_fields()
+            .expect("fixture access event satisfies native phase rules");
+        assert_eq!(
+            serde_json::to_value(&access).expect("access event serializes"),
+            fixture["access_attempt"]
+        );
+
+        let mut release = access.clone();
+        release.event_id = "urn:example:fixture:audit:release-001".to_owned();
+        release.occurred_at = "2026-08-02T00:00:01Z".to_owned();
+        release.phase = AuditPhase::DisclosureRelease;
+        release.decision = AuditDecision::Released;
+        release.disclosed_concepts = Some(vec!["urn:example:fixture:concept:boolean-a".to_owned()]);
+        release.evidence_id = Some("urn:example:fixture:evidence:001".to_owned());
+        release.signing_key_id = Some("fixture-key-2026-01".to_owned());
+        release.duration_milliseconds = 12;
+        release
+            .validate_phase_fields()
+            .expect("fixture release event satisfies native phase rules");
+        assert_eq!(
+            serde_json::to_value(&release).expect("release event serializes"),
+            fixture["disclosure_release"]
+        );
+
+        let mut unsigned_release = release.clone();
+        unsigned_release.event_id = "urn:example:fixture:audit:release-002".to_owned();
+        unsigned_release.occurred_at = "2026-08-02T00:00:02Z".to_owned();
+        unsigned_release.response_protection = ResponseProtection::Unsigned;
+        unsigned_release.signing_key_id = None;
+        unsigned_release
+            .validate_phase_fields()
+            .expect("fixture unsigned release event satisfies native phase rules");
+        assert_eq!(
+            serde_json::to_value(&unsigned_release).expect("unsigned release event serializes"),
+            fixture["unsigned_disclosure_release"]
+        );
+        unsigned_release.signing_key_id = Some("fixture-key-2026-01".to_owned());
+        assert!(matches!(
+            unsigned_release.validate_phase_fields(),
+            Err(EvidenceAuditError::InvalidEvent)
+        ));
+
+        let mut signed_release_without_key = release.clone();
+        signed_release_without_key.signing_key_id = None;
+        assert!(matches!(
+            signed_release_without_key.validate_phase_fields(),
+            Err(EvidenceAuditError::InvalidEvent)
+        ));
+
+        let mut release_fields_on_access = access;
+        release_fields_on_access.disclosed_concepts = release.disclosed_concepts.clone();
+        release_fields_on_access.evidence_id = release.evidence_id.clone();
+        release_fields_on_access.signing_key_id = release.signing_key_id.clone();
+        assert!(matches!(
+            release_fields_on_access.validate_phase_fields(),
+            Err(EvidenceAuditError::InvalidEvent)
+        ));
+        release.evidence_id = None;
+        assert!(matches!(
+            release.validate_phase_fields(),
+            Err(EvidenceAuditError::InvalidEvent)
+        ));
+
+        assert_eq!(
+            fixture["order"],
+            serde_json::json!({
+                "access_attempt_durable_before": ["credential-resolution", "source-access"],
+                "disclosure_release_durable_after": ["signing"],
+                "disclosure_release_durable_before": ["response-release"]
+            })
+        );
+        assert_eq!(
+            fixture["negative"],
+            serde_json::json!([
+                "raw-principal",
+                "raw-actor-or-grant",
+                "raw-selector-value",
+                "separate-field-hash",
+                "plain-sha256-subject-hash",
+                "base64url-reencoded-audit-hmac",
+                "globally-stable-subject-pseudonym",
+                "source-or-supported-value",
+                "credential-token-or-private-key",
+                "candidate-count-score-hint-or-comparison",
+                "release-fields-on-access-event",
+                "missing-release-fields-on-release-event",
+                "signing-key-on-unsigned-release-event",
+                "missing-signing-key-on-signed-release-event",
+                "request-nonce-in-any-event"
+            ])
+        );
+    }
+
+    #[tokio::test]
+    async fn audit_is_durable_keyed_and_redacted() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = EvidenceAuditLog::initialize(
+            &path,
+            64 * 1024,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("audit initializes");
+        assert_eq!(log.startup_verifications(), 1);
+        assert!(log.ready().await, "an empty verified chain is ready");
+        log.append(event(&log)).await.expect("event appends");
+        assert!(log.ready().await);
+        assert_eq!(
+            log.startup_verifications(),
+            1,
+            "steady-state appends and readiness must not rescan the audit file"
+        );
+
+        let contents = std::fs::read_to_string(&path).expect("audit reads");
+        assert!(!contents.contains("principal-canary"));
+        assert!(!contents.contains("selector-canary"));
+        assert!(contents.contains("hmac-sha256:v1:"));
+        assert!(!contents.contains("hmac-sha256:v1:hmac-sha256:"));
+        assert!(contents.ends_with('\n'));
+
+        std::fs::OpenOptions::new()
+            .append(true)
+            .open(&path)
+            .and_then(|mut file| file.write_all(b"{}\n"))
+            .expect("tamper audit file");
+        assert!(!log.ready().await, "readiness detects chain tampering");
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn concurrent_appends_extend_one_keyed_chain_without_forking() {
+        // Every evaluation shares one `EvidenceAuditLog` through an `Arc`, so many
+        // requests can append at once. The keyed chain must serialize each event's
+        // prev-hash read with its durable write: if two appends observed the same
+        // tail hash in parallel they would fork the chain and surface as a
+        // `ChainForkDetected` error (a spurious 503) or a broken linkage. Drive a
+        // burst of concurrent appends across worker threads and prove each one
+        // succeeds and the resulting chain still verifies end to end.
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = Arc::new(
+            EvidenceAuditLog::initialize(
+                &path,
+                256 * 1024,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .expect("audit initializes"),
+        );
+
+        const CONCURRENCY: usize = 16;
+        let mut handles = Vec::with_capacity(CONCURRENCY);
+        for _ in 0..CONCURRENCY {
+            let log = Arc::clone(&log);
+            handles.push(tokio::spawn(async move {
+                let event = event(log.as_ref());
+                log.append(event).await
+            }));
+        }
+        for handle in handles {
+            handle
+                .await
+                .expect("append task joins")
+                .expect("a concurrent append never forks the keyed chain");
+        }
+
+        assert!(
+            log.ready().await,
+            "the chain verifies after concurrent appends"
+        );
+        assert_eq!(
+            log.startup_verifications(),
+            1,
+            "concurrent appends extend the chain incrementally without rescanning it"
+        );
+        let lines = std::fs::read_to_string(&path)
+            .expect("audit reads")
+            .lines()
+            .count();
+        assert_eq!(
+            lines, CONCURRENCY,
+            "every concurrent append is durably recorded exactly once"
+        );
+
+        // Release the single-writer sink lock before reopening: the sink holds an
+        // exclusive lock for one writer per file, so a fresh reader can only
+        // re-verify the chain once this handle is dropped.
+        drop(log);
+
+        // A fresh reader re-verifies the whole keyed chain from disk, proving the
+        // prev-hash linkage stayed consistent under concurrent appends.
+        let reopened = EvidenceAuditLog::initialize(
+            &path,
+            256 * 1024,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("a chain grown under concurrency verifies on restart");
+        assert!(
+            reopened.ready().await,
+            "the reopened chain verifies end to end"
+        );
+    }
+
+    #[tokio::test]
+    async fn restart_verifies_a_nonempty_keyed_chain_before_accepting_appends() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        {
+            let log = EvidenceAuditLog::initialize(
+                &path,
+                64 * 1024,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .expect("audit initializes");
+            log.append(event(&log)).await.expect("event appends");
+        }
+
+        let restarted = EvidenceAuditLog::initialize(
+            &path,
+            64 * 1024,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("a valid nonempty chain verifies on restart");
+        assert!(restarted.ready().await);
+        assert_eq!(restarted.startup_verifications(), 1);
+        restarted
+            .append(event(&restarted))
+            .await
+            .expect("verified restarted chain accepts an append");
+    }
+
+    #[tokio::test]
+    async fn restart_rejects_same_length_chain_corruption() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        {
+            let log = EvidenceAuditLog::initialize(
+                &path,
+                64 * 1024,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .expect("audit initializes");
+            log.append(event(&log)).await.expect("event appends");
+        }
+
+        let mut external = std::fs::OpenOptions::new()
+            .write(true)
+            .open(&path)
+            .expect("audit file opens for corruption");
+        external
+            .seek(SeekFrom::Start(0))
+            .and_then(|_| external.write_all(b"["))
+            .and_then(|_| external.sync_all())
+            .expect("same-length corruption persists");
+
+        assert!(
+            EvidenceAuditLog::initialize(
+                &path,
+                64 * 1024,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .is_err(),
+            "restart must reject a corrupted keyed chain"
+        );
+    }
+
+    #[tokio::test]
+    async fn restart_rejects_a_truncated_final_record() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        {
+            let log = EvidenceAuditLog::initialize(
+                &path,
+                64 * 1024,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .expect("audit initializes");
+            log.append(event(&log)).await.expect("event appends");
+        }
+
+        let original_length = std::fs::metadata(&path)
+            .expect("audit metadata reads")
+            .len();
+        assert!(original_length > 8, "fixture record has truncation room");
+        let external = std::fs::OpenOptions::new()
+            .write(true)
+            .open(&path)
+            .expect("audit file opens for truncation");
+        external
+            .set_len(original_length - 8)
+            .and_then(|_| external.sync_all())
+            .expect("truncation persists");
+
+        assert!(
+            EvidenceAuditLog::initialize(
+                &path,
+                64 * 1024,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .is_err(),
+            "restart must reject a truncated keyed chain"
+        );
+    }
+
+    #[tokio::test]
+    async fn restart_rejects_the_wrong_audit_key() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        {
+            let log = EvidenceAuditLog::initialize(
+                &path,
+                64 * 1024,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .expect("audit initializes");
+            log.append(event(&log)).await.expect("event appends");
+        }
+
+        assert!(
+            EvidenceAuditLog::initialize(
+                &path,
+                64 * 1024,
+                b"fedcba9876543210fedcba9876543210".to_vec(),
+                1,
+            )
+            .await
+            .is_err(),
+            "restart must reject a keyed chain under a different audit secret"
+        );
+    }
+
+    #[tokio::test]
+    async fn same_length_external_mutation_fails_readiness_and_future_appends() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = EvidenceAuditLog::initialize(
+            &path,
+            64 * 1024,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("audit initializes");
+        log.append(event(&log)).await.expect("event appends");
+
+        std::thread::sleep(std::time::Duration::from_millis(2));
+        let mut external = std::fs::OpenOptions::new()
+            .write(true)
+            .open(&path)
+            .expect("audit file opens for mutation");
+        external
+            .seek(SeekFrom::Start(0))
+            .and_then(|_| external.write_all(b"["))
+            .and_then(|_| external.sync_all())
+            .expect("same-length mutation persists");
+
+        assert!(!log.ready().await);
+        assert!(log.append(event(&log)).await.is_err());
+        assert_eq!(log.startup_verifications(), 1);
+    }
+
+    #[tokio::test]
+    async fn invalid_release_shape_and_size_limit_fail_closed() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log =
+            EvidenceAuditLog::initialize(&path, 1, b"0123456789abcdef0123456789abcdef".to_vec(), 1)
+                .await
+                .expect("audit initializes");
+        assert!(log.append(event(&log)).await.is_err());
+
+        let mut invalid = event(&log);
+        invalid.phase = AuditPhase::DisclosureRelease;
+        assert!(matches!(
+            log.append(invalid).await,
+            Err(EvidenceAuditError::InvalidEvent)
+        ));
+    }
+
+    #[tokio::test]
+    async fn second_writer_is_rejected() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let first = EvidenceAuditLog::initialize(
+            &path,
+            64 * 1024,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("first initializes");
+        let second = EvidenceAuditLog::initialize(
+            &path,
+            64 * 1024,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await;
+        assert!(second.is_err());
+        drop(first);
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn pathname_replacement_never_redirects_the_pinned_audit_writer() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let displaced = directory.path().join("displaced.jsonl");
+        let log = EvidenceAuditLog::initialize(
+            &path,
+            64 * 1024,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("audit initializes");
+
+        std::fs::rename(&path, &displaced).expect("initialized file is displaced");
+        std::fs::write(&path, b"replacement-canary\n").expect("replacement is created");
+        use std::os::unix::fs::PermissionsExt as _;
+        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600))
+            .expect("replacement mode is owner-only");
+
+        assert!(log.append(event(&log)).await.is_err());
+        assert!(!log.ready().await);
+        assert_eq!(
+            std::fs::read_to_string(&path).expect("replacement reads"),
+            "replacement-canary\n"
+        );
+        assert_eq!(
+            std::fs::read_to_string(&displaced).expect("pinned file reads"),
+            ""
+        );
+    }
+
+    fn audit_secret() -> AuditHashSecret {
+        AuditHashSecret::new(b"0123456789abcdef0123456789abcdef".to_vec())
+            .expect("audit secret builds")
+    }
+
+    fn local_access(log: &EvidenceAuditLog, operation: &str) -> EvidenceAuditEvent {
+        let mut event = EvidenceAuditEvent::new(
+            AssuranceProfile::Local,
+            operation.to_owned(),
+            AuditPhase::AccessAttempt,
+            "urn:example:requirement:age-bracket:v1".to_owned(),
+            format!("sha256:{}", "a".repeat(64)),
+            "benefit:eligibility".to_owned(),
+            log.pseudonym(
+                "requester-v1",
+                "urn:example:trust",
+                b"raw-requester-token-canary",
+            )
+            .expect("requester pseudonym builds"),
+            AuditAuthority {
+                kind: AuthorityKind::Delegated,
+                grant_pseudonym: Some(
+                    log.pseudonym("grant-v1", "urn:example:trust", b"raw-grant-token-canary")
+                        .expect("grant pseudonym builds"),
+                ),
+            },
+            vec![AuditSubject {
+                role: "subject".to_owned(),
+                selector_profile: "person-v1".to_owned(),
+                selector_bundle_pseudonym: Some(
+                    log.pseudonym(
+                        "subject-v1",
+                        "benefit:eligibility",
+                        b"person-id-raw-selector-canary",
+                    )
+                    .expect("subject pseudonym builds"),
+                ),
+            }],
+            ResponseProtection::Signed,
+            AuditDecision::Authorized,
+            4,
+        );
+        event.actor_pseudonym = Some(
+            log.pseudonym("actor-v1", "urn:example:trust", b"raw-actor-token-canary")
+                .expect("actor pseudonym builds"),
+        );
+        event.source_id = Some("source-private-canary".to_owned());
+        event.adapter_id = Some("adapter-private-canary".to_owned());
+        event
+    }
+
+    fn local_release(access: &EvidenceAuditEvent) -> EvidenceAuditEvent {
+        let mut release = access.clone();
+        release.event_id = format!("urn:ulid:{}", ulid::Ulid::new());
+        release.occurred_at = chrono::Utc::now()
+            .checked_add_signed(chrono::Duration::milliseconds(1))
+            .expect("timestamp advances")
+            .to_rfc3339_opts(chrono::SecondsFormat::Millis, true);
+        release.phase = AuditPhase::DisclosureRelease;
+        release.decision = AuditDecision::Released;
+        release.disclosed_concepts = Some(vec!["urn:example:concept:age-bracket".to_owned()]);
+        release.evidence_id = Some(format!("urn:example:evidence:{}", ulid::Ulid::new()));
+        release.signing_key_id = Some("local-signing-key-1".to_owned());
+        release.duration_milliseconds = 19;
+        release
+    }
+
+    async fn append_local_operation(log: &EvidenceAuditLog, operation: &str) {
+        let access = local_access(log, operation);
+        let release = local_release(&access);
+        log.append(access).await.expect("access event appends");
+        log.append(release).await.expect("release event appends");
+    }
+
+    #[tokio::test]
+    async fn local_inspection_returns_one_closed_two_phase_view() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = EvidenceAuditLog::initialize(
+            &path,
+            64 * 1024,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("audit initializes");
+        let operation = "local-operation-0000000000000001";
+        append_local_operation(&log, operation).await;
+        drop(log);
+
+        let view = verified_last_local_audit_operation(&path, &audit_secret())
+            .expect("stopped local chain verifies");
+        let value = serde_json::to_value(view).expect("view serializes");
+        assert_eq!(
+            value
+                .as_object()
+                .expect("view is an object")
+                .keys()
+                .collect::<Vec<_>>(),
+            ["events", "operation", "schema"]
+        );
+        assert_eq!(
+            value["schema"],
+            serde_json::json!(LOCAL_AUDIT_OPERATION_VIEW_SCHEMA_V1)
+        );
+        assert_eq!(value["operation"], serde_json::json!(operation));
+        let events = value["events"].as_array().expect("events are an array");
+        assert_eq!(events.len(), 2);
+        assert_eq!(
+            events[0]
+                .as_object()
+                .expect("access is an object")
+                .keys()
+                .collect::<Vec<_>>(),
+            [
+                "decision",
+                "occurredAt",
+                "phase",
+                "purpose",
+                "requesterPseudonym",
+                "requirement",
+                "responseProtection",
+            ]
+        );
+        assert_eq!(events[0]["phase"], serde_json::json!("access-attempt"));
+        assert_eq!(events[0]["decision"], serde_json::json!("authorized"));
+        assert_eq!(
+            events[1]
+                .as_object()
+                .expect("release is an object")
+                .keys()
+                .collect::<Vec<_>>(),
+            [
+                "decision",
+                "disclosedConcepts",
+                "evidenceId",
+                "occurredAt",
+                "phase",
+                "purpose",
+                "requesterPseudonym",
+                "requirement",
+                "responseProtection",
+            ]
+        );
+        assert_eq!(events[1]["phase"], serde_json::json!("disclosure-release"));
+        assert_eq!(events[1]["decision"], serde_json::json!("released"));
+
+        let rendered = serde_json::to_string(&value).expect("view renders");
+        for forbidden in [
+            "assuranceProfile",
+            "actorPseudonym",
+            "grantPseudonym",
+            "subjects",
+            "selectorProfile",
+            "selectorBundlePseudonym",
+            "sourceId",
+            "adapterId",
+            "durationMilliseconds",
+            "signingKeyId",
+            "bundleRevision",
+            "raw-requester-token-canary",
+            "raw-grant-token-canary",
+            "raw-actor-token-canary",
+            "person-id-raw-selector-canary",
+            "source-private-canary",
+            "adapter-private-canary",
+        ] {
+            assert!(!rendered.contains(forbidden), "view disclosed {forbidden}");
+        }
+    }
+
+    #[tokio::test]
+    async fn local_inspection_selects_the_last_verified_native_operation() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = EvidenceAuditLog::initialize(
+            &path,
+            64 * 1024,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("audit initializes");
+        append_local_operation(&log, "local-operation-0000000000000001").await;
+        append_local_operation(&log, "local-operation-0000000000000002").await;
+        drop(log);
+
+        let value = serde_json::to_value(
+            verified_last_local_audit_operation(&path, &audit_secret())
+                .expect("stopped local chain verifies"),
+        )
+        .expect("view serializes");
+        assert_eq!(
+            value["operation"],
+            serde_json::json!("local-operation-0000000000000002")
+        );
+        assert_eq!(value["events"].as_array().map(Vec::len), Some(2));
+    }
+
+    #[tokio::test]
+    async fn local_inspection_verifies_the_full_rotated_keyed_chain() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = EvidenceAuditLog::initialize(
+            &path,
+            4096,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("audit initializes");
+        for index in 0..12 {
+            append_local_operation(&log, &format!("local-operation-{index:016}")).await;
+        }
+        drop(log);
+        assert!(
+            audit_segment_paths(&path)
+                .expect("segments enumerate")
+                .len()
+                > 2,
+            "fixture rotates through sealed history"
+        );
+
+        let value = serde_json::to_value(
+            verified_last_local_audit_operation(&path, &audit_secret())
+                .expect("the full keyed chain verifies"),
+        )
+        .expect("view serializes");
+        assert_eq!(
+            value["operation"],
+            serde_json::json!("local-operation-0000000000000011")
+        );
+    }
+
+    #[tokio::test]
+    async fn local_inspection_rejects_tampering_wrong_secret_and_live_writer() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let live_path = directory.path().join("live.jsonl");
+        let live = EvidenceAuditLog::initialize(
+            &live_path,
+            64 * 1024,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("audit initializes");
+        append_local_operation(&live, "local-operation-0000000000000001").await;
+        assert!(
+            verified_last_local_audit_operation(&live_path, &audit_secret()).is_err(),
+            "a live writer fails rather than yielding a partial view"
+        );
+        drop(live);
+
+        let wrong = AuditHashSecret::new(b"abcdef0123456789abcdef0123456789".to_vec())
+            .expect("wrong secret builds");
+        assert!(
+            verified_last_local_audit_operation(&live_path, &wrong).is_err(),
+            "a wrong secret yields no view"
+        );
+
+        rewrite_segment_line(&live_path, 0, corrupt_line);
+        assert!(
+            verified_last_local_audit_operation(&live_path, &audit_secret()).is_err(),
+            "tampered keyed history yields no view"
+        );
+    }
+
+    #[tokio::test]
+    async fn local_inspection_rejects_missing_history_and_active_segment() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = EvidenceAuditLog::initialize(
+            &path,
+            4096,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("audit initializes");
+        for index in 0..12 {
+            append_local_operation(&log, &format!("local-operation-{index:016}")).await;
+        }
+        drop(log);
+        let segments = audit_segment_paths(&path).expect("segments enumerate");
+        assert!(segments.len() > 3, "fixture has a middle sealed segment");
+        std::fs::remove_file(&segments[1]).expect("middle segment is removed");
+        assert!(matches!(
+            verified_last_local_audit_operation(&path, &audit_secret()),
+            Err(EvidenceAuditError::SegmentMissing { sequence: 2 })
+        ));
+
+        let active_path = directory.path().join("missing-active.jsonl");
+        let active = EvidenceAuditLog::initialize(
+            &active_path,
+            64 * 1024,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("audit initializes");
+        append_local_operation(&active, "local-operation-0000000000000001").await;
+        drop(active);
+        std::fs::remove_file(&active_path).expect("active segment is removed");
+        assert!(
+            verified_last_local_audit_operation(&active_path, &audit_secret()).is_err(),
+            "an absent active segment yields no view"
+        );
+    }
+
+    #[tokio::test]
+    async fn local_inspection_rejects_a_keyed_but_invalid_native_event() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = EvidenceAuditLog::initialize(
+            &directory.path().join("pseudonyms.jsonl"),
+            64 * 1024,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("pseudonym helper initializes");
+        let mut invalid = local_access(&log, "local-operation-0000000000000001");
+        invalid.decision = AuditDecision::Released;
+        drop(log);
+        let hasher = AuditChainHasher::keyed(audit_secret());
+        let envelope = AuditEnvelope::new_with_hasher(
+            serde_json::to_value(invalid).expect("invalid event serializes"),
+            None,
+            &hasher,
+        )
+        .expect("invalid native event is still keyed");
+        std::fs::write(&path, envelope.to_jsonl().expect("envelope renders"))
+            .expect("audit writes");
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt as _;
+            std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600))
+                .expect("audit mode is owner-only");
+        }
+
+        assert!(
+            verified_last_local_audit_operation(&path, &audit_secret()).is_err(),
+            "a valid chain hash cannot bless a non-native event"
+        );
+    }
+
+    #[tokio::test]
+    async fn local_inspection_fails_instead_of_truncating_at_any_bound() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = EvidenceAuditLog::initialize(
+            &path,
+            4096,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("audit initializes");
+        for index in 0..4 {
+            append_local_operation(&log, &format!("local-operation-{index:016}")).await;
+        }
+        drop(log);
+        let defaults = LocalAuditInspectionBounds::DEFAULT;
+        for bounds in [
+            LocalAuditInspectionBounds {
+                maximum_segments: 1,
+                ..defaults
+            },
+            LocalAuditInspectionBounds {
+                maximum_records: 1,
+                ..defaults
+            },
+            LocalAuditInspectionBounds {
+                maximum_output_bytes: 1,
+                ..defaults
+            },
+        ] {
+            assert!(
+                verified_last_local_audit_operation_with_bounds(&path, &audit_secret(), bounds)
+                    .is_err(),
+                "a bound failure yields no truncated view"
+            );
+        }
+    }
+
+    /// Change one byte of a record without changing its length, so the record
+    /// no longer matches the hash the chain recorded for it.
+    fn corrupt_line(line: &str) -> String {
+        let mut bytes = line.as_bytes().to_vec();
+        for byte in bytes.iter_mut() {
+            if byte.is_ascii_lowercase() {
+                *byte = if *byte == b'z' { b'y' } else { *byte + 1 };
+                break;
+            }
+        }
+        String::from_utf8(bytes).expect("a corrupted record stays UTF-8")
+    }
+
+    fn rewrite_segment_line(path: &Path, index: usize, rewrite: impl Fn(&str) -> String) {
+        let contents = std::fs::read_to_string(path).expect("segment reads");
+        let mut lines: Vec<String> = contents.lines().map(str::to_owned).collect();
+        lines[index] = rewrite(&lines[index]);
+        let mut rewritten = lines.join("\n");
+        rewritten.push('\n');
+        std::fs::write(path, rewritten).expect("segment rewrites");
+    }
+
+    /// Readiness reports on the chain, not on how busy the writer is. The
+    /// fingerprint it compares is the one the writer advances on every append,
+    /// so a probe that read it outside the writer's lock would see the
+    /// service's own traffic as external mutation and flap under load.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn readiness_holds_while_appends_are_in_flight() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = Arc::new(
+            EvidenceAuditLog::initialize(
+                &path,
+                1024 * 1024,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .expect("audit initializes"),
+        );
+
+        let stop = Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let mut writers = tokio::task::JoinSet::new();
+        for _ in 0..8 {
+            let log = Arc::clone(&log);
+            let stop = Arc::clone(&stop);
+            writers.spawn(async move {
+                while !stop.load(Ordering::Relaxed) {
+                    log.append(event(&log)).await.expect("event appends");
+                }
+            });
+        }
+
+        // Probe often enough to land inside a durable write rather than only in
+        // the gaps between them, which is the window the race lives in.
+        let mut probes = 0usize;
+        let mut unready = 0usize;
+        for _ in 0..200 {
+            if log.ready().await {
+                probes += 1;
+            } else {
+                unready += 1;
+            }
+            tokio::task::yield_now().await;
+        }
+        stop.store(true, Ordering::Relaxed);
+        while let Some(result) = writers.join_next().await {
+            result.expect("writer task joins");
+        }
+
+        assert_eq!(
+            unready, 0,
+            "readiness stayed true through {probes} probes but reported unready {unready} times while the service was writing its own audit records"
+        );
+    }
+
+    /// The point of group commit: appends that arrive while a durable write is
+    /// in flight join the next one instead of each paying their own `fsync`.
+    #[tokio::test]
+    async fn concurrent_appends_share_durable_writes() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = Arc::new(
+            EvidenceAuditLog::initialize(
+                &path,
+                1024 * 1024,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .expect("audit initializes"),
+        );
+
+        const APPENDS: usize = 64;
+        let mut appends = tokio::task::JoinSet::new();
+        for _ in 0..APPENDS {
+            let log = Arc::clone(&log);
+            appends.spawn(async move { log.append(event(&log)).await.expect("event appends") });
+        }
+        let mut hashes = Vec::new();
+        while let Some(result) = appends.join_next().await {
+            hashes.push(result.expect("append task joins").record_hash);
+        }
+        hashes.sort_unstable();
+        hashes.dedup();
+        assert_eq!(
+            hashes.len(),
+            APPENDS,
+            "every concurrent append gets its own chain position"
+        );
+
+        let writes = log.durable_writes();
+        assert!(
+            writes < APPENDS,
+            "concurrent appends must share durable writes, saw {writes} for {APPENDS} records"
+        );
+        drop(log);
+
+        let summary = verify_audit_chain(&path, &audit_secret()).expect("chain verifies");
+        assert_eq!(
+            summary.records, APPENDS,
+            "batching must not drop or duplicate a record"
+        );
+        assert!(summary.active_verified);
+    }
+
+    /// A durable write that fails leaves the in-memory head ahead of the disk,
+    /// so the sink must refuse everything afterwards rather than chain onto a
+    /// record that was never written.
+    #[tokio::test]
+    async fn a_failed_durable_write_poisons_the_sink_instead_of_forking_the_chain() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = EvidenceAuditLog::initialize(
+            &path,
+            1024 * 1024,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("audit initializes");
+        log.append(event(&log)).await.expect("event appends");
+        assert!(log.ready().await);
+
+        // Truncating through a second handle leaves the writer's pinned handle
+        // valid but the file no longer the one it fingerprinted.
+        std::fs::OpenOptions::new()
+            .write(true)
+            .truncate(true)
+            .open(&path)
+            .expect("external truncation opens");
+
+        let failed = log.append(event(&log)).await;
+        assert!(
+            failed.is_err(),
+            "an externally modified file fails the write"
+        );
+
+        let after = log.append(event(&log)).await;
+        assert!(
+            after.is_err(),
+            "the sink stays failed rather than continuing on a head the disk never received"
+        );
+        assert!(
+            !log.ready().await,
+            "a poisoned sink never reports itself ready again"
+        );
+    }
+
+    /// Callers wait for a batch they did not write, so a batch that fails has
+    /// to hand every one of them the failure. Waiting on a durable write that
+    /// will never arrive would hang the request that asked for the audit
+    /// record, which is a worse outcome than refusing it.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn a_poisoned_sink_fails_concurrent_waiters_instead_of_hanging_them() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = Arc::new(
+            EvidenceAuditLog::initialize(
+                &path,
+                1024 * 1024,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .expect("audit initializes"),
+        );
+        log.append(event(&log)).await.expect("event appends");
+        std::fs::OpenOptions::new()
+            .write(true)
+            .truncate(true)
+            .open(&path)
+            .expect("external truncation opens");
+        assert!(
+            log.append(event(&log)).await.is_err(),
+            "an externally modified file fails the write"
+        );
+
+        let mut waiters = tokio::task::JoinSet::new();
+        for _ in 0..32 {
+            let log = Arc::clone(&log);
+            waiters.spawn(async move { log.append(event(&log)).await });
+        }
+        let outcomes = tokio::time::timeout(std::time::Duration::from_secs(10), async {
+            let mut outcomes = Vec::new();
+            while let Some(result) = waiters.join_next().await {
+                outcomes.push(result.expect("append task joins"));
+            }
+            outcomes
+        })
+        .await
+        .expect("a poisoned sink answers every waiter rather than hanging one");
+
+        assert_eq!(outcomes.len(), 32);
+        assert!(
+            outcomes.iter().all(Result::is_err),
+            "every waiter is told the chain stopped, none is handed a position that was never written"
+        );
+    }
+
+    #[tokio::test]
+    async fn storage_usage_counts_every_segment_and_grows_across_rotation() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = EvidenceAuditLog::initialize(
+            &path,
+            4096,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("audit initializes");
+
+        let empty = log.storage_usage().await.expect("usage reads");
+        assert_eq!(
+            empty.segments, 1,
+            "the active segment counts before any append"
+        );
+        assert_eq!(empty.bytes, 0);
+
+        log.append(event(&log)).await.expect("event appends");
+        let single = log.storage_usage().await.expect("usage reads");
+        assert_eq!(single.segments, 1);
+        assert!(single.bytes > 0, "an appended record occupies bytes");
+
+        const RECORDS: usize = 24;
+        for _ in 0..RECORDS {
+            log.append(event(&log)).await.expect("event appends");
+        }
+
+        let rolled = log.storage_usage().await.expect("usage reads");
+        assert!(
+            rolled.segments > 1,
+            "a bound smaller than the appended volume must roll at least once"
+        );
+        assert_eq!(
+            rolled.segments,
+            audit_segment_paths(&path)
+                .expect("segments enumerate")
+                .len(),
+            "usage counts sealed segments as well as the active one"
+        );
+        assert!(
+            rolled.bytes > single.bytes,
+            "sealed history keeps counting toward the footprint after rotation"
+        );
+
+        // Retention is the operator's, so archiving a sealed segment must show
+        // up as a smaller footprint rather than being masked by a counter that
+        // only ever accumulates.
+        let segments = audit_segment_paths(&path).expect("segments enumerate");
+        let oldest = segments.first().expect("rotation sealed a segment");
+        let archived = std::fs::metadata(oldest).expect("sealed metadata").len();
+        std::fs::remove_file(oldest).expect("sealed segment archives away");
+
+        let pruned = log.storage_usage().await.expect("usage reads");
+        assert_eq!(pruned.segments, rolled.segments - 1);
+        assert_eq!(pruned.bytes, rolled.bytes - archived);
+    }
+
+    /// Append past the per-segment bound and prove the sealed segment and the
+    /// active segment are one chain, not two independent ones.
+    #[tokio::test]
+    async fn appends_rotate_into_sealed_segments_and_the_chain_spans_the_seam() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = EvidenceAuditLog::initialize(
+            &path,
+            4096,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("audit initializes");
+
+        const RECORDS: usize = 24;
+        for _ in 0..RECORDS {
+            log.append(event(&log)).await.expect("event appends");
+        }
+
+        let segments = audit_segment_paths(&path).expect("segments enumerate");
+        assert!(
+            segments.len() > 1,
+            "a bound smaller than the appended volume must roll at least once"
+        );
+        assert_eq!(
+            segments.last().expect("an active segment exists"),
+            &path,
+            "the configured path stays the active segment"
+        );
+        assert!(
+            log.ready().await,
+            "the chain stays ready across its own rotation"
+        );
+
+        // Against a live writer the verifier proves sealed history only, rather
+        // than racing an in-flight append and calling a partial line corruption.
+        let live = verify_audit_chain(&path, &audit_secret())
+            .expect("sealed history verifies while the writer runs");
+        assert!(!live.active_verified);
+        assert_eq!(live.segments, segments.len() - 1);
+        drop(log);
+
+        let summary = verify_audit_chain(&path, &audit_secret())
+            .expect("the chain verifies across every seam");
+        assert!(summary.active_verified);
+        assert_eq!(summary.records, RECORDS, "no record is lost to rotation");
+        assert_eq!(summary.segments, segments.len());
+        assert_eq!(summary.first_sequence, Some(1));
+        assert_eq!(summary.last_sequence, Some(segments.len() as u64 - 1));
+    }
+
+    /// Rotation must never be reachable ahead of the pinned-path check, or an
+    /// external rename would be laundered into a legitimate-looking seal.
+    #[tokio::test]
+    async fn pathname_replacement_is_rejected_even_when_the_append_would_rotate() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = EvidenceAuditLog::initialize(
+            &path,
+            4096,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("audit initializes");
+        // Fill the active segment so the next append is one that would rotate.
+        while std::fs::metadata(&path)
+            .expect("active segment reads")
+            .len()
+            == 0
+            || audit_segment_paths(&path)
+                .expect("segments enumerate")
+                .len()
+                < 2
+        {
+            log.append(event(&log)).await.expect("event appends");
+        }
+        let sealed_before = audit_segment_paths(&path)
+            .expect("segments enumerate")
+            .len();
+
+        let displaced = directory.path().join("displaced.jsonl");
+        std::fs::rename(&path, &displaced).expect("the active segment is renamed away");
+        std::fs::write(&path, "").expect("a replacement is planted");
+
+        assert!(
+            log.append(event(&log)).await.is_err(),
+            "an append must not continue onto a replaced pathname, rotation or not"
+        );
+        assert!(!log.ready().await);
+        assert_eq!(
+            audit_segment_paths(&path)
+                .expect("segments enumerate")
+                .len(),
+            sealed_before,
+            "a rejected append must not seal anything"
+        );
+    }
+
+    /// A gap in sealed history is reported as a missing segment, not as a hash
+    /// break, so an operator can tell archival from tampering.
+    #[tokio::test]
+    async fn an_archived_middle_segment_is_reported_as_missing_not_as_corruption() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        {
+            let log = EvidenceAuditLog::initialize(
+                &path,
+                2048,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .expect("audit initializes");
+            for _ in 0..48 {
+                log.append(event(&log)).await.expect("event appends");
+            }
+        }
+        let segments = audit_segment_paths(&path).expect("segments enumerate");
+        assert!(
+            segments.len() >= 4,
+            "the fixture needs a sealed segment that is neither first nor last"
+        );
+        std::fs::remove_file(&segments[1]).expect("a middle segment is archived away");
+
+        assert!(
+            matches!(
+                verify_audit_chain(&path, &audit_secret()),
+                Err(EvidenceAuditError::SegmentMissing { sequence: 2 })
+            ),
+            "a gap must name the absent sequence rather than look like tampering"
+        );
+    }
+
+    /// A restart after rotation must resume the sealed chain rather than
+    /// starting a second one.
+    #[tokio::test]
+    async fn a_restart_after_rotation_continues_from_the_sealed_tail() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        const BEFORE: usize = 24;
+        {
+            let log = EvidenceAuditLog::initialize(
+                &path,
+                4096,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .expect("audit initializes");
+            for _ in 0..BEFORE {
+                log.append(event(&log)).await.expect("event appends");
+            }
+            assert!(
+                audit_segment_paths(&path)
+                    .expect("segments enumerate")
+                    .len()
+                    > 1
+            );
+        }
+
+        let restarted = EvidenceAuditLog::initialize(
+            &path,
+            4096,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("a rotated chain verifies on restart");
+        restarted
+            .append(event(&restarted))
+            .await
+            .expect("a restarted rotated chain accepts an append");
+        drop(restarted);
+
+        let summary = verify_audit_chain(&path, &audit_secret())
+            .expect("the chain verifies after a restart across a seam");
+        assert_eq!(summary.records, BEFORE + 1);
+    }
+
+    /// Crashing between the rename and the creation of the replacement leaves
+    /// no active segment. Restart must recover the chain head from the sealed
+    /// tail instead of silently beginning a new chain at genesis.
+    #[tokio::test]
+    async fn a_missing_active_segment_recovers_from_the_sealed_tail() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        const BEFORE: usize = 24;
+        {
+            let log = EvidenceAuditLog::initialize(
+                &path,
+                4096,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .expect("audit initializes");
+            for _ in 0..BEFORE {
+                log.append(event(&log)).await.expect("event appends");
+            }
+        }
+        let segments = audit_segment_paths(&path).expect("segments enumerate");
+        assert!(segments.len() > 1, "the fixture must have rolled");
+        let sealed_records: usize = segments[..segments.len() - 1]
+            .iter()
+            .map(|segment| {
+                std::fs::read_to_string(segment)
+                    .expect("sealed segment reads")
+                    .lines()
+                    .count()
+            })
+            .sum();
+        std::fs::remove_file(&path).expect("the active segment is lost to a crash");
+
+        let restarted = EvidenceAuditLog::initialize(
+            &path,
+            4096,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("a missing active segment is recreated");
+        restarted
+            .append(event(&restarted))
+            .await
+            .expect("appends resume after the active segment is lost");
+        drop(restarted);
+
+        let summary = verify_audit_chain(&path, &audit_secret())
+            .expect("the recovered chain still spans its seams");
+        assert_eq!(
+            summary.records,
+            sealed_records + 1,
+            "the record written after recovery continues sealed history, and the \
+             records lost with the active segment are not silently replaced"
+        );
+        assert!(
+            summary.records < BEFORE + 1,
+            "the fixture must actually have lost the active segment's records"
+        );
+        assert!(
+            summary.head.is_some(),
+            "the recovered chain continues rather than restarting at genesis"
+        );
+    }
+
+    /// The chain head is recovered from the last record of the newest sealed
+    /// segment, so corrupting that record is caught at startup.
+    #[tokio::test]
+    async fn a_corrupt_sealed_tail_is_rejected_at_startup() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        {
+            let log = EvidenceAuditLog::initialize(
+                &path,
+                4096,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .expect("audit initializes");
+            for _ in 0..24 {
+                log.append(event(&log)).await.expect("event appends");
+            }
+        }
+
+        let segments = audit_segment_paths(&path).expect("segments enumerate");
+        let newest_sealed = segments[segments.len() - 2].clone();
+        let sealed_lines = std::fs::read_to_string(&newest_sealed)
+            .expect("sealed segment reads")
+            .lines()
+            .count();
+        rewrite_segment_line(&newest_sealed, sealed_lines - 1, corrupt_line);
+
+        assert!(
+            EvidenceAuditLog::initialize(
+                &path,
+                4096,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .is_err(),
+            "a corrupt sealed tail must not be accepted as the chain head"
+        );
+    }
+
+    /// Boot-time verification deliberately covers only the active segment and
+    /// the sealed tail it chains to, so history is bounded rather than replayed
+    /// from genesis. This pins the accepted cost: corruption inside an already
+    /// sealed segment starts the service and is caught by the out-of-band
+    /// verifier instead.
+    #[tokio::test]
+    async fn sealed_segment_corruption_passes_startup_and_fails_the_verifier() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        {
+            let log = EvidenceAuditLog::initialize(
+                &path,
+                4096,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .expect("audit initializes");
+            for _ in 0..24 {
+                log.append(event(&log)).await.expect("event appends");
+            }
+        }
+
+        let segments = audit_segment_paths(&path).expect("segments enumerate");
+        let oldest_sealed = segments[0].clone();
+        assert!(
+            std::fs::read_to_string(&oldest_sealed)
+                .expect("sealed segment reads")
+                .lines()
+                .count()
+                > 1,
+            "the corrupted record must not be the sealed tail"
+        );
+        rewrite_segment_line(&oldest_sealed, 0, corrupt_line);
+
+        let restarted = EvidenceAuditLog::initialize(
+            &path,
+            4096,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("startup does not replay sealed history");
+        assert!(restarted.ready().await);
+        drop(restarted);
+
+        assert!(
+            verify_audit_chain(&path, &audit_secret()).is_err(),
+            "the out-of-band verifier is what catches sealed-segment corruption"
+        );
+    }
+}
diff --git a/crates/registry-evidence/src/auth.rs b/crates/registry-evidence/src/auth.rs
new file mode 100644
index 000000000..bb697db11
--- /dev/null
+++ b/crates/registry-evidence/src/auth.rs
@@ -0,0 +1,991 @@
+//! Strict OIDC access-token authentication and configured claim extraction.
+
+use std::{
+    sync::{Arc, Mutex, MutexGuard, PoisonError},
+    time::{Duration, Instant},
+};
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use registry_platform_crypto::parse_json_strict;
+use registry_platform_httputil::FetchUrlPolicy;
+use registry_platform_oidc::{
+    JwksFetcher, JwksFetcherConfig, OidcError, TokenVerifier, TokenVerifierConfig, VerifiedToken,
+};
+use serde_json::{Map, Value};
+use thiserror::Error;
+
+use crate::config::{
+    AccessTokenAlgorithm, AccessTokenType, AssuranceProfile, AuthenticationConfig,
+};
+
+const MAX_TOKEN_BYTES: usize = 128 * 1024;
+const MAX_HEADER_BYTES: usize = 8 * 1024;
+const MAX_CLAIMS_BYTES: usize = 64 * 1024;
+const MAX_PRINCIPAL_BYTES: usize = 512;
+const MAX_TAGS: usize = 32;
+
+/// How long an unreachable issuer key set stays quiet after it has been named
+/// once.
+///
+/// A deployment that cannot reach the key set rejects every request, so the
+/// unthrottled report is one log line per request: the fault would bury the
+/// traffic that revealed it, and a caller could provoke the writing. One line a
+/// minute names it and keeps naming it while it lasts.
+const KEY_SOURCE_REPORT_INTERVAL: Duration = Duration::from_secs(60);
+
+/// How long a failed readiness probe is trusted before another is attempted.
+///
+/// Readiness is polled on a schedule the service does not choose. Without this,
+/// a probe every second against an issuer that is down is an outbound request
+/// every second, from every replica. A successful probe needs no equivalent:
+/// the verifier's own cache answers it without a request.
+const KEY_SOURCE_PROBE_INTERVAL: Duration = Duration::from_secs(15);
+
+/// Stands in for the key-set location in the log when there is none to name.
+///
+/// Only an in-memory key set reaches this, which no deployment configures.
+const STATIC_KEY_SOURCE: &str = "<static key set>";
+
+/// How many causes below the reported error are rendered.
+///
+/// `reqwest` reports a transport failure as "error sending request" and keeps
+/// the reason underneath it: the connection that was refused, the certificate
+/// that did not verify. That reason is the whole diagnosis, and it is two or
+/// three levels down.
+const REPORTED_CAUSES: usize = 3;
+
+/// The bound on the rendered cause, which is remote text in part.
+const MAX_CAUSE_BYTES: usize = 512;
+
+#[derive(Debug, Clone)]
+pub struct AuthenticationClaimsConfig {
+    pub principal_claim: String,
+    pub requester_tags_claim: String,
+    pub evidence_audience_claim: String,
+    pub grant_id_claim: String,
+    pub grant_authority_claim: String,
+    pub actor_claim: Option<String>,
+}
+
+#[derive(Clone)]
+pub struct Authenticator {
+    verifier: Arc<TokenVerifier>,
+    claims: AuthenticationClaimsConfig,
+    key_source: Arc<Mutex<KeySourceState>>,
+}
+
+/// What is known about the issuer key set, and when it was last said aloud.
+///
+/// Shared rather than copied when the authenticator is cloned, so the two
+/// intervals bound the process and not each handle.
+#[derive(Debug, Default)]
+struct KeySourceState {
+    /// When the failure was last written to the log.
+    last_reported: Option<Instant>,
+    /// When a readiness probe last failed, and so has not been retried since.
+    last_failed_probe: Option<Instant>,
+}
+
+impl std::fmt::Debug for Authenticator {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("Authenticator")
+            .field("claims", &self.claims)
+            .finish_non_exhaustive()
+    }
+}
+
+#[derive(Clone)]
+pub struct AuthenticatedContext {
+    principal: String,
+    actor: Option<String>,
+    requester_tags: Vec<String>,
+    evidence_audience: String,
+    grant_id: Option<String>,
+    grant_authority: Option<String>,
+    verified_claims: Value,
+}
+
+impl AuthenticatedContext {
+    pub fn principal(&self) -> &str {
+        &self.principal
+    }
+
+    pub fn actor(&self) -> Option<&str> {
+        self.actor.as_deref()
+    }
+
+    pub fn requester_tags(&self) -> &[String] {
+        &self.requester_tags
+    }
+
+    pub fn evidence_audience(&self) -> &str {
+        &self.evidence_audience
+    }
+
+    pub fn grant_id(&self) -> Option<&str> {
+        self.grant_id.as_deref()
+    }
+
+    pub fn grant_authority(&self) -> Option<&str> {
+        self.grant_authority.as_deref()
+    }
+
+    pub fn claim_path(&self, path: &str) -> Option<&Value> {
+        resolve_claim_path(&self.verified_claims, path)
+    }
+
+    /// Construct a context for the bundle-owned, offline fixture command.
+    ///
+    /// This is crate-private so no production caller can bypass token
+    /// verification. The public fixture harness still runs the normal
+    /// authorization and selector-resolution functions over this context.
+    pub(crate) fn offline_fixture_context(
+        requester_tags: Vec<String>,
+        evidence_audience: &str,
+        grant_id: Option<&str>,
+        grant_authority: Option<&str>,
+        verified_claims: Value,
+    ) -> Self {
+        Self {
+            principal: "offline-fixture-principal".to_owned(),
+            actor: None,
+            requester_tags,
+            evidence_audience: evidence_audience.to_owned(),
+            grant_id: grant_id.map(ToOwned::to_owned),
+            grant_authority: grant_authority.map(ToOwned::to_owned),
+            verified_claims,
+        }
+    }
+
+    #[cfg(test)]
+    pub(crate) fn test_context(
+        principal: &str,
+        requester_tags: Vec<String>,
+        evidence_audience: &str,
+        grant_id: Option<&str>,
+        grant_authority: Option<&str>,
+        verified_claims: Value,
+    ) -> Self {
+        let mut context = Self::offline_fixture_context(
+            requester_tags,
+            evidence_audience,
+            grant_id,
+            grant_authority,
+            verified_claims,
+        );
+        context.principal = principal.to_owned();
+        context
+    }
+}
+
+impl std::fmt::Debug for AuthenticatedContext {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("AuthenticatedContext")
+            .field("principal", &"<redacted>")
+            .field("actor", &self.actor.as_ref().map(|_| "<redacted>"))
+            .field("requester_tags", &"<redacted>")
+            .field("evidence_audience", &self.evidence_audience)
+            .field("grant_id", &self.grant_id.as_ref().map(|_| "<redacted>"))
+            .field(
+                "grant_authority",
+                &self.grant_authority.as_ref().map(|_| "<redacted>"),
+            )
+            .field("verified_claims", &"<redacted>")
+            .finish()
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum AuthenticationError {
+    #[error("access token is malformed")]
+    Malformed,
+    #[error("access token verification failed")]
+    Verification,
+    #[error("required authenticated context is missing or invalid")]
+    Context,
+    #[error("access token is bound to a sender proof this profile cannot validate")]
+    SenderConstrained,
+}
+
+/// RFC 7800 confirmation claim. Its presence means the authorization server
+/// issued a token that is only valid when presented with a matching proof of
+/// possession, such as DPoP or mutual TLS.
+const CONFIRMATION_CLAIM: &str = "cnf";
+
+impl Authenticator {
+    /// Build the one strict resource-server profile from the loaded bundle.
+    pub fn from_config(config: &AuthenticationConfig, assurance_profile: AssuranceProfile) -> Self {
+        let algorithms = config
+            .algorithms
+            .iter()
+            .map(|algorithm| match algorithm {
+                AccessTokenAlgorithm::EdDSA => jsonwebtoken::Algorithm::EdDSA,
+                AccessTokenAlgorithm::ES256 => jsonwebtoken::Algorithm::ES256,
+                AccessTokenAlgorithm::RS256 => jsonwebtoken::Algorithm::RS256,
+            })
+            .collect();
+        let token_types = config
+            .token_types
+            .iter()
+            .map(|token_type| match token_type {
+                AccessTokenType::AtJwt => "at+jwt".to_owned(),
+                AccessTokenType::ApplicationAtJwt => "application/at+jwt".to_owned(),
+            })
+            .collect();
+        let verifier_config = TokenVerifierConfig::access_token_profile(
+            config.issuer.clone(),
+            config.audiences.clone(),
+            algorithms,
+            token_types,
+        );
+        let fetcher = Arc::new(JwksFetcher::new_with_fetch_url_policy(
+            config.jwks_uri.clone(),
+            JwksFetcherConfig::defaults(),
+            jwks_fetch_policy(config, assurance_profile),
+        ));
+        let verifier = Arc::new(TokenVerifier::new(verifier_config, fetcher));
+        let claims = AuthenticationClaimsConfig {
+            principal_claim: config.principal_claim.clone(),
+            requester_tags_claim: config.requester_tags_claim.clone(),
+            evidence_audience_claim: config.evidence_audience_claim.clone(),
+            grant_id_claim: config.grant_id_claim.clone(),
+            grant_authority_claim: config.grant_authority_claim.clone(),
+            actor_claim: config.actor_claim.clone(),
+        };
+        Self::new(verifier, claims)
+    }
+
+    pub fn new(verifier: Arc<TokenVerifier>, claims: AuthenticationClaimsConfig) -> Self {
+        Self {
+            verifier,
+            claims,
+            key_source: Arc::new(Mutex::new(KeySourceState::default())),
+        }
+    }
+
+    pub async fn authenticate(
+        &self,
+        access_token: &str,
+    ) -> Result<AuthenticatedContext, AuthenticationError> {
+        strict_jwt_preflight(access_token)?;
+        let verified = match self.verifier.verify(access_token).await {
+            Ok(verified) => verified,
+            Err(error) => {
+                if is_key_source_failure(&error) {
+                    self.report_key_source_failure(&error);
+                }
+                return Err(AuthenticationError::Verification);
+            }
+        };
+        self.extract_context(verified)
+    }
+
+    /// Ask the issuer for its key set on a readiness check, and name what comes
+    /// back, without letting the answer decide readiness.
+    ///
+    /// Readiness answers whether this deployment should be sent traffic, and
+    /// the honest answer during an issuer outage is yes: the verifier keeps
+    /// serving a key set it cannot recheck for a bounded while, so requests
+    /// carrying tokens signed by keys already held still succeed. Withholding
+    /// readiness would take every replica out of rotation at once for a
+    /// dependency none of them owns, which is the shape of a cascading failure
+    /// rather than a diagnosis. So the probe reports and the report is the
+    /// point: an operator watching this deployment is told the issuer has gone
+    /// quiet while requests still work, and told again when the allowance is
+    /// what stands between them and rejecting everything.
+    ///
+    /// A failed probe is remembered for a short interval, so an orchestrator's
+    /// polling schedule cannot become this deployment's retry schedule against
+    /// an issuer that is down.
+    pub async fn probe_key_source(&self) {
+        if self.probe_is_suppressed(Instant::now()) {
+            return;
+        }
+        match self.verifier.key_source().ensure_key_set().await {
+            Ok(()) => {
+                self.lock_key_source().last_failed_probe = None;
+                self.report_key_source_outage().await;
+            }
+            Err(error) => {
+                self.report_key_source_failure(&error);
+                self.lock_key_source().last_failed_probe = Some(Instant::now());
+            }
+        }
+    }
+
+    /// Attempt the issuer's key set once at startup, and name it if it cannot
+    /// be had.
+    ///
+    /// A misspelled or unreachable `jwksUri` is otherwise discovered one
+    /// rejected request at a time, and the rejection an operator sees is the
+    /// same closed `401` a bad token gets. Startup is where an operator is
+    /// looking, so startup is where it should be said.
+    ///
+    /// It reports rather than refuses, for the same reason readiness does:
+    /// refusing would tie this deployment's start to the issuer's, so a restart
+    /// during an issuer outage could not come back, and an issuer that starts
+    /// alongside this service would race it.
+    pub async fn announce_key_source(&self) {
+        if let Err(error) = self.verifier.key_source().ensure_key_set().await {
+            self.report_key_source_failure(&error);
+        }
+    }
+
+    /// Whether the last probe failed recently enough to stand for this one.
+    fn probe_is_suppressed(&self, now: Instant) -> bool {
+        self.lock_key_source()
+            .last_failed_probe
+            .is_some_and(|failed| now.duration_since(failed) < KEY_SOURCE_PROBE_INTERVAL)
+    }
+
+    /// Name an unreachable issuer key set, at most once per interval.
+    ///
+    /// The caller learns nothing from this. Their rejection is the same closed
+    /// `401` whether the token was bad or this deployment could not check it,
+    /// which is the right answer to give a caller and the reason the operator
+    /// has nothing else to go on. The distinction exists only here.
+    fn report_key_source_failure(&self, error: &OidcError) {
+        if !self.claim_report_interval(Instant::now()) {
+            return;
+        }
+        tracing::warn!(
+            target: "registry_evidence::authentication",
+            jwks_uri = self
+                .verifier
+                .key_source()
+                .jwks_uri()
+                .unwrap_or(STATIC_KEY_SOURCE),
+            cause = describe_causes(error),
+            "the access-token issuer key set could not be retrieved; every request is rejected until it can be"
+        );
+    }
+
+    /// Name a key set that is being served without being confirmed, at most
+    /// once per interval.
+    ///
+    /// Nothing else would say so. The verifier keeps serving a key set it
+    /// cannot recheck, so requests succeed, readiness holds, and the only
+    /// thing that has changed is that the issuer has stopped answering. That
+    /// is worth an operator's attention before the allowance runs out and the
+    /// deployment starts rejecting everything.
+    async fn report_key_source_outage(&self) {
+        let Some(outage) = self.verifier.key_source().outage_duration().await else {
+            return;
+        };
+        if !self.claim_report_interval(Instant::now()) {
+            return;
+        }
+        tracing::warn!(
+            target: "registry_evidence::authentication",
+            jwks_uri = self
+                .verifier
+                .key_source()
+                .jwks_uri()
+                .unwrap_or(STATIC_KEY_SOURCE),
+            outage_seconds = outage.as_secs(),
+            "the access-token issuer key set has not been retrievable; the key set already held is still being accepted, and requests will be rejected once its allowance runs out"
+        );
+    }
+
+    /// Take the reporting interval if it is free, so exactly one caller logs.
+    fn claim_report_interval(&self, now: Instant) -> bool {
+        let mut state = self.lock_key_source();
+        if state
+            .last_reported
+            .is_some_and(|reported| now.duration_since(reported) < KEY_SOURCE_REPORT_INTERVAL)
+        {
+            return false;
+        }
+        state.last_reported = Some(now);
+        true
+    }
+
+    /// Recover the guard even from a poisoned lock: the state behind it is two
+    /// timestamps, which a panicking holder cannot leave inconsistent, and
+    /// readiness must not panic because a report once did.
+    fn lock_key_source(&self) -> MutexGuard<'_, KeySourceState> {
+        self.key_source
+            .lock()
+            .unwrap_or_else(PoisonError::into_inner)
+    }
+
+    fn extract_context(
+        &self,
+        verified: VerifiedToken,
+    ) -> Result<AuthenticatedContext, AuthenticationError> {
+        let claims =
+            serde_json::to_value(verified.claims).map_err(|_| AuthenticationError::Context)?;
+        let claims_object = claims.as_object().ok_or(AuthenticationError::Context)?;
+
+        // Version one validates no proof of possession. Treating a
+        // sender-constrained token as an ordinary bearer would silently discard
+        // the constraint the authorization server issued it under and make a
+        // stolen token replayable for its whole lifetime, so the profile denies
+        // rather than downgrades.
+        if claims_object.contains_key(CONFIRMATION_CLAIM) {
+            return Err(AuthenticationError::SenderConstrained);
+        }
+
+        let principal = required_direct_string(
+            claims_object,
+            &self.claims.principal_claim,
+            MAX_PRINCIPAL_BYTES,
+        )?;
+        let evidence_audience = required_direct_string(
+            claims_object,
+            &self.claims.evidence_audience_claim,
+            MAX_PRINCIPAL_BYTES,
+        )?;
+        url::Url::parse(&evidence_audience).map_err(|_| AuthenticationError::Context)?;
+        let requester_tags =
+            required_string_array(claims_object, &self.claims.requester_tags_claim, MAX_TAGS)?;
+        let actor = self
+            .claims
+            .actor_claim
+            .as_deref()
+            .map(|claim| optional_direct_string(claims_object, claim, MAX_PRINCIPAL_BYTES))
+            .transpose()?
+            .flatten();
+        let grant_id = optional_direct_string(
+            claims_object,
+            &self.claims.grant_id_claim,
+            MAX_PRINCIPAL_BYTES,
+        )?;
+        let grant_authority = optional_direct_string(
+            claims_object,
+            &self.claims.grant_authority_claim,
+            MAX_PRINCIPAL_BYTES,
+        )?;
+        if grant_id.is_some() != grant_authority.is_some() {
+            return Err(AuthenticationError::Context);
+        }
+
+        Ok(AuthenticatedContext {
+            principal,
+            actor,
+            requester_tags,
+            evidence_audience,
+            grant_id,
+            grant_authority,
+            verified_claims: claims,
+        })
+    }
+}
+
+fn jwks_fetch_policy(
+    config: &AuthenticationConfig,
+    assurance_profile: AssuranceProfile,
+) -> FetchUrlPolicy {
+    if config.uses_local_mint_http(assurance_profile) {
+        return FetchUrlPolicy {
+            allowed_schemes: vec!["http".to_owned()],
+            allow_localhost: true,
+            allow_http_private_network: false,
+            deny_private_ranges: true,
+            deny_cloud_metadata: true,
+        };
+    }
+    FetchUrlPolicy {
+        allowed_schemes: vec!["https".to_owned()],
+        allow_localhost: true,
+        allow_http_private_network: false,
+        deny_private_ranges: false,
+        deny_cloud_metadata: true,
+    }
+}
+
+/// Whether a verification failure was this deployment's key source rather than
+/// the caller's token.
+///
+/// Every known failure is listed rather than folded into the wildcard, which
+/// covers only variants added to the shared verifier after this was written.
+/// Those default to the caller's side: a failure this code has never seen is
+/// one it cannot honestly describe as an unreachable key set, and an operator
+/// misdirected by a confident wrong message is worse off than one who reads
+/// the same `authentication_failed` twice.
+fn is_key_source_failure(error: &OidcError) -> bool {
+    match error {
+        OidcError::Transport(_)
+        | OidcError::BoundedRead(_)
+        | OidcError::FetchUrl(_)
+        | OidcError::HttpStatus(_)
+        | OidcError::InvalidUrl
+        | OidcError::Parse
+        | OidcError::InvalidJwk
+        | OidcError::EmptyKeySet
+        | OidcError::MissingIssuer => true,
+        OidcError::IssuerMismatch { .. }
+        | OidcError::MalformedToken
+        | OidcError::AlgorithmNotAllowed
+        | OidcError::TokenTypeNotAllowed
+        | OidcError::MissingKid
+        | OidcError::KidTooLong
+        | OidcError::UnknownKid
+        | OidcError::TokenExpired
+        | OidcError::TokenNotYetValid
+        | OidcError::AudienceMismatch
+        | OidcError::SignatureInvalid
+        | OidcError::InvalidToken
+        | OidcError::ClientNotAllowed => false,
+        _ => false,
+    }
+}
+
+/// Render an error together with the causes beneath it, bounded.
+///
+/// Separated from the logging call so what reaches the log can be asserted
+/// directly. Every part of it is either this crate's own text or the transport
+/// library's account of a connection to an address the bundle configured;
+/// nothing the caller supplied passes through here.
+fn describe_causes(error: &dyn std::error::Error) -> String {
+    let mut rendered = error.to_string();
+    let mut cause = error.source();
+    let mut remaining = REPORTED_CAUSES;
+    while let (Some(current), 1..) = (cause, remaining) {
+        rendered.push_str(": ");
+        rendered.push_str(&current.to_string());
+        cause = current.source();
+        remaining -= 1;
+    }
+    if rendered.len() > MAX_CAUSE_BYTES {
+        let mut end = MAX_CAUSE_BYTES;
+        while !rendered.is_char_boundary(end) {
+            end -= 1;
+        }
+        rendered.truncate(end);
+        rendered.push_str("...");
+    }
+    rendered
+}
+
+pub fn strict_jwt_preflight(token: &str) -> Result<(), AuthenticationError> {
+    if token.is_empty()
+        || token.len() > MAX_TOKEN_BYTES
+        || token.bytes().any(|byte| byte.is_ascii_whitespace())
+    {
+        return Err(AuthenticationError::Malformed);
+    }
+    let mut segments = token.split('.');
+    let header = segments.next().ok_or(AuthenticationError::Malformed)?;
+    let claims = segments.next().ok_or(AuthenticationError::Malformed)?;
+    let signature = segments.next().ok_or(AuthenticationError::Malformed)?;
+    if segments.next().is_some() || header.is_empty() || claims.is_empty() || signature.is_empty() {
+        return Err(AuthenticationError::Malformed);
+    }
+    decode_strict_object(header, MAX_HEADER_BYTES)?;
+    decode_strict_object(claims, MAX_CLAIMS_BYTES)?;
+    let signature = URL_SAFE_NO_PAD
+        .decode(signature)
+        .map_err(|_| AuthenticationError::Malformed)?;
+    if signature.is_empty() || signature.len() > MAX_HEADER_BYTES {
+        return Err(AuthenticationError::Malformed);
+    }
+    Ok(())
+}
+
+fn decode_strict_object(segment: &str, maximum: usize) -> Result<(), AuthenticationError> {
+    let decoded = URL_SAFE_NO_PAD
+        .decode(segment)
+        .map_err(|_| AuthenticationError::Malformed)?;
+    if decoded.is_empty() || decoded.len() > maximum {
+        return Err(AuthenticationError::Malformed);
+    }
+    let value = parse_json_strict(&decoded).map_err(|_| AuthenticationError::Malformed)?;
+    if !value.is_object() {
+        return Err(AuthenticationError::Malformed);
+    }
+    Ok(())
+}
+
+fn required_direct_string(
+    claims: &Map<String, Value>,
+    name: &str,
+    maximum_bytes: usize,
+) -> Result<String, AuthenticationError> {
+    optional_direct_string(claims, name, maximum_bytes)?.ok_or(AuthenticationError::Context)
+}
+
+fn optional_direct_string(
+    claims: &Map<String, Value>,
+    name: &str,
+    maximum_bytes: usize,
+) -> Result<Option<String>, AuthenticationError> {
+    let Some(value) = claims.get(name) else {
+        return Ok(None);
+    };
+    let value = value.as_str().ok_or(AuthenticationError::Context)?;
+    if value.is_empty() || value.len() > maximum_bytes {
+        return Err(AuthenticationError::Context);
+    }
+    Ok(Some(value.to_owned()))
+}
+
+fn required_string_array(
+    claims: &Map<String, Value>,
+    name: &str,
+    maximum_items: usize,
+) -> Result<Vec<String>, AuthenticationError> {
+    let values = claims
+        .get(name)
+        .and_then(Value::as_array)
+        .ok_or(AuthenticationError::Context)?;
+    if values.is_empty() || values.len() > maximum_items {
+        return Err(AuthenticationError::Context);
+    }
+    let mut output = Vec::with_capacity(values.len());
+    for value in values {
+        let value = value.as_str().ok_or(AuthenticationError::Context)?;
+        if value.is_empty() || value.len() > MAX_PRINCIPAL_BYTES {
+            return Err(AuthenticationError::Context);
+        }
+        output.push(value.to_owned());
+    }
+    output.sort();
+    output.dedup();
+    Ok(output)
+}
+
+fn resolve_claim_path<'a>(claims: &'a Value, path: &str) -> Option<&'a Value> {
+    if path.is_empty() || path.len() > 512 {
+        return None;
+    }
+    let mut current = claims;
+    for segment in path.split('.') {
+        if !valid_claim_path_segment(segment) {
+            return None;
+        }
+        current = current.as_object()?.get(segment)?;
+    }
+    Some(current)
+}
+
+fn valid_claim_path_segment(segment: &str) -> bool {
+    let mut bytes = segment.bytes();
+    matches!(bytes.next(), Some(b'A'..=b'Z' | b'a'..=b'z' | b'_'))
+        && bytes.all(|byte| {
+            byte.is_ascii_uppercase()
+                || byte.is_ascii_lowercase()
+                || byte.is_ascii_digit()
+                || matches!(byte, b'_' | b'-')
+        })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn authentication_config() -> AuthenticationConfig {
+        crate::config::EvidenceConfig::parse_yaml(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ))
+        .expect("acceptance configuration parses")
+        .authentication
+    }
+
+    #[test]
+    fn jwks_fetch_policy_opens_http_only_for_exact_local_mint() {
+        let mut exact = authentication_config();
+        exact.issuer = "http://127.0.0.1:8081".to_owned();
+        exact.jwks_uri = "http://127.0.0.1:8081/.well-known/jwks.json".to_owned();
+        let local = jwks_fetch_policy(&exact, AssuranceProfile::Local);
+        assert_eq!(local.allowed_schemes, ["http"]);
+        assert!(local.allow_localhost);
+        assert!(local.deny_private_ranges);
+
+        for (profile, issuer, jwks_uri) in [
+            (
+                AssuranceProfile::Production,
+                "http://127.0.0.1:8081",
+                "http://127.0.0.1:8081/.well-known/jwks.json",
+            ),
+            (
+                AssuranceProfile::EvidenceGrade,
+                "http://127.0.0.1:8081",
+                "http://127.0.0.1:8081/.well-known/jwks.json",
+            ),
+            (
+                AssuranceProfile::Local,
+                "http://localhost:8081",
+                "http://localhost:8081/.well-known/jwks.json",
+            ),
+            (
+                AssuranceProfile::Local,
+                "http://127.0.0.2:8081",
+                "http://127.0.0.2:8081/.well-known/jwks.json",
+            ),
+            (
+                AssuranceProfile::Local,
+                "http://127.0.0.1:8081",
+                "http://127.0.0.1:8082/.well-known/jwks.json",
+            ),
+        ] {
+            let mut candidate = authentication_config();
+            candidate.issuer = issuer.to_owned();
+            candidate.jwks_uri = jwks_uri.to_owned();
+            let policy = jwks_fetch_policy(&candidate, profile);
+            assert_eq!(
+                policy.allowed_schemes,
+                ["https"],
+                "{profile:?} opened HTTP for {jwks_uri}"
+            );
+        }
+    }
+
+    fn segment(input: &str) -> String {
+        URL_SAFE_NO_PAD.encode(input)
+    }
+
+    #[test]
+    fn strict_preflight_accepts_three_strict_json_segments() {
+        let token = format!(
+            "{}.{}.{}",
+            segment(r#"{"alg":"EdDSA","kid":"key","typ":"at+jwt"}"#),
+            segment(r#"{"iss":"https://issuer.invalid","aud":"evidence","exp":2000000000}"#),
+            URL_SAFE_NO_PAD.encode([1_u8; 64])
+        );
+        strict_jwt_preflight(&token).expect("token structure is valid");
+    }
+
+    #[test]
+    fn strict_preflight_rejects_duplicate_members_and_bad_compact_shape() {
+        let duplicate_header = format!(
+            "{}.{}.{}",
+            segment(r#"{"alg":"EdDSA","alg":"RS256"}"#),
+            segment(r#"{"iss":"https://issuer.invalid"}"#),
+            URL_SAFE_NO_PAD.encode([1_u8; 64])
+        );
+        assert!(strict_jwt_preflight(&duplicate_header).is_err());
+        for token in ["", "a.b", "a.b.c.d", "a..c", " a.b.c"] {
+            assert!(strict_jwt_preflight(token).is_err());
+        }
+    }
+
+    #[test]
+    fn claim_paths_are_exact_and_do_not_fallback() {
+        let claims = serde_json::json!({"grant": {"subject-id": "value"}, "sub": "principal"});
+        assert_eq!(
+            resolve_claim_path(&claims, "grant.subject-id"),
+            Some(&Value::String("value".to_string()))
+        );
+        assert!(resolve_claim_path(&claims, "grant.missing").is_none());
+        assert!(resolve_claim_path(&claims, "grant..subject-id").is_none());
+    }
+
+    #[test]
+    fn key_source_failures_are_separated_from_token_failures() {
+        // The operator's half: nothing here is anything the caller did, and
+        // each one leaves the deployment unable to verify any token at all.
+        for error in [
+            OidcError::HttpStatus(503),
+            OidcError::InvalidUrl,
+            OidcError::Parse,
+            OidcError::InvalidJwk,
+            OidcError::EmptyKeySet,
+            OidcError::MissingIssuer,
+        ] {
+            assert!(
+                is_key_source_failure(&error),
+                "{error} is a fault in this deployment's key source"
+            );
+        }
+
+        // The caller's half: reporting these would let a caller write to the
+        // operator log by presenting bad tokens, and none of them says
+        // anything about the deployment.
+        for error in [
+            OidcError::MalformedToken,
+            OidcError::AlgorithmNotAllowed,
+            OidcError::TokenTypeNotAllowed,
+            OidcError::MissingKid,
+            OidcError::KidTooLong,
+            OidcError::UnknownKid,
+            OidcError::TokenExpired,
+            OidcError::TokenNotYetValid,
+            OidcError::AudienceMismatch,
+            OidcError::SignatureInvalid,
+            OidcError::InvalidToken,
+            OidcError::ClientNotAllowed,
+            OidcError::IssuerMismatch {
+                expected: "https://issuer.invalid".to_owned(),
+                actual: "https://other.invalid".to_owned(),
+            },
+        ] {
+            assert!(
+                !is_key_source_failure(&error),
+                "{error} is a fault in the presented token"
+            );
+        }
+    }
+
+    #[derive(Debug)]
+    struct Layered {
+        message: &'static str,
+        below: Option<Box<Layered>>,
+    }
+
+    impl std::fmt::Display for Layered {
+        fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+            formatter.write_str(self.message)
+        }
+    }
+
+    impl std::error::Error for Layered {
+        fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+            self.below
+                .as_deref()
+                .map(|below| below as &(dyn std::error::Error + 'static))
+        }
+    }
+
+    fn layered(messages: &[&'static str]) -> Layered {
+        let mut layers = messages.iter().rev();
+        let mut error = Layered {
+            message: layers.next().expect("at least one layer"),
+            below: None,
+        };
+        for message in layers {
+            error = Layered {
+                message,
+                below: Some(Box::new(error)),
+            };
+        }
+        error
+    }
+
+    #[test]
+    fn the_reported_cause_reaches_past_the_summary_to_the_reason() {
+        // The shape a refused TLS handshake arrives in: the top layer says
+        // only that a request failed, and the layer an operator needs is
+        // underneath it.
+        let described = describe_causes(&layered(&[
+            "error sending request",
+            "connection error",
+            "invalid peer certificate: UnknownIssuer",
+        ]));
+        assert_eq!(
+            described,
+            "error sending request: connection error: invalid peer certificate: UnknownIssuer"
+        );
+    }
+
+    #[test]
+    fn the_reported_cause_is_bounded_in_depth_and_length() {
+        let deep = describe_causes(&layered(&["first", "second", "third", "fourth", "fifth"]));
+        assert_eq!(deep, "first: second: third: fourth");
+
+        let long = describe_causes(&layered(&["x".repeat(4096).leak()]));
+        assert!(
+            long.len() <= MAX_CAUSE_BYTES + 3,
+            "an unbounded remote message reached the log: {} bytes",
+            long.len()
+        );
+        assert!(long.ends_with("..."), "truncation is not marked: {long}");
+    }
+
+    #[test]
+    fn a_failing_key_source_is_named_once_per_interval() {
+        let authenticator = Authenticator::new(
+            Arc::new(TokenVerifier::new(
+                TokenVerifierConfig::access_token_profile(
+                    "https://issuer.invalid".to_owned(),
+                    vec!["urn:example:audience".to_owned()],
+                    vec![jsonwebtoken::Algorithm::EdDSA],
+                    vec!["at+jwt".to_owned()],
+                ),
+                Arc::new(JwksFetcher::new(
+                    "https://issuer.invalid/jwks".to_owned(),
+                    JwksFetcherConfig::defaults(),
+                )),
+            )),
+            AuthenticationClaimsConfig {
+                principal_claim: "sub".to_owned(),
+                requester_tags_claim: "evidence_tags".to_owned(),
+                evidence_audience_claim: "evidence_audience".to_owned(),
+                grant_id_claim: "evidence_grant_id".to_owned(),
+                grant_authority_claim: "evidence_authority".to_owned(),
+                actor_claim: None,
+            },
+        );
+
+        let now = Instant::now();
+        assert!(
+            authenticator.claim_report_interval(now),
+            "the first failure is always named"
+        );
+        assert!(
+            !authenticator.claim_report_interval(now + KEY_SOURCE_REPORT_INTERVAL / 2),
+            "a deployment rejecting every request must not log every request"
+        );
+        assert!(
+            authenticator.claim_report_interval(now + KEY_SOURCE_REPORT_INTERVAL),
+            "a fault that lasts keeps being named"
+        );
+    }
+
+    #[test]
+    fn a_failed_readiness_probe_stands_in_for_the_next_one() {
+        let authenticator = Authenticator::new(
+            Arc::new(TokenVerifier::new(
+                TokenVerifierConfig::access_token_profile(
+                    "https://issuer.invalid".to_owned(),
+                    vec!["urn:example:audience".to_owned()],
+                    vec![jsonwebtoken::Algorithm::EdDSA],
+                    vec!["at+jwt".to_owned()],
+                ),
+                Arc::new(JwksFetcher::new(
+                    "https://issuer.invalid/jwks".to_owned(),
+                    JwksFetcherConfig::defaults(),
+                )),
+            )),
+            AuthenticationClaimsConfig {
+                principal_claim: "sub".to_owned(),
+                requester_tags_claim: "evidence_tags".to_owned(),
+                evidence_audience_claim: "evidence_audience".to_owned(),
+                grant_id_claim: "evidence_grant_id".to_owned(),
+                grant_authority_claim: "evidence_authority".to_owned(),
+                actor_claim: None,
+            },
+        );
+
+        let now = Instant::now();
+        assert!(
+            !authenticator.probe_is_suppressed(now),
+            "nothing is known yet, so the first probe must run"
+        );
+        authenticator.lock_key_source().last_failed_probe = Some(now);
+        assert!(
+            authenticator.probe_is_suppressed(now + KEY_SOURCE_PROBE_INTERVAL / 2),
+            "an orchestrator's polling rate must not become the retry rate"
+        );
+        assert!(
+            !authenticator.probe_is_suppressed(now + KEY_SOURCE_PROBE_INTERVAL),
+            "an issuer that comes back must be found"
+        );
+    }
+
+    #[test]
+    fn authenticated_context_debug_redacts_claim_material() {
+        let mut context = AuthenticatedContext::test_context(
+            "principal-canary",
+            vec!["tag-canary".to_string()],
+            "urn:example:audience",
+            Some("grant-canary"),
+            Some("authority-canary"),
+            serde_json::json!({"protected": "claim-canary"}),
+        );
+        context.actor = Some("actor-canary".to_string());
+        let debug = format!("{context:?}");
+        for canary in [
+            "principal-canary",
+            "actor-canary",
+            "tag-canary",
+            "grant-canary",
+            "authority-canary",
+            "claim-canary",
+        ] {
+            assert!(!debug.contains(canary));
+        }
+    }
+}
diff --git a/crates/registry-evidence/src/binding.rs b/crates/registry-evidence/src/binding.rs
new file mode 100644
index 000000000..abac5fdeb
--- /dev/null
+++ b/crates/registry-evidence/src/binding.rs
@@ -0,0 +1,391 @@
+//! Audience-scoped subject and source-entity reference projection.
+
+use std::fmt;
+
+use registry_platform_crypto::hmac_sha256_base64url_no_pad;
+use thiserror::Error;
+
+const SUBJECT_DOMAIN: &[u8] = b"registry-evidence/subject-binding/v1";
+const ENTITY_DOMAIN: &[u8] = b"registry-evidence/entity-reference/v1";
+const MIN_KEY_BYTES: usize = 32;
+const MAX_COMPONENT_BYTES: usize = 8 * 1024;
+const MAX_SELECTOR_FIELDS: usize = 16;
+const MAX_ENTITY_SEED_BYTES: usize = 512;
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub enum SelectorScalar<'a> {
+    String(&'a str),
+    Date(&'a str),
+    Integer(i64),
+    Boolean(bool),
+    ControlledCode(&'a str),
+}
+
+impl fmt::Debug for SelectorScalar<'_> {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let form = match self {
+            Self::String(_) => "string",
+            Self::Date(_) => "date",
+            Self::Integer(_) => "integer",
+            Self::Boolean(_) => "boolean",
+            Self::ControlledCode(_) => "controlled-code",
+        };
+        formatter
+            .debug_struct("SelectorScalar")
+            .field("form", &form)
+            .field("value", &"[REDACTED]")
+            .finish()
+    }
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub struct SelectorField<'a> {
+    pub name: &'a str,
+    pub value: SelectorScalar<'a>,
+}
+
+impl fmt::Debug for SelectorField<'_> {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("SelectorField")
+            .field("name", &self.name)
+            .field("value", &self.value)
+            .finish()
+    }
+}
+
+#[derive(Debug, Error, PartialEq, Eq)]
+pub enum BindingError {
+    #[error("binding key material is too short")]
+    WeakKey,
+    #[error("binding key version is invalid")]
+    KeyVersion,
+    #[error("binding input is empty or exceeds its bound")]
+    Component,
+    #[error("selector field set is invalid")]
+    Fields,
+    #[error("selector date is not canonical")]
+    Date,
+    #[error("entity-reference seed is invalid")]
+    EntitySeed,
+}
+
+pub struct SubjectBindingInput<'a> {
+    pub trust_domain: &'a str,
+    pub audience: &'a str,
+    pub purpose: &'a str,
+    pub role: &'a str,
+    pub profile: &'a str,
+    pub fields: &'a [SelectorField<'a>],
+}
+
+pub fn subject_binding(
+    key: &[u8],
+    key_version: u32,
+    input: SubjectBindingInput<'_>,
+) -> Result<String, BindingError> {
+    validate_key(key, key_version)?;
+    if input.fields.is_empty() || input.fields.len() > MAX_SELECTOR_FIELDS {
+        return Err(BindingError::Fields);
+    }
+
+    let mut canonical = Vec::new();
+    push_bytes(&mut canonical, SUBJECT_DOMAIN)?;
+    push_u32(&mut canonical, key_version);
+    push_str(&mut canonical, input.trust_domain)?;
+    push_str(&mut canonical, input.audience)?;
+    push_str(&mut canonical, input.purpose)?;
+    push_str(&mut canonical, input.role)?;
+    push_str(&mut canonical, input.profile)?;
+    push_u32(
+        &mut canonical,
+        u32::try_from(input.fields.len()).map_err(|_| BindingError::Fields)?,
+    );
+
+    for field in input.fields {
+        push_str(&mut canonical, field.name)?;
+        match field.value {
+            SelectorScalar::String(value) => {
+                canonical.push(0x01);
+                push_str(&mut canonical, value)?;
+            }
+            SelectorScalar::Date(value) => {
+                if !is_canonical_date(value) {
+                    return Err(BindingError::Date);
+                }
+                canonical.push(0x02);
+                push_str(&mut canonical, value)?;
+            }
+            SelectorScalar::Integer(value) => {
+                canonical.push(0x03);
+                push_str(&mut canonical, &value.to_string())?;
+            }
+            SelectorScalar::Boolean(value) => {
+                canonical.push(0x04);
+                push_bytes(&mut canonical, &[u8::from(value)])?;
+            }
+            SelectorScalar::ControlledCode(value) => {
+                canonical.push(0x05);
+                push_str(&mut canonical, value)?;
+            }
+        }
+    }
+
+    Ok(format!(
+        "urn:evidence:subject:v{key_version}_{}",
+        hmac_sha256_base64url_no_pad(key, &canonical)
+    ))
+}
+
+pub fn entity_reference(
+    key: &[u8],
+    key_version: u32,
+    concept_id: &str,
+    audience: &str,
+    seed: &[u8],
+) -> Result<String, BindingError> {
+    validate_key(key, key_version)?;
+    if seed.is_empty() || seed.len() > MAX_ENTITY_SEED_BYTES {
+        return Err(BindingError::EntitySeed);
+    }
+    let mut canonical = Vec::new();
+    push_bytes(&mut canonical, ENTITY_DOMAIN)?;
+    push_u32(&mut canonical, key_version);
+    push_str(&mut canonical, concept_id)?;
+    push_str(&mut canonical, audience)?;
+    push_bytes(&mut canonical, seed)?;
+    Ok(format!(
+        "urn:evidence:entity:v{key_version}_{}",
+        hmac_sha256_base64url_no_pad(key, &canonical)
+    ))
+}
+
+fn validate_key(key: &[u8], key_version: u32) -> Result<(), BindingError> {
+    if key.len() < MIN_KEY_BYTES {
+        return Err(BindingError::WeakKey);
+    }
+    if key_version == 0 {
+        return Err(BindingError::KeyVersion);
+    }
+    Ok(())
+}
+
+fn push_str(output: &mut Vec<u8>, input: &str) -> Result<(), BindingError> {
+    push_bytes(output, input.as_bytes())
+}
+
+fn push_bytes(output: &mut Vec<u8>, input: &[u8]) -> Result<(), BindingError> {
+    if input.is_empty() || input.len() > MAX_COMPONENT_BYTES {
+        return Err(BindingError::Component);
+    }
+    let length = u32::try_from(input.len()).map_err(|_| BindingError::Component)?;
+    push_u32(output, length);
+    output.extend_from_slice(input);
+    Ok(())
+}
+
+fn push_u32(output: &mut Vec<u8>, value: u32) {
+    output.extend_from_slice(&value.to_be_bytes());
+}
+
+fn is_canonical_date(value: &str) -> bool {
+    if value.len() != 10 {
+        return false;
+    }
+    let bytes = value.as_bytes();
+    if bytes[4] != b'-' || bytes[7] != b'-' {
+        return false;
+    }
+    chrono::NaiveDate::parse_from_str(value, "%Y-%m-%d")
+        .map(|date| date.format("%Y-%m-%d").to_string() == value)
+        .unwrap_or(false)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const KEY: &[u8] = b"0123456789abcdef0123456789abcdef";
+
+    fn input<'a>(fields: &'a [SelectorField<'a>]) -> SubjectBindingInput<'a> {
+        SubjectBindingInput {
+            trust_domain: "urn:example:trust",
+            audience: "urn:example:relying-party",
+            purpose: "enrolment",
+            role: "subject",
+            profile: "person-v1",
+            fields,
+        }
+    }
+
+    #[test]
+    fn subject_binding_is_stable_and_scoped() {
+        let fields = [
+            SelectorField {
+                name: "name",
+                value: SelectorScalar::String("Synthetic Person"),
+            },
+            SelectorField {
+                name: "birth_date",
+                value: SelectorScalar::Date("2000-02-29"),
+            },
+        ];
+        let first = subject_binding(KEY, 1, input(&fields)).expect("binding succeeds");
+        let second = subject_binding(KEY, 1, input(&fields)).expect("binding succeeds");
+        assert_eq!(first, second);
+        assert!(first.starts_with("urn:evidence:subject:v1_"));
+        assert_eq!(first.len(), "urn:evidence:subject:v1_".len() + 43);
+
+        let mut other_audience = input(&fields);
+        other_audience.audience = "urn:example:other-party";
+        assert_ne!(
+            first,
+            subject_binding(KEY, 1, other_audience).expect("binding succeeds")
+        );
+    }
+
+    #[test]
+    fn subject_binding_is_field_order_sensitive() {
+        let fields = [
+            SelectorField {
+                name: "a",
+                value: SelectorScalar::Integer(1),
+            },
+            SelectorField {
+                name: "b",
+                value: SelectorScalar::Boolean(true),
+            },
+        ];
+        let reversed = [fields[1], fields[0]];
+        assert_ne!(
+            subject_binding(KEY, 1, input(&fields)).expect("binding succeeds"),
+            subject_binding(KEY, 1, input(&reversed)).expect("binding succeeds")
+        );
+    }
+
+    #[test]
+    fn every_subject_binding_scope_component_is_cryptographically_bound() {
+        let fields = [SelectorField {
+            name: "coordinate",
+            value: SelectorScalar::String("same-bytes"),
+        }];
+        let baseline = subject_binding(KEY, 1, input(&fields)).expect("baseline binding succeeds");
+
+        let mut changed = input(&fields);
+        changed.trust_domain = "urn:example:other-trust";
+        assert_ne!(
+            baseline,
+            subject_binding(KEY, 1, changed).expect("changed trust binding succeeds")
+        );
+        let mut changed = input(&fields);
+        changed.audience = "urn:example:other-audience";
+        assert_ne!(
+            baseline,
+            subject_binding(KEY, 1, changed).expect("changed audience binding succeeds")
+        );
+        let mut changed = input(&fields);
+        changed.purpose = "other-purpose";
+        assert_ne!(
+            baseline,
+            subject_binding(KEY, 1, changed).expect("changed purpose binding succeeds")
+        );
+        let mut changed = input(&fields);
+        changed.role = "other-role";
+        assert_ne!(
+            baseline,
+            subject_binding(KEY, 1, changed).expect("changed role binding succeeds")
+        );
+        let mut changed = input(&fields);
+        changed.profile = "other-profile";
+        assert_ne!(
+            baseline,
+            subject_binding(KEY, 1, changed).expect("changed profile binding succeeds")
+        );
+        assert_ne!(
+            baseline,
+            subject_binding(KEY, 2, input(&fields)).expect("changed key version succeeds")
+        );
+
+        let changed_name = [SelectorField {
+            name: "other_coordinate",
+            value: SelectorScalar::String("same-bytes"),
+        }];
+        assert_ne!(
+            baseline,
+            subject_binding(KEY, 1, input(&changed_name)).expect("changed name binding succeeds")
+        );
+        let changed_type = [SelectorField {
+            name: "coordinate",
+            value: SelectorScalar::ControlledCode("same-bytes"),
+        }];
+        assert_ne!(
+            baseline,
+            subject_binding(KEY, 1, input(&changed_type)).expect("changed type binding succeeds")
+        );
+        let changed_value = [SelectorField {
+            name: "coordinate",
+            value: SelectorScalar::String("other-bytes"),
+        }];
+        assert_ne!(
+            baseline,
+            subject_binding(KEY, 1, input(&changed_value)).expect("changed value binding succeeds")
+        );
+    }
+
+    #[test]
+    fn entity_reference_is_audience_and_concept_scoped() {
+        let first = entity_reference(
+            KEY,
+            2,
+            "urn:example:concept:person",
+            "urn:example:audience:a",
+            b"protected-source-id",
+        )
+        .expect("reference succeeds");
+        let second = entity_reference(
+            KEY,
+            2,
+            "urn:example:concept:person",
+            "urn:example:audience:b",
+            b"protected-source-id",
+        )
+        .expect("reference succeeds");
+        assert_ne!(first, second);
+        assert!(first.starts_with("urn:evidence:entity:v2_"));
+    }
+
+    #[test]
+    fn invalid_dates_and_weak_keys_are_rejected() {
+        let fields = [SelectorField {
+            name: "birth_date",
+            value: SelectorScalar::Date("2025-02-29"),
+        }];
+        assert_eq!(
+            subject_binding(KEY, 1, input(&fields)),
+            Err(BindingError::Date)
+        );
+        assert_eq!(
+            entity_reference(b"short", 1, "concept", "audience", b"seed"),
+            Err(BindingError::WeakKey)
+        );
+    }
+
+    #[test]
+    fn selector_binding_helper_debug_never_exposes_values() {
+        let fields = [
+            SelectorField {
+                name: "alpha",
+                value: SelectorScalar::String("selector-debug-canary"),
+            },
+            SelectorField {
+                name: "delta",
+                value: SelectorScalar::Integer(8_192_125),
+            },
+        ];
+        let diagnostic = format!("{fields:?}");
+        assert!(!diagnostic.contains("selector-debug-canary"));
+        assert!(!diagnostic.contains("8192125"));
+        assert!(diagnostic.contains("alpha"));
+        assert!(diagnostic.contains("[REDACTED]"));
+    }
+}
diff --git a/crates/registry-evidence/src/bundle.rs b/crates/registry-evidence/src/bundle.rs
new file mode 100644
index 000000000..d5c185421
--- /dev/null
+++ b/crates/registry-evidence/src/bundle.rs
@@ -0,0 +1,2453 @@
+//! Immutable Evidence Version 1 deployment bundle loading.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::fmt;
+use std::fs::{self, File, Metadata};
+use std::io::Read;
+use std::path::{Path, PathBuf};
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use jsonschema::{Draft, JSONSchema};
+use rhai::{Engine, AST};
+use serde::de::{self, MapAccess, Visitor};
+use serde::{Deserialize, Deserializer};
+use serde_json::{Map as JsonMap, Value as JsonValue};
+use serde_norway::Value as YamlValue;
+use sha2::{Digest, Sha256};
+use thiserror::Error;
+use url::Url;
+
+use crate::config::{
+    ArtifactPath, ConceptForm, EvidenceConfig, OrderedMap, RuntimeConfig, SchemaFault,
+    SelectorField,
+};
+
+pub const MAX_BUNDLE_FILES: usize = 1_024;
+pub const MAX_BUNDLE_BYTES: u64 = 16 * 1024 * 1024;
+pub const MAX_ARTIFACT_BYTES: u64 = 1024 * 1024;
+pub const MAX_SCRIPT_BYTES: u64 = 64 * 1024;
+pub const MAX_PUBLIC_JWK_BYTES: u64 = 64 * 1024;
+
+const CONFIG_FILE: &str = "evidence.yaml";
+const RUNTIME_FILE: &str = "runtime.yaml";
+const REVISION_DOMAIN: &[u8] = b"registry.evidence.bundle-revision/v1\0";
+const RUNTIME_REVISION_DOMAIN: &[u8] = b"registry.evidence.runtime-revision/v1\0";
+const MAX_CA_BUNDLE_BYTES: u64 = 1024 * 1024;
+const ALLOWED_DIRECTORIES: [&str; 6] = [
+    "adapters",
+    "derivations",
+    "schemas",
+    "codelists",
+    "fixtures",
+    "public-keys",
+];
+
+#[derive(Debug, Error, Clone, Eq, PartialEq)]
+pub enum BundleError {
+    #[error("the Evidence deployment bundle is unavailable")]
+    Unavailable,
+    #[error("an Evidence deployment input is not immutable: {0}")]
+    NotImmutable(ArtifactFault),
+    #[error("the Evidence deployment bundle contains an unsupported filesystem entry")]
+    UnsupportedEntry,
+    #[error("the Evidence deployment bundle contains a prohibited path")]
+    InvalidPath,
+    #[error("the Evidence deployment bundle artifact closure is invalid: {0}")]
+    UnknownFile(ArtifactFault),
+    #[error("the Evidence deployment bundle exceeds a Version 1 size bound")]
+    TooLarge,
+    #[error("the Evidence deployment configuration is invalid: {0}")]
+    Config(ArtifactFault),
+    #[error("an Evidence bundle artifact is invalid: {0}")]
+    InvalidArtifact(ArtifactFault),
+    #[error("an Evidence Rhai script is invalid: {0}")]
+    InvalidScript(ArtifactFault),
+}
+
+impl BundleError {
+    /// The value-free diagnostic, when this failure identifies one artifact.
+    ///
+    /// The remaining variants describe the deployment directory itself and are
+    /// already specific enough to act on without naming a file.
+    pub fn artifact_fault(&self) -> Option<&ArtifactFault> {
+        match self {
+            Self::Config(fault)
+            | Self::InvalidArtifact(fault)
+            | Self::InvalidScript(fault)
+            | Self::NotImmutable(fault)
+            | Self::UnknownFile(fault) => Some(fault),
+            _ => None,
+        }
+    }
+
+    /// Name the artifact being loaded when the failure did not already know it.
+    ///
+    /// Loaders raise their causes where the cause is known and the artifact is
+    /// not, so the enclosing per-artifact loop binds the name on the way out.
+    fn in_artifact(self, artifact: &str) -> Self {
+        match self {
+            Self::Config(fault) => Self::Config(fault.bind(artifact)),
+            Self::InvalidArtifact(fault) => Self::InvalidArtifact(fault.bind(artifact)),
+            Self::InvalidScript(fault) => Self::InvalidScript(fault.bind(artifact)),
+            Self::NotImmutable(fault) => Self::NotImmutable(fault.bind(artifact)),
+            other => other,
+        }
+    }
+}
+
+/// A value-free deployment diagnostic bound to one bundle-relative artifact.
+///
+/// The artifact name comes from the reviewed bundle layout or from the
+/// operator's runtime file name. It is never taken from document content, and
+/// the fault it carries is value-free by construction.
+#[derive(Debug, Clone, Eq, PartialEq)]
+pub struct ArtifactFault {
+    artifact: String,
+    fault: SchemaFault,
+}
+
+impl ArtifactFault {
+    /// A diagnostic whose artifact is already known.
+    pub fn new(artifact: impl Into<String>, fault: SchemaFault) -> Self {
+        Self {
+            artifact: artifact.into(),
+            fault,
+        }
+    }
+
+    /// A cause raised before the artifact being loaded is in scope.
+    fn unbound(cause: &'static str) -> Self {
+        Self {
+            artifact: String::new(),
+            fault: SchemaFault::because(cause),
+        }
+    }
+
+    /// The bundle-relative artifact, empty when no loader claimed the failure.
+    pub fn artifact(&self) -> &str {
+        &self.artifact
+    }
+
+    pub fn fault(&self) -> &SchemaFault {
+        &self.fault
+    }
+
+    fn bind(mut self, artifact: &str) -> Self {
+        if self.artifact.is_empty() {
+            self.artifact = artifact.to_owned();
+        }
+        self
+    }
+}
+
+impl fmt::Display for ArtifactFault {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        if self.artifact.is_empty() {
+            return fmt::Display::fmt(&self.fault, formatter);
+        }
+        write!(formatter, "artifact {}: {}", self.artifact, self.fault)
+    }
+}
+
+/// An artifact fault whose artifact the caller binds later.
+fn invalid_artifact(cause: &'static str) -> BundleError {
+    BundleError::InvalidArtifact(ArtifactFault::unbound(cause))
+}
+
+/// An immutability fault whose artifact the caller binds when it knows one.
+fn not_immutable(cause: &'static str) -> BundleError {
+    BundleError::NotImmutable(ArtifactFault::unbound(cause))
+}
+
+/// A script fault whose artifact the caller binds later.
+fn invalid_script(cause: &'static str) -> BundleError {
+    BundleError::InvalidScript(ArtifactFault::unbound(cause))
+}
+
+/// A closure fault naming the artifact when the name is safe to print.
+///
+/// Closure names come from the reviewed configuration or from the bundle
+/// directory listing. A directory listing is operator input, so a name is
+/// quoted only when it matches the reviewed artifact grammar; anything else is
+/// reported without a name rather than echoed.
+fn unknown_file(candidate: &str, cause: &'static str) -> BundleError {
+    if safe_artifact_name(candidate) {
+        BundleError::UnknownFile(ArtifactFault::new(candidate, SchemaFault::because(cause)))
+    } else {
+        BundleError::UnknownFile(ArtifactFault::unbound(cause))
+    }
+}
+
+/// The reviewed bundle-relative artifact grammar, as a printable-name test.
+fn safe_artifact_name(candidate: &str) -> bool {
+    !candidate.is_empty()
+        && candidate.len() <= 128
+        && candidate
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'/' | b'-'))
+}
+
+#[derive(Debug, Clone)]
+pub struct CompiledScript {
+    pub source: String,
+    pub ast: AST,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq)]
+pub enum Codelist {
+    Codes {
+        id: String,
+        version: String,
+        codes: Vec<String>,
+    },
+    Mapping {
+        id: String,
+        version: String,
+        entries: BTreeMap<String, String>,
+        allowed_outputs: Vec<String>,
+    },
+}
+
+impl Codelist {
+    pub fn id(&self) -> &str {
+        match self {
+            Self::Codes { id, .. } | Self::Mapping { id, .. } => id,
+        }
+    }
+
+    pub fn version(&self) -> &str {
+        match self {
+            Self::Codes { version, .. } | Self::Mapping { version, .. } => version,
+        }
+    }
+
+    pub fn contains_output(&self, value: &str) -> bool {
+        match self {
+            Self::Codes { codes, .. } => codes.iter().any(|code| code == value),
+            Self::Mapping {
+                allowed_outputs, ..
+            } => allowed_outputs.iter().any(|code| code == value),
+        }
+    }
+}
+
+/// One fully captured, validated bundle revision.
+///
+/// Runtime consumers use these captured bytes and compiled artifacts. They do
+/// not reopen the deployment directory, which prevents a later filesystem
+/// change from partially replacing the revision used by a serving process.
+#[derive(Debug, Clone)]
+pub struct Bundle {
+    root: PathBuf,
+    pub config: EvidenceConfig,
+    revision: String,
+    files: BTreeMap<String, Vec<u8>>,
+    pub scripts: BTreeMap<String, CompiledScript>,
+    pub fact_schemas: BTreeMap<String, JsonValue>,
+    pub codelists: BTreeMap<String, Codelist>,
+    pub fixtures: BTreeMap<String, YamlValue>,
+    pub retired_public_jwks: BTreeMap<String, JsonValue>,
+}
+
+/// One captured operator runtime configuration and its bound trust anchors.
+///
+/// Secret values and audit contents are deliberately not captured. The
+/// runtime digest covers only the reviewed runtime YAML and private-CA bytes.
+#[derive(Debug, Clone)]
+pub struct RuntimeDocument {
+    path: PathBuf,
+    pub config: RuntimeConfig,
+    revision: String,
+    bytes: Vec<u8>,
+    pub ca_bundles: BTreeMap<String, Vec<u8>>,
+}
+
+impl RuntimeDocument {
+    pub fn load(path: impl AsRef<Path>) -> Result<Self, BundleError> {
+        let path = path.as_ref();
+        if path.file_name().and_then(|name| name.to_str()) != Some(RUNTIME_FILE) {
+            return Err(BundleError::InvalidPath);
+        }
+        let metadata = fs::symlink_metadata(path).map_err(|_| BundleError::Unavailable)?;
+        if metadata.file_type().is_symlink() || !metadata.is_file() {
+            return Err(BundleError::InvalidPath);
+        }
+        let filesystem_read_only = filesystem_is_read_only(path)?;
+        let writable_runtime = "the runtime file is writable";
+        validate_read_only(&metadata, filesystem_read_only, writable_runtime)
+            .map_err(|error| error.in_artifact(RUNTIME_FILE))?;
+        let bytes = read_stable_file(
+            path,
+            &metadata,
+            crate::config::MAX_CONFIG_BYTES as u64,
+            filesystem_read_only,
+            writable_runtime,
+        )
+        .map_err(|error| error.in_artifact(RUNTIME_FILE))?;
+        let config = RuntimeConfig::parse_yaml(&bytes).map_err(|error| {
+            BundleError::Config(ArtifactFault::new(RUNTIME_FILE, error.fault()))
+        })?;
+        validate_secret_root(Path::new(&config.secret_providers.file.root))?;
+
+        let mut ca_bundles = BTreeMap::new();
+        for (profile, binding) in config.outbound_tls.trust_profiles.iter() {
+            let ca_path = Path::new(&binding.ca_bundle_file);
+            let ca_metadata =
+                fs::symlink_metadata(ca_path).map_err(|_| BundleError::Unavailable)?;
+            if ca_metadata.file_type().is_symlink() || !ca_metadata.is_file() {
+                return Err(BundleError::InvalidPath);
+            }
+            let ca_filesystem_read_only = filesystem_is_read_only(ca_path)?;
+            let writable_ca = "the TLS CA bundle the runtime file names is writable";
+            validate_read_only(&ca_metadata, ca_filesystem_read_only, writable_ca)?;
+            let ca_bytes = read_stable_file(
+                ca_path,
+                &ca_metadata,
+                MAX_CA_BUNDLE_BYTES,
+                ca_filesystem_read_only,
+                writable_ca,
+            )?;
+            validate_ca_bundle(&ca_bytes).map_err(|error| error.in_artifact(RUNTIME_FILE))?;
+            ca_bundles.insert(profile.to_owned(), ca_bytes);
+        }
+        let revision = compute_runtime_revision(&bytes, &ca_bundles)?;
+        Ok(Self {
+            path: path.to_path_buf(),
+            config,
+            revision,
+            bytes,
+            ca_bundles,
+        })
+    }
+
+    pub fn path(&self) -> &Path {
+        &self.path
+    }
+
+    pub fn revision(&self) -> &str {
+        &self.revision
+    }
+
+    pub fn bytes(&self) -> &[u8] {
+        &self.bytes
+    }
+}
+
+/// The two independently captured, closed startup inputs.
+#[derive(Debug, Clone)]
+pub struct DeploymentInputs {
+    pub bundle: Bundle,
+    pub runtime: RuntimeDocument,
+}
+
+impl DeploymentInputs {
+    pub fn load(runtime_path: impl AsRef<Path>) -> Result<Self, BundleError> {
+        let runtime = RuntimeDocument::load(runtime_path)?;
+        let bundle = Bundle::load(&runtime.config.bundle_directory)?;
+        validate_runtime_bindings(&bundle.config, &runtime.config)?;
+        Ok(Self { bundle, runtime })
+    }
+}
+
+pub type EvidenceBundle = Bundle;
+
+impl Bundle {
+    pub fn load(root: impl AsRef<Path>) -> Result<Self, BundleError> {
+        let root = root.as_ref();
+        let files = capture_bundle_files(root)?;
+        let config_bytes = files.get(CONFIG_FILE).ok_or(BundleError::Unavailable)?;
+        let config = EvidenceConfig::parse_yaml(config_bytes)
+            .map_err(|error| BundleError::Config(ArtifactFault::new(CONFIG_FILE, error.fault())))?;
+        validate_file_closure(&config, &files)?;
+
+        let scripts = load_scripts(&config, &files)?;
+        let fact_schemas = load_fact_schemas(&config, &files)?;
+        let codelists = load_codelists(&config, &files)?;
+        validate_codelist_references(&config, &codelists)?;
+        let fixtures = load_fixtures(&config, &files)?;
+        let retired_public_jwks = load_retired_public_jwks(&config, &files)?;
+        let revision = compute_revision(&files)?;
+
+        Ok(Self {
+            root: root.to_path_buf(),
+            config,
+            revision,
+            files,
+            scripts,
+            fact_schemas,
+            codelists,
+            fixtures,
+            retired_public_jwks,
+        })
+    }
+
+    pub fn root(&self) -> &Path {
+        &self.root
+    }
+
+    pub fn configuration_revision(&self) -> &str {
+        &self.revision
+    }
+
+    pub fn revision(&self) -> &str {
+        self.configuration_revision()
+    }
+
+    pub fn artifact(&self, path: &str) -> Option<&[u8]> {
+        self.files.get(path).map(Vec::as_slice)
+    }
+
+    pub fn script(&self, path: &ArtifactPath) -> Option<&CompiledScript> {
+        self.scripts.get(path.as_str())
+    }
+
+    pub fn fact_schema(&self, path: &ArtifactPath) -> Option<&JsonValue> {
+        self.fact_schemas.get(path.as_str())
+    }
+
+    pub fn codelist(&self, path: &ArtifactPath) -> Option<&Codelist> {
+        self.codelists.get(path.as_str())
+    }
+
+    pub fn fixture(&self, path: &ArtifactPath) -> Option<&YamlValue> {
+        self.fixtures.get(path.as_str())
+    }
+}
+
+pub fn load_bundle(root: impl AsRef<Path>) -> Result<Bundle, BundleError> {
+    Bundle::load(root)
+}
+
+fn capture_bundle_files(root: &Path) -> Result<BTreeMap<String, Vec<u8>>, BundleError> {
+    let root_metadata = fs::symlink_metadata(root).map_err(|_| BundleError::Unavailable)?;
+    if root_metadata.file_type().is_symlink() || !root_metadata.is_dir() {
+        return Err(BundleError::InvalidPath);
+    }
+    let filesystem_read_only = filesystem_is_read_only(root)?;
+    validate_read_only(
+        &root_metadata,
+        filesystem_read_only,
+        "the bundle directory is writable",
+    )?;
+    let canonical_root = fs::canonicalize(root).map_err(|_| BundleError::Unavailable)?;
+    let mut paths = Vec::new();
+    collect_paths(
+        root,
+        root,
+        &canonical_root,
+        filesystem_read_only,
+        &mut paths,
+    )?;
+    paths.sort_by(|left, right| left.0.cmp(&right.0));
+    if paths.len() > MAX_BUNDLE_FILES {
+        return Err(BundleError::TooLarge);
+    }
+
+    let mut files = BTreeMap::new();
+    let mut total = 0_u64;
+    for (relative, path, scanned_metadata) in paths {
+        let cap = file_size_cap(&relative);
+        let bytes = read_stable_file(
+            &path,
+            &scanned_metadata,
+            cap,
+            filesystem_read_only,
+            "the bundle artifact is writable",
+        )
+        .map_err(|error| error.in_artifact(&relative))?;
+        total = total
+            .checked_add(u64::try_from(bytes.len()).map_err(|_| BundleError::TooLarge)?)
+            .ok_or(BundleError::TooLarge)?;
+        if total > MAX_BUNDLE_BYTES {
+            return Err(BundleError::TooLarge);
+        }
+        files.insert(relative, bytes);
+    }
+    if !files.contains_key(CONFIG_FILE) {
+        return Err(BundleError::Unavailable);
+    }
+    Ok(files)
+}
+
+fn collect_paths(
+    root: &Path,
+    directory: &Path,
+    canonical_root: &Path,
+    filesystem_read_only: bool,
+    files: &mut Vec<(String, PathBuf, Metadata)>,
+) -> Result<(), BundleError> {
+    let mut entries = fs::read_dir(directory)
+        .map_err(|_| BundleError::Unavailable)?
+        .collect::<Result<Vec<_>, _>>()
+        .map_err(|_| BundleError::Unavailable)?;
+    entries.sort_by_key(fs::DirEntry::file_name);
+    for entry in entries {
+        let path = entry.path();
+        let metadata = fs::symlink_metadata(&path).map_err(|_| BundleError::Unavailable)?;
+        if metadata.file_type().is_symlink() {
+            return Err(BundleError::InvalidPath);
+        }
+        let relative_path = path
+            .strip_prefix(root)
+            .map_err(|_| BundleError::InvalidPath)?;
+        let relative = path_to_bundle_string(relative_path)?;
+        // Named after the relative path is known, so a writable artifact says
+        // which one it is. A path the bundle grammar refuses is refused as a
+        // path first; both fail closed, and neither reaches the caller unread.
+        validate_read_only(
+            &metadata,
+            filesystem_read_only,
+            if metadata.is_dir() {
+                "the bundle directory is writable"
+            } else {
+                "the bundle artifact is writable"
+            },
+        )
+        .map_err(|error| error.in_artifact(&relative))?;
+        let top = relative.split('/').next().ok_or(BundleError::InvalidPath)?;
+        if directory == root {
+            if metadata.is_dir() {
+                if !ALLOWED_DIRECTORIES.contains(&top) {
+                    return Err(BundleError::InvalidPath);
+                }
+            } else if relative != CONFIG_FILE {
+                return Err(unknown_file(
+                    &relative,
+                    "bundle root contains a file other than the configuration",
+                ));
+            }
+        } else if !ALLOWED_DIRECTORIES.contains(&top) {
+            return Err(BundleError::InvalidPath);
+        }
+
+        let canonical = fs::canonicalize(&path).map_err(|_| BundleError::Unavailable)?;
+        if !canonical.starts_with(canonical_root) {
+            return Err(BundleError::InvalidPath);
+        }
+        if metadata.is_dir() {
+            collect_paths(root, &path, canonical_root, filesystem_read_only, files)?;
+        } else if metadata.is_file() {
+            #[cfg(unix)]
+            {
+                use std::os::unix::fs::MetadataExt as _;
+                if metadata.nlink() != 1 {
+                    return Err(BundleError::InvalidPath);
+                }
+            }
+            files.push((relative, path, metadata));
+        } else {
+            return Err(BundleError::UnsupportedEntry);
+        }
+    }
+    Ok(())
+}
+
+fn path_to_bundle_string(path: &Path) -> Result<String, BundleError> {
+    let value = path.to_str().ok_or(BundleError::InvalidPath)?;
+    if value.is_empty()
+        || value.starts_with('/')
+        || value.contains('\\')
+        || path
+            .components()
+            .any(|component| !matches!(component, std::path::Component::Normal(_)))
+    {
+        return Err(BundleError::InvalidPath);
+    }
+    Ok(value.to_owned())
+}
+
+/// Refuse a writable deployment input, naming which input it was.
+///
+/// Every caller passes its own cause because the classes are not
+/// interchangeable to whoever has to fix one: a writable bundle artifact is
+/// re-frozen with the documented `chmod`, while a writable runtime file or CA
+/// bundle sits outside the bundle entirely and re-freezing changes nothing.
+#[cfg(unix)]
+fn validate_read_only(
+    metadata: &Metadata,
+    filesystem_read_only: bool,
+    cause: &'static str,
+) -> Result<(), BundleError> {
+    use std::os::unix::fs::PermissionsExt as _;
+    if !filesystem_read_only && metadata.permissions().mode() & 0o222 != 0 {
+        Err(not_immutable(cause))
+    } else {
+        Ok(())
+    }
+}
+
+#[cfg(not(unix))]
+fn validate_read_only(
+    metadata: &Metadata,
+    filesystem_read_only: bool,
+    cause: &'static str,
+) -> Result<(), BundleError> {
+    if filesystem_read_only || metadata.permissions().readonly() {
+        Ok(())
+    } else {
+        Err(not_immutable(cause))
+    }
+}
+
+#[cfg(unix)]
+fn filesystem_is_read_only(path: &Path) -> Result<bool, BundleError> {
+    let status = rustix::fs::statvfs(path).map_err(|_| BundleError::Unavailable)?;
+    Ok(status
+        .f_flag
+        .contains(rustix::fs::StatVfsMountFlags::RDONLY))
+}
+
+#[cfg(not(unix))]
+fn filesystem_is_read_only(_path: &Path) -> Result<bool, BundleError> {
+    Ok(false)
+}
+
+fn file_size_cap(path: &str) -> u64 {
+    if path.starts_with("adapters/") || path.starts_with("derivations/") {
+        MAX_SCRIPT_BYTES
+    } else if path.starts_with("public-keys/") {
+        MAX_PUBLIC_JWK_BYTES
+    } else {
+        MAX_ARTIFACT_BYTES
+    }
+}
+
+fn read_stable_file(
+    path: &Path,
+    scanned: &Metadata,
+    cap: u64,
+    filesystem_read_only: bool,
+    writable_cause: &'static str,
+) -> Result<Vec<u8>, BundleError> {
+    if scanned.len() > cap {
+        return Err(BundleError::TooLarge);
+    }
+    let mut file = open_no_follow(path)?;
+    let opened = file.metadata().map_err(|_| BundleError::Unavailable)?;
+    validate_read_only(&opened, filesystem_read_only, writable_cause)?;
+    if !opened.is_file() || !same_file(scanned, &opened) || opened.len() > cap {
+        return Err(not_immutable(
+            "the file was replaced between the directory scan and opening it",
+        ));
+    }
+    let mut bytes = Vec::new();
+    file.by_ref()
+        .take(cap.saturating_add(1))
+        .read_to_end(&mut bytes)
+        .map_err(|_| BundleError::Unavailable)?;
+    if u64::try_from(bytes.len()).map_err(|_| BundleError::TooLarge)? > cap {
+        return Err(BundleError::TooLarge);
+    }
+    let after = file.metadata().map_err(|_| BundleError::Unavailable)?;
+    if !same_file(&opened, &after)
+        || after.len() != u64::try_from(bytes.len()).map_err(|_| BundleError::TooLarge)?
+    {
+        return Err(not_immutable("the file changed while it was being read"));
+    }
+    Ok(bytes)
+}
+
+#[cfg(unix)]
+fn open_no_follow(path: &Path) -> Result<File, BundleError> {
+    use rustix::fs::{Mode, OFlags};
+    let descriptor = rustix::fs::open(
+        path,
+        OFlags::RDONLY | OFlags::CLOEXEC | OFlags::NOFOLLOW | OFlags::NONBLOCK,
+        Mode::empty(),
+    )
+    .map_err(|_| BundleError::Unavailable)?;
+    Ok(File::from(descriptor))
+}
+
+#[cfg(not(unix))]
+fn open_no_follow(path: &Path) -> Result<File, BundleError> {
+    let metadata = fs::symlink_metadata(path).map_err(|_| BundleError::Unavailable)?;
+    if metadata.file_type().is_symlink() {
+        return Err(BundleError::InvalidPath);
+    }
+    File::open(path).map_err(|_| BundleError::Unavailable)
+}
+
+#[cfg(unix)]
+fn same_file(left: &Metadata, right: &Metadata) -> bool {
+    use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _};
+    left.dev() == right.dev()
+        && left.ino() == right.ino()
+        && left.len() == right.len()
+        && left.permissions().mode() == right.permissions().mode()
+}
+
+#[cfg(not(unix))]
+fn same_file(left: &Metadata, right: &Metadata) -> bool {
+    left.len() == right.len()
+        && left.permissions().readonly() == right.permissions().readonly()
+        && left.modified().ok() == right.modified().ok()
+}
+
+fn validate_file_closure(
+    config: &EvidenceConfig,
+    files: &BTreeMap<String, Vec<u8>>,
+) -> Result<(), BundleError> {
+    let mut expected = BTreeSet::from([CONFIG_FILE.to_owned()]);
+    for (_, source) in config.sources.iter() {
+        expected.insert(source.request.prepare_script.as_str().to_owned());
+        expected.insert(source.extract_script.as_str().to_owned());
+        expected.insert(source.request.adapter_parameters_schema.as_str().to_owned());
+        expected.insert(source.response_schema.as_str().to_owned());
+        expected.insert(source.fact_schema.as_str().to_owned());
+    }
+    for requirement in &config.requirements {
+        expected.insert(requirement.derivation.script.as_str().to_owned());
+        if let Some(fixtures) = &requirement.fixtures {
+            expected.insert(fixtures.as_str().to_owned());
+        }
+        for concept in &requirement.concepts {
+            if matches!(
+                concept.form,
+                ConceptForm::ControlledCode
+                    | ConceptForm::ControlledCategory
+                    | ConceptForm::ControlledCodeList
+            ) {
+                expected.insert(concept_codelist_path(&concept.constraints)?.to_owned());
+            }
+        }
+    }
+    for (_, profile) in config.selector_profiles.iter() {
+        for (_, field) in profile.fields.iter() {
+            if let SelectorField::ControlledCode { codelist, .. } = field {
+                expected.insert(codelist.as_str().to_owned());
+            }
+        }
+    }
+    for path in &config.signing.retired_public_jwk_files {
+        expected.insert(path.as_str().to_owned());
+    }
+    expected.extend(reviewed_schema_paths(config, files)?);
+    expected.extend(reviewed_bucket_codelist_paths(config, files)?);
+    let present: BTreeSet<&str> = files.keys().map(String::as_str).collect();
+    let referenced: BTreeSet<&str> = expected.iter().map(String::as_str).collect();
+    if let Some(missing) = referenced.difference(&present).next() {
+        return Err(unknown_file(
+            missing,
+            "the configuration references an artifact the bundle does not contain",
+        ));
+    }
+    if let Some(unreferenced) = present.difference(&referenced).next() {
+        return Err(unknown_file(
+            unreferenced,
+            "the bundle contains an artifact the configuration does not reference",
+        ));
+    }
+    Ok(())
+}
+
+fn reviewed_bucket_codelist_paths(
+    config: &EvidenceConfig,
+    files: &BTreeMap<String, Vec<u8>>,
+) -> Result<BTreeSet<String>, BundleError> {
+    let declarations = config
+        .requirements
+        .iter()
+        .flat_map(|requirement| &requirement.concepts)
+        .filter(|concept| {
+            matches!(
+                concept.form,
+                ConceptForm::DateBucket | ConceptForm::TimeBucket
+            )
+        })
+        .map(|concept| {
+            Ok((
+                concept_constraint_string(&concept.constraints, "bucketScheme")?,
+                concept_constraint_string(&concept.constraints, "schemeVersion")?,
+            ))
+        })
+        .collect::<Result<BTreeSet<_>, BundleError>>()?;
+    let mut paths = BTreeSet::new();
+    for (identifier, version) in declarations {
+        let matches = files
+            .iter()
+            .filter(|(path, _)| path.starts_with("codelists/"))
+            .filter_map(|(path, bytes)| {
+                let document = std::str::from_utf8(bytes)
+                    .ok()
+                    .and_then(|text| serde_norway::from_str::<YamlValue>(text).ok())?;
+                let mapping = document.as_mapping()?;
+                (mapping.get("id").and_then(YamlValue::as_str) == Some(identifier)
+                    && mapping.get("version").and_then(YamlValue::as_str) == Some(version))
+                .then(|| path.clone())
+            })
+            .collect::<Vec<_>>();
+        if matches.len() != 1 {
+            return Err(invalid_artifact(
+                "bucket scheme codelist is missing or ambiguous",
+            ));
+        }
+        paths.insert(matches[0].clone());
+    }
+    Ok(paths)
+}
+
+fn reviewed_schema_paths(
+    config: &EvidenceConfig,
+    files: &BTreeMap<String, Vec<u8>>,
+) -> Result<BTreeSet<String>, BundleError> {
+    let identifiers = config
+        .requirements
+        .iter()
+        .flat_map(|requirement| &requirement.concepts)
+        .filter(|concept| concept.form == ConceptForm::ReviewedStructuredValue)
+        .map(|concept| concept_constraint_string(&concept.constraints, "schema"))
+        .collect::<Result<BTreeSet<_>, _>>()?;
+    let mut paths = BTreeSet::new();
+    for identifier in identifiers {
+        let matches = files
+            .iter()
+            .filter(|(path, _)| path.starts_with("schemas/"))
+            .filter_map(|(path, bytes)| {
+                let document = std::str::from_utf8(bytes)
+                    .ok()
+                    .and_then(|text| serde_norway::from_str::<JsonValue>(text).ok())?;
+                (document.get("$id").and_then(JsonValue::as_str) == Some(identifier))
+                    .then(|| path.clone())
+            })
+            .collect::<Vec<_>>();
+        if matches.len() != 1 {
+            return Err(invalid_artifact(
+                "reviewed structured schema identifier is missing or ambiguous",
+            ));
+        }
+        paths.insert(matches[0].clone());
+    }
+    Ok(paths)
+}
+
+fn load_scripts(
+    config: &EvidenceConfig,
+    files: &BTreeMap<String, Vec<u8>>,
+) -> Result<BTreeMap<String, CompiledScript>, BundleError> {
+    let mut expected = BTreeMap::new();
+    for (_, source) in config.sources.iter() {
+        insert_script_contract(
+            &mut expected,
+            source.request.prepare_script.as_str(),
+            ("prepare", 2),
+        )?;
+        insert_script_contract(
+            &mut expected,
+            source.extract_script.as_str(),
+            ("extract", 2),
+        )?;
+    }
+    for requirement in &config.requirements {
+        insert_script_contract(
+            &mut expected,
+            requirement.derivation.script.as_str(),
+            ("derive", 3),
+        )?;
+    }
+    let mut scripts = BTreeMap::new();
+    for (path, (entrypoint, arity)) in expected {
+        let script = compile_script(path, entrypoint, arity, files)
+            .map_err(|error| error.in_artifact(path))?;
+        scripts.insert(path.to_owned(), script);
+    }
+    Ok(scripts)
+}
+
+fn compile_script(
+    path: &str,
+    entrypoint: &'static str,
+    arity: usize,
+    files: &BTreeMap<String, Vec<u8>>,
+) -> Result<CompiledScript, BundleError> {
+    let bytes = files.get(path).ok_or(invalid_artifact("missing script"))?;
+    let source = std::str::from_utf8(bytes)
+        .map_err(|_| invalid_artifact("script is not UTF-8"))?
+        .to_owned();
+    reject_prohibited_script_capabilities(&source)?;
+    let mut engine = Engine::new();
+    engine.set_max_expr_depths(64, 64);
+    engine.set_max_call_levels(32);
+    engine.set_max_operations(100_000);
+    engine.set_max_array_size(256);
+    engine.set_max_map_size(256);
+    engine.set_max_string_size(16_384);
+    engine.set_max_modules(0);
+    let ast = engine
+        .compile(&source)
+        .map_err(|_| invalid_script("script does not compile"))?;
+    let entrypoint_functions = ast
+        .iter_functions()
+        .filter(|function| function.name == entrypoint)
+        .map(|function| function.params.len())
+        .collect::<Vec<_>>();
+    if entrypoint_functions != [arity] {
+        return Err(invalid_script(
+            "script does not declare exactly one entrypoint with the required arity",
+        ));
+    }
+    Ok(CompiledScript { source, ast })
+}
+
+fn insert_script_contract<'a>(
+    scripts: &mut BTreeMap<&'a str, (&'static str, usize)>,
+    path: &'a str,
+    contract: (&'static str, usize),
+) -> Result<(), BundleError> {
+    if scripts
+        .insert(path, contract)
+        .is_some_and(|existing| existing != contract)
+    {
+        return Err(invalid_artifact(
+            "one script path is assigned incompatible entry points",
+        ));
+    }
+    Ok(())
+}
+
+fn reject_prohibited_script_capabilities(source: &str) -> Result<(), BundleError> {
+    const PROHIBITED: [&str; 14] = [
+        "import",
+        "eval",
+        "print",
+        "debug",
+        "get_env",
+        "environment",
+        "filesystem",
+        "network",
+        "process",
+        "random",
+        "Fn",
+        "call",
+        "curry",
+        "is_def_fn",
+    ];
+    let mut identifier = String::new();
+    let mut chars = source.chars().peekable();
+    let mut quote = None;
+    while let Some(character) = chars.next() {
+        if let Some(delimiter) = quote {
+            if character == '\\' {
+                chars.next();
+            } else if character == delimiter {
+                quote = None;
+            }
+            continue;
+        }
+        if matches!(character, '\'' | '"' | '`') {
+            quote = Some(character);
+            continue;
+        }
+        if character == '/' && chars.peek() == Some(&'/') {
+            chars.next();
+            for next in chars.by_ref() {
+                if next == '\n' {
+                    break;
+                }
+            }
+            continue;
+        }
+        if character.is_ascii_alphanumeric() || character == '_' {
+            identifier.push(character);
+        } else if !identifier.is_empty() {
+            if PROHIBITED.contains(&identifier.as_str()) {
+                return Err(invalid_script("script uses a prohibited capability"));
+            }
+            identifier.clear();
+        }
+    }
+    if PROHIBITED.contains(&identifier.as_str()) {
+        return Err(invalid_script("script uses a prohibited capability"));
+    }
+    Ok(())
+}
+
+/// Which contract one bundle schema artifact carries. Configuration keeps the
+/// three roles disjoint, so every path resolves to exactly one of them.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum SchemaRole {
+    /// Closed startup parameters; the empty parameter set is legitimate.
+    AdapterParameters,
+    /// Shape of one projected source response. Projection drops a missing
+    /// selected leaf, so a declared property may legitimately be absent.
+    Response,
+    /// Closed fact set handed to derivation, and the reviewed concept schemas held
+    /// to the same rule; every declared property is required.
+    Facts,
+}
+
+fn load_fact_schemas(
+    config: &EvidenceConfig,
+    files: &BTreeMap<String, Vec<u8>>,
+) -> Result<BTreeMap<String, JsonValue>, BundleError> {
+    let parameter_paths = config
+        .sources
+        .iter()
+        .map(|(_, source)| source.request.adapter_parameters_schema.as_str())
+        .collect::<BTreeSet<_>>();
+    let response_paths = config
+        .sources
+        .iter()
+        .map(|(_, source)| source.response_schema.as_str())
+        .collect::<BTreeSet<_>>();
+    let mut paths = config
+        .sources
+        .iter()
+        .flat_map(|(_, source)| {
+            [
+                source.fact_schema.as_str(),
+                source.response_schema.as_str(),
+                source.request.adapter_parameters_schema.as_str(),
+            ]
+        })
+        .map(ToOwned::to_owned)
+        .collect::<BTreeSet<_>>();
+    paths.extend(reviewed_schema_paths(config, files)?);
+    let mut schemas = BTreeMap::new();
+    for path in paths {
+        let role = if parameter_paths.contains(path.as_str()) {
+            SchemaRole::AdapterParameters
+        } else if response_paths.contains(path.as_str()) {
+            SchemaRole::Response
+        } else {
+            SchemaRole::Facts
+        };
+        let schema =
+            load_fact_schema(&path, role, files).map_err(|error| error.in_artifact(&path))?;
+        schemas.insert(path, schema);
+    }
+    for (_, source) in config.sources.iter() {
+        let schema_path = source.request.adapter_parameters_schema.as_str();
+        validate_adapter_parameters(source, &schemas)
+            .map_err(|error| error.in_artifact(schema_path))?;
+    }
+    Ok(schemas)
+}
+
+fn load_fact_schema(
+    path: &str,
+    role: SchemaRole,
+    files: &BTreeMap<String, Vec<u8>>,
+) -> Result<JsonValue, BundleError> {
+    let bytes = files
+        .get(path)
+        .ok_or(invalid_artifact("missing fact schema"))?;
+    let text =
+        std::str::from_utf8(bytes).map_err(|_| invalid_artifact("fact schema is not UTF-8"))?;
+    let schema: JsonValue = serde_norway::from_str(text)
+        .map_err(|_| invalid_artifact("fact schema YAML is invalid"))?;
+    validate_closed_schema(&schema, role)?;
+    JSONSchema::options()
+        .with_draft(Draft::Draft202012)
+        .should_validate_formats(true)
+        .compile(&schema)
+        .map_err(|_| invalid_artifact("fact schema is not valid JSON Schema"))?;
+    Ok(schema)
+}
+
+fn validate_adapter_parameters(
+    source: &crate::config::SourceConfig,
+    schemas: &BTreeMap<String, JsonValue>,
+) -> Result<(), BundleError> {
+    let schema = schemas
+        .get(source.request.adapter_parameters_schema.as_str())
+        .ok_or(invalid_artifact("missing adapter-parameter schema"))?;
+    let compiled = JSONSchema::options()
+        .with_draft(Draft::Draft202012)
+        .should_validate_formats(true)
+        .compile(schema)
+        .map_err(|_| invalid_artifact("adapter-parameter schema is not valid JSON Schema"))?;
+    let parameters = serde_json::to_value(&source.request.adapter_parameters)
+        .map_err(|_| invalid_artifact("adapter parameters are not JSON-compatible"))?;
+    if !compiled.is_valid(&parameters) {
+        return Err(invalid_artifact(
+            "adapter parameters do not satisfy their closed schema",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_closed_schema(schema: &JsonValue, role: SchemaRole) -> Result<(), BundleError> {
+    let allow_empty_root = role == SchemaRole::AdapterParameters;
+    let root = schema
+        .as_object()
+        .ok_or(invalid_artifact("fact schema must be an object"))?;
+    if root.get("type").and_then(JsonValue::as_str) != Some("object")
+        || root
+            .get("additionalProperties")
+            .and_then(JsonValue::as_bool)
+            != Some(false)
+    {
+        return Err(invalid_artifact("fact schema must close the root object"));
+    }
+    let properties = root
+        .get("properties")
+        .and_then(JsonValue::as_object)
+        .ok_or(invalid_artifact("fact schema must declare properties"))?;
+    if (!allow_empty_root && properties.is_empty()) || properties.len() > 64 {
+        return Err(invalid_artifact("fact schema property count is invalid"));
+    }
+    let required = root
+        .get("required")
+        .and_then(JsonValue::as_array)
+        .ok_or(invalid_artifact("fact schema must declare required fields"))?;
+    let required = required
+        .iter()
+        .map(JsonValue::as_str)
+        .collect::<Option<BTreeSet<_>>>()
+        .ok_or(invalid_artifact("fact schema required fields are invalid"))?;
+    if required
+        .iter()
+        .any(|field| !properties.contains_key(*field))
+        || (role != SchemaRole::Response
+            && properties
+                .keys()
+                .any(|property| !required.contains(property.as_str())))
+    {
+        return Err(invalid_artifact(
+            "fact schema must require its exact closed field set",
+        ));
+    }
+    validate_schema_node(schema, role)
+}
+
+/// Reads the one type a schema node declares, and returns `None` for a node that
+/// declares a bounded const instead.
+///
+/// A response schema may write that type as the pair `[T, "null"]`. Sources do
+/// report an explicit null where they hold no value, and the projection carries
+/// that null through verbatim, so a response shape has to be able to say so. The
+/// pair is the only union the subset admits, and only in the response role: a
+/// fact or an adapter parameter is never null. `null` reaches the script as the
+/// same unit marker `is_missing` already reads, so one script test covers both an
+/// absent leaf and an explicitly null one.
+fn schema_node_type(
+    object: &JsonMap<String, JsonValue>,
+    role: SchemaRole,
+) -> Result<Option<&str>, BundleError> {
+    match object.get("type") {
+        Some(JsonValue::String(name)) => Ok(Some(name.as_str())),
+        Some(JsonValue::Array(members)) => {
+            let [JsonValue::String(name), JsonValue::String(null_member)] = members.as_slice()
+            else {
+                return Err(invalid_artifact(
+                    "schema node type is outside the closed Version 1 subset",
+                ));
+            };
+            if role != SchemaRole::Response || null_member != "null" || name == "null" {
+                return Err(invalid_artifact(
+                    "schema node type is outside the closed Version 1 subset",
+                ));
+            }
+            Ok(Some(name.as_str()))
+        }
+        Some(_) => Err(invalid_artifact(
+            "schema node type is outside the closed Version 1 subset",
+        )),
+        None => Ok(None),
+    }
+}
+
+fn validate_schema_node(node: &JsonValue, role: SchemaRole) -> Result<(), BundleError> {
+    let object = node
+        .as_object()
+        .ok_or(invalid_artifact("every schema node must be a typed object"))?;
+    let Some(value_type) = schema_node_type(object, role)? else {
+        if object
+            .keys()
+            .all(|key| matches!(key.as_str(), "$schema" | "$id" | "const"))
+            && object.get("const").is_some_and(schema_const_is_bounded)
+        {
+            return Ok(());
+        }
+        return Err(invalid_artifact(
+            "every schema node must declare one type or one bounded const",
+        ));
+    };
+    let allowed = match value_type {
+        "object" => &[
+            "$schema",
+            "$id",
+            "type",
+            "additionalProperties",
+            "required",
+            "properties",
+        ][..],
+        "array" => &[
+            "$schema",
+            "$id",
+            "type",
+            "minItems",
+            "maxItems",
+            "uniqueItems",
+            "items",
+            "const",
+        ][..],
+        "string" => &[
+            "$schema",
+            "$id",
+            "type",
+            "minLength",
+            "maxLength",
+            "format",
+            "enum",
+            "const",
+        ][..],
+        "integer" => &[
+            "$schema", "$id", "type", "minimum", "maximum", "enum", "const",
+        ][..],
+        "boolean" => &["$schema", "$id", "type", "enum", "const"][..],
+        _ => {
+            return Err(invalid_artifact(
+                "schema node type is outside the closed Version 1 subset",
+            ));
+        }
+    };
+    if object.keys().any(|key| !allowed.contains(&key.as_str())) {
+        return Err(invalid_artifact(
+            "schema node uses a keyword outside the closed Version 1 subset",
+        ));
+    }
+
+    match value_type {
+        "object" => {
+            if object
+                .get("additionalProperties")
+                .and_then(JsonValue::as_bool)
+                != Some(false)
+            {
+                return Err(invalid_artifact("nested schema objects must be closed"));
+            }
+            let properties = object
+                .get("properties")
+                .and_then(JsonValue::as_object)
+                .filter(|properties| !properties.is_empty() && properties.len() <= 64)
+                .ok_or(invalid_artifact(
+                    "schema objects must declare bounded properties",
+                ))?;
+            let required = object
+                .get("required")
+                .and_then(JsonValue::as_array)
+                .and_then(|required| {
+                    required
+                        .iter()
+                        .map(JsonValue::as_str)
+                        .collect::<Option<BTreeSet<_>>>()
+                })
+                .ok_or(invalid_artifact(
+                    "schema objects must declare required properties",
+                ))?;
+            if required
+                .iter()
+                .any(|field| !properties.contains_key(*field))
+                || (role != SchemaRole::Response
+                    && properties
+                        .keys()
+                        .any(|property| !required.contains(property.as_str())))
+            {
+                return Err(invalid_artifact(
+                    "schema objects must require their exact property set",
+                ));
+            }
+            for property in properties.values() {
+                validate_schema_node(property, role)?;
+            }
+        }
+        "array" => {
+            if object
+                .get("uniqueItems")
+                .is_some_and(|value| value.as_bool() != Some(true))
+            {
+                return Err(invalid_artifact("schema array uniqueness flag is invalid"));
+            }
+            if let Some(value) = object.get("const") {
+                if !value.is_array() || !schema_const_is_bounded(value) {
+                    return Err(invalid_artifact("schema array const is invalid"));
+                }
+            }
+            let maximum = object
+                .get("maxItems")
+                .and_then(JsonValue::as_u64)
+                .ok_or(invalid_artifact("schema arrays must be bounded"))?;
+            if maximum == 0 || maximum > 256 {
+                return Err(invalid_artifact("schema array bound is invalid"));
+            }
+            if object
+                .get("minItems")
+                .and_then(JsonValue::as_u64)
+                .is_some_and(|minimum| minimum > maximum)
+            {
+                return Err(invalid_artifact("schema array bounds are invalid"));
+            }
+            validate_schema_node(
+                object
+                    .get("items")
+                    .ok_or(invalid_artifact("schema arrays must close their item type"))?,
+                role,
+            )?;
+        }
+        "string" => {
+            if object
+                .get("format")
+                .and_then(JsonValue::as_str)
+                .is_some_and(|format| !matches!(format, "date" | "date-time"))
+            {
+                return Err(invalid_artifact(
+                    "schema string format is outside the closed Version 1 subset",
+                ));
+            }
+            let bounded = object
+                .get("maxLength")
+                .and_then(JsonValue::as_u64)
+                .is_some_and(|maximum| maximum > 0 && maximum <= 65_536);
+            let formatted = matches!(
+                object.get("format").and_then(JsonValue::as_str),
+                Some("date" | "date-time")
+            );
+            let enumerated = object
+                .get("enum")
+                .and_then(JsonValue::as_array)
+                .is_some_and(|values| {
+                    !values.is_empty()
+                        && values.len() <= 256
+                        && values.iter().all(|value| value.as_str().is_some())
+                });
+            let constant = object
+                .get("const")
+                .and_then(JsonValue::as_str)
+                .is_some_and(|value| value.len() <= 65_536);
+            if !bounded && !formatted && !enumerated && !constant {
+                return Err(invalid_artifact(
+                    "schema strings must be bounded, formatted, or enumerated",
+                ));
+            }
+        }
+        "integer" => {
+            let bounded = object
+                .get("minimum")
+                .and_then(JsonValue::as_i64)
+                .zip(object.get("maximum").and_then(JsonValue::as_i64));
+            let enumerated = object
+                .get("enum")
+                .and_then(JsonValue::as_array)
+                .is_some_and(|values| {
+                    !values.is_empty()
+                        && values.len() <= 256
+                        && values.iter().all(|value| value.as_i64().is_some())
+                });
+            let constant = object.get("const").and_then(JsonValue::as_i64).is_some();
+            if bounded.is_none_or(|(minimum, maximum)| minimum > maximum)
+                && !enumerated
+                && !constant
+            {
+                return Err(invalid_artifact(
+                    "schema integers need both a minimum and a maximum, or an enum, or a const",
+                ));
+            }
+        }
+        "boolean" => {
+            if object.get("const").is_some_and(|value| !value.is_boolean()) {
+                return Err(invalid_artifact("schema boolean const is invalid"));
+            }
+            if object.get("enum").is_some_and(|value| {
+                value.as_array().is_none_or(|values| {
+                    values.is_empty()
+                        || values.len() > 2
+                        || values.iter().any(|value| !value.is_boolean())
+                })
+            }) {
+                return Err(invalid_artifact("schema boolean enumeration is invalid"));
+            }
+        }
+        _ => unreachable!("type was closed above"),
+    }
+    Ok(())
+}
+
+fn schema_const_is_bounded(value: &JsonValue) -> bool {
+    match value {
+        JsonValue::Bool(_) => true,
+        JsonValue::Number(value) => value.as_i64().is_some(),
+        JsonValue::String(value) => value.len() <= 65_536,
+        JsonValue::Array(values) => {
+            values.len() <= 256 && values.iter().all(schema_const_is_bounded)
+        }
+        JsonValue::Object(values) => {
+            values.len() <= 256
+                && values
+                    .iter()
+                    .all(|(name, value)| name.len() <= 1_024 && schema_const_is_bounded(value))
+        }
+        JsonValue::Null => false,
+    }
+}
+
+fn load_codelists(
+    config: &EvidenceConfig,
+    files: &BTreeMap<String, Vec<u8>>,
+) -> Result<BTreeMap<String, Codelist>, BundleError> {
+    let mut paths = BTreeSet::new();
+    for (_, profile) in config.selector_profiles.iter() {
+        for (_, field) in profile.fields.iter() {
+            if let SelectorField::ControlledCode { codelist, .. } = field {
+                paths.insert(codelist.as_str().to_owned());
+            }
+        }
+    }
+    for requirement in &config.requirements {
+        for concept in &requirement.concepts {
+            if matches!(
+                concept.form,
+                ConceptForm::ControlledCode
+                    | ConceptForm::ControlledCategory
+                    | ConceptForm::ControlledCodeList
+            ) {
+                paths.insert(concept_codelist_path(&concept.constraints)?.to_owned());
+            }
+        }
+    }
+    paths.extend(reviewed_bucket_codelist_paths(config, files)?);
+    let mut codelists = BTreeMap::new();
+    for path in paths {
+        let codelist = load_codelist(&path, files).map_err(|error| error.in_artifact(&path))?;
+        codelists.insert(path, codelist);
+    }
+    Ok(codelists)
+}
+
+fn load_codelist(path: &str, files: &BTreeMap<String, Vec<u8>>) -> Result<Codelist, BundleError> {
+    let bytes = files
+        .get(path)
+        .ok_or(invalid_artifact("missing codelist"))?;
+    let text = std::str::from_utf8(bytes).map_err(|_| invalid_artifact("codelist is not UTF-8"))?;
+    let document: CodelistDocument =
+        serde_norway::from_str(text).map_err(|_| invalid_artifact("codelist YAML is invalid"))?;
+    document.validate()
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(untagged)]
+enum CodelistDocument {
+    Codes(CodeCodelistDocument),
+    Mapping(MappingCodelistDocument),
+}
+
+impl CodelistDocument {
+    fn validate(self) -> Result<Codelist, BundleError> {
+        match self {
+            Self::Codes(document) => document.validate(),
+            Self::Mapping(document) => document.validate(),
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct CodeCodelistDocument {
+    id: String,
+    version: String,
+    codes: Vec<String>,
+}
+
+impl CodeCodelistDocument {
+    fn validate(self) -> Result<Codelist, BundleError> {
+        validate_codelist_header(&self.id, &self.version)?;
+        validate_code_collection(&self.codes)?;
+        Ok(Codelist::Codes {
+            id: self.id,
+            version: self.version,
+            codes: self.codes,
+        })
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct MappingCodelistDocument {
+    id: String,
+    version: String,
+    entries: BTreeMap<String, String>,
+    allowed_outputs: Vec<String>,
+}
+
+impl MappingCodelistDocument {
+    fn validate(self) -> Result<Codelist, BundleError> {
+        validate_codelist_header(&self.id, &self.version)?;
+        if self.entries.is_empty() || self.entries.len() > 4_096 {
+            return Err(invalid_artifact("codelist entry count is invalid"));
+        }
+        validate_code_collection(&self.allowed_outputs)?;
+        for (input, output) in &self.entries {
+            validate_code(input)?;
+            validate_code(output)?;
+            if !self.allowed_outputs.contains(output) {
+                return Err(invalid_artifact("codelist mapping output is not allowed"));
+            }
+        }
+        Ok(Codelist::Mapping {
+            id: self.id,
+            version: self.version,
+            entries: self.entries,
+            allowed_outputs: self.allowed_outputs,
+        })
+    }
+}
+
+fn validate_codelist_header(id: &str, version: &str) -> Result<(), BundleError> {
+    if id.len() > 512
+        || Url::parse(id).is_err()
+        || version.is_empty()
+        || version.len() > 128
+        || version.contains('\0')
+    {
+        return Err(invalid_artifact("codelist identity is invalid"));
+    }
+    Ok(())
+}
+
+fn validate_code_collection(codes: &[String]) -> Result<(), BundleError> {
+    if codes.is_empty() || codes.len() > 4_096 {
+        return Err(invalid_artifact("codelist code count is invalid"));
+    }
+    let mut seen = BTreeSet::new();
+    for code in codes {
+        validate_code(code)?;
+        if !seen.insert(code.as_str()) {
+            return Err(invalid_artifact("codelist code is duplicated"));
+        }
+    }
+    Ok(())
+}
+
+fn validate_code(code: &str) -> Result<(), BundleError> {
+    let bytes = code.as_bytes();
+    if bytes.is_empty()
+        || bytes.len() > 128
+        || !bytes[0].is_ascii_alphanumeric()
+        || !bytes[1..]
+            .iter()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b':' | b'-'))
+    {
+        return Err(invalid_artifact("codelist code is invalid"));
+    }
+    Ok(())
+}
+
+fn validate_codelist_references(
+    config: &EvidenceConfig,
+    codelists: &BTreeMap<String, Codelist>,
+) -> Result<(), BundleError> {
+    for (_, profile) in config.selector_profiles.iter() {
+        for (_, field) in profile.fields.iter() {
+            if let SelectorField::ControlledCode {
+                codelist,
+                codelist_version,
+                ..
+            } = field
+            {
+                let loaded = codelists
+                    .get(codelist.as_str())
+                    .ok_or(invalid_artifact("selector codelist is missing"))?;
+                if loaded.version() != codelist_version {
+                    return Err(invalid_artifact("selector codelist version mismatch"));
+                }
+            }
+        }
+    }
+    for requirement in &config.requirements {
+        for concept in &requirement.concepts {
+            if matches!(
+                concept.form,
+                ConceptForm::DateBucket | ConceptForm::TimeBucket
+            ) {
+                let identifier = concept_constraint_string(&concept.constraints, "bucketScheme")?;
+                let version = concept_constraint_string(&concept.constraints, "schemeVersion")?;
+                let matches = codelists
+                    .values()
+                    .filter(|codelist| codelist.id() == identifier && codelist.version() == version)
+                    .count();
+                if matches != 1 {
+                    return Err(invalid_artifact("bucket scheme codelist identity mismatch"));
+                }
+                continue;
+            }
+            let version_key = match concept.form {
+                ConceptForm::ControlledCode | ConceptForm::ControlledCodeList => "codelistVersion",
+                ConceptForm::ControlledCategory => "schemeVersion",
+                _ => continue,
+            };
+            let path = concept_codelist_path(&concept.constraints)?;
+            let version = concept_constraint_string(&concept.constraints, version_key)?;
+            let loaded = codelists
+                .get(path)
+                .ok_or(invalid_artifact("concept codelist is missing"))?;
+            if loaded.version() != version {
+                return Err(invalid_artifact("concept codelist version mismatch"));
+            }
+        }
+    }
+    Ok(())
+}
+
+fn load_fixtures(
+    config: &EvidenceConfig,
+    files: &BTreeMap<String, Vec<u8>>,
+) -> Result<BTreeMap<String, YamlValue>, BundleError> {
+    let mut fixtures = BTreeMap::new();
+    for requirement in &config.requirements {
+        let Some(fixture_path) = &requirement.fixtures else {
+            continue;
+        };
+        let path = fixture_path.as_str();
+        if fixtures.contains_key(path) {
+            continue;
+        }
+        let fixture = load_fixture(path, files).map_err(|error| error.in_artifact(path))?;
+        fixtures.insert(path.to_owned(), fixture);
+    }
+    Ok(fixtures)
+}
+
+fn load_fixture(path: &str, files: &BTreeMap<String, Vec<u8>>) -> Result<YamlValue, BundleError> {
+    let bytes = files
+        .get(path)
+        .ok_or(invalid_artifact("fixture file is missing"))?;
+    let text =
+        std::str::from_utf8(bytes).map_err(|_| invalid_artifact("fixture file is not UTF-8"))?;
+    let fixture: YamlValue =
+        serde_norway::from_str(text).map_err(|_| invalid_artifact("fixture YAML is invalid"))?;
+    validate_fixture_coverage(&fixture)?;
+    Ok(fixture)
+}
+
+fn validate_fixture_coverage(fixture: &YamlValue) -> Result<(), BundleError> {
+    let root = fixture
+        .as_mapping()
+        .ok_or(invalid_artifact("fixture root must be a mapping"))?;
+    if root.get("synthetic_only").and_then(YamlValue::as_bool) != Some(true) {
+        return Err(invalid_artifact("fixtures must be synthetic-only"));
+    }
+    let cases = root
+        .get("cases")
+        .and_then(YamlValue::as_sequence)
+        .ok_or(invalid_artifact("fixture cases are missing"))?;
+    if cases.is_empty() || cases.len() > 256 {
+        return Err(invalid_artifact("fixture case count is invalid"));
+    }
+    let mut ids = BTreeSet::new();
+    let mut categories = FixtureCategories::default();
+    for case in cases {
+        let id = case
+            .as_mapping()
+            .and_then(|mapping| mapping.get("id"))
+            .and_then(YamlValue::as_str)
+            .ok_or(invalid_artifact("fixture case id is missing"))?;
+        if id.is_empty() || id.len() > 128 || !ids.insert(id) {
+            return Err(invalid_artifact("fixture case id is invalid or duplicated"));
+        }
+        categories.observe(id);
+    }
+    if !categories.complete() {
+        return Err(invalid_artifact("fixture category coverage is incomplete"));
+    }
+    Ok(())
+}
+
+#[derive(Default)]
+struct FixtureCategories {
+    positive: bool,
+    negative: bool,
+    boundary: bool,
+    missing: bool,
+    no_match: bool,
+    ambiguous: bool,
+    source_failure: bool,
+    anti_reconstruction: bool,
+}
+
+impl FixtureCategories {
+    fn observe(&mut self, id: &str) {
+        self.positive |= id == "positive";
+        self.negative |= id.starts_with("negative");
+        self.boundary |= id.starts_with("boundary");
+        self.missing |= id.starts_with("missing");
+        self.no_match |= id == "no-match";
+        self.ambiguous |= id.starts_with("ambiguous");
+        self.source_failure |= id == "source-failure";
+        self.anti_reconstruction |= id == "anti-reconstruction";
+    }
+
+    fn complete(&self) -> bool {
+        self.positive
+            && self.negative
+            && self.boundary
+            && self.missing
+            && self.no_match
+            && self.ambiguous
+            && self.source_failure
+            && self.anti_reconstruction
+    }
+}
+
+fn load_retired_public_jwks(
+    config: &EvidenceConfig,
+    files: &BTreeMap<String, Vec<u8>>,
+) -> Result<BTreeMap<String, JsonValue>, BundleError> {
+    let mut keys = BTreeMap::new();
+    for path in &config.signing.retired_public_jwk_files {
+        let path = path.as_str();
+        let load = || -> Result<(String, JsonMap<String, JsonValue>), BundleError> {
+            let bytes = files
+                .get(path)
+                .ok_or(invalid_artifact("retired public JWK is missing"))?;
+            let object = parse_strict_json_object(bytes)?;
+            let kid = validate_public_jwk(&object, &config.signing.active_key_id)?;
+            Ok((kid, object))
+        };
+        let (kid, object) = load().map_err(|error| error.in_artifact(path))?;
+        if keys.insert(kid, JsonValue::Object(object)).is_some() {
+            return Err(invalid_artifact("retired public JWK kid is duplicated").in_artifact(path));
+        }
+    }
+    Ok(keys)
+}
+
+fn parse_strict_json_object(bytes: &[u8]) -> Result<JsonMap<String, JsonValue>, BundleError> {
+    struct StrictObject(JsonMap<String, JsonValue>);
+    impl<'de> Deserialize<'de> for StrictObject {
+        fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+        where
+            D: Deserializer<'de>,
+        {
+            struct ObjectVisitor;
+            impl<'de> Visitor<'de> for ObjectVisitor {
+                type Value = StrictObject;
+
+                fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+                    formatter.write_str("a JSON object with unique members")
+                }
+
+                fn visit_map<A>(self, mut map: A) -> Result<Self::Value, A::Error>
+                where
+                    A: MapAccess<'de>,
+                {
+                    let mut object = JsonMap::new();
+                    while let Some((key, value)) = map.next_entry::<String, JsonValue>()? {
+                        if object.insert(key, value).is_some() {
+                            return Err(de::Error::custom("duplicate JSON member"));
+                        }
+                    }
+                    Ok(StrictObject(object))
+                }
+            }
+            deserializer.deserialize_map(ObjectVisitor)
+        }
+    }
+
+    let mut deserializer = serde_json::Deserializer::from_slice(bytes);
+    let object = StrictObject::deserialize(&mut deserializer)
+        .map_err(|_| invalid_artifact("public JWK JSON is invalid"))?;
+    deserializer
+        .end()
+        .map_err(|_| invalid_artifact("public JWK has trailing data"))?;
+    Ok(object.0)
+}
+
+fn validate_public_jwk(
+    object: &JsonMap<String, JsonValue>,
+    active_key_id: &str,
+) -> Result<String, BundleError> {
+    const ALLOWED: [&str; 7] = ["kty", "crv", "x", "kid", "alg", "use", "key_ops"];
+    if object.keys().any(|key| !ALLOWED.contains(&key.as_str()))
+        || object.get("kty").and_then(JsonValue::as_str) != Some("OKP")
+        || object.get("crv").and_then(JsonValue::as_str) != Some("Ed25519")
+        || object.get("alg").and_then(JsonValue::as_str) != Some("EdDSA")
+        || object
+            .get("use")
+            .is_some_and(|value| value.as_str() != Some("sig"))
+    {
+        return Err(invalid_artifact(
+            "retired JWK is not an allowed public EdDSA key",
+        ));
+    }
+    let kid = object
+        .get("kid")
+        .and_then(JsonValue::as_str)
+        .filter(|kid| {
+            !kid.is_empty()
+                && kid.len() <= 256
+                && !kid.chars().any(char::is_control)
+                && *kid != active_key_id
+        })
+        .ok_or(invalid_artifact("retired JWK kid is invalid"))?;
+    let x = object
+        .get("x")
+        .and_then(JsonValue::as_str)
+        .ok_or(invalid_artifact("retired JWK public coordinate is missing"))?;
+    let decoded = URL_SAFE_NO_PAD
+        .decode(x)
+        .map_err(|_| invalid_artifact("retired JWK public coordinate is invalid"))?;
+    if decoded.len() != 32 {
+        return Err(invalid_artifact(
+            "retired JWK public coordinate has the wrong size",
+        ));
+    }
+    if let Some(operations) = object.get("key_ops") {
+        let operations = operations
+            .as_array()
+            .ok_or(invalid_artifact("retired JWK key_ops is invalid"))?;
+        if operations.len() != 1 || operations[0].as_str() != Some("verify") {
+            return Err(invalid_artifact("retired JWK key_ops is not verify-only"));
+        }
+    }
+    Ok(kid.to_owned())
+}
+
+fn concept_codelist_path(constraints: &OrderedMap<YamlValue>) -> Result<&str, BundleError> {
+    concept_constraint_string(constraints, "codelist")
+}
+
+fn concept_constraint_string<'a>(
+    constraints: &'a OrderedMap<YamlValue>,
+    key: &str,
+) -> Result<&'a str, BundleError> {
+    constraints
+        .get(key)
+        .and_then(YamlValue::as_str)
+        .ok_or(invalid_artifact("concept codelist constraint is invalid"))
+}
+
+fn validate_runtime_bindings(
+    bundle: &EvidenceConfig,
+    runtime: &RuntimeConfig,
+) -> Result<(), BundleError> {
+    let required = bundle
+        .sources
+        .iter()
+        .filter_map(|(_, source)| source.tls_trust_profile.as_deref())
+        .collect::<BTreeSet<_>>();
+    let configured = runtime
+        .outbound_tls
+        .trust_profiles
+        .keys()
+        .collect::<BTreeSet<_>>();
+    if required != configured {
+        return Err(invalid_artifact(
+            "runtime TLS trust profiles must exactly bind bundle source profiles",
+        ));
+    }
+    Ok(())
+}
+
+/// The secret root is the one immutability check whose subject is outside the
+/// bundle, so its cause says so. Re-freezing the bundle does not touch it, and
+/// an operator told only that a deployment input is not immutable audits the
+/// bundle first and finds nothing wrong with it.
+fn validate_secret_root(path: &Path) -> Result<(), BundleError> {
+    let metadata = fs::symlink_metadata(path).map_err(|_| BundleError::Unavailable)?;
+    if metadata.file_type().is_symlink() || !metadata.is_dir() {
+        return Err(BundleError::InvalidPath);
+    }
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt as _;
+        if metadata.permissions().mode() & 0o077 != 0 {
+            return Err(not_immutable(
+                "the secret root directory the runtime file names is reachable by group or other",
+            ));
+        }
+    }
+    #[cfg(not(unix))]
+    if !metadata.permissions().readonly() {
+        return Err(not_immutable(
+            "the secret root directory the runtime file names is writable",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_ca_bundle(bytes: &[u8]) -> Result<(), BundleError> {
+    let text = std::str::from_utf8(bytes)
+        .map_err(|_| invalid_artifact("TLS CA bundle is not UTF-8 PEM"))?;
+    let mut in_certificate = false;
+    let mut encoded = String::new();
+    let mut certificates = 0_usize;
+    for line in text.lines() {
+        match line {
+            "-----BEGIN CERTIFICATE-----" if !in_certificate => {
+                in_certificate = true;
+                encoded.clear();
+            }
+            "-----END CERTIFICATE-----" if in_certificate => {
+                let der = base64::engine::general_purpose::STANDARD
+                    .decode(encoded.as_bytes())
+                    .map_err(|_| invalid_artifact("TLS CA bundle PEM is invalid"))?;
+                if der.len() < 4 || der.first() != Some(&0x30) {
+                    return Err(invalid_artifact("TLS CA bundle certificate is invalid"));
+                }
+                certificates = certificates.checked_add(1).ok_or(BundleError::TooLarge)?;
+                if certificates > 64 {
+                    return Err(BundleError::TooLarge);
+                }
+                in_certificate = false;
+            }
+            "" if !in_certificate => {}
+            _ if in_certificate
+                && !line.is_empty()
+                && line.len() <= 76
+                && line.bytes().all(|byte| {
+                    byte.is_ascii_alphanumeric() || matches!(byte, b'+' | b'/' | b'=')
+                }) =>
+            {
+                encoded.push_str(line);
+            }
+            _ => {
+                return Err(invalid_artifact(
+                    "TLS CA bundle contains non-certificate PEM data",
+                ));
+            }
+        }
+    }
+    if in_certificate || certificates == 0 {
+        return Err(invalid_artifact(
+            "TLS CA bundle contains no complete certificate",
+        ));
+    }
+    Ok(())
+}
+
+fn compute_runtime_revision(
+    runtime_bytes: &[u8],
+    ca_bundles: &BTreeMap<String, Vec<u8>>,
+) -> Result<String, BundleError> {
+    let mut files = BTreeMap::from([("runtime.yaml".to_owned(), runtime_bytes.to_vec())]);
+    for (profile, bytes) in ca_bundles {
+        files.insert(format!("trust-profile/{profile}.pem"), bytes.clone());
+    }
+    compute_named_revision(RUNTIME_REVISION_DOMAIN, &files)
+}
+
+fn compute_revision(files: &BTreeMap<String, Vec<u8>>) -> Result<String, BundleError> {
+    compute_named_revision(REVISION_DOMAIN, files)
+}
+
+fn compute_named_revision(
+    domain: &[u8],
+    files: &BTreeMap<String, Vec<u8>>,
+) -> Result<String, BundleError> {
+    let mut hasher = Sha256::new();
+    hasher.update(domain);
+    hasher.update(
+        u64::try_from(files.len())
+            .map_err(|_| BundleError::TooLarge)?
+            .to_be_bytes(),
+    );
+    for (path, bytes) in files {
+        let path_bytes = path.as_bytes();
+        hasher.update(
+            u64::try_from(path_bytes.len())
+                .map_err(|_| BundleError::TooLarge)?
+                .to_be_bytes(),
+        );
+        hasher.update(path_bytes);
+        hasher.update(
+            u64::try_from(bytes.len())
+                .map_err(|_| BundleError::TooLarge)?
+                .to_be_bytes(),
+        );
+        hasher.update(bytes);
+    }
+    let digest = hasher.finalize();
+    let mut revision = String::with_capacity("sha256:".len() + 64);
+    revision.push_str("sha256:");
+    for byte in digest {
+        use std::fmt::Write as _;
+        write!(&mut revision, "{byte:02x}").map_err(|_| BundleError::TooLarge)?;
+    }
+    Ok(revision)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::config::AssuranceProfile;
+    use crate::kernel::OfflineKernel;
+
+    #[cfg(unix)]
+    fn copy_acceptance_bundle(case: &str, destination: &Path) {
+        let source = Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("../../products/evidence/fixtures/acceptance")
+            .join(case);
+        copy_tree(&source, destination);
+    }
+
+    #[cfg(unix)]
+    fn copy_tree(source: &Path, destination: &Path) {
+        fs::create_dir_all(destination).expect("create destination");
+        for entry in fs::read_dir(source).expect("read source tree") {
+            let entry = entry.expect("source entry");
+            let target = destination.join(entry.file_name());
+            if entry.file_type().expect("source file type").is_dir() {
+                copy_tree(&entry.path(), &target);
+            } else {
+                fs::copy(entry.path(), target).expect("copy fixture artifact");
+            }
+        }
+    }
+
+    #[cfg(unix)]
+    fn set_tree_mode(path: &Path, directory_mode: u32, file_mode: u32) {
+        use std::os::unix::fs::PermissionsExt as _;
+        let metadata = fs::symlink_metadata(path).expect("tree metadata");
+        if metadata.is_dir() {
+            for entry in fs::read_dir(path).expect("read tree") {
+                set_tree_mode(
+                    &entry.expect("tree entry").path(),
+                    directory_mode,
+                    file_mode,
+                );
+            }
+            fs::set_permissions(path, fs::Permissions::from_mode(directory_mode))
+                .expect("set directory mode");
+        } else if metadata.is_file() {
+            fs::set_permissions(path, fs::Permissions::from_mode(file_mode))
+                .expect("set file mode");
+        }
+    }
+
+    #[test]
+    fn revision_binds_paths_and_exact_bytes_deterministically() {
+        let first = BTreeMap::from([
+            ("evidence.yaml".to_owned(), b"version: 1\n".to_vec()),
+            ("schemas/facts.yaml".to_owned(), b"type: object\n".to_vec()),
+        ]);
+        let same = BTreeMap::from([
+            ("schemas/facts.yaml".to_owned(), b"type: object\n".to_vec()),
+            ("evidence.yaml".to_owned(), b"version: 1\n".to_vec()),
+        ]);
+        assert_eq!(compute_revision(&first), compute_revision(&same));
+
+        let renamed = BTreeMap::from([
+            ("evidence.yaml".to_owned(), b"version: 1\n".to_vec()),
+            ("schemas/other.yaml".to_owned(), b"type: object\n".to_vec()),
+        ]);
+        assert_ne!(compute_revision(&first), compute_revision(&renamed));
+    }
+
+    #[test]
+    fn fixture_coverage_is_case_neutral_but_complete() {
+        let fixture: YamlValue = serde_norway::from_str(
+            "synthetic_only: true\ncases:\n  - {id: positive}\n  - {id: negative-a}\n  - {id: boundary-a}\n  - {id: missing-a}\n  - {id: no-match}\n  - {id: ambiguous}\n  - {id: source-failure}\n  - {id: anti-reconstruction}\n",
+        )
+        .expect("fixture parses");
+        assert!(validate_fixture_coverage(&fixture).is_ok());
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn local_bundle_may_omit_fixtures_but_strict_bundles_remain_complete() {
+        let directory = tempfile::tempdir().expect("temporary bundle");
+        copy_acceptance_bundle("adult-status", directory.path());
+        let config_path = directory.path().join(CONFIG_FILE);
+        let strict = fs::read_to_string(&config_path).expect("configuration reads");
+        let local = strict
+            .replace(
+                "assuranceProfile: evidence-grade",
+                "assuranceProfile: local",
+            )
+            .lines()
+            .filter(|line| !line.trim_start().starts_with("fixtures:"))
+            .collect::<Vec<_>>()
+            .join("\n");
+        fs::write(&config_path, local).expect("local configuration writes");
+        fs::remove_file(directory.path().join("fixtures/cases.yaml"))
+            .expect("unreferenced fixture is removed");
+        set_tree_mode(directory.path(), 0o555, 0o444);
+
+        let bundle = Bundle::load(directory.path()).expect("local bundle loads without fixtures");
+        assert_eq!(bundle.config.assurance_profile, AssuranceProfile::Local);
+        assert!(bundle.fixtures.is_empty());
+
+        set_tree_mode(directory.path(), 0o755, 0o644);
+        for profile in ["production", "evidence-grade"] {
+            let candidate = fs::read_to_string(&config_path)
+                .expect("local configuration reads")
+                .replace(
+                    "assuranceProfile: local",
+                    &format!("assuranceProfile: {profile}"),
+                );
+            fs::write(&config_path, candidate).expect("strict configuration writes");
+            set_tree_mode(directory.path(), 0o555, 0o444);
+            assert!(
+                Bundle::load(directory.path()).is_err(),
+                "{profile} bundle loaded without fixtures"
+            );
+            set_tree_mode(directory.path(), 0o755, 0o644);
+            let reset = fs::read_to_string(&config_path)
+                .expect("strict configuration reads")
+                .replace(
+                    &format!("assuranceProfile: {profile}"),
+                    "assuranceProfile: local",
+                );
+            fs::write(&config_path, reset).expect("local configuration restores");
+        }
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn strict_assurance_rejects_partial_fixture_suites() {
+        for profile in ["production", "evidence-grade"] {
+            let directory = tempfile::tempdir().expect("temporary bundle");
+            copy_acceptance_bundle("adult-status", directory.path());
+
+            let config_path = directory.path().join(CONFIG_FILE);
+            let configuration = fs::read_to_string(&config_path)
+                .expect("configuration reads")
+                .replace(
+                    "assuranceProfile: evidence-grade",
+                    &format!("assuranceProfile: {profile}"),
+                );
+            fs::write(&config_path, configuration).expect("configuration writes");
+
+            let fixtures_path = directory.path().join("fixtures/cases.yaml");
+            let fixtures = fs::read_to_string(&fixtures_path)
+                .expect("fixtures read")
+                .lines()
+                .filter(|line| !line.contains("id: anti-reconstruction"))
+                .collect::<Vec<_>>()
+                .join("\n");
+            fs::write(&fixtures_path, fixtures).expect("partial fixtures write");
+            set_tree_mode(directory.path(), 0o555, 0o444);
+
+            let error = Bundle::load(directory.path()).expect_err(&format!(
+                "{profile} bundle loaded with incomplete fixture coverage"
+            ));
+            assert!(
+                error
+                    .to_string()
+                    .contains("fixture category coverage is incomplete"),
+                "{profile} failed for an unexpected reason: {error}"
+            );
+        }
+    }
+
+    #[test]
+    fn strict_public_jwk_rejects_private_material_and_duplicate_members() {
+        let private = br#"{"kty":"OKP","crv":"Ed25519","alg":"EdDSA","kid":"old","x":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","d":"secret"}"#;
+        let object = parse_strict_json_object(private).expect("JSON parses");
+        assert!(validate_public_jwk(&object, "active").is_err());
+
+        let duplicate = br#"{"kty":"OKP","kty":"OKP"}"#;
+        assert!(parse_strict_json_object(duplicate).is_err());
+
+        let control_kid = br#"{"kty":"OKP","crv":"Ed25519","alg":"EdDSA","kid":"old\u000aidentifier","x":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}"#;
+        let object = parse_strict_json_object(control_kid).expect("JSON parses");
+        assert!(validate_public_jwk(&object, "active").is_err());
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn all_coequal_immutable_acceptance_bundles_load_through_one_kernel() {
+        for case in [
+            "adult-status",
+            "residence-region",
+            "professional-licence",
+            "legal-parent-relationship",
+        ] {
+            let directory = tempfile::tempdir().expect("temporary bundle");
+            copy_acceptance_bundle(case, directory.path());
+            set_tree_mode(directory.path(), 0o555, 0o444);
+
+            let bundle = Bundle::load(directory.path()).expect("bundle loads");
+            assert!(bundle.configuration_revision().starts_with("sha256:"));
+            assert_eq!(bundle.configuration_revision().len(), 71);
+            assert_eq!(bundle.scripts.len(), 3);
+            assert_eq!(bundle.fact_schemas.len(), 3);
+            assert_eq!(bundle.fixtures.len(), 1);
+
+            set_tree_mode(directory.path(), 0o755, 0o444);
+        }
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn combined_acceptance_bundle_loads_as_one_atomic_revision() {
+        let directory = tempfile::tempdir().expect("temporary bundle");
+        copy_acceptance_bundle("all-definitions", directory.path());
+        set_tree_mode(directory.path(), 0o555, 0o444);
+
+        let bundle = Bundle::load(directory.path()).expect("combined bundle loads");
+        assert_eq!(bundle.config.requirements.len(), 4);
+        assert_eq!(bundle.config.sources.len(), 4);
+        assert_eq!(bundle.scripts.len(), 12);
+        assert_eq!(bundle.fact_schemas.len(), 12);
+        assert_eq!(bundle.fixtures.len(), 4);
+        assert_eq!(bundle.codelists.len(), 3);
+
+        set_tree_mode(directory.path(), 0o755, 0o444);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn deployment_reference_projects_are_complete_compilable_bundles() {
+        let projects_root = Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("../../products/evidence/reference/request-adapter/deployment-projects");
+        for project in [
+            "dhis2-tracker-evidence",
+            "opencrvs-family-evidence",
+            "relay-protected-read-evidence",
+        ] {
+            let project_root = projects_root.join(project);
+            RuntimeConfig::parse_yaml(
+                &fs::read(project_root.join("runtime.yaml")).expect("read reference runtime"),
+            )
+            .expect("reference runtime is closed and valid");
+
+            let directory = tempfile::tempdir().expect("temporary bundle");
+            copy_tree(&project_root.join("bundle"), directory.path());
+            set_tree_mode(directory.path(), 0o555, 0o444);
+
+            let bundle = std::sync::Arc::new(
+                Bundle::load(directory.path()).expect("reference bundle loads atomically"),
+            );
+            OfflineKernel::compile(bundle).expect("reference scripts compile through the ABI");
+
+            set_tree_mode(directory.path(), 0o755, 0o444);
+        }
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn reviewed_structured_schema_uri_resolves_exactly_one_bundle_artifact() {
+        let directory = tempfile::tempdir().expect("temporary bundle");
+        copy_acceptance_bundle("adult-status", directory.path());
+        let config_path = directory.path().join("evidence.yaml");
+        let config = fs::read_to_string(&config_path).expect("read configuration");
+        let original = "    concepts: [{id: urn:example:fixture:concept:adult-status, form: boolean, required: true, constraints: {}}]\n";
+        let replacement = "    concepts: [{id: urn:example:fixture:concept:adult-status, form: boolean, required: true, constraints: {}}, {id: urn:example:fixture:concept:structured, form: reviewed-structured-value, required: false, constraints: {schema: urn:example:fixture:schema:structured:v1, maximumSerializedBytes: 512}}]\n";
+        let config = config.replacen(original, replacement, 1);
+        assert_ne!(
+            config,
+            fs::read_to_string(&config_path).expect("read configuration")
+        );
+        fs::write(&config_path, config).expect("write configuration");
+        let schema = concat!(
+            "$schema: https://json-schema.org/draft/2020-12/schema\n",
+            "$id: urn:example:fixture:schema:structured:v1\n",
+            "type: object\n",
+            "additionalProperties: false\n",
+            "required: [status]\n",
+            "properties:\n",
+            "  status: {type: string, enum: [A]}\n"
+        );
+        fs::write(directory.path().join("schemas/structured.yaml"), schema)
+            .expect("write reviewed schema");
+        set_tree_mode(directory.path(), 0o555, 0o444);
+        let bundle = Bundle::load(directory.path()).expect("reviewed schema resolves");
+        assert!(bundle.fact_schemas.contains_key("schemas/structured.yaml"));
+
+        let schema_path = directory.path().join("schemas/structured.yaml");
+        for invalid_property in [
+            "{}",
+            "{type: object, additionalProperties: true, required: [nested], properties: {nested: {type: string, maxLength: 8}}}",
+            "{type: object, additionalProperties: false, required: [nested], properties: {nested: {}}}",
+            "{type: array, maxItems: 2, items: {}}",
+            "{type: array, items: {type: string, maxLength: 8}}",
+            "{type: string, maxLength: 8, format: custom-id}",
+        ] {
+            set_tree_mode(directory.path(), 0o755, 0o644);
+            fs::write(
+                &schema_path,
+                format!(
+                    "$schema: https://json-schema.org/draft/2020-12/schema\n$id: urn:example:fixture:schema:structured:v1\ntype: object\nadditionalProperties: false\nrequired: [status]\nproperties:\n  status: {invalid_property}\n"
+                ),
+            )
+            .expect("write invalid reviewed schema");
+            set_tree_mode(directory.path(), 0o555, 0o444);
+            assert!(
+                matches!(
+                    Bundle::load(directory.path()),
+                    Err(BundleError::InvalidArtifact(_))
+                ),
+                "open nested schema must fail: {invalid_property}"
+            );
+        }
+
+        set_tree_mode(directory.path(), 0o755, 0o644);
+        fs::write(&schema_path, schema).expect("restore reviewed schema");
+        fs::write(directory.path().join("schemas/duplicate.yaml"), schema)
+            .expect("write duplicate schema");
+        set_tree_mode(directory.path(), 0o555, 0o444);
+        let ambiguous = Bundle::load(directory.path()).expect_err("duplicate schema is rejected");
+        assert!(matches!(ambiguous, BundleError::InvalidArtifact(_)));
+        assert_eq!(
+            ambiguous.artifact_fault().map(ArtifactFault::fault),
+            Some(&SchemaFault::because(
+                "reviewed structured schema identifier is missing or ambiguous"
+            ))
+        );
+    }
+
+    /// The closed subset is learnable, but only if each rule states itself
+    /// whole. A lower bound alone is what JSON Schema habit supplies, and it is
+    /// refused, so the refusal has to say that an upper bound is the missing
+    /// half rather than leave the author to guess which of three admitted forms
+    /// was meant.
+    #[test]
+    fn an_integer_bounded_on_one_side_is_refused_by_the_whole_rule() {
+        let admitted = [
+            "{type: integer, minimum: 0, maximum: 64}",
+            "{type: integer, enum: [1, 2]}",
+            "{type: integer, const: 1}",
+        ];
+        for node in admitted {
+            let node: JsonValue = serde_norway::from_str(node).expect("admitted integer node");
+            assert!(
+                validate_schema_node(&node, SchemaRole::Facts).is_ok(),
+                "the subset admits this integer: {node}"
+            );
+        }
+
+        for node in [
+            "{type: integer, minimum: 0}",
+            "{type: integer, maximum: 64}",
+            "{type: integer}",
+        ] {
+            let node: JsonValue = serde_norway::from_str(node).expect("unbounded integer node");
+            let refused = validate_schema_node(&node, SchemaRole::Facts)
+                .expect_err("an integer bounded on one side is refused");
+            assert_eq!(
+                refused.artifact_fault().map(ArtifactFault::fault),
+                Some(&SchemaFault::because(
+                    "schema integers need both a minimum and a maximum, or an enum, or a const"
+                )),
+                "the refusal must name the whole rule: {node}"
+            );
+        }
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn writable_bundle_and_unknown_files_fail_closed() {
+        let writable = tempfile::tempdir().expect("temporary bundle");
+        copy_acceptance_bundle("adult-status", writable.path());
+        let writable_error = Bundle::load(writable.path()).expect_err("a writable bundle fails");
+        let fault = writable_error
+            .artifact_fault()
+            .expect("the refusal names what is writable");
+        assert_eq!(fault.artifact(), "");
+        assert_eq!(fault.fault().cause(), "the bundle directory is writable");
+
+        let unknown = tempfile::tempdir().expect("temporary bundle");
+        copy_acceptance_bundle("adult-status", unknown.path());
+        fs::write(
+            unknown.path().join("fixtures/unreferenced.yaml"),
+            b"synthetic_only: true\n",
+        )
+        .expect("write unknown artifact");
+        set_tree_mode(unknown.path(), 0o555, 0o444);
+        let unreferenced = Bundle::load(unknown.path()).expect_err("unknown artifact is rejected");
+        assert!(matches!(unreferenced, BundleError::UnknownFile(_)));
+        let fault = unreferenced.artifact_fault().expect("closure names a file");
+        assert_eq!(fault.artifact(), "fixtures/unreferenced.yaml");
+        assert_eq!(
+            fault.fault().cause(),
+            "the bundle contains an artifact the configuration does not reference"
+        );
+        set_tree_mode(unknown.path(), 0o755, 0o444);
+
+        let missing = tempfile::tempdir().expect("temporary bundle");
+        copy_acceptance_bundle("adult-status", missing.path());
+        fs::remove_file(missing.path().join("derivations/adult-status.rhai"))
+            .expect("remove referenced derivation");
+        set_tree_mode(missing.path(), 0o555, 0o444);
+        let absent = Bundle::load(missing.path()).expect_err("missing artifact is rejected");
+        let fault = absent.artifact_fault().expect("closure names a file");
+        assert_eq!(fault.artifact(), "derivations/adult-status.rhai");
+        assert_eq!(
+            fault.fault().cause(),
+            "the configuration references an artifact the bundle does not contain"
+        );
+        set_tree_mode(missing.path(), 0o755, 0o444);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn symlinked_artifact_fails_before_file_access() {
+        use std::os::unix::fs::symlink;
+
+        let directory = tempfile::tempdir().expect("temporary bundle");
+        copy_acceptance_bundle("adult-status", directory.path());
+        let outside = tempfile::NamedTempFile::new().expect("outside script");
+        let adapter = directory.path().join("adapters/source-a.rhai");
+        fs::remove_file(&adapter).expect("remove copied adapter");
+        symlink(outside.path(), adapter).expect("create symlink");
+        set_tree_mode(directory.path(), 0o555, 0o444);
+        assert!(matches!(
+            Bundle::load(directory.path()),
+            Err(BundleError::InvalidPath)
+        ));
+        set_tree_mode(directory.path(), 0o755, 0o444);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn runtime_and_ca_bytes_are_captured_under_an_independent_read_only_revision() {
+        use std::os::unix::fs::PermissionsExt as _;
+
+        let directory = tempfile::tempdir().expect("temporary runtime root");
+        let secret_root = directory.path().join("secrets");
+        fs::create_dir(&secret_root).expect("create secret root");
+        fs::set_permissions(&secret_root, fs::Permissions::from_mode(0o700))
+            .expect("lock secret root");
+        let ca_path = directory.path().join("internal.pem");
+        fs::write(
+            &ca_path,
+            b"-----BEGIN CERTIFICATE-----\nMAMCAQE=\n-----END CERTIFICATE-----\n",
+        )
+        .expect("write CA bundle");
+        fs::set_permissions(&ca_path, fs::Permissions::from_mode(0o444)).expect("lock CA bundle");
+        let runtime_path = directory.path().join("runtime.yaml");
+        fs::write(
+            &runtime_path,
+            format!(
+                "version: 1\nbundleDirectory: /etc/registry-evidence/bundle\nlistener:\n  bindHost: 127.0.0.1\n  port: 8080\n  tlsTermination: operator-controlled-upstream\n  trustProxyIdentityHeaders: false\n  maximumRequestBytes: 65536\n  maximumConcurrentRequests: 64\n  requestTimeoutMilliseconds: 10000\n  shutdownGraceMilliseconds: 30000\nsecretProviders:\n  file: {{root: {}}}\nauditStorage:\n  path: /var/lib/registry-evidence/audit/evidence.jsonl\n  maximumFileBytes: 1073741824\noutboundTls:\n  systemRoots: true\n  trustProfiles:\n    internal-pki: {{caBundleFile: {}}}\n",
+                secret_root.display(),
+                ca_path.display()
+            ),
+        )
+        .expect("write runtime document");
+
+        let writable = RuntimeDocument::load(&runtime_path).expect_err("a writable runtime fails");
+        let fault = writable
+            .artifact_fault()
+            .expect("the refusal names what is writable");
+        assert_eq!(fault.artifact(), RUNTIME_FILE);
+        assert_eq!(fault.fault().cause(), "the runtime file is writable");
+        fs::set_permissions(&runtime_path, fs::Permissions::from_mode(0o444))
+            .expect("lock runtime document");
+        let runtime = RuntimeDocument::load(&runtime_path).expect("runtime loads");
+        assert!(runtime.revision().starts_with("sha256:"));
+        assert_eq!(runtime.revision().len(), 71);
+        assert_eq!(runtime.ca_bundles.len(), 1);
+        assert_eq!(
+            runtime.bytes(),
+            fs::read(&runtime_path).expect("read runtime")
+        );
+
+        // Everything the operator can re-freeze is already frozen here, so the
+        // refusal has to name the one input outside the bundle. Re-freezing the
+        // bundle in answer to it changes nothing, which is what makes an
+        // unnamed immutability failure cost a mode audit of the whole tree.
+        fs::set_permissions(&secret_root, fs::Permissions::from_mode(0o750))
+            .expect("loosen secret root");
+        let loose = RuntimeDocument::load(&runtime_path).expect_err("a group-readable root fails");
+        let fault = loose
+            .artifact_fault()
+            .expect("the refusal names what is loose");
+        assert_eq!(
+            fault.fault().cause(),
+            "the secret root directory the runtime file names is reachable by group or other"
+        );
+    }
+}
diff --git a/crates/registry-evidence/src/config.rs b/crates/registry-evidence/src/config.rs
new file mode 100644
index 000000000..55a36afa6
--- /dev/null
+++ b/crates/registry-evidence/src/config.rs
@@ -0,0 +1,4771 @@
+//! Typed Evidence Version 1 deployment configuration.
+//!
+//! Configuration is trusted deployment data, but it is still parsed as a
+//! closed contract. Secret-bearing fields contain only [`SecretRef`] values;
+//! this module never resolves them.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::fmt;
+use std::net::{IpAddr, Ipv6Addr};
+use std::path::{Component, Path};
+use std::str::FromStr;
+
+use serde::de::{self, MapAccess, Visitor};
+use serde::ser::SerializeMap;
+use serde::{Deserialize, Deserializer, Serialize, Serializer};
+use serde_norway::Value as YamlValue;
+use thiserror::Error;
+use url::{Host, Url};
+
+pub const MAX_CONFIG_BYTES: usize = 1024 * 1024;
+pub const MAX_SAFE_INTEGER: i64 = 9_007_199_254_740_991;
+
+#[derive(Debug, Error, Clone, Eq, PartialEq)]
+pub enum ConfigError {
+    #[error("configuration YAML does not match the Evidence Version 1 schema: {0}")]
+    InvalidYaml(SchemaFault),
+    #[error("configuration exceeds the Evidence Version 1 size limit")]
+    TooLarge,
+    #[error("configuration violates the Evidence Version 1 contract: {0}")]
+    Invalid(&'static str),
+}
+
+impl ConfigError {
+    /// The value-free diagnostic for this failure.
+    ///
+    /// Deployment tooling reports this instead of the error itself so that
+    /// every configuration failure carries the same safe shape.
+    pub fn fault(&self) -> SchemaFault {
+        match self {
+            Self::InvalidYaml(fault) => fault.clone(),
+            Self::TooLarge => SchemaFault::because("document exceeds the Version 1 size limit"),
+            Self::Invalid(cause) => SchemaFault::because(cause),
+        }
+    }
+}
+
+/// A one-based text position inside a deployment artifact.
+#[derive(Debug, Clone, Copy, Eq, PartialEq)]
+pub struct TextLocation {
+    pub line: usize,
+    pub column: usize,
+}
+
+impl fmt::Display for TextLocation {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(formatter, "line {} column {}", self.line, self.column)
+    }
+}
+
+/// A value-free reason one deployment document was rejected.
+///
+/// Only three things are kept: a schema path built from mapping keys and
+/// sequence indices, a text location, and one static cause. The decoder's own
+/// message is classified and then discarded, because it quotes scalars, and a
+/// deployment scalar can be a selector value, a secret reference, or a source
+/// identifier.
+#[derive(Debug, Clone, Eq, PartialEq)]
+pub struct SchemaFault {
+    location: Option<TextLocation>,
+    path: Option<String>,
+    cause: &'static str,
+}
+
+/// The longest schema path a diagnostic will carry.
+const MAX_SCHEMA_PATH_BYTES: usize = 256;
+
+/// Decoder message prefixes mapped to their value-free cause.
+///
+/// The prefixes are the fixed leading text of `serde` and `serde_norway`
+/// messages. Everything after a prefix can quote document content and is
+/// never read.
+const DECODE_CAUSES: [(&str, &str); 13] = [
+    ("unknown field", "unknown field"),
+    ("missing field", "required field is missing"),
+    ("duplicate field", "duplicate field"),
+    ("duplicate entry", "duplicate mapping key"),
+    ("invalid type", "field has the wrong type"),
+    ("invalid value", "field value is not accepted"),
+    ("invalid length", "field has the wrong length"),
+    (
+        "unknown variant",
+        "field value is not one of the accepted variants",
+    ),
+    (
+        "data did not match any variant",
+        "field value is not one of the accepted variants",
+    ),
+    (
+        "EOF while parsing",
+        "document ends before a value is complete",
+    ),
+    ("recursion limit exceeded", "document nests too deeply"),
+    (
+        "repetition limit exceeded",
+        "document repeats an alias too often",
+    ),
+    (
+        "deserializing from YAML containing more than one document",
+        "document contains more than one YAML document",
+    ),
+];
+
+impl SchemaFault {
+    /// A fault that names only its cause.
+    pub fn because(cause: &'static str) -> Self {
+        Self {
+            location: None,
+            path: None,
+            cause,
+        }
+    }
+
+    pub fn cause(&self) -> &'static str {
+        self.cause
+    }
+
+    pub fn path(&self) -> Option<&str> {
+        self.path.as_deref()
+    }
+
+    pub fn location(&self) -> Option<TextLocation> {
+        self.location
+    }
+
+    /// Reduce a decoder error to a location, a safe schema path, and a cause.
+    fn from_yaml_error(error: &serde_norway::Error, fallback: &'static str) -> Self {
+        let rendered = error.to_string();
+        let (path, message) = split_schema_path(&rendered);
+        Self {
+            location: error.location().map(|location| TextLocation {
+                line: location.line(),
+                column: location.column(),
+            }),
+            path,
+            cause: classify_decode_cause(message, fallback),
+        }
+    }
+}
+
+impl fmt::Display for SchemaFault {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.cause)?;
+        if let Some(path) = &self.path {
+            write!(formatter, " at {path}")?;
+        }
+        if let Some(location) = self.location {
+            write!(formatter, " ({location})")?;
+        }
+        Ok(())
+    }
+}
+
+/// Split a rendered decoder error into its schema path and its message.
+///
+/// `serde_norway` prefixes a message with the path to the offending value when
+/// it knows one. The candidate prefix is accepted only when it matches the
+/// path grammar, which no message text can satisfy, so a message that merely
+/// contains a colon never becomes a path.
+fn split_schema_path(rendered: &str) -> (Option<String>, &str) {
+    match rendered.split_once(": ") {
+        Some((candidate, message)) if is_safe_schema_path(candidate) => {
+            (Some(candidate.to_owned()), message)
+        }
+        _ => (None, rendered),
+    }
+}
+
+/// Accept only paths built from mapping keys and numeric sequence indices.
+///
+/// Mapping keys are structural names in a reviewed bundle, never values, and
+/// this grammar admits no whitespace, quoting, or punctuation that a quoted
+/// scalar would carry.
+fn is_safe_schema_path(candidate: &str) -> bool {
+    if candidate.is_empty() || candidate.len() > MAX_SCHEMA_PATH_BYTES {
+        return false;
+    }
+    let mut index_digits: Option<usize> = None;
+    for character in candidate.chars() {
+        match index_digits {
+            Some(digits) => match character {
+                '0'..='9' => index_digits = Some(digits + 1),
+                ']' if digits > 0 => index_digits = None,
+                _ => return false,
+            },
+            None => match character {
+                '[' => index_digits = Some(0),
+                '.' | '-' | '_' | '?' => {}
+                _ if character.is_ascii_alphanumeric() => {}
+                _ => return false,
+            },
+        }
+    }
+    index_digits.is_none()
+}
+
+/// Map a decoder message to one static cause, reading only its fixed prefix.
+fn classify_decode_cause(message: &str, fallback: &'static str) -> &'static str {
+    DECODE_CAUSES
+        .iter()
+        .find(|(prefix, _)| message.starts_with(prefix))
+        .map_or(fallback, |(_, cause)| cause)
+}
+
+/// Decode one YAML document into a closed typed schema.
+///
+/// The bytes are parsed as untyped YAML first so that a syntax failure is
+/// reported as a syntax failure rather than as a schema mismatch.
+fn decode_yaml<T: serde::de::DeserializeOwned>(text: &str) -> Result<T, ConfigError> {
+    if let Err(error) = serde_norway::from_str::<YamlValue>(text) {
+        return Err(ConfigError::InvalidYaml(SchemaFault::from_yaml_error(
+            &error,
+            "document is not well-formed YAML",
+        )));
+    }
+    serde_norway::from_str(text).map_err(|error| {
+        ConfigError::InvalidYaml(SchemaFault::from_yaml_error(
+            &error,
+            "document does not match the closed schema",
+        ))
+    })
+}
+
+/// A mapping that rejects duplicate keys and preserves declaration order.
+///
+/// Selector declaration order is part of canonical selector encoding, so a
+/// sorted map is not sufficient for this contract.
+#[derive(Clone, Eq, PartialEq)]
+pub struct OrderedMap<T>(Vec<(String, T)>);
+
+impl<T> Default for OrderedMap<T> {
+    fn default() -> Self {
+        Self(Vec::new())
+    }
+}
+
+impl<T> OrderedMap<T> {
+    pub fn len(&self) -> usize {
+        self.0.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+
+    pub fn get(&self, key: &str) -> Option<&T> {
+        self.0
+            .iter()
+            .find_map(|(candidate, value)| (candidate == key).then_some(value))
+    }
+
+    pub fn contains_key(&self, key: &str) -> bool {
+        self.get(key).is_some()
+    }
+
+    pub fn iter(&self) -> impl Iterator<Item = (&str, &T)> {
+        self.0.iter().map(|(key, value)| (key.as_str(), value))
+    }
+
+    pub fn keys(&self) -> impl Iterator<Item = &str> {
+        self.0.iter().map(|(key, _)| key.as_str())
+    }
+}
+
+impl<T: fmt::Debug> fmt::Debug for OrderedMap<T> {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_map()
+            .entries(self.0.iter().map(|(key, value)| (key, value)))
+            .finish()
+    }
+}
+
+impl<'de, T> Deserialize<'de> for OrderedMap<T>
+where
+    T: Deserialize<'de>,
+{
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        struct OrderedMapVisitor<T>(std::marker::PhantomData<T>);
+
+        impl<'de, T> Visitor<'de> for OrderedMapVisitor<T>
+        where
+            T: Deserialize<'de>,
+        {
+            type Value = OrderedMap<T>;
+
+            fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+                formatter.write_str("a mapping with unique string keys")
+            }
+
+            fn visit_map<A>(self, mut map: A) -> Result<Self::Value, A::Error>
+            where
+                A: MapAccess<'de>,
+            {
+                let mut entries = Vec::with_capacity(map.size_hint().unwrap_or(0));
+                let mut seen = BTreeSet::new();
+                while let Some((key, value)) = map.next_entry::<String, T>()? {
+                    if !seen.insert(key.clone()) {
+                        return Err(de::Error::custom("duplicate mapping key"));
+                    }
+                    entries.push((key, value));
+                }
+                Ok(OrderedMap(entries))
+            }
+        }
+
+        deserializer.deserialize_map(OrderedMapVisitor(std::marker::PhantomData))
+    }
+}
+
+impl<T: Serialize> Serialize for OrderedMap<T> {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        let mut map = serializer.serialize_map(Some(self.0.len()))?;
+        for (key, value) in &self.0 {
+            map.serialize_entry(key, value)?;
+        }
+        map.end()
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct EvidenceConfig {
+    pub version: u8,
+    /// The governed assurance boundary for this immutable bundle.
+    pub assurance_profile: AssuranceProfile,
+    pub service: ServiceConfig,
+    pub issuer: IssuerConfig,
+    pub authentication: AuthenticationConfig,
+    pub audit: AuditConfig,
+    pub subject_binding: SubjectBindingConfig,
+    pub rate_limits: RateLimitConfig,
+    pub signing: SigningConfig,
+    /// Closed enabled response formats for the whole immutable bundle. Signed
+    /// flattened JWS is mandatory and the default; unsigned JSON must be
+    /// enabled here and permitted by the complete matched grant.
+    #[serde(default = "default_response_formats")]
+    pub response_formats: Vec<ResponseFormat>,
+    pub selector_profiles: OrderedMap<SelectorProfile>,
+    pub sources: OrderedMap<SourceConfig>,
+    pub authority_profiles: OrderedMap<AuthorityProfile>,
+    pub requirements: Vec<RequirementConfig>,
+}
+
+#[derive(
+    Debug,
+    Clone,
+    Copy,
+    Eq,
+    PartialEq,
+    Deserialize,
+    Serialize,
+    schemars::JsonSchema,
+    utoipa::ToSchema,
+)]
+#[serde(rename_all = "kebab-case")]
+pub enum AssuranceProfile {
+    Local,
+    Production,
+    EvidenceGrade,
+}
+
+impl AssuranceProfile {
+    /// Only the explicit local profile may be authored before fixture
+    /// coverage exists. Deployable profiles retain the complete fixture gate.
+    pub fn requires_fixtures(self) -> bool {
+        matches!(self, Self::Production | Self::EvidenceGrade)
+    }
+}
+
+pub type SourceSelectorSet = Vec<(String, String)>;
+
+impl EvidenceConfig {
+    pub fn parse_yaml(bytes: &[u8]) -> Result<Self, ConfigError> {
+        if bytes.len() > MAX_CONFIG_BYTES {
+            return Err(ConfigError::TooLarge);
+        }
+        let text = std::str::from_utf8(bytes)
+            .map_err(|_| ConfigError::InvalidYaml(SchemaFault::because("document is not UTF-8")))?;
+        let config: Self = decode_yaml(text)?;
+        config.validate()?;
+        Ok(config)
+    }
+
+    pub fn validate(&self) -> Result<(), ConfigError> {
+        if self.version != 1 {
+            return invalid("version must equal 1");
+        }
+        validate_uri(&self.service.provider_id)?;
+        validate_uri(&self.service.trust_domain)?;
+        validate_uri(&self.issuer.id)?;
+        self.authentication.validate(self.assurance_profile)?;
+        self.audit.validate()?;
+        self.subject_binding.validate()?;
+        self.rate_limits.validate()?;
+        self.signing.validate()?;
+        validate_response_formats(&self.response_formats, "bundle response formats")?;
+        validate_named_map(&self.selector_profiles, 1, 128, |profile| {
+            profile.validate()
+        })?;
+        validate_named_map(&self.sources, 1, 128, |source| {
+            source.validate(self.assurance_profile)
+        })?;
+        validate_named_map(&self.authority_profiles, 1, 128, |profile| {
+            profile.validate()
+        })?;
+        validate_len(self.requirements.len(), 1, 128, "requirements")?;
+
+        let mut requirement_ids = BTreeSet::new();
+        let mut evidence_types = BTreeSet::new();
+        let mut concept_ids = BTreeSet::new();
+        let mut disclosure_families = BTreeSet::new();
+        // One artifact carries one schema role for the whole bundle: reviewing
+        // it as a response contract must not silently also accept it as a fact
+        // or adapter-parameter contract somewhere else.
+        let response_schemas = self
+            .sources
+            .iter()
+            .map(|(_, source)| source.response_schema.as_str())
+            .collect::<BTreeSet<_>>();
+        let fact_schemas = self
+            .sources
+            .iter()
+            .map(|(_, source)| source.fact_schema.as_str())
+            .collect::<BTreeSet<_>>();
+        let parameter_schemas = self
+            .sources
+            .iter()
+            .map(|(_, source)| source.request.adapter_parameters_schema.as_str())
+            .collect::<BTreeSet<_>>();
+        if !fact_schemas.is_disjoint(&parameter_schemas)
+            || !response_schemas.is_disjoint(&fact_schemas)
+            || !response_schemas.is_disjoint(&parameter_schemas)
+        {
+            return invalid("source schema roles must not overlap across sources");
+        }
+        for requirement in &self.requirements {
+            requirement.validate()?;
+            if self.assurance_profile.requires_fixtures() && requirement.fixtures.is_none() {
+                return invalid("production and evidence-grade requirements must declare fixtures");
+            }
+            if !requirement_ids.insert(requirement.id.as_str()) {
+                return invalid("requirement identifiers must be unique");
+            }
+            if !evidence_types.insert(requirement.evidence_type.as_str()) {
+                return invalid("Evidence Type identifiers must be unique");
+            }
+            for concept in &requirement.concepts {
+                if !concept_ids.insert(concept.id.as_str()) {
+                    return invalid("concept identifiers must be unique");
+                }
+            }
+            for family in &requirement.disclosure_guard.families {
+                if !disclosure_families.insert(family.as_str()) {
+                    return invalid("enabled requirements share a disclosure family");
+                }
+            }
+        }
+
+        self.validate_cross_references()
+    }
+
+    /// Return the complete selector tuple sets that an authorized request may
+    /// activate for one source. The configuration has already proven that
+    /// every grant is complete and references the named requirement source.
+    pub fn source_selector_sets(&self, source_id: &str) -> Vec<SourceSelectorSet> {
+        let Some(source) = self.sources.get(source_id) else {
+            return Vec::new();
+        };
+        let requirement_sources = self
+            .requirements
+            .iter()
+            .map(|requirement| (requirement.id.as_str(), requirement.source.as_str()))
+            .collect::<BTreeMap<_, _>>();
+        let mut sets = BTreeSet::new();
+        for (_, authority) in self.authority_profiles.iter() {
+            for grant in &authority.grants {
+                if requirement_sources.get(grant.requirement.as_str()) != Some(&source_id) {
+                    continue;
+                }
+                let mut set = grant
+                    .subjects
+                    .iter()
+                    .filter(|subject| {
+                        source.request.selector_inputs.iter().any(|input| {
+                            input.role == subject.role
+                                && input.alternatives.iter().any(|alternative| {
+                                    alternative.profile == subject.selector_profile
+                                })
+                        })
+                    })
+                    .map(|subject| (subject.role.clone(), subject.selector_profile.clone()))
+                    .collect::<SourceSelectorSet>();
+                if set.is_empty() {
+                    continue;
+                }
+                set.sort();
+                sets.insert(set);
+            }
+        }
+        sets.into_iter().collect()
+    }
+
+    fn validate_cross_references(&self) -> Result<(), ConfigError> {
+        for (_, source) in self.sources.iter() {
+            for input in &source.request.selector_inputs {
+                for alternative in &input.alternatives {
+                    let profile = self.selector_profiles.get(&alternative.profile).ok_or(
+                        ConfigError::Invalid(
+                            "source selector input references an unknown selector profile",
+                        ),
+                    )?;
+                    if alternative
+                        .fields
+                        .iter()
+                        .any(|field| !profile.fields.contains_key(field))
+                    {
+                        return invalid(
+                            "source selector input references an unknown selector field",
+                        );
+                    }
+                }
+            }
+            for (_, binding) in source.request.path_bindings.iter() {
+                let profile =
+                    self.selector_profiles
+                        .get(&binding.profile)
+                        .ok_or(ConfigError::Invalid(
+                            "source path binding references an unknown selector profile",
+                        ))?;
+                if !profile.fields.contains_key(&binding.field) {
+                    return invalid("source path binding references an unknown selector field");
+                }
+                if !source.request.selector_inputs.iter().any(|input| {
+                    input.role == binding.role
+                        && input.alternatives.iter().any(|alternative| {
+                            alternative.profile == binding.profile
+                                && alternative.fields.contains(&binding.field)
+                        })
+                }) {
+                    return invalid("source path binding is not declared as a selector input");
+                }
+            }
+        }
+
+        for requirement in &self.requirements {
+            if !self.sources.contains_key(&requirement.source) {
+                return invalid("requirement references an unknown source");
+            }
+            if requirement.validity_seconds > self.signing.maximum_assertion_validity_seconds {
+                return invalid("requirement validity exceeds signing maximum validity");
+            }
+            for role in &requirement.subject_roles {
+                for profile_id in &role.selector_profiles {
+                    self.selector_profiles
+                        .get(profile_id)
+                        .ok_or(ConfigError::Invalid(
+                            "requirement references an unknown selector profile",
+                        ))?;
+                }
+            }
+            validate_derivation_selector_inputs(requirement, &self.selector_profiles)?;
+        }
+
+        let requirements = self
+            .requirements
+            .iter()
+            .map(|requirement| (requirement.id.as_str(), requirement))
+            .collect::<BTreeMap<_, _>>();
+        let mut authorized_combinations = BTreeSet::new();
+        let mut source_selector_sets: BTreeMap<String, BTreeSet<SourceSelectorSet>> =
+            BTreeMap::new();
+        for (_, authority) in self.authority_profiles.iter() {
+            for grant in &authority.grants {
+                let requirement =
+                    requirements
+                        .get(grant.requirement.as_str())
+                        .ok_or(ConfigError::Invalid(
+                            "authority grant references an unknown requirement",
+                        ))?;
+                if !requirement
+                    .purposes
+                    .iter()
+                    .any(|purpose| purpose == &grant.purpose)
+                {
+                    return invalid("authority grant references an unauthorized purpose");
+                }
+                if grant.subjects.len() != requirement.subject_roles.len() {
+                    return invalid("authority grant must bind the complete subject-role set");
+                }
+                let source = self
+                    .sources
+                    .get(&requirement.source)
+                    .ok_or(ConfigError::Invalid(
+                        "requirement references an unknown source",
+                    ))?;
+                let mut seen_roles = BTreeSet::new();
+                let mut source_selector_set = Vec::with_capacity(grant.subjects.len());
+                for subject in &grant.subjects {
+                    if !seen_roles.insert(subject.role.as_str()) {
+                        return invalid("authority grant subject roles must be unique");
+                    }
+                    let role = requirement
+                        .subject_roles
+                        .iter()
+                        .find(|role| role.role == subject.role)
+                        .ok_or(ConfigError::Invalid(
+                            "authority grant references an unknown subject role",
+                        ))?;
+                    if !role
+                        .selector_profiles
+                        .iter()
+                        .any(|profile| profile == &subject.selector_profile)
+                    {
+                        return invalid("authority grant selector profile is not allowed for role");
+                    }
+                    let profile = self
+                        .selector_profiles
+                        .get(&subject.selector_profile)
+                        .ok_or(ConfigError::Invalid(
+                            "authority grant references an unknown selector profile",
+                        ))?;
+                    subject.validate_value_claims(profile)?;
+                    authorized_combinations.insert((
+                        grant.requirement.as_str(),
+                        grant.purpose.as_str(),
+                        subject.role.as_str(),
+                        subject.selector_profile.as_str(),
+                    ));
+                    if source.request.selector_inputs.iter().any(|input| {
+                        input.role == subject.role
+                            && input
+                                .alternatives
+                                .iter()
+                                .any(|alternative| alternative.profile == subject.selector_profile)
+                    }) {
+                        source_selector_set
+                            .push((subject.role.clone(), subject.selector_profile.clone()));
+                    }
+                }
+                if requirement
+                    .subject_roles
+                    .iter()
+                    .any(|role| !seen_roles.contains(role.role.as_str()))
+                {
+                    return invalid("authority grant omits a required subject role");
+                }
+                if source_selector_set.is_empty() {
+                    return invalid(
+                        "authority path does not activate any declared source selector input",
+                    );
+                }
+                source_selector_set.sort();
+                source_selector_sets
+                    .entry(requirement.source.clone())
+                    .or_default()
+                    .insert(source_selector_set);
+            }
+        }
+
+        for requirement in &self.requirements {
+            for purpose in &requirement.purposes {
+                for role in &requirement.subject_roles {
+                    for profile in &role.selector_profiles {
+                        if !authorized_combinations.contains(&(
+                            requirement.id.as_str(),
+                            purpose.as_str(),
+                            role.role.as_str(),
+                            profile.as_str(),
+                        )) {
+                            return invalid(
+                                "requirement role and selector profile lack an authority path",
+                            );
+                        }
+                    }
+                }
+            }
+        }
+        self.validate_source_selector_sets(&source_selector_sets)?;
+        Ok(())
+    }
+
+    fn validate_source_selector_sets(
+        &self,
+        allowed: &BTreeMap<String, BTreeSet<SourceSelectorSet>>,
+    ) -> Result<(), ConfigError> {
+        for (source_id, source) in self.sources.iter() {
+            let sets = allowed.get(source_id).ok_or(ConfigError::Invalid(
+                "configured source is unreachable from every authority grant",
+            ))?;
+            let reachable = sets
+                .iter()
+                .flatten()
+                .map(|(role, profile)| (role.as_str(), profile.as_str()))
+                .collect::<BTreeSet<_>>();
+            if source.request.selector_inputs.iter().any(|input| {
+                input.alternatives.iter().any(|alternative| {
+                    !reachable.contains(&(input.role.as_str(), alternative.profile.as_str()))
+                })
+            }) {
+                return invalid(
+                    "source selector input is unreachable from every complete authority path",
+                );
+            }
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ServiceConfig {
+    pub provider_id: String,
+    pub trust_domain: String,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct IssuerConfig {
+    pub id: String,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct RuntimeConfig {
+    pub version: u8,
+    pub bundle_directory: String,
+    pub listener: ListenerConfig,
+    /// Optional operator-only metrics listener. Absent means the deployment
+    /// serves no metrics endpoint at all, which is the default posture.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub metrics_listener: Option<MetricsListenerConfig>,
+    pub secret_providers: RuntimeSecretProviders,
+    pub audit_storage: AuditStorageConfig,
+    pub outbound_tls: OutboundTlsConfig,
+}
+
+impl RuntimeConfig {
+    pub fn parse_yaml(bytes: &[u8]) -> Result<Self, ConfigError> {
+        if bytes.len() > MAX_CONFIG_BYTES {
+            return Err(ConfigError::TooLarge);
+        }
+        let text = std::str::from_utf8(bytes)
+            .map_err(|_| ConfigError::InvalidYaml(SchemaFault::because("document is not UTF-8")))?;
+        let config: Self = decode_yaml(text)?;
+        config.validate()?;
+        Ok(config)
+    }
+
+    pub fn validate(&self) -> Result<(), ConfigError> {
+        if self.version != 1 {
+            return invalid("runtime version must equal 1");
+        }
+        validate_absolute_path(&self.bundle_directory)?;
+        self.listener.validate()?;
+        if let Some(metrics) = &self.metrics_listener {
+            metrics.validate(&self.listener)?;
+        }
+        self.secret_providers.validate()?;
+        self.audit_storage.validate()?;
+        self.outbound_tls.validate()
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct RuntimeSecretProviders {
+    pub file: FileSecretProvider,
+}
+
+impl RuntimeSecretProviders {
+    fn validate(&self) -> Result<(), ConfigError> {
+        self.file.validate()
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct FileSecretProvider {
+    pub root: String,
+}
+
+impl FileSecretProvider {
+    fn validate(&self) -> Result<(), ConfigError> {
+        validate_absolute_path(&self.root)
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct AuditStorageConfig {
+    pub path: String,
+    pub maximum_file_bytes: u64,
+}
+
+impl AuditStorageConfig {
+    fn validate(&self) -> Result<(), ConfigError> {
+        validate_absolute_path(&self.path)?;
+        validate_range(
+            self.maximum_file_bytes,
+            1_048_576,
+            1_099_511_627_776,
+            "audit maximumFileBytes",
+        )
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct OutboundTlsConfig {
+    pub system_roots: bool,
+    pub trust_profiles: OrderedMap<TrustProfileBinding>,
+}
+
+impl OutboundTlsConfig {
+    fn validate(&self) -> Result<(), ConfigError> {
+        if !self.system_roots {
+            return invalid("outbound TLS system roots must remain enabled");
+        }
+        validate_named_map(&self.trust_profiles, 0, 64, TrustProfileBinding::validate)
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct TrustProfileBinding {
+    pub ca_bundle_file: String,
+}
+
+impl TrustProfileBinding {
+    fn validate(&self) -> Result<(), ConfigError> {
+        validate_absolute_path(&self.ca_bundle_file)
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ListenerConfig {
+    pub bind_host: String,
+    pub port: u16,
+    pub tls_termination: TlsTermination,
+    pub trust_proxy_identity_headers: bool,
+    pub maximum_request_bytes: u64,
+    pub maximum_concurrent_requests: u32,
+    pub request_timeout_milliseconds: u64,
+    pub shutdown_grace_milliseconds: u64,
+}
+
+impl ListenerConfig {
+    fn validate(&self) -> Result<(), ConfigError> {
+        validate_private_bind_host(&self.bind_host)?;
+        validate_listener_port(self.port)?;
+        if self.trust_proxy_identity_headers {
+            return invalid("proxy identity headers must not be trusted");
+        }
+        validate_range(
+            self.maximum_request_bytes,
+            1_024,
+            1_048_576,
+            "maximumRequestBytes",
+        )?;
+        validate_range(
+            u64::from(self.maximum_concurrent_requests),
+            1,
+            4_096,
+            "maximumConcurrentRequests",
+        )?;
+        validate_range(
+            self.request_timeout_milliseconds,
+            1,
+            30_000,
+            "requestTimeoutMilliseconds",
+        )?;
+        validate_range(
+            self.shutdown_grace_milliseconds,
+            1,
+            120_000,
+            "shutdownGraceMilliseconds",
+        )
+    }
+}
+
+/// Operator-only telemetry listener.
+///
+/// It is a separate binding rather than a route on the evidence listener so
+/// that reaching the counters requires reaching a different socket. It carries
+/// no request limits of its own: it serves one static rendering of in-process
+/// counters, reads no request body, and touches no source or signing material.
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct MetricsListenerConfig {
+    pub bind_host: String,
+    pub port: u16,
+}
+
+impl MetricsListenerConfig {
+    fn validate(&self, evidence_listener: &ListenerConfig) -> Result<(), ConfigError> {
+        validate_private_bind_host(&self.bind_host)?;
+        validate_listener_port(self.port)?;
+        // Sharing the evidence binding would publish the counters on the
+        // listener the public contract describes, which is the separation this
+        // block exists to enforce.
+        if self.bind_host == evidence_listener.bind_host && self.port == evidence_listener.port {
+            return invalid("metricsListener must not share the evidence listener binding");
+        }
+        Ok(())
+    }
+}
+
+/// Refuse port 0, which asks the kernel for an arbitrary ephemeral port rather
+/// than naming one.
+///
+/// Every listener here is an operator-network binding that something upstream
+/// firewalls, health-checks, or terminates TLS for, and none of that can follow
+/// a port that is chosen at bind time and changes on every restart. The
+/// published runtime schema already states the bound, so this is the loader
+/// agreeing with the contract an operator validated against.
+fn validate_listener_port(port: u16) -> Result<(), ConfigError> {
+    validate_range(u64::from(port), 1, 65_535, "port")
+}
+
+/// Accept only numeric loopback, RFC 1918 private IPv4, and RFC 4193
+/// unique-local IPv6 bindings. Every listener this service opens is an
+/// operator-network listener; TLS and exposure are upstream concerns.
+fn validate_private_bind_host(bind_host: &str) -> Result<(), ConfigError> {
+    if bind_host.len() < 2 || bind_host.len() > 64 {
+        return invalid("listener bindHost length is invalid");
+    }
+    let ip: IpAddr = bind_host
+        .parse()
+        .map_err(|_| ConfigError::Invalid("listener bindHost must be a private numeric IP"))?;
+    let private = match ip {
+        IpAddr::V4(ip) => ip.is_loopback() || ip.is_private(),
+        IpAddr::V6(ip) => ip.is_loopback() || is_unique_local(ip),
+    };
+    if !private || ip.is_unspecified() || ip.is_multicast() {
+        return invalid("listener bindHost must be loopback or private");
+    }
+    Ok(())
+}
+
+fn is_unique_local(ip: Ipv6Addr) -> bool {
+    ip.octets()[0] & 0xfe == 0xfc
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum TlsTermination {
+    OperatorControlledUpstream,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct AuthenticationConfig {
+    pub kind: AuthenticationKind,
+    pub issuer: String,
+    pub audiences: Vec<String>,
+    pub token_types: Vec<AccessTokenType>,
+    pub algorithms: Vec<AccessTokenAlgorithm>,
+    pub jwks_uri: String,
+    pub principal_claim: String,
+    pub requester_tags_claim: String,
+    pub evidence_audience_claim: String,
+    pub grant_id_claim: String,
+    pub grant_authority_claim: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub actor_claim: Option<String>,
+}
+
+impl AuthenticationConfig {
+    fn validate(&self, assurance_profile: AssuranceProfile) -> Result<(), ConfigError> {
+        let issuer = Url::parse(&self.issuer)
+            .map_err(|_| ConfigError::Invalid("authentication issuer is invalid"))?;
+        let jwks_uri = Url::parse(&self.jwks_uri)
+            .map_err(|_| ConfigError::Invalid("authentication JWKS URI is invalid"))?;
+        if issuer.scheme() == "http" || jwks_uri.scheme() == "http" {
+            if assurance_profile != AssuranceProfile::Local {
+                return invalid("production and evidence-grade authentication requires HTTPS");
+            }
+            let origin = validate_local_mint_origin(&self.issuer)?;
+            if self.jwks_uri != format!("{origin}{LOCAL_MINT_JWKS_PATH}") {
+                return invalid(
+                    "local authentication JWKS URI must use the issuer origin and Mint JWKS path",
+                );
+            }
+        } else {
+            validate_https_issuer(&self.issuer)?;
+            validate_https_url(&self.jwks_uri, false)?;
+        }
+        validate_unique_strings(&self.audiences, 1, 16, 1, 512, "authentication audiences")?;
+        validate_unique(&self.token_types, 1, 4, "authentication tokenTypes")?;
+        validate_unique(&self.algorithms, 1, 3, "authentication algorithms")?;
+        // Ordered principal first, because `sub` is legitimate for that claim
+        // alone and the shadowing check below reads the rest of the list.
+        let claims = [
+            Some(&self.principal_claim),
+            Some(&self.requester_tags_claim),
+            Some(&self.evidence_audience_claim),
+            Some(&self.grant_id_claim),
+            Some(&self.grant_authority_claim),
+            self.actor_claim.as_ref(),
+        ]
+        .into_iter()
+        .flatten()
+        .collect::<Vec<_>>();
+        for claim in &claims {
+            validate_claim_name(claim)?;
+        }
+        // Two claims naming one member means the same value is read as two
+        // different things: requester tags read as a principal, or a grant id
+        // read as the authority that granted it.
+        if claims.iter().collect::<BTreeSet<_>>().len() != claims.len() {
+            return invalid("authority claim names must be distinct");
+        }
+        // These are defined by the token itself, so reading authority out of one
+        // reads something the issuer wrote for another purpose. `aud` is the
+        // sharpest: Evidence validates it against its own configured audiences,
+        // so a grant authority read from `aud` is Evidence's own name.
+        //
+        // `sub` is the exception, and only for the principal. It carries the
+        // principal already, so naming it there reads the same value; naming it
+        // anywhere else reads the principal as something it is not.
+        if claims
+            .iter()
+            .any(|claim| REGISTERED_JWT_CLAIMS.contains(&claim.as_str()))
+            || claims.iter().skip(1).any(|claim| claim.as_str() == "sub")
+        {
+            return invalid("authority claim names must not shadow registered JWT claims");
+        }
+        Ok(())
+    }
+
+    pub(crate) fn uses_local_mint_http(&self, assurance_profile: AssuranceProfile) -> bool {
+        assurance_profile == AssuranceProfile::Local
+            && validate_local_mint_origin(&self.issuer).is_ok()
+            && self.jwks_uri == format!("{}{}", self.issuer, LOCAL_MINT_JWKS_PATH)
+    }
+}
+
+/// Registered JWT claims no authority claim may be read from. `sub` is handled
+/// separately, because the principal claim may legitimately name it.
+///
+/// Mint refuses to write these when it mints. Evidence refuses to read them,
+/// which is the check that still applies when the issuer is not Mint.
+const REGISTERED_JWT_CLAIMS: [&str; 7] = ["iss", "aud", "exp", "iat", "nbf", "jti", "client_id"];
+
+const LOCAL_MINT_JWKS_PATH: &str = "/.well-known/jwks.json";
+
+fn validate_local_mint_origin(value: &str) -> Result<&str, ConfigError> {
+    let port = value
+        .strip_prefix("http://127.0.0.1:")
+        .filter(|port| !port.is_empty() && port.bytes().all(|byte| byte.is_ascii_digit()))
+        .filter(|port| !port.starts_with('0'))
+        .and_then(|port| port.parse::<u16>().ok())
+        .filter(|port| *port != 0)
+        .ok_or(ConfigError::Invalid(
+            "local authentication issuer must be a canonical 127.0.0.1 HTTP origin with an explicit non-zero port",
+        ))?;
+    if value != format!("http://127.0.0.1:{port}") {
+        return invalid(
+            "local authentication issuer must be a canonical 127.0.0.1 HTTP origin with an explicit non-zero port",
+        );
+    }
+    Ok(value)
+}
+
+#[derive(Debug, Clone, Copy, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum AuthenticationKind {
+    OidcAccessToken,
+}
+
+#[derive(Debug, Clone, Copy, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
+pub enum AccessTokenType {
+    #[serde(rename = "at+jwt")]
+    AtJwt,
+    #[serde(rename = "application/at+jwt")]
+    ApplicationAtJwt,
+}
+
+#[derive(Debug, Clone, Copy, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
+pub enum AccessTokenAlgorithm {
+    EdDSA,
+    ES256,
+    RS256,
+}
+
+#[derive(Debug, Clone, Copy, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum SecretProvider {
+    Environment,
+    File,
+}
+
+#[derive(Clone, Eq, Ord, PartialEq, PartialOrd, Hash)]
+pub struct SecretRef(String);
+
+impl SecretRef {
+    pub fn parse(value: &str) -> Result<Self, ConfigError> {
+        if let Some(name) = value.strip_prefix("secret:file/") {
+            if valid_file_secret_name(name) {
+                return Ok(Self(value.to_owned()));
+            }
+        }
+        invalid("secret reference does not use an exact permitted grammar")
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    pub fn provider(&self) -> SecretProvider {
+        SecretProvider::File
+    }
+}
+
+impl fmt::Debug for SecretRef {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.debug_tuple("SecretRef").field(&self.0).finish()
+    }
+}
+
+impl<'de> Deserialize<'de> for SecretRef {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let value = String::deserialize(deserializer)?;
+        Self::parse(&value).map_err(de::Error::custom)
+    }
+}
+
+impl Serialize for SecretRef {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        serializer.serialize_str(&self.0)
+    }
+}
+
+fn valid_file_secret_name(name: &str) -> bool {
+    let bytes = name.as_bytes();
+    matches!(bytes.first(), Some(b'a'..=b'z'))
+        && bytes.len() <= 128
+        && bytes[1..].iter().all(|byte| {
+            byte.is_ascii_lowercase() || byte.is_ascii_digit() || matches!(byte, b'.' | b'_' | b'-')
+        })
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct AuditConfig {
+    pub format: AuditFormat,
+    pub hash_secret_ref: SecretRef,
+    pub hash_key_version: u32,
+    pub fail_closed: bool,
+}
+
+impl AuditConfig {
+    fn validate(&self) -> Result<(), ConfigError> {
+        if self.hash_key_version == 0 || !self.fail_closed {
+            return invalid("audit must be versioned and fail closed");
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum AuditFormat {
+    KeyedJsonl,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct SubjectBindingConfig {
+    pub secret_ref: SecretRef,
+    pub key_version: u32,
+}
+
+impl SubjectBindingConfig {
+    fn validate(&self) -> Result<(), ConfigError> {
+        if self.key_version == 0 {
+            return invalid("subject binding keyVersion must be positive");
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct RateLimitConfig {
+    pub requests_per_principal_per_minute: u64,
+    pub burst_per_principal: u64,
+    pub failed_selector_attempts_per_principal_authority_per_minute: u64,
+}
+
+impl RateLimitConfig {
+    fn validate(&self) -> Result<(), ConfigError> {
+        validate_range(
+            self.requests_per_principal_per_minute,
+            1,
+            1_000_000,
+            "request rate limit",
+        )?;
+        validate_range(self.burst_per_principal, 1, 100_000, "burst rate limit")?;
+        validate_range(
+            self.failed_selector_attempts_per_principal_authority_per_minute,
+            1,
+            100_000,
+            "failed-selector rate limit",
+        )
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct SigningConfig {
+    pub format: SigningFormat,
+    pub algorithm: SigningAlgorithm,
+    pub active_key_id: String,
+    pub active_key_ref: SecretRef,
+    pub retired_public_jwk_files: Vec<PublicJwkPath>,
+    pub jwks_path: String,
+    pub maximum_assertion_validity_seconds: u64,
+    pub verifier_clock_skew_seconds: u64,
+}
+
+impl SigningConfig {
+    fn validate(&self) -> Result<(), ConfigError> {
+        validate_string(&self.active_key_id, 1, 256, "active signing key id")?;
+        if self.active_key_id.chars().any(char::is_control) {
+            return invalid("active signing key id contains a control character");
+        }
+        validate_unique(
+            &self.retired_public_jwk_files,
+            0,
+            32,
+            "retired public JWK paths",
+        )?;
+        if self.jwks_path != "/.well-known/evidence/jwks.json" {
+            return invalid("JWKS path is not the Version 1 discovery path");
+        }
+        validate_range(
+            self.maximum_assertion_validity_seconds,
+            1,
+            31_536_000,
+            "maximum assertion validity",
+        )?;
+        validate_range(
+            self.verifier_clock_skew_seconds,
+            0,
+            600,
+            "verifier clock skew",
+        )
+    }
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum SigningFormat {
+    FlattenedJwsJson,
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+pub enum SigningAlgorithm {
+    EdDSA,
+}
+
+#[derive(Clone, Eq, Ord, PartialEq, PartialOrd, Hash)]
+pub struct PublicJwkPath(String);
+
+impl PublicJwkPath {
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl fmt::Debug for PublicJwkPath {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_tuple("PublicJwkPath")
+            .field(&self.0)
+            .finish()
+    }
+}
+
+impl<'de> Deserialize<'de> for PublicJwkPath {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let value = String::deserialize(deserializer)?;
+        if is_public_jwk_path(&value) {
+            Ok(Self(value))
+        } else {
+            Err(de::Error::custom("invalid public JWK path"))
+        }
+    }
+}
+
+impl Serialize for PublicJwkPath {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        serializer.serialize_str(&self.0)
+    }
+}
+
+fn is_public_jwk_path(value: &str) -> bool {
+    let Some(name) = value.strip_prefix("public-keys/") else {
+        return false;
+    };
+    let Some(stem) = name.strip_suffix(".jwk.json") else {
+        return false;
+    };
+    !stem.is_empty()
+        && stem
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-'))
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct SelectorProfile {
+    pub maximum_aggregate_bytes: u64,
+    pub fields: OrderedMap<SelectorField>,
+}
+
+impl SelectorProfile {
+    fn validate(&self) -> Result<(), ConfigError> {
+        validate_range(
+            self.maximum_aggregate_bytes,
+            1,
+            8_192,
+            "selector maximumAggregateBytes",
+        )?;
+        validate_len(self.fields.len(), 1, 16, "selector fields")?;
+        for (name, field) in self.fields.iter() {
+            if !valid_field_name(name) {
+                return invalid("selector field name is invalid");
+            }
+            field.validate(self.maximum_aggregate_bytes)?;
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(tag = "type", rename_all = "kebab-case", deny_unknown_fields)]
+pub enum SelectorField {
+    String {
+        #[serde(rename = "minimumBytes")]
+        minimum_bytes: u64,
+        #[serde(rename = "maximumBytes")]
+        maximum_bytes: u64,
+    },
+    Date,
+    Integer {
+        minimum: i64,
+        maximum: i64,
+    },
+    Boolean,
+    ControlledCode {
+        codelist: ArtifactPath,
+        #[serde(rename = "codelistVersion")]
+        codelist_version: String,
+        #[serde(rename = "maximumBytes")]
+        maximum_bytes: u64,
+    },
+}
+
+impl SelectorField {
+    fn validate(&self, aggregate_maximum: u64) -> Result<(), ConfigError> {
+        match self {
+            Self::String {
+                minimum_bytes,
+                maximum_bytes,
+            } => {
+                validate_range(*minimum_bytes, 1, 8_192, "selector string minimumBytes")?;
+                validate_range(*maximum_bytes, 1, 8_192, "selector string maximumBytes")?;
+                if minimum_bytes > maximum_bytes || maximum_bytes > &aggregate_maximum {
+                    return invalid("selector string byte bounds are inconsistent");
+                }
+            }
+            Self::Integer { minimum, maximum } => {
+                if minimum > maximum || *minimum < -MAX_SAFE_INTEGER || *maximum > MAX_SAFE_INTEGER
+                {
+                    return invalid("selector integer bounds are inconsistent");
+                }
+            }
+            Self::ControlledCode {
+                codelist,
+                codelist_version,
+                maximum_bytes,
+            } => {
+                require_artifact_prefix(codelist, "codelists/")?;
+                validate_string(codelist_version, 1, 128, "selector codelist version")?;
+                validate_range(*maximum_bytes, 1, 8_192, "selector code maximumBytes")?;
+                if maximum_bytes > &aggregate_maximum {
+                    return invalid("selector code exceeds aggregate byte bound");
+                }
+            }
+            Self::Date | Self::Boolean => {}
+        }
+        Ok(())
+    }
+}
+
+#[derive(Clone, Eq, Ord, PartialEq, PartialOrd, Hash)]
+pub struct ArtifactPath(String);
+
+impl ArtifactPath {
+    pub fn parse(value: &str) -> Result<Self, ConfigError> {
+        if !valid_artifact_path(value) {
+            return invalid("artifact path is invalid");
+        }
+        Ok(Self(value.to_owned()))
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl fmt::Debug for ArtifactPath {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_tuple("ArtifactPath")
+            .field(&self.0)
+            .finish()
+    }
+}
+
+impl<'de> Deserialize<'de> for ArtifactPath {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let value = String::deserialize(deserializer)?;
+        Self::parse(&value).map_err(de::Error::custom)
+    }
+}
+
+impl Serialize for ArtifactPath {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        serializer.serialize_str(&self.0)
+    }
+}
+
+fn valid_artifact_path(value: &str) -> bool {
+    const ROOTS: [&str; 5] = [
+        "adapters/",
+        "derivations/",
+        "schemas/",
+        "codelists/",
+        "fixtures/",
+    ];
+    ROOTS.iter().any(|root| value.starts_with(root))
+        && !value.starts_with('/')
+        && !value.contains('\\')
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'/' | b'-'))
+        && Path::new(value)
+            .components()
+            .all(|component| matches!(component, Component::Normal(_)))
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct SourceConfig {
+    pub transport: SourceTransport,
+    pub base_url: String,
+    pub posture: AcquisitionPosture,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub tls_trust_profile: Option<String>,
+    pub authentication: SourceAuthentication,
+    pub request: FixedRequest,
+    /// Shape contract for the projected response, validated by Rust before
+    /// extraction runs, so the script maps a response it can rely on.
+    pub response_schema: ArtifactPath,
+    pub extract_script: ArtifactPath,
+    pub fact_schema: ArtifactPath,
+}
+
+impl SourceConfig {
+    fn validate(&self, assurance_profile: AssuranceProfile) -> Result<(), ConfigError> {
+        validate_source_origin(&self.base_url)?;
+        if self
+            .tls_trust_profile
+            .as_deref()
+            .is_some_and(|profile| !valid_local_id(profile))
+        {
+            return invalid("source TLS trust profile identifier is invalid");
+        }
+        if matches!(self.authentication, SourceAuthentication::None {}) {
+            if assurance_profile != AssuranceProfile::Local {
+                return invalid(
+                    "unauthenticated sources are permitted only by the local assurance profile",
+                );
+            }
+            validate_local_unauthenticated_source_origin(&self.base_url)?;
+            if self.tls_trust_profile.is_some() {
+                return invalid(
+                    "an unauthenticated local HTTP source cannot use a TLS trust profile",
+                );
+            }
+        }
+        self.authentication.validate()?;
+        self.request.validate()?;
+        require_artifact_prefix(&self.extract_script, "adapters/")?;
+        if !self.extract_script.as_str().ends_with(".rhai") {
+            return invalid("source extraction script must be a Rhai file");
+        }
+        let adapter_id = Path::new(self.extract_script.as_str())
+            .file_stem()
+            .and_then(|value| value.to_str())
+            .filter(|value| valid_local_id(value))
+            .ok_or(ConfigError::Invalid(
+                "source adapter name must be a local identifier",
+            ))?;
+        debug_assert!(!adapter_id.is_empty());
+        require_artifact_prefix(&self.response_schema, "schemas/")?;
+        require_artifact_prefix(&self.fact_schema, "schemas/")?;
+        let roles = [
+            self.response_schema.as_str(),
+            self.fact_schema.as_str(),
+            self.request.adapter_parameters_schema.as_str(),
+        ];
+        let distinct = roles.iter().collect::<BTreeSet<_>>();
+        if distinct.len() != roles.len() {
+            return invalid("source schema roles must be distinct artifacts");
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum SourceTransport {
+    HttpJson,
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum AcquisitionPosture {
+    SourceDerived,
+    FieldProjected,
+    RecordTransformed,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(tag = "kind", rename_all = "kebab-case", deny_unknown_fields)]
+pub enum SourceAuthentication {
+    /// No outbound credential is sent.
+    ///
+    /// The containing bundle validator admits this only for the local
+    /// assurance profile and a canonical numeric-loopback HTTP origin with an
+    /// explicit non-zero port. It is not a production authentication mode.
+    None {},
+    Basic {
+        #[serde(rename = "usernameRef")]
+        username_ref: SecretRef,
+        #[serde(rename = "passwordRef")]
+        password_ref: SecretRef,
+    },
+    StaticBearer {
+        #[serde(rename = "tokenRef")]
+        token_ref: SecretRef,
+    },
+    StaticApiKey {
+        #[serde(rename = "headerName")]
+        header_name: String,
+        #[serde(rename = "valueRef")]
+        value_ref: SecretRef,
+    },
+    Oauth2ClientCredentials {
+        #[serde(rename = "tokenEndpoint")]
+        token_endpoint: String,
+        #[serde(rename = "clientIdRef")]
+        client_id_ref: SecretRef,
+        #[serde(rename = "clientSecretRef")]
+        client_secret_ref: SecretRef,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        scope: Option<String>,
+        #[serde(rename = "credentialPlacement")]
+        credential_placement: CredentialPlacement,
+        #[serde(rename = "maximumCacheSeconds")]
+        maximum_cache_seconds: u64,
+        /// Lifetime assumed when the provider omits `expires_in`.
+        ///
+        /// RFC 6749 section 5.1 makes `expires_in` recommended rather than
+        /// required, so a compliant provider may return only `access_token`
+        /// and `token_type`. The operator states the lifetime here rather than
+        /// the runtime inferring one from the token, and the cache is still
+        /// clamped to `maximumCacheSeconds`.
+        #[serde(
+            rename = "assumedLifetimeSeconds",
+            default,
+            skip_serializing_if = "Option::is_none"
+        )]
+        assumed_lifetime_seconds: Option<u64>,
+    },
+}
+
+impl SourceAuthentication {
+    fn validate(&self) -> Result<(), ConfigError> {
+        match self {
+            Self::None {} => Ok(()),
+            Self::Basic {
+                username_ref: _,
+                password_ref: _,
+            }
+            | Self::StaticBearer { token_ref: _ } => Ok(()),
+            Self::StaticApiKey {
+                header_name,
+                value_ref: _,
+            } => validate_configurable_header_name(header_name),
+            Self::Oauth2ClientCredentials {
+                token_endpoint,
+                scope,
+                maximum_cache_seconds,
+                assumed_lifetime_seconds,
+                ..
+            } => {
+                let token_endpoint = validate_source_url(token_endpoint, false)?;
+                if token_endpoint.query().is_some() {
+                    return invalid("OAuth token endpoint must not contain a query");
+                }
+                if let Some(scope) = scope {
+                    validate_string(scope, 1, 512, "OAuth scope")?;
+                }
+                if let Some(assumed_lifetime_seconds) = assumed_lifetime_seconds {
+                    validate_range(
+                        *assumed_lifetime_seconds,
+                        1,
+                        86_400,
+                        "OAuth assumed token lifetime",
+                    )?;
+                }
+                validate_range(
+                    *maximum_cache_seconds,
+                    0,
+                    86_400,
+                    "OAuth maximum cache lifetime",
+                )
+            }
+        }
+    }
+
+    pub fn secret_refs(&self) -> Vec<&SecretRef> {
+        match self {
+            Self::None {} => Vec::new(),
+            Self::Basic {
+                username_ref,
+                password_ref,
+            } => vec![username_ref, password_ref],
+            Self::StaticBearer { token_ref } => vec![token_ref],
+            Self::StaticApiKey { value_ref, .. } => vec![value_ref],
+            Self::Oauth2ClientCredentials {
+                client_id_ref,
+                client_secret_ref,
+                ..
+            } => vec![client_id_ref, client_secret_ref],
+        }
+    }
+}
+
+/// Where the token request carries the client credentials.
+///
+/// RFC 6749 section 2.3.1 defines Basic authentication and the request-body
+/// parameters and states that those parameters must not be placed in the
+/// request URI, so Version 1 offers no query-string placement.
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum CredentialPlacement {
+    BasicHeader,
+    FormBody,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct FixedRequest {
+    pub method: HttpMethod,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub path: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub path_template: Option<String>,
+    #[serde(default, skip_serializing_if = "OrderedMap::is_empty")]
+    pub path_bindings: OrderedMap<PathBindingConfig>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub fixed_headers: Vec<FixedHeader>,
+    pub selector_inputs: Vec<SelectorInput>,
+    pub prepare_script: ArtifactPath,
+    pub adapter_parameters: OrderedMap<AdapterParameterValue>,
+    pub adapter_parameters_schema: ArtifactPath,
+    pub preparation_limits: PreparationLimits,
+    pub projection: Vec<String>,
+    pub redirects: RedirectPolicy,
+    pub timeout_milliseconds: u64,
+    pub maximum_response_bytes: u64,
+    pub concurrency_limit: u16,
+}
+
+impl FixedRequest {
+    fn validate(&self) -> Result<(), ConfigError> {
+        match (&self.path, &self.path_template) {
+            (Some(path), None) => {
+                validate_normalized_request_path(path)?;
+                if !self.path_bindings.is_empty() {
+                    return invalid("fixed source path must not define pathBindings");
+                }
+            }
+            (None, Some(template)) => validate_path_template(template, &self.path_bindings)?,
+            _ => return invalid("source request must define exactly one of path or pathTemplate"),
+        }
+        validate_fixed_headers(&self.fixed_headers)?;
+        validate_selector_inputs(&self.selector_inputs)?;
+        require_artifact_prefix(&self.prepare_script, "adapters/")?;
+        if !self.prepare_script.as_str().ends_with(".rhai") {
+            return invalid("source preparation script must be a Rhai file");
+        }
+        validate_len(self.adapter_parameters.len(), 0, 64, "adapter parameters")?;
+        for (name, value) in self.adapter_parameters.iter() {
+            if !valid_parameter_key(name) {
+                return invalid("adapter parameter name is invalid");
+            }
+            value.validate(0)?;
+        }
+        require_artifact_prefix(&self.adapter_parameters_schema, "schemas/")?;
+        self.preparation_limits.validate()?;
+        if self.method == HttpMethod::GET
+            && self.preparation_limits.json_body != PreparationChannelPolicy::Forbidden
+        {
+            return invalid("GET source requests must forbid the JSON body channel");
+        }
+        validate_projection(&self.projection)?;
+        validate_range(self.timeout_milliseconds, 1, 30_000, "source timeout")?;
+        validate_range(
+            self.maximum_response_bytes,
+            1,
+            1_048_576,
+            "source response size",
+        )?;
+        validate_range(
+            u64::from(self.concurrency_limit),
+            1,
+            256,
+            "source concurrency",
+        )?;
+
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+pub enum HttpMethod {
+    GET,
+    POST,
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum RedirectPolicy {
+    Deny,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct FixedHeader {
+    pub name: String,
+    pub value: String,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct SelectorInput {
+    pub role: String,
+    pub alternatives: Vec<SelectorInputAlternative>,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct SelectorInputAlternative {
+    pub profile: String,
+    pub fields: Vec<String>,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct PathBindingConfig {
+    pub role: String,
+    pub profile: String,
+    pub field: String,
+}
+
+impl PathBindingConfig {
+    fn validate(&self) -> Result<(), ConfigError> {
+        if !valid_local_id(&self.role)
+            || !valid_local_id(&self.profile)
+            || !valid_field_name(&self.field)
+        {
+            return invalid("source selector binding identifier is invalid");
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(untagged)]
+pub enum AdapterParameterValue {
+    Boolean(bool),
+    Integer(i64),
+    String(String),
+    Array(Vec<AdapterParameterValue>),
+    Object(OrderedMap<AdapterParameterValue>),
+}
+
+impl AdapterParameterValue {
+    fn validate(&self, depth: usize) -> Result<(), ConfigError> {
+        if depth > 32 {
+            return invalid("adapter parameter nesting exceeds Version 1 bounds");
+        }
+        match self {
+            Self::Boolean(_) | Self::Integer(_) => Ok(()),
+            Self::String(value) => validate_string(value, 0, 16_384, "adapter parameter string"),
+            Self::Array(values) => {
+                validate_len(values.len(), 0, 256, "adapter parameter array")?;
+                for value in values {
+                    value.validate(depth + 1)?;
+                }
+                Ok(())
+            }
+            Self::Object(values) => {
+                validate_len(values.len(), 0, 256, "adapter parameter object")?;
+                for (name, value) in values.iter() {
+                    if !valid_parameter_key(name) {
+                        return invalid("adapter parameter object key is invalid");
+                    }
+                    value.validate(depth + 1)?;
+                }
+                Ok(())
+            }
+        }
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct PreparationLimits {
+    pub query: PreparationChannelPolicy,
+    pub json_body: PreparationChannelPolicy,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub maximum_query_pairs: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub maximum_query_name_bytes: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub maximum_query_value_bytes: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub maximum_json_depth: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub maximum_collection_items: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub maximum_string_bytes: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub maximum_normalized_bytes: Option<u64>,
+}
+
+impl PreparationLimits {
+    fn validate(&self) -> Result<(), ConfigError> {
+        if self.query == PreparationChannelPolicy::Forbidden
+            && self.json_body == PreparationChannelPolicy::Forbidden
+        {
+            return invalid("at least one preparation output channel must be usable");
+        }
+        validate_optional_range(self.maximum_query_pairs, 1, 64)?;
+        validate_optional_range(self.maximum_query_name_bytes, 1, 64)?;
+        validate_optional_range(self.maximum_query_value_bytes, 1, 4_096)?;
+        validate_optional_range(self.maximum_json_depth, 1, 32)?;
+        validate_optional_range(self.maximum_collection_items, 1, 256)?;
+        validate_optional_range(self.maximum_string_bytes, 1, 16_384)?;
+        validate_optional_range(self.maximum_normalized_bytes, 1, 65_536)
+    }
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum PreparationChannelPolicy {
+    Required,
+    Allowed,
+    Forbidden,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct AuthorityProfile {
+    pub kind: AuthorityKind,
+    pub requester_tags: Vec<String>,
+    pub grants: Vec<AuthorityGrant>,
+}
+
+impl AuthorityProfile {
+    fn validate(&self) -> Result<(), ConfigError> {
+        validate_unique_strings(&self.requester_tags, 1, 32, 1, 128, "requester tags")?;
+        if self.requester_tags.iter().any(|tag| !valid_local_id(tag)) {
+            return invalid("requester tag is invalid");
+        }
+        validate_len(self.grants.len(), 1, 128, "authority grants")?;
+        for grant in &self.grants {
+            grant.validate()?;
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum AuthorityKind {
+    Statutory,
+    Organizational,
+    Consent,
+    Delegated,
+    ExplicitRequest,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct AuthorityGrant {
+    pub requirement: String,
+    pub purpose: String,
+    pub audience_from: AudienceFrom,
+    /// Closed response formats this complete grant permits. Selection through
+    /// the API creates no permission; the bundle formats and this grant must
+    /// both allow the requested format. Formats are never unioned across
+    /// grants.
+    #[serde(default = "default_response_formats")]
+    pub response_formats: Vec<ResponseFormat>,
+    pub subjects: Vec<GrantedSubject>,
+}
+
+impl AuthorityGrant {
+    fn validate(&self) -> Result<(), ConfigError> {
+        validate_uri(&self.requirement)?;
+        validate_purpose(&self.purpose)?;
+        validate_response_formats(&self.response_formats, "authority grant response formats")?;
+        validate_len(self.subjects.len(), 1, 8, "authority grant subjects")
+    }
+}
+
+/// Closed Version 1 response-format vocabulary.
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum ResponseFormat {
+    SignedJws,
+    UnsignedJson,
+    /// Audience-scoped SD-JWT VC serialization of the same assertion.
+    SdJwtVc,
+}
+
+fn default_response_formats() -> Vec<ResponseFormat> {
+    vec![ResponseFormat::SignedJws]
+}
+
+fn validate_response_formats(
+    formats: &[ResponseFormat],
+    description: &'static str,
+) -> Result<(), ConfigError> {
+    validate_len(formats.len(), 1, 3, description)?;
+    let mut seen = BTreeSet::new();
+    for format in formats {
+        if !seen.insert(format_discriminant(*format)) {
+            return invalid("response formats must be unique");
+        }
+    }
+    if !formats.contains(&ResponseFormat::SignedJws) {
+        return invalid("signed JWS must remain an enabled response format");
+    }
+    Ok(())
+}
+
+fn format_discriminant(format: ResponseFormat) -> u8 {
+    match format {
+        ResponseFormat::SignedJws => 0,
+        ResponseFormat::UnsignedJson => 1,
+        ResponseFormat::SdJwtVc => 2,
+    }
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum AudienceFrom {
+    AuthenticatedRequester,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct GrantedSubject {
+    pub role: String,
+    pub selector_profile: String,
+    pub value_origin: ValueOrigin,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub value_claims: Option<OrderedMap<String>>,
+}
+
+impl GrantedSubject {
+    fn validate_value_claims(&self, profile: &SelectorProfile) -> Result<(), ConfigError> {
+        if !valid_local_id(&self.role) || !valid_local_id(&self.selector_profile) {
+            return invalid("authority subject identifier is invalid");
+        }
+        match self.value_origin {
+            ValueOrigin::Request => {
+                if self.value_claims.is_some() {
+                    return invalid("request-derived subject must not define valueClaims");
+                }
+            }
+            ValueOrigin::AuthenticatedContext | ValueOrigin::AuthenticatedGrant => {
+                let claims = self.value_claims.as_ref().ok_or(ConfigError::Invalid(
+                    "context-derived subject requires valueClaims",
+                ))?;
+                if claims.len() != profile.fields.len()
+                    || profile
+                        .fields
+                        .keys()
+                        .any(|field| !claims.contains_key(field))
+                    || claims
+                        .keys()
+                        .any(|field| !profile.fields.contains_key(field))
+                {
+                    return invalid("valueClaims must exactly equal selector profile fields");
+                }
+                let mut targets = BTreeSet::new();
+                for (_, claim) in claims.iter() {
+                    validate_claim_path(claim)?;
+                    if !targets.insert(claim.as_str()) {
+                        return invalid("valueClaims targets must be unique");
+                    }
+                }
+            }
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum ValueOrigin {
+    AuthenticatedContext,
+    AuthenticatedGrant,
+    Request,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct RequirementConfig {
+    pub id: String,
+    pub kind: RequirementKind,
+    pub source: String,
+    pub purposes: Vec<String>,
+    pub subject_roles: Vec<SubjectRole>,
+    pub reference_frameworks: Vec<String>,
+    pub evidence_type: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub observation_timezone: Option<String>,
+    pub validity_seconds: u64,
+    pub derivation: DerivationConfig,
+    pub concepts: Vec<ConceptConfig>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub fixtures: Option<ArtifactPath>,
+    pub disclosure_guard: DisclosureGuard,
+    pub existence_disclosure: ExistenceDisclosure,
+}
+
+impl RequirementConfig {
+    fn validate(&self) -> Result<(), ConfigError> {
+        validate_uri(&self.id)?;
+        if !valid_local_id(&self.source) {
+            return invalid("requirement source identifier is invalid");
+        }
+        validate_unique_strings(&self.purposes, 1, 32, 1, 128, "requirement purposes")?;
+        for purpose in &self.purposes {
+            validate_purpose(purpose)?;
+        }
+        validate_len(self.subject_roles.len(), 1, 8, "requirement subject roles")?;
+        let mut roles = BTreeSet::new();
+        for role in &self.subject_roles {
+            role.validate()?;
+            if !roles.insert(role.role.as_str()) {
+                return invalid("requirement subject roles must be unique");
+            }
+        }
+        validate_unique_strings(
+            &self.reference_frameworks,
+            1,
+            16,
+            1,
+            512,
+            "reference frameworks",
+        )?;
+        for reference in &self.reference_frameworks {
+            validate_uri(reference)?;
+        }
+        validate_uri(&self.evidence_type)?;
+        if let Some(timezone) = &self.observation_timezone {
+            validate_string(timezone, 1, 128, "observation timezone")?;
+            chrono_tz::Tz::from_str(timezone).map_err(|_| {
+                ConfigError::Invalid("observation timezone is not an IANA timezone")
+            })?;
+        }
+        validate_range(self.validity_seconds, 1, 31_536_000, "requirement validity")?;
+        self.derivation.validate()?;
+        validate_len(self.concepts.len(), 1, 16, "requirement concepts")?;
+        let mut concepts = BTreeSet::new();
+        let mut sd_jwt_claims = BTreeSet::new();
+        for concept in &self.concepts {
+            concept.validate()?;
+            if !concepts.insert(concept.id.as_str()) {
+                return invalid("requirement concepts must be unique");
+            }
+            if let Some(projection) = &concept.sd_jwt_vc {
+                if !sd_jwt_claims.insert(projection.claim.as_str()) {
+                    return invalid("requirement SD-JWT VC claim names must be unique");
+                }
+            }
+        }
+        if let Some(fixtures) = &self.fixtures {
+            require_artifact_prefix(fixtures, "fixtures/")?;
+        }
+        self.disclosure_guard.validate()
+    }
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum RequirementKind {
+    Criterion,
+    InformationRequirement,
+    Constraint,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct SubjectRole {
+    pub role: String,
+    pub cardinality: SubjectCardinality,
+    pub selector_profiles: Vec<String>,
+}
+
+impl SubjectRole {
+    fn validate(&self) -> Result<(), ConfigError> {
+        if !valid_local_id(&self.role) {
+            return invalid("subject role identifier is invalid");
+        }
+        validate_unique_strings(
+            &self.selector_profiles,
+            1,
+            16,
+            1,
+            128,
+            "role selector profiles",
+        )?;
+        if self
+            .selector_profiles
+            .iter()
+            .any(|profile| !valid_local_id(profile))
+        {
+            return invalid("role selector profile identifier is invalid");
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum SubjectCardinality {
+    One,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct DerivationConfig {
+    pub script: ArtifactPath,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub selector_inputs: Vec<SelectorInput>,
+    pub parameters: OrderedMap<ParameterValue>,
+}
+
+impl DerivationConfig {
+    fn validate(&self) -> Result<(), ConfigError> {
+        require_artifact_prefix(&self.script, "derivations/")?;
+        if !self.script.as_str().ends_with(".rhai") {
+            return invalid("derivation script must be a Rhai file");
+        }
+        validate_derivation_input_shape(&self.selector_inputs)?;
+        validate_len(self.parameters.len(), 0, 32, "derivation parameters")?;
+        for (name, value) in self.parameters.iter() {
+            if !valid_field_name(name) {
+                return invalid("derivation parameter name is invalid");
+            }
+            value.validate()?;
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(untagged)]
+pub enum ParameterValue {
+    String(String),
+    Integer(i64),
+    Boolean(bool),
+    Decimal(DecimalValue),
+    BucketBoundaries(Vec<BucketBoundary>),
+}
+
+impl ParameterValue {
+    fn validate(&self) -> Result<(), ConfigError> {
+        match self {
+            Self::String(value) => validate_string(value, 0, 1_024, "derivation string parameter"),
+            Self::Integer(value) => {
+                if value.unsigned_abs() > MAX_SAFE_INTEGER as u64 {
+                    invalid("derivation integer parameter exceeds safe bounds")
+                } else {
+                    Ok(())
+                }
+            }
+            Self::Boolean(_) => Ok(()),
+            Self::Decimal(value) => value.validate(),
+            Self::BucketBoundaries(boundaries) => validate_bucket_boundaries(boundaries),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct DecimalValue {
+    #[serde(rename = "type")]
+    pub value_type: DecimalMarker,
+    pub value: String,
+}
+
+impl DecimalValue {
+    fn validate(&self) -> Result<(), ConfigError> {
+        validate_decimal(&self.value)
+    }
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum DecimalMarker {
+    Decimal,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct BucketBoundary {
+    pub minimum_inclusive: DecimalValue,
+    pub maximum_exclusive: DecimalValue,
+    pub code: String,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ConceptConfig {
+    pub id: String,
+    pub form: ConceptForm,
+    pub required: bool,
+    #[serde(default)]
+    pub constraints: OrderedMap<YamlValue>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub sd_jwt_vc: Option<SdJwtVcConceptProjection>,
+}
+
+impl ConceptConfig {
+    fn validate(&self) -> Result<(), ConfigError> {
+        validate_uri(&self.id)?;
+        validate_len(self.constraints.len(), 0, 32, "concept constraints")?;
+        validate_concept_constraints(self)?;
+        if let Some(projection) = &self.sd_jwt_vc {
+            if self.form != ConceptForm::ReviewedStructuredValue {
+                return invalid("SD-JWT VC field projection requires a reviewed structured value");
+            }
+            projection.validate()?;
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct SdJwtVcConceptProjection {
+    pub claim: String,
+    pub disclosure: SdJwtVcDisclosureMode,
+}
+
+impl SdJwtVcConceptProjection {
+    fn validate(&self) -> Result<(), ConfigError> {
+        if !valid_sd_jwt_claim_name(&self.claim) {
+            return invalid("SD-JWT VC structured claim name is invalid");
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum SdJwtVcDisclosureMode {
+    TopLevel,
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum ConceptForm {
+    Boolean,
+    ControlledCode,
+    ControlledCategory,
+    BoundedInteger,
+    BoundedDecimal,
+    DateBucket,
+    TimeBucket,
+    AudienceScopedEntityReference,
+    ControlledCodeList,
+    EntityReferenceList,
+    ReviewedStructuredValue,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct DisclosureGuard {
+    pub families: Vec<String>,
+}
+
+impl DisclosureGuard {
+    fn validate(&self) -> Result<(), ConfigError> {
+        validate_unique_strings(&self.families, 1, 16, 1, 512, "disclosure families")?;
+        for family in &self.families {
+            validate_uri(family)?;
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum ExistenceDisclosure {
+    CollapseUnresolved,
+}
+
+fn validate_named_map<T>(
+    map: &OrderedMap<T>,
+    minimum: usize,
+    maximum: usize,
+    validate: impl Fn(&T) -> Result<(), ConfigError>,
+) -> Result<(), ConfigError> {
+    validate_len(map.len(), minimum, maximum, "named configuration map")?;
+    for (name, value) in map.iter() {
+        if !valid_local_id(name) {
+            return invalid("local identifier is invalid");
+        }
+        validate(value)?;
+    }
+    Ok(())
+}
+
+fn require_artifact_prefix(path: &ArtifactPath, prefix: &'static str) -> Result<(), ConfigError> {
+    if path.as_str().starts_with(prefix) {
+        Ok(())
+    } else {
+        invalid("artifact path has the wrong bundle directory")
+    }
+}
+
+fn validate_selector_inputs(inputs: &[SelectorInput]) -> Result<(), ConfigError> {
+    validate_len(inputs.len(), 1, 8, "source selector inputs")?;
+    validate_derivation_input_shape(inputs)
+}
+
+fn validate_derivation_input_shape(inputs: &[SelectorInput]) -> Result<(), ConfigError> {
+    validate_len(inputs.len(), 0, 8, "selector inputs")?;
+    let mut roles = BTreeSet::new();
+    for input in inputs {
+        if !valid_local_id(&input.role) || !roles.insert(input.role.as_str()) {
+            return invalid("selector-input roles must be valid and unique");
+        }
+        validate_len(
+            input.alternatives.len(),
+            1,
+            16,
+            "selector-input alternatives",
+        )?;
+        let mut profiles = BTreeSet::new();
+        for alternative in &input.alternatives {
+            if !valid_local_id(&alternative.profile)
+                || !profiles.insert(alternative.profile.as_str())
+            {
+                return invalid("selector-input profiles must be valid and unique per role");
+            }
+            validate_unique_strings(&alternative.fields, 1, 16, 1, 64, "selector-input fields")?;
+            if alternative
+                .fields
+                .iter()
+                .any(|field| !valid_field_name(field))
+            {
+                return invalid("selector-input field name is invalid");
+            }
+        }
+    }
+    Ok(())
+}
+
+fn validate_derivation_selector_inputs(
+    requirement: &RequirementConfig,
+    profiles: &OrderedMap<SelectorProfile>,
+) -> Result<(), ConfigError> {
+    for input in &requirement.derivation.selector_inputs {
+        let role = requirement
+            .subject_roles
+            .iter()
+            .find(|role| role.role == input.role)
+            .ok_or(ConfigError::Invalid(
+                "derivation selector input references an unknown requirement role",
+            ))?;
+        for alternative in &input.alternatives {
+            if !role.selector_profiles.contains(&alternative.profile) {
+                return invalid(
+                    "derivation selector input profile is not allowed for the requirement role",
+                );
+            }
+            let profile = profiles
+                .get(&alternative.profile)
+                .ok_or(ConfigError::Invalid(
+                    "derivation selector input references an unknown selector profile",
+                ))?;
+            if alternative
+                .fields
+                .iter()
+                .any(|field| !profile.fields.contains_key(field))
+            {
+                return invalid("derivation selector input references an unknown selector field");
+            }
+        }
+    }
+    Ok(())
+}
+
+fn validate_fixed_headers(headers: &[FixedHeader]) -> Result<(), ConfigError> {
+    validate_len(headers.len(), 0, 32, "fixed headers")?;
+    let mut names = BTreeSet::new();
+    for header in headers {
+        validate_configurable_header_name(&header.name)?;
+        if !names.insert(header.name.to_ascii_lowercase()) {
+            return invalid("fixed header names must be unique ignoring ASCII case");
+        }
+        validate_string(&header.value, 0, 4_096, "fixed header value")?;
+        if header.value.chars().any(char::is_control) {
+            return invalid("fixed header value contains a control character");
+        }
+    }
+    Ok(())
+}
+
+fn validate_configurable_header_name(name: &str) -> Result<(), ConfigError> {
+    if name.is_empty()
+        || name.len() > 64
+        || !name.bytes().all(is_http_token_byte)
+        || is_reserved_header_name(name)
+    {
+        return invalid("configured header name is prohibited");
+    }
+    Ok(())
+}
+
+fn is_http_token_byte(byte: u8) -> bool {
+    byte.is_ascii_alphanumeric()
+        || matches!(
+            byte,
+            b'!' | b'#'
+                | b'$'
+                | b'%'
+                | b'&'
+                | b'\''
+                | b'*'
+                | b'+'
+                | b'-'
+                | b'.'
+                | b'^'
+                | b'_'
+                | b'`'
+                | b'|'
+                | b'~'
+        )
+}
+
+/// The complete closed set of header names no bundle may configure.
+///
+/// Authentication, host and routing, cookie, framing, hop-by-hop, forwarding,
+/// proxy, and tracing headers are owned by Rust or by the operator's network
+/// path. A bundle that could set them could redirect a source request, forge a
+/// client identity, or smuggle a second request past the reviewed contract.
+const RESERVED_HEADER_NAMES: [&str; 38] = [
+    "authorization",
+    "proxy-authorization",
+    "www-authenticate",
+    "proxy-authenticate",
+    "host",
+    "cookie",
+    "set-cookie",
+    "content-length",
+    "content-type",
+    "transfer-encoding",
+    "expect",
+    "connection",
+    "keep-alive",
+    "te",
+    "trailer",
+    "upgrade",
+    "proxy-connection",
+    "forwarded",
+    "via",
+    "x-real-ip",
+    "x-client-ip",
+    "x-cluster-client-ip",
+    "true-client-ip",
+    "cf-connecting-ip",
+    "fastly-client-ip",
+    "x-appengine-user-ip",
+    "x-azure-clientip",
+    "traceparent",
+    "tracestate",
+    "baggage",
+    "b3",
+    "x-cloud-trace-context",
+    "x-request-id",
+    "x-correlation-id",
+    "x-amzn-trace-id",
+    "x-original-url",
+    "x-rewrite-url",
+    "x-original-method",
+];
+
+/// The complete closed set of reserved header-name prefix families.
+///
+/// A prefix family is denied before any exact name so that a new vendor
+/// forwarding or tracing member cannot be configured before this contract
+/// learns its exact name.
+const RESERVED_HEADER_PREFIXES: [&str; 7] = [
+    "x-forwarded-",
+    "proxy-",
+    "sec-",
+    "x-b3-",
+    "x-envoy-",
+    "x-datadog-",
+    "x-http-method",
+];
+
+/// Representative reserved names, case variants, and prefix-family members.
+///
+/// Both the startup configuration contract and the source plan compiler are
+/// tested against this one list, which is how their shared classifier is
+/// proven to be a single closed deny set rather than two drifting copies.
+pub const RESERVED_HEADER_CONTRACT_CASES: [&str; 51] = [
+    "Authorization",
+    "authorization",
+    "AUTHORIZATION",
+    "Proxy-Authorization",
+    "Proxy-Authenticate",
+    "WWW-Authenticate",
+    "Host",
+    "Cookie",
+    "Set-Cookie",
+    "Content-Length",
+    "Content-Type",
+    "Transfer-Encoding",
+    "Expect",
+    "Connection",
+    "Keep-Alive",
+    "TE",
+    "Trailer",
+    "Upgrade",
+    "Proxy-Connection",
+    "Forwarded",
+    "Via",
+    "X-Real-IP",
+    "X-Client-IP",
+    "x-client-ip",
+    "X-Cluster-Client-IP",
+    "True-Client-IP",
+    "true-client-ip",
+    "CF-Connecting-IP",
+    "cf-connecting-ip",
+    "Fastly-Client-IP",
+    "X-Appengine-User-IP",
+    "X-Azure-ClientIP",
+    "TraceParent",
+    "Tracestate",
+    "Baggage",
+    "b3",
+    "B3",
+    "X-Cloud-Trace-Context",
+    "X-Request-ID",
+    "X-Correlation-ID",
+    "X-Amzn-Trace-ID",
+    "X-Original-URL",
+    "X-Rewrite-URL",
+    "X-HTTP-Method-Override",
+    "X-Original-Method",
+    "X-Forwarded-For",
+    "X-Forwarded-Proto",
+    "X-B3-TraceId",
+    "X-Envoy-External-Address",
+    "X-Datadog-Trace-Id",
+    "Sec-Fetch-Mode",
+];
+
+/// The one closed reserved-header classifier.
+///
+/// `name` may be in any ASCII case. Configuration validation rejects a
+/// reserved name at startup and source plan compilation rejects it again
+/// before any credential is resolved, so both call sites share this function
+/// rather than duplicating the deny set.
+pub(crate) fn is_reserved_header_name(name: &str) -> bool {
+    let name = name.to_ascii_lowercase();
+    RESERVED_HEADER_PREFIXES
+        .iter()
+        .any(|prefix| name.starts_with(prefix))
+        || RESERVED_HEADER_NAMES.contains(&name.as_str())
+}
+
+fn validate_path_template(
+    template: &str,
+    bindings: &OrderedMap<PathBindingConfig>,
+) -> Result<(), ConfigError> {
+    validate_string(template, 2, 2_048, "source path template")?;
+    if !template.starts_with('/')
+        || template.starts_with("//")
+        || template.contains(['?', '#', '\\'])
+        || !template.is_ascii()
+    {
+        return invalid("source path template is invalid");
+    }
+    let mut placeholders = BTreeSet::new();
+    let mut normalized = String::new();
+    for segment in template.split('/').skip(1) {
+        if segment.is_empty() || matches!(segment, "." | "..") {
+            return invalid("source path template contains an empty or dot segment");
+        }
+        normalized.push('/');
+        if let Some(name) = segment
+            .strip_prefix('{')
+            .and_then(|segment| segment.strip_suffix('}'))
+        {
+            if !valid_field_name(name) || !placeholders.insert(name) {
+                return invalid("source path-template placeholders must be valid and unique");
+            }
+            normalized.push('x');
+        } else {
+            if segment.contains(['{', '}']) {
+                return invalid("source path-template placeholder must occupy a complete segment");
+            }
+            normalized.push_str(segment);
+        }
+    }
+    validate_normalized_request_path(&normalized)?;
+    if placeholders.is_empty() || placeholders != bindings.keys().collect::<BTreeSet<_>>() {
+        return invalid("pathBindings must exactly match path-template placeholders");
+    }
+    for (_, binding) in bindings.iter() {
+        binding.validate()?;
+    }
+    Ok(())
+}
+
+fn validate_projection(projection: &[String]) -> Result<(), ConfigError> {
+    validate_unique_strings(projection, 1, 64, 2, 256, "source projection")?;
+    let paths = projection
+        .iter()
+        .map(|path| parse_projection_pointer(path))
+        .collect::<Result<Vec<_>, _>>()?;
+    for (index, left) in paths.iter().enumerate() {
+        for right in paths.iter().skip(index + 1) {
+            if projection_paths_overlap(left, right) {
+                return invalid("source projection paths must not duplicate or overlap");
+            }
+        }
+    }
+    Ok(())
+}
+
+#[derive(Debug, Clone, Eq, PartialEq)]
+enum ProjectionSegment {
+    Wildcard,
+    Key(String),
+}
+
+fn parse_projection_pointer(pointer: &str) -> Result<Vec<ProjectionSegment>, ConfigError> {
+    if !pointer.starts_with('/')
+        || pointer.starts_with("//")
+        || pointer.chars().any(char::is_control)
+    {
+        return invalid("source projection is not an extended JSON Pointer");
+    }
+    pointer[1..]
+        .split('/')
+        .map(|raw| {
+            if raw.is_empty() {
+                return invalid("source projection contains an empty segment");
+            }
+            if raw == "*" {
+                return Ok(ProjectionSegment::Wildcard);
+            }
+            let mut decoded = String::with_capacity(raw.len());
+            let mut chars = raw.chars();
+            while let Some(character) = chars.next() {
+                if character == '~' {
+                    match chars.next() {
+                        Some('0') => decoded.push('~'),
+                        Some('1') => decoded.push('/'),
+                        _ => return invalid("source projection contains an invalid escape"),
+                    }
+                } else {
+                    decoded.push(character);
+                }
+            }
+            Ok(ProjectionSegment::Key(decoded))
+        })
+        .collect()
+}
+
+fn projection_paths_overlap(left: &[ProjectionSegment], right: &[ProjectionSegment]) -> bool {
+    let common = left.len().min(right.len());
+    left.iter().zip(right).take(common).all(|(left, right)| {
+        left == right
+            || matches!(left, ProjectionSegment::Wildcard)
+            || matches!(right, ProjectionSegment::Wildcard)
+    })
+}
+
+fn validate_optional_range(
+    value: Option<u64>,
+    minimum: u64,
+    maximum: u64,
+) -> Result<(), ConfigError> {
+    value.map_or(Ok(()), |value| {
+        validate_range(value, minimum, maximum, "optional bound")
+    })
+}
+
+fn validate_source_origin(value: &str) -> Result<(), ConfigError> {
+    let url = validate_source_url(value, true)?;
+    if url.path() != "/" || url.query().is_some() {
+        return invalid("source baseUrl must contain only scheme, host, and optional port");
+    }
+    Ok(())
+}
+
+/// Validate the only credential-free source boundary.
+///
+/// This is deliberately narrower than the numeric-loopback exception used by
+/// authenticated deterministic source mocks. The unauthenticated local mode
+/// requires one exact origin spelling and an explicit port so a tutorial
+/// bundle cannot silently inherit a default port, path, alias, or userinfo.
+pub(crate) fn validate_local_unauthenticated_source_origin(value: &str) -> Result<(), ConfigError> {
+    let url = validate_source_url(value, true)?;
+    let port = url.port_or_known_default().ok_or(ConfigError::Invalid(
+        "unauthenticated local source origin requires an explicit non-zero port",
+    ))?;
+    let canonical = match url.host() {
+        Some(Host::Ipv4(ip)) if ip.is_loopback() => format!("http://{ip}:{port}"),
+        Some(Host::Ipv6(ip)) if ip.is_loopback() => format!("http://[{ip}]:{port}"),
+        _ => {
+            return invalid(
+                "unauthenticated local source origin must use a numeric loopback HTTP host",
+            )
+        }
+    };
+    if url.scheme() != "http" || value != canonical {
+        return invalid(
+            "unauthenticated local source origin must be a canonical numeric loopback HTTP origin with an explicit non-zero port",
+        );
+    }
+    Ok(())
+}
+
+fn validate_source_url(value: &str, origin_only: bool) -> Result<Url, ConfigError> {
+    let url = Url::parse(value).map_err(|_| ConfigError::Invalid("source URL is invalid"))?;
+    if !url.username().is_empty() || url.password().is_some() || url.fragment().is_some() {
+        return invalid("source URL contains prohibited authority or fragment data");
+    }
+    if origin_only && url.query().is_some() {
+        return invalid("source origin must not contain a query");
+    }
+    match url.scheme() {
+        "https" => {}
+        "http" => {
+            match url.host() {
+                Some(Host::Ipv4(ip)) if ip.is_loopback() => {}
+                Some(Host::Ipv6(ip)) if ip.is_loopback() => {}
+                _ => return invalid("insecure source URL must use a numeric loopback host"),
+            }
+            if !has_canonical_loopback_authority(value) {
+                return invalid("insecure source URL host syntax is ambiguous");
+            }
+        }
+        _ => return invalid("source URL scheme is not permitted"),
+    }
+    Ok(url)
+}
+
+fn has_canonical_loopback_authority(value: &str) -> bool {
+    let Some(rest) = value.strip_prefix("http://") else {
+        return false;
+    };
+    let authority = rest.split('/').next().unwrap_or(rest);
+    if let Some(suffix) = authority.strip_prefix("[::1]") {
+        return suffix.is_empty() || valid_port_suffix(suffix);
+    }
+    let (host, port) = authority
+        .rsplit_once(':')
+        .filter(|(_, port)| !port.is_empty() && port.bytes().all(|byte| byte.is_ascii_digit()))
+        .map_or((authority, None), |(host, port)| (host, Some(port)));
+    if port.is_some_and(|port| !valid_port(port)) {
+        return false;
+    }
+    let octets = host.split('.').collect::<Vec<_>>();
+    octets.len() == 4
+        && octets[0] == "127"
+        && octets.iter().all(|octet| {
+            !octet.is_empty()
+                && (octet == &"0" || !octet.starts_with('0'))
+                && octet.bytes().all(|byte| byte.is_ascii_digit())
+                && octet.parse::<u8>().is_ok()
+        })
+}
+
+fn valid_port_suffix(value: &str) -> bool {
+    value.strip_prefix(':').is_some_and(valid_port)
+}
+
+fn valid_port(value: &str) -> bool {
+    !value.starts_with('0') && value.parse::<u16>().is_ok_and(|port| port != 0)
+}
+
+fn validate_https_url(value: &str, origin_only: bool) -> Result<(), ConfigError> {
+    let url = Url::parse(value).map_err(|_| ConfigError::Invalid("HTTPS URL is invalid"))?;
+    if url.scheme() != "https"
+        || url.host().is_none()
+        || !url.username().is_empty()
+        || url.password().is_some()
+        || url.fragment().is_some()
+        || (origin_only && (url.path() != "/" || url.query().is_some()))
+    {
+        return invalid("HTTPS URL violates the strict origin contract");
+    }
+    Ok(())
+}
+
+fn validate_https_issuer(value: &str) -> Result<(), ConfigError> {
+    let url = Url::parse(value).map_err(|_| ConfigError::Invalid("HTTPS issuer is invalid"))?;
+    if url.scheme() != "https"
+        || url.host().is_none()
+        || !url.username().is_empty()
+        || url.password().is_some()
+        || url.query().is_some()
+        || url.fragment().is_some()
+    {
+        return invalid("HTTPS issuer violates the exact issuer contract");
+    }
+    Ok(())
+}
+
+fn validate_normalized_request_path(value: &str) -> Result<(), ConfigError> {
+    if value.len() < 2
+        || !value.starts_with('/')
+        || value.starts_with("//")
+        || value.contains(['?', '#', '\\'])
+        || !value.is_ascii()
+    {
+        return invalid("source request path is invalid");
+    }
+    let mut index = 0;
+    let bytes = value.as_bytes();
+    while index < bytes.len() {
+        let byte = bytes[index];
+        if byte == b'%' {
+            if index + 2 >= bytes.len()
+                || !bytes[index + 1].is_ascii_hexdigit()
+                || !bytes[index + 2].is_ascii_hexdigit()
+                || bytes[index + 1].is_ascii_lowercase()
+                || bytes[index + 2].is_ascii_lowercase()
+            {
+                return invalid("source request path contains a non-canonical escape");
+            }
+            let decoded = u8::from_str_radix(&value[index + 1..index + 3], 16)
+                .map_err(|_| ConfigError::Invalid("source request path escape is invalid"))?;
+            if decoded.is_ascii_alphanumeric()
+                || matches!(decoded, b'-' | b'.' | b'_' | b'~' | b'/' | b'\\')
+            {
+                return invalid("source request path contains an ambiguous escape");
+            }
+            index += 3;
+            continue;
+        }
+        if !(byte.is_ascii_alphanumeric()
+            || matches!(
+                byte,
+                b'/' | b'.'
+                    | b'_'
+                    | b'~'
+                    | b'!'
+                    | b'$'
+                    | b'&'
+                    | b'\''
+                    | b'('
+                    | b')'
+                    | b'*'
+                    | b'+'
+                    | b','
+                    | b';'
+                    | b'='
+                    | b':'
+                    | b'@'
+                    | b'-'
+            ))
+        {
+            return invalid("source request path contains a prohibited character");
+        }
+        index += 1;
+    }
+    if value
+        .split('/')
+        .skip(1)
+        .any(|segment| segment.is_empty() || matches!(segment, "." | ".."))
+    {
+        return invalid("source request path contains a dot segment");
+    }
+    Ok(())
+}
+
+fn validate_bucket_boundaries(boundaries: &[BucketBoundary]) -> Result<(), ConfigError> {
+    validate_len(boundaries.len(), 1, 64, "bucket boundaries")?;
+    let mut codes = BTreeSet::new();
+    let mut previous_maximum: Option<&str> = None;
+    for boundary in boundaries {
+        boundary.minimum_inclusive.validate()?;
+        boundary.maximum_exclusive.validate()?;
+        if compare_decimal_text(
+            &boundary.minimum_inclusive.value,
+            &boundary.maximum_exclusive.value,
+        ) != std::cmp::Ordering::Less
+        {
+            return invalid("bucket interval must be non-empty");
+        }
+        if previous_maximum.is_some_and(|previous| {
+            compare_decimal_text(previous, &boundary.minimum_inclusive.value)
+                != std::cmp::Ordering::Equal
+        }) {
+            return invalid("bucket intervals must be ordered and contiguous");
+        }
+        if !valid_code(&boundary.code) || !codes.insert(boundary.code.as_str()) {
+            return invalid("bucket code is invalid or duplicated");
+        }
+        previous_maximum = Some(&boundary.maximum_exclusive.value);
+    }
+    Ok(())
+}
+
+fn validate_concept_constraints(concept: &ConceptConfig) -> Result<(), ConfigError> {
+    let required: &[&str] = match concept.form {
+        ConceptForm::Boolean => &[],
+        ConceptForm::ControlledCode => &["codelist", "codelistVersion", "maximumBytes"],
+        ConceptForm::ControlledCategory => &[
+            "categoryScheme",
+            "schemeVersion",
+            "maximumBytes",
+            "codelist",
+        ],
+        ConceptForm::BoundedInteger => &["minimum", "maximum"],
+        ConceptForm::BoundedDecimal => &["minimum", "maximum", "maximumScale"],
+        ConceptForm::DateBucket | ConceptForm::TimeBucket => &["bucketScheme", "schemeVersion"],
+        ConceptForm::AudienceScopedEntityReference => &["maximumBytes"],
+        ConceptForm::ControlledCodeList => &[
+            "codelist",
+            "codelistVersion",
+            "minimumItems",
+            "maximumItems",
+            "unique",
+        ],
+        ConceptForm::EntityReferenceList => &["minimumItems", "maximumItems", "unique"],
+        ConceptForm::ReviewedStructuredValue => &["schema", "maximumSerializedBytes"],
+    };
+    if concept.constraints.len() != required.len()
+        || required
+            .iter()
+            .any(|name| !concept.constraints.contains_key(name))
+    {
+        return invalid("concept constraints do not exactly match the declared value form");
+    }
+
+    match concept.form {
+        ConceptForm::Boolean => {}
+        ConceptForm::ControlledCode => {
+            validate_codelist_constraints(&concept.constraints, "codelistVersion")?;
+        }
+        ConceptForm::ControlledCategory => {
+            validate_uri(yaml_string(&concept.constraints, "categoryScheme")?)?;
+            validate_string(
+                yaml_string(&concept.constraints, "schemeVersion")?,
+                1,
+                128,
+                "scheme version",
+            )?;
+            validate_codelist_path(yaml_string(&concept.constraints, "codelist")?)?;
+            validate_constraint_u64(&concept.constraints, "maximumBytes", 1, 8_192)?;
+        }
+        ConceptForm::BoundedInteger => {
+            let minimum = yaml_i64(&concept.constraints, "minimum")?;
+            let maximum = yaml_i64(&concept.constraints, "maximum")?;
+            if minimum > maximum || minimum < -MAX_SAFE_INTEGER || maximum > MAX_SAFE_INTEGER {
+                return invalid("bounded integer constraints are invalid");
+            }
+        }
+        ConceptForm::BoundedDecimal => {
+            let minimum = yaml_string(&concept.constraints, "minimum")?;
+            let maximum = yaml_string(&concept.constraints, "maximum")?;
+            validate_decimal(minimum)?;
+            validate_decimal(maximum)?;
+            if compare_decimal_text(minimum, maximum) == std::cmp::Ordering::Greater {
+                return invalid("bounded decimal constraints are invalid");
+            }
+            validate_constraint_u64(&concept.constraints, "maximumScale", 0, 9)?;
+        }
+        ConceptForm::DateBucket | ConceptForm::TimeBucket => {
+            validate_uri(yaml_string(&concept.constraints, "bucketScheme")?)?;
+            validate_string(
+                yaml_string(&concept.constraints, "schemeVersion")?,
+                1,
+                128,
+                "scheme version",
+            )?;
+        }
+        ConceptForm::AudienceScopedEntityReference => {
+            validate_constraint_u64(&concept.constraints, "maximumBytes", 1, 8_192)?;
+        }
+        ConceptForm::ControlledCodeList => {
+            validate_codelist_path(yaml_string(&concept.constraints, "codelist")?)?;
+            validate_string(
+                yaml_string(&concept.constraints, "codelistVersion")?,
+                1,
+                128,
+                "codelist version",
+            )?;
+            validate_collection_constraints(&concept.constraints)?;
+        }
+        ConceptForm::EntityReferenceList => validate_collection_constraints(&concept.constraints)?,
+        ConceptForm::ReviewedStructuredValue => {
+            validate_uri(yaml_string(&concept.constraints, "schema")?)?;
+            validate_constraint_u64(&concept.constraints, "maximumSerializedBytes", 1, 65_536)?;
+        }
+    }
+    Ok(())
+}
+
+fn validate_codelist_constraints(
+    constraints: &OrderedMap<YamlValue>,
+    version_key: &str,
+) -> Result<(), ConfigError> {
+    validate_codelist_path(yaml_string(constraints, "codelist")?)?;
+    validate_string(
+        yaml_string(constraints, version_key)?,
+        1,
+        128,
+        "codelist version",
+    )?;
+    validate_constraint_u64(constraints, "maximumBytes", 1, 8_192).map(|_| ())
+}
+
+fn validate_collection_constraints(constraints: &OrderedMap<YamlValue>) -> Result<(), ConfigError> {
+    let minimum = validate_constraint_u64(constraints, "minimumItems", 1, 64)?;
+    let maximum = validate_constraint_u64(constraints, "maximumItems", 1, 64)?;
+    if minimum > maximum || !yaml_bool(constraints, "unique")? {
+        return invalid("collection constraints are invalid");
+    }
+    Ok(())
+}
+
+fn validate_codelist_path(value: &str) -> Result<(), ConfigError> {
+    let path = ArtifactPath::parse(value)?;
+    require_artifact_prefix(&path, "codelists/")
+}
+
+fn yaml_string<'a>(map: &'a OrderedMap<YamlValue>, key: &str) -> Result<&'a str, ConfigError> {
+    map.get(key)
+        .and_then(YamlValue::as_str)
+        .ok_or(ConfigError::Invalid(
+            "concept constraint has the wrong scalar type",
+        ))
+}
+
+fn yaml_i64(map: &OrderedMap<YamlValue>, key: &str) -> Result<i64, ConfigError> {
+    map.get(key)
+        .and_then(YamlValue::as_i64)
+        .ok_or(ConfigError::Invalid(
+            "concept constraint has the wrong integer type",
+        ))
+}
+
+fn yaml_bool(map: &OrderedMap<YamlValue>, key: &str) -> Result<bool, ConfigError> {
+    map.get(key)
+        .and_then(YamlValue::as_bool)
+        .ok_or(ConfigError::Invalid(
+            "concept constraint has the wrong boolean type",
+        ))
+}
+
+fn validate_constraint_u64(
+    map: &OrderedMap<YamlValue>,
+    key: &str,
+    minimum: u64,
+    maximum: u64,
+) -> Result<u64, ConfigError> {
+    let value = map
+        .get(key)
+        .and_then(YamlValue::as_u64)
+        .ok_or(ConfigError::Invalid(
+            "concept constraint has the wrong integer type",
+        ))?;
+    validate_range(value, minimum, maximum, "concept constraint")?;
+    Ok(value)
+}
+
+fn validate_decimal(value: &str) -> Result<(), ConfigError> {
+    if value.is_empty()
+        || value.starts_with('+')
+        || value == "-0"
+        || value.starts_with("-0.")
+        || value.contains(['e', 'E'])
+    {
+        return invalid("decimal text is not canonical");
+    }
+    let unsigned = value.strip_prefix('-').unwrap_or(value);
+    let mut parts = unsigned.split('.');
+    let integer = parts.next().unwrap_or_default();
+    let fraction = parts.next();
+    if parts.next().is_some()
+        || integer.is_empty()
+        || !integer.bytes().all(|byte| byte.is_ascii_digit())
+        || (integer.len() > 1 && integer.starts_with('0'))
+        || fraction.is_some_and(|fraction| {
+            fraction.is_empty()
+                || !fraction.bytes().all(|byte| byte.is_ascii_digit())
+                || fraction.ends_with('0')
+        })
+    {
+        return invalid("decimal text is not canonical");
+    }
+    let scale = fraction.map_or(0, str::len);
+    let precision = integer.len() + scale;
+    if precision > 28 || scale > 9 {
+        return invalid("decimal precision or scale exceeds Version 1 bounds");
+    }
+    Ok(())
+}
+
+fn compare_decimal_text(left: &str, right: &str) -> std::cmp::Ordering {
+    fn parts(value: &str) -> (bool, &str, &str) {
+        let negative = value.starts_with('-');
+        let unsigned = value.strip_prefix('-').unwrap_or(value);
+        let (integer, fraction) = unsigned.split_once('.').unwrap_or((unsigned, ""));
+        (negative, integer, fraction)
+    }
+    let (left_negative, left_integer, left_fraction) = parts(left);
+    let (right_negative, right_integer, right_fraction) = parts(right);
+    if left_negative != right_negative {
+        return if left_negative {
+            std::cmp::Ordering::Less
+        } else {
+            std::cmp::Ordering::Greater
+        };
+    }
+    let magnitude = left_integer
+        .len()
+        .cmp(&right_integer.len())
+        .then_with(|| left_integer.cmp(right_integer))
+        .then_with(|| {
+            let width = left_fraction.len().max(right_fraction.len());
+            left_fraction
+                .bytes()
+                .chain(std::iter::repeat(b'0'))
+                .take(width)
+                .cmp(
+                    right_fraction
+                        .bytes()
+                        .chain(std::iter::repeat(b'0'))
+                        .take(width),
+                )
+        });
+    if left_negative {
+        magnitude.reverse()
+    } else {
+        magnitude
+    }
+}
+
+fn validate_uri(value: &str) -> Result<(), ConfigError> {
+    validate_string(value, 1, 512, "URI")?;
+    let url = Url::parse(value).map_err(|_| ConfigError::Invalid("URI is invalid"))?;
+    if url.scheme().is_empty() || value.bytes().any(|byte| byte.is_ascii_whitespace()) {
+        return invalid("URI is invalid");
+    }
+    Ok(())
+}
+
+fn validate_absolute_path(value: &str) -> Result<(), ConfigError> {
+    let path = Path::new(value);
+    if value.len() > 512
+        || !value.starts_with('/')
+        || value.starts_with("//")
+        || value.contains('\\')
+        || !path.is_absolute()
+        || path
+            .components()
+            .any(|component| matches!(component, Component::CurDir | Component::ParentDir))
+    {
+        return invalid("absolute operator path is invalid");
+    }
+    Ok(())
+}
+
+fn validate_claim_name(value: &str) -> Result<(), ConfigError> {
+    let bytes = value.as_bytes();
+    if bytes.is_empty()
+        || bytes.len() > 128
+        || !matches!(bytes.first(), Some(b'A'..=b'Z' | b'a'..=b'z' | b'_'))
+        || !bytes[1..]
+            .iter()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'.' | b'-'))
+    {
+        return invalid("claim name is invalid");
+    }
+    Ok(())
+}
+
+fn validate_claim_path(value: &str) -> Result<(), ConfigError> {
+    if value.len() > 512 {
+        return invalid("claim path is too long");
+    }
+    for segment in value.split('.') {
+        let bytes = segment.as_bytes();
+        if bytes.is_empty()
+            || !matches!(bytes.first(), Some(b'A'..=b'Z' | b'a'..=b'z' | b'_'))
+            || !bytes[1..]
+                .iter()
+                .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'))
+        {
+            return invalid("claim path is invalid");
+        }
+    }
+    Ok(())
+}
+
+fn validate_purpose(value: &str) -> Result<(), ConfigError> {
+    let bytes = value.as_bytes();
+    if bytes.is_empty()
+        || bytes.len() > 128
+        || !matches!(bytes.first(), Some(b'a'..=b'z'))
+        || !bytes[1..].iter().all(|byte| {
+            byte.is_ascii_lowercase()
+                || byte.is_ascii_digit()
+                || matches!(byte, b'.' | b'_' | b':' | b'-')
+        })
+    {
+        return invalid("purpose code is invalid");
+    }
+    Ok(())
+}
+
+fn valid_local_id(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    !bytes.is_empty()
+        && bytes.len() <= 128
+        && matches!(bytes.first(), Some(b'a'..=b'z'))
+        && bytes[1..].iter().all(|byte| {
+            byte.is_ascii_lowercase() || byte.is_ascii_digit() || matches!(byte, b'.' | b'_' | b'-')
+        })
+}
+
+fn valid_sd_jwt_claim_name(value: &str) -> bool {
+    const RESERVED: [&str; 24] = [
+        "iss",
+        "sub",
+        "aud",
+        "iat",
+        "nbf",
+        "exp",
+        "vct",
+        "id",
+        "jti",
+        "_sd",
+        "_sd_alg",
+        "cnf",
+        "status",
+        "issuedBy",
+        "providedBy",
+        "supportsRequirement",
+        "purpose",
+        "audience",
+        "assuranceProfile",
+        "observedAt",
+        "configurationRevision",
+        "requestNonce",
+        "subjects",
+        "structuredValues",
+    ];
+    let bytes = value.as_bytes();
+    !bytes.is_empty()
+        && bytes.len() <= 64
+        && matches!(bytes.first(), Some(b'A'..=b'Z' | b'a'..=b'z'))
+        && bytes[1..]
+            .iter()
+            .all(|byte| byte.is_ascii_alphanumeric() || *byte == b'_')
+        && !RESERVED.contains(&value)
+}
+
+fn valid_field_name(value: &str) -> bool {
+    value.len() <= 64 && valid_local_id(value)
+}
+
+fn valid_parameter_key(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    !bytes.is_empty()
+        && bytes.len() <= 128
+        && matches!(bytes.first(), Some(b'A'..=b'Z' | b'a'..=b'z' | b'_'))
+        && bytes[1..]
+            .iter()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-'))
+}
+
+fn valid_code(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    !bytes.is_empty()
+        && bytes.len() <= 128
+        && bytes[0].is_ascii_alphanumeric()
+        && bytes[1..]
+            .iter()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b':' | b'-'))
+}
+
+fn validate_len(
+    length: usize,
+    minimum: usize,
+    maximum: usize,
+    _field: &'static str,
+) -> Result<(), ConfigError> {
+    if (minimum..=maximum).contains(&length) {
+        Ok(())
+    } else {
+        invalid("collection cardinality is outside Version 1 bounds")
+    }
+}
+
+fn validate_range(
+    value: u64,
+    minimum: u64,
+    maximum: u64,
+    _field: &'static str,
+) -> Result<(), ConfigError> {
+    if (minimum..=maximum).contains(&value) {
+        Ok(())
+    } else {
+        invalid("numeric value is outside Version 1 bounds")
+    }
+}
+
+fn validate_string(
+    value: &str,
+    minimum: usize,
+    maximum: usize,
+    _field: &'static str,
+) -> Result<(), ConfigError> {
+    if (minimum..=maximum).contains(&value.len()) && !value.contains('\0') {
+        Ok(())
+    } else {
+        invalid("string length is outside Version 1 bounds")
+    }
+}
+
+fn validate_unique<T: Ord>(
+    values: &[T],
+    minimum: usize,
+    maximum: usize,
+    field: &'static str,
+) -> Result<(), ConfigError> {
+    validate_len(values.len(), minimum, maximum, field)?;
+    if values.iter().collect::<BTreeSet<_>>().len() != values.len() {
+        return invalid("collection values must be unique");
+    }
+    Ok(())
+}
+
+fn validate_unique_strings(
+    values: &[String],
+    minimum_items: usize,
+    maximum_items: usize,
+    minimum_bytes: usize,
+    maximum_bytes: usize,
+    field: &'static str,
+) -> Result<(), ConfigError> {
+    validate_len(values.len(), minimum_items, maximum_items, field)?;
+    let mut seen = BTreeSet::new();
+    for value in values {
+        validate_string(value, minimum_bytes, maximum_bytes, field)?;
+        if !seen.insert(value.as_str()) {
+            return invalid("collection values must be unique");
+        }
+    }
+    Ok(())
+}
+
+fn invalid<T>(reason: &'static str) -> Result<T, ConfigError> {
+    Err(ConfigError::Invalid(reason))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn assurance_profile_is_explicit_and_strict_profiles_require_fixtures() {
+        let strict = std::str::from_utf8(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ))
+        .expect("fixture is UTF-8");
+
+        let omitted_profile = strict.replace("assuranceProfile: evidence-grade\n", "");
+        assert_ne!(omitted_profile, strict, "profile mutation must apply");
+        assert!(EvidenceConfig::parse_yaml(omitted_profile.as_bytes()).is_err());
+
+        let without_fixtures = strict
+            .lines()
+            .filter(|line| !line.trim_start().starts_with("fixtures:"))
+            .collect::<Vec<_>>()
+            .join("\n");
+        for profile in ["production", "evidence-grade"] {
+            let candidate = without_fixtures.replace("evidence-grade", profile);
+            assert!(
+                EvidenceConfig::parse_yaml(candidate.as_bytes()).is_err(),
+                "{profile} accepted a requirement without fixtures"
+            );
+        }
+
+        let local = without_fixtures.replace("evidence-grade", "local");
+        let parsed = EvidenceConfig::parse_yaml(local.as_bytes())
+            .expect("local authoring accepts an omitted fixture reference");
+        assert_eq!(parsed.assurance_profile, AssuranceProfile::Local);
+        assert!(parsed.requirements[0].fixtures.is_none());
+    }
+
+    #[test]
+    fn only_local_assurance_accepts_the_exact_loopback_mint_identity() {
+        let mut config = EvidenceConfig::parse_yaml(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ))
+        .expect("strict fixture validates");
+        config.assurance_profile = AssuranceProfile::Local;
+        config.authentication.issuer = "http://127.0.0.1:8081".to_owned();
+        config.authentication.jwks_uri = "http://127.0.0.1:8081/.well-known/jwks.json".to_owned();
+        config
+            .validate()
+            .expect("local profile accepts the supervised Mint identity");
+
+        for invalid in [
+            "http://localhost:8081",
+            "http://127.0.0.2:8081",
+            "http://127.0.0.1",
+            "http://127.0.0.1:0",
+            "http://127.0.0.1:08081",
+            "http://127.0.0.1:65536",
+            "http://user@127.0.0.1:8081",
+            "http://127.0.0.1:8081/",
+        ] {
+            let mut candidate = config.clone();
+            candidate.authentication.issuer = invalid.to_owned();
+            assert!(
+                candidate.validate().is_err(),
+                "local assurance accepted issuer {invalid}"
+            );
+        }
+        for invalid in [
+            "http://127.0.0.1:8081/.well-known/keys.json",
+            "http://127.0.0.1:8082/.well-known/jwks.json",
+            "http://localhost:8081/.well-known/jwks.json",
+            "https://127.0.0.1:8081/.well-known/jwks.json",
+        ] {
+            let mut candidate = config.clone();
+            candidate.authentication.jwks_uri = invalid.to_owned();
+            assert!(
+                candidate.validate().is_err(),
+                "local assurance accepted JWKS URI {invalid}"
+            );
+        }
+
+        for profile in [
+            AssuranceProfile::Production,
+            AssuranceProfile::EvidenceGrade,
+        ] {
+            let mut candidate = config.clone();
+            candidate.assurance_profile = profile;
+            assert!(
+                candidate.validate().is_err(),
+                "{profile:?} inherited the local HTTP exception"
+            );
+        }
+    }
+
+    /// Two authority claims naming one JWT member, or naming a member the token
+    /// already defines, is a configuration the verifier must refuse.
+    ///
+    /// Mint refuses the same shapes when it mints (`ClaimNames::validate`), but
+    /// Mint is one possible issuer. Evidence is documented against any OIDC
+    /// issuer, and no other issuer enforces Mint's rules, so the deployment with
+    /// no issuer-side check is exactly the one where this is the only check.
+    /// `grantAuthorityClaim: aud` would read Evidence's own audience as the
+    /// authority that granted the request.
+    #[test]
+    fn authority_claim_names_must_be_distinct_and_must_not_shadow_registered_claims() {
+        let config = EvidenceConfig::parse_yaml(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ))
+        .expect("strict fixture validates");
+        config
+            .validate()
+            .expect("the fixture claim names are sound");
+
+        let mut duplicate = config.clone();
+        duplicate
+            .authentication
+            .grant_id_claim
+            .clone_from(&config.authentication.grant_authority_claim);
+        assert_eq!(
+            duplicate.validate(),
+            invalid("authority claim names must be distinct"),
+            "one member read as both the grant id and the granting authority"
+        );
+
+        let mut duplicate_actor = config.clone();
+        duplicate_actor.authentication.actor_claim =
+            Some(config.authentication.requester_tags_claim.clone());
+        assert_eq!(
+            duplicate_actor.validate(),
+            invalid("authority claim names must be distinct"),
+            "one member read as both the actor and the requester tags"
+        );
+
+        for reserved in ["iss", "aud", "exp", "iat", "nbf", "jti", "client_id"] {
+            let mut candidate = config.clone();
+            candidate.authentication.grant_authority_claim = reserved.to_owned();
+            assert_eq!(
+                candidate.validate(),
+                invalid("authority claim names must not shadow registered JWT claims"),
+                "grant authority read from the registered claim {reserved}"
+            );
+        }
+
+        // `sub` carries the principal, so the principal claim may name it and
+        // the fixture does. Any other claim naming it would read the principal.
+        let mut principal_is_subject = config.clone();
+        principal_is_subject.authentication.principal_claim = "sub".to_owned();
+        principal_is_subject
+            .validate()
+            .expect("the principal may be read from sub");
+        // Moved off `sub` first, so this proves the shadowing rule rather than
+        // colliding with the principal and tripping distinctness instead.
+        let mut authority_is_subject = config.clone();
+        authority_is_subject.authentication.principal_claim = "evidence_principal".to_owned();
+        authority_is_subject.authentication.grant_authority_claim = "sub".to_owned();
+        assert_eq!(
+            authority_is_subject.validate(),
+            invalid("authority claim names must not shadow registered JWT claims"),
+            "the granting authority read from the principal member"
+        );
+
+        let mut distinct = config.clone();
+        distinct.authentication.actor_claim = Some("evidence_actor".to_owned());
+        distinct
+            .validate()
+            .expect("distinct, unreserved claim names load");
+    }
+
+    #[test]
+    fn unauthenticated_source_is_local_loopback_only_and_matches_the_bundle_schema() {
+        let mut local = EvidenceConfig::parse_yaml(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ))
+        .expect("strict fixture validates");
+        local.assurance_profile = AssuranceProfile::Local;
+        local.sources.0[0].1.authentication = SourceAuthentication::None {};
+
+        for origin in [
+            "http://127.0.0.1:80",
+            "http://127.0.0.1:18081",
+            "http://127.42.5.9:1",
+            "http://[::1]:65535",
+        ] {
+            let mut candidate = local.clone();
+            candidate.sources.0[0].1.base_url = origin.to_owned();
+            candidate
+                .validate()
+                .unwrap_or_else(|_| panic!("local assurance rejected {origin}"));
+            assert!(candidate.sources.0[0]
+                .1
+                .authentication
+                .secret_refs()
+                .is_empty());
+        }
+
+        for origin in [
+            "https://127.0.0.1:18081",
+            "http://localhost:18081",
+            "http://127.0.0.1",
+            "http://127.0.0.1:0",
+            "http://127.0.0.1:018081",
+            "http://127.0.0.1:65536",
+            "http://127.00.0.1:18081",
+            "http://127.0.0.1:18081/",
+            "http://127.0.0.1:18081/data",
+            "http://127.0.0.1:18081?query=true",
+            "http://127.0.0.1:18081#fragment",
+            "http://user@127.0.0.1:18081",
+            "http://192.168.1.2:18081",
+        ] {
+            let mut candidate = local.clone();
+            candidate.sources.0[0].1.base_url = origin.to_owned();
+            assert!(
+                candidate.validate().is_err(),
+                "local assurance accepted unauthenticated origin {origin}"
+            );
+        }
+
+        let mut with_tls_profile = local.clone();
+        with_tls_profile.sources.0[0].1.base_url = "http://127.0.0.1:18081".to_owned();
+        with_tls_profile.sources.0[0].1.tls_trust_profile = Some("unused-local-ca".to_owned());
+        assert!(with_tls_profile.validate().is_err());
+
+        for profile in [
+            AssuranceProfile::Production,
+            AssuranceProfile::EvidenceGrade,
+        ] {
+            let mut candidate = local.clone();
+            candidate.assurance_profile = profile;
+            candidate.sources.0[0].1.base_url = "http://127.0.0.1:18081".to_owned();
+            assert!(
+                candidate.validate().is_err(),
+                "{profile:?} accepted an unauthenticated source"
+            );
+        }
+
+        let validator = bundle_contract_validator();
+        let mut instance = bundle_contract_instance(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ));
+        instance["assuranceProfile"] = serde_json::json!("local");
+        instance["sources"]["source-a"]["baseUrl"] = serde_json::json!("http://127.0.0.1:18081");
+        instance["sources"]["source-a"]["authentication"] = serde_json::json!({"kind": "none"});
+        assert!(
+            validator.is_valid(&instance),
+            "schema accepts the local form"
+        );
+        instance["assuranceProfile"] = serde_json::json!("production");
+        assert!(
+            !validator.is_valid(&instance),
+            "schema rejects the local exception in a deployable profile"
+        );
+
+        assert!(
+            serde_json::from_value::<SourceAuthentication>(
+                serde_json::json!({"kind": "none", "tokenRef": "secret:file/unexpected"})
+            )
+            .is_err(),
+            "the none variant is closed"
+        );
+    }
+
+    fn bundle_contract_validator() -> jsonschema::JSONSchema {
+        let schema: serde_norway::Value = serde_norway::from_slice(include_bytes!(
+            "../../../products/evidence/contracts/bundle.schema.yaml"
+        ))
+        .expect("bundle contract is YAML");
+        let schema = serde_json::to_value(schema).expect("bundle contract converts to JSON");
+        jsonschema::JSONSchema::options()
+            .with_draft(jsonschema::Draft::Draft202012)
+            .should_validate_formats(true)
+            .compile(&schema)
+            .expect("bundle contract compiles")
+    }
+
+    fn runtime_contract_validator() -> jsonschema::JSONSchema {
+        let schema: serde_norway::Value = serde_norway::from_slice(include_bytes!(
+            "../../../products/evidence/contracts/runtime.schema.yaml"
+        ))
+        .expect("runtime contract is YAML");
+        let schema = serde_json::to_value(schema).expect("runtime contract converts to JSON");
+        jsonschema::JSONSchema::options()
+            .with_draft(jsonschema::Draft::Draft202012)
+            .should_validate_formats(true)
+            .compile(&schema)
+            .expect("runtime contract compiles")
+    }
+
+    fn bundle_contract_instance(yaml: &[u8]) -> serde_json::Value {
+        let value: serde_norway::Value =
+            serde_norway::from_slice(yaml).expect("bundle instance is YAML");
+        serde_json::to_value(value).expect("bundle instance converts to JSON")
+    }
+
+    /// Canary scalars planted in a malformed document.
+    ///
+    /// A diagnostic that ever reproduces one of these has leaked a deployment
+    /// value, which is exactly what the safe-diagnostic contract forbids.
+    const CANARY_VALUES: [&str; 4] = [
+        "s3cr3t-selector-value",
+        "urn:gov:example:canary:subject:9910",
+        "secret:file/canary-private-key",
+        "https://canary.internal.example",
+    ];
+
+    #[test]
+    fn decode_failures_report_a_safe_path_a_location_and_a_value_free_cause() {
+        let reference = include_str!("../../../products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/evidence.yaml");
+        let unknown_nested = reference.replacen(
+            "      timeoutMilliseconds: 3000",
+            "      timeoutMilliseconds: 3000\n      surprise: s3cr3t-selector-value",
+            1,
+        );
+        assert_ne!(unknown_nested, reference, "nested mutation applies");
+        let cases: [(&str, String, &str, Option<&str>, bool); 6] = [
+            (
+                "malformed YAML",
+                format!("version: 1\nbroken: [{}\n", CANARY_VALUES[0]),
+                "document is not well-formed YAML",
+                None,
+                true,
+            ),
+            (
+                "unknown top-level field",
+                format!("version: 1\nbogusField: {}\n", CANARY_VALUES[1]),
+                "unknown field",
+                None,
+                true,
+            ),
+            (
+                "unknown nested field",
+                unknown_nested,
+                "unknown field",
+                Some("sources.registered-birth-date.request"),
+                true,
+            ),
+            (
+                "wrong type",
+                format!("version: {}\n", CANARY_VALUES[2]),
+                "field has the wrong type",
+                Some("version"),
+                true,
+            ),
+            (
+                "missing field",
+                "version: 1\n".to_owned(),
+                "required field is missing",
+                None,
+                true,
+            ),
+            (
+                "more than one document",
+                format!("version: 1\n---\nversion: {}\n", CANARY_VALUES[3]),
+                "document contains more than one YAML document",
+                None,
+                false,
+            ),
+        ];
+        for (label, document, expected_cause, expected_path, expects_location) in cases {
+            let error = EvidenceConfig::parse_yaml(document.as_bytes())
+                .err()
+                .unwrap_or_else(|| panic!("{label} was accepted"));
+            let ConfigError::InvalidYaml(fault) = &error else {
+                panic!("{label} was not reported as a decode failure: {error}");
+            };
+            assert_eq!(fault.cause(), expected_cause, "{label} cause");
+            assert_eq!(fault.path(), expected_path, "{label} path");
+            assert_eq!(
+                fault.location().is_some(),
+                expects_location,
+                "{label} location presence"
+            );
+            let rendered = error.to_string();
+            for canary in CANARY_VALUES {
+                assert!(
+                    !rendered.contains(canary),
+                    "{label} diagnostic leaked a document value: {rendered}"
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn schema_paths_are_accepted_only_when_they_carry_no_document_value() {
+        for safe in [
+            "version",
+            "sources.registered-birth-date.request",
+            "sources.a.request.fixedHeaders[0].name",
+            "requirements[12].concepts[3].id",
+            "sources.a.?",
+        ] {
+            assert!(is_safe_schema_path(safe), "{safe} is a schema path");
+        }
+        for unsafe_candidate in [
+            "",
+            "invalid type",
+            "invalid value",
+            "sources.urn:gov:example",
+            "sources.\"quoted key\"",
+            "sources.a[]",
+            "sources.a[x]",
+            "sources.a[0",
+            "sources.a/b",
+            &"a".repeat(MAX_SCHEMA_PATH_BYTES + 1),
+        ] {
+            assert!(
+                !is_safe_schema_path(unsafe_candidate),
+                "{unsafe_candidate} is not a schema path"
+            );
+        }
+    }
+
+    #[test]
+    fn exact_secret_reference_grammars_are_closed() {
+        for valid in ["secret:file/a", "secret:file/source-token_v2.json"] {
+            assert!(SecretRef::parse(valid).is_ok(), "{valid}");
+        }
+        for invalid in [
+            "secret:env/",
+            "secret:env/SOURCE_2_PASSWORD",
+            "secret:env/lower",
+            "secret:env/A-B",
+            "secret:file/Upper",
+            "secret:file/../token",
+            "secret:file/.token",
+            "plain-value",
+        ] {
+            assert!(SecretRef::parse(invalid).is_err(), "{invalid}");
+        }
+    }
+
+    #[test]
+    fn decimal_comparison_is_exact() {
+        assert_eq!(
+            compare_decimal_text("-10.5", "-2"),
+            std::cmp::Ordering::Less
+        );
+        assert_eq!(
+            compare_decimal_text("1.2", "1.20"),
+            std::cmp::Ordering::Equal
+        );
+        assert_eq!(compare_decimal_text("10", "2"), std::cmp::Ordering::Greater);
+    }
+
+    #[test]
+    fn all_coequal_acceptance_definitions_use_the_same_typed_config() {
+        for yaml in [
+            include_bytes!("../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml").as_slice(),
+            include_bytes!("../../../products/evidence/fixtures/acceptance/residence-region/evidence.yaml").as_slice(),
+            include_bytes!("../../../products/evidence/fixtures/acceptance/professional-licence/evidence.yaml").as_slice(),
+            include_bytes!("../../../products/evidence/fixtures/acceptance/legal-parent-relationship/evidence.yaml").as_slice(),
+        ] {
+            EvidenceConfig::parse_yaml(yaml).expect("acceptance definition must validate");
+        }
+    }
+
+    #[test]
+    fn requirement_validity_cannot_exceed_the_signing_maximum() {
+        // Startup validation is the enforcement point: runtime construction
+        // derives validUntil from the validated requirement validity, so no
+        // constructed assertion can exceed the bundle signing maximum and no
+        // redundant signing-time check exists.
+        let yaml = include_str!(
+            "../../../products/evidence/fixtures/acceptance/all-definitions/evidence.yaml"
+        );
+        assert!(EvidenceConfig::parse_yaml(yaml.as_bytes()).is_ok());
+        let shrunk_maximum = yaml.replace(
+            "maximumAssertionValiditySeconds: 86400",
+            "maximumAssertionValiditySeconds: 3600",
+        );
+        assert!(matches!(
+            EvidenceConfig::parse_yaml(shrunk_maximum.as_bytes()),
+            Err(ConfigError::Invalid(
+                "requirement validity exceeds signing maximum validity"
+            ))
+        ));
+    }
+
+    #[test]
+    fn response_formats_are_closed_unique_and_keep_signed_mandatory() {
+        let yaml = include_str!(
+            "../../../products/evidence/fixtures/acceptance/all-definitions/evidence.yaml"
+        );
+        for (from, to) in [
+            // The bundle cannot drop the mandatory signed format.
+            (
+                "\nresponseFormats: [signed-jws, unsigned-json]",
+                "\nresponseFormats: [unsigned-json]",
+            ),
+            // Formats must be unique.
+            (
+                "\nresponseFormats: [signed-jws, unsigned-json]",
+                "\nresponseFormats: [signed-jws, signed-jws]",
+            ),
+            // A grant cannot drop the mandatory signed format either.
+            (
+                "        responseFormats: [signed-jws, unsigned-json]\n        subjects:\n          - {role: subject, selectorProfile: person-demographics-v1, valueOrigin: request}",
+                "        responseFormats: [unsigned-json]\n        subjects:\n          - {role: subject, selectorProfile: person-demographics-v1, valueOrigin: request}",
+            ),
+            // The vocabulary is closed.
+            (
+                "\nresponseFormats: [signed-jws, unsigned-json]",
+                "\nresponseFormats: [signed-jws, jws-detached]",
+            ),
+        ] {
+            let mutated = yaml.replace(from, to);
+            assert_ne!(mutated, yaml, "{to}");
+            assert!(
+                EvidenceConfig::parse_yaml(mutated.as_bytes()).is_err(),
+                "{to}"
+            );
+        }
+    }
+
+    #[test]
+    fn bundle_contract_accepts_every_complete_version_one_bundle() {
+        let validator = bundle_contract_validator();
+        for yaml in [
+            include_bytes!("../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml").as_slice(),
+            include_bytes!("../../../products/evidence/fixtures/acceptance/all-definitions/evidence.yaml").as_slice(),
+            include_bytes!("../../../products/evidence/fixtures/acceptance/legal-parent-relationship/evidence.yaml").as_slice(),
+            include_bytes!("../../../products/evidence/fixtures/acceptance/professional-licence/evidence.yaml").as_slice(),
+            include_bytes!("../../../products/evidence/fixtures/acceptance/residence-region/evidence.yaml").as_slice(),
+            include_bytes!("../../../products/evidence/fixtures/conformance/selectors/evidence.yaml").as_slice(),
+            include_bytes!("../../../products/evidence/fixtures/conformance/supported-values/evidence.yaml").as_slice(),
+            include_bytes!("../../../products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/evidence.yaml").as_slice(),
+            include_bytes!("../../../products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/evidence.yaml").as_slice(),
+        ] {
+            assert!(validator.is_valid(&bundle_contract_instance(yaml)));
+        }
+    }
+
+    #[test]
+    fn bundle_contract_closes_concept_constraints_by_form() {
+        let validator = bundle_contract_validator();
+        let valid = bundle_contract_instance(include_bytes!(
+            "../../../products/evidence/fixtures/conformance/supported-values/evidence.yaml"
+        ));
+        assert!(validator.is_valid(&valid));
+
+        let mut misspelled = valid.clone();
+        let constraints = misspelled["requirements"][0]["concepts"][1]["constraints"]
+            .as_object_mut()
+            .expect("controlled-code constraints are an object");
+        let version = constraints
+            .remove("codelistVersion")
+            .expect("canonical constraint exists");
+        constraints.insert("codelist_version".to_owned(), version);
+        assert!(!validator.is_valid(&misspelled));
+
+        let mut unsupported = valid;
+        unsupported["requirements"][0]["concepts"][0]["constraints"]["maximumBytes"] =
+            serde_json::json!(32);
+        assert!(!validator.is_valid(&unsupported));
+
+        let mut structured_projection = bundle_contract_instance(include_bytes!(
+            "../../../products/evidence/fixtures/conformance/supported-values/evidence.yaml"
+        ));
+        structured_projection["requirements"][0]["concepts"][10]["sdJwtVc"] =
+            serde_json::json!({"claim": "birthCertificate", "disclosure": "top-level"});
+        assert!(validator.is_valid(&structured_projection));
+        structured_projection["requirements"][0]["concepts"][10]
+            .as_object_mut()
+            .expect("concept is an object")
+            .remove("sdJwtVc");
+        structured_projection["requirements"][0]["concepts"][0]["sdJwtVc"] =
+            serde_json::json!({"claim": "birthCertificate", "disclosure": "top-level"});
+        assert!(!validator.is_valid(&structured_projection));
+    }
+
+    #[test]
+    fn structured_sd_jwt_claim_projection_is_generic_unique_and_non_reserved() {
+        let mut config = EvidenceConfig::parse_yaml(include_bytes!(
+            "../../../products/evidence/fixtures/conformance/supported-values/evidence.yaml"
+        ))
+        .expect("supported values fixture validates");
+        let structured_index = config.requirements[0]
+            .concepts
+            .iter()
+            .position(|concept| concept.form == ConceptForm::ReviewedStructuredValue)
+            .expect("fixture has a structured concept");
+        config.requirements[0].concepts[structured_index].sd_jwt_vc =
+            Some(SdJwtVcConceptProjection {
+                claim: "anyReviewedRecord".to_owned(),
+                disclosure: SdJwtVcDisclosureMode::TopLevel,
+            });
+        config.validate().expect("generic claim name is accepted");
+
+        config.requirements[0].concepts[structured_index]
+            .sd_jwt_vc
+            .as_mut()
+            .expect("projection exists")
+            .claim = "iss".to_owned();
+        assert!(
+            config.validate().is_err(),
+            "profile claim names are reserved"
+        );
+
+        config.requirements[0].concepts[structured_index]
+            .sd_jwt_vc
+            .as_mut()
+            .expect("projection exists")
+            .claim = "duplicateClaim".to_owned();
+        let mut duplicate = config.requirements[0].concepts[structured_index].clone();
+        duplicate.id = "urn:example:fixture:concept:another-structured-value".to_owned();
+        config.requirements[0].concepts.push(duplicate);
+        assert!(matches!(
+            config.validate(),
+            Err(ConfigError::Invalid(
+                "requirement SD-JWT VC claim names must be unique"
+            ))
+        ));
+
+        config.requirements[0].concepts.pop();
+        let projection = config.requirements[0].concepts[structured_index]
+            .sd_jwt_vc
+            .take();
+        config.requirements[0].concepts[0].sd_jwt_vc = projection;
+        assert!(matches!(
+            config.validate(),
+            Err(ConfigError::Invalid(
+                "SD-JWT VC field projection requires a reviewed structured value"
+            ))
+        ));
+    }
+
+    #[test]
+    fn typed_config_rejects_noncanonical_constraint_names() {
+        let valid = std::str::from_utf8(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/residence-region/evidence.yaml"
+        ))
+        .expect("fixture is UTF-8");
+        let misspelled = valid.replacen("codelistVersion", "codelist_version", 1);
+        assert_ne!(misspelled, valid, "fixture mutation must remain effective");
+        assert!(EvidenceConfig::parse_yaml(misspelled.as_bytes()).is_err());
+    }
+
+    #[test]
+    fn source_schema_roles_are_mandatory_distinct_and_directory_scoped() {
+        let valid = std::str::from_utf8(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ))
+        .expect("fixture is UTF-8");
+        assert!(EvidenceConfig::parse_yaml(valid.as_bytes()).is_ok());
+
+        for (from, to) in [
+            // The response contract is mandatory, so extraction never runs
+            // behind an undeclared response shape.
+            ("    responseSchema: schemas/response.schema.yaml\n", ""),
+            // Every schema artifact is directory-scoped like the other roles.
+            (
+                "responseSchema: schemas/response.schema.yaml",
+                "responseSchema: adapters/response.schema.yaml",
+            ),
+            // One artifact cannot carry two schema roles inside one source.
+            (
+                "responseSchema: schemas/response.schema.yaml",
+                "responseSchema: schemas/facts.schema.yaml",
+            ),
+            (
+                "responseSchema: schemas/response.schema.yaml",
+                "responseSchema: schemas/adapter-parameters.schema.yaml",
+            ),
+        ] {
+            let mutated = valid.replace(from, to);
+            assert_ne!(mutated, valid, "fixture mutation must remain effective");
+            assert!(
+                EvidenceConfig::parse_yaml(mutated.as_bytes()).is_err(),
+                "{to}"
+            );
+        }
+    }
+
+    #[test]
+    fn schema_roles_do_not_overlap_across_sources() {
+        let valid = std::str::from_utf8(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/all-definitions/evidence.yaml"
+        ))
+        .expect("fixture is UTF-8");
+        assert!(EvidenceConfig::parse_yaml(valid.as_bytes()).is_ok());
+
+        // One artifact validating a response for one source and facts for
+        // another would make a single review cover two different contracts.
+        let crossed = valid.replacen(
+            "responseSchema: schemas/adult-status-response.schema.yaml",
+            "responseSchema: schemas/residence-region-facts.schema.yaml",
+            1,
+        );
+        assert_ne!(crossed, valid, "fixture mutation must remain effective");
+        assert!(matches!(
+            EvidenceConfig::parse_yaml(crossed.as_bytes()),
+            Err(ConfigError::Invalid(
+                "source schema roles must not overlap across sources"
+            ))
+        ));
+    }
+
+    #[test]
+    fn yaml_names_and_secret_references_are_strict() {
+        let valid = std::str::from_utf8(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ))
+        .expect("fixture is UTF-8");
+        assert!(
+            EvidenceConfig::parse_yaml(valid.replace("providerId", "provider_id").as_bytes())
+                .is_err()
+        );
+        let unexpected = valid.replacen(
+            "service: {providerId: urn:example:fixture:provider:evidence, trustDomain: urn:example:fixture:trust-domain:acceptance}",
+            "service: {providerId: urn:example:fixture:provider:evidence, trustDomain: urn:example:fixture:trust-domain:acceptance, unexpected: true}",
+            1,
+        );
+        assert_ne!(unexpected, valid, "fixture mutation must remain effective");
+        assert!(EvidenceConfig::parse_yaml(unexpected.as_bytes()).is_err());
+        let literal_secret = valid.replacen(
+            "activeKeyRef: secret:file/signing-key",
+            "activeKeyRef: literal-private-key",
+            1,
+        );
+        assert_ne!(
+            literal_secret, valid,
+            "fixture mutation must remain effective"
+        );
+        assert!(EvidenceConfig::parse_yaml(literal_secret.as_bytes(),).is_err());
+        assert!(EvidenceConfig::parse_yaml(
+            valid
+                .replace(
+                    "activeKeyId: fixture-key-2026-01",
+                    "activeKeyId: \"fixture-key\\u000A2026-01\"",
+                )
+                .as_bytes(),
+        )
+        .is_err());
+    }
+
+    #[test]
+    fn context_and_grant_claim_maps_are_exact_and_non_aliasing() {
+        let profile: SelectorProfile = serde_norway::from_str(
+            "maximumAggregateBytes: 32\nfields:\n  alpha: {type: string, minimumBytes: 1, maximumBytes: 16}\n  beta: {type: boolean}\n",
+        )
+        .expect("selector profile parses");
+        let exact: GrantedSubject = serde_norway::from_str(
+            "role: subject\nselectorProfile: opaque-v1\nvalueOrigin: authenticated-context\nvalueClaims: {alpha: claims.alpha, beta: claims.beta}\n",
+        )
+        .expect("subject parses");
+        assert!(exact.validate_value_claims(&profile).is_ok());
+
+        for invalid_subject in [
+            "role: subject\nselectorProfile: opaque-v1\nvalueOrigin: authenticated-context\nvalueClaims: {alpha: claims.alpha}\n",
+            "role: subject\nselectorProfile: opaque-v1\nvalueOrigin: authenticated-grant\nvalueClaims: {alpha: claims.same, beta: claims.same}\n",
+            "role: subject\nselectorProfile: opaque-v1\nvalueOrigin: request\nvalueClaims: {alpha: claims.alpha, beta: claims.beta}\n",
+        ] {
+            let subject: GrantedSubject =
+                serde_norway::from_str(invalid_subject).expect("subject shape parses");
+            assert!(subject.validate_value_claims(&profile).is_err());
+        }
+    }
+
+    #[test]
+    fn complete_authority_paths_cannot_be_unioned_across_partial_grants() {
+        let mut config = EvidenceConfig::parse_yaml(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/legal-parent-relationship/evidence.yaml"
+        ))
+        .expect("fixture validates");
+        config.authority_profiles.0[0].1.grants[0].subjects.pop();
+        assert_eq!(
+            config.validate(),
+            Err(ConfigError::Invalid(
+                "authority grant must bind the complete subject-role set"
+            ))
+        );
+    }
+
+    #[test]
+    fn active_source_role_sets_reject_unreachable_inputs_at_startup() {
+        let mut config = EvidenceConfig::parse_yaml(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/legal-parent-relationship/evidence.yaml"
+        ))
+        .expect("fixture validates");
+        config.sources.0[0].1.request.selector_inputs[0]
+            .alternatives
+            .push(SelectorInputAlternative {
+                profile: "person-reference-v1".to_owned(),
+                fields: vec!["person_reference".to_owned()],
+            });
+        assert_eq!(
+            config.validate(),
+            Err(ConfigError::Invalid(
+                "source selector input is unreachable from every complete authority path"
+            ))
+        );
+    }
+
+    #[test]
+    fn one_source_may_serve_mutually_exclusive_complete_role_sets() {
+        let mut config = EvidenceConfig::parse_yaml(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ))
+        .expect("adult fixture validates");
+
+        let mut alternative = config.requirements[0].clone();
+        alternative.id = "urn:example:fixture:requirement:adult-status-alternative:v1".to_owned();
+        alternative.subject_roles[0].role = "alternate-subject".to_owned();
+        alternative.evidence_type =
+            "urn:example:fixture:evidence-type:adult-status-alternative:v1".to_owned();
+        alternative.derivation.script =
+            ArtifactPath::parse("derivations/adult-status-alternative.rhai")
+                .expect("alternative derivation path");
+        alternative.concepts[0].id =
+            "urn:example:fixture:concept:adult-status-alternative".to_owned();
+        alternative.disclosure_guard.families[0] =
+            "urn:example:fixture:disclosure-family:adult-status-alternative".to_owned();
+
+        let mut grant = config.authority_profiles.0[0].1.grants[0].clone();
+        grant.requirement = alternative.id.clone();
+        grant.subjects[0].role = "alternate-subject".to_owned();
+        config.authority_profiles.0[0].1.grants.push(grant);
+
+        let alternative_inputs = config.sources.0[0]
+            .1
+            .request
+            .selector_inputs
+            .iter()
+            .cloned()
+            .map(|mut input| {
+                input.role = "alternate-subject".to_owned();
+                input
+            })
+            .collect::<Vec<_>>();
+        config.sources.0[0]
+            .1
+            .request
+            .selector_inputs
+            .extend(alternative_inputs);
+        config.requirements.push(alternative);
+
+        config
+            .validate()
+            .expect("mutually exclusive role sets may reuse fixed placements");
+        assert_eq!(
+            config.source_selector_sets("source-a"),
+            vec![
+                vec![(
+                    "alternate-subject".to_owned(),
+                    "person-demographics-v1".to_owned()
+                )],
+                vec![("subject".to_owned(), "person-demographics-v1".to_owned())]
+            ]
+        );
+    }
+
+    #[test]
+    fn one_trust_domain_and_native_token_identity_are_closed_configuration() {
+        let valid = std::str::from_utf8(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ))
+        .expect("fixture is UTF-8");
+        let invalid = valid.replacen(
+            "service: {providerId: urn:example:fixture:provider:evidence, trustDomain: urn:example:fixture:trust-domain:acceptance}",
+            "service: {providerId: urn:example:fixture:provider:evidence, trustDomains: [urn:example:fixture:trust-domain:a, urn:example:fixture:trust-domain:b]}",
+            1,
+        );
+        assert_ne!(invalid, valid, "fixture mutation must remain effective");
+        assert!(EvidenceConfig::parse_yaml(invalid.as_bytes()).is_err());
+    }
+
+    #[test]
+    fn source_urls_reject_insecure_aliases_and_ambiguous_numeric_hosts() {
+        for valid in [
+            "https://source.invalid",
+            "http://127.0.0.1:18081",
+            "http://127.42.5.9",
+            "http://[::1]:18083",
+        ] {
+            assert!(validate_source_origin(valid).is_ok(), "{valid}");
+        }
+        for invalid in [
+            "http://localhost:18081",
+            "http://127.1:18081",
+            "http://127.00.0.1:18081",
+            "http://192.168.1.2",
+            "https://user@source.invalid",
+            "https://source.invalid/path",
+            "https://source.invalid#fragment",
+        ] {
+            assert!(validate_source_origin(invalid).is_err(), "{invalid}");
+        }
+    }
+
+    #[test]
+    fn source_adapter_name_is_audit_safe_and_oauth_endpoint_has_no_query() {
+        let valid = std::str::from_utf8(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ))
+        .expect("fixture is UTF-8");
+
+        let uppercase_adapter = valid.replace(
+            "extractScript: adapters/source-a.rhai",
+            "extractScript: adapters/Source-a.rhai",
+        );
+        assert_eq!(
+            EvidenceConfig::parse_yaml(uppercase_adapter.as_bytes()),
+            Err(ConfigError::Invalid(
+                "source adapter name must be a local identifier"
+            ))
+        );
+
+        for query in [
+            "?client_secret=plaintext",
+            "?client_id=duplicate",
+            "?fixed=true",
+        ] {
+            let mut oauth =
+                EvidenceConfig::parse_yaml(valid.as_bytes()).expect("fixture validates");
+            oauth.sources.0[0].1.authentication = SourceAuthentication::Oauth2ClientCredentials {
+                token_endpoint: format!("https://source.invalid/token{query}"),
+                client_id_ref: SecretRef::parse("secret:file/oauth-client-id").expect("secret ref"),
+                client_secret_ref: SecretRef::parse("secret:file/oauth-client-secret")
+                    .expect("secret ref"),
+                scope: None,
+                credential_placement: CredentialPlacement::FormBody,
+                maximum_cache_seconds: 60,
+                assumed_lifetime_seconds: None,
+            };
+            assert_eq!(
+                oauth.validate(),
+                Err(ConfigError::Invalid(
+                    "OAuth token endpoint must not contain a query"
+                )),
+                "{query}"
+            );
+        }
+    }
+
+    /// The assumed lifetime is a governed positive duration, so a zero or
+    /// oversized value is a configuration error rather than a silent clamp.
+    #[test]
+    fn oauth_assumed_token_lifetime_is_a_bounded_positive_duration() {
+        let valid = std::str::from_utf8(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ))
+        .expect("fixture is UTF-8");
+
+        for (assumed_lifetime_seconds, expected) in [
+            (
+                Some(0),
+                Err(ConfigError::Invalid(
+                    "numeric value is outside Version 1 bounds",
+                )),
+            ),
+            (Some(1), Ok(())),
+            (Some(86_400), Ok(())),
+            (
+                Some(86_401),
+                Err(ConfigError::Invalid(
+                    "numeric value is outside Version 1 bounds",
+                )),
+            ),
+            (None, Ok(())),
+        ] {
+            let mut oauth =
+                EvidenceConfig::parse_yaml(valid.as_bytes()).expect("fixture validates");
+            oauth.sources.0[0].1.authentication = SourceAuthentication::Oauth2ClientCredentials {
+                token_endpoint: "https://source.invalid/token".to_owned(),
+                client_id_ref: SecretRef::parse("secret:file/oauth-client-id").expect("secret ref"),
+                client_secret_ref: SecretRef::parse("secret:file/oauth-client-secret")
+                    .expect("secret ref"),
+                scope: None,
+                credential_placement: CredentialPlacement::FormBody,
+                maximum_cache_seconds: 60,
+                assumed_lifetime_seconds,
+            };
+            assert_eq!(oauth.validate(), expected, "{assumed_lifetime_seconds:?}");
+        }
+    }
+
+    /// Query-string placement puts the client id and secret in a URL that
+    /// authorization-server, proxy, and ingress logs capture, and RFC 6749
+    /// section 2.3.1 requires those parameters to travel in the request body.
+    /// Version 1 accepts only the two placements the specification defines,
+    /// and the runtime and the published contract must agree on that.
+    #[test]
+    fn oauth_credential_placement_rejects_the_query_string_placement() {
+        let validator = bundle_contract_validator();
+        for (placement, accepted) in [
+            ("basic-header", true),
+            ("form-body", true),
+            ("query-string", false),
+        ] {
+            let authentication = serde_json::json!({
+                "kind": "oauth2-client-credentials",
+                "tokenEndpoint": "https://source.invalid/token",
+                "clientIdRef": "secret:file/oauth-client-id",
+                "clientSecretRef": "secret:file/oauth-client-secret",
+                "credentialPlacement": placement,
+                "maximumCacheSeconds": 60,
+            });
+            assert_eq!(
+                serde_json::from_value::<SourceAuthentication>(authentication.clone()).is_ok(),
+                accepted,
+                "{placement} runtime deserialization"
+            );
+
+            let mut instance = bundle_contract_instance(include_bytes!(
+                "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+            ));
+            instance["sources"]["source-a"]["authentication"] = authentication;
+            assert_eq!(
+                validator.is_valid(&instance),
+                accepted,
+                "{placement} bundle contract"
+            );
+        }
+    }
+
+    #[test]
+    fn get_sources_must_forbid_the_json_body_channel() {
+        let mut config = EvidenceConfig::parse_yaml(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ))
+        .expect("fixture validates");
+        config.sources.0[0].1.request.method = HttpMethod::GET;
+        assert_eq!(
+            config.validate(),
+            Err(ConfigError::Invalid(
+                "GET source requests must forbid the JSON body channel"
+            ))
+        );
+
+        let validator = bundle_contract_validator();
+        let mut instance = bundle_contract_instance(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ));
+        instance["sources"]["source-a"]["request"]["method"] = serde_json::json!("GET");
+        assert!(!validator.is_valid(&instance));
+    }
+
+    #[test]
+    fn a_shared_disclosure_family_rejects_the_complete_bundle() {
+        let mut config = EvidenceConfig::parse_yaml(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ))
+        .expect("fixture validates");
+        let mut duplicate = config.requirements[0].clone();
+        duplicate.id = "urn:example:fixture:requirement:other:v1".to_owned();
+        duplicate.evidence_type = "urn:example:fixture:evidence-type:other:v1".to_owned();
+        duplicate.derivation.script =
+            ArtifactPath::parse("derivations/other.rhai").expect("artifact path");
+        duplicate.concepts[0].id = "urn:example:fixture:concept:other".to_owned();
+        config.requirements.push(duplicate);
+        assert_eq!(
+            config.validate(),
+            Err(ConfigError::Invalid(
+                "enabled requirements share a disclosure family"
+            ))
+        );
+    }
+
+    #[test]
+    fn runtime_document_is_closed_and_contains_no_governed_override_surface() {
+        let valid = br#"
+version: 1
+bundleDirectory: /etc/registry-evidence/bundle
+listener:
+  bindHost: 127.0.0.1
+  port: 8080
+  tlsTermination: operator-controlled-upstream
+  trustProxyIdentityHeaders: false
+  maximumRequestBytes: 65536
+  maximumConcurrentRequests: 64
+  requestTimeoutMilliseconds: 10000
+  shutdownGraceMilliseconds: 30000
+secretProviders:
+  file: {root: /run/secrets/registry-evidence}
+auditStorage:
+  path: /var/lib/registry-evidence/audit/evidence.jsonl
+  maximumFileBytes: 1073741824
+outboundTls:
+  systemRoots: true
+  trustProfiles:
+    internal-pki: {caBundleFile: /etc/registry-evidence/ca/internal.pem}
+"#;
+        RuntimeConfig::parse_yaml(valid).expect("closed runtime parses");
+        let validator = runtime_contract_validator();
+        assert!(validator.is_valid(&bundle_contract_instance(valid)));
+        for reference in [
+            include_bytes!("../../../products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/runtime.yaml").as_slice(),
+            include_bytes!("../../../products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/runtime.yaml").as_slice(),
+        ] {
+            assert!(validator.is_valid(&bundle_contract_instance(reference)));
+            RuntimeConfig::parse_yaml(reference).expect("reference runtime matches Rust contract");
+        }
+        for rejected_host in ["evidence.internal", "0.0.0.0", "8.8.8.8", "ff02::1"] {
+            let candidate = String::from_utf8(valid.to_vec())
+                .expect("runtime fixture is UTF-8")
+                .replace("bindHost: 127.0.0.1", &format!("bindHost: {rejected_host}"));
+            assert!(
+                RuntimeConfig::parse_yaml(candidate.as_bytes()).is_err(),
+                "runtime accepted prohibited bindHost {rejected_host}"
+            );
+        }
+        for governed_key in [
+            "service",
+            "issuer",
+            "authentication",
+            "audit",
+            "subjectBinding",
+            "rateLimits",
+            "signing",
+            "selectorProfiles",
+            "sources",
+            "authorityProfiles",
+            "requirements",
+        ] {
+            let mut candidate = valid.to_vec();
+            candidate.extend_from_slice(format!("{governed_key}: {{}}\n").as_bytes());
+            let rejection = RuntimeConfig::parse_yaml(&candidate)
+                .expect_err("runtime accepted governed bundle key {governed_key}");
+            let ConfigError::InvalidYaml(fault) = &rejection else {
+                panic!("runtime accepted governed bundle key {governed_key}: {rejection}");
+            };
+            assert_eq!(
+                fault.cause(),
+                "unknown field",
+                "governed bundle key {governed_key} was rejected for the wrong reason"
+            );
+            assert!(
+                fault.location().is_some(),
+                "governed bundle key {governed_key} was rejected without a location"
+            );
+            assert!(
+                !validator.is_valid(&bundle_contract_instance(&candidate)),
+                "runtime schema accepted governed bundle key {governed_key}"
+            );
+        }
+    }
+
+    /// The metrics listener is opt-in operator surface. It must be absent
+    /// unless an operator asks for it, must obey the same private-address rule
+    /// as the evidence listener, and must not be able to reuse the evidence
+    /// binding, which would publish counters on the contract listener.
+    #[test]
+    fn the_optional_metrics_listener_is_absent_by_default_and_stays_operator_private() {
+        let base = r#"
+version: 1
+bundleDirectory: /etc/registry-evidence/bundle
+listener:
+  bindHost: 127.0.0.1
+  port: 8080
+  tlsTermination: operator-controlled-upstream
+  trustProxyIdentityHeaders: false
+  maximumRequestBytes: 65536
+  maximumConcurrentRequests: 64
+  requestTimeoutMilliseconds: 10000
+  shutdownGraceMilliseconds: 30000
+secretProviders:
+  file: {root: /run/secrets/registry-evidence}
+auditStorage:
+  path: /var/lib/registry-evidence/audit/evidence.jsonl
+  maximumFileBytes: 1073741824
+outboundTls:
+  systemRoots: true
+  trustProfiles: {}
+"#;
+        let validator = runtime_contract_validator();
+        let default = RuntimeConfig::parse_yaml(base.as_bytes()).expect("closed runtime parses");
+        assert!(
+            default.metrics_listener.is_none(),
+            "a deployment that asked for no metrics listener must not get one"
+        );
+
+        let configured = format!("{base}metricsListener:\n  bindHost: 127.0.0.1\n  port: 9090\n");
+        assert!(validator.is_valid(&bundle_contract_instance(configured.as_bytes())));
+        let parsed =
+            RuntimeConfig::parse_yaml(configured.as_bytes()).expect("metrics listener parses");
+        let metrics = parsed
+            .metrics_listener
+            .expect("the configured metrics listener is retained");
+        assert_eq!(metrics.bind_host, "127.0.0.1");
+        assert_eq!(metrics.port, 9090);
+
+        for rejected_host in ["evidence.internal", "0.0.0.0", "8.8.8.8", "ff02::1"] {
+            let candidate =
+                format!("{base}metricsListener:\n  bindHost: {rejected_host}\n  port: 9090\n");
+            assert!(
+                RuntimeConfig::parse_yaml(candidate.as_bytes()).is_err(),
+                "metrics listener accepted prohibited bindHost {rejected_host}"
+            );
+        }
+
+        // Reusing the evidence binding would put the counters on the listener
+        // the public contract describes.
+        let shared = format!("{base}metricsListener:\n  bindHost: 127.0.0.1\n  port: 8080\n");
+        assert!(matches!(
+            RuntimeConfig::parse_yaml(shared.as_bytes()),
+            Err(ConfigError::Invalid(
+                "metricsListener must not share the evidence listener binding"
+            ))
+        ));
+
+        // The block is closed like every other level of the document.
+        let unknown = format!(
+            "{base}metricsListener:\n  bindHost: 127.0.0.1\n  port: 9090\n  path: /telemetry\n"
+        );
+        assert!(RuntimeConfig::parse_yaml(unknown.as_bytes()).is_err());
+        assert!(!validator.is_valid(&bundle_contract_instance(unknown.as_bytes())));
+    }
+
+    /// Port 0 is not a port. The kernel picks an arbitrary one, so the socket an
+    /// operator firewalls, health-checks, and puts behind their TLS terminator
+    /// is not the socket the service opens, and it changes on every restart.
+    /// The published runtime schema already forbids it on both listeners; the
+    /// loader accepting it meant a deployment could pass the documented contract
+    /// check and still come up on an address nobody configured. On the metrics
+    /// listener it also defeats the binding-collision refusal, which compares
+    /// configured ports rather than bound ones.
+    #[test]
+    fn a_listener_port_of_zero_is_refused_on_both_listeners() {
+        let base = r#"
+version: 1
+bundleDirectory: /etc/registry-evidence/bundle
+listener:
+  bindHost: 127.0.0.1
+  port: 8080
+  tlsTermination: operator-controlled-upstream
+  trustProxyIdentityHeaders: false
+  maximumRequestBytes: 65536
+  maximumConcurrentRequests: 64
+  requestTimeoutMilliseconds: 10000
+  shutdownGraceMilliseconds: 30000
+secretProviders:
+  file: {root: /run/secrets/registry-evidence}
+auditStorage:
+  path: /var/lib/registry-evidence/audit/evidence.jsonl
+  maximumFileBytes: 1073741824
+outboundTls:
+  systemRoots: true
+  trustProfiles: {}
+"#;
+        let validator = runtime_contract_validator();
+        RuntimeConfig::parse_yaml(base.as_bytes()).expect("the configured ports load");
+
+        let ephemeral_evidence = base.replace("port: 8080", "port: 0");
+        assert!(
+            RuntimeConfig::parse_yaml(ephemeral_evidence.as_bytes()).is_err(),
+            "the evidence listener accepted an ephemeral port"
+        );
+        assert!(
+            !validator.is_valid(&bundle_contract_instance(ephemeral_evidence.as_bytes())),
+            "the published schema must already refuse this, so Rust is matching it"
+        );
+
+        let ephemeral_metrics =
+            format!("{base}metricsListener:\n  bindHost: 127.0.0.1\n  port: 0\n");
+        assert!(
+            RuntimeConfig::parse_yaml(ephemeral_metrics.as_bytes()).is_err(),
+            "the metrics listener accepted an ephemeral port"
+        );
+        assert!(!validator.is_valid(&bundle_contract_instance(ephemeral_metrics.as_bytes())));
+
+        // Both at zero would compare equal and trip the collision rule instead,
+        // so the port rule has to be the one that fires.
+        let both = format!(
+            "{}metricsListener:\n  bindHost: 127.0.0.1\n  port: 0\n",
+            base.replace("port: 8080", "port: 0")
+        );
+        assert!(RuntimeConfig::parse_yaml(both.as_bytes()).is_err());
+    }
+
+    #[test]
+    fn path_templates_headers_and_projection_fail_closed() {
+        let bindings: OrderedMap<PathBindingConfig> = serde_norway::from_str(
+            "record_reference: {role: subject, profile: record-reference-v1, field: record_reference}\n",
+        )
+        .expect("path binding parses");
+        assert!(validate_path_template("/records/{record_reference}", &bindings).is_ok());
+        for invalid_template in [
+            "/records/{record_reference}/",
+            "/records/prefix-{record_reference}",
+            "/records/{missing}",
+            "/records/../{record_reference}",
+            "/records/{record_reference}/{record_reference}",
+        ] {
+            assert!(validate_path_template(invalid_template, &bindings).is_err());
+        }
+
+        assert!(validate_configurable_header_name("X-API-Version").is_ok());
+        for forbidden in RESERVED_HEADER_CONTRACT_CASES {
+            assert!(
+                validate_configurable_header_name(forbidden).is_err(),
+                "{forbidden}"
+            );
+        }
+
+        assert!(validate_projection(&[
+            "/total".to_owned(),
+            "/results/*/status".to_owned(),
+            "/declaration/mother.personReference".to_owned(),
+        ])
+        .is_ok());
+        for paths in [
+            vec!["/results".to_owned(), "/results/*/status".to_owned()],
+            vec![
+                "/results/*/status".to_owned(),
+                "/results/0/status".to_owned(),
+            ],
+            vec!["/bad/~2escape".to_owned()],
+        ] {
+            assert!(validate_projection(&paths).is_err());
+        }
+    }
+
+    #[test]
+    fn path_based_https_oidc_issuer_is_preserved_exactly() {
+        let mut config = EvidenceConfig::parse_yaml(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ))
+        .expect("fixture validates");
+        config.authentication.issuer = "https://identity.example.test/realms/registry".to_owned();
+        assert!(config.validate().is_ok());
+        config.authentication.issuer.push_str("?tenant=wrong");
+        assert!(config.validate().is_err());
+    }
+
+    #[test]
+    fn file_secret_references_are_the_only_governed_secret_form() {
+        assert!(SecretRef::parse("secret:file/source-token").is_ok());
+        assert!(SecretRef::parse("secret:env/SOURCE_TOKEN").is_err());
+        assert!(SecretRef::parse("literal-token").is_err());
+    }
+}
diff --git a/crates/registry-evidence/src/contracts.rs b/crates/registry-evidence/src/contracts.rs
new file mode 100644
index 000000000..8ac58518d
--- /dev/null
+++ b/crates/registry-evidence/src/contracts.rs
@@ -0,0 +1,1517 @@
+//! Deterministic public-contract generation for Evidence Version 1.
+//!
+//! The generated files are release artifacts. This module is their only
+//! source and deliberately has no dependency on a deployment bundle.
+
+use std::{
+    collections::BTreeMap,
+    fs,
+    path::{Path, PathBuf},
+    sync::OnceLock,
+};
+
+use jsonschema::{Draft, JSONSchema};
+use schemars::JsonSchema;
+use serde_json::{json, Value};
+use thiserror::Error;
+
+use crate::model::{
+    Evidence, EvidenceDefinitions, EvidenceRequest, FlattenedJws, JwksDocument, ProblemBody,
+    UnsignedEvidenceEnvelope,
+};
+
+pub const OPENAPI_FILE: &str = "registry-evidence.openapi.json";
+pub const REQUEST_SCHEMA_FILE: &str = "evidence-request-v1.schema.json";
+pub const EVIDENCE_SCHEMA_FILE: &str = "evidence-v1.schema.json";
+pub const DEFINITIONS_SCHEMA_FILE: &str = "evidence-definitions-v1.schema.json";
+pub const JWS_SCHEMA_FILE: &str = "flattened-jws-v1.schema.json";
+pub const UNSIGNED_ENVELOPE_SCHEMA_FILE: &str = "evidence-unsigned-envelope-v1.schema.json";
+pub const PROBLEM_SCHEMA_FILE: &str = "problem-v1.schema.json";
+pub const JWKS_SCHEMA_FILE: &str = "jwks-v1.schema.json";
+
+const SCHEMA_DIALECT: &str = "https://json-schema.org/draft/2020-12/schema";
+const REQUEST_SCHEMA_ID: &str = "https://registrystack.org/schemas/evidence/request-v1.json";
+const EVIDENCE_SCHEMA_ID: &str =
+    "https://registrystack.org/schemas/evidence/assertion-evidence-v1.json";
+const DEFINITIONS_SCHEMA_ID: &str =
+    "https://registrystack.org/schemas/evidence/definitions-v1.json";
+const JWS_SCHEMA_ID: &str = "https://registrystack.org/schemas/evidence/flattened-jws-v1.json";
+const UNSIGNED_ENVELOPE_SCHEMA_ID: &str =
+    "https://registrystack.org/schemas/evidence/unsigned-envelope-v1.json";
+const PROBLEM_SCHEMA_ID: &str = "https://registrystack.org/schemas/evidence/problem-v1.json";
+const JWKS_SCHEMA_ID: &str = "https://registrystack.org/schemas/evidence/jwks-v1.json";
+const REQUEST_NONCE_PATTERN: &str = "^[A-Za-z0-9_-]{43}$";
+/// Shape of the server-minted operation identifier, shared by the response
+/// header and the problem member so the two cannot describe different values.
+const OPERATION_PATTERN: &str = "^[0-9A-HJKMNP-TV-Z]{26}$";
+/// Unpadded base64url encoding of exactly one 32-byte Ed25519 public key.
+const HOLDER_KEY_COORDINATE_PATTERN: &str = "^[A-Za-z0-9_-]{43}$";
+const PROBLEM_VARIANTS: [(&str, u16, &str); 9] = [
+    ("malformed_request", 400, "Request is not valid"),
+    ("invalid_selector", 400, "Request is not valid"),
+    ("authentication_failed", 401, "Authentication failed"),
+    ("not_authorized", 403, "Request is not authorized"),
+    (
+        "response_format_not_acceptable",
+        406,
+        "Requested response format is not acceptable",
+    ),
+    (
+        "evidence_not_available",
+        422,
+        "Evidence could not be produced",
+    ),
+    ("rate_limited", 429, "Request rate exceeded"),
+    (
+        "dependency_unavailable",
+        503,
+        "Service temporarily unavailable",
+    ),
+    (
+        "service_unavailable",
+        503,
+        "Service temporarily unavailable",
+    ),
+];
+
+static SERVED_OPENAPI: OnceLock<Option<String>> = OnceLock::new();
+static REQUEST_VALIDATOR: OnceLock<Result<JSONSchema, ContractValidationError>> = OnceLock::new();
+static EVIDENCE_VALIDATOR: OnceLock<Result<JSONSchema, ContractValidationError>> = OnceLock::new();
+static DEFINITIONS_VALIDATOR: OnceLock<Result<JSONSchema, ContractValidationError>> =
+    OnceLock::new();
+
+#[derive(Debug, Error, Clone, Copy, PartialEq, Eq)]
+#[error("built-in public contract schema failed to initialize")]
+pub(crate) struct ContractValidationError;
+
+#[derive(Debug, Error)]
+pub enum ContractGenerationError {
+    #[error("generated contract serialization failed")]
+    Serialization(#[from] serde_json::Error),
+    #[error("generated contract output failed at {path}")]
+    Output {
+        path: PathBuf,
+        #[source]
+        source: std::io::Error,
+    },
+    #[error("generated contract no longer matches the public Rust wire type {type_name}")]
+    ModelDrift { type_name: &'static str },
+}
+
+/// Generate every committed public contract, keyed by its stable filename.
+pub fn documents() -> Result<BTreeMap<&'static str, String>, ContractGenerationError> {
+    let request = request_schema();
+    let evidence = evidence_schema();
+    let definitions = definitions_schema();
+    let jws = jws_schema();
+    let unsigned = unsigned_envelope_schema();
+    let problem = problem_schema();
+    let jwks = jwks_schema();
+    assert_model_shape::<EvidenceRequest>("EvidenceRequest", &request, true)?;
+    assert_model_shape::<Evidence>("Evidence", &evidence, true)?;
+    assert_model_shape::<EvidenceDefinitions>("EvidenceDefinitions", &definitions, true)?;
+    assert_model_shape::<FlattenedJws>("FlattenedJws", &jws, false)?;
+    assert_model_shape::<UnsignedEvidenceEnvelope>("UnsignedEvidenceEnvelope", &unsigned, false)?;
+    assert_model_shape::<ProblemBody>("ProblemBody", &problem, false)?;
+    assert_model_shape::<JwksDocument>("JwksDocument", &jwks, false)?;
+    let openapi = openapi_document(
+        &request,
+        &evidence,
+        &definitions,
+        &jws,
+        &unsigned,
+        &problem,
+        &jwks,
+    );
+
+    let values = [
+        (REQUEST_SCHEMA_FILE, request),
+        (EVIDENCE_SCHEMA_FILE, evidence),
+        (DEFINITIONS_SCHEMA_FILE, definitions),
+        (JWS_SCHEMA_FILE, jws),
+        (UNSIGNED_ENVELOPE_SCHEMA_FILE, unsigned),
+        (PROBLEM_SCHEMA_FILE, problem),
+        (JWKS_SCHEMA_FILE, jwks),
+        (OPENAPI_FILE, openapi),
+    ];
+    values
+        .into_iter()
+        .map(|(name, value)| Ok((name, pretty_json(&value)?)))
+        .collect()
+}
+
+/// Write all generated contracts to an otherwise caller-owned directory.
+pub fn write_documents(output: &Path) -> Result<(), ContractGenerationError> {
+    fs::create_dir_all(output).map_err(|source| ContractGenerationError::Output {
+        path: output.to_path_buf(),
+        source,
+    })?;
+    for (name, contents) in documents()? {
+        let path = output.join(name);
+        fs::write(&path, contents)
+            .map_err(|source| ContractGenerationError::Output { path, source })?;
+    }
+    Ok(())
+}
+
+/// The generated OpenAPI document the running service publishes.
+///
+/// It is built once from the same generator as [`documents`], so the served
+/// description is the committed release artifact and cannot drift from it.
+pub(crate) fn served_openapi_document() -> Option<&'static str> {
+    SERVED_OPENAPI
+        .get_or_init(|| {
+            pretty_json(&openapi_document(
+                &request_schema(),
+                &evidence_schema(),
+                &definitions_schema(),
+                &jws_schema(),
+                &unsigned_envelope_schema(),
+                &problem_schema(),
+                &jwks_schema(),
+            ))
+            .ok()
+        })
+        .as_deref()
+}
+
+/// Validate an inbound public request against the exact generated Version 1 schema.
+pub(crate) fn request_contract_accepts(value: &Value) -> Result<bool, ContractValidationError> {
+    contract_validator(&REQUEST_VALIDATOR, request_schema)
+        .map(|validator| validator.is_valid(value))
+}
+
+/// Validate a verified JWS payload against the exact generated Version 1 schema.
+pub(crate) fn evidence_contract_accepts(value: &Value) -> Result<bool, ContractValidationError> {
+    contract_validator(&EVIDENCE_VALIDATOR, evidence_schema)
+        .map(|validator| validator.is_valid(value))
+}
+
+/// Validate an outbound discovery response against the exact generated
+/// Version 1 schema.
+pub(crate) fn definitions_contract_accepts(value: &Value) -> Result<bool, ContractValidationError> {
+    contract_validator(&DEFINITIONS_VALIDATOR, definitions_schema)
+        .map(|validator| validator.is_valid(value))
+}
+
+fn contract_validator(
+    cell: &'static OnceLock<Result<JSONSchema, ContractValidationError>>,
+    schema: fn() -> Value,
+) -> Result<&'static JSONSchema, ContractValidationError> {
+    match cell.get_or_init(|| {
+        JSONSchema::options()
+            .with_draft(Draft::Draft202012)
+            .should_validate_formats(true)
+            .compile(&schema())
+            .map_err(|_| ContractValidationError)
+    }) {
+        Ok(validator) => Ok(validator),
+        Err(error) => Err(*error),
+    }
+}
+
+fn assert_model_shape<T: JsonSchema>(
+    type_name: &'static str,
+    contract: &Value,
+    compare_nested_properties: bool,
+) -> Result<(), ContractGenerationError> {
+    let derived = serde_json::to_value(schemars::schema_for!(T))?;
+    let matches = if compare_nested_properties {
+        property_groups(&derived) == property_groups(contract)
+    } else {
+        root_properties(&derived) == root_properties(contract)
+    };
+    if matches {
+        Ok(())
+    } else {
+        Err(ContractGenerationError::ModelDrift { type_name })
+    }
+}
+
+fn root_properties(value: &Value) -> Vec<String> {
+    value
+        .get("properties")
+        .and_then(Value::as_object)
+        .map(|properties| properties.keys().cloned().collect())
+        .unwrap_or_default()
+}
+
+fn property_groups(value: &Value) -> Vec<Vec<String>> {
+    fn visit(value: &Value, groups: &mut Vec<Vec<String>>) {
+        match value {
+            Value::Array(values) => {
+                for value in values {
+                    visit(value, groups);
+                }
+            }
+            Value::Object(object) => {
+                if let Some(properties) = object.get("properties").and_then(Value::as_object) {
+                    groups.push(properties.keys().cloned().collect());
+                }
+                for value in object.values() {
+                    visit(value, groups);
+                }
+            }
+            _ => {}
+        }
+    }
+
+    let mut groups = Vec::new();
+    visit(value, &mut groups);
+    groups.sort();
+    groups
+}
+
+fn pretty_json(value: &Value) -> Result<String, serde_json::Error> {
+    let mut rendered = serde_json::to_string_pretty(value)?;
+    rendered.push('\n');
+    Ok(rendered)
+}
+
+fn request_schema() -> Value {
+    json!({
+        "$schema": SCHEMA_DIALECT,
+        "$id": REQUEST_SCHEMA_ID,
+        "title": "Evidence request Version 1",
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["requestNonce", "requirement", "purpose", "subjects"],
+        "properties": {
+            "requestNonce": {"type": "string", "pattern": REQUEST_NONCE_PATTERN},
+            "requirement": {"type": "string", "format": "uri", "minLength": 1, "maxLength": 512},
+            "purpose": {"type": "string", "pattern": "^[a-z][a-z0-9._:-]{0,127}$"},
+            "subjects": {
+                "type": "array", "minItems": 1, "maxItems": 8,
+                "items": {"$ref": "#/$defs/subject"}
+            },
+            "holderKey": {"$ref": "#/$defs/holder-key"}
+        },
+        "$defs": {
+            "subject": {
+                "type": "object", "additionalProperties": false,
+                "required": ["role", "selector"],
+                "properties": {
+                    "role": {"type": "string", "pattern": "^[a-z][a-z0-9._-]{0,63}$"},
+                    "selector": {"$ref": "#/$defs/selector"}
+                }
+            },
+            "selector": {
+                "type": "object", "additionalProperties": false,
+                "required": ["profile"],
+                "properties": {
+                    "profile": {"type": "string", "pattern": "^[a-z][a-z0-9._-]{0,127}$"},
+                    "values": {
+                        "type": "object", "minProperties": 1, "maxProperties": 16,
+                        "propertyNames": {"type": "string", "pattern": "^[a-z][a-z0-9._-]{0,63}$"},
+                        "additionalProperties": {"$ref": "#/$defs/scalar-selector-value"}
+                    }
+                }
+            },
+            "scalar-selector-value": {
+                "oneOf": [
+                    {"type": "string", "minLength": 1, "maxLength": 512},
+                    {"type": "integer", "minimum": -9007199254740991_i64, "maximum": 9007199254740991_i64},
+                    {"type": "boolean"}
+                ]
+            },
+            "holder-key": {
+                "type": "object", "additionalProperties": false,
+                "required": ["kty", "crv", "x"],
+                "properties": {
+                    "kty": {"type": "string", "enum": ["OKP"]},
+                    "crv": {"type": "string", "enum": ["Ed25519"]},
+                    "x": {"type": "string", "pattern": HOLDER_KEY_COORDINATE_PATTERN},
+                    "alg": {"type": "string", "enum": ["EdDSA"]},
+                    "kid": {"type": "string", "minLength": 1, "maxLength": 256}
+                }
+            }
+        },
+        "$comment": "Named selector-profile validation follows this transport schema. The profile closes exact field names, scalar types, bounds, aggregate size, value origin, and source placements. Invalid selector material fails before credential acquisition or source access. requestNonce is the canonical unpadded base64url encoding of exactly 32 independently generated random bytes; a noncanonical final symbol is rejected by the runtime. Callers must not encode identifiers, selectors, secrets, or document digests into it. holderKey is meaningful only for the SD-JWT VC response format, where it is echoed into the cnf claim; it never reaches authorization, selectors, Rhai, source requests, or audit, and a key carrying any private member is rejected before credential acquisition or source access."
+    })
+}
+
+fn definitions_schema() -> Value {
+    json!({
+        "$schema": SCHEMA_DIALECT,
+        "$id": DEFINITIONS_SCHEMA_ID,
+        "title": "Requester-scoped Evidence definitions Version 1",
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+            "schema", "assuranceProfile", "configurationRevision", "issuedBy", "providedBy", "definitions"
+        ],
+        "properties": {
+            "schema": {"const": "registry.evidence-definitions/v1"},
+            "assuranceProfile": {"enum": ["local", "production", "evidence-grade"]},
+            "configurationRevision": {"type": "string", "pattern": "^sha256:[a-f0-9]{64}$"},
+            "issuedBy": {"type": "string", "format": "uri", "maxLength": 512},
+            "providedBy": {"type": "string", "format": "uri", "maxLength": 512},
+            "definitions": {
+                "type": "array", "maxItems": 16384, "uniqueItems": true,
+                "items": {"$ref": "#/$defs/definition"}
+            }
+        },
+        "$defs": {
+            "definition": {
+                "type": "object", "additionalProperties": false,
+                "required": [
+                    "requirement", "kind", "evidenceType", "purpose",
+                    "referenceFrameworks", "subjects", "concepts"
+                ],
+                "properties": {
+                    "requirement": {"type": "string", "format": "uri", "maxLength": 512},
+                    "kind": {"enum": ["criterion", "information-requirement", "constraint"]},
+                    "evidenceType": {"type": "string", "format": "uri", "maxLength": 512},
+                    "purpose": {"type": "string", "pattern": "^[a-z][a-z0-9._:-]{0,127}$"},
+                    "referenceFrameworks": {
+                        "type": "array", "minItems": 1, "maxItems": 16, "uniqueItems": true,
+                        "items": {"type": "string", "format": "uri", "maxLength": 512}
+                    },
+                    "subjects": {
+                        "type": "array", "minItems": 1, "maxItems": 8, "uniqueItems": true,
+                        "items": {"$ref": "#/$defs/subject"}
+                    },
+                    "concepts": {
+                        "type": "array", "minItems": 1, "maxItems": 16, "uniqueItems": true,
+                        "items": {"$ref": "#/$defs/concept"}
+                    }
+                }
+            },
+            "subject": {
+                "type": "object", "additionalProperties": false,
+                "required": ["role", "cardinality", "selector"],
+                "properties": {
+                    "role": {"type": "string", "pattern": "^[a-z][a-z0-9._-]{0,63}$"},
+                    "cardinality": {"const": "one"},
+                    "selector": {"$ref": "#/$defs/selector"}
+                }
+            },
+            "selector": {
+                "type": "object", "additionalProperties": false,
+                "required": ["profile", "valueOrigin", "fields"],
+                "properties": {
+                    "profile": {"type": "string", "pattern": "^[a-z][a-z0-9._-]{0,127}$"},
+                    "valueOrigin": {"enum": ["request", "authenticated-context", "authenticated-grant"]},
+                    "fields": {
+                        "type": "array", "minItems": 1, "maxItems": 16, "uniqueItems": true,
+                        "items": {"$ref": "#/$defs/selector-field"}
+                    }
+                }
+            },
+            "selector-field": {
+                "oneOf": [
+                    {
+                        "type": "object", "additionalProperties": false,
+                        "required": ["type", "name", "minimumBytes", "maximumBytes"],
+                        "properties": {
+                            "type": {"const": "string"},
+                            "name": {"type": "string", "pattern": "^[a-z][a-z0-9._-]{0,63}$"},
+                            "minimumBytes": {"type": "integer", "minimum": 1, "maximum": 8192},
+                            "maximumBytes": {"type": "integer", "minimum": 1, "maximum": 8192}
+                        }
+                    },
+                    {
+                        "type": "object", "additionalProperties": false,
+                        "required": ["type", "name"],
+                        "properties": {
+                            "type": {"const": "date"},
+                            "name": {"type": "string", "pattern": "^[a-z][a-z0-9._-]{0,63}$"}
+                        }
+                    },
+                    {
+                        "type": "object", "additionalProperties": false,
+                        "required": ["type", "name", "minimum", "maximum"],
+                        "properties": {
+                            "type": {"const": "integer"},
+                            "name": {"type": "string", "pattern": "^[a-z][a-z0-9._-]{0,63}$"},
+                            "minimum": {"type": "integer", "minimum": -9007199254740991_i64, "maximum": 9007199254740991_i64},
+                            "maximum": {"type": "integer", "minimum": -9007199254740991_i64, "maximum": 9007199254740991_i64}
+                        }
+                    },
+                    {
+                        "type": "object", "additionalProperties": false,
+                        "required": ["type", "name"],
+                        "properties": {
+                            "type": {"const": "boolean"},
+                            "name": {"type": "string", "pattern": "^[a-z][a-z0-9._-]{0,63}$"}
+                        }
+                    },
+                    {
+                        "type": "object", "additionalProperties": false,
+                        "required": ["type", "name", "scheme", "version", "maximumBytes"],
+                        "properties": {
+                            "type": {"const": "controlled-code"},
+                            "name": {"type": "string", "pattern": "^[a-z][a-z0-9._-]{0,63}$"},
+                            "scheme": {"type": "string", "format": "uri", "maxLength": 512},
+                            "version": {"type": "string", "minLength": 1, "maxLength": 128},
+                            "maximumBytes": {"type": "integer", "minimum": 1, "maximum": 8192}
+                        }
+                    }
+                ]
+            },
+            "concept": {
+                "type": "object", "additionalProperties": false,
+                "required": ["id", "form"],
+                "properties": {
+                    "id": {"type": "string", "format": "uri", "maxLength": 512},
+                    "form": {"enum": [
+                        "boolean", "controlled-code", "controlled-category", "bounded-integer",
+                        "bounded-decimal", "date-bucket", "time-bucket",
+                        "audience-scoped-entity-reference", "controlled-code-list",
+                        "entity-reference-list", "reviewed-structured-value"
+                    ]}
+                }
+            }
+        },
+        "$comment": "The authenticated response contains only complete request shapes that match exactly one configured authority path. It never exposes source plans, scripts, credentials, requester tags, authority-profile identifiers, selector values, codelist values, or unrelated definitions."
+    })
+}
+
+fn evidence_schema() -> Value {
+    json!({
+        "$schema": SCHEMA_DIALECT,
+        "$id": EVIDENCE_SCHEMA_ID,
+        "title": "Evidence assertion payload Version 1",
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+            "schema", "assuranceProfile", "requestNonce", "id", "type", "supportsRequirement", "isConformantTo",
+            "issuedBy", "providedBy", "issuedAt", "observedAt", "validUntil",
+            "purpose", "audience", "configurationRevision", "subjects", "supportedValues"
+        ],
+        "properties": {
+            "schema": {"const": "registry.assertion-evidence/v1"},
+            "assuranceProfile": {"enum": ["local", "production", "evidence-grade"]},
+            "requestNonce": {"type": "string", "pattern": REQUEST_NONCE_PATTERN},
+            "id": {"type": "string", "format": "uri", "maxLength": 512},
+            "type": {"const": "Evidence"},
+            "supportsRequirement": {"type": "string", "format": "uri", "maxLength": 512},
+            "isConformantTo": {"type": "string", "format": "uri", "maxLength": 512},
+            "issuedBy": {"type": "string", "format": "uri", "maxLength": 512},
+            "providedBy": {"type": "string", "format": "uri", "maxLength": 512},
+            "issuedAt": {"type": "string", "format": "date-time"},
+            "observedAt": {"type": "string", "format": "date-time"},
+            "validUntil": {"type": "string", "format": "date-time"},
+            "purpose": {"type": "string", "pattern": "^[a-z][a-z0-9._:-]{0,127}$"},
+            "audience": {"type": "string", "format": "uri", "maxLength": 512},
+            "configurationRevision": {"type": "string", "pattern": "^sha256:[a-f0-9]{64}$"},
+            "subjects": {
+                "type": "array", "minItems": 1, "maxItems": 8,
+                "items": {"$ref": "#/$defs/subject-binding"}
+            },
+            "supportedValues": {
+                "type": "array", "minItems": 1, "maxItems": 16,
+                "items": {"$ref": "#/$defs/supported-value"}
+            }
+        },
+        "$defs": {
+            "subject-binding": {
+                "type": "object", "additionalProperties": false,
+                "required": ["role", "binding"],
+                "properties": {
+                    "role": {"type": "string", "pattern": "^[a-z][a-z0-9._-]{0,63}$"},
+                    "binding": {"type": "string", "pattern": "^urn:evidence:subject:v[1-9][0-9]*_[A-Za-z0-9_-]{43}$"}
+                }
+            },
+            "supported-value": {
+                "type": "object", "additionalProperties": false,
+                "required": ["providesValueFor", "value"],
+                "properties": {
+                    "providesValueFor": {"type": "string", "format": "uri", "maxLength": 512},
+                    "value": {"$ref": "#/$defs/value"}
+                }
+            },
+            "value": {
+                "anyOf": [
+                    {"type": "boolean"},
+                    {"type": "integer", "minimum": -9007199254740991_i64, "maximum": 9007199254740991_i64},
+                    {"type": "string", "minLength": 1, "maxLength": 1024},
+                    {"$ref": "#/$defs/bucket"},
+                    {"$ref": "#/$defs/entity-reference"},
+                    {"$ref": "#/$defs/structured"},
+                    {
+                        "type": "array", "minItems": 1, "maxItems": 64,
+                        "items": {"anyOf": [
+                            {"type": "string", "minLength": 1, "maxLength": 1024},
+                            {"$ref": "#/$defs/entity-reference"}
+                        ]}
+                    }
+                ]
+            },
+            "bucket": {
+                "type": "object", "additionalProperties": false,
+                "required": ["form", "scheme", "bucket"],
+                "properties": {
+                    "form": {"enum": ["date-bucket", "time-bucket"]},
+                    "scheme": {"type": "string", "format": "uri", "maxLength": 512},
+                    "bucket": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"}
+                }
+            },
+            "entity-reference": {
+                "type": "object", "additionalProperties": false,
+                "required": ["form", "reference"],
+                "properties": {
+                    "form": {"const": "audience-scoped-entity-reference"},
+                    "reference": {"type": "string", "pattern": "^urn:evidence:entity:v[1-9][0-9]*_[A-Za-z0-9_-]{43}$"}
+                }
+            },
+            "structured": {
+                "type": "object", "additionalProperties": false,
+                "required": ["form", "schema", "fields"],
+                "properties": {
+                    "form": {"const": "reviewed-structured-value"},
+                    "schema": {"type": "string", "format": "uri", "maxLength": 512},
+                    "fields": {"type": "object", "minProperties": 1, "maxProperties": 16}
+                }
+            }
+        },
+        "$comment": "The selected concept declaration further closes value form, schema, codelist, precision, cardinality, structured fields, and uniqueness. Selector profiles and selector values never appear in Evidence."
+    })
+}
+
+fn jws_schema() -> Value {
+    json!({
+        "$schema": SCHEMA_DIALECT,
+        "$id": JWS_SCHEMA_ID,
+        "title": "Evidence flattened JWS response Version 1",
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["protected", "payload", "signature"],
+        "properties": {
+            "protected": {"type": "string", "minLength": 1, "pattern": "^[A-Za-z0-9_-]+$"},
+            "payload": {"type": "string", "minLength": 1, "pattern": "^[A-Za-z0-9_-]+$"},
+            "signature": {"type": "string", "pattern": "^[A-Za-z0-9_-]{86}$"}
+        },
+        "$comment": "Flattened JWS JSON Serialization. The protected header has exactly alg=EdDSA, kid, typ=evidence+jws, and cty=application/evidence+json. The payload is the base64url encoding without padding of exact UTF-8 Evidence JSON bytes."
+    })
+}
+
+fn unsigned_envelope_schema() -> Value {
+    json!({
+        "$schema": SCHEMA_DIALECT,
+        "$id": UNSIGNED_ENVELOPE_SCHEMA_ID,
+        "title": "Evidence unsigned response envelope Version 1",
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["schema", "type", "integrityProtection", "warning", "evidence"],
+        "properties": {
+            "schema": {"const": "registry.unsigned-evidence-envelope/v1"},
+            "type": {"const": "UnsignedEvidenceEnvelope"},
+            "integrityProtection": {"const": "none"},
+            "warning": {"const": "not-cryptographically-verifiable"},
+            "evidence": {"$ref": EVIDENCE_SCHEMA_ID}
+        },
+        "$comment": "Transport-authenticated convenience representation selected only by its exact vendor media type when the immutable bundle and the complete matched grant permit it. Once separated from its HTTPS exchange it provides no issuer-authenticity, integrity, non-repudiation, or later-verification property. The nested evidence is the same closed core object that would be JWS encoded. There is no protected, payload, or signature member, so the strict JWS verifier rejects this representation; tooling that parses it must return an explicitly unverified result."
+    })
+}
+
+fn problem_schema() -> Value {
+    let mut schema = json!({
+        "$schema": SCHEMA_DIALECT,
+        "$id": PROBLEM_SCHEMA_ID,
+        "title": "Evidence public problem Version 1",
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["type", "title", "status", "code", "operation"],
+        "properties": {
+            "type": {
+                "type": "string",
+                "enum": [
+                    "https://registrystack.org/problems/evidence/malformed_request",
+                    "https://registrystack.org/problems/evidence/invalid_selector",
+                    "https://registrystack.org/problems/evidence/authentication_failed",
+                    "https://registrystack.org/problems/evidence/not_authorized",
+                    "https://registrystack.org/problems/evidence/response_format_not_acceptable",
+                    "https://registrystack.org/problems/evidence/evidence_not_available",
+                    "https://registrystack.org/problems/evidence/rate_limited",
+                    "https://registrystack.org/problems/evidence/dependency_unavailable",
+                    "https://registrystack.org/problems/evidence/service_unavailable"
+                ]
+            },
+            "title": {"type": "string", "enum": [
+                "Request is not valid", "Authentication failed", "Request is not authorized",
+                "Requested response format is not acceptable",
+                "Evidence could not be produced", "Request rate exceeded", "Service temporarily unavailable"
+            ]},
+            "status": {"type": "integer", "enum": [400, 401, 403, 406, 422, 429, 503]},
+            "code": {"type": "string", "enum": [
+                "malformed_request", "invalid_selector", "authentication_failed", "not_authorized",
+                "response_format_not_acceptable",
+                "evidence_not_available", "rate_limited", "dependency_unavailable", "service_unavailable"
+            ]},
+            "operation": {"type": "string", "pattern": OPERATION_PATTERN}
+        },
+        "$comment": "Problem members are a closed safe shape. No request, authority, source, script, supported-value, subject-binding, candidate, or credential detail is returned."
+    });
+    schema["oneOf"] = Value::Array(
+        PROBLEM_VARIANTS
+        .into_iter()
+        .map(|(code, status, title)| {
+            json!({"properties": {
+                "type": {"const": format!("https://registrystack.org/problems/evidence/{code}")},
+                "title": {"const": title},
+                "status": {"const": status},
+                "code": {"const": code}
+            }})
+        })
+        .collect(),
+    );
+    schema
+}
+
+fn jwks_schema() -> Value {
+    json!({
+        "$schema": SCHEMA_DIALECT,
+        "$id": JWKS_SCHEMA_ID,
+        "title": "Evidence public JWKS Version 1",
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["keys"],
+        "properties": {
+            "keys": {
+                "type": "array", "minItems": 1, "maxItems": 33, "uniqueItems": true,
+                "items": {"$ref": "#/$defs/ed25519-public-jwk"}
+            }
+        },
+        "$defs": {
+            "ed25519-public-jwk": {
+                "type": "object", "additionalProperties": false,
+                "required": ["kty", "kid", "alg", "crv", "x"],
+                "properties": {
+                    "kty": {"const": "OKP"},
+                    "kid": {"type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$"},
+                    "alg": {"const": "EdDSA"},
+                    "crv": {"const": "Ed25519"},
+                    "x": {"type": "string", "pattern": "^[A-Za-z0-9_-]{43}$"}
+                }
+            }
+        },
+        "$comment": "Only the active and configured retired public keys are published. Key ids are unique and limited to 256 UTF-8 bytes by the runtime; JSON Schema maxLength is an additional code-point bound. Discovery is not a trust anchor; verifiers pin the governed provider and JWKS location."
+    })
+}
+
+fn insert_schema_family(
+    components: &mut serde_json::Map<String, Value>,
+    root_name: &str,
+    schema: &Value,
+    definition_names: &[(&str, &str)],
+) {
+    let mut root = schema.clone();
+    let definitions = root
+        .as_object_mut()
+        .and_then(|object| object.remove("$defs"))
+        .and_then(|value| value.as_object().cloned())
+        .unwrap_or_default();
+    rewrite_openapi_schema(&mut root, definition_names);
+    components.insert(root_name.to_string(), root);
+
+    for (definition_name, component_name) in definition_names {
+        let mut definition = definitions
+            .get(*definition_name)
+            .unwrap_or_else(|| panic!("missing generated schema definition {definition_name}"))
+            .clone();
+        rewrite_openapi_schema(&mut definition, definition_names);
+        components.insert((*component_name).to_string(), definition);
+    }
+}
+
+fn rewrite_openapi_schema(value: &mut Value, definition_names: &[(&str, &str)]) {
+    match value {
+        Value::Array(values) => {
+            for value in values {
+                rewrite_openapi_schema(value, definition_names);
+            }
+        }
+        Value::Object(object) => {
+            object.remove("$schema");
+            object.remove("$id");
+            object.remove("$comment");
+
+            if let Some(reference) = object
+                .get("$ref")
+                .and_then(Value::as_str)
+                .map(str::to_string)
+            {
+                if let Some(definition_name) = reference.strip_prefix("#/$defs/") {
+                    let component_name = definition_names
+                        .iter()
+                        .find_map(|(definition, component)| {
+                            (*definition == definition_name).then_some(*component)
+                        })
+                        .unwrap_or_else(|| {
+                            panic!("unmapped generated schema definition {definition_name}")
+                        });
+                    object.insert(
+                        "$ref".to_string(),
+                        Value::String(format!("#/components/schemas/{component_name}")),
+                    );
+                }
+            }
+
+            if let Some(constant) = object.remove("const") {
+                let schema_type = match &constant {
+                    Value::String(_) => Some("string"),
+                    Value::Bool(_) => Some("boolean"),
+                    Value::Number(number) if number.is_i64() || number.is_u64() => Some("integer"),
+                    Value::Number(_) => Some("number"),
+                    Value::Array(_) => Some("array"),
+                    Value::Object(_) => Some("object"),
+                    Value::Null => None,
+                };
+                if let Some(schema_type) = schema_type {
+                    object
+                        .entry("type".to_string())
+                        .or_insert_with(|| Value::String(schema_type.to_string()));
+                }
+                object.insert("enum".to_string(), Value::Array(vec![constant]));
+            }
+            if !object.contains_key("type") {
+                let enum_type = object
+                    .get("enum")
+                    .and_then(Value::as_array)
+                    .and_then(|values| values.first())
+                    .and_then(|value| match value {
+                        Value::String(_) => Some("string"),
+                        Value::Bool(_) => Some("boolean"),
+                        Value::Number(number) if number.is_i64() || number.is_u64() => {
+                            Some("integer")
+                        }
+                        Value::Number(_) => Some("number"),
+                        _ => None,
+                    });
+                if let Some(enum_type) = enum_type {
+                    object.insert("type".to_string(), Value::String(enum_type.to_string()));
+                }
+            }
+
+            for value in object.values_mut() {
+                rewrite_openapi_schema(value, definition_names);
+            }
+        }
+        _ => {}
+    }
+}
+
+fn problem_content(codes: &[&str]) -> Value {
+    let variants = codes
+        .iter()
+        .map(|code| {
+            let (_, status, title) = PROBLEM_VARIANTS
+                .iter()
+                .find(|(variant, _, _)| variant == code)
+                .unwrap_or_else(|| panic!("unknown public problem code {code}"));
+            json!({
+                "allOf": [
+                    {"$ref": "#/components/schemas/Problem"},
+                    {
+                        "type": "object",
+                        "properties": {
+                            "type": {"type": "string", "enum": [format!("https://registrystack.org/problems/evidence/{code}")]},
+                            "title": {"type": "string", "enum": [title]},
+                            "status": {"type": "integer", "enum": [status]},
+                            "code": {"type": "string", "enum": [code]}
+                        }
+                    }
+                ]
+            })
+        })
+        .collect::<Vec<_>>();
+    let schema = if variants.len() == 1 {
+        variants.into_iter().next().expect("one problem variant")
+    } else {
+        json!({"oneOf": variants})
+    };
+    json!({"application/problem+json": {"schema": schema}})
+}
+
+fn response_headers(extra: Option<(&str, Value)>) -> Value {
+    let mut headers = serde_json::Map::new();
+    headers.insert(
+        "Cache-Control".to_string(),
+        json!({
+            "description": "Evidence responses are never cacheable.",
+            "schema": {"type": "string", "enum": ["no-store"]}
+        }),
+    );
+    headers.insert(
+        "X-Request-Id".to_string(),
+        json!({
+            "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+            "schema": {"type": "string", "pattern": OPERATION_PATTERN}
+        }),
+    );
+    if let Some((name, header)) = extra {
+        headers.insert(name.to_string(), header);
+    }
+    Value::Object(headers)
+}
+
+/// Headers for every `/v1/evidence` response, which varies on `Accept`.
+fn evidence_response_headers(extra: Option<(&str, Value)>) -> Value {
+    let mut headers = response_headers(extra);
+    headers
+        .as_object_mut()
+        .expect("response headers are an object")
+        .insert(
+            "Vary".to_string(),
+            json!({
+                "description": "The response format is negotiated through the exact Accept matrix.",
+                "schema": {"type": "string", "enum": ["Accept"]}
+            }),
+        );
+    headers
+}
+
+#[allow(clippy::too_many_arguments)]
+fn openapi_document(
+    request: &Value,
+    evidence: &Value,
+    definitions: &Value,
+    jws: &Value,
+    unsigned: &Value,
+    problem: &Value,
+    jwks: &Value,
+) -> Value {
+    let mut schemas = serde_json::Map::new();
+    insert_schema_family(
+        &mut schemas,
+        "EvidenceRequest",
+        request,
+        &[
+            ("subject", "EvidenceRequestSubject"),
+            ("selector", "EvidenceRequestSelector"),
+            ("scalar-selector-value", "SelectorValue"),
+            ("holder-key", "HolderPublicKey"),
+        ],
+    );
+    insert_schema_family(
+        &mut schemas,
+        "Evidence",
+        evidence,
+        &[
+            ("subject-binding", "SubjectBinding"),
+            ("supported-value", "SupportedValue"),
+            ("value", "PublicValue"),
+            ("bucket", "BucketValue"),
+            ("entity-reference", "EntityReferenceValue"),
+            ("structured", "StructuredValue"),
+        ],
+    );
+    insert_schema_family(
+        &mut schemas,
+        "EvidenceDefinitions",
+        definitions,
+        &[
+            ("definition", "EvidenceDefinition"),
+            ("subject", "EvidenceDefinitionSubject"),
+            ("selector", "EvidenceDefinitionSelector"),
+            ("selector-field", "EvidenceSelectorField"),
+            ("concept", "EvidenceDefinitionConcept"),
+        ],
+    );
+    insert_schema_family(&mut schemas, "FlattenedJws", jws, &[]);
+    insert_schema_family(&mut schemas, "UnsignedEvidenceEnvelope", unsigned, &[]);
+    if let Some(reference) = schemas
+        .get_mut("UnsignedEvidenceEnvelope")
+        .and_then(Value::as_object_mut)
+        .and_then(|schema| schema.get_mut("properties"))
+        .and_then(Value::as_object_mut)
+        .and_then(|properties| properties.get_mut("evidence"))
+        .and_then(Value::as_object_mut)
+    {
+        reference.insert(
+            "$ref".to_string(),
+            Value::String("#/components/schemas/Evidence".to_string()),
+        );
+    }
+    if let Some(properties) = schemas
+        .get_mut("FlattenedJws")
+        .and_then(Value::as_object_mut)
+        .and_then(|schema| schema.get_mut("properties"))
+        .and_then(Value::as_object_mut)
+    {
+        properties["protected"]["x-decoded-schema"] =
+            json!({"$ref": "#/components/schemas/EvidenceProtectedHeader"});
+        properties["payload"]["x-decoded-schema"] =
+            json!({"$ref": "#/components/schemas/Evidence"});
+    }
+    schemas.insert(
+        "EvidenceProtectedHeader".to_string(),
+        json!({
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["alg", "kid", "typ", "cty"],
+            "properties": {
+                "alg": {"type": "string", "enum": ["EdDSA"]},
+                "kid": {"type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[^\\u0000-\\u001F\\u007F]+$"},
+                "typ": {"type": "string", "enum": ["evidence+jws"]},
+                "cty": {"type": "string", "enum": ["application/evidence+json"]}
+            }
+        }),
+    );
+    insert_schema_family(&mut schemas, "Problem", problem, &[]);
+    insert_schema_family(
+        &mut schemas,
+        "JwksDocument",
+        jwks,
+        &[("ed25519-public-jwk", "Ed25519PublicJwk")],
+    );
+    schemas.insert(
+        "SdJwtVcCredential".to_string(),
+        json!({
+            "type": "string",
+            "description": "Compact SD-JWT VC: the issuer-signed JWT, then the root-value and configured structured-field disclosures, then a trailing tilde marking an absent key-binding JWT. The issuer never appends a key-binding JWT.",
+            "pattern": "^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+(~[A-Za-z0-9_-]+)*~$"
+        }),
+    );
+    schemas.insert(
+        "JwtVcIssuerMetadata".to_string(),
+        json!({
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["issuer", "jwks"],
+            "properties": {
+                "issuer": {"type": "string", "maxLength": 512},
+                "jwks": {"$ref": "#/components/schemas/JwksDocument"}
+            }
+        }),
+    );
+    schemas.insert(
+        "HealthStatus".to_string(),
+        json!({
+            "type": "object", "additionalProperties": false,
+            "required": ["status"],
+            "properties": {"status": {"type": "string", "enum": ["ok"]}}
+        }),
+    );
+    schemas.insert(
+        "ReadyStatus".to_string(),
+        json!({
+            "type": "object", "additionalProperties": false,
+            "required": ["status"],
+            "properties": {"status": {"type": "string", "enum": ["ready"]}}
+        }),
+    );
+
+    json!({
+        "openapi": "3.1.0",
+        "info": {
+            "title": "Registry Evidence API",
+            "version": env!("CARGO_PKG_VERSION"),
+            "description": "Minimum-disclosure signed assertion service, Version 1."
+        },
+        "paths": {
+            "/v1/evidence": {
+                "post": {
+                    "operationId": "createEvidence",
+                    "summary": "Produce evidence for one authorized fixed requirement",
+                    "description": "Missing Accept, */*, and the exact application/jose+json media type select the default signed flattened JWS. Only the exact application/vnd.registrystack.evidence-unsigned+json media type selects the unsigned envelope, and only the exact application/dc+sd-jwt media type selects the SD-JWT VC serialization of the same assertion; each is released only when the immutable bundle and the complete matched authority grant permit it. Duplicate, combined, parameterized, weighted, or unknown negotiation returns 406 before source access.",
+                    "security": [{"bearerAuth": []}],
+                    "requestBody": {
+                        "required": true,
+                        "content": {"application/json": {"schema": {"$ref": "#/components/schemas/EvidenceRequest"}}}
+                    },
+                    "responses": {
+                        "200": {
+                            "description": "Signed Evidence as flattened JWS JSON Serialization by default, or the explicitly authorized SD-JWT VC serialization or self-identifying unsigned envelope",
+                            "headers": evidence_response_headers(None),
+                            "content": {
+                                "application/jose+json": {"schema": {"$ref": "#/components/schemas/FlattenedJws"}},
+                                "application/dc+sd-jwt": {"schema": {"$ref": "#/components/schemas/SdJwtVcCredential"}},
+                                "application/vnd.registrystack.evidence-unsigned+json": {"schema": {"$ref": "#/components/schemas/UnsignedEvidenceEnvelope"}}
+                            }
+                        },
+                        "400": {
+                            "description": "Malformed request or invalid selector",
+                            "headers": evidence_response_headers(None),
+                            "content": problem_content(&["malformed_request", "invalid_selector"])
+                        },
+                        "401": {
+                            "description": "Authentication failed",
+                            "headers": evidence_response_headers(Some(("WWW-Authenticate", json!({
+                                "schema": {"type": "string", "enum": ["Bearer"]}
+                            })))),
+                            "content": problem_content(&["authentication_failed"])
+                        },
+                        "403": {
+                            "description": "Request is not authorized, including a recognized response format the bundle or matched grant does not permit",
+                            "headers": evidence_response_headers(None),
+                            "content": problem_content(&["not_authorized"])
+                        },
+                        "406": {
+                            "description": "Media negotiation is outside the closed Accept matrix",
+                            "headers": evidence_response_headers(None),
+                            "content": problem_content(&["response_format_not_acceptable"])
+                        },
+                        "422": {
+                            "description": "Evidence could not be produced",
+                            "headers": evidence_response_headers(None),
+                            "content": problem_content(&["evidence_not_available"])
+                        },
+                        "429": {
+                            "description": "Request rate exceeded",
+                            "headers": evidence_response_headers(Some(("Retry-After", json!({
+                                "schema": {"type": "string", "enum": ["1"]}
+                            })))),
+                            "content": problem_content(&["rate_limited"])
+                        },
+                        "503": {
+                            "description": "Dependency or service temporarily unavailable",
+                            "headers": evidence_response_headers(None),
+                            "content": problem_content(&["dependency_unavailable", "service_unavailable"])
+                        },
+                    }
+                }
+            },
+            "/v1/evidence-definitions": {
+                "get": {
+                    "operationId": "listEvidenceDefinitions",
+                    "summary": "List the complete Evidence request shapes available to the authenticated caller",
+                    "security": [{"bearerAuth": []}],
+                    "responses": {
+                        "200": {
+                            "description": "Requester-scoped Evidence definitions",
+                            "headers": response_headers(None),
+                            "content": {"application/json": {"schema": {"$ref": "#/components/schemas/EvidenceDefinitions"}}}
+                        },
+                        "400": {
+                            "description": "Malformed discovery request",
+                            "headers": response_headers(None),
+                            "content": problem_content(&["malformed_request"])
+                        },
+                        "401": {
+                            "description": "Authentication failed",
+                            "headers": response_headers(Some(("WWW-Authenticate", json!({
+                                "schema": {"type": "string", "enum": ["Bearer"]}
+                            })))),
+                            "content": problem_content(&["authentication_failed"])
+                        },
+                        "429": {
+                            "description": "Request rate exceeded",
+                            "headers": response_headers(Some(("Retry-After", json!({
+                                "schema": {"type": "string", "enum": ["1"]}
+                            })))),
+                            "content": problem_content(&["rate_limited"])
+                        },
+                        "503": {
+                            "description": "Service temporarily unavailable",
+                            "headers": response_headers(None),
+                            "content": problem_content(&["service_unavailable"])
+                        }
+                    }
+                }
+            },
+            "/health": {
+                "get": {
+                    "operationId": "getHealth",
+                    "summary": "Report process liveness without dependency access",
+                    "responses": {"200": {
+                        "description": "Process is live",
+                        "headers": response_headers(None),
+                        "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HealthStatus"}}}
+                    }}
+                }
+            },
+            "/ready": {
+                "get": {
+                    "operationId": "getReadiness",
+                    "summary": "Report fail-closed runtime readiness",
+                    "responses": {
+                        "200": {
+                            "description": "Runtime is ready",
+                            "headers": response_headers(None),
+                            "content": {"application/json": {"schema": {"$ref": "#/components/schemas/ReadyStatus"}}}
+                        },
+                        "503": {
+                            "description": "Runtime is not ready",
+                            "headers": response_headers(None),
+                            "content": problem_content(&["service_unavailable"])
+                        }
+                    }
+                }
+            },
+            "/openapi.json": {
+                "get": {
+                    "operationId": "getOpenApi",
+                    "summary": "Fetch this OpenAPI document",
+                    "description": "The generated public contract for this service. This route is intentionally unauthenticated: the served bytes are the released generated artifact and describe no deployment, definition, or authority.",
+                    "security": [],
+                    "responses": {
+                        "200": {
+                            "description": "The generated Version 1 OpenAPI document",
+                            "headers": response_headers(None),
+                            "content": {"application/openapi+json": {"schema": {"type": "object"}}}
+                        },
+                        "503": {
+                            "description": "The document could not be produced",
+                            "headers": response_headers(None),
+                            "content": problem_content(&["service_unavailable"])
+                        }
+                    }
+                }
+            },
+            "/.well-known/evidence/jwks.json": {
+                "get": {
+                    "operationId": "getEvidenceJwks",
+                    "summary": "Publish the active and retained public verification keys",
+                    "responses": {"200": {
+                        "description": "Evidence public verification keys",
+                        "headers": response_headers(None),
+                        "content": {"application/jwk-set+json": {"schema": {"$ref": "#/components/schemas/JwksDocument"}}}
+                    }}
+                }
+            },
+            "/.well-known/jwt-vc-issuer": {
+                "get": {
+                    "operationId": "getJwtVcIssuerMetadata",
+                    "summary": "Publish JWT VC Issuer Metadata for the SD-JWT VC response format",
+                    "description": "Discovery is not a trust anchor. The document republishes the same public keys under the provider identity the assertion names, and resolution is meaningful only when that identity is the HTTPS origin of the deployment.",
+                    "responses": {"200": {
+                        "description": "Provider identity and public verification keys",
+                        "headers": response_headers(None),
+                        "content": {"application/json": {"schema": {"$ref": "#/components/schemas/JwtVcIssuerMetadata"}}}
+                    }}
+                }
+            }
+        },
+        "components": {
+            "securitySchemes": {
+                "bearerAuth": {
+                    "type": "http",
+                    "scheme": "bearer",
+                    "bearerFormat": "JWT",
+                    "description": "Exactly one Authorization header containing one Bearer token is required."
+                }
+            },
+            "schemas": Value::Object(schemas)
+        }
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn every_json_schema_is_valid_draft_2020_12() {
+        for schema in [
+            request_schema(),
+            evidence_schema(),
+            definitions_schema(),
+            jws_schema(),
+            problem_schema(),
+            jwks_schema(),
+        ] {
+            JSONSchema::options()
+                .with_draft(Draft::Draft202012)
+                .should_validate_formats(true)
+                .compile(&schema)
+                .expect("generated schema compiles");
+        }
+
+        // The unsigned envelope references the Evidence payload schema by its
+        // canonical identifier, so that document is registered for offline
+        // compilation.
+        JSONSchema::options()
+            .with_draft(Draft::Draft202012)
+            .should_validate_formats(true)
+            .with_document(EVIDENCE_SCHEMA_ID.to_string(), evidence_schema())
+            .compile(&unsigned_envelope_schema())
+            .expect("generated unsigned envelope schema compiles");
+    }
+
+    #[test]
+    fn openapi_document_is_valid_utoipa_model() {
+        let document = openapi_document(
+            &request_schema(),
+            &evidence_schema(),
+            &definitions_schema(),
+            &jws_schema(),
+            &unsigned_envelope_schema(),
+            &problem_schema(),
+            &jwks_schema(),
+        );
+        for (name, schema) in document["components"]["schemas"]
+            .as_object()
+            .expect("component schemas are an object")
+        {
+            serde_json::from_value::<utoipa::openapi::RefOr<utoipa::openapi::Schema>>(
+                schema.clone(),
+            )
+            .unwrap_or_else(|error| panic!("component schema {name} is invalid: {error}"));
+        }
+        serde_json::from_value::<utoipa::openapi::OpenApi>(document)
+            .expect("generated OpenAPI parses as OpenAPI 3.1");
+    }
+
+    #[test]
+    fn openapi_has_only_the_version_one_routes_and_exact_success_media() {
+        let document = openapi_document(
+            &request_schema(),
+            &evidence_schema(),
+            &definitions_schema(),
+            &jws_schema(),
+            &unsigned_envelope_schema(),
+            &problem_schema(),
+            &jwks_schema(),
+        );
+        let paths = document["paths"].as_object().expect("paths is an object");
+        assert_eq!(
+            paths.keys().map(String::as_str).collect::<Vec<_>>(),
+            [
+                "/.well-known/evidence/jwks.json",
+                "/.well-known/jwt-vc-issuer",
+                "/health",
+                "/openapi.json",
+                "/ready",
+                "/v1/evidence",
+                "/v1/evidence-definitions"
+            ]
+        );
+        assert!(
+            document["paths"]["/openapi.json"]["get"]["responses"]["200"]["content"]
+                ["application/openapi+json"]
+                .is_object()
+        );
+        assert_eq!(
+            document["paths"]["/openapi.json"]["get"]["security"],
+            json!([])
+        );
+        assert!(
+            document["paths"]["/v1/evidence"]["post"]["responses"]["200"]["content"]
+                ["application/jose+json"]
+                .is_object()
+        );
+        assert!(
+            document["paths"]["/v1/evidence"]["post"]["responses"]["200"]["content"]
+                ["application/vnd.registrystack.evidence-unsigned+json"]
+                .is_object()
+        );
+        assert!(
+            document["paths"]["/v1/evidence"]["post"]["responses"]["200"]["content"]
+                ["application/dc+sd-jwt"]
+                .is_object()
+        );
+        assert_eq!(
+            document["paths"]["/v1/evidence"]["post"]["responses"]["406"]["content"]
+                ["application/problem+json"]["schema"]["allOf"][1]["properties"]["code"]["enum"],
+            json!(["response_format_not_acceptable"])
+        );
+        for response in document["paths"]["/v1/evidence"]["post"]["responses"]
+            .as_object()
+            .expect("evidence responses are an object")
+            .values()
+        {
+            assert_eq!(
+                response["headers"]["Vary"]["schema"]["enum"],
+                json!(["Accept"])
+            );
+        }
+        assert!(
+            document["paths"]["/v1/evidence-definitions"]["get"]["responses"]["200"]["content"]
+                ["application/json"]
+                .is_object()
+        );
+        assert!(
+            document["paths"]["/.well-known/evidence/jwks.json"]["get"]["responses"]["200"]
+                ["content"]["application/jwk-set+json"]
+                .is_object()
+        );
+        assert!(
+            document["paths"]["/.well-known/jwt-vc-issuer"]["get"]["responses"]["200"]["content"]
+                ["application/json"]
+                .is_object()
+        );
+        assert_eq!(
+            document["components"]["schemas"]["FlattenedJws"]["properties"]["payload"]
+                ["x-decoded-schema"]["$ref"],
+            json!("#/components/schemas/Evidence")
+        );
+        assert_eq!(
+            document["components"]["schemas"]["EvidenceProtectedHeader"]["properties"]["alg"]
+                ["enum"],
+            json!(["EdDSA"])
+        );
+
+        for path in paths.values() {
+            let operation = path
+                .as_object()
+                .and_then(|operations| operations.values().next())
+                .expect("each Version 1 path has one operation");
+            for response in operation["responses"]
+                .as_object()
+                .expect("responses is an object")
+                .values()
+            {
+                assert_eq!(
+                    response["headers"]["Cache-Control"]["schema"]["enum"],
+                    json!(["no-store"])
+                );
+            }
+        }
+
+        assert_eq!(
+            document["paths"]["/v1/evidence"]["post"]["responses"]["401"]["content"]
+                ["application/problem+json"]["schema"]["allOf"][1]["properties"]["code"]["enum"],
+            json!(["authentication_failed"])
+        );
+        assert_eq!(
+            document["paths"]["/ready"]["get"]["responses"]["503"]["content"]
+                ["application/problem+json"]["schema"]["allOf"][1]["properties"]["code"]["enum"],
+            json!(["service_unavailable"])
+        );
+    }
+
+    #[test]
+    fn the_served_openapi_document_is_the_generated_release_artifact() {
+        let generated = documents().expect("generated contracts build");
+        assert_eq!(
+            served_openapi_document().expect("served OpenAPI document builds"),
+            generated[OPENAPI_FILE]
+        );
+    }
+
+    #[test]
+    fn jws_and_problem_schemas_are_closed() {
+        let jws = jws_schema();
+        assert_eq!(jws["additionalProperties"], json!(false));
+        assert!(jws["properties"].get("header").is_none());
+
+        let problem = problem_schema();
+        assert_eq!(problem["additionalProperties"], json!(false));
+        assert_eq!(
+            problem["properties"].as_object().map(|value| value.len()),
+            Some(5)
+        );
+    }
+
+    #[test]
+    fn schemas_accept_the_exact_public_wire_shapes() {
+        let cases = [
+            (
+                request_schema(),
+                json!({
+                    "requestNonce": "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I",
+                    "requirement": "urn:example:requirement:v1",
+                    "purpose": "casework",
+                    "subjects": [{
+                        "role": "subject",
+                        "selector": {"profile": "opaque-v1", "values": {"opaque": "value"}}
+                    }]
+                }),
+            ),
+            (
+                evidence_schema(),
+                json!({
+                    "schema": "registry.assertion-evidence/v1",
+                    "assuranceProfile": "evidence-grade",
+                    "requestNonce": "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I",
+                    "id": "urn:ulid:01K1EXAMPLE0000000000000000",
+                    "type": "Evidence",
+                    "supportsRequirement": "urn:example:requirement:v1",
+                    "isConformantTo": "urn:example:evidence-type:v1",
+                    "issuedBy": "urn:example:issuer",
+                    "providedBy": "urn:example:provider",
+                    "issuedAt": "2026-08-02T00:00:00Z",
+                    "observedAt": "2026-08-02T00:00:00Z",
+                    "validUntil": "2026-08-03T00:00:00Z",
+                    "purpose": "casework",
+                    "audience": "urn:example:audience",
+                    "configurationRevision": format!("sha256:{}", "0".repeat(64)),
+                    "subjects": [{
+                        "role": "subject",
+                        "binding": format!("urn:evidence:subject:v1_{}", "a".repeat(43))
+                    }],
+                    "supportedValues": [{
+                        "providesValueFor": "urn:example:concept",
+                        "value": true
+                    }]
+                }),
+            ),
+            (
+                definitions_schema(),
+                json!({
+                    "schema": "registry.evidence-definitions/v1",
+                    "assuranceProfile": "evidence-grade",
+                    "configurationRevision": format!("sha256:{}", "0".repeat(64)),
+                    "issuedBy": "urn:example:issuer",
+                    "providedBy": "urn:example:provider",
+                    "definitions": [{
+                        "requirement": "urn:example:requirement:v1",
+                        "kind": "criterion",
+                        "evidenceType": "urn:example:evidence-type:v1",
+                        "purpose": "casework",
+                        "referenceFrameworks": ["urn:example:framework:v1"],
+                        "subjects": [{
+                            "role": "subject",
+                            "cardinality": "one",
+                            "selector": {
+                                "profile": "person-v1",
+                                "valueOrigin": "request",
+                                "fields": [{
+                                    "type": "string",
+                                    "name": "record_reference",
+                                    "minimumBytes": 1,
+                                    "maximumBytes": 96
+                                }]
+                            }
+                        }],
+                        "concepts": [{"id": "urn:example:concept", "form": "boolean"}]
+                    }]
+                }),
+            ),
+            (
+                jws_schema(),
+                json!({
+                    "protected": "YWxn",
+                    "payload": "ZXZpZGVuY2U",
+                    "signature": "a".repeat(86)
+                }),
+            ),
+            (
+                problem_schema(),
+                json!({
+                    "type": "https://registrystack.org/problems/evidence/evidence_not_available",
+                    "title": "Evidence could not be produced",
+                    "status": 422,
+                    "code": "evidence_not_available",
+                    "operation": "01ARZ3NDEKTSV4RRFFQ69G5FAV"
+                }),
+            ),
+            (
+                jwks_schema(),
+                json!({"keys": [{
+                    "kty": "OKP", "kid": "evidence-key-1", "alg": "EdDSA",
+                    "crv": "Ed25519", "x": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+                }]}),
+            ),
+        ];
+
+        for (schema, instance) in cases {
+            let compiled = JSONSchema::options()
+                .with_draft(Draft::Draft202012)
+                .should_validate_formats(true)
+                .compile(&schema)
+                .expect("generated schema compiles");
+            assert!(compiled.is_valid(&instance), "instance: {instance}");
+        }
+    }
+
+    #[test]
+    fn problem_schema_rejects_mismatched_code_status_and_title() {
+        let schema = problem_schema();
+        let compiled = JSONSchema::options()
+            .with_draft(Draft::Draft202012)
+            .should_validate_formats(true)
+            .compile(&schema)
+            .expect("problem schema compiles");
+        let mismatched = json!({
+            "type": "https://registrystack.org/problems/evidence/dependency_unavailable",
+            "title": "Request is not valid",
+            "status": 400,
+            "code": "dependency_unavailable",
+            "operation": "01ARZ3NDEKTSV4RRFFQ69G5FAV"
+        });
+        assert!(!compiled.is_valid(&mismatched));
+    }
+}
diff --git a/crates/registry-evidence/src/kernel.rs b/crates/registry-evidence/src/kernel.rs
new file mode 100644
index 000000000..bf15a3951
--- /dev/null
+++ b/crates/registry-evidence/src/kernel.rs
@@ -0,0 +1,2383 @@
+//! Generic offline Evidence evaluation and core-owned output projection.
+//!
+//! This module deliberately knows nothing about an acceptance case or source
+//! product. It joins one captured bundle revision to the hardened Rhai runtime,
+//! validates the complete declared Supported Value set, and constructs the
+//! unsigned Evidence payload that the production release path later signs.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::Path;
+use std::str::FromStr;
+use std::sync::Arc;
+
+use chrono::{DateTime, Duration, SecondsFormat, Utc};
+use chrono_tz::Tz;
+use jsonschema::{Draft, JSONSchema};
+use serde_json::{Map as JsonMap, Value};
+use thiserror::Error;
+
+use crate::binding::entity_reference;
+use crate::bundle::{Bundle, Codelist};
+use crate::config::{
+    ConceptConfig, ConceptForm, PreparationChannelPolicy, PreparationLimits, RequirementConfig,
+};
+use crate::model::{
+    BucketForm, BucketValue, EntityReferenceForm, EntityReferenceValue, Evidence,
+    EvidenceObjectType, LookupResult, PublicValue, ScalarOrEntityReference, StructuredValue,
+    StructuredValueForm, SubjectBinding, SupportedValue,
+};
+use crate::rhai_runtime::{
+    CalendarDate, CodelistHandle, CompiledDerivation, CompiledExtraction, CompiledPreparation,
+    DerivedConceptValue, DerivedValue, EvaluationContext, LegalLocalTime, RequestPartRequirement,
+    RequestParts, RequestPartsBounds, RequestPartsLimits, RhaiRuntime, RhaiRuntimeError,
+    UtcInstant, MAXIMUM_RESULT_BYTES,
+};
+use crate::values::Decimal;
+
+const MAXIMUM_PUBLIC_STRING_BYTES: usize = 1_024;
+const MAXIMUM_BUCKET_CODE_BYTES: usize = 128;
+const MAXIMUM_EVIDENCE_IDENTIFIER_BYTES: usize = 512;
+const DEFAULT_MAXIMUM_QUERY_PAIRS: usize = 64;
+const DEFAULT_MAXIMUM_QUERY_NAME_BYTES: usize = 64;
+const DEFAULT_MAXIMUM_QUERY_VALUE_BYTES: usize = 4_096;
+const DEFAULT_MAXIMUM_JSON_DEPTH: usize = 32;
+const DEFAULT_MAXIMUM_COLLECTION_ITEMS: usize = 256;
+const DEFAULT_MAXIMUM_STRING_BYTES: usize = 16_384;
+const DEFAULT_MAXIMUM_NORMALIZED_BYTES: usize = 65_536;
+
+#[derive(Debug, Error, Clone, Copy, PartialEq, Eq)]
+pub enum KernelError {
+    #[error("the Evidence bundle cannot initialize the offline kernel")]
+    Bundle,
+    #[error("the requested Evidence requirement is unavailable")]
+    Requirement,
+    #[error("the Evidence extraction failed")]
+    Extraction,
+    /// A uniquely resolved record reached derivation with missing, mistyped,
+    /// or inconsistent inputs. Publicly this collapses with the unresolved
+    /// lookup classes so callers cannot learn that a record exists.
+    #[error("the Evidence derivation inputs are unresolved")]
+    DerivationInput,
+    #[error("the Evidence request preparation failed")]
+    Preparation,
+    #[error("the source response violates its fixed protocol contract")]
+    SourceProtocol,
+    #[error("the Evidence script failed")]
+    Script,
+    #[error("the derived Evidence values violate the requirement contract")]
+    Output,
+    #[error("the Evidence payload metadata is invalid")]
+    Evidence,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum KernelOutcome {
+    Match(ValidatedValues),
+    NoMatch,
+    Ambiguous,
+}
+
+/// Values that have passed the complete requirement output gate.
+///
+/// The inner vector is intentionally not publicly constructible or mutable, so
+/// Evidence construction cannot be invoked with an unchecked `PublicValue`.
+#[derive(Clone, PartialEq, Eq)]
+pub struct ValidatedValues(Vec<SupportedValue>);
+
+impl ValidatedValues {
+    pub fn as_slice(&self) -> &[SupportedValue] {
+        &self.0
+    }
+}
+
+impl std::fmt::Debug for ValidatedValues {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("ValidatedValues")
+            .field(
+                "concept_identifiers",
+                &self
+                    .0
+                    .iter()
+                    .map(|value| value.provides_value_for.as_str())
+                    .collect::<Vec<_>>(),
+            )
+            .finish_non_exhaustive()
+    }
+}
+
+/// Runtime-owned inputs needed to project protected derivation values.
+pub struct ValueProjection<'a> {
+    pub audience: &'a str,
+    pub binding_key: &'a [u8],
+    pub binding_key_version: u32,
+}
+
+/// Core-owned envelope inputs supplied by the authenticated release pipeline.
+pub struct EvidenceConstruction<'a> {
+    pub evidence_id: &'a str,
+    /// Exact caller nonce to echo. It is copied verbatim into the payload and
+    /// is not part of the subject binding, audit, or any diagnostic surface.
+    pub request_nonce: &'a str,
+    pub purpose: &'a str,
+    pub audience: &'a str,
+    pub issued_at: DateTime<Utc>,
+    pub observed_at: DateTime<Utc>,
+    pub subjects: Vec<SubjectBinding>,
+}
+
+fn compile_request_parts_limits(
+    configured: &PreparationLimits,
+) -> Result<RequestPartsLimits, KernelError> {
+    fn requirement(policy: PreparationChannelPolicy) -> RequestPartRequirement {
+        match policy {
+            PreparationChannelPolicy::Required => RequestPartRequirement::Required,
+            PreparationChannelPolicy::Allowed => RequestPartRequirement::Optional,
+            PreparationChannelPolicy::Forbidden => RequestPartRequirement::Forbidden,
+        }
+    }
+
+    fn bounded(value: Option<u64>, default: usize) -> Result<usize, KernelError> {
+        value
+            .map(usize::try_from)
+            .transpose()
+            .map_err(|_| KernelError::Bundle)
+            .map(|value| value.unwrap_or(default))
+    }
+
+    RequestPartsLimits::new(
+        requirement(configured.query),
+        requirement(configured.json_body),
+        RequestPartsBounds {
+            maximum_query_pairs: bounded(
+                configured.maximum_query_pairs,
+                DEFAULT_MAXIMUM_QUERY_PAIRS,
+            )?,
+            maximum_query_name_bytes: bounded(
+                configured.maximum_query_name_bytes,
+                DEFAULT_MAXIMUM_QUERY_NAME_BYTES,
+            )?,
+            maximum_query_value_bytes: bounded(
+                configured.maximum_query_value_bytes,
+                DEFAULT_MAXIMUM_QUERY_VALUE_BYTES,
+            )?,
+            maximum_json_depth: bounded(configured.maximum_json_depth, DEFAULT_MAXIMUM_JSON_DEPTH)?,
+            maximum_collection_items: bounded(
+                configured.maximum_collection_items,
+                DEFAULT_MAXIMUM_COLLECTION_ITEMS,
+            )?,
+            maximum_string_bytes: bounded(
+                configured.maximum_string_bytes,
+                DEFAULT_MAXIMUM_STRING_BYTES,
+            )?,
+            maximum_normalized_bytes: bounded(
+                configured.maximum_normalized_bytes,
+                DEFAULT_MAXIMUM_NORMALIZED_BYTES,
+            )?,
+        },
+    )
+    .map_err(|_| KernelError::Bundle)
+}
+
+/// A kernel compiled entirely from the bytes captured in one immutable bundle.
+pub struct OfflineKernel {
+    bundle: Arc<Bundle>,
+    runtime: RhaiRuntime,
+    preparations: BTreeMap<String, CompiledPreparation>,
+    extractions: BTreeMap<String, CompiledExtraction>,
+    request_parts_limits: BTreeMap<String, RequestPartsLimits>,
+    derivations: BTreeMap<String, CompiledDerivation>,
+    response_schemas: BTreeMap<String, JSONSchema>,
+    fact_schemas: BTreeMap<String, JSONSchema>,
+    reviewed_schemas: BTreeMap<String, JSONSchema>,
+    codelist_handles: BTreeMap<String, BTreeMap<String, CodelistHandle>>,
+}
+
+impl std::fmt::Debug for OfflineKernel {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("OfflineKernel")
+            .field("configuration_revision", &self.bundle.revision())
+            .field("source_count", &self.extractions.len())
+            .field("requirement_count", &self.derivations.len())
+            .finish()
+    }
+}
+
+impl OfflineKernel {
+    pub fn compile(bundle: Arc<Bundle>) -> Result<Self, KernelError> {
+        let runtime = RhaiRuntime::new();
+        let mut preparations = BTreeMap::new();
+        let mut extractions = BTreeMap::new();
+        let mut request_parts_limits = BTreeMap::new();
+        let mut response_schemas = BTreeMap::new();
+        let mut fact_schemas = BTreeMap::new();
+        for (source_id, source) in bundle.config.sources.iter() {
+            let preparation = bundle
+                .script(&source.request.prepare_script)
+                .ok_or(KernelError::Bundle)?;
+            let compiled_preparation = runtime
+                .compile_preparation(&preparation.source)
+                .map_err(|_| KernelError::Bundle)?;
+            preparations.insert(source_id.to_owned(), compiled_preparation);
+
+            let extraction = bundle
+                .script(&source.extract_script)
+                .ok_or(KernelError::Bundle)?;
+            let compiled_extraction = runtime
+                .compile_extraction(&extraction.source)
+                .map_err(|_| KernelError::Bundle)?;
+            extractions.insert(source_id.to_owned(), compiled_extraction);
+            request_parts_limits.insert(
+                source_id.to_owned(),
+                compile_request_parts_limits(&source.request.preparation_limits)?,
+            );
+
+            let response_schema = bundle
+                .fact_schema(&source.response_schema)
+                .ok_or(KernelError::Bundle)?;
+            response_schemas.insert(source_id.to_owned(), compile_schema(response_schema)?);
+
+            let schema = bundle
+                .fact_schema(&source.fact_schema)
+                .ok_or(KernelError::Bundle)?;
+            let compiled_schema = compile_schema(schema)?;
+            fact_schemas.insert(source_id.to_owned(), compiled_schema);
+        }
+
+        let mut derivations = BTreeMap::new();
+        for requirement in &bundle.config.requirements {
+            let script = bundle
+                .script(&requirement.derivation.script)
+                .ok_or(KernelError::Bundle)?;
+            let compiled = runtime
+                .compile_derivation(&script.source)
+                .map_err(|_| KernelError::Bundle)?;
+            derivations.insert(requirement.id.clone(), compiled);
+        }
+
+        let mut reviewed_schemas = BTreeMap::new();
+        for schema in bundle.fact_schemas.values() {
+            if let Some(identifier) = schema.get("$id").and_then(Value::as_str) {
+                if reviewed_schemas
+                    .insert(identifier.to_owned(), compile_schema(schema)?)
+                    .is_some()
+                {
+                    return Err(KernelError::Bundle);
+                }
+            }
+        }
+
+        let codelist_handles = bundle
+            .config
+            .requirements
+            .iter()
+            .map(|requirement| {
+                build_codelist_handles(&bundle, requirement)
+                    .map(|handles| (requirement.id.clone(), handles))
+            })
+            .collect::<Result<_, _>>()?;
+        Ok(Self {
+            bundle,
+            runtime,
+            preparations,
+            extractions,
+            request_parts_limits,
+            derivations,
+            response_schemas,
+            fact_schemas,
+            reviewed_schemas,
+            codelist_handles,
+        })
+    }
+
+    /// Run the reviewed preparation script after authorization and access audit.
+    pub fn prepare(
+        &self,
+        requirement_id: &str,
+        selectors: &Value,
+    ) -> Result<RequestParts, KernelError> {
+        let requirement = self
+            .requirement(requirement_id)
+            .ok_or(KernelError::Requirement)?;
+        let source = self
+            .bundle
+            .config
+            .sources
+            .get(&requirement.source)
+            .ok_or(KernelError::Bundle)?;
+        let script = self
+            .preparations
+            .get(&requirement.source)
+            .ok_or(KernelError::Bundle)?;
+        let limits = self
+            .request_parts_limits
+            .get(&requirement.source)
+            .ok_or(KernelError::Bundle)?;
+        let parameters = serde_json::to_value(&source.request.adapter_parameters)
+            .map_err(|_| KernelError::Bundle)?;
+        self.runtime
+            .prepare(script, selectors, &parameters, limits)
+            .map_err(|_| KernelError::Preparation)
+    }
+
+    pub fn bundle(&self) -> &Bundle {
+        &self.bundle
+    }
+
+    pub fn requirement(&self, requirement_id: &str) -> Option<&RequirementConfig> {
+        self.bundle
+            .config
+            .requirements
+            .iter()
+            .find(|requirement| requirement.id == requirement_id)
+    }
+
+    /// Run only the closed extraction ABI over one already-bounded JSON response.
+    pub fn extract(
+        &self,
+        requirement_id: &str,
+        source_response: &Value,
+    ) -> Result<LookupResult, KernelError> {
+        let requirement = self
+            .requirement(requirement_id)
+            .ok_or(KernelError::Requirement)?;
+        let script = self
+            .extractions
+            .get(&requirement.source)
+            .ok_or(KernelError::Bundle)?;
+        let schema = self
+            .fact_schemas
+            .get(&requirement.source)
+            .ok_or(KernelError::Bundle)?;
+        let source = self
+            .bundle
+            .config
+            .sources
+            .get(&requirement.source)
+            .ok_or(KernelError::Bundle)?;
+        // The declared response shape is checked in Rust before any script sees
+        // the response, so extraction maps a response it can rely on and a
+        // provider that breaks its protocol fails closed the same way whether
+        // or not the script happens to test for it.
+        let response_schema = self
+            .response_schemas
+            .get(&requirement.source)
+            .ok_or(KernelError::Bundle)?;
+        if let Err(errors) = response_schema.validate(source_response) {
+            report_response_shape_rejection(
+                &requirement.source,
+                source.response_schema.as_str(),
+                errors,
+            );
+            return Err(KernelError::SourceProtocol);
+        }
+        let parameters = serde_json::to_value(&source.request.adapter_parameters)
+            .map_err(|_| KernelError::Bundle)?;
+        self.runtime
+            .extract(script, source_response, &parameters, schema)
+            .map_err(|error| match error {
+                RhaiRuntimeError::ExtractionResult | RhaiRuntimeError::FactSchema => {
+                    KernelError::Extraction
+                }
+                RhaiRuntimeError::Unavailable => KernelError::Extraction,
+                RhaiRuntimeError::SourceProtocol => KernelError::SourceProtocol,
+                RhaiRuntimeError::Compilation
+                | RhaiRuntimeError::EntryPoint
+                | RhaiRuntimeError::Invocation
+                | RhaiRuntimeError::InputBound
+                | RhaiRuntimeError::AdapterInput
+                | RhaiRuntimeError::PreparationResult
+                | RhaiRuntimeError::DerivationResult
+                | RhaiRuntimeError::DerivationInput
+                | RhaiRuntimeError::EvaluationContext
+                | RhaiRuntimeError::Codelist => KernelError::Script,
+            })
+    }
+
+    /// Derive and gate the exact Supported Value set for one unique match.
+    pub fn derive_and_validate(
+        &self,
+        requirement_id: &str,
+        facts: &BTreeMap<String, Value>,
+        observed_at: DateTime<Utc>,
+        projection: ValueProjection<'_>,
+    ) -> Result<ValidatedValues, KernelError> {
+        self.derive_and_validate_with_selectors(
+            requirement_id,
+            facts,
+            &Value::Object(JsonMap::new()),
+            observed_at,
+            projection,
+        )
+    }
+
+    /// Derive with the exact requirement-declared selector subset.
+    pub fn derive_and_validate_with_selectors(
+        &self,
+        requirement_id: &str,
+        facts: &BTreeMap<String, Value>,
+        selectors: &Value,
+        observed_at: DateTime<Utc>,
+        projection: ValueProjection<'_>,
+    ) -> Result<ValidatedValues, KernelError> {
+        let requirement = self
+            .requirement(requirement_id)
+            .ok_or(KernelError::Requirement)?;
+        let script = self
+            .derivations
+            .get(requirement_id)
+            .ok_or(KernelError::Bundle)?;
+        let evaluation_context = self.evaluation_context(requirement, observed_at)?;
+        let derived = self
+            .runtime
+            .derive(script, facts, selectors, evaluation_context)
+            .map_err(|error| match error {
+                RhaiRuntimeError::Unavailable => KernelError::Extraction,
+                RhaiRuntimeError::DerivationInput => KernelError::DerivationInput,
+                RhaiRuntimeError::SourceProtocol => KernelError::Script,
+                _ => KernelError::Script,
+            })?;
+        self.validate_values(requirement_id, derived, projection)
+    }
+
+    /// Run the complete offline lookup and derivation path.
+    pub fn evaluate(
+        &self,
+        requirement_id: &str,
+        source_response: &Value,
+        observed_at: DateTime<Utc>,
+        projection: ValueProjection<'_>,
+    ) -> Result<KernelOutcome, KernelError> {
+        self.evaluate_with_selectors(
+            requirement_id,
+            source_response,
+            &Value::Object(JsonMap::new()),
+            observed_at,
+            projection,
+        )
+    }
+
+    /// Run lookup and derivation with the exact selector subset declared for derivation.
+    pub fn evaluate_with_selectors(
+        &self,
+        requirement_id: &str,
+        source_response: &Value,
+        selectors: &Value,
+        observed_at: DateTime<Utc>,
+        projection: ValueProjection<'_>,
+    ) -> Result<KernelOutcome, KernelError> {
+        match self.extract(requirement_id, source_response)? {
+            LookupResult::Match(facts) => self
+                .derive_and_validate_with_selectors(
+                    requirement_id,
+                    &facts,
+                    selectors,
+                    observed_at,
+                    projection,
+                )
+                .map(KernelOutcome::Match),
+            LookupResult::NoMatch => Ok(KernelOutcome::NoMatch),
+            LookupResult::Ambiguous => Ok(KernelOutcome::Ambiguous),
+        }
+    }
+
+    /// Apply the output gate to values produced by the hardened Rhai ABI.
+    pub fn validate_values(
+        &self,
+        requirement_id: &str,
+        derived: Vec<DerivedConceptValue>,
+        projection: ValueProjection<'_>,
+    ) -> Result<ValidatedValues, KernelError> {
+        let requirement = self
+            .requirement(requirement_id)
+            .ok_or(KernelError::Requirement)?;
+        gate_values(
+            requirement,
+            derived,
+            projection,
+            &self.bundle.codelists,
+            &self.reviewed_schemas,
+        )
+    }
+
+    /// Construct the exact unsigned payload after output validation.
+    pub fn construct_evidence(
+        &self,
+        requirement_id: &str,
+        values: ValidatedValues,
+        input: EvidenceConstruction<'_>,
+    ) -> Result<Evidence, KernelError> {
+        let requirement = self
+            .requirement(requirement_id)
+            .ok_or(KernelError::Requirement)?;
+        validate_evidence_inputs(requirement, values.as_slice(), &input)?;
+        let valid_until = input
+            .issued_at
+            .checked_add_signed(Duration::seconds(
+                i64::try_from(requirement.validity_seconds).map_err(|_| KernelError::Evidence)?,
+            ))
+            .ok_or(KernelError::Evidence)
+            .map(format_utc)?;
+
+        Ok(Evidence {
+            schema: crate::EVIDENCE_SCHEMA_V1.to_owned(),
+            assurance_profile: self.bundle.config.assurance_profile,
+            request_nonce: input.request_nonce.to_owned(),
+            id: input.evidence_id.to_owned(),
+            evidence_type_name: EvidenceObjectType::Evidence,
+            supports_requirement: requirement.id.clone(),
+            is_conformant_to: requirement.evidence_type.clone(),
+            issued_by: self.bundle.config.issuer.id.clone(),
+            provided_by: self.bundle.config.service.provider_id.clone(),
+            issued_at: format_utc(input.issued_at),
+            observed_at: format_utc(input.observed_at),
+            valid_until,
+            purpose: input.purpose.to_owned(),
+            audience: input.audience.to_owned(),
+            configuration_revision: self.bundle.revision().to_owned(),
+            subjects: input.subjects,
+            supported_values: values.0,
+        })
+    }
+
+    fn evaluation_context(
+        &self,
+        requirement: &RequirementConfig,
+        observed_at: DateTime<Utc>,
+    ) -> Result<EvaluationContext, KernelError> {
+        let timezone = requirement
+            .observation_timezone
+            .as_deref()
+            .map(Tz::from_str)
+            .transpose()
+            .map_err(|_| KernelError::Bundle)?
+            .unwrap_or(Tz::UTC);
+        let local = observed_at.with_timezone(&timezone);
+        let parameters = serde_json::to_value(&requirement.derivation.parameters)
+            .map_err(|_| KernelError::Bundle)?;
+        EvaluationContext::new(
+            UtcInstant::parse(&format_utc(observed_at)).map_err(map_context_error)?,
+            CalendarDate::parse(&local.format("%Y-%m-%d").to_string())
+                .map_err(map_context_error)?,
+            LegalLocalTime::parse(&local.format("%H:%M:%S%:z").to_string())
+                .map_err(map_context_error)?,
+            &parameters,
+            self.codelist_handles
+                .get(&requirement.id)
+                .cloned()
+                .ok_or(KernelError::Bundle)?,
+        )
+        .map_err(map_context_error)
+    }
+}
+
+fn map_context_error(_: RhaiRuntimeError) -> KernelError {
+    KernelError::Bundle
+}
+
+/// How many response shape violations one rejection reports.
+///
+/// A rejected response is one event, and the first few violations already say
+/// which member disagrees with which rule. An unbounded list would let a source
+/// decide how much an operator log holds.
+const REPORTED_SHAPE_VIOLATIONS: usize = 5;
+
+/// Record which member of a projected response failed which schema rule.
+///
+/// The two pointers are the whole diagnosis and neither is a value. Without
+/// them a stale response schema and a source that changed its protocol are the
+/// same `dependency_unavailable`, which sends an operator to the provider for a
+/// defect that lives in the bundle.
+///
+/// Nothing from the response body is recorded: the paths are members the
+/// bundle's own projection selected, and the schema path is bundle text. The
+/// library's own error message embeds the offending value, so it is deliberately
+/// not used here.
+fn report_response_shape_rejection<'a>(
+    source_id: &str,
+    schema_artifact: &str,
+    errors: impl Iterator<Item = jsonschema::ValidationError<'a>>,
+) {
+    let (violations, total) = describe_response_shape_rejection(errors);
+    tracing::warn!(
+        target: "registry_evidence::source",
+        source = source_id,
+        schema = schema_artifact,
+        violations = violations.join("; "),
+        total_violations = total,
+        "the projected source response does not match its declared response shape"
+    );
+}
+
+/// Reduce validation errors to bounded, value-free violation descriptions.
+///
+/// Separated from the logging call so the property that matters can be asserted
+/// directly: what is produced here is the only thing that reaches the log.
+fn describe_response_shape_rejection<'a>(
+    errors: impl Iterator<Item = jsonschema::ValidationError<'a>>,
+) -> (Vec<String>, usize) {
+    let mut violations = Vec::new();
+    let mut total = 0usize;
+    for error in errors {
+        total += 1;
+        if violations.len() < REPORTED_SHAPE_VIOLATIONS {
+            violations.push(format!(
+                "{} violates {}",
+                display_pointer(&error.instance_path),
+                display_pointer(&error.schema_path)
+            ));
+        }
+    }
+    (violations, total)
+}
+
+/// Render a JSON Pointer, naming the document root rather than printing nothing.
+fn display_pointer(pointer: &jsonschema::paths::JSONPointer) -> String {
+    let rendered = pointer.to_string();
+    if rendered.is_empty() {
+        "the response root".to_owned()
+    } else {
+        rendered
+    }
+}
+
+fn compile_schema(schema: &Value) -> Result<JSONSchema, KernelError> {
+    JSONSchema::options()
+        .with_draft(Draft::Draft202012)
+        .should_validate_formats(true)
+        .compile(schema)
+        .map_err(|_| KernelError::Bundle)
+}
+
+fn build_codelist_handles(
+    bundle: &Bundle,
+    requirement: &RequirementConfig,
+) -> Result<BTreeMap<String, CodelistHandle>, KernelError> {
+    let mut paths = BTreeSet::new();
+    for concept in &requirement.concepts {
+        if let Some(path) = concept
+            .constraints
+            .get("codelist")
+            .and_then(serde_norway::Value::as_str)
+        {
+            paths.insert(path);
+        }
+        if matches!(
+            concept.form,
+            ConceptForm::DateBucket | ConceptForm::TimeBucket
+        ) {
+            let scheme = constraint_str(concept, "bucketScheme")?;
+            let version = constraint_str(concept, "schemeVersion")?;
+            let mut matches = bundle
+                .codelists
+                .iter()
+                .filter(|(_, codelist)| codelist.id() == scheme && codelist.version() == version);
+            let (path, _) = matches.next().ok_or(KernelError::Bundle)?;
+            if matches.next().is_some() {
+                return Err(KernelError::Bundle);
+            }
+            paths.insert(path);
+        }
+    }
+
+    let mut handles = BTreeMap::new();
+    for path in paths {
+        let codelist = bundle.codelists.get(path).ok_or(KernelError::Bundle)?;
+        let name = Path::new(path)
+            .file_stem()
+            .and_then(|stem| stem.to_str())
+            .ok_or(KernelError::Bundle)?;
+        let entries = match codelist {
+            Codelist::Codes { codes, .. } => codes
+                .iter()
+                .map(|code| (code.clone(), code.clone()))
+                .collect(),
+            Codelist::Mapping { entries, .. } => entries.clone(),
+        };
+        let handle = CodelistHandle::new(entries).map_err(|_| KernelError::Bundle)?;
+        if handles.insert(name.to_owned(), handle).is_some() {
+            return Err(KernelError::Bundle);
+        }
+    }
+    Ok(handles)
+}
+
+fn gate_values(
+    requirement: &RequirementConfig,
+    derived: Vec<DerivedConceptValue>,
+    projection: ValueProjection<'_>,
+    codelists: &BTreeMap<String, Codelist>,
+    reviewed_schemas: &BTreeMap<String, JSONSchema>,
+) -> Result<ValidatedValues, KernelError> {
+    if derived.is_empty() || derived.len() > 16 {
+        return Err(KernelError::Output);
+    }
+    let derived_count = derived.len();
+    let by_identifier = derived
+        .into_iter()
+        .map(|entry| (entry.concept_id, entry.value))
+        .collect::<BTreeMap<_, _>>();
+    if by_identifier.len() != derived_count
+        || by_identifier.len() > requirement.concepts.len()
+        || requirement
+            .concepts
+            .iter()
+            .any(|concept| concept.required && !by_identifier.contains_key(&concept.id))
+        || by_identifier.keys().any(|identifier| {
+            !requirement
+                .concepts
+                .iter()
+                .any(|concept| concept.id == *identifier)
+        })
+    {
+        return Err(KernelError::Output);
+    }
+
+    let mut result = Vec::with_capacity(by_identifier.len());
+    let mut total_bytes = 0usize;
+    for concept in &requirement.concepts {
+        let Some(value) = by_identifier.get(&concept.id) else {
+            continue;
+        };
+        let public = validate_value(concept, value, &projection, codelists, reviewed_schemas)?;
+        total_bytes = total_bytes
+            .checked_add(
+                serde_json::to_vec(&public)
+                    .map_err(|_| KernelError::Output)?
+                    .len(),
+            )
+            .ok_or(KernelError::Output)?;
+        if total_bytes > MAXIMUM_RESULT_BYTES {
+            return Err(KernelError::Output);
+        }
+        result.push(SupportedValue {
+            provides_value_for: concept.id.clone(),
+            value: public,
+        });
+    }
+    Ok(ValidatedValues(result))
+}
+
+fn validate_value(
+    concept: &ConceptConfig,
+    value: &DerivedValue,
+    projection: &ValueProjection<'_>,
+    codelists: &BTreeMap<String, Codelist>,
+    reviewed_schemas: &BTreeMap<String, JSONSchema>,
+) -> Result<PublicValue, KernelError> {
+    match concept.form {
+        ConceptForm::Boolean => match value {
+            DerivedValue::Json(Value::Bool(value)) => Ok(PublicValue::Boolean(*value)),
+            _ => Err(KernelError::Output),
+        },
+        ConceptForm::ControlledCode | ConceptForm::ControlledCategory => {
+            let text = derived_string(value)?;
+            let maximum = constraint_usize(concept, "maximumBytes")?;
+            validate_public_string(text, maximum)?;
+            let codelist = declared_codelist(concept, codelists)?;
+            if concept.form == ConceptForm::ControlledCategory
+                && codelist.id() != constraint_str(concept, "categoryScheme")?
+            {
+                return Err(KernelError::Bundle);
+            }
+            if !codelist.contains_output(text) {
+                return Err(KernelError::Output);
+            }
+            Ok(PublicValue::String(text.to_owned()))
+        }
+        ConceptForm::BoundedInteger => {
+            let integer = match value {
+                DerivedValue::Json(Value::Number(number)) => {
+                    number.as_i64().ok_or(KernelError::Output)?
+                }
+                _ => return Err(KernelError::Output),
+            };
+            let minimum = constraint_i64(concept, "minimum")?;
+            let maximum = constraint_i64(concept, "maximum")?;
+            if !(minimum..=maximum).contains(&integer) {
+                return Err(KernelError::Output);
+            }
+            Ok(PublicValue::Integer(integer))
+        }
+        ConceptForm::BoundedDecimal => {
+            let decimal = match value {
+                DerivedValue::Decimal(decimal) => decimal,
+                _ => return Err(KernelError::Output),
+            };
+            let minimum = Decimal::parse(constraint_str(concept, "minimum")?)
+                .map_err(|_| KernelError::Bundle)?;
+            let maximum = Decimal::parse(constraint_str(concept, "maximum")?)
+                .map_err(|_| KernelError::Bundle)?;
+            let maximum_scale = constraint_u64(concept, "maximumScale")?;
+            if u64::from(decimal.scale()) > maximum_scale
+                || decimal.compare(&minimum).is_lt()
+                || decimal.compare(&maximum).is_gt()
+            {
+                return Err(KernelError::Output);
+            }
+            Ok(PublicValue::String(decimal.canonical().to_owned()))
+        }
+        ConceptForm::DateBucket | ConceptForm::TimeBucket => {
+            validate_bucket(concept, value, codelists)
+        }
+        ConceptForm::AudienceScopedEntityReference => {
+            let seed = match value {
+                DerivedValue::EntityReferenceSeed(seed) => seed,
+                _ => return Err(KernelError::Output),
+            };
+            let reference = project_entity(concept, seed, projection)?;
+            Ok(PublicValue::EntityReference(EntityReferenceValue {
+                form: EntityReferenceForm::AudienceScopedEntityReference,
+                reference,
+            }))
+        }
+        ConceptForm::ControlledCodeList => {
+            let values = match value {
+                DerivedValue::Json(Value::Array(values)) => values,
+                _ => return Err(KernelError::Output),
+            };
+            validate_cardinality(concept, values.len())?;
+            let codelist = declared_codelist(concept, codelists)?;
+            let mut unique = BTreeSet::new();
+            let mut public = Vec::with_capacity(values.len());
+            for item in values {
+                let text = item.as_str().ok_or(KernelError::Output)?;
+                validate_public_string(text, MAXIMUM_PUBLIC_STRING_BYTES)?;
+                if !codelist.contains_output(text) || !unique.insert(text) {
+                    return Err(KernelError::Output);
+                }
+                public.push(ScalarOrEntityReference::String(text.to_owned()));
+            }
+            Ok(PublicValue::List(public))
+        }
+        ConceptForm::EntityReferenceList => {
+            let seeds = match value {
+                DerivedValue::EntityReferenceSeedList(seeds) => seeds,
+                _ => return Err(KernelError::Output),
+            };
+            validate_cardinality(concept, seeds.len())?;
+            let mut unique = BTreeSet::new();
+            let mut public = Vec::with_capacity(seeds.len());
+            for seed in seeds {
+                let reference = project_entity(concept, seed, projection)?;
+                if !unique.insert(reference.clone()) {
+                    return Err(KernelError::Output);
+                }
+                public.push(ScalarOrEntityReference::EntityReference(
+                    EntityReferenceValue {
+                        form: EntityReferenceForm::AudienceScopedEntityReference,
+                        reference,
+                    },
+                ));
+            }
+            Ok(PublicValue::List(public))
+        }
+        ConceptForm::ReviewedStructuredValue => {
+            validate_structured(concept, value, reviewed_schemas)
+        }
+    }
+}
+
+fn validate_bucket(
+    concept: &ConceptConfig,
+    value: &DerivedValue,
+    codelists: &BTreeMap<String, Codelist>,
+) -> Result<PublicValue, KernelError> {
+    let object = match value {
+        DerivedValue::Json(Value::Object(object)) => object,
+        _ => return Err(KernelError::Output),
+    };
+    if !has_exact_json_keys(object, &["form", "scheme", "bucket"]) {
+        return Err(KernelError::Output);
+    }
+    let expected_form = match concept.form {
+        ConceptForm::DateBucket => "date-bucket",
+        ConceptForm::TimeBucket => "time-bucket",
+        _ => return Err(KernelError::Bundle),
+    };
+    let form = object["form"].as_str().ok_or(KernelError::Output)?;
+    let scheme = object["scheme"].as_str().ok_or(KernelError::Output)?;
+    let bucket = object["bucket"].as_str().ok_or(KernelError::Output)?;
+    if form != expected_form
+        || scheme != constraint_str(concept, "bucketScheme")?
+        || !valid_code(bucket)
+        || bucket.len() > MAXIMUM_BUCKET_CODE_BYTES
+    {
+        return Err(KernelError::Output);
+    }
+    let scheme_version = constraint_str(concept, "schemeVersion")?;
+    let codelist = codelists
+        .values()
+        .filter(|candidate| candidate.id() == scheme && candidate.version() == scheme_version)
+        .exactly_one()
+        .ok_or(KernelError::Bundle)?;
+    if !codelist.contains_output(bucket) {
+        return Err(KernelError::Output);
+    }
+    Ok(PublicValue::Bucket(BucketValue {
+        form: if concept.form == ConceptForm::DateBucket {
+            BucketForm::DateBucket
+        } else {
+            BucketForm::TimeBucket
+        },
+        scheme: scheme.to_owned(),
+        bucket: bucket.to_owned(),
+    }))
+}
+
+fn validate_structured(
+    concept: &ConceptConfig,
+    value: &DerivedValue,
+    schemas: &BTreeMap<String, JSONSchema>,
+) -> Result<PublicValue, KernelError> {
+    let object = match value {
+        DerivedValue::Json(Value::Object(object)) => object,
+        _ => return Err(KernelError::Output),
+    };
+    if !has_exact_json_keys(object, &["form", "schema", "fields"])
+        || object["form"].as_str() != Some("reviewed-structured-value")
+    {
+        return Err(KernelError::Output);
+    }
+    let schema_id = object["schema"].as_str().ok_or(KernelError::Output)?;
+    if schema_id != constraint_str(concept, "schema")? {
+        return Err(KernelError::Output);
+    }
+    let fields = object["fields"]
+        .as_object()
+        .filter(|fields| !fields.is_empty() && fields.len() <= 16)
+        .ok_or(KernelError::Output)?;
+    let maximum = constraint_usize(concept, "maximumSerializedBytes")?;
+    if serde_json::to_vec(value_as_json(value)?)
+        .map_err(|_| KernelError::Output)?
+        .len()
+        > maximum
+    {
+        return Err(KernelError::Output);
+    }
+    let schema = schemas.get(schema_id).ok_or(KernelError::Bundle)?;
+    let fields_value = Value::Object(fields.clone());
+    if !schema.is_valid(&fields_value) {
+        return Err(KernelError::Output);
+    }
+    Ok(PublicValue::Structured(StructuredValue {
+        form: StructuredValueForm::ReviewedStructuredValue,
+        schema: schema_id.to_owned(),
+        fields: fields.clone().into_iter().collect(),
+    }))
+}
+
+fn project_entity(
+    concept: &ConceptConfig,
+    seed: &crate::values::EntityReferenceSeed,
+    projection: &ValueProjection<'_>,
+) -> Result<String, KernelError> {
+    let reference = entity_reference(
+        projection.binding_key,
+        projection.binding_key_version,
+        &concept.id,
+        projection.audience,
+        seed.expose_for_projection(),
+    )
+    .map_err(|_| KernelError::Output)?;
+    let maximum = if concept.constraints.contains_key("maximumBytes") {
+        constraint_usize(concept, "maximumBytes")?
+    } else {
+        MAXIMUM_PUBLIC_STRING_BYTES
+    };
+    if reference.len() > maximum {
+        return Err(KernelError::Output);
+    }
+    Ok(reference)
+}
+
+fn validate_evidence_inputs(
+    requirement: &RequirementConfig,
+    values: &[SupportedValue],
+    input: &EvidenceConstruction<'_>,
+) -> Result<(), KernelError> {
+    if input.evidence_id.is_empty()
+        || input.evidence_id.len() > MAXIMUM_EVIDENCE_IDENTIFIER_BYTES
+        || url::Url::parse(input.evidence_id).is_err()
+        || !crate::model::request_nonce_is_canonical(input.request_nonce)
+        || input.audience.is_empty()
+        || input.audience.len() > MAXIMUM_EVIDENCE_IDENTIFIER_BYTES
+        || url::Url::parse(input.audience).is_err()
+        || !requirement
+            .purposes
+            .iter()
+            .any(|purpose| purpose == input.purpose)
+        || input.issued_at < input.observed_at
+        || input.subjects.len() != requirement.subject_roles.len()
+        || values.is_empty()
+    {
+        return Err(KernelError::Evidence);
+    }
+    let mut roles = BTreeSet::new();
+    for (configured, subject) in requirement.subject_roles.iter().zip(&input.subjects) {
+        if configured.role != subject.role
+            || !roles.insert(subject.role.as_str())
+            || !valid_opaque_binding(&subject.binding)
+        {
+            return Err(KernelError::Evidence);
+        }
+    }
+    let expected = requirement
+        .concepts
+        .iter()
+        .filter(|concept| concept.required)
+        .map(|concept| concept.id.as_str())
+        .collect::<BTreeSet<_>>();
+    let actual = values
+        .iter()
+        .map(|value| value.provides_value_for.as_str())
+        .collect::<BTreeSet<_>>();
+    if actual.len() != values.len()
+        || !expected.is_subset(&actual)
+        || actual.iter().any(|identifier| {
+            !requirement
+                .concepts
+                .iter()
+                .any(|concept| concept.id == *identifier)
+        })
+    {
+        return Err(KernelError::Evidence);
+    }
+    Ok(())
+}
+
+fn format_utc(value: DateTime<Utc>) -> String {
+    value.to_rfc3339_opts(SecondsFormat::Secs, true)
+}
+
+fn valid_opaque_binding(value: &str) -> bool {
+    let Some(rest) = value.strip_prefix("urn:evidence:subject:v") else {
+        return false;
+    };
+    let Some((version, encoded)) = rest.split_once('_') else {
+        return false;
+    };
+    !version.is_empty()
+        && !version.starts_with('0')
+        && version.bytes().all(|byte| byte.is_ascii_digit())
+        && encoded.len() == 43
+        && encoded
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'))
+}
+
+fn derived_string(value: &DerivedValue) -> Result<&str, KernelError> {
+    match value {
+        DerivedValue::Json(Value::String(value)) => Ok(value),
+        _ => Err(KernelError::Output),
+    }
+}
+
+fn value_as_json(value: &DerivedValue) -> Result<&Value, KernelError> {
+    match value {
+        DerivedValue::Json(value) => Ok(value),
+        _ => Err(KernelError::Output),
+    }
+}
+
+fn validate_public_string(value: &str, declared_maximum: usize) -> Result<(), KernelError> {
+    if value.is_empty()
+        || value.len() > declared_maximum
+        || value.len() > MAXIMUM_PUBLIC_STRING_BYTES
+    {
+        return Err(KernelError::Output);
+    }
+    Ok(())
+}
+
+fn validate_cardinality(concept: &ConceptConfig, length: usize) -> Result<(), KernelError> {
+    let minimum = constraint_usize(concept, "minimumItems")?;
+    let maximum = constraint_usize(concept, "maximumItems")?;
+    if length < minimum || length > maximum || !constraint_bool(concept, "unique")? {
+        return Err(KernelError::Output);
+    }
+    Ok(())
+}
+
+fn declared_codelist<'a>(
+    concept: &ConceptConfig,
+    codelists: &'a BTreeMap<String, Codelist>,
+) -> Result<&'a Codelist, KernelError> {
+    let path = constraint_str(concept, "codelist")?;
+    let expected_version_key = if concept.form == ConceptForm::ControlledCategory {
+        "schemeVersion"
+    } else {
+        "codelistVersion"
+    };
+    let expected_version = constraint_str(concept, expected_version_key)?;
+    let codelist = codelists.get(path).ok_or(KernelError::Bundle)?;
+    if codelist.version() != expected_version {
+        return Err(KernelError::Bundle);
+    }
+    Ok(codelist)
+}
+
+fn constraint_str<'a>(concept: &'a ConceptConfig, name: &str) -> Result<&'a str, KernelError> {
+    concept
+        .constraints
+        .get(name)
+        .and_then(serde_norway::Value::as_str)
+        .ok_or(KernelError::Bundle)
+}
+
+fn constraint_i64(concept: &ConceptConfig, name: &str) -> Result<i64, KernelError> {
+    concept
+        .constraints
+        .get(name)
+        .and_then(serde_norway::Value::as_i64)
+        .ok_or(KernelError::Bundle)
+}
+
+fn constraint_u64(concept: &ConceptConfig, name: &str) -> Result<u64, KernelError> {
+    concept
+        .constraints
+        .get(name)
+        .and_then(serde_norway::Value::as_u64)
+        .ok_or(KernelError::Bundle)
+}
+
+fn constraint_usize(concept: &ConceptConfig, name: &str) -> Result<usize, KernelError> {
+    usize::try_from(constraint_u64(concept, name)?).map_err(|_| KernelError::Bundle)
+}
+
+fn constraint_bool(concept: &ConceptConfig, name: &str) -> Result<bool, KernelError> {
+    concept
+        .constraints
+        .get(name)
+        .and_then(serde_norway::Value::as_bool)
+        .ok_or(KernelError::Bundle)
+}
+
+fn has_exact_json_keys(object: &JsonMap<String, Value>, keys: &[&str]) -> bool {
+    object.len() == keys.len() && keys.iter().all(|key| object.contains_key(*key))
+}
+
+fn valid_code(value: &str) -> bool {
+    let mut bytes = value.bytes();
+    bytes
+        .next()
+        .is_some_and(|byte| byte.is_ascii_alphanumeric())
+        && bytes
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b':' | b'-'))
+}
+
+trait ExactlyOne: Iterator + Sized {
+    fn exactly_one(mut self) -> Option<Self::Item> {
+        let item = self.next()?;
+        self.next().is_none().then_some(item)
+    }
+}
+
+impl<I: Iterator> ExactlyOne for I {}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+    use std::path::{Path, PathBuf};
+    use std::time::Duration as StdDuration;
+
+    use registry_platform_crypto::{LocalJwkSigner, PrivateJwk, SigningProvider};
+    use serde_json::json;
+    use tempfile::TempDir;
+
+    use crate::signing::{jwks_document, EvidenceSigner};
+    use crate::source::project_fixture_response;
+    use crate::verifier::{verify_flattened_jws, EvidenceVerificationPolicy};
+
+    const KEY: &[u8] = b"0123456789abcdef0123456789abcdef";
+    const AUDIENCE: &str = "urn:example:fixture:audience";
+    const SUPPORTED_VALUE_PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"supported-values-fixture-key"}"#;
+
+    fn projection() -> ValueProjection<'static> {
+        ValueProjection {
+            audience: AUDIENCE,
+            binding_key: KEY,
+            binding_key_version: 1,
+        }
+    }
+
+    #[test]
+    fn all_four_acceptance_bundles_use_the_same_kernel() {
+        let cases = [
+            "adult-status",
+            "residence-region",
+            "professional-licence",
+            "legal-parent-relationship",
+        ];
+        for case in cases {
+            let copied = immutable_fixture(case);
+            let bundle = Arc::new(Bundle::load(copied.path()).expect("acceptance bundle loads"));
+            let kernel = OfflineKernel::compile(Arc::clone(&bundle)).expect("kernel compiles");
+            let requirement = &bundle.config.requirements[0];
+            let fixture: Value = serde_norway::from_slice(
+                bundle
+                    .artifact(
+                        requirement
+                            .fixtures
+                            .as_ref()
+                            .expect("acceptance fixture is declared")
+                            .as_str(),
+                    )
+                    .expect("fixture is captured"),
+            )
+            .expect("fixture parses");
+            let source_config = bundle
+                .config
+                .sources
+                .get(&requirement.source)
+                .expect("requirement source exists");
+            for test_case in fixture["cases"].as_array().expect("cases is an array") {
+                if test_case.get("source_failure").is_some()
+                    || test_case.get("injected_derivation").is_some()
+                    || test_case.get("companion_bundle").is_some()
+                    || test_case.get("subjects").is_some()
+                {
+                    continue;
+                }
+                let Some(source) = test_case.get("source") else {
+                    continue;
+                };
+                let source = project_fixture_response(source_config, source)
+                    .map_err(|_| KernelError::SourceProtocol);
+                let observed = observed_for_case(&fixture, test_case);
+                let selectors = test_case
+                    .get("derivationSelectorInputs")
+                    .or_else(|| {
+                        fixture
+                            .get("common")
+                            .and_then(|common| common.get("derivationSelectorInputs"))
+                    })
+                    .cloned()
+                    .unwrap_or_else(|| Value::Object(JsonMap::new()));
+                let result = source.and_then(|source| {
+                    kernel.evaluate_with_selectors(
+                        &requirement.id,
+                        &source,
+                        &selectors,
+                        observed,
+                        projection(),
+                    )
+                });
+                match test_case.get("expected_lookup").and_then(Value::as_str) {
+                    Some("no_match") => assert!(matches!(result, Ok(KernelOutcome::NoMatch))),
+                    Some("ambiguous") => assert!(matches!(result, Ok(KernelOutcome::Ambiguous))),
+                    _ if test_case.get("expected_public_problem").is_some() => {
+                        assert!(result.is_err(), "{case}: {}", test_case["id"])
+                    }
+                    _ => {
+                        let KernelOutcome::Match(values) = result.unwrap_or_else(|error| {
+                            panic!("{case}: {} failed: {error:?}", test_case["id"])
+                        }) else {
+                            panic!("{case}: expected match");
+                        };
+                        assert!(!values.as_slice().is_empty());
+                        if let Some(expected) = test_case.get("expected_value") {
+                            assert_eq!(
+                                serde_json::to_value(&values.as_slice()[0].value)
+                                    .expect("value serializes"),
+                                *expected
+                            );
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn a_projected_response_outside_its_declared_shape_fails_before_extraction() {
+        let copied = immutable_fixture("adult-status");
+        let bundle = Arc::new(Bundle::load(copied.path()).expect("bundle loads"));
+        let kernel = OfflineKernel::compile(Arc::clone(&bundle)).expect("kernel compiles");
+        let requirement = &bundle.config.requirements[0];
+
+        // The declared response shape is the extraction contract. Rust refuses
+        // a response the script would otherwise have to re-check by hand, and
+        // the refusal is the same closed source-protocol class the script
+        // would have raised.
+        for response in [
+            json!({}),
+            json!({"total": "1"}),
+            json!({"total": -1}),
+            json!({"total": 1, "unexpected": true}),
+            json!({"total": 1, "date_of_birth": 19700101}),
+            json!({"total": 1, "date_of_birth": "1970-13-01"}),
+        ] {
+            assert_eq!(
+                kernel.extract(&requirement.id, &response),
+                Err(KernelError::SourceProtocol),
+                "{response}"
+            );
+        }
+
+        // An absent optional leaf is legitimate after projection, so it stays a
+        // script decision rather than a shape violation.
+        assert_eq!(
+            kernel.extract(&requirement.id, &json!({"total": 1})),
+            Err(KernelError::Extraction)
+        );
+        assert_eq!(
+            kernel.extract(
+                &requirement.id,
+                &json!({"total": 1, "date_of_birth": "1970-01-01"})
+            ),
+            Ok(LookupResult::Match(BTreeMap::from([(
+                "date_of_birth".to_owned(),
+                json!("1970-01-01")
+            )])))
+        );
+    }
+
+    /// A shape rejection reaches the requester as `dependency_unavailable`,
+    /// which names the provider. When the real defect is a bundle schema that
+    /// no longer describes the source, the operator log is the only place that
+    /// can say so, and it can only say it by naming the member and the rule.
+    /// It must do that without recording any part of the response.
+    #[test]
+    fn a_response_shape_rejection_names_the_member_and_the_rule_but_no_value() {
+        let copied = immutable_fixture("adult-status");
+        let bundle = Arc::new(Bundle::load(copied.path()).expect("bundle loads"));
+        let requirement = &bundle.config.requirements[0];
+        let source = bundle
+            .config
+            .sources
+            .get(&requirement.source)
+            .expect("the requirement names a configured source");
+        let schema = bundle
+            .fact_schema(&source.response_schema)
+            .expect("the response schema is a bundle artifact");
+        let compiled = compile_schema(schema).expect("the response schema compiles");
+
+        let canary = "0451-mrs-hunt-was-born-in-caracas";
+        let response = json!({"total": 1, "date_of_birth": canary});
+        let errors = compiled
+            .validate(&response)
+            .expect_err("a malformed date violates the shape");
+        let (violations, total) = describe_response_shape_rejection(errors);
+        assert_eq!(total, 1);
+        assert_eq!(
+            violations,
+            vec!["/date_of_birth violates /properties/date_of_birth/format".to_owned()]
+        );
+
+        // The library's own message would carry the value here, which is the
+        // reason the description is built from the two pointers instead.
+        assert!(
+            !violations
+                .iter()
+                .any(|violation| violation.contains(canary)),
+            "no response value reaches the log: {violations:?}"
+        );
+
+        // A violation at the document root still names somewhere.
+        let not_an_object = json!([]);
+        let errors = compiled
+            .validate(&not_an_object)
+            .expect_err("an array is not the declared object");
+        let (violations, _) = describe_response_shape_rejection(errors);
+        assert_eq!(
+            violations,
+            vec!["the response root violates /type".to_owned()]
+        );
+
+        // A source cannot decide how much the log holds.
+        let many = json!({"total": -1, "date_of_birth": "not-a-date", "extra": 1});
+        let errors = compiled
+            .validate(&many)
+            .expect_err("several rules are violated at once");
+        let (violations, total) = describe_response_shape_rejection(errors);
+        assert!(total >= 3, "the count is the whole number of violations");
+        assert!(violations.len() <= REPORTED_SHAPE_VIOLATIONS);
+    }
+
+    #[test]
+    fn extraction_failures_and_invalid_outputs_fail_closed() {
+        let copied = immutable_fixture("adult-status");
+        let bundle = Arc::new(Bundle::load(copied.path()).expect("bundle loads"));
+        let kernel = OfflineKernel::compile(Arc::clone(&bundle)).expect("kernel compiles");
+        let requirement = &bundle.config.requirements[0];
+        assert_eq!(
+            kernel.extract(&requirement.id, &json!({"total": 0})),
+            Ok(LookupResult::NoMatch)
+        );
+        assert_eq!(
+            kernel.extract(&requirement.id, &json!({"total": 2})),
+            Ok(LookupResult::Ambiguous)
+        );
+        assert!(kernel
+            .validate_values(
+                &requirement.id,
+                vec![DerivedConceptValue {
+                    concept_id: requirement.concepts[0].id.clone(),
+                    value: DerivedValue::Json(json!("true")),
+                }],
+                projection(),
+            )
+            .is_err());
+        let validated = kernel
+            .validate_values(
+                &requirement.id,
+                vec![DerivedConceptValue {
+                    concept_id: requirement.concepts[0].id.clone(),
+                    value: DerivedValue::Json(json!(true)),
+                }],
+                projection(),
+            )
+            .expect("valid output");
+        let debug = format!("{validated:?}");
+        assert!(!debug.contains("true"));
+        assert!(kernel
+            .validate_values(
+                &requirement.id,
+                vec![
+                    DerivedConceptValue {
+                        concept_id: requirement.concepts[0].id.clone(),
+                        value: DerivedValue::Json(json!(true)),
+                    },
+                    DerivedConceptValue {
+                        concept_id: requirement.concepts[0].id.clone(),
+                        value: DerivedValue::Json(json!(false)),
+                    },
+                ],
+                projection(),
+            )
+            .is_err());
+        assert!(kernel
+            .validate_values(
+                &requirement.id,
+                vec![DerivedConceptValue {
+                    concept_id: "urn:example:fixture:concept:extra".to_owned(),
+                    value: DerivedValue::Json(json!(true)),
+                }],
+                projection(),
+            )
+            .is_err());
+    }
+
+    #[test]
+    fn required_unmapped_source_fact_is_unavailable_not_a_script_failure() {
+        let copied = immutable_fixture("residence-region");
+        let bundle = Arc::new(Bundle::load(copied.path()).expect("bundle loads"));
+        let kernel = OfflineKernel::compile(Arc::clone(&bundle)).expect("kernel compiles");
+        let requirement = &bundle.config.requirements[0];
+        let observed = "2026-08-02T00:00:00Z".parse().expect("time");
+        let LookupResult::Match(facts) = kernel
+            .extract(
+                &requirement.id,
+                &json!({"total": 1, "official_residence_code": "R-999"}),
+            )
+            .expect("source extracts")
+        else {
+            panic!("source must uniquely match");
+        };
+        let raw = kernel.runtime.derive(
+            kernel
+                .derivations
+                .get(&requirement.id)
+                .expect("derivation exists"),
+            &facts,
+            &Value::Object(JsonMap::new()),
+            kernel
+                .evaluation_context(requirement, observed)
+                .expect("context builds"),
+        );
+        assert!(
+            matches!(raw, Err(RhaiRuntimeError::Unavailable)),
+            "unexpected closed error class: {:?}",
+            raw.err()
+        );
+        assert_eq!(
+            kernel.evaluate(
+                &requirement.id,
+                &json!({"total": 1, "official_residence_code": "R-999"}),
+                observed,
+                projection(),
+            ),
+            Err(KernelError::Extraction)
+        );
+    }
+
+    #[test]
+    fn scalar_decimal_and_collection_forms_are_exact() {
+        let code_list = Codelist::Codes {
+            id: "urn:example:codes".to_owned(),
+            version: "1".to_owned(),
+            codes: vec!["A".to_owned(), "B".to_owned()],
+        };
+        let codelists = BTreeMap::from([("urn:example:codes".to_owned(), code_list)]);
+        let schemas = BTreeMap::new();
+
+        assert_eq!(
+            validate_value(
+                &concept("form: boolean\nrequired: true\nconstraints: {}"),
+                &DerivedValue::Json(json!(false)),
+                &projection(),
+                &codelists,
+                &schemas,
+            ),
+            Ok(PublicValue::Boolean(false))
+        );
+        assert_eq!(
+            validate_value(
+                &concept(
+                    "form: bounded-integer\nrequired: true\nconstraints: {minimum: -2, maximum: 2}"
+                ),
+                &DerivedValue::Json(json!(2)),
+                &projection(),
+                &codelists,
+                &schemas,
+            ),
+            Ok(PublicValue::Integer(2))
+        );
+        assert_eq!(
+            validate_value(
+                &concept("form: controlled-code\nrequired: true\nconstraints: {codelist: 'urn:example:codes', codelistVersion: '1', maximumBytes: 8}"),
+                &DerivedValue::Json(json!("A")),
+                &projection(),
+                &codelists,
+                &schemas,
+            ),
+            Ok(PublicValue::String("A".to_owned()))
+        );
+        assert_eq!(
+            validate_value(
+                &concept("form: bounded-decimal\nrequired: true\nconstraints: {minimum: '-1.5', maximum: '1.5', maximumScale: 2}"),
+                &DerivedValue::Decimal(Decimal::parse("0.25").expect("decimal")),
+                &projection(),
+                &codelists,
+                &schemas,
+            ),
+            Ok(PublicValue::String("0.25".to_owned()))
+        );
+        assert!(validate_value(
+            &concept("form: bounded-decimal\nrequired: true\nconstraints: {minimum: '-1.5', maximum: '1.5', maximumScale: 2}"),
+            &DerivedValue::Json(json!(0.25)),
+            &projection(),
+            &codelists,
+            &schemas,
+        )
+        .is_err());
+
+        let controlled = concept(
+            "form: controlled-code-list\nrequired: true\nconstraints: {codelist: 'urn:example:codes', codelistVersion: '1', minimumItems: 1, maximumItems: 2, unique: true}",
+        );
+        assert!(validate_value(
+            &controlled,
+            &DerivedValue::Json(json!(["A", "A"])),
+            &projection(),
+            &codelists,
+            &schemas,
+        )
+        .is_err());
+        assert!(validate_value(
+            &controlled,
+            &DerivedValue::Json(json!(["UNKNOWN"])),
+            &projection(),
+            &codelists,
+            &schemas,
+        )
+        .is_err());
+
+        let category_list = Codelist::Codes {
+            id: "urn:example:category-scheme".to_owned(),
+            version: "7".to_owned(),
+            codes: vec!["category-a".to_owned()],
+        };
+        let category_lists =
+            BTreeMap::from([("codelists/categories.yaml".to_owned(), category_list)]);
+        assert_eq!(
+            validate_value(
+                &concept("form: controlled-category\nrequired: true\nconstraints: {categoryScheme: 'urn:example:category-scheme', schemeVersion: '7', maximumBytes: 32, codelist: 'codelists/categories.yaml'}"),
+                &DerivedValue::Json(json!("category-a")),
+                &projection(),
+                &category_lists,
+                &schemas,
+            ),
+            Ok(PublicValue::String("category-a".to_owned()))
+        );
+    }
+
+    #[test]
+    fn bucket_entity_and_structured_forms_are_closed() {
+        let buckets = Codelist::Codes {
+            id: "urn:example:bucket-scheme".to_owned(),
+            version: "1".to_owned(),
+            codes: vec!["inside".to_owned()],
+        };
+        let codelists = BTreeMap::from([("buckets".to_owned(), buckets)]);
+        let bucket = concept(
+            "form: time-bucket\nrequired: true\nconstraints: {bucketScheme: 'urn:example:bucket-scheme', schemeVersion: '1'}",
+        );
+        let date_bucket = concept(
+            "form: date-bucket\nrequired: true\nconstraints: {bucketScheme: 'urn:example:bucket-scheme', schemeVersion: '1'}",
+        );
+        assert!(matches!(
+            validate_value(
+                &date_bucket,
+                &DerivedValue::Json(
+                    json!({"form":"date-bucket","scheme":"urn:example:bucket-scheme","bucket":"inside"})
+                ),
+                &projection(),
+                &codelists,
+                &BTreeMap::new(),
+            ),
+            Ok(PublicValue::Bucket(BucketValue {
+                form: BucketForm::DateBucket,
+                ..
+            }))
+        ));
+        assert!(validate_value(
+            &bucket,
+            &DerivedValue::Json(json!({"form":"time-bucket","scheme":"urn:example:bucket-scheme","bucket":"unknown"})),
+            &projection(),
+            &codelists,
+            &BTreeMap::new(),
+        )
+        .is_err());
+
+        let entity = concept(
+            "form: audience-scoped-entity-reference\nrequired: true\nconstraints: {maximumBytes: 160}",
+        );
+        let seed = crate::values::EntityReferenceSeed::new("protected-seed").expect("seed");
+        let public = validate_value(
+            &entity,
+            &DerivedValue::EntityReferenceSeed(seed),
+            &projection(),
+            &codelists,
+            &BTreeMap::new(),
+        )
+        .expect("entity projects");
+        assert!(matches!(public, PublicValue::EntityReference(_)));
+        assert!(validate_value(
+            &entity,
+            &DerivedValue::Json(json!("protected-seed")),
+            &projection(),
+            &codelists,
+            &BTreeMap::new(),
+        )
+        .is_err());
+
+        let entity_list = concept(
+            "form: entity-reference-list\nrequired: true\nconstraints: {minimumItems: 1, maximumItems: 2, unique: true}",
+        );
+        let duplicate = crate::values::EntityReferenceSeed::new("same-seed").expect("seed");
+        assert!(validate_value(
+            &entity_list,
+            &DerivedValue::EntityReferenceSeedList(vec![duplicate.clone(), duplicate]),
+            &projection(),
+            &codelists,
+            &BTreeMap::new(),
+        )
+        .is_err());
+        let projected = validate_value(
+            &entity_list,
+            &DerivedValue::EntityReferenceSeedList(vec![
+                crate::values::EntityReferenceSeed::new("seed-a").expect("seed"),
+                crate::values::EntityReferenceSeed::new("seed-b").expect("seed"),
+            ]),
+            &projection(),
+            &codelists,
+            &BTreeMap::new(),
+        )
+        .expect("entity list projects");
+        assert!(matches!(projected, PublicValue::List(_)));
+
+        let schema_id = "urn:example:structured";
+        let schema = compile_schema(&json!({
+            "$schema": "https://json-schema.org/draft/2020-12/schema",
+            "$id": schema_id,
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["status", "effective_date", "observed_at"],
+            "properties": {
+                "status": {"type": "string", "enum": ["A"]},
+                "effective_date": {"type": "string", "format": "date"},
+                "observed_at": {"type": "string", "format": "date-time"}
+            }
+        }))
+        .expect("schema compiles");
+        let schemas = BTreeMap::from([(schema_id.to_owned(), schema)]);
+        let structured = concept(
+            "form: reviewed-structured-value\nrequired: true\nconstraints: {schema: 'urn:example:structured', maximumSerializedBytes: 512}",
+        );
+        assert!(validate_value(
+            &structured,
+            &DerivedValue::Json(json!({"form":"reviewed-structured-value","schema":schema_id,"fields":{"status":"A","effective_date":"2026-02-30","observed_at":"not-an-instant"}})),
+            &projection(),
+            &codelists,
+            &schemas,
+        )
+        .is_err());
+        assert!(validate_value(
+            &structured,
+            &DerivedValue::Json(json!({"form":"reviewed-structured-value","schema":schema_id,"fields":{"status":"A","effective_date":"2026-02-28","observed_at":"2026-02-28T12:00:00Z"}})),
+            &projection(),
+            &codelists,
+            &schemas,
+        )
+        .is_ok());
+    }
+
+    #[test]
+    fn evidence_construction_is_deterministic_and_role_ordered() {
+        let copied = immutable_fixture("legal-parent-relationship");
+        let bundle = Arc::new(Bundle::load(copied.path()).expect("bundle loads"));
+        let kernel = OfflineKernel::compile(Arc::clone(&bundle)).expect("kernel compiles");
+        let requirement = &bundle.config.requirements[0];
+        let values = kernel
+            .validate_values(
+                &requirement.id,
+                vec![DerivedConceptValue {
+                    concept_id: requirement.concepts[0].id.clone(),
+                    value: DerivedValue::Json(json!(false)),
+                }],
+                projection(),
+            )
+            .expect("values validate");
+        let construction = || EvidenceConstruction {
+            evidence_id: "urn:ulid:01K1EXAMPLE0000000000000000",
+            request_nonce: crate::model::OFFLINE_EVALUATION_REQUEST_NONCE,
+            purpose: &requirement.purposes[0],
+            audience: AUDIENCE,
+            issued_at: "2026-08-02T00:00:01Z".parse().expect("time"),
+            observed_at: "2026-08-02T00:00:00Z".parse().expect("time"),
+            subjects: vec![
+                SubjectBinding {
+                    role: "child".to_owned(),
+                    binding: format!("urn:evidence:subject:v1_{}", "A".repeat(43)),
+                },
+                SubjectBinding {
+                    role: "candidate-parent".to_owned(),
+                    binding: format!("urn:evidence:subject:v1_{}", "B".repeat(43)),
+                },
+            ],
+        };
+        let first = kernel
+            .construct_evidence(&requirement.id, values.clone(), construction())
+            .expect("constructs");
+        let second = kernel
+            .construct_evidence(&requirement.id, values, construction())
+            .expect("constructs");
+        assert_eq!(first, second);
+        assert_eq!(first.supported_values[0].value, PublicValue::Boolean(false));
+        assert_eq!(first.subjects[0].role, "child");
+        assert_eq!(first.subjects[1].role, "candidate-parent");
+        assert_eq!(first.valid_until, "2026-08-03T00:00:01Z");
+    }
+
+    #[tokio::test]
+    async fn supported_value_fixture_cases_use_the_real_gate_and_signed_round_trip() {
+        let fixture = supported_values_fixture();
+        assert_eq!(
+            fixture["fixture"].as_str(),
+            Some("registry.evidence.supported-values/v1")
+        );
+        assert_eq!(fixture["synthetic_only"].as_bool(), Some(true));
+
+        let copied = immutable_supported_values_bundle();
+        let bundle = Arc::new(Bundle::load(copied.path()).expect("supported-value bundle loads"));
+        let kernel = OfflineKernel::compile(Arc::clone(&bundle)).expect("kernel compiles");
+        let requirement = &bundle.config.requirements[0];
+        let forms = fixture["forms"].as_array().expect("forms are an array");
+        assert_eq!(forms.len(), 11, "all Version 1 forms remain covered");
+        assert_eq!(requirement.concepts.len(), forms.len());
+
+        let signer = supported_values_signer().await;
+        for form_fixture in forms {
+            let form = form_fixture["form"].as_str().expect("form name");
+            let concept_id = format!("urn:example:fixture:concept:{form}");
+            let concept = requirement
+                .concepts
+                .iter()
+                .find(|candidate| candidate.id == concept_id)
+                .unwrap_or_else(|| panic!("bundle declaration missing {form}"));
+            assert_fixture_declaration(form_fixture, concept);
+
+            for category in ["positive", "boundary"] {
+                let cases = form_fixture[category]
+                    .as_array()
+                    .unwrap_or_else(|| panic!("{form} {category} cases"));
+                for (index, fixture_case) in cases.iter().enumerate() {
+                    let derived = accepted_derived_value(
+                        &kernel,
+                        requirement,
+                        form_fixture,
+                        category,
+                        index,
+                        fixture_case,
+                    )
+                    .unwrap_or_else(|error| {
+                        panic!("{form} {category}[{index}] derivation failed: {error:?}")
+                    });
+                    let values = gate_fixture_value(&kernel, requirement, form, derived)
+                        .unwrap_or_else(|error| {
+                            panic!("{form} {category}[{index}] gate failed: {error:?}")
+                        });
+                    let public = values
+                        .as_slice()
+                        .iter()
+                        .find(|value| value.provides_value_for == concept_id)
+                        .unwrap_or_else(|| panic!("{form} value was not emitted"));
+                    assert_fixture_public_shape(form, fixture_case, &public.value);
+                    assert_signed_type_preserving_round_trip(&kernel, requirement, values, &signer)
+                        .await;
+                }
+            }
+
+            let negatives = form_fixture["negative"]
+                .as_array()
+                .unwrap_or_else(|| panic!("{form} negatives"));
+            for (index, fixture_case) in negatives.iter().enumerate() {
+                let derivation =
+                    fixture_derived_value(&kernel, requirement, &concept_id, fixture_case);
+                if fixture_case.get("leak_surface").is_some() {
+                    let derived = derivation.unwrap_or_else(|error| {
+                        panic!("{form} privacy negative[{index}] must derive: {error:?}")
+                    });
+                    let values = gate_fixture_value(&kernel, requirement, form, derived)
+                        .expect("protected seed is projected by the output gate");
+                    let serialized = serde_json::to_string(values.as_slice()).expect("serializes");
+                    let debug = format!("{values:?}");
+                    assert!(!serialized.contains("source-seed-canary"));
+                    assert!(!debug.contains("source-seed-canary"));
+                } else {
+                    let rejected = match derivation {
+                        Err(_) => true,
+                        Ok(derived) => {
+                            gate_fixture_value(&kernel, requirement, form, derived).is_err()
+                        }
+                    };
+                    assert!(rejected, "{form} negative[{index}] must fail closed");
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn supported_value_fixture_global_negatives_are_enforced() {
+        let fixture = supported_values_fixture();
+        let declared = fixture["global_negative"]
+            .as_array()
+            .expect("global negatives")
+            .iter()
+            .map(|value| value.as_str().expect("negative id"))
+            .collect::<Vec<_>>();
+        assert_eq!(
+            declared,
+            vec![
+                "undeclared-concept",
+                "duplicate-concept",
+                "missing-required-concept",
+                "extra-value-metadata",
+                "per-value-size-plus-one",
+                "aggregate-result-size-plus-one",
+            ]
+        );
+
+        let copied = immutable_supported_values_bundle();
+        let bundle = Arc::new(Bundle::load(copied.path()).expect("supported-value bundle loads"));
+        let kernel = OfflineKernel::compile(Arc::clone(&bundle)).expect("kernel compiles");
+        let requirement = &bundle.config.requirements[0];
+        let boolean = || DerivedConceptValue {
+            concept_id: "urn:example:fixture:concept:boolean".to_owned(),
+            value: DerivedValue::Json(json!(true)),
+        };
+
+        assert_eq!(
+            kernel.validate_values(
+                &requirement.id,
+                vec![DerivedConceptValue {
+                    concept_id: "urn:example:fixture:concept:undeclared".to_owned(),
+                    value: DerivedValue::Json(json!(true)),
+                }],
+                projection(),
+            ),
+            Err(KernelError::Output),
+            "undeclared-concept"
+        );
+        assert_eq!(
+            kernel.validate_values(&requirement.id, vec![boolean(), boolean()], projection(),),
+            Err(KernelError::Output),
+            "duplicate-concept"
+        );
+        assert_eq!(
+            kernel.validate_values(
+                &requirement.id,
+                vec![DerivedConceptValue {
+                    concept_id: "urn:example:fixture:concept:bounded-integer".to_owned(),
+                    value: DerivedValue::Json(json!(0)),
+                }],
+                projection(),
+            ),
+            Err(KernelError::Output),
+            "missing-required-concept"
+        );
+
+        let extra_metadata = r#"
+            fn derive(facts, selectors, evaluation_context) {
+                [#{
+                    concept_id: "urn:example:fixture:concept:boolean",
+                    value: true,
+                    confidence: "not-allowed"
+                }]
+            }
+        "#;
+        let script = kernel
+            .runtime
+            .compile_derivation(extra_metadata)
+            .expect("negative script compiles");
+        assert!(
+            kernel
+                .runtime
+                .derive(
+                    &script,
+                    &BTreeMap::new(),
+                    &Value::Object(JsonMap::new()),
+                    kernel
+                        .evaluation_context(
+                            requirement,
+                            "2026-08-02T00:00:00Z".parse().expect("time")
+                        )
+                        .expect("context"),
+                )
+                .is_err(),
+            "extra-value-metadata"
+        );
+
+        let oversized = "A".repeat(MAXIMUM_PUBLIC_STRING_BYTES + 1);
+        let oversized_codelist = Codelist::Codes {
+            id: "urn:example:fixture:codelist:oversized".to_owned(),
+            version: "1".to_owned(),
+            codes: vec![oversized.clone()],
+        };
+        assert_eq!(
+            validate_value(
+                &concept("form: controlled-code\nrequired: true\nconstraints: {codelist: oversized, codelistVersion: '1', maximumBytes: 8192}"),
+                &DerivedValue::Json(Value::String(oversized)),
+                &projection(),
+                &BTreeMap::from([("oversized".to_owned(), oversized_codelist)]),
+                &BTreeMap::new(),
+            ),
+            Err(KernelError::Output),
+            "per-value-size-plus-one"
+        );
+
+        let aggregate_schema_id = "urn:example:fixture:schema:aggregate:v1";
+        let aggregate_schema = compile_schema(&json!({
+            "$schema": "https://json-schema.org/draft/2020-12/schema",
+            "$id": aggregate_schema_id,
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["blob"],
+            "properties": {"blob": {"type": "string", "maxLength": 5000}}
+        }))
+        .expect("aggregate schema compiles");
+        let aggregate_concepts = (0..16)
+            .map(|index| {
+                let mut candidate = concept(&format!(
+                    "form: reviewed-structured-value\nrequired: false\nconstraints: {{schema: '{aggregate_schema_id}', maximumSerializedBytes: 8192}}"
+                ));
+                candidate.id = format!("urn:example:fixture:concept:aggregate-{index}");
+                candidate
+            })
+            .collect::<Vec<_>>();
+        let mut aggregate_requirement = requirement.clone();
+        aggregate_requirement.concepts = aggregate_concepts;
+        let aggregate_values = (0..16)
+            .map(|index| DerivedConceptValue {
+                concept_id: format!("urn:example:fixture:concept:aggregate-{index}"),
+                value: DerivedValue::Json(json!({
+                    "form": "reviewed-structured-value",
+                    "schema": aggregate_schema_id,
+                    "fields": {"blob": "X".repeat(4200)}
+                })),
+            })
+            .collect();
+        assert_eq!(
+            gate_values(
+                &aggregate_requirement,
+                aggregate_values,
+                projection(),
+                &BTreeMap::new(),
+                &BTreeMap::from([(aggregate_schema_id.to_owned(), aggregate_schema)]),
+            ),
+            Err(KernelError::Output),
+            "aggregate-result-size-plus-one"
+        );
+    }
+
+    fn supported_values_fixture() -> Value {
+        let path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("../../products/evidence/fixtures/conformance/supported-values.yaml");
+        serde_norway::from_slice(&fs::read(path).expect("supported-value fixture reads"))
+            .expect("supported-value fixture parses")
+    }
+
+    fn supported_values_bundle_path() -> PathBuf {
+        PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("../../products/evidence/fixtures/conformance/supported-values")
+    }
+
+    fn immutable_supported_values_bundle() -> TempDir {
+        let temporary = tempfile::tempdir().expect("temporary directory");
+        copy_tree(&supported_values_bundle_path(), temporary.path());
+        make_read_only(temporary.path());
+        temporary
+    }
+
+    fn gate_fixture_value(
+        kernel: &OfflineKernel,
+        requirement: &RequirementConfig,
+        form: &str,
+        derived: DerivedConceptValue,
+    ) -> Result<ValidatedValues, KernelError> {
+        let mut values = Vec::with_capacity(2);
+        if form != "boolean" {
+            values.push(DerivedConceptValue {
+                concept_id: "urn:example:fixture:concept:boolean".to_owned(),
+                value: DerivedValue::Json(json!(true)),
+            });
+        }
+        values.push(derived);
+        kernel.validate_values(&requirement.id, values, projection())
+    }
+
+    fn assert_fixture_declaration(form_fixture: &Value, concept: &ConceptConfig) {
+        let form = form_fixture["form"].as_str().expect("form");
+        let declaration = form_fixture["declaration"]
+            .as_object()
+            .expect("form declaration");
+        assert_eq!(declaration["form"], form);
+        assert_eq!(
+            serde_json::to_value(concept.form).expect("form serializes"),
+            Value::String(form.to_owned())
+        );
+        assert_eq!(
+            concept.required,
+            declaration
+                .get("required")
+                .and_then(Value::as_bool)
+                .unwrap_or(false)
+        );
+
+        let mut expected = JsonMap::new();
+        for (name, value) in declaration {
+            let translated = match name.as_str() {
+                "form" | "required" | "fields" => continue,
+                "codelist" => "codelist",
+                "codelist_version" => "codelistVersion",
+                "category_scheme" => "categoryScheme",
+                "scheme_version" => "schemeVersion",
+                "maximum_bytes" => "maximumBytes",
+                "maximum_scale" => "maximumScale",
+                "bucket_scheme" => "bucketScheme",
+                "minimum_items" => "minimumItems",
+                "maximum_items" => "maximumItems",
+                "maximum_serialized_bytes" => "maximumSerializedBytes",
+                other => other,
+            };
+            let value = if name == "codelist" && value.as_str() == Some("synthetic-codes") {
+                Value::String("codelists/synthetic-codes.yaml".to_owned())
+            } else {
+                value.clone()
+            };
+            expected.insert(translated.to_owned(), value);
+        }
+        if form == "controlled-category" {
+            expected.insert(
+                "codelist".to_owned(),
+                Value::String("codelists/categories.yaml".to_owned()),
+            );
+        }
+        assert_eq!(
+            serde_json::to_value(&concept.constraints).expect("constraints serialize"),
+            Value::Object(expected),
+            "{form} fixture declaration must be the executable bundle declaration"
+        );
+    }
+
+    fn accepted_derived_value(
+        kernel: &OfflineKernel,
+        requirement: &RequirementConfig,
+        form_fixture: &Value,
+        category: &str,
+        index: usize,
+        fixture_case: &Value,
+    ) -> Result<DerivedConceptValue, RhaiRuntimeError> {
+        let form = form_fixture["form"].as_str().expect("form");
+        let concept_id = format!("urn:example:fixture:concept:{form}");
+        if form == "audience-scoped-entity-reference" {
+            let expression = if category == "positive" {
+                form_fixture["derivation_positive"][index]["rhai"]
+                    .as_str()
+                    .expect("entity derivation")
+                    .to_owned()
+            } else {
+                "entity_reference_seed(\"synthetic-boundary-seed\")".to_owned()
+            };
+            return derive_expression(kernel, requirement, &concept_id, &expression);
+        }
+        if form == "entity-reference-list" {
+            let derivation_index = if category == "positive" {
+                index
+            } else {
+                index + 1
+            };
+            let expressions = form_fixture["derivation_positive"][derivation_index]
+                .as_array()
+                .expect("entity list derivation")
+                .iter()
+                .map(|value| value.as_str().expect("Rhai expression"))
+                .collect::<Vec<_>>()
+                .join(", ");
+            return derive_expression(
+                kernel,
+                requirement,
+                &concept_id,
+                &format!("[{expressions}]"),
+            );
+        }
+        fixture_derived_value(kernel, requirement, &concept_id, fixture_case)
+    }
+
+    fn fixture_derived_value(
+        kernel: &OfflineKernel,
+        requirement: &RequirementConfig,
+        concept_id: &str,
+        fixture_case: &Value,
+    ) -> Result<DerivedConceptValue, RhaiRuntimeError> {
+        if let Some(expression) = fixture_case.get("rhai") {
+            let expression = match expression {
+                Value::Array(expressions) => format!(
+                    "[{}]",
+                    expressions
+                        .iter()
+                        .map(rhai_fixture_expression)
+                        .collect::<Vec<_>>()
+                        .join(", ")
+                ),
+                value => rhai_fixture_expression(value),
+            };
+            derive_expression(kernel, requirement, concept_id, &expression)
+        } else {
+            Ok(DerivedConceptValue {
+                concept_id: concept_id.to_owned(),
+                value: DerivedValue::Json(fixture_case.clone()),
+            })
+        }
+    }
+
+    fn rhai_fixture_expression(value: &Value) -> String {
+        match value {
+            Value::String(value)
+                if value.starts_with("decimal(")
+                    || value.starts_with("parse_decimal(")
+                    || value.starts_with("entity_reference_seed(") =>
+            {
+                value.clone()
+            }
+            Value::String(value) => serde_json::to_string(value).expect("string expression"),
+            Value::Number(value) => value.to_string(),
+            _ => panic!("unsupported fixture Rhai expression form"),
+        }
+    }
+
+    fn derive_expression(
+        kernel: &OfflineKernel,
+        requirement: &RequirementConfig,
+        concept_id: &str,
+        expression: &str,
+    ) -> Result<DerivedConceptValue, RhaiRuntimeError> {
+        let source = format!(
+            "fn derive(facts, selectors, evaluation_context) {{ [#{{ concept_id: \"{concept_id}\", value: {expression} }}] }}"
+        );
+        let script = kernel.runtime.compile_derivation(&source)?;
+        let values = kernel.runtime.derive(
+            &script,
+            &BTreeMap::new(),
+            &Value::Object(JsonMap::new()),
+            kernel
+                .evaluation_context(requirement, "2026-08-02T00:00:00Z".parse().expect("time"))
+                .expect("evaluation context"),
+        )?;
+        values
+            .into_iter()
+            .next()
+            .ok_or(RhaiRuntimeError::DerivationResult)
+    }
+
+    fn assert_fixture_public_shape(form: &str, fixture_case: &Value, actual: &PublicValue) {
+        let actual = serde_json::to_value(actual).expect("public value serializes");
+        if let Some(wire) = fixture_case.get("wire_json").and_then(Value::as_str) {
+            let expected: Value = serde_json::from_str(wire).expect("wire JSON parses");
+            assert_eq!(actual, expected);
+            return;
+        }
+        match form {
+            "audience-scoped-entity-reference" => {
+                let _: PublicValue = serde_json::from_value(fixture_case.clone())
+                    .expect("public entity exemplar parses");
+                assert_eq!(actual["form"], "audience-scoped-entity-reference");
+                let reference = actual["reference"].as_str().expect("projected reference");
+                assert!(reference.starts_with("urn:evidence:entity:v1_"));
+            }
+            "entity-reference-list" => {
+                let _: PublicValue = serde_json::from_value(fixture_case.clone())
+                    .expect("public entity-list exemplar parses");
+                assert_eq!(
+                    actual.as_array().map(Vec::len),
+                    fixture_case.as_array().map(Vec::len)
+                );
+                assert!(actual
+                    .as_array()
+                    .expect("public list")
+                    .iter()
+                    .all(|item| item["form"] == "audience-scoped-entity-reference"));
+            }
+            _ => assert_eq!(actual, *fixture_case),
+        }
+    }
+
+    async fn supported_values_signer() -> EvidenceSigner {
+        let private = PrivateJwk::parse(SUPPORTED_VALUE_PRIVATE_JWK).expect("fixture key parses");
+        let provider: Arc<dyn SigningProvider> =
+            Arc::new(LocalJwkSigner::new(private).expect("fixture signer builds"));
+        EvidenceSigner::initialize(provider, "supported-values-fixture-key")
+            .await
+            .expect("fixture signer initializes")
+    }
+
+    async fn assert_signed_type_preserving_round_trip(
+        kernel: &OfflineKernel,
+        requirement: &RequirementConfig,
+        values: ValidatedValues,
+        signer: &EvidenceSigner,
+    ) {
+        let evidence = kernel
+            .construct_evidence(
+                &requirement.id,
+                values,
+                EvidenceConstruction {
+                    evidence_id: "urn:ulid:01K1SUPPORTEDVALUES0000000000",
+                    request_nonce: crate::model::OFFLINE_EVALUATION_REQUEST_NONCE,
+                    purpose: "conformance",
+                    audience: AUDIENCE,
+                    issued_at: "2026-08-02T00:00:01Z".parse().expect("time"),
+                    observed_at: "2026-08-02T00:00:00Z".parse().expect("time"),
+                    subjects: vec![SubjectBinding {
+                        role: "subject".to_owned(),
+                        binding: format!("urn:evidence:subject:v1_{}", "A".repeat(43)),
+                    }],
+                },
+            )
+            .expect("Evidence constructs");
+        let expected_values =
+            serde_json::to_value(&evidence.supported_values).expect("values serialize");
+        let jws = signer
+            .sign_json(&evidence)
+            .await
+            .expect("fixture Evidence signs");
+        let serialized = serde_json::to_vec(&jws).expect("JWS serializes");
+        let jwks = jwks_document(signer.public_jwk(), []).expect("fixture JWKS builds");
+        let verified = verify_flattened_jws(
+            &serialized,
+            &jwks,
+            &EvidenceVerificationPolicy::from_accepted_transaction(
+                &evidence,
+                &evidence.request_nonce,
+                StdDuration::from_secs(48 * 60 * 60),
+                "2026-08-02T12:00:00Z".parse().expect("time"),
+                StdDuration::from_secs(30),
+            ),
+        )
+        .expect("signed Evidence verifies");
+        assert_eq!(
+            serde_json::to_value(verified.supported_values).expect("verified values serialize"),
+            expected_values,
+            "JSON value types must survive construction, signing, verification, and parsing"
+        );
+    }
+
+    fn concept(body: &str) -> ConceptConfig {
+        serde_norway::from_str(&format!("id: urn:example:concept\n{body}\n"))
+            .expect("concept parses")
+    }
+
+    fn observed_for_case(fixture: &Value, test_case: &Value) -> DateTime<Utc> {
+        let local_date = test_case
+            .get("legal_local_date")
+            .or_else(|| {
+                fixture
+                    .get("common")
+                    .and_then(|common| common.get("legal_local_date"))
+            })
+            .and_then(Value::as_str)
+            .unwrap_or("2026-08-02");
+        format!("{local_date}T00:00:00Z")
+            .parse()
+            .expect("observed time")
+    }
+
+    fn immutable_fixture(name: &str) -> TempDir {
+        let source = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("../../products/evidence/fixtures/acceptance")
+            .join(name);
+        let temporary = tempfile::tempdir().expect("temporary directory");
+        copy_tree(&source, temporary.path());
+        make_read_only(temporary.path());
+        temporary
+    }
+
+    fn copy_tree(source: &Path, target: &Path) {
+        for entry in fs::read_dir(source).expect("reads fixture") {
+            let entry = entry.expect("directory entry");
+            let destination = target.join(entry.file_name());
+            if entry.file_type().expect("file type").is_dir() {
+                fs::create_dir(&destination).expect("creates directory");
+                copy_tree(&entry.path(), &destination);
+            } else {
+                fs::copy(entry.path(), destination).expect("copies fixture");
+            }
+        }
+    }
+
+    #[cfg(unix)]
+    fn make_read_only(path: &Path) {
+        use std::os::unix::fs::PermissionsExt as _;
+
+        for entry in fs::read_dir(path).expect("reads copied fixture") {
+            let entry = entry.expect("directory entry");
+            let child = entry.path();
+            if entry.file_type().expect("file type").is_dir() {
+                make_read_only(&child);
+                fs::set_permissions(&child, fs::Permissions::from_mode(0o555))
+                    .expect("locks directory");
+            } else {
+                fs::set_permissions(&child, fs::Permissions::from_mode(0o444)).expect("locks file");
+            }
+        }
+        fs::set_permissions(path, fs::Permissions::from_mode(0o555)).expect("locks root");
+    }
+
+    #[cfg(not(unix))]
+    fn make_read_only(path: &Path) {
+        for entry in fs::read_dir(path).expect("reads copied fixture") {
+            let entry = entry.expect("directory entry");
+            let child = entry.path();
+            if entry.file_type().expect("file type").is_dir() {
+                make_read_only(&child);
+            } else {
+                let mut permissions = fs::metadata(&child).expect("metadata").permissions();
+                permissions.set_readonly(true);
+                fs::set_permissions(child, permissions).expect("locks file");
+            }
+        }
+    }
+}
diff --git a/crates/registry-evidence/src/lib.rs b/crates/registry-evidence/src/lib.rs
new file mode 100644
index 000000000..3df152990
--- /dev/null
+++ b/crates/registry-evidence/src/lib.rs
@@ -0,0 +1,43 @@
+//! Evidence Version 1 minimum-disclosure assertion runtime.
+
+#[cfg(not(unix))]
+compile_error!("registry-evidence Version 1 requires a Unix target for owner and file-identity security guarantees");
+
+pub mod audit;
+pub mod auth;
+pub mod binding;
+pub mod bundle;
+pub mod config;
+pub mod contracts;
+pub mod kernel;
+pub mod local_verification;
+pub mod model;
+pub mod observability;
+pub mod problem;
+pub mod rate_limit;
+pub mod rhai_runtime;
+pub mod runtime;
+pub mod sdjwt_vc;
+pub mod secrets;
+pub mod selector;
+pub mod server;
+pub mod signing;
+pub mod source;
+pub mod values;
+pub mod verifier;
+
+#[cfg(test)]
+mod runtime_tests;
+
+pub const EVIDENCE_SCHEMA_V1: &str = "registry.assertion-evidence/v1";
+pub const EVIDENCE_DEFINITIONS_SCHEMA_V1: &str = "registry.evidence-definitions/v1";
+pub const EVIDENCE_UNSIGNED_ENVELOPE_SCHEMA_V1: &str = "registry.unsigned-evidence-envelope/v1";
+pub const EVIDENCE_JWS_TYP: &str = "evidence+jws";
+pub const EVIDENCE_JWS_CTY: &str = "application/evidence+json";
+pub const EVIDENCE_JWS_MEDIA_TYPE: &str = "application/jose+json";
+/// Compact SD-JWT VC serialization of the same assertion. The profile adds a
+/// response format only; it introduces no credential lifecycle.
+pub const EVIDENCE_SD_JWT_VC_MEDIA_TYPE: &str = "application/dc+sd-jwt";
+pub const EVIDENCE_SD_JWT_VC_TYP: &str = "dc+sd-jwt";
+pub const EVIDENCE_UNSIGNED_MEDIA_TYPE: &str =
+    "application/vnd.registrystack.evidence-unsigned+json";
diff --git a/crates/registry-evidence/src/local_verification.rs b/crates/registry-evidence/src/local_verification.rs
new file mode 100644
index 000000000..8da3cbe5e
--- /dev/null
+++ b/crates/registry-evidence/src/local_verification.rs
@@ -0,0 +1,230 @@
+//! Core-owned pre-response verification context for the local adopter path.
+//!
+//! Preparation authenticates and authorizes the exact retained request before
+//! any source access. Verification then uses only that closed context and the
+//! returned bytes. The second half cannot initialize a runtime, open audit
+//! storage, resolve a source, or fetch keys over the network.
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+
+use crate::{
+    auth::Authenticator,
+    bundle::DeploymentInputs,
+    config::{AssuranceProfile, ConceptForm, ResponseFormat},
+    model::{request_nonce_is_canonical, Evidence, EvidenceRequest, JwksDocument},
+    runtime::{validate_verification_material, ValidatedVerificationMaterial},
+    secrets::{SecretProvider, SecretResolver},
+    selector::{match_entitlement, resolve_selectors},
+    verifier::{
+        verify_flattened_jws, EvidenceVerificationPolicyDocument, ExpectedFormDocument,
+        ExpectedOutputDocument, ExpectedScalarFormDocument, ExpectedSubjectDocument,
+    },
+};
+
+pub const LOCAL_VERIFICATION_CONTEXT_SCHEMA_V1: &str =
+    "registry.evidence.local-response-verification-context/v1";
+
+/// One deliberately uninformative failure for the local verification seam.
+///
+/// Authentication, entitlement, selector, secret, signing, context, and
+/// response failures collapse here so caller-controlled values cannot reach a
+/// retained CLI diagnostic.
+#[derive(Debug, Error, Clone, Copy, PartialEq, Eq)]
+#[error("local response verification failed")]
+pub struct LocalVerificationError;
+
+/// Closed trusted state retained before sending the corresponding request.
+///
+/// `responseFormat` is explicit so a future encoding can reuse the common
+/// policy without ever inferring its format from attacker-controlled bytes.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct LocalVerificationContext {
+    schema: String,
+    response_format: LocalResponseFormat,
+    trusted_jwks: JwksDocument,
+    verification_policy: EvidenceVerificationPolicyDocument,
+}
+
+#[derive(Debug, Clone, Copy, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum LocalResponseFormat {
+    SignedJws,
+    SdJwtVc,
+}
+
+/// Authenticate and authorize one exact local request and close all response
+/// expectations before source access.
+pub async fn prepare_local_verification_context(
+    deployment: &DeploymentInputs,
+    request: &EvidenceRequest,
+    bearer: &str,
+) -> Result<LocalVerificationContext, LocalVerificationError> {
+    prepare_local_verification_context_for_format(
+        deployment,
+        request,
+        bearer,
+        LocalResponseFormat::SignedJws,
+    )
+    .await
+}
+
+/// Close the local verification expectations for one explicitly selected
+/// response format before any response or source access exists.
+pub async fn prepare_local_verification_context_for_format(
+    deployment: &DeploymentInputs,
+    request: &EvidenceRequest,
+    bearer: &str,
+    response_format: LocalResponseFormat,
+) -> Result<LocalVerificationContext, LocalVerificationError> {
+    let bundle = &deployment.bundle;
+    let configured_format = match response_format {
+        LocalResponseFormat::SignedJws => ResponseFormat::SignedJws,
+        LocalResponseFormat::SdJwtVc => ResponseFormat::SdJwtVc,
+    };
+    if bundle.config.assurance_profile != AssuranceProfile::Local
+        || !request_nonce_is_canonical(&request.request_nonce)
+        || request.holder_key.is_some()
+        || !bundle.config.response_formats.contains(&configured_format)
+    {
+        return Err(LocalVerificationError);
+    }
+
+    let requirement = bundle
+        .config
+        .requirements
+        .iter()
+        .find(|candidate| candidate.id == request.requirement)
+        .ok_or(LocalVerificationError)?;
+    // The local adopter path remains deliberately narrow: every value must be
+    // required and use one of the two forms taught by the shared start.
+    if requirement.concepts.is_empty()
+        || requirement
+            .concepts
+            .iter()
+            .any(|concept| !concept.required || local_expected_form(concept.form).is_none())
+    {
+        return Err(LocalVerificationError);
+    }
+
+    let authenticator = Authenticator::from_config(
+        &bundle.config.authentication,
+        bundle.config.assurance_profile,
+    );
+    let authenticated = authenticator
+        .authenticate(bearer)
+        .await
+        .map_err(|_| LocalVerificationError)?;
+    let matched =
+        match_entitlement(bundle, request, &authenticated).map_err(|_| LocalVerificationError)?;
+    if !matched.permits_response_format(configured_format) {
+        return Err(LocalVerificationError);
+    }
+    let resolved = resolve_selectors(bundle, request, &authenticated, &matched)
+        .map_err(|_| LocalVerificationError)?;
+
+    let secrets = SecretResolver::new(
+        [SecretProvider::File],
+        &deployment.runtime.config.secret_providers.file.root,
+    )
+    .map_err(|_| LocalVerificationError)?;
+    let ValidatedVerificationMaterial {
+        subject_binding_secret,
+        signer: _,
+        jwks,
+    } = validate_verification_material(bundle, &secrets)
+        .await
+        .map_err(|_| LocalVerificationError)?;
+    let expected_subjects = resolved
+        .subjects
+        .iter()
+        .map(|subject| {
+            subject
+                .binding(
+                    subject_binding_secret.expose_secret(),
+                    bundle.config.subject_binding.key_version,
+                    &bundle.config.service.trust_domain,
+                    &resolved.audience,
+                    &resolved.purpose,
+                )
+                .map(|binding| ExpectedSubjectDocument {
+                    role: subject.role.clone(),
+                    binding,
+                })
+                .map_err(|_| LocalVerificationError)
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+
+    Ok(LocalVerificationContext {
+        schema: LOCAL_VERIFICATION_CONTEXT_SCHEMA_V1.to_owned(),
+        response_format,
+        trusted_jwks: jwks,
+        verification_policy: EvidenceVerificationPolicyDocument {
+            expected_assurance_profile: AssuranceProfile::Local,
+            issued_by: bundle.config.issuer.id.clone(),
+            provided_by: bundle.config.service.provider_id.clone(),
+            requirement: requirement.id.clone(),
+            evidence_type: requirement.evidence_type.clone(),
+            purpose: resolved.purpose,
+            audience: resolved.audience,
+            configuration_revision: bundle.revision().to_owned(),
+            request_nonce: request.request_nonce.clone(),
+            expected_subjects,
+            expected_outputs: requirement
+                .concepts
+                .iter()
+                .map(|concept| ExpectedOutputDocument {
+                    concept: concept.id.clone(),
+                    form: ExpectedFormDocument::Scalar(
+                        local_expected_form(concept.form)
+                            .expect("the local concept forms were validated"),
+                    ),
+                })
+                .collect(),
+            maximum_assertion_lifetime_seconds: requirement.validity_seconds,
+            clock_skew_seconds: bundle.config.signing.verifier_clock_skew_seconds,
+        },
+    })
+}
+
+fn local_expected_form(form: ConceptForm) -> Option<ExpectedScalarFormDocument> {
+    match form {
+        ConceptForm::Boolean => Some(ExpectedScalarFormDocument::Boolean),
+        ConceptForm::ControlledCategory => Some(ExpectedScalarFormDocument::String),
+        ConceptForm::ReviewedStructuredValue => Some(ExpectedScalarFormDocument::Structured),
+        _ => None,
+    }
+}
+
+/// Strictly verify one flattened JWS against a context retained before the
+/// response existed. This operation is entirely offline.
+pub fn verify_local_response(
+    context: LocalVerificationContext,
+    response: &[u8],
+) -> Result<Evidence, LocalVerificationError> {
+    verify_local_response_at(context, response, Utc::now())
+}
+
+/// Deterministic clock entry point used by the expiry test. Production callers
+/// use [`verify_local_response`] and cannot choose the verification instant.
+pub(crate) fn verify_local_response_at(
+    context: LocalVerificationContext,
+    response: &[u8],
+    now: DateTime<Utc>,
+) -> Result<Evidence, LocalVerificationError> {
+    if context.schema != LOCAL_VERIFICATION_CONTEXT_SCHEMA_V1 {
+        return Err(LocalVerificationError);
+    }
+    let policy = context.verification_policy.into_policy(now);
+    match context.response_format {
+        LocalResponseFormat::SignedJws => {
+            verify_flattened_jws(response, &context.trusted_jwks, &policy)
+        }
+        LocalResponseFormat::SdJwtVc => {
+            crate::verifier::verify_sd_jwt_vc(response, &context.trusted_jwks, &policy)
+        }
+    }
+    .map_err(|_| LocalVerificationError)
+}
diff --git a/crates/registry-evidence/src/main.rs b/crates/registry-evidence/src/main.rs
new file mode 100644
index 000000000..c53a98c4b
--- /dev/null
+++ b/crates/registry-evidence/src/main.rs
@@ -0,0 +1,3484 @@
+//! Evidence Version 1 operator CLI and serving process.
+
+use std::{
+    collections::BTreeMap,
+    fmt, fs,
+    fs::File,
+    io::{Read as _, Write as _},
+    path::{Component, Path, PathBuf},
+    process::ExitCode,
+    str::FromStr,
+    sync::Arc,
+};
+
+use chrono::{DateTime, NaiveDate, SecondsFormat, TimeZone, Utc};
+use chrono_tz::Tz;
+use clap::{ArgGroup, Parser, Subcommand};
+use ed25519_dalek::SigningKey;
+use rand_core::OsRng;
+use registry_evidence::{
+    audit::{
+        verified_last_local_audit_operation, verify_audit_chain, AuditChainSummary,
+        EvidenceAuditError,
+    },
+    bundle::{ArtifactFault, Bundle, BundleError, DeploymentInputs, RuntimeDocument},
+    config::{AssuranceProfile, ConfigError, EvidenceConfig, OutboundTlsConfig, SelectorInput},
+    kernel::{
+        EvidenceConstruction, KernelError, KernelOutcome, OfflineKernel, ValidatedValues,
+        ValueProjection,
+    },
+    local_verification::{
+        prepare_local_verification_context_for_format, verify_local_response, LocalResponseFormat,
+        LocalVerificationContext,
+    },
+    model::{
+        EvidenceRequest, JwksDocument, LookupResult, PublicValue, ScalarOrEntityReference,
+        SelectorValue, SubjectBinding,
+    },
+    problem::ProblemCode,
+    rhai_runtime::{DerivedConceptValue, DerivedValue, RequestParts},
+    runtime::{
+        source_failure_problem, validate_secret_material, AuditInitializationFault,
+        EvidenceRuntime, RuntimeInitializationError,
+    },
+    secrets::{SecretProvider, SecretResolver},
+    selector::{
+        resolve_offline_fixture_authorization, resolve_offline_fixture_subjects,
+        OfflineFixtureError, ResolvedAuthorization, ResolvedSelectorValue,
+    },
+    server,
+    signing::{jwks_document, EvidenceSigner},
+    source::{
+        project_fixture_response, ResolvedSourceSelector, SourceError, SourceExecutor, SourceStatus,
+    },
+    verifier::{
+        verify_flattened_jws, verify_flattened_jws_report, verify_sd_jwt_vc_report,
+        EvidenceVerificationPolicy, EvidenceVerificationPolicyDocument, VerificationError,
+    },
+};
+use registry_platform_audit::{AuditHashSecret, OptionalHashHex};
+use registry_platform_crypto::{canonicalize_json, parse_json_strict, LocalJwkSigner, PrivateJwk};
+use serde_json::{Map as JsonMap, Value};
+use zeroize::Zeroizing;
+
+const DEFAULT_RUNTIME_PATH: &str = "/etc/registry-evidence/runtime.yaml";
+const OFFLINE_AUDIENCE: &str = "urn:registry-evidence:offline-evaluation";
+const OFFLINE_BINDING_KEY: [u8; 32] = [0x45; 32];
+const ANTI_RECONSTRUCTION_FIXTURE: &[u8] =
+    include_bytes!("../../../products/evidence/fixtures/conformance/anti-reconstruction.yaml");
+
+#[derive(Debug, Parser)]
+#[command(name = "evidence", version, about = "Registry Evidence Version 1")]
+struct Cli {
+    /// One closed operator runtime file that binds the governed bundle.
+    #[arg(
+        long,
+        global = true,
+        env = "REGISTRY_EVIDENCE_RUNTIME",
+        default_value = DEFAULT_RUNTIME_PATH
+    )]
+    runtime: PathBuf,
+
+    #[command(subcommand)]
+    command: Command,
+}
+
+#[derive(Debug, Subcommand)]
+enum Command {
+    /// Validate and compile the complete immutable bundle, and validate the
+    /// mounted secret material exactly as startup does.
+    Check,
+    /// Evaluate one bundle-owned fixture without source or credential access.
+    Evaluate {
+        /// Bundle-relative fixture path referenced by exactly one requirement.
+        #[arg(long)]
+        fixture: PathBuf,
+    },
+    /// Start the native Evidence HTTP service.
+    Serve,
+    /// Re-verify one stored signed response offline against a pinned key set.
+    ///
+    /// Exactly one stored response is named, and its format is named with it.
+    /// The command never infers a format from the file's contents, so a
+    /// credential can never be re-verified under the other format's rules.
+    #[command(group(ArgGroup::new("stored").required(true)))]
+    Verify {
+        /// Stored flattened JWS JSON response file.
+        #[arg(long, group = "stored")]
+        jws: Option<PathBuf>,
+        /// Stored compact SD-JWT VC response file.
+        #[arg(long = "sd-jwt-vc", group = "stored")]
+        sd_jwt_vc: Option<PathBuf>,
+        /// Pinned trusted JWKS document. This file is the complete trust set.
+        #[arg(long)]
+        jwks: PathBuf,
+        /// Relying-procedure verification policy document.
+        #[arg(long)]
+        policy: PathBuf,
+        /// Verification instant as strict RFC 3339 UTC; system time by default.
+        #[arg(long)]
+        at: Option<String>,
+    },
+    /// Run a full out-of-band verification pass over the audit chain.
+    ///
+    /// Startup verification is deliberately bounded to the active segment, so
+    /// restart time does not grow with retained history; tampering inside an
+    /// already sealed segment is not caught there. This is the counterpart
+    /// check that catches it, meant to run out of band.
+    VerifyAudit,
+    /// Internal local-adopter seam. Bearer bytes are accepted only on stdin.
+    #[command(hide = true)]
+    PrepareLocalVerificationContext {
+        /// Owner-only JSON file containing the exact request to retain.
+        #[arg(long)]
+        request: PathBuf,
+        /// Exact response format the caller will request.
+        #[arg(
+            long,
+            default_value = "signed-jws",
+            value_parser = ["signed-jws", "sd-jwt-vc"]
+        )]
+        response_format: String,
+    },
+    /// Internal offline response-verification seam.
+    #[command(hide = true)]
+    VerifyLocalResponse {
+        /// Owner-only closed context produced before the response existed.
+        #[arg(long)]
+        context: PathBuf,
+        /// Bounded flattened JWS JSON returned by Evidence.
+        #[arg(long)]
+        response: PathBuf,
+    },
+    /// Internal stopped-service audit inspection seam.
+    #[command(hide = true)]
+    LocalAuditLastOperation,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+struct CliError(&'static str);
+
+impl fmt::Display for CliError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.0)
+    }
+}
+
+impl std::error::Error for CliError {}
+
+/// A command failure: a fixed operator message, or one artifact diagnostic.
+///
+/// The diagnostic names a bundle-relative artifact, a schema path, and a text
+/// location so an operator can find the defect. It carries no document value,
+/// which is what keeps a failed `check` safe to paste into a ticket.
+///
+/// A service failure carries an owned message instead, because the operating
+/// system decides both the address and the reason and neither is known when
+/// this enum is written. Those two are the whole diagnosis of a failed start,
+/// so a fixed string here would cost an operator the port and the cause.
+#[derive(Debug, PartialEq, Eq)]
+enum CommandError {
+    Cli(CliError),
+    Deployment(&'static str, ArtifactFault),
+    /// The audit boundary refused, with the value-free cause it reported.
+    ///
+    /// It is the one startup boundary that separates its causes, because a
+    /// permission bit, a chain that no longer verifies, and a second writer
+    /// holding the sink lock have nothing in common but the moment they fail.
+    Audit(&'static str, AuditInitializationFault),
+    Service(String),
+}
+
+impl fmt::Display for CommandError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Cli(error) => fmt::Display::fmt(error, formatter),
+            Self::Deployment(message, fault) => write!(formatter, "{message}: {fault}"),
+            Self::Audit(message, fault) => write!(formatter, "{message}: {fault}"),
+            Self::Service(reason) => write!(formatter, "service failed: {reason}"),
+        }
+    }
+}
+
+impl std::error::Error for CommandError {}
+
+impl From<CliError> for CommandError {
+    fn from(error: CliError) -> Self {
+        Self::Cli(error)
+    }
+}
+
+#[derive(Debug, Default, PartialEq, Eq)]
+struct FixtureSummary {
+    evaluated_cases: usize,
+}
+
+#[tokio::main]
+async fn main() -> ExitCode {
+    match run(Cli::parse()).await {
+        Ok(code) => code,
+        Err(error) => {
+            eprintln!("evidence: {error}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+async fn run(cli: Cli) -> Result<ExitCode, CommandError> {
+    match cli.command {
+        Command::Check => {
+            let deployment = DeploymentInputs::load(&cli.runtime).map_err(deployment_load_error)?;
+            let runtime = deployment.runtime;
+            let bundle = Arc::new(deployment.bundle);
+            OfflineKernel::compile(Arc::clone(&bundle))
+                .map_err(|_| CliError("bundle compilation failed"))?;
+            let _source_plans = compile_source_plans(&bundle.config, &runtime)?;
+            // Deployment secret material is validated exactly as startup
+            // validates it, without opening the audit chain, so a deployment
+            // the server would refuse fails check instead of first start.
+            // Source credentials stay unresolved: readiness owns them.
+            let secrets = SecretResolver::new(
+                [SecretProvider::File],
+                &runtime.config.secret_providers.file.root,
+            )
+            .map_err(|_| runtime_initialization_error(RuntimeInitializationError::Secrets))?;
+            validate_secret_material(&bundle, &secrets)
+                .await
+                .map_err(runtime_initialization_error)?;
+            println!(
+                "Evidence deployment {} / {} passed check ({} requirements)",
+                bundle.revision(),
+                runtime.revision(),
+                bundle.config.requirements.len()
+            );
+            Ok(ExitCode::SUCCESS)
+        }
+        Command::Evaluate { fixture } => {
+            let deployment = DeploymentInputs::load(&cli.runtime).map_err(deployment_load_error)?;
+            let runtime = deployment.runtime;
+            let bundle = Arc::new(deployment.bundle);
+            let kernel = OfflineKernel::compile(Arc::clone(&bundle))
+                .map_err(|_| CliError("fixture bundle compilation failed"))?;
+            let source_plans = compile_source_plans(&bundle.config, &runtime)?;
+            let summary = evaluate_fixture(&bundle, &kernel, &source_plans, &fixture).await?;
+            println!(
+                "Evidence fixture passed ({} evaluated cases)",
+                summary.evaluated_cases
+            );
+            Ok(ExitCode::SUCCESS)
+        }
+        Command::Serve => {
+            install_operational_logging();
+            let runtime = Arc::new(
+                EvidenceRuntime::initialize(&cli.runtime)
+                    .await
+                    .map_err(runtime_initialization_error)?,
+            );
+            // The startup announcement belongs to the server, which makes it
+            // after both listeners are held. Nothing is reported here, because
+            // a start reported before the bind describes a service that may
+            // never have got its port.
+            server::serve(runtime, shutdown_signal())
+                .await
+                .map_err(|error| CommandError::Service(error.to_string()))?;
+            Ok(ExitCode::SUCCESS)
+        }
+        Command::Verify {
+            jws,
+            sd_jwt_vc,
+            jwks,
+            policy,
+            at,
+        } => {
+            let stored = jws
+                .map(StoredResponse::SignedJws)
+                .or_else(|| sd_jwt_vc.map(StoredResponse::SdJwtVc))
+                .ok_or(CommandError::Cli(CliError(
+                    "verify requires one stored response file",
+                )))?;
+            Ok(verify_stored_response(
+                &stored,
+                &jwks,
+                &policy,
+                at.as_deref(),
+            )?)
+        }
+        Command::VerifyAudit => run_verify_audit(&cli.runtime),
+        Command::PrepareLocalVerificationContext {
+            request,
+            response_format,
+        } => prepare_local_context_command(&cli.runtime, &request, &response_format).await,
+        Command::VerifyLocalResponse { context, response } => {
+            verify_local_response_command(&context, &response)
+        }
+        Command::LocalAuditLastOperation => local_audit_last_operation_command(&cli.runtime),
+    }
+}
+
+/// Report a startup failure with the artifact diagnostic it carries.
+///
+/// The failure class stays a fixed operator message. When the loader knew
+/// which artifact failed, the value-free diagnostic is appended so that
+/// `evidence check` names a file, a schema path, and a text location instead
+/// of only a class. Public HTTP problems are unaffected and stay generic.
+fn deployment_load_error(error: BundleError) -> CommandError {
+    let message = match &error {
+        BundleError::Unavailable => "deployment input is unavailable",
+        BundleError::NotImmutable(_) => "deployment input is not immutable",
+        BundleError::UnsupportedEntry => "deployment contains an unsupported entry",
+        BundleError::InvalidPath => "deployment contains an invalid path binding",
+        BundleError::UnknownFile(_) => "deployment artifact closure is invalid",
+        BundleError::TooLarge => "deployment exceeds a Version 1 size bound",
+        BundleError::Config(_) => "deployment configuration is invalid",
+        BundleError::InvalidArtifact(_) => "deployment artifact is invalid",
+        BundleError::InvalidScript(_) => "deployment script is invalid",
+    };
+    match error.artifact_fault() {
+        Some(fault) => CommandError::Deployment(message, fault.clone()),
+        None => CommandError::Cli(CliError(message)),
+    }
+}
+
+fn runtime_initialization_error(error: RuntimeInitializationError) -> CommandError {
+    match error {
+        RuntimeInitializationError::Bundle => {
+            CliError("runtime bundle initialization failed").into()
+        }
+        RuntimeInitializationError::Secrets => {
+            CliError("runtime secret initialization failed").into()
+        }
+        RuntimeInitializationError::Audit(fault) => {
+            CommandError::Audit("runtime audit initialization failed", fault)
+        }
+        RuntimeInitializationError::Signing => {
+            CliError("runtime signing initialization failed").into()
+        }
+        RuntimeInitializationError::Source => {
+            CliError("runtime source initialization failed").into()
+        }
+        RuntimeInitializationError::RateLimit => {
+            CliError("runtime rate-limit initialization failed").into()
+        }
+    }
+}
+
+fn compile_source_plans(
+    config: &EvidenceConfig,
+    runtime: &RuntimeDocument,
+) -> Result<BTreeMap<String, SourceExecutor>, CliError> {
+    compile_source_plans_with_runtime(
+        config,
+        &runtime.config.secret_providers.file.root,
+        &runtime.config.outbound_tls,
+        &runtime.ca_bundles,
+    )
+}
+
+fn compile_source_plans_with_runtime(
+    config: &EvidenceConfig,
+    secret_root: &str,
+    outbound_tls: &OutboundTlsConfig,
+    ca_bundles: &BTreeMap<String, Vec<u8>>,
+) -> Result<BTreeMap<String, SourceExecutor>, CliError> {
+    let secrets = Arc::new(
+        SecretResolver::new([SecretProvider::File], secret_root)
+            .map_err(|_| CliError("source plan compilation failed"))?,
+    );
+    let mut plans = BTreeMap::new();
+    for (source_id, source) in config.sources.iter() {
+        let allowed_selector_sets = config.source_selector_sets(source_id);
+        let plan = SourceExecutor::new_with_selector_sets_and_tls(
+            source,
+            &allowed_selector_sets,
+            outbound_tls,
+            ca_bundles,
+            Arc::clone(&secrets),
+        )
+        .map_err(|_| CliError("source plan compilation failed"))?;
+        plans.insert(source_id.to_owned(), plan);
+    }
+    Ok(plans)
+}
+
+/// Install the operational log subscriber for the serving process.
+///
+/// Records are line-delimited JSON on stdout so a collector can read them
+/// without a parsing convention of its own. `EVIDENCE_LOG` selects verbosity
+/// and defaults to `info`, which is the level the request boundary emits at.
+/// Offline commands print their own result and install nothing, so no command
+/// gains log output it did not have.
+fn install_operational_logging() {
+    let filter = tracing_subscriber::EnvFilter::try_from_env("EVIDENCE_LOG")
+        .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info"));
+    tracing_subscriber::fmt()
+        .json()
+        .with_env_filter(filter)
+        .with_current_span(false)
+        .with_span_list(false)
+        .init();
+}
+
+/// Resolve on the first operator stop signal.
+///
+/// A service manager and a container runtime both stop a process with
+/// SIGTERM, and an interactive operator uses Ctrl-C. Both resolve here, so the
+/// same drain runs either way: the server stops accepting, finishes its
+/// in-flight evaluations, and closes the audit chain before the process exits.
+async fn shutdown_signal() {
+    #[cfg(unix)]
+    {
+        use tokio::signal::unix::{signal, SignalKind};
+
+        match signal(SignalKind::terminate()) {
+            Ok(mut terminate) => {
+                tokio::select! {
+                    _ = tokio::signal::ctrl_c() => {}
+                    _ = terminate.recv() => {}
+                }
+            }
+            Err(error) => {
+                eprintln!(
+                    "evidence: SIGTERM handler unavailable ({error}); stopping on Ctrl-C only"
+                );
+                let _ = tokio::signal::ctrl_c().await;
+            }
+        }
+    }
+    #[cfg(not(unix))]
+    {
+        let _ = tokio::signal::ctrl_c().await;
+    }
+}
+
+/// Longest accepted verification input.
+///
+/// A stored response, a pinned key set, and a relying-procedure policy are all
+/// small documents, so a larger file is refused before it is read rather than
+/// pulled into memory because a path was mistyped.
+const MAX_VERIFY_INPUT_BYTES: u64 = 1024 * 1024;
+const MAX_LOCAL_REQUEST_BYTES: u64 = 64 * 1024;
+const MAX_LOCAL_CONTEXT_BYTES: u64 = 256 * 1024;
+const MAX_LOCAL_RESPONSE_BYTES: u64 = 256 * 1024;
+const MAX_LOCAL_BEARER_BYTES: usize = 64 * 1024;
+
+/// Exit status for a response that is authentic but no longer current.
+const NOT_CURRENT_EXIT_CODE: u8 = 3;
+
+/// The one class reported for an input document that cannot be read or parsed.
+const VERIFY_MALFORMED: CliError = CliError("stored response verification failed (malformed)");
+const LOCAL_CONTEXT_FAILED: CliError = CliError("local verification context preparation failed");
+const LOCAL_RESPONSE_FAILED: CliError = CliError("local response verification failed");
+const LOCAL_AUDIT_FAILED: CliError = CliError("local audit inspection failed");
+
+/// Prepare one closed context from trusted deployment state and a retained
+/// request. The bearer is read only from stdin and is never echoed.
+async fn prepare_local_context_command(
+    runtime_path: &Path,
+    request_path: &Path,
+    response_format: &str,
+) -> Result<ExitCode, CommandError> {
+    let deployment = DeploymentInputs::load(runtime_path).map_err(|_| LOCAL_CONTEXT_FAILED)?;
+    let request_bytes =
+        read_owner_only_input(request_path, MAX_LOCAL_REQUEST_BYTES, LOCAL_CONTEXT_FAILED)?;
+    let request_value = parse_json_strict(&request_bytes).map_err(|_| LOCAL_CONTEXT_FAILED)?;
+    let request: EvidenceRequest =
+        serde_json::from_value(request_value).map_err(|_| LOCAL_CONTEXT_FAILED)?;
+    let bearer = read_local_bearer(std::io::stdin()).map_err(|_| LOCAL_CONTEXT_FAILED)?;
+    let response_format = match response_format {
+        "signed-jws" => LocalResponseFormat::SignedJws,
+        "sd-jwt-vc" => LocalResponseFormat::SdJwtVc,
+        _ => return Err(LOCAL_CONTEXT_FAILED.into()),
+    };
+    let context = prepare_local_verification_context_for_format(
+        &deployment,
+        &request,
+        &bearer,
+        response_format,
+    )
+    .await
+    .map_err(|_| LOCAL_CONTEXT_FAILED)?;
+    write_canonical_json_line(&context, LOCAL_CONTEXT_FAILED)?;
+    Ok(ExitCode::SUCCESS)
+}
+
+/// Verify from closed local state only. In particular, `--runtime` is not
+/// loaded on this path and no network, source, secret, or audit boundary is
+/// reachable after the context has been created.
+fn verify_local_response_command(
+    context_path: &Path,
+    response_path: &Path,
+) -> Result<ExitCode, CommandError> {
+    let context_bytes =
+        read_owner_only_input(context_path, MAX_LOCAL_CONTEXT_BYTES, LOCAL_RESPONSE_FAILED)?;
+    let context_value = parse_json_strict(&context_bytes).map_err(|_| LOCAL_RESPONSE_FAILED)?;
+    let context: LocalVerificationContext =
+        serde_json::from_value(context_value).map_err(|_| LOCAL_RESPONSE_FAILED)?;
+    let response = read_untrusted_response_input(
+        response_path,
+        MAX_LOCAL_RESPONSE_BYTES,
+        LOCAL_RESPONSE_FAILED,
+    )?;
+    let evidence = verify_local_response(context, &response).map_err(|_| LOCAL_RESPONSE_FAILED)?;
+    write_canonical_json_line(&evidence, LOCAL_RESPONSE_FAILED)?;
+    Ok(ExitCode::SUCCESS)
+}
+
+/// Open one operator input without following a symlink, then enforce the same
+/// owner, mode, link-count, and bounded-read posture as secret files.
+fn read_owner_only_input(
+    path: &Path,
+    maximum_bytes: u64,
+    failure: CliError,
+) -> Result<Vec<u8>, CliError> {
+    read_bounded_regular_input(path, maximum_bytes, true, failure)
+}
+
+/// A signed response is untrusted input, not a trust anchor. Normal
+/// `curl --output` permissions are accepted, while file identity and size
+/// checks still prevent path tricks and blocking or unbounded reads.
+fn read_untrusted_response_input(
+    path: &Path,
+    maximum_bytes: u64,
+    failure: CliError,
+) -> Result<Vec<u8>, CliError> {
+    read_bounded_regular_input(path, maximum_bytes, false, failure)
+}
+
+fn read_bounded_regular_input(
+    path: &Path,
+    maximum_bytes: u64,
+    require_owner_only: bool,
+    failure: CliError,
+) -> Result<Vec<u8>, CliError> {
+    use rustix::fs::{Mode, OFlags};
+    use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _};
+
+    let descriptor = rustix::fs::open(
+        path,
+        OFlags::RDONLY | OFlags::CLOEXEC | OFlags::NOFOLLOW | OFlags::NONBLOCK,
+        Mode::empty(),
+    )
+    .map_err(|_| failure)?;
+    let file = File::from(descriptor);
+    let metadata = file.metadata().map_err(|_| failure)?;
+    if !metadata.is_file()
+        || (require_owner_only
+            && (metadata.uid() != rustix::process::geteuid().as_raw()
+                || metadata.permissions().mode() & 0o7777 != 0o600))
+        || metadata.nlink() != 1
+        || metadata.len() > maximum_bytes
+    {
+        return Err(failure);
+    }
+    let mut bytes = Vec::new();
+    file.take(maximum_bytes + 1)
+        .read_to_end(&mut bytes)
+        .map_err(|_| failure)?;
+    if bytes.is_empty() || bytes.len() as u64 > maximum_bytes {
+        return Err(failure);
+    }
+    Ok(bytes)
+}
+
+/// Read exactly one compact bearer from stdin with at most one shell line
+/// ending. Other whitespace, control bytes, empty values, and oversize input
+/// are rejected before authentication.
+fn read_local_bearer(reader: impl std::io::Read) -> Result<Zeroizing<String>, CliError> {
+    let mut bytes = Zeroizing::new(Vec::new());
+    reader
+        .take((MAX_LOCAL_BEARER_BYTES + 1) as u64)
+        .read_to_end(&mut bytes)
+        .map_err(|_| LOCAL_CONTEXT_FAILED)?;
+    if bytes.len() > MAX_LOCAL_BEARER_BYTES {
+        return Err(LOCAL_CONTEXT_FAILED);
+    }
+    let body = bytes
+        .strip_suffix(b"\r\n")
+        .or_else(|| bytes.strip_suffix(b"\n"))
+        .unwrap_or(bytes.as_slice());
+    let bearer = std::str::from_utf8(body).map_err(|_| LOCAL_CONTEXT_FAILED)?;
+    if bearer.is_empty()
+        || bearer
+            .bytes()
+            .any(|byte| byte.is_ascii_whitespace() || byte.is_ascii_control())
+    {
+        return Err(LOCAL_CONTEXT_FAILED);
+    }
+    Ok(Zeroizing::new(bearer.to_owned()))
+}
+
+fn write_canonical_json_line<T: serde::Serialize>(
+    value: &T,
+    failure: CliError,
+) -> Result<(), CliError> {
+    let value = serde_json::to_value(value).map_err(|_| failure)?;
+    let bytes = canonicalize_json(&value).map_err(|_| failure)?;
+    let mut stdout = std::io::stdout().lock();
+    stdout.write_all(&bytes).map_err(|_| failure)?;
+    stdout.write_all(b"\n").map_err(|_| failure)
+}
+
+/// Inspect the last local audit operation only after the writer has stopped.
+///
+/// Every failure is deliberately collapsed to one value-free class. The view
+/// is written only after the entire retained chain and its native events have
+/// verified, so stdout can never contain a partial or unverified operation.
+fn local_audit_last_operation_command(runtime_path: &Path) -> Result<ExitCode, CommandError> {
+    let deployment = DeploymentInputs::load(runtime_path).map_err(|_| LOCAL_AUDIT_FAILED)?;
+    if deployment.bundle.config.assurance_profile != AssuranceProfile::Local {
+        return Err(LOCAL_AUDIT_FAILED.into());
+    }
+    let secrets = SecretResolver::new(
+        [SecretProvider::File],
+        &deployment.runtime.config.secret_providers.file.root,
+    )
+    .map_err(|_| LOCAL_AUDIT_FAILED)?;
+    let audit_secret = secrets
+        .resolve(deployment.bundle.config.audit.hash_secret_ref.as_str())
+        .map_err(|_| LOCAL_AUDIT_FAILED)?;
+    let master_secret = AuditHashSecret::new(audit_secret.expose_secret().to_vec())
+        .map_err(|_| LOCAL_AUDIT_FAILED)?;
+    let view = verified_last_local_audit_operation(
+        Path::new(&deployment.runtime.config.audit_storage.path),
+        &master_secret,
+    )
+    .map_err(|_| LOCAL_AUDIT_FAILED)?;
+    write_canonical_json_line(&view, LOCAL_AUDIT_FAILED)?;
+    Ok(ExitCode::SUCCESS)
+}
+
+/// The one stored response an operator named, and the format its bytes are
+/// parsed under. The format is an operator statement, never a guess from the
+/// file's contents.
+enum StoredResponse {
+    SignedJws(PathBuf),
+    SdJwtVc(PathBuf),
+}
+
+impl StoredResponse {
+    fn path(&self) -> &Path {
+        match self {
+            Self::SignedJws(path) | Self::SdJwtVc(path) => path,
+        }
+    }
+}
+
+/// Re-verify one stored signed response offline.
+///
+/// The pinned key set file is the complete trust set: this command opens no
+/// socket, resolves no metadata, and fetches no key. Every expectation comes
+/// from the operator's policy document, which belongs to independently
+/// retained trusted state such as the original request and an accepted
+/// original transaction. The printed lines are the verification instant, the
+/// authenticity answer, and, for an authentic response, current usability.
+/// A failure reports only its closed class, so re-verification never becomes
+/// an oracle for which hidden comparison failed.
+fn verify_stored_response(
+    stored: &StoredResponse,
+    jwks_path: &Path,
+    policy_path: &Path,
+    at: Option<&str>,
+) -> Result<ExitCode, CliError> {
+    let instant = verification_instant(at)?;
+    println!(
+        "verified-at: {}",
+        instant.to_rfc3339_opts(SecondsFormat::Secs, true)
+    );
+
+    let response = read_verification_input(stored.path())?;
+    let trusted: JwksDocument = serde_json::from_value(
+        parse_json_strict(&read_verification_input(jwks_path)?).map_err(|_| VERIFY_MALFORMED)?,
+    )
+    .map_err(|_| VERIFY_MALFORMED)?;
+    let document: EvidenceVerificationPolicyDocument =
+        serde_norway::from_slice(&read_verification_input(policy_path)?)
+            .map_err(|_| VERIFY_MALFORMED)?;
+    let policy = document.into_policy(instant);
+
+    // One policy document, one set of expectations, and one report shape serve
+    // both response formats; only the serialization the operator named is
+    // parsed.
+    let report = match stored {
+        StoredResponse::SignedJws(_) => verify_flattened_jws_report(&response, &trusted, &policy),
+        StoredResponse::SdJwtVc(_) => verify_sd_jwt_vc_report(&response, &trusted, &policy),
+    };
+
+    match report {
+        Ok(report) => {
+            println!("authentic: yes");
+            if !report.currently_valid {
+                println!("currently-valid: no");
+                return Ok(ExitCode::from(NOT_CURRENT_EXIT_CODE));
+            }
+            println!("currently-valid: yes");
+            // Inspection output for the operator who already holds the stored
+            // response. It appears only once the trusted key signed the exact
+            // payload, every expectation held, and the assertion is current.
+            let inspected = serde_json::to_string_pretty(&report.evidence)
+                .map_err(|_| verification_error_class(VerificationError::Payload))?;
+            println!("{inspected}");
+            Ok(ExitCode::SUCCESS)
+        }
+        Err(error) => {
+            println!("authentic: no");
+            Err(verification_error_class(error))
+        }
+    }
+}
+
+/// Resolve the verification instant from `--at`, or from system time.
+///
+/// `--at` is strict RFC 3339 at zero offset, so an operator cannot silently
+/// re-verify against a local wall clock and read the result as UTC.
+fn verification_instant(at: Option<&str>) -> Result<DateTime<Utc>, CliError> {
+    const NOT_UTC: CliError = CliError("verification instant is not strict RFC 3339 UTC");
+
+    let Some(text) = at else {
+        return Ok(Utc::now());
+    };
+    let parsed = DateTime::parse_from_rfc3339(text).map_err(|_| NOT_UTC)?;
+    if parsed.offset().local_minus_utc() != 0 {
+        return Err(NOT_UTC);
+    }
+    Ok(parsed.with_timezone(&Utc))
+}
+
+/// Read one bounded verification input file.
+fn read_verification_input(path: &Path) -> Result<Vec<u8>, CliError> {
+    let metadata = fs::metadata(path).map_err(|_| VERIFY_MALFORMED)?;
+    if !metadata.is_file() || metadata.len() > MAX_VERIFY_INPUT_BYTES {
+        return Err(VERIFY_MALFORMED);
+    }
+    fs::read(path).map_err(|_| VERIFY_MALFORMED)
+}
+
+/// Report one verification failure as its closed class and nothing more.
+fn verification_error_class(error: VerificationError) -> CliError {
+    match error {
+        VerificationError::MalformedJws => VERIFY_MALFORMED,
+        VerificationError::ProtectedHeader => {
+            CliError("stored response verification failed (protected-header)")
+        }
+        VerificationError::Key => CliError("stored response verification failed (key)"),
+        VerificationError::Signature => CliError("stored response verification failed (signature)"),
+        VerificationError::Payload => CliError("stored response verification failed (payload)"),
+        VerificationError::Policy => CliError("stored response verification failed (policy)"),
+        VerificationError::Time => CliError("stored response verification failed (time)"),
+        VerificationError::Disclosure => {
+            CliError("stored response verification failed (disclosure)")
+        }
+    }
+}
+
+/// Run a full out-of-band audit verification pass for the deployment named by
+/// one closed operator runtime file.
+///
+/// The audit storage path and hash secret are read from the same runtime
+/// document and secret provider the serving process uses; this command takes
+/// no path or secret flags of its own, so it can never be pointed at an audit
+/// chain the deployment does not own.
+fn run_verify_audit(runtime_path: &Path) -> Result<ExitCode, CommandError> {
+    let deployment = DeploymentInputs::load(runtime_path).map_err(deployment_load_error)?;
+    let secrets = SecretResolver::new(
+        [SecretProvider::File],
+        &deployment.runtime.config.secret_providers.file.root,
+    )
+    .map_err(|_| CliError("audit verification secret resolver failed"))?;
+    let audit_secret = secrets
+        .resolve(deployment.bundle.config.audit.hash_secret_ref.as_str())
+        .map_err(|_| CliError("audit verification secret resolution failed"))?;
+    let master_secret = AuditHashSecret::new(audit_secret.expose_secret().to_vec())
+        .map_err(|_| CliError("audit verification secret is invalid"))?;
+    verify_audit_with_secret(
+        Path::new(&deployment.runtime.config.audit_storage.path),
+        &master_secret,
+    )
+}
+
+/// Verify one audit chain and print the operator report.
+///
+/// Split from [`run_verify_audit`] so the report and the failure
+/// classification can be exercised directly against a constructed chain,
+/// without a full deployment bundle and runtime document on disk.
+fn verify_audit_with_secret(
+    audit_path: &Path,
+    master_secret: &AuditHashSecret,
+) -> Result<ExitCode, CommandError> {
+    match verify_audit_chain(audit_path, master_secret) {
+        Ok(summary) => {
+            println!("{}", audit_chain_report(&summary));
+            Ok(ExitCode::SUCCESS)
+        }
+        Err(error) => {
+            let (detail, class) = audit_verification_failure(error);
+            println!("{detail}");
+            Err(CommandError::Cli(class))
+        }
+    }
+}
+
+/// Render an out-of-band audit verification result for an operator.
+///
+/// The head hash and the segment and record counts carry no request content,
+/// so they are safe to print; nothing secret-derived beyond the chain head
+/// appears here. When the active segment could not be verified, the report
+/// says so plainly rather than reading as a pass of the whole chain.
+fn audit_chain_report(summary: &AuditChainSummary) -> String {
+    let sealed_sequence = match (summary.first_sequence, summary.last_sequence) {
+        (Some(first), Some(last)) => format!("{first}-{last}"),
+        _ => "none".to_owned(),
+    };
+    let active_segment = if summary.active_verified {
+        "verified".to_owned()
+    } else {
+        "not verified: a running writer holds it, so only sealed history was proven".to_owned()
+    };
+    format!(
+        "segments: {}\nrecords: {}\nsealed-sequence: {sealed_sequence}\nhead: {}\nactive-segment: {active_segment}",
+        summary.segments,
+        summary.records,
+        OptionalHashHex(summary.head),
+    )
+}
+
+/// Classify an audit verification failure for the operator report and exit.
+///
+/// A gap in the sealed sequence is archived-or-missing history, not a hash
+/// break, so it is reported in those terms and kept distinguishable from
+/// every other verification failure, which is corruption.
+fn audit_verification_failure(error: EvidenceAuditError) -> (String, CliError) {
+    match error {
+        EvidenceAuditError::SegmentMissing { sequence } => (
+            format!(
+                "sealed segment {sequence} is archived or missing from the chain; \
+                 this is not corruption"
+            ),
+            CliError("audit chain is missing sealed history"),
+        ),
+        _ => (
+            "audit chain verification failed".to_owned(),
+            CliError("audit chain verification failed"),
+        ),
+    }
+}
+
+async fn evaluate_fixture(
+    bundle: &Arc<Bundle>,
+    kernel: &OfflineKernel,
+    source_plans: &BTreeMap<String, SourceExecutor>,
+    fixture_path: &Path,
+) -> Result<FixtureSummary, CliError> {
+    let signer = offline_fixture_signer().await?;
+    let fixture_name = safe_fixture_name(fixture_path)?;
+    let referenced = bundle
+        .config
+        .requirements
+        .iter()
+        .filter(|requirement| {
+            requirement
+                .fixtures
+                .as_ref()
+                .is_some_and(|fixtures| fixtures.as_str() == fixture_name)
+        })
+        .collect::<Vec<_>>();
+    if referenced.len() != 1 {
+        return Err(CliError(
+            "fixture must be a captured artifact referenced by exactly one requirement",
+        ));
+    }
+    let requirement = referenced[0];
+    let fixture = bundle
+        .fixtures
+        .get(fixture_name)
+        .ok_or(CliError("fixture artifact is not captured by the bundle"))?;
+    let fixture = serde_json::to_value(fixture)
+        .map_err(|_| CliError("fixture contract is not representable"))?;
+    let object = fixture
+        .as_object()
+        .ok_or(CliError("fixture contract must be an object"))?;
+    if object.get("synthetic_only") != Some(&Value::Bool(true)) {
+        return Err(CliError("fixture is not an approved synthetic definition"));
+    }
+    if object.get("coequal_acceptance_definition") != Some(&Value::Bool(true)) {
+        if object
+            .get("fixture")
+            .and_then(Value::as_str)
+            .is_some_and(|id| id.starts_with("registry.evidence.reference.") && id.ends_with("/v1"))
+        {
+            return evaluate_reference_fixture(
+                bundle,
+                kernel,
+                source_plans,
+                &signer,
+                requirement,
+                object,
+            )
+            .await;
+        }
+        return Err(CliError(
+            "fixture is not an approved synthetic acceptance definition",
+        ));
+    }
+    let common = object.get("common").and_then(Value::as_object);
+    let cases = object
+        .get("cases")
+        .and_then(Value::as_array)
+        .ok_or(CliError("fixture cases are unavailable"))?;
+    if cases.is_empty() || cases.len() > 256 {
+        return Err(CliError("fixture case count is invalid"));
+    }
+
+    let mut summary = FixtureSummary::default();
+    let mut successful_values = Vec::new();
+    for case in cases {
+        let case = case
+            .as_object()
+            .ok_or(CliError("fixture case is not an object"))?;
+        let id = case
+            .get("id")
+            .and_then(Value::as_str)
+            .filter(|value| !value.is_empty() && value.len() <= 128)
+            .ok_or(CliError("fixture case identifier is invalid"))?;
+
+        if case.get("subjects").is_some() {
+            require_expected(case, "pre-source-selector-rejection")?;
+            match resolve_offline_fixture_subjects(
+                bundle,
+                requirement,
+                common,
+                case,
+                OFFLINE_AUDIENCE,
+            ) {
+                Ok(_) => return Err(CliError("fixture selector rejection did not occur")),
+                Err(OfflineFixtureError::Purpose) => {
+                    return Err(CliError(FIXTURE_PURPOSE_FAILURE));
+                }
+                Err(OfflineFixtureError::Authorization(_)) => {}
+            }
+            summary.evaluated_cases += 1;
+            continue;
+        }
+        if let Some(expected_roles) = case.get("expected_subject_roles") {
+            let expected_roles = expected_roles
+                .as_array()
+                .ok_or(CliError("fixture subject-role expectation is invalid"))?
+                .iter()
+                .map(|role| {
+                    role.as_str()
+                        .map(ToOwned::to_owned)
+                        .ok_or(CliError("fixture subject-role expectation is invalid"))
+                })
+                .collect::<Result<Vec<_>, _>>()?;
+            let actual_roles = resolve_offline_fixture_subjects(
+                bundle,
+                requirement,
+                common,
+                case,
+                OFFLINE_AUDIENCE,
+            )
+            .map_err(|error| fixture_failure(error, "fixture subjects did not resolve"))?;
+            if actual_roles != expected_roles {
+                return Err(CliError("fixture subject roles did not match"));
+            }
+        }
+        let observed_at =
+            fixture_observed_at(case, common, requirement.observation_timezone.as_deref())?;
+
+        if let Some(source) = case.get("source") {
+            let resolved = resolve_offline_fixture_authorization(
+                bundle,
+                requirement,
+                common,
+                case,
+                OFFLINE_AUDIENCE,
+            )
+            .map_err(|error| fixture_failure(error, "fixture subjects did not resolve"))?;
+            let derivation_selectors =
+                fixture_selector_value(&resolved, &requirement.derivation.selector_inputs)?;
+            if let Some(expected) = case
+                .get("derivationSelectorInputs")
+                .or_else(|| common.and_then(|common| common.get("derivationSelectorInputs")))
+            {
+                if expected != &derivation_selectors {
+                    return Err(CliError(
+                        "fixture derivation selector projection did not match",
+                    ));
+                }
+            }
+            let source_config = bundle
+                .config
+                .sources
+                .get(&requirement.source)
+                .ok_or(CliError("fixture source is unavailable"))?;
+            let outcome = match project_fixture_response(source_config, source) {
+                Ok(projected) => kernel.evaluate_with_selectors(
+                    &requirement.id,
+                    &projected,
+                    &derivation_selectors,
+                    observed_at,
+                    ValueProjection {
+                        audience: OFFLINE_AUDIENCE,
+                        binding_key: &OFFLINE_BINDING_KEY,
+                        binding_key_version: 1,
+                    },
+                ),
+                Err(_) => Err(KernelError::SourceProtocol),
+            };
+            if let Some(values) = validate_case_outcome(id, case, outcome)? {
+                successful_values.push(
+                    sign_and_verify_fixture_evidence(
+                        bundle,
+                        kernel,
+                        &signer,
+                        requirement,
+                        &resolved,
+                        values,
+                        observed_at,
+                    )
+                    .await?,
+                );
+            }
+            summary.evaluated_cases += 1;
+            continue;
+        }
+
+        if let Some(injected) = case.get("injected_derivation") {
+            validate_injected_rejection(kernel, &requirement.id, injected)?;
+            require_expected(case, "output-gate-rejection")?;
+            summary.evaluated_cases += 1;
+            continue;
+        }
+
+        if let Some(source_failure) = case.get("source_failure") {
+            validate_source_failure(case, source_failure)?;
+            summary.evaluated_cases += 1;
+            continue;
+        }
+
+        if let Some(companion) = case.get("companion_bundle") {
+            validate_companion_rejection(bundle, requirement, case, companion)?;
+            summary.evaluated_cases += 1;
+            continue;
+        }
+
+        return Err(CliError(
+            "fixture case has no closed Version 1 evaluation form",
+        ));
+    }
+    validate_privacy_expectation(object, requirement, &successful_values)?;
+    Ok(summary)
+}
+
+async fn evaluate_reference_fixture(
+    bundle: &Arc<Bundle>,
+    kernel: &OfflineKernel,
+    source_plans: &BTreeMap<String, SourceExecutor>,
+    signer: &EvidenceSigner,
+    requirement: &registry_evidence::config::RequirementConfig,
+    fixture: &JsonMap<String, Value>,
+) -> Result<FixtureSummary, CliError> {
+    require_exact_keys(
+        fixture,
+        &[
+            "fixture",
+            "synthetic_only",
+            "common",
+            "cases",
+            "privacyExpectation",
+        ],
+    )?;
+    let common = fixture
+        .get("common")
+        .and_then(Value::as_object)
+        .ok_or(CliError("reference fixture common block is invalid"))?;
+    require_allowed_keys(
+        common,
+        &[
+            "observed_at",
+            "purpose",
+            "selectors",
+            "verified_token_claims",
+            "derivationSelectorInputs",
+            "expectedRequestParts",
+            "expectedTransport",
+        ],
+    )?;
+    for required in [
+        "observed_at",
+        "selectors",
+        "expectedRequestParts",
+        "expectedTransport",
+    ] {
+        if !common.contains_key(required) {
+            return Err(CliError("reference fixture common block is incomplete"));
+        }
+    }
+    let cases = fixture
+        .get("cases")
+        .and_then(Value::as_array)
+        .filter(|cases| !cases.is_empty() && cases.len() <= 256)
+        .ok_or(CliError("reference fixture case count is invalid"))?;
+    let mut identifiers = std::collections::BTreeSet::new();
+    let mut successful_values = Vec::new();
+    let mut summary = FixtureSummary::default();
+
+    for case in cases {
+        let case = case
+            .as_object()
+            .ok_or(CliError("reference fixture case is not an object"))?;
+        require_allowed_keys(
+            case,
+            &[
+                "id",
+                "purpose",
+                "response",
+                "sourceFailure",
+                "bundleMutation",
+                "requestMutation",
+                "derivationMutation",
+                "derivationParameterMutation",
+                "selectorOverrides",
+                "observed_at",
+                "expected",
+            ],
+        )?;
+        let id = case
+            .get("id")
+            .and_then(Value::as_str)
+            .filter(|id| !id.is_empty() && id.len() <= 128 && identifiers.insert(*id))
+            .ok_or(CliError("reference fixture case identifier is invalid"))?;
+        let expected = case
+            .get("expected")
+            .and_then(Value::as_object)
+            .ok_or(CliError("reference fixture expectation is invalid"))?;
+        require_allowed_keys(
+            expected,
+            &[
+                "lookup",
+                "facts",
+                "value",
+                "values",
+                "entityReferenceCount",
+                "rawReferencesDisclosed",
+                "signed",
+                "publicProblem",
+                "error",
+                "derivationRuns",
+                "bundle",
+                "outputGate",
+                "rejectedBefore",
+                "sourceRequestCount",
+                "expectedTransport",
+            ],
+        )?;
+        // A case states either the one concept value or the complete concept map,
+        // never both, so neither expectation can weaken the other.
+        if expected.contains_key("value") && expected.contains_key("values") {
+            return Err(CliError("reference fixture states two value expectations"));
+        }
+        let forms = [
+            "response",
+            "sourceFailure",
+            "bundleMutation",
+            "requestMutation",
+            "derivationMutation",
+            "derivationParameterMutation",
+            "selectorOverrides",
+        ];
+        let selected_forms = forms
+            .iter()
+            .filter(|name| case.contains_key(**name))
+            .copied()
+            .collect::<Vec<_>>();
+        if selected_forms.len() != 1 {
+            return Err(CliError("reference fixture case form is not closed"));
+        }
+        validate_reference_expectation_keys(selected_forms[0], expected)?;
+
+        if let Some(mutation) = case.get("bundleMutation").and_then(Value::as_str) {
+            if mutation != "duplicate-disclosure-family"
+                || expected.get("bundle").and_then(Value::as_str) != Some("rejected")
+            {
+                return Err(CliError("reference bundle mutation is invalid"));
+            }
+            validate_reference_bundle_mutation(bundle, requirement)?;
+            summary.evaluated_cases += 1;
+            continue;
+        }
+        if let Some(mutation) = case.get("requestMutation").and_then(Value::as_str) {
+            validate_reference_request_mutation(
+                bundle,
+                requirement,
+                common,
+                case,
+                expected,
+                mutation,
+            )?;
+            summary.evaluated_cases += 1;
+            continue;
+        }
+
+        let resolved = resolve_offline_fixture_authorization(
+            bundle,
+            requirement,
+            Some(common),
+            case,
+            OFFLINE_AUDIENCE,
+        )
+        .map_err(|error| fixture_failure(error, "reference fixture subjects did not resolve"))?;
+        let source = bundle
+            .config
+            .sources
+            .get(&requirement.source)
+            .ok_or(CliError("reference fixture source is unavailable"))?;
+        let source_plan = source_plans
+            .get(&requirement.source)
+            .ok_or(CliError("reference fixture source plan is unavailable"))?;
+        let preparation_selectors =
+            fixture_selector_value(&resolved, &source.request.selector_inputs)?;
+        let prepared = match kernel.prepare(&requirement.id, &preparation_selectors) {
+            Ok(prepared) => prepared,
+            Err(error) if case.contains_key("selectorOverrides") => {
+                validate_reference_error(expected, error, false)?;
+                if expected.get("rejectedBefore").and_then(Value::as_str) != Some("credential") {
+                    return Err(CliError(
+                        "reference preparation rejection boundary did not match",
+                    ));
+                }
+                require_reference_request_count(expected, 0)?;
+                summary.evaluated_cases += 1;
+                continue;
+            }
+            Err(_) => return Err(CliError("reference fixture request preparation failed")),
+        };
+        if !case.contains_key("selectorOverrides") {
+            validate_reference_request_parts(common, &prepared)?;
+        }
+        let source_selectors =
+            reference_source_selectors(&resolved, &source.request.selector_inputs)?;
+        validate_reference_transport(
+            source,
+            source_plan,
+            &source_selectors,
+            &prepared,
+            common
+                .get("expectedTransport")
+                .and_then(Value::as_object)
+                .ok_or(CliError("reference transport expectation is invalid"))?,
+        )?;
+        if let Some(transport) = expected.get("expectedTransport").and_then(Value::as_object) {
+            validate_reference_transport(
+                source,
+                source_plan,
+                &source_selectors,
+                &prepared,
+                transport,
+            )?;
+        }
+        if case.contains_key("selectorOverrides") {
+            if expected.contains_key("error")
+                || expected.contains_key("publicProblem")
+                || expected.contains_key("rejectedBefore")
+            {
+                return Err(CliError(
+                    "reference successful preparation contradicts its expectation",
+                ));
+            }
+            require_reference_request_count(expected, 1)?;
+            summary.evaluated_cases += 1;
+            continue;
+        }
+        let derivation_selectors =
+            fixture_selector_value(&resolved, &requirement.derivation.selector_inputs)?;
+        if let Some(expected_selectors) = common.get("derivationSelectorInputs") {
+            if expected_selectors != &derivation_selectors {
+                return Err(CliError("reference derivation selectors did not match"));
+            }
+        } else if derivation_selectors != Value::Object(JsonMap::new()) {
+            return Err(CliError(
+                "reference derivation selectors were not minimized",
+            ));
+        }
+        if let Some(failure) = case.get("sourceFailure").and_then(Value::as_str) {
+            validate_reference_source_failure(failure, expected)?;
+            summary.evaluated_cases += 1;
+            continue;
+        }
+
+        let observed_at = fixture_observed_at(
+            case,
+            Some(common),
+            requirement.observation_timezone.as_deref(),
+        )?;
+        if let Some(mutation) = case.get("derivationMutation").and_then(Value::as_str) {
+            validate_reference_derivation_mutation(kernel, requirement, expected, mutation)?;
+            summary.evaluated_cases += 1;
+            continue;
+        }
+        if let Some(mutation) = case
+            .get("derivationParameterMutation")
+            .and_then(Value::as_object)
+        {
+            validate_reference_parameter_mutation(
+                bundle,
+                requirement,
+                cases,
+                mutation,
+                &derivation_selectors,
+                observed_at,
+                expected,
+            )?;
+            summary.evaluated_cases += 1;
+            continue;
+        }
+
+        let response = case
+            .get("response")
+            .ok_or(CliError("reference fixture response is unavailable"))?;
+        let projected = project_fixture_response(source, response)
+            .map_err(|_| CliError("reference fixture source projection failed"))?;
+        if let Some(values) = validate_reference_response(
+            ReferenceResponseContext {
+                bundle,
+                kernel,
+                signer,
+                requirement,
+                resolved: &resolved,
+            },
+            &projected,
+            &derivation_selectors,
+            observed_at,
+            expected,
+        )
+        .await?
+        {
+            successful_values.push(values);
+        }
+        require_reference_request_count(expected, 1)?;
+        summary.evaluated_cases += 1;
+        let _ = id;
+    }
+
+    validate_reference_privacy(fixture, requirement, &successful_values)?;
+    Ok(summary)
+}
+
+struct ReferenceResponseContext<'a> {
+    bundle: &'a Bundle,
+    kernel: &'a OfflineKernel,
+    signer: &'a EvidenceSigner,
+    requirement: &'a registry_evidence::config::RequirementConfig,
+    resolved: &'a ResolvedAuthorization,
+}
+
+async fn validate_reference_response(
+    context: ReferenceResponseContext<'_>,
+    response: &Value,
+    selectors: &Value,
+    observed_at: DateTime<Utc>,
+    expected: &JsonMap<String, Value>,
+) -> Result<Option<Value>, CliError> {
+    let lookup = match context.kernel.extract(&context.requirement.id, response) {
+        Ok(lookup) => lookup,
+        Err(error) => {
+            validate_reference_error(expected, error, false)?;
+            return Ok(None);
+        }
+    };
+    match lookup {
+        LookupResult::NoMatch => {
+            validate_reference_unresolved(expected, "no_match")?;
+            Ok(None)
+        }
+        LookupResult::Ambiguous => {
+            validate_reference_unresolved(expected, "ambiguous")?;
+            Ok(None)
+        }
+        LookupResult::Match(facts) => {
+            if expected.get("lookup").and_then(Value::as_str) != Some("match") {
+                return Err(CliError("reference lookup outcome did not match"));
+            }
+            if let Some(exact) = expected.get("facts") {
+                let actual = serde_json::to_value(&facts)
+                    .map_err(|_| CliError("reference facts are not representable"))?;
+                if exact != &actual {
+                    return Err(CliError("reference exact facts did not match"));
+                }
+            }
+            let values = match context.kernel.derive_and_validate_with_selectors(
+                &context.requirement.id,
+                &facts,
+                selectors,
+                observed_at,
+                ValueProjection {
+                    audience: OFFLINE_AUDIENCE,
+                    binding_key: &OFFLINE_BINDING_KEY,
+                    binding_key_version: 1,
+                },
+            ) {
+                Ok(values) => values,
+                Err(error) => {
+                    validate_reference_error(expected, error, true)?;
+                    return Ok(None);
+                }
+            };
+            if expected.get("derivationRuns").and_then(Value::as_bool) != Some(true) {
+                return Err(CliError("reference derivation execution did not match"));
+            }
+            if let Some(exact) = expected.get("value") {
+                if values.as_slice().len() != 1
+                    || public_json(&values.as_slice()[0].value)? != *exact
+                {
+                    return Err(CliError("reference scalar value did not match"));
+                }
+            }
+            if let Some(exact) = expected.get("values") {
+                let exact = exact
+                    .as_object()
+                    .ok_or(CliError("reference concept map is invalid"))?;
+                if values.as_slice().len() != exact.len() {
+                    return Err(CliError("reference concept value did not match"));
+                }
+                for (concept, expected_value) in exact {
+                    let disclosed = values
+                        .as_slice()
+                        .iter()
+                        .find(|value| value.provides_value_for == *concept)
+                        .ok_or(CliError("reference concept value did not match"))?;
+                    if public_json(&disclosed.value)? != *expected_value {
+                        return Err(CliError("reference concept value did not match"));
+                    }
+                }
+            }
+            if let Some(count) = expected.get("entityReferenceCount").and_then(Value::as_u64) {
+                let actual = match values.as_slice() {
+                    [value] => match &value.value {
+                        PublicValue::List(items) => items
+                            .iter()
+                            .filter(|item| {
+                                matches!(item, ScalarOrEntityReference::EntityReference(_))
+                            })
+                            .count() as u64,
+                        _ => 0,
+                    },
+                    _ => 0,
+                };
+                if actual != count {
+                    return Err(CliError("reference entity-reference count did not match"));
+                }
+            }
+            if expected
+                .get("rawReferencesDisclosed")
+                .and_then(Value::as_bool)
+                == Some(false)
+            {
+                let encoded = serde_json::to_string(values.as_slice())
+                    .map_err(|_| CliError("reference values are not representable"))?;
+                let mut protected_source_strings = Vec::new();
+                collect_strings(response, &mut protected_source_strings);
+                if protected_source_strings
+                    .iter()
+                    .filter(|value| value.len() >= 8)
+                    .any(|value| encoded.contains(value))
+                {
+                    return Err(CliError("reference raw source reference was disclosed"));
+                }
+            }
+            if expected.get("signed").and_then(Value::as_bool) != Some(true) {
+                return Err(CliError("reference signing expectation did not match"));
+            }
+            sign_and_verify_fixture_evidence(
+                context.bundle,
+                context.kernel,
+                context.signer,
+                context.requirement,
+                context.resolved,
+                values,
+                observed_at,
+            )
+            .await
+            .map(Some)
+        }
+    }
+}
+
+async fn sign_and_verify_fixture_evidence(
+    bundle: &Bundle,
+    kernel: &OfflineKernel,
+    signer: &EvidenceSigner,
+    requirement: &registry_evidence::config::RequirementConfig,
+    resolved: &ResolvedAuthorization,
+    values: ValidatedValues,
+    observed_at: DateTime<Utc>,
+) -> Result<Value, CliError> {
+    let subjects = resolved
+        .subjects
+        .iter()
+        .map(|subject| {
+            Ok(SubjectBinding {
+                role: subject.role.clone(),
+                binding: subject
+                    .binding(
+                        &OFFLINE_BINDING_KEY,
+                        1,
+                        &bundle.config.service.trust_domain,
+                        OFFLINE_AUDIENCE,
+                        &resolved.purpose,
+                    )
+                    .map_err(|_| CliError("fixture subject binding failed"))?,
+            })
+        })
+        .collect::<Result<Vec<_>, CliError>>()?;
+    let issued_at = observed_at + chrono::Duration::seconds(1);
+    let evidence_id = format!("urn:ulid:{}", ulid::Ulid::new());
+    let evidence = kernel
+        .construct_evidence(
+            &requirement.id,
+            values,
+            EvidenceConstruction {
+                evidence_id: &evidence_id,
+                request_nonce: registry_evidence::model::OFFLINE_EVALUATION_REQUEST_NONCE,
+                purpose: &resolved.purpose,
+                audience: OFFLINE_AUDIENCE,
+                issued_at,
+                observed_at,
+                subjects,
+            },
+        )
+        .map_err(|_| CliError("fixture evidence construction failed"))?;
+    let signed = signer
+        .sign_json(&evidence)
+        .await
+        .map_err(|_| CliError("fixture evidence signing failed"))?;
+    let jwks = jwks_document(signer.public_jwk(), [])
+        .map_err(|_| CliError("fixture verification key construction failed"))?;
+    let mut policy = EvidenceVerificationPolicy::from_accepted_transaction(
+        &evidence,
+        registry_evidence::model::OFFLINE_EVALUATION_REQUEST_NONCE,
+        std::time::Duration::from_secs(31_536_000),
+        issued_at,
+        std::time::Duration::ZERO,
+    );
+    policy.issued_by = bundle.config.issuer.id.clone();
+    policy.provided_by = bundle.config.service.provider_id.clone();
+    policy.requirement = requirement.id.clone();
+    policy.evidence_type = requirement.evidence_type.clone();
+    policy.purpose = resolved.purpose.clone();
+    policy.audience = OFFLINE_AUDIENCE.to_owned();
+    policy.configuration_revision = bundle.revision().to_owned();
+    let verified = verify_flattened_jws(
+        &serde_json::to_vec(&signed)
+            .map_err(|_| CliError("fixture signed evidence is not representable"))?,
+        &jwks,
+        &policy,
+    )
+    .map_err(|_| CliError("fixture signed evidence verification failed"))?;
+    serde_json::to_value(verified)
+        .map_err(|_| CliError("fixture verified evidence is not representable"))
+}
+
+async fn offline_fixture_signer() -> Result<EvidenceSigner, CliError> {
+    use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+
+    const KEY_ID: &str = "offline-fixture-signing-key";
+    let signing_key = SigningKey::generate(&mut OsRng);
+    let private_bytes = Zeroizing::new(signing_key.to_bytes());
+    let public_bytes = signing_key.verifying_key().to_bytes();
+    let private_jwk = PrivateJwk {
+        kty: "OKP".to_owned(),
+        kid: Some(KEY_ID.to_owned()),
+        alg: Some("EdDSA".to_owned()),
+        crv: Some("Ed25519".to_owned()),
+        d: Some(URL_SAFE_NO_PAD.encode(private_bytes.as_slice())),
+        x: Some(URL_SAFE_NO_PAD.encode(public_bytes)),
+        y: None,
+        n: None,
+        e: None,
+        p: None,
+        q: None,
+        dp: None,
+        dq: None,
+        qi: None,
+    };
+    let provider = Arc::new(
+        LocalJwkSigner::new(private_jwk)
+            .map_err(|_| CliError("offline fixture signer initialization failed"))?,
+    );
+    EvidenceSigner::initialize(provider, KEY_ID)
+        .await
+        .map_err(|_| CliError("offline fixture signer self-test failed"))
+}
+
+fn validate_reference_unresolved(
+    expected: &JsonMap<String, Value>,
+    lookup: &str,
+) -> Result<(), CliError> {
+    if expected.get("lookup").and_then(Value::as_str) != Some(lookup)
+        || expected.get("derivationRuns").and_then(Value::as_bool) != Some(false)
+        || expected.get("signed").and_then(Value::as_bool) != Some(false)
+        || expected.get("publicProblem").and_then(Value::as_str) != Some("evidence_not_available")
+    {
+        return Err(CliError("reference unresolved outcome did not match"));
+    }
+    Ok(())
+}
+
+fn validate_reference_expectation_keys(
+    form: &str,
+    expected: &JsonMap<String, Value>,
+) -> Result<(), CliError> {
+    let allowed: &[&str] = match form {
+        "response" => &[
+            "lookup",
+            "facts",
+            "value",
+            "values",
+            "entityReferenceCount",
+            "rawReferencesDisclosed",
+            "signed",
+            "publicProblem",
+            "error",
+            "derivationRuns",
+            "sourceRequestCount",
+        ],
+        "sourceFailure" => &["publicProblem", "signed", "sourceRequestCount"],
+        "bundleMutation" => &["bundle"],
+        "requestMutation" => &["rejectedBefore", "signed", "sourceRequestCount"],
+        "derivationMutation" => &["outputGate", "signed"],
+        "derivationParameterMutation" => &["error", "publicProblem", "signed", "derivationRuns"],
+        "selectorOverrides" => &[
+            "expectedTransport",
+            "error",
+            "publicProblem",
+            "signed",
+            "rejectedBefore",
+            "sourceRequestCount",
+        ],
+        _ => return Err(CliError("reference fixture case form is unknown")),
+    };
+    require_allowed_keys(expected, allowed)
+}
+
+fn validate_reference_error(
+    expected: &JsonMap<String, Value>,
+    error: KernelError,
+    derivation_ran: bool,
+) -> Result<(), CliError> {
+    let (internal, public_problem) = match error {
+        KernelError::Preparation => ("adapter_input_error", "service_unavailable"),
+        KernelError::SourceProtocol => ("source_protocol_error", "dependency_unavailable"),
+        // Derivation-input inconsistency over a uniquely found record
+        // collapses publicly with the unresolved classes; the internal
+        // category stays a value-free operator diagnostic.
+        KernelError::DerivationInput => ("derivation_input_error", "evidence_not_available"),
+        KernelError::Script if derivation_ran => ("derivation_input_error", "service_unavailable"),
+        KernelError::Extraction => ("evidence_not_available", "evidence_not_available"),
+        _ => ("service_unavailable", "service_unavailable"),
+    };
+    let expected_error = expected.get("error").and_then(Value::as_str);
+    let expected_problem = expected.get("publicProblem").and_then(Value::as_str);
+    if expected_error.is_none() && expected_problem.is_none() {
+        return Err(CliError("reference failing case has no exact expectation"));
+    }
+    if expected_error.is_some_and(|expected| expected != internal) {
+        return Err(CliError("reference internal error did not match"));
+    }
+    if expected_problem.is_some_and(|expected| expected != public_problem) {
+        return Err(CliError("reference public problem did not match"));
+    }
+    if expected.get("signed").and_then(Value::as_bool) != Some(false) {
+        return Err(CliError(
+            "reference failed case signing expectation did not match",
+        ));
+    }
+    if expected.get("derivationRuns").and_then(Value::as_bool) != Some(derivation_ran) {
+        return Err(CliError("reference derivation execution did not match"));
+    }
+    Ok(())
+}
+
+fn validate_reference_request_parts(
+    common: &JsonMap<String, Value>,
+    actual: &RequestParts,
+) -> Result<(), CliError> {
+    let expected = common
+        .get("expectedRequestParts")
+        .and_then(Value::as_object)
+        .ok_or(CliError("reference request-parts expectation is invalid"))?;
+    require_exact_keys(expected, &["query", "body"])?;
+    let query = expected
+        .get("query")
+        .and_then(Value::as_array)
+        .ok_or(CliError("reference query expectation is invalid"))?;
+    if query.len() != actual.query.len() {
+        return Err(CliError("reference prepared query did not match"));
+    }
+    for (expected, actual) in query.iter().zip(&actual.query) {
+        let expected = expected
+            .as_object()
+            .ok_or(CliError("reference query-pair expectation is invalid"))?;
+        require_exact_keys(expected, &["name", "value"])?;
+        if expected.get("name").and_then(Value::as_str) != Some(&actual.name)
+            || expected.get("value").and_then(Value::as_str) != Some(&actual.value)
+        {
+            return Err(CliError("reference prepared query did not match"));
+        }
+    }
+    let expected_body = expected.get("body").filter(|body| !body.is_null());
+    if expected_body != actual.body.as_ref() {
+        return Err(CliError("reference prepared body did not match"));
+    }
+    Ok(())
+}
+
+fn validate_reference_transport(
+    source: &registry_evidence::config::SourceConfig,
+    source_plan: &SourceExecutor,
+    selectors: &[ResolvedSourceSelector],
+    parts: &RequestParts,
+    expected: &JsonMap<String, Value>,
+) -> Result<(), CliError> {
+    require_allowed_keys(expected, &["path", "query", "body", "fixedHeaders"])?;
+    let materialized = source_plan
+        .materialize_request(selectors, parts)
+        .map_err(|_| CliError("reference transport materialization failed"))?;
+    if expected
+        .get("path")
+        .and_then(Value::as_str)
+        .is_some_and(|path| materialized.path() != path)
+    {
+        return Err(CliError("reference materialized path did not match"));
+    }
+    if let Some(query) = expected.get("query").and_then(Value::as_str) {
+        if materialized.query().unwrap_or_default() != query {
+            return Err(CliError("reference encoded query did not match"));
+        }
+    }
+    if let Some(body) = expected.get("body").filter(|body| !body.is_null()) {
+        if materialized.body() != Some(body) {
+            return Err(CliError("reference transport body did not match"));
+        }
+    }
+    if let Some(headers) = expected.get("fixedHeaders").and_then(Value::as_array) {
+        if headers.len() != source.request.fixed_headers.len() {
+            return Err(CliError("reference fixed headers did not match"));
+        }
+        for (expected, actual) in headers.iter().zip(&source.request.fixed_headers) {
+            let expected = expected
+                .as_object()
+                .ok_or(CliError("reference fixed-header expectation is invalid"))?;
+            require_exact_keys(expected, &["name", "value"])?;
+            if expected.get("name").and_then(Value::as_str) != Some(&actual.name)
+                || expected.get("value").and_then(Value::as_str) != Some(&actual.value)
+            {
+                return Err(CliError("reference fixed headers did not match"));
+            }
+        }
+    }
+    Ok(())
+}
+
+fn reference_source_selectors(
+    resolved: &ResolvedAuthorization,
+    inputs: &[SelectorInput],
+) -> Result<Vec<ResolvedSourceSelector>, CliError> {
+    inputs
+        .iter()
+        .map(|input| {
+            let subject = resolved
+                .subjects
+                .iter()
+                .find(|subject| subject.role == input.role)
+                .ok_or(CliError("reference source selector role is unavailable"))?;
+            let alternative = input
+                .alternatives
+                .iter()
+                .find(|alternative| alternative.profile == subject.selector_profile)
+                .ok_or(CliError("reference source selector profile is invalid"))?;
+            let values = alternative
+                .fields
+                .iter()
+                .map(|name| {
+                    let field = subject
+                        .fields
+                        .iter()
+                        .find(|field| &field.name == name)
+                        .ok_or(CliError("reference source selector field is unavailable"))?;
+                    let value = match &field.value {
+                        ResolvedSelectorValue::String(value)
+                        | ResolvedSelectorValue::Date(value)
+                        | ResolvedSelectorValue::ControlledCode(value) => {
+                            SelectorValue::String(value.clone())
+                        }
+                        ResolvedSelectorValue::Integer(value) => SelectorValue::Integer(*value),
+                        ResolvedSelectorValue::Boolean(value) => SelectorValue::Boolean(*value),
+                    };
+                    Ok((name.clone(), value))
+                })
+                .collect::<Result<BTreeMap<_, _>, CliError>>()?;
+            Ok(ResolvedSourceSelector {
+                role: input.role.clone(),
+                profile: alternative.profile.clone(),
+                values,
+            })
+        })
+        .collect()
+}
+
+fn validate_reference_source_failure(
+    failure: &str,
+    expected: &JsonMap<String, Value>,
+) -> Result<(), CliError> {
+    let error = match failure {
+        "timeout" => SourceError::Timeout,
+        "connection-refused" => SourceError::Transport,
+        "invalid-media-type" => SourceError::WrongMediaType,
+        "oversized" => SourceError::ResponseTooLarge,
+        "malformed-json" => SourceError::InvalidJson,
+        _ => return Err(CliError("reference source-failure name is invalid")),
+    };
+    if source_failure_problem(&error) != ProblemCode::DependencyUnavailable
+        || expected.get("publicProblem").and_then(Value::as_str) != Some("dependency_unavailable")
+        || expected.get("signed").and_then(Value::as_bool) != Some(false)
+    {
+        return Err(CliError("reference source-failure mapping is invalid"));
+    }
+    require_reference_request_count(expected, 1)
+}
+
+fn validate_reference_bundle_mutation(
+    bundle: &Bundle,
+    requirement: &registry_evidence::config::RequirementConfig,
+) -> Result<(), CliError> {
+    let mut mutated = bundle.config.clone();
+    let mut companion = requirement.clone();
+    companion.id.push_str(":fixture-companion");
+    companion.evidence_type.push_str(":fixture-companion");
+    for concept in &mut companion.concepts {
+        concept.id.push_str(":fixture-companion");
+    }
+    mutated.requirements.push(companion);
+    if mutated.validate()
+        != Err(ConfigError::Invalid(
+            "enabled requirements share a disclosure family",
+        ))
+    {
+        return Err(CliError(
+            "reference unsafe bundle mutation was not rejected",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_reference_request_mutation(
+    bundle: &Bundle,
+    requirement: &registry_evidence::config::RequirementConfig,
+    common: &JsonMap<String, Value>,
+    case: &JsonMap<String, Value>,
+    expected: &JsonMap<String, Value>,
+    mutation: &str,
+) -> Result<(), CliError> {
+    if expected.get("rejectedBefore").and_then(Value::as_str) != Some("source") {
+        return Err(CliError("reference request rejection boundary is invalid"));
+    }
+    let selectors = common
+        .get("selectors")
+        .and_then(Value::as_object)
+        .ok_or(CliError("reference selectors are invalid"))?;
+    let mut subjects = selectors
+        .iter()
+        .map(|(role, selector)| {
+            let mut selector = selector
+                .as_object()
+                .cloned()
+                .ok_or(CliError("reference selector is invalid"))?;
+            selector.insert("role".to_owned(), Value::String(role.clone()));
+            Ok(Value::Object(selector))
+        })
+        .collect::<Result<Vec<_>, CliError>>()?;
+    match mutation {
+        "swap-subject-roles" if subjects.len() == 2 => {
+            let first = subjects[0]["role"].clone();
+            subjects[0]["role"] = subjects[1]["role"].clone();
+            subjects[1]["role"] = first;
+        }
+        "supply-grant-derived-candidate" => {}
+        _ => return Err(CliError("reference request-mutation name is invalid")),
+    }
+    let mut mutated = case.clone();
+    mutated.insert("subjects".to_owned(), Value::Array(subjects));
+    match resolve_offline_fixture_authorization(
+        bundle,
+        requirement,
+        Some(common),
+        &mutated,
+        OFFLINE_AUDIENCE,
+    ) {
+        Ok(_) => return Err(CliError("reference request mutation was authorized")),
+        Err(OfflineFixtureError::Purpose) => return Err(CliError(FIXTURE_PURPOSE_FAILURE)),
+        Err(OfflineFixtureError::Authorization(_)) => {}
+    }
+    if expected.get("signed").and_then(Value::as_bool) != Some(false) {
+        return Err(CliError("reference rejected request requires signing"));
+    }
+    require_reference_request_count(expected, 0)
+}
+
+fn validate_reference_derivation_mutation(
+    kernel: &OfflineKernel,
+    requirement: &registry_evidence::config::RequirementConfig,
+    expected: &JsonMap<String, Value>,
+    mutation: &str,
+) -> Result<(), CliError> {
+    if mutation != "return-raw-reference"
+        || expected.get("outputGate").and_then(Value::as_str) != Some("rejected")
+        || expected.get("signed").and_then(Value::as_bool) != Some(false)
+    {
+        return Err(CliError("reference derivation mutation is invalid"));
+    }
+    let injected = vec![DerivedConceptValue {
+        concept_id: requirement.concepts[0].id.clone(),
+        value: DerivedValue::Json(Value::String("PROTECTED-REFERENCE".to_owned())),
+    }];
+    if kernel
+        .validate_values(
+            &requirement.id,
+            injected,
+            ValueProjection {
+                audience: OFFLINE_AUDIENCE,
+                binding_key: &OFFLINE_BINDING_KEY,
+                binding_key_version: 1,
+            },
+        )
+        .is_ok()
+    {
+        return Err(CliError(
+            "reference derivation mutation crossed the output gate",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_reference_parameter_mutation(
+    bundle: &Bundle,
+    requirement: &registry_evidence::config::RequirementConfig,
+    cases: &[Value],
+    mutation: &JsonMap<String, Value>,
+    selectors: &Value,
+    observed_at: DateTime<Utc>,
+    expected: &JsonMap<String, Value>,
+) -> Result<(), CliError> {
+    let mut disposable = bundle.clone();
+    let mut config = serde_json::to_value(&disposable.config)
+        .map_err(|_| CliError("reference configuration is not representable"))?;
+    let target = config["requirements"]
+        .as_array_mut()
+        .and_then(|requirements| {
+            requirements
+                .iter_mut()
+                .find(|candidate| candidate["id"].as_str() == Some(&requirement.id))
+        })
+        .ok_or(CliError("reference disposable requirement is unavailable"))?;
+    let parameters = target["derivation"]["parameters"]
+        .as_object_mut()
+        .ok_or(CliError("reference derivation parameters are invalid"))?;
+    for (name, value) in mutation {
+        if !parameters.contains_key(name) {
+            return Err(CliError("reference parameter mutation is unknown"));
+        }
+        parameters.insert(name.clone(), value.clone());
+    }
+    disposable.config = serde_json::from_value(config)
+        .map_err(|_| CliError("reference parameter mutation is invalid"))?;
+    disposable
+        .config
+        .validate()
+        .map_err(|_| CliError("reference parameter mutation broke configuration"))?;
+    let disposable = Arc::new(disposable);
+    let kernel = OfflineKernel::compile(Arc::clone(&disposable))
+        .map_err(|_| CliError("reference disposable kernel did not compile"))?;
+    let positive = cases
+        .iter()
+        .find(|case| case.get("id").and_then(Value::as_str) == Some("positive"))
+        .and_then(|case| case.get("response"))
+        .ok_or(CliError("reference positive response is unavailable"))?;
+    let source = disposable
+        .config
+        .sources
+        .get(&requirement.source)
+        .ok_or(CliError("reference disposable source is unavailable"))?;
+    let projected = project_fixture_response(source, positive)
+        .map_err(|_| CliError("reference positive response projection failed"))?;
+    let outcome = kernel.evaluate_with_selectors(
+        &requirement.id,
+        &projected,
+        selectors,
+        observed_at,
+        ValueProjection {
+            audience: OFFLINE_AUDIENCE,
+            binding_key: &OFFLINE_BINDING_KEY,
+            binding_key_version: 1,
+        },
+    );
+    match outcome {
+        Err(error) => validate_reference_error(expected, error, true),
+        Ok(_) => Err(CliError("reference parameter mutation did not fail")),
+    }
+}
+
+fn require_reference_request_count(
+    expected: &JsonMap<String, Value>,
+    actual: u64,
+) -> Result<(), CliError> {
+    if expected
+        .get("sourceRequestCount")
+        .and_then(Value::as_u64)
+        .is_some_and(|count| count != actual)
+        || actual > 1
+    {
+        return Err(CliError("reference source request count did not match"));
+    }
+    Ok(())
+}
+
+fn validate_reference_privacy(
+    fixture: &JsonMap<String, Value>,
+    requirement: &registry_evidence::config::RequirementConfig,
+    successful_values: &[Value],
+) -> Result<(), CliError> {
+    let source = fixture
+        .get("privacyExpectation")
+        .and_then(Value::as_object)
+        .ok_or(CliError("reference privacy expectation is invalid"))?;
+    require_exact_keys(
+        source,
+        &["evidenceContains", "evidenceExcludes", "diagnosticsExclude"],
+    )?;
+    let mut expectation = JsonMap::new();
+    for (source_name, target_name) in [
+        ("evidenceContains", "evidence_contains"),
+        ("evidenceExcludes", "evidence_excludes"),
+        ("diagnosticsExclude", "diagnostics_exclude"),
+    ] {
+        expectation.insert(
+            target_name.to_owned(),
+            source
+                .get(source_name)
+                .cloned()
+                .ok_or(CliError("reference privacy expectation is incomplete"))?,
+        );
+    }
+    let projection = serde_json::json!({
+        "supportsRequirement": requirement.id,
+        "isConformantTo": requirement.evidence_type,
+        "subjectRoles": requirement
+            .subject_roles
+            .iter()
+            .map(|role| role.role.as_str())
+            .collect::<Vec<_>>(),
+        "successfulValues": successful_values,
+    });
+    validate_privacy_projection(&expectation, &projection)
+}
+
+const FIXTURE_PURPOSE_FAILURE: &str = "fixture does not select one of the requirement's purposes";
+
+/// Report an unselected fixture purpose as its own failure so a harness
+/// omission is never presented as a rejected request.
+fn fixture_failure(error: OfflineFixtureError, authorization: &'static str) -> CliError {
+    match error {
+        OfflineFixtureError::Purpose => CliError(FIXTURE_PURPOSE_FAILURE),
+        OfflineFixtureError::Authorization(_) => CliError(authorization),
+    }
+}
+
+fn require_exact_keys(object: &JsonMap<String, Value>, expected: &[&str]) -> Result<(), CliError> {
+    require_allowed_keys(object, expected)?;
+    if expected.iter().any(|key| !object.contains_key(*key)) {
+        return Err(CliError("reference fixture required key is missing"));
+    }
+    Ok(())
+}
+
+fn require_allowed_keys(object: &JsonMap<String, Value>, allowed: &[&str]) -> Result<(), CliError> {
+    if object
+        .keys()
+        .any(|key| !allowed.iter().any(|allowed| key == allowed))
+    {
+        return Err(CliError("reference fixture contains an unknown key"));
+    }
+    Ok(())
+}
+
+fn fixture_selector_value(
+    resolved: &ResolvedAuthorization,
+    inputs: &[SelectorInput],
+) -> Result<Value, CliError> {
+    let mut selectors = JsonMap::new();
+    for input in inputs {
+        let subject = resolved
+            .subjects
+            .iter()
+            .find(|subject| subject.role == input.role)
+            .ok_or(CliError("fixture selector input role is unavailable"))?;
+        let alternative = input
+            .alternatives
+            .iter()
+            .find(|alternative| alternative.profile == subject.selector_profile)
+            .ok_or(CliError("fixture selector input profile is unavailable"))?;
+        let mut values = JsonMap::new();
+        for name in &alternative.fields {
+            let field = subject
+                .fields
+                .iter()
+                .find(|field| &field.name == name)
+                .ok_or(CliError("fixture selector input field is unavailable"))?;
+            values.insert(name.clone(), field.value.as_json());
+        }
+        let mut selector = JsonMap::new();
+        selector.insert(
+            "profile".to_owned(),
+            Value::String(alternative.profile.clone()),
+        );
+        selector.insert("values".to_owned(), Value::Object(values));
+        if selectors
+            .insert(input.role.clone(), Value::Object(selector))
+            .is_some()
+        {
+            return Err(CliError("fixture selector input role is duplicated"));
+        }
+    }
+    Ok(Value::Object(selectors))
+}
+
+fn validate_case_outcome(
+    _case_id: &str,
+    case: &serde_json::Map<String, Value>,
+    outcome: Result<KernelOutcome, registry_evidence::kernel::KernelError>,
+) -> Result<Option<ValidatedValues>, CliError> {
+    let derivation_runs = optional_boolean(case, "derivation_runs")?;
+    let signed_success = optional_boolean(case, "signed_success")?;
+    let expected_problem = optional_string(case, "expected_public_problem")?;
+
+    if let Some(expected_lookup @ ("no_match" | "ambiguous")) =
+        optional_string(case, "expected_lookup")?
+    {
+        let matches = matches!(
+            (expected_lookup, &outcome),
+            ("no_match", Ok(KernelOutcome::NoMatch)) | ("ambiguous", Ok(KernelOutcome::Ambiguous))
+        );
+        if !matches {
+            return Err(CliError(
+                "fixture lookup outcome did not match its contract",
+            ));
+        }
+        if signed_success != Some(false) || derivation_runs != Some(false) {
+            return Err(CliError(
+                "unresolved fixture must deny derivation and signed success",
+            ));
+        }
+        if expected_problem != Some("evidence_not_available") {
+            return Err(CliError("unresolved fixture public problem is not exact"));
+        }
+        return Ok(None);
+    }
+    if optional_string(case, "expected_lookup")?.is_some_and(|lookup| lookup != "match") {
+        return Err(CliError("fixture lookup expectation is invalid"));
+    }
+
+    if let Some(problem) = expected_problem {
+        let exact = matches!(
+            (problem, &outcome),
+            (
+                "evidence_not_available",
+                Err(registry_evidence::kernel::KernelError::Extraction
+                    | registry_evidence::kernel::KernelError::DerivationInput)
+            ) | (
+                "dependency_unavailable",
+                Err(registry_evidence::kernel::KernelError::SourceProtocol)
+            ) | (
+                "service_unavailable",
+                Err(registry_evidence::kernel::KernelError::Script
+                    | registry_evidence::kernel::KernelError::Output
+                    | registry_evidence::kernel::KernelError::Bundle
+                    | registry_evidence::kernel::KernelError::Requirement
+                    | registry_evidence::kernel::KernelError::Evidence)
+            )
+        );
+        if !exact {
+            return Err(CliError(
+                "fixture kernel failure did not match its public problem",
+            ));
+        }
+        let derivation_ran = !matches!(
+            outcome,
+            Err(registry_evidence::kernel::KernelError::Extraction
+                | registry_evidence::kernel::KernelError::SourceProtocol)
+        );
+        if signed_success != Some(false) || derivation_runs != Some(derivation_ran) {
+            return Err(CliError(
+                "failing fixture execution expectations did not match",
+            ));
+        }
+        return Ok(None);
+    }
+
+    let KernelOutcome::Match(values) =
+        outcome.map_err(|_| CliError("fixture evaluation failed unexpectedly"))?
+    else {
+        return Err(CliError("fixture expected a unique match"));
+    };
+    if optional_string(case, "expected_lookup")? != Some("match") {
+        return Err(CliError("matched fixture must require an exact match"));
+    }
+    if derivation_runs == Some(false) {
+        return Err(CliError("matched fixture cannot deny derivation execution"));
+    }
+    if signed_success == Some(false) {
+        return Err(CliError(
+            "matched fixture cannot deny signed-success eligibility",
+        ));
+    }
+
+    let expected_value = case.get("expected_value");
+    let expected_values = case.get("expected_values");
+    if expected_value.is_some() == expected_values.is_some() {
+        return Err(CliError(
+            "matched fixture must declare exactly one value expectation",
+        ));
+    }
+    if let Some(expected) = expected_value {
+        if values.as_slice().len() != 1 || public_json(&values.as_slice()[0].value)? != *expected {
+            return Err(CliError("fixture value did not match its contract"));
+        }
+    }
+    if let Some(expected) = expected_values.and_then(Value::as_object) {
+        if values.as_slice().len() != expected.len() {
+            return Err(CliError("fixture value set did not match its contract"));
+        }
+        for (name, expected_value) in expected {
+            let actual = values
+                .as_slice()
+                .iter()
+                .filter(|candidate| {
+                    candidate.provides_value_for == *name
+                        || candidate
+                            .provides_value_for
+                            .strip_suffix(name)
+                            .is_some_and(|prefix| prefix.ends_with(':'))
+                })
+                .collect::<Vec<_>>();
+            if actual.len() != 1 || public_json(&actual[0].value)? != *expected_value {
+                return Err(CliError("fixture value set did not match its contract"));
+            }
+        }
+    } else if expected_values.is_some() {
+        return Err(CliError("fixture value-set expectation is invalid"));
+    }
+    if derivation_runs != Some(true) || signed_success != Some(true) {
+        return Err(CliError(
+            "matched fixture must require derivation and signed success",
+        ));
+    }
+    Ok(Some(values))
+}
+
+fn validate_source_failure(
+    case: &serde_json::Map<String, Value>,
+    source_failure: &Value,
+) -> Result<(), CliError> {
+    let failure = match source_failure.as_str() {
+        Some("timeout") => SourceError::Timeout,
+        Some("redirect") => SourceError::Redirect,
+        Some("http-503") => SourceError::Status(SourceStatus::ServerError),
+        Some("wrong-media-type") => SourceError::WrongMediaType,
+        _ => return Err(CliError("fixture source-failure category is invalid")),
+    };
+    if optional_string(case, "expected_public_problem")? != Some("dependency_unavailable")
+        || optional_boolean(case, "signed_success")? != Some(false)
+        || source_failure_problem(&failure) != ProblemCode::DependencyUnavailable
+    {
+        return Err(CliError("fixture source-failure mapping is invalid"));
+    }
+    Ok(())
+}
+
+fn validate_companion_rejection(
+    bundle: &Bundle,
+    requirement: &registry_evidence::config::RequirementConfig,
+    case: &serde_json::Map<String, Value>,
+    companion: &Value,
+) -> Result<(), CliError> {
+    let label = companion
+        .as_str()
+        .filter(|value| {
+            !value.is_empty()
+                && value.len() <= 128
+                && value
+                    .bytes()
+                    .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'-')
+        })
+        .ok_or(CliError("fixture companion-bundle label is invalid"))?;
+    require_expected(case, "bundle-rejection")?;
+    let matrix: Value = serde_norway::from_slice(ANTI_RECONSTRUCTION_FIXTURE)
+        .map_err(|_| CliError("anti-reconstruction fixture is invalid"))?;
+    let rejected = matrix
+        .get("rejected_bundles")
+        .and_then(Value::as_array)
+        .ok_or(CliError("anti-reconstruction fixture is invalid"))?;
+    let declaration = rejected
+        .iter()
+        .find(|entry| entry.get("id").and_then(Value::as_str) == Some(label))
+        .and_then(Value::as_object)
+        .ok_or(CliError("fixture companion-bundle label is unknown"))?;
+    let shared_family = declaration
+        .get("shared_disclosure_family")
+        .and_then(Value::as_str)
+        .ok_or(CliError("anti-reconstruction family is invalid"))?;
+    let definitions = declaration
+        .get("definitions")
+        .and_then(Value::as_array)
+        .filter(|definitions| definitions.len() >= 2)
+        .ok_or(CliError(
+            "anti-reconstruction combination must contain multiple definitions",
+        ))?;
+    let distinct_definitions = definitions
+        .iter()
+        .map(serde_json::to_string)
+        .collect::<Result<std::collections::BTreeSet<_>, _>>()
+        .map_err(|_| CliError("anti-reconstruction definition is invalid"))?;
+    if distinct_definitions.len() != definitions.len()
+        || !definitions.iter().all(Value::is_object)
+        || declaration
+            .get("threat")
+            .and_then(Value::as_str)
+            .is_none_or(str::is_empty)
+        || declaration
+            .get("expected")
+            .and_then(Value::as_str)
+            .is_none_or(str::is_empty)
+    {
+        return Err(CliError(
+            "anti-reconstruction combination declaration is incomplete",
+        ));
+    }
+
+    let mut unsafe_config = bundle.config.clone();
+    let original = unsafe_config
+        .requirements
+        .iter_mut()
+        .find(|candidate| candidate.id == requirement.id)
+        .ok_or(CliError("fixture requirement is missing"))?;
+    original.disclosure_guard.families = vec![shared_family.to_owned()];
+    for index in 1..definitions.len() {
+        let suffix = format!(":fixture-companion-{index}");
+        let mut companion = requirement.clone();
+        companion.id.push_str(&suffix);
+        companion.evidence_type.push_str(&suffix);
+        companion.disclosure_guard.families = vec![shared_family.to_owned()];
+        companion.derivation.script = registry_evidence::config::ArtifactPath::parse(&format!(
+            "derivations/fixture-companion-{index}.rhai"
+        ))
+        .map_err(|_| CliError("fixture companion path is invalid"))?;
+        companion.fixtures = Some(
+            registry_evidence::config::ArtifactPath::parse(&format!(
+                "fixtures/fixture-companion-{index}.yaml"
+            ))
+            .map_err(|_| CliError("fixture companion path is invalid"))?,
+        );
+        for concept in &mut companion.concepts {
+            concept.id.push_str(&suffix);
+        }
+        unsafe_config.requirements.push(companion);
+    }
+    if unsafe_config.validate()
+        != Err(ConfigError::Invalid(
+            "enabled requirements share a disclosure family",
+        ))
+    {
+        return Err(CliError("unsafe companion bundle was not rejected"));
+    }
+    Ok(())
+}
+
+fn optional_boolean(
+    case: &serde_json::Map<String, Value>,
+    name: &str,
+) -> Result<Option<bool>, CliError> {
+    case.get(name)
+        .map(|value| {
+            value
+                .as_bool()
+                .ok_or(CliError("fixture boolean expectation is invalid"))
+        })
+        .transpose()
+}
+
+fn optional_string<'a>(
+    case: &'a serde_json::Map<String, Value>,
+    name: &str,
+) -> Result<Option<&'a str>, CliError> {
+    case.get(name)
+        .map(|value| {
+            value
+                .as_str()
+                .ok_or(CliError("fixture string expectation is invalid"))
+        })
+        .transpose()
+}
+
+fn validate_privacy_expectation(
+    fixture: &serde_json::Map<String, Value>,
+    requirement: &registry_evidence::config::RequirementConfig,
+    successful_values: &[Value],
+) -> Result<(), CliError> {
+    let expectation = fixture
+        .get("privacy_expectation")
+        .and_then(Value::as_object)
+        .ok_or(CliError("fixture privacy expectation is unavailable"))?;
+    let projection = serde_json::json!({
+        "supportsRequirement": requirement.id,
+        "isConformantTo": requirement.evidence_type,
+        "subjectRoles": requirement
+            .subject_roles
+            .iter()
+            .map(|role| role.role.as_str())
+            .collect::<Vec<_>>(),
+        "successfulValues": successful_values,
+    });
+    validate_privacy_projection(expectation, &projection)
+}
+
+fn validate_privacy_projection(
+    expectation: &serde_json::Map<String, Value>,
+    projection: &Value,
+) -> Result<(), CliError> {
+    let mut disclosed_strings = Vec::new();
+    collect_strings(projection, &mut disclosed_strings);
+
+    for expected in expectation_strings(expectation, "evidence_contains")? {
+        if !disclosed_strings.contains(&expected) {
+            return Err(CliError("fixture required disclosure is absent"));
+        }
+    }
+    for prohibited in expectation_strings(expectation, "evidence_excludes")? {
+        if disclosed_strings.contains(&prohibited) {
+            return Err(CliError("fixture prohibited disclosure is present"));
+        }
+    }
+    // CLI diagnostics are structurally static (`CliError(&'static str)`) and
+    // the success line contains counts only. Still exercise every declared
+    // diagnostic canary against the exact dynamic-free output templates so a
+    // future template change cannot silently weaken this fixture assertion.
+    for prohibited in expectation_strings(expectation, "diagnostics_exclude")? {
+        if [
+            "Evidence fixture passed (0 evaluated cases)",
+            "evidence: fixture evaluation failed",
+        ]
+        .iter()
+        .any(|surface| surface.contains(prohibited))
+        {
+            return Err(CliError("fixture prohibited diagnostic is present"));
+        }
+    }
+    Ok(())
+}
+
+fn expectation_strings<'a>(
+    expectation: &'a serde_json::Map<String, Value>,
+    name: &str,
+) -> Result<Vec<&'a str>, CliError> {
+    expectation
+        .get(name)
+        .and_then(Value::as_array)
+        .ok_or(CliError("fixture privacy expectation is invalid"))?
+        .iter()
+        .map(|value| {
+            value
+                .as_str()
+                .ok_or(CliError("fixture privacy expectation is invalid"))
+        })
+        .collect()
+}
+
+fn collect_strings<'a>(value: &'a Value, output: &mut Vec<&'a str>) {
+    match value {
+        Value::String(value) => output.push(value),
+        Value::Array(values) => {
+            for value in values {
+                collect_strings(value, output);
+            }
+        }
+        Value::Object(values) => {
+            for (key, value) in values {
+                output.push(key);
+                collect_strings(value, output);
+            }
+        }
+        _ => {}
+    }
+}
+
+fn validate_injected_rejection(
+    kernel: &OfflineKernel,
+    requirement_id: &str,
+    injected: &Value,
+) -> Result<(), CliError> {
+    let injected = injected
+        .as_array()
+        .ok_or(CliError("injected derivation fixture must be an array"))?;
+    let mut derived = Vec::with_capacity(injected.len());
+    for value in injected {
+        let object = value
+            .as_object()
+            .ok_or(CliError("injected derivation member is invalid"))?;
+        if object.len() != 2 {
+            return Err(CliError("injected derivation member is not closed"));
+        }
+        let concept_id = object
+            .get("concept_id")
+            .and_then(Value::as_str)
+            .ok_or(CliError("injected derivation concept is invalid"))?;
+        let value = object
+            .get("value")
+            .cloned()
+            .ok_or(CliError("injected derivation value is missing"))?;
+        derived.push(DerivedConceptValue {
+            concept_id: concept_id.to_owned(),
+            value: DerivedValue::Json(value),
+        });
+    }
+    if kernel
+        .validate_values(
+            requirement_id,
+            derived,
+            ValueProjection {
+                audience: OFFLINE_AUDIENCE,
+                binding_key: &OFFLINE_BINDING_KEY,
+                binding_key_version: 1,
+            },
+        )
+        .is_ok()
+    {
+        return Err(CliError("injected derivation was not rejected"));
+    }
+    Ok(())
+}
+
+fn public_json(value: &PublicValue) -> Result<Value, CliError> {
+    serde_json::to_value(value).map_err(|_| CliError("fixture value is not representable"))
+}
+
+fn fixture_observed_at(
+    case: &serde_json::Map<String, Value>,
+    common: Option<&serde_json::Map<String, Value>>,
+    timezone: Option<&str>,
+) -> Result<DateTime<Utc>, CliError> {
+    if let Some(observed) = case.get("observed_at").and_then(Value::as_str) {
+        return DateTime::parse_from_rfc3339(observed)
+            .map(|value| value.with_timezone(&Utc))
+            .map_err(|_| CliError("fixture observation time is invalid"));
+    }
+
+    if let Some(local_date) = case.get("legal_local_date").and_then(Value::as_str) {
+        return local_date_at_noon(local_date, timezone);
+    }
+
+    if let Some(observed) = common
+        .and_then(|value| value.get("observed_at"))
+        .and_then(Value::as_str)
+    {
+        return DateTime::parse_from_rfc3339(observed)
+            .map(|value| value.with_timezone(&Utc))
+            .map_err(|_| CliError("fixture observation time is invalid"));
+    }
+
+    if let Some(local_date) = common
+        .and_then(|value| value.get("legal_local_date"))
+        .and_then(Value::as_str)
+    {
+        return local_date_at_noon(local_date, timezone);
+    }
+
+    DateTime::parse_from_rfc3339("1970-01-01T12:00:00Z")
+        .map(|value| value.with_timezone(&Utc))
+        .map_err(|_| CliError("fixed fixture time is invalid"))
+}
+
+fn local_date_at_noon(local_date: &str, timezone: Option<&str>) -> Result<DateTime<Utc>, CliError> {
+    let date = NaiveDate::parse_from_str(local_date, "%Y-%m-%d")
+        .map_err(|_| CliError("fixture legal local date is invalid"))?;
+    let local_noon = date
+        .and_hms_opt(12, 0, 0)
+        .ok_or(CliError("fixture legal local date is invalid"))?;
+    let timezone = timezone
+        .map(Tz::from_str)
+        .transpose()
+        .map_err(|_| CliError("fixture observation timezone is invalid"))?
+        .unwrap_or(Tz::UTC);
+    timezone
+        .from_local_datetime(&local_noon)
+        .single()
+        .map(|value| value.with_timezone(&Utc))
+        .ok_or(CliError("fixture legal local date cannot be resolved"))
+}
+
+fn require_expected(case: &serde_json::Map<String, Value>, expected: &str) -> Result<(), CliError> {
+    if case.get("expected").and_then(Value::as_str) == Some(expected) {
+        Ok(())
+    } else {
+        Err(CliError("fixture boundary expectation is invalid"))
+    }
+}
+
+fn safe_fixture_name(path: &Path) -> Result<&str, CliError> {
+    if path.is_absolute()
+        || !path
+            .components()
+            .all(|component| matches!(component, Component::Normal(_)))
+    {
+        return Err(CliError(
+            "fixture path must be bundle-relative and normalized",
+        ));
+    }
+    let name = path
+        .to_str()
+        .filter(|value| value.starts_with("fixtures/") && value.ends_with(".yaml"))
+        .ok_or(CliError("fixture path is invalid"))?;
+    Ok(name)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use clap::CommandFactory as _;
+    use registry_evidence::audit::{
+        audit_segment_paths, AuditAuthority, AuditDecision, AuditPhase, AuditSubject,
+        AuthorityKind, EvidenceAuditEvent, EvidenceAuditLog, ResponseProtection,
+    };
+    use registry_evidence::config::AssuranceProfile;
+    use registry_evidence::verifier::ExpectedValueForm;
+    use std::fs;
+
+    #[test]
+    fn local_shell_seams_are_hidden_from_adopter_help() {
+        let command = Cli::command();
+        for name in [
+            "prepare-local-verification-context",
+            "verify-local-response",
+            "local-audit-last-operation",
+        ] {
+            assert!(
+                command
+                    .get_subcommands()
+                    .find(|candidate| candidate.get_name() == name)
+                    .is_some_and(clap::Command::is_hide_set),
+                "{name} remains an internal shell seam"
+            );
+        }
+    }
+
+    #[test]
+    fn local_bearer_is_bounded_and_accepts_only_one_shell_line() {
+        assert_eq!(
+            read_local_bearer("header.payload.signature\n".as_bytes())
+                .expect("one shell line is accepted")
+                .as_str(),
+            "header.payload.signature"
+        );
+        for invalid in [
+            "",
+            "\n",
+            "header.payload.signature\n\n",
+            "header.payload. signature",
+        ] {
+            assert!(read_local_bearer(invalid.as_bytes()).is_err());
+        }
+        assert!(read_local_bearer(vec![b'a'; MAX_LOCAL_BEARER_BYTES + 1].as_slice()).is_err());
+    }
+
+    #[test]
+    fn local_documents_require_one_owner_only_regular_file() {
+        use std::os::unix::fs::{symlink, PermissionsExt as _};
+
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let safe = directory.path().join("request.json");
+        fs::write(&safe, b"{}").expect("input is written");
+        fs::set_permissions(&safe, fs::Permissions::from_mode(0o600))
+            .expect("input becomes owner-only");
+        assert_eq!(
+            read_owner_only_input(&safe, 2, LOCAL_CONTEXT_FAILED).expect("owner-only input reads"),
+            b"{}"
+        );
+
+        fs::set_permissions(&safe, fs::Permissions::from_mode(0o640))
+            .expect("input becomes group-readable");
+        assert!(read_owner_only_input(&safe, 2, LOCAL_CONTEXT_FAILED).is_err());
+        fs::set_permissions(&safe, fs::Permissions::from_mode(0o600))
+            .expect("input becomes owner-only again");
+
+        let link = directory.path().join("second-link.json");
+        fs::hard_link(&safe, &link).expect("hard link is created");
+        assert!(read_owner_only_input(&safe, 2, LOCAL_CONTEXT_FAILED).is_err());
+        fs::remove_file(&link).expect("hard link is removed");
+
+        let symbolic = directory.path().join("symbolic.json");
+        symlink(&safe, &symbolic).expect("symbolic link is created");
+        assert!(read_owner_only_input(&symbolic, 2, LOCAL_CONTEXT_FAILED).is_err());
+        assert!(read_owner_only_input(&safe, 1, LOCAL_CONTEXT_FAILED).is_err());
+    }
+
+    #[test]
+    fn local_response_accepts_curl_permissions_but_rejects_file_identity_tricks() {
+        use std::os::unix::fs::{symlink, PermissionsExt as _};
+
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let response = directory.path().join("assertion.jws.json");
+        fs::write(&response, b"{}").expect("response is written");
+        fs::set_permissions(&response, fs::Permissions::from_mode(0o644))
+            .expect("response uses ordinary curl output permissions");
+        assert_eq!(
+            read_untrusted_response_input(&response, 2, LOCAL_RESPONSE_FAILED)
+                .expect("ordinary curl output reads"),
+            b"{}"
+        );
+
+        let link = directory.path().join("response-link.json");
+        fs::hard_link(&response, &link).expect("hard link is created");
+        assert!(read_untrusted_response_input(&response, 2, LOCAL_RESPONSE_FAILED).is_err());
+        fs::remove_file(&link).expect("hard link is removed");
+
+        let symbolic = directory.path().join("response-symbolic.json");
+        symlink(&response, &symbolic).expect("symbolic link is created");
+        assert!(read_untrusted_response_input(&symbolic, 2, LOCAL_RESPONSE_FAILED).is_err());
+        assert!(read_untrusted_response_input(&response, 1, LOCAL_RESPONSE_FAILED).is_err());
+    }
+
+    /// Every expected form the published policy schema accepts must parse the
+    /// way that schema writes it. The list form is a mapping under `list`, not
+    /// a YAML tag, and it is the only form a list-valued concept can state.
+    #[test]
+    fn policy_documents_parse_every_expected_form_as_the_contract_writes_it() {
+        for (written, expected) in [
+            ("boolean", ExpectedValueForm::Boolean),
+            ("integer", ExpectedValueForm::Integer),
+            ("string", ExpectedValueForm::String),
+            ("date-bucket", ExpectedValueForm::DateBucket),
+            ("time-bucket", ExpectedValueForm::TimeBucket),
+            ("entity-reference", ExpectedValueForm::EntityReference),
+            ("structured", ExpectedValueForm::Structured),
+            (
+                "{list: {minimumItems: 1, maximumItems: 2}}",
+                ExpectedValueForm::List {
+                    minimum_items: 1,
+                    maximum_items: 2,
+                },
+            ),
+        ] {
+            let document = verification_policy_document(&format!("form: {written}"));
+            let policy: EvidenceVerificationPolicyDocument = serde_norway::from_str(&document)
+                .unwrap_or_else(|error| panic!("`{written}` is a policy form: {error}"));
+            assert_eq!(
+                policy.into_policy(Utc::now()).expected_outputs[0].form,
+                expected,
+                "`{written}` parsed as a different form"
+            );
+        }
+    }
+
+    #[test]
+    fn policy_documents_reject_forms_outside_the_closed_vocabulary() {
+        for written in [
+            "list",
+            "{list: {minimumItems: 1}}",
+            "{list: {minimumItems: 1, maximumItems: 2, extra: 3}}",
+            "{set: {minimumItems: 1, maximumItems: 2}}",
+            "date_bucket",
+        ] {
+            let document = verification_policy_document(&format!("form: {written}"));
+            assert!(
+                serde_norway::from_str::<EvidenceVerificationPolicyDocument>(&document).is_err(),
+                "`{written}` is not a policy form but parsed as one"
+            );
+        }
+    }
+
+    /// One complete policy document whose single expected output states `form`.
+    fn verification_policy_document(form: &str) -> String {
+        format!(
+            "expectedAssuranceProfile: evidence-grade\n\
+             issuedBy: urn:example:issuer\n\
+             providedBy: urn:example:provider\n\
+             requirement: urn:example:requirement:v1\n\
+             evidenceType: urn:example:evidence-type:v1\n\
+             purpose: example-purpose\n\
+             audience: https://relying-party.example\n\
+             configurationRevision: sha256:0\n\
+             requestNonce: example-nonce\n\
+             expectedSubjects:\n\
+             \x20 - {{role: subject, binding: urn:evidence:subject:v1_{binding}}}\n\
+             expectedOutputs:\n\
+             \x20 - concept: urn:example:concept\n\
+             \x20   {form}\n\
+             maximumAssertionLifetimeSeconds: 86400\n\
+             clockSkewSeconds: 30\n",
+            binding = "A".repeat(43),
+        )
+    }
+
+    #[test]
+    fn fixture_paths_never_escape_the_captured_bundle() {
+        assert_eq!(
+            safe_fixture_name(Path::new("fixtures/cases.yaml")),
+            Ok("fixtures/cases.yaml")
+        );
+        assert!(safe_fixture_name(Path::new("../fixtures/cases.yaml")).is_err());
+        assert!(safe_fixture_name(Path::new("/tmp/cases.yaml")).is_err());
+    }
+
+    #[test]
+    fn offline_dates_are_fixed_and_never_use_ambient_time() {
+        let case = serde_json::json!({"legal_local_date": "2026-08-03"});
+        let observed = fixture_observed_at(case.as_object().expect("object"), None, None)
+            .expect("date converts");
+        assert_eq!(observed.to_rfc3339(), "2026-08-03T12:00:00+00:00");
+    }
+
+    #[test]
+    fn case_local_date_overrides_common_observation_time() {
+        let case = serde_json::json!({"legal_local_date": "2026-08-01"});
+        let common = serde_json::json!({"observed_at": "2026-08-02T00:00:00Z"});
+        let observed = fixture_observed_at(
+            case.as_object().expect("case object"),
+            common.as_object(),
+            Some("Asia/Bangkok"),
+        )
+        .expect("case-local date converts");
+        assert_eq!(observed.to_rfc3339(), "2026-08-01T05:00:00+00:00");
+    }
+
+    #[test]
+    fn symbolic_source_failures_use_the_production_public_mapper() {
+        for category in ["timeout", "redirect", "http-503", "wrong-media-type"] {
+            let case = serde_json::json!({
+                "source_failure": category,
+                "expected_public_problem": "dependency_unavailable",
+                "signed_success": false
+            });
+            let object = case.as_object().expect("object");
+            assert_eq!(
+                validate_source_failure(object, &object["source_failure"]),
+                Ok(())
+            );
+        }
+    }
+
+    #[test]
+    fn public_unavailability_requires_an_extraction_failure() {
+        let case = serde_json::json!({
+            "expected_public_problem": "evidence_not_available",
+            "derivation_runs": false,
+            "signed_success": false
+        });
+        let case = case.as_object().expect("object");
+        assert!(validate_case_outcome("case", case, Ok(KernelOutcome::NoMatch)).is_err());
+        assert!(validate_case_outcome(
+            "case",
+            case,
+            Err(registry_evidence::kernel::KernelError::Script),
+        )
+        .is_err());
+        assert_eq!(
+            validate_case_outcome(
+                "case",
+                case,
+                Err(registry_evidence::kernel::KernelError::Extraction),
+            ),
+            Ok(None)
+        );
+    }
+
+    #[test]
+    fn service_unavailability_requires_an_internal_kernel_failure() {
+        let case = serde_json::json!({
+            "expected_public_problem": "service_unavailable",
+            "derivation_runs": true,
+            "signed_success": false
+        });
+        let case = case.as_object().expect("object");
+        assert_eq!(
+            validate_case_outcome(
+                "case",
+                case,
+                Err(registry_evidence::kernel::KernelError::Script),
+            ),
+            Ok(None)
+        );
+        assert!(validate_case_outcome(
+            "case",
+            case,
+            Err(registry_evidence::kernel::KernelError::Extraction),
+        )
+        .is_err());
+    }
+
+    #[test]
+    fn unresolved_lookup_rejects_derivation_or_signed_success_claims() {
+        for declaration in [
+            serde_json::json!({
+                "expected_lookup": "no_match",
+                "expected_public_problem": "evidence_not_available",
+                "derivation_runs": true
+            }),
+            serde_json::json!({
+                "expected_lookup": "no_match",
+                "expected_public_problem": "evidence_not_available",
+                "signed_success": true
+            }),
+        ] {
+            assert!(validate_case_outcome(
+                "case",
+                declaration.as_object().expect("object"),
+                Ok(KernelOutcome::NoMatch),
+            )
+            .is_err());
+        }
+    }
+
+    #[test]
+    fn reference_fixture_forms_reject_irrelevant_expectations() {
+        let bundle = serde_json::json!({"bundle": "rejected"});
+        assert_eq!(
+            validate_reference_expectation_keys(
+                "bundleMutation",
+                bundle.as_object().expect("object"),
+            ),
+            Ok(())
+        );
+
+        let irrelevant = serde_json::json!({"bundle": "rejected", "signed": false});
+        assert!(validate_reference_expectation_keys(
+            "bundleMutation",
+            irrelevant.as_object().expect("object"),
+        )
+        .is_err());
+
+        let transport = serde_json::json!({
+            "expectedTransport": {"path": "/records"},
+            "sourceRequestCount": 1
+        });
+        assert_eq!(
+            validate_reference_expectation_keys(
+                "selectorOverrides",
+                transport.as_object().expect("object"),
+            ),
+            Ok(())
+        );
+        assert!(validate_reference_expectation_keys(
+            "response",
+            transport.as_object().expect("object"),
+        )
+        .is_err());
+    }
+
+    #[test]
+    fn reference_failures_require_exact_unsigned_stage_expectations() {
+        let exact = serde_json::json!({
+            "error": "source_protocol_error",
+            "publicProblem": "dependency_unavailable",
+            "derivationRuns": false,
+            "signed": false
+        });
+        assert_eq!(
+            validate_reference_error(
+                exact.as_object().expect("object"),
+                KernelError::SourceProtocol,
+                false,
+            ),
+            Ok(())
+        );
+
+        let wrong_public = serde_json::json!({
+            "error": "source_protocol_error",
+            "publicProblem": "service_unavailable",
+            "derivationRuns": false,
+            "signed": false
+        });
+        assert!(validate_reference_error(
+            wrong_public.as_object().expect("object"),
+            KernelError::SourceProtocol,
+            false,
+        )
+        .is_err());
+    }
+
+    #[test]
+    fn privacy_expectations_check_exact_projected_strings() {
+        let expectation = serde_json::json!({
+            "evidence_contains": ["urn:example:concept", "subject"],
+            "evidence_excludes": ["raw-source-value"],
+            "diagnostics_exclude": ["selector-value"]
+        });
+        let projection = serde_json::json!({
+            "subjectRoles": ["subject"],
+            "successfulValues": [{"providesValueFor": "urn:example:concept", "value": true}]
+        });
+        assert_eq!(
+            validate_privacy_projection(
+                expectation.as_object().expect("expectation object"),
+                &projection,
+            ),
+            Ok(())
+        );
+
+        let leaking = serde_json::json!({"value": "raw-source-value"});
+        assert!(validate_privacy_projection(
+            expectation.as_object().expect("expectation object"),
+            &leaking,
+        )
+        .is_err());
+
+        let leaking_key = serde_json::json!({"raw-source-value": false});
+        assert!(validate_privacy_projection(
+            expectation.as_object().expect("expectation object"),
+            &leaking_key,
+        )
+        .is_err());
+    }
+
+    #[test]
+    fn check_compiles_source_plans_without_resolving_secrets() {
+        let valid = std::str::from_utf8(include_bytes!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ))
+        .expect("fixture is UTF-8");
+        let valid_config = EvidenceConfig::parse_yaml(valid.as_bytes()).expect("config validates");
+        let outbound_tls = OutboundTlsConfig {
+            system_roots: true,
+            trust_profiles: Default::default(),
+        };
+        assert_eq!(
+            compile_source_plans_with_runtime(
+                &valid_config,
+                "/run/secrets/evidence",
+                &outbound_tls,
+                &Default::default(),
+            )
+            .map(|plans| plans.len()),
+            Ok(valid_config.sources.len())
+        );
+
+        let invalid = valid.replacen("timeoutMilliseconds: 3000", "timeoutMilliseconds: 0", 1);
+        assert_ne!(invalid, valid, "fixture mutation must remain effective");
+        let invalid_config: EvidenceConfig =
+            serde_norway::from_str(&invalid).expect("closed typed shape deserializes");
+        assert_eq!(
+            compile_source_plans_with_runtime(
+                &invalid_config,
+                "/run/secrets/evidence",
+                &outbound_tls,
+                &Default::default(),
+            )
+            .map(|_| ()),
+            Err(CliError("source plan compilation failed"))
+        );
+    }
+
+    fn test_audit_secret() -> AuditHashSecret {
+        AuditHashSecret::new(b"0123456789abcdef0123456789abcdef".to_vec())
+            .expect("audit secret builds")
+    }
+
+    fn test_audit_event(log: &EvidenceAuditLog) -> EvidenceAuditEvent {
+        EvidenceAuditEvent::new(
+            AssuranceProfile::EvidenceGrade,
+            "01K1EXAMPLE0000000000000000".to_owned(),
+            AuditPhase::AccessAttempt,
+            "urn:example:requirement:v1".to_owned(),
+            format!("sha256:{}", "0".repeat(64)),
+            "casework".to_owned(),
+            log.pseudonym("requester-v1", "urn:example:trust", b"principal-canary")
+                .expect("pseudonym builds"),
+            AuditAuthority {
+                kind: AuthorityKind::Statutory,
+                grant_pseudonym: None,
+            },
+            vec![AuditSubject {
+                role: "subject".to_owned(),
+                selector_profile: "person-v1".to_owned(),
+                selector_bundle_pseudonym: Some(
+                    log.pseudonym("subject-v1", "casework", b"selector-canary")
+                        .expect("pseudonym builds"),
+                ),
+            }],
+            ResponseProtection::Signed,
+            AuditDecision::Authorized,
+            5,
+        )
+    }
+
+    /// Change one byte of a record without changing its length, so the
+    /// record no longer matches the hash the chain recorded for it.
+    fn corrupt_audit_line(line: &str) -> String {
+        let mut bytes = line.as_bytes().to_vec();
+        for byte in bytes.iter_mut() {
+            if byte.is_ascii_lowercase() {
+                *byte = if *byte == b'z' { b'y' } else { *byte + 1 };
+                break;
+            }
+        }
+        String::from_utf8(bytes).expect("a corrupted record stays UTF-8")
+    }
+
+    #[tokio::test]
+    async fn verify_audit_reports_a_clean_multi_segment_chain() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        {
+            let log = EvidenceAuditLog::initialize(
+                &path,
+                2048,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .expect("audit initializes");
+            for _ in 0..48 {
+                log.append(test_audit_event(&log))
+                    .await
+                    .expect("event appends");
+            }
+        }
+        let segments = audit_segment_paths(&path).expect("segments enumerate");
+        assert!(
+            segments.len() >= 4,
+            "the fixture needs several sealed segments plus the active one"
+        );
+
+        let secret = test_audit_secret();
+        let summary =
+            verify_audit_chain(&path, &secret).expect("a clean multi-segment chain verifies");
+        assert_eq!(summary.records, 48);
+        assert_eq!(summary.segments, segments.len());
+        assert!(summary.active_verified);
+        assert_eq!(summary.first_sequence, Some(1));
+
+        assert!(verify_audit_with_secret(&path, &secret).is_ok());
+    }
+
+    /// Startup verification only replays the active segment; this pins the
+    /// counterpart it exists for: corruption planted in an already sealed
+    /// segment passes startup and is only caught by the out-of-band verifier.
+    #[tokio::test]
+    async fn verify_audit_fails_on_sealed_segment_corruption() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        {
+            let log = EvidenceAuditLog::initialize(
+                &path,
+                4096,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .expect("audit initializes");
+            for _ in 0..24 {
+                log.append(test_audit_event(&log))
+                    .await
+                    .expect("event appends");
+            }
+        }
+
+        let segments = audit_segment_paths(&path).expect("segments enumerate");
+        let oldest_sealed = segments[0].clone();
+        let contents = fs::read_to_string(&oldest_sealed).expect("sealed segment reads");
+        let mut lines: Vec<String> = contents.lines().map(str::to_owned).collect();
+        assert!(
+            lines.len() > 1,
+            "the corrupted record must not be the sealed tail"
+        );
+        lines[0] = corrupt_audit_line(&lines[0]);
+        let mut rewritten = lines.join("\n");
+        rewritten.push('\n');
+        fs::write(&oldest_sealed, rewritten).expect("segment rewrites");
+
+        let restarted = EvidenceAuditLog::initialize(
+            &path,
+            4096,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("startup does not replay sealed history");
+        assert!(restarted.ready().await);
+        drop(restarted);
+
+        assert!(
+            verify_audit_with_secret(&path, &test_audit_secret()).is_err(),
+            "the out-of-band verifier must catch sealed-segment corruption"
+        );
+    }
+
+    /// A gap in sealed history is an operator archiving a segment, not
+    /// tampering, so it must be reported by sequence rather than folded into
+    /// the generic corruption message.
+    #[tokio::test]
+    async fn verify_audit_reports_an_archived_segment_as_missing_not_corrupt() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        {
+            let log = EvidenceAuditLog::initialize(
+                &path,
+                2048,
+                b"0123456789abcdef0123456789abcdef".to_vec(),
+                1,
+            )
+            .await
+            .expect("audit initializes");
+            for _ in 0..48 {
+                log.append(test_audit_event(&log))
+                    .await
+                    .expect("event appends");
+            }
+        }
+        let segments = audit_segment_paths(&path).expect("segments enumerate");
+        assert!(
+            segments.len() >= 4,
+            "the fixture needs a sealed segment that is neither first nor last"
+        );
+        fs::remove_file(&segments[1]).expect("a middle segment is archived away");
+
+        let error = verify_audit_chain(&path, &test_audit_secret())
+            .expect_err("a gap in sealed history must fail verification");
+        let sequence = match &error {
+            EvidenceAuditError::SegmentMissing { sequence } => *sequence,
+            other => panic!("expected a missing-segment error, got {other:?}"),
+        };
+        assert_eq!(sequence, 2);
+
+        let (detail, _) = audit_verification_failure(error);
+        assert!(
+            detail.contains(&format!("segment {sequence}"))
+                && detail.contains("archived or missing"),
+            "the report must name the sequence and describe archival: {detail}"
+        );
+        assert!(
+            detail.contains("not corruption"),
+            "the report must state plainly that this is not corruption: {detail}"
+        );
+
+        assert!(verify_audit_with_secret(&path, &test_audit_secret()).is_err());
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn offline_cli_evaluates_every_coequal_acceptance_fixture() {
+        for definition in [
+            "adult-status",
+            "residence-region",
+            "professional-licence",
+            "legal-parent-relationship",
+        ] {
+            let directory = tempfile::tempdir().expect("temporary bundle");
+            let source = Path::new(env!("CARGO_MANIFEST_DIR"))
+                .join("../../products/evidence/fixtures/acceptance")
+                .join(definition);
+            copy_tree(&source, directory.path());
+            set_tree_mode(directory.path(), 0o555, 0o444);
+
+            let bundle = Arc::new(Bundle::load(directory.path()).expect("acceptance bundle loads"));
+            let kernel = OfflineKernel::compile(Arc::clone(&bundle)).expect("kernel compiles");
+            let source_plans = compile_source_plans_with_runtime(
+                &bundle.config,
+                "/run/secrets/evidence",
+                &OutboundTlsConfig {
+                    system_roots: true,
+                    trust_profiles: Default::default(),
+                },
+                &Default::default(),
+            )
+            .expect("source plans compile");
+            let fixture = Path::new(
+                bundle.config.requirements[0]
+                    .fixtures
+                    .as_ref()
+                    .expect("acceptance fixture is declared")
+                    .as_str(),
+            );
+            let expected_cases = bundle.fixtures[fixture.to_str().expect("fixture path")]
+                .get("cases")
+                .and_then(serde_norway::Value::as_sequence)
+                .expect("cases")
+                .len();
+            assert_eq!(
+                evaluate_fixture(&bundle, &kernel, &source_plans, fixture).await,
+                Ok(FixtureSummary {
+                    evaluated_cases: expected_cases,
+                }),
+                "{definition}"
+            );
+
+            set_tree_mode(directory.path(), 0o755, 0o444);
+        }
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn offline_cli_evaluates_the_combined_acceptance_bundle() {
+        let directory = tempfile::tempdir().expect("temporary bundle");
+        let source = Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("../../products/evidence/fixtures/acceptance/all-definitions");
+        copy_tree(&source, directory.path());
+        set_tree_mode(directory.path(), 0o555, 0o444);
+
+        let bundle = Arc::new(Bundle::load(directory.path()).expect("acceptance bundle loads"));
+        let kernel = OfflineKernel::compile(Arc::clone(&bundle)).expect("kernel compiles");
+        let source_plans = compile_source_plans_with_runtime(
+            &bundle.config,
+            "/run/secrets/evidence",
+            &OutboundTlsConfig {
+                system_roots: true,
+                trust_profiles: Default::default(),
+            },
+            &Default::default(),
+        )
+        .expect("source plans compile");
+        for requirement in &bundle.config.requirements {
+            let fixture = Path::new(
+                requirement
+                    .fixtures
+                    .as_ref()
+                    .expect("acceptance fixture is declared")
+                    .as_str(),
+            );
+            assert!(
+                evaluate_fixture(&bundle, &kernel, &source_plans, fixture)
+                    .await
+                    .is_ok(),
+                "combined acceptance fixture failed"
+            );
+        }
+
+        set_tree_mode(directory.path(), 0o755, 0o444);
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn offline_cli_evaluates_every_reference_deployment_fixture() {
+        for project in [
+            "dhis2-tracker-evidence",
+            "opencrvs-family-evidence",
+            "relay-protected-read-evidence",
+        ] {
+            let directory = tempfile::tempdir().expect("temporary bundle");
+            let source = Path::new(env!("CARGO_MANIFEST_DIR"))
+                .join("../../products/evidence/reference/request-adapter/deployment-projects")
+                .join(project)
+                .join("bundle");
+            copy_tree(&source, directory.path());
+            set_tree_mode(directory.path(), 0o555, 0o444);
+
+            let bundle = Arc::new(Bundle::load(directory.path()).expect("reference bundle loads"));
+            let kernel = OfflineKernel::compile(Arc::clone(&bundle)).expect("kernel compiles");
+            let outbound_tls: OutboundTlsConfig = if project == "dhis2-tracker-evidence" {
+                serde_norway::from_str(
+                    "systemRoots: true\ntrustProfiles:\n  government-internal-pki:\n    caBundleFile: /etc/registry-evidence/ca/government-internal.pem\n",
+                )
+                .expect("private TLS profile parses")
+            } else {
+                OutboundTlsConfig {
+                    system_roots: true,
+                    trust_profiles: Default::default(),
+                }
+            };
+            let ca_bundles = if project == "dhis2-tracker-evidence" {
+                let certificate =
+                    rcgen::generate_simple_self_signed(
+                        vec!["tracker.dhis2.gov.example".to_owned()],
+                    )
+                    .expect("generate private TLS root");
+                let certificate = test_certificate_pem(certificate.cert.der().as_ref());
+                BTreeMap::from([("government-internal-pki".to_owned(), certificate)])
+            } else {
+                BTreeMap::new()
+            };
+            let source_plans = compile_source_plans_with_runtime(
+                &bundle.config,
+                "/run/secrets/evidence",
+                &outbound_tls,
+                &ca_bundles,
+            )
+            .expect("source plans compile");
+            for requirement in &bundle.config.requirements {
+                let fixture_path = requirement
+                    .fixtures
+                    .as_ref()
+                    .expect("reference fixture is declared");
+                let fixture = Path::new(fixture_path.as_str());
+                let expected_cases = bundle.fixtures[fixture_path.as_str()]
+                    .get("cases")
+                    .and_then(serde_norway::Value::as_sequence)
+                    .expect("cases")
+                    .len();
+                assert_eq!(
+                    evaluate_fixture(&bundle, &kernel, &source_plans, fixture).await,
+                    Ok(FixtureSummary {
+                        evaluated_cases: expected_cases,
+                    }),
+                    "{project}/{}",
+                    requirement.id
+                );
+            }
+
+            set_tree_mode(directory.path(), 0o755, 0o444);
+        }
+    }
+
+    #[cfg(unix)]
+    fn copy_tree(source: &Path, destination: &Path) {
+        fs::create_dir_all(destination).expect("create destination");
+        for entry in fs::read_dir(source).expect("read source tree") {
+            let entry = entry.expect("source entry");
+            let target = destination.join(entry.file_name());
+            if entry.file_type().expect("source type").is_dir() {
+                copy_tree(&entry.path(), &target);
+            } else {
+                fs::copy(entry.path(), target).expect("copy artifact");
+            }
+        }
+    }
+
+    #[cfg(unix)]
+    fn set_tree_mode(path: &Path, directory_mode: u32, file_mode: u32) {
+        use std::os::unix::fs::PermissionsExt as _;
+        let metadata = fs::symlink_metadata(path).expect("tree metadata");
+        if metadata.is_dir() {
+            for entry in fs::read_dir(path).expect("read tree") {
+                set_tree_mode(
+                    &entry.expect("tree entry").path(),
+                    directory_mode,
+                    file_mode,
+                );
+            }
+            fs::set_permissions(path, fs::Permissions::from_mode(directory_mode))
+                .expect("set directory mode");
+        } else {
+            fs::set_permissions(path, fs::Permissions::from_mode(file_mode))
+                .expect("set file mode");
+        }
+    }
+
+    #[cfg(unix)]
+    fn test_certificate_pem(der: &[u8]) -> Vec<u8> {
+        use base64::{engine::general_purpose::STANDARD, Engine as _};
+
+        let encoded = STANDARD.encode(der);
+        let mut pem = String::from("-----BEGIN CERTIFICATE-----\n");
+        for line in encoded.as_bytes().chunks(64) {
+            pem.push_str(std::str::from_utf8(line).expect("base64 is UTF-8"));
+            pem.push('\n');
+        }
+        pem.push_str("-----END CERTIFICATE-----\n");
+        pem.into_bytes()
+    }
+}
diff --git a/crates/registry-evidence/src/model.rs b/crates/registry-evidence/src/model.rs
new file mode 100644
index 000000000..edb517324
--- /dev/null
+++ b/crates/registry-evidence/src/model.rs
@@ -0,0 +1,694 @@
+use std::{collections::BTreeMap, fmt};
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use schemars::JsonSchema;
+use serde::{de, Deserialize, Deserializer, Serialize};
+use serde_json::{Number, Value};
+use utoipa::ToSchema;
+
+use crate::config::AssuranceProfile;
+
+/// Exact encoded length of the required caller-generated request nonce: the
+/// canonical unpadded base64url form of 32 random bytes.
+pub const REQUEST_NONCE_ENCODED_LENGTH: usize = 43;
+const REQUEST_NONCE_DECODED_LENGTH: usize = 32;
+
+/// Deterministic canonical nonce for offline fixture evaluation and internal
+/// non-released request shapes. Real callers generate a fresh random value
+/// for every request.
+pub const OFFLINE_EVALUATION_REQUEST_NONCE: &str = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+
+/// Accept only the canonical 43-character unpadded base64url encoding of
+/// exactly 32 bytes. Padding, wrong length, non-alphabet bytes, and a
+/// noncanonical final symbol all fail.
+pub fn request_nonce_is_canonical(nonce: &str) -> bool {
+    if nonce.len() != REQUEST_NONCE_ENCODED_LENGTH
+        || !nonce
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'))
+    {
+        return false;
+    }
+    match URL_SAFE_NO_PAD.decode(nonce) {
+        Ok(decoded) => decoded.len() == REQUEST_NONCE_DECODED_LENGTH,
+        Err(_) => false,
+    }
+}
+
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct EvidenceRequest {
+    /// Uninterpreted caller-generated correlation nonce. It is echoed into the
+    /// Evidence payload and never reaches authorization, rate limits, Rhai,
+    /// source requests, logs, metrics, traces, or native audit.
+    pub request_nonce: String,
+    pub requirement: String,
+    pub purpose: String,
+    /// Unordered role set encoded as an array. Roles are resolved by name and
+    /// canonicalized to requirement declaration order.
+    pub subjects: Vec<RequestedSubject>,
+    /// Optional holder public key echoed into the SD-JWT VC `cnf` claim. It is
+    /// meaningful only for the SD-JWT VC response format, never reaches
+    /// authorization, selectors, Rhai, source requests, or audit, and never
+    /// appears in the signed-JWS payload.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub holder_key: Option<HolderPublicKey>,
+}
+
+/// Caller-supplied Ed25519 holder public key. `deny_unknown_fields` is the
+/// primary defence against private key members: a body carrying `d` or any
+/// other unexpected member fails to parse.
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(deny_unknown_fields)]
+pub struct HolderPublicKey {
+    pub kty: String,
+    pub crv: String,
+    pub x: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub alg: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub kid: Option<String>,
+}
+
+/// Exact byte length of a raw Ed25519 public key.
+const HOLDER_KEY_DECODED_LENGTH: usize = 32;
+const MAX_HOLDER_KEY_ID_BYTES: usize = 256;
+
+impl HolderPublicKey {
+    /// Accept only a public OKP Ed25519 JWK whose coordinate is the canonical
+    /// unpadded base64url encoding of exactly 32 bytes.
+    pub fn is_acceptable(&self) -> bool {
+        if self.kty != "OKP" || self.crv != "Ed25519" {
+            return false;
+        }
+        if self.alg.as_deref().is_some_and(|alg| alg != "EdDSA") {
+            return false;
+        }
+        if self
+            .kid
+            .as_deref()
+            .is_some_and(|kid| kid.is_empty() || kid.len() > MAX_HOLDER_KEY_ID_BYTES)
+        {
+            return false;
+        }
+        URL_SAFE_NO_PAD
+            .decode(&self.x)
+            .is_ok_and(|decoded| decoded.len() == HOLDER_KEY_DECODED_LENGTH)
+    }
+}
+
+/// Requester-scoped descriptions of the exact Evidence request shapes that
+/// the authenticated caller can currently invoke.
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct EvidenceDefinitions {
+    pub schema: String,
+    pub assurance_profile: AssuranceProfile,
+    pub configuration_revision: String,
+    pub issued_by: String,
+    pub provided_by: String,
+    pub definitions: Vec<EvidenceDefinition>,
+}
+
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct EvidenceDefinition {
+    pub requirement: String,
+    pub kind: String,
+    pub evidence_type: String,
+    pub purpose: String,
+    pub reference_frameworks: Vec<String>,
+    pub subjects: Vec<EvidenceDefinitionSubject>,
+    pub concepts: Vec<EvidenceDefinitionConcept>,
+}
+
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(deny_unknown_fields)]
+pub struct EvidenceDefinitionSubject {
+    pub role: String,
+    pub cardinality: String,
+    pub selector: EvidenceDefinitionSelector,
+}
+
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct EvidenceDefinitionSelector {
+    pub profile: String,
+    pub value_origin: String,
+    pub fields: Vec<EvidenceSelectorField>,
+}
+
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct EvidenceDefinitionConcept {
+    pub id: String,
+    pub form: String,
+}
+
+/// Public validation metadata for a selector field. Controlled-code
+/// definitions expose their governed scheme identity, never the bundle path or
+/// the configured list of supported values.
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(tag = "type", rename_all = "kebab-case", deny_unknown_fields)]
+pub enum EvidenceSelectorField {
+    String {
+        name: String,
+        #[serde(rename = "minimumBytes")]
+        minimum_bytes: u64,
+        #[serde(rename = "maximumBytes")]
+        maximum_bytes: u64,
+    },
+    Date {
+        name: String,
+    },
+    Integer {
+        name: String,
+        minimum: i64,
+        maximum: i64,
+    },
+    Boolean {
+        name: String,
+    },
+    ControlledCode {
+        name: String,
+        scheme: String,
+        version: String,
+        #[serde(rename = "maximumBytes")]
+        maximum_bytes: u64,
+    },
+}
+
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(deny_unknown_fields)]
+pub struct RequestedSubject {
+    pub role: String,
+    pub selector: RequestedSelector,
+}
+
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(deny_unknown_fields)]
+pub struct RequestedSelector {
+    pub profile: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub values: Option<BTreeMap<String, SelectorValue>>,
+}
+
+#[derive(Clone, PartialEq, Eq, Serialize, JsonSchema, ToSchema)]
+#[serde(untagged)]
+pub enum SelectorValue {
+    String(String),
+    Integer(i64),
+    Boolean(bool),
+}
+
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Evidence {
+    pub schema: String,
+    pub assurance_profile: AssuranceProfile,
+    /// Exact echo of the caller's request nonce for request-response
+    /// correlation. The runtime does not store it or reject reuse.
+    pub request_nonce: String,
+    pub id: String,
+    #[serde(rename = "type")]
+    pub evidence_type_name: EvidenceObjectType,
+    pub supports_requirement: String,
+    pub is_conformant_to: String,
+    pub issued_by: String,
+    pub provided_by: String,
+    pub issued_at: String,
+    pub observed_at: String,
+    pub valid_until: String,
+    pub purpose: String,
+    pub audience: String,
+    pub configuration_revision: String,
+    pub subjects: Vec<SubjectBinding>,
+    pub supported_values: Vec<SupportedValue>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+pub enum EvidenceObjectType {
+    Evidence,
+}
+
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(deny_unknown_fields)]
+pub struct SubjectBinding {
+    pub role: String,
+    pub binding: String,
+}
+
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct SupportedValue {
+    pub provides_value_for: String,
+    pub value: PublicValue,
+}
+
+#[derive(Clone, PartialEq, Eq, Serialize, JsonSchema, ToSchema)]
+#[serde(untagged)]
+pub enum PublicValue {
+    Boolean(bool),
+    Integer(i64),
+    String(String),
+    Bucket(BucketValue),
+    EntityReference(EntityReferenceValue),
+    Structured(StructuredValue),
+    List(Vec<ScalarOrEntityReference>),
+}
+
+impl<'de> Deserialize<'de> for SelectorValue {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        match Value::deserialize(deserializer)? {
+            Value::String(value) => Ok(Self::String(value)),
+            Value::Number(value) => safe_json_integer(&value)
+                .map(Self::Integer)
+                .ok_or_else(|| de::Error::custom("selector number is not a safe JSON integer")),
+            Value::Bool(value) => Ok(Self::Boolean(value)),
+            _ => Err(de::Error::custom("selector value is not a scalar")),
+        }
+    }
+}
+
+impl<'de> Deserialize<'de> for PublicValue {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let value = Value::deserialize(deserializer)?;
+        match value {
+            Value::Bool(value) => Ok(Self::Boolean(value)),
+            Value::Number(value) => safe_json_integer(&value)
+                .map(Self::Integer)
+                .ok_or_else(|| de::Error::custom("public number is not a safe JSON integer")),
+            Value::String(value) => Ok(Self::String(value)),
+            Value::Array(values) => serde_json::from_value(Value::Array(values))
+                .map(Self::List)
+                .map_err(de::Error::custom),
+            Value::Object(object) => {
+                let form = object
+                    .get("form")
+                    .and_then(Value::as_str)
+                    .map(str::to_owned);
+                let value = Value::Object(object);
+                match form.as_deref() {
+                    Some("date-bucket" | "time-bucket") => serde_json::from_value(value)
+                        .map(Self::Bucket)
+                        .map_err(de::Error::custom),
+                    Some("audience-scoped-entity-reference") => serde_json::from_value(value)
+                        .map(Self::EntityReference)
+                        .map_err(de::Error::custom),
+                    Some("reviewed-structured-value") => serde_json::from_value(value)
+                        .map(Self::Structured)
+                        .map_err(de::Error::custom),
+                    _ => Err(de::Error::custom("public object has an unsupported form")),
+                }
+            }
+            Value::Null => Err(de::Error::custom("public value cannot be null")),
+        }
+    }
+}
+
+fn safe_json_integer(number: &Number) -> Option<i64> {
+    const MAX_SAFE_INTEGER: i64 = 9_007_199_254_740_991;
+
+    if let Some(value) = number.as_i64() {
+        return (-MAX_SAFE_INTEGER..=MAX_SAFE_INTEGER)
+            .contains(&value)
+            .then_some(value);
+    }
+    if let Some(value) = number.as_u64() {
+        return (value <= MAX_SAFE_INTEGER as u64).then_some(value as i64);
+    }
+    let value = number.as_f64()?;
+    (value.is_finite()
+        && value.fract() == 0.0
+        && value >= -(MAX_SAFE_INTEGER as f64)
+        && value <= MAX_SAFE_INTEGER as f64)
+        .then_some(value as i64)
+}
+
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(untagged)]
+pub enum ScalarOrEntityReference {
+    String(String),
+    EntityReference(EntityReferenceValue),
+}
+
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(deny_unknown_fields)]
+pub struct BucketValue {
+    pub form: BucketForm,
+    pub scheme: String,
+    pub bucket: String,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(rename_all = "kebab-case")]
+pub enum BucketForm {
+    DateBucket,
+    TimeBucket,
+}
+
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(deny_unknown_fields)]
+pub struct EntityReferenceValue {
+    pub form: EntityReferenceForm,
+    pub reference: String,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(rename_all = "kebab-case")]
+pub enum EntityReferenceForm {
+    AudienceScopedEntityReference,
+}
+
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(deny_unknown_fields)]
+pub struct StructuredValue {
+    pub form: StructuredValueForm,
+    pub schema: String,
+    pub fields: BTreeMap<String, Value>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(rename_all = "kebab-case")]
+pub enum StructuredValueForm {
+    ReviewedStructuredValue,
+}
+
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(deny_unknown_fields)]
+pub struct FlattenedJws {
+    pub protected: String,
+    pub payload: String,
+    pub signature: String,
+}
+
+/// Self-identifying unsigned response envelope. It deliberately does not
+/// serialize as the signed Evidence payload by itself and carries no JWS
+/// member, so the strict JWS verifier rejects it.
+#[derive(Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct UnsignedEvidenceEnvelope {
+    pub schema: String,
+    #[serde(rename = "type")]
+    pub envelope_type: UnsignedEnvelopeType,
+    pub integrity_protection: UnsignedIntegrityProtection,
+    pub warning: UnsignedEnvelopeWarning,
+    pub evidence: Evidence,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+pub enum UnsignedEnvelopeType {
+    UnsignedEvidenceEnvelope,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(rename_all = "kebab-case")]
+pub enum UnsignedIntegrityProtection {
+    None,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(rename_all = "kebab-case")]
+pub enum UnsignedEnvelopeWarning {
+    NotCryptographicallyVerifiable,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(deny_unknown_fields)]
+pub struct JwksDocument {
+    pub keys: Vec<Value>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema, ToSchema)]
+#[serde(deny_unknown_fields)]
+pub struct ProblemBody {
+    #[serde(rename = "type")]
+    pub type_uri: String,
+    pub title: String,
+    pub status: u16,
+    pub code: String,
+    pub operation: String,
+}
+
+#[derive(Clone, PartialEq)]
+pub enum LookupResult {
+    Match(BTreeMap<String, Value>),
+    NoMatch,
+    Ambiguous,
+}
+
+macro_rules! redacted_debug {
+    ($($type_name:ty),+ $(,)?) => {
+        $(
+            impl fmt::Debug for $type_name {
+                fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+                    formatter
+                        .debug_struct(stringify!($type_name))
+                        .field("protected", &"<redacted>")
+                        .finish()
+                }
+            }
+        )+
+    };
+}
+
+redacted_debug!(
+    EvidenceRequest,
+    HolderPublicKey,
+    EvidenceDefinitions,
+    EvidenceDefinition,
+    EvidenceDefinitionSubject,
+    EvidenceDefinitionSelector,
+    EvidenceDefinitionConcept,
+    EvidenceSelectorField,
+    RequestedSubject,
+    RequestedSelector,
+    SelectorValue,
+    Evidence,
+    SubjectBinding,
+    SupportedValue,
+    PublicValue,
+    ScalarOrEntityReference,
+    BucketValue,
+    EntityReferenceValue,
+    StructuredValue,
+    FlattenedJws,
+    UnsignedEvidenceEnvelope,
+    LookupResult,
+);
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn schema_integer_lexical_forms_canonicalize_to_safe_i64() {
+        for input in ["1", "1.0", "1e0"] {
+            assert_eq!(
+                serde_json::from_str::<SelectorValue>(input).expect("selector integer parses"),
+                SelectorValue::Integer(1)
+            );
+            let public = serde_json::from_str::<PublicValue>(input).expect("public integer parses");
+            assert_eq!(public, PublicValue::Integer(1));
+            assert_eq!(
+                serde_json::to_string(&public).expect("integer serializes"),
+                "1"
+            );
+        }
+        for input in ["1.5", "9007199254740992", "-9007199254740992"] {
+            assert!(serde_json::from_str::<SelectorValue>(input).is_err());
+            assert!(serde_json::from_str::<PublicValue>(input).is_err());
+        }
+    }
+
+    #[test]
+    fn request_rejects_query_material_and_unknown_fields() {
+        let input = serde_json::json!({
+            "requestNonce": "A".repeat(43),
+            "requirement": "urn:example:requirement:v1",
+            "purpose": "casework",
+            "subjects": [{
+                "role": "subject",
+                "selector": {"profile": "profile-v1", "values": {"opaque": "value"}}
+            }],
+            "threshold": 18
+        });
+        assert!(serde_json::from_value::<EvidenceRequest>(input).is_err());
+
+        let caller_grant_reference = serde_json::json!({
+            "requestNonce": "A".repeat(43),
+            "requirement": "urn:example:requirement:v1",
+            "purpose": "casework",
+            "grantId": "caller-selected-grant",
+            "grantAuthority": "caller-selected-authority",
+            "subjects": [{
+                "role": "subject",
+                "selector": {"profile": "profile-v1", "values": {"opaque": "value"}}
+            }]
+        });
+        assert!(serde_json::from_value::<EvidenceRequest>(caller_grant_reference).is_err());
+
+        let missing_nonce = serde_json::json!({
+            "requirement": "urn:example:requirement:v1",
+            "purpose": "casework",
+            "subjects": [{
+                "role": "subject",
+                "selector": {"profile": "profile-v1", "values": {"opaque": "value"}}
+            }]
+        });
+        assert!(serde_json::from_value::<EvidenceRequest>(missing_nonce).is_err());
+    }
+
+    #[test]
+    fn request_nonce_canonicality_is_exact() {
+        assert!(request_nonce_is_canonical(
+            "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I"
+        ));
+        assert!(request_nonce_is_canonical(&"A".repeat(43)));
+
+        let noncanonical_final_symbol = format!("{}B", "A".repeat(42));
+        for invalid in [
+            "",
+            "short",
+            &"A".repeat(42),
+            &"A".repeat(44),
+            &format!("{}=", "A".repeat(42)),
+            &format!("{}+", "A".repeat(42)),
+            &format!("{}/", "A".repeat(42)),
+            &format!("{} ", "A".repeat(42)),
+            &format!("{}\u{e9}", "A".repeat(42)),
+            noncanonical_final_symbol.as_str(),
+        ] {
+            assert!(!request_nonce_is_canonical(invalid), "{invalid:?}");
+        }
+    }
+
+    #[test]
+    fn evidence_has_no_selector_echo_field() {
+        let serialized = serde_json::to_value(Evidence {
+            schema: crate::EVIDENCE_SCHEMA_V1.to_string(),
+            assurance_profile: AssuranceProfile::EvidenceGrade,
+            request_nonce: "A".repeat(43),
+            id: "urn:ulid:01K1EXAMPLE0000000000000000".to_string(),
+            evidence_type_name: EvidenceObjectType::Evidence,
+            supports_requirement: "urn:example:requirement:v1".to_string(),
+            is_conformant_to: "urn:example:evidence-type:v1".to_string(),
+            issued_by: "urn:example:issuer".to_string(),
+            provided_by: "urn:example:provider".to_string(),
+            issued_at: "2026-08-02T00:00:00Z".to_string(),
+            observed_at: "2026-08-02T00:00:00Z".to_string(),
+            valid_until: "2026-08-03T00:00:00Z".to_string(),
+            purpose: "casework".to_string(),
+            audience: "urn:example:audience".to_string(),
+            configuration_revision: format!("sha256:{}", "0".repeat(64)),
+            subjects: vec![SubjectBinding {
+                role: "subject".to_string(),
+                binding: format!("urn:evidence:subject:v1_{}", "a".repeat(43)),
+            }],
+            supported_values: vec![SupportedValue {
+                provides_value_for: "urn:example:concept".to_string(),
+                value: PublicValue::Boolean(true),
+            }],
+        })
+        .expect("evidence serializes");
+        let text = serialized.to_string();
+        assert!(!text.contains("selector"));
+        assert!(!text.contains("opaque"));
+    }
+
+    #[test]
+    fn debug_surfaces_redact_requests_facts_disclosures_and_signed_payloads() {
+        let request = EvidenceRequest {
+            request_nonce: "protected-request-nonce-canary".to_owned(),
+            requirement: "urn:example:protected-requirement-canary".to_owned(),
+            purpose: "protected-purpose-canary".to_owned(),
+            subjects: vec![RequestedSubject {
+                role: "subject".to_owned(),
+                selector: RequestedSelector {
+                    profile: "protected-profile-canary".to_owned(),
+                    values: Some(BTreeMap::from([(
+                        "protected-field-canary".to_owned(),
+                        SelectorValue::String("protected-selector-canary".to_owned()),
+                    )])),
+                },
+            }],
+            holder_key: None,
+        };
+        let evidence = Evidence {
+            schema: "protected-schema-canary".to_owned(),
+            assurance_profile: AssuranceProfile::EvidenceGrade,
+            request_nonce: "protected-request-nonce-canary".to_owned(),
+            id: "protected-evidence-id-canary".to_owned(),
+            evidence_type_name: EvidenceObjectType::Evidence,
+            supports_requirement: "protected-requirement-canary".to_owned(),
+            is_conformant_to: "protected-evidence-type-canary".to_owned(),
+            issued_by: "protected-issuer-canary".to_owned(),
+            provided_by: "protected-provider-canary".to_owned(),
+            issued_at: "2026-08-02T00:00:00Z".to_owned(),
+            observed_at: "2026-08-02T00:00:00Z".to_owned(),
+            valid_until: "2026-08-03T00:00:00Z".to_owned(),
+            purpose: "protected-purpose-canary".to_owned(),
+            audience: "protected-audience-canary".to_owned(),
+            configuration_revision: "protected-revision-canary".to_owned(),
+            subjects: vec![SubjectBinding {
+                role: "subject".to_owned(),
+                binding: "protected-binding-canary".to_owned(),
+            }],
+            supported_values: vec![SupportedValue {
+                provides_value_for: "protected-concept-canary".to_owned(),
+                value: PublicValue::String("protected-supported-value-canary".to_owned()),
+            }],
+        };
+        let lookup = LookupResult::Match(BTreeMap::from([(
+            "protected-fact-name-canary".to_owned(),
+            serde_json::json!("protected-fact-value-canary"),
+        )]));
+        let signed = FlattenedJws {
+            protected: "protected-header-canary".to_owned(),
+            payload: "protected-payload-canary".to_owned(),
+            signature: "protected-signature-canary".to_owned(),
+        };
+        let definitions = EvidenceDefinitions {
+            schema: "protected-discovery-schema-canary".to_owned(),
+            assurance_profile: AssuranceProfile::EvidenceGrade,
+            configuration_revision: "protected-discovery-revision-canary".to_owned(),
+            issued_by: "protected-discovery-issuer-canary".to_owned(),
+            provided_by: "protected-discovery-provider-canary".to_owned(),
+            definitions: Vec::new(),
+        };
+
+        let unsigned_envelope = UnsignedEvidenceEnvelope {
+            schema: crate::EVIDENCE_UNSIGNED_ENVELOPE_SCHEMA_V1.to_owned(),
+            envelope_type: UnsignedEnvelopeType::UnsignedEvidenceEnvelope,
+            integrity_protection: UnsignedIntegrityProtection::None,
+            warning: UnsignedEnvelopeWarning::NotCryptographicallyVerifiable,
+            evidence: evidence.clone(),
+        };
+
+        for diagnostic in [
+            format!("{request:?}"),
+            format!("{definitions:?}"),
+            format!("{unsigned_envelope:?}"),
+            format!(
+                "{:?}",
+                SelectorValue::String("protected-selector-canary".to_owned())
+            ),
+            format!("{evidence:?}"),
+            format!(
+                "{:?}",
+                PublicValue::String("protected-supported-value-canary".to_owned())
+            ),
+            format!("{lookup:?}"),
+            format!("{signed:?}"),
+        ] {
+            assert!(diagnostic.contains("<redacted>"));
+            assert!(!diagnostic.contains("canary"));
+        }
+    }
+}
diff --git a/crates/registry-evidence/src/observability.rs b/crates/registry-evidence/src/observability.rs
new file mode 100644
index 000000000..bbd33fe3a
--- /dev/null
+++ b/crates/registry-evidence/src/observability.rs
@@ -0,0 +1,708 @@
+//! Version 1 operational telemetry for the Evidence HTTP boundary.
+//!
+//! Operational records describe service health and performance only. The
+//! reviewed field set is route template, operation identifier, duration,
+//! status category, and safe internal error category; request bodies, selector
+//! profiles or values, source responses, Supported Values, credentials,
+//! tokens, authority grants, and script inputs are outside it. Both the log
+//! record and the metric series below are built from that same closed set, so
+//! neither can widen without a review of this module.
+
+use std::{
+    collections::BTreeMap,
+    sync::{
+        atomic::{AtomicU64, AtomicUsize, Ordering},
+        Arc, Mutex,
+    },
+    time::{Duration, Instant},
+};
+
+use axum::{
+    body::Body,
+    extract::{MatchedPath, State},
+    http::{header::CONTENT_TYPE, HeaderName, HeaderValue, Method, Request, StatusCode},
+    middleware::Next,
+    response::{IntoResponse, Response},
+    routing::get,
+    Router,
+};
+use ulid::Ulid;
+
+use crate::{
+    audit::{AuditStorageUsage, EvidenceAuditLog},
+    problem::ProblemCode,
+    rate_limit::EvidenceRateLimiter,
+};
+
+/// Correlation identifier returned to the caller on every response.
+///
+/// Requests carry no inbound correlation value: the listener contract fixes
+/// `trustProxyIdentityHeaders` to false, so a client-supplied identifier would
+/// let a caller choose the key its own records are filed under.
+pub(crate) const CORRELATION_HEADER: &str = "x-request-id";
+
+/// Target of the per-request operational record.
+pub(crate) const REQUEST_LOG_TARGET: &str = "registry_evidence::request";
+
+/// Route label used when no route template matched the request.
+const UNMATCHED_ROUTE: &str = "unmatched";
+
+/// Error label used when a response carries no problem code.
+const NO_ERROR: &str = "none";
+
+const METRICS_MEDIA_TYPE: &str = "text/plain; version=0.0.4";
+
+/// Upper bounds, in seconds, of the request duration histogram.
+const DURATION_BUCKETS: [f64; 9] = [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1.0, 5.0];
+
+/// The request-scoped correlation identifier, minted once at the boundary.
+///
+/// Handlers read it from the request extensions rather than minting their own,
+/// so the problem body, the audit record, the operational log record, and the
+/// response header all name the same operation.
+#[derive(Clone)]
+pub(crate) struct OperationId(Arc<str>);
+
+impl OperationId {
+    fn new() -> Self {
+        Self(Ulid::new().to_string().into())
+    }
+
+    pub(crate) fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+/// Read the boundary-minted identifier for this request.
+///
+/// The observation layer wraps every route including both fallbacks, so the
+/// extension is always present. A handler reached without one would otherwise
+/// report an operation that correlates with nothing, so the missing case mints
+/// a fresh identifier rather than reporting an empty one.
+pub(crate) fn operation_id(extensions: &axum::http::Extensions) -> String {
+    extensions.get::<OperationId>().map_or_else(
+        || OperationId::new().as_str().to_owned(),
+        |id| id.0.to_string(),
+    )
+}
+
+/// Coarse outcome class. Operational records report the class, never the exact
+/// status, because the exact status of a denial is part of the closed public
+/// problem contract rather than an operational signal.
+#[derive(Clone, Copy)]
+enum StatusCategory {
+    Success,
+    ClientError,
+    ServerError,
+}
+
+impl StatusCategory {
+    fn of(status: StatusCode) -> Self {
+        if status.is_server_error() {
+            Self::ServerError
+        } else if status.is_client_error() {
+            Self::ClientError
+        } else {
+            Self::Success
+        }
+    }
+
+    const fn as_str(self) -> &'static str {
+        match self {
+            Self::Success => "success",
+            Self::ClientError => "client_error",
+            Self::ServerError => "server_error",
+        }
+    }
+}
+
+/// Observe one request: mint its identifier, serve it, then publish the
+/// reviewed operational fields to the log and the metric registry.
+pub(crate) async fn observe(
+    State(metrics): State<Arc<Metrics>>,
+    mut request: Request<Body>,
+    next: Next,
+) -> Response {
+    let operation = OperationId::new();
+    let route = route_template(&request);
+    let method = normalized_method(request.method());
+    request.extensions_mut().insert(operation.clone());
+
+    let started = Instant::now();
+    let mut response = next.run(request).await;
+    let elapsed = started.elapsed();
+
+    let status = StatusCategory::of(response.status());
+    let error = response
+        .extensions()
+        .get::<ProblemCode>()
+        .map_or(NO_ERROR, |code| code.code());
+    response.headers_mut().insert(
+        HeaderName::from_static(CORRELATION_HEADER),
+        HeaderValue::from_str(operation.as_str())
+            .expect("a Crockford base32 identifier is a valid header value"),
+    );
+
+    metrics.record(route, method, status, error, elapsed);
+    tracing::info!(
+        target: REQUEST_LOG_TARGET,
+        route,
+        operation = operation.as_str(),
+        duration_ms = duration_milliseconds(elapsed),
+        status = status.as_str(),
+        error,
+        "evidence request served"
+    );
+    response
+}
+
+/// Resolve the matched route template.
+///
+/// Only templates the router registered are reported. An unrouted request
+/// reports a single fixed label rather than its requested path, which keeps
+/// both the log field and the metric label set bounded by the route table and
+/// prevents a caller from writing arbitrary text into either.
+fn route_template(request: &Request<Body>) -> &'static str {
+    let Some(matched) = request.extensions().get::<MatchedPath>() else {
+        return UNMATCHED_ROUTE;
+    };
+    crate::server::ROUTE_TEMPLATES
+        .iter()
+        .find(|template| **template == matched.as_str())
+        .copied()
+        .unwrap_or(UNMATCHED_ROUTE)
+}
+
+/// Fold the method into the closed set the route table can serve, so an
+/// arbitrary request verb cannot create a metric series.
+fn normalized_method(method: &Method) -> &'static str {
+    match *method {
+        Method::GET => "GET",
+        Method::POST => "POST",
+        Method::HEAD => "HEAD",
+        Method::OPTIONS => "OPTIONS",
+        _ => "other",
+    }
+}
+
+fn duration_milliseconds(elapsed: Duration) -> u64 {
+    u64::try_from(elapsed.as_millis()).unwrap_or(u64::MAX)
+}
+
+/// In-process request counters and duration histogram.
+///
+/// Series are keyed only by the closed label set above, so the registry is
+/// bounded by the route table regardless of traffic and needs no eviction.
+#[derive(Default)]
+pub(crate) struct Metrics {
+    series: Mutex<BTreeMap<SeriesKey, Series>>,
+    /// Current count of pseudonym keys tracked by the rate limiter, for the
+    /// `evidence_rate_limiter_tracked_keys` gauge. Unlike `series`, this is
+    /// not derived from request content: it is republished on every scrape
+    /// from [`crate::rate_limit::EvidenceRateLimiter::tracked_key_count`],
+    /// so it stays a single unlabeled series regardless of traffic. See
+    /// security invariant V1-I33.
+    rate_limiter_tracked_keys: AtomicUsize,
+    /// The limiter the metrics scrape handler samples immediately before
+    /// each render. `None` for registries that are never served on the
+    /// metrics listener (for example, an unrelated middleware test).
+    rate_limiter: Option<Arc<EvidenceRateLimiter>>,
+    /// Current segment count and total on-disk bytes of the audit chain, for
+    /// the `evidence_audit_segments` and `evidence_audit_bytes` gauges.
+    /// Rotation never deletes a sealed segment, so nothing in the runtime
+    /// bounds this growth; these gauges are how an operator sees the footprint
+    /// they own. Republished on every scrape from
+    /// [`crate::audit::EvidenceAuditLog::storage_usage`], so they stay two
+    /// unlabeled series regardless of traffic. See security invariant V1-I33.
+    audit_segments: AtomicUsize,
+    audit_bytes: AtomicU64,
+    /// The chain the metrics scrape handler samples immediately before each
+    /// render. `None` for the same reason as `rate_limiter`.
+    audit: Option<Arc<EvidenceAuditLog>>,
+}
+
+#[derive(Clone, PartialEq, Eq, PartialOrd, Ord)]
+struct SeriesKey {
+    route: &'static str,
+    method: &'static str,
+    status: &'static str,
+    error: &'static str,
+}
+
+#[derive(Default)]
+struct Series {
+    requests: u64,
+    duration_sum: f64,
+    bucket_counts: [u64; DURATION_BUCKETS.len()],
+}
+
+impl Metrics {
+    /// A registry that serves the metrics listener: it samples `rate_limiter`
+    /// on every scrape to publish the `evidence_rate_limiter_tracked_keys`
+    /// gauge.
+    pub(crate) fn new(
+        rate_limiter: Arc<EvidenceRateLimiter>,
+        audit: Arc<EvidenceAuditLog>,
+    ) -> Self {
+        Self {
+            rate_limiter: Some(rate_limiter),
+            audit: Some(audit),
+            ..Self::default()
+        }
+    }
+
+    fn record(
+        &self,
+        route: &'static str,
+        method: &'static str,
+        status: StatusCategory,
+        error: &'static str,
+        elapsed: Duration,
+    ) {
+        let key = SeriesKey {
+            route,
+            method,
+            status: status.as_str(),
+            error,
+        };
+        let seconds = elapsed.as_secs_f64();
+        let mut series = self
+            .series
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner());
+        let entry = series.entry(key).or_default();
+        entry.requests += 1;
+        entry.duration_sum += seconds;
+        for (count, bound) in entry.bucket_counts.iter_mut().zip(DURATION_BUCKETS) {
+            if seconds <= bound {
+                *count += 1;
+            }
+        }
+    }
+
+    /// Publish the rate limiter's current tracked-key count for the next
+    /// render.
+    ///
+    /// The caller reads the live count from the actual limiter (see
+    /// [`crate::rate_limit::EvidenceRateLimiter::tracked_key_count`])
+    /// immediately before calling this, so the published gauge reflects the
+    /// limiter's state at scrape time rather than a value cached from an
+    /// earlier request.
+    pub(crate) fn record_rate_limiter_tracked_keys(&self, count: usize) {
+        self.rate_limiter_tracked_keys
+            .store(count, Ordering::Relaxed);
+    }
+
+    /// Publish the audit chain's current footprint for the next render.
+    ///
+    /// Read live from the chain immediately before calling this, for the same
+    /// reason as the rate-limiter gauge.
+    pub(crate) fn record_audit_storage_usage(&self, usage: AuditStorageUsage) {
+        self.audit_segments.store(usage.segments, Ordering::Relaxed);
+        self.audit_bytes.store(usage.bytes, Ordering::Relaxed);
+    }
+
+    /// Render the Prometheus text exposition of the current registry.
+    pub(crate) fn render(&self) -> String {
+        let series = self
+            .series
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner());
+        let mut body = String::new();
+        body.push_str(
+            "# HELP evidence_http_requests_total Requests served by the Evidence boundary.\n",
+        );
+        body.push_str("# TYPE evidence_http_requests_total counter\n");
+        for (key, value) in series.iter() {
+            body.push_str(&format!(
+                "evidence_http_requests_total{{{}}} {}\n",
+                labels(key),
+                value.requests
+            ));
+        }
+        body.push_str(
+            "# HELP evidence_http_request_duration_seconds Request duration at the Evidence boundary.\n",
+        );
+        body.push_str("# TYPE evidence_http_request_duration_seconds histogram\n");
+        for (key, value) in series.iter() {
+            for (count, bound) in value.bucket_counts.iter().zip(DURATION_BUCKETS) {
+                body.push_str(&format!(
+                    "evidence_http_request_duration_seconds_bucket{{{},le=\"{bound}\"}} {count}\n",
+                    labels(key)
+                ));
+            }
+            body.push_str(&format!(
+                "evidence_http_request_duration_seconds_bucket{{{},le=\"+Inf\"}} {}\n",
+                labels(key),
+                value.requests
+            ));
+            body.push_str(&format!(
+                "evidence_http_request_duration_seconds_sum{{{}}} {}\n",
+                labels(key),
+                value.duration_sum
+            ));
+            body.push_str(&format!(
+                "evidence_http_request_duration_seconds_count{{{}}} {}\n",
+                labels(key),
+                value.requests
+            ));
+        }
+        body.push_str(
+            "# HELP evidence_rate_limiter_tracked_keys Pseudonym keys currently tracked by the rate limiter.\n",
+        );
+        body.push_str("# TYPE evidence_rate_limiter_tracked_keys gauge\n");
+        body.push_str(&format!(
+            "evidence_rate_limiter_tracked_keys {}\n",
+            self.rate_limiter_tracked_keys.load(Ordering::Relaxed)
+        ));
+        body.push_str(
+            "# HELP evidence_audit_segments Audit chain segments on disk, sealed and active.\n",
+        );
+        body.push_str("# TYPE evidence_audit_segments gauge\n");
+        body.push_str(&format!(
+            "evidence_audit_segments {}\n",
+            self.audit_segments.load(Ordering::Relaxed)
+        ));
+        body.push_str(
+            "# HELP evidence_audit_bytes Bytes occupied by the audit chain across every segment.\n",
+        );
+        body.push_str("# TYPE evidence_audit_bytes gauge\n");
+        body.push_str(&format!(
+            "evidence_audit_bytes {}\n",
+            self.audit_bytes.load(Ordering::Relaxed)
+        ));
+        body
+    }
+}
+
+fn labels(key: &SeriesKey) -> String {
+    format!(
+        "route=\"{}\",method=\"{}\",status=\"{}\",error=\"{}\"",
+        key.route, key.method, key.status, key.error
+    )
+}
+
+/// Build the metrics application.
+///
+/// It is a separate application on a separate listener: the served counters
+/// are operator material, and the public evidence contract does not describe
+/// them. Every other path on this listener is unserved rather than delegated
+/// back to the evidence routes.
+pub(crate) fn metrics_app(metrics: Arc<Metrics>) -> Router {
+    Router::new()
+        .route("/metrics", get(render_metrics))
+        .fallback(metrics_route_absent)
+        .with_state(metrics)
+}
+
+async fn render_metrics(State(metrics): State<Arc<Metrics>>) -> Response {
+    // Sampled fresh on every scrape rather than cached from request
+    // handling, so the gauge reflects the limiter's state at scrape time.
+    // A registry built without a limiter (see `Metrics::default`) has
+    // nothing to sample and leaves the gauge at its initial zero.
+    if let Some(rate_limiter) = &metrics.rate_limiter {
+        metrics.record_rate_limiter_tracked_keys(rate_limiter.tracked_key_count().await);
+    }
+    if let Some(audit) = &metrics.audit {
+        // A failed read leaves the previous values standing rather than
+        // publishing a zero that would read as an empty chain. It is logged so
+        // the staleness is visible instead of silent; the sampled path is
+        // operator material and carries no request content.
+        match audit.storage_usage().await {
+            Ok(usage) => metrics.record_audit_storage_usage(usage),
+            Err(error) => tracing::warn!(
+                %error,
+                "audit storage usage could not be sampled for the capacity gauges"
+            ),
+        }
+    }
+    let mut response = (StatusCode::OK, metrics.render()).into_response();
+    response
+        .headers_mut()
+        .insert(CONTENT_TYPE, HeaderValue::from_static(METRICS_MEDIA_TYPE));
+    response
+}
+
+async fn metrics_route_absent() -> Response {
+    StatusCode::NOT_FOUND.into_response()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::audit::{
+        AuditAuthority, AuditDecision, AuditPhase, AuditSubject, AuthorityKind, EvidenceAuditEvent,
+        ResponseProtection,
+    };
+
+    #[test]
+    fn series_labels_stay_bounded_by_the_closed_route_and_method_sets() {
+        // An arbitrary verb and an unrouted path must not each create a series.
+        let metrics = Metrics::default();
+        for method in [
+            Method::from_bytes(b"PATCH").expect("a valid method"),
+            Method::from_bytes(b"BREW").expect("a valid method"),
+        ] {
+            metrics.record(
+                UNMATCHED_ROUTE,
+                normalized_method(&method),
+                StatusCategory::ClientError,
+                ProblemCode::MalformedRequest.code(),
+                Duration::from_millis(1),
+            );
+        }
+        let rendered = metrics.render();
+        assert_eq!(
+            rendered
+                .matches("evidence_http_requests_total{route=\"unmatched\",method=\"other\"")
+                .count(),
+            1,
+            "unrecognized methods collapse onto one series"
+        );
+        assert!(rendered.contains("status=\"client_error\",error=\"malformed_request\"} 2\n"));
+    }
+
+    #[test]
+    fn rate_limiter_tracked_keys_gauge_is_a_single_unlabeled_series() {
+        let metrics = Metrics::default();
+        // Populate unrelated request series first, to prove the gauge does
+        // not multiply per label the way the request counter and duration
+        // histogram do.
+        metrics.record(
+            "/health",
+            "GET",
+            StatusCategory::Success,
+            NO_ERROR,
+            Duration::from_millis(1),
+        );
+        metrics.record(
+            "/v1/evidence",
+            "POST",
+            StatusCategory::ClientError,
+            ProblemCode::MalformedRequest.code(),
+            Duration::from_millis(1),
+        );
+        metrics.record_rate_limiter_tracked_keys(42);
+
+        let rendered = metrics.render();
+        assert_eq!(
+            rendered
+                .matches("evidence_rate_limiter_tracked_keys")
+                .count(),
+            3, // HELP line, TYPE line, and exactly one value line
+            "the gauge is emitted once regardless of how many request series exist"
+        );
+        assert!(rendered.contains("\nevidence_rate_limiter_tracked_keys 42\n"));
+        assert!(
+            !rendered.contains("evidence_rate_limiter_tracked_keys{"),
+            "the gauge must carry no labels"
+        );
+    }
+
+    #[tokio::test]
+    async fn rate_limiter_tracked_keys_gauge_reflects_keys_added_through_the_limiter_api() {
+        use crate::rate_limit::{EvidenceRateLimiter, RateLimitConfig};
+
+        let limiter = EvidenceRateLimiter::new(RateLimitConfig {
+            requests_per_principal_per_minute: 60,
+            burst_per_principal: 2,
+            failed_selector_attempts_per_principal_authority_per_minute: 2,
+        })
+        .expect("limiter builds");
+        limiter
+            .check_request("pseudonym-a")
+            .await
+            .expect("first principal");
+        limiter
+            .check_request("pseudonym-b")
+            .await
+            .expect("second principal");
+        limiter
+            .record_selector_failure("authority-a")
+            .await
+            .expect("first failure");
+
+        let metrics = Metrics::default();
+        metrics.record_rate_limiter_tracked_keys(limiter.tracked_key_count().await);
+
+        let rendered = metrics.render();
+        assert!(rendered.contains("\nevidence_rate_limiter_tracked_keys 3\n"));
+    }
+
+    /// The gauge must come from the live limiter at scrape time, not from a
+    /// value recorded during earlier request handling. Drive a real limiter
+    /// through its public API, wire it into a registry the way production
+    /// startup does, and scrape it through the actual `/metrics` router
+    /// rather than calling `render` directly.
+    #[tokio::test]
+    async fn metrics_endpoint_samples_the_live_rate_limiter_at_scrape_time() {
+        use crate::rate_limit::{EvidenceRateLimiter, RateLimitConfig};
+
+        let limiter = Arc::new(
+            EvidenceRateLimiter::new(RateLimitConfig {
+                requests_per_principal_per_minute: 60,
+                burst_per_principal: 2,
+                failed_selector_attempts_per_principal_authority_per_minute: 2,
+            })
+            .expect("limiter builds"),
+        );
+        limiter
+            .check_request("pseudonym-a")
+            .await
+            .expect("first principal");
+        limiter
+            .check_request("pseudonym-b")
+            .await
+            .expect("second principal");
+        limiter
+            .record_selector_failure("authority-a")
+            .await
+            .expect("first failure");
+        let expected = limiter.tracked_key_count().await;
+        assert_eq!(
+            expected, 3,
+            "three distinct tracked keys precede the scrape"
+        );
+
+        let (_directory, audit) = scrape_audit_log().await;
+        let metrics = Arc::new(Metrics::new(Arc::clone(&limiter), audit));
+        let server = axum_test::TestServer::new(metrics_app(metrics));
+
+        let response = server.get("/metrics").await;
+        response.assert_status_ok();
+        let body = response.text();
+        assert!(body.contains(&format!(
+            "\nevidence_rate_limiter_tracked_keys {expected}\n"
+        )));
+
+        // A key tracked after the registry was built is still visible on the
+        // next scrape, proving the value is sampled live rather than cached
+        // from construction time.
+        limiter
+            .check_request("pseudonym-c")
+            .await
+            .expect("third principal");
+        let response = server.get("/metrics").await;
+        response.assert_status_ok();
+        let body = response.text();
+        assert!(body.contains("\nevidence_rate_limiter_tracked_keys 4\n"));
+    }
+
+    /// A representative record, so the footprint the gauges report reflects a
+    /// real audit line rather than an artificially short one.
+    fn scrape_audit_event(log: &EvidenceAuditLog) -> EvidenceAuditEvent {
+        EvidenceAuditEvent::new(
+            crate::config::AssuranceProfile::EvidenceGrade,
+            "01K1EXAMPLE0000000000000000".to_string(),
+            AuditPhase::AccessAttempt,
+            "urn:example:requirement:v1".to_string(),
+            format!("sha256:{}", "0".repeat(64)),
+            "casework".to_string(),
+            log.pseudonym("requester-v1", "urn:example:trust", b"principal-canary")
+                .expect("pseudonym builds"),
+            AuditAuthority {
+                kind: AuthorityKind::Statutory,
+                grant_pseudonym: None,
+            },
+            vec![AuditSubject {
+                role: "subject".to_string(),
+                selector_profile: "person-v1".to_string(),
+                selector_bundle_pseudonym: Some(
+                    log.pseudonym("subject-v1", "casework", b"selector-canary")
+                        .expect("pseudonym builds"),
+                ),
+            }],
+            ResponseProtection::Signed,
+            AuditDecision::Authorized,
+            5,
+        )
+    }
+
+    /// A durable chain over a temporary directory, for tests that need the
+    /// metrics registry's live audit sampling. The `TempDir` is returned
+    /// because dropping it removes the segments out from under the sink.
+    async fn scrape_audit_log() -> (tempfile::TempDir, Arc<EvidenceAuditLog>) {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let path = directory.path().join("audit.jsonl");
+        let log = EvidenceAuditLog::initialize(
+            &path,
+            4096,
+            b"0123456789abcdef0123456789abcdef".to_vec(),
+            1,
+        )
+        .await
+        .expect("audit initializes");
+        (directory, Arc::new(log))
+    }
+
+    #[tokio::test]
+    async fn metrics_endpoint_samples_the_live_audit_chain_at_scrape_time() {
+        use crate::rate_limit::{EvidenceRateLimiter, RateLimitConfig};
+
+        let limiter = Arc::new(
+            EvidenceRateLimiter::new(RateLimitConfig {
+                requests_per_principal_per_minute: 10,
+                burst_per_principal: 10,
+                failed_selector_attempts_per_principal_authority_per_minute: 10,
+            })
+            .expect("limiter builds"),
+        );
+        let (_directory, audit) = scrape_audit_log().await;
+        let metrics = Arc::new(Metrics::new(limiter, Arc::clone(&audit)));
+        let server = axum_test::TestServer::new(metrics_app(metrics));
+
+        let response = server.get("/metrics").await;
+        response.assert_status_ok();
+        let body = response.text();
+        assert!(
+            body.contains("\nevidence_audit_segments 1\n"),
+            "an untouched chain reports its active segment"
+        );
+        assert!(
+            body.contains("\nevidence_audit_bytes 0\n"),
+            "an untouched chain occupies no bytes"
+        );
+        assert!(
+            !body.contains("evidence_audit_segments{") && !body.contains("evidence_audit_bytes{"),
+            "the capacity gauges stay unlabeled under V1-I33"
+        );
+
+        // Append past the rotation threshold, so the next scrape has to show
+        // both a new segment and a larger footprint. This is what proves the
+        // gauges are sampled live rather than cached from construction.
+        for _ in 0..24 {
+            audit
+                .append(scrape_audit_event(&audit))
+                .await
+                .expect("event appends");
+        }
+        let usage = audit.storage_usage().await.expect("usage reads");
+        assert!(
+            usage.segments > 1,
+            "the appended volume must roll the chain"
+        );
+
+        let response = server.get("/metrics").await;
+        response.assert_status_ok();
+        let body = response.text();
+        assert!(body.contains(&format!("\nevidence_audit_segments {}\n", usage.segments)));
+        assert!(body.contains(&format!("\nevidence_audit_bytes {}\n", usage.bytes)));
+    }
+
+    #[test]
+    fn duration_buckets_are_cumulative_and_carry_an_infinite_bound() {
+        let metrics = Metrics::default();
+        metrics.record(
+            "/health",
+            "GET",
+            StatusCategory::Success,
+            NO_ERROR,
+            Duration::from_millis(30),
+        );
+        let rendered = metrics.render();
+        assert!(rendered.contains("le=\"0.025\"} 0\n"));
+        assert!(rendered.contains("le=\"0.05\"} 1\n"));
+        assert!(rendered.contains("le=\"+Inf\"} 1\n"));
+        assert!(rendered.contains("evidence_http_request_duration_seconds_count{route=\"/health\",method=\"GET\",status=\"success\",error=\"none\"} 1\n"));
+    }
+}
diff --git a/crates/registry-evidence/src/problem.rs b/crates/registry-evidence/src/problem.rs
new file mode 100644
index 000000000..de907f2ed
--- /dev/null
+++ b/crates/registry-evidence/src/problem.rs
@@ -0,0 +1,135 @@
+//! Closed public problem details for the Evidence HTTP boundary.
+
+use http::StatusCode;
+
+use crate::model::ProblemBody;
+
+const PROBLEM_BASE: &str = "https://registrystack.org/problems/evidence/";
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ProblemCode {
+    MalformedRequest,
+    InvalidSelector,
+    AuthenticationFailed,
+    NotAuthorized,
+    ResponseFormatNotAcceptable,
+    EvidenceNotAvailable,
+    RateLimited,
+    DependencyUnavailable,
+    ServiceUnavailable,
+}
+
+impl ProblemCode {
+    pub const fn code(self) -> &'static str {
+        match self {
+            Self::MalformedRequest => "malformed_request",
+            Self::InvalidSelector => "invalid_selector",
+            Self::AuthenticationFailed => "authentication_failed",
+            Self::NotAuthorized => "not_authorized",
+            Self::ResponseFormatNotAcceptable => "response_format_not_acceptable",
+            Self::EvidenceNotAvailable => "evidence_not_available",
+            Self::RateLimited => "rate_limited",
+            Self::DependencyUnavailable => "dependency_unavailable",
+            Self::ServiceUnavailable => "service_unavailable",
+        }
+    }
+
+    pub const fn status(self) -> StatusCode {
+        match self {
+            Self::MalformedRequest | Self::InvalidSelector => StatusCode::BAD_REQUEST,
+            Self::AuthenticationFailed => StatusCode::UNAUTHORIZED,
+            Self::NotAuthorized => StatusCode::FORBIDDEN,
+            Self::ResponseFormatNotAcceptable => StatusCode::NOT_ACCEPTABLE,
+            Self::EvidenceNotAvailable => StatusCode::UNPROCESSABLE_ENTITY,
+            Self::RateLimited => StatusCode::TOO_MANY_REQUESTS,
+            Self::DependencyUnavailable | Self::ServiceUnavailable => {
+                StatusCode::SERVICE_UNAVAILABLE
+            }
+        }
+    }
+
+    pub const fn title(self) -> &'static str {
+        match self {
+            Self::MalformedRequest | Self::InvalidSelector => "Request is not valid",
+            Self::AuthenticationFailed => "Authentication failed",
+            Self::NotAuthorized => "Request is not authorized",
+            Self::ResponseFormatNotAcceptable => "Requested response format is not acceptable",
+            Self::EvidenceNotAvailable => "Evidence could not be produced",
+            Self::RateLimited => "Request rate exceeded",
+            Self::DependencyUnavailable | Self::ServiceUnavailable => {
+                "Service temporarily unavailable"
+            }
+        }
+    }
+
+    pub fn body(self, operation: &str) -> ProblemBody {
+        ProblemBody {
+            type_uri: format!("{PROBLEM_BASE}{}", self.code()),
+            title: self.title().to_string(),
+            status: self.status().as_u16(),
+            code: self.code().to_string(),
+            operation: operation.to_string(),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn unresolved_internal_classes_share_one_exact_public_shape() {
+        let no_match = ProblemCode::EvidenceNotAvailable.body("operation-0000000000000001");
+        let ambiguous = ProblemCode::EvidenceNotAvailable.body("operation-0000000000000001");
+        assert_eq!(no_match, ambiguous);
+        assert_eq!(
+            serde_json::to_value(no_match).expect("problem serializes"),
+            serde_json::json!({
+                "type": "https://registrystack.org/problems/evidence/evidence_not_available",
+                "title": "Evidence could not be produced",
+                "status": 422,
+                "code": "evidence_not_available",
+                "operation": "operation-0000000000000001"
+            })
+        );
+    }
+
+    #[test]
+    fn every_code_has_the_contract_status_and_title() {
+        let cases = [
+            (ProblemCode::MalformedRequest, 400, "Request is not valid"),
+            (ProblemCode::InvalidSelector, 400, "Request is not valid"),
+            (
+                ProblemCode::AuthenticationFailed,
+                401,
+                "Authentication failed",
+            ),
+            (ProblemCode::NotAuthorized, 403, "Request is not authorized"),
+            (
+                ProblemCode::ResponseFormatNotAcceptable,
+                406,
+                "Requested response format is not acceptable",
+            ),
+            (
+                ProblemCode::EvidenceNotAvailable,
+                422,
+                "Evidence could not be produced",
+            ),
+            (ProblemCode::RateLimited, 429, "Request rate exceeded"),
+            (
+                ProblemCode::DependencyUnavailable,
+                503,
+                "Service temporarily unavailable",
+            ),
+            (
+                ProblemCode::ServiceUnavailable,
+                503,
+                "Service temporarily unavailable",
+            ),
+        ];
+        for (code, status, title) in cases {
+            assert_eq!(code.status().as_u16(), status);
+            assert_eq!(code.title(), title);
+        }
+    }
+}
diff --git a/crates/registry-evidence/src/rate_limit.rs b/crates/registry-evidence/src/rate_limit.rs
new file mode 100644
index 000000000..dac51e990
--- /dev/null
+++ b/crates/registry-evidence/src/rate_limit.rs
@@ -0,0 +1,313 @@
+//! In-memory pseudonym-keyed request and failed-selector rate limits.
+
+use std::{collections::HashMap, time::Duration};
+
+use thiserror::Error;
+use tokio::time::Instant;
+
+const MAX_TRACKED_KEYS: usize = 100_000;
+
+#[derive(Debug, Clone, Copy)]
+pub struct RateLimitConfig {
+    pub requests_per_principal_per_minute: u32,
+    pub burst_per_principal: u32,
+    pub failed_selector_attempts_per_principal_authority_per_minute: u32,
+}
+
+#[derive(Debug, Error, Clone, Copy, PartialEq, Eq)]
+pub enum RateLimitError {
+    #[error("rate-limit configuration is invalid")]
+    Configuration,
+    #[error("request rate exceeded")]
+    RequestExceeded,
+    #[error("failed-selector rate exceeded")]
+    FailedSelectorExceeded,
+    #[error("rate-limit capacity is unavailable")]
+    Capacity,
+}
+
+#[derive(Debug)]
+struct TokenBucket {
+    tokens: f64,
+    updated_at: Instant,
+}
+
+#[derive(Debug)]
+struct FixedWindow {
+    started_at: Instant,
+    count: u32,
+}
+
+#[derive(Debug)]
+pub struct EvidenceRateLimiter {
+    config: RateLimitConfig,
+    requests: tokio::sync::Mutex<HashMap<String, TokenBucket>>,
+    selector_failures: tokio::sync::Mutex<HashMap<String, FixedWindow>>,
+}
+
+impl EvidenceRateLimiter {
+    pub fn new(config: RateLimitConfig) -> Result<Self, RateLimitError> {
+        if config.requests_per_principal_per_minute == 0
+            || config.burst_per_principal == 0
+            || config.failed_selector_attempts_per_principal_authority_per_minute == 0
+        {
+            return Err(RateLimitError::Configuration);
+        }
+        Ok(Self {
+            config,
+            requests: tokio::sync::Mutex::new(HashMap::new()),
+            selector_failures: tokio::sync::Mutex::new(HashMap::new()),
+        })
+    }
+
+    pub async fn check_request(&self, principal_pseudonym: &str) -> Result<(), RateLimitError> {
+        validate_pseudonym_key(principal_pseudonym)?;
+        let now = Instant::now();
+        let mut buckets = self.requests.lock().await;
+        prune_buckets(&mut buckets, now);
+        if !buckets.contains_key(principal_pseudonym) && buckets.len() >= MAX_TRACKED_KEYS {
+            return Err(RateLimitError::Capacity);
+        }
+        let capacity = f64::from(self.config.burst_per_principal);
+        let refill_per_second = f64::from(self.config.requests_per_principal_per_minute) / 60.0;
+        let bucket = buckets
+            .entry(principal_pseudonym.to_owned())
+            .or_insert(TokenBucket {
+                tokens: capacity,
+                updated_at: now,
+            });
+        let elapsed = now.duration_since(bucket.updated_at).as_secs_f64();
+        bucket.tokens = (bucket.tokens + elapsed * refill_per_second).min(capacity);
+        bucket.updated_at = now;
+        if bucket.tokens < 1.0 {
+            return Err(RateLimitError::RequestExceeded);
+        }
+        bucket.tokens -= 1.0;
+        Ok(())
+    }
+
+    /// Check the selector-failure budget before source access. Call
+    /// [`Self::record_selector_failure`] only when selector validation or
+    /// authorization actually fails.
+    pub async fn check_selector_failure_budget(
+        &self,
+        principal_authority_pseudonym: &str,
+    ) -> Result<(), RateLimitError> {
+        validate_pseudonym_key(principal_authority_pseudonym)?;
+        let now = Instant::now();
+        let mut windows = self.selector_failures.lock().await;
+        prune_windows(&mut windows, now);
+        match windows.get(principal_authority_pseudonym) {
+            Some(window)
+                if now.duration_since(window.started_at) < Duration::from_secs(60)
+                    && window.count
+                        >= self
+                            .config
+                            .failed_selector_attempts_per_principal_authority_per_minute =>
+            {
+                Err(RateLimitError::FailedSelectorExceeded)
+            }
+            _ => Ok(()),
+        }
+    }
+
+    pub async fn record_selector_failure(
+        &self,
+        principal_authority_pseudonym: &str,
+    ) -> Result<(), RateLimitError> {
+        validate_pseudonym_key(principal_authority_pseudonym)?;
+        let now = Instant::now();
+        let mut windows = self.selector_failures.lock().await;
+        prune_windows(&mut windows, now);
+        if !windows.contains_key(principal_authority_pseudonym) && windows.len() >= MAX_TRACKED_KEYS
+        {
+            return Err(RateLimitError::Capacity);
+        }
+        let window = windows
+            .entry(principal_authority_pseudonym.to_owned())
+            .or_insert(FixedWindow {
+                started_at: now,
+                count: 0,
+            });
+        if now.duration_since(window.started_at) >= Duration::from_secs(60) {
+            window.started_at = now;
+            window.count = 0;
+        }
+        window.count = window.count.saturating_add(1);
+        if window.count
+            > self
+                .config
+                .failed_selector_attempts_per_principal_authority_per_minute
+        {
+            return Err(RateLimitError::FailedSelectorExceeded);
+        }
+        Ok(())
+    }
+
+    /// Total pseudonym keys currently tracked across both maps, toward the
+    /// shared [`MAX_TRACKED_KEYS`] capacity ceiling each map enforces.
+    ///
+    /// Each lock is held only long enough to read `.len()`; no other work
+    /// happens in either critical section, since the request path contends
+    /// on these same locks.
+    pub async fn tracked_key_count(&self) -> usize {
+        let requests_len = self.requests.lock().await.len();
+        let selector_failures_len = self.selector_failures.lock().await.len();
+        requests_len + selector_failures_len
+    }
+}
+
+fn validate_pseudonym_key(key: &str) -> Result<(), RateLimitError> {
+    if key.is_empty() || key.len() > 256 || key.chars().any(char::is_whitespace) {
+        return Err(RateLimitError::Configuration);
+    }
+    Ok(())
+}
+
+fn prune_buckets(buckets: &mut HashMap<String, TokenBucket>, now: Instant) {
+    if buckets.len() < MAX_TRACKED_KEYS / 2 {
+        return;
+    }
+    buckets.retain(|_, bucket| now.duration_since(bucket.updated_at) < Duration::from_secs(600));
+}
+
+fn prune_windows(windows: &mut HashMap<String, FixedWindow>, now: Instant) {
+    if windows.len() < MAX_TRACKED_KEYS / 2 {
+        return;
+    }
+    windows.retain(|_, window| now.duration_since(window.started_at) < Duration::from_secs(120));
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn limiter() -> EvidenceRateLimiter {
+        EvidenceRateLimiter::new(RateLimitConfig {
+            requests_per_principal_per_minute: 60,
+            burst_per_principal: 2,
+            failed_selector_attempts_per_principal_authority_per_minute: 2,
+        })
+        .expect("limiter builds")
+    }
+
+    #[tokio::test]
+    async fn request_burst_and_refill_are_enforced() {
+        let limiter = EvidenceRateLimiter::new(RateLimitConfig {
+            requests_per_principal_per_minute: 6_000,
+            burst_per_principal: 2,
+            failed_selector_attempts_per_principal_authority_per_minute: 2,
+        })
+        .expect("limiter builds");
+        limiter.check_request("pseudonym-a").await.expect("first");
+        limiter.check_request("pseudonym-a").await.expect("second");
+        assert_eq!(
+            limiter.check_request("pseudonym-a").await,
+            Err(RateLimitError::RequestExceeded)
+        );
+        tokio::time::sleep(Duration::from_millis(11)).await;
+        limiter
+            .check_request("pseudonym-a")
+            .await
+            .expect("refilled");
+    }
+
+    #[tokio::test]
+    async fn request_budget_is_shared_by_every_use_of_a_principal_key() {
+        let limiter = limiter();
+        let principal_key = "stable-principal-pseudonym";
+
+        for _request_context in [
+            ("adult", "service-enrolment", "audience-a"),
+            ("residence", "benefit-eligibility", "audience-b"),
+        ] {
+            limiter
+                .check_request(principal_key)
+                .await
+                .expect("shared principal budget has capacity");
+        }
+
+        assert_eq!(
+            limiter.check_request(principal_key).await,
+            Err(RateLimitError::RequestExceeded)
+        );
+        limiter
+            .check_request("other-principal-pseudonym")
+            .await
+            .expect("another principal has an independent budget");
+    }
+
+    #[tokio::test]
+    async fn selector_failure_budget_is_separate_and_authority_scoped() {
+        let limiter = limiter();
+        limiter
+            .record_selector_failure("principal-authority-a")
+            .await
+            .expect("first failure");
+        limiter
+            .record_selector_failure("principal-authority-a")
+            .await
+            .expect("second failure");
+        assert_eq!(
+            limiter
+                .check_selector_failure_budget("principal-authority-a")
+                .await,
+            Err(RateLimitError::FailedSelectorExceeded)
+        );
+        limiter
+            .check_selector_failure_budget("principal-authority-b")
+            .await
+            .expect("other authority remains available");
+    }
+
+    #[tokio::test]
+    async fn tracked_key_count_reports_the_total_across_both_maps() {
+        let limiter = limiter();
+        assert_eq!(limiter.tracked_key_count().await, 0);
+
+        limiter
+            .check_request("pseudonym-a")
+            .await
+            .expect("first principal");
+        limiter
+            .check_request("pseudonym-b")
+            .await
+            .expect("second principal");
+        limiter
+            .record_selector_failure("authority-a")
+            .await
+            .expect("first failure");
+
+        assert_eq!(limiter.tracked_key_count().await, 3);
+
+        // Reusing an already-tracked key does not grow the count.
+        limiter
+            .check_request("pseudonym-a")
+            .await
+            .expect("existing principal");
+        assert_eq!(limiter.tracked_key_count().await, 3);
+    }
+
+    #[tokio::test]
+    async fn selector_failure_budget_is_shared_across_request_contexts() {
+        let limiter = limiter();
+        let principal_authority_key = "stable-principal-authority-pseudonym";
+
+        for _request_context in [
+            ("service-enrolment", "audience-a"),
+            ("benefit-eligibility", "audience-b"),
+        ] {
+            limiter
+                .record_selector_failure(principal_authority_key)
+                .await
+                .expect("shared selector-failure budget has capacity");
+        }
+
+        assert_eq!(
+            limiter
+                .check_selector_failure_budget(principal_authority_key)
+                .await,
+            Err(RateLimitError::FailedSelectorExceeded)
+        );
+    }
+}
diff --git a/crates/registry-evidence/src/rhai_runtime.rs b/crates/registry-evidence/src/rhai_runtime.rs
new file mode 100644
index 000000000..590069522
--- /dev/null
+++ b/crates/registry-evidence/src/rhai_runtime.rs
@@ -0,0 +1,3991 @@
+//! Hardened, deterministic Rhai execution for Evidence bundle scripts.
+
+use std::{
+    cmp::Ordering,
+    collections::{BTreeMap, BTreeSet},
+    fmt,
+    sync::Arc,
+};
+
+use chrono::{DateTime, Datelike, Duration, NaiveDate, Utc};
+use rhai::{
+    Array, CallFnOptions, Dynamic, Engine, EvalAltResult, ImmutableString, Map, Module, Scope, AST,
+    INT,
+};
+use serde_json::Value;
+use thiserror::Error;
+
+use crate::{
+    model::LookupResult,
+    values::{Decimal, EntityReferenceSeed},
+};
+
+pub const MAXIMUM_OPERATIONS: u64 = 100_000;
+pub const MAXIMUM_CALL_DEPTH: usize = 32;
+pub const MAXIMUM_EXPRESSION_DEPTH: usize = 64;
+pub const MAXIMUM_MODULES: usize = 0;
+pub const MAXIMUM_STRING_BYTES: usize = 16_384;
+pub const MAXIMUM_ARRAY_ITEMS: usize = 256;
+pub const MAXIMUM_MAP_ENTRIES: usize = 256;
+pub const MAXIMUM_FACT_ENTRIES: usize = 64;
+pub const MAXIMUM_CONCEPT_VALUES: usize = 16;
+pub const MAXIMUM_CODELIST_ENTRIES: usize = 4_096;
+pub const MAXIMUM_SOURCE_INPUT_BYTES: usize = 1_048_576;
+pub const MAXIMUM_RESULT_BYTES: usize = 65_536;
+pub const MAXIMUM_PREPARATION_INPUT_BYTES: usize = 1_048_576;
+pub const MAXIMUM_REQUEST_PARTS_BYTES: usize = 65_536;
+pub const MAXIMUM_QUERY_PAIRS: usize = 64;
+pub const MAXIMUM_QUERY_NAME_BYTES: usize = 64;
+pub const MAXIMUM_QUERY_VALUE_BYTES: usize = 4_096;
+pub const MAXIMUM_JSON_BODY_DEPTH: usize = 32;
+
+const MAXIMUM_BUCKETS: usize = 64;
+const MAXIMUM_ENTITY_REFERENCE_ITEMS: usize = 64;
+const MAXIMUM_REQUIRED_CODE_BYTES: usize = 64;
+const MAXIMUM_POINTER_BYTES: usize = 256;
+const MAXIMUM_POINTER_SEGMENTS: usize = 16;
+/// One past the largest signed 64-bit integer, as the exclusive magnitude bound for any
+/// ordinary floating-point number that crosses a runtime boundary.
+const INTEGER_MAGNITUDE_LIMIT: f64 = 9_223_372_036_854_775_808.0;
+/// Host-owned wrapper applied to every index operand by the startup source review.
+const INDEX_GUARD_FUNCTION: &str = "__evidence_index";
+
+/// Host-private marker for a `required` value that was absent. Scripts cannot name,
+/// construct, catch, or observe it, and it carries no script-supplied text.
+#[derive(Clone, Copy, Debug)]
+struct RequiredUnavailable;
+
+#[derive(Debug, Error, Clone, Copy, PartialEq, Eq)]
+pub enum RhaiRuntimeError {
+    #[error("Evidence script compilation failed")]
+    Compilation,
+    #[error("Evidence script has an invalid entry point")]
+    EntryPoint,
+    #[error("Evidence script invocation failed")]
+    Invocation,
+    #[error("Evidence required input is unavailable")]
+    Unavailable,
+    #[error("Evidence source response violates its protocol contract")]
+    SourceProtocol,
+    #[error("Evidence script input exceeds its bound")]
+    InputBound,
+    #[error("Evidence request preparation input is invalid")]
+    AdapterInput,
+    #[error("Evidence request preparation result violates the closed ABI")]
+    PreparationResult,
+    #[error("Evidence extraction result violates the closed ABI")]
+    ExtractionResult,
+    #[error("Evidence extracted facts violate their schema")]
+    FactSchema,
+    #[error("Evidence derivation result violates the closed ABI")]
+    DerivationResult,
+    #[error("Evidence derivation input violates its reviewed contract")]
+    DerivationInput,
+    #[error("Evidence evaluation context is invalid")]
+    EvaluationContext,
+    #[error("Evidence codelist is invalid")]
+    Codelist,
+}
+
+/// A schema hook kept separate from bundle configuration while that layer is loaded.
+pub trait FactSchemaValidator {
+    fn is_valid(&self, facts: &Value) -> bool;
+}
+
+impl FactSchemaValidator for jsonschema::JSONSchema {
+    fn is_valid(&self, facts: &Value) -> bool {
+        jsonschema::JSONSchema::is_valid(self, facts)
+    }
+}
+
+impl<F> FactSchemaValidator for F
+where
+    F: Fn(&Value) -> bool,
+{
+    fn is_valid(&self, facts: &Value) -> bool {
+        self(facts)
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct CompiledExtraction {
+    ast: AST,
+}
+
+#[derive(Clone, Debug)]
+pub struct CompiledPreparation {
+    ast: AST,
+}
+
+#[derive(Clone, Debug)]
+pub struct CompiledDerivation {
+    ast: AST,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum RequestPartRequirement {
+    Forbidden,
+    Optional,
+    Required,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RequestPartsLimits {
+    query: RequestPartRequirement,
+    body: RequestPartRequirement,
+    maximum_query_pairs: usize,
+    maximum_query_name_bytes: usize,
+    maximum_query_value_bytes: usize,
+    maximum_json_depth: usize,
+    maximum_collection_items: usize,
+    maximum_string_bytes: usize,
+    maximum_normalized_bytes: usize,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct RequestPartsBounds {
+    pub maximum_query_pairs: usize,
+    pub maximum_query_name_bytes: usize,
+    pub maximum_query_value_bytes: usize,
+    pub maximum_json_depth: usize,
+    pub maximum_collection_items: usize,
+    pub maximum_string_bytes: usize,
+    pub maximum_normalized_bytes: usize,
+}
+
+impl RequestPartsLimits {
+    pub fn new(
+        query: RequestPartRequirement,
+        body: RequestPartRequirement,
+        bounds: RequestPartsBounds,
+    ) -> Result<Self, RhaiRuntimeError> {
+        let RequestPartsBounds {
+            maximum_query_pairs,
+            maximum_query_name_bytes,
+            maximum_query_value_bytes,
+            maximum_json_depth,
+            maximum_collection_items,
+            maximum_string_bytes,
+            maximum_normalized_bytes,
+        } = bounds;
+        if maximum_query_pairs == 0
+            || maximum_query_pairs > MAXIMUM_QUERY_PAIRS
+            || maximum_query_name_bytes == 0
+            || maximum_query_name_bytes > MAXIMUM_QUERY_NAME_BYTES
+            || maximum_query_value_bytes == 0
+            || maximum_query_value_bytes > MAXIMUM_QUERY_VALUE_BYTES
+            || maximum_json_depth == 0
+            || maximum_json_depth > MAXIMUM_JSON_BODY_DEPTH
+            || maximum_collection_items == 0
+            || maximum_collection_items > MAXIMUM_ARRAY_ITEMS
+            || maximum_string_bytes == 0
+            || maximum_string_bytes > MAXIMUM_STRING_BYTES
+            || maximum_normalized_bytes == 0
+            || maximum_normalized_bytes > MAXIMUM_REQUEST_PARTS_BYTES
+        {
+            return Err(RhaiRuntimeError::PreparationResult);
+        }
+        Ok(Self {
+            query,
+            body,
+            maximum_query_pairs,
+            maximum_query_name_bytes,
+            maximum_query_value_bytes,
+            maximum_json_depth,
+            maximum_collection_items,
+            maximum_string_bytes,
+            maximum_normalized_bytes,
+        })
+    }
+}
+
+#[derive(Clone, PartialEq)]
+pub struct QueryPair {
+    pub name: String,
+    pub value: String,
+}
+
+impl fmt::Debug for QueryPair {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("QueryPair")
+            .field("name", &"[redacted]")
+            .field("value", &"[redacted]")
+            .finish()
+    }
+}
+
+#[derive(Clone, PartialEq)]
+pub struct RequestParts {
+    pub query: Vec<QueryPair>,
+    pub body: Option<Value>,
+}
+
+impl fmt::Debug for RequestParts {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("RequestParts")
+            .field("query_pairs", &self.query.len())
+            .field("body_present", &self.body.is_some())
+            .finish()
+    }
+}
+
+/// Strict proleptic-Gregorian date exposed to Rhai as an opaque typed value.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub struct CalendarDate(NaiveDate);
+
+impl CalendarDate {
+    pub fn parse(input: &str) -> Result<Self, RhaiRuntimeError> {
+        if !is_canonical_date_text(input) {
+            return Err(RhaiRuntimeError::EvaluationContext);
+        }
+        NaiveDate::parse_from_str(input, "%Y-%m-%d")
+            .map(Self)
+            .map_err(|_| RhaiRuntimeError::EvaluationContext)
+    }
+
+    pub fn as_naive_date(self) -> NaiveDate {
+        self.0
+    }
+}
+
+/// Strict RFC 3339 instant normalized to UTC without ambient clock access.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub struct UtcInstant(DateTime<Utc>);
+
+impl UtcInstant {
+    pub fn parse(input: &str) -> Result<Self, RhaiRuntimeError> {
+        if !is_strict_rfc3339(input) {
+            return Err(RhaiRuntimeError::EvaluationContext);
+        }
+        DateTime::parse_from_rfc3339(input)
+            .map(|value| Self(value.with_timezone(&Utc)))
+            .map_err(|_| RhaiRuntimeError::EvaluationContext)
+    }
+
+    pub fn as_utc(self) -> DateTime<Utc> {
+        self.0
+    }
+}
+
+/// A validated local clock time carrying its explicit UTC offset.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct LegalLocalTime(ImmutableString);
+
+impl LegalLocalTime {
+    pub fn parse(input: &str) -> Result<Self, RhaiRuntimeError> {
+        if !is_strict_local_time(input) {
+            return Err(RhaiRuntimeError::EvaluationContext);
+        }
+        Ok(Self(input.into()))
+    }
+}
+
+/// Read-only, bounded mapping handle. Rhai can only pass it to `codelist_lookup`.
+#[derive(Clone)]
+pub struct CodelistHandle {
+    entries: Arc<BTreeMap<String, String>>,
+}
+
+impl CodelistHandle {
+    pub fn new(entries: BTreeMap<String, String>) -> Result<Self, RhaiRuntimeError> {
+        if entries.len() > MAXIMUM_CODELIST_ENTRIES
+            || entries.iter().any(|(input, output)| {
+                input.is_empty()
+                    || output.is_empty()
+                    || input.len() > MAXIMUM_STRING_BYTES
+                    || output.len() > MAXIMUM_STRING_BYTES
+            })
+        {
+            return Err(RhaiRuntimeError::Codelist);
+        }
+        Ok(Self {
+            entries: Arc::new(entries),
+        })
+    }
+}
+
+impl fmt::Debug for CodelistHandle {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("CodelistHandle")
+            .field("entry_count", &self.entries.len())
+            .finish()
+    }
+}
+
+/// The only values derivation may pass to the lead output gate.
+#[derive(Clone)]
+pub enum DerivedValue {
+    Json(Value),
+    Decimal(Decimal),
+    EntityReferenceSeed(EntityReferenceSeed),
+    EntityReferenceSeedList(Vec<EntityReferenceSeed>),
+}
+
+impl fmt::Debug for DerivedValue {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Json(value) => formatter
+                .debug_struct("DerivedValue::Json")
+                .field("form", &json_form(value))
+                .finish(),
+            Self::Decimal(_) => formatter.write_str("DerivedValue::Decimal([REDACTED])"),
+            Self::EntityReferenceSeed(_) => {
+                formatter.write_str("DerivedValue::EntityReferenceSeed([REDACTED])")
+            }
+            Self::EntityReferenceSeedList(values) => formatter
+                .debug_struct("DerivedValue::EntityReferenceSeedList")
+                .field("count", &values.len())
+                .finish(),
+        }
+    }
+}
+
+fn json_form(value: &Value) -> &'static str {
+    match value {
+        Value::Null => "null",
+        Value::Bool(_) => "boolean",
+        Value::Number(_) => "number",
+        Value::String(_) => "string",
+        Value::Array(_) => "array",
+        Value::Object(_) => "object",
+    }
+}
+
+#[derive(Clone)]
+pub struct DerivedConceptValue {
+    pub concept_id: String,
+    pub value: DerivedValue,
+}
+
+impl fmt::Debug for DerivedConceptValue {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("DerivedConceptValue")
+            .field("concept_id", &self.concept_id)
+            .field("value", &self.value)
+            .finish()
+    }
+}
+
+/// Exact deterministic input to `derive`.
+#[derive(Clone, Debug)]
+pub struct EvaluationContext {
+    observed_at: UtcInstant,
+    legal_local_date: CalendarDate,
+    legal_local_time: LegalLocalTime,
+    parameters: Map,
+    codelists: BTreeMap<String, CodelistHandle>,
+}
+
+impl EvaluationContext {
+    pub fn new(
+        observed_at: UtcInstant,
+        legal_local_date: CalendarDate,
+        legal_local_time: LegalLocalTime,
+        parameters: &Value,
+        codelists: BTreeMap<String, CodelistHandle>,
+    ) -> Result<Self, RhaiRuntimeError> {
+        if codelists.len() > MAXIMUM_MAP_ENTRIES
+            || codelists
+                .keys()
+                .any(|name| name.is_empty() || name.len() > MAXIMUM_STRING_BYTES)
+        {
+            return Err(RhaiRuntimeError::EvaluationContext);
+        }
+        validate_json_bound(parameters, MAXIMUM_RESULT_BYTES)
+            .map_err(|_| RhaiRuntimeError::EvaluationContext)?;
+        let parameters = parameters_to_map(parameters)?;
+        Ok(Self {
+            observed_at,
+            legal_local_date,
+            legal_local_time,
+            parameters,
+            codelists,
+        })
+    }
+
+    fn into_dynamic(self) -> Dynamic {
+        let mut codelists = Map::new();
+        for (name, handle) in self.codelists {
+            codelists.insert(name.into(), Dynamic::from(handle));
+        }
+        let mut context = Map::new();
+        context.insert("observed_at".into(), Dynamic::from(self.observed_at));
+        context.insert(
+            "legal_local_date".into(),
+            Dynamic::from(self.legal_local_date),
+        );
+        context.insert(
+            "legal_local_time".into(),
+            Dynamic::from(self.legal_local_time),
+        );
+        context.insert("parameters".into(), Dynamic::from(self.parameters));
+        context.insert("codelists".into(), Dynamic::from(codelists));
+        Dynamic::from(context)
+    }
+}
+
+/// One immutable capability allowlist used by every bundle script.
+pub struct RhaiRuntime {
+    engine: Engine,
+}
+
+impl fmt::Debug for RhaiRuntime {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("RhaiRuntime(<hardened>)")
+    }
+}
+
+impl Default for RhaiRuntime {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl RhaiRuntime {
+    pub fn new() -> Self {
+        let mut engine = Engine::new_raw();
+        engine
+            .set_max_operations(MAXIMUM_OPERATIONS)
+            .set_max_call_levels(MAXIMUM_CALL_DEPTH)
+            .set_max_expr_depths(MAXIMUM_EXPRESSION_DEPTH, MAXIMUM_EXPRESSION_DEPTH)
+            .set_max_modules(MAXIMUM_MODULES)
+            .set_max_string_size(MAXIMUM_STRING_BYTES)
+            .set_max_array_size(MAXIMUM_ARRAY_ITEMS)
+            .set_max_map_size(MAXIMUM_MAP_ENTRIES)
+            .set_allow_anonymous_fn(false)
+            .disable_symbol("import")
+            .disable_symbol("export")
+            .disable_symbol("eval")
+            .disable_symbol("print")
+            .disable_symbol("debug")
+            .disable_symbol("while")
+            .disable_symbol("until")
+            .disable_symbol("loop")
+            .disable_symbol("do")
+            .disable_symbol("switch")
+            .disable_symbol("try")
+            .disable_symbol("catch")
+            .disable_symbol("..")
+            .disable_symbol("..=")
+            .disable_symbol("?.")
+            .disable_symbol("??");
+
+        let mut iterators = Module::new();
+        iterators.set_iterable::<Array>();
+        engine.register_global_module(iterators.into());
+
+        register_language_essentials(&mut engine);
+        register_evidence_primitives(&mut engine);
+
+        Self { engine }
+    }
+
+    pub fn compile_preparation(
+        &self,
+        source: &str,
+    ) -> Result<CompiledPreparation, RhaiRuntimeError> {
+        self.compile_exact(source, "prepare", 2)
+            .map(|ast| CompiledPreparation { ast })
+    }
+
+    pub fn compile_extraction(&self, source: &str) -> Result<CompiledExtraction, RhaiRuntimeError> {
+        self.compile_exact(source, "extract", 2)
+            .map(|ast| CompiledExtraction { ast })
+    }
+
+    pub fn compile_derivation(&self, source: &str) -> Result<CompiledDerivation, RhaiRuntimeError> {
+        self.compile_exact(source, "derive", 3)
+            .map(|ast| CompiledDerivation { ast })
+    }
+
+    pub fn prepare(
+        &self,
+        script: &CompiledPreparation,
+        selectors: &Value,
+        parameters: &Value,
+        limits: &RequestPartsLimits,
+    ) -> Result<RequestParts, RhaiRuntimeError> {
+        validate_adapter_inputs(selectors, parameters)?;
+        let selectors = adapter_object_to_dynamic(selectors)?;
+        let parameters = adapter_object_to_dynamic(parameters)?;
+        let result = self
+            .engine
+            .call_fn_with_options::<Dynamic>(
+                CallFnOptions::new().eval_ast(false),
+                &mut Scope::new(),
+                &script.ast,
+                "prepare",
+                (selectors, parameters),
+            )
+            .map_err(|error| classify_invocation_error(error, ScriptStage::Preparation))?;
+        decode_request_parts(result, limits)
+    }
+
+    pub fn extract<V>(
+        &self,
+        script: &CompiledExtraction,
+        source_response: &Value,
+        parameters: &Value,
+        fact_schema: &V,
+    ) -> Result<LookupResult, RhaiRuntimeError>
+    where
+        V: FactSchemaValidator + ?Sized,
+    {
+        validate_json_bound(source_response, MAXIMUM_SOURCE_INPUT_BYTES)?;
+        if !json_numbers_are_supported(source_response) {
+            return Err(RhaiRuntimeError::InputBound);
+        }
+        validate_adapter_object(parameters)?;
+        let input =
+            rhai::serde::to_dynamic(source_response).map_err(|_| RhaiRuntimeError::InputBound)?;
+        let parameters = adapter_object_to_dynamic(parameters)?;
+        let result = self
+            .engine
+            .call_fn_with_options::<Dynamic>(
+                CallFnOptions::new().eval_ast(false),
+                &mut Scope::new(),
+                &script.ast,
+                "extract",
+                (input, parameters),
+            )
+            .map_err(|error| classify_invocation_error(error, ScriptStage::Extraction))?;
+        decode_lookup_result(result, fact_schema)
+    }
+
+    pub fn derive(
+        &self,
+        script: &CompiledDerivation,
+        facts: &BTreeMap<String, Value>,
+        selectors: &Value,
+        evaluation_context: EvaluationContext,
+    ) -> Result<Vec<DerivedConceptValue>, RhaiRuntimeError> {
+        if facts.len() > MAXIMUM_FACT_ENTRIES {
+            return Err(RhaiRuntimeError::InputBound);
+        }
+        let facts_value = Value::Object(
+            facts
+                .iter()
+                .map(|(name, value)| (name.clone(), value.clone()))
+                .collect(),
+        );
+        validate_json_bound(&facts_value, MAXIMUM_RESULT_BYTES)?;
+        if !json_numbers_are_supported(&facts_value) {
+            return Err(RhaiRuntimeError::InputBound);
+        }
+        let facts =
+            rhai::serde::to_dynamic(facts_value).map_err(|_| RhaiRuntimeError::InputBound)?;
+        validate_adapter_object(selectors)?;
+        let selectors = adapter_object_to_dynamic(selectors)?;
+        let context = evaluation_context.into_dynamic();
+        let result = self
+            .engine
+            .call_fn_with_options::<Dynamic>(
+                CallFnOptions::new().eval_ast(false),
+                &mut Scope::new(),
+                &script.ast,
+                "derive",
+                (facts, selectors, context),
+            )
+            .map_err(|error| classify_invocation_error(error, ScriptStage::Derivation))?;
+        decode_derivation_result(result)
+    }
+
+    fn compile_exact(
+        &self,
+        source: &str,
+        function_name: &str,
+        parameter_count: usize,
+    ) -> Result<AST, RhaiRuntimeError> {
+        if source.len() > MAXIMUM_RESULT_BYTES {
+            return Err(RhaiRuntimeError::InputBound);
+        }
+        let guarded = guarded_script_source(source)?;
+        let ast = self
+            .engine
+            .compile(&guarded)
+            .map_err(|_| RhaiRuntimeError::Compilation)?;
+        let mut names = BTreeSet::new();
+        let mut entry_points = 0usize;
+        for function in ast.iter_functions() {
+            if !names.insert(function.name) {
+                return Err(RhaiRuntimeError::EntryPoint);
+            }
+            if function.name == function_name {
+                if function.params.len() != parameter_count
+                    || function.access != rhai::FnAccess::Public
+                {
+                    return Err(RhaiRuntimeError::EntryPoint);
+                }
+                entry_points += 1;
+            }
+        }
+        if entry_points != 1 {
+            return Err(RhaiRuntimeError::EntryPoint);
+        }
+        Ok(ast)
+    }
+
+    #[cfg(test)]
+    fn engine(&self) -> &Engine {
+        &self.engine
+    }
+}
+
+fn register_language_essentials(engine: &mut Engine) {
+    engine
+        .register_fn("==", |left: INT, right: INT| left == right)
+        .register_fn("!=", |left: INT, right: INT| left != right)
+        .register_fn("<", |left: INT, right: INT| left < right)
+        .register_fn("<=", |left: INT, right: INT| left <= right)
+        .register_fn(">", |left: INT, right: INT| left > right)
+        .register_fn(">=", |left: INT, right: INT| left >= right)
+        .register_fn("!", |value: bool| !value)
+        .register_fn("==", |left: bool, right: bool| left == right)
+        .register_fn("!=", |left: bool, right: bool| left != right)
+        .register_fn("==", |left: ImmutableString, right: ImmutableString| {
+            left == right
+        })
+        .register_fn("!=", |left: ImmutableString, right: ImmutableString| {
+            left != right
+        })
+        .register_get("len", |array: &mut Array| {
+            INT::try_from(array.len()).unwrap_or(INT::MAX)
+        })
+        .register_fn("len", |map: Map| {
+            INT::try_from(map.len()).unwrap_or(INT::MAX)
+        })
+        .register_fn("contains", |map: Map, name: ImmutableString| {
+            map.contains_key(name.as_str())
+        })
+        .register_fn("push", bounded_array_push)
+        .register_fn("replace", literal_string_replace)
+        .register_fn("parse_integer", parse_integer)
+        .register_fn(INDEX_GUARD_FUNCTION, guard_index)
+        .register_fn(INDEX_GUARD_FUNCTION, guard_index_key);
+}
+
+fn register_evidence_primitives(engine: &mut Engine) {
+    engine
+        .register_type_with_name::<CalendarDate>("Date")
+        .register_type_with_name::<UtcInstant>("Instant")
+        .register_type_with_name::<LegalLocalTime>("LegalLocalTime")
+        .register_type_with_name::<Decimal>("Decimal")
+        .register_type_with_name::<EntityReferenceSeed>("EntityReferenceSeed")
+        .register_type_with_name::<CodelistHandle>("CodelistHandle")
+        .register_fn("parse_date", parse_date)
+        .register_fn("parse_instant", parse_instant)
+        .register_fn("decimal", parse_decimal)
+        .register_fn("parse_decimal", parse_decimal)
+        .register_fn("integer_to_decimal", integer_to_decimal)
+        .register_fn("add_calendar_years", add_calendar_years)
+        .register_fn("add_calendar_months", add_calendar_months)
+        .register_fn("compare_dates", compare_dates)
+        .register_fn("compare_instants", compare_instants)
+        .register_fn("days_between", days_between)
+        .register_fn("compare_decimals", compare_decimals)
+        .register_fn("bucket_number", bucket_number)
+        .register_fn("entity_reference_seed", entity_reference_seed)
+        .register_fn("codelist_lookup", codelist_lookup)
+        .register_fn("list_contains", list_contains)
+        .register_fn("set_contains", set_contains)
+        .register_fn("required", required)
+        .register_fn("is_missing", is_missing)
+        .register_fn("get_path", get_path);
+}
+
+/// Resolves one RFC 6901 JSON Pointer against a decoded value, the same pointer
+/// grammar source projection already uses, so one document shape is described one way.
+///
+/// Absence at any step is reported as the unit marker `is_missing` and `required`
+/// already understand, because a projected response legitimately omits a selected
+/// leaf. A malformed or oversized pointer is instead a fault in the script's own
+/// text, so it fails closed rather than passing as absence.
+fn get_path(value: Dynamic, pointer: &str) -> Result<Dynamic, Box<EvalAltResult>> {
+    let mut current = value;
+    for token in parse_json_pointer(pointer)? {
+        let next = if let Some(map) = current.read_lock::<Map>() {
+            map.get(token.as_str()).cloned()
+        } else if let Some(array) = current.read_lock::<Array>() {
+            array.get(reference_token_index(&token)?).cloned()
+        } else {
+            None
+        };
+        match next {
+            Some(value) => current = value,
+            None => return Ok(Dynamic::UNIT),
+        }
+    }
+    Ok(current)
+}
+
+/// Splits a pointer into its unescaped reference tokens under fixed ceilings. Index
+/// tokens stay unchecked here because only the value being traversed says which
+/// tokens address an array.
+fn parse_json_pointer(pointer: &str) -> Result<Vec<String>, Box<EvalAltResult>> {
+    if pointer.len() > MAXIMUM_POINTER_BYTES {
+        return Err(primitive_error("pointer_out_of_bounds"));
+    }
+    if pointer.is_empty() {
+        return Ok(Vec::new());
+    }
+    let Some(body) = pointer.strip_prefix('/') else {
+        return Err(primitive_error("invalid_pointer"));
+    };
+    let tokens: Vec<&str> = body.split('/').collect();
+    if tokens.len() > MAXIMUM_POINTER_SEGMENTS {
+        return Err(primitive_error("pointer_out_of_bounds"));
+    }
+    tokens.into_iter().map(unescape_reference_token).collect()
+}
+
+fn unescape_reference_token(token: &str) -> Result<String, Box<EvalAltResult>> {
+    let mut unescaped = String::with_capacity(token.len());
+    let mut characters = token.chars();
+    while let Some(character) = characters.next() {
+        if character != '~' {
+            unescaped.push(character);
+            continue;
+        }
+        match characters.next() {
+            Some('0') => unescaped.push('~'),
+            Some('1') => unescaped.push('/'),
+            _ => return Err(primitive_error("invalid_pointer")),
+        }
+    }
+    Ok(unescaped)
+}
+
+/// Accepts only the canonical decimal index RFC 6901 defines, which leaves no way to
+/// express the negative index Rhai would otherwise count from the end of an array.
+fn reference_token_index(token: &str) -> Result<usize, Box<EvalAltResult>> {
+    let canonical = token == "0"
+        || (!token.is_empty()
+            && !token.starts_with('0')
+            && token.bytes().all(|byte| byte.is_ascii_digit()));
+    if !canonical {
+        return Err(primitive_error("invalid_pointer"));
+    }
+    token
+        .parse()
+        .map_err(|_| primitive_error("pointer_out_of_bounds"))
+}
+
+fn parse_date(input: &str) -> Result<CalendarDate, Box<EvalAltResult>> {
+    CalendarDate::parse(input).map_err(|_| primitive_error("invalid_date"))
+}
+
+fn parse_instant(input: &str) -> Result<UtcInstant, Box<EvalAltResult>> {
+    UtcInstant::parse(input).map_err(|_| primitive_error("invalid_instant"))
+}
+
+fn parse_decimal(input: &str) -> Result<Decimal, Box<EvalAltResult>> {
+    Decimal::parse(input).map_err(|_| primitive_error("invalid_decimal"))
+}
+
+fn integer_to_decimal(value: INT) -> Decimal {
+    Decimal::from_integer(value)
+}
+
+fn add_calendar_years(date: CalendarDate, years: INT) -> Result<CalendarDate, Box<EvalAltResult>> {
+    if !(-1_000..=1_000).contains(&years) {
+        return Err(primitive_error("calendar_years_out_of_bounds"));
+    }
+    let months = years
+        .checked_mul(12)
+        .ok_or_else(|| primitive_error("calendar_years_out_of_bounds"))?;
+    add_calendar_months(date, months)
+}
+
+fn add_calendar_months(
+    date: CalendarDate,
+    months: INT,
+) -> Result<CalendarDate, Box<EvalAltResult>> {
+    if !(-12_000..=12_000).contains(&months) {
+        return Err(primitive_error("calendar_months_out_of_bounds"));
+    }
+    let month_index = i64::from(date.0.year())
+        .checked_mul(12)
+        .and_then(|value| value.checked_add(i64::from(date.0.month0())))
+        .and_then(|value| value.checked_add(months))
+        .ok_or_else(|| primitive_error("invalid_calendar_result"))?;
+    let year = i32::try_from(month_index.div_euclid(12))
+        .map_err(|_| primitive_error("invalid_calendar_result"))?;
+    let month = u32::try_from(month_index.rem_euclid(12) + 1)
+        .map_err(|_| primitive_error("invalid_calendar_result"))?;
+    let day = date.0.day().min(last_day_of_month(year, month)?);
+    NaiveDate::from_ymd_opt(year, month, day)
+        .map(CalendarDate)
+        .ok_or_else(|| primitive_error("invalid_calendar_result"))
+}
+
+fn compare_dates(left: CalendarDate, right: CalendarDate) -> INT {
+    ordering_value(left.cmp(&right))
+}
+
+fn compare_instants(left: UtcInstant, right: UtcInstant) -> INT {
+    ordering_value(left.cmp(&right))
+}
+
+fn days_between(first: CalendarDate, second: CalendarDate) -> Result<INT, Box<EvalAltResult>> {
+    let days = second.0.signed_duration_since(first.0).num_days();
+    if !(-365_000..=365_000).contains(&days) {
+        return Err(primitive_error("calendar_days_out_of_bounds"));
+    }
+    Ok(days)
+}
+
+fn compare_decimals(left: Decimal, right: Decimal) -> INT {
+    ordering_value(left.compare(&right))
+}
+
+fn bucket_number(value: Decimal, boundaries: Array) -> Result<ImmutableString, Box<EvalAltResult>> {
+    if boundaries.is_empty() || boundaries.len() > MAXIMUM_BUCKETS {
+        return Err(primitive_error("invalid_numeric_buckets"));
+    }
+
+    let mut parsed = Vec::with_capacity(boundaries.len());
+    let mut codes = BTreeSet::new();
+    for boundary in boundaries {
+        let map = boundary
+            .try_cast::<Map>()
+            .ok_or_else(|| primitive_error("invalid_numeric_buckets"))?;
+        if !has_exact_keys(&map, &["minimumInclusive", "maximumExclusive", "code"]) {
+            return Err(primitive_error("invalid_numeric_buckets"));
+        }
+        let minimum = map["minimumInclusive"]
+            .clone()
+            .try_cast::<Decimal>()
+            .ok_or_else(|| primitive_error("invalid_numeric_buckets"))?;
+        let maximum = map["maximumExclusive"]
+            .clone()
+            .try_cast::<Decimal>()
+            .ok_or_else(|| primitive_error("invalid_numeric_buckets"))?;
+        let code = map["code"]
+            .clone()
+            .try_cast::<ImmutableString>()
+            .ok_or_else(|| primitive_error("invalid_numeric_buckets"))?;
+        if minimum.compare(&maximum) != Ordering::Less
+            || code.is_empty()
+            || code.len() > MAXIMUM_STRING_BYTES
+            || !codes.insert(code.to_string())
+        {
+            return Err(primitive_error("invalid_numeric_buckets"));
+        }
+        if parsed.last().is_some_and(
+            |(_, previous_maximum, _): &(Decimal, Decimal, ImmutableString)| {
+                previous_maximum.compare(&minimum) != Ordering::Equal
+            },
+        ) {
+            return Err(primitive_error("invalid_numeric_buckets"));
+        }
+        parsed.push((minimum, maximum, code));
+    }
+
+    parsed
+        .into_iter()
+        .find(|(minimum, maximum, _)| {
+            value.compare(minimum) != Ordering::Less && value.compare(maximum) == Ordering::Less
+        })
+        .map(|(_, _, code)| code)
+        .ok_or_else(|| primitive_error("number_outside_bucket_range"))
+}
+
+fn entity_reference_seed(input: &str) -> Result<EntityReferenceSeed, Box<EvalAltResult>> {
+    EntityReferenceSeed::new(input).map_err(|_| primitive_error("invalid_entity_reference_seed"))
+}
+
+fn codelist_lookup(handle: CodelistHandle, code: &str) -> Dynamic {
+    handle
+        .entries
+        .get(code)
+        .cloned()
+        .map(Dynamic::from)
+        .unwrap_or(Dynamic::UNIT)
+}
+
+fn list_contains(values: Array, needle: Dynamic) -> Result<bool, Box<EvalAltResult>> {
+    let needle = scalar_value(&needle).ok_or_else(|| primitive_error("invalid_scalar"))?;
+    let values = bounded_scalar_values(&values)?;
+    Ok(values.contains(&needle))
+}
+
+fn set_contains(values: Array, needle: Dynamic) -> Result<bool, Box<EvalAltResult>> {
+    let needle = scalar_value(&needle).ok_or_else(|| primitive_error("invalid_scalar"))?;
+    let values = bounded_scalar_values(&values)?;
+    let mut unique = BTreeSet::new();
+    for value in values {
+        if !unique.insert(value) {
+            return Err(primitive_error("set_contains_duplicate"));
+        }
+    }
+    Ok(unique.contains(&needle))
+}
+
+/// Validates the whole bounded collection before any containment answer exists, so a
+/// value that violates the declared `array<scalar>` input fails even when an earlier
+/// item already matches.
+fn bounded_scalar_values(values: &Array) -> Result<Vec<ScalarValue>, Box<EvalAltResult>> {
+    if values.len() > MAXIMUM_ARRAY_ITEMS {
+        return Err(primitive_error("collection_out_of_bounds"));
+    }
+    values
+        .iter()
+        .map(|value| scalar_value(value).ok_or_else(|| primitive_error("invalid_scalar")))
+        .collect()
+}
+
+fn bounded_array_push(array: &mut Array, value: Dynamic) -> Result<(), Box<EvalAltResult>> {
+    if array.len() >= MAXIMUM_ARRAY_ITEMS {
+        return Err(primitive_error("collection_out_of_bounds"));
+    }
+    array.push(value);
+    Ok(())
+}
+
+fn literal_string_replace(
+    value: &mut ImmutableString,
+    from: &str,
+    to: &str,
+) -> Result<(), Box<EvalAltResult>> {
+    let occurrences = if from.is_empty() {
+        value.chars().count().saturating_add(1)
+    } else {
+        value.match_indices(from).count()
+    };
+    let retained = if from.is_empty() {
+        value.len()
+    } else {
+        value
+            .len()
+            .checked_sub(
+                occurrences
+                    .checked_mul(from.len())
+                    .ok_or_else(|| primitive_error("string_out_of_bounds"))?,
+            )
+            .ok_or_else(|| primitive_error("string_out_of_bounds"))?
+    };
+    let output_len = retained
+        .checked_add(
+            occurrences
+                .checked_mul(to.len())
+                .ok_or_else(|| primitive_error("string_out_of_bounds"))?,
+        )
+        .ok_or_else(|| primitive_error("string_out_of_bounds"))?;
+    if output_len > MAXIMUM_STRING_BYTES {
+        return Err(primitive_error("string_out_of_bounds"));
+    }
+    *value = value.replace(from, to).into();
+    Ok(())
+}
+
+fn parse_integer(value: &str) -> Result<INT, Box<EvalAltResult>> {
+    let digits = value.strip_prefix('-').unwrap_or(value);
+    if digits.is_empty()
+        || !digits.bytes().all(|byte| byte.is_ascii_digit())
+        || value.starts_with('+')
+    {
+        return Err(primitive_error("invalid_integer"));
+    }
+    value
+        .parse::<INT>()
+        .map_err(|_| primitive_error("invalid_integer"))
+}
+
+/// Returns the value, or terminates the invocation with the host-private unavailable
+/// signal.
+///
+/// The second argument is validated as a safe shape and then deliberately discarded.
+/// Shape validation cannot prove that a code is a reviewed bundle literal rather than a
+/// value derived from protected source data, so carrying it into any observable failure
+/// would open a disclosure channel. Every unavailable termination therefore collapses to
+/// the same value-free class in public problems, audit, and service logs.
+fn required(value: Dynamic, error_code: &str) -> Result<Dynamic, Box<EvalAltResult>> {
+    if !is_safe_error_code(error_code) {
+        return Err(primitive_error("invalid_required_error_code"));
+    }
+    if value.is_unit() {
+        return Err(EvalAltResult::ErrorRuntime(
+            Dynamic::from(RequiredUnavailable),
+            rhai::Position::NONE,
+        )
+        .into());
+    }
+    Ok(value)
+}
+
+#[derive(Clone, Copy)]
+enum ScriptStage {
+    Preparation,
+    Extraction,
+    Derivation,
+}
+
+fn classify_invocation_error(error: Box<EvalAltResult>, stage: ScriptStage) -> RhaiRuntimeError {
+    if contains_unavailable_signal(&error) {
+        RhaiRuntimeError::Unavailable
+    } else {
+        match stage {
+            ScriptStage::Preparation if contains_runtime_signal(&error, "adapter_input_error") => {
+                RhaiRuntimeError::AdapterInput
+            }
+            ScriptStage::Extraction if contains_runtime_signal(&error, "source_protocol_error") => {
+                RhaiRuntimeError::SourceProtocol
+            }
+            ScriptStage::Derivation
+                if contains_runtime_signal(&error, "derivation_input_error") =>
+            {
+                RhaiRuntimeError::DerivationInput
+            }
+            _ => RhaiRuntimeError::Invocation,
+        }
+    }
+}
+
+fn contains_unavailable_signal(error: &EvalAltResult) -> bool {
+    match error {
+        EvalAltResult::ErrorRuntime(value, _) => value.is::<RequiredUnavailable>(),
+        EvalAltResult::ErrorInFunctionCall(_, _, inner, _)
+        | EvalAltResult::ErrorInModule(_, inner, _) => contains_unavailable_signal(inner),
+        _ => false,
+    }
+}
+
+fn contains_runtime_signal(error: &EvalAltResult, expected: &str) -> bool {
+    match error {
+        EvalAltResult::ErrorRuntime(value, _) => value
+            .clone()
+            .try_cast::<ImmutableString>()
+            .is_some_and(|signal| signal.as_str() == expected),
+        EvalAltResult::ErrorInFunctionCall(_, _, inner, _)
+        | EvalAltResult::ErrorInModule(_, inner, _) => contains_runtime_signal(inner, expected),
+        _ => false,
+    }
+}
+
+fn is_missing(value: Dynamic) -> bool {
+    value.is_unit()
+}
+
+fn decode_lookup_result<V>(
+    result: Dynamic,
+    fact_schema: &V,
+) -> Result<LookupResult, RhaiRuntimeError>
+where
+    V: FactSchemaValidator + ?Sized,
+{
+    let map = result
+        .try_cast::<Map>()
+        .ok_or(RhaiRuntimeError::ExtractionResult)?;
+    let outcome = map
+        .get("outcome")
+        .and_then(|value| value.clone().try_cast::<ImmutableString>())
+        .ok_or(RhaiRuntimeError::ExtractionResult)?;
+    match outcome.as_str() {
+        "no_match" if has_exact_keys(&map, &["outcome"]) => Ok(LookupResult::NoMatch),
+        "ambiguous" if has_exact_keys(&map, &["outcome"]) => Ok(LookupResult::Ambiguous),
+        "match" if has_exact_keys(&map, &["outcome", "facts"]) => {
+            let facts_dynamic = map.get("facts").ok_or(RhaiRuntimeError::ExtractionResult)?;
+            if !dynamic_is_json(facts_dynamic, FloatAdmission::AdapterSurface) {
+                return Err(RhaiRuntimeError::ExtractionResult);
+            }
+            let facts: Value = rhai::serde::from_dynamic(facts_dynamic)
+                .map_err(|_| RhaiRuntimeError::ExtractionResult)?;
+            let object = facts
+                .as_object()
+                .ok_or(RhaiRuntimeError::ExtractionResult)?;
+            if object.len() > MAXIMUM_FACT_ENTRIES {
+                return Err(RhaiRuntimeError::ExtractionResult);
+            }
+            validate_json_bound(&facts, MAXIMUM_RESULT_BYTES)
+                .map_err(|_| RhaiRuntimeError::ExtractionResult)?;
+            if !fact_schema.is_valid(&facts) {
+                return Err(RhaiRuntimeError::FactSchema);
+            }
+            Ok(LookupResult::Match(
+                object
+                    .iter()
+                    .map(|(name, value)| (name.clone(), value.clone()))
+                    .collect(),
+            ))
+        }
+        _ => Err(RhaiRuntimeError::ExtractionResult),
+    }
+}
+
+fn decode_derivation_result(result: Dynamic) -> Result<Vec<DerivedConceptValue>, RhaiRuntimeError> {
+    let array = result
+        .try_cast::<Array>()
+        .ok_or(RhaiRuntimeError::DerivationResult)?;
+    if array.is_empty() || array.len() > MAXIMUM_CONCEPT_VALUES {
+        return Err(RhaiRuntimeError::DerivationResult);
+    }
+    let mut result = Vec::with_capacity(array.len());
+    let mut identifiers = BTreeSet::new();
+    let mut total_bytes = 2usize;
+    for item in array {
+        let map = item
+            .try_cast::<Map>()
+            .ok_or(RhaiRuntimeError::DerivationResult)?;
+        if !has_exact_keys(&map, &["concept_id", "value"]) {
+            return Err(RhaiRuntimeError::DerivationResult);
+        }
+        let concept_id = map["concept_id"]
+            .clone()
+            .try_cast::<ImmutableString>()
+            .ok_or(RhaiRuntimeError::DerivationResult)?
+            .to_string();
+        if concept_id.is_empty()
+            || concept_id.len() > MAXIMUM_STRING_BYTES
+            || !identifiers.insert(concept_id.clone())
+        {
+            return Err(RhaiRuntimeError::DerivationResult);
+        }
+        let value = decode_derived_value(map["value"].clone())?;
+        let encoded_identifier = serde_json::to_vec(&concept_id)
+            .map_err(|_| RhaiRuntimeError::DerivationResult)?
+            .len();
+        total_bytes = total_bytes
+            .checked_add(encoded_identifier)
+            .and_then(|total| total.checked_add(derived_value_size(&value).ok()?))
+            .and_then(|total| total.checked_add(29))
+            .ok_or(RhaiRuntimeError::DerivationResult)?;
+        if total_bytes > MAXIMUM_RESULT_BYTES {
+            return Err(RhaiRuntimeError::DerivationResult);
+        }
+        result.push(DerivedConceptValue { concept_id, value });
+    }
+    Ok(result)
+}
+
+fn decode_derived_value(value: Dynamic) -> Result<DerivedValue, RhaiRuntimeError> {
+    if value.is::<Decimal>() {
+        return Ok(DerivedValue::Decimal(value.cast::<Decimal>()));
+    }
+    if value.is::<EntityReferenceSeed>() {
+        return Ok(DerivedValue::EntityReferenceSeed(
+            value.cast::<EntityReferenceSeed>(),
+        ));
+    }
+    if value.is_array() {
+        let array = value.clone_cast::<Array>();
+        if array.iter().any(Dynamic::is::<EntityReferenceSeed>) {
+            if array.is_empty()
+                || array.len() > MAXIMUM_ENTITY_REFERENCE_ITEMS
+                || !array.iter().all(Dynamic::is::<EntityReferenceSeed>)
+            {
+                return Err(RhaiRuntimeError::DerivationResult);
+            }
+            return Ok(DerivedValue::EntityReferenceSeedList(
+                array
+                    .into_iter()
+                    .map(Dynamic::cast::<EntityReferenceSeed>)
+                    .collect(),
+            ));
+        }
+    }
+    if !dynamic_is_json(&value, FloatAdmission::Rejected) {
+        return Err(RhaiRuntimeError::DerivationResult);
+    }
+    let json = rhai::serde::from_dynamic::<Value>(&value)
+        .map_err(|_| RhaiRuntimeError::DerivationResult)?;
+    validate_json_bound(&json, MAXIMUM_RESULT_BYTES)
+        .map_err(|_| RhaiRuntimeError::DerivationResult)?;
+    Ok(DerivedValue::Json(json))
+}
+
+/// Reviews the reviewed-language surface and returns the source with every index
+/// operand routed through the host-owned index guard. The raw engine remains the
+/// capability boundary; this lexical review is an enforceable language contract over
+/// governed bundle scripts and is not claimed as a sandbox perimeter.
+///
+/// This scanner mirrors the pinned `rhai` lexer's operand-position and
+/// brace-disambiguation rules. Bumping the `rhai` dependency requires
+/// re-validating this scanner against the new lexer: over-acceptance only weakens
+/// a defense-in-depth guard over trusted scripts (the runtime negative-index guard
+/// still holds), while over-rejection breaks a valid adapter and is caught by the
+/// scanner and fixture tests.
+fn guarded_script_source(source: &str) -> Result<String, RhaiRuntimeError> {
+    validate_top_level_functions(source)?;
+    let mut insertions = review_script_bytes(source)?;
+    insertions.sort_by_key(|(offset, _)| *offset);
+    let mut guarded = String::with_capacity(source.len());
+    let mut copied = 0usize;
+    for (offset, guard) in insertions {
+        guarded.push_str(&source[copied..offset]);
+        match guard {
+            IndexGuard::Open => {
+                guarded.push_str(INDEX_GUARD_FUNCTION);
+                guarded.push('(');
+            }
+            IndexGuard::Close => guarded.push(')'),
+        }
+        copied = offset;
+    }
+    guarded.push_str(&source[copied..]);
+    Ok(guarded)
+}
+
+fn validate_top_level_functions(source: &str) -> Result<(), RhaiRuntimeError> {
+    let mut cursor = ScriptCursor::new(source);
+    while cursor.skip_trivia()? {
+        let _private = cursor.consume_word("private");
+        cursor.skip_trivia()?;
+        if !cursor.consume_word("fn") {
+            return Err(RhaiRuntimeError::Compilation);
+        }
+        cursor.skip_trivia()?;
+        if !cursor.consume_identifier() {
+            return Err(RhaiRuntimeError::Compilation);
+        }
+        cursor.skip_trivia()?;
+        cursor.consume_balanced(b'(', b')')?;
+        cursor.skip_trivia()?;
+        cursor.consume_balanced(b'{', b'}')?;
+    }
+    Ok(())
+}
+
+/// Walks the script the way Rhai 1.25.1 tokenizes it, rejects the forbidden constructs,
+/// and reports where the index guard must wrap an index operand.
+fn review_script_bytes(source: &str) -> Result<Vec<(usize, IndexGuard)>, RhaiRuntimeError> {
+    let mut cursor = ScriptCursor::new(source);
+    let mut insertions = Vec::new();
+    let mut braces = Vec::new();
+    let mut previous_significant = None;
+    let mut previous_ends_value = false;
+    while cursor.index < cursor.bytes.len() {
+        if cursor.skip_comment()? {
+            continue;
+        }
+        let byte = cursor.bytes[cursor.index];
+        if byte.is_ascii_whitespace() {
+            cursor.index += 1;
+            continue;
+        }
+        match byte {
+            b'"' | b'\'' => {
+                cursor.skip_quoted()?;
+                previous_significant = Some(byte);
+                previous_ends_value = true;
+            }
+            b'`' => return Err(RhaiRuntimeError::Compilation),
+            b'#' => {
+                cursor.consume_map_literal_start()?;
+                braces.push(BraceKind::MapLiteral);
+                previous_significant = Some(b'{');
+                previous_ends_value = false;
+            }
+            b'{' => {
+                if expects_operand(previous_significant) {
+                    return Err(RhaiRuntimeError::Compilation);
+                }
+                cursor.index += 1;
+                braces.push(BraceKind::Block);
+                previous_significant = Some(b'{');
+                previous_ends_value = false;
+            }
+            b'}' => {
+                let kind = braces.pop().ok_or(RhaiRuntimeError::Compilation)?;
+                cursor.index += 1;
+                previous_significant = Some(b'}');
+                previous_ends_value = kind == BraceKind::MapLiteral;
+            }
+            b'[' if previous_ends_value => {
+                let close = cursor.matching_bracket()?;
+                cursor.index += 1;
+                if cursor.negative_literal_follows()? {
+                    return Err(RhaiRuntimeError::Compilation);
+                }
+                insertions.push((cursor.index, IndexGuard::Open));
+                insertions.push((close, IndexGuard::Close));
+                previous_significant = Some(b'[');
+                previous_ends_value = false;
+            }
+            _ if is_identifier_start(byte) => {
+                let word = cursor.take_identifier();
+                if word == "Fn"
+                    || word == INDEX_GUARD_FUNCTION
+                    || matches!(word, "call" | "curry") && previous_significant == Some(b'.')
+                    || word == "if" && expects_operand(previous_significant)
+                {
+                    return Err(RhaiRuntimeError::Compilation);
+                }
+                previous_significant = word.as_bytes().last().copied();
+                previous_ends_value = !keyword_precedes_value(word);
+            }
+            _ => {
+                cursor.index += 1;
+                previous_significant = Some(byte);
+                previous_ends_value = matches!(byte, b')' | b']') || byte.is_ascii_digit();
+            }
+        }
+    }
+    if !braces.is_empty() {
+        return Err(RhaiRuntimeError::Compilation);
+    }
+    Ok(insertions)
+}
+
+/// Whether the previous significant byte leaves an expression waiting for an operand.
+///
+/// Rhai indexes a block or an `if` chain that sits in operand position, so `}` there ends
+/// a value while `}` at statement position does not. A byte scanner cannot tell those two
+/// closing braces apart, and a missing guard would restore negative indexing. Both forms
+/// are therefore outside the reviewed language, which keeps every remaining `[` exactly
+/// classifiable.
+fn expects_operand(previous_significant: Option<u8>) -> bool {
+    matches!(
+        previous_significant,
+        Some(
+            b'=' | b'('
+                | b','
+                | b':'
+                | b'['
+                | b'+'
+                | b'-'
+                | b'*'
+                | b'/'
+                | b'%'
+                | b'<'
+                | b'>'
+                | b'!'
+                | b'&'
+                | b'|'
+                | b'^'
+                | b'?'
+        )
+    )
+}
+
+/// Reserved words after which `[` opens an array literal instead of indexing a value.
+fn keyword_precedes_value(word: &str) -> bool {
+    matches!(
+        word,
+        "as" | "break"
+            | "case"
+            | "catch"
+            | "const"
+            | "continue"
+            | "do"
+            | "else"
+            | "export"
+            | "fn"
+            | "for"
+            | "if"
+            | "import"
+            | "in"
+            | "let"
+            | "loop"
+            | "private"
+            | "return"
+            | "switch"
+            | "throw"
+            | "try"
+            | "until"
+            | "while"
+    )
+}
+
+#[derive(Clone, Copy)]
+enum IndexGuard {
+    Open,
+    Close,
+}
+
+/// Whether a closing brace ends a map literal, which is a value, or a block, which is
+/// not. The distinction decides whether a following `[` indexes or opens an array.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum BraceKind {
+    Block,
+    MapLiteral,
+}
+
+/// Rejects a negative array index however it was computed, because Rhai counts a
+/// negative index from the end of the array.
+fn guard_index(index: INT) -> Result<INT, Box<EvalAltResult>> {
+    if index < 0 {
+        return Err(primitive_error("negative_index"));
+    }
+    Ok(index)
+}
+
+fn guard_index_key(key: ImmutableString) -> ImmutableString {
+    key
+}
+
+struct ScriptCursor<'a> {
+    source: &'a str,
+    bytes: &'a [u8],
+    index: usize,
+}
+
+impl<'a> ScriptCursor<'a> {
+    fn new(source: &'a str) -> Self {
+        Self {
+            source,
+            bytes: source.as_bytes(),
+            index: 0,
+        }
+    }
+
+    fn skip_trivia(&mut self) -> Result<bool, RhaiRuntimeError> {
+        loop {
+            while self
+                .bytes
+                .get(self.index)
+                .is_some_and(u8::is_ascii_whitespace)
+            {
+                self.index += 1;
+            }
+            if !self.skip_comment()? {
+                return Ok(self.index < self.bytes.len());
+            }
+        }
+    }
+
+    fn skip_noise(&mut self) -> Result<bool, RhaiRuntimeError> {
+        if self.skip_comment()? {
+            return Ok(true);
+        }
+        match self.bytes.get(self.index).copied() {
+            Some(b'"' | b'\'') => {
+                self.skip_quoted()?;
+                Ok(true)
+            }
+            Some(b'`') => Err(RhaiRuntimeError::Compilation),
+            Some(b'#') => {
+                self.check_map_literal_start()?;
+                Ok(false)
+            }
+            _ => Ok(false),
+        }
+    }
+
+    /// Rhai 1.25.1 reads `#"..."#` and `##"..."##` as raw strings, whose bodies may
+    /// contain quotes. Only `#{` stays inside the reviewed language, so every other `#`
+    /// fails rather than letting this scanner and the Rhai tokenizer disagree about
+    /// where a string ends.
+    fn check_map_literal_start(&self) -> Result<(), RhaiRuntimeError> {
+        if self.bytes.get(self.index + 1) != Some(&b'{') {
+            return Err(RhaiRuntimeError::Compilation);
+        }
+        Ok(())
+    }
+
+    fn consume_map_literal_start(&mut self) -> Result<(), RhaiRuntimeError> {
+        self.check_map_literal_start()?;
+        self.index += 2;
+        Ok(())
+    }
+
+    /// Position of the `]` that closes the bracket at the cursor.
+    fn matching_bracket(&self) -> Result<usize, RhaiRuntimeError> {
+        let mut cursor = ScriptCursor {
+            source: self.source,
+            bytes: self.bytes,
+            index: self.index,
+        };
+        let mut depth = 0usize;
+        while cursor.index < cursor.bytes.len() {
+            if cursor.skip_noise()? {
+                continue;
+            }
+            match cursor.bytes[cursor.index] {
+                b'[' => depth += 1,
+                b']' => {
+                    depth -= 1;
+                    if depth == 0 {
+                        return Ok(cursor.index);
+                    }
+                }
+                _ => {}
+            }
+            cursor.index += 1;
+        }
+        Err(RhaiRuntimeError::Compilation)
+    }
+
+    /// Whether the expression at the cursor opens with a negative numeric literal.
+    fn negative_literal_follows(&self) -> Result<bool, RhaiRuntimeError> {
+        let mut lookahead = ScriptCursor {
+            source: self.source,
+            bytes: self.bytes,
+            index: self.index,
+        };
+        lookahead.skip_trivia()?;
+        if lookahead.bytes.get(lookahead.index) != Some(&b'-') {
+            return Ok(false);
+        }
+        lookahead.index += 1;
+        lookahead.skip_trivia()?;
+        Ok(lookahead
+            .bytes
+            .get(lookahead.index)
+            .is_some_and(u8::is_ascii_digit))
+    }
+
+    fn take_identifier(&mut self) -> &'a str {
+        let start = self.index;
+        self.index += 1;
+        while self
+            .bytes
+            .get(self.index)
+            .is_some_and(|byte| is_identifier_continue(*byte))
+        {
+            self.index += 1;
+        }
+        &self.source[start..self.index]
+    }
+
+    fn skip_comment(&mut self) -> Result<bool, RhaiRuntimeError> {
+        if self.bytes.get(self.index..self.index + 2) == Some(b"//") {
+            self.index += 2;
+            while self.index < self.bytes.len() && self.bytes[self.index] != b'\n' {
+                self.index += 1;
+            }
+            return Ok(true);
+        }
+        if self.bytes.get(self.index..self.index + 2) == Some(b"/*") {
+            self.index += 2;
+            while self.index + 1 < self.bytes.len()
+                && self.bytes.get(self.index..self.index + 2) != Some(b"*/")
+            {
+                self.index += 1;
+            }
+            if self.bytes.get(self.index..self.index + 2) != Some(b"*/") {
+                return Err(RhaiRuntimeError::Compilation);
+            }
+            self.index += 2;
+            return Ok(true);
+        }
+        Ok(false)
+    }
+
+    fn skip_quoted(&mut self) -> Result<(), RhaiRuntimeError> {
+        let quote = self.bytes[self.index];
+        self.index += 1;
+        while self.index < self.bytes.len() {
+            match self.bytes[self.index] {
+                b'\\' => self.index = self.index.saturating_add(2),
+                byte if byte == quote => {
+                    self.index += 1;
+                    return Ok(());
+                }
+                _ => self.index += 1,
+            }
+        }
+        Err(RhaiRuntimeError::Compilation)
+    }
+
+    fn consume_word(&mut self, expected: &str) -> bool {
+        let remaining = &self.source[self.index..];
+        if !remaining.starts_with(expected) {
+            return false;
+        }
+        let end = self.index + expected.len();
+        if self
+            .bytes
+            .get(end)
+            .is_some_and(|byte| is_identifier_continue(*byte))
+        {
+            return false;
+        }
+        self.index = end;
+        true
+    }
+
+    fn consume_identifier(&mut self) -> bool {
+        if !self
+            .bytes
+            .get(self.index)
+            .is_some_and(|byte| is_identifier_start(*byte))
+        {
+            return false;
+        }
+        self.index += 1;
+        while self
+            .bytes
+            .get(self.index)
+            .is_some_and(|byte| is_identifier_continue(*byte))
+        {
+            self.index += 1;
+        }
+        true
+    }
+
+    fn consume_balanced(&mut self, open: u8, close: u8) -> Result<(), RhaiRuntimeError> {
+        if self.bytes.get(self.index) != Some(&open) {
+            return Err(RhaiRuntimeError::Compilation);
+        }
+        let mut depth = 0usize;
+        while self.index < self.bytes.len() {
+            if self.skip_noise()? {
+                continue;
+            }
+            match self.bytes[self.index] {
+                byte if byte == open => depth += 1,
+                byte if byte == close => {
+                    depth -= 1;
+                    self.index += 1;
+                    if depth == 0 {
+                        return Ok(());
+                    }
+                    continue;
+                }
+                _ => {}
+            }
+            self.index += 1;
+        }
+        Err(RhaiRuntimeError::Compilation)
+    }
+}
+
+fn is_identifier_start(byte: u8) -> bool {
+    byte.is_ascii_alphabetic() || byte == b'_'
+}
+
+fn is_identifier_continue(byte: u8) -> bool {
+    is_identifier_start(byte) || byte.is_ascii_digit()
+}
+
+fn validate_adapter_inputs(selectors: &Value, parameters: &Value) -> Result<(), RhaiRuntimeError> {
+    validate_adapter_object(selectors)?;
+    validate_adapter_object(parameters)?;
+    let combined = Value::Array(vec![selectors.clone(), parameters.clone()]);
+    let size = serde_json::to_vec(&combined)
+        .map_err(|_| RhaiRuntimeError::AdapterInput)?
+        .len();
+    if size > MAXIMUM_PREPARATION_INPUT_BYTES {
+        return Err(RhaiRuntimeError::InputBound);
+    }
+    Ok(())
+}
+
+fn validate_adapter_object(value: &Value) -> Result<(), RhaiRuntimeError> {
+    if !value.is_object() || !adapter_value_is_supported(value) {
+        return Err(RhaiRuntimeError::AdapterInput);
+    }
+    Ok(())
+}
+
+fn adapter_value_is_supported(value: &Value) -> bool {
+    match value {
+        Value::Bool(_) => true,
+        Value::Number(value) => value.as_i64().is_some(),
+        Value::String(value) => value.len() <= MAXIMUM_STRING_BYTES,
+        Value::Array(values) => {
+            values.len() <= MAXIMUM_ARRAY_ITEMS && values.iter().all(adapter_value_is_supported)
+        }
+        Value::Object(values) => {
+            values.len() <= MAXIMUM_MAP_ENTRIES
+                && !is_typed_derivation_envelope(values)
+                && values.iter().all(|(name, value)| {
+                    name.len() <= MAXIMUM_STRING_BYTES && adapter_value_is_supported(value)
+                })
+        }
+        Value::Null => false,
+    }
+}
+
+fn adapter_object_to_dynamic(value: &Value) -> Result<Dynamic, RhaiRuntimeError> {
+    let object = value.as_object().ok_or(RhaiRuntimeError::AdapterInput)?;
+    object
+        .iter()
+        .map(|(name, value)| Ok((name.as_str().into(), adapter_value_to_dynamic(value)?)))
+        .collect::<Result<Map, RhaiRuntimeError>>()
+        .map(Dynamic::from)
+}
+
+fn adapter_value_to_dynamic(value: &Value) -> Result<Dynamic, RhaiRuntimeError> {
+    match value {
+        Value::Bool(value) => Ok(Dynamic::from(*value)),
+        Value::Number(value) => value
+            .as_i64()
+            .map(Dynamic::from)
+            .ok_or(RhaiRuntimeError::AdapterInput),
+        Value::String(value) if value.len() <= MAXIMUM_STRING_BYTES => {
+            Ok(Dynamic::from(value.clone()))
+        }
+        Value::Array(values) if values.len() <= MAXIMUM_ARRAY_ITEMS => values
+            .iter()
+            .map(adapter_value_to_dynamic)
+            .collect::<Result<Array, _>>()
+            .map(Dynamic::from),
+        Value::Object(values)
+            if values.len() <= MAXIMUM_MAP_ENTRIES && !is_typed_derivation_envelope(values) =>
+        {
+            values
+                .iter()
+                .map(|(name, value)| {
+                    if name.len() > MAXIMUM_STRING_BYTES {
+                        return Err(RhaiRuntimeError::AdapterInput);
+                    }
+                    Ok((name.as_str().into(), adapter_value_to_dynamic(value)?))
+                })
+                .collect::<Result<Map, _>>()
+                .map(Dynamic::from)
+        }
+        _ => Err(RhaiRuntimeError::AdapterInput),
+    }
+}
+
+fn is_typed_derivation_envelope(values: &serde_json::Map<String, Value>) -> bool {
+    values.len() == 2
+        && values.get("type") == Some(&Value::String("decimal".to_string()))
+        && values.get("value").is_some_and(Value::is_string)
+}
+
+fn decode_request_parts(
+    result: Dynamic,
+    limits: &RequestPartsLimits,
+) -> Result<RequestParts, RhaiRuntimeError> {
+    let map = result
+        .try_cast::<Map>()
+        .ok_or(RhaiRuntimeError::PreparationResult)?;
+    if !has_exact_keys(&map, &["query", "body"]) {
+        return Err(RhaiRuntimeError::PreparationResult);
+    }
+
+    let query = map["query"]
+        .clone()
+        .try_cast::<Array>()
+        .ok_or(RhaiRuntimeError::PreparationResult)?;
+    if query.len() > limits.maximum_query_pairs || query.len() > MAXIMUM_QUERY_PAIRS {
+        return Err(RhaiRuntimeError::PreparationResult);
+    }
+    let query = query
+        .into_iter()
+        .map(|pair| {
+            let pair = pair
+                .try_cast::<Map>()
+                .ok_or(RhaiRuntimeError::PreparationResult)?;
+            if !has_exact_keys(&pair, &["name", "value"]) {
+                return Err(RhaiRuntimeError::PreparationResult);
+            }
+            let name = pair["name"]
+                .clone()
+                .try_cast::<ImmutableString>()
+                .ok_or(RhaiRuntimeError::PreparationResult)?
+                .to_string();
+            let value = pair["value"]
+                .clone()
+                .try_cast::<ImmutableString>()
+                .ok_or(RhaiRuntimeError::PreparationResult)?
+                .to_string();
+            if name.is_empty()
+                || name.len() > limits.maximum_query_name_bytes
+                || name.len() > MAXIMUM_QUERY_NAME_BYTES
+                || name.len() > limits.maximum_string_bytes
+                || value.len() > limits.maximum_query_value_bytes
+                || value.len() > MAXIMUM_QUERY_VALUE_BYTES
+                || value.len() > limits.maximum_string_bytes
+                || name.bytes().any(|byte| matches!(byte, b'\r' | b'\n'))
+                || value.bytes().any(|byte| matches!(byte, b'\r' | b'\n'))
+            {
+                return Err(RhaiRuntimeError::PreparationResult);
+            }
+            Ok(QueryPair { name, value })
+        })
+        .collect::<Result<Vec<_>, RhaiRuntimeError>>()?;
+
+    validate_part_requirement(limits.query, !query.is_empty())?;
+    let body = if map["body"].is_unit() {
+        None
+    } else {
+        if !dynamic_is_json(&map["body"], FloatAdmission::AdapterSurface) {
+            return Err(RhaiRuntimeError::PreparationResult);
+        }
+        let body = rhai::serde::from_dynamic::<Value>(&map["body"])
+            .map_err(|_| RhaiRuntimeError::PreparationResult)?;
+        if !json_numbers_are_supported(&body)
+            || !json_value_within_limits(
+                &body,
+                limits.maximum_json_depth,
+                limits.maximum_collection_items,
+                limits.maximum_string_bytes,
+            )
+        {
+            return Err(RhaiRuntimeError::PreparationResult);
+        }
+        Some(body)
+    };
+    validate_part_requirement(limits.body, body.is_some())?;
+
+    let normalized = Value::Object(serde_json::Map::from_iter([
+        ("body".to_string(), body.clone().unwrap_or(Value::Null)),
+        (
+            "query".to_string(),
+            Value::Array(
+                query
+                    .iter()
+                    .map(|pair| {
+                        Value::Object(serde_json::Map::from_iter([
+                            ("name".to_string(), Value::String(pair.name.clone())),
+                            ("value".to_string(), Value::String(pair.value.clone())),
+                        ]))
+                    })
+                    .collect(),
+            ),
+        ),
+    ]));
+    let normalized_size = serde_json::to_vec(&normalized)
+        .map_err(|_| RhaiRuntimeError::PreparationResult)?
+        .len();
+    if normalized_size > limits.maximum_normalized_bytes
+        || normalized_size > MAXIMUM_REQUEST_PARTS_BYTES
+    {
+        return Err(RhaiRuntimeError::PreparationResult);
+    }
+    Ok(RequestParts { query, body })
+}
+
+fn validate_part_requirement(
+    requirement: RequestPartRequirement,
+    present: bool,
+) -> Result<(), RhaiRuntimeError> {
+    match (requirement, present) {
+        (RequestPartRequirement::Forbidden, true) | (RequestPartRequirement::Required, false) => {
+            Err(RhaiRuntimeError::PreparationResult)
+        }
+        _ => Ok(()),
+    }
+}
+
+fn json_value_within_limits(
+    value: &Value,
+    maximum_depth: usize,
+    maximum_collection_items: usize,
+    maximum_string_bytes: usize,
+) -> bool {
+    fn visit(
+        value: &Value,
+        container_depth: usize,
+        maximum_depth: usize,
+        maximum_collection_items: usize,
+        maximum_string_bytes: usize,
+    ) -> bool {
+        match value {
+            Value::String(value) => value.len() <= maximum_string_bytes,
+            Value::Array(values) => {
+                container_depth < maximum_depth
+                    && values.len() <= maximum_collection_items
+                    && values.iter().all(|value| {
+                        visit(
+                            value,
+                            container_depth + 1,
+                            maximum_depth,
+                            maximum_collection_items,
+                            maximum_string_bytes,
+                        )
+                    })
+            }
+            Value::Object(values) => {
+                container_depth < maximum_depth
+                    && values.len() <= maximum_collection_items
+                    && values.iter().all(|(name, value)| {
+                        name.len() <= maximum_string_bytes
+                            && visit(
+                                value,
+                                container_depth + 1,
+                                maximum_depth,
+                                maximum_collection_items,
+                                maximum_string_bytes,
+                            )
+                    })
+            }
+            _ => true,
+        }
+    }
+    visit(
+        value,
+        0,
+        maximum_depth,
+        maximum_collection_items,
+        maximum_string_bytes,
+    )
+}
+
+/// Numeric admission for JSON decoded into Rhai. An integer token outside the signed
+/// 64-bit range fails here instead of reaching a script as a precision-losing float; a
+/// provider identifier beyond that range must be represented as a string.
+fn json_numbers_are_supported(value: &Value) -> bool {
+    match value {
+        Value::Number(value) => value.is_i64() || value.as_f64().is_some_and(is_supported_float),
+        Value::Array(values) => values.iter().all(json_numbers_are_supported),
+        Value::Object(values) => values.values().all(json_numbers_are_supported),
+        _ => true,
+    }
+}
+
+/// An ordinary float is carried only when it is finite and its magnitude stays inside the
+/// signed 64-bit integer range, which keeps every admitted number distinguishable from a
+/// silently truncated large integer token.
+fn is_supported_float(value: f64) -> bool {
+    value.is_finite() && value.abs() < INTEGER_MAGNITUDE_LIMIT
+}
+
+/// Whether ordinary Rhai floats may appear in a decoded value.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum FloatAdmission {
+    /// Request preparation and source extraction carry provider-shaped JSON, which may
+    /// contain finite ordinary floats.
+    AdapterSurface,
+    /// Public derived values use the declared integer or exact Decimal forms only.
+    Rejected,
+}
+
+fn dynamic_is_json(value: &Dynamic, floats: FloatAdmission) -> bool {
+    if value.is_unit() || value.is_bool() || value.is_int() || value.is_string() {
+        return true;
+    }
+    if value.is_float() {
+        return floats == FloatAdmission::AdapterSurface
+            && value.as_float().is_ok_and(is_supported_float);
+    }
+    if value.is_array() {
+        return value
+            .clone_cast::<Array>()
+            .iter()
+            .all(|value| dynamic_is_json(value, floats));
+    }
+    if value.is_map() {
+        return value
+            .clone_cast::<Map>()
+            .values()
+            .all(|value| dynamic_is_json(value, floats));
+    }
+    false
+}
+
+fn derived_value_size(value: &DerivedValue) -> Result<usize, RhaiRuntimeError> {
+    match value {
+        DerivedValue::Json(value) => serde_json::to_vec(value)
+            .map(|bytes| bytes.len())
+            .map_err(|_| RhaiRuntimeError::DerivationResult),
+        DerivedValue::Decimal(value) => Ok(value.canonical().len()),
+        DerivedValue::EntityReferenceSeed(value) => Ok(value.expose_for_projection().len()),
+        DerivedValue::EntityReferenceSeedList(values) => {
+            values.iter().try_fold(0usize, |sum, value| {
+                sum.checked_add(value.expose_for_projection().len())
+                    .ok_or(RhaiRuntimeError::DerivationResult)
+            })
+        }
+    }
+}
+
+fn parameters_to_map(parameters: &Value) -> Result<Map, RhaiRuntimeError> {
+    let object = parameters
+        .as_object()
+        .ok_or(RhaiRuntimeError::EvaluationContext)?;
+    if object.len() > MAXIMUM_MAP_ENTRIES {
+        return Err(RhaiRuntimeError::EvaluationContext);
+    }
+    object
+        .iter()
+        .map(|(name, value)| {
+            if name.is_empty() || name.len() > MAXIMUM_STRING_BYTES {
+                return Err(RhaiRuntimeError::EvaluationContext);
+            }
+            Ok((name.as_str().into(), parameter_to_dynamic(value)?))
+        })
+        .collect()
+}
+
+fn parameter_to_dynamic(value: &Value) -> Result<Dynamic, RhaiRuntimeError> {
+    match value {
+        Value::Bool(value) => Ok(Dynamic::from(*value)),
+        Value::Number(value) => value
+            .as_i64()
+            .map(Dynamic::from)
+            .ok_or(RhaiRuntimeError::EvaluationContext),
+        Value::String(value) if value.len() <= MAXIMUM_STRING_BYTES => {
+            Ok(Dynamic::from(value.clone()))
+        }
+        Value::Array(values) if values.len() <= MAXIMUM_ARRAY_ITEMS => values
+            .iter()
+            .map(parameter_to_dynamic)
+            .collect::<Result<Array, _>>()
+            .map(Dynamic::from),
+        Value::Object(object)
+            if object.len() == 2
+                && object.get("type") == Some(&Value::String("decimal".to_string()))
+                && object.get("value").is_some_and(Value::is_string) =>
+        {
+            let text = object["value"]
+                .as_str()
+                .ok_or(RhaiRuntimeError::EvaluationContext)?;
+            Decimal::parse(text)
+                .map(Dynamic::from)
+                .map_err(|_| RhaiRuntimeError::EvaluationContext)
+        }
+        Value::Object(object) if object.len() <= MAXIMUM_MAP_ENTRIES => object
+            .iter()
+            .map(|(name, value)| {
+                if name.is_empty() || name.len() > MAXIMUM_STRING_BYTES {
+                    return Err(RhaiRuntimeError::EvaluationContext);
+                }
+                Ok((name.as_str().into(), parameter_to_dynamic(value)?))
+            })
+            .collect::<Result<Map, _>>()
+            .map(Dynamic::from),
+        _ => Err(RhaiRuntimeError::EvaluationContext),
+    }
+}
+
+#[derive(Clone, PartialEq, Eq, PartialOrd, Ord)]
+enum ScalarValue {
+    Boolean(bool),
+    Integer(INT),
+    String(String),
+    Date(CalendarDate),
+    Instant(UtcInstant),
+    Decimal(String),
+}
+
+impl fmt::Debug for ScalarValue {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let form = match self {
+            Self::Boolean(_) => "boolean",
+            Self::Integer(_) => "integer",
+            Self::String(_) => "string",
+            Self::Date(_) => "date",
+            Self::Instant(_) => "instant",
+            Self::Decimal(_) => "decimal",
+        };
+        formatter
+            .debug_struct("ScalarValue")
+            .field("form", &form)
+            .field("value", &"[REDACTED]")
+            .finish()
+    }
+}
+
+fn scalar_value(value: &Dynamic) -> Option<ScalarValue> {
+    if value.is_bool() {
+        return Some(ScalarValue::Boolean(value.as_bool().ok()?));
+    }
+    if value.is_int() {
+        return Some(ScalarValue::Integer(value.as_int().ok()?));
+    }
+    if value.is_string() {
+        return Some(ScalarValue::String(
+            value.clone_cast::<ImmutableString>().to_string(),
+        ));
+    }
+    if value.is::<CalendarDate>() {
+        return Some(ScalarValue::Date(value.clone_cast::<CalendarDate>()));
+    }
+    if value.is::<UtcInstant>() {
+        return Some(ScalarValue::Instant(value.clone_cast::<UtcInstant>()));
+    }
+    if value.is::<Decimal>() {
+        return Some(ScalarValue::Decimal(
+            value.clone_cast::<Decimal>().canonical().to_string(),
+        ));
+    }
+    None
+}
+
+fn validate_json_bound(
+    value: &Value,
+    maximum_serialized_bytes: usize,
+) -> Result<(), RhaiRuntimeError> {
+    let serialized = serde_json::to_vec(value).map_err(|_| RhaiRuntimeError::InputBound)?;
+    if serialized.len() > maximum_serialized_bytes || !json_collections_are_bounded(value) {
+        return Err(RhaiRuntimeError::InputBound);
+    }
+    Ok(())
+}
+
+fn json_collections_are_bounded(value: &Value) -> bool {
+    match value {
+        Value::String(value) => value.len() <= MAXIMUM_STRING_BYTES,
+        Value::Array(values) => {
+            values.len() <= MAXIMUM_ARRAY_ITEMS && values.iter().all(json_collections_are_bounded)
+        }
+        Value::Object(values) => {
+            values.len() <= MAXIMUM_MAP_ENTRIES
+                && values.iter().all(|(name, value)| {
+                    name.len() <= MAXIMUM_STRING_BYTES && json_collections_are_bounded(value)
+                })
+        }
+        _ => true,
+    }
+}
+
+fn has_exact_keys(map: &Map, keys: &[&str]) -> bool {
+    map.len() == keys.len() && keys.iter().all(|key| map.contains_key(*key))
+}
+
+fn ordering_value(ordering: Ordering) -> INT {
+    match ordering {
+        Ordering::Less => -1,
+        Ordering::Equal => 0,
+        Ordering::Greater => 1,
+    }
+}
+
+fn last_day_of_month(year: i32, month: u32) -> Result<u32, Box<EvalAltResult>> {
+    let (next_year, next_month) = if month == 12 {
+        (year.checked_add(1), 1)
+    } else {
+        (Some(year), month + 1)
+    };
+    let next_year = next_year.ok_or_else(|| primitive_error("invalid_calendar_result"))?;
+    let first_next = NaiveDate::from_ymd_opt(next_year, next_month, 1)
+        .ok_or_else(|| primitive_error("invalid_calendar_result"))?;
+    Ok((first_next - Duration::days(1)).day())
+}
+
+fn is_canonical_date_text(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    bytes.len() == 10
+        && bytes[4] == b'-'
+        && bytes[7] == b'-'
+        && bytes
+            .iter()
+            .enumerate()
+            .all(|(index, byte)| matches!(index, 4 | 7) || byte.is_ascii_digit())
+}
+
+fn is_strict_rfc3339(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    if bytes.len() < 20
+        || !value.is_ascii()
+        || bytes.get(10) != Some(&b'T')
+        || !is_canonical_date_text(&value[..10])
+        || bytes.get(13) != Some(&b':')
+        || bytes.get(16) != Some(&b':')
+    {
+        return false;
+    }
+    let hour = parse_two_digits(&bytes[11..13]);
+    let minute = parse_two_digits(&bytes[14..16]);
+    let second = parse_two_digits(&bytes[17..19]);
+    if !matches!(hour, Some(0..=23))
+        || !matches!(minute, Some(0..=59))
+        || !matches!(second, Some(0..=59))
+    {
+        return false;
+    }
+    has_strict_fraction_and_offset(&value[19..])
+}
+
+fn is_strict_local_time(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    if bytes.len() < 9
+        || !value.is_ascii()
+        || bytes.get(2) != Some(&b':')
+        || bytes.get(5) != Some(&b':')
+    {
+        return false;
+    }
+    let hour = parse_two_digits(&bytes[0..2]);
+    let minute = parse_two_digits(&bytes[3..5]);
+    let second = parse_two_digits(&bytes[6..8]);
+    matches!(hour, Some(0..=23))
+        && matches!(minute, Some(0..=59))
+        && matches!(second, Some(0..=59))
+        && has_strict_fraction_and_offset(&value[8..])
+}
+
+fn has_strict_fraction_and_offset(suffix: &str) -> bool {
+    let (fraction, offset) = if let Some(rest) = suffix.strip_prefix('.') {
+        let digit_count = rest.bytes().take_while(u8::is_ascii_digit).count();
+        if digit_count == 0 || digit_count > 9 {
+            return false;
+        }
+        (&rest[..digit_count], &rest[digit_count..])
+    } else {
+        ("", suffix)
+    };
+    if !fraction.bytes().all(|byte| byte.is_ascii_digit()) {
+        return false;
+    }
+    if offset == "Z" {
+        return true;
+    }
+    let bytes = offset.as_bytes();
+    if bytes.len() != 6 || !matches!(bytes[0], b'+' | b'-') || bytes[3] != b':' {
+        return false;
+    }
+    matches!(parse_two_digits(&bytes[1..3]), Some(0..=23))
+        && matches!(parse_two_digits(&bytes[4..6]), Some(0..=59))
+}
+
+fn parse_two_digits(value: &[u8]) -> Option<u8> {
+    if value.len() != 2 || !value.iter().all(u8::is_ascii_digit) {
+        return None;
+    }
+    Some((value[0] - b'0') * 10 + value[1] - b'0')
+}
+
+fn is_safe_error_code(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    !bytes.is_empty()
+        && bytes.len() <= MAXIMUM_REQUIRED_CODE_BYTES
+        && bytes[0].is_ascii_lowercase()
+        && bytes
+            .iter()
+            .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || *byte == b'_')
+}
+
+fn primitive_error(code: &str) -> Box<EvalAltResult> {
+    EvalAltResult::ErrorRuntime(code.into(), rhai::Position::NONE).into()
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+
+    const ADULT_EXTRACTION: &str = include_str!(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../../products/evidence/fixtures/acceptance/adult-status/adapters/source-a.rhai"
+    ));
+    const ADULT_DERIVATION: &str = include_str!(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../../products/evidence/fixtures/acceptance/adult-status/derivations/adult-status.rhai"
+    ));
+    const RESIDENCE_EXTRACTION: &str = include_str!(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../../products/evidence/fixtures/acceptance/residence-region/adapters/source-b.rhai"
+    ));
+    const RESIDENCE_DERIVATION: &str = include_str!(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../../products/evidence/fixtures/acceptance/residence-region/derivations/residence-region.rhai"
+    ));
+    const LICENCE_EXTRACTION: &str = include_str!(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../../products/evidence/fixtures/acceptance/professional-licence/adapters/source-c.rhai"
+    ));
+    const LICENCE_DERIVATION: &str = include_str!(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../../products/evidence/fixtures/acceptance/professional-licence/derivations/professional-licence.rhai"
+    ));
+    const RELATIONSHIP_EXTRACTION: &str = include_str!(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../../products/evidence/fixtures/acceptance/legal-parent-relationship/adapters/source-d.rhai"
+    ));
+    const RELATIONSHIP_DERIVATION: &str = include_str!(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../../products/evidence/fixtures/acceptance/legal-parent-relationship/derivations/legal-parent-relationship.rhai"
+    ));
+
+    fn runtime() -> RhaiRuntime {
+        RhaiRuntime::new()
+    }
+
+    fn context(
+        parameters: Value,
+        codelists: BTreeMap<String, CodelistHandle>,
+    ) -> EvaluationContext {
+        EvaluationContext::new(
+            UtcInstant::parse("2026-08-02T00:00:00Z").expect("instant"),
+            CalendarDate::parse("2026-08-02").expect("date"),
+            LegalLocalTime::parse("07:00:00+07:00").expect("time"),
+            &parameters,
+            codelists,
+        )
+        .expect("context")
+    }
+
+    fn request_limits(
+        query: RequestPartRequirement,
+        body: RequestPartRequirement,
+    ) -> RequestPartsLimits {
+        RequestPartsLimits::new(
+            query,
+            body,
+            RequestPartsBounds {
+                maximum_query_pairs: MAXIMUM_QUERY_PAIRS,
+                maximum_query_name_bytes: MAXIMUM_QUERY_NAME_BYTES,
+                maximum_query_value_bytes: MAXIMUM_QUERY_VALUE_BYTES,
+                maximum_json_depth: MAXIMUM_JSON_BODY_DEPTH,
+                maximum_collection_items: MAXIMUM_ARRAY_ITEMS,
+                maximum_string_bytes: MAXIMUM_STRING_BYTES,
+                maximum_normalized_bytes: MAXIMUM_REQUEST_PARTS_BYTES,
+            },
+        )
+        .expect("request limits")
+    }
+
+    #[test]
+    fn engine_has_exact_normative_limits_and_disabled_module_syntax() {
+        let runtime = runtime();
+        let engine = runtime.engine();
+        assert_eq!(engine.max_operations(), MAXIMUM_OPERATIONS);
+        assert_eq!(engine.max_call_levels(), MAXIMUM_CALL_DEPTH);
+        assert_eq!(engine.max_expr_depth(), MAXIMUM_EXPRESSION_DEPTH);
+        assert_eq!(engine.max_function_expr_depth(), MAXIMUM_EXPRESSION_DEPTH);
+        assert_eq!(engine.max_modules(), MAXIMUM_MODULES);
+        assert_eq!(engine.max_string_size(), MAXIMUM_STRING_BYTES);
+        assert_eq!(engine.max_array_size(), MAXIMUM_ARRAY_ITEMS);
+        assert_eq!(engine.max_map_size(), MAXIMUM_MAP_ENTRIES);
+        assert!(engine.is_symbol_disabled("import"));
+        assert!(engine.is_symbol_disabled("export"));
+        assert!(engine.is_symbol_disabled("eval"));
+        assert!(engine.is_symbol_disabled("print"));
+        assert!(engine.is_symbol_disabled("debug"));
+        for symbol in [
+            "while", "until", "loop", "do", "switch", "try", "catch", "..", "..=", "?.", "??",
+        ] {
+            assert!(engine.is_symbol_disabled(symbol), "{symbol}");
+        }
+        assert!(!engine.allow_anonymous_fn());
+    }
+
+    #[test]
+    fn preparation_runs_named_helpers_with_fresh_isolated_inputs() {
+        let runtime = runtime();
+        let script = runtime
+            .compile_preparation(
+                r#"
+                    fn query_pair(name, value) { #{ name: name, value: value } }
+                    fn prepare(selectors, parameters) {
+                        let query = [];
+                        query.push(query_pair("filter", selectors.subject.values.reference));
+                        query.push(query_pair("filter", parameters.status));
+                        let provider_name = parameters.provider_name;
+                        provider_name.replace("_", "-");
+                        selectors.subject.values.reference = "mutated-only-locally";
+                        #{
+                            query: query,
+                            body: #{
+                                provider: provider_name,
+                                limit: parse_integer(parameters.limit)
+                            }
+                        }
+                    }
+                "#,
+            )
+            .expect("preparation compiles");
+        let selectors = json!({
+            "subject": {"profile": "reference-v1", "values": {"reference": "person-1"}}
+        });
+        let parameters = json!({"status": "ACTIVE", "provider_name": "source_a", "limit": "02"});
+        let limits = request_limits(
+            RequestPartRequirement::Required,
+            RequestPartRequirement::Required,
+        );
+        for _ in 0..2 {
+            assert_eq!(
+                runtime
+                    .prepare(&script, &selectors, &parameters, &limits)
+                    .expect("prepares"),
+                RequestParts {
+                    query: vec![
+                        QueryPair {
+                            name: "filter".to_string(),
+                            value: "person-1".to_string(),
+                        },
+                        QueryPair {
+                            name: "filter".to_string(),
+                            value: "ACTIVE".to_string(),
+                        },
+                    ],
+                    body: Some(json!({"limit": 2, "provider": "source-a"})),
+                }
+            );
+        }
+        assert_eq!(selectors["subject"]["values"]["reference"], "person-1");
+        assert_eq!(parameters["provider_name"], "source_a");
+    }
+
+    #[test]
+    fn preparation_inputs_and_request_parts_are_closed_and_bounded() {
+        let runtime = runtime();
+        let passthrough = runtime
+            .compile_preparation(
+                "fn prepare(selectors, parameters) { #{ query: parameters.query, body: () } }",
+            )
+            .expect("compiles");
+        let limits = request_limits(
+            RequestPartRequirement::Optional,
+            RequestPartRequirement::Optional,
+        );
+
+        for invalid in [
+            json!({"value": null}),
+            json!({"value": 1.25}),
+            json!({"value": {"type": "decimal", "value": "1.25"}}),
+        ] {
+            assert_eq!(
+                runtime.prepare(&passthrough, &json!({}), &invalid, &limits),
+                Err(RhaiRuntimeError::AdapterInput)
+            );
+        }
+
+        for parameters in [
+            json!({"query": [{"name": "", "value": "x"}]}),
+            json!({"query": [{"name": "x\r", "value": "y"}]}),
+            json!({"query": [{"name": "x", "value": "y\n"}]}),
+            json!({"query": [{"name": "x", "value": 1}]}),
+        ] {
+            assert!(matches!(
+                runtime.prepare(&passthrough, &json!({}), &parameters, &limits),
+                Err(RhaiRuntimeError::AdapterInput | RhaiRuntimeError::PreparationResult)
+            ));
+        }
+
+        let unknown = runtime
+            .compile_preparation(
+                "fn prepare(selectors, parameters) { #{ query: [], body: (), extra: true } }",
+            )
+            .expect("compiles");
+        assert_eq!(
+            runtime.prepare(&unknown, &json!({}), &json!({}), &limits),
+            Err(RhaiRuntimeError::PreparationResult)
+        );
+        for body in ["parse_date(\"2026-08-02\")", "'x'"] {
+            let source =
+                format!("fn prepare(selectors, parameters) {{ #{{ query: [], body: {body} }} }}");
+            let script = runtime.compile_preparation(&source).expect("compiles");
+            assert_eq!(
+                runtime.prepare(&script, &json!({}), &json!({}), &limits),
+                Err(RhaiRuntimeError::PreparationResult)
+            );
+        }
+        let forbidden_query = request_limits(
+            RequestPartRequirement::Forbidden,
+            RequestPartRequirement::Optional,
+        );
+        let query = runtime
+            .compile_preparation(
+                "fn prepare(selectors, parameters) { #{ query: [#{name: \"x\", value: \"y\"}], body: () } }",
+            )
+            .expect("compiles");
+        assert_eq!(
+            runtime.prepare(&query, &json!({}), &json!({}), &forbidden_query),
+            Err(RhaiRuntimeError::PreparationResult)
+        );
+
+        let strict = RequestPartsLimits::new(
+            RequestPartRequirement::Optional,
+            RequestPartRequirement::Optional,
+            RequestPartsBounds {
+                maximum_query_pairs: 1,
+                maximum_query_name_bytes: 1,
+                maximum_query_value_bytes: 1,
+                maximum_json_depth: 1,
+                maximum_collection_items: 1,
+                maximum_string_bytes: 1,
+                maximum_normalized_bytes: 32,
+            },
+        )
+        .expect("strict limits");
+        assert_eq!(
+            runtime.prepare(&query, &json!({}), &json!({}), &strict),
+            Err(RhaiRuntimeError::PreparationResult)
+        );
+    }
+
+    #[test]
+    fn compiler_rejects_every_forbidden_candidate_construct() {
+        let runtime = runtime();
+        let bodies = [
+            "while true {}",
+            "until true {}",
+            "loop {}",
+            "do {} while false",
+            "switch 1 { 1 => true, _ => false }",
+            "try { throw \"x\"; } catch (error) {}",
+            "let pointer = Fn(\"helper\");",
+            "let closure = |value| value;",
+            "let closure = || 1;",
+            "let text = `value=${selectors}`;",
+            "let value = [1, 2, 3][0..1];",
+            "let value = [1, 2, 3][-1];",
+            "let value = parameters?.value;",
+            "let value = parameters.value ?? 0;",
+            "let pointer = parameters.pointer; pointer.call();",
+            "let pointer = parameters.pointer; pointer.curry(1);",
+        ];
+        for body in bodies {
+            let source = format!(
+                "fn prepare(selectors, parameters) {{ {body} #{{ query: [], body: () }} }}"
+            );
+            assert!(
+                runtime.compile_preparation(&source).is_err(),
+                "construct compiled: {body}"
+            );
+        }
+    }
+
+    #[test]
+    fn compiler_allows_unique_helpers_but_rejects_entry_overloads() {
+        let runtime = runtime();
+        assert!(runtime
+            .compile_preparation(
+                "fn helper(value) { value } fn prepare(selectors, parameters) { #{query: [], body: helper(())} }"
+            )
+            .is_ok());
+        for source in [
+            "fn prepare(a, b) { #{query: [], body: ()} } fn prepare(a) { a }",
+            "fn helper(a) { a } fn helper(a, b) { b } fn prepare(a, b) { #{query: [], body: ()} }",
+            "private fn prepare(a, b) { #{query: [], body: ()} }",
+        ] {
+            assert_eq!(
+                runtime.compile_preparation(source).unwrap_err(),
+                RhaiRuntimeError::EntryPoint
+            );
+        }
+    }
+
+    #[test]
+    fn strict_integer_parser_and_mutating_helpers_enforce_bounds() {
+        for (input, expected) in [("0", 0), ("-0", 0), ("0012", 12), ("-42", -42)] {
+            assert_eq!(parse_integer(input).expect("integer"), expected);
+        }
+        for invalid in [
+            "",
+            "+1",
+            " 1",
+            "1 ",
+            "1.0",
+            "1e2",
+            "١",
+            "9223372036854775808",
+            "-9223372036854775809",
+        ] {
+            assert!(parse_integer(invalid).is_err(), "{invalid}");
+        }
+        let mut full = vec![Dynamic::UNIT; MAXIMUM_ARRAY_ITEMS];
+        assert!(bounded_array_push(&mut full, Dynamic::UNIT).is_err());
+        let mut value: ImmutableString = "a".repeat(MAXIMUM_STRING_BYTES).into();
+        assert!(literal_string_replace(&mut value, "", "x").is_err());
+    }
+
+    #[test]
+    fn compile_requires_one_exact_entry_point_and_rejects_top_level_statements() {
+        let runtime = runtime();
+        assert_eq!(
+            runtime
+                .compile_extraction("fn derive(x) { x }")
+                .unwrap_err(),
+            RhaiRuntimeError::EntryPoint
+        );
+        assert!(runtime
+            .compile_extraction("fn extract(x, parameters) { x } fn helper() {}")
+            .is_ok());
+
+        assert_eq!(
+            runtime
+                .compile_extraction(
+                    r#"
+                    throw("top_level_must_not_run");
+                    fn extract(source_response, parameters) { #{ outcome: "no_match" } }
+                "#,
+                )
+                .unwrap_err(),
+            RhaiRuntimeError::Compilation
+        );
+    }
+
+    #[test]
+    fn ambient_and_diagnostic_capabilities_are_unavailable() {
+        let runtime = runtime();
+        for forbidden in [
+            "print(\"x\")",
+            "debug(\"x\")",
+            "eval(\"40 + 2\")",
+            "get_env(\"HOME\")",
+            "timestamp()",
+        ] {
+            let source = format!(
+                "fn extract(source_response, parameters) {{ {forbidden}; #{{ outcome: \"no_match\" }} }}"
+            );
+            if let Ok(script) = runtime.compile_extraction(&source) {
+                assert_eq!(
+                    runtime.extract(&script, &json!({}), &json!({}), &|_: &Value| true),
+                    Err(RhaiRuntimeError::Invocation),
+                    "{forbidden} must be unavailable"
+                );
+            }
+        }
+        assert!(matches!(
+            runtime.compile_extraction(
+                "import \"outside\" as outside; fn extract(x, parameters) { #{ outcome: \"no_match\" } }"
+            ),
+            Err(RhaiRuntimeError::Compilation)
+        ));
+    }
+
+    #[test]
+    fn extraction_decodes_only_the_closed_union_and_validates_facts() {
+        let runtime = runtime();
+        let valid = runtime
+            .compile_extraction(
+                r#"
+                    fn extract(source_response, parameters) {
+                        #{ outcome: "match", facts: #{ code: source_response.code } }
+                    }
+                "#,
+            )
+            .expect("compiles");
+        let schema = jsonschema::JSONSchema::compile(&json!({
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["code"],
+            "properties": {"code": {"type": "string"}}
+        }))
+        .expect("schema");
+        assert_eq!(
+            runtime.extract(&valid, &json!({"code": "A"}), &json!({}), &schema),
+            Ok(LookupResult::Match(BTreeMap::from([(
+                "code".to_string(),
+                json!("A")
+            )])))
+        );
+        assert_eq!(
+            runtime.extract(&valid, &json!({"code": 1}), &json!({}), &schema),
+            Err(RhaiRuntimeError::FactSchema)
+        );
+
+        for body in [
+            "#{ outcome: \"no_match\", facts: #{} }",
+            "#{ outcome: \"ambiguous\", count: 2 }",
+            "#{ outcome: \"match\", facts: #{}, candidates: [] }",
+            "#{ outcome: \"unknown\" }",
+        ] {
+            let source = format!("fn extract(source_response, parameters) {{ {body} }}");
+            let script = runtime.compile_extraction(&source).expect("compiles");
+            assert_eq!(
+                runtime.extract(&script, &json!({}), &json!({}), &|_: &Value| true),
+                Err(RhaiRuntimeError::ExtractionResult)
+            );
+        }
+    }
+
+    #[test]
+    fn extraction_source_input_uses_the_configured_one_mebibyte_boundary() {
+        fn sized_json_array(serialized_bytes: usize, items: usize) -> Value {
+            let payload_bytes = serialized_bytes
+                .checked_sub(1 + 3 * items)
+                .expect("serialized target fits array framing");
+            let base = payload_bytes / items;
+            let remainder = payload_bytes % items;
+            let values = (0..items)
+                .map(|index| Value::String("x".repeat(base + usize::from(index < remainder))))
+                .collect::<Vec<_>>();
+            let value = Value::Array(values);
+            assert_eq!(
+                serde_json::to_vec(&value).expect("serializes").len(),
+                serialized_bytes
+            );
+            value
+        }
+
+        let runtime = runtime();
+        let script = runtime
+            .compile_extraction(
+                "fn extract(source_response, parameters) { #{ outcome: \"no_match\" } }",
+            )
+            .expect("compiles");
+        for size in [MAXIMUM_RESULT_BYTES + 1, MAXIMUM_SOURCE_INPUT_BYTES] {
+            assert_eq!(
+                runtime.extract(
+                    &script,
+                    &sized_json_array(size, 64),
+                    &json!({}),
+                    &|_: &Value| true,
+                ),
+                Ok(LookupResult::NoMatch),
+                "source input of {size} bytes remains valid"
+            );
+        }
+        assert_eq!(
+            runtime.extract(
+                &script,
+                &sized_json_array(MAXIMUM_SOURCE_INPUT_BYTES + 1, 64),
+                &json!({}),
+                &|_: &Value| true,
+            ),
+            Err(RhaiRuntimeError::InputBound)
+        );
+    }
+
+    #[test]
+    fn dates_instants_and_calendar_arithmetic_are_strict_and_bounded() {
+        assert!(CalendarDate::parse("2024-02-29").is_ok());
+        for invalid in ["2023-02-29", "2026-8-02", "+2026-08-02", "2026-08-02Z"] {
+            assert!(CalendarDate::parse(invalid).is_err(), "{invalid}");
+        }
+        assert!(UtcInstant::parse("2026-08-02T07:00:00+07:00").is_ok());
+        for invalid in [
+            "2026-08-02 00:00:00Z",
+            "2026-08-02T00:00:60Z",
+            "2026-08-02T00:00:00",
+            "2026-08-02T00:00:00.1234567890Z",
+        ] {
+            assert!(UtcInstant::parse(invalid).is_err(), "{invalid}");
+        }
+
+        let leap = CalendarDate::parse("2008-02-29").expect("date");
+        assert_eq!(
+            add_calendar_years(leap, 18).expect("adds").as_naive_date(),
+            NaiveDate::from_ymd_opt(2026, 2, 28).expect("date")
+        );
+        let month_end = CalendarDate::parse("2025-01-31").expect("date");
+        assert_eq!(
+            add_calendar_months(month_end, 1)
+                .expect("adds")
+                .as_naive_date(),
+            NaiveDate::from_ymd_opt(2025, 2, 28).expect("date")
+        );
+        assert!(add_calendar_years(leap, 1_001).is_err());
+        assert!(days_between(
+            CalendarDate::parse("0001-01-01").expect("date"),
+            CalendarDate::parse("2001-01-01").expect("date")
+        )
+        .is_err());
+    }
+
+    #[test]
+    fn candidate_numeric_string_and_opaque_type_surface_is_pinned() {
+        let runtime = runtime();
+        let script = runtime
+            .compile_derivation(
+                r#"
+                    fn derive(facts, selectors, evaluation_context) {
+                        let text = "source_adapter";
+                        text.replace("_", "-");
+                        [#{
+                            concept_id: "surface",
+                            value: [
+                                1.5 + 2.0 == 3.5, 1 + 2.5 == 3.5, 2.5 + 1 == 3.5,
+                                5.0 % 2.0 == 1.0, 2.0 ** 3.0 == 8.0,
+                                1.5 < 2.0, 1 < 2.0, 2.0 >= 1,
+                                "ab" + "cd", "abc" - "b", text,
+                                type_of(1.5), type_of(1),
+                                type_of(parse_date("2026-08-02")),
+                                type_of(parse_instant("2026-08-02T00:00:00Z")),
+                                type_of(evaluation_context.legal_local_time),
+                                type_of(decimal("1.25")),
+                                type_of(entity_reference_seed("reference")),
+                                type_of(evaluation_context.codelists["codes"])
+                            ]
+                        }]
+                    }
+                "#,
+            )
+            .expect("compiles");
+        let codelist = CodelistHandle::new(BTreeMap::from([("A".to_string(), "B".to_string())]))
+            .expect("codelist");
+        let values = runtime
+            .derive(
+                &script,
+                &BTreeMap::new(),
+                &json!({}),
+                context(
+                    json!({}),
+                    BTreeMap::from([("codes".to_string(), codelist.clone())]),
+                ),
+            )
+            .expect("derives");
+        assert!(matches!(
+            &values[0].value,
+            DerivedValue::Json(value)
+                if value == &json!([
+                    true, true, true, true, true,
+                    true, true, true,
+                    "abcd", "ac", "source-adapter",
+                    "f64", "i64",
+                    "Date", "Instant", "LegalLocalTime", "Decimal",
+                    "EntityReferenceSeed", "CodelistHandle"
+                ])
+        ));
+
+        // The float arithmetic surface still exists inside a script, but an ordinary
+        // float result is not a public derived value.
+        let float_output = runtime
+            .compile_derivation(
+                "fn derive(facts, selectors, evaluation_context) { [#{ concept_id: \"surface\", value: 1.5 + 2.0 }] }",
+            )
+            .expect("compiles");
+        assert!(matches!(
+            runtime.derive(
+                &float_output,
+                &BTreeMap::new(),
+                &json!({}),
+                context(json!({}), BTreeMap::from([("codes".to_string(), codelist)]))
+            ),
+            Err(RhaiRuntimeError::DerivationResult)
+        ));
+    }
+
+    #[test]
+    fn operation_exhaustion_terminates_a_hostile_script_with_a_value_free_error() {
+        let runtime = runtime();
+        // Unbounded loop syntax is disabled, so exhaustion is driven by
+        // nesting bounded iteration over the largest admissible fact array:
+        // 256 * 256 iterations exceeds the 100,000-operation ceiling.
+        let script = runtime
+            .compile_derivation(
+                r#"
+                    fn derive(facts, selectors, evaluation_context) {
+                        let total = 0;
+                        for outer in facts.items {
+                            for inner in facts.items {
+                                total += 1;
+                            }
+                        }
+                        [#{ concept_id: "count", value: total }]
+                    }
+                "#,
+            )
+            .expect("compiles");
+        // A small input proves the script itself is well-formed, so the
+        // failure below is the operation ceiling and nothing else.
+        let small = BTreeMap::from([("items".to_string(), json!([1, 2, 3, 4]))]);
+        let values = runtime
+            .derive(
+                &script,
+                &small,
+                &json!({}),
+                context(json!({}), BTreeMap::new()),
+            )
+            .expect("the bounded variant derives");
+        assert!(matches!(&values[0].value, DerivedValue::Json(value) if value == &json!(16)));
+
+        let items = (0..256).collect::<Vec<i64>>();
+        let facts = BTreeMap::from([("items".to_string(), json!(items))]);
+        let error = runtime
+            .derive(
+                &script,
+                &facts,
+                &json!({}),
+                context(json!({}), BTreeMap::new()),
+            )
+            .expect_err("operation exhaustion terminates the invocation");
+        assert!(matches!(error, RhaiRuntimeError::Invocation));
+        let diagnostic = format!("{error} {error:?}");
+        assert!(!diagnostic.contains("operations"));
+        assert!(!diagnostic.contains("256"));
+    }
+
+    #[test]
+    fn exact_decimals_and_validated_contiguous_buckets_work() {
+        let runtime = runtime();
+        let script = runtime
+            .compile_derivation(
+                r#"
+                    fn derive(facts, selectors, evaluation_context) {
+                        let exact = decimal("1.25");
+                        let integer = integer_to_decimal(1);
+                        [
+                            #{ concept_id: "decimal", value: exact },
+                            #{ concept_id: "comparison", value: compare_decimals(exact, integer) },
+                            #{
+                                concept_id: "bucket",
+                                value: bucket_number(exact, evaluation_context.parameters.buckets)
+                            }
+                        ]
+                    }
+                "#,
+            )
+            .expect("compiles");
+        let parameters = json!({
+            "buckets": [
+                {
+                    "minimumInclusive": {"type": "decimal", "value": "0"},
+                    "maximumExclusive": {"type": "decimal", "value": "1"},
+                    "code": "low"
+                },
+                {
+                    "minimumInclusive": {"type": "decimal", "value": "1"},
+                    "maximumExclusive": {"type": "decimal", "value": "2"},
+                    "code": "high"
+                }
+            ]
+        });
+        let values = runtime
+            .derive(
+                &script,
+                &BTreeMap::new(),
+                &json!({}),
+                context(parameters, BTreeMap::new()),
+            )
+            .expect("derives");
+        assert!(matches!(
+            &values[0].value,
+            DerivedValue::Decimal(value) if value.canonical() == "1.25"
+        ));
+        assert!(matches!(&values[1].value, DerivedValue::Json(value) if value == &json!(1)));
+        assert!(matches!(&values[2].value, DerivedValue::Json(value) if value == &json!("high")));
+
+        let invalid = vec![boundary("0", "1", "a"), boundary("2", "3", "b")];
+        assert!(bucket_number(Decimal::parse("1").expect("decimal"), invalid).is_err());
+    }
+
+    #[test]
+    fn derived_value_debug_redacts_every_value_carrier() {
+        let seed =
+            EntityReferenceSeed::new("entity-reference-debug-canary").expect("seed is valid");
+        let values = [
+            DerivedConceptValue {
+                concept_id: "urn:example:concept:string".to_owned(),
+                value: DerivedValue::Json(json!("json-debug-canary")),
+            },
+            DerivedConceptValue {
+                concept_id: "urn:example:concept:decimal".to_owned(),
+                value: DerivedValue::Decimal(Decimal::parse("8192.125").expect("decimal")),
+            },
+            DerivedConceptValue {
+                concept_id: "urn:example:concept:reference".to_owned(),
+                value: DerivedValue::EntityReferenceSeed(seed.clone()),
+            },
+            DerivedConceptValue {
+                concept_id: "urn:example:concept:references".to_owned(),
+                value: DerivedValue::EntityReferenceSeedList(vec![seed]),
+            },
+        ];
+        let diagnostic = format!("{values:?}");
+        for canary in [
+            "json-debug-canary",
+            "8192.125",
+            "entity-reference-debug-canary",
+        ] {
+            assert!(!diagnostic.contains(canary), "protected value leaked");
+        }
+        assert!(diagnostic.contains("urn:example:concept:string"));
+        assert!(diagnostic.contains("form: \"string\""));
+        assert!(diagnostic.contains("count: 1"));
+
+        let scalars = [
+            ScalarValue::String("scalar-debug-canary".to_owned()),
+            ScalarValue::Integer(8_192_125),
+            ScalarValue::Decimal("8192.125".to_owned()),
+        ];
+        let diagnostic = format!("{scalars:?}");
+        for canary in ["scalar-debug-canary", "8192125", "8192.125"] {
+            assert!(!diagnostic.contains(canary), "protected value leaked");
+        }
+    }
+
+    #[test]
+    fn request_parts_debug_redacts_query_and_body_values() {
+        let parts = RequestParts {
+            query: vec![QueryPair {
+                name: "query-name-debug-canary".to_owned(),
+                value: "query-value-debug-canary".to_owned(),
+            }],
+            body: Some(serde_json::json!({
+                "body-name-debug-canary": "body-value-debug-canary"
+            })),
+        };
+
+        let diagnostic = format!("{parts:?}");
+        for protected in [
+            "query-name-debug-canary",
+            "query-value-debug-canary",
+            "body-name-debug-canary",
+            "body-value-debug-canary",
+        ] {
+            assert!(
+                !diagnostic.contains(protected),
+                "request parts debug leaked protected material"
+            );
+        }
+        assert!(diagnostic.contains("query_pairs: 1"));
+        assert!(diagnostic.contains("body_present: true"));
+    }
+
+    #[test]
+    fn codelist_required_missing_and_exact_collections_work() {
+        let runtime = runtime();
+        let script = runtime
+            .compile_derivation(
+                r#"
+                    fn derive(facts, selectors, evaluation_context) {
+                        let mapped = codelist_lookup(evaluation_context.codelists["regions"], facts.code);
+                        [
+                            #{ concept_id: "mapped", value: required(mapped, "unknown_code") },
+                            #{ concept_id: "missing", value: is_missing(facts.absent) },
+                            #{ concept_id: "list", value: list_contains([1, "1", true], "1") },
+                            #{ concept_id: "set", value: set_contains(["A", "B"], "B") }
+                        ]
+                    }
+                "#,
+            )
+            .expect("compiles");
+        let handle =
+            CodelistHandle::new(BTreeMap::from([("R-101".to_string(), "NORTH".to_string())]))
+                .expect("codelist");
+        let values = runtime
+            .derive(
+                &script,
+                &BTreeMap::from([("code".to_string(), json!("R-101"))]),
+                &json!({}),
+                context(json!({}), BTreeMap::from([("regions".to_string(), handle)])),
+            )
+            .expect("derives");
+        assert!(matches!(&values[0].value, DerivedValue::Json(value) if value == &json!("NORTH")));
+        assert!(matches!(&values[1].value, DerivedValue::Json(value) if value == &json!(true)));
+        assert!(matches!(&values[2].value, DerivedValue::Json(value) if value == &json!(true)));
+        assert!(matches!(&values[3].value, DerivedValue::Json(value) if value == &json!(true)));
+        assert!(set_contains(
+            vec![Dynamic::from("A"), Dynamic::from("A")],
+            Dynamic::from("A")
+        )
+        .is_err());
+        assert!(required(Dynamic::UNIT, "protected value").is_err());
+        assert!(!is_missing(Dynamic::from(false)));
+    }
+
+    #[test]
+    fn derivation_decode_is_closed_and_retains_protected_types() {
+        let runtime = runtime();
+        let protected = runtime
+            .compile_derivation(
+                r#"
+                    fn derive(facts, selectors, evaluation_context) {
+                        [
+                            #{ concept_id: "one", value: entity_reference_seed(facts.seed) },
+                            #{
+                                concept_id: "many",
+                                value: [entity_reference_seed("a"), entity_reference_seed("b")]
+                            }
+                        ]
+                    }
+                "#,
+            )
+            .expect("compiles");
+        let values = runtime
+            .derive(
+                &protected,
+                &BTreeMap::from([("seed".to_string(), json!("protected-canary"))]),
+                &json!({}),
+                context(json!({}), BTreeMap::new()),
+            )
+            .expect("derives");
+        assert!(matches!(
+            values[0].value,
+            DerivedValue::EntityReferenceSeed(_)
+        ));
+        assert!(matches!(
+            &values[1].value,
+            DerivedValue::EntityReferenceSeedList(values) if values.len() == 2
+        ));
+        assert!(!format!("{:?}", values).contains("protected-canary"));
+
+        for result in [
+            "[#{ concept_id: \"x\", value: true, extra: false }]",
+            "[#{ concept_id: \"x\", value: true }, #{ concept_id: \"x\", value: false }]",
+            "#{ concept_id: \"x\", value: true }",
+        ] {
+            let source = format!("fn derive(facts, selectors, evaluation_context) {{ {result} }}");
+            let script = runtime.compile_derivation(&source).expect("compiles");
+            assert!(matches!(
+                runtime.derive(
+                    &script,
+                    &BTreeMap::new(),
+                    &json!({}),
+                    context(json!({}), BTreeMap::new())
+                ),
+                Err(RhaiRuntimeError::DerivationResult)
+            ));
+        }
+    }
+
+    #[test]
+    fn operation_limit_and_fresh_scope_fail_closed() {
+        let runtime = runtime();
+        let runaway = runtime
+            .compile_derivation("fn derive(facts, selectors, evaluation_context) { while true {} }")
+            .unwrap_err();
+        assert_eq!(runaway, RhaiRuntimeError::Compilation);
+
+        let local_only = runtime
+            .compile_derivation(
+                r#"
+                    fn derive(facts, selectors, evaluation_context) {
+                        let invocation_local = 1;
+                        [#{ concept_id: "value", value: invocation_local }]
+                    }
+                "#,
+            )
+            .expect("compiles");
+        for _ in 0..2 {
+            assert!(runtime
+                .derive(
+                    &local_only,
+                    &BTreeMap::new(),
+                    &json!({}),
+                    context(json!({}), BTreeMap::new())
+                )
+                .is_ok());
+        }
+    }
+
+    #[test]
+    fn required_primitive_reports_closed_unavailability() {
+        let runtime = runtime();
+        let script = runtime
+            .compile_derivation(
+                r#"fn derive(facts, selectors, evaluation_context) {
+                    [#{ concept_id: "urn:example:concept", value: required(facts.absent, "required_fact_missing") }]
+                }"#,
+            )
+            .expect("script compiles");
+        assert!(matches!(
+            runtime.derive(
+                &script,
+                &BTreeMap::new(),
+                &json!({}),
+                context(json!({}), BTreeMap::new())
+            ),
+            Err(RhaiRuntimeError::Unavailable)
+        ));
+
+        let forged = runtime
+            .compile_derivation(
+                r#"fn derive(facts, selectors, evaluation_context) {
+                    throw "registry_evidence_required_unavailable";
+                }"#,
+            )
+            .expect("script compiles");
+        assert!(matches!(
+            runtime.derive(
+                &forged,
+                &BTreeMap::new(),
+                &json!({}),
+                context(json!({}), BTreeMap::new())
+            ),
+            Err(RhaiRuntimeError::Invocation)
+        ));
+        assert!(runtime
+            .compile_derivation(
+                r#"fn derive(facts, selectors, evaluation_context) {
+                    try { required(facts.absent, "missing"); } catch (error) {}
+                    [#{concept_id: "x", value: true}]
+                }"#,
+            )
+            .is_err());
+    }
+
+    #[test]
+    fn get_path_resolves_bounded_pointers_and_reports_absence_as_missing() {
+        let runtime = runtime();
+        let response = json!({
+            "total": 1,
+            "person": {"date_of_birth": "1970-01-01", "names": [{"given": "A"}, {"given": "B"}]},
+            "a/b": "slash",
+            "m~n": "tilde"
+        });
+
+        fn resolved(runtime: &RhaiRuntime, response: &Value, body: &str) -> Value {
+            let script = runtime
+                .compile_extraction(&format!(
+                    "fn extract(source_response, parameters) {{
+                        #{{ outcome: \"match\", facts: #{{ value: {body} }} }}
+                    }}"
+                ))
+                .expect("compiles");
+            match runtime.extract(&script, response, &json!({}), &|_: &Value| true) {
+                Ok(LookupResult::Match(facts)) => facts["value"].clone(),
+                other => panic!("expected a match, got {other:?}"),
+            }
+        }
+
+        for (body, expected) in [
+            (r#"get_path(source_response, "/total")"#, json!(1)),
+            (
+                r#"get_path(source_response, "/person/date_of_birth")"#,
+                json!("1970-01-01"),
+            ),
+            (
+                r#"get_path(source_response, "/person/names/1/given")"#,
+                json!("B"),
+            ),
+            (r#"get_path(source_response, "/a~1b")"#, json!("slash")),
+            (r#"get_path(source_response, "/m~0n")"#, json!("tilde")),
+            (
+                r#"get_path(get_path(source_response, "/person"), "/date_of_birth")"#,
+                json!("1970-01-01"),
+            ),
+            (r#"len(get_path(source_response, ""))"#, json!(4)),
+        ] {
+            assert_eq!(resolved(&runtime, &response, body), expected, "{body}");
+        }
+
+        // Absence of any kind is the script's decision to make, so it arrives as the
+        // same unit marker `is_missing` and `required` already understand.
+        for body in [
+            r#"get_path(source_response, "/absent")"#,
+            r#"get_path(source_response, "/person/absent/deeper")"#,
+            r#"get_path(source_response, "/person/names/9")"#,
+            r#"get_path(source_response, "/total/deeper")"#,
+        ] {
+            assert_eq!(
+                resolved(&runtime, &response, &format!("is_missing({body})")),
+                json!(true),
+                "{body}"
+            );
+        }
+
+        let unavailable = runtime
+            .compile_extraction(
+                r#"fn extract(source_response, parameters) {
+                    #{ outcome: "match", facts: #{ value: required(get_path(source_response, "/absent"), "required_fact_missing") } }
+                }"#,
+            )
+            .expect("compiles");
+        assert_eq!(
+            runtime.extract(&unavailable, &response, &json!({}), &|_: &Value| true),
+            Err(RhaiRuntimeError::Unavailable)
+        );
+    }
+
+    #[test]
+    fn get_path_rejects_malformed_and_oversized_pointers() {
+        let runtime = runtime();
+        let response = json!({"total": 1, "person": {"names": [{"given": "A"}]}});
+
+        let long_pointer = format!("/{}", "x".repeat(MAXIMUM_POINTER_BYTES));
+        let deep_pointer = "/x".repeat(MAXIMUM_POINTER_SEGMENTS + 1);
+        for pointer in [
+            "total",               // no leading separator
+            "/person/names/-1",    // negative index, however it was written
+            "/person/names/01",    // non-canonical index
+            "/person/names/0x1",   // non-numeric index
+            "/person/names/ 0",    // padded index
+            "/bad~",               // dangling escape
+            "/bad~2",              // undefined escape
+            long_pointer.as_str(), // beyond the pointer byte ceiling
+            deep_pointer.as_str(), // beyond the pointer segment ceiling
+        ] {
+            let script = runtime
+                .compile_extraction(&format!(
+                    "fn extract(source_response, parameters) {{
+                        #{{ outcome: \"match\", facts: #{{ value: get_path(source_response, \"{pointer}\") }} }}
+                    }}"
+                ))
+                .expect("compiles");
+            assert_eq!(
+                runtime.extract(&script, &response, &json!({}), &|_: &Value| true),
+                Err(RhaiRuntimeError::Invocation),
+                "{pointer}"
+            );
+        }
+
+        // The ceilings admit the largest well-formed pointer, so the rejections above
+        // are boundary decisions rather than an accidentally narrower primitive.
+        for pointer in [
+            format!("/{}", "x".repeat(MAXIMUM_POINTER_BYTES - 1)),
+            "/x".repeat(MAXIMUM_POINTER_SEGMENTS),
+        ] {
+            let script = runtime
+                .compile_extraction(&format!(
+                    "fn extract(source_response, parameters) {{
+                        #{{ outcome: \"match\", facts: #{{ value: is_missing(get_path(source_response, \"{pointer}\")) }} }}
+                    }}"
+                ))
+                .expect("compiles");
+            assert_eq!(
+                runtime.extract(&script, &response, &json!({}), &|_: &Value| true),
+                Ok(LookupResult::Match(BTreeMap::from([(
+                    "value".to_string(),
+                    json!(true)
+                )]))),
+                "{pointer}"
+            );
+        }
+    }
+
+    #[test]
+    fn all_four_acceptance_script_pairs_run_through_one_runtime() {
+        let runtime = runtime();
+
+        let adult_facts = matched_facts(
+            &runtime,
+            ADULT_EXTRACTION,
+            json!({"total": 1, "date_of_birth": "2008-08-02"}),
+        );
+        let adult = runtime
+            .derive(
+                &runtime
+                    .compile_derivation(&candidate_derivation(ADULT_DERIVATION))
+                    .expect("adult derivation compiles"),
+                &adult_facts,
+                &json!({}),
+                context(json!({"minimum_age_years": 18}), BTreeMap::new()),
+            )
+            .expect("adult derives");
+        assert!(matches!(&adult[0].value, DerivedValue::Json(value) if value == &json!(true)));
+
+        let residence_facts = matched_facts(
+            &runtime,
+            RESIDENCE_EXTRACTION,
+            json!({"total": 1, "official_residence_code": "R-101"}),
+        );
+        let region_map = CodelistHandle::new(BTreeMap::from([
+            ("R-101".to_string(), "REGION-NORTH".to_string()),
+            ("R-201".to_string(), "REGION-SOUTH".to_string()),
+        ]))
+        .expect("codelist");
+        let residence = runtime
+            .derive(
+                &runtime
+                    .compile_derivation(&candidate_derivation(RESIDENCE_DERIVATION))
+                    .expect("residence derivation compiles"),
+                &residence_facts,
+                &json!({}),
+                context(
+                    json!({}),
+                    BTreeMap::from([("region-map".to_string(), region_map)]),
+                ),
+            )
+            .expect("residence derives");
+        assert!(
+            matches!(&residence[0].value, DerivedValue::Json(value) if value == &json!("REGION-NORTH"))
+        );
+
+        let licence_facts = matched_facts(
+            &runtime,
+            LICENCE_EXTRACTION,
+            json!({
+                "total": 1,
+                "records": [{
+                    "licence_state": "CURRENT",
+                    "valid_from": "2025-01-01",
+                    "valid_until": "2026-08-20",
+                    "historical_states": ["PENDING"]
+                }]
+            }),
+        );
+        let licence = runtime
+            .derive(
+                &runtime
+                    .compile_derivation(&candidate_derivation(LICENCE_DERIVATION))
+                    .expect("licence derivation compiles"),
+                &licence_facts,
+                &json!({}),
+                context(
+                    json!({
+                        "active_state": "CURRENT",
+                        "expiry_buckets": [
+                            bucket_parameter("-365000", "0", "expired"),
+                            bucket_parameter("0", "31", "within-30-days"),
+                            bucket_parameter("31", "91", "within-90-days"),
+                            bucket_parameter("91", "365001", "later")
+                        ]
+                    }),
+                    BTreeMap::new(),
+                ),
+            )
+            .expect("licence derives");
+        assert!(matches!(&licence[0].value, DerivedValue::Json(value) if value == &json!(true)));
+        assert!(
+            matches!(&licence[1].value, DerivedValue::Json(value) if value == &json!("within-30-days"))
+        );
+
+        let relationship_facts = matched_facts(
+            &runtime,
+            RELATIONSHIP_EXTRACTION,
+            json!({
+                "total": 1,
+                "records": [{
+                    "returned_child_reference": "synthetic-child-record-001",
+                    "parent_references": ["synthetic-parent-reference-001"],
+                    "reference_namespace": "urn:example:fixture:person-reference",
+                    "relationship_set_contract": "urn:example:fixture:legal-parent-set:v1",
+                    "relationship_set_complete": true
+                }]
+            }),
+        );
+        let relationship = runtime
+            .derive(
+                &runtime
+                    .compile_derivation(&candidate_derivation(RELATIONSHIP_DERIVATION))
+                    .expect("relationship derivation compiles"),
+                &relationship_facts,
+                &json!({
+                    "child": {
+                        "profile": "civil-record-reference-v1",
+                        "values": {"record_reference": "synthetic-child-record-001"}
+                    },
+                    "candidate-parent": {
+                        "profile": "person-reference-v1",
+                        "values": {"person_reference": "synthetic-parent-reference-001"}
+                    }
+                }),
+                context(
+                    json!({
+                        "matching_policy": "exact-opaque-reference-membership-v1",
+                        "candidate_reference_namespace": "urn:example:fixture:person-reference",
+                        "relationship_set_contract": "urn:example:fixture:legal-parent-set:v1",
+                        "legal_authority_attestation": "urn:example:fixture:governance:legal-parent-register:v1"
+                    }),
+                    BTreeMap::new(),
+                ),
+            )
+            .expect("relationship derives");
+        assert!(
+            matches!(&relationship[0].value, DerivedValue::Json(value) if value == &json!(true))
+        );
+    }
+
+    #[test]
+    fn protected_seed_has_no_comparison_or_string_conversion_capability() {
+        let runtime = runtime();
+        for expression in [
+            "{ let seed = entity_reference_seed(facts.seed); seed == seed }",
+            "{ let seed = entity_reference_seed(facts.seed); seed.to_string() }",
+            "{ let seed = entity_reference_seed(facts.seed); debug(seed) }",
+        ] {
+            let source = format!(
+                "fn derive(facts, selectors, evaluation_context) {{ [#{{ concept_id: \"x\", value: {expression} }}] }}"
+            );
+            match runtime.compile_derivation(&source) {
+                Ok(script) => assert!(matches!(
+                    runtime.derive(
+                        &script,
+                        &BTreeMap::from([("seed".to_string(), json!("protected-canary"))]),
+                        &json!({}),
+                        context(json!({}), BTreeMap::new())
+                    ),
+                    Err(RhaiRuntimeError::Invocation)
+                )),
+                Err(RhaiRuntimeError::Compilation) => {}
+                Err(error) => panic!("unexpected compilation result: {error}"),
+            }
+        }
+    }
+
+    #[test]
+    fn list_contains_validates_every_element_before_any_answer() {
+        for unsupported in [
+            Dynamic::UNIT,
+            Dynamic::from(Map::new()),
+            Dynamic::from(Array::new()),
+            Dynamic::from(1.5_f64),
+            Dynamic::from(EntityReferenceSeed::new("seed").expect("seed")),
+        ] {
+            assert!(
+                list_contains(
+                    vec![Dynamic::from("A"), unsupported.clone()],
+                    Dynamic::from("A")
+                )
+                .is_err(),
+                "a match before an invalid element answered instead of failing"
+            );
+            assert!(list_contains(
+                vec![unsupported.clone(), Dynamic::from("A")],
+                Dynamic::from("A")
+            )
+            .is_err());
+            assert!(
+                set_contains(vec![Dynamic::from("A"), unsupported], Dynamic::from("A")).is_err()
+            );
+        }
+
+        assert!(list_contains(
+            vec![Dynamic::from("A"), Dynamic::from("A")],
+            Dynamic::from("A")
+        )
+        .expect("duplicates are containment, not a set"));
+
+        let mixed = vec![
+            Dynamic::from(1_i64),
+            Dynamic::from("1"),
+            Dynamic::from(true),
+        ];
+        for needle in [
+            Dynamic::from(1_i64),
+            Dynamic::from("1"),
+            Dynamic::from(true),
+        ] {
+            assert!(list_contains(mixed.clone(), needle).expect("valid scalars"));
+        }
+        for absent in [
+            Dynamic::from(2_i64),
+            Dynamic::from("true"),
+            Dynamic::from(false),
+        ] {
+            assert!(!list_contains(mixed.clone(), absent).expect("valid scalars"));
+        }
+
+        let decimals = vec![Dynamic::from(Decimal::parse("1.25").expect("decimal"))];
+        assert!(list_contains(
+            decimals.clone(),
+            Dynamic::from(Decimal::parse("1.25").expect("decimal"))
+        )
+        .expect("exact decimal comparison"));
+        assert!(!list_contains(
+            decimals.clone(),
+            Dynamic::from(Decimal::parse("1.26").expect("decimal"))
+        )
+        .expect("exact decimal comparison"));
+        assert!(!list_contains(
+            vec![Dynamic::from(integer_to_decimal(1))],
+            Dynamic::from(1_i64)
+        )
+        .expect("decimal and integer stay distinct"));
+
+        assert!(list_contains(
+            vec![Dynamic::from("A"); MAXIMUM_ARRAY_ITEMS + 1],
+            Dynamic::from("A")
+        )
+        .is_err());
+        assert!(list_contains(vec![Dynamic::from("A")], Dynamic::UNIT).is_err());
+    }
+
+    #[test]
+    fn negative_array_indexes_fail_instead_of_selecting_from_the_end() {
+        let runtime = runtime();
+        let facts = || BTreeMap::from([("values".to_string(), json!(["first", "last"]))]);
+        let derivation = |index: &str| {
+            format!(
+                r#"fn derive(facts, selectors, evaluation_context) {{
+                    let position = {index};
+                    [#{{ concept_id: "x", value: facts.values[position] }}]
+                }}"#
+            )
+        };
+
+        let computed_negative = runtime
+            .compile_derivation(&derivation(
+                "compare_dates(evaluation_context.legal_local_date, parse_date(\"2100-01-01\"))",
+            ))
+            .expect("computed index compiles");
+        assert!(
+            matches!(
+                runtime.derive(
+                    &computed_negative,
+                    &facts(),
+                    &json!({}),
+                    context(json!({}), BTreeMap::new())
+                ),
+                Err(RhaiRuntimeError::Invocation)
+            ),
+            "a computed negative index selected from the end"
+        );
+
+        let computed_forward = runtime
+            .compile_derivation(&derivation(
+                "compare_dates(parse_date(\"2100-01-01\"), evaluation_context.legal_local_date)",
+            ))
+            .expect("computed index compiles");
+        let values = runtime
+            .derive(
+                &computed_forward,
+                &facts(),
+                &json!({}),
+                context(json!({}), BTreeMap::new()),
+            )
+            .expect("a non-negative computed index still resolves");
+        assert!(matches!(&values[0].value, DerivedValue::Json(value) if value == &json!("last")));
+
+        let computed_key = runtime
+            .compile_extraction(
+                r#"fn extract(source_response, parameters) {
+                    let field = parameters.field;
+                    #{ outcome: "match", facts: #{ code: source_response["record"][field] } }
+                }"#,
+            )
+            .expect("computed map key compiles");
+        assert_eq!(
+            runtime.extract(
+                &computed_key,
+                &json!({"record": {"code": "A"}}),
+                &json!({"field": "code"}),
+                &|_: &Value| true,
+            ),
+            Ok(LookupResult::Match(BTreeMap::from([(
+                "code".to_string(),
+                json!("A")
+            )])))
+        );
+
+        assert_eq!(
+            runtime
+                .compile_derivation(&derivation("0"))
+                .and_then(|script| runtime
+                    .compile_derivation(
+                        "fn derive(facts, selectors, evaluation_context) { [#{ concept_id: \"x\", value: facts.values[-1] }] }",
+                    )
+                    .map(|_| script))
+                .unwrap_err(),
+            RhaiRuntimeError::Compilation
+        );
+        assert!(
+            runtime
+                .compile_derivation(
+                    r#"fn derive(facts, selectors, evaluation_context) {
+                        let offsets = [-1, 0];
+                        [#{ concept_id: "x", value: list_contains(offsets, 0) }]
+                    }"#,
+                )
+                .is_ok(),
+            "a negative number inside an array literal is not an index"
+        );
+    }
+
+    #[test]
+    fn script_scanner_agrees_with_rhai_string_comment_and_pointer_tokenization() {
+        let runtime = runtime();
+        for rejected in [
+            // Rhai reads #"A"B"# as one raw string; a scanner that treats every quote as a
+            // plain delimiter desynchronizes and hides the code between two raw strings.
+            "let a = #\"A\"B\"#; parameters.call(); let c = #\"D\"E\"#;",
+            "let a = #\"raw\"#;",
+            "let a = ##\"raw \"# still raw\"##;",
+            "let a = `interpolated ${parameters}`;",
+            "let a = Fn(\"helper\");",
+            "parameters.call();",
+            "parameters.curry(1);",
+            "let a = parameters.values[-1];",
+            "let a = parameters.values[ - 1];",
+            "let a = 1; /* unterminated",
+            "let a = __evidence_index(1);",
+            // Rhai indexes a block or an if chain in operand position, so its closing
+            // brace ends a value that a byte scanner cannot distinguish from the closing
+            // brace of a statement block.
+            "let v = [10, 20]; let a = if true { v } else { v }[-1];",
+            "let a = if true { 1 } else { 2 };",
+            "let a = { 1 };",
+        ] {
+            let source = format!(
+                "fn prepare(selectors, parameters) {{ {rejected} #{{ query: [], body: () }} }}"
+            );
+            assert!(
+                runtime.compile_preparation(&source).is_err(),
+                "accepted: {rejected}"
+            );
+        }
+        for accepted in [
+            "// Fn(\"helper\") and values[-1]\n",
+            "/* Fn(\"helper\") and values[-1] */",
+            "let a = \"values[-1] Fn\";",
+            "let a = 'x';",
+            "let a = [-1, 0];",
+            "let a = #{ inner: [1] }[\"inner\"][0];",
+            // A statement block is followed by an array literal, not by an index.
+            "if true { let b = 1; }\n [-1, 0];",
+            "for x in [1, 2] { let b = x; }",
+            "if true { let b = 1; } else if false { let b = 2; }",
+        ] {
+            let source = format!(
+                "fn prepare(selectors, parameters) {{ {accepted} #{{ query: [], body: () }} }}"
+            );
+            assert!(
+                runtime.compile_preparation(&source).is_ok(),
+                "rejected: {accepted}"
+            );
+        }
+        assert_eq!(
+            runtime
+                .compile_preparation(
+                    "let leaked = 1; fn prepare(selectors, parameters) { #{ query: [], body: () } }",
+                )
+                .unwrap_err(),
+            RhaiRuntimeError::Compilation
+        );
+
+        // Only index operands are rewritten, and every one of them is.
+        assert_eq!(
+            guarded_script_source(
+                "fn f(a) { let b = a[\"k\"][0]; let c = [1, 2]; let d = #{ k: [1] }[\"k\"]; }"
+            )
+            .expect("reviewed"),
+            "fn f(a) { let b = a[__evidence_index(\"k\")][__evidence_index(0)]; \
+             let c = [1, 2]; let d = #{ k: [1] }[__evidence_index(\"k\")]; }"
+        );
+        assert_eq!(
+            guarded_script_source("fn f(a) { let b = a[a[\"i\"]]; }").expect("reviewed"),
+            "fn f(a) { let b = a[__evidence_index(a[__evidence_index(\"i\")])]; }"
+        );
+    }
+
+    #[test]
+    fn public_derived_values_reject_ordinary_floats() {
+        let runtime = runtime();
+        for float in [
+            "1.5",
+            "1.0",
+            "[1.5]",
+            "#{ ratio: 1.5 }",
+            "0.0 / 0.0",
+            "1.5 + 2.0",
+        ] {
+            let source =
+                format!("fn derive(facts, selectors, evaluation_context) {{ [#{{ concept_id: \"x\", value: {float} }}] }}");
+            let script = runtime.compile_derivation(&source).expect("compiles");
+            assert!(
+                matches!(
+                    runtime.derive(
+                        &script,
+                        &BTreeMap::new(),
+                        &json!({}),
+                        context(json!({}), BTreeMap::new())
+                    ),
+                    Err(RhaiRuntimeError::DerivationResult)
+                ),
+                "ordinary float accepted at the derivation output gate: {float}"
+            );
+        }
+
+        let declared = runtime
+            .compile_derivation(
+                r#"fn derive(facts, selectors, evaluation_context) {
+                    [
+                        #{ concept_id: "integer", value: 2 },
+                        #{ concept_id: "exact", value: decimal("1.25") }
+                    ]
+                }"#,
+            )
+            .expect("compiles");
+        let values = runtime
+            .derive(
+                &declared,
+                &BTreeMap::new(),
+                &json!({}),
+                context(json!({}), BTreeMap::new()),
+            )
+            .expect("declared numeric forms remain available");
+        assert!(matches!(&values[0].value, DerivedValue::Json(value) if value == &json!(2)));
+        assert!(
+            matches!(&values[1].value, DerivedValue::Decimal(value) if value.canonical() == "1.25")
+        );
+
+        let extraction = runtime
+            .compile_extraction(
+                "fn extract(source_response, parameters) { #{ outcome: \"match\", facts: #{ ratio: source_response.ratio } } }",
+            )
+            .expect("compiles");
+        assert_eq!(
+            runtime.extract(
+                &extraction,
+                &json!({"ratio": 1.25}),
+                &json!({}),
+                &|_: &Value| true
+            ),
+            Ok(LookupResult::Match(BTreeMap::from([(
+                "ratio".to_string(),
+                json!(1.25)
+            )])))
+        );
+
+        let limits = request_limits(
+            RequestPartRequirement::Optional,
+            RequestPartRequirement::Optional,
+        );
+        let preparation = runtime
+            .compile_preparation(
+                "fn prepare(selectors, parameters) { #{ query: [], body: #{ ratio: 1.25 } } }",
+            )
+            .expect("compiles");
+        assert_eq!(
+            runtime
+                .prepare(&preparation, &json!({}), &json!({}), &limits)
+                .expect("finite adapter floats remain available")
+                .body,
+            Some(json!({"ratio": 1.25}))
+        );
+        let non_finite = runtime
+            .compile_preparation(
+                "fn prepare(selectors, parameters) { #{ query: [], body: #{ ratio: 0.0 / 0.0 } } }",
+            )
+            .expect("compiles");
+        assert_eq!(
+            runtime.prepare(&non_finite, &json!({}), &json!({}), &limits),
+            Err(RhaiRuntimeError::PreparationResult)
+        );
+    }
+
+    #[test]
+    fn out_of_range_json_integer_tokens_fail_before_rhai() {
+        let runtime = runtime();
+        let script = runtime
+            .compile_extraction(
+                "fn extract(source_response, parameters) { #{ outcome: \"no_match\" } }",
+            )
+            .expect("compiles");
+        let response = |token: &str| {
+            serde_json::from_str::<Value>(&format!("{{\"value\": {token}}}")).expect("parses")
+        };
+        for accepted in [
+            "0",
+            "9223372036854775807",
+            "-9223372036854775808",
+            "1.25",
+            "1e3",
+        ] {
+            assert_eq!(
+                runtime.extract(&script, &response(accepted), &json!({}), &|_: &Value| true),
+                Ok(LookupResult::NoMatch),
+                "{accepted}"
+            );
+        }
+        for rejected in [
+            "9223372036854775808",
+            "18446744073709551615",
+            "99999999999999999999999",
+            "1e30",
+        ] {
+            assert_eq!(
+                runtime.extract(&script, &response(rejected), &json!({}), &|_: &Value| true),
+                Err(RhaiRuntimeError::InputBound),
+                "{rejected}"
+            );
+        }
+        assert_eq!(
+            runtime.extract(
+                &script,
+                &json!({"value": "99999999999999999999999"}),
+                &json!({}),
+                &|_: &Value| true
+            ),
+            Ok(LookupResult::NoMatch),
+            "an identifier outside the signed 64-bit range must arrive as a string"
+        );
+
+        let derivation = runtime
+            .compile_derivation(
+                "fn derive(facts, selectors, evaluation_context) { [#{ concept_id: \"x\", value: true }] }",
+            )
+            .expect("compiles");
+        assert!(matches!(
+            runtime.derive(
+                &derivation,
+                &BTreeMap::from([(
+                    "value".to_string(),
+                    response("99999999999999999999999")["value"].clone()
+                )]),
+                &json!({}),
+                context(json!({}), BTreeMap::new())
+            ),
+            Err(RhaiRuntimeError::InputBound)
+        ));
+    }
+
+    #[test]
+    fn required_unavailability_carries_no_supplied_code_into_any_surface() {
+        let runtime = runtime();
+        for code in ["required_fact_missing", "other_missing_input_9"] {
+            let source = format!(
+                "fn derive(facts, selectors, evaluation_context) {{ [#{{ concept_id: \"x\", value: required(facts.absent, \"{code}\") }}] }}"
+            );
+            let script = runtime.compile_derivation(&source).expect("compiles");
+            let error = runtime
+                .derive(
+                    &script,
+                    &BTreeMap::new(),
+                    &json!({}),
+                    context(json!({}), BTreeMap::new()),
+                )
+                .expect_err("unavailable");
+            assert_eq!(error, RhaiRuntimeError::Unavailable);
+            let rendered = format!("{error} {error:?}");
+            assert!(!rendered.contains(code), "supplied code reached a surface");
+        }
+
+        // A code that fails review validation stops before the unavailable signal.
+        let unsafe_code = runtime
+            .compile_derivation(
+                "fn derive(facts, selectors, evaluation_context) { [#{ concept_id: \"x\", value: required(facts.absent, \"Protected Value\") }] }",
+            )
+            .expect("compiles");
+        assert!(matches!(
+            runtime.derive(
+                &unsafe_code,
+                &BTreeMap::new(),
+                &json!({}),
+                context(json!({}), BTreeMap::new())
+            ),
+            Err(RhaiRuntimeError::Invocation)
+        ));
+        assert!(required(Dynamic::from(1_i64), "Protected Value").is_err());
+        assert!(required(Dynamic::from(1_i64), "").is_err());
+        assert!(required(Dynamic::from(1_i64), "safe_code").is_ok());
+    }
+
+    fn boundary(minimum: &str, maximum: &str, code: &str) -> Dynamic {
+        let mut map = Map::new();
+        map.insert(
+            "minimumInclusive".into(),
+            Dynamic::from(Decimal::parse(minimum).expect("decimal")),
+        );
+        map.insert(
+            "maximumExclusive".into(),
+            Dynamic::from(Decimal::parse(maximum).expect("decimal")),
+        );
+        map.insert("code".into(), Dynamic::from(code.to_string()));
+        Dynamic::from(map)
+    }
+
+    fn bucket_parameter(minimum: &str, maximum: &str, code: &str) -> Value {
+        json!({
+            "minimumInclusive": {"type": "decimal", "value": minimum},
+            "maximumExclusive": {"type": "decimal", "value": maximum},
+            "code": code
+        })
+    }
+
+    fn matched_facts(
+        runtime: &RhaiRuntime,
+        source: &str,
+        response: Value,
+    ) -> BTreeMap<String, Value> {
+        let label = if source == ADULT_EXTRACTION {
+            "adult"
+        } else if source == RESIDENCE_EXTRACTION {
+            "residence"
+        } else if source == LICENCE_EXTRACTION {
+            "licence"
+        } else {
+            "relationship"
+        };
+        let script = runtime
+            .compile_extraction(&candidate_extraction(source))
+            .expect("extraction compiles");
+        let parameters = match label {
+            "licence" => {
+                json!({"requestedFields": "licence_state,valid_from,valid_until", "resultLimit": "2"})
+            }
+            "relationship" => json!({
+                "requestedFields": [
+                    "returned_child_reference",
+                    "parent_references",
+                    "reference_namespace",
+                    "relationship_set_contract",
+                    "relationship_set_complete"
+                ],
+                "resultLimit": 2,
+                "referenceNamespace": "urn:example:fixture:person-reference",
+                "relationshipSetContract": "urn:example:fixture:legal-parent-set:v1",
+                "relationshipSetComplete": true
+            }),
+            _ => json!({}),
+        };
+        match runtime
+            .extract(&script, &response, &parameters, &|_: &Value| true)
+            .unwrap_or_else(|error| panic!("{label} extraction failed: {error}"))
+        {
+            LookupResult::Match(facts) => facts,
+            other => panic!("expected match, got {other:?}"),
+        }
+    }
+
+    fn candidate_extraction(source: &str) -> String {
+        source.replacen(
+            "fn extract(source_response)",
+            "fn extract(source_response, parameters)",
+            1,
+        )
+    }
+
+    fn candidate_derivation(source: &str) -> String {
+        source.replacen(
+            "fn derive(facts, evaluation_context)",
+            "fn derive(facts, selectors, evaluation_context)",
+            1,
+        )
+    }
+}
diff --git a/crates/registry-evidence/src/runtime.rs b/crates/registry-evidence/src/runtime.rs
new file mode 100644
index 000000000..3fc2b2f6f
--- /dev/null
+++ b/crates/registry-evidence/src/runtime.rs
@@ -0,0 +1,1772 @@
+//! Complete authenticated Evidence evaluation and fail-closed release pipeline.
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fmt,
+    path::Path,
+    str,
+    sync::Arc,
+    time::Instant,
+};
+
+use chrono::Utc;
+use registry_platform_audit::{AuditError, AuditHashSecret};
+use registry_platform_crypto::{LocalJwkSigner, PrivateJwk, PublicJwk};
+use serde_json::{Map as JsonMap, Value};
+use thiserror::Error;
+
+use crate::{
+    audit::{
+        AuditAuthority, AuditDecision, AuditPhase, AuditSubject,
+        AuthorityKind as AuditAuthorityKind, EvidenceAuditError, EvidenceAuditEvent,
+        EvidenceAuditLog, ResponseProtection,
+    },
+    auth::{AuthenticatedContext, Authenticator},
+    bundle::{Bundle, DeploymentInputs},
+    config::{
+        AssuranceProfile, AuthorityKind, ConceptForm, RequirementKind, ResponseFormat,
+        RuntimeConfig, SelectorField, SelectorInput, SubjectCardinality, ValueOrigin,
+    },
+    contracts::definitions_contract_accepts,
+    kernel::{EvidenceConstruction, KernelError, KernelOutcome, OfflineKernel, ValueProjection},
+    model::{
+        request_nonce_is_canonical, EvidenceDefinition, EvidenceDefinitionConcept,
+        EvidenceDefinitionSelector, EvidenceDefinitionSubject, EvidenceDefinitions,
+        EvidenceRequest, EvidenceSelectorField, FlattenedJws, JwksDocument, RequestedSelector,
+        RequestedSubject, SelectorValue, SubjectBinding, UnsignedEnvelopeType,
+        UnsignedEnvelopeWarning, UnsignedEvidenceEnvelope, UnsignedIntegrityProtection,
+    },
+    problem::ProblemCode,
+    rate_limit::{EvidenceRateLimiter, RateLimitConfig, RateLimitError},
+    sdjwt_vc,
+    secrets::{ProtectedSecret, SecretProvider, SecretResolver},
+    selector::{
+        match_entitlement, resolve_selectors, validate_entitlement_context,
+        validate_subject_binding_key, AuthorizationError, MatchedEntitlement,
+        ResolvedAuthorization, ResolvedSelectorValue,
+    },
+    signing::{jwks_document, EvidenceSigner},
+    source::{ResolvedSourceSelector, SourceError, SourceExecutor},
+    EVIDENCE_DEFINITIONS_SCHEMA_V1, EVIDENCE_JWS_MEDIA_TYPE, EVIDENCE_SD_JWT_VC_MEDIA_TYPE,
+    EVIDENCE_UNSIGNED_ENVELOPE_SCHEMA_V1, EVIDENCE_UNSIGNED_MEDIA_TYPE,
+};
+
+const MAX_OPERATION_BYTES: usize = 128;
+
+#[derive(Debug, Error)]
+pub enum RuntimeInitializationError {
+    #[error("the immutable Evidence bundle could not be loaded")]
+    Bundle,
+    #[error("the Evidence secret resolver could not initialize")]
+    Secrets,
+    #[error("the Evidence audit boundary could not initialize: {0}")]
+    Audit(AuditInitializationFault),
+    #[error("the Evidence signing boundary could not initialize")]
+    Signing,
+    #[error("an Evidence source plan could not initialize")]
+    Source,
+    #[error("the Evidence rate limiter could not initialize")]
+    RateLimit,
+}
+
+/// Why the audit boundary refused to initialize.
+///
+/// A mode an operator fixes with `chmod`, a chain that no longer verifies, and
+/// a second writer already holding the sink lock are three unrelated faults
+/// with three unrelated remedies. They are reported separately because from
+/// outside the process they are indistinguishable, and the wrong guess sends an
+/// operator hunting for tampering in what is a permission bit.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum AuditInitializationFault {
+    /// `auditStorage` bounds or the audit key version are out of range.
+    Configuration,
+    /// The audit hash secret is missing, unreadable, or too weak.
+    Secret,
+    /// The audit file or lock is not owner-only and singly linked, or its
+    /// directory is not controlled by the service owner.
+    Storage,
+    /// Another writer already holds the sink's single-writer lock.
+    Locked,
+    /// A chain is present but its records do not verify against the head.
+    Chain,
+}
+
+impl AuditInitializationFault {
+    /// The value-free cause, for the operator message this fault appears in.
+    /// It names the fault and never the audit path, which the operator already
+    /// has in the runtime file.
+    pub fn cause(self) -> &'static str {
+        match self {
+            Self::Configuration => "the audit storage configuration is out of range",
+            Self::Secret => "the audit hash secret is unusable",
+            Self::Storage => {
+                "the audit file or lock is not owner-only, or its directory is unavailable or not owner-controlled"
+            }
+            Self::Locked => "another writer already holds the audit sink lock",
+            Self::Chain => "the existing audit chain did not verify",
+        }
+    }
+}
+
+impl fmt::Display for AuditInitializationFault {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.cause())
+    }
+}
+
+impl From<&EvidenceAuditError> for AuditInitializationFault {
+    fn from(error: &EvidenceAuditError) -> Self {
+        match error {
+            EvidenceAuditError::Configuration => Self::Configuration,
+            EvidenceAuditError::InvalidEvent | EvidenceAuditError::SegmentMissing { .. } => {
+                Self::Chain
+            }
+            EvidenceAuditError::Audit(audit) => match audit {
+                AuditError::Io(error) if error.kind() == std::io::ErrorKind::InvalidData => {
+                    Self::Chain
+                }
+                AuditError::Io(_) => Self::Storage,
+                AuditError::SinkLocked { .. } => Self::Locked,
+                AuditError::EmptyEnvVarName
+                | AuditError::EnvVarUnavailable { .. }
+                | AuditError::EnvVarNotUnicode { .. }
+                | AuditError::EmptySecret { .. }
+                | AuditError::WeakSecret { .. } => Self::Secret,
+                // Everything else the sink can report at startup is a statement
+                // about chain state: a record that does not parse, a hash that
+                // does not match, or a head that cannot be read.
+                _ => Self::Chain,
+            },
+        }
+    }
+}
+
+/// Deployment secret material, resolved and validated exactly as service
+/// startup validates it.
+pub struct ValidatedSecretMaterial {
+    pub audit_secret: ProtectedSecret,
+    pub subject_binding_secret: ProtectedSecret,
+    pub signer: EvidenceSigner,
+    pub jwks: JwksDocument,
+}
+
+/// Secret-derived material needed to prepare an independent verification
+/// context. Unlike complete startup validation, this boundary never resolves
+/// the audit key or opens audit storage.
+pub struct ValidatedVerificationMaterial {
+    pub subject_binding_secret: ProtectedSecret,
+    pub signer: EvidenceSigner,
+    pub jwks: JwksDocument,
+}
+
+/// Resolve and validate the audit, subject-binding, and signing secret
+/// material a bundle names, with no side effects: nothing is written and no
+/// audit chain is opened. Startup builds its runtime state from the returned
+/// material, and `check` runs the same validation so a deployment whose
+/// mounted secrets the server would refuse fails check instead of first
+/// start. Source credentials are deliberately not resolved here: readiness
+/// owns them.
+pub async fn validate_secret_material(
+    bundle: &Bundle,
+    secrets: &SecretResolver,
+) -> Result<ValidatedSecretMaterial, RuntimeInitializationError> {
+    let audit_secret = secrets
+        .resolve(bundle.config.audit.hash_secret_ref.as_str())
+        .map_err(|_| RuntimeInitializationError::Audit(AuditInitializationFault::Secret))?;
+    AuditHashSecret::new(audit_secret.expose_secret().to_vec())
+        .map_err(|_| RuntimeInitializationError::Audit(AuditInitializationFault::Secret))?;
+
+    let verification = validate_verification_material(bundle, secrets).await?;
+
+    Ok(ValidatedSecretMaterial {
+        audit_secret,
+        subject_binding_secret: verification.subject_binding_secret,
+        signer: verification.signer,
+        jwks: verification.jwks,
+    })
+}
+
+/// Resolve and validate only the binding and signing material required to
+/// create a pre-response verification context. This deliberately excludes
+/// source credentials and the audit boundary.
+pub async fn validate_verification_material(
+    bundle: &Bundle,
+    secrets: &SecretResolver,
+) -> Result<ValidatedVerificationMaterial, RuntimeInitializationError> {
+    let subject_binding_secret = secrets
+        .resolve(bundle.config.subject_binding.secret_ref.as_str())
+        .map_err(|_| RuntimeInitializationError::Secrets)?;
+    validate_subject_binding_key(
+        subject_binding_secret.expose_secret(),
+        bundle.config.subject_binding.key_version,
+        &bundle.config.service.trust_domain,
+    )
+    .map_err(|_| RuntimeInitializationError::Secrets)?;
+
+    let signing_secret = secrets
+        .resolve(bundle.config.signing.active_key_ref.as_str())
+        .map_err(|_| RuntimeInitializationError::Signing)?;
+    let signing_json = str::from_utf8(signing_secret.expose_secret())
+        .map_err(|_| RuntimeInitializationError::Signing)?;
+    let private_jwk =
+        PrivateJwk::parse(signing_json).map_err(|_| RuntimeInitializationError::Signing)?;
+    let provider = Arc::new(
+        LocalJwkSigner::new(private_jwk).map_err(|_| RuntimeInitializationError::Signing)?,
+    );
+    let signer = EvidenceSigner::initialize(provider, &bundle.config.signing.active_key_id)
+        .await
+        .map_err(|_| RuntimeInitializationError::Signing)?;
+    let retired = bundle
+        .retired_public_jwks
+        .values()
+        .map(|value| {
+            serde_json::to_string(value)
+                .map_err(|_| RuntimeInitializationError::Signing)
+                .and_then(|json| {
+                    PublicJwk::parse(&json).map_err(|_| RuntimeInitializationError::Signing)
+                })
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+    let jwks = jwks_document(signer.public_jwk(), retired)
+        .map_err(|_| RuntimeInitializationError::Signing)?;
+
+    Ok(ValidatedVerificationMaterial {
+        subject_binding_secret,
+        signer,
+        jwks,
+    })
+}
+
+/// One safe failure classification for the public HTTP boundary.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub struct RuntimeFailure {
+    problem: ProblemCode,
+    category: &'static str,
+}
+
+impl RuntimeFailure {
+    pub fn problem(self) -> ProblemCode {
+        self.problem
+    }
+
+    pub fn category(self) -> &'static str {
+        self.category
+    }
+}
+
+impl std::fmt::Debug for RuntimeFailure {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("RuntimeFailure")
+            .field("problem", &self.problem)
+            .field("category", &self.category)
+            .finish()
+    }
+}
+
+impl std::fmt::Display for RuntimeFailure {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str("the Evidence operation did not complete")
+    }
+}
+
+impl std::error::Error for RuntimeFailure {}
+
+/// One released response: the exact final immutable bytes that were serialized
+/// before the durable disclosure-release audit event, plus their exact media
+/// type. The HTTP boundary returns these bytes unchanged.
+pub struct ReleasedEvidence {
+    format: ResponseFormat,
+    media_type: &'static str,
+    bytes: Vec<u8>,
+}
+
+impl ReleasedEvidence {
+    pub fn format(&self) -> ResponseFormat {
+        self.format
+    }
+
+    pub fn media_type(&self) -> &'static str {
+        self.media_type
+    }
+
+    pub fn bytes(&self) -> &[u8] {
+        &self.bytes
+    }
+
+    pub fn into_bytes(self) -> Vec<u8> {
+        self.bytes
+    }
+}
+
+impl std::fmt::Debug for ReleasedEvidence {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("ReleasedEvidence")
+            .field("format", &self.format)
+            .field("media_type", &self.media_type)
+            .field("bytes", &"<redacted>")
+            .finish()
+    }
+}
+
+/// All runtime state is derived from one captured immutable bundle revision.
+pub struct EvidenceRuntime {
+    kernel: OfflineKernel,
+    runtime_config: RuntimeConfig,
+    runtime_revision: String,
+    authenticator: Authenticator,
+    sources: BTreeMap<String, SourceExecutor>,
+    audit: Arc<EvidenceAuditLog>,
+    signer: EvidenceSigner,
+    jwks: JwksDocument,
+    subject_binding_secret: ProtectedSecret,
+    rate_limiter: Arc<EvidenceRateLimiter>,
+}
+
+impl std::fmt::Debug for EvidenceRuntime {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("EvidenceRuntime")
+            .field("configuration_revision", &self.kernel.bundle().revision())
+            .field("source_count", &self.sources.len())
+            .field("signing_key_id", &self.signer.key_id())
+            .finish_non_exhaustive()
+    }
+}
+
+impl EvidenceRuntime {
+    /// Capture and initialize the complete Version 1 deployment at one revision.
+    pub async fn initialize(runtime_path: &Path) -> Result<Self, RuntimeInitializationError> {
+        Self::initialize_internal(runtime_path, None).await
+    }
+
+    #[cfg(test)]
+    pub(crate) async fn initialize_with_authenticator(
+        runtime_path: &Path,
+        authenticator: Authenticator,
+    ) -> Result<Self, RuntimeInitializationError> {
+        Self::initialize_internal(runtime_path, Some(authenticator)).await
+    }
+
+    async fn initialize_internal(
+        runtime_path: &Path,
+        authenticator_override: Option<Authenticator>,
+    ) -> Result<Self, RuntimeInitializationError> {
+        let deployment =
+            DeploymentInputs::load(runtime_path).map_err(|_| RuntimeInitializationError::Bundle)?;
+        let runtime_document = deployment.runtime;
+        let runtime_config = runtime_document.config.clone();
+        let runtime_revision = runtime_document.revision().to_owned();
+        let bundle = Arc::new(deployment.bundle);
+        let kernel = OfflineKernel::compile(Arc::clone(&bundle))
+            .map_err(|_| RuntimeInitializationError::Bundle)?;
+
+        let secrets = Arc::new(
+            SecretResolver::new(
+                [SecretProvider::File],
+                &runtime_config.secret_providers.file.root,
+            )
+            .map_err(|_| RuntimeInitializationError::Secrets)?,
+        );
+
+        let material = validate_secret_material(&bundle, &secrets).await?;
+        let audit = EvidenceAuditLog::initialize(
+            &runtime_config.audit_storage.path,
+            runtime_config.audit_storage.maximum_file_bytes,
+            material.audit_secret.expose_secret().to_vec(),
+            bundle.config.audit.hash_key_version,
+        )
+        .await
+        .map_err(|error| RuntimeInitializationError::Audit((&error).into()))?;
+
+        let mut sources = BTreeMap::new();
+        for (source_id, source) in bundle.config.sources.iter() {
+            let allowed_selector_sets = bundle.config.source_selector_sets(source_id);
+            let executor = SourceExecutor::new_with_selector_sets_and_tls(
+                source,
+                &allowed_selector_sets,
+                &runtime_config.outbound_tls,
+                &runtime_document.ca_bundles,
+                Arc::clone(&secrets),
+            )
+            .map_err(|_| RuntimeInitializationError::Source)?;
+            sources.insert(source_id.to_owned(), executor);
+        }
+
+        let configured_limits = &bundle.config.rate_limits;
+        let rate_limiter = EvidenceRateLimiter::new(RateLimitConfig {
+            requests_per_principal_per_minute: u32::try_from(
+                configured_limits.requests_per_principal_per_minute,
+            )
+            .map_err(|_| RuntimeInitializationError::RateLimit)?,
+            burst_per_principal: u32::try_from(configured_limits.burst_per_principal)
+                .map_err(|_| RuntimeInitializationError::RateLimit)?,
+            failed_selector_attempts_per_principal_authority_per_minute: u32::try_from(
+                configured_limits.failed_selector_attempts_per_principal_authority_per_minute,
+            )
+            .map_err(|_| RuntimeInitializationError::RateLimit)?,
+        })
+        .map_err(|_| RuntimeInitializationError::RateLimit)?;
+        let rate_limiter = Arc::new(rate_limiter);
+
+        Ok(Self {
+            kernel,
+            runtime_config,
+            runtime_revision,
+            authenticator: authenticator_override.unwrap_or_else(|| {
+                Authenticator::from_config(
+                    &bundle.config.authentication,
+                    bundle.config.assurance_profile,
+                )
+            }),
+            sources,
+            audit: Arc::new(audit),
+            signer: material.signer,
+            jwks: material.jwks,
+            subject_binding_secret: material.subject_binding_secret,
+            rate_limiter,
+        })
+    }
+
+    pub fn bundle(&self) -> &Bundle {
+        self.kernel.bundle()
+    }
+
+    pub fn runtime_config(&self) -> &RuntimeConfig {
+        &self.runtime_config
+    }
+
+    pub fn runtime_revision(&self) -> &str {
+        &self.runtime_revision
+    }
+
+    pub fn jwks(&self) -> &JwksDocument {
+        &self.jwks
+    }
+
+    /// The rate limiter whose tracked-key count backs the
+    /// `evidence_rate_limiter_tracked_keys` gauge on the metrics listener.
+    ///
+    /// Returned as a shared handle, independent of this runtime's own
+    /// lifetime, so the metrics listener can hold it and sample it fresh on
+    /// every scrape.
+    pub(crate) fn rate_limiter(&self) -> Arc<EvidenceRateLimiter> {
+        Arc::clone(&self.rate_limiter)
+    }
+
+    /// The audit chain, for the capacity gauge.
+    ///
+    /// Shared for the same reason as the rate limiter: the metrics listener
+    /// samples the chain's on-disk footprint at scrape time rather than
+    /// caching a value taken at startup.
+    pub(crate) fn audit(&self) -> Arc<EvidenceAuditLog> {
+        Arc::clone(&self.audit)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn replace_signer_for_test(&mut self, signer: EvidenceSigner) {
+        self.signer = signer;
+    }
+
+    /// Readiness proves all locally required material and source credentials.
+    /// It never performs an evidence-data request.
+    ///
+    /// It also asks the access-token issuer for its key set, but only so an
+    /// issuer that has gone quiet is named in the log while requests still
+    /// work. The answer does not decide readiness: the verifier keeps serving
+    /// a key set it cannot recheck for a bounded while, and an issuer outage
+    /// that pulled every replica out of rotation at once would be a cascading
+    /// failure, not a diagnosis.
+    pub async fn ready(&self) -> bool {
+        self.authenticator.probe_key_source().await;
+        if validate_subject_binding_key(
+            self.subject_binding_secret.expose_secret(),
+            self.bundle().config.subject_binding.key_version,
+            &self.bundle().config.service.trust_domain,
+        )
+        .is_err()
+            || !self.signer.ready()
+            || !self.audit.ready().await
+        {
+            return false;
+        }
+        for source in self.sources.values() {
+            if source.credentials_ready().await.is_err() {
+                return false;
+            }
+        }
+        true
+    }
+
+    /// Attempt the access-token issuer's key set once, so a `jwksUri` this
+    /// deployment cannot use is named at startup rather than discovered one
+    /// rejected request at a time. It reports; it does not refuse to start.
+    pub async fn announce_key_source(&self) {
+        self.authenticator.announce_key_source().await;
+    }
+
+    /// List only the complete request shapes that the authenticated caller can
+    /// currently invoke. Discovery performs no source access, credential
+    /// resolution, signing, or evidence-data audit.
+    pub async fn discover(
+        &self,
+        access_token: &str,
+    ) -> Result<EvidenceDefinitions, RuntimeFailure> {
+        let context = self
+            .authenticator
+            .authenticate(access_token)
+            .await
+            .map_err(|_| failure(ProblemCode::AuthenticationFailed, "authentication"))?;
+        let rate_scope = rate_limit_scope(&self.bundle().config.service.trust_domain);
+        let request_limit_key = self
+            .audit
+            .pseudonym("request-rate", &rate_scope, context.principal().as_bytes())
+            .map_err(|_| failure(ProblemCode::ServiceUnavailable, "audit-pseudonym"))?;
+        self.rate_limiter
+            .check_request(&request_limit_key)
+            .await
+            .map_err(map_request_limit)?;
+
+        let mut candidates = BTreeSet::new();
+        for (_, authority) in self.bundle().config.authority_profiles.iter() {
+            for grant in &authority.grants {
+                let mut subjects = grant
+                    .subjects
+                    .iter()
+                    .map(|subject| (subject.role.clone(), subject.selector_profile.clone()))
+                    .collect::<Vec<_>>();
+                subjects.sort();
+                candidates.insert((grant.requirement.clone(), grant.purpose.clone(), subjects));
+            }
+        }
+
+        let mut definitions = Vec::new();
+        for (requirement, purpose, subjects) in candidates {
+            // Discovery only probes the authorization boundary; this internal
+            // request shape is never evaluated or released, so it carries the
+            // fixed non-random placeholder nonce.
+            let request = EvidenceRequest {
+                request_nonce: crate::model::OFFLINE_EVALUATION_REQUEST_NONCE.to_owned(),
+                requirement,
+                purpose,
+                subjects: subjects
+                    .into_iter()
+                    .map(|(role, profile)| RequestedSubject {
+                        role,
+                        selector: RequestedSelector {
+                            profile,
+                            values: None,
+                        },
+                    })
+                    .collect(),
+                holder_key: None,
+            };
+            let Ok(matched) = match_entitlement(self.bundle(), &request, &context) else {
+                continue;
+            };
+            if validate_entitlement_context(self.bundle(), &context, &matched).is_err() {
+                continue;
+            }
+            definitions.push(self.discovery_definition(&request, &matched)?);
+        }
+        let response = EvidenceDefinitions {
+            schema: EVIDENCE_DEFINITIONS_SCHEMA_V1.to_owned(),
+            assurance_profile: self.bundle().config.assurance_profile,
+            configuration_revision: self.bundle().revision().to_owned(),
+            issued_by: self.bundle().config.issuer.id.clone(),
+            provided_by: self.bundle().config.service.provider_id.clone(),
+            definitions,
+        };
+        let contract_value = serde_json::to_value(&response)
+            .map_err(|_| failure(ProblemCode::ServiceUnavailable, "discovery-contract"))?;
+        if !definitions_contract_accepts(&contract_value)
+            .map_err(|_| failure(ProblemCode::ServiceUnavailable, "discovery-contract"))?
+        {
+            return Err(failure(
+                ProblemCode::ServiceUnavailable,
+                "discovery-contract",
+            ));
+        }
+        Ok(response)
+    }
+
+    fn discovery_definition(
+        &self,
+        request: &EvidenceRequest,
+        matched: &MatchedEntitlement,
+    ) -> Result<EvidenceDefinition, RuntimeFailure> {
+        let requirement = self
+            .kernel
+            .requirement(&request.requirement)
+            .ok_or_else(|| failure(ProblemCode::ServiceUnavailable, "discovery-requirement"))?;
+        let subjects = requirement
+            .subject_roles
+            .iter()
+            .map(|role| {
+                let granted = matched
+                    .subjects()
+                    .iter()
+                    .find(|subject| subject.role == role.role)
+                    .ok_or_else(|| failure(ProblemCode::ServiceUnavailable, "discovery-subject"))?;
+                let profile = self
+                    .bundle()
+                    .config
+                    .selector_profiles
+                    .get(&granted.selector_profile)
+                    .ok_or_else(|| {
+                        failure(ProblemCode::ServiceUnavailable, "discovery-selector")
+                    })?;
+                let fields = profile
+                    .fields
+                    .iter()
+                    .map(|(name, field)| self.discovery_selector_field(name, field))
+                    .collect::<Result<Vec<_>, RuntimeFailure>>()?;
+                Ok(EvidenceDefinitionSubject {
+                    role: role.role.clone(),
+                    cardinality: subject_cardinality_name(role.cardinality).to_owned(),
+                    selector: EvidenceDefinitionSelector {
+                        profile: granted.selector_profile.clone(),
+                        value_origin: value_origin_name(granted.value_origin).to_owned(),
+                        fields,
+                    },
+                })
+            })
+            .collect::<Result<Vec<_>, RuntimeFailure>>()?;
+        let concepts = requirement
+            .concepts
+            .iter()
+            .map(|concept| EvidenceDefinitionConcept {
+                id: concept.id.clone(),
+                form: concept_form_name(concept.form).to_owned(),
+            })
+            .collect();
+
+        Ok(EvidenceDefinition {
+            requirement: requirement.id.clone(),
+            kind: requirement_kind_name(requirement.kind).to_owned(),
+            evidence_type: requirement.evidence_type.clone(),
+            purpose: request.purpose.clone(),
+            reference_frameworks: requirement.reference_frameworks.clone(),
+            subjects,
+            concepts,
+        })
+    }
+
+    fn discovery_selector_field(
+        &self,
+        name: &str,
+        field: &SelectorField,
+    ) -> Result<EvidenceSelectorField, RuntimeFailure> {
+        Ok(match field {
+            SelectorField::String {
+                minimum_bytes,
+                maximum_bytes,
+            } => EvidenceSelectorField::String {
+                name: name.to_owned(),
+                minimum_bytes: *minimum_bytes,
+                maximum_bytes: *maximum_bytes,
+            },
+            SelectorField::Date => EvidenceSelectorField::Date {
+                name: name.to_owned(),
+            },
+            SelectorField::Integer { minimum, maximum } => EvidenceSelectorField::Integer {
+                name: name.to_owned(),
+                minimum: *minimum,
+                maximum: *maximum,
+            },
+            SelectorField::Boolean => EvidenceSelectorField::Boolean {
+                name: name.to_owned(),
+            },
+            SelectorField::ControlledCode {
+                codelist,
+                codelist_version,
+                maximum_bytes,
+            } => {
+                let list = self.bundle().codelist(codelist).ok_or_else(|| {
+                    failure(ProblemCode::ServiceUnavailable, "discovery-codelist")
+                })?;
+                EvidenceSelectorField::ControlledCode {
+                    name: name.to_owned(),
+                    scheme: list.id().to_owned(),
+                    version: codelist_version.clone(),
+                    maximum_bytes: *maximum_bytes,
+                }
+            }
+        })
+    }
+
+    /// Run the fixed authenticated signed-default path and return the JWS.
+    ///
+    /// This convenience wrapper deserializes the exact released bytes; the
+    /// HTTP boundary uses [`EvidenceRuntime::evaluate_with_format`] so the
+    /// bytes serialized before release audit are the bytes returned.
+    pub async fn evaluate(
+        &self,
+        operation: &str,
+        access_token: &str,
+        request: &EvidenceRequest,
+    ) -> Result<FlattenedJws, RuntimeFailure> {
+        let released = self
+            .evaluate_at(
+                operation,
+                access_token,
+                request,
+                ResponseFormat::SignedJws,
+                None,
+            )
+            .await?;
+        serde_json::from_slice(released.bytes())
+            .map_err(|_| failure(ProblemCode::ServiceUnavailable, "release-serialization"))
+    }
+
+    /// Run the fixed authenticated path for one explicitly resolved response
+    /// format through serialization and durable release audit.
+    pub async fn evaluate_with_format(
+        &self,
+        operation: &str,
+        access_token: &str,
+        request: &EvidenceRequest,
+        format: ResponseFormat,
+    ) -> Result<ReleasedEvidence, RuntimeFailure> {
+        self.evaluate_at(operation, access_token, request, format, None)
+            .await
+    }
+
+    #[cfg(test)]
+    pub(crate) async fn evaluate_at_for_test(
+        &self,
+        operation: &str,
+        access_token: &str,
+        request: &EvidenceRequest,
+        format: ResponseFormat,
+        evaluation_time: chrono::DateTime<Utc>,
+    ) -> Result<ReleasedEvidence, RuntimeFailure> {
+        self.evaluate_at(
+            operation,
+            access_token,
+            request,
+            format,
+            Some(evaluation_time),
+        )
+        .await
+    }
+
+    async fn evaluate_at(
+        &self,
+        operation: &str,
+        access_token: &str,
+        request: &EvidenceRequest,
+        format: ResponseFormat,
+        evaluation_time: Option<chrono::DateTime<Utc>>,
+    ) -> Result<ReleasedEvidence, RuntimeFailure> {
+        if operation.len() < 16
+            || operation.len() > MAX_OPERATION_BYTES
+            || operation.bytes().any(|byte| byte.is_ascii_whitespace())
+        {
+            return Err(failure(ProblemCode::ServiceUnavailable, "operation-id"));
+        }
+        // The nonce is validated before authentication and never used again
+        // until evidence construction echoes it.
+        if !request_nonce_is_canonical(&request.request_nonce) {
+            return Err(failure(ProblemCode::MalformedRequest, "request-nonce"));
+        }
+        // An unacceptable holder key fails before any credential acquisition or
+        // source access. The key never reaches authorization, selectors, Rhai,
+        // sources, or audit.
+        if request
+            .holder_key
+            .as_ref()
+            .is_some_and(|key| !key.is_acceptable())
+        {
+            return Err(failure(ProblemCode::MalformedRequest, "holder-key"));
+        }
+        let started = Instant::now();
+        let context = self
+            .authenticator
+            .authenticate(access_token)
+            .await
+            .map_err(|_| failure(ProblemCode::AuthenticationFailed, "authentication"))?;
+        let rate_scope = rate_limit_scope(&self.bundle().config.service.trust_domain);
+        let request_limit_key = self
+            .audit
+            .pseudonym("request-rate", &rate_scope, context.principal().as_bytes())
+            .map_err(|_| failure(ProblemCode::ServiceUnavailable, "audit-pseudonym"))?;
+        self.rate_limiter
+            .check_request(&request_limit_key)
+            .await
+            .map_err(map_request_limit)?;
+
+        let scope = audit_scope(
+            &self.bundle().config.service.trust_domain,
+            &request.purpose,
+            context.evidence_audience(),
+        );
+        let requester_pseudonym = self
+            .audit
+            .pseudonym("requester", &scope, context.principal().as_bytes())
+            .map_err(|_| failure(ProblemCode::ServiceUnavailable, "audit-pseudonym"))?;
+
+        let matched = match_entitlement(self.bundle(), request, &context).map_err(map_authority)?;
+        // The immutable bundle and the one complete matched grant must both
+        // permit the requested format. API selection creates no permission,
+        // and the denial does not reveal which layer withheld it.
+        if !self.bundle().config.response_formats.contains(&format)
+            || !matched.permits_response_format(format)
+        {
+            return Err(failure(ProblemCode::NotAuthorized, "response-format"));
+        }
+        let selector_limit_input = canonical_pair(
+            context.principal().as_bytes(),
+            matched.authority_profile().as_bytes(),
+        )
+        .ok_or_else(|| failure(ProblemCode::ServiceUnavailable, "selector-rate-key"))?;
+        let selector_limit_key = self
+            .audit
+            .pseudonym("selector-failure-rate", &rate_scope, &selector_limit_input)
+            .map_err(|_| failure(ProblemCode::ServiceUnavailable, "audit-pseudonym"))?;
+        self.rate_limiter
+            .check_selector_failure_budget(&selector_limit_key)
+            .await
+            .map_err(map_selector_limit)?;
+        let resolved = match resolve_selectors(self.bundle(), request, &context, &matched) {
+            Ok(resolved) => resolved,
+            Err(error) => {
+                if error == AuthorizationError::Selector {
+                    self.rate_limiter
+                        .record_selector_failure(&selector_limit_key)
+                        .await
+                        .map_err(map_selector_limit)?;
+                }
+                return Err(map_authority(error));
+            }
+        };
+
+        let material =
+            self.audit_material(&scope, requester_pseudonym, &context, &resolved, format)?;
+        let (source_id, adapter_id) = self.source_identity(&request.requirement)?;
+        let mut access_event = material.event(
+            operation,
+            AuditPhase::AccessAttempt,
+            AuditDecision::Authorized,
+            elapsed_millis(started),
+        );
+        access_event.source_id = Some(source_id.clone());
+        access_event.adapter_id = Some(adapter_id.clone());
+        self.audit
+            .append(access_event)
+            .await
+            .map_err(|_| failure(ProblemCode::ServiceUnavailable, "access-audit"))?;
+
+        let executor = self
+            .sources
+            .get(&source_id)
+            .ok_or_else(|| failure(ProblemCode::ServiceUnavailable, "source-plan"))?;
+        let requirement = self
+            .kernel
+            .requirement(&request.requirement)
+            .ok_or_else(|| failure(ProblemCode::ServiceUnavailable, "requirement"))?;
+        let source = self
+            .bundle()
+            .config
+            .sources
+            .get(&source_id)
+            .ok_or_else(|| failure(ProblemCode::ServiceUnavailable, "source-plan"))?;
+        let preparation_selector_value =
+            source_selector_input_value(&resolved, &source.request.selector_inputs)?;
+        let selectors = source_selectors(&resolved, &source.request.selector_inputs)?;
+        let request_parts = match self
+            .kernel
+            .prepare(&request.requirement, &preparation_selector_value)
+        {
+            Ok(parts) => parts,
+            Err(error) => {
+                let category = kernel_failure_category(error);
+                self.append_failure(
+                    &material,
+                    operation,
+                    AuditDecision::EvaluationFailure,
+                    category,
+                    &source_id,
+                    &adapter_id,
+                    started,
+                )
+                .await?;
+                return Err(failure(kernel_failure_problem(error), category));
+            }
+        };
+        let source_response = match executor.execute(&selectors, &request_parts).await {
+            Ok(response) => response,
+            Err(error) => {
+                let category = source_failure_category(&error);
+                self.append_failure(
+                    &material,
+                    operation,
+                    AuditDecision::DependencyFailure,
+                    category,
+                    &source_id,
+                    &adapter_id,
+                    started,
+                )
+                .await?;
+                return Err(failure(source_failure_problem(&error), category));
+            }
+        };
+        let observed_at = evaluation_time.unwrap_or_else(Utc::now);
+        let derivation_selectors =
+            selector_input_value(&resolved, &requirement.derivation.selector_inputs)?;
+        let values = match self.kernel.evaluate_with_selectors(
+            &request.requirement,
+            &source_response,
+            &derivation_selectors,
+            observed_at,
+            ValueProjection {
+                audience: context.evidence_audience(),
+                binding_key: self.subject_binding_secret.expose_secret(),
+                binding_key_version: self.bundle().config.subject_binding.key_version,
+            },
+        ) {
+            Ok(KernelOutcome::Match(values)) => values,
+            Ok(KernelOutcome::NoMatch) => {
+                self.append_failure(
+                    &material,
+                    operation,
+                    AuditDecision::NoMatch,
+                    "no-match",
+                    &source_id,
+                    &adapter_id,
+                    started,
+                )
+                .await?;
+                return Err(evidence_unavailable_failure());
+            }
+            Ok(KernelOutcome::Ambiguous) => {
+                self.append_failure(
+                    &material,
+                    operation,
+                    AuditDecision::Ambiguous,
+                    "ambiguous",
+                    &source_id,
+                    &adapter_id,
+                    started,
+                )
+                .await?;
+                return Err(evidence_unavailable_failure());
+            }
+            Err(error) => {
+                let category = kernel_failure_category(error);
+                let problem = kernel_failure_problem(error);
+                let decision = match error {
+                    KernelError::Extraction | KernelError::DerivationInput => {
+                        AuditDecision::FactMissing
+                    }
+                    KernelError::SourceProtocol => AuditDecision::DependencyFailure,
+                    _ => AuditDecision::EvaluationFailure,
+                };
+                self.append_failure(
+                    &material,
+                    operation,
+                    decision,
+                    category,
+                    &source_id,
+                    &adapter_id,
+                    started,
+                )
+                .await?;
+                return Err(failure(problem, category));
+            }
+        };
+
+        let subjects = match self.subject_bindings(&resolved) {
+            Ok(subjects) => subjects,
+            Err(error) => {
+                self.append_failure(
+                    &material,
+                    operation,
+                    AuditDecision::EvaluationFailure,
+                    "subject-binding",
+                    &source_id,
+                    &adapter_id,
+                    started,
+                )
+                .await?;
+                return Err(error);
+            }
+        };
+        let evidence_id = format!("urn:ulid:{}", ulid::Ulid::new());
+        // `issued_at` is read after the source round-trip, so a backward wall-clock
+        // adjustment between it and `observed_at` could otherwise make `issued_at`
+        // precede `observed_at` and fail evidence construction. Clamp the wall-clock
+        // read so issuance never predates observation; an injected evaluation time
+        // keeps both stamps equal.
+        let issued_at = evaluation_time.unwrap_or_else(|| Utc::now().max(observed_at));
+        let evidence = match self.kernel.construct_evidence(
+            &request.requirement,
+            values,
+            EvidenceConstruction {
+                evidence_id: &evidence_id,
+                request_nonce: &request.request_nonce,
+                purpose: &request.purpose,
+                audience: context.evidence_audience(),
+                issued_at,
+                observed_at,
+                subjects,
+            },
+        ) {
+            Ok(evidence) => evidence,
+            Err(_) => {
+                self.append_failure(
+                    &material,
+                    operation,
+                    AuditDecision::EvaluationFailure,
+                    "evidence-construction",
+                    &source_id,
+                    &adapter_id,
+                    started,
+                )
+                .await?;
+                return Err(failure(
+                    ProblemCode::ServiceUnavailable,
+                    "evidence-construction",
+                ));
+            }
+        };
+        let disclosed_concepts = evidence
+            .supported_values
+            .iter()
+            .map(|value| value.provides_value_for.clone())
+            .collect::<Vec<_>>();
+
+        // Serialize the final immutable response bytes before the durable
+        // disclosure-release audit; the released bytes are exactly these. A
+        // signed-path failure never downgrades to unsigned output.
+        let (bytes, media_type, signing_key_id) = match format {
+            ResponseFormat::SignedJws => {
+                let signed = match self.signer.sign_json(&evidence).await {
+                    Ok(signed) => signed,
+                    Err(_) => {
+                        self.append_failure(
+                            &material,
+                            operation,
+                            AuditDecision::SigningFailure,
+                            "signing",
+                            &source_id,
+                            &adapter_id,
+                            started,
+                        )
+                        .await?;
+                        return Err(failure(ProblemCode::ServiceUnavailable, "signing"));
+                    }
+                };
+                let bytes = serde_json::to_vec(&signed)
+                    .map_err(|_| failure(ProblemCode::ServiceUnavailable, "release-serialization"));
+                let bytes = match bytes {
+                    Ok(bytes) => bytes,
+                    Err(error) => {
+                        // Serialization of the already-signed artifact failed;
+                        // record it with the same decision as the unsigned path
+                        // so the audit taxonomy for release-serialization is one
+                        // class regardless of format.
+                        self.append_failure(
+                            &material,
+                            operation,
+                            AuditDecision::EvaluationFailure,
+                            "release-serialization",
+                            &source_id,
+                            &adapter_id,
+                            started,
+                        )
+                        .await?;
+                        return Err(error);
+                    }
+                };
+                (
+                    bytes,
+                    EVIDENCE_JWS_MEDIA_TYPE,
+                    Some(self.signer.key_id().to_owned()),
+                )
+            }
+            ResponseFormat::SdJwtVc => {
+                // The projection re-encodes the constructed payload and
+                // re-derives nothing.
+                let structured_projections = self
+                    .kernel
+                    .requirement(&request.requirement)
+                    .ok_or_else(|| failure(ProblemCode::ServiceUnavailable, "sd-jwt-vc-mapping"))?
+                    .concepts
+                    .iter()
+                    .filter_map(|concept| {
+                        concept
+                            .sd_jwt_vc
+                            .as_ref()
+                            .map(|projection| (concept.id.clone(), projection.claim.clone()))
+                    })
+                    .collect::<BTreeMap<_, _>>();
+                let input = match sdjwt_vc::issuance_input(
+                    &evidence,
+                    request.holder_key.as_ref(),
+                    &structured_projections,
+                ) {
+                    Ok(input) => input,
+                    Err(_) => {
+                        self.append_failure(
+                            &material,
+                            operation,
+                            AuditDecision::EvaluationFailure,
+                            "sd-jwt-vc-mapping",
+                            &source_id,
+                            &adapter_id,
+                            started,
+                        )
+                        .await?;
+                        return Err(failure(
+                            ProblemCode::ServiceUnavailable,
+                            "sd-jwt-vc-mapping",
+                        ));
+                    }
+                };
+                // A signing failure is a safe 503. It never falls back to the
+                // signed-JWS or unsigned format.
+                let serialized = match self.signer.sign_sd_jwt_vc(input).await {
+                    Ok(serialized) => serialized,
+                    Err(_) => {
+                        self.append_failure(
+                            &material,
+                            operation,
+                            AuditDecision::SigningFailure,
+                            "signing",
+                            &source_id,
+                            &adapter_id,
+                            started,
+                        )
+                        .await?;
+                        return Err(failure(ProblemCode::ServiceUnavailable, "signing"));
+                    }
+                };
+                (
+                    serialized.into_bytes(),
+                    EVIDENCE_SD_JWT_VC_MEDIA_TYPE,
+                    Some(self.signer.key_id().to_owned()),
+                )
+            }
+            ResponseFormat::UnsignedJson => {
+                // No signing operation runs, but the ordinary signing
+                // dependency must still be ready for the deployment.
+                if !self.signer.ready() {
+                    self.append_failure(
+                        &material,
+                        operation,
+                        AuditDecision::SigningFailure,
+                        "signing",
+                        &source_id,
+                        &adapter_id,
+                        started,
+                    )
+                    .await?;
+                    return Err(failure(ProblemCode::ServiceUnavailable, "signing"));
+                }
+                let envelope = UnsignedEvidenceEnvelope {
+                    schema: EVIDENCE_UNSIGNED_ENVELOPE_SCHEMA_V1.to_owned(),
+                    envelope_type: UnsignedEnvelopeType::UnsignedEvidenceEnvelope,
+                    integrity_protection: UnsignedIntegrityProtection::None,
+                    warning: UnsignedEnvelopeWarning::NotCryptographicallyVerifiable,
+                    evidence,
+                };
+                let bytes = serde_json::to_vec(&envelope)
+                    .map_err(|_| failure(ProblemCode::ServiceUnavailable, "release-serialization"));
+                let bytes = match bytes {
+                    Ok(bytes) => bytes,
+                    Err(error) => {
+                        self.append_failure(
+                            &material,
+                            operation,
+                            AuditDecision::EvaluationFailure,
+                            "release-serialization",
+                            &source_id,
+                            &adapter_id,
+                            started,
+                        )
+                        .await?;
+                        return Err(error);
+                    }
+                };
+                (bytes, EVIDENCE_UNSIGNED_MEDIA_TYPE, None)
+            }
+        };
+
+        let mut release = material.event(
+            operation,
+            AuditPhase::DisclosureRelease,
+            AuditDecision::Released,
+            elapsed_millis(started),
+        );
+        release.source_id = Some(source_id);
+        release.adapter_id = Some(adapter_id);
+        release.disclosed_concepts = Some(disclosed_concepts);
+        release.evidence_id = Some(evidence_id);
+        release.signing_key_id = signing_key_id;
+        self.audit
+            .append(release)
+            .await
+            .map_err(|_| failure(ProblemCode::ServiceUnavailable, "release-audit"))?;
+        Ok(ReleasedEvidence {
+            format,
+            media_type,
+            bytes,
+        })
+    }
+
+    fn source_identity(&self, requirement_id: &str) -> Result<(String, String), RuntimeFailure> {
+        let requirement = self
+            .kernel
+            .requirement(requirement_id)
+            .ok_or_else(|| failure(ProblemCode::ServiceUnavailable, "requirement"))?;
+        let source = self
+            .bundle()
+            .config
+            .sources
+            .get(&requirement.source)
+            .ok_or_else(|| failure(ProblemCode::ServiceUnavailable, "source-plan"))?;
+        let adapter_id = Path::new(source.extract_script.as_str())
+            .file_stem()
+            .and_then(|name| name.to_str())
+            .filter(|name| !name.is_empty() && name.len() <= 128)
+            .ok_or_else(|| failure(ProblemCode::ServiceUnavailable, "adapter-id"))?;
+        Ok((requirement.source.clone(), adapter_id.to_owned()))
+    }
+
+    fn audit_material(
+        &self,
+        scope: &str,
+        requester_pseudonym: String,
+        context: &AuthenticatedContext,
+        resolved: &ResolvedAuthorization,
+        format: ResponseFormat,
+    ) -> Result<AuditMaterial, RuntimeFailure> {
+        let actor_pseudonym = context
+            .actor()
+            .map(|actor| self.audit.pseudonym("actor", scope, actor.as_bytes()))
+            .transpose()
+            .map_err(|_| failure(ProblemCode::ServiceUnavailable, "audit-pseudonym"))?;
+        let grant_pseudonym = resolved
+            .grant_id
+            .as_deref()
+            .map(|grant| self.audit.pseudonym("grant", scope, grant.as_bytes()))
+            .transpose()
+            .map_err(|_| failure(ProblemCode::ServiceUnavailable, "audit-pseudonym"))?;
+        let subjects = resolved
+            .subjects
+            .iter()
+            .map(|subject| {
+                let protected = subject
+                    .audit_pseudonym_input(&resolved.audience, &resolved.purpose)
+                    .map_err(|_| failure(ProblemCode::ServiceUnavailable, "subject-pseudonym"))?;
+                let pseudonym = self
+                    .audit
+                    .pseudonym("subject-selector-bundle", scope, &protected)
+                    .map_err(|_| failure(ProblemCode::ServiceUnavailable, "audit-pseudonym"))?;
+                Ok(AuditSubject {
+                    role: subject.role.clone(),
+                    selector_profile: subject.selector_profile.clone(),
+                    selector_bundle_pseudonym: Some(pseudonym),
+                })
+            })
+            .collect::<Result<Vec<_>, RuntimeFailure>>()?;
+        Ok(AuditMaterial {
+            assurance_profile: self.bundle().config.assurance_profile,
+            requirement: resolved.requirement.clone(),
+            bundle_revision: self.bundle().revision().to_owned(),
+            purpose: resolved.purpose.clone(),
+            requester_pseudonym,
+            actor_pseudonym,
+            authority: AuditAuthority {
+                kind: map_authority_kind(resolved.authority_kind),
+                grant_pseudonym,
+            },
+            subjects,
+            response_protection: map_response_protection(format),
+        })
+    }
+
+    fn subject_bindings(
+        &self,
+        resolved: &ResolvedAuthorization,
+    ) -> Result<Vec<SubjectBinding>, RuntimeFailure> {
+        resolved
+            .subjects
+            .iter()
+            .map(|subject| {
+                subject
+                    .binding(
+                        self.subject_binding_secret.expose_secret(),
+                        self.bundle().config.subject_binding.key_version,
+                        &self.bundle().config.service.trust_domain,
+                        &resolved.audience,
+                        &resolved.purpose,
+                    )
+                    .map(|binding| SubjectBinding {
+                        role: subject.role.clone(),
+                        binding,
+                    })
+                    .map_err(|_| failure(ProblemCode::ServiceUnavailable, "subject-binding"))
+            })
+            .collect()
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    async fn append_failure(
+        &self,
+        material: &AuditMaterial,
+        operation: &str,
+        decision: AuditDecision,
+        category: &'static str,
+        source_id: &str,
+        adapter_id: &str,
+        started: Instant,
+    ) -> Result<(), RuntimeFailure> {
+        let phase = match decision {
+            AuditDecision::NoMatch | AuditDecision::Ambiguous | AuditDecision::FactMissing => {
+                AuditPhase::Denial
+            }
+            _ => AuditPhase::TransientFailure,
+        };
+        let mut event = material.event(operation, phase, decision, elapsed_millis(started));
+        event.source_id = Some(source_id.to_owned());
+        event.adapter_id = Some(adapter_id.to_owned());
+        event.safe_error_category = Some(category.to_owned());
+        self.audit
+            .append(event)
+            .await
+            .map(|_| ())
+            .map_err(|_| failure(ProblemCode::ServiceUnavailable, "failure-audit"))
+    }
+}
+
+struct AuditMaterial {
+    assurance_profile: AssuranceProfile,
+    requirement: String,
+    bundle_revision: String,
+    purpose: String,
+    requester_pseudonym: String,
+    actor_pseudonym: Option<String>,
+    authority: AuditAuthority,
+    subjects: Vec<AuditSubject>,
+    response_protection: ResponseProtection,
+}
+
+impl AuditMaterial {
+    fn event(
+        &self,
+        operation: &str,
+        phase: AuditPhase,
+        decision: AuditDecision,
+        duration_milliseconds: u64,
+    ) -> EvidenceAuditEvent {
+        let mut event = EvidenceAuditEvent::new(
+            self.assurance_profile,
+            operation.to_owned(),
+            phase,
+            self.requirement.clone(),
+            self.bundle_revision.clone(),
+            self.purpose.clone(),
+            self.requester_pseudonym.clone(),
+            self.authority.clone(),
+            self.subjects.clone(),
+            self.response_protection,
+            decision,
+            duration_milliseconds,
+        );
+        event.actor_pseudonym = self.actor_pseudonym.clone();
+        event
+    }
+}
+
+fn map_response_protection(format: ResponseFormat) -> ResponseProtection {
+    match format {
+        ResponseFormat::SignedJws => ResponseProtection::Signed,
+        ResponseFormat::UnsignedJson => ResponseProtection::Unsigned,
+        ResponseFormat::SdJwtVc => ResponseProtection::SdJwtVc,
+    }
+}
+
+fn source_selectors(
+    resolved: &ResolvedAuthorization,
+    inputs: &[SelectorInput],
+) -> Result<Vec<ResolvedSourceSelector>, RuntimeFailure> {
+    inputs
+        .iter()
+        .map(|input| {
+            let Some(subject) = resolved
+                .subjects
+                .iter()
+                .find(|subject| subject.role == input.role)
+            else {
+                return Ok(None);
+            };
+            let alternative = input
+                .alternatives
+                .iter()
+                .find(|alternative| alternative.profile == subject.selector_profile)
+                .ok_or_else(selector_contract_failure)?;
+            let values = alternative
+                .fields
+                .iter()
+                .map(|name| {
+                    let field = subject
+                        .fields
+                        .iter()
+                        .find(|field| &field.name == name)
+                        .ok_or_else(selector_contract_failure)?;
+                    let value = match &field.value {
+                        ResolvedSelectorValue::String(value)
+                        | ResolvedSelectorValue::Date(value)
+                        | ResolvedSelectorValue::ControlledCode(value) => {
+                            SelectorValue::String(value.clone())
+                        }
+                        ResolvedSelectorValue::Integer(value) => SelectorValue::Integer(*value),
+                        ResolvedSelectorValue::Boolean(value) => SelectorValue::Boolean(*value),
+                    };
+                    Ok((name.clone(), value))
+                })
+                .collect::<Result<BTreeMap<_, _>, RuntimeFailure>>()?;
+            Ok(Some(ResolvedSourceSelector {
+                role: input.role.clone(),
+                profile: alternative.profile.clone(),
+                values,
+            }))
+        })
+        .collect::<Result<Vec<_>, RuntimeFailure>>()
+        .map(|selectors| selectors.into_iter().flatten().collect())
+}
+
+fn source_selector_input_value(
+    resolved: &ResolvedAuthorization,
+    inputs: &[SelectorInput],
+) -> Result<Value, RuntimeFailure> {
+    let active = inputs
+        .iter()
+        .filter(|input| {
+            resolved
+                .subjects
+                .iter()
+                .any(|subject| subject.role == input.role)
+        })
+        .cloned()
+        .collect::<Vec<_>>();
+    if active.is_empty() {
+        return Err(selector_contract_failure());
+    }
+    selector_input_value(resolved, &active)
+}
+
+fn selector_input_value(
+    resolved: &ResolvedAuthorization,
+    inputs: &[SelectorInput],
+) -> Result<Value, RuntimeFailure> {
+    let mut selectors = JsonMap::new();
+    for input in inputs {
+        let (subject, alternative) = selector_input_subject(resolved, input)?;
+        let mut values = JsonMap::new();
+        for name in &alternative.fields {
+            let field = subject
+                .fields
+                .iter()
+                .find(|field| &field.name == name)
+                .ok_or_else(selector_contract_failure)?;
+            values.insert(name.clone(), field.value.as_json());
+        }
+        let mut selector = JsonMap::new();
+        selector.insert(
+            "profile".to_owned(),
+            Value::String(alternative.profile.clone()),
+        );
+        selector.insert("values".to_owned(), Value::Object(values));
+        if selectors
+            .insert(input.role.clone(), Value::Object(selector))
+            .is_some()
+        {
+            return Err(selector_contract_failure());
+        }
+    }
+    Ok(Value::Object(selectors))
+}
+
+fn selector_input_subject<'a>(
+    resolved: &'a ResolvedAuthorization,
+    input: &'a SelectorInput,
+) -> Result<
+    (
+        &'a crate::selector::ResolvedSubject,
+        &'a crate::config::SelectorInputAlternative,
+    ),
+    RuntimeFailure,
+> {
+    let subject = resolved
+        .subjects
+        .iter()
+        .find(|subject| subject.role == input.role)
+        .ok_or_else(selector_contract_failure)?;
+    let alternative = input
+        .alternatives
+        .iter()
+        .find(|alternative| alternative.profile == subject.selector_profile)
+        .ok_or_else(selector_contract_failure)?;
+    Ok((subject, alternative))
+}
+
+fn selector_contract_failure() -> RuntimeFailure {
+    failure(ProblemCode::ServiceUnavailable, "selector-contract")
+}
+
+fn failure(problem: ProblemCode, category: &'static str) -> RuntimeFailure {
+    RuntimeFailure { problem, category }
+}
+
+fn evidence_unavailable_failure() -> RuntimeFailure {
+    failure(ProblemCode::EvidenceNotAvailable, "evidence-unavailable")
+}
+
+fn map_authority(error: AuthorizationError) -> RuntimeFailure {
+    match error {
+        AuthorizationError::Selector => failure(ProblemCode::InvalidSelector, "selector"),
+        AuthorizationError::Unauthorized | AuthorizationError::AmbiguousAuthority => {
+            failure(ProblemCode::NotAuthorized, "authorization")
+        }
+        AuthorizationError::Binding => failure(ProblemCode::ServiceUnavailable, "subject-binding"),
+    }
+}
+
+fn map_request_limit(error: RateLimitError) -> RuntimeFailure {
+    match error {
+        RateLimitError::RequestExceeded => failure(ProblemCode::RateLimited, "request-rate"),
+        _ => failure(ProblemCode::ServiceUnavailable, "request-rate"),
+    }
+}
+
+fn map_selector_limit(error: RateLimitError) -> RuntimeFailure {
+    match error {
+        RateLimitError::FailedSelectorExceeded => {
+            failure(ProblemCode::RateLimited, "selector-rate")
+        }
+        _ => failure(ProblemCode::ServiceUnavailable, "selector-rate"),
+    }
+}
+
+fn source_failure_category(error: &SourceError) -> &'static str {
+    match error {
+        SourceError::Credential => "source-credential",
+        SourceError::Concurrency => "source-concurrency",
+        SourceError::Timeout => "source-timeout",
+        SourceError::Redirect => "source-redirect",
+        SourceError::Status(_) => "source-status",
+        SourceError::WrongMediaType => "source-media-type",
+        SourceError::ResponseTooLarge => "source-response-size",
+        SourceError::InvalidJson
+        | SourceError::ErrorEnvelope
+        | SourceError::ProjectionViolation => "source-protocol",
+        SourceError::InvalidPlan | SourceError::InvalidSelectors | SourceError::Transport => {
+            "source-unavailable"
+        }
+    }
+}
+
+/// Map a closed source-boundary failure to its public problem class.
+///
+/// The offline fixture command uses this same function, so its symbolic
+/// failure cases cannot drift from the production release pipeline.
+pub fn source_failure_problem(_error: &SourceError) -> ProblemCode {
+    ProblemCode::DependencyUnavailable
+}
+
+fn kernel_failure_category(error: KernelError) -> &'static str {
+    match error {
+        KernelError::Preparation => "request-preparation",
+        KernelError::Extraction => "fact-unavailable",
+        KernelError::DerivationInput => "derivation-input",
+        KernelError::SourceProtocol => "source-protocol",
+        KernelError::Script => "script-failure",
+        KernelError::Output => "output-gate",
+        KernelError::Bundle | KernelError::Requirement | KernelError::Evidence => "kernel",
+    }
+}
+
+/// Map a closed kernel failure to its public problem class. The unresolved
+/// classes, including derivation-input inconsistency over a uniquely found
+/// record, collapse to one public shape so status codes cannot become an
+/// existence oracle. Native audit keeps only a value-free category.
+fn kernel_failure_problem(error: KernelError) -> ProblemCode {
+    match error {
+        KernelError::Preparation => ProblemCode::ServiceUnavailable,
+        KernelError::Extraction | KernelError::DerivationInput => ProblemCode::EvidenceNotAvailable,
+        KernelError::SourceProtocol => ProblemCode::DependencyUnavailable,
+        KernelError::Script
+        | KernelError::Output
+        | KernelError::Bundle
+        | KernelError::Requirement
+        | KernelError::Evidence => ProblemCode::ServiceUnavailable,
+    }
+}
+
+fn map_authority_kind(kind: AuthorityKind) -> AuditAuthorityKind {
+    match kind {
+        AuthorityKind::Statutory => AuditAuthorityKind::Statutory,
+        AuthorityKind::Organizational => AuditAuthorityKind::Organizational,
+        AuthorityKind::Consent => AuditAuthorityKind::Consent,
+        AuthorityKind::Delegated => AuditAuthorityKind::Delegated,
+        AuthorityKind::ExplicitRequest => AuditAuthorityKind::ExplicitRequest,
+    }
+}
+
+fn requirement_kind_name(kind: RequirementKind) -> &'static str {
+    match kind {
+        RequirementKind::Criterion => "criterion",
+        RequirementKind::InformationRequirement => "information-requirement",
+        RequirementKind::Constraint => "constraint",
+    }
+}
+
+fn subject_cardinality_name(cardinality: SubjectCardinality) -> &'static str {
+    match cardinality {
+        SubjectCardinality::One => "one",
+    }
+}
+
+fn value_origin_name(origin: ValueOrigin) -> &'static str {
+    match origin {
+        ValueOrigin::AuthenticatedContext => "authenticated-context",
+        ValueOrigin::AuthenticatedGrant => "authenticated-grant",
+        ValueOrigin::Request => "request",
+    }
+}
+
+fn concept_form_name(form: ConceptForm) -> &'static str {
+    match form {
+        ConceptForm::Boolean => "boolean",
+        ConceptForm::ControlledCode => "controlled-code",
+        ConceptForm::ControlledCategory => "controlled-category",
+        ConceptForm::BoundedInteger => "bounded-integer",
+        ConceptForm::BoundedDecimal => "bounded-decimal",
+        ConceptForm::DateBucket => "date-bucket",
+        ConceptForm::TimeBucket => "time-bucket",
+        ConceptForm::AudienceScopedEntityReference => "audience-scoped-entity-reference",
+        ConceptForm::ControlledCodeList => "controlled-code-list",
+        ConceptForm::EntityReferenceList => "entity-reference-list",
+        ConceptForm::ReviewedStructuredValue => "reviewed-structured-value",
+    }
+}
+
+fn audit_scope(trust_domain: &str, purpose: &str, audience: &str) -> String {
+    format!(
+        "v1:{}:{trust_domain}:{}:{purpose}:{}:{audience}",
+        trust_domain.len(),
+        purpose.len(),
+        audience.len()
+    )
+}
+
+/// Rate-limit pseudonyms deliberately omit request-controlled dimensions so a
+/// principal cannot multiply its budget by varying purpose, audience, or
+/// requirement. The pseudonym class and protected input distinguish request
+/// and selector-failure budgets within this deployment scope.
+fn rate_limit_scope(trust_domain: &str) -> String {
+    format!("v1-rate:{}:{trust_domain}", trust_domain.len())
+}
+
+fn canonical_pair(first: &[u8], second: &[u8]) -> Option<Vec<u8>> {
+    let first_length = u32::try_from(first.len()).ok()?;
+    let second_length = u32::try_from(second.len()).ok()?;
+    let mut output = Vec::with_capacity(8 + first.len() + second.len());
+    output.extend_from_slice(&first_length.to_be_bytes());
+    output.extend_from_slice(first);
+    output.extend_from_slice(&second_length.to_be_bytes());
+    output.extend_from_slice(second);
+    Some(output)
+}
+
+fn elapsed_millis(started: Instant) -> u64 {
+    u64::try_from(started.elapsed().as_millis())
+        .unwrap_or(u64::MAX)
+        .min(86_400_000)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn runtime_failures_and_rate_keys_are_value_free() {
+        let failure = failure(ProblemCode::InvalidSelector, "selector");
+        let rendered = format!("{failure:?} {failure}");
+        assert!(!rendered.contains("protected-principal"));
+
+        let first = canonical_pair(b"a", b"bc").expect("pair");
+        let second = canonical_pair(b"ab", b"c").expect("pair");
+        assert_ne!(first, second);
+    }
+
+    #[test]
+    fn audit_scope_is_unambiguous_for_component_boundaries() {
+        assert_ne!(
+            audit_scope("urn:a", "bc", "https://d.invalid"),
+            audit_scope("urn:ab", "c", "https://d.invalid")
+        );
+    }
+
+    #[test]
+    fn rate_limit_scope_cannot_be_fragmented_by_request_dimensions() {
+        let trust_domain = "urn:example:evidence";
+        let shared = rate_limit_scope(trust_domain);
+
+        for (requirement, purpose, audience) in [
+            ("adult", "service-enrolment", "https://one.invalid"),
+            ("residence", "benefit-eligibility", "https://two.invalid"),
+            ("professional", "licence-check", "https://three.invalid"),
+        ] {
+            assert_eq!(rate_limit_scope(trust_domain), shared);
+            assert_ne!(audit_scope(trust_domain, purpose, audience), shared);
+            assert!(!shared.contains(requirement));
+            assert!(!shared.contains(purpose));
+            assert!(!shared.contains(audience));
+        }
+    }
+
+    #[test]
+    fn public_unavailability_does_not_distinguish_no_match_from_ambiguity() {
+        let no_match = evidence_unavailable_failure();
+        let ambiguous = evidence_unavailable_failure();
+
+        assert_eq!(no_match.problem(), ambiguous.problem());
+        assert_eq!(no_match.category(), ambiguous.category());
+        assert_eq!(format!("{no_match:?}"), format!("{ambiguous:?}"));
+    }
+
+    #[test]
+    fn fact_absence_and_trusted_script_failures_have_distinct_public_classes() {
+        assert_eq!(
+            kernel_failure_problem(KernelError::Extraction),
+            ProblemCode::EvidenceNotAvailable
+        );
+        for failure in [KernelError::Script, KernelError::Output] {
+            assert_eq!(
+                kernel_failure_problem(failure),
+                ProblemCode::ServiceUnavailable
+            );
+        }
+    }
+
+    #[test]
+    fn derivation_input_inconsistency_collapses_with_the_unresolved_classes() {
+        assert_eq!(
+            kernel_failure_problem(KernelError::DerivationInput),
+            kernel_failure_problem(KernelError::Extraction)
+        );
+        assert_eq!(
+            kernel_failure_problem(KernelError::DerivationInput),
+            ProblemCode::EvidenceNotAvailable
+        );
+        assert_ne!(
+            kernel_failure_category(KernelError::DerivationInput),
+            kernel_failure_category(KernelError::Extraction)
+        );
+    }
+}
diff --git a/crates/registry-evidence/src/runtime_tests.rs b/crates/registry-evidence/src/runtime_tests.rs
new file mode 100644
index 000000000..23ecdf478
--- /dev/null
+++ b/crates/registry-evidence/src/runtime_tests.rs
@@ -0,0 +1,5800 @@
+use std::{
+    cell::RefCell,
+    collections::{BTreeMap, BTreeSet},
+    fs,
+    io::Write as _,
+    path::{Path, PathBuf},
+    sync::{
+        atomic::{AtomicUsize, Ordering},
+        Arc,
+    },
+    time::{Duration, Instant},
+};
+
+use async_trait::async_trait;
+use axum::{body::Body, http::Request as HttpRequest};
+use axum_test::TestServer;
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use chrono::{DateTime, Utc};
+use jsonwebtoken::{jwk::JwkSet, Algorithm};
+use registry_platform_audit::{verify_jsonl_lines_with_hasher, AuditChainHasher, AuditHashSecret};
+use registry_platform_crypto::{
+    sign, KeyReadiness, LocalJwkSigner, PrivateJwk, PublicJwk, SigningAlgorithm, SigningError,
+    SigningProvider,
+};
+use registry_platform_httputil::FetchUrlPolicy;
+use registry_platform_oidc::{JwksFetcher, JwksFetcherConfig, TokenVerifier, TokenVerifierConfig};
+use serde_json::{json, Value};
+use tempfile::TempDir;
+use tower::ServiceExt as _;
+use wiremock::{
+    matchers::{body_json, header, method, path, query_param},
+    Mock, MockServer, ResponseTemplate,
+};
+
+use crate::{
+    audit::{
+        AuditAuthority, AuditDecision, AuditPhase, AuditSubject,
+        AuthorityKind as AuditAuthorityKind, EvidenceAuditEvent, EvidenceAuditLog,
+        ResponseProtection,
+    },
+    auth::{AuthenticationClaimsConfig, Authenticator},
+    bundle::DeploymentInputs,
+    config::{AssuranceProfile, ResponseFormat},
+    contracts::evidence_contract_accepts,
+    local_verification::{
+        prepare_local_verification_context, verify_local_response, verify_local_response_at,
+        LocalVerificationContext,
+    },
+    model::{
+        Evidence, EvidenceDefinitions, EvidenceRequest, EvidenceSelectorField, FlattenedJws,
+        HolderPublicKey, PublicValue, RequestedSelector, RequestedSubject, SelectorValue,
+        UnsignedEvidenceEnvelope,
+    },
+    observability::{metrics_app, CORRELATION_HEADER, REQUEST_LOG_TARGET},
+    problem::ProblemCode,
+    runtime::{EvidenceRuntime, RuntimeInitializationError},
+    server::{build_app, build_app_at_for_test, build_app_with_metrics, serve_listener_for_test},
+    signing::EvidenceSigner,
+    verifier::{
+        verify_flattened_jws, verify_sd_jwt_vc, EvidenceVerificationPolicy, ExpectedValueForm,
+    },
+    EVIDENCE_SD_JWT_VC_MEDIA_TYPE, EVIDENCE_UNSIGNED_MEDIA_TYPE,
+};
+
+const AUTH_PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"acceptance-auth-key"}"#;
+const EVIDENCE_PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"acceptance-evidence-key"}"#;
+const TOKEN_ISSUER: &str = "https://identity.invalid";
+const TOKEN_AUDIENCE: &str = "evidence-fixture";
+const EVIDENCE_AUDIENCE: &str = "https://relying.invalid/procedure";
+const AUTHORITY: &str = "statutory-caseworker-v1";
+const BEARER: &str = "source-bearer-canary";
+const BASIC_USER: &str = "source-user-canary";
+const BASIC_PASSWORD: &str = "source-password-canary";
+const PARENT_REFERENCE: &str = "synthetic-parent-reference-001";
+const NON_PARENT_REFERENCE: &str = "synthetic-non-parent-reference-003";
+const LOG_TOKEN_CANARY: &str = "operational-log-token-canary";
+const LOG_SELECTOR_CANARY: &str = "operational-log-selector-canary";
+
+struct AcceptanceRuntime {
+    _temporary: TempDir,
+    bundle_root: PathBuf,
+    runtime_path: PathBuf,
+    runtime: Arc<EvidenceRuntime>,
+    server: MockServer,
+    audit_path: PathBuf,
+}
+
+struct PreparedAcceptance {
+    temporary: TempDir,
+    bundle_root: PathBuf,
+    runtime_path: PathBuf,
+    server: MockServer,
+    audit_path: PathBuf,
+}
+
+/// A prepared bundle and runtime file with no opinion about what serves the
+/// configured source origin.
+struct PreparedFixture {
+    temporary: TempDir,
+    bundle_root: PathBuf,
+    runtime_path: PathBuf,
+    audit_path: PathBuf,
+}
+
+struct FailAfterSelfTestSigner {
+    delegate: LocalJwkSigner,
+    calls: AtomicUsize,
+}
+
+struct UnavailableReadinessSigner {
+    delegate: LocalJwkSigner,
+}
+
+/// Start the real Evidence HTTP router over TCP for one operator-driven curl,
+/// then verify the returned JWS and durable audit before completing.
+///
+/// This intentionally uses the deterministic acceptance source and a static
+/// test JWKS. Live provider credentials are neither needed nor read here.
+#[tokio::test]
+#[ignore = "operator-driven local curl checkpoint"]
+async fn first_curl_exercises_and_verifies_the_evidence_server() {
+    let fixture = acceptance_runtime().await;
+    // The documented optional unsigned curl may run before the signed one, so
+    // the deterministic source accepts one or two identical lookups.
+    Mock::given(method("POST"))
+        .and(path("/v1/facts"))
+        .and(header("accept", "application/json"))
+        .and(header("authorization", format!("Bearer {BEARER}").as_str()))
+        .and(body_json(json!({
+            "lookup": {
+                "given_name": "Amina",
+                "family_name": "Diallo",
+                "birth_date": "2000-01-01"
+            },
+            "fields": ["date_of_birth"],
+            "limit": 2
+        })))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "total": 1,
+            "date_of_birth": "2000-01-01"
+        })))
+        .expect(1..=2)
+        .mount(&fixture.server)
+        .await;
+
+    let request = adult_request();
+    let token = access_token(Some(parent_grant_claims()));
+    let state_root =
+        Path::new(env!("CARGO_MANIFEST_DIR")).join("../../products/evidence/.first-curl");
+    fs::create_dir_all(&state_root).expect("first-curl state directory is created");
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt as _;
+        fs::set_permissions(&state_root, fs::Permissions::from_mode(0o700))
+            .expect("first-curl state directory is owner-only");
+    }
+    let definitions_path = state_root.join("definitions.json");
+    let response_path = state_root.join("response.json");
+    let unsigned_path = state_root.join("response-unsigned.json");
+    for stale in [&definitions_path, &response_path, &unsigned_path] {
+        match fs::remove_file(stale) {
+            Ok(()) => {}
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+            Err(error) => panic!("stale first-curl output could not be removed: {error}"),
+        }
+    }
+
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:18080")
+        .await
+        .expect("first-curl listener binds on 127.0.0.1:18080");
+    let address = listener
+        .local_addr()
+        .expect("listener address is available");
+    write_secret(
+        &state_root,
+        "request.json",
+        &serde_json::to_string_pretty(&request).expect("request serializes"),
+    );
+    write_secret(
+        &state_root,
+        "session.env",
+        &format!("EVIDENCE_ACCESS_TOKEN={token}\n"),
+    );
+
+    println!(
+        "Evidence first-curl server is ready at http://{address}. The ignored session.env contains only the short-lived synthetic bearer token. Use the plain curl command in products/evidence/FIRST-CURL-TEST.md."
+    );
+
+    let (shutdown_tx, shutdown_rx) = tokio::sync::oneshot::channel();
+    let runtime = Arc::clone(&fixture.runtime);
+    let server = tokio::spawn(async move {
+        serve_listener_for_test(runtime, listener, async move {
+            let _ = shutdown_rx.await;
+        })
+        .await
+    });
+
+    let definitions = tokio::time::timeout(Duration::from_secs(180), async {
+        loop {
+            if let Ok(bytes) = fs::read(&definitions_path) {
+                if let Ok(definitions) = serde_json::from_slice::<EvidenceDefinitions>(&bytes) {
+                    break definitions;
+                }
+                if let Ok(problem) = serde_json::from_slice::<Value>(&bytes) {
+                    if let Some(code) = problem.get("code").and_then(Value::as_str) {
+                        panic!("Evidence discovery returned the safe problem code {code}");
+                    }
+                }
+            }
+            tokio::time::sleep(Duration::from_millis(50)).await;
+        }
+    })
+    .await
+    .expect("curl discovery response arrives within three minutes");
+    assert_eq!(definitions.definitions.len(), 4);
+    assert_eq!(
+        definitions.configuration_revision,
+        fixture.runtime.bundle().revision()
+    );
+    let serialized_definitions =
+        serde_json::to_string(&definitions).expect("discovery response serializes");
+    for prohibited in [
+        "fixture-agency",
+        "statutory-caseworker-v1",
+        "source-a",
+        "adapters/",
+        "derivations/",
+        "codelists/",
+        "secret:",
+    ] {
+        assert!(!serialized_definitions.contains(prohibited));
+    }
+
+    let serialized = tokio::time::timeout(Duration::from_secs(180), async {
+        loop {
+            if let Ok(bytes) = fs::read(&response_path) {
+                if serde_json::from_slice::<FlattenedJws>(&bytes).is_ok() {
+                    break bytes;
+                }
+                if let Ok(problem) = serde_json::from_slice::<Value>(&bytes) {
+                    if let Some(code) = problem.get("code").and_then(Value::as_str) {
+                        panic!("Evidence returned the safe problem code {code}");
+                    }
+                }
+            }
+            tokio::time::sleep(Duration::from_millis(50)).await;
+        }
+    })
+    .await
+    .expect("curl response arrives within three minutes");
+
+    let evidence = verify_flattened_jws(
+        &serialized,
+        fixture.runtime.jwks(),
+        &verification_policy(&fixture.runtime, &request, &serialized),
+    )
+    .expect("curl response JWS verifies against the running Evidence JWKS");
+    assert_eq!(
+        evidence.supported_values[0].value,
+        PublicValue::Boolean(true)
+    );
+    assert_minimized_payload(&serialized);
+
+    shutdown_tx
+        .send(())
+        .expect("first-curl server is still running");
+    server
+        .await
+        .expect("first-curl server task joins")
+        .expect("first-curl server stops cleanly");
+
+    // The optional unsigned leg, when the operator ran it, produced its own
+    // self-identifying envelope and its own pair of durable audit events.
+    let unsigned_leg_ran = match fs::read(&unsigned_path) {
+        Ok(bytes) => {
+            let envelope: UnsignedEvidenceEnvelope = serde_json::from_slice(&bytes)
+                .expect("unsigned first-curl output parses as the closed envelope");
+            assert_eq!(envelope.evidence.request_nonce, request.request_nonce);
+            assert!(
+                verify_flattened_jws(
+                    &bytes,
+                    fixture.runtime.jwks(),
+                    &verification_policy(&fixture.runtime, &request, &serialized),
+                )
+                .is_err(),
+                "the strict JWS verifier must reject the unsigned envelope"
+            );
+            true
+        }
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => false,
+        Err(error) => panic!("unsigned first-curl output could not be read: {error}"),
+    };
+    let audit = fs::read_to_string(&fixture.audit_path).expect("first-curl audit is readable");
+    let expected_audit_lines = if unsigned_leg_ran { 4 } else { 2 };
+    assert_eq!(audit.lines().count(), expected_audit_lines);
+    assert!(!audit.contains(&request.request_nonce));
+    if unsigned_leg_ran {
+        println!(
+            "PASS: authenticated discovery listed four safe request shapes, Evidence returned HTTP 200 in both formats, the JWS verified, the unsigned envelope was self-identifying and rejected by the JWS verifier, adult-status was true, minimization held, and all four audit events were durable."
+        );
+    } else {
+        println!(
+            "PASS: authenticated discovery listed four safe request shapes, Evidence returned HTTP 200, its JWS verified, adult-status was true, minimization held, and both audit events were durable."
+        );
+    }
+}
+
+#[async_trait]
+impl SigningProvider for UnavailableReadinessSigner {
+    fn algorithm(&self) -> SigningAlgorithm {
+        self.delegate.algorithm()
+    }
+
+    fn key_id(&self) -> &str {
+        self.delegate.key_id()
+    }
+
+    fn public_jwk(&self) -> PublicJwk {
+        self.delegate.public_jwk()
+    }
+
+    fn readiness(&self) -> KeyReadiness {
+        KeyReadiness::NotReady
+    }
+
+    async fn sign(&self, payload: &[u8]) -> Result<Vec<u8>, SigningError> {
+        self.delegate.sign(payload).await
+    }
+}
+
+#[async_trait]
+impl SigningProvider for FailAfterSelfTestSigner {
+    fn algorithm(&self) -> SigningAlgorithm {
+        self.delegate.algorithm()
+    }
+
+    fn key_id(&self) -> &str {
+        self.delegate.key_id()
+    }
+
+    fn public_jwk(&self) -> PublicJwk {
+        self.delegate.public_jwk()
+    }
+
+    fn readiness(&self) -> KeyReadiness {
+        KeyReadiness::Ready
+    }
+
+    async fn sign(&self, payload: &[u8]) -> Result<Vec<u8>, SigningError> {
+        if self.calls.fetch_add(1, Ordering::AcqRel) == 0 {
+            self.delegate.sign(payload).await
+        } else {
+            Err(SigningError::external("synthetic unavailable signer"))
+        }
+    }
+}
+
+#[tokio::test]
+async fn real_router_serves_all_definitions_concurrently_without_crossing_boundaries() {
+    let fixture = acceptance_runtime().await;
+    let http = TestServer::new(build_app(Arc::clone(&fixture.runtime)));
+
+    let health = http.get("/health").await;
+    health.assert_status_ok();
+    assert_eq!(health.json::<Value>(), json!({"status": "ok"}));
+    let ready = http.get("/ready").await;
+    ready.assert_status_ok();
+    assert_eq!(ready.json::<Value>(), json!({"status": "ready"}));
+    assert!(fixture
+        .server
+        .received_requests()
+        .await
+        .expect("request journal is available")
+        .is_empty());
+    let jwks = http.get("/.well-known/evidence/jwks.json").await;
+    jwks.assert_status_ok();
+    assert_eq!(jwks.header("content-type"), "application/jwk-set+json");
+    assert_eq!(
+        jwks.json::<crate::model::JwksDocument>(),
+        *fixture.runtime.jwks()
+    );
+
+    let standard_token = access_token(None);
+    let parent_token = access_token(Some(parent_grant_claims()));
+    let standard_discovery = http
+        .get("/v1/evidence-definitions")
+        .add_header("authorization", format!("Bearer {standard_token}"))
+        .await;
+    standard_discovery.assert_status_ok();
+    assert_eq!(
+        standard_discovery.header("content-type"),
+        "application/json"
+    );
+    let standard_definitions = standard_discovery.json::<EvidenceDefinitions>();
+    assert_eq!(standard_definitions.definitions.len(), 3);
+    assert_eq!(
+        standard_definitions.configuration_revision,
+        fixture.runtime.bundle().revision()
+    );
+    assert!(standard_definitions
+        .definitions
+        .iter()
+        .all(|definition| !definition.requirement.contains("legal-parent")));
+
+    let parent_discovery = http
+        .get("/v1/evidence-definitions")
+        .add_header("authorization", format!("Bearer {parent_token}"))
+        .await;
+    parent_discovery.assert_status_ok();
+    let parent_definitions = parent_discovery.json::<EvidenceDefinitions>();
+    assert_eq!(parent_definitions.definitions.len(), 4);
+    let adult_definition = parent_definitions
+        .definitions
+        .iter()
+        .find(|definition| definition.requirement.ends_with(":adult-status:v1"))
+        .expect("authorized adult definition is discoverable");
+    assert!(adult_definition.subjects[0].selector.fields.iter().any(
+        |field| matches!(field, EvidenceSelectorField::Date { name } if name == "birth_date")
+    ));
+    let parent_definition = parent_definitions
+        .definitions
+        .iter()
+        .find(|definition| {
+            definition
+                .requirement
+                .ends_with(":legal-parent-relationship:v1")
+        })
+        .expect("grant-backed relationship definition is discoverable");
+    assert_eq!(
+        parent_definition.subjects[1].selector.value_origin,
+        "authenticated-grant"
+    );
+    let serialized_discovery =
+        serde_json::to_string(&parent_definitions).expect("discovery serializes");
+    for prohibited in [
+        "fixture-agency",
+        "statutory-caseworker-v1",
+        "source-a",
+        "adapters/",
+        "derivations/",
+        "codelists/",
+        "secret:",
+    ] {
+        assert!(
+            !serialized_discovery.contains(prohibited),
+            "discovery exposed protected deployment material"
+        );
+    }
+    assert!(fixture
+        .server
+        .received_requests()
+        .await
+        .expect("request journal is available")
+        .is_empty());
+    assert!(
+        fs::read_to_string(&fixture.audit_path)
+            .expect("audit is readable")
+            .is_empty(),
+        "metadata discovery must not create evidence-data audit records"
+    );
+
+    mount_success_sources(&fixture.server, false).await;
+    let adult_request = adult_request();
+    let residence_request = residence_request();
+    let licence_request = licence_request();
+    let parent_request = parent_request();
+
+    let adult = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {standard_token}"))
+        .json(&adult_request);
+    let residence = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {standard_token}"))
+        .json(&residence_request);
+    let licence = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {standard_token}"))
+        .json(&licence_request);
+    let parent = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {parent_token}"))
+        .json(&parent_request);
+    let (adult, residence, licence, parent) = tokio::join!(adult, residence, licence, parent);
+
+    for (response, request, expected_concept, expected_value, expected_roles) in [
+        (
+            adult,
+            &adult_request,
+            "urn:example:fixture:concept:adult-status",
+            PublicValue::Boolean(true),
+            vec!["subject"],
+        ),
+        (
+            residence,
+            &residence_request,
+            "urn:example:fixture:concept:residence-region",
+            PublicValue::String("REGION-NORTH".to_owned()),
+            vec!["subject"],
+        ),
+        (
+            licence,
+            &licence_request,
+            "urn:example:fixture:concept:licence-active",
+            PublicValue::Boolean(true),
+            vec!["subject"],
+        ),
+        (
+            parent,
+            &parent_request,
+            "urn:example:fixture:concept:legal-parent-relationship-confirmed",
+            PublicValue::Boolean(false),
+            vec!["child", "candidate-parent"],
+        ),
+    ] {
+        response.assert_status_ok();
+        assert_eq!(response.header("content-type"), "application/jose+json");
+        let jws = response.json::<FlattenedJws>();
+        let serialized = serde_json::to_vec(&jws).expect("router JWS serializes");
+        let evidence = verify_flattened_jws(
+            &serialized,
+            fixture.runtime.jwks(),
+            &verification_policy(&fixture.runtime, request, &serialized),
+        )
+        .expect("router response verifies");
+        assert_eq!(
+            evidence
+                .subjects
+                .iter()
+                .map(|subject| subject.role.as_str())
+                .collect::<Vec<_>>(),
+            expected_roles
+        );
+        assert!(evidence.supported_values.iter().any(|value| {
+            value.provides_value_for == expected_concept && value.value == expected_value
+        }));
+        assert_minimized_payload(&serialized);
+    }
+
+    let audit = fs::read_to_string(&fixture.audit_path).expect("durable audit is readable");
+    assert_eq!(audit.matches("\"phase\":\"access-attempt\"").count(), 4);
+    assert_eq!(audit.matches("\"phase\":\"disclosure-release\"").count(), 4);
+    for canary in privacy_canaries() {
+        assert!(!audit.contains(canary));
+    }
+}
+
+/// One identifier is minted per request at the boundary and stays the same
+/// everywhere an operator can observe it. Without a response header the
+/// identifier the problem body reports is the only copy the caller ever sees,
+/// so a support report cannot be joined to a server-side record.
+#[tokio::test]
+async fn every_response_carries_the_request_scoped_correlation_identifier() {
+    let fixture = acceptance_runtime().await;
+    let http = TestServer::new(build_app(Arc::clone(&fixture.runtime)));
+
+    let health = http.get("/health").await;
+    health.assert_status_ok();
+    let first = correlation_id(&health);
+
+    // A rejected request reports one identifier, not one per error site.
+    let denied = http.get("/v1/evidence-definitions").await;
+    assert_eq!(denied.status_code(), axum::http::StatusCode::UNAUTHORIZED);
+    assert_eq!(correlation_id(&denied), denied.json::<Value>()["operation"]);
+
+    // An unrouted request correlates on the same terms.
+    let unknown = http.get("/absent").await;
+    assert_eq!(
+        correlation_id(&unknown),
+        unknown.json::<Value>()["operation"]
+    );
+
+    // Identifiers are request-scoped, never process-scoped.
+    let second = http.get("/health").await;
+    assert_ne!(first, correlation_id(&second));
+}
+
+/// Section 12 fixes exactly what an operational record may contain. Anything
+/// outside that set is a disclosure the record has never been reviewed for, so
+/// the field set is asserted whole rather than field by field.
+#[test]
+fn operational_logs_carry_only_the_reviewed_fields_and_disclose_no_value() {
+    let emitted = capture_evidence_logs(|| async {
+        let fixture = acceptance_runtime().await;
+        let http = TestServer::new(build_app(Arc::clone(&fixture.runtime)));
+
+        http.get("/health").await.assert_status_ok();
+
+        // The body parses and its selector values are held in memory before
+        // authentication rejects the request, so this exercises the disclosure
+        // path rather than an early parse failure.
+        let rejected = http
+            .post("/v1/evidence")
+            .add_header("authorization", format!("Bearer {LOG_TOKEN_CANARY}"))
+            .json(&request(
+                "urn:example:fixture:requirement:adult-status:v1",
+                "fixture-eligibility",
+                vec![requested_subject(
+                    "subject",
+                    "person-demographics-v1",
+                    Some([
+                        ("given_name", LOG_SELECTOR_CANARY),
+                        ("family_name", "Diallo"),
+                        ("birth_date", "2000-01-01"),
+                    ]),
+                )],
+            ))
+            .await;
+        assert_eq!(
+            rejected.status_code(),
+            axum::http::StatusCode::UNAUTHORIZED,
+            "the canary token is not a verifiable access token"
+        );
+    });
+
+    let served: Vec<&Value> = emitted
+        .iter()
+        .filter(|record| record["target"] == json!(REQUEST_LOG_TARGET))
+        .collect();
+    assert_eq!(served.len(), 2, "one operational record per served request");
+
+    for record in &served {
+        let fields = record["fields"]
+            .as_object()
+            .expect("an operational record carries fields");
+        assert_eq!(
+            fields.keys().map(String::as_str).collect::<BTreeSet<_>>(),
+            BTreeSet::from([
+                "message",
+                "route",
+                "operation",
+                "duration_ms",
+                "status",
+                "error"
+            ])
+        );
+        assert!(fields["duration_ms"].is_u64());
+        assert!(!fields["operation"]
+            .as_str()
+            .expect("the operation identifier is a string")
+            .is_empty());
+    }
+
+    // The route template, never the requested path, and a status category
+    // rather than a code.
+    assert_eq!(served[0]["fields"]["route"], json!("/health"));
+    assert_eq!(served[0]["fields"]["status"], json!("success"));
+    assert_eq!(served[0]["fields"]["error"], json!("none"));
+    assert_eq!(served[1]["fields"]["route"], json!("/v1/evidence"));
+    assert_eq!(served[1]["fields"]["status"], json!("client_error"));
+    assert_eq!(served[1]["fields"]["error"], json!("authentication_failed"));
+
+    // No token, selector value, purpose, or requirement identity reaches an
+    // operational record this crate emits.
+    let raw = serde_json::to_string(&emitted).expect("captured records serialize");
+    for canary in [
+        LOG_TOKEN_CANARY,
+        LOG_SELECTOR_CANARY,
+        "Diallo",
+        "2000-01-01",
+        "fixture-eligibility",
+        "adult-status",
+    ] {
+        assert!(
+            !raw.contains(canary),
+            "an operational log disclosed {canary}"
+        );
+    }
+}
+
+/// Counters describe traffic. They must say how the boundary behaved without
+/// naming what any request asked for, and their label set must stay bounded by
+/// the route table rather than by anything a caller can send.
+#[tokio::test]
+async fn metrics_report_bounded_series_without_disclosing_request_content() {
+    let fixture = acceptance_runtime().await;
+    let (app, metrics) = build_app_with_metrics(Arc::clone(&fixture.runtime));
+    let http = TestServer::new(app);
+
+    http.get("/health").await.assert_status_ok();
+    http.get("/health").await.assert_status_ok();
+    let denied = http.get("/v1/evidence-definitions").await;
+    assert_eq!(denied.status_code(), axum::http::StatusCode::UNAUTHORIZED);
+    http.get("/absent-path-canary").await;
+
+    let exposition = TestServer::new(metrics_app(Arc::clone(&metrics)));
+    let rendered = exposition.get("/metrics").await;
+    rendered.assert_status_ok();
+    assert_eq!(rendered.header("content-type"), "text/plain; version=0.0.4");
+    let body = rendered.text();
+
+    assert!(body.contains(
+        "evidence_http_requests_total{route=\"/health\",method=\"GET\",status=\"success\",error=\"none\"} 2\n"
+    ));
+    assert!(body.contains(
+        "evidence_http_requests_total{route=\"/v1/evidence-definitions\",method=\"GET\",status=\"client_error\",error=\"authentication_failed\"} 1\n"
+    ));
+    assert!(body.contains("evidence_http_request_duration_seconds_count{route=\"/health\""));
+
+    // An unrouted request is one fixed label, never the path the caller chose.
+    assert!(body.contains("route=\"unmatched\""));
+    assert!(!body.contains("absent-path-canary"));
+    for canary in privacy_canaries() {
+        assert!(!body.contains(canary), "metrics disclosed {canary}");
+    }
+
+    // The metrics application answers for metrics only; it is not a second
+    // way to reach the evidence routes.
+    for path in ["/health", "/v1/evidence-definitions", "/openapi.json"] {
+        assert_eq!(
+            exposition.get(path).await.status_code(),
+            axum::http::StatusCode::NOT_FOUND,
+            "the metrics listener served {path}"
+        );
+    }
+}
+
+/// The metrics endpoint is opt-in deployment surface on its own socket. The
+/// evidence listener must not gain a metrics route, and the two listeners must
+/// share one lifecycle so shutdown leaves nothing behind.
+#[tokio::test]
+async fn a_configured_metrics_listener_serves_beside_the_evidence_listener() {
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    let evidence_port = reserved_port();
+    let metrics_port = reserved_port();
+    let mut document =
+        fs::read_to_string(&prepared.runtime_path).expect("runtime configuration is readable");
+    replace_exact(
+        &mut document,
+        "port: 8080",
+        &format!("port: {evidence_port}"),
+        1,
+    );
+    document.push_str(&format!(
+        "metricsListener:\n  bindHost: 127.0.0.1\n  port: {metrics_port}\n"
+    ));
+    // The prepared document is already read-only, as deployment requires, so
+    // this variant is written before the runtime captures it.
+    make_file_writable(&prepared.runtime_path);
+    fs::write(&prepared.runtime_path, &document).expect("runtime configuration is rewritten");
+    make_file_read_only(&prepared.runtime_path);
+    let runtime = Arc::new(
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("the runtime initializes with a metrics listener"),
+    );
+
+    let (stop, stopped) = tokio::sync::oneshot::channel::<()>();
+    let server = tokio::spawn(crate::server::serve(runtime, async move {
+        let _ = stopped.await;
+    }));
+    let client = reqwest::Client::new();
+    let evidence = format!("http://127.0.0.1:{evidence_port}");
+    let telemetry = format!("http://127.0.0.1:{metrics_port}");
+    await_ready(&client, &format!("{evidence}/health")).await;
+
+    let exposition = client
+        .get(format!("{telemetry}/metrics"))
+        .send()
+        .await
+        .expect("the metrics listener answers");
+    assert_eq!(exposition.status(), reqwest::StatusCode::OK);
+    assert!(exposition
+        .text()
+        .await
+        .expect("the exposition is readable")
+        .contains("evidence_http_requests_total{route=\"/health\""));
+
+    // The evidence listener gained no metrics route of its own.
+    let on_evidence_listener = client
+        .get(format!("{evidence}/metrics"))
+        .send()
+        .await
+        .expect("the evidence listener answers");
+    assert_eq!(
+        on_evidence_listener.status(),
+        reqwest::StatusCode::BAD_REQUEST
+    );
+    assert_eq!(
+        on_evidence_listener
+            .json::<Value>()
+            .await
+            .expect("problem body")["code"],
+        json!("malformed_request")
+    );
+
+    let _ = stop.send(());
+    server
+        .await
+        .expect("the service task joins")
+        .expect("the service stops cleanly");
+
+    // One shutdown closes both sockets.
+    assert!(client
+        .get(format!("{telemetry}/metrics"))
+        .send()
+        .await
+        .is_err());
+    assert!(client
+        .get(format!("{evidence}/health"))
+        .send()
+        .await
+        .is_err());
+}
+
+/// Reserve an ephemeral port and release it, so a test can name a port in
+/// configuration that the operating system has just confirmed is free.
+fn reserved_port() -> u16 {
+    let listener =
+        std::net::TcpListener::bind("127.0.0.1:0").expect("an ephemeral port is available");
+    listener
+        .local_addr()
+        .expect("the reserved socket has an address")
+        .port()
+}
+
+async fn await_ready(client: &reqwest::Client, url: &str) {
+    for _ in 0..100 {
+        if let Ok(response) = client.get(url).send().await {
+            if response.status().is_success() {
+                return;
+            }
+        }
+        tokio::time::sleep(Duration::from_millis(20)).await;
+    }
+    panic!("the evidence listener never became reachable at {url}");
+}
+
+fn correlation_id(response: &axum_test::TestResponse) -> Value {
+    json!(response
+        .header(CORRELATION_HEADER)
+        .to_str()
+        .expect("the correlation header is ASCII"))
+}
+
+/// Collect every record this crate emits while `body` runs.
+///
+/// The subscriber is thread-local and the request future is driven to
+/// completion on this thread, so records emitted from the detached evaluation
+/// task land in the same buffer.
+///
+/// Earlier tests serve requests with no subscriber installed, which caches the
+/// request boundary's callsite as permanently uninteresting and drops the
+/// global maximum level to off. A thread-local subscriber does not undo that on
+/// its own, so one subscriber is installed process-wide on first use and routes
+/// each record to the buffer of the thread that emitted it. Tests running
+/// concurrently on other threads have no buffer and their records are dropped.
+fn capture_evidence_logs<F, Fut>(body: F) -> Vec<Value>
+where
+    F: FnOnce() -> Fut,
+    Fut: std::future::Future<Output = ()>,
+{
+    static INSTALLED: std::sync::Once = std::sync::Once::new();
+    INSTALLED.call_once(|| {
+        tracing::subscriber::set_global_default(
+            tracing_subscriber::fmt()
+                .json()
+                .with_max_level(tracing::Level::INFO)
+                .with_writer(CapturedLogs)
+                .finish(),
+        )
+        .expect("this test binary installs no other subscriber");
+    });
+
+    let buffer = Arc::new(std::sync::Mutex::new(Vec::<u8>::new()));
+    CAPTURED_LOGS.with(|slot| *slot.borrow_mut() = Some(Arc::clone(&buffer)));
+    let executor = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .expect("a single-threaded executor builds");
+    executor.block_on(body());
+    CAPTURED_LOGS.with(|slot| *slot.borrow_mut() = None);
+
+    let raw = buffer
+        .lock()
+        .expect("the log buffer is not poisoned")
+        .clone();
+    String::from_utf8(raw)
+        .expect("operational records are UTF-8")
+        .lines()
+        .filter_map(|line| serde_json::from_str::<Value>(line).ok())
+        .filter(|record| {
+            record["target"]
+                .as_str()
+                .is_some_and(|target| target.starts_with("registry_evidence"))
+        })
+        .collect()
+}
+
+thread_local! {
+    /// The buffer `capture_evidence_logs` is filling on this thread, if any.
+    static CAPTURED_LOGS: std::cell::RefCell<Option<Arc<std::sync::Mutex<Vec<u8>>>>> =
+        const { std::cell::RefCell::new(None) };
+}
+
+#[derive(Clone)]
+struct CapturedLogs;
+
+impl std::io::Write for CapturedLogs {
+    fn write(&mut self, buffer: &[u8]) -> std::io::Result<usize> {
+        // A record emitted outside a capture window belongs to a test that is
+        // not inspecting logs, so it is deliberately discarded rather than
+        // written anywhere.
+        let _ = CAPTURED_LOGS.try_with(|slot| {
+            if let Some(sink) = slot.borrow().as_ref() {
+                sink.lock()
+                    .expect("the log buffer is not poisoned")
+                    .extend_from_slice(buffer);
+            }
+        });
+        Ok(buffer.len())
+    }
+
+    fn flush(&mut self) -> std::io::Result<()> {
+        Ok(())
+    }
+}
+
+impl<'writer> tracing_subscriber::fmt::MakeWriter<'writer> for CapturedLogs {
+    type Writer = Self;
+
+    fn make_writer(&'writer self) -> Self::Writer {
+        self.clone()
+    }
+}
+
+#[tokio::test]
+async fn openapi_route_serves_the_generated_contract_without_authentication_or_source_access() {
+    let fixture = acceptance_runtime().await;
+    let http = TestServer::new(build_app(Arc::clone(&fixture.runtime)));
+
+    let document = http.get("/openapi.json").await;
+    document.assert_status_ok();
+    assert_eq!(document.header("content-type"), "application/openapi+json");
+    assert_eq!(document.header("cache-control"), "no-store");
+
+    // The served bytes are the committed release artifact, not a second
+    // hand-maintained description of the same routes.
+    let generated = crate::contracts::documents().expect("generated contracts build");
+    assert_eq!(document.text(), generated[crate::contracts::OPENAPI_FILE]);
+
+    // The document is static public material: it names no definition, reveals
+    // no deployment revision, and reaches no source.
+    let served = document.json::<Value>();
+    assert_eq!(served["openapi"], json!("3.1.0"));
+    assert!(served["paths"]["/openapi.json"]["get"].is_object());
+    assert!(!document
+        .text()
+        .contains(&fixture.runtime.bundle().revision().to_string()));
+    assert!(fixture
+        .server
+        .received_requests()
+        .await
+        .expect("request journal is available")
+        .is_empty());
+
+    // Only GET is in the contract; anything else joins the closed unknown-route
+    // problem response.
+    let rejected = http.post("/openapi.json").await;
+    assert_eq!(
+        rejected.status_code(),
+        ProblemCode::MalformedRequest.status()
+    );
+    assert_eq!(
+        rejected.json::<Value>()["code"],
+        json!(ProblemCode::MalformedRequest.code())
+    );
+
+    let audit = fs::read_to_string(&fixture.audit_path).expect("durable audit is readable");
+    assert!(audit.is_empty());
+}
+
+#[tokio::test]
+async fn discovery_requires_authentication_and_returns_no_unentitled_definitions() {
+    let fixture = acceptance_runtime().await;
+    let http = TestServer::new(build_app(Arc::clone(&fixture.runtime)));
+
+    let missing = http.get("/v1/evidence-definitions").await;
+    assert_eq!(missing.status_code(), axum::http::StatusCode::UNAUTHORIZED);
+    assert_eq!(
+        missing.json::<Value>()["code"],
+        json!("authentication_failed")
+    );
+
+    let filtered = http
+        .get("/v1/evidence-definitions?requirement=caller-selected")
+        .add_header("authorization", format!("Bearer {}", access_token(None)))
+        .await;
+    assert_eq!(filtered.status_code(), axum::http::StatusCode::BAD_REQUEST);
+    assert_eq!(filtered.json::<Value>()["code"], json!("malformed_request"));
+
+    let body_response = build_app(Arc::clone(&fixture.runtime))
+        .oneshot(
+            HttpRequest::builder()
+                .uri("/v1/evidence-definitions")
+                .header("authorization", format!("Bearer {}", access_token(None)))
+                .body(Body::from("{}"))
+                .expect("discovery request is valid"),
+        )
+        .await
+        .expect("discovery router responds");
+    assert_eq!(body_response.status(), axum::http::StatusCode::BAD_REQUEST);
+
+    let now = Utc::now().timestamp();
+    let unentitled = signed_access_token(json!({
+        "iss": TOKEN_ISSUER,
+        "aud": TOKEN_AUDIENCE,
+        "sub": "unentitled-discovery-principal",
+        "iat": now - 1,
+        "exp": now + 3600,
+        "evidence_tags": ["unentitled-agency"],
+        "evidence_audience": EVIDENCE_AUDIENCE
+    }));
+    let response = http
+        .get("/v1/evidence-definitions")
+        .add_header("authorization", format!("Bearer {unentitled}"))
+        .await;
+    response.assert_status_ok();
+    assert!(response
+        .json::<EvidenceDefinitions>()
+        .definitions
+        .is_empty());
+    assert!(fixture
+        .server
+        .received_requests()
+        .await
+        .expect("request journal is available")
+        .is_empty());
+    assert!(
+        fs::read_to_string(&fixture.audit_path)
+            .expect("audit is readable")
+            .is_empty(),
+        "denied discovery must not create evidence-data audit records"
+    );
+}
+
+#[tokio::test]
+async fn discovery_omits_an_authority_shape_that_the_runtime_would_deny_as_ambiguous() {
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    make_writable(&prepared.bundle_root);
+    let configuration_path = prepared.bundle_root.join("evidence.yaml");
+    let mut configuration =
+        fs::read_to_string(&configuration_path).expect("acceptance configuration is readable");
+    replace_exact(
+        &mut configuration,
+        "authorityProfiles:\n  statutory-caseworker-v1:",
+        r#"authorityProfiles:
+  overlapping-caseworker-v1:
+    kind: statutory
+    requesterTags: [fixture-agency]
+    grants:
+      - requirement: urn:example:fixture:requirement:adult-status:v1
+        purpose: fixture-eligibility
+        audienceFrom: authenticated-requester
+        subjects:
+          - {role: subject, selectorProfile: person-demographics-v1, valueOrigin: request}
+  statutory-caseworker-v1:"#,
+        1,
+    );
+    fs::write(&configuration_path, configuration).expect("test configuration is rewritten");
+    make_read_only(&prepared.bundle_root);
+    let runtime = Arc::new(
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("overlapping runtime initializes for fail-closed request decisions"),
+    );
+    let http = TestServer::new(build_app(runtime));
+
+    let response = http
+        .get("/v1/evidence-definitions")
+        .add_header("authorization", format!("Bearer {}", access_token(None)))
+        .await;
+    response.assert_status_ok();
+    let definitions = response.json::<EvidenceDefinitions>();
+    assert_eq!(definitions.definitions.len(), 2);
+    assert!(definitions
+        .definitions
+        .iter()
+        .all(|definition| !definition.requirement.ends_with(":adult-status:v1")));
+    assert!(prepared
+        .server
+        .received_requests()
+        .await
+        .expect("request journal is available")
+        .is_empty());
+    assert!(fs::read_to_string(&prepared.audit_path)
+        .expect("audit is readable")
+        .is_empty());
+}
+
+#[tokio::test]
+async fn discovery_uses_the_bounded_per_principal_request_budget() {
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    make_writable(&prepared.bundle_root);
+    let configuration_path = prepared.bundle_root.join("evidence.yaml");
+    let mut configuration =
+        fs::read_to_string(&configuration_path).expect("acceptance configuration is readable");
+    replace_exact(
+        &mut configuration,
+        "rateLimits: {requestsPerPrincipalPerMinute: 60, burstPerPrincipal: 10, failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 10}",
+        "rateLimits: {requestsPerPrincipalPerMinute: 1, burstPerPrincipal: 1, failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 10}",
+        1,
+    );
+    fs::write(&configuration_path, configuration).expect("test configuration is rewritten");
+    make_read_only(&prepared.bundle_root);
+    let runtime = Arc::new(
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("rate-limited discovery runtime initializes"),
+    );
+    let http = TestServer::new(build_app(runtime));
+    let token = access_token(None);
+
+    http.get("/v1/evidence-definitions")
+        .add_header("authorization", format!("Bearer {token}"))
+        .await
+        .assert_status_ok();
+    let limited = http
+        .get("/v1/evidence-definitions")
+        .add_header("authorization", format!("Bearer {token}"))
+        .await;
+    assert_eq!(
+        limited.status_code(),
+        axum::http::StatusCode::TOO_MANY_REQUESTS
+    );
+    assert_eq!(limited.json::<Value>()["code"], json!("rate_limited"));
+    assert_eq!(limited.header("retry-after"), "1");
+    assert!(prepared
+        .server
+        .received_requests()
+        .await
+        .expect("request journal is available")
+        .is_empty());
+}
+
+#[tokio::test]
+async fn serving_runtime_never_reloads_merges_or_falls_back_after_bundle_capture() {
+    let fixture = acceptance_runtime().await;
+    let captured_revision = fixture.runtime.bundle().revision().to_owned();
+    let captured_runtime_revision = fixture.runtime.runtime_revision().to_owned();
+    let captured_config = fixture
+        .runtime
+        .bundle()
+        .artifact("evidence.yaml")
+        .expect("captured configuration exists")
+        .to_vec();
+    let adapter_path = "adapters/adult-status-source.rhai";
+    let captured_adapter = fixture
+        .runtime
+        .bundle()
+        .artifact(adapter_path)
+        .expect("captured adapter exists")
+        .to_vec();
+
+    make_writable(&fixture.bundle_root);
+    make_file_writable(&fixture.runtime_path);
+    fs::write(
+        &fixture.runtime_path,
+        b"this: is-not-the-captured-runtime\n",
+    )
+    .expect("replace on-disk runtime configuration");
+    fs::write(
+        fixture.bundle_root.join("evidence.yaml"),
+        b"this: is-not-the-captured-revision\n",
+    )
+    .expect("replace on-disk configuration");
+    fs::remove_file(fixture.bundle_root.join(adapter_path)).expect("remove on-disk adapter");
+    fs::write(
+        fixture.bundle_root.join("adapters/fallback.rhai"),
+        b"fn extract(_) { no_match() }\n",
+    )
+    .expect("add an unreferenced fallback-like artifact");
+
+    assert_eq!(fixture.runtime.bundle().revision(), captured_revision);
+    assert_eq!(
+        fixture.runtime.runtime_revision(),
+        captured_runtime_revision
+    );
+    assert_eq!(
+        fixture.runtime.bundle().artifact("evidence.yaml"),
+        Some(captured_config.as_slice())
+    );
+    assert_eq!(
+        fixture.runtime.bundle().artifact(adapter_path),
+        Some(captured_adapter.as_slice())
+    );
+    assert!(fixture
+        .runtime
+        .bundle()
+        .artifact("adapters/fallback.rhai")
+        .is_none());
+
+    mount_adult_source(&fixture.server, None).await;
+    let request = adult_request();
+    let jws = fixture
+        .runtime
+        .evaluate(
+            "operation-captured-bundle-revision",
+            &access_token(None),
+            &request,
+        )
+        .await
+        .expect("captured runtime still evaluates with captured artifacts");
+    let serialized = serde_json::to_vec(&jws).expect("JWS serializes");
+    let evidence = verify_flattened_jws(
+        &serialized,
+        fixture.runtime.jwks(),
+        &verification_policy(&fixture.runtime, &request, &serialized),
+    )
+    .expect("captured-revision assertion verifies");
+    assert_eq!(evidence.configuration_revision, captured_revision);
+    assert_eq!(
+        evidence.supported_values[0].value,
+        PublicValue::Boolean(true)
+    );
+}
+
+#[tokio::test]
+async fn local_runtime_without_fixture_references_keeps_the_real_security_path() {
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    let local_issuer = prepared.server.uri();
+    let auth_private = PrivateJwk::parse(AUTH_PRIVATE_JWK).expect("auth test key parses");
+    Mock::given(method("GET"))
+        .and(path("/.well-known/jwks.json"))
+        .respond_with(
+            ResponseTemplate::new(200).set_body_json(json!({"keys": [auth_private.public()]})),
+        )
+        .mount(&prepared.server)
+        .await;
+    make_writable(&prepared.bundle_root);
+    let configuration_path = prepared.bundle_root.join("evidence.yaml");
+    let strict =
+        fs::read_to_string(&configuration_path).expect("acceptance configuration is readable");
+    let mut local = strict
+        .replace(
+            "assuranceProfile: evidence-grade",
+            "assuranceProfile: local",
+        )
+        .lines()
+        .filter(|line| !line.trim_start().starts_with("fixtures:"))
+        .collect::<Vec<_>>()
+        .join("\n");
+    replace_exact(
+        &mut local,
+        "issuer: https://identity.invalid",
+        &format!("issuer: {local_issuer}"),
+        1,
+    );
+    replace_exact(
+        &mut local,
+        "jwksUri: https://identity.invalid/.well-known/jwks.json",
+        &format!("jwksUri: {local_issuer}/.well-known/jwks.json"),
+        1,
+    );
+    fs::write(&configuration_path, local).expect("local configuration is written");
+    let fixture_directory = prepared.bundle_root.join("fixtures");
+    for entry in fs::read_dir(&fixture_directory).expect("fixture directory reads") {
+        fs::remove_file(entry.expect("fixture entry reads").path())
+            .expect("unreferenced fixture is removed");
+    }
+    make_read_only(&prepared.bundle_root);
+
+    // Close independent expectations before the source exists and before a
+    // response or audit record can exist. Preparation uses the deployed
+    // profile-aware authenticator, not the in-memory test override.
+    let request = adult_request();
+    let token = access_token_for_issuer(&local_issuer, "requester-principal-canary", None);
+    let deployment = DeploymentInputs::load(&prepared.runtime_path)
+        .expect("the immutable local deployment reloads");
+    let context = prepare_local_verification_context(&deployment, &request, &token)
+        .await
+        .expect("real local token closes the verification context");
+    assert!(
+        !prepared.audit_path.exists(),
+        "context preparation never opens audit storage"
+    );
+    let preparation_requests = prepared
+        .server
+        .received_requests()
+        .await
+        .expect("authentication request journal is available");
+    assert!(
+        preparation_requests.iter().all(|request| {
+            request.method.as_str() == "GET" && request.url.path() == "/.well-known/jwks.json"
+        }),
+        "context preparation reaches only the configured authentication JWKS"
+    );
+
+    let mut bad_token = token.clone();
+    let last = bad_token.pop().expect("token has a signature");
+    bad_token.push(if last == 'A' { 'B' } else { 'A' });
+    assert!(
+        prepare_local_verification_context(&deployment, &request, &bad_token)
+            .await
+            .is_err(),
+        "a token that fails real signature verification cannot create context"
+    );
+
+    let mut holder_request = request.clone();
+    holder_request.holder_key = Some(HolderPublicKey {
+        kty: "OKP".to_owned(),
+        crv: "Ed25519".to_owned(),
+        x: "1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc".to_owned(),
+        alg: Some("EdDSA".to_owned()),
+        kid: Some("acceptable-holder-key".to_owned()),
+    });
+    assert!(
+        holder_request
+            .holder_key
+            .as_ref()
+            .is_some_and(HolderPublicKey::is_acceptable),
+        "the negative exercises an otherwise acceptable holder key"
+    );
+    assert!(
+        prepare_local_verification_context(&deployment, &holder_request, &token)
+            .await
+            .is_err(),
+        "the signed-JWS-only seam rejects even an acceptable holder key"
+    );
+
+    let mut wrong_request = request.clone();
+    wrong_request.request_nonce = URL_SAFE_NO_PAD.encode([0x22; 32]);
+    let wrong_request_context =
+        prepare_local_verification_context(&deployment, &wrong_request, &token)
+            .await
+            .expect("an independently valid request creates its own context");
+
+    let mut wrong_subject = request.clone();
+    wrong_subject.subjects[0]
+        .selector
+        .values
+        .as_mut()
+        .expect("adult selectors are request-owned")
+        .insert(
+            "family_name".to_owned(),
+            SelectorValue::String("Different".to_owned()),
+        );
+    let wrong_subject_context =
+        prepare_local_verification_context(&deployment, &wrong_subject, &token)
+            .await
+            .expect("an authorized different subject creates a different binding");
+
+    let runtime = Arc::new(
+        EvidenceRuntime::initialize(&prepared.runtime_path)
+            .await
+            .expect("local runtime initializes without an authenticator override"),
+    );
+    assert_eq!(
+        runtime.bundle().config.assurance_profile,
+        AssuranceProfile::Local
+    );
+    assert!(runtime.bundle().fixtures.is_empty());
+
+    let http = TestServer::new(build_app(Arc::clone(&runtime)));
+    let definitions_response = http
+        .get("/v1/evidence-definitions")
+        .add_header("authorization", format!("Bearer {token}"))
+        .await;
+    definitions_response.assert_status_ok();
+    let definitions = definitions_response.json::<EvidenceDefinitions>();
+    assert_eq!(definitions.assurance_profile, AssuranceProfile::Local);
+
+    mount_adult_source(&prepared.server, None).await;
+    let response = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {token}"))
+        .json(&request)
+        .await;
+    response.assert_status_ok();
+    assert_eq!(response.header("content-type"), "application/jose+json");
+    let jws = response.json::<FlattenedJws>();
+    let serialized = serde_json::to_vec(&jws).expect("JWS serializes");
+    let verified = verify_local_response(context.clone(), &serialized)
+        .expect("the response strictly verifies against pre-response state");
+    assert_eq!(verified.request_nonce, request.request_nonce);
+    assert_eq!(
+        verified.supported_values[0].value,
+        PublicValue::Boolean(true)
+    );
+    assert!(
+        verify_local_response(wrong_request_context, &serialized).is_err(),
+        "a response cannot verify against another retained request"
+    );
+    assert!(
+        verify_local_response(wrong_subject_context, &serialized).is_err(),
+        "a response cannot verify against another subject binding"
+    );
+
+    let context_json = serde_json::to_value(&context).expect("context serializes");
+    assert_eq!(
+        context_json["trustedJwks"],
+        serde_json::to_value(runtime.jwks()).expect("runtime JWKS serializes"),
+        "the closed context pins the exact public signing JWKS"
+    );
+    for (pointer, replacement, reason) in [
+        (
+            "/verificationPolicy/configurationRevision",
+            json!("sha256:wrong-bundle"),
+            "another bundle revision",
+        ),
+        (
+            "/verificationPolicy/expectedSubjects/0/binding",
+            json!(format!("urn:evidence:subject:v1_{}", "A".repeat(43))),
+            "a changed retained subject binding",
+        ),
+        (
+            "/verificationPolicy/expectedAssuranceProfile",
+            json!("production"),
+            "a production assurance expectation",
+        ),
+        (
+            "/trustedJwks/keys/0/x",
+            json!(URL_SAFE_NO_PAD.encode([0x44; 32])),
+            "a changed trust key",
+        ),
+    ] {
+        let mut changed = context_json.clone();
+        *changed
+            .pointer_mut(pointer)
+            .unwrap_or_else(|| panic!("context pointer {pointer} exists")) = replacement;
+        let changed: LocalVerificationContext =
+            serde_json::from_value(changed).expect("changed context remains structurally closed");
+        assert!(
+            verify_local_response(changed, &serialized).is_err(),
+            "response must fail against {reason}"
+        );
+    }
+
+    let mut tampered_response = serde_json::to_value(&jws).expect("flattened response serializes");
+    tampered_response["signature"] = json!("A".repeat(86));
+    assert!(
+        verify_local_response(
+            context.clone(),
+            &serde_json::to_vec(&tampered_response).expect("tampered response serializes"),
+        )
+        .is_err(),
+        "response tampering fails closed"
+    );
+
+    let expired_at = DateTime::parse_from_rfc3339(&verified.valid_until)
+        .expect("validUntil parses")
+        .with_timezone(&Utc)
+        + chrono::Duration::seconds(
+            i64::try_from(runtime.bundle().config.signing.verifier_clock_skew_seconds)
+                .expect("clock skew fits i64")
+                + 1,
+        );
+    assert!(
+        verify_local_response_at(context, &serialized, expired_at).is_err(),
+        "an expired response fails strict local verification"
+    );
+
+    let evidence = verify_flattened_jws(
+        &serialized,
+        runtime.jwks(),
+        &verification_policy(&runtime, &request, &serialized),
+    )
+    .expect("local assertion verifies under an explicit local expectation");
+    assert_eq!(evidence.assurance_profile, AssuranceProfile::Local);
+
+    let events = fs::read_to_string(&prepared.audit_path).expect("audit reads");
+    let events = events
+        .lines()
+        .map(|line| serde_json::from_str::<Value>(line).expect("audit event parses"))
+        .collect::<Vec<_>>();
+    assert_eq!(events.len(), 2);
+    assert!(events
+        .iter()
+        .all(|event| event["record"]["assuranceProfile"] == json!("local")));
+}
+
+#[tokio::test]
+async fn admitted_evaluation_survives_client_disconnect_and_keeps_audit_chain_usable() {
+    let fixture = acceptance_runtime().await;
+    mount_adult_source(&fixture.server, Some(Duration::from_millis(750))).await;
+
+    let request = adult_request();
+    let client_token = access_token(None);
+    let body = serde_json::to_vec(&request).expect("request serializes");
+    let app = build_app(Arc::clone(&fixture.runtime));
+    let client_bound = tokio::spawn(async move {
+        app.oneshot(
+            HttpRequest::builder()
+                .method("POST")
+                .uri("/v1/evidence")
+                .header("authorization", format!("Bearer {client_token}"))
+                .header("content-type", "application/json")
+                .body(Body::from(body))
+                .expect("HTTP request builds"),
+        )
+        .await
+    });
+
+    wait_for_source_request_count(&fixture.server, 1).await;
+    client_bound.abort();
+    assert!(
+        client_bound
+            .await
+            .expect_err("client-bound handler is cancelled")
+            .is_cancelled(),
+        "the regression must exercise handler cancellation"
+    );
+
+    let audit = wait_for_audit_counts(&fixture.audit_path, 1, 1).await;
+    assert_eq!(audit.matches("\"phase\":\"access-attempt\"").count(), 1);
+    assert_eq!(audit.matches("\"phase\":\"disclosure-release\"").count(), 1);
+    wait_for_runtime_ready(&fixture.runtime).await;
+
+    fixture.server.reset().await;
+    mount_adult_source(&fixture.server, None).await;
+    fixture
+        .runtime
+        .evaluate(
+            "operation-after-client-disconnect",
+            &access_token(None),
+            &adult_request(),
+        )
+        .await
+        .expect("a later evaluation can append to the same audit chain");
+    let audit = wait_for_audit_counts(&fixture.audit_path, 2, 2).await;
+    assert_eq!(audit.matches("\"phase\":\"access-attempt\"").count(), 2);
+    assert_eq!(audit.matches("\"phase\":\"disclosure-release\"").count(), 2);
+    assert!(fixture.runtime.ready().await);
+}
+
+#[tokio::test]
+async fn graceful_shutdown_waits_for_admitted_evaluation_and_terminal_audit() {
+    let fixture = acceptance_runtime().await;
+    mount_adult_source(&fixture.server, Some(Duration::from_millis(750))).await;
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("test listener binds");
+    let address = listener
+        .local_addr()
+        .expect("listener address is available");
+    let (shutdown_tx, shutdown_rx) = tokio::sync::oneshot::channel();
+    let runtime = Arc::clone(&fixture.runtime);
+    let serving = tokio::spawn(async move {
+        crate::server::serve_listener_for_test(runtime, listener, async move {
+            let _ = shutdown_rx.await;
+        })
+        .await
+    });
+    tokio::task::yield_now().await;
+
+    let client = reqwest::Client::builder()
+        .no_proxy()
+        .build()
+        .expect("test client builds");
+    let request = adult_request();
+    let token = access_token(None);
+    let response = tokio::spawn(async move {
+        client
+            .post(format!("http://{address}/v1/evidence"))
+            .bearer_auth(token)
+            .json(&request)
+            .send()
+            .await
+            .expect("request completes")
+    });
+    wait_for_source_request_count(&fixture.server, 1).await;
+    shutdown_tx
+        .send(())
+        .expect("server still observes shutdown signal");
+    assert!(
+        !serving.is_finished(),
+        "shutdown cannot finish while protected evaluation is active"
+    );
+
+    let response = response.await.expect("request task completes");
+    assert_eq!(response.status(), reqwest::StatusCode::OK);
+    tokio::time::timeout(Duration::from_secs(3), serving)
+        .await
+        .expect("server drains before timeout")
+        .expect("server task does not panic")
+        .expect("server exits cleanly");
+    let audit = wait_for_audit_counts(&fixture.audit_path, 1, 1).await;
+    assert_eq!(audit.matches("\"phase\":\"access-attempt\"").count(), 1);
+    assert_eq!(audit.matches("\"phase\":\"disclosure-release\"").count(), 1);
+}
+
+#[tokio::test]
+async fn weak_subject_binding_key_fails_initialization_before_source_access() {
+    let prepared = prepare_acceptance("0123456789012345678901234567890").await;
+    let result =
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await;
+    let error = match result {
+        Ok(_) => panic!("a 31-byte subject-binding key must be rejected"),
+        Err(error) => error,
+    };
+    assert!(
+        matches!(error, RuntimeInitializationError::Secrets),
+        "weak binding key failed at the wrong boundary: {error:?}"
+    );
+    assert!(
+        prepared
+            .server
+            .received_requests()
+            .await
+            .expect("request journal is available")
+            .is_empty(),
+        "initialization cannot contact an evidence source"
+    );
+}
+
+#[tokio::test]
+async fn readiness_fails_for_missing_credentials_tampered_audit_and_unready_signing() {
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    let runtime =
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("runtime initializes");
+    fs::remove_file(prepared.temporary.path().join("secrets/source-a-token"))
+        .expect("source credential is removed");
+    assert!(
+        !runtime.ready().await,
+        "missing source credentials deny readiness"
+    );
+
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    let runtime =
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("runtime initializes");
+    fs::write(&prepared.audit_path, b"{}\n").expect("audit is tampered");
+    assert!(
+        !runtime.ready().await,
+        "invalid audit chain denies readiness"
+    );
+
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    let mut runtime =
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("runtime initializes");
+    let private = PrivateJwk::parse(EVIDENCE_PRIVATE_JWK).expect("test signing key parses");
+    let provider: Arc<dyn SigningProvider> = Arc::new(UnavailableReadinessSigner {
+        delegate: LocalJwkSigner::new(private).expect("test signer builds"),
+    });
+    let signer = EvidenceSigner::initialize(provider, "acceptance-evidence-key")
+        .await
+        .expect("provider self-test succeeds independently of readiness posture");
+    runtime.replace_signer_for_test(signer);
+    assert!(
+        !runtime.ready().await,
+        "unready signing provider denies readiness"
+    );
+}
+
+/// Readiness asks the access-token issuer for its key set and does not let the
+/// answer decide readiness.
+///
+/// The issuer is not this deployment's to fix, and every replica shares it. A
+/// readiness check that failed on it would take the whole deployment out of
+/// rotation at once, for a cause removing it from rotation cannot address, and
+/// would do so while the verifier was still accepting tokens signed by keys
+/// already in hand. The probe stays because the log line it produces is worth
+/// having; readiness stays local because the traffic decision is.
+#[tokio::test]
+async fn readiness_reports_an_unretrievable_issuer_key_set_without_denying_readiness() {
+    let private = PrivateJwk::parse(AUTH_PRIVATE_JWK).expect("auth test key parses");
+    let issuer = MockServer::start().await;
+    Mock::given(method("GET"))
+        .and(path("/jwks"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({"keys": [private.public()]})))
+        .mount(&issuer)
+        .await;
+
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    let reachable = EvidenceRuntime::initialize_with_authenticator(
+        &prepared.runtime_path,
+        fetching_authenticator(&format!("{}/jwks", issuer.uri())),
+    )
+    .await
+    .expect("runtime initializes");
+    assert!(
+        reachable.ready().await,
+        "a retrievable issuer key set is ready"
+    );
+
+    // Port 1 on the loopback interface refuses: the shape of a private CA the
+    // service does not trust or an issuer that is down, where the address is
+    // configured and nothing answers on it.
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    let unreachable = EvidenceRuntime::initialize_with_authenticator(
+        &prepared.runtime_path,
+        fetching_authenticator("http://127.0.0.1:1/jwks"),
+    )
+    .await
+    .expect("runtime initializes");
+    assert!(
+        unreachable.ready().await,
+        "an unretrievable issuer key set is reported, not made a traffic decision"
+    );
+    // The probe answered, which is what the report is made from, and answering
+    // did not disturb the local readiness verdict on a second check either.
+    assert!(
+        unreachable.ready().await,
+        "a repeated check under a suppressed probe holds the same verdict"
+    );
+}
+
+#[tokio::test]
+async fn access_audit_failure_blocks_credentials_and_source_access() {
+    let fixture = acceptance_runtime().await;
+    fs::write(&fixture.audit_path, b"{}\n").expect("audit tamper writes");
+
+    let error = fixture
+        .runtime
+        .evaluate(
+            "operation-access-audit-failure",
+            &access_token(None),
+            &adult_request(),
+        )
+        .await
+        .expect_err("an unverifiable access audit must fail closed");
+    assert_eq!(error.problem(), ProblemCode::ServiceUnavailable);
+    assert!(
+        fixture
+            .server
+            .received_requests()
+            .await
+            .expect("request journal is available")
+            .is_empty(),
+        "source credentials and data requests remain untouched"
+    );
+}
+
+#[tokio::test]
+async fn missing_principal_never_falls_back_to_client_id_or_azp() {
+    let fixture = acceptance_runtime().await;
+    let now = Utc::now().timestamp();
+    let token = signed_access_token(json!({
+        "iss": TOKEN_ISSUER,
+        "aud": TOKEN_AUDIENCE,
+        "client_id": "fallback-client-canary",
+        "azp": "fallback-authorized-party-canary",
+        "iat": now - 1,
+        "exp": now + 3600,
+        "evidence_tags": ["fixture-agency"],
+        "evidence_audience": EVIDENCE_AUDIENCE
+    }));
+    let error = fixture
+        .runtime
+        .evaluate("operation-missing-principal", &token, &adult_request())
+        .await
+        .expect_err("a token without the configured principal claim is denied");
+    assert_eq!(error.problem(), ProblemCode::AuthenticationFailed);
+    assert!(
+        fixture
+            .server
+            .received_requests()
+            .await
+            .expect("request journal is available")
+            .is_empty(),
+        "authentication failure cannot acquire source credentials"
+    );
+    let audit = fs::read_to_string(&fixture.audit_path).expect("audit is readable");
+    assert!(!audit.contains("fallback-client-canary"));
+    assert!(!audit.contains("fallback-authorized-party-canary"));
+}
+
+/// A confirmation claim binds the token to a sender-provided proof this
+/// profile does not validate. Accepting it as an ordinary bearer would
+/// silently discard the constraint the authorization server issued it under,
+/// so the only safe outcome is denial.
+#[tokio::test]
+async fn sender_constrained_tokens_are_denied_rather_than_downgraded() {
+    for confirmation in [
+        json!({"jkt": "sender-constraint-canary"}),
+        json!({"x5t#S256": "sender-constraint-canary"}),
+        json!({"jwk": {"kty": "OKP", "crv": "Ed25519", "x": "sender-constraint-canary"}}),
+    ] {
+        let fixture = acceptance_runtime().await;
+        let token = access_token(Some(json!({"cnf": confirmation})));
+        let error = fixture
+            .runtime
+            .evaluate("operation-sender-constrained", &token, &adult_request())
+            .await
+            .expect_err("a confirmation-bound token is denied");
+        assert_eq!(error.problem(), ProblemCode::AuthenticationFailed);
+        assert!(
+            fixture
+                .server
+                .received_requests()
+                .await
+                .expect("request journal is available")
+                .is_empty(),
+            "a sender-constrained token cannot acquire source credentials"
+        );
+        let audit = fs::read_to_string(&fixture.audit_path).expect("audit is readable");
+        assert!(!audit.contains("sender-constraint-canary"));
+    }
+}
+
+#[tokio::test]
+async fn disclosure_audit_failure_prevents_signed_response_release() {
+    let fixture = acceptance_runtime().await;
+    mount_adult_source(&fixture.server, Some(Duration::from_millis(500))).await;
+    let runtime = Arc::clone(&fixture.runtime);
+    let token = access_token(None);
+    let request = adult_request();
+    let evaluation = tokio::spawn(async move {
+        runtime
+            .evaluate("operation-disclosure-audit-failure", &token, &request)
+            .await
+    });
+
+    wait_for_source_request_count(&fixture.server, 1).await;
+    fs::OpenOptions::new()
+        .append(true)
+        .open(&fixture.audit_path)
+        .and_then(|mut file| file.write_all(b"{}\n"))
+        .expect("audit tamper writes after access acceptance");
+    let error = evaluation
+        .await
+        .expect("evaluation task completes")
+        .expect_err("release audit failure cannot return a signed response");
+    assert_eq!(error.problem(), ProblemCode::ServiceUnavailable);
+
+    let audit = fs::read_to_string(&fixture.audit_path).expect("audit is readable");
+    assert_eq!(audit.matches("\"phase\":\"access-attempt\"").count(), 1);
+    assert_eq!(audit.matches("\"phase\":\"disclosure-release\"").count(), 0);
+    assert!(
+        !audit.contains("date_of_birth") && !audit.contains("2000-01-01"),
+        "audit failure diagnostics cannot retain source or disclosed values"
+    );
+}
+
+#[tokio::test]
+async fn signing_failure_is_transient_audited_and_never_releases_unsigned_evidence() {
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    let mut runtime =
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("runtime initializes");
+    let private = PrivateJwk::parse(EVIDENCE_PRIVATE_JWK).expect("test signing key parses");
+    let delegate = LocalJwkSigner::new(private).expect("local signer builds");
+    let provider: Arc<dyn SigningProvider> = Arc::new(FailAfterSelfTestSigner {
+        delegate,
+        calls: AtomicUsize::new(0),
+    });
+    let failing_signer = EvidenceSigner::initialize(provider, "acceptance-evidence-key")
+        .await
+        .expect("signer passes its startup self-test");
+    runtime.replace_signer_for_test(failing_signer);
+    mount_adult_source(&prepared.server, None).await;
+
+    let error = runtime
+        .evaluate(
+            "operation-signing-failure",
+            &access_token(None),
+            &adult_request(),
+        )
+        .await
+        .expect_err("signing failure cannot produce any success representation");
+    assert_eq!(error.problem(), ProblemCode::ServiceUnavailable);
+    let audit = fs::read_to_string(&prepared.audit_path).expect("audit is readable");
+    assert_eq!(audit.matches("\"phase\":\"access-attempt\"").count(), 1);
+    assert_eq!(audit.matches("\"decision\":\"signing-failure\"").count(), 1);
+    assert_eq!(audit.matches("\"phase\":\"disclosure-release\"").count(), 0);
+    for canary in privacy_canaries() {
+        assert!(!audit.contains(canary));
+    }
+}
+
+#[tokio::test]
+async fn configured_jwks_path_is_mechanically_the_served_route() {
+    let fixture = acceptance_runtime().await;
+    let configured_path = fixture.runtime.bundle().config.signing.jwks_path.clone();
+    let http = TestServer::new(build_app(Arc::clone(&fixture.runtime)));
+    let response = http.get(&configured_path).await;
+    response.assert_status_ok();
+    assert_eq!(response.header("content-type"), "application/jwk-set+json");
+    let keys = response.json::<crate::model::JwksDocument>();
+    assert_eq!(&keys, fixture.runtime.jwks());
+}
+
+/// The declared existence-disclosure mode is an enforced invariant, not an
+/// inert field: every enabled requirement declares the one closed collapse
+/// mode, and the runtime's unresolved outcomes for that mode share one public
+/// problem shape whether the record was absent, ambiguous, or uniquely found
+/// with inconsistent derivation inputs.
+#[tokio::test]
+async fn declared_existence_disclosure_mode_governs_the_public_collapse() {
+    let fixture = acceptance_runtime().await;
+    for requirement in &fixture.runtime.bundle().config.requirements {
+        assert_eq!(
+            requirement.existence_disclosure,
+            crate::config::ExistenceDisclosure::CollapseUnresolved,
+            "{}",
+            requirement.id
+        );
+    }
+
+    mount_parent_source(
+        &fixture.server,
+        json!({"total": 1, "records": [{
+            "returned_child_reference": "synthetic-other-child-record",
+            "parent_references": ["synthetic-parent-reference-001"],
+            "reference_namespace": "urn:example:fixture:person-reference",
+            "relationship_set_contract": "urn:example:fixture:legal-parent-set:v1",
+            "relationship_set_complete": true
+        }]}),
+    )
+    .await;
+    let mismatch = fixture
+        .runtime
+        .evaluate(
+            "operation-existence-derivation-mismatch",
+            &access_token(Some(parent_grant_claims())),
+            &parent_request(),
+        )
+        .await
+        .expect_err("a returned-child mismatch is not signed evidence");
+    assert_eq!(mismatch.problem(), ProblemCode::EvidenceNotAvailable);
+
+    fixture.server.reset().await;
+    mount_parent_source(&fixture.server, json!({"total": 0, "records": []})).await;
+    let unknown = fixture
+        .runtime
+        .evaluate(
+            "operation-existence-unknown-record",
+            &access_token(Some(parent_grant_claims())),
+            &parent_request(),
+        )
+        .await
+        .expect_err("an unknown record is not signed evidence");
+
+    // A uniquely found record with inconsistent derivation inputs is publicly
+    // indistinguishable from no record at all.
+    assert_eq!(mismatch.problem(), unknown.problem());
+    let operation = "operation-existence-problem-shape-check-000001";
+    assert_eq!(
+        serde_json::to_value(mismatch.problem().body(operation)).expect("problem serializes"),
+        serde_json::to_value(unknown.problem().body(operation)).expect("problem serializes"),
+    );
+}
+
+#[tokio::test]
+async fn request_nonce_is_strict_and_never_reaches_source_or_audit() {
+    let fixture = acceptance_runtime().await;
+    let http = TestServer::new(build_app(Arc::clone(&fixture.runtime)));
+    let token = access_token(None);
+
+    // Missing, empty, short, long, padded, wrong-alphabet, oversized, and
+    // noncanonical final-symbol nonces fail as malformed requests before
+    // authorization, credential acquisition, or source access.
+    let base = serde_json::to_value(adult_request()).expect("request serializes");
+    let mut variants = Vec::new();
+    let mut missing = base.clone();
+    missing
+        .as_object_mut()
+        .expect("request is an object")
+        .remove("requestNonce");
+    variants.push(missing);
+    for nonce in [
+        String::new(),
+        "A".repeat(42),
+        "A".repeat(44),
+        format!("{}=", "A".repeat(42)),
+        format!("{}+", "A".repeat(42)),
+        format!("{}B", "A".repeat(42)),
+        "A".repeat(4096),
+    ] {
+        let mut variant = base.clone();
+        variant["requestNonce"] = json!(nonce);
+        variants.push(variant);
+    }
+    for variant in variants {
+        let response = http
+            .post("/v1/evidence")
+            .add_header("authorization", format!("Bearer {token}"))
+            .json(&variant)
+            .await;
+        assert_eq!(response.status_code(), axum::http::StatusCode::BAD_REQUEST);
+        assert_eq!(response.json::<Value>()["code"], json!("malformed_request"));
+    }
+    // A duplicate requestNonce member fails strict JSON parsing.
+    let duplicate = build_app(Arc::clone(&fixture.runtime))
+        .oneshot(
+            HttpRequest::builder()
+                .method("POST")
+                .uri("/v1/evidence")
+                .header("authorization", format!("Bearer {token}"))
+                .header("content-type", "application/json")
+                .body(Body::from(format!(
+                    r#"{{"requestNonce":"{0}","requestNonce":"{0}","requirement":"urn:example:fixture:requirement:adult-status:v1","purpose":"fixture-eligibility","subjects":[{{"role":"subject","selector":{{"profile":"person-demographics-v1","values":{{"given_name":"Amina","family_name":"Diallo","birth_date":"2000-01-01"}}}}}}]}}"#,
+                    "A".repeat(43)
+                )))
+                .expect("duplicate-nonce request builds"),
+        )
+        .await
+        .expect("router responds");
+    assert_eq!(duplicate.status(), axum::http::StatusCode::BAD_REQUEST);
+    assert!(
+        fixture
+            .server
+            .received_requests()
+            .await
+            .expect("request journal is available")
+            .is_empty(),
+        "invalid nonces must fail before credential acquisition or source access"
+    );
+    assert!(
+        fs::read_to_string(&fixture.audit_path)
+            .expect("audit is readable")
+            .is_empty(),
+        "invalid nonces must not fabricate audit events"
+    );
+
+    // A unique canary nonce is echoed exactly into the signed payload and
+    // reaches nothing else: not the source request, not native audit.
+    mount_adult_source(&fixture.server, None).await;
+    let request = adult_request();
+    let nonce = request.request_nonce.clone();
+    let response = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {token}"))
+        .json(&request)
+        .await;
+    response.assert_status_ok();
+    let jws = response.json::<FlattenedJws>();
+    let payload = URL_SAFE_NO_PAD
+        .decode(&jws.payload)
+        .expect("payload decodes");
+    let evidence: Evidence = serde_json::from_slice(&payload).expect("payload parses");
+    assert_eq!(evidence.request_nonce, nonce, "exact nonce echo");
+
+    let audit = wait_for_audit_counts(&fixture.audit_path, 1, 1).await;
+    assert!(
+        !audit.contains(&nonce),
+        "the request nonce must never be recorded in native audit"
+    );
+    for received in fixture
+        .server
+        .received_requests()
+        .await
+        .expect("request journal is available")
+    {
+        assert!(!received.url.as_str().contains(&nonce));
+        assert!(!String::from_utf8_lossy(&received.body).contains(&nonce));
+        for header_name in received.headers.keys() {
+            let value = received.headers[header_name].to_str().unwrap_or_default();
+            assert!(!value.contains(&nonce));
+        }
+    }
+}
+
+#[tokio::test]
+async fn accept_negotiation_is_closed_and_fails_before_source_access() {
+    let fixture = acceptance_runtime().await;
+    let http = TestServer::new(build_app(Arc::clone(&fixture.runtime)));
+    let token = access_token(None);
+
+    for invalid in [
+        "application/json",
+        "application/jose+json, application/vnd.registrystack.evidence-unsigned+json",
+        "application/jose+json;q=0.9",
+        "application/vnd.registrystack.evidence-unsigned+json; charset=utf-8",
+        "application/*",
+        "text/html",
+    ] {
+        let response = http
+            .post("/v1/evidence")
+            .add_header("authorization", format!("Bearer {token}"))
+            .add_header("accept", invalid)
+            .json(&serde_json::to_value(adult_request()).expect("request serializes"))
+            .await;
+        assert_eq!(
+            response.status_code(),
+            axum::http::StatusCode::NOT_ACCEPTABLE,
+            "{invalid}"
+        );
+        assert_eq!(
+            response.json::<Value>()["code"],
+            json!("response_format_not_acceptable")
+        );
+        assert_eq!(response.header("vary"), "Accept");
+    }
+    assert!(
+        fixture
+            .server
+            .received_requests()
+            .await
+            .expect("request journal is available")
+            .is_empty(),
+        "unsupported negotiation must fail before source access"
+    );
+    assert!(fs::read_to_string(&fixture.audit_path)
+        .expect("audit is readable")
+        .is_empty());
+
+    // Missing Accept, */*, and the exact signed media type all select JWS.
+    mount_adult_source(&fixture.server, None).await;
+    let response = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {token}"))
+        .add_header("accept", "*/*")
+        .json(&serde_json::to_value(adult_request()).expect("request serializes"))
+        .await;
+    response.assert_status_ok();
+    assert_eq!(response.header("content-type"), "application/jose+json");
+    assert_eq!(response.header("vary"), "Accept");
+}
+
+#[tokio::test]
+async fn unsigned_output_requires_both_bundle_and_grant_permission() {
+    // Grant permits unsigned but the immutable bundle does not enable it.
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    make_writable(&prepared.bundle_root);
+    let configuration_path = prepared.bundle_root.join("evidence.yaml");
+    let mut configuration =
+        fs::read_to_string(&configuration_path).expect("acceptance configuration is readable");
+    replace_exact(
+        &mut configuration,
+        "\nresponseFormats: [signed-jws, unsigned-json]",
+        "\nresponseFormats: [signed-jws]",
+        1,
+    );
+    fs::write(&configuration_path, &configuration).expect("test configuration is rewritten");
+    make_read_only(&prepared.bundle_root);
+    let runtime = Arc::new(
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("bundle-restricted runtime initializes"),
+    );
+    let http = TestServer::new(build_app(Arc::clone(&runtime)));
+    let token = access_token(None);
+    let bundle_denied = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {token}"))
+        .add_header("accept", EVIDENCE_UNSIGNED_MEDIA_TYPE)
+        .json(&serde_json::to_value(adult_request()).expect("request serializes"))
+        .await;
+    assert_eq!(
+        bundle_denied.status_code(),
+        axum::http::StatusCode::FORBIDDEN
+    );
+    let bundle_denied_body = bundle_denied.json::<Value>();
+    assert_eq!(bundle_denied_body["code"], json!("not_authorized"));
+    assert!(prepared
+        .server
+        .received_requests()
+        .await
+        .expect("request journal is available")
+        .is_empty());
+
+    // The bundle enables unsigned but the matched grant withholds it. Another
+    // grant's permission cannot be unioned in, and the denial is identical.
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    make_writable(&prepared.bundle_root);
+    let configuration_path = prepared.bundle_root.join("evidence.yaml");
+    let mut configuration =
+        fs::read_to_string(&configuration_path).expect("acceptance configuration is readable");
+    replace_exact(
+        &mut configuration,
+        "purpose: fixture-eligibility\n        audienceFrom: authenticated-requester\n        responseFormats: [signed-jws, unsigned-json]",
+        "purpose: fixture-eligibility\n        audienceFrom: authenticated-requester\n        responseFormats: [signed-jws]",
+        1,
+    );
+    fs::write(&configuration_path, &configuration).expect("test configuration is rewritten");
+    make_read_only(&prepared.bundle_root);
+    let runtime = Arc::new(
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("grant-restricted runtime initializes"),
+    );
+    let http = TestServer::new(build_app(Arc::clone(&runtime)));
+    let grant_denied = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {token}"))
+        .add_header("accept", EVIDENCE_UNSIGNED_MEDIA_TYPE)
+        .json(&serde_json::to_value(adult_request()).expect("request serializes"))
+        .await;
+    assert_eq!(
+        grant_denied.status_code(),
+        axum::http::StatusCode::FORBIDDEN
+    );
+    let grant_denied_body = grant_denied.json::<Value>();
+    assert_eq!(grant_denied_body["code"], json!("not_authorized"));
+    // The two denials must not reveal which layer withheld permission.
+    assert_eq!(bundle_denied_body["code"], grant_denied_body["code"]);
+    assert_eq!(bundle_denied_body["title"], grant_denied_body["title"]);
+    assert_eq!(bundle_denied_body["status"], grant_denied_body["status"]);
+    // The signed default remains available under the restricted grant.
+    mount_adult_source(&prepared.server, None).await;
+    let signed = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {token}"))
+        .json(&serde_json::to_value(adult_request()).expect("request serializes"))
+        .await;
+    signed.assert_status_ok();
+    assert_eq!(signed.header("content-type"), "application/jose+json");
+
+    // Runtime configuration is closed and cannot enable a response format.
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    let mut runtime_document =
+        fs::read_to_string(&prepared.runtime_path).expect("runtime configuration is readable");
+    runtime_document.push_str("responseFormats: [signed-jws, unsigned-json]\n");
+    make_file_writable(&prepared.runtime_path);
+    fs::write(&prepared.runtime_path, runtime_document).expect("runtime override is written");
+    make_file_read_only(&prepared.runtime_path);
+    let error =
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect_err("a runtime response-format override must fail startup closed");
+    assert!(matches!(error, RuntimeInitializationError::Bundle));
+}
+
+#[tokio::test]
+async fn unsigned_envelope_is_exact_audited_and_never_a_signing_fallback() {
+    let fixture = acceptance_runtime().await;
+    mount_adult_source(&fixture.server, None).await;
+    let http = TestServer::new(build_app(Arc::clone(&fixture.runtime)));
+    let token = access_token(None);
+    let request = adult_request();
+    let nonce = request.request_nonce.clone();
+
+    let response = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {token}"))
+        .add_header("accept", EVIDENCE_UNSIGNED_MEDIA_TYPE)
+        .json(&serde_json::to_value(&request).expect("request serializes"))
+        .await;
+    response.assert_status_ok();
+    assert_eq!(
+        response.header("content-type"),
+        EVIDENCE_UNSIGNED_MEDIA_TYPE
+    );
+    assert_eq!(response.header("vary"), "Accept");
+    assert_eq!(response.header("cache-control"), "no-store");
+
+    let body = response.text();
+    let value: Value = serde_json::from_str(&body).expect("unsigned body is JSON");
+    let members = value
+        .as_object()
+        .expect("envelope is an object")
+        .keys()
+        .cloned()
+        .collect::<BTreeSet<_>>();
+    assert_eq!(
+        members,
+        BTreeSet::from([
+            "schema".to_owned(),
+            "type".to_owned(),
+            "integrityProtection".to_owned(),
+            "warning".to_owned(),
+            "evidence".to_owned(),
+        ]),
+        "the envelope has no JWS member and no signing-key claim"
+    );
+    assert_eq!(
+        value["schema"],
+        json!("registry.unsigned-evidence-envelope/v1")
+    );
+    assert_eq!(value["type"], json!("UnsignedEvidenceEnvelope"));
+    assert_eq!(value["integrityProtection"], json!("none"));
+    assert_eq!(value["warning"], json!("not-cryptographically-verifiable"));
+    let envelope: UnsignedEvidenceEnvelope =
+        serde_json::from_str(&body).expect("envelope parses strictly");
+    assert_eq!(envelope.evidence.request_nonce, nonce);
+    assert!(
+        evidence_contract_accepts(&value["evidence"]).expect("evidence contract is available"),
+        "the nested evidence is the same closed core object"
+    );
+
+    // The strict JWS verifier rejects the unsigned representation.
+    let mut policy = verification_policy_stub(&fixture.runtime, &request);
+    policy.request_nonce = nonce;
+    assert!(verify_flattened_jws(body.as_bytes(), fixture.runtime.jwks(), &policy).is_err());
+
+    // Audit records the closed protection mode; the release event carries no
+    // signing key identity for unsigned output.
+    let audit = wait_for_audit_counts(&fixture.audit_path, 1, 1).await;
+    let events = audit
+        .lines()
+        .map(|line| serde_json::from_str::<Value>(line).expect("audit line is JSON"))
+        .collect::<Vec<_>>();
+    let access = events
+        .iter()
+        .find(|event| event["record"]["phase"] == json!("access-attempt"))
+        .expect("access event exists");
+    let release = events
+        .iter()
+        .find(|event| event["record"]["phase"] == json!("disclosure-release"))
+        .expect("release event exists");
+    assert_eq!(access["record"]["responseProtection"], json!("unsigned"));
+    assert_eq!(release["record"]["responseProtection"], json!("unsigned"));
+    assert!(release["record"]["signingKeyId"].is_null());
+    assert!(release["record"]["evidenceId"].is_string());
+    assert!(release["record"]["disclosedConcepts"].is_array());
+    assert!(!audit.contains(&envelope.evidence.request_nonce));
+
+    // An unready ordinary signing dependency also denies unsigned output.
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    let mut runtime =
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("runtime initializes");
+    let private = PrivateJwk::parse(EVIDENCE_PRIVATE_JWK).expect("test signing key parses");
+    let delegate = LocalJwkSigner::new(private).expect("local signer builds");
+    let provider: Arc<dyn SigningProvider> = Arc::new(UnavailableReadinessSigner { delegate });
+    let unready_signer = EvidenceSigner::initialize(provider, "acceptance-evidence-key")
+        .await
+        .expect("signer passes its startup self-test");
+    runtime.replace_signer_for_test(unready_signer);
+    mount_adult_source(&prepared.server, None).await;
+    let error = runtime
+        .evaluate_with_format(
+            "operation-unsigned-unready-signing",
+            &access_token(None),
+            &adult_request(),
+            ResponseFormat::UnsignedJson,
+        )
+        .await
+        .expect_err("unsigned output still requires the signing dependency to be ready");
+    assert_eq!(error.problem(), ProblemCode::ServiceUnavailable);
+    let audit = fs::read_to_string(&prepared.audit_path).expect("audit is readable");
+    assert_eq!(audit.matches("\"phase\":\"disclosure-release\"").count(), 0);
+}
+
+#[tokio::test]
+async fn signing_failure_returns_a_problem_and_never_an_unsigned_body() {
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    let mut runtime =
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("runtime initializes");
+    let private = PrivateJwk::parse(EVIDENCE_PRIVATE_JWK).expect("test signing key parses");
+    let delegate = LocalJwkSigner::new(private).expect("local signer builds");
+    let provider: Arc<dyn SigningProvider> = Arc::new(FailAfterSelfTestSigner {
+        delegate,
+        calls: AtomicUsize::new(0),
+    });
+    let failing_signer = EvidenceSigner::initialize(provider, "acceptance-evidence-key")
+        .await
+        .expect("signer passes its startup self-test");
+    runtime.replace_signer_for_test(failing_signer);
+    mount_adult_source(&prepared.server, None).await;
+
+    let http = TestServer::new(build_app(Arc::new(runtime)));
+    let response = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {}", access_token(None)))
+        .json(&serde_json::to_value(adult_request()).expect("request serializes"))
+        .await;
+    assert_eq!(
+        response.status_code(),
+        axum::http::StatusCode::SERVICE_UNAVAILABLE
+    );
+    assert_eq!(response.header("content-type"), "application/problem+json");
+    let text = response.text();
+    assert!(
+        !text.contains("integrityProtection") && !text.contains("UnsignedEvidenceEnvelope"),
+        "a signed-path failure must never downgrade to unsigned output"
+    );
+}
+
+#[tokio::test]
+async fn disclosure_audit_failure_prevents_unsigned_response_release() {
+    let fixture = acceptance_runtime().await;
+    mount_adult_source(&fixture.server, Some(Duration::from_millis(500))).await;
+    let runtime = Arc::clone(&fixture.runtime);
+    let token = access_token(None);
+    let request = adult_request();
+    let evaluation = tokio::spawn(async move {
+        runtime
+            .evaluate_with_format(
+                "operation-unsigned-audit-failure",
+                &token,
+                &request,
+                ResponseFormat::UnsignedJson,
+            )
+            .await
+    });
+
+    wait_for_source_request_count(&fixture.server, 1).await;
+    fs::OpenOptions::new()
+        .append(true)
+        .open(&fixture.audit_path)
+        .and_then(|mut file| file.write_all(b"{}\n"))
+        .expect("audit tamper writes after access acceptance");
+    let error = evaluation
+        .await
+        .expect("evaluation task completes")
+        .expect_err("release audit failure cannot return an unsigned response");
+    assert_eq!(error.problem(), ProblemCode::ServiceUnavailable);
+    let audit = fs::read_to_string(&fixture.audit_path).expect("audit is readable");
+    assert_eq!(audit.matches("\"phase\":\"disclosure-release\"").count(), 0);
+}
+
+#[tokio::test]
+async fn all_four_definitions_pass_the_explicitly_authorized_unsigned_path() {
+    let fixture = acceptance_runtime().await;
+    mount_success_sources(&fixture.server, true).await;
+    let http = TestServer::new(build_app(Arc::clone(&fixture.runtime)));
+
+    let cases = [
+        (access_token(None), adult_request()),
+        (access_token(None), residence_request()),
+        (access_token(None), licence_request()),
+        (access_token(Some(parent_grant_claims())), parent_request()),
+    ];
+    for (token, request) in cases {
+        let response = http
+            .post("/v1/evidence")
+            .add_header("authorization", format!("Bearer {token}"))
+            .add_header("accept", EVIDENCE_UNSIGNED_MEDIA_TYPE)
+            .json(&serde_json::to_value(&request).expect("request serializes"))
+            .await;
+        response.assert_status_ok();
+        assert_eq!(
+            response.header("content-type"),
+            EVIDENCE_UNSIGNED_MEDIA_TYPE
+        );
+        let envelope: UnsignedEvidenceEnvelope =
+            serde_json::from_str(&response.text()).expect("envelope parses strictly");
+        assert_eq!(envelope.evidence.request_nonce, request.request_nonce);
+        assert!(!envelope.evidence.supported_values.is_empty());
+        assert_eq!(
+            envelope.evidence.subjects.len(),
+            request.subjects.len(),
+            "unsigned output binds the same declaration-ordered roles"
+        );
+    }
+    let audit = wait_for_audit_counts(&fixture.audit_path, 4, 4).await;
+    assert_eq!(
+        audit.matches("\"responseProtection\":\"unsigned\"").count(),
+        8,
+        "every unsigned access and release event records the closed mode"
+    );
+    for canary in privacy_canaries() {
+        assert!(!audit.contains(canary));
+    }
+}
+
+/// Rewrite the acceptance bundle so the immutable bundle, and optionally the
+/// matched grant, enable the SD-JWT VC response format.
+async fn sd_jwt_vc_acceptance(grant_permits: bool) -> PreparedAcceptance {
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    make_writable(&prepared.bundle_root);
+    let configuration_path = prepared.bundle_root.join("evidence.yaml");
+    let mut configuration =
+        fs::read_to_string(&configuration_path).expect("acceptance configuration is readable");
+    replace_exact(
+        &mut configuration,
+        "\nresponseFormats: [signed-jws, unsigned-json]",
+        "\nresponseFormats: [signed-jws, unsigned-json, sd-jwt-vc]",
+        1,
+    );
+    if grant_permits {
+        replace_exact(
+            &mut configuration,
+            "purpose: fixture-eligibility\n        audienceFrom: authenticated-requester\n        responseFormats: [signed-jws, unsigned-json]",
+            "purpose: fixture-eligibility\n        audienceFrom: authenticated-requester\n        responseFormats: [signed-jws, unsigned-json, sd-jwt-vc]",
+            1,
+        );
+    }
+    fs::write(&configuration_path, &configuration).expect("test configuration is rewritten");
+    make_read_only(&prepared.bundle_root);
+    prepared
+}
+
+async fn runtime_for(prepared: &PreparedAcceptance) -> Arc<EvidenceRuntime> {
+    Arc::new(
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("runtime initializes"),
+    )
+}
+
+#[tokio::test]
+async fn sd_jwt_format_not_permitted_by_bundle() {
+    // The stock acceptance bundle enables signed and unsigned output only.
+    let fixture = acceptance_runtime().await;
+    let http = TestServer::new(build_app(Arc::clone(&fixture.runtime)));
+    let response = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {}", access_token(None)))
+        .add_header("accept", EVIDENCE_SD_JWT_VC_MEDIA_TYPE)
+        .json(&serde_json::to_value(adult_request()).expect("request serializes"))
+        .await;
+
+    assert_eq!(response.status_code(), axum::http::StatusCode::FORBIDDEN);
+    assert_eq!(response.json::<Value>()["code"], json!("not_authorized"));
+    assert!(
+        fixture
+            .server
+            .received_requests()
+            .await
+            .expect("request journal is available")
+            .is_empty(),
+        "an unenabled response format is denied before source access"
+    );
+    assert!(fs::read_to_string(&fixture.audit_path)
+        .expect("audit is readable")
+        .is_empty());
+}
+
+#[tokio::test]
+async fn sd_jwt_format_not_permitted_by_grant() {
+    // The bundle enables the format but the one matched grant withholds it.
+    let prepared = sd_jwt_vc_acceptance(false).await;
+    let runtime = runtime_for(&prepared).await;
+    let http = TestServer::new(build_app(Arc::clone(&runtime)));
+    let denied = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {}", access_token(None)))
+        .add_header("accept", EVIDENCE_SD_JWT_VC_MEDIA_TYPE)
+        .json(&serde_json::to_value(adult_request()).expect("request serializes"))
+        .await;
+    assert_eq!(denied.status_code(), axum::http::StatusCode::FORBIDDEN);
+    assert_eq!(denied.json::<Value>()["code"], json!("not_authorized"));
+    assert!(prepared
+        .server
+        .received_requests()
+        .await
+        .expect("request journal is available")
+        .is_empty());
+
+    // With both gates open the same assertion is released as an SD-JWT VC.
+    let prepared = sd_jwt_vc_acceptance(true).await;
+    let runtime = runtime_for(&prepared).await;
+    // One evaluation per response format; both must reach the same source.
+    mount_adult_source_expecting(&prepared.server, None, 2).await;
+    let http = TestServer::new(build_app(Arc::clone(&runtime)));
+    let token = access_token(None);
+    let request = adult_request();
+
+    // The signed default establishes the independent expectations a relying
+    // party retains, so the credential is verified against the other format's
+    // payload rather than against itself.
+    let signed = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {token}"))
+        .json(&serde_json::to_value(&request).expect("request serializes"))
+        .await;
+    signed.assert_status_ok();
+    let jws = signed.json::<FlattenedJws>();
+    let payload = URL_SAFE_NO_PAD
+        .decode(&jws.payload)
+        .expect("payload decodes");
+    let expected: Evidence = serde_json::from_slice(&payload).expect("payload parses");
+    let policy = EvidenceVerificationPolicy::from_accepted_transaction(
+        &expected,
+        &request.request_nonce,
+        Duration::from_secs(48 * 60 * 60),
+        Utc::now(),
+        Duration::from_secs(30),
+    );
+
+    let credential = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {token}"))
+        .add_header("accept", EVIDENCE_SD_JWT_VC_MEDIA_TYPE)
+        .json(&serde_json::to_value(&request).expect("request serializes"))
+        .await;
+    credential.assert_status_ok();
+    assert_eq!(
+        credential.header("content-type"),
+        EVIDENCE_SD_JWT_VC_MEDIA_TYPE
+    );
+    assert_eq!(credential.header("vary"), "Accept");
+    assert_eq!(credential.header("cache-control"), "no-store");
+
+    let serialized = credential.text();
+    assert!(serialized.ends_with('~'), "no key-binding JWT is issued");
+    let verified = verify_sd_jwt_vc(serialized.as_bytes(), runtime.jwks(), &policy)
+        .expect("the credential verifies against the signed transaction's expectations");
+    assert_eq!(verified.supported_values, expected.supported_values);
+    assert_eq!(verified.subjects, expected.subjects);
+    assert_eq!(verified.request_nonce, request.request_nonce);
+
+    // Audit records the closed protection mode and the signing key identity.
+    let audit = wait_for_audit_counts(&prepared.audit_path, 2, 2).await;
+    let events = audit
+        .lines()
+        .map(|line| serde_json::from_str::<Value>(line).expect("audit line is JSON"))
+        .collect::<Vec<_>>();
+    let releases = events
+        .iter()
+        .filter(|event| event["record"]["phase"] == json!("disclosure-release"))
+        .collect::<Vec<_>>();
+    let credential_release = releases
+        .iter()
+        .find(|event| event["record"]["responseProtection"] == json!("sd-jwt-vc"))
+        .expect("the credential release records the SD-JWT VC mode");
+    assert_eq!(
+        credential_release["record"]["signingKeyId"],
+        json!("acceptance-evidence-key")
+    );
+    assert!(!audit.contains(&request.request_nonce));
+    for canary in privacy_canaries() {
+        assert!(!audit.contains(canary));
+    }
+}
+
+#[tokio::test]
+async fn sd_jwt_holder_key_with_private_member_rejected() {
+    let prepared = sd_jwt_vc_acceptance(true).await;
+    let runtime = runtime_for(&prepared).await;
+    // No source is mounted: no request may reach acquisition.
+    let http = TestServer::new(build_app(Arc::clone(&runtime)));
+    let mut body = serde_json::to_value(adult_request()).expect("request serializes");
+
+    for holder_key in [
+        json!({
+            "kty": "OKP",
+            "crv": "Ed25519",
+            "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo",
+            "d": "nWGxne_9WmC6hEr0kuwsxERJxWl7MmkZcDusAxyuf2A"
+        }),
+        json!({
+            "kty": "oct",
+            "crv": "Ed25519",
+            "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo",
+            "k": "c2VjcmV0LWtleS1jYW5hcnk"
+        }),
+    ] {
+        body["holderKey"] = holder_key;
+        let response = http
+            .post("/v1/evidence")
+            .add_header("authorization", format!("Bearer {}", access_token(None)))
+            .add_header("accept", EVIDENCE_SD_JWT_VC_MEDIA_TYPE)
+            .json(&body)
+            .await;
+        assert_eq!(
+            response.status_code(),
+            axum::http::StatusCode::BAD_REQUEST,
+            "a holder key carrying private material is not a request"
+        );
+        let problem = response.json::<Value>();
+        assert_eq!(problem["code"], json!("malformed_request"));
+        let text = response.text();
+        assert!(
+            !text.contains("nWGxne") && !text.contains("c2VjcmV0"),
+            "rejected key material is never echoed"
+        );
+    }
+
+    assert!(
+        prepared
+            .server
+            .received_requests()
+            .await
+            .expect("request journal is available")
+            .is_empty(),
+        "an unacceptable holder key fails before credential acquisition"
+    );
+    assert!(fs::read_to_string(&prepared.audit_path)
+        .expect("audit is readable")
+        .is_empty());
+}
+
+#[tokio::test]
+async fn sd_jwt_holder_key_wrong_algorithm_rejected() {
+    let prepared = sd_jwt_vc_acceptance(true).await;
+    let runtime = runtime_for(&prepared).await;
+    mount_adult_source(&prepared.server, None).await;
+    let http = TestServer::new(build_app(Arc::clone(&runtime)));
+    let mut body = serde_json::to_value(adult_request()).expect("request serializes");
+
+    for holder_key in [
+        json!({"kty": "OKP", "crv": "Ed25519", "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo", "alg": "ES256"}),
+        json!({"kty": "EC", "crv": "P-256", "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo", "alg": "EdDSA"}),
+        json!({"kty": "OKP", "crv": "X25519", "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo"}),
+        json!({"kty": "OKP", "crv": "Ed25519", "x": "11qYAYKxCrfVS_7TyWQHOg"}),
+        json!({"kty": "OKP", "crv": "Ed25519", "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo="}),
+    ] {
+        body["holderKey"] = holder_key.clone();
+        let response = http
+            .post("/v1/evidence")
+            .add_header("authorization", format!("Bearer {}", access_token(None)))
+            .add_header("accept", EVIDENCE_SD_JWT_VC_MEDIA_TYPE)
+            .json(&body)
+            .await;
+        assert_eq!(
+            response.status_code(),
+            axum::http::StatusCode::BAD_REQUEST,
+            "{holder_key} is outside the closed holder-key profile"
+        );
+        assert_eq!(response.json::<Value>()["code"], json!("malformed_request"));
+    }
+
+    // The same request without a holder key still succeeds, so the rejection
+    // is the key's and not the format's.
+    body.as_object_mut()
+        .expect("request is an object")
+        .remove("holderKey");
+    let accepted = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {}", access_token(None)))
+        .add_header("accept", EVIDENCE_SD_JWT_VC_MEDIA_TYPE)
+        .json(&body)
+        .await;
+    accepted.assert_status_ok();
+    assert!(!accepted.text().contains("cnf"));
+}
+
+#[tokio::test]
+async fn sd_jwt_signing_failure_no_fallback_format() {
+    let prepared = sd_jwt_vc_acceptance(true).await;
+    let mut runtime =
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("runtime initializes");
+    let private = PrivateJwk::parse(EVIDENCE_PRIVATE_JWK).expect("test signing key parses");
+    let delegate = LocalJwkSigner::new(private).expect("local signer builds");
+    let provider: Arc<dyn SigningProvider> = Arc::new(FailAfterSelfTestSigner {
+        delegate,
+        calls: AtomicUsize::new(0),
+    });
+    let failing_signer = EvidenceSigner::initialize(provider, "acceptance-evidence-key")
+        .await
+        .expect("signer passes its startup self-test");
+    runtime.replace_signer_for_test(failing_signer);
+    mount_adult_source(&prepared.server, None).await;
+
+    let http = TestServer::new(build_app(Arc::new(runtime)));
+    let response = http
+        .post("/v1/evidence")
+        .add_header("authorization", format!("Bearer {}", access_token(None)))
+        .add_header("accept", EVIDENCE_SD_JWT_VC_MEDIA_TYPE)
+        .json(&serde_json::to_value(adult_request()).expect("request serializes"))
+        .await;
+
+    assert_eq!(
+        response.status_code(),
+        axum::http::StatusCode::SERVICE_UNAVAILABLE
+    );
+    assert_eq!(response.header("content-type"), "application/problem+json");
+    let text = response.text();
+    assert!(
+        !text.contains('~') && !text.contains("integrityProtection"),
+        "a failed credential signature never falls back to another format"
+    );
+    let audit = fs::read_to_string(&prepared.audit_path).expect("audit is readable");
+    assert_eq!(audit.matches("\"phase\":\"disclosure-release\"").count(), 0);
+}
+
+/// Serve the operator-driven SD-JWT VC demo documented in `SD-JWT-VC-DEMO.md`.
+///
+/// The immutable bundle and the one complete matched grant both enable the
+/// credential format, so one deterministic request is released twice: once as
+/// the signed default and once as an SD-JWT VC. The harness verifies the
+/// credential against expectations taken from the signed transaction rather
+/// than from the credential's own bytes, then leaves the pinned key set and a
+/// policy document so the operator can re-verify the stored credential offline
+/// with `evidence verify --sd-jwt-vc`.
+#[tokio::test]
+#[ignore = "operator-driven local curl demo"]
+async fn sd_jwt_vc_demo_serves_a_credential_for_curl() {
+    let prepared = sd_jwt_vc_acceptance(true).await;
+    // One source call per response format. Both formats answer the same
+    // request, so neither may reach the source more than once.
+    mount_adult_source_expecting(&prepared.server, None, 2).await;
+    let runtime = runtime_for(&prepared).await;
+
+    let state_root =
+        Path::new(env!("CARGO_MANIFEST_DIR")).join("../../products/evidence/.sd-jwt-vc-demo");
+    fs::create_dir_all(&state_root).expect("demo state directory is created");
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt as _;
+        fs::set_permissions(&state_root, fs::Permissions::from_mode(0o700))
+            .expect("demo state directory is owner-only");
+    }
+    let signed_path = state_root.join("response.jws.json");
+    let credential_path = state_root.join("credential.txt");
+    let metadata_path = state_root.join("issuer-metadata.json");
+    let jwks_path = state_root.join("trusted.jwks.json");
+    let policy_path = state_root.join("verification-policy.yaml");
+    for stale in [
+        &signed_path,
+        &credential_path,
+        &metadata_path,
+        &jwks_path,
+        &policy_path,
+    ] {
+        match fs::remove_file(stale) {
+            Ok(()) => {}
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+            Err(error) => panic!("stale demo output could not be removed: {error}"),
+        }
+    }
+
+    let request = adult_request();
+    write_secret(
+        &state_root,
+        "request.json",
+        &serde_json::to_string_pretty(&request).expect("request serializes"),
+    );
+    write_secret(
+        &state_root,
+        "session.env",
+        &format!("EVIDENCE_ACCESS_TOKEN={}\n", access_token(None)),
+    );
+
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:18081")
+        .await
+        .expect("demo listener binds on 127.0.0.1:18081");
+    let address = listener
+        .local_addr()
+        .expect("listener address is available");
+    println!(
+        "Evidence SD-JWT VC demo server is ready at http://{address}. The ignored session.env contains only the short-lived synthetic bearer token. Use the curl commands in products/evidence/SD-JWT-VC-DEMO.md."
+    );
+
+    let (shutdown_tx, shutdown_rx) = tokio::sync::oneshot::channel();
+    let served = Arc::clone(&runtime);
+    let server = tokio::spawn(async move {
+        serve_listener_for_test(served, listener, async move {
+            let _ = shutdown_rx.await;
+        })
+        .await
+    });
+
+    // The signed default is fetched first, because a relying party's
+    // expectations come from the transaction it accepted, never from the
+    // credential it is about to check.
+    let signed = tokio::time::timeout(Duration::from_secs(180), async {
+        loop {
+            if let Ok(bytes) = fs::read(&signed_path) {
+                if serde_json::from_slice::<FlattenedJws>(&bytes).is_ok() {
+                    break bytes;
+                }
+                if let Ok(problem) = serde_json::from_slice::<Value>(&bytes) {
+                    if let Some(code) = problem.get("code").and_then(Value::as_str) {
+                        panic!("Evidence returned the safe problem code {code}");
+                    }
+                }
+            }
+            tokio::time::sleep(Duration::from_millis(50)).await;
+        }
+    })
+    .await
+    .expect("the signed curl response arrives within three minutes");
+    let policy = verification_policy(&runtime, &request, &signed);
+    let accepted = verify_flattened_jws(&signed, runtime.jwks(), &policy)
+        .expect("the signed response verifies against the running Evidence JWKS");
+
+    // A partial write looks like a malformed credential, so the last
+    // verification failure is retained outside the polling future and reported
+    // on timeout rather than swallowed.
+    let last_failure = RefCell::new(None);
+    let credential_wait = tokio::time::timeout(Duration::from_secs(180), async {
+        loop {
+            if let Ok(bytes) = fs::read(&credential_path) {
+                if bytes.ends_with(b"~") {
+                    match verify_sd_jwt_vc(&bytes, runtime.jwks(), &policy) {
+                        Ok(verified) => {
+                            break (
+                                String::from_utf8(bytes).expect("credential is ASCII"),
+                                verified,
+                            )
+                        }
+                        Err(error) => *last_failure.borrow_mut() = Some(format!("{error:?}")),
+                    }
+                }
+                if let Ok(problem) = serde_json::from_slice::<Value>(&bytes) {
+                    if let Some(code) = problem.get("code").and_then(Value::as_str) {
+                        panic!("Evidence returned the safe problem code {code}");
+                    }
+                }
+            }
+            tokio::time::sleep(Duration::from_millis(50)).await;
+        }
+    })
+    .await;
+    let (credential, verified) = match credential_wait {
+        Ok(pair) => pair,
+        Err(_) => panic!(
+            "the credential curl response arrives and verifies within three minutes; \
+             last verification failure: {:?}",
+            last_failure.borrow()
+        ),
+    };
+
+    assert!(
+        credential.ends_with('~'),
+        "no key-binding JWT is issued or expected"
+    );
+    assert_eq!(
+        credential
+            .split('~')
+            .filter(|part| !part.is_empty())
+            .count(),
+        1 + accepted.supported_values.len(),
+        "the unprojected demo credential carries one root disclosure per supported value"
+    );
+    assert_eq!(verified.supported_values, accepted.supported_values);
+    assert_eq!(verified.subjects, accepted.subjects);
+    assert_eq!(verified.request_nonce, request.request_nonce);
+
+    shutdown_tx.send(()).expect("demo server is still running");
+    server
+        .await
+        .expect("demo server task joins")
+        .expect("demo server stops cleanly");
+
+    // What an offline relying party keeps besides the credential: the closed
+    // policy document, written from the accepted transaction. The pinned key
+    // set is not written here, because the demo fetches it the way a relying
+    // party does, from the issuer metadata route.
+    fs::write(&policy_path, demo_verification_policy_document(&policy))
+        .expect("the verification policy is written");
+
+    let audit = wait_for_audit_counts(&prepared.audit_path, 2, 2).await;
+    let releases = audit
+        .lines()
+        .map(|line| serde_json::from_str::<Value>(line).expect("audit line is JSON"))
+        .filter(|event| event["record"]["phase"] == json!("disclosure-release"))
+        .map(|event| {
+            event["record"]["responseProtection"]
+                .as_str()
+                .expect("every release records a protection mode")
+                .to_owned()
+        })
+        .collect::<BTreeSet<_>>();
+    assert_eq!(
+        releases,
+        BTreeSet::from(["sd-jwt-vc".to_owned(), "signed".to_owned()]),
+        "each release records its own closed protection mode"
+    );
+    assert!(!audit.contains(&request.request_nonce));
+    for canary in privacy_canaries() {
+        assert!(!audit.contains(canary));
+    }
+
+    println!(
+        "PASS: the same assertion was released as a signed JWS and as an SD-JWT VC, the credential verified against the signed transaction's expectations, minimization held, and both releases recorded their protection mode."
+    );
+}
+
+/// Render the accepted transaction's expectations as the closed policy document
+/// the `evidence verify` command parses.
+fn demo_verification_policy_document(policy: &EvidenceVerificationPolicy) -> String {
+    let document = json!({
+        "issuedBy": policy.issued_by,
+        "providedBy": policy.provided_by,
+        "requirement": policy.requirement,
+        "evidenceType": policy.evidence_type,
+        "purpose": policy.purpose,
+        "audience": policy.audience,
+        "configurationRevision": policy.configuration_revision,
+        "requestNonce": policy.request_nonce,
+        "expectedSubjects": policy
+            .expected_subjects
+            .iter()
+            .map(|subject| json!({"role": subject.role, "binding": subject.binding}))
+            .collect::<Vec<_>>(),
+        "expectedOutputs": policy
+            .expected_outputs
+            .iter()
+            .map(|output| json!({"concept": output.concept, "form": expected_form_document(&output.form)}))
+            .collect::<Vec<_>>(),
+        "maximumAssertionLifetimeSeconds": policy.maximum_assertion_lifetime.as_secs(),
+        "clockSkewSeconds": policy.clock_skew.as_secs(),
+    });
+    serde_norway::to_string(&document).expect("the policy document serializes as YAML")
+}
+
+/// The closed expected value-form vocabulary as a policy document writes it.
+fn expected_form_document(form: &ExpectedValueForm) -> Value {
+    match form {
+        ExpectedValueForm::Boolean => json!("boolean"),
+        ExpectedValueForm::Integer => json!("integer"),
+        ExpectedValueForm::String => json!("string"),
+        ExpectedValueForm::DateBucket => json!("date-bucket"),
+        ExpectedValueForm::TimeBucket => json!("time-bucket"),
+        ExpectedValueForm::EntityReference => json!("entity-reference"),
+        ExpectedValueForm::Structured => json!("structured"),
+        ExpectedValueForm::List {
+            minimum_items,
+            maximum_items,
+        } => json!({"list": {"minimumItems": minimum_items, "maximumItems": maximum_items}}),
+    }
+}
+
+#[tokio::test]
+async fn reordered_grant_subjects_resolve_by_role_and_emit_declaration_order() {
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    make_writable(&prepared.bundle_root);
+    let configuration_path = prepared.bundle_root.join("evidence.yaml");
+    let mut configuration =
+        fs::read_to_string(&configuration_path).expect("acceptance configuration is readable");
+    replace_exact(
+        &mut configuration,
+        r#"        subjects:
+          - {role: child, selectorProfile: civil-record-reference-v1, valueOrigin: request}
+          - role: candidate-parent
+            selectorProfile: person-reference-v1
+            valueOrigin: authenticated-grant
+            valueClaims:
+              person_reference: grant.candidate_parent.person_reference"#,
+        r#"        subjects:
+          - role: candidate-parent
+            selectorProfile: person-reference-v1
+            valueOrigin: authenticated-grant
+            valueClaims:
+              person_reference: grant.candidate_parent.person_reference
+          - {role: child, selectorProfile: civil-record-reference-v1, valueOrigin: request}"#,
+        1,
+    );
+    fs::write(&configuration_path, configuration).expect("test configuration is rewritten");
+    make_read_only(&prepared.bundle_root);
+    let runtime = Arc::new(
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("a valid bundle with reordered grant subjects initializes"),
+    );
+    mount_parent_source(
+        &prepared.server,
+        parent_source_response(vec![PARENT_REFERENCE]),
+    )
+    .await;
+
+    // The request array order is also reversed independently of grant order.
+    let mut request = parent_request();
+    request.subjects.reverse();
+    let jws = runtime
+        .evaluate(
+            "operation-reordered-grant-subjects",
+            &access_token(Some(parent_grant_claims())),
+            &request,
+        )
+        .await
+        .expect("reordered grant subjects resolve by unique role");
+    let payload = URL_SAFE_NO_PAD
+        .decode(&jws.payload)
+        .expect("Evidence payload is base64url");
+    let evidence: Evidence = serde_json::from_slice(&payload).expect("Evidence payload is JSON");
+    assert_eq!(evidence.subjects[0].role, "child");
+    assert_eq!(evidence.subjects[1].role, "candidate-parent");
+
+    // Audit subjects also use requirement declaration order.
+    let audit = wait_for_audit_counts(&prepared.audit_path, 1, 1).await;
+    let first_event =
+        serde_json::from_str::<Value>(audit.lines().next().expect("audit has events"))
+            .expect("audit line is JSON");
+    let roles = first_event["record"]["subjects"]
+        .as_array()
+        .expect("audit subjects are an array")
+        .iter()
+        .map(|subject| subject["role"].as_str().expect("role is text").to_owned())
+        .collect::<Vec<_>>();
+    assert_eq!(roles, ["child", "candidate-parent"]);
+
+    // The verifier accepts the expected subject set in any expectation order.
+    let serialized = serde_json::to_vec(&jws).expect("JWS serializes");
+    let mut policy = verification_policy_stub(&runtime, &request);
+    policy.request_nonce = request.request_nonce.clone();
+    policy.expected_subjects = evidence
+        .subjects
+        .iter()
+        .rev()
+        .map(|subject| crate::verifier::ExpectedSubject {
+            role: subject.role.clone(),
+            binding: subject.binding.clone(),
+        })
+        .collect();
+    policy.expected_outputs = evidence
+        .supported_values
+        .iter()
+        .map(|value| crate::verifier::ExpectedOutput {
+            concept: value.provides_value_for.clone(),
+            form: crate::verifier::ExpectedValueForm::Boolean,
+        })
+        .collect();
+    verify_flattened_jws(&serialized, runtime.jwks(), &policy)
+        .expect("declaration-ordered subjects verify against unordered expectations");
+}
+
+/// Policy scaffold with the independent bundle-derived fields filled in and
+/// empty subject and output expectations for the caller to complete.
+fn verification_policy_stub(
+    runtime: &EvidenceRuntime,
+    request: &EvidenceRequest,
+) -> EvidenceVerificationPolicy {
+    let requirement = runtime
+        .bundle()
+        .config
+        .requirements
+        .iter()
+        .find(|candidate| candidate.id == request.requirement)
+        .expect("requirement is loaded");
+    EvidenceVerificationPolicy {
+        assurance_profile: runtime.bundle().config.assurance_profile,
+        issued_by: runtime.bundle().config.issuer.id.clone(),
+        provided_by: runtime.bundle().config.service.provider_id.clone(),
+        requirement: request.requirement.clone(),
+        evidence_type: requirement.evidence_type.clone(),
+        purpose: request.purpose.clone(),
+        audience: EVIDENCE_AUDIENCE.to_owned(),
+        configuration_revision: runtime.bundle().revision().to_owned(),
+        request_nonce: request.request_nonce.clone(),
+        expected_subjects: Vec::new(),
+        expected_outputs: Vec::new(),
+        maximum_assertion_lifetime: Duration::from_secs(48 * 60 * 60),
+        now: Utc::now(),
+        clock_skew: Duration::from_secs(30),
+    }
+}
+
+#[tokio::test]
+async fn multi_role_request_order_is_not_semantic_and_output_uses_declaration_order() {
+    let fixture = acceptance_runtime().await;
+    mount_parent_source(
+        &fixture.server,
+        parent_source_response(vec![PARENT_REFERENCE]),
+    )
+    .await;
+    let mut request = parent_request();
+    request.subjects.reverse();
+
+    let response = fixture
+        .runtime
+        .evaluate(
+            "operation-reversed-subject-order",
+            &access_token(Some(parent_grant_claims())),
+            &request,
+        )
+        .await
+        .expect("roles resolve independently of request array order");
+    let payload = URL_SAFE_NO_PAD
+        .decode(response.payload)
+        .expect("Evidence payload is base64url");
+    let evidence: Evidence = serde_json::from_slice(&payload).expect("Evidence payload is JSON");
+    assert_eq!(evidence.subjects[0].role, "child");
+    assert_eq!(evidence.subjects[1].role, "candidate-parent");
+    assert_eq!(
+        fixture
+            .server
+            .received_requests()
+            .await
+            .expect("request journal is available")
+            .len(),
+        1
+    );
+    let audit = fs::read_to_string(&fixture.audit_path).expect("audit is readable");
+    assert_eq!(audit.matches("\"phase\":\"access-attempt\"").count(), 1);
+    assert_eq!(audit.matches("\"phase\":\"disclosure-release\"").count(), 1);
+}
+
+#[tokio::test]
+async fn security_contract_rejects_unknown_and_unauthorized_requests_before_source_access() {
+    let fixture = acceptance_runtime().await;
+    let now = Utc::now().timestamp();
+    let unentitled_token = signed_access_token(json!({
+        "iss": TOKEN_ISSUER,
+        "aud": TOKEN_AUDIENCE,
+        "sub": "unentitled-principal",
+        "iat": now - 1,
+        "exp": now + 3600,
+        "evidence_tags": ["unentitled-tag"],
+        "evidence_audience": EVIDENCE_AUDIENCE
+    }));
+
+    let mut unknown_requirement = adult_request();
+    unknown_requirement.requirement = "urn:example:fixture:requirement:unknown:v1".to_owned();
+    let mut unauthorized_purpose = adult_request();
+    unauthorized_purpose.purpose = "caller-selected-purpose".to_owned();
+    let mut unauthorized_profile = adult_request();
+    unauthorized_profile.subjects[0].selector.profile = "caller-selected-profile-v1".to_owned();
+
+    for (operation, token, request) in [
+        (
+            "operation-unknown-requirement",
+            access_token(None),
+            unknown_requirement,
+        ),
+        (
+            "operation-unauthorized-purpose",
+            access_token(None),
+            unauthorized_purpose,
+        ),
+        (
+            "operation-unauthorized-profile",
+            access_token(None),
+            unauthorized_profile,
+        ),
+        (
+            "operation-selector-possession-without-authority",
+            unentitled_token,
+            adult_request(),
+        ),
+    ] {
+        let error = fixture
+            .runtime
+            .evaluate(operation, &token, &request)
+            .await
+            .expect_err("caller material cannot create authority");
+        assert_eq!(error.problem(), ProblemCode::NotAuthorized);
+    }
+
+    assert!(fixture
+        .server
+        .received_requests()
+        .await
+        .expect("request journal is available")
+        .is_empty());
+    let audit = fs::read_to_string(&fixture.audit_path).expect("audit is readable");
+    assert!(!audit.contains("\"phase\":\"access-attempt\""));
+    for protected in [
+        "unentitled-principal",
+        "caller-selected-purpose",
+        "caller-selected-profile-v1",
+    ] {
+        assert!(!audit.contains(protected));
+    }
+}
+
+#[tokio::test]
+async fn failed_selector_budget_is_enforced_by_the_runtime_and_scoped_to_authority() {
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    make_writable(&prepared.bundle_root);
+    let configuration_path = prepared.bundle_root.join("evidence.yaml");
+    let mut configuration =
+        fs::read_to_string(&configuration_path).expect("acceptance configuration is readable");
+    replace_exact(
+        &mut configuration,
+        "rateLimits: {requestsPerPrincipalPerMinute: 60, burstPerPrincipal: 10, failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 10}",
+        "rateLimits: {requestsPerPrincipalPerMinute: 120, burstPerPrincipal: 20, failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 2}",
+        1,
+    );
+    replace_exact(
+        &mut configuration,
+        "authorityProfiles:\n  statutory-caseworker-v1:",
+        r#"authorityProfiles:
+  alternate-caseworker-v1:
+    kind: statutory
+    requesterTags: [alternate-fixture-agency]
+    grants:
+      - requirement: urn:example:fixture:requirement:adult-status:v1
+        purpose: fixture-eligibility
+        audienceFrom: authenticated-requester
+        subjects:
+          - {role: subject, selectorProfile: person-demographics-v1, valueOrigin: request}
+  statutory-caseworker-v1:"#,
+        1,
+    );
+    fs::write(&configuration_path, configuration).expect("test configuration is rewritten");
+    make_read_only(&prepared.bundle_root);
+    let runtime =
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("runtime with bounded selector budget initializes");
+
+    let mut invalid = adult_request();
+    invalid.subjects[0]
+        .selector
+        .values
+        .as_mut()
+        .expect("adult selector has values")
+        .remove("birth_date");
+    let primary_token = access_token_for("shared-selector-principal", None);
+    let mut retained_failures = String::new();
+    for attempt in 0..2 {
+        let error = runtime
+            .evaluate(
+                &format!("operation-selector-failure-primary-{attempt}"),
+                &primary_token,
+                &invalid,
+            )
+            .await
+            .expect_err("invalid selectors consume the configured budget");
+        assert_eq!(error.problem(), ProblemCode::InvalidSelector);
+        retained_failures.push_str(&format!("{error:?} {error}\n"));
+    }
+    let exhausted = runtime
+        .evaluate(
+            "operation-selector-failure-primary-exhausted",
+            &primary_token,
+            &invalid,
+        )
+        .await
+        .expect_err("the next request is rejected before selector resolution");
+    assert_eq!(exhausted.problem(), ProblemCode::RateLimited);
+    retained_failures.push_str(&format!("{exhausted:?} {exhausted}\n"));
+
+    let now = Utc::now().timestamp();
+    let alternate_token = signed_access_token(json!({
+        "iss": TOKEN_ISSUER,
+        "aud": TOKEN_AUDIENCE,
+        "sub": "shared-selector-principal",
+        "iat": now - 1,
+        "exp": now + 3600,
+        "evidence_tags": ["alternate-fixture-agency"],
+        "evidence_audience": EVIDENCE_AUDIENCE
+    }));
+    let alternate = runtime
+        .evaluate(
+            "operation-selector-failure-alternate-authority",
+            &alternate_token,
+            &invalid,
+        )
+        .await
+        .expect_err("a different matched authority has an independent selector budget");
+    assert_eq!(alternate.problem(), ProblemCode::InvalidSelector);
+    retained_failures.push_str(&format!("{alternate:?} {alternate}\n"));
+
+    assert!(prepared
+        .server
+        .received_requests()
+        .await
+        .expect("request journal is available")
+        .is_empty());
+    let audit = fs::read_to_string(&prepared.audit_path).expect("audit is readable");
+    assert!(
+        audit.is_empty(),
+        "pre-material selector failures are not audited"
+    );
+    retained_failures.push_str(&audit);
+    for protected in [
+        "shared-selector-principal",
+        "alternate-fixture-agency",
+        "Amina",
+        "Diallo",
+        "2000-01-01",
+    ] {
+        assert!(!audit.contains(protected));
+        assert!(!retained_failures.contains(protected));
+    }
+    for canary in privacy_canaries() {
+        assert!(
+            !retained_failures.contains(canary),
+            "public selector failures and audit remain value-free"
+        );
+    }
+}
+
+#[tokio::test]
+async fn one_runtime_proves_all_definitions_and_collapses_unresolved_relationships() {
+    let fixture = acceptance_runtime().await;
+    assert!(
+        fixture.runtime.ready().await,
+        "readiness accepts local credentials and performs no evidence-data lookup"
+    );
+    assert!(fixture
+        .server
+        .received_requests()
+        .await
+        .expect("request journal is available")
+        .is_empty());
+
+    mount_success_sources(&fixture.server, true).await;
+    let standard_token = access_token(None);
+    let parent_token = access_token(Some(parent_grant_claims()));
+
+    let cases = [
+        (
+            "adult",
+            adult_request(),
+            standard_token.as_str(),
+            "urn:example:fixture:concept:adult-status",
+            PublicValue::Boolean(true),
+            1,
+        ),
+        (
+            "residence",
+            residence_request(),
+            standard_token.as_str(),
+            "urn:example:fixture:concept:residence-region",
+            PublicValue::String("REGION-NORTH".to_owned()),
+            1,
+        ),
+        (
+            "licence",
+            licence_request(),
+            standard_token.as_str(),
+            "urn:example:fixture:concept:licence-active",
+            PublicValue::Boolean(true),
+            1,
+        ),
+        (
+            "parent-true",
+            parent_request(),
+            parent_token.as_str(),
+            "urn:example:fixture:concept:legal-parent-relationship-confirmed",
+            PublicValue::Boolean(true),
+            2,
+        ),
+    ];
+
+    for (operation_suffix, request, token, concept, expected, role_count) in cases {
+        let jws = fixture
+            .runtime
+            .evaluate(
+                &format!("operation-acceptance-{operation_suffix}"),
+                token,
+                &request,
+            )
+            .await
+            .expect("full Evidence path signs");
+        let serialized = serde_json::to_vec(&jws).expect("JWS serializes");
+        let evidence = verify_flattened_jws(
+            &serialized,
+            fixture.runtime.jwks(),
+            &verification_policy(&fixture.runtime, &request, &serialized),
+        )
+        .expect("released JWS verifies under the exact relying-procedure policy");
+        assert_eq!(evidence.subjects.len(), role_count);
+        if role_count == 2 {
+            assert_eq!(
+                evidence
+                    .subjects
+                    .iter()
+                    .map(|subject| subject.role.as_str())
+                    .collect::<Vec<_>>(),
+                ["child", "candidate-parent"]
+            );
+        }
+        assert!(evidence
+            .supported_values
+            .iter()
+            .any(|value| value.provides_value_for == concept && value.value == expected));
+        assert_minimized_payload(&serialized);
+    }
+
+    fixture.server.reset().await;
+    let non_parent = non_parent_candidate();
+    mount_parent_source(
+        &fixture.server,
+        parent_source_response(vec!["synthetic-parent-reference-002"]),
+    )
+    .await;
+    let non_parent_token = access_token(Some(parent_grant_claims_for(non_parent)));
+    let false_request = parent_request();
+    let false_jws = fixture
+        .runtime
+        .evaluate(
+            "operation-acceptance-parent-false",
+            &non_parent_token,
+            &false_request,
+        )
+        .await
+        .expect("exact non-membership in the complete governed parent set is signed");
+    let false_serialized = serde_json::to_vec(&false_jws).expect("JWS serializes");
+    let false_evidence = verify_flattened_jws(
+        &false_serialized,
+        fixture.runtime.jwks(),
+        &verification_policy(&fixture.runtime, &false_request, &false_serialized),
+    )
+    .expect("negative Evidence verifies");
+    assert_eq!(
+        false_evidence.supported_values[0].value,
+        PublicValue::Boolean(false)
+    );
+
+    for (suffix, response) in [
+        ("none", json!({"total": 0, "records": []})),
+        ("ambiguous", json!({"total": 2, "records": [{}, {}]})),
+    ] {
+        fixture.server.reset().await;
+        mount_parent_source(&fixture.server, response).await;
+        let error = fixture
+            .runtime
+            .evaluate(
+                &format!("operation-acceptance-parent-{suffix}"),
+                &parent_token,
+                &parent_request(),
+            )
+            .await
+            .expect_err("unresolved pairs never produce signed Evidence");
+        assert_eq!(error.problem(), ProblemCode::EvidenceNotAvailable);
+    }
+
+    fixture.server.reset().await;
+    let swapped_roles = request(
+        "urn:example:fixture:requirement:legal-parent-relationship:v1",
+        "fixture-enrolment",
+        vec![
+            requested_subject(
+                "candidate-parent",
+                "civil-record-reference-v1",
+                Some([("record_reference", "synthetic-child-record-001")]),
+            ),
+            requested_subject::<[(&str, &str); 0]>("child", "person-reference-v1", None),
+        ],
+    );
+    let swapped_error = fixture
+        .runtime
+        .evaluate(
+            "operation-acceptance-swapped-parent-roles",
+            &parent_token,
+            &swapped_roles,
+        )
+        .await
+        .expect_err("role/profile substitution is rejected before source access");
+    assert_eq!(swapped_error.problem(), ProblemCode::NotAuthorized);
+
+    let substituted = parent_request_with_candidate_values();
+    let error = fixture
+        .runtime
+        .evaluate(
+            "operation-acceptance-substitution",
+            &parent_token,
+            &substituted,
+        )
+        .await
+        .expect_err("caller candidate substitution is rejected before source access");
+    assert_eq!(error.problem(), ProblemCode::InvalidSelector);
+    let unauthorized = fixture
+        .runtime
+        .evaluate(
+            "operation-acceptance-unauthorized",
+            &access_token(Some(json!({
+                "evidence_grant_id": "grant-canary",
+                "evidence_authority": "different-authority",
+                "grant": {"candidate_parent": parent_candidate()}
+            }))),
+            &parent_request(),
+        )
+        .await
+        .expect_err("authority substitution is rejected before source access");
+    assert_eq!(unauthorized.problem(), ProblemCode::NotAuthorized);
+    assert!(fixture
+        .server
+        .received_requests()
+        .await
+        .expect("request journal is available")
+        .is_empty());
+
+    let audit = fs::read_to_string(&fixture.audit_path).expect("durable audit is readable");
+    assert_eq!(audit.matches("\"phase\":\"access-attempt\"").count(), 7);
+    assert_eq!(audit.matches("\"phase\":\"disclosure-release\"").count(), 5);
+    assert_eq!(audit.matches("\"phase\":\"denial\"").count(), 2);
+    let retained_failures = format!(
+        "{swapped_error:?} {swapped_error}\n{error:?} {error}\n{unauthorized:?} {unauthorized}\n{audit}"
+    );
+    for canary in privacy_canaries() {
+        assert!(
+            !retained_failures.contains(canary),
+            "public failures and audit must not retain protected selector, grant, source, or secret material"
+        );
+    }
+}
+
+#[tokio::test]
+async fn runtime_output_gate_rejects_every_fixture_injected_derivation_without_release() {
+    let cases = [
+        (
+            "adult",
+            "derivations/adult-status.rhai",
+            r#"fn derive(facts, selectors, evaluation_context) { [#{concept_id: "urn:example:fixture:concept:adult-status", value: "true"}] }"#,
+        ),
+        (
+            "residence",
+            "derivations/residence-region.rhai",
+            r#"fn derive(facts, selectors, evaluation_context) { [#{concept_id: "urn:example:fixture:concept:residence-region", value: "R-101"}] }"#,
+        ),
+        (
+            "licence",
+            "derivations/professional-licence.rhai",
+            r#"fn derive(facts, selectors, evaluation_context) { [#{concept_id: "urn:example:fixture:concept:licence-active", value: true}, #{concept_id: "urn:example:fixture:concept:licence-expiry-category", value: "2026-08-20"}] }"#,
+        ),
+        (
+            "relationship",
+            "derivations/legal-parent-relationship.rhai",
+            r#"fn derive(facts, selectors, evaluation_context) { [#{concept_id: "urn:example:fixture:concept:legal-parent-relationship-confirmed", value: true}, #{concept_id: "urn:example:fixture:concept:related-subject-name", value: "PrivacyCanary"}] }"#,
+        ),
+    ];
+
+    for (definition, script_path, script) in cases {
+        let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+        make_writable(&prepared.bundle_root);
+        fs::write(prepared.bundle_root.join(script_path), script)
+            .expect("test derivation replacement succeeds");
+        make_read_only(&prepared.bundle_root);
+        let runtime =
+            EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+                .await
+                .expect("runtime with a syntactically valid injected derivation initializes");
+        let (request, token) = match definition {
+            "adult" => {
+                mount_adult_source(&prepared.server, None).await;
+                (adult_request(), access_token(None))
+            }
+            "residence" => {
+                mount_residence_source(&prepared.server).await;
+                (residence_request(), access_token(None))
+            }
+            "licence" => {
+                mount_licence_source(&prepared.server).await;
+                (licence_request(), access_token(None))
+            }
+            "relationship" => {
+                mount_parent_source(
+                    &prepared.server,
+                    parent_source_response(vec![PARENT_REFERENCE]),
+                )
+                .await;
+                (parent_request(), access_token(Some(parent_grant_claims())))
+            }
+            _ => unreachable!("closed acceptance definitions"),
+        };
+
+        let error = runtime
+            .evaluate(
+                &format!("operation-output-gate-{definition}"),
+                &token,
+                &request,
+            )
+            .await
+            .expect_err("invalid derived output cannot reach signing or release");
+        assert_eq!(error.problem(), ProblemCode::ServiceUnavailable);
+        let audit = fs::read_to_string(&prepared.audit_path).expect("audit is readable");
+        assert_eq!(audit.matches("\"phase\":\"access-attempt\"").count(), 1);
+        assert_eq!(
+            audit
+                .matches("\"safeErrorCategory\":\"output-gate\"")
+                .count(),
+            1
+        );
+        assert_eq!(audit.matches("\"phase\":\"disclosure-release\"").count(), 0);
+        let requests = prepared
+            .server
+            .received_requests()
+            .await
+            .expect("request journal is available");
+        assert_eq!(requests.len(), 1);
+        let retained = format!(
+            "{error:?} {error}\n{audit}\n{} {}",
+            requests[0].method,
+            requests[0].url.path()
+        );
+        for canary in privacy_canaries() {
+            assert!(
+                !retained.contains(canary),
+                "public failure, audit, and non-sensitive request metadata remain minimized"
+            );
+        }
+    }
+}
+
+#[tokio::test]
+async fn runtime_rejects_an_extra_extracted_fact_before_derivation_or_release() {
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    make_writable(&prepared.bundle_root);
+    let adapter_path = prepared
+        .bundle_root
+        .join("adapters/adult-status-source.rhai");
+    let mut adapter = fs::read_to_string(&adapter_path).expect("adapter is readable");
+    replace_exact(
+        &mut adapter,
+        "facts: #{date_of_birth: date_of_birth}",
+        "facts: #{date_of_birth: date_of_birth, unexpected_private_fact: \"PrivacyCanary\"}",
+        1,
+    );
+    fs::write(adapter_path, adapter).expect("test adapter replacement succeeds");
+    make_read_only(&prepared.bundle_root);
+    let runtime =
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("runtime with a syntactically valid adapter initializes");
+    mount_adult_source(&prepared.server, None).await;
+
+    let error = runtime
+        .evaluate(
+            "operation-extra-extracted-fact-rejection",
+            &access_token(None),
+            &adult_request(),
+        )
+        .await
+        .expect_err("a fact outside the closed fact schema cannot reach derivation");
+    assert_eq!(error.problem(), ProblemCode::EvidenceNotAvailable);
+    let audit = fs::read_to_string(&prepared.audit_path).expect("audit is readable");
+    assert_eq!(audit.matches("\"phase\":\"access-attempt\"").count(), 1);
+    assert_eq!(
+        audit
+            .matches("\"safeErrorCategory\":\"fact-unavailable\"")
+            .count(),
+        1
+    );
+    assert_eq!(audit.matches("\"phase\":\"disclosure-release\"").count(), 0);
+    let requests = prepared
+        .server
+        .received_requests()
+        .await
+        .expect("request journal is available");
+    assert_eq!(requests.len(), 1);
+    let retained = format!(
+        "{error:?} {error}\n{audit}\n{} {}",
+        requests[0].method,
+        requests[0].url.path()
+    );
+    for canary in privacy_canaries() {
+        assert!(
+            !retained.contains(canary),
+            "public failure, audit, and non-sensitive request metadata remain minimized"
+        );
+    }
+}
+
+#[tokio::test]
+async fn every_runtime_applicable_acceptance_case_reaches_terminal_audit_and_verification() {
+    let fixture = acceptance_runtime().await;
+    let definitions = [
+        (
+            "adult",
+            include_bytes!(
+                "../../../products/evidence/fixtures/acceptance/all-definitions/fixtures/adult-status-cases.yaml"
+            )
+            .as_slice(),
+        ),
+        (
+            "residence",
+            include_bytes!(
+                "../../../products/evidence/fixtures/acceptance/all-definitions/fixtures/residence-region-cases.yaml"
+            )
+            .as_slice(),
+        ),
+        (
+            "licence",
+            include_bytes!(
+                "../../../products/evidence/fixtures/acceptance/all-definitions/fixtures/professional-licence-cases.yaml"
+            )
+            .as_slice(),
+        ),
+        (
+            "relationship",
+            include_bytes!(
+                "../../../products/evidence/fixtures/acceptance/all-definitions/fixtures/legal-parent-relationship-cases.yaml"
+            )
+            .as_slice(),
+        ),
+    ];
+    let mut executed = BTreeMap::new();
+    let mut runtime_equivalents = BTreeSet::new();
+    let mut startup_only = BTreeSet::new();
+
+    for (definition, bytes) in definitions {
+        let matrix: Value = serde_norway::from_slice(bytes).expect("acceptance matrix parses");
+        let common = matrix["common"].as_object().expect("common is an object");
+        for (index, case) in matrix["cases"]
+            .as_array()
+            .expect("cases are an array")
+            .iter()
+            .enumerate()
+        {
+            let case = case.as_object().expect("case is an object");
+            let case_id = case["id"].as_str().expect("case id is text");
+            if case.contains_key("injected_derivation") {
+                runtime_equivalents.insert(format!("{definition}/{case_id}:output-gate"));
+                continue;
+            }
+            if case.contains_key("companion_bundle") {
+                startup_only.insert(format!("{definition}/{case_id}:bundle-rejection"));
+                continue;
+            }
+            if case.get("expected").and_then(Value::as_str) == Some("pre-source-selector-rejection")
+            {
+                runtime_equivalents.insert(format!("{definition}/{case_id}:pre-source-rejection"));
+                continue;
+            }
+
+            fixture.server.reset().await;
+            let request = match definition {
+                "adult" => adult_request(),
+                "residence" => residence_request(),
+                "licence" => licence_request(),
+                "relationship" => parent_request(),
+                _ => unreachable!("closed definition set"),
+            };
+            let source_path = match definition {
+                "adult" | "residence" => "/v1/facts",
+                "licence" => "/v1/records",
+                "relationship" => "/v1/child-relationships",
+                _ => unreachable!("closed definition set"),
+            };
+            let source_method = if definition == "licence" {
+                "GET"
+            } else {
+                "POST"
+            };
+            let is_relationship = definition == "relationship";
+            let response = if let Some(source) = case.get("source") {
+                ResponseTemplate::new(200).set_body_json(source)
+            } else {
+                match case.get("source_failure").and_then(Value::as_str) {
+                    Some("timeout") => ResponseTemplate::new(200)
+                        .set_body_json(json!({"total": 1}))
+                        .set_delay(Duration::from_millis(3_050)),
+                    Some("http-503") => ResponseTemplate::new(503),
+                    Some("wrong-media-type") => {
+                        ResponseTemplate::new(200).set_body_raw("{}", "text/plain")
+                    }
+                    Some("redirect") => {
+                        ResponseTemplate::new(302).insert_header("location", "/prohibited-redirect")
+                    }
+                    _ => panic!("case must have source or closed source failure"),
+                }
+            };
+            let mut source_mock = Mock::given(method(source_method))
+                .and(path(source_path))
+                .and(header("accept", "application/json"));
+            if is_relationship {
+                source_mock = source_mock
+                    .and(header("authorization", format!("Bearer {BEARER}").as_str()))
+                    .and(body_json(parent_source_request()));
+            }
+            source_mock
+                .respond_with(response)
+                .expect(1)
+                .mount(&fixture.server)
+                .await;
+
+            let principal = format!("principal-{definition}-{index}");
+            let token_claims = case
+                .get("verified_token_claims")
+                .cloned()
+                .or_else(|| is_relationship.then(|| parent_grant_claims_for(parent_candidate())));
+            let token = access_token_for(&principal, token_claims);
+            let evaluation_time = acceptance_case_time(case, common);
+            let audit_before = fs::read_to_string(&fixture.audit_path)
+                .expect("audit is readable before router request")
+                .lines()
+                .count();
+            let http = TestServer::new(build_app_at_for_test(
+                Arc::clone(&fixture.runtime),
+                evaluation_time,
+            ));
+            let response = http
+                .post("/v1/evidence")
+                .add_header("authorization", format!("Bearer {token}"))
+                .json(&request)
+                .await;
+
+            if case.contains_key("expected_value") || case.contains_key("expected_values") {
+                response.assert_status_ok();
+                let jws = response.json::<FlattenedJws>();
+                let serialized = serde_json::to_vec(&jws).expect("JWS serializes");
+                let mut policy = verification_policy(&fixture.runtime, &request, &serialized);
+                policy.now = evaluation_time;
+                let evidence = verify_flattened_jws(&serialized, fixture.runtime.jwks(), &policy)
+                    .expect("matrix JWS verifies");
+                if let Some(expected) = case.get("expected_value") {
+                    assert_eq!(
+                        serde_json::to_value(&evidence.supported_values[0].value)
+                            .expect("value serializes"),
+                        *expected,
+                        "{definition}/{case_id}"
+                    );
+                } else {
+                    let expected = case["expected_values"]
+                        .as_object()
+                        .expect("expected values are an object");
+                    for value in &evidence.supported_values {
+                        let short = value
+                            .provides_value_for
+                            .rsplit(':')
+                            .next()
+                            .expect("concept has a suffix");
+                        assert_eq!(
+                            serde_json::to_value(&value.value).expect("value serializes"),
+                            expected[short],
+                            "{definition}/{case_id}/{short}"
+                        );
+                    }
+                }
+                assert_minimized_payload(&serialized);
+            } else {
+                let expected = match case
+                    .get("expected_public_problem")
+                    .and_then(Value::as_str)
+                    .expect("failed case names its public problem")
+                {
+                    "evidence_not_available" => ProblemCode::EvidenceNotAvailable,
+                    "dependency_unavailable" => ProblemCode::DependencyUnavailable,
+                    "service_unavailable" => ProblemCode::ServiceUnavailable,
+                    _ => panic!("unknown public problem"),
+                };
+                response.assert_status(expected.status());
+                assert_eq!(
+                    response.json::<Value>()["code"],
+                    expected.code(),
+                    "{definition}/{case_id}"
+                );
+            }
+
+            let audit = fs::read_to_string(&fixture.audit_path).expect("audit is readable");
+            let new_events = audit.lines().skip(audit_before).collect::<Vec<_>>();
+            assert_eq!(new_events.len(), 2, "{definition}/{case_id}");
+            let first: Value = serde_json::from_str(new_events[0]).expect("access audit parses");
+            let second: Value = serde_json::from_str(new_events[1]).expect("terminal audit parses");
+            assert_eq!(
+                first["operation"], second["operation"],
+                "{definition}/{case_id}"
+            );
+            for protected in [
+                principal.as_str(),
+                "2000-01-01",
+                "2008-08-02",
+                "R-101",
+                "R-102",
+                "R-201",
+                "R-999",
+                "CURRENT",
+                "SUSPENDED",
+                "PENDING",
+                "UNIQUE",
+                "CONFIRMED",
+                "NOT_CONFIRMED",
+                "Amadou",
+                "Keita",
+                "1974-02-11",
+                "related_subject_name",
+                "synthetic-other-child-record",
+                "synthetic-parent-reference-001",
+                "synthetic-parent-reference-002",
+                "synthetic-non-parent-reference-003",
+                "synthetic-substitute-reference",
+                "PrivacyCanary",
+            ] {
+                assert!(
+                    !audit.contains(protected),
+                    "audit leaked protected material"
+                );
+            }
+            assert_eq!(
+                fixture
+                    .server
+                    .received_requests()
+                    .await
+                    .expect("request journal is available")
+                    .iter()
+                    .filter(|request| request.url.path() == source_path)
+                    .count(),
+                1,
+                "{definition}/{case_id} must perform exactly one evidence-data request"
+            );
+            *executed.entry(definition).or_insert(0_usize) += 1;
+        }
+    }
+
+    assert_eq!(
+        executed,
+        BTreeMap::from([
+            ("adult", 11),
+            ("residence", 9),
+            ("licence", 10),
+            ("relationship", 20)
+        ])
+    );
+    assert_eq!(
+        runtime_equivalents,
+        BTreeSet::from([
+            "adult/negative-wrong-derived-type:output-gate".to_owned(),
+            "licence/negative-exact-date-leak:output-gate".to_owned(),
+            "relationship/negative-caller-candidate-substitution:pre-source-rejection".to_owned(),
+            "relationship/negative-extra-family-fact:output-gate".to_owned(),
+            "relationship/negative-swapped-roles:pre-source-rejection".to_owned(),
+            "residence/negative-overly-precise-output:output-gate".to_owned(),
+        ]),
+        "every runtime-applicable non-source fixture has a named executable equivalent in this module"
+    );
+    assert_eq!(
+        startup_only,
+        BTreeSet::from([
+            "adult/anti-reconstruction:bundle-rejection".to_owned(),
+            "licence/anti-reconstruction:bundle-rejection".to_owned(),
+            "relationship/anti-reconstruction:bundle-rejection".to_owned(),
+            "residence/anti-reconstruction:bundle-rejection".to_owned(),
+        ]),
+        "only companion-bundle conflicts remain startup-only because an invalid bundle cannot initialize an EvidenceRuntime"
+    );
+}
+
+/// Many simultaneous evaluations must leave exactly one verifiable audit chain:
+/// two records per released assertion, no forked or interleaved hash links, and
+/// one distinct evidence identity per request.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn concurrent_evidence_requests_keep_one_verifiable_audit_chain() {
+    let load = LoadFixture::start().await;
+    let outcomes = load.run(LOAD_CONCURRENCY, LOAD_CONCURRENCY).await;
+    assert_eq!(
+        outcomes.released(),
+        LOAD_CONCURRENCY,
+        "every admitted concurrent request releases evidence; observed {:?}",
+        outcomes.status_counts()
+    );
+
+    let audit = load.shutdown().await;
+    assert_eq!(
+        audit.matches("\"phase\":\"access-attempt\"").count(),
+        LOAD_CONCURRENCY
+    );
+    assert_eq!(
+        audit.matches("\"phase\":\"disclosure-release\"").count(),
+        LOAD_CONCURRENCY
+    );
+    assert_eq!(
+        released_evidence_ids(&audit).len(),
+        LOAD_CONCURRENCY,
+        "concurrent releases must not share an evidence identity"
+    );
+
+    let verification = verify_jsonl_lines_with_hasher(audit.lines(), &acceptance_audit_hasher())
+        .expect("the concurrently written audit chain verifies under the deployment key");
+    assert_eq!(verification.records, LOAD_CONCURRENCY * 2);
+}
+
+/// Report sustained request throughput against the two candidate ceilings, so
+/// the dominant one is attributed from measurement rather than argument.
+///
+/// This asserts only correctness invariants. The rates themselves are reported,
+/// never asserted: they are properties of the host filesystem and core count,
+/// and a threshold here would be a flake generator. Read the report, record the
+/// numbers with the hardware they came from, and compare across changes.
+///
+/// ```text
+/// cargo test -p registry-evidence --lib -- --ignored --nocapture soak_reports
+/// ```
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "opt-in throughput soak; rates are host-specific and reported, not asserted"]
+async fn soak_reports_request_throughput_against_the_audit_ceiling() {
+    let load = LoadFixture::start().await;
+
+    // Warm the OAuth-free source path, JWKS cache, and connection pool so
+    // first-request costs do not land inside the measured window.
+    let _ = load.run(LOAD_CONCURRENCY, LOAD_CONCURRENCY).await;
+
+    let outcomes = load.run(SOAK_REQUESTS, LOAD_CONCURRENCY).await;
+    let released = outcomes.released();
+    let request_rate = released as f64 / outcomes.elapsed.as_secs_f64();
+
+    let source_rate = load.measure_source_rate(SOURCE_PROBE_REQUESTS).await;
+    let append_rate = load.measure_audit_append_rate(AUDIT_PROBE_APPENDS).await;
+    // Every released assertion writes an access-attempt record before source
+    // access and a disclosure-release record after it.
+    let audit_ceiling = append_rate / 2.0;
+
+    let percentiles = outcomes.latency_percentiles();
+    println!(
+        "\n=== Evidence throughput report ===\n\
+         host                : {} logical cores\n\
+         load                : {SOAK_REQUESTS} requests, {LOAD_CONCURRENCY} concurrent\n\
+         released            : {released} in {:.2}s\n\
+         \n\
+         observed request    : {request_rate:.0} rps\n\
+         audit ceiling       : {audit_ceiling:.0} rps ({append_rate:.0} appends/s / 2 records per request)\n\
+         mock source floor   : {source_rate:.0} rps\n\
+         \n\
+         latency p50/p95/p99 : {:.1} / {:.1} / {:.1} ms\n\
+         audit share of ceiling: {:.0}%\n\
+         ==================================\n",
+        std::thread::available_parallelism().map_or(0, std::num::NonZeroUsize::get),
+        outcomes.elapsed.as_secs_f64(),
+        percentiles.0.as_secs_f64() * 1000.0,
+        percentiles.1.as_secs_f64() * 1000.0,
+        percentiles.2.as_secs_f64() * 1000.0,
+        if audit_ceiling > 0.0 {
+            request_rate / audit_ceiling * 100.0
+        } else {
+            0.0
+        },
+    );
+
+    assert_eq!(
+        released,
+        SOAK_REQUESTS,
+        "sustained load must not shed requests; observed {:?}",
+        outcomes.status_counts()
+    );
+
+    let audit = load.shutdown().await;
+    let expected_releases = SOAK_REQUESTS + LOAD_CONCURRENCY;
+    assert_eq!(
+        audit.matches("\"phase\":\"disclosure-release\"").count(),
+        expected_releases
+    );
+    assert_eq!(released_evidence_ids(&audit).len(), expected_releases);
+    let verification = verify_jsonl_lines_with_hasher(audit.lines(), &acceptance_audit_hasher())
+        .expect("the audit chain written under sustained load verifies");
+    assert_eq!(verification.records, expected_releases * 2);
+}
+
+fn acceptance_case_time(
+    case: &serde_json::Map<String, Value>,
+    common: &serde_json::Map<String, Value>,
+) -> chrono::DateTime<Utc> {
+    if let Some(date) = case
+        .get("legal_local_date")
+        .or_else(|| common.get("legal_local_date"))
+        .and_then(Value::as_str)
+    {
+        return format!("{date}T05:00:00Z")
+            .parse()
+            .expect("fixed legal-local fixture date converts");
+    }
+    case.get("observed_at")
+        .or_else(|| common.get("observed_at"))
+        .and_then(Value::as_str)
+        .unwrap_or("2026-08-02T00:00:00Z")
+        .parse()
+        .expect("fixed observation time parses")
+}
+
+async fn acceptance_runtime() -> AcceptanceRuntime {
+    let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+    let runtime = Arc::new(
+        EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+            .await
+            .expect("one immutable acceptance runtime initializes"),
+    );
+    AcceptanceRuntime {
+        _temporary: prepared.temporary,
+        bundle_root: prepared.bundle_root,
+        runtime_path: prepared.runtime_path,
+        runtime,
+        server: prepared.server,
+        audit_path: prepared.audit_path,
+    }
+}
+
+async fn prepare_acceptance(binding_secret: &str) -> PreparedAcceptance {
+    let server = MockServer::start().await;
+    let prepared = prepare_fixture(
+        binding_secret,
+        &server.uri(),
+        &FixtureCeilings::deployment_defaults(),
+    );
+    PreparedAcceptance {
+        temporary: prepared.temporary,
+        bundle_root: prepared.bundle_root,
+        runtime_path: prepared.runtime_path,
+        server,
+        audit_path: prepared.audit_path,
+    }
+}
+
+/// Copy the acceptance bundle into a temporary root, point every source at
+/// `source_origin`, write the synthetic secrets and the runtime configuration
+/// under `ceilings`, then make the bundle and runtime file read-only.
+fn prepare_fixture(
+    binding_secret: &str,
+    source_origin: &str,
+    ceilings: &FixtureCeilings,
+) -> PreparedFixture {
+    let temporary = tempfile::tempdir().expect("temporary acceptance root");
+    let bundle_root = temporary.path().join("bundle");
+    let runtime_path = temporary.path().join("runtime.yaml");
+    let secret_root = temporary.path().join("secrets");
+    let audit_path = temporary.path().join("audit.jsonl");
+    fs::create_dir(&bundle_root).expect("bundle root is created");
+    fs::create_dir(&secret_root).expect("secret root is created");
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt as _;
+        fs::set_permissions(&secret_root, fs::Permissions::from_mode(0o700))
+            .expect("secret root is owner-only");
+    }
+    copy_tree(&fixture_root(), &bundle_root);
+
+    rewrite_deployment_values(&bundle_root, source_origin);
+    apply_fixture_ceilings(&bundle_root, ceilings);
+    write_secret(
+        &secret_root,
+        "audit-hash-key",
+        "audit-hash-secret-canary-32-bytes-minimum",
+    );
+    write_secret(&secret_root, "subject-binding-key", binding_secret);
+    write_secret(&secret_root, "signing-key", EVIDENCE_PRIVATE_JWK);
+    write_secret(&secret_root, "source-a-token", BEARER);
+    write_secret(&secret_root, "source-b-token", BEARER);
+    write_secret(&secret_root, "source-c-username", BASIC_USER);
+    write_secret(&secret_root, "source-c-password", BASIC_PASSWORD);
+    write_secret(&secret_root, "source-d-token", BEARER);
+    write_runtime_config(
+        &runtime_path,
+        &bundle_root,
+        &secret_root,
+        &audit_path,
+        ceilings,
+    );
+    make_file_read_only(&runtime_path);
+    make_read_only(&bundle_root);
+
+    PreparedFixture {
+        temporary,
+        bundle_root,
+        runtime_path,
+        audit_path,
+    }
+}
+
+fn authenticator() -> Authenticator {
+    let private = PrivateJwk::parse(AUTH_PRIVATE_JWK).expect("auth test key parses");
+    let jwks: JwkSet = serde_json::from_value(json!({"keys": [private.public()]}))
+        .expect("static auth JWKS parses");
+    let fetcher = Arc::new(JwksFetcher::new_static(jwks, JwksFetcherConfig::defaults()));
+    let verifier = Arc::new(TokenVerifier::new(
+        TokenVerifierConfig::access_token_profile(
+            TOKEN_ISSUER,
+            vec![TOKEN_AUDIENCE.to_owned()],
+            vec![Algorithm::EdDSA],
+            vec!["at+jwt".to_owned()],
+        ),
+        fetcher,
+    ));
+    Authenticator::new(
+        verifier,
+        AuthenticationClaimsConfig {
+            principal_claim: "sub".to_owned(),
+            requester_tags_claim: "evidence_tags".to_owned(),
+            evidence_audience_claim: "evidence_audience".to_owned(),
+            grant_id_claim: "evidence_grant_id".to_owned(),
+            grant_authority_claim: "evidence_authority".to_owned(),
+            actor_claim: None,
+        },
+    )
+}
+
+/// The same authenticator, but resolving the issuer's keys over HTTP from a
+/// given address rather than from a key set held in memory.
+///
+/// The fetch policy is the permissive one so a loopback test server is a legal
+/// address; the deployed policy is built in `Authenticator::from_config` and is
+/// not what this exercises.
+fn fetching_authenticator(jwks_uri: &str) -> Authenticator {
+    let verifier = Arc::new(TokenVerifier::new(
+        TokenVerifierConfig::access_token_profile(
+            TOKEN_ISSUER,
+            vec![TOKEN_AUDIENCE.to_owned()],
+            vec![Algorithm::EdDSA],
+            vec!["at+jwt".to_owned()],
+        ),
+        Arc::new(JwksFetcher::new_with_fetch_url_policy(
+            jwks_uri.to_owned(),
+            JwksFetcherConfig::defaults(),
+            FetchUrlPolicy::dev(),
+        )),
+    ));
+    Authenticator::new(
+        verifier,
+        AuthenticationClaimsConfig {
+            principal_claim: "sub".to_owned(),
+            requester_tags_claim: "evidence_tags".to_owned(),
+            evidence_audience_claim: "evidence_audience".to_owned(),
+            grant_id_claim: "evidence_grant_id".to_owned(),
+            grant_authority_claim: "evidence_authority".to_owned(),
+            actor_claim: None,
+        },
+    )
+}
+
+fn access_token(extra: Option<Value>) -> String {
+    access_token_for("requester-principal-canary", extra)
+}
+
+fn access_token_for(principal: &str, extra: Option<Value>) -> String {
+    access_token_for_issuer(TOKEN_ISSUER, principal, extra)
+}
+
+fn access_token_for_issuer(issuer: &str, principal: &str, extra: Option<Value>) -> String {
+    let now = Utc::now().timestamp();
+    let mut claims = json!({
+        "iss": issuer,
+        "aud": TOKEN_AUDIENCE,
+        "sub": principal,
+        "iat": now - 1,
+        "exp": now + 3600,
+        "evidence_tags": ["fixture-agency"],
+        "evidence_audience": EVIDENCE_AUDIENCE
+    });
+    if let Some(Value::Object(extra)) = extra {
+        claims
+            .as_object_mut()
+            .expect("claims are an object")
+            .extend(extra);
+    }
+    signed_access_token(claims)
+}
+
+fn signed_access_token(claims: Value) -> String {
+    let header = URL_SAFE_NO_PAD.encode(
+        serde_json::to_vec(&json!({
+            "alg": "EdDSA",
+            "kid": "acceptance-auth-key",
+            "typ": "at+jwt"
+        }))
+        .expect("JWT header serializes"),
+    );
+    let payload = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&claims).expect("claims serialize"));
+    let signing_input = format!("{header}.{payload}");
+    let key = PrivateJwk::parse(AUTH_PRIVATE_JWK).expect("auth key parses");
+    let signature =
+        URL_SAFE_NO_PAD.encode(sign(signing_input.as_bytes(), &key).expect("JWT signs"));
+    format!("{signing_input}.{signature}")
+}
+
+fn parent_grant_claims() -> Value {
+    parent_grant_claims_for(parent_candidate())
+}
+
+fn parent_grant_claims_for(candidate: Value) -> Value {
+    json!({
+        "evidence_grant_id": "synthetic-parentage-grant-001",
+        "evidence_authority": AUTHORITY,
+        "grant": {"candidate_parent": candidate}
+    })
+}
+
+fn parent_candidate() -> Value {
+    json!({"person_reference": PARENT_REFERENCE})
+}
+
+fn non_parent_candidate() -> Value {
+    json!({"person_reference": NON_PARENT_REFERENCE})
+}
+
+async fn mount_success_sources(server: &MockServer, candidate_is_parent: bool) {
+    mount_adult_source(server, None).await;
+    mount_residence_source(server).await;
+    mount_licence_source(server).await;
+    let parents = if candidate_is_parent {
+        vec![PARENT_REFERENCE]
+    } else {
+        vec!["synthetic-parent-reference-002"]
+    };
+    mount_parent_source(server, parent_source_response(parents)).await;
+}
+
+async fn mount_residence_source(server: &MockServer) {
+    Mock::given(method("POST"))
+        .and(path("/v1/facts"))
+        .and(header("accept", "application/json"))
+        .and(header("authorization", format!("Bearer {BEARER}").as_str()))
+        .and(body_json(json!({
+            "lookup": {"record_reference": "synthetic-residence-record-001"},
+            "fields": ["official_residence_code"],
+            "limit": 2
+        })))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "total": 1,
+            "official_residence_code": "R-101"
+        })))
+        .expect(1)
+        .mount(server)
+        .await;
+}
+
+async fn mount_licence_source(server: &MockServer) {
+    let basic = format!(
+        "Basic {}",
+        base64::engine::general_purpose::STANDARD.encode(format!("{BASIC_USER}:{BASIC_PASSWORD}"))
+    );
+    Mock::given(method("GET"))
+        .and(path("/v1/records"))
+        .and(header("accept", "application/json"))
+        .and(header("authorization", basic.as_str()))
+        .and(query_param("limit", "2"))
+        .and(query_param("licence_reference", "synthetic-licence-001"))
+        .and(query_param("registry_region", "RR-A"))
+        .and(query_param(
+            "fields",
+            "licence_state,valid_from,valid_until",
+        ))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "total": 1,
+            "records": [{
+                "licence_state": "CURRENT",
+                "valid_from": "2000-01-01",
+                "valid_until": "2099-12-31",
+                "historical_states": ["PENDING"]
+            }]
+        })))
+        .expect(1)
+        .mount(server)
+        .await;
+}
+
+async fn mount_adult_source(server: &MockServer, delay: Option<Duration>) {
+    mount_adult_source_expecting(server, delay, 1).await;
+}
+
+/// The same fixture source mounted for an exact number of evaluations.
+async fn mount_adult_source_expecting(server: &MockServer, delay: Option<Duration>, expected: u64) {
+    let response = ResponseTemplate::new(200).set_body_json(json!({
+        "total": 1,
+        "date_of_birth": "2000-01-01"
+    }));
+    let response = delay.map_or(response.clone(), |delay| response.set_delay(delay));
+    Mock::given(method("POST"))
+        .and(path("/v1/facts"))
+        .and(header("accept", "application/json"))
+        .and(header("authorization", format!("Bearer {BEARER}").as_str()))
+        .and(body_json(json!({
+            "lookup": {
+                "given_name": "Amina",
+                "family_name": "Diallo",
+                "birth_date": "2000-01-01"
+            },
+            "fields": ["date_of_birth"],
+            "limit": 2
+        })))
+        .respond_with(response)
+        .expect(expected)
+        .mount(server)
+        .await;
+}
+
+async fn mount_parent_source(server: &MockServer, response: Value) {
+    Mock::given(method("POST"))
+        .and(path("/v1/child-relationships"))
+        .and(header("accept", "application/json"))
+        .and(header("authorization", format!("Bearer {BEARER}").as_str()))
+        .and(body_json(parent_source_request()))
+        .respond_with(ResponseTemplate::new(200).set_body_json(response))
+        .expect(1)
+        .mount(server)
+        .await;
+}
+
+fn parent_source_request() -> Value {
+    json!({
+        "lookup": {"record_reference": "synthetic-child-record-001"},
+        "fields": [
+            "returned_child_reference",
+            "parent_references",
+            "reference_namespace",
+            "relationship_set_contract",
+            "relationship_set_complete"
+        ],
+        "limit": 2
+    })
+}
+
+fn parent_source_response(parent_references: Vec<&str>) -> Value {
+    json!({
+        "total": 1,
+        "records": [{
+            "returned_child_reference": "synthetic-child-record-001",
+            "parent_references": parent_references,
+            "reference_namespace": "urn:example:fixture:person-reference",
+            "relationship_set_contract": "urn:example:fixture:legal-parent-set:v1",
+            "relationship_set_complete": true
+        }]
+    })
+}
+
+async fn wait_for_source_request_count(server: &MockServer, expected: usize) {
+    tokio::time::timeout(Duration::from_secs(3), async {
+        loop {
+            let count = server
+                .received_requests()
+                .await
+                .expect("request journal is available")
+                .len();
+            if count >= expected {
+                return;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .expect("source request arrives before the test deadline");
+}
+
+async fn wait_for_audit_counts(path: &Path, access: usize, release: usize) -> String {
+    tokio::time::timeout(Duration::from_secs(5), async {
+        loop {
+            let contents = fs::read_to_string(path).expect("audit is readable");
+            if contents.matches("\"phase\":\"access-attempt\"").count() >= access
+                && contents.matches("\"phase\":\"disclosure-release\"").count() >= release
+            {
+                return contents;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .expect("terminal audit records arrive before the test deadline")
+}
+
+async fn wait_for_runtime_ready(runtime: &EvidenceRuntime) {
+    tokio::time::timeout(Duration::from_secs(3), async {
+        loop {
+            if runtime.ready().await {
+                return;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .expect("runtime returns to ready after detached evaluation completes");
+}
+
+fn adult_request() -> EvidenceRequest {
+    request(
+        "urn:example:fixture:requirement:adult-status:v1",
+        "fixture-eligibility",
+        vec![requested_subject(
+            "subject",
+            "person-demographics-v1",
+            Some([
+                ("given_name", "Amina"),
+                ("family_name", "Diallo"),
+                ("birth_date", "2000-01-01"),
+            ]),
+        )],
+    )
+}
+
+fn residence_request() -> EvidenceRequest {
+    request(
+        "urn:example:fixture:requirement:residence-region:v1",
+        "fixture-routing",
+        vec![requested_subject(
+            "subject",
+            "residence-record-v1",
+            Some([("record_reference", "synthetic-residence-record-001")]),
+        )],
+    )
+}
+
+fn licence_request() -> EvidenceRequest {
+    request(
+        "urn:example:fixture:requirement:professional-licence-status:v1",
+        "fixture-registration",
+        vec![requested_subject(
+            "subject",
+            "licence-register-v1",
+            Some([
+                ("licence_reference", "synthetic-licence-001"),
+                ("registry_region", "RR-A"),
+            ]),
+        )],
+    )
+}
+
+fn parent_request() -> EvidenceRequest {
+    request(
+        "urn:example:fixture:requirement:legal-parent-relationship:v1",
+        "fixture-enrolment",
+        vec![
+            requested_subject(
+                "child",
+                "civil-record-reference-v1",
+                Some([("record_reference", "synthetic-child-record-001")]),
+            ),
+            requested_subject::<[(&str, &str); 0]>("candidate-parent", "person-reference-v1", None),
+        ],
+    )
+}
+
+fn parent_request_with_candidate_values() -> EvidenceRequest {
+    let mut request = parent_request();
+    request.subjects[1].selector.values = Some(BTreeMap::from([(
+        "person_reference".to_owned(),
+        SelectorValue::String("synthetic-substitute-reference".to_owned()),
+    )]));
+    request
+}
+
+fn request(requirement: &str, purpose: &str, subjects: Vec<RequestedSubject>) -> EvidenceRequest {
+    EvidenceRequest {
+        request_nonce: fresh_request_nonce(),
+        requirement: requirement.to_owned(),
+        purpose: purpose.to_owned(),
+        subjects,
+        holder_key: None,
+    }
+}
+
+/// A unique canonical nonce per constructed request, so exact-echo and
+/// non-propagation assertions cannot pass by collision.
+fn fresh_request_nonce() -> String {
+    use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+    let mut bytes = [0u8; 32];
+    let unique = ulid::Ulid::new().to_bytes();
+    bytes[..16].copy_from_slice(&unique);
+    URL_SAFE_NO_PAD.encode(bytes)
+}
+
+fn requested_subject<'a, I>(role: &str, profile: &str, values: Option<I>) -> RequestedSubject
+where
+    I: IntoIterator<Item = (&'a str, &'a str)>,
+{
+    RequestedSubject {
+        role: role.to_owned(),
+        selector: RequestedSelector {
+            profile: profile.to_owned(),
+            values: values.map(|entries| {
+                entries
+                    .into_iter()
+                    .map(|(name, value)| (name.to_owned(), SelectorValue::String(value.to_owned())))
+                    .collect()
+            }),
+        },
+    }
+}
+
+/// Independent policy expectations for one live response. The identity,
+/// requirement, purpose, audience, revision, and nonce expectations come from
+/// the bundle and the retained request; the subject-binding and output-shape
+/// expectations are lifted from the response as an accepted first
+/// transaction, exactly as a relying party stores them for later checks.
+fn verification_policy(
+    runtime: &EvidenceRuntime,
+    request: &EvidenceRequest,
+    serialized_jws: &[u8],
+) -> EvidenceVerificationPolicy {
+    let requirement = runtime
+        .bundle()
+        .config
+        .requirements
+        .iter()
+        .find(|candidate| candidate.id == request.requirement)
+        .expect("requirement is loaded");
+    let jws: FlattenedJws = serde_json::from_slice(serialized_jws).expect("flattened JWS is JSON");
+    let payload = URL_SAFE_NO_PAD
+        .decode(jws.payload)
+        .expect("flattened JWS payload is base64url");
+    let evidence: Evidence =
+        serde_json::from_slice(&payload).expect("Evidence payload parses for expectations");
+    let mut policy = EvidenceVerificationPolicy::from_accepted_transaction(
+        &evidence,
+        &request.request_nonce,
+        Duration::from_secs(48 * 60 * 60),
+        Utc::now(),
+        Duration::from_secs(30),
+    );
+    policy.issued_by = runtime.bundle().config.issuer.id.clone();
+    policy.provided_by = runtime.bundle().config.service.provider_id.clone();
+    policy.requirement = request.requirement.clone();
+    policy.evidence_type = requirement.evidence_type.clone();
+    policy.purpose = request.purpose.clone();
+    policy.audience = EVIDENCE_AUDIENCE.to_owned();
+    policy.configuration_revision = runtime.bundle().revision().to_owned();
+    policy
+}
+
+fn assert_minimized_payload(serialized_jws: &[u8]) {
+    let jws: FlattenedJws = serde_json::from_slice(serialized_jws).expect("flattened JWS is JSON");
+    let payload = URL_SAFE_NO_PAD
+        .decode(jws.payload)
+        .expect("flattened JWS payload is base64url");
+    let text = String::from_utf8(payload).expect("Evidence payload is UTF-8 JSON");
+    for canary in privacy_canaries() {
+        assert!(
+            !text.contains(canary),
+            "signed JWS retained protected material"
+        );
+    }
+    for forbidden_field in [
+        "record_reference",
+        "given_name",
+        "family_name",
+        "birth_date",
+        "licence_reference",
+        "registry_region",
+        "role_resolution",
+        "relationship_status",
+        "date_of_birth",
+        "official_residence_code",
+        "historical_states",
+        "returned_child_reference",
+        "parent_references",
+        "reference_namespace",
+        "relationship_set_contract",
+        "relationship_set_complete",
+        "person_reference",
+    ] {
+        assert!(!text.contains(forbidden_field));
+    }
+}
+
+fn privacy_canaries() -> &'static [&'static str] {
+    &[
+        "Amina",
+        "Binta",
+        "Diallo",
+        "Other",
+        "Subject",
+        "Amadou",
+        "Keita",
+        "2000-01-01",
+        "1970-06-15",
+        "1971-01-01",
+        "1974-02-11",
+        "synthetic-child-record-001",
+        "synthetic-other-child-record",
+        "synthetic-residence-record-001",
+        "synthetic-licence-001",
+        "synthetic-parentage-grant-001",
+        "synthetic-parent-reference-001",
+        "synthetic-parent-reference-002",
+        "synthetic-non-parent-reference-003",
+        "synthetic-substitute-reference",
+        "PrivacyCanary",
+        "source-bearer-canary",
+        "source-user-canary",
+        "source-password-canary",
+        "audit-hash-secret-canary-32-bytes-minimum",
+        "subject-binding-secret-canary-32-bytes-minimum",
+    ]
+}
+
+fn fixture_root() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("../../products/evidence/fixtures/acceptance/all-definitions")
+}
+
+fn rewrite_deployment_values(bundle_root: &Path, source_origin: &str) {
+    let path = bundle_root.join("evidence.yaml");
+    let mut text = fs::read_to_string(&path).expect("copied configuration is readable");
+    replace_exact(&mut text, "https://source.invalid", source_origin, 4);
+    replace_exact(
+        &mut text,
+        "fixture-key-2026-01",
+        "acceptance-evidence-key",
+        1,
+    );
+    fs::write(path, text).expect("deployment-only fixture rewrite succeeds");
+}
+
+/// The deployment ceilings a prepared fixture runs under.
+///
+/// Every field here is a production-meaningful default in the acceptance
+/// bundle or runtime file. They exist as a struct only so a throughput
+/// measurement can lift the ones that would otherwise be the thing measured;
+/// the lifted values are measurement scaffolding and are not a recommended
+/// deployment posture.
+struct FixtureCeilings {
+    maximum_concurrent_requests: u32,
+    audit_maximum_file_bytes: u64,
+    requests_per_principal_per_minute: u64,
+    burst_per_principal: u64,
+    source_concurrency_limit: u16,
+}
+
+impl FixtureCeilings {
+    /// The values the tracked acceptance bundle and the acceptance runtime
+    /// file carry. Every existing fixture runs under exactly these.
+    fn deployment_defaults() -> Self {
+        Self {
+            maximum_concurrent_requests: 64,
+            audit_maximum_file_bytes: 10_485_760,
+            requests_per_principal_per_minute: 60,
+            burst_per_principal: 10,
+            source_concurrency_limit: 8,
+        }
+    }
+}
+
+/// Rewrite the copied bundle's rate limits and per-source outbound concurrency
+/// to `ceilings`. The tracked fixture under `products/evidence/fixtures` is
+/// never touched: only the temporary copy is, and only before it is sealed
+/// read-only.
+fn apply_fixture_ceilings(bundle_root: &Path, ceilings: &FixtureCeilings) {
+    let path = bundle_root.join("evidence.yaml");
+    let mut text = fs::read_to_string(&path).expect("copied configuration is readable");
+    replace_exact(
+        &mut text,
+        "requestsPerPrincipalPerMinute: 60",
+        &format!(
+            "requestsPerPrincipalPerMinute: {}",
+            ceilings.requests_per_principal_per_minute
+        ),
+        1,
+    );
+    replace_exact(
+        &mut text,
+        "burstPerPrincipal: 10",
+        &format!("burstPerPrincipal: {}", ceilings.burst_per_principal),
+        1,
+    );
+    replace_exact(
+        &mut text,
+        "concurrencyLimit: 8",
+        &format!("concurrencyLimit: {}", ceilings.source_concurrency_limit),
+        4,
+    );
+    fs::write(path, text).expect("deployment-only ceiling rewrite succeeds");
+}
+
+fn write_runtime_config(
+    runtime_path: &Path,
+    bundle_root: &Path,
+    secret_root: &Path,
+    audit_path: &Path,
+    ceilings: &FixtureCeilings,
+) {
+    let document = format!(
+        r#"version: 1
+bundleDirectory: {}
+listener:
+  bindHost: 127.0.0.1
+  port: 8080
+  tlsTermination: operator-controlled-upstream
+  trustProxyIdentityHeaders: false
+  maximumRequestBytes: 65536
+  maximumConcurrentRequests: {}
+  requestTimeoutMilliseconds: 10000
+  shutdownGraceMilliseconds: 30000
+secretProviders:
+  file:
+    root: {}
+auditStorage:
+  path: {}
+  maximumFileBytes: {}
+outboundTls:
+  systemRoots: true
+  trustProfiles: {{}}
+"#,
+        bundle_root.display(),
+        ceilings.maximum_concurrent_requests,
+        secret_root.display(),
+        audit_path.display(),
+        ceilings.audit_maximum_file_bytes,
+    );
+    fs::write(runtime_path, document).expect("immutable runtime configuration is written");
+}
+
+fn replace_exact(text: &mut String, from: &str, to: &str, expected: usize) {
+    assert_eq!(
+        text.matches(from).count(),
+        expected,
+        "fixture drift for {from}"
+    );
+    *text = text.replace(from, to);
+}
+
+fn write_secret(root: &Path, name: &str, value: &str) {
+    let path = root.join(name);
+    fs::write(&path, value.as_bytes()).expect("synthetic secret is written");
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt as _;
+        fs::set_permissions(path, fs::Permissions::from_mode(0o600))
+            .expect("synthetic secret is owner-only");
+    }
+}
+
+fn copy_tree(source: &Path, target: &Path) {
+    for entry in fs::read_dir(source).expect("acceptance fixture is readable") {
+        let entry = entry.expect("fixture directory entry is readable");
+        let destination = target.join(entry.file_name());
+        if entry
+            .file_type()
+            .expect("fixture file type is readable")
+            .is_dir()
+        {
+            fs::create_dir(&destination).expect("fixture directory is copied");
+            copy_tree(&entry.path(), &destination);
+        } else {
+            fs::copy(entry.path(), destination).expect("fixture file is copied");
+        }
+    }
+}
+
+#[cfg(unix)]
+fn make_file_read_only(path: &Path) {
+    use std::os::unix::fs::PermissionsExt as _;
+
+    fs::set_permissions(path, fs::Permissions::from_mode(0o444))
+        .expect("runtime configuration is immutable");
+}
+
+#[cfg(unix)]
+fn make_file_writable(path: &Path) {
+    use std::os::unix::fs::PermissionsExt as _;
+
+    fs::set_permissions(path, fs::Permissions::from_mode(0o644))
+        .expect("runtime configuration becomes writable for mutation test");
+}
+
+#[cfg(not(unix))]
+fn make_file_read_only(path: &Path) {
+    let mut permissions = fs::metadata(path).expect("runtime metadata").permissions();
+    permissions.set_readonly(true);
+    fs::set_permissions(path, permissions).expect("runtime configuration is immutable");
+}
+
+#[cfg(not(unix))]
+fn make_file_writable(path: &Path) {
+    let mut permissions = fs::metadata(path).expect("runtime metadata").permissions();
+    permissions.set_readonly(false);
+    fs::set_permissions(path, permissions)
+        .expect("runtime configuration becomes writable for mutation test");
+}
+
+#[cfg(unix)]
+fn make_read_only(path: &Path) {
+    use std::os::unix::fs::PermissionsExt as _;
+
+    for entry in fs::read_dir(path).expect("copied bundle is readable") {
+        let entry = entry.expect("bundle directory entry is readable");
+        let child = entry.path();
+        if entry
+            .file_type()
+            .expect("bundle file type is readable")
+            .is_dir()
+        {
+            make_read_only(&child);
+            fs::set_permissions(&child, fs::Permissions::from_mode(0o555))
+                .expect("bundle directory is immutable");
+        } else {
+            fs::set_permissions(&child, fs::Permissions::from_mode(0o444))
+                .expect("bundle file is immutable");
+        }
+    }
+    fs::set_permissions(path, fs::Permissions::from_mode(0o555)).expect("bundle root is immutable");
+}
+
+#[cfg(unix)]
+fn make_writable(path: &Path) {
+    use std::os::unix::fs::PermissionsExt as _;
+
+    fs::set_permissions(path, fs::Permissions::from_mode(0o755))
+        .expect("bundle directory becomes writable for mutation test");
+    for entry in fs::read_dir(path).expect("captured bundle remains readable") {
+        let entry = entry.expect("captured bundle entry remains readable");
+        let child = entry.path();
+        if entry
+            .file_type()
+            .expect("captured bundle file type remains readable")
+            .is_dir()
+        {
+            make_writable(&child);
+        } else {
+            fs::set_permissions(child, fs::Permissions::from_mode(0o644))
+                .expect("bundle file becomes writable for mutation test");
+        }
+    }
+}
+
+#[cfg(not(unix))]
+fn make_read_only(path: &Path) {
+    for entry in fs::read_dir(path).expect("copied bundle is readable") {
+        let entry = entry.expect("bundle directory entry is readable");
+        let child = entry.path();
+        if entry
+            .file_type()
+            .expect("bundle file type is readable")
+            .is_dir()
+        {
+            make_read_only(&child);
+        } else {
+            let mut permissions = fs::metadata(&child).expect("bundle metadata").permissions();
+            permissions.set_readonly(true);
+            fs::set_permissions(child, permissions).expect("bundle file is immutable");
+        }
+    }
+}
+
+#[cfg(not(unix))]
+fn make_writable(path: &Path) {
+    for entry in fs::read_dir(path).expect("captured bundle remains readable") {
+        let entry = entry.expect("captured bundle entry remains readable");
+        let child = entry.path();
+        if entry
+            .file_type()
+            .expect("captured bundle file type remains readable")
+            .is_dir()
+        {
+            make_writable(&child);
+        } else {
+            let mut permissions = fs::metadata(&child)
+                .expect("captured bundle metadata remains readable")
+                .permissions();
+            permissions.set_readonly(false);
+            fs::set_permissions(child, permissions)
+                .expect("bundle file becomes writable for mutation test");
+        }
+    }
+}
+
+// Concurrency and throughput harness.
+
+/// Simultaneous virtual clients. Held below the fixture listener's 64 admitted
+/// request slots so admission queueing never reads as a throughput limit.
+const LOAD_CONCURRENCY: usize = 32;
+
+/// Requests issued by one measured soak window.
+const SOAK_REQUESTS: usize = 512;
+
+/// Direct source calls used to establish the mock-source floor.
+const SOURCE_PROBE_REQUESTS: usize = 256;
+
+/// Appends used to measure the audit sink ceiling on the same filesystem.
+const AUDIT_PROBE_APPENDS: usize = 200;
+
+/// Probe ceiling. The probe writes a small fraction of this.
+const AUDIT_PROBE_MAXIMUM_BYTES: u64 = 64 * 1024 * 1024;
+
+/// The acceptance runtime behind a real TCP listener, driven by real HTTP
+/// clients. Load is applied over sockets rather than through an in-process
+/// router so admission, the detached evaluation task, and connection handling
+/// are all measured.
+struct LoadFixture {
+    _temporary: TempDir,
+    _source: MockServer,
+    source_origin: String,
+    audit_path: PathBuf,
+    probe_directory: PathBuf,
+    address: std::net::SocketAddr,
+    client: reqwest::Client,
+    shutdown: tokio::sync::oneshot::Sender<()>,
+    serving: tokio::task::JoinHandle<std::io::Result<()>>,
+    runtime: Arc<EvidenceRuntime>,
+}
+
+/// One measured load window.
+struct LoadOutcomes {
+    statuses: Vec<u16>,
+    latencies: Vec<Duration>,
+    elapsed: Duration,
+}
+
+impl LoadOutcomes {
+    fn released(&self) -> usize {
+        self.statuses
+            .iter()
+            .filter(|status| **status == 200)
+            .count()
+    }
+
+    fn status_counts(&self) -> BTreeMap<u16, usize> {
+        let mut counts = BTreeMap::new();
+        for status in &self.statuses {
+            *counts.entry(*status).or_insert(0_usize) += 1;
+        }
+        counts
+    }
+
+    /// Nearest-rank p50, p95, and p99 over the whole window.
+    fn latency_percentiles(&self) -> (Duration, Duration, Duration) {
+        if self.latencies.is_empty() {
+            return (Duration::ZERO, Duration::ZERO, Duration::ZERO);
+        }
+        let mut sorted = self.latencies.clone();
+        sorted.sort_unstable();
+        let at = |fraction: f64| {
+            let rank = (fraction * sorted.len() as f64).ceil() as usize;
+            sorted[rank.clamp(1, sorted.len()) - 1]
+        };
+        (at(0.50), at(0.95), at(0.99))
+    }
+}
+
+impl LoadFixture {
+    async fn start() -> Self {
+        let prepared = prepare_acceptance("subject-binding-secret-canary-32-bytes-minimum").await;
+        mount_unmetered_adult_source(&prepared.server).await;
+        let runtime = Arc::new(
+            EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+                .await
+                .expect("the load fixture runtime initializes"),
+        );
+
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("the load listener binds");
+        let address = listener
+            .local_addr()
+            .expect("the load listener has an address");
+        let (shutdown, shutdown_rx) = tokio::sync::oneshot::channel();
+        let serving = tokio::spawn({
+            let runtime = Arc::clone(&runtime);
+            async move {
+                serve_listener_for_test(runtime, listener, async move {
+                    let _ = shutdown_rx.await;
+                })
+                .await
+            }
+        });
+
+        let client = reqwest::Client::builder()
+            .pool_max_idle_per_host(LOAD_CONCURRENCY)
+            .timeout(Duration::from_secs(30))
+            .build()
+            .expect("the load client builds");
+
+        Self {
+            source_origin: prepared.server.uri(),
+            probe_directory: prepared
+                .audit_path
+                .parent()
+                .expect("the audit path has a parent")
+                .to_path_buf(),
+            audit_path: prepared.audit_path,
+            _temporary: prepared.temporary,
+            _source: prepared.server,
+            address,
+            client,
+            shutdown,
+            serving,
+            runtime,
+        }
+    }
+
+    /// Issue `total` adult-status requests across `concurrency` clients.
+    ///
+    /// Each request carries its own principal so the per-principal token bucket
+    /// never becomes the thing under measurement. Tokens are signed up front,
+    /// outside the timed window.
+    async fn run(&self, total: usize, concurrency: usize) -> LoadOutcomes {
+        let tokens: Arc<Vec<String>> = Arc::new(
+            (0..total)
+                .map(|index| access_token_for(&format!("load-principal-{index:06}"), None))
+                .collect(),
+        );
+        let body =
+            Arc::new(serde_json::to_vec(&adult_request()).expect("the load request serializes"));
+        let endpoint = Arc::new(format!("http://{}/v1/evidence", self.address));
+
+        let started = Instant::now();
+        let mut workers = Vec::with_capacity(concurrency);
+        for worker in 0..concurrency {
+            let client = self.client.clone();
+            let tokens = Arc::clone(&tokens);
+            let body = Arc::clone(&body);
+            let endpoint = Arc::clone(&endpoint);
+            workers.push(tokio::spawn(async move {
+                let mut results = Vec::new();
+                let mut index = worker;
+                while index < tokens.len() {
+                    let attempt = Instant::now();
+                    let response = client
+                        .post(endpoint.as_str())
+                        .header("authorization", format!("Bearer {}", tokens[index]))
+                        .header("content-type", "application/json")
+                        .body(body.as_ref().clone())
+                        .send()
+                        .await
+                        .expect("the load request completes");
+                    let status = response.status().as_u16();
+                    // Drain the body so the connection returns to the pool.
+                    let _ = response
+                        .bytes()
+                        .await
+                        .expect("the load response body reads");
+                    results.push((status, attempt.elapsed()));
+                    index += concurrency;
+                }
+                results
+            }));
+        }
+
+        let mut statuses = Vec::with_capacity(total);
+        let mut latencies = Vec::with_capacity(total);
+        for worker in workers {
+            for (status, latency) in worker.await.expect("a load worker completes") {
+                statuses.push(status);
+                latencies.push(latency);
+            }
+        }
+        LoadOutcomes {
+            statuses,
+            latencies,
+            elapsed: started.elapsed(),
+        }
+    }
+
+    /// Call the mock source directly to establish the harness floor: no result
+    /// above this rate is attributable to Evidence.
+    async fn measure_source_rate(&self, requests: usize) -> f64 {
+        let endpoint = Arc::new(format!("{}/v1/facts", self.source_origin));
+        let started = Instant::now();
+        let mut workers = Vec::with_capacity(LOAD_CONCURRENCY);
+        for worker in 0..LOAD_CONCURRENCY {
+            let client = self.client.clone();
+            let endpoint = Arc::clone(&endpoint);
+            workers.push(tokio::spawn(async move {
+                let mut index = worker;
+                while index < requests {
+                    let response = client
+                        .post(endpoint.as_str())
+                        .header("accept", "application/json")
+                        .header("authorization", format!("Bearer {BEARER}"))
+                        .json(&adult_source_request())
+                        .send()
+                        .await
+                        .expect("the source probe request completes");
+                    let _ = response.bytes().await.expect("the source probe body reads");
+                    index += LOAD_CONCURRENCY;
+                }
+            }));
+        }
+        for worker in workers {
+            worker.await.expect("a source probe worker completes");
+        }
+        requests as f64 / started.elapsed().as_secs_f64()
+    }
+
+    /// Append through a real keyed sink on the same filesystem as the runtime's
+    /// own audit file. Appends are serialized by the chain, so this is a
+    /// sequential measurement by construction, not by choice of harness.
+    async fn measure_audit_append_rate(&self, appends: usize) -> f64 {
+        let path = self.probe_directory.join("audit-throughput-probe.jsonl");
+        let log = EvidenceAuditLog::initialize(
+            &path,
+            AUDIT_PROBE_MAXIMUM_BYTES,
+            b"audit-hash-secret-canary-32-bytes-minimum".to_vec(),
+            1,
+        )
+        .await
+        .expect("the audit throughput probe initializes");
+
+        let started = Instant::now();
+        for index in 0..appends {
+            log.append(audit_probe_event(index))
+                .await
+                .expect("the audit throughput probe appends");
+        }
+        appends as f64 / started.elapsed().as_secs_f64()
+    }
+
+    /// Stop the listener, drain detached evaluations, and return the audit file.
+    async fn shutdown(self) -> String {
+        let _ = self.shutdown.send(());
+        self.serving
+            .await
+            .expect("the load listener task completes")
+            .expect("the load listener shuts down cleanly");
+        drop(self.runtime);
+        fs::read_to_string(&self.audit_path).expect("the load audit file is readable")
+    }
+}
+
+/// The adult source mock without a call-count expectation, so one mount serves
+/// a whole load window.
+async fn mount_unmetered_adult_source(server: &MockServer) {
+    Mock::given(method("POST"))
+        .and(path("/v1/facts"))
+        .and(header("accept", "application/json"))
+        .and(header("authorization", format!("Bearer {BEARER}").as_str()))
+        .and(body_json(adult_source_request()))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "total": 1,
+            "date_of_birth": "2000-01-01"
+        })))
+        .mount(server)
+        .await;
+}
+
+fn adult_source_request() -> Value {
+    json!({
+        "lookup": {
+            "given_name": "Amina",
+            "family_name": "Diallo",
+            "birth_date": "2000-01-01"
+        },
+        "fields": ["date_of_birth"],
+        "limit": 2
+    })
+}
+
+/// A valid access-attempt event shaped like the ones the runtime writes, so the
+/// probe measures the real serialization, hashing, and fsync path.
+fn audit_probe_event(index: usize) -> EvidenceAuditEvent {
+    EvidenceAuditEvent::new(
+        AssuranceProfile::EvidenceGrade,
+        format!("audit-throughput-probe-{index:012}"),
+        AuditPhase::AccessAttempt,
+        "urn:example:fixture:requirement:adult-status:v1".to_owned(),
+        "audit-throughput-probe".to_owned(),
+        "fixture-eligibility".to_owned(),
+        "hmac-sha256:v1:audit-throughput-probe-requester".to_owned(),
+        AuditAuthority {
+            kind: AuditAuthorityKind::Statutory,
+            grant_pseudonym: None,
+        },
+        vec![AuditSubject {
+            role: "subject".to_owned(),
+            selector_profile: "person-demographics-v1".to_owned(),
+            selector_bundle_pseudonym: None,
+        }],
+        ResponseProtection::Signed,
+        AuditDecision::Authorized,
+        0,
+    )
+}
+
+fn acceptance_audit_hasher() -> AuditChainHasher {
+    AuditChainHasher::keyed(
+        AuditHashSecret::new(b"audit-hash-secret-canary-32-bytes-minimum".to_vec())
+            .expect("the acceptance audit secret is accepted"),
+    )
+}
+
+/// Distinct evidence identities across every disclosure-release record.
+fn released_evidence_ids(audit: &str) -> BTreeSet<String> {
+    audit
+        .lines()
+        .filter(|line| !line.trim().is_empty())
+        .map(|line| serde_json::from_str::<Value>(line).expect("an audit line is JSON"))
+        .filter_map(|envelope| {
+            envelope
+                .get("record")?
+                .get("evidenceId")?
+                .as_str()
+                .map(str::to_owned)
+        })
+        .collect()
+}
+
+// Sustained end-to-end throughput measurement.
+
+/// Requests offered simultaneously by the sustained driver.
+///
+/// Two durable audit appends sit on every request's critical path, and the
+/// audit sink commits in groups: appends that arrive while a durable write is
+/// in flight join the next batch instead of each paying an `fsync`. Its rate
+/// therefore rises with the number of concurrent appenders and collapses
+/// toward one `fsync` per append when only a few are in flight, so the offered
+/// concurrency has to keep batches full. 128 also leaves Little's law room:
+/// sustaining 1000 requests per second needs roughly `1000 * latency_seconds`
+/// requests in flight, so 128 covers per-request latencies up to about 128 ms.
+const SUSTAINED_CONCURRENCY: usize = 128;
+
+/// The measured window. Ten seconds is long enough for group-commit batching,
+/// connection reuse, and the verifier and source caches to reach steady state,
+/// and short enough that the check stays runnable on demand rather than
+/// becoming a nightly job.
+const SUSTAINED_WINDOW: Duration = Duration::from_secs(10);
+
+/// An unmeasured window that absorbs first-request script compilation, lazy
+/// initialization, connection establishment, and audit file growth.
+const SUSTAINED_WARMUP: Duration = Duration::from_secs(3);
+
+/// The end-to-end rate this check exists to prove, in requests per second.
+const SUSTAINED_TARGET_RPS: f64 = 1000.0;
+
+/// How far the constant source's own ceiling must sit above the Evidence
+/// result before the run is read as a measurement of Evidence.
+///
+/// A source held at a fraction `f` of its own ceiling contributes about `f` of
+/// the saturation, so a factor of five keeps the source below 20 percent
+/// utilization while the service under test is at 100 percent. Below this
+/// factor the harness is close enough to the result to be part of what was
+/// measured, and the run is reported as inconclusive rather than as a pass or
+/// a failure.
+const SUSTAINED_SOURCE_HEADROOM: f64 = 5.0;
+
+/// The one constant body the sustained source returns. It satisfies the
+/// projection and fact schema the acceptance bundle declares for that source.
+const CONSTANT_SOURCE_BODY: &str = r#"{"total":1,"date_of_birth":"2000-01-01"}"#;
+
+/// The ceilings the sustained fixture runs under.
+///
+/// Each lifted value is a production-meaningful default that would otherwise
+/// become the thing measured, not a recommended deployment posture:
+///
+/// - `requestsPerPrincipalPerMinute: 60` with `burstPerPrincipal: 10` is one
+///   request per second per principal, so an unlifted run measures the rate
+///   limiter returning `rate_limited`.
+/// - `maximumConcurrentRequests: 64` admits fewer requests than this driver
+///   offers, so an unlifted run measures admission queueing.
+/// - `concurrencyLimit: 8` per source caps outbound calls in flight, so an
+///   unlifted run measures the source semaphore.
+/// - `maximumFileBytes: 10485760` rotates the audit segment several times
+///   inside a measured window, so an unlifted run measures segment rotation.
+///
+/// Deployments should keep the tracked defaults and tune from real traffic.
+fn sustained_ceilings() -> FixtureCeilings {
+    FixtureCeilings {
+        maximum_concurrent_requests: 512,
+        audit_maximum_file_bytes: 1_073_741_824,
+        requests_per_principal_per_minute: 1_000_000,
+        burst_per_principal: 100_000,
+        source_concurrency_limit: 256,
+    }
+}
+
+/// The upstream source used for sustained measurement: one `axum` handler
+/// returning a constant JSON body over a real socket.
+///
+/// A matching mock server puts request matching, shared-state locking, and
+/// per-call allocation on the measured path, and a rate measured through one
+/// describes the harness rather than Evidence. This handler matches nothing,
+/// locks nothing, and allocates only its response.
+struct ConstantSource {
+    origin: String,
+    shutdown: tokio::sync::oneshot::Sender<()>,
+    serving: tokio::task::JoinHandle<std::io::Result<()>>,
+}
+
+async fn start_constant_source() -> ConstantSource {
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("the constant source listener binds");
+    let address = listener
+        .local_addr()
+        .expect("the constant source listener has an address");
+    let router = axum::Router::new().route(
+        "/v1/facts",
+        axum::routing::post(|| async {
+            // Built explicitly so the response carries exactly one
+            // `Content-Type`, which is what the source client requires.
+            axum::response::Response::builder()
+                .header(axum::http::header::CONTENT_TYPE, "application/json")
+                .body(Body::from(CONSTANT_SOURCE_BODY))
+                .expect("the constant source response builds")
+        }),
+    );
+    let (shutdown, shutdown_rx) = tokio::sync::oneshot::channel();
+    let serving = tokio::spawn(async move {
+        axum::serve(listener, router)
+            .with_graceful_shutdown(async move {
+                let _ = shutdown_rx.await;
+            })
+            .await
+    });
+    ConstantSource {
+        origin: format!("http://{address}"),
+        shutdown,
+        serving,
+    }
+}
+
+/// One flat-out window against one endpoint. Every attempt lands in exactly
+/// one of `statuses` or `transport_failures`, so nothing is dropped.
+#[derive(Default)]
+struct SustainedOutcome {
+    statuses: BTreeMap<u16, usize>,
+    latencies: Vec<Duration>,
+    transport_failures: Vec<String>,
+    elapsed: Duration,
+}
+
+impl SustainedOutcome {
+    fn attempted(&self) -> usize {
+        self.latencies.len() + self.transport_failures.len()
+    }
+
+    fn released(&self) -> usize {
+        self.statuses.get(&200).copied().unwrap_or_default()
+    }
+
+    /// Attempts that did not return 200, including transport failures.
+    fn unexpected(&self) -> usize {
+        self.attempted() - self.released()
+    }
+
+    fn rate(&self) -> f64 {
+        if self.elapsed.is_zero() {
+            return 0.0;
+        }
+        self.released() as f64 / self.elapsed.as_secs_f64()
+    }
+
+    /// Nearest-rank p50, p95, and p99 over the whole window.
+    fn latency_percentiles(&self) -> (Duration, Duration, Duration) {
+        if self.latencies.is_empty() {
+            return (Duration::ZERO, Duration::ZERO, Duration::ZERO);
+        }
+        let mut sorted = self.latencies.clone();
+        sorted.sort_unstable();
+        let at = |fraction: f64| {
+            let rank = (fraction * sorted.len() as f64).ceil() as usize;
+            sorted[rank.clamp(1, sorted.len()) - 1]
+        };
+        (at(0.50), at(0.95), at(0.99))
+    }
+
+    /// A short, operator-readable account of everything that was not a 200.
+    fn failure_summary(&self) -> String {
+        let statuses: Vec<String> = self
+            .statuses
+            .iter()
+            .filter(|(status, _)| **status != 200)
+            .map(|(status, count)| format!("{status} x{count}"))
+            .collect();
+        let mut summary = if statuses.is_empty() {
+            "no non-2xx statuses".to_owned()
+        } else {
+            statuses.join(", ")
+        };
+        if let Some(first) = self.transport_failures.first() {
+            summary.push_str(&format!(
+                "; {} transport failures, first: {first}",
+                self.transport_failures.len()
+            ));
+        }
+        summary
+    }
+}
+
+/// Issue requests flat out for `window` across `SUSTAINED_CONCURRENCY` closed
+/// loop workers. Worker `n` presents `authorizations[n]`, so the caller decides
+/// whether load spreads across principals or concentrates on one.
+///
+/// Both the service and the constant source are driven through this function
+/// with the same client, worker count, header set, and window, so the two
+/// reported rates are comparable.
+async fn drive_flat_out(
+    client: &reqwest::Client,
+    endpoint: &str,
+    body: &bytes::Bytes,
+    authorizations: &[String],
+    window: Duration,
+) -> SustainedOutcome {
+    assert_eq!(
+        authorizations.len(),
+        SUSTAINED_CONCURRENCY,
+        "one authorization per worker"
+    );
+    let endpoint = Arc::new(endpoint.to_owned());
+    let started = Instant::now();
+    let deadline = started + window;
+    let mut workers = Vec::with_capacity(SUSTAINED_CONCURRENCY);
+    for authorization in authorizations {
+        let client = client.clone();
+        let endpoint = Arc::clone(&endpoint);
+        let body = body.clone();
+        let authorization = authorization.clone();
+        workers.push(tokio::spawn(async move {
+            let mut attempts: Vec<Result<(u16, Duration), String>> = Vec::new();
+            while Instant::now() < deadline {
+                let issued = Instant::now();
+                let sent = client
+                    .post(endpoint.as_str())
+                    .header("authorization", authorization.as_str())
+                    .header("content-type", "application/json")
+                    .body(body.clone())
+                    .send()
+                    .await;
+                attempts.push(match sent {
+                    // Draining the body returns the connection to the pool. A
+                    // body that fails to arrive is a failed request, not a
+                    // successful one with a footnote.
+                    Ok(response) => {
+                        let status = response.status().as_u16();
+                        match response.bytes().await {
+                            Ok(_) => Ok((status, issued.elapsed())),
+                            Err(error) => Err(error.to_string()),
+                        }
+                    }
+                    Err(error) => Err(error.to_string()),
+                });
+            }
+            attempts
+        }));
+    }
+
+    let mut outcome = SustainedOutcome::default();
+    for worker in workers {
+        for attempt in worker.await.expect("a sustained load worker completes") {
+            match attempt {
+                Ok((status, latency)) => {
+                    *outcome.statuses.entry(status).or_default() += 1;
+                    outcome.latencies.push(latency);
+                }
+                Err(failure) => outcome.transport_failures.push(failure),
+            }
+        }
+    }
+    outcome.elapsed = started.elapsed();
+    outcome
+}
+
+/// The acceptance runtime behind a real TCP listener, with a constant
+/// in-process upstream source, driven by a real HTTP client over sockets.
+struct SustainedFixture {
+    _temporary: TempDir,
+    source: ConstantSource,
+    address: std::net::SocketAddr,
+    client: reqwest::Client,
+    /// One access token per worker, signed once outside every measured window.
+    authorizations: Vec<String>,
+    shutdown: tokio::sync::oneshot::Sender<()>,
+    serving: tokio::task::JoinHandle<std::io::Result<()>>,
+    runtime: Arc<EvidenceRuntime>,
+    audit_path: PathBuf,
+}
+
+impl SustainedFixture {
+    async fn start() -> Self {
+        let source = start_constant_source().await;
+        let prepared = prepare_fixture(
+            "subject-binding-secret-canary-32-bytes-minimum",
+            &source.origin,
+            &sustained_ceilings(),
+        );
+        let runtime = Arc::new(
+            EvidenceRuntime::initialize_with_authenticator(&prepared.runtime_path, authenticator())
+                .await
+                .expect("the sustained load runtime initializes"),
+        );
+
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("the sustained load listener binds");
+        let address = listener
+            .local_addr()
+            .expect("the sustained load listener has an address");
+        let (shutdown, shutdown_rx) = tokio::sync::oneshot::channel();
+        let serving = tokio::spawn({
+            let runtime = Arc::clone(&runtime);
+            async move {
+                serve_listener_for_test(runtime, listener, async move {
+                    let _ = shutdown_rx.await;
+                })
+                .await
+            }
+        });
+
+        let client = reqwest::Client::builder()
+            .pool_max_idle_per_host(SUSTAINED_CONCURRENCY)
+            .no_proxy()
+            .timeout(Duration::from_secs(30))
+            .build()
+            .expect("the sustained load client builds");
+
+        // One principal per worker keeps the rate limiter's tracked key set
+        // small and its per-check pruning cheap, so neither the token bucket
+        // nor its map becomes the thing measured.
+        let authorizations = (0..SUSTAINED_CONCURRENCY)
+            .map(|worker| {
+                format!(
+                    "Bearer {}",
+                    access_token_for(&format!("sustained-principal-{worker:04}"), None)
+                )
+            })
+            .collect();
+
+        Self {
+            _temporary: prepared.temporary,
+            source,
+            address,
+            client,
+            authorizations,
+            shutdown,
+            serving,
+            runtime,
+            audit_path: prepared.audit_path,
+        }
+    }
+
+    /// Drive the whole Evidence request path for `window`.
+    async fn drive_service(&self, window: Duration) -> SustainedOutcome {
+        let body = bytes::Bytes::from(
+            serde_json::to_vec(&adult_request()).expect("the sustained request serializes"),
+        );
+        drive_flat_out(
+            &self.client,
+            &format!("http://{}/v1/evidence", self.address),
+            &body,
+            &self.authorizations,
+            window,
+        )
+        .await
+    }
+
+    /// Drive the constant source directly to establish the harness ceiling the
+    /// Evidence result has to sit well below.
+    ///
+    /// The probe opens its own connections and gets no warm-up, so it
+    /// understates the source. That is the safe direction: it can only shrink
+    /// the reported headroom, never inflate it.
+    async fn drive_source(&self, window: Duration) -> SustainedOutcome {
+        let body = bytes::Bytes::from(
+            serde_json::to_vec(&adult_source_request()).expect("the probe body serializes"),
+        );
+        drive_flat_out(
+            &self.client,
+            &format!("{}/v1/facts", self.source.origin),
+            &body,
+            &self.authorizations,
+            window,
+        )
+        .await
+    }
+
+    /// Stop the listener and the source, drain detached evaluations, and return
+    /// the durable audit file.
+    async fn shutdown(self) -> String {
+        let _ = self.shutdown.send(());
+        self.serving
+            .await
+            .expect("the sustained listener task completes")
+            .expect("the sustained listener shuts down cleanly");
+        let _ = self.source.shutdown.send(());
+        self.source
+            .serving
+            .await
+            .expect("the constant source task completes")
+            .expect("the constant source shuts down cleanly");
+        drop(self.runtime);
+        fs::read_to_string(&self.audit_path).expect("the sustained audit file is readable")
+    }
+}
+
+/// Sustain 1000 end-to-end requests per second through the whole request path.
+///
+/// Every measured request runs token verification, rate limiting, Rhai request
+/// preparation, one outbound source call, Rhai extraction, evidence
+/// construction, Ed25519 signing, and two durable audit appends, over real
+/// sockets against the real router. At 1000 requests per second that is 2000
+/// audit appends per second.
+///
+/// The upstream source is a constant in-process handler whose own ceiling is
+/// measured in the same run, under the same client, worker count, header set,
+/// and window shape. When that ceiling is not at least
+/// `SUSTAINED_SOURCE_HEADROOM` times the Evidence result, the harness is part
+/// of what was measured and the run is reported as inconclusive rather than as
+/// a pass or a failure.
+///
+/// The target holds with and without `--release`; the recorded figures in
+/// `products/evidence/OPERATOR-CONTRACT.md` come from the optimized build.
+///
+/// ```text
+/// cargo test --release -p registry-evidence --lib -- --ignored --nocapture sustained_load_holds_one_thousand_requests_per_second
+/// ```
+#[tokio::test(flavor = "multi_thread")]
+#[ignore = "opt-in sustained throughput target; host-specific and long running"]
+async fn sustained_load_holds_one_thousand_requests_per_second() {
+    let fixture = SustainedFixture::start().await;
+
+    let warmup = fixture.drive_service(SUSTAINED_WARMUP).await;
+    assert_eq!(
+        warmup.unexpected(),
+        0,
+        "warm-up must already be clean; observed {}",
+        warmup.failure_summary()
+    );
+
+    let measured = fixture.drive_service(SUSTAINED_WINDOW).await;
+    let source = fixture.drive_source(SUSTAINED_WINDOW).await;
+
+    let rate = measured.rate();
+    let source_rate = source.rate();
+    let headroom = if rate > 0.0 { source_rate / rate } else { 0.0 };
+    let percentiles = measured.latency_percentiles();
+    println!(
+        "\n=== Evidence sustained throughput ===\n\
+         host                  : {} logical cores\n\
+         offered concurrency   : {SUSTAINED_CONCURRENCY} in flight, {} principals\n\
+         measured window       : {:.1}s after a {:.1}s warm-up\n\
+         \n\
+         requests released     : {} in {:.2}s\n\
+         achieved rate         : {rate:.0} rps ({:.0} audit appends/s)\n\
+         target                : {SUSTAINED_TARGET_RPS:.0} rps\n\
+         non-2xx and failures  : {} ({})\n\
+         \n\
+         latency p50           : {:.2} ms\n\
+         latency p95           : {:.2} ms\n\
+         latency p99           : {:.2} ms\n\
+         \n\
+         constant source rate  : {source_rate:.0} rps standalone, {} non-2xx and failures\n\
+         source headroom       : {headroom:.1}x over Evidence (validity floor {SUSTAINED_SOURCE_HEADROOM:.1}x)\n\
+         =====================================\n",
+        std::thread::available_parallelism().map_or(0, std::num::NonZeroUsize::get),
+        SUSTAINED_CONCURRENCY,
+        SUSTAINED_WINDOW.as_secs_f64(),
+        SUSTAINED_WARMUP.as_secs_f64(),
+        measured.released(),
+        measured.elapsed.as_secs_f64(),
+        rate * 2.0,
+        measured.unexpected(),
+        measured.failure_summary(),
+        percentiles.0.as_secs_f64() * 1000.0,
+        percentiles.1.as_secs_f64() * 1000.0,
+        percentiles.2.as_secs_f64() * 1000.0,
+        source.unexpected(),
+    );
+
+    assert_eq!(
+        measured.unexpected(),
+        0,
+        "sustained load must not shed requests; observed {}",
+        measured.failure_summary()
+    );
+    assert_eq!(
+        source.unexpected(),
+        0,
+        "the constant source probe must not shed requests; observed {}",
+        source.failure_summary()
+    );
+    assert!(
+        headroom >= SUSTAINED_SOURCE_HEADROOM,
+        "INCONCLUSIVE: the constant source sustained {source_rate:.0} rps against Evidence at \
+         {rate:.0} rps, only {headroom:.1}x. Below {SUSTAINED_SOURCE_HEADROOM:.1}x the harness is \
+         part of what was measured, so this run is neither a pass nor a failure"
+    );
+    assert!(
+        rate >= SUSTAINED_TARGET_RPS,
+        "sustained {rate:.0} rps, below the {SUSTAINED_TARGET_RPS:.0} rps target"
+    );
+
+    // Both audit appends are on the request's critical path, so a released
+    // assertion that skipped one would be a silently cheaper request.
+    let released = warmup.released() + measured.released();
+    let audit = fixture.shutdown().await;
+    assert_eq!(
+        audit.matches("\"phase\":\"access-attempt\"").count(),
+        released,
+        "one access-attempt record per released assertion"
+    );
+    assert_eq!(
+        audit.matches("\"phase\":\"disclosure-release\"").count(),
+        released,
+        "one disclosure-release record per released assertion"
+    );
+}
diff --git a/crates/registry-evidence/src/sdjwt_vc.rs b/crates/registry-evidence/src/sdjwt_vc.rs
new file mode 100644
index 000000000..8f5f5fa55
--- /dev/null
+++ b/crates/registry-evidence/src/sdjwt_vc.rs
@@ -0,0 +1,729 @@
+//! Projection of a constructed Evidence payload onto the frozen SD-JWT VC
+//! profile in `products/evidence/contracts/sd-jwt-vc-profile.yaml`, and the
+//! inverse projection used by the relying-party verifier.
+//!
+//! The projection re-derives nothing. It re-encodes the exact payload the
+//! signed-JWS format would carry: the always-disclosed claims become public
+//! JWT claims, and each supported value becomes exactly one selective
+//! disclosure keyed by its concept identifier. The inverse rebuilds that same
+//! payload so one policy engine serves both response formats.
+
+use std::collections::BTreeMap;
+
+use chrono::{DateTime, SecondsFormat, TimeZone, Utc};
+use registry_platform_crypto::PublicJwk;
+use registry_platform_sdjwt::{
+    Disclosure, HolderConfirmation, ObjectDisclosure, SdJwtIssuanceInput,
+};
+use serde::Serialize;
+use serde_json::{Map, Value};
+use thiserror::Error;
+
+use crate::{
+    model::{Evidence, HolderPublicKey},
+    EVIDENCE_SCHEMA_V1,
+};
+
+/// Claims the issuer writes itself. `status` is absent because Version 1
+/// publishes no credential status.
+const ISSUER_OWNED_CLAIMS: [&str; 10] = [
+    "iss", "sub", "iat", "exp", "vct", "id", "jti", "_sd", "_sd_alg", "cnf",
+];
+
+/// The profile's always-disclosed claims that carry Evidence members, in the
+/// sorted order the issuance input uses.
+const ALWAYS_DISCLOSED_CLAIMS: [&str; 10] = [
+    "assuranceProfile",
+    "audience",
+    "configurationRevision",
+    "issuedBy",
+    "observedAt",
+    "providedBy",
+    "purpose",
+    "requestNonce",
+    "subjects",
+    "supportsRequirement",
+];
+
+const STRUCTURED_VALUES_CLAIM: &str = "structuredValues";
+
+/// A constructed payload that cannot be projected onto the profile. Every
+/// variant is an internal invariant violation rather than caller input, except
+/// `HolderKey`, which the runtime rejects earlier and re-checks here so the
+/// unacceptable key can never reach a signature.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+pub enum SdJwtVcMappingError {
+    #[error("an evidence timestamp is not an RFC 3339 instant")]
+    Timestamp,
+    #[error("the evidence carries no role-bound subject")]
+    Subjects,
+    #[error("an evidence claim is not representable as JSON")]
+    Claim,
+    #[error("the holder public key is not an acceptable Ed25519 public JWK")]
+    HolderKey,
+    #[error("the SD-JWT VC structured projection is inconsistent with the evidence value")]
+    StructuredProjection,
+}
+
+/// Map a constructed payload and an optional holder key onto the issuance
+/// input. The public claim set is exactly the profile's always-disclosed list
+/// minus the members the issuer writes itself (`iss`, `sub`, `iat`, `exp`,
+/// `vct`, `jti`, `_sd_alg`).
+pub fn issuance_input(
+    evidence: &Evidence,
+    holder_key: Option<&HolderPublicKey>,
+    structured_projections: &BTreeMap<String, String>,
+) -> Result<SdJwtIssuanceInput, SdJwtVcMappingError> {
+    // Deterministic because the kernel canonicalizes subjects to requirement
+    // declaration order. The complete set travels as a public claim; `sub` is
+    // a convenience projection of the first role.
+    let subject = evidence
+        .subjects
+        .first()
+        .ok_or(SdJwtVcMappingError::Subjects)?;
+
+    let mut public_claims = BTreeMap::new();
+    public_claims.insert("issuedBy".to_string(), string_claim(&evidence.issued_by));
+    public_claims.insert(
+        "providedBy".to_string(),
+        string_claim(&evidence.provided_by),
+    );
+    public_claims.insert(
+        "supportsRequirement".to_string(),
+        string_claim(&evidence.supports_requirement),
+    );
+    public_claims.insert("purpose".to_string(), string_claim(&evidence.purpose));
+    public_claims.insert("audience".to_string(), string_claim(&evidence.audience));
+    public_claims.insert(
+        "assuranceProfile".to_string(),
+        claim_value(&evidence.assurance_profile)?,
+    );
+    public_claims.insert(
+        "observedAt".to_string(),
+        string_claim(&evidence.observed_at),
+    );
+    public_claims.insert(
+        "configurationRevision".to_string(),
+        string_claim(&evidence.configuration_revision),
+    );
+    public_claims.insert(
+        "requestNonce".to_string(),
+        string_claim(&evidence.request_nonce),
+    );
+    public_claims.insert("subjects".to_string(), claim_value(&evidence.subjects)?);
+
+    let mut disclosures = Vec::with_capacity(evidence.supported_values.len());
+    let mut object_disclosures = Vec::new();
+    let mut structured_values = Map::new();
+    for (position, supported) in evidence.supported_values.iter().enumerate() {
+        if let Some(claim) = structured_projections.get(&supported.provides_value_for) {
+            let crate::model::PublicValue::Structured(structured) = &supported.value else {
+                return Err(SdJwtVcMappingError::StructuredProjection);
+            };
+            let fields = structured
+                .fields
+                .iter()
+                .map(|(name, value)| Disclosure {
+                    name: name.clone(),
+                    value: value.clone(),
+                })
+                .collect::<Vec<_>>();
+            if fields.is_empty() {
+                return Err(SdJwtVcMappingError::StructuredProjection);
+            }
+            object_disclosures.push(ObjectDisclosure {
+                name: claim.clone(),
+                fields,
+            });
+            structured_values.insert(
+                claim.clone(),
+                serde_json::json!({
+                    "providesValueFor": supported.provides_value_for,
+                    "form": "reviewed-structured-value",
+                    "schema": structured.schema,
+                    "position": position,
+                }),
+            );
+            continue;
+        }
+        disclosures.push(Disclosure {
+            name: supported.provides_value_for.clone(),
+            value: claim_value(&supported.value)?,
+        });
+    }
+    if !structured_values.is_empty() {
+        public_claims.insert(
+            STRUCTURED_VALUES_CLAIM.to_string(),
+            Value::Object(structured_values),
+        );
+    }
+
+    Ok(SdJwtIssuanceInput {
+        // The technical provider controlling the signing key, matching the
+        // signed-JWS trust statement. The named legal issuer travels as
+        // `issuedBy`.
+        iss: evidence.provided_by.clone(),
+        sub_ref: subject.binding.clone(),
+        credential_id: Some(evidence.id.clone()),
+        iat: unix_seconds(&evidence.issued_at)?,
+        exp: unix_seconds(&evidence.valid_until)?,
+        vct: evidence.is_conformant_to.clone(),
+        // Version 1 publishes no credential status, so no status reference can
+        // be constructed for one.
+        status: None,
+        public_claims,
+        cnf: holder_key.map(confirmation).transpose()?,
+        disclosures,
+        object_disclosures,
+    })
+}
+
+/// Build the `cnf` member. The key identifier stays inside the JWK so the
+/// confirmation carries exactly one confirmation method.
+fn confirmation(key: &HolderPublicKey) -> Result<HolderConfirmation, SdJwtVcMappingError> {
+    if !key.is_acceptable() {
+        return Err(SdJwtVcMappingError::HolderKey);
+    }
+    Ok(HolderConfirmation {
+        jwk: PublicJwk {
+            kty: key.kty.clone(),
+            kid: key.kid.clone(),
+            alg: key.alg.clone(),
+            crv: Some(key.crv.clone()),
+            x: Some(key.x.clone()),
+            y: None,
+            n: None,
+            e: None,
+        },
+        kid: None,
+    })
+}
+
+fn unix_seconds(value: &str) -> Result<i64, SdJwtVcMappingError> {
+    DateTime::parse_from_rfc3339(value)
+        .map(|instant| instant.timestamp())
+        .map_err(|_| SdJwtVcMappingError::Timestamp)
+}
+
+fn string_claim(value: &str) -> Value {
+    Value::String(value.to_string())
+}
+
+fn claim_value<T: Serialize>(value: &T) -> Result<Value, SdJwtVcMappingError> {
+    serde_json::to_value(value).map_err(|_| SdJwtVcMappingError::Claim)
+}
+
+/// A verified token whose claim set is not the profile's projection of an
+/// Evidence payload.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+pub enum SdJwtVcClaimError {
+    #[error("the token carries a claim the profile does not publish")]
+    UnexpectedClaim,
+    #[error("the token is missing a claim the profile always discloses")]
+    MissingClaim,
+    #[error("a token claim has the wrong type or an inconsistent value")]
+    ClaimShape,
+    #[error("a token timestamp is not a representable instant")]
+    Timestamp,
+}
+
+/// Rebuild the Evidence payload that a compact SD-JWT VC projects from.
+///
+/// The claim set is closed: any member outside the issuer-owned claims and the
+/// profile's always-disclosed claims fails, which is how a relying party
+/// detects a prohibited `status`, `aud`, `nbf`, or smuggled selector claim. The
+/// result is a JSON payload, not a parsed `Evidence`, so the caller applies the
+/// same contract validation and deserialization the signed-JWS path applies.
+pub fn evidence_payload_from_claims(
+    claims: &Map<String, Value>,
+    disclosed: &[(String, Value)],
+) -> Result<Value, SdJwtVcClaimError> {
+    let structured = structured_value_metadata(claims)?;
+    for name in claims.keys() {
+        if !ISSUER_OWNED_CLAIMS.contains(&name.as_str())
+            && !ALWAYS_DISCLOSED_CLAIMS.contains(&name.as_str())
+            && name != STRUCTURED_VALUES_CLAIM
+            && !structured.contains_key(name)
+        {
+            return Err(SdJwtVcClaimError::UnexpectedClaim);
+        }
+    }
+
+    let id = string_of(claims, "id")?;
+    if string_of(claims, "jti")? != id {
+        return Err(SdJwtVcClaimError::ClaimShape);
+    }
+
+    // The profile sources `iss` and `providedBy` from the same
+    // `service.providerId`, so a token that disagrees with itself about the
+    // technical provider is not the projection of any payload.
+    if string_of(claims, "iss")? != string_of(claims, "providedBy")? {
+        return Err(SdJwtVcClaimError::ClaimShape);
+    }
+
+    let subjects = claims
+        .get("subjects")
+        .ok_or(SdJwtVcClaimError::MissingClaim)?
+        .clone();
+    // `sub` is a projection of the first role-bound subject, never an
+    // independent identifier.
+    let first_binding = subjects
+        .as_array()
+        .and_then(|roles| roles.first())
+        .and_then(|role| role.get("binding"))
+        .and_then(Value::as_str)
+        .ok_or(SdJwtVcClaimError::ClaimShape)?;
+    if string_of(claims, "sub")? != first_binding {
+        return Err(SdJwtVcClaimError::ClaimShape);
+    }
+
+    let mut supported_values = Vec::with_capacity(disclosed.len());
+    let mut concepts = std::collections::BTreeSet::<String>::new();
+    for (concept, value) in disclosed {
+        if !concepts.insert(concept.clone()) {
+            return Err(SdJwtVcClaimError::ClaimShape);
+        }
+        supported_values.push(serde_json::json!({
+            "providesValueFor": concept,
+            "value": value,
+        }));
+    }
+    let mut projected = Vec::with_capacity(structured.len());
+    for (claim, metadata) in structured {
+        if !concepts.insert(metadata.concept.clone()) {
+            return Err(SdJwtVcClaimError::ClaimShape);
+        }
+        let fields = claims
+            .get(&claim)
+            .and_then(Value::as_object)
+            .filter(|fields| !fields.is_empty() && fields.len() <= 64)
+            .ok_or(SdJwtVcClaimError::ClaimShape)?;
+        projected.push((
+            metadata.position,
+            serde_json::json!({
+                "providesValueFor": metadata.concept,
+                "value": {
+                    "form": "reviewed-structured-value",
+                    "schema": metadata.schema,
+                    "fields": fields,
+                },
+            }),
+        ));
+    }
+    projected.sort_by_key(|(position, _)| *position);
+    for (position, value) in projected {
+        if position > supported_values.len() {
+            return Err(SdJwtVcClaimError::ClaimShape);
+        }
+        supported_values.insert(position, value);
+    }
+
+    Ok(serde_json::json!({
+        "schema": EVIDENCE_SCHEMA_V1,
+        "assuranceProfile": claims.get("assuranceProfile").ok_or(SdJwtVcClaimError::MissingClaim)?,
+        "requestNonce": claims.get("requestNonce").ok_or(SdJwtVcClaimError::MissingClaim)?,
+        "id": id,
+        "type": "Evidence",
+        "supportsRequirement": claims.get("supportsRequirement").ok_or(SdJwtVcClaimError::MissingClaim)?,
+        "isConformantTo": claims.get("vct").ok_or(SdJwtVcClaimError::MissingClaim)?,
+        "issuedBy": claims.get("issuedBy").ok_or(SdJwtVcClaimError::MissingClaim)?,
+        "providedBy": claims.get("providedBy").ok_or(SdJwtVcClaimError::MissingClaim)?,
+        "issuedAt": rfc3339_of(claims, "iat")?,
+        "observedAt": claims.get("observedAt").ok_or(SdJwtVcClaimError::MissingClaim)?,
+        "validUntil": rfc3339_of(claims, "exp")?,
+        "purpose": claims.get("purpose").ok_or(SdJwtVcClaimError::MissingClaim)?,
+        "audience": claims.get("audience").ok_or(SdJwtVcClaimError::MissingClaim)?,
+        "configurationRevision": claims.get("configurationRevision").ok_or(SdJwtVcClaimError::MissingClaim)?,
+        "subjects": subjects,
+        "supportedValues": supported_values,
+    }))
+}
+
+struct StructuredValueMetadata {
+    concept: String,
+    schema: String,
+    position: usize,
+}
+
+fn structured_value_metadata(
+    claims: &Map<String, Value>,
+) -> Result<BTreeMap<String, StructuredValueMetadata>, SdJwtVcClaimError> {
+    let Some(value) = claims.get(STRUCTURED_VALUES_CLAIM) else {
+        return Ok(BTreeMap::new());
+    };
+    let object = value.as_object().ok_or(SdJwtVcClaimError::ClaimShape)?;
+    if object.is_empty() || object.len() > 16 {
+        return Err(SdJwtVcClaimError::ClaimShape);
+    }
+    let mut result = BTreeMap::new();
+    let mut concepts = std::collections::BTreeSet::new();
+    let mut positions = std::collections::BTreeSet::new();
+    for (claim, metadata) in object {
+        let metadata = metadata
+            .as_object()
+            .filter(|metadata| {
+                metadata.len() == 4
+                    && metadata.contains_key("providesValueFor")
+                    && metadata.contains_key("form")
+                    && metadata.contains_key("schema")
+                    && metadata.contains_key("position")
+            })
+            .ok_or(SdJwtVcClaimError::ClaimShape)?;
+        if metadata.get("form").and_then(Value::as_str) != Some("reviewed-structured-value") {
+            return Err(SdJwtVcClaimError::ClaimShape);
+        }
+        let concept = metadata
+            .get("providesValueFor")
+            .and_then(Value::as_str)
+            .ok_or(SdJwtVcClaimError::ClaimShape)?
+            .to_owned();
+        let schema = metadata
+            .get("schema")
+            .and_then(Value::as_str)
+            .ok_or(SdJwtVcClaimError::ClaimShape)?
+            .to_owned();
+        let position = metadata
+            .get("position")
+            .and_then(Value::as_u64)
+            .and_then(|position| usize::try_from(position).ok())
+            .filter(|position| *position < 16)
+            .ok_or(SdJwtVcClaimError::ClaimShape)?;
+        if !concepts.insert(concept.clone())
+            || !positions.insert(position)
+            || !claims.get(claim).is_some_and(Value::is_object)
+        {
+            return Err(SdJwtVcClaimError::ClaimShape);
+        }
+        result.insert(
+            claim.clone(),
+            StructuredValueMetadata {
+                concept,
+                schema,
+                position,
+            },
+        );
+    }
+    Ok(result)
+}
+
+fn string_of<'a>(claims: &'a Map<String, Value>, name: &str) -> Result<&'a str, SdJwtVcClaimError> {
+    claims
+        .get(name)
+        .ok_or(SdJwtVcClaimError::MissingClaim)?
+        .as_str()
+        .ok_or(SdJwtVcClaimError::ClaimShape)
+}
+
+/// `iat` and `exp` are the profile's only numeric time claims. The kernel
+/// emits every Evidence timestamp at whole-second UTC precision, so the
+/// rebuilt string is the exact string the signed-JWS payload carries.
+fn rfc3339_of(claims: &Map<String, Value>, name: &str) -> Result<String, SdJwtVcClaimError> {
+    let seconds = claims
+        .get(name)
+        .ok_or(SdJwtVcClaimError::MissingClaim)?
+        .as_i64()
+        .ok_or(SdJwtVcClaimError::ClaimShape)?;
+    Utc.timestamp_opt(seconds, 0)
+        .single()
+        .map(|instant| instant.to_rfc3339_opts(SecondsFormat::Secs, true))
+        .ok_or(SdJwtVcClaimError::Timestamp)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::model::{
+        EvidenceObjectType, PublicValue, SubjectBinding, SupportedValue,
+        OFFLINE_EVALUATION_REQUEST_NONCE,
+    };
+    use crate::EVIDENCE_SCHEMA_V1;
+
+    fn evidence() -> Evidence {
+        Evidence {
+            schema: EVIDENCE_SCHEMA_V1.to_string(),
+            assurance_profile: crate::config::AssuranceProfile::EvidenceGrade,
+            request_nonce: OFFLINE_EVALUATION_REQUEST_NONCE.to_string(),
+            id: "urn:evidence:assertion:v1_2f0a".to_string(),
+            evidence_type_name: EvidenceObjectType::Evidence,
+            supports_requirement: "urn:example:requirement:adult-status".to_string(),
+            is_conformant_to: "urn:example:evidence-type:adult-status".to_string(),
+            issued_by: "urn:example:issuer:civil-registry".to_string(),
+            provided_by: "urn:example:provider:evidence-service".to_string(),
+            issued_at: "2026-08-02T09:15:00Z".to_string(),
+            observed_at: "2026-08-02T09:14:59Z".to_string(),
+            valid_until: "2026-08-02T09:20:00Z".to_string(),
+            purpose: "age-gated-service".to_string(),
+            audience: "urn:example:relying-party:library".to_string(),
+            configuration_revision: "rev-7".to_string(),
+            subjects: vec![
+                SubjectBinding {
+                    role: "applicant".to_string(),
+                    binding: "urn:evidence:subject:v1_aaaa".to_string(),
+                },
+                SubjectBinding {
+                    role: "guardian".to_string(),
+                    binding: "urn:evidence:subject:v1_bbbb".to_string(),
+                },
+            ],
+            supported_values: vec![
+                SupportedValue {
+                    provides_value_for: "urn:example:concept:is-adult".to_string(),
+                    value: PublicValue::Boolean(true),
+                },
+                SupportedValue {
+                    provides_value_for: "urn:example:concept:jurisdiction".to_string(),
+                    value: PublicValue::String("SE".to_string()),
+                },
+            ],
+        }
+    }
+
+    fn holder_key() -> HolderPublicKey {
+        HolderPublicKey {
+            kty: "OKP".to_string(),
+            crv: "Ed25519".to_string(),
+            x: "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo".to_string(),
+            alg: None,
+            kid: None,
+        }
+    }
+
+    #[test]
+    fn projects_the_always_disclosed_claims() {
+        let evidence = evidence();
+        let input = issuance_input(&evidence, None, &BTreeMap::new()).expect("evidence maps");
+
+        assert_eq!(input.iss, "urn:example:provider:evidence-service");
+        assert_eq!(input.sub_ref, "urn:evidence:subject:v1_aaaa");
+        assert_eq!(
+            input.credential_id.as_deref(),
+            Some("urn:evidence:assertion:v1_2f0a")
+        );
+        assert_eq!(input.vct, "urn:example:evidence-type:adult-status");
+        assert_eq!(input.iat, 1_785_662_100);
+        assert_eq!(input.exp, 1_785_662_400);
+        assert!(input.status.is_none());
+        assert!(input.cnf.is_none());
+
+        let names: Vec<&str> = input.public_claims.keys().map(String::as_str).collect();
+        assert_eq!(
+            names,
+            [
+                "assuranceProfile",
+                "audience",
+                "configurationRevision",
+                "issuedBy",
+                "observedAt",
+                "providedBy",
+                "purpose",
+                "requestNonce",
+                "subjects",
+                "supportsRequirement",
+            ]
+        );
+        assert_eq!(
+            input.public_claims["issuedBy"],
+            Value::String("urn:example:issuer:civil-registry".to_string())
+        );
+        assert_eq!(
+            input.public_claims["requestNonce"],
+            Value::String(OFFLINE_EVALUATION_REQUEST_NONCE.to_string())
+        );
+        assert_eq!(
+            input.public_claims["subjects"],
+            serde_json::json!([
+                {"role": "applicant", "binding": "urn:evidence:subject:v1_aaaa"},
+                {"role": "guardian", "binding": "urn:evidence:subject:v1_bbbb"},
+            ])
+        );
+    }
+
+    #[test]
+    fn selectively_discloses_exactly_one_value_per_concept() {
+        let evidence = evidence();
+        let input = issuance_input(&evidence, None, &BTreeMap::new()).expect("evidence maps");
+
+        let disclosed: Vec<(&str, &Value)> = input
+            .disclosures
+            .iter()
+            .map(|disclosure| (disclosure.name.as_str(), &disclosure.value))
+            .collect();
+        assert_eq!(
+            disclosed,
+            [
+                ("urn:example:concept:is-adult", &Value::Bool(true)),
+                (
+                    "urn:example:concept:jurisdiction",
+                    &Value::String("SE".to_string())
+                ),
+            ]
+        );
+    }
+
+    #[test]
+    fn omits_the_prohibited_claims() {
+        let evidence = evidence();
+        let input = issuance_input(&evidence, None, &BTreeMap::new()).expect("evidence maps");
+
+        for prohibited in ["status", "nbf", "aud", "selector", "grant", "actor"] {
+            assert!(
+                !input.public_claims.contains_key(prohibited),
+                "{prohibited} must not be published"
+            );
+            assert!(
+                !input
+                    .disclosures
+                    .iter()
+                    .any(|disclosure| disclosure.name == prohibited),
+                "{prohibited} must not be disclosed"
+            );
+        }
+    }
+
+    #[test]
+    fn embeds_an_acceptable_holder_key_as_confirmation() {
+        let evidence = evidence();
+        let mut key = holder_key();
+        key.kid = Some("holder-1".to_string());
+        key.alg = Some("EdDSA".to_string());
+
+        let confirmation = issuance_input(&evidence, Some(&key), &BTreeMap::new())
+            .expect("evidence maps")
+            .cnf
+            .expect("confirmation is present");
+        assert_eq!(confirmation.jwk.kty, "OKP");
+        assert_eq!(confirmation.jwk.crv.as_deref(), Some("Ed25519"));
+        assert_eq!(confirmation.jwk.x.as_deref(), Some(key.x.as_str()));
+        assert_eq!(confirmation.jwk.kid.as_deref(), Some("holder-1"));
+        assert_eq!(confirmation.jwk.alg.as_deref(), Some("EdDSA"));
+        assert!(confirmation.kid.is_none());
+    }
+
+    #[test]
+    fn rejects_unacceptable_holder_keys() {
+        let evidence = evidence();
+        let mut wrong_curve = holder_key();
+        wrong_curve.crv = "P-256".to_string();
+        let mut wrong_algorithm = holder_key();
+        wrong_algorithm.alg = Some("ES256".to_string());
+        let mut wrong_key_type = holder_key();
+        wrong_key_type.kty = "EC".to_string();
+        let mut short_coordinate = holder_key();
+        short_coordinate.x = "11qYAYKxCrfVS_7TyWQHOg".to_string();
+        let mut padded_coordinate = holder_key();
+        padded_coordinate.x = "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo=".to_string();
+
+        for key in [
+            wrong_curve,
+            wrong_algorithm,
+            wrong_key_type,
+            short_coordinate,
+            padded_coordinate,
+        ] {
+            assert_eq!(
+                issuance_input(&evidence, Some(&key), &BTreeMap::new()).unwrap_err(),
+                SdJwtVcMappingError::HolderKey
+            );
+        }
+    }
+
+    #[test]
+    fn rejects_private_key_members_before_mapping() {
+        let body = serde_json::json!({
+            "kty": "OKP",
+            "crv": "Ed25519",
+            "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo",
+            "d": "nWGxne_9WmC6hEr0kuwsxERJxWl7MmkZcDusAxyuf2A",
+        });
+        assert!(serde_json::from_value::<HolderPublicKey>(body).is_err());
+    }
+
+    #[test]
+    fn rejects_payloads_the_profile_cannot_represent() {
+        let mut no_subjects = evidence();
+        no_subjects.subjects.clear();
+        assert_eq!(
+            issuance_input(&no_subjects, None, &BTreeMap::new()).unwrap_err(),
+            SdJwtVcMappingError::Subjects
+        );
+
+        let mut bad_issued_at = evidence();
+        bad_issued_at.issued_at = "2026-08-02 09:15:00".to_string();
+        assert_eq!(
+            issuance_input(&bad_issued_at, None, &BTreeMap::new()).unwrap_err(),
+            SdJwtVcMappingError::Timestamp
+        );
+
+        let mut bad_valid_until = evidence();
+        bad_valid_until.valid_until = "never".to_string();
+        assert_eq!(
+            issuance_input(&bad_valid_until, None, &BTreeMap::new()).unwrap_err(),
+            SdJwtVcMappingError::Timestamp
+        );
+    }
+
+    /// The claim map and resolved disclosures the verifier hands to the
+    /// inverse projection once the signature and the digests check out.
+    fn verified_claims(evidence: &Evidence) -> (Map<String, Value>, Vec<(String, Value)>) {
+        let input = issuance_input(evidence, None, &BTreeMap::new()).expect("evidence maps");
+        let credential_id = input.credential_id.clone().expect("credential identifier");
+        let mut claims = Map::new();
+        claims.insert("iss".to_string(), Value::String(input.iss.clone()));
+        claims.insert("sub".to_string(), Value::String(input.sub_ref.clone()));
+        claims.insert("iat".to_string(), Value::from(input.iat));
+        claims.insert("exp".to_string(), Value::from(input.exp));
+        claims.insert("vct".to_string(), Value::String(input.vct.clone()));
+        claims.insert("id".to_string(), Value::String(credential_id.clone()));
+        claims.insert("jti".to_string(), Value::String(credential_id));
+        for (name, value) in &input.public_claims {
+            claims.insert(name.clone(), value.clone());
+        }
+        let disclosed = input
+            .disclosures
+            .iter()
+            .map(|disclosure| (disclosure.name.clone(), disclosure.value.clone()))
+            .collect();
+        (claims, disclosed)
+    }
+
+    #[test]
+    fn rebuilds_the_payload_from_a_conformant_claim_set() {
+        let evidence = evidence();
+        let (claims, disclosed) = verified_claims(&evidence);
+
+        let payload = evidence_payload_from_claims(&claims, &disclosed).expect("claims rebuild");
+
+        assert_eq!(payload["providedBy"], Value::String(evidence.provided_by));
+        assert_eq!(payload["issuedBy"], Value::String(evidence.issued_by));
+    }
+
+    #[test]
+    fn rejects_an_issuer_claim_that_is_not_the_provider() {
+        let evidence = evidence();
+        let (mut claims, disclosed) = verified_claims(&evidence);
+        // The profile sources `iss` and `providedBy` from the same
+        // `service.providerId`, so a token that disagrees with itself about
+        // who signed it is not the profile's projection of any payload.
+        claims.insert(
+            "iss".to_string(),
+            Value::String("urn:example:provider:other-service".to_string()),
+        );
+
+        assert_eq!(
+            evidence_payload_from_claims(&claims, &disclosed).unwrap_err(),
+            SdJwtVcClaimError::ClaimShape
+        );
+    }
+
+    #[test]
+    fn rejects_a_claim_set_without_an_issuer() {
+        let evidence = evidence();
+        let (mut claims, disclosed) = verified_claims(&evidence);
+        claims.remove("iss");
+
+        assert_eq!(
+            evidence_payload_from_claims(&claims, &disclosed).unwrap_err(),
+            SdJwtVcClaimError::MissingClaim
+        );
+    }
+}
diff --git a/crates/registry-evidence/src/secrets.rs b/crates/registry-evidence/src/secrets.rs
new file mode 100644
index 000000000..14a567748
--- /dev/null
+++ b/crates/registry-evidence/src/secrets.rs
@@ -0,0 +1,384 @@
+//! Bounded resolution of runtime secret references.
+
+use std::{
+    collections::BTreeSet,
+    env, fmt,
+    fs::File,
+    io::Read,
+    path::{Path, PathBuf},
+};
+
+use thiserror::Error;
+use zeroize::Zeroizing;
+
+/// The maximum size of a resolved secret value.
+pub const MAX_SECRET_BYTES: usize = 64 * 1024;
+
+#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)]
+pub enum SecretProvider {
+    Environment,
+    File,
+}
+
+#[derive(Debug, Error, Eq, PartialEq)]
+pub enum SecretError {
+    #[error("the secret reference is invalid")]
+    InvalidReference,
+    #[error("the secret reference uses a disabled provider")]
+    ProviderDisabled,
+    #[error("the secret provider configuration is invalid")]
+    InvalidProviderConfiguration,
+    #[error("the referenced secret is unavailable")]
+    Unavailable,
+    #[error("the referenced secret file is unsafe")]
+    UnsafeFile,
+    #[error("the referenced secret could not be read")]
+    Read,
+    #[error("the referenced secret value is invalid")]
+    InvalidValue,
+}
+
+/// Secret bytes that are erased when dropped and never exposed by `Debug`.
+pub struct ProtectedSecret(Zeroizing<Vec<u8>>);
+
+impl ProtectedSecret {
+    /// Explicitly borrow the secret for the smallest possible consumer scope.
+    pub fn expose_secret(&self) -> &[u8] {
+        self.0.as_slice()
+    }
+
+    pub fn len(&self) -> usize {
+        self.0.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+}
+
+impl fmt::Debug for ProtectedSecret {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("ProtectedSecret([REDACTED])")
+    }
+}
+
+/// Resolves only the providers explicitly enabled by runtime configuration.
+#[derive(Debug)]
+pub struct SecretResolver {
+    providers: BTreeSet<SecretProvider>,
+    file_root: PathBuf,
+}
+
+impl SecretResolver {
+    pub fn new(
+        providers: impl IntoIterator<Item = SecretProvider>,
+        file_root: impl Into<PathBuf>,
+    ) -> Result<Self, SecretError> {
+        let providers = providers.into_iter().collect::<BTreeSet<_>>();
+        let file_root = file_root.into();
+        if providers.is_empty()
+            || (providers.contains(&SecretProvider::File) && !file_root.is_absolute())
+        {
+            return Err(SecretError::InvalidProviderConfiguration);
+        }
+        Ok(Self {
+            providers,
+            file_root,
+        })
+    }
+
+    pub fn resolve(&self, reference: &str) -> Result<ProtectedSecret, SecretError> {
+        let (provider, name) = parse_reference(reference)?;
+        if !self.providers.contains(&provider) {
+            return Err(SecretError::ProviderDisabled);
+        }
+
+        let bytes = match provider {
+            SecretProvider::Environment => read_environment(name)?,
+            SecretProvider::File => read_secret_file(&self.file_root, name)?,
+        };
+        validate_secret(bytes)
+    }
+}
+
+fn parse_reference(reference: &str) -> Result<(SecretProvider, &str), SecretError> {
+    if let Some(name) = reference.strip_prefix("secret:env/") {
+        if valid_environment_name(name) {
+            return Ok((SecretProvider::Environment, name));
+        }
+    } else if let Some(name) = reference.strip_prefix("secret:file/") {
+        if valid_file_name(name) {
+            return Ok((SecretProvider::File, name));
+        }
+    }
+    Err(SecretError::InvalidReference)
+}
+
+fn valid_environment_name(name: &str) -> bool {
+    let bytes = name.as_bytes();
+    matches!(bytes.first(), Some(b'A'..=b'Z'))
+        && bytes.len() <= 128
+        && bytes[1..]
+            .iter()
+            .all(|byte| byte.is_ascii_uppercase() || byte.is_ascii_digit() || *byte == b'_')
+}
+
+fn valid_file_name(name: &str) -> bool {
+    let bytes = name.as_bytes();
+    matches!(bytes.first(), Some(b'a'..=b'z'))
+        && bytes.len() <= 128
+        && bytes[1..].iter().all(|byte| {
+            byte.is_ascii_lowercase() || byte.is_ascii_digit() || matches!(byte, b'.' | b'_' | b'-')
+        })
+}
+
+fn read_environment(name: &str) -> Result<Zeroizing<Vec<u8>>, SecretError> {
+    let value = env::var_os(name).ok_or(SecretError::Unavailable)?;
+    #[cfg(unix)]
+    let bytes = {
+        use std::os::unix::ffi::OsStringExt as _;
+        value.into_vec()
+    };
+    #[cfg(not(unix))]
+    let bytes = value
+        .into_string()
+        .map_err(|_| SecretError::InvalidValue)?
+        .into_bytes();
+    Ok(Zeroizing::new(bytes))
+}
+
+#[cfg(unix)]
+fn read_secret_file(root: &Path, name: &str) -> Result<Zeroizing<Vec<u8>>, SecretError> {
+    use rustix::fs::{Mode, OFlags};
+
+    let root = rustix::fs::open(
+        root,
+        OFlags::RDONLY | OFlags::CLOEXEC | OFlags::NOFOLLOW | OFlags::DIRECTORY,
+        Mode::empty(),
+    )
+    .map_err(|_| SecretError::Unavailable)?;
+    let secret = rustix::fs::openat(
+        &root,
+        name,
+        OFlags::RDONLY | OFlags::CLOEXEC | OFlags::NOFOLLOW | OFlags::NONBLOCK,
+        Mode::empty(),
+    )
+    .map_err(|_| SecretError::Unavailable)?;
+    let file = File::from(secret);
+    validate_file_metadata(&file)?;
+    read_bounded(file)
+}
+
+#[cfg(unix)]
+fn validate_file_metadata(file: &File) -> Result<(), SecretError> {
+    use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _};
+
+    let metadata = file.metadata().map_err(|_| SecretError::Read)?;
+    if !metadata.is_file()
+        || metadata.uid() != rustix::process::geteuid().as_raw()
+        || metadata.permissions().mode() & 0o7777 != 0o600
+        || metadata.nlink() != 1
+    {
+        return Err(SecretError::UnsafeFile);
+    }
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn read_secret_file(root: &Path, name: &str) -> Result<Zeroizing<Vec<u8>>, SecretError> {
+    let path = root.join(name);
+    let metadata = std::fs::symlink_metadata(&path).map_err(|_| SecretError::Unavailable)?;
+    if metadata.file_type().is_symlink() || !metadata.is_file() {
+        return Err(SecretError::UnsafeFile);
+    }
+    let file = File::open(path).map_err(|_| SecretError::Unavailable)?;
+    read_bounded(file)
+}
+
+fn read_bounded(file: File) -> Result<Zeroizing<Vec<u8>>, SecretError> {
+    let mut bytes = Zeroizing::new(Vec::new());
+    file.take((MAX_SECRET_BYTES + 1) as u64)
+        .read_to_end(&mut bytes)
+        .map_err(|_| SecretError::Read)?;
+    Ok(bytes)
+}
+
+fn validate_secret(bytes: Zeroizing<Vec<u8>>) -> Result<ProtectedSecret, SecretError> {
+    if bytes.is_empty() || bytes.len() > MAX_SECRET_BYTES || bytes.contains(&0) {
+        return Err(SecretError::InvalidValue);
+    }
+    Ok(ProtectedSecret(bytes))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::{Mutex, OnceLock};
+
+    fn environment_lock() -> std::sync::MutexGuard<'static, ()> {
+        static LOCK: OnceLock<Mutex<()>> = OnceLock::new();
+        LOCK.get_or_init(|| Mutex::new(())).lock().expect("lock")
+    }
+
+    #[test]
+    fn references_use_only_the_two_exact_contract_grammars() {
+        for valid in [
+            "secret:env/A",
+            "secret:env/SOURCE_2_PASSWORD",
+            "secret:file/a",
+            "secret:file/source-token_v2.json",
+        ] {
+            assert!(parse_reference(valid).is_ok(), "{valid}");
+        }
+        for invalid in [
+            "secret:env/",
+            "secret:env/lower",
+            "secret:env/A-B",
+            "secret:environment/A",
+            "secret:file/Upper",
+            "secret:file/../token",
+            "secret:file/nested/token",
+            "secret:file/.token",
+            "secret:file/token\0suffix",
+            "plain-value",
+        ] {
+            assert_eq!(parse_reference(invalid), Err(SecretError::InvalidReference));
+        }
+        assert!(parse_reference(&format!("secret:env/A{}", "B".repeat(127))).is_ok());
+        assert_eq!(
+            parse_reference(&format!("secret:env/A{}", "B".repeat(128))),
+            Err(SecretError::InvalidReference)
+        );
+    }
+
+    #[test]
+    fn provider_allowlist_is_enforced_before_lookup() {
+        let resolver =
+            SecretResolver::new([SecretProvider::File], "/safe-root").expect("resolver builds");
+        assert!(matches!(
+            resolver.resolve("secret:env/DEFINITELY_NOT_PRESENT"),
+            Err(SecretError::ProviderDisabled)
+        ));
+    }
+
+    #[test]
+    fn environment_secret_is_bounded_and_debug_is_redacted() {
+        let _guard = environment_lock();
+        const NAME: &str = "REGISTRY_EVIDENCE_SECRET_RESOLVER_TEST";
+        env::set_var(NAME, "environment-canary");
+        let resolver =
+            SecretResolver::new([SecretProvider::Environment], "").expect("resolver builds");
+        let secret = resolver
+            .resolve("secret:env/REGISTRY_EVIDENCE_SECRET_RESOLVER_TEST")
+            .expect("secret resolves");
+        env::remove_var(NAME);
+
+        assert!(
+            secret.expose_secret() == b"environment-canary",
+            "resolved environment secret bytes differ"
+        );
+        assert_eq!(format!("{secret:?}"), "ProtectedSecret([REDACTED])");
+        assert!(!format!("{secret:?}").contains("environment-canary"));
+    }
+
+    #[test]
+    fn empty_nul_and_oversized_values_are_rejected_without_echo() {
+        for value in [
+            Vec::new(),
+            b"canary\0value".to_vec(),
+            vec![b'x'; MAX_SECRET_BYTES + 1],
+        ] {
+            let error = validate_secret(Zeroizing::new(value)).expect_err("invalid secret");
+            assert_eq!(error, SecretError::InvalidValue);
+            assert_eq!(error.to_string(), "the referenced secret value is invalid");
+        }
+    }
+
+    #[cfg(unix)]
+    mod unix {
+        use super::*;
+        use std::{fs, os::unix::fs::PermissionsExt as _};
+
+        fn write_secret(root: &Path, name: &str, value: &[u8], mode: u32) {
+            let path = root.join(name);
+            fs::write(&path, value).expect("write secret");
+            fs::set_permissions(path, fs::Permissions::from_mode(mode)).expect("set mode");
+        }
+
+        #[test]
+        fn file_secret_uses_open_file_owner_and_exact_mode_checks() {
+            let root = tempfile::tempdir().expect("temporary root");
+            write_secret(root.path(), "source-token", b"file-canary", 0o600);
+            let resolver =
+                SecretResolver::new([SecretProvider::File], root.path()).expect("resolver builds");
+            let secret = resolver
+                .resolve("secret:file/source-token")
+                .expect("safe file resolves");
+            assert!(
+                secret.expose_secret() == b"file-canary",
+                "resolved file secret bytes differ"
+            );
+
+            write_secret(root.path(), "unsafe-token", b"unsafe-canary", 0o640);
+            assert!(matches!(
+                resolver.resolve("secret:file/unsafe-token"),
+                Err(SecretError::UnsafeFile)
+            ));
+        }
+
+        #[test]
+        fn file_secret_rejects_symlinks_and_non_regular_files() {
+            use std::os::unix::fs::symlink;
+
+            let root = tempfile::tempdir().expect("temporary root");
+            write_secret(root.path(), "target", b"symlink-canary", 0o600);
+            symlink(root.path().join("target"), root.path().join("link")).expect("create symlink");
+            fs::create_dir(root.path().join("directory")).expect("create directory");
+            let resolver =
+                SecretResolver::new([SecretProvider::File], root.path()).expect("resolver builds");
+
+            assert!(matches!(
+                resolver.resolve("secret:file/link"),
+                Err(SecretError::Unavailable)
+            ));
+            assert!(matches!(
+                resolver.resolve("secret:file/directory"),
+                Err(SecretError::Unavailable | SecretError::UnsafeFile)
+            ));
+        }
+
+        #[test]
+        fn file_secret_rejects_every_name_for_a_hard_link() {
+            let root = tempfile::tempdir().expect("temporary root");
+            write_secret(root.path(), "first", b"hard-link-canary", 0o600);
+            fs::hard_link(root.path().join("first"), root.path().join("second"))
+                .expect("create hard link");
+            let resolver =
+                SecretResolver::new([SecretProvider::File], root.path()).expect("resolver builds");
+
+            for name in ["first", "second"] {
+                assert!(matches!(
+                    resolver.resolve(&format!("secret:file/{name}")),
+                    Err(SecretError::UnsafeFile)
+                ));
+            }
+        }
+
+        #[test]
+        fn file_secret_read_is_bounded() {
+            let root = tempfile::tempdir().expect("temporary root");
+            write_secret(
+                root.path(),
+                "oversized",
+                &vec![b'x'; MAX_SECRET_BYTES + 1],
+                0o600,
+            );
+            let resolver =
+                SecretResolver::new([SecretProvider::File], root.path()).expect("resolver builds");
+            assert!(matches!(
+                resolver.resolve("secret:file/oversized"),
+                Err(SecretError::InvalidValue)
+            ));
+        }
+    }
+}
diff --git a/crates/registry-evidence/src/selector.rs b/crates/registry-evidence/src/selector.rs
new file mode 100644
index 000000000..7424c8de0
--- /dev/null
+++ b/crates/registry-evidence/src/selector.rs
@@ -0,0 +1,1124 @@
+//! One fail-closed authorization and selector-resolution decision.
+
+use std::{collections::BTreeSet, fmt};
+
+use chrono::NaiveDate;
+use serde_json::Value;
+use thiserror::Error;
+
+use crate::{
+    auth::AuthenticatedContext,
+    binding::{
+        subject_binding, BindingError, SelectorField as BindingField,
+        SelectorScalar as BindingScalar, SubjectBindingInput,
+    },
+    bundle::{Bundle, Codelist},
+    config::{
+        AuthorityKind, GrantedSubject, ResponseFormat, SelectorField as ConfiguredField,
+        SelectorProfile, ValueOrigin, MAX_SAFE_INTEGER,
+    },
+    model::{EvidenceRequest, RequestedSubject, SelectorValue},
+};
+
+const MAX_CANONICAL_BYTES: usize = 64 * 1024;
+
+/// Validate configured subject-binding key material through the same primitive
+/// used for released subject bindings. This keeps readiness from duplicating
+/// the crypto boundary's key-length and key-version invariants.
+pub(crate) fn validate_subject_binding_key(
+    key: &[u8],
+    key_version: u32,
+    trust_domain: &str,
+) -> Result<(), AuthorizationError> {
+    let fields = [BindingField {
+        name: "readiness",
+        value: BindingScalar::Boolean(true),
+    }];
+    subject_binding(
+        key,
+        key_version,
+        SubjectBindingInput {
+            trust_domain,
+            audience: "urn:registry-evidence:readiness",
+            purpose: "readiness",
+            role: "readiness",
+            profile: "readiness-v1",
+            fields: &fields,
+        },
+    )
+    .map(|_| ())
+    .map_err(|_: BindingError| AuthorizationError::Binding)
+}
+
+#[derive(Debug, Error, Clone, Copy, PartialEq, Eq)]
+pub enum AuthorizationError {
+    #[error("the Evidence request is not authorized")]
+    Unauthorized,
+    #[error("the Evidence request selector is invalid")]
+    Selector,
+    #[error("the Evidence authorization decision is ambiguous")]
+    AmbiguousAuthority,
+    #[error("the Evidence subject binding could not be constructed")]
+    Binding,
+}
+
+/// Failure of the offline fixture harness, which resolves a captured fixture
+/// case through the ordinary authorization boundary.
+///
+/// A fixture that does not state which purpose it exercises is a fixture
+/// contract failure, not an authorization denial. Keeping the two apart stops
+/// a harness omission from reading as a rejected request.
+#[derive(Debug, Error, Clone, Copy, PartialEq, Eq)]
+pub enum OfflineFixtureError {
+    #[error("the offline fixture does not select one of the requirement's purposes")]
+    Purpose,
+    #[error(transparent)]
+    Authorization(#[from] AuthorizationError),
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub enum ResolvedSelectorValue {
+    String(String),
+    Date(String),
+    Integer(i64),
+    Boolean(bool),
+    ControlledCode(String),
+}
+
+impl fmt::Debug for ResolvedSelectorValue {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("<redacted-selector-value>")
+    }
+}
+
+impl ResolvedSelectorValue {
+    pub fn as_json(&self) -> Value {
+        match self {
+            Self::String(value) | Self::Date(value) | Self::ControlledCode(value) => {
+                Value::String(value.clone())
+            }
+            Self::Integer(value) => Value::from(*value),
+            Self::Boolean(value) => Value::from(*value),
+        }
+    }
+
+    fn binding_scalar(&self) -> BindingScalar<'_> {
+        match self {
+            Self::String(value) => BindingScalar::String(value),
+            Self::Date(value) => BindingScalar::Date(value),
+            Self::Integer(value) => BindingScalar::Integer(*value),
+            Self::Boolean(value) => BindingScalar::Boolean(*value),
+            Self::ControlledCode(value) => BindingScalar::ControlledCode(value),
+        }
+    }
+
+    fn canonical_bytes(&self) -> &[u8] {
+        match self {
+            Self::String(value) | Self::Date(value) | Self::ControlledCode(value) => {
+                value.as_bytes()
+            }
+            Self::Integer(_) | Self::Boolean(_) => &[],
+        }
+    }
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct ResolvedSelectorField {
+    pub name: String,
+    pub value: ResolvedSelectorValue,
+}
+
+impl fmt::Debug for ResolvedSelectorField {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ResolvedSelectorField")
+            .field("name", &self.name)
+            .field("value", &"<redacted>")
+            .finish()
+    }
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct ResolvedSubject {
+    pub role: String,
+    pub selector_profile: String,
+    pub value_origin: ValueOrigin,
+    pub fields: Vec<ResolvedSelectorField>,
+}
+
+impl fmt::Debug for ResolvedSubject {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ResolvedSubject")
+            .field("role", &self.role)
+            .field("selector_profile", &self.selector_profile)
+            .field("value_origin", &self.value_origin)
+            .field(
+                "field_names",
+                &self
+                    .fields
+                    .iter()
+                    .map(|field| &field.name)
+                    .collect::<Vec<_>>(),
+            )
+            .finish()
+    }
+}
+
+impl ResolvedSubject {
+    pub fn value(&self, field_name: &str) -> Option<&ResolvedSelectorValue> {
+        self.fields
+            .iter()
+            .find(|field| field.name == field_name)
+            .map(|field| &field.value)
+    }
+
+    pub fn binding(
+        &self,
+        key: &[u8],
+        key_version: u32,
+        trust_domain: &str,
+        audience: &str,
+        purpose: &str,
+    ) -> Result<String, AuthorizationError> {
+        let fields = self
+            .fields
+            .iter()
+            .map(|field| BindingField {
+                name: &field.name,
+                value: field.value.binding_scalar(),
+            })
+            .collect::<Vec<_>>();
+        subject_binding(
+            key,
+            key_version,
+            SubjectBindingInput {
+                trust_domain,
+                audience,
+                purpose,
+                role: &self.role,
+                profile: &self.selector_profile,
+                fields: &fields,
+            },
+        )
+        .map_err(|_: BindingError| AuthorizationError::Binding)
+    }
+
+    /// Canonical protected input for the one permitted per-subject audit pseudonym.
+    pub fn audit_pseudonym_input(
+        &self,
+        audience: &str,
+        purpose: &str,
+    ) -> Result<Vec<u8>, AuthorizationError> {
+        let mut output = Vec::new();
+        output.push(0x01);
+        push_component(&mut output, audience.as_bytes())?;
+        push_component(&mut output, purpose.as_bytes())?;
+        push_component(&mut output, self.role.as_bytes())?;
+        push_component(&mut output, self.selector_profile.as_bytes())?;
+        push_count(&mut output, self.fields.len())?;
+        for field in &self.fields {
+            push_component(&mut output, field.name.as_bytes())?;
+            match &field.value {
+                ResolvedSelectorValue::String(value) => {
+                    output.push(0x01);
+                    push_component(&mut output, value.as_bytes())?;
+                }
+                ResolvedSelectorValue::Date(value) => {
+                    output.push(0x02);
+                    push_component(&mut output, value.as_bytes())?;
+                }
+                ResolvedSelectorValue::Integer(value) => {
+                    output.push(0x03);
+                    push_component(&mut output, value.to_string().as_bytes())?;
+                }
+                ResolvedSelectorValue::Boolean(value) => {
+                    output.push(0x04);
+                    push_component(&mut output, &[u8::from(*value)])?;
+                }
+                ResolvedSelectorValue::ControlledCode(value) => {
+                    output.push(0x05);
+                    push_component(&mut output, value.as_bytes())?;
+                }
+            }
+        }
+        Ok(output)
+    }
+}
+
+#[derive(Clone)]
+pub struct ResolvedAuthorization {
+    pub authority_profile: String,
+    pub authority_kind: AuthorityKind,
+    pub grant_id: Option<String>,
+    pub grant_authority: Option<String>,
+    pub requirement: String,
+    pub purpose: String,
+    pub audience: String,
+    pub subjects: Vec<ResolvedSubject>,
+}
+
+impl fmt::Debug for ResolvedAuthorization {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ResolvedAuthorization")
+            .field("authority_profile", &"<redacted>")
+            .field("authority_kind", &self.authority_kind)
+            .field("grant_id", &self.grant_id.as_ref().map(|_| "<redacted>"))
+            .field(
+                "grant_authority",
+                &self.grant_authority.as_ref().map(|_| "<redacted>"),
+            )
+            .field("requirement", &self.requirement)
+            .field("purpose", &self.purpose)
+            .field("audience", &self.audience)
+            .field("subjects", &self.subjects)
+            .finish()
+    }
+}
+
+#[derive(Clone)]
+pub struct MatchedEntitlement {
+    authority_profile: String,
+    authority_kind: AuthorityKind,
+    response_formats: Vec<ResponseFormat>,
+    subjects: Vec<GrantedSubject>,
+}
+
+impl MatchedEntitlement {
+    pub fn authority_profile(&self) -> &str {
+        &self.authority_profile
+    }
+
+    pub fn authority_kind(&self) -> AuthorityKind {
+        self.authority_kind
+    }
+
+    /// Report whether this one complete matched grant permits the requested
+    /// response format. Permissions are never unioned across grants.
+    pub fn permits_response_format(&self, format: ResponseFormat) -> bool {
+        self.response_formats.contains(&format)
+    }
+
+    pub(crate) fn subjects(&self) -> &[GrantedSubject] {
+        &self.subjects
+    }
+}
+
+impl fmt::Debug for MatchedEntitlement {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("MatchedEntitlement")
+            .field("authority_profile", &"<redacted>")
+            .field("authority_kind", &self.authority_kind)
+            .field("subject_count", &self.subjects.len())
+            .finish()
+    }
+}
+
+/// Match exactly one complete entitlement without inspecting selector values.
+///
+/// Keeping this decision separate lets the service charge invalid selector
+/// attempts to the matched authority profile before resolving any protected
+/// values. It performs no credential resolution and no source access.
+pub fn match_entitlement(
+    bundle: &Bundle,
+    request: &EvidenceRequest,
+    context: &AuthenticatedContext,
+) -> Result<MatchedEntitlement, AuthorizationError> {
+    let requirement = bundle
+        .config
+        .requirements
+        .iter()
+        .find(|candidate| candidate.id == request.requirement)
+        .ok_or(AuthorizationError::Unauthorized)?;
+    if !requirement
+        .purposes
+        .iter()
+        .any(|purpose| purpose == &request.purpose)
+    {
+        return Err(AuthorizationError::Unauthorized);
+    }
+    validate_request_subject_shape(requirement, &request.subjects)?;
+
+    let mut matched = Vec::new();
+    for (authority_profile, authority) in bundle.config.authority_profiles.iter() {
+        if !authority.requester_tags.iter().all(|required| {
+            context
+                .requester_tags()
+                .iter()
+                .any(|actual| actual == required)
+        }) {
+            continue;
+        }
+        if context.actor().is_some() && authority.kind != AuthorityKind::Delegated {
+            continue;
+        }
+        for grant in &authority.grants {
+            if grant.requirement != request.requirement
+                || grant.purpose != request.purpose
+                || !same_subject_tuples(&grant.subjects, &request.subjects)
+            {
+                continue;
+            }
+            let uses_authenticated_grant = grant
+                .subjects
+                .iter()
+                .any(|subject| subject.value_origin == ValueOrigin::AuthenticatedGrant);
+            if uses_authenticated_grant && context.grant_authority() != Some(authority_profile) {
+                continue;
+            }
+            matched.push(MatchedEntitlement {
+                authority_profile: authority_profile.to_owned(),
+                authority_kind: authority.kind,
+                response_formats: grant.response_formats.clone(),
+                subjects: grant.subjects.clone(),
+            });
+        }
+    }
+
+    match matched.len() {
+        1 => Ok(matched.remove(0)),
+        0 => Err(AuthorizationError::Unauthorized),
+        _ => Err(AuthorizationError::AmbiguousAuthority),
+    }
+}
+
+/// Resolve the complete role-bound selector set for one matched entitlement.
+///
+/// This is the first operation that inspects caller or authenticated-grant
+/// selector values. It still performs no credential resolution or source
+/// access.
+pub fn resolve_selectors(
+    bundle: &Bundle,
+    request: &EvidenceRequest,
+    context: &AuthenticatedContext,
+    matched: &MatchedEntitlement,
+) -> Result<ResolvedAuthorization, AuthorizationError> {
+    let requirement = bundle
+        .config
+        .requirements
+        .iter()
+        .find(|candidate| candidate.id == request.requirement)
+        .ok_or(AuthorizationError::Unauthorized)?;
+    let subjects = resolve_grant_subjects(
+        bundle,
+        requirement,
+        &matched.subjects,
+        &request.subjects,
+        context,
+    )?;
+    let uses_authenticated_grant = matched
+        .subjects
+        .iter()
+        .any(|subject| subject.value_origin == ValueOrigin::AuthenticatedGrant);
+    Ok(ResolvedAuthorization {
+        authority_profile: matched.authority_profile.clone(),
+        authority_kind: matched.authority_kind,
+        grant_id: uses_authenticated_grant
+            .then(|| context.grant_id().map(ToOwned::to_owned))
+            .flatten(),
+        grant_authority: uses_authenticated_grant
+            .then(|| context.grant_authority().map(ToOwned::to_owned))
+            .flatten(),
+        requirement: request.requirement.clone(),
+        purpose: request.purpose.clone(),
+        audience: context.evidence_audience().to_owned(),
+        subjects,
+    })
+}
+
+/// Confirm that selector values owned by the authenticated context or grant
+/// are present and valid before advertising an entitlement. Request-owned
+/// selector values are intentionally not inspected during discovery.
+pub(crate) fn validate_entitlement_context(
+    bundle: &Bundle,
+    context: &AuthenticatedContext,
+    matched: &MatchedEntitlement,
+) -> Result<(), AuthorizationError> {
+    let uses_authenticated_grant = matched
+        .subjects
+        .iter()
+        .any(|subject| subject.value_origin == ValueOrigin::AuthenticatedGrant);
+    if uses_authenticated_grant
+        && (context.grant_id().is_none()
+            || context.grant_authority() != Some(matched.authority_profile()))
+    {
+        return Err(AuthorizationError::Unauthorized);
+    }
+
+    for grant in &matched.subjects {
+        if grant.value_origin == ValueOrigin::Request {
+            continue;
+        }
+        let profile = bundle
+            .config
+            .selector_profiles
+            .get(&grant.selector_profile)
+            .ok_or(AuthorizationError::Unauthorized)?;
+        let claims = grant
+            .value_claims
+            .as_ref()
+            .ok_or(AuthorizationError::Unauthorized)?;
+        let values = claims
+            .iter()
+            .map(|(field, path)| {
+                let value = context
+                    .claim_path(path)
+                    .and_then(selector_value_from_claim)
+                    .ok_or(AuthorizationError::Selector)?;
+                Ok((field.to_owned(), value))
+            })
+            .collect::<Result<_, AuthorizationError>>()?;
+        validate_values(bundle, profile, &values)?;
+    }
+    Ok(())
+}
+
+/// Resolve exactly one complete entitlement and its complete selector set.
+///
+/// Service code that applies the failed-selector budget uses
+/// [`match_entitlement`] and [`resolve_selectors`] separately. Offline callers
+/// may use this convenience wrapper.
+pub fn authorize_and_resolve(
+    bundle: &Bundle,
+    request: &EvidenceRequest,
+    context: &AuthenticatedContext,
+) -> Result<ResolvedAuthorization, AuthorizationError> {
+    let matched = match_entitlement(bundle, request, context)?;
+    resolve_selectors(bundle, request, context, &matched)
+}
+
+/// Exercise the normal authorization and selector boundary for one captured
+/// offline fixture subject set without token, credential, or source access.
+///
+/// Fixture JSON uses the compact `{role, profile, values}` representation from
+/// the reviewed product bundles. No selector value is included in an error.
+pub fn resolve_offline_fixture_authorization(
+    bundle: &Bundle,
+    requirement: &crate::config::RequirementConfig,
+    common: Option<&serde_json::Map<String, Value>>,
+    case: &serde_json::Map<String, Value>,
+    audience: &str,
+) -> Result<ResolvedAuthorization, OfflineFixtureError> {
+    let purpose = fixture_purpose(&requirement.purposes, common, case)?;
+    let subjects = if let Some(subjects) = case
+        .get("subjects")
+        .or_else(|| common.and_then(|value| value.get("subjects")))
+        .and_then(Value::as_array)
+    {
+        subjects
+            .iter()
+            .map(parse_fixture_subject)
+            .collect::<Result<Vec<_>, _>>()?
+    } else {
+        fixture_subjects_from_selectors(bundle, requirement, purpose, common, case)?
+    };
+    let request = EvidenceRequest {
+        request_nonce: crate::model::OFFLINE_EVALUATION_REQUEST_NONCE.to_owned(),
+        requirement: requirement.id.clone(),
+        purpose: purpose.to_owned(),
+        subjects,
+        holder_key: None,
+    };
+    let (authority_name, authority) = bundle
+        .config
+        .authority_profiles
+        .iter()
+        .find(|(_, authority)| {
+            authority.grants.iter().any(|grant| {
+                grant.requirement == request.requirement
+                    && grant.purpose == request.purpose
+                    && same_subject_tuples(&grant.subjects, &request.subjects)
+            })
+        })
+        .ok_or(AuthorizationError::Unauthorized)?;
+    let claims = case
+        .get("verified_token_claims")
+        .or_else(|| common.and_then(|value| value.get("verified_token_claims")))
+        .cloned()
+        .unwrap_or_else(|| Value::Object(Default::default()));
+    let grant_id = claims
+        .get("evidence_grant_id")
+        .and_then(Value::as_str)
+        .map(ToOwned::to_owned);
+    let grant_authority = claims
+        .get("evidence_authority")
+        .and_then(Value::as_str)
+        .unwrap_or(authority_name)
+        .to_owned();
+    let context = AuthenticatedContext::offline_fixture_context(
+        authority.requester_tags.clone(),
+        audience,
+        grant_id.as_deref(),
+        Some(&grant_authority),
+        claims,
+    );
+    Ok(authorize_and_resolve(bundle, &request, &context)?)
+}
+
+/// Resolve the purpose one fixture case exercises.
+///
+/// A requirement declaring more than one purpose must say which one the case
+/// covers, in the case or in the inherited common block. The harness never
+/// chooses on the fixture's behalf, so offline evaluation reaches every
+/// authorized purpose and no purpose is silently skipped.
+fn fixture_purpose<'a>(
+    purposes: &'a [String],
+    common: Option<&serde_json::Map<String, Value>>,
+    case: &serde_json::Map<String, Value>,
+) -> Result<&'a str, OfflineFixtureError> {
+    match case
+        .get("purpose")
+        .or_else(|| common.and_then(|common| common.get("purpose")))
+    {
+        Some(declared) => {
+            let declared = declared.as_str().ok_or(OfflineFixtureError::Purpose)?;
+            purposes
+                .iter()
+                .find(|purpose| purpose.as_str() == declared)
+                .map(String::as_str)
+                .ok_or(OfflineFixtureError::Authorization(
+                    AuthorizationError::Unauthorized,
+                ))
+        }
+        None => match purposes {
+            [only] => Ok(only.as_str()),
+            _ => Err(OfflineFixtureError::Purpose),
+        },
+    }
+}
+
+fn fixture_subjects_from_selectors(
+    bundle: &Bundle,
+    requirement: &crate::config::RequirementConfig,
+    purpose: &str,
+    common: Option<&serde_json::Map<String, Value>>,
+    case: &serde_json::Map<String, Value>,
+) -> Result<Vec<RequestedSubject>, AuthorizationError> {
+    let mut selectors = case
+        .get("selectors")
+        .or_else(|| common.and_then(|value| value.get("selectors")))
+        .and_then(Value::as_object)
+        .cloned()
+        .ok_or(AuthorizationError::Selector)?;
+    if let Some(overrides) = case.get("selectorOverrides") {
+        let overrides = overrides.as_object().ok_or(AuthorizationError::Selector)?;
+        for (role, replacement) in overrides {
+            let replacement = replacement
+                .as_object()
+                .filter(|object| object.keys().all(|key| key == "profile" || key == "values"))
+                .ok_or(AuthorizationError::Selector)?;
+            let selector = selectors
+                .get_mut(role)
+                .and_then(Value::as_object_mut)
+                .ok_or(AuthorizationError::Selector)?;
+            for (name, value) in replacement {
+                selector.insert(name.clone(), value.clone());
+            }
+        }
+    }
+
+    let mut requested = Vec::with_capacity(requirement.subject_roles.len());
+    for configured_role in &requirement.subject_roles {
+        let mut selector = selectors
+            .remove(&configured_role.role)
+            .and_then(|value| value.as_object().cloned())
+            .ok_or(AuthorizationError::Selector)?;
+        selector.insert(
+            "role".to_owned(),
+            Value::String(configured_role.role.clone()),
+        );
+        requested.push(parse_fixture_subject(&Value::Object(selector))?);
+    }
+    if !selectors.is_empty() {
+        return Err(AuthorizationError::Selector);
+    }
+
+    let grant = bundle
+        .config
+        .authority_profiles
+        .iter()
+        .flat_map(|(_, authority)| authority.grants.iter())
+        .find(|grant| {
+            grant.requirement == requirement.id
+                && grant.purpose == purpose
+                && same_subject_tuples(&grant.subjects, &requested)
+        })
+        .ok_or(AuthorizationError::Unauthorized)?;
+    for subject in &mut requested {
+        let granted = grant
+            .subjects
+            .iter()
+            .find(|granted| granted.role == subject.role)
+            .ok_or(AuthorizationError::Unauthorized)?;
+        if granted.value_origin != ValueOrigin::Request {
+            subject.selector.values = None;
+        }
+    }
+    Ok(requested)
+}
+
+pub fn resolve_offline_fixture_subjects(
+    bundle: &Bundle,
+    requirement: &crate::config::RequirementConfig,
+    common: Option<&serde_json::Map<String, Value>>,
+    case: &serde_json::Map<String, Value>,
+    audience: &str,
+) -> Result<Vec<String>, OfflineFixtureError> {
+    resolve_offline_fixture_authorization(bundle, requirement, common, case, audience).map(
+        |resolved| {
+            resolved
+                .subjects
+                .into_iter()
+                .map(|subject| subject.role)
+                .collect()
+        },
+    )
+}
+
+fn parse_fixture_subject(value: &Value) -> Result<RequestedSubject, AuthorizationError> {
+    let object = value.as_object().ok_or(AuthorizationError::Selector)?;
+    if object
+        .keys()
+        .any(|key| !matches!(key.as_str(), "role" | "profile" | "values"))
+    {
+        return Err(AuthorizationError::Selector);
+    }
+    let role = object
+        .get("role")
+        .and_then(Value::as_str)
+        .ok_or(AuthorizationError::Selector)?;
+    let profile = object
+        .get("profile")
+        .and_then(Value::as_str)
+        .ok_or(AuthorizationError::Selector)?;
+    let values = object
+        .get("values")
+        .map(|values| {
+            values
+                .as_object()
+                .ok_or(AuthorizationError::Selector)?
+                .iter()
+                .map(|(name, value)| {
+                    let value = match value {
+                        Value::String(value) => SelectorValue::String(value.clone()),
+                        Value::Number(value) => value
+                            .as_i64()
+                            .map(SelectorValue::Integer)
+                            .ok_or(AuthorizationError::Selector)?,
+                        Value::Bool(value) => SelectorValue::Boolean(*value),
+                        _ => return Err(AuthorizationError::Selector),
+                    };
+                    Ok((name.clone(), value))
+                })
+                .collect::<Result<_, AuthorizationError>>()
+        })
+        .transpose()?;
+    Ok(RequestedSubject {
+        role: role.to_owned(),
+        selector: crate::model::RequestedSelector {
+            profile: profile.to_owned(),
+            values,
+        },
+    })
+}
+
+fn validate_request_subject_shape(
+    requirement: &crate::config::RequirementConfig,
+    requested: &[RequestedSubject],
+) -> Result<(), AuthorizationError> {
+    if requested.len() != requirement.subject_roles.len() {
+        return Err(AuthorizationError::Unauthorized);
+    }
+    let mut roles = BTreeSet::new();
+    for subject in requested {
+        if !roles.insert(subject.role.as_str()) {
+            return Err(AuthorizationError::Unauthorized);
+        }
+        let configured = requirement
+            .subject_roles
+            .iter()
+            .find(|configured| configured.role == subject.role)
+            .ok_or(AuthorizationError::Unauthorized)?;
+        if !configured
+            .selector_profiles
+            .iter()
+            .any(|profile| profile == &subject.selector.profile)
+        {
+            return Err(AuthorizationError::Unauthorized);
+        }
+    }
+    Ok(())
+}
+
+fn same_subject_tuples(granted: &[GrantedSubject], requested: &[RequestedSubject]) -> bool {
+    granted.len() == requested.len()
+        && granted.iter().all(|grant| {
+            requested.iter().any(|subject| {
+                subject.role == grant.role && subject.selector.profile == grant.selector_profile
+            })
+        })
+}
+
+/// Resolve subjects by unique role and emit the requirement's declaration
+/// order. Neither grant order nor request array order is semantic.
+fn resolve_grant_subjects(
+    bundle: &Bundle,
+    requirement: &crate::config::RequirementConfig,
+    granted: &[GrantedSubject],
+    requested: &[RequestedSubject],
+    context: &AuthenticatedContext,
+) -> Result<Vec<ResolvedSubject>, AuthorizationError> {
+    let uses_authenticated_grant = granted
+        .iter()
+        .any(|subject| subject.value_origin == ValueOrigin::AuthenticatedGrant);
+    if uses_authenticated_grant
+        && (context.grant_id().is_none() || context.grant_authority().is_none())
+    {
+        return Err(AuthorizationError::Unauthorized);
+    }
+    if granted.len() != requirement.subject_roles.len() {
+        return Err(AuthorizationError::Unauthorized);
+    }
+
+    requirement
+        .subject_roles
+        .iter()
+        .map(|declared| {
+            let grant = granted
+                .iter()
+                .find(|grant| grant.role == declared.role)
+                .ok_or(AuthorizationError::Unauthorized)?;
+            let subject = requested
+                .iter()
+                .find(|subject| subject.role == grant.role)
+                .ok_or(AuthorizationError::Unauthorized)?;
+            let profile = bundle
+                .config
+                .selector_profiles
+                .get(&grant.selector_profile)
+                .ok_or(AuthorizationError::Unauthorized)?;
+            let input = match grant.value_origin {
+                ValueOrigin::Request => subject
+                    .selector
+                    .values
+                    .as_ref()
+                    .ok_or(AuthorizationError::Selector)?
+                    .clone(),
+                ValueOrigin::AuthenticatedContext | ValueOrigin::AuthenticatedGrant => {
+                    if subject.selector.values.is_some() {
+                        return Err(AuthorizationError::Selector);
+                    }
+                    let claims = grant
+                        .value_claims
+                        .as_ref()
+                        .ok_or(AuthorizationError::Unauthorized)?;
+                    claims
+                        .iter()
+                        .map(|(field, path)| {
+                            let value = context
+                                .claim_path(path)
+                                .and_then(selector_value_from_claim)
+                                .ok_or(AuthorizationError::Selector)?;
+                            Ok((field.to_owned(), value))
+                        })
+                        .collect::<Result<_, AuthorizationError>>()?
+                }
+            };
+            let fields = validate_values(bundle, profile, &input)?;
+            Ok(ResolvedSubject {
+                role: grant.role.clone(),
+                selector_profile: subject.selector.profile.clone(),
+                value_origin: grant.value_origin,
+                fields,
+            })
+        })
+        .collect()
+}
+
+fn selector_value_from_claim(value: &Value) -> Option<SelectorValue> {
+    match value {
+        Value::String(value) => Some(SelectorValue::String(value.clone())),
+        Value::Number(value) => value.as_i64().map(SelectorValue::Integer),
+        Value::Bool(value) => Some(SelectorValue::Boolean(*value)),
+        _ => None,
+    }
+}
+
+fn validate_values(
+    bundle: &Bundle,
+    profile: &SelectorProfile,
+    values: &std::collections::BTreeMap<String, SelectorValue>,
+) -> Result<Vec<ResolvedSelectorField>, AuthorizationError> {
+    if values.len() != profile.fields.len()
+        || profile
+            .fields
+            .keys()
+            .any(|field| !values.contains_key(field))
+        || values
+            .keys()
+            .any(|field| !profile.fields.contains_key(field))
+    {
+        return Err(AuthorizationError::Selector);
+    }
+
+    let mut aggregate_bytes = 0_u64;
+    let mut output = Vec::with_capacity(values.len());
+    for (name, configured) in profile.fields.iter() {
+        let supplied = values.get(name).ok_or(AuthorizationError::Selector)?;
+        let resolved = validate_value(bundle, configured, supplied)?;
+        let value_bytes = match &resolved {
+            ResolvedSelectorValue::Integer(value) => value.to_string().len(),
+            ResolvedSelectorValue::Boolean(_) => 1,
+            _ => resolved.canonical_bytes().len(),
+        };
+        aggregate_bytes = aggregate_bytes
+            .checked_add(u64::try_from(value_bytes).map_err(|_| AuthorizationError::Selector)?)
+            .ok_or(AuthorizationError::Selector)?;
+        output.push(ResolvedSelectorField {
+            name: name.to_owned(),
+            value: resolved,
+        });
+    }
+    if aggregate_bytes > profile.maximum_aggregate_bytes {
+        return Err(AuthorizationError::Selector);
+    }
+    Ok(output)
+}
+
+fn validate_value(
+    bundle: &Bundle,
+    configured: &ConfiguredField,
+    supplied: &SelectorValue,
+) -> Result<ResolvedSelectorValue, AuthorizationError> {
+    match (configured, supplied) {
+        (
+            ConfiguredField::String {
+                minimum_bytes,
+                maximum_bytes,
+            },
+            SelectorValue::String(value),
+        ) if bounded(value.len(), *minimum_bytes, *maximum_bytes) => {
+            Ok(ResolvedSelectorValue::String(value.clone()))
+        }
+        (ConfiguredField::Date, SelectorValue::String(value))
+            if canonical_date(value).is_some() =>
+        {
+            Ok(ResolvedSelectorValue::Date(value.clone()))
+        }
+        (ConfiguredField::Integer { minimum, maximum }, SelectorValue::Integer(value))
+            if value >= minimum
+                && value <= maximum
+                && value.unsigned_abs() <= MAX_SAFE_INTEGER as u64 =>
+        {
+            Ok(ResolvedSelectorValue::Integer(*value))
+        }
+        (ConfiguredField::Boolean, SelectorValue::Boolean(value)) => {
+            Ok(ResolvedSelectorValue::Boolean(*value))
+        }
+        (
+            ConfiguredField::ControlledCode {
+                codelist,
+                codelist_version,
+                maximum_bytes,
+            },
+            SelectorValue::String(value),
+        ) if bounded(value.len(), 1, *maximum_bytes) => {
+            let list = bundle
+                .codelist(codelist)
+                .ok_or(AuthorizationError::Selector)?;
+            if list.version() != codelist_version || !codelist_contains_selector_value(list, value)
+            {
+                return Err(AuthorizationError::Selector);
+            }
+            Ok(ResolvedSelectorValue::ControlledCode(value.clone()))
+        }
+        _ => Err(AuthorizationError::Selector),
+    }
+}
+
+fn codelist_contains_selector_value(codelist: &Codelist, value: &str) -> bool {
+    match codelist {
+        Codelist::Codes { codes, .. } => codes.iter().any(|code| code == value),
+        Codelist::Mapping { entries, .. } => entries.contains_key(value),
+    }
+}
+
+fn canonical_date(value: &str) -> Option<NaiveDate> {
+    if value.len() != 10 {
+        return None;
+    }
+    NaiveDate::parse_from_str(value, "%Y-%m-%d")
+        .ok()
+        .filter(|date| date.format("%Y-%m-%d").to_string() == value)
+}
+
+fn bounded(actual: usize, minimum: u64, maximum: u64) -> bool {
+    u64::try_from(actual).is_ok_and(|actual| (minimum..=maximum).contains(&actual))
+}
+
+fn push_component(output: &mut Vec<u8>, component: &[u8]) -> Result<(), AuthorizationError> {
+    if component.is_empty() || output.len().saturating_add(component.len()) > MAX_CANONICAL_BYTES {
+        return Err(AuthorizationError::Selector);
+    }
+    let length = u32::try_from(component.len()).map_err(|_| AuthorizationError::Selector)?;
+    output.extend_from_slice(&length.to_be_bytes());
+    output.extend_from_slice(component);
+    Ok(())
+}
+
+fn push_count(output: &mut Vec<u8>, count: usize) -> Result<(), AuthorizationError> {
+    let count = u32::try_from(count).map_err(|_| AuthorizationError::Selector)?;
+    output.extend_from_slice(&count.to_be_bytes());
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn resolved_selector_debug_never_exposes_values() {
+        let subject = ResolvedSubject {
+            role: "subject".to_owned(),
+            selector_profile: "opaque-v1".to_owned(),
+            value_origin: ValueOrigin::Request,
+            fields: vec![ResolvedSelectorField {
+                name: "opaque".to_owned(),
+                value: ResolvedSelectorValue::String("selector-canary".to_owned()),
+            }],
+        };
+        let debug = format!("{subject:?}");
+        assert!(!debug.contains("selector-canary"));
+        assert!(debug.contains("opaque"));
+    }
+
+    #[test]
+    fn canonical_selector_input_is_order_and_audience_sensitive() {
+        let subject = ResolvedSubject {
+            role: "subject".to_owned(),
+            selector_profile: "opaque-v1".to_owned(),
+            value_origin: ValueOrigin::Request,
+            fields: vec![ResolvedSelectorField {
+                name: "field".to_owned(),
+                value: ResolvedSelectorValue::String("value".to_owned()),
+            }],
+        };
+        let first = subject
+            .audit_pseudonym_input("urn:audience:a", "purpose")
+            .expect("canonicalizes");
+        let second = subject
+            .audit_pseudonym_input("urn:audience:b", "purpose")
+            .expect("canonicalizes");
+        assert_ne!(first, second);
+    }
+
+    #[test]
+    fn selector_claim_values_are_scalar_only() {
+        assert!(selector_value_from_claim(&serde_json::json!({"value": "x"})).is_none());
+        assert!(selector_value_from_claim(&serde_json::json!(["x"])).is_none());
+        assert_eq!(
+            selector_value_from_claim(&serde_json::json!(false)),
+            Some(SelectorValue::Boolean(false))
+        );
+    }
+
+    fn fixture_object(value: Value) -> serde_json::Map<String, Value> {
+        value
+            .as_object()
+            .expect("fixture block is an object")
+            .clone()
+    }
+
+    #[test]
+    fn a_single_purpose_requirement_needs_no_declared_fixture_purpose() {
+        let purposes = vec!["only-purpose".to_owned()];
+        assert_eq!(
+            fixture_purpose(&purposes, None, &fixture_object(serde_json::json!({}))),
+            Ok("only-purpose")
+        );
+    }
+
+    #[test]
+    fn a_fixture_selects_one_of_several_declared_purposes() {
+        let purposes = vec!["first".to_owned(), "second".to_owned()];
+        assert_eq!(
+            fixture_purpose(
+                &purposes,
+                None,
+                &fixture_object(serde_json::json!({"purpose": "second"}))
+            ),
+            Ok("second")
+        );
+    }
+
+    #[test]
+    fn a_common_fixture_purpose_applies_to_every_case() {
+        let purposes = vec!["first".to_owned(), "second".to_owned()];
+        let common = fixture_object(serde_json::json!({"purpose": "second"}));
+        assert_eq!(
+            fixture_purpose(
+                &purposes,
+                Some(&common),
+                &fixture_object(serde_json::json!({}))
+            ),
+            Ok("second")
+        );
+    }
+
+    #[test]
+    fn a_case_fixture_purpose_overrides_the_common_purpose() {
+        let purposes = vec!["first".to_owned(), "second".to_owned()];
+        let common = fixture_object(serde_json::json!({"purpose": "first"}));
+        assert_eq!(
+            fixture_purpose(
+                &purposes,
+                Some(&common),
+                &fixture_object(serde_json::json!({"purpose": "second"}))
+            ),
+            Ok("second")
+        );
+    }
+
+    #[test]
+    fn a_multi_purpose_requirement_without_a_declared_purpose_is_a_fixture_error() {
+        let purposes = vec!["first".to_owned(), "second".to_owned()];
+        let error = fixture_purpose(&purposes, None, &fixture_object(serde_json::json!({})))
+            .expect_err("an unselected purpose is rejected");
+        assert_eq!(error, OfflineFixtureError::Purpose);
+        assert_ne!(
+            error,
+            OfflineFixtureError::Authorization(AuthorizationError::Unauthorized),
+            "an unselected fixture purpose must not be reported as an authorization denial"
+        );
+    }
+
+    #[test]
+    fn a_non_string_fixture_purpose_is_a_fixture_error() {
+        let purposes = vec!["first".to_owned(), "second".to_owned()];
+        assert_eq!(
+            fixture_purpose(
+                &purposes,
+                None,
+                &fixture_object(serde_json::json!({"purpose": 1}))
+            ),
+            Err(OfflineFixtureError::Purpose)
+        );
+    }
+
+    #[test]
+    fn a_fixture_purpose_outside_the_requirement_is_unauthorized() {
+        let purposes = vec!["first".to_owned()];
+        assert_eq!(
+            fixture_purpose(
+                &purposes,
+                None,
+                &fixture_object(serde_json::json!({"purpose": "other"}))
+            ),
+            Err(OfflineFixtureError::Authorization(
+                AuthorizationError::Unauthorized
+            ))
+        );
+    }
+}
diff --git a/crates/registry-evidence/src/server.rs b/crates/registry-evidence/src/server.rs
new file mode 100644
index 000000000..3ab93429a
--- /dev/null
+++ b/crates/registry-evidence/src/server.rs
@@ -0,0 +1,1094 @@
+//! Native Evidence Version 1 HTTP boundary.
+//!
+//! Request admission, body collection, and concurrency queueing observe the
+//! configured request timeout. Once [`EvidenceRuntime::evaluate`] starts, this
+//! boundary deliberately does not wrap it in a cancelling timeout: evaluation
+//! contains the durable access-audit, signing, and durable release-audit
+//! critical section.
+
+use std::{
+    future::{Future, IntoFuture},
+    io,
+    net::{IpAddr, SocketAddr},
+    sync::{
+        atomic::{AtomicUsize, Ordering},
+        Arc,
+    },
+    time::{Duration, Instant},
+};
+
+use axum::{
+    body::{to_bytes, Body},
+    extract::State,
+    http::{
+        header::{
+            ACCEPT, AUTHORIZATION, CACHE_CONTROL, CONTENT_LENGTH, CONTENT_TYPE, RETRY_AFTER, VARY,
+        },
+        HeaderMap, HeaderValue, Request, StatusCode,
+    },
+    middleware::{from_fn, from_fn_with_state, Next},
+    response::{IntoResponse, Response},
+    routing::{get, post},
+    Router,
+};
+use registry_platform_crypto::parse_json_strict;
+use registry_platform_httpsec::CspBuilder;
+use serde::Serialize;
+use tokio::{net::TcpListener, sync::Semaphore};
+
+use crate::{
+    config::{ListenerConfig, ResponseFormat},
+    contracts::{request_contract_accepts, served_openapi_document},
+    model::{request_nonce_is_canonical, EvidenceRequest, JwksDocument},
+    observability::{self, operation_id, Metrics},
+    problem::ProblemCode,
+    runtime::{EvidenceRuntime, RuntimeFailure},
+    EVIDENCE_JWS_MEDIA_TYPE, EVIDENCE_SD_JWT_VC_MEDIA_TYPE, EVIDENCE_UNSIGNED_MEDIA_TYPE,
+};
+
+const EVIDENCE_ROUTE: &str = "/v1/evidence";
+const DEFINITIONS_ROUTE: &str = "/v1/evidence-definitions";
+const HEALTH_ROUTE: &str = "/health";
+const OPENAPI_ROUTE: &str = "/openapi.json";
+const READY_ROUTE: &str = "/ready";
+const JWKS_ROUTE: &str = "/.well-known/evidence/jwks.json";
+const JWT_VC_ISSUER_ROUTE: &str = "/.well-known/jwt-vc-issuer";
+
+/// Every route template this listener registers.
+///
+/// Operational telemetry labels requests with a member of this set or with a
+/// single fixed unmatched label, so a caller cannot introduce a label value.
+pub(crate) const ROUTE_TEMPLATES: [&str; 7] = [
+    EVIDENCE_ROUTE,
+    DEFINITIONS_ROUTE,
+    HEALTH_ROUTE,
+    OPENAPI_ROUTE,
+    READY_ROUTE,
+    JWKS_ROUTE,
+    JWT_VC_ISSUER_ROUTE,
+];
+
+const JSON_MEDIA_TYPE: &str = "application/json";
+const PROBLEM_MEDIA_TYPE: &str = "application/problem+json";
+const JWKS_MEDIA_TYPE: &str = "application/jwk-set+json";
+const OPENAPI_MEDIA_TYPE: &str = "application/openapi+json";
+const RETRY_AFTER_SECONDS: &str = "1";
+
+#[derive(Clone)]
+struct ServerState {
+    runtime: Arc<EvidenceRuntime>,
+    maximum_request_bytes: usize,
+    request_timeout: Duration,
+    request_slots: Arc<Semaphore>,
+    evaluations: EvaluationTracker,
+    #[cfg(test)]
+    evaluation_time: Option<chrono::DateTime<chrono::Utc>>,
+}
+
+/// Build the complete Version 1 application from one immutable runtime.
+#[cfg(test)]
+pub(crate) fn build_app(runtime: Arc<EvidenceRuntime>) -> Router {
+    build_app_with_tracker(runtime).0
+}
+
+#[cfg(test)]
+pub(crate) fn build_app_at_for_test(
+    runtime: Arc<EvidenceRuntime>,
+    evaluation_time: chrono::DateTime<chrono::Utc>,
+) -> Router {
+    build_app_with_tracker_at(runtime, Some(evaluation_time)).0
+}
+
+/// Build the application together with the registry its observation layer
+/// feeds, so a test can read the counters a request produced.
+#[cfg(test)]
+pub(crate) fn build_app_with_metrics(runtime: Arc<EvidenceRuntime>) -> (Router, Arc<Metrics>) {
+    let (app, _evaluations, metrics) = build_app_with_tracker_at(runtime, None);
+    (app, metrics)
+}
+
+fn build_app_with_tracker(
+    runtime: Arc<EvidenceRuntime>,
+) -> (Router, EvaluationTracker, Arc<Metrics>) {
+    build_app_with_tracker_at(runtime, None)
+}
+
+fn build_app_with_tracker_at(
+    runtime: Arc<EvidenceRuntime>,
+    evaluation_time: Option<chrono::DateTime<chrono::Utc>>,
+) -> (Router, EvaluationTracker, Arc<Metrics>) {
+    #[cfg(not(test))]
+    let _ = evaluation_time;
+    let listener = &runtime.runtime_config().listener;
+    let maximum_request_bytes = listener.maximum_request_bytes as usize;
+    let request_timeout = Duration::from_millis(listener.request_timeout_milliseconds);
+    let maximum_concurrent_requests = listener.maximum_concurrent_requests as usize;
+    let evaluations = EvaluationTracker::default();
+    // Captured before `runtime` moves into the evidence app's state, so the
+    // metrics registry can sample the same rate limiter the evidence routes
+    // use, on the separate opt-in metrics listener.
+    let rate_limiter = runtime.rate_limiter();
+    let audit = runtime.audit();
+    let state = Arc::new(ServerState {
+        runtime,
+        maximum_request_bytes,
+        request_timeout,
+        request_slots: Arc::new(Semaphore::new(maximum_concurrent_requests)),
+        evaluations: evaluations.clone(),
+        #[cfg(test)]
+        evaluation_time,
+    });
+
+    let routes = Router::new()
+        .route(EVIDENCE_ROUTE, post(create_evidence))
+        .route(DEFINITIONS_ROUTE, get(discover_evidence))
+        .route(HEALTH_ROUTE, get(health))
+        .route(OPENAPI_ROUTE, get(openapi))
+        .route(READY_ROUTE, get(ready))
+        .route(JWKS_ROUTE, get(jwks))
+        .route(JWT_VC_ISSUER_ROUTE, get(jwt_vc_issuer_metadata))
+        .fallback(unknown_route)
+        .method_not_allowed_fallback(unknown_route)
+        .with_state(state);
+    let metrics = Arc::new(Metrics::new(rate_limiter, audit));
+    (
+        response_layers(routes, Arc::clone(&metrics)),
+        evaluations,
+        metrics,
+    )
+}
+
+#[derive(Clone, Default)]
+struct EvaluationTracker {
+    inner: Arc<EvaluationTrackerInner>,
+}
+
+#[derive(Default)]
+struct EvaluationTrackerInner {
+    active: AtomicUsize,
+    idle: tokio::sync::Notify,
+}
+
+impl EvaluationTracker {
+    fn spawn<F, T>(&self, future: F) -> tokio::task::JoinHandle<T>
+    where
+        F: Future<Output = T> + Send + 'static,
+        T: Send + 'static,
+    {
+        self.inner.active.fetch_add(1, Ordering::AcqRel);
+        let guard = ActiveEvaluation {
+            tracker: self.clone(),
+        };
+        tokio::spawn(async move {
+            let _guard = guard;
+            future.await
+        })
+    }
+
+    async fn wait_idle(&self) {
+        loop {
+            let idle = self.inner.idle.notified();
+            if self.inner.active.load(Ordering::Acquire) == 0 {
+                return;
+            }
+            idle.await;
+        }
+    }
+}
+
+struct ActiveEvaluation {
+    tracker: EvaluationTracker,
+}
+
+impl Drop for ActiveEvaluation {
+    fn drop(&mut self) {
+        if self.tracker.inner.active.fetch_sub(1, Ordering::AcqRel) == 1 {
+            self.tracker.inner.idle.notify_one();
+        }
+    }
+}
+
+fn response_layers(routes: Router, metrics: Arc<Metrics>) -> Router {
+    routes
+        .layer(from_fn(add_no_store))
+        .layer(registry_platform_httpsec::corp_conditional())
+        .layer(
+            registry_platform_httpsec::security_headers(CspBuilder::restrictive()).without_hsts(),
+        )
+        // Outermost, so that every response including both fallbacks carries a
+        // correlation identifier and produces exactly one operational record.
+        .layer(from_fn_with_state(metrics, observability::observe))
+}
+
+/// Bind the configured private listener and serve until graceful shutdown.
+pub async fn serve<F>(runtime: Arc<EvidenceRuntime>, shutdown: F) -> io::Result<()>
+where
+    F: Future<Output = ()> + Send + 'static,
+{
+    let listener_config = runtime.runtime_config().listener.clone();
+    let metrics_config = runtime.runtime_config().metrics_listener.clone();
+    let bundle_revision = runtime.bundle().revision().to_owned();
+    let runtime_revision = runtime.runtime_revision().to_owned();
+    let listener = bind(&listener_config.bind_host, listener_config.port).await?;
+    let startup_runtime = Arc::clone(&runtime);
+    let (app, evaluations, metrics) = build_app_with_tracker(runtime);
+
+    // Both listeners are bound before either serves, so a misconfigured
+    // metrics binding fails startup instead of leaving a service that reports
+    // healthy while publishing no telemetry.
+    let metrics_listener = match &metrics_config {
+        Some(config) => Some(bind(&config.bind_host, config.port).await?),
+        None => None,
+    };
+
+    // Announced only once both listeners are held, because whatever already
+    // owns a taken port answers in this service's place. A start announced
+    // before the bind reads as success to anyone who backgrounds the process
+    // and greps the log, and their verification run then tests the deployment
+    // that won the port.
+    tracing::info!(
+        target: "registry_evidence::startup",
+        bundle_revision,
+        runtime_revision,
+        bind_host = listener_config.bind_host,
+        port = listener_config.port,
+        metrics = metrics_config.is_some(),
+        "evidence service listening"
+    );
+    // Said here rather than left to the first rejected request, which an
+    // operator reads as a bad token. Reported, not fatal: readiness is what
+    // withholds traffic until the key set is in hand.
+    startup_runtime.announce_key_source().await;
+    let (stop_metrics, metrics_stopped) = tokio::sync::watch::channel(());
+    let metrics_server = metrics_listener.map(|listener| {
+        let mut stopped = metrics_stopped;
+        tokio::spawn(async move {
+            axum::serve(listener, observability::metrics_app(metrics))
+                .with_graceful_shutdown(async move {
+                    // A dropped sender also ends the wait, so the metrics
+                    // listener cannot outlive a failed evidence listener.
+                    let _ = stopped.changed().await;
+                })
+                .await
+        })
+    });
+
+    let result = serve_listener(listener, app, &listener_config, async move {
+        shutdown.await;
+        drop(stop_metrics);
+    })
+    .await;
+    if let Some(server) = metrics_server {
+        let _ = server.await;
+    }
+
+    // A disconnected client can cause axum to drop its handler future. The
+    // admitted evaluation itself is owned by a detached task, so the server
+    // must explicitly drain those tasks before production shutdown returns.
+    evaluations.wait_idle().await;
+    result
+}
+
+/// Bind one listener, naming the address in any failure.
+///
+/// A bind failure is reported to an operator who configured two addresses and
+/// controls neither exclusively. Without the address, the two most common
+/// causes read alike and neither points at its fix: a port already taken by
+/// another process, and an address this host does not own.
+async fn bind(bind_host: &str, port: u16) -> io::Result<TcpListener> {
+    let ip = bind_host.parse::<IpAddr>().map_err(|error| {
+        io::Error::new(
+            io::ErrorKind::InvalidInput,
+            format!("{bind_host} is not an address: {error}"),
+        )
+    })?;
+    TcpListener::bind(SocketAddr::new(ip, port))
+        .await
+        .map_err(|error| {
+            io::Error::new(error.kind(), format!("could not bind {ip}:{port}: {error}"))
+        })
+}
+
+/// Serve a pre-bound listener and drain client-bound handlers on shutdown.
+///
+/// The grace duration is an operational target, not a cancellation boundary.
+/// A request already inside runtime evaluation is allowed to complete even if
+/// it exceeds that target, preserving the audit and signing invariants. The
+/// production [`serve`] entry point additionally drains detached evaluations.
+async fn serve_listener<F>(
+    listener: TcpListener,
+    app: Router,
+    config: &ListenerConfig,
+    shutdown: F,
+) -> io::Result<()>
+where
+    F: Future<Output = ()> + Send + 'static,
+{
+    let grace = Duration::from_millis(config.shutdown_grace_milliseconds);
+    let (shutdown_started_tx, shutdown_started_rx) = tokio::sync::oneshot::channel();
+    let graceful = async move {
+        shutdown.await;
+        let _ = shutdown_started_tx.send(());
+    };
+    let server = axum::serve(listener, app)
+        .with_graceful_shutdown(graceful)
+        .into_future();
+    tokio::pin!(server);
+
+    let grace_watch = async move {
+        if shutdown_started_rx.await.is_ok() {
+            tokio::time::sleep(grace).await;
+            tracing::warn!(
+                target: "registry_evidence::server",
+                "graceful shutdown target elapsed; waiting for protected operations to finish"
+            );
+        }
+        std::future::pending::<()>().await;
+    };
+    tokio::pin!(grace_watch);
+
+    tokio::select! {
+        result = &mut server => result,
+        () = &mut grace_watch => unreachable!("shutdown grace watcher never completes"),
+    }
+}
+
+#[cfg(test)]
+pub(crate) async fn serve_listener_for_test<F>(
+    runtime: Arc<EvidenceRuntime>,
+    listener: TcpListener,
+    shutdown: F,
+) -> io::Result<()>
+where
+    F: Future<Output = ()> + Send + 'static,
+{
+    let listener_config = runtime.runtime_config().listener.clone();
+    let (app, evaluations, _metrics) = build_app_with_tracker(runtime);
+    let result = serve_listener(listener, app, &listener_config, shutdown).await;
+    evaluations.wait_idle().await;
+    result
+}
+
+/// Every `/v1/evidence` response varies on the negotiated `Accept` value.
+async fn create_evidence(
+    State(state): State<Arc<ServerState>>,
+    request: Request<Body>,
+) -> Response {
+    let mut response = create_evidence_negotiated(state, request).await;
+    response
+        .headers_mut()
+        .insert(VARY, HeaderValue::from_static("Accept"));
+    response
+}
+
+async fn create_evidence_negotiated(state: Arc<ServerState>, request: Request<Body>) -> Response {
+    let operation = operation_id(request.extensions());
+    let started = Instant::now();
+
+    let access_token = match bearer_token(request.headers()) {
+        Ok(token) => token.to_owned(),
+        Err(code) => return problem_response(code, &operation),
+    };
+    // Strict media negotiation resolves the requested response format before
+    // the body is read and long before credential acquisition or source
+    // access. Selection creates no permission; the bundle and matched grant
+    // decide authorization later.
+    let format = match resolve_response_format(request.headers()) {
+        Ok(format) => format,
+        Err(code) => return problem_response(code, &operation),
+    };
+    if !has_exact_content_type(request.headers(), JSON_MEDIA_TYPE)
+        || content_length_exceeds(request.headers(), state.maximum_request_bytes)
+    {
+        return problem_response(ProblemCode::MalformedRequest, &operation);
+    }
+
+    let admission_budget = match remaining(state.request_timeout, started) {
+        Some(remaining) => remaining,
+        None => return problem_response(ProblemCode::ServiceUnavailable, &operation),
+    };
+    let request_slot = match tokio::time::timeout(
+        admission_budget,
+        Arc::clone(&state.request_slots).acquire_owned(),
+    )
+    .await
+    {
+        Ok(Ok(permit)) => permit,
+        Ok(Err(_)) | Err(_) => {
+            return problem_response(ProblemCode::ServiceUnavailable, &operation)
+        }
+    };
+
+    let body_budget = match remaining(state.request_timeout, started) {
+        Some(remaining) => remaining,
+        None => return problem_response(ProblemCode::ServiceUnavailable, &operation),
+    };
+    let body = match tokio::time::timeout(
+        body_budget,
+        to_bytes(request.into_body(), state.maximum_request_bytes),
+    )
+    .await
+    {
+        Ok(Ok(body)) => body,
+        Ok(Err(_)) => return problem_response(ProblemCode::MalformedRequest, &operation),
+        Err(_) => return problem_response(ProblemCode::ServiceUnavailable, &operation),
+    };
+    let evidence_request = match parse_evidence_request(&body) {
+        Ok(request) => request,
+        Err(code) => return problem_response(code, &operation),
+    };
+
+    // The tracker-owned task, rather than this client-bound handler, owns the
+    // admitted concurrency permit and complete fail-closed evaluation. If the
+    // client disconnects while the handler awaits the join handle, dropping
+    // that handle detaches the task instead of cancelling its audit writes.
+    let evaluation_operation = operation.clone();
+    let runtime = Arc::clone(&state.runtime);
+    let evaluations = state.evaluations.clone();
+    #[cfg(test)]
+    let evaluation_time = state.evaluation_time;
+    let evaluation = evaluations.spawn(async move {
+        let _request_slot = request_slot;
+        #[cfg(test)]
+        if let Some(evaluation_time) = evaluation_time {
+            return runtime
+                .evaluate_at_for_test(
+                    &evaluation_operation,
+                    &access_token,
+                    &evidence_request,
+                    format,
+                    evaluation_time,
+                )
+                .await;
+        }
+        runtime
+            .evaluate_with_format(
+                &evaluation_operation,
+                &access_token,
+                &evidence_request,
+                format,
+            )
+            .await
+    });
+    let result = match evaluation.await {
+        Ok(result) => result,
+        Err(_) => return problem_response(ProblemCode::ServiceUnavailable, &operation),
+    };
+
+    match result {
+        // Release exactly the immutable bytes serialized before the durable
+        // disclosure-release audit event, with their exact media type.
+        Ok(released) => {
+            let media_type = released.media_type();
+            bytes_response(StatusCode::OK, media_type, released.into_bytes())
+        }
+        Err(failure) => runtime_failure_response(failure, &operation),
+    }
+}
+
+/// Resolve the closed Version 1 `Accept` matrix. Missing, `*/*`, and the exact
+/// signed media type select signed JWS; only the exact unsigned vendor media
+/// type selects the unsigned envelope, and only the exact SD-JWT VC media type
+/// selects that serialization. Duplicate, combined, parameterized, weighted, or
+/// unknown negotiation is not acceptable.
+fn resolve_response_format(headers: &HeaderMap) -> Result<ResponseFormat, ProblemCode> {
+    let mut values = headers.get_all(ACCEPT).iter();
+    let Some(value) = values.next() else {
+        return Ok(ResponseFormat::SignedJws);
+    };
+    if values.next().is_some() {
+        return Err(ProblemCode::ResponseFormatNotAcceptable);
+    }
+    match value.as_bytes() {
+        b"*/*" => Ok(ResponseFormat::SignedJws),
+        value if value == EVIDENCE_JWS_MEDIA_TYPE.as_bytes() => Ok(ResponseFormat::SignedJws),
+        value if value == EVIDENCE_UNSIGNED_MEDIA_TYPE.as_bytes() => {
+            Ok(ResponseFormat::UnsignedJson)
+        }
+        value if value == EVIDENCE_SD_JWT_VC_MEDIA_TYPE.as_bytes() => Ok(ResponseFormat::SdJwtVc),
+        _ => Err(ProblemCode::ResponseFormatNotAcceptable),
+    }
+}
+
+async fn discover_evidence(
+    State(state): State<Arc<ServerState>>,
+    request: Request<Body>,
+) -> Response {
+    let operation = operation_id(request.extensions());
+    let started = Instant::now();
+    let access_token = match bearer_token(request.headers()) {
+        Ok(token) => token.to_owned(),
+        Err(code) => return problem_response(code, &operation),
+    };
+    if request.uri().query().is_some() || content_length_exceeds(request.headers(), 0) {
+        return problem_response(ProblemCode::MalformedRequest, &operation);
+    }
+    let admission_budget = match remaining(state.request_timeout, started) {
+        Some(remaining) => remaining,
+        None => return problem_response(ProblemCode::ServiceUnavailable, &operation),
+    };
+    let _request_slot = match tokio::time::timeout(
+        admission_budget,
+        Arc::clone(&state.request_slots).acquire_owned(),
+    )
+    .await
+    {
+        Ok(Ok(permit)) => permit,
+        Ok(Err(_)) | Err(_) => {
+            return problem_response(ProblemCode::ServiceUnavailable, &operation)
+        }
+    };
+    let body_budget = match remaining(state.request_timeout, started) {
+        Some(remaining) => remaining,
+        None => return problem_response(ProblemCode::ServiceUnavailable, &operation),
+    };
+    match tokio::time::timeout(body_budget, to_bytes(request.into_body(), 0)).await {
+        Ok(Ok(body)) if body.is_empty() => {}
+        Ok(Ok(_)) | Ok(Err(_)) => {
+            return problem_response(ProblemCode::MalformedRequest, &operation)
+        }
+        Err(_) => return problem_response(ProblemCode::ServiceUnavailable, &operation),
+    }
+    let discovery_budget = match remaining(state.request_timeout, started) {
+        Some(remaining) => remaining,
+        None => return problem_response(ProblemCode::ServiceUnavailable, &operation),
+    };
+    match tokio::time::timeout(discovery_budget, state.runtime.discover(&access_token)).await {
+        Ok(Ok(definitions)) => {
+            match serialize_response(StatusCode::OK, JSON_MEDIA_TYPE, &definitions) {
+                Some(response) => response,
+                None => problem_response(ProblemCode::ServiceUnavailable, &operation),
+            }
+        }
+        Ok(Err(failure)) => runtime_failure_response(failure, &operation),
+        Err(_) => problem_response(ProblemCode::ServiceUnavailable, &operation),
+    }
+}
+
+async fn health() -> Response {
+    static_json_response(StatusCode::OK, r#"{"status":"ok"}"#)
+}
+
+/// Publish the generated public contract. The document is static release
+/// material, so this route takes no credential and reaches no dependency.
+async fn openapi(request: Request<Body>) -> Response {
+    match served_openapi_document() {
+        Some(document) => bytes_response(
+            StatusCode::OK,
+            OPENAPI_MEDIA_TYPE,
+            document.as_bytes().to_vec(),
+        ),
+        None => problem_response(
+            ProblemCode::ServiceUnavailable,
+            &operation_id(request.extensions()),
+        ),
+    }
+}
+
+async fn ready(State(state): State<Arc<ServerState>>, request: Request<Body>) -> Response {
+    let operation = operation_id(request.extensions());
+    match tokio::time::timeout(state.request_timeout, state.runtime.ready()).await {
+        Ok(true) => static_json_response(StatusCode::OK, r#"{"status":"ready"}"#),
+        Ok(false) | Err(_) => problem_response(ProblemCode::ServiceUnavailable, &operation),
+    }
+}
+
+async fn jwks(State(state): State<Arc<ServerState>>, request: Request<Body>) -> Response {
+    let operation = operation_id(request.extensions());
+    match serialize_response(StatusCode::OK, JWKS_MEDIA_TYPE, state.runtime.jwks()) {
+        Some(response) => response,
+        None => problem_response(ProblemCode::ServiceUnavailable, &operation),
+    }
+}
+
+/// JWT VC Issuer Metadata. Discovery is not a trust anchor: it republishes the
+/// same public keys under the provider identity the assertion already names.
+/// Resolution is meaningful only when that identity is the HTTPS origin of the
+/// deployment; a URN provider identity simply has no resolution path.
+async fn jwt_vc_issuer_metadata(
+    State(state): State<Arc<ServerState>>,
+    request: Request<Body>,
+) -> Response {
+    let operation = operation_id(request.extensions());
+    let metadata = JwtVcIssuerMetadata {
+        issuer: &state.runtime.bundle().config.service.provider_id,
+        jwks: state.runtime.jwks(),
+    };
+    match serialize_response(StatusCode::OK, JSON_MEDIA_TYPE, &metadata) {
+        Some(response) => response,
+        None => problem_response(ProblemCode::ServiceUnavailable, &operation),
+    }
+}
+
+#[derive(Serialize)]
+struct JwtVcIssuerMetadata<'a> {
+    issuer: &'a str,
+    jwks: &'a JwksDocument,
+}
+
+async fn unknown_route(request: Request<Body>) -> Response {
+    problem_response(
+        ProblemCode::MalformedRequest,
+        &operation_id(request.extensions()),
+    )
+}
+
+async fn add_no_store(request: Request<Body>, next: Next) -> Response {
+    let mut response = next.run(request).await;
+    response
+        .headers_mut()
+        .insert(CACHE_CONTROL, HeaderValue::from_static("no-store"));
+    response
+}
+
+fn parse_evidence_request(bytes: &[u8]) -> Result<EvidenceRequest, ProblemCode> {
+    let value = parse_json_strict(bytes).map_err(|_| ProblemCode::MalformedRequest)?;
+    match request_contract_accepts(&value) {
+        Ok(true) => {}
+        Ok(false) => return Err(ProblemCode::MalformedRequest),
+        Err(_) => return Err(ProblemCode::ServiceUnavailable),
+    }
+    let request: EvidenceRequest =
+        serde_json::from_value(value).map_err(|_| ProblemCode::MalformedRequest)?;
+    // The transport schema pins length and alphabet; canonicality of the
+    // final base64url symbol is checked here, before authentication.
+    if !request_nonce_is_canonical(&request.request_nonce) {
+        return Err(ProblemCode::MalformedRequest);
+    }
+    Ok(request)
+}
+
+fn bearer_token(headers: &HeaderMap) -> Result<&str, ProblemCode> {
+    let mut values = headers.get_all(AUTHORIZATION).iter();
+    let value = values.next().ok_or(ProblemCode::AuthenticationFailed)?;
+    if values.next().is_some() {
+        return Err(ProblemCode::AuthenticationFailed);
+    }
+    let value = value
+        .to_str()
+        .map_err(|_| ProblemCode::AuthenticationFailed)?;
+    // The HTTP authentication grammar matches the scheme case-insensitively.
+    // The single-header, single-space, and token-value rules stay exact.
+    let (scheme, token) = value
+        .split_once(' ')
+        .ok_or(ProblemCode::AuthenticationFailed)?;
+    if !scheme.eq_ignore_ascii_case("Bearer")
+        || token.is_empty()
+        || token
+            .bytes()
+            .any(|byte| byte.is_ascii_whitespace() || byte == b',')
+    {
+        return Err(ProblemCode::AuthenticationFailed);
+    }
+    Ok(token)
+}
+
+fn has_exact_content_type(headers: &HeaderMap, expected: &str) -> bool {
+    let mut values = headers.get_all(CONTENT_TYPE).iter();
+    let Some(value) = values.next() else {
+        return false;
+    };
+    values.next().is_none() && value.as_bytes() == expected.as_bytes()
+}
+
+fn content_length_exceeds(headers: &HeaderMap, maximum: usize) -> bool {
+    let mut values = headers.get_all(CONTENT_LENGTH).iter();
+    let Some(value) = values.next() else {
+        return false;
+    };
+    if values.next().is_some() {
+        return true;
+    }
+    value
+        .to_str()
+        .ok()
+        .and_then(|value| value.parse::<u64>().ok())
+        .is_none_or(|length| length > maximum as u64)
+}
+
+fn remaining(limit: Duration, started: Instant) -> Option<Duration> {
+    limit.checked_sub(started.elapsed())
+}
+
+fn runtime_failure_response(failure: RuntimeFailure, operation: &str) -> Response {
+    problem_response(failure.problem(), operation)
+}
+
+fn problem_response(code: ProblemCode, operation: &str) -> Response {
+    let body = code.body(operation);
+    let mut response = serialize_response(code.status(), PROBLEM_MEDIA_TYPE, &body)
+        .unwrap_or_else(|| empty_response(StatusCode::INTERNAL_SERVER_ERROR));
+    // The observation layer reads the code from here rather than from the
+    // response body, so the operational record names the same reviewed error
+    // category the caller was given without reparsing public bytes.
+    response.extensions_mut().insert(code);
+    if code == ProblemCode::AuthenticationFailed {
+        response.headers_mut().insert(
+            axum::http::header::WWW_AUTHENTICATE,
+            HeaderValue::from_static("Bearer"),
+        );
+    }
+    if code == ProblemCode::RateLimited {
+        response
+            .headers_mut()
+            .insert(RETRY_AFTER, HeaderValue::from_static(RETRY_AFTER_SECONDS));
+    }
+    response
+}
+
+fn serialize_response<T: Serialize>(
+    status: StatusCode,
+    media_type: &'static str,
+    value: &T,
+) -> Option<Response> {
+    let bytes = serde_json::to_vec(value).ok()?;
+    Some(bytes_response(status, media_type, bytes))
+}
+
+fn static_json_response(status: StatusCode, body: &'static str) -> Response {
+    bytes_response(status, JSON_MEDIA_TYPE, body.as_bytes().to_vec())
+}
+
+fn bytes_response(status: StatusCode, media_type: &'static str, bytes: Vec<u8>) -> Response {
+    let mut response = (status, Body::from(bytes)).into_response();
+    response
+        .headers_mut()
+        .insert(CONTENT_TYPE, HeaderValue::from_static(media_type));
+    response
+}
+
+fn empty_response(status: StatusCode) -> Response {
+    (status, Body::empty()).into_response()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tower::ServiceExt;
+
+    /// A port this service did not get is the one failure whose symptom is
+    /// another service answering correctly in its place. The refusal has to
+    /// carry the address, because an operator reading it is deciding whether
+    /// the configuration is wrong or a previous instance is still running.
+    #[tokio::test]
+    async fn a_taken_port_is_refused_by_address() {
+        let held = bind("127.0.0.1", 0).await.expect("an ephemeral port binds");
+        let taken = held.local_addr().expect("the held listener has an address");
+
+        let refused = bind("127.0.0.1", taken.port())
+            .await
+            .expect_err("a held port cannot be bound twice");
+        assert_eq!(refused.kind(), io::ErrorKind::AddrInUse);
+        assert!(
+            refused
+                .to_string()
+                .starts_with(&format!("could not bind 127.0.0.1:{}: ", taken.port())),
+            "the refusal names the address it failed on: {refused}"
+        );
+
+        let malformed = bind("localhost", 0)
+            .await
+            .expect_err("a host name is not an address");
+        assert_eq!(malformed.kind(), io::ErrorKind::InvalidInput);
+        assert!(
+            malformed
+                .to_string()
+                .starts_with("localhost is not an address: "),
+            "the refusal names the value it could not parse: {malformed}"
+        );
+    }
+
+    #[test]
+    fn authorization_requires_one_unambiguous_bearer_value() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            AUTHORIZATION,
+            HeaderValue::from_static("Bearer three.parts.value"),
+        );
+        assert_eq!(
+            bearer_token(&headers).expect("single bearer accepted"),
+            "three.parts.value"
+        );
+
+        // The authentication scheme is case-insensitive per the HTTP grammar.
+        for scheme in ["bearer", "BEARER", "BeArEr"] {
+            headers.insert(
+                AUTHORIZATION,
+                HeaderValue::from_str(&format!("{scheme} three.parts.value"))
+                    .expect("test header is valid"),
+            );
+            assert_eq!(
+                bearer_token(&headers).expect("case-insensitive scheme accepted"),
+                "three.parts.value"
+            );
+        }
+
+        for invalid in [
+            "Basic three.parts.value",
+            "Bearer",
+            "Bearer  three.parts.value",
+            "Bearer three.parts.value ",
+            "Bearer three.parts.value,other",
+        ] {
+            headers.insert(
+                AUTHORIZATION,
+                HeaderValue::from_str(invalid).expect("test header is valid"),
+            );
+            assert_eq!(
+                bearer_token(&headers),
+                Err(ProblemCode::AuthenticationFailed)
+            );
+        }
+
+        headers.clear();
+        headers.append(AUTHORIZATION, HeaderValue::from_static("Bearer first"));
+        headers.append(AUTHORIZATION, HeaderValue::from_static("Bearer second"));
+        assert_eq!(
+            bearer_token(&headers),
+            Err(ProblemCode::AuthenticationFailed)
+        );
+    }
+
+    const TEST_NONCE: &str = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+
+    #[test]
+    fn request_json_is_strict_and_closed() {
+        let valid = br#"{
+            "requestNonce":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+            "requirement":"urn:example:requirement:v1",
+            "purpose":"review",
+            "subjects":[{
+                "role":"subject",
+                "selector":{"profile":"opaque-v1","values":{"opaque":"value"}}
+            }]
+        }"#;
+        assert!(parse_evidence_request(valid).is_ok());
+        for number in ["1.0", "1e0"] {
+            let request = r#"{"requestNonce":"NONCE","requirement":"urn:example:requirement:v1","purpose":"p","subjects":[{"role":"subject","selector":{"profile":"opaque-v1","values":{"opaque":NUMBER}}}]}"#
+                .replace("NONCE", TEST_NONCE)
+                .replace("NUMBER", number);
+            let parsed = parse_evidence_request(request.as_bytes())
+                .expect("schema-valid integral JSON number is accepted");
+            assert_eq!(
+                parsed.subjects[0]
+                    .selector
+                    .values
+                    .as_ref()
+                    .and_then(|values| values.get("opaque")),
+                Some(&crate::model::SelectorValue::Integer(1))
+            );
+        }
+        assert_eq!(
+            parse_evidence_request(
+                br#"{"requestNonce":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","requirement":"a","requirement":"b","purpose":"p","subjects":[]}"#
+            ),
+            Err(ProblemCode::MalformedRequest)
+        );
+        assert_eq!(
+            parse_evidence_request(
+                br#"{"requestNonce":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","requirement":"a","purpose":"p","subjects":[],"query":"hidden"}"#
+            ),
+            Err(ProblemCode::MalformedRequest)
+        );
+
+        let base = r#"{"requestNonce":"NONCE","requirement":"urn:example:requirement:v1","purpose":"p","subjects":[{"role":"subject","selector":{"profile":"opaque-v1","values":{"opaque":"value"}}}]}"#;
+        for invalid in [
+            base.replace("\"requestNonce\":\"NONCE\",", ""),
+            base.replace("NONCE", ""),
+            base.replace("NONCE", &"A".repeat(42)),
+            base.replace("NONCE", &"A".repeat(44)),
+            base.replace("NONCE", &format!("{}=", "A".repeat(42))),
+            base.replace("NONCE", &format!("{}+", "A".repeat(42))),
+            base.replace("NONCE", &format!("{}B", "A".repeat(42))),
+            format!(
+                r#"{{"requestNonce":"{TEST_NONCE}","requestNonce":"{TEST_NONCE}","requirement":"urn:example:requirement:v1","purpose":"p","subjects":[{{"role":"subject","selector":{{"profile":"opaque-v1","values":{{"opaque":"value"}}}}}}]}}"#
+            ),
+        ] {
+            assert_eq!(
+                parse_evidence_request(invalid.as_bytes()),
+                Err(ProblemCode::MalformedRequest),
+                "{invalid}"
+            );
+        }
+
+        for invalid in [
+            br#"{"requestNonce":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","requirement":"not a URI","purpose":"p","subjects":[{"role":"subject","selector":{"profile":"opaque-v1","values":{"opaque":"value"}}}]}"#.as_slice(),
+            br#"{"requestNonce":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","requirement":"urn:example:requirement:v1","purpose":"Uppercase","subjects":[{"role":"subject","selector":{"profile":"opaque-v1","values":{"opaque":"value"}}}]}"#.as_slice(),
+            br#"{"requestNonce":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","requirement":"urn:example:requirement:v1","purpose":"p","subjects":[]}"#.as_slice(),
+            br#"{"requestNonce":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","requirement":"urn:example:requirement:v1","purpose":"p","subjects":[{"role":"Uppercase","selector":{"profile":"opaque-v1","values":{"opaque":"value"}}}]}"#.as_slice(),
+            br#"{"requestNonce":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","requirement":"urn:example:requirement:v1","purpose":"p","subjects":[{"role":"subject","selector":{"profile":"opaque-v1","values":{}}}]}"#.as_slice(),
+            br#"{"requestNonce":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","requirement":"urn:example:requirement:v1","purpose":"p","subjects":[{"role":"subject","selector":{"profile":"opaque-v1","values":{"opaque":9007199254740992}}}]}"#.as_slice(),
+        ] {
+            assert_eq!(
+                parse_evidence_request(invalid),
+                Err(ProblemCode::MalformedRequest)
+            );
+        }
+    }
+
+    #[test]
+    fn accept_negotiation_matrix_is_closed_and_exact() {
+        let mut headers = HeaderMap::new();
+        assert_eq!(
+            resolve_response_format(&headers),
+            Ok(ResponseFormat::SignedJws)
+        );
+
+        for (value, expected) in [
+            ("*/*", ResponseFormat::SignedJws),
+            ("application/jose+json", ResponseFormat::SignedJws),
+            (
+                "application/vnd.registrystack.evidence-unsigned+json",
+                ResponseFormat::UnsignedJson,
+            ),
+        ] {
+            headers.insert(ACCEPT, HeaderValue::from_static(value));
+            assert_eq!(resolve_response_format(&headers), Ok(expected), "{value}");
+        }
+
+        for invalid in [
+            "application/json",
+            "application/jose+json, application/json",
+            "application/jose+json;q=0.9",
+            "application/vnd.registrystack.evidence-unsigned+json; charset=utf-8",
+            "application/*",
+            "*/*;q=1",
+            " application/jose+json",
+            "APPLICATION/JOSE+JSON",
+        ] {
+            headers.insert(
+                ACCEPT,
+                HeaderValue::from_str(invalid).expect("test header is valid"),
+            );
+            assert_eq!(
+                resolve_response_format(&headers),
+                Err(ProblemCode::ResponseFormatNotAcceptable),
+                "{invalid}"
+            );
+        }
+
+        headers.clear();
+        headers.append(ACCEPT, HeaderValue::from_static("application/jose+json"));
+        headers.append(ACCEPT, HeaderValue::from_static("application/jose+json"));
+        assert_eq!(
+            resolve_response_format(&headers),
+            Err(ProblemCode::ResponseFormatNotAcceptable)
+        );
+    }
+
+    #[tokio::test]
+    async fn problem_responses_have_closed_media_and_challenge_headers() {
+        let authentication = problem_response(
+            ProblemCode::AuthenticationFailed,
+            "01K1EVIDENCEOPERATION0000000",
+        );
+        assert_eq!(authentication.status(), StatusCode::UNAUTHORIZED);
+        assert_eq!(
+            authentication.headers().get(CONTENT_TYPE),
+            Some(&HeaderValue::from_static(PROBLEM_MEDIA_TYPE))
+        );
+        assert_eq!(
+            authentication
+                .headers()
+                .get(axum::http::header::WWW_AUTHENTICATE),
+            Some(&HeaderValue::from_static("Bearer"))
+        );
+
+        let rate = problem_response(ProblemCode::RateLimited, "01K1EVIDENCEOPERATION0000000");
+        assert_eq!(rate.status(), StatusCode::TOO_MANY_REQUESTS);
+        assert_eq!(
+            rate.headers().get(RETRY_AFTER),
+            Some(&HeaderValue::from_static(RETRY_AFTER_SECONDS))
+        );
+    }
+
+    #[test]
+    fn operation_ids_meet_the_audit_contract() {
+        // The public `operation` field is frozen to a 26-character Crockford
+        // Base32 ULID by the generated problem schema (^[0-9A-HJKMNP-TV-Z]{26}$).
+        // Pin the producer to that exact shape so a future change (for example
+        // swapping ULID for a hyphenated UUID) fails loudly here instead of
+        // silently breaking the frozen contract.
+        let operation = operation_id(&axum::http::Extensions::new());
+        assert_operation_contract(&operation);
+    }
+
+    fn assert_operation_contract(operation: &str) {
+        const CROCKFORD_UPPER: &[u8] = b"0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+        assert_eq!(operation.len(), 26, "operation id is a 26-character ULID");
+        assert!(
+            operation
+                .bytes()
+                .all(|byte| CROCKFORD_UPPER.contains(&byte)),
+            "operation id uses only Crockford Base32 uppercase symbols"
+        );
+        // 26 lies inside the frozen 16..=128 audit-operation length range.
+        assert!(!operation.bytes().any(|byte| byte.is_ascii_whitespace()));
+    }
+
+    #[tokio::test]
+    async fn response_layers_apply_no_store_and_security_headers_without_hsts() {
+        let app = response_layers(
+            Router::new().route("/probe", get(|| async { StatusCode::NO_CONTENT })),
+            Arc::new(Metrics::default()),
+        );
+        let response = app
+            .oneshot(
+                Request::builder()
+                    .uri("/probe")
+                    .body(Body::empty())
+                    .expect("test request builds"),
+            )
+            .await
+            .expect("infallible router responds");
+
+        assert_eq!(
+            response.headers().get(CACHE_CONTROL),
+            Some(&HeaderValue::from_static("no-store"))
+        );
+        assert_eq!(
+            response.headers().get("x-content-type-options"),
+            Some(&HeaderValue::from_static("nosniff"))
+        );
+        assert_eq!(
+            response.headers().get("x-frame-options"),
+            Some(&HeaderValue::from_static("DENY"))
+        );
+        assert!(response
+            .headers()
+            .get("strict-transport-security")
+            .is_none());
+        // The identifier the caller can quote back is produced by the boundary
+        // itself, so it must meet the same frozen shape as the audit field.
+        assert_operation_contract(
+            response
+                .headers()
+                .get(crate::observability::CORRELATION_HEADER)
+                .expect("every response carries a correlation identifier")
+                .to_str()
+                .expect("the correlation header is ASCII"),
+        );
+    }
+
+    #[tokio::test]
+    async fn evaluation_tracker_drains_a_detached_task_without_a_missed_wakeup() {
+        let tracker = EvaluationTracker::default();
+        let (release, blocked) = tokio::sync::oneshot::channel();
+        let detached = tracker.spawn(async move {
+            let _ = blocked.await;
+        });
+        drop(detached);
+
+        let waiter = tokio::spawn({
+            let tracker = tracker.clone();
+            async move { tracker.wait_idle().await }
+        });
+        tokio::task::yield_now().await;
+        assert!(!waiter.is_finished());
+        release.send(()).expect("detached task is still running");
+        tokio::time::timeout(Duration::from_secs(1), waiter)
+            .await
+            .expect("detached task drains")
+            .expect("drain waiter does not panic");
+    }
+}
diff --git a/crates/registry-evidence/src/signing.rs b/crates/registry-evidence/src/signing.rs
new file mode 100644
index 000000000..e6a52f6d4
--- /dev/null
+++ b/crates/registry-evidence/src/signing.rs
@@ -0,0 +1,439 @@
+//! Evidence-owned flattened JWS construction and key publication.
+
+use std::{collections::BTreeSet, sync::Arc};
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use registry_platform_crypto::{
+    verify, KeyReadiness, PublicJwk, SigningAlgorithm, SigningError as ProviderSigningError,
+    SigningProvider,
+};
+use registry_platform_sdjwt::{SdJwtError, SdJwtIssuanceInput, SdJwtIssuer};
+use serde::Serialize;
+use thiserror::Error;
+
+use crate::{
+    model::{FlattenedJws, JwksDocument},
+    EVIDENCE_JWS_CTY, EVIDENCE_JWS_TYP,
+};
+
+const MAX_KEY_ID_BYTES: usize = 256;
+const MAX_PUBLISHED_KEYS: usize = 33;
+
+#[derive(Debug, Error)]
+pub enum EvidenceSigningError {
+    #[error("the configured signing algorithm is not allowed")]
+    Algorithm,
+    #[error("the configured signing key identifier is invalid")]
+    KeyId,
+    #[error("the signing key identifier does not match the configured active key")]
+    ActiveKeyId,
+    #[error("the signing provider is unavailable")]
+    Provider(#[from] ProviderSigningError),
+    #[error("the signing provider failed its startup self-test")]
+    SelfTest,
+    #[error("the protected header could not be serialized")]
+    HeaderSerialization(#[source] serde_json::Error),
+    #[error("the evidence payload could not be serialized")]
+    PayloadSerialization(#[source] serde_json::Error),
+    #[error("the published key set contains an invalid or duplicate key identifier")]
+    PublishedKey,
+    #[error("the published key set could not be serialized")]
+    KeySerialization(#[source] serde_json::Error),
+    #[error("the SD-JWT VC serialization could not be produced")]
+    SdJwtVc(#[source] SdJwtError),
+}
+
+#[derive(Debug, Serialize)]
+struct ProtectedHeader<'a> {
+    alg: &'static str,
+    kid: &'a str,
+    typ: &'static str,
+    cty: &'static str,
+}
+
+/// Evidence's single active Ed25519 signer.
+pub struct EvidenceSigner {
+    provider: Arc<dyn SigningProvider>,
+}
+
+impl std::fmt::Debug for EvidenceSigner {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("EvidenceSigner")
+            .field("algorithm", &self.provider.algorithm())
+            .field("key_id", &self.provider.key_id())
+            .finish_non_exhaustive()
+    }
+}
+
+impl EvidenceSigner {
+    pub async fn initialize(
+        provider: Arc<dyn SigningProvider>,
+        configured_active_key_id: &str,
+    ) -> Result<Self, EvidenceSigningError> {
+        validate_provider(provider.as_ref(), configured_active_key_id)?;
+
+        let self_test_message = b"registry-evidence-signing-readiness-v1";
+        let signature = provider.sign(self_test_message).await?;
+        verify(self_test_message, &signature, &provider.public_jwk())
+            .map_err(|_| EvidenceSigningError::SelfTest)?;
+
+        Ok(Self { provider })
+    }
+
+    pub fn key_id(&self) -> &str {
+        self.provider.key_id()
+    }
+
+    pub fn public_jwk(&self) -> PublicJwk {
+        self.provider.public_jwk()
+    }
+
+    /// Report the current signing-provider posture without exposing key data.
+    pub fn ready(&self) -> bool {
+        self.provider.readiness() == KeyReadiness::Ready
+    }
+
+    /// Serialize and sign the exact JSON representation of a validated Evidence value.
+    pub async fn sign_json<T: Serialize>(
+        &self,
+        evidence: &T,
+    ) -> Result<FlattenedJws, EvidenceSigningError> {
+        let payload =
+            serde_json::to_vec(evidence).map_err(EvidenceSigningError::PayloadSerialization)?;
+        self.sign_bytes(&payload).await
+    }
+
+    /// Sign exact UTF-8 Evidence JSON bytes as a flattened JWS JSON value.
+    pub async fn sign_bytes(
+        &self,
+        evidence_json: &[u8],
+    ) -> Result<FlattenedJws, EvidenceSigningError> {
+        let protected = serde_json::to_vec(&ProtectedHeader {
+            alg: "EdDSA",
+            kid: self.provider.key_id(),
+            typ: EVIDENCE_JWS_TYP,
+            cty: EVIDENCE_JWS_CTY,
+        })
+        .map_err(EvidenceSigningError::HeaderSerialization)?;
+
+        let protected = URL_SAFE_NO_PAD.encode(protected);
+        let payload = URL_SAFE_NO_PAD.encode(evidence_json);
+        let signing_input = [protected.as_bytes(), b".", payload.as_bytes()].concat();
+        let signature = self.provider.sign(&signing_input).await?;
+
+        Ok(FlattenedJws {
+            protected,
+            payload,
+            signature: URL_SAFE_NO_PAD.encode(signature),
+        })
+    }
+
+    /// Serialize the same assertion as a compact SD-JWT VC. The signer is the
+    /// one active key already used for the flattened JWS; the profile adds no
+    /// second key, algorithm, or key ceremony.
+    pub async fn sign_sd_jwt_vc(
+        &self,
+        input: SdJwtIssuanceInput,
+    ) -> Result<String, EvidenceSigningError> {
+        SdJwtIssuer::from_signing_provider(Arc::clone(&self.provider))
+            .issue(input)
+            .await
+            .map(|signed| signed.jwt)
+            .map_err(EvidenceSigningError::SdJwtVc)
+    }
+}
+
+pub fn jwks_document(
+    active: PublicJwk,
+    retired: impl IntoIterator<Item = PublicJwk>,
+) -> Result<JwksDocument, EvidenceSigningError> {
+    let mut seen = BTreeSet::new();
+    let mut keys = Vec::new();
+    for key in std::iter::once(active).chain(retired) {
+        if keys.len() == MAX_PUBLISHED_KEYS {
+            return Err(EvidenceSigningError::PublishedKey);
+        }
+        if key.algorithm().ok() != Some(SigningAlgorithm::EdDsa) {
+            return Err(EvidenceSigningError::Algorithm);
+        }
+        let key_id = key
+            .kid
+            .as_deref()
+            .ok_or(EvidenceSigningError::PublishedKey)?;
+        validate_key_id(key_id)?;
+        if !seen.insert(key_id.to_owned()) {
+            return Err(EvidenceSigningError::PublishedKey);
+        }
+        keys.push(serde_json::to_value(key).map_err(EvidenceSigningError::KeySerialization)?);
+    }
+    Ok(JwksDocument { keys })
+}
+
+fn validate_provider(
+    provider: &dyn SigningProvider,
+    configured_active_key_id: &str,
+) -> Result<(), EvidenceSigningError> {
+    if provider.algorithm() != SigningAlgorithm::EdDsa {
+        return Err(EvidenceSigningError::Algorithm);
+    }
+    validate_key_id(provider.key_id())?;
+    if provider.key_id() != configured_active_key_id {
+        return Err(EvidenceSigningError::ActiveKeyId);
+    }
+    let public = provider.public_jwk();
+    if public.algorithm().ok() != Some(SigningAlgorithm::EdDsa)
+        || public.kid.as_deref() != Some(provider.key_id())
+    {
+        return Err(EvidenceSigningError::Algorithm);
+    }
+    Ok(())
+}
+
+fn validate_key_id(key_id: &str) -> Result<(), EvidenceSigningError> {
+    if key_id.is_empty() || key_id.len() > MAX_KEY_ID_BYTES || key_id.chars().any(char::is_control)
+    {
+        return Err(EvidenceSigningError::KeyId);
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use registry_platform_crypto::{LocalJwkSigner, PrivateJwk};
+    use sha2::{Digest, Sha256};
+    use std::collections::BTreeMap;
+
+    const PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"evidence-key-1"}"#;
+    const FIXTURE_PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"fixture-key-2026-01"}"#;
+    const SAME_KID_DIFFERENT_PRIVATE_JWK: &str = r#"{"crv":"Ed25519","d":"f4QIxnAyRWzhuBOmNRgvBTE56mWePdsPL0mvCtl8Gys","x":"pv4e_hXHBLN27rcs6VDFV1ED0TiU8M3xy9vsuWFEsec","kty":"OKP","alg":"EdDSA","kid":"evidence-key-1"}"#;
+
+    async fn signer() -> EvidenceSigner {
+        let private = PrivateJwk::parse(PRIVATE_JWK).expect("test key parses");
+        let provider: Arc<dyn SigningProvider> =
+            Arc::new(LocalJwkSigner::new(private).expect("test signer builds"));
+        EvidenceSigner::initialize(provider, "evidence-key-1")
+            .await
+            .expect("signer initializes")
+    }
+
+    async fn fixture_signer() -> EvidenceSigner {
+        let private = PrivateJwk::parse(FIXTURE_PRIVATE_JWK).expect("test key parses");
+        let provider: Arc<dyn SigningProvider> =
+            Arc::new(LocalJwkSigner::new(private).expect("test signer builds"));
+        EvidenceSigner::initialize(provider, "fixture-key-2026-01")
+            .await
+            .expect("signer initializes")
+    }
+
+    #[tokio::test]
+    async fn flattened_jws_has_exact_protected_header_and_valid_signature() {
+        let signer = signer().await;
+        let evidence = serde_json::json!({"schema": crate::EVIDENCE_SCHEMA_V1});
+        let jws = signer.sign_json(&evidence).await.expect("evidence signs");
+
+        let protected_bytes = URL_SAFE_NO_PAD
+            .decode(&jws.protected)
+            .expect("protected header decodes");
+        let protected: serde_json::Value =
+            serde_json::from_slice(&protected_bytes).expect("protected header parses");
+        assert_eq!(
+            protected,
+            serde_json::json!({
+                "alg": "EdDSA",
+                "kid": "evidence-key-1",
+                "typ": "evidence+jws",
+                "cty": "application/evidence+json"
+            })
+        );
+
+        let signing_input = format!("{}.{}", jws.protected, jws.payload);
+        let signature = URL_SAFE_NO_PAD
+            .decode(&jws.signature)
+            .expect("signature decodes");
+        verify(signing_input.as_bytes(), &signature, &signer.public_jwk())
+            .expect("signature verifies");
+    }
+
+    #[tokio::test]
+    async fn configured_key_id_must_match_provider() {
+        let private = PrivateJwk::parse(PRIVATE_JWK).expect("test key parses");
+        let provider: Arc<dyn SigningProvider> =
+            Arc::new(LocalJwkSigner::new(private).expect("test signer builds"));
+        let error = EvidenceSigner::initialize(provider, "different-key")
+            .await
+            .expect_err("mismatched key id is rejected");
+        assert!(matches!(error, EvidenceSigningError::ActiveKeyId));
+    }
+
+    #[tokio::test]
+    async fn jwks_contains_public_material_only() {
+        let signer = signer().await;
+        let document = jwks_document(signer.public_jwk(), []).expect("JWKS builds");
+        let json = serde_json::to_value(document).expect("JWKS serializes");
+        assert_eq!(json["keys"].as_array().map(Vec::len), Some(1));
+        assert!(json["keys"][0].get("d").is_none());
+
+        let duplicate_private =
+            PrivateJwk::parse(SAME_KID_DIFFERENT_PRIVATE_JWK).expect("rotated test key parses");
+        let duplicate = LocalJwkSigner::new(duplicate_private)
+            .expect("rotated signer builds")
+            .public_jwk();
+        assert!(matches!(
+            jwks_document(signer.public_jwk(), [duplicate]),
+            Err(EvidenceSigningError::PublishedKey)
+        ));
+
+        let retired = (0..32).map(|index| {
+            let mut key = signer.public_jwk();
+            key.kid = Some(format!("retired-evidence-key-{index:02}"));
+            key
+        });
+        let boundary = jwks_document(signer.public_jwk(), retired).expect("33 keys are allowed");
+        assert_eq!(boundary.keys.len(), 33);
+
+        let too_many = (0..33).map(|index| {
+            let mut key = signer.public_jwk();
+            key.kid = Some(format!("excess-evidence-key-{index:02}"));
+            key
+        });
+        assert!(matches!(
+            jwks_document(signer.public_jwk(), too_many),
+            Err(EvidenceSigningError::PublishedKey)
+        ));
+    }
+
+    /// The SD-JWT VC fixture is the adopter-facing wire contract, so it must be
+    /// reproduced by the production issuance path over every golden payload:
+    /// the exact protected header, one root disclosure per unprojected golden
+    /// value, sorted unique digests over the encoded disclosure bytes, and a
+    /// trailing tilde. Structured field projection has a focused verifier test.
+    #[tokio::test]
+    async fn sd_jwt_vc_fixture_serialization_and_protected_header_are_exact() {
+        let fixture: serde_json::Value = serde_norway::from_slice(include_bytes!(
+            "../../../products/evidence/fixtures/conformance/sd-jwt-vc-cases.yaml"
+        ))
+        .expect("SD-JWT VC fixture parses");
+        assert_eq!(
+            fixture["media_type"].as_str(),
+            Some(crate::EVIDENCE_SD_JWT_VC_MEDIA_TYPE)
+        );
+        let expected_header = fixture["protected_header"]["exact_json"]
+            .as_str()
+            .expect("fixture header is text");
+        let signer = fixture_signer().await;
+
+        for case in fixture["cases"]
+            .as_array()
+            .expect("fixture cases are an array")
+        {
+            let relative = case["payload"].as_str().expect("payload path is text");
+            let path = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+                .join("../../products/evidence/fixtures/conformance")
+                .join(relative);
+            let evidence: crate::model::Evidence =
+                serde_json::from_slice(&std::fs::read(path).expect("golden payload reads"))
+                    .expect("golden payload is an Evidence document");
+            let input = crate::sdjwt_vc::issuance_input(&evidence, None, &BTreeMap::new())
+                .expect("golden payload maps");
+            let serialized = signer
+                .sign_sd_jwt_vc(input)
+                .await
+                .expect("golden payload serializes");
+
+            let body = serialized
+                .strip_suffix('~')
+                .expect("the serialization ends with the key-binding terminator");
+            let mut segments = body.split('~');
+            let jwt = segments.next().expect("issuer-signed JWT segment");
+            let disclosures = segments.collect::<Vec<_>>();
+            assert_eq!(
+                disclosures.len(),
+                evidence.supported_values.len(),
+                "{} discloses one root value per unprojected supported value",
+                case["id"]
+            );
+
+            let parts = jwt.split('.').collect::<Vec<_>>();
+            assert_eq!(parts.len(), 3, "the JWT is compact JWS serialized");
+            assert_eq!(
+                URL_SAFE_NO_PAD.decode(parts[0]).expect("header decodes"),
+                expected_header.as_bytes()
+            );
+            let claims: serde_json::Value =
+                serde_json::from_slice(&URL_SAFE_NO_PAD.decode(parts[1]).expect("payload decodes"))
+                    .expect("payload parses");
+            assert_eq!(claims["_sd_alg"], serde_json::json!("sha-256"));
+
+            let digests = claims["_sd"]
+                .as_array()
+                .expect("_sd is an array")
+                .iter()
+                .map(|value| value.as_str().expect("digest is text").to_owned())
+                .collect::<Vec<_>>();
+            let mut sorted = digests.clone();
+            sorted.sort();
+            sorted.dedup();
+            assert_eq!(digests, sorted, "_sd is sorted and carries no repeat");
+            for disclosure in &disclosures {
+                let digest = URL_SAFE_NO_PAD.encode(Sha256::digest(disclosure.as_bytes()));
+                assert!(
+                    digests.contains(&digest),
+                    "a disclosure is absent from _sd in {}",
+                    case["id"]
+                );
+            }
+
+            let signature = URL_SAFE_NO_PAD.decode(parts[2]).expect("signature decodes");
+            verify(
+                format!("{}.{}", parts[0], parts[1]).as_bytes(),
+                &signature,
+                &signer.public_jwk(),
+            )
+            .expect("fixture signature verifies");
+        }
+    }
+
+    #[tokio::test]
+    async fn jws_fixture_payload_bytes_and_protected_header_are_exact() {
+        let fixture: serde_json::Value = serde_norway::from_slice(include_bytes!(
+            "../../../products/evidence/fixtures/conformance/jws-cases.yaml"
+        ))
+        .expect("JWS fixture parses");
+        let expected_header = fixture["protected_header"]["exact_json"]
+            .as_str()
+            .expect("fixture header is text");
+        let signer = fixture_signer().await;
+        for case in fixture["cases"]
+            .as_array()
+            .expect("fixture cases are an array")
+        {
+            let relative = case["payload"].as_str().expect("payload path is text");
+            let path = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+                .join("../../products/evidence/fixtures/conformance")
+                .join(relative);
+            let payload = std::fs::read(path).expect("golden payload reads");
+            assert_eq!(payload.last(), Some(&b'\n'));
+            let jws = signer.sign_bytes(&payload).await.expect("payload signs");
+            assert_eq!(
+                URL_SAFE_NO_PAD
+                    .decode(&jws.protected)
+                    .expect("header decodes"),
+                expected_header.as_bytes()
+            );
+            assert_eq!(
+                URL_SAFE_NO_PAD
+                    .decode(&jws.payload)
+                    .expect("payload decodes"),
+                payload
+            );
+            let signing_input = format!("{}.{}", jws.protected, jws.payload);
+            let signature = URL_SAFE_NO_PAD
+                .decode(&jws.signature)
+                .expect("signature decodes");
+            verify(signing_input.as_bytes(), &signature, &signer.public_jwk())
+                .expect("fixture signature verifies");
+        }
+    }
+}
diff --git a/crates/registry-evidence/src/source.rs b/crates/registry-evidence/src/source.rs
new file mode 100644
index 000000000..a4def3b06
--- /dev/null
+++ b/crates/registry-evidence/src/source.rs
@@ -0,0 +1,1750 @@
+//! Exact, bounded HTTP/JSON source execution for Evidence Version 1.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::fmt;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use base64::Engine as _;
+use http::header::{ACCEPT, AUTHORIZATION, CONTENT_TYPE};
+use http::{HeaderMap, HeaderName, HeaderValue};
+use registry_platform_httputil::{read_bounded, BoundedReadError};
+use serde::de::{self, MapAccess, SeqAccess, Visitor};
+use serde::{Deserialize, Deserializer};
+use serde_json::{Map as JsonMap, Number as JsonNumber, Value as JsonValue};
+use thiserror::Error;
+use tokio::sync::{Mutex, Semaphore};
+use url::{Host, Url};
+use zeroize::{Zeroize, Zeroizing};
+
+use crate::config::{
+    validate_local_unauthenticated_source_origin, AcquisitionPosture, CredentialPlacement,
+    FixedRequest, HttpMethod, OutboundTlsConfig, PathBindingConfig, PreparationChannelPolicy,
+    SecretRef, SourceAuthentication, SourceConfig, SourceSelectorSet,
+};
+use crate::model::SelectorValue;
+use crate::rhai_runtime::RequestParts;
+use crate::secrets::{ProtectedSecret, SecretResolver};
+
+const TOKEN_RESPONSE_MAXIMUM_BYTES: u64 = 8 * 1024;
+const PRIVATE_CA_MAXIMUM_BYTES: u64 = 1024 * 1024;
+const PROJECTED_RESPONSE_MAXIMUM_BYTES: usize = 65_536;
+const JSON_MEDIA_TYPE: &str = "application/json";
+const GRAPHQL_JSON_MEDIA_TYPE: &str = "application/graphql-response+json";
+
+/// A role-bound selector that has already passed authentication,
+/// authorization, exact-field, type, and size validation.
+///
+/// This type intentionally has no `Debug` implementation because its values
+/// are protected request material.
+pub struct ResolvedSourceSelector {
+    pub role: String,
+    pub profile: String,
+    pub values: BTreeMap<String, SelectorValue>,
+}
+
+/// A safe status category that does not retain a response or request URL.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum SourceStatus {
+    Unauthorized,
+    Forbidden,
+    RateLimited,
+    ServerError,
+    Other,
+}
+
+/// Closed source failures. No variant retains request, response, selector, or
+/// credential material.
+#[derive(Debug, Error, Eq, PartialEq)]
+pub enum SourceError {
+    #[error("the fixed source plan is invalid")]
+    InvalidPlan,
+    #[error("the resolved source selector set is invalid")]
+    InvalidSelectors,
+    #[error("source credentials are unavailable or invalid")]
+    Credential,
+    #[error("the source concurrency boundary is unavailable")]
+    Concurrency,
+    #[error("the source request timed out")]
+    Timeout,
+    #[error("the source transport is unavailable")]
+    Transport,
+    #[error("the source attempted a redirect")]
+    Redirect,
+    #[error("the source returned a rejected status category")]
+    Status(SourceStatus),
+    #[error("the source returned an unsupported media type")]
+    WrongMediaType,
+    #[error("the source response exceeded a configured bound")]
+    ResponseTooLarge,
+    #[error("the source returned invalid JSON")]
+    InvalidJson,
+    #[error("the source returned an error envelope")]
+    ErrorEnvelope,
+    #[error("the source response did not satisfy its acquisition projection")]
+    ProjectionViolation,
+}
+
+/// Executes one immutable source plan. The client has redirects, retries,
+/// ambient proxies, pagination, cookies, and caller-controlled headers absent.
+pub struct SourceExecutor {
+    client: reqwest::Client,
+    request: RequestPlan,
+    authentication: AuthenticationPlan,
+    secrets: Arc<SecretResolver>,
+    concurrency: Semaphore,
+    concurrency_admission_timeout: Duration,
+}
+
+/// The validated non-credential transport material for one fixed source request.
+///
+/// The full URL remains private so callers cannot obtain source authority, and
+/// this type deliberately exposes no fixed headers or authentication material.
+/// Path, query, and body access is intended for the trusted offline fixture
+/// harness. Its diagnostic representation is always value-free.
+#[derive(Clone, PartialEq)]
+pub struct MaterializedSourceRequest {
+    url: Url,
+    body: Option<JsonValue>,
+}
+
+impl MaterializedSourceRequest {
+    pub fn path(&self) -> &str {
+        self.url.path()
+    }
+
+    pub fn query(&self) -> Option<&str> {
+        self.url.query()
+    }
+
+    pub fn body(&self) -> Option<&JsonValue> {
+        self.body.as_ref()
+    }
+}
+
+impl fmt::Debug for MaterializedSourceRequest {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("MaterializedSourceRequest")
+            .field("path", &"<redacted>")
+            .field("query", &self.query().map(|_| "<redacted>"))
+            .field("body", &self.body().map(|_| "<redacted>"))
+            .finish()
+    }
+}
+
+struct RequestPlan {
+    base_url: Url,
+    path: SourcePath,
+    method: HttpMethod,
+    fixed_headers: HeaderMap,
+    selector_inputs: BTreeMap<String, BTreeMap<String, BTreeSet<String>>>,
+    allowed_selector_sets: Vec<SourceSelectorSet>,
+    posture: AcquisitionPosture,
+    projection: ProjectionNode,
+    maximum_response_bytes: u64,
+}
+
+enum SourcePath {
+    Fixed(String),
+    Template {
+        template: String,
+        bindings: BTreeMap<String, PathBindingPlan>,
+    },
+}
+
+struct PathBindingPlan {
+    role: String,
+    profile: String,
+    field: String,
+}
+
+enum AuthenticationPlan {
+    None,
+    Basic {
+        username_ref: SecretRef,
+        password_ref: SecretRef,
+    },
+    StaticBearer {
+        token_ref: SecretRef,
+    },
+    StaticApiKey {
+        header_name: HeaderName,
+        value_ref: SecretRef,
+    },
+    Oauth2(Box<OauthPlan>),
+}
+
+struct OauthPlan {
+    token_endpoint: Url,
+    client_id_ref: SecretRef,
+    client_secret_ref: SecretRef,
+    scope: Option<String>,
+    credential_placement: CredentialPlacement,
+    maximum_cache_lifetime: Duration,
+    /// Lifetime used when the provider omits `expires_in`.
+    assumed_lifetime: Option<Duration>,
+    admission_timeout: Duration,
+    cache: Mutex<Option<CachedToken>>,
+}
+
+struct CachedToken {
+    token: ProtectedToken,
+    expires_at: Instant,
+}
+
+struct ProtectedToken(Zeroizing<Vec<u8>>);
+
+impl ProtectedToken {
+    fn from_string(value: String) -> Result<Self, SourceError> {
+        if value.is_empty() || value.len() > TOKEN_RESPONSE_MAXIMUM_BYTES as usize {
+            return Err(SourceError::Credential);
+        }
+        Ok(Self(Zeroizing::new(value.into_bytes())))
+    }
+
+    fn expose(&self) -> &[u8] {
+        self.0.as_slice()
+    }
+}
+
+impl Clone for ProtectedToken {
+    fn clone(&self) -> Self {
+        Self(Zeroizing::new(self.0.to_vec()))
+    }
+}
+
+#[derive(Default)]
+struct ProjectionNode {
+    terminal: bool,
+    keys: BTreeMap<String, ProjectionNode>,
+    wildcard: Option<Box<ProjectionNode>>,
+}
+
+impl SourceExecutor {
+    /// Compile a standalone source with system TLS roots. Sources that name a
+    /// private trust profile require `new_with_selector_sets_and_tls`.
+    pub fn new(source: &SourceConfig, secrets: Arc<SecretResolver>) -> Result<Self, SourceError> {
+        let allowed = conservative_selector_sets(source)?;
+        Self::new_with_selector_sets(source, &allowed, secrets)
+    }
+
+    /// Compile a source with system TLS roots and explicitly allowed selector
+    /// tuples.
+    pub fn new_with_selector_sets(
+        source: &SourceConfig,
+        allowed_selector_sets: &[SourceSelectorSet],
+        secrets: Arc<SecretResolver>,
+    ) -> Result<Self, SourceError> {
+        if source.tls_trust_profile.is_some() {
+            return Err(SourceError::InvalidPlan);
+        }
+        Self::compile(source, allowed_selector_sets, None, secrets)
+    }
+
+    /// Compile a source against runtime-owned TLS trust bindings. System roots
+    /// remain enabled and the selected private CA bundle is additive.
+    pub fn new_with_selector_sets_and_tls(
+        source: &SourceConfig,
+        allowed_selector_sets: &[SourceSelectorSet],
+        outbound_tls: &OutboundTlsConfig,
+        captured_ca_bundles: &BTreeMap<String, Vec<u8>>,
+        secrets: Arc<SecretResolver>,
+    ) -> Result<Self, SourceError> {
+        Self::compile(
+            source,
+            allowed_selector_sets,
+            Some((outbound_tls, captured_ca_bundles)),
+            secrets,
+        )
+    }
+
+    fn compile(
+        source: &SourceConfig,
+        allowed_selector_sets: &[SourceSelectorSet],
+        outbound_tls: Option<(&OutboundTlsConfig, &BTreeMap<String, Vec<u8>>)>,
+        secrets: Arc<SecretResolver>,
+    ) -> Result<Self, SourceError> {
+        if matches!(source.authentication, SourceAuthentication::None {})
+            && (source.tls_trust_profile.is_some()
+                || validate_local_unauthenticated_source_origin(&source.base_url).is_err())
+        {
+            return Err(SourceError::InvalidPlan);
+        }
+        let timeout = Duration::from_millis(source.request.timeout_milliseconds);
+        if timeout.is_zero()
+            || source.request.timeout_milliseconds > 30_000
+            || source.request.maximum_response_bytes == 0
+            || source.request.maximum_response_bytes > 1_048_576
+            || source.request.concurrency_limit == 0
+            || source.request.concurrency_limit > 256
+        {
+            return Err(SourceError::InvalidPlan);
+        }
+        let base_url = validate_url(&source.base_url, true)?;
+        let authentication = compile_authentication(&source.authentication, timeout)?;
+        let request = compile_request(
+            &source.request,
+            allowed_selector_sets,
+            source.posture,
+            base_url,
+            &authentication,
+        )?;
+        let client = build_client(timeout, source, outbound_tls)?;
+        Ok(Self {
+            client,
+            request,
+            authentication,
+            secrets,
+            concurrency: Semaphore::new(usize::from(source.request.concurrency_limit)),
+            concurrency_admission_timeout: timeout,
+        })
+    }
+
+    /// Make exactly one evidence-data request using validated Rhai preparation
+    /// output. Path expansion remains Rust-owned and selector-bound.
+    pub async fn execute(
+        &self,
+        selectors: &[ResolvedSourceSelector],
+        request_parts: &RequestParts,
+    ) -> Result<JsonValue, SourceError> {
+        let materialized = self.materialize_request(selectors, request_parts)?;
+        let _permit =
+            acquire_source_slot(&self.concurrency, self.concurrency_admission_timeout).await?;
+        let method = match self.request.method {
+            HttpMethod::GET => reqwest::Method::GET,
+            HttpMethod::POST => reqwest::Method::POST,
+        };
+        let mut request = self
+            .client
+            .request(method, materialized.url.clone())
+            .headers(self.request.fixed_headers.clone());
+        if let Some((authentication_name, authentication_value)) =
+            self.authentication_header().await?
+        {
+            request = request.header(authentication_name, authentication_value);
+        }
+        if !self.request.fixed_headers.contains_key(ACCEPT) {
+            request = request.header(ACCEPT, HeaderValue::from_static(JSON_MEDIA_TYPE));
+        }
+        if let Some(body) = materialized.body() {
+            request = request.json(body);
+        }
+        let response = request.send().await.map_err(map_transport_error)?;
+        parse_data_response(
+            response,
+            self.request.maximum_response_bytes,
+            self.request.posture,
+            &self.request.projection,
+        )
+        .await
+    }
+
+    /// Validate and materialize only path, encoded query, and JSON body.
+    ///
+    /// This performs no concurrency admission, credential resolution, or I/O.
+    /// The same result is consumed directly by [`Self::execute`].
+    pub fn materialize_request(
+        &self,
+        selectors: &[ResolvedSourceSelector],
+        request_parts: &RequestParts,
+    ) -> Result<MaterializedSourceRequest, SourceError> {
+        if matches!(self.request.method, HttpMethod::GET) && request_parts.body.is_some() {
+            return Err(SourceError::InvalidPlan);
+        }
+        let selectors = self.request.validate_selectors(selectors)?;
+        let url = self.request.materialize_url(&selectors, request_parts)?;
+        Ok(MaterializedSourceRequest {
+            url,
+            body: request_parts.body.clone(),
+        })
+    }
+
+    /// Resolve and validate credentials without making an evidence-data
+    /// request. OAuth may perform its bounded token bootstrap.
+    pub async fn credentials_ready(&self) -> Result<(), SourceError> {
+        self.authentication_header().await.map(|_| ())
+    }
+
+    async fn authentication_header(
+        &self,
+    ) -> Result<Option<(HeaderName, HeaderValue)>, SourceError> {
+        let value = match &self.authentication {
+            AuthenticationPlan::None => return Ok(None),
+            AuthenticationPlan::Basic {
+                username_ref,
+                password_ref,
+            } => {
+                let username = resolve(&self.secrets, username_ref)?;
+                let password = resolve(&self.secrets, password_ref)?;
+                basic_authorization(&username, &password)?
+            }
+            AuthenticationPlan::StaticBearer { token_ref } => {
+                let token = resolve(&self.secrets, token_ref)?;
+                bearer_authorization(token.expose_secret())?
+            }
+            AuthenticationPlan::StaticApiKey {
+                header_name,
+                value_ref,
+            } => {
+                let secret = resolve(&self.secrets, value_ref)?;
+                return Ok(Some((
+                    header_name.clone(),
+                    sensitive_header(secret.expose_secret())?,
+                )));
+            }
+            AuthenticationPlan::Oauth2(plan) => {
+                let token = plan.access_token(&self.client, &self.secrets).await?;
+                bearer_authorization(token.expose())?
+            }
+        };
+        Ok(Some((AUTHORIZATION, value)))
+    }
+}
+
+/// Apply the exact production response-size, envelope, and projection rules
+/// to an already parsed synthetic fixture response.
+pub fn project_fixture_response(
+    source: &SourceConfig,
+    response: &JsonValue,
+) -> Result<JsonValue, SourceError> {
+    let raw = serde_json::to_vec(response).map_err(|_| SourceError::InvalidJson)?;
+    if raw.len()
+        > usize::try_from(source.request.maximum_response_bytes)
+            .map_err(|_| SourceError::ResponseTooLarge)?
+    {
+        return Err(SourceError::ResponseTooLarge);
+    }
+    if response
+        .as_object()
+        .is_some_and(|object| object.contains_key("errors"))
+    {
+        return Err(SourceError::ErrorEnvelope);
+    }
+    let projection = compile_projection(&source.request.projection)?;
+    let projected = project_value(response, &projection)?;
+    if serde_json::to_vec(&projected)
+        .map_err(|_| SourceError::ProjectionViolation)?
+        .len()
+        > PROJECTED_RESPONSE_MAXIMUM_BYTES
+    {
+        return Err(SourceError::ResponseTooLarge);
+    }
+    Ok(projected)
+}
+
+fn build_client(
+    timeout: Duration,
+    source: &SourceConfig,
+    outbound_tls: Option<(&OutboundTlsConfig, &BTreeMap<String, Vec<u8>>)>,
+) -> Result<reqwest::Client, SourceError> {
+    let mut builder = reqwest::Client::builder()
+        .timeout(timeout)
+        .connect_timeout(timeout.min(Duration::from_secs(10)))
+        .redirect(reqwest::redirect::Policy::none())
+        .no_proxy()
+        // Select rustls explicitly. Cargo unifies reqwest's feature set across
+        // the whole workspace, so another workspace member enabling
+        // reqwest's native-tls feature must not silently change which TLS
+        // backend this client uses.
+        .use_rustls_tls()
+        // Evidence source execution is exactly one request per plan step; a
+        // transport-level retry would duplicate an outbound call the caller
+        // did not ask for and is not accounted for in the one-request
+        // contract.
+        .retry(reqwest::retry::never());
+    if let Some(profile_name) = source.tls_trust_profile.as_deref() {
+        let (tls, captured_ca_bundles) = outbound_tls.ok_or(SourceError::InvalidPlan)?;
+        if !tls.system_roots {
+            return Err(SourceError::InvalidPlan);
+        }
+        let binding = tls
+            .trust_profiles
+            .get(profile_name)
+            .ok_or(SourceError::InvalidPlan)?;
+        if binding.ca_bundle_file.is_empty() {
+            return Err(SourceError::InvalidPlan);
+        }
+        let pem = captured_ca_bundles
+            .get(profile_name)
+            .ok_or(SourceError::InvalidPlan)?;
+        if pem.is_empty() || pem.len() as u64 > PRIVATE_CA_MAXIMUM_BYTES {
+            return Err(SourceError::InvalidPlan);
+        }
+        let certificates =
+            reqwest::Certificate::from_pem_bundle(pem).map_err(|_| SourceError::InvalidPlan)?;
+        if certificates.is_empty() {
+            return Err(SourceError::InvalidPlan);
+        }
+        for certificate in certificates {
+            builder = builder.add_root_certificate(certificate);
+        }
+    }
+    builder.build().map_err(|_| SourceError::InvalidPlan)
+}
+
+fn conservative_selector_sets(
+    source: &SourceConfig,
+) -> Result<Vec<SourceSelectorSet>, SourceError> {
+    let mut sets = vec![Vec::new()];
+    for input in &source.request.selector_inputs {
+        if input.alternatives.is_empty() {
+            return Err(SourceError::InvalidPlan);
+        }
+        let mut next = Vec::new();
+        for set in &sets {
+            for alternative in &input.alternatives {
+                let mut candidate = set.clone();
+                candidate.push((input.role.clone(), alternative.profile.clone()));
+                next.push(candidate);
+            }
+        }
+        sets = next;
+    }
+    if sets.is_empty() {
+        return Err(SourceError::InvalidPlan);
+    }
+    Ok(sets)
+}
+
+fn compile_request(
+    request: &FixedRequest,
+    allowed_selector_sets: &[SourceSelectorSet],
+    posture: AcquisitionPosture,
+    base_url: Url,
+    authentication: &AuthenticationPlan,
+) -> Result<RequestPlan, SourceError> {
+    if request.method == HttpMethod::GET
+        && request.preparation_limits.json_body != PreparationChannelPolicy::Forbidden
+    {
+        return Err(SourceError::InvalidPlan);
+    }
+    let selector_inputs = compile_selector_inputs(request)?;
+    let allowed_selector_sets =
+        compile_allowed_selector_sets(&selector_inputs, allowed_selector_sets)?;
+    let path = compile_source_path(request, &selector_inputs)?;
+    validate_bindings_are_reachable(&path, &allowed_selector_sets)?;
+    let fixed_headers = compile_fixed_headers(request, authentication)?;
+    let projection = compile_projection(&request.projection)?;
+    Ok(RequestPlan {
+        base_url,
+        path,
+        method: request.method,
+        fixed_headers,
+        selector_inputs,
+        allowed_selector_sets,
+        posture,
+        projection,
+        maximum_response_bytes: request.maximum_response_bytes,
+    })
+}
+
+async fn acquire_source_slot<'a>(
+    semaphore: &'a Semaphore,
+    timeout: Duration,
+) -> Result<tokio::sync::SemaphorePermit<'a>, SourceError> {
+    tokio::time::timeout(timeout, semaphore.acquire())
+        .await
+        .map_err(|_| SourceError::Timeout)?
+        .map_err(|_| SourceError::Concurrency)
+}
+
+fn compile_selector_inputs(
+    request: &FixedRequest,
+) -> Result<BTreeMap<String, BTreeMap<String, BTreeSet<String>>>, SourceError> {
+    let mut output = BTreeMap::new();
+    for input in &request.selector_inputs {
+        let profiles = output
+            .entry(input.role.clone())
+            .or_insert_with(BTreeMap::new);
+        for alternative in &input.alternatives {
+            let fields = alternative.fields.iter().cloned().collect::<BTreeSet<_>>();
+            if fields.len() != alternative.fields.len()
+                || profiles
+                    .insert(alternative.profile.clone(), fields)
+                    .is_some()
+            {
+                return Err(SourceError::InvalidPlan);
+            }
+        }
+        if profiles.is_empty() {
+            return Err(SourceError::InvalidPlan);
+        }
+    }
+    if output.is_empty() {
+        return Err(SourceError::InvalidPlan);
+    }
+    Ok(output)
+}
+
+fn compile_allowed_selector_sets(
+    inputs: &BTreeMap<String, BTreeMap<String, BTreeSet<String>>>,
+    configured: &[SourceSelectorSet],
+) -> Result<Vec<SourceSelectorSet>, SourceError> {
+    let mut unique = BTreeSet::new();
+    for configured_set in configured {
+        if configured_set.is_empty() || configured_set.len() > inputs.len() {
+            return Err(SourceError::InvalidPlan);
+        }
+        let mut set = configured_set.clone();
+        set.sort();
+        let mut roles = BTreeSet::new();
+        for (role, profile) in &set {
+            if !roles.insert(role)
+                || !inputs
+                    .get(role)
+                    .is_some_and(|profiles| profiles.contains_key(profile))
+            {
+                return Err(SourceError::InvalidPlan);
+            }
+        }
+        if !unique.insert(set) {
+            return Err(SourceError::InvalidPlan);
+        }
+    }
+    if unique.is_empty() {
+        return Err(SourceError::InvalidPlan);
+    }
+    Ok(unique.into_iter().collect())
+}
+
+/// Refuse any allowed selector set that cannot fill the path template.
+///
+/// `materialize_url` resolves each placeholder against the set the request
+/// actually activated, so a binding is mandatory per set, not across their
+/// union. A set missing one has no value to substitute and fails every request
+/// it serves. That set exists because an authority grant produced it, which is
+/// a startup fact, so refuse it at startup rather than per request.
+fn validate_bindings_are_reachable(
+    path: &SourcePath,
+    allowed: &[SourceSelectorSet],
+) -> Result<(), SourceError> {
+    let SourcePath::Template { bindings, .. } = path else {
+        return Ok(());
+    };
+    for set in allowed {
+        let activated = set
+            .iter()
+            .map(|(role, profile)| (role.as_str(), profile.as_str()))
+            .collect::<BTreeSet<_>>();
+        if bindings
+            .values()
+            .any(|binding| !activated.contains(&(binding.role.as_str(), binding.profile.as_str())))
+        {
+            return Err(SourceError::InvalidPlan);
+        }
+    }
+    Ok(())
+}
+
+fn compile_source_path(
+    request: &FixedRequest,
+    inputs: &BTreeMap<String, BTreeMap<String, BTreeSet<String>>>,
+) -> Result<SourcePath, SourceError> {
+    match (&request.path, &request.path_template) {
+        (Some(path), None) if request.path_bindings.is_empty() => {
+            validate_request_path(path)?;
+            Ok(SourcePath::Fixed(path.clone()))
+        }
+        (None, Some(template)) => {
+            validate_template_shape(template, &request.path_bindings)?;
+            let mut bindings = BTreeMap::new();
+            for (name, binding) in request.path_bindings.iter() {
+                validate_path_binding(binding, inputs)?;
+                bindings.insert(
+                    name.to_owned(),
+                    PathBindingPlan {
+                        role: binding.role.clone(),
+                        profile: binding.profile.clone(),
+                        field: binding.field.clone(),
+                    },
+                );
+            }
+            Ok(SourcePath::Template {
+                template: template.clone(),
+                bindings,
+            })
+        }
+        _ => Err(SourceError::InvalidPlan),
+    }
+}
+
+fn validate_path_binding(
+    binding: &PathBindingConfig,
+    inputs: &BTreeMap<String, BTreeMap<String, BTreeSet<String>>>,
+) -> Result<(), SourceError> {
+    if inputs
+        .get(&binding.role)
+        .and_then(|profiles| profiles.get(&binding.profile))
+        .is_some_and(|fields| fields.contains(&binding.field))
+    {
+        Ok(())
+    } else {
+        Err(SourceError::InvalidPlan)
+    }
+}
+
+fn validate_template_shape(
+    template: &str,
+    bindings: &crate::config::OrderedMap<PathBindingConfig>,
+) -> Result<(), SourceError> {
+    if !template.starts_with('/')
+        || template.starts_with("//")
+        || template.contains(['?', '#', '\\'])
+    {
+        return Err(SourceError::InvalidPlan);
+    }
+    let mut names = BTreeSet::new();
+    for segment in template.split('/').skip(1) {
+        if segment.is_empty() || matches!(segment, "." | "..") {
+            return Err(SourceError::InvalidPlan);
+        }
+        if let Some(name) = segment
+            .strip_prefix('{')
+            .and_then(|value| value.strip_suffix('}'))
+        {
+            if name.is_empty() || !names.insert(name) {
+                return Err(SourceError::InvalidPlan);
+            }
+        } else if segment.contains(['{', '}']) {
+            return Err(SourceError::InvalidPlan);
+        }
+    }
+    if names == bindings.keys().collect::<BTreeSet<_>>() {
+        Ok(())
+    } else {
+        Err(SourceError::InvalidPlan)
+    }
+}
+
+fn compile_fixed_headers(
+    request: &FixedRequest,
+    authentication: &AuthenticationPlan,
+) -> Result<HeaderMap, SourceError> {
+    let mut headers = HeaderMap::new();
+    for fixed in &request.fixed_headers {
+        if reserved_configured_header(&fixed.name) {
+            return Err(SourceError::InvalidPlan);
+        }
+        let name =
+            HeaderName::from_bytes(fixed.name.as_bytes()).map_err(|_| SourceError::InvalidPlan)?;
+        let value = HeaderValue::from_str(&fixed.value).map_err(|_| SourceError::InvalidPlan)?;
+        if headers.insert(name, value).is_some() {
+            return Err(SourceError::InvalidPlan);
+        }
+    }
+    let authentication_name = match authentication {
+        AuthenticationPlan::StaticApiKey { header_name, .. } => header_name,
+        _ => &AUTHORIZATION,
+    };
+    if headers.contains_key(authentication_name) {
+        return Err(SourceError::InvalidPlan);
+    }
+    Ok(headers)
+}
+
+/// Reject a bundle-configured header name before any credential is resolved.
+///
+/// Startup configuration validation already rejects these names. This is the
+/// defensive second check on the request path, and it deliberately calls the
+/// one shared closed classifier so the two deny sets cannot drift apart.
+fn reserved_configured_header(name: &str) -> bool {
+    crate::config::is_reserved_header_name(name)
+}
+
+fn compile_authentication(
+    authentication: &SourceAuthentication,
+    admission_timeout: Duration,
+) -> Result<AuthenticationPlan, SourceError> {
+    match authentication {
+        SourceAuthentication::None {} => Ok(AuthenticationPlan::None),
+        SourceAuthentication::Basic {
+            username_ref,
+            password_ref,
+        } => Ok(AuthenticationPlan::Basic {
+            username_ref: username_ref.clone(),
+            password_ref: password_ref.clone(),
+        }),
+        SourceAuthentication::StaticBearer { token_ref } => Ok(AuthenticationPlan::StaticBearer {
+            token_ref: token_ref.clone(),
+        }),
+        SourceAuthentication::StaticApiKey {
+            header_name,
+            value_ref,
+        } => {
+            if reserved_configured_header(header_name) {
+                return Err(SourceError::InvalidPlan);
+            }
+            Ok(AuthenticationPlan::StaticApiKey {
+                header_name: HeaderName::from_bytes(header_name.as_bytes())
+                    .map_err(|_| SourceError::InvalidPlan)?,
+                value_ref: value_ref.clone(),
+            })
+        }
+        SourceAuthentication::Oauth2ClientCredentials {
+            token_endpoint,
+            client_id_ref,
+            client_secret_ref,
+            scope,
+            credential_placement,
+            maximum_cache_seconds,
+            assumed_lifetime_seconds,
+        } => {
+            let token_endpoint = validate_url(token_endpoint, false)?;
+            if token_endpoint.query().is_some() {
+                return Err(SourceError::InvalidPlan);
+            }
+            Ok(AuthenticationPlan::Oauth2(Box::new(OauthPlan {
+                token_endpoint,
+                client_id_ref: client_id_ref.clone(),
+                client_secret_ref: client_secret_ref.clone(),
+                scope: scope.clone(),
+                credential_placement: *credential_placement,
+                maximum_cache_lifetime: Duration::from_secs(*maximum_cache_seconds),
+                assumed_lifetime: assumed_lifetime_seconds.map(Duration::from_secs),
+                admission_timeout,
+                cache: Mutex::new(None),
+            })))
+        }
+    }
+}
+
+impl RequestPlan {
+    fn validate_selectors<'a>(
+        &self,
+        selectors: &'a [ResolvedSourceSelector],
+    ) -> Result<BTreeMap<(&'a str, &'a str), &'a ResolvedSourceSelector>, SourceError> {
+        let mut index = BTreeMap::new();
+        let mut active = Vec::new();
+        let mut roles = BTreeSet::new();
+        for selector in selectors {
+            if !roles.insert(selector.role.as_str())
+                || index
+                    .insert(
+                        (selector.role.as_str(), selector.profile.as_str()),
+                        selector,
+                    )
+                    .is_some()
+            {
+                return Err(SourceError::InvalidSelectors);
+            }
+            let fields = self
+                .selector_inputs
+                .get(&selector.role)
+                .and_then(|profiles| profiles.get(&selector.profile))
+                .ok_or(SourceError::InvalidSelectors)?;
+            if selector.values.keys().collect::<BTreeSet<_>>()
+                != fields.iter().collect::<BTreeSet<_>>()
+            {
+                return Err(SourceError::InvalidSelectors);
+            }
+            active.push((selector.role.clone(), selector.profile.clone()));
+        }
+        active.sort();
+        if !self.allowed_selector_sets.contains(&active) {
+            return Err(SourceError::InvalidSelectors);
+        }
+        Ok(index)
+    }
+
+    fn materialize_url(
+        &self,
+        selectors: &BTreeMap<(&str, &str), &ResolvedSourceSelector>,
+        parts: &RequestParts,
+    ) -> Result<Url, SourceError> {
+        let path = match &self.path {
+            SourcePath::Fixed(path) => path.clone(),
+            SourcePath::Template { template, bindings } => {
+                let mut rendered = String::new();
+                for segment in template.split('/').skip(1) {
+                    rendered.push('/');
+                    if let Some(name) = segment
+                        .strip_prefix('{')
+                        .and_then(|value| value.strip_suffix('}'))
+                    {
+                        let binding = bindings.get(name).ok_or(SourceError::InvalidPlan)?;
+                        let selector = selectors
+                            .get(&(binding.role.as_str(), binding.profile.as_str()))
+                            .ok_or(SourceError::InvalidSelectors)?;
+                        let value = selector
+                            .values
+                            .get(&binding.field)
+                            .ok_or(SourceError::InvalidSelectors)?;
+                        rendered.push_str(&encode_path_selector(value)?);
+                    } else {
+                        rendered.push_str(segment);
+                    }
+                }
+                rendered
+            }
+        };
+        let mut url = join_source_path(&self.base_url, &path)?;
+        if !parts.query.is_empty() {
+            let mut query = String::new();
+            for pair in &parts.query {
+                if pair.name.is_empty()
+                    || pair.name.bytes().any(|byte| matches!(byte, b'\r' | b'\n'))
+                    || pair.value.bytes().any(|byte| matches!(byte, b'\r' | b'\n'))
+                {
+                    return Err(SourceError::InvalidPlan);
+                }
+                if !query.is_empty() {
+                    query.push('&');
+                }
+                encode_query_component(&pair.name, &mut query);
+                query.push('=');
+                encode_query_component(&pair.value, &mut query);
+            }
+            url.set_query(Some(&query));
+        }
+        Ok(url)
+    }
+}
+
+fn encode_query_component(value: &str, output: &mut String) {
+    const HEX: &[u8; 16] = b"0123456789ABCDEF";
+    for byte in value.bytes() {
+        if byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'.' | b'_' | b'~') {
+            output.push(char::from(byte));
+        } else {
+            output.push('%');
+            output.push(char::from(HEX[usize::from(byte >> 4)]));
+            output.push(char::from(HEX[usize::from(byte & 0x0f)]));
+        }
+    }
+}
+
+fn encode_path_selector(value: &SelectorValue) -> Result<String, SourceError> {
+    let text = match value {
+        SelectorValue::String(value) => value.clone(),
+        SelectorValue::Integer(value) => value.to_string(),
+        SelectorValue::Boolean(value) => value.to_string(),
+    };
+    if text.is_empty()
+        || matches!(text.as_str(), "." | "..")
+        || text.chars().any(char::is_control)
+        || text.contains(['/', '\\', '%'])
+    {
+        return Err(SourceError::InvalidSelectors);
+    }
+    let mut encoded = String::with_capacity(text.len());
+    for byte in text.bytes() {
+        if byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'.' | b'_' | b'~') {
+            encoded.push(char::from(byte));
+        } else {
+            use std::fmt::Write as _;
+            write!(&mut encoded, "%{byte:02X}").map_err(|_| SourceError::InvalidSelectors)?;
+        }
+    }
+    Ok(encoded)
+}
+
+impl OauthPlan {
+    async fn access_token(
+        &self,
+        client: &reqwest::Client,
+        secrets: &SecretResolver,
+    ) -> Result<ProtectedToken, SourceError> {
+        let mut cache = tokio::time::timeout(self.admission_timeout, self.cache.lock())
+            .await
+            .map_err(|_| SourceError::Timeout)?;
+        let now = Instant::now();
+        if let Some(cached) = cache.as_ref() {
+            if cached.expires_at > now {
+                return Ok(cached.token.clone());
+            }
+        }
+        *cache = None;
+        let client_id = resolve(secrets, &self.client_id_ref)?;
+        let client_secret = resolve(secrets, &self.client_secret_ref)?;
+        let client_id_text = protected_text(&client_id)?;
+        let client_secret_text = protected_text(&client_secret)?;
+        let mut form = vec![("grant_type", "client_credentials")];
+        if let Some(scope) = self.scope.as_deref() {
+            form.push(("scope", scope));
+        }
+        // Both placements keep the client credentials out of the request URI,
+        // where proxy and ingress logs would capture them.
+        let mut request = client
+            .post(self.token_endpoint.clone())
+            .header(ACCEPT, JSON_MEDIA_TYPE);
+        match self.credential_placement {
+            CredentialPlacement::BasicHeader => {
+                request = request.header(
+                    AUTHORIZATION,
+                    basic_authorization(&client_id, &client_secret)?,
+                );
+            }
+            CredentialPlacement::FormBody => {
+                form.push(("client_id", client_id_text));
+                form.push(("client_secret", client_secret_text));
+            }
+        }
+        request = request.form(&form);
+        drop(form);
+        drop(client_id);
+        drop(client_secret);
+        let response = request.send().await.map_err(map_transport_error)?;
+        let (token, lifetime) =
+            parse_token_response(response, self.scope.as_deref(), self.assumed_lifetime).await?;
+        let cache_lifetime = lifetime.min(self.maximum_cache_lifetime);
+        if !cache_lifetime.is_zero() {
+            let expires_at = Instant::now()
+                .checked_add(cache_lifetime)
+                .ok_or(SourceError::Credential)?;
+            *cache = Some(CachedToken {
+                token: token.clone(),
+                expires_at,
+            });
+        }
+        Ok(token)
+    }
+}
+
+fn compile_projection(paths: &[String]) -> Result<ProjectionNode, SourceError> {
+    if paths.is_empty() {
+        return Err(SourceError::InvalidPlan);
+    }
+    let mut root = ProjectionNode::default();
+    for path in paths {
+        let segments = parse_projection_pointer(path)?;
+        let mut node = &mut root;
+        for segment in segments {
+            if node.terminal {
+                return Err(SourceError::InvalidPlan);
+            }
+            match segment {
+                ProjectionSegment::Key(key) => {
+                    if node.wildcard.is_some() {
+                        return Err(SourceError::InvalidPlan);
+                    }
+                    node = node.keys.entry(key).or_default();
+                }
+                ProjectionSegment::Wildcard => {
+                    if !node.keys.is_empty() {
+                        return Err(SourceError::InvalidPlan);
+                    }
+                    node = node
+                        .wildcard
+                        .get_or_insert_with(|| Box::new(ProjectionNode::default()));
+                }
+            }
+        }
+        if node.terminal || !node.keys.is_empty() || node.wildcard.is_some() {
+            return Err(SourceError::InvalidPlan);
+        }
+        node.terminal = true;
+    }
+    Ok(root)
+}
+
+enum ProjectionSegment {
+    Key(String),
+    Wildcard,
+}
+
+fn parse_projection_pointer(pointer: &str) -> Result<Vec<ProjectionSegment>, SourceError> {
+    if !pointer.starts_with('/')
+        || pointer.starts_with("//")
+        || pointer.chars().any(char::is_control)
+    {
+        return Err(SourceError::InvalidPlan);
+    }
+    pointer[1..]
+        .split('/')
+        .map(|raw| {
+            if raw.is_empty() {
+                return Err(SourceError::InvalidPlan);
+            }
+            if raw == "*" {
+                return Ok(ProjectionSegment::Wildcard);
+            }
+            let mut decoded = String::with_capacity(raw.len());
+            let mut chars = raw.chars();
+            while let Some(character) = chars.next() {
+                if character == '~' {
+                    match chars.next() {
+                        Some('0') => decoded.push('~'),
+                        Some('1') => decoded.push('/'),
+                        _ => return Err(SourceError::InvalidPlan),
+                    }
+                } else {
+                    decoded.push(character);
+                }
+            }
+            if decoded.is_empty() || decoded.bytes().all(|byte| byte.is_ascii_digit()) {
+                return Err(SourceError::InvalidPlan);
+            }
+            Ok(ProjectionSegment::Key(decoded))
+        })
+        .collect()
+}
+
+fn project_value(value: &JsonValue, node: &ProjectionNode) -> Result<JsonValue, SourceError> {
+    if node.terminal {
+        return Ok(value.clone());
+    }
+    if let Some(wildcard) = &node.wildcard {
+        let array = value.as_array().ok_or(SourceError::ProjectionViolation)?;
+        return array
+            .iter()
+            .map(|item| project_value(item, wildcard))
+            .collect::<Result<Vec<_>, _>>()
+            .map(JsonValue::Array);
+    }
+    let object = value.as_object().ok_or(SourceError::ProjectionViolation)?;
+    let mut projected = JsonMap::new();
+    for (key, child) in &node.keys {
+        match object.get(key) {
+            Some(value) => {
+                projected.insert(key.clone(), project_value(value, child)?);
+            }
+            None if child.terminal => {}
+            None => return Err(SourceError::ProjectionViolation),
+        }
+    }
+    Ok(JsonValue::Object(projected))
+}
+
+fn resolve(
+    resolver: &SecretResolver,
+    reference: &SecretRef,
+) -> Result<ProtectedSecret, SourceError> {
+    resolver
+        .resolve(reference.as_str())
+        .map_err(|_| SourceError::Credential)
+}
+
+fn protected_text(secret: &ProtectedSecret) -> Result<&str, SourceError> {
+    std::str::from_utf8(secret.expose_secret()).map_err(|_| SourceError::Credential)
+}
+
+fn basic_authorization(
+    username: &ProtectedSecret,
+    password: &ProtectedSecret,
+) -> Result<HeaderValue, SourceError> {
+    if username.is_empty() || password.is_empty() || username.expose_secret().contains(&b':') {
+        return Err(SourceError::Credential);
+    }
+    let mut joined = Zeroizing::new(Vec::with_capacity(username.len() + password.len() + 1));
+    joined.extend_from_slice(username.expose_secret());
+    joined.push(b':');
+    joined.extend_from_slice(password.expose_secret());
+    let encoded =
+        Zeroizing::new(base64::engine::general_purpose::STANDARD.encode(joined.as_slice()));
+    let mut header = Zeroizing::new(Vec::with_capacity(6 + encoded.len()));
+    header.extend_from_slice(b"Basic ");
+    header.extend_from_slice(encoded.as_bytes());
+    sensitive_header(&header)
+}
+
+fn bearer_authorization(token: &[u8]) -> Result<HeaderValue, SourceError> {
+    if token.is_empty() {
+        return Err(SourceError::Credential);
+    }
+    let mut header = Zeroizing::new(Vec::with_capacity(7 + token.len()));
+    header.extend_from_slice(b"Bearer ");
+    header.extend_from_slice(token);
+    sensitive_header(&header)
+}
+
+fn sensitive_header(bytes: &[u8]) -> Result<HeaderValue, SourceError> {
+    let mut value = HeaderValue::from_bytes(bytes).map_err(|_| SourceError::Credential)?;
+    value.set_sensitive(true);
+    Ok(value)
+}
+
+async fn parse_data_response(
+    response: reqwest::Response,
+    maximum_bytes: u64,
+    _posture: AcquisitionPosture,
+    projection: &ProjectionNode,
+) -> Result<JsonValue, SourceError> {
+    reject_response_status(&response)?;
+    let media_type = response_media_type(&response)?;
+    if media_type != JSON_MEDIA_TYPE && media_type != GRAPHQL_JSON_MEDIA_TYPE {
+        return Err(SourceError::WrongMediaType);
+    }
+    let bytes = Zeroizing::new(
+        read_bounded(response, maximum_bytes)
+            .await
+            .map_err(map_bounded_read_error)?,
+    );
+    let value = parse_strict_json(&bytes)?;
+    drop(bytes);
+    if value
+        .as_object()
+        .is_some_and(|object| object.contains_key("errors"))
+    {
+        return Err(SourceError::ErrorEnvelope);
+    }
+    let projected = project_value(&value, projection)?;
+    if serde_json::to_vec(&projected)
+        .map_err(|_| SourceError::ProjectionViolation)?
+        .len()
+        > PROJECTED_RESPONSE_MAXIMUM_BYTES
+    {
+        return Err(SourceError::ResponseTooLarge);
+    }
+    Ok(projected)
+}
+
+async fn parse_token_response(
+    response: reqwest::Response,
+    expected_scope: Option<&str>,
+    assumed_lifetime: Option<Duration>,
+) -> Result<(ProtectedToken, Duration), SourceError> {
+    // `reject_response_status` classifies only redirect/status outcomes, never a
+    // timeout, so every rejection here is a credential-exchange failure.
+    reject_response_status(&response).map_err(|_| SourceError::Credential)?;
+    if response_media_type(&response).map_err(|_| SourceError::Credential)? != JSON_MEDIA_TYPE {
+        return Err(SourceError::Credential);
+    }
+    let bytes = Zeroizing::new(
+        read_bounded(response, TOKEN_RESPONSE_MAXIMUM_BYTES)
+            .await
+            .map_err(|_| SourceError::Credential)?,
+    );
+    let mut object = parse_strict_json(&bytes)
+        .map_err(|_| SourceError::Credential)?
+        .as_object()
+        .cloned()
+        .ok_or(SourceError::Credential)?;
+    drop(bytes);
+    let access_token = match object.remove("access_token") {
+        Some(JsonValue::String(value)) => value,
+        _ => return Err(SourceError::Credential),
+    };
+    let token_type = match object.remove("token_type") {
+        Some(JsonValue::String(value)) => value,
+        _ => return Err(SourceError::Credential),
+    };
+    if !token_type.eq_ignore_ascii_case("bearer") {
+        return Err(SourceError::Credential);
+    }
+    // RFC 6749 section 5.1 makes `expires_in` recommended rather than required.
+    // A provider that omits it is accepted only when the bundle states the
+    // lifetime to assume; a present but unusable value is never rescued by it.
+    let lifetime = match object.remove("expires_in") {
+        Some(JsonValue::Number(value)) => Duration::from_secs(
+            value
+                .as_u64()
+                .filter(|seconds| *seconds > 0)
+                .ok_or(SourceError::Credential)?,
+        ),
+        Some(_) => return Err(SourceError::Credential),
+        None => assumed_lifetime.ok_or(SourceError::Credential)?,
+    };
+    if let Some(scope) = object.remove("scope") {
+        let JsonValue::String(scope) = scope else {
+            return Err(SourceError::Credential);
+        };
+        if scope.is_empty()
+            || scope.len() > 512
+            || expected_scope.is_some_and(|expected| scope != expected)
+        {
+            return Err(SourceError::Credential);
+        }
+    }
+    // RFC 6749 section 5.1 permits members beyond the ones it defines, and
+    // deployed authorization servers send them: `refresh_expires_in` and
+    // `not-before-policy` from Keycloak, `ext_expires_in` from Entra ID.
+    // Refusing them would refuse the providers Evidence is documented against.
+    //
+    // Ignoring is not trusting. Nothing here reads an unread member, no script
+    // ever sees the token response, and `parse_strict_json` refuses duplicate
+    // members, so an extension cannot arrive as a second `access_token`. What
+    // remains is that one of them may carry credential material of its own, so
+    // scrub the strings before the map is dropped rather than leaving them for
+    // the allocator, the same reason the response bytes are zeroized above.
+    for (_, value) in &mut object {
+        if let JsonValue::String(value) = value {
+            value.zeroize();
+        }
+    }
+    drop(object);
+    Ok((ProtectedToken::from_string(access_token)?, lifetime))
+}
+
+fn reject_response_status(response: &reqwest::Response) -> Result<(), SourceError> {
+    let status = response.status();
+    if status.is_redirection() {
+        return Err(SourceError::Redirect);
+    }
+    if status.is_success() {
+        return Ok(());
+    }
+    Err(SourceError::Status(match status.as_u16() {
+        401 => SourceStatus::Unauthorized,
+        403 => SourceStatus::Forbidden,
+        429 => SourceStatus::RateLimited,
+        500..=599 => SourceStatus::ServerError,
+        _ => SourceStatus::Other,
+    }))
+}
+
+fn response_media_type(response: &reqwest::Response) -> Result<&str, SourceError> {
+    let mut values = response.headers().get_all(CONTENT_TYPE).iter();
+    let value = values.next().ok_or(SourceError::WrongMediaType)?;
+    if values.next().is_some() {
+        return Err(SourceError::WrongMediaType);
+    }
+    let value = value.to_str().map_err(|_| SourceError::WrongMediaType)?;
+    let media_type = value.split(';').next().unwrap_or_default().trim();
+    if media_type.eq_ignore_ascii_case(JSON_MEDIA_TYPE) {
+        Ok(JSON_MEDIA_TYPE)
+    } else if media_type.eq_ignore_ascii_case(GRAPHQL_JSON_MEDIA_TYPE) {
+        Ok(GRAPHQL_JSON_MEDIA_TYPE)
+    } else {
+        Ok(media_type)
+    }
+}
+
+fn map_transport_error(error: reqwest::Error) -> SourceError {
+    if error.is_timeout() {
+        SourceError::Timeout
+    } else {
+        SourceError::Transport
+    }
+}
+
+fn map_bounded_read_error(error: BoundedReadError) -> SourceError {
+    match error {
+        BoundedReadError::Transport(error) => map_transport_error(error),
+        BoundedReadError::ContentLengthExceeded { .. }
+        | BoundedReadError::BodyTooLarge { .. }
+        | BoundedReadError::LengthOverflow => SourceError::ResponseTooLarge,
+        _ => SourceError::Transport,
+    }
+}
+
+fn validate_url(value: &str, origin_only: bool) -> Result<Url, SourceError> {
+    let url = Url::parse(value).map_err(|_| SourceError::InvalidPlan)?;
+    if !url.username().is_empty() || url.password().is_some() || url.fragment().is_some() {
+        return Err(SourceError::InvalidPlan);
+    }
+    if origin_only && (url.path() != "/" || url.query().is_some()) {
+        return Err(SourceError::InvalidPlan);
+    }
+    match url.scheme() {
+        "https" if url.host().is_some() => {}
+        "http" => match url.host() {
+            Some(Host::Ipv4(ip)) if ip.is_loopback() => {}
+            Some(Host::Ipv6(ip)) if ip == std::net::Ipv6Addr::LOCALHOST => {}
+            _ => return Err(SourceError::InvalidPlan),
+        },
+        _ => return Err(SourceError::InvalidPlan),
+    }
+    Ok(url)
+}
+
+fn validate_request_path(path: &str) -> Result<(), SourceError> {
+    if path.len() < 2
+        || !path.starts_with('/')
+        || path.starts_with("//")
+        || path.contains(['?', '#', '\\'])
+        || path
+            .split('/')
+            .skip(1)
+            .any(|segment| segment.is_empty() || matches!(segment, "." | ".."))
+    {
+        return Err(SourceError::InvalidPlan);
+    }
+    Ok(())
+}
+
+fn join_source_path(base: &Url, path: &str) -> Result<Url, SourceError> {
+    validate_request_path(path)?;
+    let value = format!("{}{}", base.as_str().trim_end_matches('/'), path);
+    let url = Url::parse(&value).map_err(|_| SourceError::InvalidPlan)?;
+    if url.scheme() != base.scheme()
+        || url.host() != base.host()
+        || url.port_or_known_default() != base.port_or_known_default()
+    {
+        return Err(SourceError::InvalidPlan);
+    }
+    Ok(url)
+}
+
+struct StrictJson(JsonValue);
+
+impl<'de> Deserialize<'de> for StrictJson {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        deserializer.deserialize_any(StrictJsonVisitor)
+    }
+}
+
+struct StrictJsonVisitor;
+
+impl<'de> Visitor<'de> for StrictJsonVisitor {
+    type Value = StrictJson;
+    fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("a duplicate-free JSON value")
+    }
+    fn visit_bool<E>(self, value: bool) -> Result<Self::Value, E> {
+        Ok(StrictJson(JsonValue::Bool(value)))
+    }
+    fn visit_i64<E>(self, value: i64) -> Result<Self::Value, E> {
+        Ok(StrictJson(JsonValue::Number(value.into())))
+    }
+    fn visit_u64<E>(self, value: u64) -> Result<Self::Value, E> {
+        Ok(StrictJson(JsonValue::Number(value.into())))
+    }
+    fn visit_f64<E: de::Error>(self, value: f64) -> Result<Self::Value, E> {
+        JsonNumber::from_f64(value)
+            .map(JsonValue::Number)
+            .map(StrictJson)
+            .ok_or_else(|| de::Error::custom("invalid JSON number"))
+    }
+    fn visit_str<E: de::Error>(self, value: &str) -> Result<Self::Value, E> {
+        self.visit_string(value.to_owned())
+    }
+    fn visit_string<E>(self, value: String) -> Result<Self::Value, E> {
+        Ok(StrictJson(JsonValue::String(value)))
+    }
+    fn visit_none<E>(self) -> Result<Self::Value, E> {
+        Ok(StrictJson(JsonValue::Null))
+    }
+    fn visit_unit<E>(self) -> Result<Self::Value, E> {
+        Ok(StrictJson(JsonValue::Null))
+    }
+    fn visit_some<D: Deserializer<'de>>(self, deserializer: D) -> Result<Self::Value, D::Error> {
+        StrictJson::deserialize(deserializer)
+    }
+    fn visit_seq<A: SeqAccess<'de>>(self, mut sequence: A) -> Result<Self::Value, A::Error> {
+        let mut values = Vec::with_capacity(sequence.size_hint().unwrap_or(0));
+        while let Some(value) = sequence.next_element::<StrictJson>()? {
+            values.push(value.0);
+        }
+        Ok(StrictJson(JsonValue::Array(values)))
+    }
+    fn visit_map<A: MapAccess<'de>>(self, mut mapping: A) -> Result<Self::Value, A::Error> {
+        let mut object = JsonMap::new();
+        while let Some((key, value)) = mapping.next_entry::<String, StrictJson>()? {
+            if object.insert(key, value.0).is_some() {
+                return Err(de::Error::custom("duplicate JSON object member"));
+            }
+        }
+        Ok(StrictJson(JsonValue::Object(object)))
+    }
+}
+
+fn parse_strict_json(bytes: &[u8]) -> Result<JsonValue, SourceError> {
+    let mut deserializer = serde_json::Deserializer::from_slice(bytes);
+    let value = StrictJson::deserialize(&mut deserializer).map_err(|_| SourceError::InvalidJson)?;
+    deserializer.end().map_err(|_| SourceError::InvalidJson)?;
+    Ok(value.0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn projection_supports_nested_arrays_escapes_and_literal_dots() {
+        let plan = compile_projection(&[
+            "/total".into(),
+            "/results/*/declaration/mother.personReference".into(),
+            "/results/*/a~1b/~0value".into(),
+        ])
+        .expect("projection compiles");
+        let input = json!({
+            "total": 1,
+            "ignored": "gone",
+            "results": [{
+                "declaration": {"mother.personReference": "P-1", "private": "gone"},
+                "a/b": {"~value": true, "ignored": false}
+            }]
+        });
+        assert_eq!(
+            project_value(&input, &plan),
+            Ok(json!({
+                "total": 1,
+                "results": [{
+                    "declaration": {"mother.personReference": "P-1"},
+                    "a/b": {"~value": true}
+                }]
+            }))
+        );
+    }
+
+    #[test]
+    fn projection_omits_missing_leaves_but_rejects_missing_or_mistyped_intermediates() {
+        let plan =
+            compile_projection(&["/results/*/optional".into()]).expect("projection compiles");
+        assert_eq!(
+            project_value(&json!({"results": [{}]}), &plan),
+            Ok(json!({"results": [{}]}))
+        );
+        assert_eq!(
+            project_value(&json!({}), &plan),
+            Err(SourceError::ProjectionViolation)
+        );
+        assert_eq!(
+            project_value(&json!({"results": {}}), &plan),
+            Err(SourceError::ProjectionViolation)
+        );
+    }
+
+    #[test]
+    fn projection_rejects_duplicates_conflicts_indexes_and_mixed_container_shapes() {
+        for paths in [
+            vec!["/a".into(), "/a".into()],
+            vec!["/a".into(), "/a/b".into()],
+            vec!["/a/0".into()],
+            vec!["/a/*/x".into(), "/a/b".into()],
+        ] {
+            assert!(compile_projection(&paths).is_err());
+        }
+    }
+
+    #[test]
+    fn path_selector_encoding_is_single_pass_and_hostile_values_fail_closed() {
+        assert_eq!(
+            encode_path_selector(&SelectorValue::String("A B".into())),
+            Ok("A%20B".into())
+        );
+        for value in [".", "..", "a/b", "a\\b", "a%2Fb", "a\nb"] {
+            assert_eq!(
+                encode_path_selector(&SelectorValue::String(value.into())),
+                Err(SourceError::InvalidSelectors)
+            );
+        }
+    }
+
+    #[test]
+    fn duplicate_json_members_are_rejected() {
+        assert_eq!(
+            parse_strict_json(br#"{"a":1,"a":2}"#),
+            Err(SourceError::InvalidJson)
+        );
+    }
+
+    #[tokio::test]
+    async fn saturated_source_admission_fails_at_the_configured_timeout() {
+        let server = wiremock::MockServer::start().await;
+        let source: SourceConfig = serde_json::from_value(json!({
+            "transport": "http-json",
+            "baseUrl": server.uri(),
+            "posture": "source-derived",
+            "authentication": {
+                "kind": "static-bearer",
+                "tokenRef": "secret:file/missing-source-token"
+            },
+            "request": {
+                "method": "POST",
+                "path": "/data",
+                "fixedHeaders": [],
+                "selectorInputs": [{
+                    "role": "subject",
+                    "alternatives": [{"profile": "record-v1", "fields": ["record_id"]}]
+                }],
+                "prepareScript": "adapters/prepare.rhai",
+                "adapterParameters": {},
+                "adapterParametersSchema": "schemas/parameters.schema.yaml",
+                "preparationLimits": {
+                    "query": "forbidden",
+                    "jsonBody": "required",
+                    "maximumJsonDepth": 4,
+                    "maximumCollectionItems": 4,
+                    "maximumStringBytes": 64,
+                    "maximumNormalizedBytes": 1024
+                },
+                "projection": ["/ok"],
+                "redirects": "deny",
+                "timeoutMilliseconds": 20,
+                "maximumResponseBytes": 1024,
+                "concurrencyLimit": 1
+            },
+            "responseSchema": "schemas/response.schema.yaml",
+            "extractScript": "adapters/extract.rhai",
+            "factSchema": "schemas/facts.schema.yaml"
+        }))
+        .expect("source config deserializes");
+        let secret_root = tempfile::tempdir().expect("temporary secret root");
+        let secrets = Arc::new(
+            SecretResolver::new([crate::secrets::SecretProvider::File], secret_root.path())
+                .expect("secret resolver builds"),
+        );
+        let executor = SourceExecutor::new(&source, secrets).expect("source executor builds");
+        let _occupied = executor
+            .concurrency
+            .acquire()
+            .await
+            .expect("source slot is available");
+        let selectors = [ResolvedSourceSelector {
+            role: "subject".into(),
+            profile: "record-v1".into(),
+            values: BTreeMap::from([(
+                "record_id".into(),
+                SelectorValue::String("synthetic-record".into()),
+            )]),
+        }];
+        let started = Instant::now();
+        assert!(matches!(
+            executor
+                .execute(
+                    &selectors,
+                    &RequestParts {
+                        query: Vec::new(),
+                        body: Some(json!({"requested": true})),
+                    },
+                )
+                .await,
+            Err(SourceError::Timeout)
+        ));
+        assert!(started.elapsed() < Duration::from_secs(1));
+        assert!(server
+            .received_requests()
+            .await
+            .expect("request journal is available")
+            .is_empty());
+    }
+
+    /// Spins up a TLS server whose certificate is signed by a private
+    /// certificate authority that the client under test is never told to
+    /// trust. The resulting handshake failure is specific to whichever TLS
+    /// backend the client actually uses, which makes it a proof that the
+    /// backend selected in `build_client` is the one in effect at runtime.
+    async fn spawn_untrusted_tls_server(
+        server_subject_alt_name: &str,
+    ) -> (std::net::SocketAddr, tokio::task::JoinHandle<()>) {
+        let mut ca_parameters = rcgen::CertificateParams::new(Vec::<String>::new())
+            .expect("private CA parameters are valid");
+        ca_parameters.is_ca = rcgen::IsCa::Ca(rcgen::BasicConstraints::Unconstrained);
+        let ca_key = rcgen::KeyPair::generate().expect("private CA key generates");
+        let ca_certificate = ca_parameters
+            .self_signed(&ca_key)
+            .expect("private CA certificate generates");
+
+        let server_parameters =
+            rcgen::CertificateParams::new(vec![server_subject_alt_name.to_owned()])
+                .expect("server certificate parameters are valid");
+        let server_key = rcgen::KeyPair::generate().expect("server key generates");
+        let server_certificate = server_parameters
+            .signed_by(&server_key, &ca_certificate, &ca_key)
+            .expect("private CA signs server certificate");
+        let private_key = tokio_rustls::rustls::pki_types::PrivateKeyDer::Pkcs8(
+            tokio_rustls::rustls::pki_types::PrivatePkcs8KeyDer::from(server_key.serialize_der()),
+        );
+        let server_config = tokio_rustls::rustls::ServerConfig::builder()
+            .with_no_client_auth()
+            .with_single_cert(vec![server_certificate.der().clone()], private_key)
+            .expect("TLS server configuration builds");
+        let acceptor = tokio_rustls::TlsAcceptor::from(Arc::new(server_config));
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("TLS test server binds");
+        let address = listener.local_addr().expect("TLS server address");
+        let handle = tokio::spawn(async move {
+            let Ok((stream, _)) = listener.accept().await else {
+                return;
+            };
+            // The client is expected to abort the handshake once it
+            // evaluates the certificate chain, so no request or response
+            // handling is needed here.
+            let _ = acceptor.accept(stream).await;
+        });
+        (address, handle)
+    }
+
+    #[tokio::test]
+    async fn evidence_client_uses_rustls_and_fails_closed_on_an_unrecognized_certificate_authority()
+    {
+        let (address, _server) = spawn_untrusted_tls_server("127.0.0.1").await;
+        let source: SourceConfig = serde_json::from_value(json!({
+            "transport": "http-json",
+            "baseUrl": format!("https://{address}"),
+            "posture": "source-derived",
+            "authentication": {
+                "kind": "static-bearer",
+                "tokenRef": "secret:file/missing-source-token"
+            },
+            "request": {
+                "method": "POST",
+                "path": "/data",
+                "fixedHeaders": [],
+                "selectorInputs": [{
+                    "role": "subject",
+                    "alternatives": [{"profile": "record-v1", "fields": ["record_id"]}]
+                }],
+                "prepareScript": "adapters/prepare.rhai",
+                "adapterParameters": {},
+                "adapterParametersSchema": "schemas/parameters.schema.yaml",
+                "preparationLimits": {
+                    "query": "forbidden",
+                    "jsonBody": "required",
+                    "maximumJsonDepth": 4,
+                    "maximumCollectionItems": 4,
+                    "maximumStringBytes": 64,
+                    "maximumNormalizedBytes": 1024
+                },
+                "projection": ["/ok"],
+                "redirects": "deny",
+                "timeoutMilliseconds": 2000,
+                "maximumResponseBytes": 1024,
+                "concurrencyLimit": 1
+            },
+            "responseSchema": "schemas/response.schema.yaml",
+            "extractScript": "adapters/extract.rhai",
+            "factSchema": "schemas/facts.schema.yaml"
+        }))
+        .expect("source config deserializes");
+        let client = build_client(Duration::from_secs(5), &source, None).expect("client builds");
+        let error = client
+            .get(format!("https://{address}/"))
+            .send()
+            .await
+            .expect_err("an unrecognized certificate authority is rejected");
+        let mut messages = Vec::new();
+        let mut current: &dyn std::error::Error = &error;
+        while let Some(source) = current.source() {
+            messages.push(source.to_string());
+            current = source;
+        }
+        assert!(
+            messages
+                .iter()
+                .any(|message| message.contains("invalid peer certificate")),
+            "expected a rustls certificate-validation error in the source chain, got: {messages:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn saturated_oauth_single_flight_fails_before_credentials_or_transport() {
+        let secret_root = tempfile::tempdir().expect("temporary secret root");
+        let secrets =
+            SecretResolver::new([crate::secrets::SecretProvider::File], secret_root.path())
+                .expect("secret resolver builds");
+        let plan = OauthPlan {
+            token_endpoint: Url::parse("http://127.0.0.1:1/token")
+                .expect("synthetic endpoint parses"),
+            client_id_ref: SecretRef::parse("secret:file/missing-client-id")
+                .expect("secret reference parses"),
+            client_secret_ref: SecretRef::parse("secret:file/missing-client-secret")
+                .expect("secret reference parses"),
+            scope: Some("fixture.read".into()),
+            credential_placement: CredentialPlacement::FormBody,
+            maximum_cache_lifetime: Duration::from_secs(60),
+            assumed_lifetime: None,
+            admission_timeout: Duration::from_millis(20),
+            cache: Mutex::new(None),
+        };
+        let _occupied = plan.cache.lock().await;
+        let client = reqwest::Client::builder()
+            .no_proxy()
+            .build()
+            .expect("HTTP client builds");
+        let started = Instant::now();
+        let result =
+            tokio::time::timeout(Duration::from_secs(1), plan.access_token(&client, &secrets))
+                .await
+                .expect("OAuth admission is bounded by its configured timeout");
+        assert!(matches!(result, Err(SourceError::Timeout)));
+        assert!(started.elapsed() < Duration::from_secs(1));
+    }
+}
diff --git a/crates/registry-evidence/src/values.rs b/crates/registry-evidence/src/values.rs
new file mode 100644
index 000000000..53edb0814
--- /dev/null
+++ b/crates/registry-evidence/src/values.rs
@@ -0,0 +1,259 @@
+//! Core-owned exact and protected values crossing the Rhai boundary.
+
+use std::{cmp::Ordering, fmt, str::FromStr};
+
+use serde::{Serialize, Serializer};
+use thiserror::Error;
+use zeroize::Zeroizing;
+
+const MAX_DECIMAL_PRECISION: usize = 28;
+const MAX_DECIMAL_SCALE: u32 = 9;
+const MAX_ENTITY_SEED_BYTES: usize = 512;
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct Decimal {
+    coefficient: i128,
+    scale: u32,
+    canonical: String,
+}
+
+impl Decimal {
+    pub fn parse(input: &str) -> Result<Self, DecimalError> {
+        if input.is_empty()
+            || input.starts_with('+')
+            || input.contains(['e', 'E'])
+            || matches!(input, "NaN" | "Infinity" | "-Infinity")
+        {
+            return Err(DecimalError::Lexical);
+        }
+
+        let (negative, unsigned) = match input.strip_prefix('-') {
+            Some(unsigned) => (true, unsigned),
+            None => (false, input),
+        };
+        if unsigned.is_empty() {
+            return Err(DecimalError::Lexical);
+        }
+        let (integer, fraction) = match unsigned.split_once('.') {
+            Some((integer, fraction)) => (integer, Some(fraction)),
+            None => (unsigned, None),
+        };
+
+        if integer.is_empty()
+            || !integer.bytes().all(|byte| byte.is_ascii_digit())
+            || (integer.len() > 1 && integer.starts_with('0'))
+        {
+            return Err(DecimalError::Lexical);
+        }
+        let scale = match fraction {
+            Some(fraction)
+                if !fraction.is_empty()
+                    && fraction.bytes().all(|byte| byte.is_ascii_digit())
+                    && !fraction.ends_with('0') =>
+            {
+                u32::try_from(fraction.len()).map_err(|_| DecimalError::Scale)?
+            }
+            Some(_) => return Err(DecimalError::Lexical),
+            None => 0,
+        };
+        if scale > MAX_DECIMAL_SCALE {
+            return Err(DecimalError::Scale);
+        }
+
+        let digits = match fraction {
+            Some(fraction) => format!("{integer}{fraction}"),
+            None => integer.to_owned(),
+        };
+        let significant = digits.trim_start_matches('0');
+        let precision = significant.len().max(1);
+        if precision > MAX_DECIMAL_PRECISION {
+            return Err(DecimalError::Precision);
+        }
+        let magnitude = if significant.is_empty() {
+            0
+        } else {
+            i128::from_str(significant).map_err(|_| DecimalError::Precision)?
+        };
+        if magnitude == 0 && (negative || scale != 0) {
+            return Err(DecimalError::Zero);
+        }
+        let coefficient = if negative { -magnitude } else { magnitude };
+
+        Ok(Self {
+            coefficient,
+            scale,
+            canonical: input.to_owned(),
+        })
+    }
+
+    pub fn from_integer(value: i64) -> Self {
+        Self {
+            coefficient: i128::from(value),
+            scale: 0,
+            canonical: value.to_string(),
+        }
+    }
+
+    pub fn canonical(&self) -> &str {
+        &self.canonical
+    }
+
+    pub fn scale(&self) -> u32 {
+        self.scale
+    }
+
+    pub fn compare(&self, other: &Self) -> Ordering {
+        match self.scale.cmp(&other.scale) {
+            Ordering::Equal => self.coefficient.cmp(&other.coefficient),
+            Ordering::Less => self
+                .coefficient
+                .saturating_mul(power_of_ten(other.scale - self.scale))
+                .cmp(&other.coefficient),
+            Ordering::Greater => self.coefficient.cmp(
+                &other
+                    .coefficient
+                    .saturating_mul(power_of_ten(self.scale - other.scale)),
+            ),
+        }
+    }
+}
+
+impl fmt::Debug for Decimal {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("Decimal([REDACTED])")
+    }
+}
+
+impl Serialize for Decimal {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        serializer.serialize_str(&self.canonical)
+    }
+}
+
+impl FromStr for Decimal {
+    type Err = DecimalError;
+
+    fn from_str(input: &str) -> Result<Self, Self::Err> {
+        Self::parse(input)
+    }
+}
+
+#[derive(Debug, Error, Clone, Copy, PartialEq, Eq)]
+pub enum DecimalError {
+    #[error("decimal text is not canonical")]
+    Lexical,
+    #[error("decimal zero must be represented as 0")]
+    Zero,
+    #[error("decimal precision exceeds the supported bound")]
+    Precision,
+    #[error("decimal scale exceeds the supported bound")]
+    Scale,
+}
+
+fn power_of_ten(exponent: u32) -> i128 {
+    10_i128.pow(exponent)
+}
+
+pub struct EntityReferenceSeed(Zeroizing<Vec<u8>>);
+
+impl EntityReferenceSeed {
+    pub fn new(input: &str) -> Result<Self, EntityReferenceSeedError> {
+        let bytes = input.as_bytes();
+        if bytes.is_empty() || bytes.len() > MAX_ENTITY_SEED_BYTES {
+            return Err(EntityReferenceSeedError);
+        }
+        Ok(Self(Zeroizing::new(bytes.to_vec())))
+    }
+
+    pub(crate) fn expose_for_projection(&self) -> &[u8] {
+        self.0.as_slice()
+    }
+}
+
+impl Clone for EntityReferenceSeed {
+    fn clone(&self) -> Self {
+        Self(Zeroizing::new(self.0.to_vec()))
+    }
+}
+
+impl fmt::Debug for EntityReferenceSeed {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("EntityReferenceSeed(<redacted>)")
+    }
+}
+
+#[derive(Debug, Error, Clone, Copy, PartialEq, Eq)]
+#[error("entity-reference seed is empty or exceeds its bound")]
+pub struct EntityReferenceSeedError;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn canonical_decimals_round_trip_as_json_strings() {
+        for text in [
+            "0",
+            "1",
+            "-1",
+            "0.25",
+            "-10.5",
+            "1234567890123456789012345678",
+            "0.000000001",
+        ] {
+            let value = Decimal::parse(text).expect("decimal parses");
+            assert_eq!(value.canonical(), text);
+            assert_eq!(
+                serde_json::to_string(&value).expect("serializes"),
+                format!("\"{text}\"")
+            );
+        }
+    }
+
+    #[test]
+    fn noncanonical_or_excessive_decimals_are_rejected() {
+        for text in [
+            "",
+            "+1",
+            "01.0",
+            "1.0",
+            "1.",
+            ".1",
+            "-0",
+            "-0.0",
+            "0.0",
+            "1e2",
+            "NaN",
+            "12345678901234567890123456789",
+            "0.1234567891",
+        ] {
+            assert!(Decimal::parse(text).is_err(), "{text} must be rejected");
+        }
+    }
+
+    #[test]
+    fn decimal_comparison_is_exact_across_scales() {
+        let one = Decimal::parse("1").expect("parses");
+        let one_point_five = Decimal::parse("1.5").expect("parses");
+        let negative_tenth = Decimal::parse("-0.1").expect("parses");
+        assert_eq!(one.compare(&one_point_five), Ordering::Less);
+        assert_eq!(one_point_five.compare(&one), Ordering::Greater);
+        assert_eq!(negative_tenth.compare(&one), Ordering::Less);
+    }
+
+    #[test]
+    fn entity_seed_debug_is_redacted() {
+        let seed = EntityReferenceSeed::new("protected-canary").expect("seed builds");
+        let debug = format!("{seed:?}");
+        assert!(!debug.contains("protected-canary"));
+        assert_eq!(debug, "EntityReferenceSeed(<redacted>)");
+
+        let decimal = Decimal::parse("8192.125").expect("decimal parses");
+        let debug = format!("{decimal:?}");
+        assert!(!debug.contains("8192.125"));
+        assert_eq!(debug, "Decimal([REDACTED])");
+    }
+}
diff --git a/crates/registry-evidence/src/verifier.rs b/crates/registry-evidence/src/verifier.rs
new file mode 100644
index 000000000..619cd4435
--- /dev/null
+++ b/crates/registry-evidence/src/verifier.rs
@@ -0,0 +1,1978 @@
+//! Strict verifier for the Evidence Version 1 flattened JWS profile and for
+//! the SD-JWT VC profile that projects the same payload.
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    time::Duration,
+};
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use chrono::{DateTime, Utc};
+use registry_platform_crypto::{parse_json_strict, verify, PublicJwk, SigningAlgorithm};
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value};
+use sha2::{Digest, Sha256};
+use thiserror::Error;
+
+use crate::{
+    config::AssuranceProfile,
+    contracts::evidence_contract_accepts,
+    model::{Evidence, FlattenedJws, JwksDocument},
+    sdjwt_vc::evidence_payload_from_claims,
+    EVIDENCE_JWS_CTY, EVIDENCE_JWS_TYP, EVIDENCE_SCHEMA_V1, EVIDENCE_SD_JWT_VC_TYP,
+};
+
+const MAX_JWS_BYTES: usize = 256 * 1024;
+const MAX_PROTECTED_BYTES: usize = 8 * 1024;
+const MAX_PAYLOAD_BYTES: usize = 128 * 1024;
+const MAX_TRUSTED_KEYS: usize = 33;
+/// One disclosure per Supported Value, bounded well above the largest
+/// requirement a Version 1 bundle can declare.
+const MAX_DISCLOSURES: usize = 64;
+const MAX_DISCLOSURE_BYTES: usize = 8 * 1024;
+const MINIMUM_SALT_BYTES: usize = 16;
+const MAXIMUM_SALT_BYTES: usize = 64;
+
+/// Complete relying-procedure expectations for strict verification.
+///
+/// Every expectation comes from independent trusted state such as the relying
+/// procedure, a previously trusted binding, or a trusted requirement contract.
+/// Copying values out of the JWS under verification proves nothing.
+#[derive(Debug, Clone)]
+pub struct EvidenceVerificationPolicy {
+    pub assurance_profile: AssuranceProfile,
+    pub issued_by: String,
+    pub provided_by: String,
+    pub requirement: String,
+    pub evidence_type: String,
+    pub purpose: String,
+    pub audience: String,
+    pub configuration_revision: String,
+    /// The exact nonce from the independently retained original request.
+    pub request_nonce: String,
+    /// Expected role-bound opaque subject bindings as an unordered set of
+    /// unique pairs. Subject order alone is never semantic.
+    pub expected_subjects: Vec<ExpectedSubject>,
+    /// Expected concept identifiers, value forms, and cardinalities.
+    pub expected_outputs: Vec<ExpectedOutput>,
+    /// Longest acceptable `validUntil - issuedAt` interval.
+    pub maximum_assertion_lifetime: Duration,
+    pub now: DateTime<Utc>,
+    pub clock_skew: Duration,
+}
+
+/// Closed wire document for independently retained verification expectations.
+///
+/// The runtime-facing policy keeps an explicit verification instant and Rust
+/// durations. This document is the serializable form used by offline operator
+/// boundaries, including the local pre-response context. It never learns
+/// expectations from the response it is asked to verify.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct EvidenceVerificationPolicyDocument {
+    pub(crate) expected_assurance_profile: AssuranceProfile,
+    pub(crate) issued_by: String,
+    pub(crate) provided_by: String,
+    pub(crate) requirement: String,
+    pub(crate) evidence_type: String,
+    pub(crate) purpose: String,
+    pub(crate) audience: String,
+    pub(crate) configuration_revision: String,
+    /// The exact nonce from the independently retained original request.
+    pub(crate) request_nonce: String,
+    pub(crate) expected_subjects: Vec<ExpectedSubjectDocument>,
+    pub(crate) expected_outputs: Vec<ExpectedOutputDocument>,
+    pub(crate) maximum_assertion_lifetime_seconds: u64,
+    #[serde(default)]
+    pub(crate) clock_skew_seconds: u64,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub(crate) struct ExpectedSubjectDocument {
+    pub(crate) role: String,
+    pub(crate) binding: String,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub(crate) struct ExpectedOutputDocument {
+    pub(crate) concept: String,
+    pub(crate) form: ExpectedFormDocument,
+}
+
+/// The closed expected value-form vocabulary as written in a policy document.
+///
+/// The two alternatives are untagged because the policy schema writes a scalar
+/// form as a plain string and the list form as a mapping under `list`.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(untagged)]
+pub(crate) enum ExpectedFormDocument {
+    Scalar(ExpectedScalarFormDocument),
+    List(ExpectedListFormDocument),
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub(crate) enum ExpectedScalarFormDocument {
+    Boolean,
+    Integer,
+    String,
+    DateBucket,
+    TimeBucket,
+    EntityReference,
+    Structured,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct ExpectedListFormDocument {
+    pub(crate) list: ExpectedListDocument,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub(crate) struct ExpectedListDocument {
+    pub(crate) minimum_items: usize,
+    pub(crate) maximum_items: usize,
+}
+
+impl EvidenceVerificationPolicyDocument {
+    pub fn into_policy(self, now: DateTime<Utc>) -> EvidenceVerificationPolicy {
+        EvidenceVerificationPolicy {
+            assurance_profile: self.expected_assurance_profile,
+            issued_by: self.issued_by,
+            provided_by: self.provided_by,
+            requirement: self.requirement,
+            evidence_type: self.evidence_type,
+            purpose: self.purpose,
+            audience: self.audience,
+            configuration_revision: self.configuration_revision,
+            request_nonce: self.request_nonce,
+            expected_subjects: self
+                .expected_subjects
+                .into_iter()
+                .map(|subject| ExpectedSubject {
+                    role: subject.role,
+                    binding: subject.binding,
+                })
+                .collect(),
+            expected_outputs: self
+                .expected_outputs
+                .into_iter()
+                .map(|output| ExpectedOutput {
+                    concept: output.concept,
+                    form: expected_value_form_document(output.form),
+                })
+                .collect(),
+            maximum_assertion_lifetime: Duration::from_secs(
+                self.maximum_assertion_lifetime_seconds,
+            ),
+            now,
+            clock_skew: Duration::from_secs(self.clock_skew_seconds),
+        }
+    }
+}
+
+fn expected_value_form_document(document: ExpectedFormDocument) -> ExpectedValueForm {
+    match document {
+        ExpectedFormDocument::Scalar(ExpectedScalarFormDocument::Boolean) => {
+            ExpectedValueForm::Boolean
+        }
+        ExpectedFormDocument::Scalar(ExpectedScalarFormDocument::Integer) => {
+            ExpectedValueForm::Integer
+        }
+        ExpectedFormDocument::Scalar(ExpectedScalarFormDocument::String) => {
+            ExpectedValueForm::String
+        }
+        ExpectedFormDocument::Scalar(ExpectedScalarFormDocument::DateBucket) => {
+            ExpectedValueForm::DateBucket
+        }
+        ExpectedFormDocument::Scalar(ExpectedScalarFormDocument::TimeBucket) => {
+            ExpectedValueForm::TimeBucket
+        }
+        ExpectedFormDocument::Scalar(ExpectedScalarFormDocument::EntityReference) => {
+            ExpectedValueForm::EntityReference
+        }
+        ExpectedFormDocument::Scalar(ExpectedScalarFormDocument::Structured) => {
+            ExpectedValueForm::Structured
+        }
+        ExpectedFormDocument::List(wrapper) => ExpectedValueForm::List {
+            minimum_items: wrapper.list.minimum_items,
+            maximum_items: wrapper.list.maximum_items,
+        },
+    }
+}
+
+impl EvidenceVerificationPolicy {
+    /// Build expectations from evidence accepted in an original trusted
+    /// transaction, for later re-verification of the stored response.
+    ///
+    /// This is only meaningful when `evidence` was itself verified and
+    /// accepted at transaction time and then retained under the relying
+    /// party's record policy. Parsing an untrusted JWS and passing its own
+    /// values back as expectations proves nothing. The expected nonce comes
+    /// from the independently retained original request, never from the
+    /// response.
+    pub fn from_accepted_transaction(
+        evidence: &Evidence,
+        retained_request_nonce: &str,
+        maximum_assertion_lifetime: Duration,
+        now: DateTime<Utc>,
+        clock_skew: Duration,
+    ) -> Self {
+        Self {
+            assurance_profile: evidence.assurance_profile,
+            issued_by: evidence.issued_by.clone(),
+            provided_by: evidence.provided_by.clone(),
+            requirement: evidence.supports_requirement.clone(),
+            evidence_type: evidence.is_conformant_to.clone(),
+            purpose: evidence.purpose.clone(),
+            audience: evidence.audience.clone(),
+            configuration_revision: evidence.configuration_revision.clone(),
+            request_nonce: retained_request_nonce.to_owned(),
+            expected_subjects: evidence
+                .subjects
+                .iter()
+                .map(|subject| ExpectedSubject {
+                    role: subject.role.clone(),
+                    binding: subject.binding.clone(),
+                })
+                .collect(),
+            expected_outputs: evidence
+                .supported_values
+                .iter()
+                .map(|value| ExpectedOutput {
+                    concept: value.provides_value_for.clone(),
+                    form: expected_form_of(&value.value),
+                })
+                .collect(),
+            maximum_assertion_lifetime,
+            now,
+            clock_skew,
+        }
+    }
+}
+
+fn expected_form_of(value: &crate::model::PublicValue) -> ExpectedValueForm {
+    use crate::model::{BucketForm, PublicValue};
+    match value {
+        PublicValue::Boolean(_) => ExpectedValueForm::Boolean,
+        PublicValue::Integer(_) => ExpectedValueForm::Integer,
+        PublicValue::String(_) => ExpectedValueForm::String,
+        PublicValue::Bucket(bucket) => {
+            if bucket.form == BucketForm::DateBucket {
+                ExpectedValueForm::DateBucket
+            } else {
+                ExpectedValueForm::TimeBucket
+            }
+        }
+        PublicValue::EntityReference(_) => ExpectedValueForm::EntityReference,
+        PublicValue::Structured(_) => ExpectedValueForm::Structured,
+        PublicValue::List(items) => ExpectedValueForm::List {
+            minimum_items: items.len(),
+            maximum_items: items.len(),
+        },
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
+pub struct ExpectedSubject {
+    pub role: String,
+    pub binding: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct ExpectedOutput {
+    pub concept: String,
+    pub form: ExpectedValueForm,
+}
+
+/// Closed expected form for one disclosed Supported Value.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ExpectedValueForm {
+    Boolean,
+    Integer,
+    String,
+    DateBucket,
+    TimeBucket,
+    EntityReference,
+    Structured,
+    List {
+        minimum_items: usize,
+        maximum_items: usize,
+    },
+}
+
+/// Result of verifying a stored signed response.
+///
+/// A returned report means the trusted key signed the exact payload and every
+/// policy expectation held. Current usability is reported separately so an
+/// expired assertion can remain cryptographically authentic without being
+/// treated as current evidence.
+#[derive(Debug)]
+pub struct VerificationReport {
+    pub evidence: Evidence,
+    pub currently_valid: bool,
+}
+
+#[derive(Debug, Error, Clone, Copy, PartialEq, Eq)]
+pub enum VerificationError {
+    #[error("flattened JWS is malformed")]
+    MalformedJws,
+    #[error("protected JWS header is not allowed")]
+    ProtectedHeader,
+    #[error("JWS key identifier is unknown or ambiguous")]
+    Key,
+    #[error("JWS signature is invalid")]
+    Signature,
+    #[error("Evidence payload is malformed")]
+    Payload,
+    #[error("Evidence payload does not match the relying procedure")]
+    Policy,
+    #[error("Evidence payload is outside its validity interval")]
+    Time,
+    #[error("SD-JWT VC disclosures do not match the signed digests")]
+    Disclosure,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ProtectedHeader {
+    alg: String,
+    kid: String,
+    typ: String,
+    cty: String,
+}
+
+/// The SD-JWT VC header carries no `cty`: the credential type travels in the
+/// signed `vct` claim.
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct SdJwtHeader {
+    alg: String,
+    kid: String,
+    typ: String,
+}
+
+/// Strict one-call verification: cryptographic authenticity, every policy
+/// expectation, and current validity must all hold.
+pub fn verify_flattened_jws(
+    serialized_jws: &[u8],
+    trusted_jwks: &JwksDocument,
+    policy: &EvidenceVerificationPolicy,
+) -> Result<Evidence, VerificationError> {
+    let report = verify_flattened_jws_report(serialized_jws, trusted_jwks, policy)?;
+    if !report.currently_valid {
+        return Err(VerificationError::Time);
+    }
+    Ok(report.evidence)
+}
+
+/// Verify a stored signed response against a pinned trusted key set and the
+/// complete independent policy, reporting cryptographic authenticity
+/// separately from current validity.
+pub fn verify_flattened_jws_report(
+    serialized_jws: &[u8],
+    trusted_jwks: &JwksDocument,
+    policy: &EvidenceVerificationPolicy,
+) -> Result<VerificationReport, VerificationError> {
+    if serialized_jws.is_empty() || serialized_jws.len() > MAX_JWS_BYTES {
+        return Err(VerificationError::MalformedJws);
+    }
+    let strict = parse_json_strict(serialized_jws).map_err(|_| VerificationError::MalformedJws)?;
+    let jws: FlattenedJws =
+        serde_json::from_value(strict).map_err(|_| VerificationError::MalformedJws)?;
+
+    let protected_bytes = decode_bounded(
+        &jws.protected,
+        MAX_PROTECTED_BYTES,
+        VerificationError::ProtectedHeader,
+    )?;
+    let protected_strict =
+        parse_json_strict(&protected_bytes).map_err(|_| VerificationError::ProtectedHeader)?;
+    let protected: ProtectedHeader =
+        serde_json::from_value(protected_strict).map_err(|_| VerificationError::ProtectedHeader)?;
+    if protected.alg != "EdDSA"
+        || protected.typ != EVIDENCE_JWS_TYP
+        || protected.cty != EVIDENCE_JWS_CTY
+        || protected.kid.is_empty()
+        || protected.kid.len() > 256
+        || protected.kid.chars().any(char::is_control)
+    {
+        return Err(VerificationError::ProtectedHeader);
+    }
+
+    let keys = trusted_keys(trusted_jwks)?;
+    let key = keys.get(&protected.kid).ok_or(VerificationError::Key)?;
+    if key.algorithm().ok() != Some(SigningAlgorithm::EdDsa) {
+        return Err(VerificationError::Key);
+    }
+    let signature = decode_bounded(
+        &jws.signature,
+        MAX_PROTECTED_BYTES,
+        VerificationError::Signature,
+    )?;
+    let signing_input = [jws.protected.as_bytes(), b".", jws.payload.as_bytes()].concat();
+    verify(&signing_input, &signature, key).map_err(|_| VerificationError::Signature)?;
+
+    // Parse and act on the payload only after signature verification.
+    let payload = decode_bounded(&jws.payload, MAX_PAYLOAD_BYTES, VerificationError::Payload)?;
+    let payload_strict = parse_json_strict(&payload).map_err(|_| VerificationError::Payload)?;
+    if !evidence_contract_accepts(&payload_strict).map_err(|_| VerificationError::Payload)? {
+        return Err(VerificationError::Payload);
+    }
+    let evidence: Evidence =
+        serde_json::from_value(payload_strict).map_err(|_| VerificationError::Payload)?;
+    let currently_valid = validate_policy(&evidence, policy)?;
+    Ok(VerificationReport {
+        evidence,
+        currently_valid,
+    })
+}
+
+/// Strict one-call verification of an issued SD-JWT VC: cryptographic
+/// authenticity, complete disclosure resolution, every policy expectation, and
+/// current validity must all hold.
+pub fn verify_sd_jwt_vc(
+    serialized: &[u8],
+    trusted_jwks: &JwksDocument,
+    policy: &EvidenceVerificationPolicy,
+) -> Result<Evidence, VerificationError> {
+    let report = verify_sd_jwt_vc_report(serialized, trusted_jwks, policy)?;
+    if !report.currently_valid {
+        return Err(VerificationError::Time);
+    }
+    Ok(report.evidence)
+}
+
+/// Verify an issued SD-JWT VC against a pinned trusted key set and the
+/// complete independent policy, reporting cryptographic authenticity
+/// separately from current validity.
+///
+/// Version 1 issues only complete credentials, so verification requires every
+/// signed digest to be resolved by exactly one presented disclosure. A holder
+/// presenting a subset is out of scope for the issuance profile, and the
+/// relying procedure's expected output contract would reject it in any case.
+/// A key-binding JWT is never accepted here: the serialization must end with
+/// the trailing tilde that marks its absence.
+pub fn verify_sd_jwt_vc_report(
+    serialized: &[u8],
+    trusted_jwks: &JwksDocument,
+    policy: &EvidenceVerificationPolicy,
+) -> Result<VerificationReport, VerificationError> {
+    if serialized.is_empty() || serialized.len() > MAX_JWS_BYTES {
+        return Err(VerificationError::MalformedJws);
+    }
+    let serialized =
+        std::str::from_utf8(serialized).map_err(|_| VerificationError::MalformedJws)?;
+    let body = serialized
+        .strip_suffix('~')
+        .ok_or(VerificationError::MalformedJws)?;
+    let mut segments = body.split('~');
+    let jwt = segments.next().ok_or(VerificationError::MalformedJws)?;
+    let encoded_disclosures: Vec<&str> = segments.collect();
+    if encoded_disclosures.len() > MAX_DISCLOSURES
+        || encoded_disclosures.iter().any(|value| value.is_empty())
+    {
+        return Err(VerificationError::MalformedJws);
+    }
+
+    let mut parts = jwt.split('.');
+    let (Some(encoded_header), Some(encoded_payload), Some(encoded_signature), None) =
+        (parts.next(), parts.next(), parts.next(), parts.next())
+    else {
+        return Err(VerificationError::MalformedJws);
+    };
+
+    let header_bytes = decode_bounded(
+        encoded_header,
+        MAX_PROTECTED_BYTES,
+        VerificationError::ProtectedHeader,
+    )?;
+    let header_strict =
+        parse_json_strict(&header_bytes).map_err(|_| VerificationError::ProtectedHeader)?;
+    let header: SdJwtHeader =
+        serde_json::from_value(header_strict).map_err(|_| VerificationError::ProtectedHeader)?;
+    if header.alg != "EdDSA"
+        || header.typ != EVIDENCE_SD_JWT_VC_TYP
+        || header.kid.is_empty()
+        || header.kid.len() > 256
+        || header.kid.chars().any(char::is_control)
+    {
+        return Err(VerificationError::ProtectedHeader);
+    }
+
+    let keys = trusted_keys(trusted_jwks)?;
+    let key = keys.get(&header.kid).ok_or(VerificationError::Key)?;
+    if key.algorithm().ok() != Some(SigningAlgorithm::EdDsa) {
+        return Err(VerificationError::Key);
+    }
+    let signature = decode_bounded(
+        encoded_signature,
+        MAX_PROTECTED_BYTES,
+        VerificationError::Signature,
+    )?;
+    let signing_input = [encoded_header.as_bytes(), b".", encoded_payload.as_bytes()].concat();
+    verify(&signing_input, &signature, key).map_err(|_| VerificationError::Signature)?;
+
+    // Parse and act on the payload only after signature verification.
+    let payload_bytes = decode_bounded(
+        encoded_payload,
+        MAX_PAYLOAD_BYTES,
+        VerificationError::Payload,
+    )?;
+    let payload_strict =
+        parse_json_strict(&payload_bytes).map_err(|_| VerificationError::Payload)?;
+    let Value::Object(mut claims) = payload_strict else {
+        return Err(VerificationError::Payload);
+    };
+
+    let digests = signed_digests(&mut claims)?;
+    let disclosed = resolve_disclosures(&encoded_disclosures, &digests, &mut claims)?;
+    if let Some(confirmation) = claims.remove("cnf") {
+        validate_confirmation(&confirmation)?;
+    }
+
+    let payload = evidence_payload_from_claims(&claims, &disclosed)
+        .map_err(|_| VerificationError::Payload)?;
+    if !evidence_contract_accepts(&payload).map_err(|_| VerificationError::Payload)? {
+        return Err(VerificationError::Payload);
+    }
+    let evidence: Evidence =
+        serde_json::from_value(payload).map_err(|_| VerificationError::Payload)?;
+    let currently_valid = validate_policy(&evidence, policy)?;
+    Ok(VerificationReport {
+        evidence,
+        currently_valid,
+    })
+}
+
+/// Take the signed digest set out of the claims. The set must be sorted and
+/// free of duplicates, matching the issuance profile exactly.
+fn signed_digests(claims: &mut Map<String, Value>) -> Result<Vec<String>, VerificationError> {
+    if claims
+        .remove("_sd_alg")
+        .and_then(|alg| alg.as_str().map(str::to_owned))
+        != Some("sha-256".to_string())
+    {
+        return Err(VerificationError::Disclosure);
+    }
+    let listed = claims
+        .remove("_sd")
+        .ok_or(VerificationError::Disclosure)?
+        .as_array()
+        .ok_or(VerificationError::Disclosure)?
+        .iter()
+        .map(|digest| digest.as_str().map(str::to_owned))
+        .collect::<Option<Vec<String>>>()
+        .ok_or(VerificationError::Disclosure)?;
+    if listed.len() > MAX_DISCLOSURES
+        || listed.windows(2).any(|pair| pair[0] >= pair[1])
+        || listed.iter().any(|digest| digest.len() != 43)
+    {
+        return Err(VerificationError::Disclosure);
+    }
+    Ok(listed)
+}
+
+/// Resolve every presented disclosure against the signed digests. Each digest
+/// must be claimed by exactly one disclosure, each disclosure must carry a
+/// distinct name, and no disclosure may shadow a public claim.
+fn resolve_disclosures(
+    encoded: &[&str],
+    digests: &[String],
+    claims: &mut Map<String, Value>,
+) -> Result<Vec<(String, Value)>, VerificationError> {
+    #[derive(Clone)]
+    enum Location {
+        Root,
+        Object(String),
+    }
+
+    let mut locations = BTreeMap::<String, Location>::new();
+    for digest in digests {
+        if locations.insert(digest.clone(), Location::Root).is_some() {
+            return Err(VerificationError::Disclosure);
+        }
+    }
+    let structured_claims = match claims.get("structuredValues") {
+        None => Vec::new(),
+        Some(Value::Object(metadata)) => metadata.keys().cloned().collect::<Vec<_>>(),
+        Some(_) => return Err(VerificationError::Disclosure),
+    };
+    for claim in structured_claims {
+        let object = claims
+            .get_mut(&claim)
+            .and_then(Value::as_object_mut)
+            .ok_or(VerificationError::Disclosure)?;
+        if object.len() != 1 {
+            return Err(VerificationError::Disclosure);
+        }
+        let nested = object
+            .remove("_sd")
+            .and_then(|value| value.as_array().cloned())
+            .ok_or(VerificationError::Disclosure)?;
+        let nested = nested
+            .iter()
+            .map(|digest| digest.as_str().map(str::to_owned))
+            .collect::<Option<Vec<_>>>()
+            .ok_or(VerificationError::Disclosure)?;
+        if nested.is_empty()
+            || nested.len() > 64
+            || nested.windows(2).any(|pair| pair[0] >= pair[1])
+            || nested.iter().any(|digest| digest.len() != 43)
+        {
+            return Err(VerificationError::Disclosure);
+        }
+        for digest in nested {
+            if locations
+                .insert(digest, Location::Object(claim.clone()))
+                .is_some()
+            {
+                return Err(VerificationError::Disclosure);
+            }
+        }
+    }
+    if encoded.len() != locations.len() {
+        return Err(VerificationError::Disclosure);
+    }
+    let mut resolved = Vec::with_capacity(encoded.len());
+    let mut seen_digests = BTreeSet::new();
+    let mut root_names = BTreeSet::new();
+    let mut object_names = BTreeMap::<String, BTreeSet<String>>::new();
+    for disclosure in encoded {
+        if disclosure.len() > MAX_DISCLOSURE_BYTES {
+            return Err(VerificationError::Disclosure);
+        }
+        let digest = URL_SAFE_NO_PAD.encode(Sha256::digest(disclosure.as_bytes()));
+        let location = locations
+            .get(&digest)
+            .cloned()
+            .ok_or(VerificationError::Disclosure)?;
+        if !seen_digests.insert(digest) {
+            return Err(VerificationError::Disclosure);
+        }
+        let decoded = decode_bounded(
+            disclosure,
+            MAX_DISCLOSURE_BYTES,
+            VerificationError::Disclosure,
+        )?;
+        let strict = parse_json_strict(&decoded).map_err(|_| VerificationError::Disclosure)?;
+        let Value::Array(members) = strict else {
+            return Err(VerificationError::Disclosure);
+        };
+        let [salt, name, value] = members.as_slice() else {
+            return Err(VerificationError::Disclosure);
+        };
+        let salt = salt.as_str().ok_or(VerificationError::Disclosure)?;
+        let salt_bytes = URL_SAFE_NO_PAD
+            .decode(salt)
+            .map_err(|_| VerificationError::Disclosure)?;
+        if salt_bytes.len() < MINIMUM_SALT_BYTES || salt_bytes.len() > MAXIMUM_SALT_BYTES {
+            return Err(VerificationError::Disclosure);
+        }
+        let name = name.as_str().ok_or(VerificationError::Disclosure)?;
+        match location {
+            Location::Root => {
+                if claims.contains_key(name) || !root_names.insert(name.to_owned()) {
+                    return Err(VerificationError::Disclosure);
+                }
+                resolved.push((name.to_owned(), value.clone()));
+            }
+            Location::Object(claim) => {
+                if name.is_empty()
+                    || name.len() > 128
+                    || name == "_sd"
+                    || name == "..."
+                    || name.chars().any(char::is_control)
+                    || !object_names
+                        .entry(claim.clone())
+                        .or_default()
+                        .insert(name.to_owned())
+                {
+                    return Err(VerificationError::Disclosure);
+                }
+                let object = claims
+                    .get_mut(&claim)
+                    .and_then(Value::as_object_mut)
+                    .ok_or(VerificationError::Disclosure)?;
+                if object.insert(name.to_owned(), value.clone()).is_some() {
+                    return Err(VerificationError::Disclosure);
+                }
+            }
+        }
+    }
+    Ok(resolved)
+}
+
+/// The confirmation, when present, carries exactly one Ed25519 public key and
+/// no private material.
+fn validate_confirmation(confirmation: &Value) -> Result<(), VerificationError> {
+    let Some(members) = confirmation.as_object() else {
+        return Err(VerificationError::Payload);
+    };
+    if members.len() != 1 {
+        return Err(VerificationError::Payload);
+    }
+    let jwk = members.get("jwk").ok_or(VerificationError::Payload)?;
+    let key: PublicJwk =
+        serde_json::from_value(jwk.clone()).map_err(|_| VerificationError::Payload)?;
+    if key.kty != "OKP"
+        || key.crv.as_deref() != Some("Ed25519")
+        || key.algorithm().ok() != Some(SigningAlgorithm::EdDsa)
+    {
+        return Err(VerificationError::Payload);
+    }
+    Ok(())
+}
+
+fn trusted_keys(jwks: &JwksDocument) -> Result<BTreeMap<String, PublicJwk>, VerificationError> {
+    if jwks.keys.is_empty() || jwks.keys.len() > MAX_TRUSTED_KEYS {
+        return Err(VerificationError::Key);
+    }
+    let mut output = BTreeMap::new();
+    for value in &jwks.keys {
+        let key: PublicJwk =
+            serde_json::from_value(value.clone()).map_err(|_| VerificationError::Key)?;
+        let kid = key.kid.clone().ok_or(VerificationError::Key)?;
+        if kid.is_empty()
+            || kid.len() > 256
+            || kid.chars().any(char::is_control)
+            || key.algorithm().ok() != Some(SigningAlgorithm::EdDsa)
+            || output.insert(kid, key).is_some()
+        {
+            return Err(VerificationError::Key);
+        }
+    }
+    Ok(output)
+}
+
+/// Compare every policy expectation after signature and schema verification.
+///
+/// Every mismatch, including the expected nonce, expected role-bound subject
+/// set, and expected output contract, returns the one generic policy error so
+/// verification does not reveal which hidden comparison failed. The returned
+/// boolean is current validity, which is reported separately from
+/// authenticity and policy conformance.
+fn validate_policy(
+    evidence: &Evidence,
+    policy: &EvidenceVerificationPolicy,
+) -> Result<bool, VerificationError> {
+    if evidence.schema != EVIDENCE_SCHEMA_V1
+        || evidence.assurance_profile != policy.assurance_profile
+        || evidence.issued_by != policy.issued_by
+        || evidence.provided_by != policy.provided_by
+        || evidence.supports_requirement != policy.requirement
+        || evidence.is_conformant_to != policy.evidence_type
+        || evidence.purpose != policy.purpose
+        || evidence.audience != policy.audience
+        || evidence.configuration_revision != policy.configuration_revision
+        || evidence.subjects.is_empty()
+        || evidence.supported_values.is_empty()
+        || evidence.request_nonce != policy.request_nonce
+    {
+        return Err(VerificationError::Policy);
+    }
+    validate_expected_subjects(evidence, policy)?;
+    validate_expected_outputs(evidence, policy)?;
+
+    let issued = parse_time(&evidence.issued_at)?;
+    let observed = parse_time(&evidence.observed_at)?;
+    let valid_until = parse_time(&evidence.valid_until)?;
+    let skew =
+        chrono::Duration::from_std(policy.clock_skew).map_err(|_| VerificationError::Time)?;
+    let maximum_lifetime = chrono::Duration::from_std(policy.maximum_assertion_lifetime)
+        .map_err(|_| VerificationError::Time)?;
+    let expiration_with_skew = valid_until
+        .checked_add_signed(skew)
+        .ok_or(VerificationError::Time)?;
+    // Internal chronology and the accepted-lifetime ceiling are hard errors;
+    // an internally inconsistent or over-long assertion is never acceptable.
+    if issued < observed
+        || valid_until <= observed
+        || valid_until <= issued
+        || valid_until - issued > maximum_lifetime
+    {
+        return Err(VerificationError::Time);
+    }
+    let latest_acceptable_issue = policy
+        .now
+        .checked_add_signed(skew)
+        .ok_or(VerificationError::Time)?;
+    let currently_valid = issued <= latest_acceptable_issue
+        && observed <= latest_acceptable_issue
+        && policy.now < expiration_with_skew;
+    Ok(currently_valid)
+}
+
+/// Compare the unordered set of unique expected `(role, binding)` pairs.
+fn validate_expected_subjects(
+    evidence: &Evidence,
+    policy: &EvidenceVerificationPolicy,
+) -> Result<(), VerificationError> {
+    let mut expected = policy.expected_subjects.clone();
+    expected.sort();
+    if expected.is_empty() || expected.windows(2).any(|pair| pair[0] == pair[1]) {
+        return Err(VerificationError::Policy);
+    }
+    let mut actual = evidence
+        .subjects
+        .iter()
+        .map(|subject| ExpectedSubject {
+            role: subject.role.clone(),
+            binding: subject.binding.clone(),
+        })
+        .collect::<Vec<_>>();
+    actual.sort();
+    if actual != expected {
+        return Err(VerificationError::Policy);
+    }
+    Ok(())
+}
+
+/// Compare the expected concept identifiers, value forms, and cardinalities.
+fn validate_expected_outputs(
+    evidence: &Evidence,
+    policy: &EvidenceVerificationPolicy,
+) -> Result<(), VerificationError> {
+    let expected = &policy.expected_outputs;
+    if expected.is_empty() || evidence.supported_values.len() != expected.len() {
+        return Err(VerificationError::Policy);
+    }
+    let mut concepts = BTreeMap::new();
+    for output in expected {
+        if concepts
+            .insert(output.concept.as_str(), &output.form)
+            .is_some()
+        {
+            return Err(VerificationError::Policy);
+        }
+    }
+    let mut seen = std::collections::BTreeSet::new();
+    for value in &evidence.supported_values {
+        let concept = value.provides_value_for.as_str();
+        let Some(form) = concepts.get(concept) else {
+            return Err(VerificationError::Policy);
+        };
+        if !seen.insert(concept) || !value_matches_form(&value.value, form) {
+            return Err(VerificationError::Policy);
+        }
+    }
+    Ok(())
+}
+
+fn value_matches_form(value: &crate::model::PublicValue, form: &ExpectedValueForm) -> bool {
+    use crate::model::{BucketForm, PublicValue};
+    match (value, form) {
+        (PublicValue::Boolean(_), ExpectedValueForm::Boolean)
+        | (PublicValue::Integer(_), ExpectedValueForm::Integer)
+        | (PublicValue::String(_), ExpectedValueForm::String)
+        | (PublicValue::EntityReference(_), ExpectedValueForm::EntityReference)
+        | (PublicValue::Structured(_), ExpectedValueForm::Structured) => true,
+        (PublicValue::Bucket(bucket), ExpectedValueForm::DateBucket) => {
+            bucket.form == BucketForm::DateBucket
+        }
+        (PublicValue::Bucket(bucket), ExpectedValueForm::TimeBucket) => {
+            bucket.form == BucketForm::TimeBucket
+        }
+        (
+            PublicValue::List(items),
+            ExpectedValueForm::List {
+                minimum_items,
+                maximum_items,
+            },
+        ) => items.len() >= *minimum_items && items.len() <= *maximum_items,
+        _ => false,
+    }
+}
+
+fn parse_time(input: &str) -> Result<DateTime<Utc>, VerificationError> {
+    DateTime::parse_from_rfc3339(input)
+        .map(|value| value.with_timezone(&Utc))
+        .map_err(|_| VerificationError::Time)
+}
+
+fn decode_bounded(
+    input: &str,
+    maximum: usize,
+    error: VerificationError,
+) -> Result<Vec<u8>, VerificationError> {
+    let decoded = URL_SAFE_NO_PAD.decode(input).map_err(|_| error)?;
+    if decoded.is_empty() || decoded.len() > maximum {
+        return Err(error);
+    }
+    Ok(decoded)
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Arc;
+
+    use registry_platform_crypto::{LocalJwkSigner, PrivateJwk, SigningProvider};
+    use serde_json::{json, Value};
+
+    use super::*;
+    use crate::{
+        model::{
+            EvidenceObjectType, PublicValue, StructuredValue, StructuredValueForm, SubjectBinding,
+            SupportedValue,
+        },
+        signing::{jwks_document, EvidenceSigner},
+    };
+
+    const PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"evidence-key-1"}"#;
+    const RETIRED_PRIVATE_JWK: &str = r#"{"crv":"Ed25519","d":"f4QIxnAyRWzhuBOmNRgvBTE56mWePdsPL0mvCtl8Gys","x":"pv4e_hXHBLN27rcs6VDFV1ED0TiU8M3xy9vsuWFEsec","kty":"OKP","alg":"EdDSA","kid":"retired-evidence-key"}"#;
+
+    async fn sign_with_protected_header(
+        private_jwk: &str,
+        protected_header: Value,
+        evidence: &Evidence,
+    ) -> (Vec<u8>, PublicJwk) {
+        sign_payload_bytes(
+            private_jwk,
+            protected_header,
+            &serde_json::to_vec(evidence).expect("Evidence serializes"),
+        )
+        .await
+    }
+
+    async fn sign_payload_bytes(
+        private_jwk: &str,
+        protected_header: Value,
+        payload_bytes: &[u8],
+    ) -> (Vec<u8>, PublicJwk) {
+        let private = PrivateJwk::parse(private_jwk).expect("test key parses");
+        let signer = LocalJwkSigner::new(private).expect("test signer builds");
+        let protected = URL_SAFE_NO_PAD
+            .encode(serde_json::to_vec(&protected_header).expect("protected header serializes"));
+        let payload = URL_SAFE_NO_PAD.encode(payload_bytes);
+        let signing_input = format!("{protected}.{payload}");
+        let signature = signer
+            .sign(signing_input.as_bytes())
+            .await
+            .expect("test JWS signs");
+        let jws = FlattenedJws {
+            protected,
+            payload,
+            signature: URL_SAFE_NO_PAD.encode(signature),
+        };
+        (
+            serde_json::to_vec(&jws).expect("JWS serializes"),
+            signer.public_jwk(),
+        )
+    }
+
+    const FIXTURE_NONCE: &str = "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I";
+
+    fn fixture_evidence() -> Evidence {
+        Evidence {
+            schema: EVIDENCE_SCHEMA_V1.to_string(),
+            assurance_profile: AssuranceProfile::EvidenceGrade,
+            request_nonce: FIXTURE_NONCE.to_string(),
+            id: "urn:ulid:01K1EXAMPLE0000000000000000".to_string(),
+            evidence_type_name: EvidenceObjectType::Evidence,
+            supports_requirement: "urn:example:requirement:v1".to_string(),
+            is_conformant_to: "urn:example:type:v1".to_string(),
+            issued_by: "urn:example:issuer".to_string(),
+            provided_by: "urn:example:provider".to_string(),
+            issued_at: "2026-08-02T00:00:00Z".to_string(),
+            observed_at: "2026-08-02T00:00:00Z".to_string(),
+            valid_until: "2026-08-03T00:00:00Z".to_string(),
+            purpose: "casework".to_string(),
+            audience: "urn:example:audience".to_string(),
+            configuration_revision: format!("sha256:{}", "0".repeat(64)),
+            subjects: vec![SubjectBinding {
+                role: "subject".to_string(),
+                binding: format!("urn:evidence:subject:v1_{}", "A".repeat(43)),
+            }],
+            supported_values: vec![SupportedValue {
+                provides_value_for: "urn:example:concept".to_string(),
+                value: PublicValue::Boolean(false),
+            }],
+        }
+    }
+
+    async fn signed_evidence(
+        evidence: Evidence,
+        now: DateTime<Utc>,
+    ) -> (Vec<u8>, JwksDocument, EvidenceVerificationPolicy) {
+        let private = PrivateJwk::parse(PRIVATE_JWK).expect("key parses");
+        let provider: Arc<dyn SigningProvider> =
+            Arc::new(LocalJwkSigner::new(private).expect("signer builds"));
+        let signer = EvidenceSigner::initialize(provider, "evidence-key-1")
+            .await
+            .expect("signer initializes");
+        let jws = signer.sign_json(&evidence).await.expect("evidence signs");
+        let serialized = serde_json::to_vec(&jws).expect("JWS serializes");
+        let jwks = jwks_document(signer.public_jwk(), []).expect("JWKS builds");
+        let policy = policy_for(&evidence, now);
+        (serialized, jwks, policy)
+    }
+
+    /// Build expectations equal to one known evidence value. Production
+    /// relying parties obtain these from independent trusted state; the test
+    /// simulates that state from the fixture it controls.
+    fn policy_for(evidence: &Evidence, now: DateTime<Utc>) -> EvidenceVerificationPolicy {
+        EvidenceVerificationPolicy::from_accepted_transaction(
+            evidence,
+            &evidence.request_nonce,
+            Duration::from_secs(48 * 60 * 60),
+            now,
+            Duration::from_secs(30),
+        )
+    }
+
+    async fn signed_fixture() -> (Vec<u8>, JwksDocument, EvidenceVerificationPolicy) {
+        signed_evidence(
+            fixture_evidence(),
+            "2026-08-02T12:00:00Z".parse().expect("time parses"),
+        )
+        .await
+    }
+
+    #[tokio::test]
+    async fn signed_false_round_trips_and_verifies() {
+        let (jws, jwks, policy) = signed_fixture().await;
+        let evidence = verify_flattened_jws(&jws, &jwks, &policy).expect("JWS verifies");
+        assert_eq!(
+            evidence.supported_values[0].value,
+            PublicValue::Boolean(false)
+        );
+    }
+
+    #[tokio::test]
+    async fn authentic_local_assertions_fail_deployable_assurance_expectations() {
+        let mut local = fixture_evidence();
+        local.assurance_profile = AssuranceProfile::Local;
+        let (jws, jwks, mut strict_policy) = signed_evidence(
+            local.clone(),
+            "2026-08-02T12:00:00Z".parse().expect("time parses"),
+        )
+        .await;
+        strict_policy.assurance_profile = AssuranceProfile::Production;
+        assert_eq!(
+            verify_flattened_jws(&jws, &jwks, &strict_policy),
+            Err(VerificationError::Policy)
+        );
+
+        let signer = fixture_signer().await;
+        let input = crate::sdjwt_vc::issuance_input(&local, None, &BTreeMap::new())
+            .expect("local evidence maps");
+        let serialized = signer
+            .sign_sd_jwt_vc(input)
+            .await
+            .expect("local SD-JWT VC serializes");
+        let jwks = jwks_document(signer.public_jwk(), []).expect("JWKS builds");
+        assert_eq!(
+            verify_sd_jwt_vc(serialized.as_bytes(), &jwks, &strict_policy),
+            Err(VerificationError::Policy)
+        );
+    }
+
+    #[tokio::test]
+    async fn signed_payload_must_satisfy_the_complete_evidence_schema() {
+        let mut cases = Vec::new();
+
+        let mut invalid_id = fixture_evidence();
+        invalid_id.id = "not a URI".to_owned();
+        cases.push(invalid_id);
+
+        let mut invalid_role = fixture_evidence();
+        invalid_role.subjects[0].role = "Uppercase".to_owned();
+        cases.push(invalid_role);
+
+        let mut invalid_binding = fixture_evidence();
+        invalid_binding.subjects[0].binding = "raw-subject-identifier".to_owned();
+        cases.push(invalid_binding);
+
+        let mut invalid_concept = fixture_evidence();
+        invalid_concept.supported_values[0].provides_value_for = "not a URI".to_owned();
+        cases.push(invalid_concept);
+
+        let mut empty_public_string = fixture_evidence();
+        empty_public_string.supported_values[0].value = PublicValue::String(String::new());
+        cases.push(empty_public_string);
+
+        let mut excessive_subjects = fixture_evidence();
+        excessive_subjects.subjects = (0..9)
+            .map(|index| SubjectBinding {
+                role: format!("subject-{index}"),
+                binding: format!("urn:evidence:subject:v1_{}", "A".repeat(43)),
+            })
+            .collect();
+        cases.push(excessive_subjects);
+
+        for evidence in cases {
+            let (jws, jwks, policy) = signed_evidence(
+                evidence,
+                "2026-08-02T12:00:00Z".parse().expect("time parses"),
+            )
+            .await;
+            assert_eq!(
+                verify_flattened_jws(&jws, &jwks, &policy),
+                Err(VerificationError::Payload)
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn signed_schema_integer_lexical_forms_verify_without_type_loss() {
+        let base = serde_json::to_string(&fixture_evidence()).expect("Evidence serializes");
+        assert_eq!(base.matches("\"value\":false").count(), 1);
+        let header = json!({
+            "alg": "EdDSA",
+            "kid": "evidence-key-1",
+            "typ": EVIDENCE_JWS_TYP,
+            "cty": EVIDENCE_JWS_CTY
+        });
+        let (_, _, mut policy) = signed_fixture().await;
+        policy.expected_outputs[0].form = ExpectedValueForm::Integer;
+
+        for number in ["1.0", "1e0"] {
+            let payload = base.replace("\"value\":false", &format!("\"value\":{number}"));
+            let (serialized, public) =
+                sign_payload_bytes(PRIVATE_JWK, header.clone(), payload.as_bytes()).await;
+            let jwks = jwks_document(public, []).expect("JWKS builds");
+            let evidence = verify_flattened_jws(&serialized, &jwks, &policy)
+                .expect("schema-valid integral JSON number verifies");
+            assert_eq!(evidence.supported_values[0].value, PublicValue::Integer(1));
+        }
+    }
+
+    #[tokio::test]
+    async fn payload_and_protected_header_mutation_fail() {
+        let (jws, jwks, policy) = signed_fixture().await;
+        let mut value: serde_json::Value = serde_json::from_slice(&jws).expect("JWS parses");
+        let payload = value["payload"].as_str().expect("payload").to_string();
+        value["payload"] = Value::String(format!("A{}", &payload[1..]));
+        assert!(matches!(
+            verify_flattened_jws(
+                &serde_json::to_vec(&value).expect("serializes"),
+                &jwks,
+                &policy
+            ),
+            Err(VerificationError::Signature)
+        ));
+
+        let (jws, jwks, policy) = signed_fixture().await;
+        let mut value: serde_json::Value = serde_json::from_slice(&jws).expect("JWS parses");
+        let protected = value["protected"].as_str().expect("protected").to_string();
+        value["protected"] = Value::String(format!("A{}", &protected[1..]));
+        assert!(verify_flattened_jws(
+            &serde_json::to_vec(&value).expect("serializes"),
+            &jwks,
+            &policy
+        )
+        .is_err());
+    }
+
+    #[tokio::test]
+    async fn duplicate_jws_members_and_unknown_kid_are_rejected() {
+        let (jws, mut jwks, policy) = signed_fixture().await;
+        let value: serde_json::Value = serde_json::from_slice(&jws).expect("JWS parses");
+        let duplicate = format!(
+            "{{\"protected\":{},\"protected\":{},\"payload\":{},\"signature\":{}}}",
+            value["protected"], value["protected"], value["payload"], value["signature"]
+        );
+        assert_eq!(
+            verify_flattened_jws(duplicate.as_bytes(), &jwks, &policy),
+            Err(VerificationError::MalformedJws)
+        );
+        jwks.keys.clear();
+        assert_eq!(
+            verify_flattened_jws(&jws, &jwks, &policy),
+            Err(VerificationError::Key)
+        );
+    }
+
+    #[tokio::test]
+    async fn signature_never_substitutes_for_provider_and_issuer_trust_policy() {
+        let (jws, jwks, policy) = signed_fixture().await;
+        let mut untrusted_provider = policy.clone();
+        untrusted_provider.provided_by = "urn:example:untrusted-provider".to_owned();
+        assert_eq!(
+            verify_flattened_jws(&jws, &jwks, &untrusted_provider),
+            Err(VerificationError::Policy)
+        );
+
+        let mut untrusted_issuer = policy;
+        untrusted_issuer.issued_by = "urn:example:untrusted-issuer".to_owned();
+        assert_eq!(
+            verify_flattened_jws(&jws, &jwks, &untrusted_issuer),
+            Err(VerificationError::Policy)
+        );
+    }
+
+    #[tokio::test]
+    async fn signed_chronology_and_clock_arithmetic_fail_closed() {
+        let mut reversed = fixture_evidence();
+        reversed.observed_at = "2026-08-02T00:01:00Z".to_owned();
+        let (jws, jwks, policy) = signed_evidence(
+            reversed,
+            "2026-08-02T12:00:00Z".parse().expect("time parses"),
+        )
+        .await;
+        assert_eq!(
+            verify_flattened_jws(&jws, &jwks, &policy),
+            Err(VerificationError::Time)
+        );
+
+        let mut expired_when_issued = fixture_evidence();
+        expired_when_issued.issued_at = "2026-08-03T00:00:00Z".to_owned();
+        expired_when_issued.valid_until = "2026-08-03T00:00:00Z".to_owned();
+        let (jws, jwks, policy) = signed_evidence(
+            expired_when_issued,
+            "2026-08-03T00:00:00Z".parse().expect("time parses"),
+        )
+        .await;
+        assert_eq!(
+            verify_flattened_jws(&jws, &jwks, &policy),
+            Err(VerificationError::Time)
+        );
+
+        let (jws, jwks, mut policy) = signed_fixture().await;
+        policy.now = DateTime::<Utc>::MAX_UTC;
+        assert_eq!(
+            verify_flattened_jws(&jws, &jwks, &policy),
+            Err(VerificationError::Time)
+        );
+    }
+
+    #[tokio::test]
+    async fn complete_jws_negative_fixture_is_executable() {
+        let fixture: Value = serde_norway::from_slice(include_bytes!(
+            "../../../products/evidence/fixtures/conformance/jws-cases.yaml"
+        ))
+        .expect("JWS fixture parses");
+        let negatives = fixture["negative"]
+            .as_array()
+            .expect("negative cases are an array")
+            .iter()
+            .map(|value| value.as_str().expect("negative case is text"))
+            .collect::<Vec<_>>();
+        assert_eq!(
+            negatives,
+            [
+                "mutate one protected-header byte",
+                "mutate one payload byte",
+                "remove signature",
+                "add an unprotected header",
+                "add jku, x5u, jwk, x5c, crit, or b64",
+                "unknown kid",
+                "algorithm mismatch",
+                "signed payload violates the Evidence JSON Schema",
+                "duplicate evidence object beside payload",
+                "signing-provider failure",
+            ]
+        );
+
+        let evidence = fixture_evidence();
+        let base_header = json!({
+            "alg": "EdDSA",
+            "kid": "evidence-key-1",
+            "typ": EVIDENCE_JWS_TYP,
+            "cty": EVIDENCE_JWS_CTY
+        });
+        let (valid, public) =
+            sign_with_protected_header(PRIVATE_JWK, base_header.clone(), &evidence).await;
+        let jwks = jwks_document(public, []).expect("JWKS builds");
+        let (_, _, policy) = signed_fixture().await;
+        assert!(verify_flattened_jws(&valid, &jwks, &policy).is_ok());
+
+        let mut missing_signature: Value = serde_json::from_slice(&valid).expect("JWS parses");
+        missing_signature
+            .as_object_mut()
+            .expect("JWS is an object")
+            .remove("signature");
+        assert_eq!(
+            verify_flattened_jws(
+                &serde_json::to_vec(&missing_signature).expect("serializes"),
+                &jwks,
+                &policy
+            ),
+            Err(VerificationError::MalformedJws)
+        );
+
+        for extra in [
+            ("header", json!({"kid": "evidence-key-1"})),
+            (
+                "evidence",
+                serde_json::to_value(&evidence).expect("Evidence serializes"),
+            ),
+        ] {
+            let mut value: Value = serde_json::from_slice(&valid).expect("JWS parses");
+            value
+                .as_object_mut()
+                .expect("JWS is an object")
+                .insert(extra.0.to_owned(), extra.1);
+            assert_eq!(
+                verify_flattened_jws(
+                    &serde_json::to_vec(&value).expect("serializes"),
+                    &jwks,
+                    &policy
+                ),
+                Err(VerificationError::MalformedJws)
+            );
+        }
+
+        for (name, value) in [
+            ("jku", json!("https://attacker.invalid/jwks.json")),
+            ("x5u", json!("https://attacker.invalid/cert.pem")),
+            ("jwk", json!({"kty": "OKP"})),
+            ("x5c", json!(["certificate-canary"])),
+            ("crit", json!(["exp"])),
+            ("b64", json!(false)),
+        ] {
+            let mut header = base_header.clone();
+            header
+                .as_object_mut()
+                .expect("header is an object")
+                .insert(name.to_owned(), value);
+            let (serialized, public) =
+                sign_with_protected_header(PRIVATE_JWK, header, &evidence).await;
+            let keys = jwks_document(public, []).expect("JWKS builds");
+            assert_eq!(
+                verify_flattened_jws(&serialized, &keys, &policy),
+                Err(VerificationError::ProtectedHeader),
+                "{name}"
+            );
+        }
+
+        for (header, expected) in [
+            (
+                json!({
+                    "alg": "EdDSA", "kid": "unknown-key", "typ": EVIDENCE_JWS_TYP,
+                    "cty": EVIDENCE_JWS_CTY
+                }),
+                VerificationError::Key,
+            ),
+            (
+                json!({
+                    "alg": "HS256", "kid": "evidence-key-1", "typ": EVIDENCE_JWS_TYP,
+                    "cty": EVIDENCE_JWS_CTY
+                }),
+                VerificationError::ProtectedHeader,
+            ),
+        ] {
+            let (serialized, _) = sign_with_protected_header(PRIVATE_JWK, header, &evidence).await;
+            assert_eq!(
+                verify_flattened_jws(&serialized, &jwks, &policy),
+                Err(expected)
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn expected_nonce_must_match_and_reuse_is_not_replay_prevention() {
+        let (jws, jwks, policy) = signed_fixture().await;
+
+        // Changing the expected nonce fails with the generic policy mismatch.
+        let mut wrong_expectation = policy.clone();
+        wrong_expectation.request_nonce = "B".repeat(43);
+        assert_eq!(
+            verify_flattened_jws(&jws, &jwks, &wrong_expectation),
+            Err(VerificationError::Policy)
+        );
+
+        // Changing the signed nonce fails: re-signing a mutated payload with
+        // the same trusted key still mismatches the retained expectation.
+        let mut mutated = fixture_evidence();
+        mutated.request_nonce = "B".repeat(43);
+        let header = json!({
+            "alg": "EdDSA",
+            "kid": "evidence-key-1",
+            "typ": EVIDENCE_JWS_TYP,
+            "cty": EVIDENCE_JWS_CTY
+        });
+        let (mutated_jws, public) = sign_with_protected_header(PRIVATE_JWK, header, &mutated).await;
+        let mutated_jwks = jwks_document(public, []).expect("JWKS builds");
+        assert_eq!(
+            verify_flattened_jws(&mutated_jws, &mutated_jwks, &policy),
+            Err(VerificationError::Policy)
+        );
+
+        // The runtime does not store nonces, so verifying the same stored
+        // response twice with the same expectation succeeds. The nonce proves
+        // correlation with the retained request, never one-time use.
+        assert!(verify_flattened_jws(&jws, &jwks, &policy).is_ok());
+        assert!(verify_flattened_jws(&jws, &jwks, &policy).is_ok());
+    }
+
+    #[tokio::test]
+    async fn expected_subject_set_is_unordered_unique_and_exact() {
+        let mut evidence = fixture_evidence();
+        evidence.subjects = vec![
+            SubjectBinding {
+                role: "child".to_string(),
+                binding: format!("urn:evidence:subject:v1_{}", "A".repeat(43)),
+            },
+            SubjectBinding {
+                role: "candidate-parent".to_string(),
+                binding: format!("urn:evidence:subject:v1_{}", "B".repeat(43)),
+            },
+        ];
+        let (jws, jwks, policy) = signed_evidence(
+            evidence,
+            "2026-08-02T12:00:00Z".parse().expect("time parses"),
+        )
+        .await;
+
+        // Subject order alone is non-semantic.
+        let mut reordered = policy.clone();
+        reordered.expected_subjects.reverse();
+        assert!(verify_flattened_jws(&jws, &jwks, &reordered).is_ok());
+
+        // Missing, extra, duplicated, substituted, and wrong-key-version
+        // expectations all fail with the one generic policy mismatch.
+        let mut missing = policy.clone();
+        missing.expected_subjects.pop();
+        let mut extra = policy.clone();
+        extra.expected_subjects.push(ExpectedSubject {
+            role: "witness".to_string(),
+            binding: format!("urn:evidence:subject:v1_{}", "C".repeat(43)),
+        });
+        let mut duplicated = policy.clone();
+        let first = duplicated.expected_subjects[0].clone();
+        duplicated.expected_subjects.push(first);
+        let mut substituted = policy.clone();
+        substituted.expected_subjects[0].binding =
+            format!("urn:evidence:subject:v1_{}", "D".repeat(43));
+        let mut wrong_key_version = policy.clone();
+        wrong_key_version.expected_subjects[0].binding = wrong_key_version.expected_subjects[0]
+            .binding
+            .replace(":v1_", ":v2_");
+        let mut empty = policy.clone();
+        empty.expected_subjects.clear();
+        for broken in [
+            missing,
+            extra,
+            duplicated,
+            substituted,
+            wrong_key_version,
+            empty,
+        ] {
+            assert_eq!(
+                verify_flattened_jws(&jws, &jwks, &broken),
+                Err(VerificationError::Policy)
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn expected_output_contract_is_exact_after_signature_verification() {
+        let (jws, jwks, policy) = signed_fixture().await;
+
+        let mut missing = policy.clone();
+        missing.expected_outputs.clear();
+        let mut extra = policy.clone();
+        extra.expected_outputs.push(ExpectedOutput {
+            concept: "urn:example:other-concept".to_string(),
+            form: ExpectedValueForm::Boolean,
+        });
+        let mut duplicated = policy.clone();
+        duplicated.expected_outputs.push(ExpectedOutput {
+            concept: policy.expected_outputs[0].concept.clone(),
+            form: ExpectedValueForm::Boolean,
+        });
+        let mut wrong_concept = policy.clone();
+        wrong_concept.expected_outputs[0].concept = "urn:example:unexpected".to_string();
+        let mut wrong_form = policy.clone();
+        wrong_form.expected_outputs[0].form = ExpectedValueForm::String;
+        let mut wrong_cardinality = policy.clone();
+        wrong_cardinality.expected_outputs[0].form = ExpectedValueForm::List {
+            minimum_items: 2,
+            maximum_items: 4,
+        };
+        for broken in [
+            missing,
+            extra,
+            duplicated,
+            wrong_concept,
+            wrong_form,
+            wrong_cardinality,
+        ] {
+            assert_eq!(
+                verify_flattened_jws(&jws, &jwks, &broken),
+                Err(VerificationError::Policy)
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn authenticity_is_reported_separately_from_current_validity() {
+        // Verified after expiry: still authentic and policy-conformant, but
+        // not current evidence.
+        let (jws, jwks, mut policy) = signed_fixture().await;
+        policy.now = "2026-08-04T00:00:00Z".parse().expect("time parses");
+        let report = verify_flattened_jws_report(&jws, &jwks, &policy)
+            .expect("expired assertion remains cryptographically authentic");
+        assert!(!report.currently_valid);
+        assert_eq!(
+            verify_flattened_jws(&jws, &jwks, &policy),
+            Err(VerificationError::Time)
+        );
+
+        // While current, both entry points agree.
+        let (jws, jwks, policy) = signed_fixture().await;
+        let report = verify_flattened_jws_report(&jws, &jwks, &policy).expect("report verifies");
+        assert!(report.currently_valid);
+
+        // A mutated payload is not authentic in either entry point.
+        let mut value: serde_json::Value = serde_json::from_slice(&jws).expect("JWS parses");
+        let payload = value["payload"].as_str().expect("payload").to_string();
+        value["payload"] = Value::String(format!("A{}", &payload[1..]));
+        let mutated = serde_json::to_vec(&value).expect("serializes");
+        assert!(verify_flattened_jws_report(&mutated, &jwks, &policy).is_err());
+    }
+
+    #[tokio::test]
+    async fn assertion_lifetime_above_the_accepted_maximum_fails() {
+        let (jws, jwks, mut policy) = signed_fixture().await;
+        policy.maximum_assertion_lifetime = Duration::from_secs(60 * 60);
+        assert_eq!(
+            verify_flattened_jws(&jws, &jwks, &policy),
+            Err(VerificationError::Time)
+        );
+        assert!(verify_flattened_jws_report(&jws, &jwks, &policy).is_err());
+    }
+
+    #[tokio::test]
+    async fn unsigned_envelope_is_rejected_by_the_strict_jws_verifier() {
+        let (_, jwks, policy) = signed_fixture().await;
+        let envelope = crate::model::UnsignedEvidenceEnvelope {
+            schema: crate::EVIDENCE_UNSIGNED_ENVELOPE_SCHEMA_V1.to_owned(),
+            envelope_type: crate::model::UnsignedEnvelopeType::UnsignedEvidenceEnvelope,
+            integrity_protection: crate::model::UnsignedIntegrityProtection::None,
+            warning: crate::model::UnsignedEnvelopeWarning::NotCryptographicallyVerifiable,
+            evidence: fixture_evidence(),
+        };
+        let serialized = serde_json::to_vec(&envelope).expect("envelope serializes");
+        assert_eq!(
+            verify_flattened_jws(&serialized, &jwks, &policy),
+            Err(VerificationError::MalformedJws)
+        );
+        assert!(verify_flattened_jws_report(&serialized, &jwks, &policy).is_err());
+    }
+
+    #[tokio::test]
+    async fn retired_public_key_verifies_only_while_published_and_payload_is_current() {
+        let evidence = fixture_evidence();
+        let header = json!({
+            "alg": "EdDSA",
+            "kid": "retired-evidence-key",
+            "typ": EVIDENCE_JWS_TYP,
+            "cty": EVIDENCE_JWS_CTY
+        });
+        let (serialized, retired_public) =
+            sign_with_protected_header(RETIRED_PRIVATE_JWK, header, &evidence).await;
+
+        let active_private = PrivateJwk::parse(PRIVATE_JWK).expect("active key parses");
+        let active_public = LocalJwkSigner::new(active_private)
+            .expect("active signer builds")
+            .public_jwk();
+        let with_retired =
+            jwks_document(active_public.clone(), [retired_public]).expect("rotated JWKS builds");
+        let without_retired = jwks_document(active_public, []).expect("active JWKS builds");
+        let (_, _, policy) = signed_fixture().await;
+
+        assert!(verify_flattened_jws(&serialized, &with_retired, &policy).is_ok());
+        assert_eq!(
+            verify_flattened_jws(&serialized, &without_retired, &policy),
+            Err(VerificationError::Key)
+        );
+
+        let mut outside_window = policy;
+        outside_window.now = "2026-08-03T00:00:31Z".parse().expect("time parses");
+        assert_eq!(
+            verify_flattened_jws(&serialized, &with_retired, &outside_window),
+            Err(VerificationError::Time)
+        );
+    }
+
+    #[tokio::test]
+    async fn active_plus_maximum_retired_keys_is_a_usable_trusted_set() {
+        let (jws, _, policy) = signed_fixture().await;
+        let private = PrivateJwk::parse(PRIVATE_JWK).expect("active key parses");
+        let active = LocalJwkSigner::new(private)
+            .expect("active signer builds")
+            .public_jwk();
+        let retired = (0..32).map(|index| {
+            let mut key = active.clone();
+            key.kid = Some(format!("retired-evidence-key-{index:02}"));
+            key
+        });
+        let maximum = jwks_document(active.clone(), retired).expect("maximum JWKS builds");
+        assert_eq!(maximum.keys.len(), MAX_TRUSTED_KEYS);
+        assert!(verify_flattened_jws(&jws, &maximum, &policy).is_ok());
+
+        let mut excess = maximum;
+        let mut extra = active;
+        extra.kid = Some("retired-evidence-key-excess".to_owned());
+        excess
+            .keys
+            .push(serde_json::to_value(extra).expect("extra key serializes"));
+        assert_eq!(
+            verify_flattened_jws(&jws, &excess, &policy),
+            Err(VerificationError::Key)
+        );
+    }
+
+    /// Issue the fixture as an SD-JWT VC through the same signer, mapping, and
+    /// key set the runtime uses.
+    async fn issued_sd_jwt_vc() -> (String, JwksDocument, EvidenceVerificationPolicy) {
+        let evidence = fixture_evidence();
+        let signer = fixture_signer().await;
+        let input = crate::sdjwt_vc::issuance_input(&evidence, None, &BTreeMap::new())
+            .expect("evidence maps");
+        let serialized = signer
+            .sign_sd_jwt_vc(input)
+            .await
+            .expect("SD-JWT VC serializes");
+        let jwks = jwks_document(signer.public_jwk(), []).expect("JWKS builds");
+        let policy = policy_for(
+            &evidence,
+            "2026-08-02T12:00:00Z".parse().expect("time parses"),
+        );
+        (serialized, jwks, policy)
+    }
+
+    async fn fixture_signer() -> EvidenceSigner {
+        let private = PrivateJwk::parse(PRIVATE_JWK).expect("key parses");
+        let provider: Arc<dyn SigningProvider> =
+            Arc::new(LocalJwkSigner::new(private).expect("signer builds"));
+        EvidenceSigner::initialize(provider, "evidence-key-1")
+            .await
+            .expect("signer initializes")
+    }
+
+    /// Split an issued serialization into its JWT and its disclosures.
+    fn split_sd_jwt(serialized: &str) -> (String, Vec<String>) {
+        let body = serialized.strip_suffix('~').expect("trailing tilde");
+        let mut segments = body.split('~');
+        let jwt = segments.next().expect("JWT segment").to_owned();
+        (jwt, segments.map(str::to_owned).collect())
+    }
+
+    fn join_sd_jwt(jwt: &str, disclosures: &[String]) -> String {
+        let mut serialized = jwt.to_owned();
+        for disclosure in disclosures {
+            serialized.push('~');
+            serialized.push_str(disclosure);
+        }
+        serialized.push('~');
+        serialized
+    }
+
+    fn encode_disclosure(salt: &str, name: &str, value: Value) -> String {
+        URL_SAFE_NO_PAD
+            .encode(serde_json::to_vec(&json!([salt, name, value])).expect("disclosure serializes"))
+    }
+
+    /// Decode the signed JWT payload of an issued serialization.
+    fn sd_jwt_claims(jwt: &str) -> Map<String, Value> {
+        let encoded = jwt.split('.').nth(1).expect("payload segment");
+        let decoded = URL_SAFE_NO_PAD.decode(encoded).expect("payload decodes");
+        serde_json::from_slice(&decoded).expect("payload parses")
+    }
+
+    /// Re-encode a JWT with a replaced segment, keeping the original signature.
+    fn replace_segment(jwt: &str, index: usize, replacement: &str) -> String {
+        let mut parts: Vec<String> = jwt.split('.').map(str::to_owned).collect();
+        parts[index] = replacement.to_owned();
+        parts.join(".")
+    }
+
+    #[tokio::test]
+    async fn sd_jwt_vc_round_trips_and_verifies_under_the_same_policy() {
+        let (serialized, jwks, policy) = issued_sd_jwt_vc().await;
+        let evidence =
+            verify_sd_jwt_vc(serialized.as_bytes(), &jwks, &policy).expect("SD-JWT VC verifies");
+        // The rebuilt payload is the payload the signed JWS would carry.
+        assert_eq!(evidence, fixture_evidence());
+    }
+
+    #[tokio::test]
+    async fn structured_value_round_trips_as_top_level_field_disclosures() {
+        let mut evidence = fixture_evidence();
+        evidence.supported_values = vec![SupportedValue {
+            provides_value_for: "urn:example:concept:birth-certificate".to_owned(),
+            value: PublicValue::Structured(StructuredValue {
+                form: StructuredValueForm::ReviewedStructuredValue,
+                schema: "urn:example:schema:birth-certificate:v1".to_owned(),
+                fields: BTreeMap::from([
+                    ("dateOfBirth".to_owned(), json!("2000-05-23")),
+                    ("familyName".to_owned(), json!("Smith")),
+                    ("givenName".to_owned(), json!("John")),
+                    (
+                        "placeOfBirth".to_owned(),
+                        json!({"city": "Dusseldorf", "country": "DE"}),
+                    ),
+                ]),
+            }),
+        }];
+        let projections = BTreeMap::from([(
+            "urn:example:concept:birth-certificate".to_owned(),
+            "birthCertificate".to_owned(),
+        )]);
+        let signer = fixture_signer().await;
+        let input = crate::sdjwt_vc::issuance_input(&evidence, None, &projections)
+            .expect("structured evidence maps");
+        let serialized = signer
+            .sign_sd_jwt_vc(input)
+            .await
+            .expect("SD-JWT VC serializes");
+        let (jwt, disclosures) = split_sd_jwt(&serialized);
+        let claims = sd_jwt_claims(&jwt);
+        assert_eq!(
+            claims["birthCertificate"]
+                .as_object()
+                .expect("container object")
+                .keys()
+                .collect::<Vec<_>>(),
+            vec!["_sd"]
+        );
+        assert_eq!(disclosures.len(), 4);
+
+        let jwks = jwks_document(signer.public_jwk(), []).expect("JWKS builds");
+        let policy = policy_for(
+            &evidence,
+            "2026-08-02T12:00:00Z".parse().expect("time parses"),
+        );
+        let verified = verify_sd_jwt_vc(serialized.as_bytes(), &jwks, &policy)
+            .expect("field-disclosed credential verifies");
+        assert_eq!(verified, evidence);
+    }
+
+    #[tokio::test]
+    async fn sd_jwt_vc_confirmation_is_accepted_and_carries_no_private_material() {
+        let evidence = fixture_evidence();
+        let signer = fixture_signer().await;
+        let holder = crate::model::HolderPublicKey {
+            kty: "OKP".to_owned(),
+            crv: "Ed25519".to_owned(),
+            x: "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo".to_owned(),
+            alg: Some("EdDSA".to_owned()),
+            kid: Some("holder-1".to_owned()),
+        };
+        let input = crate::sdjwt_vc::issuance_input(&evidence, Some(&holder), &BTreeMap::new())
+            .expect("evidence maps");
+        let serialized = signer
+            .sign_sd_jwt_vc(input)
+            .await
+            .expect("SD-JWT VC serializes");
+        let jwks = jwks_document(signer.public_jwk(), []).expect("JWKS builds");
+        let policy = policy_for(
+            &evidence,
+            "2026-08-02T12:00:00Z".parse().expect("time parses"),
+        );
+
+        let (jwt, _) = split_sd_jwt(&serialized);
+        let claims = sd_jwt_claims(&jwt);
+        assert_eq!(claims["cnf"]["jwk"]["x"], json!(holder.x));
+        assert!(claims["cnf"]["jwk"].get("d").is_none());
+        assert!(
+            verify_sd_jwt_vc(serialized.as_bytes(), &jwks, &policy).is_ok(),
+            "a confirmed credential still verifies"
+        );
+    }
+
+    #[tokio::test]
+    async fn sd_jwt_disclosure_modification_rejected() {
+        let (serialized, jwks, policy) = issued_sd_jwt_vc().await;
+        let (jwt, disclosures) = split_sd_jwt(&serialized);
+        let original = URL_SAFE_NO_PAD
+            .decode(&disclosures[0])
+            .expect("disclosure decodes");
+        let members: Vec<Value> = serde_json::from_slice(&original).expect("disclosure parses");
+        let salt = members[0].as_str().expect("salt is a string");
+        let name = members[1].as_str().expect("name is a string");
+
+        let flipped = encode_disclosure(salt, name, json!(true));
+        assert_eq!(
+            verify_sd_jwt_vc(join_sd_jwt(&jwt, &[flipped]).as_bytes(), &jwks, &policy),
+            Err(VerificationError::Disclosure)
+        );
+
+        let renamed = encode_disclosure(salt, "urn:example:other-concept", json!(false));
+        assert_eq!(
+            verify_sd_jwt_vc(join_sd_jwt(&jwt, &[renamed]).as_bytes(), &jwks, &policy),
+            Err(VerificationError::Disclosure)
+        );
+
+        let unsalted = encode_disclosure("", name, json!(false));
+        assert_eq!(
+            verify_sd_jwt_vc(join_sd_jwt(&jwt, &[unsalted]).as_bytes(), &jwks, &policy),
+            Err(VerificationError::Disclosure)
+        );
+    }
+
+    #[tokio::test]
+    async fn sd_jwt_added_disclosure_rejected() {
+        let (serialized, jwks, policy) = issued_sd_jwt_vc().await;
+        let (jwt, disclosures) = split_sd_jwt(&serialized);
+
+        let mut extra = disclosures.clone();
+        extra.push(encode_disclosure(
+            "0123456789abcdef0123ab",
+            "urn:example:extra-concept",
+            json!(true),
+        ));
+        assert_eq!(
+            verify_sd_jwt_vc(join_sd_jwt(&jwt, &extra).as_bytes(), &jwks, &policy),
+            Err(VerificationError::Disclosure)
+        );
+
+        // Presenting the same signed disclosure twice claims one digest twice.
+        let mut repeated = disclosures.clone();
+        repeated.push(disclosures[0].clone());
+        assert_eq!(
+            verify_sd_jwt_vc(join_sd_jwt(&jwt, &repeated).as_bytes(), &jwks, &policy),
+            Err(VerificationError::Disclosure)
+        );
+    }
+
+    #[tokio::test]
+    async fn sd_jwt_removed_digest_rejected() {
+        let (serialized, jwks, policy) = issued_sd_jwt_vc().await;
+        let (jwt, _) = split_sd_jwt(&serialized);
+
+        // Version 1 issues complete credentials, so an unresolved signed digest
+        // is a mutation rather than a selective presentation.
+        assert_eq!(
+            verify_sd_jwt_vc(join_sd_jwt(&jwt, &[]).as_bytes(), &jwks, &policy),
+            Err(VerificationError::Disclosure)
+        );
+
+        // A stripped trailing tilde is not a valid issued serialization.
+        assert_eq!(
+            verify_sd_jwt_vc(serialized.trim_end_matches('~').as_bytes(), &jwks, &policy),
+            Err(VerificationError::MalformedJws)
+        );
+    }
+
+    #[tokio::test]
+    async fn sd_jwt_payload_modification_rejected() {
+        let (serialized, jwks, policy) = issued_sd_jwt_vc().await;
+        let (jwt, disclosures) = split_sd_jwt(&serialized);
+        let mut claims = sd_jwt_claims(&jwt);
+        claims.insert(
+            "audience".to_owned(),
+            json!("urn:example:other-relying-party"),
+        );
+        let replacement =
+            URL_SAFE_NO_PAD.encode(serde_json::to_vec(&claims).expect("claims serialize"));
+        let mutated = replace_segment(&jwt, 1, &replacement);
+
+        assert_eq!(
+            verify_sd_jwt_vc(
+                join_sd_jwt(&mutated, &disclosures).as_bytes(),
+                &jwks,
+                &policy
+            ),
+            Err(VerificationError::Signature)
+        );
+    }
+
+    #[tokio::test]
+    async fn sd_jwt_protected_header_modification_rejected() {
+        let (serialized, jwks, policy) = issued_sd_jwt_vc().await;
+        let (jwt, disclosures) = split_sd_jwt(&serialized);
+
+        for header in [
+            json!({"alg": "none", "kid": "evidence-key-1", "typ": EVIDENCE_SD_JWT_VC_TYP}),
+            json!({"alg": "EdDSA", "kid": "evidence-key-1", "typ": "JWT"}),
+            json!({"alg": "EdDSA", "kid": "evidence-key-1", "typ": EVIDENCE_SD_JWT_VC_TYP, "jwk": {"kty": "OKP"}}),
+        ] {
+            let replacement =
+                URL_SAFE_NO_PAD.encode(serde_json::to_vec(&header).expect("header serializes"));
+            let mutated = replace_segment(&jwt, 0, &replacement);
+            assert_eq!(
+                verify_sd_jwt_vc(
+                    join_sd_jwt(&mutated, &disclosures).as_bytes(),
+                    &jwks,
+                    &policy
+                ),
+                Err(VerificationError::ProtectedHeader)
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn sd_jwt_unknown_kid_rejected() {
+        let (serialized, jwks, policy) = issued_sd_jwt_vc().await;
+        let (jwt, disclosures) = split_sd_jwt(&serialized);
+        let header = json!({
+            "alg": "EdDSA",
+            "kid": "some-other-key",
+            "typ": EVIDENCE_SD_JWT_VC_TYP
+        });
+        let replacement =
+            URL_SAFE_NO_PAD.encode(serde_json::to_vec(&header).expect("header serializes"));
+        let mutated = replace_segment(&jwt, 0, &replacement);
+
+        assert_eq!(
+            verify_sd_jwt_vc(
+                join_sd_jwt(&mutated, &disclosures).as_bytes(),
+                &jwks,
+                &policy
+            ),
+            Err(VerificationError::Key)
+        );
+    }
+
+    #[tokio::test]
+    async fn sd_jwt_prohibited_claim_rejected() {
+        let signer = fixture_signer().await;
+        let evidence = fixture_evidence();
+        let jwks = jwks_document(signer.public_jwk(), []).expect("JWKS builds");
+        let policy = policy_for(
+            &evidence,
+            "2026-08-02T12:00:00Z".parse().expect("time parses"),
+        );
+
+        for (name, value) in [
+            (
+                "status",
+                json!({"status_list": {"uri": "https://example.test/status"}}),
+            ),
+            ("aud", json!("urn:example:relying-party")),
+            ("nbf", json!(1_785_662_100_i64)),
+            ("selector", json!({"profile": "national-identifier"})),
+        ] {
+            let mut input = crate::sdjwt_vc::issuance_input(&evidence, None, &BTreeMap::new())
+                .expect("evidence maps");
+            if name == "status" {
+                input.status = Some(value.clone());
+            } else {
+                input.public_claims.insert(name.to_owned(), value.clone());
+            }
+            let Ok(serialized) = signer.sign_sd_jwt_vc(input).await else {
+                // The issuer refuses reserved claim names outright, which is a
+                // stronger outcome than verifier rejection.
+                continue;
+            };
+            assert_eq!(
+                verify_sd_jwt_vc(serialized.as_bytes(), &jwks, &policy),
+                Err(VerificationError::Payload),
+                "{name} must never be published"
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn sd_jwt_rejected_by_flattened_jws_verifier() {
+        let (serialized, jwks, policy) = issued_sd_jwt_vc().await;
+        assert_eq!(
+            verify_flattened_jws(serialized.as_bytes(), &jwks, &policy),
+            Err(VerificationError::MalformedJws)
+        );
+
+        // The reverse also holds: a flattened JWS is not an SD-JWT VC.
+        let (jws, _, _) = signed_fixture().await;
+        assert_eq!(
+            verify_sd_jwt_vc(&jws, &jwks, &policy),
+            Err(VerificationError::MalformedJws)
+        );
+    }
+}
diff --git a/crates/registry-evidence/tests/cli.rs b/crates/registry-evidence/tests/cli.rs
new file mode 100644
index 000000000..c26fba1af
--- /dev/null
+++ b/crates/registry-evidence/tests/cli.rs
@@ -0,0 +1,1227 @@
+#![cfg(unix)]
+
+use std::{
+    collections::BTreeMap,
+    fs,
+    net::TcpStream,
+    os::unix::fs::PermissionsExt as _,
+    path::{Path, PathBuf},
+    process::{Child, Command, Output, Stdio},
+    time::{Duration, Instant},
+};
+
+/// A value planted in every mutated artifact so a diagnostic that leaks a
+/// document value fails loudly instead of quietly.
+const CANARY: &str = "s3cr3t-canary-value";
+
+#[test]
+fn actual_binary_checks_and_evaluates_an_immutable_project() {
+    let staged = tempfile::tempdir().expect("temporary deployment");
+    let project = Path::new(env!("CARGO_MANIFEST_DIR")).join(
+        "../../products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence",
+    );
+    copy_tree(&project.join("bundle"), &staged.path().join("bundle"));
+    let secret_root = staged.path().join("secrets");
+    fs::create_dir(&secret_root).expect("create private secret root");
+    fs::set_permissions(&secret_root, fs::Permissions::from_mode(0o700))
+        .expect("set private secret-root mode");
+
+    stage_reference_secrets(&secret_root);
+
+    let runtime = fs::read_to_string(project.join("runtime.yaml")).expect("read runtime template");
+    let bundle_path = staged.path().join("bundle");
+    let bundle_directory = bundle_path.to_str().expect("temporary path is UTF-8");
+    let audit_path = staged.path().join("audit.jsonl");
+    let runtime = runtime
+        .replacen("/etc/registry-evidence/bundle", bundle_directory, 1)
+        .replacen(
+            "/run/secrets/registry-evidence",
+            secret_root.to_str().expect("temporary path is UTF-8"),
+            1,
+        )
+        .replacen(
+            "/var/lib/registry-evidence/audit/evidence.jsonl",
+            audit_path.to_str().expect("temporary path is UTF-8"),
+            1,
+        );
+    let runtime_path = staged.path().join("runtime.yaml");
+    fs::write(&runtime_path, runtime).expect("stage runtime");
+    set_tree_mode(&bundle_path, 0o555, 0o444);
+    fs::set_permissions(&runtime_path, fs::Permissions::from_mode(0o444))
+        .expect("set immutable runtime mode");
+
+    let check = invoke(&runtime_path, &["check"]);
+    let evaluate = invoke(
+        &runtime_path,
+        &["evaluate", "--fixture", "fixtures/adult-status-cases.yaml"],
+    );
+
+    set_tree_mode(&bundle_path, 0o755, 0o644);
+    fs::set_permissions(&runtime_path, fs::Permissions::from_mode(0o644))
+        .expect("restore runtime mode");
+    assert_success(
+        &check,
+        "Evidence deployment ",
+        " passed check (3 requirements)\n",
+    );
+    assert_success(
+        &evaluate,
+        "Evidence fixture passed (",
+        " evaluated cases)\n",
+    );
+}
+
+/// Stage the platform secrets the reference project's bundle names, with a
+/// signing key generated for this run under the bundle's `activeKeyId`.
+/// Source credentials stay absent: `check` must not resolve them.
+fn stage_reference_secrets(secret_root: &Path) {
+    use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+
+    let write = |name: &str, value: &str| {
+        let path = secret_root.join(name);
+        fs::write(&path, value).expect("write reference secret");
+        fs::set_permissions(path, fs::Permissions::from_mode(0o600))
+            .expect("set owner-only secret mode");
+    };
+    let signing_key = ed25519_dalek::SigningKey::generate(&mut rand_core::OsRng);
+    let private_jwk = format!(
+        r#"{{"kty":"OKP","crv":"Ed25519","alg":"EdDSA","kid":"evidence-signing-2026-01","d":"{}","x":"{}"}}"#,
+        URL_SAFE_NO_PAD.encode(signing_key.to_bytes()),
+        URL_SAFE_NO_PAD.encode(signing_key.verifying_key().to_bytes())
+    );
+    write("audit-hmac-key", "audit-hash-secret-32-bytes-minimum-value");
+    write(
+        "subject-binding-hmac-key",
+        "subject-binding-secret-32-bytes-minimum-value",
+    );
+    write("signing-ed25519-private-jwk", &private_jwk);
+}
+
+/// One deployment failure class, with the exact operator text it must produce.
+///
+/// The expected text is split into a prefix and a suffix so a case that
+/// reports a text location can pin the cause and the location shape without
+/// pinning a line number that ordinary fixture edits would move.
+struct FailureCase {
+    label: &'static str,
+    break_deployment: fn(&Deployment),
+    prefix: &'static str,
+    suffix: &'static str,
+}
+
+#[test]
+fn check_names_a_safe_artifact_and_a_value_free_cause_for_every_failure_class() {
+    let cases = [
+        FailureCase {
+            label: "malformed bundle YAML",
+            break_deployment: |deployment| {
+                deployment.append("bundle/evidence.yaml", &format!("trailing: [{CANARY}\n"));
+            },
+            prefix: "evidence: deployment configuration is invalid: artifact evidence.yaml: document is not well-formed YAML (line ",
+            suffix: ")\n",
+        },
+        FailureCase {
+            label: "unknown bundle field",
+            break_deployment: |deployment| {
+                deployment.replace(
+                    "bundle/evidence.yaml",
+                    "  principalClaim: sub\n",
+                    &format!("  principalClaim: sub\n  unknownField: {CANARY}\n"),
+                );
+            },
+            prefix: "evidence: deployment configuration is invalid: artifact evidence.yaml: unknown field at authentication (line ",
+            suffix: ")\n",
+        },
+        FailureCase {
+            label: "wrong bundle field type",
+            break_deployment: |deployment| {
+                deployment.replace(
+                    "bundle/evidence.yaml",
+                    "version: 1\n",
+                    &format!("version: \"{CANARY}\"\n"),
+                );
+            },
+            prefix: "evidence: deployment configuration is invalid: artifact evidence.yaml: field has the wrong type at version (line ",
+            suffix: ")\n",
+        },
+        FailureCase {
+            label: "unaccepted bundle field variant",
+            break_deployment: |deployment| {
+                deployment.replace(
+                    "bundle/evidence.yaml",
+                    "  kind: oidc-access-token\n",
+                    &format!("  kind: {CANARY}\n"),
+                );
+            },
+            prefix: "evidence: deployment configuration is invalid: artifact evidence.yaml: field value is not one of the accepted variants at authentication.kind (line ",
+            suffix: ")\n",
+        },
+        FailureCase {
+            label: "configuration cross-reference",
+            break_deployment: |deployment| {
+                deployment.replace(
+                    "bundle/evidence.yaml",
+                    "    source: source-a\n",
+                    &format!("    source: {CANARY}\n"),
+                );
+            },
+            prefix: "evidence: deployment configuration is invalid: artifact evidence.yaml: requirement references an unknown source\n",
+            suffix: "",
+        },
+        FailureCase {
+            label: "artifact closure references a missing file",
+            break_deployment: |deployment| {
+                deployment.remove("bundle/derivations/adult-status.rhai");
+            },
+            prefix: "evidence: deployment artifact closure is invalid: artifact derivations/adult-status.rhai: the configuration references an artifact the bundle does not contain\n",
+            suffix: "",
+        },
+        FailureCase {
+            label: "artifact closure carries an unreferenced file",
+            break_deployment: |deployment| {
+                deployment.write("bundle/schemas/orphan.schema.yaml", &format!("x: {CANARY}\n"));
+            },
+            prefix: "evidence: deployment artifact closure is invalid: artifact schemas/orphan.schema.yaml: the bundle contains an artifact the configuration does not reference\n",
+            suffix: "",
+        },
+        FailureCase {
+            label: "unsafe artifact name is never echoed",
+            break_deployment: |deployment| {
+                deployment.write(
+                    &format!("bundle/fixtures/orphan {CANARY}.yaml"),
+                    "synthetic_only: true\n",
+                );
+            },
+            prefix: "evidence: deployment artifact closure is invalid: the bundle contains an artifact the configuration does not reference\n",
+            suffix: "",
+        },
+        FailureCase {
+            label: "script",
+            break_deployment: |deployment| {
+                deployment.append(
+                    "bundle/derivations/adult-status.rhai",
+                    &format!("\nthis is not rhai {CANARY}(((\n"),
+                );
+            },
+            prefix: "evidence: deployment script is invalid: artifact derivations/adult-status.rhai: script does not compile\n",
+            suffix: "",
+        },
+        FailureCase {
+            label: "fact schema",
+            break_deployment: |deployment| {
+                deployment.write(
+                    "bundle/schemas/adult-status-facts.schema.yaml",
+                    &format!("type: [{CANARY}]\n"),
+                );
+            },
+            prefix: "evidence: deployment artifact is invalid: artifact schemas/adult-status-facts.schema.yaml: fact schema must close the root object\n",
+            suffix: "",
+        },
+        FailureCase {
+            label: "codelist",
+            break_deployment: |deployment| {
+                deployment.write(
+                    "bundle/codelists/residence-region-map.yaml",
+                    &format!("id: broken\nversion: \"1\"\nentries: {CANARY}\n"),
+                );
+            },
+            prefix: "evidence: deployment artifact is invalid: artifact codelists/residence-region-map.yaml: codelist YAML is invalid\n",
+            suffix: "",
+        },
+        FailureCase {
+            label: "fixture",
+            break_deployment: |deployment| {
+                deployment.write(
+                    "bundle/fixtures/adult-status-cases.yaml",
+                    &format!("synthetic_only: true\ncases: {CANARY}\n"),
+                );
+            },
+            prefix: "evidence: deployment artifact is invalid: artifact fixtures/adult-status-cases.yaml: fixture cases are missing\n",
+            suffix: "",
+        },
+        FailureCase {
+            label: "unknown runtime field",
+            break_deployment: |deployment| {
+                deployment.append("runtime.yaml", &format!("unknownField: {CANARY}\n"));
+            },
+            prefix: "evidence: deployment configuration is invalid: artifact runtime.yaml: unknown field (line ",
+            suffix: ")\n",
+        },
+        FailureCase {
+            label: "wrong runtime field type",
+            break_deployment: |deployment| {
+                deployment.replace(
+                    "runtime.yaml",
+                    "  port: 8080\n",
+                    &format!("  port: \"{CANARY}\"\n"),
+                );
+            },
+            prefix: "evidence: deployment configuration is invalid: artifact runtime.yaml: field has the wrong type at listener.port (line ",
+            suffix: ")\n",
+        },
+        FailureCase {
+            label: "runtime operator path",
+            break_deployment: |deployment| {
+                deployment.replace_line(
+                    "runtime.yaml",
+                    "bundleDirectory: ",
+                    &format!("bundleDirectory: relative/{CANARY}\n"),
+                );
+            },
+            prefix: "evidence: deployment configuration is invalid: artifact runtime.yaml: absolute operator path is invalid\n",
+            suffix: "",
+        },
+    ];
+
+    for case in cases {
+        let deployment = Deployment::stage("all-definitions");
+        (case.break_deployment)(&deployment);
+        let output = deployment.check();
+
+        assert!(
+            !output.status.success(),
+            "{}: check accepted a broken deployment",
+            case.label
+        );
+        let stdout = std::str::from_utf8(&output.stdout).expect("stdout is UTF-8");
+        let stderr = std::str::from_utf8(&output.stderr).expect("stderr is UTF-8");
+        assert!(stdout.is_empty(), "{}: check wrote output", case.label);
+        assert!(
+            stderr.starts_with(case.prefix) && stderr.ends_with(case.suffix),
+            "{}: unexpected diagnostic {stderr:?}",
+            case.label
+        );
+        assert!(
+            !stdout.contains(CANARY) && !stderr.contains(CANARY),
+            "{}: diagnostic disclosed a document value",
+            case.label
+        );
+    }
+}
+
+/// Secret material the server would refuse at startup must already fail
+/// `check`, with the same fixed operator message startup produces. Each case
+/// stages the complete acceptance secret set and then breaks exactly one
+/// piece of it.
+#[test]
+fn check_rejects_secret_material_the_server_would_refuse_at_startup() {
+    struct SecretFailureCase {
+        label: &'static str,
+        break_secrets: fn(&Deployment),
+        expected: &'static str,
+    }
+    let cases = [
+        SecretFailureCase {
+            label: "signing key kid differs from the bundle's activeKeyId",
+            break_secrets: |deployment| deployment.write_mismatched_signing_key(),
+            expected: "evidence: runtime signing initialization failed\n",
+        },
+        SecretFailureCase {
+            label: "audit hash key below the minimum length",
+            break_secrets: |deployment| deployment.write_secret("audit-hash-key", "short"),
+            expected: "evidence: runtime audit initialization failed: the audit hash secret is \
+                       unusable\n",
+        },
+        SecretFailureCase {
+            label: "subject binding key missing",
+            break_secrets: |deployment| deployment.remove("secrets/subject-binding-key"),
+            expected: "evidence: runtime secret initialization failed\n",
+        },
+    ];
+
+    for case in cases {
+        let deployment = Deployment::stage("all-definitions");
+        deployment.stage_acceptance_secrets();
+        (case.break_secrets)(&deployment);
+        let output = deployment.check();
+
+        assert!(
+            !output.status.success(),
+            "{}: check accepted secret material the server would refuse",
+            case.label
+        );
+        assert!(
+            output.stdout.is_empty(),
+            "{}: check wrote output for a refused deployment",
+            case.label
+        );
+        let stderr = std::str::from_utf8(&output.stderr).expect("stderr is UTF-8");
+        assert_eq!(
+            stderr, case.expected,
+            "{}: unexpected diagnostic",
+            case.label
+        );
+    }
+}
+
+/// One audit initialization failure class, with the exact operator text it
+/// must produce and any handle the fault needs held open while `serve` runs.
+struct AuditFaultCase {
+    label: &'static str,
+    break_audit: fn(&Deployment) -> Option<fs::File>,
+    expected: &'static str,
+}
+
+/// The audit boundary refuses to start for unrelated reasons, and from outside
+/// the process they are indistinguishable: a mode an operator fixes with
+/// `chmod`, a chain that no longer verifies, and a second writer already
+/// holding the sink lock are three different questions with three different
+/// answers. Each names itself, and none of them names the audit path, which
+/// the operator already has in the runtime file.
+#[test]
+fn serve_names_why_the_audit_boundary_refused_to_initialize() {
+    let cases = [
+        AuditFaultCase {
+            label: "an audit file readable beyond its owner",
+            break_audit: |deployment| {
+                deployment.stage_audit_chain("");
+                set_mode(&deployment.path("audit.jsonl"), 0o644);
+                None
+            },
+            expected: "evidence: runtime audit initialization failed: the audit file or lock is \
+                       not owner-only, or its directory is unavailable or not owner-controlled\n",
+        },
+        AuditFaultCase {
+            label: "an audit chain that does not verify",
+            break_audit: |deployment| {
+                deployment.stage_audit_chain("{\"not\":\"an audit record\"}\n");
+                None
+            },
+            expected: "evidence: runtime audit initialization failed: the existing audit chain \
+                       did not verify\n",
+        },
+        AuditFaultCase {
+            label: "a second writer holding the audit sink lock",
+            break_audit: |deployment| {
+                let path = deployment.path("audit.jsonl.lock");
+                fs::write(&path, "").expect("stage audit sink lock");
+                fs::set_permissions(&path, fs::Permissions::from_mode(0o600))
+                    .expect("set owner-only audit lock mode");
+                let held = fs::OpenOptions::new()
+                    .write(true)
+                    .open(&path)
+                    .expect("open audit sink lock");
+                held.try_lock().expect("hold the audit sink lock");
+                Some(held)
+            },
+            expected: "evidence: runtime audit initialization failed: another writer already \
+                       holds the audit sink lock\n",
+        },
+    ];
+
+    for case in cases {
+        let deployment = Deployment::stage_on_port("all-definitions", free_port());
+        deployment.stage_acceptance_secrets();
+        deployment.seal();
+        let _held = (case.break_audit)(&deployment);
+        let output = invoke(&deployment.path("runtime.yaml"), &["serve"]);
+        deployment.unseal();
+
+        assert!(
+            !output.status.success(),
+            "{}: serve started on a refused audit boundary",
+            case.label
+        );
+        let stderr = std::str::from_utf8(&output.stderr).expect("stderr is UTF-8");
+        assert_eq!(
+            stderr, case.expected,
+            "{}: unexpected diagnostic",
+            case.label
+        );
+    }
+}
+
+/// The documented audit rotation procedure, executed against the real binary.
+///
+/// The procedure is: stop the service with SIGTERM, archive the audit file by
+/// rename, start the service again on the same path, and confirm readiness on
+/// the new chain. This proves the stop and start-new-chain steps of the
+/// operator procedure and the SIGTERM handling that makes the stop step
+/// possible at all.
+#[test]
+fn serve_stops_on_sigterm_and_restarts_on_an_archived_audit_chain() {
+    let port = free_port();
+    let deployment = Deployment::stage_on_port("all-definitions", port);
+    deployment.stage_acceptance_secrets();
+    deployment.seal();
+
+    let mut service = deployment.serve();
+    wait_until_ready(port);
+    let first = deployment.path("audit.jsonl");
+    assert!(first.is_file(), "the service did not open an audit chain");
+    stop(&mut service);
+
+    // Archive by rename: the audit file must stay a singly linked owner-only
+    // regular file, so a copy-and-truncate rotation is not the procedure.
+    let archive = deployment.path("audit-archived.jsonl");
+    fs::rename(&first, &archive).expect("archive the audit chain");
+    assert!(!first.exists(), "the archived chain was left in place");
+
+    let mut restarted = deployment.serve();
+    wait_until_ready(port);
+    assert!(first.is_file(), "the restart did not start a new chain");
+    stop(&mut restarted);
+
+    assert!(archive.is_file(), "the archived chain was disturbed");
+
+    // Rollback is the same stop, rename, start sequence in reverse: the new
+    // chain is set aside and the archived chain resumes at the original path.
+    let superseded = deployment.path("audit-superseded.jsonl");
+    fs::rename(&first, &superseded).expect("set the new chain aside");
+    fs::rename(&archive, &first).expect("restore the archived chain");
+    let mut rolled_back = deployment.serve();
+    wait_until_ready(port);
+    stop(&mut rolled_back);
+    assert!(
+        superseded.is_file(),
+        "the superseded chain was disturbed during rollback"
+    );
+    deployment.unseal();
+}
+
+/// The staged verification key identifier, echoed by the protected header.
+const VERIFY_KEY_ID: &str = "verify-fixture-key";
+
+/// A staged Ed25519 test key. It signs fixture assertions in this test binary
+/// only and is not a deployment key.
+const VERIFY_PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"verify-fixture-key"}"#;
+
+/// A staged request nonce, of the exact 43-character request-nonce shape.
+const FIXTURE_NONCE: &str = "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I";
+
+/// A different nonce of the same shape, carrying the canary so a policy
+/// diagnostic that echoed the expected value would fail loudly.
+const CANARY_NONCE: &str = "s3cr3t-canary-value000000000000000000000000";
+
+#[test]
+fn verify_accepts_an_authentic_and_current_stored_response() {
+    let stored = StoredResponse::stage(&fixture_evidence(), &fixture_evidence(), &fixture_policy());
+    let output = stored.verify(Some("2026-08-02T12:00:00Z"));
+
+    assert_eq!(
+        output.status.code(),
+        Some(0),
+        "verify rejected a good response"
+    );
+    assert!(output.stderr.is_empty(), "verify wrote diagnostics");
+    let stdout = std::str::from_utf8(&output.stdout).expect("stdout is UTF-8");
+    assert!(
+        stdout.starts_with(
+            "verified-at: 2026-08-02T12:00:00Z\nauthentic: yes\ncurrently-valid: yes\n"
+        ),
+        "unexpected verification output {stdout:?}"
+    );
+    assert!(
+        stdout.contains(&format!("\"requestNonce\": \"{FIXTURE_NONCE}\"")),
+        "verify did not print the verified Evidence for inspection"
+    );
+}
+
+#[test]
+fn verify_separates_authenticity_from_current_validity() {
+    let stored = StoredResponse::stage(&fixture_evidence(), &fixture_evidence(), &fixture_policy());
+    let output = stored.verify(Some("2026-08-05T00:00:00Z"));
+
+    assert_eq!(
+        output.status.code(),
+        Some(3),
+        "an expired response did not report its own exit status"
+    );
+    assert!(output.stderr.is_empty(), "verify wrote diagnostics");
+    assert_eq!(
+        std::str::from_utf8(&output.stdout).expect("stdout is UTF-8"),
+        "verified-at: 2026-08-05T00:00:00Z\nauthentic: yes\ncurrently-valid: no\n",
+        "an expired response must stay authentic without being current"
+    );
+}
+
+#[test]
+fn verify_rejects_a_tampered_payload_without_naming_a_value() {
+    let mut tampered = fixture_evidence();
+    tampered["supportedValues"][0]["value"] = serde_json::Value::String(CANARY.to_owned());
+    let stored = StoredResponse::stage(&fixture_evidence(), &tampered, &fixture_policy());
+    let output = stored.verify(Some("2026-08-02T12:00:00Z"));
+
+    assert_verification_failure(
+        &output,
+        "2026-08-02T12:00:00Z",
+        "authentic: no\n",
+        "evidence: stored response verification failed (signature)\n",
+    );
+}
+
+#[test]
+fn verify_reports_only_the_generic_policy_class_for_a_wrong_expected_nonce() {
+    let policy = fixture_policy().replacen(FIXTURE_NONCE, CANARY_NONCE, 1);
+    let stored = StoredResponse::stage(&fixture_evidence(), &fixture_evidence(), &policy);
+    let output = stored.verify(Some("2026-08-02T12:00:00Z"));
+
+    assert_verification_failure(
+        &output,
+        "2026-08-02T12:00:00Z",
+        "authentic: no\n",
+        "evidence: stored response verification failed (policy)\n",
+    );
+}
+
+#[test]
+fn verify_rejects_a_policy_document_with_an_unknown_field() {
+    let policy = format!("{}unknownField: {CANARY}\n", fixture_policy());
+    let stored = StoredResponse::stage(&fixture_evidence(), &fixture_evidence(), &policy);
+    let output = stored.verify(Some("2026-08-02T12:00:00Z"));
+
+    assert_verification_failure(
+        &output,
+        "2026-08-02T12:00:00Z",
+        "",
+        "evidence: stored response verification failed (malformed)\n",
+    );
+}
+
+#[test]
+fn verify_rejects_a_verification_instant_that_is_not_strict_utc() {
+    let stored = StoredResponse::stage(&fixture_evidence(), &fixture_evidence(), &fixture_policy());
+
+    for at in ["2026-08-02T12:00:00+02:00", "2026-08-02", CANARY] {
+        let output = stored.verify(Some(at));
+        assert_eq!(output.status.code(), Some(1), "verify accepted {at:?}");
+        assert!(
+            output.stdout.is_empty(),
+            "verify printed an unusable instant"
+        );
+        let stderr = std::str::from_utf8(&output.stderr).expect("stderr is UTF-8");
+        assert_eq!(
+            stderr, "evidence: verification instant is not strict RFC 3339 UTC\n",
+            "unexpected verification diagnostic"
+        );
+    }
+}
+
+#[test]
+fn verify_accepts_an_authentic_and_current_stored_sd_jwt_vc() {
+    let stored = StoredCredential::stage(&fixture_policy(), |credential| credential);
+    let output = stored.verify(Some("2026-08-02T12:00:00Z"));
+
+    assert_eq!(
+        output.status.code(),
+        Some(0),
+        "verify rejected a good credential"
+    );
+    assert!(output.stderr.is_empty(), "verify wrote diagnostics");
+    let stdout = std::str::from_utf8(&output.stdout).expect("stdout is UTF-8");
+    assert!(
+        stdout.contains("authentic: yes\n") && stdout.contains("currently-valid: yes\n"),
+        "verify did not report the credential as authentic and current"
+    );
+    assert!(
+        stdout.contains("urn:example:concept"),
+        "verify did not print the rebuilt Evidence for inspection"
+    );
+}
+
+#[test]
+fn verify_rejects_a_stored_sd_jwt_vc_whose_disclosure_was_replaced() {
+    // Substitute a well-formed disclosure of the same claim with the opposite
+    // value. Its digest is absent from the signed `_sd`, so the credential
+    // fails without the signature itself being touched.
+    let stored = StoredCredential::stage(&fixture_policy(), |credential| {
+        use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+
+        let body = credential
+            .strip_suffix('~')
+            .expect("the credential ends with the key-binding terminator");
+        let (jwt, disclosure) = body.split_once('~').expect("the credential discloses");
+        let decoded: serde_json::Value = serde_json::from_slice(
+            &URL_SAFE_NO_PAD
+                .decode(disclosure)
+                .expect("disclosure decodes"),
+        )
+        .expect("disclosure parses");
+        let replaced = URL_SAFE_NO_PAD.encode(
+            serde_json::to_vec(&serde_json::json!([decoded[0], decoded[1], true]))
+                .expect("disclosure serializes"),
+        );
+        format!("{jwt}~{replaced}~")
+    });
+    let output = stored.verify(Some("2026-08-02T12:00:00Z"));
+
+    assert_verification_failure(
+        &output,
+        "2026-08-02T12:00:00Z",
+        "authentic: no\n",
+        "evidence: stored response verification failed (disclosure)\n",
+    );
+}
+
+#[test]
+fn verify_requires_exactly_one_stored_response_format() {
+    let stored = StoredCredential::stage(&fixture_policy(), |credential| credential);
+    for arguments in [
+        vec![],
+        vec![
+            "--jws".to_owned(),
+            stored.path("response.sd-jwt").display().to_string(),
+            "--sd-jwt-vc".to_owned(),
+            stored.path("response.sd-jwt").display().to_string(),
+        ],
+    ] {
+        let mut command = Command::new(env!("CARGO_BIN_EXE_evidence"));
+        command
+            .arg("verify")
+            .args(&arguments)
+            .arg("--jwks")
+            .arg(stored.path("trusted.jwks.json"))
+            .arg("--policy")
+            .arg(stored.path("policy.yaml"))
+            .env_remove("REGISTRY_EVIDENCE_RUNTIME");
+        let output = command.output().expect("evidence binary starts");
+        assert_eq!(
+            output.status.code(),
+            Some(2),
+            "verify accepted an ambiguous stored-response selection"
+        );
+        assert!(
+            output.stdout.is_empty(),
+            "verify began before selecting a stored response"
+        );
+    }
+}
+
+/// Assert one closed verification failure: exit 1, the chosen instant, the
+/// expected remaining stdout, only the closed class on stderr, and no leaked
+/// document value on either stream.
+fn assert_verification_failure(
+    output: &Output,
+    instant: &str,
+    remaining_stdout: &str,
+    stderr: &str,
+) {
+    assert_eq!(output.status.code(), Some(1), "verify accepted a bad input");
+    let printed_out = std::str::from_utf8(&output.stdout).expect("stdout is UTF-8");
+    let printed_err = std::str::from_utf8(&output.stderr).expect("stderr is UTF-8");
+    assert_eq!(
+        printed_out,
+        format!("verified-at: {instant}\n{remaining_stdout}"),
+        "unexpected verification output"
+    );
+    assert_eq!(printed_err, stderr, "unexpected verification diagnostic");
+    assert!(
+        !printed_out.contains(CANARY) && !printed_err.contains(CANARY),
+        "verification disclosed a document value"
+    );
+}
+
+/// The stored Evidence payload the verify tests sign and re-verify.
+fn fixture_evidence() -> serde_json::Value {
+    serde_json::json!({
+        "schema": "registry.assertion-evidence/v1",
+        "assuranceProfile": "evidence-grade",
+        "requestNonce": FIXTURE_NONCE,
+        "id": "urn:ulid:01K1EXAMPLE0000000000000000",
+        "type": "Evidence",
+        "supportsRequirement": "urn:example:requirement:v1",
+        "isConformantTo": "urn:example:type:v1",
+        "issuedBy": "urn:example:issuer",
+        "providedBy": "urn:example:provider",
+        "issuedAt": "2026-08-02T00:00:00Z",
+        "observedAt": "2026-08-02T00:00:00Z",
+        "validUntil": "2026-08-03T00:00:00Z",
+        "purpose": "casework",
+        "audience": "urn:example:audience",
+        "configurationRevision": format!("sha256:{}", "0".repeat(64)),
+        "subjects": [{"role": "subject", "binding": format!("urn:evidence:subject:v1_{}", "A".repeat(43))}],
+        "supportedValues": [{"providesValueFor": "urn:example:concept", "value": false}],
+    })
+}
+
+/// The relying-procedure policy matching that payload.
+///
+/// A real relying party builds this from independently retained trusted state.
+/// The test simulates that state from the fixture it controls.
+fn fixture_policy() -> String {
+    format!(
+        "expectedAssuranceProfile: evidence-grade
+issuedBy: urn:example:issuer
+providedBy: urn:example:provider
+requirement: urn:example:requirement:v1
+evidenceType: urn:example:type:v1
+purpose: casework
+audience: urn:example:audience
+configurationRevision: sha256:{revision}
+requestNonce: {FIXTURE_NONCE}
+expectedSubjects:
+  - role: subject
+    binding: urn:evidence:subject:v1_{binding}
+expectedOutputs:
+  - concept: urn:example:concept
+    form: boolean
+maximumAssertionLifetimeSeconds: 172800
+clockSkewSeconds: 30
+",
+        revision = "0".repeat(64),
+        binding = "A".repeat(43),
+    )
+}
+
+/// The three files an operator holds for offline re-verification: one stored
+/// signed response, one pinned trusted key set, and one policy document.
+struct StoredResponse {
+    root: tempfile::TempDir,
+}
+
+impl StoredResponse {
+    /// Sign `signed`, store `stored` as the response payload, and stage
+    /// `policy`. Passing different payloads produces a tampered response whose
+    /// signature no longer covers the stored bytes.
+    fn stage(signed: &serde_json::Value, stored: &serde_json::Value, policy: &str) -> Self {
+        use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+        use ed25519_dalek::Signer as _;
+
+        let root = tempfile::tempdir().expect("temporary verification inputs");
+        let key = ed25519_dalek::SigningKey::generate(&mut rand_core::OsRng);
+        let protected = URL_SAFE_NO_PAD.encode(format!(
+            r#"{{"alg":"EdDSA","kid":"{VERIFY_KEY_ID}","typ":"evidence+jws","cty":"application/evidence+json"}}"#
+        ));
+        let signed_payload = URL_SAFE_NO_PAD
+            .encode(serde_json::to_vec(signed).expect("Evidence payload serializes"));
+        let signature = URL_SAFE_NO_PAD.encode(
+            key.sign(format!("{protected}.{signed_payload}").as_bytes())
+                .to_bytes(),
+        );
+        let stored_payload = URL_SAFE_NO_PAD
+            .encode(serde_json::to_vec(stored).expect("Evidence payload serializes"));
+
+        fs::write(
+            root.path().join("response.jws.json"),
+            format!(
+                r#"{{"protected":"{protected}","payload":"{stored_payload}","signature":"{signature}"}}"#
+            ),
+        )
+        .expect("stage the stored response");
+        fs::write(
+            root.path().join("trusted.jwks.json"),
+            format!(
+                r#"{{"keys":[{{"kty":"OKP","crv":"Ed25519","alg":"EdDSA","kid":"{VERIFY_KEY_ID}","x":"{}"}}]}}"#,
+                URL_SAFE_NO_PAD.encode(key.verifying_key().to_bytes())
+            ),
+        )
+        .expect("stage the pinned key set");
+        fs::write(root.path().join("policy.yaml"), policy).expect("stage the policy");
+        Self { root }
+    }
+
+    /// Run `verify` with no runtime file staged, so the command proves it needs
+    /// no deployment and opens no socket.
+    fn verify(&self, at: Option<&str>) -> Output {
+        let mut command = Command::new(env!("CARGO_BIN_EXE_evidence"));
+        command
+            .arg("verify")
+            .arg("--jws")
+            .arg(self.root.path().join("response.jws.json"))
+            .arg("--jwks")
+            .arg(self.root.path().join("trusted.jwks.json"))
+            .arg("--policy")
+            .arg(self.root.path().join("policy.yaml"))
+            .env_remove("REGISTRY_EVIDENCE_RUNTIME");
+        if let Some(at) = at {
+            command.arg("--at").arg(at);
+        }
+        command.output().expect("evidence binary starts")
+    }
+}
+
+/// The SD-JWT VC counterpart of `StoredResponse`. The same assertion is
+/// serialized through the production issuance path, so the command is proven
+/// against the bytes an adopter actually receives rather than a hand-built
+/// approximation.
+struct StoredCredential {
+    root: tempfile::TempDir,
+}
+
+impl StoredCredential {
+    /// Issue the fixture assertion, apply `mutate` to the serialization, and
+    /// stage it beside the pinned key set and the policy.
+    fn stage(policy: &str, mutate: impl FnOnce(String) -> String) -> Self {
+        use registry_evidence::{
+            model::Evidence,
+            sdjwt_vc::issuance_input,
+            signing::{jwks_document, EvidenceSigner},
+        };
+        use registry_platform_crypto::{LocalJwkSigner, PrivateJwk, SigningProvider};
+        use std::sync::Arc;
+
+        let root = tempfile::tempdir().expect("temporary verification inputs");
+        let evidence: Evidence =
+            serde_json::from_value(fixture_evidence()).expect("the fixture is an Evidence payload");
+        let private = PrivateJwk::parse(VERIFY_PRIVATE_JWK).expect("fixture key parses");
+        let provider: Arc<dyn SigningProvider> =
+            Arc::new(LocalJwkSigner::new(private).expect("fixture signer builds"));
+
+        let (credential, trusted) = tokio::runtime::Runtime::new()
+            .expect("issuance runtime starts")
+            .block_on(async {
+                let signer = EvidenceSigner::initialize(provider, VERIFY_KEY_ID)
+                    .await
+                    .expect("signer initializes");
+                let input =
+                    issuance_input(&evidence, None, &BTreeMap::new()).expect("the fixture maps");
+                let credential = signer
+                    .sign_sd_jwt_vc(input)
+                    .await
+                    .expect("credential serializes");
+                let trusted = jwks_document(signer.public_jwk(), []).expect("JWKS builds");
+                (credential, trusted)
+            });
+
+        fs::write(root.path().join("response.sd-jwt"), mutate(credential))
+            .expect("stage the stored credential");
+        fs::write(
+            root.path().join("trusted.jwks.json"),
+            serde_json::to_vec(&trusted).expect("JWKS serializes"),
+        )
+        .expect("stage the pinned key set");
+        fs::write(root.path().join("policy.yaml"), policy).expect("stage the policy");
+        Self { root }
+    }
+
+    fn path(&self, name: &str) -> PathBuf {
+        self.root.path().join(name)
+    }
+
+    fn verify(&self, at: Option<&str>) -> Output {
+        let mut command = Command::new(env!("CARGO_BIN_EXE_evidence"));
+        command
+            .arg("verify")
+            .arg("--sd-jwt-vc")
+            .arg(self.path("response.sd-jwt"))
+            .arg("--jwks")
+            .arg(self.path("trusted.jwks.json"))
+            .arg("--policy")
+            .arg(self.path("policy.yaml"))
+            .env_remove("REGISTRY_EVIDENCE_RUNTIME");
+        if let Some(at) = at {
+            command.arg("--at").arg(at);
+        }
+        command.output().expect("evidence binary starts")
+    }
+}
+
+fn stop(service: &mut Child) {
+    let pid = rustix::process::Pid::from_raw(
+        i32::try_from(service.id()).expect("child identifier is a pid"),
+    )
+    .expect("child identifier is a pid");
+    rustix::process::kill_process(pid, rustix::process::Signal::TERM).expect("send SIGTERM");
+    let status = service.wait().expect("service exits");
+    assert!(
+        status.success(),
+        "SIGTERM did not stop the service cleanly: {status}"
+    );
+}
+
+fn free_port() -> u16 {
+    std::net::TcpListener::bind("127.0.0.1:0")
+        .expect("reserve a local port")
+        .local_addr()
+        .expect("reserved port")
+        .port()
+}
+
+/// Poll `/ready` until the service reports a healthy audit chain.
+///
+/// Readiness covers the subject-binding key, the signer, the audit chain head,
+/// and every source credential, so a ready service proves the whole startup
+/// path completed rather than only that a socket is open.
+fn wait_until_ready(port: u16) {
+    let deadline = Instant::now() + Duration::from_secs(20);
+    let mut last = String::new();
+    while Instant::now() < deadline {
+        if let Some(status) = probe(port, "/ready") {
+            if status == "HTTP/1.1 200 OK" {
+                return;
+            }
+            last = status;
+        }
+        std::thread::sleep(Duration::from_millis(50));
+    }
+    panic!("the service never became ready (last status {last:?})");
+}
+
+fn probe(port: u16, path: &str) -> Option<String> {
+    use std::io::{BufRead as _, BufReader, Write as _};
+
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).ok()?;
+    stream.set_read_timeout(Some(Duration::from_secs(5))).ok()?;
+    write!(
+        stream,
+        "GET {path} HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n"
+    )
+    .ok()?;
+    let mut status = String::new();
+    BufReader::new(stream).read_line(&mut status).ok()?;
+    Some(status.trim_end().to_owned())
+}
+
+/// A staged deployment: one acceptance bundle, one operator runtime file, and
+/// one private secret root under a single temporary directory.
+struct Deployment {
+    root: tempfile::TempDir,
+    port: u16,
+}
+
+impl Deployment {
+    fn stage(case: &str) -> Self {
+        Self::stage_on_port(case, 8080)
+    }
+
+    fn stage_on_port(case: &str, port: u16) -> Self {
+        let deployment = Self {
+            root: tempfile::tempdir().expect("temporary deployment"),
+            port,
+        };
+        let source = Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("../../products/evidence/fixtures/acceptance")
+            .join(case);
+        copy_tree(&source, &deployment.path("bundle"));
+        let secrets = deployment.path("secrets");
+        fs::create_dir(&secrets).expect("create private secret root");
+        fs::set_permissions(&secrets, fs::Permissions::from_mode(0o700))
+            .expect("set private secret-root mode");
+        fs::write(
+            deployment.path("runtime.yaml"),
+            deployment.runtime_document(),
+        )
+        .expect("stage runtime");
+        deployment
+    }
+
+    fn path(&self, relative: &str) -> PathBuf {
+        self.root.path().join(relative)
+    }
+
+    fn runtime_document(&self) -> String {
+        format!(
+            "version: 1
+bundleDirectory: {bundle}
+listener:
+  bindHost: 127.0.0.1
+  port: {port}
+  tlsTermination: operator-controlled-upstream
+  trustProxyIdentityHeaders: false
+  maximumRequestBytes: 65536
+  maximumConcurrentRequests: 64
+  requestTimeoutMilliseconds: 10000
+  shutdownGraceMilliseconds: 5000
+secretProviders:
+  file:
+    root: {secrets}
+auditStorage:
+  path: {audit}
+  maximumFileBytes: 1073741824
+outboundTls:
+  systemRoots: true
+  trustProfiles: {{}}
+",
+            bundle = self.path("bundle").display(),
+            port = self.port,
+            secrets = self.path("secrets").display(),
+            audit = self.path("audit.jsonl").display(),
+        )
+    }
+
+    fn write(&self, relative: &str, contents: &str) {
+        fs::write(self.path(relative), contents).expect("write staged artifact");
+    }
+
+    fn append(&self, relative: &str, contents: &str) {
+        let path = self.path(relative);
+        let mut text = fs::read_to_string(&path).expect("read staged artifact");
+        text.push_str(contents);
+        fs::write(path, text).expect("write staged artifact");
+    }
+
+    fn remove(&self, relative: &str) {
+        fs::remove_file(self.path(relative)).expect("remove staged artifact");
+    }
+
+    fn replace(&self, relative: &str, from: &str, to: &str) {
+        let path = self.path(relative);
+        let text = fs::read_to_string(&path).expect("read staged artifact");
+        assert!(text.contains(from), "staged artifact has no {from:?}");
+        fs::write(path, text.replacen(from, to, 1)).expect("write staged artifact");
+    }
+
+    fn replace_line(&self, relative: &str, prefix: &str, line: &str) {
+        let path = self.path(relative);
+        let text = fs::read_to_string(&path).expect("read staged artifact");
+        let replaced = text
+            .lines()
+            .map(|current| {
+                if current.starts_with(prefix) {
+                    line.to_owned()
+                } else {
+                    format!("{current}\n")
+                }
+            })
+            .collect::<String>();
+        assert_ne!(replaced, text, "staged artifact has no {prefix:?} line");
+        fs::write(path, replaced).expect("write staged artifact");
+    }
+
+    fn write_secret(&self, name: &str, value: &str) {
+        let path = self.path("secrets").join(name);
+        fs::write(&path, value).expect("write staged secret");
+        fs::set_permissions(path, fs::Permissions::from_mode(0o600))
+            .expect("set owner-only secret mode");
+    }
+
+    /// Stage every logical secret the acceptance bundle references.
+    ///
+    /// The signing key is generated for this run so no private key material is
+    /// tracked, and the source credentials are synthetic constants that never
+    /// reach a network because the test performs no evidence request.
+    fn stage_acceptance_secrets(&self) {
+        use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+
+        let signing_key = ed25519_dalek::SigningKey::generate(&mut rand_core::OsRng);
+        let private_jwk = format!(
+            r#"{{"kty":"OKP","crv":"Ed25519","alg":"EdDSA","kid":"fixture-key-2026-01","d":"{}","x":"{}"}}"#,
+            URL_SAFE_NO_PAD.encode(signing_key.to_bytes()),
+            URL_SAFE_NO_PAD.encode(signing_key.verifying_key().to_bytes())
+        );
+        self.write_secret("audit-hash-key", "audit-hash-secret-32-bytes-minimum-value");
+        self.write_secret(
+            "subject-binding-key",
+            "subject-binding-secret-32-bytes-minimum-value",
+        );
+        self.write_secret("signing-key", &private_jwk);
+        self.write_secret("source-a-token", "synthetic-source-token");
+        self.write_secret("source-b-token", "synthetic-source-token");
+        self.write_secret("source-c-username", "synthetic-source-user");
+        self.write_secret("source-c-password", "synthetic-source-password");
+        self.write_secret("source-d-token", "synthetic-source-token");
+    }
+
+    /// Place an audit chain the service will find on start, owner-only as the
+    /// sink requires. A case that is about a mode widens it afterwards.
+    fn stage_audit_chain(&self, contents: &str) {
+        let path = self.path("audit.jsonl");
+        fs::write(&path, contents).expect("stage audit chain");
+        fs::set_permissions(path, fs::Permissions::from_mode(0o600))
+            .expect("set owner-only audit chain mode");
+    }
+
+    /// Overwrite the staged signing key with a fresh key whose kid is not
+    /// the bundle's `signing.activeKeyId`.
+    fn write_mismatched_signing_key(&self) {
+        use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+
+        let signing_key = ed25519_dalek::SigningKey::generate(&mut rand_core::OsRng);
+        let private_jwk = format!(
+            r#"{{"kty":"OKP","crv":"Ed25519","alg":"EdDSA","kid":"not-the-active-key","d":"{}","x":"{}"}}"#,
+            URL_SAFE_NO_PAD.encode(signing_key.to_bytes()),
+            URL_SAFE_NO_PAD.encode(signing_key.verifying_key().to_bytes())
+        );
+        self.write_secret("signing-key", &private_jwk);
+    }
+
+    /// Start `serve` against the sealed deployment.
+    fn serve(&self) -> Child {
+        Command::new(env!("CARGO_BIN_EXE_evidence"))
+            .arg("--runtime")
+            .arg(self.path("runtime.yaml"))
+            .arg("serve")
+            .env_remove("REGISTRY_EVIDENCE_RUNTIME")
+            .stdout(Stdio::null())
+            .stderr(Stdio::null())
+            .spawn()
+            .expect("evidence service starts")
+    }
+
+    /// Run `check` against the sealed deployment, then restore write access so
+    /// the temporary directory can be cleaned up.
+    fn check(&self) -> Output {
+        self.seal();
+        let output = invoke(&self.path("runtime.yaml"), &["check"]);
+        self.unseal();
+        output
+    }
+
+    fn seal(&self) {
+        set_tree_mode(&self.path("bundle"), 0o555, 0o444);
+        fs::set_permissions(self.path("runtime.yaml"), fs::Permissions::from_mode(0o444))
+            .expect("seal runtime");
+    }
+
+    fn unseal(&self) {
+        set_tree_mode(&self.path("bundle"), 0o755, 0o644);
+        fs::set_permissions(self.path("runtime.yaml"), fs::Permissions::from_mode(0o644))
+            .expect("unseal runtime");
+    }
+}
+
+impl Drop for Deployment {
+    fn drop(&mut self) {
+        if self.path("bundle").is_dir() {
+            set_tree_mode(&self.path("bundle"), 0o755, 0o644);
+        }
+    }
+}
+
+fn invoke(runtime: &Path, arguments: &[&str]) -> Output {
+    Command::new(env!("CARGO_BIN_EXE_evidence"))
+        .arg("--runtime")
+        .arg(runtime)
+        .args(arguments)
+        .env_remove("REGISTRY_EVIDENCE_RUNTIME")
+        .output()
+        .expect("evidence binary starts")
+}
+
+fn assert_success(output: &Output, prefix: &str, suffix: &str) {
+    assert!(output.status.success(), "evidence command failed");
+    assert!(
+        output.stderr.is_empty(),
+        "evidence command wrote diagnostics"
+    );
+    let stdout = std::str::from_utf8(&output.stdout).expect("stdout is UTF-8");
+    assert!(
+        stdout.starts_with(prefix) && stdout.ends_with(suffix),
+        "evidence command output shape changed"
+    );
+}
+
+fn copy_tree(source: &Path, destination: &Path) {
+    fs::create_dir_all(destination).expect("create staged directory");
+    for entry in fs::read_dir(source).expect("read source tree") {
+        let entry = entry.expect("source entry");
+        let target = destination.join(entry.file_name());
+        if entry.file_type().expect("source entry type").is_dir() {
+            copy_tree(&entry.path(), &target);
+        } else {
+            fs::copy(entry.path(), target).expect("copy staged artifact");
+        }
+    }
+}
+
+fn set_mode(path: &Path, mode: u32) {
+    fs::set_permissions(path, fs::Permissions::from_mode(mode)).expect("set staged mode");
+}
+
+fn set_tree_mode(path: &Path, directory_mode: u32, file_mode: u32) {
+    let metadata = fs::symlink_metadata(path).expect("staged path metadata");
+    if metadata.is_dir() {
+        for entry in fs::read_dir(path).expect("read staged tree") {
+            set_tree_mode(
+                &entry.expect("staged entry").path(),
+                directory_mode,
+                file_mode,
+            );
+        }
+        fs::set_permissions(path, fs::Permissions::from_mode(directory_mode))
+            .expect("set staged directory mode");
+    } else {
+        fs::set_permissions(path, fs::Permissions::from_mode(file_mode))
+            .expect("set staged file mode");
+    }
+}
diff --git a/crates/registry-evidence/tests/deployment_projects.rs b/crates/registry-evidence/tests/deployment_projects.rs
new file mode 100644
index 000000000..03e765ea3
--- /dev/null
+++ b/crates/registry-evidence/tests/deployment_projects.rs
@@ -0,0 +1,1295 @@
+//! Executable proof for the complete Evidence Version 1 reference deployments.
+
+#![cfg(unix)]
+
+use std::collections::BTreeSet;
+use std::fs;
+use std::os::unix::fs::PermissionsExt as _;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::Duration;
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use chrono::{DateTime, Utc};
+use ed25519_dalek::SigningKey;
+use rand_core::OsRng;
+use registry_evidence::bundle::{Bundle, DeploymentInputs};
+use registry_evidence::config::{ConfigError, SelectorInput};
+use registry_evidence::kernel::{
+    EvidenceConstruction, KernelError, KernelOutcome, OfflineKernel, ValueProjection,
+};
+use registry_evidence::model::{
+    LookupResult, PublicValue, ScalarOrEntityReference, SubjectBinding,
+};
+use registry_evidence::problem::ProblemCode;
+use registry_evidence::rhai_runtime::{QueryPair, RequestParts};
+use registry_evidence::runtime::source_failure_problem;
+use registry_evidence::selector::{resolve_offline_fixture_authorization, ResolvedAuthorization};
+use registry_evidence::signing::{jwks_document, EvidenceSigner};
+use registry_evidence::source::{project_fixture_response, SourceError};
+use registry_evidence::verifier::{verify_flattened_jws, EvidenceVerificationPolicy};
+use registry_platform_crypto::{LocalJwkSigner, PrivateJwk};
+use serde::Deserialize;
+use serde_json::{Map as JsonMap, Value};
+use tempfile::TempDir;
+use zeroize::Zeroizing;
+
+const AUDIENCE: &str = "urn:registry-evidence:reference-project-fixtures";
+const BINDING_KEY: &[u8] = b"reference-project-binding-key-v1";
+const TEST_CA: &str = "-----BEGIN CERTIFICATE-----\nMAMCAQE=\n-----END CERTIFICATE-----\n";
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct FixtureContract {
+    fixture: String,
+    synthetic_only: bool,
+    common: FixtureCommon,
+    cases: Vec<FixtureCase>,
+    #[serde(rename = "privacyExpectation")]
+    privacy_expectation: PrivacyExpectation,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct FixtureCommon {
+    observed_at: String,
+    #[serde(default)]
+    purpose: Option<String>,
+    selectors: Value,
+    #[serde(default, rename = "verified_token_claims")]
+    verified_token_claims: Option<Value>,
+    #[serde(default, rename = "derivationSelectorInputs")]
+    derivation_selector_inputs: Option<Value>,
+    #[serde(rename = "expectedRequestParts")]
+    expected_request_parts: ExpectedRequestParts,
+    #[serde(rename = "expectedTransport")]
+    expected_transport: ExpectedTransport,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct FixtureCase {
+    id: String,
+    #[serde(default)]
+    purpose: Option<String>,
+    #[serde(default)]
+    response: Option<Value>,
+    #[serde(default, rename = "sourceFailure")]
+    source_failure: Option<String>,
+    #[serde(default, rename = "bundleMutation")]
+    bundle_mutation: Option<String>,
+    #[serde(default, rename = "requestMutation")]
+    request_mutation: Option<String>,
+    #[serde(default, rename = "derivationMutation")]
+    derivation_mutation: Option<String>,
+    #[serde(default, rename = "derivationParameterMutation")]
+    derivation_parameter_mutation: Option<JsonMap<String, Value>>,
+    #[serde(default, rename = "selectorOverrides")]
+    selector_overrides: Option<Value>,
+    #[serde(default)]
+    observed_at: Option<String>,
+    expected: Expected,
+}
+
+#[derive(Debug, Default, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Expected {
+    #[serde(default)]
+    lookup: Option<String>,
+    #[serde(default)]
+    facts: Option<Value>,
+    #[serde(default)]
+    value: Option<Value>,
+    #[serde(default)]
+    values: Option<Value>,
+    #[serde(default, rename = "entityReferenceCount")]
+    entity_reference_count: Option<usize>,
+    #[serde(default, rename = "rawReferencesDisclosed")]
+    raw_references_disclosed: Option<bool>,
+    #[serde(default)]
+    signed: Option<bool>,
+    #[serde(default, rename = "publicProblem")]
+    public_problem: Option<String>,
+    #[serde(default)]
+    error: Option<String>,
+    #[serde(default, rename = "derivationRuns")]
+    derivation_runs: Option<bool>,
+    #[serde(default)]
+    bundle: Option<String>,
+    #[serde(default, rename = "outputGate")]
+    output_gate: Option<String>,
+    #[serde(default, rename = "rejectedBefore")]
+    rejected_before: Option<String>,
+    #[serde(default, rename = "sourceRequestCount")]
+    source_request_count: Option<usize>,
+    #[serde(default, rename = "expectedTransport")]
+    expected_transport: Option<ExpectedTransport>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ExpectedRequestParts {
+    query: Vec<ExpectedQueryPair>,
+    body: Option<Value>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ExpectedQueryPair {
+    name: String,
+    value: String,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ExpectedTransport {
+    #[serde(default)]
+    path: Option<String>,
+    #[serde(default)]
+    query: Option<String>,
+    #[serde(default)]
+    body: Option<Value>,
+    #[serde(default, rename = "fixedHeaders")]
+    fixed_headers: Option<Vec<ExpectedHeader>>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ExpectedHeader {
+    name: String,
+    value: String,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct PrivacyExpectation {
+    #[serde(rename = "evidenceContains")]
+    evidence_contains: Vec<String>,
+    #[serde(rename = "evidenceExcludes")]
+    evidence_excludes: Vec<String>,
+    #[serde(rename = "diagnosticsExclude")]
+    diagnostics_exclude: Vec<String>,
+}
+
+struct LoadedProject {
+    _temporary: TempDir,
+    runtime_path: PathBuf,
+    bundle: Arc<Bundle>,
+    kernel: OfflineKernel,
+}
+
+struct FixtureExecution<'a> {
+    bundle: &'a Arc<Bundle>,
+    kernel: &'a OfflineKernel,
+    requirement: &'a registry_evidence::config::RequirementConfig,
+    fixture: &'a FixtureContract,
+    signer: &'a EvidenceSigner,
+}
+
+impl Drop for LoadedProject {
+    fn drop(&mut self) {
+        set_tree_mode(self._temporary.path(), 0o755, 0o644);
+    }
+}
+
+#[tokio::test]
+async fn reference_deployment_projects_execute_the_closed_fixture_contract() {
+    for project_name in [
+        "dhis2-tracker-evidence",
+        "opencrvs-family-evidence",
+        "relay-protected-read-evidence",
+    ] {
+        let project = load_project(project_name);
+        let signer = fixture_signer().await;
+        for requirement in &project.bundle.config.requirements {
+            let fixture_value = project
+                .bundle
+                .fixtures
+                .get(
+                    requirement
+                        .fixtures
+                        .as_ref()
+                        .expect("reference fixture is declared")
+                        .as_str(),
+                )
+                .unwrap_or_else(|| panic!("{project_name}: fixture artifact missing"));
+            let fixture: FixtureContract = serde_json::from_value(
+                serde_json::to_value(fixture_value)
+                    .unwrap_or_else(|_| panic!("{project_name}: fixture conversion failed")),
+            )
+            .unwrap_or_else(|_| panic!("{project_name}: fixture vocabulary is not closed"));
+            validate_contract_shape(project_name, &fixture);
+            execute_fixture(
+                project_name,
+                &project.bundle,
+                &project.kernel,
+                requirement,
+                &fixture,
+                &signer,
+            )
+            .await;
+        }
+
+        assert!(project.runtime_path.exists());
+    }
+}
+
+fn load_project(project_name: &str) -> LoadedProject {
+    let project_root = projects_root().join(project_name);
+    let original_runtime = fs::read_to_string(project_root.join("runtime.yaml"))
+        .unwrap_or_else(|_| panic!("{project_name}: runtime is unreadable"));
+    registry_evidence::config::RuntimeConfig::parse_yaml(original_runtime.as_bytes())
+        .unwrap_or_else(|_| panic!("{project_name}: checked-in runtime is invalid"));
+
+    let temporary = tempfile::tempdir().expect("temporary project deployment");
+    let bundle_root = temporary.path().join("bundle");
+    fs::create_dir(&bundle_root).expect("temporary bundle root");
+    copy_tree(&project_root.join("bundle"), &bundle_root);
+
+    let secret_root = temporary.path().join("secrets");
+    fs::create_dir(&secret_root).expect("temporary secret root");
+    fs::set_permissions(&secret_root, fs::Permissions::from_mode(0o700))
+        .expect("temporary secret root is private");
+    let audit_path = temporary.path().join("audit.jsonl");
+    let ca_path = temporary.path().join("reference-ca.pem");
+    fs::write(&ca_path, TEST_CA).expect("temporary CA writes");
+
+    let mut local_runtime = original_runtime;
+    replace_once(
+        &mut local_runtime,
+        "/etc/registry-evidence/bundle",
+        &bundle_root.display().to_string(),
+    );
+    replace_once(
+        &mut local_runtime,
+        "/run/secrets/registry-evidence",
+        &secret_root.display().to_string(),
+    );
+    replace_once(
+        &mut local_runtime,
+        "/var/lib/registry-evidence/audit/evidence.jsonl",
+        &audit_path.display().to_string(),
+    );
+    if local_runtime.contains("/etc/registry-evidence/ca/government-internal.pem") {
+        replace_once(
+            &mut local_runtime,
+            "/etc/registry-evidence/ca/government-internal.pem",
+            &ca_path.display().to_string(),
+        );
+    }
+    let runtime_path = temporary.path().join("runtime.yaml");
+    fs::write(&runtime_path, local_runtime).expect("temporary runtime writes");
+    set_tree_mode(&bundle_root, 0o555, 0o444);
+    fs::set_permissions(&runtime_path, fs::Permissions::from_mode(0o444))
+        .expect("temporary runtime is immutable");
+    fs::set_permissions(&ca_path, fs::Permissions::from_mode(0o444))
+        .expect("temporary CA is immutable");
+
+    let deployment = DeploymentInputs::load(&runtime_path).unwrap_or_else(|error| {
+        panic!("{project_name}: production deployment loading failed: {error:?}")
+    });
+    let bundle = Arc::new(deployment.bundle);
+    let kernel = OfflineKernel::compile(Arc::clone(&bundle))
+        .unwrap_or_else(|_| panic!("{project_name}: production kernel compilation failed"));
+    LoadedProject {
+        _temporary: temporary,
+        runtime_path,
+        bundle,
+        kernel,
+    }
+}
+
+fn validate_contract_shape(project_name: &str, fixture: &FixtureContract) {
+    assert!(
+        fixture.synthetic_only,
+        "{project_name}: fixture is not synthetic"
+    );
+    assert!(
+        fixture.fixture.starts_with("registry.evidence.reference.")
+            && fixture.fixture.ends_with("/v1"),
+        "{project_name}: fixture identifier is invalid"
+    );
+    assert!(
+        !fixture.cases.is_empty() && fixture.cases.len() <= 256,
+        "{project_name}: fixture case count is invalid"
+    );
+    let mut ids = BTreeSet::new();
+    for case in &fixture.cases {
+        assert!(
+            !case.id.is_empty() && case.id.len() <= 128 && ids.insert(case.id.as_str()),
+            "{project_name}: fixture case identifier is invalid or duplicated"
+        );
+        let primary_inputs = [
+            case.response.is_some(),
+            case.source_failure.is_some(),
+            case.bundle_mutation.is_some(),
+            case.request_mutation.is_some(),
+            case.derivation_mutation.is_some(),
+            case.derivation_parameter_mutation.is_some(),
+            case.selector_overrides.is_some(),
+        ]
+        .into_iter()
+        .filter(|present| *present)
+        .count();
+        assert_eq!(
+            primary_inputs, 1,
+            "{project_name}/{}: case input form is not closed",
+            case.id
+        );
+        assert!(
+            !(case.expected.value.is_some() && case.expected.values.is_some()),
+            "{project_name}/{}: a case states either one concept value or the complete concept map",
+            case.id
+        );
+    }
+}
+
+async fn execute_fixture(
+    project_name: &str,
+    bundle: &Arc<Bundle>,
+    kernel: &OfflineKernel,
+    requirement: &registry_evidence::config::RequirementConfig,
+    fixture: &FixtureContract,
+    signer: &EvidenceSigner,
+) {
+    let execution = FixtureExecution {
+        bundle,
+        kernel,
+        requirement,
+        fixture,
+        signer,
+    };
+    let mut verified_payloads = Vec::new();
+    for case in &fixture.cases {
+        let label = format!("{project_name}/{}", case.id);
+        if let Some(mutation) = &case.bundle_mutation {
+            require_name(&label, mutation, "duplicate-disclosure-family");
+            execute_bundle_mutation(&label, bundle, requirement, &case.expected);
+            continue;
+        }
+        if let Some(mutation) = &case.request_mutation {
+            execute_request_mutation(&label, bundle, requirement, fixture, case, mutation);
+            continue;
+        }
+
+        let case_object = fixture_case_object(fixture, case);
+        let common_object = fixture_common_object(fixture);
+        let resolved = resolve_offline_fixture_authorization(
+            bundle,
+            requirement,
+            Some(&common_object),
+            &case_object,
+            AUDIENCE,
+        )
+        .unwrap_or_else(|_| panic!("{label}: authorization or selector resolution failed"));
+        let source = bundle
+            .config
+            .sources
+            .get(&requirement.source)
+            .unwrap_or_else(|| panic!("{label}: requirement source is absent"));
+        let preparation_selectors = selector_projection(&resolved, &source.request.selector_inputs)
+            .unwrap_or_else(|| panic!("{label}: preparation selector projection failed"));
+        let prepared = kernel
+            .prepare(&requirement.id, &preparation_selectors)
+            .unwrap_or_else(|_| panic!("{label}: request preparation failed"));
+        if case.selector_overrides.is_none() {
+            assert_request_parts(&label, &prepared, &fixture.common.expected_request_parts);
+        }
+        assert_transport(
+            &label,
+            source,
+            &prepared,
+            &fixture.common.expected_transport,
+        );
+        if let Some(expected) = &case.expected.expected_transport {
+            assert_transport(&label, source, &prepared, expected);
+        }
+        let derivation_selectors =
+            selector_projection(&resolved, &requirement.derivation.selector_inputs)
+                .unwrap_or_else(|| panic!("{label}: derivation selector projection failed"));
+        if case.selector_overrides.is_none() {
+            if let Some(expected) = &fixture.common.derivation_selector_inputs {
+                assert!(
+                    same_json(expected, &derivation_selectors),
+                    "{label}: minimized derivation selectors mismatch"
+                );
+            } else {
+                assert_eq!(
+                    derivation_selectors,
+                    Value::Object(JsonMap::new()),
+                    "{label}: derivation selectors were not minimized to empty"
+                );
+            }
+        }
+
+        if case.selector_overrides.is_some() {
+            assert_expected_count(&label, &case.expected, 1);
+            continue;
+        }
+        if let Some(failure) = &case.source_failure {
+            execute_source_failure(&label, failure, &case.expected);
+            continue;
+        }
+        let observed_at = observed_at(&label, fixture, case);
+        if let Some(mutation) = &case.derivation_mutation {
+            require_name(&label, mutation, "return-raw-reference");
+            execute_derivation_mutation(
+                &label,
+                &execution,
+                &derivation_selectors,
+                observed_at,
+                &case.expected,
+            );
+            continue;
+        }
+        if let Some(mutation) = &case.derivation_parameter_mutation {
+            execute_parameter_mutation(
+                &label,
+                &execution,
+                mutation,
+                &derivation_selectors,
+                observed_at,
+                &case.expected,
+            );
+            continue;
+        }
+
+        let response = case
+            .response
+            .as_ref()
+            .unwrap_or_else(|| panic!("{label}: response is absent"));
+        let projected = project_fixture_response(source, response)
+            .unwrap_or_else(|_| panic!("{label}: production source projection failed"));
+        let payload = execute_response(
+            &label,
+            &execution,
+            &resolved,
+            &derivation_selectors,
+            observed_at,
+            &projected,
+            &case.expected,
+        )
+        .await;
+        if let Some(payload) = payload {
+            verified_payloads.push(payload);
+        }
+    }
+    assert_privacy(
+        project_name,
+        &fixture.privacy_expectation,
+        &verified_payloads,
+    );
+}
+
+async fn execute_response(
+    label: &str,
+    execution: &FixtureExecution<'_>,
+    resolved: &ResolvedAuthorization,
+    derivation_selectors: &Value,
+    observed_at: DateTime<Utc>,
+    response: &Value,
+    expected: &Expected,
+) -> Option<Value> {
+    let bundle = execution.bundle;
+    let kernel = execution.kernel;
+    let requirement = execution.requirement;
+    let signer = execution.signer;
+    assert_expected_count(label, expected, 1);
+    let lookup = match kernel.extract(&requirement.id, response) {
+        Ok(lookup) => lookup,
+        Err(error) => {
+            assert_kernel_error(label, expected, error, false);
+            return None;
+        }
+    };
+    match lookup {
+        LookupResult::NoMatch => {
+            assert_lookup(label, expected, "no_match");
+            assert_derivation(label, expected, false);
+            assert_not_signed(label, expected);
+            assert_public_problem(label, expected, "evidence_not_available");
+            None
+        }
+        LookupResult::Ambiguous => {
+            assert_lookup(label, expected, "ambiguous");
+            assert_derivation(label, expected, false);
+            assert_not_signed(label, expected);
+            assert_public_problem(label, expected, "evidence_not_available");
+            None
+        }
+        LookupResult::Match(facts) => {
+            assert_lookup(label, expected, "match");
+            if let Some(expected_facts) = &expected.facts {
+                let actual = serde_json::to_value(&facts)
+                    .unwrap_or_else(|_| panic!("{label}: facts are not representable"));
+                assert!(
+                    same_json(expected_facts, &actual),
+                    "{label}: exact facts mismatch"
+                );
+            }
+            let values = match kernel.derive_and_validate_with_selectors(
+                &requirement.id,
+                &facts,
+                derivation_selectors,
+                observed_at,
+                ValueProjection {
+                    audience: AUDIENCE,
+                    binding_key: BINDING_KEY,
+                    binding_key_version: 1,
+                },
+            ) {
+                Ok(values) => values,
+                Err(error) => {
+                    assert_derivation(label, expected, true);
+                    assert_kernel_error(label, expected, error, true);
+                    return None;
+                }
+            };
+            assert_derivation(label, expected, true);
+            assert_values(label, expected, values.as_slice());
+
+            let issued_at = observed_at + chrono::Duration::seconds(1);
+            let subjects = resolved
+                .subjects
+                .iter()
+                .map(|subject| SubjectBinding {
+                    role: subject.role.clone(),
+                    binding: subject
+                        .binding(
+                            BINDING_KEY,
+                            1,
+                            &bundle.config.service.trust_domain,
+                            AUDIENCE,
+                            &resolved.purpose,
+                        )
+                        .unwrap_or_else(|_| panic!("{label}: subject binding failed")),
+                })
+                .collect();
+            let evidence_id = format!("urn:ulid:{}", ulid::Ulid::new());
+            let evidence = kernel
+                .construct_evidence(
+                    &requirement.id,
+                    values,
+                    EvidenceConstruction {
+                        evidence_id: &evidence_id,
+                        request_nonce: registry_evidence::model::OFFLINE_EVALUATION_REQUEST_NONCE,
+                        purpose: &resolved.purpose,
+                        audience: AUDIENCE,
+                        issued_at,
+                        observed_at,
+                        subjects,
+                    },
+                )
+                .unwrap_or_else(|_| panic!("{label}: evidence construction failed"));
+            let signed = signer
+                .sign_json(&evidence)
+                .await
+                .unwrap_or_else(|_| panic!("{label}: evidence signing failed"));
+            let jwks = jwks_document(signer.public_jwk(), [])
+                .unwrap_or_else(|_| panic!("{label}: fixture JWKS construction failed"));
+            let mut policy = EvidenceVerificationPolicy::from_accepted_transaction(
+                &evidence,
+                registry_evidence::model::OFFLINE_EVALUATION_REQUEST_NONCE,
+                Duration::from_secs(31_536_000),
+                issued_at,
+                Duration::from_secs(0),
+            );
+            policy.issued_by = bundle.config.issuer.id.clone();
+            policy.provided_by = bundle.config.service.provider_id.clone();
+            policy.requirement = requirement.id.clone();
+            policy.evidence_type = requirement.evidence_type.clone();
+            policy.purpose = resolved.purpose.clone();
+            policy.audience = AUDIENCE.to_owned();
+            policy.configuration_revision = bundle.revision().to_owned();
+            let verified = verify_flattened_jws(
+                &serde_json::to_vec(&signed)
+                    .unwrap_or_else(|_| panic!("{label}: signed evidence encoding failed")),
+                &jwks,
+                &policy,
+            )
+            .unwrap_or_else(|_| panic!("{label}: signed evidence verification failed"));
+            if expected.signed == Some(false) {
+                panic!("{label}: successful case prohibited signing");
+            }
+            Some(
+                serde_json::to_value(verified)
+                    .unwrap_or_else(|_| panic!("{label}: verified payload encoding failed")),
+            )
+        }
+    }
+}
+
+fn execute_bundle_mutation(
+    label: &str,
+    bundle: &Bundle,
+    requirement: &registry_evidence::config::RequirementConfig,
+    expected: &Expected,
+) {
+    assert_eq!(
+        expected.bundle.as_deref(),
+        Some("rejected"),
+        "{label}: bundle rejection expectation is absent"
+    );
+    let mut mutated = bundle.config.clone();
+    let mut companion = requirement.clone();
+    companion.id.push_str(":fixture-companion");
+    companion.evidence_type.push_str(":fixture-companion");
+    for concept in &mut companion.concepts {
+        concept.id.push_str(":fixture-companion");
+    }
+    mutated.requirements.push(companion);
+    assert_eq!(
+        mutated.validate(),
+        Err(ConfigError::Invalid(
+            "enabled requirements share a disclosure family"
+        )),
+        "{label}: unsafe disclosure-family mutation was not rejected"
+    );
+    assert_expected_count(label, expected, 0);
+    assert_not_signed(label, expected);
+}
+
+fn execute_request_mutation(
+    label: &str,
+    bundle: &Bundle,
+    requirement: &registry_evidence::config::RequirementConfig,
+    fixture: &FixtureContract,
+    case: &FixtureCase,
+    mutation: &str,
+) {
+    assert_eq!(
+        case.expected.rejected_before.as_deref(),
+        Some("source"),
+        "{label}: request mutation boundary is not exact"
+    );
+    let selectors = fixture
+        .common
+        .selectors
+        .as_object()
+        .unwrap_or_else(|| panic!("{label}: common selectors are invalid"));
+    let mut subjects = selectors
+        .iter()
+        .map(|(role, selector)| {
+            let mut selector = selector
+                .as_object()
+                .cloned()
+                .unwrap_or_else(|| panic!("{label}: common selector is invalid"));
+            selector.insert("role".to_owned(), Value::String(role.clone()));
+            Value::Object(selector)
+        })
+        .collect::<Vec<_>>();
+    match mutation {
+        "swap-subject-roles" => {
+            assert_eq!(subjects.len(), 2, "{label}: swap mutation needs two roles");
+            let first = subjects[0]["role"].clone();
+            subjects[0]["role"] = subjects[1]["role"].clone();
+            subjects[1]["role"] = first;
+        }
+        "supply-grant-derived-candidate" => {}
+        _ => panic!("{label}: request mutation name is not closed"),
+    }
+    let mut case_object = fixture_case_object(fixture, case);
+    case_object.insert("subjects".to_owned(), Value::Array(subjects));
+    let common_object = fixture_common_object(fixture);
+    assert!(
+        resolve_offline_fixture_authorization(
+            bundle,
+            requirement,
+            Some(&common_object),
+            &case_object,
+            AUDIENCE,
+        )
+        .is_err(),
+        "{label}: request mutation crossed the authorization boundary"
+    );
+    assert_expected_count(label, &case.expected, 0);
+    assert_not_signed(label, &case.expected);
+}
+
+fn execute_source_failure(label: &str, failure: &str, expected: &Expected) {
+    let source_error = match failure {
+        "timeout" => SourceError::Timeout,
+        "connection-refused" => SourceError::Transport,
+        "invalid-media-type" => SourceError::WrongMediaType,
+        "oversized" => SourceError::ResponseTooLarge,
+        "malformed-json" => SourceError::InvalidJson,
+        _ => panic!("{label}: source failure name is not closed"),
+    };
+    assert_eq!(
+        source_failure_problem(&source_error),
+        ProblemCode::DependencyUnavailable,
+        "{label}: source failure did not use the production safe mapping"
+    );
+    assert_eq!(
+        expected.public_problem.as_deref(),
+        Some("dependency_unavailable"),
+        "{label}: source failure public problem is not exact"
+    );
+    assert_expected_count(label, expected, 1);
+    assert_derivation(label, expected, false);
+    assert_not_signed(label, expected);
+}
+
+fn execute_derivation_mutation(
+    label: &str,
+    execution: &FixtureExecution<'_>,
+    selectors: &Value,
+    observed_at: DateTime<Utc>,
+    expected: &Expected,
+) {
+    let bundle = execution.bundle;
+    let requirement = execution.requirement;
+    let fixture = execution.fixture;
+    assert_eq!(
+        expected.output_gate.as_deref(),
+        Some("rejected"),
+        "{label}: output-gate expectation is absent"
+    );
+    let mut disposable = bundle.as_ref().clone();
+    disposable
+        .scripts
+        .get_mut(requirement.derivation.script.as_str())
+        .unwrap_or_else(|| panic!("{label}: derivation artifact is absent"))
+        .source = format!(
+        "fn derive(facts, selectors, evaluation_context) {{ [#{{concept_id: \"{}\", value: \"PERSON-SYNTHETIC-A\"}}] }}",
+        requirement.concepts[0].id
+    );
+    let disposable = Arc::new(disposable);
+    let kernel = OfflineKernel::compile(Arc::clone(&disposable))
+        .unwrap_or_else(|_| panic!("{label}: disposable derivation did not compile"));
+    let response = positive_response(label, fixture);
+    let source = disposable
+        .config
+        .sources
+        .get(&requirement.source)
+        .unwrap_or_else(|| panic!("{label}: source is absent"));
+    let projected = project_fixture_response(source, response)
+        .unwrap_or_else(|_| panic!("{label}: positive source projection failed"));
+    assert_eq!(
+        kernel.evaluate_with_selectors(
+            &requirement.id,
+            &projected,
+            selectors,
+            observed_at,
+            ValueProjection {
+                audience: AUDIENCE,
+                binding_key: BINDING_KEY,
+                binding_key_version: 1,
+            },
+        ),
+        Err(KernelError::Output),
+        "{label}: raw-reference derivation crossed the output gate"
+    );
+    assert_expected_count(label, expected, 1);
+    assert_not_signed(label, expected);
+}
+
+fn execute_parameter_mutation(
+    label: &str,
+    execution: &FixtureExecution<'_>,
+    mutation: &JsonMap<String, Value>,
+    selectors: &Value,
+    observed_at: DateTime<Utc>,
+    expected: &Expected,
+) {
+    let bundle = execution.bundle;
+    let requirement = execution.requirement;
+    let fixture = execution.fixture;
+    let mut disposable = bundle.as_ref().clone();
+    let mut config = serde_json::to_value(&disposable.config)
+        .unwrap_or_else(|_| panic!("{label}: config is not representable"));
+    let requirements = config["requirements"]
+        .as_array_mut()
+        .unwrap_or_else(|| panic!("{label}: requirement list is unavailable"));
+    let target = requirements
+        .iter_mut()
+        .find(|candidate| candidate["id"].as_str() == Some(requirement.id.as_str()))
+        .unwrap_or_else(|| panic!("{label}: disposable requirement is absent"));
+    let parameters = target["derivation"]["parameters"]
+        .as_object_mut()
+        .unwrap_or_else(|| panic!("{label}: derivation parameters are unavailable"));
+    for (name, value) in mutation {
+        assert!(
+            parameters.contains_key(name),
+            "{label}: parameter mutation introduced an unknown parameter"
+        );
+        parameters.insert(name.clone(), value.clone());
+    }
+    disposable.config = serde_json::from_value(config)
+        .unwrap_or_else(|_| panic!("{label}: parameter mutation is not typed"));
+    disposable
+        .config
+        .validate()
+        .unwrap_or_else(|_| panic!("{label}: parameter mutation broke startup validation"));
+    let disposable = Arc::new(disposable);
+    let kernel = OfflineKernel::compile(Arc::clone(&disposable))
+        .unwrap_or_else(|_| panic!("{label}: disposable kernel compilation failed"));
+    let source = disposable
+        .config
+        .sources
+        .get(&requirement.source)
+        .unwrap_or_else(|| panic!("{label}: source is absent"));
+    let projected = project_fixture_response(source, positive_response(label, fixture))
+        .unwrap_or_else(|_| panic!("{label}: positive source projection failed"));
+    let outcome = kernel.evaluate_with_selectors(
+        &requirement.id,
+        &projected,
+        selectors,
+        observed_at,
+        ValueProjection {
+            audience: AUDIENCE,
+            binding_key: BINDING_KEY,
+            binding_key_version: 1,
+        },
+    );
+    assert_kernel_error_result(label, expected, outcome, true);
+    assert_expected_count(label, expected, 1);
+}
+
+fn positive_response<'a>(label: &str, fixture: &'a FixtureContract) -> &'a Value {
+    fixture
+        .cases
+        .iter()
+        .find(|case| case.id == "positive")
+        .and_then(|case| case.response.as_ref())
+        .unwrap_or_else(|| panic!("{label}: positive companion response is absent"))
+}
+
+fn assert_kernel_error_result(
+    label: &str,
+    expected: &Expected,
+    outcome: Result<KernelOutcome, KernelError>,
+    derivation_ran: bool,
+) {
+    match outcome {
+        Err(error) => assert_kernel_error(label, expected, error, derivation_ran),
+        Ok(_) => panic!("{label}: expected failure returned a kernel outcome"),
+    }
+}
+
+fn assert_kernel_error(label: &str, expected: &Expected, error: KernelError, derivation_ran: bool) {
+    let (expected_signal, expected_problem) = match error {
+        KernelError::Preparation => ("adapter_input_error", "service_unavailable"),
+        KernelError::SourceProtocol => ("source_protocol_error", "dependency_unavailable"),
+        // The public class collapses with the unresolved lookup classes so a
+        // uniquely found record with inconsistent derivation inputs is not
+        // distinguishable from no match.
+        KernelError::DerivationInput => ("derivation_input_error", "evidence_not_available"),
+        KernelError::Script if derivation_ran => ("derivation_input_error", "service_unavailable"),
+        KernelError::Extraction => ("evidence_not_available", "evidence_not_available"),
+        _ => ("service_unavailable", "service_unavailable"),
+    };
+    if let Some(signal) = expected.error.as_deref() {
+        assert_eq!(
+            signal, expected_signal,
+            "{label}: internal error class mismatch"
+        );
+    }
+    if let Some(problem) = expected.public_problem.as_deref() {
+        assert_eq!(
+            problem, expected_problem,
+            "{label}: public problem mismatch"
+        );
+    }
+    if expected.error.is_none() && expected.public_problem.is_none() {
+        panic!("{label}: failing case has no exact error expectation");
+    }
+    assert_not_signed(label, expected);
+}
+
+fn assert_values(
+    label: &str,
+    expected: &Expected,
+    values: &[registry_evidence::model::SupportedValue],
+) {
+    if let Some(expected_value) = &expected.value {
+        assert_eq!(values.len(), 1, "{label}: scalar value count mismatch");
+        let actual = serde_json::to_value(&values[0].value)
+            .unwrap_or_else(|_| panic!("{label}: scalar value encoding failed"));
+        assert!(
+            same_json(expected_value, &actual),
+            "{label}: scalar value mismatch"
+        );
+    }
+    // A requirement disclosing more than one concept states every concept it
+    // discloses, so a new or leaked concept cannot pass unnoticed.
+    if let Some(expected_values) = &expected.values {
+        let expected_values = expected_values
+            .as_object()
+            .unwrap_or_else(|| panic!("{label}: expected concept map is not an object"));
+        assert_eq!(
+            values.len(),
+            expected_values.len(),
+            "{label}: concept value count mismatch"
+        );
+        for (concept_id, expected_value) in expected_values {
+            let value = values
+                .iter()
+                .find(|value| &value.provides_value_for == concept_id)
+                .unwrap_or_else(|| panic!("{label}: expected concept is absent"));
+            let actual = serde_json::to_value(&value.value)
+                .unwrap_or_else(|_| panic!("{label}: concept value encoding failed"));
+            assert!(
+                same_json(expected_value, &actual),
+                "{label}: concept value mismatch"
+            );
+        }
+    }
+    if let Some(expected_count) = expected.entity_reference_count {
+        assert_eq!(values.len(), 1, "{label}: reference concept count mismatch");
+        let actual_count = match &values[0].value {
+            PublicValue::List(items) => items
+                .iter()
+                .filter(|item| matches!(item, ScalarOrEntityReference::EntityReference(_)))
+                .count(),
+            _ => 0,
+        };
+        assert_eq!(
+            actual_count, expected_count,
+            "{label}: entity-reference count mismatch"
+        );
+    }
+    if let Some(disclosed) = expected.raw_references_disclosed {
+        let encoded = serde_json::to_string(values)
+            .unwrap_or_else(|_| panic!("{label}: supported value encoding failed"));
+        let actual = ["PERSON-SYNTHETIC-A", "PERSON-SYNTHETIC-B"]
+            .iter()
+            .any(|reference| encoded.contains(reference));
+        assert_eq!(
+            actual, disclosed,
+            "{label}: raw-reference disclosure expectation mismatch"
+        );
+    }
+}
+
+fn assert_request_parts(label: &str, actual: &RequestParts, expected: &ExpectedRequestParts) {
+    let expected_query = expected
+        .query
+        .iter()
+        .map(|pair| QueryPair {
+            name: pair.name.clone(),
+            value: pair.value.clone(),
+        })
+        .collect::<Vec<_>>();
+    assert_eq!(
+        actual.query, expected_query,
+        "{label}: request query mismatch"
+    );
+    assert!(
+        same_optional_json(expected.body.as_ref(), actual.body.as_ref()),
+        "{label}: request body mismatch"
+    );
+}
+
+fn assert_transport(
+    label: &str,
+    source: &registry_evidence::config::SourceConfig,
+    parts: &RequestParts,
+    expected: &ExpectedTransport,
+) {
+    if let Some(path) = &expected.path {
+        assert_eq!(
+            source.request.path.as_deref(),
+            Some(path.as_str()),
+            "{label}: fixed transport path mismatch"
+        );
+    }
+    if let Some(headers) = &expected.fixed_headers {
+        let actual = source
+            .request
+            .fixed_headers
+            .iter()
+            .map(|header| (header.name.as_str(), header.value.as_str()))
+            .collect::<Vec<_>>();
+        let expected = headers
+            .iter()
+            .map(|header| (header.name.as_str(), header.value.as_str()))
+            .collect::<Vec<_>>();
+        assert_eq!(
+            actual, expected,
+            "{label}: fixed transport headers mismatch"
+        );
+    }
+    if let Some(query) = &expected.query {
+        assert_eq!(
+            encode_query(&parts.query),
+            *query,
+            "{label}: encoded transport query mismatch"
+        );
+    }
+    if expected.body.is_some() {
+        assert!(
+            same_optional_json(expected.body.as_ref(), parts.body.as_ref()),
+            "{label}: normalized transport body mismatch"
+        );
+    }
+}
+
+fn encode_query(query: &[QueryPair]) -> String {
+    let mut encoded = String::new();
+    for pair in query {
+        if !encoded.is_empty() {
+            encoded.push('&');
+        }
+        encode_query_component(&pair.name, &mut encoded);
+        encoded.push('=');
+        encode_query_component(&pair.value, &mut encoded);
+    }
+    encoded
+}
+
+fn encode_query_component(value: &str, output: &mut String) {
+    const HEX: &[u8; 16] = b"0123456789ABCDEF";
+    for byte in value.bytes() {
+        if byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'.' | b'_' | b'~') {
+            output.push(char::from(byte));
+        } else {
+            output.push('%');
+            output.push(char::from(HEX[usize::from(byte >> 4)]));
+            output.push(char::from(HEX[usize::from(byte & 0x0f)]));
+        }
+    }
+}
+
+fn selector_projection(
+    resolved: &ResolvedAuthorization,
+    inputs: &[SelectorInput],
+) -> Option<Value> {
+    let mut output = JsonMap::new();
+    for input in inputs {
+        let subject = resolved
+            .subjects
+            .iter()
+            .find(|subject| subject.role == input.role)?;
+        let alternative = input
+            .alternatives
+            .iter()
+            .find(|alternative| alternative.profile == subject.selector_profile)?;
+        let mut values = JsonMap::new();
+        for name in &alternative.fields {
+            let field = subject.fields.iter().find(|field| &field.name == name)?;
+            values.insert(name.clone(), field.value.as_json());
+        }
+        output.insert(
+            input.role.clone(),
+            serde_json::json!({"profile": alternative.profile, "values": values}),
+        );
+    }
+    Some(Value::Object(output))
+}
+
+fn fixture_common_object(fixture: &FixtureContract) -> JsonMap<String, Value> {
+    let mut common = JsonMap::new();
+    common.insert("selectors".to_owned(), fixture.common.selectors.clone());
+    if let Some(purpose) = &fixture.common.purpose {
+        common.insert("purpose".to_owned(), Value::String(purpose.clone()));
+    }
+    if let Some(claims) = &fixture.common.verified_token_claims {
+        common.insert("verified_token_claims".to_owned(), claims.clone());
+    }
+    common
+}
+
+fn fixture_case_object(fixture: &FixtureContract, case: &FixtureCase) -> JsonMap<String, Value> {
+    let mut output = JsonMap::new();
+    if let Some(overrides) = &case.selector_overrides {
+        output.insert("selectorOverrides".to_owned(), overrides.clone());
+    }
+    if let Some(purpose) = &case.purpose {
+        output.insert("purpose".to_owned(), Value::String(purpose.clone()));
+    }
+    if let Some(claims) = &fixture.common.verified_token_claims {
+        output.insert("verified_token_claims".to_owned(), claims.clone());
+    }
+    output
+}
+
+fn observed_at(label: &str, fixture: &FixtureContract, case: &FixtureCase) -> DateTime<Utc> {
+    DateTime::parse_from_rfc3339(
+        case.observed_at
+            .as_deref()
+            .unwrap_or(&fixture.common.observed_at),
+    )
+    .map(|value| value.with_timezone(&Utc))
+    .unwrap_or_else(|_| panic!("{label}: observation instant is invalid"))
+}
+
+fn assert_lookup(label: &str, expected: &Expected, actual: &str) {
+    if let Some(expected) = expected.lookup.as_deref() {
+        assert_eq!(expected, actual, "{label}: lookup outcome mismatch");
+    }
+}
+
+fn assert_derivation(label: &str, expected: &Expected, actual: bool) {
+    if let Some(expected) = expected.derivation_runs {
+        assert_eq!(expected, actual, "{label}: derivation execution mismatch");
+    }
+}
+
+fn assert_not_signed(label: &str, expected: &Expected) {
+    if expected.signed == Some(true) {
+        panic!("{label}: unsuccessful case required a signature");
+    }
+}
+
+fn assert_public_problem(label: &str, expected: &Expected, actual: &str) {
+    if let Some(expected) = expected.public_problem.as_deref() {
+        assert_eq!(expected, actual, "{label}: public problem mismatch");
+    }
+}
+
+fn assert_expected_count(label: &str, expected: &Expected, actual: usize) {
+    if let Some(expected) = expected.source_request_count {
+        assert_eq!(expected, actual, "{label}: source request count mismatch");
+    }
+    assert!(
+        actual <= 1,
+        "{label}: fixture attempted multiple source requests"
+    );
+}
+
+fn assert_privacy(project_name: &str, expectation: &PrivacyExpectation, payloads: &[Value]) {
+    let projection = Value::Array(payloads.to_vec());
+    let mut strings = Vec::new();
+    collect_strings(&projection, &mut strings);
+    for required in &expectation.evidence_contains {
+        assert!(
+            strings.contains(&required.as_str()),
+            "{project_name}: required Evidence disclosure is absent"
+        );
+    }
+    for prohibited in &expectation.evidence_excludes {
+        assert!(
+            !strings.contains(&prohibited.as_str()),
+            "{project_name}: prohibited Evidence disclosure is present"
+        );
+    }
+    const DIAGNOSTIC_SURFACES: &[&str] = &[
+        "fixture vocabulary is not closed",
+        "authorization or selector resolution failed",
+        "request preparation failed",
+        "exact facts mismatch",
+        "scalar value mismatch",
+        "concept value mismatch",
+        "expected concept is absent",
+        "signed evidence verification failed",
+    ];
+    for prohibited in &expectation.diagnostics_exclude {
+        assert!(
+            DIAGNOSTIC_SURFACES
+                .iter()
+                .all(|surface| !surface.contains(prohibited)),
+            "{project_name}: protected value appears in a diagnostic template"
+        );
+    }
+}
+
+fn collect_strings<'a>(value: &'a Value, output: &mut Vec<&'a str>) {
+    match value {
+        Value::String(value) => output.push(value),
+        Value::Array(values) => {
+            for value in values {
+                collect_strings(value, output);
+            }
+        }
+        Value::Object(values) => {
+            for (key, value) in values {
+                output.push(key);
+                collect_strings(value, output);
+            }
+        }
+        _ => {}
+    }
+}
+
+fn same_json(left: &Value, right: &Value) -> bool {
+    serde_json::to_vec(left).ok() == serde_json::to_vec(right).ok()
+}
+
+fn same_optional_json(left: Option<&Value>, right: Option<&Value>) -> bool {
+    match (left, right) {
+        (None, None) => true,
+        (Some(left), Some(right)) => same_json(left, right),
+        _ => false,
+    }
+}
+
+fn require_name(label: &str, actual: &str, expected: &str) {
+    assert_eq!(actual, expected, "{label}: mutation name is not closed");
+}
+
+async fn fixture_signer() -> EvidenceSigner {
+    const KEY_ID: &str = "evidence-signing-2026-01";
+    let signing_key = SigningKey::generate(&mut OsRng);
+    let private_bytes = Zeroizing::new(signing_key.to_bytes());
+    let public_bytes = signing_key.verifying_key().to_bytes();
+    let private = PrivateJwk {
+        kty: "OKP".to_owned(),
+        kid: Some(KEY_ID.to_owned()),
+        alg: Some("EdDSA".to_owned()),
+        crv: Some("Ed25519".to_owned()),
+        d: Some(URL_SAFE_NO_PAD.encode(private_bytes.as_slice())),
+        x: Some(URL_SAFE_NO_PAD.encode(public_bytes)),
+        y: None,
+        n: None,
+        e: None,
+        p: None,
+        q: None,
+        dp: None,
+        dq: None,
+        qi: None,
+    };
+    let provider = Arc::new(LocalJwkSigner::new(private).expect("fixture signer builds"));
+    EvidenceSigner::initialize(provider, KEY_ID)
+        .await
+        .expect("fixture signer initializes")
+}
+
+fn projects_root() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("../../products/evidence/reference/request-adapter/deployment-projects")
+        .canonicalize()
+        .expect("reference deployment projects exist")
+}
+
+fn replace_once(text: &mut String, from: &str, to: &str) {
+    assert_eq!(
+        text.matches(from).count(),
+        1,
+        "runtime fixture binding drifted"
+    );
+    *text = text.replacen(from, to, 1);
+}
+
+fn copy_tree(source: &Path, target: &Path) {
+    for entry in fs::read_dir(source).expect("reference bundle is readable") {
+        let entry = entry.expect("reference bundle entry is readable");
+        let destination = target.join(entry.file_name());
+        if entry.file_type().expect("entry type is readable").is_dir() {
+            fs::create_dir(&destination).expect("reference bundle directory copies");
+            copy_tree(&entry.path(), &destination);
+        } else {
+            fs::copy(entry.path(), destination).expect("reference bundle file copies");
+        }
+    }
+}
+
+fn set_tree_mode(path: &Path, directory_mode: u32, file_mode: u32) {
+    if !path.exists() {
+        return;
+    }
+    if path.is_dir() {
+        fs::set_permissions(path, fs::Permissions::from_mode(directory_mode))
+            .expect("directory mode updates");
+        for entry in fs::read_dir(path).expect("mode target is readable") {
+            set_tree_mode(
+                &entry.expect("mode target entry is readable").path(),
+                directory_mode,
+                file_mode,
+            );
+        }
+    } else {
+        fs::set_permissions(path, fs::Permissions::from_mode(file_mode))
+            .expect("file mode updates");
+    }
+}
diff --git a/crates/registry-evidence/tests/live_sources.rs b/crates/registry-evidence/tests/live_sources.rs
new file mode 100644
index 000000000..1e1feb2b5
--- /dev/null
+++ b/crates/registry-evidence/tests/live_sources.rs
@@ -0,0 +1,761 @@
+//! Opt-in, ignored, read-only compatibility checks for approved public demos.
+//!
+//! Credentials and selectors are loaded only from exact owner-only files outside
+//! the repository. Errors and status output are deliberately value-free.
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    env,
+    fs::{self, File},
+    io::Read,
+    path::{Path, PathBuf},
+    time::{Duration, Instant},
+};
+
+use registry_platform_crypto::parse_json_strict;
+use reqwest::{header::CONTENT_TYPE, redirect::Policy, Client, Response, StatusCode, Url};
+use serde_json::{json, Value};
+use zeroize::Zeroizing;
+
+const MAX_CREDENTIAL_FILE_BYTES: u64 = 16 * 1024;
+const MAX_TOKEN_RESPONSE_BYTES: usize = 8 * 1024;
+const MAX_SOURCE_RESPONSE_BYTES: usize = 256 * 1024;
+const REQUEST_TIMEOUT: Duration = Duration::from_secs(10);
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum LiveError {
+    Skipped,
+    CredentialFile,
+    Configuration,
+    Authentication,
+    Unavailable,
+    SchemaDrift,
+    ExcessDisclosure,
+}
+
+#[tokio::test]
+#[ignore = "opt-in read-only public-demo check; requires EVIDENCE_DHIS2_LIVE_ENV_FILE"]
+async fn dhis2() {
+    run_live("dhis2", run_dhis2).await;
+}
+
+#[tokio::test]
+#[ignore = "opt-in read-only public-demo check; requires EVIDENCE_OPENCRVS_LIVE_ENV_FILE"]
+async fn opencrvs() {
+    run_live("opencrvs", run_opencrvs).await;
+}
+
+async fn run_live<F, Fut>(profile: &'static str, operation: F)
+where
+    F: FnOnce() -> Fut,
+    Fut: std::future::Future<Output = Result<(), LiveError>>,
+{
+    let started = Instant::now();
+    let result = operation().await;
+    let (phase, outcome) = match result {
+        Ok(()) => ("complete", "pass"),
+        Err(LiveError::Skipped) => ("configuration", "skip"),
+        Err(LiveError::CredentialFile | LiveError::Configuration) => {
+            ("configuration", "inconclusive")
+        }
+        Err(LiveError::Authentication) => ("authentication", "inconclusive"),
+        Err(LiveError::Unavailable) => ("lookup", "inconclusive"),
+        Err(LiveError::SchemaDrift) => ("lookup-schema", "fail"),
+        Err(LiveError::ExcessDisclosure) => ("lookup-minimization", "fail"),
+    };
+    eprintln!(
+        "live-source profile={profile} phase={phase} outcome={outcome} duration_ms={}",
+        started.elapsed().as_millis()
+    );
+    match result {
+        Ok(()) | Err(LiveError::Skipped) => {}
+        Err(LiveError::SchemaDrift | LiveError::ExcessDisclosure) => {
+            panic!("authenticated live source contract requires investigation")
+        }
+        Err(_) => {}
+    }
+}
+
+async fn run_dhis2() -> Result<(), LiveError> {
+    let path = credential_path("EVIDENCE_DHIS2_LIVE_ENV_FILE", None)?;
+    let config = read_exact_credentials(
+        &path,
+        &[
+            "DHIS2_BASE_URL",
+            "DHIS2_USERNAME",
+            "DHIS2_PASSWORD",
+            "DHIS2_TEST_PROGRAM_ID",
+            "DHIS2_TEST_ORG_UNIT_ID",
+            "DHIS2_TEST_TRACKED_ENTITY_ID",
+        ],
+    )?;
+    let base = safe_https_base(required(&config, "DHIS2_BASE_URL")?)?;
+    let client = live_client()?;
+
+    let metadata = base
+        .join("api/system/info?fields=version")
+        .map_err(|_| LiveError::Configuration)?;
+    let response = client
+        .get(metadata)
+        .basic_auth(
+            required(&config, "DHIS2_USERNAME")?,
+            Some(required(&config, "DHIS2_PASSWORD")?),
+        )
+        .send()
+        .await
+        .map_err(|_| LiveError::Unavailable)?;
+    require_success(response.status(), true)?;
+    require_json_media(&response, LiveError::SchemaDrift)?;
+    let metadata = bounded_body(response, MAX_SOURCE_RESPONSE_BYTES).await?;
+    let metadata = parse_json_strict(&metadata).map_err(|_| LiveError::SchemaDrift)?;
+    if metadata.get("version").and_then(Value::as_str).is_none() {
+        return Err(LiveError::SchemaDrift);
+    }
+
+    let lookup = base
+        .join("api/tracker/trackedEntities")
+        .map_err(|_| LiveError::Configuration)?;
+    let lookup_query = dhis2_lookup_query(&config)?;
+    let response = client
+        .get(lookup)
+        .basic_auth(
+            required(&config, "DHIS2_USERNAME")?,
+            Some(required(&config, "DHIS2_PASSWORD")?),
+        )
+        .query(&lookup_query)
+        .send()
+        .await
+        .map_err(|_| LiveError::Unavailable)?;
+    require_success(response.status(), false)?;
+    require_json_media(&response, LiveError::SchemaDrift)?;
+    let body = bounded_body(response, MAX_SOURCE_RESPONSE_BYTES).await?;
+    let body = parse_json_strict(&body).map_err(|_| LiveError::SchemaDrift)?;
+    validate_dhis2_lookup(&body, required(&config, "DHIS2_TEST_TRACKED_ENTITY_ID")?)
+}
+
+async fn run_opencrvs() -> Result<(), LiveError> {
+    let path = credential_path("EVIDENCE_OPENCRVS_LIVE_ENV_FILE", None)?;
+    let config = read_exact_credentials(
+        &path,
+        &[
+            "OPENCRVS_CLIENT_ID",
+            "OPENCRVS_SECRET",
+            "OPENCRVS_URL",
+            "OPENCRVS_TEST_TRACKING_ID",
+        ],
+    )?;
+    let (token_url, search_url) = opencrvs_urls(required(&config, "OPENCRVS_URL")?)?;
+    let client = live_client()?;
+
+    // Form-body placement mirrors the reviewed reference bundle and keeps the
+    // client credentials out of the token URL, where a proxy or ingress log
+    // would capture them.
+    let response = client
+        .post(token_url)
+        .form(&[
+            ("client_id", required(&config, "OPENCRVS_CLIENT_ID")?),
+            ("client_secret", required(&config, "OPENCRVS_SECRET")?),
+            ("grant_type", "client_credentials"),
+        ])
+        .send()
+        .await
+        .map_err(|_| LiveError::Unavailable)?;
+    require_success(response.status(), true)?;
+    require_json_media(&response, LiveError::Authentication)?;
+    let token_body = bounded_body(response, MAX_TOKEN_RESPONSE_BYTES).await?;
+    let token_body = parse_json_strict(&token_body).map_err(|_| LiveError::Authentication)?;
+    let mut token_object = token_body
+        .as_object()
+        .cloned()
+        .ok_or(LiveError::Authentication)?;
+    // This check must stay as strict as the product's own token parser in
+    // `source::parse_token_response`. A live check that accepts a response the
+    // product rejects reports a passing profile for a source Evidence cannot
+    // actually reach.
+    if !token_object.keys().all(|key| {
+        matches!(
+            key.as_str(),
+            "access_token" | "token_type" | "expires_in" | "scope"
+        )
+    }) {
+        return Err(LiveError::Authentication);
+    }
+    let token = token_object
+        .remove("access_token")
+        .and_then(|value| value.as_str().map(ToOwned::to_owned))
+        .filter(|value| !value.is_empty() && value.len() <= MAX_TOKEN_RESPONSE_BYTES)
+        .map(Zeroizing::new)
+        .ok_or(LiveError::Authentication)?;
+    // `token_type` is required by RFC 6749 section 5.1 and by the product.
+    if !token_object
+        .remove("token_type")
+        .and_then(|value| value.as_str().map(ToOwned::to_owned))
+        .is_some_and(|token_type| token_type.eq_ignore_ascii_case("bearer"))
+    {
+        return Err(LiveError::Authentication);
+    }
+    // `expires_in` is only recommended, so an absent lifetime is accepted here
+    // exactly as the product accepts it under a configured assumed lifetime.
+    // A present lifetime must still be a positive integer.
+    if token_object
+        .remove("expires_in")
+        .is_some_and(|value| value.as_u64().is_none_or(|seconds| seconds == 0))
+    {
+        return Err(LiveError::Authentication);
+    }
+    if token_object
+        .remove("scope")
+        .is_some_and(|value| value.as_str().is_none_or(str::is_empty))
+    {
+        return Err(LiveError::Authentication);
+    }
+
+    let tracking_id = required(&config, "OPENCRVS_TEST_TRACKING_ID")?;
+    let search_body = opencrvs_tracking_id_search(tracking_id);
+    let response = client
+        .post(search_url)
+        .bearer_auth(token.as_str())
+        .json(&search_body)
+        .send()
+        .await
+        .map_err(|_| LiveError::Unavailable)?;
+    require_success(response.status(), false)?;
+    require_json_media(&response, LiveError::SchemaDrift)?;
+    let body = bounded_body(response, MAX_SOURCE_RESPONSE_BYTES).await?;
+    let body = parse_json_strict(&body).map_err(|_| LiveError::SchemaDrift)?;
+    validate_opencrvs_search(&body, tracking_id)
+}
+
+fn dhis2_lookup_query(
+    config: &BTreeMap<String, Zeroizing<String>>,
+) -> Result<Vec<(&'static str, String)>, LiveError> {
+    Ok(vec![
+        (
+            "program",
+            required(config, "DHIS2_TEST_PROGRAM_ID")?.to_owned(),
+        ),
+        (
+            "orgUnits",
+            required(config, "DHIS2_TEST_ORG_UNIT_ID")?.to_owned(),
+        ),
+        (
+            "trackedEntities",
+            required(config, "DHIS2_TEST_TRACKED_ENTITY_ID")?.to_owned(),
+        ),
+        (
+            "fields",
+            "trackedEntity,attributes[attribute,value]".to_owned(),
+        ),
+        ("pageSize", "2".to_owned()),
+        ("page", "1".to_owned()),
+        ("totalPages", "true".to_owned()),
+    ])
+}
+
+fn validate_dhis2_lookup(body: &Value, expected_tracked_entity: &str) -> Result<(), LiveError> {
+    let object = body.as_object().ok_or(LiveError::SchemaDrift)?;
+    if !object
+        .keys()
+        .all(|key| matches!(key.as_str(), "pager" | "trackedEntities"))
+    {
+        return Err(LiveError::ExcessDisclosure);
+    }
+    let pager = object
+        .get("pager")
+        .and_then(Value::as_object)
+        .ok_or(LiveError::SchemaDrift)?;
+    if pager.get("page").and_then(Value::as_u64) != Some(1)
+        || pager.get("pageSize").and_then(Value::as_u64) != Some(2)
+        || !pager
+            .keys()
+            .all(|key| matches!(key.as_str(), "page" | "pageSize" | "total" | "pageCount"))
+    {
+        return Err(LiveError::SchemaDrift);
+    }
+    let records = object
+        .get("trackedEntities")
+        .and_then(Value::as_array)
+        .ok_or(LiveError::SchemaDrift)?;
+    if records.len() > 2 {
+        return Err(LiveError::ExcessDisclosure);
+    }
+    if records.len() != 1 {
+        return Err(LiveError::Unavailable);
+    }
+    let record = records[0].as_object().ok_or(LiveError::SchemaDrift)?;
+    if !record.contains_key("trackedEntity") || !record.contains_key("attributes") {
+        return Err(LiveError::SchemaDrift);
+    }
+    if !record
+        .keys()
+        .all(|key| matches!(key.as_str(), "trackedEntity" | "attributes"))
+    {
+        return Err(LiveError::ExcessDisclosure);
+    }
+    if record.get("trackedEntity").and_then(Value::as_str) != Some(expected_tracked_entity) {
+        return Err(LiveError::SchemaDrift);
+    }
+    let attributes = record
+        .get("attributes")
+        .and_then(Value::as_array)
+        .ok_or(LiveError::SchemaDrift)?;
+    if attributes.is_empty() {
+        return Err(LiveError::SchemaDrift);
+    }
+    for attribute in attributes {
+        let attribute = attribute.as_object().ok_or(LiveError::SchemaDrift)?;
+        if attribute.get("attribute").and_then(Value::as_str).is_none()
+            || attribute.get("value").and_then(Value::as_str).is_none()
+        {
+            return Err(LiveError::SchemaDrift);
+        }
+        if !attribute
+            .keys()
+            .all(|key| matches!(key.as_str(), "attribute" | "value"))
+        {
+            return Err(LiveError::ExcessDisclosure);
+        }
+    }
+    Ok(())
+}
+
+fn opencrvs_tracking_id_search(tracking_id: &str) -> Value {
+    json!({
+        "query": {
+            "type": "and",
+            "clauses": [{
+                "eventType": "birth",
+                "status": {"type": "exact", "term": "REGISTERED"},
+                "trackingId": {
+                    "type": "exact",
+                    "term": tracking_id
+                }
+            }]
+        },
+        "limit": 2,
+        "offset": 0
+    })
+}
+
+fn validate_opencrvs_search(body: &Value, expected_tracking_id: &str) -> Result<(), LiveError> {
+    let object = body.as_object().ok_or(LiveError::SchemaDrift)?;
+    let results = object
+        .get("results")
+        .and_then(Value::as_array)
+        .ok_or(LiveError::SchemaDrift)?;
+    let total = object
+        .get("total")
+        .and_then(Value::as_u64)
+        .ok_or(LiveError::SchemaDrift)?;
+    if results.len() > 2 {
+        return Err(LiveError::ExcessDisclosure);
+    }
+    if results.len() as u64 > total {
+        return Err(LiveError::SchemaDrift);
+    }
+    if total != 1 || results.len() != 1 {
+        return Err(LiveError::Unavailable);
+    }
+    let returned_tracking_id = results[0]
+        .get("trackingId")
+        .and_then(Value::as_str)
+        .ok_or(LiveError::SchemaDrift)?;
+    if returned_tracking_id != expected_tracking_id {
+        return Err(LiveError::SchemaDrift);
+    }
+    Ok(())
+}
+
+fn credential_path(variable: &str, default: Option<&str>) -> Result<PathBuf, LiveError> {
+    let value = env::var_os(variable)
+        .or_else(|| default.map(Into::into))
+        .ok_or(LiveError::Skipped)?;
+    let path = PathBuf::from(value);
+    if !path.exists() && default.is_some() && env::var_os(variable).is_none() {
+        return Err(LiveError::Skipped);
+    }
+    if !path.is_absolute() {
+        return Err(LiveError::CredentialFile);
+    }
+    Ok(path)
+}
+
+fn read_exact_credentials(
+    path: &Path,
+    required_keys: &[&str],
+) -> Result<BTreeMap<String, Zeroizing<String>>, LiveError> {
+    let repository = Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("../..")
+        .canonicalize()
+        .map_err(|_| LiveError::CredentialFile)?;
+    let canonical = path.canonicalize().map_err(|_| LiveError::CredentialFile)?;
+    if canonical.starts_with(&repository) {
+        return Err(LiveError::CredentialFile);
+    }
+    let file = open_owner_only(path)?;
+    let metadata = file.metadata().map_err(|_| LiveError::CredentialFile)?;
+    if metadata.len() == 0 || metadata.len() > MAX_CREDENTIAL_FILE_BYTES {
+        return Err(LiveError::CredentialFile);
+    }
+    let mut text = Zeroizing::new(String::new());
+    file.take(MAX_CREDENTIAL_FILE_BYTES + 1)
+        .read_to_string(&mut text)
+        .map_err(|_| LiveError::CredentialFile)?;
+    if text.len() as u64 != metadata.len() || text.contains('\0') {
+        return Err(LiveError::CredentialFile);
+    }
+
+    let allow = required_keys.iter().copied().collect::<BTreeSet<_>>();
+    let mut values = BTreeMap::new();
+    for line in text.lines() {
+        if line.is_empty() || line.trim() != line {
+            return Err(LiveError::CredentialFile);
+        }
+        let (key, value) = line.split_once('=').ok_or(LiveError::CredentialFile)?;
+        if !allow.contains(key)
+            || value.is_empty()
+            || value.len() > 16 * 1024
+            || values
+                .insert(key.to_owned(), Zeroizing::new(value.to_owned()))
+                .is_some()
+        {
+            return Err(LiveError::CredentialFile);
+        }
+    }
+    if values.len() != required_keys.len()
+        || required_keys.iter().any(|key| !values.contains_key(*key))
+    {
+        return Err(LiveError::CredentialFile);
+    }
+    Ok(values)
+}
+
+#[cfg(unix)]
+fn open_owner_only(path: &Path) -> Result<File, LiveError> {
+    use std::os::unix::fs::MetadataExt as _;
+
+    let metadata = fs::symlink_metadata(path).map_err(|_| LiveError::CredentialFile)?;
+    if !metadata.is_file() || metadata.file_type().is_symlink() || metadata.mode() & 0o777 != 0o600
+    {
+        return Err(LiveError::CredentialFile);
+    }
+    let fd = rustix::fs::open(
+        path,
+        rustix::fs::OFlags::RDONLY | rustix::fs::OFlags::CLOEXEC | rustix::fs::OFlags::NOFOLLOW,
+        rustix::fs::Mode::empty(),
+    )
+    .map_err(|_| LiveError::CredentialFile)?;
+    let file = File::from(fd);
+    let opened = file.metadata().map_err(|_| LiveError::CredentialFile)?;
+    if opened.dev() != metadata.dev()
+        || opened.ino() != metadata.ino()
+        || opened.uid() != rustix::process::getuid().as_raw()
+        || opened.uid() != metadata.uid()
+        || opened.mode() & 0o777 != 0o600
+        || opened.nlink() != 1
+    {
+        return Err(LiveError::CredentialFile);
+    }
+    Ok(file)
+}
+
+#[cfg(not(unix))]
+fn open_owner_only(_path: &Path) -> Result<File, LiveError> {
+    Err(LiveError::CredentialFile)
+}
+
+fn required<'a>(
+    config: &'a BTreeMap<String, Zeroizing<String>>,
+    key: &str,
+) -> Result<&'a str, LiveError> {
+    config
+        .get(key)
+        .map(|value| value.as_str())
+        .ok_or(LiveError::Configuration)
+}
+
+fn live_client() -> Result<Client, LiveError> {
+    Client::builder()
+        .no_proxy()
+        .redirect(Policy::none())
+        .connect_timeout(Duration::from_secs(5))
+        .timeout(REQUEST_TIMEOUT)
+        .user_agent("registry-evidence-live-source-check/1")
+        .build()
+        .map_err(|_| LiveError::Configuration)
+}
+
+fn require_json_media(response: &Response, failure: LiveError) -> Result<(), LiveError> {
+    let mut values = response.headers().get_all(CONTENT_TYPE).iter();
+    let value = values.next().ok_or(failure)?;
+    if values.next().is_some() {
+        return Err(failure);
+    }
+    let value = value.to_str().map_err(|_| failure)?;
+    let media_type = value.split(';').next().unwrap_or_default().trim();
+    if media_type.eq_ignore_ascii_case("application/json") {
+        Ok(())
+    } else {
+        Err(failure)
+    }
+}
+
+fn safe_https_base(value: &str) -> Result<Url, LiveError> {
+    let mut url = Url::parse(value).map_err(|_| LiveError::Configuration)?;
+    if url.scheme() != "https"
+        || url.host_str().is_none()
+        || !url.username().is_empty()
+        || url.password().is_some()
+        || url.query().is_some()
+        || url.fragment().is_some()
+    {
+        return Err(LiveError::Configuration);
+    }
+    url.set_query(None);
+    url.set_fragment(None);
+    if !url.path().ends_with('/') {
+        url.set_path(&format!("{}/", url.path()));
+    }
+    Ok(url)
+}
+
+fn opencrvs_urls(value: &str) -> Result<(Url, Url), LiveError> {
+    let normalized = if value.contains("://") {
+        value.to_owned()
+    } else {
+        format!("https://{value}")
+    };
+    let base = safe_https_base(&normalized)?;
+    if base.path() != "/" || base.port().is_some() {
+        return Err(LiveError::Configuration);
+    }
+    let host = base.host_str().ok_or(LiveError::Configuration)?;
+    let mut labels = host.split('.').collect::<Vec<_>>();
+    if labels.len() < 2 {
+        return Err(LiveError::Configuration);
+    }
+    if matches!(labels[0], "gateway" | "register" | "auth" | "events") {
+        labels.remove(0);
+    }
+    if labels.len() < 2 {
+        return Err(LiveError::Configuration);
+    }
+    let domain = labels.join(".");
+    let token = Url::parse(&format!("https://auth.{domain}/token"))
+        .map_err(|_| LiveError::Configuration)?;
+    let search = Url::parse(&format!("https://events.{domain}/events/search"))
+        .map_err(|_| LiveError::Configuration)?;
+    Ok((token, search))
+}
+
+fn require_success(status: StatusCode, authentication: bool) -> Result<(), LiveError> {
+    if status.is_success() {
+        Ok(())
+    } else if authentication && matches!(status.as_u16(), 400 | 401 | 403) {
+        Err(LiveError::Authentication)
+    } else {
+        Err(LiveError::Unavailable)
+    }
+}
+
+async fn bounded_body(mut response: Response, maximum: usize) -> Result<Vec<u8>, LiveError> {
+    if response
+        .content_length()
+        .is_some_and(|length| length > maximum as u64)
+    {
+        return Err(LiveError::ExcessDisclosure);
+    }
+    let mut output = Vec::new();
+    while let Some(chunk) = response.chunk().await.map_err(|_| LiveError::Unavailable)? {
+        if output.len().saturating_add(chunk.len()) > maximum {
+            return Err(LiveError::ExcessDisclosure);
+        }
+        output.extend_from_slice(&chunk);
+    }
+    Ok(output)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[cfg(unix)]
+    use std::os::unix::fs::PermissionsExt as _;
+
+    #[cfg(unix)]
+    #[test]
+    fn exact_file_parser_accepts_only_owner_only_external_files() {
+        let temporary = tempfile::tempdir().expect("external temporary directory");
+        let path = temporary.path().join("profile.env");
+        fs::write(&path, "A=one\nB=two\n").expect("fixture file writes");
+        fs::set_permissions(&path, fs::Permissions::from_mode(0o600)).expect("mode sets");
+        let parsed = read_exact_credentials(&path, &["A", "B"]).expect("exact file parses");
+        assert_eq!(parsed.len(), 2);
+        fs::set_permissions(&path, fs::Permissions::from_mode(0o640)).expect("mode sets");
+        assert_eq!(
+            read_exact_credentials(&path, &["A", "B"]),
+            Err(LiveError::CredentialFile)
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn parser_rejects_unknown_duplicate_empty_and_symlinked_inputs() {
+        let temporary = tempfile::tempdir().expect("external temporary directory");
+        for (name, contents) in [
+            ("unknown", "A=one\nC=two\n"),
+            ("duplicate", "A=one\nA=two\nB=three\n"),
+            ("empty", "A=\nB=two\n"),
+            ("shell", "A=$(command)\nB=two\nEXTRA=value\n"),
+        ] {
+            let path = temporary.path().join(name);
+            fs::write(&path, contents).expect("fixture file writes");
+            fs::set_permissions(&path, fs::Permissions::from_mode(0o600)).expect("mode sets");
+            assert_eq!(
+                read_exact_credentials(&path, &["A", "B"]),
+                Err(LiveError::CredentialFile)
+            );
+        }
+        let target = temporary.path().join("target");
+        let link = temporary.path().join("link");
+        fs::write(&target, "A=one\nB=two\n").expect("target writes");
+        fs::set_permissions(&target, fs::Permissions::from_mode(0o600)).expect("mode sets");
+        std::os::unix::fs::symlink(&target, &link).expect("symlink creates");
+        assert_eq!(
+            read_exact_credentials(&link, &["A", "B"]),
+            Err(LiveError::CredentialFile)
+        );
+    }
+
+    #[test]
+    fn service_urls_are_fixed_and_never_carry_credentials() {
+        let (token, search) = opencrvs_urls("https://register.example.test").expect("URL derives");
+        assert_eq!(token.as_str(), "https://auth.example.test/token");
+        assert_eq!(search.as_str(), "https://events.example.test/events/search");
+        let (token, search) = opencrvs_urls("example.test").expect("bare domain derives");
+        assert_eq!(token.as_str(), "https://auth.example.test/token");
+        assert_eq!(search.as_str(), "https://events.example.test/events/search");
+        assert!(opencrvs_urls("http://example.test").is_err());
+        assert!(safe_https_base("https://user:secret@example.test").is_err());
+    }
+
+    #[test]
+    fn dhis2_tracker_query_is_deployment_scoped_and_bounded() {
+        let config = BTreeMap::from([
+            (
+                "DHIS2_TEST_PROGRAM_ID".to_owned(),
+                Zeroizing::new("PROGRAM-CANARY".to_owned()),
+            ),
+            (
+                "DHIS2_TEST_ORG_UNIT_ID".to_owned(),
+                Zeroizing::new("ORG-UNIT-CANARY".to_owned()),
+            ),
+            (
+                "DHIS2_TEST_TRACKED_ENTITY_ID".to_owned(),
+                Zeroizing::new("TRACKED-ENTITY-CANARY".to_owned()),
+            ),
+        ]);
+        assert!(
+            dhis2_lookup_query(&config)
+                == Ok(vec![
+                    ("program", "PROGRAM-CANARY".to_owned()),
+                    ("orgUnits", "ORG-UNIT-CANARY".to_owned()),
+                    ("trackedEntities", "TRACKED-ENTITY-CANARY".to_owned()),
+                    (
+                        "fields",
+                        "trackedEntity,attributes[attribute,value]".to_owned(),
+                    ),
+                    ("pageSize", "2".to_owned()),
+                    ("page", "1".to_owned()),
+                    ("totalPages", "true".to_owned()),
+                ]),
+            "DHIS2 lookup query did not match the fixed bounded shape"
+        );
+        assert_eq!(
+            validate_dhis2_lookup(
+                &json!({
+                    "pager": {"page": 1, "pageSize": 2},
+                    "trackedEntities": [{
+                        "trackedEntity": "TRACKED-ENTITY-CANARY",
+                        "attributes": [{"attribute": "ATTRIBUTE-CANARY", "value": "VALUE-CANARY"}]
+                    }]
+                }),
+                "TRACKED-ENTITY-CANARY"
+            ),
+            Ok(())
+        );
+        assert_eq!(
+            validate_dhis2_lookup(
+                &json!({"pager": {"page": 1, "pageSize": 2}, "trackedEntities": []}),
+                "TRACKED-ENTITY-CANARY"
+            ),
+            Err(LiveError::Unavailable)
+        );
+        assert_eq!(
+            validate_dhis2_lookup(
+                &json!({"pager": {"page": 1, "pageSize": 2}, "trackedEntities": [{}, {}, {}]}),
+                "TRACKED-ENTITY-CANARY"
+            ),
+            Err(LiveError::ExcessDisclosure)
+        );
+        assert_eq!(
+            validate_dhis2_lookup(
+                &json!({
+                    "pager": {"page": 1, "pageSize": 2},
+                    "trackedEntities": [{
+                        "trackedEntity": "WRONG-ENTITY",
+                        "attributes": [{"attribute": "ATTRIBUTE-CANARY", "value": "VALUE-CANARY"}]
+                    }]
+                }),
+                "TRACKED-ENTITY-CANARY"
+            ),
+            Err(LiveError::SchemaDrift)
+        );
+    }
+
+    #[test]
+    fn opencrvs_tracking_id_search_is_exact_and_bounded() {
+        let selector = "TRACKING-CANARY";
+        assert!(
+            opencrvs_tracking_id_search(selector)
+                == json!({
+                    "query": {
+                        "type": "and",
+                        "clauses": [{
+                            "eventType": "birth",
+                            "status": {"type": "exact", "term": "REGISTERED"},
+                            "trackingId": {
+                                "type": "exact",
+                                "term": selector
+                            }
+                        }]
+                    },
+                    "limit": 2,
+                    "offset": 0
+                }),
+            "OpenCRVS search body did not match the fixed bounded shape"
+        );
+        let exact = json!({
+            "results": [{
+                "trackingId": selector
+            }],
+            "total": 1
+        });
+        assert_eq!(validate_opencrvs_search(&exact, selector), Ok(()));
+        assert_eq!(
+            validate_opencrvs_search(
+                &json!({"results": [{"trackingId": "WRONG-TRACKING-CANARY"}], "total": 1}),
+                selector
+            ),
+            Err(LiveError::SchemaDrift)
+        );
+        assert_eq!(
+            validate_opencrvs_search(&json!({"results": [], "total": 0}), selector),
+            Err(LiveError::Unavailable)
+        );
+        assert_eq!(
+            validate_opencrvs_search(&json!({"results": [{}, {}, {}], "total": 3}), selector),
+            Err(LiveError::ExcessDisclosure)
+        );
+    }
+}
diff --git a/crates/registry-evidence/tests/relay_shaped_source.rs b/crates/registry-evidence/tests/relay_shaped_source.rs
new file mode 100644
index 000000000..2df7e8ae5
--- /dev/null
+++ b/crates/registry-evidence/tests/relay_shaped_source.rs
@@ -0,0 +1,581 @@
+//! Evidence-over-Relay composition: one full signed Evidence assertion is
+//! evaluated over a mock HTTP source whose wire shape mirrors a Registry
+//! Relay protected read API, authenticated with OAuth client credentials.
+//!
+//! The mock mirrors the Relay wire shape by hand: the templated protected
+//! read path and the minimal single-record JSON response body of
+//! `GET /v1/datasets/{dataset_id}/entities/{entity}/records/{id}` in
+//! `crates/registry-relay/openapi/registry-relay.openapi.json`. Evidence
+//! proves the composition without importing or depending on any Relay code,
+//! per the Evidence product boundary rules, so no Relay crate, type, or
+//! fixture appears here and the record content stays synthetic and
+//! domain-neutral.
+
+#![cfg(unix)]
+
+use std::collections::BTreeMap;
+use std::fs;
+use std::os::unix::fs::PermissionsExt as _;
+use std::path::Path;
+use std::sync::Arc;
+use std::time::Duration;
+
+use base64::engine::general_purpose::URL_SAFE_NO_PAD;
+use base64::Engine as _;
+use ed25519_dalek::SigningKey;
+use rand_core::OsRng;
+use registry_evidence::bundle::Bundle;
+use registry_evidence::config::{PreparationChannelPolicy, PreparationLimits, SourceConfig};
+use registry_evidence::kernel::{EvidenceConstruction, OfflineKernel, ValueProjection};
+use registry_evidence::model::{LookupResult, PublicValue, SelectorValue, SubjectBinding};
+use registry_evidence::rhai_runtime::{
+    RequestPartRequirement, RequestPartsBounds, RequestPartsLimits, RhaiRuntime,
+    MAXIMUM_ARRAY_ITEMS, MAXIMUM_JSON_BODY_DEPTH, MAXIMUM_QUERY_NAME_BYTES, MAXIMUM_QUERY_PAIRS,
+    MAXIMUM_QUERY_VALUE_BYTES, MAXIMUM_REQUEST_PARTS_BYTES, MAXIMUM_STRING_BYTES,
+};
+use registry_evidence::secrets::{SecretProvider, SecretResolver};
+use registry_evidence::signing::{jwks_document, EvidenceSigner};
+use registry_evidence::source::{ResolvedSourceSelector, SourceExecutor};
+use registry_evidence::verifier::{verify_flattened_jws, EvidenceVerificationPolicy};
+use registry_platform_crypto::{LocalJwkSigner, PrivateJwk};
+use serde_json::json;
+use tempfile::TempDir;
+use wiremock::matchers::{body_string_contains, header, method, path};
+use wiremock::{Mock, MockServer, ResponseTemplate};
+use zeroize::Zeroizing;
+
+/// The Relay-shaped protected read for one synthetic record: the templated
+/// `/v1/datasets/{dataset_id}/entities/{entity}/records/{id}` path with
+/// domain-neutral dataset and entity segments and the subject's record key.
+const RECORD_PATH: &str = "/v1/datasets/synthetic-units/entities/unit-record/records/REC-0001";
+/// Relay requires a `Data-Purpose` header on entity record reads; the
+/// deployment pins it as a reviewed fixed header.
+const DATA_PURPOSE: &str = "https://relying.invalid/purpose/fixture-routing";
+/// Raw record material from the mirrored Relay response body. None of it may
+/// reach the signed assertion payload.
+const RAW_FIELD_NAME_CANARY: &str = "area_geometry";
+const RAW_FIELD_VALUE_CANARY: &str = "SYNTHETIC-AREA-GEOMETRY-CANARY";
+const RECORD_KEY: &str = "REC-0001";
+const RAW_REGION_CODE: &str = "R-101";
+
+const AUDIENCE: &str = "https://relying.invalid/residence-procedure";
+const BINDING_KEY: &[u8] = b"relay-composition-binding-key-32-bytes-minimum";
+const REQUIREMENT: &str = "urn:example:fixture:requirement:residence-region:v1";
+
+/// The reviewed bounded request preparation: the Relay read is a completely
+/// fixed request, so both dynamic channels stay empty.
+const PREPARE_SCRIPT: &str = "fn prepare(selectors, parameters) { #{query: [], body: ()} }";
+
+/// The reviewed extraction over the Rust-projected response: only the
+/// projected `region` field is visible here, and it becomes the one declared
+/// fact for the residence-region acceptance derivation.
+const EXTRACT_SCRIPT: &str = r#"
+fn extract(source_response, parameters) {
+    let region_code = get_path(source_response, "/region");
+    if is_missing(region_code) { return #{outcome: "no_match"}; }
+    #{outcome: "match", facts: #{official_residence_code: region_code}}
+}
+"#;
+
+/// An Evidence source declared the way a deployment bundle would declare it:
+/// oauth2-client-credentials against the mock token endpoint and a fixed GET
+/// against the Relay-shaped record path.
+fn relay_shaped_source(base_url: &str, token_endpoint: &str) -> SourceConfig {
+    serde_json::from_value(json!({
+        "transport": "http-json",
+        "baseUrl": base_url,
+        "posture": "field-projected",
+        "authentication": {
+            "kind": "oauth2-client-credentials",
+            "tokenEndpoint": token_endpoint,
+            "clientIdRef": "secret:file/relay-client-id",
+            "clientSecretRef": "secret:file/relay-client-secret",
+            "scope": "registry.read",
+            "credentialPlacement": "form-body",
+            "maximumCacheSeconds": 60
+        },
+        "request": {
+            "method": "GET",
+            "pathTemplate": "/v1/datasets/synthetic-units/entities/unit-record/records/{record}",
+            "pathBindings": {
+                "record": {
+                    "role": "subject",
+                    "profile": "residence-record-v1",
+                    "field": "record_reference"
+                }
+            },
+            "fixedHeaders": [
+                {"name": "Accept", "value": "application/json"},
+                {"name": "Data-Purpose", "value": DATA_PURPOSE}
+            ],
+            "selectorInputs": [{
+                "role": "subject",
+                "alternatives": [
+                    {"profile": "residence-record-v1", "fields": ["record_reference"]}
+                ]
+            }],
+            "prepareScript": "adapters/prepare.rhai",
+            "adapterParameters": {},
+            "adapterParametersSchema": "schemas/parameters.schema.yaml",
+            "preparationLimits": {"query": "forbidden", "jsonBody": "forbidden"},
+            "projection": ["/region"],
+            "redirects": "deny",
+            "timeoutMilliseconds": 1000,
+            "maximumResponseBytes": 65536,
+            "concurrencyLimit": 4
+        },
+        "responseSchema": "schemas/response.schema.yaml",
+        "extractScript": "adapters/extract.rhai",
+        "factSchema": "schemas/facts.schema.yaml"
+    }))
+    .expect("Relay-shaped source config deserializes")
+}
+
+fn resolver(entries: &[(&str, &str)]) -> (TempDir, Arc<SecretResolver>) {
+    let root = tempfile::tempdir().expect("temporary secret root");
+    for (name, value) in entries {
+        let path = root.path().join(name);
+        fs::write(&path, value).expect("write synthetic secret");
+        fs::set_permissions(path, fs::Permissions::from_mode(0o600)).expect("protect secret");
+    }
+    let resolver = SecretResolver::new([SecretProvider::File], root.path())
+        .map(Arc::new)
+        .expect("resolver builds");
+    (root, resolver)
+}
+
+fn request_limits(config: &PreparationLimits) -> RequestPartsLimits {
+    fn channel(policy: PreparationChannelPolicy) -> RequestPartRequirement {
+        match policy {
+            PreparationChannelPolicy::Required => RequestPartRequirement::Required,
+            PreparationChannelPolicy::Allowed => RequestPartRequirement::Optional,
+            PreparationChannelPolicy::Forbidden => RequestPartRequirement::Forbidden,
+        }
+    }
+
+    fn configured(value: Option<u64>, fallback: usize) -> usize {
+        value
+            .map(|value| usize::try_from(value).expect("configured limit fits usize"))
+            .unwrap_or(fallback)
+    }
+
+    RequestPartsLimits::new(
+        channel(config.query),
+        channel(config.json_body),
+        RequestPartsBounds {
+            maximum_query_pairs: configured(config.maximum_query_pairs, MAXIMUM_QUERY_PAIRS),
+            maximum_query_name_bytes: configured(
+                config.maximum_query_name_bytes,
+                MAXIMUM_QUERY_NAME_BYTES,
+            ),
+            maximum_query_value_bytes: configured(
+                config.maximum_query_value_bytes,
+                MAXIMUM_QUERY_VALUE_BYTES,
+            ),
+            maximum_json_depth: configured(config.maximum_json_depth, MAXIMUM_JSON_BODY_DEPTH),
+            maximum_collection_items: configured(
+                config.maximum_collection_items,
+                MAXIMUM_ARRAY_ITEMS,
+            ),
+            maximum_string_bytes: configured(config.maximum_string_bytes, MAXIMUM_STRING_BYTES),
+            maximum_normalized_bytes: configured(
+                config.maximum_normalized_bytes,
+                MAXIMUM_REQUEST_PARTS_BYTES,
+            ),
+        },
+    )
+    .expect("fixture preparation limits satisfy the production ABI")
+}
+
+fn encoded_parameters(bytes: &[u8]) -> Vec<(String, String)> {
+    url::form_urlencoded::parse(bytes)
+        .map(|(name, value)| (name.into_owned(), value.into_owned()))
+        .collect()
+}
+
+fn contains_parameter(parameters: &[(String, String)], name: &str, value: &str) -> bool {
+    parameters
+        .iter()
+        .any(|(actual_name, actual_value)| actual_name == name && actual_value == value)
+}
+
+fn copy_fixture_tree(source: &Path, target: &Path) {
+    fs::create_dir(target).expect("fixture directory is copied");
+    for entry in fs::read_dir(source).expect("fixture directory is readable") {
+        let entry = entry.expect("fixture entry is readable");
+        let destination = target.join(entry.file_name());
+        if entry
+            .file_type()
+            .expect("fixture entry type is readable")
+            .is_dir()
+        {
+            copy_fixture_tree(&entry.path(), &destination);
+        } else {
+            fs::copy(entry.path(), destination).expect("fixture file is copied");
+        }
+    }
+}
+
+fn make_fixture_bundle_read_only(path: &Path) {
+    for entry in fs::read_dir(path).expect("fixture bundle is readable") {
+        let entry = entry.expect("fixture bundle entry is readable");
+        let child = entry.path();
+        if entry
+            .file_type()
+            .expect("fixture bundle entry type is readable")
+            .is_dir()
+        {
+            make_fixture_bundle_read_only(&child);
+        } else {
+            fs::set_permissions(child, fs::Permissions::from_mode(0o444))
+                .expect("fixture bundle file becomes read-only");
+        }
+    }
+    fs::set_permissions(path, fs::Permissions::from_mode(0o555))
+        .expect("fixture bundle directory becomes read-only");
+}
+
+async fn fixture_signer() -> EvidenceSigner {
+    const KEY_ID: &str = "relay-composition-evidence-key";
+    let signing_key = SigningKey::generate(&mut OsRng);
+    let private_bytes = Zeroizing::new(signing_key.to_bytes());
+    let public_bytes = signing_key.verifying_key().to_bytes();
+    let private = PrivateJwk {
+        kty: "OKP".to_owned(),
+        kid: Some(KEY_ID.to_owned()),
+        alg: Some("EdDSA".to_owned()),
+        crv: Some("Ed25519".to_owned()),
+        d: Some(URL_SAFE_NO_PAD.encode(private_bytes.as_slice())),
+        x: Some(URL_SAFE_NO_PAD.encode(public_bytes)),
+        y: None,
+        n: None,
+        e: None,
+        p: None,
+        q: None,
+        dp: None,
+        dq: None,
+        qi: None,
+    };
+    let provider = Arc::new(LocalJwkSigner::new(private).expect("fixture signer builds"));
+    EvidenceSigner::initialize(provider, KEY_ID)
+        .await
+        .expect("fixture signer initializes")
+}
+
+#[tokio::test]
+async fn a_relay_shaped_protected_read_backs_a_full_signed_minimum_disclosure_assertion() {
+    // A mock OAuth token endpoint stands in for the Relay deployment's
+    // authorization server: it only answers a client-credentials grant and
+    // issues one fresh bearer token.
+    let token_server = MockServer::start().await;
+    let records_server = MockServer::start().await;
+    let client_id = format!("client-id-{}", ulid::Ulid::new());
+    let client_secret = format!("client-secret-{}", ulid::Ulid::new());
+    let access_token = format!("access-token-{}", ulid::Ulid::new());
+    Mock::given(method("POST"))
+        .and(path("/oauth/token"))
+        .and(body_string_contains("grant_type=client_credentials"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "access_token": access_token.clone(),
+            "token_type": "Bearer",
+            "expires_in": 120,
+            "scope": "registry.read"
+        })))
+        .expect(1)
+        .mount(&token_server)
+        .await;
+
+    // The record endpoint mirrors the Relay wire shape by hand (hardcoded
+    // JSON, no Relay code): the single-record body follows the OpenAPI entity
+    // example shape of `id`, one codelist field, and one extra raw field.
+    // Only a request carrying the exact issued bearer, the pinned Accept
+    // header, and Relay's required Data-Purpose header is answered.
+    Mock::given(method("GET"))
+        .and(path(RECORD_PATH))
+        .and(header("authorization", format!("Bearer {access_token}")))
+        .and(header("accept", "application/json"))
+        .and(header("data-purpose", DATA_PURPOSE))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "id": RECORD_KEY,
+            "region": RAW_REGION_CODE,
+            "area_geometry": RAW_FIELD_VALUE_CANARY
+        })))
+        .with_priority(1)
+        .expect(1)
+        .mount(&records_server)
+        .await;
+    // Any request that misses the exact bearer is rejected the way a Relay
+    // deployment rejects it, and must never happen.
+    Mock::given(method("GET"))
+        .and(path(RECORD_PATH))
+        .respond_with(ResponseTemplate::new(401).set_body_raw(
+            r#"{"type":"about:blank","title":"Unauthorized","status":401}"#,
+            "application/problem+json",
+        ))
+        .with_priority(10)
+        .expect(0)
+        .mount(&records_server)
+        .await;
+
+    // Deployment-shaped inputs: file-provider secrets and the declared source.
+    let (_secret_root, secrets) = resolver(&[
+        ("relay-client-id", client_id.as_str()),
+        ("relay-client-secret", client_secret.as_str()),
+    ]);
+    let source = relay_shaped_source(
+        &records_server.uri(),
+        &format!("{}/oauth/token", token_server.uri()),
+    );
+
+    // Bounded request preparation through the production Rhai runtime.
+    let runtime = RhaiRuntime::new();
+    let preparation = runtime
+        .compile_preparation(PREPARE_SCRIPT)
+        .expect("preparation script compiles");
+    let extraction = runtime
+        .compile_extraction(EXTRACT_SCRIPT)
+        .expect("extraction script compiles");
+    let parameters = serde_json::to_value(&source.request.adapter_parameters)
+        .expect("adapter parameters serialize");
+    let script_selectors = json!({
+        "subject": {
+            "profile": "residence-record-v1",
+            "values": {"record_reference": RECORD_KEY}
+        }
+    });
+    let prepared = runtime
+        .prepare(
+            &preparation,
+            &script_selectors,
+            &parameters,
+            &request_limits(&source.request.preparation_limits),
+        )
+        .expect("fixed Relay read preparation succeeds");
+
+    // Production transport materialization pins the exact Relay-shaped read.
+    let transport_selectors = vec![ResolvedSourceSelector {
+        role: "subject".into(),
+        profile: "residence-record-v1".into(),
+        values: BTreeMap::from([(
+            "record_reference".into(),
+            SelectorValue::String(RECORD_KEY.into()),
+        )]),
+    }];
+    let executor = SourceExecutor::new(&source, secrets).expect("Relay-shaped source compiles");
+    let materialized = executor
+        .materialize_request(&transport_selectors, &prepared)
+        .expect("Relay-shaped request materializes");
+    assert_eq!(materialized.path(), RECORD_PATH);
+    assert_eq!(materialized.query(), None);
+    assert_eq!(materialized.body(), None);
+
+    // One end-to-end source execution: token acquisition, the authenticated
+    // record read, and the Rust projection boundary.
+    let projected = executor
+        .execute(&transport_selectors, &prepared)
+        .await
+        .expect("Relay-shaped source read succeeds");
+    assert_eq!(projected, json!({"region": RAW_REGION_CODE}));
+    let projected_text = serde_json::to_string(&projected).expect("projected response serializes");
+    for stripped in [RAW_FIELD_NAME_CANARY, RAW_FIELD_VALUE_CANARY, RECORD_KEY] {
+        assert!(
+            !projected_text.contains(stripped),
+            "projection let raw record material past the source boundary"
+        );
+    }
+    let response_schema = jsonschema::JSONSchema::compile(&json!({
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["region"],
+        "properties": {"region": {"type": "string", "minLength": 1, "maxLength": 32}}
+    }))
+    .expect("response schema compiles");
+    assert!(
+        response_schema.is_valid(&projected),
+        "projected Relay-shaped response is outside the declared response schema"
+    );
+
+    // Reviewed extraction produces exactly the one declared fact.
+    let fact_schema = jsonschema::JSONSchema::compile(&json!({
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["official_residence_code"],
+        "properties": {
+            "official_residence_code": {"type": "string", "minLength": 1, "maxLength": 32}
+        }
+    }))
+    .expect("fact schema compiles");
+    let facts = match runtime
+        .extract(&extraction, &projected, &parameters, &fact_schema)
+        .expect("Relay-shaped response extracts")
+    {
+        LookupResult::Match(facts) => facts,
+        _ => panic!("Relay-shaped match returned a non-match outcome"),
+    };
+    assert_eq!(
+        serde_json::to_value(&facts).expect("facts serialize"),
+        json!({"official_residence_code": RAW_REGION_CODE})
+    );
+
+    // The immutable residence-region acceptance bundle finishes the full
+    // path: real derivation, output gate, Evidence construction, signing,
+    // and verification against the deployment's public JWKS.
+    let acceptance_copy = tempfile::tempdir().expect("temporary acceptance bundle root");
+    let acceptance_root = acceptance_copy.path().join("residence-region");
+    copy_fixture_tree(
+        &Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("../../products/evidence/fixtures/acceptance/residence-region"),
+        &acceptance_root,
+    );
+    make_fixture_bundle_read_only(&acceptance_root);
+    let kernel = OfflineKernel::compile(Arc::new(
+        Bundle::load(&acceptance_root).expect("immutable residence acceptance bundle loads"),
+    ))
+    .expect("residence acceptance kernel compiles");
+    let observed_at = "2026-08-02T00:00:00Z"
+        .parse()
+        .expect("fixed observation time parses");
+    let values = kernel
+        .derive_and_validate(
+            REQUIREMENT,
+            &facts,
+            observed_at,
+            ValueProjection {
+                audience: AUDIENCE,
+                binding_key: BINDING_KEY,
+                binding_key_version: 1,
+            },
+        )
+        .expect("residence derivation and immutable output gate succeed");
+    assert_eq!(values.as_slice().len(), 1);
+    assert_eq!(
+        values.as_slice()[0].provides_value_for,
+        "urn:example:fixture:concept:residence-region"
+    );
+    assert_eq!(
+        values.as_slice()[0].value,
+        PublicValue::String("REGION-NORTH".to_owned())
+    );
+    let evidence = kernel
+        .construct_evidence(
+            REQUIREMENT,
+            values,
+            EvidenceConstruction {
+                evidence_id: "urn:ulid:01J4BRXQ0ZZZZZZZZZZZZZZZZZ",
+                request_nonce: registry_evidence::model::OFFLINE_EVALUATION_REQUEST_NONCE,
+                purpose: "fixture-routing",
+                audience: AUDIENCE,
+                issued_at: observed_at,
+                observed_at,
+                subjects: vec![SubjectBinding {
+                    role: "subject".to_owned(),
+                    binding: format!("urn:evidence:subject:v1_{}", "A".repeat(43)),
+                }],
+            },
+        )
+        .expect("residence Evidence constructs");
+    let signer = fixture_signer().await;
+    let jws = signer
+        .sign_json(&evidence)
+        .await
+        .expect("residence Evidence signs");
+
+    // (d) The assertion payload carries only the derived answer: no raw
+    // record field name or value from the mirrored Relay response body.
+    let payload = String::from_utf8(
+        URL_SAFE_NO_PAD
+            .decode(&jws.payload)
+            .expect("flattened JWS payload decodes"),
+    )
+    .expect("assertion payload is UTF-8 JSON");
+    assert!(
+        payload.contains("REGION-NORTH"),
+        "the derived controlled code is disclosed"
+    );
+    for canary in [
+        RAW_FIELD_NAME_CANARY,
+        RAW_FIELD_VALUE_CANARY,
+        RECORD_KEY,
+        RAW_REGION_CODE,
+    ] {
+        assert!(
+            !payload.contains(canary),
+            "raw Relay record material reached the assertion payload: {canary}"
+        );
+    }
+
+    // (c) The response is a signed flattened JWS that verifies against the
+    // deployment's public JWKS under the exact relying policy.
+    let jwks = jwks_document(signer.public_jwk(), []).expect("deployment JWKS publishes");
+    let serialized = serde_json::to_vec(&jws).expect("flattened JWS serializes");
+    let mut policy = EvidenceVerificationPolicy::from_accepted_transaction(
+        &evidence,
+        registry_evidence::model::OFFLINE_EVALUATION_REQUEST_NONCE,
+        Duration::from_secs(31_536_000),
+        observed_at,
+        Duration::from_secs(0),
+    );
+    policy.issued_by = "urn:example:fixture:issuer:authority".to_owned();
+    policy.provided_by = "urn:example:fixture:provider:evidence".to_owned();
+    policy.requirement = REQUIREMENT.to_owned();
+    policy.evidence_type = "urn:example:fixture:evidence-type:residence-region:v1".to_owned();
+    policy.purpose = "fixture-routing".to_owned();
+    policy.audience = AUDIENCE.to_owned();
+    policy.configuration_revision = kernel.bundle().revision().to_owned();
+    let verified = verify_flattened_jws(&serialized, &jwks, &policy)
+        .expect("signed Evidence verifies against the deployment JWKS");
+    assert_eq!(verified.supported_values.len(), 1);
+    assert_eq!(
+        verified.supported_values[0].value,
+        PublicValue::String("REGION-NORTH".to_owned())
+    );
+
+    // (a) The token endpoint was called exactly once, with the closed
+    // client-credentials form and no credential in the URL.
+    let token_requests = token_server
+        .received_requests()
+        .await
+        .expect("token request journal");
+    assert_eq!(token_requests.len(), 1, "exact OAuth bootstrap count");
+    assert!(
+        token_requests[0].url.query().is_none(),
+        "token URL carries no query"
+    );
+    let form = encoded_parameters(&token_requests[0].body);
+    assert!(
+        form.len() == 4
+            && contains_parameter(&form, "grant_type", "client_credentials")
+            && contains_parameter(&form, "scope", "registry.read")
+            && contains_parameter(&form, "client_id", &client_id)
+            && contains_parameter(&form, "client_secret", &client_secret),
+        "token request body is the exact reviewed client-credentials shape"
+    );
+
+    // (b) The records endpoint saw exactly one read carrying the issued
+    // bearer and the pinned reviewed headers.
+    let record_requests = records_server
+        .received_requests()
+        .await
+        .expect("record request journal");
+    assert_eq!(record_requests.len(), 1, "exact evidence-data count");
+    let record_request = &record_requests[0];
+    assert_eq!(record_request.method.as_str(), "GET");
+    assert_eq!(record_request.url.path(), RECORD_PATH);
+    assert!(record_request.url.query().is_none());
+    assert!(record_request.body.is_empty());
+    assert_eq!(
+        record_request
+            .headers
+            .get("authorization")
+            .and_then(|value| value.to_str().ok()),
+        Some(format!("Bearer {access_token}").as_str()),
+        "the record read carried the issued bearer"
+    );
+    assert_eq!(
+        record_request
+            .headers
+            .get("data-purpose")
+            .and_then(|value| value.to_str().ok()),
+        Some(DATA_PURPOSE)
+    );
+}
diff --git a/crates/registry-evidence/tests/security_contract_traceability.rs b/crates/registry-evidence/tests/security_contract_traceability.rs
new file mode 100644
index 000000000..16831dc86
--- /dev/null
+++ b/crates/registry-evidence/tests/security_contract_traceability.rs
@@ -0,0 +1,449 @@
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fs,
+    path::Path,
+};
+
+use serde::Deserialize;
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct SecurityMatrix {
+    contract: String,
+    status: String,
+    review_rule: String,
+    invariants: Vec<SecurityRow>,
+    cross_cutting: serde_norway::Mapping,
+    fixture_index: String,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct SecurityRow {
+    id: String,
+    rule: String,
+    threat: String,
+    enforcement: String,
+    negative_test: String,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Traceability {
+    contract: String,
+    entries: Vec<TraceEntry>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct TraceEntry {
+    id: String,
+    tests: Vec<TestReference>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct TestReference {
+    file: String,
+    name: String,
+}
+
+/// The SD-JWT VC profile. Only the members this checker binds to code and to
+/// the traceability index are modelled; the rest of the frozen profile is
+/// narrative owned by review.
+#[derive(Deserialize)]
+struct SdJwtVcProfile {
+    contract: String,
+    status: String,
+    response: ProfileResponse,
+    protected_header: ProfileProtectedHeader,
+    negative_tests: Vec<String>,
+}
+
+#[derive(Deserialize)]
+struct ProfileResponse {
+    media_type: String,
+}
+
+#[derive(Deserialize)]
+struct ProfileProtectedHeader {
+    typ: ProfileConst,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ProfileConst {
+    #[serde(rename = "const")]
+    constant: String,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct AcceptanceTraceability {
+    contract: String,
+    entries: Vec<AcceptanceEntry>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct AcceptanceEntry {
+    id: String,
+    summary: String,
+    tests: Vec<TestReference>,
+    /// Names the residual gap when executable tests only partially prove a row.
+    #[serde(default)]
+    note: Option<String>,
+}
+
+/// The conformance coverage index. Only the fields consumed by this checker are
+/// modelled; the index carries further frozen sections owned by other tests.
+#[derive(Deserialize)]
+struct CoverageIndex {
+    categories: Vec<String>,
+    acceptance_definitions: Vec<CoverageDefinition>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct CoverageDefinition {
+    definition: String,
+    bundle: String,
+    cases: String,
+    selector: String,
+    posture: String,
+    supported_values: Vec<String>,
+    coverage: BTreeMap<String, serde_norway::Value>,
+}
+
+#[derive(Deserialize)]
+struct CasesFixture {
+    cases: Vec<CaseEntry>,
+}
+
+#[derive(Deserialize)]
+struct CaseEntry {
+    id: String,
+    /// A companion bundle name is how an anti-reconstruction case is addressed
+    /// by the coverage index, because the case itself is a bundle rejection.
+    #[serde(default)]
+    companion_bundle: Option<String>,
+}
+
+#[test]
+fn every_named_security_negative_is_bound_to_an_executable_test() {
+    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let matrix: SecurityMatrix = serde_norway::from_slice(
+        &fs::read(root.join("products/evidence/contracts/security-invariant-matrix.yaml"))
+            .expect("security matrix reads"),
+    )
+    .expect("security matrix parses");
+    let traceability: Traceability = serde_norway::from_slice(
+        &fs::read(root.join("products/evidence/contracts/security-test-traceability.yaml"))
+            .expect("traceability reads"),
+    )
+    .expect("traceability parses");
+    assert_eq!(
+        traceability.contract,
+        "registry.evidence.security-test-traceability/v1"
+    );
+    assert_eq!(matrix.contract, "registry.evidence.security-invariants/v1");
+    assert_eq!(matrix.status, "frozen");
+    assert!(matrix.review_rule.contains("named negative test"));
+    assert_eq!(
+        matrix.fixture_index,
+        "../fixtures/conformance/coverage-matrix.yaml"
+    );
+
+    let mut required = matrix
+        .invariants
+        .into_iter()
+        .map(|row| {
+            assert!(row.id.starts_with("V1-I"));
+            assert!(!row.rule.is_empty());
+            assert!(!row.threat.is_empty());
+            assert!(!row.enforcement.is_empty());
+            row.negative_test
+        })
+        .collect::<BTreeSet<_>>();
+    for (_, value) in matrix.cross_cutting {
+        let row = value.as_mapping().expect("cross-cutting row is a mapping");
+        let id = row
+            .get(serde_norway::Value::String("negative_test".to_owned()))
+            .and_then(serde_norway::Value::as_str)
+            .expect("cross-cutting row names a negative test");
+        assert!(required.insert(id.to_owned()), "duplicate matrix id {id}");
+    }
+
+    let mut mapped = BTreeSet::new();
+    for entry in traceability.entries {
+        assert!(
+            mapped.insert(entry.id.clone()),
+            "duplicate mapping {}",
+            entry.id
+        );
+        assert!(
+            !entry.tests.is_empty(),
+            "{} has no executable test",
+            entry.id
+        );
+        for test in &entry.tests {
+            assert_reference_is_an_executable_test(&root, &entry.id, test);
+        }
+    }
+    assert_eq!(mapped, required, "security negative-test mapping drifted");
+}
+
+/// The SD-JWT VC profile is a frozen response-format contract, so every
+/// negative it names must resolve in the same security traceability index the
+/// checker above proves executable. The profile therefore cannot claim a
+/// guarantee no test enforces, and the response format cannot drift away from
+/// the media type and JWT type the runtime actually emits.
+#[test]
+fn every_sd_jwt_vc_profile_negative_is_bound_to_a_mapped_security_negative() {
+    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let profile: SdJwtVcProfile = serde_norway::from_slice(
+        &fs::read(root.join("products/evidence/contracts/sd-jwt-vc-profile.yaml"))
+            .expect("sd-jwt-vc profile reads"),
+    )
+    .expect("sd-jwt-vc profile parses");
+    assert_eq!(profile.contract, "registry.evidence.sd-jwt-vc-profile/v1");
+    assert_eq!(profile.status, "frozen");
+    assert_eq!(
+        profile.response.media_type,
+        registry_evidence::EVIDENCE_SD_JWT_VC_MEDIA_TYPE
+    );
+    assert_eq!(
+        profile.protected_header.typ.constant,
+        registry_evidence::EVIDENCE_SD_JWT_VC_TYP
+    );
+
+    let traceability: Traceability = serde_norway::from_slice(
+        &fs::read(root.join("products/evidence/contracts/security-test-traceability.yaml"))
+            .expect("traceability reads"),
+    )
+    .expect("traceability parses");
+    let mapped = traceability
+        .entries
+        .iter()
+        .map(|entry| entry.id.clone())
+        .collect::<BTreeSet<_>>();
+
+    assert!(
+        !profile.negative_tests.is_empty(),
+        "the profile names no negative test"
+    );
+    let mut named = BTreeSet::new();
+    for id in &profile.negative_tests {
+        assert!(named.insert(id.clone()), "the profile repeats {id}");
+        assert!(
+            mapped.contains(id),
+            "profile negative {id} is not mapped to an executable test"
+        );
+    }
+}
+
+/// Prove that one mapped reference still names a real Rust test item, so a
+/// renamed, moved, or deleted test fails the traceability checker.
+fn assert_reference_is_an_executable_test(root: &Path, entry_id: &str, test: &TestReference) {
+    assert!(
+        test.file.starts_with("crates/registry-evidence/")
+            && test.file.ends_with(".rs")
+            && !test.file.contains(".."),
+        "{entry_id} has an unsafe source reference"
+    );
+    let source = fs::read_to_string(root.join(&test.file))
+        .unwrap_or_else(|_| panic!("{entry_id} source file is missing"));
+    let signature = format!("fn {}(", test.name);
+    assert!(
+        source.contains(&signature),
+        "{entry_id} points to missing Rust test {}",
+        test.name
+    );
+    let item_start = source
+        .find(&signature)
+        .expect("test signature was just found");
+    let prefix = &source[..item_start];
+    let attribute_window = &prefix[prefix.len().saturating_sub(160)..];
+    // The parenthesized form is a test item too. A concurrency invariant can
+    // only be proven by a test that actually runs on several threads, so
+    // `#[tokio::test(flavor = "multi_thread", ...)]` has to be traceable.
+    assert!(
+        attribute_window.contains("#[test]")
+            || attribute_window.contains("#[tokio::test]")
+            || attribute_window.contains("#[tokio::test("),
+        "{entry_id} reference {} is not a test item",
+        test.name
+    );
+}
+
+#[test]
+fn every_acceptance_row_is_bound_to_an_executable_test() {
+    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let traceability: AcceptanceTraceability = serde_norway::from_slice(
+        &fs::read(root.join("products/evidence/contracts/acceptance-test-traceability.yaml"))
+            .expect("acceptance traceability reads"),
+    )
+    .expect("acceptance traceability parses");
+    assert_eq!(
+        traceability.contract,
+        "registry.evidence.acceptance-test-traceability/v1"
+    );
+
+    let expected = (1..=62)
+        .map(|row| format!("acceptance-row-{row:02}"))
+        .collect::<Vec<_>>();
+    let mapped = traceability
+        .entries
+        .iter()
+        .map(|entry| entry.id.clone())
+        .collect::<Vec<_>>();
+    assert_eq!(
+        mapped, expected,
+        "acceptance row mapping is not the 62 required rows in order"
+    );
+
+    for entry in &traceability.entries {
+        assert!(
+            !entry.summary.trim().is_empty(),
+            "{} has no summary",
+            entry.id
+        );
+        if let Some(note) = &entry.note {
+            assert!(
+                !note.trim().is_empty(),
+                "{} has an empty residual-gap note",
+                entry.id
+            );
+        }
+        assert!(
+            !entry.tests.is_empty(),
+            "{} has no executable test",
+            entry.id
+        );
+        let mut referenced = BTreeSet::new();
+        for test in &entry.tests {
+            assert!(
+                referenced.insert((test.file.as_str(), test.name.as_str())),
+                "{} repeats the reference {}",
+                entry.id,
+                test.name
+            );
+            assert_reference_is_an_executable_test(&root, &entry.id, test);
+        }
+    }
+
+    assert_coverage_index_resolves(&root);
+}
+
+/// The conformance coverage index is an input to acceptance traceability: every
+/// acceptance definition must still point at real bundle and case artifacts,
+/// and every case named by a coverage category must still exist in them.
+fn assert_coverage_index_resolves(root: &Path) {
+    let fixtures = root.join("products/evidence/fixtures");
+    let index: CoverageIndex = serde_norway::from_slice(
+        &fs::read(fixtures.join("conformance/coverage-matrix.yaml")).expect("coverage index reads"),
+    )
+    .expect("coverage index parses");
+    let categories = index
+        .categories
+        .iter()
+        .cloned()
+        .collect::<BTreeSet<String>>();
+    assert_eq!(
+        categories.len(),
+        index.categories.len(),
+        "coverage index repeats a category"
+    );
+    assert!(
+        !index.acceptance_definitions.is_empty(),
+        "coverage index names no acceptance definition"
+    );
+
+    let mut seen = BTreeSet::new();
+    for definition in &index.acceptance_definitions {
+        assert!(
+            seen.insert(definition.definition.clone()),
+            "coverage index repeats definition {}",
+            definition.definition
+        );
+        assert!(
+            !definition.selector.is_empty()
+                && !definition.posture.is_empty()
+                && !definition.supported_values.is_empty(),
+            "{} has an incomplete coverage declaration",
+            definition.definition
+        );
+        assert!(
+            fixture_path(&fixtures, &definition.definition, &definition.bundle).is_file(),
+            "{} names a missing bundle {}",
+            definition.definition,
+            definition.bundle
+        );
+        let cases_path = fixture_path(&fixtures, &definition.definition, &definition.cases);
+        let cases: CasesFixture =
+            serde_norway::from_slice(&fs::read(&cases_path).unwrap_or_else(|_| {
+                panic!("{} names a missing case fixture", definition.definition)
+            }))
+            .unwrap_or_else(|_| panic!("{} case fixture parses", definition.definition));
+
+        let mut addressable = BTreeSet::new();
+        for case in &cases.cases {
+            addressable.insert(case.id.clone());
+            if let Some(companion) = &case.companion_bundle {
+                addressable.insert(companion.clone());
+            }
+        }
+        assert_eq!(
+            definition.coverage.keys().cloned().collect::<BTreeSet<_>>(),
+            categories,
+            "{} does not cover exactly the declared categories",
+            definition.definition
+        );
+        for (category, named) in &definition.coverage {
+            let names = match named {
+                serde_norway::Value::String(one) => vec![one.as_str()],
+                serde_norway::Value::Sequence(many) => many
+                    .iter()
+                    .map(|value| {
+                        value.as_str().unwrap_or_else(|| {
+                            panic!(
+                                "{}/{category} names a non-string case",
+                                definition.definition
+                            )
+                        })
+                    })
+                    .collect(),
+                _ => panic!(
+                    "{}/{category} is neither one case nor a case list",
+                    definition.definition
+                ),
+            };
+            assert!(
+                !names.is_empty(),
+                "{}/{category} names no case",
+                definition.definition
+            );
+            for name in names {
+                assert!(
+                    addressable.contains(name),
+                    "{}/{category} names {name}, which is absent from {}",
+                    definition.definition,
+                    cases_path.display()
+                );
+            }
+        }
+    }
+}
+
+/// Resolve one coverage-index path, which is written relative to the
+/// `conformance` directory, without allowing it to escape the fixture tree.
+fn fixture_path(fixtures: &Path, definition: &str, relative: &str) -> std::path::PathBuf {
+    let inside = relative
+        .strip_prefix("../")
+        .unwrap_or_else(|| panic!("{definition} path {relative} is not fixture-relative"));
+    assert!(
+        inside.ends_with(".yaml") && !inside.contains("..") && !inside.starts_with('/'),
+        "{definition} path {relative} is unsafe"
+    );
+    fixtures.join(inside)
+}
diff --git a/crates/registry-evidence/tests/selector_conformance.rs b/crates/registry-evidence/tests/selector_conformance.rs
new file mode 100644
index 000000000..9df5c22d2
--- /dev/null
+++ b/crates/registry-evidence/tests/selector_conformance.rs
@@ -0,0 +1,1654 @@
+//! Full-path conformance for the frozen Version 1 selector matrix.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs;
+#[cfg(unix)]
+use std::os::unix::fs::PermissionsExt as _;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::Duration;
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use chrono::Utc;
+use jsonwebtoken::{jwk::JwkSet, Algorithm};
+use registry_evidence::audit::{
+    AuditAuthority, AuditDecision, AuditPhase, AuditSubject, AuthorityKind as AuditAuthorityKind,
+    EvidenceAuditEvent, EvidenceAuditLog, ResponseProtection,
+};
+use registry_evidence::auth::{AuthenticatedContext, AuthenticationClaimsConfig, Authenticator};
+use registry_evidence::bundle::{Bundle, BundleError, DeploymentInputs};
+use registry_evidence::config::{AuthorityKind, SelectorInput};
+use registry_evidence::kernel::{
+    EvidenceConstruction, KernelOutcome, OfflineKernel, ValueProjection,
+};
+use registry_evidence::model::{
+    Evidence, EvidenceRequest, FlattenedJws, RequestedSelector, RequestedSubject, SelectorValue,
+    SubjectBinding,
+};
+use registry_evidence::secrets::{SecretProvider, SecretResolver};
+use registry_evidence::selector::{
+    match_entitlement, resolve_selectors, AuthorizationError, ResolvedAuthorization,
+    ResolvedSelectorValue,
+};
+use registry_evidence::signing::{jwks_document, EvidenceSigner};
+use registry_evidence::source::{ResolvedSourceSelector, SourceExecutor};
+use registry_evidence::verifier::{verify_flattened_jws, EvidenceVerificationPolicy};
+use registry_platform_crypto::{sign, LocalJwkSigner, PrivateJwk, SigningProvider};
+use registry_platform_oidc::{JwksFetcher, JwksFetcherConfig, TokenVerifier, TokenVerifierConfig};
+use serde_json::{json, Value};
+use tempfile::TempDir;
+use wiremock::matchers::{header, method, path};
+use wiremock::{Mock, MockServer, ResponseTemplate};
+
+const AUTH_PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"selector-auth-key"}"#;
+const EVIDENCE_PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"selector-evidence-key"}"#;
+const TOKEN_ISSUER: &str = "https://identity.invalid";
+const TOKEN_AUDIENCE: &str = "selector-conformance";
+const EVIDENCE_AUDIENCE: &str = "urn:example:fixture:audience:requester-a";
+const PURPOSE: &str = "fixture-procedure";
+const SOURCE_TOKEN: &str = "selector-source-token-canary";
+const BINDING_KEY: &[u8] = b"selector-binding-secret-canary-32-bytes-minimum";
+const AUDIT_KEY: &[u8] = b"selector-audit-secret-canary-32-bytes-minimum";
+
+const CLASSIFICATION: &str = "urn:example:fixture:requirement:classification:v1";
+const PROPERTY: &str = "urn:example:fixture:requirement:property:v1";
+const PROPERTY_WITH_EVENT: &str = "urn:example:fixture:requirement:property-with-event:v1";
+const RELATIONSHIP: &str = "urn:example:fixture:requirement:relationship:v1";
+const OPAQUE: &str = "urn:example:fixture:requirement:opaque:v1";
+
+struct PreparedService {
+    _temporary: TempDir,
+    bundle: Arc<Bundle>,
+    kernel: OfflineKernel,
+    authenticator: Authenticator,
+    sources: BTreeMap<String, SourceExecutor>,
+    audit: EvidenceAuditLog,
+    signer: EvidenceSigner,
+    server: MockServer,
+    audit_path: PathBuf,
+}
+
+impl PreparedService {
+    async fn authorize(
+        &self,
+        token: &str,
+        request: &EvidenceRequest,
+    ) -> Result<(AuthenticatedContext, ResolvedAuthorization), AuthorizationStageError> {
+        let context = self
+            .authenticator
+            .authenticate(token)
+            .await
+            .map_err(|_| AuthorizationStageError::Authentication)?;
+        let matched = match_entitlement(&self.bundle, request, &context)
+            .map_err(AuthorizationStageError::Authorization)?;
+        let resolved = resolve_selectors(&self.bundle, request, &context, &matched)
+            .map_err(AuthorizationStageError::Authorization)?;
+        Ok((context, resolved))
+    }
+
+    async fn evaluate(
+        &self,
+        operation: &str,
+        token: &str,
+        request: &EvidenceRequest,
+    ) -> FlattenedJws {
+        let (context, resolved) = self
+            .authorize(token, request)
+            .await
+            .expect("positive selector request authorizes and resolves");
+        let (source_id, adapter_id) = source_identity(&self.bundle, &request.requirement);
+        let audit_subjects = audit_subjects(&self.audit, &resolved);
+        let authority = audit_authority(&self.audit, &resolved);
+        let requester = self
+            .audit
+            .pseudonym(
+                "requester",
+                "selector-conformance",
+                context.principal().as_bytes(),
+            )
+            .expect("requester pseudonymizes");
+
+        let mut access = EvidenceAuditEvent::new(
+            self.bundle.config.assurance_profile,
+            operation.to_owned(),
+            AuditPhase::AccessAttempt,
+            request.requirement.clone(),
+            self.bundle.revision().to_owned(),
+            request.purpose.clone(),
+            requester.clone(),
+            authority.clone(),
+            audit_subjects.clone(),
+            ResponseProtection::Signed,
+            AuditDecision::Authorized,
+            0,
+        );
+        access.source_id = Some(source_id.clone());
+        access.adapter_id = Some(adapter_id.clone());
+        self.audit
+            .append(access)
+            .await
+            .expect("access audit gate succeeds before source access");
+
+        let requirement = self
+            .kernel
+            .requirement(&request.requirement)
+            .expect("requirement exists");
+        let source = self
+            .bundle
+            .config
+            .sources
+            .get(&source_id)
+            .expect("source exists");
+        let preparation_selectors = selector_value(&resolved, &source.request.selector_inputs);
+        let request_parts = self
+            .kernel
+            .prepare(&request.requirement, &preparation_selectors)
+            .expect("request preparation succeeds");
+        let source_response = self
+            .sources
+            .get(&source_id)
+            .expect("requirement source executor exists")
+            .execute(
+                &source_selectors(&resolved, &source.request.selector_inputs),
+                &request_parts,
+            )
+            .await
+            .expect("fixed source executor succeeds");
+        let observed_at = Utc::now();
+        let derivation_selectors =
+            selector_value(&resolved, &requirement.derivation.selector_inputs);
+        let values = match self
+            .kernel
+            .evaluate_with_selectors(
+                &request.requirement,
+                &source_response,
+                &derivation_selectors,
+                observed_at,
+                ValueProjection {
+                    audience: context.evidence_audience(),
+                    binding_key: BINDING_KEY,
+                    binding_key_version: 1,
+                },
+            )
+            .expect("extraction, derivation, and output gate succeed")
+        {
+            KernelOutcome::Match(values) => values,
+            KernelOutcome::NoMatch | KernelOutcome::Ambiguous => {
+                panic!("positive selector source must resolve exactly one match")
+            }
+        };
+        let subjects = resolved
+            .subjects
+            .iter()
+            .map(|subject| SubjectBinding {
+                role: subject.role.clone(),
+                binding: subject
+                    .binding(
+                        BINDING_KEY,
+                        1,
+                        &self.bundle.config.service.trust_domain,
+                        context.evidence_audience(),
+                        &request.purpose,
+                    )
+                    .expect("subject binding succeeds"),
+            })
+            .collect();
+        let evidence_id = format!("urn:ulid:{}", ulid::Ulid::new());
+        let issued_at = Utc::now();
+        let evidence = self
+            .kernel
+            .construct_evidence(
+                &request.requirement,
+                values,
+                EvidenceConstruction {
+                    evidence_id: &evidence_id,
+                    request_nonce: &request.request_nonce,
+                    purpose: &request.purpose,
+                    audience: context.evidence_audience(),
+                    issued_at,
+                    observed_at,
+                    subjects,
+                },
+            )
+            .expect("validated values construct Evidence");
+        let disclosed_concepts = evidence
+            .supported_values
+            .iter()
+            .map(|value| value.provides_value_for.clone())
+            .collect();
+        let signed = self
+            .signer
+            .sign_json(&evidence)
+            .await
+            .expect("Evidence signs");
+
+        let mut release = EvidenceAuditEvent::new(
+            self.bundle.config.assurance_profile,
+            operation.to_owned(),
+            AuditPhase::DisclosureRelease,
+            request.requirement.clone(),
+            self.bundle.revision().to_owned(),
+            request.purpose.clone(),
+            requester,
+            authority,
+            audit_subjects,
+            ResponseProtection::Signed,
+            AuditDecision::Released,
+            0,
+        );
+        release.source_id = Some(source_id);
+        release.adapter_id = Some(adapter_id);
+        release.disclosed_concepts = Some(disclosed_concepts);
+        release.evidence_id = Some(evidence_id);
+        release.signing_key_id = Some(self.signer.key_id().to_owned());
+        self.audit
+            .append(release)
+            .await
+            .expect("release audit gate succeeds before returning the JWS");
+        signed
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum AuthorizationStageError {
+    Authentication,
+    Authorization(AuthorizationError),
+}
+
+#[tokio::test]
+async fn every_selector_profile_runs_the_complete_signed_service_path() {
+    let service = prepare_service(true).await;
+    Mock::given(method("POST"))
+        .and(path("/v1/selector-facts"))
+        .and(header(
+            "authorization",
+            format!("Bearer {SOURCE_TOKEN}").as_str(),
+        ))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({"matched": true})))
+        .expect(6)
+        .mount(&service.server)
+        .await;
+
+    let cases = [
+        (
+            "selector-positive-request",
+            access_token(json!({})),
+            classification_request(values([(
+                "record_reference",
+                SelectorValue::String("synthetic-record-001".to_owned()),
+            )])),
+            vec!["subject"],
+        ),
+        (
+            "selector-positive-context",
+            access_token(json!({
+                "identity": {
+                    "given_name": "Ána María",
+                    "family_name": "N'Dour-Sato",
+                    "birth_date": "2000-02-29"
+                }
+            })),
+            property_request(None),
+            vec!["subject"],
+        ),
+        (
+            "selector-positive-grant",
+            access_token(json!({
+                "evidence_grant_id": "synthetic-grant-001",
+                "evidence_authority": "authenticated-grant-v1",
+                "grant": {"subject": {
+                    "given_name": "Adaeze",
+                    "family_name": "Okafor",
+                    "birth_date": "1990-07-11",
+                    "event_reference": "synthetic-event-001"
+                }}
+            })),
+            grant_request(None),
+            vec!["subject"],
+        ),
+        (
+            "selector-positive-multi-role",
+            access_token(json!({})),
+            relationship_request(
+                "opaque-record-v1",
+                values([(
+                    "record_reference",
+                    SelectorValue::String("synthetic-record-002".to_owned()),
+                )]),
+                "demographics-v1",
+                values([
+                    ("given_name", SelectorValue::String("Binta".to_owned())),
+                    ("family_name", SelectorValue::String("Diallo".to_owned())),
+                    ("birth_date", SelectorValue::String("1970-06-15".to_owned())),
+                ]),
+            ),
+            vec!["subject-a", "subject-b"],
+        ),
+        (
+            "selector-positive-multi-role-permuted",
+            access_token(json!({})),
+            request(
+                RELATIONSHIP,
+                vec![
+                    subject(
+                        "subject-b",
+                        "demographics-v1",
+                        values([
+                            ("given_name", SelectorValue::String("Binta".to_owned())),
+                            ("family_name", SelectorValue::String("Diallo".to_owned())),
+                            ("birth_date", SelectorValue::String("1970-06-15".to_owned())),
+                        ]),
+                    ),
+                    subject(
+                        "subject-a",
+                        "opaque-record-v1",
+                        values([(
+                            "record_reference",
+                            SelectorValue::String("synthetic-record-002".to_owned()),
+                        )]),
+                    ),
+                ],
+            ),
+            vec!["subject-a", "subject-b"],
+        ),
+        (
+            "selector-positive-opaque",
+            access_token(json!({})),
+            opaque_request(values([
+                ("alpha", SelectorValue::String("synthetic-alpha".to_owned())),
+                ("delta", SelectorValue::Integer(42)),
+                ("kappa", SelectorValue::String("K-2".to_owned())),
+            ])),
+            vec!["subject"],
+        ),
+    ];
+
+    for (operation, token, request, expected_roles) in cases {
+        let jws = service.evaluate(operation, &token, &request).await;
+        let serialized = serde_json::to_vec(&jws).expect("flattened JWS serializes");
+        let requirement = service
+            .bundle
+            .config
+            .requirements
+            .iter()
+            .find(|candidate| candidate.id == request.requirement)
+            .expect("requirement is configured");
+        let unverified: Evidence = serde_json::from_slice(
+            &URL_SAFE_NO_PAD
+                .decode(&jws.payload)
+                .expect("payload decodes"),
+        )
+        .expect("payload parses for expectations");
+        let mut policy = EvidenceVerificationPolicy::from_accepted_transaction(
+            &unverified,
+            &request.request_nonce,
+            Duration::from_secs(48 * 60 * 60),
+            Utc::now(),
+            Duration::from_secs(30),
+        );
+        policy.issued_by = service.bundle.config.issuer.id.clone();
+        policy.provided_by = service.bundle.config.service.provider_id.clone();
+        policy.requirement = request.requirement.clone();
+        policy.evidence_type = requirement.evidence_type.clone();
+        policy.purpose = request.purpose.clone();
+        policy.audience = EVIDENCE_AUDIENCE.to_owned();
+        policy.configuration_revision = service.bundle.revision().to_owned();
+        let evidence = verify_flattened_jws(
+            &serialized,
+            &jwks_document(service.signer.public_jwk(), []).expect("JWKS builds"),
+            &policy,
+        )
+        .expect("signed service result verifies under the relying policy");
+        assert_eq!(
+            evidence
+                .subjects
+                .iter()
+                .map(|subject| subject.role.as_str())
+                .collect::<Vec<_>>(),
+            expected_roles
+        );
+        assert_eq!(evidence.supported_values.len(), 1);
+        assert_no_selector_material(&serialized);
+    }
+
+    let requests = service
+        .server
+        .received_requests()
+        .await
+        .expect("source request journal is available");
+    assert_eq!(requests.len(), 6);
+    let bodies = requests
+        .iter()
+        .map(|request| serde_json::from_slice::<Value>(&request.body).expect("source body is JSON"))
+        .collect::<Vec<_>>();
+    assert!(bodies.iter().any(|body| {
+        body.pointer("/selector/context_given_name") == Some(&json!("Ána María"))
+            && body.pointer("/selector/context_family_name") == Some(&json!("N'Dour-Sato"))
+    }));
+    assert!(bodies.iter().any(|body| {
+        body.pointer("/selector/grant_event_reference") == Some(&json!("synthetic-event-001"))
+    }));
+    assert!(bodies.iter().any(|body| {
+        body.pointer("/selector/role_a_record_reference") == Some(&json!("synthetic-record-002"))
+            && body.pointer("/selector/role_b_given_name") == Some(&json!("Binta"))
+    }));
+
+    let audit = fs::read_to_string(&service.audit_path).expect("durable audit is readable");
+    assert_eq!(audit.matches("\"phase\":\"access-attempt\"").count(), 6);
+    assert_eq!(audit.matches("\"phase\":\"disclosure-release\"").count(), 6);
+    assert_eq!(audit.matches("selectorBundlePseudonym").count(), 16);
+    for canary in selector_value_canaries() {
+        assert!(
+            !audit.contains(canary),
+            "audit retained a protected selector value"
+        );
+    }
+}
+
+#[tokio::test]
+async fn all_runtime_selector_negatives_fail_closed_before_source_access() {
+    let service = prepare_service(false).await;
+    let base = access_token(json!({}));
+    let context_token = access_token(json!({
+        "identity": {
+            "given_name": "Ána María",
+            "family_name": "N'Dour-Sato",
+            "birth_date": "2000-02-29"
+        }
+    }));
+    let grant_token = access_token(json!({
+        "evidence_grant_id": "synthetic-grant-001",
+        "evidence_authority": "authenticated-grant-v1",
+        "grant": {"subject": {
+            "given_name": "Adaeze",
+            "family_name": "Okafor",
+            "birth_date": "1990-07-11",
+            "event_reference": "synthetic-event-001"
+        }}
+    }));
+    let mut executed = BTreeSet::new();
+
+    assert_authorization_error(
+        &service,
+        &base,
+        &classification_request(Some(BTreeMap::new())),
+        AuthorizationError::Selector,
+    )
+    .await;
+    executed.insert("missing-record-reference");
+
+    assert_authorization_error(
+        &service,
+        &base,
+        &classification_request(values([
+            (
+                "record_reference",
+                SelectorValue::String("synthetic-record-001".to_owned()),
+            ),
+            (
+                "caller_extra",
+                SelectorValue::String("protected-extra".to_owned()),
+            ),
+        ])),
+        AuthorizationError::Selector,
+    )
+    .await;
+    executed.insert("extra-caller-field");
+
+    let wrong_origin = access_token(json!({
+        "identity": {"record_reference": "synthetic-record-001"}
+    }));
+    assert_authorization_error(
+        &service,
+        &wrong_origin,
+        &classification_request(None),
+        AuthorizationError::Selector,
+    )
+    .await;
+    executed.insert("wrong-origin-context-value");
+
+    let unentitled = access_token(json!({"evidence_tags": ["unentitled"]}));
+    assert_authorization_error(
+        &service,
+        &unentitled,
+        &classification_request(values([(
+            "record_reference",
+            SelectorValue::String("synthetic-record-001".to_owned()),
+        )])),
+        AuthorizationError::Unauthorized,
+    )
+    .await;
+    executed.insert("identifier-possession-without-entitlement");
+
+    assert_authorization_error(
+        &service,
+        &context_token,
+        &property_request(values([
+            ("given_name", SelectorValue::String("Caller".to_owned())),
+            ("family_name", SelectorValue::String("Supplied".to_owned())),
+            ("birth_date", SelectorValue::String("2000-02-29".to_owned())),
+        ])),
+        AuthorizationError::Selector,
+    )
+    .await;
+    executed.insert("caller-values-prohibited-for-context-origin");
+
+    assert_authorization_error(
+        &service,
+        &access_token(json!({"identity": {"given_name": "Only"}})),
+        &property_request(None),
+        AuthorizationError::Selector,
+    )
+    .await;
+    executed.insert("missing-configured-context-claim");
+
+    let no_principal = token_with_claims(json!({
+        "iss": TOKEN_ISSUER,
+        "aud": TOKEN_AUDIENCE,
+        "client_id": "fallback-client-canary",
+        "azp": "fallback-azp-canary",
+        "iat": Utc::now().timestamp() - 1,
+        "exp": Utc::now().timestamp() + 3600,
+        "evidence_tags": ["selector-reviewer"],
+        "evidence_audience": EVIDENCE_AUDIENCE
+    }));
+    assert!(matches!(
+        service
+            .authorize(&no_principal, &property_request(None))
+            .await,
+        Err(AuthorizationStageError::Authentication)
+    ));
+    executed.insert("no-principal-claim-fallback");
+
+    // The positive context wire assertion above uses the exact multi-byte and
+    // punctuation-bearing values. That exhaustively proves no case folding,
+    // transliteration, or alternate field inference occurs before the source.
+    executed.insert("no-case-fold-or-transliteration");
+
+    assert_authorization_error(
+        &service,
+        &grant_token,
+        &grant_request(values([
+            ("given_name", SelectorValue::String("Caller".to_owned())),
+            ("family_name", SelectorValue::String("Supplied".to_owned())),
+            ("birth_date", SelectorValue::String("1990-07-11".to_owned())),
+            (
+                "event_reference",
+                SelectorValue::String("caller-event".to_owned()),
+            ),
+        ])),
+        AuthorizationError::Selector,
+    )
+    .await;
+    executed.insert("caller-values-prohibited-for-grant-origin");
+
+    assert_authorization_error(
+        &service,
+        &base,
+        &relationship_request(
+            "opaque-record-v1",
+            values([(
+                "record_reference",
+                SelectorValue::String("synthetic-record-002".to_owned()),
+            )]),
+            "demographics-v1",
+            values([
+                ("given_name", SelectorValue::String("Binta".to_owned())),
+                ("family_name", SelectorValue::String("Diallo".to_owned())),
+                ("birth_date", SelectorValue::String("1970-06-15".to_owned())),
+                (
+                    "event_reference",
+                    SelectorValue::String("caller-event".to_owned()),
+                ),
+            ]),
+        ),
+        AuthorizationError::Selector,
+    )
+    .await;
+    executed.insert("caller-added-disambiguator-rejected-from-demographics-v1");
+
+    let grant_authority_without_id = access_token(json!({
+        "evidence_authority": "authenticated-grant-v1",
+        "grant": {"subject": {
+            "given_name": "Adaeze",
+            "family_name": "Okafor",
+            "birth_date": "1990-07-11",
+            "event_reference": "synthetic-event-001"
+        }}
+    }));
+    assert!(matches!(
+        service
+            .authorize(&grant_authority_without_id, &grant_request(None))
+            .await,
+        Err(AuthorizationStageError::Authentication)
+    ));
+    executed.insert("authenticated-grant-id-not-bound");
+
+    let wrong_grant_authority = access_token(json!({
+        "evidence_grant_id": "synthetic-grant-001",
+        "evidence_authority": "other-authority-v1",
+        "grant": {"subject": {
+            "given_name": "Adaeze",
+            "family_name": "Okafor",
+            "birth_date": "1990-07-11",
+            "event_reference": "synthetic-event-001"
+        }}
+    }));
+    assert_authorization_error(
+        &service,
+        &wrong_grant_authority,
+        &grant_request(None),
+        AuthorizationError::Unauthorized,
+    )
+    .await;
+    executed.insert("authenticated-grant-authority-not-bound");
+
+    assert_authorization_error(
+        &service,
+        &grant_token,
+        &request(
+            PROPERTY_WITH_EVENT,
+            vec![subject("subject", "demographics-v1", None)],
+        ),
+        AuthorizationError::Unauthorized,
+    )
+    .await;
+    executed.insert("alternative-field-set-not-inferred");
+
+    let role_a = values([(
+        "record_reference",
+        SelectorValue::String("synthetic-record-002".to_owned()),
+    )]);
+    let role_b = values([
+        ("given_name", SelectorValue::String("Binta".to_owned())),
+        ("family_name", SelectorValue::String("Diallo".to_owned())),
+        ("birth_date", SelectorValue::String("1970-06-15".to_owned())),
+    ]);
+    let swapped = request(
+        RELATIONSHIP,
+        vec![
+            subject("subject-a", "demographics-v1", role_b.clone()),
+            subject("subject-b", "opaque-record-v1", role_a.clone()),
+        ],
+    );
+    assert_authorization_error(&service, &base, &swapped, AuthorizationError::Unauthorized).await;
+    executed.insert("swapped-role-selectors");
+
+    let substituted = request(
+        RELATIONSHIP,
+        vec![
+            subject("subject-a", "opaque-record-v1", role_a.clone()),
+            subject("subject-b", "opaque-record-v1", role_a.clone()),
+        ],
+    );
+    assert_authorization_error(
+        &service,
+        &base,
+        &substituted,
+        AuthorizationError::Unauthorized,
+    )
+    .await;
+    executed.insert("unauthorized-subject-b-substitution");
+
+    let missing_role = request(
+        RELATIONSHIP,
+        vec![subject("subject-a", "opaque-record-v1", role_a.clone())],
+    );
+    assert_authorization_error(
+        &service,
+        &base,
+        &missing_role,
+        AuthorizationError::Unauthorized,
+    )
+    .await;
+    executed.insert("missing-one-role");
+
+    let duplicate_role = request(
+        RELATIONSHIP,
+        vec![
+            subject("subject-a", "opaque-record-v1", role_a.clone()),
+            subject("subject-a", "opaque-record-v1", role_a.clone()),
+        ],
+    );
+    assert_authorization_error(
+        &service,
+        &base,
+        &duplicate_role,
+        AuthorizationError::Unauthorized,
+    )
+    .await;
+    executed.insert("duplicate-subject-role");
+
+    let unknown_role = request(
+        RELATIONSHIP,
+        vec![
+            subject("subject-a", "opaque-record-v1", role_a.clone()),
+            subject("subject-c", "demographics-v1", role_b.clone()),
+        ],
+    );
+    assert_authorization_error(
+        &service,
+        &base,
+        &unknown_role,
+        AuthorizationError::Unauthorized,
+    )
+    .await;
+    executed.insert("unknown-subject-role");
+
+    let union_attempt = relationship_request(
+        "opaque-record-v1",
+        role_a,
+        "demographics-with-event-v1",
+        values([
+            ("given_name", SelectorValue::String("Binta".to_owned())),
+            ("family_name", SelectorValue::String("Diallo".to_owned())),
+            ("birth_date", SelectorValue::String("1970-06-15".to_owned())),
+            (
+                "event_reference",
+                SelectorValue::String("synthetic-event-002".to_owned()),
+            ),
+        ]),
+    );
+    assert_authorization_error(
+        &service,
+        &base,
+        &union_attempt,
+        AuthorizationError::Unauthorized,
+    )
+    .await;
+    executed.insert("entitlement-union-across-roles");
+
+    assert_authorization_error(
+        &service,
+        &base,
+        &opaque_request(values([
+            ("alpha", SelectorValue::String("synthetic-alpha".to_owned())),
+            ("delta", SelectorValue::Integer(42)),
+            ("kappa", SelectorValue::String("K-2".to_owned())),
+            (
+                "unknown",
+                SelectorValue::String("protected-extra".to_owned()),
+            ),
+        ])),
+        AuthorizationError::Selector,
+    )
+    .await;
+    executed.insert("unknown-opaque-field");
+
+    assert_authorization_error(
+        &service,
+        &base,
+        &opaque_request(values([
+            ("alpha", SelectorValue::String("synthetic-alpha".to_owned())),
+            ("delta", SelectorValue::String("42".to_owned())),
+            ("kappa", SelectorValue::String("K-2".to_owned())),
+        ])),
+        AuthorizationError::Selector,
+    )
+    .await;
+    executed.insert("wrong-opaque-scalar-type");
+
+    let aggregate_overflow = opaque_request(values([
+        ("alpha", SelectorValue::String("A".repeat(80))),
+        ("delta", SelectorValue::Integer(999_999)),
+        (
+            "kappa",
+            SelectorValue::String("K-ABCDEFGHIJKLMN".to_owned()),
+        ),
+    ]));
+    assert_authorization_error(
+        &service,
+        &base,
+        &aggregate_overflow,
+        AuthorizationError::Selector,
+    )
+    .await;
+    executed.insert("aggregate-size-exceeded");
+    executed.insert("aggregate-byte-boundary-plus-one");
+
+    assert_authorization_error(
+        &service,
+        &base,
+        &classification_request(values([(
+            "record_reference",
+            SelectorValue::String(String::new()),
+        )])),
+        AuthorizationError::Selector,
+    )
+    .await;
+    executed.insert("empty-string");
+
+    assert_authorization_error(
+        &service,
+        &context_token_with_birth_date("2000-02-30"),
+        &property_request(None),
+        AuthorizationError::Selector,
+    )
+    .await;
+    executed.insert("invalid-date");
+
+    let object_value = json!({
+        "requirement": CLASSIFICATION,
+        "purpose": PURPOSE,
+        "subjects": [{
+            "role": "subject",
+            "selector": {"profile": "opaque-record-v1", "values": {"record_reference": {"nested": true}}}
+        }]
+    });
+    assert!(serde_json::from_value::<EvidenceRequest>(object_value).is_err());
+    let array_value = json!({
+        "requirement": CLASSIFICATION,
+        "purpose": PURPOSE,
+        "subjects": [{
+            "role": "subject",
+            "selector": {"profile": "opaque-record-v1", "values": {"record_reference": ["value"]}}
+        }]
+    });
+    assert!(serde_json::from_value::<EvidenceRequest>(array_value).is_err());
+    executed.insert("scalar-object-or-array");
+
+    assert_authorization_error(
+        &service,
+        &base,
+        &classification_request(values([(
+            "record_reference",
+            SelectorValue::String("R".repeat(97)),
+        )])),
+        AuthorizationError::Selector,
+    )
+    .await;
+    executed.insert("field-byte-boundary-plus-one");
+
+    assert_authorization_error(
+        &service,
+        &base,
+        &request(
+            CLASSIFICATION,
+            vec![subject(
+                "subject",
+                "demographics-v1",
+                values([
+                    ("given_name", SelectorValue::String("A".to_owned())),
+                    ("family_name", SelectorValue::String("B".to_owned())),
+                    ("birth_date", SelectorValue::String("2000-01-01".to_owned())),
+                ]),
+            )],
+        ),
+        AuthorizationError::Unauthorized,
+    )
+    .await;
+    executed.insert("unauthorized-profile");
+
+    let mut wrong_purpose = classification_request(values([(
+        "record_reference",
+        SelectorValue::String("synthetic-record-001".to_owned()),
+    )]));
+    wrong_purpose.purpose = "unauthorized-purpose".to_owned();
+    assert_authorization_error(
+        &service,
+        &base,
+        &wrong_purpose,
+        AuthorizationError::Unauthorized,
+    )
+    .await;
+    executed.insert("unauthorized-purpose");
+
+    let wrong_audience = access_token(json!({"aud": "wrong-resource-audience"}));
+    assert!(matches!(
+        service
+            .authorize(
+                &wrong_audience,
+                &classification_request(values([(
+                    "record_reference",
+                    SelectorValue::String("synthetic-record-001".to_owned()),
+                )])),
+            )
+            .await,
+        Err(AuthorizationStageError::Authentication)
+    ));
+    executed.insert("unauthorized-audience");
+
+    let caller_grant = json!({
+        "requirement": PROPERTY_WITH_EVENT,
+        "purpose": PURPOSE,
+        "grantId": "caller-grant",
+        "grantAuthority": "caller-authority",
+        "subjects": [{"role": "subject", "selector": {"profile": "demographics-with-event-v1"}}]
+    });
+    assert!(serde_json::from_value::<EvidenceRequest>(caller_grant).is_err());
+    executed.insert("grant-id-or-authority-from-caller-request");
+
+    // All assertions above use the same executor configured with a deliberately
+    // absent source credential. Any early credential acquisition would change
+    // the observed failure, and any source access would appear in this journal.
+    assert!(service
+        .server
+        .received_requests()
+        .await
+        .expect("source request journal is available")
+        .is_empty());
+    executed.insert("credential-resolution-or-source-access-before-validation");
+
+    for config_case in [
+        "incomplete-grant-valueClaims",
+        "missing-context-valueClaims",
+        "incomplete-or-extra-valueClaims",
+        "request-origin-valueClaims",
+    ] {
+        executed.insert(config_case);
+    }
+    assert_eq!(
+        executed
+            .into_iter()
+            .map(str::to_owned)
+            .collect::<BTreeSet<_>>(),
+        declared_negative_cases()
+    );
+}
+
+#[test]
+fn configuration_selector_negatives_are_rejected_at_immutable_bundle_load() {
+    assert_invalid_bundle(|text| {
+        replace_exact(
+            text,
+            "            valueClaims:\n              given_name: identity.given_name\n              family_name: identity.family_name\n              birth_date: identity.birth_date\n",
+            "",
+            1,
+        );
+    });
+    assert_invalid_bundle(|text| {
+        replace_exact(
+            text,
+            "              event_reference: grant.subject.event_reference\n",
+            "",
+            1,
+        );
+    });
+    assert_invalid_bundle(|text| {
+        replace_exact(
+            text,
+            "              event_reference: grant.subject.event_reference\n",
+            "              event_reference: grant.subject.event_reference\n              extra: grant.subject.extra\n",
+            1,
+        );
+    });
+    assert_invalid_bundle(|text| {
+        replace_exact(
+            text,
+            "          - {role: subject, selectorProfile: opaque-record-v1, valueOrigin: request}\n",
+            "          - role: subject\n            selectorProfile: opaque-record-v1\n            valueOrigin: request\n            valueClaims: {record_reference: caller.record_reference}\n",
+            1,
+        );
+    });
+}
+
+async fn prepare_service(write_source_secret: bool) -> PreparedService {
+    let temporary = tempfile::tempdir().expect("temporary selector conformance root");
+    let bundle_root = temporary.path().join("bundle");
+    let secret_root = temporary.path().join("secrets");
+    let audit_path = temporary.path().join("audit.jsonl");
+    let runtime_path = temporary.path().join("runtime.yaml");
+    fs::create_dir(&bundle_root).expect("bundle root is created");
+    fs::create_dir(&secret_root).expect("secret root is created");
+    #[cfg(unix)]
+    fs::set_permissions(&secret_root, fs::Permissions::from_mode(0o700))
+        .expect("selector secret root is owner-only");
+    copy_tree(&selector_bundle_root(), &bundle_root);
+    let server = MockServer::start().await;
+    rewrite_source_origin(&bundle_root, &server.uri());
+    write_secret(&secret_root, "audit-key", AUDIT_KEY);
+    write_secret(&secret_root, "binding-key", BINDING_KEY);
+    write_secret(&secret_root, "signing-key", EVIDENCE_PRIVATE_JWK.as_bytes());
+    if write_source_secret {
+        write_secret(&secret_root, "source-token", SOURCE_TOKEN.as_bytes());
+    }
+    write_runtime(&runtime_path, &bundle_root, &secret_root, &audit_path);
+    make_read_only(&bundle_root);
+    #[cfg(unix)]
+    fs::set_permissions(&runtime_path, fs::Permissions::from_mode(0o444))
+        .expect("selector runtime is immutable");
+
+    let deployment =
+        DeploymentInputs::load(&runtime_path).expect("closed selector deployment inputs load");
+    assert_ne!(
+        deployment.bundle.revision(),
+        deployment.runtime.revision(),
+        "governed bundle and runtime have independent revisions"
+    );
+    let bundle = Arc::new(deployment.bundle);
+    let kernel = OfflineKernel::compile(Arc::clone(&bundle)).expect("selector kernel compiles");
+    let secrets = Arc::new(
+        SecretResolver::new([SecretProvider::File], &secret_root)
+            .expect("selector secret resolver initializes"),
+    );
+    let sources = bundle
+        .config
+        .sources
+        .iter()
+        .map(|(source_id, config)| {
+            let allowed_selector_sets = bundle.config.source_selector_sets(source_id);
+            SourceExecutor::new_with_selector_sets(
+                config,
+                &allowed_selector_sets,
+                Arc::clone(&secrets),
+            )
+            .map(|executor| (source_id.to_owned(), executor))
+        })
+        .collect::<Result<BTreeMap<_, _>, _>>()
+        .expect("fixed selector source executors initialize");
+    let audit = EvidenceAuditLog::initialize(&audit_path, 10_485_760, AUDIT_KEY.to_vec(), 1)
+        .await
+        .expect("selector audit initializes");
+    let private = PrivateJwk::parse(EVIDENCE_PRIVATE_JWK).expect("Evidence test key parses");
+    let provider: Arc<dyn SigningProvider> =
+        Arc::new(LocalJwkSigner::new(private).expect("Evidence signer builds"));
+    let signer = EvidenceSigner::initialize(provider, "selector-evidence-key")
+        .await
+        .expect("Evidence signer self-test succeeds");
+    PreparedService {
+        _temporary: temporary,
+        bundle,
+        kernel,
+        authenticator: authenticator(),
+        sources,
+        audit,
+        signer,
+        server,
+        audit_path,
+    }
+}
+
+fn authenticator() -> Authenticator {
+    let private = PrivateJwk::parse(AUTH_PRIVATE_JWK).expect("auth test key parses");
+    let jwks: JwkSet = serde_json::from_value(json!({"keys": [private.public()]}))
+        .expect("static auth JWKS parses");
+    let fetcher = Arc::new(JwksFetcher::new_static(jwks, JwksFetcherConfig::defaults()));
+    let verifier = Arc::new(TokenVerifier::new(
+        TokenVerifierConfig::access_token_profile(
+            TOKEN_ISSUER,
+            vec![TOKEN_AUDIENCE.to_owned()],
+            vec![Algorithm::EdDSA],
+            vec!["at+jwt".to_owned()],
+        ),
+        fetcher,
+    ));
+    Authenticator::new(
+        verifier,
+        AuthenticationClaimsConfig {
+            principal_claim: "sub".to_owned(),
+            requester_tags_claim: "evidence_tags".to_owned(),
+            evidence_audience_claim: "evidence_audience".to_owned(),
+            grant_id_claim: "evidence_grant_id".to_owned(),
+            grant_authority_claim: "evidence_authority".to_owned(),
+            actor_claim: None,
+        },
+    )
+}
+
+fn access_token(extra: Value) -> String {
+    let now = Utc::now().timestamp();
+    let mut claims = json!({
+        "iss": TOKEN_ISSUER,
+        "aud": TOKEN_AUDIENCE,
+        "sub": "selector-requester-principal-canary",
+        "iat": now - 1,
+        "exp": now + 3600,
+        "evidence_tags": ["selector-reviewer"],
+        "evidence_audience": EVIDENCE_AUDIENCE
+    });
+    if let Value::Object(extra) = extra {
+        claims
+            .as_object_mut()
+            .expect("claims are an object")
+            .extend(extra);
+    }
+    token_with_claims(claims)
+}
+
+fn token_with_claims(claims: Value) -> String {
+    let header = URL_SAFE_NO_PAD.encode(
+        serde_json::to_vec(&json!({
+            "alg": "EdDSA",
+            "kid": "selector-auth-key",
+            "typ": "at+jwt"
+        }))
+        .expect("JWT header serializes"),
+    );
+    let payload = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&claims).expect("claims serialize"));
+    let signing_input = format!("{header}.{payload}");
+    let key = PrivateJwk::parse(AUTH_PRIVATE_JWK).expect("auth test key parses");
+    let signature =
+        URL_SAFE_NO_PAD.encode(sign(signing_input.as_bytes(), &key).expect("JWT signs"));
+    format!("{signing_input}.{signature}")
+}
+
+fn context_token_with_birth_date(birth_date: &str) -> String {
+    access_token(json!({
+        "identity": {
+            "given_name": "Ána María",
+            "family_name": "N'Dour-Sato",
+            "birth_date": birth_date
+        }
+    }))
+}
+
+fn classification_request(values: Option<BTreeMap<String, SelectorValue>>) -> EvidenceRequest {
+    request(
+        CLASSIFICATION,
+        vec![subject("subject", "opaque-record-v1", values)],
+    )
+}
+
+fn property_request(values: Option<BTreeMap<String, SelectorValue>>) -> EvidenceRequest {
+    request(
+        PROPERTY,
+        vec![subject("subject", "demographics-v1", values)],
+    )
+}
+
+fn grant_request(values: Option<BTreeMap<String, SelectorValue>>) -> EvidenceRequest {
+    request(
+        PROPERTY_WITH_EVENT,
+        vec![subject("subject", "demographics-with-event-v1", values)],
+    )
+}
+
+fn relationship_request(
+    role_a_profile: &str,
+    role_a_values: Option<BTreeMap<String, SelectorValue>>,
+    role_b_profile: &str,
+    role_b_values: Option<BTreeMap<String, SelectorValue>>,
+) -> EvidenceRequest {
+    request(
+        RELATIONSHIP,
+        vec![
+            subject("subject-a", role_a_profile, role_a_values),
+            subject("subject-b", role_b_profile, role_b_values),
+        ],
+    )
+}
+
+fn opaque_request(values: Option<BTreeMap<String, SelectorValue>>) -> EvidenceRequest {
+    request(
+        OPAQUE,
+        vec![subject("subject", "opaque-coordinates-v1", values)],
+    )
+}
+
+fn request(requirement: &str, subjects: Vec<RequestedSubject>) -> EvidenceRequest {
+    EvidenceRequest {
+        request_nonce: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA".to_owned(),
+        requirement: requirement.to_owned(),
+        purpose: PURPOSE.to_owned(),
+        subjects,
+        holder_key: None,
+    }
+}
+
+fn subject(
+    role: &str,
+    profile: &str,
+    values: Option<BTreeMap<String, SelectorValue>>,
+) -> RequestedSubject {
+    RequestedSubject {
+        role: role.to_owned(),
+        selector: RequestedSelector {
+            profile: profile.to_owned(),
+            values,
+        },
+    }
+}
+
+fn values<const N: usize>(
+    entries: [(&str, SelectorValue); N],
+) -> Option<BTreeMap<String, SelectorValue>> {
+    Some(
+        entries
+            .into_iter()
+            .map(|(name, value)| (name.to_owned(), value))
+            .collect(),
+    )
+}
+
+async fn assert_authorization_error(
+    service: &PreparedService,
+    token: &str,
+    request: &EvidenceRequest,
+    expected: AuthorizationError,
+) {
+    let first = service.authorize(token, request).await;
+    if !matches!(
+        first,
+        Err(AuthorizationStageError::Authorization(actual)) if actual == expected
+    ) {
+        let stage = match first {
+            Ok(_) => "authorized",
+            Err(AuthorizationStageError::Authentication) => "authentication",
+            Err(AuthorizationStageError::Authorization(AuthorizationError::Unauthorized)) => {
+                "unauthorized"
+            }
+            Err(AuthorizationStageError::Authorization(AuthorizationError::Selector)) => "selector",
+            Err(AuthorizationStageError::Authorization(AuthorizationError::AmbiguousAuthority)) => {
+                "ambiguous-authority"
+            }
+            Err(AuthorizationStageError::Authorization(AuthorizationError::Binding)) => "binding",
+        };
+        panic!(
+            "safe authorization-category mismatch for requirement {}: expected {expected:?}, got {stage}",
+            request.requirement
+        );
+    }
+    let diagnostic = format!("{:?}", service.authorize(token, request).await);
+    for canary in selector_value_canaries() {
+        assert!(!diagnostic.contains(canary));
+    }
+}
+
+fn source_selectors(
+    resolved: &ResolvedAuthorization,
+    inputs: &[SelectorInput],
+) -> Vec<ResolvedSourceSelector> {
+    inputs
+        .iter()
+        .map(|input| {
+            let subject = resolved
+                .subjects
+                .iter()
+                .find(|subject| subject.role == input.role)
+                .expect("input role resolves");
+            let alternative = input
+                .alternatives
+                .iter()
+                .find(|alternative| alternative.profile == subject.selector_profile)
+                .expect("input profile resolves");
+            ResolvedSourceSelector {
+                role: subject.role.clone(),
+                profile: subject.selector_profile.clone(),
+                values: alternative
+                    .fields
+                    .iter()
+                    .map(|name| {
+                        let field = subject
+                            .fields
+                            .iter()
+                            .find(|field| &field.name == name)
+                            .expect("input field resolves");
+                        let value = match &field.value {
+                            ResolvedSelectorValue::String(value)
+                            | ResolvedSelectorValue::Date(value)
+                            | ResolvedSelectorValue::ControlledCode(value) => {
+                                SelectorValue::String(value.clone())
+                            }
+                            ResolvedSelectorValue::Integer(value) => SelectorValue::Integer(*value),
+                            ResolvedSelectorValue::Boolean(value) => SelectorValue::Boolean(*value),
+                        };
+                        (field.name.clone(), value)
+                    })
+                    .collect(),
+            }
+        })
+        .collect()
+}
+
+fn selector_value(resolved: &ResolvedAuthorization, inputs: &[SelectorInput]) -> Value {
+    Value::Object(
+        inputs
+            .iter()
+            .map(|input| {
+                let subject = resolved
+                    .subjects
+                    .iter()
+                    .find(|subject| subject.role == input.role)
+                    .expect("input role resolves");
+                let alternative = input
+                    .alternatives
+                    .iter()
+                    .find(|alternative| alternative.profile == subject.selector_profile)
+                    .expect("input profile resolves");
+                let values = alternative
+                    .fields
+                    .iter()
+                    .map(|name| {
+                        let field = subject
+                            .fields
+                            .iter()
+                            .find(|field| &field.name == name)
+                            .expect("input field resolves");
+                        (name.clone(), field.value.as_json())
+                    })
+                    .collect();
+                (
+                    input.role.clone(),
+                    json!({"profile": alternative.profile, "values": Value::Object(values)}),
+                )
+            })
+            .collect(),
+    )
+}
+
+fn audit_subjects(audit: &EvidenceAuditLog, resolved: &ResolvedAuthorization) -> Vec<AuditSubject> {
+    resolved
+        .subjects
+        .iter()
+        .map(|subject| AuditSubject {
+            role: subject.role.clone(),
+            selector_profile: subject.selector_profile.clone(),
+            selector_bundle_pseudonym: Some(
+                audit
+                    .pseudonym(
+                        "subject-selector-bundle",
+                        "selector-conformance",
+                        &subject
+                            .audit_pseudonym_input(&resolved.audience, &resolved.purpose)
+                            .expect("selector bundle canonicalizes"),
+                    )
+                    .expect("selector bundle pseudonymizes"),
+            ),
+        })
+        .collect()
+}
+
+fn audit_authority(audit: &EvidenceAuditLog, resolved: &ResolvedAuthorization) -> AuditAuthority {
+    AuditAuthority {
+        kind: match resolved.authority_kind {
+            AuthorityKind::Statutory => AuditAuthorityKind::Statutory,
+            AuthorityKind::Organizational => AuditAuthorityKind::Organizational,
+            AuthorityKind::Consent => AuditAuthorityKind::Consent,
+            AuthorityKind::Delegated => AuditAuthorityKind::Delegated,
+            AuthorityKind::ExplicitRequest => AuditAuthorityKind::ExplicitRequest,
+        },
+        grant_pseudonym: resolved.grant_id.as_deref().map(|grant| {
+            audit
+                .pseudonym("grant", "selector-conformance", grant.as_bytes())
+                .expect("grant pseudonymizes")
+        }),
+    }
+}
+
+fn source_identity(bundle: &Bundle, requirement_id: &str) -> (String, String) {
+    let requirement = bundle
+        .config
+        .requirements
+        .iter()
+        .find(|candidate| candidate.id == requirement_id)
+        .expect("requirement is configured");
+    let source = bundle
+        .config
+        .sources
+        .get(&requirement.source)
+        .expect("source is configured");
+    let adapter = Path::new(source.extract_script.as_str())
+        .file_stem()
+        .and_then(|name| name.to_str())
+        .expect("adapter has a local identifier");
+    (requirement.source.clone(), adapter.to_owned())
+}
+
+fn selector_value_canaries() -> &'static [&'static str] {
+    &[
+        "synthetic-record-001",
+        "synthetic-record-002",
+        "Ána María",
+        "N'Dour-Sato",
+        "Adaeze",
+        "Okafor",
+        "Binta",
+        "Diallo",
+        "synthetic-event-001",
+        "synthetic-alpha",
+        "fallback-client-canary",
+        "fallback-azp-canary",
+        SOURCE_TOKEN,
+    ]
+}
+
+fn assert_no_selector_material(serialized_jws: &[u8]) {
+    let jws: FlattenedJws = serde_json::from_slice(serialized_jws).expect("JWS is JSON");
+    let payload = URL_SAFE_NO_PAD
+        .decode(jws.payload)
+        .expect("JWS payload decodes");
+    let payload = String::from_utf8(payload).expect("Evidence payload is UTF-8");
+    for canary in selector_value_canaries() {
+        assert!(!payload.contains(canary));
+    }
+    for profile in [
+        "opaque-record-v1",
+        "demographics-v1",
+        "demographics-with-event-v1",
+        "opaque-coordinates-v1",
+    ] {
+        assert!(!payload.contains(profile));
+    }
+}
+
+fn declared_negative_cases() -> BTreeSet<String> {
+    const EXECUTED: &[&str] = &[
+        "missing-record-reference",
+        "extra-caller-field",
+        "wrong-origin-context-value",
+        "identifier-possession-without-entitlement",
+        "caller-values-prohibited-for-context-origin",
+        "missing-configured-context-claim",
+        "no-principal-claim-fallback",
+        "no-case-fold-or-transliteration",
+        "caller-values-prohibited-for-grant-origin",
+        "caller-added-disambiguator-rejected-from-demographics-v1",
+        "authenticated-grant-id-not-bound",
+        "authenticated-grant-authority-not-bound",
+        "incomplete-grant-valueClaims",
+        "alternative-field-set-not-inferred",
+        "swapped-role-selectors",
+        "unauthorized-subject-b-substitution",
+        "missing-one-role",
+        "duplicate-subject-role",
+        "unknown-subject-role",
+        "entitlement-union-across-roles",
+        "unknown-opaque-field",
+        "wrong-opaque-scalar-type",
+        "aggregate-size-exceeded",
+        "empty-string",
+        "invalid-date",
+        "scalar-object-or-array",
+        "field-byte-boundary-plus-one",
+        "aggregate-byte-boundary-plus-one",
+        "unauthorized-profile",
+        "unauthorized-purpose",
+        "unauthorized-audience",
+        "missing-context-valueClaims",
+        "incomplete-or-extra-valueClaims",
+        "request-origin-valueClaims",
+        "grant-id-or-authority-from-caller-request",
+        "credential-resolution-or-source-access-before-validation",
+    ];
+    let declared = matrix_negative_cases();
+    let executed = EXECUTED
+        .iter()
+        .map(|name| (*name).to_owned())
+        .collect::<BTreeSet<_>>();
+    assert_eq!(
+        declared, executed,
+        "selector matrix negative coverage drifted"
+    );
+    executed
+}
+
+fn matrix_negative_cases() -> BTreeSet<String> {
+    let text =
+        fs::read_to_string(products_root().join("fixtures/conformance/selector-matrix.yaml"))
+            .expect("selector matrix is readable");
+    let yaml: serde_norway::Value = serde_norway::from_str(&text).expect("selector matrix is YAML");
+    let json = serde_json::to_value(yaml).expect("selector matrix converts to JSON");
+    let mut names = Vec::new();
+    for profile in json["profiles"]
+        .as_array()
+        .expect("selector profiles are an array")
+    {
+        names.extend(
+            profile["negative"]
+                .as_array()
+                .expect("profile negatives are an array")
+                .iter()
+                .map(|value| {
+                    value
+                        .as_str()
+                        .expect("negative name is a string")
+                        .to_owned()
+                }),
+        );
+    }
+    names.extend(
+        json["global_negative"]
+            .as_array()
+            .expect("global negatives are an array")
+            .iter()
+            .map(|value| {
+                value
+                    .as_str()
+                    .expect("negative name is a string")
+                    .to_owned()
+            }),
+    );
+    names.into_iter().collect()
+}
+
+fn assert_invalid_bundle(mutate: impl FnOnce(&mut String)) {
+    let temporary = tempfile::tempdir().expect("temporary invalid bundle root");
+    let bundle_root = temporary.path().join("bundle");
+    fs::create_dir(&bundle_root).expect("bundle root is created");
+    copy_tree(&selector_bundle_root(), &bundle_root);
+    let config_path = bundle_root.join("evidence.yaml");
+    let mut config = fs::read_to_string(&config_path).expect("bundle config is readable");
+    mutate(&mut config);
+    fs::write(config_path, config).expect("invalid config mutation writes");
+    make_read_only(&bundle_root);
+    assert!(matches!(
+        Bundle::load(&bundle_root),
+        Err(BundleError::Config(_))
+    ));
+}
+
+fn products_root() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("../../products/evidence")
+        .canonicalize()
+        .expect("Evidence product root exists")
+}
+
+fn selector_bundle_root() -> PathBuf {
+    products_root().join("fixtures/conformance/selectors")
+}
+
+fn rewrite_source_origin(bundle_root: &Path, source_origin: &str) {
+    let path = bundle_root.join("evidence.yaml");
+    let mut text = fs::read_to_string(&path).expect("copied selector config is readable");
+    replace_exact(&mut text, "https://source.invalid", source_origin, 5);
+    fs::write(path, text).expect("deployment-only selector rewrite succeeds");
+}
+
+fn write_runtime(runtime_path: &Path, bundle_root: &Path, secret_root: &Path, audit_path: &Path) {
+    let runtime = format!(
+        concat!(
+            "version: 1\n",
+            "bundleDirectory: {}\n",
+            "listener:\n",
+            "  bindHost: 127.0.0.1\n",
+            "  port: 8080\n",
+            "  tlsTermination: operator-controlled-upstream\n",
+            "  trustProxyIdentityHeaders: false\n",
+            "  maximumRequestBytes: 65536\n",
+            "  maximumConcurrentRequests: 32\n",
+            "  requestTimeoutMilliseconds: 10000\n",
+            "  shutdownGraceMilliseconds: 30000\n",
+            "secretProviders:\n",
+            "  file:\n",
+            "    root: {}\n",
+            "auditStorage:\n",
+            "  path: {}\n",
+            "  maximumFileBytes: 10485760\n",
+            "outboundTls:\n",
+            "  systemRoots: true\n",
+            "  trustProfiles: {{}}\n"
+        ),
+        bundle_root.display(),
+        secret_root.display(),
+        audit_path.display()
+    );
+    fs::write(runtime_path, runtime).expect("closed selector runtime writes");
+}
+
+fn replace_exact(text: &mut String, from: &str, to: &str, expected: usize) {
+    assert_eq!(
+        text.matches(from).count(),
+        expected,
+        "fixture drift for {from}"
+    );
+    *text = text.replace(from, to);
+}
+
+fn write_secret(root: &Path, name: &str, value: &[u8]) {
+    let path = root.join(name);
+    fs::write(&path, value).expect("synthetic selector secret writes");
+    #[cfg(unix)]
+    fs::set_permissions(path, fs::Permissions::from_mode(0o600))
+        .expect("synthetic selector secret is owner-only");
+}
+
+fn copy_tree(source: &Path, target: &Path) {
+    for entry in fs::read_dir(source).expect("selector fixture is readable") {
+        let entry = entry.expect("selector fixture entry is readable");
+        let destination = target.join(entry.file_name());
+        if entry
+            .file_type()
+            .expect("selector fixture type is readable")
+            .is_dir()
+        {
+            fs::create_dir(&destination).expect("selector fixture directory is copied");
+            copy_tree(&entry.path(), &destination);
+        } else {
+            fs::copy(entry.path(), destination).expect("selector fixture file is copied");
+        }
+    }
+}
+
+#[cfg(unix)]
+fn make_read_only(path: &Path) {
+    for entry in fs::read_dir(path).expect("copied selector bundle is readable") {
+        let entry = entry.expect("selector bundle entry is readable");
+        let child = entry.path();
+        if entry
+            .file_type()
+            .expect("selector bundle type is readable")
+            .is_dir()
+        {
+            make_read_only(&child);
+            fs::set_permissions(&child, fs::Permissions::from_mode(0o555))
+                .expect("selector bundle directory is immutable");
+        } else {
+            fs::set_permissions(&child, fs::Permissions::from_mode(0o444))
+                .expect("selector bundle file is immutable");
+        }
+    }
+    fs::set_permissions(path, fs::Permissions::from_mode(0o555))
+        .expect("selector bundle root is immutable");
+}
+
+#[cfg(not(unix))]
+fn make_read_only(path: &Path) {
+    for entry in fs::read_dir(path).expect("copied selector bundle is readable") {
+        let entry = entry.expect("selector bundle entry is readable");
+        let child = entry.path();
+        if entry
+            .file_type()
+            .expect("selector bundle type is readable")
+            .is_dir()
+        {
+            make_read_only(&child);
+        } else {
+            let mut permissions = fs::metadata(&child)
+                .expect("selector bundle metadata")
+                .permissions();
+            permissions.set_readonly(true);
+            fs::set_permissions(child, permissions).expect("selector bundle file is immutable");
+        }
+    }
+}
diff --git a/crates/registry-evidence/tests/source_contracts.rs b/crates/registry-evidence/tests/source_contracts.rs
new file mode 100644
index 000000000..8e8cd2ef3
--- /dev/null
+++ b/crates/registry-evidence/tests/source_contracts.rs
@@ -0,0 +1,2525 @@
+//! Contract tests for exact, source-neutral HTTP/JSON execution.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs;
+#[cfg(unix)]
+use std::os::unix::fs::PermissionsExt as _;
+use std::path::Path;
+use std::process::Command;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::Arc;
+use std::time::Duration;
+
+use base64::Engine as _;
+use rcgen::{BasicConstraints, CertificateParams, IsCa, KeyPair};
+use registry_evidence::bundle::{Bundle, BundleError, RuntimeDocument};
+use registry_evidence::config::{
+    AcquisitionPosture, HttpMethod, OutboundTlsConfig, PreparationChannelPolicy, PreparationLimits,
+    SourceConfig, RESERVED_HEADER_CONTRACT_CASES,
+};
+use registry_evidence::kernel::{EvidenceConstruction, OfflineKernel, ValueProjection};
+use registry_evidence::model::{LookupResult, PublicValue, SelectorValue, SubjectBinding};
+use registry_evidence::rhai_runtime::{
+    CalendarDate, EvaluationContext, LegalLocalTime, QueryPair, RequestPartRequirement,
+    RequestParts, RequestPartsBounds, RequestPartsLimits, RhaiRuntime, RhaiRuntimeError,
+    UtcInstant, MAXIMUM_ARRAY_ITEMS, MAXIMUM_JSON_BODY_DEPTH, MAXIMUM_QUERY_NAME_BYTES,
+    MAXIMUM_QUERY_PAIRS, MAXIMUM_QUERY_VALUE_BYTES, MAXIMUM_REQUEST_PARTS_BYTES,
+    MAXIMUM_STRING_BYTES,
+};
+use registry_evidence::secrets::{SecretProvider, SecretResolver};
+use registry_evidence::signing::{jwks_document, EvidenceSigner};
+use registry_evidence::source::{
+    project_fixture_response, ResolvedSourceSelector, SourceError, SourceExecutor, SourceStatus,
+};
+use registry_evidence::verifier::{verify_flattened_jws, EvidenceVerificationPolicy};
+use registry_platform_crypto::{LocalJwkSigner, PrivateJwk, SigningProvider};
+use serde_json::{json, Value};
+use tempfile::TempDir;
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpListener;
+use tokio::task::JoinHandle;
+use tokio_rustls::rustls::pki_types::{PrivateKeyDer, PrivatePkcs8KeyDer};
+use tokio_rustls::rustls::ServerConfig;
+use tokio_rustls::TlsAcceptor;
+use wiremock::matchers::{header, method, path};
+use wiremock::{Mock, MockServer, ResponseTemplate};
+
+const SHAPE_EVIDENCE_PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"source-shape-evidence-key"}"#;
+
+fn source_config(
+    base_url: &str,
+    authentication: Value,
+    path_fields: Value,
+    fixed_headers: Value,
+    projection: Value,
+) -> SourceConfig {
+    serde_json::from_value(json!({
+        "transport": "http-json",
+        "baseUrl": base_url,
+        "posture": "record-transformed",
+        "authentication": authentication,
+        "request": {
+            "method": "POST",
+            "pathTemplate": "/v1/records/{record}",
+            "pathBindings": {
+                "record": {"role": "subject", "profile": "record-v1", "field": "record_id"}
+            },
+            "fixedHeaders": fixed_headers,
+            "selectorInputs": [{
+                "role": "subject",
+                "alternatives": [{"profile": "record-v1", "fields": path_fields}]
+            }],
+            "prepareScript": "adapters/prepare.rhai",
+            "adapterParameters": {},
+            "adapterParametersSchema": "schemas/parameters.schema.yaml",
+            "preparationLimits": {
+                "query": "allowed",
+                "jsonBody": "allowed",
+                "maximumQueryPairs": 8,
+                "maximumQueryNameBytes": 64,
+                "maximumQueryValueBytes": 256,
+                "maximumJsonDepth": 8,
+                "maximumCollectionItems": 32,
+                "maximumStringBytes": 512,
+                "maximumNormalizedBytes": 4096
+            },
+            "projection": projection,
+            "redirects": "deny",
+            "timeoutMilliseconds": 1000,
+            "maximumResponseBytes": 65536,
+            "concurrencyLimit": 4
+        },
+        "responseSchema": "schemas/response.schema.yaml",
+        "extractScript": "adapters/extract.rhai",
+        "factSchema": "schemas/facts.schema.yaml"
+    }))
+    .expect("source config deserializes")
+}
+
+fn fixed_source(base_url: &str, authentication: Value) -> SourceConfig {
+    let mut source = source_config(
+        base_url,
+        authentication,
+        json!(["record_id"]),
+        json!([]),
+        json!(["/ok"]),
+    );
+    source.request.path = Some("/data".into());
+    source.request.path_template = None;
+    source.request.path_bindings = Default::default();
+    source.request.method = registry_evidence::config::HttpMethod::POST;
+    source
+}
+
+fn oauth_source(
+    base_url: &str,
+    token_endpoint: &str,
+    placement: &str,
+    maximum_cache_seconds: u64,
+) -> SourceConfig {
+    oauth_source_with_assumed_lifetime(
+        base_url,
+        token_endpoint,
+        placement,
+        maximum_cache_seconds,
+        None,
+    )
+}
+
+fn oauth_source_with_assumed_lifetime(
+    base_url: &str,
+    token_endpoint: &str,
+    placement: &str,
+    maximum_cache_seconds: u64,
+    assumed_lifetime_seconds: Option<u64>,
+) -> SourceConfig {
+    let mut authentication = json!({
+        "kind": "oauth2-client-credentials",
+        "tokenEndpoint": token_endpoint,
+        "clientIdRef": "secret:file/oauth-client-id",
+        "clientSecretRef": "secret:file/oauth-client-secret",
+        "scope": "fixture.read",
+        "credentialPlacement": placement,
+        "maximumCacheSeconds": maximum_cache_seconds
+    });
+    if let Some(seconds) = assumed_lifetime_seconds {
+        authentication["assumedLifetimeSeconds"] = json!(seconds);
+    }
+    fixed_source(base_url, authentication)
+}
+
+fn selector(value: &str) -> ResolvedSourceSelector {
+    ResolvedSourceSelector {
+        role: "subject".into(),
+        profile: "record-v1".into(),
+        values: BTreeMap::from([("record_id".into(), SelectorValue::String(value.into()))]),
+    }
+}
+
+fn parts() -> RequestParts {
+    RequestParts {
+        query: vec![
+            QueryPair {
+                name: "filter".into(),
+                value: "first value".into(),
+            },
+            QueryPair {
+                name: "filter".into(),
+                value: "second/value%".into(),
+            },
+        ],
+        body: Some(json!({"limit": 1, "requested": ["status"]})),
+    }
+}
+
+fn resolver(entries: &[(&str, &str)]) -> (TempDir, Arc<SecretResolver>) {
+    let root = tempfile::tempdir().expect("temporary secret root");
+    for (name, value) in entries {
+        let path = root.path().join(name);
+        fs::write(&path, value).expect("write synthetic secret");
+        #[cfg(unix)]
+        fs::set_permissions(path, fs::Permissions::from_mode(0o600)).expect("protect secret");
+    }
+    let resolver = SecretResolver::new([SecretProvider::File], root.path())
+        .map(Arc::new)
+        .expect("resolver builds");
+    (root, resolver)
+}
+
+fn encoded_parameters(bytes: &[u8]) -> Vec<(String, String)> {
+    url::form_urlencoded::parse(bytes)
+        .map(|(name, value)| (name.into_owned(), value.into_owned()))
+        .collect()
+}
+
+fn query_parameters(url: &url::Url) -> Vec<(String, String)> {
+    url.query_pairs()
+        .map(|(name, value)| (name.into_owned(), value.into_owned()))
+        .collect()
+}
+
+fn contains_parameter(parameters: &[(String, String)], name: &str, value: &str) -> bool {
+    parameters
+        .iter()
+        .any(|(actual_name, actual_value)| actual_name == name && actual_value == value)
+}
+
+fn request_limits(config: &PreparationLimits) -> RequestPartsLimits {
+    fn channel(policy: PreparationChannelPolicy) -> RequestPartRequirement {
+        match policy {
+            PreparationChannelPolicy::Required => RequestPartRequirement::Required,
+            PreparationChannelPolicy::Allowed => RequestPartRequirement::Optional,
+            PreparationChannelPolicy::Forbidden => RequestPartRequirement::Forbidden,
+        }
+    }
+
+    fn configured(value: Option<u64>, fallback: usize) -> usize {
+        value
+            .map(|value| usize::try_from(value).expect("configured limit fits usize"))
+            .unwrap_or(fallback)
+    }
+
+    RequestPartsLimits::new(
+        channel(config.query),
+        channel(config.json_body),
+        RequestPartsBounds {
+            maximum_query_pairs: configured(config.maximum_query_pairs, MAXIMUM_QUERY_PAIRS),
+            maximum_query_name_bytes: configured(
+                config.maximum_query_name_bytes,
+                MAXIMUM_QUERY_NAME_BYTES,
+            ),
+            maximum_query_value_bytes: configured(
+                config.maximum_query_value_bytes,
+                MAXIMUM_QUERY_VALUE_BYTES,
+            ),
+            maximum_json_depth: configured(config.maximum_json_depth, MAXIMUM_JSON_BODY_DEPTH),
+            maximum_collection_items: configured(
+                config.maximum_collection_items,
+                MAXIMUM_ARRAY_ITEMS,
+            ),
+            maximum_string_bytes: configured(config.maximum_string_bytes, MAXIMUM_STRING_BYTES),
+            maximum_normalized_bytes: configured(
+                config.maximum_normalized_bytes,
+                MAXIMUM_REQUEST_PARTS_BYTES,
+            ),
+        },
+    )
+    .expect("fixture preparation limits satisfy the production ABI")
+}
+
+fn shape_selectors(shape: &str) -> (Value, Vec<ResolvedSourceSelector>) {
+    let (profile, values, resolved) = match shape {
+        "flat-rest" => (
+            "opaque-coordinates-v1",
+            json!({"alpha": "synthetic-alpha", "delta": 42}),
+            BTreeMap::from([
+                (
+                    "alpha".into(),
+                    SelectorValue::String("synthetic-alpha".into()),
+                ),
+                ("delta".into(), SelectorValue::Integer(42)),
+            ]),
+        ),
+        "nested-paged-rest" => (
+            "civil-record-reference-v1",
+            json!({"record_reference": "B0000000001"}),
+            BTreeMap::from([(
+                "record_reference".into(),
+                SelectorValue::String("B0000000001".into()),
+            )]),
+        ),
+        "opencrvs-event-search-json" => (
+            "civil-record-reference-v1",
+            json!({"record_reference": "TRACKING-CANARY-0001"}),
+            BTreeMap::from([(
+                "record_reference".into(),
+                SelectorValue::String("TRACKING-CANARY-0001".into()),
+            )]),
+        ),
+        _ => panic!("source-shape index contains an unknown profile"),
+    };
+    (
+        json!({"subject": {"profile": profile, "values": values}}),
+        vec![ResolvedSourceSelector {
+            role: "subject".into(),
+            profile: profile.into(),
+            values: resolved,
+        }],
+    )
+}
+
+fn source_shape_root() -> std::path::PathBuf {
+    std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("../../products/evidence/fixtures/source-shapes")
+}
+
+fn copy_fixture_tree(source: &Path, target: &Path) {
+    fs::create_dir(target).expect("fixture directory is copied");
+    for entry in fs::read_dir(source).expect("fixture directory is readable") {
+        let entry = entry.expect("fixture entry is readable");
+        let destination = target.join(entry.file_name());
+        if entry
+            .file_type()
+            .expect("fixture entry type is readable")
+            .is_dir()
+        {
+            copy_fixture_tree(&entry.path(), &destination);
+        } else {
+            fs::copy(entry.path(), destination).expect("fixture file is copied");
+        }
+    }
+}
+
+#[cfg(unix)]
+fn make_fixture_bundle_read_only(path: &Path) {
+    for entry in fs::read_dir(path).expect("fixture bundle is readable") {
+        let entry = entry.expect("fixture bundle entry is readable");
+        let child = entry.path();
+        if entry
+            .file_type()
+            .expect("fixture bundle entry type is readable")
+            .is_dir()
+        {
+            make_fixture_bundle_read_only(&child);
+        } else {
+            fs::set_permissions(child, fs::Permissions::from_mode(0o444))
+                .expect("fixture bundle file becomes read-only");
+        }
+    }
+    fs::set_permissions(path, fs::Permissions::from_mode(0o555))
+        .expect("fixture bundle directory becomes read-only");
+}
+
+fn pem(label: &str, der: &[u8]) -> String {
+    let encoded = base64::engine::general_purpose::STANDARD.encode(der);
+    let body = encoded
+        .as_bytes()
+        .chunks(64)
+        .map(|line| std::str::from_utf8(line).expect("base64 is UTF-8"))
+        .collect::<Vec<_>>()
+        .join("\n");
+    format!("-----BEGIN {label}-----\n{body}\n-----END {label}-----\n")
+}
+
+async fn spawn_private_ca_tls_server(
+    server_subject_alt_name: &str,
+) -> (std::net::SocketAddr, Vec<u8>, JoinHandle<()>) {
+    let mut ca_parameters =
+        CertificateParams::new(Vec::<String>::new()).expect("private CA parameters are valid");
+    ca_parameters.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
+    let ca_key = KeyPair::generate().expect("private CA key generates");
+    let ca_certificate = ca_parameters
+        .self_signed(&ca_key)
+        .expect("private CA certificate generates");
+
+    let server_parameters = CertificateParams::new(vec![server_subject_alt_name.to_owned()])
+        .expect("server certificate parameters are valid");
+    let server_key = KeyPair::generate().expect("server key generates");
+    let server_certificate = server_parameters
+        .signed_by(&server_key, &ca_certificate, &ca_key)
+        .expect("private CA signs server certificate");
+    let private_key = PrivateKeyDer::Pkcs8(PrivatePkcs8KeyDer::from(server_key.serialize_der()));
+    let server_config = ServerConfig::builder()
+        .with_no_client_auth()
+        .with_single_cert(vec![server_certificate.der().clone()], private_key)
+        .expect("TLS server configuration builds");
+    let acceptor = TlsAcceptor::from(Arc::new(server_config));
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("TLS test server binds");
+    let address = listener.local_addr().expect("TLS server address");
+    let handle = tokio::spawn(async move {
+        let Ok((stream, _)) = listener.accept().await else {
+            return;
+        };
+        let Ok(mut stream) = acceptor.accept(stream).await else {
+            return;
+        };
+        let mut request = Vec::with_capacity(1_024);
+        loop {
+            let mut chunk = [0_u8; 512];
+            let Ok(read) = stream.read(&mut chunk).await else {
+                return;
+            };
+            if read == 0 || request.len() + read > 8_192 {
+                return;
+            }
+            request.extend_from_slice(&chunk[..read]);
+            if request.windows(4).any(|window| window == b"\r\n\r\n") {
+                break;
+            }
+        }
+        let _ = stream
+            .write_all(
+                b"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 11\r\nConnection: close\r\n\r\n{\"ok\":true}",
+            )
+            .await;
+        let _ = stream.shutdown().await;
+    });
+    (
+        address,
+        pem("CERTIFICATE", ca_certificate.der().as_ref()).into_bytes(),
+        handle,
+    )
+}
+
+/// Accepts TCP connections, counts each one, and resets it (`RST`, not a
+/// graceful close) before any HTTP bytes are exchanged. Used to prove that a
+/// transport failure on a source's very first connection attempt does not
+/// trigger a second, silent connection.
+async fn spawn_reset_on_connect_server() -> (std::net::SocketAddr, Arc<AtomicUsize>, JoinHandle<()>)
+{
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("reset server binds");
+    let address = listener.local_addr().expect("reset server address");
+    let attempts = Arc::new(AtomicUsize::new(0));
+    let counted = Arc::clone(&attempts);
+    let handle = tokio::spawn(async move {
+        loop {
+            let Ok((stream, _)) = listener.accept().await else {
+                return;
+            };
+            counted.fetch_add(1, Ordering::SeqCst);
+            let _ = stream.set_zero_linger();
+            drop(stream);
+        }
+    });
+    (address, attempts, handle)
+}
+
+#[tokio::test]
+async fn exact_request_applies_path_query_body_headers_auth_and_projection_once() {
+    let server = MockServer::start().await;
+    Mock::given(method("POST"))
+        .and(path("/v1/records/A%20B"))
+        .and(header("accept", "application/vnd.registry+json"))
+        .and(header("x-fixed-contract", "v1"))
+        .and(header("x-source-key", "api-key-canary"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "total": 1,
+            "ignored": "private-canary",
+            "results": [{
+                "status": "ACTIVE",
+                "declaration": {
+                    "mother.personReference": "P-1",
+                    "private": "private-canary"
+                }
+            }]
+        })))
+        .expect(1)
+        .mount(&server)
+        .await;
+    let (_root, secrets) = resolver(&[("api-key", "api-key-canary")]);
+    let source = source_config(
+        &server.uri(),
+        json!({"kind": "static-api-key", "headerName": "X-Source-Key", "valueRef": "secret:file/api-key"}),
+        json!(["record_id"]),
+        json!([
+            {"name": "Accept", "value": "application/vnd.registry+json"},
+            {"name": "X-Fixed-Contract", "value": "v1"}
+        ]),
+        json!([
+            "/total",
+            "/results/*/status",
+            "/results/*/declaration/mother.personReference"
+        ]),
+    );
+    let executor = SourceExecutor::new(&source, secrets).expect("executor builds");
+    let response = executor
+        .execute(&[selector("A B")], &parts())
+        .await
+        .expect("source succeeds");
+    assert_eq!(
+        response,
+        json!({
+            "total": 1,
+            "results": [{
+                "status": "ACTIVE",
+                "declaration": {"mother.personReference": "P-1"}
+            }]
+        })
+    );
+    let requests = server.received_requests().await.expect("requests recorded");
+    assert_eq!(requests.len(), 1);
+    assert_eq!(
+        requests[0].url.query(),
+        Some("filter=first%20value&filter=second%2Fvalue%25")
+    );
+    assert_eq!(
+        requests[0]
+            .url
+            .query_pairs()
+            .map(|(name, value)| (name.into_owned(), value.into_owned()))
+            .collect::<Vec<_>>(),
+        vec![
+            ("filter".into(), "first value".into()),
+            ("filter".into(), "second/value%".into())
+        ]
+    );
+    assert_eq!(
+        serde_json::from_slice::<Value>(&requests[0].body).expect("JSON body"),
+        json!({"limit": 1, "requested": ["status"]})
+    );
+}
+
+#[test]
+fn materialized_request_reuses_path_template_query_and_body_without_auth_material() {
+    let (_root, secrets) = resolver(&[]);
+    let source = source_config(
+        "http://127.0.0.1:18080",
+        json!({"kind": "static-bearer", "tokenRef": "secret:file/missing-token"}),
+        json!(["record_id"]),
+        json!([{"name": "X-Fixed-Contract", "value": "fixed-header-canary"}]),
+        json!(["/ok"]),
+    );
+    let executor = SourceExecutor::new(&source, secrets).expect("executor builds without secrets");
+    let materialized = executor
+        .materialize_request(&[selector("A B")], &parts())
+        .expect("request materializes without credential access");
+    assert_eq!(materialized.path(), "/v1/records/A%20B");
+    assert_eq!(
+        materialized.query(),
+        Some("filter=first%20value&filter=second%2Fvalue%25")
+    );
+    assert_eq!(
+        materialized.body(),
+        Some(&json!({"limit": 1, "requested": ["status"]}))
+    );
+
+    let diagnostic = format!("{materialized:?}");
+    for protected in [
+        "127.0.0.1",
+        "A%20B",
+        "first%20value",
+        "second%2Fvalue%25",
+        "status",
+        "fixed-header-canary",
+        "missing-token",
+    ] {
+        assert!(!diagnostic.contains(protected));
+    }
+}
+
+#[tokio::test]
+async fn local_unauthenticated_loopback_source_sends_no_authentication_header() {
+    let server = MockServer::start().await;
+    Mock::given(method("POST"))
+        .and(path("/data"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({"ok": true})))
+        .expect(1)
+        .mount(&server)
+        .await;
+    let (_root, secrets) = resolver(&[]);
+    let source = fixed_source(&server.uri(), json!({"kind": "none"}));
+    let executor = SourceExecutor::new(&source, secrets).expect("local source plan compiles");
+
+    executor
+        .credentials_ready()
+        .await
+        .expect("credential-free readiness has no bootstrap");
+    assert!(
+        server
+            .received_requests()
+            .await
+            .expect("request journal")
+            .is_empty(),
+        "readiness must not contact the source"
+    );
+
+    let response = executor
+        .execute(&[selector("synthetic")], &parts())
+        .await
+        .expect("local source request succeeds");
+    assert_eq!(response, json!({"ok": true}));
+
+    let requests = server.received_requests().await.expect("request journal");
+    assert_eq!(requests.len(), 1);
+    assert!(
+        !requests[0].headers.contains_key("authorization"),
+        "credential-free source must not receive Authorization"
+    );
+
+    let forbidden_header = source_config(
+        &server.uri(),
+        json!({"kind": "none"}),
+        json!(["record_id"]),
+        json!([{"name": "Authorization", "value": "caller-controlled"}]),
+        json!(["/ok"]),
+    );
+    assert_eq!(
+        SourceExecutor::new(&forbidden_header, resolver(&[]).1).err(),
+        Some(SourceError::InvalidPlan),
+        "fixed headers cannot recreate authentication in local mode"
+    );
+
+    for invalid_origin in [
+        "https://127.0.0.1:18081",
+        "http://127.0.0.1",
+        "http://localhost:18081",
+    ] {
+        let invalid = fixed_source(invalid_origin, json!({"kind": "none"}));
+        assert_eq!(
+            SourceExecutor::new(&invalid, resolver(&[]).1).err(),
+            Some(SourceError::InvalidPlan),
+            "executor rejected unauthenticated origin {invalid_origin}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn hostile_path_values_and_malformed_preparation_fail_before_transport_and_redact() {
+    let server = MockServer::start().await;
+    let (_root, secrets) = resolver(&[("token", "credential-canary")]);
+    let source = source_config(
+        &server.uri(),
+        json!({"kind": "static-bearer", "tokenRef": "secret:file/token"}),
+        json!(["record_id"]),
+        json!([]),
+        json!(["/ok"]),
+    );
+    let executor = SourceExecutor::new(&source, secrets).expect("executor builds");
+    for hostile in [".", "..", "a/b", "a\\b", "a%2Fb", "a\nb"] {
+        let error = executor
+            .execute(
+                &[selector(hostile)],
+                &RequestParts {
+                    query: vec![],
+                    body: None,
+                },
+            )
+            .await
+            .expect_err("hostile path value fails");
+        let diagnostic = format!("{error:?} {error}");
+        assert!(!diagnostic.contains(hostile));
+        assert!(!diagnostic.contains("credential-canary"));
+    }
+    let error = executor
+        .execute(
+            &[selector("safe")],
+            &RequestParts {
+                query: vec![QueryPair {
+                    name: "x\r\nInjected".into(),
+                    value: "v".into(),
+                }],
+                body: None,
+            },
+        )
+        .await
+        .expect_err("header-style query injection fails");
+    assert_eq!(error, SourceError::InvalidPlan);
+    assert!(server
+        .received_requests()
+        .await
+        .expect("requests")
+        .is_empty());
+}
+
+#[tokio::test]
+async fn path_binding_contract_rejects_empty_missing_and_extra_material_before_credentials() {
+    let (_empty_root, empty_secrets) = resolver(&[]);
+    let base = source_config(
+        "http://127.0.0.1:18080",
+        json!({"kind": "static-bearer", "tokenRef": "secret:file/missing-token"}),
+        json!(["record_id"]),
+        json!([]),
+        json!(["/ok"]),
+    );
+    for (case_id, template) in [
+        ("empty-placeholder", "/v1/records/{}"),
+        ("missing-binding", "/v1/records/{missing}"),
+        ("extra-binding", "/v1/records"),
+    ] {
+        let mut source = base.clone();
+        source.request.path_template = Some(template.to_owned());
+        assert_eq!(
+            SourceExecutor::new(&source, Arc::clone(&empty_secrets)).err(),
+            Some(SourceError::InvalidPlan),
+            "{case_id}: invalid template/binding closure is rejected"
+        );
+    }
+
+    let server = MockServer::start().await;
+    let mut source = base;
+    source.base_url = server.uri();
+    let executor = SourceExecutor::new(&source, empty_secrets).expect("valid path plan compiles");
+    let mut missing_field = selector("unused");
+    missing_field.values.clear();
+    let mut extra_field = selector("record");
+    extra_field.values.insert(
+        "extra".to_owned(),
+        SelectorValue::String("canary".to_owned()),
+    );
+    let extra_role = ResolvedSourceSelector {
+        role: "other".to_owned(),
+        profile: "record-v1".to_owned(),
+        values: BTreeMap::from([(
+            "record_id".to_owned(),
+            SelectorValue::String("canary".to_owned()),
+        )]),
+    };
+    for (case_id, selectors, expected) in [
+        (
+            "empty-path-value",
+            vec![selector("")],
+            SourceError::InvalidSelectors,
+        ),
+        (
+            "missing-path-field",
+            vec![missing_field],
+            SourceError::InvalidSelectors,
+        ),
+        (
+            "extra-path-field",
+            vec![extra_field],
+            SourceError::InvalidSelectors,
+        ),
+        (
+            "extra-selector-role",
+            vec![selector("record"), extra_role],
+            SourceError::InvalidSelectors,
+        ),
+        (
+            "missing-selector-role",
+            vec![],
+            SourceError::InvalidSelectors,
+        ),
+    ] {
+        let error = executor
+            .execute(
+                &selectors,
+                &RequestParts {
+                    query: vec![],
+                    body: None,
+                },
+            )
+            .await
+            .expect_err("invalid path material fails before credentials");
+        assert_eq!(error, expected, "{case_id}: exact source error");
+        let diagnostic = format!("{error:?} {error}");
+        assert!(!diagnostic.contains("canary"));
+        assert!(!diagnostic.contains("missing-token"));
+    }
+    assert!(server
+        .received_requests()
+        .await
+        .expect("request journal")
+        .is_empty());
+}
+
+#[tokio::test]
+async fn get_body_is_rejected_before_static_or_oauth_credential_acquisition() {
+    let token_server = MockServer::start().await;
+    let data_server = MockServer::start().await;
+    let (_empty_root, empty_secrets) = resolver(&[]);
+
+    let mut static_source = fixed_source(
+        &data_server.uri(),
+        json!({"kind": "static-bearer", "tokenRef": "secret:file/missing-token"}),
+    );
+    static_source.request.method = HttpMethod::GET;
+    static_source.request.preparation_limits.json_body = PreparationChannelPolicy::Forbidden;
+    let static_executor =
+        SourceExecutor::new(&static_source, Arc::clone(&empty_secrets)).expect("valid GET builds");
+    assert_eq!(
+        static_executor
+            .execute(
+                &[selector("record")],
+                &RequestParts {
+                    query: vec![],
+                    body: Some(json!({"prohibited": true})),
+                },
+            )
+            .await,
+        Err(SourceError::InvalidPlan)
+    );
+
+    let mut oauth = oauth_source(
+        &data_server.uri(),
+        &format!("{}/token", token_server.uri()),
+        "form-body",
+        60,
+    );
+    oauth.request.method = HttpMethod::GET;
+    oauth.request.preparation_limits.json_body = PreparationChannelPolicy::Forbidden;
+    let oauth_executor =
+        SourceExecutor::new(&oauth, empty_secrets).expect("valid OAuth GET builds");
+    assert_eq!(
+        oauth_executor
+            .execute(
+                &[selector("record")],
+                &RequestParts {
+                    query: vec![],
+                    body: Some(json!({"prohibited": true})),
+                },
+            )
+            .await,
+        Err(SourceError::InvalidPlan)
+    );
+    assert!(token_server
+        .received_requests()
+        .await
+        .expect("token journal")
+        .is_empty());
+    assert!(data_server
+        .received_requests()
+        .await
+        .expect("data journal")
+        .is_empty());
+
+    let mut invalid_get = static_source;
+    invalid_get.request.preparation_limits.json_body = PreparationChannelPolicy::Allowed;
+    assert_eq!(
+        SourceExecutor::new(&invalid_get, resolver(&[]).1).err(),
+        Some(SourceError::InvalidPlan)
+    );
+}
+
+#[tokio::test]
+async fn every_frozen_source_shape_executes_through_production_materialization_and_projection() {
+    let root = source_shape_root();
+    let index: Value = serde_norway::from_str(
+        &fs::read_to_string(root.join("index.yaml")).expect("source-shape index is readable"),
+    )
+    .expect("source-shape index parses");
+    let profiles = index["profiles"]
+        .as_array()
+        .expect("source-shape profiles are an array");
+    let declared = profiles
+        .iter()
+        .map(|profile| profile["id"].as_str().expect("profile id"))
+        .collect::<BTreeSet<_>>();
+    assert_eq!(
+        declared,
+        BTreeSet::from([
+            "flat-rest",
+            "nested-paged-rest",
+            "opencrvs-event-search-json",
+        ])
+    );
+
+    let runtime = RhaiRuntime::new();
+    let mut matched_facts = BTreeMap::new();
+    for profile in profiles {
+        let id = profile["id"].as_str().expect("profile id");
+        let directory = root.join(profile["path"].as_str().expect("profile path"));
+        let contract: Value = serde_norway::from_str(
+            &fs::read_to_string(directory.join("contract.yaml"))
+                .expect("source-shape contract is readable"),
+        )
+        .expect("source-shape contract parses");
+        assert_eq!(contract["synthetic_only"], json!(true));
+        let server = MockServer::start().await;
+        let mut source_value = contract["validated_source_definition"].clone();
+        source_value["baseUrl"] = json!(server.uri());
+        if id == "opencrvs-event-search-json" {
+            source_value["authentication"]["tokenEndpoint"] =
+                json!(format!("{}/oauth/token", server.uri()));
+        }
+        let source: SourceConfig =
+            serde_json::from_value(source_value).expect("validated source definition is typed");
+        let preparation = runtime
+            .compile_preparation(
+                &fs::read_to_string(directory.join(source.request.prepare_script.as_str()))
+                    .expect("preparation script is readable"),
+            )
+            .expect("preparation script compiles");
+        let extraction = runtime
+            .compile_extraction(
+                &fs::read_to_string(directory.join(source.extract_script.as_str()))
+                    .expect("extraction script is readable"),
+            )
+            .expect("extraction script compiles");
+        let fact_schema_value: Value = serde_norway::from_str(
+            &fs::read_to_string(directory.join(source.fact_schema.as_str()))
+                .expect("fact schema is readable"),
+        )
+        .expect("fact schema parses");
+        let fact_schema =
+            jsonschema::JSONSchema::compile(&fact_schema_value).expect("fact schema compiles");
+        let response_schema_value: Value = serde_norway::from_str(
+            &fs::read_to_string(directory.join(source.response_schema.as_str()))
+                .expect("response schema is readable"),
+        )
+        .expect("response schema parses");
+        let response_schema = jsonschema::JSONSchema::options()
+            .should_validate_formats(true)
+            .compile(&response_schema_value)
+            .expect("response schema compiles");
+        let parameters = serde_json::to_value(&source.request.adapter_parameters)
+            .expect("adapter parameters serialize");
+        let (script_selectors, transport_selectors) = shape_selectors(id);
+        let prepared = runtime
+            .prepare(
+                &preparation,
+                &script_selectors,
+                &parameters,
+                &request_limits(&source.request.preparation_limits),
+            )
+            .expect("shape request preparation succeeds");
+        let expected_request = &contract["request"];
+        assert_eq!(
+            prepared.body.as_ref(),
+            match expected_request["body"].as_str() {
+                Some("absent") => None,
+                _ => Some(&expected_request["body"]),
+            },
+            "{id}: prepared body differs from the committed contract"
+        );
+        let expected_query = expected_request["query_order"]
+            .as_array()
+            .map(|order| {
+                order
+                    .iter()
+                    .map(|name| {
+                        let name = name.as_str().expect("query-order name");
+                        (
+                            name.to_owned(),
+                            expected_request["query"][name]
+                                .as_str()
+                                .expect("query value")
+                                .to_owned(),
+                        )
+                    })
+                    .collect::<Vec<_>>()
+            })
+            .unwrap_or_default();
+        assert!(
+            prepared
+                .query
+                .iter()
+                .map(|pair| (pair.name.clone(), pair.value.clone()))
+                .eq(expected_query.clone()),
+            "{id}: prepared query differs from the committed contract"
+        );
+        let (secret_entries, expected_authorization) = match id {
+            "flat-rest" => (
+                vec![("fixture-flat-rest-token", "shape-static-bearer-canary")],
+                "Bearer shape-static-bearer-canary".to_owned(),
+            ),
+            "nested-paged-rest" => (
+                vec![
+                    ("fixture-nested-rest-username", "shape-basic-user-canary"),
+                    (
+                        "fixture-nested-rest-password",
+                        "shape-basic-password-canary",
+                    ),
+                ],
+                format!(
+                    "Basic {}",
+                    base64::engine::general_purpose::STANDARD
+                        .encode("shape-basic-user-canary:shape-basic-password-canary")
+                ),
+            ),
+            "opencrvs-event-search-json" => (
+                vec![
+                    (
+                        "fixture-event-search-client-id",
+                        "shape-oauth-client-canary",
+                    ),
+                    (
+                        "fixture-event-search-client-secret",
+                        "shape-oauth-secret-canary",
+                    ),
+                ],
+                "Bearer shape-oauth-access-token-canary".to_owned(),
+            ),
+            _ => unreachable!("closed source-shape profiles"),
+        };
+        let (_secret_root, secrets) = resolver(&secret_entries);
+        let executor = SourceExecutor::new(&source, secrets).expect("source plan compiles");
+        let match_response: Value = serde_json::from_slice(
+            &fs::read(directory.join("responses/match.json"))
+                .expect("match response fixture is readable"),
+        )
+        .expect("match response fixture is JSON");
+        if id == "opencrvs-event-search-json" {
+            // The reference shape returns only access_token and token_type.
+            // Adding a lifetime here would make the mock more compliant than
+            // the provider it models and hide the assumed-lifetime path.
+            Mock::given(method("POST"))
+                .and(path("/oauth/token"))
+                .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+                    "access_token": "shape-oauth-access-token-canary",
+                    "token_type": "Bearer"
+                })))
+                .expect(1)
+                .mount(&server)
+                .await;
+        }
+        Mock::given(method(
+            expected_request["method"].as_str().expect("request method"),
+        ))
+        .and(path(
+            expected_request["path"].as_str().expect("request path"),
+        ))
+        .respond_with(ResponseTemplate::new(200).set_body_json(match_response))
+        .expect(1)
+        .mount(&server)
+        .await;
+        let materialized = executor
+            .materialize_request(&transport_selectors, &prepared)
+            .expect("production request materialization succeeds");
+        assert_eq!(
+            materialized.path(),
+            expected_request["path"].as_str().expect("request path")
+        );
+        assert_eq!(
+            materialized.query().map(|query| {
+                url::form_urlencoded::parse(query.as_bytes())
+                    .map(|(name, value)| (name.into_owned(), value.into_owned()))
+                    .collect::<Vec<_>>()
+            }),
+            (!expected_query.is_empty()).then_some(expected_query.clone()),
+            "{id}: production query materialization drifted"
+        );
+        assert_eq!(materialized.body(), prepared.body.as_ref());
+
+        let projected = executor
+            .execute(&transport_selectors, &prepared)
+            .await
+            .expect("frozen shape executes through the production transport");
+        // Every committed cardinality response of the shape has to sit inside the
+        // declared response schema, because the runtime refuses the response
+        // before extraction otherwise.
+        for case in ["match", "no-match", "ambiguous", "missing-fact"] {
+            let recorded: Value = serde_json::from_slice(
+                &fs::read(directory.join(format!("responses/{case}.json")))
+                    .expect("cardinality response fixture is readable"),
+            )
+            .expect("cardinality response fixture is JSON");
+            let recorded = project_fixture_response(&source, &recorded)
+                .expect("cardinality response fixture projects");
+            assert!(
+                response_schema.is_valid(&recorded),
+                "{id}: committed {case} response is outside the declared response schema"
+            );
+        }
+        assert!(
+            response_schema.is_valid(&projected),
+            "{id}: transport-backed response is outside the declared response schema"
+        );
+        let facts = match runtime
+            .extract(&extraction, &projected, &parameters, &fact_schema)
+            .expect("projected transport response extracts")
+        {
+            LookupResult::Match(facts) => facts,
+            _ => panic!("{id}: transport-backed match returned a non-match outcome"),
+        };
+        matched_facts.insert(id.to_owned(), facts.clone());
+
+        let requests = server
+            .received_requests()
+            .await
+            .expect("source-shape request journal is available");
+        let data_requests = requests
+            .iter()
+            .filter(|request| {
+                request.url.path() == expected_request["path"].as_str().expect("request path")
+            })
+            .collect::<Vec<_>>();
+        assert_eq!(data_requests.len(), 1, "{id}: exact evidence-data count");
+        let data_request = data_requests[0];
+        assert_eq!(
+            data_request.method.as_str(),
+            expected_request["method"].as_str().expect("request method")
+        );
+        assert_eq!(
+            query_parameters(&data_request.url),
+            expected_query,
+            "{id}: exact data query"
+        );
+        assert!(
+            data_request
+                .headers
+                .get("authorization")
+                .and_then(|value| value.to_str().ok())
+                .is_some_and(|value| value == expected_authorization),
+            "{id}: exact evidence-data authentication"
+        );
+        for (name, value) in expected_request["headers"]
+            .as_object()
+            .expect("reviewed request headers are an object")
+        {
+            if name == "authorization" {
+                continue;
+            }
+            assert!(
+                data_request
+                    .headers
+                    .get(name)
+                    .and_then(|actual| actual.to_str().ok())
+                    .is_some_and(|actual| actual == value.as_str().expect("header value")),
+                "{id}: exact reviewed header {name}"
+            );
+        }
+        match prepared.body.as_ref() {
+            Some(expected) => assert_eq!(
+                serde_json::from_slice::<Value>(&data_request.body)
+                    .expect("evidence-data body is JSON"),
+                *expected,
+                "{id}: exact evidence-data body"
+            ),
+            None => assert!(data_request.body.is_empty(), "{id}: body remains absent"),
+        }
+        if id == "opencrvs-event-search-json" {
+            let token_requests = requests
+                .iter()
+                .filter(|request| request.url.path() == "/oauth/token")
+                .collect::<Vec<_>>();
+            assert_eq!(token_requests.len(), 1, "exact OAuth bootstrap count");
+            // The reference shape accepts the client credentials in the token
+            // request body, so no credential may appear in the token URL.
+            assert!(
+                query_parameters(&token_requests[0].url).is_empty(),
+                "OAuth bootstrap URL carries no query"
+            );
+            let form = encoded_parameters(&token_requests[0].body);
+            assert!(
+                form.len() == 4
+                    && contains_parameter(&form, "grant_type", "client_credentials")
+                    && contains_parameter(&form, "scope", "fixture.read")
+                    && contains_parameter(&form, "client_id", "shape-oauth-client-canary")
+                    && contains_parameter(&form, "client_secret", "shape-oauth-secret-canary"),
+                "OAuth bootstrap body is the exact reviewed shape"
+            );
+            assert!(token_requests[0].headers.get("authorization").is_none());
+            assert_eq!(
+                token_requests[0]
+                    .headers
+                    .get("content-type")
+                    .and_then(|value| value.to_str().ok()),
+                Some("application/x-www-form-urlencoded")
+            );
+            assert_eq!(
+                token_requests[0]
+                    .headers
+                    .get("accept")
+                    .and_then(|value| value.to_str().ok()),
+                Some("application/json")
+            );
+            assert_eq!(requests.len(), 2);
+        } else {
+            assert_eq!(requests.len(), 1);
+        }
+
+        let mut response_files = fs::read_dir(directory.join("responses"))
+            .expect("response fixture directory is readable")
+            .map(|entry| entry.expect("response fixture entry").path())
+            .filter(|path| path.extension().and_then(|value| value.to_str()) == Some("json"))
+            .collect::<Vec<_>>();
+        response_files.sort();
+        let names = response_files
+            .iter()
+            .map(|path| {
+                path.file_name()
+                    .and_then(|value| value.to_str())
+                    .expect("response fixture name")
+            })
+            .collect::<BTreeSet<_>>();
+        for required in [
+            "ambiguous.json",
+            "error-envelope.json",
+            "match.json",
+            "missing-fact.json",
+            "no-match.json",
+        ] {
+            assert!(
+                names.contains(required),
+                "{id}: required outcome {required} is absent"
+            );
+        }
+
+        for response_path in response_files {
+            let name = response_path
+                .file_name()
+                .and_then(|value| value.to_str())
+                .expect("response fixture name");
+            let response: Value = serde_json::from_slice(
+                &fs::read(&response_path).expect("response fixture is readable"),
+            )
+            .expect("response fixture is JSON");
+            let projected = project_fixture_response(&source, &response);
+            if name == "error-envelope.json" {
+                assert_eq!(projected, Err(SourceError::ErrorEnvelope));
+                continue;
+            }
+            let projected = projected.expect("response projection succeeds");
+            let lookup = runtime.extract(&extraction, &projected, &parameters, &fact_schema);
+            match name {
+                "match.json" => match lookup.expect("match extraction succeeds") {
+                    LookupResult::Match(direct_facts) => assert_eq!(
+                        direct_facts, facts,
+                        "{id}: direct fixture and real transport extraction drifted"
+                    ),
+                    _ => panic!("{id}: match fixture returned a non-match outcome"),
+                },
+                "no-match.json" => assert!(matches!(lookup, Ok(LookupResult::NoMatch))),
+                "ambiguous.json" => assert!(matches!(lookup, Ok(LookupResult::Ambiguous))),
+                "missing-fact.json" => {
+                    assert_eq!(lookup, Err(RhaiRuntimeError::FactSchema));
+                }
+                "inconsistent-cardinality.json" => {
+                    assert_eq!(lookup, Err(RhaiRuntimeError::SourceProtocol));
+                }
+                _ => panic!("{id}: unclassified response fixture {name}"),
+            }
+        }
+    }
+
+    let acceptance_copy = tempfile::tempdir().expect("temporary acceptance bundle root");
+    let acceptance_root = acceptance_copy.path().join("residence-region");
+    copy_fixture_tree(
+        &Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("../../products/evidence/fixtures/acceptance/residence-region"),
+        &acceptance_root,
+    );
+    make_fixture_bundle_read_only(&acceptance_root);
+    let kernel = OfflineKernel::compile(Arc::new(
+        Bundle::load(&acceptance_root).expect("immutable residence acceptance bundle loads"),
+    ))
+    .expect("residence acceptance kernel compiles");
+    let requirement = "urn:example:fixture:requirement:residence-region:v1";
+    let observed_at = "2026-08-02T00:00:00Z"
+        .parse()
+        .expect("fixed observation time parses");
+    let private = PrivateJwk::parse(SHAPE_EVIDENCE_PRIVATE_JWK).expect("test signing key parses");
+    let provider: Arc<dyn SigningProvider> =
+        Arc::new(LocalJwkSigner::new(private).expect("test signing provider builds"));
+    let signer = EvidenceSigner::initialize(provider, "source-shape-evidence-key")
+        .await
+        .expect("test signer passes its self-test");
+    let jwks =
+        jwks_document(signer.public_jwk(), std::iter::empty()).expect("test public key publishes");
+
+    for shape in ["flat-rest", "nested-paged-rest"] {
+        let values = kernel
+            .derive_and_validate(
+                requirement,
+                matched_facts.get(shape).expect("shape match facts exist"),
+                observed_at,
+                ValueProjection {
+                    audience: "https://relying.invalid/residence-procedure",
+                    binding_key: b"source-shape-binding-key-32-bytes-minimum",
+                    binding_key_version: 1,
+                },
+            )
+            .expect("real residence derivation and immutable output gate succeed");
+        assert_eq!(values.as_slice().len(), 1);
+        assert_eq!(
+            values.as_slice()[0].provides_value_for,
+            "urn:example:fixture:concept:residence-region"
+        );
+        assert_eq!(
+            values.as_slice()[0].value,
+            PublicValue::String("REGION-NORTH".to_owned()),
+            "{shape}: source-shape swap changed the governed controlled code"
+        );
+        let evidence = kernel
+            .construct_evidence(
+                requirement,
+                values,
+                EvidenceConstruction {
+                    evidence_id: "urn:ulid:01J4BRXQ0ZZZZZZZZZZZZZZZZZ",
+                    request_nonce: registry_evidence::model::OFFLINE_EVALUATION_REQUEST_NONCE,
+                    purpose: "fixture-routing",
+                    audience: "https://relying.invalid/residence-procedure",
+                    issued_at: observed_at,
+                    observed_at,
+                    subjects: vec![SubjectBinding {
+                        role: "subject".to_owned(),
+                        binding: format!("urn:evidence:subject:v1_{}", "A".repeat(43)),
+                    }],
+                },
+            )
+            .expect("real residence Evidence constructs");
+        let jws = signer
+            .sign_json(&evidence)
+            .await
+            .expect("real residence Evidence signs");
+        let serialized = serde_json::to_vec(&jws).expect("flattened JWS serializes");
+        let mut policy = EvidenceVerificationPolicy::from_accepted_transaction(
+            &evidence,
+            registry_evidence::model::OFFLINE_EVALUATION_REQUEST_NONCE,
+            Duration::from_secs(31_536_000),
+            observed_at,
+            Duration::from_secs(0),
+        );
+        policy.issued_by = "urn:example:fixture:issuer:authority".to_owned();
+        policy.provided_by = "urn:example:fixture:provider:evidence".to_owned();
+        policy.requirement = requirement.to_owned();
+        policy.evidence_type = "urn:example:fixture:evidence-type:residence-region:v1".to_owned();
+        policy.purpose = "fixture-routing".to_owned();
+        policy.audience = "https://relying.invalid/residence-procedure".to_owned();
+        policy.configuration_revision = kernel.bundle().revision().to_owned();
+        let verified = verify_flattened_jws(&serialized, &jwks, &policy)
+            .expect("signed residence Evidence verifies under the exact relying policy");
+        assert_eq!(
+            verified.supported_values[0].value,
+            PublicValue::String("REGION-NORTH".to_owned())
+        );
+    }
+}
+
+#[tokio::test]
+async fn every_acquisition_posture_fixture_executes_with_one_bounded_request() {
+    let fixture: Value = serde_norway::from_str(include_str!(
+        "../../../products/evidence/fixtures/conformance/acquisition-postures.yaml"
+    ))
+    .expect("acquisition-posture fixture parses");
+    let cases = fixture["cases"]
+        .as_array()
+        .expect("acquisition-posture cases are an array");
+    let runtime = RhaiRuntime::new();
+    let preparation = runtime
+        .compile_preparation("fn prepare(selectors, parameters) { #{query: [], body: #{}} }")
+        .expect("common posture preparation compiles");
+    let mut executed = BTreeSet::new();
+
+    for case in cases {
+        let posture_name = case["posture"].as_str().expect("posture name");
+        executed.insert(posture_name.to_owned());
+        let (posture, derived_fact, expected_claim, expected_negative) = match posture_name {
+            "source-derived" => (
+                AcquisitionPosture::SourceDerived,
+                "final_code",
+                "acquisition and disclosure minimization",
+                "source-returns-undeclared-field",
+            ),
+            "field-projected" => (
+                AcquisitionPosture::FieldProjected,
+                "fact_b",
+                "strong acquisition and disclosure minimization",
+                "fixed-projection-expanded",
+            ),
+            "record-transformed" => (
+                AcquisitionPosture::RecordTransformed,
+                "fact_a",
+                "disclosure minimization only",
+                "full-lifecycle-minimization-overclaim",
+            ),
+            _ => panic!("unknown acquisition posture fixture case"),
+        };
+        assert_eq!(case["expected_claim"], json!(expected_claim));
+        assert_eq!(case["negative"], json!(expected_negative));
+        let declared_facts = case["declared_facts"]
+            .as_array()
+            .expect("declared facts are an array")
+            .iter()
+            .map(|value| value.as_str().expect("declared fact").to_owned())
+            .collect::<Vec<_>>();
+        let mut response = case["source_response"].clone();
+        response["result"]["undeclared_source_canary"] = json!("never-project-this-value");
+
+        let server = MockServer::start().await;
+        Mock::given(method("POST"))
+            .and(path("/data"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(response))
+            .expect(1)
+            .mount(&server)
+            .await;
+        let (_root, secrets) = resolver(&[("token", "synthetic-posture-token")]);
+        let mut source = fixed_source(
+            &server.uri(),
+            json!({"kind": "static-bearer", "tokenRef": "secret:file/token"}),
+        );
+        source.posture = posture;
+        source.request.projection = std::iter::once("/total".to_owned())
+            .chain(declared_facts.iter().map(|fact| format!("/result/{fact}")))
+            .collect();
+        let prepared = runtime
+            .prepare(
+                &preparation,
+                &json!({}),
+                &json!({}),
+                &request_limits(&source.request.preparation_limits),
+            )
+            .expect("common posture preparation succeeds");
+        let projected = SourceExecutor::new(&source, secrets)
+            .expect("posture source compiles")
+            .execute(&[selector("record")], &prepared)
+            .await
+            .expect("posture source request succeeds");
+        assert!(!serde_json::to_string(&projected)
+            .expect("projected response serializes")
+            .contains("never-project-this-value"));
+
+        let facts_body = declared_facts
+            .iter()
+            .map(|fact| format!("{fact}: source_response[\"result\"][\"{fact}\"]"))
+            .collect::<Vec<_>>()
+            .join(",");
+        let extraction = runtime
+            .compile_extraction(&format!(
+                "fn extract(source_response, parameters) {{ #{{outcome: \"match\", facts: #{{{facts_body}}}}} }}"
+            ))
+            .expect("posture extraction compiles");
+        let properties = declared_facts
+            .iter()
+            .map(|fact| (fact.clone(), json!({})))
+            .collect::<serde_json::Map<String, Value>>();
+        let schema = jsonschema::JSONSchema::compile(&json!({
+            "type": "object",
+            "additionalProperties": false,
+            "required": declared_facts,
+            "properties": properties
+        }))
+        .expect("posture fact schema compiles");
+        let facts = match runtime
+            .extract(&extraction, &projected, &json!({}), &schema)
+            .expect("posture extraction succeeds")
+        {
+            LookupResult::Match(facts) => facts,
+            _ => panic!("posture extraction returned a non-match outcome"),
+        };
+        let derivation = runtime
+            .compile_derivation(&format!(
+                "fn derive(facts, selectors, evaluation_context) {{ [#{{concept_id: \"posture-result\", value: facts[\"{derived_fact}\"]}}] }}"
+            ))
+            .expect("posture derivation compiles");
+        let derived = runtime
+            .derive(
+                &derivation,
+                &facts,
+                &json!({}),
+                EvaluationContext::new(
+                    UtcInstant::parse("2026-08-02T00:00:00Z").expect("instant"),
+                    CalendarDate::parse("2026-08-02").expect("date"),
+                    LegalLocalTime::parse("07:00:00+07:00").expect("local time"),
+                    &json!({}),
+                    BTreeMap::new(),
+                )
+                .expect("evaluation context"),
+            )
+            .expect("posture derivation succeeds");
+        assert!(derived.len() == 1 && derived[0].concept_id == "posture-result");
+        assert_eq!(
+            server
+                .received_requests()
+                .await
+                .expect("request journal")
+                .len(),
+            1
+        );
+    }
+
+    assert_eq!(
+        executed,
+        BTreeSet::from([
+            "field-projected".to_owned(),
+            "record-transformed".to_owned(),
+            "source-derived".to_owned(),
+        ])
+    );
+}
+
+#[tokio::test]
+async fn basic_bearer_and_static_api_key_headers_are_exact_and_failures_are_redacted() {
+    let cases = [
+        (
+            json!({"kind": "basic", "usernameRef": "secret:file/user", "passwordRef": "secret:file/password"}),
+            vec![("user", "basic-user"), ("password", "basic-password")],
+            "authorization",
+            format!(
+                "Basic {}",
+                base64::Engine::encode(
+                    &base64::engine::general_purpose::STANDARD,
+                    "basic-user:basic-password"
+                )
+            ),
+        ),
+        (
+            json!({"kind": "static-bearer", "tokenRef": "secret:file/token"}),
+            vec![("token", "bearer-token")],
+            "authorization",
+            "Bearer bearer-token".into(),
+        ),
+        (
+            json!({"kind": "static-api-key", "headerName": "X-Api-Key", "valueRef": "secret:file/key"}),
+            vec![("key", "static-key")],
+            "x-api-key",
+            "static-key".into(),
+        ),
+    ];
+    for (authentication, entries, header_name, header_value) in cases {
+        let server = MockServer::start().await;
+        Mock::given(method("POST"))
+            .and(path("/data"))
+            .and(header(header_name, header_value.as_str()))
+            .respond_with(ResponseTemplate::new(200).set_body_json(json!({"ok": true})))
+            .expect(1)
+            .mount(&server)
+            .await;
+        let (_root, secrets) = resolver(&entries);
+        let source = fixed_source(&server.uri(), authentication);
+        let executor = SourceExecutor::new(&source, secrets).expect("executor builds");
+        executor
+            .execute(
+                &[selector("record")],
+                &RequestParts {
+                    query: vec![],
+                    body: Some(json!({})),
+                },
+            )
+            .await
+            .expect("authenticated request succeeds");
+    }
+}
+
+async fn assert_oauth_success_matrix_case(placement: &str, maximum_cache_seconds: u64) {
+    let server = MockServer::start().await;
+    let client_id = format!("client-id-{}", ulid::Ulid::new());
+    let client_secret = format!("client-secret-{}", ulid::Ulid::new());
+    let access_token = format!("access-token-{}", ulid::Ulid::new());
+    let expected_token_requests: usize = if maximum_cache_seconds == 0 { 2 } else { 1 };
+
+    Mock::given(method("POST"))
+        .and(path("/token"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "access_token": access_token.clone(),
+            "token_type": "Bearer",
+            "expires_in": 120,
+            "scope": "fixture.read"
+        })))
+        .expect(expected_token_requests as u64)
+        .mount(&server)
+        .await;
+    Mock::given(method("POST"))
+        .and(path("/data"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({"ok": true})))
+        .expect(2)
+        .mount(&server)
+        .await;
+
+    let (_root, secrets) = resolver(&[
+        ("oauth-client-id", client_id.as_str()),
+        ("oauth-client-secret", client_secret.as_str()),
+    ]);
+    let source = oauth_source(
+        &server.uri(),
+        &format!("{}/token", server.uri()),
+        placement,
+        maximum_cache_seconds,
+    );
+    let executor = SourceExecutor::new(&source, secrets).expect("OAuth executor builds");
+    for _ in 0..2 {
+        executor
+            .execute(
+                &[selector("record")],
+                &RequestParts {
+                    query: vec![],
+                    body: Some(json!({})),
+                },
+            )
+            .await
+            .expect("OAuth-authenticated source request succeeds");
+    }
+
+    let requests = server.received_requests().await.expect("request journal");
+    let token_requests = requests
+        .iter()
+        .filter(|request| request.url.path() == "/token")
+        .collect::<Vec<_>>();
+    let data_requests = requests
+        .iter()
+        .filter(|request| request.url.path() == "/data")
+        .collect::<Vec<_>>();
+    assert!(
+        token_requests.len() == expected_token_requests,
+        "unexpected OAuth token request count"
+    );
+    assert!(
+        data_requests.len() == 2,
+        "unexpected evidence-data request count"
+    );
+    assert!(data_requests.iter().all(|request| {
+        request
+            .headers
+            .get("authorization")
+            .and_then(|value| value.to_str().ok())
+            .is_some_and(|value| value == format!("Bearer {access_token}"))
+    }));
+
+    for request in token_requests {
+        let query = query_parameters(&request.url);
+        let form = encoded_parameters(&request.body);
+        match placement {
+            "basic-header" => {
+                let expected = format!(
+                    "Basic {}",
+                    base64::Engine::encode(
+                        &base64::engine::general_purpose::STANDARD,
+                        format!("{client_id}:{client_secret}")
+                    )
+                );
+                assert!(query.is_empty(), "Basic placement added token query fields");
+                assert!(
+                    form.len() == 2
+                        && contains_parameter(&form, "grant_type", "client_credentials")
+                        && contains_parameter(&form, "scope", "fixture.read"),
+                    "Basic placement token form is not exact"
+                );
+                assert!(request
+                    .headers
+                    .get("authorization")
+                    .and_then(|value| value.to_str().ok())
+                    .is_some_and(|value| value == expected));
+            }
+            "form-body" => {
+                assert!(query.is_empty(), "form placement added token query fields");
+                assert!(request.headers.get("authorization").is_none());
+                assert!(
+                    form.len() == 4
+                        && contains_parameter(&form, "grant_type", "client_credentials")
+                        && contains_parameter(&form, "scope", "fixture.read")
+                        && contains_parameter(&form, "client_id", &client_id)
+                        && contains_parameter(&form, "client_secret", &client_secret),
+                    "form placement token body is not exact"
+                );
+            }
+            _ => panic!("unknown non-secret test placement"),
+        }
+    }
+}
+
+#[tokio::test]
+async fn oauth_client_credentials_placements_are_exact_and_cache_reuse_is_bounded() {
+    for placement in ["basic-header", "form-body"] {
+        assert_oauth_success_matrix_case(placement, 60).await;
+        assert_oauth_success_matrix_case(placement, 0).await;
+    }
+}
+
+/// A provider that omits `expires_in` still gets a bounded cache, and the
+/// configured maximum still wins over the assumed lifetime.
+#[tokio::test]
+async fn oauth_assumed_lifetime_caches_an_omitted_provider_lifetime_and_stays_clamped() {
+    for (maximum_cache_seconds, expected_token_requests) in [(60_u64, 1_u64), (0, 2)] {
+        let server = MockServer::start().await;
+        let access_token = format!("access-token-{}", ulid::Ulid::new());
+        Mock::given(method("POST"))
+            .and(path("/token"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+                "access_token": access_token.clone(),
+                "token_type": "Bearer"
+            })))
+            .expect(expected_token_requests)
+            .mount(&server)
+            .await;
+        Mock::given(method("POST"))
+            .and(path("/data"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(json!({"ok": true})))
+            .expect(2)
+            .mount(&server)
+            .await;
+
+        let (_root, secrets) = resolver(&[
+            ("oauth-client-id", "assumed-lifetime-client-id"),
+            ("oauth-client-secret", "assumed-lifetime-client-secret"),
+        ]);
+        let source = oauth_source_with_assumed_lifetime(
+            &server.uri(),
+            &format!("{}/token", server.uri()),
+            "form-body",
+            maximum_cache_seconds,
+            Some(120),
+        );
+        let executor = SourceExecutor::new(&source, secrets).expect("OAuth executor builds");
+        for _ in 0..2 {
+            executor
+                .execute(
+                    &[selector("record")],
+                    &RequestParts {
+                        query: vec![],
+                        body: Some(json!({})),
+                    },
+                )
+                .await
+                .expect("assumed lifetime authorizes the request");
+        }
+    }
+}
+
+#[tokio::test]
+async fn oauth_credential_redaction_fixture_fails_closed_without_data_requests() {
+    let fixture: Value = serde_norway::from_str(include_str!(
+        "../../../products/evidence/fixtures/conformance/oauth-credential-redaction.yaml"
+    ))
+    .expect("OAuth redaction fixture parses");
+    let declared = fixture["cases"]
+        .as_array()
+        .expect("fixture cases are an array")
+        .iter()
+        .map(|case| {
+            case["id"]
+                .as_str()
+                .expect("fixture case has an id")
+                .to_owned()
+        })
+        .collect::<BTreeSet<_>>();
+    let expected = BTreeSet::from([
+        "malformed-token-json".to_owned(),
+        "token-400".to_owned(),
+        "token-401".to_owned(),
+        "token-response-duplicate-access-token".to_owned(),
+        "token-response-extension-members".to_owned(),
+        "token-response-oversized".to_owned(),
+        "token-response-wrong-access-token-field".to_owned(),
+        "token-response-wrong-lifetime".to_owned(),
+        "token-response-wrong-media-type".to_owned(),
+        "token-response-wrong-scope".to_owned(),
+        "token-response-omitted-lifetime".to_owned(),
+        "token-response-omitted-lifetime-with-assumed-lifetime".to_owned(),
+        "token-response-wrong-token-type".to_owned(),
+        "token-success".to_owned(),
+        "transport-connection-failure".to_owned(),
+        "transport-timeout".to_owned(),
+    ]);
+    assert_eq!(
+        declared, expected,
+        "OAuth fixture and executable matrix drifted"
+    );
+
+    for case_id in declared {
+        let server = MockServer::start().await;
+        let client_id = format!("client-id-{}", ulid::Ulid::new());
+        let client_secret = format!("client-secret-{}", ulid::Ulid::new());
+        let access_token = format!("access-token-{}", ulid::Ulid::new());
+        let response = match case_id.as_str() {
+            "transport-connection-failure" => None,
+            "token-success" => Some(ResponseTemplate::new(200).set_body_json(json!({
+                "access_token": access_token.clone(),
+                "token_type": "Bearer",
+                "expires_in": 120,
+                "scope": "fixture.read"
+            }))),
+            "token-400" => Some(
+                ResponseTemplate::new(400).set_body_string(client_secret.clone()),
+            ),
+            "token-401" => Some(
+                ResponseTemplate::new(401).set_body_string(client_secret.clone()),
+            ),
+            "malformed-token-json" => {
+                Some(ResponseTemplate::new(200).set_body_raw("{invalid", "application/json"))
+            }
+            "token-response-oversized" => Some(ResponseTemplate::new(200).set_body_raw(
+                format!(
+                    "{{\"access_token\":\"{}\",\"token_type\":\"Bearer\",\"expires_in\":120}}",
+                    "x".repeat(9_000)
+                ),
+                "application/json",
+            )),
+            // The members a deployed authorization server actually adds, plus
+            // one carrying the client-secret canary. Ignored members must not
+            // become credentials and must not surface anywhere.
+            "token-response-extension-members" => Some(ResponseTemplate::new(200).set_body_json(json!({
+                "access_token": access_token.clone(),
+                "token_type": "Bearer",
+                "expires_in": 120,
+                "scope": "fixture.read",
+                "refresh_expires_in": 0,
+                "not-before-policy": 0,
+                "session_state": "b2c1d0f3-0000-4000-8000-000000000000",
+                "ext_expires_in": 120,
+                "unexpected": client_secret.clone()
+            }))),
+            // An extension member must not be able to arrive as a second
+            // access_token, which is what makes ignoring the unread ones safe.
+            "token-response-duplicate-access-token" => Some(ResponseTemplate::new(200).set_body_raw(
+                format!(
+                    "{{\"access_token\":\"{access_token}\",\"token_type\":\"Bearer\",\"expires_in\":120,\"access_token\":\"{client_secret}\"}}"
+                ),
+                "application/json",
+            )),
+            "token-response-wrong-access-token-field" => {
+                Some(ResponseTemplate::new(200).set_body_json(json!({
+                    "access_token": 7,
+                    "token_type": "Bearer",
+                    "expires_in": 120
+                })))
+            }
+            "token-response-wrong-token-type" => Some(ResponseTemplate::new(200).set_body_json(json!({
+                "access_token": access_token.clone(),
+                "token_type": "MAC",
+                "expires_in": 120
+            }))),
+            "token-response-wrong-scope" => Some(ResponseTemplate::new(200).set_body_json(json!({
+                "access_token": access_token.clone(),
+                "token_type": "Bearer",
+                "expires_in": 120,
+                "scope": "other.scope"
+            }))),
+            "token-response-wrong-lifetime" => Some(ResponseTemplate::new(200).set_body_json(json!({
+                "access_token": access_token.clone(),
+                "token_type": "Bearer",
+                "expires_in": 0
+            }))),
+            // The minimum RFC 6749 section 5.1 response. Accepted only when the
+            // bundle states the lifetime to assume.
+            "token-response-omitted-lifetime"
+            | "token-response-omitted-lifetime-with-assumed-lifetime" => {
+                Some(ResponseTemplate::new(200).set_body_json(json!({
+                    "access_token": access_token.clone(),
+                    "token_type": "Bearer"
+                })))
+            }
+            "token-response-wrong-media-type" => Some(ResponseTemplate::new(200).set_body_raw(
+                format!(
+                    "{{\"access_token\":\"{access_token}\",\"token_type\":\"Bearer\",\"expires_in\":120}}"
+                ),
+                "text/plain",
+            )),
+            "transport-timeout" => Some(ResponseTemplate::new(200)
+                .set_delay(Duration::from_millis(100))
+                .set_body_json(json!({
+                    "access_token": access_token.clone(),
+                    "token_type": "Bearer",
+                    "expires_in": 120
+                }))),
+            _ => panic!("fixture contains an unknown case id: {case_id}"),
+        };
+        if let Some(response) = response {
+            Mock::given(method("POST"))
+                .and(path("/token"))
+                .respond_with(response)
+                .expect(1)
+                .mount(&server)
+                .await;
+        }
+        Mock::given(method("POST"))
+            .and(path("/data"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(json!({"ok": true})))
+            .mount(&server)
+            .await;
+
+        let (_root, secrets) = resolver(&[
+            ("oauth-client-id", client_id.as_str()),
+            ("oauth-client-secret", client_secret.as_str()),
+        ]);
+        let token_endpoint = if case_id == "transport-connection-failure" {
+            "http://127.0.0.1:0/token".to_owned()
+        } else {
+            format!("{}/token", server.uri())
+        };
+        let assumed_lifetime_seconds =
+            (case_id == "token-response-omitted-lifetime-with-assumed-lifetime").then_some(120);
+        let mut source = oauth_source_with_assumed_lifetime(
+            &server.uri(),
+            &token_endpoint,
+            "form-body",
+            0,
+            assumed_lifetime_seconds,
+        );
+        if case_id == "transport-timeout" {
+            source.request.timeout_milliseconds = 20;
+        }
+        let executor = SourceExecutor::new(&source, secrets).expect("OAuth executor builds");
+        let result = executor
+            .execute(
+                &[selector("record")],
+                &RequestParts {
+                    query: vec![],
+                    body: Some(json!({})),
+                },
+            )
+            .await;
+        let expects_success = matches!(
+            case_id.as_str(),
+            "token-success"
+                | "token-response-extension-members"
+                | "token-response-omitted-lifetime-with-assumed-lifetime"
+        );
+        if expects_success {
+            assert!(result.is_ok(), "success fixture case {case_id} failed");
+        } else {
+            let expected_error = match case_id.as_str() {
+                "transport-timeout" => SourceError::Timeout,
+                "transport-connection-failure" => SourceError::Transport,
+                _ => SourceError::Credential,
+            };
+            assert_eq!(result, Err(expected_error));
+            let diagnostic = result
+                .expect_err("failure fixture case returns an error")
+                .to_string();
+            assert!(!diagnostic.contains(&client_id));
+            assert!(!diagnostic.contains(&client_secret));
+            assert!(!diagnostic.contains(&access_token));
+            assert!(!diagnostic.contains("/token?"));
+        }
+
+        let requests = server.received_requests().await.expect("request journal");
+        let data_count = requests
+            .iter()
+            .filter(|request| request.url.path() == "/data")
+            .count();
+        if expects_success {
+            assert!(
+                data_count == 1,
+                "successful token did not authorize one data request"
+            );
+            // The credential the source presents is the access token and only
+            // the access token. For the extension-members case this is what
+            // proves an ignored member did not become one.
+            let authorization = requests
+                .iter()
+                .find(|request| request.url.path() == "/data")
+                .expect("the data request was journaled")
+                .headers
+                .get("authorization")
+                .expect("the data request carried a credential")
+                .to_str()
+                .expect("the authorization header is text")
+                .to_owned();
+            assert_eq!(authorization, format!("Bearer {access_token}"));
+        } else {
+            assert!(
+                data_count == 0,
+                "token failure reached the evidence-data source"
+            );
+        }
+        let token_request = requests
+            .iter()
+            .find(|request| request.url.path() == "/token");
+        if case_id == "transport-connection-failure" {
+            assert!(token_request.is_none());
+            continue;
+        }
+        let token_request = token_request.expect("token request was journaled");
+        // No placement may put a credential in the token URL, so the redaction
+        // surface is the request body and the response, never the URL.
+        assert!(
+            query_parameters(&token_request.url).is_empty(),
+            "token URL carried a query"
+        );
+        let form = encoded_parameters(&token_request.body);
+        assert!(
+            form.len() == 4
+                && contains_parameter(&form, "grant_type", "client_credentials")
+                && contains_parameter(&form, "scope", "fixture.read")
+                && contains_parameter(&form, "client_id", &client_id)
+                && contains_parameter(&form, "client_secret", &client_secret),
+            "form placement did not deliver the exact closed credential request"
+        );
+    }
+}
+
+#[tokio::test]
+async fn projection_missing_leaf_is_omitted_but_bad_intermediate_stops_before_extraction() {
+    for (response, expected) in [
+        (json!({"results": [{}]}), Ok(json!({"results": [{}]}))),
+        (json!({}), Err(SourceError::ProjectionViolation)),
+        (
+            json!({"results": {}}),
+            Err(SourceError::ProjectionViolation),
+        ),
+    ] {
+        let server = MockServer::start().await;
+        Mock::given(method("POST"))
+            .and(path("/data"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(response))
+            .expect(1)
+            .mount(&server)
+            .await;
+        let (_root, secrets) = resolver(&[("token", "token")]);
+        let mut source = fixed_source(
+            &server.uri(),
+            json!({"kind": "static-bearer", "tokenRef": "secret:file/token"}),
+        );
+        source.request.projection = vec!["/results/*/optional".into()];
+        let executor = SourceExecutor::new(&source, secrets).expect("executor builds");
+        assert_eq!(
+            executor
+                .execute(
+                    &[selector("record")],
+                    &RequestParts {
+                        query: vec![],
+                        body: Some(json!({}))
+                    }
+                )
+                .await,
+            expected
+        );
+    }
+}
+
+#[tokio::test]
+async fn source_executor_failure_matrix_is_exact_single_request_and_value_free() {
+    let cases = [
+        ("http-401", SourceError::Status(SourceStatus::Unauthorized)),
+        ("http-403", SourceError::Status(SourceStatus::Forbidden)),
+        ("http-429", SourceError::Status(SourceStatus::RateLimited)),
+        ("http-500", SourceError::Status(SourceStatus::ServerError)),
+        ("redirect", SourceError::Redirect),
+        ("timeout", SourceError::Timeout),
+        ("invalid-json", SourceError::InvalidJson),
+        ("wrong-media-type", SourceError::WrongMediaType),
+        (
+            "raw-oversized-before-projection",
+            SourceError::ResponseTooLarge,
+        ),
+    ];
+
+    for (case_id, expected_error) in cases {
+        let server = MockServer::start().await;
+        let response = match case_id {
+            "http-401" => ResponseTemplate::new(401)
+                .set_body_string("source-response-canary credential-canary"),
+            "http-403" => ResponseTemplate::new(403)
+                .set_body_string("source-response-canary credential-canary"),
+            "http-429" => ResponseTemplate::new(429)
+                .insert_header("retry-after", "60")
+                .set_body_string("source-response-canary credential-canary"),
+            "http-500" => ResponseTemplate::new(500)
+                .set_body_string("source-response-canary credential-canary"),
+            "redirect" => {
+                ResponseTemplate::new(302).insert_header("location", "/redirect-target-canary")
+            }
+            "timeout" => ResponseTemplate::new(200)
+                .set_delay(Duration::from_millis(100))
+                .set_body_json(json!({"ok": true})),
+            "invalid-json" => ResponseTemplate::new(200)
+                .set_body_raw("{source-response-canary", "application/json"),
+            "wrong-media-type" => {
+                ResponseTemplate::new(200).set_body_raw("source-response-canary", "text/plain")
+            }
+            "raw-oversized-before-projection" => ResponseTemplate::new(200).set_body_raw(
+                format!(
+                    "{{\"ok\":true,\"ignored\":\"source-response-canary{}\"}}",
+                    "x".repeat(256)
+                ),
+                "application/json",
+            ),
+            _ => unreachable!("closed source failure cases"),
+        };
+        Mock::given(method("POST"))
+            .and(path("/data"))
+            .respond_with(response)
+            .expect(1)
+            .mount(&server)
+            .await;
+        let (_root, secrets) = resolver(&[("token", "credential-canary")]);
+        let mut source = fixed_source(
+            &server.uri(),
+            json!({"kind": "static-bearer", "tokenRef": "secret:file/token"}),
+        );
+        if case_id == "timeout" {
+            source.request.timeout_milliseconds = 20;
+        }
+        if case_id == "raw-oversized-before-projection" {
+            source.request.maximum_response_bytes = 64;
+        }
+        let error = SourceExecutor::new(&source, secrets)
+            .expect("failure-matrix source compiles")
+            .execute(
+                &[selector("record")],
+                &RequestParts {
+                    query: vec![],
+                    body: Some(json!({})),
+                },
+            )
+            .await
+            .expect_err("failure-matrix case cannot succeed");
+        assert_eq!(error, expected_error, "{case_id}: exact source error");
+        let diagnostic = format!("{error:?} {error}");
+        for canary in [
+            "source-response-canary",
+            "credential-canary",
+            "redirect-target-canary",
+        ] {
+            assert!(
+                !diagnostic.contains(canary),
+                "{case_id}: diagnostics remain value-free"
+            );
+        }
+        let requests = server.received_requests().await.expect("request journal");
+        assert_eq!(requests.len(), 1, "{case_id}: exactly one request");
+        assert_eq!(requests[0].url.path(), "/data");
+    }
+}
+
+#[test]
+fn forbidden_header_collisions_and_invalid_projection_contracts_fail_at_compilation() {
+    let (_root, secrets) = resolver(&[("key", "secret")]);
+    for header_name in RESERVED_HEADER_CONTRACT_CASES {
+        let source = source_config(
+            "http://127.0.0.1:18080",
+            json!({"kind": "static-api-key", "headerName": "X-Api-Key", "valueRef": "secret:file/key"}),
+            json!(["record_id"]),
+            json!([{"name": header_name, "value": "forbidden"}]),
+            json!(["/ok"]),
+        );
+        assert_eq!(
+            SourceExecutor::new(&source, Arc::clone(&secrets)).err(),
+            Some(SourceError::InvalidPlan),
+            "reserved fixed header {header_name} is rejected"
+        );
+    }
+    let duplicate = source_config(
+        "http://127.0.0.1:18080",
+        json!({"kind": "static-api-key", "headerName": "X-Api-Key", "valueRef": "secret:file/key"}),
+        json!(["record_id"]),
+        json!([
+            {"name": "X-Reviewed-Header", "value": "one"},
+            {"name": "x-reviewed-header", "value": "two"}
+        ]),
+        json!(["/ok"]),
+    );
+    assert_eq!(
+        SourceExecutor::new(&duplicate, Arc::clone(&secrets)).err(),
+        Some(SourceError::InvalidPlan),
+        "fixed header names are unique case-insensitively"
+    );
+    let authentication_collision = source_config(
+        "http://127.0.0.1:18080",
+        json!({"kind": "static-api-key", "headerName": "X-Api-Key", "valueRef": "secret:file/key"}),
+        json!(["record_id"]),
+        json!([{"name": "x-api-key", "value": "fixed"}]),
+        json!(["/ok"]),
+    );
+    assert_eq!(
+        SourceExecutor::new(&authentication_collision, Arc::clone(&secrets)).err(),
+        Some(SourceError::InvalidPlan),
+        "fixed and authentication headers cannot collide"
+    );
+    for api_key_header in RESERVED_HEADER_CONTRACT_CASES {
+        let source = source_config(
+            "http://127.0.0.1:18080",
+            json!({"kind": "static-api-key", "headerName": api_key_header, "valueRef": "secret:file/key"}),
+            json!(["record_id"]),
+            json!([]),
+            json!(["/ok"]),
+        );
+        assert_eq!(
+            SourceExecutor::new(&source, Arc::clone(&secrets)).err(),
+            Some(SourceError::InvalidPlan),
+            "reserved authentication header {api_key_header} is rejected"
+        );
+    }
+    for projection in [
+        json!(["/a", "/a/b"]),
+        json!(["/a/0"]),
+        json!(["/a/*/x", "/a/b"]),
+    ] {
+        let source = source_config(
+            "http://127.0.0.1:18080",
+            json!({"kind": "static-api-key", "headerName": "X-Api-Key", "valueRef": "secret:file/key"}),
+            json!(["record_id"]),
+            json!([]),
+            projection,
+        );
+        assert_eq!(
+            SourceExecutor::new(&source, Arc::clone(&secrets)).err(),
+            Some(SourceError::InvalidPlan)
+        );
+    }
+}
+
+/// Every allowed selector set must carry the roles the path template binds.
+///
+/// The sets are not written by an operator. They are derived from authority
+/// grants, one per grant, filtered to the roles the source declares. So a grant
+/// that authorizes this requirement over a role the template does not bind
+/// yields a set with no value for the placeholder. `materialize_url` needs one
+/// for every placeholder, so that set fails every request it ever serves, while
+/// startup and readiness both pass because some other grant covers the role.
+/// Refuse the plan instead, at the point the mismatch is visible.
+#[test]
+fn an_allowed_selector_set_that_cannot_fill_the_path_template_is_refused() {
+    let (_root, secrets) = resolver(&[("key", "api-key-value")]);
+    let mut source = source_config(
+        "http://127.0.0.1:18080",
+        json!({"kind": "static-api-key", "headerName": "X-Api-Key", "valueRef": "secret:file/key"}),
+        json!(["record_id"]),
+        json!([]),
+        json!(["/ok"]),
+    );
+    // The template binds `subject`; `parent` is declared but never bound.
+    source.request.selector_inputs = serde_json::from_value(json!([
+        {"role": "subject", "alternatives": [{"profile": "record-v1", "fields": ["record_id"]}]},
+        {"role": "parent", "alternatives": [{"profile": "record-v1", "fields": ["record_id"]}]}
+    ]))
+    .expect("selector inputs deserialize");
+
+    let complete = vec![vec![
+        ("subject".to_owned(), "record-v1".to_owned()),
+        ("parent".to_owned(), "record-v1".to_owned()),
+    ]];
+    SourceExecutor::new_with_selector_sets(&source, &complete, Arc::clone(&secrets))
+        .expect("a set carrying every bound role compiles");
+
+    let subject_only = vec![vec![("subject".to_owned(), "record-v1".to_owned())]];
+    SourceExecutor::new_with_selector_sets(&source, &subject_only, Arc::clone(&secrets))
+        .expect("a set carrying only the bound role compiles");
+
+    // Legal-parent-relationship shape: one authority path over the parent, one
+    // source path template bound to the child. The parent-only path is the one
+    // that would fail every request.
+    let parent_only = vec![vec![("parent".to_owned(), "record-v1".to_owned())]];
+    assert_eq!(
+        SourceExecutor::new_with_selector_sets(&source, &parent_only, Arc::clone(&secrets)).err(),
+        Some(SourceError::InvalidPlan),
+        "a set omitting the bound role has no value for the placeholder"
+    );
+
+    let mixed = vec![
+        vec![
+            ("subject".to_owned(), "record-v1".to_owned()),
+            ("parent".to_owned(), "record-v1".to_owned()),
+        ],
+        vec![("parent".to_owned(), "record-v1".to_owned())],
+    ];
+    assert_eq!(
+        SourceExecutor::new_with_selector_sets(&source, &mixed, secrets).err(),
+        Some(SourceError::InvalidPlan),
+        "one complete set must not excuse an incomplete one"
+    );
+}
+
+#[tokio::test]
+async fn private_ca_tls_handshake_succeeds_and_hostname_mismatch_fails() {
+    let (address, ca_pem, server) = spawn_private_ca_tls_server("127.0.0.1").await;
+    let directory = tempfile::tempdir().expect("temporary TLS directory");
+    let configured_path = directory.path().join("private-ca.pem");
+    fs::write(&configured_path, &ca_pem).expect("write configured private CA");
+    let tls: OutboundTlsConfig = serde_json::from_value(json!({
+        "systemRoots": true,
+        "trustProfiles": {"private-pki": {"caBundleFile": configured_path}}
+    }))
+    .expect("TLS config deserializes");
+    let mut source = fixed_source(
+        &format!("https://127.0.0.1:{}", address.port()),
+        json!({"kind": "static-bearer", "tokenRef": "secret:file/token"}),
+    );
+    source.tls_trust_profile = Some("private-pki".into());
+    let (_root, secrets) = resolver(&[("token", "token")]);
+    let mut captured = BTreeMap::from([("private-pki".into(), ca_pem)]);
+    let executor = SourceExecutor::new_with_selector_sets_and_tls(
+        &source,
+        &[vec![("subject".into(), "record-v1".into())]],
+        &tls,
+        &captured,
+        Arc::clone(&secrets),
+    )
+    .expect("private CA source compiles");
+    fs::write(&configured_path, b"changed-after-capture").expect("mutate configured file");
+    captured.insert("private-pki".into(), b"changed-after-compile".to_vec());
+    executor
+        .credentials_ready()
+        .await
+        .expect("captured TLS source remains credential-ready without reopening CA files");
+    assert_eq!(
+        executor
+            .execute(
+                &[selector("record")],
+                &RequestParts {
+                    query: vec![],
+                    body: Some(json!({})),
+                },
+            )
+            .await,
+        Ok(json!({"ok": true}))
+    );
+    server.await.expect("trusted TLS server task completes");
+
+    let (mismatch_address, mismatch_ca, mismatch_server) =
+        spawn_private_ca_tls_server("localhost").await;
+    let mut mismatch_source = source;
+    mismatch_source.base_url = format!("https://127.0.0.1:{}", mismatch_address.port());
+    let mismatch_captured = BTreeMap::from([("private-pki".into(), mismatch_ca)]);
+    let mismatch = SourceExecutor::new_with_selector_sets_and_tls(
+        &mismatch_source,
+        &[vec![("subject".into(), "record-v1".into())]],
+        &tls,
+        &mismatch_captured,
+        secrets,
+    )
+    .expect("hostname-mismatch source compiles")
+    .execute(
+        &[selector("record")],
+        &RequestParts {
+            query: vec![],
+            body: Some(json!({})),
+        },
+    )
+    .await;
+    assert_eq!(mismatch, Err(SourceError::Transport));
+    mismatch_server
+        .await
+        .expect("mismatched TLS server task completes");
+}
+
+#[tokio::test]
+async fn a_reset_transport_failure_yields_exactly_one_connection_attempt() {
+    let (address, attempts, server) = spawn_reset_on_connect_server().await;
+    let source = fixed_source(
+        &format!("http://127.0.0.1:{}", address.port()),
+        json!({"kind": "static-bearer", "tokenRef": "secret:file/token"}),
+    );
+    let (_root, secrets) = resolver(&[("token", "token")]);
+    let result = SourceExecutor::new(&source, secrets)
+        .expect("reset-transport source compiles")
+        .execute(
+            &[selector("record")],
+            &RequestParts {
+                query: vec![],
+                body: Some(json!({})),
+            },
+        )
+        .await;
+    assert_eq!(result, Err(SourceError::Transport));
+    // Give the listener a moment to observe a second connection attempt, if
+    // one were made, before asserting the final count.
+    tokio::time::sleep(Duration::from_millis(50)).await;
+    assert_eq!(
+        attempts.load(Ordering::SeqCst),
+        1,
+        "a reset transport failure must not be retried"
+    );
+    server.abort();
+}
+
+#[test]
+fn private_ca_plan_rejects_unbound_missing_and_malformed_captures() {
+    let directory = tempfile::tempdir().expect("temporary TLS directory");
+    let configured_path = directory.path().join("private-ca.pem");
+    let tls: OutboundTlsConfig = serde_json::from_value(json!({
+        "systemRoots": true,
+        "trustProfiles": {"private-pki": {"caBundleFile": configured_path}}
+    }))
+    .expect("TLS config deserializes");
+    let mut source = fixed_source(
+        "https://127.0.0.1:443",
+        json!({"kind": "static-bearer", "tokenRef": "secret:file/token"}),
+    );
+    source.tls_trust_profile = Some("private-pki".into());
+    let (_root, secrets) = resolver(&[("token", "token")]);
+    let allowed = [vec![("subject".into(), "record-v1".into())]];
+    let no_bindings = OutboundTlsConfig {
+        system_roots: true,
+        trust_profiles: Default::default(),
+    };
+    assert_eq!(
+        SourceExecutor::new_with_selector_sets_and_tls(
+            &source,
+            &allowed,
+            &no_bindings,
+            &BTreeMap::new(),
+            Arc::clone(&secrets),
+        )
+        .err(),
+        Some(SourceError::InvalidPlan)
+    );
+    assert_eq!(
+        SourceExecutor::new_with_selector_sets_and_tls(
+            &source,
+            &allowed,
+            &tls,
+            &BTreeMap::new(),
+            Arc::clone(&secrets),
+        )
+        .err(),
+        Some(SourceError::InvalidPlan)
+    );
+    assert_eq!(
+        SourceExecutor::new_with_selector_sets_and_tls(
+            &source,
+            &allowed,
+            &tls,
+            &BTreeMap::from([("private-pki".into(), b"not-a-certificate".to_vec())]),
+            secrets,
+        )
+        .err(),
+        Some(SourceError::InvalidPlan)
+    );
+}
+
+#[cfg(unix)]
+#[test]
+fn runtime_ca_capture_rejects_symlink_malformed_and_mutable_files() {
+    use std::os::unix::fs::symlink;
+
+    enum CaCase {
+        Symlink,
+        Malformed,
+        Mutable,
+    }
+    for case in [CaCase::Symlink, CaCase::Malformed, CaCase::Mutable] {
+        let directory = tempfile::tempdir().expect("temporary runtime directory");
+        let secret_root = directory.path().join("secrets");
+        fs::create_dir(&secret_root).expect("create secret root");
+        fs::set_permissions(&secret_root, fs::Permissions::from_mode(0o700))
+            .expect("protect secret root");
+        let ca_path = directory.path().join("private-ca.pem");
+        match case {
+            CaCase::Symlink => {
+                let target = directory.path().join("private-ca-target.pem");
+                fs::write(
+                    &target,
+                    b"-----BEGIN CERTIFICATE-----\nMAMCAQE=\n-----END CERTIFICATE-----\n",
+                )
+                .expect("write CA target");
+                fs::set_permissions(&target, fs::Permissions::from_mode(0o444))
+                    .expect("protect CA target");
+                symlink(target, &ca_path).expect("create CA symlink");
+            }
+            CaCase::Malformed => {
+                fs::write(&ca_path, b"not-a-certificate").expect("write malformed CA");
+                fs::set_permissions(&ca_path, fs::Permissions::from_mode(0o444))
+                    .expect("protect malformed CA");
+            }
+            CaCase::Mutable => {
+                fs::write(
+                    &ca_path,
+                    b"-----BEGIN CERTIFICATE-----\nMAMCAQE=\n-----END CERTIFICATE-----\n",
+                )
+                .expect("write mutable CA");
+                fs::set_permissions(&ca_path, fs::Permissions::from_mode(0o600))
+                    .expect("leave CA mutable");
+            }
+        }
+        let runtime_path = directory.path().join("runtime.yaml");
+        fs::write(
+            &runtime_path,
+            format!(
+                "version: 1\nbundleDirectory: /etc/registry-evidence/bundle\nlistener:\n  bindHost: 127.0.0.1\n  port: 8080\n  tlsTermination: operator-controlled-upstream\n  trustProxyIdentityHeaders: false\n  maximumRequestBytes: 65536\n  maximumConcurrentRequests: 64\n  requestTimeoutMilliseconds: 10000\n  shutdownGraceMilliseconds: 30000\nsecretProviders:\n  file: {{root: {}}}\nauditStorage:\n  path: /var/lib/registry-evidence/audit/evidence.jsonl\n  maximumFileBytes: 1073741824\noutboundTls:\n  systemRoots: true\n  trustProfiles:\n    private-pki: {{caBundleFile: {}}}\n",
+                secret_root.display(),
+                ca_path.display()
+            ),
+        )
+        .expect("write runtime configuration");
+        fs::set_permissions(&runtime_path, fs::Permissions::from_mode(0o444))
+            .expect("protect runtime configuration");
+        let error = RuntimeDocument::load(&runtime_path).expect_err("unsafe CA capture fails");
+        match case {
+            CaCase::Symlink => assert_eq!(error, BundleError::InvalidPath),
+            CaCase::Malformed => assert!(matches!(error, BundleError::InvalidArtifact(_))),
+            // The CA bundle sits outside the bundle directory, so the refusal
+            // has to name it. Re-freezing the bundle would not touch it.
+            CaCase::Mutable => assert_eq!(
+                error.artifact_fault().map(|fault| fault.fault().cause()),
+                Some("the TLS CA bundle the runtime file names is writable")
+            ),
+        }
+    }
+}
+
+#[test]
+fn ambient_proxy_variables_are_ignored_in_an_isolated_process() {
+    if std::env::var_os("EVIDENCE_PROXY_CHILD").is_some() {
+        return;
+    }
+    let status = Command::new(std::env::current_exe().expect("test executable"))
+        .arg("--exact")
+        .arg("ambient_proxy_child")
+        .arg("--nocapture")
+        .env("EVIDENCE_PROXY_CHILD", "1")
+        .env("HTTP_PROXY", "http://127.0.0.1:1")
+        .env("HTTPS_PROXY", "http://127.0.0.1:1")
+        .env("ALL_PROXY", "http://127.0.0.1:1")
+        .env("NO_PROXY", "")
+        .status()
+        .expect("spawn isolated proxy test");
+    assert!(status.success());
+}
+
+#[tokio::test]
+async fn ambient_proxy_child() {
+    if std::env::var_os("EVIDENCE_PROXY_CHILD").is_none() {
+        return;
+    }
+    let server = MockServer::start().await;
+    Mock::given(method("POST"))
+        .and(path("/data"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({"ok": true})))
+        .expect(2)
+        .mount(&server)
+        .await;
+    Mock::given(method("POST"))
+        .and(path("/token"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "access_token": "synthetic-proxy-test-access-token",
+            "token_type": "Bearer",
+            "expires_in": 60,
+            "scope": "fixture.read"
+        })))
+        .expect(1)
+        .mount(&server)
+        .await;
+    let (_root, secrets) = resolver(&[
+        ("token", "token"),
+        ("oauth-client-id", "synthetic-proxy-client"),
+        ("oauth-client-secret", "synthetic-proxy-secret"),
+    ]);
+    let source = fixed_source(
+        &server.uri(),
+        json!({"kind": "static-bearer", "tokenRef": "secret:file/token"}),
+    );
+    SourceExecutor::new(&source, Arc::clone(&secrets))
+        .expect("executor builds")
+        .execute(
+            &[selector("record")],
+            &RequestParts {
+                query: vec![],
+                body: Some(json!({})),
+            },
+        )
+        .await
+        .expect("ambient proxy is ignored");
+    let oauth = oauth_source(
+        &server.uri(),
+        &format!("{}/token", server.uri()),
+        "basic-header",
+        0,
+    );
+    SourceExecutor::new(&oauth, secrets)
+        .expect("OAuth executor builds")
+        .execute(
+            &[selector("record")],
+            &RequestParts {
+                query: vec![],
+                body: Some(json!({})),
+            },
+        )
+        .await
+        .expect("ambient proxy is ignored for token and evidence-data requests");
+}
diff --git a/crates/registry-evidencectl/Cargo.toml b/crates/registry-evidencectl/Cargo.toml
new file mode 100644
index 000000000..077379995
--- /dev/null
+++ b/crates/registry-evidencectl/Cargo.toml
@@ -0,0 +1,36 @@
+[package]
+name = "registry-evidencectl"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+description = "Evidence adopter tooling: key generation, OpenAPI authoring, fixture runs."
+repository.workspace = true
+publish = false
+
+[[bin]]
+name = "evidencectl"
+path = "src/main.rs"
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow.workspace = true
+base64.workspace = true
+chrono.workspace = true
+clap.workspace = true
+ed25519-dalek.workspace = true
+getrandom.workspace = true
+inquire.workspace = true
+registry-platform-crypto.workspace = true
+rhai.workspace = true
+rustix.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+serde_norway.workspace = true
+signal-hook.workspace = true
+ureq.workspace = true
+url.workspace = true
+zeroize.workspace = true
+tempfile.workspace = true
diff --git a/crates/registry-evidencectl/install.sh b/crates/registry-evidencectl/install.sh
new file mode 100644
index 000000000..4ffb41f4b
--- /dev/null
+++ b/crates/registry-evidencectl/install.sh
@@ -0,0 +1,261 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo="registrystack/registry-stack"
+binaries=(evidence evidencectl mint)
+# Release packaging replaces this empty value with the asset's canonical tag.
+default_version=""
+script_name="${BASH_SOURCE[0]:-}"
+script_name="${script_name##*/}"
+filename_version=""
+if [[ "$script_name" =~ ^evidencectl-(v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*))-install\.sh$ ]]; then
+	filename_version="${BASH_REMATCH[1]}"
+fi
+if [ -n "$default_version" ] &&
+	[ -n "$filename_version" ] &&
+	[ "$default_version" != "$filename_version" ]; then
+	echo "Refusing an installer whose embedded release does not match its filename." >&2
+	exit 1
+fi
+default_version="${default_version:-$filename_version}"
+version="${EVIDENCECTL_VERSION:-$default_version}"
+if [ -n "$default_version" ] &&
+	[ -n "${EVIDENCECTL_VERSION:-}" ] &&
+	[ "$EVIDENCECTL_VERSION" != "$default_version" ]; then
+	echo "Refusing a release override that does not match the released installer asset." >&2
+	exit 1
+fi
+install_dir="${EVIDENCECTL_INSTALL_DIR:-$HOME/.local/bin}"
+asset_dir="${EVIDENCECTL_ASSET_DIR:-}"
+
+usage() {
+	cat <<EOF
+Install the Evidence toolset: the evidence runtime, the evidencectl adopter
+tooling, and the mint token issuer.
+
+Quick install:
+  curl -fsSL https://github.com/${repo}/releases/latest/download/evidencectl-install.sh | bash
+
+The installer verifies every downloaded release asset against the release's
+SHA256SUMS before anything reaches the install directory, and installs the
+three binaries together or not at all. It does not verify release
+authenticity. For a higher-assurance installation, follow the release
+verification guide for the pinned tag, then rerun with EVIDENCECTL_ASSET_DIR
+set to the verified directory:
+  https://github.com/${repo}/blob/<version>/release/VERIFY.md
+
+Environment:
+  EVIDENCECTL_VERSION      Release tag to install. A released installer
+                           embeds its tag and refuses a different override.
+  EVIDENCECTL_INSTALL_DIR  Install directory. Defaults to ~/.local/bin.
+  EVIDENCECTL_ASSET_DIR    Read already-downloaded release assets from this
+                           directory instead of downloading them.
+EOF
+}
+
+if [ "${1:-}" = "--help" ] || [ "${1:-}" = "-h" ]; then
+	usage
+	exit 0
+fi
+
+need() {
+	if ! command -v "$1" >/dev/null 2>&1; then
+		echo "evidencectl installer needs '$1'." >&2
+		exit 1
+	fi
+}
+
+if [ -z "$version" ]; then
+	echo "No release is pinned for this installer copy." >&2
+	echo "Evidence binaries ship with releases that include them; set" >&2
+	echo "EVIDENCECTL_VERSION to a pinned vMAJOR.MINOR.PATCH tag or run the" >&2
+	echo "versioned evidencectl-<tag>-install.sh asset from a release." >&2
+	exit 1
+fi
+if [[ ! "$version" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+	echo "Refusing non-canonical release tag '$version'." >&2
+	echo "Set EVIDENCECTL_VERSION to a pinned vMAJOR.MINOR.PATCH tag." >&2
+	exit 1
+fi
+
+need uname
+if [ -z "$asset_dir" ]; then
+	need curl
+fi
+
+os="$(uname -s)"
+arch="$(uname -m)"
+
+case "$os/$arch" in
+Linux/x86_64 | Linux/amd64)
+	os_label="linux"
+	arch_label="amd64"
+	;;
+Linux/arm64 | Linux/aarch64)
+	os_label="linux"
+	arch_label="arm64"
+	;;
+Darwin/arm64 | Darwin/aarch64)
+	os_label="macos"
+	arch_label="arm64"
+	;;
+*)
+	printf 'No prebuilt Evidence toolset asset is published for %s/%s.\n' "$os" "$arch" >&2
+	printf 'Supported platforms: Linux amd64, Linux arm64, and macOS arm64.\n' >&2
+	printf 'Check the published assets at https://github.com/%s/releases/tag/%s\n' "$repo" "$version" >&2
+	exit 1
+	;;
+esac
+
+base_url="https://github.com/${repo}/releases/download/${version}"
+verify_url="https://github.com/${repo}/blob/${version}/release/VERIFY.md"
+tmpdir="$(mktemp -d 2>/dev/null || mktemp -d -t evidencectl)"
+
+cleanup() {
+	rm -rf "$tmpdir"
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+download() {
+	local src="$1"
+	local dest="$2"
+	if [ -n "$asset_dir" ]; then
+		local name="${src##*/}"
+		if [ ! -f "$asset_dir/$name" ]; then
+			return 1
+		fi
+		cp "$asset_dir/$name" "$dest"
+	else
+		curl -fsSL "$src" -o "$dest" 2>/dev/null
+	fi
+}
+
+if [ -n "$asset_dir" ]; then
+	printf 'Installing verified local Evidence toolset %s assets for %s/%s...\n' \
+		"$version" "$os_label" "$arch_label"
+else
+	printf 'Downloading the Evidence toolset %s for %s/%s...\n' \
+		"$version" "$os_label" "$arch_label"
+fi
+
+for binary in "${binaries[@]}"; do
+	asset="${binary}-${version}-${os_label}-${arch_label}"
+	if ! download "$base_url/$asset" "$tmpdir/$asset"; then
+		printf 'Could not read the published %s %s binary for %s/%s.\n' \
+			"$binary" "$version" "$os_label" "$arch_label" >&2
+		printf 'Check the published assets at https://github.com/%s/releases/tag/%s\n' \
+			"$repo" "$version" >&2
+		exit 1
+	fi
+done
+
+if ! download "$base_url/SHA256SUMS" "$tmpdir/SHA256SUMS"; then
+	echo "Could not download SHA256SUMS for checksum verification." >&2
+	exit 1
+fi
+
+sha256_file() {
+	local path="$1"
+	local result
+	if command -v shasum >/dev/null 2>&1; then
+		result="$(shasum -a 256 "$path")"
+	elif command -v sha256sum >/dev/null 2>&1; then
+		result="$(sha256sum "$path")"
+	else
+		echo "evidencectl installer needs 'shasum' or 'sha256sum' for checksum verification." >&2
+		exit 1
+	fi
+	printf '%s\n' "${result%% *}"
+}
+
+verify_asset() {
+	local name="$1"
+	local expected_hash actual_hash
+	expected_hash="$(awk -v asset="$name" '$2 == asset {print $1}' "$tmpdir/SHA256SUMS")"
+	if [ -z "$expected_hash" ]; then
+		echo "SHA256SUMS has no entry for $name" >&2
+		exit 1
+	fi
+	actual_hash="$(sha256_file "$tmpdir/$name")"
+	if [ "$actual_hash" != "$expected_hash" ]; then
+		echo "Checksum verification failed for $name" >&2
+		echo "Expected: $expected_hash" >&2
+		echo "Actual:   $actual_hash" >&2
+		exit 1
+	fi
+}
+
+for binary in "${binaries[@]}"; do
+	verify_asset "${binary}-${version}-${os_label}-${arch_label}"
+done
+printf 'Integrity checks passed: %s binaries matched SHA256SUMS.\n' "${#binaries[@]}"
+cat <<EOF
+Authenticity check not performed by this installer.
+For a higher-assurance installation, follow the tag-frozen release
+verification guide first, then rerun this installer with
+EVIDENCECTL_ASSET_DIR set to that verified directory:
+  $verify_url
+
+EOF
+
+mkdir -p "$install_dir"
+stage_dir="$(mktemp -d "$install_dir/.evidencectl-install.XXXXXX")"
+install_started=0
+install_complete=0
+# The saved copy under $tmpdir is itself the record that a binary was already
+# installed, so rollback needs no parallel bookkeeping. Stock macOS bash is 3.2
+# and has no associative array to keep that bookkeeping in.
+rollback_install() {
+	set +e
+	if [ "$install_started" -eq 1 ] && [ "$install_complete" -eq 0 ]; then
+		local binary
+		for binary in "${binaries[@]}"; do
+			if [ -f "$tmpdir/${binary}.previous" ]; then
+				cp -p "$tmpdir/${binary}.previous" "$install_dir/$binary"
+			else
+				rm -f "$install_dir/$binary"
+			fi
+		done
+	fi
+	rm -rf "$stage_dir"
+}
+trap 'rollback_install; cleanup' EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+for binary in "${binaries[@]}"; do
+	cp "$tmpdir/${binary}-${version}-${os_label}-${arch_label}" "$stage_dir/$binary"
+	chmod 0755 "$stage_dir/$binary"
+	if [ -e "$install_dir/$binary" ]; then
+		cp -p "$install_dir/$binary" "$tmpdir/${binary}.previous"
+	fi
+done
+
+# Replace the three binaries only after every one of them is staged and
+# verified, so an interrupted update never leaves a mixed-version toolset.
+install_started=1
+for binary in "${binaries[@]}"; do
+	mv -f "$stage_dir/$binary" "$install_dir/$binary"
+done
+install_complete=1
+
+for binary in "${binaries[@]}"; do
+	printf '%s installed to %s\n' "$binary" "$install_dir/$binary"
+done
+cat <<EOF
+
+Try it:
+  evidencectl keygen --help
+  evidencectl new --help
+  evidencectl fixtures --help
+
+EOF
+
+case ":$PATH:" in
+*":$install_dir:"*) ;;
+*)
+	echo "Add $install_dir to PATH to run the Evidence toolset from any shell." >&2
+	;;
+esac
diff --git a/crates/registry-evidencectl/src/access.rs b/crates/registry-evidencectl/src/access.rs
new file mode 100644
index 000000000..505b77e73
--- /dev/null
+++ b/crates/registry-evidencectl/src/access.rs
@@ -0,0 +1,925 @@
+//! Local access-policy and client authoring.
+//!
+//! Governed, reviewable policy and public client membership live under
+//! `access/`. The only private client artifact is the locally generated key
+//! under `.evidence/clients/<id>/private.jwk`.
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fs::{self, File},
+    io::{Read as _, Write as _},
+    os::unix::fs::{DirBuilderExt as _, MetadataExt as _, PermissionsExt as _},
+    path::{Path, PathBuf},
+    process::ExitCode,
+};
+
+use anyhow::{bail, Context as _, Result};
+use clap::{Args, Subcommand};
+use registry_platform_crypto::{PrivateJwk, PublicJwk};
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value};
+
+use crate::{authoring, dev, keygen};
+
+const ACCESS_DIRECTORY: &str = "access";
+const POLICIES_DIRECTORY: &str = "policies";
+const CLIENTS_DIRECTORY: &str = "clients";
+const PRIVATE_STATE_DIRECTORY: &str = ".evidence";
+const PRIVATE_KEY_FILENAME: &str = "private.jwk";
+const MAX_DOCUMENT_BYTES: u64 = 64 * 1024;
+const MAX_POLICIES: usize = 128;
+const MAX_QUESTIONS: usize = 128;
+const MAX_CLIENTS: usize = 4_096;
+const MAX_POLICIES_PER_CLIENT: usize = 32;
+const PUBLIC_DIRECTORY_MODE: u32 = 0o755;
+const PUBLIC_FILE_MODE: u32 = 0o644;
+const PRIVATE_DIRECTORY_MODE: u32 = 0o700;
+const PRIVATE_FILE_MODE: u32 = 0o600;
+
+#[derive(Debug, Subcommand)]
+pub enum AccessCommand {
+    /// Define which authored questions a policy may request.
+    #[command(subcommand)]
+    Policy(PolicyCommand),
+    /// Register and revoke local Evidence clients.
+    #[command(subcommand)]
+    Client(ClientCommand),
+}
+
+#[derive(Debug, Subcommand)]
+pub enum PolicyCommand {
+    /// Add one governed access policy.
+    Add(PolicyAddArgs),
+    /// List governed access policies.
+    List(ProjectArgs),
+}
+
+#[derive(Debug, Subcommand)]
+pub enum ClientCommand {
+    /// Add one local client and generate its private key.
+    Add(ClientAddArgs),
+    /// List local clients and their policy membership.
+    List(ProjectArgs),
+    /// Revoke one local client.
+    Revoke(ClientRevokeArgs),
+}
+
+#[derive(Debug, Args)]
+pub struct ProjectArgs {
+    /// Project root. Defaults to the current directory.
+    #[arg(long, default_value = ".", hide = true)]
+    project: PathBuf,
+}
+
+#[derive(Debug, Args)]
+pub struct PolicyAddArgs {
+    /// Lowercase policy identifier.
+    policy: String,
+    /// Authored question granted by this policy. Repeat for more than one.
+    #[arg(long, required = true)]
+    question: Vec<String>,
+    /// Project root. Defaults to the current directory.
+    #[arg(long, default_value = ".", hide = true)]
+    project: PathBuf,
+}
+
+#[derive(Debug, Args)]
+pub struct ClientAddArgs {
+    /// Lowercase client identifier.
+    client: String,
+    /// Access policy assigned to this client. Repeat for more than one.
+    #[arg(long, required = true)]
+    policy: Vec<String>,
+    /// Generate an owner-only Ed25519 key for local client authentication.
+    #[arg(long, required = true)]
+    generate_local_key: bool,
+    /// Project root. Defaults to the current directory.
+    #[arg(long, default_value = ".", hide = true)]
+    project: PathBuf,
+}
+
+#[derive(Debug, Args)]
+pub struct ClientRevokeArgs {
+    /// Lowercase client identifier.
+    client: String,
+    /// Project root. Defaults to the current directory.
+    #[arg(long, default_value = ".", hide = true)]
+    project: PathBuf,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct AccessPolicyDocument {
+    version: u8,
+    id: String,
+    questions: Vec<String>,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "kebab-case")]
+enum ClientStatus {
+    Active,
+    Revoked,
+}
+
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct ClientDocument {
+    version: u8,
+    client_id: String,
+    status: ClientStatus,
+    policies: Vec<String>,
+    principal: String,
+    evidence_audience: String,
+    keys: Vec<Value>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct ActiveClient {
+    pub(crate) client_id: String,
+    pub(crate) private_key_path: PathBuf,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct ActiveClientRegistration {
+    pub(crate) client_id: String,
+    pub(crate) registration: Value,
+}
+
+pub fn run(command: AccessCommand) -> Result<ExitCode> {
+    match command {
+        AccessCommand::Policy(PolicyCommand::Add(args)) => add_policy(&args),
+        AccessCommand::Policy(PolicyCommand::List(args)) => list_policies(&args.project),
+        AccessCommand::Client(ClientCommand::Add(args)) => add_client(&args),
+        AccessCommand::Client(ClientCommand::List(args)) => list_clients(&args.project),
+        AccessCommand::Client(ClientCommand::Revoke(args)) => revoke_client(&args),
+    }
+}
+
+fn add_policy(args: &PolicyAddArgs) -> Result<ExitCode> {
+    let project = canonical_project(&args.project)?;
+    validate_identifier(&args.policy, "policy")?;
+    let questions = sorted_unique(&args.question, "questions", MAX_QUESTIONS)?;
+    for question in &questions {
+        validate_identifier(question, "question")?;
+    }
+    let _lifecycle = dev::lock_project_lifecycle(&project)?;
+    if dev::try_load_ready_state(&project)?.is_some() {
+        bail!("stop the local development session before changing access policies");
+    }
+    for question in &questions {
+        validate_authored_question(&project, question)?;
+    }
+
+    let directory = project.join(ACCESS_DIRECTORY).join(POLICIES_DIRECTORY);
+    ensure_public_directory(&project.join(ACCESS_DIRECTORY))?;
+    ensure_public_directory(&directory)?;
+    if load_policy_documents_if_present(&project)?.len() >= MAX_POLICIES {
+        bail!("a project may define at most {MAX_POLICIES} access policies");
+    }
+    let path = directory.join(format!("{}.yaml", args.policy));
+    let document = AccessPolicyDocument {
+        version: 1,
+        id: args.policy.clone(),
+        questions,
+    };
+    write_new_yaml_atomic(&path, &document, PUBLIC_FILE_MODE)?;
+    println!(
+        "Added access policy {} for {}.",
+        document.id,
+        document.questions.join(", ")
+    );
+    Ok(ExitCode::SUCCESS)
+}
+
+fn list_policies(project: &Path) -> Result<ExitCode> {
+    let project = canonical_project(project)?;
+    let policies = load_policy_documents_if_present(&project)?;
+    if policies.is_empty() {
+        println!("No access policies configured.");
+        return Ok(ExitCode::SUCCESS);
+    }
+    println!("POLICY\tQUESTIONS");
+    for policy in policies.values() {
+        println!("{}\t{}", policy.id, policy.questions.join(", "));
+    }
+    Ok(ExitCode::SUCCESS)
+}
+
+fn add_client(args: &ClientAddArgs) -> Result<ExitCode> {
+    let project = canonical_project(&args.project)?;
+    validate_identifier(&args.client, "client")?;
+    if !args.generate_local_key {
+        bail!("local client creation requires --generate-local-key");
+    }
+    let policy_ids = sorted_unique(&args.policy, "policies", MAX_POLICIES_PER_CLIENT)?;
+    for policy_id in &policy_ids {
+        validate_identifier(policy_id, "policy")?;
+    }
+    let _lifecycle = dev::lock_project_lifecycle(&project)?;
+    let live = prepare_live_context(&project)?;
+    let policies = load_policy_documents(&project)?;
+    validate_client_policies(&policy_ids, &policies)?;
+    let existing_clients = load_client_documents_if_present(&project)?;
+    for existing in existing_clients.values() {
+        validate_client_policies(&existing.policies, &policies)?;
+    }
+    if existing_clients.len() >= MAX_CLIENTS {
+        bail!("a project may define at most {MAX_CLIENTS} clients");
+    }
+
+    let public_directory = project.join(ACCESS_DIRECTORY).join(CLIENTS_DIRECTORY);
+    let private_directory = project
+        .join(PRIVATE_STATE_DIRECTORY)
+        .join(CLIENTS_DIRECTORY);
+    ensure_public_directory(&project.join(ACCESS_DIRECTORY))?;
+    ensure_public_directory(&public_directory)?;
+    ensure_private_directory(&project.join(PRIVATE_STATE_DIRECTORY))?;
+    ensure_private_directory(&private_directory)?;
+
+    let public_path = public_directory.join(format!("{}.yaml", args.client));
+    let private_client_path = private_directory.join(&args.client);
+    reject_existing(&public_path)?;
+    reject_existing(&private_client_path)?;
+
+    let staging = tempfile::Builder::new()
+        .prefix(".client-stage-")
+        .tempdir_in(&private_directory)
+        .context("creating private client staging directory")?;
+    fs::set_permissions(
+        staging.path(),
+        fs::Permissions::from_mode(PRIVATE_DIRECTORY_MODE),
+    )?;
+    let public_key_path = staging.path().join("public.jwk");
+    let (_, generated_public) = keygen::generate_dev_keypair(
+        staging.path(),
+        &format!("local-client-{}-key-1", args.client),
+        PRIVATE_KEY_FILENAME,
+        "public.jwk",
+    )?;
+    debug_assert_eq!(generated_public, public_key_path);
+    let public_key = read_public_jwk(&public_key_path)?;
+    fs::remove_file(&public_key_path).context("removing staged public-key copy")?;
+
+    let document = ClientDocument {
+        version: 1,
+        client_id: args.client.clone(),
+        status: ClientStatus::Active,
+        policies: policy_ids,
+        principal: format!("urn:registrystack:evidence:local:client:{}", args.client),
+        evidence_audience: format!("urn:registrystack:evidence:local:client:{}", args.client),
+        keys: vec![public_key],
+    };
+
+    // Publish the private directory first. The public document is the marker
+    // that makes the client discoverable, and an unexpected public collision
+    // rolls the newly published private directory back.
+    fs::rename(staging.path(), &private_client_path)
+        .context("publishing private local client key")?;
+    if let Err(error) = write_new_yaml_atomic(&public_path, &document, PUBLIC_FILE_MODE) {
+        let _ = fs::remove_dir_all(&private_client_path);
+        return Err(error);
+    }
+
+    let reload_requested =
+        if let Err(error) = synchronize_live_client(&project, &document, live.as_ref()) {
+            return Err(
+                error.context("client was saved, but the running local session was not reloaded")
+            );
+        } else {
+            live.is_some()
+        };
+    println!(
+        "Added client {} with {}.",
+        document.client_id,
+        joined_policies(&document.policies)
+    );
+    if reload_requested {
+        println!("Registry Mint reload requested.");
+    }
+    Ok(ExitCode::SUCCESS)
+}
+
+fn list_clients(project: &Path) -> Result<ExitCode> {
+    let project = canonical_project(project)?;
+    let policies = load_policy_documents_if_present(&project)?;
+    let clients = load_client_documents_if_present(&project)?;
+    if clients.is_empty() {
+        println!("No clients configured.");
+        return Ok(ExitCode::SUCCESS);
+    }
+    println!("CLIENT\tSTATUS\tPOLICIES");
+    for client in clients.values() {
+        validate_client_policies(&client.policies, &policies)?;
+        let status = match client.status {
+            ClientStatus::Active => "active",
+            ClientStatus::Revoked => "revoked",
+        };
+        println!(
+            "{}\t{}\t{}",
+            client.client_id,
+            status,
+            client.policies.join(", ")
+        );
+    }
+    Ok(ExitCode::SUCCESS)
+}
+
+fn revoke_client(args: &ClientRevokeArgs) -> Result<ExitCode> {
+    let project = canonical_project(&args.project)?;
+    validate_identifier(&args.client, "client")?;
+    let _lifecycle = dev::lock_project_lifecycle(&project)?;
+    let live = prepare_live_context(&project)?;
+    let policies = load_policy_documents(&project)?;
+    let path = client_document_path(&project, &args.client);
+    let mut document = read_client_document(&path)?;
+    validate_client_policies(&document.policies, &policies)?;
+    if document.status == ClientStatus::Revoked {
+        bail!("client {} is already revoked", args.client);
+    }
+    if let Some(context) = &live {
+        validate_path_mode(
+            &context
+                .generated_directory
+                .join(format!("{}.yaml", document.client_id)),
+            false,
+            PRIVATE_FILE_MODE,
+        )?;
+    }
+    document.status = ClientStatus::Revoked;
+    replace_yaml_atomic(&path, &document, PUBLIC_FILE_MODE)?;
+    let reload_requested =
+        if let Err(error) = synchronize_live_revocation(&project, &document, live.as_ref()) {
+            return Err(
+                error.context("client was revoked, but the running local session was not reloaded")
+            );
+        } else {
+            live.is_some()
+        };
+    println!("Revoked client {}.", document.client_id);
+    if reload_requested {
+        println!("Registry Mint reload requested.");
+    }
+    Ok(ExitCode::SUCCESS)
+}
+
+/// Resolve one client against the exact access-policy generation currently
+/// active in local development.
+pub(crate) fn resolve_ready_client(
+    project: &Path,
+    client_id: &str,
+    policy_tags: &BTreeMap<String, String>,
+) -> Result<ActiveClient> {
+    validate_identifier(client_id, "client")?;
+    let registration = load_active_clients(project, policy_tags)?
+        .into_iter()
+        .find(|registration| registration.client_id == client_id)
+        .ok_or_else(|| anyhow::anyhow!("unknown or revoked active client {client_id}"))?;
+    let project = canonical_project(project)?;
+    let document = read_client_document(&client_document_path(&project, client_id))?;
+    let private_key_path = validate_private_client_key(&project, &document)?;
+    Ok(ActiveClient {
+        client_id: registration.client_id,
+        private_key_path,
+    })
+}
+
+/// Load active editable clients as exact Mint registration documents.
+pub(crate) fn load_active_clients(
+    project: &Path,
+    policy_tags: &BTreeMap<String, String>,
+) -> Result<Vec<ActiveClientRegistration>> {
+    let project = canonical_project(project)?;
+    let policies = load_policy_documents_if_present(&project)?;
+    if policy_tags.len() != policies.len() {
+        bail!("compiled access policies do not match the editable project policies");
+    }
+    for policy in policies.values() {
+        let expected = authoring::access_policy_requester_tag(&policy.id, &policy.questions)?;
+        if policy_tags.get(&policy.id) != Some(&expected) {
+            bail!(
+                "editable access policy {} differs from the active generation",
+                policy.id
+            );
+        }
+    }
+    let clients = load_client_documents_if_present(&project)?;
+    let mut registrations = Vec::new();
+    for document in clients.values() {
+        validate_client_policies(&document.policies, &policies)?;
+        if document.status == ClientStatus::Revoked {
+            continue;
+        }
+        let requester_tags = document
+            .policies
+            .iter()
+            .map(|id| {
+                policy_tags
+                    .get(id)
+                    .cloned()
+                    .ok_or_else(|| anyhow::anyhow!("client names an unknown compiled policy"))
+            })
+            .collect::<Result<Vec<_>>>()?;
+        registrations.push(ActiveClientRegistration {
+            client_id: document.client_id.clone(),
+            registration: mint_registration(document, requester_tags),
+        });
+    }
+    Ok(registrations)
+}
+
+fn mint_registration(document: &ClientDocument, requester_tags: Vec<String>) -> Value {
+    json!({
+        "clientId": document.client_id,
+        "principal": document.principal,
+        "evidenceAudience": document.evidence_audience,
+        "requesterTags": requester_tags,
+        "keys": document.keys,
+    })
+}
+
+#[derive(Clone, Debug)]
+struct LiveContext {
+    policy_tags: BTreeMap<String, String>,
+    generated_directory: PathBuf,
+}
+
+fn prepare_live_context(project: &Path) -> Result<Option<LiveContext>> {
+    let Some(ready) = dev::try_load_ready_state(project)? else {
+        return Ok(None);
+    };
+    if ready.access_policies.is_empty() {
+        bail!(
+            "the running local session uses the implicit tutorial caller; stop and restart it after defining access policies"
+        );
+    }
+    let policy_tags = ready
+        .access_policies
+        .into_iter()
+        .map(|policy| (policy.id, policy.requester_tag))
+        .collect::<BTreeMap<_, _>>();
+    // Validate the complete editable registry and exact policy generation
+    // before a mutation publishes anything.
+    load_active_clients(project, &policy_tags)?;
+    let generated_directory = project.join(".evidence/dev/generated/clients");
+    validate_path_mode(&generated_directory, true, PRIVATE_DIRECTORY_MODE)?;
+    Ok(Some(LiveContext {
+        policy_tags,
+        generated_directory,
+    }))
+}
+
+fn synchronize_live_client(
+    project: &Path,
+    document: &ClientDocument,
+    live: Option<&LiveContext>,
+) -> Result<()> {
+    let Some(live) = live else {
+        return Ok(());
+    };
+    let registration = load_active_clients(project, &live.policy_tags)?
+        .into_iter()
+        .find(|registration| registration.client_id == document.client_id)
+        .ok_or_else(|| anyhow::anyhow!("new client is not active in the editable registry"))?;
+    let generated_path = live
+        .generated_directory
+        .join(format!("{}.yaml", document.client_id));
+    write_new_yaml_atomic(
+        &generated_path,
+        &registration.registration,
+        PRIVATE_FILE_MODE,
+    )?;
+    dev::request_mint_reload(project)
+}
+
+fn synchronize_live_revocation(
+    project: &Path,
+    document: &ClientDocument,
+    live: Option<&LiveContext>,
+) -> Result<()> {
+    let Some(live) = live else {
+        return Ok(());
+    };
+    // The remaining registry must still be a valid all-or-nothing snapshot.
+    load_active_clients(project, &live.policy_tags)?;
+    let generated_path = live
+        .generated_directory
+        .join(format!("{}.yaml", document.client_id));
+    validate_path_mode(&generated_path, false, PRIVATE_FILE_MODE)?;
+    fs::remove_file(&generated_path)
+        .with_context(|| format!("removing revoked registration {}", generated_path.display()))?;
+    sync_directory(&live.generated_directory)?;
+    dev::request_mint_reload(project)
+}
+
+fn validate_client_policies(
+    policy_ids: &[String],
+    policies: &BTreeMap<String, AccessPolicyDocument>,
+) -> Result<()> {
+    if policy_ids.is_empty() || policy_ids.len() > MAX_POLICIES_PER_CLIENT {
+        bail!("a client must have 1..={MAX_POLICIES_PER_CLIENT} policies");
+    }
+    let mut covered_questions = BTreeMap::<&str, &str>::new();
+    for policy_id in policy_ids {
+        validate_identifier(policy_id, "policy")?;
+        let policy = policies
+            .get(policy_id)
+            .ok_or_else(|| anyhow::anyhow!("unknown access policy {policy_id}"))?;
+        for question in &policy.questions {
+            if let Some(existing) = covered_questions.insert(question, policy_id) {
+                bail!(
+                    "policies {existing} and {policy_id} grant the same authored entitlement for question {question}"
+                );
+            }
+        }
+    }
+    Ok(())
+}
+
+fn load_policy_documents(project: &Path) -> Result<BTreeMap<String, AccessPolicyDocument>> {
+    let policies = load_policy_documents_if_present(project)?;
+    if policies.is_empty() {
+        bail!("no access policies are configured");
+    }
+    Ok(policies)
+}
+
+fn load_policy_documents_if_present(
+    project: &Path,
+) -> Result<BTreeMap<String, AccessPolicyDocument>> {
+    validate_optional_access_root(project)?;
+    let directory = project.join(ACCESS_DIRECTORY).join(POLICIES_DIRECTORY);
+    let paths = yaml_paths_if_present(&directory, MAX_POLICIES, "access policies")?;
+    let mut policies = BTreeMap::new();
+    for path in paths {
+        let mut document: AccessPolicyDocument = read_yaml(&path, PUBLIC_FILE_MODE)?;
+        if document.version != 1 {
+            bail!("access policy version must be 1");
+        }
+        validate_identifier(&document.id, "policy")?;
+        validate_filename_id(&path, &document.id, "access policy")?;
+        document.questions =
+            canonical_sorted_unique(&document.questions, "questions", MAX_QUESTIONS)?;
+        for question in &document.questions {
+            validate_identifier(question, "question")?;
+            validate_authored_question(project, question)?;
+        }
+        if policies.insert(document.id.clone(), document).is_some() {
+            bail!("access policy ids must be unique");
+        }
+    }
+    Ok(policies)
+}
+
+fn load_client_documents_if_present(project: &Path) -> Result<BTreeMap<String, ClientDocument>> {
+    validate_optional_access_root(project)?;
+    let directory = project.join(ACCESS_DIRECTORY).join(CLIENTS_DIRECTORY);
+    let paths = yaml_paths_if_present(&directory, MAX_CLIENTS, "clients")?;
+    let mut clients = BTreeMap::new();
+    for path in paths {
+        let document = read_client_document(&path)?;
+        if clients
+            .insert(document.client_id.clone(), document)
+            .is_some()
+        {
+            bail!("client ids must be unique");
+        }
+    }
+    Ok(clients)
+}
+
+fn read_client_document(path: &Path) -> Result<ClientDocument> {
+    let mut document: ClientDocument = read_yaml(path, PUBLIC_FILE_MODE)?;
+    if document.version != 1 {
+        bail!("client document version must be 1");
+    }
+    validate_identifier(&document.client_id, "client")?;
+    validate_filename_id(path, &document.client_id, "client")?;
+    document.policies =
+        canonical_sorted_unique(&document.policies, "policies", MAX_POLICIES_PER_CLIENT)?;
+    if document.principal != local_client_uri(&document.client_id)
+        || document.evidence_audience != local_client_uri(&document.client_id)
+    {
+        bail!("local client principal and evidence audience must match its client id");
+    }
+    if document.keys.len() != 1 {
+        bail!("a local client must contain exactly one public key");
+    }
+    for key in &document.keys {
+        if key.get("d").is_some() {
+            bail!("client documents must never contain private key material");
+        }
+        let text = serde_json::to_string(key).context("rendering client public key")?;
+        PublicJwk::parse(&text).context("client public JWK is invalid")?;
+    }
+    Ok(document)
+}
+
+fn validate_private_client_key(project: &Path, document: &ClientDocument) -> Result<PathBuf> {
+    let private_root = project.join(PRIVATE_STATE_DIRECTORY);
+    let clients_root = private_root.join(CLIENTS_DIRECTORY);
+    let directory = clients_root.join(&document.client_id);
+    validate_path_mode(&private_root, true, PRIVATE_DIRECTORY_MODE)?;
+    validate_path_mode(&clients_root, true, PRIVATE_DIRECTORY_MODE)?;
+    validate_path_mode(&directory, true, PRIVATE_DIRECTORY_MODE)?;
+    let path = directory.join(PRIVATE_KEY_FILENAME);
+    let text = read_bounded_file(&path, MAX_DOCUMENT_BYTES, Some(PRIVATE_FILE_MODE))?;
+    let private = PrivateJwk::parse(&text).context("local client private JWK is invalid")?;
+    let registered_text = serde_json::to_string(&document.keys[0])
+        .context("rendering registered client public JWK")?;
+    let registered =
+        PublicJwk::parse(&registered_text).context("registered client public JWK is invalid")?;
+    if private
+        .public()
+        .jkt()
+        .context("deriving private-key thumbprint")?
+        != registered
+            .jkt()
+            .context("deriving registered-key thumbprint")?
+    {
+        bail!("local client private key does not match its registered public key");
+    }
+    Ok(path)
+}
+
+fn read_public_jwk(path: &Path) -> Result<Value> {
+    let text = read_bounded_file(path, MAX_DOCUMENT_BYTES, Some(PRIVATE_FILE_MODE))?;
+    PublicJwk::parse(&text).context("generated public JWK is invalid")?;
+    let value: Value = serde_json::from_str(&text).context("parsing generated public JWK")?;
+    if value.get("d").is_some() {
+        bail!("generated public JWK unexpectedly contains private material");
+    }
+    Ok(value)
+}
+
+fn validate_authored_question(project: &Path, question_id: &str) -> Result<()> {
+    let directory = project.join("questions");
+    validate_visible_directory(&directory, "questions")?;
+    let path = directory.join(format!("{question_id}.yaml"));
+    let value: Value = read_yaml_any_mode(&path)?;
+    if value.get("id").and_then(Value::as_str) != Some(question_id) {
+        bail!("question id must match its questions/<id>.yaml filename");
+    }
+    Ok(())
+}
+
+fn yaml_paths_if_present(directory: &Path, maximum: usize, label: &str) -> Result<Vec<PathBuf>> {
+    match fs::symlink_metadata(directory) {
+        Ok(metadata) => metadata,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(Vec::new()),
+        Err(error) => return Err(error).with_context(|| format!("inspecting {label}")),
+    };
+    let parent = directory
+        .parent()
+        .context("access directory has no parent")?;
+    validate_path_mode(parent, true, PUBLIC_DIRECTORY_MODE)?;
+    validate_path_mode(directory, true, PUBLIC_DIRECTORY_MODE)?;
+    let mut paths = fs::read_dir(directory)
+        .with_context(|| format!("reading {label}"))?
+        .map(|entry| entry.map(|entry| entry.path()))
+        .collect::<std::io::Result<Vec<_>>>()?;
+    paths.sort();
+    if paths.len() > maximum {
+        bail!("too many {label}; maximum is {maximum}");
+    }
+    if paths
+        .iter()
+        .any(|path| path.extension().and_then(|value| value.to_str()) != Some("yaml"))
+    {
+        bail!("{label} may contain only <id>.yaml files");
+    }
+    Ok(paths)
+}
+
+fn validate_optional_access_root(project: &Path) -> Result<()> {
+    let path = project.join(ACCESS_DIRECTORY);
+    match fs::symlink_metadata(&path) {
+        Ok(_) => validate_path_mode(&path, true, PUBLIC_DIRECTORY_MODE),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(error) => Err(error.into()),
+    }
+}
+
+fn validate_visible_directory(path: &Path, label: &str) -> Result<()> {
+    let metadata = fs::symlink_metadata(path)
+        .with_context(|| format!("inspecting {label} directory {}", path.display()))?;
+    if metadata.file_type().is_symlink()
+        || !metadata.is_dir()
+        || metadata.uid() != rustix::process::geteuid().as_raw()
+        || metadata.permissions().mode() & 0o022 != 0
+    {
+        bail!("{label} must be held in a plain owner-controlled directory");
+    }
+    Ok(())
+}
+
+fn read_yaml<T: for<'de> Deserialize<'de>>(path: &Path, mode: u32) -> Result<T> {
+    let text = read_bounded_file(path, MAX_DOCUMENT_BYTES, Some(mode))?;
+    serde_norway::from_str(&text).with_context(|| format!("parsing {}", path.display()))
+}
+
+fn read_yaml_any_mode(path: &Path) -> Result<Value> {
+    let text = read_bounded_file(path, MAX_DOCUMENT_BYTES, None)?;
+    serde_norway::from_str(&text).with_context(|| format!("parsing {}", path.display()))
+}
+
+fn read_bounded_file(path: &Path, maximum: u64, required_mode: Option<u32>) -> Result<String> {
+    let descriptor = rustix::fs::open(
+        path,
+        rustix::fs::OFlags::RDONLY | rustix::fs::OFlags::NOFOLLOW | rustix::fs::OFlags::CLOEXEC,
+        rustix::fs::Mode::empty(),
+    )
+    .with_context(|| format!("opening {} without following symlinks", path.display()))?;
+    let file = File::from(descriptor);
+    let metadata = file
+        .metadata()
+        .with_context(|| format!("inspecting open file {}", path.display()))?;
+    if !metadata.is_file()
+        || metadata.uid() != rustix::process::geteuid().as_raw()
+        || metadata.len() > maximum
+        || required_mode.is_some_and(|mode| metadata.permissions().mode() & 0o7777 != mode)
+    {
+        bail!(
+            "{} is not a bounded owner-controlled regular file",
+            path.display()
+        );
+    }
+    let mut text = String::new();
+    file.take(maximum + 1)
+        .read_to_string(&mut text)
+        .with_context(|| format!("reading {}", path.display()))?;
+    if text.len() as u64 > maximum {
+        bail!("{} is too large", path.display());
+    }
+    Ok(text)
+}
+
+fn write_new_yaml_atomic<T: Serialize>(path: &Path, value: &T, mode: u32) -> Result<()> {
+    reject_existing(path)?;
+    let bytes = serde_norway::to_string(value).context("rendering access document")?;
+    let parent = path.parent().context("access document has no parent")?;
+    let mut temporary = tempfile::Builder::new()
+        .prefix(".access-write-")
+        .tempfile_in(parent)
+        .context("creating temporary access document")?;
+    temporary
+        .as_file_mut()
+        .set_permissions(fs::Permissions::from_mode(mode))?;
+    temporary.write_all(bytes.as_bytes())?;
+    temporary.as_file_mut().sync_all()?;
+    temporary
+        .persist_noclobber(path)
+        .map_err(|error| error.error)
+        .with_context(|| format!("publishing {} without overwrite", path.display()))?;
+    sync_directory(parent)?;
+    Ok(())
+}
+
+fn replace_yaml_atomic<T: Serialize>(path: &Path, value: &T, mode: u32) -> Result<()> {
+    validate_path_mode(path, false, mode)?;
+    let bytes = serde_norway::to_string(value).context("rendering access document")?;
+    let parent = path.parent().context("access document has no parent")?;
+    let mut temporary = tempfile::Builder::new()
+        .prefix(".access-write-")
+        .tempfile_in(parent)
+        .context("creating temporary access document")?;
+    temporary
+        .as_file_mut()
+        .set_permissions(fs::Permissions::from_mode(mode))?;
+    temporary.write_all(bytes.as_bytes())?;
+    temporary.as_file_mut().sync_all()?;
+    temporary
+        .persist(path)
+        .map_err(|error| error.error)
+        .with_context(|| format!("atomically replacing {}", path.display()))?;
+    sync_directory(parent)?;
+    Ok(())
+}
+
+fn sync_directory(path: &Path) -> Result<()> {
+    File::open(path)
+        .with_context(|| format!("opening directory {}", path.display()))?
+        .sync_all()
+        .with_context(|| format!("syncing directory {}", path.display()))
+}
+
+fn ensure_public_directory(path: &Path) -> Result<()> {
+    ensure_directory(path, PUBLIC_DIRECTORY_MODE)
+}
+
+fn ensure_private_directory(path: &Path) -> Result<()> {
+    ensure_directory(path, PRIVATE_DIRECTORY_MODE)
+}
+
+fn ensure_directory(path: &Path, mode: u32) -> Result<()> {
+    match fs::symlink_metadata(path) {
+        Ok(_) => validate_path_mode(path, true, mode),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+            fs::DirBuilder::new()
+                .mode(mode)
+                .create(path)
+                .with_context(|| format!("creating {}", path.display()))?;
+            validate_path_mode(path, true, mode)
+        }
+        Err(error) => Err(error.into()),
+    }
+}
+
+fn validate_path_mode(path: &Path, directory: bool, mode: u32) -> Result<()> {
+    let metadata =
+        fs::symlink_metadata(path).with_context(|| format!("inspecting {}", path.display()))?;
+    if metadata.file_type().is_symlink()
+        || if directory {
+            !metadata.is_dir()
+        } else {
+            !metadata.is_file()
+        }
+        || metadata.uid() != rustix::process::geteuid().as_raw()
+        || metadata.permissions().mode() & 0o7777 != mode
+    {
+        bail!(
+            "{} must be a plain owner-controlled {} with mode {mode:04o}",
+            path.display(),
+            if directory { "directory" } else { "file" }
+        );
+    }
+    Ok(())
+}
+
+fn reject_existing(path: &Path) -> Result<()> {
+    match fs::symlink_metadata(path) {
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Ok(_) => bail!("refusing to overwrite existing {}", path.display()),
+        Err(error) => Err(error.into()),
+    }
+}
+
+fn validate_filename_id(path: &Path, id: &str, label: &str) -> Result<()> {
+    if path.file_stem().and_then(|value| value.to_str()) != Some(id) {
+        bail!("{label} id must match its <id>.yaml filename");
+    }
+    Ok(())
+}
+
+fn sorted_unique(values: &[String], label: &str, maximum: usize) -> Result<Vec<String>> {
+    if values.is_empty() || values.len() > maximum {
+        bail!("{label} must contain 1..={maximum} values");
+    }
+    let sorted = values.iter().cloned().collect::<BTreeSet<_>>();
+    if sorted.len() != values.len() {
+        bail!("{label} must be unique");
+    }
+    Ok(sorted.into_iter().collect())
+}
+
+fn canonical_sorted_unique(values: &[String], label: &str, maximum: usize) -> Result<Vec<String>> {
+    let sorted = sorted_unique(values, label, maximum)?;
+    if sorted != values {
+        bail!("{label} must be sorted in canonical order");
+    }
+    Ok(sorted)
+}
+
+fn validate_identifier(value: &str, label: &str) -> Result<()> {
+    let bytes = value.as_bytes();
+    if !matches!(bytes.first(), Some(b'a'..=b'z'))
+        || bytes.len() > 64
+        || bytes[1..].iter().any(|byte| {
+            !(byte.is_ascii_lowercase()
+                || byte.is_ascii_digit()
+                || matches!(byte, b'.' | b'_' | b'-'))
+        })
+    {
+        bail!("{label} id must be a lowercase local identifier (maximum 64 bytes)");
+    }
+    Ok(())
+}
+
+fn canonical_project(path: &Path) -> Result<PathBuf> {
+    let project = fs::canonicalize(path)
+        .with_context(|| format!("resolving project root {}", path.display()))?;
+    let metadata = fs::symlink_metadata(&project)?;
+    if !metadata.is_dir() {
+        bail!("project root must be a directory");
+    }
+    Ok(project)
+}
+
+fn client_document_path(project: &Path, client_id: &str) -> PathBuf {
+    project
+        .join(ACCESS_DIRECTORY)
+        .join(CLIENTS_DIRECTORY)
+        .join(format!("{client_id}.yaml"))
+}
+
+fn local_client_uri(client_id: &str) -> String {
+    format!("urn:registrystack:evidence:local:client:{client_id}")
+}
+
+fn joined_policies(policies: &[String]) -> String {
+    if policies.len() == 1 {
+        format!("policy {}", policies[0])
+    } else {
+        format!("policies {}", policies.join(", "))
+    }
+}
diff --git a/crates/registry-evidencectl/src/audit_view.rs b/crates/registry-evidencectl/src/audit_view.rs
new file mode 100644
index 000000000..178ba0a1f
--- /dev/null
+++ b/crates/registry-evidencectl/src/audit_view.rs
@@ -0,0 +1,317 @@
+//! Minimized local audit presentation delegated to the Evidence core.
+
+use std::{
+    io::{Read as _, Write as _},
+    path::{Path, PathBuf},
+    process::{Command, ExitCode, Stdio},
+};
+
+use anyhow::{anyhow, Result};
+use chrono::DateTime;
+use clap::{ArgGroup, Args, Subcommand};
+use serde::{Deserialize, Deserializer};
+
+use crate::dev;
+
+const CORE_VIEW_SCHEMA: &str = "registry.evidence.local-audit-operation/v1";
+const MAX_CORE_OUTPUT_BYTES: usize = 256 * 1024;
+const AUDIT_FAILED: &str = "local audit inspection failed";
+
+#[derive(Debug, Subcommand)]
+pub enum AuditCommand {
+    /// Show a minimized view of stopped local audit history.
+    Show(ShowArgs),
+}
+
+#[derive(Debug, Args)]
+#[command(group(
+    ArgGroup::new("view")
+        .required(true)
+        .multiple(false)
+        .args(["last_operation"])
+))]
+pub struct ShowArgs {
+    /// Show the last verified local operation after the service has stopped.
+    #[arg(long)]
+    last_operation: bool,
+
+    /// Project root. Defaults to the current directory.
+    #[arg(long, default_value = ".", hide = true)]
+    project: PathBuf,
+
+    #[arg(long, hide = true)]
+    evidence_bin: Option<PathBuf>,
+}
+
+pub fn run(command: AuditCommand) -> Result<ExitCode> {
+    match command {
+        AuditCommand::Show(args) => show(args),
+    }
+}
+
+fn show(args: ShowArgs) -> Result<ExitCode> {
+    if !args.last_operation {
+        return Err(failed());
+    }
+    let stopped = dev::load_stopped_state(&args.project).map_err(|_| failed())?;
+    let evidence = dev::resolve_tool_binary(
+        "evidence",
+        args.evidence_bin.as_deref(),
+        "EVIDENCECTL_TEST_EVIDENCE_BIN",
+    )
+    .map_err(|_| failed())?;
+    let output = inspect_core(&evidence, &stopped.runtime_path)?;
+    let view: CoreAuditOperation = serde_json::from_slice(&output).map_err(|_| failed())?;
+    let rendered = render(&view, &stopped.questions)?;
+
+    std::io::stdout()
+        .lock()
+        .write_all(rendered.as_bytes())
+        .map_err(|_| failed())?;
+    Ok(ExitCode::SUCCESS)
+}
+
+/// Read no more than the closed core output bound and retain nothing from a
+/// failed child. Stderr is never inherited because it may contain protected
+/// audit or deployment detail from a substituted binary.
+fn inspect_core(evidence: &Path, runtime: &Path) -> Result<Vec<u8>> {
+    let mut child = Command::new(evidence)
+        .arg("--runtime")
+        .arg(runtime)
+        .arg("local-audit-last-operation")
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::null())
+        .spawn()
+        .map_err(|_| failed())?;
+    let mut bytes = Vec::with_capacity(MAX_CORE_OUTPUT_BYTES.min(8192));
+    let read = child
+        .stdout
+        .take()
+        .ok_or_else(failed)?
+        .take((MAX_CORE_OUTPUT_BYTES + 1) as u64)
+        .read_to_end(&mut bytes);
+    if read.is_err() || bytes.len() > MAX_CORE_OUTPUT_BYTES {
+        let _ = child.kill();
+        let _ = child.wait();
+        return Err(failed());
+    }
+    let status = child.wait().map_err(|_| failed())?;
+    if !status.success() {
+        return Err(failed());
+    }
+    Ok(bytes)
+}
+
+fn render(view: &CoreAuditOperation, questions: &[dev::ReadyQuestionState]) -> Result<String> {
+    let access = view.events.first().ok_or_else(failed)?;
+    let question = questions
+        .iter()
+        .find(|question| {
+            question.requirement_uri == access.requirement && question.purpose == access.purpose
+        })
+        .ok_or_else(failed)?;
+    if view.schema != CORE_VIEW_SCHEMA
+        || !valid_operation(&view.operation)
+        || !valid_alias(&question.alias)
+        || question.concepts.is_empty()
+        || question.concepts.len() > 16
+        || question.concepts.iter().any(|concept| {
+            !valid_alias(&concept.alias)
+                || !valid_uri(&concept.uri)
+                || !matches!(
+                    concept.form.as_str(),
+                    "boolean"
+                        | "controlled-category"
+                        | "bounded-integer"
+                        | "reviewed-structured-value"
+                )
+        })
+        || !valid_purpose(&question.purpose)
+        || !(1..=2).contains(&view.events.len())
+    {
+        return Err(failed());
+    }
+
+    validate_common(access, question)?;
+    if access.phase != Phase::AccessAttempt
+        || access.decision != Decision::Authorized
+        || access.disclosed_concepts != Presence::Absent
+        || access.evidence_id != Presence::Absent
+    {
+        return Err(failed());
+    }
+
+    let mut rendered = format!(
+        "ACCESS AUTHORIZED {} {} requester={}\n",
+        question.alias, question.purpose, access.requester_pseudonym
+    );
+    if view.events.len() == 1 {
+        return Ok(rendered);
+    }
+
+    let release = &view.events[1];
+    validate_common(release, question)?;
+    if release.phase != Phase::DisclosureRelease
+        || release.decision != Decision::Released
+        || release.requirement != access.requirement
+        || release.purpose != access.purpose
+        || release.requester_pseudonym != access.requester_pseudonym
+        || release.response_protection != access.response_protection
+        || parse_time(&release.occurred_at)? < parse_time(&access.occurred_at)?
+        || release.disclosed_concepts
+            != Presence::Present(
+                question
+                    .concepts
+                    .iter()
+                    .map(|concept| concept.uri.clone())
+                    .collect(),
+            )
+        || !matches!(
+            &release.evidence_id,
+            Presence::Present(value) if valid_uri(value)
+        )
+    {
+        return Err(failed());
+    }
+    rendered.push_str(&format!(
+        "DISCLOSURE RELEASED {}\n",
+        question
+            .concepts
+            .iter()
+            .map(|concept| concept.alias.as_str())
+            .collect::<Vec<_>>()
+            .join(", ")
+    ));
+    Ok(rendered)
+}
+
+fn validate_common(event: &CoreAuditEvent, question: &dev::ReadyQuestionState) -> Result<()> {
+    if event.requirement != question.requirement_uri
+        || event.purpose != question.purpose
+        || !matches!(
+            event.response_protection,
+            ResponseProtection::Signed | ResponseProtection::SdJwtVc
+        )
+        || !valid_pseudonym(&event.requester_pseudonym)
+    {
+        return Err(failed());
+    }
+    parse_time(&event.occurred_at)?;
+    Ok(())
+}
+
+fn parse_time(value: &str) -> Result<chrono::DateTime<chrono::FixedOffset>> {
+    if value.len() > 64 || value.chars().any(char::is_control) {
+        return Err(failed());
+    }
+    DateTime::parse_from_rfc3339(value).map_err(|_| failed())
+}
+
+fn valid_operation(value: &str) -> bool {
+    (16..=128).contains(&value.len()) && !value.chars().any(char::is_control)
+}
+
+fn valid_alias(value: &str) -> bool {
+    valid_local_name(value, 128, false)
+}
+
+fn valid_purpose(value: &str) -> bool {
+    valid_local_name(value, 128, true)
+}
+
+fn valid_local_name(value: &str, maximum: usize, colon: bool) -> bool {
+    let mut bytes = value.bytes();
+    matches!(bytes.next(), Some(b'a'..=b'z'))
+        && value.len() <= maximum
+        && bytes.all(|byte| {
+            byte.is_ascii_lowercase()
+                || byte.is_ascii_digit()
+                || matches!(byte, b'.' | b'_' | b'-')
+                || (colon && byte == b':')
+        })
+}
+
+fn valid_pseudonym(value: &str) -> bool {
+    let Some(rest) = value.strip_prefix("hmac-sha256:v") else {
+        return false;
+    };
+    let Some((version, digest)) = rest.split_once(':') else {
+        return false;
+    };
+    !version.is_empty()
+        && !version.starts_with('0')
+        && version.bytes().all(|byte| byte.is_ascii_digit())
+        && digest.len() == 64
+        && digest
+            .bytes()
+            .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
+}
+
+fn valid_uri(value: &str) -> bool {
+    !value.is_empty() && value.len() <= 512 && url::Url::parse(value).is_ok()
+}
+
+fn failed() -> anyhow::Error {
+    anyhow!(AUDIT_FAILED)
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct CoreAuditOperation {
+    schema: String,
+    operation: String,
+    events: Vec<CoreAuditEvent>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct CoreAuditEvent {
+    occurred_at: String,
+    phase: Phase,
+    decision: Decision,
+    requirement: String,
+    purpose: String,
+    requester_pseudonym: String,
+    response_protection: ResponseProtection,
+    #[serde(default, deserialize_with = "deserialize_presence")]
+    disclosed_concepts: Presence<Vec<String>>,
+    #[serde(default, deserialize_with = "deserialize_presence")]
+    evidence_id: Presence<String>,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq)]
+#[serde(rename_all = "kebab-case")]
+enum Phase {
+    AccessAttempt,
+    DisclosureRelease,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq)]
+#[serde(rename_all = "kebab-case")]
+enum Decision {
+    Authorized,
+    Released,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq)]
+#[serde(rename_all = "kebab-case")]
+enum ResponseProtection {
+    Signed,
+    SdJwtVc,
+}
+
+#[derive(Debug, Default, Eq, PartialEq)]
+enum Presence<T> {
+    #[default]
+    Absent,
+    Present(T),
+}
+
+fn deserialize_presence<'de, D, T>(deserializer: D) -> Result<Presence<T>, D::Error>
+where
+    D: Deserializer<'de>,
+    T: Deserialize<'de>,
+{
+    T::deserialize(deserializer).map(Presence::Present)
+}
diff --git a/crates/registry-evidencectl/src/authoring.rs b/crates/registry-evidencectl/src/authoring.rs
new file mode 100644
index 000000000..ccfeb4b06
--- /dev/null
+++ b/crates/registry-evidencectl/src/authoring.rs
@@ -0,0 +1,5105 @@
+//! Compile the deliberately narrow local tutorial authoring shape into the
+//! runtime's canonical deployment inputs.
+//!
+//! This module is an internal seam for `dev`. It does not expose another CLI
+//! surface and it delegates the final semantic decision to `evidence check`.
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fs::{self, File},
+    io::Read as _,
+    os::unix::fs::{DirBuilderExt as _, MetadataExt as _, PermissionsExt as _},
+    path::{Component, Path, PathBuf},
+    process::Command,
+};
+
+use anyhow::{anyhow, bail, Context as _, Result};
+use registry_platform_crypto::{canonicalize_json, domain_separated_sha256};
+use serde::Deserialize;
+use serde_json::{json, Map, Value};
+use url::{Host, Url};
+
+use crate::suggest::{
+    narrow,
+    openapi::Spec,
+    types::{BoundKind, BoundValues, OperationKey},
+};
+
+const OPENAPI_FILE: &str = "source.openapi.yaml";
+const QUESTIONS_DIRECTORY: &str = "questions";
+const SOURCES_DIRECTORY: &str = "sources";
+const SELECTORS_DIRECTORY: &str = "selectors";
+const DERIVATIONS_DIRECTORY: &str = "derivations";
+const SCHEMAS_DIRECTORY: &str = "schemas";
+const FIXTURES_DIRECTORY: &str = "fixtures";
+const SECRETS_DIRECTORY: &str = "secrets";
+const ACCESS_DIRECTORY: &str = "access";
+const ACCESS_POLICIES_DIRECTORY: &str = "policies";
+const LOCAL_URI_PREFIX: &str = "urn:registrystack:evidence:local:";
+const LOCAL_AUDIENCE: &str = "registry-evidence-local";
+const SIGNING_KEY_ID: &str = "local-signing-key-1";
+const AUTHORITY_PROFILE_ID: &str = "local-caller";
+const LOCAL_CALLER_EVIDENCE_AUDIENCE: &str = "urn:registrystack:evidence:local:caller";
+const MAX_OPENAPI_BYTES: u64 = 16 * 1024 * 1024;
+const MAX_QUESTION_BYTES: u64 = 64 * 1024;
+const MAX_ACCESS_POLICY_BYTES: u64 = 64 * 1024;
+const MAX_DERIVATION_BYTES: u64 = 64 * 1024;
+const MAX_SOURCE_ARTIFACT_BYTES: u64 = 1024 * 1024;
+const MAX_QUESTIONS: usize = 128;
+const MAX_CONCEPTS: usize = 16;
+const MAX_CATEGORIES: usize = 32;
+const MAX_CATEGORY_BYTES: usize = 64;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum CompiledConceptForm {
+    Boolean,
+    ControlledCategory,
+    BoundedInteger,
+    Structured,
+}
+
+#[derive(Debug, Eq, PartialEq)]
+pub(crate) struct CompiledConcept {
+    pub(crate) concept_alias: String,
+    pub(crate) concept_uri: String,
+    pub(crate) concept_form: CompiledConceptForm,
+}
+
+/// Closed metadata consumed later by `dev` and request preparation. It stays
+/// in memory here; this compiler does not create a second public artifact.
+#[derive(Debug, Eq, PartialEq)]
+pub(crate) struct CompiledQuestion {
+    pub(crate) question_alias: String,
+    pub(crate) requirement_uri: String,
+    pub(crate) purpose: String,
+    pub(crate) subjects: Vec<CompiledSubject>,
+    pub(crate) concepts: Vec<CompiledConcept>,
+}
+
+#[derive(Debug, Eq, PartialEq)]
+pub(crate) struct CompiledSubject {
+    pub(crate) role: String,
+    pub(crate) selector_profile: String,
+    pub(crate) selector_field: String,
+}
+
+#[derive(Debug, Eq, PartialEq)]
+pub(crate) struct CompiledProject {
+    pub(crate) runtime_path: PathBuf,
+    pub(crate) questions: Vec<CompiledQuestion>,
+    pub(crate) local_audience: String,
+    pub(crate) requester_tag: String,
+    pub(crate) caller_evidence_audience: String,
+    pub(crate) access_policies: Vec<CompiledAccessPolicy>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct CompiledAccessPolicy {
+    pub(crate) id: String,
+    pub(crate) requester_tag: String,
+    pub(crate) questions: Vec<String>,
+}
+
+#[derive(Debug)]
+pub(crate) struct CompiledProductionProject {
+    pub(crate) bundle_path: PathBuf,
+    pub(crate) fixture_paths: Vec<String>,
+    pub(crate) bundle: Value,
+}
+
+enum CompileProfile {
+    Local(LocalServicePorts),
+    Production(Value),
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) struct LocalServicePorts {
+    pub(crate) evidence: u16,
+    pub(crate) mint: u16,
+}
+
+impl LocalServicePorts {
+    pub(crate) fn new(evidence: u16, mint: u16) -> Result<Self> {
+        if evidence == 0 || mint == 0 {
+            bail!("local service ports must be non-zero");
+        }
+        if evidence == mint {
+            bail!("Evidence and Mint must use different local ports");
+        }
+        Ok(Self { evidence, mint })
+    }
+
+    pub(crate) fn mint_origin(self) -> String {
+        format!("http://127.0.0.1:{}", self.mint)
+    }
+}
+
+impl Default for LocalServicePorts {
+    fn default() -> Self {
+        Self {
+            evidence: 8080,
+            mint: 8081,
+        }
+    }
+}
+
+/// Compile the authored questions into one unpublished local generation, then
+/// ask the real Evidence binary to check the complete result.
+///
+/// `staging_root` must be an existing, empty, owner-only directory. The caller
+/// owns generation publication and process supervision.
+#[cfg(test)]
+pub(crate) fn compile_local_project(
+    project_root: &Path,
+    staging_root: &Path,
+    evidence_bin: &Path,
+) -> Result<CompiledProject> {
+    compile_local_project_with_ports(
+        project_root,
+        staging_root,
+        evidence_bin,
+        LocalServicePorts::default(),
+    )
+}
+
+pub(crate) fn compile_local_project_with_ports(
+    project_root: &Path,
+    staging_root: &Path,
+    evidence_bin: &Path,
+    ports: LocalServicePorts,
+) -> Result<CompiledProject> {
+    LocalServicePorts::new(ports.evidence, ports.mint)?;
+    let project_root = validate_project_root(project_root)?;
+    validate_private_empty_staging(staging_root)?;
+    validate_evidence_binary(evidence_bin)?;
+
+    // Resolve the complete plan before writing anything. Unsupported or
+    // ambiguous authoring inputs therefore leave the staging root empty.
+    let inputs = read_inputs(&project_root, true)?;
+    let plan = compile_plan(inputs, CompileProfile::Local(ports))?;
+    let compilation = write_plan(&project_root, staging_root, &plan, ports)?;
+
+    if let Err(error) = check_with_evidence(evidence_bin, &compilation.runtime_path) {
+        // A rejected unpublished generation should remain removable by its
+        // owner. No path outside the caller-supplied staging root is changed.
+        let _ = set_bundle_modes(&staging_root.join("bundle"), 0o700, 0o600);
+        let _ = fs::set_permissions(&compilation.runtime_path, fs::Permissions::from_mode(0o600));
+        return Err(error);
+    }
+
+    Ok(compilation)
+}
+
+/// Compile one complete production bundle into an unpublished private staging
+/// directory. The caller owns temporary runtime validation and publication.
+pub(crate) fn compile_production_project(
+    project_root: &Path,
+    staging_root: &Path,
+    governed_bundle: Value,
+) -> Result<CompiledProductionProject> {
+    validate_plain_path_components(project_root, "production project")?;
+    let project_root = validate_project_root(project_root)?;
+    validate_private_empty_staging(staging_root)?;
+    let inputs = read_inputs(&project_root, false)?;
+    validate_production_inputs(&project_root, &inputs)?;
+    let plan = compile_plan(inputs, CompileProfile::Production(governed_bundle))?;
+    reject_local_production_values(&plan.bundle)?;
+    validate_production_sources(&plan.bundle)?;
+    let bundle_path = write_bundle(&project_root, staging_root, &plan)?;
+    let fixture_paths = plan
+        .questions
+        .iter()
+        .map(|question| {
+            question
+                .fixture_artifact
+                .clone()
+                .expect("production questions were validated")
+        })
+        .collect();
+    Ok(CompiledProductionProject {
+        bundle_path,
+        fixture_paths,
+        bundle: plan.bundle,
+    })
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Question {
+    id: String,
+    question: String,
+    purpose: String,
+    #[serde(default)]
+    subject: Option<QuestionSubject>,
+    #[serde(default)]
+    subjects: Vec<QuestionSubject>,
+    source: QuestionSource,
+    answers: Vec<QuestionAnswer>,
+    derivation: String,
+    disclosure: QuestionDisclosure,
+    #[serde(default)]
+    governance: Option<QuestionGovernance>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct QuestionGovernance {
+    requirement: String,
+    kind: RequirementKind,
+    reference_frameworks: Vec<String>,
+    evidence_type: String,
+    validity_seconds: u64,
+    observation_timezone: String,
+    fixtures: String,
+    disclosure_families: Vec<String>,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+enum RequirementKind {
+    Criterion,
+    InformationRequirement,
+    Constraint,
+}
+
+impl RequirementKind {
+    fn as_str(self) -> &'static str {
+        match self {
+            Self::Criterion => "criterion",
+            Self::InformationRequirement => "information-requirement",
+            Self::Constraint => "constraint",
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct QuestionSubject {
+    role: String,
+    selector: String,
+    #[serde(default)]
+    profile: Option<String>,
+    #[serde(default)]
+    derivation: bool,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct QuestionSource {
+    #[serde(rename = "ref")]
+    source_ref: Option<String>,
+    #[serde(default)]
+    operation: Option<String>,
+    #[serde(default)]
+    facts: Vec<QuestionFact>,
+    #[serde(rename = "collectionBounds", default)]
+    collection_bounds: BTreeMap<String, u64>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct QuestionFact {
+    name: String,
+    path: String,
+    combine: FactCombination,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq)]
+#[serde(rename_all = "kebab-case")]
+enum FactCombination {
+    ExactlyOne,
+    Collect,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct QuestionAnswer {
+    concept: String,
+    #[serde(default)]
+    id: Option<String>,
+    #[serde(rename = "type")]
+    answer_type: AnswerType,
+    #[serde(default)]
+    values: Vec<String>,
+    minimum: Option<i64>,
+    maximum: Option<i64>,
+    schema: Option<String>,
+    #[serde(rename = "maximumSerializedBytes")]
+    maximum_serialized_bytes: Option<u64>,
+    #[serde(rename = "sdJwtVc")]
+    sd_jwt_vc: Option<QuestionSdJwtVc>,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+enum AnswerType {
+    Boolean,
+    ControlledCategory,
+    BoundedInteger,
+    ReviewedStructuredValue,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct QuestionSdJwtVc {
+    claim: String,
+    disclosure: QuestionSdJwtVcDisclosure,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+enum QuestionSdJwtVcDisclosure {
+    TopLevel,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct QuestionDisclosure {
+    allow: Vec<String>,
+}
+
+struct Inputs {
+    openapi: Value,
+    selectors: BTreeMap<String, Value>,
+    sources: BTreeMap<String, Value>,
+    schemas: BTreeMap<String, Value>,
+    questions: Vec<AuthoredQuestion>,
+    access_policies: Vec<AuthoredAccessPolicy>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct AccessPolicyDocument {
+    version: u8,
+    id: String,
+    questions: Vec<String>,
+}
+
+#[derive(Clone)]
+struct AuthoredAccessPolicy {
+    id: String,
+    requester_tag: String,
+    questions: Vec<String>,
+}
+
+struct AuthoredQuestion {
+    question: Question,
+    derivation: String,
+}
+
+struct CompilePlan {
+    questions: Vec<QuestionPlan>,
+    access_policies: Vec<AuthoredAccessPolicy>,
+    bundle: Value,
+}
+
+struct QuestionPlan {
+    question_id: String,
+    source_artifact_id: String,
+    authored_source_artifacts: Option<Vec<String>>,
+    derivation_artifact: String,
+    fixture_artifact: Option<String>,
+    purpose: String,
+    requirement_uri: String,
+    concepts: Vec<ConceptPlan>,
+    subjects: Vec<SubjectPlan>,
+    source_id: String,
+    source_value: Value,
+    grant: Value,
+    requirement: Value,
+    response_schema: Value,
+    fact_schema: Value,
+    adapter_parameters_schema: Value,
+    prepare_script: String,
+    extract_script: String,
+    derivation_script: String,
+}
+
+struct SubjectPlan {
+    role: String,
+    selector_field: String,
+    selector_profile: String,
+    selector_profile_value: Value,
+    derivation: bool,
+}
+
+struct ConceptPlan {
+    concept_alias: String,
+    concept_uri: String,
+    concept_form: CompiledConceptForm,
+    constraints: Value,
+    codelist: Option<(String, Value)>,
+    schema: Option<(String, Value)>,
+    sd_jwt_vc: Option<Value>,
+}
+
+struct CompiledFacts {
+    response_schema: Value,
+    fact_schema: Value,
+    extract_script: String,
+}
+
+struct BundleRequirement<'a> {
+    requirement_uri: String,
+    kind: &'static str,
+    concepts: &'a [ConceptPlan],
+}
+
+struct Operation<'a> {
+    method: &'a str,
+    path: &'a str,
+    path_item: &'a Map<String, Value>,
+    operation: &'a Map<String, Value>,
+}
+
+fn validate_project_root(project_root: &Path) -> Result<PathBuf> {
+    let metadata = fs::symlink_metadata(project_root)
+        .with_context(|| format!("inspecting project root {}", project_root.display()))?;
+    if metadata.file_type().is_symlink() || !metadata.is_dir() {
+        bail!(
+            "project root {} must be a plain directory",
+            project_root.display()
+        );
+    }
+    fs::canonicalize(project_root)
+        .with_context(|| format!("resolving project root {}", project_root.display()))
+}
+
+fn validate_plain_path_components(path: &Path, description: &str) -> Result<()> {
+    let absolute = if path.is_absolute() {
+        path.to_path_buf()
+    } else {
+        std::env::current_dir()?.join(path)
+    };
+    let components = absolute.components().collect::<Vec<_>>();
+    let mut current = PathBuf::new();
+    for component in components {
+        match component {
+            Component::RootDir => current.push(Path::new("/")),
+            Component::Normal(value) => current.push(value),
+            Component::CurDir => continue,
+            Component::ParentDir | Component::Prefix(_) => {
+                bail!("{description} must not contain path traversal")
+            }
+        }
+        let metadata =
+            fs::symlink_metadata(&current).with_context(|| format!("inspecting {description}"))?;
+        if metadata.file_type().is_symlink() {
+            bail!("{description} must not traverse symbolic links");
+        }
+        if !metadata.is_dir() {
+            bail!("{description} must be a plain directory");
+        }
+    }
+    Ok(())
+}
+
+fn validate_private_empty_staging(staging_root: &Path) -> Result<()> {
+    let metadata = fs::symlink_metadata(staging_root)
+        .with_context(|| format!("inspecting staging root {}", staging_root.display()))?;
+    if metadata.file_type().is_symlink()
+        || !metadata.is_dir()
+        || metadata.uid() != rustix::process::geteuid().as_raw()
+        || metadata.permissions().mode() & 0o7777 != 0o700
+    {
+        bail!(
+            "local compilation staging root {} must be a plain owner-only directory (mode 0700)",
+            staging_root.display()
+        );
+    }
+    let mut entries = fs::read_dir(staging_root)
+        .with_context(|| format!("reading staging root {}", staging_root.display()))?;
+    if entries.next().transpose()?.is_some() {
+        bail!("local compilation staging root must be empty");
+    }
+    Ok(())
+}
+
+fn validate_evidence_binary(path: &Path) -> Result<()> {
+    let metadata = fs::metadata(path)
+        .with_context(|| format!("inspecting evidence binary {}", path.display()))?;
+    if !metadata.is_file() || metadata.permissions().mode() & 0o111 == 0 {
+        bail!(
+            "evidence binary {} is not an executable file",
+            path.display()
+        );
+    }
+    Ok(())
+}
+
+fn read_inputs(project_root: &Path, require_local_secrets: bool) -> Result<Inputs> {
+    let openapi_text = read_regular_file(
+        &project_root.join(OPENAPI_FILE),
+        MAX_OPENAPI_BYTES,
+        "retained OpenAPI document",
+    )?;
+    let openapi: Value = serde_norway::from_slice(&openapi_text)
+        .context("parsing retained OpenAPI document as YAML or JSON")?;
+    validate_openapi_version(&openapi)?;
+
+    let selectors = read_named_objects(project_root, SELECTORS_DIRECTORY, "selector profile")?;
+    let sources = read_named_objects(project_root, SOURCES_DIRECTORY, "source")?;
+    let schemas = read_named_objects(project_root, SCHEMAS_DIRECTORY, "schema")?;
+    let mut questions = Vec::new();
+    let mut question_ids = BTreeSet::new();
+    let mut derivation_paths = BTreeSet::new();
+    for question_path in question_paths(project_root)? {
+        let question_bytes = read_regular_file(&question_path, MAX_QUESTION_BYTES, "question")?;
+        let question: Question = serde_norway::from_slice(&question_bytes)
+            .with_context(|| format!("parsing question {}", question_path.display()))?;
+        validate_question(&question)?;
+        if question_path.file_stem().and_then(|value| value.to_str()) != Some(&question.id) {
+            bail!("question id must match its questions/<id>.yaml filename");
+        }
+        if !question_ids.insert(question.id.clone()) {
+            bail!("question ids must be unique");
+        }
+        if !derivation_paths.insert(question.derivation.clone()) {
+            bail!("each question must name its own derivation file");
+        }
+
+        let derivation_path = project_relative_derivation(project_root, &question.derivation)?;
+        let derivation_bytes = read_regular_file(
+            &derivation_path,
+            MAX_DERIVATION_BYTES,
+            "authored derivation",
+        )?;
+        let derivation =
+            String::from_utf8(derivation_bytes).context("authored derivation must be UTF-8")?;
+        validate_authored_answer(&derivation)?;
+        questions.push(AuthoredQuestion {
+            question,
+            derivation,
+        });
+    }
+    let access_policies = if require_local_secrets {
+        read_access_policies(project_root, &question_ids)?
+    } else {
+        Vec::new()
+    };
+
+    if require_local_secrets {
+        let secrets = project_root.join(SECRETS_DIRECTORY);
+        let secrets_metadata = fs::symlink_metadata(&secrets)
+            .with_context(|| format!("inspecting local secret directory {}", secrets.display()))?;
+        if secrets_metadata.file_type().is_symlink()
+            || !secrets_metadata.is_dir()
+            || secrets_metadata.uid() != rustix::process::geteuid().as_raw()
+            || secrets_metadata.permissions().mode() & 0o7777 != 0o700
+        {
+            bail!("local secret directory must be a plain owner-only directory (mode 0700)");
+        }
+    }
+
+    Ok(Inputs {
+        openapi,
+        selectors,
+        sources,
+        schemas,
+        questions,
+        access_policies,
+    })
+}
+
+fn validate_production_inputs(project_root: &Path, inputs: &Inputs) -> Result<()> {
+    for authored in &inputs.questions {
+        let question = &authored.question;
+        let governance = question
+            .governance
+            .as_ref()
+            .ok_or_else(|| anyhow!("every production question requires governance"))?;
+        if question.answers.iter().any(|answer| answer.id.is_none()) {
+            bail!("every production answer requires one stable concept id");
+        }
+        for uri in std::iter::once(governance.requirement.as_str())
+            .chain(governance.reference_frameworks.iter().map(String::as_str))
+            .chain(std::iter::once(governance.evidence_type.as_str()))
+            .chain(governance.disclosure_families.iter().map(String::as_str))
+            .chain(
+                question
+                    .answers
+                    .iter()
+                    .filter_map(|answer| answer.id.as_deref()),
+            )
+        {
+            if uri.starts_with(LOCAL_URI_PREFIX) {
+                bail!("production governance must not use disposable local identifiers");
+            }
+        }
+        let fixture = project_relative_fixture(project_root, &governance.fixtures)?;
+        let _ = read_regular_file(&fixture, MAX_SOURCE_ARTIFACT_BYTES, "production fixture")?;
+    }
+    Ok(())
+}
+
+fn project_relative_fixture(project_root: &Path, value: &str) -> Result<PathBuf> {
+    let relative = Path::new(value);
+    let components = relative.components().collect::<Vec<_>>();
+    if components.len() != 2
+        || components.first() != Some(&Component::Normal(FIXTURES_DIRECTORY.as_ref()))
+        || !matches!(components.get(1), Some(Component::Normal(_)))
+        || relative
+            .extension()
+            .and_then(|extension| extension.to_str())
+            != Some("yaml")
+    {
+        bail!("governance fixtures must be project-relative fixtures/<name>.yaml files");
+    }
+    let directory = project_root.join(FIXTURES_DIRECTORY);
+    let metadata = fs::symlink_metadata(&directory)
+        .with_context(|| format!("inspecting fixture directory {}", directory.display()))?;
+    if metadata.file_type().is_symlink() || !metadata.is_dir() {
+        bail!("fixtures must be held in a plain directory");
+    }
+    Ok(project_root.join(relative))
+}
+
+fn reject_local_production_values(bundle: &Value) -> Result<()> {
+    match bundle {
+        Value::String(value) if value.starts_with(LOCAL_URI_PREFIX) => {
+            bail!("the production bundle contains a disposable local identifier")
+        }
+        Value::Array(values) => {
+            for value in values {
+                reject_local_production_values(value)?;
+            }
+        }
+        Value::Object(values) => {
+            for value in values.values() {
+                reject_local_production_values(value)?;
+            }
+        }
+        _ => {}
+    }
+    Ok(())
+}
+
+fn validate_production_sources(bundle: &Value) -> Result<()> {
+    let sources = bundle
+        .get("sources")
+        .and_then(Value::as_object)
+        .ok_or_else(|| anyhow!("the production bundle has no sources object"))?;
+    for source in sources.values() {
+        let https = source
+            .get("baseUrl")
+            .and_then(Value::as_str)
+            .is_some_and(|value| value.starts_with("https://"));
+        let authenticated = source
+            .pointer("/authentication/kind")
+            .and_then(Value::as_str)
+            .is_some_and(|kind| kind != "none" && kind != "review-required");
+        if !https || !authenticated {
+            bail!("every production source must use authenticated HTTPS");
+        }
+    }
+    Ok(())
+}
+
+fn read_access_policies(
+    project_root: &Path,
+    question_ids: &BTreeSet<String>,
+) -> Result<Vec<AuthoredAccessPolicy>> {
+    let access_root = project_root.join(ACCESS_DIRECTORY);
+    let access_metadata = match fs::symlink_metadata(&access_root) {
+        Ok(metadata) => metadata,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(Vec::new()),
+        Err(error) => {
+            return Err(error)
+                .with_context(|| format!("inspecting access directory {}", access_root.display()))
+        }
+    };
+    if access_metadata.file_type().is_symlink() || !access_metadata.is_dir() {
+        bail!("access must be held in a plain project directory");
+    }
+    let directory = access_root.join(ACCESS_POLICIES_DIRECTORY);
+    let metadata = match fs::symlink_metadata(&directory) {
+        Ok(metadata) => metadata,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+            if access_root.join("clients").exists() {
+                bail!("client access configuration requires at least one access policy");
+            }
+            return Ok(Vec::new());
+        }
+        Err(error) => {
+            return Err(error).with_context(|| {
+                format!("inspecting access policy directory {}", directory.display())
+            })
+        }
+    };
+    if metadata.file_type().is_symlink() || !metadata.is_dir() {
+        bail!("access policies must be held in a plain access/policies directory");
+    }
+    let mut paths = fs::read_dir(&directory)
+        .with_context(|| format!("reading access policy directory {}", directory.display()))?
+        .map(|entry| entry.map(|entry| entry.path()))
+        .collect::<std::io::Result<Vec<_>>>()?;
+    paths.sort();
+    if !(1..=MAX_QUESTIONS).contains(&paths.len()) {
+        bail!("explicit access configuration requires 1..={MAX_QUESTIONS} access policies");
+    }
+
+    let mut ids = BTreeSet::new();
+    let mut policies = Vec::with_capacity(paths.len());
+    for path in paths {
+        if path.extension().and_then(|extension| extension.to_str()) != Some("yaml") {
+            bail!("access-policies may contain only <id>.yaml files");
+        }
+        let bytes = read_regular_file(&path, MAX_ACCESS_POLICY_BYTES, "access policy")?;
+        let policy: AccessPolicyDocument = serde_norway::from_slice(&bytes)
+            .with_context(|| format!("parsing access policy {}", path.display()))?;
+        if policy.version != 1 {
+            bail!("access policy version must be 1");
+        }
+        if !valid_local_identifier(&policy.id) {
+            bail!("access policy id must be a lowercase local identifier");
+        }
+        if path.file_stem().and_then(|value| value.to_str()) != Some(&policy.id) {
+            bail!("access policy id must match its access/policies/<id>.yaml filename");
+        }
+        if !ids.insert(policy.id.clone()) {
+            bail!("access policy ids must be unique");
+        }
+        if !(1..=MAX_QUESTIONS).contains(&policy.questions.len()) {
+            bail!("an access policy must name 1..={MAX_QUESTIONS} questions");
+        }
+        if !policy.questions.windows(2).all(|pair| pair[0] < pair[1]) {
+            bail!("access policy questions must be sorted and unique");
+        }
+        if policy
+            .questions
+            .iter()
+            .any(|question| !question_ids.contains(question))
+        {
+            bail!("access policy names a question that does not exist in this project");
+        }
+        let questions = policy.questions;
+        let requester_tag = access_policy_requester_tag(&policy.id, &questions)?;
+        policies.push(AuthoredAccessPolicy {
+            id: policy.id,
+            requester_tag,
+            questions,
+        });
+    }
+    Ok(policies)
+}
+
+pub(crate) fn access_policy_requester_tag(id: &str, questions: &[String]) -> Result<String> {
+    if !valid_local_identifier(id) || questions.is_empty() || questions.len() > MAX_QUESTIONS {
+        bail!("access policy is outside the closed local profile");
+    }
+    if !questions.windows(2).all(|pair| pair[0] < pair[1])
+        || questions
+            .iter()
+            .any(|question| !valid_local_identifier(question))
+    {
+        bail!("access policy questions must be unique lowercase local identifiers");
+    }
+    let canonical = canonicalize_json(&json!({
+        "version": 1,
+        "id": id,
+        "questions": questions,
+    }))
+    .context("canonicalizing access policy")?;
+    let digest = domain_separated_sha256(b"registry-evidencectl-access-policy-v1\0", &canonical);
+    let mut tag = String::from("policy-v1-");
+    for byte in digest {
+        use std::fmt::Write as _;
+        write!(&mut tag, "{byte:02x}").expect("writing to a string cannot fail");
+    }
+    Ok(tag)
+}
+
+fn read_named_objects(
+    project_root: &Path,
+    directory_name: &str,
+    description: &str,
+) -> Result<BTreeMap<String, Value>> {
+    let directory = project_root.join(directory_name);
+    let metadata = match fs::symlink_metadata(&directory) {
+        Ok(metadata) => metadata,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(BTreeMap::new()),
+        Err(error) => {
+            return Err(error).with_context(|| {
+                format!("inspecting {description} directory {}", directory.display())
+            })
+        }
+    };
+    if metadata.file_type().is_symlink() || !metadata.is_dir() {
+        bail!("{directory_name} must be held in a plain directory");
+    }
+    let mut paths = fs::read_dir(&directory)
+        .with_context(|| format!("reading {description} directory {}", directory.display()))?
+        .map(|entry| entry.map(|entry| entry.path()))
+        .collect::<std::io::Result<Vec<_>>>()?;
+    paths.sort();
+
+    let mut objects = BTreeMap::new();
+    for path in paths {
+        if path.extension().and_then(|extension| extension.to_str()) != Some("yaml") {
+            bail!("{directory_name} may contain only <id>.yaml files");
+        }
+        let bytes = read_regular_file(&path, MAX_SOURCE_ARTIFACT_BYTES, description)?;
+        let value: Value = serde_norway::from_slice(&bytes)
+            .with_context(|| format!("parsing {description} {}", path.display()))?;
+        if !value.is_object() {
+            bail!("{description} must be a YAML object");
+        }
+        let id = path
+            .file_stem()
+            .and_then(|stem| stem.to_str())
+            .ok_or_else(|| anyhow!("{description} file name is not valid UTF-8"))?;
+        if !valid_local_identifier(id) {
+            bail!("{description} file name must be a lowercase local identifier");
+        }
+        objects.insert(id.to_owned(), value);
+    }
+    Ok(objects)
+}
+
+/// Parse the authored program as Rhai and reserve `derive` exclusively for
+/// the generated binding wrapper. Function discovery comes from the AST, so
+/// strings, comments, and whitespace cannot masquerade as entry points.
+fn validate_authored_answer(source: &str) -> Result<()> {
+    let ast = rhai::Engine::new()
+        .compile(source)
+        .map_err(|_| anyhow!("authored derivation does not compile as Rhai"))?;
+    let mut names = BTreeSet::new();
+    let mut answers = 0;
+    for function in ast.iter_functions() {
+        if !names.insert(function.name) {
+            bail!("authored derivation function names must be unique");
+        }
+        if function.name == "derive" {
+            bail!("the `derive` entry point is reserved for the generated concept binding");
+        }
+        if function.name == "answer" {
+            if function.params.len() != 3 {
+                bail!("authored derivation must declare answer(facts, selectors, context)");
+            }
+            answers += 1;
+        }
+    }
+    if answers != 1 {
+        bail!("authored derivation must declare exactly one answer(facts, selectors, context)");
+    }
+    Ok(())
+}
+
+fn read_regular_file(path: &Path, maximum_bytes: u64, description: &str) -> Result<Vec<u8>> {
+    use rustix::fs::{Mode, OFlags};
+
+    let descriptor = rustix::fs::open(
+        path,
+        OFlags::RDONLY | OFlags::CLOEXEC | OFlags::NOFOLLOW | OFlags::NONBLOCK,
+        Mode::empty(),
+    )
+    .map_err(std::io::Error::from)
+    .with_context(|| format!("opening {description} {}", path.display()))?;
+    let mut file = File::from(descriptor);
+    let metadata = file
+        .metadata()
+        .with_context(|| format!("inspecting {description} {}", path.display()))?;
+    if !metadata.is_file() || metadata.nlink() != 1 || metadata.len() > maximum_bytes {
+        bail!(
+            "{description} {} is not a bounded plain file",
+            path.display()
+        );
+    }
+    let mut bytes = Vec::new();
+    file.by_ref()
+        .take(maximum_bytes.saturating_add(1))
+        .read_to_end(&mut bytes)
+        .with_context(|| format!("reading {description} {}", path.display()))?;
+    if u64::try_from(bytes.len()).unwrap_or(u64::MAX) > maximum_bytes {
+        bail!("{description} exceeds its byte limit");
+    }
+    Ok(bytes)
+}
+
+fn question_paths(project_root: &Path) -> Result<Vec<PathBuf>> {
+    let directory = project_root.join(QUESTIONS_DIRECTORY);
+    let metadata = fs::symlink_metadata(&directory)
+        .with_context(|| format!("inspecting question directory {}", directory.display()))?;
+    if metadata.file_type().is_symlink() || !metadata.is_dir() {
+        bail!("questions must be held in a plain directory");
+    }
+    let mut paths = fs::read_dir(&directory)
+        .with_context(|| format!("reading question directory {}", directory.display()))?
+        .map(|entry| entry.map(|entry| entry.path()))
+        .collect::<std::io::Result<Vec<_>>>()?;
+    paths.sort();
+    if paths.is_empty() || paths.len() > MAX_QUESTIONS {
+        bail!("local authoring requires 1..={MAX_QUESTIONS} questions/*.yaml files");
+    }
+    if paths
+        .iter()
+        .any(|path| path.extension().and_then(|value| value.to_str()) != Some("yaml"))
+    {
+        bail!("questions must contain only questions/*.yaml files");
+    }
+    Ok(paths)
+}
+
+fn project_relative_derivation(project_root: &Path, value: &str) -> Result<PathBuf> {
+    let relative = Path::new(value);
+    let components = relative.components().collect::<Vec<_>>();
+    if components.len() != 2
+        || components.first() != Some(&Component::Normal(DERIVATIONS_DIRECTORY.as_ref()))
+        || !matches!(components.get(1), Some(Component::Normal(_)))
+        || relative
+            .extension()
+            .and_then(|extension| extension.to_str())
+            != Some("rhai")
+    {
+        bail!("derivation must be a project-relative derivations/<name>.rhai file");
+    }
+    let directory = project_root.join(DERIVATIONS_DIRECTORY);
+    let metadata = fs::symlink_metadata(&directory)
+        .with_context(|| format!("inspecting derivation directory {}", directory.display()))?;
+    if metadata.file_type().is_symlink() || !metadata.is_dir() {
+        bail!("derivations must be held in a plain directory");
+    }
+    Ok(project_root.join(relative))
+}
+
+fn validate_question(question: &Question) -> Result<()> {
+    for (label, value) in [
+        ("id", question.id.as_str()),
+        ("purpose", question.purpose.as_str()),
+    ] {
+        if !valid_local_identifier(value) {
+            bail!("question {label} must be a lowercase local identifier");
+        }
+    }
+    let subjects = question_subjects(question)?;
+    let mut roles = BTreeSet::new();
+    for subject in &subjects {
+        if !valid_local_identifier(&subject.role)
+            || !valid_local_identifier(&subject.selector)
+            || subject
+                .profile
+                .as_deref()
+                .is_some_and(|profile| !valid_local_identifier(profile))
+        {
+            bail!("question subjects must use lowercase local role, selector, and profile identifiers");
+        }
+        if !roles.insert(subject.role.as_str()) {
+            bail!("question subject roles must be unique");
+        }
+    }
+    if question.question.is_empty()
+        || question.question.len() > 512
+        || question.question.chars().any(char::is_control)
+    {
+        bail!("question text must be a non-empty bounded line of text");
+    }
+    if !(1..=MAX_CONCEPTS).contains(&question.answers.len()) {
+        bail!("answers must contain 1..={MAX_CONCEPTS} governed concepts");
+    }
+    let mut concepts = BTreeSet::new();
+    let mut sd_jwt_claims = BTreeSet::new();
+    for answer in &question.answers {
+        if !valid_local_identifier(&answer.concept) {
+            bail!("answer concept must be a lowercase local identifier");
+        }
+        if !concepts.insert(answer.concept.as_str()) {
+            bail!("answer concepts must be unique");
+        }
+        validate_answer(answer)?;
+        if let Some(projection) = &answer.sd_jwt_vc {
+            if !sd_jwt_claims.insert(projection.claim.as_str()) {
+                bail!("sdJwtVc.claim names must be unique within a question");
+            }
+        }
+    }
+    match (&question.source.source_ref, &question.source.operation) {
+        (Some(source_ref), None) => {
+            if !valid_local_identifier(source_ref)
+                || !question.source.facts.is_empty()
+                || !question.source.collection_bounds.is_empty()
+            {
+                bail!("a source reference must contain only one valid ref");
+            }
+        }
+        (None, Some(operation)) => {
+            if question.source.facts.is_empty() || question.source.facts.len() > 16 {
+                bail!("source.facts must contain 1..=16 authored fact selections");
+            }
+            let mut names = BTreeSet::new();
+            let mut paths = BTreeSet::new();
+            for fact in &question.source.facts {
+                if !valid_field_name(&fact.name) || !names.insert(fact.name.as_str()) {
+                    bail!("source fact names must be unique lowercase local identifiers");
+                }
+                if fact.path.is_empty()
+                    || fact.path.len() > 256
+                    || !fact.path.starts_with('/')
+                    || fact.path.chars().any(char::is_control)
+                    || !paths.insert(fact.path.as_str())
+                {
+                    bail!("source fact paths must be unique bounded extended JSON Pointers");
+                }
+                let repeated = fact.path.split('/').any(|segment| segment == "*");
+                match (repeated, fact.combine) {
+                    (false, FactCombination::ExactlyOne) | (true, FactCombination::Collect) => {}
+                    (false, FactCombination::Collect) => bail!(
+                        "source fact `{}` uses `collect` but its path visits no collection",
+                        fact.name
+                    ),
+                    (true, FactCombination::ExactlyOne) => bail!(
+                        "source fact `{}` visits a collection and must explicitly use `combine: collect`",
+                        fact.name
+                    ),
+                }
+            }
+            if question.source.collection_bounds.len() > 16
+                || question
+                    .source
+                    .collection_bounds
+                    .iter()
+                    .any(|(pointer, maximum)| {
+                        pointer.is_empty()
+                            || pointer.len() > 256
+                            || !pointer.starts_with('/')
+                            || pointer.chars().any(char::is_control)
+                            || !(1..=256).contains(maximum)
+                    })
+            {
+                bail!("source.collectionBounds must contain bounded array pointers with values in 1..=256");
+            }
+            if operation.is_empty()
+                || operation.len() > 256
+                || operation.chars().any(char::is_control)
+            {
+                bail!("source.operation must name one bounded OpenAPI operationId");
+            }
+        }
+        _ => bail!("source must declare either ref or operation with facts"),
+    }
+    let allowed = question
+        .disclosure
+        .allow
+        .iter()
+        .map(String::as_str)
+        .collect::<BTreeSet<_>>();
+    if allowed != concepts || allowed.len() != question.disclosure.allow.len() {
+        bail!("disclosure.allow must contain exactly the declared answer concepts");
+    }
+    Ok(())
+}
+
+fn question_subjects(question: &Question) -> Result<Vec<&QuestionSubject>> {
+    match (&question.subject, question.subjects.as_slice()) {
+        (Some(subject), []) => Ok(vec![subject]),
+        (None, subjects) if (1..=8).contains(&subjects.len()) => Ok(subjects.iter().collect()),
+        (Some(_), _) => bail!("question must declare either subject or subjects, not both"),
+        (None, _) => bail!("question must declare 1..=8 subjects"),
+    }
+}
+
+fn validate_answer(answer: &QuestionAnswer) -> Result<()> {
+    match answer.answer_type {
+        AnswerType::Boolean => {
+            if !answer.values.is_empty()
+                || answer.minimum.is_some()
+                || answer.maximum.is_some()
+                || answer.schema.is_some()
+                || answer.maximum_serialized_bytes.is_some()
+                || answer.sd_jwt_vc.is_some()
+            {
+                bail!("a boolean answer must not declare values or numeric bounds");
+            }
+        }
+        AnswerType::ControlledCategory => {
+            if answer.minimum.is_some()
+                || answer.maximum.is_some()
+                || answer.schema.is_some()
+                || answer.maximum_serialized_bytes.is_some()
+                || answer.sd_jwt_vc.is_some()
+            {
+                bail!("a controlled-category answer must not declare numeric bounds");
+            }
+            if !(2..=MAX_CATEGORIES).contains(&answer.values.len())
+                || answer.values.iter().collect::<BTreeSet<_>>().len() != answer.values.len()
+                || answer.values.iter().any(|value| {
+                    value.is_empty()
+                        || value.len() > MAX_CATEGORY_BYTES
+                        || value.chars().any(char::is_control)
+                })
+            {
+                bail!(
+                    "a controlled-category answer needs 2..={MAX_CATEGORIES} unique bounded values"
+                );
+            }
+        }
+        AnswerType::BoundedInteger => {
+            if !answer.values.is_empty()
+                || answer.schema.is_some()
+                || answer.maximum_serialized_bytes.is_some()
+                || answer.sd_jwt_vc.is_some()
+            {
+                bail!("a bounded-integer answer must not declare category values");
+            }
+            let (Some(minimum), Some(maximum)) = (answer.minimum, answer.maximum) else {
+                bail!("a bounded-integer answer requires minimum and maximum");
+            };
+            const JSON_SAFE_INTEGER: i64 = 9_007_199_254_740_991;
+            if !(-JSON_SAFE_INTEGER..=JSON_SAFE_INTEGER).contains(&minimum)
+                || !(-JSON_SAFE_INTEGER..=JSON_SAFE_INTEGER).contains(&maximum)
+                || minimum > maximum
+            {
+                bail!("a bounded-integer answer needs consistent JSON-safe bounds");
+            }
+        }
+        AnswerType::ReviewedStructuredValue => {
+            if !answer.values.is_empty() || answer.minimum.is_some() || answer.maximum.is_some() {
+                bail!("a reviewed structured answer must not declare scalar constraints");
+            }
+            let schema = answer
+                .schema
+                .as_deref()
+                .ok_or_else(|| anyhow!("a reviewed structured answer requires schema"))?;
+            validate_answer_schema_path(schema)?;
+            if !matches!(answer.maximum_serialized_bytes, Some(1..=65_536)) {
+                bail!("a reviewed structured answer requires maximumSerializedBytes in 1..=65536");
+            }
+            if let Some(projection) = &answer.sd_jwt_vc {
+                validate_sd_jwt_claim_name(&projection.claim)?;
+            }
+        }
+    }
+    Ok(())
+}
+
+fn validate_answer_schema_path(value: &str) -> Result<()> {
+    let path = Path::new(value);
+    let components = path.components().collect::<Vec<_>>();
+    if components.len() != 2
+        || components.first() != Some(&Component::Normal(SCHEMAS_DIRECTORY.as_ref()))
+        || !matches!(components.get(1), Some(Component::Normal(_)))
+        || path.extension().and_then(|extension| extension.to_str()) != Some("yaml")
+    {
+        bail!("answer schema must be one schemas/<name>.yaml file");
+    }
+    Ok(())
+}
+
+fn validate_sd_jwt_claim_name(value: &str) -> Result<()> {
+    const RESERVED: [&str; 24] = [
+        "iss",
+        "sub",
+        "aud",
+        "iat",
+        "nbf",
+        "exp",
+        "vct",
+        "id",
+        "jti",
+        "_sd",
+        "_sd_alg",
+        "cnf",
+        "status",
+        "issuedBy",
+        "providedBy",
+        "supportsRequirement",
+        "purpose",
+        "audience",
+        "assuranceProfile",
+        "observedAt",
+        "configurationRevision",
+        "requestNonce",
+        "subjects",
+        "structuredValues",
+    ];
+    let bytes = value.as_bytes();
+    if bytes.is_empty()
+        || bytes.len() > 64
+        || !matches!(bytes.first(), Some(b'A'..=b'Z' | b'a'..=b'z'))
+        || !bytes[1..]
+            .iter()
+            .all(|byte| byte.is_ascii_alphanumeric() || *byte == b'_')
+        || RESERVED.contains(&value)
+    {
+        bail!("sdJwtVc.claim must be a bounded JSON claim name");
+    }
+    Ok(())
+}
+
+fn valid_local_identifier(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    matches!(bytes.first(), Some(b'a'..=b'z'))
+        && bytes.len() <= 64
+        && bytes[1..].iter().all(|byte| {
+            byte.is_ascii_lowercase() || byte.is_ascii_digit() || matches!(byte, b'.' | b'_' | b'-')
+        })
+}
+
+fn valid_field_name(value: &str) -> bool {
+    valid_local_identifier(value)
+}
+
+fn validate_openapi_version(document: &Value) -> Result<()> {
+    let version = document
+        .get("openapi")
+        .and_then(Value::as_str)
+        .ok_or_else(|| anyhow!("retained document has no OpenAPI version"))?;
+    if !(version.starts_with("3.0.") || version.starts_with("3.1.")) {
+        bail!("only OpenAPI 3.0.x and 3.1.x are supported");
+    }
+    Ok(())
+}
+
+fn compile_plan(inputs: Inputs, profile: CompileProfile) -> Result<CompilePlan> {
+    let has_inline_source = inputs
+        .questions
+        .iter()
+        .any(|authored| authored.question.source.source_ref.is_none());
+    let (spec, base_url) = if has_inline_source {
+        reject_unsupported_keys(
+            inputs
+                .openapi
+                .as_object()
+                .ok_or_else(|| anyhow!("retained OpenAPI document must be an object"))?,
+            &["openapi", "info", "servers", "paths", "components"],
+            "OpenAPI document",
+        )?;
+        if inputs.openapi.get("security").is_some() {
+            bail!("the local tutorial source must omit top-level OpenAPI security");
+        }
+        (
+            Some(Spec::from_value(
+                inputs.openapi.clone(),
+                "retained OpenAPI document",
+            )?),
+            Some(exact_loopback_server(&inputs.openapi)?),
+        )
+    } else {
+        (None, None)
+    };
+    let mut questions = Vec::with_capacity(inputs.questions.len());
+    for authored in inputs.questions {
+        questions.push(compile_question_plan(
+            &inputs.openapi,
+            spec.as_ref(),
+            base_url.as_deref(),
+            &inputs.selectors,
+            &inputs.sources,
+            &inputs.schemas,
+            authored,
+        )?);
+    }
+    let access_policies = inputs.access_policies;
+    let bundle = match profile {
+        CompileProfile::Local(ports) => render_local_bundle(&questions, &access_policies, ports),
+        CompileProfile::Production(governance) => render_production_bundle(&questions, governance)?,
+    };
+    Ok(CompilePlan {
+        questions,
+        access_policies,
+        bundle,
+    })
+}
+
+fn compile_question_plan(
+    openapi: &Value,
+    spec: Option<&Spec>,
+    base_url: Option<&str>,
+    selectors: &BTreeMap<String, Value>,
+    sources: &BTreeMap<String, Value>,
+    schemas: &BTreeMap<String, Value>,
+    authored: AuthoredQuestion,
+) -> Result<QuestionPlan> {
+    let question = &authored.question;
+    if question.source.source_ref.is_some() {
+        return compile_referenced_question(selectors, sources, schemas, authored);
+    }
+    let authored_subjects = question_subjects(question)?;
+    if authored_subjects
+        .iter()
+        .any(|subject| subject.profile.is_some())
+    {
+        bail!("an OpenAPI question derives its local selector profiles");
+    }
+    let operation_id = question
+        .source
+        .operation
+        .as_deref()
+        .expect("inline source was validated");
+    let operation = unique_operation(openapi, operation_id)?;
+    if operation.operation.get("security").is_some() {
+        bail!("the local tutorial operation must omit OpenAPI security");
+    }
+    if operation.operation.get("requestBody").is_some() {
+        bail!("the local tutorial GET operation must not declare a request body");
+    }
+    if operation.operation.get("servers").is_some() || operation.path_item.get("servers").is_some()
+    {
+        bail!("the local tutorial operation must use the document's one server");
+    }
+    reject_unsupported_keys(
+        operation.path_item,
+        &["get", "parameters"],
+        "selected OpenAPI path item",
+    )?;
+    reject_unsupported_keys(
+        operation.operation,
+        &["operationId", "parameters", "responses"],
+        "selected OpenAPI operation",
+    )?;
+
+    exact_path_selectors(
+        &operation,
+        &authored_subjects
+            .iter()
+            .map(|subject| subject.selector.as_str())
+            .collect::<Vec<_>>(),
+    )?;
+    let compiled_facts = compile_facts(
+        spec.expect("inline source needs parsed OpenAPI"),
+        &operation,
+        &question.source,
+    )?;
+    let requirement_uri = question
+        .governance
+        .as_ref()
+        .map(|governance| governance.requirement.clone())
+        .unwrap_or_else(|| local_uri(&format!("requirement:{}", question.id)));
+    let concepts = question
+        .answers
+        .iter()
+        .map(|answer| compile_concept(&question.id, answer, schemas))
+        .collect::<Result<Vec<_>>>()?;
+    let requirement_kind = question
+        .governance
+        .as_ref()
+        .map(|governance| governance.kind.as_str())
+        .unwrap_or_else(|| {
+            if concepts.len() == 1 && concepts[0].concept_form == CompiledConceptForm::Boolean {
+                "criterion"
+            } else {
+                "information-requirement"
+            }
+        });
+
+    let response_schema = compiled_facts.response_schema;
+    let fact_schema = compiled_facts.fact_schema;
+    let adapter_parameters_schema = json!({
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["operationId"],
+        "properties": {
+            "operationId": {"type": "string", "const": operation_id}
+        }
+    });
+
+    let prepare_script =
+        "fn prepare(selectors, parameters) {\n    #{query: [], body: ()}\n}\n".to_owned();
+    let extract_script = compiled_facts.extract_script;
+    let derivation_script = render_derivation(&authored.derivation, &concepts);
+    let subjects = authored_subjects
+        .iter()
+        .map(|authored_subject| {
+            let selector_profile = local_subject_selector_profile_id(
+                &question.id,
+                &authored_subject.role,
+                authored_subjects.len(),
+            );
+            SubjectPlan {
+                role: authored_subject.role.clone(),
+                selector_field: authored_subject.selector.clone(),
+                selector_profile,
+                selector_profile_value: json!({
+                    "maximumAggregateBytes": 200,
+                    "fields": {
+                        authored_subject.selector.clone(): {
+                            "type": "string",
+                            "minimumBytes": 1,
+                            "maximumBytes": 200,
+                        }
+                    },
+                }),
+                derivation: authored_subject.derivation,
+            }
+        })
+        .collect::<Vec<_>>();
+    let source_id = local_source_id(&question.id);
+    let (source_value, grant, requirement) = render_question_bundle_parts(
+        question,
+        base_url.expect("inline source needs local base URL"),
+        operation.path,
+        &subjects,
+        &source_id,
+        &BundleRequirement {
+            requirement_uri: requirement_uri.clone(),
+            kind: requirement_kind,
+            concepts: &concepts,
+        },
+    );
+    Ok(QuestionPlan {
+        question_id: question.id.clone(),
+        source_artifact_id: question.id.clone(),
+        authored_source_artifacts: None,
+        derivation_artifact: question.derivation.clone(),
+        fixture_artifact: question
+            .governance
+            .as_ref()
+            .map(|governance| governance.fixtures.clone()),
+        purpose: question.purpose.clone(),
+        requirement_uri,
+        concepts,
+        subjects,
+        source_id,
+        source_value,
+        grant,
+        requirement,
+        response_schema,
+        fact_schema,
+        adapter_parameters_schema,
+        prepare_script,
+        extract_script,
+        derivation_script,
+    })
+}
+
+fn compile_referenced_question(
+    selectors: &BTreeMap<String, Value>,
+    sources: &BTreeMap<String, Value>,
+    schemas: &BTreeMap<String, Value>,
+    authored: AuthoredQuestion,
+) -> Result<QuestionPlan> {
+    let question = &authored.question;
+    let source_id = question
+        .source
+        .source_ref
+        .as_deref()
+        .expect("referenced source was validated");
+    let source_value = sources
+        .get(source_id)
+        .ok_or_else(|| {
+            anyhow!("question source ref `{source_id}` has no sources/{source_id}.yaml")
+        })?
+        .clone();
+    let subjects = compile_referenced_subjects(question, &source_value, selectors)?;
+
+    let requirement_uri = question
+        .governance
+        .as_ref()
+        .map(|governance| governance.requirement.clone())
+        .unwrap_or_else(|| local_uri(&format!("requirement:{}", question.id)));
+    let concepts = question
+        .answers
+        .iter()
+        .map(|answer| compile_concept(&question.id, answer, schemas))
+        .collect::<Result<Vec<_>>>()?;
+    let requirement_kind = question
+        .governance
+        .as_ref()
+        .map(|governance| governance.kind.as_str())
+        .unwrap_or_else(|| {
+            if concepts.len() == 1 && concepts[0].concept_form == CompiledConceptForm::Boolean {
+                "criterion"
+            } else {
+                "information-requirement"
+            }
+        });
+    let (grant, requirement) = render_governance_parts(
+        question,
+        &subjects,
+        source_id,
+        &BundleRequirement {
+            requirement_uri: requirement_uri.clone(),
+            kind: requirement_kind,
+            concepts: &concepts,
+        },
+    );
+    let derivation_script = render_derivation(&authored.derivation, &concepts);
+
+    Ok(QuestionPlan {
+        question_id: question.id.clone(),
+        source_artifact_id: source_id.to_owned(),
+        authored_source_artifacts: Some(referenced_source_artifacts(&source_value)?),
+        derivation_artifact: question.derivation.clone(),
+        fixture_artifact: question
+            .governance
+            .as_ref()
+            .map(|governance| governance.fixtures.clone()),
+        purpose: question.purpose.clone(),
+        requirement_uri,
+        concepts,
+        subjects,
+        source_id: source_id.to_owned(),
+        source_value,
+        grant,
+        requirement,
+        response_schema: Value::Null,
+        fact_schema: Value::Null,
+        adapter_parameters_schema: Value::Null,
+        prepare_script: String::new(),
+        extract_script: String::new(),
+        derivation_script,
+    })
+}
+
+fn compile_referenced_subjects(
+    question: &Question,
+    source: &Value,
+    selectors: &BTreeMap<String, Value>,
+) -> Result<Vec<SubjectPlan>> {
+    let authored = question_subjects(question)?;
+    let mut compiled = Vec::with_capacity(authored.len());
+    for subject in authored {
+        let selector_profile = match &subject.profile {
+            Some(profile) => profile.clone(),
+            None => referenced_selector_profile(source, &subject.role, &subject.selector)?,
+        };
+        let selector_profile_value = selectors
+            .get(&selector_profile)
+            .ok_or_else(|| {
+                anyhow!("referenced source question uses missing selectors/{selector_profile}.yaml")
+            })?
+            .clone();
+        let selector_fields = selector_profile_value
+            .get("fields")
+            .and_then(Value::as_object)
+            .ok_or_else(|| anyhow!("selector profile `{selector_profile}` has no fields object"))?;
+        if !selector_fields.contains_key(&subject.selector) {
+            bail!(
+                "selector profile `{selector_profile}` does not declare the question subject field"
+            );
+        }
+        let used_by_source =
+            source_uses_subject(source, &subject.role, &selector_profile, &subject.selector)?;
+        if !used_by_source && !subject.derivation {
+            bail!("every question subject must be used by the source or declared for derivation");
+        }
+        compiled.push(SubjectPlan {
+            role: subject.role.clone(),
+            selector_field: subject.selector.clone(),
+            selector_profile,
+            selector_profile_value,
+            derivation: subject.derivation,
+        });
+    }
+
+    let inputs = source
+        .pointer("/request/selectorInputs")
+        .and_then(Value::as_array)
+        .ok_or_else(|| anyhow!("referenced source request must declare selectorInputs"))?;
+    for input in inputs {
+        let role = input
+            .get("role")
+            .and_then(Value::as_str)
+            .ok_or_else(|| anyhow!("source selector input has no role"))?;
+        let matches = compiled
+            .iter()
+            .filter(|subject| {
+                subject.role == role
+                    && source_uses_subject(
+                        source,
+                        role,
+                        &subject.selector_profile,
+                        &subject.selector_field,
+                    )
+                    .unwrap_or(false)
+            })
+            .count();
+        if matches != 1 {
+            bail!("question subjects must select exactly one alternative for every source role");
+        }
+    }
+    Ok(compiled)
+}
+
+fn source_uses_subject(source: &Value, role: &str, profile: &str, field: &str) -> Result<bool> {
+    let inputs = source
+        .pointer("/request/selectorInputs")
+        .and_then(Value::as_array)
+        .ok_or_else(|| anyhow!("referenced source request must declare selectorInputs"))?;
+    Ok(inputs.iter().any(|input| {
+        input.get("role").and_then(Value::as_str) == Some(role)
+            && input
+                .get("alternatives")
+                .and_then(Value::as_array)
+                .is_some_and(|alternatives| {
+                    alternatives.iter().any(|alternative| {
+                        alternative.get("profile").and_then(Value::as_str) == Some(profile)
+                            && alternative
+                                .get("fields")
+                                .and_then(Value::as_array)
+                                .is_some_and(|fields| {
+                                    fields.len() == 1 && fields[0].as_str() == Some(field)
+                                })
+                    })
+                })
+    }))
+}
+
+fn referenced_selector_profile(source: &Value, role: &str, field: &str) -> Result<String> {
+    let inputs = source
+        .pointer("/request/selectorInputs")
+        .and_then(Value::as_array)
+        .ok_or_else(|| anyhow!("referenced source request must declare selectorInputs"))?;
+    let mut matches = Vec::new();
+    for input in inputs {
+        if input.get("role").and_then(Value::as_str) != Some(role) {
+            continue;
+        }
+        let alternatives = input
+            .get("alternatives")
+            .and_then(Value::as_array)
+            .ok_or_else(|| anyhow!("source selector alternatives must be an array"))?;
+        for alternative in alternatives {
+            let fields = alternative
+                .get("fields")
+                .and_then(Value::as_array)
+                .ok_or_else(|| anyhow!("source selector fields must be an array"))?;
+            if fields.iter().any(|value| value.as_str() == Some(field)) {
+                matches.push(
+                    alternative
+                        .get("profile")
+                        .and_then(Value::as_str)
+                        .ok_or_else(|| anyhow!("source selector alternative has no profile"))?
+                        .to_owned(),
+                );
+            }
+        }
+    }
+    if matches.len() != 1 {
+        bail!("question subject must match exactly one referenced source selector alternative");
+    }
+    Ok(matches.pop().expect("one selector profile"))
+}
+
+fn referenced_source_artifacts(source: &Value) -> Result<Vec<String>> {
+    [
+        "/request/prepareScript",
+        "/request/adapterParametersSchema",
+        "/responseSchema",
+        "/extractScript",
+        "/factSchema",
+    ]
+    .iter()
+    .map(|pointer| {
+        let path = source
+            .pointer(pointer)
+            .and_then(Value::as_str)
+            .ok_or_else(|| anyhow!("referenced source is missing `{pointer}`"))?;
+        validate_bundle_relative_artifact(path)?;
+        Ok(path.to_owned())
+    })
+    .collect()
+}
+
+fn validate_bundle_relative_artifact(value: &str) -> Result<()> {
+    let path = Path::new(value);
+    if path.is_absolute()
+        || path
+            .components()
+            .any(|component| !matches!(component, Component::Normal(_)))
+        || path.components().count() != 2
+        || !matches!(
+            path.components().next(),
+            Some(Component::Normal(directory))
+                if directory == "adapters" || directory == "schemas"
+        )
+    {
+        bail!("referenced source artifacts must be adapters/<file> or schemas/<file>");
+    }
+    Ok(())
+}
+
+fn compile_concept(
+    question_id: &str,
+    answer: &QuestionAnswer,
+    schemas: &BTreeMap<String, Value>,
+) -> Result<ConceptPlan> {
+    let concept_uri = answer
+        .id
+        .clone()
+        .unwrap_or_else(|| local_uri(&format!("concept:{question_id}:{}", answer.concept)));
+    Ok(match answer.answer_type {
+        AnswerType::Boolean => ConceptPlan {
+            concept_alias: answer.concept.clone(),
+            concept_uri,
+            concept_form: CompiledConceptForm::Boolean,
+            constraints: json!({}),
+            codelist: None,
+            schema: None,
+            sd_jwt_vc: None,
+        },
+        AnswerType::ControlledCategory => {
+            let scheme = answer.id.as_ref().map_or_else(
+                || local_uri(&format!("category-scheme:{question_id}:{}", answer.concept)),
+                // Version 1 requires a distinct category-scheme identifier,
+                // while the compact production question contract authors
+                // only the stable concept identifier. This deterministic
+                // suffix does not invent a requirement, framework, Evidence
+                // Type, concept, or disclosure-family URI.
+                |identifier| format!("{identifier}:categories"),
+            );
+            let path = format!("codelists/{question_id}-{}.yaml", answer.concept);
+            let maximum_bytes = answer
+                .values
+                .iter()
+                .map(String::len)
+                .max()
+                .expect("controlled categories were validated");
+            ConceptPlan {
+                concept_alias: answer.concept.clone(),
+                concept_uri,
+                concept_form: CompiledConceptForm::ControlledCategory,
+                constraints: json!({
+                    "categoryScheme": scheme,
+                    "schemeVersion": "1",
+                    "maximumBytes": maximum_bytes,
+                    "codelist": path,
+                }),
+                codelist: Some((
+                    path,
+                    json!({
+                        "id": scheme,
+                        "version": "1",
+                        "codes": answer.values,
+                    }),
+                )),
+                schema: None,
+                sd_jwt_vc: None,
+            }
+        }
+        AnswerType::BoundedInteger => ConceptPlan {
+            concept_alias: answer.concept.clone(),
+            concept_uri,
+            concept_form: CompiledConceptForm::BoundedInteger,
+            constraints: json!({
+                "minimum": answer.minimum.expect("bounded integer was validated"),
+                "maximum": answer.maximum.expect("bounded integer was validated"),
+            }),
+            codelist: None,
+            schema: None,
+            sd_jwt_vc: None,
+        },
+        AnswerType::ReviewedStructuredValue => {
+            let path = answer
+                .schema
+                .as_deref()
+                .expect("structured answer was validated");
+            let key = Path::new(path)
+                .file_stem()
+                .and_then(|stem| stem.to_str())
+                .ok_or_else(|| anyhow!("answer schema filename is not valid UTF-8"))?;
+            let schema = schemas
+                .get(key)
+                .cloned()
+                .ok_or_else(|| anyhow!("answer schema `{path}` does not exist"))?;
+            let schema_id = schema
+                .get("$id")
+                .and_then(Value::as_str)
+                .filter(|value| url::Url::parse(value).is_ok())
+                .ok_or_else(|| anyhow!("answer schema `{path}` requires an absolute `$id`"))?
+                .to_owned();
+            ConceptPlan {
+                concept_alias: answer.concept.clone(),
+                concept_uri,
+                concept_form: CompiledConceptForm::Structured,
+                constraints: json!({
+                    "schema": schema_id,
+                    "maximumSerializedBytes": answer
+                        .maximum_serialized_bytes
+                        .expect("structured answer was validated"),
+                }),
+                codelist: None,
+                schema: Some((path.to_owned(), schema)),
+                sd_jwt_vc: answer.sd_jwt_vc.as_ref().map(|projection| {
+                    json!({
+                        "claim": projection.claim,
+                        "disclosure": match projection.disclosure {
+                            QuestionSdJwtVcDisclosure::TopLevel => "top-level",
+                        },
+                    })
+                }),
+            }
+        }
+    })
+}
+
+fn exact_loopback_server(document: &Value) -> Result<String> {
+    let servers = document
+        .get("servers")
+        .and_then(Value::as_array)
+        .filter(|servers| servers.len() == 1)
+        .ok_or_else(|| anyhow!("OpenAPI must declare exactly one local server"))?;
+    let server = servers[0]
+        .as_object()
+        .filter(|server| server.len() == 1)
+        .ok_or_else(|| anyhow!("the local OpenAPI server must contain only its fixed URL"))?;
+    let value = server
+        .get("url")
+        .and_then(Value::as_str)
+        .ok_or_else(|| anyhow!("the local OpenAPI server URL is missing"))?;
+    let url = Url::parse(value).context("parsing the local OpenAPI server URL")?;
+    let port = url
+        .port()
+        .filter(|port| *port != 0)
+        .ok_or_else(|| anyhow!("the local OpenAPI server needs an explicit non-zero port"))?;
+    if url.scheme() != "http"
+        || !url.username().is_empty()
+        || url.password().is_some()
+        || url.path() != "/"
+        || url.query().is_some()
+        || url.fragment().is_some()
+    {
+        bail!("the local OpenAPI server must be one canonical HTTP loopback origin");
+    }
+    let canonical = match url.host() {
+        Some(Host::Ipv4(address)) if address.is_loopback() => {
+            format!("http://{address}:{port}")
+        }
+        Some(Host::Ipv6(address)) if address == std::net::Ipv6Addr::LOCALHOST => {
+            format!("http://[{address}]:{port}")
+        }
+        _ => bail!("the local OpenAPI server must use a numeric loopback address"),
+    };
+    if canonical != value {
+        bail!("the local OpenAPI server must use its exact canonical origin spelling");
+    }
+    Ok(canonical)
+}
+
+fn unique_operation<'a>(document: &'a Value, operation_id: &str) -> Result<Operation<'a>> {
+    const METHODS: [&str; 8] = [
+        "get", "put", "post", "delete", "options", "head", "patch", "trace",
+    ];
+    let paths = document
+        .get("paths")
+        .and_then(Value::as_object)
+        .ok_or_else(|| anyhow!("OpenAPI paths must be an object"))?;
+    let mut matches = Vec::new();
+    for (path, item) in paths {
+        let item = item
+            .as_object()
+            .ok_or_else(|| anyhow!("OpenAPI path item `{path}` must be an object"))?;
+        if item.contains_key("$ref") {
+            bail!("OpenAPI path-item references are outside the local tutorial subset");
+        }
+        for method in METHODS {
+            let Some(operation) = item.get(method) else {
+                continue;
+            };
+            let operation = operation
+                .as_object()
+                .ok_or_else(|| anyhow!("OpenAPI operation `{method} {path}` must be an object"))?;
+            if operation.get("operationId").and_then(Value::as_str) == Some(operation_id) {
+                matches.push(Operation {
+                    method,
+                    path,
+                    path_item: item,
+                    operation,
+                });
+            }
+        }
+    }
+    if matches.len() != 1 {
+        bail!("source.operation must resolve to exactly one OpenAPI operationId");
+    }
+    let operation = matches.pop().expect("one operation");
+    if operation.method != "get" {
+        bail!("the local tutorial source supports only one resolved GET operationId");
+    }
+    Ok(operation)
+}
+
+fn exact_path_selectors(operation: &Operation<'_>, expected: &[&str]) -> Result<()> {
+    let mut parameters = Vec::new();
+    for owner in [operation.path_item, operation.operation] {
+        if let Some(values) = owner.get("parameters") {
+            let values = values
+                .as_array()
+                .ok_or_else(|| anyhow!("OpenAPI parameters must be an array"))?;
+            parameters.extend(values);
+        }
+    }
+    if parameters.len() != expected.len() {
+        bail!("the local tutorial operation must declare exactly one path selector per subject");
+    }
+    let expected = expected.iter().copied().collect::<BTreeSet<_>>();
+    if expected.len() != parameters.len() {
+        bail!("each OpenAPI question subject must use a distinct path selector");
+    }
+    let mut actual = BTreeSet::new();
+    for parameter in parameters {
+        let parameter = parameter
+            .as_object()
+            .ok_or_else(|| anyhow!("the path selector must be an object"))?;
+        reject_unsupported_keys(
+            parameter,
+            &["name", "in", "required", "schema"],
+            "path selector",
+        )?;
+        let parameter_schema = parameter
+            .get("schema")
+            .and_then(Value::as_object)
+            .ok_or_else(|| anyhow!("the path selector schema must be an object"))?;
+        reject_unsupported_keys(parameter_schema, &["type"], "path selector schema")?;
+        let name = parameter
+            .get("name")
+            .and_then(Value::as_str)
+            .ok_or_else(|| anyhow!("the path selector must have a name"))?;
+        if parameter.contains_key("$ref")
+            || parameter.get("in").and_then(Value::as_str) != Some("path")
+            || parameter.get("required").and_then(Value::as_bool) != Some(true)
+            || parameter_schema.get("type").and_then(Value::as_str) != Some("string")
+            || !actual.insert(name)
+        {
+            bail!("question selectors must equal the operation's required string path parameters");
+        }
+    }
+    if actual != expected {
+        bail!("question selectors must equal the operation's required string path parameters");
+    }
+    if !operation.path.starts_with('/')
+        || operation.path.starts_with("//")
+        || operation.path.contains(['?', '#', '\\'])
+        || operation
+            .path
+            .split('/')
+            .skip(1)
+            .any(|segment| segment.is_empty() || matches!(segment, "." | ".."))
+        || expected.iter().any(|name| {
+            let placeholder = format!("{{{name}}}");
+            operation
+                .path
+                .split('/')
+                .filter(|segment| *segment == placeholder)
+                .count()
+                != 1
+        })
+        || operation.path.matches('{').count() != expected.len()
+        || operation.path.matches('}').count() != expected.len()
+    {
+        bail!("each path selector must occupy exactly one complete path segment");
+    }
+    Ok(())
+}
+
+fn compile_facts(
+    spec: &Spec,
+    operation: &Operation<'_>,
+    source: &QuestionSource,
+) -> Result<CompiledFacts> {
+    let operation_key = OperationKey {
+        method: operation.method.to_ascii_uppercase(),
+        path: operation.path.to_owned(),
+    };
+    let resolved = spec.response_schema(&operation_key, "200", "application/json")?;
+    for fact in &source.facts {
+        validate_selected_schema_path(&resolved.schema.0, &fact.path)?;
+    }
+    let (candidate_leaves, _) = crate::suggest::flatten::candidate_leaves(&resolved.schema);
+    let offered = candidate_leaves
+        .iter()
+        .map(|leaf| leaf.pointer.as_str())
+        .collect::<BTreeSet<_>>();
+    for fact in &source.facts {
+        if !offered.contains(fact.path.as_str()) {
+            bail!(
+                "source fact `{}` path `{}` is not a selectable scalar leaf in the 200 application/json response",
+                fact.name,
+                fact.path
+            );
+        }
+    }
+
+    let projection = source
+        .facts
+        .iter()
+        .map(|fact| fact.path.clone())
+        .collect::<Vec<_>>();
+    let used_collections = source
+        .facts
+        .iter()
+        .flat_map(|fact| collection_pointers(&fact.path))
+        .collect::<BTreeSet<_>>();
+    let declared_collections = source
+        .collection_bounds
+        .keys()
+        .cloned()
+        .collect::<BTreeSet<_>>();
+    if used_collections != declared_collections {
+        let missing = used_collections
+            .difference(&declared_collections)
+            .cloned()
+            .collect::<Vec<_>>();
+        let unused = declared_collections
+            .difference(&used_collections)
+            .cloned()
+            .collect::<Vec<_>>();
+        bail!(
+            "source.collectionBounds must exactly name every selected collection (missing: {}; unused: {})",
+            display_list(&missing),
+            display_list(&unused)
+        );
+    }
+
+    let plan = narrow::plan_advisories(
+        &resolved.schema,
+        &projection,
+        &crate::suggest::types::Observations::default(),
+    )?;
+    if let Some(advisory) = plan.advisories.first() {
+        bail!(
+            "selected source schema needs adopter review: {}",
+            advisory.message()
+        );
+    }
+    let mut resolutions = BTreeMap::new();
+    for need in &plan.needs {
+        match need.kind {
+            BoundKind::ArrayMaxItems => {
+                let maximum = source.collection_bounds.get(&need.pointer).ok_or_else(|| {
+                    anyhow!(
+                        "selected collection `{}` is unbounded; declare it in source.collectionBounds",
+                        need.pointer
+                    )
+                })?;
+                resolutions.insert(
+                    (need.pointer.clone(), BoundKind::ArrayMaxItems),
+                    BoundValues::MaxItems(*maximum),
+                );
+            }
+            BoundKind::IntegerRange | BoundKind::StringLength => bail!(
+                "selected fact schema at `{}` is unbounded; add its closed bounds to the retained OpenAPI document",
+                need.pointer
+            ),
+        }
+    }
+    let mut response_schema = narrow::apply(&resolved.schema, &projection, &resolutions)?.schema;
+    close_selected_response(&mut response_schema, &projection, &source.collection_bounds)?;
+
+    let mut fact_properties = Map::new();
+    for fact in &source.facts {
+        let leaf = schema_at_extended_pointer(&response_schema, &fact.path)?.clone();
+        let property = match fact.combine {
+            FactCombination::ExactlyOne => leaf,
+            FactCombination::Collect => {
+                let maximum = collection_pointers(&fact.path)
+                    .iter()
+                    .try_fold(1_u64, |product, pointer| {
+                        product.checked_mul(source.collection_bounds[pointer])
+                    })
+                    .ok_or_else(|| {
+                        anyhow!("source fact `{}` collection bound overflows", fact.name)
+                    })?;
+                if maximum > 256 {
+                    bail!(
+                        "source fact `{}` can collect {maximum} values; reduce collection bounds so the product is at most 256",
+                        fact.name
+                    );
+                }
+                json!({
+                    "type": "array",
+                    "minItems": 1,
+                    "maxItems": maximum,
+                    "items": leaf,
+                })
+            }
+        };
+        fact_properties.insert(fact.name.clone(), property);
+    }
+    let required = source
+        .facts
+        .iter()
+        .map(|fact| Value::String(fact.name.clone()))
+        .collect::<Vec<_>>();
+    let fact_schema = json!({
+        "type": "object",
+        "additionalProperties": false,
+        "required": required,
+        "properties": fact_properties,
+    });
+
+    Ok(CompiledFacts {
+        response_schema,
+        fact_schema,
+        extract_script: render_fact_extraction(&source.facts),
+    })
+}
+
+fn validate_selected_schema_path(schema: &Value, pointer: &str) -> Result<()> {
+    let segments = parse_extended_pointer(pointer)?;
+    validate_selected_schema_node(schema, &segments, "")
+}
+
+fn validate_selected_schema_node(
+    node: &Value,
+    segments: &[ExtendedSegment],
+    pointer: &str,
+) -> Result<()> {
+    let object = node
+        .as_object()
+        .ok_or_else(|| anyhow!("selected OpenAPI schema node at `{pointer}` is not an object"))?;
+    let primary_type = match object.get("type") {
+        Some(Value::String(value)) => value.as_str(),
+        Some(Value::Array(values)) => values
+            .iter()
+            .filter_map(Value::as_str)
+            .find(|value| *value != "null")
+            .ok_or_else(|| {
+                anyhow!("selected OpenAPI schema node at `{pointer}` has no value type")
+            })?,
+        _ => bail!("selected OpenAPI schema node at `{pointer}` has no closed type"),
+    };
+    let mut allowed = vec![
+        "type",
+        "description",
+        "title",
+        "deprecated",
+        "readOnly",
+        "writeOnly",
+        "example",
+        "examples",
+    ];
+    allowed.extend(match primary_type {
+        "object" => &["properties", "required", "additionalProperties"][..],
+        "array" => &["items", "minItems", "maxItems", "uniqueItems", "const"][..],
+        "string" => &["format", "minLength", "maxLength", "enum", "const"][..],
+        "integer" => &["minimum", "maximum", "enum", "const"][..],
+        "boolean" => &["enum", "const"][..],
+        other => {
+            bail!("selected OpenAPI schema node at `{pointer}` has unsupported type `{other}`")
+        }
+    });
+    reject_unsupported_keys(
+        object,
+        &allowed,
+        &format!("selected OpenAPI schema at `{pointer}`"),
+    )?;
+
+    let Some((segment, rest)) = segments.split_first() else {
+        return Ok(());
+    };
+    match (primary_type, segment) {
+        ("object", ExtendedSegment::Key(key)) => {
+            let child = object
+                .get("properties")
+                .and_then(Value::as_object)
+                .and_then(|properties| properties.get(key))
+                .ok_or_else(|| {
+                    anyhow!("selected OpenAPI schema at `{pointer}` has no member `{key}`")
+                })?;
+            validate_selected_schema_node(
+                child,
+                rest,
+                &format!("{pointer}/{}", escape_pointer_segment(key)),
+            )
+        }
+        ("array", ExtendedSegment::Wildcard) => {
+            let child = object
+                .get("items")
+                .ok_or_else(|| anyhow!("selected OpenAPI array at `{pointer}` has no items"))?;
+            validate_selected_schema_node(child, rest, &format!("{pointer}/*"))
+        }
+        ("object", ExtendedSegment::Wildcard) => {
+            bail!("selected fact path uses `*` at object `{pointer}`")
+        }
+        ("array", ExtendedSegment::Key(_)) => {
+            bail!("selected fact path must use `*` at array `{pointer}`")
+        }
+        _ => bail!("selected fact path continues past scalar `{pointer}`"),
+    }
+}
+
+fn collection_pointers(pointer: &str) -> Vec<String> {
+    let mut parts = Vec::new();
+    let mut collections = Vec::new();
+    for segment in pointer.split('/').skip(1) {
+        if segment == "*" {
+            collections.push(format!("/{}", parts.join("/")));
+        }
+        parts.push(segment);
+    }
+    collections
+}
+
+fn display_list(values: &[String]) -> String {
+    if values.is_empty() {
+        "none".to_owned()
+    } else {
+        values.join(", ")
+    }
+}
+
+fn close_selected_response(
+    schema: &mut Value,
+    selections: &[String],
+    collection_bounds: &BTreeMap<String, u64>,
+) -> Result<()> {
+    for selection in selections {
+        let segments = parse_extended_pointer(selection)?;
+        close_selected_path(schema, &segments, "", collection_bounds)?;
+    }
+    Ok(())
+}
+
+#[derive(Clone, Debug)]
+enum ExtendedSegment {
+    Key(String),
+    Wildcard,
+}
+
+fn parse_extended_pointer(pointer: &str) -> Result<Vec<ExtendedSegment>> {
+    if pointer.is_empty() || !pointer.starts_with('/') {
+        bail!("source fact path must be a non-empty extended JSON Pointer");
+    }
+    pointer
+        .split('/')
+        .skip(1)
+        .map(|segment| {
+            if segment == "*" {
+                Ok(ExtendedSegment::Wildcard)
+            } else {
+                decode_pointer_segment(segment).map(ExtendedSegment::Key)
+            }
+        })
+        .collect()
+}
+
+fn decode_pointer_segment(segment: &str) -> Result<String> {
+    let mut decoded = String::new();
+    let mut characters = segment.chars();
+    while let Some(character) = characters.next() {
+        if character != '~' {
+            decoded.push(character);
+            continue;
+        }
+        match characters.next() {
+            Some('0') => decoded.push('~'),
+            Some('1') => decoded.push('/'),
+            _ => bail!("source fact path contains an invalid JSON Pointer escape"),
+        }
+    }
+    Ok(decoded)
+}
+
+fn close_selected_path(
+    node: &mut Value,
+    segments: &[ExtendedSegment],
+    pointer: &str,
+    collection_bounds: &BTreeMap<String, u64>,
+) -> Result<()> {
+    make_non_nullable(node);
+    let Some((segment, rest)) = segments.split_first() else {
+        return Ok(());
+    };
+    let object = node.as_object_mut().ok_or_else(|| {
+        anyhow!("selected response path crosses a non-schema node at `{pointer}`")
+    })?;
+    match segment {
+        ExtendedSegment::Key(key) => {
+            let required = object
+                .get_mut("required")
+                .and_then(Value::as_array_mut)
+                .ok_or_else(|| {
+                    anyhow!("selected response object at `{pointer}` has no required list")
+                })?;
+            if !required.iter().any(|value| value.as_str() == Some(key)) {
+                required.push(Value::String(key.clone()));
+            }
+            let properties = object
+                .get_mut("properties")
+                .and_then(Value::as_object_mut)
+                .ok_or_else(|| {
+                    anyhow!("selected response path expects an object at `{pointer}`")
+                })?;
+            let child = properties
+                .get_mut(key)
+                .ok_or_else(|| anyhow!("selected response path does not declare `{key}`"))?;
+            let child_pointer = format!("{pointer}/{}", escape_pointer_segment(key));
+            close_selected_path(child, rest, &child_pointer, collection_bounds)
+        }
+        ExtendedSegment::Wildcard => {
+            let maximum = collection_bounds.get(pointer).ok_or_else(|| {
+                anyhow!("selected response collection `{pointer}` has no authored bound")
+            })?;
+            let minimum = object.get("minItems").and_then(Value::as_u64).unwrap_or(0);
+            if minimum > *maximum {
+                bail!(
+                    "source.collectionBounds sets `{pointer}` to {maximum}, below its declared minItems {minimum}"
+                );
+            }
+            object.insert("minItems".to_owned(), Value::from(minimum.max(1)));
+            object.insert("maxItems".to_owned(), Value::from(*maximum));
+            let items = object.get_mut("items").ok_or_else(|| {
+                anyhow!("selected response collection `{pointer}` has no items schema")
+            })?;
+            close_selected_path(items, rest, &format!("{pointer}/*"), collection_bounds)
+        }
+    }
+}
+
+fn make_non_nullable(node: &mut Value) {
+    let Some(object) = node.as_object_mut() else {
+        return;
+    };
+    let Some(Value::Array(types)) = object.get("type") else {
+        return;
+    };
+    if types.len() == 2 && types.iter().any(|value| value.as_str() == Some("null")) {
+        if let Some(value_type) = types.iter().find(|value| value.as_str() != Some("null")) {
+            object.insert("type".to_owned(), value_type.clone());
+        }
+    }
+}
+
+fn schema_at_extended_pointer<'a>(schema: &'a Value, pointer: &str) -> Result<&'a Value> {
+    let mut node = schema;
+    for segment in parse_extended_pointer(pointer)? {
+        node = match segment {
+            ExtendedSegment::Key(key) => node
+                .get("properties")
+                .and_then(|properties| properties.get(&key))
+                .ok_or_else(|| anyhow!("generated response schema lost selected member `{key}`"))?,
+            ExtendedSegment::Wildcard => node.get("items").ok_or_else(|| {
+                anyhow!("generated response schema lost selected collection items")
+            })?,
+        };
+    }
+    Ok(node)
+}
+
+fn render_fact_extraction(facts: &[QuestionFact]) -> String {
+    let mut rendered =
+        String::from("fn extract(source_response, parameters) {\n    let facts = #{};\n");
+    for (index, fact) in facts.iter().enumerate() {
+        let name = json_string(&fact.name);
+        match fact.combine {
+            FactCombination::ExactlyOne => rendered.push_str(&format!(
+                "    facts[{name}] = required(get_path(source_response, {}), \"source_fact_missing\");\n",
+                json_string(&fact.path)
+            )),
+            FactCombination::Collect => {
+                rendered.push_str(&format!("    let collected_{index} = [];\n"));
+                render_collection_walk(&mut rendered, index, &fact.path);
+                rendered.push_str(&format!("    facts[{name}] = collected_{index};\n"));
+            }
+        }
+    }
+    rendered.push_str("    #{outcome: \"match\", facts: facts}\n}\n");
+    rendered
+}
+
+fn render_collection_walk(rendered: &mut String, fact_index: usize, pointer: &str) {
+    let segments = pointer.split('/').skip(1).collect::<Vec<_>>();
+    let wildcard_count = segments.iter().filter(|segment| **segment == "*").count();
+    let mut cursor = "source_response".to_owned();
+    let mut start = 0;
+    let mut depth = 0;
+    for (position, segment) in segments.iter().enumerate() {
+        if *segment != "*" {
+            continue;
+        }
+        let relative = format!("/{}", segments[start..position].join("/"));
+        let items = format!("items_{fact_index}_{depth}");
+        let item = format!("item_{fact_index}_{depth}");
+        let indent = "    ".repeat(depth + 1);
+        let collection = if relative == "/" {
+            cursor.clone()
+        } else {
+            format!("get_path({cursor}, {})", json_string(&relative))
+        };
+        rendered.push_str(&format!(
+            "{indent}let {items} = required({collection}, \"source_collection_missing\");\n"
+        ));
+        rendered.push_str(&format!("{indent}for {item} in {items} {{\n"));
+        cursor = item;
+        start = position + 1;
+        depth += 1;
+    }
+    debug_assert_eq!(depth, wildcard_count);
+    let tail = segments[start..].join("/");
+    let indent = "    ".repeat(depth + 1);
+    let value = if tail.is_empty() {
+        cursor
+    } else {
+        format!("get_path({cursor}, {})", json_string(&format!("/{tail}")))
+    };
+    rendered.push_str(&format!(
+        "{indent}collected_{fact_index}.push(required({value}, \"source_fact_missing\"));\n"
+    ));
+    for closing_depth in (0..depth).rev() {
+        rendered.push_str(&format!("{}}}\n", "    ".repeat(closing_depth + 1)));
+    }
+}
+
+fn reject_unsupported_keys(
+    object: &Map<String, Value>,
+    allowed: &[&str],
+    description: &str,
+) -> Result<()> {
+    if let Some(key) = object.keys().find(|key| !allowed.contains(&key.as_str())) {
+        bail!("{description} contains unsupported key `{key}`");
+    }
+    Ok(())
+}
+
+fn render_derivation(authored: &str, concepts: &[ConceptPlan]) -> String {
+    let mut rendered = authored.trim_end().to_owned();
+    rendered.push_str("\n\n");
+    rendered.push_str("fn derive(facts, selectors, evaluation_context) {\n");
+    rendered.push_str("    let governed_answers = answer(facts, selectors, evaluation_context);\n");
+    rendered.push_str("    [\n");
+    for (index, concept) in concepts.iter().enumerate() {
+        rendered.push_str("        #{\n");
+        rendered.push_str(&format!(
+            "            concept_id: {},\n",
+            json_string(&concept.concept_uri)
+        ));
+        rendered.push_str(&format!(
+            "            value: governed_answers[{}]\n",
+            json_string(&concept.concept_alias)
+        ));
+        rendered.push_str("        }");
+        if index + 1 != concepts.len() {
+            rendered.push(',');
+        }
+        rendered.push('\n');
+    }
+    rendered.push_str("    ]\n}\n");
+    rendered
+}
+
+fn render_question_bundle_parts(
+    question: &Question,
+    base_url: &str,
+    path_template: &str,
+    subjects: &[SubjectPlan],
+    source_id: &str,
+    requirement: &BundleRequirement,
+) -> (Value, Value, Value) {
+    let path_bindings = Value::Object(Map::from_iter(subjects.iter().map(|subject| {
+        (
+            subject.selector_field.clone(),
+            json!({
+                "role": subject.role,
+                "profile": subject.selector_profile,
+                "field": subject.selector_field,
+            }),
+        )
+    })));
+    let selector_inputs = subjects
+        .iter()
+        .map(|subject| {
+            json!({
+                "role": subject.role,
+                "alternatives": [{
+                    "profile": subject.selector_profile,
+                    "fields": [subject.selector_field],
+                }],
+            })
+        })
+        .collect::<Vec<_>>();
+    let projection = question
+        .source
+        .facts
+        .iter()
+        .map(|fact| Value::String(fact.path.clone()))
+        .collect::<Vec<_>>();
+
+    let source_value = json!({
+        "transport": "http-json",
+        "baseUrl": base_url,
+        "posture": "field-projected",
+        "authentication": {"kind": "none"},
+        "request": {
+            "method": "GET",
+            "pathTemplate": path_template,
+            "pathBindings": path_bindings,
+            "fixedHeaders": [{"name": "Accept", "value": "application/json"}],
+            "selectorInputs": selector_inputs,
+            "prepareScript": format!("adapters/{}-source-prepare.rhai", question.id),
+            "adapterParameters": {"operationId": question.source.operation.as_deref().expect("inline source")},
+            "adapterParametersSchema": format!(
+                "schemas/{}-source-adapter-parameters.schema.yaml",
+                question.id
+            ),
+            "preparationLimits": {
+                "query": "allowed",
+                "jsonBody": "forbidden",
+                "maximumNormalizedBytes": 4096,
+            },
+            "projection": projection,
+            "redirects": "deny",
+            "timeoutMilliseconds": 3000,
+            "maximumResponseBytes": 65536,
+            "concurrencyLimit": 8,
+        },
+        "responseSchema": format!("schemas/{}-source-response.schema.yaml", question.id),
+        "extractScript": format!("adapters/{}-source-extract.rhai", question.id),
+        "factSchema": format!("schemas/{}-source-facts.schema.yaml", question.id),
+    });
+    let (grant, requirement_value) =
+        render_governance_parts(question, subjects, source_id, requirement);
+    (source_value, grant, requirement_value)
+}
+
+fn render_governance_parts(
+    question: &Question,
+    subjects: &[SubjectPlan],
+    source_id: &str,
+    requirement: &BundleRequirement<'_>,
+) -> (Value, Value) {
+    let (reference_frameworks, evidence_type, observation_timezone, validity_seconds, families) =
+        match &question.governance {
+            Some(governance) => (
+                governance.reference_frameworks.clone(),
+                governance.evidence_type.clone(),
+                governance.observation_timezone.clone(),
+                governance.validity_seconds,
+                governance.disclosure_families.clone(),
+            ),
+            None => (
+                vec![local_uri(&format!("framework:{}", question.id))],
+                local_uri(&format!("evidence-type:{}", question.id)),
+                "UTC".to_owned(),
+                300,
+                vec![local_uri(&format!("disclosure-family:{}", question.id))],
+            ),
+        };
+    let grant_subjects = subjects
+        .iter()
+        .map(|subject| {
+            json!({
+                "role": subject.role,
+                "selectorProfile": subject.selector_profile,
+                "valueOrigin": "request",
+            })
+        })
+        .collect::<Vec<_>>();
+    let response_formats = if requirement
+        .concepts
+        .iter()
+        .any(|concept| concept.sd_jwt_vc.is_some())
+    {
+        json!(["signed-jws", "sd-jwt-vc"])
+    } else {
+        json!(["signed-jws"])
+    };
+    let grant = json!({
+        "requirement": requirement.requirement_uri,
+        "purpose": question.purpose,
+        "audienceFrom": "authenticated-requester",
+        "responseFormats": response_formats,
+        "subjects": grant_subjects,
+    });
+    let concepts = requirement
+        .concepts
+        .iter()
+        .map(|concept| {
+            let mut rendered = json!({
+                "id": concept.concept_uri,
+                "form": match concept.concept_form {
+                    CompiledConceptForm::Boolean => "boolean",
+                    CompiledConceptForm::ControlledCategory => "controlled-category",
+                    CompiledConceptForm::BoundedInteger => "bounded-integer",
+                    CompiledConceptForm::Structured => "reviewed-structured-value",
+                },
+                "required": true,
+                "constraints": concept.constraints,
+            });
+            if let Some(projection) = &concept.sd_jwt_vc {
+                rendered["sdJwtVc"] = projection.clone();
+            }
+            rendered
+        })
+        .collect::<Vec<_>>();
+    let subject_roles = subjects
+        .iter()
+        .map(|subject| {
+            json!({
+                "role": subject.role,
+                "cardinality": "one",
+                "selectorProfiles": [subject.selector_profile],
+            })
+        })
+        .collect::<Vec<_>>();
+    let selector_inputs = subjects
+        .iter()
+        .filter(|subject| subject.derivation)
+        .map(|subject| {
+            json!({
+                "role": subject.role,
+                "alternatives": [{
+                    "profile": subject.selector_profile,
+                    "fields": [subject.selector_field],
+                }],
+            })
+        })
+        .collect::<Vec<_>>();
+    let mut derivation = Map::from_iter([
+        ("script".to_owned(), json!(question.derivation)),
+        ("parameters".to_owned(), json!({})),
+    ]);
+    if !selector_inputs.is_empty() {
+        derivation.insert("selectorInputs".to_owned(), Value::Array(selector_inputs));
+    }
+    let mut requirement_value = json!({
+            "id": requirement.requirement_uri,
+            "kind": requirement.kind,
+            "source": source_id,
+            "purposes": [question.purpose],
+            "subjectRoles": subject_roles,
+            "referenceFrameworks": reference_frameworks,
+            "evidenceType": evidence_type,
+            "observationTimezone": observation_timezone,
+            "validitySeconds": validity_seconds,
+            "derivation": derivation,
+            "concepts": concepts,
+            "disclosureGuard": {"families": families},
+            "existenceDisclosure": "collapse-unresolved",
+    });
+    if let Some(governance) = &question.governance {
+        requirement_value["fixtures"] = Value::String(governance.fixtures.clone());
+    }
+    (grant, requirement_value)
+}
+
+fn render_local_bundle(
+    questions: &[QuestionPlan],
+    access_policies: &[AuthoredAccessPolicy],
+    ports: LocalServicePorts,
+) -> Value {
+    let mint_origin = ports.mint_origin();
+    let selector_profiles = questions
+        .iter()
+        .flat_map(|question| &question.subjects)
+        .map(|subject| {
+            (
+                subject.selector_profile.clone(),
+                subject.selector_profile_value.clone(),
+            )
+        })
+        .collect::<Map<_, _>>();
+    let sources = questions
+        .iter()
+        .map(|question| (question.source_id.clone(), question.source_value.clone()))
+        .collect::<Map<_, _>>();
+    let authority_profiles = if access_policies.is_empty() {
+        let grants = questions
+            .iter()
+            .map(|question| question.grant.clone())
+            .collect::<Vec<_>>();
+        Map::from_iter([(
+            AUTHORITY_PROFILE_ID.to_owned(),
+            json!({
+                "kind": "explicit-request",
+                "requesterTags": [AUTHORITY_PROFILE_ID],
+                "grants": grants,
+            }),
+        )])
+    } else {
+        access_policies
+            .iter()
+            .map(|policy| {
+                let grants = policy
+                    .questions
+                    .iter()
+                    .map(|question_id| {
+                        questions
+                            .iter()
+                            .find(|question| question.question_id == *question_id)
+                            .expect("access policy questions were validated")
+                            .grant
+                            .clone()
+                    })
+                    .collect::<Vec<_>>();
+                (
+                    policy.requester_tag.clone(),
+                    json!({
+                        "kind": "explicit-request",
+                        "requesterTags": [policy.requester_tag],
+                        "grants": grants,
+                    }),
+                )
+            })
+            .collect::<Map<_, _>>()
+    };
+    let requirements = questions
+        .iter()
+        .map(|question| question.requirement.clone())
+        .collect::<Vec<_>>();
+    let response_formats = if questions
+        .iter()
+        .flat_map(|question| &question.concepts)
+        .any(|concept| concept.sd_jwt_vc.is_some())
+    {
+        json!(["signed-jws", "sd-jwt-vc"])
+    } else {
+        json!(["signed-jws"])
+    };
+    json!({
+        "version": 1,
+        "assuranceProfile": "local",
+        "service": {
+            "providerId": local_uri("provider"),
+            "trustDomain": local_uri("trust-domain"),
+        },
+        "issuer": {"id": local_uri("issuer")},
+        "authentication": {
+            "kind": "oidc-access-token",
+            "issuer": mint_origin,
+            "audiences": [LOCAL_AUDIENCE],
+            "tokenTypes": ["at+jwt"],
+            "algorithms": ["EdDSA"],
+            "jwksUri": format!("{mint_origin}/.well-known/jwks.json"),
+            "principalClaim": "sub",
+            "requesterTagsClaim": "evidence_tags",
+            "evidenceAudienceClaim": "evidence_audience",
+            "grantIdClaim": "evidence_grant_id",
+            "grantAuthorityClaim": "evidence_authority",
+        },
+        "audit": {
+            "format": "keyed-jsonl",
+            "hashSecretRef": "secret:file/audit-hmac-key",
+            "hashKeyVersion": 1,
+            "failClosed": true,
+        },
+        "subjectBinding": {
+            "secretRef": "secret:file/subject-binding-hmac-key",
+            "keyVersion": 1,
+        },
+        "rateLimits": {
+            "requestsPerPrincipalPerMinute": 60,
+            "burstPerPrincipal": 10,
+            "failedSelectorAttemptsPerPrincipalAuthorityPerMinute": 10,
+        },
+        "signing": {
+            "format": "flattened-jws-json",
+            "algorithm": "EdDSA",
+            "activeKeyId": SIGNING_KEY_ID,
+            "activeKeyRef": "secret:file/signing-ed25519-private-jwk",
+            "retiredPublicJwkFiles": [],
+            "jwksPath": "/.well-known/evidence/jwks.json",
+            "maximumAssertionValiditySeconds": 300,
+            "verifierClockSkewSeconds": 30,
+        },
+        "responseFormats": response_formats,
+        "selectorProfiles": selector_profiles,
+        "sources": sources,
+        "authorityProfiles": authority_profiles,
+        "requirements": requirements,
+    })
+}
+
+fn render_production_bundle(questions: &[QuestionPlan], mut governance: Value) -> Result<Value> {
+    let object = governance
+        .as_object_mut()
+        .ok_or_else(|| anyhow!("production governance must be an object"))?;
+    object.insert(
+        "selectorProfiles".to_owned(),
+        Value::Object(Map::from_iter(
+            questions
+                .iter()
+                .flat_map(|question| &question.subjects)
+                .map(|subject| {
+                    (
+                        subject.selector_profile.clone(),
+                        subject.selector_profile_value.clone(),
+                    )
+                }),
+        )),
+    );
+    object.insert(
+        "sources".to_owned(),
+        Value::Object(Map::from_iter(questions.iter().map(|question| {
+            (question.source_id.clone(), question.source_value.clone())
+        }))),
+    );
+    object.insert(
+        "requirements".to_owned(),
+        Value::Array(
+            questions
+                .iter()
+                .map(|question| question.requirement.clone())
+                .collect(),
+        ),
+    );
+    Ok(governance)
+}
+
+fn write_plan(
+    project_root: &Path,
+    staging_root: &Path,
+    plan: &CompilePlan,
+    ports: LocalServicePorts,
+) -> Result<CompiledProject> {
+    write_bundle(project_root, staging_root, plan)?;
+    create_private_directory(&staging_root.join("audit"))?;
+
+    let canonical_staging = fs::canonicalize(staging_root)
+        .with_context(|| format!("resolving staging root {}", staging_root.display()))?;
+    let secret_root = fs::canonicalize(project_root.join(SECRETS_DIRECTORY))
+        .context("resolving local secret directory")?;
+    let runtime = json!({
+        "version": 1,
+        "bundleDirectory": canonical_staging.join("bundle").to_string_lossy(),
+        "listener": {
+            "bindHost": "127.0.0.1",
+            "port": ports.evidence,
+            "tlsTermination": "operator-controlled-upstream",
+            "trustProxyIdentityHeaders": false,
+            "maximumRequestBytes": 65536,
+            "maximumConcurrentRequests": 64,
+            "requestTimeoutMilliseconds": 10000,
+            "shutdownGraceMilliseconds": 30000,
+        },
+        "secretProviders": {"file": {"root": secret_root.to_string_lossy()}},
+        "auditStorage": {
+            "path": canonical_staging.join("audit/evidence.jsonl").to_string_lossy(),
+            "maximumFileBytes": 1073741824_u64,
+        },
+        "outboundTls": {"systemRoots": true, "trustProfiles": {}},
+    });
+    let runtime_path = staging_root.join("runtime.yaml");
+    write_private_file(&runtime_path, &yaml_bytes(&runtime)?)?;
+    fs::set_permissions(&runtime_path, fs::Permissions::from_mode(0o400))
+        .with_context(|| format!("sealing {}", runtime_path.display()))?;
+
+    let questions = plan
+        .questions
+        .iter()
+        .map(|question| CompiledQuestion {
+            question_alias: question.question_id.clone(),
+            requirement_uri: question.requirement_uri.clone(),
+            purpose: question.purpose.clone(),
+            subjects: question
+                .subjects
+                .iter()
+                .map(|subject| CompiledSubject {
+                    role: subject.role.clone(),
+                    selector_profile: subject.selector_profile.clone(),
+                    selector_field: subject.selector_field.clone(),
+                })
+                .collect(),
+            concepts: question
+                .concepts
+                .iter()
+                .map(|concept| CompiledConcept {
+                    concept_alias: concept.concept_alias.clone(),
+                    concept_uri: concept.concept_uri.clone(),
+                    concept_form: concept.concept_form,
+                })
+                .collect(),
+        })
+        .collect();
+    Ok(CompiledProject {
+        runtime_path,
+        questions,
+        local_audience: LOCAL_AUDIENCE.to_owned(),
+        requester_tag: AUTHORITY_PROFILE_ID.to_owned(),
+        caller_evidence_audience: LOCAL_CALLER_EVIDENCE_AUDIENCE.to_owned(),
+        access_policies: plan
+            .access_policies
+            .iter()
+            .map(|policy| CompiledAccessPolicy {
+                id: policy.id.clone(),
+                requester_tag: policy.requester_tag.clone(),
+                questions: policy.questions.clone(),
+            })
+            .collect(),
+    })
+}
+
+fn write_bundle(project_root: &Path, staging_root: &Path, plan: &CompilePlan) -> Result<PathBuf> {
+    let bundle = staging_root.join("bundle");
+    create_private_directory(&bundle)?;
+    for directory in ["adapters", "derivations", "schemas"] {
+        create_private_directory(&bundle.join(directory))?;
+    }
+    if plan
+        .questions
+        .iter()
+        .flat_map(|question| &question.concepts)
+        .any(|concept| concept.codelist.is_some())
+    {
+        create_private_directory(&bundle.join("codelists"))?;
+    }
+    write_private_file(&bundle.join("evidence.yaml"), &yaml_bytes(&plan.bundle)?)?;
+    let mut written_sources = BTreeSet::new();
+    let mut written_paths = BTreeSet::from(["evidence.yaml".to_owned()]);
+    for question in &plan.questions {
+        if written_sources.insert(question.source_artifact_id.clone()) {
+            if let Some(artifacts) = &question.authored_source_artifacts {
+                for artifact in artifacts {
+                    let bytes = read_project_artifact(
+                        project_root,
+                        artifact,
+                        MAX_SOURCE_ARTIFACT_BYTES,
+                        "referenced source artifact",
+                    )?;
+                    if !written_paths.insert(artifact.clone()) {
+                        continue;
+                    }
+                    write_private_file(&bundle.join(artifact), &bytes)?;
+                }
+            } else {
+                write_private_file(
+                    &bundle.join(format!(
+                        "adapters/{}-source-prepare.rhai",
+                        question.question_id
+                    )),
+                    question.prepare_script.as_bytes(),
+                )?;
+                write_private_file(
+                    &bundle.join(format!(
+                        "adapters/{}-source-extract.rhai",
+                        question.question_id
+                    )),
+                    question.extract_script.as_bytes(),
+                )?;
+                write_private_file(
+                    &bundle.join(format!(
+                        "schemas/{}-source-response.schema.yaml",
+                        question.question_id
+                    )),
+                    &yaml_bytes(&question.response_schema)?,
+                )?;
+                write_private_file(
+                    &bundle.join(format!(
+                        "schemas/{}-source-facts.schema.yaml",
+                        question.question_id
+                    )),
+                    &yaml_bytes(&question.fact_schema)?,
+                )?;
+                write_private_file(
+                    &bundle.join(format!(
+                        "schemas/{}-source-adapter-parameters.schema.yaml",
+                        question.question_id
+                    )),
+                    &yaml_bytes(&question.adapter_parameters_schema)?,
+                )?;
+            }
+        }
+        write_private_file(
+            &bundle.join(&question.derivation_artifact),
+            question.derivation_script.as_bytes(),
+        )?;
+        written_paths.insert(question.derivation_artifact.clone());
+        for (path, codelist) in question
+            .concepts
+            .iter()
+            .filter_map(|concept| concept.codelist.as_ref())
+        {
+            if !written_paths.insert(path.clone()) {
+                continue;
+            }
+            write_private_file(&bundle.join(path), &yaml_bytes(codelist)?)?;
+        }
+        for (path, schema) in question
+            .concepts
+            .iter()
+            .filter_map(|concept| concept.schema.as_ref())
+        {
+            if written_paths.insert(path.clone()) {
+                write_private_file(&bundle.join(path), &yaml_bytes(schema)?)?;
+            }
+        }
+        if let Some(path) = &question.fixture_artifact {
+            if written_paths.insert(path.clone()) {
+                let bytes = read_project_artifact(
+                    project_root,
+                    path,
+                    MAX_SOURCE_ARTIFACT_BYTES,
+                    "production fixture",
+                )?;
+                ensure_generated_parent(&bundle, path)?;
+                write_private_file(&bundle.join(path), &bytes)?;
+            }
+        }
+    }
+    for path in auxiliary_artifacts(&plan.bundle)? {
+        if written_paths.insert(path.clone()) {
+            let bytes = read_project_artifact(
+                project_root,
+                &path,
+                MAX_SOURCE_ARTIFACT_BYTES,
+                "referenced bundle artifact",
+            )?;
+            ensure_generated_parent(&bundle, &path)?;
+            write_private_file(&bundle.join(path), &bytes)?;
+        }
+    }
+    set_bundle_modes(&bundle, 0o500, 0o400)?;
+    Ok(bundle)
+}
+
+fn read_project_artifact(
+    project_root: &Path,
+    relative: &str,
+    maximum_bytes: u64,
+    description: &str,
+) -> Result<Vec<u8>> {
+    let parent = project_root
+        .join(relative)
+        .parent()
+        .ok_or_else(|| anyhow!("{description} has no project directory"))?
+        .to_path_buf();
+    let metadata = fs::symlink_metadata(&parent)
+        .with_context(|| format!("inspecting {description} directory"))?;
+    if metadata.file_type().is_symlink() || !metadata.is_dir() {
+        bail!("{description} must be held in a plain project directory");
+    }
+    read_regular_file(&project_root.join(relative), maximum_bytes, description)
+}
+
+fn ensure_generated_parent(bundle: &Path, relative: &str) -> Result<()> {
+    let parent = bundle
+        .join(relative)
+        .parent()
+        .ok_or_else(|| anyhow!("generated artifact has no parent"))?
+        .to_path_buf();
+    if !parent.exists() {
+        fs::create_dir_all(&parent)
+            .with_context(|| format!("creating generated directory {}", parent.display()))?;
+    }
+    Ok(())
+}
+
+fn auxiliary_artifacts(bundle: &Value) -> Result<Vec<String>> {
+    let mut paths = BTreeSet::new();
+    if let Some(profiles) = bundle.get("selectorProfiles").and_then(Value::as_object) {
+        for profile in profiles.values() {
+            if let Some(fields) = profile.get("fields").and_then(Value::as_object) {
+                for field in fields.values() {
+                    if let Some(path) = field.get("codelist").and_then(Value::as_str) {
+                        validate_auxiliary_artifact(path, "codelists", ".yaml")?;
+                        paths.insert(path.to_owned());
+                    }
+                }
+            }
+        }
+    }
+    if let Some(public_keys) = bundle
+        .pointer("/signing/retiredPublicJwkFiles")
+        .and_then(Value::as_array)
+    {
+        for value in public_keys {
+            let path = value
+                .as_str()
+                .ok_or_else(|| anyhow!("retired public key paths must be strings"))?;
+            validate_auxiliary_artifact(path, "public-keys", ".jwk.json")?;
+            paths.insert(path.to_owned());
+        }
+    }
+    Ok(paths.into_iter().collect())
+}
+
+fn validate_auxiliary_artifact(value: &str, directory: &str, suffix: &str) -> Result<()> {
+    let path = Path::new(value);
+    if path.is_absolute()
+        || path
+            .components()
+            .any(|component| !matches!(component, Component::Normal(_)))
+        || path.components().next() != Some(Component::Normal(directory.as_ref()))
+        || path.components().count() != 2
+        || !value.ends_with(suffix)
+    {
+        bail!("referenced bundle artifacts must remain in their allowed project directory");
+    }
+    Ok(())
+}
+
+fn create_private_directory(path: &Path) -> Result<()> {
+    let mut builder = fs::DirBuilder::new();
+    builder.mode(0o700);
+    builder
+        .create(path)
+        .with_context(|| format!("creating private directory {}", path.display()))
+}
+
+fn write_private_file(path: &Path, bytes: &[u8]) -> Result<()> {
+    use std::{fs::OpenOptions, io::Write as _, os::unix::fs::OpenOptionsExt as _};
+
+    let mut file = OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(0o600)
+        .open(path)
+        .with_context(|| format!("creating {}", path.display()))?;
+    file.write_all(bytes)
+        .with_context(|| format!("writing {}", path.display()))?;
+    file.sync_all()
+        .with_context(|| format!("persisting {}", path.display()))
+}
+
+fn set_bundle_modes(root: &Path, directory_mode: u32, file_mode: u32) -> Result<()> {
+    for entry in fs::read_dir(root).with_context(|| format!("reading {}", root.display()))? {
+        let path = entry?.path();
+        let metadata = fs::symlink_metadata(&path)?;
+        if metadata.is_dir() {
+            set_bundle_modes(&path, directory_mode, file_mode)?;
+            fs::set_permissions(&path, fs::Permissions::from_mode(directory_mode))?;
+        } else if metadata.is_file() {
+            fs::set_permissions(&path, fs::Permissions::from_mode(file_mode))?;
+        } else {
+            bail!("unexpected generated bundle entry");
+        }
+    }
+    fs::set_permissions(root, fs::Permissions::from_mode(directory_mode))?;
+    Ok(())
+}
+
+fn check_with_evidence(evidence_bin: &Path, runtime_path: &Path) -> Result<()> {
+    let output = Command::new(evidence_bin)
+        .arg("--runtime")
+        .arg(runtime_path)
+        .arg("check")
+        .env_remove("REGISTRY_EVIDENCE_RUNTIME")
+        .output()
+        .with_context(|| format!("running {} check", evidence_bin.display()))?;
+    if output.status.success() {
+        return Ok(());
+    }
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    let diagnostic = stderr.trim();
+    if diagnostic.is_empty() {
+        bail!("Evidence rejected the compiled local generation");
+    }
+    bail!("Evidence rejected the compiled local generation: {diagnostic}")
+}
+
+fn yaml_bytes(value: &Value) -> Result<Vec<u8>> {
+    let mut text = serde_norway::to_string(value).context("serializing generated YAML")?;
+    if !text.ends_with('\n') {
+        text.push('\n');
+    }
+    Ok(text.into_bytes())
+}
+
+fn local_uri(suffix: &str) -> String {
+    format!("{LOCAL_URI_PREFIX}{suffix}")
+}
+
+fn local_selector_profile_id(question_id: &str) -> String {
+    format!("local-subject-{question_id}-v1")
+}
+
+fn local_subject_selector_profile_id(
+    question_id: &str,
+    role: &str,
+    subject_count: usize,
+) -> String {
+    if subject_count == 1 {
+        local_selector_profile_id(question_id)
+    } else {
+        format!("local-subject-{question_id}-{role}-v1")
+    }
+}
+
+fn local_source_id(question_id: &str) -> String {
+    format!("local-source-{question_id}")
+}
+
+fn json_string(value: &str) -> String {
+    serde_json::to_string(value).expect("strings serialize")
+}
+
+fn escape_pointer_segment(value: &str) -> String {
+    value.replace('~', "~0").replace('/', "~1")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::{
+        io::Write as _,
+        os::unix::fs::{symlink, OpenOptionsExt as _},
+    };
+
+    const OPENAPI: &str = r#"openapi: 3.1.0
+info: {title: Tutorial registry, version: 1.0.0}
+servers: [{url: 'http://127.0.0.1:8000'}]
+paths:
+  /people/{person_id}:
+    get:
+      operationId: getPerson
+      parameters:
+        - name: person_id
+          in: path
+          required: true
+          schema: {type: string}
+      responses:
+        '200':
+          description: A person
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [person_id, name, date_of_birth]
+                properties:
+                  person_id: {type: string}
+                  name: {type: string}
+                  date_of_birth: {type: string, format: date}
+"#;
+
+    const QUESTION: &str = r#"id: adult-status
+question: Is the person at least 18 years old?
+purpose: age-check
+subject:
+  role: person
+  selector: person_id
+source:
+  operation: getPerson
+  facts:
+    - name: date_of_birth
+      path: /date_of_birth
+      combine: exactly-one
+  collectionBounds: {}
+answers:
+  - concept: is_adult
+    type: boolean
+derivation: derivations/adult-status.rhai
+disclosure:
+  allow: [is_adult]
+"#;
+
+    const RELATIONSHIP_OPENAPI: &str = r#"openapi: 3.1.0
+info: {title: Tutorial family registry, version: 1.0.0}
+servers: [{url: 'http://127.0.0.1:8000'}]
+paths:
+  /children/{child_id}/candidate-parents/{candidate_id}:
+    get:
+      operationId: getParentRelationship
+      parameters:
+        - name: child_id
+          in: path
+          required: true
+          schema: {type: string}
+        - name: candidate_id
+          in: path
+          required: true
+          schema: {type: string}
+      responses:
+        '200':
+          description: A governed relationship decision
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [relationship_confirmed]
+                properties:
+                  relationship_confirmed: {type: boolean}
+"#;
+
+    const RELATIONSHIP_QUESTION: &str = r#"id: parent-relationship
+question: Is the candidate registered as a parent of the child?
+purpose: relationship-check
+subjects:
+  - role: child
+    selector: child_id
+  - role: candidate-parent
+    selector: candidate_id
+source:
+  operation: getParentRelationship
+  facts:
+    - name: relationship_confirmed
+      path: /relationship_confirmed
+      combine: exactly-one
+  collectionBounds: {}
+answers:
+  - concept: relationship_confirmed
+    type: boolean
+derivation: derivations/parent-relationship.rhai
+disclosure:
+  allow: [relationship_confirmed]
+"#;
+
+    const RELATIONSHIP_ANSWER: &str = r#"fn answer(facts, selectors, context) {
+    #{relationship_confirmed: required(facts.relationship_confirmed, "relationship_missing")}
+}
+"#;
+
+    const ANSWER: &str = r#"fn answer(facts, selectors, context) {
+    let born = parse_date(required(facts.date_of_birth, "date_of_birth_missing"));
+    let adult_on = add_calendar_years(born, 18);
+    #{is_adult: compare_dates(context.legal_local_date, adult_on) >= 0}
+}
+"#;
+
+    const AGE_BRACKET_QUESTION: &str = r#"id: age-bracket
+question: Which age bracket does this person belong to?
+purpose: service-path-selection
+subject:
+  role: person
+  selector: person_id
+source:
+  operation: getPerson
+  facts:
+    - name: date_of_birth
+      path: /date_of_birth
+      combine: exactly-one
+  collectionBounds: {}
+answers:
+  - concept: age_bracket
+    type: controlled-category
+    values: [under-18, 18-to-24, 25-to-64, 65-or-older]
+derivation: derivations/age-bracket.rhai
+disclosure:
+  allow: [age_bracket]
+"#;
+
+    const AGE_BRACKET_ANSWER: &str = r#"fn answer(facts, selectors, context) {
+    let born = parse_date(required(facts.date_of_birth, "date_of_birth_missing"));
+    if compare_dates(context.legal_local_date, add_calendar_years(born, 18)) < 0 {
+        #{age_bracket: "under-18"}
+    } else if compare_dates(context.legal_local_date, add_calendar_years(born, 25)) < 0 {
+        #{age_bracket: "18-to-24"}
+    } else if compare_dates(context.legal_local_date, add_calendar_years(born, 65)) < 0 {
+        #{age_bracket: "25-to-64"}
+    } else {
+        #{age_bracket: "65-or-older"}
+    }
+}
+"#;
+
+    const IMMUNIZATION_QUESTION: &str = r#"id: immunization-summary
+question: Is the immunization schedule complete, and how many doses are recorded?
+purpose: care-coordination
+subject:
+  role: person
+  selector: person_id
+source:
+  operation: getPerson
+  facts:
+    - name: dose_count
+      path: /dose_count
+      combine: exactly-one
+  collectionBounds: {}
+answers:
+  - concept: schedule_complete
+    type: boolean
+  - concept: dose_count
+    type: bounded-integer
+    minimum: 0
+    maximum: 20
+derivation: derivations/immunization-summary.rhai
+disclosure:
+  allow: [schedule_complete, dose_count]
+"#;
+
+    const IMMUNIZATION_ANSWER: &str = r#"fn answer(facts, selectors, context) {
+    let dose_count = required(facts.dose_count, "dose_count_missing");
+    #{schedule_complete: dose_count >= 3, dose_count: dose_count}
+}
+"#;
+
+    const MULTI_EVENT_OPENAPI: &str = r#"openapi: 3.1.0
+info: {title: Sanitized tracker API, version: 1.0.0}
+servers: [{url: 'http://127.0.0.1:8000'}]
+paths:
+  /records/{record_id}/events:
+    get:
+      operationId: listRecordEvents
+      parameters:
+        - name: record_id
+          in: path
+          required: true
+          schema: {type: string}
+      responses:
+        '200':
+          description: Bounded event history
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/EventPage'
+components:
+  schemas:
+    EventPage:
+      type: object
+      additionalProperties: false
+      properties:
+        events:
+          type: array
+          items:
+            $ref: '#/components/schemas/Event'
+    Event:
+      type: object
+      additionalProperties: false
+      properties:
+        event: {type: string, minLength: 1, maxLength: 64}
+        status: {type: string, minLength: 1, maxLength: 32}
+        occurredAt: {type: string, format: date-time}
+"#;
+
+    const MULTI_EVENT_QUESTION: &str = r#"id: event-history
+question: Did the bounded event history satisfy the reviewed rule?
+purpose: history-review
+subject:
+  role: record
+  selector: record_id
+source:
+  operation: listRecordEvents
+  facts:
+    - name: event_statuses
+      path: /events/*/status
+      combine: collect
+    - name: event_times
+      path: /events/*/occurredAt
+      combine: collect
+  collectionBounds:
+    /events: 4
+answers:
+  - concept: history_satisfies_rule
+    type: boolean
+derivation: derivations/event-history.rhai
+disclosure:
+  allow: [history_satisfies_rule]
+"#;
+
+    const MULTI_EVENT_ANSWER: &str = r#"fn answer(facts, selectors, context) {
+    #{history_satisfies_rule: len(required(facts.event_statuses, "event_statuses_missing")) > 0}
+}
+"#;
+
+    const MULTI_EVENT_RESPONSE: &str = r#"{
+  "events": [
+    {"event": "evt-001", "status": "completed", "occurredAt": "2026-07-01T08:00:00Z"},
+    {"event": "evt-002", "status": "cancelled", "occurredAt": "2026-07-02T09:00:00Z"}
+  ]
+}"#;
+
+    const BIRTH_CERTIFICATE_QUESTION: &str = r#"id: birth-certificate
+question: What birth details are recorded for this person?
+purpose: birth-record-review
+subject:
+  role: person
+  selector: person_id
+source:
+  operation: getPerson
+  facts:
+    - name: name
+      path: /name
+      combine: exactly-one
+    - name: date_of_birth
+      path: /date_of_birth
+      combine: exactly-one
+  collectionBounds: {}
+answers:
+  - concept: birth_certificate
+    type: reviewed-structured-value
+    schema: schemas/birth-certificate.yaml
+    maximumSerializedBytes: 2048
+    sdJwtVc:
+      claim: birthCertificate
+      disclosure: top-level
+derivation: derivations/birth-certificate.rhai
+disclosure:
+  allow: [birth_certificate]
+"#;
+
+    const BIRTH_CERTIFICATE_ANSWER: &str = r#"fn answer(facts, selectors, context) {
+    #{birth_certificate: #{
+        form: "reviewed-structured-value",
+        schema: "urn:example:schema:birth-certificate:v1",
+        fields: #{
+            givenName: required(facts.name, "name_missing"),
+            dateOfBirth: required(facts.date_of_birth, "date_of_birth_missing")
+        }
+    }}
+}
+"#;
+
+    const BIRTH_CERTIFICATE_SCHEMA: &str = r#"$schema: https://json-schema.org/draft/2020-12/schema
+$id: urn:example:schema:birth-certificate:v1
+type: object
+additionalProperties: false
+required: [givenName, dateOfBirth]
+properties:
+  givenName: {type: string, minLength: 1, maxLength: 200}
+  dateOfBirth: {type: string, format: date}
+"#;
+
+    #[test]
+    fn compiles_only_the_canonical_private_local_generation() {
+        let fixture = Fixture::new(OPENAPI, QUESTION, ANSWER, true);
+        let compiled = compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect("local compilation succeeds");
+
+        assert_eq!(compiled.runtime_path, fixture.staging.join("runtime.yaml"));
+        assert_eq!(compiled.questions.len(), 1);
+        let question = &compiled.questions[0];
+        assert_eq!(question.question_alias, "adult-status");
+        assert_eq!(
+            question.requirement_uri,
+            "urn:registrystack:evidence:local:requirement:adult-status"
+        );
+        assert_eq!(
+            question.concepts[0].concept_uri,
+            "urn:registrystack:evidence:local:concept:adult-status:is_adult"
+        );
+        assert_eq!(question.purpose, "age-check");
+        assert_eq!(question.subjects[0].role, "person");
+        assert_eq!(
+            question.subjects[0].selector_profile,
+            local_selector_profile_id("adult-status")
+        );
+        assert_eq!(question.subjects[0].selector_field, "person_id");
+        assert_eq!(question.concepts[0].concept_alias, "is_adult");
+        assert_eq!(
+            question.concepts[0].concept_form,
+            CompiledConceptForm::Boolean
+        );
+        assert_eq!(compiled.local_audience, LOCAL_AUDIENCE);
+        assert_eq!(compiled.requester_tag, AUTHORITY_PROFILE_ID);
+        assert!(compiled.access_policies.is_empty());
+        assert_eq!(
+            compiled.caller_evidence_audience,
+            LOCAL_CALLER_EVIDENCE_AUDIENCE
+        );
+        assert_eq!(
+            tree(&fixture.staging),
+            vec![
+                "audit/",
+                "bundle/",
+                "bundle/adapters/",
+                "bundle/adapters/adult-status-source-extract.rhai",
+                "bundle/adapters/adult-status-source-prepare.rhai",
+                "bundle/derivations/",
+                "bundle/derivations/adult-status.rhai",
+                "bundle/evidence.yaml",
+                "bundle/schemas/",
+                "bundle/schemas/adult-status-source-adapter-parameters.schema.yaml",
+                "bundle/schemas/adult-status-source-facts.schema.yaml",
+                "bundle/schemas/adult-status-source-response.schema.yaml",
+                "runtime.yaml",
+            ]
+        );
+        assert_mode(&fixture.staging, 0o700);
+        assert_mode(&fixture.staging.join("audit"), 0o700);
+        assert_mode(&fixture.staging.join("bundle"), 0o500);
+        assert_mode(&compiled.runtime_path, 0o400);
+
+        let bundle: Value = serde_norway::from_slice(
+            &fs::read(fixture.staging.join("bundle/evidence.yaml")).expect("bundle reads"),
+        )
+        .expect("bundle parses");
+        assert_eq!(bundle["assuranceProfile"], "local");
+        let source_id = local_source_id("adult-status");
+        let selector_profile = local_selector_profile_id("adult-status");
+        assert_eq!(
+            bundle["sources"][&source_id]["authentication"],
+            json!({"kind": "none"})
+        );
+        assert_eq!(
+            bundle["sources"][&source_id]["request"]["pathBindings"]["person_id"],
+            json!({"role": "person", "profile": selector_profile, "field": "person_id"})
+        );
+        assert!(bundle["requirements"][0].get("fixtures").is_none());
+        assert_eq!(
+            bundle["requirements"][0]["concepts"]
+                .as_array()
+                .unwrap()
+                .len(),
+            1
+        );
+
+        let derivation =
+            fs::read_to_string(fixture.staging.join("bundle/derivations/adult-status.rhai"))
+                .expect("derivation reads");
+        assert!(derivation.contains("fn answer(facts, selectors, context)"));
+        assert!(derivation.contains(
+            "concept_id: \"urn:registrystack:evidence:local:concept:adult-status:is_adult\""
+        ));
+        assert!(derivation
+            .contains("let governed_answers = answer(facts, selectors, evaluation_context)"));
+        assert!(derivation.contains("value: governed_answers[\"is_adult\"]"));
+        assert!(!derivation.contains("concept_id: \"is_adult\""));
+    }
+
+    #[test]
+    fn compiles_a_structured_value_into_independent_sd_jwt_vc_fields() {
+        let openapi = OPENAPI.replace(
+            "                  name: {type: string}",
+            "                  name: {type: string, minLength: 1, maxLength: 200}",
+        );
+        let fixture = Fixture::new(
+            &openapi,
+            BIRTH_CERTIFICATE_QUESTION,
+            BIRTH_CERTIFICATE_ANSWER,
+            true,
+        );
+        fs::create_dir(fixture.project.join("schemas")).expect("schemas");
+        fs::write(
+            fixture.project.join("schemas/birth-certificate.yaml"),
+            BIRTH_CERTIFICATE_SCHEMA,
+        )
+        .expect("birth certificate schema");
+
+        let compiled = compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect("structured value compiles");
+
+        assert_eq!(
+            compiled.questions[0].concepts[0].concept_form,
+            CompiledConceptForm::Structured
+        );
+        assert!(fixture
+            .staging
+            .join("bundle/schemas/birth-certificate.yaml")
+            .is_file());
+        let bundle: Value = serde_norway::from_slice(
+            &fs::read(fixture.staging.join("bundle/evidence.yaml")).expect("bundle reads"),
+        )
+        .expect("bundle parses");
+        assert_eq!(
+            bundle["responseFormats"],
+            json!(["signed-jws", "sd-jwt-vc"])
+        );
+        assert_eq!(
+            bundle["authorityProfiles"][AUTHORITY_PROFILE_ID]["grants"][0]["responseFormats"],
+            json!(["signed-jws", "sd-jwt-vc"])
+        );
+        let concept = &bundle["requirements"][0]["concepts"][0];
+        assert_eq!(concept["form"], "reviewed-structured-value");
+        assert_eq!(
+            concept["constraints"],
+            json!({
+                "schema": "urn:example:schema:birth-certificate:v1",
+                "maximumSerializedBytes": 2048,
+            })
+        );
+        assert_eq!(
+            concept["sdJwtVc"],
+            json!({"claim": "birthCertificate", "disclosure": "top-level"})
+        );
+    }
+
+    #[test]
+    fn inline_openapi_question_compiles_multiple_role_bound_subjects() {
+        let fixture = Fixture::new(
+            RELATIONSHIP_OPENAPI,
+            RELATIONSHIP_QUESTION,
+            RELATIONSHIP_ANSWER,
+            true,
+        );
+        let compiled = compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect("multi-subject local compilation succeeds");
+
+        let question = &compiled.questions[0];
+        assert_eq!(question.subjects.len(), 2);
+        assert_eq!(question.subjects[0].role, "child");
+        assert_eq!(question.subjects[0].selector_field, "child_id");
+        assert_eq!(question.subjects[1].role, "candidate-parent");
+        assert_eq!(question.subjects[1].selector_field, "candidate_id");
+
+        let bundle: Value = serde_norway::from_slice(
+            &fs::read(fixture.staging.join("bundle/evidence.yaml")).expect("bundle reads"),
+        )
+        .expect("bundle parses");
+        let source = &bundle["sources"][local_source_id("parent-relationship")];
+        assert_eq!(
+            source["request"]["pathBindings"]["child_id"]["role"],
+            "child"
+        );
+        assert_eq!(
+            source["request"]["pathBindings"]["candidate_id"]["role"],
+            "candidate-parent"
+        );
+        assert_eq!(
+            source["request"]["selectorInputs"]
+                .as_array()
+                .expect("selector inputs")
+                .len(),
+            2
+        );
+        assert_eq!(
+            bundle["requirements"][0]["subjectRoles"]
+                .as_array()
+                .expect("subject roles")
+                .len(),
+            2
+        );
+        assert_eq!(
+            bundle["authorityProfiles"][AUTHORITY_PROFILE_ID]["grants"][0]["subjects"]
+                .as_array()
+                .expect("grant subjects")
+                .len(),
+            2
+        );
+
+        for invalid_question in [
+            RELATIONSHIP_QUESTION.replace(
+                "  - role: candidate-parent\n    selector: candidate_id\n",
+                "",
+            ),
+            RELATIONSHIP_QUESTION.replace("role: candidate-parent", "role: child"),
+            RELATIONSHIP_QUESTION.replace("selector: candidate_id", "selector: person_id"),
+        ] {
+            let fixture = Fixture::new(
+                RELATIONSHIP_OPENAPI,
+                &invalid_question,
+                RELATIONSHIP_ANSWER,
+                true,
+            );
+            compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+                .expect_err("incomplete or ambiguous role binding is rejected");
+            assert!(fixture.staging_is_empty());
+        }
+    }
+
+    #[test]
+    fn compiles_one_closed_controlled_category() {
+        let fixture = Fixture::new(OPENAPI, AGE_BRACKET_QUESTION, AGE_BRACKET_ANSWER, true);
+        let compiled = compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect("controlled category compiles");
+
+        assert_eq!(
+            compiled.questions[0].concepts[0].concept_form,
+            CompiledConceptForm::ControlledCategory
+        );
+        let codelist: Value = serde_norway::from_slice(
+            &fs::read(
+                fixture
+                    .staging
+                    .join("bundle/codelists/age-bracket-age_bracket.yaml"),
+            )
+            .expect("codelist reads"),
+        )
+        .expect("codelist parses");
+        assert_eq!(
+            codelist["codes"],
+            json!(["under-18", "18-to-24", "25-to-64", "65-or-older"])
+        );
+        let bundle: Value = serde_norway::from_slice(
+            &fs::read(fixture.staging.join("bundle/evidence.yaml")).expect("bundle reads"),
+        )
+        .expect("bundle parses");
+        assert_eq!(bundle["requirements"][0]["kind"], "information-requirement");
+        assert_eq!(
+            bundle["requirements"][0]["concepts"][0]["form"],
+            "controlled-category"
+        );
+    }
+
+    #[test]
+    fn production_controlled_category_keeps_the_stable_concept_and_distinct_scheme_ids() {
+        let answer: QuestionAnswer = serde_norway::from_str(
+            r#"concept: age_bracket
+id: urn:authority:concept:age-bracket:v1
+type: controlled-category
+values: [under-18, adult]
+"#,
+        )
+        .expect("production answer parses");
+        let concept = compile_concept("age-bracket", &answer, &BTreeMap::new())
+            .expect("controlled category compiles");
+
+        assert_eq!(concept.concept_uri, "urn:authority:concept:age-bracket:v1");
+        assert_eq!(
+            concept.constraints["categoryScheme"],
+            "urn:authority:concept:age-bracket:v1:categories"
+        );
+        assert_ne!(
+            concept.constraints["categoryScheme"],
+            concept.concept_uri.as_str(),
+            "the runtime-required category scheme remains distinct from the governed concept"
+        );
+        let (_, codelist) = concept.codelist.expect("controlled category codelist");
+        assert_eq!(
+            codelist["id"],
+            "urn:authority:concept:age-bracket:v1:categories"
+        );
+    }
+
+    #[test]
+    fn production_compiler_ignores_local_access_and_handles_all_neutral_question_shapes() {
+        fn referenced(question: &str, source: &str) -> String {
+            let start = question.find("source:\n").expect("source section");
+            let end = start
+                + question[start..]
+                    .find("answers:\n")
+                    .expect("answers section");
+            format!(
+                "{}source:\n  ref: {source}\n{}",
+                &question[..start],
+                &question[end..]
+            )
+        }
+
+        fn governed(mut question: String, question_id: &str, answers: &[(&str, &str)]) -> String {
+            for (alias, identifier) in answers {
+                question = question.replace(
+                    &format!("  - concept: {alias}\n"),
+                    &format!("  - concept: {alias}\n    id: {identifier}\n"),
+                );
+            }
+            question.push_str(&format!(
+                r#"governance:
+  requirement: urn:authority:requirement:{question_id}:v1
+  kind: information-requirement
+  referenceFrameworks: [urn:authority:framework:neutral:v1]
+  evidenceType: urn:authority:evidence-type:{question_id}:v1
+  validitySeconds: 300
+  observationTimezone: UTC
+  fixtures: fixtures/{question_id}.yaml
+  disclosureFamilies: [urn:authority:disclosure-family:{question_id}:v1]
+"#,
+            ));
+            question
+        }
+
+        let fixture = Fixture::new(OPENAPI, QUESTION, ANSWER, true);
+        for directory in ["sources", "selectors", "adapters", "schemas", "fixtures"] {
+            fs::create_dir(fixture.project.join(directory))
+                .expect("production authoring directory");
+        }
+        for (profile, field) in [
+            ("person-reference-v1", "person_id"),
+            ("child-reference-v1", "child_id"),
+            ("candidate-reference-v1", "candidate_id"),
+        ] {
+            fs::write(
+                fixture.project.join(format!("selectors/{profile}.yaml")),
+                format!(
+                    "maximumAggregateBytes: 64\nfields:\n  {field}:\n    type: string\n    minimumBytes: 1\n    maximumBytes: 64\n"
+                ),
+            )
+            .expect("selector profile");
+        }
+        fs::write(
+            fixture.project.join("sources/people.yaml"),
+            r#"transport: http-json
+baseUrl: https://records.example.test
+posture: field-projected
+authentication: {kind: static-bearer, tokenRef: 'secret:file/records-token'}
+request:
+  method: GET
+  pathTemplate: /people/{person_id}
+  pathBindings:
+    person_id: {role: person, profile: person-reference-v1, field: person_id}
+  fixedHeaders: [{name: Accept, value: application/json}]
+  selectorInputs:
+    - role: person
+      alternatives:
+        - {profile: person-reference-v1, fields: [person_id]}
+  prepareScript: adapters/source-prepare.rhai
+  adapterParameters: {}
+  adapterParametersSchema: schemas/source-parameters.schema.yaml
+  preparationLimits: {query: forbidden, jsonBody: forbidden, maximumNormalizedBytes: 4096}
+  projection: [/value]
+  redirects: deny
+  timeoutMilliseconds: 3000
+  maximumResponseBytes: 65536
+  concurrencyLimit: 8
+responseSchema: schemas/source-response.schema.yaml
+extractScript: adapters/source-extract.rhai
+factSchema: schemas/source-facts.schema.yaml
+"#,
+        )
+        .expect("people source");
+        fs::write(
+            fixture.project.join("sources/relationships.yaml"),
+            r#"transport: http-json
+baseUrl: https://relationships.example.test
+posture: field-projected
+authentication: {kind: static-bearer, tokenRef: 'secret:file/relationships-token'}
+request:
+  method: GET
+  pathTemplate: /children/{child_id}/candidates/{candidate_id}
+  pathBindings:
+    child_id: {role: child, profile: child-reference-v1, field: child_id}
+    candidate_id: {role: candidate-parent, profile: candidate-reference-v1, field: candidate_id}
+  fixedHeaders: [{name: Accept, value: application/json}]
+  selectorInputs:
+    - role: child
+      alternatives:
+        - {profile: child-reference-v1, fields: [child_id]}
+    - role: candidate-parent
+      alternatives:
+        - {profile: candidate-reference-v1, fields: [candidate_id]}
+  prepareScript: adapters/source-prepare.rhai
+  adapterParameters: {}
+  adapterParametersSchema: schemas/source-parameters.schema.yaml
+  preparationLimits: {query: forbidden, jsonBody: forbidden, maximumNormalizedBytes: 4096}
+  projection: [/value]
+  redirects: deny
+  timeoutMilliseconds: 3000
+  maximumResponseBytes: 65536
+  concurrencyLimit: 8
+responseSchema: schemas/source-response.schema.yaml
+extractScript: adapters/source-extract.rhai
+factSchema: schemas/source-facts.schema.yaml
+"#,
+        )
+        .expect("relationship source");
+        for (path, contents) in [
+            (
+                "adapters/source-prepare.rhai",
+                "fn prepare(selectors, parameters) { #{query: [], body: ()} }\n",
+            ),
+            (
+                "adapters/source-extract.rhai",
+                "fn extract(response, parameters) { #{outcome: \"match\", facts: response} }\n",
+            ),
+            (
+                "schemas/source-parameters.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: []\nproperties: {}\n",
+            ),
+            (
+                "schemas/source-response.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: []\nproperties: {}\n",
+            ),
+            (
+                "schemas/source-facts.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: []\nproperties: {}\n",
+            ),
+        ] {
+            fs::write(fixture.project.join(path), contents).expect("source artifact");
+        }
+
+        let questions = [
+            (
+                governed(
+                    referenced(QUESTION, "people"),
+                    "adult-status",
+                    &[("is_adult", "urn:authority:concept:is-adult:v1")],
+                ),
+                ANSWER,
+            ),
+            (
+                governed(
+                    referenced(AGE_BRACKET_QUESTION, "people"),
+                    "age-bracket",
+                    &[("age_bracket", "urn:authority:concept:age-bracket:v1")],
+                ),
+                AGE_BRACKET_ANSWER,
+            ),
+            (
+                governed(
+                    referenced(IMMUNIZATION_QUESTION, "people"),
+                    "immunization-summary",
+                    &[
+                        (
+                            "schedule_complete",
+                            "urn:authority:concept:schedule-complete:v1",
+                        ),
+                        ("dose_count", "urn:authority:concept:dose-count:v1"),
+                    ],
+                ),
+                IMMUNIZATION_ANSWER,
+            ),
+            (
+                governed(
+                    referenced(RELATIONSHIP_QUESTION, "relationships"),
+                    "parent-relationship",
+                    &[(
+                        "relationship_confirmed",
+                        "urn:authority:concept:relationship-confirmed:v1",
+                    )],
+                ),
+                RELATIONSHIP_ANSWER,
+            ),
+        ];
+        for (question, derivation) in questions {
+            fixture.add_question(&question, derivation);
+            let parsed: Question = serde_norway::from_str(&question).expect("governed question");
+            fs::write(
+                fixture.project.join(format!("fixtures/{}.yaml", parsed.id)),
+                "version: 1\ncases: []\n",
+            )
+            .expect("governed fixture");
+        }
+
+        symlink(
+            fixture.project.join("questions"),
+            fixture.project.join(ACCESS_DIRECTORY),
+        )
+        .expect("malformed local access link");
+
+        let target = json!({
+            "version": 1,
+            "assuranceProfile": "production",
+            "service": {"providerId": "urn:authority:provider", "trustDomain": "urn:authority:trust"},
+            "issuer": {"id": "urn:authority:issuer"},
+            "authentication": {},
+            "audit": {},
+            "subjectBinding": {},
+            "rateLimits": {},
+            "signing": {},
+            "authorityProfiles": {"authority": {"kind": "explicit-request"}},
+        });
+        let project = fs::canonicalize(&fixture.project).expect("canonical production project");
+        let compiled = compile_production_project(&project, &fixture.staging, target)
+            .expect("all neutral shapes compile through production");
+        let bundle = compiled.bundle;
+        let requirements = bundle["requirements"].as_array().expect("requirements");
+
+        assert_eq!(requirements.len(), 4);
+        assert_eq!(
+            requirements
+                .iter()
+                .map(|requirement| requirement["id"].as_str().expect("requirement id"))
+                .collect::<Vec<_>>(),
+            [
+                "urn:authority:requirement:adult-status:v1",
+                "urn:authority:requirement:age-bracket:v1",
+                "urn:authority:requirement:immunization-summary:v1",
+                "urn:authority:requirement:parent-relationship:v1",
+            ]
+        );
+        assert_eq!(requirements[0]["concepts"][0]["form"], "boolean");
+        assert_eq!(
+            requirements[1]["concepts"][0]["form"],
+            "controlled-category"
+        );
+        assert_eq!(requirements[2]["concepts"].as_array().unwrap().len(), 2);
+        assert_eq!(requirements[2]["concepts"][1]["form"], "bounded-integer");
+        assert_eq!(requirements[3]["subjectRoles"].as_array().unwrap().len(), 2);
+        assert_eq!(compiled.fixture_paths.len(), 4);
+        assert!(!serde_json::to_string(&bundle)
+            .expect("bundle JSON")
+            .contains(LOCAL_URI_PREFIX));
+    }
+
+    #[test]
+    fn local_compiler_uses_exact_optional_governance_but_keeps_local_assurance() {
+        let question = QUESTION.replace(
+            "  - concept: is_adult\n",
+            "  - concept: is_adult\n    id: urn:authority:concept:is-adult:v1\n",
+        ) + r#"governance:
+  requirement: urn:authority:requirement:adult-status:v1
+  kind: criterion
+  referenceFrameworks: [urn:authority:framework:adult-status:v1]
+  evidenceType: urn:authority:evidence-type:adult-status:v1
+  validitySeconds: 900
+  observationTimezone: Asia/Bangkok
+  fixtures: fixtures/adult-status.yaml
+  disclosureFamilies: [urn:authority:disclosure-family:adult-status:v1]
+"#;
+        let fixture = Fixture::new(OPENAPI, &question, ANSWER, true);
+        fs::create_dir(fixture.project.join("fixtures")).expect("fixtures");
+        fs::write(
+            fixture.project.join("fixtures/adult-status.yaml"),
+            "version: 1\ncases: []\n",
+        )
+        .expect("fixture");
+
+        compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect("governed local compilation");
+        let bundle: Value = serde_norway::from_slice(
+            &fs::read(fixture.staging.join("bundle/evidence.yaml")).expect("local bundle"),
+        )
+        .expect("local bundle YAML");
+        let requirement = &bundle["requirements"][0];
+
+        assert_eq!(bundle["assuranceProfile"], "local");
+        assert_eq!(bundle["authentication"]["issuer"], "http://127.0.0.1:8081");
+        assert_eq!(
+            bundle["signing"]["activeKeyRef"],
+            "secret:file/signing-ed25519-private-jwk"
+        );
+        assert_eq!(
+            requirement["id"],
+            "urn:authority:requirement:adult-status:v1"
+        );
+        assert_eq!(requirement["validitySeconds"], 900);
+        assert_eq!(requirement["observationTimezone"], "Asia/Bangkok");
+        assert_eq!(
+            requirement["concepts"][0]["id"],
+            "urn:authority:concept:is-adult:v1"
+        );
+        assert!(fixture
+            .staging
+            .join("bundle/fixtures/adult-status.yaml")
+            .is_file());
+    }
+
+    #[test]
+    fn copied_project_artifacts_reject_symlinked_parent_directories() {
+        let temporary = tempfile::tempdir().expect("tempdir");
+        let project = temporary.path().join("project");
+        let outside = temporary.path().join("outside");
+        fs::create_dir(&project).expect("project");
+        fs::create_dir(&outside).expect("outside");
+
+        for (directory, file) in [
+            ("adapters", "prepare.rhai"),
+            ("schemas", "facts.schema.yaml"),
+            ("codelists", "categories.yaml"),
+            ("public-keys", "retired.jwk.json"),
+        ] {
+            fs::write(outside.join(file), b"outside\n").expect("outside artifact");
+            symlink(&outside, project.join(directory)).expect("artifact directory symlink");
+            assert!(
+                read_project_artifact(
+                    &project,
+                    &format!("{directory}/{file}"),
+                    1024,
+                    "copied artifact",
+                )
+                .is_err(),
+                "{directory} symlink must not be followed"
+            );
+            fs::remove_file(project.join(directory)).expect("remove test symlink");
+            fs::remove_file(outside.join(file)).expect("remove outside artifact");
+        }
+    }
+
+    #[test]
+    fn compiles_boolean_and_bounded_integer_into_one_signed_assertion_bundle() {
+        let openapi = OPENAPI
+            .replace(
+                "required: [person_id, name, date_of_birth]",
+                "required: [person_id, name, date_of_birth, dose_count]",
+            )
+            .replace(
+                "                  date_of_birth: {type: string, format: date}",
+                "                  date_of_birth: {type: string, format: date}\n                  dose_count: {type: integer, minimum: 0, maximum: 20}",
+            );
+        let fixture = Fixture::new(&openapi, IMMUNIZATION_QUESTION, IMMUNIZATION_ANSWER, true);
+        let compiled = compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect("multiple governed answers compile");
+
+        assert_eq!(
+            compiled.questions[0]
+                .concepts
+                .iter()
+                .map(|concept| (concept.concept_alias.as_str(), concept.concept_form))
+                .collect::<Vec<_>>(),
+            [
+                ("schedule_complete", CompiledConceptForm::Boolean),
+                ("dose_count", CompiledConceptForm::BoundedInteger),
+            ]
+        );
+        let bundle: Value = serde_norway::from_slice(
+            &fs::read(fixture.staging.join("bundle/evidence.yaml")).expect("bundle reads"),
+        )
+        .expect("bundle parses");
+        let requirement = &bundle["requirements"][0];
+        assert_eq!(requirement["kind"], "information-requirement");
+        assert_eq!(requirement["concepts"].as_array().unwrap().len(), 2);
+        assert_eq!(requirement["concepts"][0]["form"], "boolean");
+        assert_eq!(requirement["concepts"][1]["form"], "bounded-integer");
+        assert_eq!(
+            requirement["concepts"][1]["constraints"],
+            json!({"minimum": 0, "maximum": 20})
+        );
+        let derivation = fs::read_to_string(
+            fixture
+                .staging
+                .join("bundle/derivations/immunization-summary.rhai"),
+        )
+        .expect("derivation reads");
+        assert!(derivation.contains("value: governed_answers[\"schedule_complete\"]"));
+        assert!(derivation.contains("value: governed_answers[\"dose_count\"]"));
+        assert!(derivation.contains(
+            "urn:registrystack:evidence:local:concept:immunization-summary:schedule_complete"
+        ));
+        assert!(derivation
+            .contains("urn:registrystack:evidence:local:concept:immunization-summary:dose_count"));
+    }
+
+    #[test]
+    fn compiles_every_authored_question_into_one_generation() {
+        let fixture = Fixture::new(OPENAPI, QUESTION, ANSWER, true);
+        fixture.add_question(AGE_BRACKET_QUESTION, AGE_BRACKET_ANSWER);
+
+        let compiled = compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect("multiple questions compile");
+
+        assert_eq!(
+            compiled
+                .questions
+                .iter()
+                .map(|question| question.question_alias.as_str())
+                .collect::<Vec<_>>(),
+            ["adult-status", "age-bracket"]
+        );
+        let bundle: Value = serde_norway::from_slice(
+            &fs::read(fixture.staging.join("bundle/evidence.yaml")).expect("bundle reads"),
+        )
+        .expect("bundle parses");
+        assert_eq!(bundle["selectorProfiles"].as_object().unwrap().len(), 2);
+        assert_eq!(bundle["sources"].as_object().unwrap().len(), 2);
+        assert_eq!(
+            bundle["authorityProfiles"][AUTHORITY_PROFILE_ID]["grants"]
+                .as_array()
+                .unwrap()
+                .len(),
+            2
+        );
+        assert_eq!(bundle["requirements"].as_array().unwrap().len(), 2);
+        assert!(fixture
+            .staging
+            .join("bundle/derivations/adult-status.rhai")
+            .is_file());
+        assert!(fixture
+            .staging
+            .join("bundle/derivations/age-bracket.rhai")
+            .is_file());
+    }
+
+    #[test]
+    fn explicit_access_policies_replace_the_implicit_caller_profile() {
+        let fixture = Fixture::new(OPENAPI, QUESTION, ANSWER, true);
+        fixture.add_question(AGE_BRACKET_QUESTION, AGE_BRACKET_ANSWER);
+        fixture.add_access_policy("age-checks", &["adult-status", "age-bracket"]);
+        fixture.add_access_policy("service-routing", &["age-bracket"]);
+
+        let compiled = compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect("explicit access policies compile");
+
+        assert_eq!(
+            compiled
+                .access_policies
+                .iter()
+                .map(|policy| (policy.id.as_str(), policy.questions.as_slice()))
+                .collect::<Vec<_>>(),
+            [
+                (
+                    "age-checks",
+                    ["adult-status".to_owned(), "age-bracket".to_owned()].as_slice()
+                ),
+                ("service-routing", ["age-bracket".to_owned()].as_slice()),
+            ]
+        );
+        let bundle: Value = serde_norway::from_slice(
+            &fs::read(fixture.staging.join("bundle/evidence.yaml")).expect("bundle reads"),
+        )
+        .expect("bundle parses");
+        let profiles = bundle["authorityProfiles"]
+            .as_object()
+            .expect("authority profiles");
+        assert_eq!(profiles.len(), 2);
+        assert!(!profiles.contains_key(AUTHORITY_PROFILE_ID));
+        for policy in &compiled.access_policies {
+            let profile = &profiles[&policy.requester_tag];
+            assert_eq!(profile["kind"], "explicit-request");
+            assert_eq!(profile["requesterTags"], json!([policy.requester_tag]));
+            let grants = profile["grants"].as_array().unwrap();
+            assert_eq!(grants.len(), policy.questions.len());
+            for (grant, question) in grants.iter().zip(&policy.questions) {
+                assert_eq!(
+                    grant["requirement"],
+                    local_uri(&format!("requirement:{question}"))
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn access_policy_tags_are_stable_and_revision_bound() {
+        let first = access_policy_requester_tag("age-checks", &["adult-status".to_owned()])
+            .expect("first tag");
+        let same = access_policy_requester_tag("age-checks", &["adult-status".to_owned()])
+            .expect("same tag");
+        let changed = access_policy_requester_tag(
+            "age-checks",
+            &["adult-status".to_owned(), "age-bracket".to_owned()],
+        )
+        .expect("changed tag");
+
+        assert_eq!(first, same);
+        assert_ne!(first, changed);
+        assert!(first.starts_with("policy-v1-"));
+        assert_eq!(first.len(), "policy-v1-".len() + 64);
+    }
+
+    #[test]
+    fn explicit_access_policies_reject_unknown_questions_before_writing() {
+        let fixture = Fixture::new(OPENAPI, QUESTION, ANSWER, true);
+        fixture.add_access_policy("unknown-access", &["missing-question"]);
+
+        let error = compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect_err("unknown question must fail");
+
+        assert!(error.to_string().contains("does not exist"));
+        assert!(fixture.staging_is_empty());
+    }
+
+    #[test]
+    fn explicit_access_directory_cannot_escape_through_a_symlink() {
+        let fixture = Fixture::new(OPENAPI, QUESTION, ANSWER, true);
+        let outside = fixture.project.parent().unwrap().join("outside-access");
+        fs::create_dir(&outside).expect("outside access");
+        symlink(&outside, fixture.project.join("access")).expect("access symlink");
+
+        let error = compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect_err("access symlink must fail");
+
+        assert!(error.to_string().contains("plain project directory"));
+        assert!(fixture.staging_is_empty());
+    }
+
+    #[test]
+    fn referenced_v1_source_and_selector_are_reused_by_questions() {
+        let fixture = Fixture::new(OPENAPI, QUESTION, ANSWER, true);
+        for directory in ["sources", "selectors", "adapters", "schemas"] {
+            fs::create_dir(fixture.project.join(directory)).expect("authoring directory");
+        }
+        fs::write(
+            fixture.project.join("selectors/person-reference-v1.yaml"),
+            "maximumAggregateBytes: 200\nfields:\n  person_id:\n    type: string\n    minimumBytes: 1\n    maximumBytes: 200\n",
+        )
+        .expect("selector");
+        fs::write(
+            fixture.project.join("sources/people.yaml"),
+            r#"transport: http-json
+baseUrl: https://records.example.test
+posture: field-projected
+authentication:
+  kind: basic
+  usernameRef: secret:file/records-username
+  passwordRef: secret:file/records-password
+request:
+  method: GET
+  pathTemplate: /people/{person_id}
+  pathBindings:
+    person_id: {role: person, profile: person-reference-v1, field: person_id}
+  fixedHeaders: [{name: Accept, value: application/json}]
+  selectorInputs:
+    - role: person
+      alternatives:
+        - {profile: person-reference-v1, fields: [person_id]}
+  prepareScript: adapters/people-prepare.rhai
+  adapterParameters: {}
+  adapterParametersSchema: schemas/people-parameters.schema.yaml
+  preparationLimits: {query: allowed, jsonBody: forbidden, maximumNormalizedBytes: 4096}
+  projection: [/date_of_birth]
+  redirects: deny
+  timeoutMilliseconds: 3000
+  maximumResponseBytes: 65536
+  concurrencyLimit: 8
+responseSchema: schemas/people-response.schema.yaml
+extractScript: adapters/people-extract.rhai
+factSchema: schemas/people-facts.schema.yaml
+"#,
+        )
+        .expect("source");
+        for (path, contents) in [
+            (
+                "adapters/people-prepare.rhai",
+                "fn prepare(s, p) { #{query: [], body: ()} }\n",
+            ),
+            (
+                "adapters/people-extract.rhai",
+                "fn extract(r, p) { #{outcome: \"match\", facts: r} }\n",
+            ),
+            (
+                "schemas/people-parameters.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: []\nproperties: {}\n",
+            ),
+            (
+                "schemas/people-response.schema.yaml",
+                "type: object\nadditionalProperties: false\nproperties: {}\n",
+            ),
+            (
+                "schemas/people-facts.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: []\nproperties: {}\n",
+            ),
+        ] {
+            fs::write(fixture.project.join(path), contents).expect("source artifact");
+        }
+        let inline = r#"source:
+  operation: getPerson
+  facts:
+    - name: date_of_birth
+      path: /date_of_birth
+      combine: exactly-one
+  collectionBounds: {}
+"#;
+        let referenced = QUESTION.replace(inline, "source:\n  ref: people\n");
+        fs::write(
+            fixture.project.join("questions/adult-status.yaml"),
+            &referenced,
+        )
+        .expect("referenced question");
+        let copied = referenced
+            .replace("id: adult-status", "id: adult-status-copy")
+            .replace(
+                "derivations/adult-status.rhai",
+                "derivations/adult-status-copy.rhai",
+            );
+        fixture.add_question(&copied, ANSWER);
+
+        let compiled = compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect("referenced source compiles");
+        assert_eq!(compiled.questions.len(), 2);
+        let bundle: Value = serde_norway::from_slice(
+            &fs::read(fixture.staging.join("bundle/evidence.yaml")).expect("bundle"),
+        )
+        .expect("bundle yaml");
+        assert_eq!(bundle["sources"].as_object().expect("sources").len(), 1);
+        assert_eq!(
+            bundle["selectorProfiles"]
+                .as_object()
+                .expect("selectors")
+                .len(),
+            1
+        );
+        assert_eq!(
+            bundle["sources"]["people"]["authentication"]["usernameRef"],
+            "secret:file/records-username"
+        );
+        assert!(fixture
+            .staging
+            .join("bundle/adapters/people-extract.rhai")
+            .is_file());
+    }
+
+    #[test]
+    fn referenced_question_compiles_multiple_role_bound_subjects() {
+        let question = r#"id: relationship-check
+question: Does the governed relationship hold?
+purpose: relationship-review
+subjects:
+  - role: child
+    selector: child_reference
+    profile: child-reference-v1
+    derivation: true
+  - role: candidate
+    selector: person_reference
+    profile: person-reference-v1
+    derivation: true
+source:
+  ref: family-record
+answers:
+  - concept: relationship_confirmed
+    type: boolean
+derivation: derivations/relationship-check.rhai
+disclosure:
+  allow: [relationship_confirmed]
+"#;
+        let answer = r#"fn answer(facts, selectors, context) {
+    let child = required(selectors["child"], "child_missing");
+    let candidate = required(selectors["candidate"], "candidate_missing");
+    #{relationship_confirmed: child["values"]["child_reference"] != candidate["values"]["person_reference"]}
+}
+"#;
+        let fixture = Fixture::new(OPENAPI, question, answer, true);
+        for directory in ["sources", "selectors", "adapters", "schemas"] {
+            fs::create_dir(fixture.project.join(directory)).expect("authoring directory");
+        }
+        for (name, field) in [
+            ("child-reference-v1", "child_reference"),
+            ("person-reference-v1", "person_reference"),
+        ] {
+            fs::write(
+                fixture.project.join(format!("selectors/{name}.yaml")),
+                format!(
+                    "maximumAggregateBytes: 200\nfields:\n  {field}:\n    type: string\n    minimumBytes: 1\n    maximumBytes: 200\n"
+                ),
+            )
+            .expect("selector");
+        }
+        fs::write(
+            fixture.project.join("sources/family-record.yaml"),
+            r#"transport: http-json
+baseUrl: https://records.example.test
+posture: field-projected
+authentication: {kind: static-bearer, tokenRef: 'secret:file/records-token'}
+request:
+  method: GET
+  pathTemplate: /children/{child_reference}/relationships
+  pathBindings:
+    child_reference: {role: child, profile: child-reference-v1, field: child_reference}
+  selectorInputs:
+    - role: child
+      alternatives:
+        - {profile: child-reference-v1, fields: [child_reference]}
+  prepareScript: adapters/family-prepare.rhai
+  adapterParameters: {}
+  adapterParametersSchema: schemas/family-parameters.schema.yaml
+  preparationLimits: {query: forbidden, jsonBody: forbidden, maximumNormalizedBytes: 4096}
+  projection: [/relationship_complete]
+  redirects: deny
+  timeoutMilliseconds: 3000
+  maximumResponseBytes: 65536
+  concurrencyLimit: 8
+responseSchema: schemas/family-response.schema.yaml
+extractScript: adapters/family-extract.rhai
+factSchema: schemas/family-facts.schema.yaml
+"#,
+        )
+        .expect("source");
+        for (path, contents) in [
+            (
+                "adapters/family-prepare.rhai",
+                "fn prepare(s, p) { #{query: [], body: ()} }\n",
+            ),
+            (
+                "adapters/family-extract.rhai",
+                "fn extract(r, p) { #{outcome: \"match\", facts: r} }\n",
+            ),
+            (
+                "schemas/family-parameters.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: []\nproperties: {}\n",
+            ),
+            (
+                "schemas/family-response.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: [relationship_complete]\nproperties:\n  relationship_complete: {type: boolean}\n",
+            ),
+            (
+                "schemas/family-facts.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: [relationship_complete]\nproperties:\n  relationship_complete: {type: boolean}\n",
+            ),
+        ] {
+            fs::write(fixture.project.join(path), contents).expect("source artifact");
+        }
+
+        let compiled = compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect("multi-subject question compiles");
+        assert_eq!(
+            compiled.questions[0]
+                .subjects
+                .iter()
+                .map(|subject| (subject.role.as_str(), subject.selector_profile.as_str()))
+                .collect::<Vec<_>>(),
+            [
+                ("child", "child-reference-v1"),
+                ("candidate", "person-reference-v1"),
+            ]
+        );
+        let bundle: Value = serde_norway::from_slice(
+            &fs::read(fixture.staging.join("bundle/evidence.yaml")).expect("bundle"),
+        )
+        .expect("bundle YAML");
+        assert_eq!(bundle["selectorProfiles"].as_object().unwrap().len(), 2);
+        let grant = &bundle["authorityProfiles"][AUTHORITY_PROFILE_ID]["grants"][0];
+        assert_eq!(grant["subjects"].as_array().unwrap().len(), 2);
+        let requirement = &bundle["requirements"][0];
+        assert_eq!(requirement["subjectRoles"].as_array().unwrap().len(), 2);
+        assert_eq!(
+            requirement["derivation"]["selectorInputs"]
+                .as_array()
+                .unwrap()
+                .len(),
+            2
+        );
+        assert_eq!(
+            bundle["sources"]["family-record"]["request"]["selectorInputs"]
+                .as_array()
+                .unwrap()
+                .len(),
+            1,
+            "the derivation-only candidate never widens the provider request"
+        );
+    }
+
+    #[test]
+    fn compiles_nested_multi_event_leaves_without_reducing_to_the_first_event() {
+        let fixture = Fixture::new(
+            MULTI_EVENT_OPENAPI,
+            MULTI_EVENT_QUESTION,
+            MULTI_EVENT_ANSWER,
+            true,
+        );
+        compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect("nested repeated facts compile");
+
+        let response: Value = serde_norway::from_slice(
+            &fs::read(
+                fixture
+                    .staging
+                    .join("bundle/schemas/event-history-source-response.schema.yaml"),
+            )
+            .expect("response schema"),
+        )
+        .expect("response schema parses");
+        assert_eq!(response["additionalProperties"], false);
+        assert_eq!(response["required"], json!(["events"]));
+        assert_eq!(response["properties"]["events"]["minItems"], 1);
+        assert_eq!(response["properties"]["events"]["maxItems"], 4);
+        assert_eq!(
+            response["properties"]["events"]["items"]["required"],
+            json!(["status", "occurredAt"])
+        );
+
+        let facts: Value = serde_norway::from_slice(
+            &fs::read(
+                fixture
+                    .staging
+                    .join("bundle/schemas/event-history-source-facts.schema.yaml"),
+            )
+            .expect("fact schema"),
+        )
+        .expect("fact schema parses");
+        assert_eq!(facts["additionalProperties"], false);
+        assert_eq!(facts["properties"]["event_statuses"]["minItems"], 1);
+        assert_eq!(facts["properties"]["event_statuses"]["maxItems"], 4);
+
+        let extract = fs::read_to_string(
+            fixture
+                .staging
+                .join("bundle/adapters/event-history-source-extract.rhai"),
+        )
+        .expect("extract script");
+        assert!(extract.contains("for item_0_0 in items_0_0"), "{extract}");
+        assert!(extract.contains("collected_0.push"), "{extract}");
+        assert!(extract.contains("for item_1_0 in items_1_0"), "{extract}");
+        assert!(!extract.contains("/events/0"), "{extract}");
+
+        let sample: Value = serde_json::from_str(MULTI_EVENT_RESPONSE).expect("sanitized sample");
+        assert_eq!(sample["events"].as_array().expect("events").len(), 2);
+        assert_ne!(sample["events"][0]["status"], sample["events"][1]["status"]);
+    }
+
+    #[test]
+    fn repeated_fact_selection_requires_an_explicit_closed_combination_rule_and_bounds() {
+        let cases = [
+            MULTI_EVENT_QUESTION.replace("combine: collect", "combine: exactly-one"),
+            MULTI_EVENT_QUESTION.replace(
+                "  collectionBounds:\n    /events: 4",
+                "  collectionBounds: {}",
+            ),
+            MULTI_EVENT_QUESTION.replace("    /events: 4", "    /events: 257"),
+            MULTI_EVENT_QUESTION.replace("    /events: 4", "    /events: 4\n    /unused: 2"),
+        ];
+        for question in cases {
+            let fixture = Fixture::new(MULTI_EVENT_OPENAPI, &question, MULTI_EVENT_ANSWER, true);
+            let error =
+                compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+                    .expect_err("unsafe repeated fact selection is rejected");
+            assert!(fixture.staging_is_empty(), "{error:#}");
+        }
+    }
+
+    #[test]
+    fn selected_scalar_leaf_must_have_a_reviewed_closed_bound() {
+        let unbounded = MULTI_EVENT_OPENAPI.replace(
+            "status: {type: string, minLength: 1, maxLength: 32}",
+            "status: {type: string}",
+        );
+        let fixture = Fixture::new(&unbounded, MULTI_EVENT_QUESTION, MULTI_EVENT_ANSWER, true);
+        let error = compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect_err("unbounded selected leaf is rejected");
+        assert!(error.to_string().contains("unbounded"), "{error:#}");
+        assert!(fixture.staging_is_empty());
+    }
+
+    #[test]
+    fn collection_extraction_visits_nested_arrays_and_scalar_array_items() {
+        let extract = render_fact_extraction(&[QuestionFact {
+            name: "observations".to_owned(),
+            path: "/events/*/groups/*/*".to_owned(),
+            combine: FactCombination::Collect,
+        }]);
+        assert!(extract.contains("get_path(source_response, \"/events\")"));
+        assert!(extract.contains("get_path(item_0_0, \"/groups\")"));
+        assert!(extract.contains("let items_0_2 = required(item_0_1"));
+        assert!(extract.contains("collected_0.push(required(item_0_2"));
+        assert!(!extract.contains("/0"));
+    }
+
+    #[test]
+    fn question_is_closed_and_disclosure_cannot_be_widened() {
+        for mutation in [
+            QUESTION.replace("  allow: [is_adult]", "  allow: []"),
+            QUESTION.replace("  allow: [is_adult]", "  allow: [is_adult, another_answer]"),
+            QUESTION.replace("  allow: [is_adult]", "  allow: [is_adult, is_adult]"),
+            QUESTION.replace("      path: /date_of_birth", "      path: /missing"),
+            format!("{QUESTION}unknown: true\n"),
+        ] {
+            let fixture = Fixture::new(OPENAPI, QUESTION, ANSWER, true);
+            fs::write(
+                fixture.project.join("questions/adult-status.yaml"),
+                mutation,
+            )
+            .expect("mutated question");
+            let error =
+                compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+                    .expect_err("widened question is rejected");
+            assert!(fixture.staging_is_empty(), "{error:#}");
+        }
+    }
+
+    #[test]
+    fn multi_answer_constraints_and_exact_disclosure_fail_closed() {
+        let openapi = OPENAPI
+            .replace(
+                "required: [person_id, name, date_of_birth]",
+                "required: [person_id, name, date_of_birth, dose_count]",
+            )
+            .replace(
+                "                  date_of_birth: {type: string, format: date}",
+                "                  date_of_birth: {type: string, format: date}\n                  dose_count: {type: integer, minimum: 0, maximum: 20}",
+            );
+        for question in [
+            IMMUNIZATION_QUESTION.replace("    minimum: 0\n", ""),
+            IMMUNIZATION_QUESTION.replace("    maximum: 20", "    maximum: -1"),
+            IMMUNIZATION_QUESTION.replace(
+                "  allow: [schedule_complete, dose_count]",
+                "  allow: [schedule_complete, undeclared]",
+            ),
+            IMMUNIZATION_QUESTION
+                .replace("  - concept: dose_count", "  - concept: schedule_complete"),
+            IMMUNIZATION_QUESTION.replace(
+                "    type: boolean\n  - concept: dose_count",
+                "    type: boolean\n    minimum: 0\n  - concept: dose_count",
+            ),
+        ] {
+            let fixture = Fixture::new(&openapi, &question, IMMUNIZATION_ANSWER, true);
+            let error =
+                compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+                    .expect_err("invalid governed answers are rejected");
+            assert!(fixture.staging_is_empty(), "{error:#}");
+        }
+    }
+
+    #[test]
+    fn authored_code_cannot_replace_or_bypass_the_generated_concept_binding() {
+        let authored = r#"fn answer(facts, selectors, context) {
+    [#{concept_id: "urn:attacker:extra", value: true}]
+}
+"#;
+        let fixture = Fixture::new(OPENAPI, QUESTION, authored, true);
+        compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect("authored function stays behind the generated binding");
+
+        let derivation =
+            fs::read_to_string(fixture.staging.join("bundle/derivations/adult-status.rhai"))
+                .expect("rejected generated derivation remains inspectable");
+        let wrapper = derivation.rsplit_once("fn derive").unwrap().1;
+        assert!(wrapper.contains("urn:registrystack:evidence:local:concept:adult-status:is_adult"));
+        assert!(!wrapper.contains("urn:attacker"));
+        assert!(
+            wrapper.contains("let governed_answers = answer(facts, selectors, evaluation_context)")
+        );
+        assert!(wrapper.contains("value: governed_answers[\"is_adult\"]"));
+
+        for rejected in [
+            "fn helper(facts, selectors, context) { true }",
+            "fn answer(facts) { true }",
+            "fn answer(facts, selectors, context) { true } fn derive(facts, selectors, context) { [] }",
+            "fn answer(facts, selectors, context) { true } fn answer(facts) { false }",
+        ] {
+            let fixture = Fixture::new(OPENAPI, QUESTION, rejected, true);
+            let error =
+                compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+                    .expect_err("authored entry-point bypass is rejected");
+            assert!(fixture.staging_is_empty(), "{error:#}");
+        }
+    }
+
+    #[test]
+    fn ambiguous_or_nonlocal_openapi_fails_before_staging() {
+        let cases = [
+            OPENAPI.replace("127.0.0.1", "example.test"),
+            OPENAPI.replace(
+                "servers: [{url: 'http://127.0.0.1:8000'}]",
+                "servers: [{url: 'http://127.0.0.1:8000'}, {url: 'http://127.0.0.1:8001'}]",
+            ),
+            OPENAPI.replace("paths:", "security: []\npaths:"),
+            OPENAPI.replace("    get:", "    post:"),
+            OPENAPI.replace("      responses:", "      security: []\n      responses:"),
+            OPENAPI.replace("        '200':", "        default:"),
+            OPENAPI.replace(
+                "                  date_of_birth: {type: string, format: date}",
+                "                  date_of_birth: {type: object}",
+            ),
+        ];
+        for openapi in cases {
+            let fixture = Fixture::new(&openapi, QUESTION, ANSWER, true);
+            let error =
+                compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+                    .expect_err("unsupported OpenAPI is rejected");
+            assert!(fixture.staging_is_empty(), "{error:#}");
+        }
+    }
+
+    #[test]
+    fn unsupported_openapi_constraints_fail_before_staging() {
+        let cases = [
+            OPENAPI.replace(
+                "date_of_birth: {type: string, format: date}",
+                "date_of_birth: {type: string, maxLength: 32, pattern: '^2000-'}",
+            ),
+            OPENAPI.replace(
+                "date_of_birth: {type: string, format: date}",
+                "date_of_birth: {type: integer, exclusiveMinimum: 0}",
+            ),
+            OPENAPI.replace(
+                "date_of_birth: {type: string, format: date}",
+                "date_of_birth: {type: string, format: date, x-extra: true}",
+            ),
+            OPENAPI.replace(
+                "                type: object\n                required:",
+                "                type: object\n                minProperties: 1\n                required:",
+            ),
+        ];
+        for openapi in cases {
+            let fixture = Fixture::new(&openapi, QUESTION, ANSWER, true);
+            let error =
+                compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+                    .expect_err("unpreserved OpenAPI constraint is rejected");
+            assert!(error.to_string().contains("unsupported key"), "{error:#}");
+            assert!(fixture.staging_is_empty(), "{error:#}");
+        }
+    }
+
+    #[test]
+    fn punctuated_selector_and_fact_names_are_safely_quoted() {
+        let (openapi, question, answer) = punctuated_inputs();
+        let fixture = Fixture::new(&openapi, &question, &answer, true);
+        let compiled = compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect("punctuated names compile");
+
+        assert_eq!(
+            compiled.questions[0].subjects[0].selector_field,
+            "person-id.v1"
+        );
+        let extract = fs::read_to_string(
+            fixture
+                .staging
+                .join("bundle/adapters/adult-status-source-extract.rhai"),
+        )
+        .expect("extract script reads");
+        assert!(extract.contains(
+            "facts[\"date-of.birth\"] = required(get_path(source_response, \"/date-of.birth\")"
+        ));
+    }
+
+    #[test]
+    fn input_files_and_private_staging_are_fail_closed() {
+        let fixture = Fixture::new(OPENAPI, QUESTION, ANSWER, true);
+        fs::set_permissions(&fixture.staging, fs::Permissions::from_mode(0o755))
+            .expect("change staging mode");
+        let error = compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect_err("public staging rejected");
+        assert!(error.to_string().contains("0700"));
+
+        let fixture = Fixture::new(OPENAPI, QUESTION, ANSWER, true);
+        fs::write(
+            fixture.project.join("questions/notes.txt"),
+            b"not a question",
+        )
+        .expect("write unexpected entry");
+        let error = compile_local_project(&fixture.project, &fixture.staging, &fixture.evidence)
+            .expect_err("unexpected question entry rejected");
+        assert!(error.to_string().contains("only questions/*.yaml"));
+        assert!(fixture.staging_is_empty());
+    }
+
+    #[test]
+    #[ignore = "run after building the sibling evidence binary with local source authentication"]
+    fn real_evidence_loader_accepts_the_compiled_tutorial_generation() {
+        let evidence = std::env::var_os("EVIDENCE_BIN")
+            .map(PathBuf::from)
+            .expect("set EVIDENCE_BIN to the built evidence binary");
+        let fixture = Fixture::new(OPENAPI, QUESTION, ANSWER, true);
+        crate::keygen::generate_scaffold_key_material(
+            &fixture.project.join("secrets"),
+            SIGNING_KEY_ID,
+        )
+        .expect("generate local keys");
+        compile_local_project(&fixture.project, &fixture.staging, &evidence)
+            .expect("real Evidence loader accepts generated inputs");
+
+        let fixture = Fixture::new(OPENAPI, QUESTION, ANSWER, true);
+        fixture.add_question(AGE_BRACKET_QUESTION, AGE_BRACKET_ANSWER);
+        fixture.add_access_policy("age-checks", &["adult-status"]);
+        fixture.add_access_policy("service-routing", &["age-bracket"]);
+        crate::keygen::generate_scaffold_key_material(
+            &fixture.project.join("secrets"),
+            SIGNING_KEY_ID,
+        )
+        .expect("generate local keys");
+        compile_local_project(&fixture.project, &fixture.staging, &evidence)
+            .expect("real Evidence loader accepts explicit access profiles");
+
+        let fixture = Fixture::new(OPENAPI, AGE_BRACKET_QUESTION, AGE_BRACKET_ANSWER, true);
+        crate::keygen::generate_scaffold_key_material(
+            &fixture.project.join("secrets"),
+            SIGNING_KEY_ID,
+        )
+        .expect("generate local keys");
+        compile_local_project(&fixture.project, &fixture.staging, &evidence)
+            .expect("real Evidence loader accepts the controlled category");
+
+        let openapi = OPENAPI
+            .replace(
+                "required: [person_id, name, date_of_birth]",
+                "required: [person_id, name, date_of_birth, dose_count]",
+            )
+            .replace(
+                "                  date_of_birth: {type: string, format: date}",
+                "                  date_of_birth: {type: string, format: date}\n                  dose_count: {type: integer, minimum: 0, maximum: 20}",
+            );
+        let fixture = Fixture::new(&openapi, IMMUNIZATION_QUESTION, IMMUNIZATION_ANSWER, true);
+        crate::keygen::generate_scaffold_key_material(
+            &fixture.project.join("secrets"),
+            SIGNING_KEY_ID,
+        )
+        .expect("generate local keys");
+        compile_local_project(&fixture.project, &fixture.staging, &evidence)
+            .expect("real Evidence loader accepts multiple governed answers");
+
+        let (openapi, question, answer) = punctuated_inputs();
+        let fixture = Fixture::new(&openapi, &question, &answer, true);
+        crate::keygen::generate_scaffold_key_material(
+            &fixture.project.join("secrets"),
+            SIGNING_KEY_ID,
+        )
+        .expect("generate local keys");
+        compile_local_project(&fixture.project, &fixture.staging, &evidence)
+            .expect("real Evidence loader accepts safely quoted punctuated names");
+
+        let fixture = Fixture::new(
+            MULTI_EVENT_OPENAPI,
+            MULTI_EVENT_QUESTION,
+            MULTI_EVENT_ANSWER,
+            true,
+        );
+        crate::keygen::generate_scaffold_key_material(
+            &fixture.project.join("secrets"),
+            SIGNING_KEY_ID,
+        )
+        .expect("generate local keys");
+        compile_local_project(&fixture.project, &fixture.staging, &evidence)
+            .expect("real Evidence loader accepts nested repeated fact extraction");
+
+        let fixture = Fixture::new(
+            RELATIONSHIP_OPENAPI,
+            RELATIONSHIP_QUESTION,
+            RELATIONSHIP_ANSWER,
+            true,
+        );
+        crate::keygen::generate_scaffold_key_material(
+            &fixture.project.join("secrets"),
+            SIGNING_KEY_ID,
+        )
+        .expect("generate local keys");
+        compile_local_project(&fixture.project, &fixture.staging, &evidence)
+            .expect("real Evidence loader accepts multiple role-bound subjects");
+    }
+
+    fn punctuated_inputs() -> (String, String, String) {
+        let openapi = OPENAPI
+            .replace("person_id", "person-id.v1")
+            .replace("date_of_birth", "date-of.birth");
+        let question = QUESTION
+            .replace("person_id", "person-id.v1")
+            .replace("date_of_birth", "date-of.birth");
+        let answer = ANSWER.replace("facts.date_of_birth", "facts[\"date-of.birth\"]");
+        (openapi, question, answer)
+    }
+
+    struct Fixture {
+        _root: tempfile::TempDir,
+        project: PathBuf,
+        staging: PathBuf,
+        evidence: PathBuf,
+    }
+
+    impl Fixture {
+        fn new(openapi: &str, question: &str, derivation: &str, check_succeeds: bool) -> Self {
+            let root = tempfile::tempdir().expect("tempdir");
+            let project = root.path().join("project");
+            fs::create_dir(&project).expect("project");
+            fs::create_dir(project.join("questions")).expect("questions");
+            fs::create_dir(project.join("derivations")).expect("derivations");
+            let mut secrets = fs::DirBuilder::new();
+            secrets.mode(0o700);
+            secrets.create(project.join("secrets")).expect("secrets");
+            fs::write(project.join(OPENAPI_FILE), openapi).expect("OpenAPI");
+
+            let staging = root.path().join("staging");
+            let mut private = fs::DirBuilder::new();
+            private.mode(0o700);
+            private.create(&staging).expect("staging");
+
+            let evidence = root.path().join("evidence-stub");
+            let mut file = fs::OpenOptions::new()
+                .write(true)
+                .create_new(true)
+                .mode(0o700)
+                .open(&evidence)
+                .expect("stub");
+            let script = if check_succeeds {
+                "#!/bin/sh\ntest \"$1\" = --runtime && test \"$3\" = check\n"
+            } else {
+                "#!/bin/sh\necho 'script rejected' >&2\nexit 1\n"
+            };
+            file.write_all(script.as_bytes()).expect("write stub");
+
+            let fixture = Self {
+                _root: root,
+                project,
+                staging,
+                evidence,
+            };
+            fixture.add_question(question, derivation);
+            fixture
+        }
+
+        fn add_question(&self, question: &str, derivation: &str) {
+            let parsed: Question = serde_norway::from_str(question).expect("question parses");
+            fs::write(
+                self.project
+                    .join("questions")
+                    .join(format!("{}.yaml", parsed.id)),
+                question,
+            )
+            .expect("question");
+            fs::write(self.project.join(&parsed.derivation), derivation).expect("derivation");
+        }
+
+        fn add_access_policy(&self, id: &str, questions: &[&str]) {
+            fs::create_dir_all(self.project.join("access/policies")).expect("policy directory");
+            let policy = json!({"version": 1, "id": id, "questions": questions});
+            fs::write(
+                self.project
+                    .join("access/policies")
+                    .join(format!("{id}.yaml")),
+                serde_norway::to_string(&policy).expect("policy YAML"),
+            )
+            .expect("policy");
+        }
+
+        fn staging_is_empty(&self) -> bool {
+            fs::read_dir(&self.staging)
+                .expect("read staging")
+                .next()
+                .is_none()
+        }
+    }
+
+    impl Drop for Fixture {
+        fn drop(&mut self) {
+            if self.staging.join("bundle").is_dir() {
+                let _ = set_bundle_modes(&self.staging.join("bundle"), 0o700, 0o600);
+            }
+            if self.staging.join("runtime.yaml").is_file() {
+                let _ = fs::set_permissions(
+                    self.staging.join("runtime.yaml"),
+                    fs::Permissions::from_mode(0o600),
+                );
+            }
+        }
+    }
+
+    fn tree(root: &Path) -> Vec<String> {
+        fn visit(root: &Path, current: &Path, output: &mut Vec<String>) {
+            let mut entries = fs::read_dir(current)
+                .expect("read directory")
+                .collect::<std::io::Result<Vec<_>>>()
+                .expect("entries");
+            entries.sort_by_key(|entry| entry.file_name());
+            for entry in entries {
+                let path = entry.path();
+                let relative = path.strip_prefix(root).unwrap().to_string_lossy();
+                if path.is_dir() {
+                    output.push(format!("{relative}/"));
+                    visit(root, &path, output);
+                } else {
+                    output.push(relative.into_owned());
+                }
+            }
+        }
+        let mut output = Vec::new();
+        visit(root, root, &mut output);
+        output
+    }
+
+    fn assert_mode(path: &Path, expected: u32) {
+        let actual = fs::metadata(path).unwrap().permissions().mode() & 0o7777;
+        assert_eq!(actual, expected, "mode of {}", path.display());
+    }
+}
diff --git a/crates/registry-evidencectl/src/build.rs b/crates/registry-evidencectl/src/build.rs
new file mode 100644
index 000000000..691981fad
--- /dev/null
+++ b/crates/registry-evidencectl/src/build.rs
@@ -0,0 +1,817 @@
+//! Compile an editable Evidence authoring project into one closed production
+//! candidate. Production secrets and target-host paths remain operator-owned.
+
+use std::{
+    collections::BTreeSet,
+    fs::{self, File, OpenOptions},
+    io::{Read as _, Seek as _, Write as _},
+    os::unix::fs::{
+        DirBuilderExt as _, MetadataExt as _, OpenOptionsExt as _, PermissionsExt as _,
+    },
+    path::{Component, Path, PathBuf},
+    process::{Command, ExitCode, ExitStatus, Stdio},
+    sync::{
+        atomic::{AtomicBool, Ordering},
+        Arc,
+    },
+    thread,
+    time::Duration,
+};
+
+use anyhow::{anyhow, bail, Context as _, Result};
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use clap::Args;
+use serde::Deserialize;
+use serde_json::{json, Map, Value};
+
+use crate::{authoring, fixtures, keygen};
+
+const MAX_TARGET_BYTES: u64 = 1024 * 1024;
+const MAX_EVIDENCE_STDOUT_BYTES: u64 = 1024 * 1024;
+const SECRET_PREFIX: &str = "secret:file/";
+const VALIDATION_CA: &[u8] = br#"-----BEGIN CERTIFICATE-----
+MIIDMzCCAhugAwIBAgIULquGuNJ2HotUWgpEcRBAdsEtTkUwDQYJKoZIhvcNAQEL
+BQAwKTEnMCUGA1UEAwweZXZpZGVuY2VjdGwtdmFsaWRhdGlvbi5pbnZhbGlkMB4X
+DTI2MDgwNDE1MjIxMloXDTM2MDgwMTE1MjIxMlowKTEnMCUGA1UEAwweZXZpZGVu
+Y2VjdGwtdmFsaWRhdGlvbi5pbnZhbGlkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAqaK57iK2Xspf35AsdY0lCOkUgGRFP7cheDnl855jeW1izSt9ZbBZ
+BO9TbUo2J5WnNApOIQFi/57kxX/9HUaTHxaQXsFRgLolYCU5CSWuAI5JMDP0OH+H
+xni8AJ1j/cOFovhg/eqRAatF97tBu5Wxh6ghl1eDmZOVeboM/OHns4hauxi6zkdC
+oq0ZF7XAQTM7WYbmSewfXcaY5Px4YtyuDJoTVBzsVkp9X3OposyicAXT/5BqPqjC
+2jCnM9/PsO9ZpzSZTzeYn06QRtED3hCruCc3isMlWr5lE/KMvMvm9Q+q7+VfariD
+qL2UuK4hCRcvTzcbW3s67x3DsohcbuA/OQIDAQABo1MwUTAdBgNVHQ4EFgQUAHgZ
+2TkaFqS4edYq+6zlsG6aBDwwHwYDVR0jBBgwFoAUAHgZ2TkaFqS4edYq+6zlsG6a
+BDwwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAeOvtXp0JMcQw
+ouUNvQGlPvu2bcfjsEfvzKOyzjRKmgf4RZYXdFTbV+TkRWjUHjkKjkGE8T18bnBs
+3bLuzx0/UJw0b5BxTVSevUgmjnSDqK8XBS8ZyBomcB9MQ+MwPO4ssTDPsZCqOLao
+GlhP5e68cbZwmC2YYtgu/bPRSMtlYzTp6wQv2voDlSPZgCUlzfTU67yKsS0dnQaV
+wObsZ58XF4WVjuNtyoxtqToUtnrdCP9HUG/I5QiD54IFlVx2dqeWhLa/oyMeAxiR
+R1YU60RrYIjPIGEnL+L1WuwoOEu8x09ly2/9wuIWhQPNgVMTCzjwnt8XdVuNecD6
+MRmJRtyidQ==
+-----END CERTIFICATE-----
+"#;
+
+#[derive(Debug, Args)]
+pub struct BuildArgs {
+    /// Editable Evidence authoring project; defaults to the current directory.
+    #[arg(long, default_value = ".")]
+    pub project: PathBuf,
+
+    /// Explicit production target containing governance.yaml and runtime.yaml.
+    #[arg(long)]
+    pub target: PathBuf,
+
+    /// New candidate directory to create. It must not already exist.
+    #[arg(long)]
+    pub output: PathBuf,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct TargetGovernance {
+    version: u32,
+    assurance_profile: String,
+    service: Value,
+    issuer: Value,
+    authentication: Value,
+    audit: Value,
+    subject_binding: Value,
+    rate_limits: Value,
+    signing: Value,
+    #[serde(default)]
+    response_formats: Option<Value>,
+    authority_profiles: Value,
+}
+
+impl TargetGovernance {
+    fn into_bundle(self) -> Result<Value> {
+        if self.version != 1 {
+            bail!("production governance version must be 1");
+        }
+        if self.assurance_profile != "production" {
+            bail!("evidencectl build requires assuranceProfile: production");
+        }
+        if self
+            .authority_profiles
+            .as_object()
+            .is_none_or(Map::is_empty)
+        {
+            bail!("production governance requires at least one authority profile");
+        }
+        let mut object = Map::from_iter([
+            ("version".to_owned(), json!(self.version)),
+            (
+                "assuranceProfile".to_owned(),
+                Value::String(self.assurance_profile),
+            ),
+            ("service".to_owned(), self.service),
+            ("issuer".to_owned(), self.issuer),
+            ("authentication".to_owned(), self.authentication),
+            ("audit".to_owned(), self.audit),
+            ("subjectBinding".to_owned(), self.subject_binding),
+            ("rateLimits".to_owned(), self.rate_limits),
+            ("signing".to_owned(), self.signing),
+            ("authorityProfiles".to_owned(), self.authority_profiles),
+        ]);
+        if let Some(response_formats) = self.response_formats {
+            object.insert("responseFormats".to_owned(), response_formats);
+        }
+        Ok(Value::Object(object))
+    }
+}
+
+pub fn run(args: BuildArgs) -> Result<ExitCode> {
+    let interruption = BuildInterruption::install()?;
+    run_inner(args, &interruption)
+}
+
+fn run_inner(args: BuildArgs, interruption: &BuildInterruption) -> Result<ExitCode> {
+    interruption.check()?;
+    reject_existing_output(&args.output)?;
+    let project = plain_directory(&args.project, "production project")?;
+    let output_parent = plain_parent(&args.output)?;
+    let candidate = output_parent.join(
+        args.output
+            .file_name()
+            .ok_or_else(|| anyhow!("candidate output must name one new directory"))?,
+    );
+    if candidate.starts_with(&project) {
+        bail!("candidate output must remain outside the editable project");
+    }
+    let target = plain_directory(&args.target, "production target")?;
+    let governance_bytes = read_plain_file(
+        &target.join("governance.yaml"),
+        MAX_TARGET_BYTES,
+        "production governance",
+    )?;
+    let target_runtime = read_plain_file(
+        &target.join("runtime.yaml"),
+        MAX_TARGET_BYTES,
+        "production runtime",
+    )?;
+    let governance: TargetGovernance = serde_norway::from_slice(&governance_bytes)
+        .context("production governance is not the closed Version 1 target shape")?;
+    let governed_bundle = governance.into_bundle()?;
+    let evidence_bin = fixtures::resolve_evidence_binary(None)?;
+
+    interruption.check()?;
+    let staging = tempfile::Builder::new()
+        .prefix(".evidencectl-build-")
+        .tempdir_in(&output_parent)
+        .with_context(|| format!("staging the candidate in {}", output_parent.display()))?;
+    fs::set_permissions(staging.path(), fs::Permissions::from_mode(0o700))
+        .context("setting private production candidate staging permissions")?;
+    let result = prepare_candidate(
+        &project,
+        staging.path(),
+        &target_runtime,
+        governed_bundle,
+        &evidence_bin,
+        &output_parent,
+        interruption,
+    );
+    let (revision, secret_references) = match result {
+        Ok(result) => result,
+        Err(error) => {
+            close_candidate_staging(staging)?;
+            return Err(error);
+        }
+    };
+    if let Err(error) = interruption.check() {
+        close_candidate_staging(staging)?;
+        return Err(error);
+    }
+    publish(staging, &args.output)?;
+
+    println!("Bundle revision: {revision}");
+    println!("Candidate: {}", args.output.display());
+    for reference in secret_references {
+        println!("Provision {SECRET_PREFIX}{reference}");
+    }
+    println!(
+        "Target runtime paths and production secret material remain unverified until `evidencectl doctor --project {}` and the target-host Evidence check.",
+        args.output.display()
+    );
+    Ok(ExitCode::SUCCESS)
+}
+
+struct BuildInterruption {
+    requested: Arc<AtomicBool>,
+    registrations: Vec<signal_hook::SigId>,
+}
+
+impl BuildInterruption {
+    fn install() -> Result<Self> {
+        let mut guard = Self {
+            requested: Arc::new(AtomicBool::new(false)),
+            registrations: Vec::new(),
+        };
+        for signal in [signal_hook::consts::SIGINT, signal_hook::consts::SIGTERM] {
+            let registration = signal_hook::flag::register(signal, Arc::clone(&guard.requested))
+                .context("installing the production-build signal handler")?;
+            guard.registrations.push(registration);
+        }
+        Ok(guard)
+    }
+
+    fn check(&self) -> Result<()> {
+        if self.requested.load(Ordering::Relaxed) {
+            bail!("production build interrupted");
+        }
+        Ok(())
+    }
+}
+
+impl Drop for BuildInterruption {
+    fn drop(&mut self) {
+        for registration in self.registrations.drain(..) {
+            signal_hook::low_level::unregister(registration);
+        }
+    }
+}
+
+fn prepare_candidate(
+    project: &Path,
+    staging_root: &Path,
+    target_runtime: &[u8],
+    governed_bundle: Value,
+    evidence_bin: &Path,
+    temporary_parent: &Path,
+    interruption: &BuildInterruption,
+) -> Result<(String, Vec<String>)> {
+    let compiled = authoring::compile_production_project(project, staging_root, governed_bundle)?;
+    interruption.check()?;
+    reject_review_markers(&compiled.bundle_path)?;
+    reject_review_markers_in_bytes(target_runtime, "production runtime")?;
+    let runtime_path = staging_root.join("runtime.yaml");
+    write_new_file(&runtime_path, target_runtime, 0o600)?;
+    fs::set_permissions(&runtime_path, fs::Permissions::from_mode(0o400))
+        .context("sealing the copied production runtime")?;
+
+    let secret_references = secret_references(&compiled.bundle)?;
+    let validation = tempfile::Builder::new()
+        .prefix(".evidencectl-build-validation-")
+        .tempdir_in(temporary_parent)
+        .context("creating private production validation state")?;
+    fs::set_permissions(validation.path(), fs::Permissions::from_mode(0o700))
+        .context("setting private production validation permissions")?;
+    let validation_result = (|| -> Result<String> {
+        let validation_runtime = prepare_validation_runtime(
+            validation.path(),
+            &compiled.bundle_path,
+            &compiled.bundle,
+            &secret_references,
+        )?;
+        interruption.check()?;
+        let revision = run_check(evidence_bin, &validation_runtime, interruption)?;
+        for fixture in &compiled.fixture_paths {
+            interruption.check()?;
+            run_fixture(evidence_bin, &validation_runtime, fixture, interruption)?;
+        }
+        interruption.check()?;
+        Ok(revision)
+    })();
+    validation
+        .close()
+        .context("removing private production validation staging")?;
+    let revision = validation_result?;
+    Ok((revision, secret_references))
+}
+
+fn prepare_validation_runtime(
+    root: &Path,
+    bundle: &Path,
+    config: &Value,
+    secret_references: &[String],
+) -> Result<PathBuf> {
+    let secret_root = root.join("secrets");
+    let active_ref = config
+        .pointer("/signing/activeKeyRef")
+        .and_then(Value::as_str)
+        .and_then(|value| value.strip_prefix(SECRET_PREFIX))
+        .ok_or_else(|| anyhow!("production signing must use one logical file secret reference"))?;
+    let active_key_id = config
+        .pointer("/signing/activeKeyId")
+        .and_then(Value::as_str)
+        .ok_or_else(|| anyhow!("production signing must declare one active key id"))?;
+    keygen::generate_dev_keypair(
+        &secret_root,
+        active_key_id,
+        active_ref,
+        ".validation-public.jwk.json",
+    )?;
+    for reference in secret_references {
+        if reference == active_ref {
+            continue;
+        }
+        let mut entropy = [0_u8; 32];
+        getrandom::fill(&mut entropy).context("generating temporary validation material")?;
+        let encoded = URL_SAFE_NO_PAD.encode(entropy);
+        write_new_file(&secret_root.join(reference), encoded.as_bytes(), 0o600)?;
+    }
+
+    let ca_root = root.join("ca");
+    create_private_directory(&ca_root)?;
+    let mut trust_profiles = Map::new();
+    for profile in tls_trust_profiles(config)? {
+        let path = ca_root.join(format!("{profile}.pem"));
+        write_new_file(&path, VALIDATION_CA, 0o400)?;
+        trust_profiles.insert(profile, json!({"caBundleFile": path.to_string_lossy()}));
+    }
+    let audit = root.join("audit");
+    create_private_directory(&audit)?;
+    let runtime = json!({
+        "version": 1,
+        "bundleDirectory": fs::canonicalize(bundle)?.to_string_lossy(),
+        "listener": {
+            "bindHost": "127.0.0.1",
+            "port": 1,
+            "tlsTermination": "operator-controlled-upstream",
+            "trustProxyIdentityHeaders": false,
+            "maximumRequestBytes": 65536,
+            "maximumConcurrentRequests": 1,
+            "requestTimeoutMilliseconds": 10000,
+            "shutdownGraceMilliseconds": 30000,
+        },
+        "secretProviders": {"file": {"root": fs::canonicalize(&secret_root)?.to_string_lossy()}},
+        "auditStorage": {
+            "path": audit.join("evidence.jsonl").to_string_lossy(),
+            "maximumFileBytes": 1048576,
+        },
+        "outboundTls": {"systemRoots": true, "trustProfiles": trust_profiles},
+    });
+    let path = root.join("runtime.yaml");
+    let mut bytes = serde_norway::to_string(&runtime)?.into_bytes();
+    if !bytes.ends_with(b"\n") {
+        bytes.push(b'\n');
+    }
+    write_new_file(&path, &bytes, 0o400)?;
+    Ok(path)
+}
+
+fn tls_trust_profiles(config: &Value) -> Result<Vec<String>> {
+    let mut profiles = BTreeSet::new();
+    if let Some(sources) = config.get("sources").and_then(Value::as_object) {
+        for source in sources.values() {
+            if let Some(profile) = source.get("tlsTrustProfile").and_then(Value::as_str) {
+                if !valid_local_identifier(profile) {
+                    bail!("production TLS trust profile identifier is invalid");
+                }
+                profiles.insert(profile.to_owned());
+            }
+        }
+    }
+    Ok(profiles.into_iter().collect())
+}
+
+fn run_check(
+    evidence_bin: &Path,
+    runtime: &Path,
+    interruption: &BuildInterruption,
+) -> Result<String> {
+    let mut command = Command::new(evidence_bin);
+    command
+        .arg("--runtime")
+        .arg(runtime)
+        .arg("check")
+        .env_remove("REGISTRY_EVIDENCE_RUNTIME");
+    let output = run_evidence(command, interruption, true)?;
+    if !output.status.success() {
+        return runtime_failure("Evidence rejected the generated production bundle");
+    }
+    parse_bundle_revision(&String::from_utf8_lossy(&output.stdout))
+}
+
+fn run_fixture(
+    evidence_bin: &Path,
+    runtime: &Path,
+    fixture: &str,
+    interruption: &BuildInterruption,
+) -> Result<()> {
+    let mut command = Command::new(evidence_bin);
+    command
+        .arg("--runtime")
+        .arg(runtime)
+        .arg("evaluate")
+        .arg("--fixture")
+        .arg(fixture)
+        .env_remove("REGISTRY_EVIDENCE_RUNTIME");
+    let output = run_evidence(command, interruption, false)?;
+    if output.status.success() {
+        return Ok(());
+    }
+    runtime_failure("Evidence rejected a production fixture")
+}
+
+struct EvidenceOutput {
+    status: ExitStatus,
+    stdout: Vec<u8>,
+}
+
+fn run_evidence(
+    mut command: Command,
+    interruption: &BuildInterruption,
+    capture_stdout: bool,
+) -> Result<EvidenceOutput> {
+    interruption.check()?;
+    let mut stdout = capture_stdout
+        .then(tempfile::tempfile)
+        .transpose()
+        .context("creating private Evidence output capture")?;
+    command.stdin(Stdio::null()).stderr(Stdio::null());
+    if let Some(file) = &stdout {
+        command.stdout(Stdio::from(file.try_clone()?));
+    } else {
+        command.stdout(Stdio::null());
+    }
+    let mut child = command
+        .spawn()
+        .context("starting the Evidence production validation")?;
+    let status = loop {
+        if interruption.check().is_err() {
+            terminate_validation_child(&mut child);
+            return Err(anyhow!("production build interrupted"));
+        }
+        if stdout.as_ref().is_some_and(|file| {
+            file.metadata()
+                .is_ok_and(|metadata| metadata.len() > MAX_EVIDENCE_STDOUT_BYTES)
+        }) {
+            terminate_validation_child(&mut child);
+            bail!("Evidence production validation output exceeded its byte limit");
+        }
+        match child.try_wait() {
+            Ok(Some(status)) => break status,
+            Ok(None) => thread::sleep(Duration::from_millis(10)),
+            Err(error) => {
+                terminate_validation_child(&mut child);
+                return Err(error).context("waiting for Evidence production validation");
+            }
+        }
+    };
+    interruption.check()?;
+
+    let mut captured = Vec::new();
+    if let Some(file) = stdout.as_mut() {
+        file.rewind()?;
+        file.take(MAX_EVIDENCE_STDOUT_BYTES + 1)
+            .read_to_end(&mut captured)?;
+        if captured.len() as u64 > MAX_EVIDENCE_STDOUT_BYTES {
+            bail!("Evidence production validation output exceeded its byte limit");
+        }
+    }
+    Ok(EvidenceOutput {
+        status,
+        stdout: captured,
+    })
+}
+
+fn terminate_validation_child(child: &mut std::process::Child) {
+    let _ = child.kill();
+    let _ = child.wait();
+}
+
+fn runtime_failure<T>(message: &str) -> Result<T> {
+    // Evidence diagnostics are intentionally not relayed here. A validation
+    // process may have opened operator-authored configuration, and build
+    // failures must remain value-free even if that subprocess is replaced.
+    bail!("{message}")
+}
+
+fn parse_bundle_revision(stdout: &str) -> Result<String> {
+    let revision = stdout
+        .lines()
+        .find_map(|line| line.strip_prefix("Evidence deployment "))
+        .and_then(|line| line.split_whitespace().next())
+        .filter(|value| {
+            value.len() == 71
+                && value.starts_with("sha256:")
+                && value[7..].bytes().all(|byte| byte.is_ascii_hexdigit())
+        })
+        .ok_or_else(|| anyhow!("Evidence check returned no bundle revision"))?;
+    Ok(revision.to_owned())
+}
+
+fn secret_references(value: &Value) -> Result<Vec<String>> {
+    let mut references = BTreeSet::new();
+    collect_secret_references(value, &mut references)?;
+    Ok(references.into_iter().collect())
+}
+
+fn collect_secret_references(value: &Value, references: &mut BTreeSet<String>) -> Result<()> {
+    match value {
+        Value::String(value) => {
+            if let Some(reference) = value.strip_prefix(SECRET_PREFIX) {
+                if !valid_secret_name(reference) {
+                    bail!("production logical file secret reference has invalid syntax");
+                }
+                references.insert(reference.to_owned());
+            }
+        }
+        Value::Array(values) => {
+            for value in values {
+                collect_secret_references(value, references)?;
+            }
+        }
+        Value::Object(values) => {
+            for value in values.values() {
+                collect_secret_references(value, references)?;
+            }
+        }
+        _ => {}
+    }
+    Ok(())
+}
+
+fn valid_secret_name(name: &str) -> bool {
+    let bytes = name.as_bytes();
+    matches!(bytes.first(), Some(b'a'..=b'z'))
+        && bytes.len() <= 128
+        && bytes[1..].iter().all(|byte| {
+            byte.is_ascii_lowercase() || byte.is_ascii_digit() || matches!(byte, b'.' | b'_' | b'-')
+        })
+}
+
+fn valid_local_identifier(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    matches!(bytes.first(), Some(b'a'..=b'z'))
+        && bytes.len() <= 128
+        && bytes[1..].iter().all(|byte| {
+            byte.is_ascii_lowercase() || byte.is_ascii_digit() || matches!(byte, b'.' | b'_' | b'-')
+        })
+}
+
+fn reject_review_markers(bundle: &Path) -> Result<()> {
+    for path in bundle_files(bundle)? {
+        let bytes = fs::read(&path).context("reading one generated bundle artifact")?;
+        reject_review_markers_in_bytes(&bytes, "production bundle")?;
+    }
+    Ok(())
+}
+
+fn reject_review_markers_in_bytes(bytes: &[u8], description: &str) -> Result<()> {
+    if [
+        b"TODO(evidencectl)".as_slice(),
+        b"review-required",
+        b"placeholder_fact",
+    ]
+    .iter()
+    .any(|marker| bytes.windows(marker.len()).any(|window| window == *marker))
+    {
+        bail!("the {description} contains an unresolved authoring review marker");
+    }
+    Ok(())
+}
+
+fn bundle_files(root: &Path) -> Result<Vec<PathBuf>> {
+    let mut pending = vec![root.to_path_buf()];
+    let mut files = Vec::new();
+    while let Some(path) = pending.pop() {
+        for entry in fs::read_dir(&path).context("walking the generated bundle")? {
+            let path = entry?.path();
+            let metadata = fs::symlink_metadata(&path)?;
+            if metadata.file_type().is_symlink() {
+                bail!("the generated bundle contains a symbolic link");
+            }
+            if metadata.is_dir() {
+                pending.push(path);
+            } else if metadata.is_file() {
+                files.push(path);
+            } else {
+                bail!("the generated bundle contains an unsupported entry");
+            }
+        }
+    }
+    files.sort();
+    Ok(files)
+}
+
+fn reject_existing_output(path: &Path) -> Result<()> {
+    match fs::symlink_metadata(path) {
+        Ok(_) => bail!("output already exists; evidencectl build never overwrites a candidate"),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(error) => Err(error).context("inspecting the candidate output path"),
+    }
+}
+
+fn plain_parent(path: &Path) -> Result<PathBuf> {
+    if !matches!(path.components().next_back(), Some(Component::Normal(_))) {
+        bail!("candidate output must name one new directory");
+    }
+    let parent = path
+        .parent()
+        .filter(|parent| !parent.as_os_str().is_empty())
+        .unwrap_or_else(|| Path::new("."));
+    validate_plain_components(parent, "candidate parent", true)?;
+    fs::canonicalize(parent).context("resolving the candidate parent")
+}
+
+fn plain_directory(path: &Path, description: &str) -> Result<PathBuf> {
+    validate_plain_components(path, description, true)?;
+    fs::canonicalize(path).with_context(|| format!("resolving {description} directory"))
+}
+
+fn validate_plain_components(
+    path: &Path,
+    description: &str,
+    final_is_directory: bool,
+) -> Result<()> {
+    let absolute = if path.is_absolute() {
+        path.to_path_buf()
+    } else {
+        std::env::current_dir()?.join(path)
+    };
+    let components = absolute.components().collect::<Vec<_>>();
+    let mut current = PathBuf::new();
+    for (index, component) in components.iter().enumerate() {
+        match component {
+            Component::RootDir => current.push(Path::new("/")),
+            Component::Normal(value) => current.push(value),
+            Component::CurDir => continue,
+            Component::ParentDir | Component::Prefix(_) => {
+                bail!("{description} must not contain path traversal")
+            }
+        }
+        let metadata =
+            fs::symlink_metadata(&current).with_context(|| format!("inspecting {description}"))?;
+        if metadata.file_type().is_symlink() {
+            bail!("{description} must not traverse symbolic links");
+        }
+        let is_final = index + 1 == components.len();
+        if (!is_final || final_is_directory) && !metadata.is_dir() {
+            bail!("{description} must be an existing plain directory");
+        }
+    }
+    Ok(())
+}
+
+fn read_plain_file(path: &Path, maximum: u64, description: &str) -> Result<Vec<u8>> {
+    use rustix::fs::{Mode, OFlags};
+    let descriptor = rustix::fs::open(
+        path,
+        OFlags::RDONLY | OFlags::CLOEXEC | OFlags::NOFOLLOW | OFlags::NONBLOCK,
+        Mode::empty(),
+    )
+    .map_err(std::io::Error::from)
+    .with_context(|| format!("opening {description}"))?;
+    let mut file = File::from(descriptor);
+    let metadata = file.metadata()?;
+    if !metadata.is_file() || metadata.nlink() != 1 || metadata.len() > maximum {
+        bail!("{description} must be a bounded regular file");
+    }
+    let mut bytes = Vec::new();
+    std::io::Read::by_ref(&mut file)
+        .take(maximum + 1)
+        .read_to_end(&mut bytes)?;
+    if bytes.len() as u64 > maximum {
+        bail!("{description} exceeds its byte limit");
+    }
+    Ok(bytes)
+}
+
+fn create_private_directory(path: &Path) -> Result<()> {
+    let mut builder = fs::DirBuilder::new();
+    builder.mode(0o700);
+    builder
+        .create(path)
+        .with_context(|| format!("creating {}", path.display()))
+}
+
+fn write_new_file(path: &Path, contents: &[u8], mode: u32) -> Result<()> {
+    let mut file = OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(mode)
+        .open(path)
+        .with_context(|| format!("creating {}", path.display()))?;
+    file.write_all(contents)?;
+    file.sync_all()?;
+    Ok(())
+}
+
+fn make_tree_removable(root: &Path) -> Result<()> {
+    for entry in fs::read_dir(root)? {
+        let path = entry?.path();
+        let metadata = fs::symlink_metadata(&path)?;
+        if metadata.file_type().is_symlink() {
+            bail!("private staging contains a symbolic link");
+        }
+        if metadata.is_dir() {
+            fs::set_permissions(&path, fs::Permissions::from_mode(0o700))?;
+            make_tree_removable(&path)?;
+        } else if metadata.is_file() {
+            fs::set_permissions(&path, fs::Permissions::from_mode(0o600))?;
+        } else {
+            bail!("private staging contains an unsupported entry");
+        }
+    }
+    fs::set_permissions(root, fs::Permissions::from_mode(0o700))?;
+    Ok(())
+}
+
+fn close_candidate_staging(staging: tempfile::TempDir) -> Result<()> {
+    make_tree_removable(staging.path())?;
+    staging
+        .close()
+        .context("removing private production candidate staging")
+}
+
+fn publish(staging: tempfile::TempDir, output: &Path) -> Result<()> {
+    let staged = staging.keep();
+    if let Err(error) = rename_noreplace(&staged, output) {
+        let _ = make_tree_removable(&staged);
+        let _ = fs::remove_dir_all(&staged);
+        return Err(error).context("publishing the production candidate without replacement");
+    }
+    Ok(())
+}
+
+#[cfg(any(target_os = "linux", target_vendor = "apple"))]
+fn rename_noreplace(source: &Path, destination: &Path) -> std::io::Result<()> {
+    rustix::fs::renameat_with(
+        rustix::fs::CWD,
+        source,
+        rustix::fs::CWD,
+        destination,
+        rustix::fs::RenameFlags::NOREPLACE,
+    )
+    .map_err(std::io::Error::from)
+}
+
+#[cfg(not(any(target_os = "linux", target_vendor = "apple")))]
+fn rename_noreplace(_source: &Path, _destination: &Path) -> std::io::Result<()> {
+    Err(std::io::Error::new(
+        std::io::ErrorKind::Unsupported,
+        "atomic no-replace candidate publication is unsupported on this platform",
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::os::unix::fs::symlink;
+
+    #[test]
+    fn production_governance_is_closed_at_the_target_boundary() {
+        let unknown = serde_norway::from_str::<TargetGovernance>(
+            r#"version: 1
+assuranceProfile: production
+service: {}
+issuer: {}
+authentication: {}
+audit: {}
+subjectBinding: {}
+rateLimits: {}
+signing: {}
+authorityProfiles: {}
+requirements: []
+"#,
+        );
+        assert!(unknown.is_err());
+    }
+
+    #[test]
+    fn revision_and_secret_reference_parsing_are_closed() {
+        let revision = format!("Evidence deployment sha256:{}\n", "a".repeat(64));
+        assert_eq!(
+            parse_bundle_revision(&revision).expect("revision"),
+            format!("sha256:{}", "a".repeat(64))
+        );
+        assert!(parse_bundle_revision("Evidence deployment sha256:not-a-digest\n").is_err());
+
+        let names = secret_references(&json!({
+            "z": "secret:file/source-token",
+            "a": ["secret:file/audit-key", "secret:file/source-token"]
+        }))
+        .expect("references");
+        assert_eq!(names, ["audit-key", "source-token"]);
+        assert!(secret_references(&json!({"key": "secret:file/../escape"})).is_err());
+        assert!(secret_references(&json!({"key": "secret:file/nested/escape"})).is_err());
+        assert!(tls_trust_profiles(&json!({
+            "sources": {"source": {"tlsTrustProfile": "../../escape"}}
+        }))
+        .is_err());
+    }
+
+    #[test]
+    fn target_and_candidate_paths_reject_ancestor_symlinks() {
+        let temporary = tempfile::tempdir().expect("tempdir");
+        let root = fs::canonicalize(temporary.path()).expect("canonical tempdir");
+        let actual = root.join("actual");
+        fs::create_dir(&actual).expect("actual directory");
+        let link = root.join("link");
+        symlink(&actual, &link).expect("ancestor symlink");
+
+        assert!(plain_directory(&link, "production target").is_err());
+        assert!(plain_parent(&link.join("candidate")).is_err());
+    }
+
+    #[test]
+    fn review_markers_are_rejected_without_repeating_authored_values() {
+        for marker in ["TODO(evidencectl)", "review-required", "placeholder_fact"] {
+            let error = reject_review_markers_in_bytes(marker.as_bytes(), "production runtime")
+                .expect_err("review marker rejected")
+                .to_string();
+            assert!(!error.contains(marker));
+        }
+    }
+}
diff --git a/crates/registry-evidencectl/src/dev.rs b/crates/registry-evidencectl/src/dev.rs
new file mode 100644
index 000000000..442cffd4f
--- /dev/null
+++ b/crates/registry-evidencectl/src/dev.rs
@@ -0,0 +1,2308 @@
+//! Minimal private lifecycle for local Evidence tutorials.
+//!
+//! The final `.evidence/dev` directory is compiled in place because the
+//! runtime contains absolute paths. A resident supervisor owns both service
+//! children and is the only process allowed to stop them.
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fs::{self, File, Metadata, OpenOptions},
+    io::{Read as _, Write as _},
+    os::unix::{
+        fs::{
+            symlink, DirBuilderExt as _, FileTypeExt as _, MetadataExt as _, OpenOptionsExt as _,
+            PermissionsExt as _,
+        },
+        net::{UnixListener, UnixStream},
+    },
+    path::{Path, PathBuf},
+    process::{Child, Command, ExitCode, Stdio},
+    sync::{
+        atomic::{AtomicBool, Ordering},
+        Arc,
+    },
+    thread,
+    time::{Duration, Instant},
+};
+
+use anyhow::{anyhow, bail, Context as _, Result};
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use clap::{Args, Subcommand};
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value};
+use zeroize::Zeroizing;
+
+use crate::{
+    access,
+    authoring::{
+        access_policy_requester_tag, compile_local_project_with_ports, CompiledAccessPolicy,
+        CompiledConceptForm, CompiledProject, CompiledQuestion, LocalServicePorts,
+    },
+    keygen,
+};
+
+const STATE_SCHEMA: &str = "registry.evidencectl.dev-state/v5";
+const CONTROL_SOCKET_NAME: &str = "control.sock";
+const CALLER_ID: &str = "local-tutorial-caller";
+const LOCAL_ACCESS_TOKEN_AUDIENCE: &str = "registry-evidence-local";
+const LOCAL_CALLER_EVIDENCE_AUDIENCE: &str = "urn:registrystack:evidence:local:caller";
+const LOCAL_REQUESTER_TAG: &str = "local-caller";
+const MINT_KEY_ID: &str = "local-mint-signing-key-1";
+const CALLER_KEY_ID: &str = "local-tutorial-caller-key-1";
+const MINT_AUDIT_KEY_FILENAME: &str = "mint-audit-hmac-key";
+const PRIVATE_DIR_MODE: u32 = 0o700;
+const PRIVATE_FILE_MODE: u32 = 0o600;
+const MAX_STATE_BYTES: u64 = 4 * 1024 * 1024;
+const MAX_HTTP_BODY_BYTES: u64 = 64 * 1024;
+const DEFAULT_READY_TIMEOUT_SECONDS: u64 = 45;
+const SHUTDOWN_TIMEOUT_SECONDS: u64 = 35;
+
+#[derive(Debug, Args)]
+pub struct DevArgs {
+    #[command(subcommand)]
+    action: Option<DevAction>,
+
+    /// Return after Mint and Evidence are ready on loopback.
+    #[arg(long)]
+    detach: bool,
+
+    /// Loopback port for the local Evidence service.
+    #[arg(long, default_value_t = 8080)]
+    evidence_port: u16,
+
+    /// Loopback port for the local Mint service.
+    #[arg(long, default_value_t = 8081)]
+    mint_port: u16,
+
+    /// Project root. Defaults to the current directory.
+    #[arg(long, default_value = ".", hide = true)]
+    project: PathBuf,
+
+    #[arg(long, hide = true)]
+    evidence_bin: Option<PathBuf>,
+
+    #[arg(long, hide = true)]
+    mint_bin: Option<PathBuf>,
+
+    #[arg(
+        long,
+        default_value_t = DEFAULT_READY_TIMEOUT_SECONDS,
+        value_parser = clap::value_parser!(u64).range(1..=120),
+        hide = true
+    )]
+    ready_timeout_seconds: u64,
+}
+
+#[derive(Debug, Subcommand)]
+enum DevAction {
+    /// Stop the active local Mint and Evidence pair.
+    Stop(StopArgs),
+    /// Remove one completed stopped local generation.
+    Clean(CleanArgs),
+}
+
+#[derive(Debug, Args)]
+struct StopArgs {
+    #[arg(long, default_value = ".", hide = true)]
+    project: PathBuf,
+}
+
+#[derive(Debug, Args)]
+struct CleanArgs {
+    #[arg(long, default_value = ".", hide = true)]
+    project: PathBuf,
+}
+
+#[derive(Debug, Args)]
+pub struct SupervisorArgs {
+    #[arg(long)]
+    dev_root: PathBuf,
+    #[arg(long)]
+    evidence_bin: PathBuf,
+    #[arg(long)]
+    mint_bin: PathBuf,
+    #[arg(long)]
+    ready_timeout_seconds: u64,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "kebab-case")]
+enum DevStatus {
+    Starting,
+    Ready,
+    Stopping,
+    Stopped,
+    Failed,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "kebab-case")]
+enum FailureKind {
+    MintStart,
+    MintReadiness,
+    EvidenceStart,
+    EvidenceReadiness,
+    ChildExited,
+    Supervisor,
+    SupervisorSignal,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct DevState {
+    schema: String,
+    status: DevStatus,
+    project: PathBuf,
+    runtime_path: PathBuf,
+    evidence_origin: String,
+    mint_origin: String,
+    token_url: String,
+    access_token_audience: String,
+    caller: Option<CallerState>,
+    access_policies: Vec<AccessPolicyState>,
+    questions: Vec<QuestionState>,
+    failure: Option<FailureKind>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct CallerState {
+    client_id: String,
+    private_key_path: PathBuf,
+    assertion_audience: String,
+    evidence_audience: String,
+    requester_tag: String,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct AccessPolicyState {
+    id: String,
+    requester_tag: String,
+    questions: Vec<String>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct QuestionState {
+    alias: String,
+    requirement_uri: String,
+    purpose: String,
+    subjects: Vec<SubjectState>,
+    concepts: Vec<ConceptState>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct SubjectState {
+    role: String,
+    selector_profile: String,
+    selector_field: String,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct ConceptState {
+    alias: String,
+    uri: String,
+    form: String,
+}
+
+/// Validated active-session inputs for native request preparation.
+///
+/// Consumers use this seam instead of parsing private state themselves. Every
+/// path is absolute and revalidated against the one ready `.evidence/dev`
+/// session before it is returned.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct ReadyDevState {
+    pub(crate) project: PathBuf,
+    pub(crate) runtime_path: PathBuf,
+    pub(crate) evidence_origin: String,
+    pub(crate) mint_origin: String,
+    pub(crate) token_url: String,
+    pub(crate) access_token_audience: String,
+    pub(crate) caller: Option<ReadyCallerState>,
+    pub(crate) access_policies: Vec<ReadyAccessPolicy>,
+    pub(crate) questions: Vec<ReadyQuestionState>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct ReadyCallerState {
+    pub(crate) client_id: String,
+    pub(crate) private_key_path: PathBuf,
+    pub(crate) assertion_audience: String,
+    pub(crate) evidence_audience: String,
+    pub(crate) requester_tag: String,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct ReadyAccessPolicy {
+    pub(crate) id: String,
+    pub(crate) requester_tag: String,
+    pub(crate) questions: Vec<String>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct ReadyQuestionState {
+    pub(crate) alias: String,
+    pub(crate) requirement_uri: String,
+    pub(crate) purpose: String,
+    pub(crate) subjects: Vec<ReadySubjectState>,
+    pub(crate) concepts: Vec<ReadyConceptState>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct ReadySubjectState {
+    pub(crate) role: String,
+    pub(crate) selector_profile: String,
+    pub(crate) selector_field: String,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct ReadyConceptState {
+    pub(crate) alias: String,
+    pub(crate) uri: String,
+    pub(crate) form: String,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct StoppedDevState {
+    pub(crate) runtime_path: PathBuf,
+    pub(crate) questions: Vec<ReadyQuestionState>,
+}
+
+pub(crate) struct LifecycleLock {
+    _file: File,
+}
+
+#[derive(Default)]
+struct OwnedChildren {
+    evidence: Option<Child>,
+    mint: Option<Child>,
+}
+
+impl OwnedChildren {
+    fn stop(&mut self) {
+        stop_children(self.evidence.as_mut(), self.mint.as_mut());
+        self.evidence = None;
+        self.mint = None;
+    }
+}
+
+impl Drop for OwnedChildren {
+    fn drop(&mut self) {
+        self.stop();
+    }
+}
+
+pub fn run(args: DevArgs) -> Result<ExitCode> {
+    match args.action {
+        Some(DevAction::Stop(stop)) => {
+            if args.detach {
+                bail!("`dev stop` does not accept `--detach`");
+            }
+            stop_dev(&stop.project)
+        }
+        Some(DevAction::Clean(clean)) => {
+            if args.detach {
+                bail!("`dev clean` does not accept `--detach`");
+            }
+            clean_dev(&clean.project)
+        }
+        None => {
+            if !args.detach {
+                bail!("the local development lifecycle requires `evidencectl dev --detach`");
+            }
+            let ports = LocalServicePorts::new(args.evidence_port, args.mint_port)?;
+            start_detached(
+                &args.project,
+                args.evidence_bin.as_deref(),
+                args.mint_bin.as_deref(),
+                args.ready_timeout_seconds,
+                ports,
+            )
+        }
+    }
+}
+
+pub fn run_supervisor(args: SupervisorArgs) -> Result<ExitCode> {
+    let dev_root = args.dev_root.clone();
+    let terminate = Arc::new(AtomicBool::new(false));
+    let result = (|| {
+        // SIGKILL cannot be observed and is intentionally not part of this
+        // tutorial lifecycle. Catchable operator signals use owned cleanup.
+        for signal in [
+            signal_hook::consts::SIGTERM,
+            signal_hook::consts::SIGHUP,
+            signal_hook::consts::SIGINT,
+        ] {
+            signal_hook::flag::register(signal, Arc::clone(&terminate))
+                .context("failed to install the local supervisor signal handler")?;
+        }
+        injected_supervisor_failure("before-setsid")?;
+        rustix::process::setsid().context("failed to detach the local supervisor session")?;
+        publish_test_supervisor_pid()?;
+        supervise(args, &terminate)
+    })();
+    if let Err(error) = result {
+        let _ = publish_supervisor_failure(&dev_root, FailureKind::Supervisor);
+        return Err(error);
+    }
+    Ok(ExitCode::SUCCESS)
+}
+
+#[allow(dead_code)] // Crate-private handoff for the immediately following request slice.
+pub(crate) fn load_ready_state(project: &Path) -> Result<ReadyDevState> {
+    let project = canonical_project(project)?;
+    let generated_root = existing_private_generated_root(&project)?;
+    let dev_root = generated_root.join("dev");
+    validate_private_directory(&dev_root)?;
+    let state = read_state(&dev_root.join("state.json"))?;
+    if state.status != DevStatus::Ready || state.failure.is_some() {
+        bail!("the local development state is not the closed ready session");
+    }
+    validate_closed_state(&state, &project, &dev_root)?;
+    require_owned_regular_file(&state.runtime_path, 0o400)?;
+    if let Some(caller) = &state.caller {
+        require_owned_regular_file(&caller.private_key_path, PRIVATE_FILE_MODE)?;
+    }
+    validate_control_socket(&dev_root.join("control.sock"))?;
+    Ok(ReadyDevState {
+        project,
+        runtime_path: state.runtime_path,
+        evidence_origin: state.evidence_origin,
+        mint_origin: state.mint_origin,
+        token_url: state.token_url,
+        access_token_audience: state.access_token_audience,
+        caller: state.caller.map(|caller| ReadyCallerState {
+            client_id: caller.client_id,
+            private_key_path: caller.private_key_path,
+            assertion_audience: caller.assertion_audience,
+            evidence_audience: caller.evidence_audience,
+            requester_tag: caller.requester_tag,
+        }),
+        access_policies: state
+            .access_policies
+            .into_iter()
+            .map(|policy| ReadyAccessPolicy {
+                id: policy.id,
+                requester_tag: policy.requester_tag,
+                questions: policy.questions,
+            })
+            .collect(),
+        questions: state.questions.into_iter().map(ready_question).collect(),
+    })
+}
+
+#[allow(dead_code)] // Consumed by the access-management CLI slice.
+pub(crate) fn try_load_ready_state(project: &Path) -> Result<Option<ReadyDevState>> {
+    let project = canonical_project(project)?;
+    let generated_root = project.join(".evidence");
+    match fs::symlink_metadata(&generated_root) {
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+        Ok(_) => validate_private_directory(&generated_root)?,
+        Err(error) => return Err(error.into()),
+    }
+    let dev_root = generated_root.join("dev");
+    match fs::symlink_metadata(&dev_root) {
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+        Ok(_) => validate_private_directory(&dev_root)?,
+        Err(error) => return Err(error.into()),
+    }
+    let state = read_state(&dev_root.join("state.json"))?;
+    match state.status {
+        DevStatus::Ready if state.failure.is_none() => load_ready_state(&project).map(Some),
+        DevStatus::Stopped if state.caller.is_none() && state.failure.is_none() => {
+            load_stopped_state(&project)?;
+            Ok(None)
+        }
+        _ => bail!("local development state exists but is neither ready nor cleanly stopped"),
+    }
+}
+
+#[allow(dead_code)] // Crate-private handoff for the immediately following audit slice.
+pub(crate) fn load_stopped_state(project: &Path) -> Result<StoppedDevState> {
+    let project = canonical_project(project)?;
+    let generated_root = existing_private_generated_root(&project)?;
+    let dev_root = generated_root.join("dev");
+    validate_private_directory(&dev_root)?;
+    let state = read_state(&dev_root.join("state.json"))?;
+    if state.status != DevStatus::Stopped || state.caller.is_some() || state.failure.is_some() {
+        bail!("the local development state is not the closed stopped session");
+    }
+    validate_closed_state(&state, &project, &dev_root)?;
+    require_owned_regular_file(&state.runtime_path, 0o400)?;
+    match fs::symlink_metadata(dev_root.join("control.sock")) {
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+        Ok(_) => bail!("stopped local state still has a control path"),
+        Err(error) => return Err(error.into()),
+    }
+    Ok(StoppedDevState {
+        runtime_path: state.runtime_path,
+        questions: state.questions.into_iter().map(ready_question).collect(),
+    })
+}
+
+/// Ask the private local supervisor to make Mint reload its complete client
+/// registry. This confirms only that SIGHUP was delivered. The next token
+/// request remains the functional proof that Mint accepted the new registry.
+#[allow(dead_code)] // Consumed by the access-management CLI slice.
+pub(crate) fn request_mint_reload(project: &Path) -> Result<()> {
+    let project = canonical_project(project)?;
+    let generated_root = existing_private_generated_root(&project)?;
+    let dev_root = generated_root.join("dev");
+    validate_private_directory(&dev_root)?;
+    let state = read_state(&dev_root.join("state.json"))?;
+    if state.status != DevStatus::Ready || state.failure.is_some() {
+        bail!("the local development state is not ready for a Mint reload");
+    }
+    validate_closed_state(&state, &project, &dev_root)?;
+    let socket = dev_root.join(CONTROL_SOCKET_NAME);
+    validate_control_socket(&socket)?;
+    send_control_request(&socket, b"reload-mint\n", b"reload-requested\n")
+        .context("the local supervisor did not accept the Mint reload request")
+}
+
+fn send_control_request(socket: &Path, request: &[u8], expected: &[u8]) -> Result<()> {
+    let parent = socket
+        .parent()
+        .ok_or_else(|| anyhow!("local control socket has no parent"))?;
+    let bridge = tempfile::Builder::new()
+        .prefix("ec-")
+        .tempdir()
+        .context("creating a short private control path")?;
+    fs::set_permissions(bridge.path(), fs::Permissions::from_mode(PRIVATE_DIR_MODE))?;
+    let link = bridge.path().join("d");
+    symlink(parent, &link).context("creating a short private control path")?;
+    let mut stream = UnixStream::connect(link.join(CONTROL_SOCKET_NAME))
+        .context("the local supervisor is unavailable")?;
+    stream.set_read_timeout(Some(Duration::from_secs(2)))?;
+    stream.write_all(request)?;
+    stream.shutdown(std::net::Shutdown::Write)?;
+    let mut response = Vec::new();
+    (&mut stream).take(64).read_to_end(&mut response)?;
+    if response != expected {
+        bail!("the local supervisor returned an unexpected control response");
+    }
+    Ok(())
+}
+
+fn validate_closed_state(state: &DevState, project: &Path, dev_root: &Path) -> Result<()> {
+    let evidence_port = local_origin_port(&state.evidence_origin);
+    let mint_port = local_origin_port(&state.mint_origin);
+    let origins_are_closed = matches!((evidence_port, mint_port), (Some(evidence), Some(mint)) if evidence != mint)
+        && state.token_url == format!("{}/token", state.mint_origin);
+    let questions_are_closed = !state.questions.is_empty()
+        && state.questions.len() <= 128
+        && state.questions.iter().all(valid_question_state)
+        && state
+            .questions
+            .iter()
+            .map(|question| question.alias.as_str())
+            .collect::<std::collections::BTreeSet<_>>()
+            .len()
+            == state.questions.len();
+    let question_aliases = state
+        .questions
+        .iter()
+        .map(|question| question.alias.as_str())
+        .collect::<BTreeSet<_>>();
+    let access_policies_are_closed = state.access_policies.len() <= 128
+        && state
+            .access_policies
+            .windows(2)
+            .all(|pair| pair[0].id < pair[1].id)
+        && state
+            .access_policies
+            .iter()
+            .all(|policy| valid_access_policy_state(policy, &question_aliases))
+        && state
+            .access_policies
+            .iter()
+            .map(|policy| policy.requester_tag.as_str())
+            .collect::<BTreeSet<_>>()
+            .len()
+            == state.access_policies.len()
+        && state_matches_sealed_bundle(&state.questions, &state.access_policies, dev_root)
+            .unwrap_or(false);
+    let caller_is_closed = match state.status {
+        DevStatus::Starting | DevStatus::Ready => {
+            state.access_policies.is_empty() == state.caller.is_some()
+        }
+        DevStatus::Stopped => state.caller.is_none(),
+        DevStatus::Stopping | DevStatus::Failed => true,
+    } && state
+        .caller
+        .as_ref()
+        .is_none_or(|caller| validate_closed_caller(caller, dev_root, &state.token_url).is_ok());
+    if state.project != project
+        || state.runtime_path != dev_root.join("runtime.yaml")
+        || !origins_are_closed
+        || state.access_token_audience != LOCAL_ACCESS_TOKEN_AUDIENCE
+        || !questions_are_closed
+        || !access_policies_are_closed
+        || !caller_is_closed
+    {
+        bail!("the local development state contains values outside the closed lifecycle profile");
+    }
+    Ok(())
+}
+
+fn valid_access_policy_state(
+    policy: &AccessPolicyState,
+    question_aliases: &BTreeSet<&str>,
+) -> bool {
+    valid_local_identifier(&policy.id)
+        && !policy.questions.is_empty()
+        && policy.questions.len() <= 128
+        && policy.questions.windows(2).all(|pair| pair[0] < pair[1])
+        && policy
+            .questions
+            .iter()
+            .all(|question| question_aliases.contains(question.as_str()))
+        && access_policy_requester_tag(&policy.id, &policy.questions)
+            .is_ok_and(|tag| tag == policy.requester_tag)
+}
+
+fn valid_question_state(question: &QuestionState) -> bool {
+    let identifiers_are_closed = [question.alias.as_str(), question.purpose.as_str()]
+        .into_iter()
+        .all(valid_local_identifier);
+    let concepts_are_closed = !question.concepts.is_empty()
+        && question.concepts.len() <= 16
+        && question.concepts.iter().all(valid_concept_state)
+        && question
+            .concepts
+            .iter()
+            .map(|concept| concept.alias.as_str())
+            .collect::<std::collections::BTreeSet<_>>()
+            .len()
+            == question.concepts.len();
+    let subject_count = question.subjects.len();
+    let subjects_are_closed = !question.subjects.is_empty()
+        && question.subjects.len() <= 8
+        && question.subjects.iter().all(|subject| {
+            valid_local_identifier(&subject.role)
+                && valid_local_identifier(&subject.selector_profile)
+                && valid_local_identifier(&subject.selector_field)
+                && (!subject.selector_profile.starts_with("local-subject-")
+                    || subject.selector_profile
+                        == if subject_count == 1 {
+                            format!("local-subject-{}-v1", question.alias)
+                        } else {
+                            format!("local-subject-{}-{}-v1", question.alias, subject.role)
+                        })
+        })
+        && question
+            .subjects
+            .iter()
+            .map(|subject| subject.role.as_str())
+            .collect::<std::collections::BTreeSet<_>>()
+            .len()
+            == question.subjects.len();
+    identifiers_are_closed
+        && valid_uri(&question.requirement_uri)
+        && subjects_are_closed
+        && concepts_are_closed
+}
+
+fn valid_concept_state(concept: &ConceptState) -> bool {
+    valid_local_identifier(&concept.alias)
+        && valid_uri(&concept.uri)
+        && matches!(
+            concept.form.as_str(),
+            "boolean" | "controlled-category" | "bounded-integer" | "reviewed-structured-value"
+        )
+}
+
+fn valid_uri(value: &str) -> bool {
+    value.len() <= 512 && url::Url::parse(value).is_ok()
+}
+
+fn state_matches_sealed_bundle(
+    questions: &[QuestionState],
+    access_policies: &[AccessPolicyState],
+    dev_root: &Path,
+) -> Result<bool> {
+    let path = dev_root.join("bundle/evidence.yaml");
+    require_owned_regular_file(&path, 0o400)?;
+    let bytes = fs::read(&path).context("failed to read the sealed local bundle")?;
+    if bytes.len() > 1024 * 1024 {
+        return Ok(false);
+    }
+    let bundle: Value =
+        serde_norway::from_slice(&bytes).context("the sealed local bundle is invalid")?;
+    let requirements = bundle
+        .get("requirements")
+        .and_then(Value::as_array)
+        .ok_or_else(|| anyhow!("the sealed local bundle has no requirements"))?;
+    if requirements.len() != questions.len() {
+        return Ok(false);
+    }
+    let selector_profiles = bundle
+        .get("selectorProfiles")
+        .and_then(Value::as_object)
+        .ok_or_else(|| anyhow!("the sealed local bundle has no selector profiles"))?;
+    for question in questions {
+        let Some(requirement) = requirements.iter().find(|requirement| {
+            requirement.get("id").and_then(Value::as_str) == Some(question.requirement_uri.as_str())
+        }) else {
+            return Ok(false);
+        };
+        if !requirement
+            .get("purposes")
+            .and_then(Value::as_array)
+            .is_some_and(|purposes| *purposes == [Value::String(question.purpose.clone())])
+        {
+            return Ok(false);
+        }
+        let concepts = requirement
+            .get("concepts")
+            .and_then(Value::as_array)
+            .ok_or_else(|| anyhow!("a sealed local requirement has no concepts"))?;
+        if concepts.len() != question.concepts.len()
+            || question.concepts.iter().any(|concept| {
+                !concepts.iter().any(|configured| {
+                    configured.get("id").and_then(Value::as_str) == Some(concept.uri.as_str())
+                        && configured.get("form").and_then(Value::as_str)
+                            == Some(concept.form.as_str())
+                })
+            })
+        {
+            return Ok(false);
+        }
+        let roles = requirement
+            .get("subjectRoles")
+            .and_then(Value::as_array)
+            .ok_or_else(|| anyhow!("a sealed local requirement has no subject roles"))?;
+        if roles.len() != question.subjects.len()
+            || question.subjects.iter().any(|subject| {
+                !roles.iter().any(|role| {
+                    role.get("role").and_then(Value::as_str) == Some(subject.role.as_str())
+                        && role
+                            .get("selectorProfiles")
+                            .and_then(Value::as_array)
+                            .is_some_and(|profiles| {
+                                profiles.iter().any(|profile| {
+                                    profile.as_str() == Some(subject.selector_profile.as_str())
+                                })
+                            })
+                }) || !selector_profiles
+                    .get(&subject.selector_profile)
+                    .and_then(|profile| profile.get("fields"))
+                    .and_then(Value::as_object)
+                    .is_some_and(|fields| fields.contains_key(&subject.selector_field))
+            })
+        {
+            return Ok(false);
+        }
+    }
+    let authority_profiles = bundle
+        .get("authorityProfiles")
+        .and_then(Value::as_object)
+        .ok_or_else(|| anyhow!("the sealed local bundle has no authority profiles"))?;
+    if access_policies.is_empty() {
+        let Some(profile) = authority_profiles.get(LOCAL_REQUESTER_TAG) else {
+            return Ok(false);
+        };
+        return Ok(authority_profiles.len() == 1
+            && authority_profile_matches(
+                profile,
+                LOCAL_REQUESTER_TAG,
+                &questions.iter().collect::<Vec<_>>(),
+            ));
+    }
+    if authority_profiles.len() != access_policies.len() {
+        return Ok(false);
+    }
+    for policy in access_policies {
+        let Some(profile) = authority_profiles.get(&policy.requester_tag) else {
+            return Ok(false);
+        };
+        let governed_questions = policy
+            .questions
+            .iter()
+            .filter_map(|alias| questions.iter().find(|question| question.alias == *alias))
+            .collect::<Vec<_>>();
+        if governed_questions.len() != policy.questions.len()
+            || !authority_profile_matches(profile, &policy.requester_tag, &governed_questions)
+        {
+            return Ok(false);
+        }
+    }
+    Ok(true)
+}
+
+fn authority_profile_matches(
+    profile: &Value,
+    requester_tag: &str,
+    questions: &[&QuestionState],
+) -> bool {
+    if profile.get("kind").and_then(Value::as_str) != Some("explicit-request")
+        || profile
+            .get("requesterTags")
+            .and_then(Value::as_array)
+            .is_none_or(|tags| tags.as_slice() != [Value::String(requester_tag.to_owned())])
+    {
+        return false;
+    }
+    profile
+        .get("grants")
+        .and_then(Value::as_array)
+        .is_some_and(|grants| {
+            grants.len() == questions.len()
+                && grants
+                    .iter()
+                    .zip(questions)
+                    .all(|(grant, question)| grant_matches_question(grant, question))
+        })
+}
+
+fn grant_matches_question(grant: &Value, question: &QuestionState) -> bool {
+    if grant.get("requirement").and_then(Value::as_str) != Some(question.requirement_uri.as_str())
+        || grant.get("purpose").and_then(Value::as_str) != Some(question.purpose.as_str())
+        || grant.get("audienceFrom").and_then(Value::as_str) != Some("authenticated-requester")
+    {
+        return false;
+    }
+    grant
+        .get("subjects")
+        .and_then(Value::as_array)
+        .is_some_and(|subjects| {
+            subjects.len() == question.subjects.len()
+                && subjects
+                    .iter()
+                    .zip(&question.subjects)
+                    .all(|(configured, expected)| {
+                        configured.get("role").and_then(Value::as_str)
+                            == Some(expected.role.as_str())
+                            && configured.get("selectorProfile").and_then(Value::as_str)
+                                == Some(expected.selector_profile.as_str())
+                            && configured.get("valueOrigin").and_then(Value::as_str)
+                                == Some("request")
+                    })
+        })
+}
+
+fn validate_closed_caller(caller: &CallerState, dev_root: &Path, token_url: &str) -> Result<()> {
+    if caller.client_id != CALLER_ID
+        || caller.private_key_path != dev_root.join("generated/keys/caller-private.jwk")
+        || caller.assertion_audience != token_url
+        || caller.evidence_audience != LOCAL_CALLER_EVIDENCE_AUDIENCE
+        || caller.requester_tag != LOCAL_REQUESTER_TAG
+    {
+        bail!("the local development caller is outside the closed lifecycle profile");
+    }
+    Ok(())
+}
+
+fn local_origin_port(origin: &str) -> Option<u16> {
+    let port = origin.strip_prefix("http://127.0.0.1:")?.parse().ok()?;
+    (port != 0 && origin == format!("http://127.0.0.1:{port}")).then_some(port)
+}
+
+fn local_origin(port: u16) -> String {
+    format!("http://127.0.0.1:{port}")
+}
+
+fn valid_local_identifier(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    matches!(bytes.first(), Some(b'a'..=b'z'))
+        && bytes.len() <= 64
+        && bytes[1..].iter().all(|byte| {
+            byte.is_ascii_lowercase() || byte.is_ascii_digit() || matches!(byte, b'.' | b'_' | b'-')
+        })
+}
+
+fn start_detached(
+    project: &Path,
+    evidence_override: Option<&Path>,
+    mint_override: Option<&Path>,
+    ready_timeout_seconds: u64,
+    ports: LocalServicePorts,
+) -> Result<ExitCode> {
+    let project = canonical_project(project)?;
+    let generated_root = ensure_private_generated_root(&project)?;
+    let _lifecycle = lock_lifecycle(&generated_root)?;
+    let dev_root = generated_root.join("dev");
+
+    match fs::symlink_metadata(&dev_root) {
+        Ok(metadata) => {
+            validate_private_directory_metadata(&dev_root, &metadata)?;
+            remove_completed_dev_root(&project, &dev_root)?;
+        }
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+        Err(error) => return Err(error).context("failed to inspect local development state"),
+    }
+
+    create_private_directory(&dev_root)?;
+    let result = prepare_and_start(
+        &project,
+        &dev_root,
+        evidence_override,
+        mint_override,
+        ready_timeout_seconds,
+        ports,
+    );
+    if let Err(error) = result {
+        if let Err(cleanup) = cleanup_new_dev_root(&dev_root) {
+            return Err(error.context(format!(
+                "failed to roll back the incomplete local session: {cleanup:#}"
+            )));
+        }
+        return Err(error);
+    }
+    result
+}
+
+fn remove_completed_dev_root(project: &Path, dev_root: &Path) -> Result<()> {
+    let state = read_state(&dev_root.join("state.json"))?;
+    if state.status != DevStatus::Stopped || state.caller.is_some() || state.failure.is_some() {
+        bail!("local development state already exists and is not a completed stopped session");
+    }
+    validate_closed_state(&state, project, dev_root)?;
+    require_owned_regular_file(&state.runtime_path, 0o400)?;
+    match fs::symlink_metadata(dev_root.join(CONTROL_SOCKET_NAME)) {
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+        Ok(_) => bail!("stopped local state still has a control path"),
+        Err(error) => return Err(error.into()),
+    }
+    make_tree_removable(dev_root)?;
+    fs::remove_dir_all(dev_root).context("failed to replace the completed local session")
+}
+
+fn clean_dev(project: &Path) -> Result<ExitCode> {
+    let project = canonical_project(project)?;
+    let generated_root = existing_private_generated_root(&project)?;
+    let _lifecycle = lock_lifecycle(&generated_root)?;
+    let dev_root = generated_root.join("dev");
+    validate_private_directory(&dev_root)?;
+    remove_completed_dev_root(&project, &dev_root)?;
+    println!("Removed stopped local Evidence state");
+    Ok(ExitCode::SUCCESS)
+}
+
+fn prepare_and_start(
+    project: &Path,
+    dev_root: &Path,
+    evidence_override: Option<&Path>,
+    mint_override: Option<&Path>,
+    ready_timeout_seconds: u64,
+    ports: LocalServicePorts,
+) -> Result<ExitCode> {
+    let evidence_bin = canonical_tool_binary(resolve_tool_binary(
+        "evidence",
+        evidence_override,
+        "EVIDENCECTL_TEST_EVIDENCE_BIN",
+    )?)?;
+    let mint_bin = canonical_tool_binary(resolve_tool_binary(
+        "mint",
+        mint_override,
+        "EVIDENCECTL_TEST_MINT_BIN",
+    )?)?;
+    let compiled = compile_local_project_with_ports(project, dev_root, &evidence_bin, ports)?;
+    let evidence_origin = local_origin(ports.evidence);
+    let mint_origin = local_origin(ports.mint);
+    let token_url = format!("{mint_origin}/token");
+
+    let generated = dev_root.join("generated");
+    let keys = generated.join("keys");
+    let clients = generated.join("clients");
+    let mint_audit = generated.join("audit");
+    let logs = dev_root.join("logs");
+    for directory in [&generated, &keys, &clients, &mint_audit, &logs] {
+        create_private_directory(directory)?;
+    }
+
+    let (mint_private, _) = keygen::generate_dev_keypair(
+        &keys,
+        MINT_KEY_ID,
+        "mint-private.jwk",
+        "mint-public.jwk.json",
+    )?;
+    let mint_audit_key = keys.join(MINT_AUDIT_KEY_FILENAME);
+    generate_mint_audit_key(&mint_audit_key)?;
+    let mint_config = mint_config(&compiled, &mint_private, &mint_audit_key, ports);
+    let mint_config_path = generated.join("mint.yaml");
+    write_private_yaml(&mint_config_path, &mint_config)?;
+    let caller = if compiled.access_policies.is_empty() {
+        let (caller_private, caller_public) = keygen::generate_dev_keypair(
+            &keys,
+            CALLER_KEY_ID,
+            "caller-private.jwk",
+            "caller-public.jwk.json",
+        )?;
+        let caller_public = read_owner_json(&caller_public, 16 * 1024)?;
+        write_private_yaml(
+            &clients.join("caller.yaml"),
+            &local_caller_registration(&compiled, caller_public),
+        )?;
+        Some(CallerState {
+            client_id: CALLER_ID.to_owned(),
+            private_key_path: caller_private,
+            assertion_audience: token_url.clone(),
+            evidence_audience: compiled.caller_evidence_audience.clone(),
+            requester_tag: compiled.requester_tag.clone(),
+        })
+    } else {
+        let policy_tags = compiled
+            .access_policies
+            .iter()
+            .map(|policy| (policy.id.clone(), policy.requester_tag.clone()))
+            .collect::<BTreeMap<_, _>>();
+        let registrations = access::load_active_clients(project, &policy_tags)?;
+        if registrations.is_empty() {
+            bail!("explicit access policies require at least one active client");
+        }
+        for registration in registrations {
+            write_private_yaml(
+                &clients.join(format!("{}.yaml", registration.client_id)),
+                &registration.registration,
+            )?;
+        }
+        None
+    };
+    run_check(&mint_bin, &["check", "--config"], &mint_config_path, "Mint")?;
+
+    let state = DevState {
+        schema: STATE_SCHEMA.to_owned(),
+        status: DevStatus::Starting,
+        project: project.to_path_buf(),
+        runtime_path: compiled.runtime_path.clone(),
+        evidence_origin: evidence_origin.clone(),
+        mint_origin: mint_origin.clone(),
+        token_url: token_url.clone(),
+        access_token_audience: compiled.local_audience.clone(),
+        caller,
+        access_policies: compiled
+            .access_policies
+            .iter()
+            .map(AccessPolicyState::from)
+            .collect(),
+        questions: compiled.questions.iter().map(QuestionState::from).collect(),
+        failure: None,
+    };
+    write_new_state(&dev_root.join("state.json"), &state)?;
+
+    let supervisor_log = create_private_file(&logs.join("supervisor.log"))?;
+    let supervisor_error = supervisor_log.try_clone()?;
+    let executable = supervisor_executable()?;
+    let mut supervisor = match Command::new(executable)
+        .arg("__dev-supervisor")
+        .arg("--dev-root")
+        .arg(dev_root)
+        .arg("--evidence-bin")
+        .arg(&evidence_bin)
+        .arg("--mint-bin")
+        .arg(&mint_bin)
+        .arg("--ready-timeout-seconds")
+        .arg(ready_timeout_seconds.to_string())
+        .stdin(Stdio::null())
+        .stdout(Stdio::from(supervisor_log))
+        .stderr(Stdio::from(supervisor_error))
+        .spawn()
+    {
+        Ok(supervisor) => supervisor,
+        Err(error) => {
+            publish_supervisor_failure(dev_root, FailureKind::Supervisor)?;
+            return Err(error).context("failed to start the local supervisor");
+        }
+    };
+
+    if let Err(error) = wait_for_supervisor_ready(dev_root, &mut supervisor, ready_timeout_seconds)
+    {
+        abort_start(&mut supervisor)?;
+        publish_supervisor_failure(dev_root, FailureKind::Supervisor)?;
+        return Err(error);
+    }
+    println!("Evidence ready at {evidence_origin}");
+    println!("Mint ready at {mint_origin}");
+    Ok(ExitCode::SUCCESS)
+}
+
+fn stop_dev(project: &Path) -> Result<ExitCode> {
+    let project = canonical_project(project)?;
+    let generated_root = existing_private_generated_root(&project)?;
+    let _lifecycle = lock_lifecycle(&generated_root)?;
+    let dev_root = generated_root.join("dev");
+    validate_private_directory(&dev_root)?;
+    let state = read_state(&dev_root.join("state.json"))?;
+    if state.project != project || !matches!(state.status, DevStatus::Starting | DevStatus::Ready) {
+        bail!("local development state is not an active session");
+    }
+    let socket = dev_root.join(CONTROL_SOCKET_NAME);
+    validate_control_socket(&socket)?;
+    std::env::set_current_dir(&dev_root)
+        .context("failed to enter the private local development directory")?;
+    let mut stream = UnixStream::connect(CONTROL_SOCKET_NAME)
+        .context("the recorded local supervisor is unavailable; refusing PID-based recovery")?;
+    stream.set_read_timeout(Some(Duration::from_secs(SHUTDOWN_TIMEOUT_SECONDS + 5)))?;
+    stream.write_all(b"stop\n")?;
+    stream.shutdown(std::net::Shutdown::Write)?;
+    let mut response = Vec::new();
+    (&mut stream).take(64).read_to_end(&mut response)?;
+    if response != b"stopped\n" {
+        bail!("the local supervisor did not confirm a clean stop");
+    }
+    let stopped = read_state(&dev_root.join("state.json"))?;
+    if stopped.status != DevStatus::Stopped || stopped.caller.is_some() {
+        bail!("the local supervisor did not publish the closed stopped state");
+    }
+    println!("Local Evidence stopped");
+    Ok(ExitCode::SUCCESS)
+}
+
+fn supervisor_executable() -> Result<PathBuf> {
+    #[cfg(debug_assertions)]
+    if let Some(path) = std::env::var_os("EVIDENCECTL_TEST_SUPERVISOR_BIN") {
+        return Ok(PathBuf::from(path));
+    }
+    std::env::current_exe().context("failed to resolve evidencectl")
+}
+
+fn injected_supervisor_failure(stage: &str) -> Result<()> {
+    #[cfg(debug_assertions)]
+    if std::env::var("EVIDENCECTL_TEST_SUPERVISOR_FAIL_STAGE").as_deref() == Ok(stage) {
+        bail!("injected local supervisor failure at {stage}");
+    }
+    let _ = stage;
+    Ok(())
+}
+
+fn publish_test_supervisor_pid() -> Result<()> {
+    #[cfg(debug_assertions)]
+    if let Some(path) = std::env::var_os("EVIDENCECTL_TEST_SUPERVISOR_PID_FILE") {
+        let path = PathBuf::from(path);
+        let mut file = create_private_file(&path)?;
+        writeln!(file, "{}", std::process::id())?;
+        file.sync_all()?;
+    }
+    Ok(())
+}
+
+fn publish_test_service_pid(name: &str, child: &Child) -> Result<()> {
+    #[cfg(debug_assertions)]
+    if let Some(directory) = std::env::var_os("EVIDENCECTL_TEST_SERVICE_PID_DIRECTORY") {
+        let directory = PathBuf::from(directory);
+        validate_private_directory(&directory)?;
+        let mut file = create_private_file(&directory.join(format!("{name}.pid")))?;
+        writeln!(file, "{}", child.id())?;
+        file.sync_all()?;
+    }
+    let _ = (name, child);
+    Ok(())
+}
+
+fn publish_supervisor_failure(dev_root: &Path, kind: FailureKind) -> Result<()> {
+    let state_path = dev_root.join("state.json");
+    let mut state = read_state(&state_path)?;
+    if !matches!(state.status, DevStatus::Failed | DevStatus::Stopped) {
+        state.status = DevStatus::Failed;
+        state.failure = Some(kind);
+        replace_state(&state_path, &state)?;
+    }
+    let socket = dev_root.join(CONTROL_SOCKET_NAME);
+    match fs::symlink_metadata(&socket) {
+        Ok(_) => remove_control_socket(&socket),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(error) => Err(error.into()),
+    }
+}
+
+fn supervise(args: SupervisorArgs, terminate: &AtomicBool) -> Result<()> {
+    ensure_supervisor_active(terminate)?;
+    validate_private_directory(&args.dev_root)?;
+    let dev_root = fs::canonicalize(&args.dev_root)?;
+    let state_path = dev_root.join("state.json");
+    let mut state = read_state(&state_path)?;
+    if state.status != DevStatus::Starting || state.runtime_path != dev_root.join("runtime.yaml") {
+        bail!("supervisor state is not a fresh compiled local session");
+    }
+    let project = dev_root
+        .parent()
+        .and_then(Path::parent)
+        .ok_or_else(|| anyhow!("local development root is outside a project"))?;
+    validate_closed_state(&state, project, &dev_root)?;
+
+    std::env::set_current_dir(&dev_root)
+        .context("failed to enter the private local development directory")?;
+    let socket_path = dev_root.join(CONTROL_SOCKET_NAME);
+    injected_supervisor_failure("before-socket")?;
+    let listener = UnixListener::bind(CONTROL_SOCKET_NAME)
+        .context("failed to bind the private local control socket")?;
+    fs::set_permissions(&socket_path, fs::Permissions::from_mode(PRIVATE_FILE_MODE))?;
+    validate_control_socket(&socket_path)?;
+    listener.set_nonblocking(true)?;
+    injected_supervisor_failure("after-socket")?;
+
+    let mut children = OwnedChildren::default();
+    children.mint = Some(
+        match spawn_service(
+            &args.mint_bin,
+            &["serve", "--config"],
+            &dev_root.join("generated/mint.yaml"),
+            &dev_root.join("logs/mint.log"),
+        ) {
+            Ok(child) => child,
+            Err(error) => {
+                eprintln!("Mint start failed before child ownership: {error:#}");
+                return fail_before_evidence(&state_path, &mut state, FailureKind::MintStart);
+            }
+        },
+    );
+    publish_test_service_pid(
+        "mint",
+        children.mint.as_ref().expect("Mint child was assigned"),
+    )?;
+    if wait_for_http(
+        &format!("{}/.well-known/jwks.json", state.mint_origin),
+        children.mint.as_mut().expect("Mint child was assigned"),
+        HttpProof::MintKey(MINT_KEY_ID),
+        args.ready_timeout_seconds,
+        terminate,
+    )
+    .is_err()
+    {
+        eprintln!("Mint did not reach its fixed local JWKS readiness proof");
+        return fail_before_evidence(&state_path, &mut state, FailureKind::MintReadiness);
+    }
+
+    children.evidence = Some(
+        match spawn_evidence(
+            &args.evidence_bin,
+            &state.runtime_path,
+            &dev_root.join("logs/evidence.log"),
+        ) {
+            Ok(child) => child,
+            Err(error) => {
+                eprintln!("Evidence start failed: {error:#}");
+                return fail_before_evidence(&state_path, &mut state, FailureKind::EvidenceStart);
+            }
+        },
+    );
+    publish_test_service_pid(
+        "evidence",
+        children
+            .evidence
+            .as_ref()
+            .expect("Evidence child was assigned"),
+    )?;
+    if wait_for_http(
+        &format!("{}/ready", state.evidence_origin),
+        children
+            .evidence
+            .as_mut()
+            .expect("Evidence child was assigned"),
+        HttpProof::EvidenceReady,
+        args.ready_timeout_seconds,
+        terminate,
+    )
+    .is_err()
+    {
+        eprintln!("Evidence did not reach its fixed local readiness proof");
+        return fail_before_evidence(&state_path, &mut state, FailureKind::EvidenceReadiness);
+    }
+
+    state.status = DevStatus::Ready;
+    injected_supervisor_failure("before-ready-state")?;
+    replace_state(&state_path, &state)?;
+    let outcome = supervisor_loop(
+        &listener,
+        children
+            .evidence
+            .as_mut()
+            .expect("Evidence child was assigned"),
+        children.mint.as_mut().expect("Mint child was assigned"),
+        terminate,
+    )
+    .unwrap_or(SupervisorOutcome::Failed(FailureKind::Supervisor));
+    state.status = DevStatus::Stopping;
+    let stopping_state = replace_state(&state_path, &state);
+    children.stop();
+    stopping_state?;
+
+    match outcome {
+        SupervisorOutcome::Stop(mut stream) => {
+            remove_control_socket(&socket_path)?;
+            remove_private_tree(&dev_root.join("generated"))?;
+            remove_private_tree(&dev_root.join("logs"))?;
+            state.status = DevStatus::Stopped;
+            state.caller = None;
+            state.failure = None;
+            replace_state(&state_path, &state)?;
+            stream.write_all(b"stopped\n")?;
+            Ok(())
+        }
+        SupervisorOutcome::Failed(kind) => {
+            remove_control_socket(&socket_path)?;
+            state.status = DevStatus::Failed;
+            state.failure = Some(kind);
+            replace_state(&state_path, &state)
+        }
+    }
+}
+
+fn fail_before_evidence(state_path: &Path, state: &mut DevState, kind: FailureKind) -> Result<()> {
+    state.status = DevStatus::Failed;
+    state.failure = Some(kind);
+    replace_state(state_path, state)
+}
+
+enum SupervisorOutcome {
+    Stop(UnixStream),
+    Failed(FailureKind),
+}
+
+fn supervisor_loop(
+    listener: &UnixListener,
+    evidence: &mut Child,
+    mint: &mut Child,
+    terminate: &AtomicBool,
+) -> Result<SupervisorOutcome> {
+    loop {
+        if terminate.load(Ordering::Relaxed) {
+            return Ok(SupervisorOutcome::Failed(FailureKind::SupervisorSignal));
+        }
+        if evidence.try_wait()?.is_some() || mint.try_wait()?.is_some() {
+            return Ok(SupervisorOutcome::Failed(FailureKind::ChildExited));
+        }
+        match listener.accept() {
+            Ok((mut stream, _)) => {
+                stream.set_read_timeout(Some(Duration::from_secs(2)))?;
+                let mut request = Vec::new();
+                (&mut stream).take(16).read_to_end(&mut request)?;
+                if request == b"stop\n" {
+                    return Ok(SupervisorOutcome::Stop(stream));
+                }
+                if request == b"reload-mint\n" {
+                    signal_child_with(mint, rustix::process::Signal::HUP)?;
+                    stream.write_all(b"reload-requested\n")?;
+                    continue;
+                }
+                let _ = stream.write_all(b"invalid\n");
+            }
+            Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => {
+                thread::sleep(Duration::from_millis(50));
+            }
+            Err(_) => return Ok(SupervisorOutcome::Failed(FailureKind::Supervisor)),
+        }
+    }
+}
+
+fn spawn_service(binary: &Path, prefix: &[&str], value: &Path, log: &Path) -> Result<Child> {
+    let stdout = create_private_file(log)?;
+    let stderr = stdout.try_clone()?;
+    Command::new(binary)
+        .args(prefix)
+        .arg(value)
+        .stdin(Stdio::null())
+        .stdout(Stdio::from(stdout))
+        .stderr(Stdio::from(stderr))
+        .spawn()
+        .with_context(|| format!("failed to start {}", binary.display()))
+}
+
+fn spawn_evidence(binary: &Path, runtime: &Path, log: &Path) -> Result<Child> {
+    let stdout = create_private_file(log)?;
+    let stderr = stdout.try_clone()?;
+    Command::new(binary)
+        .arg("--runtime")
+        .arg(runtime)
+        .arg("serve")
+        .stdin(Stdio::null())
+        .stdout(Stdio::from(stdout))
+        .stderr(Stdio::from(stderr))
+        .spawn()
+        .with_context(|| format!("failed to start {}", binary.display()))
+}
+
+enum HttpProof<'a> {
+    MintKey(&'a str),
+    EvidenceReady,
+}
+
+fn wait_for_http(
+    url: &str,
+    child: &mut Child,
+    proof: HttpProof<'_>,
+    seconds: u64,
+    terminate: &AtomicBool,
+) -> Result<()> {
+    let agent = ureq::AgentBuilder::new()
+        .timeout_connect(Duration::from_millis(250))
+        .timeout_read(Duration::from_secs(2))
+        .timeout_write(Duration::from_millis(500))
+        .redirects(0)
+        .build();
+    let deadline = Instant::now() + Duration::from_secs(seconds);
+    while Instant::now() < deadline {
+        ensure_supervisor_active(terminate)?;
+        if child.try_wait()?.is_some() {
+            bail!("service exited before readiness");
+        }
+        if let Ok(response) = agent.get(url).call() {
+            let mut bytes = Vec::new();
+            response
+                .into_reader()
+                .take(MAX_HTTP_BODY_BYTES + 1)
+                .read_to_end(&mut bytes)?;
+            if bytes.len() as u64 <= MAX_HTTP_BODY_BYTES {
+                let value: Value = serde_json::from_slice(&bytes).unwrap_or(Value::Null);
+                let matches = match proof {
+                    HttpProof::MintKey(kid) => value["keys"]
+                        .as_array()
+                        .is_some_and(|keys| keys.iter().any(|key| key["kid"] == kid)),
+                    HttpProof::EvidenceReady => value == json!({"status": "ready"}),
+                };
+                if matches && child.try_wait()?.is_none() {
+                    return Ok(());
+                }
+            }
+        }
+        thread::sleep(Duration::from_millis(100));
+    }
+    bail!("service readiness timed out")
+}
+
+fn ensure_supervisor_active(terminate: &AtomicBool) -> Result<()> {
+    if terminate.load(Ordering::Relaxed) {
+        bail!("local supervisor received a termination signal");
+    }
+    Ok(())
+}
+
+fn stop_children(evidence: Option<&mut Child>, mint: Option<&mut Child>) {
+    let mut evidence = evidence;
+    let mut mint = mint;
+    if let Some(child) = evidence.as_deref_mut() {
+        let _ = signal_child(child);
+    }
+    if let Some(child) = mint.as_deref_mut() {
+        let _ = signal_child(child);
+    }
+    let deadline = Instant::now() + Duration::from_secs(SHUTDOWN_TIMEOUT_SECONDS);
+    loop {
+        let evidence_done = evidence
+            .as_deref_mut()
+            .is_none_or(|child| child.try_wait().ok().flatten().is_some());
+        let mint_done = mint
+            .as_deref_mut()
+            .is_none_or(|child| child.try_wait().ok().flatten().is_some());
+        if evidence_done && mint_done {
+            return;
+        }
+        if Instant::now() >= deadline {
+            break;
+        }
+        thread::sleep(Duration::from_millis(50));
+    }
+    for child in [evidence, mint].into_iter().flatten() {
+        // A child that ignores TERM is killed only after the bounded graceful
+        // deadline. Child::kill is SIGKILL on Unix and cannot run child cleanup.
+        let _ = child.kill();
+        let _ = child.wait();
+    }
+}
+
+fn signal_child(child: &Child) -> Result<()> {
+    signal_child_with(child, rustix::process::Signal::TERM)
+}
+
+fn signal_child_with(child: &Child, signal: rustix::process::Signal) -> Result<()> {
+    let raw = i32::try_from(child.id()).context("child identifier is not a process id")?;
+    let pid =
+        rustix::process::Pid::from_raw(raw).ok_or_else(|| anyhow!("invalid child process"))?;
+    rustix::process::kill_process(pid, signal)?;
+    Ok(())
+}
+
+fn wait_for_supervisor_ready(dev_root: &Path, child: &mut Child, seconds: u64) -> Result<()> {
+    let deadline = Instant::now() + Duration::from_secs(seconds + 5);
+    loop {
+        let state = read_state(&dev_root.join("state.json"))?;
+        match state.status {
+            DevStatus::Ready => return Ok(()),
+            DevStatus::Failed => {
+                let _ = child.wait();
+                let diagnostic = read_owner_file(&dev_root.join("logs/supervisor.log"), 4096)
+                    .ok()
+                    .and_then(|bytes| String::from_utf8(bytes).ok())
+                    .unwrap_or_default();
+                bail!(
+                    "local services failed during startup ({:?}){}{}",
+                    state.failure,
+                    if diagnostic.is_empty() { "" } else { ": " },
+                    diagnostic.trim()
+                );
+            }
+            DevStatus::Starting if Instant::now() < deadline => {}
+            _ => bail!("local supervisor did not publish readiness"),
+        }
+        if child.try_wait()?.is_some() {
+            bail!("local supervisor exited before readiness");
+        }
+        thread::sleep(Duration::from_millis(50));
+    }
+}
+
+fn abort_start(supervisor: &mut Child) -> Result<()> {
+    if supervisor.try_wait()?.is_some() {
+        return Ok(());
+    }
+    signal_child(supervisor).context("failed to terminate the local supervisor after startup")?;
+    // SIGKILL is deliberately outside this tutorial lifecycle because it
+    // cannot run the supervisor's child cleanup. TERM is bounded by the
+    // supervisor's own child shutdown deadline, and the creating command
+    // waits for that cleanup instead of abandoning the owner process.
+    supervisor.wait()?;
+    Ok(())
+}
+
+fn mint_config(
+    compiled: &CompiledProject,
+    mint_private: &Path,
+    mint_audit_key: &Path,
+    ports: LocalServicePorts,
+) -> Value {
+    let mint_origin = ports.mint_origin();
+    let token_url = format!("{mint_origin}/token");
+    json!({
+        "version": 1,
+        "validationMode": "supervised-local-development",
+        "issuer": mint_origin,
+        "listener": {
+            "address": "127.0.0.1",
+            "port": ports.mint,
+            "maximumRequestBytes": 16384,
+            "requestTimeoutMilliseconds": 5000,
+        },
+        "signing": {
+            "algorithm": "EdDSA",
+            "activeKeyId": MINT_KEY_ID,
+            "activeKeyFile": mint_private,
+            "retiredPublicJwkFiles": [],
+            "jwksPath": "/.well-known/jwks.json",
+        },
+        "audit": {
+            "path": "audit/mint.jsonl",
+            // Mint rotates a sealed segment at this threshold. A local
+            // tutorial session never reaches it, and the value matches the
+            // documented deployment example.
+            "maximumFileBytes": 1_073_741_824u64,
+            "hashKeyFile": mint_audit_key,
+            "hashKeyVersion": 1,
+        },
+        "accessTokens": {
+            "audiences": [compiled.local_audience],
+            "lifetimeSeconds": 300,
+            "claims": {
+                "principal": "sub",
+                "requesterTags": "evidence_tags",
+                "evidenceAudience": "evidence_audience",
+                "grantId": "evidence_grant_id",
+                "grantAuthority": "evidence_authority",
+            },
+        },
+        "clientAssertion": {
+            "audience": token_url,
+            "maximumLifetimeSeconds": 120,
+            "algorithms": ["EdDSA"],
+            "replayCacheEntries": 256,
+        },
+        "clients": {"directory": "clients"},
+    })
+}
+
+fn generate_mint_audit_key(path: &Path) -> Result<()> {
+    let mut entropy = Zeroizing::new([0_u8; 32]);
+    getrandom::fill(entropy.as_mut_slice())
+        .context("failed to generate local Mint audit key material")?;
+    let key = Zeroizing::new(URL_SAFE_NO_PAD.encode(entropy.as_slice()));
+    let mut file = create_private_file(path)?;
+    file.write_all(key.as_bytes())?;
+    file.sync_all()?;
+    Ok(())
+}
+
+fn local_caller_registration(compiled: &CompiledProject, caller_public: Value) -> Value {
+    json!({
+        "clientId": CALLER_ID,
+        "principal": "urn:registrystack:evidence:local:caller",
+        "evidenceAudience": compiled.caller_evidence_audience,
+        "requesterTags": [compiled.requester_tag],
+        "keys": [caller_public],
+    })
+}
+
+impl From<&CompiledAccessPolicy> for AccessPolicyState {
+    fn from(compiled: &CompiledAccessPolicy) -> Self {
+        Self {
+            id: compiled.id.clone(),
+            requester_tag: compiled.requester_tag.clone(),
+            questions: compiled.questions.clone(),
+        }
+    }
+}
+
+impl From<&CompiledQuestion> for QuestionState {
+    fn from(compiled: &CompiledQuestion) -> Self {
+        Self {
+            alias: compiled.question_alias.clone(),
+            requirement_uri: compiled.requirement_uri.clone(),
+            purpose: compiled.purpose.clone(),
+            subjects: compiled
+                .subjects
+                .iter()
+                .map(|subject| SubjectState {
+                    role: subject.role.clone(),
+                    selector_profile: subject.selector_profile.clone(),
+                    selector_field: subject.selector_field.clone(),
+                })
+                .collect(),
+            concepts: compiled
+                .concepts
+                .iter()
+                .map(|concept| ConceptState {
+                    alias: concept.concept_alias.clone(),
+                    uri: concept.concept_uri.clone(),
+                    form: match concept.concept_form {
+                        CompiledConceptForm::Boolean => "boolean".to_owned(),
+                        CompiledConceptForm::ControlledCategory => "controlled-category".to_owned(),
+                        CompiledConceptForm::BoundedInteger => "bounded-integer".to_owned(),
+                        CompiledConceptForm::Structured => "reviewed-structured-value".to_owned(),
+                    },
+                })
+                .collect(),
+        }
+    }
+}
+
+fn run_check(binary: &Path, prefix: &[&str], config: &Path, name: &str) -> Result<()> {
+    let status = Command::new(binary)
+        .args(prefix)
+        .arg(config)
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .status()
+        .with_context(|| format!("failed to run {name} check"))?;
+    if !status.success() {
+        bail!("{name} rejected the generated local configuration");
+    }
+    Ok(())
+}
+
+#[allow(dead_code)] // Shared by the immediately following request and audit slices.
+pub(crate) fn resolve_tool_binary(
+    name: &str,
+    explicit: Option<&Path>,
+    test_env: &str,
+) -> Result<PathBuf> {
+    if let Some(path) = explicit {
+        return Ok(path.to_path_buf());
+    }
+    let current = std::env::current_exe().context("failed to resolve evidencectl")?;
+    if let Some(sibling) = current.parent().map(|parent| parent.join(name)) {
+        if sibling.is_file() {
+            return Ok(sibling);
+        }
+    }
+    if let Some(path) = std::env::var_os(test_env) {
+        return Ok(PathBuf::from(path));
+    }
+    Ok(PathBuf::from(name))
+}
+
+fn canonical_tool_binary(path: PathBuf) -> Result<PathBuf> {
+    fs::canonicalize(&path)
+        .with_context(|| format!("failed to resolve tool binary {}", path.display()))
+}
+
+fn canonical_project(path: &Path) -> Result<PathBuf> {
+    let canonical = fs::canonicalize(path)
+        .with_context(|| format!("project {} is unavailable", path.display()))?;
+    let metadata = fs::symlink_metadata(&canonical)?;
+    if !metadata.is_dir() || metadata.file_type().is_symlink() {
+        bail!("project is not a real directory");
+    }
+    require_owner(&metadata, "project directory")?;
+    Ok(canonical)
+}
+
+fn ensure_private_generated_root(project: &Path) -> Result<PathBuf> {
+    let root = project.join(".evidence");
+    match fs::symlink_metadata(&root) {
+        Ok(metadata) => validate_private_directory_metadata(&root, &metadata)?,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+            create_private_directory(&root)?;
+        }
+        Err(error) => return Err(error.into()),
+    }
+    Ok(root)
+}
+
+fn existing_private_generated_root(project: &Path) -> Result<PathBuf> {
+    let root = project.join(".evidence");
+    validate_private_directory(&root)?;
+    Ok(root)
+}
+
+fn create_private_directory(path: &Path) -> Result<()> {
+    let mut builder = fs::DirBuilder::new();
+    builder.mode(PRIVATE_DIR_MODE);
+    builder
+        .create(path)
+        .with_context(|| format!("failed to create private directory {}", path.display()))?;
+    validate_private_directory(path)
+}
+
+fn validate_private_directory(path: &Path) -> Result<()> {
+    let metadata = fs::symlink_metadata(path)
+        .with_context(|| format!("failed to inspect private directory {}", path.display()))?;
+    validate_private_directory_metadata(path, &metadata)
+}
+
+fn validate_private_directory_metadata(path: &Path, metadata: &Metadata) -> Result<()> {
+    if metadata.file_type().is_symlink() || !metadata.is_dir() {
+        bail!("private state {} is not a real directory", path.display());
+    }
+    require_owner(metadata, "private directory")?;
+    if metadata.mode() & 0o777 != PRIVATE_DIR_MODE {
+        bail!("private state {} must have mode 0700", path.display());
+    }
+    Ok(())
+}
+
+fn lock_lifecycle(root: &Path) -> Result<LifecycleLock> {
+    let path = root.join("lifecycle.lock");
+    let file = match create_private_rw_file(&path) {
+        Ok(file) => file,
+        Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => open_owner_rw(&path)?,
+        Err(error) => return Err(error.into()),
+    };
+    require_owner_file(&path)?;
+    rustix::fs::flock(&file, rustix::fs::FlockOperation::NonBlockingLockExclusive)
+        .context("another local lifecycle operation is already active")?;
+    Ok(LifecycleLock { _file: file })
+}
+
+#[allow(dead_code)] // Consumed by the access-management CLI slice.
+pub(crate) fn lock_project_lifecycle(project: &Path) -> Result<LifecycleLock> {
+    let project = canonical_project(project)?;
+    let generated_root = ensure_private_generated_root(&project)?;
+    lock_lifecycle(&generated_root)
+}
+
+fn create_private_rw_file(path: &Path) -> std::io::Result<File> {
+    OpenOptions::new()
+        .read(true)
+        .write(true)
+        .create_new(true)
+        .mode(PRIVATE_FILE_MODE)
+        .open(path)
+}
+
+fn open_owner_rw(path: &Path) -> Result<File> {
+    require_owner_file(path)?;
+    let fd = rustix::fs::open(
+        path,
+        rustix::fs::OFlags::RDWR | rustix::fs::OFlags::NOFOLLOW | rustix::fs::OFlags::CLOEXEC,
+        rustix::fs::Mode::empty(),
+    )?;
+    let file = File::from(fd);
+    require_owner_metadata(&file.metadata()?, "lifecycle lock")?;
+    Ok(file)
+}
+
+fn require_owner_file(path: &Path) -> Result<Metadata> {
+    let metadata = fs::symlink_metadata(path)?;
+    if metadata.file_type().is_symlink() || !metadata.is_file() || metadata.nlink() != 1 {
+        bail!("owner-only state is not a single-link regular file");
+    }
+    require_owner_metadata(&metadata, "owner-only state")?;
+    Ok(metadata)
+}
+
+#[allow(dead_code)]
+fn require_owned_regular_file(path: &Path, mode: u32) -> Result<()> {
+    let metadata = fs::symlink_metadata(path)?;
+    if metadata.file_type().is_symlink() || !metadata.is_file() || metadata.nlink() != 1 {
+        bail!("ready session path is not a single-link regular file");
+    }
+    require_owner(&metadata, "ready session file")?;
+    if metadata.mode() & 0o777 != mode {
+        bail!("ready session file has the wrong private mode");
+    }
+    Ok(())
+}
+
+fn require_owner_metadata(metadata: &Metadata, label: &str) -> Result<()> {
+    require_owner(metadata, label)?;
+    if metadata.mode() & 0o777 != PRIVATE_FILE_MODE {
+        bail!("{label} must have mode 0600");
+    }
+    Ok(())
+}
+
+fn require_owner(metadata: &Metadata, label: &str) -> Result<()> {
+    if metadata.uid() != rustix::process::getuid().as_raw() {
+        bail!("{label} is not owned by the current user");
+    }
+    Ok(())
+}
+
+fn create_private_file(path: &Path) -> Result<File> {
+    let file = OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(PRIVATE_FILE_MODE)
+        .open(path)
+        .with_context(|| format!("failed to create {}", path.display()))?;
+    require_owner_file(path)?;
+    Ok(file)
+}
+
+fn write_private_yaml(path: &Path, value: &Value) -> Result<()> {
+    let mut text = serde_norway::to_string(value)?;
+    if !text.ends_with('\n') {
+        text.push('\n');
+    }
+    let mut file = create_private_file(path)?;
+    file.write_all(text.as_bytes())?;
+    file.sync_all()?;
+    Ok(())
+}
+
+fn read_owner_json(path: &Path, maximum: u64) -> Result<Value> {
+    let bytes = read_owner_file(path, maximum)?;
+    serde_json::from_slice(&bytes).context("owner-only JSON is invalid")
+}
+
+fn read_owner_file(path: &Path, maximum: u64) -> Result<Vec<u8>> {
+    let before = require_owner_file(path)?;
+    if before.len() > maximum {
+        bail!("owner-only state exceeds its size bound");
+    }
+    let fd = rustix::fs::open(
+        path,
+        rustix::fs::OFlags::RDONLY | rustix::fs::OFlags::NOFOLLOW,
+        rustix::fs::Mode::empty(),
+    )?;
+    let mut file = File::from(fd);
+    let opened = file.metadata()?;
+    if before.dev() != opened.dev() || before.ino() != opened.ino() {
+        bail!("owner-only state changed while opening");
+    }
+    let mut bytes = Vec::new();
+    (&mut file).take(maximum + 1).read_to_end(&mut bytes)?;
+    if bytes.len() as u64 > maximum {
+        bail!("owner-only state exceeds its size bound");
+    }
+    Ok(bytes)
+}
+
+fn write_new_state(path: &Path, state: &DevState) -> Result<()> {
+    let bytes = serde_json::to_vec(state)?;
+    let mut file = create_private_file(path)?;
+    file.write_all(&bytes)?;
+    file.sync_all()?;
+    Ok(())
+}
+
+fn replace_state(path: &Path, state: &DevState) -> Result<()> {
+    require_owner_file(path)?;
+    let parent = path
+        .parent()
+        .ok_or_else(|| anyhow!("state has no parent"))?;
+    validate_private_directory(parent)?;
+    let mut random = [0_u8; 9];
+    getrandom::fill(&mut random)?;
+    let temporary = parent.join(format!(".state-{}", URL_SAFE_NO_PAD.encode(random)));
+    write_new_state(&temporary, state)?;
+    fs::rename(&temporary, path)?;
+    Ok(())
+}
+
+fn read_state(path: &Path) -> Result<DevState> {
+    let bytes = read_owner_file(path, MAX_STATE_BYTES)?;
+    let state: DevState = serde_json::from_slice(&bytes).context("local state is invalid")?;
+    if state.schema != STATE_SCHEMA {
+        bail!("local state schema is unsupported");
+    }
+    Ok(state)
+}
+
+fn validate_control_socket(path: &Path) -> Result<()> {
+    let metadata = fs::symlink_metadata(path)?;
+    if metadata.file_type().is_symlink() || !metadata.file_type().is_socket() {
+        bail!("local control path is not a Unix socket");
+    }
+    require_owner_metadata(&metadata, "local control socket")
+}
+
+fn remove_control_socket(path: &Path) -> Result<()> {
+    validate_control_socket(path)?;
+    fs::remove_file(path)?;
+    Ok(())
+}
+
+fn remove_private_tree(path: &Path) -> Result<()> {
+    validate_private_directory(path)?;
+    fs::remove_dir_all(path).with_context(|| format!("failed to remove {}", path.display()))
+}
+
+fn cleanup_new_dev_root(dev_root: &Path) -> Result<()> {
+    validate_private_directory(dev_root)?;
+    let socket = dev_root.join("control.sock");
+    match fs::symlink_metadata(&socket) {
+        Ok(_) => remove_control_socket(&socket)?,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+        Err(error) => return Err(error.into()),
+    }
+    make_tree_removable(dev_root)?;
+    fs::remove_dir_all(dev_root).context("failed to clean incomplete local development state")
+}
+
+fn make_tree_removable(root: &Path) -> Result<()> {
+    for entry in fs::read_dir(root)? {
+        let path = entry?.path();
+        let metadata = fs::symlink_metadata(&path)?;
+        require_owner(&metadata, "incomplete local state")?;
+        if metadata.file_type().is_symlink() {
+            bail!("incomplete local state contains a symlink");
+        }
+        if metadata.is_dir() {
+            make_tree_removable(&path)?;
+            fs::set_permissions(&path, fs::Permissions::from_mode(PRIVATE_DIR_MODE))?;
+        } else if metadata.is_file() {
+            fs::set_permissions(&path, fs::Permissions::from_mode(PRIVATE_FILE_MODE))?;
+        } else {
+            bail!("incomplete local state contains an unexpected entry");
+        }
+    }
+    fs::set_permissions(root, fs::Permissions::from_mode(PRIVATE_DIR_MODE))?;
+    Ok(())
+}
+
+fn ready_question(question: QuestionState) -> ReadyQuestionState {
+    ReadyQuestionState {
+        alias: question.alias,
+        requirement_uri: question.requirement_uri,
+        purpose: question.purpose,
+        subjects: question
+            .subjects
+            .into_iter()
+            .map(|subject| ReadySubjectState {
+                role: subject.role,
+                selector_profile: subject.selector_profile,
+                selector_field: subject.selector_field,
+            })
+            .collect(),
+        concepts: question
+            .concepts
+            .into_iter()
+            .map(|concept| ReadyConceptState {
+                alias: concept.alias,
+                uri: concept.uri,
+                form: concept.form,
+            })
+            .collect(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn compiled(runtime: &Path) -> CompiledProject {
+        CompiledProject {
+            runtime_path: runtime.to_path_buf(),
+            questions: vec![CompiledQuestion {
+                question_alias: "adult-status".to_owned(),
+                requirement_uri: "urn:registrystack:evidence:local:requirement:adult-status"
+                    .to_owned(),
+                purpose: "age-check".to_owned(),
+                subjects: vec![crate::authoring::CompiledSubject {
+                    role: "person".to_owned(),
+                    selector_profile: "local-subject-adult-status-v1".to_owned(),
+                    selector_field: "person_id".to_owned(),
+                }],
+                concepts: vec![crate::authoring::CompiledConcept {
+                    concept_alias: "is_adult".to_owned(),
+                    concept_uri: "urn:registrystack:evidence:local:concept:adult-status:is_adult"
+                        .to_owned(),
+                    concept_form: CompiledConceptForm::Boolean,
+                }],
+            }],
+            local_audience: "registry-evidence-local".to_owned(),
+            requester_tag: "local-caller".to_owned(),
+            caller_evidence_audience: LOCAL_CALLER_EVIDENCE_AUDIENCE.to_owned(),
+            access_policies: Vec::new(),
+        }
+    }
+
+    #[test]
+    fn mint_documents_are_closed_and_derive_authority_from_the_compiler() {
+        let compiled = compiled(Path::new("/private/runtime.yaml"));
+        let config = mint_config(
+            &compiled,
+            Path::new("/private/mint-private.jwk"),
+            Path::new("/private/mint-audit-hmac-key"),
+            LocalServicePorts::default(),
+        );
+        let caller = local_caller_registration(
+            &compiled,
+            json!({"kty":"OKP","crv":"Ed25519","kid":"caller","alg":"EdDSA","x":"public"}),
+        );
+        assert_eq!(config["validationMode"], "supervised-local-development");
+        assert_eq!(config["issuer"], "http://127.0.0.1:8081");
+        assert_eq!(
+            config["listener"],
+            json!({
+                "address": "127.0.0.1", "port": 8081,
+                "maximumRequestBytes": 16384, "requestTimeoutMilliseconds": 5000
+            })
+        );
+        assert_eq!(
+            config["accessTokens"]["audiences"],
+            json!([compiled.local_audience])
+        );
+        assert_eq!(
+            config["audit"],
+            json!({
+                "path": "audit/mint.jsonl",
+                "maximumFileBytes": 1_073_741_824u64,
+                "hashKeyFile": "/private/mint-audit-hmac-key",
+                "hashKeyVersion": 1,
+            })
+        );
+        assert_eq!(caller["requesterTags"], json!([compiled.requester_tag]));
+        assert_eq!(
+            caller["evidenceAudience"],
+            compiled.caller_evidence_audience
+        );
+        assert!(caller.to_string().find("private").is_none());
+    }
+
+    #[test]
+    fn structured_concepts_use_the_runtime_value_form_in_lifecycle_state() {
+        let mut compiled = compiled(Path::new("/private/runtime.yaml"));
+        compiled.questions[0].concepts[0].concept_form = CompiledConceptForm::Structured;
+
+        let state = QuestionState::from(&compiled.questions[0]);
+
+        assert_eq!(state.concepts[0].form, "reviewed-structured-value");
+        assert!(valid_question_state(&state));
+    }
+
+    #[test]
+    fn private_state_rejects_public_directories_files_and_symlinks() {
+        let root = tempfile::tempdir().expect("tempdir");
+        let public = root.path().join("public");
+        fs::create_dir(&public).expect("directory");
+        fs::set_permissions(&public, fs::Permissions::from_mode(0o755)).expect("mode");
+        assert!(validate_private_directory(&public).is_err());
+
+        let private = root.path().join("private");
+        create_private_directory(&private).expect("private directory");
+        let state = private.join("state.json");
+        fs::write(&state, b"{}").expect("state");
+        fs::set_permissions(&state, fs::Permissions::from_mode(0o644)).expect("mode");
+        assert!(read_state(&state).is_err());
+
+        let link = root.path().join("link");
+        symlink(&private, &link).expect("symlink");
+        assert!(validate_private_directory(&link).is_err());
+    }
+
+    #[test]
+    fn ready_and_stopped_handoffs_validate_the_closed_lifecycle_state() {
+        let temporary = tempfile::tempdir().expect("tempdir");
+        let project = temporary.path().join("project");
+        fs::create_dir(&project).expect("project");
+        let project = fs::canonicalize(project).expect("canonical project");
+        let generated = project.join(".evidence");
+        create_private_directory(&generated).expect("generated root");
+        let dev = generated.join("dev");
+        create_private_directory(&dev).expect("dev root");
+        create_private_directory(&dev.join("generated")).expect("generated");
+        create_private_directory(&dev.join("generated/keys")).expect("keys");
+
+        let runtime = dev.join("runtime.yaml");
+        drop(create_private_file(&runtime).expect("runtime"));
+        fs::set_permissions(&runtime, fs::Permissions::from_mode(0o400)).expect("seal runtime");
+        let caller_key = dev.join("generated/keys/caller-private.jwk");
+        drop(create_private_file(&caller_key).expect("caller key"));
+        let socket = dev.join("control.sock");
+        let listener = UnixListener::bind(&socket).expect("control socket");
+        fs::set_permissions(&socket, fs::Permissions::from_mode(0o600)).expect("socket mode");
+
+        let compiled = compiled(&runtime);
+        let bundle = dev.join("bundle");
+        create_private_directory(&bundle).expect("bundle");
+        let bundle_path = bundle.join("evidence.yaml");
+        fs::write(
+            &bundle_path,
+            br#"selectorProfiles:
+  local-subject-adult-status-v1:
+    fields:
+      person_id: {type: string}
+authorityProfiles:
+  local-caller:
+    kind: explicit-request
+    requesterTags: [local-caller]
+    grants:
+      - requirement: urn:registrystack:evidence:local:requirement:adult-status
+        purpose: age-check
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects:
+          - role: person
+            selectorProfile: local-subject-adult-status-v1
+            valueOrigin: request
+requirements:
+  - id: urn:registrystack:evidence:local:requirement:adult-status
+    purposes: [age-check]
+    subjectRoles:
+      - role: person
+        selectorProfiles: [local-subject-adult-status-v1]
+    concepts:
+      - id: urn:registrystack:evidence:local:concept:adult-status:is_adult
+        form: boolean
+"#,
+        )
+        .expect("bundle config");
+        fs::set_permissions(&bundle_path, fs::Permissions::from_mode(0o400))
+            .expect("seal bundle config");
+        fs::set_permissions(&bundle, fs::Permissions::from_mode(0o500)).expect("seal bundle");
+        let mut state = DevState {
+            schema: STATE_SCHEMA.to_owned(),
+            status: DevStatus::Ready,
+            project: project.clone(),
+            runtime_path: runtime.clone(),
+            evidence_origin: local_origin(8080),
+            mint_origin: local_origin(8081),
+            token_url: format!("{}/token", local_origin(8081)),
+            access_token_audience: compiled.local_audience.clone(),
+            caller: Some(CallerState {
+                client_id: CALLER_ID.to_owned(),
+                private_key_path: caller_key,
+                assertion_audience: format!("{}/token", local_origin(8081)),
+                evidence_audience: compiled.caller_evidence_audience.clone(),
+                requester_tag: compiled.requester_tag.clone(),
+            }),
+            access_policies: Vec::new(),
+            questions: compiled.questions.iter().map(QuestionState::from).collect(),
+            failure: None,
+        };
+        write_new_state(&dev.join("state.json"), &state).expect("ready state");
+        let ready = load_ready_state(&project).expect("ready handoff");
+        assert_eq!(ready.runtime_path, runtime);
+        assert_eq!(ready.questions[0].alias, "adult-status");
+        assert!(ready.caller.is_some());
+        assert!(ready.access_policies.is_empty());
+        assert!(
+            clean_dev(&project).is_err(),
+            "active state is never removed"
+        );
+        assert!(dev.is_dir(), "refused cleanup preserves active state");
+
+        let valid_ready = state.clone();
+        state.access_token_audience = "tampered-audience".to_owned();
+        replace_state(&dev.join("state.json"), &state).expect("tampered state");
+        assert!(load_ready_state(&project).is_err());
+        state = valid_ready.clone();
+        state.questions[0].requirement_uri = "urn:tampered".to_owned();
+        replace_state(&dev.join("state.json"), &state).expect("tampered canonical value");
+        assert!(load_ready_state(&project).is_err());
+        state = valid_ready.clone();
+        state.questions[0].concepts[0].uri = "urn:tampered".to_owned();
+        replace_state(&dev.join("state.json"), &state).expect("tampered concept");
+        assert!(load_ready_state(&project).is_err());
+        state = valid_ready;
+        replace_state(&dev.join("state.json"), &state).expect("restore ready state");
+
+        let policy_questions = vec!["adult-status".to_owned()];
+        let policy_tag =
+            access_policy_requester_tag("age-checks", &policy_questions).expect("policy tag");
+        let mut explicit_bundle: Value =
+            serde_norway::from_slice(&fs::read(&bundle_path).expect("read implicit bundle"))
+                .expect("parse implicit bundle");
+        explicit_bundle["authorityProfiles"] = Value::Object(serde_json::Map::from_iter([(
+            policy_tag.clone(),
+            json!({
+                "kind": "explicit-request",
+                "requesterTags": [policy_tag],
+                "grants": [{
+                    "requirement": "urn:registrystack:evidence:local:requirement:adult-status",
+                    "purpose": "age-check",
+                    "audienceFrom": "authenticated-requester",
+                    "responseFormats": ["signed-jws"],
+                    "subjects": [{
+                        "role": "person",
+                        "selectorProfile": "local-subject-adult-status-v1",
+                        "valueOrigin": "request",
+                    }],
+                }],
+            }),
+        )]));
+        fs::set_permissions(&bundle_path, fs::Permissions::from_mode(PRIVATE_FILE_MODE))
+            .expect("unseal bundle config for test update");
+        fs::write(
+            &bundle_path,
+            serde_norway::to_string(&explicit_bundle).expect("explicit bundle YAML"),
+        )
+        .expect("write explicit bundle");
+        fs::set_permissions(&bundle_path, fs::Permissions::from_mode(0o400))
+            .expect("reseal bundle config");
+        state.caller = None;
+        state.access_policies = vec![AccessPolicyState {
+            id: "age-checks".to_owned(),
+            requester_tag: policy_tag.clone(),
+            questions: policy_questions,
+        }];
+        replace_state(&dev.join("state.json"), &state).expect("explicit policy state");
+        let explicit = load_ready_state(&project).expect("explicit ready handoff");
+        assert!(explicit.caller.is_none());
+        assert_eq!(explicit.access_policies[0].requester_tag, policy_tag);
+        assert!(try_load_ready_state(&project)
+            .expect("optional ready handoff")
+            .is_some());
+        let valid_explicit = state.clone();
+        state.access_policies[0].id = "other-age-checks".to_owned();
+        state.access_policies[0].requester_tag = access_policy_requester_tag(
+            &state.access_policies[0].id,
+            &state.access_policies[0].questions,
+        )
+        .expect("internally valid but unsealed policy tag");
+        replace_state(&dev.join("state.json"), &state).expect("unsealed policy state");
+        assert!(load_ready_state(&project).is_err());
+        state = valid_explicit.clone();
+        state.access_policies[0].requester_tag = "policy-v1-tampered".to_owned();
+        replace_state(&dev.join("state.json"), &state).expect("tampered policy state");
+        assert!(load_ready_state(&project).is_err());
+        state = valid_explicit;
+        replace_state(&dev.join("state.json"), &state).expect("restore explicit state");
+
+        drop(listener);
+        remove_control_socket(&socket).expect("remove socket");
+        remove_private_tree(&dev.join("generated")).expect("remove generated");
+        state.status = DevStatus::Stopped;
+        state.caller = None;
+        replace_state(&dev.join("state.json"), &state).expect("stopped state");
+        let stopped = load_stopped_state(&project).expect("stopped handoff");
+        assert!(try_load_ready_state(&project)
+            .expect("stopped optional handoff")
+            .is_none());
+        assert_eq!(stopped.runtime_path, runtime);
+        assert_eq!(stopped.questions[0].concepts[0].alias, "is_adult");
+
+        clean_dev(&project).expect("clean stopped session");
+        assert!(!dev.exists());
+    }
+
+    #[test]
+    fn lifecycle_lock_is_nonblocking_and_owner_only() {
+        let temporary = tempfile::tempdir().expect("tempdir");
+        let root = temporary.path().join("generated");
+        create_private_directory(&root).expect("root");
+        let _held = lock_lifecycle(&root).expect("first lock");
+        assert!(lock_lifecycle(&root).is_err(), "second operation must fail");
+        require_owner_file(&root.join("lifecycle.lock")).expect("private sentinel");
+    }
+
+    #[test]
+    fn supervisor_reload_control_signals_only_mint_and_keeps_serving() {
+        let temporary = tempfile::tempdir().expect("tempdir");
+        let socket = temporary.path().join("control.sock");
+        let listener = UnixListener::bind(&socket).expect("control listener");
+        listener
+            .set_nonblocking(true)
+            .expect("nonblocking listener");
+
+        let mint_script = temporary.path().join("mint-child");
+        let mint_ready = temporary.path().join("mint-ready");
+        fs::write(
+            &mint_script,
+            "#!/bin/sh\ntrap ':' HUP\nprintf ready > \"$MINT_READY\"\nwhile :; do sleep 1; done\n",
+        )
+        .expect("mint script");
+        fs::set_permissions(&mint_script, fs::Permissions::from_mode(0o700)).expect("script mode");
+        let mut mint = Command::new(&mint_script)
+            .env("MINT_READY", &mint_ready)
+            .spawn()
+            .expect("mint child");
+        let mut evidence = Command::new("/bin/sleep")
+            .arg("30")
+            .spawn()
+            .expect("evidence child");
+        let deadline = Instant::now() + Duration::from_secs(10);
+        while !mint_ready.is_file() {
+            if let Some(status) = mint.try_wait().expect("mint child status") {
+                panic!("mint child exited before installing its HUP handler: {status}");
+            }
+            assert!(
+                Instant::now() < deadline,
+                "mint child did not install its HUP handler within 10 seconds"
+            );
+            thread::sleep(Duration::from_millis(10));
+        }
+
+        let client_socket = socket.clone();
+        let client = thread::spawn(move || {
+            send_control_request(&client_socket, b"reload-mint\n", b"reload-requested\n")
+                .expect("reload response");
+            send_control_request(&client_socket, b"stop\n", b"stopped\n").expect("stop response");
+        });
+        let outcome = supervisor_loop(&listener, &mut evidence, &mut mint, &AtomicBool::new(false))
+            .expect("supervisor loop");
+        match outcome {
+            SupervisorOutcome::Stop(mut stream) => {
+                stream.write_all(b"stopped\n").expect("stop confirmation");
+            }
+            SupervisorOutcome::Failed(kind) => panic!("unexpected supervisor failure: {kind:?}"),
+        }
+        client.join().expect("control client");
+        assert!(evidence.try_wait().expect("evidence status").is_none());
+        assert!(mint.try_wait().expect("mint status").is_none());
+        signal_child(&evidence).expect("stop evidence");
+        signal_child(&mint).expect("stop mint");
+        evidence.wait().expect("wait evidence");
+        mint.wait().expect("wait mint");
+    }
+
+    #[test]
+    fn control_requests_bridge_paths_longer_than_sockaddr_un() {
+        let temporary = tempfile::tempdir().expect("tempdir");
+        let short = temporary.path().join("short");
+        fs::create_dir(&short).expect("short directory");
+        let socket = short.join(CONTROL_SOCKET_NAME);
+        let listener = UnixListener::bind(&socket).expect("listener");
+
+        let mut long_parent = temporary.path().join("long");
+        fs::create_dir(&long_parent).expect("long root");
+        for _ in 0..6 {
+            long_parent = long_parent.join("component-with-a-deliberately-long-name");
+            fs::create_dir(&long_parent).expect("long component");
+        }
+        let alias = long_parent.join("target");
+        symlink(&short, &alias).expect("short target alias");
+        let long_socket = alias.join(CONTROL_SOCKET_NAME);
+        assert!(long_socket.as_os_str().as_encoded_bytes().len() > 104);
+        assert!(UnixStream::connect(&long_socket).is_err());
+
+        let server = thread::spawn(move || {
+            let (mut stream, _) = listener.accept().expect("accept");
+            let mut request = Vec::new();
+            (&mut stream)
+                .take(16)
+                .read_to_end(&mut request)
+                .expect("request");
+            assert_eq!(request, b"reload-mint\n");
+            stream.write_all(b"reload-requested\n").expect("response");
+        });
+        send_control_request(&long_socket, b"reload-mint\n", b"reload-requested\n")
+            .expect("long control path");
+        server.join().expect("server");
+    }
+}
diff --git a/crates/registry-evidencectl/src/doctor.rs b/crates/registry-evidencectl/src/doctor.rs
new file mode 100644
index 000000000..d568d0c39
--- /dev/null
+++ b/crates/registry-evidencectl/src/doctor.rs
@@ -0,0 +1,753 @@
+//! Deployment-project mode walk.
+//!
+//! Evidence refuses, at startup, any deployment artifact whose permissions or
+//! ownership are wrong: a bundle it could write to, a secret readable past its
+//! owner, an audit chain another user could edit. Each refusal is correct and
+//! each names one artifact, so an operator who has just run `chmod -R` over a
+//! project discovers them one restart at a time.
+//!
+//! This walks the whole project and reports every artifact that would be
+//! refused, in one pass, without starting anything. It re-states the runtime's
+//! rules rather than deciding anything of its own: it makes no Evidence
+//! semantic decision, needs no `evidence` binary, and is advisory. What the
+//! runtime accepts at startup remains the only authority.
+//!
+//! Two caveats belong to the operator rather than to the code. Ownership is
+//! compared against the user running this check, which is not necessarily the
+//! user the service runs as. And a project on a read-only mount satisfies the
+//! immutability rule whatever its modes say, which this mirrors.
+//!
+//! An explicitly paired Mint configuration adds a separate, mechanical check
+//! of the access-token fields both products share. It does not discover Mint,
+//! validate either product, read a client registry or key, or make an
+//! authorization decision. The product `check` commands remain authoritative.
+
+use std::{
+    collections::BTreeSet,
+    fs::{self, Metadata},
+    os::unix::fs::{MetadataExt as _, PermissionsExt as _},
+    path::{Path, PathBuf},
+    process::ExitCode,
+};
+
+use anyhow::{anyhow, bail, Context, Result};
+use clap::Args;
+use serde::{Deserialize, Serialize};
+use serde_norway::Value as YamlValue;
+
+/// How a bundle names a secret the file provider resolves.
+const SECRET_REFERENCE_PREFIX: &str = "secret:file/";
+
+/// The JWT `typ` Registry Mint writes on access tokens.
+const MINT_ACCESS_TOKEN_TYPE: &str = "at+jwt";
+
+/// Registry Mint's default public-key route when `signing.jwksPath` is omitted.
+const DEFAULT_MINT_JWKS_PATH: &str = "/.well-known/jwks.json";
+
+#[derive(Debug, Args)]
+pub struct DoctorArgs {
+    /// Deployment project directory containing runtime.yaml and bundle/.
+    #[arg(long)]
+    pub project: PathBuf,
+
+    /// Mechanically compare this Mint configuration with Evidence authentication.
+    #[arg(long, value_name = "PATH")]
+    pub mint_config: Option<PathBuf>,
+
+    /// Emit one machine-readable JSON report on standard output.
+    #[arg(long)]
+    pub json: bool,
+}
+
+/// One artifact this walk refuses, and why.
+#[derive(Debug, Serialize)]
+struct Finding {
+    path: String,
+    problem: String,
+}
+
+/// One group of artifacts governed by a single runtime rule.
+#[derive(Debug, Serialize)]
+struct Check {
+    name: &'static str,
+    passed: bool,
+    inspected: usize,
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    findings: Vec<Finding>,
+}
+
+#[derive(Debug, Serialize)]
+struct DoctorReport {
+    checks: Vec<Check>,
+    passed: bool,
+    /// Artifacts this walk looked at, summed. A reader mistakes the check
+    /// count for coverage otherwise: six checks say nothing about whether the
+    /// bundle beneath them held four files or four hundred.
+    inspected: usize,
+}
+
+pub fn run(args: DoctorArgs) -> Result<ExitCode> {
+    let project = args.project.as_path();
+    let runtime_path = project.join("runtime.yaml");
+    if !runtime_path.is_file() {
+        bail!(
+            "runtime configuration not found at {} (expected a deployment project directory containing runtime.yaml)",
+            runtime_path.display()
+        );
+    }
+    let runtime = read_yaml(&runtime_path)?;
+    let bundle_directory = resolve_bundle_directory(&runtime, &runtime_path, project)?;
+    let bundle_config_path = bundle_directory.join("evidence.yaml");
+    let bundle = read_yaml(&bundle_config_path)?;
+
+    let mut checks = vec![
+        check_runtime_file(project, &runtime_path),
+        check_bundle(project, &bundle_directory),
+    ];
+    checks.extend(check_secrets(project, &runtime, &runtime_path, &bundle));
+    checks.push(check_audit(project, &runtime, &runtime_path));
+    if let Some(mint_config_path) = args.mint_config.as_deref() {
+        checks.push(check_mint_compatibility(
+            project,
+            &bundle_config_path,
+            &bundle,
+            mint_config_path,
+        ));
+    }
+
+    let passed = checks.iter().all(|check| check.passed);
+    let inspected = checks.iter().map(|check| check.inspected).sum();
+    let report = DoctorReport {
+        checks,
+        passed,
+        inspected,
+    };
+
+    if args.json {
+        print_diagnostics(&report, true);
+        let encoded = serde_json::to_string(&report).context("failed to encode the JSON report")?;
+        println!("{encoded}");
+    } else {
+        print_diagnostics(&report, false);
+    }
+
+    Ok(if passed {
+        ExitCode::SUCCESS
+    } else {
+        ExitCode::FAILURE
+    })
+}
+
+/// The runtime file itself: a deployment input the service refuses to start
+/// from if it could write to it.
+fn check_runtime_file(project: &Path, runtime_path: &Path) -> Check {
+    let mut run = CheckRun::new("runtime file", project);
+    let read_only_mount = mount_is_read_only(runtime_path);
+    require_immutable(&mut run, runtime_path, read_only_mount);
+    run.finish()
+}
+
+/// The bundle directory and everything beneath it, under the same rule.
+fn check_bundle(project: &Path, bundle_directory: &Path) -> Check {
+    let mut run = CheckRun::new("bundle", project);
+    let read_only_mount = mount_is_read_only(bundle_directory);
+    walk_immutable(&mut run, bundle_directory, read_only_mount);
+    run.finish()
+}
+
+/// The secret root and every secret the bundle names.
+///
+/// The secrets are discovered from the bundle's own `secret:file/` references
+/// rather than by listing the secret directory. The difference matters: the
+/// public half of a signing key is written into that directory at mode 0644 by
+/// design, and a directory walk would report a project the runtime accepts.
+fn check_secrets(
+    project: &Path,
+    runtime: &YamlValue,
+    runtime_path: &Path,
+    bundle: &YamlValue,
+) -> Vec<Check> {
+    let references = secret_references(bundle);
+    let root = runtime
+        .get("secretProviders")
+        .and_then(|providers| providers.get("file"))
+        .and_then(|file| file.get("root"))
+        .and_then(YamlValue::as_str);
+
+    let Some(root) = root else {
+        if references.is_empty() {
+            return Vec::new();
+        }
+        let mut run = CheckRun::new("secrets", project);
+        run.refuse(
+            runtime_path,
+            format!(
+                "names no file secret provider, and the bundle references {} secret(s) through one",
+                references.len()
+            ),
+        );
+        return vec![run.finish()];
+    };
+    let root = resolve_against(runtime_path, project, Path::new(root));
+
+    let mut root_run = CheckRun::new("secret root", project);
+    if let Some(metadata) = root_run.stat(&root) {
+        if metadata.file_type().is_symlink() {
+            root_run.refuse(&root, "is a symbolic link; the runtime requires a directory reached without traversing one".to_owned());
+        } else if !metadata.is_dir() {
+            root_run.refuse(&root, "is not a directory".to_owned());
+        } else if metadata.permissions().mode() & 0o077 != 0 {
+            root_run.refuse(&root, group_or_other(&metadata, 0o700));
+        }
+    }
+
+    let mut secret_run = CheckRun::new("secrets", project);
+    for name in references {
+        let path = root.join(&name);
+        let Some(metadata) = secret_run.stat(&path) else {
+            continue;
+        };
+        if metadata.file_type().is_symlink() || !metadata.is_file() {
+            secret_run.refuse(
+                &path,
+                "is not a regular file reached without traversing a symbolic link".to_owned(),
+            );
+            continue;
+        }
+        // Secrets are the one artifact the runtime pins to an exact mode
+        // rather than to a bound, so report the exact mode back.
+        let mode = metadata.permissions().mode() & 0o7777;
+        if mode != 0o600 {
+            secret_run.refuse(
+                &path,
+                format!("has mode {mode:04o}; the runtime requires exactly 0600 (chmod 600)"),
+            );
+        }
+        require_sole_owner(&mut secret_run, &path, &metadata);
+    }
+
+    vec![root_run.finish(), secret_run.finish()]
+}
+
+/// The audit chain and its lock companion, when they exist. Absence is not a
+/// finding: the service creates both on first write.
+fn check_audit(project: &Path, runtime: &YamlValue, runtime_path: &Path) -> Check {
+    let mut run = CheckRun::new("audit", project);
+    let Some(path) = runtime
+        .get("auditStorage")
+        .and_then(|storage| storage.get("path"))
+        .and_then(YamlValue::as_str)
+    else {
+        return run.finish();
+    };
+    let path = resolve_against(runtime_path, project, Path::new(path));
+    let lock = lock_companion(&path);
+    for candidate in [path, lock] {
+        if !candidate.exists() {
+            continue;
+        }
+        let Some(metadata) = run.stat(&candidate) else {
+            continue;
+        };
+        if metadata.file_type().is_symlink() || !metadata.is_file() {
+            run.refuse(&candidate, "is not a regular file".to_owned());
+            continue;
+        }
+        if metadata.permissions().mode() & 0o077 != 0 {
+            run.refuse(&candidate, group_or_other(&metadata, 0o600));
+        }
+        require_sole_owner(&mut run, &candidate, &metadata);
+    }
+    run.finish()
+}
+
+/// The Evidence fields whose values must agree with a paired Mint deployment.
+///
+/// This deliberately projects only the protocol binding. The rest of the
+/// bundle is governed by `evidence check`, and accepting it here would turn
+/// adopter tooling into a second implementation of Evidence configuration.
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct EvidenceAuthenticationCompatibility {
+    issuer: String,
+    audiences: Vec<String>,
+    token_types: Vec<String>,
+    algorithms: Vec<String>,
+    jwks_uri: String,
+    principal_claim: String,
+    requester_tags_claim: String,
+    evidence_audience_claim: String,
+    grant_id_claim: String,
+    grant_authority_claim: String,
+    actor_claim: Option<String>,
+}
+
+/// The corresponding Mint projection. Mint's own `mint check` owns every
+/// other field, including key files, clients and client assertions.
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct MintCompatibilityDocument {
+    issuer: String,
+    signing: MintSigningCompatibility,
+    access_tokens: MintAccessTokenCompatibility,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct MintSigningCompatibility {
+    algorithm: String,
+    #[serde(default = "default_mint_jwks_path")]
+    jwks_path: String,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct MintAccessTokenCompatibility {
+    audiences: Vec<String>,
+    claims: MintClaimCompatibility,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct MintClaimCompatibility {
+    #[serde(default = "default_principal_claim")]
+    principal: String,
+    requester_tags: String,
+    evidence_audience: String,
+    grant_id: String,
+    grant_authority: String,
+    actor: Option<String>,
+}
+
+fn default_mint_jwks_path() -> String {
+    DEFAULT_MINT_JWKS_PATH.to_owned()
+}
+
+fn default_principal_claim() -> String {
+    "sub".to_owned()
+}
+
+fn check_mint_compatibility(
+    project: &Path,
+    bundle_config_path: &Path,
+    bundle: &YamlValue,
+    mint_config_path: &Path,
+) -> Check {
+    let mut run = CheckRun::new("mint compatibility", project);
+    run.inspected += 1;
+    let evidence: Option<EvidenceAuthenticationCompatibility> = bundle
+        .get("authentication")
+        .cloned()
+        .and_then(|authentication| serde_norway::from_value(authentication).ok());
+    if evidence.is_none() {
+        run.refuse(
+            bundle_config_path,
+            "authentication paired-Mint compatibility fields are missing or invalid".to_owned(),
+        );
+    }
+    let mint = read_mint_compatibility(&mut run, mint_config_path);
+
+    let (Some(evidence), Some(mint)) = (evidence, mint) else {
+        return run.finish();
+    };
+
+    if evidence.issuer != mint.issuer {
+        run.refuse(
+            bundle_config_path,
+            "authentication.issuer does not match the paired Mint issuer".to_owned(),
+        );
+    }
+
+    // This is the route Mint publishes in its metadata. It is concatenation,
+    // not URL joining: path-bearing issuers are part of Mint's contract.
+    let mint_jwks_uri = format!("{}{}", mint.issuer, mint.signing.jwks_path);
+    if evidence.jwks_uri != mint_jwks_uri {
+        run.refuse(
+            bundle_config_path,
+            "authentication.jwksUri does not match the paired Mint JWKS endpoint".to_owned(),
+        );
+    }
+
+    if !same_string_set(&evidence.audiences, &mint.access_tokens.audiences) {
+        run.refuse(
+            bundle_config_path,
+            "authentication.audiences do not match the paired Mint access-token audiences"
+                .to_owned(),
+        );
+    }
+    if !evidence.algorithms.contains(&mint.signing.algorithm) {
+        run.refuse(
+            bundle_config_path,
+            "authentication.algorithms does not admit the paired Mint access-token signing algorithm"
+                .to_owned(),
+        );
+    }
+    if !evidence
+        .token_types
+        .iter()
+        .any(|token_type| token_type == MINT_ACCESS_TOKEN_TYPE)
+    {
+        run.refuse(
+            bundle_config_path,
+            "authentication.tokenTypes does not admit Mint at+jwt access tokens".to_owned(),
+        );
+    }
+
+    compare_claim_name(
+        &mut run,
+        bundle_config_path,
+        "principalClaim",
+        &evidence.principal_claim,
+        &mint.access_tokens.claims.principal,
+    );
+    compare_claim_name(
+        &mut run,
+        bundle_config_path,
+        "requesterTagsClaim",
+        &evidence.requester_tags_claim,
+        &mint.access_tokens.claims.requester_tags,
+    );
+    compare_claim_name(
+        &mut run,
+        bundle_config_path,
+        "evidenceAudienceClaim",
+        &evidence.evidence_audience_claim,
+        &mint.access_tokens.claims.evidence_audience,
+    );
+    compare_claim_name(
+        &mut run,
+        bundle_config_path,
+        "grantIdClaim",
+        &evidence.grant_id_claim,
+        &mint.access_tokens.claims.grant_id,
+    );
+    compare_claim_name(
+        &mut run,
+        bundle_config_path,
+        "grantAuthorityClaim",
+        &evidence.grant_authority_claim,
+        &mint.access_tokens.claims.grant_authority,
+    );
+    if evidence.actor_claim != mint.access_tokens.claims.actor {
+        run.refuse(
+            bundle_config_path,
+            "authentication.actorClaim does not match accessTokens.claims.actor".to_owned(),
+        );
+    }
+
+    run.finish()
+}
+
+fn read_mint_compatibility(
+    run: &mut CheckRun<'_>,
+    mint_config_path: &Path,
+) -> Option<MintCompatibilityDocument> {
+    run.inspected += 1;
+    let bytes = match fs::read(mint_config_path) {
+        Ok(bytes) => bytes,
+        Err(_) => {
+            run.refuse(
+                mint_config_path,
+                "paired Mint configuration cannot be read".to_owned(),
+            );
+            return None;
+        }
+    };
+    match serde_norway::from_slice(&bytes) {
+        Ok(document) => Some(document),
+        Err(_) => {
+            run.refuse(
+                mint_config_path,
+                "paired Mint compatibility fields are missing or invalid".to_owned(),
+            );
+            None
+        }
+    }
+}
+
+fn same_string_set(left: &[String], right: &[String]) -> bool {
+    left.iter().collect::<BTreeSet<_>>() == right.iter().collect::<BTreeSet<_>>()
+}
+
+fn compare_claim_name(
+    run: &mut CheckRun<'_>,
+    bundle_config_path: &Path,
+    evidence_field: &str,
+    evidence_claim: &str,
+    mint_claim: &str,
+) {
+    if evidence_claim != mint_claim {
+        run.refuse(
+            bundle_config_path,
+            format!(
+                "authentication.{evidence_field} does not match its paired Mint access-token claim name"
+            ),
+        );
+    }
+}
+
+/// One check under construction: the artifacts it looked at, and the reasons it
+/// refused any of them.
+struct CheckRun<'a> {
+    name: &'static str,
+    project: &'a Path,
+    inspected: usize,
+    findings: Vec<Finding>,
+}
+
+impl<'a> CheckRun<'a> {
+    fn new(name: &'static str, project: &'a Path) -> Self {
+        Self {
+            name,
+            project,
+            inspected: 0,
+            findings: Vec::new(),
+        }
+    }
+
+    /// Read one artifact's own metadata, counting it as inspected. Symbolic
+    /// links are not followed: every rule here is about the named entry.
+    fn stat(&mut self, path: &Path) -> Option<Metadata> {
+        self.inspected += 1;
+        match fs::symlink_metadata(path) {
+            Ok(metadata) => Some(metadata),
+            Err(error) => {
+                self.refuse(path, format!("cannot be read: {error}"));
+                None
+            }
+        }
+    }
+
+    fn refuse(&mut self, path: &Path, problem: String) {
+        self.findings.push(Finding {
+            path: self.display(path),
+            problem,
+        });
+    }
+
+    /// Project-relative where possible, so a report reads as a list of things
+    /// to fix rather than a column of temporary directory prefixes.
+    fn display(&self, path: &Path) -> String {
+        path.strip_prefix(self.project)
+            .unwrap_or(path)
+            .display()
+            .to_string()
+    }
+
+    fn finish(self) -> Check {
+        Check {
+            name: self.name,
+            passed: self.findings.is_empty(),
+            inspected: self.inspected,
+            findings: self.findings,
+        }
+    }
+}
+
+/// No write bits for anyone: what the runtime requires of a deployment input.
+fn require_immutable(run: &mut CheckRun, path: &Path, read_only_mount: bool) {
+    let Some(metadata) = run.stat(path) else {
+        return;
+    };
+    refuse_unless_immutable(run, path, &metadata, read_only_mount);
+}
+
+/// The same rule over a directory tree, entry by entry.
+fn walk_immutable(run: &mut CheckRun, path: &Path, read_only_mount: bool) {
+    let Some(metadata) = run.stat(path) else {
+        return;
+    };
+    if metadata.file_type().is_symlink() {
+        run.refuse(
+            path,
+            "is a symbolic link; the runtime refuses one anywhere in a bundle".to_owned(),
+        );
+        return;
+    }
+    refuse_unless_immutable(run, path, &metadata, read_only_mount);
+    if !metadata.is_dir() {
+        return;
+    }
+    match fs::read_dir(path) {
+        Ok(entries) => {
+            for entry in entries {
+                match entry {
+                    Ok(entry) => walk_immutable(run, &entry.path(), read_only_mount),
+                    Err(error) => run.refuse(path, format!("cannot be listed: {error}")),
+                }
+            }
+        }
+        Err(error) => run.refuse(path, format!("cannot be listed: {error}")),
+    }
+}
+
+fn refuse_unless_immutable(
+    run: &mut CheckRun,
+    path: &Path,
+    metadata: &Metadata,
+    read_only_mount: bool,
+) {
+    let mode = metadata.permissions().mode() & 0o7777;
+    if !read_only_mount && mode & 0o222 != 0 {
+        run.refuse(
+            path,
+            format!("has mode {mode:04o}; the runtime requires no write bits (chmod a-w)"),
+        );
+    }
+}
+
+/// Owned by this user and reachable under one name only. A second hard link is
+/// a second name for the same bytes, which survives a permission change on the
+/// first.
+fn require_sole_owner(run: &mut CheckRun, path: &Path, metadata: &Metadata) {
+    let euid = rustix::process::geteuid().as_raw();
+    if metadata.uid() != euid {
+        run.refuse(
+            path,
+            format!(
+                "is owned by uid {}, not by the user running this check (uid {euid}); the runtime requires the user it runs as",
+                metadata.uid()
+            ),
+        );
+    }
+    if metadata.nlink() != 1 {
+        run.refuse(
+            path,
+            format!(
+                "has {} hard links; the runtime requires exactly one",
+                metadata.nlink()
+            ),
+        );
+    }
+}
+
+fn group_or_other(metadata: &Metadata, required: u32) -> String {
+    let mode = metadata.permissions().mode() & 0o7777;
+    format!(
+        "has mode {mode:04o}; the runtime requires no group or other access (chmod {required:o})"
+    )
+}
+
+/// The audit sink's lock companion, `<audit file>.lock`.
+fn lock_companion(path: &Path) -> PathBuf {
+    let mut name = path.as_os_str().to_os_string();
+    name.push(".lock");
+    PathBuf::from(name)
+}
+
+/// Whether the filesystem carrying `path` is mounted read-only, in which case
+/// the runtime accepts write bits it would otherwise refuse. An unreadable
+/// mount is treated as writable, which reports rather than hides.
+fn mount_is_read_only(path: &Path) -> bool {
+    rustix::fs::statvfs(path).is_ok_and(|status| {
+        status
+            .f_flag
+            .contains(rustix::fs::StatVfsMountFlags::RDONLY)
+    })
+}
+
+/// Resolve a configured path: absolute as written, relative against the
+/// configuration file's own directory.
+fn resolve_against(config_path: &Path, project: &Path, path: &Path) -> PathBuf {
+    if path.is_absolute() {
+        path.to_path_buf()
+    } else {
+        config_path.parent().unwrap_or(project).join(path)
+    }
+}
+
+/// Resolve the bundle directory a project's `runtime.yaml` names, on the same
+/// terms `evidencectl fixtures run` does.
+fn resolve_bundle_directory(
+    runtime: &YamlValue,
+    runtime_path: &Path,
+    project: &Path,
+) -> Result<PathBuf> {
+    match runtime.get("bundleDirectory") {
+        Some(value) => {
+            let value = value.as_str().ok_or_else(|| {
+                anyhow!(
+                    "bundleDirectory in {} is not a string",
+                    runtime_path.display()
+                )
+            })?;
+            Ok(resolve_against(runtime_path, project, Path::new(value)))
+        }
+        None => Ok(project.join("bundle")),
+    }
+}
+
+/// Every `secret:file/<name>` a bundle names, wherever in the document it sits.
+///
+/// This is discovery, not validation: the reference is found by its own prefix
+/// rather than by the field carrying it, so a secret a future field names is
+/// checked without this walk learning that field. `evidence check` is left to
+/// reject a bundle that is otherwise malformed.
+fn secret_references(bundle: &YamlValue) -> Vec<String> {
+    let mut names = Vec::new();
+    collect_secret_references(bundle, &mut names);
+    names
+}
+
+fn collect_secret_references(value: &YamlValue, names: &mut Vec<String>) {
+    match value {
+        YamlValue::String(text) => {
+            if let Some(name) = text.strip_prefix(SECRET_REFERENCE_PREFIX) {
+                let name = name.to_owned();
+                if !names.contains(&name) {
+                    names.push(name);
+                }
+            }
+        }
+        YamlValue::Sequence(items) => {
+            for item in items {
+                collect_secret_references(item, names);
+            }
+        }
+        YamlValue::Mapping(entries) => {
+            for (_, entry) in entries {
+                collect_secret_references(entry, names);
+            }
+        }
+        _ => {}
+    }
+}
+
+fn read_yaml(path: &Path) -> Result<YamlValue> {
+    let bytes = fs::read(path).with_context(|| format!("failed to read {}", path.display()))?;
+    serde_norway::from_slice(&bytes).with_context(|| format!("failed to parse {}", path.display()))
+}
+
+/// Print one line per check, every finding beneath it, and a summary line.
+///
+/// In JSON mode this goes to stderr, keeping stdout reserved for the single
+/// JSON document; in human mode it is the entire report and goes to stdout.
+/// Findings are never elided: a walk that reports some of what is broken sends
+/// an operator back for a second restart, which is what this exists to avoid.
+fn print_diagnostics(report: &DoctorReport, to_stderr: bool) {
+    let mut lines = Vec::new();
+    for check in &report.checks {
+        let status = if check.passed { "PASS" } else { "FAIL" };
+        lines.push(format!(
+            "{status}: {} ({} inspected)",
+            check.name, check.inspected
+        ));
+        for finding in &check.findings {
+            lines.push(format!("    {}: {}", finding.path, finding.problem));
+        }
+    }
+    let passed = report.checks.iter().filter(|check| check.passed).count();
+    let failed = report.checks.len() - passed;
+    lines.push(format!(
+        "{passed} passed, {failed} failed ({} artifacts inspected)",
+        report.inspected
+    ));
+
+    for line in lines {
+        if to_stderr {
+            eprintln!("{line}");
+        } else {
+            println!("{line}");
+        }
+    }
+}
diff --git a/crates/registry-evidencectl/src/fixtures.rs b/crates/registry-evidencectl/src/fixtures.rs
new file mode 100644
index 000000000..8e5ddf60f
--- /dev/null
+++ b/crates/registry-evidencectl/src/fixtures.rs
@@ -0,0 +1,383 @@
+//! Fixture-run driver. Shells out to the `evidence` binary for every
+//! semantic decision and only aggregates results.
+
+use std::{
+    env, fs,
+    path::{Path, PathBuf},
+    process::{Command, ExitCode},
+};
+
+use anyhow::{anyhow, bail, Context, Result};
+use clap::{Args, Subcommand};
+use serde::Serialize;
+use serde_norway::Value as YamlValue;
+
+#[derive(Debug, Subcommand)]
+pub enum FixturesCommand {
+    /// Run `evidence check` and every bundle fixture through `evidence evaluate`.
+    Run(RunArgs),
+}
+
+#[derive(Debug, Args)]
+pub struct RunArgs {
+    /// Deployment project directory containing runtime.yaml and bundle/.
+    #[arg(long)]
+    pub project: PathBuf,
+
+    /// Path to the evidence binary; defaults to `evidence` on PATH.
+    #[arg(long)]
+    pub evidence_bin: Option<PathBuf>,
+
+    /// Emit one machine-readable JSON report on standard output.
+    #[arg(long)]
+    pub json: bool,
+}
+
+/// The result of one `evidence` invocation: whether it exited zero, when it did
+/// not its captured stderr for the operator to read, and, for a fixture run,
+/// how many cases that fixture evaluated.
+struct StepOutcome {
+    passed: bool,
+    stderr: Option<String>,
+    evaluated_cases: Option<usize>,
+}
+
+#[derive(Debug, Serialize)]
+struct CheckReport {
+    passed: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    stderr: Option<String>,
+}
+
+#[derive(Debug, Serialize)]
+struct FixtureReport {
+    path: String,
+    passed: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    stderr: Option<String>,
+    /// Absent when the fixture failed, or when `evidence` reported no count.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    evaluated_cases: Option<usize>,
+}
+
+#[derive(Debug, Serialize)]
+struct RunReport {
+    check: CheckReport,
+    fixtures: Vec<FixtureReport>,
+    passed: bool,
+    /// The cases every fixture in this run evaluated, summed.
+    ///
+    /// The step counts above measure artifacts, which a reader mistakes for
+    /// coverage: a project with four fixture files reports the same `5 passed`
+    /// whether those files hold four cases or forty.
+    evaluated_cases: usize,
+}
+
+pub fn run(command: FixturesCommand) -> Result<ExitCode> {
+    match command {
+        FixturesCommand::Run(args) => run_fixtures(args),
+    }
+}
+
+fn run_fixtures(args: RunArgs) -> Result<ExitCode> {
+    let runtime_path = args.project.join("runtime.yaml");
+    if !runtime_path.is_file() {
+        bail!(
+            "runtime configuration not found at {} (expected a deployment project directory containing runtime.yaml)",
+            runtime_path.display()
+        );
+    }
+    let bundle_directory = resolve_bundle_directory(&runtime_path, &args.project)?;
+    let bundle_config_path = bundle_directory.join("evidence.yaml");
+    let fixture_paths = discover_fixtures(&bundle_config_path)?;
+    let evidence_bin = resolve_evidence_binary(args.evidence_bin.as_deref())?;
+
+    let check_outcome = run_evidence_step(&evidence_bin, &runtime_path, &["check"]);
+    let check_passed = check_outcome.passed;
+
+    // A broken bundle makes per-fixture results meaningless, so a failing
+    // check short-circuits before any fixture is evaluated.
+    let mut fixtures = Vec::new();
+    if check_passed {
+        for fixture_path in &fixture_paths {
+            let outcome = run_evidence_step(
+                &evidence_bin,
+                &runtime_path,
+                &["evaluate", "--fixture", fixture_path],
+            );
+            fixtures.push(FixtureReport {
+                path: fixture_path.clone(),
+                passed: outcome.passed,
+                stderr: outcome.stderr,
+                evaluated_cases: outcome.evaluated_cases,
+            });
+        }
+    }
+
+    let overall_passed = check_passed && fixtures.iter().all(|fixture| fixture.passed);
+    let evaluated_cases = fixtures
+        .iter()
+        .filter_map(|fixture| fixture.evaluated_cases)
+        .sum();
+    let report = RunReport {
+        check: CheckReport {
+            passed: check_passed,
+            stderr: check_outcome.stderr,
+        },
+        fixtures,
+        passed: overall_passed,
+        evaluated_cases,
+    };
+
+    if args.json {
+        print_diagnostics(&report, true);
+        let encoded = serde_json::to_string(&report).context("failed to encode the JSON report")?;
+        println!("{encoded}");
+    } else {
+        print_diagnostics(&report, false);
+    }
+
+    Ok(if overall_passed {
+        ExitCode::SUCCESS
+    } else {
+        ExitCode::FAILURE
+    })
+}
+
+/// Resolve the bundle directory a project's `runtime.yaml` names. A relative
+/// `bundleDirectory` is resolved against the runtime file's own directory, an
+/// absolute one is used as-is, and `<project>/bundle` is the default only when
+/// the key is absent. This is discovery, not validation: `evidence check` is
+/// left to reject a runtime configuration that is otherwise malformed.
+fn resolve_bundle_directory(runtime_path: &Path, project: &Path) -> Result<PathBuf> {
+    let bytes = fs::read(runtime_path).with_context(|| {
+        format!(
+            "failed to read runtime configuration at {}",
+            runtime_path.display()
+        )
+    })?;
+    let document: YamlValue = serde_norway::from_slice(&bytes).with_context(|| {
+        format!(
+            "failed to parse runtime configuration at {}",
+            runtime_path.display()
+        )
+    })?;
+    match document.get("bundleDirectory") {
+        Some(value) => {
+            let value = value.as_str().ok_or_else(|| {
+                anyhow!(
+                    "bundleDirectory in {} is not a string",
+                    runtime_path.display()
+                )
+            })?;
+            let path = Path::new(value);
+            if path.is_absolute() {
+                Ok(path.to_path_buf())
+            } else {
+                let base = runtime_path.parent().unwrap_or(project);
+                Ok(base.join(path))
+            }
+        }
+        None => Ok(project.join("bundle")),
+    }
+}
+
+/// Enumerate the bundle-relative fixture paths a project's requirements
+/// reference. This is discovery, not validation: unknown fields anywhere in
+/// the document are tolerated, and `evidence check` is left to reject a
+/// bundle that is otherwise malformed.
+fn discover_fixtures(bundle_config_path: &Path) -> Result<Vec<String>> {
+    let bytes = fs::read(bundle_config_path).with_context(|| {
+        format!(
+            "failed to read bundle configuration at {}",
+            bundle_config_path.display()
+        )
+    })?;
+    let document: YamlValue = serde_norway::from_slice(&bytes).with_context(|| {
+        format!(
+            "failed to parse bundle configuration at {}",
+            bundle_config_path.display()
+        )
+    })?;
+    let requirements = document
+        .get("requirements")
+        .and_then(YamlValue::as_sequence)
+        .ok_or_else(|| {
+            anyhow!(
+                "bundle configuration at {} has no requirements list",
+                bundle_config_path.display()
+            )
+        })?;
+
+    let mut fixture_paths: Vec<String> = Vec::new();
+    for requirement in requirements {
+        let fixture_path = requirement
+            .get("fixtures")
+            .and_then(YamlValue::as_str)
+            .ok_or_else(|| {
+                anyhow!(
+                    "a requirement in {} has no fixtures path",
+                    bundle_config_path.display()
+                )
+            })?;
+        if !fixture_paths
+            .iter()
+            .any(|existing| existing == fixture_path)
+        {
+            fixture_paths.push(fixture_path.to_owned());
+        }
+    }
+    Ok(fixture_paths)
+}
+
+/// Resolve the `evidence` binary: an explicit `--evidence-bin`, else
+/// `EVIDENCE_BIN`, else the first `evidence` found on `PATH`.
+/// Crate-visible so `suggest::emit` resolves the runtime binary the same way.
+pub(crate) fn resolve_evidence_binary(explicit: Option<&Path>) -> Result<PathBuf> {
+    if let Some(path) = explicit {
+        if !path.is_file() {
+            bail!("evidence binary not found at {}", path.display());
+        }
+        return Ok(path.to_path_buf());
+    }
+    if let Ok(env_path) = env::var("EVIDENCE_BIN") {
+        let path = PathBuf::from(&env_path);
+        if !path.is_file() {
+            bail!(
+                "evidence binary not found at {} (from EVIDENCE_BIN)",
+                path.display()
+            );
+        }
+        return Ok(path);
+    }
+    find_on_path("evidence").ok_or_else(|| {
+        anyhow!(
+            "evidence binary not found: pass --evidence-bin, set EVIDENCE_BIN, or add `evidence` to PATH"
+        )
+    })
+}
+
+fn find_on_path(name: &str) -> Option<PathBuf> {
+    let path_var = env::var_os("PATH")?;
+    env::split_paths(&path_var).find_map(|dir| {
+        let candidate = dir.join(name);
+        is_candidate_executable(&candidate).then_some(candidate)
+    })
+}
+
+/// A regular file, and, on unix, one with at least one executable bit set. A
+/// non-executable file on `PATH` is skipped so resolution falls through to
+/// the clearer "not found" error instead of a spawn failure later.
+fn is_candidate_executable(path: &Path) -> bool {
+    let Ok(metadata) = fs::metadata(path) else {
+        return false;
+    };
+    if !metadata.is_file() {
+        return false;
+    }
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt as _;
+        metadata.permissions().mode() & 0o111 != 0
+    }
+    #[cfg(not(unix))]
+    {
+        true
+    }
+}
+
+/// Run one `evidence --runtime <runtime_path> <args...>` invocation.
+///
+/// Standard output and standard error are captured rather than inherited so
+/// steps never interleave, and any failure to even spawn the process is
+/// treated the same as a nonzero exit: the step failed.
+fn run_evidence_step(evidence_bin: &Path, runtime_path: &Path, args: &[&str]) -> StepOutcome {
+    let mut command = Command::new(evidence_bin);
+    command.arg("--runtime").arg(runtime_path).args(args);
+    match command.output() {
+        Ok(output) if output.status.success() => StepOutcome {
+            passed: true,
+            stderr: None,
+            evaluated_cases: evaluated_cases(&String::from_utf8_lossy(&output.stdout)),
+        },
+        Ok(output) => StepOutcome {
+            passed: false,
+            stderr: Some(String::from_utf8_lossy(&output.stderr).into_owned()),
+            evaluated_cases: None,
+        },
+        Err(error) => StepOutcome {
+            passed: false,
+            stderr: Some(format!("failed to run {}: {error}", evidence_bin.display())),
+            evaluated_cases: None,
+        },
+    }
+}
+
+/// Read the case count out of `Evidence fixture passed (N evaluated cases)`.
+///
+/// This driver makes no semantic decision, so the count is `evidence`'s own
+/// figure or nothing at all. An unrecognized line leaves it absent rather than
+/// guessed, which keeps a total that is short honest instead of wrong.
+fn evaluated_cases(stdout: &str) -> Option<usize> {
+    stdout.lines().find_map(|line| {
+        line.trim()
+            .strip_prefix("Evidence fixture passed (")?
+            .strip_suffix(" evaluated cases)")?
+            .parse()
+            .ok()
+    })
+}
+
+/// Print one line per step and a summary line.
+///
+/// In JSON mode this goes to stderr, keeping stdout reserved for the single
+/// JSON document; in human mode it is the entire report and goes to stdout.
+fn print_diagnostics(report: &RunReport, to_stderr: bool) {
+    let mut lines = Vec::new();
+    lines.push(step_line("check", report.check.passed));
+    if !report.check.passed {
+        lines.extend(indented(report.check.stderr.as_deref()));
+    }
+    for fixture in &report.fixtures {
+        let mut line = step_line(&fixture.path, fixture.passed);
+        if let Some(cases) = fixture.evaluated_cases {
+            line.push_str(&format!(" ({cases} cases)"));
+        }
+        lines.push(line);
+        if !fixture.passed {
+            lines.extend(indented(fixture.stderr.as_deref()));
+        }
+    }
+    let passed_count =
+        usize::from(report.check.passed) + report.fixtures.iter().filter(|f| f.passed).count();
+    let failed_count =
+        usize::from(!report.check.passed) + report.fixtures.iter().filter(|f| !f.passed).count();
+    // The step counts stay, because they are what the exit code is made of.
+    // The case total is beside them because it is the number a reader is
+    // actually looking for: how much of the deployment this run exercised.
+    lines.push(format!(
+        "{passed_count} passed, {failed_count} failed ({} cases evaluated)",
+        report.evaluated_cases
+    ));
+
+    for line in lines {
+        if to_stderr {
+            eprintln!("{line}");
+        } else {
+            println!("{line}");
+        }
+    }
+}
+
+fn step_line(name: &str, passed: bool) -> String {
+    let status = if passed { "PASS" } else { "FAIL" };
+    format!("{status}: {name}")
+}
+
+fn indented(stderr: Option<&str>) -> Vec<String> {
+    let text = stderr.unwrap_or_default();
+    if text.trim().is_empty() {
+        return vec!["    (no output captured)".to_owned()];
+    }
+    text.lines().map(|line| format!("    {line}")).collect()
+}
diff --git a/crates/registry-evidencectl/src/jwks.rs b/crates/registry-evidencectl/src/jwks.rs
new file mode 100644
index 000000000..4efa9cd42
--- /dev/null
+++ b/crates/registry-evidencectl/src/jwks.rs
@@ -0,0 +1,114 @@
+//! Public JWKS assembly from public JWK files. Inputs containing private
+//! material are rejected outright.
+
+use std::{
+    collections::HashMap,
+    fs::{self, OpenOptions},
+    io::Write as _,
+    os::unix::fs::OpenOptionsExt as _,
+    path::PathBuf,
+    process::ExitCode,
+};
+
+use anyhow::{bail, Context, Result};
+use clap::Args;
+use registry_platform_crypto::{canonicalize_json, PublicJwk};
+
+const OUTPUT_FILE_MODE: u32 = 0o644;
+
+#[derive(Debug, Args)]
+pub struct JwksArgs {
+    /// Output JWKS document path.
+    #[arg(long)]
+    pub out: PathBuf,
+
+    /// Overwrite an existing output file.
+    #[arg(long)]
+    pub force: bool,
+
+    /// Public JWK files to include, in order.
+    #[arg(required = true)]
+    pub public_jwk_files: Vec<PathBuf>,
+}
+
+pub fn run(args: JwksArgs) -> Result<ExitCode> {
+    if args.out.exists() && !args.force {
+        bail!(
+            "refusing to overwrite existing output without --force: {}",
+            args.out.display()
+        );
+    }
+
+    let mut entries = Vec::new();
+    // canonical bytes per kid already accepted, so a repeated kid can be
+    // recognized as either an identical duplicate or a genuine conflict.
+    let mut seen_by_kid: HashMap<String, Vec<u8>> = HashMap::new();
+
+    for path in &args.public_jwk_files {
+        let contents = fs::read_to_string(path)
+            .with_context(|| format!("failed to read {}", path.display()))?;
+        // Validates the JWK and hard-rejects any private member (including a
+        // "d" value); the error never carries the file's contents.
+        let public = PublicJwk::parse(&contents)
+            .with_context(|| format!("{} is not a valid public JWK", path.display()))?;
+        let kid = public
+            .kid
+            .clone()
+            .ok_or_else(|| anyhow::anyhow!("{} is missing a \"kid\" member", path.display()))?;
+
+        let value: serde_json::Value = serde_json::from_str(&contents)
+            .with_context(|| format!("failed to parse {}", path.display()))?;
+        let canonical = canonicalize_json(&value)
+            .with_context(|| format!("failed to canonicalize {}", path.display()))?;
+
+        match seen_by_kid.get(&kid) {
+            Some(existing) if existing == &canonical => continue,
+            Some(_) => bail!(
+                "conflicting public JWKs share kid \"{kid}\" (last seen at {})",
+                path.display()
+            ),
+            None => {
+                seen_by_kid.insert(kid, canonical);
+                entries.push(value);
+            }
+        }
+    }
+
+    let mut document = serde_json::to_string_pretty(&serde_json::json!({ "keys": entries }))
+        .context("failed to render the JWKS document")?;
+    document.push('\n');
+
+    write_owner_file(&args.out, document.as_bytes(), args.force)?;
+
+    println!("wrote {}", args.out.display());
+
+    Ok(ExitCode::SUCCESS)
+}
+
+/// Writes `contents` to `path` at `OUTPUT_FILE_MODE`, set atomically at file
+/// creation. A force overwrite first removes anything already at `path`,
+/// including a symlink, so the create that follows always creates a fresh
+/// file and `OUTPUT_FILE_MODE` is always the one `O_CREAT` applies, never a
+/// later chmod that could instead land on whatever a symlink now points at.
+fn write_owner_file(path: &std::path::Path, contents: &[u8], force: bool) -> Result<()> {
+    if force {
+        match fs::symlink_metadata(path) {
+            Ok(_) => fs::remove_file(path)
+                .with_context(|| format!("failed to remove existing {}", path.display()))?,
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+            Err(error) => {
+                return Err(error).with_context(|| format!("failed to inspect {}", path.display()))
+            }
+        }
+    }
+    let mut options = OpenOptions::new();
+    options.write(true).mode(OUTPUT_FILE_MODE).create_new(true);
+    let mut file = options
+        .open(path)
+        .with_context(|| format!("failed to create {}", path.display()))?;
+    file.write_all(contents)
+        .with_context(|| format!("failed to write {}", path.display()))?;
+    file.sync_all()
+        .with_context(|| format!("failed to persist {}", path.display()))?;
+    Ok(())
+}
diff --git a/crates/registry-evidencectl/src/keygen.rs b/crates/registry-evidencectl/src/keygen.rs
new file mode 100644
index 000000000..7d43add6f
--- /dev/null
+++ b/crates/registry-evidencectl/src/keygen.rs
@@ -0,0 +1,499 @@
+//! Key material generation. Private material is written as owner-only files
+//! and never reaches standard output.
+
+use std::{
+    fs::{self, OpenOptions},
+    io::Write as _,
+    os::unix::fs::{DirBuilderExt as _, OpenOptionsExt as _, PermissionsExt as _},
+    path::{Path, PathBuf},
+    process::ExitCode,
+};
+
+use anyhow::{bail, Context, Result};
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use clap::{Args, Subcommand};
+use ed25519_dalek::SigningKey;
+use registry_platform_crypto::{PrivateJwk, PublicJwk};
+use zeroize::Zeroizing;
+
+#[derive(Debug, Subcommand)]
+pub enum KeygenCommand {
+    /// Ed25519 signing keypair as private and public JWK files.
+    Signing(SigningArgs),
+    /// One random raw secret file, 32 bytes (audit or subject-binding HMAC).
+    ///
+    /// This is HMAC key material, not a credential a source will accept: the
+    /// bytes are arbitrary and an HTTP header value rejects most of them. Use
+    /// `keygen token` for a bearer token.
+    Secret(SecretArgs),
+    /// One random bearer token file, printable and header-safe.
+    Token(TokenArgs),
+    /// Ed25519 holder keypair for SD-JWT VC confirmation binding.
+    Holder(HolderArgs),
+}
+
+#[derive(Debug, Args)]
+pub struct SigningArgs {
+    /// Secret directory receiving the private JWK file (created 0700).
+    #[arg(long)]
+    pub out_dir: PathBuf,
+
+    /// Key identifier; defaults to the RFC 7638 JWK thumbprint.
+    #[arg(long)]
+    pub kid: Option<String>,
+
+    /// Public JWK output path; defaults to a file inside the secret directory.
+    #[arg(long)]
+    pub public_out: Option<PathBuf>,
+
+    /// Overwrite existing output files.
+    #[arg(long)]
+    pub force: bool,
+}
+
+#[derive(Debug, Args)]
+pub struct SecretArgs {
+    /// Output file for the raw secret (written 0600).
+    #[arg(long)]
+    pub out: PathBuf,
+
+    /// Overwrite an existing output file.
+    #[arg(long)]
+    pub force: bool,
+}
+
+#[derive(Debug, Args)]
+pub struct TokenArgs {
+    /// Output file for the bearer token (written 0600).
+    #[arg(long)]
+    pub out: PathBuf,
+
+    /// Overwrite an existing output file.
+    #[arg(long)]
+    pub force: bool,
+}
+
+#[derive(Debug, Args)]
+pub struct HolderArgs {
+    /// Directory receiving the holder private JWK file (created 0700).
+    #[arg(long)]
+    pub out_dir: PathBuf,
+
+    /// Key identifier; defaults to the RFC 7638 JWK thumbprint.
+    #[arg(long)]
+    pub kid: Option<String>,
+
+    /// Public JWK output path; defaults to a file inside the secret directory.
+    #[arg(long)]
+    pub public_out: Option<PathBuf>,
+
+    /// Overwrite existing output files.
+    #[arg(long)]
+    pub force: bool,
+}
+
+/// Filename for the private signing JWK, fixed to match the reference
+/// deployment project's secret-mount layout.
+const SIGNING_PRIVATE_FILENAME: &str = "signing-ed25519-private-jwk";
+const SIGNING_PUBLIC_FILENAME: &str = "signing-ed25519-public.jwk.json";
+const HOLDER_PRIVATE_FILENAME: &str = "holder-ed25519-private-jwk";
+const HOLDER_PUBLIC_FILENAME: &str = "holder-ed25519-public.jwk.json";
+const AUDIT_HMAC_FILENAME: &str = "audit-hmac-key";
+const SUBJECT_BINDING_HMAC_FILENAME: &str = "subject-binding-hmac-key";
+
+const PRIVATE_FILE_MODE: u32 = 0o600;
+const PUBLIC_FILE_MODE: u32 = 0o644;
+const PRIVATE_DIR_MODE: u32 = 0o700;
+
+/// Exactly 32 raw bytes: one HMAC secret (audit or subject-binding).
+const SECRET_FILE_BYTES: usize = 32;
+
+/// How much randomness a generated bearer token carries, before encoding.
+const TOKEN_ENTROPY_BYTES: usize = 32;
+
+pub fn run(command: KeygenCommand) -> Result<ExitCode> {
+    match command {
+        KeygenCommand::Signing(args) => run_keypair(
+            &args.out_dir,
+            args.kid.as_deref(),
+            args.public_out.as_deref(),
+            args.force,
+            SIGNING_PRIVATE_FILENAME,
+            SIGNING_PUBLIC_FILENAME,
+        ),
+        KeygenCommand::Secret(args) => run_secret(&args),
+        KeygenCommand::Token(args) => run_token(&args),
+        KeygenCommand::Holder(args) => run_keypair(
+            &args.out_dir,
+            args.kid.as_deref(),
+            args.public_out.as_deref(),
+            args.force,
+            HOLDER_PRIVATE_FILENAME,
+            HOLDER_PUBLIC_FILENAME,
+        ),
+    }
+}
+
+/// Generate the four files needed during local Evidence authoring.
+///
+/// The caller supplies a newly staged, unpublished project. This function
+/// never accepts force and never reports paths, so a collision fails closed
+/// and no private material reaches standard output. Publication of the staged
+/// project makes the complete batch visible at once.
+pub(crate) fn generate_scaffold_key_material(out_dir: &Path, kid: &str) -> Result<()> {
+    ensure_private_dir(out_dir)?;
+    run_keypair_impl(
+        out_dir,
+        Some(kid),
+        None,
+        false,
+        SIGNING_PRIVATE_FILENAME,
+        SIGNING_PUBLIC_FILENAME,
+        false,
+        PUBLIC_FILE_MODE,
+    )?;
+    for filename in [AUDIT_HMAC_FILENAME, SUBJECT_BINDING_HMAC_FILENAME] {
+        run_secret_impl(
+            &SecretArgs {
+                out: out_dir.join(filename),
+                force: false,
+            },
+            false,
+        )?;
+    }
+    Ok(())
+}
+
+/// Generate one private development keypair without reporting key material or
+/// paths. Both halves remain owner-only because the pair lives in ephemeral
+/// private supervisor state rather than in a public JWKS artifact.
+pub(crate) fn generate_dev_keypair(
+    out_dir: &Path,
+    kid: &str,
+    private_filename: &str,
+    public_filename: &str,
+) -> Result<(PathBuf, PathBuf)> {
+    ensure_private_dir(out_dir)?;
+    run_keypair_impl(
+        out_dir,
+        Some(kid),
+        None,
+        false,
+        private_filename,
+        public_filename,
+        false,
+        PRIVATE_FILE_MODE,
+    )?;
+    Ok((
+        out_dir.join(private_filename),
+        out_dir.join(public_filename),
+    ))
+}
+
+fn run_keypair(
+    out_dir: &Path,
+    kid: Option<&str>,
+    public_out: Option<&Path>,
+    force: bool,
+    private_filename: &str,
+    public_filename: &str,
+) -> Result<ExitCode> {
+    run_keypair_impl(
+        out_dir,
+        kid,
+        public_out,
+        force,
+        private_filename,
+        public_filename,
+        true,
+        PUBLIC_FILE_MODE,
+    )
+}
+
+#[allow(clippy::too_many_arguments)]
+fn run_keypair_impl(
+    out_dir: &Path,
+    kid: Option<&str>,
+    public_out: Option<&Path>,
+    force: bool,
+    private_filename: &str,
+    public_filename: &str,
+    report: bool,
+    public_file_mode: u32,
+) -> Result<ExitCode> {
+    if let Some(kid) = kid {
+        if kid.trim().is_empty() {
+            bail!("--kid must not be empty or whitespace-only");
+        }
+    }
+
+    let private_path = out_dir.join(private_filename);
+    let public_path = public_out
+        .map(Path::to_path_buf)
+        .unwrap_or_else(|| out_dir.join(public_filename));
+
+    // Every target path is known up front, so the whole batch can be checked
+    // for collisions before anything is written.
+    reject_existing(&[&private_path, &public_path], force)?;
+
+    let mut secret = Zeroizing::new([0_u8; 32]);
+    getrandom::fill(secret.as_mut_slice()).context("failed to generate random key material")?;
+    let signing_key = SigningKey::from_bytes(&secret);
+    let x = URL_SAFE_NO_PAD.encode(signing_key.verifying_key().as_bytes());
+    let d = Zeroizing::new(URL_SAFE_NO_PAD.encode(secret.as_slice()));
+
+    let kid = match kid {
+        Some(kid) => kid.to_string(),
+        None => default_kid(&x)?,
+    };
+
+    let private_json = Zeroizing::new(
+        serde_json::to_string_pretty(&serde_json::json!({
+            "kty": "OKP",
+            "crv": "Ed25519",
+            // `json!` copies `d` into a `serde_json::Value::String` whose heap
+            // buffer this crate does not zeroize, unlike every other copy of
+            // the secret above. Accepted: serde_json owns the escaping here,
+            // and the copy is short-lived, but it is not wiped.
+            "d": d.as_str(),
+            "x": x,
+            "alg": "EdDSA",
+            "kid": kid,
+        }))
+        .context("failed to render the private JWK")?,
+    );
+    let public_json = serde_json::to_string_pretty(&serde_json::json!({
+        "kty": "OKP",
+        "crv": "Ed25519",
+        "x": x,
+        "alg": "EdDSA",
+        "kid": kid,
+        "use": "sig",
+    }))
+    .context("failed to render the public JWK")?;
+
+    // Self-check: a key this tool cannot parse back is not fit to ship.
+    PrivateJwk::parse(&private_json).context("generated private JWK failed validation")?;
+    PublicJwk::parse(&public_json).context("generated public JWK failed validation")?;
+
+    ensure_private_dir(out_dir)?;
+    ensure_parent_dir(&public_path)?;
+    write_owner_file(
+        &private_path,
+        private_json.as_bytes(),
+        PRIVATE_FILE_MODE,
+        force,
+    )?;
+    write_owner_file(
+        &public_path,
+        public_json.as_bytes(),
+        public_file_mode,
+        force,
+    )?;
+
+    if report {
+        println!("wrote {}", private_path.display());
+        println!("wrote {}", public_path.display());
+        println!("kid: {kid}");
+    }
+
+    Ok(ExitCode::SUCCESS)
+}
+
+fn run_secret(args: &SecretArgs) -> Result<ExitCode> {
+    run_secret_impl(args, true)
+}
+
+fn run_secret_impl(args: &SecretArgs, report: bool) -> Result<ExitCode> {
+    reject_existing(&[&args.out], args.force)?;
+
+    let secret = generate_secret()?;
+
+    if let Some(parent) = args
+        .out
+        .parent()
+        .filter(|parent| !parent.as_os_str().is_empty())
+    {
+        ensure_secret_parent_dir(parent)?;
+    }
+    write_owner_file(&args.out, secret.as_slice(), PRIVATE_FILE_MODE, args.force)?;
+
+    if report {
+        println!("wrote {}", args.out.display());
+    }
+
+    Ok(ExitCode::SUCCESS)
+}
+
+/// Write one bearer token, for a source that has no token of its own to issue.
+///
+/// A real source issues its own credential and this command has no business
+/// inventing one. It exists for the stand-in source a project is stood up
+/// against first, where the alternative is `keygen secret`: the obvious
+/// neighbour, and the wrong tool, because its raw bytes reach an HTTP header
+/// that rejects most of them.
+fn run_token(args: &TokenArgs) -> Result<ExitCode> {
+    reject_existing(&[&args.out], args.force)?;
+
+    let mut entropy = Zeroizing::new([0_u8; TOKEN_ENTROPY_BYTES]);
+    getrandom::fill(entropy.as_mut_slice()).context("failed to generate random key material")?;
+    // base64url without padding: every character is unreserved in a header
+    // value and never NUL, so no draw has to be rejected. Written without a
+    // trailing newline, because the runtime reads the file whole and would
+    // carry one into the header.
+    let token = Zeroizing::new(URL_SAFE_NO_PAD.encode(entropy.as_slice()));
+
+    if let Some(parent) = args
+        .out
+        .parent()
+        .filter(|parent| !parent.as_os_str().is_empty())
+    {
+        ensure_secret_parent_dir(parent)?;
+    }
+    write_owner_file(&args.out, token.as_bytes(), PRIVATE_FILE_MODE, args.force)?;
+
+    println!("wrote {}", args.out.display());
+
+    Ok(ExitCode::SUCCESS)
+}
+
+/// Draws `SECRET_FILE_BYTES` uniformly at random, rejecting any draw that
+/// contains a NUL byte.
+///
+/// The Evidence runtime refuses a file-provided secret containing NUL, which a
+/// uniform 32-byte draw carries about 11.8% of the time. Rejection sampling
+/// keeps the value uniform over the accepted set (255^32, or 255.8 bits) and
+/// keeps a scaffolded project working the first time, instead of failing at
+/// `evidence serve` long after `evidence check` passed.
+fn generate_secret() -> Result<Zeroizing<[u8; SECRET_FILE_BYTES]>> {
+    let mut secret = Zeroizing::new([0_u8; SECRET_FILE_BYTES]);
+    loop {
+        getrandom::fill(secret.as_mut_slice()).context("failed to generate random key material")?;
+        if !secret.contains(&0) {
+            return Ok(secret);
+        }
+    }
+}
+
+/// Default kid: the RFC 7638 thumbprint of the public key.
+fn default_kid(x: &str) -> Result<String> {
+    let public = PublicJwk {
+        kty: "OKP".to_string(),
+        kid: None,
+        alg: None,
+        crv: Some("Ed25519".to_string()),
+        x: Some(x.to_string()),
+        y: None,
+        n: None,
+        e: None,
+    };
+    public.jkt().context("failed to compute the JWK thumbprint")
+}
+
+/// Refuses to proceed if any target path already exists, unless `force` is
+/// set. Checked for every path before any file is written so a batch either
+/// completes in full or leaves nothing behind.
+fn reject_existing(paths: &[&Path], force: bool) -> Result<()> {
+    if force {
+        return Ok(());
+    }
+    let existing: Vec<String> = paths
+        .iter()
+        .filter(|path| path.exists())
+        .map(|path| path.display().to_string())
+        .collect();
+    if existing.is_empty() {
+        return Ok(());
+    }
+    bail!(
+        "refusing to overwrite existing output without --force: {}",
+        existing.join(", ")
+    );
+}
+
+/// Creates the parent directory of `path` if it does not already exist. Used
+/// for public output paths, which carry no confidentiality requirement of
+/// their own, so no particular mode is imposed.
+fn ensure_parent_dir(path: &Path) -> Result<()> {
+    let Some(parent) = path
+        .parent()
+        .filter(|parent| !parent.as_os_str().is_empty())
+    else {
+        return Ok(());
+    };
+    if parent.exists() {
+        return Ok(());
+    }
+    fs::create_dir_all(parent).with_context(|| format!("failed to create {}", parent.display()))
+}
+
+/// Creates `dir` as mode 0700 if missing, or normalizes its mode to 0700 if
+/// it already exists. Used for `--out-dir`: the caller named `dir` itself as
+/// the secret directory, so an existing directory found there is brought
+/// under this tool's ownership either way.
+fn ensure_private_dir(dir: &Path) -> Result<()> {
+    ensure_private_dir_impl(dir, true)
+}
+
+/// Creates `dir` as mode 0700 if missing; leaves its mode untouched if it
+/// already exists. Used for `--out`'s parent directory, which is derived from
+/// the output path rather than named by the caller as a secret directory, so
+/// this tool does not re-chmod a directory it did not create.
+fn ensure_secret_parent_dir(dir: &Path) -> Result<()> {
+    ensure_private_dir_impl(dir, false)
+}
+
+/// Shared implementation: a symlink or non-directory at `dir` is always
+/// rejected. A missing `dir` is always created at mode 0700. Whether an
+/// already-existing `dir` has its mode normalized to 0700 is left to the
+/// caller via `normalize_existing`.
+fn ensure_private_dir_impl(dir: &Path, normalize_existing: bool) -> Result<()> {
+    if dir.exists() {
+        let metadata = fs::symlink_metadata(dir)
+            .with_context(|| format!("failed to inspect {}", dir.display()))?;
+        if metadata.file_type().is_symlink() || !metadata.is_dir() {
+            bail!("{} exists and is not a plain directory", dir.display());
+        }
+        if !normalize_existing {
+            return Ok(());
+        }
+    } else {
+        let mut builder = fs::DirBuilder::new();
+        builder.recursive(true);
+        builder.mode(PRIVATE_DIR_MODE);
+        builder
+            .create(dir)
+            .with_context(|| format!("failed to create {}", dir.display()))?;
+    }
+    fs::set_permissions(dir, fs::Permissions::from_mode(PRIVATE_DIR_MODE))
+        .with_context(|| format!("failed to set permissions on {}", dir.display()))
+}
+
+/// Writes `contents` to `path` with `mode`, set atomically at file creation
+/// so there is no window where the file is readable with the wrong
+/// permissions. A force overwrite first removes anything already at `path`,
+/// including a symlink, so the create that follows always creates a fresh
+/// file and `mode` is always the one `O_CREAT` applies, never a later chmod
+/// that could instead land on whatever a symlink now points at.
+fn write_owner_file(path: &Path, contents: &[u8], mode: u32, force: bool) -> Result<()> {
+    if force {
+        match fs::symlink_metadata(path) {
+            Ok(_) => fs::remove_file(path)
+                .with_context(|| format!("failed to remove existing {}", path.display()))?,
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+            Err(error) => {
+                return Err(error).with_context(|| format!("failed to inspect {}", path.display()))
+            }
+        }
+    }
+    let mut options = OpenOptions::new();
+    options.write(true).mode(mode).create_new(true);
+    let mut file = options
+        .open(path)
+        .with_context(|| format!("failed to create {}", path.display()))?;
+    file.write_all(contents)
+        .with_context(|| format!("failed to write {}", path.display()))?;
+    file.sync_all()
+        .with_context(|| format!("failed to persist {}", path.display()))?;
+    Ok(())
+}
diff --git a/crates/registry-evidencectl/src/main.rs b/crates/registry-evidencectl/src/main.rs
new file mode 100644
index 000000000..ace835211
--- /dev/null
+++ b/crates/registry-evidencectl/src/main.rs
@@ -0,0 +1,95 @@
+//! Evidence adopter tooling: key generation, OpenAPI-assisted authoring, and
+//! fixture runs. Companion to the frozen `evidence` runtime CLI; it never
+//! implements Evidence semantics itself and shells out to the runtime binary
+//! for them.
+
+use std::process::ExitCode;
+
+use clap::{Parser, Subcommand};
+
+mod access;
+mod audit_view;
+mod authoring;
+mod build;
+mod dev;
+mod doctor;
+mod fixtures;
+mod jwks;
+mod keygen;
+mod request;
+mod scaffold;
+mod suggest;
+mod verify;
+
+#[derive(Debug, Parser)]
+#[command(
+    name = "evidencectl",
+    version,
+    about = "Evidence adopter tooling: keys, OpenAPI authoring, fixture runs"
+)]
+struct Cli {
+    #[command(subcommand)]
+    command: Command,
+}
+
+#[derive(Debug, Subcommand)]
+enum Command {
+    /// Manage local caller access policies and clients.
+    #[command(subcommand)]
+    Access(access::AccessCommand),
+    /// Generate Evidence deployment key material as owner-only files.
+    #[command(subcommand)]
+    Keygen(keygen::KeygenCommand),
+    /// Assemble a public JWKS document from public JWK files.
+    Jwks(jwks::JwksArgs),
+    /// Start an editable Evidence authoring project from OpenAPI.
+    New(scaffold::NewArgs),
+    /// Compile an editable project into a reviewed production candidate.
+    Build(build::BuildArgs),
+    /// Drive the evidence binary across a project's bundle fixtures.
+    #[command(subcommand)]
+    Fixtures(fixtures::FixturesCommand),
+    /// Work with a project's sources, starting from their own API documents.
+    #[command(subcommand)]
+    Source(suggest::SourceCommand),
+    /// Report every project artifact whose mode or owner the runtime refuses.
+    Doctor(doctor::DoctorArgs),
+    /// Run the private local Mint and Evidence pair for an authored project.
+    Dev(dev::DevArgs),
+    /// Prepare a closed request for the active local project.
+    #[command(subcommand)]
+    Request(request::RequestCommand),
+    /// Verify one retained Evidence response offline.
+    Verify(verify::VerifyArgs),
+    /// Inspect stopped local audit history.
+    #[command(subcommand)]
+    Audit(audit_view::AuditCommand),
+    #[command(name = "__dev-supervisor", hide = true)]
+    DevSupervisor(dev::SupervisorArgs),
+}
+
+fn main() -> ExitCode {
+    let cli = Cli::parse();
+    let result = match cli.command {
+        Command::Access(command) => access::run(command),
+        Command::Keygen(command) => keygen::run(command),
+        Command::Jwks(args) => jwks::run(args),
+        Command::New(args) => scaffold::run(args),
+        Command::Build(args) => build::run(args),
+        Command::Fixtures(command) => fixtures::run(command),
+        Command::Source(command) => suggest::run(command),
+        Command::Doctor(args) => doctor::run(args),
+        Command::Dev(args) => dev::run(args),
+        Command::Request(command) => request::run(command),
+        Command::Verify(args) => verify::run(args),
+        Command::Audit(command) => audit_view::run(command),
+        Command::DevSupervisor(args) => dev::run_supervisor(args),
+    };
+    match result {
+        Ok(code) => code,
+        Err(error) => {
+            eprintln!("evidencectl: {error:#}");
+            ExitCode::FAILURE
+        }
+    }
+}
diff --git a/crates/registry-evidencectl/src/request.rs b/crates/registry-evidencectl/src/request.rs
new file mode 100644
index 000000000..cf436b2f0
--- /dev/null
+++ b/crates/registry-evidencectl/src/request.rs
@@ -0,0 +1,581 @@
+//! Closed request preparation for the first local tutorial.
+//!
+//! This module assembles only the request described by validated ready state.
+//! Mint owns authentication and Evidence owns authorization and verification
+//! context semantics.
+
+use std::{
+    collections::BTreeMap,
+    fs::{self, File},
+    io::{Read as _, Write as _},
+    os::unix::fs::{DirBuilderExt as _, MetadataExt as _, PermissionsExt as _},
+    path::{Path, PathBuf},
+    process::{Command, ExitCode, Stdio},
+};
+
+use anyhow::{anyhow, bail, Context as _, Result};
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use clap::{Args, Subcommand, ValueEnum};
+use registry_platform_crypto::canonicalize_json;
+use serde_json::{json, Map, Value};
+use zeroize::{Zeroize as _, Zeroizing};
+
+use crate::{
+    access,
+    dev::{self, ReadyDevState},
+};
+
+const PRIVATE_DIRECTORY_MODE: u32 = 0o700;
+const PRIVATE_FILE_MODE: u32 = 0o600;
+const MAX_SELECTOR_VALUE_BYTES: usize = 200;
+const MAX_TOKEN_BYTES: usize = 64 * 1024;
+const MAX_CONTEXT_BYTES: u64 = 256 * 1024;
+
+#[derive(Debug, Subcommand)]
+pub enum RequestCommand {
+    /// Prepare the request, authorization header, and verification context.
+    Prepare(PrepareArgs),
+}
+
+#[derive(Debug, Args)]
+pub struct PrepareArgs {
+    /// Question defined by the active local project.
+    question: String,
+
+    /// Exact purpose declared by the question.
+    #[arg(long)]
+    purpose: String,
+
+    /// Subject selector. Repeat role:field=value for a multi-subject question.
+    #[arg(long, required = true)]
+    subject: Vec<String>,
+
+    /// Safe name for this retained request.
+    #[arg(long)]
+    name: String,
+
+    /// Registered local application used to request authorization.
+    #[arg(long)]
+    client: Option<String>,
+
+    /// Response format to request and verify.
+    #[arg(long, value_enum, default_value_t = PreparedResponseFormat::SignedJws)]
+    format: PreparedResponseFormat,
+
+    /// Project root. Defaults to the current directory.
+    #[arg(long, default_value = ".", hide = true)]
+    project: PathBuf,
+
+    #[arg(long, hide = true)]
+    evidence_bin: Option<PathBuf>,
+
+    #[arg(long, hide = true)]
+    mint_bin: Option<PathBuf>,
+}
+
+#[derive(Clone, Copy, Debug, ValueEnum)]
+enum PreparedResponseFormat {
+    SignedJws,
+    SdJwtVc,
+}
+
+impl PreparedResponseFormat {
+    fn as_str(self) -> &'static str {
+        match self {
+            Self::SignedJws => "signed-jws",
+            Self::SdJwtVc => "sd-jwt-vc",
+        }
+    }
+}
+
+pub fn run(command: RequestCommand) -> Result<ExitCode> {
+    match command {
+        RequestCommand::Prepare(args) => prepare(args),
+    }
+}
+
+fn prepare(args: PrepareArgs) -> Result<ExitCode> {
+    validate_request_name(&args.name)?;
+    let ready = dev::load_ready_state(&args.project)?;
+    let (question, subjects) = validate_closed_inputs(&ready, &args)?;
+    let client = resolve_request_client(&ready, args.client.as_deref())?;
+    let evidence = dev::resolve_tool_binary(
+        "evidence",
+        args.evidence_bin.as_deref(),
+        "EVIDENCECTL_TEST_EVIDENCE_BIN",
+    )?;
+    let mint = dev::resolve_tool_binary(
+        "mint",
+        args.mint_bin.as_deref(),
+        "EVIDENCECTL_TEST_MINT_BIN",
+    )?;
+
+    let requests_root = ensure_requests_root(&ready.project)?;
+    let destination = requests_root.join(&args.name);
+    require_absent(&destination)?;
+    let mut staging = StagingDirectory::create(&requests_root)?;
+
+    let request = closed_request(question, &subjects)?;
+    let request_path = staging.path().join("request.json");
+    write_private_bytes(&request_path, &request)?;
+
+    let token = obtain_token(
+        &mint,
+        &ready.token_url,
+        &client.client_id,
+        &client.private_key_path,
+        &client.assertion_audience,
+    )?;
+    let context_path = staging.path().join("verification.json");
+    prepare_context(
+        &evidence,
+        &ready.runtime_path,
+        &request_path,
+        &context_path,
+        &token,
+        args.format,
+    )?;
+    let authorization_path = staging.path().join("authorization.curl");
+    write_authorization(&authorization_path, &token)?;
+    drop(token);
+
+    validate_private_directory(&requests_root)?;
+    staging.publish(&destination)?;
+
+    let relative = Path::new(".evidence/requests").join(&args.name);
+    println!(
+        "Prepared request: {}",
+        relative.join("request.json").display()
+    );
+    println!(
+        "Prepared verification context: {}",
+        relative.join("verification.json").display()
+    );
+    println!(
+        "Prepared authorization: {}",
+        relative.join("authorization.curl").display()
+    );
+    Ok(ExitCode::SUCCESS)
+}
+
+struct RequestClient {
+    client_id: String,
+    private_key_path: PathBuf,
+    assertion_audience: String,
+}
+
+fn resolve_request_client(ready: &ReadyDevState, client_id: Option<&str>) -> Result<RequestClient> {
+    match client_id {
+        Some(client_id) => {
+            if ready.access_policies.is_empty() {
+                bail!("--client requires an active generation with explicit access policies");
+            }
+            let policy_tags = ready
+                .access_policies
+                .iter()
+                .map(|policy| (policy.id.clone(), policy.requester_tag.clone()))
+                .collect::<BTreeMap<_, _>>();
+            let client = access::resolve_ready_client(&ready.project, client_id, &policy_tags)?;
+            Ok(RequestClient {
+                client_id: client.client_id,
+                private_key_path: client.private_key_path,
+                assertion_audience: ready.token_url.clone(),
+            })
+        }
+        None => {
+            let caller = ready.caller.as_ref().ok_or_else(|| {
+                anyhow!("the active project requires a registered client selected with --client")
+            })?;
+            Ok(RequestClient {
+                client_id: caller.client_id.clone(),
+                private_key_path: caller.private_key_path.clone(),
+                assertion_audience: caller.assertion_audience.clone(),
+            })
+        }
+    }
+}
+
+fn validate_closed_inputs<'a, 'b>(
+    ready: &'a ReadyDevState,
+    args: &'b PrepareArgs,
+) -> Result<(
+    &'a dev::ReadyQuestionState,
+    Vec<(&'a dev::ReadySubjectState, &'b str)>,
+)> {
+    let question = ready
+        .questions
+        .iter()
+        .find(|question| question.alias == args.question)
+        .ok_or_else(|| anyhow!("question does not match the active local project"))?;
+    if args.purpose != question.purpose {
+        bail!("purpose does not match the active local tutorial question");
+    }
+    if args.subject.len() != question.subjects.len() {
+        bail!("subject inputs must match the question's complete role set");
+    }
+    let mut values = BTreeMap::new();
+    for input in &args.subject {
+        let (binding, value) = input
+            .split_once('=')
+            .filter(|(_, value)| !value.contains('='))
+            .ok_or_else(|| anyhow!("subject must be one field=value or role:field=value pair"))?;
+        let (role, field) = match binding.split_once(':') {
+            Some((role, field)) if !role.contains(':') && !field.contains(':') => (role, field),
+            None if question.subjects.len() == 1 => (question.subjects[0].role.as_str(), binding),
+            _ => bail!("multi-subject inputs must use role:field=value"),
+        };
+        let subject = question
+            .subjects
+            .iter()
+            .find(|subject| subject.role == role)
+            .ok_or_else(|| anyhow!("subject role does not match the active local question"))?;
+        if field != subject.selector_field || values.insert(role, value).is_some() {
+            bail!("subject inputs must contain each declared role and selector exactly once");
+        }
+        if value.is_empty()
+            || value.len() > MAX_SELECTOR_VALUE_BYTES
+            || value.chars().any(char::is_control)
+        {
+            bail!("subject value must be non-empty, bounded, and contain no control characters");
+        }
+    }
+    let subjects = question
+        .subjects
+        .iter()
+        .map(|subject| {
+            values
+                .get(subject.role.as_str())
+                .copied()
+                .map(|value| (subject, value))
+                .ok_or_else(|| anyhow!("subject inputs do not cover the complete role set"))
+        })
+        .collect::<Result<Vec<_>>>()?;
+    Ok((question, subjects))
+}
+
+fn validate_request_name(name: &str) -> Result<()> {
+    let bytes = name.as_bytes();
+    if !matches!(bytes.first(), Some(b'a'..=b'z'))
+        || bytes.len() > 64
+        || bytes[1..].iter().any(|byte| {
+            !(byte.is_ascii_lowercase()
+                || byte.is_ascii_digit()
+                || matches!(byte, b'.' | b'_' | b'-'))
+        })
+    {
+        bail!("request name must be a safe lowercase local name");
+    }
+    Ok(())
+}
+
+fn closed_request(
+    question: &dev::ReadyQuestionState,
+    subjects: &[(&dev::ReadySubjectState, &str)],
+) -> Result<Vec<u8>> {
+    let mut random = [0_u8; 32];
+    getrandom::fill(&mut random).context("failed to generate a request nonce")?;
+    let nonce = URL_SAFE_NO_PAD.encode(random);
+    random.zeroize();
+    let subjects = subjects
+        .iter()
+        .map(|(subject, value)| {
+            let selector_values = Value::Object(Map::from_iter([(
+                subject.selector_field.clone(),
+                Value::String((*value).to_owned()),
+            )]));
+            json!({
+                "role": subject.role,
+                "selector": {
+                    "profile": subject.selector_profile,
+                    "values": selector_values,
+                }
+            })
+        })
+        .collect::<Vec<_>>();
+    let request = json!({
+        "requestNonce": nonce,
+        "requirement": question.requirement_uri,
+        "purpose": question.purpose,
+        "subjects": subjects,
+    });
+    canonicalize_json(&request).context("failed to serialize the closed Evidence request")
+}
+
+fn obtain_token(
+    mint: &Path,
+    token_url: &str,
+    client_id: &str,
+    private_key_path: &Path,
+    assertion_audience: &str,
+) -> Result<Zeroizing<String>> {
+    let mut child = Command::new(mint)
+        .arg("token")
+        .arg("--url")
+        .arg(token_url)
+        .arg("--client-id")
+        .arg(client_id)
+        .arg("--key")
+        .arg(private_key_path)
+        .arg("--audience")
+        .arg(assertion_audience)
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::null())
+        .spawn()
+        .context("failed to invoke Mint")?;
+    let mut stdout = Zeroizing::new(Vec::with_capacity(MAX_TOKEN_BYTES + 2));
+    let read_result = child
+        .stdout
+        .take()
+        .ok_or_else(|| anyhow!("failed to open Mint token output"))?
+        .take((MAX_TOKEN_BYTES + 3) as u64)
+        .read_to_end(&mut stdout);
+    if read_result.is_err() || stdout.len() > MAX_TOKEN_BYTES + 2 {
+        let _ = child.kill();
+        let _ = child.wait();
+        bail!("Registry Mint refused a token for client {client_id}");
+    }
+    let status = child.wait().context("failed to wait for Mint")?;
+    if !status.success() {
+        bail!("Registry Mint refused a token for client {client_id}");
+    }
+    if std::str::from_utf8(&stdout).is_err() {
+        bail!("Registry Mint refused a token for client {client_id}");
+    }
+    let mut token = Zeroizing::new(
+        String::from_utf8(std::mem::take(&mut stdout)).expect("Mint output was validated as UTF-8"),
+    );
+    if token.ends_with('\n') {
+        token.pop();
+        if token.ends_with('\r') {
+            token.pop();
+        }
+    }
+    if token.is_empty()
+        || token.len() > MAX_TOKEN_BYTES
+        || token
+            .bytes()
+            .any(|byte| !(byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-')))
+    {
+        bail!("Registry Mint refused a token for client {client_id}");
+    }
+    Ok(token)
+}
+
+fn prepare_context(
+    evidence: &Path,
+    runtime: &Path,
+    request: &Path,
+    context: &Path,
+    token: &str,
+    response_format: PreparedResponseFormat,
+) -> Result<()> {
+    let context_file = create_private_file(context)?;
+    let mut child = Command::new(evidence)
+        .arg("--runtime")
+        .arg(runtime)
+        .arg("prepare-local-verification-context")
+        .arg("--request")
+        .arg(request)
+        .arg("--response-format")
+        .arg(response_format.as_str())
+        .stdin(Stdio::piped())
+        .stdout(Stdio::from(context_file.try_clone()?))
+        .stderr(Stdio::null())
+        .spawn()
+        .context("failed to invoke Evidence context preparation")?;
+    let write_result = child
+        .stdin
+        .take()
+        .ok_or_else(|| anyhow!("failed to open Evidence authorization input"))?
+        .write_all(token.as_bytes());
+    if write_result.is_err() {
+        let _ = child.kill();
+        let _ = child.wait();
+        bail!("Evidence context preparation failed");
+    }
+    let status = child.wait().context("failed to wait for Evidence")?;
+    if !status.success() {
+        bail!("Evidence context preparation failed");
+    }
+    context_file.sync_all()?;
+    validate_private_file(context, &context_file, 1, MAX_CONTEXT_BYTES)?;
+    Ok(())
+}
+
+fn write_authorization(path: &Path, token: &str) -> Result<()> {
+    let mut contents = Zeroizing::new(String::with_capacity(token.len() + 36));
+    contents.push_str("header = \"Authorization: Bearer ");
+    contents.push_str(token);
+    contents.push_str("\"\n");
+    write_private_bytes(path, contents.as_bytes())
+}
+
+fn ensure_requests_root(project: &Path) -> Result<PathBuf> {
+    let generated = project.join(".evidence");
+    validate_private_directory(&generated)?;
+    let requests = generated.join("requests");
+    match fs::symlink_metadata(&requests) {
+        Ok(_) => validate_private_directory(&requests)?,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+            create_private_directory(&requests)?;
+        }
+        Err(error) => return Err(error.into()),
+    }
+    Ok(requests)
+}
+
+fn require_absent(path: &Path) -> Result<()> {
+    match fs::symlink_metadata(path) {
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Ok(_) => bail!("request name already exists; refusing to replace it"),
+        Err(error) => Err(error.into()),
+    }
+}
+
+struct StagingDirectory {
+    path: Option<PathBuf>,
+}
+
+impl StagingDirectory {
+    fn create(parent: &Path) -> Result<Self> {
+        for _ in 0..8 {
+            let mut random = [0_u8; 12];
+            getrandom::fill(&mut random)?;
+            let name = format!(".prepare-{}", URL_SAFE_NO_PAD.encode(random));
+            random.zeroize();
+            let path = parent.join(name);
+            match create_private_directory(&path) {
+                Ok(()) => return Ok(Self { path: Some(path) }),
+                Err(error)
+                    if error
+                        .downcast_ref::<std::io::Error>()
+                        .is_some_and(|error| error.kind() == std::io::ErrorKind::AlreadyExists) => {
+                }
+                Err(error) => return Err(error),
+            }
+        }
+        bail!("failed to allocate private request staging")
+    }
+
+    fn path(&self) -> &Path {
+        self.path.as_deref().expect("staging remains active")
+    }
+
+    fn publish(&mut self, destination: &Path) -> Result<()> {
+        let path = self.path();
+        rename_noreplace(path, destination)
+            .with_context(|| format!("failed to publish request `{}`", destination.display()))?;
+        self.path = None;
+        Ok(())
+    }
+}
+
+impl Drop for StagingDirectory {
+    fn drop(&mut self) {
+        let Some(path) = self.path.take() else {
+            return;
+        };
+        match fs::symlink_metadata(&path) {
+            Ok(metadata) if metadata.file_type().is_symlink() || metadata.is_file() => {
+                let _ = fs::remove_file(path);
+            }
+            Ok(metadata) if metadata.is_dir() => {
+                let _ = fs::remove_dir_all(path);
+            }
+            _ => {}
+        }
+    }
+}
+
+fn create_private_directory(path: &Path) -> Result<()> {
+    let mut builder = fs::DirBuilder::new();
+    builder.mode(PRIVATE_DIRECTORY_MODE);
+    builder
+        .create(path)
+        .with_context(|| format!("failed to create private directory {}", path.display()))?;
+    validate_private_directory(path)
+}
+
+fn validate_private_directory(path: &Path) -> Result<()> {
+    let metadata = fs::symlink_metadata(path)
+        .with_context(|| format!("failed to inspect private directory {}", path.display()))?;
+    if metadata.file_type().is_symlink()
+        || !metadata.is_dir()
+        || metadata.uid() != rustix::process::getuid().as_raw()
+        || metadata.permissions().mode() & 0o777 != PRIVATE_DIRECTORY_MODE
+    {
+        bail!(
+            "private directory {} must be owner-only and unsymlinked",
+            path.display()
+        );
+    }
+    Ok(())
+}
+
+fn create_private_file(path: &Path) -> Result<File> {
+    let fd = rustix::fs::open(
+        path,
+        rustix::fs::OFlags::WRONLY
+            | rustix::fs::OFlags::CREATE
+            | rustix::fs::OFlags::EXCL
+            | rustix::fs::OFlags::CLOEXEC
+            | rustix::fs::OFlags::NOFOLLOW
+            | rustix::fs::OFlags::NONBLOCK,
+        rustix::fs::Mode::from_bits_truncate(PRIVATE_FILE_MODE as rustix::fs::RawMode),
+    )
+    .map_err(std::io::Error::from)
+    .with_context(|| format!("failed to create private file {}", path.display()))?;
+    let file = File::from(fd);
+    validate_private_file(path, &file, 0, u64::MAX)?;
+    Ok(file)
+}
+
+fn write_private_bytes(path: &Path, contents: &[u8]) -> Result<()> {
+    let mut file = create_private_file(path)?;
+    file.write_all(contents)?;
+    file.sync_all()?;
+    validate_private_file(path, &file, contents.len() as u64, contents.len() as u64)
+}
+
+fn validate_private_file(
+    path: &Path,
+    opened: &File,
+    minimum_bytes: u64,
+    maximum_bytes: u64,
+) -> Result<()> {
+    let path_metadata = fs::symlink_metadata(path)?;
+    let open_metadata = opened.metadata()?;
+    if path_metadata.file_type().is_symlink()
+        || !path_metadata.is_file()
+        || path_metadata.nlink() != 1
+        || path_metadata.uid() != rustix::process::getuid().as_raw()
+        || path_metadata.permissions().mode() & 0o777 != PRIVATE_FILE_MODE
+        || path_metadata.dev() != open_metadata.dev()
+        || path_metadata.ino() != open_metadata.ino()
+        || !(minimum_bytes..=maximum_bytes).contains(&open_metadata.len())
+    {
+        bail!("private request artifact failed its file-safety checks");
+    }
+    Ok(())
+}
+
+#[cfg(any(target_os = "linux", target_vendor = "apple"))]
+fn rename_noreplace(source: &Path, destination: &Path) -> std::io::Result<()> {
+    rustix::fs::renameat_with(
+        rustix::fs::CWD,
+        source,
+        rustix::fs::CWD,
+        destination,
+        rustix::fs::RenameFlags::NOREPLACE,
+    )
+    .map_err(std::io::Error::from)
+}
+
+#[cfg(not(any(target_os = "linux", target_vendor = "apple")))]
+fn rename_noreplace(_source: &Path, _destination: &Path) -> std::io::Result<()> {
+    Err(std::io::Error::new(
+        std::io::ErrorKind::Unsupported,
+        "atomic no-replace request publication is unsupported",
+    ))
+}
diff --git a/crates/registry-evidencectl/src/scaffold.rs b/crates/registry-evidencectl/src/scaffold.rs
new file mode 100644
index 000000000..2f131522d
--- /dev/null
+++ b/crates/registry-evidencectl/src/scaffold.rs
@@ -0,0 +1,213 @@
+//! Minimal OpenAPI-assisted Evidence project authoring.
+//!
+//! `new` retains the API description for a later question-authoring step. It
+//! does not select an operation or invent Evidence semantics, source policy,
+//! runtime configuration, or acceptance cases.
+
+use std::{
+    fs,
+    os::unix::fs::PermissionsExt as _,
+    path::{Path, PathBuf},
+    process::ExitCode,
+};
+
+use anyhow::{bail, Context as _};
+use clap::{Args, ValueEnum};
+
+use crate::{keygen, suggest};
+
+const RETAINED_OPENAPI_FILE: &str = "source.openapi.yaml";
+const SIGNING_KEY_ID: &str = "local-signing-key-1";
+
+#[derive(Clone, Debug, ValueEnum)]
+pub enum AuthoringProfile {
+    /// Development-only authoring with no deployment assurance claim.
+    Local,
+}
+
+#[derive(Debug, Args)]
+pub struct NewArgs {
+    /// New directory to create for the editable authoring project.
+    pub directory: PathBuf,
+
+    /// OpenAPI 3.0 or 3.1 document: a local path or an HTTPS URL.
+    #[arg(long)]
+    pub openapi: Option<String>,
+
+    /// Explicit development profile for OpenAPI-assisted authoring.
+    #[arg(long, value_enum, requires = "openapi")]
+    pub profile: Option<AuthoringProfile>,
+
+    /// Generate disposable, unbound local signing and HMAC material.
+    #[arg(long, requires = "openapi")]
+    pub generate_keys: bool,
+}
+
+pub fn run(args: NewArgs) -> anyhow::Result<ExitCode> {
+    let openapi = args.openapi.as_ref().context(
+        "`evidencectl new` starts from an API description; pass --openapi <path-or-https-url>",
+    )?;
+    if args.profile.is_none() {
+        bail!("OpenAPI authoring requires the explicit development profile `--profile local`");
+    }
+
+    validate_new_destination(&args.directory)?;
+    let parent = destination_parent(&args.directory)?;
+    let source = suggest::fetch::spec_source(openapi)?;
+    let (_, document) = suggest::openapi::Spec::open_retained(&source)?;
+
+    let staging = tempfile::Builder::new()
+        .prefix(".evidencectl-new-")
+        .tempdir_in(parent)
+        .with_context(|| format!("staging the project in {}", parent.display()))?;
+    let staged_root = staging.path();
+
+    write_new_file(
+        &staged_root.join(".gitignore"),
+        b"secrets/\n.evidence/\n",
+        0o644,
+    )?;
+    write_new_file(
+        &staged_root.join(RETAINED_OPENAPI_FILE),
+        document.as_bytes(),
+        0o644,
+    )?;
+    for directory in [
+        "selectors",
+        "sources",
+        "adapters",
+        "schemas",
+        "questions",
+        "derivations",
+        "fixtures",
+    ] {
+        fs::create_dir(staged_root.join(directory))
+            .with_context(|| format!("creating the empty {directory} directory"))?;
+    }
+
+    if args.generate_keys {
+        keygen::generate_scaffold_key_material(&staged_root.join("secrets"), SIGNING_KEY_ID)
+            .context("generating unbound local authoring key material")?;
+    }
+
+    fs::set_permissions(staged_root, fs::Permissions::from_mode(0o755))
+        .with_context(|| format!("setting permissions on {}", staged_root.display()))?;
+    publish(staging, &args.directory)?;
+
+    println!(
+        "Created an editable OpenAPI authoring project in {}",
+        args.directory.display()
+    );
+    println!(
+        "  OpenAPI: {} (retained exactly for question authoring)",
+        args.directory.join(RETAINED_OPENAPI_FILE).display()
+    );
+    println!(
+        "  selectors: {}",
+        args.directory.join("selectors").display()
+    );
+    println!("  sources: {}", args.directory.join("sources").display());
+    println!(
+        "  questions: {}",
+        args.directory.join("questions").display()
+    );
+    println!(
+        "  derivations: {}",
+        args.directory.join("derivations").display()
+    );
+    println!("  fixtures: {}", args.directory.join("fixtures").display());
+    if args.generate_keys {
+        println!(
+            "  keys: {} (owner-only, disposable, and unbound)",
+            args.directory.join("secrets").display()
+        );
+    }
+    println!(
+        "Next: run `evidencectl source suggest --project {}` to draft one editable source.",
+        args.directory.display()
+    );
+    println!("No question, fixture case, runtime, target, or deployment bundle was generated.");
+    Ok(ExitCode::SUCCESS)
+}
+
+fn validate_new_destination(path: &Path) -> anyhow::Result<()> {
+    match fs::symlink_metadata(path) {
+        Ok(_) => bail!(
+            "refusing to replace existing project path {}; choose a new directory",
+            path.display()
+        ),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(error) => {
+            Err(error).with_context(|| format!("inspecting project path {}", path.display()))
+        }
+    }
+}
+
+fn destination_parent(path: &Path) -> anyhow::Result<&Path> {
+    let parent = path
+        .parent()
+        .filter(|parent| !parent.as_os_str().is_empty())
+        .unwrap_or_else(|| Path::new("."));
+    let metadata = fs::symlink_metadata(parent)
+        .with_context(|| format!("inspecting project parent {}", parent.display()))?;
+    if metadata.file_type().is_symlink() || !metadata.is_dir() {
+        bail!(
+            "project parent {} must be an existing plain directory",
+            parent.display()
+        );
+    }
+    Ok(parent)
+}
+
+fn write_new_file(path: &Path, contents: &[u8], mode: u32) -> anyhow::Result<()> {
+    use std::{fs::OpenOptions, io::Write as _, os::unix::fs::OpenOptionsExt as _};
+
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent)
+            .with_context(|| format!("creating directory {}", parent.display()))?;
+    }
+    let mut file = OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(mode)
+        .open(path)
+        .with_context(|| format!("creating {}", path.display()))?;
+    file.write_all(contents)
+        .with_context(|| format!("writing {}", path.display()))?;
+    file.sync_all()
+        .with_context(|| format!("persisting {}", path.display()))
+}
+
+fn publish(staging: tempfile::TempDir, destination: &Path) -> anyhow::Result<()> {
+    let staged = staging.keep();
+    if let Err(error) = rename_noreplace(&staged, destination) {
+        let _ = fs::remove_dir_all(&staged);
+        return Err(error).with_context(|| {
+            format!(
+                "publishing the project without replacing {}",
+                destination.display()
+            )
+        });
+    }
+    Ok(())
+}
+
+#[cfg(any(target_os = "linux", target_vendor = "apple"))]
+fn rename_noreplace(source: &Path, destination: &Path) -> std::io::Result<()> {
+    rustix::fs::renameat_with(
+        rustix::fs::CWD,
+        source,
+        rustix::fs::CWD,
+        destination,
+        rustix::fs::RenameFlags::NOREPLACE,
+    )
+    .map_err(std::io::Error::from)
+}
+
+#[cfg(not(any(target_os = "linux", target_vendor = "apple")))]
+fn rename_noreplace(_source: &Path, _destination: &Path) -> std::io::Result<()> {
+    Err(std::io::Error::new(
+        std::io::ErrorKind::Unsupported,
+        "atomic no-replace project publication is unsupported on this platform",
+    ))
+}
diff --git a/crates/registry-evidencectl/src/suggest/emit.rs b/crates/registry-evidencectl/src/suggest/emit.rs
new file mode 100644
index 000000000..75e820140
--- /dev/null
+++ b/crates/registry-evidencectl/src/suggest/emit.rs
@@ -0,0 +1,1378 @@
+//! Draft Evidence source artifacts from a narrowed response schema, write
+//! them into a deployment project, and verify them against the `evidence`
+//! binary.
+//!
+//! This stage never re-derives anything the earlier pipeline stages already
+//! decided: it renders `NarrowOutcome` and the confirmed selection into
+//! files, a pasteable source block, and a report. A bound the pipeline could
+//! not resolve is never invented here either — it stays an explicit
+//! `# TODO(evidencectl):` comment, so `evidence check` keeps rejecting the
+//! draft until a human resolves it.
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fs,
+    path::{Path, PathBuf},
+    process::Command,
+};
+
+use anyhow::{bail, Context, Result};
+use serde_json::Value;
+
+use super::types::{
+    BoundKind, BoundNeed, BoundValues, DraftArtifacts, DraftFile, NarrowOutcome, OperationKey,
+    Provenance, SpecSource, SuggestedBound,
+};
+
+/// Everything the emit stage needs to draft artifacts for one source. Built
+/// from the outputs of the earlier pipeline stages (`openapi`, `flatten`,
+/// `sample`, `narrow`); this stage does not consult the OpenAPI document, the
+/// sample, or the narrowing heuristics again.
+#[derive(Debug, Clone)]
+pub struct EmitInputs {
+    /// Source identifier the caller chose. Names every emitted file and
+    /// becomes the `sources.<id>` key.
+    pub source_id: String,
+    pub operation: OperationKey,
+    /// Response status code the schema was read from.
+    pub status: String,
+    /// Response media type the schema was read from; also the `Accept`
+    /// header value in the drafted source block.
+    pub media_type: String,
+    /// An origin and path prefix derived from the OpenAPI `servers` list, when
+    /// one could be. The origin is emitted only as a commented review
+    /// suggestion. See [`split_server_url`].
+    pub base_url_suggestion: Option<ServerSuggestion>,
+    /// Selected projection pointers (extended form), in presentation order.
+    pub selection: Vec<String>,
+    pub narrowed: NarrowOutcome,
+    /// Every bound the closed subset required for this selection, each
+    /// carrying its suggestion and provenance when the pipeline could derive
+    /// one. Used to annotate resolved bounds with a `# derived from ...`
+    /// comment; a need still unresolved is already covered by
+    /// `narrowed.unresolved` and gets a TODO comment instead.
+    pub needs: Vec<BoundNeed>,
+    /// Where the OpenAPI document was read from, echoed back in
+    /// `equivalent_command`.
+    pub openapi: SpecSource,
+    /// The sample file path, if one was used, echoed back in
+    /// `equivalent_command`.
+    pub sample_path: Option<PathBuf>,
+    /// The deployment project the draft was (or would be) written into,
+    /// echoed back in `equivalent_command`.
+    pub project: Option<PathBuf>,
+}
+
+/// The outcome of running `evidence check` against a written draft.
+///
+/// Bundle-stage failures and secret/runtime-stage failures are distinguished
+/// by the runtime's own fixed stderr messages: bundle rejection prints
+/// "deployment ..." text, while secret/runtime initialization failure prints
+/// "runtime ... initialization failed" — which means the bundle itself was
+/// already accepted, only local secret material is missing.
+#[derive(Debug, Clone, PartialEq, Eq)]
+#[allow(dead_code)]
+pub enum CheckClassification {
+    /// `evidence check` passed outright.
+    BundleAccepted,
+    /// The bundle was rejected; `stderr` is the runtime's captured message.
+    BundleRejected { stderr: String },
+    /// The bundle was accepted, but local secret material has not been
+    /// provisioned yet (expected for a freshly drafted project).
+    SecretsUnprovisioned,
+}
+
+/// An OpenAPI server URL split into the two places the runtime keeps its
+/// parts: `baseUrl` is validated as an origin, so any path the server URL
+/// carried belongs on the request path instead.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ServerSuggestion {
+    /// Scheme, host and optional port, with no trailing slash.
+    pub base_url: String,
+    /// The path the server URL carried, without a trailing slash, or the
+    /// empty string when it carried none.
+    pub path_prefix: String,
+}
+
+/// Splits an OpenAPI server URL into an origin and a path prefix.
+///
+/// Returns `None` for anything that does not name one fixed origin: a URL with
+/// `{variables}`, a relative URL, or one carrying a query or fragment. The
+/// caller leaves the origin absent in that case. The origin is not otherwise
+/// validated here because it remains a review suggestion, not source policy.
+pub fn split_server_url(url: &str) -> Option<ServerSuggestion> {
+    if url.contains(['{', '}', '?', '#', ' ']) {
+        return None;
+    }
+    let (scheme, rest) = url.split_once("://")?;
+    if scheme.is_empty()
+        || !scheme.chars().all(|character| {
+            character.is_ascii_alphanumeric() || matches!(character, '+' | '-' | '.')
+        })
+    {
+        return None;
+    }
+    let (authority, path) = match rest.find('/') {
+        Some(position) => (&rest[..position], &rest[position..]),
+        None => (rest, ""),
+    };
+    if authority.is_empty() || authority.contains('@') {
+        return None;
+    }
+    let path_prefix = path.trim_end_matches('/');
+    Some(ServerSuggestion {
+        base_url: format!("{scheme}://{authority}"),
+        path_prefix: path_prefix.to_owned(),
+    })
+}
+
+/// The get_path pointer byte-length ceiling the runtime enforces.
+const GET_PATH_MAX_BYTES: usize = 256;
+/// The get_path pointer segment-count ceiling the runtime enforces.
+const GET_PATH_MAX_SEGMENTS: usize = 16;
+
+/// The two methods an Evidence fixed request admits.
+const ADMITTED_METHODS: [&str; 2] = ["GET", "POST"];
+
+/// Draft the response schema, extract-script skeleton, facts-schema stub,
+/// pasteable source block, human report, and equivalent command for one
+/// source, from already-decided inputs.
+pub fn draft(inputs: &EmitInputs) -> Result<DraftArtifacts> {
+    let method = request_method(&inputs.operation.method)?;
+
+    let mut get_paths = Vec::with_capacity(inputs.selection.len());
+    for pointer in &inputs.selection {
+        let derived = get_path_pointer(pointer).with_context(|| {
+            format!(
+                "preparing the extract script for source `{}`",
+                inputs.source_id
+            )
+        })?;
+        get_paths.push((pointer.clone(), derived));
+    }
+
+    let files = vec![
+        DraftFile {
+            bundle_relative_path: format!("adapters/{}-prepare.rhai", inputs.source_id),
+            contents: render_prepare_script(),
+        },
+        DraftFile {
+            bundle_relative_path: format!("schemas/{}-parameters.schema.yaml", inputs.source_id),
+            contents: render_parameters_schema(),
+        },
+        DraftFile {
+            bundle_relative_path: format!("schemas/{}-response.schema.yaml", inputs.source_id),
+            contents: render_response_schema(inputs),
+        },
+        DraftFile {
+            bundle_relative_path: format!("adapters/{}-extract.rhai", inputs.source_id),
+            contents: render_extract_script(inputs, &get_paths),
+        },
+        DraftFile {
+            bundle_relative_path: format!("schemas/{}-facts.schema.yaml", inputs.source_id),
+            contents: render_facts_schema(&inputs.source_id),
+        },
+    ];
+
+    Ok(DraftArtifacts {
+        source_id: inputs.source_id.clone(),
+        files,
+        authoring_source: render_authoring_source(inputs),
+        source_block: render_source_block(inputs, method),
+        report: render_report(inputs),
+        equivalent_command: render_equivalent_command(inputs),
+    })
+}
+
+fn render_prepare_script() -> String {
+    r#"fn prepare(selectors, parameters) {
+    // TODO(evidencectl): bind only reviewed selector fields and fixed parameters.
+    #{query: [], body: ()}
+}
+"#
+    .to_owned()
+}
+
+fn render_parameters_schema() -> String {
+    r#"type: object
+additionalProperties: false
+required: []
+properties: {}
+"#
+    .to_owned()
+}
+
+/// Checks the operation's method against the runtime's fixed-request method
+/// enumeration, which holds two members. Anything else is refused by name
+/// rather than drafted into a source the runtime would reject.
+pub fn request_method(method: &str) -> Result<&'static str> {
+    let upper = method.to_ascii_uppercase();
+    ADMITTED_METHODS
+        .into_iter()
+        .find(|admitted| *admitted == upper)
+        .ok_or_else(|| {
+            anyhow::anyhow!(
+                "an Evidence fixed request declares method GET or POST; `{method}` is outside \
+                 that enumeration, so no source can call this operation"
+            )
+        })
+}
+
+/// The request path the source declares: the OpenAPI operation path with the
+/// server URL's path prefix, if any, in front of it.
+fn request_path(inputs: &EmitInputs) -> String {
+    let prefix = inputs
+        .base_url_suggestion
+        .as_ref()
+        .map(|server| server.path_prefix.as_str())
+        .unwrap_or_default();
+    format!("{prefix}{}", inputs.operation.path)
+}
+
+/// Write every draft file under `<project>/bundle/`, creating parent
+/// directories as needed. Refuses to overwrite any existing file: if any
+/// target already exists, nothing is written and the error lists every
+/// collision so the caller can resolve them all at once.
+#[allow(dead_code)]
+pub fn write_into_project(project: &Path, files: &[DraftFile]) -> Result<Vec<PathBuf>> {
+    let bundle_directory = project.join("bundle");
+    let targets: Vec<PathBuf> = files
+        .iter()
+        .map(|file| bundle_directory.join(&file.bundle_relative_path))
+        .collect();
+
+    let collisions: Vec<String> = targets
+        .iter()
+        .filter(|path| path.exists())
+        .map(|path| path.display().to_string())
+        .collect();
+    if !collisions.is_empty() {
+        bail!(
+            "refusing to overwrite existing file(s): {}",
+            collisions.join(", ")
+        );
+    }
+
+    for (file, target) in files.iter().zip(&targets) {
+        if let Some(parent) = target.parent() {
+            fs::create_dir_all(parent)
+                .with_context(|| format!("creating the directory {}", parent.display()))?;
+        }
+        fs::write(target, &file.contents)
+            .with_context(|| format!("writing {}", target.display()))?;
+    }
+    Ok(targets)
+}
+
+/// Write one complete editable source draft into an authoring project.
+///
+/// The authoring project owns this layout. The deployment-shaped print-only
+/// draft remains available without `--project`, but local `dev` consumes this
+/// source directory directly after its explicit review fields are completed.
+pub fn write_into_authoring_project(
+    project: &Path,
+    artifacts: &DraftArtifacts,
+) -> Result<Vec<PathBuf>> {
+    for directory in ["sources", "adapters", "schemas"] {
+        let path = project.join(directory);
+        let metadata = fs::symlink_metadata(&path)
+            .with_context(|| format!("inspecting authoring directory {}", path.display()))?;
+        if metadata.file_type().is_symlink() || !metadata.is_dir() {
+            bail!(
+                "authoring directory {} must be a plain directory created by `evidencectl new`",
+                path.display()
+            );
+        }
+    }
+    let source_path = project
+        .join("sources")
+        .join(format!("{}.yaml", artifacts.source_id));
+    let mut targets = vec![source_path];
+    targets.extend(
+        artifacts
+            .files
+            .iter()
+            .map(|file| project.join(&file.bundle_relative_path)),
+    );
+
+    let collisions = targets
+        .iter()
+        .filter(|path| path.exists())
+        .map(|path| path.display().to_string())
+        .collect::<Vec<_>>();
+    if !collisions.is_empty() {
+        bail!(
+            "refusing to overwrite existing file(s): {}",
+            collisions.join(", ")
+        );
+    }
+    let mut contents = vec![artifacts.authoring_source.as_bytes()];
+    contents.extend(artifacts.files.iter().map(|file| file.contents.as_bytes()));
+    let mut written = Vec::new();
+    for (target, contents) in targets.iter().zip(contents) {
+        if let Err(error) = write_new_authoring_file(target, contents) {
+            for path in &written {
+                let _ = fs::remove_file(path);
+            }
+            return Err(error);
+        }
+        written.push(target.clone());
+    }
+    Ok(targets)
+}
+
+fn write_new_authoring_file(path: &Path, contents: &[u8]) -> Result<()> {
+    use std::{fs::OpenOptions, io::Write as _, os::unix::fs::OpenOptionsExt as _};
+
+    let mut file = OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(0o644)
+        .open(path)
+        .with_context(|| format!("creating {}", path.display()))?;
+    file.write_all(contents)
+        .with_context(|| format!("writing {}", path.display()))?;
+    file.sync_all()
+        .with_context(|| format!("persisting {}", path.display()))
+}
+
+/// Run `evidence --runtime <project>/runtime.yaml check` and classify the
+/// result. `evidence_bin` resolves the same way as the other `evidencectl`
+/// subcommands that shell out to the runtime binary: an explicit path, else
+/// `EVIDENCE_BIN`, else the first `evidence` found on `PATH`.
+#[allow(dead_code)]
+pub fn verify(project: &Path, evidence_bin: Option<&Path>) -> Result<CheckClassification> {
+    let evidence_bin = crate::fixtures::resolve_evidence_binary(evidence_bin)
+        .context("resolving the evidence binary")?;
+    let runtime_path = project.join("runtime.yaml");
+
+    let output = Command::new(&evidence_bin)
+        .arg("--runtime")
+        .arg(&runtime_path)
+        .arg("check")
+        .output()
+        .with_context(|| format!("failed to run {}", evidence_bin.display()))?;
+
+    if output.status.success() {
+        return Ok(CheckClassification::BundleAccepted);
+    }
+
+    let stderr = String::from_utf8_lossy(&output.stderr).into_owned();
+    if is_secrets_unprovisioned(&stderr) {
+        return Ok(CheckClassification::SecretsUnprovisioned);
+    }
+    Ok(CheckClassification::BundleRejected { stderr })
+}
+
+/// The runtime initialization stages that fail only because local secret or
+/// key material has not been provisioned yet. Reaching any of them means the
+/// bundle itself was already accepted.
+///
+/// The list is exact rather than a `runtime ... initialization failed` shape,
+/// because the runtime reports bundle, source and rate-limit failures through
+/// the same shape. Matching the shape would report a draft the runtime refused
+/// as a success.
+#[allow(dead_code)]
+const SECRET_STAGE_MESSAGES: [&str; 3] = [
+    "evidence: runtime secret initialization failed",
+    "evidence: runtime audit initialization failed",
+    "evidence: runtime signing initialization failed",
+];
+
+/// True when `stderr` names one of [`SECRET_STAGE_MESSAGES`].
+///
+/// The comparison is a prefix so a stage message that grows a trailing reason
+/// still classifies; the stage name itself is still matched in full.
+#[allow(dead_code)]
+fn is_secrets_unprovisioned(stderr: &str) -> bool {
+    let trimmed = stderr.trim();
+    SECRET_STAGE_MESSAGES
+        .iter()
+        .any(|message| trimmed.starts_with(message))
+}
+
+/// Derive a plain RFC 6901 `get_path` pointer from an extended projection
+/// pointer by substituting `0` for every `*` wildcard segment, then enforce
+/// the runtime's byte-length and segment-count ceilings.
+fn get_path_pointer(extended_pointer: &str) -> Result<String> {
+    let derived = extended_pointer
+        .split('/')
+        .map(|segment| if segment == "*" { "0" } else { segment })
+        .collect::<Vec<_>>()
+        .join("/");
+
+    if derived.len() > GET_PATH_MAX_BYTES {
+        bail!(
+            "selection pointer {extended_pointer} produces a get_path pointer of {} bytes, exceeding the {GET_PATH_MAX_BYTES}-byte ceiling",
+            derived.len()
+        );
+    }
+    let segment_count = derived.split('/').filter(|s| !s.is_empty()).count();
+    if segment_count > GET_PATH_MAX_SEGMENTS {
+        bail!(
+            "selection pointer {extended_pointer} produces a get_path pointer of {segment_count} segments, exceeding the {GET_PATH_MAX_SEGMENTS}-segment ceiling"
+        );
+    }
+    Ok(derived)
+}
+
+fn escape_pointer_segment(segment: &str) -> String {
+    segment.replace('~', "~0").replace('/', "~1")
+}
+
+/// How a derived bound is described wherever it is reported: in a schema
+/// comment, in the report, and in the auto-acceptance notes a flag-driven run
+/// prints. One phrasing keeps those three consistent.
+///
+/// [`Provenance::Operator`] has no label here, because a value the operator
+/// typed was not derived from anything: it is reported separately, and calling
+/// it a derivation would misattribute a human decision to the tool.
+pub(super) fn provenance_label(provenance: &Provenance) -> Option<&'static str> {
+    match provenance {
+        Provenance::Spec => Some("the OpenAPI schema"),
+        Provenance::Format => Some("its declared format"),
+        Provenance::Sample => Some("the sample response (widened)"),
+        Provenance::PageSize => Some("a page-size parameter in the spec"),
+        Provenance::SubsetCeiling => {
+            Some("the subset ceiling, because the document states a larger bound")
+        }
+        Provenance::Operator => None,
+    }
+}
+
+/// The comment written above a bound the operator chose themselves.
+const OPERATOR_CHOICE_COMMENT: &str = "# chosen at the prompt";
+
+/// The caution shown wherever a bound the tool guessed is announced.
+///
+/// Only a sampled integer earns one. A page of results says how long that page
+/// was, but an integer field is usually a counter, and the highest value one
+/// response happened to carry is no statement about how high it can climb;
+/// under-sizing that ceiling rejects real responses later. Every other
+/// derivation reads a stated bound rather than guessing at one.
+pub(super) fn review_note(kind: &BoundKind, provenance: &Provenance) -> Option<&'static str> {
+    match (kind, provenance) {
+        (BoundKind::IntegerRange, Provenance::Sample) => {
+            Some("a counter usually needs a more generous ceiling than one response shows")
+        }
+        _ => None,
+    }
+}
+
+/// Re-attributes to the operator every bound whose accepted value differs from
+/// what the pipeline suggested, so the draft's comments and the report describe
+/// what actually happened.
+///
+/// A suggestion adopted unchanged keeps its real provenance: the operator
+/// confirming a derivation does not make the derivation theirs. A need the
+/// operator answered where nothing was suggested, and one whose suggestion they
+/// edited, both become [`Provenance::Operator`] carrying the accepted value.
+pub fn attribute_operator_edits(
+    needs: &mut [BoundNeed],
+    resolutions: &BTreeMap<(String, BoundKind), BoundValues>,
+) {
+    for need in needs.iter_mut() {
+        let key = (need.pointer.clone(), need.kind.clone());
+        let Some(accepted) = resolutions.get(&key) else {
+            continue;
+        };
+        if need
+            .suggestion
+            .as_ref()
+            .is_some_and(|suggestion| &suggestion.values == accepted)
+        {
+            continue;
+        }
+        need.suggestion = Some(SuggestedBound {
+            values: accepted.clone(),
+            provenance: Provenance::Operator,
+        });
+    }
+}
+
+/// Tracks which (pointer, kind) bound needs are still unresolved (get a TODO
+/// comment) versus resolved with known provenance (get a "derived from"
+/// comment), so the schema renderer can annotate each node as it recurses.
+struct SchemaAnnotations {
+    unresolved: BTreeSet<(String, BoundKind)>,
+    provenance: BTreeMap<(String, BoundKind), Provenance>,
+}
+
+impl SchemaAnnotations {
+    fn new(narrowed: &NarrowOutcome, needs: &[BoundNeed]) -> Self {
+        let unresolved: BTreeSet<(String, BoundKind)> = narrowed
+            .unresolved
+            .iter()
+            .map(|need| (need.pointer.clone(), need.kind.clone()))
+            .collect();
+
+        let mut provenance = BTreeMap::new();
+        for need in needs {
+            let key = (need.pointer.clone(), need.kind.clone());
+            if unresolved.contains(&key) {
+                continue;
+            }
+            if let Some(suggestion) = &need.suggestion {
+                provenance.insert(key, suggestion.provenance.clone());
+            }
+        }
+
+        Self {
+            unresolved,
+            provenance,
+        }
+    }
+
+    fn comment_for(&self, pointer: &str, kind: BoundKind) -> Option<String> {
+        let key = (pointer.to_owned(), kind.clone());
+        if self.unresolved.contains(&key) {
+            return Some(format!(
+                "# TODO(evidencectl): {} needs {}",
+                display_pointer(pointer),
+                kind.label()
+            ));
+        }
+        self.provenance.get(&key).map(|provenance| {
+            provenance_label(provenance).map_or_else(
+                || OPERATOR_CHOICE_COMMENT.to_owned(),
+                |label| format!("# derived from {label}"),
+            )
+        })
+    }
+}
+
+/// Renders a pointer for a message, naming the root rather than printing an
+/// empty string. Matches the wording `narrow` and `flatten` already use.
+fn display_pointer(pointer: &str) -> &str {
+    if pointer.is_empty() {
+        "(response root)"
+    } else {
+        pointer
+    }
+}
+
+fn push_line(out: &mut String, indent: usize, text: &str) {
+    for _ in 0..indent {
+        out.push_str("  ");
+    }
+    out.push_str(text);
+    out.push('\n');
+}
+
+fn yaml_scalar_string(value: &str) -> String {
+    quote_if(value, needs_yaml_quoting(value))
+}
+
+/// A scalar written inside a flow sequence. There `,`, `[`, `]`, `{` and `}`
+/// are significant wherever they appear, not only at the start of the scalar:
+/// an unquoted `pending, review` would read as two members.
+fn yaml_flow_scalar_string(value: &str) -> String {
+    let quoted = needs_yaml_quoting(value) || value.contains([',', '[', ']', '{', '}']);
+    quote_if(value, quoted)
+}
+
+fn quote_if(value: &str, quoted: bool) -> String {
+    if quoted {
+        format!("\"{}\"", escape_double_quoted(value))
+    } else {
+        value.to_owned()
+    }
+}
+
+/// Escapes `value` for the interior of a double-quoted YAML or Rhai string.
+///
+/// One function serves both because the two grammars agree on every escape
+/// used here: `\\`, `\"`, `\n`, `\r`, `\t`, and `\xNN` for the remaining
+/// control characters, all of which are below `U+00A0` and so fit two hex
+/// digits.
+///
+/// Every value passed here originates in the OpenAPI document: property names,
+/// media types, enum members. A property name may legally contain a quote, a
+/// backslash or a control character, and none of those may reach the output
+/// raw. A raw newline folds a YAML scalar (turning the rest of the value into
+/// a sibling mapping entry) and terminates a Rhai literal; a raw quote ends
+/// either one early.
+fn escape_double_quoted(value: &str) -> String {
+    let mut escaped = String::with_capacity(value.len());
+    for character in value.chars() {
+        match character {
+            '\\' => escaped.push_str(r"\\"),
+            '"' => escaped.push_str("\\\""),
+            '\n' => escaped.push_str(r"\n"),
+            '\r' => escaped.push_str(r"\r"),
+            '\t' => escaped.push_str(r"\t"),
+            control if control.is_control() => {
+                escaped.push_str(&format!(r"\x{:02x}", control as u32));
+            }
+            other => escaped.push(other),
+        }
+    }
+    escaped
+}
+
+/// Renders `value` as a complete double-quoted Rhai string literal.
+fn rhai_string_literal(value: &str) -> String {
+    format!("\"{}\"", escape_double_quoted(value))
+}
+
+fn needs_yaml_quoting(value: &str) -> bool {
+    if value.is_empty() {
+        return true;
+    }
+    if matches!(
+        value,
+        "true" | "false" | "null" | "~" | "yes" | "no" | "Yes" | "No" | "TRUE" | "FALSE" | "NULL"
+    ) {
+        return true;
+    }
+    if value.trim() != value {
+        return true;
+    }
+    if value.parse::<f64>().is_ok() {
+        return true;
+    }
+    let first = value.chars().next().expect("checked non-empty above");
+    if matches!(
+        first,
+        '-' | '?'
+            | ':'
+            | ','
+            | '['
+            | ']'
+            | '{'
+            | '}'
+            | '#'
+            | '&'
+            | '*'
+            | '!'
+            | '|'
+            | '>'
+            | '\''
+            | '"'
+            | '%'
+            | '@'
+            | '`'
+    ) {
+        return true;
+    }
+    // A bare colon or hash is fine in a plain scalar (e.g. `https://...`); it
+    // is only ambiguous with a mapping key or a comment when followed by
+    // whitespace, or when a colon ends the scalar entirely.
+    if value.contains(": ") || value.ends_with(':') || value.contains(" #") {
+        return true;
+    }
+    // Any control character, not just a newline: a plain scalar carrying one
+    // either folds or is rejected outright, and the quoted form escapes it.
+    value.chars().any(char::is_control)
+}
+
+fn render_key(key: &str) -> String {
+    yaml_scalar_string(key)
+}
+
+fn render_scalar(value: &Value) -> String {
+    render_scalar_with(value, yaml_scalar_string)
+}
+
+fn render_flow_scalar(value: &Value) -> String {
+    render_scalar_with(value, yaml_flow_scalar_string)
+}
+
+fn render_scalar_with(value: &Value, quote: fn(&str) -> String) -> String {
+    match value {
+        Value::String(s) => quote(s),
+        Value::Number(n) => n.to_string(),
+        Value::Bool(b) => b.to_string(),
+        Value::Null => "null".to_owned(),
+        other => other.to_string(),
+    }
+}
+
+fn render_flow_list(items: &[Value]) -> String {
+    let rendered: Vec<String> = items.iter().map(render_flow_scalar).collect();
+    format!("[{}]", rendered.join(", "))
+}
+
+/// A `const` value, which the closed subset admits as a scalar or as a
+/// sequence (an array node may be pinned to one exact list).
+fn render_const_value(value: &Value) -> String {
+    match value {
+        Value::Array(items) => render_flow_list(items),
+        other => render_scalar(other),
+    }
+}
+
+fn render_type(value: &Value) -> String {
+    match value {
+        Value::String(s) => s.clone(),
+        Value::Array(items) => render_flow_list(items),
+        other => render_scalar(other),
+    }
+}
+
+fn primary_type_name(object: &serde_json::Map<String, Value>) -> Option<&str> {
+    match object.get("type") {
+        Some(Value::String(s)) => Some(s.as_str()),
+        Some(Value::Array(items)) => items
+            .iter()
+            .filter_map(Value::as_str)
+            .find(|s| *s != "null"),
+        _ => None,
+    }
+}
+
+fn bound_kind_of(object: &serde_json::Map<String, Value>) -> Option<BoundKind> {
+    match primary_type_name(object) {
+        Some("array") => Some(BoundKind::ArrayMaxItems),
+        Some("integer") => Some(BoundKind::IntegerRange),
+        Some("string") => Some(BoundKind::StringLength),
+        _ => None,
+    }
+}
+
+fn render_response_schema(inputs: &EmitInputs) -> String {
+    let annotations = SchemaAnnotations::new(&inputs.narrowed, &inputs.needs);
+    let mut out = String::new();
+    push_line(
+        &mut out,
+        0,
+        &format!(
+            "# Closed schema for the projected response of {}. The runtime checks it",
+            inputs.source_id
+        ),
+    );
+    push_line(
+        &mut out,
+        0,
+        "# before the extract script runs, so the script maps a response whose shape",
+    );
+    push_line(
+        &mut out,
+        0,
+        "# it can rely on and never re-checks presence or type by hand.",
+    );
+    push_line(&mut out, 0, "#");
+    push_line(
+        &mut out,
+        0,
+        "# Generated by `evidencectl source suggest`. Every TODO below blocks",
+    );
+    push_line(
+        &mut out,
+        0,
+        "# `evidence check` until it is resolved by hand; every \"derived from\" comment",
+    );
+    push_line(
+        &mut out,
+        0,
+        "# states where a bound came from so it can be reviewed rather than trusted",
+    );
+    push_line(&mut out, 0, "# blindly.");
+    // A response body that is itself an array needs a `maxItems` like any other
+    // array, but the root node has no property line to hang the comment on:
+    // `render_schema_node` annotates children only. It is annotated here or
+    // nowhere.
+    if let Some(kind) = inputs.narrowed.schema.as_object().and_then(bound_kind_of) {
+        if let Some(comment) = annotations.comment_for("", kind) {
+            push_line(&mut out, 0, &comment);
+        }
+    }
+    render_schema_node(&inputs.narrowed.schema, "", 0, &annotations, &mut out);
+    out
+}
+
+fn render_schema_node(
+    node: &Value,
+    pointer: &str,
+    indent: usize,
+    annotations: &SchemaAnnotations,
+    out: &mut String,
+) {
+    let Some(object) = node.as_object() else {
+        return;
+    };
+    if let Some(type_value) = object.get("type") {
+        push_line(out, indent, &format!("type: {}", render_type(type_value)));
+    }
+    match primary_type_name(object) {
+        Some("object") => {
+            if let Some(additional) = object.get("additionalProperties") {
+                push_line(
+                    out,
+                    indent,
+                    &format!("additionalProperties: {}", render_scalar(additional)),
+                );
+            }
+            if let Some(required) = object.get("required").and_then(Value::as_array) {
+                push_line(
+                    out,
+                    indent,
+                    &format!("required: {}", render_flow_list(required)),
+                );
+            }
+            if let Some(properties) = object.get("properties").and_then(Value::as_object) {
+                push_line(out, indent, "properties:");
+                for (key, child) in properties {
+                    let child_pointer = format!("{pointer}/{}", escape_pointer_segment(key));
+                    if let Some(kind) = child.as_object().and_then(bound_kind_of) {
+                        if let Some(comment) = annotations.comment_for(&child_pointer, kind) {
+                            push_line(out, indent + 1, &comment);
+                        }
+                    }
+                    push_line(out, indent + 1, &format!("{}:", render_key(key)));
+                    render_schema_node(child, &child_pointer, indent + 2, annotations, out);
+                }
+            }
+        }
+        Some("array") => {
+            if let Some(min_items) = object.get("minItems") {
+                push_line(
+                    out,
+                    indent,
+                    &format!("minItems: {}", render_scalar(min_items)),
+                );
+            }
+            if let Some(max_items) = object.get("maxItems") {
+                push_line(
+                    out,
+                    indent,
+                    &format!("maxItems: {}", render_scalar(max_items)),
+                );
+            }
+            if object.get("uniqueItems").and_then(Value::as_bool) == Some(true) {
+                push_line(out, indent, "uniqueItems: true");
+            }
+            if let Some(const_value) = object.get("const") {
+                push_line(
+                    out,
+                    indent,
+                    &format!("const: {}", render_const_value(const_value)),
+                );
+            }
+            if let Some(items) = object.get("items") {
+                // An array of scalars never reaches the object-properties loop
+                // below, so a bound demanded of the items node is annotated
+                // here or nowhere.
+                let child_pointer = format!("{pointer}/*");
+                if let Some(kind) = items.as_object().and_then(bound_kind_of) {
+                    if let Some(comment) = annotations.comment_for(&child_pointer, kind) {
+                        push_line(out, indent, &comment);
+                    }
+                }
+                push_line(out, indent, "items:");
+                render_schema_node(items, &child_pointer, indent + 1, annotations, out);
+            }
+        }
+        _ => {
+            for key in ["minimum", "maximum", "minLength", "maxLength"] {
+                if let Some(value) = object.get(key) {
+                    push_line(out, indent, &format!("{key}: {}", render_scalar(value)));
+                }
+            }
+            if let Some(format_value) = object.get("format") {
+                push_line(
+                    out,
+                    indent,
+                    &format!("format: {}", render_scalar(format_value)),
+                );
+            }
+            if let Some(enum_values) = object.get("enum").and_then(Value::as_array) {
+                push_line(
+                    out,
+                    indent,
+                    &format!("enum: {}", render_flow_list(enum_values)),
+                );
+            }
+            if let Some(const_value) = object.get("const") {
+                push_line(
+                    out,
+                    indent,
+                    &format!("const: {}", render_const_value(const_value)),
+                );
+            }
+        }
+    }
+}
+
+fn render_facts_schema(source_id: &str) -> String {
+    let mut out = String::new();
+    push_line(
+        &mut out,
+        0,
+        "# Closed schema for the facts extraction may hand to the derivation for",
+    );
+    push_line(
+        &mut out,
+        0,
+        &format!("# {source_id}. Extraction output that does not match exactly is"),
+    );
+    push_line(&mut out, 0, "# rejected before any derivation runs.");
+    push_line(&mut out, 0, "#");
+    push_line(
+        &mut out,
+        0,
+        "# TODO(evidencectl): replace placeholder_fact with the real fact(s) this",
+    );
+    push_line(
+        &mut out,
+        0,
+        "# source's extract script produces, and give each one real bounds.",
+    );
+    push_line(&mut out, 0, "type: object");
+    push_line(&mut out, 0, "additionalProperties: false");
+    push_line(&mut out, 0, "required: [placeholder_fact]");
+    push_line(&mut out, 0, "properties:");
+    push_line(
+        &mut out,
+        1,
+        "# TODO(evidencectl): rename and bound this placeholder fact.",
+    );
+    push_line(&mut out, 1, "placeholder_fact:");
+    push_line(&mut out, 2, "type: string");
+    push_line(&mut out, 2, "minLength: 1");
+    push_line(&mut out, 2, "maxLength: 256");
+    out
+}
+
+/// The commented loop sketch shown beside a selection that crosses an array,
+/// as `(indentation, code)` pairs.
+///
+/// Every construct in it is one the runtime's Rhai engine actually registers:
+/// an array is reached by its own pointer with `get_path`, guarded with
+/// `is_missing`, and iterated with `for`. The engine disables ranges, exposes
+/// `len` as a property rather than a method, and defines no `string + integer`
+/// operator, so a sketch built from any of those would not run if pasted.
+///
+/// Each array the pointer crosses is named by its own pointer relative to the
+/// element that contains it, so a nested array is reached from the outer
+/// element rather than from the response root.
+fn loop_sketch(extended_pointer: &str) -> Vec<(usize, String)> {
+    let parts: Vec<&str> = extended_pointer.split("/*").collect();
+    let Some((remainder, arrays)) = parts.split_last() else {
+        return Vec::new();
+    };
+    if arrays.is_empty() {
+        return Vec::new();
+    }
+
+    let mut lines = Vec::new();
+    let mut indent = 4;
+    for (depth, array_pointer) in arrays.iter().enumerate() {
+        let level = depth + 1;
+        let container = if depth == 0 {
+            "source_response".to_owned()
+        } else {
+            format!("element_{depth}")
+        };
+        lines.push((
+            indent,
+            format!("let items_{level} = get_path({container}, \"{array_pointer}\");"),
+        ));
+        lines.push((indent, format!("if !is_missing(items_{level}) {{")));
+        indent += 4;
+        lines.push((indent, format!("for element_{level} in items_{level} {{")));
+        indent += 4;
+    }
+
+    let innermost = arrays.len();
+    if remainder.is_empty() {
+        lines.push((
+            indent,
+            format!("// element_{innermost} is the value at {extended_pointer}"),
+        ));
+    } else {
+        lines.push((
+            indent,
+            format!("let value = get_path(element_{innermost}, \"{remainder}\");"),
+        ));
+        lines.push((indent, "// ...".to_owned()));
+    }
+    for _ in arrays {
+        indent -= 4;
+        lines.push((indent, "}".to_owned()));
+        indent -= 4;
+        lines.push((indent, "}".to_owned()));
+    }
+    lines
+}
+
+fn render_extract_script(inputs: &EmitInputs, get_paths: &[(String, String)]) -> String {
+    let mut out = String::new();
+    push_line(
+        &mut out,
+        0,
+        "// Fact extraction skeleton generated by `evidencectl source suggest` for",
+    );
+    push_line(
+        &mut out,
+        0,
+        &format!("// {} {}.", inputs.operation.method, inputs.operation.path),
+    );
+    push_line(
+        &mut out,
+        0,
+        "// The response schema has already rejected anything outside its declared",
+    );
+    push_line(
+        &mut out,
+        0,
+        "// shape, so get_path below never needs a presence or type check beyond",
+    );
+    push_line(
+        &mut out,
+        0,
+        "// is_missing. What remains is deciding how the selected leaves relate, which",
+    );
+    push_line(
+        &mut out,
+        0,
+        "// cardinality outcome they mean, and which facts the derivation needs.",
+    );
+    push_line(&mut out, 0, "//");
+    push_line(
+        &mut out,
+        0,
+        "// TODO(evidencectl): decide how this response distinguishes zero, one, and",
+    );
+    push_line(
+        &mut out,
+        0,
+        "// multiple matches, and return the matching outcome instead of the",
+    );
+    push_line(&mut out, 0, "// unconditional match below.");
+    push_line(&mut out, 0, "fn extract(source_response, parameters) {");
+
+    for (index, (extended_pointer, get_path_pointer)) in get_paths.iter().enumerate() {
+        let variable = format!("leaf_{}", index + 1);
+        push_line(
+            &mut out,
+            1,
+            &format!(
+                "let {variable} = get_path(source_response, {});",
+                rhai_string_literal(get_path_pointer)
+            ),
+        );
+        push_line(&mut out, 1, &format!("if is_missing({variable}) {{"));
+        push_line(
+            &mut out,
+            2,
+            &format!("// TODO(evidencectl): decide what an absent {extended_pointer} means here."),
+        );
+        push_line(&mut out, 1, "}");
+        if extended_pointer.contains('*') {
+            push_line(
+                &mut out,
+                1,
+                &format!("// TODO(evidencectl): {extended_pointer} is under an array; the index 0"),
+            );
+            push_line(
+                &mut out,
+                1,
+                "// pointer above only reaches the first element. Iterate every element once",
+            );
+            push_line(
+                &mut out,
+                1,
+                "// the cardinality check above is written, for example:",
+            );
+            for (sketch_indent, code) in loop_sketch(extended_pointer) {
+                let padding = " ".repeat(sketch_indent);
+                push_line(&mut out, 1, &format!("// {padding}{code}"));
+            }
+        }
+        out.push('\n');
+    }
+
+    push_line(&mut out, 1, "#{outcome: \"match\", facts: #{}}");
+    out.push_str("}\n");
+    out
+}
+
+/// Render only facts established mechanically by the selected OpenAPI
+/// operation. Governed source policy remains absent rather than receiving a
+/// plausible-looking default.
+fn render_source_block(inputs: &EmitInputs, method: &str) -> String {
+    let mut out = String::new();
+    push_line(&mut out, 0, "sources:");
+    push_line(&mut out, 1, &format!("{}:", render_key(&inputs.source_id)));
+    push_line(&mut out, 2, "transport: http-json");
+    match &inputs.base_url_suggestion {
+        Some(server) => {
+            push_line(
+                &mut out,
+                2,
+                "# Review the OpenAPI server origin before adding it to source policy:",
+            );
+            push_line(
+                &mut out,
+                2,
+                &format!("# baseUrl: {}", yaml_scalar_string(&server.base_url)),
+            );
+        }
+        None => push_line(
+            &mut out,
+            2,
+            "# Add a reviewed fixed baseUrl; the OpenAPI document gives no fixed origin.",
+        ),
+    }
+    push_line(&mut out, 2, "request:");
+    push_line(&mut out, 3, &format!("method: {method}"));
+    let path = request_path(inputs);
+    if path.contains(['{', '}']) {
+        push_line(
+            &mut out,
+            3,
+            &format!("pathTemplate: {}", yaml_scalar_string(&path)),
+        );
+    } else {
+        push_line(&mut out, 3, &format!("path: {}", yaml_scalar_string(&path)));
+    }
+    push_line(&mut out, 3, "fixedHeaders:");
+    push_line(&mut out, 4, "- name: Accept");
+    push_line(
+        &mut out,
+        5,
+        &format!("value: {}", yaml_scalar_string(&inputs.media_type)),
+    );
+    let selection_values: Vec<Value> = inputs
+        .selection
+        .iter()
+        .cloned()
+        .map(Value::String)
+        .collect();
+    push_line(
+        &mut out,
+        3,
+        &format!("projection: {}", render_flow_list(&selection_values)),
+    );
+    push_line(
+        &mut out,
+        2,
+        &format!(
+            "responseSchema: schemas/{}-response.schema.yaml",
+            inputs.source_id
+        ),
+    );
+    push_line(
+        &mut out,
+        2,
+        &format!("extractScript: adapters/{}-extract.rhai", inputs.source_id),
+    );
+    push_line(
+        &mut out,
+        2,
+        &format!("factSchema: schemas/{}-facts.schema.yaml", inputs.source_id),
+    );
+    out
+}
+
+/// Render the existing V1 source object without a surrounding `sources` map.
+/// This keeps the authoring artifact identical to the runtime contract.
+fn render_authoring_source(inputs: &EmitInputs) -> String {
+    let mechanical = render_source_block(
+        inputs,
+        request_method(&inputs.operation.method).expect("validated method"),
+    );
+    let mut out = String::new();
+    for line in mechanical
+        .lines()
+        .skip(2)
+        .map(|line| line.strip_prefix("    ").unwrap_or(line))
+    {
+        if line == "request:" {
+            push_line(
+                &mut out,
+                0,
+                "# Replace review-required with source-derived, field-projected, or record-transformed.",
+            );
+            push_line(&mut out, 0, "posture: review-required");
+            push_line(
+                &mut out,
+                0,
+                "# Choose an authentication kind and logical secret:file references.",
+            );
+            push_line(&mut out, 0, "authentication: {kind: review-required}");
+        }
+        push_line(&mut out, 0, line);
+        if line.starts_with("  projection:") {
+            push_line(
+                &mut out,
+                1,
+                "# Declare selectorInputs and any complete-segment pathBindings before running dev.",
+            );
+            push_line(&mut out, 1, "selectorInputs: []");
+            push_line(
+                &mut out,
+                1,
+                &format!("prepareScript: adapters/{}-prepare.rhai", inputs.source_id),
+            );
+            push_line(&mut out, 1, "adapterParameters: {}");
+            push_line(
+                &mut out,
+                1,
+                &format!(
+                    "adapterParametersSchema: schemas/{}-parameters.schema.yaml",
+                    inputs.source_id
+                ),
+            );
+            push_line(&mut out, 1, "preparationLimits:");
+            push_line(&mut out, 2, "query: allowed");
+            push_line(&mut out, 2, "jsonBody: forbidden");
+            push_line(&mut out, 2, "maximumNormalizedBytes: 4096");
+            push_line(&mut out, 1, "redirects: deny");
+            push_line(&mut out, 1, "timeoutMilliseconds: 3000");
+            push_line(&mut out, 1, "maximumResponseBytes: 65536");
+            push_line(&mut out, 1, "concurrencyLimit: 8");
+        }
+    }
+    out
+}
+
+fn render_report(inputs: &EmitInputs) -> String {
+    let mut out = String::new();
+    out.push_str(&format!(
+        "evidencectl source suggest: draft for source `{}` ({} {})\n\n",
+        inputs.source_id, inputs.operation.method, inputs.operation.path
+    ));
+
+    let unresolved_keys: BTreeSet<(String, BoundKind)> = inputs
+        .narrowed
+        .unresolved
+        .iter()
+        .map(|need| (need.pointer.clone(), need.kind.clone()))
+        .collect();
+
+    let mut derived_lines = Vec::new();
+    let mut chosen_lines = Vec::new();
+    for need in &inputs.needs {
+        let key = (need.pointer.clone(), need.kind.clone());
+        if unresolved_keys.contains(&key) {
+            continue;
+        }
+        let Some(suggestion) = &need.suggestion else {
+            continue;
+        };
+        let note = review_note(&need.kind, &suggestion.provenance)
+            .map_or_else(String::new, |note| format!(" ({note})"));
+        match provenance_label(&suggestion.provenance) {
+            Some(label) => derived_lines.push(format!(
+                "  - {} ({}): derived from {label}{note}",
+                need.pointer,
+                need.kind.label()
+            )),
+            None => chosen_lines.push(format!("  - {} ({})", need.pointer, need.kind.label())),
+        }
+    }
+    if derived_lines.is_empty() {
+        out.push_str("Derived automatically: none.\n\n");
+    } else {
+        out.push_str("Derived automatically:\n");
+        for line in &derived_lines {
+            out.push_str(line);
+            out.push('\n');
+        }
+        out.push('\n');
+    }
+    if !chosen_lines.is_empty() {
+        out.push_str("Chosen at the prompt:\n");
+        for line in &chosen_lines {
+            out.push_str(line);
+            out.push('\n');
+        }
+        out.push('\n');
+    }
+
+    out.push_str(&format!(
+        "Still needs your input ({}):\n",
+        match inputs.narrowed.unresolved.len() {
+            0 => "the source block below".to_owned(),
+            1 => "1 schema bound, plus the source block below".to_owned(),
+            count => format!("{count} schema bounds, plus the source block below"),
+        }
+    ));
+    for need in &inputs.narrowed.unresolved {
+        out.push_str(&format!(
+            "  - TODO(evidencectl): {} needs {}\n",
+            display_pointer(&need.pointer),
+            need.kind.label()
+        ));
+    }
+    out.push_str("  - source origin, posture, authentication, selector bindings, preparation,\n");
+    out.push_str("    and request limits are intentionally absent from the mechanical draft.\n\n");
+
+    out.push_str("Next steps:\n");
+    out.push_str(&format!(
+        "  1. Resolve every TODO(evidencectl) comment in schemas/{}-response.schema.yaml,\n     adapters/{}-extract.rhai, and schemas/{}-facts.schema.yaml.\n",
+        inputs.source_id, inputs.source_id, inputs.source_id
+    ));
+    out.push_str("  2. Review the source block and add the governed source decisions it omits.\n");
+    out.push_str("  3. Merge it into a separately authored Evidence project.\n");
+    out
+}
+
+fn path_display(path: &Path) -> String {
+    path.to_string_lossy().into_owned()
+}
+
+/// Quotes one argument of the reproduce command for a POSIX shell.
+///
+/// The reproduce line is meant to be pasted, and a projection pointer carries
+/// `*`: an interactive zsh expands it, and aborts the whole command when it
+/// matches nothing. Single quotes are used because they suppress every
+/// expansion; the only character they cannot carry is the single quote itself,
+/// which is spliced in as `'\''`.
+///
+/// The decision to quote is an allowlist rather than a list of characters
+/// known to be special. A denylist has to be complete to be correct, and the
+/// cost of an omission is not a cosmetic one: an unquoted `$` expands a
+/// parameter and an unquoted backtick runs a command, so a pointer through a
+/// property named `$id` would silently reproduce a different run.
+fn shell_quote(value: &str) -> String {
+    const SHELL_SAFE: [char; 6] = ['_', '.', '/', ':', '@', '-'];
+    let safe = !value.is_empty()
+        && value
+            .chars()
+            .all(|character| character.is_ascii_alphanumeric() || SHELL_SAFE.contains(&character));
+    if safe {
+        return value.to_owned();
+    }
+    format!("'{}'", value.replace('\'', r"'\''"))
+}
+
+fn render_equivalent_command(inputs: &EmitInputs) -> String {
+    let mut parts: Vec<String> = vec![
+        "evidencectl".to_owned(),
+        "source".to_owned(),
+        "suggest".to_owned(),
+    ];
+
+    if inputs.project.is_none() {
+        parts.push("--openapi".to_owned());
+        parts.push(shell_quote(&inputs.openapi.display()));
+    }
+    parts.push("--operation".to_owned());
+    parts.push(shell_quote(&format!(
+        "{} {}",
+        inputs.operation.method, inputs.operation.path
+    )));
+    parts.push("--status".to_owned());
+    parts.push(shell_quote(&inputs.status));
+    parts.push("--media-type".to_owned());
+    parts.push(shell_quote(&inputs.media_type));
+    if let Some(sample) = &inputs.sample_path {
+        parts.push("--sample".to_owned());
+        parts.push(shell_quote(&path_display(sample)));
+    }
+    parts.push("--source-id".to_owned());
+    parts.push(inputs.source_id.clone());
+    if let Some(project) = &inputs.project {
+        parts.push("--project".to_owned());
+        parts.push(shell_quote(&path_display(project)));
+    }
+    for pointer in &inputs.selection {
+        parts.push("--select".to_owned());
+        parts.push(shell_quote(pointer));
+    }
+
+    parts.join(" ")
+}
diff --git a/crates/registry-evidencectl/src/suggest/fetch.rs b/crates/registry-evidencectl/src/suggest/fetch.rs
new file mode 100644
index 000000000..a050d7130
--- /dev/null
+++ b/crates/registry-evidencectl/src/suggest/fetch.rs
@@ -0,0 +1,169 @@
+//! Reads an OpenAPI document that is published at a URL rather than sitting
+//! on disk.
+//!
+//! Registry APIs publish their description at a well-known URL far more often
+//! than they ship it as a file, and making the operator fetch it by hand adds
+//! a step that only invites a stale copy. Fetching it here is read-only and
+//! touches nothing the runtime will later run: the draft is still reviewed by
+//! a human and still carries a `TODO` wherever a bound could not be derived.
+//!
+//! What a URL does change is trust. The description decides which leaves the
+//! operator is offered, and the projection they pick from it is the
+//! data-minimization boundary of the finished source, so a tampered document
+//! could quietly widen what a deployment reads. The rule applied here is
+//! therefore the one the runtime already enforces for the source URLs it will
+//! itself call: plain `http` only to a numeric loopback host, `https`
+//! everywhere else, and never any credential in the authority. Two tools
+//! reading the same rule is one rule to review.
+//!
+//! A new project retains the validated response exactly; `source suggest`
+//! interprets it later, when an adopter is ready to select fields. Nothing is
+//! written outside the authoring project the operator names, and no request
+//! carries authentication. A description behind a token is fetched by the
+//! operator with their own client and passed as a file.
+
+use std::{io::Read, path::PathBuf, time::Duration};
+
+use anyhow::{bail, Context, Result};
+use url::{Host, Url};
+
+use super::types::SpecSource;
+
+/// How long a connection may take to establish, and how long the whole
+/// exchange may take. A description is a single small document from a server
+/// the operator chose; a request still running after this is a wedged host,
+/// and failing beats hanging a terminal indefinitely.
+const CONNECT_TIMEOUT: Duration = Duration::from_secs(10);
+const REQUEST_TIMEOUT: Duration = Duration::from_secs(60);
+
+/// Redirects are followed because a published description is very often a
+/// stable URL pointing at a versioned one. The count is bounded so a
+/// redirect loop fails rather than spins.
+const MAX_REDIRECTS: u32 = 5;
+
+/// Decides what a `--openapi` argument names, and rejects a URL this tool
+/// will not fetch before anything is read or any question is asked.
+pub fn spec_source(value: &str) -> Result<SpecSource> {
+    if looks_like_url(value) {
+        return Ok(SpecSource::Url(check_url(value)?));
+    }
+    Ok(SpecSource::File(PathBuf::from(value)))
+}
+
+/// Whether `value` names a location to fetch rather than a file to open.
+///
+/// The test is for a URL scheme at the front, not for `://` anywhere in the
+/// string, so a local path that merely contains those characters still opens
+/// as a path. Any scheme is detected, not only the two that are permitted:
+/// `ftp://spec.yaml` is a URL the operator meant as a URL, and telling them
+/// the scheme is not permitted is more use than reporting that no such file
+/// exists.
+pub fn looks_like_url(value: &str) -> bool {
+    let Some((scheme, rest)) = value.split_once("://") else {
+        return false;
+    };
+    !scheme.is_empty()
+        && !rest.is_empty()
+        && scheme.starts_with(|first: char| first.is_ascii_alphabetic())
+        && scheme
+            .chars()
+            .all(|character| character.is_ascii_alphanumeric() || "+-.".contains(character))
+}
+
+/// Parses `value` and accepts it only if it is a URL this tool will fetch.
+///
+/// Applied to the URL the operator passed and again to the URL the response
+/// actually came from, so a document that arrived over a hop the operator
+/// would not have permitted is refused rather than drafted from. The redirect
+/// has already been followed by the time the second check runs; what it
+/// prevents is reading a description whose last hop was open to tampering.
+/// Checking the final URL is enough for that: an intermediate hop can only be
+/// introduced by a server whose own response was already protected by the
+/// scheme of the hop before it.
+pub fn check_url(value: &str) -> Result<Url> {
+    let url = Url::parse(value).with_context(|| format!("parsing `{value}` as a URL"))?;
+
+    // Reported without quoting the URL back: the thing that makes it
+    // unacceptable is the credential inside it, and echoing it to a terminal
+    // or a scrollback buffer is exactly what should not happen to a secret.
+    if !url.username().is_empty() || url.password().is_some() {
+        bail!(
+            "the OpenAPI URL carries credentials in its authority; pass a URL without them, and \
+             fetch a description that needs authentication with your own client and pass the file"
+        );
+    }
+    // A query is routinely where signed URLs and API keys live, and a
+    // fragment is client-side state rather than part of the fetched resource.
+    // Reject both without echoing either value into terminal output.
+    if url.query().is_some() || url.fragment().is_some() {
+        bail!(
+            "the OpenAPI URL carries a query or fragment; pass a stable URL without either, or \
+             fetch the description with your own client and pass the local file"
+        );
+    }
+
+    match url.scheme() {
+        "https" => {}
+        "http" => match url.host() {
+            Some(Host::Ipv4(address)) if address.is_loopback() => {}
+            Some(Host::Ipv6(address)) if address.is_loopback() => {}
+            _ => bail!(
+                "`{url}` is plain http to a host that is not loopback; a description read in the \
+                 clear can be tampered with, and it decides what the drafted projection reads. \
+                 Use https, or a numeric loopback host such as `http://127.0.0.1:8080/...` for a \
+                 local server"
+            ),
+        },
+        scheme => bail!("`{scheme}` URLs are not fetched; pass an https URL, or a local file path"),
+    }
+    Ok(url)
+}
+
+/// Fetches `url` and returns the document text, refusing a body past
+/// `max_bytes`.
+///
+/// The limit is enforced while reading rather than from `Content-Length`, so
+/// a response that never declares a length cannot talk this into buffering
+/// whatever the server feels like sending.
+pub fn get(url: &Url, max_bytes: u64) -> Result<String> {
+    let agent = ureq::AgentBuilder::new()
+        .timeout_connect(CONNECT_TIMEOUT)
+        .timeout(REQUEST_TIMEOUT)
+        .redirects(MAX_REDIRECTS)
+        .user_agent(concat!("evidencectl/", env!("CARGO_PKG_VERSION")))
+        .build();
+
+    let response = match agent
+        .get(url.as_str())
+        .set(
+            "Accept",
+            "application/yaml, application/json, text/yaml, */*",
+        )
+        .call()
+    {
+        Ok(response) => response,
+        Err(ureq::Error::Status(status, _)) => bail!(
+            "fetching {url} returned HTTP {status}; a description behind authentication has to be \
+             fetched with your own client and passed as a file"
+        ),
+        Err(error) => return Err(error).with_context(|| format!("fetching {url}")),
+    };
+
+    let landed = response.get_url().to_owned();
+    if landed != url.as_str() {
+        check_url(&landed)
+            .with_context(|| format!("{url} redirected to a URL that is not read"))?;
+    }
+
+    let mut body = Vec::new();
+    response
+        .into_reader()
+        .take(max_bytes.saturating_add(1))
+        .read_to_end(&mut body)
+        .with_context(|| format!("reading the response body of {url}"))?;
+    if body.len() as u64 > max_bytes {
+        bail!("the document at {url} exceeds the {max_bytes} byte limit");
+    }
+
+    String::from_utf8(body).with_context(|| format!("decoding the document at {url} as UTF-8"))
+}
diff --git a/crates/registry-evidencectl/src/suggest/flatten.rs b/crates/registry-evidencectl/src/suggest/flatten.rs
new file mode 100644
index 000000000..699864e4a
--- /dev/null
+++ b/crates/registry-evidencectl/src/suggest/flatten.rs
@@ -0,0 +1,221 @@
+//! Flattens a fully-resolved response schema into candidate projection
+//! leaves.
+//!
+//! Every leaf pointer is in the extended projection form ADAPTER-API.md
+//! defines: RFC 6901 segments (`~0`/`~1` escaped) for object members and the
+//! reserved segment `*` for "every array element". Constructs the closed
+//! schema subset cannot express as a selectable leaf (a real union via
+//! `oneOf`/`anyOf`, an `allOf` merging more than one schema, an
+//! `additionalProperties` schema, an untyped node, a cut `$ref` cycle, a
+//! pointer past the depth limit) are skipped with a warning rather than
+//! failing the whole spec: one exotic node should not block drafting from the
+//! rest of the operation.
+
+use serde_json::Value;
+
+use super::types::{CandidateLeaf, ResolvedSchema, RECURSIVE_REF_KEY};
+
+/// The extended-pointer form shares `get_path`'s 16-segment ceiling (see
+/// `primitive-library.yaml`), so a projection pointer this stage produces
+/// never needs truncating again once `*` is substituted for a numeric index.
+const MAX_POINTER_SEGMENTS: usize = 16;
+
+/// Flattens `schema` into its selectable leaves plus warnings for any
+/// skipped, unsupported node. A leaf's `pointer` selects one scalar value
+/// (or, through a `*` segment, every occurrence of one scalar value inside
+/// an array); containers (objects, arrays) are never themselves leaves.
+pub fn candidate_leaves(schema: &ResolvedSchema) -> (Vec<CandidateLeaf>, Vec<String>) {
+    let mut leaves = Vec::new();
+    let mut warnings = Vec::new();
+    walk(&schema.0, String::new(), 0, &mut leaves, &mut warnings);
+    (leaves, warnings)
+}
+
+fn walk(
+    node: &Value,
+    pointer: String,
+    depth: usize,
+    leaves: &mut Vec<CandidateLeaf>,
+    warnings: &mut Vec<String>,
+) {
+    let Some(object) = node.as_object() else {
+        warnings.push(format!(
+            "schema at `{}` is not an object node; skipped",
+            display_pointer(&pointer)
+        ));
+        return;
+    };
+
+    if let Some(reference) = object.get(RECURSIVE_REF_KEY).and_then(Value::as_str) {
+        warnings.push(format!(
+            "`{}` repeats the $ref cycle `{reference}`; a schema with no end cannot be \
+             projected, so the repeat is skipped",
+            display_pointer(&pointer)
+        ));
+        return;
+    }
+
+    if object.contains_key("oneOf") || object.contains_key("anyOf") {
+        warnings.push(format!(
+            "unsupported oneOf/anyOf union at `{}`; skipped",
+            display_pointer(&pointer)
+        ));
+        return;
+    }
+    if let Some(members) = object.get("allOf").and_then(Value::as_array) {
+        // A single-member allOf is the common code-generation idiom for
+        // attaching shared metadata via $ref (already inlined by this
+        // point); it is equivalent to its one member. Anything wider is a
+        // real merge this stage does not attempt to compute.
+        return if members.len() == 1 {
+            walk(&members[0], pointer, depth, leaves, warnings)
+        } else {
+            warnings.push(format!(
+                "unsupported allOf with {} members at `{}`; skipped",
+                members.len(),
+                display_pointer(&pointer)
+            ));
+        };
+    }
+
+    let Some((base_type, nullable)) = resolve_type(object) else {
+        warnings.push(format!(
+            "schema at `{}` has no single supported type (missing `type`, or a multi-type union beyond `[T, \"null\"]`); skipped",
+            display_pointer(&pointer)
+        ));
+        return;
+    };
+
+    match base_type.as_str() {
+        "object" => walk_object(object, &pointer, depth, leaves, warnings),
+        "array" => walk_array(object, &pointer, depth, leaves, warnings),
+        scalar => leaves.push(CandidateLeaf {
+            pointer,
+            type_label: type_label(scalar, object),
+            nullable,
+            description: object
+                .get("description")
+                .and_then(Value::as_str)
+                .map(str::to_string),
+        }),
+    }
+}
+
+fn walk_object(
+    object: &serde_json::Map<String, Value>,
+    pointer: &str,
+    depth: usize,
+    leaves: &mut Vec<CandidateLeaf>,
+    warnings: &mut Vec<String>,
+) {
+    if object
+        .get("additionalProperties")
+        .is_some_and(Value::is_object)
+    {
+        warnings.push(format!(
+            "unsupported additionalProperties schema at `{}`; unnamed extra members cannot be named as projection pointers",
+            display_pointer(pointer)
+        ));
+    }
+    if object.contains_key("patternProperties") {
+        warnings.push(format!(
+            "unsupported patternProperties at `{}`; skipped",
+            display_pointer(pointer)
+        ));
+    }
+    let Some(properties) = object.get("properties").and_then(Value::as_object) else {
+        warnings.push(format!(
+            "object at `{}` has no declared properties; nothing to select",
+            display_pointer(pointer)
+        ));
+        return;
+    };
+    if depth >= MAX_POINTER_SEGMENTS {
+        warnings.push(format!(
+            "pointer depth limit ({MAX_POINTER_SEGMENTS} segments) reached at `{}`; not descending further",
+            display_pointer(pointer)
+        ));
+        return;
+    }
+    for (member_name, member_schema) in properties {
+        let child_pointer = format!("{pointer}/{}", escape_pointer_segment(member_name));
+        walk(member_schema, child_pointer, depth + 1, leaves, warnings);
+    }
+}
+
+fn walk_array(
+    object: &serde_json::Map<String, Value>,
+    pointer: &str,
+    depth: usize,
+    leaves: &mut Vec<CandidateLeaf>,
+    warnings: &mut Vec<String>,
+) {
+    let Some(items) = object.get("items") else {
+        warnings.push(format!(
+            "array at `{}` has no `items` schema; skipped",
+            display_pointer(pointer)
+        ));
+        return;
+    };
+    if depth >= MAX_POINTER_SEGMENTS {
+        warnings.push(format!(
+            "pointer depth limit ({MAX_POINTER_SEGMENTS} segments) reached at `{}`; not descending further",
+            display_pointer(pointer)
+        ));
+        return;
+    }
+    walk(items, format!("{pointer}/*"), depth + 1, leaves, warnings);
+}
+
+/// Resolves a schema node's JSON Schema `type` to `(base type, nullable)`.
+/// Accepts a bare string type, or the closed subset's only admitted union:
+/// an array pairing exactly one non-`null` type with `"null"`. Any other
+/// shape (missing `type`, or a genuine multi-type union) is not represented
+/// and yields `None`.
+fn resolve_type(object: &serde_json::Map<String, Value>) -> Option<(String, bool)> {
+    match object.get("type") {
+        Some(Value::String(type_name)) => Some((type_name.clone(), false)),
+        Some(Value::Array(type_names)) => {
+            let mut non_null = Vec::new();
+            let mut has_null = false;
+            for entry in type_names {
+                match entry.as_str()? {
+                    "null" => has_null = true,
+                    other => non_null.push(other),
+                }
+            }
+            if non_null.len() == 1 {
+                Some((non_null[0].to_string(), has_null))
+            } else {
+                None
+            }
+        }
+        _ => None,
+    }
+}
+
+/// A human label for a leaf's type: `string (date)` when a string carries a
+/// `format`, otherwise the bare JSON Schema type name.
+fn type_label(base_type: &str, object: &serde_json::Map<String, Value>) -> String {
+    if base_type == "string" {
+        if let Some(format) = object.get("format").and_then(Value::as_str) {
+            return format!("string ({format})");
+        }
+    }
+    base_type.to_string()
+}
+
+/// Escapes an object member name into one RFC 6901 pointer segment: `~` and
+/// `/` are escaped in that order (escaping `/` first would double-escape a
+/// `~` produced by escaping a literal `~`).
+fn escape_pointer_segment(name: &str) -> String {
+    name.replace('~', "~0").replace('/', "~1")
+}
+
+fn display_pointer(pointer: &str) -> &str {
+    if pointer.is_empty() {
+        "(root)"
+    } else {
+        pointer
+    }
+}
diff --git a/crates/registry-evidencectl/src/suggest/interactive.rs b/crates/registry-evidencectl/src/suggest/interactive.rs
new file mode 100644
index 000000000..a82dd62a5
--- /dev/null
+++ b/crates/registry-evidencectl/src/suggest/interactive.rs
@@ -0,0 +1,291 @@
+//! The interactive front-end of `evidencectl source suggest`.
+//!
+//! Every prompt the tool can raise lives in this module, so the pipeline in
+//! `mod.rs` and the stages beneath it stay promptless and deterministic: the
+//! front-end only turns the pipeline's own findings into questions and turns
+//! the answers back into the same values a fully-flagged run would have
+//! supplied. Nothing here derives a bound, validates a schema, or writes a
+//! file.
+//!
+//! A prompt is only ever raised when [`is_interactive`] holds, which requires
+//! both standard input and standard output to be terminals. A run that is
+//! piped, redirected, or driven by CI therefore fails with a message naming
+//! the flags it needs rather than blocking on a question nobody can answer.
+
+use std::{collections::BTreeMap, io::IsTerminal};
+
+use anyhow::{anyhow, Result};
+use inquire::{
+    error::InquireError,
+    validator::{MinLengthValidator, Validation},
+    Confirm, CustomUserError, MultiSelect, Select, Text,
+};
+
+use super::types::{
+    BoundKind, BoundNeed, BoundValues, CandidateLeaf, DraftFile, OperationKey, OperationSummary,
+    Provenance,
+};
+
+/// The longest leaf description shown beside a candidate pointer. A schema
+/// description can run to paragraphs; the list stays readable instead.
+const DESCRIPTION_BUDGET: usize = 60;
+
+/// True when both standard input and standard output are terminals, which is
+/// what an inquire prompt needs to draw itself and read an answer.
+pub fn is_interactive() -> bool {
+    std::io::stdin().is_terminal() && std::io::stdout().is_terminal()
+}
+
+/// Ask which operation the source calls.
+pub fn choose_operation(operations: &[OperationSummary]) -> Result<OperationKey> {
+    let labels: Vec<String> = operations.iter().map(operation_label).collect();
+    let chosen = Select::new("Which operation does this source call?", labels)
+        .with_help_message("type to filter, arrows to move, enter to select")
+        .raw_prompt()
+        .map_err(prompt_error)?;
+    Ok(operations[chosen.index].key.clone())
+}
+
+/// Ask which response leaves the projection allowlist should carry.
+///
+/// Nothing is preselected: the projection is the data-minimization boundary,
+/// so every field is chosen deliberately. At least one leaf is required,
+/// because a source with an empty projection reads nothing.
+pub fn choose_leaves(leaves: &[CandidateLeaf]) -> Result<Vec<String>> {
+    let labels: Vec<String> = leaves.iter().map(leaf_label).collect();
+    let chosen = MultiSelect::new("Which response fields does this source need?", labels)
+        .with_validator(MinLengthValidator::new(1))
+        .with_help_message(
+            "space to toggle, enter to confirm; select the smallest set the derivation needs",
+        )
+        .raw_prompt()
+        .map_err(prompt_error)?;
+    Ok(chosen
+        .into_iter()
+        .map(|option| leaves[option.index].pointer.clone())
+        .collect())
+}
+
+/// Ask for every bound the closed subset demands and the specification does
+/// not state.
+///
+/// A derived suggestion is offered as an editable value with its provenance in
+/// the help line, never adopted silently. Clearing the value skips the
+/// decision, which leaves an explicit TODO in the draft that `evidence check`
+/// rejects until a human resolves it.
+pub fn resolve_bounds(needs: &[BoundNeed]) -> Result<BTreeMap<(String, BoundKind), BoundValues>> {
+    let mut resolutions = BTreeMap::new();
+    for need in needs {
+        if let Some(values) = ask_bound(need)? {
+            resolutions.insert((need.pointer.clone(), need.kind.clone()), values);
+        }
+    }
+    Ok(resolutions)
+}
+
+fn ask_bound(need: &BoundNeed) -> Result<Option<BoundValues>> {
+    let message = format!("{} for {}", need.kind.label(), need.pointer);
+    let help = match &need.suggestion {
+        Some(suggestion) => format!(
+            "suggested from {}{}; edit it, or clear the line to leave a TODO for review",
+            provenance_phrase(&suggestion.provenance),
+            super::emit::review_note(&need.kind, &suggestion.provenance)
+                .map_or_else(String::new, |note| format!(" ({note})"))
+        ),
+        None => format!(
+            "nothing in the specification or the sample implies one; enter {} or leave it empty to leave a TODO",
+            input_shape(&need.kind)
+        ),
+    };
+    let initial = need
+        .suggestion
+        .as_ref()
+        .map(|suggestion| render_bound(&suggestion.values));
+
+    let kind = need.kind.clone();
+    let mut prompt = Text::new(&message).with_help_message(&help).with_validator(
+        move |input: &str| -> Result<Validation, CustomUserError> {
+            Ok(match parse_bound(&kind, input) {
+                Ok(_) => Validation::Valid,
+                Err(message) => Validation::Invalid(message.into()),
+            })
+        },
+    );
+    if let Some(initial) = &initial {
+        prompt = prompt.with_initial_value(initial);
+    }
+
+    let answer = prompt.prompt().map_err(prompt_error)?;
+    parse_bound(&need.kind, &answer).map_err(|message| anyhow!("{message}"))
+}
+
+/// Ask for the source identifier, offering `default_id` as an editable value.
+pub fn choose_source_id(default_id: &str) -> Result<String> {
+    let answer = Text::new("Identifier for this source?")
+        .with_help_message("names the generated files and the `sources.<id>` key")
+        .with_initial_value(default_id)
+        .with_validator(|input: &str| -> Result<Validation, CustomUserError> {
+            Ok(match super::validate_source_id(input) {
+                Ok(_) => Validation::Valid,
+                Err(error) => Validation::Invalid(format!("{error}").into()),
+            })
+        })
+        .prompt()
+        .map_err(prompt_error)?;
+    super::validate_source_id(&answer)
+}
+
+/// Show the files a draft would create and ask whether to write them.
+pub fn confirm_write(project_display: &str, files: &[DraftFile]) -> Result<bool> {
+    eprintln!("These files will be written into {project_display}:");
+    for file in files {
+        eprintln!("  bundle/{}", file.bundle_relative_path);
+    }
+    Confirm::new("Write them?")
+        .with_default(true)
+        .with_help_message("nothing existing is ever overwritten; a collision stops the write")
+        .prompt()
+        .map_err(prompt_error)
+}
+
+/// `METHOD /path — summary`, the one-line form an operation is chosen by.
+fn operation_label(operation: &OperationSummary) -> String {
+    let mut label = format!("{} {}", operation.key.method, operation.key.path);
+    if let Some(summary) = &operation.summary {
+        label.push_str(" — ");
+        label.push_str(&truncate(summary));
+    }
+    label
+}
+
+/// `pointer  type (nullable) — description`, the one-line form a leaf is
+/// chosen by.
+fn leaf_label(leaf: &CandidateLeaf) -> String {
+    let mut label = format!("{}  {}", leaf.pointer, leaf.type_label);
+    if leaf.nullable {
+        label.push_str(" (nullable)");
+    }
+    if let Some(description) = &leaf.description {
+        label.push_str(" — ");
+        label.push_str(&truncate(description));
+    }
+    label
+}
+
+/// One line of `text`, cut to the description budget on a character boundary.
+fn truncate(text: &str) -> String {
+    let single_line = text.split('\n').next().unwrap_or(text).trim();
+    if single_line.chars().count() <= DESCRIPTION_BUDGET {
+        return single_line.to_owned();
+    }
+    let kept: String = single_line.chars().take(DESCRIPTION_BUDGET).collect();
+    format!("{kept}…")
+}
+
+fn provenance_phrase(provenance: &Provenance) -> &'static str {
+    match provenance {
+        Provenance::Spec => "the OpenAPI schema",
+        Provenance::Format => "the declared format",
+        Provenance::Sample => "the sample response, widened",
+        Provenance::PageSize => "a page-size parameter in the spec",
+        Provenance::SubsetCeiling => "the subset ceiling; the document states a larger bound",
+        Provenance::Operator => "your own answer",
+    }
+}
+
+/// The text form of a bound value, which is also the editable initial value
+/// of its prompt.
+fn render_bound(values: &BoundValues) -> String {
+    match values {
+        BoundValues::MaxItems(maximum) => maximum.to_string(),
+        BoundValues::IntegerRange { minimum, maximum } => format!("{minimum} {maximum}"),
+        BoundValues::StringLength {
+            min_length,
+            max_length,
+        } => format!("{min_length} {max_length}"),
+    }
+}
+
+/// What the operator is asked to type for a bound with no suggestion.
+fn input_shape(kind: &BoundKind) -> &'static str {
+    match kind {
+        BoundKind::ArrayMaxItems => "a maximum item count",
+        BoundKind::IntegerRange => "a minimum and a maximum, separated by a space",
+        BoundKind::StringLength => "a minimum and a maximum length, separated by a space",
+    }
+}
+
+/// Parses one bound answer. An empty answer is a deliberate skip, not an
+/// error: it leaves the bound unresolved and the draft rejected until a human
+/// supplies it. The message in `Err` is shown inline by the prompt validator,
+/// so the operator can correct the answer without restarting.
+fn parse_bound(kind: &BoundKind, input: &str) -> std::result::Result<Option<BoundValues>, String> {
+    let fields: Vec<&str> = input
+        .split([' ', ',', '\t'])
+        .filter(|field| !field.is_empty())
+        .collect();
+    if fields.is_empty() {
+        return Ok(None);
+    }
+    match kind {
+        BoundKind::ArrayMaxItems => {
+            let [maximum] = fields[..] else {
+                return Err("enter one maximum item count".to_owned());
+            };
+            let maximum = parse_unsigned(maximum)?;
+            Ok(Some(BoundValues::MaxItems(maximum)))
+        }
+        BoundKind::IntegerRange => {
+            let [minimum, maximum] = fields[..] else {
+                return Err("enter a minimum and a maximum, separated by a space".to_owned());
+            };
+            let minimum = parse_signed(minimum)?;
+            let maximum = parse_signed(maximum)?;
+            if minimum > maximum {
+                return Err("the minimum must not exceed the maximum".to_owned());
+            }
+            Ok(Some(BoundValues::IntegerRange { minimum, maximum }))
+        }
+        BoundKind::StringLength => {
+            let [minimum, maximum] = fields[..] else {
+                return Err("enter a minimum and a maximum length, separated by a space".to_owned());
+            };
+            let min_length = parse_unsigned(minimum)?;
+            let max_length = parse_unsigned(maximum)?;
+            if min_length > max_length {
+                return Err("the minimum length must not exceed the maximum length".to_owned());
+            }
+            Ok(Some(BoundValues::StringLength {
+                min_length,
+                max_length,
+            }))
+        }
+    }
+}
+
+fn parse_unsigned(field: &str) -> std::result::Result<u64, String> {
+    field
+        .parse::<u64>()
+        .map_err(|_| format!("`{field}` is not a whole number of zero or more"))
+}
+
+fn parse_signed(field: &str) -> std::result::Result<i64, String> {
+    field
+        .parse::<i64>()
+        .map_err(|_| format!("`{field}` is not a whole number"))
+}
+
+/// Turns an inquire failure into an actionable error. Cancelling a prompt is
+/// an ordinary outcome of an interactive session, not a defect, so it reports
+/// what did not happen rather than a library error.
+fn prompt_error(error: InquireError) -> anyhow::Error {
+    match error {
+        InquireError::OperationCanceled | InquireError::OperationInterrupted => {
+            anyhow!("cancelled at a prompt; nothing was written")
+        }
+        InquireError::NotTTY => {
+            anyhow!("this run has no terminal to prompt on; pass --operation and --select instead")
+        }
+        other => anyhow::Error::new(other).context("reading a prompt answer"),
+    }
+}
diff --git a/crates/registry-evidencectl/src/suggest/mod.rs b/crates/registry-evidencectl/src/suggest/mod.rs
new file mode 100644
index 000000000..6eb5706f3
--- /dev/null
+++ b/crates/registry-evidencectl/src/suggest/mod.rs
@@ -0,0 +1,636 @@
+//! `evidencectl source suggest`: turn one OpenAPI operation into draft
+//! Evidence source artifacts.
+//!
+//! The tool derives what the specification can state, asks (or accepts flags)
+//! for what it cannot, and never invents a bound: every unresolved decision
+//! is emitted as an explicit TODO that `evidence check` rejects, so the
+//! runtime stays the only validator of the closed schema subset. The
+//! interactive mode is a thin front-end over the same deterministic pipeline
+//! and ends by printing the equivalent fully-flagged command.
+
+pub mod emit;
+pub mod fetch;
+pub mod flatten;
+pub mod interactive;
+pub mod narrow;
+pub mod openapi;
+pub mod sample;
+pub mod types;
+
+use std::{collections::BTreeMap, path::Path, process::ExitCode};
+
+use anyhow::{bail, Result};
+use clap::{Args, Subcommand};
+
+use emit::EmitInputs;
+use openapi::Spec;
+use types::{
+    BoundKind, BoundNeed, BoundValues, CandidateLeaf, Decisions, DraftArtifacts, Observations,
+    OperationKey, OperationSummary, Provenance, SuggestedBound,
+};
+
+#[derive(Debug, Subcommand)]
+pub enum SourceCommand {
+    /// Suggest source configuration from an OpenAPI document.
+    Suggest(SuggestArgs),
+}
+
+#[derive(Debug, Args)]
+pub struct SuggestArgs {
+    /// OpenAPI 3.0 or 3.1 document for a print-only draft. With --project,
+    /// the retained source.openapi.yaml is used instead.
+    #[arg(long)]
+    pub openapi: Option<String>,
+
+    /// Operation as "METHOD /path/template"; interactive selection if absent.
+    #[arg(long)]
+    pub operation: Option<String>,
+
+    /// Response status code to read the schema from.
+    #[arg(long, default_value = "200")]
+    pub status: String,
+
+    /// Response media type to read the schema from.
+    #[arg(long, default_value = "application/json")]
+    pub media_type: String,
+
+    /// Projection pointer to select; repeat once per leaf. Interactive
+    /// selection if absent.
+    #[arg(long = "select")]
+    pub selection: Vec<String>,
+
+    /// Sample response JSON file used to suggest bounds. Read only; nothing
+    /// from it is copied into any artifact except derived bounds.
+    #[arg(long)]
+    pub sample: Option<std::path::PathBuf>,
+
+    /// Source identifier for the generated artifacts.
+    #[arg(long)]
+    pub source_id: Option<String>,
+
+    /// Deployment project to write the draft into; print-only if absent.
+    #[arg(long)]
+    pub project: Option<std::path::PathBuf>,
+}
+
+pub fn run(command: SourceCommand) -> Result<ExitCode> {
+    match command {
+        SourceCommand::Suggest(args) => suggest(args),
+    }
+}
+
+/// The largest `maxItems` the closed schema subset admits, and therefore the
+/// ceiling any page-size-derived suggestion is clamped to.
+const MAX_PROJECTED_ITEMS: i64 = 256;
+
+/// The identifier used when an operation's path yields no usable one.
+const FALLBACK_SOURCE_ID: &str = "source-a";
+
+/// Run one drafting pass.
+///
+/// The pipeline is the same in both front-ends and runs in one order:
+/// load the document, pick the operation, resolve its response schema,
+/// flatten it into candidate leaves, take a selection, observe an optional
+/// sample, plan the bounds the closed subset still demands, resolve those
+/// bounds, then narrow, draft, and either write or print. Only the two
+/// resolution steps differ: prompts when a terminal is driving the run,
+/// announced auto-acceptance of the pipeline's own suggestions when flags
+/// are. Both produce the same [`Decisions`], and the printed equivalent
+/// command reproduces either run exactly, because every suggestion is
+/// derived deterministically from the same inputs.
+pub(crate) struct PreparedSuggestion {
+    pub artifacts: DraftArtifacts,
+    flag_driven: bool,
+}
+
+/// Run the shared OpenAPI interpretation pipeline without writing output.
+/// `source suggest` and `new --openapi` differ only in how they deliver this
+/// prepared draft.
+pub(crate) fn prepare(args: &SuggestArgs) -> Result<PreparedSuggestion> {
+    let source = suggestion_openapi(args)?;
+    let spec = Spec::open(&source)?;
+    let operations = spec.operations();
+    if operations.is_empty() {
+        bail!(
+            "{} declares no operation with a JSON response schema; there is nothing to draft from",
+            source.display()
+        );
+    }
+
+    let flag_driven = args.operation.is_some() && !args.selection.is_empty();
+    // A run with no terminal to prompt on still gets told what it could have
+    // asked for, and each answer is only knowable once the one before it is
+    // settled: the operations come from the document, the leaves from the
+    // chosen operation's response schema. So the two refusals happen at the two
+    // points where the answer exists, not together at the top.
+    if args.operation.is_none() && !interactive::is_interactive() {
+        bail!(
+            "{}\n\nthis document declares:\n{}",
+            missing_flags_message(args),
+            list_operations(&operations)
+        );
+    }
+
+    let summary = match &args.operation {
+        Some(text) => find_operation(&parse_operation(text)?, &operations)?,
+        None => {
+            let key = interactive::choose_operation(&operations)?;
+            find_operation(&key, &operations)?
+        }
+    };
+    if !summary
+        .json_responses
+        .iter()
+        .any(|(status, media_type)| *status == args.status && *media_type == args.media_type)
+    {
+        bail!(
+            "{} {} declares no `{}` `{}` response schema; it declares {}",
+            summary.key.method,
+            summary.key.path,
+            args.status,
+            args.media_type,
+            describe_responses(&summary.json_responses)
+        );
+    }
+    let operation = summary.key.clone();
+
+    let resolved = spec.response_schema(&operation, &args.status, &args.media_type)?;
+    for note in &resolved.notes {
+        eprintln!("evidencectl: {note}");
+    }
+    let schema = resolved.schema;
+    let (leaves, warnings) = flatten::candidate_leaves(&schema);
+    for warning in &warnings {
+        eprintln!("evidencectl: {warning}");
+    }
+    if leaves.is_empty() {
+        bail!(
+            "the `{}` `{}` response schema of {} {} has no selectable leaf; \
+             nothing above can be projected",
+            args.status,
+            args.media_type,
+            operation.method,
+            operation.path
+        );
+    }
+
+    let selection = if args.selection.is_empty() {
+        if !interactive::is_interactive() {
+            bail!(
+                "{}\n\nthis operation's `{}` `{}` response offers:\n{}",
+                missing_flags_message(args),
+                args.status,
+                args.media_type,
+                list_leaves(&leaves)
+            );
+        }
+        interactive::choose_leaves(&leaves)?
+    } else {
+        check_selection(&args.selection, &leaves)?;
+        args.selection.clone()
+    };
+
+    let observations = match &args.sample {
+        Some(path) => sample::observe(&sample::load_sample(path)?, &selection)?,
+        None => Observations::default(),
+    };
+
+    let plan = narrow::plan_advisories(&schema, &selection, &observations)?;
+    for advisory in &plan.advisories {
+        eprintln!("evidencectl: {}", advisory.message());
+    }
+    let mut needs = with_page_size_fallback(plan.needs, &spec, &operation)?;
+
+    let resolutions = if flag_driven {
+        accept_suggestions(&needs)
+    } else {
+        interactive::resolve_bounds(&needs)?
+    };
+    // An operator who typed over a suggestion owns that bound now, and the
+    // draft must not keep crediting the source the rejected number came from.
+    emit::attribute_operator_edits(&mut needs, &resolutions);
+
+    let source_id = match &args.source_id {
+        Some(id) => validate_source_id(id)?,
+        None => {
+            let derived = default_source_id(&operation.path);
+            if flag_driven {
+                eprintln!("evidencectl: naming this source `{derived}`, from the operation path");
+                derived
+            } else {
+                interactive::choose_source_id(&derived)?
+            }
+        }
+    };
+
+    let decisions = Decisions {
+        operation,
+        status: args.status.clone(),
+        media_type: args.media_type.clone(),
+        source_id,
+        selection,
+        resolutions,
+    };
+
+    let narrowed = narrow::apply(&schema, &decisions.selection, &decisions.resolutions)?;
+    let inputs = EmitInputs {
+        source_id: decisions.source_id.clone(),
+        operation: decisions.operation.clone(),
+        status: decisions.status.clone(),
+        media_type: decisions.media_type.clone(),
+        // Only the first server is a candidate: a later entry is usually a
+        // sandbox or a mirror, and quietly drafting against one because the
+        // primary carries template variables would point the source elsewhere.
+        base_url_suggestion: spec
+            .servers()
+            .into_iter()
+            .next()
+            .and_then(|url| emit::split_server_url(&url)),
+        selection: decisions.selection.clone(),
+        narrowed,
+        needs,
+        openapi: source.clone(),
+        sample_path: args.sample.clone(),
+        project: args.project.clone(),
+    };
+    let artifacts = emit::draft(&inputs)?;
+
+    Ok(PreparedSuggestion {
+        artifacts,
+        flag_driven,
+    })
+}
+
+fn suggestion_openapi(args: &SuggestArgs) -> Result<types::SpecSource> {
+    match (&args.project, &args.openapi) {
+        (Some(project), None) => {
+            if !project.is_dir() {
+                bail!(
+                    "authoring project directory {} not found; create it with `evidencectl new` first",
+                    project.display()
+                );
+            }
+            let retained = project.join("source.openapi.yaml");
+            if !retained.is_file() {
+                bail!(
+                    "authoring project {} has no retained source.openapi.yaml",
+                    project.display()
+                );
+            }
+            fetch::spec_source(
+                retained
+                    .to_str()
+                    .ok_or_else(|| anyhow::anyhow!("retained OpenAPI path is not valid UTF-8"))?,
+            )
+        }
+        (Some(_), Some(_)) => bail!(
+            "--project uses its retained source.openapi.yaml; omit --openapi to avoid drafting from a different contract"
+        ),
+        (None, Some(openapi)) => fetch::spec_source(openapi),
+        (None, None) => bail!("pass --openapi <path-or-https-url>, or pass --project <authoring-project>"),
+    }
+}
+
+fn suggest(args: SuggestArgs) -> Result<ExitCode> {
+    let prepared = prepare(&args)?;
+    let artifacts = prepared.artifacts;
+
+    let code = match &args.project {
+        Some(project) => deliver_into_project(project, &artifacts, prepared.flag_driven)?,
+        None => {
+            print_draft(&artifacts);
+            ExitCode::SUCCESS
+        }
+    };
+
+    println!("{}", artifacts.report);
+    println!("Reproduce this run with:");
+    println!("  {}", artifacts.equivalent_command);
+    Ok(code)
+}
+
+/// Write the draft into an OpenAPI authoring project, then report what happened.
+///
+/// The write refuses to replace anything that already exists, so a repeated
+/// run never silently discards an edited draft. Verification runs only when
+/// the operator supplied a runtime binary to run it with.
+fn deliver_into_project(
+    project: &Path,
+    artifacts: &DraftArtifacts,
+    flag_driven: bool,
+) -> Result<ExitCode> {
+    if !project.is_dir() {
+        bail!(
+            "authoring project directory {} not found; create one with `evidencectl new` first",
+            project.display()
+        );
+    }
+    if !flag_driven
+        && !interactive::confirm_write(&project.display().to_string(), &artifacts.files)?
+    {
+        eprintln!("evidencectl: nothing was written; the draft is printed below instead.");
+        print_draft(artifacts);
+        return Ok(ExitCode::SUCCESS);
+    }
+
+    let written = emit::write_into_authoring_project(project, artifacts)?;
+    for path in &written {
+        println!("wrote {}", path.display());
+    }
+    println!(
+        "source draft: {}",
+        project
+            .join("sources")
+            .join(format!("{}.yaml", artifacts.source_id))
+            .display()
+    );
+
+    println!(
+        "not verified: complete a question and run `evidencectl dev`; the local compiler \
+         delegates validation to Evidence."
+    );
+    Ok(ExitCode::SUCCESS)
+}
+
+/// Print every drafted file, and the pasteable source block, to stdout.
+fn print_draft(artifacts: &DraftArtifacts) {
+    for file in &artifacts.files {
+        print_block(&file.bundle_relative_path, &file.contents);
+    }
+    print_block(
+        "the block to paste under `sources:` in bundle/evidence.yaml",
+        &artifacts.source_block,
+    );
+}
+
+fn print_block(title: &str, body: &str) {
+    println!("--- {title} ---");
+    print!("{body}");
+    if !body.ends_with('\n') {
+        println!();
+    }
+    println!();
+}
+
+/// Adopt every suggestion the pipeline derived, announcing each one with its
+/// provenance so a flag-driven run is auditable from its own output. A need
+/// with no suggestion stays unresolved: nothing here invents a bound.
+fn accept_suggestions(needs: &[BoundNeed]) -> BTreeMap<(String, BoundKind), BoundValues> {
+    let mut resolutions = BTreeMap::new();
+    for need in needs {
+        match &need.suggestion {
+            Some(suggestion) => {
+                let derivation = emit::provenance_label(&suggestion.provenance)
+                    .map_or_else(String::new, |label| format!(", derived from {label}"));
+                let note = emit::review_note(&need.kind, &suggestion.provenance)
+                    .map_or_else(String::new, |note| format!(" ({note})"));
+                eprintln!(
+                    "evidencectl: adopting {} for `{}`{derivation}{note}",
+                    describe_bound(&suggestion.values),
+                    narrow::display_pointer(&need.pointer),
+                );
+                resolutions.insert(
+                    (need.pointer.clone(), need.kind.clone()),
+                    suggestion.values.clone(),
+                );
+            }
+            None => eprintln!(
+                "evidencectl: nothing implies {} for `{}`; left as a TODO in the draft",
+                need.kind.label(),
+                narrow::display_pointer(&need.pointer)
+            ),
+        }
+    }
+    resolutions
+}
+
+fn describe_bound(values: &BoundValues) -> String {
+    match values {
+        BoundValues::MaxItems(maximum) => format!("maxItems {maximum}"),
+        BoundValues::IntegerRange { minimum, maximum } => {
+            format!("minimum {minimum} and maximum {maximum}")
+        }
+        BoundValues::StringLength {
+            min_length,
+            max_length,
+        } => format!("minLength {min_length} and maxLength {max_length}"),
+    }
+}
+
+/// Fill in the top-level collection's `maxItems` from the operation's
+/// page-size parameters.
+///
+/// The narrowing stage sees only the response schema, so it cannot know that a
+/// query parameter caps how long a page can be. What that parameter bounds is
+/// exactly one array: the collection the operation pages over. It says nothing
+/// about an array nested inside a record, so only a need whose pointer crosses
+/// no earlier wildcard is eligible; a nested array keeps whatever narrowing
+/// derived, including nothing at all.
+///
+/// For that one array the stated page size outranks a sample: a page of two
+/// records is a fact about the request that was made, while the parameter's
+/// maximum is the source's own statement about how long any page can be. A
+/// bound taken from the response schema or from a format is stronger still and
+/// is left alone. The largest declared maximum is used, because a smaller one
+/// bounds only the requests that ask for it, and the result is clamped to the
+/// subset ceiling.
+fn with_page_size_fallback(
+    mut needs: Vec<BoundNeed>,
+    spec: &Spec,
+    operation: &OperationKey,
+) -> Result<Vec<BoundNeed>> {
+    let eligible = |need: &BoundNeed| {
+        need.kind == BoundKind::ArrayMaxItems
+            && is_top_level_collection(&need.pointer)
+            && need.suggestion.as_ref().is_none_or(|suggestion| {
+                matches!(
+                    suggestion.provenance,
+                    Provenance::Sample | Provenance::PageSize
+                )
+            })
+    };
+    if !needs.iter().any(eligible) {
+        return Ok(needs);
+    }
+    // The smallest advertised ceiling is the only one a response can actually
+    // reach: a server honouring both `pageSize` (max 50) and `limit` (max 200)
+    // never returns more than 50 items. Taking the largest would bound the
+    // array well above anything the operation can produce, which is the wrong
+    // direction for a minimum-disclosure bound.
+    let Some(maximum) = spec
+        .page_size_maximums(operation)?
+        .into_iter()
+        .filter(|maximum| *maximum > 0)
+        .min()
+    else {
+        return Ok(needs);
+    };
+    let clamped = u64::try_from(maximum.min(MAX_PROJECTED_ITEMS)).unwrap_or(1);
+    // A page size above the subset ceiling is not what the draft ends up
+    // stating, so the parameter does not get the credit for what it does.
+    let provenance = if maximum <= MAX_PROJECTED_ITEMS {
+        Provenance::PageSize
+    } else {
+        Provenance::SubsetCeiling
+    };
+    for need in needs.iter_mut().filter(|need| eligible(need)) {
+        need.suggestion = Some(SuggestedBound {
+            values: BoundValues::MaxItems(clamped),
+            provenance: provenance.clone(),
+        });
+    }
+    Ok(needs)
+}
+
+/// Whether `pointer` names an array the operation pages over directly, rather
+/// than one reached by descending through another array's items.
+fn is_top_level_collection(pointer: &str) -> bool {
+    !pointer.contains("/*")
+}
+
+/// Parses `--operation`, which names one operation as `METHOD /path`.
+///
+/// A method outside the runtime's fixed-request enumeration is refused here,
+/// naming the two it admits, rather than later as an operation the document
+/// "does not declare": the document may well declare it, and the reason it
+/// cannot be drafted from is the runtime's, not the document's.
+fn parse_operation(text: &str) -> Result<OperationKey> {
+    let mut fields = text.split_whitespace();
+    let (Some(method), Some(path), None) = (fields.next(), fields.next(), fields.next()) else {
+        bail!("--operation reads as \"METHOD /path\", for example \"GET /records\"; got `{text}`");
+    };
+    Ok(OperationKey {
+        method: emit::request_method(method)?.to_owned(),
+        path: path.to_owned(),
+    })
+}
+
+fn find_operation<'a>(
+    key: &OperationKey,
+    operations: &'a [OperationSummary],
+) -> Result<&'a OperationSummary> {
+    operations
+        .iter()
+        .find(|operation| operation.key == *key)
+        .ok_or_else(|| {
+            anyhow::anyhow!(
+                "this document declares no `{} {}` with a JSON response schema; it declares:\n{}",
+                key.method,
+                key.path,
+                list_operations(operations)
+            )
+        })
+}
+
+/// The document's operations, one `--operation` argument per line.
+fn list_operations(operations: &[OperationSummary]) -> String {
+    operations
+        .iter()
+        .map(|operation| format!("  {} {}", operation.key.method, operation.key.path))
+        .collect::<Vec<_>>()
+        .join("\n")
+}
+
+/// The response's selectable leaves, one `--select` argument per line.
+fn list_leaves(leaves: &[CandidateLeaf]) -> String {
+    leaves
+        .iter()
+        .map(|leaf| format!("  {}", leaf.pointer))
+        .collect::<Vec<_>>()
+        .join("\n")
+}
+
+fn describe_responses(responses: &[(String, String)]) -> String {
+    responses
+        .iter()
+        .map(|(status, media_type)| format!("`{status}` `{media_type}`"))
+        .collect::<Vec<_>>()
+        .join(", ")
+}
+
+/// Rejects a `--select` pointer that names nothing in this response schema,
+/// before the narrowing stage reports the same pointer in schema terms. A
+/// pointer may name a leaf or a container above one: selecting a container
+/// projects its whole subtree.
+fn check_selection(selection: &[String], leaves: &[CandidateLeaf]) -> Result<()> {
+    for pointer in selection {
+        let prefix = format!("{pointer}/");
+        let known = leaves
+            .iter()
+            .any(|leaf| leaf.pointer == *pointer || leaf.pointer.starts_with(&prefix));
+        if !known {
+            let available = leaves
+                .iter()
+                .map(|leaf| format!("  {}", leaf.pointer))
+                .collect::<Vec<_>>()
+                .join("\n");
+            bail!("`--select {pointer}` names nothing in this response schema; it offers:\n{available}");
+        }
+    }
+    Ok(())
+}
+
+/// Accepts an identifier that is safe as a file name, a YAML key, and a
+/// bundle-relative path segment.
+fn validate_source_id(candidate: &str) -> Result<String> {
+    let acceptable = !candidate.is_empty()
+        && candidate.chars().all(|character| {
+            character.is_ascii_lowercase() || character.is_ascii_digit() || character == '-'
+        })
+        && !candidate.starts_with('-')
+        && !candidate.ends_with('-');
+    if !acceptable {
+        bail!(
+            "`{candidate}` is not a usable source identifier: use lowercase letters, digits and \
+             inner hyphens, for example `source-a`"
+        );
+    }
+    Ok(candidate.to_owned())
+}
+
+/// Derives a source identifier from the last literal segment of the operation
+/// path, so `/v1/records/{id}` suggests `records`. A path made only of
+/// template parameters yields the neutral fallback.
+fn default_source_id(path: &str) -> String {
+    let sanitized = path
+        .split('/')
+        .rfind(|segment| !segment.is_empty() && !segment.starts_with('{'))
+        .map(|segment| {
+            segment
+                .chars()
+                .map(|character| {
+                    let lowered = character.to_ascii_lowercase();
+                    if lowered.is_ascii_lowercase() || lowered.is_ascii_digit() {
+                        lowered
+                    } else {
+                        '-'
+                    }
+                })
+                .collect::<String>()
+        })
+        .unwrap_or_default();
+    let trimmed = sanitized.trim_matches('-').to_owned();
+    if trimmed.is_empty() {
+        FALLBACK_SOURCE_ID.to_owned()
+    } else {
+        trimmed
+    }
+}
+
+/// The error a run gets when it has neither a terminal to ask on nor the
+/// flags that answer the questions.
+fn missing_flags_message(args: &SuggestArgs) -> String {
+    let mut missing: Vec<&str> = Vec::new();
+    if args.operation.is_none() {
+        missing.push("--operation");
+    }
+    if args.selection.is_empty() {
+        missing.push("--select");
+    }
+    format!(
+        "this run has no terminal to prompt on, so it needs {} on the command line; \
+         run it in a terminal to choose interactively, or pass the missing flags \
+         (an interactive run prints the equivalent fully-flagged command)",
+        missing.join(" and ")
+    )
+}
diff --git a/crates/registry-evidencectl/src/suggest/narrow.rs b/crates/registry-evidencectl/src/suggest/narrow.rs
new file mode 100644
index 000000000..4d7a59db3
--- /dev/null
+++ b/crates/registry-evidencectl/src/suggest/narrow.rs
@@ -0,0 +1,1054 @@
+//! Narrowing a resolved response schema to the Evidence closed schema subset.
+//!
+//! The runtime validates a projected response against a bundle-relative
+//! `responseSchema` written in the closed Version 1 subset: objects are closed
+//! and declare bounded properties, arrays declare `maxItems` in `1..=256`,
+//! integers declare both `minimum` and `maximum` or an enumeration or a
+//! constant, strings declare `maxLength` or one of the two date formats or an
+//! enumeration or a constant, and the only admitted union is the response-role
+//! pair `[T, "null"]`. Two relaxations belong to the response role alone:
+//! `required` may be a subset of the declared properties, because projection
+//! drops a selected leaf the record did not carry, and a node may be null.
+//!
+//! This module does two things over that subset and nothing else:
+//!
+//! - [`plan_advisories`] enumerates the bounds the subset demands and the OpenAPI
+//!   document does not already state, each with the best suggestion the
+//!   inputs support and the provenance of that suggestion.
+//! - [`apply`] prunes the schema to the projection selection and rewrites it
+//!   into the subset, inserting the bounds a human confirmed and omitting the
+//!   ones nobody did.
+//!
+//! The module never invents a bound. An unresolved bound is left out of the
+//! emitted schema and reported in [`NarrowOutcome::unresolved`], so the draft
+//! fails `evidence check` until an operator supplies it. The runtime stays the
+//! only validator of the subset; this module only generates toward it.
+
+use std::collections::BTreeMap;
+
+use anyhow::{bail, Context as _, Result};
+use serde_json::{Map as JsonMap, Value};
+
+use super::types::{
+    BoundKind, BoundNeed, BoundValues, NarrowOutcome, Observations, Observed, Provenance,
+    ResolvedSchema, SuggestedBound, RECURSIVE_REF_KEY,
+};
+
+/// The largest `maxItems` the closed subset admits.
+const MAX_ITEMS_CEILING: u64 = 256;
+/// The largest `maxLength` the closed subset admits.
+const MAX_LENGTH_CEILING: u64 = 65_536;
+/// The largest number of properties one closed object may declare.
+const MAX_PROPERTIES: usize = 64;
+/// The largest enumeration the closed subset admits.
+const MAX_ENUM_MEMBERS: usize = 256;
+/// The byte length of a canonical hyphenated UUID.
+const UUID_LENGTH: u64 = 36;
+/// The smallest string bound derived from a sample. Below this a bound says
+/// more about the one response that was read than about the source.
+const SAMPLE_STRING_FLOOR: u64 = 16;
+/// The bucket a sampled array length is rounded up to.
+const SAMPLE_ARRAY_BUCKET: u64 = 8;
+/// The smallest integer maximum derived from a sample, for the same reason as
+/// the string floor.
+const SAMPLE_INTEGER_FLOOR: u64 = 10;
+
+/// Everything the narrowing stage can say about a schema before a human
+/// decides anything: the bounds the subset still demands, and the findings
+/// that are not bound decisions.
+#[derive(Debug, Clone, Default)]
+pub struct Plan {
+    /// Bounds the closed subset demands and the specification does not state,
+    /// in schema order.
+    pub needs: Vec<BoundNeed>,
+    /// Facts an operator should see that are not bound decisions.
+    pub advisories: Vec<Advisory>,
+}
+
+/// One thing worth telling the operator about a node that is not a missing
+/// bound. Advisories never change the emitted schema.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Advisory {
+    /// The extended projection pointer of the node it concerns.
+    pub pointer: String,
+    pub kind: AdvisoryKind,
+}
+
+/// What an [`Advisory`] reports.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum AdvisoryKind {
+    /// The sample carried an explicit null where the specification does not
+    /// admit one. The emitted schema follows the specification, so the draft
+    /// rejects that response until the operator writes the node as the
+    /// response-role pair `[T, "null"]`.
+    NullOutsideSpec,
+    /// A string `format` outside the closed subset was dropped. The subset
+    /// admits `date` and `date-time` only; every other format survives, if at
+    /// all, as a length bound.
+    DroppedFormat(String),
+}
+
+impl Advisory {
+    /// A one-line explanation, safe to print: it names the pointer and the
+    /// rule, never a sampled value.
+    pub fn message(&self) -> String {
+        match &self.kind {
+            AdvisoryKind::NullOutsideSpec => format!(
+                "`{}` was null in the sample but the specification does not admit null; \
+                 write the node as the pair [T, \"null\"] if the source really reports it",
+                display_pointer(&self.pointer)
+            ),
+            AdvisoryKind::DroppedFormat(format) => format!(
+                "`{}` declares format `{format}`, which the closed subset does not admit; \
+                 the subset admits `date` and `date-time` only",
+                display_pointer(&self.pointer)
+            ),
+        }
+    }
+}
+
+/// Enumerates every bound the closed subset demands of the selected subtrees
+/// and the specification does not already satisfy.
+///
+/// Contract:
+///
+/// - `selection` holds extended projection pointers (`~0`/`~1` escapes, `*`
+///   for every array element). Duplicates, ancestor and descendant overlaps,
+///   pointers absent from the schema, and numeric array indexes are errors:
+///   bundle validation would reject the projection they describe, so they
+///   fail here first.
+/// - A bound the specification states inside the subset raises no need at all.
+/// - Each need carries the best derivable suggestion, by precedence
+///   `Spec` > `Format` > `Sample`. `Spec` appears when a stated bound is
+///   outside the subset and can be clamped into it; `Format` only for `uuid`,
+///   which is a fixed 36-byte string; `Sample` is widened by the policy
+///   documented on [`widen_integer_range`], [`widen_string_length`] and
+///   [`widen_array_items`]. A need with no derivable value carries none: this
+///   module never invents a bound.
+/// - Needs are returned in schema order.
+///
+/// The returned [`Plan`] also carries the findings that are not bound
+/// decisions: an explicit null the specification does not admit, and every
+/// string format the closed subset made this stage drop.
+pub fn plan_advisories(
+    schema: &ResolvedSchema,
+    selection: &[String],
+    observations: &Observations,
+) -> Result<Plan> {
+    let selected = build_selection(selection)?;
+    let mut narrowing = Narrowing {
+        observations,
+        resolutions: &[],
+        needs: Vec::new(),
+        advisories: Vec::new(),
+    };
+    narrowing.narrow(&schema.0, &selected, "", true)?;
+    Ok(Plan {
+        needs: narrowing.needs,
+        advisories: narrowing.advisories,
+    })
+}
+
+/// Produces the closed-subset response schema for the selected subtrees.
+///
+/// Contract:
+///
+/// - The selection is validated exactly as in [`plan_advisories`].
+/// - The result is pruned to the selected subtrees and the containers needed
+///   to reach them. Selecting a container keeps its whole subtree.
+/// - Every object is closed with `additionalProperties: false` and declares
+///   `required` as the members the specification marks required among the
+///   members that were kept. A record reached through `*` therefore requires
+///   nothing unless the specification guarantees that member of every record.
+/// - Enumerations, constants, `uniqueItems`, in-subset bounds and the `date`
+///   and `date-time` formats are carried through. Every other format is
+///   dropped, because the subset admits no other. A `[T, "null"]` type pair is
+///   preserved.
+/// - A bound in `resolutions` is written into the schema after being checked
+///   against the subset limits; a bound nobody resolved is omitted entirely
+///   and returned in [`NarrowOutcome::unresolved`] in schema order. A
+///   resolution matching no need is an error rather than a silent no-op.
+/// - Arrays declare `minItems`, from the specification when it states one and
+///   `0` otherwise: an empty page survives projection, and saying so
+///   constrains nothing.
+pub fn apply(
+    schema: &ResolvedSchema,
+    selection: &[String],
+    resolutions: &BTreeMap<(String, BoundKind), BoundValues>,
+) -> Result<NarrowOutcome> {
+    let entries: Vec<Resolution> = resolutions
+        .iter()
+        .map(|(key, values)| (key.clone(), values.clone()))
+        .collect();
+    apply_entries(schema, selection, &entries)
+}
+
+/// [`apply`] over resolutions held as a slice rather than a map.
+///
+/// [`apply`] takes the map form `Decisions` declares and delegates here; this
+/// entry point takes the same pairs as a slice, for a caller holding them in
+/// schema order rather than keyed. Order is not significant; duplicate keys
+/// resolve to the first entry.
+pub fn apply_entries(
+    schema: &ResolvedSchema,
+    selection: &[String],
+    resolutions: &[Resolution],
+) -> Result<NarrowOutcome> {
+    let selected = build_selection(selection)?;
+    let observations = Observations::default();
+    let mut narrowing = Narrowing {
+        observations: &observations,
+        resolutions,
+        needs: Vec::new(),
+        advisories: Vec::new(),
+    };
+    let narrowed = narrowing.narrow(&schema.0, &selected, "", true)?;
+    for (pointer, kind) in resolutions.iter().map(|(key, _)| key) {
+        if !narrowing
+            .needs
+            .iter()
+            .any(|need| &need.pointer == pointer && &need.kind == kind)
+        {
+            bail!(
+                "the resolved {} for `{}` matches no bound this schema needs; \
+                 check the pointer against the selection",
+                kind.label(),
+                display_pointer(pointer)
+            );
+        }
+    }
+    let unresolved = narrowing
+        .needs
+        .into_iter()
+        .filter(|need| resolution(resolutions, &need.pointer, &need.kind).is_none())
+        .collect();
+    Ok(NarrowOutcome {
+        schema: narrowed,
+        unresolved,
+    })
+}
+
+/// Rounds a sampled array length up to the next multiple of eight, with eight
+/// as the floor, clamped to the subset ceiling of 256.
+///
+/// One response is weak evidence of how long a page can be, so the bound is
+/// deliberately looser than what was seen. It still has to stay inside the
+/// subset, and an operator confirms it before it is written.
+fn widen_array_items(observed: u64) -> u64 {
+    let bucketed = observed
+        .max(1)
+        .div_ceil(SAMPLE_ARRAY_BUCKET)
+        .saturating_mul(SAMPLE_ARRAY_BUCKET);
+    bucketed.clamp(SAMPLE_ARRAY_BUCKET, MAX_ITEMS_CEILING)
+}
+
+/// Rounds a sampled string byte length up to the next power of two, with 16 as
+/// the floor, clamped to the subset ceiling of 65,536.
+fn widen_string_length(observed: u64) -> u64 {
+    let mut widened = SAMPLE_STRING_FLOOR;
+    while widened < observed && widened < MAX_LENGTH_CEILING {
+        widened = widened.saturating_mul(2);
+    }
+    widened.clamp(SAMPLE_STRING_FLOOR, MAX_LENGTH_CEILING)
+}
+
+/// Widens a sampled integer range outward to round numbers.
+///
+/// A non-negative observed minimum is kept at `0`: a count or a total that
+/// never went below zero in one sample is not evidence of a floor above it. A
+/// negative minimum is widened by half again of its magnitude, rounded away
+/// from zero to the next number of the form `{1,2,5} x 10^k`.
+///
+/// The maximum is treated far more generously, because a sampled integer is
+/// usually a counter and one response says almost nothing about how high it
+/// can climb: it becomes the next power of ten at or above twice what was
+/// observed, with a floor of ten. Observing 12 therefore suggests 100 and
+/// observing 60 suggests 1000. A ceiling that is merely snug around the sample
+/// is the bound most likely to reject a legitimate response later, and the
+/// operator confirms it before it is written.
+fn widen_integer_range(min_observed: i64, max_observed: i64) -> (i64, i64) {
+    let minimum = if min_observed >= 0 {
+        0
+    } else {
+        let magnitude = min_observed.unsigned_abs();
+        let widened = round_up_to_round_number(magnitude.saturating_add(magnitude / 2));
+        i64::try_from(widened).map_or(i64::MIN, |widened| -widened)
+    };
+    let target = if max_observed <= 0 {
+        0
+    } else {
+        max_observed.unsigned_abs().saturating_mul(2)
+    };
+    let maximum = next_power_of_ten(target.max(SAMPLE_INTEGER_FLOOR));
+    (minimum, i64::try_from(maximum).unwrap_or(i64::MAX))
+}
+
+/// The smallest power of ten that is at least `value`.
+fn next_power_of_ten(value: u64) -> u64 {
+    let mut power: u64 = 1;
+    while power < value {
+        let Some(next) = power.checked_mul(10) else {
+            return u64::MAX;
+        };
+        power = next;
+    }
+    power
+}
+
+/// The smallest number of the form `{1,2,5} x 10^k` that is at least `value`.
+fn round_up_to_round_number(value: u64) -> u64 {
+    if value <= 1 {
+        return 1;
+    }
+    let mut scale: u64 = 1;
+    loop {
+        for step in [1, 2, 5] {
+            let Some(candidate) = scale.checked_mul(step) else {
+                return u64::MAX;
+            };
+            if candidate >= value {
+                return candidate;
+            }
+        }
+        let Some(next) = scale.checked_mul(10) else {
+            return u64::MAX;
+        };
+        scale = next;
+    }
+}
+
+/// One segment of an extended projection pointer.
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum Segment {
+    /// An ordinary object member, already unescaped.
+    Key(String),
+    /// The reserved segment `*`, visiting every element of an array.
+    Wildcard,
+}
+
+/// The selection as a tree. A node either terminates a projection entry, in
+/// which case its whole subtree is projected, or names the children selected
+/// beneath it.
+#[derive(Debug, Default)]
+struct Selected {
+    /// The projection entry terminating here, kept for error messages.
+    terminal: Option<String>,
+    children: Vec<(Segment, Selected)>,
+}
+
+impl Selected {
+    fn child(&self, segment: &Segment) -> Option<&Selected> {
+        self.children
+            .iter()
+            .find_map(|(candidate, node)| (candidate == segment).then_some(node))
+    }
+
+    /// Any projection entry terminating at or beneath this node.
+    fn first_terminal(&self) -> Option<&str> {
+        if let Some(terminal) = &self.terminal {
+            return Some(terminal);
+        }
+        self.children
+            .iter()
+            .find_map(|(_, node)| node.first_terminal())
+    }
+
+    /// The entry to name in a message about this node.
+    fn blamed(&self) -> &str {
+        self.first_terminal().unwrap_or("(unknown entry)")
+    }
+}
+
+/// Parses and validates the selection into a tree.
+///
+/// Duplicate entries and ancestor/descendant overlaps are rejected here,
+/// naming both entries, because bundle validation would reject the projection
+/// they describe and a failure at authoring time is cheaper to read.
+fn build_selection(selection: &[String]) -> Result<Selected> {
+    if selection.is_empty() {
+        bail!("the projection selection is empty: select at least one response leaf");
+    }
+    let mut root = Selected::default();
+    for pointer in selection {
+        let segments = parse_pointer(pointer)?;
+        insert_selection(&mut root, &segments, pointer)?;
+    }
+    Ok(root)
+}
+
+fn insert_selection(node: &mut Selected, segments: &[Segment], pointer: &str) -> Result<()> {
+    let Some((head, tail)) = segments.split_first() else {
+        if let Some(owner) = &node.terminal {
+            bail!("projection entry `{pointer}` duplicates `{owner}`");
+        }
+        if let Some(descendant) = node.first_terminal() {
+            bail!(
+                "projection entries `{pointer}` and `{descendant}` overlap: \
+                 `{pointer}` already selects every leaf beneath it"
+            );
+        }
+        node.terminal = Some(pointer.to_owned());
+        return Ok(());
+    };
+    if let Some(owner) = &node.terminal {
+        bail!(
+            "projection entries `{owner}` and `{pointer}` overlap: \
+             `{owner}` already selects every leaf beneath it"
+        );
+    }
+    let index = match node
+        .children
+        .iter()
+        .position(|(segment, _)| segment == head)
+    {
+        Some(index) => index,
+        None => {
+            node.children.push((head.clone(), Selected::default()));
+            node.children.len() - 1
+        }
+    };
+    insert_selection(&mut node.children[index].1, tail, pointer)
+}
+
+/// Splits an extended projection pointer into segments.
+fn parse_pointer(pointer: &str) -> Result<Vec<Segment>> {
+    if pointer.is_empty() {
+        bail!("a projection entry is empty: an entry names at least one segment, e.g. `/total`");
+    }
+    let Some(body) = pointer.strip_prefix('/') else {
+        bail!("projection entry `{pointer}` must start with `/`");
+    };
+    body.split('/')
+        .map(|raw| parse_segment(raw, pointer))
+        .collect()
+}
+
+fn parse_segment(raw: &str, pointer: &str) -> Result<Segment> {
+    if raw == "*" {
+        return Ok(Segment::Wildcard);
+    }
+    if raw.is_empty() {
+        bail!("projection entry `{pointer}` has an empty segment");
+    }
+    let mut decoded = String::with_capacity(raw.len());
+    let mut characters = raw.chars();
+    while let Some(character) = characters.next() {
+        if character != '~' {
+            decoded.push(character);
+            continue;
+        }
+        match characters.next() {
+            Some('0') => decoded.push('~'),
+            Some('1') => decoded.push('/'),
+            _ => bail!(
+                "projection entry `{pointer}` has an invalid escape: \
+                 RFC 6901 defines `~0` and `~1` only"
+            ),
+        }
+    }
+    Ok(Segment::Key(decoded))
+}
+
+/// Appends one already-decoded member name to a pointer, re-escaping it.
+fn child_pointer(parent: &str, key: &str) -> String {
+    format!("{parent}/{}", key.replace('~', "~0").replace('/', "~1"))
+}
+
+/// Renders a pointer for a message, naming the root rather than printing an
+/// empty string.
+pub fn display_pointer(pointer: &str) -> &str {
+    if pointer.is_empty() {
+        "(response root)"
+    } else {
+        pointer
+    }
+}
+
+/// One confirmed bound, keyed the way [`Decisions::resolutions`] keys it.
+///
+/// [`Decisions::resolutions`]: super::types::Decisions::resolutions
+pub type Resolution = ((String, BoundKind), BoundValues);
+
+/// Looks a resolution up. [`BoundKind`] carries no ordering, so resolutions
+/// are scanned rather than searched; a selection is a handful of entries.
+fn resolution<'a>(
+    resolutions: &'a [Resolution],
+    pointer: &str,
+    kind: &BoundKind,
+) -> Option<&'a BoundValues> {
+    resolutions
+        .iter()
+        .find_map(|((candidate, candidate_kind), values)| {
+            (candidate == pointer && candidate_kind == kind).then_some(values)
+        })
+}
+
+/// One narrowing pass. It emits the pruned schema and collects, in schema
+/// order, every bound the subset demands and every advisory.
+struct Narrowing<'a> {
+    observations: &'a Observations,
+    resolutions: &'a [Resolution],
+    needs: Vec<BoundNeed>,
+    advisories: Vec<Advisory>,
+}
+
+impl Narrowing<'_> {
+    fn observed(&self, pointer: &str) -> Option<&Observed> {
+        self.observations.by_pointer.get(pointer)
+    }
+
+    /// Records a demanded bound and returns the resolution for it, when a
+    /// human supplied one.
+    fn demand(
+        &mut self,
+        pointer: &str,
+        kind: BoundKind,
+        suggestion: Option<SuggestedBound>,
+    ) -> Option<BoundValues> {
+        let resolved = resolution(self.resolutions, pointer, &kind).cloned();
+        self.needs.push(BoundNeed {
+            pointer: pointer.to_owned(),
+            kind,
+            suggestion,
+        });
+        resolved
+    }
+
+    fn advise(&mut self, pointer: &str, kind: AdvisoryKind) {
+        self.advisories.push(Advisory {
+            pointer: pointer.to_owned(),
+            kind,
+        });
+    }
+
+    fn narrow(
+        &mut self,
+        schema: &Value,
+        selected: &Selected,
+        pointer: &str,
+        at_root: bool,
+    ) -> Result<Value> {
+        let node = schema.as_object().with_context(|| {
+            format!(
+                "the schema node at `{}` is not an object; every node in the closed subset is one",
+                display_pointer(pointer)
+            )
+        })?;
+        // Reachable only by selecting a whole subtree that contains a cut
+        // recursion: the flattener never offers the cut node itself as a leaf.
+        if let Some(reference) = node.get(RECURSIVE_REF_KEY).and_then(Value::as_str) {
+            bail!(
+                "the node at `{}` repeats the $ref cycle `{reference}`; a schema with no end \
+                 cannot be projected, so select the members you need rather than the subtree \
+                 above it",
+                display_pointer(pointer)
+            );
+        }
+        let Some((base, nullable)) = node_type(node, pointer)? else {
+            // A node with no type but a bounded const is admitted as it is.
+            reject_descent(selected, pointer)?;
+            let mut narrowed = JsonMap::new();
+            carry(node, "const", &mut narrowed);
+            return Ok(Value::Object(narrowed));
+        };
+        if nullable && at_root {
+            bail!(
+                "the response schema root is a plain object in the closed subset; \
+                 the `[T, \"null\"]` pair is not admitted there"
+            );
+        }
+        if !nullable && self.observed(pointer).is_some_and(|seen| seen.saw_null) {
+            self.advise(pointer, AdvisoryKind::NullOutsideSpec);
+        }
+        let mut narrowed = JsonMap::new();
+        narrowed.insert(
+            "type".to_owned(),
+            if nullable {
+                Value::Array(vec![Value::from(base), Value::from("null")])
+            } else {
+                Value::from(base)
+            },
+        );
+        match base {
+            "object" => self.narrow_object(node, selected, pointer, &mut narrowed)?,
+            "array" => self.narrow_array(node, selected, pointer, &mut narrowed)?,
+            "string" => {
+                reject_descent(selected, pointer)?;
+                self.narrow_string(node, pointer, &mut narrowed)?;
+            }
+            "integer" => {
+                reject_descent(selected, pointer)?;
+                self.narrow_integer(node, pointer, &mut narrowed)?;
+            }
+            "boolean" => {
+                reject_descent(selected, pointer)?;
+                carry(node, "enum", &mut narrowed);
+                carry(node, "const", &mut narrowed);
+            }
+            other => bail!(
+                "the node at `{}` has type `{other}`, which is outside the closed Version 1 \
+                 subset; that subset admits object, array, string, integer and boolean",
+                display_pointer(pointer)
+            ),
+        }
+        Ok(Value::Object(narrowed))
+    }
+
+    fn narrow_object(
+        &mut self,
+        node: &JsonMap<String, Value>,
+        selected: &Selected,
+        pointer: &str,
+        narrowed: &mut JsonMap<String, Value>,
+    ) -> Result<()> {
+        let properties = node
+            .get("properties")
+            .and_then(Value::as_object)
+            .with_context(|| {
+                format!(
+                    "the object at `{}` declares no properties; the closed subset needs them",
+                    display_pointer(pointer)
+                )
+            })?;
+        let whole = selected.terminal.is_some();
+        if !whole {
+            for (segment, child) in &selected.children {
+                let Segment::Key(key) = segment else {
+                    bail!(
+                        "projection entry `{}` uses `*` at `{}`, which is an object, not an array",
+                        child.blamed(),
+                        display_pointer(pointer)
+                    );
+                };
+                if !properties.contains_key(key) {
+                    bail!(
+                        "projection entry `{}` names `{key}`, which the response schema does \
+                         not declare at `{}`",
+                        child.blamed(),
+                        display_pointer(pointer)
+                    );
+                }
+            }
+        }
+        let spec_required: Vec<&str> = node
+            .get("required")
+            .and_then(Value::as_array)
+            .map(|values| values.iter().filter_map(Value::as_str).collect())
+            .unwrap_or_default();
+        let mut kept = JsonMap::new();
+        let mut required = Vec::new();
+        for (key, child_schema) in properties {
+            let child_selected = if whole {
+                selected
+            } else {
+                match selected.child(&Segment::Key(key.clone())) {
+                    Some(child) => child,
+                    None => continue,
+                }
+            };
+            let child = child_pointer(pointer, key);
+            let narrowed_child = self.narrow(child_schema, child_selected, &child, false)?;
+            if spec_required.contains(&key.as_str()) {
+                required.push(Value::from(key.clone()));
+            }
+            kept.insert(key.clone(), narrowed_child);
+        }
+        if kept.is_empty() {
+            bail!(
+                "no member of the object at `{}` is selected; a closed object declares at \
+                 least one property",
+                display_pointer(pointer)
+            );
+        }
+        if kept.len() > MAX_PROPERTIES {
+            bail!(
+                "the object at `{}` keeps {} members; the closed subset admits at most \
+                 {MAX_PROPERTIES}",
+                display_pointer(pointer),
+                kept.len()
+            );
+        }
+        narrowed.insert("additionalProperties".to_owned(), Value::Bool(false));
+        narrowed.insert("required".to_owned(), Value::Array(required));
+        narrowed.insert("properties".to_owned(), Value::Object(kept));
+        Ok(())
+    }
+
+    fn narrow_array(
+        &mut self,
+        node: &JsonMap<String, Value>,
+        selected: &Selected,
+        pointer: &str,
+        narrowed: &mut JsonMap<String, Value>,
+    ) -> Result<()> {
+        let items = node.get("items").with_context(|| {
+            format!(
+                "the array at `{}` does not close its item type; the closed subset needs `items`",
+                display_pointer(pointer)
+            )
+        })?;
+        let child_selected = if selected.terminal.is_some() {
+            selected
+        } else {
+            match selected.child(&Segment::Wildcard) {
+                Some(child) => child,
+                None => bail!(
+                    "projection entry `{}` addresses the array at `{}` by member name; \
+                     an array is visited with the reserved segment `*`, and numeric indexes \
+                     are not projection syntax",
+                    selected.blamed(),
+                    display_pointer(pointer)
+                ),
+            }
+        };
+        let spec_minimum = node.get("minItems").and_then(Value::as_u64);
+        let spec_maximum = node.get("maxItems").and_then(Value::as_u64);
+        let stated_in_subset = spec_maximum.is_some_and(|maximum| {
+            (1..=MAX_ITEMS_CEILING).contains(&maximum) && maximum >= spec_minimum.unwrap_or(0)
+        });
+        let maximum = if stated_in_subset {
+            spec_maximum
+        } else {
+            let suggestion = self.array_suggestion(pointer, spec_maximum, spec_minimum);
+            match self.demand(pointer, BoundKind::ArrayMaxItems, suggestion) {
+                Some(values) => Some(accept_max_items(&values, pointer)?),
+                None => None,
+            }
+        };
+        let minimum = match (spec_minimum, maximum) {
+            (Some(minimum), Some(maximum)) => minimum.min(maximum),
+            (Some(minimum), None) => minimum,
+            (None, _) => 0,
+        };
+        narrowed.insert("minItems".to_owned(), Value::from(minimum));
+        if let Some(maximum) = maximum {
+            narrowed.insert("maxItems".to_owned(), Value::from(maximum));
+        }
+        if node.get("uniqueItems").and_then(Value::as_bool) == Some(true) {
+            narrowed.insert("uniqueItems".to_owned(), Value::Bool(true));
+        }
+        carry(node, "const", narrowed);
+        let child = format!("{pointer}/*");
+        let narrowed_items = self.narrow(items, child_selected, &child, false)?;
+        narrowed.insert("items".to_owned(), narrowed_items);
+        Ok(())
+    }
+
+    /// The best `maxItems` the inputs support: a stated bound clamped into the
+    /// subset, else a widened sample observation, else nothing.
+    ///
+    /// A stated bound above the ceiling is reported as the ceiling's, not the
+    /// document's. A specification writing `maxItems: 2147483647` is declining
+    /// to bound the array; carrying its name onto the 256 the draft ends up
+    /// with would read as a promise the source never made.
+    fn array_suggestion(
+        &self,
+        pointer: &str,
+        spec_maximum: Option<u64>,
+        spec_minimum: Option<u64>,
+    ) -> Option<SuggestedBound> {
+        let floor = spec_minimum.unwrap_or(0).clamp(1, MAX_ITEMS_CEILING);
+        if let Some(stated) = spec_maximum {
+            let clamped = stated.clamp(floor, MAX_ITEMS_CEILING);
+            return Some(SuggestedBound {
+                values: BoundValues::MaxItems(clamped),
+                provenance: if clamped == stated {
+                    Provenance::Spec
+                } else {
+                    Provenance::SubsetCeiling
+                },
+            });
+        }
+        let observed = self.observed(pointer)?.max_array_items?;
+        Some(SuggestedBound {
+            values: BoundValues::MaxItems(widen_array_items(observed).max(floor)),
+            provenance: Provenance::Sample,
+        })
+    }
+
+    fn narrow_string(
+        &mut self,
+        node: &JsonMap<String, Value>,
+        pointer: &str,
+        narrowed: &mut JsonMap<String, Value>,
+    ) -> Result<()> {
+        let format = node.get("format").and_then(Value::as_str);
+        let dated = matches!(format, Some("date" | "date-time"));
+        if let Some(dropped) = format.filter(|_| !dated) {
+            self.advise(pointer, AdvisoryKind::DroppedFormat(dropped.to_owned()));
+        }
+        let spec_minimum = node.get("minLength").and_then(Value::as_u64);
+        let spec_maximum = node.get("maxLength").and_then(Value::as_u64);
+        let bounded =
+            spec_maximum.is_some_and(|maximum| (1..=MAX_LENGTH_CEILING).contains(&maximum));
+        let enumerated = is_bounded_enum(node, Value::is_string);
+        let constant = node
+            .get("const")
+            .and_then(Value::as_str)
+            .is_some_and(|value| value.len() as u64 <= MAX_LENGTH_CEILING);
+        if dated {
+            if let Some(format) = format {
+                narrowed.insert("format".to_owned(), Value::from(format));
+            }
+        }
+        if enumerated {
+            carry(node, "enum", narrowed);
+        }
+        if constant {
+            carry(node, "const", narrowed);
+        }
+        if bounded || dated || enumerated || constant {
+            if let Some((minimum, maximum)) = spec_minimum.zip(spec_maximum) {
+                if minimum > 0 && minimum <= maximum {
+                    narrowed.insert("minLength".to_owned(), Value::from(minimum));
+                }
+            }
+            if let Some(maximum) = spec_maximum.filter(|_| bounded) {
+                narrowed.insert("maxLength".to_owned(), Value::from(maximum));
+            }
+            return Ok(());
+        }
+        let suggestion = self.string_suggestion(pointer, format, spec_minimum, spec_maximum);
+        let Some(values) = self.demand(pointer, BoundKind::StringLength, suggestion) else {
+            return Ok(());
+        };
+        let (minimum, maximum) = accept_string_length(&values, pointer)?;
+        if minimum > 0 {
+            narrowed.insert("minLength".to_owned(), Value::from(minimum));
+        }
+        narrowed.insert("maxLength".to_owned(), Value::from(maximum));
+        Ok(())
+    }
+
+    /// The best string length the inputs support: a stated bound clamped into
+    /// the subset, else the fixed length a `uuid` format implies, else a
+    /// widened sample observation, else nothing. A stated bound above the
+    /// ceiling is attributed to the ceiling, for the reason
+    /// [`Self::array_suggestion`] gives.
+    fn string_suggestion(
+        &self,
+        pointer: &str,
+        format: Option<&str>,
+        spec_minimum: Option<u64>,
+        spec_maximum: Option<u64>,
+    ) -> Option<SuggestedBound> {
+        let minimum = spec_minimum.unwrap_or(0);
+        if spec_maximum.is_some_and(|maximum| maximum > MAX_LENGTH_CEILING) {
+            return Some(SuggestedBound {
+                values: BoundValues::StringLength {
+                    min_length: minimum.min(MAX_LENGTH_CEILING),
+                    max_length: MAX_LENGTH_CEILING,
+                },
+                provenance: Provenance::SubsetCeiling,
+            });
+        }
+        if format == Some("uuid") {
+            return Some(SuggestedBound {
+                values: BoundValues::StringLength {
+                    min_length: UUID_LENGTH,
+                    max_length: UUID_LENGTH,
+                },
+                provenance: Provenance::Format,
+            });
+        }
+        let observed = self.observed(pointer)?.max_string_bytes?;
+        let maximum = widen_string_length(observed);
+        Some(SuggestedBound {
+            values: BoundValues::StringLength {
+                min_length: minimum.min(maximum),
+                max_length: maximum,
+            },
+            provenance: Provenance::Sample,
+        })
+    }
+
+    fn narrow_integer(
+        &mut self,
+        node: &JsonMap<String, Value>,
+        pointer: &str,
+        narrowed: &mut JsonMap<String, Value>,
+    ) -> Result<()> {
+        let spec_minimum = node.get("minimum").and_then(Value::as_i64);
+        let spec_maximum = node.get("maximum").and_then(Value::as_i64);
+        let stated = spec_minimum
+            .zip(spec_maximum)
+            .filter(|(minimum, maximum)| minimum <= maximum);
+        let enumerated = is_bounded_enum(node, |value| value.as_i64().is_some());
+        let constant = node.get("const").and_then(Value::as_i64).is_some();
+        if enumerated {
+            carry(node, "enum", narrowed);
+        }
+        if constant {
+            carry(node, "const", narrowed);
+        }
+        if let Some((minimum, maximum)) = stated {
+            narrowed.insert("minimum".to_owned(), Value::from(minimum));
+            narrowed.insert("maximum".to_owned(), Value::from(maximum));
+            return Ok(());
+        }
+        if enumerated || constant {
+            return Ok(());
+        }
+        let suggestion = self.integer_suggestion(pointer, spec_minimum, spec_maximum);
+        let Some(values) = self.demand(pointer, BoundKind::IntegerRange, suggestion) else {
+            return Ok(());
+        };
+        let (minimum, maximum) = accept_integer_range(&values, pointer)?;
+        narrowed.insert("minimum".to_owned(), Value::from(minimum));
+        narrowed.insert("maximum".to_owned(), Value::from(maximum));
+        Ok(())
+    }
+
+    /// The best integer range the inputs support. A stated end is kept as it
+    /// stands and only the missing end is derived from the sample; with no
+    /// sample and only one stated end there is no suggestion, because the
+    /// other end would have to be invented.
+    fn integer_suggestion(
+        &self,
+        pointer: &str,
+        spec_minimum: Option<i64>,
+        spec_maximum: Option<i64>,
+    ) -> Option<SuggestedBound> {
+        let observed = self.observed(pointer);
+        let seen_minimum = observed.and_then(|seen| seen.min_integer);
+        let seen_maximum = observed.and_then(|seen| seen.max_integer);
+        let widened = seen_minimum
+            .or(seen_maximum)
+            .zip(seen_maximum.or(seen_minimum))
+            .map(|(minimum, maximum)| widen_integer_range(minimum, maximum));
+        let minimum = spec_minimum.or(widened.map(|(minimum, _)| minimum))?;
+        let maximum = spec_maximum.or(widened.map(|(_, maximum)| maximum))?;
+        if minimum > maximum {
+            return None;
+        }
+        Some(SuggestedBound {
+            values: BoundValues::IntegerRange { minimum, maximum },
+            provenance: if spec_minimum.is_some() && spec_maximum.is_some() {
+                Provenance::Spec
+            } else {
+                Provenance::Sample
+            },
+        })
+    }
+}
+
+/// Reads the one type a node declares, admitting the response-role pair
+/// `[T, "null"]`. Returns `None` for a node that declares a bounded const
+/// instead of a type.
+fn node_type<'node>(
+    node: &'node JsonMap<String, Value>,
+    pointer: &str,
+) -> Result<Option<(&'node str, bool)>> {
+    match node.get("type") {
+        None => {
+            if node.get("const").is_some() {
+                return Ok(None);
+            }
+            bail!(
+                "the node at `{}` declares no type; the closed subset needs one type \
+                 or one bounded const",
+                display_pointer(pointer)
+            )
+        }
+        Some(Value::String(name)) => Ok(Some((name.as_str(), false))),
+        Some(Value::Array(members)) => match members.as_slice() {
+            [Value::String(name), Value::String(null)] if null == "null" && name != "null" => {
+                Ok(Some((name.as_str(), true)))
+            }
+            _ => bail!(
+                "the node at `{}` declares a type union the closed subset does not admit; \
+                 a response node may write `[T, \"null\"]` and nothing else",
+                display_pointer(pointer)
+            ),
+        },
+        Some(_) => bail!(
+            "the node at `{}` declares a type that is neither a name nor a `[T, \"null\"]` pair",
+            display_pointer(pointer)
+        ),
+    }
+}
+
+/// Fails when a projection entry descends past a leaf.
+fn reject_descent(selected: &Selected, pointer: &str) -> Result<()> {
+    if selected.terminal.is_some() {
+        return Ok(());
+    }
+    bail!(
+        "projection entry `{}` descends past the leaf at `{}`",
+        selected.blamed(),
+        display_pointer(pointer)
+    )
+}
+
+/// Copies one keyword through unchanged when the node declares it.
+fn carry(node: &JsonMap<String, Value>, keyword: &str, narrowed: &mut JsonMap<String, Value>) {
+    if let Some(value) = node.get(keyword) {
+        narrowed.insert(keyword.to_owned(), value.clone());
+    }
+}
+
+/// True when the node declares an enumeration the closed subset admits.
+fn is_bounded_enum(node: &JsonMap<String, Value>, member: fn(&Value) -> bool) -> bool {
+    node.get("enum")
+        .and_then(Value::as_array)
+        .is_some_and(|values| {
+            !values.is_empty() && values.len() <= MAX_ENUM_MEMBERS && values.iter().all(member)
+        })
+}
+
+/// Checks a resolved `maxItems` against the subset before it is written.
+fn accept_max_items(values: &BoundValues, pointer: &str) -> Result<u64> {
+    let BoundValues::MaxItems(maximum) = values else {
+        bail!(
+            "the resolution for `{}` is not a maxItems value, but the array there needs one",
+            display_pointer(pointer)
+        );
+    };
+    if !(1..=MAX_ITEMS_CEILING).contains(maximum) {
+        bail!(
+            "the resolved maxItems {maximum} for `{}` is outside the closed subset range \
+             1..={MAX_ITEMS_CEILING}",
+            display_pointer(pointer)
+        );
+    }
+    Ok(*maximum)
+}
+
+/// Checks a resolved string length against the subset before it is written.
+fn accept_string_length(values: &BoundValues, pointer: &str) -> Result<(u64, u64)> {
+    let BoundValues::StringLength {
+        min_length,
+        max_length,
+    } = values
+    else {
+        bail!(
+            "the resolution for `{}` is not a string length, but the string there needs one",
+            display_pointer(pointer)
+        );
+    };
+    if *max_length == 0 || *max_length > MAX_LENGTH_CEILING || min_length > max_length {
+        bail!(
+            "the resolved string length {min_length}..={max_length} for `{}` is outside the \
+             closed subset range 1..={MAX_LENGTH_CEILING}",
+            display_pointer(pointer)
+        );
+    }
+    Ok((*min_length, *max_length))
+}
+
+/// Checks a resolved integer range against the subset before it is written.
+fn accept_integer_range(values: &BoundValues, pointer: &str) -> Result<(i64, i64)> {
+    let BoundValues::IntegerRange { minimum, maximum } = values else {
+        bail!(
+            "the resolution for `{}` is not an integer range, but the integer there needs one",
+            display_pointer(pointer)
+        );
+    };
+    if minimum > maximum {
+        bail!(
+            "the resolved integer range {minimum}..={maximum} for `{}` is empty",
+            display_pointer(pointer)
+        );
+    }
+    Ok((*minimum, *maximum))
+}
diff --git a/crates/registry-evidencectl/src/suggest/openapi.rs b/crates/registry-evidencectl/src/suggest/openapi.rs
new file mode 100644
index 000000000..49eb500d7
--- /dev/null
+++ b/crates/registry-evidencectl/src/suggest/openapi.rs
@@ -0,0 +1,716 @@
+//! Loads an OpenAPI 3.0.x or 3.1.x document, from a file or from a URL (see
+//! [`super::fetch`]), and resolves the pieces the `source suggest` pipeline
+//! needs: operation listings and one operation's response schema with every
+//! local `$ref` inlined.
+//!
+//! Only local `#/components/...` refs are followed, whichever way the
+//! document arrived: one document is fetched, never a graph of them. An
+//! external or remote `$ref` (anything not starting with `#/`)
+//! is rejected with a clear error rather than silently truncated or ignored,
+//! because a partially-resolved schema would let the closed-subset narrowing
+//! stage draft against data the runtime cannot actually see. A `$ref` cycle
+//! is different in kind: it is not missing information but an expansion with
+//! no end, so the repeat is cut in place, marked, and reported, and the rest
+//! of the operation stays draftable.
+//!
+//! Resolution also canonicalizes the two dialect spellings that describe
+//! something the closed subset already admits: a two-member union against
+//! `null` becomes the type pair `[T, "null"]`, and a node declaring
+//! `properties` or `items` and no `type` is read as the type that keyword
+//! belongs to. Neither adds a constraint the document does not state; each is
+//! reported as a note so the reading stays the operator's to reject.
+
+use std::path::Path;
+
+use anyhow::{anyhow, bail, Context, Result};
+use serde_json::Value;
+
+use super::fetch;
+use super::types::{
+    OperationKey, OperationSummary, ResolvedResponse, ResolvedSchema, SpecSource, RECURSIVE_REF_KEY,
+};
+
+/// Path Item Object keys this pipeline can draft a source from.
+///
+/// OpenAPI allows eight methods, but an Evidence fixed request declares one of
+/// two: the runtime's method enumeration is `GET` and `POST`. Offering any
+/// other method would only produce a source the runtime rejects, so the
+/// listing is filtered here rather than at the far end of the pipeline.
+const OPERATION_METHODS: [&str; 2] = ["get", "post"];
+
+/// OpenAPI documents larger than this are rejected before they are read, the
+/// way `sample::load_sample` rejects an oversized sample. The largest published
+/// registry API descriptions are a few megabytes; a document past this ceiling
+/// is a mistaken path rather than a specification to draft from.
+const MAX_DOCUMENT_BYTES: u64 = 16 * 1024 * 1024;
+
+/// Query parameter names that bound how many items one response carries,
+/// compared against the parameter's name lowercased with `_`, `-` and `.`
+/// removed.
+///
+/// The list is deliberately closed. A name outside it yields no page-size
+/// value at all, so the bound it would have set stays an unresolved
+/// `TODO(evidencectl)` for the operator to answer, which is the outcome this
+/// tool prefers over a bound it cannot justify. `page`, `pageNumber`,
+/// `pageIndex`, `offset` and `start` are absent on purpose: they count pages
+/// or positions, not items.
+const PAGE_SIZE_NAMES: [&str; 8] = [
+    "pagesize",
+    "perpage",
+    "size",
+    "limit",
+    "pagelimit",
+    "count",
+    "maxresults",
+    "maxrecords",
+];
+
+/// Whether `name` names a page-size query parameter, comparing the whole
+/// normalized name against [`PAGE_SIZE_NAMES`].
+fn is_page_size_name(name: &str) -> bool {
+    let normalized: String = name
+        .chars()
+        .filter(|character| !matches!(character, '_' | '-' | '.'))
+        .flat_map(char::to_lowercase)
+        .collect();
+    PAGE_SIZE_NAMES.contains(&normalized.as_str())
+}
+
+/// A loaded, dialect-checked OpenAPI document.
+///
+/// `open` accepts OpenAPI 3.0.x and 3.1.x, in YAML or JSON, from a local file
+/// or URL. It does not otherwise validate the document against the OpenAPI
+/// meta-schema; malformed structure surfaces as an error from whichever
+/// accessor first needs the missing or mistyped piece.
+#[derive(Debug, Clone)]
+pub struct Spec {
+    document: Value,
+}
+
+impl Spec {
+    /// Reads and parses the OpenAPI document `source` names, from disk or
+    /// from the network. Accepts YAML or JSON (YAML is a superset for this
+    /// purpose, so both are parsed the same way) and requires a top-level
+    /// `openapi: 3.0.x` or `3.1.x` version string.
+    pub fn open(source: &SpecSource) -> Result<Spec> {
+        Self::open_retained(source).map(|(spec, _)| spec)
+    }
+
+    /// Read and validate a document once while retaining its exact UTF-8 text.
+    ///
+    /// `evidencectl new` stores this text for the later question-authoring
+    /// step. Returning it from the same read that produced `Spec` prevents a
+    /// file change or a second network response from making the retained
+    /// document differ from the one that was validated.
+    pub(crate) fn open_retained(source: &SpecSource) -> Result<(Spec, String)> {
+        let text = match source {
+            SpecSource::File(path) => read_local(path)?,
+            SpecSource::Url(url) => fetch::get(url, MAX_DOCUMENT_BYTES)?,
+        };
+        let spec = Spec::parse(&text, &source.display())?;
+        Ok((spec, text))
+    }
+
+    /// Parses one already-read document, naming it `origin` in any error so
+    /// the message points at the file path or URL the operator passed rather
+    /// than at a buffer.
+    fn parse(text: &str, origin: &str) -> Result<Spec> {
+        let document: Value = serde_norway::from_str(text)
+            .with_context(|| format!("parsing {origin} as YAML or JSON"))?;
+        Self::from_value(document, origin)
+    }
+
+    /// Validate an already parsed, retained OpenAPI document.
+    ///
+    /// Local authoring reads its retained file once with owner and size checks,
+    /// then uses this constructor to share response reference resolution with
+    /// `source suggest` without reopening the file.
+    pub(crate) fn from_value(document: Value, origin: &str) -> Result<Spec> {
+        let version = document
+            .get("openapi")
+            .and_then(Value::as_str)
+            .ok_or_else(|| anyhow!("{origin} has no top-level `openapi` version string"))?;
+        if !(version.starts_with("3.0.") || version.starts_with("3.1.")) {
+            bail!(
+                "{origin} declares `openapi: {version}`; only OpenAPI 3.0.x and 3.1.x are supported"
+            );
+        }
+        Ok(Spec { document })
+    }
+
+    /// Every path-and-method operation that carries at least one JSON
+    /// response schema (a response whose media type contains `json`, e.g.
+    /// `application/json` or `application/problem+json`, and that declares
+    /// a `schema`). Operations with no JSON response are omitted because
+    /// they have nothing this pipeline can draft from.
+    pub fn operations(&self) -> Vec<OperationSummary> {
+        let mut out = Vec::new();
+        let Some(paths) = self.document.get("paths").and_then(Value::as_object) else {
+            return out;
+        };
+        for (path, path_item_raw) in paths {
+            let Ok(path_item) = self.resolve_top_ref(path_item_raw, &mut Vec::new()) else {
+                continue;
+            };
+            let Some(path_item) = path_item.as_object() else {
+                continue;
+            };
+            for method in OPERATION_METHODS {
+                let Some(operation) = path_item.get(method) else {
+                    continue;
+                };
+                let json_responses = self.json_responses(operation);
+                if json_responses.is_empty() {
+                    continue;
+                }
+                out.push(OperationSummary {
+                    key: OperationKey {
+                        method: method.to_ascii_uppercase(),
+                        path: path.clone(),
+                    },
+                    summary: operation
+                        .get("summary")
+                        .and_then(Value::as_str)
+                        .map(str::to_string),
+                    json_responses,
+                });
+            }
+        }
+        out
+    }
+
+    /// The `(status, media type)` pairs on `operation` whose media type
+    /// looks like JSON and which declare a response `schema`.
+    fn json_responses(&self, operation: &Value) -> Vec<(String, String)> {
+        let mut out = Vec::new();
+        let Some(responses) = operation.get("responses").and_then(Value::as_object) else {
+            return out;
+        };
+        for (status, response_raw) in responses {
+            let Ok(response) = self.resolve_top_ref(response_raw, &mut Vec::new()) else {
+                continue;
+            };
+            let Some(content) = response.get("content").and_then(Value::as_object) else {
+                continue;
+            };
+            for (media_type, media_object) in content {
+                if media_type.to_ascii_lowercase().contains("json")
+                    && media_object.get("schema").is_some()
+                {
+                    out.push((status.clone(), media_type.clone()));
+                }
+            }
+        }
+        out
+    }
+
+    /// The response schema for `key`'s `status`/`media_type` response, with
+    /// every local `$ref` inlined, the dialect normalized, and a note for each
+    /// reading the normalization had to make.
+    pub fn response_schema(
+        &self,
+        key: &OperationKey,
+        status: &str,
+        media_type: &str,
+    ) -> Result<ResolvedResponse> {
+        let operation = self.find_operation(key)?;
+        let responses = operation
+            .get("responses")
+            .and_then(Value::as_object)
+            .ok_or_else(|| anyhow!("{} {} declares no `responses`", key.method, key.path))?;
+        let response_raw = responses
+            .get(status)
+            .ok_or_else(|| anyhow!("{} {} has no `{status}` response", key.method, key.path))?;
+        let response = self
+            .resolve_top_ref(response_raw, &mut Vec::new())
+            .with_context(|| {
+                format!(
+                    "resolving the `{status}` response of {} {}",
+                    key.method, key.path
+                )
+            })?;
+        let content = response
+            .get("content")
+            .and_then(Value::as_object)
+            .ok_or_else(|| {
+                anyhow!(
+                    "{} {} `{status}` response declares no `content`",
+                    key.method,
+                    key.path
+                )
+            })?;
+        let media_object = content.get(media_type).ok_or_else(|| {
+            anyhow!(
+                "{} {} `{status}` response has no `{media_type}` content",
+                key.method,
+                key.path
+            )
+        })?;
+        let schema = media_object.get("schema").ok_or_else(|| {
+            anyhow!(
+                "{} {} `{status}` `{media_type}` response declares no `schema`",
+                key.method,
+                key.path
+            )
+        })?;
+        let mut notes = Vec::new();
+        let resolved = self
+            .inline_schema(schema, "", &mut Vec::new(), &mut notes)
+            .with_context(|| {
+                format!(
+                    "resolving the `{status}` `{media_type}` response schema of {} {}",
+                    key.method, key.path
+                )
+            })?;
+        Ok(ResolvedResponse {
+            schema: ResolvedSchema(resolved),
+            notes,
+        })
+    }
+
+    /// Base URLs from the document's top-level `servers` array, in document
+    /// order. Empty when the document declares none.
+    pub fn servers(&self) -> Vec<String> {
+        self.document
+            .get("servers")
+            .and_then(Value::as_array)
+            .map(|servers| {
+                servers
+                    .iter()
+                    .filter_map(|server| server.get("url").and_then(Value::as_str))
+                    .map(str::to_string)
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+
+    /// Integer `maximum` values found on `key`'s query parameters (path-item
+    /// level and operation level) whose name is one of [`PAGE_SIZE_NAMES`].
+    ///
+    /// This is a naming heuristic, not a semantic one: it does not attempt
+    /// to determine whether a matching parameter actually bounds page size,
+    /// and it looks only at the parameter's own `schema.maximum`. Later
+    /// pipeline stages decide whether and how to use the values as
+    /// `Provenance::PageSize`.
+    ///
+    /// The match is on the whole normalized name rather than a substring,
+    /// because a substring match cannot tell a page size from a page index:
+    /// `page` and `pageSize` both contain `page`, but only one of them bounds
+    /// how many items a response carries, and reading the other as an item
+    /// count would suggest a bound orders of magnitude too generous.
+    pub fn page_size_maximums(&self, key: &OperationKey) -> Result<Vec<i64>> {
+        let paths = self
+            .document
+            .get("paths")
+            .and_then(Value::as_object)
+            .ok_or_else(|| anyhow!("document has no `paths`"))?;
+        let path_item_raw = paths
+            .get(&key.path)
+            .ok_or_else(|| anyhow!("no path `{}` in the document", key.path))?;
+        let path_item = self.resolve_top_ref(path_item_raw, &mut Vec::new())?;
+
+        let mut maximums = Vec::new();
+        if let Some(parameters) = path_item.get("parameters").and_then(Value::as_array) {
+            self.collect_page_size_maximums(parameters, &mut maximums)?;
+        }
+        let operation = self.find_operation(key)?;
+        if let Some(parameters) = operation.get("parameters").and_then(Value::as_array) {
+            self.collect_page_size_maximums(parameters, &mut maximums)?;
+        }
+        Ok(maximums)
+    }
+
+    fn collect_page_size_maximums(&self, parameters: &[Value], out: &mut Vec<i64>) -> Result<()> {
+        for parameter_raw in parameters {
+            let parameter = self.resolve_top_ref(parameter_raw, &mut Vec::new())?;
+            let Some(name) = parameter.get("name").and_then(Value::as_str) else {
+                continue;
+            };
+            if parameter.get("in").and_then(Value::as_str) != Some("query") {
+                continue;
+            }
+            if !is_page_size_name(name) {
+                continue;
+            }
+            let Some(schema) = parameter.get("schema") else {
+                continue;
+            };
+            let resolved = self
+                .inline_schema(schema, "", &mut Vec::new(), &mut Vec::new())
+                .with_context(|| format!("resolving the schema of query parameter `{name}`"))?;
+            if let Some(maximum) = resolved.get("maximum").and_then(Value::as_i64) {
+                out.push(maximum);
+            }
+        }
+        Ok(())
+    }
+
+    /// Finds `key`'s Operation Object, resolving a path-item-level `$ref` if
+    /// present.
+    fn find_operation(&self, key: &OperationKey) -> Result<&Value> {
+        let paths = self
+            .document
+            .get("paths")
+            .and_then(Value::as_object)
+            .ok_or_else(|| anyhow!("document has no `paths`"))?;
+        let path_item_raw = paths
+            .get(&key.path)
+            .ok_or_else(|| anyhow!("no path `{}` in the document", key.path))?;
+        let path_item = self.resolve_top_ref(path_item_raw, &mut Vec::new())?;
+        let method = key.method.to_ascii_lowercase();
+        path_item
+            .get(&method)
+            .ok_or_else(|| anyhow!("path `{}` has no `{}` operation", key.path, key.method))
+    }
+
+    /// Follows a chain of `$ref` at the top level of `node` (a Response,
+    /// Parameter, or Path Item Object, none of which nest further schema
+    /// keywords the way a Schema Object does) until a non-`$ref` object is
+    /// reached. Returns `node` unchanged when it carries no `$ref`.
+    fn resolve_top_ref<'a>(
+        &'a self,
+        node: &'a Value,
+        stack: &mut Vec<String>,
+    ) -> Result<&'a Value> {
+        let Some(object) = node.as_object() else {
+            return Ok(node);
+        };
+        let Some(reference) = object.get("$ref").and_then(Value::as_str) else {
+            return Ok(node);
+        };
+        let pointer = local_ref_pointer(reference)?;
+        if stack.iter().any(|seen| seen == reference) {
+            bail!("$ref cycle detected at `{reference}`");
+        }
+        let target = resolve_pointer(&self.document, pointer)
+            .with_context(|| format!("resolving $ref `{reference}`"))?;
+        stack.push(reference.to_string());
+        let resolved = self.resolve_top_ref(target, stack)?;
+        stack.pop();
+        Ok(resolved)
+    }
+
+    /// Recursively inlines every local `$ref` inside a Schema Object and
+    /// normalizes the dialect. Per OpenAPI 3.0 semantics, a schema node
+    /// carrying `$ref` has any sibling keywords ignored; this function does the
+    /// same, uniformly, for simplicity.
+    ///
+    /// `pointer` locates `node` inside the response schema so a note can name
+    /// where it applies; it is the same extended projection form the flattener
+    /// produces, so the two read alike.
+    fn inline_schema(
+        &self,
+        node: &Value,
+        pointer: &str,
+        stack: &mut Vec<String>,
+        notes: &mut Vec<String>,
+    ) -> Result<Value> {
+        let Value::Object(object) = node else {
+            return Ok(node.clone());
+        };
+        if let Some(reference) = object.get("$ref").and_then(Value::as_str) {
+            let target_pointer = local_ref_pointer(reference)?;
+            if stack.iter().any(|seen| seen == reference) {
+                notes.push(format!(
+                    "`{}` repeats the $ref cycle `{reference}`; the repeat is cut there, so \
+                     nothing below it can be projected",
+                    display_pointer(pointer)
+                ));
+                return Ok(Value::Object(
+                    [(RECURSIVE_REF_KEY.to_owned(), Value::from(reference))]
+                        .into_iter()
+                        .collect(),
+                ));
+            }
+            let target = resolve_pointer(&self.document, target_pointer)
+                .with_context(|| format!("resolving $ref `{reference}`"))?
+                .clone();
+            stack.push(reference.to_string());
+            let inlined = self.inline_schema(&target, pointer, stack, notes);
+            stack.pop();
+            return inlined;
+        }
+
+        let mut result = serde_json::Map::with_capacity(object.len());
+        for (key, value) in object {
+            let inlined_value = match key.as_str() {
+                "properties" => match value.as_object() {
+                    Some(members) => {
+                        let mut properties = serde_json::Map::with_capacity(members.len());
+                        for (member_name, member_schema) in members {
+                            let member_pointer =
+                                format!("{pointer}/{}", escape_pointer_segment(member_name));
+                            properties.insert(
+                                member_name.clone(),
+                                self.inline_schema(member_schema, &member_pointer, stack, notes)?,
+                            );
+                        }
+                        Value::Object(properties)
+                    }
+                    None => value.clone(),
+                },
+                "items" if value.is_object() => {
+                    self.inline_schema(value, &format!("{pointer}/*"), stack, notes)?
+                }
+                "not" | "additionalProperties" if value.is_object() => {
+                    self.inline_schema(value, pointer, stack, notes)?
+                }
+                "allOf" | "oneOf" | "anyOf" => {
+                    if let Some(members) = value.as_array() {
+                        let mut inlined_members = Vec::with_capacity(members.len());
+                        for member in members {
+                            inlined_members
+                                .push(self.inline_schema(member, pointer, stack, notes)?);
+                        }
+                        Value::Array(inlined_members)
+                    } else {
+                        value.clone()
+                    }
+                }
+                _ => value.clone(),
+            };
+            result.insert(key.clone(), inlined_value);
+        }
+        normalize_nullable(&mut result);
+        collapse_null_union(&mut result);
+        order_nullable_pair(&mut result);
+        infer_structural_type(&mut result, pointer, notes);
+        Ok(Value::Object(result))
+    }
+}
+
+/// Rewrites OpenAPI 3.0's `nullable: true` in place to the 3.1-style type
+/// pair `[T, "null"]`, removing the `nullable` keyword. A `nullable: true`
+/// with no `type` keyword to pair against is left unrepresented (the
+/// `nullable` key is still removed): the closed subset this pipeline drafts
+/// toward always requires an explicit type, so a later stage rejects the
+/// node as untyped rather than this function guessing one.
+fn normalize_nullable(object: &mut serde_json::Map<String, Value>) {
+    let Some(Value::Bool(true)) = object.remove("nullable") else {
+        return;
+    };
+    match object.get_mut("type") {
+        Some(Value::String(type_name)) => {
+            let pair = Value::Array(vec![
+                Value::String(type_name.clone()),
+                Value::String("null".to_string()),
+            ]);
+            object.insert("type".to_string(), pair);
+        }
+        Some(Value::Array(type_names))
+            if !type_names
+                .iter()
+                .any(|entry| entry.as_str() == Some("null")) =>
+        {
+            type_names.push(Value::String("null".to_string()));
+        }
+        _ => {}
+    }
+}
+
+/// Rewrites a two-member `anyOf`/`oneOf` whose members are one typed schema
+/// and the schema `{"type": "null"}` into that typed schema carrying the pair
+/// `[T, "null"]`.
+///
+/// This is the shape generators emit for an optional field, and it states
+/// exactly what the closed subset's one admitted union states. Rewriting it
+/// adds no constraint: the members are kept as they stand, and a keyword on
+/// the union node itself (a `description`, say) is carried over only where the
+/// kept member does not already state one, so nothing the document said is
+/// overwritten. Any other union, including one against `null` whose other
+/// member declares no type to pair against, is left for the flattening stage
+/// to skip and warn about.
+fn collapse_null_union(object: &mut serde_json::Map<String, Value>) {
+    let keyword = ["anyOf", "oneOf"]
+        .into_iter()
+        .find(|keyword| object.contains_key(*keyword));
+    let Some(keyword) = keyword else {
+        return;
+    };
+    let Some(members) = object.get(keyword).and_then(Value::as_array) else {
+        return;
+    };
+    let [first, second] = members.as_slice() else {
+        return;
+    };
+    let kept = match (is_null_schema(first), is_null_schema(second)) {
+        (true, false) => second,
+        (false, true) => first,
+        _ => return,
+    };
+    let Some(kept) = kept.as_object() else {
+        return;
+    };
+    let Some(paired) = nullable_type(kept.get("type")) else {
+        return;
+    };
+
+    let mut collapsed = kept.clone();
+    collapsed.insert("type".to_owned(), paired);
+    for (key, value) in object.iter() {
+        if key == keyword || collapsed.contains_key(key) {
+            continue;
+        }
+        collapsed.insert(key.clone(), value.clone());
+    }
+    *object = collapsed;
+}
+
+/// Whether `node` is the schema that admits only `null`.
+fn is_null_schema(node: &Value) -> bool {
+    node.get("type").and_then(Value::as_str) == Some("null")
+}
+
+/// The `[T, "null"]` pair for an existing `type` keyword, or `None` when there
+/// is no single non-`null` type to pair.
+fn nullable_type(declared: Option<&Value>) -> Option<Value> {
+    let null = Value::from("null");
+    match declared? {
+        Value::String(name) if name != "null" => {
+            Some(Value::Array(vec![Value::String(name.clone()), null]))
+        }
+        Value::Array(names) => {
+            let mut non_null = names
+                .iter()
+                .filter(|name| name.as_str() != Some("null"))
+                .cloned();
+            let single = non_null.next()?;
+            non_null
+                .next()
+                .is_none()
+                .then(|| Value::Array(vec![single, null]))
+        }
+        _ => None,
+    }
+}
+
+/// Writes a nullable type pair in the one order the closed subset admits.
+/// A document spelling it `["null", T]` describes the same node, and the
+/// spelling is not a reason to refuse it later.
+fn order_nullable_pair(object: &mut serde_json::Map<String, Value>) {
+    let Some(Value::Array(names)) = object.get("type") else {
+        return;
+    };
+    let [first, second] = names.as_slice() else {
+        return;
+    };
+    if first.as_str() == Some("null") && second.as_str().is_some_and(|name| name != "null") {
+        let reordered = Value::Array(vec![second.clone(), first.clone()]);
+        object.insert("type".to_owned(), reordered);
+    }
+}
+
+/// Reads the type of a node that declares a structural keyword and no `type`.
+///
+/// `properties` describes members of an object and `items` describes elements
+/// of an array; neither means anything on any other type, so the node is not
+/// ambiguous and reading it costs nothing the document did not already say.
+/// Several large registry APIs publish their collection wrappers exactly this
+/// way, and refusing them yields no draft at all rather than a narrower one.
+///
+/// The reading stops there. A node carrying no structural keyword is left
+/// untyped for the flattening stage to skip: there would be nothing to read it
+/// from, and guessing a scalar type is the kind of invention this tool does
+/// not do. A node already carrying `type`, a bounded `const`/`enum`, or a
+/// union keyword states its own shape and is left alone.
+fn infer_structural_type(
+    object: &mut serde_json::Map<String, Value>,
+    pointer: &str,
+    notes: &mut Vec<String>,
+) {
+    let stated = ["type", "const", "enum", "allOf", "oneOf", "anyOf"]
+        .into_iter()
+        .any(|keyword| object.contains_key(keyword));
+    if stated || object.contains_key(RECURSIVE_REF_KEY) {
+        return;
+    }
+    let (keyword, inferred) = if object.contains_key("properties") {
+        ("properties", "object")
+    } else if object.contains_key("items") {
+        ("items", "array")
+    } else {
+        return;
+    };
+    object.insert("type".to_owned(), Value::from(inferred));
+    notes.push(format!(
+        "`{}` declares no `type` but does declare `{keyword}`, so it is read as `{inferred}`",
+        display_pointer(pointer)
+    ));
+}
+
+/// Reads a local document, refusing one past the size ceiling before any of
+/// it is read into memory.
+fn read_local(path: &Path) -> Result<String> {
+    let metadata = std::fs::metadata(path)
+        .with_context(|| format!("reading OpenAPI document metadata at {}", path.display()))?;
+    if metadata.len() > MAX_DOCUMENT_BYTES {
+        bail!(
+            "OpenAPI document at {} is {} bytes, exceeding the {} byte limit",
+            path.display(),
+            metadata.len(),
+            MAX_DOCUMENT_BYTES
+        );
+    }
+    std::fs::read_to_string(path)
+        .with_context(|| format!("reading OpenAPI document at {}", path.display()))
+}
+
+/// Escapes an object member name into one RFC 6901 pointer segment, matching
+/// the flattening stage so a note and a candidate leaf name the same node the
+/// same way.
+fn escape_pointer_segment(name: &str) -> String {
+    name.replace('~', "~0").replace('/', "~1")
+}
+
+fn display_pointer(pointer: &str) -> &str {
+    if pointer.is_empty() {
+        "(root)"
+    } else {
+        pointer
+    }
+}
+
+/// Validates that `reference` is a local same-document ref (`#/...` or the
+/// whole-document `#`) and returns its JSON Pointer (without the leading
+/// `#`). Rejects anything else — a relative or absolute document reference,
+/// a URL, or a bare non-pointer fragment — as external or remote.
+fn local_ref_pointer(reference: &str) -> Result<&str> {
+    if reference == "#" {
+        return Ok("");
+    }
+    if reference.starts_with("#/") {
+        // Strip only the leading `#`, keeping the `/` that `resolve_pointer` expects.
+        Ok(&reference[1..])
+    } else {
+        Err(anyhow!(
+            "external or remote $ref `{reference}` is not supported; only local `#/...` refs are"
+        ))
+    }
+}
+
+/// Resolves an RFC 6901 JSON Pointer (without its leading `#`, e.g.
+/// `/components/schemas/Record`) against `document`.
+fn resolve_pointer<'a>(document: &'a Value, pointer: &str) -> Result<&'a Value> {
+    let mut current = document;
+    if pointer.is_empty() {
+        return Ok(current);
+    }
+    for raw_segment in pointer.split('/').skip(1) {
+        let segment = raw_segment.replace("~1", "/").replace("~0", "~");
+        current = match current {
+            Value::Object(map) => map
+                .get(&segment)
+                .ok_or_else(|| anyhow!("no member `{segment}` at this point in the document"))?,
+            Value::Array(items) => {
+                let index: usize = segment
+                    .parse()
+                    .map_err(|_| anyhow!("`{segment}` is not a valid array index"))?;
+                items
+                    .get(index)
+                    .ok_or_else(|| anyhow!("index {index} is out of bounds"))?
+            }
+            _ => bail!("cannot descend into a scalar value at `{segment}`"),
+        };
+    }
+    Ok(current)
+}
diff --git a/crates/registry-evidencectl/src/suggest/sample.rs b/crates/registry-evidencectl/src/suggest/sample.rs
new file mode 100644
index 000000000..05bc7fe01
--- /dev/null
+++ b/crates/registry-evidencectl/src/suggest/sample.rs
@@ -0,0 +1,171 @@
+//! Raw shape observation from a sample response.
+//!
+//! `observe` walks a sample JSON document against a selection of extended
+//! projection pointers (the same syntax `flatten` produces and the runtime's
+//! `request.projection` accepts: RFC 6901 segments with `~0`/`~1` escapes and
+//! the reserved segment `*` visiting every array element) and records what
+//! shape each selected leaf had: integer extremes, maximum string byte
+//! length, maximum array length, and whether an explicit null was seen. This
+//! is bookkeeping only; no widening policy and no subset validation happen
+//! here. That is the narrow stage's job, using these observations as one
+//! input among several (spec bounds and formats outrank a sample).
+//!
+//! Privacy invariant: no function in this module stores, logs, or returns a
+//! sample string *value*. Only its byte length crosses into an `Observed`.
+//! The same holds for every other JSON value: only lengths, integer
+//! extremes, array lengths, and a null flag are retained.
+
+use std::{collections::BTreeMap, fs, path::Path};
+
+use anyhow::{bail, Context, Result};
+use serde_json::Value;
+
+use super::types::{Observations, Observed};
+
+/// Sample files larger than this are rejected outright: a sample is read
+/// only to suggest bounds, never to carry bulk data through this tool.
+const MAX_SAMPLE_BYTES: u64 = 4 * 1024 * 1024;
+
+/// Read and parse a sample response document from `path`.
+///
+/// Rejects files over [`MAX_SAMPLE_BYTES`] with a clear message before
+/// reading their contents, and rejects a file that is not valid JSON. The
+/// parsed value is returned to the caller; this function does not log or
+/// otherwise surface any of its contents.
+pub fn load_sample(path: &Path) -> Result<Value> {
+    let metadata = fs::metadata(path)
+        .with_context(|| format!("failed to read sample file metadata at {}", path.display()))?;
+    if metadata.len() > MAX_SAMPLE_BYTES {
+        bail!(
+            "sample file at {} is {} bytes, exceeding the {} byte limit",
+            path.display(),
+            metadata.len(),
+            MAX_SAMPLE_BYTES
+        );
+    }
+    let bytes = fs::read(path)
+        .with_context(|| format!("failed to read sample file at {}", path.display()))?;
+    serde_json::from_slice(&bytes)
+        .with_context(|| format!("sample file at {} is not valid JSON", path.display()))
+}
+
+/// Walk `sample` following each pointer in `selection`, recording raw shape
+/// observations keyed by the pointer text exactly as given.
+///
+/// A pointer whose path is absent from the sample (a missing key, or a
+/// wildcard segment landing on a non-array) is simply left unobserved: that
+/// is not an error, since a sample need not exercise every selected leaf.
+/// A pointer that is not a well-formed extended JSON Pointer (empty, or not
+/// starting with `/`) is a caller error and returns `Err`.
+///
+/// Every array visited through a `*` segment is also recorded, keyed by the
+/// array's own pointer (the selection prefix up to that segment), holding
+/// the largest length seen across every occurrence of that array shape in
+/// the sample. A selection pointer that itself resolves to an array (no
+/// trailing `*`) is recorded the same way, keyed by the selection pointer.
+pub fn observe(sample: &Value, selection: &[String]) -> Result<Observations> {
+    let mut by_pointer: BTreeMap<String, Observed> = BTreeMap::new();
+    for pointer in selection {
+        observe_one(sample, pointer, &mut by_pointer)?;
+    }
+    Ok(Observations { by_pointer })
+}
+
+/// Parse one extended pointer and walk `root` with it, folding results into
+/// `by_pointer`.
+fn observe_one(
+    root: &Value,
+    pointer: &str,
+    by_pointer: &mut BTreeMap<String, Observed>,
+) -> Result<()> {
+    if pointer.is_empty() || !pointer.starts_with('/') {
+        bail!(
+            "projection pointer {pointer:?} must be a non-empty extended JSON Pointer starting with \"/\""
+        );
+    }
+    let tokens: Vec<&str> = pointer.split('/').skip(1).collect();
+    walk(root, &tokens, String::new(), by_pointer);
+    Ok(())
+}
+
+/// Follow `tokens` from `value`, tracking the pointer text already consumed
+/// in `prefix` so recorded map keys are built from the same escaped text the
+/// caller supplied rather than a re-derived (and possibly different)
+/// rendering.
+fn walk(
+    value: &Value,
+    tokens: &[&str],
+    prefix: String,
+    by_pointer: &mut BTreeMap<String, Observed>,
+) {
+    match tokens.split_first() {
+        None => record(value, &prefix, by_pointer),
+        Some((&"*", rest)) => {
+            if let Value::Array(items) = value {
+                // `prefix` here is the pointer to the array itself: the
+                // selection text consumed so far, before this `*` segment.
+                record(value, &prefix, by_pointer);
+                let element_prefix = format!("{prefix}/*");
+                for item in items {
+                    walk(item, rest, element_prefix.clone(), by_pointer);
+                }
+            }
+            // A non-array at a `*` segment is an unobserved mismatch, not
+            // an error: schema/sample disagreement is validated elsewhere.
+        }
+        Some((token, rest)) => {
+            if let Value::Object(members) = value {
+                let key = unescape_segment(token);
+                if let Some(child) = members.get(&key) {
+                    let child_prefix = format!("{prefix}/{token}");
+                    walk(child, rest, child_prefix, by_pointer);
+                }
+            }
+            // A missing key or non-object here is likewise left unobserved.
+        }
+    }
+}
+
+/// Fold one visited JSON value into the observation entry at `pointer`,
+/// widening extremes but never retaining the value itself.
+fn record(value: &Value, pointer: &str, by_pointer: &mut BTreeMap<String, Observed>) {
+    let entry = by_pointer.entry(pointer.to_owned()).or_default();
+    match value {
+        Value::Null => entry.saw_null = true,
+        Value::Bool(_) | Value::Object(_) => {}
+        Value::Number(number) => {
+            if let Some(seen) = number.as_i64() {
+                entry.min_integer =
+                    Some(entry.min_integer.map_or(seen, |current| current.min(seen)));
+                entry.max_integer =
+                    Some(entry.max_integer.map_or(seen, |current| current.max(seen)));
+            }
+        }
+        Value::String(text) => {
+            let bytes = text.len() as u64;
+            entry.max_string_bytes = Some(
+                entry
+                    .max_string_bytes
+                    .map_or(bytes, |current| current.max(bytes)),
+            );
+        }
+        Value::Array(items) => {
+            let count = items.len() as u64;
+            entry.max_array_items = Some(
+                entry
+                    .max_array_items
+                    .map_or(count, |current| current.max(count)),
+            );
+        }
+    }
+}
+
+/// Decode one RFC 6901 pointer segment: `~1` to `/`, then `~0` to `~`, in
+/// that order, so a literal `~1` in a key (encoded `~01`) round-trips.
+fn unescape_segment(raw: &str) -> String {
+    if raw.contains('~') {
+        raw.replace("~1", "/").replace("~0", "~")
+    } else {
+        raw.to_owned()
+    }
+}
diff --git a/crates/registry-evidencectl/src/suggest/types.rs b/crates/registry-evidencectl/src/suggest/types.rs
new file mode 100644
index 000000000..96ad6b18a
--- /dev/null
+++ b/crates/registry-evidencectl/src/suggest/types.rs
@@ -0,0 +1,238 @@
+//! Interchange types for the source-suggest pipeline.
+//!
+//! The pipeline is: load and resolve an OpenAPI document, flatten one
+//! operation's response schema into candidate leaves, collect a selection and
+//! bound decisions (from flags or the interactive prompts), narrow to the
+//! closed schema subset, then emit draft artifacts. Every stage communicates
+//! through the types here so the interactive front-end and the flag-driven
+//! front-end share one deterministic core.
+
+use std::{collections::BTreeMap, path::PathBuf};
+
+/// Where the OpenAPI document is read from.
+///
+/// The two cases stay distinguishable all the way to the reproduce line, so
+/// the command printed at the end of a run names the same document the run
+/// actually read. Deciding which case a `--openapi` argument is happens once,
+/// before anything is read, so an unusable URL fails before the operator is
+/// asked a single question.
+#[derive(Debug, Clone)]
+pub enum SpecSource {
+    File(PathBuf),
+    Url(url::Url),
+}
+
+impl SpecSource {
+    /// The document as it should be named in a message or echoed back in the
+    /// reproduce command.
+    pub fn display(&self) -> String {
+        match self {
+            SpecSource::File(path) => path.to_string_lossy().into_owned(),
+            SpecSource::Url(url) => url.to_string(),
+        }
+    }
+}
+
+/// One operation in the OpenAPI document: an uppercase HTTP method and the
+/// literal path template, e.g. `GET` and `/records/{id}`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct OperationKey {
+    pub method: String,
+    pub path: String,
+}
+
+/// One selectable operation, as listed to the user.
+#[derive(Debug, Clone)]
+pub struct OperationSummary {
+    pub key: OperationKey,
+    pub summary: Option<String>,
+    /// (status code, media type) pairs carrying a JSON response schema.
+    pub json_responses: Vec<(String, String)>,
+}
+
+/// A response schema with every local `$ref` inlined and the dialect
+/// normalized: OpenAPI 3.0 `nullable: true` is rewritten to the 3.1 type
+/// pair `[T, "null"]`, so downstream stages handle one form.
+#[derive(Debug, Clone)]
+pub struct ResolvedSchema(pub serde_json::Value);
+
+/// The marker left in place of a schema node that repeats a `$ref` already on
+/// the resolution stack. Cutting the repeat bounds an otherwise infinite
+/// expansion without discarding the rest of the operation; the marker declares
+/// no type, so no stage can mistake it for something projectable, and the
+/// flattener names the recursion it stands for.
+pub const RECURSIVE_REF_KEY: &str = "x-evidencectl-recursive-ref";
+
+/// A resolved response schema with the readings the resolver made on the way.
+///
+/// A note records where the document was ambiguous or unrepresentable and what
+/// was done about it: a cut recursion, or a type read from a structural
+/// keyword. Every note is reported to the operator, because a reading the tool
+/// made on their behalf is one they may need to disagree with.
+#[derive(Debug, Clone)]
+pub struct ResolvedResponse {
+    pub schema: ResolvedSchema,
+    pub notes: Vec<String>,
+}
+
+/// One selectable leaf of the resolved schema, presented to the user and
+/// mapped one-to-one onto a projection allowlist entry.
+///
+/// Pointers are in the extended projection form defined by ADAPTER-API.md:
+/// RFC 6901 segments with `~0`/`~1` escapes, and the reserved segment `*`
+/// visiting every element of an array (`/results/*/trackingId`). The emit
+/// stage derives `get_path` pointers from these by substituting a numeric
+/// index for `*`, because `get_path` is plain RFC 6901 and does not accept
+/// `*`.
+#[derive(Debug, Clone)]
+pub struct CandidateLeaf {
+    /// Extended projection pointer into the projected tree.
+    pub pointer: String,
+    /// Human label for the leaf's type, e.g. `string (date)`, `integer`.
+    pub type_label: String,
+    /// True when the spec admits an explicit null for this leaf.
+    pub nullable: bool,
+    pub description: Option<String>,
+}
+
+/// What kind of bound the closed subset demands and the spec did not supply.
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
+pub enum BoundKind {
+    /// Arrays must declare `maxItems` between 1 and 256.
+    ArrayMaxItems,
+    /// Integers must carry both `minimum` and `maximum` (or enum/const).
+    IntegerRange,
+    /// Strings need `minLength`/`maxLength` (or format/enum/const).
+    StringLength,
+}
+
+/// Where a suggested bound value came from. Shown to the user so a default
+/// is confirmed with its provenance, never adopted blind.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Provenance {
+    /// Stated in the OpenAPI document itself.
+    Spec,
+    /// Derived mechanically from a `format` the subset does not admit,
+    /// e.g. `uuid` becoming fixed length bounds.
+    Format,
+    /// Observed in the sample response and widened.
+    Sample,
+    /// Derived from a page-size parameter in the spec.
+    PageSize,
+    /// The closed subset's own ceiling, used because the document states a
+    /// bound above it. This is deliberately not [`Provenance::Spec`]: the
+    /// number in the draft is not the number the document states, and
+    /// crediting the document for it would tell a reviewer the source promised
+    /// something it never promised.
+    SubsetCeiling,
+    /// Chosen by the operator at the prompt, either where nothing could be
+    /// derived or in place of a suggestion they edited. Nothing the tool
+    /// derived carries this: it is the one provenance that is not a
+    /// derivation.
+    Operator,
+}
+
+/// One concrete bound value with its provenance.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SuggestedBound {
+    pub values: BoundValues,
+    pub provenance: Provenance,
+}
+
+/// The value shape per bound kind.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum BoundValues {
+    MaxItems(u64),
+    IntegerRange { minimum: i64, maximum: i64 },
+    StringLength { min_length: u64, max_length: u64 },
+}
+
+/// One decision the closed subset requires at `pointer`, with the best
+/// suggestion the pipeline could derive, if any.
+#[derive(Debug, Clone)]
+pub struct BoundNeed {
+    pub pointer: String,
+    pub kind: BoundKind,
+    pub suggestion: Option<SuggestedBound>,
+}
+
+/// Raw observations from a sample response, keyed by pointer. Widening
+/// policy belongs to the narrowing stage, not here.
+#[derive(Debug, Clone, Default)]
+pub struct Observations {
+    pub by_pointer: BTreeMap<String, Observed>,
+}
+
+/// What one leaf (or array) looked like in the sample.
+#[derive(Debug, Clone, Default)]
+pub struct Observed {
+    pub min_integer: Option<i64>,
+    pub max_integer: Option<i64>,
+    pub max_string_bytes: Option<u64>,
+    pub max_array_items: Option<u64>,
+    pub saw_null: bool,
+}
+
+/// The complete set of decisions the deterministic core consumes. The
+/// interactive front-end and the flag parser both produce exactly this.
+#[derive(Debug, Clone)]
+pub struct Decisions {
+    pub operation: OperationKey,
+    pub status: String,
+    pub media_type: String,
+    pub source_id: String,
+    /// Selected projection allowlist entries (extended-pointer form), in
+    /// presentation order. The pipeline must reject or normalize a
+    /// selection containing both an ancestor and its descendant, because
+    /// bundle validation fails overlapping projection paths.
+    pub selection: Vec<String>,
+    /// Confirmed bound values, keyed by (pointer, kind). A need absent here
+    /// is emitted as an explicit TODO and the draft fails `evidence check`
+    /// until the operator supplies it: the tool never invents a bound.
+    pub resolutions: BTreeMap<(String, BoundKind), BoundValues>,
+}
+
+impl BoundKind {
+    /// Stable key form for maps and reports.
+    pub fn label(&self) -> &'static str {
+        match self {
+            BoundKind::ArrayMaxItems => "maxItems",
+            BoundKind::IntegerRange => "integer bounds",
+            BoundKind::StringLength => "string length bounds",
+        }
+    }
+}
+
+/// The narrowed response schema plus everything still owed by a human.
+#[derive(Debug, Clone)]
+pub struct NarrowOutcome {
+    /// The closed-subset schema as a YAML-ready value. Unresolved bounds are
+    /// omitted (never invented), so `evidence check` rejects the draft until
+    /// the operator fills them.
+    pub schema: serde_json::Value,
+    /// Bounds still unresolved, in schema order.
+    pub unresolved: Vec<BoundNeed>,
+}
+
+/// One draft file to write, bundle-relative.
+#[derive(Debug, Clone)]
+pub struct DraftFile {
+    pub bundle_relative_path: String,
+    pub contents: String,
+}
+
+/// Everything the emit stage produces for one source.
+#[derive(Debug, Clone)]
+pub struct DraftArtifacts {
+    pub source_id: String,
+    pub files: Vec<DraftFile>,
+    /// Editable local-authoring source document written by `--project`.
+    pub authoring_source: String,
+    /// A deliberately incomplete `sources.<id>` YAML block containing only
+    /// facts mechanically established by the OpenAPI selection.
+    pub source_block: String,
+    /// Human report: what was derived, from where, and what remains.
+    pub report: String,
+    /// The fully-flagged non-interactive invocation reproducing this run.
+    pub equivalent_command: String,
+}
diff --git a/crates/registry-evidencectl/src/verify.rs b/crates/registry-evidencectl/src/verify.rs
new file mode 100644
index 000000000..43034fe71
--- /dev/null
+++ b/crates/registry-evidencectl/src/verify.rs
@@ -0,0 +1,208 @@
+//! Offline response verification delegated entirely to the Evidence core.
+
+use std::{
+    fs::{self, File},
+    os::unix::fs::{MetadataExt as _, PermissionsExt as _},
+    path::{Component, Path, PathBuf},
+    process::{Command, ExitCode, Stdio},
+};
+
+use anyhow::{bail, Context as _, Result};
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use clap::Args;
+use zeroize::Zeroize as _;
+
+use crate::dev;
+
+const PRIVATE_FILE_MODE: u32 = 0o600;
+const MAX_VERIFIED_BYTES: u64 = 256 * 1024;
+
+#[derive(Debug, Args)]
+pub struct VerifyArgs {
+    /// Flattened JWS JSON response returned by Evidence.
+    response: PathBuf,
+
+    /// Owner-only verification context retained before the response existed.
+    #[arg(long)]
+    context: PathBuf,
+
+    /// New owner-only file for the exact verified Evidence payload.
+    #[arg(long)]
+    output: PathBuf,
+
+    #[arg(long, hide = true)]
+    evidence_bin: Option<PathBuf>,
+}
+
+pub fn run(args: VerifyArgs) -> Result<ExitCode> {
+    validate_output_path(&args.output)?;
+    let evidence = dev::resolve_tool_binary(
+        "evidence",
+        args.evidence_bin.as_deref(),
+        "EVIDENCECTL_TEST_EVIDENCE_BIN",
+    )?;
+    let mut staged = StagedOutput::create(&args.output)?;
+    let output_file = staged.file.try_clone()?;
+    let status = Command::new(evidence)
+        .arg("verify-local-response")
+        .arg("--context")
+        .arg(&args.context)
+        .arg("--response")
+        .arg(&args.response)
+        .stdin(Stdio::null())
+        .stdout(Stdio::from(output_file))
+        .stderr(Stdio::null())
+        .status()
+        .context("failed to invoke Evidence response verification")?;
+    if !status.success() {
+        bail!("Evidence response verification failed");
+    }
+    staged.file.sync_all()?;
+    validate_private_output(&staged.path, &staged.file)?;
+    staged.publish(&args.output)?;
+    println!("VERIFIED");
+    Ok(ExitCode::SUCCESS)
+}
+
+fn validate_output_path(path: &Path) -> Result<()> {
+    if path.file_name().is_none()
+        || path
+            .components()
+            .any(|component| matches!(component, Component::CurDir | Component::ParentDir))
+    {
+        bail!("verified output path must be normalized and name one new file");
+    }
+    match fs::symlink_metadata(path) {
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+        Ok(_) => bail!("verified output already exists; refusing to replace it"),
+        Err(error) => return Err(error.into()),
+    }
+    let parent = path
+        .parent()
+        .filter(|parent| !parent.as_os_str().is_empty())
+        .unwrap_or_else(|| Path::new("."));
+    let metadata = fs::symlink_metadata(parent)
+        .with_context(|| format!("failed to inspect output directory {}", parent.display()))?;
+    if metadata.file_type().is_symlink()
+        || !metadata.is_dir()
+        || metadata.uid() != rustix::process::getuid().as_raw()
+    {
+        bail!("verified output directory must be owned and unsymlinked");
+    }
+    Ok(())
+}
+
+struct StagedOutput {
+    path: PathBuf,
+    file: File,
+    published: bool,
+}
+
+impl StagedOutput {
+    fn create(output: &Path) -> Result<Self> {
+        let parent = output
+            .parent()
+            .filter(|parent| !parent.as_os_str().is_empty())
+            .unwrap_or_else(|| Path::new("."));
+        for _ in 0..8 {
+            let mut random = [0_u8; 12];
+            getrandom::fill(&mut random)?;
+            let path = parent.join(format!(".verify-{}", URL_SAFE_NO_PAD.encode(random)));
+            random.zeroize();
+            match create_private_file(&path) {
+                Ok(file) => {
+                    return Ok(Self {
+                        path,
+                        file,
+                        published: false,
+                    });
+                }
+                Err(error)
+                    if error
+                        .downcast_ref::<std::io::Error>()
+                        .is_some_and(|error| error.kind() == std::io::ErrorKind::AlreadyExists) => {
+                }
+                Err(error) => return Err(error),
+            }
+        }
+        bail!("failed to allocate private verification output")
+    }
+
+    fn publish(&mut self, output: &Path) -> Result<()> {
+        rename_noreplace(&self.path, output)
+            .context("failed to publish verified output without replacing an existing path")?;
+        self.published = true;
+        Ok(())
+    }
+}
+
+impl Drop for StagedOutput {
+    fn drop(&mut self) {
+        if !self.published {
+            let _ = fs::remove_file(&self.path);
+        }
+    }
+}
+
+fn create_private_file(path: &Path) -> Result<File> {
+    let fd = rustix::fs::open(
+        path,
+        rustix::fs::OFlags::WRONLY
+            | rustix::fs::OFlags::CREATE
+            | rustix::fs::OFlags::EXCL
+            | rustix::fs::OFlags::CLOEXEC
+            | rustix::fs::OFlags::NOFOLLOW
+            | rustix::fs::OFlags::NONBLOCK,
+        rustix::fs::Mode::from_bits_truncate(PRIVATE_FILE_MODE as rustix::fs::RawMode),
+    )
+    .map_err(std::io::Error::from)
+    .with_context(|| format!("failed to create private output {}", path.display()))?;
+    let file = File::from(fd);
+    let metadata = file.metadata()?;
+    if !metadata.is_file()
+        || metadata.nlink() != 1
+        || metadata.uid() != rustix::process::getuid().as_raw()
+        || metadata.permissions().mode() & 0o777 != PRIVATE_FILE_MODE
+    {
+        bail!("private verification output failed its file-safety checks");
+    }
+    Ok(file)
+}
+
+fn validate_private_output(path: &Path, opened: &File) -> Result<()> {
+    let path_metadata = fs::symlink_metadata(path)?;
+    let open_metadata = opened.metadata()?;
+    if path_metadata.file_type().is_symlink()
+        || !path_metadata.is_file()
+        || path_metadata.nlink() != 1
+        || path_metadata.uid() != rustix::process::getuid().as_raw()
+        || path_metadata.permissions().mode() & 0o777 != PRIVATE_FILE_MODE
+        || path_metadata.dev() != open_metadata.dev()
+        || path_metadata.ino() != open_metadata.ino()
+        || open_metadata.len() == 0
+        || open_metadata.len() > MAX_VERIFIED_BYTES
+    {
+        bail!("private verification output failed its file-safety checks");
+    }
+    Ok(())
+}
+
+#[cfg(any(target_os = "linux", target_vendor = "apple"))]
+fn rename_noreplace(source: &Path, destination: &Path) -> std::io::Result<()> {
+    rustix::fs::renameat_with(
+        rustix::fs::CWD,
+        source,
+        rustix::fs::CWD,
+        destination,
+        rustix::fs::RenameFlags::NOREPLACE,
+    )
+    .map_err(std::io::Error::from)
+}
+
+#[cfg(not(any(target_os = "linux", target_vendor = "apple")))]
+fn rename_noreplace(_source: &Path, _destination: &Path) -> std::io::Result<()> {
+    Err(std::io::Error::new(
+        std::io::ErrorKind::Unsupported,
+        "atomic no-replace verification publication is unsupported",
+    ))
+}
diff --git a/crates/registry-evidencectl/tests/access.rs b/crates/registry-evidencectl/tests/access.rs
new file mode 100644
index 000000000..f402187ee
--- /dev/null
+++ b/crates/registry-evidencectl/tests/access.rs
@@ -0,0 +1,263 @@
+#![cfg(unix)]
+
+use std::{
+    fs,
+    os::unix::fs::{symlink, PermissionsExt as _},
+    path::Path,
+    process::{Command, Output},
+};
+
+use registry_platform_crypto::{PrivateJwk, PublicJwk};
+use serde_json::Value;
+
+fn evidencectl(project: &Path, arguments: &[&str]) -> Output {
+    Command::new(env!("CARGO_BIN_EXE_evidencectl"))
+        .args(arguments)
+        .arg("--project")
+        .arg(project)
+        .output()
+        .expect("run evidencectl")
+}
+
+fn write_question(project: &Path, id: &str) {
+    fs::create_dir_all(project.join("questions")).expect("questions directory");
+    fs::write(
+        project.join("questions").join(format!("{id}.yaml")),
+        format!("id: {id}\n"),
+    )
+    .expect("question");
+}
+
+fn add_policy(project: &Path, id: &str, questions: &[&str]) -> Output {
+    let mut command = Command::new(env!("CARGO_BIN_EXE_evidencectl"));
+    command.args(["access", "policy", "add", id]);
+    for question in questions {
+        command.args(["--question", question]);
+    }
+    command.arg("--project").arg(project);
+    command.output().expect("add policy")
+}
+
+fn add_client(project: &Path, id: &str, policies: &[&str]) -> Output {
+    let mut command = Command::new(env!("CARGO_BIN_EXE_evidencectl"));
+    command.args(["access", "client", "add", id]);
+    for policy in policies {
+        command.args(["--policy", policy]);
+    }
+    command
+        .arg("--generate-local-key")
+        .arg("--project")
+        .arg(project);
+    command.output().expect("add client")
+}
+
+fn success(output: &Output) -> String {
+    assert!(
+        output.status.success(),
+        "command failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    String::from_utf8(output.stdout.clone()).expect("stdout utf8")
+}
+
+fn mode(path: &Path) -> u32 {
+    fs::metadata(path).expect("metadata").permissions().mode() & 0o7777
+}
+
+#[test]
+fn adds_reviewable_policy_and_public_client_while_isolating_private_key() {
+    let fixture = tempfile::tempdir().expect("tempdir");
+    let project = fixture.path();
+    write_question(project, "adult-status");
+
+    assert_eq!(
+        success(&add_policy(project, "age-checks", &["adult-status"])),
+        "Added access policy age-checks for adult-status.\n"
+    );
+    assert_eq!(
+        success(&add_client(project, "age-checker", &["age-checks"])),
+        "Added client age-checker with policy age-checks.\n"
+    );
+
+    let policy_path = project.join("access/policies/age-checks.yaml");
+    let client_path = project.join("access/clients/age-checker.yaml");
+    let private_path = project.join(".evidence/clients/age-checker/private.jwk");
+    assert_eq!(mode(&policy_path), 0o644);
+    assert_eq!(mode(&client_path), 0o644);
+    assert_eq!(mode(private_path.parent().unwrap()), 0o700);
+    assert_eq!(mode(&private_path), 0o600);
+
+    let policy: Value =
+        serde_norway::from_slice(&fs::read(policy_path).expect("policy")).expect("policy yaml");
+    assert_eq!(policy["version"], 1);
+    assert_eq!(policy["id"], "age-checks");
+    assert_eq!(policy["questions"], serde_json::json!(["adult-status"]));
+
+    let client: Value =
+        serde_norway::from_slice(&fs::read(client_path).expect("client")).expect("client yaml");
+    assert_eq!(client["clientId"], "age-checker");
+    assert_eq!(client["status"], "active");
+    assert_eq!(client["policies"], serde_json::json!(["age-checks"]));
+    assert_eq!(client["keys"].as_array().unwrap().len(), 1);
+    assert!(client["keys"][0].get("d").is_none());
+    let public_text = serde_json::to_string(&client["keys"][0]).expect("public json");
+    PublicJwk::parse(&public_text).expect("public JWK");
+
+    let private_text = fs::read_to_string(private_path).expect("private key");
+    let private = PrivateJwk::parse(&private_text).expect("private JWK");
+    let private_value = private.d.clone().expect("private material");
+    assert!(
+        !String::from_utf8_lossy(&add_client(project, "age-checker", &["age-checks"]).stdout)
+            .contains(&private_value)
+    );
+
+    let policies = success(&evidencectl(project, &["access", "policy", "list"]));
+    assert!(policies.contains("age-checks\tadult-status"));
+    let clients = success(&evidencectl(project, &["access", "client", "list"]));
+    assert!(clients.contains("age-checker\tactive\tage-checks"));
+}
+
+#[test]
+fn unknown_policy_fails_before_generating_or_publishing_client_state() {
+    let fixture = tempfile::tempdir().expect("tempdir");
+    let output = add_client(fixture.path(), "unknown-client", &["missing-policy"]);
+    assert!(!output.status.success());
+    assert!(String::from_utf8_lossy(&output.stderr).contains("no access policies are configured"));
+    assert!(!fixture.path().join("access/clients").exists());
+    assert!(!fixture.path().join(".evidence/clients").exists());
+}
+
+#[test]
+fn overlapping_policy_membership_is_rejected_before_key_generation() {
+    let fixture = tempfile::tempdir().expect("tempdir");
+    let project = fixture.path();
+    write_question(project, "adult-status");
+    success(&add_policy(project, "first", &["adult-status"]));
+    success(&add_policy(project, "second", &["adult-status"]));
+
+    let output = add_client(project, "ambiguous-client", &["first", "second"]);
+    assert!(!output.status.success());
+    assert!(String::from_utf8_lossy(&output.stderr)
+        .contains("grant the same authored entitlement for question adult-status"));
+    assert!(!project
+        .join("access/clients/ambiguous-client.yaml")
+        .exists());
+    assert!(!project.join(".evidence/clients/ambiguous-client").exists());
+}
+
+#[test]
+fn unsafe_identifiers_and_unknown_questions_change_nothing() {
+    let fixture = tempfile::tempdir().expect("tempdir");
+    let project = fixture.path();
+    write_question(project, "adult-status");
+
+    let unsafe_id = add_policy(project, "../escape", &["adult-status"]);
+    assert!(!unsafe_id.status.success());
+    assert!(!project.join("access").exists());
+
+    let unknown = add_policy(project, "missing-question", &["not-authored"]);
+    assert!(!unknown.status.success());
+    assert!(String::from_utf8_lossy(&unknown.stderr).contains("not-authored.yaml"));
+    assert!(!project.join("access").exists());
+}
+
+#[test]
+fn add_never_overwrites_existing_policy_or_client() {
+    let fixture = tempfile::tempdir().expect("tempdir");
+    let project = fixture.path();
+    write_question(project, "adult-status");
+    success(&add_policy(project, "age-checks", &["adult-status"]));
+    let policy_before = fs::read(project.join("access/policies/age-checks.yaml")).unwrap();
+    let duplicate_policy = add_policy(project, "age-checks", &["adult-status"]);
+    assert!(!duplicate_policy.status.success());
+    assert_eq!(
+        fs::read(project.join("access/policies/age-checks.yaml")).unwrap(),
+        policy_before
+    );
+
+    success(&add_client(project, "age-checker", &["age-checks"]));
+    let private_before =
+        fs::read(project.join(".evidence/clients/age-checker/private.jwk")).unwrap();
+    let duplicate_client = add_client(project, "age-checker", &["age-checks"]);
+    assert!(!duplicate_client.status.success());
+    assert_eq!(
+        fs::read(project.join(".evidence/clients/age-checker/private.jwk")).unwrap(),
+        private_before
+    );
+}
+
+#[test]
+fn revoke_updates_public_status_but_retains_private_key() {
+    let fixture = tempfile::tempdir().expect("tempdir");
+    let project = fixture.path();
+    write_question(project, "adult-status");
+    success(&add_policy(project, "age-checks", &["adult-status"]));
+    success(&add_client(project, "age-checker", &["age-checks"]));
+    let private_path = project.join(".evidence/clients/age-checker/private.jwk");
+    let private_before = fs::read(&private_path).expect("private key");
+
+    let output = evidencectl(project, &["access", "client", "revoke", "age-checker"]);
+    assert_eq!(success(&output), "Revoked client age-checker.\n");
+    assert_eq!(
+        fs::read(&private_path).expect("retained private key"),
+        private_before
+    );
+    let list = success(&evidencectl(project, &["access", "client", "list"]));
+    assert!(list.contains("age-checker\trevoked\tage-checks"));
+
+    let duplicate = evidencectl(project, &["access", "client", "revoke", "age-checker"]);
+    assert!(!duplicate.status.success());
+    assert!(String::from_utf8_lossy(&duplicate.stderr).contains("already revoked"));
+}
+
+#[test]
+fn unsafe_or_symlinked_access_directory_publishes_no_access_artifact() {
+    let fixture = tempfile::tempdir().expect("tempdir");
+    let project = fixture.path();
+    write_question(project, "adult-status");
+    fs::create_dir(project.join("access")).expect("access directory");
+    fs::set_permissions(project.join("access"), fs::Permissions::from_mode(0o777))
+        .expect("unsafe access mode");
+    let unsafe_mode = add_policy(project, "age-checks", &["adult-status"]);
+    assert!(!unsafe_mode.status.success());
+    assert!(!project.join("access/policies").exists());
+
+    let symlink_fixture = tempfile::tempdir().expect("symlink fixture");
+    let symlink_project = symlink_fixture.path().join("project");
+    let outside = symlink_fixture.path().join("outside");
+    fs::create_dir(&symlink_project).expect("project");
+    fs::create_dir(&outside).expect("outside");
+    write_question(&symlink_project, "adult-status");
+    symlink(&outside, symlink_project.join("access")).expect("access symlink");
+    let escaped = add_policy(&symlink_project, "age-checks", &["adult-status"]);
+    assert!(!escaped.status.success());
+    assert_eq!(fs::read_dir(&outside).expect("outside").count(), 0);
+}
+
+#[test]
+fn public_clients_without_local_keys_can_be_added_alongside_and_revoked() {
+    let fixture = tempfile::tempdir().expect("tempdir");
+    let project = fixture.path();
+    write_question(project, "adult-status");
+    success(&add_policy(project, "age-checks", &["adult-status"]));
+    success(&add_client(project, "governed-client", &["age-checks"]));
+    fs::remove_dir_all(project.join(".evidence/clients/governed-client"))
+        .expect("remove local-only key as in a fresh clone");
+
+    let local = add_client(project, "local-client", &["age-checks"]);
+    assert_eq!(
+        success(&local),
+        "Added client local-client with policy age-checks.\n"
+    );
+    assert!(project
+        .join(".evidence/clients/local-client/private.jwk")
+        .is_file());
+
+    let revoke = evidencectl(project, &["access", "client", "revoke", "governed-client"]);
+    assert_eq!(success(&revoke), "Revoked client governed-client.\n");
+    let governed: Value = serde_norway::from_slice(
+        &fs::read(project.join("access/clients/governed-client.yaml")).expect("governed client"),
+    )
+    .expect("governed client yaml");
+    assert_eq!(governed["status"], "revoked");
+}
diff --git a/crates/registry-evidencectl/tests/audit_view.rs b/crates/registry-evidencectl/tests/audit_view.rs
new file mode 100644
index 000000000..ba27c27c5
--- /dev/null
+++ b/crates/registry-evidencectl/tests/audit_view.rs
@@ -0,0 +1,567 @@
+use std::{
+    fs,
+    os::unix::fs::PermissionsExt as _,
+    path::{Path, PathBuf},
+    process::{Command, Output},
+};
+
+use serde_json::{json, Value};
+
+const PSEUDONYM: &str =
+    "hmac-sha256:v1:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+const FAILURE: &str = "evidencectl: local audit inspection failed\n";
+
+#[test]
+fn audit_help_is_nested_required_and_hides_test_seams() {
+    let audit = command()
+        .args(["audit", "--help"])
+        .output()
+        .expect("audit help");
+    assert_success(&audit);
+    let audit = String::from_utf8_lossy(&audit.stdout);
+    assert!(
+        audit.contains("show"),
+        "nested show command is absent: {audit}"
+    );
+
+    let show = command()
+        .args(["audit", "show", "--help"])
+        .output()
+        .expect("show help");
+    assert_success(&show);
+    let show = String::from_utf8_lossy(&show.stdout);
+    assert!(
+        show.contains("--last-operation"),
+        "selector is absent: {show}"
+    );
+    for hidden in ["--project", "--evidence-bin"] {
+        assert!(!show.contains(hidden), "test seam leaked: {show}");
+    }
+
+    for arguments in [
+        vec!["audit", "show"],
+        vec!["audit", "show", "--all"],
+        vec!["audit", "show", "--last-operation", "--last-operation"],
+    ] {
+        let output = command().args(arguments).output().expect("invalid CLI");
+        assert!(
+            !output.status.success(),
+            "selector must be required/exclusive"
+        );
+        assert!(output.stdout.is_empty());
+    }
+}
+
+#[test]
+fn successful_view_delegates_to_stopped_core_and_prints_only_aliases() {
+    let fixture = Fixture::new();
+    fixture.write_core_json(&successful_view());
+    let output = fixture.show();
+    assert_success(&output);
+    assert_eq!(
+        String::from_utf8_lossy(&output.stdout),
+        format!(
+            "ACCESS AUTHORIZED adult-status age-check requester={PSEUDONYM}\n\
+             DISCLOSURE RELEASED is_adult\n"
+        )
+    );
+    assert!(output.stderr.is_empty());
+
+    let arguments =
+        fs::read_to_string(fixture.evidence.with_extension("args")).expect("Evidence argv");
+    assert_eq!(
+        arguments.lines().collect::<Vec<_>>(),
+        [
+            "--runtime",
+            fs::canonicalize(&fixture.root)
+                .expect("canonical project")
+                .join(".evidence/dev/runtime.yaml")
+                .to_str()
+                .expect("runtime path"),
+            "local-audit-last-operation",
+        ]
+    );
+    let rendered = String::from_utf8_lossy(&output.stdout);
+    for forbidden in [
+        "person-123",
+        "token-canary",
+        "operation",
+        "evidenceId",
+        "source",
+        "adapter",
+        "actor",
+        "grant",
+        "subject",
+        "citizen",
+        "accountability",
+    ] {
+        assert!(!rendered.contains(forbidden), "rendered {forbidden}");
+    }
+}
+
+#[test]
+fn access_only_view_prints_authorized_without_claiming_release() {
+    let fixture = Fixture::new();
+    let mut view = successful_view();
+    view["events"].as_array_mut().expect("events").truncate(1);
+    fixture.write_core_json(&view);
+    let output = fixture.show();
+    assert_success(&output);
+    assert_eq!(
+        String::from_utf8_lossy(&output.stdout),
+        format!("ACCESS AUTHORIZED adult-status age-check requester={PSEUDONYM}\n")
+    );
+    assert!(!String::from_utf8_lossy(&output.stdout).contains("RELEASE"));
+}
+
+#[test]
+fn structured_sd_jwt_release_uses_the_same_minimized_audit_view() {
+    let fixture = Fixture::new();
+    let state_path = fixture.root.join(".evidence/dev/state.json");
+    let mut state: Value =
+        serde_json::from_slice(&fs::read(&state_path).expect("state")).expect("state JSON");
+    state["questions"][1]["concepts"][0]["form"] = json!("reviewed-structured-value");
+    fs::write(
+        &state_path,
+        serde_json::to_vec(&state).expect("state renders"),
+    )
+    .expect("state writes");
+    fs::set_permissions(&state_path, fs::Permissions::from_mode(0o600)).expect("state mode");
+
+    let bundle_path = fixture.root.join(".evidence/dev/bundle/evidence.yaml");
+    let mut bundle: Value =
+        serde_norway::from_slice(&fs::read(&bundle_path).expect("bundle")).expect("bundle YAML");
+    bundle["requirements"][1]["concepts"][0]["form"] = json!("reviewed-structured-value");
+    fs::set_permissions(&bundle_path, fs::Permissions::from_mode(0o600))
+        .expect("unseal bundle for fixture update");
+    fs::write(
+        &bundle_path,
+        serde_norway::to_string(&bundle).expect("bundle renders"),
+    )
+    .expect("bundle writes");
+    fs::set_permissions(&bundle_path, fs::Permissions::from_mode(0o400)).expect("bundle mode");
+
+    let mut view = successful_view();
+    view["events"][0]["responseProtection"] = json!("sd-jwt-vc");
+    view["events"][1]["responseProtection"] = json!("sd-jwt-vc");
+    fixture.write_core_json(&view);
+
+    let output = fixture.show();
+    assert_success(&output);
+    assert_eq!(
+        String::from_utf8_lossy(&output.stdout),
+        format!(
+            "ACCESS AUTHORIZED adult-status age-check requester={PSEUDONYM}\n\
+             DISCLOSURE RELEASED is_adult\n"
+        )
+    );
+}
+
+#[test]
+fn multi_concept_release_requires_and_prints_the_exact_declared_list() {
+    let fixture = Fixture::new();
+    let state_path = fixture.root.join(".evidence/dev/state.json");
+    let mut state: Value =
+        serde_json::from_slice(&fs::read(&state_path).expect("state")).expect("state JSON");
+    state["questions"][1]["concepts"] = json!([
+        {
+            "alias": "is_adult",
+            "uri": "urn:registrystack:evidence:local:concept:adult-status:is_adult",
+            "form": "boolean"
+        },
+        {
+            "alias": "age_years",
+            "uri": "urn:registrystack:evidence:local:concept:adult-status:age_years",
+            "form": "bounded-integer"
+        }
+    ]);
+    fs::write(
+        &state_path,
+        serde_json::to_vec(&state).expect("state renders"),
+    )
+    .expect("state writes");
+    fs::set_permissions(&state_path, fs::Permissions::from_mode(0o600)).expect("state mode");
+
+    let bundle_path = fixture.root.join(".evidence/dev/bundle/evidence.yaml");
+    let mut bundle: Value =
+        serde_norway::from_slice(&fs::read(&bundle_path).expect("bundle")).expect("bundle YAML");
+    bundle["requirements"][1]["concepts"] = json!([
+        {
+            "id": "urn:registrystack:evidence:local:concept:adult-status:is_adult",
+            "form": "boolean"
+        },
+        {
+            "id": "urn:registrystack:evidence:local:concept:adult-status:age_years",
+            "form": "bounded-integer"
+        }
+    ]);
+    fs::set_permissions(&bundle_path, fs::Permissions::from_mode(0o600))
+        .expect("open bundle for fixture update");
+    fs::write(
+        &bundle_path,
+        serde_norway::to_string(&bundle).expect("bundle renders"),
+    )
+    .expect("bundle writes");
+    fs::set_permissions(&bundle_path, fs::Permissions::from_mode(0o400))
+        .expect("seal updated bundle");
+
+    let mut view = successful_view();
+    view["events"][1]["disclosedConcepts"] = json!([
+        "urn:registrystack:evidence:local:concept:adult-status:is_adult",
+        "urn:registrystack:evidence:local:concept:adult-status:age_years"
+    ]);
+    fixture.write_core_json(&view);
+    let output = fixture.show();
+    assert_success(&output);
+    assert!(String::from_utf8_lossy(&output.stdout)
+        .contains("DISCLOSURE RELEASED is_adult, age_years\n"));
+
+    view["events"][1]["disclosedConcepts"] =
+        json!(["urn:registrystack:evidence:local:concept:adult-status:is_adult"]);
+    fixture.write_core_json(&view);
+    assert_closed_failure(&fixture.show(), "incomplete multi-concept release");
+}
+
+#[test]
+fn closed_parser_alias_mapping_and_metadata_fail_without_partial_output() {
+    let fixture = Fixture::new();
+    let base = successful_view();
+    let mut cases = Vec::new();
+
+    let mut unknown_top = base.clone();
+    unknown_top["rawSelector"] = json!("person-123");
+    cases.push(("unknown top field", unknown_top));
+
+    let mut unknown_event = base.clone();
+    unknown_event["events"][0]["sourceId"] = json!("source-canary");
+    cases.push(("unknown event field", unknown_event));
+
+    let mut schema = base.clone();
+    schema["schema"] = json!("registry.evidence.local-audit-operation/v2");
+    cases.push(("schema", schema));
+
+    let mut requirement = base.clone();
+    requirement["events"][0]["requirement"] = json!("urn:other:requirement");
+    cases.push(("requirement alias", requirement));
+
+    let mut concept = base.clone();
+    concept["events"][1]["disclosedConcepts"] = json!(["urn:other:concept"]);
+    cases.push(("concept alias", concept));
+
+    let mut requester = base.clone();
+    requester["events"][1]["requesterPseudonym"] =
+        json!(format!("hmac-sha256:v1:{}", "b".repeat(64)));
+    cases.push(("requester coherence", requester));
+
+    let mut unsafe_requester = base.clone();
+    unsafe_requester["events"][0]["requesterPseudonym"] = json!("person-123");
+    cases.push(("unsafe pseudonym", unsafe_requester));
+
+    let mut protection = base.clone();
+    protection["events"][0]["responseProtection"] = json!("unsigned");
+    cases.push(("response protection", protection));
+
+    let mut phase = base.clone();
+    phase["events"][1]["phase"] = json!("access-attempt");
+    cases.push(("phase", phase));
+
+    let mut decision = base.clone();
+    decision["events"][1]["decision"] = json!("authorized");
+    cases.push(("decision", decision));
+
+    let mut explicit_null = base.clone();
+    explicit_null["events"][0]["disclosedConcepts"] = Value::Null;
+    cases.push(("explicit null is not omission", explicit_null));
+
+    let mut reversed_time = base.clone();
+    reversed_time["events"][1]["occurredAt"] = json!("2026-08-04T00:00:00.000Z");
+    cases.push(("event time order", reversed_time));
+
+    let mut too_many = base.clone();
+    let third = too_many["events"][1].clone();
+    too_many["events"]
+        .as_array_mut()
+        .expect("events")
+        .push(third);
+    cases.push(("event bound", too_many));
+
+    for (label, value) in cases {
+        fixture.write_core_json(&value);
+        assert_closed_failure(&fixture.show(), label);
+    }
+
+    fixture.write_core_bytes(b"{malformed person-123 token-canary");
+    assert_closed_failure(&fixture.show(), "malformed JSON");
+}
+
+#[test]
+fn core_failure_oversized_output_and_non_stopped_state_are_value_free() {
+    let fixture = Fixture::new();
+    fixture.write_core_json(&successful_view());
+    fs::write(fixture.evidence.with_extension("fail"), b"").expect("failure marker");
+    assert_closed_failure(&fixture.show(), "core failure");
+    fs::remove_file(fixture.evidence.with_extension("fail")).expect("remove marker");
+
+    fixture.write_core_bytes(&vec![b'x'; 256 * 1024 + 1]);
+    assert_closed_failure(&fixture.show(), "output bound");
+
+    fixture.write_core_json(&successful_view());
+    let state_path = fixture.root.join(".evidence/dev/state.json");
+    let mut state: Value =
+        serde_json::from_slice(&fs::read(&state_path).expect("state")).expect("state JSON");
+    state["status"] = json!("ready");
+    fs::write(
+        &state_path,
+        serde_json::to_vec(&state).expect("state renders"),
+    )
+    .expect("state writes");
+    fs::set_permissions(&state_path, fs::Permissions::from_mode(0o600)).expect("state mode");
+    assert_closed_failure(&fixture.show(), "running state");
+}
+
+fn successful_view() -> Value {
+    json!({
+        "schema": "registry.evidence.local-audit-operation/v1",
+        "operation": "person-123-token-canary",
+        "events": [
+            {
+                "occurredAt": "2026-08-04T00:00:01.000Z",
+                "phase": "access-attempt",
+                "decision": "authorized",
+                "requirement": "urn:registrystack:evidence:local:requirement:adult-status",
+                "purpose": "age-check",
+                "requesterPseudonym": PSEUDONYM,
+                "responseProtection": "signed"
+            },
+            {
+                "occurredAt": "2026-08-04T00:00:02.000Z",
+                "phase": "disclosure-release",
+                "decision": "released",
+                "requirement": "urn:registrystack:evidence:local:requirement:adult-status",
+                "purpose": "age-check",
+                "requesterPseudonym": PSEUDONYM,
+                "responseProtection": "signed",
+                "disclosedConcepts": [
+                    "urn:registrystack:evidence:local:concept:adult-status:is_adult"
+                ],
+                "evidenceId": "urn:token-canary:evidence:person-123"
+            }
+        ]
+    })
+}
+
+struct Fixture {
+    _temporary: tempfile::TempDir,
+    root: PathBuf,
+    evidence: PathBuf,
+}
+
+impl Fixture {
+    fn new() -> Self {
+        let temporary = tempfile::tempdir().expect("temporary directory");
+        let root = temporary.path().join("project");
+        private_directory(&root);
+        private_directory(&root.join(".evidence"));
+        private_directory(&root.join(".evidence/dev"));
+        private_directory(&root.join(".evidence/dev/bundle"));
+        private_file(&root.join(".evidence/dev/runtime.yaml"), b"runtime", 0o400);
+        let canonical = fs::canonicalize(&root).expect("canonical project");
+        let state = json!({
+            "schema": "registry.evidencectl.dev-state/v5",
+            "status": "stopped",
+            "project": canonical,
+            "runtimePath": canonical.join(".evidence/dev/runtime.yaml"),
+            "evidenceOrigin": "http://127.0.0.1:8080",
+            "mintOrigin": "http://127.0.0.1:8081",
+            "tokenUrl": "http://127.0.0.1:8081/token",
+            "accessTokenAudience": "registry-evidence-local",
+            "caller": null,
+            "accessPolicies": [],
+            "questions": [
+                {
+                    "alias": "age-bracket",
+                    "requirementUri": "urn:registrystack:evidence:local:requirement:age-bracket",
+                    "purpose": "service-path-selection",
+                    "subjects": [{
+                        "role": "person",
+                        "selectorProfile": "local-subject-age-bracket-v1",
+                        "selectorField": "person_id"
+                    }],
+                    "concepts": [{
+                        "alias": "age_bracket",
+                        "uri": "urn:registrystack:evidence:local:concept:age-bracket:age_bracket",
+                        "form": "controlled-category"
+                    }]
+                },
+                {
+                    "alias": "adult-status",
+                    "requirementUri": "urn:registrystack:evidence:local:requirement:adult-status",
+                    "purpose": "age-check",
+                    "subjects": [{
+                        "role": "person",
+                        "selectorProfile": "local-subject-adult-status-v1",
+                        "selectorField": "person_id"
+                    }],
+                    "concepts": [{
+                        "alias": "is_adult",
+                        "uri": "urn:registrystack:evidence:local:concept:adult-status:is_adult",
+                        "form": "boolean"
+                    }]
+                }
+            ],
+            "failure": null
+        });
+        private_file(
+            &root.join(".evidence/dev/state.json"),
+            &serde_json::to_vec(&state).expect("state renders"),
+            0o600,
+        );
+        let bundle = json!({
+            "selectorProfiles": {
+                "local-subject-age-bracket-v1": {
+                    "fields": {"person_id": {"type": "string"}}
+                },
+                "local-subject-adult-status-v1": {
+                    "fields": {"person_id": {"type": "string"}}
+                }
+            },
+            "authorityProfiles": {
+                "local-caller": {
+                    "kind": "explicit-request",
+                    "requesterTags": ["local-caller"],
+                    "grants": [
+                        {
+                            "requirement": "urn:registrystack:evidence:local:requirement:age-bracket",
+                            "purpose": "service-path-selection",
+                            "audienceFrom": "authenticated-requester",
+                            "responseFormats": ["signed-jws"],
+                            "subjects": [{
+                                "role": "person",
+                                "selectorProfile": "local-subject-age-bracket-v1",
+                                "valueOrigin": "request"
+                            }]
+                        },
+                        {
+                            "requirement": "urn:registrystack:evidence:local:requirement:adult-status",
+                            "purpose": "age-check",
+                            "audienceFrom": "authenticated-requester",
+                            "responseFormats": ["signed-jws"],
+                            "subjects": [{
+                                "role": "person",
+                                "selectorProfile": "local-subject-adult-status-v1",
+                                "valueOrigin": "request"
+                            }]
+                        }
+                    ]
+                }
+            },
+            "requirements": [
+                {
+                    "id": "urn:registrystack:evidence:local:requirement:age-bracket",
+                    "purposes": ["service-path-selection"],
+                    "subjectRoles": [{
+                        "role": "person",
+                        "selectorProfiles": ["local-subject-age-bracket-v1"]
+                    }],
+                    "concepts": [{
+                        "id": "urn:registrystack:evidence:local:concept:age-bracket:age_bracket",
+                        "form": "controlled-category"
+                    }]
+                },
+                {
+                    "id": "urn:registrystack:evidence:local:requirement:adult-status",
+                    "purposes": ["age-check"],
+                    "subjectRoles": [{
+                        "role": "person",
+                        "selectorProfiles": ["local-subject-adult-status-v1"]
+                    }],
+                    "concepts": [{
+                        "id": "urn:registrystack:evidence:local:concept:adult-status:is_adult",
+                        "form": "boolean"
+                    }]
+                }
+            ]
+        });
+        private_file(
+            &root.join(".evidence/dev/bundle/evidence.yaml"),
+            serde_norway::to_string(&bundle)
+                .expect("bundle renders")
+                .as_bytes(),
+            0o400,
+        );
+
+        let evidence = temporary.path().join("evidence-stub");
+        executable(
+            &evidence,
+            b"#!/bin/sh\nprintf '%s\\n' \"$@\" > \"$0.args\"\nif [ -f \"$0.fail\" ]; then\n  printf 'person-123 token-canary source-canary\\n' >&2\n  exit 41\nfi\ncat \"$0.output\"\n",
+        );
+        Self {
+            _temporary: temporary,
+            root,
+            evidence,
+        }
+    }
+
+    fn write_core_json(&self, value: &Value) {
+        self.write_core_bytes(&serde_json::to_vec(value).expect("core output renders"));
+    }
+
+    fn write_core_bytes(&self, bytes: &[u8]) {
+        fs::write(self.evidence.with_extension("output"), bytes).expect("core output writes");
+    }
+
+    fn show(&self) -> Output {
+        command()
+            .current_dir(&self.root)
+            .args([
+                "audit",
+                "show",
+                "--last-operation",
+                "--project",
+                ".",
+                "--evidence-bin",
+            ])
+            .arg(&self.evidence)
+            .output()
+            .expect("audit show")
+    }
+}
+
+fn command() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_evidencectl"))
+}
+
+fn private_directory(path: &Path) {
+    fs::create_dir(path).expect("private directory");
+    fs::set_permissions(path, fs::Permissions::from_mode(0o700)).expect("private mode");
+}
+
+fn private_file(path: &Path, contents: &[u8], mode: u32) {
+    fs::write(path, contents).expect("private file");
+    fs::set_permissions(path, fs::Permissions::from_mode(mode)).expect("private file mode");
+}
+
+fn executable(path: &Path, contents: &[u8]) {
+    private_file(path, contents, 0o700);
+}
+
+fn assert_success(output: &Output) {
+    assert!(
+        output.status.success(),
+        "stdout: {}\nstderr: {}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+}
+
+fn assert_closed_failure(output: &Output, label: &str) {
+    assert!(!output.status.success(), "{label} unexpectedly succeeded");
+    assert!(output.stdout.is_empty(), "{label} printed partial output");
+    assert_eq!(String::from_utf8_lossy(&output.stderr), FAILURE, "{label}");
+    for protected in ["person-123", "token-canary", "source-canary"] {
+        assert!(
+            !String::from_utf8_lossy(&output.stderr).contains(protected),
+            "{label} leaked {protected}"
+        );
+    }
+}
diff --git a/crates/registry-evidencectl/tests/cli_surface.rs b/crates/registry-evidencectl/tests/cli_surface.rs
new file mode 100644
index 000000000..ce9c6644a
--- /dev/null
+++ b/crates/registry-evidencectl/tests/cli_surface.rs
@@ -0,0 +1,64 @@
+//! Every command module is reachable from the binary.
+//!
+//! The crate has only a `[[bin]]` target, so the other integration tests pull
+//! command modules in with `#[path = "../src/..."] mod`. That compiles a module
+//! whether or not `main.rs` declares it, which lets a command ship with a full
+//! test suite and still be unreachable from `evidencectl`. This file drives the
+//! real binary so the top-level surface cannot drift away from `src/`.
+
+use std::process::Command;
+
+/// The complete top-level subcommand set. Adding a command means adding it
+/// here; the point of the list is that an omission fails rather than passes.
+const TOP_LEVEL_COMMANDS: [&str; 11] = [
+    "access", "keygen", "jwks", "new", "build", "fixtures", "source", "dev", "request", "verify",
+    "audit",
+];
+
+#[test]
+fn every_top_level_command_is_listed_and_dispatchable() {
+    let help = evidencectl(&["--help"]);
+    for command in TOP_LEVEL_COMMANDS {
+        assert!(
+            help.contains(command),
+            "`evidencectl --help` does not list `{command}`:\n{help}"
+        );
+
+        // Listing is not dispatch: clap prints help for a declared variant even
+        // when the arm behind it is missing, so ask the command itself.
+        let output = Command::new(env!("CARGO_BIN_EXE_evidencectl"))
+            .args([command, "--help"])
+            .output()
+            .expect("run evidencectl");
+        assert!(
+            output.status.success(),
+            "`evidencectl {command} --help` failed: {}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+    }
+}
+
+#[test]
+fn an_undeclared_command_is_still_refused() {
+    let output = Command::new(env!("CARGO_BIN_EXE_evidencectl"))
+        .args(["not-a-command", "--help"])
+        .output()
+        .expect("run evidencectl");
+    assert!(
+        !output.status.success(),
+        "an unknown subcommand must not succeed"
+    );
+}
+
+fn evidencectl(arguments: &[&str]) -> String {
+    let output = Command::new(env!("CARGO_BIN_EXE_evidencectl"))
+        .args(arguments)
+        .output()
+        .expect("run evidencectl");
+    assert!(
+        output.status.success(),
+        "evidencectl {arguments:?} failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    String::from_utf8_lossy(&output.stdout).into_owned()
+}
diff --git a/crates/registry-evidencectl/tests/dev_lifecycle.rs b/crates/registry-evidencectl/tests/dev_lifecycle.rs
new file mode 100644
index 000000000..85635f57d
--- /dev/null
+++ b/crates/registry-evidencectl/tests/dev_lifecycle.rs
@@ -0,0 +1,1148 @@
+//! Real first-tutorial lifecycle proof.
+//!
+//! The test is ignored in the ordinary package suite because it owns the
+//! fixed tutorial ports. The grouped lifecycle gate builds the sibling Mint
+//! and Evidence binaries, supplies their paths, and runs this test exactly.
+
+use std::{
+    ffi::OsStr,
+    fs,
+    net::TcpListener,
+    os::unix::{
+        ffi::OsStrExt as _,
+        fs::{symlink, MetadataExt as _, PermissionsExt as _},
+    },
+    path::{Path, PathBuf},
+    process::{Child, Command, Output},
+    thread,
+    time::{Duration, Instant},
+};
+
+use serde_json::{json, Value};
+
+const OPENAPI: &str = r#"openapi: 3.1.0
+info: {title: Tutorial registry, version: 1.0.0}
+servers: [{url: 'http://127.0.0.1:8000'}]
+paths:
+  /people/{person_id}:
+    get:
+      operationId: getPerson
+      parameters:
+        - name: person_id
+          in: path
+          required: true
+          schema: {type: string}
+      responses:
+        '200':
+          description: A person
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [person_id, date_of_birth]
+                properties:
+                  person_id: {type: string}
+                  date_of_birth: {type: string, format: date}
+"#;
+
+const QUESTION: &str = r#"id: adult-status
+question: Is the person at least 18 years old?
+purpose: age-check
+subject:
+  role: person
+  selector: person_id
+source:
+  operation: getPerson
+  facts:
+    - name: date_of_birth
+      path: /date_of_birth
+      combine: exactly-one
+  collectionBounds: {}
+answers:
+  - concept: is_adult
+    type: boolean
+derivation: derivations/adult-status.rhai
+disclosure:
+  allow: [is_adult]
+"#;
+
+const DERIVATION: &str = r#"fn answer(facts, selectors, context) {
+    let born = parse_date(required(facts.date_of_birth, "date_of_birth_missing"));
+    #{is_adult: compare_dates(context.legal_local_date, add_calendar_years(born, 18)) >= 0}
+}
+"#;
+
+const AGE_BRACKET_QUESTION: &str = r#"id: age-bracket
+question: Which age bracket does this person belong to?
+purpose: service-path-selection
+subject:
+  role: person
+  selector: person_id
+source:
+  operation: getPerson
+  facts:
+    - name: date_of_birth
+      path: /date_of_birth
+      combine: exactly-one
+  collectionBounds: {}
+answers:
+  - concept: age_bracket
+    type: controlled-category
+    values: [under-18, 18-to-24, 25-to-64, 65-or-older]
+derivation: derivations/age-bracket.rhai
+disclosure:
+  allow: [age_bracket]
+"#;
+
+const AGE_BRACKET_DERIVATION: &str = r#"fn answer(facts, selectors, context) {
+    let born = parse_date(required(facts.date_of_birth, "date_of_birth_missing"));
+    if compare_dates(context.legal_local_date, add_calendar_years(born, 18)) < 0 {
+        #{age_bracket: "under-18"}
+    } else if compare_dates(context.legal_local_date, add_calendar_years(born, 25)) < 0 {
+        #{age_bracket: "18-to-24"}
+    } else if compare_dates(context.legal_local_date, add_calendar_years(born, 65)) < 0 {
+        #{age_bracket: "25-to-64"}
+    } else {
+        #{age_bracket: "65-or-older"}
+    }
+}
+"#;
+
+#[test]
+#[ignore = "exact gate: owns fixed 127.0.0.1:8080 and :8081 tutorial ports"]
+fn real_detached_lifecycle_is_ready_private_and_stops_only_owned_children() {
+    let evidence = required_binary("EVIDENCE_BIN");
+    let mint = required_binary("MINT_BIN");
+    let fixture = Project::new_long_path();
+    assert!(
+        fixture
+            .root
+            .join(".evidence/dev/control.sock")
+            .as_os_str()
+            .as_bytes()
+            .len()
+            > 104,
+        "test path must exceed the common sockaddr_un.sun_path limit"
+    );
+    fixture.generate_evidence_keys();
+
+    let mut unrelated = Command::new("/bin/sleep")
+        .arg("60")
+        .spawn()
+        .expect("start unrelated process");
+
+    let started = fixture.dev_start(&evidence, &mint);
+    assert_success(&started, "dev --detach");
+    let stdout = String::from_utf8_lossy(&started.stdout);
+    assert_eq!(
+        stdout,
+        "Evidence ready at http://127.0.0.1:8080\nMint ready at http://127.0.0.1:8081\n"
+    );
+    assert!(ready(
+        "http://127.0.0.1:8080/ready",
+        json!({"status":"ready"})
+    ));
+    assert!(jwks_ready());
+
+    let duplicate = fixture.dev_start(&evidence, &mint);
+    assert!(!duplicate.status.success(), "duplicate start must fail");
+    assert!(ready(
+        "http://127.0.0.1:8080/ready",
+        json!({"status":"ready"})
+    ));
+
+    let dev = fixture.root.join(".evidence/dev");
+    assert_mode(&fixture.root.join(".evidence"), 0o700);
+    assert_mode(&dev, 0o700);
+    assert_mode(&dev.join("generated/audit"), 0o700);
+    for path in [
+        "state.json",
+        "generated/mint.yaml",
+        "generated/clients/caller.yaml",
+        "generated/audit/mint.jsonl",
+        "generated/keys/mint-audit-hmac-key",
+        "generated/keys/mint-private.jwk",
+        "generated/keys/mint-public.jwk.json",
+        "generated/keys/caller-private.jwk",
+        "generated/keys/caller-public.jwk.json",
+        "logs/supervisor.log",
+        "logs/mint.log",
+        "logs/evidence.log",
+    ] {
+        assert_mode(&dev.join(path), 0o600);
+    }
+
+    let state: Value = serde_json::from_slice(&fs::read(dev.join("state.json")).expect("state"))
+        .expect("state JSON");
+    assert_eq!(state["schema"], "registry.evidencectl.dev-state/v5");
+    assert_eq!(state["status"], "ready");
+    assert_eq!(state["accessTokenAudience"], "registry-evidence-local");
+    assert_eq!(state["caller"]["requesterTag"], "local-caller");
+    assert_eq!(state["accessPolicies"], json!([]));
+    assert_eq!(state["questions"][0]["alias"], "adult-status");
+    assert_eq!(
+        state["questions"][0]["requirementUri"],
+        "urn:registrystack:evidence:local:requirement:adult-status"
+    );
+    let encoded_state = serde_json::to_string(&state).expect("state encodes");
+    for prohibited in [
+        "access_token",
+        "\"d\"",
+        "generations",
+        "receipt",
+        "template",
+    ] {
+        assert!(
+            !encoded_state.contains(prohibited),
+            "state contains {prohibited}"
+        );
+    }
+
+    assert_success(
+        &Command::new(&mint)
+            .args(["check", "--config"])
+            .arg(dev.join("generated/mint.yaml"))
+            .output()
+            .expect("mint check"),
+        "mint check",
+    );
+    assert_success(
+        &Command::new(&evidence)
+            .arg("--runtime")
+            .arg(dev.join("runtime.yaml"))
+            .arg("check")
+            .output()
+            .expect("evidence check"),
+        "evidence check",
+    );
+
+    let stopped = fixture.dev_stop();
+    assert_success(&stopped, "dev stop");
+    assert_eq!(
+        String::from_utf8_lossy(&stopped.stdout),
+        "Local Evidence stopped\n"
+    );
+    wait_unavailable("127.0.0.1:8080");
+    wait_unavailable("127.0.0.1:8081");
+    assert!(unrelated.try_wait().expect("unrelated status").is_none());
+    stop_child(&mut unrelated);
+
+    let entries = sorted_names(&dev);
+    assert_eq!(entries, ["audit", "bundle", "runtime.yaml", "state.json"]);
+    let stopped_state: Value =
+        serde_json::from_slice(&fs::read(dev.join("state.json")).expect("stopped state"))
+            .expect("stopped state JSON");
+    assert_eq!(stopped_state["status"], "stopped");
+    assert!(stopped_state["caller"].is_null());
+    assert!(dev.join("audit/evidence.jsonl").is_file());
+    assert!(dev.join("runtime.yaml").is_file());
+    assert_success(&fixture.dev_clean(), "dev clean");
+    assert!(!dev.exists(), "clean removes the sealed stopped generation");
+}
+
+#[test]
+#[ignore = "exact gate: starts real local Mint and Evidence services"]
+fn configurable_ports_drive_every_generated_url_and_listener() {
+    let evidence = required_binary("EVIDENCE_BIN");
+    let mint = required_binary("MINT_BIN");
+    let fixture = Project::new();
+    fixture.generate_evidence_keys();
+    let (evidence_port, mint_port) = unused_port_pair();
+
+    let started = fixture.dev_start_on_ports(&evidence, &mint, evidence_port, mint_port);
+    assert_success(&started, "dev --detach on configured ports");
+    assert_eq!(
+        String::from_utf8_lossy(&started.stdout),
+        format!(
+            "Evidence ready at http://127.0.0.1:{evidence_port}\nMint ready at http://127.0.0.1:{mint_port}\n"
+        )
+    );
+    assert!(ready(
+        &format!("http://127.0.0.1:{evidence_port}/ready"),
+        json!({"status":"ready"})
+    ));
+    assert!(jwks_ready_at(mint_port));
+
+    let dev = fixture.root.join(".evidence/dev");
+    let state: Value = serde_json::from_slice(&fs::read(dev.join("state.json")).unwrap()).unwrap();
+    assert_eq!(
+        state["evidenceOrigin"],
+        format!("http://127.0.0.1:{evidence_port}")
+    );
+    assert_eq!(
+        state["tokenUrl"],
+        format!("http://127.0.0.1:{mint_port}/token")
+    );
+    let runtime: Value = serde_norway::from_slice(&fs::read(dev.join("runtime.yaml")).unwrap())
+        .expect("runtime YAML");
+    let mint_config: Value =
+        serde_norway::from_slice(&fs::read(dev.join("generated/mint.yaml")).unwrap())
+            .expect("Mint YAML");
+    assert_eq!(runtime["listener"]["port"], evidence_port);
+    assert_eq!(mint_config["listener"]["port"], mint_port);
+    assert_eq!(mint_config["audit"]["path"], "audit/mint.jsonl");
+    assert_eq!(mint_config["audit"]["hashKeyVersion"], 1);
+    assert_eq!(
+        mint_config["clientAssertion"]["audience"],
+        format!("http://127.0.0.1:{mint_port}/token")
+    );
+
+    assert_success(&fixture.dev_stop(), "stop configured ports");
+    wait_unavailable(&format!("127.0.0.1:{evidence_port}"));
+    wait_unavailable(&format!("127.0.0.1:{mint_port}"));
+    assert_success(&fixture.dev_clean(), "clean configured ports");
+}
+
+#[test]
+#[ignore = "exact gate: starts real Mint and Evidence services"]
+fn explicit_access_clients_reload_mint_without_restarting_services() {
+    let evidence = required_binary("EVIDENCE_BIN");
+    let mint = required_binary("MINT_BIN");
+    let fixture = Project::new();
+    let source_probe = TcpListener::bind("127.0.0.1:0").expect("source call probe");
+    source_probe
+        .set_nonblocking(true)
+        .expect("nonblocking source call probe");
+    fixture.point_source_at(
+        source_probe
+            .local_addr()
+            .expect("source probe address")
+            .port(),
+    );
+    fixture.add_age_bracket_question();
+    fixture.generate_evidence_keys();
+    assert_success(
+        &evidencectl()
+            .args([
+                "access",
+                "policy",
+                "add",
+                "age-checks",
+                "--question",
+                "adult-status",
+                "--project",
+            ])
+            .arg(&fixture.root)
+            .output()
+            .expect("add policy"),
+        "add policy",
+    );
+    assert_success(
+        &evidencectl()
+            .args([
+                "access",
+                "policy",
+                "add",
+                "service-routing",
+                "--question",
+                "age-bracket",
+                "--project",
+            ])
+            .arg(&fixture.root)
+            .output()
+            .expect("add unassigned policy"),
+        "add policy for the ungranted question",
+    );
+    assert_success(
+        &add_local_client(&fixture.root, "client-a", "age-checks"),
+        "add client A",
+    );
+    let client_a_key = fixture.root.join(".evidence/clients/client-a/private.jwk");
+    assert_mode(&client_a_key, 0o600);
+    let external_client_a_key = fixture
+        ._temporary
+        .path()
+        .join("external-client-a-private.jwk");
+    fs::copy(&client_a_key, &external_client_a_key).expect("retain external client A key");
+    fs::remove_dir_all(client_a_key.parent().unwrap())
+        .expect("remove local-only client A key as in a fresh clone");
+    assert!(
+        !client_a_key.exists(),
+        "the cloned project has only client A's public registration"
+    );
+
+    let pid_directory = fixture.root.join("service-pids");
+    fs::create_dir(&pid_directory).expect("PID directory");
+    fs::set_permissions(&pid_directory, fs::Permissions::from_mode(0o700))
+        .expect("PID directory mode");
+    let (evidence_port, mint_port) = unused_port_pair();
+    let started = fixture
+        .dev_start_command(&evidence, &mint)
+        .args(["--evidence-port", &evidence_port.to_string()])
+        .args(["--mint-port", &mint_port.to_string()])
+        .env("EVIDENCECTL_TEST_SERVICE_PID_DIRECTORY", &pid_directory)
+        .output()
+        .expect("start explicit access generation");
+    assert_success(&started, "start explicit access generation");
+    let evidence_pid = read_pid(&pid_directory.join("evidence.pid"));
+    let mint_pid = read_pid(&pid_directory.join("mint.pid"));
+    let generated_clients = fixture.root.join(".evidence/dev/generated/clients");
+    assert_mode(&fixture.root.join(".evidence/dev/generated/audit"), 0o700);
+    assert_mode(
+        &fixture
+            .root
+            .join(".evidence/dev/generated/keys/mint-audit-hmac-key"),
+        0o600,
+    );
+    assert_mode(
+        &fixture
+            .root
+            .join(".evidence/dev/generated/audit/mint.jsonl"),
+        0o600,
+    );
+    assert_eq!(sorted_names(&generated_clients), ["client-a.yaml"]);
+
+    let added = add_local_client(&fixture.root, "client-b", "age-checks");
+    assert_success(&added, "live add client B");
+    assert!(String::from_utf8_lossy(&added.stdout).contains("Registry Mint reload requested."));
+    assert_eq!(
+        sorted_names(&generated_clients),
+        ["client-a.yaml", "client-b.yaml"]
+    );
+    assert_eq!(read_pid(&pid_directory.join("evidence.pid")), evidence_pid);
+    assert_eq!(read_pid(&pid_directory.join("mint.pid")), mint_pid);
+    assert!(process_is_alive(evidence_pid));
+    assert!(process_is_alive(mint_pid));
+
+    let prepared = retry_until_success("newly added client B token request", || {
+        evidencectl()
+            .args([
+                "request",
+                "prepare",
+                "adult-status",
+                "--purpose",
+                "age-check",
+                "--subject",
+                "person_id=person-123",
+                "--client",
+                "client-b",
+                "--name",
+                "client-b-live",
+                "--project",
+            ])
+            .arg(&fixture.root)
+            .output()
+            .expect("prepare as client B")
+    });
+    assert_success(&prepared, "newly added client B token request");
+
+    let client_b_key = fixture.root.join(".evidence/clients/client-b/private.jwk");
+    let token = direct_mint_token(&mint, mint_port, "client-b", &client_b_key);
+    assert_success(&token, "direct token for client B");
+    let token = String::from_utf8(token.stdout)
+        .expect("Mint token is UTF-8")
+        .trim()
+        .to_owned();
+    let status = post_evidence(
+        evidence_port,
+        &token,
+        "urn:registrystack:evidence:local:requirement:age-bracket",
+        "service-path-selection",
+        "local-subject-age-bracket-v1",
+    );
+    assert_eq!(status, 403, "an ungranted authored question is forbidden");
+    assert_source_not_called(&source_probe);
+
+    let revoked = evidencectl()
+        .args(["access", "client", "revoke", "client-a", "--project"])
+        .arg(&fixture.root)
+        .output()
+        .expect("revoke client A");
+    assert_success(&revoked, "live revoke client A");
+    assert!(String::from_utf8_lossy(&revoked.stdout).contains("Registry Mint reload requested."));
+    assert_eq!(sorted_names(&generated_clients), ["client-b.yaml"]);
+    assert_eq!(read_pid(&pid_directory.join("evidence.pid")), evidence_pid);
+    assert_eq!(read_pid(&pid_directory.join("mint.pid")), mint_pid);
+    assert!(process_is_alive(evidence_pid));
+    assert!(process_is_alive(mint_pid));
+    assert!(
+        !client_a_key.exists(),
+        "revocation does not require or recreate client A's local key"
+    );
+
+    let direct_refusal = retry_until_mint_refuses(|| {
+        direct_mint_token(&mint, mint_port, "client-a", &external_client_a_key)
+    });
+    assert!(direct_refusal.stdout.is_empty());
+
+    let refused = evidencectl()
+        .args([
+            "request",
+            "prepare",
+            "adult-status",
+            "--purpose",
+            "age-check",
+            "--subject",
+            "person_id=person-123",
+            "--client",
+            "client-a",
+            "--name",
+            "client-a-revoked",
+            "--project",
+        ])
+        .arg(&fixture.root)
+        .output()
+        .expect("prepare as revoked client A");
+    assert!(
+        !refused.status.success(),
+        "revoked client A must be refused"
+    );
+    assert!(String::from_utf8_lossy(&refused.stderr)
+        .contains("unknown or revoked active client client-a"));
+    assert!(!fixture
+        .root
+        .join(".evidence/requests/client-a-revoked")
+        .exists());
+
+    let last_revoked = evidencectl()
+        .args(["access", "client", "revoke", "client-b", "--project"])
+        .arg(&fixture.root)
+        .output()
+        .expect("revoke last client B");
+    assert_success(&last_revoked, "live revoke last client B");
+    assert!(
+        String::from_utf8_lossy(&last_revoked.stdout).contains("Registry Mint reload requested.")
+    );
+    assert!(sorted_names(&generated_clients).is_empty());
+    wait_mint_without_clients(mint_port);
+    assert!(process_is_alive(evidence_pid));
+    assert!(process_is_alive(mint_pid));
+
+    assert_success(&fixture.dev_stop(), "stop explicit access generation");
+    wait_unavailable(&format!("127.0.0.1:{evidence_port}"));
+    wait_unavailable(&format!("127.0.0.1:{mint_port}"));
+    assert_success(&fixture.dev_clean(), "clean explicit access generation");
+}
+
+#[test]
+fn equal_local_ports_fail_before_creating_private_state() {
+    let fixture = Project::new();
+    let output = evidencectl()
+        .args([
+            "dev",
+            "--detach",
+            "--evidence-port",
+            "18080",
+            "--mint-port",
+            "18080",
+            "--project",
+        ])
+        .arg(&fixture.root)
+        .output()
+        .expect("equal-port start");
+    assert!(!output.status.success());
+    assert!(!fixture.root.join(".evidence").exists());
+}
+
+#[test]
+#[ignore = "exact gate: owns fixed 127.0.0.1:8081 tutorial port"]
+fn mint_port_conflict_fails_without_starting_evidence_or_disturbing_the_listener() {
+    let evidence = required_binary("EVIDENCE_BIN");
+    let mint = required_binary("MINT_BIN");
+    let fixture = Project::new();
+    fixture.generate_evidence_keys();
+    let conflict = TcpListener::bind("127.0.0.1:8081").expect("reserve Mint port");
+
+    let output = fixture.dev_start(&evidence, &mint);
+    assert!(!output.status.success(), "port conflict must fail");
+    assert!(conflict.local_addr().is_ok(), "unrelated listener survives");
+    assert!(
+        TcpListener::bind("127.0.0.1:8080").is_ok(),
+        "Evidence was not orphaned"
+    );
+    assert!(
+        !fixture.root.join(".evidence/dev").exists(),
+        "failed fresh state cleaned"
+    );
+}
+
+#[test]
+#[ignore = "exact gate: starts real Mint on fixed 127.0.0.1:8081"]
+fn evidence_child_failure_stops_mint_and_cleans_the_fresh_session() {
+    let mint = required_binary("MINT_BIN");
+    let fixture = Project::new();
+    fixture.generate_evidence_keys();
+    let evidence = fixture.root.join("evidence-fails-on-serve");
+    fs::write(
+        &evidence,
+        "#!/bin/sh\nif [ \"$3\" = check ]; then exit 0; fi\nexit 1\n",
+    )
+    .expect("write Evidence test binary");
+    fs::set_permissions(&evidence, fs::Permissions::from_mode(0o700)).expect("test binary mode");
+
+    let output = fixture.dev_start(&evidence, &mint);
+    assert!(
+        !output.status.success(),
+        "Evidence child failure must fail start"
+    );
+    wait_unavailable("127.0.0.1:8080");
+    wait_unavailable("127.0.0.1:8081");
+    assert!(
+        !fixture.root.join(".evidence/dev").exists(),
+        "failed state cleaned"
+    );
+}
+
+#[test]
+#[ignore = "exact gate: starts real services on fixed tutorial ports"]
+fn ready_state_publication_failure_stops_children_and_allows_a_fresh_start() {
+    let evidence = required_binary("EVIDENCE_BIN");
+    let mint = required_binary("MINT_BIN");
+    let fixture = Project::new();
+    fixture.generate_evidence_keys();
+
+    let failed = fixture.dev_start_with_env(
+        &evidence,
+        &mint,
+        "EVIDENCECTL_TEST_SUPERVISOR_FAIL_STAGE",
+        OsStr::new("before-ready-state"),
+    );
+    assert!(
+        !failed.status.success(),
+        "state publication fault must fail"
+    );
+    wait_unavailable("127.0.0.1:8080");
+    wait_unavailable("127.0.0.1:8081");
+    assert!(
+        !fixture.root.join(".evidence/dev").exists(),
+        "failed fresh state cleaned"
+    );
+
+    let restarted = fixture.dev_start(&evidence, &mint);
+    assert_success(&restarted, "fresh start after rollback");
+    assert_success(&fixture.dev_stop(), "stop fresh start");
+}
+
+#[test]
+#[ignore = "exact gate: starts real services on fixed tutorial ports"]
+fn catchable_supervisor_signals_stop_owned_children_and_publish_terminal_state() {
+    let evidence = required_binary("EVIDENCE_BIN");
+    let mint = required_binary("MINT_BIN");
+    let mut unrelated = Command::new("/bin/sleep")
+        .arg("60")
+        .spawn()
+        .expect("start unrelated process");
+
+    for signal in [
+        rustix::process::Signal::TERM,
+        rustix::process::Signal::HUP,
+        rustix::process::Signal::INT,
+    ] {
+        let fixture = Project::new();
+        fixture.generate_evidence_keys();
+        let pid_file = fixture.root.join("supervisor.pid");
+        let started = fixture.dev_start_with_env(
+            &evidence,
+            &mint,
+            "EVIDENCECTL_TEST_SUPERVISOR_PID_FILE",
+            pid_file.as_os_str(),
+        );
+        assert_success(&started, "dev --detach before supervisor signal");
+
+        let pid: i32 = fs::read_to_string(&pid_file)
+            .expect("supervisor pid file")
+            .trim()
+            .parse()
+            .expect("supervisor pid");
+        let pid = rustix::process::Pid::from_raw(pid).expect("positive supervisor pid");
+        rustix::process::kill_process(pid, signal).expect("signal supervisor");
+
+        let dev = fixture.root.join(".evidence/dev");
+        wait_for_failed_state(&dev);
+        wait_unavailable("127.0.0.1:8080");
+        wait_unavailable("127.0.0.1:8081");
+        assert!(!dev.join("control.sock").exists());
+        assert!(unrelated.try_wait().expect("unrelated status").is_none());
+    }
+    stop_child(&mut unrelated);
+}
+
+#[test]
+fn every_pre_socket_supervisor_failure_rolls_back_without_wedging_the_project() {
+    let fixture = Project::new();
+    fixture.generate_evidence_keys();
+    let check_only = fixture.root.join("check-only-tool");
+    fs::write(
+        &check_only,
+        "#!/bin/sh\ncase \"$*\" in *check*) exit 0;; *) exit 1;; esac\n",
+    )
+    .expect("write check-only tool");
+    fs::set_permissions(&check_only, fs::Permissions::from_mode(0o700)).expect("tool mode");
+
+    let missing_supervisor = fixture.root.join("missing-supervisor");
+    let failed = fixture.dev_start_with_env(
+        &check_only,
+        &check_only,
+        "EVIDENCECTL_TEST_SUPERVISOR_BIN",
+        missing_supervisor.as_os_str(),
+    );
+    assert!(!failed.status.success(), "supervisor spawn fault must fail");
+    assert!(!fixture.root.join(".evidence/dev").exists());
+
+    for stage in ["before-setsid", "before-socket", "after-socket"] {
+        let failed = fixture.dev_start_with_env(
+            &check_only,
+            &check_only,
+            "EVIDENCECTL_TEST_SUPERVISOR_FAIL_STAGE",
+            OsStr::new(stage),
+        );
+        assert!(!failed.status.success(), "{stage} fault must fail");
+        assert!(
+            !fixture.root.join(".evidence/dev").exists(),
+            "{stage} rollback must permit the next fresh start"
+        );
+    }
+}
+
+#[test]
+fn public_symlink_and_stale_state_fail_before_binary_or_process_access() {
+    let public = Project::new();
+    fs::create_dir(public.root.join(".evidence")).expect("generated root");
+    fs::set_permissions(
+        public.root.join(".evidence"),
+        fs::Permissions::from_mode(0o755),
+    )
+    .expect("public mode");
+    let output = evidencectl()
+        .args(["dev", "--detach", "--project"])
+        .arg(&public.root)
+        .output()
+        .expect("public-state start");
+    assert!(!output.status.success());
+    assert!(!public.dev_clean().status.success());
+
+    let linked = Project::new();
+    let target = linked.root.join("private-target");
+    fs::create_dir(&target).expect("target");
+    fs::set_permissions(&target, fs::Permissions::from_mode(0o700)).expect("target mode");
+    symlink(&target, linked.root.join(".evidence")).expect("generated symlink");
+    let output = evidencectl()
+        .args(["dev", "--detach", "--project"])
+        .arg(&linked.root)
+        .output()
+        .expect("symlink-state start");
+    assert!(!output.status.success());
+    assert!(!linked.dev_clean().status.success());
+    assert!(linked.root.join(".evidence").is_symlink());
+
+    let stale = Project::new();
+    fs::create_dir(stale.root.join(".evidence")).expect("generated root");
+    fs::set_permissions(
+        stale.root.join(".evidence"),
+        fs::Permissions::from_mode(0o700),
+    )
+    .expect("generated mode");
+    fs::create_dir(stale.root.join(".evidence/dev")).expect("stale dev");
+    fs::set_permissions(
+        stale.root.join(".evidence/dev"),
+        fs::Permissions::from_mode(0o700),
+    )
+    .expect("stale mode");
+    fs::write(stale.root.join(".evidence/dev/unknown"), b"do not remove").expect("stale entry");
+    let mut unrelated = Command::new("/bin/sleep")
+        .arg("60")
+        .spawn()
+        .expect("unrelated process");
+    let output = evidencectl()
+        .args(["dev", "--detach", "--project"])
+        .arg(&stale.root)
+        .output()
+        .expect("stale-state start");
+    assert!(!output.status.success());
+    assert!(!stale.dev_clean().status.success());
+    assert!(stale.root.join(".evidence/dev/unknown").is_file());
+    assert!(unrelated.try_wait().expect("unrelated status").is_none());
+    stop_child(&mut unrelated);
+}
+
+struct Project {
+    _temporary: tempfile::TempDir,
+    root: PathBuf,
+}
+
+impl Project {
+    fn new() -> Self {
+        Self::at_relative_path(Path::new("tutorial"))
+    }
+
+    fn new_long_path() -> Self {
+        Self::at_relative_path(Path::new(
+            "first-evidence-assertion-with-a-deliberately-long-project-directory/adult-status-with-a-long-adopter-project-name",
+        ))
+    }
+
+    fn at_relative_path(relative: &Path) -> Self {
+        let temporary = tempfile::tempdir().expect("tempdir");
+        let root = temporary.path().join(relative);
+        fs::create_dir_all(&root).expect("project");
+        fs::create_dir(root.join("questions")).expect("questions");
+        fs::create_dir(root.join("derivations")).expect("derivations");
+        fs::write(root.join("source.openapi.yaml"), OPENAPI).expect("OpenAPI");
+        fs::write(root.join("questions/adult-status.yaml"), QUESTION).expect("question");
+        fs::write(root.join("derivations/adult-status.rhai"), DERIVATION).expect("derivation");
+        Self {
+            _temporary: temporary,
+            root,
+        }
+    }
+
+    fn generate_evidence_keys(&self) {
+        let secrets = self.root.join("secrets");
+        assert_success(
+            &evidencectl()
+                .args(["keygen", "signing", "--out-dir"])
+                .arg(&secrets)
+                .args(["--kid", "local-signing-key-1"])
+                .output()
+                .expect("signing key"),
+            "signing key",
+        );
+        for name in ["audit-hmac-key", "subject-binding-hmac-key"] {
+            assert_success(
+                &evidencectl()
+                    .args(["keygen", "secret", "--out"])
+                    .arg(secrets.join(name))
+                    .output()
+                    .expect("HMAC key"),
+                "HMAC key",
+            );
+        }
+    }
+
+    fn point_source_at(&self, port: u16) {
+        fs::write(
+            self.root.join("source.openapi.yaml"),
+            OPENAPI.replace("http://127.0.0.1:8000", &format!("http://127.0.0.1:{port}")),
+        )
+        .expect("update source origin");
+    }
+
+    fn add_age_bracket_question(&self) {
+        fs::write(
+            self.root.join("questions/age-bracket.yaml"),
+            AGE_BRACKET_QUESTION,
+        )
+        .expect("age-bracket question");
+        fs::write(
+            self.root.join("derivations/age-bracket.rhai"),
+            AGE_BRACKET_DERIVATION,
+        )
+        .expect("age-bracket derivation");
+    }
+
+    fn dev_start(&self, evidence: &Path, mint: &Path) -> Output {
+        self.dev_start_command(evidence, mint)
+            .output()
+            .expect("dev --detach")
+    }
+
+    fn dev_start_on_ports(
+        &self,
+        evidence: &Path,
+        mint: &Path,
+        evidence_port: u16,
+        mint_port: u16,
+    ) -> Output {
+        self.dev_start_command(evidence, mint)
+            .args(["--evidence-port", &evidence_port.to_string()])
+            .args(["--mint-port", &mint_port.to_string()])
+            .output()
+            .expect("dev --detach on configured ports")
+    }
+
+    fn dev_start_with_env(
+        &self,
+        evidence: &Path,
+        mint: &Path,
+        name: &str,
+        value: &OsStr,
+    ) -> Output {
+        self.dev_start_command(evidence, mint)
+            .env(name, value)
+            .output()
+            .expect("dev --detach with test fault")
+    }
+
+    fn dev_start_command(&self, evidence: &Path, mint: &Path) -> Command {
+        let mut command = evidencectl();
+        command
+            .args(["dev", "--detach", "--project"])
+            .arg(&self.root)
+            .arg("--evidence-bin")
+            .arg(evidence)
+            .arg("--mint-bin")
+            .arg(mint)
+            .arg("--ready-timeout-seconds")
+            .arg("20");
+        command
+    }
+
+    fn dev_stop(&self) -> Output {
+        evidencectl()
+            .args(["dev", "stop", "--project"])
+            .arg(&self.root)
+            .output()
+            .expect("dev stop")
+    }
+
+    fn dev_clean(&self) -> Output {
+        evidencectl()
+            .args(["dev", "clean", "--project"])
+            .arg(&self.root)
+            .output()
+            .expect("dev clean")
+    }
+}
+
+fn evidencectl() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_evidencectl"))
+}
+
+fn add_local_client(project: &Path, client: &str, policy: &str) -> Output {
+    evidencectl()
+        .args([
+            "access",
+            "client",
+            "add",
+            client,
+            "--policy",
+            policy,
+            "--generate-local-key",
+            "--project",
+        ])
+        .arg(project)
+        .output()
+        .expect("add local client")
+}
+
+fn direct_mint_token(mint: &Path, port: u16, client: &str, key: &Path) -> Output {
+    let token_url = format!("http://127.0.0.1:{port}/token");
+    Command::new(mint)
+        .arg("token")
+        .arg("--url")
+        .arg(&token_url)
+        .arg("--audience")
+        .arg(&token_url)
+        .arg("--client-id")
+        .arg(client)
+        .arg("--key")
+        .arg(key)
+        .output()
+        .expect("invoke Mint token client")
+}
+
+fn post_evidence(
+    port: u16,
+    token: &str,
+    requirement: &str,
+    purpose: &str,
+    selector_profile: &str,
+) -> u16 {
+    let body = json!({
+        "requestNonce": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+        "requirement": requirement,
+        "purpose": purpose,
+        "subjects": [{
+            "role": "person",
+            "selector": {
+                "profile": selector_profile,
+                "values": {"person_id": "person-123"},
+            },
+        }],
+    });
+    let body = body.to_string();
+    match ureq::post(&format!("http://127.0.0.1:{port}/v1/evidence"))
+        .set("Authorization", &format!("Bearer {token}"))
+        .set("Accept", "application/jose+json")
+        .set("Content-Type", "application/json")
+        .send_string(&body)
+    {
+        Ok(response) => response.status(),
+        Err(ureq::Error::Status(status, _)) => status,
+        Err(error) => panic!("Evidence request failed before an HTTP response: {error}"),
+    }
+}
+
+fn assert_source_not_called(source_probe: &TcpListener) {
+    match source_probe.accept() {
+        Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => {}
+        Ok(_) => panic!("Evidence contacted the source for an ungranted question"),
+        Err(error) => panic!("source call probe failed: {error}"),
+    }
+}
+
+fn retry_until_success(label: &str, mut operation: impl FnMut() -> Output) -> Output {
+    let deadline = Instant::now() + Duration::from_secs(5);
+    loop {
+        let output = operation();
+        if output.status.success() {
+            return output;
+        }
+        if Instant::now() >= deadline {
+            panic!(
+                "{label} did not succeed after Mint reload\nstdout:\n{}\nstderr:\n{}",
+                String::from_utf8_lossy(&output.stdout),
+                String::from_utf8_lossy(&output.stderr)
+            );
+        }
+        thread::sleep(Duration::from_millis(50));
+    }
+}
+
+fn retry_until_mint_refuses(mut operation: impl FnMut() -> Output) -> Output {
+    let deadline = Instant::now() + Duration::from_secs(5);
+    loop {
+        let output = operation();
+        let refused = !output.status.success()
+            && output.stdout.is_empty()
+            && String::from_utf8_lossy(&output.stderr).contains("invalid_client");
+        if refused {
+            return output;
+        }
+        if Instant::now() >= deadline {
+            panic!(
+                "Mint did not refuse revoked client A after reload\nstdout:\n{}\nstderr:\n{}",
+                String::from_utf8_lossy(&output.stdout),
+                String::from_utf8_lossy(&output.stderr)
+            );
+        }
+        thread::sleep(Duration::from_millis(50));
+    }
+}
+
+fn read_pid(path: &Path) -> u32 {
+    fs::read_to_string(path)
+        .unwrap_or_else(|error| panic!("read {}: {error}", path.display()))
+        .trim()
+        .parse()
+        .expect("numeric PID")
+}
+
+fn process_is_alive(pid: u32) -> bool {
+    Command::new("/bin/kill")
+        .args(["-0", &pid.to_string()])
+        .status()
+        .is_ok_and(|status| status.success())
+}
+
+fn required_binary(name: &str) -> PathBuf {
+    std::env::var_os(name)
+        .map(PathBuf::from)
+        .unwrap_or_else(|| panic!("set {name} for the exact lifecycle gate"))
+}
+
+fn assert_success(output: &Output, label: &str) {
+    assert!(
+        output.status.success(),
+        "{label} failed\nstdout:\n{}\nstderr:\n{}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+}
+
+fn ready(url: &str, expected: Value) -> bool {
+    ureq::get(url)
+        .call()
+        .ok()
+        .and_then(|response| serde_json::from_reader::<_, Value>(response.into_reader()).ok())
+        == Some(expected)
+}
+
+fn jwks_ready() -> bool {
+    jwks_ready_at(8081)
+}
+
+fn jwks_ready_at(port: u16) -> bool {
+    ureq::get(&format!("http://127.0.0.1:{port}/.well-known/jwks.json"))
+        .call()
+        .ok()
+        .and_then(|response| serde_json::from_reader::<_, Value>(response.into_reader()).ok())
+        .and_then(|value| value["keys"].as_array().cloned())
+        .is_some_and(|keys| {
+            keys.iter()
+                .any(|key| key["kid"] == "local-mint-signing-key-1")
+        })
+}
+
+fn unused_port_pair() -> (u16, u16) {
+    let first = TcpListener::bind("127.0.0.1:0").expect("reserve first port");
+    let second = TcpListener::bind("127.0.0.1:0").expect("reserve second port");
+    let ports = (
+        first.local_addr().expect("first address").port(),
+        second.local_addr().expect("second address").port(),
+    );
+    drop((first, second));
+    ports
+}
+
+fn assert_mode(path: &Path, expected: u32) {
+    let metadata = fs::symlink_metadata(path)
+        .unwrap_or_else(|error| panic!("inspect {}: {error}", path.display()));
+    assert_eq!(
+        metadata.mode() & 0o777,
+        expected,
+        "mode of {}",
+        path.display()
+    );
+    assert_eq!(metadata.uid(), rustix::process::getuid().as_raw());
+}
+
+fn sorted_names(root: &Path) -> Vec<String> {
+    let mut names = fs::read_dir(root)
+        .expect("directory")
+        .map(|entry| {
+            entry
+                .expect("entry")
+                .file_name()
+                .to_string_lossy()
+                .into_owned()
+        })
+        .collect::<Vec<_>>();
+    names.sort();
+    names
+}
+
+fn wait_unavailable(address: &str) {
+    let deadline = Instant::now() + Duration::from_secs(5);
+    while Instant::now() < deadline {
+        if TcpListener::bind(address).is_ok() {
+            return;
+        }
+        thread::sleep(Duration::from_millis(50));
+    }
+    panic!("{address} remained occupied");
+}
+
+fn wait_mint_without_clients(port: u16) {
+    let deadline = Instant::now() + Duration::from_secs(5);
+    while Instant::now() < deadline {
+        if matches!(
+            ureq::get(&format!("http://127.0.0.1:{port}/ready")).call(),
+            Err(ureq::Error::Status(503, _))
+        ) {
+            return;
+        }
+        thread::sleep(Duration::from_millis(50));
+    }
+    panic!("Mint did not publish its empty-registry readiness state");
+}
+
+fn wait_for_failed_state(dev: &Path) {
+    let deadline = Instant::now() + Duration::from_secs(45);
+    while Instant::now() < deadline {
+        if let Ok(bytes) = fs::read(dev.join("state.json")) {
+            if let Ok(state) = serde_json::from_slice::<Value>(&bytes) {
+                if state["status"] == "failed" && state["failure"] == "supervisor-signal" {
+                    return;
+                }
+            }
+        }
+        thread::sleep(Duration::from_millis(50));
+    }
+    panic!("supervisor did not publish terminal failed state");
+}
+
+fn stop_child(child: &mut Child) {
+    let _ = child.kill();
+    let _ = child.wait();
+}
diff --git a/crates/registry-evidencectl/tests/doctor.rs b/crates/registry-evidencectl/tests/doctor.rs
new file mode 100644
index 000000000..87b43ecbd
--- /dev/null
+++ b/crates/registry-evidencectl/tests/doctor.rs
@@ -0,0 +1,924 @@
+#![cfg(unix)]
+
+//! `evidencectl doctor` over a real deployment project.
+//!
+//! Every filesystem assertion here is about a mode or an owner the Evidence
+//! runtime refuses at startup. The filesystem is intentionally assembled as a
+//! doctor fixture because `evidencectl new` no longer invents a runnable
+//! deployment. No `evidence` binary is involved anywhere in this file:
+//! `doctor` is a filesystem walk, and an adopter who cannot yet start the
+//! service is exactly the one who needs it. Nothing here prints key material.
+
+use std::{
+    fs,
+    os::unix::fs::PermissionsExt as _,
+    path::Path,
+    process::{Command, Output},
+};
+
+const SIGNING_KID: &str = "doctor-signing-key-1";
+const SECRET_FILES: [&str; 2] = ["audit-hmac-key", "subject-binding-hmac-key"];
+
+const MATCHING_MINT_CONFIG: &str = r#"version: 1
+issuer: https://identity.invalid
+signing:
+  algorithm: EdDSA
+  jwksPath: /.well-known/jwks.json
+accessTokens:
+  audiences: [evidence-scaffold]
+  claims:
+    principal: sub
+    requesterTags: evidence_tags
+    evidenceAudience: evidence_audience
+    grantId: evidence_grant_id
+    grantAuthority: evidence_authority
+"#;
+
+#[test]
+fn doctor_passes_a_frozen_project_and_leaves_the_public_key_beside_it_alone() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let project = workspace.path().join("project");
+    provision(&project);
+    provision_bearer_token(&project);
+
+    // `keygen signing` writes the public half into the secret root at 0644 by
+    // design. The runtime never resolves it as a secret, so doctor must not
+    // report it. A walk of the secret directory would; a walk of the secret
+    // references the bundle actually names does not.
+    let public_key = project.join("secrets/signing-ed25519-public.jwk.json");
+    assert_eq!(
+        mode_of(&public_key),
+        0o644,
+        "the scaffolded public key is no longer world-readable, so this test proves nothing"
+    );
+
+    freeze(&project);
+    let output = doctor(&project, &[]);
+    unfreeze(&project);
+
+    let stdout = stdout_of(&output);
+    assert!(
+        output.status.success(),
+        "doctor failed on a correctly provisioned project:\n{stdout}{}",
+        stderr_of(&output)
+    );
+    assert!(
+        stdout.contains("0 failed"),
+        "unexpected doctor summary: {stdout}"
+    );
+    assert!(
+        !stdout.contains("signing-ed25519-public.jwk.json"),
+        "doctor reported the public key that sits beside the private one: {stdout}"
+    );
+}
+
+#[test]
+fn doctor_names_every_artifact_whose_mode_the_runtime_refuses() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let project = workspace.path().join("project");
+    provision(&project);
+    provision_bearer_token(&project);
+    freeze(&project);
+
+    // One artifact per rule the runtime enforces, each widened past it. A
+    // `chmod -R` an operator runs over a project produces exactly this state.
+    let refused = [
+        "runtime.yaml",
+        "bundle/evidence.yaml",
+        "secrets",
+        "secrets/audit-hmac-key",
+        "audit/evidence.jsonl",
+    ];
+    fs::write(project.join("audit/evidence.jsonl"), "").expect("stage an audit chain");
+    for path in refused {
+        set_mode(&project.join(path), 0o755);
+    }
+
+    let output = doctor(&project, &[]);
+    unfreeze(&project);
+
+    let stdout = stdout_of(&output);
+    assert!(
+        !output.status.success(),
+        "doctor passed a project the runtime would refuse:\n{stdout}"
+    );
+    for path in refused {
+        assert!(
+            stdout.contains(path),
+            "doctor did not report {path}:\n{stdout}"
+        );
+    }
+}
+
+#[test]
+fn doctor_reports_a_secret_the_bundle_references_and_the_project_does_not_hold() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let project = workspace.path().join("project");
+    provision(&project);
+
+    // Every secret but the source bearer token, which the README tells an
+    // adopter to obtain from the source system rather than generate. Forgetting
+    // it is the ordinary way a project reaches this state.
+    freeze(&project);
+    let output = doctor(&project, &[]);
+    unfreeze(&project);
+
+    let stdout = stdout_of(&output);
+    assert!(
+        !output.status.success(),
+        "doctor passed a project missing a secret the bundle references:\n{stdout}"
+    );
+    assert!(
+        stdout.contains("secrets/source-bearer-token"),
+        "doctor did not name the missing secret:\n{stdout}"
+    );
+}
+
+#[test]
+fn doctor_json_puts_one_document_on_stdout_and_the_report_on_stderr() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let project = workspace.path().join("project");
+    provision(&project);
+    provision_bearer_token(&project);
+
+    freeze(&project);
+    let output = doctor(&project, &["--json"]);
+    unfreeze(&project);
+
+    assert!(
+        output.status.success(),
+        "doctor --json failed on a correctly provisioned project:\n{}",
+        stderr_of(&output)
+    );
+    let stdout = stdout_of(&output);
+    let lines: Vec<&str> = stdout.lines().filter(|line| !line.is_empty()).collect();
+    assert_eq!(
+        lines.len(),
+        1,
+        "stdout must carry exactly one JSON document: {stdout}"
+    );
+    let report: serde_json::Value = serde_json::from_str(lines[0]).expect("parse the JSON report");
+    assert_eq!(report["passed"], serde_json::Value::Bool(true));
+    let checks = report["checks"].as_array().expect("checks array");
+    assert!(
+        checks.iter().all(|check| check["passed"] == true),
+        "a check failed in the JSON report: {stdout}"
+    );
+    assert!(
+        stderr_of(&output).contains("0 failed"),
+        "the human report did not reach stderr in JSON mode"
+    );
+}
+
+#[test]
+fn doctor_checks_only_an_explicit_external_mint_config() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let project = workspace.path().join("project");
+    let external_mint = workspace.path().join("mint/mint.yaml");
+    provision(&project);
+    provision_bearer_token(&project);
+    write_mint(&external_mint, MATCHING_MINT_CONFIG);
+
+    // A nested document must not be discovered. The explicit path is the only
+    // act that pairs Evidence with Mint.
+    write_mint(
+        &project.join("mint/mint.yaml"),
+        &MATCHING_MINT_CONFIG.replace("https://identity.invalid", "https://nested.invalid"),
+    );
+
+    freeze(&project);
+    let unpaired = doctor(&project, &[]);
+    let paired = doctor(
+        &project,
+        &[
+            "--mint-config",
+            external_mint.to_str().expect("Mint config path"),
+        ],
+    );
+    unfreeze(&project);
+
+    assert!(
+        unpaired.status.success(),
+        "doctor discovered an unrequested Mint config:\n{}{}",
+        stdout_of(&unpaired),
+        stderr_of(&unpaired)
+    );
+    assert!(
+        !stdout_of(&unpaired).contains("mint compatibility"),
+        "unpaired doctor reported a Mint check: {}",
+        stdout_of(&unpaired)
+    );
+    assert!(
+        paired.status.success(),
+        "doctor rejected matching external Mint config:\n{}{}",
+        stdout_of(&paired),
+        stderr_of(&paired)
+    );
+    assert!(
+        stdout_of(&paired).contains("PASS: mint compatibility"),
+        "paired doctor omitted its compatibility result: {}",
+        stdout_of(&paired)
+    );
+}
+
+#[test]
+fn doctor_rejects_an_issuer_mismatch_without_printing_its_value() {
+    const SENTINEL: &str = "https://credential-token-selector-source.invalid";
+
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let project = workspace.path().join("project");
+    let mint_config = workspace.path().join("mint/mint.yaml");
+    provision(&project);
+    provision_bearer_token(&project);
+    write_mint(
+        &mint_config,
+        &MATCHING_MINT_CONFIG.replace("https://identity.invalid", SENTINEL),
+    );
+
+    freeze(&project);
+    let output = doctor(
+        &project,
+        &[
+            "--mint-config",
+            mint_config.to_str().expect("Mint config path"),
+        ],
+    );
+    unfreeze(&project);
+
+    let diagnostics = format!("{}{}", stdout_of(&output), stderr_of(&output));
+    assert!(
+        !output.status.success(),
+        "doctor accepted an issuer mismatch: {diagnostics}"
+    );
+    assert!(
+        diagnostics.contains("authentication.issuer"),
+        "issuer mismatch did not identify its field: {diagnostics}"
+    );
+    assert!(
+        !diagnostics.contains(SENTINEL),
+        "issuer mismatch disclosed the configured value: {diagnostics}"
+    );
+}
+
+#[test]
+fn doctor_reports_every_mint_field_mismatch_without_printing_values() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let project = workspace.path().join("project");
+    let mint_config = workspace.path().join("mint/mint.yaml");
+    provision(&project);
+    provision_bearer_token(&project);
+
+    let cases = [
+        (
+            "jwksPath: /.well-known/jwks.json",
+            "jwksPath: /credential-token-selector-source-jwks",
+            "authentication.jwksUri",
+            "/credential-token-selector-source-jwks",
+        ),
+        (
+            "audiences: [evidence-scaffold]",
+            "audiences: [credential-token-selector-source-audience]",
+            "authentication.audiences",
+            "credential-token-selector-source-audience",
+        ),
+        (
+            "algorithm: EdDSA",
+            "algorithm: RS256",
+            "authentication.algorithms",
+            "RS256",
+        ),
+        (
+            "principal: sub",
+            "principal: credential_token_selector_source_principal",
+            "authentication.principalClaim",
+            "credential_token_selector_source_principal",
+        ),
+        (
+            "requesterTags: evidence_tags",
+            "requesterTags: credential_token_selector_source_tags",
+            "authentication.requesterTagsClaim",
+            "credential_token_selector_source_tags",
+        ),
+        (
+            "evidenceAudience: evidence_audience",
+            "evidenceAudience: credential_token_selector_source_audience_claim",
+            "authentication.evidenceAudienceClaim",
+            "credential_token_selector_source_audience_claim",
+        ),
+        (
+            "grantId: evidence_grant_id",
+            "grantId: credential_token_selector_source_grant_id",
+            "authentication.grantIdClaim",
+            "credential_token_selector_source_grant_id",
+        ),
+        (
+            "grantAuthority: evidence_authority",
+            "grantAuthority: credential_token_selector_source_authority",
+            "authentication.grantAuthorityClaim",
+            "credential_token_selector_source_authority",
+        ),
+    ];
+
+    for (original, replacement, field, sentinel) in cases {
+        let mismatched = replace_once(MATCHING_MINT_CONFIG, original, replacement);
+        write_mint(&mint_config, &mismatched);
+
+        freeze(&project);
+        let output = doctor(
+            &project,
+            &[
+                "--mint-config",
+                mint_config.to_str().expect("Mint config path"),
+            ],
+        );
+        unfreeze(&project);
+
+        let diagnostics = format!("{}{}", stdout_of(&output), stderr_of(&output));
+        assert!(
+            !output.status.success(),
+            "doctor accepted mismatch in {field}: {diagnostics}"
+        );
+        assert!(
+            diagnostics.contains(field),
+            "mismatch did not identify {field}: {diagnostics}"
+        );
+        assert!(
+            !diagnostics.contains(sentinel),
+            "mismatch in {field} disclosed its configured value: {diagnostics}"
+        );
+    }
+}
+
+#[test]
+fn doctor_requires_evidence_to_admit_the_mint_access_token_type() {
+    const SENTINEL: &str = "credential-token-selector-source-type";
+
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let project = workspace.path().join("project");
+    let mint_config = workspace.path().join("mint/mint.yaml");
+    provision(&project);
+    provision_bearer_token(&project);
+    rewrite_bundle(
+        &project,
+        "tokenTypes: [at+jwt]",
+        &format!("tokenTypes: [{SENTINEL}]"),
+    );
+    write_mint(&mint_config, MATCHING_MINT_CONFIG);
+
+    freeze(&project);
+    let output = doctor(
+        &project,
+        &[
+            "--mint-config",
+            mint_config.to_str().expect("Mint config path"),
+        ],
+    );
+    unfreeze(&project);
+
+    let diagnostics = format!("{}{}", stdout_of(&output), stderr_of(&output));
+    assert!(!output.status.success(), "doctor accepted {diagnostics}");
+    assert!(
+        diagnostics.contains("authentication.tokenTypes"),
+        "token-type mismatch did not identify its field: {diagnostics}"
+    );
+    assert!(
+        !diagnostics.contains(SENTINEL),
+        "token-type mismatch disclosed its configured value: {diagnostics}"
+    );
+}
+
+#[test]
+fn doctor_checks_every_actor_claim_presence_combination() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let mint_config = workspace.path().join("mint/mint.yaml");
+    let cases = [
+        (None, None, true),
+        (Some("shared_actor"), Some("shared_actor"), true),
+        (Some("evidence_actor"), None, false),
+        (None, Some("mint_actor"), false),
+        (Some("evidence_actor"), Some("mint_actor"), false),
+    ];
+
+    for (index, (evidence_actor, mint_actor, expected_pass)) in cases.into_iter().enumerate() {
+        let project = workspace.path().join(format!("project-{index}"));
+        provision(&project);
+        provision_bearer_token(&project);
+        if let Some(actor) = evidence_actor {
+            add_evidence_actor(&project, actor);
+        }
+        let mut mint = MATCHING_MINT_CONFIG.to_owned();
+        if let Some(actor) = mint_actor {
+            mint.push_str(&format!("    actor: {actor}\n"));
+        }
+        write_mint(&mint_config, &mint);
+
+        freeze(&project);
+        let output = doctor(
+            &project,
+            &[
+                "--mint-config",
+                mint_config.to_str().expect("Mint config path"),
+            ],
+        );
+        unfreeze(&project);
+
+        let diagnostics = format!("{}{}", stdout_of(&output), stderr_of(&output));
+        assert_eq!(
+            output.status.success(),
+            expected_pass,
+            "unexpected actor compatibility result: {diagnostics}"
+        );
+        if !expected_pass {
+            assert!(
+                diagnostics.contains("authentication.actorClaim"),
+                "actor mismatch did not identify its field: {diagnostics}"
+            );
+            for value in [evidence_actor, mint_actor].into_iter().flatten() {
+                assert!(
+                    !diagnostics.contains(value),
+                    "actor mismatch disclosed its configured value: {diagnostics}"
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn doctor_accepts_set_order_supersets_custom_jwks_and_matching_actor() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let project = workspace.path().join("project");
+    let mint_config = workspace.path().join("mint/mint.yaml");
+    provision(&project);
+    provision_bearer_token(&project);
+
+    rewrite_bundle(
+        &project,
+        "issuer: https://identity.invalid",
+        "issuer: https://identity.invalid/",
+    );
+    rewrite_bundle(
+        &project,
+        "audiences: [evidence-scaffold]",
+        "audiences: [secondary-audience, evidence-scaffold]",
+    );
+    rewrite_bundle(
+        &project,
+        "tokenTypes: [at+jwt]",
+        "tokenTypes: [application/at+jwt, at+jwt]",
+    );
+    rewrite_bundle(
+        &project,
+        "algorithms: [EdDSA]",
+        "algorithms: [RS256, EdDSA]",
+    );
+    rewrite_bundle(
+        &project,
+        "jwksUri: https://identity.invalid/.well-known/jwks.json",
+        "jwksUri: https://identity.invalid//custom/jwks.json",
+    );
+    add_evidence_actor(&project, "shared_actor");
+
+    let mut mint = MATCHING_MINT_CONFIG
+        .replace(
+            "issuer: https://identity.invalid",
+            "issuer: https://identity.invalid/",
+        )
+        .replace(
+            "jwksPath: /.well-known/jwks.json",
+            "jwksPath: /custom/jwks.json",
+        )
+        .replace(
+            "audiences: [evidence-scaffold]",
+            "audiences: [evidence-scaffold, secondary-audience]",
+        );
+    mint.push_str("    actor: shared_actor\n");
+    write_mint(&mint_config, &mint);
+
+    freeze(&project);
+    let output = doctor(
+        &project,
+        &[
+            "--mint-config",
+            mint_config.to_str().expect("Mint config path"),
+        ],
+    );
+    unfreeze(&project);
+
+    assert!(
+        output.status.success(),
+        "doctor rejected mechanically compatible sets and supersets:\n{}{}",
+        stdout_of(&output),
+        stderr_of(&output)
+    );
+}
+
+#[test]
+fn doctor_applies_mint_protocol_defaults() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let project = workspace.path().join("project");
+    let mint_config = workspace.path().join("mint/mint.yaml");
+    provision(&project);
+    provision_bearer_token(&project);
+    let mint = MATCHING_MINT_CONFIG
+        .replace("  jwksPath: /.well-known/jwks.json\n", "")
+        .replace("    principal: sub\n", "");
+    write_mint(&mint_config, &mint);
+
+    freeze(&project);
+    let output = doctor(
+        &project,
+        &[
+            "--mint-config",
+            mint_config.to_str().expect("Mint config path"),
+        ],
+    );
+    unfreeze(&project);
+
+    assert!(
+        output.status.success(),
+        "doctor did not apply Mint's JWKS and principal defaults:\n{}{}",
+        stdout_of(&output),
+        stderr_of(&output)
+    );
+}
+
+#[test]
+fn doctor_json_aggregates_mismatches_and_redacts_every_value() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let project = workspace.path().join("project");
+    let mint_config = workspace.path().join("mint/mint.yaml");
+    provision(&project);
+    provision_bearer_token(&project);
+
+    let sentinels = [
+        "credential-token-selector-source-audience",
+        "RS256",
+        "credential_token_selector_source_principal",
+    ];
+    let mint = MATCHING_MINT_CONFIG
+        .replace(
+            "audiences: [evidence-scaffold]",
+            &format!("audiences: [{}]", sentinels[0]),
+        )
+        .replace("algorithm: EdDSA", &format!("algorithm: {}", sentinels[1]))
+        .replace("principal: sub", &format!("principal: {}", sentinels[2]));
+    write_mint(&mint_config, &mint);
+
+    freeze(&project);
+    let output = doctor(
+        &project,
+        &[
+            "--mint-config",
+            mint_config.to_str().expect("Mint config path"),
+            "--json",
+        ],
+    );
+    unfreeze(&project);
+
+    assert!(!output.status.success(), "doctor accepted three mismatches");
+    let stdout = stdout_of(&output);
+    let report: serde_json::Value = serde_json::from_str(stdout.trim()).expect("doctor JSON");
+    let check = report["checks"]
+        .as_array()
+        .expect("checks")
+        .iter()
+        .find(|check| check["name"] == "mint compatibility")
+        .expect("Mint compatibility check");
+    assert_eq!(
+        check["findings"].as_array().expect("findings").len(),
+        3,
+        "doctor must report every mechanical mismatch in one run: {stdout}"
+    );
+
+    let diagnostics = format!("{stdout}{}", stderr_of(&output));
+    for field in [
+        "authentication.audiences",
+        "authentication.algorithms",
+        "authentication.principalClaim",
+    ] {
+        assert!(
+            diagnostics.contains(field),
+            "aggregate diagnostics omitted {field}: {diagnostics}"
+        );
+    }
+    for sentinel in sentinels {
+        assert!(
+            !diagnostics.contains(sentinel),
+            "JSON or human diagnostics disclosed {sentinel}: {diagnostics}"
+        );
+    }
+}
+
+#[test]
+fn doctor_redacts_invalid_paired_documents() {
+    const SENTINEL: &str = "credential-token-selector-source-invalid-document";
+
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let project = workspace.path().join("project");
+    let mint_config = workspace.path().join("mint/mint.yaml");
+    provision(&project);
+    provision_bearer_token(&project);
+    write_mint(&mint_config, &format!("issuer: {SENTINEL}\nsigning: [\n"));
+
+    freeze(&project);
+    let invalid_mint = doctor(
+        &project,
+        &[
+            "--mint-config",
+            mint_config.to_str().expect("Mint config path"),
+        ],
+    );
+    unfreeze(&project);
+    let mint_diagnostics = format!("{}{}", stdout_of(&invalid_mint), stderr_of(&invalid_mint));
+    assert!(!invalid_mint.status.success());
+    assert!(
+        mint_diagnostics.contains("paired Mint compatibility fields are missing or invalid"),
+        "invalid Mint document lacked a stable diagnostic: {mint_diagnostics}"
+    );
+    assert!(
+        !mint_diagnostics.contains(SENTINEL),
+        "Mint decoder error disclosed an authored value: {mint_diagnostics}"
+    );
+
+    write_mint(&mint_config, MATCHING_MINT_CONFIG);
+    rewrite_bundle(
+        &project,
+        "issuer: https://identity.invalid",
+        &format!("issuer: [{SENTINEL}]"),
+    );
+    freeze(&project);
+    let invalid_evidence = doctor(
+        &project,
+        &[
+            "--mint-config",
+            mint_config.to_str().expect("Mint config path"),
+        ],
+    );
+    unfreeze(&project);
+    let evidence_diagnostics = format!(
+        "{}{}",
+        stdout_of(&invalid_evidence),
+        stderr_of(&invalid_evidence)
+    );
+    assert!(!invalid_evidence.status.success());
+    assert!(
+        evidence_diagnostics
+            .contains("authentication paired-Mint compatibility fields are missing or invalid"),
+        "invalid Evidence binding lacked a stable diagnostic: {evidence_diagnostics}"
+    );
+    assert!(
+        !evidence_diagnostics.contains(SENTINEL),
+        "Evidence decoder error disclosed an authored value: {evidence_diagnostics}"
+    );
+}
+
+#[test]
+fn doctor_pairing_is_read_only_and_does_not_inspect_mint_authority_material() {
+    const SENTINEL: &str = "credential-token-selector-source-authority-material";
+
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let project = workspace.path().join("project");
+    let mint_root = workspace.path().join("mint");
+    let mint_config = mint_root.join("mint.yaml");
+    provision(&project);
+    provision_bearer_token(&project);
+    let mut mint = MATCHING_MINT_CONFIG.replace(
+        "  jwksPath: /.well-known/jwks.json",
+        &format!("  activeKeyFile: secrets/{SENTINEL}\n  jwksPath: /.well-known/jwks.json"),
+    );
+    mint.push_str("clients:\n  directory: clients\n");
+    write_mint(&mint_config, &mint);
+    fs::create_dir_all(mint_root.join("secrets")).expect("Mint secrets");
+    fs::create_dir_all(mint_root.join("clients")).expect("Mint clients");
+    fs::write(mint_root.join("secrets").join(SENTINEL), SENTINEL).expect("private key sentinel");
+    fs::write(mint_root.join("clients/client.yaml"), SENTINEL).expect("client sentinel");
+
+    freeze(&project);
+    let before = tree_snapshot(workspace.path());
+    let output = doctor(
+        &project,
+        &[
+            "--mint-config",
+            mint_config.to_str().expect("Mint config path"),
+        ],
+    );
+    let after = tree_snapshot(workspace.path());
+    unfreeze(&project);
+
+    assert!(
+        output.status.success(),
+        "doctor inspected unrelated Mint authority material:\n{}{}",
+        stdout_of(&output),
+        stderr_of(&output)
+    );
+    assert!(
+        before == after,
+        "doctor changed a deployment artifact; snapshot contents are withheld"
+    );
+    let diagnostics = format!("{}{}", stdout_of(&output), stderr_of(&output));
+    assert!(
+        !diagnostics.contains(SENTINEL),
+        "doctor disclosed Mint authority material: {diagnostics}"
+    );
+}
+
+#[test]
+fn doctor_help_exposes_the_explicit_mint_config_option() {
+    let output = evidencectl(&["doctor", "--help"]);
+    assert!(output.status.success(), "doctor --help failed");
+    assert!(
+        stdout_of(&output).contains("--mint-config <PATH>"),
+        "doctor help omitted --mint-config: {}",
+        stdout_of(&output)
+    );
+}
+
+/// Assemble the smallest filesystem fixture that names every kind of artifact
+/// doctor checks, then generate the private material through the public CLI.
+fn provision(project: &Path) {
+    fs::create_dir_all(project.join("bundle")).expect("bundle directory");
+    fs::create_dir_all(project.join("audit")).expect("audit directory");
+    fs::write(
+        project.join("runtime.yaml"),
+        "bundleDirectory: bundle\nsecretProviders:\n  file:\n    root: secrets\nauditStorage:\n  path: audit/evidence.jsonl\n",
+    )
+    .expect("runtime fixture");
+    fs::write(
+        project.join("bundle/evidence.yaml"),
+        r#"authentication:
+  kind: oidc-access-token
+  issuer: https://identity.invalid
+  audiences: [evidence-scaffold]
+  tokenTypes: [at+jwt]
+  algorithms: [EdDSA]
+  jwksUri: https://identity.invalid/.well-known/jwks.json
+  principalClaim: sub
+  requesterTagsClaim: evidence_tags
+  evidenceAudienceClaim: evidence_audience
+  grantIdClaim: evidence_grant_id
+  grantAuthorityClaim: evidence_authority
+signing: secret:file/signing-ed25519-private-jwk
+audit: secret:file/audit-hmac-key
+subjectBinding: secret:file/subject-binding-hmac-key
+sourceToken: secret:file/source-bearer-token
+"#,
+    )
+    .expect("bundle fixture");
+
+    let secrets = project.join("secrets");
+    run_ok(&[
+        "keygen",
+        "signing",
+        "--out-dir",
+        secrets.to_str().expect("secret root"),
+        "--kid",
+        SIGNING_KID,
+    ]);
+    for name in SECRET_FILES {
+        let out = secrets.join(name);
+        run_ok(&["keygen", "secret", "--out", out.to_str().expect("secret")]);
+    }
+}
+
+fn write_mint(path: &Path, document: &str) {
+    fs::create_dir_all(path.parent().expect("Mint parent")).expect("Mint directory");
+    fs::write(path, document).expect("Mint configuration");
+}
+
+fn rewrite_bundle(project: &Path, original: &str, replacement: &str) {
+    let path = project.join("bundle/evidence.yaml");
+    let document = fs::read_to_string(&path).expect("Evidence configuration");
+    fs::write(&path, replace_once(&document, original, replacement))
+        .expect("rewrite Evidence configuration");
+}
+
+fn add_evidence_actor(project: &Path, actor: &str) {
+    rewrite_bundle(
+        project,
+        "  grantAuthorityClaim: evidence_authority",
+        &format!("  grantAuthorityClaim: evidence_authority\n  actorClaim: {actor}"),
+    );
+}
+
+fn replace_once(document: &str, original: &str, replacement: &str) -> String {
+    assert_eq!(
+        document.matches(original).count(),
+        1,
+        "fixture must contain exactly one {original:?}"
+    );
+    document.replacen(original, replacement, 1)
+}
+
+fn tree_snapshot(root: &Path) -> Vec<(String, u32, Vec<u8>)> {
+    let mut snapshot = Vec::new();
+    collect_tree_snapshot(root, root, &mut snapshot);
+    snapshot
+}
+
+fn collect_tree_snapshot(root: &Path, path: &Path, snapshot: &mut Vec<(String, u32, Vec<u8>)>) {
+    let metadata = fs::symlink_metadata(path).expect("snapshot metadata");
+    let relative = path
+        .strip_prefix(root)
+        .expect("snapshot root")
+        .display()
+        .to_string();
+    let mode = metadata.permissions().mode() & 0o7777;
+    if metadata.is_dir() {
+        snapshot.push((relative, mode, Vec::new()));
+        let mut entries: Vec<_> = fs::read_dir(path)
+            .expect("snapshot directory")
+            .map(|entry| entry.expect("snapshot entry").path())
+            .collect();
+        entries.sort();
+        for entry in entries {
+            collect_tree_snapshot(root, &entry, snapshot);
+        }
+    } else {
+        snapshot.push((relative, mode, fs::read(path).expect("snapshot file")));
+    }
+}
+
+/// The one secret the scaffolded source needs and `provision` leaves out, so a
+/// test can choose whether the project is complete.
+fn provision_bearer_token(project: &Path) {
+    let out = project.join("secrets/source-bearer-token");
+    run_ok(&["keygen", "token", "--out", out.to_str().expect("token")]);
+}
+
+fn doctor(project: &Path, extra: &[&str]) -> Output {
+    let mut arguments = vec![
+        "doctor",
+        "--project",
+        project.to_str().expect("project path"),
+    ];
+    arguments.extend_from_slice(extra);
+    evidencectl(&arguments)
+}
+
+fn run_ok(arguments: &[&str]) {
+    let output = evidencectl(arguments);
+    assert!(
+        output.status.success(),
+        "evidencectl {} failed: {}",
+        arguments[0],
+        stderr_of(&output)
+    );
+}
+
+fn evidencectl(arguments: &[&str]) -> Output {
+    Command::new(env!("CARGO_BIN_EXE_evidencectl"))
+        .args(arguments)
+        .output()
+        .expect("running evidencectl")
+}
+
+fn stdout_of(output: &Output) -> String {
+    String::from_utf8(output.stdout.clone()).expect("utf8 stdout")
+}
+
+fn stderr_of(output: &Output) -> String {
+    String::from_utf8(output.stderr.clone()).expect("utf8 stderr")
+}
+
+fn mode_of(path: &Path) -> u32 {
+    fs::symlink_metadata(path)
+        .expect("artifact metadata")
+        .permissions()
+        .mode()
+        & 0o7777
+}
+
+fn set_mode(path: &Path, mode: u32) {
+    fs::set_permissions(path, fs::Permissions::from_mode(mode)).expect("setting a mode");
+}
+
+/// The documented freeze: no write bits anywhere in the bundle, and a read-only
+/// runtime file. Evidence refuses a deployment input it could write.
+fn freeze(project: &Path) {
+    set_tree_mode(&project.join("bundle"), 0o555, 0o444);
+    set_mode(&project.join("runtime.yaml"), 0o444);
+}
+
+/// Restore write permissions so the temporary directory can be removed.
+fn unfreeze(project: &Path) {
+    set_tree_mode(&project.join("bundle"), 0o755, 0o644);
+    set_mode(&project.join("runtime.yaml"), 0o644);
+    set_mode(&project.join("secrets"), 0o700);
+}
+
+fn set_tree_mode(path: &Path, directory_mode: u32, file_mode: u32) {
+    let metadata = fs::symlink_metadata(path).expect("tree entry");
+    if metadata.is_dir() {
+        set_mode(path, 0o755);
+        for entry in fs::read_dir(path).expect("reading a directory") {
+            set_tree_mode(
+                &entry.expect("tree entry").path(),
+                directory_mode,
+                file_mode,
+            );
+        }
+        set_mode(path, directory_mode);
+    } else {
+        set_mode(path, file_mode);
+    }
+}
diff --git a/crates/registry-evidencectl/tests/fixtures.rs b/crates/registry-evidencectl/tests/fixtures.rs
new file mode 100644
index 000000000..9f57d784b
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures.rs
@@ -0,0 +1,542 @@
+#![cfg(unix)]
+
+use std::{
+    fs,
+    os::unix::fs::PermissionsExt as _,
+    path::{Path, PathBuf},
+    process::{Command, Output},
+};
+
+fn evidencectl() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_evidencectl"))
+}
+
+fn stdout_of(output: &Output) -> String {
+    String::from_utf8(output.stdout.clone()).expect("utf8 stdout")
+}
+
+fn stderr_of(output: &Output) -> String {
+    String::from_utf8(output.stderr.clone()).expect("utf8 stderr")
+}
+
+/// Build a minimal deployment project: `runtime.yaml` at the root and a
+/// `bundle/evidence.yaml` whose requirements reference the given
+/// bundle-relative fixture paths. The driver only ever parses this file to
+/// enumerate fixtures, so its other fields are placeholders.
+fn write_project(root: &Path, fixture_paths: &[&str]) -> PathBuf {
+    let project = root.join("project");
+    fs::create_dir_all(project.join("bundle")).expect("create bundle dir");
+    fs::write(project.join("runtime.yaml"), b"placeholder: true\n").expect("write runtime.yaml");
+
+    let mut requirements = String::new();
+    for (index, fixture_path) in fixture_paths.iter().enumerate() {
+        requirements.push_str(&format!(
+            "  - id: urn:example:fixture:requirement:{index}\n    fixtures: {fixture_path}\n"
+        ));
+    }
+    let evidence_yaml = format!("version: 1\nrequirements:\n{requirements}");
+    fs::write(project.join("bundle").join("evidence.yaml"), evidence_yaml)
+        .expect("write bundle evidence.yaml");
+    project
+}
+
+/// Write a stub `evidence` binary that:
+/// - appends its argv (one argument per line, `===` between invocations) to
+///   the file named by `$ARGV_LOG`;
+/// - exits 1 with a fixed diagnostic on stderr when its step name equals
+///   `$FAIL_STEP` (`check`, or `evaluate:<fixture path>`), and exits 0
+///   otherwise;
+/// - prints the real `evidence evaluate` summary line, with `$CASES` cases,
+///   when `$CASES` is set and the step is an evaluation.
+fn write_stub_evidence(dir: &Path) -> PathBuf {
+    let path = dir.join("evidence");
+    let script = r#"#!/bin/sh
+set -eu
+
+for arg in "$@"; do
+  printf '%s\n' "$arg" >> "$ARGV_LOG"
+done
+printf '===\n' >> "$ARGV_LOG"
+
+fixture=""
+prev=""
+for arg in "$@"; do
+  if [ "$prev" = "--fixture" ]; then
+    fixture="$arg"
+  fi
+  prev="$arg"
+done
+
+step="check"
+for arg in "$@"; do
+  case "$arg" in
+    evaluate) step="evaluate" ;;
+  esac
+done
+if [ -n "$fixture" ]; then
+  step="evaluate:$fixture"
+fi
+
+if [ "$step" = "${FAIL_STEP:-}" ]; then
+  printf 'stub failure for %s\n' "$step" >&2
+  exit 1
+fi
+
+printf 'stub ok for %s\n' "$step"
+if [ -n "$fixture" ] && [ -n "${CASES:-}" ]; then
+  printf 'Evidence fixture passed (%s evaluated cases)\n' "$CASES"
+fi
+exit 0
+"#;
+    fs::write(&path, script).expect("write stub evidence script");
+    let mut permissions = fs::metadata(&path).expect("stat stub").permissions();
+    permissions.set_mode(0o755);
+    fs::set_permissions(&path, permissions).expect("chmod stub");
+    path
+}
+
+/// Parse the argv log into one `Vec<String>` per invocation, in call order.
+fn read_argv_log(path: &Path) -> Vec<Vec<String>> {
+    let contents = fs::read_to_string(path).unwrap_or_default();
+    contents
+        .split("===\n")
+        .filter(|block| !block.is_empty())
+        .map(|block| block.lines().map(str::to_owned).collect())
+        .collect()
+}
+
+#[test]
+fn happy_path_runs_check_then_each_fixture_and_reports_pass() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let project = write_project(dir.path(), &["fixtures/a.yaml", "fixtures/b.yaml"]);
+    let stub = write_stub_evidence(dir.path());
+    let argv_log = dir.path().join("argv.log");
+
+    let output = evidencectl()
+        .args(["fixtures", "run", "--project"])
+        .arg(&project)
+        .arg("--evidence-bin")
+        .arg(&stub)
+        .env("ARGV_LOG", &argv_log)
+        .env_remove("FAIL_STEP")
+        .output()
+        .expect("run evidencectl");
+
+    assert!(output.status.success(), "{}", stderr_of(&output));
+    let stdout = stdout_of(&output);
+    assert!(stdout.contains("PASS: check"), "{stdout}");
+    assert!(stdout.contains("PASS: fixtures/a.yaml"), "{stdout}");
+    assert!(stdout.contains("PASS: fixtures/b.yaml"), "{stdout}");
+    assert!(stdout.contains("3 passed, 0 failed"), "{stdout}");
+
+    let runtime_path = project.join("runtime.yaml");
+    let runtime_path = runtime_path.to_str().expect("runtime path is utf8");
+    let invocations = read_argv_log(&argv_log);
+    assert_eq!(
+        invocations,
+        vec![
+            vec!["--runtime", runtime_path, "check"],
+            vec![
+                "--runtime",
+                runtime_path,
+                "evaluate",
+                "--fixture",
+                "fixtures/a.yaml"
+            ],
+            vec![
+                "--runtime",
+                runtime_path,
+                "evaluate",
+                "--fixture",
+                "fixtures/b.yaml"
+            ],
+        ],
+        "unexpected evidence invocations"
+    );
+}
+
+#[test]
+fn check_failure_short_circuits_before_any_fixture_evaluation() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let project = write_project(dir.path(), &["fixtures/a.yaml", "fixtures/b.yaml"]);
+    let stub = write_stub_evidence(dir.path());
+    let argv_log = dir.path().join("argv.log");
+
+    let output = evidencectl()
+        .args(["fixtures", "run", "--project"])
+        .arg(&project)
+        .arg("--evidence-bin")
+        .arg(&stub)
+        .env("ARGV_LOG", &argv_log)
+        .env("FAIL_STEP", "check")
+        .output()
+        .expect("run evidencectl");
+
+    assert!(
+        !output.status.success(),
+        "expected nonzero exit on check failure"
+    );
+    let stdout = stdout_of(&output);
+    assert!(stdout.contains("FAIL: check"), "{stdout}");
+    assert!(stdout.contains("stub failure for check"), "{stdout}");
+    assert!(stdout.contains("0 passed, 1 failed"), "{stdout}");
+    assert!(
+        !stdout.contains("fixtures/a.yaml") && !stdout.contains("fixtures/b.yaml"),
+        "no fixture should have been reported: {stdout}"
+    );
+
+    let invocations = read_argv_log(&argv_log);
+    assert_eq!(
+        invocations.len(),
+        1,
+        "evaluate must never be invoked once check fails: {invocations:?}"
+    );
+}
+
+#[test]
+fn one_failing_fixture_is_reported_with_its_stderr_and_the_rest_still_run() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let project = write_project(dir.path(), &["fixtures/a.yaml", "fixtures/b.yaml"]);
+    let stub = write_stub_evidence(dir.path());
+    let argv_log = dir.path().join("argv.log");
+
+    let output = evidencectl()
+        .args(["fixtures", "run", "--project"])
+        .arg(&project)
+        .arg("--evidence-bin")
+        .arg(&stub)
+        .env("ARGV_LOG", &argv_log)
+        .env("FAIL_STEP", "evaluate:fixtures/b.yaml")
+        .output()
+        .expect("run evidencectl");
+
+    assert!(
+        !output.status.success(),
+        "expected nonzero exit on fixture failure"
+    );
+    let stdout = stdout_of(&output);
+    assert!(stdout.contains("PASS: check"), "{stdout}");
+    assert!(stdout.contains("PASS: fixtures/a.yaml"), "{stdout}");
+    assert!(stdout.contains("FAIL: fixtures/b.yaml"), "{stdout}");
+    assert!(
+        stdout.contains("stub failure for evaluate:fixtures/b.yaml"),
+        "failing step's stderr must be included: {stdout}"
+    );
+    assert!(stdout.contains("2 passed, 1 failed"), "{stdout}");
+
+    let invocations = read_argv_log(&argv_log);
+    assert_eq!(
+        invocations.len(),
+        3,
+        "every fixture must still run despite one failure: {invocations:?}"
+    );
+}
+
+#[test]
+fn json_output_is_one_parseable_document_on_stdout_with_expected_pass_fail_values() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let project = write_project(dir.path(), &["fixtures/a.yaml", "fixtures/b.yaml"]);
+    let stub = write_stub_evidence(dir.path());
+    let argv_log = dir.path().join("argv.log");
+
+    let output = evidencectl()
+        .args(["fixtures", "run", "--project"])
+        .arg(&project)
+        .arg("--evidence-bin")
+        .arg(&stub)
+        .arg("--json")
+        .env("ARGV_LOG", &argv_log)
+        .env("FAIL_STEP", "evaluate:fixtures/b.yaml")
+        .output()
+        .expect("run evidencectl");
+
+    assert!(!output.status.success());
+    let stdout = stdout_of(&output);
+    let stdout_lines: Vec<&str> = stdout.lines().filter(|line| !line.is_empty()).collect();
+    assert_eq!(
+        stdout_lines.len(),
+        1,
+        "stdout must carry exactly one JSON document: {stdout}"
+    );
+
+    let report: serde_json::Value =
+        serde_json::from_str(stdout_lines[0]).expect("parse JSON report");
+    assert_eq!(report["passed"], serde_json::Value::Bool(false));
+    assert_eq!(report["check"]["passed"], serde_json::Value::Bool(true));
+    let fixtures = report["fixtures"].as_array().expect("fixtures array");
+    assert_eq!(fixtures.len(), 2);
+    assert_eq!(fixtures[0]["path"], "fixtures/a.yaml");
+    assert_eq!(fixtures[0]["passed"], serde_json::Value::Bool(true));
+    assert_eq!(fixtures[1]["path"], "fixtures/b.yaml");
+    assert_eq!(fixtures[1]["passed"], serde_json::Value::Bool(false));
+    assert!(fixtures[1]["stderr"]
+        .as_str()
+        .expect("failing fixture carries stderr")
+        .contains("stub failure for evaluate:fixtures/b.yaml"));
+
+    // Human diagnostics belong on stderr in JSON mode, not on stdout.
+    let stderr = stderr_of(&output);
+    assert!(stderr.contains("FAIL: fixtures/b.yaml"), "{stderr}");
+}
+
+/// The step counts measure artifacts, and a reader takes the summary line for
+/// coverage. Two fixture files holding seven cases each is a fourteen-case run,
+/// and reporting it as `3 passed` says nothing about how much was exercised.
+#[test]
+fn the_summary_totals_the_cases_each_fixture_evaluated() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let project = write_project(dir.path(), &["fixtures/a.yaml", "fixtures/b.yaml"]);
+    let stub = write_stub_evidence(dir.path());
+    let argv_log = dir.path().join("argv.log");
+
+    let output = evidencectl()
+        .args(["fixtures", "run", "--project"])
+        .arg(&project)
+        .arg("--evidence-bin")
+        .arg(&stub)
+        .env("ARGV_LOG", &argv_log)
+        .env("CASES", "7")
+        .env_remove("FAIL_STEP")
+        .output()
+        .expect("run evidencectl");
+
+    assert!(output.status.success(), "{}", stderr_of(&output));
+    let stdout = stdout_of(&output);
+    assert!(
+        stdout.contains("PASS: fixtures/a.yaml (7 cases)"),
+        "{stdout}"
+    );
+    assert!(
+        stdout.contains("3 passed, 0 failed (14 cases evaluated)"),
+        "{stdout}"
+    );
+
+    // A failing fixture evaluated nothing this run can count, so the total
+    // reports what actually ran rather than an estimate of what would have.
+    let output = evidencectl()
+        .args(["fixtures", "run", "--project"])
+        .arg(&project)
+        .arg("--evidence-bin")
+        .arg(&stub)
+        .arg("--json")
+        .env("ARGV_LOG", &argv_log)
+        .env("CASES", "7")
+        .env("FAIL_STEP", "evaluate:fixtures/b.yaml")
+        .output()
+        .expect("run evidencectl");
+
+    assert!(!output.status.success());
+    let report: serde_json::Value =
+        serde_json::from_str(stdout_of(&output).trim()).expect("parse JSON report");
+    assert_eq!(report["evaluated_cases"], serde_json::json!(7));
+    let fixtures = report["fixtures"].as_array().expect("fixtures array");
+    assert_eq!(fixtures[0]["evaluated_cases"], serde_json::json!(7));
+    assert!(
+        fixtures[1].get("evaluated_cases").is_none(),
+        "a failed fixture reports no count: {}",
+        fixtures[1]
+    );
+}
+
+/// An `evidence` that reports no count at all leaves the total short rather
+/// than guessed. The driver makes no semantic decision of its own, and a
+/// fabricated case count would be exactly that.
+#[test]
+fn an_unrecognized_summary_line_is_counted_as_nothing() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let project = write_project(dir.path(), &["fixtures/a.yaml"]);
+    let stub = write_stub_evidence(dir.path());
+    let argv_log = dir.path().join("argv.log");
+
+    let output = evidencectl()
+        .args(["fixtures", "run", "--project"])
+        .arg(&project)
+        .arg("--evidence-bin")
+        .arg(&stub)
+        .env("ARGV_LOG", &argv_log)
+        .env_remove("CASES")
+        .env_remove("FAIL_STEP")
+        .output()
+        .expect("run evidencectl");
+
+    assert!(output.status.success(), "{}", stderr_of(&output));
+    let stdout = stdout_of(&output);
+    assert!(
+        stdout.contains("2 passed, 0 failed (0 cases evaluated)"),
+        "{stdout}"
+    );
+    assert!(
+        !stdout.contains("cases)\n") || !stdout.contains("PASS: fixtures/a.yaml ("),
+        "an uncounted fixture must not claim a count: {stdout}"
+    );
+}
+
+#[test]
+fn missing_runtime_yaml_errors_clearly_without_invoking_evidence() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let project = dir.path().join("project");
+    fs::create_dir_all(&project).expect("create project dir");
+    let stub = write_stub_evidence(dir.path());
+    let argv_log = dir.path().join("argv.log");
+
+    let output = evidencectl()
+        .args(["fixtures", "run", "--project"])
+        .arg(&project)
+        .arg("--evidence-bin")
+        .arg(&stub)
+        .env("ARGV_LOG", &argv_log)
+        .output()
+        .expect("run evidencectl");
+
+    assert!(!output.status.success());
+    let stderr = stderr_of(&output);
+    assert!(stderr.contains("runtime.yaml"), "{stderr}");
+    assert!(!argv_log.exists(), "evidence must never be invoked");
+}
+
+#[test]
+fn unresolvable_evidence_binary_errors_clearly() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let project = write_project(dir.path(), &["fixtures/a.yaml"]);
+    let missing_bin = dir.path().join("nowhere").join("evidence");
+
+    let output = evidencectl()
+        .args(["fixtures", "run", "--project"])
+        .arg(&project)
+        .arg("--evidence-bin")
+        .arg(&missing_bin)
+        .output()
+        .expect("run evidencectl");
+
+    assert!(!output.status.success());
+    let stderr = stderr_of(&output);
+    assert!(stderr.contains("evidence binary not found"), "{stderr}");
+    assert!(
+        stderr.contains(missing_bin.to_str().expect("utf8 path")),
+        "{stderr}"
+    );
+}
+
+#[test]
+fn fixtures_are_discovered_at_a_relative_bundle_directory_named_in_runtime_yaml() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let project = dir.path().join("project");
+    fs::create_dir_all(project.join("custom-bundle")).expect("create custom bundle dir");
+    fs::write(
+        project.join("runtime.yaml"),
+        b"placeholder: true\nbundleDirectory: custom-bundle\n",
+    )
+    .expect("write runtime.yaml");
+    fs::write(
+        project.join("custom-bundle").join("evidence.yaml"),
+        "version: 1\nrequirements:\n  - id: urn:example:fixture:requirement:0\n    fixtures: fixtures/a.yaml\n",
+    )
+    .expect("write bundle evidence.yaml");
+
+    let stub = write_stub_evidence(dir.path());
+    let argv_log = dir.path().join("argv.log");
+
+    let output = evidencectl()
+        .args(["fixtures", "run", "--project"])
+        .arg(&project)
+        .arg("--evidence-bin")
+        .arg(&stub)
+        .env("ARGV_LOG", &argv_log)
+        .env_remove("FAIL_STEP")
+        .output()
+        .expect("run evidencectl");
+
+    assert!(output.status.success(), "{}", stderr_of(&output));
+    let stdout = stdout_of(&output);
+    assert!(stdout.contains("PASS: fixtures/a.yaml"), "{stdout}");
+    assert!(stdout.contains("2 passed, 0 failed"), "{stdout}");
+}
+
+#[test]
+fn fixtures_are_discovered_at_an_absolute_bundle_directory_named_in_runtime_yaml() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let project = dir.path().join("project");
+    fs::create_dir_all(&project).expect("create project dir");
+    let bundle_directory = dir.path().join("elsewhere").join("bundle");
+    fs::create_dir_all(&bundle_directory).expect("create bundle dir");
+
+    let runtime_yaml = format!(
+        "placeholder: true\nbundleDirectory: {}\n",
+        bundle_directory.to_str().expect("bundle directory is utf8")
+    );
+    fs::write(project.join("runtime.yaml"), runtime_yaml).expect("write runtime.yaml");
+    fs::write(
+        bundle_directory.join("evidence.yaml"),
+        "version: 1\nrequirements:\n  - id: urn:example:fixture:requirement:0\n    fixtures: fixtures/a.yaml\n",
+    )
+    .expect("write bundle evidence.yaml");
+
+    let stub = write_stub_evidence(dir.path());
+    let argv_log = dir.path().join("argv.log");
+
+    let output = evidencectl()
+        .args(["fixtures", "run", "--project"])
+        .arg(&project)
+        .arg("--evidence-bin")
+        .arg(&stub)
+        .env("ARGV_LOG", &argv_log)
+        .env_remove("FAIL_STEP")
+        .output()
+        .expect("run evidencectl");
+
+    assert!(output.status.success(), "{}", stderr_of(&output));
+    let stdout = stdout_of(&output);
+    assert!(stdout.contains("PASS: fixtures/a.yaml"), "{stdout}");
+    assert!(stdout.contains("2 passed, 0 failed"), "{stdout}");
+}
+
+#[test]
+fn a_non_executable_evidence_on_path_is_skipped_with_a_clear_resolution_error() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let project = write_project(dir.path(), &["fixtures/a.yaml"]);
+
+    let path_dir = dir.path().join("path-entry");
+    fs::create_dir(&path_dir).expect("create path entry dir");
+    let candidate = path_dir.join("evidence");
+    fs::write(&candidate, b"#!/bin/sh\nexit 0\n").expect("write candidate");
+    let mut permissions = fs::metadata(&candidate)
+        .expect("stat candidate")
+        .permissions();
+    permissions.set_mode(0o644);
+    fs::set_permissions(&candidate, permissions).expect("chmod candidate non-executable");
+
+    let output = evidencectl()
+        .args(["fixtures", "run", "--project"])
+        .arg(&project)
+        .env("PATH", &path_dir)
+        .env_remove("EVIDENCE_BIN")
+        .output()
+        .expect("run evidencectl");
+
+    assert!(!output.status.success());
+    let stderr = stderr_of(&output);
+    assert!(
+        stderr.contains("evidence binary not found"),
+        "a non-executable candidate on PATH must be skipped: {stderr}"
+    );
+}
+
+#[test]
+fn evidence_bin_env_var_is_used_when_the_flag_is_omitted() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let project = write_project(dir.path(), &["fixtures/a.yaml"]);
+    let stub = write_stub_evidence(dir.path());
+    let argv_log = dir.path().join("argv.log");
+
+    let output = evidencectl()
+        .args(["fixtures", "run", "--project"])
+        .arg(&project)
+        .env("EVIDENCE_BIN", &stub)
+        .env("ARGV_LOG", &argv_log)
+        .output()
+        .expect("run evidencectl");
+
+    assert!(output.status.success(), "{}", stderr_of(&output));
+    let invocations = read_argv_log(&argv_log);
+    assert_eq!(invocations.len(), 2, "check plus one fixture");
+}
diff --git a/crates/registry-evidencectl/tests/fixtures/openapi/escaping.yaml b/crates/registry-evidencectl/tests/fixtures/openapi/escaping.yaml
new file mode 100644
index 000000000..53db2c96b
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/openapi/escaping.yaml
@@ -0,0 +1,20 @@
+openapi: 3.0.3
+info:
+  title: Escaping
+  version: "1.0.0"
+paths:
+  /records:
+    get:
+      responses:
+        "200":
+          description: ok
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                properties:
+                  "tags/primary":
+                    type: string
+                  "tilde~name":
+                    type: string
diff --git a/crates/registry-evidencectl/tests/fixtures/openapi/external-ref.yaml b/crates/registry-evidencectl/tests/fixtures/openapi/external-ref.yaml
new file mode 100644
index 000000000..9d8844670
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/openapi/external-ref.yaml
@@ -0,0 +1,14 @@
+openapi: 3.0.3
+info:
+  title: External Ref
+  version: "1.0.0"
+paths:
+  /records:
+    get:
+      responses:
+        "200":
+          description: ok
+          content:
+            application/json:
+              schema:
+                $ref: 'external.yaml#/components/schemas/Record'
diff --git a/crates/registry-evidencectl/tests/fixtures/openapi/implicit-types.yaml b/crates/registry-evidencectl/tests/fixtures/openapi/implicit-types.yaml
new file mode 100644
index 000000000..134ad8fe0
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/openapi/implicit-types.yaml
@@ -0,0 +1,49 @@
+openapi: 3.0.3
+info:
+  title: Implicit Types
+  version: "1.0.0"
+paths:
+  # The collection-wrapper shape published by several large registry APIs:
+  # `properties` with no `type: object` beside it.
+  /records:
+    get:
+      responses:
+        "200":
+          description: ok
+          content:
+            application/json:
+              schema:
+                properties:
+                  pager:
+                    properties:
+                      page:
+                        type: integer
+                        minimum: 1
+                        maximum: 1000
+                  records:
+                    items:
+                      properties:
+                        id:
+                          type: string
+                          minLength: 11
+                          maxLength: 11
+                    maxItems: 50
+  # A node carrying neither a type nor a structural keyword stays untyped:
+  # nothing here guesses at a scalar.
+  /opaque:
+    get:
+      responses:
+        "200":
+          description: ok
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                properties:
+                  known:
+                    type: string
+                    minLength: 1
+                    maxLength: 8
+                  anything:
+                    description: no type, no properties, no items
diff --git a/crates/registry-evidencectl/tests/fixtures/openapi/nullable-unions.yaml b/crates/registry-evidencectl/tests/fixtures/openapi/nullable-unions.yaml
new file mode 100644
index 000000000..02618aeb0
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/openapi/nullable-unions.yaml
@@ -0,0 +1,57 @@
+openapi: 3.1.0
+info:
+  title: Nullable Unions
+  version: "1.0.0"
+paths:
+  /records:
+    get:
+      responses:
+        "200":
+          description: ok
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                properties:
+                  # The idiom generated by zod-to-openapi and friends: an
+                  # optional scalar written as a two-member anyOf against
+                  # `null` rather than as the 3.1 type pair.
+                  note:
+                    anyOf:
+                      - type: string
+                        minLength: 1
+                        maxLength: 64
+                      - type: "null"
+                  # The same idiom spelled with `oneOf`, with the null member
+                  # first, and carrying a description on the union node.
+                  count:
+                    description: how many were seen
+                    oneOf:
+                      - type: "null"
+                      - type: integer
+                        minimum: 0
+                        maximum: 99
+                  # A 3.1 type pair written null-first.
+                  reversedPair:
+                    type: ["null", string]
+                    minLength: 1
+                    maxLength: 8
+                  # Nullable containers collapse the same way, so their members
+                  # stay selectable.
+                  parent:
+                    anyOf:
+                      - type: object
+                        additionalProperties: false
+                        properties:
+                          id:
+                            type: string
+                            minLength: 1
+                            maxLength: 36
+                      - type: "null"
+                  # A union of two real types is not a nullable spelling and is
+                  # left alone for the flattener to skip.
+                  either:
+                    anyOf:
+                      - type: string
+                      - type: integer
diff --git a/crates/registry-evidencectl/tests/fixtures/openapi/paging-parameters.yaml b/crates/registry-evidencectl/tests/fixtures/openapi/paging-parameters.yaml
new file mode 100644
index 000000000..d6119fc0d
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/openapi/paging-parameters.yaml
@@ -0,0 +1,90 @@
+openapi: 3.0.3
+info:
+  title: Paging parameter shapes
+  version: "1.0.0"
+paths:
+  # A page index and a page size side by side. The index bounds how many pages
+  # exist, not how many items a response carries, so it must not set an array
+  # bound; the size does.
+  /records:
+    get:
+      summary: Search records
+      parameters:
+        - name: page
+          in: query
+          schema:
+            type: integer
+            maximum: 10000
+        - name: pageSize
+          in: query
+          schema:
+            type: integer
+            maximum: 50
+      responses:
+        "200":
+          description: A page of records
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RecordSearchResponse'
+  # Two genuine size ceilings. The smaller one is the one a response can
+  # actually reach.
+  /events:
+    get:
+      summary: Search events
+      parameters:
+        - name: per_page
+          in: query
+          schema:
+            type: integer
+            maximum: 25
+        - name: limit
+          in: query
+          schema:
+            type: integer
+            maximum: 200
+      responses:
+        "200":
+          description: A page of events
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RecordSearchResponse'
+  # Names that merely contain a matching word without naming a page size.
+  /reports:
+    get:
+      summary: Search reports
+      parameters:
+        - name: pageToken
+          in: query
+          schema:
+            type: string
+        - name: fileSizeCeiling
+          in: query
+          schema:
+            type: integer
+            maximum: 9000
+        - name: rateLimitBurst
+          in: query
+          schema:
+            type: integer
+            maximum: 8000
+      responses:
+        "200":
+          description: A page of reports
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RecordSearchResponse'
+components:
+  schemas:
+    RecordSearchResponse:
+      type: object
+      properties:
+        results:
+          type: array
+          items:
+            type: object
+            properties:
+              id:
+                type: string
diff --git a/crates/registry-evidencectl/tests/fixtures/openapi/records-3.0.yaml b/crates/registry-evidencectl/tests/fixtures/openapi/records-3.0.yaml
new file mode 100644
index 000000000..7685c7870
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/openapi/records-3.0.yaml
@@ -0,0 +1,70 @@
+openapi: 3.0.3
+info:
+  title: Example Records API
+  version: "1.0.0"
+servers:
+  - url: https://records.example.test/api
+paths:
+  /records:
+    get:
+      summary: Search records
+      parameters:
+        - name: pageSize
+          in: query
+          schema:
+            type: integer
+            maximum: 100
+      responses:
+        "200":
+          description: A page of records
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RecordSearchResponse'
+    post:
+      summary: Create a record
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Record'
+    delete:
+      summary: Delete every record
+      responses:
+        "200":
+          description: Deleted
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Record'
+components:
+  schemas:
+    RecordSearchResponse:
+      type: object
+      additionalProperties: false
+      required: [total, results]
+      properties:
+        total:
+          type: integer
+        recordedOn:
+          type: string
+          format: date-time
+          nullable: true
+        results:
+          type: array
+          items:
+            $ref: '#/components/schemas/Record'
+    Record:
+      type: object
+      additionalProperties: false
+      properties:
+        trackingId:
+          type: string
+        status:
+          type: string
+          enum: [open, closed]
+        notes:
+          type: string
+          nullable: true
diff --git a/crates/registry-evidencectl/tests/fixtures/openapi/records-3.1.json b/crates/registry-evidencectl/tests/fixtures/openapi/records-3.1.json
new file mode 100644
index 000000000..8eb16b074
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/openapi/records-3.1.json
@@ -0,0 +1,42 @@
+{
+  "openapi": "3.1.0",
+  "info": { "title": "Example Records API", "version": "1.0.0" },
+  "paths": {
+    "/records/{id}": {
+      "get": {
+        "summary": "Get one record",
+        "parameters": [
+          { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } },
+          { "name": "limit", "in": "query", "schema": { "type": "integer", "maximum": 50 } }
+        ],
+        "responses": {
+          "200": {
+            "description": "One record",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["trackingId", "status"],
+                  "properties": {
+                    "trackingId": { "type": "string" },
+                    "status": { "type": ["string", "null"] },
+                    "total": { "type": ["integer", "null"] }
+                  }
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not found",
+            "content": {
+              "application/json": {
+                "schema": { "type": "object", "additionalProperties": false, "properties": {} }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/crates/registry-evidencectl/tests/fixtures/openapi/recursive-tree.yaml b/crates/registry-evidencectl/tests/fixtures/openapi/recursive-tree.yaml
new file mode 100644
index 000000000..d78fd4bfd
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/openapi/recursive-tree.yaml
@@ -0,0 +1,33 @@
+openapi: 3.1.0
+info:
+  title: Recursive Tree
+  version: "1.0.0"
+paths:
+  /nodes:
+    get:
+      responses:
+        "200":
+          description: ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Node'
+components:
+  schemas:
+    Node:
+      type: object
+      additionalProperties: false
+      properties:
+        id:
+          type: string
+          minLength: 1
+          maxLength: 36
+        label:
+          type: string
+          minLength: 1
+          maxLength: 64
+        children:
+          type: array
+          maxItems: 10
+          items:
+            $ref: '#/components/schemas/Node'
diff --git a/crates/registry-evidencectl/tests/fixtures/openapi/ref-cycle.yaml b/crates/registry-evidencectl/tests/fixtures/openapi/ref-cycle.yaml
new file mode 100644
index 000000000..7c314d754
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/openapi/ref-cycle.yaml
@@ -0,0 +1,28 @@
+openapi: 3.0.3
+info:
+  title: Ref Cycle
+  version: "1.0.0"
+paths:
+  /records:
+    get:
+      responses:
+        "200":
+          description: ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/A'
+components:
+  schemas:
+    A:
+      type: object
+      additionalProperties: false
+      properties:
+        child:
+          $ref: '#/components/schemas/B'
+    B:
+      type: object
+      additionalProperties: false
+      properties:
+        parent:
+          $ref: '#/components/schemas/A'
diff --git a/crates/registry-evidencectl/tests/fixtures/openapi/unsupported-constructs.yaml b/crates/registry-evidencectl/tests/fixtures/openapi/unsupported-constructs.yaml
new file mode 100644
index 000000000..1f66819a2
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/openapi/unsupported-constructs.yaml
@@ -0,0 +1,37 @@
+openapi: 3.0.3
+info:
+  title: Unsupported Constructs
+  version: "1.0.0"
+paths:
+  /records:
+    get:
+      responses:
+        "200":
+          description: ok
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                properties:
+                  trackingId:
+                    type: string
+                  choice:
+                    oneOf:
+                      - type: string
+                      - type: integer
+                  wildcard:
+                    type: object
+                    properties: {}
+                    additionalProperties:
+                      type: string
+                  simpleAllOf:
+                    allOf:
+                      - type: string
+                        format: date
+                  missingItems:
+                    type: array
+                  freeform:
+                    type: object
+                  multiType:
+                    type: [string, integer]
diff --git a/crates/registry-evidencectl/tests/fixtures/openapi/unsupported-version.yaml b/crates/registry-evidencectl/tests/fixtures/openapi/unsupported-version.yaml
new file mode 100644
index 000000000..daac38ccb
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/openapi/unsupported-version.yaml
@@ -0,0 +1,10 @@
+openapi: "2.0"
+info:
+  title: Swagger, Not OpenAPI 3
+  version: "1.0.0"
+paths:
+  /records:
+    get:
+      responses:
+        "200":
+          description: ok
diff --git a/crates/registry-evidencectl/tests/fixtures/samples/canary.json b/crates/registry-evidencectl/tests/fixtures/samples/canary.json
new file mode 100644
index 000000000..98fc13833
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/samples/canary.json
@@ -0,0 +1,3 @@
+{
+  "status": "CANARY-DO-NOT-LEAK-9f31"
+}
diff --git a/crates/registry-evidencectl/tests/fixtures/samples/escaping.json b/crates/registry-evidencectl/tests/fixtures/samples/escaping.json
new file mode 100644
index 000000000..fb1bee406
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/samples/escaping.json
@@ -0,0 +1,4 @@
+{
+  "a/b": "slash-key",
+  "a~b": "tilde-key"
+}
diff --git a/crates/registry-evidencectl/tests/fixtures/samples/integer-range.json b/crates/registry-evidencectl/tests/fixtures/samples/integer-range.json
new file mode 100644
index 000000000..e21018e69
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/samples/integer-range.json
@@ -0,0 +1,7 @@
+{
+  "records": [
+    { "priority": 3 },
+    { "priority": -7 },
+    { "priority": 12 }
+  ]
+}
diff --git a/crates/registry-evidencectl/tests/fixtures/samples/nested-records.json b/crates/registry-evidencectl/tests/fixtures/samples/nested-records.json
new file mode 100644
index 000000000..7d51b22d2
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/samples/nested-records.json
@@ -0,0 +1,15 @@
+{
+  "total": 42,
+  "results": [
+    {
+      "trackingId": "abc-123",
+      "status": "open",
+      "tags": ["a", "b", "c"]
+    },
+    {
+      "trackingId": "def-456-longer",
+      "status": "closed",
+      "tags": ["x"]
+    }
+  ]
+}
diff --git a/crates/registry-evidencectl/tests/fixtures/samples/nulls-and-absent.json b/crates/registry-evidencectl/tests/fixtures/samples/nulls-and-absent.json
new file mode 100644
index 000000000..20fcd3862
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/samples/nulls-and-absent.json
@@ -0,0 +1,4 @@
+{
+  "recordedOn": null,
+  "status": "active"
+}
diff --git a/crates/registry-evidencectl/tests/fixtures/samples/unicode.json b/crates/registry-evidencectl/tests/fixtures/samples/unicode.json
new file mode 100644
index 000000000..ea6ac7dc6
--- /dev/null
+++ b/crates/registry-evidencectl/tests/fixtures/samples/unicode.json
@@ -0,0 +1,4 @@
+{
+  "status": "héllo",
+  "note": "日本語"
+}
diff --git a/crates/registry-evidencectl/tests/install_script.rs b/crates/registry-evidencectl/tests/install_script.rs
new file mode 100644
index 000000000..b2eabd827
--- /dev/null
+++ b/crates/registry-evidencectl/tests/install_script.rs
@@ -0,0 +1,603 @@
+// SPDX-License-Identifier: Apache-2.0
+
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+
+#[cfg(unix)]
+use std::os::unix::fs::PermissionsExt;
+#[cfg(unix)]
+use tempfile::TempDir;
+
+const TEST_VERSION: &str = "v9.8.7";
+const BINARIES: [&str; 3] = ["evidence", "evidencectl", "mint"];
+
+#[cfg(unix)]
+#[test]
+fn installer_refuses_to_run_without_a_pinned_release() {
+    let fixture = InstallerFixture::new();
+    let output = fixture.command_without_version().output().unwrap();
+    assert!(!output.status.success());
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(stderr.contains("EVIDENCECTL_VERSION"), "stderr: {stderr}");
+    assert!(
+        !fixture.fake_curl_log().exists(),
+        "must fail before download"
+    );
+}
+
+#[cfg(unix)]
+#[test]
+fn installer_rejects_noncanonical_release_tags() {
+    for tag in ["9.8.7", "v9.8", "latest", "v09.8.7", "v9.8.7-rc1"] {
+        let fixture = InstallerFixture::for_release(tag);
+        let output = fixture.run();
+        assert!(!output.status.success(), "tag {tag} must be refused");
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        assert!(
+            stderr.contains("non-canonical"),
+            "tag {tag} stderr: {stderr}"
+        );
+        assert!(
+            !fixture.fake_curl_log().exists(),
+            "must fail before download"
+        );
+    }
+}
+
+#[cfg(unix)]
+#[test]
+fn installer_help_describes_the_toolset_and_verification_contract() {
+    let fixture = InstallerFixture::new();
+    let mut command = fixture.command_without_version();
+    command.arg("--help");
+    let output = command.output().unwrap();
+    assert!(output.status.success());
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    for expected in [
+        "evidence runtime",
+        "evidencectl adopter",
+        "mint token issuer",
+        "curl -fsSL https://github.com/registrystack/registry-stack/releases/latest/download/evidencectl-install.sh | bash",
+        "SHA256SUMS",
+        "EVIDENCECTL_ASSET_DIR",
+        "release/VERIFY.md",
+    ] {
+        assert!(stdout.contains(expected), "help must mention {expected}");
+    }
+}
+
+#[cfg(unix)]
+#[test]
+fn versioned_installer_asset_selects_its_own_release_without_an_override() {
+    let fixture = InstallerFixture::new();
+    let versioned = fixture
+        .temp_path()
+        .join(format!("evidencectl-{TEST_VERSION}-install.sh"));
+    fs::copy(installer_path(), &versioned).unwrap();
+    let output = fixture.command_for(&versioned, false).output().unwrap();
+    assert!(
+        output.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    fixture.assert_toolset_installed();
+}
+
+#[cfg(unix)]
+#[test]
+fn released_installer_supports_the_conventional_curl_pipe() {
+    let fixture = InstallerFixture::new();
+    let rendered = fixture.rendered_installer();
+    let output = fixture.command_from_stdin(&rendered).output().unwrap();
+    assert!(
+        output.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    fixture.assert_toolset_installed();
+}
+
+#[cfg(unix)]
+#[test]
+fn released_installer_rejects_a_mismatched_release_override_from_stdin() {
+    let fixture = InstallerFixture::new();
+    let rendered = fixture.rendered_installer();
+    let mut command = fixture.command_from_stdin(&rendered);
+    command.env("EVIDENCECTL_VERSION", "v1.2.3");
+    let output = command.output().unwrap();
+    assert!(!output.status.success());
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        stderr.contains("Refusing a release override"),
+        "stderr: {stderr}"
+    );
+    assert!(
+        !fixture.fake_curl_log().exists(),
+        "must fail before download"
+    );
+}
+
+#[cfg(unix)]
+#[test]
+fn released_installer_rejects_a_filename_that_names_another_release() {
+    let fixture = InstallerFixture::new();
+    let rendered = fixture.rendered_installer();
+    let mismatched = fixture.temp_path().join("evidencectl-v1.2.3-install.sh");
+    fs::rename(rendered, &mismatched).unwrap();
+    let output = fixture.command_for(&mismatched, false).output().unwrap();
+    assert!(!output.status.success());
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        stderr.contains("embedded release does not match its filename"),
+        "stderr: {stderr}"
+    );
+    assert!(
+        !fixture.fake_curl_log().exists(),
+        "must fail before download"
+    );
+}
+
+#[cfg(unix)]
+#[test]
+fn versioned_installer_asset_rejects_a_mismatched_release_override() {
+    let fixture = InstallerFixture::new();
+    let versioned = fixture
+        .temp_path()
+        .join(format!("evidencectl-{TEST_VERSION}-install.sh"));
+    fs::copy(installer_path(), &versioned).unwrap();
+    let mut command = fixture.command_for(&versioned, false);
+    command.env("EVIDENCECTL_VERSION", "v1.2.3");
+    let output = command.output().unwrap();
+    assert!(!output.status.success());
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        stderr.contains("Refusing a release override"),
+        "stderr: {stderr}"
+    );
+    assert!(
+        !fixture.fake_curl_log().exists(),
+        "must fail before download"
+    );
+}
+
+#[cfg(unix)]
+#[test]
+fn installer_checksum_verifies_and_installs_all_three_binaries() {
+    let fixture = InstallerFixture::new();
+    let output = fixture.run();
+    assert!(
+        output.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    fixture.assert_toolset_installed();
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert!(
+        stdout.contains("Integrity checks passed"),
+        "stdout: {stdout}"
+    );
+    assert!(
+        stdout.contains("Authenticity check not performed"),
+        "stdout: {stdout}"
+    );
+}
+
+#[cfg(unix)]
+#[test]
+fn verified_local_asset_mode_installs_without_network_downloads() {
+    let fixture = InstallerFixture::new();
+    let mut command = fixture.command();
+    command.env("EVIDENCECTL_ASSET_DIR", fixture.release_dir());
+    let output = command.output().unwrap();
+    assert!(
+        output.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    fixture.assert_toolset_installed();
+    assert!(
+        !fixture.fake_curl_log().exists(),
+        "asset-dir mode must not download"
+    );
+}
+
+#[cfg(unix)]
+#[test]
+fn unsupported_platform_fails_before_download_without_a_partial_install() {
+    let fixture = InstallerFixture::new();
+    let mut command = fixture.command();
+    command.env("FAKE_UNAME_S", "SunOS");
+    let output = command.output().unwrap();
+    assert!(!output.status.success());
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        stderr.contains("No prebuilt Evidence toolset asset"),
+        "stderr: {stderr}"
+    );
+    assert!(
+        !fixture.fake_curl_log().exists(),
+        "must fail before download"
+    );
+    assert!(!fixture.install_dir().exists(), "nothing may be installed");
+}
+
+#[cfg(unix)]
+#[test]
+fn missing_checksum_entry_refuses_the_whole_install() {
+    let fixture = InstallerFixture::new();
+    fixture.rewrite_sums_without("evidencectl");
+    let output = fixture.run();
+    assert!(!output.status.success());
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        stderr.contains("SHA256SUMS has no entry"),
+        "stderr: {stderr}"
+    );
+    fixture.assert_nothing_installed();
+}
+
+#[cfg(unix)]
+#[test]
+fn checksum_failure_preserves_the_existing_toolset() {
+    let fixture = InstallerFixture::new();
+    fixture.preinstall_previous_toolset();
+    fixture.corrupt_release_asset("mint");
+    let output = fixture.run();
+    assert!(!output.status.success());
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        stderr.contains("Checksum verification failed"),
+        "stderr: {stderr}"
+    );
+    fixture.assert_previous_toolset_intact();
+}
+
+#[cfg(unix)]
+#[test]
+fn partial_replacement_rolls_back_the_previous_toolset() {
+    let fixture = InstallerFixture::new();
+    fixture.preinstall_previous_toolset();
+    let output = fixture.run_with_second_mv_failure();
+    assert!(!output.status.success());
+    fixture.assert_previous_toolset_intact();
+}
+
+// macOS ships bash 3.2, so `/usr/bin/env bash` finds a shell without
+// associative arrays, `mapfile`, or case conversion on any Mac that has no
+// newer bash installed. The installer advertises macOS arm64, and the runners
+// that execute this suite carry bash 5, so the portable-construct guard has to
+// be a property of the source text rather than of the interpreter under test.
+#[cfg(unix)]
+#[test]
+fn installer_avoids_shell_constructs_stock_macos_bash_cannot_parse() {
+    let source = fs::read_to_string(installer_path()).unwrap();
+    for (construct, describe) in [
+        ("declare -A", "associative arrays"),
+        ("local -A", "associative arrays"),
+        ("mapfile", "mapfile"),
+        ("readarray", "readarray"),
+        ("${!", "indirect or key expansion"),
+        (",,}", "lowercase expansion"),
+        ("^^}", "uppercase expansion"),
+    ] {
+        assert!(
+            !source.contains(construct),
+            "install.sh uses {describe} ('{construct}'), which bash 3.2 cannot parse"
+        );
+    }
+}
+
+#[cfg(unix)]
+#[test]
+fn installer_installs_under_stock_macos_bash() {
+    let Some(bash) = stock_macos_bash() else {
+        // Linux runners have no bash 3.2 to borrow. The construct guard above
+        // is what protects this path there.
+        return;
+    };
+    let fixture = InstallerFixture::new();
+    let output = reinterpret(fixture.command(), &bash).output().unwrap();
+    assert!(
+        output.status.success(),
+        "bash 3.2 install failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    fixture.assert_toolset_installed();
+}
+
+#[cfg(unix)]
+#[test]
+fn stock_macos_bash_rollback_restores_the_previous_toolset() {
+    let Some(bash) = stock_macos_bash() else {
+        return;
+    };
+    let fixture = InstallerFixture::new();
+    fixture.preinstall_previous_toolset();
+    let output = reinterpret(fixture.mv_failure_command(), &bash)
+        .output()
+        .unwrap();
+    assert!(!output.status.success());
+    fixture.assert_previous_toolset_intact();
+}
+
+#[cfg(unix)]
+struct InstallerFixture {
+    _temp: TempDir,
+    fake_bin: PathBuf,
+    release_dir: PathBuf,
+    install_dir: PathBuf,
+    version: String,
+}
+
+#[cfg(unix)]
+impl InstallerFixture {
+    fn new() -> Self {
+        Self::for_release(TEST_VERSION)
+    }
+
+    fn for_release(version: &str) -> Self {
+        let temp = TempDir::new().unwrap();
+        let fake_bin = temp.path().join("fake-bin");
+        let release_dir = temp.path().join("release");
+        let install_dir = temp.path().join("install");
+        fs::create_dir_all(&fake_bin).unwrap();
+        fs::create_dir_all(&release_dir).unwrap();
+        write_executable(
+            &fake_bin.join("curl"),
+            r#"#!/usr/bin/env bash
+set -euo pipefail
+url=""
+dest=""
+while [[ "$#" -gt 0 ]]; do
+  case "$1" in
+    -o) dest="$2"; shift 2 ;;
+    -*) shift ;;
+    *) url="$1"; shift ;;
+  esac
+done
+if [[ -n "${FAKE_CURL_LOG:-}" ]]; then
+  printf '%s\n' "$url" >> "$FAKE_CURL_LOG"
+fi
+cp "${FAKE_RELEASE_DIR}/${url##*/}" "$dest"
+"#,
+        );
+        write_executable(
+            &fake_bin.join("uname"),
+            r#"#!/usr/bin/env bash
+case "${1:-}" in
+  -s) printf '%s\n' "${FAKE_UNAME_S:-Linux}" ;;
+  -m) printf '%s\n' "${FAKE_UNAME_M:-x86_64}" ;;
+  *) exit 1 ;;
+esac
+"#,
+        );
+        let fixture = Self {
+            _temp: temp,
+            fake_bin,
+            release_dir,
+            install_dir,
+            version: version.to_string(),
+        };
+        fixture.write_release_assets();
+        fixture
+    }
+
+    fn write_release_assets(&self) {
+        let mut checksums = Vec::new();
+        for binary in BINARIES {
+            let asset = self.asset_name(binary);
+            let path = self.release_dir.join(&asset);
+            fs::write(&path, format!("{binary} release binary\n")).unwrap();
+            checksums.push(format!("{}  {}\n", sha256(&path), asset));
+        }
+        fs::write(self.release_dir.join("SHA256SUMS"), checksums.concat()).unwrap();
+    }
+
+    fn asset_name(&self, binary: &str) -> String {
+        format!("{binary}-{}-linux-amd64", self.version)
+    }
+
+    fn rewrite_sums_without(&self, excluded: &str) {
+        let mut checksums = Vec::new();
+        for binary in BINARIES {
+            if binary == excluded {
+                continue;
+            }
+            let asset = self.asset_name(binary);
+            let path = self.release_dir.join(&asset);
+            checksums.push(format!("{}  {}\n", sha256(&path), asset));
+        }
+        fs::write(self.release_dir.join("SHA256SUMS"), checksums.concat()).unwrap();
+    }
+
+    fn corrupt_release_asset(&self, binary: &str) {
+        let path = self.release_dir.join(self.asset_name(binary));
+        fs::write(&path, b"tampered bytes\n").unwrap();
+    }
+
+    fn preinstall_previous_toolset(&self) {
+        fs::create_dir_all(&self.install_dir).unwrap();
+        for binary in BINARIES {
+            fs::write(
+                self.install_dir.join(binary),
+                format!("{binary} previous binary\n"),
+            )
+            .unwrap();
+        }
+    }
+
+    fn assert_previous_toolset_intact(&self) {
+        for binary in BINARIES {
+            let contents = fs::read_to_string(self.install_dir.join(binary)).unwrap();
+            assert_eq!(
+                contents,
+                format!("{binary} previous binary\n"),
+                "{binary} must keep its previous contents"
+            );
+        }
+    }
+
+    fn assert_toolset_installed(&self) {
+        for binary in BINARIES {
+            let path = self.install_dir.join(binary);
+            let contents = fs::read_to_string(&path).unwrap();
+            assert_eq!(contents, format!("{binary} release binary\n"));
+            let mode = fs::metadata(&path).unwrap().permissions().mode();
+            assert_eq!(mode & 0o777, 0o755, "{binary} must be executable");
+        }
+    }
+
+    fn assert_nothing_installed(&self) {
+        for binary in BINARIES {
+            assert!(
+                !self.install_dir.join(binary).exists(),
+                "{binary} must not be installed"
+            );
+        }
+    }
+
+    fn run(&self) -> std::process::Output {
+        self.command().output().unwrap()
+    }
+
+    fn run_with_second_mv_failure(&self) -> std::process::Output {
+        self.mv_failure_command().output().unwrap()
+    }
+
+    fn mv_failure_command(&self) -> Command {
+        write_executable(
+            &self.fake_bin.join("mv"),
+            r#"#!/usr/bin/env bash
+set -euo pipefail
+count=0
+if [[ -f "$FAKE_MV_COUNT_FILE" ]]; then
+  read -r count < "$FAKE_MV_COUNT_FILE"
+fi
+count=$((count + 1))
+printf '%s\n' "$count" > "$FAKE_MV_COUNT_FILE"
+if [[ "$count" -eq 2 ]]; then
+  exit 73
+fi
+exec "$REAL_MV" "$@"
+"#,
+        );
+        let mut command = self.command();
+        command
+            .env("FAKE_MV_COUNT_FILE", self._temp.path().join("mv-count"))
+            .env("REAL_MV", "/bin/mv");
+        command
+    }
+
+    fn fake_curl_log(&self) -> PathBuf {
+        self._temp.path().join("curl-log")
+    }
+
+    fn temp_path(&self) -> &Path {
+        self._temp.path()
+    }
+
+    fn rendered_installer(&self) -> PathBuf {
+        let source = fs::read_to_string(installer_path()).unwrap();
+        let marker = "default_version=\"\"";
+        assert_eq!(source.matches(marker).count(), 1);
+        let rendered = source.replacen(marker, &format!("default_version=\"{}\"", self.version), 1);
+        let path = self._temp.path().join("evidencectl-install.sh");
+        fs::write(&path, rendered).unwrap();
+        path
+    }
+
+    fn release_dir(&self) -> &Path {
+        &self.release_dir
+    }
+
+    fn install_dir(&self) -> &Path {
+        &self.install_dir
+    }
+
+    fn command(&self) -> Command {
+        self.command_for(&installer_path(), true)
+    }
+
+    fn command_without_version(&self) -> Command {
+        self.command_for(&installer_path(), false)
+    }
+
+    fn command_for(&self, installer: &Path, set_version: bool) -> Command {
+        let path = format!(
+            "{}:{}",
+            self.fake_bin.display(),
+            std::env::var("PATH").unwrap_or_default()
+        );
+        let mut command = Command::new("bash");
+        command
+            .arg(installer)
+            .env("PATH", path)
+            .env("FAKE_RELEASE_DIR", &self.release_dir)
+            .env("FAKE_CURL_LOG", self.fake_curl_log())
+            .env("EVIDENCECTL_INSTALL_DIR", &self.install_dir);
+        if set_version {
+            command.env("EVIDENCECTL_VERSION", &self.version);
+        }
+        command
+    }
+
+    fn command_from_stdin(&self, installer: &Path) -> Command {
+        let mut command = self.command_for(Path::new("/dev/stdin"), false);
+        command.stdin(Stdio::from(fs::File::open(installer).unwrap()));
+        command
+    }
+}
+
+#[cfg(unix)]
+fn installer_path() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("install.sh")
+}
+
+/// `/bin/bash` when it is the bash 3.2 macOS ships, which is the interpreter a
+/// Mac without Homebrew bash resolves `/usr/bin/env bash` to.
+#[cfg(unix)]
+fn stock_macos_bash() -> Option<PathBuf> {
+    let path = PathBuf::from("/bin/bash");
+    let output = Command::new(&path).arg("--version").output().ok()?;
+    let banner = String::from_utf8_lossy(&output.stdout);
+    banner.contains("version 3.").then_some(path)
+}
+
+/// Rebuild a prepared fixture command against a different shell, keeping its
+/// arguments and environment.
+#[cfg(unix)]
+fn reinterpret(source: Command, shell: &Path) -> Command {
+    let mut command = Command::new(shell);
+    command.args(source.get_args());
+    for (key, value) in source.get_envs() {
+        match value {
+            Some(value) => command.env(key, value),
+            None => command.env_remove(key),
+        };
+    }
+    command
+}
+
+#[cfg(unix)]
+fn write_executable(path: &Path, body: &str) {
+    fs::write(path, body).unwrap();
+    fs::set_permissions(path, fs::Permissions::from_mode(0o755)).unwrap();
+}
+
+#[cfg(unix)]
+fn sha256(path: &Path) -> String {
+    for (program, args) in [("shasum", vec!["-a", "256"]), ("sha256sum", vec![])] {
+        if let Ok(output) = Command::new(program).args(args).arg(path).output() {
+            if output.status.success() {
+                return String::from_utf8(output.stdout)
+                    .unwrap()
+                    .split_whitespace()
+                    .next()
+                    .unwrap()
+                    .to_string();
+            }
+        }
+    }
+    panic!("test needs shasum or sha256sum");
+}
diff --git a/crates/registry-evidencectl/tests/jwks.rs b/crates/registry-evidencectl/tests/jwks.rs
new file mode 100644
index 000000000..0e00da919
--- /dev/null
+++ b/crates/registry-evidencectl/tests/jwks.rs
@@ -0,0 +1,239 @@
+#![cfg(unix)]
+
+use std::{
+    fs,
+    os::unix::fs::PermissionsExt as _,
+    path::Path,
+    process::{Command, Output},
+};
+
+fn evidencectl() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_evidencectl"))
+}
+
+fn mode_of(path: &Path) -> u32 {
+    fs::metadata(path)
+        .unwrap_or_else(|error| panic!("stat {}: {error}", path.display()))
+        .permissions()
+        .mode()
+        & 0o777
+}
+
+fn stderr_of(output: &Output) -> String {
+    String::from_utf8(output.stderr.clone()).expect("utf8 stderr")
+}
+
+/// Generates a signing keypair via the `keygen signing` subcommand and
+/// returns the path to its public JWK file. Reuses the tool under test
+/// instead of hand-rolling key material.
+fn generate_public_jwk(dir: &Path, name: &str, kid: &str) -> std::path::PathBuf {
+    let out_dir = dir.join(name);
+    let output = evidencectl()
+        .args(["keygen", "signing", "--out-dir"])
+        .arg(&out_dir)
+        .args(["--kid", kid])
+        .output()
+        .expect("run evidencectl keygen");
+    assert!(output.status.success(), "{}", stderr_of(&output));
+    out_dir.join("signing-ed25519-public.jwk.json")
+}
+
+#[test]
+fn assembles_a_jwks_document_from_public_jwk_files() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let first = generate_public_jwk(dir.path(), "first", "kid-a");
+    let second = generate_public_jwk(dir.path(), "second", "kid-b");
+    let out = dir.path().join("jwks.json");
+
+    let output = evidencectl()
+        .arg("jwks")
+        .arg("--out")
+        .arg(&out)
+        .arg(&first)
+        .arg(&second)
+        .output()
+        .expect("run evidencectl jwks");
+    assert!(output.status.success(), "{}", stderr_of(&output));
+
+    assert_eq!(mode_of(&out), 0o644);
+    let contents = fs::read_to_string(&out).expect("read jwks");
+    assert!(contents.ends_with('\n'), "output must end with a newline");
+
+    let document: serde_json::Value = serde_json::from_str(&contents).expect("valid json");
+    let keys = document["keys"].as_array().expect("keys array");
+    assert_eq!(keys.len(), 2);
+    let kids: Vec<&str> = keys
+        .iter()
+        .map(|key| key["kid"].as_str().unwrap())
+        .collect();
+    assert!(kids.contains(&"kid-a"));
+    assert!(kids.contains(&"kid-b"));
+}
+
+#[test]
+fn rejects_a_private_jwk_input_without_printing_its_contents() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let private_path = dir.path().join("oops-private.json");
+    let canary = "s3cr3t-d-value-canary";
+    fs::write(
+        &private_path,
+        format!(
+            r#"{{"kty":"OKP","crv":"Ed25519","d":"{canary}","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"leaked"}}"#
+        ),
+    )
+    .expect("write fake private jwk");
+    let out = dir.path().join("jwks.json");
+
+    let output = evidencectl()
+        .arg("jwks")
+        .arg("--out")
+        .arg(&out)
+        .arg(&private_path)
+        .output()
+        .expect("run evidencectl jwks");
+    assert!(
+        !output.status.success(),
+        "private JWK input must be rejected"
+    );
+    assert!(!out.exists(), "no output should be written on rejection");
+
+    let stderr = stderr_of(&output);
+    let stdout = String::from_utf8(output.stdout).expect("utf8 stdout");
+    assert!(!stdout.contains(canary), "stdout leaked private material");
+    assert!(!stderr.contains(canary), "stderr leaked private material");
+}
+
+#[test]
+fn deduplicates_identical_duplicate_entries() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let public = generate_public_jwk(dir.path(), "solo", "kid-dup");
+    let out = dir.path().join("jwks.json");
+
+    let output = evidencectl()
+        .arg("jwks")
+        .arg("--out")
+        .arg(&out)
+        .arg(&public)
+        .arg(&public)
+        .output()
+        .expect("run evidencectl jwks");
+    assert!(output.status.success(), "{}", stderr_of(&output));
+
+    let contents = fs::read_to_string(&out).expect("read jwks");
+    let document: serde_json::Value = serde_json::from_str(&contents).expect("valid json");
+    let keys = document["keys"].as_array().expect("keys array");
+    assert_eq!(
+        keys.len(),
+        1,
+        "identical duplicate entries must be deduplicated"
+    );
+}
+
+#[test]
+fn conflicting_keys_sharing_a_kid_is_an_error() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let first = generate_public_jwk(dir.path(), "first", "shared-kid");
+    let second = generate_public_jwk(dir.path(), "second", "shared-kid");
+    let out = dir.path().join("jwks.json");
+
+    let output = evidencectl()
+        .arg("jwks")
+        .arg("--out")
+        .arg(&out)
+        .arg(&first)
+        .arg(&second)
+        .output()
+        .expect("run evidencectl jwks");
+    assert!(
+        !output.status.success(),
+        "two different keys sharing a kid must be rejected"
+    );
+    assert!(!out.exists());
+    let stderr = stderr_of(&output);
+    assert!(
+        stderr.contains("shared-kid"),
+        "error should name the conflicting kid: {stderr}"
+    );
+}
+
+#[test]
+fn force_replaces_a_symlinked_output_path_without_writing_through_it() {
+    use std::os::unix::fs::symlink;
+
+    let dir = tempfile::tempdir().expect("tempdir");
+    let public = generate_public_jwk(dir.path(), "solo", "kid-sym");
+    let target = dir.path().join("elsewhere.json");
+    fs::write(&target, b"untouched").expect("seed symlink target");
+    let out = dir.path().join("jwks.json");
+    symlink(&target, &out).expect("create symlink at the output path");
+
+    let output = evidencectl()
+        .arg("jwks")
+        .arg("--out")
+        .arg(&out)
+        .arg("--force")
+        .arg(&public)
+        .output()
+        .expect("run evidencectl jwks");
+    assert!(output.status.success(), "{}", stderr_of(&output));
+
+    let metadata = fs::symlink_metadata(&out).expect("stat output path");
+    assert!(
+        metadata.is_file(),
+        "the symlink must be replaced by a regular file"
+    );
+    assert!(!metadata.file_type().is_symlink());
+    assert_eq!(mode_of(&out), 0o644);
+    assert_eq!(
+        fs::read(&target).expect("read symlink target"),
+        b"untouched",
+        "the symlink's former target must never be written through"
+    );
+}
+
+#[test]
+fn refuses_overwrite_without_force_then_succeeds_with_force() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let public = generate_public_jwk(dir.path(), "solo", "kid-x");
+    let out = dir.path().join("jwks.json");
+
+    let first = evidencectl()
+        .arg("jwks")
+        .arg("--out")
+        .arg(&out)
+        .arg(&public)
+        .output()
+        .expect("run evidencectl jwks");
+    assert!(first.status.success(), "{}", stderr_of(&first));
+    let original = fs::read(&out).expect("read jwks");
+
+    let second = evidencectl()
+        .arg("jwks")
+        .arg("--out")
+        .arg(&out)
+        .arg(&public)
+        .output()
+        .expect("run evidencectl jwks");
+    assert!(
+        !second.status.success(),
+        "overwrite without --force must be refused"
+    );
+    assert_eq!(fs::read(&out).expect("read jwks"), original);
+
+    let another = generate_public_jwk(dir.path(), "another", "kid-y");
+    let third = evidencectl()
+        .arg("jwks")
+        .arg("--out")
+        .arg(&out)
+        .arg("--force")
+        .arg(&public)
+        .arg(&another)
+        .output()
+        .expect("run evidencectl jwks");
+    assert!(third.status.success(), "{}", stderr_of(&third));
+    assert_eq!(mode_of(&out), 0o644);
+
+    let contents = fs::read_to_string(&out).expect("read jwks");
+    let document: serde_json::Value = serde_json::from_str(&contents).expect("valid json");
+    assert_eq!(document["keys"].as_array().expect("keys array").len(), 2);
+}
diff --git a/crates/registry-evidencectl/tests/keygen.rs b/crates/registry-evidencectl/tests/keygen.rs
new file mode 100644
index 000000000..f69eff062
--- /dev/null
+++ b/crates/registry-evidencectl/tests/keygen.rs
@@ -0,0 +1,560 @@
+#![cfg(unix)]
+
+use std::{
+    fs,
+    os::unix::fs::PermissionsExt as _,
+    path::Path,
+    process::{Command, Output},
+};
+
+use registry_platform_crypto::{PrivateJwk, PublicJwk};
+
+fn evidencectl() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_evidencectl"))
+}
+
+fn mode_of(path: &Path) -> u32 {
+    fs::metadata(path)
+        .unwrap_or_else(|error| panic!("stat {}: {error}", path.display()))
+        .permissions()
+        .mode()
+        & 0o777
+}
+
+fn stdout_of(output: &Output) -> String {
+    String::from_utf8(output.stdout.clone()).expect("utf8 stdout")
+}
+
+fn stderr_of(output: &Output) -> String {
+    String::from_utf8(output.stderr.clone()).expect("utf8 stderr")
+}
+
+/// Asserts neither captured stream contains `needle`, e.g. private key
+/// material that must never reach the terminal or logs.
+fn assert_output_excludes(output: &Output, needle: &str) {
+    let stdout = stdout_of(output);
+    let stderr = stderr_of(output);
+    assert!(
+        !stdout.contains(needle),
+        "stdout leaked secret material: {stdout}"
+    );
+    assert!(
+        !stderr.contains(needle),
+        "stderr leaked secret material: {stderr}"
+    );
+}
+
+#[test]
+fn signing_writes_private_and_public_jwk_with_expected_modes() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let out_dir = dir.path().join("keys");
+
+    let output = evidencectl()
+        .args(["keygen", "signing", "--out-dir"])
+        .arg(&out_dir)
+        .output()
+        .expect("run evidencectl");
+    assert!(
+        output.status.success(),
+        "keygen signing failed: {}",
+        stderr_of(&output)
+    );
+
+    assert_eq!(mode_of(&out_dir), 0o700, "out-dir mode");
+
+    let private_path = out_dir.join("signing-ed25519-private-jwk");
+    let public_path = out_dir.join("signing-ed25519-public.jwk.json");
+    assert_eq!(mode_of(&private_path), 0o600, "private file mode");
+    assert_eq!(mode_of(&public_path), 0o644, "public file mode");
+
+    let private_contents = fs::read_to_string(&private_path).expect("read private jwk");
+    let public_contents = fs::read_to_string(&public_path).expect("read public jwk");
+
+    let private = PrivateJwk::parse(&private_contents).expect("private JWK parses");
+    let public = PublicJwk::parse(&public_contents).expect("public JWK parses");
+
+    let expected_kid = public.jkt().expect("thumbprint");
+    assert_eq!(private.kid.as_deref(), Some(expected_kid.as_str()));
+    assert_eq!(public.kid.as_deref(), Some(expected_kid.as_str()));
+
+    // The "d" value must never appear on stdout or stderr.
+    let d_value = private.d.clone().expect("private JWK has d");
+    assert_output_excludes(&output, &d_value);
+}
+
+#[test]
+fn signing_kid_override_replaces_the_default_thumbprint() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let out_dir = dir.path().join("keys");
+
+    let output = evidencectl()
+        .args(["keygen", "signing", "--out-dir"])
+        .arg(&out_dir)
+        .args(["--kid", "custom-kid-1"])
+        .output()
+        .expect("run evidencectl");
+    assert!(output.status.success(), "{}", stderr_of(&output));
+
+    let private_contents =
+        fs::read_to_string(out_dir.join("signing-ed25519-private-jwk")).expect("read private jwk");
+    let public_contents = fs::read_to_string(out_dir.join("signing-ed25519-public.jwk.json"))
+        .expect("read public jwk");
+
+    let private = PrivateJwk::parse(&private_contents).expect("private JWK parses");
+    let public = PublicJwk::parse(&public_contents).expect("public JWK parses");
+    assert_eq!(private.kid.as_deref(), Some("custom-kid-1"));
+    assert_eq!(public.kid.as_deref(), Some("custom-kid-1"));
+
+    let d_value = private.d.clone().expect("private JWK has d");
+    assert_output_excludes(&output, &d_value);
+}
+
+#[test]
+fn signing_rejects_an_empty_or_whitespace_only_kid() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let out_dir = dir.path().join("keys");
+
+    let output = evidencectl()
+        .args(["keygen", "signing", "--out-dir"])
+        .arg(&out_dir)
+        .args(["--kid", "   "])
+        .output()
+        .expect("run evidencectl");
+    assert!(
+        !output.status.success(),
+        "a whitespace-only --kid must be refused"
+    );
+    assert!(
+        !out_dir.join("signing-ed25519-private-jwk").exists(),
+        "no key material should be generated for a refused --kid"
+    );
+}
+
+#[test]
+fn signing_public_out_overrides_the_default_public_path() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let out_dir = dir.path().join("keys");
+    let public_out = dir.path().join("elsewhere").join("signing-public.json");
+
+    let output = evidencectl()
+        .args(["keygen", "signing", "--out-dir"])
+        .arg(&out_dir)
+        .arg("--public-out")
+        .arg(&public_out)
+        .output()
+        .expect("run evidencectl");
+    assert!(output.status.success(), "{}", stderr_of(&output));
+
+    assert!(public_out.is_file());
+    assert!(!out_dir.join("signing-ed25519-public.jwk.json").exists());
+    assert_eq!(mode_of(&public_out), 0o644);
+}
+
+#[test]
+fn holder_writes_private_and_public_jwk_with_holder_filenames() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let out_dir = dir.path().join("holder-keys");
+
+    let output = evidencectl()
+        .args(["keygen", "holder", "--out-dir"])
+        .arg(&out_dir)
+        .output()
+        .expect("run evidencectl");
+    assert!(output.status.success(), "{}", stderr_of(&output));
+
+    let private_path = out_dir.join("holder-ed25519-private-jwk");
+    let public_path = out_dir.join("holder-ed25519-public.jwk.json");
+    assert_eq!(mode_of(&private_path), 0o600);
+    assert_eq!(mode_of(&public_path), 0o644);
+
+    let private_contents = fs::read_to_string(&private_path).expect("read private jwk");
+    let public_contents = fs::read_to_string(&public_path).expect("read public jwk");
+    let private = PrivateJwk::parse(&private_contents).expect("private JWK parses");
+    let public = PublicJwk::parse(&public_contents).expect("public JWK parses");
+    assert_eq!(private.kid, public.kid);
+
+    let d_value = private.d.clone().expect("private JWK has d");
+    assert_output_excludes(&output, &d_value);
+}
+
+#[test]
+fn secret_writes_exactly_32_raw_bytes_with_owner_only_mode() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let out = dir.path().join("secrets").join("audit-hmac-key");
+
+    let output = evidencectl()
+        .args(["keygen", "secret", "--out"])
+        .arg(&out)
+        .output()
+        .expect("run evidencectl");
+    assert!(output.status.success(), "{}", stderr_of(&output));
+
+    assert_eq!(mode_of(out.parent().unwrap()), 0o700, "parent dir mode");
+    assert_eq!(mode_of(&out), 0o600, "secret file mode");
+
+    let bytes = fs::read(&out).expect("read secret");
+    assert_eq!(bytes.len(), 32);
+}
+
+#[test]
+fn secret_invocations_generate_independent_values() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let first = dir.path().join("first.key");
+    let second = dir.path().join("second.key");
+
+    for out in [&first, &second] {
+        let output = evidencectl()
+            .args(["keygen", "secret", "--out"])
+            .arg(out)
+            .output()
+            .expect("run evidencectl");
+        assert!(output.status.success(), "{}", stderr_of(&output));
+    }
+
+    let first_bytes = fs::read(&first).expect("read first secret");
+    let second_bytes = fs::read(&second).expect("read second secret");
+    assert_eq!(first_bytes.len(), 32);
+    assert_eq!(second_bytes.len(), 32);
+    assert_ne!(first_bytes, second_bytes);
+}
+
+/// The Evidence runtime rejects any file-provided secret containing a NUL
+/// byte, and a uniform 32-byte draw carries one about 11.8% of the time. A
+/// generated secret must therefore never contain one, or roughly one project
+/// in five fails at `evidence serve` long after `evidence check` passed.
+#[test]
+fn secret_never_contains_a_nul_byte() {
+    let dir = tempfile::tempdir().expect("tempdir");
+
+    // 64 draws leave under one chance in 3000 of a run where every unfixed
+    // draw happened to be NUL-free.
+    for index in 0..64 {
+        let out = dir.path().join(format!("secret-{index}.key"));
+        let output = evidencectl()
+            .args(["keygen", "secret", "--out"])
+            .arg(&out)
+            .output()
+            .expect("run evidencectl");
+        assert!(output.status.success(), "{}", stderr_of(&output));
+
+        let bytes = fs::read(&out).expect("read secret");
+        assert_eq!(bytes.len(), 32);
+        assert!(
+            !bytes.contains(&0),
+            "draw {index} contains a NUL byte the runtime rejects"
+        );
+    }
+}
+
+#[test]
+fn signing_refuses_overwrite_without_force_then_succeeds_with_force() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let out_dir = dir.path().join("keys");
+
+    let first = evidencectl()
+        .args(["keygen", "signing", "--out-dir"])
+        .arg(&out_dir)
+        .output()
+        .expect("run evidencectl");
+    assert!(first.status.success(), "{}", stderr_of(&first));
+
+    let private_path = out_dir.join("signing-ed25519-private-jwk");
+    let original_private = fs::read_to_string(&private_path).expect("read private jwk");
+
+    let second = evidencectl()
+        .args(["keygen", "signing", "--out-dir"])
+        .arg(&out_dir)
+        .output()
+        .expect("run evidencectl");
+    assert!(
+        !second.status.success(),
+        "second run without --force unexpectedly succeeded"
+    );
+    let unchanged = fs::read_to_string(&private_path).expect("read private jwk");
+    assert_eq!(
+        original_private, unchanged,
+        "file must be untouched on refusal"
+    );
+
+    let third = evidencectl()
+        .args(["keygen", "signing", "--out-dir"])
+        .arg(&out_dir)
+        .arg("--force")
+        .output()
+        .expect("run evidencectl");
+    assert!(third.status.success(), "{}", stderr_of(&third));
+    assert_eq!(
+        mode_of(&private_path),
+        0o600,
+        "mode preserved across --force"
+    );
+
+    let regenerated = fs::read_to_string(&private_path).expect("read private jwk");
+    assert_ne!(
+        original_private, regenerated,
+        "--force must regenerate key material"
+    );
+}
+
+#[test]
+fn secret_refuses_overwrite_without_force_then_succeeds_with_force() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let out = dir.path().join("secret.key");
+
+    let first = evidencectl()
+        .args(["keygen", "secret", "--out"])
+        .arg(&out)
+        .output()
+        .expect("run evidencectl");
+    assert!(first.status.success(), "{}", stderr_of(&first));
+    let original = fs::read(&out).expect("read secret");
+
+    let second = evidencectl()
+        .args(["keygen", "secret", "--out"])
+        .arg(&out)
+        .output()
+        .expect("run evidencectl");
+    assert!(!second.status.success());
+    assert_eq!(fs::read(&out).expect("read secret"), original);
+
+    let third = evidencectl()
+        .args(["keygen", "secret", "--out"])
+        .arg(&out)
+        .arg("--force")
+        .output()
+        .expect("run evidencectl");
+    assert!(third.status.success(), "{}", stderr_of(&third));
+    assert_eq!(mode_of(&out), 0o600);
+    assert_ne!(fs::read(&out).expect("read secret"), original);
+}
+
+#[test]
+fn signing_batch_abort_leaves_the_private_file_unwritten() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let out_dir = dir.path().join("keys");
+    fs::create_dir(&out_dir).expect("create out-dir");
+
+    // Pre-create only the public target; the private target must never be
+    // written once the batch is refused.
+    fs::write(out_dir.join("signing-ed25519-public.jwk.json"), b"stale").expect("seed public file");
+
+    let output = evidencectl()
+        .args(["keygen", "signing", "--out-dir"])
+        .arg(&out_dir)
+        .output()
+        .expect("run evidencectl");
+    assert!(!output.status.success(), "batch should have been refused");
+    assert!(
+        !out_dir.join("signing-ed25519-private-jwk").exists(),
+        "private key must not be written when the batch aborts"
+    );
+    let public_contents =
+        fs::read(out_dir.join("signing-ed25519-public.jwk.json")).expect("read public file");
+    assert_eq!(
+        public_contents, b"stale",
+        "pre-existing public file must be untouched"
+    );
+}
+
+#[test]
+fn secret_leaves_a_pre_existing_parent_directorys_mode_untouched() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let parent = dir.path().join("secrets");
+    fs::create_dir(&parent).expect("create parent dir");
+    fs::set_permissions(&parent, fs::Permissions::from_mode(0o755)).expect("loosen parent mode");
+
+    let out = parent.join("audit-hmac-key");
+    let output = evidencectl()
+        .args(["keygen", "secret", "--out"])
+        .arg(&out)
+        .output()
+        .expect("run evidencectl");
+    assert!(output.status.success(), "{}", stderr_of(&output));
+
+    assert_eq!(
+        mode_of(&parent),
+        0o755,
+        "a parent directory this invocation did not create must keep its own mode"
+    );
+}
+
+#[test]
+fn signing_out_dir_mode_is_normalized_to_0700_when_pre_created_looser() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let out_dir = dir.path().join("keys");
+    fs::create_dir(&out_dir).expect("create out-dir");
+    fs::set_permissions(&out_dir, fs::Permissions::from_mode(0o755)).expect("loosen out-dir mode");
+
+    let output = evidencectl()
+        .args(["keygen", "signing", "--out-dir"])
+        .arg(&out_dir)
+        .output()
+        .expect("run evidencectl");
+    assert!(output.status.success(), "{}", stderr_of(&output));
+
+    assert_eq!(
+        mode_of(&out_dir),
+        0o700,
+        "a pre-existing out-dir must be normalized to owner-only"
+    );
+}
+
+#[test]
+fn signing_force_replaces_a_symlinked_private_path_without_writing_through_it() {
+    use std::os::unix::fs::symlink;
+
+    let dir = tempfile::tempdir().expect("tempdir");
+    let out_dir = dir.path().join("keys");
+    fs::create_dir(&out_dir).expect("create out-dir");
+
+    let target = dir.path().join("attacker-target");
+    fs::write(&target, b"untouched").expect("seed symlink target");
+
+    let private_path = out_dir.join("signing-ed25519-private-jwk");
+    symlink(&target, &private_path).expect("create symlink at the private path");
+
+    let output = evidencectl()
+        .args(["keygen", "signing", "--out-dir"])
+        .arg(&out_dir)
+        .arg("--force")
+        .output()
+        .expect("run evidencectl");
+    assert!(output.status.success(), "{}", stderr_of(&output));
+
+    let metadata = fs::symlink_metadata(&private_path).expect("stat private path");
+    assert!(
+        metadata.file_type().is_file(),
+        "the symlink must be replaced by a regular file"
+    );
+    assert!(!metadata.file_type().is_symlink());
+
+    let target_contents = fs::read(&target).expect("read symlink target");
+    assert_eq!(
+        target_contents, b"untouched",
+        "the symlink's former target must never be written through"
+    );
+}
+
+#[test]
+fn signing_error_names_the_offending_paths() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let out_dir = dir.path().join("keys");
+    fs::create_dir(&out_dir).expect("create out-dir");
+    fs::write(out_dir.join("signing-ed25519-private-jwk"), b"stale").expect("seed private file");
+
+    let output = evidencectl()
+        .args(["keygen", "signing", "--out-dir"])
+        .arg(&out_dir)
+        .output()
+        .expect("run evidencectl");
+    assert!(!output.status.success());
+    let stderr = stderr_of(&output);
+    assert!(
+        stderr.contains("signing-ed25519-private-jwk"),
+        "error should name the offending path: {stderr}"
+    );
+}
+
+/// A bearer token ends up in an HTTP header, where the raw bytes `keygen
+/// secret` writes are not valid. `keygen token` must therefore emit only
+/// characters a header value accepts, with no trailing newline: the runtime
+/// reads the file whole and would carry one into the header.
+#[test]
+fn token_writes_a_header_safe_value_with_owner_only_mode() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let out = dir.path().join("secrets").join("source-bearer-token");
+
+    let output = evidencectl()
+        .args(["keygen", "token", "--out"])
+        .arg(&out)
+        .output()
+        .expect("run evidencectl");
+    assert!(output.status.success(), "{}", stderr_of(&output));
+
+    assert_eq!(mode_of(out.parent().unwrap()), 0o700, "parent dir mode");
+    assert_eq!(mode_of(&out), 0o600, "token file mode");
+
+    let token = fs::read_to_string(&out).expect("read token");
+    assert_eq!(token.len(), 43, "token: {token}");
+    assert!(
+        token
+            .chars()
+            .all(|character| character.is_ascii_alphanumeric()
+                || character == '-'
+                || character == '_'),
+        "token carries a character an HTTP header value rejects: {token}"
+    );
+
+    // The generated credential is as secret as any private key, and this tool
+    // never prints those either.
+    assert_output_excludes(&output, &token);
+}
+
+#[test]
+fn token_invocations_generate_independent_values() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let first = dir.path().join("first.token");
+    let second = dir.path().join("second.token");
+
+    for out in [&first, &second] {
+        let output = evidencectl()
+            .args(["keygen", "token", "--out"])
+            .arg(out)
+            .output()
+            .expect("run evidencectl");
+        assert!(output.status.success(), "{}", stderr_of(&output));
+    }
+
+    assert_ne!(
+        fs::read_to_string(&first).expect("read first token"),
+        fs::read_to_string(&second).expect("read second token")
+    );
+}
+
+#[test]
+fn token_refuses_overwrite_without_force_then_succeeds_with_force() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let out = dir.path().join("source-bearer-token");
+    fs::write(&out, b"already here").expect("seed token");
+
+    let refused = evidencectl()
+        .args(["keygen", "token", "--out"])
+        .arg(&out)
+        .output()
+        .expect("run evidencectl");
+    assert!(!refused.status.success());
+    assert_eq!(
+        fs::read_to_string(&out).expect("read token"),
+        "already here",
+        "a refused run must leave the existing token alone"
+    );
+
+    let forced = evidencectl()
+        .args(["keygen", "token", "--force", "--out"])
+        .arg(&out)
+        .output()
+        .expect("run evidencectl");
+    assert!(forced.status.success(), "{}", stderr_of(&forced));
+    assert_ne!(
+        fs::read_to_string(&out).expect("read token"),
+        "already here"
+    );
+}
+
+/// `keygen secret` is the obvious tool for the one secret every scaffolded
+/// bundle needs, and it is the wrong one. Its own help has to say so, because
+/// the alternative is discovering it at the first live request.
+#[test]
+fn secret_help_says_it_does_not_make_bearer_tokens() {
+    let output = evidencectl()
+        .args(["keygen", "secret", "--help"])
+        .output()
+        .expect("run evidencectl");
+    assert!(output.status.success(), "{}", stderr_of(&output));
+
+    let help = stdout_of(&output);
+    assert!(
+        help.contains("keygen token"),
+        "keygen secret's help never points at the token generator:\n{help}"
+    );
+}
diff --git a/crates/registry-evidencectl/tests/production_build.rs b/crates/registry-evidencectl/tests/production_build.rs
new file mode 100644
index 000000000..7976e7b98
--- /dev/null
+++ b/crates/registry-evidencectl/tests/production_build.rs
@@ -0,0 +1,854 @@
+#![cfg(unix)]
+
+//! Production-build filesystem and delegation invariants.
+//!
+//! These tests deliberately replace the sibling `evidence` binary with a
+//! value-free recorder. They pin the adopter tool's responsibilities without
+//! copying bundle or fixture semantics out of the runtime.
+
+use std::{
+    collections::BTreeMap,
+    fs,
+    os::unix::fs::{symlink, PermissionsExt as _},
+    path::{Path, PathBuf},
+    process::{Command, Output, Stdio},
+    thread,
+    time::{Duration, Instant},
+};
+
+const REVISION: &str = "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+const LOCAL_URI: &str = "urn:registrystack:evidence:local:forbidden";
+const SECRET_CANARY: &str = "production-build-secret-canary";
+
+#[test]
+fn build_is_create_only_and_never_changes_an_existing_output() {
+    let fixture = Fixture::new();
+    fs::create_dir(&fixture.output).expect("existing output");
+    fs::write(fixture.output.join("owned.txt"), "preserve me\n").expect("existing file");
+
+    let output = fixture.build();
+
+    assert_failed(&output, "existing output must be refused");
+    assert_eq!(
+        fs::read_to_string(fixture.output.join("owned.txt")).unwrap(),
+        "preserve me\n"
+    );
+    assert!(fixture.invocations().is_empty());
+    fixture.assert_no_staging_residue();
+}
+
+#[test]
+fn build_rejects_output_inside_the_editable_project_without_modifying_it() {
+    let fixture = Fixture::new();
+    let candidate = fixture.project.join("candidate");
+    let before = snapshot(&fixture.project);
+
+    let output = fixture.build_with(&fixture.project, &fixture.target, &candidate);
+
+    assert_failed(&output, "project-contained output must be refused");
+    assert!(!candidate.exists());
+    assert_eq!(snapshot(&fixture.project), before);
+    assert!(fixture.invocations().is_empty());
+    fixture.assert_no_staging_residue();
+}
+
+#[test]
+fn build_rejects_symlinked_project_target_output_parent_and_artifact() {
+    for boundary in ["project", "target", "output-parent", "artifact"] {
+        let fixture = Fixture::new();
+        let mut project = fixture.project.clone();
+        let mut target = fixture.target.clone();
+        let mut output = fixture.output.clone();
+        match boundary {
+            "project" => {
+                project = fixture.root.join("project-link");
+                symlink(&fixture.project, &project).expect("project symlink");
+            }
+            "target" => {
+                target = fixture.root.join("target-link");
+                symlink(&fixture.target, &target).expect("target symlink");
+            }
+            "output-parent" => {
+                let actual = fixture.root.join("actual-output-parent");
+                fs::create_dir(&actual).expect("actual output parent");
+                let linked = fixture.root.join("linked-output-parent");
+                symlink(&actual, &linked).expect("output parent symlink");
+                output = linked.join("candidate");
+            }
+            "artifact" => {
+                let derivation = fixture.project.join("derivations/answer.rhai");
+                fs::remove_file(&derivation).expect("remove regular derivation");
+                let outside = fixture.root.join("outside.rhai");
+                fs::write(
+                    &outside,
+                    "fn answer(facts, selectors, context) { #{allowed: true} }\n",
+                )
+                .expect("outside derivation");
+                symlink(outside, derivation).expect("artifact symlink");
+            }
+            _ => unreachable!(),
+        }
+
+        let result = fixture.build_with(&project, &target, &output);
+        assert_failed(&result, boundary);
+        assert!(!output.exists(), "{boundary} published an output");
+        assert!(
+            fixture.invocations().is_empty(),
+            "{boundary} reached Evidence"
+        );
+        fixture.assert_no_staging_residue();
+    }
+}
+
+#[test]
+fn failed_runtime_check_leaves_no_output_or_private_staging() {
+    let fixture = Fixture::new();
+
+    let output = fixture.build_failing("check");
+
+    assert_failed(&output, "runtime rejection must fail the build");
+    assert!(!fixture.output.exists());
+    fixture.assert_no_staging_residue();
+    assert_eq!(fixture.steps(), ["check"]);
+    assert_value_free(&output);
+}
+
+#[test]
+fn successful_build_copies_runtime_exactly_and_excludes_local_and_validation_secrets() {
+    let fixture = Fixture::new();
+    let local = fixture.project.join(".evidence/dev");
+    fs::create_dir_all(&local).expect("local state");
+    fs::write(local.join("disposable-private-key"), SECRET_CANARY).expect("local secret");
+    let runtime = fs::read(&fixture.runtime).expect("target runtime");
+
+    let output = fixture.build();
+
+    assert_success(&output, "production build");
+    assert_eq!(
+        fs::read(fixture.output.join("runtime.yaml")).unwrap(),
+        runtime
+    );
+    let snapshot = snapshot(&fixture.output);
+    assert_eq!(
+        snapshot.keys().cloned().collect::<Vec<_>>(),
+        vec![
+            PathBuf::from("bundle/adapters/source-extract.rhai"),
+            PathBuf::from("bundle/adapters/source-prepare.rhai"),
+            PathBuf::from("bundle/derivations/answer.rhai"),
+            PathBuf::from("bundle/evidence.yaml"),
+            PathBuf::from("bundle/fixtures/answer.yaml"),
+            PathBuf::from("bundle/schemas/facts.schema.yaml"),
+            PathBuf::from("bundle/schemas/parameters.schema.yaml"),
+            PathBuf::from("bundle/schemas/response.schema.yaml"),
+            PathBuf::from("runtime.yaml"),
+        ]
+    );
+    for (path, bytes) in snapshot {
+        assert!(
+            !bytes
+                .windows(SECRET_CANARY.len())
+                .any(|part| part == SECRET_CANARY.as_bytes()),
+            "{} contains local secret material",
+            path.display()
+        );
+        assert!(!path.to_string_lossy().contains("validation"));
+    }
+    fixture.assert_no_staging_residue();
+}
+
+#[test]
+fn production_metadata_and_fixture_completeness_fail_before_runtime_delegation() {
+    for label in [
+        "missing-governance",
+        "missing-stable-concept",
+        "missing-fixture",
+    ] {
+        let fixture = Fixture::new();
+        match label {
+            "missing-governance" => fixture.remove_governance(),
+            "missing-stable-concept" => {
+                fixture.replace_in_question("    id: urn:example:concepts:allowed\n", "")
+            }
+            "missing-fixture" => fs::remove_file(fixture.project.join("fixtures/answer.yaml"))
+                .expect("remove fixture"),
+            _ => unreachable!(),
+        }
+        let output = fixture.build();
+        assert_failed(&output, label);
+        assert!(!fixture.output.exists());
+        assert!(fixture.invocations().is_empty(), "{label} reached Evidence");
+        fixture.assert_no_staging_residue();
+    }
+}
+
+#[test]
+fn disposable_local_identifiers_fail_before_runtime_delegation() {
+    for original in [
+        "urn:example:requirements:allowed:v1",
+        "urn:example:frameworks:allowed:v1",
+        "urn:example:evidence-types:allowed:v1",
+        "urn:example:disclosure-families:allowed",
+        "urn:example:concepts:allowed",
+    ] {
+        let fixture = Fixture::new();
+        fixture.replace_in_question(original, LOCAL_URI);
+        let output = fixture.build();
+        assert_failed(&output, "local identifier");
+        assert!(!fixture.output.exists());
+        assert!(fixture.invocations().is_empty());
+        assert!(!stderr(&output).contains(LOCAL_URI));
+    }
+}
+
+#[test]
+fn plain_http_and_unauthenticated_sources_fail_before_runtime_delegation() {
+    for (from, to) in [
+        ("https://registry.invalid", "http://127.0.0.1:8088"),
+        ("kind: static-bearer", "kind: none"),
+    ] {
+        let fixture = Fixture::new();
+        fixture.replace_in_source(from, to);
+        let output = fixture.build();
+        assert_failed(&output, "insecure source");
+        assert!(!fixture.output.exists());
+        assert!(fixture.invocations().is_empty());
+        fixture.assert_no_staging_residue();
+    }
+}
+
+#[test]
+fn unresolved_review_markers_and_unknown_target_fields_fail_closed() {
+    let marker = Fixture::new();
+    fs::write(
+        marker.project.join("fixtures/answer.yaml"),
+        "fixture: TODO(evidencectl)\n",
+    )
+    .expect("review marker");
+    let marker_output = marker.build();
+    assert_failed(&marker_output, "review marker");
+    assert!(marker.invocations().is_empty());
+    assert!(!marker.output.exists());
+    assert_value_free(&marker_output);
+
+    let unknown = Fixture::new();
+    let mut governance = fs::read_to_string(&unknown.governance).unwrap();
+    governance.push_str("deploymentGenerator: forbidden\n");
+    fs::write(&unknown.governance, governance).unwrap();
+    let unknown_output = unknown.build();
+    assert_failed(&unknown_output, "unknown target field");
+    assert!(unknown.invocations().is_empty());
+    assert!(!unknown.output.exists());
+    unknown.assert_no_staging_residue();
+}
+
+#[test]
+fn semantic_authority_completeness_is_delegated_to_evidence() {
+    let fixture = Fixture::new();
+    let mut governance = fs::read_to_string(&fixture.governance).unwrap();
+    let start = governance
+        .find("authorityProfiles:")
+        .expect("authority profile section");
+    governance.truncate(start);
+    governance.push_str("authorityProfiles:\n  incomplete: {}\n");
+    fs::write(&fixture.governance, governance).unwrap();
+
+    let output = fixture.build_failing("check");
+
+    assert_failed(&output, "runtime-owned authority validation");
+    assert_eq!(fixture.steps(), ["check"]);
+    assert!(!fixture.output.exists());
+    assert_value_free(&output);
+    fixture.assert_no_staging_residue();
+}
+
+#[test]
+fn every_referenced_fixture_is_delegated_and_one_failure_prevents_publication() {
+    let fixture = Fixture::new();
+    fixture.add_second_question();
+
+    let passed = fixture.build();
+    assert_success(&passed, "two-fixture build");
+    assert_eq!(
+        fixture.steps(),
+        [
+            "check",
+            "evaluate:fixtures/answer.yaml",
+            "evaluate:fixtures/second.yaml"
+        ]
+    );
+
+    let failed = Fixture::new();
+    failed.add_second_question();
+    let output = failed.build_failing("fixture:fixtures/second.yaml");
+    assert_failed(&output, "one rejected fixture");
+    assert_eq!(
+        failed.steps(),
+        [
+            "check",
+            "evaluate:fixtures/answer.yaml",
+            "evaluate:fixtures/second.yaml"
+        ]
+    );
+    assert!(!failed.output.exists());
+    assert_value_free(&output);
+    failed.assert_no_staging_residue();
+}
+
+#[test]
+fn identical_inputs_produce_identical_bundle_bytes_revision_and_stable_report_shape() {
+    let fixture = Fixture::new();
+    let first_output = fixture.root.join("candidate-one");
+    let second_output = fixture.root.join("candidate-two");
+
+    let first = fixture.build_with(&fixture.project, &fixture.target, &first_output);
+    let second = fixture.build_with(&fixture.project, &fixture.target, &second_output);
+
+    assert_success(&first, "first deterministic build");
+    assert_success(&second, "second deterministic build");
+    assert_eq!(
+        snapshot(&first_output.join("bundle")),
+        snapshot(&second_output.join("bundle"))
+    );
+    assert_report(&first, &first_output);
+    assert_report(&second, &second_output);
+    assert_eq!(reported_revision(&first), reported_revision(&second));
+}
+
+#[test]
+fn termination_cancels_evidence_and_removes_only_current_build_staging() {
+    for signal in [rustix::process::Signal::INT, rustix::process::Signal::TERM] {
+        let fixture = Fixture::new();
+        let ready = fixture.root.join("blocked-evidence-ready");
+        let unrelated = fixture.root.join(".evidencectl-build-unrelated");
+        fs::create_dir(&unrelated).expect("unrelated staging");
+        fs::write(unrelated.join("owned.txt"), "preserve me\n").expect("unrelated sentinel");
+
+        let mut child = fixture
+            .command(&fixture.project, &fixture.target, &fixture.output)
+            .env("FAKE_EVIDENCE_BLOCK", "1")
+            .env("FAKE_EVIDENCE_BLOCK_READY", &ready)
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()
+            .expect("blocking evidencectl build starts");
+
+        let ready_deadline = Instant::now() + Duration::from_secs(10);
+        while !ready.exists() {
+            assert!(
+                child.try_wait().expect("poll blocking build").is_none(),
+                "build exited before the fake Evidence process blocked"
+            );
+            assert!(
+                Instant::now() < ready_deadline,
+                "fake Evidence did not reach its blocking point"
+            );
+            thread::sleep(Duration::from_millis(10));
+        }
+
+        let pid = rustix::process::Pid::from_raw(
+            i32::try_from(child.id()).expect("evidencectl PID fits i32"),
+        )
+        .expect("evidencectl PID is positive");
+        rustix::process::kill_process(pid, signal).expect("send signal to evidencectl build");
+
+        let exit_deadline = Instant::now() + Duration::from_secs(10);
+        loop {
+            if child.try_wait().expect("poll interrupted build").is_some() {
+                break;
+            }
+            if Instant::now() >= exit_deadline {
+                let _ = child.kill();
+                let _ = child.wait();
+                panic!("interrupted evidencectl build did not exit");
+            }
+            thread::sleep(Duration::from_millis(10));
+        }
+        let output = child.wait_with_output().expect("collect interrupted build");
+
+        assert_failed(&output, "signal-interrupted build");
+        assert_value_free(&output);
+        assert!(!fixture.output.exists());
+        assert_eq!(
+            fs::read_to_string(unrelated.join("owned.txt")).unwrap(),
+            "preserve me\n",
+            "build cleaned unrelated staging"
+        );
+        fs::remove_dir_all(&unrelated).expect("remove test-owned unrelated staging");
+        fixture.assert_no_staging_residue();
+    }
+}
+
+struct Fixture {
+    _temporary: tempfile::TempDir,
+    root: PathBuf,
+    project: PathBuf,
+    target: PathBuf,
+    governance: PathBuf,
+    runtime: PathBuf,
+    output: PathBuf,
+    evidence: PathBuf,
+    log: PathBuf,
+}
+
+impl Fixture {
+    fn new() -> Self {
+        let temporary_root = workspace_root().join("target");
+        fs::create_dir_all(&temporary_root).expect("workspace target");
+        let temporary = tempfile::Builder::new()
+            .prefix("production-build-")
+            .tempdir_in(temporary_root)
+            .expect("test tempdir");
+        let root = temporary.path().to_path_buf();
+        let project = root.join("project");
+        let target = project.join("deployment-targets/production");
+        for directory in [
+            "selectors",
+            "sources",
+            "adapters",
+            "schemas",
+            "questions",
+            "derivations",
+            "fixtures",
+        ] {
+            fs::create_dir_all(project.join(directory)).expect("project directory");
+        }
+        fs::create_dir_all(&target).expect("target directory");
+
+        fs::write(
+            project.join("source.openapi.yaml"),
+            "openapi: 3.1.0\ninfo: {title: Neutral source, version: 1.0.0}\npaths: {}\n",
+        )
+        .expect("retained OpenAPI");
+        fs::write(
+            project.join("selectors/subject-reference-v1.yaml"),
+            "maximumAggregateBytes: 128\nfields:\n  reference: {type: string, minimumBytes: 1, maximumBytes: 128}\n",
+        )
+        .expect("selector profile");
+        fs::write(project.join("sources/registry.yaml"), SOURCE).expect("source");
+        fs::write(
+            project.join("adapters/source-prepare.rhai"),
+            "fn prepare(selectors, parameters) { #{query: [], body: #{reference: selectors[\"subject\"][\"values\"][\"reference\"]}} }\n",
+        )
+        .expect("prepare script");
+        fs::write(
+            project.join("adapters/source-extract.rhai"),
+            "fn extract(source_response, parameters) { #{outcome: \"match\", facts: #{allowed: source_response[\"allowed\"]}} }\n",
+        )
+        .expect("extract script");
+        fs::write(
+            project.join("schemas/parameters.schema.yaml"),
+            "type: object\nadditionalProperties: false\nproperties: {}\n",
+        )
+        .expect("parameters schema");
+        fs::write(
+            project.join("schemas/response.schema.yaml"),
+            "type: object\nadditionalProperties: false\nrequired: [allowed]\nproperties:\n  allowed: {type: boolean}\n",
+        )
+        .expect("response schema");
+        fs::write(
+            project.join("schemas/facts.schema.yaml"),
+            "type: object\nadditionalProperties: false\nrequired: [allowed]\nproperties:\n  allowed: {type: boolean}\n",
+        )
+        .expect("facts schema");
+        fs::write(project.join("questions/answer.yaml"), question("answer")).expect("question");
+        fs::write(
+            project.join("derivations/answer.rhai"),
+            "fn answer(facts, selectors, context) { #{allowed: facts[\"allowed\"]} }\n",
+        )
+        .expect("derivation");
+        fs::write(
+            project.join("fixtures/answer.yaml"),
+            "fixture: neutral.answer/v1\n",
+        )
+        .expect("fixture");
+
+        let governance = target.join("governance.yaml");
+        fs::write(&governance, GOVERNANCE).expect("target governance");
+        let runtime = target.join("runtime.yaml");
+        fs::write(&runtime, TARGET_RUNTIME).expect("target runtime");
+
+        let evidence = root.join("evidence");
+        fs::write(&evidence, FAKE_EVIDENCE).expect("fake Evidence");
+        let mut permissions = fs::metadata(&evidence).unwrap().permissions();
+        permissions.set_mode(0o700);
+        fs::set_permissions(&evidence, permissions).unwrap();
+
+        Self {
+            output: root.join("candidate"),
+            log: root.join("evidence-invocations"),
+            _temporary: temporary,
+            root,
+            project,
+            target,
+            governance,
+            runtime,
+            evidence,
+        }
+    }
+
+    fn build(&self) -> Output {
+        self.build_with(&self.project, &self.target, &self.output)
+    }
+
+    fn build_failing(&self, failure: &str) -> Output {
+        self.command(&self.project, &self.target, &self.output)
+            .env("FAKE_EVIDENCE_FAIL", failure)
+            .output()
+            .expect("evidencectl build starts")
+    }
+
+    fn build_with(&self, project: &Path, target: &Path, output: &Path) -> Output {
+        self.command(project, target, output)
+            .output()
+            .expect("evidencectl build starts")
+    }
+
+    fn command(&self, project: &Path, target: &Path, output: &Path) -> Command {
+        let mut command = Command::new(env!("CARGO_BIN_EXE_evidencectl"));
+        command
+            .arg("build")
+            .arg("--project")
+            .arg(project)
+            .arg("--target")
+            .arg(target)
+            .arg("--output")
+            .arg(output)
+            .env("EVIDENCE_BIN", &self.evidence)
+            .env("FAKE_EVIDENCE_LOG", &self.log)
+            .env_remove("FAKE_EVIDENCE_FAIL");
+        command
+    }
+
+    fn invocations(&self) -> Vec<Vec<String>> {
+        let Ok(contents) = fs::read_to_string(&self.log) else {
+            return Vec::new();
+        };
+        contents
+            .split("===\n")
+            .filter(|part| !part.is_empty())
+            .map(|part| part.lines().map(str::to_owned).collect())
+            .collect()
+    }
+
+    fn steps(&self) -> Vec<String> {
+        self.invocations()
+            .into_iter()
+            .map(|args| {
+                if let Some(index) = args.iter().position(|arg| arg == "--fixture") {
+                    format!("evaluate:{}", args[index + 1])
+                } else {
+                    "check".to_owned()
+                }
+            })
+            .collect()
+    }
+
+    fn replace_in_question(&self, from: &str, to: &str) {
+        replace(&self.project.join("questions/answer.yaml"), from, to);
+    }
+
+    fn replace_in_source(&self, from: &str, to: &str) {
+        replace(&self.project.join("sources/registry.yaml"), from, to);
+    }
+
+    fn remove_governance(&self) {
+        let path = self.project.join("questions/answer.yaml");
+        let mut contents = fs::read_to_string(&path).expect("question reads");
+        let start = contents.find("governance:\n").expect("governance section");
+        contents.truncate(start);
+        fs::write(path, contents).expect("question without governance writes");
+    }
+
+    fn add_second_question(&self) {
+        fs::write(
+            self.project.join("questions/second.yaml"),
+            question("second"),
+        )
+        .expect("second question");
+        fs::write(
+            self.project.join("derivations/second.rhai"),
+            "fn answer(facts, selectors, context) { #{allowed: facts[\"allowed\"]} }\n",
+        )
+        .expect("second derivation");
+        fs::write(
+            self.project.join("fixtures/second.yaml"),
+            "fixture: neutral.second/v1\n",
+        )
+        .expect("second fixture");
+    }
+
+    fn assert_no_staging_residue(&self) {
+        fn collect(path: &Path, names: &mut Vec<PathBuf>) {
+            for entry in fs::read_dir(path).expect("staging scan directory") {
+                let entry = entry.expect("staging scan entry");
+                let entry_path = entry.path();
+                let metadata = fs::symlink_metadata(&entry_path).expect("staging scan metadata");
+                let name = entry.file_name();
+                let name = name.to_string_lossy();
+                if name.starts_with(".evidencectl-build-")
+                    || name.starts_with(".evidencectl-build-validation-")
+                {
+                    names.push(entry_path.clone());
+                }
+                if metadata.is_dir() && !metadata.file_type().is_symlink() {
+                    collect(&entry_path, names);
+                }
+            }
+        }
+        let mut names = Vec::new();
+        collect(&self.root, &mut names);
+        assert!(
+            names.is_empty(),
+            "private staging residue remained: {names:?}"
+        );
+    }
+}
+
+fn question(id: &str) -> String {
+    format!(
+        r#"id: {id}
+question: Is the governed condition satisfied?
+purpose: eligibility
+subject:
+  role: subject
+  selector: reference
+  profile: subject-reference-v1
+source:
+  ref: registry
+answers:
+  - concept: allowed
+    id: urn:example:concepts:allowed
+    type: boolean
+derivation: derivations/{id}.rhai
+disclosure:
+  allow: [allowed]
+governance:
+  requirement: urn:example:requirements:allowed:v1
+  kind: criterion
+  referenceFrameworks: [urn:example:frameworks:allowed:v1]
+  evidenceType: urn:example:evidence-types:allowed:v1
+  validitySeconds: 300
+  observationTimezone: UTC
+  fixtures: fixtures/{id}.yaml
+  disclosureFamilies: [urn:example:disclosure-families:allowed]
+"#
+    )
+}
+
+fn replace(path: &Path, from: &str, to: &str) {
+    let contents = fs::read_to_string(path).expect("replace source reads");
+    assert!(contents.contains(from), "replacement source was present");
+    fs::write(path, contents.replacen(from, to, 1)).expect("replacement writes");
+}
+
+fn assert_success(output: &Output, label: &str) {
+    assert!(
+        output.status.success(),
+        "{label} failed\nstdout:\n{}\nstderr:\n{}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+}
+
+fn assert_failed(output: &Output, label: &str) {
+    assert!(
+        !output.status.success(),
+        "{label} unexpectedly succeeded\nstdout:\n{}",
+        String::from_utf8_lossy(&output.stdout)
+    );
+}
+
+fn assert_value_free(output: &Output) {
+    let mut diagnostic = output.stdout.clone();
+    diagnostic.extend_from_slice(&output.stderr);
+    for prohibited in [
+        SECRET_CANARY,
+        "synthetic-selector-canary",
+        "source-value-canary",
+    ] {
+        assert!(
+            !diagnostic
+                .windows(prohibited.len())
+                .any(|part| part == prohibited.as_bytes()),
+            "build diagnostic exposed protected test material"
+        );
+    }
+}
+
+fn stderr(output: &Output) -> String {
+    String::from_utf8_lossy(&output.stderr).into_owned()
+}
+
+fn assert_report(output: &Output, candidate: &Path) {
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert_eq!(
+        stdout,
+        format!(
+            "Bundle revision: {REVISION}\nCandidate: {}\nProvision secret:file/audit-hmac-key\nProvision secret:file/signing-private-jwk\nProvision secret:file/source-token\nProvision secret:file/subject-binding-hmac-key\nTarget runtime paths and production secret material remain unverified until `evidencectl doctor --project {}` and the target-host Evidence check.\n",
+            candidate.display(),
+            candidate.display(),
+        )
+    );
+}
+
+fn reported_revision(output: &Output) -> String {
+    String::from_utf8_lossy(&output.stdout)
+        .lines()
+        .find_map(|line| line.strip_prefix("Bundle revision: "))
+        .expect("revision report")
+        .to_owned()
+}
+
+fn snapshot(root: &Path) -> BTreeMap<PathBuf, Vec<u8>> {
+    fn visit(root: &Path, path: &Path, files: &mut BTreeMap<PathBuf, Vec<u8>>) {
+        let mut entries = fs::read_dir(path)
+            .expect("snapshot directory")
+            .map(|entry| entry.unwrap().path())
+            .collect::<Vec<_>>();
+        entries.sort();
+        for entry in entries {
+            let metadata = fs::symlink_metadata(&entry).unwrap();
+            assert!(!metadata.file_type().is_symlink());
+            if metadata.is_dir() {
+                visit(root, &entry, files);
+            } else {
+                files.insert(
+                    entry.strip_prefix(root).unwrap().to_path_buf(),
+                    fs::read(entry).unwrap(),
+                );
+            }
+        }
+    }
+    let mut files = BTreeMap::new();
+    visit(root, root, &mut files);
+    files
+}
+
+fn workspace_root() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .ancestors()
+        .nth(2)
+        .expect("workspace root")
+        .to_path_buf()
+}
+
+const SOURCE: &str = r#"transport: http-json
+baseUrl: https://registry.invalid
+posture: field-projected
+authentication: {kind: static-bearer, tokenRef: 'secret:file/source-token'}
+request:
+  method: POST
+  path: /v1/facts
+  fixedHeaders: [{name: Accept, value: application/json}]
+  selectorInputs:
+    - role: subject
+      alternatives:
+        - {profile: subject-reference-v1, fields: [reference]}
+  prepareScript: adapters/source-prepare.rhai
+  adapterParameters: {}
+  adapterParametersSchema: schemas/parameters.schema.yaml
+  preparationLimits: {query: forbidden, jsonBody: required, maximumJsonDepth: 4, maximumCollectionItems: 8, maximumStringBytes: 128, maximumNormalizedBytes: 1024}
+  projection: [/allowed]
+  redirects: deny
+  timeoutMilliseconds: 1000
+  maximumResponseBytes: 4096
+  concurrencyLimit: 1
+responseSchema: schemas/response.schema.yaml
+extractScript: adapters/source-extract.rhai
+factSchema: schemas/facts.schema.yaml
+"#;
+
+const GOVERNANCE: &str = r#"version: 1
+assuranceProfile: production
+service: {providerId: urn:example:providers:evidence, trustDomain: urn:example:trust-domains:evidence}
+issuer: {id: urn:example:issuers:evidence}
+authentication:
+  kind: oidc-access-token
+  issuer: https://issuer.invalid
+  audiences: [evidence]
+  tokenTypes: [at+jwt]
+  algorithms: [EdDSA]
+  jwksUri: https://issuer.invalid/.well-known/jwks.json
+  principalClaim: sub
+  requesterTagsClaim: evidence_tags
+  evidenceAudienceClaim: evidence_audience
+  grantIdClaim: evidence_grant_id
+  grantAuthorityClaim: evidence_authority
+audit: {format: keyed-jsonl, hashSecretRef: 'secret:file/audit-hmac-key', hashKeyVersion: 1, failClosed: true}
+subjectBinding: {secretRef: 'secret:file/subject-binding-hmac-key', keyVersion: 1}
+rateLimits: {requestsPerPrincipalPerMinute: 60, burstPerPrincipal: 10, failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 10}
+signing:
+  format: flattened-jws-json
+  algorithm: EdDSA
+  activeKeyId: production-key-1
+  activeKeyRef: secret:file/signing-private-jwk
+  retiredPublicJwkFiles: []
+  jwksPath: /.well-known/evidence/jwks.json
+  maximumAssertionValiditySeconds: 300
+  verifierClockSkewSeconds: 30
+responseFormats: [signed-jws]
+authorityProfiles:
+  requester:
+    kind: statutory
+    requesterTags: [requester]
+    grants:
+      - requirement: urn:example:requirements:allowed:v1
+        purpose: eligibility
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects: [{role: subject, selectorProfile: subject-reference-v1, valueOrigin: request}]
+"#;
+
+const TARGET_RUNTIME: &str = r#"version: 1
+bundleDirectory: /srv/evidence/candidate/bundle
+listener:
+  bindHost: 127.0.0.1
+  port: 8080
+  tlsTermination: operator-controlled-upstream
+  trustProxyIdentityHeaders: false
+  maximumRequestBytes: 65536
+  maximumConcurrentRequests: 8
+  requestTimeoutMilliseconds: 10000
+  shutdownGraceMilliseconds: 10000
+secretProviders:
+  file: {root: /run/secrets/evidence}
+auditStorage: {path: /var/lib/evidence/audit.jsonl, maximumFileBytes: 1048576}
+outboundTls: {systemRoots: true, trustProfiles: {}}
+"#;
+
+const FAKE_EVIDENCE: &str = r#"#!/bin/sh
+set -eu
+
+for arg in "$@"; do
+  printf '%s\n' "$arg" >> "$FAKE_EVIDENCE_LOG"
+done
+printf '%s\n' '===' >> "$FAKE_EVIDENCE_LOG"
+
+if [ "${FAKE_EVIDENCE_BLOCK:-}" = '1' ]; then
+  printf '%s\n' ready > "$FAKE_EVIDENCE_BLOCK_READY"
+  exec sleep 300
+fi
+
+fixture=''
+previous=''
+for arg in "$@"; do
+  if [ "$previous" = '--fixture' ]; then fixture=$arg; fi
+  previous=$arg
+done
+
+failure=${FAKE_EVIDENCE_FAIL:-}
+if [ "$failure" = 'check' ] && [ -z "$fixture" ]; then
+  printf '%s\n' 'production-build-secret-canary synthetic-selector-canary source-value-canary' >&2
+  exit 1
+fi
+if [ "$failure" = "fixture:$fixture" ]; then
+  printf '%s\n' 'production-build-secret-canary synthetic-selector-canary source-value-canary' >&2
+  exit 1
+fi
+
+if [ -z "$fixture" ]; then
+  printf '%s\n' 'Evidence deployment sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa / sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb passed check'
+else
+  printf '%s\n' 'Evidence fixture passed (1 evaluated cases)'
+fi
+"#;
diff --git a/crates/registry-evidencectl/tests/production_handoff.rs b/crates/registry-evidencectl/tests/production_handoff.rs
new file mode 100644
index 000000000..4853d7653
--- /dev/null
+++ b/crates/registry-evidencectl/tests/production_handoff.rs
@@ -0,0 +1,2187 @@
+#![cfg(unix)]
+
+//! Exact production-candidate handoff through the real adopter and runtime
+//! binaries. The gate is ignored in the ordinary package suite because it
+//! starts two services and requires `python3` and `openssl` on the host.
+
+use std::{
+    collections::BTreeMap,
+    fs::{self, File, OpenOptions},
+    io::{Read as _, Write as _},
+    net::{TcpListener, TcpStream},
+    os::unix::fs::{OpenOptionsExt as _, PermissionsExt as _},
+    path::{Path, PathBuf},
+    process::{Child, Command, Output, Stdio},
+    sync::OnceLock,
+    thread,
+    time::{Duration, Instant},
+};
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use chrono::Utc;
+use ed25519_dalek::{Signer as _, SigningKey};
+use serde_json::{json, Value};
+
+const AUTH_KEY_ID: &str = "acceptance-auth-key";
+const SIGNING_KEY_ID: &str = "production-signing-key-1";
+const TOKEN_AUDIENCE: &str = "registry-evidence-production-test";
+const EVIDENCE_AUDIENCE: &str = "https://relying.invalid/production-acceptance";
+const REQUIREMENT: &str = "urn:example:requirements:adult-status:v1";
+const EVIDENCE_TYPE: &str = "urn:example:evidence-types:adult-status:v1";
+const CONCEPT: &str = "urn:example:concepts:is-adult";
+const PURPOSE: &str = "fixture-eligibility";
+const SELECTOR_CANARY: &str = "synthetic-person-001";
+const AGE_REQUIREMENT: &str = "urn:example:requirements:age-bracket:v1";
+const AGE_CONCEPT: &str = "urn:example:concepts:age-bracket";
+const IMMUNIZATION_REQUIREMENT: &str = "urn:example:requirements:immunization-summary:v1";
+const SCHEDULE_CONCEPT: &str = "urn:example:concepts:schedule-complete";
+const DOSE_COUNT_CONCEPT: &str = "urn:example:concepts:dose-count";
+const RELATIONSHIP_REQUIREMENT: &str = "urn:example:requirements:parent-relationship:v1";
+const RELATIONSHIP_CONCEPT: &str = "urn:example:concepts:relationship-confirmed";
+
+#[test]
+#[ignore = "exact gate: starts real binaries plus local HTTPS issuer and source"]
+fn production_candidate_handoff_reaches_verified_assertion_and_audit() {
+    let fixture = Fixture::new();
+    let evidence = evidence_binary();
+    fixture.stage_authoring_project();
+    fixture.stage_https_identity();
+    fixture.stage_target();
+
+    let first = fixture.build(evidence);
+    let first_revision = bundle_revision(&first);
+    let first_bytes = snapshot_files(&fixture.candidate);
+    fs::rename(&fixture.candidate, &fixture.first_candidate)
+        .expect("archive the first create-only candidate");
+
+    let second = fixture.build(evidence);
+    let revision = bundle_revision(&second);
+    assert_eq!(
+        revision, first_revision,
+        "bundle revision must be repeatable"
+    );
+    assert_eq!(
+        snapshot_files(&fixture.candidate),
+        first_bytes,
+        "identical inputs and output binding must reproduce every candidate file byte"
+    );
+    assert_eq!(
+        fs::read(&fixture.target_runtime).expect("target runtime"),
+        fs::read(fixture.candidate.join("runtime.yaml")).expect("copied runtime"),
+        "the target runtime must be copied byte-for-byte"
+    );
+
+    fixture.provision_target_secrets();
+    assert_success(
+        evidencectl()
+            .args(["doctor", "--project"])
+            .arg(&fixture.candidate)
+            .output()
+            .expect("doctor starts"),
+        "target-host doctor",
+    );
+    assert_success(
+        evidencectl()
+            .args(["fixtures", "run", "--project"])
+            .arg(&fixture.candidate)
+            .arg("--evidence-bin")
+            .arg(evidence)
+            .output()
+            .expect("fixture driver starts"),
+        "target-host fixtures",
+    );
+    fixture.assert_compose_revision_distinction(evidence, &revision);
+
+    let mut https = fixture.start_https();
+    fixture.wait_for_https(&mut https);
+    let mut service = fixture.start_evidence(evidence);
+    fixture.wait_for_evidence(&mut service);
+
+    let token = fixture.access_token();
+    let nonce = URL_SAFE_NO_PAD.encode([0x42_u8; 32]);
+    let (status, response) = post_evidence(fixture.evidence_port, &token, &nonce);
+    if status != 200 {
+        let log = fs::read(fixture.root.join("evidence.log")).expect("Evidence diagnostic log");
+        let source_token = fs::read(&fixture.source_token).expect("source token");
+        for prohibited in [
+            token.as_bytes(),
+            source_token.as_slice(),
+            SELECTOR_CANARY.as_bytes(),
+        ] {
+            assert!(
+                !log.windows(prohibited.len()).any(|part| part == prohibited),
+                "Evidence diagnostic leaked protected request or credential data"
+            );
+        }
+        panic!(
+            "Evidence request returned HTTP {status}, not HTTP 200; value-free log:\n{}",
+            String::from_utf8_lossy(&log)
+        );
+    }
+    fs::write(&fixture.response, &response).expect("retain signed response");
+    fs::set_permissions(&fixture.response, fs::Permissions::from_mode(0o600))
+        .expect("protect retained response");
+    assert!(
+        fixture.source_marker.is_file(),
+        "the real request must reach the authenticated HTTPS source"
+    );
+
+    let payload = signed_payload(&response);
+    assert_eq!(payload["assuranceProfile"], "production");
+    assert_eq!(payload["configurationRevision"], revision);
+    assert_eq!(payload["supportedValues"][0]["providesValueFor"], CONCEPT);
+    assert_eq!(payload["supportedValues"][0]["value"], true);
+    let payload_bytes = serde_json::to_vec(&payload).expect("payload serializes");
+    for prohibited in [
+        b"date_of_birth".as_slice(),
+        SELECTOR_CANARY.as_bytes(),
+        token.as_bytes(),
+    ] {
+        assert!(
+            !payload_bytes
+                .windows(prohibited.len())
+                .any(|part| part == prohibited),
+            "signed payload retained protected source or selector data"
+        );
+    }
+    let source_token = fs::read(&fixture.source_token).expect("source token");
+    assert!(
+        !payload_bytes
+            .windows(source_token.len())
+            .any(|part| part == source_token),
+        "signed payload retained a source credential"
+    );
+
+    fixture.write_verification_policy(&payload, &nonce, &revision);
+    assert_success(
+        Command::new(evidence)
+            .arg("verify")
+            .arg("--jws")
+            .arg(&fixture.response)
+            .arg("--jwks")
+            .arg(&fixture.evidence_jwks)
+            .arg("--policy")
+            .arg(&fixture.policy)
+            .output()
+            .expect("offline verifier starts"),
+        "independent production verification policy",
+    );
+
+    let audit = wait_for_audit(&fixture.audit_path);
+    assert_audit_contract(
+        &audit,
+        &revision,
+        &[source_token.as_slice(), token.as_bytes()],
+    );
+    stop_gracefully(&mut service, "Evidence");
+    stop_forcefully(&mut https);
+    assert_success(
+        Command::new(evidence)
+            .arg("--runtime")
+            .arg(fixture.candidate.join("runtime.yaml"))
+            .arg("verify-audit")
+            .output()
+            .expect("audit verifier starts"),
+        "complete audit-chain verification",
+    );
+}
+
+#[test]
+#[ignore = "exact gate: starts real Mint and Evidence plus local HTTPS routing"]
+fn production_candidate_accepts_a_token_from_an_independent_real_mint() {
+    let fixture = Fixture::new();
+    let evidence = evidence_binary();
+    let mint = mint_binary();
+    fixture.stage_authoring_project();
+    fixture.stage_https_identity();
+    fixture.stage_target();
+    let build = fixture.build(evidence);
+    let revision = bundle_revision(&build);
+    fixture.provision_target_secrets();
+    let mint_deployment = fixture.stage_mint();
+
+    assert_success(
+        Command::new(mint)
+            .args(["check", "--config"])
+            .arg(&mint_deployment.config)
+            .output()
+            .expect("Mint check starts"),
+        "real Mint deployment check",
+    );
+    assert_success(
+        evidencectl()
+            .args(["doctor", "--project"])
+            .arg(&fixture.candidate)
+            .arg("--mint-config")
+            .arg(&mint_deployment.config)
+            .output()
+            .expect("paired doctor starts"),
+        "paired Evidence and Mint doctor",
+    );
+
+    let mut https = fixture.start_https();
+    fixture.wait_for_https(&mut https);
+    let mut mint_service = fixture.start_mint(mint, &mint_deployment.config);
+    wait_for_listener(&mut mint_service, fixture.mint_port, "Mint");
+    let mut evidence_service = fixture.start_evidence(evidence);
+    fixture.wait_for_evidence(&mut evidence_service);
+
+    let public_token_endpoint = format!("https://127.0.0.1:{}/token", fixture.https_port);
+    let token_output = Command::new(mint)
+        .arg("token")
+        .arg("--url")
+        .arg(&public_token_endpoint)
+        .arg("--audience")
+        .arg(public_token_endpoint)
+        .args(["--client-id", "acceptance-client", "--key"])
+        .arg(&mint_deployment.caller_private)
+        .arg("--ca-certificate")
+        .arg(&fixture.ca)
+        .output()
+        .expect("Mint token starts");
+    assert!(
+        token_output.status.success(),
+        "Mint token failed without printing a token: {}",
+        String::from_utf8_lossy(&token_output.stderr)
+    );
+    let token = String::from_utf8(token_output.stdout).expect("Mint token stdout");
+    assert_eq!(
+        token.lines().count(),
+        1,
+        "Mint prints exactly one token line"
+    );
+    let token = token.trim();
+
+    let nonce = URL_SAFE_NO_PAD.encode([0x24_u8; 32]);
+    let (status, response) = post_evidence(fixture.evidence_port, token, &nonce);
+    assert_eq!(status, 200, "a real Mint token must authorize Evidence");
+    fs::write(&fixture.response, &response).expect("retain Mint-backed response");
+    fs::set_permissions(&fixture.response, fs::Permissions::from_mode(0o600))
+        .expect("protect Mint-backed response");
+    let payload = signed_payload(&response);
+    assert_eq!(payload["assuranceProfile"], "production");
+    assert_eq!(payload["configurationRevision"], revision);
+    assert_eq!(payload["supportedValues"][0]["providesValueFor"], CONCEPT);
+    assert_eq!(payload["supportedValues"][0]["value"], true);
+    assert!(
+        !serde_json::to_vec(&payload)
+            .expect("Mint-backed payload serializes")
+            .windows(token.len())
+            .any(|part| part == token.as_bytes()),
+        "signed payload retained the Mint access token"
+    );
+
+    fixture.write_verification_policy(&payload, &nonce, &revision);
+    assert_success(
+        Command::new(evidence)
+            .arg("verify")
+            .arg("--jws")
+            .arg(&fixture.response)
+            .arg("--jwks")
+            .arg(&fixture.evidence_jwks)
+            .arg("--policy")
+            .arg(&fixture.policy)
+            .output()
+            .expect("Mint-backed response verifier starts"),
+        "Mint-backed independent response verification",
+    );
+    let source_token = fs::read(&fixture.source_token).expect("source token");
+    assert_audit_contract(
+        &wait_for_audit(&fixture.audit_path),
+        &revision,
+        &[source_token.as_slice(), token.as_bytes()],
+    );
+
+    stop_gracefully(&mut evidence_service, "Evidence");
+    stop_gracefully(&mut mint_service, "Mint");
+    stop_forcefully(&mut https);
+    assert_success(
+        Command::new(evidence)
+            .arg("--runtime")
+            .arg(fixture.candidate.join("runtime.yaml"))
+            .arg("verify-audit")
+            .output()
+            .expect("Mint-backed audit verifier starts"),
+        "Mint-backed complete audit-chain verification",
+    );
+}
+
+#[test]
+#[ignore = "exact gate: runs the real production builder across all four authoring shapes"]
+fn production_build_checks_and_evaluates_every_neutral_authoring_shape() {
+    let fixture = Fixture::new();
+    let evidence = evidence_binary();
+    fixture.stage_authoring_project();
+    fixture.stage_four_shape_project();
+    fixture.stage_target();
+    fixture.authorize_four_shapes();
+
+    let output = fixture.build(evidence);
+    let revision = bundle_revision(&output);
+    fixture.provision_target_secrets();
+    let (checked_revision, _) = check_revisions(
+        evidence,
+        &fixture.candidate.join("runtime.yaml"),
+        "published four-shape production check",
+    );
+    assert_eq!(checked_revision, revision);
+
+    let bundle: Value = serde_norway::from_slice(
+        &fs::read(fixture.candidate.join("bundle/evidence.yaml")).expect("four-shape bundle"),
+    )
+    .expect("four-shape bundle parses");
+    assert_eq!(bundle["assuranceProfile"], "production");
+    let requirements = bundle["requirements"]
+        .as_array()
+        .expect("compiled requirements");
+    assert_eq!(requirements.len(), 4);
+    let requirements = requirements
+        .iter()
+        .map(|requirement| {
+            (
+                requirement["id"]
+                    .as_str()
+                    .expect("stable requirement identifier"),
+                requirement,
+            )
+        })
+        .collect::<BTreeMap<_, _>>();
+
+    assert_requirement_forms(&requirements, REQUIREMENT, &["boolean"], 1);
+    assert_requirement_forms(&requirements, AGE_REQUIREMENT, &["controlled-category"], 1);
+    assert_requirement_forms(
+        &requirements,
+        IMMUNIZATION_REQUIREMENT,
+        &["boolean", "bounded-integer"],
+        1,
+    );
+    assert_requirement_forms(&requirements, RELATIONSHIP_REQUIREMENT, &["boolean"], 2);
+    for fixture_path in [
+        "adult-status.yaml",
+        "age-bracket.yaml",
+        "immunization-summary.yaml",
+        "parent-relationship.yaml",
+    ] {
+        assert!(
+            fixture
+                .candidate
+                .join("bundle/fixtures")
+                .join(fixture_path)
+                .is_file(),
+            "the production candidate must capture fixture {fixture_path}"
+        );
+    }
+    let age_codelist = requirements[AGE_REQUIREMENT]["concepts"][0]["constraints"]["codelist"]
+        .as_str()
+        .expect("compiled controlled-category codelist path");
+    assert!(
+        fixture
+            .candidate
+            .join("bundle")
+            .join(age_codelist)
+            .is_file(),
+        "the governed controlled-category codelist must be captured"
+    );
+}
+
+#[test]
+#[ignore = "exact gate: starts and stops real local Evidence and Mint before production build"]
+fn public_lifecycle_keeps_local_dev_state_out_of_the_production_candidate() {
+    let fixture = Fixture::new();
+    let evidence = evidence_binary();
+    let mint = mint_binary();
+    let retained_openapi = fixture.root.join("lifecycle.openapi.yaml");
+    fs::write(
+        &retained_openapi,
+        "openapi: 3.1.0\ninfo: {title: Lifecycle source, version: 1.0.0}\npaths: {}\n",
+    )
+    .expect("lifecycle OpenAPI");
+
+    assert_success(
+        evidencectl()
+            .arg("new")
+            .arg(&fixture.project)
+            .arg("--openapi")
+            .arg(&retained_openapi)
+            .args(["--profile", "local", "--generate-keys"])
+            .output()
+            .expect("public new starts"),
+        "public new",
+    );
+    assert!(!fixture.project.join(".evidence").exists());
+    fixture.stage_local_project_without_governance();
+    assert_success(
+        evidencectl()
+            .args(["keygen", "token", "--out"])
+            .arg(fixture.project.join("secrets/source-token"))
+            .output()
+            .expect("local source token keygen starts"),
+        "local source token keygen",
+    );
+
+    let started = assert_success(
+        evidencectl()
+            .args(["dev", "--detach", "--project"])
+            .arg(&fixture.project)
+            .arg("--evidence-bin")
+            .arg(evidence)
+            .arg("--mint-bin")
+            .arg(mint)
+            .args(["--evidence-port", &fixture.evidence_port.to_string()])
+            .args(["--mint-port", &fixture.mint_port.to_string()])
+            .args(["--ready-timeout-seconds", "20"])
+            .output()
+            .expect("public dev starts"),
+        "public dev with omitted governance",
+    );
+    let mut stop_guard = DevStopGuard::new(&fixture.project);
+    let started_stdout = String::from_utf8(started.stdout).expect("dev stdout");
+    assert!(started_stdout.contains(&format!(
+        "Evidence ready at http://127.0.0.1:{}",
+        fixture.evidence_port
+    )));
+    assert!(started_stdout.contains(&format!(
+        "Mint ready at http://127.0.0.1:{}",
+        fixture.mint_port
+    )));
+    let dev_root = fixture.project.join(".evidence/dev");
+    let local_bundle = fs::read(dev_root.join("bundle/evidence.yaml")).expect("local dev bundle");
+    assert!(
+        local_bundle
+            .windows(b"urn:registrystack:evidence:local:".len())
+            .any(|part| part == b"urn:registrystack:evidence:local:"),
+        "the governance-free dev generation must use disposable local identifiers"
+    );
+    assert_success(
+        evidencectl()
+            .args(["dev", "stop", "--project"])
+            .arg(&fixture.project)
+            .output()
+            .expect("public dev stop starts"),
+        "public dev stop",
+    );
+    stop_guard.disarm();
+    assert!(dev_root.join("state.json").is_file());
+    let stopped_dev = snapshot_files(&dev_root);
+
+    fixture.stage_authoring_project();
+    fixture.stage_target();
+    let governed_question = fs::read_to_string(fixture.project.join("questions/adult-status.yaml"))
+        .expect("governed question");
+    assert!(governed_question.contains(&format!("  requirement: {REQUIREMENT}")));
+    assert!(governed_question.contains(&format!("    id: {CONCEPT}")));
+    assert!(fixture.project.join("fixtures/adult-status.yaml").is_file());
+
+    let local_source_token =
+        fs::read(fixture.project.join("secrets/source-token")).expect("local source token");
+    let build = fixture.build(evidence);
+    bundle_revision(&build);
+    assert_eq!(
+        snapshot_files(&dev_root),
+        stopped_dev,
+        "production build must neither consume nor mutate stopped local state"
+    );
+    let candidate = snapshot_files(&fixture.candidate);
+    for (path, bytes) in &candidate {
+        assert!(
+            !path.to_string_lossy().contains(".evidence"),
+            "production candidate captured local state at {}",
+            path.display()
+        );
+        assert!(
+            !bytes
+                .windows(b"urn:registrystack:evidence:local:".len())
+                .any(|part| part == b"urn:registrystack:evidence:local:"),
+            "production candidate retained a disposable local identifier in {}",
+            path.display()
+        );
+        assert!(
+            !bytes
+                .windows(local_source_token.len())
+                .any(|part| part == local_source_token),
+            "production candidate copied local secret material into {}",
+            path.display()
+        );
+    }
+    let production_bundle =
+        fs::read(fixture.candidate.join("bundle/evidence.yaml")).expect("production bundle");
+    assert!(
+        production_bundle
+            .windows(REQUIREMENT.len())
+            .any(|part| part == REQUIREMENT.as_bytes()),
+        "production candidate must use the newly added stable governance"
+    );
+
+    assert_success(
+        evidencectl()
+            .args(["dev", "clean", "--project"])
+            .arg(&fixture.project)
+            .output()
+            .expect("public dev clean starts"),
+        "public dev clean",
+    );
+}
+
+struct DevStopGuard {
+    project: PathBuf,
+    active: bool,
+}
+
+impl DevStopGuard {
+    fn new(project: &Path) -> Self {
+        Self {
+            project: project.to_owned(),
+            active: true,
+        }
+    }
+
+    fn disarm(&mut self) {
+        self.active = false;
+    }
+}
+
+impl Drop for DevStopGuard {
+    fn drop(&mut self) {
+        if self.active {
+            let _ = evidencectl()
+                .args(["dev", "stop", "--project"])
+                .arg(&self.project)
+                .output();
+        }
+    }
+}
+
+struct MintDeployment {
+    config: PathBuf,
+    caller_private: PathBuf,
+}
+
+struct Fixture {
+    temporary: tempfile::TempDir,
+    root: PathBuf,
+    project: PathBuf,
+    target: PathBuf,
+    target_runtime: PathBuf,
+    candidate: PathBuf,
+    first_candidate: PathBuf,
+    secrets: PathBuf,
+    audit_path: PathBuf,
+    ca: PathBuf,
+    tls_cert: PathBuf,
+    tls_key: PathBuf,
+    oidc_private: PathBuf,
+    oidc_jwks: PathBuf,
+    source_token: PathBuf,
+    source_marker: PathBuf,
+    https_ready: PathBuf,
+    response: PathBuf,
+    evidence_jwks: PathBuf,
+    policy: PathBuf,
+    https_port: u16,
+    evidence_port: u16,
+    mint_port: u16,
+}
+
+impl Fixture {
+    fn new() -> Self {
+        // macOS exposes its default temporary root through `/var`, which is a
+        // symlink. Production build correctly refuses that ancestry, so keep
+        // the exact gate under the workspace's already-created target tree.
+        let temporary = tempfile::Builder::new()
+            .prefix("production-handoff-")
+            .tempdir_in(workspace_root().join("target"))
+            .expect("acceptance tempdir");
+        let root = temporary.path().to_path_buf();
+        let project = root.join("authoring");
+        let target = project.join("deployment-targets/production");
+        let candidate = root.join("candidate");
+        let secrets = root.join("production-secrets");
+        let ports = free_ports(3);
+        Self {
+            target_runtime: target.join("runtime.yaml"),
+            first_candidate: root.join("first-candidate"),
+            audit_path: root.join("audit/evidence.jsonl"),
+            ca: root.join("tls/ca.pem"),
+            tls_cert: root.join("tls/server.pem"),
+            tls_key: root.join("tls/server.key"),
+            oidc_private: root.join("oidc-private/signing-ed25519-private-jwk"),
+            oidc_jwks: root.join("oidc.jwks.json"),
+            source_token: secrets.join("source-token"),
+            source_marker: root.join("source-requested"),
+            https_ready: root.join("https-ready"),
+            response: root.join("response.jws.json"),
+            evidence_jwks: root.join("evidence.jwks.json"),
+            policy: root.join("verification-policy.yaml"),
+            https_port: ports[0],
+            evidence_port: ports[1],
+            mint_port: ports[2],
+            temporary,
+            root,
+            project,
+            target,
+            candidate,
+            secrets,
+        }
+    }
+
+    fn stage_authoring_project(&self) {
+        for directory in [
+            "selectors",
+            "sources",
+            "adapters",
+            "schemas",
+            "questions",
+            "derivations",
+            "fixtures",
+        ] {
+            fs::create_dir_all(self.project.join(directory)).expect("authoring directory");
+        }
+        fs::write(
+            self.project.join("source.openapi.yaml"),
+            "openapi: 3.1.0\ninfo: {title: Acceptance source, version: 1.0.0}\npaths: {}\n",
+        )
+        .expect("OpenAPI");
+        fs::write(
+            self.project.join("selectors/person-reference-v1.yaml"),
+            "maximumAggregateBytes: 200\nfields:\n  person_id: {type: string, minimumBytes: 1, maximumBytes: 200}\n",
+        )
+        .expect("selector");
+        let source_origin = format!("https://127.0.0.1:{}", self.https_port);
+        fs::write(
+            self.project.join("sources/people.yaml"),
+            format!(
+                r#"transport: http-json
+baseUrl: {source_origin}
+posture: field-projected
+authentication: {{kind: static-bearer, tokenRef: 'secret:file/source-token'}}
+request:
+  method: POST
+  path: /v1/facts
+  fixedHeaders: [{{name: Accept, value: application/json}}]
+  selectorInputs:
+    - role: subject
+      alternatives:
+        - {{profile: person-reference-v1, fields: [person_id]}}
+  prepareScript: adapters/people-prepare.rhai
+  adapterParameters: {{requestedFields: [date_of_birth], resultLimit: 2}}
+  adapterParametersSchema: schemas/people-parameters.schema.yaml
+  preparationLimits: {{query: forbidden, jsonBody: required, maximumJsonDepth: 8, maximumCollectionItems: 16, maximumStringBytes: 256, maximumNormalizedBytes: 4096}}
+  projection: [/total, /date_of_birth]
+  redirects: deny
+  timeoutMilliseconds: 3000
+  maximumResponseBytes: 65536
+  concurrencyLimit: 8
+responseSchema: schemas/people-response.schema.yaml
+extractScript: adapters/people-extract.rhai
+factSchema: schemas/people-facts.schema.yaml
+"#
+            ),
+        )
+        .expect("source");
+        for (path, contents) in [
+            (
+                "adapters/people-prepare.rhai",
+                r#"fn prepare(selectors, parameters) {
+    #{
+        query: [],
+        body: #{
+            lookup: #{person_id: selectors["subject"]["values"]["person_id"]},
+            fields: parameters["requestedFields"],
+            limit: parameters["resultLimit"]
+        }
+    }
+}
+"#,
+            ),
+            (
+                "adapters/people-extract.rhai",
+                r#"fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    if total == 0 { return #{outcome: "no_match"}; }
+    if total > 1 { return #{outcome: "ambiguous"}; }
+    let value = get_path(source_response, "/date_of_birth");
+    if is_missing(value) { return #{outcome: "match", facts: #{}}; }
+    #{outcome: "match", facts: #{date_of_birth: value}}
+}
+"#,
+            ),
+            (
+                "schemas/people-parameters.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: [requestedFields, resultLimit]\nproperties:\n  requestedFields: {const: [date_of_birth]}\n  resultLimit: {const: 2}\n",
+            ),
+            (
+                "schemas/people-response.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: [total]\nproperties:\n  total: {type: integer, minimum: 0, maximum: 1000000}\n  date_of_birth: {type: string, format: date}\n",
+            ),
+            (
+                "schemas/people-facts.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: [date_of_birth]\nproperties:\n  date_of_birth: {type: string, format: date}\n",
+            ),
+        ] {
+            fs::write(self.project.join(path), contents).expect("source artifact");
+        }
+        fs::write(
+            self.project.join("questions/adult-status.yaml"),
+            format!(
+                r#"id: adult-status
+question: Is the person at least 18 years old?
+purpose: {PURPOSE}
+subject:
+  role: subject
+  selector: person_id
+  profile: person-reference-v1
+source:
+  ref: people
+answers:
+  - concept: is_adult
+    id: {CONCEPT}
+    type: boolean
+derivation: derivations/adult-status.rhai
+disclosure:
+  allow: [is_adult]
+governance:
+  requirement: {REQUIREMENT}
+  kind: criterion
+  referenceFrameworks: [urn:example:frameworks:adult-status:v1]
+  evidenceType: {EVIDENCE_TYPE}
+  validitySeconds: 86400
+  observationTimezone: Asia/Bangkok
+  fixtures: fixtures/adult-status.yaml
+  disclosureFamilies: [urn:example:disclosure-families:adult-status]
+"#
+            ),
+        )
+        .expect("question");
+        fs::write(
+            self.project.join("derivations/adult-status.rhai"),
+            r#"fn answer(facts, selectors, context) {
+    let born = parse_date(required(facts.date_of_birth, "date_of_birth_missing"));
+    #{is_adult: compare_dates(context.legal_local_date, add_calendar_years(born, 18)) >= 0}
+}
+"#,
+        )
+        .expect("derivation");
+        fs::write(
+            self.project.join("fixtures/adult-status.yaml"),
+            format!(
+                r#"fixture: registry.evidence.acceptance.production-handoff/v1
+coequal_acceptance_definition: true
+synthetic_only: true
+common:
+  observed_at: '2026-08-02T00:00:00Z'
+  legal_local_date: '2026-08-02'
+  selector: {{person_id: {SELECTOR_CANARY}}}
+  selectors:
+    subject: {{profile: person-reference-v1, values: {{person_id: {SELECTOR_CANARY}}}}}
+  expectedRequestParts:
+    query: []
+    body: {{lookup: {{person_id: {SELECTOR_CANARY}}}, fields: [date_of_birth], limit: 2}}
+  expectedTransport:
+    path: /v1/facts
+    fixedHeaders: [{{name: Accept, value: application/json}}]
+cases:
+  - {{id: positive, source: {{total: 1, date_of_birth: '2000-01-01'}}, expected_value: true, expected_lookup: match, derivation_runs: true, signed_success: true}}
+  - {{id: negative-false-is-success, source: {{total: 1, date_of_birth: '2010-01-01'}}, expected_value: false, expected_lookup: match, derivation_runs: true, signed_success: true}}
+  - {{id: boundary-on, legal_local_date: '2026-08-02', source: {{total: 1, date_of_birth: '2008-08-02'}}, expected_value: true, expected_lookup: match, derivation_runs: true, signed_success: true}}
+  - {{id: missing-fact, source: {{total: 1}}, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}}
+  - {{id: no-match, source: {{total: 0}}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}}
+  - {{id: ambiguous, source: {{total: 2}}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}}
+  - {{id: source-failure, source_failure: timeout, expected_public_problem: dependency_unavailable, signed_success: false}}
+  - {{id: negative-wrong-derived-type, injected_derivation: [{{concept_id: {CONCEPT}, value: 'true'}}], expected: output-gate-rejection}}
+  - {{id: anti-reconstruction, companion_bundle: threshold-ladder, expected: bundle-rejection}}
+privacy_expectation:
+  evidence_contains: [{CONCEPT}]
+  evidence_excludes: [date_of_birth, person_id]
+  diagnostics_exclude: [{SELECTOR_CANARY}, fixture-source-canary]
+"#
+            ),
+        )
+        .expect("fixture");
+    }
+
+    fn stage_local_project_without_governance(&self) {
+        self.stage_authoring_project();
+        let question_path = self.project.join("questions/adult-status.yaml");
+        let question = fs::read_to_string(&question_path).expect("governed adult question");
+        let governance = question
+            .find("governance:\n")
+            .expect("adult question governance block");
+        let question = question[..governance].replace(&format!("    id: {CONCEPT}\n"), "");
+        fs::write(&question_path, question).expect("governance-free local question");
+        fs::remove_file(self.project.join("fixtures/adult-status.yaml"))
+            .expect("withhold production fixture during local dev");
+        assert!(
+            !fs::read_to_string(question_path)
+                .expect("local question")
+                .contains("governance:"),
+            "local dev must begin before stable governance exists"
+        );
+    }
+
+    fn stage_four_shape_project(&self) {
+        for (profile, field) in [
+            ("child-reference-v1", "child_id"),
+            ("candidate-reference-v1", "candidate_id"),
+        ] {
+            fs::write(
+                self.project.join(format!("selectors/{profile}.yaml")),
+                format!(
+                    "maximumAggregateBytes: 200\nfields:\n  {field}: {{type: string, minimumBytes: 1, maximumBytes: 200}}\n"
+                ),
+            )
+            .expect("role-bound selector");
+        }
+
+        let source_origin = format!("https://127.0.0.1:{}", self.https_port);
+        fs::write(
+            self.project.join("sources/immunizations.yaml"),
+            format!(
+                r#"transport: http-json
+baseUrl: {source_origin}
+posture: field-projected
+authentication: {{kind: static-bearer, tokenRef: 'secret:file/source-token'}}
+request:
+  method: POST
+  path: /v1/immunizations
+  fixedHeaders: [{{name: Accept, value: application/json}}]
+  selectorInputs:
+    - role: subject
+      alternatives:
+        - {{profile: person-reference-v1, fields: [person_id]}}
+  prepareScript: adapters/immunizations-prepare.rhai
+  adapterParameters: {{requestedFields: [dose_count], resultLimit: 2}}
+  adapterParametersSchema: schemas/immunizations-parameters.schema.yaml
+  preparationLimits: {{query: forbidden, jsonBody: required, maximumJsonDepth: 8, maximumCollectionItems: 16, maximumStringBytes: 256, maximumNormalizedBytes: 4096}}
+  projection: [/total, /dose_count]
+  redirects: deny
+  timeoutMilliseconds: 3000
+  maximumResponseBytes: 65536
+  concurrencyLimit: 8
+responseSchema: schemas/immunizations-response.schema.yaml
+extractScript: adapters/immunizations-extract.rhai
+factSchema: schemas/immunizations-facts.schema.yaml
+"#
+            ),
+        )
+        .expect("immunization source");
+        fs::write(
+            self.project.join("sources/relationships.yaml"),
+            format!(
+                r#"transport: http-json
+baseUrl: {source_origin}
+posture: field-projected
+authentication: {{kind: static-bearer, tokenRef: 'secret:file/source-token'}}
+request:
+  method: POST
+  path: /v1/relationships
+  fixedHeaders: [{{name: Accept, value: application/json}}]
+  selectorInputs:
+    - role: child
+      alternatives:
+        - {{profile: child-reference-v1, fields: [child_id]}}
+    - role: candidate-parent
+      alternatives:
+        - {{profile: candidate-reference-v1, fields: [candidate_id]}}
+  prepareScript: adapters/relationships-prepare.rhai
+  adapterParameters: {{requestedFields: [relationship_confirmed], resultLimit: 2}}
+  adapterParametersSchema: schemas/relationships-parameters.schema.yaml
+  preparationLimits: {{query: forbidden, jsonBody: required, maximumJsonDepth: 8, maximumCollectionItems: 16, maximumStringBytes: 256, maximumNormalizedBytes: 4096}}
+  projection: [/total, /relationship_confirmed]
+  redirects: deny
+  timeoutMilliseconds: 3000
+  maximumResponseBytes: 65536
+  concurrencyLimit: 8
+responseSchema: schemas/relationships-response.schema.yaml
+extractScript: adapters/relationships-extract.rhai
+factSchema: schemas/relationships-facts.schema.yaml
+"#
+            ),
+        )
+        .expect("relationship source");
+
+        for (path, contents) in [
+            (
+                "adapters/immunizations-prepare.rhai",
+                r#"fn prepare(selectors, parameters) {
+    #{
+        query: [],
+        body: #{
+            lookup: #{person_id: selectors["subject"]["values"]["person_id"]},
+            fields: parameters["requestedFields"],
+            limit: parameters["resultLimit"]
+        }
+    }
+}
+"#,
+            ),
+            (
+                "adapters/immunizations-extract.rhai",
+                r#"fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    if total == 0 { return #{outcome: "no_match"}; }
+    if total > 1 { return #{outcome: "ambiguous"}; }
+    let value = get_path(source_response, "/dose_count");
+    if is_missing(value) { return #{outcome: "match", facts: #{}}; }
+    #{outcome: "match", facts: #{dose_count: value}}
+}
+"#,
+            ),
+            (
+                "adapters/relationships-prepare.rhai",
+                r#"fn prepare(selectors, parameters) {
+    #{
+        query: [],
+        body: #{
+            lookup: #{
+                child_id: selectors["child"]["values"]["child_id"],
+                candidate_id: selectors["candidate-parent"]["values"]["candidate_id"]
+            },
+            fields: parameters["requestedFields"],
+            limit: parameters["resultLimit"]
+        }
+    }
+}
+"#,
+            ),
+            (
+                "adapters/relationships-extract.rhai",
+                r#"fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    if total == 0 { return #{outcome: "no_match"}; }
+    if total > 1 { return #{outcome: "ambiguous"}; }
+    let value = get_path(source_response, "/relationship_confirmed");
+    if is_missing(value) { return #{outcome: "match", facts: #{}}; }
+    #{outcome: "match", facts: #{relationship_confirmed: value}}
+}
+"#,
+            ),
+            (
+                "schemas/immunizations-parameters.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: [requestedFields, resultLimit]\nproperties:\n  requestedFields: {const: [dose_count]}\n  resultLimit: {const: 2}\n",
+            ),
+            (
+                "schemas/immunizations-response.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: [total]\nproperties:\n  total: {type: integer, minimum: 0, maximum: 1000000}\n  dose_count: {type: integer, minimum: 0, maximum: 20}\n",
+            ),
+            (
+                "schemas/immunizations-facts.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: [dose_count]\nproperties:\n  dose_count: {type: integer, minimum: 0, maximum: 20}\n",
+            ),
+            (
+                "schemas/relationships-parameters.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: [requestedFields, resultLimit]\nproperties:\n  requestedFields: {const: [relationship_confirmed]}\n  resultLimit: {const: 2}\n",
+            ),
+            (
+                "schemas/relationships-response.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: [total]\nproperties:\n  total: {type: integer, minimum: 0, maximum: 1000000}\n  relationship_confirmed: {type: boolean}\n",
+            ),
+            (
+                "schemas/relationships-facts.schema.yaml",
+                "type: object\nadditionalProperties: false\nrequired: [relationship_confirmed]\nproperties:\n  relationship_confirmed: {type: boolean}\n",
+            ),
+        ] {
+            fs::write(self.project.join(path), contents).expect("four-shape source artifact");
+        }
+
+        self.stage_four_shape_questions();
+        self.stage_four_shape_fixtures();
+    }
+
+    fn stage_four_shape_questions(&self) {
+        for (path, contents) in [
+            (
+                "questions/age-bracket.yaml",
+                format!(
+                    r#"id: age-bracket
+question: Which governed age bracket contains this person?
+purpose: service-path-selection
+subject:
+  role: subject
+  selector: person_id
+  profile: person-reference-v1
+source:
+  ref: people
+answers:
+  - concept: age_bracket
+    id: {AGE_CONCEPT}
+    type: controlled-category
+    values: [under-18, 18-to-24, 25-to-64, 65-or-older]
+derivation: derivations/age-bracket.rhai
+disclosure:
+  allow: [age_bracket]
+governance:
+  requirement: {AGE_REQUIREMENT}
+  kind: information-requirement
+  referenceFrameworks: [urn:example:frameworks:age-bracket:v1]
+  evidenceType: urn:example:evidence-types:age-bracket:v1
+  validitySeconds: 86400
+  observationTimezone: Asia/Bangkok
+  fixtures: fixtures/age-bracket.yaml
+  disclosureFamilies: [urn:example:disclosure-families:age-bracket]
+"#
+                ),
+            ),
+            (
+                "questions/immunization-summary.yaml",
+                format!(
+                    r#"id: immunization-summary
+question: Is the schedule complete, and how many doses are recorded?
+purpose: care-coordination
+subject:
+  role: subject
+  selector: person_id
+  profile: person-reference-v1
+source:
+  ref: immunizations
+answers:
+  - concept: schedule_complete
+    id: {SCHEDULE_CONCEPT}
+    type: boolean
+  - concept: dose_count
+    id: {DOSE_COUNT_CONCEPT}
+    type: bounded-integer
+    minimum: 0
+    maximum: 20
+derivation: derivations/immunization-summary.rhai
+disclosure:
+  allow: [schedule_complete, dose_count]
+governance:
+  requirement: {IMMUNIZATION_REQUIREMENT}
+  kind: information-requirement
+  referenceFrameworks: [urn:example:frameworks:immunization-summary:v1]
+  evidenceType: urn:example:evidence-types:immunization-summary:v1
+  validitySeconds: 86400
+  observationTimezone: Asia/Bangkok
+  fixtures: fixtures/immunization-summary.yaml
+  disclosureFamilies: [urn:example:disclosure-families:immunization-summary]
+"#
+                ),
+            ),
+            (
+                "questions/parent-relationship.yaml",
+                format!(
+                    r#"id: parent-relationship
+question: Is the candidate registered as a parent of the child?
+purpose: relationship-check
+subjects:
+  - role: child
+    selector: child_id
+    profile: child-reference-v1
+  - role: candidate-parent
+    selector: candidate_id
+    profile: candidate-reference-v1
+source:
+  ref: relationships
+answers:
+  - concept: relationship_confirmed
+    id: {RELATIONSHIP_CONCEPT}
+    type: boolean
+derivation: derivations/parent-relationship.rhai
+disclosure:
+  allow: [relationship_confirmed]
+governance:
+  requirement: {RELATIONSHIP_REQUIREMENT}
+  kind: criterion
+  referenceFrameworks: [urn:example:frameworks:parent-relationship:v1]
+  evidenceType: urn:example:evidence-types:parent-relationship:v1
+  validitySeconds: 86400
+  observationTimezone: Asia/Bangkok
+  fixtures: fixtures/parent-relationship.yaml
+  disclosureFamilies: [urn:example:disclosure-families:parent-relationship]
+"#
+                ),
+            ),
+        ] {
+            fs::write(self.project.join(path), contents).expect("four-shape question");
+        }
+        for (path, contents) in [
+            (
+                "derivations/age-bracket.rhai",
+                r#"fn answer(facts, selectors, context) {
+    let born = parse_date(required(facts.date_of_birth, "date_of_birth_missing"));
+    if compare_dates(context.legal_local_date, add_calendar_years(born, 18)) < 0 {
+        #{age_bracket: "under-18"}
+    } else if compare_dates(context.legal_local_date, add_calendar_years(born, 25)) < 0 {
+        #{age_bracket: "18-to-24"}
+    } else if compare_dates(context.legal_local_date, add_calendar_years(born, 65)) < 0 {
+        #{age_bracket: "25-to-64"}
+    } else {
+        #{age_bracket: "65-or-older"}
+    }
+}
+"#,
+            ),
+            (
+                "derivations/immunization-summary.rhai",
+                r#"fn answer(facts, selectors, context) {
+    let dose_count = required(facts.dose_count, "dose_count_missing");
+    #{schedule_complete: dose_count >= 3, dose_count: dose_count}
+}
+"#,
+            ),
+            (
+                "derivations/parent-relationship.rhai",
+                r#"fn answer(facts, selectors, context) {
+    #{relationship_confirmed: required(facts.relationship_confirmed, "relationship_missing")}
+}
+"#,
+            ),
+        ] {
+            fs::write(self.project.join(path), contents).expect("four-shape derivation");
+        }
+    }
+
+    fn stage_four_shape_fixtures(&self) {
+        fs::write(
+            self.project.join("fixtures/age-bracket.yaml"),
+            format!(
+                r#"fixture: registry.evidence.acceptance.production-age-bracket/v1
+coequal_acceptance_definition: true
+synthetic_only: true
+common:
+  observed_at: '2026-08-02T00:00:00Z'
+  legal_local_date: '2026-08-02'
+  selector: {{person_id: {SELECTOR_CANARY}}}
+  selectors:
+    subject: {{profile: person-reference-v1, values: {{person_id: {SELECTOR_CANARY}}}}}
+  expectedRequestParts:
+    query: []
+    body: {{lookup: {{person_id: {SELECTOR_CANARY}}}, fields: [date_of_birth], limit: 2}}
+  expectedTransport:
+    path: /v1/facts
+    fixedHeaders: [{{name: Accept, value: application/json}}]
+cases:
+  - {{id: positive, source: {{total: 1, date_of_birth: '2000-01-01'}}, expected_value: 25-to-64, expected_lookup: match, derivation_runs: true, signed_success: true}}
+  - {{id: negative-under-18-is-success, source: {{total: 1, date_of_birth: '2010-01-01'}}, expected_value: under-18, expected_lookup: match, derivation_runs: true, signed_success: true}}
+  - {{id: boundary-on-18, source: {{total: 1, date_of_birth: '2008-08-02'}}, expected_value: 18-to-24, expected_lookup: match, derivation_runs: true, signed_success: true}}
+  - {{id: missing-fact, source: {{total: 1}}, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}}
+  - {{id: no-match, source: {{total: 0}}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}}
+  - {{id: ambiguous, source: {{total: 2}}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}}
+  - {{id: source-failure, source_failure: timeout, expected_public_problem: dependency_unavailable, signed_success: false}}
+  - {{id: negative-wrong-derived-type, injected_derivation: [{{concept_id: {AGE_CONCEPT}, value: true}}], expected: output-gate-rejection}}
+  - {{id: anti-reconstruction, companion_bundle: threshold-ladder, expected: bundle-rejection}}
+privacy_expectation:
+  evidence_contains: [{AGE_CONCEPT}]
+  evidence_excludes: [date_of_birth, person_id]
+  diagnostics_exclude: [{SELECTOR_CANARY}, fixture-source-canary]
+"#
+            ),
+        )
+        .expect("age-bracket fixture");
+
+        fs::write(
+            self.project.join("fixtures/immunization-summary.yaml"),
+            format!(
+                r#"fixture: registry.evidence.acceptance.production-immunization-summary/v1
+coequal_acceptance_definition: true
+synthetic_only: true
+common:
+  observed_at: '2026-08-02T00:00:00Z'
+  selector: {{person_id: {SELECTOR_CANARY}}}
+  selectors:
+    subject: {{profile: person-reference-v1, values: {{person_id: {SELECTOR_CANARY}}}}}
+  expectedRequestParts:
+    query: []
+    body: {{lookup: {{person_id: {SELECTOR_CANARY}}}, fields: [dose_count], limit: 2}}
+  expectedTransport:
+    path: /v1/immunizations
+    fixedHeaders: [{{name: Accept, value: application/json}}]
+cases:
+  - id: positive
+    source: {{total: 1, dose_count: 4}}
+    expected_values: {{schedule-complete: true, dose-count: 4}}
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+  - id: negative-false-is-success
+    source: {{total: 1, dose_count: 2}}
+    expected_values: {{schedule-complete: false, dose-count: 2}}
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+  - id: boundary-maximum
+    source: {{total: 1, dose_count: 20}}
+    expected_values: {{schedule-complete: true, dose-count: 20}}
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+  - {{id: missing-fact, source: {{total: 1}}, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}}
+  - {{id: no-match, source: {{total: 0}}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}}
+  - {{id: ambiguous, source: {{total: 2}}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}}
+  - {{id: source-failure, source_failure: timeout, expected_public_problem: dependency_unavailable, signed_success: false}}
+  - id: negative-wrong-derived-type
+    injected_derivation:
+      - {{concept_id: {SCHEDULE_CONCEPT}, value: true}}
+      - {{concept_id: {DOSE_COUNT_CONCEPT}, value: '4'}}
+    expected: output-gate-rejection
+  - {{id: anti-reconstruction, companion_bundle: threshold-ladder, expected: bundle-rejection}}
+privacy_expectation:
+  evidence_contains: [{SCHEDULE_CONCEPT}, {DOSE_COUNT_CONCEPT}]
+  evidence_excludes: [dose_count, person_id]
+  diagnostics_exclude: [{SELECTOR_CANARY}, fixture-source-canary]
+"#
+            ),
+        )
+        .expect("immunization fixture");
+
+        fs::write(
+            self.project.join("fixtures/parent-relationship.yaml"),
+            format!(
+                r#"fixture: registry.evidence.acceptance.production-parent-relationship/v1
+coequal_acceptance_definition: true
+synthetic_only: true
+common:
+  observed_at: '2026-08-02T00:00:00Z'
+  selectors:
+    child: {{profile: child-reference-v1, values: {{child_id: synthetic-child-001}}}}
+    candidate-parent: {{profile: candidate-reference-v1, values: {{candidate_id: synthetic-parent-001}}}}
+  expectedRequestParts:
+    query: []
+    body:
+      lookup: {{child_id: synthetic-child-001, candidate_id: synthetic-parent-001}}
+      fields: [relationship_confirmed]
+      limit: 2
+  expectedTransport:
+    path: /v1/relationships
+    fixedHeaders: [{{name: Accept, value: application/json}}]
+cases:
+  - {{id: positive, source: {{total: 1, relationship_confirmed: true}}, expected_value: true, expected_lookup: match, derivation_runs: true, signed_success: true}}
+  - {{id: negative-false-is-success, source: {{total: 1, relationship_confirmed: false}}, expected_value: false, expected_lookup: match, derivation_runs: true, signed_success: true}}
+  - id: boundary-role-order
+    source: {{total: 1, relationship_confirmed: true}}
+    expected_value: true
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+    expected_subject_roles: [child, candidate-parent]
+  - {{id: missing-fact, source: {{total: 1}}, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}}
+  - {{id: no-match, source: {{total: 0}}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}}
+  - {{id: ambiguous, source: {{total: 2}}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}}
+  - {{id: source-failure, source_failure: timeout, expected_public_problem: dependency_unavailable, signed_success: false}}
+  - {{id: negative-wrong-derived-type, injected_derivation: [{{concept_id: {RELATIONSHIP_CONCEPT}, value: 'true'}}], expected: output-gate-rejection}}
+  - {{id: anti-reconstruction, companion_bundle: relationship-graph, expected: bundle-rejection}}
+privacy_expectation:
+  evidence_contains: [child, candidate-parent, {RELATIONSHIP_CONCEPT}]
+  evidence_excludes: [child_id, candidate_id, relationship_confirmed]
+  diagnostics_exclude: [synthetic-child-001, synthetic-parent-001, fixture-source-canary]
+"#
+            ),
+        )
+        .expect("parent relationship fixture");
+    }
+
+    fn stage_https_identity(&self) {
+        let tls = self.ca.parent().expect("TLS directory");
+        fs::create_dir(tls).expect("TLS directory");
+        fs::write(
+            tls.join("server.cnf"),
+            "[server]\nsubjectAltName = IP:127.0.0.1\nbasicConstraints = critical,CA:FALSE\nkeyUsage = critical,digitalSignature,keyEncipherment\nextendedKeyUsage = serverAuth\n",
+        )
+        .expect("OpenSSL config");
+        let ca_key = tls.join("ca.key");
+        assert_success(
+            Command::new("openssl")
+                .args(["req", "-x509", "-newkey", "rsa:2048", "-nodes", "-sha256"])
+                .args(["-days", "1", "-keyout"])
+                .arg(&ca_key)
+                .arg("-out")
+                .arg(&self.ca)
+                .args(["-subj", "/CN=Evidence acceptance CA"])
+                .output()
+                .expect("openssl starts"),
+            "test HTTPS CA generation",
+        );
+        let csr = tls.join("server.csr");
+        assert_success(
+            Command::new("openssl")
+                .args(["req", "-new", "-newkey", "rsa:2048", "-nodes", "-sha256"])
+                .arg("-keyout")
+                .arg(&self.tls_key)
+                .arg("-out")
+                .arg(&csr)
+                .args(["-subj", "/CN=127.0.0.1"])
+                .output()
+                .expect("openssl starts"),
+            "test HTTPS leaf-key generation",
+        );
+        assert_success(
+            Command::new("openssl")
+                .args(["x509", "-req", "-sha256", "-days", "1", "-in"])
+                .arg(&csr)
+                .arg("-CA")
+                .arg(&self.ca)
+                .arg("-CAkey")
+                .arg(&ca_key)
+                .arg("-CAcreateserial")
+                .arg("-out")
+                .arg(&self.tls_cert)
+                .arg("-extfile")
+                .arg(tls.join("server.cnf"))
+                .args(["-extensions", "server"])
+                .output()
+                .expect("openssl starts"),
+            "test HTTPS leaf certificate generation",
+        );
+        fs::set_permissions(&self.tls_key, fs::Permissions::from_mode(0o600))
+            .expect("TLS key mode");
+        fs::set_permissions(&self.ca, fs::Permissions::from_mode(0o444)).expect("CA mode");
+
+        let public = self.root.join("oidc-public.jwk.json");
+        assert_success(
+            evidencectl()
+                .args(["keygen", "signing", "--out-dir"])
+                .arg(self.oidc_private.parent().expect("OIDC private directory"))
+                .args(["--kid", AUTH_KEY_ID, "--public-out"])
+                .arg(&public)
+                .output()
+                .expect("OIDC keygen starts"),
+            "external OIDC signing key generation",
+        );
+        assert_success(
+            evidencectl()
+                .args(["jwks", "--out"])
+                .arg(&self.oidc_jwks)
+                .arg(&public)
+                .output()
+                .expect("OIDC JWKS assembly starts"),
+            "external OIDC JWKS assembly",
+        );
+    }
+
+    fn stage_target(&self) {
+        fs::create_dir_all(&self.target).expect("production target");
+        let identity = format!("https://127.0.0.1:{}", self.https_port);
+        fs::write(
+            self.target.join("governance.yaml"),
+            format!(
+                r#"version: 1
+assuranceProfile: production
+service: {{providerId: urn:example:providers:evidence, trustDomain: urn:example:trust-domains:acceptance}}
+issuer: {{id: urn:example:issuers:evidence}}
+authentication:
+  kind: oidc-access-token
+  issuer: {identity}
+  audiences: [{TOKEN_AUDIENCE}]
+  tokenTypes: [at+jwt]
+  algorithms: [EdDSA]
+  jwksUri: {identity}/.well-known/jwks.json
+  principalClaim: sub
+  requesterTagsClaim: evidence_tags
+  evidenceAudienceClaim: evidence_audience
+  grantIdClaim: evidence_grant_id
+  grantAuthorityClaim: evidence_authority
+audit: {{format: keyed-jsonl, hashSecretRef: 'secret:file/audit-hmac-key', hashKeyVersion: 1, failClosed: true}}
+subjectBinding: {{secretRef: 'secret:file/subject-binding-hmac-key', keyVersion: 1}}
+rateLimits: {{requestsPerPrincipalPerMinute: 60, burstPerPrincipal: 10, failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 10}}
+signing:
+  format: flattened-jws-json
+  algorithm: EdDSA
+  activeKeyId: {SIGNING_KEY_ID}
+  activeKeyRef: secret:file/signing-ed25519-private-jwk
+  retiredPublicJwkFiles: []
+  jwksPath: /.well-known/evidence/jwks.json
+  maximumAssertionValiditySeconds: 86400
+  verifierClockSkewSeconds: 30
+responseFormats: [signed-jws]
+authorityProfiles:
+  statutory-caseworker-v1:
+    kind: statutory
+    requesterTags: [fixture-agency]
+    grants:
+      - requirement: {REQUIREMENT}
+        purpose: {PURPOSE}
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects: [{{role: subject, selectorProfile: person-reference-v1, valueOrigin: request}}]
+"#
+            ),
+        )
+        .expect("governance");
+        fs::write(
+            &self.target_runtime,
+            format!(
+                "version: 1\nbundleDirectory: {bundle}\nlistener:\n  bindHost: 127.0.0.1\n  port: {port}\n  tlsTermination: operator-controlled-upstream\n  trustProxyIdentityHeaders: false\n  maximumRequestBytes: 65536\n  maximumConcurrentRequests: 64\n  requestTimeoutMilliseconds: 10000\n  shutdownGraceMilliseconds: 5000\nsecretProviders:\n  file:\n    root: {secrets}\nauditStorage:\n  path: {audit}\n  maximumFileBytes: 1048576\noutboundTls:\n  systemRoots: true\n  trustProfiles: {{}}\n",
+                bundle = self.candidate.join("bundle").display(),
+                port = self.evidence_port,
+                secrets = self.secrets.display(),
+                audit = self.audit_path.display(),
+            ),
+        )
+        .expect("runtime");
+    }
+
+    fn authorize_four_shapes(&self) {
+        let path = self.target.join("governance.yaml");
+        let mut governance = fs::read_to_string(&path).expect("production governance");
+        governance.push_str(&format!(
+            r#"      - requirement: {AGE_REQUIREMENT}
+        purpose: service-path-selection
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects: [{{role: subject, selectorProfile: person-reference-v1, valueOrigin: request}}]
+      - requirement: {IMMUNIZATION_REQUIREMENT}
+        purpose: care-coordination
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects: [{{role: subject, selectorProfile: person-reference-v1, valueOrigin: request}}]
+      - requirement: {RELATIONSHIP_REQUIREMENT}
+        purpose: relationship-check
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects:
+          - {{role: child, selectorProfile: child-reference-v1, valueOrigin: request}}
+          - {{role: candidate-parent, selectorProfile: candidate-reference-v1, valueOrigin: request}}
+"#
+        ));
+        fs::write(path, governance).expect("four-shape production governance");
+    }
+
+    fn build(&self, evidence: &Path) -> Output {
+        let output = evidencectl()
+            .arg("build")
+            .arg("--project")
+            .arg(&self.project)
+            .arg("--target")
+            .arg(&self.target)
+            .arg("--output")
+            .arg(&self.candidate)
+            .env("EVIDENCE_BIN", evidence)
+            .output()
+            .expect("build starts");
+        assert_success(output, "production build")
+    }
+
+    fn provision_target_secrets(&self) {
+        fs::create_dir(self.audit_path.parent().expect("audit directory"))
+            .expect("audit directory");
+        fs::set_permissions(
+            self.audit_path.parent().expect("audit directory"),
+            fs::Permissions::from_mode(0o700),
+        )
+        .expect("audit directory mode");
+        let public = self.root.join("evidence-public.jwk.json");
+        assert_success(
+            evidencectl()
+                .args(["keygen", "signing", "--out-dir"])
+                .arg(&self.secrets)
+                .args(["--kid", SIGNING_KEY_ID, "--public-out"])
+                .arg(&public)
+                .output()
+                .expect("Evidence signing keygen starts"),
+            "independent Evidence signing key generation",
+        );
+        for name in ["audit-hmac-key", "subject-binding-hmac-key"] {
+            assert_success(
+                evidencectl()
+                    .args(["keygen", "secret", "--out"])
+                    .arg(self.secrets.join(name))
+                    .output()
+                    .expect("HMAC keygen starts"),
+                "independent HMAC generation",
+            );
+        }
+        assert_success(
+            evidencectl()
+                .args(["keygen", "token", "--out"])
+                .arg(&self.source_token)
+                .output()
+                .expect("source token keygen starts"),
+            "independent source credential generation",
+        );
+        assert_success(
+            evidencectl()
+                .args(["jwks", "--out"])
+                .arg(&self.evidence_jwks)
+                .arg(public)
+                .output()
+                .expect("Evidence JWKS assembly starts"),
+            "trusted Evidence JWKS assembly",
+        );
+    }
+
+    fn assert_compose_revision_distinction(&self, evidence: &Path, revision: &str) {
+        let (host_bundle, host_runtime) = check_revisions(
+            evidence,
+            &self.candidate.join("runtime.yaml"),
+            "host runtime check",
+        );
+        assert_eq!(host_bundle, revision);
+
+        let compose = self.root.join("compose-adapter");
+        fs::create_dir(&compose).expect("Compose adapter directory");
+        let runtime = compose.join("runtime.yaml");
+        fs::write(
+            &runtime,
+            format!(
+                "version: 1\nbundleDirectory: {bundle}\nlistener:\n  bindHost: 127.0.0.1\n  port: {port}\n  tlsTermination: operator-controlled-upstream\n  trustProxyIdentityHeaders: false\n  maximumRequestBytes: 131072\n  maximumConcurrentRequests: 32\n  requestTimeoutMilliseconds: 15000\n  shutdownGraceMilliseconds: 10000\nsecretProviders:\n  file:\n    root: {secrets}\nauditStorage:\n  path: {audit}\n  maximumFileBytes: 2097152\noutboundTls:\n  systemRoots: true\n  trustProfiles: {{}}\n",
+                // This absolute host path stands for the unchanged read-only
+                // candidate/bundle mount in the container execution context.
+                bundle = self.candidate.join("bundle").display(),
+                port = free_port(),
+                secrets = self.secrets.display(),
+                audit = compose.join("persistent-audit/evidence.jsonl").display(),
+            ),
+        )
+        .expect("Compose runtime");
+        fs::set_permissions(&runtime, fs::Permissions::from_mode(0o400))
+            .expect("seal Compose runtime");
+
+        let unchanged_bundle = snapshot_files(&self.candidate.join("bundle"));
+        let (compose_bundle, compose_runtime) =
+            check_revisions(evidence, &runtime, "Compose-context runtime check");
+        assert_eq!(
+            snapshot_files(&self.candidate.join("bundle")),
+            unchanged_bundle,
+            "the Compose adapter must not edit the governed bundle"
+        );
+        assert_eq!(compose_bundle, revision);
+        assert_ne!(
+            compose_runtime, host_runtime,
+            "environment-specific runtime bindings require an independent runtime revision"
+        );
+    }
+
+    fn stage_mint(&self) -> MintDeployment {
+        let mint = self.root.join("mint");
+        let clients = mint.join("clients");
+        fs::create_dir_all(&clients).expect("Mint client registry");
+
+        let mint_public = mint.join("mint-public.jwk.json");
+        assert_success(
+            evidencectl()
+                .args(["keygen", "signing", "--out-dir"])
+                .arg(mint.join("secrets"))
+                .args(["--kid", "mint-signing-key-1", "--public-out"])
+                .arg(&mint_public)
+                .output()
+                .expect("Mint signing keygen starts"),
+            "independent Mint signing key generation",
+        );
+        let audit = mint.join("audit");
+        fs::create_dir(&audit).expect("Mint audit directory");
+        fs::set_permissions(&audit, fs::Permissions::from_mode(0o700))
+            .expect("Mint audit directory mode");
+        let audit_key = mint.join("secrets/mint-audit-hmac-key");
+        let mut audit_key_file = OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .mode(0o600)
+            .open(&audit_key)
+            .expect("Mint audit key");
+        audit_key_file
+            .write_all(b"production-handoff-mint-audit-key")
+            .expect("Mint audit key contents");
+        audit_key_file.sync_all().expect("sync Mint audit key");
+        assert_eq!(
+            fs::metadata(&audit)
+                .expect("Mint audit metadata")
+                .permissions()
+                .mode()
+                & 0o777,
+            0o700,
+        );
+        assert_eq!(
+            fs::metadata(&audit_key)
+                .expect("Mint audit key metadata")
+                .permissions()
+                .mode()
+                & 0o777,
+            0o600,
+        );
+        let caller_public = mint.join("caller-public.jwk.json");
+        let caller_directory = mint.join("caller");
+        assert_success(
+            evidencectl()
+                .args(["keygen", "signing", "--out-dir"])
+                .arg(&caller_directory)
+                .args(["--kid", "acceptance-client-key-1", "--public-out"])
+                .arg(&caller_public)
+                .output()
+                .expect("Mint caller keygen starts"),
+            "independent Mint caller key generation",
+        );
+        let caller_jwk: Value =
+            serde_json::from_slice(&fs::read(&caller_public).expect("Mint caller public JWK"))
+                .expect("Mint caller public JWK parses");
+        fs::write(
+            clients.join("acceptance-client.yaml"),
+            format!(
+                "clientId: acceptance-client\nprincipal: urn:example:principals:acceptance-client\nevidenceAudience: {EVIDENCE_AUDIENCE}\nrequesterTags: [fixture-agency]\nkeys: [{}]\n",
+                serde_json::to_string(&caller_jwk).expect("caller JWK serializes")
+            ),
+        )
+        .expect("Mint client registration");
+
+        // The HTTPS process now publishes Mint's public signing key at the
+        // configured public identity. Mint itself remains on a private plain
+        // HTTP listener behind that operator-owned route.
+        fs::remove_file(&self.oidc_jwks).expect("replace external IdP JWKS for Mint path");
+        assert_success(
+            evidencectl()
+                .args(["jwks", "--out"])
+                .arg(&self.oidc_jwks)
+                .arg(&mint_public)
+                .output()
+                .expect("Mint JWKS assembly starts"),
+            "Mint public JWKS assembly",
+        );
+
+        let identity = format!("https://127.0.0.1:{}", self.https_port);
+        let config = mint.join("mint.yaml");
+        fs::write(
+            &config,
+            format!(
+                "version: 1\nissuer: {identity}\nlistener: {{address: 127.0.0.1, port: {port}}}\nsigning:\n  algorithm: EdDSA\n  activeKeyId: mint-signing-key-1\n  activeKeyFile: secrets/signing-ed25519-private-jwk\naudit:\n  path: audit/mint.jsonl\n  maximumFileBytes: 1073741824\n  hashKeyFile: secrets/mint-audit-hmac-key\n  hashKeyVersion: 1\naccessTokens:\n  audiences: [{TOKEN_AUDIENCE}]\n  lifetimeSeconds: 300\n  claims:\n    principal: sub\n    requesterTags: evidence_tags\n    evidenceAudience: evidence_audience\n    grantId: evidence_grant_id\n    grantAuthority: evidence_authority\nclientAssertion:\n  audience: {identity}/token\n  algorithms: [EdDSA]\nclients:\n  directory: clients\n",
+                port = self.mint_port,
+            ),
+        )
+        .expect("Mint config");
+        MintDeployment {
+            config,
+            caller_private: caller_directory.join("signing-ed25519-private-jwk"),
+        }
+    }
+
+    fn start_https(&self) -> Child {
+        Command::new("python3")
+            .arg(
+                Path::new(env!("CARGO_MANIFEST_DIR"))
+                    .join("tests/support/production_handoff_https.py"),
+            )
+            .env("ACCEPTANCE_HTTPS_PORT", self.https_port.to_string())
+            .env("ACCEPTANCE_TLS_CERT", &self.tls_cert)
+            .env("ACCEPTANCE_TLS_KEY", &self.tls_key)
+            .env("ACCEPTANCE_JWKS", &self.oidc_jwks)
+            .env("ACCEPTANCE_MINT_PORT", self.mint_port.to_string())
+            .env("ACCEPTANCE_SOURCE_TOKEN", &self.source_token)
+            .env("ACCEPTANCE_SOURCE_MARKER", &self.source_marker)
+            .env("ACCEPTANCE_READY", &self.https_ready)
+            .stdin(Stdio::null())
+            .stdout(Stdio::null())
+            .stderr(Stdio::null())
+            .spawn()
+            .expect("local HTTPS process starts")
+    }
+
+    fn wait_for_https(&self, child: &mut Child) {
+        wait_for(Duration::from_secs(10), || {
+            assert_running(child, "local HTTPS");
+            self.https_ready.is_file()
+        });
+    }
+
+    fn start_evidence(&self, evidence: &Path) -> Child {
+        let log = owner_only_log(&self.root.join("evidence.log"));
+        Command::new(evidence)
+            .arg("--runtime")
+            .arg(self.candidate.join("runtime.yaml"))
+            .arg("serve")
+            .env("SSL_CERT_FILE", &self.ca)
+            .stdin(Stdio::null())
+            .stdout(Stdio::from(log.try_clone().expect("clone Evidence log")))
+            .stderr(Stdio::from(log))
+            .spawn()
+            .expect("Evidence service starts")
+    }
+
+    fn start_mint(&self, mint: &Path, config: &Path) -> Child {
+        let log = owner_only_log(&self.root.join("mint.log"));
+        Command::new(mint)
+            .args(["serve", "--config"])
+            .arg(config)
+            .stdin(Stdio::null())
+            .stdout(Stdio::from(log.try_clone().expect("clone Mint log")))
+            .stderr(Stdio::from(log))
+            .spawn()
+            .expect("Mint service starts")
+    }
+
+    fn wait_for_evidence(&self, child: &mut Child) {
+        wait_for(Duration::from_secs(20), || {
+            assert_running(child, "Evidence");
+            http_status(self.evidence_port, "/ready") == Some(200)
+        });
+    }
+
+    fn access_token(&self) -> String {
+        let private: Value = serde_json::from_slice(
+            &fs::read(&self.oidc_private).expect("read external OIDC private JWK"),
+        )
+        .expect("external OIDC private JWK parses");
+        let secret = URL_SAFE_NO_PAD
+            .decode(private["d"].as_str().expect("private JWK d"))
+            .expect("private JWK d decodes");
+        let secret: [u8; 32] = secret.try_into().expect("Ed25519 seed length");
+        let key = SigningKey::from_bytes(&secret);
+        let identity = format!("https://127.0.0.1:{}", self.https_port);
+        let now = Utc::now().timestamp();
+        let header = URL_SAFE_NO_PAD.encode(
+            serde_json::to_vec(&json!({"alg":"EdDSA","kid":AUTH_KEY_ID,"typ":"at+jwt"}))
+                .expect("JWT header"),
+        );
+        let claims = URL_SAFE_NO_PAD.encode(
+            serde_json::to_vec(&json!({
+                "iss": identity,
+                "aud": TOKEN_AUDIENCE,
+                "sub": "synthetic-caller",
+                "iat": now - 1,
+                "exp": now + 3600,
+                "evidence_tags": ["fixture-agency"],
+                "evidence_audience": EVIDENCE_AUDIENCE,
+            }))
+            .expect("JWT claims"),
+        );
+        let input = format!("{header}.{claims}");
+        let signature = URL_SAFE_NO_PAD.encode(key.sign(input.as_bytes()).to_bytes());
+        format!("{input}.{signature}")
+    }
+
+    fn write_verification_policy(&self, payload: &Value, nonce: &str, revision: &str) {
+        let binding = payload["subjects"][0]["binding"]
+            .as_str()
+            .expect("accepted transaction subject binding");
+        let policy = json!({
+            "expectedAssuranceProfile": "production",
+            "issuedBy": "urn:example:issuers:evidence",
+            "providedBy": "urn:example:providers:evidence",
+            "requirement": REQUIREMENT,
+            "evidenceType": EVIDENCE_TYPE,
+            "purpose": PURPOSE,
+            "audience": EVIDENCE_AUDIENCE,
+            "configurationRevision": revision,
+            "requestNonce": nonce,
+            // A relying party retains this opaque binding from the accepted
+            // first transaction. Every other expectation is independently
+            // controlled by the target and retained request in this fixture.
+            "expectedSubjects": [{"role":"subject","binding":binding}],
+            "expectedOutputs": [{"concept":CONCEPT,"form":"boolean"}],
+            "maximumAssertionLifetimeSeconds": 86400,
+            "clockSkewSeconds": 30,
+        });
+        fs::write(
+            &self.policy,
+            serde_norway::to_string(&policy).expect("policy YAML"),
+        )
+        .expect("verification policy");
+    }
+}
+
+impl Drop for Fixture {
+    fn drop(&mut self) {
+        for path in [&self.candidate, &self.first_candidate] {
+            let _ = make_tree_writable(path);
+        }
+        let _ = &self.temporary;
+    }
+}
+
+fn evidencectl() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_evidencectl"))
+}
+
+fn assert_success(output: Output, label: &str) -> Output {
+    assert!(
+        output.status.success(),
+        "{label} failed\nstdout:\n{}\nstderr:\n{}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    output
+}
+
+fn bundle_revision(output: &Output) -> String {
+    String::from_utf8_lossy(&output.stdout)
+        .lines()
+        .find_map(|line| line.strip_prefix("Bundle revision: "))
+        .filter(|revision| {
+            revision.len() == 71
+                && revision.starts_with("sha256:")
+                && revision[7..].bytes().all(|byte| byte.is_ascii_hexdigit())
+        })
+        .expect("build reports one bundle revision")
+        .to_owned()
+}
+
+fn assert_requirement_forms(
+    requirements: &BTreeMap<&str, &Value>,
+    requirement_id: &str,
+    expected_forms: &[&str],
+    expected_subject_roles: usize,
+) {
+    let requirement = requirements
+        .get(requirement_id)
+        .unwrap_or_else(|| panic!("missing compiled requirement {requirement_id}"));
+    let forms = requirement["concepts"]
+        .as_array()
+        .expect("compiled concepts")
+        .iter()
+        .map(|concept| concept["form"].as_str().expect("compiled concept form"))
+        .collect::<Vec<_>>();
+    assert_eq!(forms, expected_forms);
+    assert_eq!(
+        requirement["subjectRoles"]
+            .as_array()
+            .expect("compiled subject roles")
+            .len(),
+        expected_subject_roles
+    );
+}
+
+fn check_revisions(evidence: &Path, runtime: &Path, label: &str) -> (String, String) {
+    let output = assert_success(
+        Command::new(evidence)
+            .arg("--runtime")
+            .arg(runtime)
+            .arg("check")
+            .output()
+            .expect("Evidence check starts"),
+        label,
+    );
+    let stdout = String::from_utf8(output.stdout).expect("Evidence check stdout");
+    let fields = stdout
+        .lines()
+        .find(|line| line.starts_with("Evidence deployment "))
+        .expect("Evidence check report")
+        .split_whitespace()
+        .collect::<Vec<_>>();
+    assert_eq!(fields.get(3), Some(&"/"), "Evidence revision separator");
+    (
+        fields.get(2).expect("bundle revision").to_string(),
+        fields.get(4).expect("runtime revision").to_string(),
+    )
+}
+
+fn snapshot_files(root: &Path) -> BTreeMap<PathBuf, Vec<u8>> {
+    fn visit(root: &Path, path: &Path, snapshot: &mut BTreeMap<PathBuf, Vec<u8>>) {
+        let mut entries = fs::read_dir(path)
+            .expect("candidate directory")
+            .map(|entry| entry.expect("candidate entry").path())
+            .collect::<Vec<_>>();
+        entries.sort();
+        for entry in entries {
+            let metadata = fs::symlink_metadata(&entry).expect("candidate metadata");
+            assert!(
+                !metadata.file_type().is_symlink(),
+                "candidate contains symlink"
+            );
+            if metadata.is_dir() {
+                visit(root, &entry, snapshot);
+            } else {
+                snapshot.insert(
+                    entry
+                        .strip_prefix(root)
+                        .expect("candidate-relative path")
+                        .to_owned(),
+                    fs::read(entry).expect("candidate file"),
+                );
+            }
+        }
+    }
+    let mut snapshot = BTreeMap::new();
+    visit(root, root, &mut snapshot);
+    snapshot
+}
+
+fn free_port() -> u16 {
+    TcpListener::bind("127.0.0.1:0")
+        .expect("reserve port")
+        .local_addr()
+        .expect("reserved address")
+        .port()
+}
+
+fn free_ports(count: usize) -> Vec<u16> {
+    let listeners = (0..count)
+        .map(|_| TcpListener::bind("127.0.0.1:0").expect("reserve distinct port"))
+        .collect::<Vec<_>>();
+    listeners
+        .iter()
+        .map(|listener| listener.local_addr().expect("reserved address").port())
+        .collect()
+}
+
+fn wait_for_listener(child: &mut Child, port: u16, label: &str) {
+    wait_for(Duration::from_secs(20), || {
+        assert_running(child, label);
+        TcpStream::connect(("127.0.0.1", port)).is_ok()
+    });
+}
+
+fn wait_for(timeout: Duration, mut condition: impl FnMut() -> bool) {
+    let deadline = Instant::now() + timeout;
+    while Instant::now() < deadline {
+        if condition() {
+            return;
+        }
+        thread::sleep(Duration::from_millis(50));
+    }
+    panic!("condition did not become true before the acceptance timeout");
+}
+
+fn assert_running(child: &mut Child, label: &str) {
+    if let Some(status) = child.try_wait().expect("child status") {
+        panic!("{label} exited before readiness with {status}");
+    }
+}
+
+fn http_status(port: u16, path: &str) -> Option<u16> {
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).ok()?;
+    stream.set_read_timeout(Some(Duration::from_secs(2))).ok()?;
+    write!(
+        stream,
+        "GET {path} HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n"
+    )
+    .ok()?;
+    let mut response = String::new();
+    stream.read_to_string(&mut response).ok()?;
+    response
+        .lines()
+        .next()?
+        .split_whitespace()
+        .nth(1)?
+        .parse()
+        .ok()
+}
+
+fn post_evidence(port: u16, token: &str, nonce: &str) -> (u16, Vec<u8>) {
+    let body = serde_json::to_vec(&json!({
+        "requestNonce": nonce,
+        "requirement": REQUIREMENT,
+        "purpose": PURPOSE,
+        "subjects": [{
+            "role": "subject",
+            "selector": {
+                "profile": "person-reference-v1",
+                "values": {"person_id": SELECTOR_CANARY},
+            },
+        }],
+    }))
+    .expect("request JSON");
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).expect("Evidence connection");
+    stream
+        .set_read_timeout(Some(Duration::from_secs(15)))
+        .expect("request timeout");
+    write!(
+        stream,
+        "POST /v1/evidence HTTP/1.1\r\nHost: 127.0.0.1\r\nAuthorization: Bearer {token}\r\nContent-Type: application/json\r\nAccept: application/jose+json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+        body.len()
+    )
+    .expect("request headers");
+    stream.write_all(&body).expect("request body");
+    let mut response = Vec::new();
+    stream.read_to_end(&mut response).expect("response bytes");
+    let separator = response
+        .windows(4)
+        .position(|window| window == b"\r\n\r\n")
+        .expect("HTTP response separator");
+    let headers = std::str::from_utf8(&response[..separator]).expect("HTTP response headers");
+    let status = headers
+        .lines()
+        .next()
+        .and_then(|line| line.split_whitespace().nth(1))
+        .and_then(|value| value.parse::<u16>().ok())
+        .expect("HTTP response status");
+    (status, response[separator + 4..].to_vec())
+}
+
+fn signed_payload(response: &[u8]) -> Value {
+    let jws: Value = serde_json::from_slice(response).expect("flattened JWS response");
+    let encoded = jws["payload"].as_str().expect("flattened JWS payload");
+    serde_json::from_slice(&URL_SAFE_NO_PAD.decode(encoded).expect("payload decodes"))
+        .expect("Evidence payload JSON")
+}
+
+fn wait_for_audit(path: &Path) -> String {
+    let mut result = None;
+    wait_for(Duration::from_secs(10), || {
+        let Ok(contents) = fs::read_to_string(path) else {
+            return false;
+        };
+        if contents.matches("\"phase\":\"access-attempt\"").count() == 1
+            && contents.matches("\"phase\":\"disclosure-release\"").count() == 1
+        {
+            result = Some(contents);
+            true
+        } else {
+            false
+        }
+    });
+    result.expect("the complete operation audit")
+}
+
+fn assert_audit_contract(audit: &str, revision: &str, credentials: &[&[u8]]) {
+    let records = audit
+        .lines()
+        .map(|line| serde_json::from_str::<Value>(line).expect("audit JSONL"))
+        .collect::<Vec<_>>();
+    assert_eq!(
+        records.len(),
+        2,
+        "one request must write exactly two events"
+    );
+    assert_eq!(records[0]["record"]["phase"], "access-attempt");
+    assert_eq!(records[0]["record"]["decision"], "authorized");
+    assert_eq!(records[1]["record"]["phase"], "disclosure-release");
+    assert_eq!(records[1]["record"]["decision"], "released");
+    assert_eq!(records[1]["record"]["signingKeyId"], SIGNING_KEY_ID);
+    for record in &records {
+        assert_eq!(record["record"]["bundleRevision"], revision);
+        assert_eq!(record["record"]["assuranceProfile"], "production");
+    }
+    let bytes = audit.as_bytes();
+    for prohibited in [
+        SELECTOR_CANARY.as_bytes(),
+        b"date_of_birth".as_slice(),
+        b"synthetic-caller".as_slice(),
+    ] {
+        assert!(
+            !bytes
+                .windows(prohibited.len())
+                .any(|part| part == prohibited),
+            "audit retained protected request, source, principal, or credential data"
+        );
+    }
+    for credential in credentials {
+        assert!(
+            !bytes
+                .windows(credential.len())
+                .any(|part| part == *credential),
+            "audit retained an access token or source credential"
+        );
+    }
+}
+
+fn stop_gracefully(child: &mut Child, label: &str) {
+    let pid =
+        rustix::process::Pid::from_raw(i32::try_from(child.id()).expect("child PID fits i32"))
+            .expect("child PID is positive");
+    rustix::process::kill_process(pid, rustix::process::Signal::TERM).expect("send SIGTERM");
+    let status = child.wait().expect("child exits");
+    assert!(status.success(), "{label} did not stop cleanly: {status}");
+}
+
+fn stop_forcefully(child: &mut Child) {
+    let _ = child.kill();
+    let _ = child.wait();
+}
+
+fn owner_only_log(path: &Path) -> File {
+    OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(0o600)
+        .open(path)
+        .expect("create owner-only log")
+}
+
+fn make_tree_writable(path: &Path) -> std::io::Result<()> {
+    let Ok(metadata) = fs::symlink_metadata(path) else {
+        return Ok(());
+    };
+    if metadata.is_dir() {
+        fs::set_permissions(path, fs::Permissions::from_mode(0o700))?;
+        for entry in fs::read_dir(path)? {
+            make_tree_writable(&entry?.path())?;
+        }
+    } else if metadata.is_file() {
+        fs::set_permissions(path, fs::Permissions::from_mode(0o600))?;
+    }
+    Ok(())
+}
+
+fn evidence_binary() -> &'static Path {
+    static BINARY: OnceLock<PathBuf> = OnceLock::new();
+    BINARY.get_or_init(|| {
+        if let Some(path) = std::env::var_os("EVIDENCE_BIN") {
+            return PathBuf::from(path);
+        }
+        let build = Command::new(std::env::var_os("CARGO").unwrap_or_else(|| "cargo".into()))
+            .current_dir(workspace_root())
+            .args([
+                "build",
+                "--locked",
+                "-p",
+                "registry-evidence",
+                "--bin",
+                "evidence",
+                "--profile",
+                &current_test_profile(),
+                "--message-format",
+                "json-render-diagnostics",
+            ])
+            .output()
+            .expect("building the Evidence binary");
+        assert!(
+            build.status.success(),
+            "building the Evidence binary failed: {}",
+            String::from_utf8_lossy(&build.stderr)
+        );
+        String::from_utf8_lossy(&build.stdout)
+            .lines()
+            .filter_map(|line| serde_json::from_str::<Value>(line).ok())
+            .filter(|message| message["reason"] == "compiler-artifact")
+            .filter_map(|message| message["executable"].as_str().map(PathBuf::from))
+            .find(|path| path.file_name().is_some_and(|name| name == "evidence"))
+            .expect("Evidence executable path")
+    })
+}
+
+fn mint_binary() -> &'static Path {
+    static BINARY: OnceLock<PathBuf> = OnceLock::new();
+    BINARY.get_or_init(|| {
+        if let Some(path) = std::env::var_os("MINT_BIN") {
+            return PathBuf::from(path);
+        }
+        let build = Command::new(std::env::var_os("CARGO").unwrap_or_else(|| "cargo".into()))
+            .current_dir(workspace_root())
+            .args([
+                "build",
+                "--locked",
+                "-p",
+                "registry-mint",
+                "--bin",
+                "mint",
+                "--profile",
+                &current_test_profile(),
+                "--message-format",
+                "json-render-diagnostics",
+            ])
+            .output()
+            .expect("building the Mint binary");
+        assert!(
+            build.status.success(),
+            "building the Mint binary failed: {}",
+            String::from_utf8_lossy(&build.stderr)
+        );
+        String::from_utf8_lossy(&build.stdout)
+            .lines()
+            .filter_map(|line| serde_json::from_str::<Value>(line).ok())
+            .filter(|message| message["reason"] == "compiler-artifact")
+            .filter_map(|message| message["executable"].as_str().map(PathBuf::from))
+            .find(|path| path.file_name().is_some_and(|name| name == "mint"))
+            .expect("Mint executable path")
+    })
+}
+
+fn workspace_root() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .ancestors()
+        .nth(2)
+        .expect("workspace root")
+        .to_path_buf()
+}
+
+fn current_test_profile() -> String {
+    let executable = std::env::current_exe().expect("test executable");
+    let profile = executable
+        .parent()
+        .and_then(Path::parent)
+        .and_then(Path::file_name)
+        .and_then(|name| name.to_str())
+        .expect("test profile");
+    if profile == "debug" {
+        "dev".to_owned()
+    } else {
+        profile.to_owned()
+    }
+}
diff --git a/crates/registry-evidencectl/tests/request_verify.rs b/crates/registry-evidencectl/tests/request_verify.rs
new file mode 100644
index 000000000..63afca3de
--- /dev/null
+++ b/crates/registry-evidencectl/tests/request_verify.rs
@@ -0,0 +1,1007 @@
+use std::{
+    fs,
+    os::unix::{
+        fs::{symlink, PermissionsExt as _},
+        net::UnixListener,
+    },
+    path::{Path, PathBuf},
+    process::{Command, Output},
+};
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use serde_json::{json, Value};
+
+const TOKEN: &str = "secret.token-canary";
+const CONTEXT: &str = "{\"schema\":\"context-canary\"}\n";
+const VERIFIED: &str =
+    "{\"purpose\":\"age-check\",\"schema\":\"verified-canary\",\"values\":{\"is_adult\":true}}\n";
+const AGE_CHECKS_TAG: &str =
+    "policy-v1-bc8c04f766133dc6ffd6e395caa64f9c3b43301c1d308716668c71b8b839c0dc";
+
+#[test]
+fn public_help_exposes_only_the_adopter_request_and_verify_inputs() {
+    let request = command()
+        .args(["request", "prepare", "--help"])
+        .output()
+        .expect("request help");
+    assert_success(&request);
+    let request = String::from_utf8_lossy(&request.stdout);
+    for visible in [
+        "<QUESTION>",
+        "--purpose",
+        "--subject",
+        "--name",
+        "--client",
+        "--format",
+    ] {
+        assert!(request.contains(visible), "missing {visible}: {request}");
+    }
+    for hidden in ["--project", "--evidence-bin", "--mint-bin"] {
+        assert!(!request.contains(hidden), "test seam leaked: {request}");
+    }
+
+    let verify = command()
+        .args(["verify", "--help"])
+        .output()
+        .expect("verify help");
+    assert_success(&verify);
+    let verify = String::from_utf8_lossy(&verify.stdout);
+    for visible in ["<RESPONSE>", "--context", "--output"] {
+        assert!(verify.contains(visible), "missing {visible}: {verify}");
+    }
+    assert!(!verify.contains("--evidence-bin"));
+}
+
+#[test]
+fn prepare_and_verify_delegate_exactly_and_publish_only_safe_artifacts() {
+    let fixture = Fixture::new();
+    let prepared = fixture.prepare("first-assertion");
+    assert_success(&prepared);
+    assert_eq!(
+        String::from_utf8_lossy(&prepared.stdout),
+        "Prepared request: .evidence/requests/first-assertion/request.json\n\
+         Prepared verification context: .evidence/requests/first-assertion/verification.json\n\
+         Prepared authorization: .evidence/requests/first-assertion/authorization.curl\n"
+    );
+
+    let retained = fixture.root.join(".evidence/requests/first-assertion");
+    assert_mode(&fixture.root.join(".evidence/requests"), 0o700);
+    assert_mode(&retained, 0o700);
+    assert_eq!(
+        sorted_names(&retained),
+        ["authorization.curl", "request.json", "verification.json"]
+    );
+    for name in ["authorization.curl", "request.json", "verification.json"] {
+        assert_mode(&retained.join(name), 0o600);
+    }
+
+    let request_bytes = fs::read(retained.join("request.json")).expect("request");
+    let request: Value = serde_json::from_slice(&request_bytes).expect("request JSON");
+    assert_eq!(
+        request,
+        json!({
+            "requestNonce": request["requestNonce"],
+            "requirement": "urn:registrystack:evidence:local:requirement:adult-status",
+            "purpose": "age-check",
+            "subjects": [{
+                "role": "person",
+                "selector": {
+                    "profile": "local-subject-adult-status-v1",
+                    "values": {"person_id": "person-123"}
+                }
+            }]
+        })
+    );
+    let nonce = request["requestNonce"].as_str().expect("nonce");
+    assert_eq!(nonce.len(), 43);
+    assert_eq!(
+        URL_SAFE_NO_PAD
+            .decode(nonce)
+            .expect("canonical nonce")
+            .len(),
+        32
+    );
+    assert_eq!(
+        fs::read_to_string(retained.join("verification.json")).unwrap(),
+        CONTEXT
+    );
+    assert_eq!(
+        fs::read_to_string(retained.join("authorization.curl")).unwrap(),
+        format!("header = \"Authorization: Bearer {TOKEN}\"\n")
+    );
+
+    let mint_args = fs::read_to_string(fixture.mint.with_extension("args")).unwrap();
+    assert_eq!(
+        mint_args.lines().collect::<Vec<_>>(),
+        [
+            "token",
+            "--url",
+            "http://127.0.0.1:8081/token",
+            "--client-id",
+            "local-tutorial-caller",
+            "--key",
+            fs::canonicalize(&fixture.root)
+                .unwrap()
+                .join(".evidence/dev/generated/keys/caller-private.jwk")
+                .to_str()
+                .unwrap(),
+            "--audience",
+            "http://127.0.0.1:8081/token",
+        ]
+    );
+    let evidence_args = fs::read_to_string(fixture.evidence.with_extension("prepare.args"))
+        .expect("Evidence prepare argv");
+    let evidence_args = evidence_args.lines().collect::<Vec<_>>();
+    assert_eq!(evidence_args[0], "--runtime");
+    assert_eq!(evidence_args[2], "prepare-local-verification-context");
+    assert_eq!(evidence_args[3], "--request");
+    assert!(evidence_args[4].ends_with("/request.json"));
+    assert_eq!(&evidence_args[5..], ["--response-format", "signed-jws"]);
+    assert!(!evidence_args.join(" ").contains(TOKEN));
+    assert_eq!(
+        fs::read_to_string(fixture.evidence.with_extension("prepare.stdin")).unwrap(),
+        "stdin-ok\n"
+    );
+    for non_secret in [
+        &request_bytes,
+        fs::read(retained.join("verification.json"))
+            .unwrap()
+            .as_slice(),
+        &prepared.stdout,
+        &prepared.stderr,
+    ] {
+        assert!(!String::from_utf8_lossy(non_secret).contains(TOKEN));
+    }
+
+    let second = fixture.prepare("second-assertion");
+    assert_success(&second);
+    let second: Value = serde_json::from_slice(
+        &fs::read(
+            fixture
+                .root
+                .join(".evidence/requests/second-assertion/request.json"),
+        )
+        .unwrap(),
+    )
+    .unwrap();
+    assert_ne!(request["requestNonce"], second["requestNonce"]);
+
+    let sd_jwt = fixture.prepare_with(
+        &[
+            "adult-status",
+            "--purpose",
+            "age-check",
+            "--subject",
+            "person_id=person-123",
+            "--format",
+            "sd-jwt-vc",
+        ],
+        "sd-jwt-assertion",
+    );
+    assert_success(&sd_jwt);
+    let evidence_args = fs::read_to_string(fixture.evidence.with_extension("prepare.args"))
+        .expect("Evidence SD-JWT prepare argv");
+    assert_eq!(
+        &evidence_args.lines().collect::<Vec<_>>()[5..],
+        ["--response-format", "sd-jwt-vc"]
+    );
+
+    let age = fixture.prepare_with(
+        &[
+            "age-bracket",
+            "--purpose",
+            "service-path-selection",
+            "--subject",
+            "person_id=person-123",
+        ],
+        "age-bracket",
+    );
+    assert_success(&age);
+    let age: Value = serde_json::from_slice(
+        &fs::read(
+            fixture
+                .root
+                .join(".evidence/requests/age-bracket/request.json"),
+        )
+        .unwrap(),
+    )
+    .unwrap();
+    assert_eq!(
+        age["requirement"],
+        "urn:registrystack:evidence:local:requirement:age-bracket"
+    );
+    assert_eq!(age["purpose"], "service-path-selection");
+    assert_eq!(
+        age["subjects"][0]["selector"]["profile"],
+        "local-subject-age-bracket-v1"
+    );
+
+    let response = fixture.root.join("assertion.jws.json");
+    fs::write(&response, b"ordinary curl response").expect("response");
+    fs::set_permissions(&response, fs::Permissions::from_mode(0o644)).expect("curl mode");
+    let verified = fixture.verify("verified.json");
+    assert_success(&verified);
+    assert_eq!(verified.stdout, b"VERIFIED\n");
+    let verified_path = fixture.root.join("verified.json");
+    assert_mode(&verified_path, 0o600);
+    assert_eq!(fs::read_to_string(&verified_path).unwrap(), VERIFIED);
+    assert_eq!(
+        fs::read_to_string(fixture.evidence.with_extension("verify.args"))
+            .unwrap()
+            .lines()
+            .collect::<Vec<_>>(),
+        [
+            "verify-local-response",
+            "--context",
+            ".evidence/requests/first-assertion/verification.json",
+            "--response",
+            "assertion.jws.json",
+        ]
+    );
+
+    let refused = fixture.verify("verified.json");
+    assert!(!refused.status.success());
+    assert_eq!(fs::read_to_string(&verified_path).unwrap(), VERIFIED);
+}
+
+#[test]
+fn named_client_prepare_uses_the_registered_identity() {
+    let fixture = Fixture::new();
+    fixture.add_named_client("age-checker", "active", 0o600);
+    fixture.use_explicit_access();
+
+    let prepared = fixture.prepare_as("age-checker", "named-client");
+    assert_success(&prepared);
+    let mint_args = fs::read_to_string(fixture.mint.with_extension("args")).unwrap();
+    assert_eq!(
+        mint_args.lines().collect::<Vec<_>>(),
+        [
+            "token",
+            "--url",
+            "http://127.0.0.1:8081/token",
+            "--client-id",
+            "age-checker",
+            "--key",
+            fs::canonicalize(&fixture.root)
+                .unwrap()
+                .join(".evidence/clients/age-checker/private.jwk")
+                .to_str()
+                .unwrap(),
+            "--audience",
+            "http://127.0.0.1:8081/token",
+        ]
+    );
+    assert!(fixture
+        .root
+        .join(".evidence/requests/named-client/request.json")
+        .is_file());
+}
+
+#[test]
+fn unusable_named_clients_and_mint_refusal_publish_no_request_artifacts() {
+    let unknown = Fixture::new();
+    unknown.add_named_client("other-client", "active", 0o600);
+    unknown.use_explicit_access();
+    let output = unknown.prepare_as("unknown-client", "unknown-client");
+    assert!(!output.status.success());
+    assert_eq!(
+        String::from_utf8_lossy(&output.stderr),
+        "evidencectl: unknown or revoked active client unknown-client\n"
+    );
+    assert_no_request_artifacts(&unknown.root, "unknown-client");
+
+    let revoked = Fixture::new();
+    revoked.add_named_client("other-client", "active", 0o600);
+    revoked.add_named_client("revoked-client", "revoked", 0o600);
+    revoked.use_explicit_access();
+    let output = revoked.prepare_as("revoked-client", "revoked-client");
+    assert!(!output.status.success());
+    assert_eq!(
+        String::from_utf8_lossy(&output.stderr),
+        "evidencectl: unknown or revoked active client revoked-client\n"
+    );
+    assert_no_request_artifacts(&revoked.root, "revoked-client");
+
+    let unsafe_key = Fixture::new();
+    unsafe_key.add_named_client("unsafe-client", "active", 0o644);
+    unsafe_key.use_explicit_access();
+    let output = unsafe_key.prepare_as("unsafe-client", "unsafe-client");
+    assert!(!output.status.success());
+    assert_no_request_artifacts(&unsafe_key.root, "unsafe-client");
+
+    let missing_key = Fixture::new();
+    missing_key.add_named_client("missing-key-client", "active", 0o600);
+    missing_key.use_explicit_access();
+    fs::remove_dir_all(
+        missing_key
+            .root
+            .join(".evidence/clients/missing-key-client"),
+    )
+    .unwrap();
+    let output = missing_key.prepare_as("missing-key-client", "missing-key-client");
+    assert!(!output.status.success());
+    assert_no_request_artifacts(&missing_key.root, "missing-key-client");
+
+    let mismatched_key = Fixture::new();
+    mismatched_key.add_named_client("mismatched-key-client", "active", 0o600);
+    mismatched_key.use_explicit_access();
+    let registration = mismatched_key
+        .root
+        .join("access/clients/mismatched-key-client.yaml");
+    let text = fs::read_to_string(&registration).unwrap().replace(
+        "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo",
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+    );
+    fs::write(&registration, text).unwrap();
+    let output = mismatched_key.prepare_as("mismatched-key-client", "mismatched-key-client");
+    assert!(!output.status.success());
+    assert_no_request_artifacts(&mismatched_key.root, "mismatched-key-client");
+
+    let refused = Fixture::new();
+    refused.add_named_client("refused-client", "active", 0o600);
+    refused.use_explicit_access();
+    fs::write(refused.mint.with_extension("fail"), b"").unwrap();
+    let output = refused.prepare_as("refused-client", "refused-client");
+    assert!(!output.status.success());
+    assert!(!String::from_utf8_lossy(&output.stderr).contains(TOKEN));
+    assert_eq!(
+        String::from_utf8_lossy(&output.stderr),
+        "evidencectl: Registry Mint refused a token for client refused-client\n"
+    );
+    assert_no_request_artifacts(&refused.root, "refused-client");
+}
+
+#[test]
+fn selected_clients_require_an_explicit_current_policy_generation() {
+    let implicit = Fixture::new();
+    implicit.add_named_client("age-checker", "active", 0o600);
+    let output = implicit.prepare_as("age-checker", "implicit-client");
+    assert!(!output.status.success());
+    assert_no_request_artifacts(&implicit.root, "implicit-client");
+
+    let explicit = Fixture::new();
+    explicit.add_named_client("age-checker", "active", 0o600);
+    explicit.use_explicit_access();
+    let output = explicit.prepare("missing-client");
+    assert!(!output.status.success());
+    assert_no_request_artifacts(&explicit.root, "missing-client");
+
+    private_file(
+        &explicit.root.join("questions/age-bracket.yaml"),
+        b"id: age-bracket\n",
+        0o644,
+    );
+    private_file(
+        &explicit.root.join("access/policies/age-checks.yaml"),
+        b"version: 1\nid: age-checks\nquestions: [adult-status, age-bracket]\n",
+        0o644,
+    );
+    let output = explicit.prepare_as("age-checker", "drifted-policy");
+    assert!(!output.status.success());
+    assert_no_request_artifacts(&explicit.root, "drifted-policy");
+}
+
+#[test]
+fn multi_subject_prepare_requires_the_exact_role_set_and_emits_declaration_order() {
+    let fixture = Fixture::new();
+    let prepared = fixture.prepare_with(
+        &[
+            "relationship-check",
+            "--purpose",
+            "relationship-review",
+            "--subject",
+            "candidate:person_reference=person-456",
+            "--subject",
+            "child:child_reference=child-123",
+        ],
+        "relationship",
+    );
+    assert_success(&prepared);
+    let request: Value = serde_json::from_slice(
+        &fs::read(
+            fixture
+                .root
+                .join(".evidence/requests/relationship/request.json"),
+        )
+        .unwrap(),
+    )
+    .unwrap();
+    assert_eq!(
+        request["subjects"],
+        json!([
+            {
+                "role": "child",
+                "selector": {
+                    "profile": "child-reference-v1",
+                    "values": {"child_reference": "child-123"}
+                }
+            },
+            {
+                "role": "candidate",
+                "selector": {
+                    "profile": "person-reference-v1",
+                    "values": {"person_reference": "person-456"}
+                }
+            }
+        ])
+    );
+
+    for (name, inputs) in [
+        (
+            "missing",
+            vec![
+                "relationship-check",
+                "--purpose",
+                "relationship-review",
+                "--subject",
+                "child:child_reference=child-123",
+            ],
+        ),
+        (
+            "duplicate",
+            vec![
+                "relationship-check",
+                "--purpose",
+                "relationship-review",
+                "--subject",
+                "child:child_reference=child-123",
+                "--subject",
+                "child:child_reference=child-456",
+            ],
+        ),
+        (
+            "wrong-field",
+            vec![
+                "relationship-check",
+                "--purpose",
+                "relationship-review",
+                "--subject",
+                "child:person_reference=child-123",
+                "--subject",
+                "candidate:child_reference=person-456",
+            ],
+        ),
+    ] {
+        let refused = fixture.prepare_with(&inputs, name);
+        assert!(!refused.status.success(), "{name} role set must fail");
+        assert!(!fixture.root.join(".evidence/requests").join(name).exists());
+    }
+}
+
+#[test]
+fn request_inputs_are_exact_and_every_failed_preparation_cleans_staging() {
+    for arguments in [
+        vec![
+            "other",
+            "--purpose",
+            "age-check",
+            "--subject",
+            "person_id=person-123",
+        ],
+        vec![
+            "adult-status",
+            "--purpose",
+            "other",
+            "--subject",
+            "person_id=person-123",
+        ],
+        vec![
+            "adult-status",
+            "--purpose",
+            "age-check",
+            "--subject",
+            "other=person-123",
+        ],
+        vec![
+            "adult-status",
+            "--purpose",
+            "age-check",
+            "--subject",
+            "person_id=",
+        ],
+        vec![
+            "adult-status",
+            "--purpose",
+            "age-check",
+            "--subject",
+            "person_id=a=b",
+        ],
+    ] {
+        let fixture = Fixture::new();
+        let output = fixture.prepare_with(&arguments, "first-assertion");
+        assert!(!output.status.success(), "{arguments:?}");
+        assert!(!fixture
+            .root
+            .join(".evidence/requests/first-assertion")
+            .exists());
+    }
+
+    let fixture = Fixture::new();
+    fs::write(fixture.evidence.with_extension("fail-prepare"), b"").unwrap();
+    let failed = fixture.prepare("first-assertion");
+    assert!(!failed.status.success());
+    assert!(!String::from_utf8_lossy(&failed.stderr).contains(TOKEN));
+    let requests = fixture.root.join(".evidence/requests");
+    assert_eq!(sorted_names(&requests), Vec::<String>::new());
+
+    let existing = Fixture::new();
+    let target = existing.root.join(".evidence/requests/first-assertion");
+    fs::create_dir_all(&target).unwrap();
+    fs::set_permissions(target.parent().unwrap(), fs::Permissions::from_mode(0o700)).unwrap();
+    fs::set_permissions(&target, fs::Permissions::from_mode(0o700)).unwrap();
+    fs::write(target.join("canary"), b"keep").unwrap();
+    let failed = existing.prepare("first-assertion");
+    assert!(!failed.status.success());
+    assert_eq!(fs::read(target.join("canary")).unwrap(), b"keep");
+}
+
+#[test]
+fn unsafe_request_and_verify_paths_are_refused_without_clobbering() {
+    let public = Fixture::new();
+    let requests = public.root.join(".evidence/requests");
+    fs::create_dir(&requests).unwrap();
+    fs::set_permissions(&requests, fs::Permissions::from_mode(0o755)).unwrap();
+    assert!(!public.prepare("first-assertion").status.success());
+
+    let linked = Fixture::new();
+    let target = linked.root.join("request-target");
+    fs::create_dir(&target).unwrap();
+    fs::set_permissions(&target, fs::Permissions::from_mode(0o700)).unwrap();
+    symlink(&target, linked.root.join(".evidence/requests")).unwrap();
+    assert!(!linked.prepare("first-assertion").status.success());
+    assert!(sorted_names(&target).is_empty());
+
+    let verify = Fixture::new();
+    fs::write(verify.root.join("assertion.jws.json"), b"response").unwrap();
+    let destination = verify.root.join("verified.json");
+    let canary = verify.root.join("canary");
+    fs::write(&canary, b"keep").unwrap();
+    symlink(&canary, &destination).unwrap();
+    assert!(!verify.verify("verified.json").status.success());
+    assert_eq!(fs::read(&canary).unwrap(), b"keep");
+
+    fs::remove_file(destination).unwrap();
+    let target = verify.root.join("output-target");
+    fs::create_dir(&target).unwrap();
+    let linked_parent = verify.root.join("linked-output");
+    symlink(&target, &linked_parent).unwrap();
+    let output = verify.verify("linked-output/verified.json");
+    assert!(!output.status.success());
+    assert!(sorted_names(&target).is_empty());
+}
+
+#[test]
+fn failed_core_verification_removes_the_unpublished_output() {
+    let fixture = Fixture::new();
+    fs::write(fixture.root.join("assertion.jws.json"), b"response").unwrap();
+    fs::write(fixture.evidence.with_extension("fail-verify"), b"").unwrap();
+    let output = fixture.verify("verified.json");
+    assert!(!output.status.success());
+    assert!(!fixture.root.join("verified.json").exists());
+    assert!(sorted_names(&fixture.root)
+        .iter()
+        .all(|name| !name.starts_with(".verify-")));
+}
+
+struct Fixture {
+    _temporary: tempfile::TempDir,
+    _listener: UnixListener,
+    root: PathBuf,
+    evidence: PathBuf,
+    mint: PathBuf,
+}
+
+impl Fixture {
+    fn new() -> Self {
+        let temporary = tempfile::tempdir().expect("temporary directory");
+        let root = temporary.path().join("project");
+        private_directory(&root);
+        private_directory(&root.join(".evidence"));
+        private_directory(&root.join(".evidence/dev"));
+        private_directory(&root.join(".evidence/dev/generated"));
+        private_directory(&root.join(".evidence/dev/generated/keys"));
+        private_file(&root.join(".evidence/dev/runtime.yaml"), b"runtime", 0o400);
+        let caller_key = root.join(".evidence/dev/generated/keys/caller-private.jwk");
+        private_file(&caller_key, b"{}", 0o600);
+        let socket = root.join(".evidence/dev/control.sock");
+        let listener = UnixListener::bind(&socket).expect("control socket");
+        fs::set_permissions(&socket, fs::Permissions::from_mode(0o600)).unwrap();
+        let canonical = fs::canonicalize(&root).unwrap();
+        let state = json!({
+            "schema": "registry.evidencectl.dev-state/v5",
+            "status": "ready",
+            "project": canonical,
+            "runtimePath": canonical.join(".evidence/dev/runtime.yaml"),
+            "evidenceOrigin": "http://127.0.0.1:8080",
+            "mintOrigin": "http://127.0.0.1:8081",
+            "tokenUrl": "http://127.0.0.1:8081/token",
+            "accessTokenAudience": "registry-evidence-local",
+            "caller": {
+                "clientId": "local-tutorial-caller",
+                "privateKeyPath": canonical.join(".evidence/dev/generated/keys/caller-private.jwk"),
+                "assertionAudience": "http://127.0.0.1:8081/token",
+                "evidenceAudience": "urn:registrystack:evidence:local:caller",
+                "requesterTag": "local-caller"
+            },
+            "accessPolicies": [],
+            "questions": [
+                {
+                    "alias": "adult-status",
+                    "requirementUri": "urn:registrystack:evidence:local:requirement:adult-status",
+                    "purpose": "age-check",
+                    "subjects": [{
+                        "role": "person",
+                        "selectorProfile": "local-subject-adult-status-v1",
+                        "selectorField": "person_id"
+                    }],
+                    "concepts": [{
+                        "alias": "is_adult",
+                        "uri": "urn:registrystack:evidence:local:concept:adult-status:is_adult",
+                        "form": "boolean"
+                    }]
+                },
+                {
+                    "alias": "age-bracket",
+                    "requirementUri": "urn:registrystack:evidence:local:requirement:age-bracket",
+                    "purpose": "service-path-selection",
+                    "subjects": [{
+                        "role": "person",
+                        "selectorProfile": "local-subject-age-bracket-v1",
+                        "selectorField": "person_id"
+                    }],
+                    "concepts": [{
+                        "alias": "age_bracket",
+                        "uri": "urn:registrystack:evidence:local:concept:age-bracket:age_bracket",
+                        "form": "controlled-category"
+                    }]
+                },
+                {
+                    "alias": "relationship-check",
+                    "requirementUri": "urn:registrystack:evidence:local:requirement:relationship-check",
+                    "purpose": "relationship-review",
+                    "subjects": [
+                        {
+                            "role": "child",
+                            "selectorProfile": "child-reference-v1",
+                            "selectorField": "child_reference"
+                        },
+                        {
+                            "role": "candidate",
+                            "selectorProfile": "person-reference-v1",
+                            "selectorField": "person_reference"
+                        }
+                    ],
+                    "concepts": [{
+                        "alias": "relationship_confirmed",
+                        "uri": "urn:registrystack:evidence:local:concept:relationship-check:relationship_confirmed",
+                        "form": "boolean"
+                    }]
+                }
+            ],
+            "failure": null
+        });
+        private_file(
+            &root.join(".evidence/dev/state.json"),
+            &serde_json::to_vec(&state).unwrap(),
+            0o600,
+        );
+        write_sealed_bundle(&root, &state);
+
+        let mint = temporary.path().join("mint-stub");
+        executable(
+            &mint,
+            format!(
+                "#!/bin/sh\nprintf '%s\\n' \"$@\" > \"$0.args\"\n[ ! -f \"$0.fail\" ] || exit 31\nprintf '%s\\n' '{TOKEN}'\n"
+            )
+            .as_bytes(),
+        );
+        let evidence = temporary.path().join("evidence-stub");
+        executable(
+            &evidence,
+            format!(
+                "#!/bin/sh\ncase \"$1\" in\n  --runtime)\n    printf '%s\\n' \"$@\" > \"$0.prepare.args\"\n    bearer=$(dd bs=65536 count=1 2>/dev/null)\n    [ \"$bearer\" = '{TOKEN}' ] || exit 40\n    printf 'stdin-ok\\n' > \"$0.prepare.stdin\"\n    [ ! -f \"$0.fail-prepare\" ] || exit 41\n    printf '%s' '{CONTEXT}'\n    ;;\n  verify-local-response)\n    printf '%s\\n' \"$@\" > \"$0.verify.args\"\n    [ ! -f \"$0.fail-verify\" ] || exit 42\n    printf '%s' '{VERIFIED}'\n    ;;\n  *) exit 43 ;;\nesac\n"
+            )
+            .as_bytes(),
+        );
+        Self {
+            _temporary: temporary,
+            _listener: listener,
+            root,
+            evidence,
+            mint,
+        }
+    }
+
+    fn prepare(&self, name: &str) -> Output {
+        self.prepare_with(
+            &[
+                "adult-status",
+                "--purpose",
+                "age-check",
+                "--subject",
+                "person_id=person-123",
+            ],
+            name,
+        )
+    }
+
+    fn prepare_with(&self, inputs: &[&str], name: &str) -> Output {
+        command()
+            .current_dir(&self.root)
+            .args(["request", "prepare"])
+            .args(inputs)
+            .args(["--name", name, "--project", ".", "--evidence-bin"])
+            .arg(&self.evidence)
+            .arg("--mint-bin")
+            .arg(&self.mint)
+            .output()
+            .expect("prepare command")
+    }
+
+    fn prepare_as(&self, client_id: &str, name: &str) -> Output {
+        self.prepare_with(
+            &[
+                "adult-status",
+                "--purpose",
+                "age-check",
+                "--subject",
+                "person_id=person-123",
+                "--client",
+                client_id,
+            ],
+            name,
+        )
+    }
+
+    fn add_named_client(&self, client_id: &str, status: &str, key_mode: u32) {
+        let questions = self.root.join("questions");
+        fs::create_dir_all(&questions).expect("authored question directory");
+        private_file(
+            &questions.join("adult-status.yaml"),
+            b"id: adult-status\n",
+            0o644,
+        );
+        let policies = self.root.join("access/policies");
+        fs::create_dir_all(&policies).expect("editable policy directory");
+        private_file(
+            &policies.join("age-checks.yaml"),
+            b"version: 1\nid: age-checks\nquestions: [adult-status]\n",
+            0o644,
+        );
+        let clients = self.root.join("access/clients");
+        fs::create_dir_all(&clients).expect("editable client directory");
+        private_file(
+            &clients.join(format!("{client_id}.yaml")),
+            format!(
+                "version: 1\n\
+                 clientId: {client_id}\n\
+                 status: {status}\n\
+                 principal: urn:registrystack:evidence:local:client:{client_id}\n\
+                 evidenceAudience: urn:registrystack:evidence:local:client:{client_id}\n\
+                 policies: [age-checks]\n\
+                 keys:\n\
+                   - {{kty: OKP, crv: Ed25519, kid: {client_id}-key-1, alg: EdDSA, use: sig, x: 11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo}}\n"
+            )
+            .as_bytes(),
+            0o644,
+        );
+
+        let private_clients = self.root.join(".evidence/clients");
+        if !private_clients.exists() {
+            private_directory(&private_clients);
+        }
+        let private_client = private_clients.join(client_id);
+        private_directory(&private_client);
+        private_file(
+            &private_client.join("private.jwk"),
+            format!(
+                "{{\"kty\":\"OKP\",\"crv\":\"Ed25519\",\"kid\":\"{client_id}-key-1\",\"alg\":\"EdDSA\",\"x\":\"11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo\",\"d\":\"nWGxne_9WmC6hEr0kuwsxERJxWl7MmkZcDusAxyuf2A\"}}"
+            )
+            .as_bytes(),
+            key_mode,
+        );
+    }
+
+    fn use_explicit_access(&self) {
+        let path = self.root.join(".evidence/dev/state.json");
+        let mut state: Value = serde_json::from_slice(&fs::read(&path).unwrap()).unwrap();
+        state["caller"] = Value::Null;
+        state["accessPolicies"] = json!([{
+            "id": "age-checks",
+            "requesterTag": AGE_CHECKS_TAG,
+            "questions": ["adult-status"]
+        }]);
+        fs::write(&path, serde_json::to_vec(&state).unwrap()).unwrap();
+        fs::set_permissions(&path, fs::Permissions::from_mode(0o600)).unwrap();
+        write_sealed_bundle(&self.root, &state);
+    }
+
+    fn verify(&self, output: &str) -> Output {
+        command()
+            .current_dir(&self.root)
+            .args([
+                "verify",
+                "assertion.jws.json",
+                "--context",
+                ".evidence/requests/first-assertion/verification.json",
+                "--output",
+                output,
+                "--evidence-bin",
+            ])
+            .arg(&self.evidence)
+            .output()
+            .expect("verify command")
+    }
+}
+
+fn command() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_evidencectl"))
+}
+
+fn private_directory(path: &Path) {
+    fs::create_dir(path).expect("private directory");
+    fs::set_permissions(path, fs::Permissions::from_mode(0o700)).unwrap();
+}
+
+fn private_file(path: &Path, contents: &[u8], mode: u32) {
+    fs::write(path, contents).expect("private file");
+    fs::set_permissions(path, fs::Permissions::from_mode(mode)).unwrap();
+}
+
+fn write_sealed_bundle(root: &Path, state: &Value) {
+    let bundle_directory = root.join(".evidence/dev/bundle");
+    if !bundle_directory.exists() {
+        private_directory(&bundle_directory);
+    }
+    let questions = state["questions"].as_array().expect("state questions");
+    let mut selector_profiles = serde_json::Map::new();
+    let requirements = questions
+        .iter()
+        .map(|question| {
+            let roles = question["subjects"]
+                .as_array()
+                .expect("question subjects")
+                .iter()
+                .map(|subject| {
+                    let profile = subject["selectorProfile"]
+                        .as_str()
+                        .expect("selector profile");
+                    let field = subject["selectorField"].as_str().expect("selector field");
+                    selector_profiles.insert(
+                        profile.to_owned(),
+                        json!({"fields": {field: {"type": "string"}}}),
+                    );
+                    json!({"role": subject["role"], "selectorProfiles": [profile]})
+                })
+                .collect::<Vec<_>>();
+            let concepts = question["concepts"]
+                .as_array()
+                .expect("question concepts")
+                .iter()
+                .map(|concept| json!({"id": concept["uri"], "form": concept["form"]}))
+                .collect::<Vec<_>>();
+            json!({
+                "id": question["requirementUri"],
+                "purposes": [question["purpose"].clone()],
+                "subjectRoles": roles,
+                "concepts": concepts,
+            })
+        })
+        .collect::<Vec<_>>();
+    let grant_for = |question: &Value| {
+        let subjects = question["subjects"]
+            .as_array()
+            .expect("question subjects")
+            .iter()
+            .map(|subject| {
+                json!({
+                    "role": subject["role"],
+                    "selectorProfile": subject["selectorProfile"],
+                    "valueOrigin": "request",
+                })
+            })
+            .collect::<Vec<_>>();
+        json!({
+            "requirement": question["requirementUri"],
+            "purpose": question["purpose"],
+            "audienceFrom": "authenticated-requester",
+            "responseFormats": ["signed-jws"],
+            "subjects": subjects,
+        })
+    };
+    let access_policies = state["accessPolicies"]
+        .as_array()
+        .expect("state access policies");
+    let authority_profiles = if access_policies.is_empty() {
+        serde_json::Map::from_iter([(
+            "local-caller".to_owned(),
+            json!({
+                "kind": "explicit-request",
+                "requesterTags": ["local-caller"],
+                "grants": questions.iter().map(grant_for).collect::<Vec<_>>(),
+            }),
+        )])
+    } else {
+        access_policies
+            .iter()
+            .map(|policy| {
+                let requester_tag = policy["requesterTag"]
+                    .as_str()
+                    .expect("policy requester tag");
+                let grants = policy["questions"]
+                    .as_array()
+                    .expect("policy questions")
+                    .iter()
+                    .map(|alias| {
+                        let alias = alias.as_str().expect("question alias");
+                        let question = questions
+                            .iter()
+                            .find(|question| question["alias"] == alias)
+                            .expect("policy question exists");
+                        grant_for(question)
+                    })
+                    .collect::<Vec<_>>();
+                (
+                    requester_tag.to_owned(),
+                    json!({
+                        "kind": "explicit-request",
+                        "requesterTags": [requester_tag],
+                        "grants": grants,
+                    }),
+                )
+            })
+            .collect()
+    };
+    let bundle = json!({
+        "selectorProfiles": selector_profiles,
+        "authorityProfiles": authority_profiles,
+        "requirements": requirements,
+    });
+    let bundle_path = bundle_directory.join("evidence.yaml");
+    if bundle_path.exists() {
+        fs::set_permissions(&bundle_path, fs::Permissions::from_mode(0o600))
+            .expect("unseal bundle fixture");
+    }
+    private_file(
+        &bundle_path,
+        serde_norway::to_string(&bundle)
+            .expect("bundle renders")
+            .as_bytes(),
+        0o400,
+    );
+}
+
+fn executable(path: &Path, contents: &[u8]) {
+    private_file(path, contents, 0o700);
+}
+
+fn assert_mode(path: &Path, expected: u32) {
+    let mode = fs::symlink_metadata(path).unwrap().permissions().mode() & 0o777;
+    assert_eq!(mode, expected, "{}", path.display());
+}
+
+fn sorted_names(path: &Path) -> Vec<String> {
+    let mut names = fs::read_dir(path)
+        .unwrap()
+        .map(|entry| entry.unwrap().file_name().to_string_lossy().into_owned())
+        .collect::<Vec<_>>();
+    names.sort();
+    names
+}
+
+fn assert_no_request_artifacts(project: &Path, name: &str) {
+    let requests = project.join(".evidence/requests");
+    assert!(!requests.join(name).exists());
+    if requests.exists() {
+        assert_eq!(sorted_names(&requests), Vec::<String>::new());
+    }
+}
+
+fn assert_success(output: &Output) {
+    assert!(
+        output.status.success(),
+        "stdout: {}\nstderr: {}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+}
diff --git a/crates/registry-evidencectl/tests/scaffold.rs b/crates/registry-evidencectl/tests/scaffold.rs
new file mode 100644
index 000000000..f754b6fae
--- /dev/null
+++ b/crates/registry-evidencectl/tests/scaffold.rs
@@ -0,0 +1,363 @@
+//! Acceptance tests for the minimal `evidencectl new --openapi` path.
+
+#![cfg(unix)]
+
+use std::{
+    fs,
+    io::{Read as _, Write as _},
+    net::TcpListener,
+    os::unix::fs::{symlink, PermissionsExt as _},
+    path::{Path, PathBuf},
+    process::{Command, Output},
+};
+
+use tempfile::TempDir;
+
+const OPENAPI: &str = "# retained comment\r\nopenapi: 3.1.0\r\ninfo:\r\n  title: Records\r\n  version: 1.0.0\r\npaths: {}\r\n";
+
+#[test]
+fn bare_new_points_to_openapi_and_writes_nothing() {
+    let workspace = TempDir::new().expect("temporary directory");
+    let project = workspace.path().join("project");
+    let output = evidencectl(&["new", path(&project)]);
+
+    assert!(!output.status.success());
+    assert!(stderr(&output).contains("--openapi <path-or-https-url>"));
+    assert!(!project.exists());
+}
+
+#[test]
+fn openapi_requires_the_explicit_local_profile_before_writing() {
+    let workspace = TempDir::new().expect("temporary directory");
+    let spec = write_spec(workspace.path(), OPENAPI.as_bytes());
+    let project = workspace.path().join("project");
+    let output = evidencectl(&["new", path(&project), "--openapi", path(&spec)]);
+
+    assert!(!output.status.success());
+    assert!(stderr(&output).contains("--profile local"));
+    assert!(!project.exists());
+
+    let wrong = workspace.path().join("wrong");
+    let output = evidencectl(&[
+        "new",
+        path(&wrong),
+        "--openapi",
+        path(&spec),
+        "--profile",
+        "production",
+    ]);
+    assert!(!output.status.success());
+    assert!(stderr(&output).contains("invalid value 'production'"));
+    assert!(!wrong.exists());
+}
+
+#[test]
+fn local_openapi_is_retained_byte_for_byte_without_premature_artifacts() {
+    let workspace = TempDir::new().expect("temporary directory");
+    let spec = write_spec(workspace.path(), OPENAPI.as_bytes());
+    let project = workspace.path().join("project");
+    let output = openapi_new(&project, path(&spec), &[]);
+    assert!(output.status.success(), "{}", stderr(&output));
+
+    assert_eq!(
+        fs::read(project.join("source.openapi.yaml")).expect("retained OpenAPI"),
+        OPENAPI.as_bytes()
+    );
+    assert_minimal_project(&project, false);
+    assert!(stdout(&output).contains("retained exactly"));
+    assert!(stdout(&output).contains("No question, fixture case, runtime"));
+    assert!(stdout(&output).contains("evidencectl source suggest --project"));
+}
+
+#[test]
+fn remote_openapi_is_retained_byte_for_byte() {
+    let workspace = TempDir::new().expect("temporary directory");
+    let mut remote = OPENAPI.as_bytes().to_vec();
+    remote.extend_from_slice(b"# remote trailing bytes\n");
+    let url = serve_once(200, remote.clone());
+    let project = workspace.path().join("remote-project");
+
+    let output = openapi_new(&project, &url, &[]);
+    assert!(output.status.success(), "{}", stderr(&output));
+    assert_eq!(
+        fs::read(project.join("source.openapi.yaml")).expect("retained remote OpenAPI"),
+        remote
+    );
+    assert_minimal_project(&project, false);
+}
+
+#[test]
+fn invalid_local_or_remote_openapi_writes_nothing_and_cleans_staging() {
+    let workspace = TempDir::new().expect("temporary directory");
+    let invalid = write_spec(workspace.path(), b"not: openapi\n");
+    let invalid_project = workspace.path().join("invalid-project");
+    let output = openapi_new(&invalid_project, path(&invalid), &["--generate-keys"]);
+    assert!(!output.status.success());
+    assert!(!invalid_project.exists());
+
+    let failed_url = serve_once(500, b"failure\n".to_vec());
+    let failed_project = workspace.path().join("failed-project");
+    let output = openapi_new(&failed_project, &failed_url, &[]);
+    assert!(!output.status.success());
+    assert!(stderr(&output).contains("HTTP 500"));
+    assert!(!failed_project.exists());
+    assert_no_staging_directories(workspace.path());
+}
+
+#[test]
+fn unsafe_remote_urls_are_value_free_and_fail_before_network_or_writes() {
+    let workspace = TempDir::new().expect("temporary directory");
+    let listener = TcpListener::bind("127.0.0.1:0").expect("bind connection probe");
+    listener
+        .set_nonblocking(true)
+        .expect("nonblocking connection probe");
+    let address = listener.local_addr().expect("probe address");
+
+    for (name, url, sensitive, expected) in [
+        (
+            "userinfo",
+            format!("http://reader:userinfo-secret@{address}/openapi.yaml"),
+            "userinfo-secret",
+            "credentials",
+        ),
+        (
+            "query",
+            format!("http://{address}/openapi.yaml?access_token=query-secret"),
+            "query-secret",
+            "query or fragment",
+        ),
+        (
+            "fragment",
+            format!("http://{address}/openapi.yaml#private-fragment"),
+            "private-fragment",
+            "query or fragment",
+        ),
+    ] {
+        let project = workspace.path().join(name);
+        let output = openapi_new(&project, &url, &["--generate-keys"]);
+        assert!(!output.status.success());
+        let logged = format!("{}{}", stdout(&output), stderr(&output));
+        assert!(logged.contains(expected), "unexpected refusal: {logged}");
+        assert!(
+            !logged.contains(sensitive) && !logged.contains(&url),
+            "refusal leaked an unsafe URL value: {logged}"
+        );
+        assert!(!project.exists(), "unsafe URL wrote project {name}");
+    }
+
+    assert!(
+        matches!(listener.accept(), Err(error) if error.kind() == std::io::ErrorKind::WouldBlock),
+        "an unsafe URL reached the network"
+    );
+    assert_no_staging_directories(workspace.path());
+}
+
+#[test]
+fn generate_keys_is_transactional_unbound_owner_only_and_prints_no_secret() {
+    let workspace = TempDir::new().expect("temporary directory");
+    let spec = write_spec(workspace.path(), OPENAPI.as_bytes());
+    let project = workspace.path().join("project");
+    let output = openapi_new(&project, path(&spec), &["--generate-keys"]);
+    assert!(output.status.success(), "{}", stderr(&output));
+
+    assert_minimal_project(&project, true);
+    assert_eq!(
+        fs::metadata(project.join("secrets"))
+            .expect("secret directory")
+            .permissions()
+            .mode()
+            & 0o777,
+        0o700
+    );
+    for (name, mode) in [
+        ("signing-ed25519-private-jwk", 0o600),
+        ("signing-ed25519-public.jwk.json", 0o644),
+        ("audit-hmac-key", 0o600),
+        ("subject-binding-hmac-key", 0o600),
+    ] {
+        assert_eq!(
+            fs::metadata(project.join("secrets").join(name))
+                .unwrap_or_else(|error| panic!("reading {name}: {error}"))
+                .permissions()
+                .mode()
+                & 0o777,
+            mode
+        );
+    }
+
+    let private = fs::read_to_string(project.join("secrets/signing-ed25519-private-jwk"))
+        .expect("private JWK");
+    let private: serde_json::Value = serde_json::from_str(&private).expect("private JWK JSON");
+    let secret = private["d"].as_str().expect("private key member");
+    assert!(!stdout(&output).contains(secret));
+    assert!(!stderr(&output).contains(secret));
+    assert_no_staging_directories(workspace.path());
+}
+
+#[test]
+fn existing_paths_and_force_are_refused_without_changes() {
+    let workspace = TempDir::new().expect("temporary directory");
+    let spec = write_spec(workspace.path(), OPENAPI.as_bytes());
+
+    let directory = workspace.path().join("existing");
+    fs::create_dir(&directory).expect("existing directory");
+    fs::write(directory.join("sentinel"), b"unchanged").expect("sentinel");
+    let output = openapi_new(&directory, path(&spec), &[]);
+    assert!(!output.status.success());
+    assert_eq!(
+        fs::read(directory.join("sentinel")).expect("sentinel"),
+        b"unchanged"
+    );
+
+    let external = workspace.path().join("external");
+    fs::create_dir(&external).expect("external directory");
+    fs::write(external.join("sentinel"), b"external").expect("external sentinel");
+    let symlinked = workspace.path().join("symlinked");
+    symlink(&external, &symlinked).expect("project symlink");
+    let output = openapi_new(&symlinked, path(&spec), &["--generate-keys"]);
+    assert!(!output.status.success());
+    assert_eq!(
+        fs::read(external.join("sentinel")).expect("external sentinel"),
+        b"external"
+    );
+    assert_eq!(entries(&external), ["sentinel"]);
+
+    let forced = workspace.path().join("forced");
+    let output = openapi_new(&forced, path(&spec), &["--force"]);
+    assert!(!output.status.success());
+    assert!(stderr(&output).contains("unexpected argument '--force'"));
+    assert!(!forced.exists());
+    assert_no_staging_directories(workspace.path());
+}
+
+fn assert_minimal_project(project: &Path, with_keys: bool) {
+    let expected = if with_keys {
+        vec![
+            ".gitignore",
+            "adapters",
+            "derivations",
+            "fixtures",
+            "questions",
+            "schemas",
+            "secrets",
+            "selectors",
+            "source.openapi.yaml",
+            "sources",
+        ]
+    } else {
+        vec![
+            ".gitignore",
+            "adapters",
+            "derivations",
+            "fixtures",
+            "questions",
+            "schemas",
+            "selectors",
+            "source.openapi.yaml",
+            "sources",
+        ]
+    };
+    assert_eq!(entries(project), expected);
+    assert!(entries(&project.join("questions")).is_empty());
+    assert!(entries(&project.join("derivations")).is_empty());
+    assert!(entries(&project.join("selectors")).is_empty());
+    assert!(entries(&project.join("sources")).is_empty());
+    assert!(entries(&project.join("adapters")).is_empty());
+    assert!(entries(&project.join("schemas")).is_empty());
+    assert!(entries(&project.join("fixtures")).is_empty());
+    assert_eq!(
+        fs::read_to_string(project.join(".gitignore")).expect("gitignore"),
+        "secrets/\n.evidence/\n"
+    );
+    for absent in ["bundle", "runtime.yaml", "evidence.yaml", "README.md"] {
+        assert!(
+            !project.join(absent).exists(),
+            "unexpected generated {absent}"
+        );
+    }
+}
+
+fn openapi_new(project: &Path, openapi: &str, extra: &[&str]) -> Output {
+    let mut arguments = vec![
+        "new",
+        path(project),
+        "--openapi",
+        openapi,
+        "--profile",
+        "local",
+    ];
+    arguments.extend_from_slice(extra);
+    evidencectl(&arguments)
+}
+
+fn evidencectl(arguments: &[&str]) -> Output {
+    Command::new(env!("CARGO_BIN_EXE_evidencectl"))
+        .args(arguments)
+        .output()
+        .expect("running evidencectl")
+}
+
+fn write_spec(root: &Path, contents: &[u8]) -> PathBuf {
+    let path = root.join("records.openapi.yaml");
+    fs::write(&path, contents).expect("OpenAPI fixture");
+    path
+}
+
+fn serve_once(status: u16, body: Vec<u8>) -> String {
+    let listener = TcpListener::bind("127.0.0.1:0").expect("bind loopback server");
+    let address = listener.local_addr().expect("server address");
+    std::thread::spawn(move || {
+        let (mut stream, _) = listener.accept().expect("accept request");
+        let mut request = [0_u8; 4096];
+        let _ = stream.read(&mut request);
+        let reason = if status == 200 {
+            "OK"
+        } else {
+            "Internal Server Error"
+        };
+        write!(
+            stream,
+            "HTTP/1.1 {status} {reason}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+            body.len()
+        )
+        .expect("response headers");
+        stream.write_all(&body).expect("response body");
+    });
+    format!("http://{address}/openapi.yaml")
+}
+
+fn entries(root: &Path) -> Vec<String> {
+    let mut names = fs::read_dir(root)
+        .unwrap_or_else(|error| panic!("reading {}: {error}", root.display()))
+        .map(|entry| {
+            entry
+                .expect("directory entry")
+                .file_name()
+                .to_string_lossy()
+                .into_owned()
+        })
+        .collect::<Vec<_>>();
+    names.sort();
+    names
+}
+
+fn assert_no_staging_directories(root: &Path) {
+    assert!(
+        entries(root)
+            .into_iter()
+            .all(|name| !name.starts_with(".evidencectl-new-")),
+        "failed scaffold left a staging directory"
+    );
+}
+
+fn path(path: &Path) -> &str {
+    path.to_str().expect("UTF-8 test path")
+}
+
+fn stdout(output: &Output) -> String {
+    String::from_utf8_lossy(&output.stdout).into_owned()
+}
+
+fn stderr(output: &Output) -> String {
+    String::from_utf8_lossy(&output.stderr).into_owned()
+}
diff --git a/crates/registry-evidencectl/tests/suggest_e2e.rs b/crates/registry-evidencectl/tests/suggest_e2e.rs
new file mode 100644
index 000000000..44ae5ab8c
--- /dev/null
+++ b/crates/registry-evidencectl/tests/suggest_e2e.rs
@@ -0,0 +1,504 @@
+//! `evidencectl source suggest` end to end, through the real binary.
+//!
+//! Every case here drives the installed `evidencectl` executable
+//! non-interactively, the way an operator reproduces a reviewed interactive
+//! run: a synthetic OpenAPI document and a synthetic sample response are
+//! written into a temporary directory, and the command is asked to draft one
+//! source from them. Nothing here reaches the network, and no sample value is
+//! expected in any assertion: only bounds derived from the sample are.
+
+use std::{
+    path::{Path, PathBuf},
+    process::{Command, Output},
+};
+
+use serde_json::Value;
+
+/// A two-operation document with one paginated collection response. The
+/// vocabulary is deliberately generic: records, trackingId, status, total,
+/// recordedOn.
+const OPENAPI_DOCUMENT: &str = r#"openapi: 3.0.3
+info:
+  title: Example record service
+  version: "1.0.0"
+servers:
+  - url: https://records.example.invalid/v1
+paths:
+  /records:
+    get:
+      summary: List records
+      parameters:
+        - name: pageSize
+          in: query
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 50
+      responses:
+        "200":
+          description: matching records
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [total, records]
+                properties:
+                  total:
+                    type: integer
+                  records:
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/Record'
+components:
+  schemas:
+    Record:
+      type: object
+      required: [trackingId]
+      properties:
+        trackingId:
+          type: string
+        status:
+          type: string
+          enum: [active, closed]
+        recordedOn:
+          type: string
+          format: date
+        tags:
+          type: array
+          items:
+            type: string
+            maxLength: 32
+"#;
+
+/// Two records, so the array observation is a real length rather than one.
+const SAMPLE_RESPONSE: &str = r#"{
+  "total": 3,
+  "records": [
+    {"trackingId": "TR-000001", "status": "active", "recordedOn": "2024-05-01"},
+    {"trackingId": "TR-000002", "status": "closed", "recordedOn": "2024-05-02"}
+  ]
+}
+"#;
+
+#[test]
+fn drafts_into_a_project_and_then_refuses_to_overwrite_the_draft() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let sample = write(workspace.path(), "records.sample.json", SAMPLE_RESPONSE);
+    let project = scaffold(workspace.path(), OPENAPI_DOCUMENT);
+
+    let arguments = vec![
+        "source".to_owned(),
+        "suggest".to_owned(),
+        "--operation".to_owned(),
+        "GET /records".to_owned(),
+        "--select".to_owned(),
+        "/total".to_owned(),
+        "--select".to_owned(),
+        "/records/*/trackingId".to_owned(),
+        "--sample".to_owned(),
+        path_argument(&sample),
+        "--source-id".to_owned(),
+        "source-b".to_owned(),
+        "--project".to_owned(),
+        path_argument(&project),
+    ];
+    let output = evidencectl(&arguments);
+    assert!(
+        output.status.success(),
+        "source suggest failed: {}",
+        stderr_of(&output)
+    );
+
+    let schema_path = project.join("schemas/source-b-response.schema.yaml");
+    let script_path = project.join("adapters/source-b-extract.rhai");
+    let facts_path = project.join("schemas/source-b-facts.schema.yaml");
+    let source_path = project.join("sources/source-b.yaml");
+    let prepare_path = project.join("adapters/source-b-prepare.rhai");
+    let parameters_path = project.join("schemas/source-b-parameters.schema.yaml");
+    for path in [
+        &schema_path,
+        &script_path,
+        &facts_path,
+        &prepare_path,
+        &parameters_path,
+    ] {
+        assert!(path.is_file(), "expected {} to be written", path.display());
+    }
+    assert!(
+        source_path.is_file(),
+        "the V1 source object must be editable in place"
+    );
+    let source: Value =
+        serde_norway::from_str(&std::fs::read_to_string(&source_path).expect("read source object"))
+            .expect("source object parses");
+    assert_eq!(source["transport"], "http-json");
+    assert!(
+        source.get("sources").is_none(),
+        "source file has no wrapper"
+    );
+    assert_eq!(source["authentication"]["kind"], "review-required");
+
+    // The response schema parses as YAML and carries the sample-derived
+    // bounds, widened by the narrowing policy rather than copied.
+    let schema: Value =
+        serde_norway::from_str(&std::fs::read_to_string(&schema_path).expect("read schema"))
+            .expect("the drafted response schema parses as YAML");
+    assert_eq!(schema["type"], "object");
+    assert_eq!(schema["additionalProperties"], Value::Bool(false));
+    assert_eq!(schema["properties"]["total"]["minimum"], 0);
+    assert_eq!(schema["properties"]["total"]["maximum"], 10);
+    // Two records is weak evidence of how long a page can be; the spec's own
+    // page-size maximum is the stronger statement and wins for the top-level
+    // collection.
+    assert_eq!(schema["properties"]["records"]["maxItems"], 50);
+    assert_eq!(
+        schema["properties"]["records"]["items"]["properties"]["trackingId"]["maxLength"],
+        16
+    );
+
+    let script = std::fs::read_to_string(&script_path).expect("read extract script");
+    assert!(
+        script.contains(r#"get_path(source_response, "/total")"#),
+        "extract skeleton must read the selected scalar leaf: {script}"
+    );
+    assert!(
+        script.contains(r#"get_path(source_response, "/records/0/trackingId")"#),
+        "extract skeleton must substitute a numeric index for the `*` segment: {script}"
+    );
+
+    let stdout = stdout_of(&output);
+    assert!(
+        stdout.contains("evidencectl source suggest: draft for source `source-b`"),
+        "the report belongs on stdout: {stdout}"
+    );
+    assert!(
+        stdout.contains("evidencectl source suggest --operation")
+            && stdout.contains("--project")
+            && !stdout.contains("--openapi"),
+        "a project reproduction uses its retained OpenAPI: {stdout}"
+    );
+    // The reproduce line is pasted into a shell, so a pointer carrying `*` is
+    // quoted rather than left for the shell to expand.
+    assert!(
+        stdout.contains("--select '/records/*/trackingId'"),
+        "the equivalent command must reproduce the selection, quoted: {stdout}"
+    );
+
+    // OpenAPI cannot establish governed source policy. The report must make
+    // that boundary visible instead of presenting generated defaults.
+    assert!(
+        stdout.contains("source origin, posture, authentication, selector bindings"),
+        "the report must name the omitted decisions: {stdout}"
+    );
+
+    // Every adopted default is announced with its provenance, so a flag-driven
+    // run is auditable without re-reading the generated files.
+    let stderr = stderr_of(&output);
+    assert!(
+        stderr.contains("the sample response (widened)"),
+        "adopted bounds must be announced with their provenance: {stderr}"
+    );
+    assert!(
+        stderr.contains("a counter usually needs a more generous ceiling"),
+        "a sampled integer ceiling must be flagged for review: {stderr}"
+    );
+
+    // A second identical run must not silently replace a draft an operator may
+    // already have edited.
+    let repeat = evidencectl(&arguments);
+    assert!(
+        !repeat.status.success(),
+        "a second run must not overwrite the first draft"
+    );
+    assert!(
+        stderr_of(&repeat).contains("refusing to overwrite"),
+        "unexpected refusal message: {}",
+        stderr_of(&repeat)
+    );
+}
+
+#[test]
+fn a_project_always_uses_its_retained_openapi() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let project = scaffold(workspace.path(), OPENAPI_DOCUMENT);
+    let other = write(workspace.path(), "other.openapi.yaml", OPENAPI_DOCUMENT);
+    let output = evidencectl(&[
+        "source".to_owned(),
+        "suggest".to_owned(),
+        "--project".to_owned(),
+        path_argument(&project),
+        "--openapi".to_owned(),
+        path_argument(&other),
+        "--operation".to_owned(),
+        "GET /records".to_owned(),
+        "--select".to_owned(),
+        "/total".to_owned(),
+    ]);
+    assert!(!output.status.success());
+    assert!(stderr_of(&output).contains("retained source.openapi.yaml"));
+    assert!(bundle_entries(&project).is_empty());
+}
+
+#[test]
+fn prints_the_draft_without_a_project_and_writes_nothing() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let openapi = write(workspace.path(), "records.openapi.yaml", OPENAPI_DOCUMENT);
+    let project = scaffold(workspace.path(), OPENAPI_DOCUMENT);
+    let bundle_before = bundle_entries(&project);
+
+    let output = evidencectl(&[
+        "source".to_owned(),
+        "suggest".to_owned(),
+        "--openapi".to_owned(),
+        path_argument(&openapi),
+        "--operation".to_owned(),
+        "GET /records".to_owned(),
+        "--select".to_owned(),
+        "/records/*/trackingId".to_owned(),
+        "--source-id".to_owned(),
+        "source-c".to_owned(),
+    ]);
+    assert!(
+        output.status.success(),
+        "print-only source suggest failed: {}",
+        stderr_of(&output)
+    );
+
+    let stdout = stdout_of(&output);
+    for block in [
+        "--- schemas/source-c-response.schema.yaml ---",
+        "--- adapters/source-c-extract.rhai ---",
+        "--- schemas/source-c-facts.schema.yaml ---",
+    ] {
+        assert!(
+            stdout.contains(block),
+            "missing draft block {block}:\n{stdout}"
+        );
+    }
+    assert!(
+        stdout.contains("sources:") && stdout.contains("source-c:"),
+        "the pasteable source block belongs on stdout: {stdout}"
+    );
+    // With no sample, the page-size parameter is the only evidence of how long
+    // the array can be, and the string leaf has none at all.
+    assert!(
+        stdout.contains("maxItems: 50"),
+        "the page-size parameter must bound the array: {stdout}"
+    );
+    assert!(
+        stdout.contains("TODO(evidencectl): /records/*/trackingId needs string length bounds"),
+        "an underivable bound must stay an explicit TODO: {stdout}"
+    );
+    assert!(
+        stderr_of(&output).contains("a page-size parameter in the spec"),
+        "adopted page-size bound must be announced: {}",
+        stderr_of(&output)
+    );
+
+    assert_eq!(
+        bundle_entries(&project),
+        bundle_before,
+        "a print-only run must not write into any project"
+    );
+}
+
+/// A page-size parameter bounds one page of the top-level collection. It says
+/// nothing about how long an array *inside* a record can be, so a nested array
+/// stays an explicit TODO instead of inheriting the page size.
+#[test]
+fn a_page_size_bounds_the_collection_but_not_an_array_inside_a_record() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let openapi = write(workspace.path(), "records.openapi.yaml", OPENAPI_DOCUMENT);
+
+    let output = evidencectl(&[
+        "source".to_owned(),
+        "suggest".to_owned(),
+        "--openapi".to_owned(),
+        path_argument(&openapi),
+        "--operation".to_owned(),
+        "GET /records".to_owned(),
+        "--select".to_owned(),
+        "/records/*/tags/*".to_owned(),
+        "--source-id".to_owned(),
+        "source-e".to_owned(),
+    ]);
+    assert!(
+        output.status.success(),
+        "source suggest failed: {}",
+        stderr_of(&output)
+    );
+
+    let stdout = stdout_of(&output);
+    assert!(
+        stdout.contains("maxItems: 50"),
+        "the page-size parameter must bound the collection: {stdout}"
+    );
+    assert!(
+        stdout.contains("TODO(evidencectl): /records/*/tags needs maxItems"),
+        "a nested array must not inherit the page size: {stdout}"
+    );
+    assert_eq!(
+        stdout.matches("maxItems: 50").count(),
+        1,
+        "only the collection carries the page-size bound: {stdout}"
+    );
+}
+
+/// When an operation advertises more than one size ceiling, the bound has to
+/// be one a response can actually reach. The smallest ceiling is that bound;
+/// the largest is a number the server will never return.
+#[test]
+fn the_smallest_advertised_size_ceiling_bounds_the_collection() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let document = OPENAPI_DOCUMENT.replace(
+        "        - name: pageSize\n",
+        "        - name: limit\n          in: query\n          schema:\n            type: integer\n            maximum: 200\n        - name: pageSize\n",
+    );
+    let openapi = write(workspace.path(), "records.openapi.yaml", &document);
+
+    let output = evidencectl(&[
+        "source".to_owned(),
+        "suggest".to_owned(),
+        "--openapi".to_owned(),
+        path_argument(&openapi),
+        "--operation".to_owned(),
+        "GET /records".to_owned(),
+        "--select".to_owned(),
+        "/records/*/trackingId".to_owned(),
+        "--source-id".to_owned(),
+        "source-f".to_owned(),
+    ]);
+    assert!(
+        output.status.success(),
+        "source suggest failed: {}",
+        stderr_of(&output)
+    );
+
+    let stdout = stdout_of(&output);
+    assert!(
+        stdout.contains("maxItems: 50"),
+        "the smallest ceiling must bound the collection: {stdout}"
+    );
+    assert!(
+        !stdout.contains("maxItems: 200"),
+        "a ceiling the response cannot reach must not become the bound: {stdout}"
+    );
+}
+
+/// The runtime's fixed-request method is an enumeration of two. An operation
+/// outside it is refused by name, before any file is drafted.
+#[test]
+fn an_operation_outside_the_runtime_method_enum_is_refused_by_name() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let openapi = write(workspace.path(), "records.openapi.yaml", OPENAPI_DOCUMENT);
+
+    let output = evidencectl(&[
+        "source".to_owned(),
+        "suggest".to_owned(),
+        "--openapi".to_owned(),
+        path_argument(&openapi),
+        "--operation".to_owned(),
+        "PATCH /records".to_owned(),
+        "--select".to_owned(),
+        "/total".to_owned(),
+    ]);
+    assert!(
+        !output.status.success(),
+        "PATCH must not draft a source: {}",
+        stdout_of(&output)
+    );
+    let stderr = stderr_of(&output);
+    assert!(
+        stderr.contains("PATCH") && stderr.contains("GET") && stderr.contains("POST"),
+        "the refusal must name the method and the two admitted ones: {stderr}"
+    );
+}
+
+#[test]
+fn a_non_interactive_run_names_the_flags_it_needs() {
+    let workspace = tempfile::tempdir().expect("tempdir");
+    let openapi = write(workspace.path(), "records.openapi.yaml", OPENAPI_DOCUMENT);
+
+    // `output()` gives the child a null stdin and piped stdout, so neither is a
+    // terminal and the interactive selection cannot run.
+    let output = evidencectl(&[
+        "source".to_owned(),
+        "suggest".to_owned(),
+        "--openapi".to_owned(),
+        path_argument(&openapi),
+    ]);
+    assert!(
+        !output.status.success(),
+        "a non-interactive run without the selection flags must fail"
+    );
+    let stderr = stderr_of(&output);
+    assert!(
+        stderr.contains("--operation") && stderr.contains("--select"),
+        "the error must name every missing flag: {stderr}"
+    );
+}
+
+/// The classification of `evidence check` is reported in plain words. The
+/// runtime is represented here by a stub printing one of its fixed messages,
+/// so the assertion is about `evidencectl`'s reporting and not about a
+/// deployment project that is not frozen or provisioned yet.
+fn evidencectl(arguments: &[String]) -> Output {
+    Command::new(env!("CARGO_BIN_EXE_evidencectl"))
+        .args(arguments)
+        .output()
+        .expect("running evidencectl")
+}
+
+/// Create the only precondition `source suggest --project` requires: an
+/// existing project directory. `new` is tested separately and now owns the
+/// OpenAPI path itself.
+fn scaffold(root: &Path, openapi: &str) -> PathBuf {
+    let project = root.join("project");
+    std::fs::create_dir(&project).expect("project directory");
+    for directory in ["sources", "adapters", "schemas"] {
+        std::fs::create_dir(project.join(directory)).expect("authoring directory");
+    }
+    std::fs::write(project.join("source.openapi.yaml"), openapi).expect("retained OpenAPI");
+    project
+}
+
+fn write(root: &Path, name: &str, contents: &str) -> PathBuf {
+    let path = root.join(name);
+    std::fs::write(&path, contents).expect("writing a test input");
+    path
+}
+
+/// Every path beneath the project's bundle directory, sorted, so a test can
+/// prove a run wrote nothing.
+fn bundle_entries(project: &Path) -> Vec<PathBuf> {
+    let mut entries = Vec::new();
+    let mut pending = vec![project.join("bundle")];
+    while let Some(directory) = pending.pop() {
+        let Ok(children) = std::fs::read_dir(&directory) else {
+            continue;
+        };
+        for child in children.flatten() {
+            let path = child.path();
+            if path.is_dir() {
+                pending.push(path.clone());
+            }
+            entries.push(path);
+        }
+    }
+    entries.sort();
+    entries
+}
+
+fn path_argument(path: &Path) -> String {
+    path.to_str()
+        .expect("test paths are valid UTF-8")
+        .to_owned()
+}
+
+fn stdout_of(output: &Output) -> String {
+    String::from_utf8(output.stdout.clone()).expect("utf8 stdout")
+}
+
+fn stderr_of(output: &Output) -> String {
+    String::from_utf8(output.stderr.clone()).expect("utf8 stderr")
+}
diff --git a/crates/registry-evidencectl/tests/suggest_emit.rs b/crates/registry-evidencectl/tests/suggest_emit.rs
new file mode 100644
index 000000000..68b113fef
--- /dev/null
+++ b/crates/registry-evidencectl/tests/suggest_emit.rs
@@ -0,0 +1,1064 @@
+//! Emit stage: draft artifacts from a narrowed response schema, write them
+//! into a deployment project, and classify `evidence check` output.
+//!
+//! Inputs are built here as `NarrowOutcome`/`EmitInputs` literals rather than
+//! produced by the other pipeline stages, so a failure names an emit-stage
+//! rule and never a bug in the OpenAPI loader, the sampler, or the narrowing
+//! heuristics (all still placeholders as this file is written).
+
+#[allow(dead_code)]
+#[path = "../src/suggest/types.rs"]
+mod types;
+
+#[allow(dead_code)]
+#[path = "../src/fixtures.rs"]
+mod fixtures;
+
+#[allow(dead_code)]
+#[path = "../src/suggest/emit.rs"]
+mod emit;
+
+use std::path::{Path, PathBuf};
+
+use serde_json::json;
+
+use emit::{CheckClassification, EmitInputs};
+use types::{
+    BoundKind, BoundNeed, BoundValues, NarrowOutcome, OperationKey, Provenance, SpecSource,
+    SuggestedBound,
+};
+
+/// A schema exercising every case the response-schema renderer must handle:
+/// a resolved integer bound (derived from the spec), an unresolved array
+/// missing `maxItems`, a nested unresolved string missing length bounds
+/// (despite carrying a sample-derived suggestion nobody confirmed yet), and a
+/// nullable string that needs no bound because `format` alone satisfies the
+/// subset.
+fn narrow_outcome_fixture() -> NarrowOutcome {
+    let schema = json!({
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["total"],
+        "properties": {
+            "total": {"type": "integer", "minimum": 0, "maximum": 1000000},
+            "event_date": {"type": ["string", "null"], "format": "date"},
+            "results": {
+                "type": "array",
+                "items": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [],
+                    "properties": {
+                        "status": {"type": "string"}
+                    }
+                }
+            }
+        }
+    });
+
+    let unresolved = vec![
+        BoundNeed {
+            pointer: "/results".to_owned(),
+            kind: BoundKind::ArrayMaxItems,
+            suggestion: None,
+        },
+        BoundNeed {
+            pointer: "/results/*/status".to_owned(),
+            kind: BoundKind::StringLength,
+            suggestion: Some(SuggestedBound {
+                values: BoundValues::StringLength {
+                    min_length: 0,
+                    max_length: 64,
+                },
+                provenance: Provenance::Sample,
+            }),
+        },
+    ];
+
+    NarrowOutcome { schema, unresolved }
+}
+
+fn needs_fixture() -> Vec<BoundNeed> {
+    vec![
+        BoundNeed {
+            pointer: "/total".to_owned(),
+            kind: BoundKind::IntegerRange,
+            suggestion: Some(SuggestedBound {
+                values: BoundValues::IntegerRange {
+                    minimum: 0,
+                    maximum: 1_000_000,
+                },
+                provenance: Provenance::Spec,
+            }),
+        },
+        BoundNeed {
+            pointer: "/results".to_owned(),
+            kind: BoundKind::ArrayMaxItems,
+            suggestion: None,
+        },
+        BoundNeed {
+            pointer: "/results/*/status".to_owned(),
+            kind: BoundKind::StringLength,
+            suggestion: Some(SuggestedBound {
+                values: BoundValues::StringLength {
+                    min_length: 0,
+                    max_length: 64,
+                },
+                provenance: Provenance::Sample,
+            }),
+        },
+    ]
+}
+
+fn base_inputs() -> EmitInputs {
+    EmitInputs {
+        source_id: "search-a".to_owned(),
+        operation: OperationKey {
+            method: "GET".to_owned(),
+            path: "/v1/records".to_owned(),
+        },
+        status: "200".to_owned(),
+        media_type: "application/json".to_owned(),
+        base_url_suggestion: emit::split_server_url("https://api.example.invalid"),
+        selection: vec![
+            "/total".to_owned(),
+            "/event_date".to_owned(),
+            "/results/*/status".to_owned(),
+        ],
+        narrowed: narrow_outcome_fixture(),
+        needs: needs_fixture(),
+        openapi: SpecSource::File(PathBuf::from("tests/fixtures/openapi/example.yaml")),
+        sample_path: None,
+        project: None,
+    }
+}
+
+fn file_contents<'a>(artifacts: &'a types::DraftArtifacts, bundle_relative_path: &str) -> &'a str {
+    artifacts
+        .files
+        .iter()
+        .find(|file| file.bundle_relative_path == bundle_relative_path)
+        .unwrap_or_else(|| panic!("expected a draft file at {bundle_relative_path}"))
+        .contents
+        .as_str()
+}
+
+fn assert_adjacent(text: &str, comment: &str, next_line_contains: &str) {
+    let lines: Vec<&str> = text.lines().collect();
+    let comment_index = lines
+        .iter()
+        .position(|line| line.contains(comment))
+        .unwrap_or_else(|| panic!("expected a line containing {comment:?} in:\n{text}"));
+    let next = lines
+        .get(comment_index + 1)
+        .unwrap_or_else(|| panic!("expected a line after {comment:?} in:\n{text}"));
+    assert!(
+        next.contains(next_line_contains),
+        "expected the line after {comment:?} to contain {next_line_contains:?}, got {next:?}"
+    );
+}
+
+#[test]
+fn response_schema_parses_and_carries_adjacent_annotations() {
+    let artifacts = emit::draft(&base_inputs()).expect("draft");
+    let response_schema = file_contents(&artifacts, "schemas/search-a-response.schema.yaml");
+
+    let parsed: serde_norway::Value =
+        serde_norway::from_str(response_schema).expect("response schema parses as YAML");
+    assert!(parsed.is_mapping());
+
+    assert_adjacent(
+        response_schema,
+        "# TODO(evidencectl): /results needs maxItems",
+        "results:",
+    );
+    assert_adjacent(
+        response_schema,
+        "# TODO(evidencectl): /results/*/status needs string length bounds",
+        "status:",
+    );
+    assert_adjacent(
+        response_schema,
+        "# derived from the OpenAPI schema",
+        "total:",
+    );
+
+    // event_date needs no bound comment: `format: date` alone satisfies the
+    // subset, so no BoundNeed exists for it in the fixture.
+    let event_date_index = response_schema
+        .lines()
+        .position(|line| line.trim() == "event_date:")
+        .expect("event_date property present");
+    let preceding = response_schema.lines().nth(event_date_index - 1).unwrap();
+    assert!(
+        !preceding.contains("TODO(evidencectl)") && !preceding.contains("derived from"),
+        "event_date should carry no bound annotation, got preceding line {preceding:?}"
+    );
+}
+
+/// A flow sequence makes `,`, `[`, `]`, `{` and `}` significant anywhere in a
+/// member, not only at its start: an unquoted `pending, review` would parse as
+/// two enumeration members.
+#[test]
+fn a_flow_list_member_containing_a_comma_stays_one_member() {
+    let mut inputs = base_inputs();
+    inputs.narrowed = NarrowOutcome {
+        schema: json!({
+            "type": "object",
+            "additionalProperties": false,
+            "required": [],
+            "properties": {
+                "status": {"type": "string", "enum": ["pending, review", "closed"]}
+            }
+        }),
+        unresolved: Vec::new(),
+    };
+    inputs.needs = Vec::new();
+    inputs.selection = vec!["/status".to_owned(), "/a,b".to_owned()];
+
+    let artifacts = emit::draft(&inputs).expect("draft");
+    let response_schema = file_contents(&artifacts, "schemas/search-a-response.schema.yaml");
+    let parsed: serde_norway::Value =
+        serde_norway::from_str(response_schema).expect("response schema parses as YAML");
+    let enumeration = parsed["properties"]["status"]["enum"]
+        .as_sequence()
+        .expect("enum is a sequence");
+    assert_eq!(enumeration.len(), 2, "got {enumeration:?}");
+    assert_eq!(enumeration[0].as_str(), Some("pending, review"));
+
+    let block: serde_norway::Value =
+        serde_norway::from_str(&artifacts.source_block).expect("source block parses as YAML");
+    let projection = block["sources"]["search-a"]["request"]["projection"]
+        .as_sequence()
+        .expect("projection is a sequence");
+    assert_eq!(projection.len(), 2, "got {projection:?}");
+    assert_eq!(projection[1].as_str(), Some("/a,b"));
+}
+
+/// A bound demanded of an array's items node belongs above `items:`; without
+/// it the only annotation-carrying place is the object-properties loop, which
+/// an array of scalars never reaches.
+#[test]
+fn a_bound_on_an_array_items_node_is_annotated_above_items() {
+    let mut inputs = base_inputs();
+    let unresolved = vec![BoundNeed {
+        pointer: "/tags/*".to_owned(),
+        kind: BoundKind::StringLength,
+        suggestion: None,
+    }];
+    inputs.narrowed = NarrowOutcome {
+        schema: json!({
+            "type": "object",
+            "additionalProperties": false,
+            "required": [],
+            "properties": {
+                "tags": {
+                    "type": "array",
+                    "minItems": 0,
+                    "maxItems": 8,
+                    "items": {"type": "string"}
+                }
+            }
+        }),
+        unresolved: unresolved.clone(),
+    };
+    inputs.needs = unresolved;
+    inputs.selection = vec!["/tags/*".to_owned()];
+
+    let artifacts = emit::draft(&inputs).expect("draft");
+    let response_schema = file_contents(&artifacts, "schemas/search-a-response.schema.yaml");
+    assert_adjacent(
+        response_schema,
+        "# TODO(evidencectl): /tags/* needs string length bounds",
+        "items:",
+    );
+}
+
+/// `uniqueItems` and an array `const` narrow the accepted response, and the
+/// narrowing stage deliberately carries both through; dropping them here would
+/// widen the drafted schema past what the specification stated.
+#[test]
+fn an_array_keeps_unique_items_and_a_constant() {
+    let mut inputs = base_inputs();
+    inputs.narrowed = NarrowOutcome {
+        schema: json!({
+            "type": "object",
+            "additionalProperties": false,
+            "required": [],
+            "properties": {
+                "tags": {
+                    "type": "array",
+                    "minItems": 0,
+                    "maxItems": 8,
+                    "uniqueItems": true,
+                    "const": ["alpha", "beta"],
+                    "items": {"type": "string", "maxLength": 16}
+                }
+            }
+        }),
+        unresolved: Vec::new(),
+    };
+    inputs.needs = Vec::new();
+    inputs.selection = vec!["/tags/*".to_owned()];
+
+    let artifacts = emit::draft(&inputs).expect("draft");
+    let response_schema = file_contents(&artifacts, "schemas/search-a-response.schema.yaml");
+    let parsed: serde_norway::Value =
+        serde_norway::from_str(response_schema).expect("response schema parses as YAML");
+    assert_eq!(
+        parsed["properties"]["tags"]["uniqueItems"].as_bool(),
+        Some(true)
+    );
+    assert_eq!(
+        parsed["properties"]["tags"]["const"]
+            .as_sequence()
+            .map(Vec::len),
+        Some(2)
+    );
+}
+
+#[test]
+fn facts_schema_stub_is_minimal_and_parses() {
+    let artifacts = emit::draft(&base_inputs()).expect("draft");
+    let facts_schema = file_contents(&artifacts, "schemas/search-a-facts.schema.yaml");
+
+    let parsed: serde_norway::Value =
+        serde_norway::from_str(facts_schema).expect("facts schema parses as YAML");
+    let mapping = parsed.as_mapping().expect("facts schema is a mapping");
+    assert_eq!(
+        mapping
+            .get(serde_norway::Value::String("type".to_owned()))
+            .and_then(|v| v.as_str()),
+        Some("object")
+    );
+    assert_eq!(
+        mapping
+            .get(serde_norway::Value::String(
+                "additionalProperties".to_owned()
+            ))
+            .and_then(|v| v.as_bool()),
+        Some(false)
+    );
+    let required = mapping
+        .get(serde_norway::Value::String("required".to_owned()))
+        .and_then(|v| v.as_sequence())
+        .expect("required is a sequence");
+    assert_eq!(required.len(), 1);
+    assert_eq!(required[0].as_str(), Some("placeholder_fact"));
+
+    let properties = mapping
+        .get(serde_norway::Value::String("properties".to_owned()))
+        .and_then(|v| v.as_mapping())
+        .expect("properties is a mapping");
+    assert_eq!(properties.len(), 1);
+    assert!(properties.contains_key(serde_norway::Value::String("placeholder_fact".to_owned())));
+
+    assert!(facts_schema.contains("TODO(evidencectl)"));
+}
+
+#[test]
+fn extract_script_uses_get_path_for_every_selected_leaf_with_wildcard_substitution() {
+    let artifacts = emit::draft(&base_inputs()).expect("draft");
+    let script = file_contents(&artifacts, "adapters/search-a-extract.rhai");
+
+    assert!(script.contains(r#"get_path(source_response, "/total")"#));
+    assert!(script.contains(r#"get_path(source_response, "/event_date")"#));
+    // The extended pointer's `*` becomes `0` in the plain get_path pointer.
+    assert!(script.contains(r#"get_path(source_response, "/results/0/status")"#));
+    assert_eq!(script.matches("is_missing(leaf_").count(), 3);
+
+    // A selection under an array gets a commented loop sketch.
+    assert!(script.contains("for element_1 in items_1 {"));
+    assert!(!script.contains(r#"source_response["total"]"#));
+
+    assert!(script.contains("fn extract(source_response, parameters) {"));
+}
+
+/// The commented loop sketch is read by an operator and then pasted, so it may
+/// only use constructs the runtime's Rhai engine actually registers: ranges
+/// (`..`) are disabled, `len` is a property getter rather than a method, and
+/// no operator concatenates a string with an integer.
+#[test]
+fn the_array_loop_sketch_uses_only_constructs_the_runtime_registers() {
+    let artifacts = emit::draft(&base_inputs()).expect("draft");
+    let script = file_contents(&artifacts, "adapters/search-a-extract.rhai");
+
+    assert!(!script.contains("0.."), "ranges are disabled: {script}");
+    assert!(!script.contains(".len()"), "len is a getter: {script}");
+    assert!(
+        !script.contains("+ index"),
+        "string + integer has no operator: {script}"
+    );
+    // The array is reached by its own pointer and iterated directly.
+    assert!(
+        script.contains(r#"//     let items_1 = get_path(source_response, "/results");"#),
+        "the sketch must read the array by its own pointer: {script}"
+    );
+    assert!(
+        script.contains(r#"//     if !is_missing(items_1) {"#),
+        "the sketch must guard an absent array: {script}"
+    );
+    assert!(
+        script.contains(r#"//             let value = get_path(element_1, "/status");"#),
+        "the sketch must read the leaf from each element: {script}"
+    );
+}
+
+/// A pointer crossing two arrays names each array by its own pointer: the
+/// segment before the first `*` says nothing about the inner one.
+#[test]
+fn a_nested_array_loop_sketch_names_every_array_it_crosses() {
+    let mut inputs = base_inputs();
+    inputs.selection = vec!["/results/*/tags/*".to_owned()];
+    let artifacts = emit::draft(&inputs).expect("draft");
+    let script = file_contents(&artifacts, "adapters/search-a-extract.rhai");
+
+    assert!(
+        script.contains(r#"let items_1 = get_path(source_response, "/results");"#),
+        "the outer array is /results: {script}"
+    );
+    assert!(
+        script.contains(r#"let items_2 = get_path(element_1, "/tags");"#),
+        "the inner array is /tags, reached from an outer element: {script}"
+    );
+    assert!(
+        script.contains("element_2 is the value at /results/*/tags/*"),
+        "the innermost element is the selected value: {script}"
+    );
+}
+
+#[test]
+fn get_path_byte_ceiling_is_enforced_and_names_the_pointer() {
+    let mut inputs = base_inputs();
+    let long_segment = "x".repeat(300);
+    let long_pointer = format!("/{long_segment}");
+    inputs.selection = vec![long_pointer.clone()];
+
+    let error = emit::draft(&inputs).expect_err("oversized pointer must be rejected");
+    let message = format!("{error:#}");
+    assert!(message.contains(&long_pointer) || message.contains("byte"));
+    assert!(message.contains("256"));
+}
+
+#[test]
+fn get_path_segment_ceiling_is_enforced_and_names_the_pointer() {
+    let mut inputs = base_inputs();
+    let segments: Vec<String> = (0..17).map(|n| format!("s{n}")).collect();
+    let deep_pointer = format!("/{}", segments.join("/"));
+    inputs.selection = vec![deep_pointer.clone()];
+
+    let error = emit::draft(&inputs).expect_err("pointer with too many segments must be rejected");
+    let message = format!("{error:#}");
+    assert!(message.contains(&deep_pointer));
+    assert!(message.contains("16"));
+}
+
+#[test]
+fn source_block_parses_and_carries_only_mechanical_source_facts() {
+    let artifacts = emit::draft(&base_inputs()).expect("draft");
+
+    let parsed: serde_norway::Value =
+        serde_norway::from_str(&artifacts.source_block).expect("source block parses as YAML");
+    assert!(parsed.is_mapping());
+
+    assert!(artifacts.source_block.contains("search-a:"));
+    assert!(artifacts.source_block.contains("method: GET"));
+    assert!(artifacts.source_block.contains("path: /v1/records"));
+    assert!(artifacts.source_block.contains("value: application/json"));
+    assert!(artifacts
+        .source_block
+        .contains("projection: [/total, /event_date, /results/*/status]"));
+    assert!(artifacts
+        .source_block
+        .contains("baseUrl: https://api.example.invalid"));
+    assert!(artifacts
+        .source_block
+        .contains("responseSchema: schemas/search-a-response.schema.yaml"));
+    assert!(artifacts
+        .source_block
+        .contains("extractScript: adapters/search-a-extract.rhai"));
+    assert!(artifacts
+        .source_block
+        .contains("factSchema: schemas/search-a-facts.schema.yaml"));
+
+    let source = &parsed["sources"]["search-a"];
+    for governed in [
+        "baseUrl",
+        "posture",
+        "authentication",
+        "selectorInputs",
+        "prepareScript",
+        "adapterParameters",
+        "preparationLimits",
+    ] {
+        assert!(source.get(governed).is_none(), "draft invented {governed}");
+    }
+}
+
+/// OpenAPI establishes the method, but it does not establish the adopter's
+/// bounded preparation policy.
+#[test]
+fn a_get_source_omits_request_channel_policy() {
+    let artifacts = emit::draft(&base_inputs()).expect("draft");
+    let block = &artifacts.source_block;
+
+    assert!(block.contains("method: GET"), "{block}");
+    assert!(!block.contains("query:"), "{block}");
+    assert!(!block.contains("jsonBody:"), "{block}");
+    assert!(!block.contains("maximumQueryPairs:"), "{block}");
+}
+
+#[test]
+fn a_post_source_omits_request_channel_policy() {
+    let mut inputs = base_inputs();
+    inputs.operation.method = "POST".to_owned();
+    let artifacts = emit::draft(&inputs).expect("draft");
+    let block = &artifacts.source_block;
+
+    assert!(block.contains("method: POST"), "{block}");
+    assert!(!block.contains("query:"), "{block}");
+    assert!(!block.contains("jsonBody:"), "{block}");
+    assert!(!block.contains("maximumQueryPairs:"), "{block}");
+}
+
+/// The runtime's fixed-request method admits GET and POST only.
+#[test]
+fn a_method_outside_the_runtime_enum_is_refused_by_name() {
+    let mut inputs = base_inputs();
+    inputs.operation.method = "PATCH".to_owned();
+
+    let error = emit::draft(&inputs).expect_err("PATCH is not an admitted method");
+    let message = format!("{error:#}");
+    assert!(message.contains("PATCH"), "{message}");
+    assert!(
+        message.contains("GET") && message.contains("POST"),
+        "{message}"
+    );
+}
+
+/// A templated OpenAPI path cannot be a `path:`, which the runtime rejects on
+/// `{` and `}`. It becomes a `pathTemplate:` without inventing bindings.
+#[test]
+fn a_templated_path_becomes_a_path_template_without_bindings() {
+    let mut inputs = base_inputs();
+    inputs.operation.path = "/v1/records/{id}".to_owned();
+    let artifacts = emit::draft(&inputs).expect("draft");
+    let block = &artifacts.source_block;
+
+    let parsed: serde_norway::Value =
+        serde_norway::from_str(block).expect("source block parses as YAML");
+    assert!(parsed.is_mapping());
+
+    assert!(block.contains("pathTemplate: /v1/records/{id}"), "{block}");
+    assert!(!block.contains("path: /v1/records/{id}"), "{block}");
+    assert!(!block.contains("pathBindings:"), "{block}");
+}
+
+/// `baseUrl` is validated as an origin: any path the OpenAPI server URL
+/// carries has to move onto the request path instead of staying in the origin.
+#[test]
+fn a_server_path_prefix_moves_onto_the_request_path() {
+    let mut inputs = base_inputs();
+    inputs.base_url_suggestion = emit::split_server_url("https://api.example.invalid:8443/v1/");
+    inputs.operation.path = "/records".to_owned();
+    let artifacts = emit::draft(&inputs).expect("draft");
+    let block = &artifacts.source_block;
+
+    assert!(
+        block.contains("baseUrl: https://api.example.invalid:8443\n"),
+        "{block}"
+    );
+    assert!(block.contains("path: /v1/records"), "{block}");
+}
+
+#[test]
+fn a_server_path_prefix_moves_onto_a_path_template_too() {
+    let mut inputs = base_inputs();
+    inputs.base_url_suggestion = emit::split_server_url("https://api.example.invalid/v1");
+    inputs.operation.path = "/records/{id}".to_owned();
+    let artifacts = emit::draft(&inputs).expect("draft");
+
+    assert!(
+        artifacts
+            .source_block
+            .contains("pathTemplate: /v1/records/{id}"),
+        "{}",
+        artifacts.source_block
+    );
+}
+
+/// A server URL with template variables names no single origin, so the draft
+/// falls back to the placeholder rather than emitting an unusable baseUrl.
+#[test]
+fn a_server_url_with_variables_yields_no_base_url_suggestion() {
+    assert!(emit::split_server_url("https://{tenant}.example.invalid/v1").is_none());
+    assert!(emit::split_server_url("/relative/only").is_none());
+
+    let split = emit::split_server_url("https://api.example.invalid").expect("plain origin splits");
+    assert_eq!(split.base_url, "https://api.example.invalid");
+    assert_eq!(split.path_prefix, "");
+}
+
+/// Acquisition posture is a governed decision that OpenAPI cannot make.
+#[test]
+fn the_draft_omits_acquisition_posture() {
+    let artifacts = emit::draft(&base_inputs()).expect("draft");
+    let block = &artifacts.source_block;
+
+    assert!(!block.contains("posture:"), "{block}");
+}
+
+#[test]
+fn source_block_leaves_base_url_absent_without_a_suggestion() {
+    let mut inputs = base_inputs();
+    inputs.base_url_suggestion = None;
+    let artifacts = emit::draft(&inputs).expect("draft");
+
+    assert!(artifacts
+        .source_block
+        .contains("OpenAPI document gives no fixed origin"));
+    assert!(!artifacts.source_block.contains("baseUrl:"));
+}
+
+#[test]
+fn write_into_project_creates_directories_and_writes_every_file() {
+    let temp = tempfile::tempdir().expect("tempdir");
+    let project = temp.path().join("project");
+    let artifacts = emit::draft(&base_inputs()).expect("draft");
+
+    let written = emit::write_into_project(&project, &artifacts.files).expect("write");
+    assert_eq!(written.len(), 5);
+
+    for file in &artifacts.files {
+        let path = project.join("bundle").join(&file.bundle_relative_path);
+        assert!(path.exists(), "expected {path:?} to exist");
+        let on_disk = std::fs::read_to_string(&path).expect("read written file");
+        assert_eq!(on_disk, file.contents);
+    }
+}
+
+#[test]
+fn write_into_project_refuses_all_collisions_and_writes_nothing() {
+    let temp = tempfile::tempdir().expect("tempdir");
+    let project = temp.path().join("project");
+    let artifacts = emit::draft(&base_inputs()).expect("draft");
+
+    let response_path = project
+        .join("bundle")
+        .join("schemas/search-a-response.schema.yaml");
+    let facts_path = project
+        .join("bundle")
+        .join("schemas/search-a-facts.schema.yaml");
+    std::fs::create_dir_all(response_path.parent().unwrap()).expect("mkdir");
+    std::fs::write(&response_path, b"pre-existing\n").expect("seed collision file 1");
+    std::fs::write(&facts_path, b"pre-existing\n").expect("seed collision file 2");
+
+    let error =
+        emit::write_into_project(&project, &artifacts.files).expect_err("must refuse to overwrite");
+    let message = error.to_string();
+    assert!(message.contains(&response_path.display().to_string()));
+    assert!(message.contains(&facts_path.display().to_string()));
+
+    let extract_path = project
+        .join("bundle")
+        .join("adapters/search-a-extract.rhai");
+    assert!(
+        !extract_path.exists(),
+        "a non-colliding file must not be written when any file collides"
+    );
+    // The pre-existing collision files must be untouched.
+    assert_eq!(
+        std::fs::read_to_string(&response_path).unwrap(),
+        "pre-existing\n"
+    );
+}
+
+/// A value the operator typed is not a value the pipeline derived, and must
+/// not be reported as one.
+#[test]
+fn an_operator_chosen_bound_is_reported_as_chosen_not_derived() {
+    let mut inputs = base_inputs();
+    inputs.narrowed.unresolved = Vec::new();
+    inputs.needs = vec![BoundNeed {
+        pointer: "/total".to_owned(),
+        kind: BoundKind::IntegerRange,
+        suggestion: Some(SuggestedBound {
+            values: BoundValues::IntegerRange {
+                minimum: 0,
+                maximum: 1_000_000,
+            },
+            provenance: Provenance::Operator,
+        }),
+    }];
+
+    let artifacts = emit::draft(&inputs).expect("draft");
+    let response_schema = file_contents(&artifacts, "schemas/search-a-response.schema.yaml");
+    assert_adjacent(response_schema, "# chosen at the prompt", "total:");
+    assert!(
+        !response_schema.contains("# derived from"),
+        "{response_schema}"
+    );
+
+    assert!(
+        artifacts.report.contains("Chosen at the prompt:"),
+        "{}",
+        artifacts.report
+    );
+    assert!(
+        artifacts.report.contains("Derived automatically: none."),
+        "an operator's own answer is not a derivation: {}",
+        artifacts.report
+    );
+}
+
+/// Only a need whose accepted value differs from the suggestion is
+/// reattributed: adopting a suggestion unchanged keeps its real provenance.
+#[test]
+fn only_an_edited_or_invented_bound_is_reattributed_to_the_operator() {
+    let mut needs = needs_fixture();
+    let mut resolutions: std::collections::BTreeMap<(String, BoundKind), BoundValues> =
+        std::collections::BTreeMap::new();
+    // Adopted unchanged.
+    resolutions.insert(
+        ("/total".to_owned(), BoundKind::IntegerRange),
+        BoundValues::IntegerRange {
+            minimum: 0,
+            maximum: 1_000_000,
+        },
+    );
+    // Answered where nothing was suggested.
+    resolutions.insert(
+        ("/results".to_owned(), BoundKind::ArrayMaxItems),
+        BoundValues::MaxItems(32),
+    );
+    // Edited away from the suggestion.
+    resolutions.insert(
+        ("/results/*/status".to_owned(), BoundKind::StringLength),
+        BoundValues::StringLength {
+            min_length: 1,
+            max_length: 128,
+        },
+    );
+
+    emit::attribute_operator_edits(&mut needs, &resolutions);
+
+    assert_eq!(
+        needs[0].suggestion.as_ref().map(|s| &s.provenance),
+        Some(&Provenance::Spec)
+    );
+    assert_eq!(
+        needs[1].suggestion.as_ref().map(|s| &s.provenance),
+        Some(&Provenance::Operator)
+    );
+    assert_eq!(
+        needs[1].suggestion.as_ref().map(|s| &s.values),
+        Some(&BoundValues::MaxItems(32))
+    );
+    assert_eq!(
+        needs[2].suggestion.as_ref().map(|s| &s.provenance),
+        Some(&Provenance::Operator)
+    );
+}
+
+/// The report must name the governed decisions absent from a mechanical draft.
+#[test]
+fn the_report_names_omitted_governed_source_decisions() {
+    let artifacts = emit::draft(&base_inputs()).expect("draft");
+    assert!(
+        artifacts
+            .report
+            .contains("source origin, posture, authentication, selector bindings"),
+        "{}",
+        artifacts.report
+    );
+}
+
+#[test]
+fn equivalent_command_is_deterministic_with_the_documented_flag_order() {
+    let mut inputs = base_inputs();
+    inputs.sample_path = Some(PathBuf::from("tests/fixtures/samples/example.json"));
+    inputs.project = Some(PathBuf::from("/tmp/example-project"));
+
+    let first = emit::draft(&inputs).expect("draft").equivalent_command;
+    let second = emit::draft(&inputs).expect("draft").equivalent_command;
+    assert_eq!(first, second, "equivalent_command must be deterministic");
+
+    let expected = "evidencectl source suggest \
+--operation 'GET /v1/records' \
+--status 200 \
+--media-type application/json \
+--sample tests/fixtures/samples/example.json \
+--source-id search-a \
+--project /tmp/example-project \
+--select /total \
+--select /event_date \
+--select '/results/*/status'";
+    assert_eq!(first, expected);
+}
+
+/// The reproduce line is meant to be pasted into a shell. A projection pointer
+/// carries `*`, which an interactive zsh expands (and aborts on when nothing
+/// matches), so every value a shell would rewrite is quoted.
+#[test]
+fn the_reproduce_command_quotes_every_value_a_shell_would_rewrite() {
+    let mut inputs = base_inputs();
+    inputs.selection = vec!["/results/*/status".to_owned(), "/a?b".to_owned()];
+    inputs.openapi = SpecSource::File(PathBuf::from("/tmp/spec (copy).yaml"));
+
+    let command = emit::draft(&inputs).expect("draft").equivalent_command;
+    assert!(
+        command.contains("--select '/results/*/status'"),
+        "{command}"
+    );
+    assert!(command.contains("--select '/a?b'"), "{command}");
+    assert!(
+        command.contains("--openapi '/tmp/spec (copy).yaml'"),
+        "{command}"
+    );
+    assert!(
+        !command.contains("--select /results/*/status"),
+        "a bare glob must not survive into the reproduce line: {command}"
+    );
+}
+
+#[test]
+fn equivalent_command_omits_optional_flags_when_absent() {
+    let inputs = base_inputs();
+    let command = emit::draft(&inputs).expect("draft").equivalent_command;
+    assert!(!command.contains("--sample"));
+    assert!(!command.contains("--project"));
+}
+
+#[cfg(unix)]
+fn write_stub_evidence(dir: &Path, script: &str) -> PathBuf {
+    use std::os::unix::fs::PermissionsExt as _;
+
+    let path = dir.join("evidence");
+    std::fs::write(&path, script).expect("write stub evidence script");
+    let mut permissions = std::fs::metadata(&path).expect("stat stub").permissions();
+    permissions.set_mode(0o755);
+    std::fs::set_permissions(&path, permissions).expect("chmod stub");
+    path
+}
+
+#[cfg(unix)]
+#[test]
+fn verify_classifies_a_successful_check_as_bundle_accepted() {
+    let temp = tempfile::tempdir().expect("tempdir");
+    let stub = write_stub_evidence(temp.path(), "#!/bin/sh\nexit 0\n");
+    let project = temp.path().join("project");
+    std::fs::create_dir_all(&project).expect("mkdir project");
+
+    let classification = emit::verify(&project, Some(&stub)).expect("verify");
+    assert_eq!(classification, CheckClassification::BundleAccepted);
+}
+
+#[cfg(unix)]
+#[test]
+fn verify_classifies_a_deployment_message_as_bundle_rejected() {
+    let temp = tempfile::tempdir().expect("tempdir");
+    let script = "#!/bin/sh\nprintf 'evidence: deployment configuration is invalid: artifact evidence.yaml: unknown field\\n' >&2\nexit 1\n";
+    let stub = write_stub_evidence(temp.path(), script);
+    let project = temp.path().join("project");
+    std::fs::create_dir_all(&project).expect("mkdir project");
+
+    let classification = emit::verify(&project, Some(&stub)).expect("verify");
+    match classification {
+        CheckClassification::BundleRejected { stderr } => {
+            assert!(stderr.contains("deployment configuration is invalid"));
+        }
+        other => panic!("expected BundleRejected, got {other:?}"),
+    }
+}
+
+#[cfg(unix)]
+#[test]
+fn verify_classifies_a_runtime_initialization_message_as_secrets_unprovisioned() {
+    let temp = tempfile::tempdir().expect("tempdir");
+    let script =
+        "#!/bin/sh\nprintf 'evidence: runtime signing initialization failed\\n' >&2\nexit 1\n";
+    let stub = write_stub_evidence(temp.path(), script);
+    let project = temp.path().join("project");
+    std::fs::create_dir_all(&project).expect("mkdir project");
+
+    let classification = emit::verify(&project, Some(&stub)).expect("verify");
+    assert_eq!(classification, CheckClassification::SecretsUnprovisioned);
+}
+
+// --- Escaping and pointer rendering -------------------------------------
+
+/// The reproduce line is documented as paste-ready. A path carrying `$` or a
+/// backtick must therefore reach the shell as literal text: unquoted, `$HOME`
+/// expands and a backtick pair runs a command, so the pasted line reproduces
+/// something other than the run it claims to reproduce.
+#[test]
+fn the_reproduce_line_quotes_shell_expansion_characters() {
+    let mut inputs = base_inputs();
+    inputs.openapi = SpecSource::File(PathBuf::from("/srv/specs/$HOME/records`id`.yaml"));
+    let artifacts = emit::draft(&inputs).expect("draft");
+
+    assert!(
+        artifacts
+            .equivalent_command
+            .contains("'/srv/specs/$HOME/records`id`.yaml'"),
+        "expansion characters must be single-quoted: {}",
+        artifacts.equivalent_command
+    );
+}
+
+/// A property name may legally contain a double quote or a backslash. Both
+/// terminate or escape inside a Rhai string literal, so an unescaped one
+/// produces an extract script that does not parse, or parses as something
+/// other than the pointer it was drafted from.
+#[test]
+fn the_extract_script_escapes_quotes_in_a_pointer() {
+    let mut inputs = base_inputs();
+    inputs.selection = vec![r#"/say"hi"#.to_owned(), r"/back\slash".to_owned()];
+    let artifacts = emit::draft(&inputs).expect("draft");
+    let extract = file_contents(&artifacts, "adapters/search-a-extract.rhai");
+
+    assert!(
+        extract.contains(r#"get_path(source_response, "/say\"hi")"#),
+        "a double quote must be escaped in the Rhai literal:\n{extract}"
+    );
+    assert!(
+        extract.contains(r#"get_path(source_response, "/back\\slash")"#),
+        "a backslash must be escaped in the Rhai literal:\n{extract}"
+    );
+}
+
+/// The same applies to the drafted YAML: a double-quoted scalar carrying a raw
+/// newline or tab folds, silently changing the value the runtime reads.
+#[test]
+fn drafted_yaml_escapes_control_characters_in_a_scalar() {
+    let mut inputs = base_inputs();
+    inputs.media_type = "application/json\nx-injected: true".to_owned();
+    let artifacts = emit::draft(&inputs).expect("draft");
+    let source_block = artifacts
+        .files
+        .iter()
+        .find(|file| file.bundle_relative_path.ends_with(".yaml"))
+        .map(|file| file.contents.clone())
+        .unwrap_or_default();
+    let combined = format!("{}\n{}", artifacts.source_block, source_block);
+
+    assert!(
+        combined.contains(r"application/json\nx-injected"),
+        "a newline must be escaped rather than folded:\n{combined}"
+    );
+    // A raw newline inside the quoted scalar would make the injected key a
+    // sibling mapping entry.
+    assert!(
+        !combined.contains("\nx-injected: true"),
+        "the scalar must not break out into its own mapping key:\n{combined}"
+    );
+}
+
+/// Emitted paths are project-relative and never refer to removed source-tree
+/// templates.
+#[test]
+fn emitted_paths_are_project_relative() {
+    let artifacts = emit::draft(&base_inputs()).expect("draft");
+    let all = artifacts
+        .files
+        .iter()
+        .fold(artifacts.source_block.clone(), |mut text, file| {
+            text.push('\n');
+            text.push_str(&file.contents);
+            text
+        });
+
+    assert!(all.contains("schemas/search-a-response.schema.yaml"));
+    assert!(all.contains("adapters/search-a-extract.rhai"));
+    assert!(
+        !all.contains("templates/bundle/"),
+        "an evidencectl source path is not a path in the adopter's project:\n{all}"
+    );
+}
+
+/// A response body that is itself an array still needs a `maxItems`. The bound
+/// belongs to the root node, which has no property to hang a comment on and no
+/// pointer text of its own.
+#[test]
+fn a_root_level_array_carries_its_own_bound_annotation() {
+    let mut inputs = base_inputs();
+    inputs.selection = vec!["/*/trackingId".to_owned()];
+    inputs.narrowed = NarrowOutcome {
+        schema: json!({
+            "type": "array",
+            "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [],
+                "properties": {"trackingId": {"type": "string", "minLength": 0, "maxLength": 64}}
+            }
+        }),
+        unresolved: vec![BoundNeed {
+            pointer: String::new(),
+            kind: BoundKind::ArrayMaxItems,
+            suggestion: None,
+        }],
+    };
+    inputs.needs = vec![BoundNeed {
+        pointer: String::new(),
+        kind: BoundKind::ArrayMaxItems,
+        suggestion: None,
+    }];
+
+    let artifacts = emit::draft(&inputs).expect("draft");
+    let response_schema = file_contents(&artifacts, "schemas/search-a-response.schema.yaml");
+
+    assert!(
+        response_schema.contains("TODO(evidencectl): (response root) needs maxItems"),
+        "the root array's own bound must be annotated:\n{response_schema}"
+    );
+    assert!(
+        !response_schema.contains("TODO(evidencectl):  "),
+        "an empty pointer must not render as blank text:\n{response_schema}"
+    );
+    assert!(
+        !artifacts.report.contains("TODO(evidencectl):  "),
+        "an empty pointer must not render as blank text in the report:\n{}",
+        artifacts.report
+    );
+}
+
+/// A rejected bundle and unprovisioned secrets are opposite outcomes: one means
+/// the draft is wrong, the other means the draft is fine and the operator has
+/// not generated keys yet. Classifying a bundle rejection as the latter reports
+/// success for a draft the runtime refused.
+#[cfg(unix)]
+#[test]
+fn verify_never_classifies_a_bundle_rejection_as_unprovisioned_secrets() {
+    for stage in ["bundle", "source", "rate-limit"] {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let script = format!(
+            "#!/bin/sh\nprintf 'evidence: runtime {stage} initialization failed\\n' >&2\nexit 1\n"
+        );
+        let stub = write_stub_evidence(temp.path(), &script);
+        let project = temp.path().join("project");
+        std::fs::create_dir_all(&project).expect("mkdir project");
+
+        let classification = emit::verify(&project, Some(&stub)).expect("verify");
+        assert!(
+            matches!(classification, CheckClassification::BundleRejected { .. }),
+            "a {stage}-stage failure is a rejected bundle, got {classification:?}"
+        );
+    }
+}
+
+/// A future runtime may append a reason to a secret-stage message. The
+/// classification must survive that without loosening into a prefix match that
+/// also catches the bundle stage.
+#[cfg(unix)]
+#[test]
+fn verify_classifies_a_secret_stage_message_carrying_a_reason() {
+    let temp = tempfile::tempdir().expect("tempdir");
+    let script = "#!/bin/sh\nprintf 'evidence: runtime audit initialization failed: the audit chain head does not verify\\n' >&2\nexit 1\n";
+    let stub = write_stub_evidence(temp.path(), script);
+    let project = temp.path().join("project");
+    std::fs::create_dir_all(&project).expect("mkdir project");
+
+    let classification = emit::verify(&project, Some(&stub)).expect("verify");
+    assert_eq!(classification, CheckClassification::SecretsUnprovisioned);
+}
diff --git a/crates/registry-evidencectl/tests/suggest_fetch.rs b/crates/registry-evidencectl/tests/suggest_fetch.rs
new file mode 100644
index 000000000..4cfe9db2b
--- /dev/null
+++ b/crates/registry-evidencectl/tests/suggest_fetch.rs
@@ -0,0 +1,290 @@
+//! Reading an OpenAPI document from a URL: which URLs are fetched at all, and
+//! what happens to the response.
+//!
+//! Every test here is offline. The policy half is a pure function over a URL
+//! string, and the transport half runs against a throwaway HTTP server bound
+//! to a loopback port in this process, which is also the one case where plain
+//! `http` is permitted. Nothing in this file reaches a public host, so the
+//! suite stays hermetic and runs the same on a machine with no network.
+
+#[path = "../src/suggest/fetch.rs"]
+mod fetch;
+// `openapi.rs` pulls in the whole pipeline's type vocabulary; this binary
+// exercises the loading slice of it.
+#[allow(dead_code)]
+#[path = "../src/suggest/openapi.rs"]
+mod openapi;
+#[allow(dead_code)]
+#[path = "../src/suggest/types.rs"]
+mod types;
+
+use std::{
+    io::{BufRead, BufReader, Write},
+    net::{SocketAddr, TcpListener, TcpStream},
+    path::Path,
+};
+
+use types::SpecSource;
+
+// --- which URLs are fetched --------------------------------------------------
+
+#[test]
+fn an_https_url_is_read_as_a_url() {
+    let source = fetch::spec_source("https://api.example.test/openapi.yaml").expect("accepted");
+    assert!(matches!(source, SpecSource::Url(_)));
+    assert_eq!(source.display(), "https://api.example.test/openapi.yaml");
+}
+
+/// The URL test is for a scheme at the front of the argument, so an ordinary
+/// path is still a path even when it contains the characters a URL uses.
+#[test]
+fn a_path_is_read_as_a_path() {
+    for argument in [
+        "openapi.yaml",
+        "./specs/openapi.yaml",
+        "/srv/specs/openapi.yaml",
+        "specs/http://not-a-url.yaml",
+    ] {
+        let source = fetch::spec_source(argument).expect("accepted");
+        assert!(
+            matches!(source, SpecSource::File(_)),
+            "`{argument}` should be read as a file"
+        );
+    }
+}
+
+/// A description read in the clear can be tampered with, and it decides which
+/// leaves the operator is offered, so the projection a drafted source ends up
+/// reading is only as trustworthy as the transport that carried it. This is
+/// the same rule the runtime applies to the source URLs it will itself call.
+#[test]
+fn plain_http_to_a_host_that_is_not_loopback_is_refused() {
+    for url in [
+        "http://api.example.test/openapi.yaml",
+        "http://192.0.2.10/openapi.yaml",
+        "http://localhost:3000/openapi.yaml",
+    ] {
+        let error = fetch::spec_source(url).unwrap_err();
+        let message = format!("{error:#}");
+        assert!(
+            message.contains("loopback"),
+            "`{url}` message was: {message}"
+        );
+    }
+}
+
+#[test]
+fn plain_http_to_a_numeric_loopback_host_is_accepted() {
+    for url in [
+        "http://127.0.0.1:8080/openapi.yaml",
+        "http://[::1]:8080/openapi.yaml",
+    ] {
+        let source = fetch::spec_source(url).unwrap_or_else(|error| panic!("{url}: {error:#}"));
+        assert!(matches!(source, SpecSource::Url(_)), "`{url}` was refused");
+    }
+}
+
+/// The refusal must not quote the URL back: what makes it unacceptable is the
+/// credential inside it, and a message is printed to a terminal and kept in a
+/// scrollback buffer.
+#[test]
+fn a_url_carrying_credentials_is_refused_without_echoing_them() {
+    let error =
+        fetch::spec_source("https://reader:hunter2@api.example.test/openapi.yaml").unwrap_err();
+    let message = format!("{error:#}");
+    assert!(message.contains("credentials"), "message was: {message}");
+    assert!(
+        !message.contains("hunter2") && !message.contains("reader"),
+        "the refusal echoed the credential: {message}"
+    );
+}
+
+#[test]
+fn a_query_or_fragment_is_refused_without_echoing_its_value() {
+    for (url, sensitive) in [
+        (
+            "https://api.example.test/openapi.yaml?access_token=query-secret",
+            "query-secret",
+        ),
+        (
+            "https://api.example.test/openapi.yaml#private-fragment",
+            "private-fragment",
+        ),
+    ] {
+        let error = fetch::spec_source(url).unwrap_err();
+        let message = format!("{error:#}");
+        assert!(
+            message.contains("query or fragment") && message.contains("local file"),
+            "message was: {message}"
+        );
+        assert!(
+            !message.contains(sensitive) && !message.contains(url),
+            "the refusal echoed the unsafe URL component: {message}"
+        );
+    }
+}
+
+#[test]
+fn a_scheme_that_is_not_http_is_refused() {
+    for url in [
+        "ftp://example.test/openapi.yaml",
+        "file:///tmp/openapi.yaml",
+    ] {
+        let error = fetch::spec_source(url).unwrap_err();
+        let message = format!("{error:#}");
+        assert!(
+            message.contains("not fetched"),
+            "`{url}` message was: {message}"
+        );
+    }
+}
+
+// --- what happens to the response --------------------------------------------
+
+#[test]
+fn a_document_served_over_loopback_is_opened_exactly_as_the_file_would_be() {
+    let fixture = fixture_text("records-3.0.yaml");
+    let address = serve(move |_target| ok(&fixture, "application/yaml"));
+
+    let from_url = openapi::Spec::open(&url_source(address, "/openapi.yaml")).expect("opens");
+    let from_file =
+        openapi::Spec::open(&SpecSource::File(fixture_path("records-3.0.yaml"))).expect("opens");
+
+    assert_eq!(
+        from_url
+            .operations()
+            .into_iter()
+            .map(|summary| summary.key)
+            .collect::<Vec<_>>(),
+        from_file
+            .operations()
+            .into_iter()
+            .map(|summary| summary.key)
+            .collect::<Vec<_>>()
+    );
+}
+
+/// A description behind authentication answers with a status, not a document.
+/// Saying which status came back is what tells the operator to fetch it
+/// themselves rather than to go looking for a malformed file.
+#[test]
+fn a_non_success_status_is_reported_with_its_code() {
+    let address = serve(|_target| {
+        b"HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\nConnection: close\r\n\r\n".to_vec()
+    });
+
+    let error = openapi::Spec::open(&url_source(address, "/openapi.yaml")).unwrap_err();
+    let message = format!("{error:#}");
+    assert!(
+        message.contains("401") && message.contains("authentication"),
+        "message was: {message}"
+    );
+}
+
+/// The ceiling is enforced while reading rather than from the declared length,
+/// so a response that never says how long it is cannot talk this into
+/// buffering whatever the server feels like sending.
+#[test]
+fn a_body_past_the_ceiling_is_refused() {
+    let declared = serve(|_target| ok(&"x".repeat(4096), "application/yaml"));
+    let undeclared = serve(|_target| {
+        let mut response =
+            b"HTTP/1.1 200 OK\r\nContent-Type: application/yaml\r\nConnection: close\r\n\r\n"
+                .to_vec();
+        response.extend_from_slice("x".repeat(4096).as_bytes());
+        response
+    });
+
+    for address in [declared, undeclared] {
+        let SpecSource::Url(url) = url_source(address, "/openapi.yaml") else {
+            unreachable!("built as a URL")
+        };
+        let error = fetch::get(&url, 512).unwrap_err();
+        let message = format!("{error:#}");
+        assert!(message.contains("512 byte limit"), "message was: {message}");
+    }
+}
+
+/// A published description is very often a stable URL pointing at a versioned
+/// one, so a redirect is followed; where it lands is checked under the same
+/// rule as where it started.
+#[test]
+fn a_redirect_is_followed_and_its_destination_is_read() {
+    let fixture = fixture_text("records-3.0.yaml");
+    let destination = serve(move |_target| ok(&fixture, "application/yaml"));
+    let entry = serve(move |_target| {
+        format!(
+            "HTTP/1.1 302 Found\r\nLocation: http://{destination}/versioned.yaml\r\n\
+             Content-Length: 0\r\nConnection: close\r\n\r\n"
+        )
+        .into_bytes()
+    });
+
+    let spec = openapi::Spec::open(&url_source(entry, "/latest.yaml")).expect("opens");
+    assert!(!spec.operations().is_empty());
+}
+
+// --- helpers -----------------------------------------------------------------
+
+fn fixture_path(name: &str) -> std::path::PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("tests/fixtures/openapi")
+        .join(name)
+}
+
+fn fixture_text(name: &str) -> String {
+    std::fs::read_to_string(fixture_path(name)).expect("fixture readable")
+}
+
+fn url_source(address: SocketAddr, path: &str) -> SpecSource {
+    fetch::spec_source(&format!("http://{address}{path}")).expect("loopback URL accepted")
+}
+
+fn ok(body: &str, content_type: &str) -> Vec<u8> {
+    format!(
+        "HTTP/1.1 200 OK\r\nContent-Type: {content_type}\r\nContent-Length: {}\r\n\
+         Connection: close\r\n\r\n{body}",
+        body.len()
+    )
+    .into_bytes()
+}
+
+/// Binds a loopback port and answers every request with `respond`, returning
+/// the address it bound.
+///
+/// The serving thread is left running for the rest of the test binary's life:
+/// it holds nothing but a socket, and a test that finished has no way to be
+/// waiting on it. Requests are read only far enough to know what was asked
+/// for, which is all any test here needs to decide what to send back.
+fn serve(respond: impl Fn(&str) -> Vec<u8> + Send + 'static) -> SocketAddr {
+    let listener = TcpListener::bind("127.0.0.1:0").expect("binds a loopback port");
+    let address = listener.local_addr().expect("has an address");
+    std::thread::spawn(move || {
+        for stream in listener.incoming() {
+            let Ok(stream) = stream else { continue };
+            handle(stream, &respond);
+        }
+    });
+    address
+}
+
+fn handle(mut stream: TcpStream, respond: &impl Fn(&str) -> Vec<u8>) {
+    let mut reader = BufReader::new(stream.try_clone().expect("clones the stream"));
+    let mut request_line = String::new();
+    if reader.read_line(&mut request_line).is_err() {
+        return;
+    }
+    loop {
+        let mut header = String::new();
+        match reader.read_line(&mut header) {
+            Ok(0) => break,
+            Ok(_) if header == "\r\n" || header == "\n" => break,
+            Ok(_) => {}
+            Err(_) => return,
+        }
+    }
+    let target = request_line.split_whitespace().nth(1).unwrap_or("/");
+    let response = respond(target);
+    let _ = stream.write_all(&response);
+    let _ = stream.flush();
+}
diff --git a/crates/registry-evidencectl/tests/suggest_narrow.rs b/crates/registry-evidencectl/tests/suggest_narrow.rs
new file mode 100644
index 000000000..644c4111c
--- /dev/null
+++ b/crates/registry-evidencectl/tests/suggest_narrow.rs
@@ -0,0 +1,957 @@
+//! Narrowing stage: an OpenAPI response schema restricted to a projection
+//! selection and rewritten into the closed Version 1 response subset.
+//!
+//! The inputs are built here as JSON literals rather than loaded through the
+//! OpenAPI stage, so a failure names a narrowing rule and never a loader bug.
+//! Every expectation is checked against the shipped shapes under
+//! `products/evidence/fixtures/source-shapes/*/schemas/response.schema.yaml`:
+//! closed objects, `required` as the spec-guaranteed subset of kept members,
+//! bounded arrays and strings, and the `[T, "null"]` response pair.
+
+#[allow(dead_code)]
+#[path = "../src/suggest/types.rs"]
+mod types;
+
+#[allow(dead_code)]
+#[path = "../src/suggest/narrow.rs"]
+mod narrow;
+
+use std::collections::BTreeMap;
+
+use serde_json::{json, Value};
+
+use narrow::{AdvisoryKind, Plan, Resolution};
+use types::{
+    BoundKind, BoundValues, NarrowOutcome, Observations, Observed, Provenance, ResolvedSchema,
+    SuggestedBound,
+};
+
+/// Builds a resolved schema from a JSON literal.
+fn schema(value: Value) -> ResolvedSchema {
+    ResolvedSchema(value)
+}
+
+/// Builds a selection from string literals.
+fn selection(entries: &[&str]) -> Vec<String> {
+    entries.iter().map(|entry| (*entry).to_owned()).collect()
+}
+
+/// Builds observations for one pointer.
+fn observed(pointer: &str, observation: Observed) -> Observations {
+    let mut observations = Observations::default();
+    observations
+        .by_pointer
+        .insert(pointer.to_owned(), observation);
+    observations
+}
+
+/// Builds a one-entry resolution list for the slice entry point, which takes
+/// the same pairs as the `BTreeMap` form declared in `types.rs`.
+fn resolved(pointer: &str, kind: BoundKind, values: BoundValues) -> Vec<Resolution> {
+    vec![((pointer.to_owned(), kind), values)]
+}
+
+fn plan(
+    schema: &ResolvedSchema,
+    entries: &[&str],
+    observations: &Observations,
+) -> Vec<types::BoundNeed> {
+    plan_advisories(schema, entries, observations).needs
+}
+
+fn plan_advisories(schema: &ResolvedSchema, entries: &[&str], observations: &Observations) -> Plan {
+    narrow::plan_advisories(schema, &selection(entries), observations).expect("plan")
+}
+
+fn apply(schema: &ResolvedSchema, entries: &[&str], resolutions: &[Resolution]) -> NarrowOutcome {
+    narrow::apply_entries(schema, &selection(entries), resolutions).expect("apply")
+}
+
+/// A root object wrapping one property, the smallest schema the subset admits.
+fn root(properties: Value, required: Value) -> ResolvedSchema {
+    schema(json!({
+        "type": "object",
+        "required": required,
+        "properties": properties,
+    }))
+}
+
+#[test]
+fn an_integer_with_only_a_minimum_raises_a_bound_need() {
+    let input = root(
+        json!({"total": {"type": "integer", "minimum": 0}}),
+        json!(["total"]),
+    );
+
+    let needs = plan(&input, &["/total"], &Observations::default());
+
+    assert_eq!(needs.len(), 1, "one unmet bound: {needs:?}");
+    assert_eq!(needs[0].pointer, "/total");
+    assert_eq!(needs[0].kind, BoundKind::IntegerRange);
+    assert!(
+        needs[0].suggestion.is_none(),
+        "nothing to derive a maximum from: {:?}",
+        needs[0].suggestion
+    );
+}
+
+#[test]
+fn an_integer_with_an_enum_needs_no_bound_and_keeps_the_enum() {
+    let input = root(
+        json!({"total": {"type": "integer", "enum": [0, 1, 2]}}),
+        json!(["total"]),
+    );
+
+    assert!(plan(&input, &["/total"], &Observations::default()).is_empty());
+
+    let outcome = apply(&input, &["/total"], &[]);
+    assert_eq!(
+        outcome.schema["properties"]["total"],
+        json!({"type": "integer", "enum": [0, 1, 2]})
+    );
+    assert!(outcome.unresolved.is_empty());
+}
+
+#[test]
+fn an_integer_with_a_const_needs_no_bound() {
+    let input = root(
+        json!({"page": {"type": "integer", "const": 1}}),
+        json!(["page"]),
+    );
+
+    assert!(plan(&input, &["/page"], &Observations::default()).is_empty());
+    let outcome = apply(&input, &["/page"], &[]);
+    assert_eq!(
+        outcome.schema["properties"]["page"],
+        json!({"type": "integer", "const": 1})
+    );
+}
+
+#[test]
+fn a_sample_widens_an_integer_range_outward_to_round_numbers() {
+    let input = root(json!({"total": {"type": "integer"}}), json!(["total"]));
+    let observations = observed(
+        "/total",
+        Observed {
+            min_integer: Some(0),
+            max_integer: Some(2),
+            ..Observed::default()
+        },
+    );
+
+    let needs = plan(&input, &["/total"], &observations);
+
+    let suggestion = needs[0].suggestion.clone().expect("a sample suggestion");
+    assert_eq!(
+        suggestion,
+        SuggestedBound {
+            values: BoundValues::IntegerRange {
+                minimum: 0,
+                maximum: 10
+            },
+            provenance: Provenance::Sample,
+        }
+    );
+}
+
+/// A sampled integer is usually a counter, and a counter's ceiling is the one
+/// bound a single response says least about: the widening is deliberately
+/// generous rather than snug around what was seen.
+#[test]
+fn a_sample_integer_maximum_widens_to_a_generous_power_of_ten() {
+    let input = root(json!({"total": {"type": "integer"}}), json!(["total"]));
+    let observations = observed(
+        "/total",
+        Observed {
+            min_integer: Some(4),
+            max_integer: Some(1_000),
+            ..Observed::default()
+        },
+    );
+
+    let needs = plan(&input, &["/total"], &observations);
+
+    assert_eq!(
+        needs[0].suggestion.clone().expect("suggestion").values,
+        BoundValues::IntegerRange {
+            minimum: 0,
+            maximum: 10_000
+        },
+        "the observed floor of 4 is kept at 0 and 1000 widens past 2000 to 10000"
+    );
+}
+
+#[test]
+fn a_small_sampled_counter_still_gets_a_generous_ceiling() {
+    for (observed_maximum, expected) in [(12_i64, 100_i64), (60, 1_000), (2, 10)] {
+        let input = root(json!({"total": {"type": "integer"}}), json!(["total"]));
+        let observations = observed(
+            "/total",
+            Observed {
+                min_integer: Some(0),
+                max_integer: Some(observed_maximum),
+                ..Observed::default()
+            },
+        );
+
+        let needs = plan(&input, &["/total"], &observations);
+
+        assert_eq!(
+            needs[0].suggestion.clone().expect("suggestion").values,
+            BoundValues::IntegerRange {
+                minimum: 0,
+                maximum: expected
+            },
+            "observing {observed_maximum} should suggest a ceiling of {expected}"
+        );
+    }
+}
+
+#[test]
+fn a_negative_sample_integer_widens_below_zero() {
+    let input = root(json!({"offset": {"type": "integer"}}), json!(["offset"]));
+    let observations = observed(
+        "/offset",
+        Observed {
+            min_integer: Some(-30),
+            max_integer: Some(5),
+            ..Observed::default()
+        },
+    );
+
+    let needs = plan(&input, &["/offset"], &observations);
+
+    assert_eq!(
+        needs[0].suggestion.clone().expect("suggestion").values,
+        BoundValues::IntegerRange {
+            minimum: -50,
+            maximum: 10
+        }
+    );
+}
+
+#[test]
+fn a_spec_minimum_survives_into_a_sample_suggestion() {
+    let input = root(
+        json!({"total": {"type": "integer", "minimum": 1}}),
+        json!(["total"]),
+    );
+    let observations = observed(
+        "/total",
+        Observed {
+            min_integer: Some(3),
+            max_integer: Some(3),
+            ..Observed::default()
+        },
+    );
+
+    let needs = plan(&input, &["/total"], &observations);
+
+    assert_eq!(
+        needs[0].suggestion.clone().expect("suggestion").values,
+        BoundValues::IntegerRange {
+            minimum: 1,
+            maximum: 10
+        },
+        "the stated minimum is authoritative; only the missing maximum is derived"
+    );
+}
+
+#[test]
+fn a_string_with_the_date_format_is_kept_and_needs_no_bound() {
+    let input = root(
+        json!({"recordedOn": {"type": "string", "format": "date"}}),
+        json!([]),
+    );
+
+    assert!(plan(&input, &["/recordedOn"], &Observations::default()).is_empty());
+
+    let outcome = apply(&input, &["/recordedOn"], &[]);
+    assert_eq!(
+        outcome.schema["properties"]["recordedOn"],
+        json!({"type": "string", "format": "date"})
+    );
+}
+
+#[test]
+fn a_string_with_the_uuid_format_is_suggested_fixed_length_and_loses_the_format() {
+    let input = root(
+        json!({"trackingId": {"type": "string", "format": "uuid"}}),
+        json!(["trackingId"]),
+    );
+
+    let plan = plan_advisories(&input, &["/trackingId"], &Observations::default());
+
+    assert_eq!(plan.needs.len(), 1);
+    assert_eq!(plan.needs[0].kind, BoundKind::StringLength);
+    assert_eq!(
+        plan.needs[0].suggestion.clone().expect("suggestion"),
+        SuggestedBound {
+            values: BoundValues::StringLength {
+                min_length: 36,
+                max_length: 36
+            },
+            provenance: Provenance::Format,
+        }
+    );
+    assert!(
+        plan.advisories
+            .iter()
+            .any(|advisory| advisory.pointer == "/trackingId"
+                && advisory.kind == AdvisoryKind::DroppedFormat("uuid".to_owned())),
+        "the dropped format is reported: {:?}",
+        plan.advisories
+    );
+
+    let outcome = apply(
+        &input,
+        &["/trackingId"],
+        &resolved(
+            "/trackingId",
+            BoundKind::StringLength,
+            BoundValues::StringLength {
+                min_length: 36,
+                max_length: 36,
+            },
+        ),
+    );
+    assert_eq!(
+        outcome.schema["properties"]["trackingId"],
+        json!({"type": "string", "minLength": 36, "maxLength": 36}),
+        "the closed subset admits only the date formats, so `uuid` is dropped"
+    );
+}
+
+#[test]
+fn a_string_with_an_unsupported_format_suggests_nothing_and_reports_the_drop() {
+    let input = root(
+        json!({"contact": {"type": "string", "format": "email"}}),
+        json!(["contact"]),
+    );
+
+    let plan = plan_advisories(&input, &["/contact"], &Observations::default());
+
+    assert_eq!(plan.needs.len(), 1);
+    assert!(
+        plan.needs[0].suggestion.is_none(),
+        "nothing mechanical follows from `email`"
+    );
+    assert_eq!(
+        plan.advisories[0].kind,
+        AdvisoryKind::DroppedFormat("email".to_owned())
+    );
+}
+
+#[test]
+fn a_sample_string_length_rounds_up_to_the_next_power_of_two() {
+    let input = root(json!({"status": {"type": "string"}}), json!(["status"]));
+    let observations = observed(
+        "/status",
+        Observed {
+            max_string_bytes: Some(36),
+            ..Observed::default()
+        },
+    );
+
+    let needs = plan(&input, &["/status"], &observations);
+
+    assert_eq!(
+        needs[0].suggestion.clone().expect("suggestion"),
+        SuggestedBound {
+            values: BoundValues::StringLength {
+                min_length: 0,
+                max_length: 64
+            },
+            provenance: Provenance::Sample,
+        }
+    );
+}
+
+#[test]
+fn a_short_sample_string_still_gets_the_sixteen_byte_floor() {
+    let input = root(json!({"status": {"type": "string"}}), json!(["status"]));
+    let observations = observed(
+        "/status",
+        Observed {
+            max_string_bytes: Some(3),
+            ..Observed::default()
+        },
+    );
+
+    let needs = plan(&input, &["/status"], &observations);
+
+    assert_eq!(
+        needs[0].suggestion.clone().expect("suggestion").values,
+        BoundValues::StringLength {
+            min_length: 0,
+            max_length: 16
+        }
+    );
+}
+
+#[test]
+fn a_string_enum_needs_no_bound_and_is_carried_through() {
+    let input = root(
+        json!({"status": {"type": "string", "enum": ["open", "closed"]}}),
+        json!(["status"]),
+    );
+
+    assert!(plan(&input, &["/status"], &Observations::default()).is_empty());
+
+    let outcome = apply(&input, &["/status"], &[]);
+    assert_eq!(
+        outcome.schema["properties"]["status"],
+        json!({"type": "string", "enum": ["open", "closed"]})
+    );
+}
+
+#[test]
+fn an_array_without_max_items_takes_a_widened_clamped_sample_suggestion() {
+    let input = root(
+        json!({"records": {"type": "array", "items": {"type": "string", "maxLength": 32}}}),
+        json!(["records"]),
+    );
+    let observations = observed(
+        "/records",
+        Observed {
+            max_array_items: Some(2),
+            ..Observed::default()
+        },
+    );
+
+    let needs = plan(&input, &["/records/*"], &observations);
+
+    assert_eq!(needs.len(), 1);
+    assert_eq!(needs[0].pointer, "/records");
+    assert_eq!(needs[0].kind, BoundKind::ArrayMaxItems);
+    assert_eq!(
+        needs[0].suggestion.clone().expect("suggestion"),
+        SuggestedBound {
+            values: BoundValues::MaxItems(8),
+            provenance: Provenance::Sample,
+        },
+        "two observed elements round up to the next multiple of eight"
+    );
+}
+
+#[test]
+fn a_large_sample_array_is_clamped_to_the_subset_ceiling() {
+    let input = root(
+        json!({"records": {"type": "array", "items": {"type": "string", "maxLength": 32}}}),
+        json!(["records"]),
+    );
+    let observations = observed(
+        "/records",
+        Observed {
+            max_array_items: Some(500),
+            ..Observed::default()
+        },
+    );
+
+    let needs = plan(&input, &["/records/*"], &observations);
+
+    assert_eq!(
+        needs[0].suggestion.clone().expect("suggestion").values,
+        BoundValues::MaxItems(256),
+        "the closed subset admits maxItems 1..=256"
+    );
+}
+
+#[test]
+fn a_spec_max_items_outside_the_subset_is_clamped_and_credited_to_the_ceiling() {
+    let input = root(
+        json!({
+            "records": {
+                "type": "array",
+                "maxItems": 5_000,
+                "items": {"type": "string", "maxLength": 32}
+            }
+        }),
+        json!(["records"]),
+    );
+
+    let needs = plan(&input, &["/records/*"], &Observations::default());
+
+    assert_eq!(needs.len(), 1);
+    assert_eq!(
+        needs[0].suggestion.clone().expect("suggestion"),
+        SuggestedBound {
+            values: BoundValues::MaxItems(256),
+            provenance: Provenance::SubsetCeiling,
+        },
+        "5000 is not the number the draft ends up stating, so the document does not \
+         get the credit for the 256 that replaces it"
+    );
+
+    let outcome = apply(&input, &["/records/*"], &[]);
+    assert!(
+        outcome.schema["properties"]["records"]
+            .get("maxItems")
+            .is_none(),
+        "an out-of-subset spec bound is never emitted unresolved"
+    );
+}
+
+#[test]
+fn a_spec_max_items_inside_the_subset_raises_no_need() {
+    let input = root(
+        json!({
+            "records": {
+                "type": "array",
+                "maxItems": 2,
+                "items": {"type": "string", "maxLength": 32}
+            }
+        }),
+        json!(["records"]),
+    );
+
+    assert!(plan(&input, &["/records/*"], &Observations::default()).is_empty());
+
+    let outcome = apply(&input, &["/records/*"], &[]);
+    assert_eq!(
+        outcome.schema["properties"]["records"],
+        json!({
+            "type": "array",
+            "minItems": 0,
+            "maxItems": 2,
+            "items": {"type": "string", "maxLength": 32}
+        })
+    );
+}
+
+#[test]
+fn a_record_under_a_wildcard_requires_only_the_kept_members_the_spec_guarantees() {
+    let input = root(
+        json!({
+            "total": {"type": "integer", "minimum": 0, "maximum": 1000000},
+            "results": {
+                "type": "array",
+                "maxItems": 2,
+                "items": {
+                    "type": "object",
+                    "required": ["id", "status"],
+                    "properties": {
+                        "id": {"type": "string", "maxLength": 64},
+                        "status": {"type": "string", "enum": ["open", "closed"]},
+                        "note": {"type": "string", "maxLength": 8}
+                    }
+                }
+            }
+        }),
+        json!(["total", "results"]),
+    );
+
+    let outcome = apply(&input, &["/total", "/results/*/id"], &[]);
+
+    assert_eq!(
+        outcome.schema,
+        json!({
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["results", "total"],
+            "properties": {
+                "total": {"type": "integer", "minimum": 0, "maximum": 1000000},
+                "results": {
+                    "type": "array",
+                    "minItems": 0,
+                    "maxItems": 2,
+                    "items": {
+                        "type": "object",
+                        "additionalProperties": false,
+                        "required": ["id"],
+                        "properties": {
+                            "id": {"type": "string", "maxLength": 64}
+                        }
+                    }
+                }
+            }
+        }),
+        "unselected members leave, and `status` leaves `required` with them"
+    );
+    assert!(outcome.unresolved.is_empty());
+}
+
+#[test]
+fn a_record_the_spec_does_not_guarantee_gets_an_empty_required_list() {
+    let input = root(
+        json!({
+            "results": {
+                "type": "array",
+                "maxItems": 2,
+                "items": {
+                    "type": "object",
+                    "properties": {"recordedOn": {"type": "string", "format": "date"}}
+                }
+            }
+        }),
+        json!(["results"]),
+    );
+
+    let outcome = apply(&input, &["/results/*/recordedOn"], &[]);
+
+    assert_eq!(
+        outcome.schema["properties"]["results"]["items"]["required"],
+        json!([]),
+        "projection drops a leaf the record did not carry, so nothing is required"
+    );
+}
+
+#[test]
+fn a_nullable_type_pair_is_preserved_through_narrowing() {
+    let input = root(
+        json!({
+            "result": {
+                "type": ["object", "null"],
+                "properties": {
+                    "code": {"type": ["string", "null"], "maxLength": 32}
+                }
+            }
+        }),
+        json!([]),
+    );
+
+    let outcome = apply(&input, &["/result/code"], &[]);
+
+    assert_eq!(
+        outcome.schema["properties"]["result"],
+        json!({
+            "type": ["object", "null"],
+            "additionalProperties": false,
+            "required": [],
+            "properties": {"code": {"type": ["string", "null"], "maxLength": 32}}
+        })
+    );
+}
+
+#[test]
+fn an_explicit_null_the_spec_does_not_admit_is_reported_as_an_advisory() {
+    let input = root(
+        json!({"status": {"type": "string", "maxLength": 32}}),
+        json!(["status"]),
+    );
+    let observations = observed(
+        "/status",
+        Observed {
+            saw_null: true,
+            max_string_bytes: Some(4),
+            ..Observed::default()
+        },
+    );
+
+    let plan = plan_advisories(&input, &["/status"], &observations);
+
+    assert!(plan.needs.is_empty(), "the spec already bounds the string");
+    assert_eq!(plan.advisories.len(), 1);
+    assert_eq!(plan.advisories[0].pointer, "/status");
+    assert_eq!(plan.advisories[0].kind, AdvisoryKind::NullOutsideSpec);
+    assert!(
+        plan.advisories[0].message().contains("null"),
+        "the advisory explains itself: {}",
+        plan.advisories[0].message()
+    );
+}
+
+#[test]
+fn a_nullable_leaf_that_saw_null_raises_no_advisory() {
+    let input = root(
+        json!({"status": {"type": ["string", "null"], "maxLength": 32}}),
+        json!(["status"]),
+    );
+    let observations = observed(
+        "/status",
+        Observed {
+            saw_null: true,
+            ..Observed::default()
+        },
+    );
+
+    assert!(plan_advisories(&input, &["/status"], &observations)
+        .advisories
+        .is_empty());
+}
+
+#[test]
+fn an_ancestor_and_its_descendant_cannot_both_be_selected() {
+    let input = root(
+        json!({
+            "results": {
+                "type": "array",
+                "maxItems": 2,
+                "items": {
+                    "type": "object",
+                    "properties": {"id": {"type": "string", "maxLength": 8}}
+                }
+            }
+        }),
+        json!(["results"]),
+    );
+
+    let error = narrow::apply_entries(&input, &selection(&["/results", "/results/*/id"]), &[])
+        .expect_err("overlapping projection entries are rejected");
+    let message = format!("{error:#}");
+
+    assert!(message.contains("/results"), "{message}");
+    assert!(message.contains("/results/*/id"), "{message}");
+    assert!(message.contains("overlap"), "{message}");
+}
+
+#[test]
+fn a_duplicate_selection_entry_is_rejected() {
+    let input = root(json!({"total": {"type": "integer", "const": 1}}), json!([]));
+
+    let error = narrow::plan_advisories(
+        &input,
+        &selection(&["/total", "/total"]),
+        &Observations::default(),
+    )
+    .expect_err("duplicate projection entries are rejected");
+    let message = format!("{error:#}");
+
+    assert!(message.contains("/total"), "{message}");
+    assert!(message.contains("duplicat"), "{message}");
+}
+
+#[test]
+fn a_numeric_index_into_an_array_is_rejected_in_favour_of_the_wildcard() {
+    let input = root(
+        json!({
+            "results": {
+                "type": "array",
+                "maxItems": 2,
+                "items": {"type": "string", "maxLength": 8}
+            }
+        }),
+        json!([]),
+    );
+
+    let error = narrow::apply_entries(&input, &selection(&["/results/0"]), &[])
+        .expect_err("numeric indexes are not projection syntax");
+    let message = format!("{error:#}");
+
+    assert!(message.contains('*'), "{message}");
+}
+
+#[test]
+fn a_selection_that_is_not_in_the_schema_is_rejected() {
+    let input = root(json!({"total": {"type": "integer", "const": 1}}), json!([]));
+
+    let error = narrow::apply_entries(&input, &selection(&["/missing"]), &[])
+        .expect_err("an unknown pointer is a visible failure");
+
+    assert!(format!("{error:#}").contains("/missing"));
+}
+
+#[test]
+fn an_unresolved_bound_is_omitted_from_the_schema_and_reported() {
+    let input = root(
+        json!({
+            "total": {"type": "integer"},
+            "records": {"type": "array", "items": {"type": "string"}}
+        }),
+        json!(["total"]),
+    );
+
+    let outcome = apply(&input, &["/total", "/records/*"], &[]);
+
+    let total = &outcome.schema["properties"]["total"];
+    assert_eq!(total, &json!({"type": "integer"}));
+    assert!(total.get("minimum").is_none() && total.get("maximum").is_none());
+    let records = &outcome.schema["properties"]["records"];
+    assert!(records.get("maxItems").is_none());
+    assert!(records["items"].get("maxLength").is_none());
+
+    let reported: Vec<(&str, &BoundKind)> = outcome
+        .unresolved
+        .iter()
+        .map(|need| (need.pointer.as_str(), &need.kind))
+        .collect();
+    assert_eq!(
+        reported,
+        vec![
+            ("/records", &BoundKind::ArrayMaxItems),
+            ("/records/*", &BoundKind::StringLength),
+            ("/total", &BoundKind::IntegerRange),
+        ],
+        "unresolved bounds are reported in schema order"
+    );
+}
+
+#[test]
+fn a_resolved_bound_is_written_into_the_schema() {
+    let input = root(json!({"total": {"type": "integer"}}), json!(["total"]));
+
+    let outcome = apply(
+        &input,
+        &["/total"],
+        &resolved(
+            "/total",
+            BoundKind::IntegerRange,
+            BoundValues::IntegerRange {
+                minimum: 0,
+                maximum: 1_000_000,
+            },
+        ),
+    );
+
+    assert_eq!(
+        outcome.schema["properties"]["total"],
+        json!({"type": "integer", "minimum": 0, "maximum": 1000000})
+    );
+    assert!(outcome.unresolved.is_empty());
+}
+
+#[test]
+fn unselected_siblings_are_pruned_from_every_level() {
+    let input = root(
+        json!({
+            "total": {"type": "integer", "minimum": 0, "maximum": 100},
+            "secret": {"type": "string", "maxLength": 32},
+            "meta": {
+                "type": "object",
+                "required": ["page"],
+                "properties": {
+                    "page": {"type": "integer", "const": 1},
+                    "cursor": {"type": "string", "maxLength": 64}
+                }
+            }
+        }),
+        json!(["total", "secret", "meta"]),
+    );
+
+    let outcome = apply(&input, &["/total", "/meta/page"], &[]);
+
+    assert_eq!(
+        outcome.schema,
+        json!({
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["meta", "total"],
+            "properties": {
+                "total": {"type": "integer", "minimum": 0, "maximum": 100},
+                "meta": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["page"],
+                    "properties": {"page": {"type": "integer", "const": 1}}
+                }
+            }
+        })
+    );
+}
+
+#[test]
+fn selecting_a_container_keeps_its_whole_subtree() {
+    let input = root(
+        json!({
+            "meta": {
+                "type": "object",
+                "required": ["page"],
+                "properties": {
+                    "page": {"type": "integer", "const": 1},
+                    "cursor": {"type": "string", "maxLength": 64}
+                }
+            },
+            "other": {"type": "string", "maxLength": 4}
+        }),
+        json!(["meta", "other"]),
+    );
+
+    let outcome = apply(&input, &["/meta"], &[]);
+
+    assert_eq!(
+        outcome.schema["properties"]["meta"]["properties"]["cursor"],
+        json!({"type": "string", "maxLength": 64})
+    );
+    assert!(outcome.schema["properties"].get("other").is_none());
+}
+
+#[test]
+fn an_escaped_segment_addresses_the_literal_key() {
+    let input = root(
+        json!({"a/b": {"type": "string", "maxLength": 8}, "c~d": {"type": "string", "maxLength": 8}}),
+        json!([]),
+    );
+
+    let outcome = apply(&input, &["/a~1b", "/c~0d"], &[]);
+
+    assert!(outcome.schema["properties"].get("a/b").is_some());
+    assert!(outcome.schema["properties"].get("c~d").is_some());
+}
+
+#[test]
+fn a_type_outside_the_closed_subset_is_rejected() {
+    let input = root(json!({"score": {"type": "number"}}), json!(["score"]));
+
+    let error = narrow::apply_entries(&input, &selection(&["/score"]), &[])
+        .expect_err("`number` is outside the closed Version 1 subset");
+
+    assert!(format!("{error:#}").contains("number"));
+}
+
+#[test]
+fn a_resolution_outside_the_subset_range_is_rejected() {
+    let input = root(
+        json!({"records": {"type": "array", "items": {"type": "string", "maxLength": 8}}}),
+        json!([]),
+    );
+
+    let error = narrow::apply_entries(
+        &input,
+        &selection(&["/records/*"]),
+        &resolved(
+            "/records",
+            BoundKind::ArrayMaxItems,
+            BoundValues::MaxItems(1_000),
+        ),
+    )
+    .expect_err("a resolved maxItems above 256 is outside the subset");
+
+    assert!(format!("{error:#}").contains("256"));
+}
+
+#[test]
+fn a_resolution_that_matches_no_need_is_rejected() {
+    let input = root(
+        json!({"total": {"type": "integer", "minimum": 0, "maximum": 10}}),
+        json!(["total"]),
+    );
+
+    let error = narrow::apply_entries(
+        &input,
+        &selection(&["/total"]),
+        &resolved(
+            "/totl",
+            BoundKind::IntegerRange,
+            BoundValues::IntegerRange {
+                minimum: 0,
+                maximum: 10,
+            },
+        ),
+    )
+    .expect_err("a stray resolution is a visible failure");
+
+    assert!(format!("{error:#}").contains("/totl"));
+}
+
+#[test]
+fn an_empty_selection_is_rejected() {
+    let input = root(json!({"total": {"type": "integer", "const": 1}}), json!([]));
+
+    assert!(narrow::apply_entries(&input, &[], &[]).is_err());
+}
+
+#[test]
+fn the_map_entry_point_narrows_the_same_schema() {
+    let input = root(
+        json!({"total": {"type": "integer", "minimum": 0, "maximum": 10}}),
+        json!(["total"]),
+    );
+
+    let outcome = narrow::apply(&input, &selection(&["/total"]), &BTreeMap::new())
+        .expect("the map entry point delegates to the slice one");
+
+    assert_eq!(
+        outcome.schema["properties"]["total"],
+        json!({"type": "integer", "minimum": 0, "maximum": 10})
+    );
+}
diff --git a/crates/registry-evidencectl/tests/suggest_openapi.rs b/crates/registry-evidencectl/tests/suggest_openapi.rs
new file mode 100644
index 000000000..d5acecf33
--- /dev/null
+++ b/crates/registry-evidencectl/tests/suggest_openapi.rs
@@ -0,0 +1,624 @@
+//! Tests for the OpenAPI loading (`openapi.rs`) and schema flattening
+//! (`flatten.rs`) stages of `evidencectl source suggest`.
+//!
+//! `registry-evidencectl` ships only a binary target, so this integration
+//! test pulls the modules it needs in directly by path rather than through a
+//! library crate. `types` and `openapi`/`flatten` are declared as siblings
+//! here, mirroring their nesting under `src/suggest/`, so the `super::types`
+//! imports inside `openapi.rs` and `flatten.rs` resolve unchanged.
+
+// `openapi.rs` dispatches a file path or a URL through `fetch`; this binary
+// only ever opens files, so the fetching half of that module is unused here.
+#[allow(dead_code)]
+#[path = "../src/suggest/fetch.rs"]
+mod fetch;
+#[path = "../src/suggest/flatten.rs"]
+mod flatten;
+#[path = "../src/suggest/openapi.rs"]
+mod openapi;
+// `types.rs` is shared across every pipeline stage; this test binary only
+// exercises the openapi/flatten slice of it, so the rest looks unused to
+// this crate's own dead-code analysis even though the real `evidencectl`
+// binary uses all of it once every stage is wired together.
+#[allow(dead_code)]
+#[path = "../src/suggest/types.rs"]
+mod types;
+
+use std::path::{Path, PathBuf};
+
+use types::{OperationKey, ResolvedSchema, SpecSource};
+
+fn fixture(name: &str) -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("tests/fixtures/openapi")
+        .join(name)
+}
+
+/// Opens a fixture through the same entry point the CLI uses, naming it as a
+/// local file. Fetching over HTTP is covered in `suggest_fetch.rs`.
+fn load(path: &Path) -> anyhow::Result<openapi::Spec> {
+    openapi::Spec::open(&SpecSource::File(path.to_path_buf()))
+}
+
+fn operation(method: &str, path: &str) -> OperationKey {
+    OperationKey {
+        method: method.to_string(),
+        path: path.to_string(),
+    }
+}
+
+// --- Spec::open -----------------------------------------------------------
+
+#[test]
+fn load_accepts_openapi_3_0_yaml() {
+    let spec = load(&fixture("records-3.0.yaml")).expect("loads");
+    assert!(!spec.operations().is_empty());
+}
+
+#[test]
+fn load_accepts_openapi_3_1_json() {
+    let spec = load(&fixture("records-3.1.json")).expect("loads");
+    assert!(!spec.operations().is_empty());
+}
+
+#[test]
+fn load_rejects_unsupported_openapi_version() {
+    let error = load(&fixture("unsupported-version.yaml")).unwrap_err();
+    let message = format!("{error:#}");
+    assert!(
+        message.contains("3.0") || message.contains("3.1"),
+        "message was: {message}"
+    );
+}
+
+#[test]
+fn load_rejects_missing_file() {
+    let error = load(&fixture("does-not-exist.yaml")).unwrap_err();
+    let message = format!("{error:#}");
+    assert!(
+        message.contains("does-not-exist.yaml"),
+        "message was: {message}"
+    );
+}
+
+// --- Spec::operations --------------------------------------------------------
+
+/// The runtime's fixed-request method is an enumeration of GET and POST, so an
+/// operation on any other method is not offerable: the fixture's `DELETE
+/// /records` carries a JSON response and is still absent from the listing.
+#[test]
+fn operations_lists_only_the_methods_the_runtime_admits() {
+    let spec = load(&fixture("records-3.0.yaml")).expect("loads");
+    let mut keys: Vec<OperationKey> = spec
+        .operations()
+        .into_iter()
+        .map(|summary| summary.key)
+        .collect();
+    keys.sort_by(|a, b| (&a.path, &a.method).cmp(&(&b.path, &b.method)));
+    assert_eq!(
+        keys,
+        vec![operation("GET", "/records"), operation("POST", "/records")]
+    );
+}
+
+#[test]
+fn operations_reports_summary_and_json_responses() {
+    let spec = load(&fixture("records-3.0.yaml")).expect("loads");
+    let get_records = spec
+        .operations()
+        .into_iter()
+        .find(|summary| summary.key == operation("GET", "/records"))
+        .expect("GET /records present");
+    assert_eq!(get_records.summary.as_deref(), Some("Search records"));
+    assert_eq!(
+        get_records.json_responses,
+        vec![("200".to_string(), "application/json".to_string())]
+    );
+}
+
+#[test]
+fn operations_collects_every_json_response_status() {
+    let spec = load(&fixture("records-3.1.json")).expect("loads");
+    let get_record = spec
+        .operations()
+        .into_iter()
+        .find(|summary| summary.key == operation("GET", "/records/{id}"))
+        .expect("GET /records/{id} present");
+    let mut responses = get_record.json_responses;
+    responses.sort();
+    assert_eq!(
+        responses,
+        vec![
+            ("200".to_string(), "application/json".to_string()),
+            ("404".to_string(), "application/json".to_string()),
+        ]
+    );
+}
+
+// --- Spec::response_schema ---------------------------------------------------
+
+#[test]
+fn response_schema_inlines_local_refs_and_normalizes_nullable() {
+    let spec = load(&fixture("records-3.0.yaml")).expect("loads");
+    let resolved = spec
+        .response_schema(&operation("GET", "/records"), "200", "application/json")
+        .expect("resolves");
+
+    let rendered = resolved.schema.0.to_string();
+    assert!(
+        !rendered.contains("$ref"),
+        "refs should be fully inlined: {rendered}"
+    );
+
+    // Top-level `nullable: true` string becomes the 3.1 type pair.
+    assert_eq!(
+        resolved.schema.0["properties"]["recordedOn"]["type"],
+        serde_json::json!(["string", "null"])
+    );
+    assert!(resolved.schema.0["properties"]["recordedOn"]
+        .get("nullable")
+        .is_none());
+
+    // The $ref'd array item schema (Record) is inlined in place, and its own
+    // nested `nullable: true` (notes) is normalized too.
+    let record_item = &resolved.schema.0["properties"]["results"]["items"];
+    assert_eq!(
+        record_item["properties"]["trackingId"]["type"],
+        serde_json::json!("string")
+    );
+    assert_eq!(
+        record_item["properties"]["notes"]["type"],
+        serde_json::json!(["string", "null"])
+    );
+}
+
+#[test]
+fn response_schema_passes_through_3_1_type_arrays_unchanged() {
+    let spec = load(&fixture("records-3.1.json")).expect("loads");
+    let resolved = spec
+        .response_schema(
+            &operation("GET", "/records/{id}"),
+            "200",
+            "application/json",
+        )
+        .expect("resolves");
+    assert_eq!(
+        resolved.schema.0["properties"]["status"]["type"],
+        serde_json::json!(["string", "null"])
+    );
+}
+
+#[test]
+fn response_schema_rejects_external_ref() {
+    let spec = load(&fixture("external-ref.yaml")).expect("loads");
+    let error = spec
+        .response_schema(&operation("GET", "/records"), "200", "application/json")
+        .unwrap_err();
+    let message = format!("{error:#}");
+    assert!(
+        message.contains("external") || message.contains("remote"),
+        "message was: {message}"
+    );
+}
+
+/// A recursive `$ref` bounds how deep the response can be described, not
+/// whether the operation can be drafted from at all. The repeat is cut and
+/// named, and everything beside it stays selectable.
+#[test]
+fn response_schema_cuts_a_ref_cycle_and_notes_it() {
+    let spec = load(&fixture("ref-cycle.yaml")).expect("loads");
+    let resolved = spec
+        .response_schema(&operation("GET", "/records"), "200", "application/json")
+        .expect("resolves");
+    assert!(
+        resolved
+            .notes
+            .iter()
+            .any(|note| note.contains("cycle") && note.contains("#/components/schemas/A")),
+        "notes were: {:#?}",
+        resolved.notes
+    );
+
+    let (_, warnings) = flatten::candidate_leaves(&resolved.schema);
+    assert!(
+        warnings
+            .iter()
+            .any(|warning| warning.contains("/child/parent")
+                && warning.contains("#/components/schemas/A")),
+        "warnings were: {warnings:#?}"
+    );
+}
+
+#[test]
+fn a_recursive_schema_still_offers_its_non_recursive_leaves() {
+    let spec = load(&fixture("recursive-tree.yaml")).expect("loads");
+    let resolved = spec
+        .response_schema(&operation("GET", "/nodes"), "200", "application/json")
+        .expect("resolves");
+    let (leaves, _) = flatten::candidate_leaves(&resolved.schema);
+
+    // The repeat is cut where it first repeats, so the recursive branch offers
+    // nothing and the record's own scalars stay selectable.
+    let mut pointers: Vec<&str> = leaves.iter().map(|leaf| leaf.pointer.as_str()).collect();
+    pointers.sort();
+    assert_eq!(pointers, vec!["/id", "/label"]);
+}
+
+// --- dialect normalization ---------------------------------------------------
+
+/// A two-member `anyOf`/`oneOf` against `null` is how several generators spell
+/// the 3.1 nullable type pair. It states nothing the closed subset cannot
+/// already express, so it is rewritten into the pair rather than skipped as an
+/// unsupported union.
+#[test]
+fn a_two_member_union_against_null_becomes_the_nullable_type_pair() {
+    let spec = load(&fixture("nullable-unions.yaml")).expect("loads");
+    let resolved = spec
+        .response_schema(&operation("GET", "/records"), "200", "application/json")
+        .expect("resolves");
+    let properties = &resolved.schema.0["properties"];
+
+    assert_eq!(
+        properties["note"]["type"],
+        serde_json::json!(["string", "null"])
+    );
+    // The collapsed member's own bounds survive the rewrite.
+    assert_eq!(properties["note"]["maxLength"], serde_json::json!(64));
+    assert!(properties["note"].get("anyOf").is_none());
+
+    assert_eq!(
+        properties["count"]["type"],
+        serde_json::json!(["integer", "null"])
+    );
+    assert_eq!(properties["count"]["maximum"], serde_json::json!(99));
+    // A keyword on the union node itself is not lost when the union collapses.
+    assert_eq!(
+        properties["count"]["description"],
+        serde_json::json!("how many were seen")
+    );
+
+    // A nullable object keeps its members addressable.
+    assert_eq!(
+        properties["parent"]["type"],
+        serde_json::json!(["object", "null"])
+    );
+    assert_eq!(
+        properties["parent"]["properties"]["id"]["maxLength"],
+        serde_json::json!(36)
+    );
+}
+
+/// The subset admits the pair in one order only, so a document writing it the
+/// other way round describes something the subset can express and must not be
+/// refused over the spelling.
+#[test]
+fn a_null_first_type_pair_is_reordered() {
+    let spec = load(&fixture("nullable-unions.yaml")).expect("loads");
+    let resolved = spec
+        .response_schema(&operation("GET", "/records"), "200", "application/json")
+        .expect("resolves");
+    assert_eq!(
+        resolved.schema.0["properties"]["reversedPair"]["type"],
+        serde_json::json!(["string", "null"])
+    );
+}
+
+#[test]
+fn a_union_of_two_real_types_is_left_for_the_flattener_to_skip() {
+    let spec = load(&fixture("nullable-unions.yaml")).expect("loads");
+    let resolved = spec
+        .response_schema(&operation("GET", "/records"), "200", "application/json")
+        .expect("resolves");
+    assert!(resolved.schema.0["properties"]["either"]
+        .get("anyOf")
+        .is_some());
+
+    let (leaves, warnings) = flatten::candidate_leaves(&resolved.schema);
+    let mut pointers: Vec<&str> = leaves.iter().map(|leaf| leaf.pointer.as_str()).collect();
+    pointers.sort();
+    assert_eq!(
+        pointers,
+        vec!["/count", "/note", "/parent/id", "/reversedPair"]
+    );
+    assert!(
+        warnings.iter().any(|warning| warning.contains("/either")),
+        "warnings were: {warnings:#?}"
+    );
+}
+
+/// `properties` and `items` are meaningless on anything but an object and an
+/// array, so a node carrying one and no `type` is not ambiguous. Reading it is
+/// what lets the tool draft from the collection wrappers large registry APIs
+/// actually publish; the reading is announced rather than made silently.
+#[test]
+fn a_structural_keyword_without_a_type_is_read_as_that_type_and_noted() {
+    let spec = load(&fixture("implicit-types.yaml")).expect("loads");
+    let resolved = spec
+        .response_schema(&operation("GET", "/records"), "200", "application/json")
+        .expect("resolves");
+
+    assert_eq!(resolved.schema.0["type"], serde_json::json!("object"));
+    assert_eq!(
+        resolved.schema.0["properties"]["records"]["type"],
+        serde_json::json!("array")
+    );
+    assert_eq!(
+        resolved.schema.0["properties"]["records"]["items"]["type"],
+        serde_json::json!("object")
+    );
+    assert!(
+        resolved
+            .notes
+            .iter()
+            .any(|note| note.contains("(root)") && note.contains("object")),
+        "notes were: {:#?}",
+        resolved.notes
+    );
+    assert!(
+        resolved
+            .notes
+            .iter()
+            .any(|note| note.contains("/records") && note.contains("array")),
+        "notes were: {:#?}",
+        resolved.notes
+    );
+
+    let (leaves, _) = flatten::candidate_leaves(&resolved.schema);
+    let mut pointers: Vec<&str> = leaves.iter().map(|leaf| leaf.pointer.as_str()).collect();
+    pointers.sort();
+    assert_eq!(pointers, vec!["/pager/page", "/records/*/id"]);
+}
+
+#[test]
+fn a_node_with_neither_a_type_nor_a_structural_keyword_stays_untyped() {
+    let spec = load(&fixture("implicit-types.yaml")).expect("loads");
+    let resolved = spec
+        .response_schema(&operation("GET", "/opaque"), "200", "application/json")
+        .expect("resolves");
+    assert!(resolved.schema.0["properties"]["anything"]
+        .get("type")
+        .is_none());
+
+    let (leaves, warnings) = flatten::candidate_leaves(&resolved.schema);
+    let pointers: Vec<&str> = leaves.iter().map(|leaf| leaf.pointer.as_str()).collect();
+    assert_eq!(pointers, vec!["/known"]);
+    assert!(
+        warnings.iter().any(|warning| warning.contains("/anything")),
+        "warnings were: {warnings:#?}"
+    );
+}
+
+#[test]
+fn response_schema_rejects_unknown_status() {
+    let spec = load(&fixture("records-3.0.yaml")).expect("loads");
+    let error = spec
+        .response_schema(&operation("GET", "/records"), "500", "application/json")
+        .unwrap_err();
+    let message = format!("{error:#}");
+    assert!(message.contains("500"), "message was: {message}");
+}
+
+// --- Spec::servers / Spec::page_size_maximums --------------------------------
+
+#[test]
+fn servers_lists_declared_base_urls_in_order() {
+    let spec = load(&fixture("records-3.0.yaml")).expect("loads");
+    assert_eq!(
+        spec.servers(),
+        vec!["https://records.example.test/api".to_string()]
+    );
+}
+
+#[test]
+fn servers_is_empty_when_undeclared() {
+    let spec = load(&fixture("records-3.1.json")).expect("loads");
+    assert!(spec.servers().is_empty());
+}
+
+#[test]
+fn page_size_maximums_reads_matching_query_parameters() {
+    let spec = load(&fixture("records-3.0.yaml")).expect("loads");
+    let maximums = spec
+        .page_size_maximums(&operation("GET", "/records"))
+        .expect("no ref errors");
+    assert_eq!(maximums, vec![100]);
+}
+
+#[test]
+fn page_size_maximums_is_empty_without_matching_parameters() {
+    let spec = load(&fixture("records-3.0.yaml")).expect("loads");
+    let maximums = spec
+        .page_size_maximums(&operation("POST", "/records"))
+        .expect("no ref errors");
+    assert!(maximums.is_empty());
+}
+
+#[test]
+fn page_size_maximums_matches_limit_named_parameters() {
+    let spec = load(&fixture("records-3.1.json")).expect("loads");
+    let maximums = spec
+        .page_size_maximums(&operation("GET", "/records/{id}"))
+        .expect("no ref errors");
+    assert_eq!(maximums, vec![50]);
+}
+
+#[test]
+fn page_size_maximums_ignores_a_page_index_beside_a_page_size() {
+    let spec = load(&fixture("paging-parameters.yaml")).expect("loads");
+    let maximums = spec
+        .page_size_maximums(&operation("GET", "/records"))
+        .expect("no ref errors");
+    // `page` bounds how many pages exist, not how many items one carries.
+    // Reading its maximum as an item count would bound the array at 10000.
+    assert_eq!(maximums, vec![50]);
+}
+
+#[test]
+fn page_size_maximums_reads_every_genuine_size_parameter() {
+    let spec = load(&fixture("paging-parameters.yaml")).expect("loads");
+    let mut maximums = spec
+        .page_size_maximums(&operation("GET", "/events"))
+        .expect("no ref errors");
+    maximums.sort_unstable();
+    assert_eq!(maximums, vec![25, 200]);
+}
+
+#[test]
+fn page_size_maximums_ignores_names_that_only_contain_a_matching_word() {
+    let spec = load(&fixture("paging-parameters.yaml")).expect("loads");
+    let maximums = spec
+        .page_size_maximums(&operation("GET", "/reports"))
+        .expect("no ref errors");
+    assert!(
+        maximums.is_empty(),
+        "a byte ceiling and a rate-limit burst are not page sizes: {maximums:?}"
+    );
+}
+
+// --- flatten::candidate_leaves ------------------------------------------------
+
+#[test]
+fn candidate_leaves_flattens_arrays_and_nullable_records() {
+    let spec = load(&fixture("records-3.0.yaml")).expect("loads");
+    let resolved = spec
+        .response_schema(&operation("GET", "/records"), "200", "application/json")
+        .expect("resolves");
+    let (leaves, warnings) = flatten::candidate_leaves(&resolved.schema);
+    assert!(warnings.is_empty(), "unexpected warnings: {warnings:?}");
+
+    let mut pointers: Vec<&str> = leaves.iter().map(|leaf| leaf.pointer.as_str()).collect();
+    pointers.sort();
+    assert_eq!(
+        pointers,
+        vec![
+            "/recordedOn",
+            "/results/*/notes",
+            "/results/*/status",
+            "/results/*/trackingId",
+            "/total",
+        ]
+    );
+
+    let recorded_on = leaves
+        .iter()
+        .find(|leaf| leaf.pointer == "/recordedOn")
+        .expect("present");
+    assert_eq!(recorded_on.type_label, "string (date-time)");
+    assert!(recorded_on.nullable);
+
+    let notes = leaves
+        .iter()
+        .find(|leaf| leaf.pointer == "/results/*/notes")
+        .expect("present");
+    assert!(notes.nullable);
+
+    let total = leaves
+        .iter()
+        .find(|leaf| leaf.pointer == "/total")
+        .expect("present");
+    assert_eq!(total.type_label, "integer");
+    assert!(!total.nullable);
+}
+
+#[test]
+fn candidate_leaves_escapes_member_names_per_rfc_6901() {
+    let spec = load(&fixture("escaping.yaml")).expect("loads");
+    let resolved = spec
+        .response_schema(&operation("GET", "/records"), "200", "application/json")
+        .expect("resolves");
+    let (leaves, warnings) = flatten::candidate_leaves(&resolved.schema);
+    assert!(warnings.is_empty(), "unexpected warnings: {warnings:?}");
+
+    let mut pointers: Vec<&str> = leaves.iter().map(|leaf| leaf.pointer.as_str()).collect();
+    pointers.sort();
+    assert_eq!(pointers, vec!["/tags~1primary", "/tilde~0name"]);
+}
+
+#[test]
+fn candidate_leaves_skips_and_warns_on_unsupported_constructs() {
+    let spec = load(&fixture("unsupported-constructs.yaml")).expect("loads");
+    let resolved = spec
+        .response_schema(&operation("GET", "/records"), "200", "application/json")
+        .expect("resolves");
+    let (leaves, warnings) = flatten::candidate_leaves(&resolved.schema);
+
+    let mut pointers: Vec<&str> = leaves.iter().map(|leaf| leaf.pointer.as_str()).collect();
+    pointers.sort();
+    assert_eq!(pointers, vec!["/simpleAllOf", "/trackingId"]);
+
+    let simple_all_of = leaves
+        .iter()
+        .find(|leaf| leaf.pointer == "/simpleAllOf")
+        .expect("present");
+    assert_eq!(simple_all_of.type_label, "string (date)");
+
+    assert_eq!(warnings.len(), 5, "warnings: {warnings:#?}");
+    assert!(warnings
+        .iter()
+        .any(|warning| warning.contains("/choice") && warning.contains("oneOf")));
+    assert!(warnings
+        .iter()
+        .any(|warning| warning.contains("/wildcard") && warning.contains("additionalProperties")));
+    assert!(warnings
+        .iter()
+        .any(|warning| warning.contains("/missingItems") && warning.contains("items")));
+    assert!(warnings
+        .iter()
+        .any(|warning| warning.contains("/freeform") && warning.contains("properties")));
+    assert!(warnings
+        .iter()
+        .any(|warning| warning.contains("/multiType")));
+}
+
+#[test]
+fn candidate_leaves_truncates_at_depth_limit_and_warns() {
+    fn nested_object(remaining: usize) -> serde_json::Value {
+        if remaining == 0 {
+            serde_json::json!({"type": "string"})
+        } else {
+            serde_json::json!({
+                "type": "object",
+                "additionalProperties": false,
+                "properties": { "level": nested_object(remaining - 1) },
+            })
+        }
+    }
+
+    let schema = serde_json::json!({
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+            "shallow": {"type": "string"},
+            "deep": nested_object(20),
+        },
+    });
+    let resolved = ResolvedSchema(schema);
+    let (leaves, warnings) = flatten::candidate_leaves(&resolved);
+
+    let pointers: Vec<&str> = leaves.iter().map(|leaf| leaf.pointer.as_str()).collect();
+    assert_eq!(pointers, vec!["/shallow"]);
+    assert!(
+        warnings
+            .iter()
+            .any(|warning| warning.contains("16") && warning.contains("/deep")),
+        "warnings: {warnings:#?}"
+    );
+}
+
+/// The sampler refuses an oversized sample before reading it. The loader is
+/// held to the same rule, so a mistaken path is named as one rather than read
+/// into memory whole.
+#[test]
+fn an_oversized_document_is_refused_before_it_is_read() {
+    let temp = tempfile::tempdir().expect("tempdir");
+    let path = temp.path().join("huge.openapi.yaml");
+    let file = std::fs::File::create(&path).expect("create");
+    // Sparse where the filesystem supports it: the point is the declared
+    // length, not the bytes.
+    file.set_len(17 * 1024 * 1024).expect("set_len");
+    drop(file);
+
+    let error = load(&path).unwrap_err();
+    let message = format!("{error:#}");
+    assert!(message.contains("exceeding the"), "message was: {message}");
+}
diff --git a/crates/registry-evidencectl/tests/suggest_sample.rs b/crates/registry-evidencectl/tests/suggest_sample.rs
new file mode 100644
index 000000000..da36ef5d8
--- /dev/null
+++ b/crates/registry-evidencectl/tests/suggest_sample.rs
@@ -0,0 +1,310 @@
+//! Tests for the sample-observation stage of `evidencectl source suggest`.
+//!
+//! `registry-evidencectl` is a binary-only crate (no library target), so the
+//! module under test is pulled in directly by path rather than through
+//! normal `use registry_evidencectl::...` linkage. `types` is included the
+//! same way and declared as a sibling of `sample`, mirroring their real
+//! relationship as siblings under `suggest`: `sample.rs` reaches it through
+//! `super::types`, and `super` from a crate-root `mod sample;` here is this
+//! same crate root, where `mod types;` also lives.
+
+#[path = "../src/suggest/sample.rs"]
+mod sample;
+#[allow(dead_code)]
+#[path = "../src/suggest/types.rs"]
+mod types;
+
+use std::{fs, path::PathBuf};
+
+use sample::{load_sample, observe};
+use serde_json::json;
+use types::Observations;
+
+fn fixture(name: &str) -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("tests/fixtures/samples")
+        .join(name)
+}
+
+fn load_fixture(name: &str) -> serde_json::Value {
+    load_sample(&fixture(name)).unwrap_or_else(|error| panic!("failed to load {name}: {error:#}"))
+}
+
+// --- load_sample -----------------------------------------------------------
+
+#[test]
+fn load_sample_reads_a_valid_json_file() {
+    let value = load_fixture("nested-records.json");
+    assert_eq!(value["total"], json!(42));
+}
+
+#[test]
+fn load_sample_rejects_a_file_that_is_not_valid_json() {
+    let directory = tempfile::tempdir().expect("temp dir");
+    let path = directory.path().join("not-json.json");
+    fs::write(&path, b"{ this is not json").expect("write fixture");
+
+    let error = load_sample(&path).expect_err("invalid JSON must be rejected");
+    assert!(
+        error.to_string().contains("not valid JSON"),
+        "unexpected error: {error:#}"
+    );
+}
+
+#[test]
+fn load_sample_rejects_a_missing_file() {
+    let directory = tempfile::tempdir().expect("temp dir");
+    let path = directory.path().join("missing.json");
+
+    let error = load_sample(&path).expect_err("a missing file must be rejected");
+    assert!(
+        error
+            .to_string()
+            .contains("failed to read sample file metadata"),
+        "unexpected error: {error:#}"
+    );
+}
+
+#[test]
+fn load_sample_rejects_a_file_over_the_size_ceiling() {
+    let directory = tempfile::tempdir().expect("temp dir");
+    let path = directory.path().join("oversized.json");
+
+    // A single 4 MiB+1 array element keeps this a well-formed (if useless)
+    // JSON document while tripping the size ceiling before any parsing.
+    let mut contents = Vec::with_capacity(4 * 1024 * 1024 + 16);
+    contents.extend_from_slice(b"\"");
+    contents.resize(contents.len() + 4 * 1024 * 1024 + 1, b'Z');
+    contents.extend_from_slice(b"\"");
+    fs::write(&path, &contents).expect("write oversized fixture");
+
+    let error = load_sample(&path).expect_err("an oversized file must be rejected");
+    let message = error.to_string();
+    assert!(message.contains("exceeding"), "unexpected error: {message}");
+    // The ceiling is enforced from file metadata alone, before any read, so
+    // the fill content can never reach the error message; "ZZZZ" is a
+    // pattern a temp-directory path could not plausibly contain.
+    assert!(
+        !message.contains("ZZZZ"),
+        "error message must not echo sample content: {message}"
+    );
+}
+
+// --- observe: integers -------------------------------------------------------
+
+#[test]
+fn observe_tracks_integer_min_and_max_across_every_array_element() {
+    let sample = load_fixture("integer-range.json");
+    let selection = vec!["/records/*/priority".to_owned()];
+
+    let observations = observe(&sample, &selection).expect("observe");
+
+    let observed = observations
+        .by_pointer
+        .get("/records/*/priority")
+        .expect("priority observed");
+    assert_eq!(observed.min_integer, Some(-7));
+    assert_eq!(observed.max_integer, Some(12));
+    assert!(!observed.saw_null);
+    assert_eq!(observed.max_string_bytes, None);
+}
+
+// --- observe: strings, unicode ----------------------------------------------
+
+#[test]
+fn observe_measures_string_length_in_bytes_not_characters() {
+    let sample = load_fixture("unicode.json");
+    let selection = vec!["/status".to_owned(), "/note".to_owned()];
+
+    let observations = observe(&sample, &selection).expect("observe");
+
+    // "héllo" is 5 characters but 6 bytes: 'é' is a 2-byte UTF-8 sequence.
+    let status = observations
+        .by_pointer
+        .get("/status")
+        .expect("status observed");
+    assert_eq!("héllo".chars().count(), 5);
+    assert_eq!(status.max_string_bytes, Some(6));
+
+    // "日本語" is 3 characters but 9 bytes: each character is 3 UTF-8 bytes.
+    let note = observations.by_pointer.get("/note").expect("note observed");
+    assert_eq!("日本語".chars().count(), 3);
+    assert_eq!(note.max_string_bytes, Some(9));
+}
+
+// --- observe: arrays ---------------------------------------------------------
+
+#[test]
+fn observe_records_max_array_items_for_the_wildcard_array_itself() {
+    let sample = load_fixture("nested-records.json");
+    let selection = vec!["/results/*/trackingId".to_owned()];
+
+    let observations = observe(&sample, &selection).expect("observe");
+
+    let results = observations
+        .by_pointer
+        .get("/results")
+        .expect("results array observed");
+    assert_eq!(results.max_array_items, Some(2));
+
+    let tracking_id = observations
+        .by_pointer
+        .get("/results/*/trackingId")
+        .expect("trackingId observed");
+    assert_eq!(
+        tracking_id.max_string_bytes,
+        Some("def-456-longer".len() as u64)
+    );
+}
+
+#[test]
+fn observe_records_max_array_items_for_an_array_selected_wholesale_under_a_wildcard() {
+    let sample = load_fixture("nested-records.json");
+    // `tags` is itself an array within each record; it is selected without a
+    // further `*`, exercising the "array selected wholesale" case nested
+    // under an outer wildcard.
+    let selection = vec!["/results/*/tags".to_owned()];
+
+    let observations = observe(&sample, &selection).expect("observe");
+
+    let tags = observations
+        .by_pointer
+        .get("/results/*/tags")
+        .expect("tags observed");
+    // Record one carries 3 tags, record two carries 1: the largest is kept.
+    assert_eq!(tags.max_array_items, Some(3));
+}
+
+#[test]
+fn observe_records_a_top_level_array_selected_wholesale() {
+    let sample = load_fixture("nested-records.json");
+    let selection = vec!["/results".to_owned()];
+
+    let observations = observe(&sample, &selection).expect("observe");
+
+    let results = observations
+        .by_pointer
+        .get("/results")
+        .expect("results observed");
+    assert_eq!(results.max_array_items, Some(2));
+}
+
+// --- observe: nulls and absence ---------------------------------------------
+
+#[test]
+fn observe_flags_an_explicit_null_without_recording_a_length() {
+    let sample = load_fixture("nulls-and-absent.json");
+    let selection = vec!["/recordedOn".to_owned(), "/status".to_owned()];
+
+    let observations = observe(&sample, &selection).expect("observe");
+
+    let recorded_on = observations
+        .by_pointer
+        .get("/recordedOn")
+        .expect("recordedOn observed");
+    assert!(recorded_on.saw_null);
+    assert_eq!(recorded_on.max_string_bytes, None);
+
+    let status = observations
+        .by_pointer
+        .get("/status")
+        .expect("status observed");
+    assert!(!status.saw_null);
+    assert_eq!(status.max_string_bytes, Some("active".len() as u64));
+}
+
+#[test]
+fn observe_leaves_an_absent_pointer_unobserved_without_error() {
+    let sample = load_fixture("nulls-and-absent.json");
+    let selection = vec!["/doesNotExist".to_owned()];
+
+    let observations = observe(&sample, &selection).expect("an absent pointer is not an error");
+
+    assert!(!observations.by_pointer.contains_key("/doesNotExist"));
+    assert!(observations.by_pointer.is_empty());
+}
+
+#[test]
+fn observe_leaves_a_wildcard_on_a_non_array_unobserved_without_error() {
+    let sample = load_fixture("nulls-and-absent.json");
+    // `status` is a string, not an array: the `*` segment cannot land.
+    let selection = vec!["/status/*/child".to_owned()];
+
+    let observations = observe(&sample, &selection).expect("a type mismatch is not an error");
+
+    assert!(observations.by_pointer.is_empty());
+}
+
+#[test]
+fn observe_leaves_a_key_lookup_on_a_non_object_unobserved_without_error() {
+    let sample = load_fixture("nulls-and-absent.json");
+    // `status` is a string, not an object: it has no `child` member.
+    let selection = vec!["/status/child".to_owned()];
+
+    let observations = observe(&sample, &selection).expect("a type mismatch is not an error");
+
+    assert!(observations.by_pointer.is_empty());
+}
+
+// --- observe: pointer escaping -----------------------------------------------
+
+#[test]
+fn observe_unescapes_tilde_one_and_tilde_zero_segments() {
+    let sample = load_fixture("escaping.json");
+    // "~1" decodes to "/", so "/a~1b" reaches the key "a/b".
+    // "~0" decodes to "~", so "/a~0b" reaches the key "a~b".
+    let selection = vec!["/a~1b".to_owned(), "/a~0b".to_owned()];
+
+    let observations = observe(&sample, &selection).expect("observe");
+
+    let slash_key = observations.by_pointer.get("/a~1b").expect("a/b observed");
+    assert_eq!(slash_key.max_string_bytes, Some("slash-key".len() as u64));
+
+    let tilde_key = observations.by_pointer.get("/a~0b").expect("a~b observed");
+    assert_eq!(tilde_key.max_string_bytes, Some("tilde-key".len() as u64));
+}
+
+// --- observe: malformed pointer syntax --------------------------------------
+
+#[test]
+fn observe_rejects_a_pointer_missing_its_leading_slash() {
+    let sample = json!({ "status": "open" });
+    let selection = vec!["status".to_owned()];
+
+    let error =
+        observe(&sample, &selection).expect_err("a pointer without a leading slash is malformed");
+    assert!(error
+        .to_string()
+        .contains("must be a non-empty extended JSON Pointer"));
+}
+
+#[test]
+fn observe_rejects_an_empty_pointer() {
+    let sample = json!({ "status": "open" });
+    let selection = vec![String::new()];
+
+    let error = observe(&sample, &selection).expect_err("an empty pointer is malformed");
+    assert!(error
+        .to_string()
+        .contains("must be a non-empty extended JSON Pointer"));
+}
+
+// --- privacy: no sample string value survives into Observations ------------
+
+#[test]
+fn observe_never_carries_a_sample_string_value_into_its_debug_rendering() {
+    let sample = load_fixture("canary.json");
+    let canary = sample["status"].as_str().expect("canary value").to_owned();
+    let selection = vec!["/status".to_owned()];
+
+    let observations: Observations = observe(&sample, &selection).expect("observe");
+
+    let rendered = format!("{observations:?}");
+    assert!(
+        !rendered.contains(&canary),
+        "Debug rendering of Observations must never contain a sample string value: {rendered}"
+    );
+    // The pointer and the derived length are expected to appear; only the
+    // value itself must be absent.
+    assert!(rendered.contains("/status"));
+}
diff --git a/crates/registry-evidencectl/tests/support/production_handoff_https.py b/crates/registry-evidencectl/tests/support/production_handoff_https.py
new file mode 100644
index 000000000..3c4a9320e
--- /dev/null
+++ b/crates/registry-evidencectl/tests/support/production_handoff_https.py
@@ -0,0 +1,111 @@
+"""Silent local HTTPS issuer and sanitized Evidence source for acceptance tests."""
+
+import http.client
+import http.server
+import json
+import os
+import pathlib
+import ssl
+
+
+class Handler(http.server.BaseHTTPRequestHandler):
+    server_version = "EvidenceAcceptance/1"
+
+    def log_message(self, _format, *_args):
+        pass
+
+    def do_GET(self):
+        if self.path == "/.well-known/jwks.json":
+            self._json(pathlib.Path(os.environ["ACCEPTANCE_JWKS"]).read_bytes())
+            return
+        self.send_error(404)
+
+    def do_POST(self):
+        if self.path == "/token" and os.environ.get("ACCEPTANCE_MINT_PORT"):
+            self._proxy_mint_token()
+            return
+        if self.path != "/v1/facts":
+            self.send_error(404)
+            return
+        expected = "Bearer " + pathlib.Path(
+            os.environ["ACCEPTANCE_SOURCE_TOKEN"]
+        ).read_text().strip()
+        if self.headers.get("Authorization") != expected:
+            self.send_error(401)
+            return
+        try:
+            length = int(self.headers.get("Content-Length", "0"))
+            request = json.loads(self.rfile.read(length))
+        except (ValueError, json.JSONDecodeError):
+            self.send_error(400)
+            return
+        if request != {
+            "lookup": {"person_id": "synthetic-person-001"},
+            "fields": ["date_of_birth"],
+            "limit": 2,
+        }:
+            self.send_error(400)
+            return
+        pathlib.Path(os.environ["ACCEPTANCE_SOURCE_MARKER"]).write_text("requested\n")
+        self._json(b'{"total":1,"date_of_birth":"2000-01-01"}')
+
+    def _proxy_mint_token(self):
+        try:
+            length = int(self.headers.get("Content-Length", "0"))
+        except ValueError:
+            self.send_error(400)
+            return
+        if length <= 0 or length > 65536:
+            self.send_error(413)
+            return
+        body = self.rfile.read(length)
+        upstream = http.client.HTTPConnection(
+            "127.0.0.1", int(os.environ["ACCEPTANCE_MINT_PORT"]), timeout=5
+        )
+        try:
+            upstream.request(
+                "POST",
+                "/token",
+                body=body,
+                headers={"Content-Type": "application/x-www-form-urlencoded"},
+            )
+            response = upstream.getresponse()
+            response_body = response.read(1048577)
+            if len(response_body) > 1048576:
+                self.send_error(502)
+                return
+            self.send_response(response.status)
+            self.send_header(
+                "Content-Type", response.getheader("Content-Type", "application/json")
+            )
+            self.send_header("Content-Length", str(len(response_body)))
+            self.send_header("Connection", "close")
+            self.end_headers()
+            self.wfile.write(response_body)
+        except (OSError, http.client.HTTPException):
+            self.send_error(502)
+        finally:
+            upstream.close()
+
+    def _json(self, body):
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.send_header("Connection", "close")
+        self.end_headers()
+        self.wfile.write(body)
+
+
+address = ("127.0.0.1", int(os.environ["ACCEPTANCE_HTTPS_PORT"]))
+server = http.server.ThreadingHTTPServer(address, Handler)
+context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+# The stand-in sets its own floor rather than inheriting whatever the runtime
+# happens to allow, so the handoff is proven over the transport a deployment
+# would actually run.
+context.minimum_version = ssl.TLSVersion.TLSv1_2
+context.load_cert_chain(
+    os.environ["ACCEPTANCE_TLS_CERT"], os.environ["ACCEPTANCE_TLS_KEY"]
+)
+server.socket = context.wrap_socket(server.socket, server_side=True)
+pathlib.Path(os.environ["ACCEPTANCE_READY"]).write_text("ready\n")
+server.serve_forever()
diff --git a/crates/registry-language-server/src/index.rs b/crates/registry-language-server/src/index.rs
index 633ec522d..b36044b0d 100644
--- a/crates/registry-language-server/src/index.rs
+++ b/crates/registry-language-server/src/index.rs
@@ -20,8 +20,6 @@ pub enum RegistrySymbolKind {
     Entity,
     Service,
     Consultation,
-    Claim,
-    CredentialProfile,
     Fixture,
     Environment,
 }
@@ -34,8 +32,6 @@ impl RegistrySymbolKind {
             Self::Entity => "entity",
             Self::Service => "service",
             Self::Consultation => "consultation",
-            Self::Claim => "claim",
-            Self::CredentialProfile => "credential profile",
             Self::Fixture => "fixture",
             Self::Environment => "environment",
         }
@@ -47,8 +43,6 @@ impl RegistrySymbolKind {
             Self::Integration | Self::Entity => SymbolKind::MODULE,
             Self::Service => SymbolKind::INTERFACE,
             Self::Consultation => SymbolKind::FUNCTION,
-            Self::Claim => SymbolKind::PROPERTY,
-            Self::CredentialProfile => SymbolKind::OBJECT,
             Self::Fixture => SymbolKind::EVENT,
             Self::Environment => SymbolKind::PACKAGE,
         }
@@ -119,14 +113,6 @@ impl SymbolQuery {
             name: name.into(),
         }
     }
-
-    fn scoped(kind: RegistrySymbolKind, scope: impl Into<String>, name: impl Into<String>) -> Self {
-        Self {
-            kind,
-            scope: Some(scope.into()),
-            name: name.into(),
-        }
-    }
 }
 
 #[derive(Clone, Debug, Eq, PartialEq)]
@@ -695,68 +681,6 @@ impl IndexBuilder<'_> {
                     }
                 }
             }
-
-            if let Some(claims) = service.value.get("claims").and_then(YamlValue::as_mapping) {
-                for claim in claims {
-                    self.add_resolvable_symbol(
-                        SymbolKey::scoped(
-                            RegistrySymbolKind::Claim,
-                            &service_name,
-                            &claim.key.value,
-                        ),
-                        Some(service_name.clone()),
-                        path,
-                        claim.key.range,
-                    );
-                    if let Some(output) = claim.value.get_scalar("output") {
-                        if let Some((consultation, _)) = output.value.split_once('.') {
-                            self.add_reference(
-                                SymbolQuery::scoped(
-                                    RegistrySymbolKind::Consultation,
-                                    &service_name,
-                                    consultation,
-                                ),
-                                path,
-                                scalar_prefix_range(output, consultation),
-                            );
-                        }
-                    }
-                }
-            }
-
-            if let Some(profiles) = service
-                .value
-                .get("credential_profiles")
-                .and_then(YamlValue::as_mapping)
-            {
-                for profile in profiles {
-                    self.add_resolvable_symbol(
-                        SymbolKey::scoped(
-                            RegistrySymbolKind::CredentialProfile,
-                            &service_name,
-                            &profile.key.value,
-                        ),
-                        Some(service_name.clone()),
-                        path,
-                        profile.key.range,
-                    );
-                    if let Some(claims) =
-                        profile.value.get("claims").and_then(YamlValue::as_sequence)
-                    {
-                        for claim in claims.iter().filter_map(YamlValue::as_scalar) {
-                            self.add_reference(
-                                SymbolQuery::scoped(
-                                    RegistrySymbolKind::Claim,
-                                    &service_name,
-                                    &claim.value,
-                                ),
-                                path,
-                                claim.range,
-                            );
-                        }
-                    }
-                }
-            }
         }
     }
 
@@ -843,19 +767,6 @@ impl IndexBuilder<'_> {
                 name.range,
             );
         }
-        if let Some(claims) = document
-            .get("expect")
-            .and_then(|expect| expect.get("claims"))
-            .and_then(YamlValue::as_mapping)
-        {
-            for claim in claims {
-                self.add_reference(
-                    SymbolQuery::global(RegistrySymbolKind::Claim, &claim.key.value),
-                    path,
-                    claim.key.range,
-                );
-            }
-        }
     }
 
     fn extract_environment(&mut self, path: &Path, relative: &Path, document: &YamlValue) {
@@ -952,6 +863,7 @@ struct YamlPair {
 enum YamlValue {
     Scalar(YamlScalar),
     Mapping(Vec<YamlPair>),
+    #[allow(dead_code)]
     Sequence(Vec<YamlValue>),
     Other,
 }
@@ -964,6 +876,7 @@ impl YamlValue {
         }
     }
 
+    #[allow(dead_code)]
     fn as_sequence(&self) -> Option<&[YamlValue]> {
         match self {
             Self::Sequence(entries) => Some(entries),
@@ -1094,12 +1007,6 @@ fn scalar_from_node(
     })
 }
 
-fn scalar_prefix_range(scalar: &YamlScalar, prefix: &str) -> Range {
-    let mut end = scalar.range.start;
-    end.character += prefix.encode_utf16().count() as u32;
-    Range::new(scalar.range.start, end)
-}
-
 fn meaningful_named_children(node: Node<'_>) -> Vec<Node<'_>> {
     let mut cursor = node.walk();
     node.named_children(&mut cursor)
@@ -1281,13 +1188,9 @@ entities:
   residents: { file: entities/residents.yaml }
 services:
   person-check:
-    kind: evidence
+    kind: consultation_api
     consultations:
       person_record: { integration: people }
-    claims:
-      active: { output: person_record.active, disclosure: predicate }
-    credential_profiles:
-      person-status: { claims: [active] }
   records:
     kind: records_api
     entity: residents
@@ -1311,7 +1214,7 @@ services:
         write(
             temp.path(),
             "integrations/people/fixtures/active.yaml",
-            "name: active-person\nexpect: { claims: { active: true } }\n",
+            "name: active-person\n",
         );
         temp
     }
@@ -1332,28 +1235,18 @@ services:
                 && symbol.name == "residents"
                 && symbol.location.path.ends_with("residents.yaml")
         }));
+        assert!(index.symbols().iter().any(|symbol| {
+            symbol.kind == RegistrySymbolKind::Consultation && symbol.name == "person_record"
+        }));
 
         let manifest = temp.path().join(PROJECT_FILE);
         let locations = index.definitions_at(&manifest, Position::new(10, 38));
         assert_eq!(locations.len(), 1);
         assert!(locations[0].path.ends_with("integration.yaml"));
-
-        let fixture = temp.path().join("integrations/people/fixtures/active.yaml");
-        let claim_locations = index.definitions_at(&fixture, Position::new(1, 21));
-        assert_eq!(claim_locations.len(), 1);
-        assert_eq!(claim_locations[0].path, normalize_lookup_path(&manifest));
-
-        let consultation_locations = index.definitions_at(&manifest, Position::new(12, 28));
-        assert_eq!(consultation_locations.len(), 1);
-        assert_eq!(
-            consultation_locations[0].path,
-            normalize_lookup_path(&manifest)
-        );
-        assert_eq!(consultation_locations[0].range.start, Position::new(10, 6));
     }
 
     #[test]
-    fn reports_missing_duplicate_and_ambiguous_references() {
+    fn reports_missing_and_duplicate_references() {
         let temp = fixture_project();
         write(
             temp.path(),
@@ -1366,22 +1259,9 @@ services:
   first:
     consultations:
       lookup: { integration: missing }
-    claims:
-      shared: { cel: true }
-      shared: { cel: false }
-      broken: { output: absent.value }
-    credential_profiles:
-      broken: { claims: [absent-claim] }
-  second:
-    claims:
-      shared: { cel: true }
+      lookup: { integration: people }
 "#,
         );
-        write(
-            temp.path(),
-            "integrations/people/fixtures/active.yaml",
-            "name: active-person\nexpect: { claims: { shared: true, absent-fixture-claim: true } }\n",
-        );
         let index = ProjectIndex::load(temp.path()).unwrap();
         let messages = index
             .diagnostics()
@@ -1394,19 +1274,7 @@ services:
             .any(|message| message.contains("Unknown integration")));
         assert!(messages
             .iter()
-            .any(|message| message.contains("Duplicate claim")));
-        assert!(messages
-            .iter()
-            .any(|message| message.contains("Ambiguous claim")));
-        assert!(messages
-            .iter()
-            .any(|message| message.contains("Unknown consultation")));
-        assert!(messages
-            .iter()
-            .any(|message| message.contains("Unknown claim reference 'absent-claim'")));
-        assert!(messages
-            .iter()
-            .any(|message| message.contains("Unknown claim reference 'absent-fixture-claim'")));
+            .any(|message| message.contains("Duplicate consultation")));
     }
 
     #[test]
@@ -1581,7 +1449,7 @@ services:
             (RegistrySymbolKind::Registry, "fictional-citizen-registry"),
             (RegistrySymbolKind::Integration, "person-record"),
             (RegistrySymbolKind::Service, "person-verification"),
-            (RegistrySymbolKind::Claim, "person-active"),
+            (RegistrySymbolKind::Consultation, "person_record"),
             (RegistrySymbolKind::Fixture, "active-person"),
             (RegistrySymbolKind::Environment, "local"),
         ] {
@@ -1595,6 +1463,33 @@ services:
         }
     }
 
+    #[test]
+    fn retired_notary_authoring_fields_are_not_indexed() {
+        let temp = TempDir::new().unwrap();
+        write(
+            temp.path(),
+            PROJECT_FILE,
+            r#"version: 1
+registry: { id: demo }
+services:
+  retired:
+    claims:
+      active: { cel: true }
+    credential_profiles:
+      status: { claims: [active] }
+"#,
+        );
+
+        let index = ProjectIndex::load(temp.path()).unwrap();
+        assert!(
+            index
+                .symbols()
+                .iter()
+                .all(|symbol| symbol.name != "active" && symbol.name != "status"),
+            "retired Notary authoring fields must not remain in the current editor surface"
+        );
+    }
+
     #[test]
     fn maintained_authoring_catalog_workspaces_have_no_reference_diagnostics() {
         let repository_root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
diff --git a/crates/registry-language-server/tests/protocol.rs b/crates/registry-language-server/tests/protocol.rs
index 170b8fc04..4e594041b 100644
--- a/crates/registry-language-server/tests/protocol.rs
+++ b/crates/registry-language-server/tests/protocol.rs
@@ -21,12 +21,9 @@ integrations:
   people: { file: integrations/people/integration.yaml }
 services:
   check:
+    kind: consultation_api
     consultations:
       lookup: { integration: people }
-    claims:
-      active: { output: lookup.active }
-    credential_profiles:
-      status: { claims: [active, missing] }
 "#,
     )
     .unwrap();
@@ -162,7 +159,7 @@ fn serves_definition_references_and_workspace_symbols_over_stdio() {
             "result": null
         }),
     );
-    let mut published_missing_reference = false;
+    let mut published_manifest_diagnostics = false;
     for _ in 0..3 {
         let notification = receive(&mut stdout);
         if notification.get("method").and_then(Value::as_str)
@@ -170,22 +167,13 @@ fn serves_definition_references_and_workspace_symbols_over_stdio() {
             && notification.pointer("/params/uri").and_then(Value::as_str)
                 == Some(manifest_uri.as_str())
         {
-            published_missing_reference = notification
+            published_manifest_diagnostics = notification
                 .pointer("/params/diagnostics")
                 .and_then(Value::as_array)
-                .is_some_and(|diagnostics| {
-                    diagnostics.iter().any(|diagnostic| {
-                        diagnostic
-                            .get("message")
-                            .and_then(Value::as_str)
-                            .is_some_and(|message| {
-                                message.contains("Unknown claim reference 'missing'")
-                            })
-                    })
-                });
+                .is_some_and(Vec::is_empty);
         }
     }
-    assert!(published_missing_reference);
+    assert!(published_manifest_diagnostics);
 
     send(
         &mut stdin,
@@ -195,7 +183,7 @@ fn serves_definition_references_and_workspace_symbols_over_stdio() {
             "method": "textDocument/definition",
             "params": {
                 "textDocument": { "uri": manifest_uri },
-                "position": { "line": 7, "character": 31 }
+                "position": { "line": 8, "character": 31 }
             }
         }),
     );
@@ -233,13 +221,13 @@ fn serves_definition_references_and_workspace_symbols_over_stdio() {
             "jsonrpc": "2.0",
             "id": 4,
             "method": "workspace/symbol",
-            "params": { "query": "active" }
+            "params": { "query": "lookup" }
         }),
     );
     let symbols = receive_response(&mut stdout, 4);
     assert_eq!(
         symbols.pointer("/result/0/name").and_then(Value::as_str),
-        Some("active")
+        Some("lookup")
     );
 
     let changed_manifest = fs::read_to_string(&manifest_path)
diff --git a/crates/registry-manifest-cli/tests/cli.rs b/crates/registry-manifest-cli/tests/cli.rs
index 2672ffde2..8af7c31c1 100644
--- a/crates/registry-manifest-cli/tests/cli.rs
+++ b/crates/registry-manifest-cli/tests/cli.rs
@@ -204,28 +204,25 @@ fn validate_prints_source_digest_and_rejects_runtime_only_keys() {
     let stdout = String::from_utf8(output.stdout).expect("stdout utf8");
     assert!(stdout.contains("source_manifest_digest: sha256:"));
 
-    let federation = dir.join("federation.yaml");
+    let endpoints = dir.join("endpoints.yaml");
     write_minimal_manifest(
-        &federation,
+        &endpoints,
         r#"
-federation:
-  node_id: did:web:registry.example.test
-  issuer: https://registry.example.test
-  jwks_uri: https://registry.example.test/.well-known/jwks.json
-  federation_api: https://registry.example.test/federation
-  supported_protocol_versions:
-    - registry-notary-federation/v0.1
+data_services:
+  - id: person_api
+    title: Person API
+    endpoint_url: https://registry.example.test/v1/person
 datasets: []
 "#,
     );
     let output = Command::new(bin())
         .arg("validate")
-        .arg(&federation)
+        .arg(&endpoints)
         .output()
         .expect("run cli");
     assert!(
         output.status.success(),
-        "federation jwks_uri should be source metadata, stderr: {}",
+        "a declared endpoint URL should be source metadata, stderr: {}",
         String::from_utf8_lossy(&output.stderr)
     );
 
diff --git a/crates/registry-manifest-core/src/lib.rs b/crates/registry-manifest-core/src/lib.rs
index 3ed071cb4..c297bfae8 100644
--- a/crates/registry-manifest-core/src/lib.rs
+++ b/crates/registry-manifest-core/src/lib.rs
@@ -19,7 +19,8 @@ const JSON_SCHEMA_DRAFT_2020_12: &str = "https://json-schema.org/draft/2020-12/s
 const EU_DATA_THEME_SCHEME: &str = "http://publications.europa.eu/resource/authority/data-theme";
 const EUROVOC_THEME_SCHEME: &str = "http://eurovoc.europa.eu/100141";
 const EU_LOCATION_IRI: &str = "http://publications.europa.eu/resource/authority/country/EUR";
-const REGISTRY_NOTARY_FEDERATION_PROTOCOL: &str = "registry-notary-federation/v0.1";
+/// The single evidence-offering access kind this layer validates in depth.
+pub const REGISTRY_EVIDENCE_ACCESS_KIND: &str = "registry-evidence";
 const CATALOG_SCHEMA_VERSION: &str = "registry-manifest-catalog/v1";
 const EVIDENCE_OFFERINGS_SCHEMA_VERSION: &str = "registry-manifest-evidence-offerings/v1";
 const EVIDENCE_OFFERING_SCHEMA_VERSION: &str = "registry-manifest-evidence-offering/v1";
@@ -368,8 +369,6 @@ pub struct MetadataManifest {
     pub vocabularies: BTreeMap<String, String>,
     #[serde(default)]
     pub profiles: Vec<ProfileClaim>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub federation: Option<FederationManifest>,
     #[serde(default)]
     pub evaluation_profiles: Vec<EvaluationProfileManifest>,
     #[serde(default)]
@@ -433,8 +432,6 @@ struct MetadataManifestFields {
     #[serde(default)]
     profiles: Vec<ProfileClaim>,
     #[serde(default)]
-    federation: Option<FederationManifest>,
-    #[serde(default)]
     evaluation_profiles: Vec<EvaluationProfileManifest>,
     #[serde(default)]
     ecosystem_bindings: Vec<EcosystemBindingManifest>,
@@ -463,7 +460,6 @@ impl From<MetadataManifestFields> for MetadataManifest {
             catalog: fields.catalog,
             vocabularies: fields.vocabularies,
             profiles: fields.profiles,
-            federation: fields.federation,
             evaluation_profiles: fields.evaluation_profiles,
             ecosystem_bindings: fields.ecosystem_bindings,
             requirements: fields.requirements,
@@ -548,17 +544,6 @@ pub struct ProfileClaim {
     pub version: String,
 }
 
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
-#[serde(deny_unknown_fields)]
-pub struct FederationManifest {
-    pub node_id: String,
-    pub issuer: String,
-    pub jwks_uri: String,
-    pub federation_api: String,
-    #[serde(default)]
-    pub supported_protocol_versions: Vec<String>,
-}
-
 #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(deny_unknown_fields)]
 pub struct EvaluationProfileManifest {
@@ -1261,8 +1246,6 @@ pub struct CompiledMetadataInner {
     pub datasets: BTreeMap<String, CompiledDataset>,
     pub codelists: BTreeMap<String, CompiledCodelist>,
     pub profiles: Vec<ProfileClaim>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub federation: Option<FederationManifest>,
     pub evaluation_profiles: Vec<EvaluationProfileManifest>,
     pub ecosystem_bindings: Vec<EcosystemBindingManifest>,
 }
@@ -1692,10 +1675,6 @@ impl CompiledMetadata {
         &self.inner.profiles
     }
 
-    pub fn federation(&self) -> Option<&FederationManifest> {
-        self.inner.federation.as_ref()
-    }
-
     pub fn evaluation_profiles(&self) -> &[EvaluationProfileManifest] {
         &self.inner.evaluation_profiles
     }
@@ -1785,7 +1764,6 @@ impl CompiledMetadata {
                 datasets,
                 codelists,
                 profiles: self.inner.profiles.clone(),
-                federation: self.inner.federation.clone(),
                 evaluation_profiles: self.inner.evaluation_profiles.clone(),
                 ecosystem_bindings: self.inner.ecosystem_bindings.clone(),
             }),
@@ -1816,87 +1794,6 @@ impl ValidationError {
     }
 }
 
-fn validate_federation(federation: Option<&FederationManifest>, errors: &mut Vec<ValidationError>) {
-    let Some(federation) = federation else {
-        return;
-    };
-
-    validate_non_empty(&federation.node_id, "federation.node_id", errors);
-    validate_https_url(&federation.issuer, "federation.issuer", errors);
-    validate_https_url(&federation.jwks_uri, "federation.jwks_uri", errors);
-    validate_https_url(
-        &federation.federation_api,
-        "federation.federation_api",
-        errors,
-    );
-    if let Some(issuer_host) = https_url_host(&federation.issuer) {
-        validate_federation_endpoint_host(
-            &federation.jwks_uri,
-            "federation.jwks_uri",
-            &issuer_host,
-            errors,
-        );
-        validate_federation_endpoint_host(
-            &federation.federation_api,
-            "federation.federation_api",
-            &issuer_host,
-            errors,
-        );
-    }
-    if !federation
-        .supported_protocol_versions
-        .iter()
-        .any(|version| version == REGISTRY_NOTARY_FEDERATION_PROTOCOL)
-    {
-        errors.push(ValidationError::new(
-            "federation.supported_protocol_versions",
-            format!(
-                "supported protocol versions must include {REGISTRY_NOTARY_FEDERATION_PROTOCOL}"
-            ),
-        ));
-    }
-    for (index, version) in federation.supported_protocol_versions.iter().enumerate() {
-        validate_non_empty(
-            version,
-            format!("federation.supported_protocol_versions[{index}]"),
-            errors,
-        );
-    }
-
-    match did_web_host(&federation.node_id) {
-        Some(did_web_host) => {
-            if url_host(&federation.issuer)
-                .is_some_and(|issuer_host| !did_web_host.eq_ignore_ascii_case(issuer_host.as_str()))
-            {
-                errors.push(ValidationError::new(
-                    "federation.node_id",
-                    "DID:web node id must bind to federation issuer host",
-                ));
-            }
-        }
-        None => errors.push(ValidationError::new(
-            "federation.node_id",
-            "federation node id must be a did:web identifier",
-        )),
-    }
-}
-
-fn validate_federation_endpoint_host(
-    value: &str,
-    path: impl Into<String>,
-    issuer_host: &str,
-    errors: &mut Vec<ValidationError>,
-) {
-    if let Some(endpoint_host) = https_url_host(value) {
-        if !issuer_host.eq_ignore_ascii_case(&endpoint_host) {
-            errors.push(ValidationError::new(
-                path,
-                "federation endpoint host must bind to federation issuer host",
-            ));
-        }
-    }
-}
-
 fn validate_evaluation_profiles<'a>(
     manifest: &'a MetadataManifest,
     errors: &mut Vec<ValidationError>,
@@ -2538,7 +2435,6 @@ pub fn validate_manifest(manifest: &MetadataManifest) -> Result<(), MetadataErro
         }
     }
 
-    validate_federation(manifest.federation.as_ref(), &mut errors);
     let evaluation_profile_rulesets = validate_evaluation_profiles(manifest, &mut errors);
     validate_ecosystem_bindings(manifest, &mut errors);
     let requirement_ids = validate_requirements(manifest, &mut errors);
@@ -2581,20 +2477,6 @@ pub fn validate_manifest(manifest: &MetadataManifest) -> Result<(), MetadataErro
         }
     }
 
-    if manifest.federation.is_none()
-        && manifest.datasets.iter().any(|dataset| {
-            dataset
-                .evidence_offerings
-                .iter()
-                .any(|offering| offering.access.kind == "registry-notary")
-        })
-    {
-        errors.push(ValidationError::new(
-            "federation",
-            "registry-notary access requires a top-level federation block",
-        ));
-    }
-
     let mut dataset_ids = BTreeSet::new();
     let mut offering_ids = BTreeSet::new();
     for (dataset_index, dataset) in manifest.datasets.iter().enumerate() {
@@ -2824,7 +2706,6 @@ pub fn compile_manifest(manifest: &MetadataManifest) -> Result<CompiledMetadata,
             datasets,
             codelists,
             profiles: manifest.profiles.clone(),
-            federation: manifest.federation.clone(),
             evaluation_profiles: manifest.evaluation_profiles.clone(),
             ecosystem_bindings: manifest.ecosystem_bindings.clone(),
         }),
@@ -2873,9 +2754,6 @@ pub fn render_catalog(compiled: &CompiledMetadata) -> Value {
     if !evidence_offerings.is_empty() {
         catalog["evidence_offerings"] = json!(evidence_offerings);
     }
-    if let Some(federation) = compiled.federation() {
-        catalog["federation"] = json!(federation);
-    }
     if !compiled.evaluation_profiles().is_empty() {
         catalog["evaluation_profiles"] = json!(compiled.evaluation_profiles());
     }
@@ -4328,7 +4206,7 @@ fn validate_evidence_offerings(
                 "access kind must not be empty",
             ));
         }
-        if offering.access.conforms_to.as_deref() != Some(REGISTRY_NOTARY_FEDERATION_PROTOCOL) {
+        if offering.access.kind != REGISTRY_EVIDENCE_ACCESS_KIND {
             validate_optional_uri(
                 offering.access.conforms_to.as_deref(),
                 format!("{offering_path}.access.conforms_to"),
@@ -4336,8 +4214,8 @@ fn validate_evidence_offerings(
                 errors,
             );
         }
-        if offering.access.kind == "registry-notary" {
-            validate_registry_notary_access(
+        if offering.access.kind == REGISTRY_EVIDENCE_ACCESS_KIND {
+            validate_registry_evidence_access(
                 offering,
                 &offering_path,
                 evaluation_profile_rulesets,
@@ -4375,17 +4253,25 @@ fn validate_evidence_offerings(
     }
 }
 
-fn validate_registry_notary_access(
+/// Validates the one access kind this layer knows how to check.
+///
+/// The offering vocabulary itself is portable and product-neutral. Only the
+/// `registry-evidence` kind carries endpoint expectations here, because it
+/// names a service whose shape this repository defines: an evidence endpoint
+/// and the discovery document a relying party reads to verify what that
+/// endpoint returns. Every other kind is left to the runtime that consumes it.
+fn validate_registry_evidence_access(
     offering: &EvidenceOfferingManifest,
     offering_path: &str,
     evaluation_profile_rulesets: &BTreeSet<&str>,
     errors: &mut Vec<ValidationError>,
 ) {
-    if offering.access.conforms_to.as_deref() != Some(REGISTRY_NOTARY_FEDERATION_PROTOCOL) {
-        errors.push(ValidationError::new(
+    match offering.access.conforms_to.as_deref() {
+        Some(conforms_to) if !conforms_to.trim().is_empty() => {}
+        _ => errors.push(ValidationError::new(
             format!("{offering_path}.access.conforms_to"),
-            format!("registry-notary access must conform to {REGISTRY_NOTARY_FEDERATION_PROTOCOL}"),
-        ));
+            "registry-evidence access must declare the response profile it conforms to",
+        )),
     }
     match offering.access.endpoint_url.as_deref() {
         Some(endpoint_url) => validate_https_url(
@@ -4395,7 +4281,7 @@ fn validate_registry_notary_access(
         ),
         None => errors.push(ValidationError::new(
             format!("{offering_path}.access.endpoint_url"),
-            "registry-notary access must declare an HTTPS endpoint URL",
+            "registry-evidence access must declare an HTTPS endpoint URL",
         )),
     }
     match offering.access.discovery_url.as_deref() {
@@ -4406,7 +4292,7 @@ fn validate_registry_notary_access(
         ),
         None => errors.push(ValidationError::new(
             format!("{offering_path}.access.discovery_url"),
-            "registry-notary access must declare an HTTPS discovery URL",
+            "registry-evidence access must declare an HTTPS discovery URL",
         )),
     }
     if !offering.access.ruleset.trim().is_empty()
@@ -4414,7 +4300,7 @@ fn validate_registry_notary_access(
     {
         errors.push(ValidationError::new(
             format!("{offering_path}.access.ruleset"),
-            "registry-notary access.ruleset must reference a known evaluation profile ruleset",
+            "registry-evidence access.ruleset must reference a known evaluation profile ruleset",
         ));
     }
 }
@@ -6729,15 +6615,8 @@ fn https_url_host(value: &str) -> Option<String> {
         .and_then(url_host_after_scheme)
 }
 
-fn url_host(value: &str) -> Option<String> {
-    value
-        .strip_prefix("https://")
-        .or_else(|| value.strip_prefix("http://"))
-        .and_then(url_host_after_scheme)
-}
-
-// Returns the full authority (host plus port when present), lower-cased, so that
-// did:web bindings can match the issuer URL on origin boundary, not just host.
+// Returns the full authority (host plus port when present), lower-cased, so a
+// comparison lands on the origin boundary rather than the bare host.
 fn url_host_after_scheme(remainder: &str) -> Option<String> {
     let authority = remainder
         .split(['/', '?', '#'])
@@ -6749,22 +6628,6 @@ fn url_host_after_scheme(remainder: &str) -> Option<String> {
     (!host.is_empty()).then(|| host.to_ascii_lowercase())
 }
 
-fn did_web_host(node_id: &str) -> Option<String> {
-    node_id
-        .strip_prefix("did:web:")
-        .and_then(|method_id| method_id.split(':').next())
-        .filter(|host| !host.is_empty())
-        .map(|host| {
-            host.replace("%3A", ":")
-                .replace("%3a", ":")
-                .replace("%5B", "[")
-                .replace("%5b", "[")
-                .replace("%5D", "]")
-                .replace("%5d", "]")
-                .to_ascii_lowercase()
-        })
-}
-
 fn validate_dataset_public_service_id(
     value: &str,
     path: impl Into<String>,
diff --git a/crates/registry-manifest-core/tests/metadata_core.rs b/crates/registry-manifest-core/tests/metadata_core.rs
index 3b6059b17..bc29d5b07 100644
--- a/crates/registry-manifest-core/tests/metadata_core.rs
+++ b/crates/registry-manifest-core/tests/metadata_core.rs
@@ -2095,7 +2095,7 @@ datasets:
     );
 }
 
-fn federated_evaluation_manifest() -> MetadataManifest {
+fn evidence_offering_manifest() -> MetadataManifest {
     serde_yaml_ng::from_str(
         r#"
 schema_version: registry-manifest/v1
@@ -2105,13 +2105,6 @@ catalog:
   title: Federated Evaluation
   publisher:
     name: Example Registry
-federation:
-  node_id: did:web:registry.example.test
-  issuer: https://registry.example.test
-  jwks_uri: https://registry.example.test/.well-known/jwks.json
-  federation_api: https://registry.example.test/federation
-  supported_protocol_versions:
-    - registry-notary-federation/v0.1
 evaluation_profiles:
   - id: age_eligibility_profile
     ruleset: age-eligibility-v1
@@ -2129,8 +2122,8 @@ datasets:
   - id: residents
     title: Residents
     evidence_offerings:
-      - id: age_notary
-        title: Age notary
+      - id: age_evidence_offering
+        title: Age evidence service
         evidence_type: age_evidence
         issuing_authority:
           id: civil_registry
@@ -2138,10 +2131,10 @@ datasets:
         entity: resident
         lookup_keys: [national_id]
         access:
-          kind: registry-notary
-          conforms_to: registry-notary-federation/v0.1
-          endpoint_url: https://notary.example.test/evaluate
-          discovery_url: https://notary.example.test/.well-known/registry-notary
+          kind: registry-evidence
+          conforms_to: registry.assertion-evidence/v1
+          endpoint_url: https://evidence.example.test/v1/assertions
+          discovery_url: https://evidence.example.test/.well-known/evidence/jwks.json
           ruleset: age-eligibility-v1
     entities:
       - name: resident
@@ -2150,20 +2143,20 @@ datasets:
             type: string
 "#,
     )
-    .expect("federated evaluation manifest parses")
+    .expect("evidence offering manifest parses")
 }
 
 #[test]
-fn federated_evaluation_manifest_validates_and_renders_catalog_fields() {
-    let manifest = federated_evaluation_manifest();
+fn evidence_offering_manifest_validates_and_renders_catalog_fields() {
+    let manifest = evidence_offering_manifest();
 
-    validate_manifest(&manifest).expect("federated manifest validates");
-    let compiled = compile_manifest(&manifest).expect("federated manifest compiles");
+    validate_manifest(&manifest).expect("evidence offering manifest validates");
+    let compiled = compile_manifest(&manifest).expect("evidence offering manifest compiles");
     let catalog = render_catalog(&compiled);
 
-    assert_eq!(
-        catalog["federation"]["supported_protocol_versions"][0],
-        json!("registry-notary-federation/v0.1")
+    assert!(
+        catalog.get("federation").is_none(),
+        "catalog must not republish a federation block: {catalog}"
     );
     assert_eq!(
         catalog["evaluation_profiles"][0]["id"],
@@ -3321,8 +3314,8 @@ codelists: []
 }
 
 #[test]
-fn validation_rejects_registry_notary_unresolved_ruleset() {
-    let mut manifest = federated_evaluation_manifest();
+fn validation_rejects_registry_evidence_unresolved_ruleset() {
+    let mut manifest = evidence_offering_manifest();
     manifest.datasets[0].evidence_offerings[0].access.ruleset = "missing_profile".to_string();
 
     let error = validate_manifest(&manifest).expect_err("unresolved ruleset rejected");
@@ -3338,25 +3331,39 @@ fn validation_rejects_registry_notary_unresolved_ruleset() {
 }
 
 #[test]
-fn validation_rejects_registry_notary_bad_conforms_to() {
-    let mut manifest = federated_evaluation_manifest();
+fn validation_rejects_blank_registry_evidence_conforms_to() {
+    let mut manifest = evidence_offering_manifest();
     manifest.datasets[0].evidence_offerings[0]
         .access
-        .conforms_to = Some("registry_relay:evidence-server-v1".to_string());
+        .conforms_to = Some("   ".to_string());
 
-    let error = validate_manifest(&manifest).expect_err("bad protocol rejected");
+    let error = validate_manifest(&manifest).expect_err("blank conformance target rejected");
     let MetadataError::Validation { errors } = error else {
         panic!("unexpected error: {error:?}");
     };
     assert!(errors.iter().any(|error| {
         error.path == "datasets[0].evidence_offerings[0].access.conforms_to"
-            && error.message.contains("registry-notary-federation/v0.1")
+            && error.message.contains("registry-evidence access")
     }));
 }
 
+#[test]
+fn validation_accepts_a_registry_evidence_conforms_to_that_is_not_a_uri() {
+    // conforms_to names the response profile the endpoint returns, and the
+    // portable manifest layer deliberately does not pin it to a product's
+    // contract version, so a bare profile identifier is a legitimate value.
+    // Requiring a URI here would reject what the Evidence runtime returns.
+    let mut manifest = evidence_offering_manifest();
+    manifest.datasets[0].evidence_offerings[0]
+        .access
+        .conforms_to = Some("registry.assertion-evidence/v1".to_string());
+
+    validate_manifest(&manifest).expect("a profile identifier is a valid conformance target");
+}
+
 #[test]
 fn validation_rejects_duplicate_evaluation_profile_ids() {
-    let mut manifest = federated_evaluation_manifest();
+    let mut manifest = evidence_offering_manifest();
     manifest
         .evaluation_profiles
         .push(manifest.evaluation_profiles[0].clone());
@@ -3374,187 +3381,91 @@ fn validation_rejects_duplicate_evaluation_profile_ids() {
 }
 
 #[test]
-fn validation_rejects_invalid_federation_urls_and_did_web_binding() {
-    let mut manifest = federated_evaluation_manifest();
-    let federation = manifest.federation.as_mut().expect("federation");
-    federation.issuer = "http://registry.example.test".to_string();
-    federation.jwks_uri = "http://registry.example.test/.well-known/jwks.json".to_string();
-    federation.federation_api = "http://registry.example.test/federation".to_string();
-    federation.node_id = "did:web:other.example.test".to_string();
-
-    let error = validate_manifest(&manifest).expect_err("bad federation rejected");
-    let MetadataError::Validation { errors } = error else {
-        panic!("unexpected error: {error:?}");
-    };
-    assert!(errors.iter().any(|error| error.path == "federation.issuer"));
-    assert!(errors
-        .iter()
-        .any(|error| error.path == "federation.jwks_uri"));
-    assert!(errors
-        .iter()
-        .any(|error| error.path == "federation.federation_api"));
-    assert!(errors.iter().any(|error| {
-        error.path == "federation.node_id"
-            && error
-                .message
-                .contains("must bind to federation issuer host")
-    }));
-}
-
-#[test]
-fn validation_accepts_federation_endpoints_on_issuer_host() {
-    let mut manifest = federated_evaluation_manifest();
-    let federation = manifest.federation.as_mut().expect("federation");
-    federation.issuer = "https://registry.example.test/issuer".to_string();
-    federation.jwks_uri = "https://registry.example.test/.well-known/jwks.json".to_string();
-    federation.federation_api = "https://registry.example.test/federation".to_string();
-
-    validate_manifest(&manifest).expect("federation endpoints bind to issuer host");
-}
+fn manifest_rejects_a_retired_federation_block() {
+    let raw = r#"
+schema_version: registry-manifest/v1
+catalog:
+  id: retired-federation
+  base_url: https://registry.example.test
+  title: Retired Federation
+  publisher:
+    name: Example Registry
+federation:
+  node_id: did:web:registry.example.test
+  issuer: https://registry.example.test
+  jwks_uri: https://registry.example.test/.well-known/jwks.json
+  federation_api: https://registry.example.test/federation
+  supported_protocol_versions:
+    - registry-notary-federation/v0.1
+"#;
 
-#[test]
-fn validation_rejects_federation_endpoints_on_cross_hosts() {
-    let mut manifest = federated_evaluation_manifest();
-    let federation = manifest.federation.as_mut().expect("federation");
-    federation.jwks_uri = "https://keys.example.test/.well-known/jwks.json".to_string();
-    federation.federation_api = "https://api.example.test/federation".to_string();
+    let error = serde_yaml_ng::from_str::<MetadataManifest>(raw)
+        .expect_err("retired federation block rejected");
 
-    let error = validate_manifest(&manifest).expect_err("cross-host federation endpoints rejected");
-    let MetadataError::Validation { errors } = error else {
-        panic!("unexpected error: {error:?}");
-    };
     assert!(
-        errors.iter().any(|error| {
-            error.path == "federation.jwks_uri"
-                && error
-                    .message
-                    .contains("must bind to federation issuer host")
-        }),
-        "expected JWKS host binding error, got: {errors:?}"
-    );
-    assert!(
-        errors.iter().any(|error| {
-            error.path == "federation.federation_api"
-                && error
-                    .message
-                    .contains("must bind to federation issuer host")
-        }),
-        "expected federation API host binding error, got: {errors:?}"
+        error.to_string().contains("federation"),
+        "expected the unknown-field error to name federation, got: {error}"
     );
 }
 
 #[test]
-fn validation_rejects_did_web_port_mismatch_against_issuer() {
-    let mut manifest = federated_evaluation_manifest();
-    let federation = manifest.federation.as_mut().expect("federation");
-    federation.issuer = "https://registry.example.test:9090".to_string();
-    federation.jwks_uri = "https://registry.example.test:9090/.well-known/jwks.json".to_string();
-    federation.federation_api = "https://registry.example.test:9090/federation".to_string();
-    federation.node_id = "did:web:registry.example.test%3A8080".to_string();
-
-    let error = validate_manifest(&manifest).expect_err("port mismatch rejected");
+fn validation_requires_https_endpoints_for_registry_evidence_access() {
+    let mut manifest = evidence_offering_manifest();
+    let access = &mut manifest.datasets[0].evidence_offerings[0].access;
+    access.endpoint_url = Some("http://evidence.example.test/v1/assertions".to_string());
+    access.discovery_url = Some("http://evidence.example.test/.well-known/jwks.json".to_string());
+
+    let error = validate_manifest(&manifest).expect_err("insecure evidence endpoints rejected");
     let MetadataError::Validation { errors } = error else {
         panic!("unexpected error: {error:?}");
     };
     assert!(
-        errors.iter().any(|error| {
-            error.path == "federation.node_id"
-                && error
-                    .message
-                    .contains("must bind to federation issuer host")
-        }),
-        "expected DID:web port mismatch to be reported, got: {errors:?}"
+        errors
+            .iter()
+            .any(|error| error.path == "datasets[0].evidence_offerings[0].access.endpoint_url"),
+        "expected an endpoint_url error, got: {errors:?}"
     );
-}
-
-#[test]
-fn validation_rejects_did_web_with_port_against_default_port_issuer() {
-    let mut manifest = federated_evaluation_manifest();
-    let federation = manifest.federation.as_mut().expect("federation");
-    federation.issuer = "https://registry.example.test".to_string();
-    federation.jwks_uri = "https://registry.example.test/.well-known/jwks.json".to_string();
-    federation.federation_api = "https://registry.example.test/federation".to_string();
-    federation.node_id = "did:web:registry.example.test%3A8443".to_string();
-
-    let error = validate_manifest(&manifest).expect_err("asymmetric port rejected");
-    let MetadataError::Validation { errors } = error else {
-        panic!("unexpected error: {error:?}");
-    };
     assert!(
-        errors.iter().any(|error| {
-            error.path == "federation.node_id"
-                && error
-                    .message
-                    .contains("must bind to federation issuer host")
-        }),
-        "expected DID:web port-vs-default-port asymmetry to be reported, got: {errors:?}"
+        errors
+            .iter()
+            .any(|error| error.path == "datasets[0].evidence_offerings[0].access.discovery_url"),
+        "expected a discovery_url error, got: {errors:?}"
     );
 }
 
 #[test]
-fn validation_rejects_default_port_did_web_against_issuer_with_port() {
-    let mut manifest = federated_evaluation_manifest();
-    let federation = manifest.federation.as_mut().expect("federation");
-    federation.issuer = "https://registry.example.test:8443".to_string();
-    federation.jwks_uri = "https://registry.example.test:8443/.well-known/jwks.json".to_string();
-    federation.federation_api = "https://registry.example.test:8443/federation".to_string();
-    federation.node_id = "did:web:registry.example.test".to_string();
-
-    let error = validate_manifest(&manifest).expect_err("asymmetric port rejected");
+fn validation_requires_declared_endpoints_for_registry_evidence_access() {
+    let mut manifest = evidence_offering_manifest();
+    let access = &mut manifest.datasets[0].evidence_offerings[0].access;
+    access.endpoint_url = None;
+    access.discovery_url = None;
+    access.conforms_to = None;
+
+    let error = validate_manifest(&manifest).expect_err("undeclared evidence access rejected");
     let MetadataError::Validation { errors } = error else {
         panic!("unexpected error: {error:?}");
     };
-    assert!(
-        errors.iter().any(|error| {
-            error.path == "federation.node_id"
-                && error
-                    .message
-                    .contains("must bind to federation issuer host")
-        }),
-        "expected DID:web default-vs-explicit-port asymmetry to be reported, got: {errors:?}"
-    );
-}
-
-#[test]
-fn validation_accepts_did_web_port_match_against_issuer() {
-    let mut manifest = federated_evaluation_manifest();
-    let federation = manifest.federation.as_mut().expect("federation");
-    federation.issuer = "https://registry.example.test:8443".to_string();
-    federation.jwks_uri = "https://registry.example.test:8443/.well-known/jwks.json".to_string();
-    federation.federation_api = "https://registry.example.test:8443/federation".to_string();
-    federation.node_id = "did:web:registry.example.test%3A8443".to_string();
-
-    validate_manifest(&manifest).expect("matching port binds");
+    for field in ["endpoint_url", "discovery_url", "conforms_to"] {
+        let path = format!("datasets[0].evidence_offerings[0].access.{field}");
+        assert!(
+            errors
+                .iter()
+                .any(|error| error.path == path
+                    && error.message.contains("registry-evidence access")),
+            "expected a registry-evidence error for {field}, got: {errors:?}"
+        );
+    }
 }
 
 #[test]
-fn validation_reports_missing_federation_block_once_across_offerings() {
-    let mut manifest = federated_evaluation_manifest();
-    manifest.federation = None;
-    let template = manifest.datasets[0].evidence_offerings[0].clone();
-    for index in 1..3 {
-        let mut copy = template.clone();
-        copy.id = format!("age_notary_{index}");
-        manifest.datasets[0].evidence_offerings.push(copy);
-    }
+fn validation_leaves_an_unrecognized_access_kind_to_the_consuming_runtime() {
+    let mut manifest = evidence_offering_manifest();
+    let access = &mut manifest.datasets[0].evidence_offerings[0].access;
+    access.kind = "registry-notary".to_string();
+    access.conforms_to = Some("https://example.test/protocols/some-other-service".to_string());
 
-    let error = validate_manifest(&manifest).expect_err("missing federation rejected");
-    let MetadataError::Validation { errors } = error else {
-        panic!("unexpected error: {error:?}");
-    };
-    let federation_errors = errors
-        .iter()
-        .filter(|error| {
-            error.path == "federation"
-                && error
-                    .message
-                    .contains("registry-notary access requires a top-level federation block")
-        })
-        .count();
-    assert_eq!(
-        federation_errors, 1,
-        "expected exactly one federation-missing error, got {federation_errors}: {errors:?}"
-    );
+    validate_manifest(&manifest)
+        .expect("the portable layer does not enumerate product access kinds");
 }
 
 #[test]
diff --git a/crates/registry-mint/Cargo.toml b/crates/registry-mint/Cargo.toml
new file mode 100644
index 000000000..fb3ca48e0
--- /dev/null
+++ b/crates/registry-mint/Cargo.toml
@@ -0,0 +1,48 @@
+[package]
+name = "registry-mint"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+description = "Minimal OAuth token issuer that authenticates clients by private key JWT."
+repository.workspace = true
+publish = false
+
+[[bin]]
+name = "mint"
+path = "src/main.rs"
+
+[lints]
+workspace = true
+
+[dependencies]
+async-trait.workspace = true
+axum.workspace = true
+base64.workspace = true
+clap.workspace = true
+http.workspace = true
+jsonwebtoken.workspace = true
+registry-platform-canonical-json.workspace = true
+registry-platform-audit.workspace = true
+registry-platform-crypto.workspace = true
+registry-platform-oidc.workspace = true
+reqwest.workspace = true
+rustix.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+serde_norway.workspace = true
+thiserror.workspace = true
+time.workspace = true
+tokio.workspace = true
+tower-http.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+ulid.workspace = true
+url.workspace = true
+zeroize.workspace = true
+
+[dev-dependencies]
+axum-test.workspace = true
+ed25519-dalek.workspace = true
+registry-evidence.workspace = true
+tempfile.workspace = true
diff --git a/crates/registry-mint/README.md b/crates/registry-mint/README.md
new file mode 100644
index 000000000..438f7905e
--- /dev/null
+++ b/crates/registry-mint/README.md
@@ -0,0 +1,325 @@
+# Registry Mint
+
+Mint issues short-lived access tokens to registered machine clients. It exists
+so that a resource server such as Evidence can require signed, expiring,
+audience-bound tokens without the deployment first having to stand up a general
+purpose identity provider.
+
+Mint is not a product line. It is a small supporting service for deployments
+that have many callers and no IdP.
+
+## Why a server, and not just a shared JWKS
+
+A resource server configured with a pooled JWK set can answer only one
+question: *was this token signed by one of the trusted keys?* It cannot answer
+the question that authorization actually depends on: *which caller signed it,
+and what is that caller permitted to assert?*
+
+Key selection inside a JWK set is by `kid`, and `kid` is chosen by whoever
+built the token. So in a pooled set every key is equally authoritative for
+every claim. Any client holding any trusted key can mint a token naming any
+principal, any requester tags, and any evidence audience.
+
+Mint closes that by splitting the two questions across two places:
+
+- The **client registry** (`clients/*.yaml`) binds a client id to *that
+  client's* public keys and to the authority Mint will assert for it.
+- The **token endpoint** verifies an incoming client assertion against the
+  keys of the client it claims to be, selected *before* signature
+  verification, and then writes the authority from the registry, never from
+  the assertion payload.
+
+A client therefore holds its own key and signs for itself, but possession of a
+key no longer decides what may be said.
+
+## Protocol
+
+Mint speaks the `client_credentials` grant with `private_key_jwt` client
+authentication (RFC 7523). A client builds a short-lived JWT assertion signed
+with its own private key, and posts it to the token endpoint:
+
+```
+POST /token
+Content-Type: application/x-www-form-urlencoded
+
+grant_type=client_credentials
+&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
+&client_assertion=<compact JWS>
+```
+
+The assertion must carry `iss` and `sub` equal to the client id, `aud` equal to
+the configured `clientAssertion.audience`, a `jti`, and `iat`/`exp` inside the
+configured maximum lifetime. Every `jti` is single use: presenting the same
+assertion twice is refused.
+
+The response is a signed `at+jwt` access token. Errors collapse to
+`invalid_client` so that the endpoint cannot be used to probe which client ids
+are registered.
+
+Endpoints:
+
+| Path | Purpose |
+|---|---|
+| `POST /token` | Issue an access token |
+| `GET /.well-known/jwks.json` | Public keys for verifying minted tokens (path is configurable) |
+| `GET /.well-known/oauth-authorization-server` | Metadata pointing at the above |
+| `GET /health`, `GET /ready` | Liveness, and readiness (503 without clients or a writable audit chain) |
+
+## Configuration
+
+One YAML document. Every path in it resolves relative to the document's own
+directory. Everything here is startup-only: issuer identity, signing and audit
+keys, listener, and token policy are fixed for the life of the process.
+
+```yaml
+version: 1
+issuer: https://mint.example.org
+listener:
+  address: 127.0.0.1
+  port: 8081
+signing:
+  algorithm: EdDSA
+  activeKeyId: mint-2026-01
+  activeKeyFile: secrets/signing.jwk
+  # Public JWKs of keys that no longer sign but may still have live tokens.
+  retiredPublicJwkFiles: []
+audit:
+  path: audit/mint.jsonl
+  maximumFileBytes: 1073741824
+  hashKeyFile: secrets/audit-hmac-key
+  hashKeyVersion: 1
+accessTokens:
+  audiences: [evidence]
+  lifetimeSeconds: 300
+  claims:
+    principal: sub
+    requesterTags: evidence_tags
+    evidenceAudience: evidence_audience
+    grantId: evidence_grant_id
+    grantAuthority: evidence_authority
+    # Optional. Required only to issue delegated tokens; see below.
+    actor: evidence_actor
+clientAssertion:
+  audience: https://mint.example.org/token
+  maximumLifetimeSeconds: 300
+  algorithms: [EdDSA]
+clients:
+  directory: clients
+```
+
+The `accessTokens.claims` names must match the resource server's
+`authentication` block, because the resource server reads its principal,
+requester tags, evidence audience, and grant pair from configurable claim
+names. Access token lifetime is bounded to 60..=3600 seconds; a long-lived
+bearer token is the thing Mint exists to avoid.
+
+The signing key file must be a private JWK and must be readable only by its
+owner. Never commit it, print it, or pass it on a command line.
+
+The audit key file is also owner-only and must contain at least 32 bytes. The
+audit directory, chain, and lock file must be owned by the Mint process user and
+unavailable to group and other users. For a new deployment, `openssl rand -hex
+32 > secrets/audit-hmac-key` followed by `chmod 600
+secrets/audit-hmac-key` is sufficient. Mint verifies the keyed chain at startup
+and holds a single-writer lock for the process lifetime. It writes a durable
+release record before returning every access token; if that write fails, the
+request returns `server_error` and readiness fails. Denials are recorded with
+value-free error categories. Raw assertions, tokens, client ids, actors,
+principals, and subject values never enter the chain; successful records use
+keyed pseudonyms where correlation is needed.
+
+`audit.maximumFileBytes` is a per-segment threshold, not a total capacity limit.
+When an append would exceed the threshold, Mint seals the active segment as
+`<audit.path>.<eight-digit-sequence>` and opens a new active segment online. The
+keyed chain continues across the seam. Mint never deletes or compacts sealed
+segments, so monitor total capacity and archive sealed history under the
+deployment's retention policy while retaining the matching audit key. Never
+rename or archive the active segment while Mint is running.
+
+## Registering a client
+
+One `*.yaml` file per client in `clients.directory`:
+
+```yaml
+clientId: health-desk
+principal: service:health-desk
+evidenceAudience: https://evidence.example.org
+requesterTags: [health-desk, region-north]
+# Optional. Minted only for callers acting under a recorded authority.
+grant:
+  id: grant-2026-014
+  authority: ministry-of-health
+keys:
+  - kty: OKP
+    crv: Ed25519
+    kid: health-desk-2026-01
+    x: "..."
+```
+
+Only public JWKs are accepted; a document carrying a private member is
+rejected. The load is all-or-nothing, so one malformed registration fails the
+whole load and a partially applied registry can never serve.
+
+## Delegation: a token bound to one subject
+
+A caller can be issued a token that is valid only for evidence *about one named
+person*. The point is containment rather than labelling: a client that loops
+over the wrong list or reuses a request object cannot cross from one person to
+another, because the subject is not a request parameter it controls.
+
+Three things have to line up.
+
+**The registration** says which agents this client may act as, and which
+selector fields it may bind, at which claim paths:
+
+```yaml
+clientId: appointment-scheduler
+principal: service:appointment-scheduler
+evidenceAudience: https://scheduler.example.org
+requesterTags: [scheduling-agent]
+delegation:
+  # Optional. Omitted means the client names its own actor.
+  actors: [urn:example:agent:appointment-scheduler]
+  subjectClaims:
+    given_name: identity.given_name
+    family_name: identity.family_name
+    birth_date: identity.birth_date
+keys: [...]
+```
+
+A client with no `delegation` block cannot obtain a delegated token at all.
+
+**The request** names the actor and the subject inside the client's own signed
+assertion, in an `on_behalf_of` member:
+
+```json
+{
+  "iss": "appointment-scheduler",
+  "sub": "appointment-scheduler",
+  "aud": "https://mint.example.org/token",
+  "iat": 1785671511, "exp": 1785671631, "jti": "...",
+  "on_behalf_of": {
+    "actor": "urn:example:agent:appointment-scheduler",
+    "subject": {"given_name": "...", "family_name": "...", "birth_date": "..."}
+  }
+}
+```
+
+Placing it inside the assertion is deliberate: the actor and the subject are
+covered by the client's signature, so nothing between the client and Mint can
+alter who the token is for. `on_behalf_of` is Mint's own member rather than RFC
+8693 `act`, because token exchange presents a subject's own credential, which is
+exactly what a deployment without an identity provider does not have.
+
+The subject must carry the registration's subject fields exactly: a missing
+field or an extra one is refused, like every other delegation failure, as
+`invalid_client`.
+
+**The resource server bundle** declares that subject role's `valueOrigin` as
+`authenticated-context`, with `valueClaims` mirroring `subjectClaims` above.
+That is what makes the property hold: Evidence reads the selector from the token
+and rejects any request that carries selector values of its own. A request
+naming a different person is refused for carrying values at all, not for
+carrying the wrong ones.
+
+Two limits worth stating plainly. This defends against a *buggy* client, not a
+*compromised* one: a client holding its own signing key can ask Mint for a token
+naming a different subject, within the fields its registration permits. And
+Evidence confines an actor-bearing token to `kind: delegated` authority profiles
+but does not conversely require an actor to reach one, so an undelegated token
+matches such a grant and is stopped when the subject cannot be resolved.
+
+[`demo/`](demo/) runs all of this end to end against the real binaries, with
+every request printed before it is sent.
+
+The registry is the one reloadable part of Mint. `SIGHUP` reloads it in place,
+keeping the previous registry if the new one does not load. Onboarding,
+offboarding, and caller key rotation therefore never restart the resource
+server.
+
+## Running
+
+```bash
+mint check --config /etc/mint/mint.yaml
+```
+
+```bash
+mint serve --config /etc/mint/mint.yaml
+```
+
+Verify the retained chain with the same configuration and audit key:
+
+```bash
+mint verify-audit --config /etc/mint/mint.yaml
+```
+
+The command verifies every sealed segment. It also verifies the active segment
+when no Mint process owns the writer lock; otherwise it reports
+`active-segment: not verified`.
+
+All three operator commands accept `MINT_CONFIG` in place of `--config`.
+`check` loads the configuration, signing key, audit chain, and client registry,
+then exits without opening a socket.
+
+Mint serves plain HTTP and expects to sit behind TLS termination it does not
+manage.
+
+## Getting a token in development
+
+```bash
+mint token --url https://mint.example.org/token \
+  --client-id scheduler --key ./dev/scheduler.jwk
+```
+
+It prints the access token on stdout and nothing else, so `TOKEN=$(mint token
+...)` is the whole usage. Diagnostics go to stderr; `--verbose` prints the
+endpoint's full response instead.
+
+This is a *client* tool. It signs a client assertion with the caller's own key
+and presents it to a running endpoint, exactly as an adopter's client library
+would. It reads no server configuration and never touches Mint's signing key.
+There is deliberately no subcommand that signs an access token directly: that
+would be a way to obtain authority without authenticating, inside the binary
+whose purpose is to make authority depend on authentication. Anything `mint
+token` can obtain, the same client could have obtained over the wire.
+
+The key file gets the same treatment as Mint's own signing key: a regular file,
+owned by you, unreadable by group and other, reached without traversing a
+symlink.
+
+For a delegated token:
+
+```bash
+mint token --url https://mint.example.org/token \
+  --client-id scheduler --key ./dev/scheduler.jwk \
+  --actor urn:example:agent:appointment-scheduler \
+  --subject-file ./dev/subject.json
+```
+
+`--subject-file` holds a flat JSON object of selector fields
+(`{"given_name": "Amara", "birth_date": "1998-04-02"}`). It is a file rather
+than repeated flags because those are a real person's identifying details, and
+command lines are visible to every process on the host and land in shell
+history.
+
+Two more flags matter in development. `--audience` overrides the assertion
+audience, which defaults to `--url`; they differ when the endpoint is reached
+over loopback but configured with its public URL. `--ca-certificate` trusts a
+PEM bundle in addition to the system roots, for a deployment behind a private
+CA.
+
+## Verify a change
+
+```bash
+cargo test --locked -p registry-mint
+```
+
+`tests/evidence_compatibility.rs` is the test that justifies the crate: it
+drives the real router over a real on-disk deployment and feeds the minted
+token to Evidence's own authenticator. `tests/delegated_subject_binding.rs`
+does the same for delegation, running Evidence's own entitlement match and
+selector resolution over a token from the real Mint router. The dependency runs
+one way only. Evidence does not depend on Mint.
+
+`tests/token_cli.rs` runs `mint token` against a real `mint serve` as two
+processes, which is the only place the stdout contract can be observed.
diff --git a/crates/registry-mint/demo/.gitignore b/crates/registry-mint/demo/.gitignore
new file mode 100644
index 000000000..3b785b09b
--- /dev/null
+++ b/crates/registry-mint/demo/.gitignore
@@ -0,0 +1,3 @@
+# The throwaway deployment `run.sh` provisions: keys, certificates, configs,
+# audit log. Regenerated on every run, never committed.
+.run/
diff --git a/crates/registry-mint/demo/README.md b/crates/registry-mint/demo/README.md
new file mode 100644
index 000000000..46b7b2cee
--- /dev/null
+++ b/crates/registry-mint/demo/README.md
@@ -0,0 +1,275 @@
+# Delegated, subject-bound access: a runnable demonstration
+
+An agent needs to know which region one person lives in. It must not be able to
+learn that about anybody else, even if the agent's own code is wrong.
+
+This directory runs that end to end against the real Mint and the real Evidence
+binaries: a real client assertion, a real token, a real signed evidence
+assertion, and a real refusal.
+
+```bash
+crates/registry-mint/demo/run.sh
+```
+
+It needs `cargo`, `uv`, and `openssl`, binds four loopback ports (8080, 8090,
+8092, 8443), and leaves its throwaway deployment in `demo/.run/` for inspection.
+Everything it generates is disposable: fresh keys per run, synthetic people, a
+private CA that exists for the lifetime of the demonstration.
+
+## What to read
+
+- [`walkthrough.py`](walkthrough.py) is the demonstration. Six steps, every
+  request printed before it is sent, with the reasoning next to it.
+- [`evidence-bundle/evidence.yaml`](evidence-bundle/evidence.yaml) is the
+  policy. The security property is one line of it.
+- Everything under [`support/`](support/) is deployment plumbing: key
+  generation, a TLS terminator, a stand-in registry source. None of it decides
+  anything. Read it only if you want to know why the demonstration needs a
+  certificate.
+
+## The mechanism, in one paragraph
+
+The client authenticates to Mint with a JWT it signs with its own key
+(RFC 7523 `private_key_jwt`), so there is no shared secret and Mint holds only
+public keys. The delegation request rides *inside* that signed JWT, in an
+`on_behalf_of` member, which is what makes the actor and the subject
+tamper-evident between the client and Mint. Mint checks both against the
+client's registration and mints them as claims. The Evidence bundle then
+declares that subject role's `valueOrigin` as `authenticated-context`, which
+means Evidence reads the selector from those claims and **refuses any request
+that carries selector values of its own**. That refusal is the containment: it
+is not "you named the wrong person", it is "you do not get to name a person".
+
+## The flow
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant Client
+    participant Mint as Registry Mint
+    participant Evidence
+    participant Source as Registry source
+
+    Note over Client: Signs a client assertion with its own private key.<br/>The delegation request rides inside that signature.
+    Client->>Mint: POST /token, assertion carrying on_behalf_of
+    Mint->>Mint: Verify the signature against the keys registered for scheduler
+    Mint->>Mint: Check the actor and the subject fields against that registration
+    Mint->>Mint: Durably append the keyed token-release audit record
+    Mint-->>Client: Access token with evidence_actor and identity.* claims
+
+    Note over Client,Evidence: The person is named nowhere in the request below.
+    Client->>Evidence: POST /v1/evidence, requirement and purpose only
+    Evidence->>Evidence: Match the delegated authority profile
+    Evidence->>Evidence: Read the selector from the token (valueOrigin: authenticated-context)
+    Evidence->>Source: One fixed-authority lookup, for that person only
+    Source-->>Evidence: Registry record
+    Evidence-->>Client: Signed assertion: coarse region, opaque subject binding
+
+    Note over Client,Evidence: The containment, with the same valid token.
+    Client->>Evidence: POST /v1/evidence carrying selector values for someone else
+    Evidence--xClient: 400 invalid_selector
+```
+
+Two properties are visible in the shape of that diagram. Nothing the client
+sends after step 1 names a person, and the only arrow that reaches the registry
+source is the one Evidence draws for the subject its own authority context
+resolved. The final refusal is not a lookup that failed; it is a request that
+was never allowed to describe anybody.
+
+## The four requests
+
+These are the requests the walkthrough sends, written as curl so they can be
+read without running anything. `run.sh` stops its servers when it exits, so to
+issue them by hand you would keep the deployment in `.run/` and start the four
+processes yourself.
+
+### 1. The client assertion
+
+The client builds and signs this itself. Nothing between it and Mint can change
+who the token is for.
+
+```json
+{
+  "iss": "scheduler",
+  "sub": "scheduler",
+  "aud": "https://localhost:8443/token",
+  "iat": 1785671511,
+  "exp": 1785671631,
+  "jti": "demo-1",
+  "on_behalf_of": {
+    "actor": "urn:example:demo:agent:appointment-scheduler",
+    "subject": {"given_name": "Amara", "family_name": "Okafor", "birth_date": "1998-04-02"}
+  }
+}
+```
+
+`on_behalf_of` is Mint's own member, not RFC 8693 `act`. Token exchange presents
+a subject's own credential, which is exactly what a deployment without an
+identity provider does not have.
+
+### 2. The token request
+
+```bash
+curl -sS --cacert crates/registry-mint/demo/.run/ca.pem https://localhost:8443/token \
+  -d grant_type=client_credentials \
+  -d client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer \
+  --data-urlencode "client_assertion@/path/to/assertion.jwt"
+```
+
+Mint verifies the signature against the keys registered for `scheduler`, then
+checks the delegation request against the same registration:
+
+```yaml
+clientId: scheduler
+principal: urn:example:demo:principal:scheduler
+evidenceAudience: https://scheduler.demo.invalid
+requesterTags: [demo-agent]
+keys: [...]
+delegation:
+  actors: [urn:example:demo:agent:appointment-scheduler]
+  subjectClaims:
+    given_name: identity.given_name
+    family_name: identity.family_name
+    birth_date: identity.birth_date
+```
+
+That block is the whole authorization decision Mint makes: which agents this
+client may act as, and which selector fields it may bind, at which claim paths.
+Neither answer comes from the request. A client with no `delegation:` block
+cannot obtain a delegated token at all.
+
+The resulting token:
+
+```json
+{
+  "iss": "https://localhost:8443",
+  "sub": "urn:example:demo:principal:scheduler",
+  "aud": "evidence.demo.invalid",
+  "client_id": "scheduler",
+  "evidence_tags": ["demo-agent"],
+  "evidence_audience": "https://scheduler.demo.invalid",
+  "evidence_actor": "urn:example:demo:agent:appointment-scheduler",
+  "identity": {"given_name": "Amara", "family_name": "Okafor", "birth_date": "1998-04-02"},
+  "exp": 1785671811, "iat": 1785671511, "nbf": 1785671511, "jti": "01KZ..."
+}
+```
+
+`evidence_actor` says who is acting. `identity.*` says who they are acting for.
+
+### 3. The evidence request
+
+```bash
+curl -sS http://127.0.0.1:8080/v1/evidence \
+  -H "Authorization: Bearer ${TOKEN}" \
+  -H 'Content-Type: application/json' \
+  -d '{
+        "requestNonce": "<32 random bytes, base64url, unpadded>",
+        "requirement": "urn:example:demo:requirement:residence-region:v1",
+        "purpose": "demo-routing",
+        "subjects": [{"role": "subject", "selector": {"profile": "demographics-v1"}}]
+      }'
+```
+
+Note what is not in that body: the person. `requestNonce` is a caller
+correlation value, echoed into the assertion and kept away from authorization,
+sources, and audit. The bundle says where the subject
+comes from instead.
+
+```yaml
+authorityProfiles:
+  delegated-agent-v1:
+    kind: delegated
+    requesterTags: [demo-agent]
+    grants:
+      - requirement: urn:example:demo:requirement:residence-region:v1
+        purpose: demo-routing
+        audienceFrom: authenticated-requester
+        subjects:
+          - role: subject
+            selectorProfile: demographics-v1
+            valueOrigin: authenticated-context   # <- the security property
+            valueClaims:
+              given_name: identity.given_name
+              family_name: identity.family_name
+              birth_date: identity.birth_date
+```
+
+Evidence answers with a signed assertion whose payload carries a coarse region
+and an opaque subject binding. The person's name and their residence code are in
+neither the request nor the answer:
+
+```json
+{
+  "supportsRequirement": "urn:example:demo:requirement:residence-region:v1",
+  "purpose": "demo-routing",
+  "audience": "https://scheduler.demo.invalid",
+  "subjects": [{"role": "subject", "binding": "urn:evidence:subject:v1_lARwiBg..."}],
+  "supportedValues": [
+    {"providesValueFor": "urn:example:demo:concept:residence-region", "value": "REGION-NORTH"}
+  ]
+}
+```
+
+### 4. The same token, pointed at somebody else
+
+```bash
+curl -sS http://127.0.0.1:8080/v1/evidence \
+  -H "Authorization: Bearer ${TOKEN}" \
+  -H 'Content-Type: application/json' \
+  -d '{
+        "requestNonce": "<32 random bytes, base64url, unpadded>",
+        "requirement": "urn:example:demo:requirement:residence-region:v1",
+        "purpose": "demo-routing",
+        "subjects": [{"role": "subject", "selector": {"profile": "demographics-v1",
+          "values": {"given_name": "Kofi", "family_name": "Mensah", "birth_date": "1971-11-30"}}}]
+      }'
+```
+
+```json
+{"type": "https://registrystack.org/problems/evidence/invalid_selector",
+ "title": "Request is not valid", "status": 400, "code": "invalid_selector"}
+```
+
+There is no request this token can make about Kofi Mensah. The refusal is for
+carrying selector values at all, not for carrying the wrong ones, so a client
+bug that puts the wrong person in the body cannot reach that person.
+
+## What this does and does not defend against
+
+It defends against a **buggy** client. A client that loops over the wrong list,
+reuses a request object, or confuses two sessions cannot cross from one person
+to another, because the subject is not a request parameter it controls.
+
+It does not defend against a **compromised** client. A client holding its own
+signing key can ask Mint for a token naming a different subject, within the
+fields its registration permits. Closing that would mean Mint resolving the
+subject from a server-side grant record rather than from the caller's request,
+which is a larger change and is not what this builds.
+
+Two further limits worth stating plainly:
+
+- Evidence confines an *actor-bearing* token to `kind: delegated` authority
+  profiles, but it does not conversely require an actor to reach one. An
+  undelegated token therefore matches this grant and is stopped when the subject
+  cannot be resolved, rather than at the authority match. Nothing leaks either
+  way, but the two are not interchangeable: were this grant to gain a subject
+  role whose values come from the request, an undelegated token would reach it.
+- The registry source still receives the person's identifying details. Data
+  minimization here is about what the *caller* learns, not about what the source
+  is asked.
+
+## Why the demonstration needs a certificate
+
+Evidence requires the token issuer and its key set to be HTTPS, with no
+exception for loopback, and Mint expects TLS to be terminated upstream. Rather
+than work around that, `run.sh` issues a throwaway CA and puts a small TLS
+terminator in front of Mint, exactly where your ingress would sit. The CA is
+trusted only by the demonstration's own Evidence process, through `SSL_CERT_FILE`.
+
+## The same property, as a test
+
+Steps 3 and 4 are also asserted in
+[`tests/delegated_subject_binding.rs`](../tests/delegated_subject_binding.rs),
+which loads this same bundle and runs Evidence's own authorization decision over
+a token minted by the real Mint router. The demonstration and the test cannot
+drift: they share `evidence-bundle/`, and the test's constants must match it.
diff --git a/crates/registry-mint/demo/evidence-bundle/adapters/demo-source-prepare.rhai b/crates/registry-mint/demo/evidence-bundle/adapters/demo-source-prepare.rhai
new file mode 100644
index 000000000..691d7c164
--- /dev/null
+++ b/crates/registry-mint/demo/evidence-bundle/adapters/demo-source-prepare.rhai
@@ -0,0 +1,15 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"];
+    #{
+        query: [],
+        body: #{
+            lookup: #{
+                given_name: subject["values"]["given_name"],
+                family_name: subject["values"]["family_name"],
+                birth_date: subject["values"]["birth_date"]
+            },
+            fields: parameters["requestedFields"],
+            limit: parameters["resultLimit"]
+        }
+    }
+}
diff --git a/crates/registry-mint/demo/evidence-bundle/adapters/demo-source.rhai b/crates/registry-mint/demo/evidence-bundle/adapters/demo-source.rhai
new file mode 100644
index 000000000..a2af00768
--- /dev/null
+++ b/crates/registry-mint/demo/evidence-bundle/adapters/demo-source.rhai
@@ -0,0 +1,13 @@
+fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    if total == 0 {
+        if len(source_response) != 1 { throw("source_protocol_error"); }
+        return #{outcome: "no_match"};
+    }
+    if total > 1 { return #{outcome: "ambiguous"}; }
+    let official_residence_code = get_path(source_response, "/official_residence_code");
+    if is_missing(official_residence_code) {
+        return #{outcome: "match", facts: #{}};
+    }
+    #{outcome: "match", facts: #{official_residence_code: official_residence_code}}
+}
diff --git a/crates/registry-mint/demo/evidence-bundle/codelists/region-map.yaml b/crates/registry-mint/demo/evidence-bundle/codelists/region-map.yaml
new file mode 100644
index 000000000..e7bfbbf26
--- /dev/null
+++ b/crates/registry-mint/demo/evidence-bundle/codelists/region-map.yaml
@@ -0,0 +1,6 @@
+id: urn:example:demo:codelist:region-map
+version: '2026-01'
+entries:
+  R-101: REGION-NORTH
+  R-201: REGION-SOUTH
+allowed_outputs: [REGION-NORTH, REGION-SOUTH]
diff --git a/crates/registry-mint/demo/evidence-bundle/derivations/residence-region.rhai b/crates/registry-mint/demo/evidence-bundle/derivations/residence-region.rhai
new file mode 100644
index 000000000..ef3749040
--- /dev/null
+++ b/crates/registry-mint/demo/evidence-bundle/derivations/residence-region.rhai
@@ -0,0 +1,10 @@
+fn derive(facts, selectors, evaluation_context) {
+    let mapped = codelist_lookup(
+        evaluation_context.codelists["region-map"],
+        required(facts.official_residence_code, "required_fact_missing")
+    );
+    [#{
+        concept_id: "urn:example:demo:concept:residence-region",
+        value: required(mapped, "unknown_controlled_code")
+    }]
+}
diff --git a/crates/registry-mint/demo/evidence-bundle/evidence.yaml b/crates/registry-mint/demo/evidence-bundle/evidence.yaml
new file mode 100644
index 000000000..426ac9ffe
--- /dev/null
+++ b/crates/registry-mint/demo/evidence-bundle/evidence.yaml
@@ -0,0 +1,103 @@
+# Demonstration Evidence bundle for delegated, subject-bound access.
+#
+# The one line that matters is `valueOrigin: authenticated-context` under
+# `delegated-agent-v1`. It moves the subject out of the request body and into
+# the access token: Evidence reads the selector from the claims listed in
+# `valueClaims`, and refuses any request that carries selector values of its
+# own. A token minted for one person therefore cannot be pointed at another.
+#
+# Synthetic identifiers only. Nothing here describes a real person or source.
+version: 1
+assuranceProfile: production
+service: {providerId: urn:example:demo:provider:evidence, trustDomain: urn:example:demo:trust-domain:delegation}
+issuer: {id: urn:example:demo:issuer:authority}
+authentication:
+  kind: oidc-access-token
+  # Mint's public origin. Evidence requires HTTPS for both the issuer and the
+  # key set, so the demonstration puts a TLS terminator in front of Mint exactly
+  # as a real deployment would.
+  issuer: https://localhost:8443
+  audiences: [evidence.demo.invalid]
+  tokenTypes: [at+jwt]
+  algorithms: [EdDSA]
+  jwksUri: https://localhost:8443/.well-known/jwks.json
+  principalClaim: sub
+  requesterTagsClaim: evidence_tags
+  evidenceAudienceClaim: evidence_audience
+  grantIdClaim: evidence_grant_id
+  grantAuthorityClaim: evidence_authority
+  # The claim Mint writes the delegated agent into. Its presence is what
+  # confines a token to `kind: delegated` authority profiles.
+  actorClaim: evidence_actor
+audit: {format: keyed-jsonl, hashSecretRef: secret:file/audit-hash-key, hashKeyVersion: 1, failClosed: true}
+subjectBinding: {secretRef: secret:file/subject-binding-key, keyVersion: 1}
+rateLimits: {requestsPerPrincipalPerMinute: 60, burstPerPrincipal: 10, failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 10}
+signing: {format: flattened-jws-json, algorithm: EdDSA, activeKeyId: demo-evidence-key, activeKeyRef: secret:file/signing-key, retiredPublicJwkFiles: [], jwksPath: /.well-known/evidence/jwks.json, maximumAssertionValiditySeconds: 86400, verifierClockSkewSeconds: 30}
+selectorProfiles:
+  demographics-v1:
+    maximumAggregateBytes: 420
+    fields:
+      given_name: {type: string, minimumBytes: 1, maximumBytes: 200}
+      family_name: {type: string, minimumBytes: 1, maximumBytes: 200}
+      birth_date: {type: date}
+sources:
+  demo-source:
+    transport: http-json
+    # The stand-in registry source the demonstration runs on loopback. Evidence
+    # permits plain HTTP only for a numeric loopback host.
+    baseUrl: http://127.0.0.1:8092
+    posture: field-projected
+    authentication: {kind: static-bearer, tokenRef: secret:file/source-token}
+    request:
+      method: POST
+      path: /v1/facts
+      fixedHeaders: [{name: Accept, value: application/json}]
+      selectorInputs:
+        - role: subject
+          alternatives: [{profile: demographics-v1, fields: [given_name, family_name, birth_date]}]
+      prepareScript: adapters/demo-source-prepare.rhai
+      adapterParameters: {requestedFields: [official_residence_code], resultLimit: 2}
+      adapterParametersSchema: schemas/adapter-parameters.schema.yaml
+      preparationLimits: {query: forbidden, jsonBody: required, maximumJsonDepth: 8, maximumCollectionItems: 16, maximumStringBytes: 256, maximumNormalizedBytes: 4096}
+      projection: [/total, /official_residence_code]
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 8
+    responseSchema: schemas/response.schema.yaml
+    extractScript: adapters/demo-source.rhai
+    factSchema: schemas/facts.schema.yaml
+authorityProfiles:
+  delegated-agent-v1:
+    kind: delegated
+    requesterTags: [demo-agent]
+    grants:
+      - requirement: urn:example:demo:requirement:residence-region:v1
+        purpose: demo-routing
+        audienceFrom: authenticated-requester
+        subjects:
+          - role: subject
+            selectorProfile: demographics-v1
+            valueOrigin: authenticated-context
+            valueClaims:
+              given_name: identity.given_name
+              family_name: identity.family_name
+              birth_date: identity.birth_date
+requirements:
+  - id: urn:example:demo:requirement:residence-region:v1
+    kind: information-requirement
+    source: demo-source
+    purposes: [demo-routing]
+    subjectRoles: [{role: subject, cardinality: one, selectorProfiles: [demographics-v1]}]
+    referenceFrameworks: [urn:example:demo:framework:residence-region:v1]
+    evidenceType: urn:example:demo:evidence-type:residence-region:v1
+    validitySeconds: 86400
+    derivation: {script: derivations/residence-region.rhai, parameters: {}}
+    concepts:
+      - id: urn:example:demo:concept:residence-region
+        form: controlled-code
+        required: true
+        constraints: {codelist: codelists/region-map.yaml, codelistVersion: '2026-01', maximumBytes: 32}
+    fixtures: fixtures/cases.yaml
+    disclosureGuard: {families: [urn:example:demo:disclosure-family:residence-region]}
+    existenceDisclosure: collapse-unresolved
diff --git a/crates/registry-mint/demo/evidence-bundle/fixtures/cases.yaml b/crates/registry-mint/demo/evidence-bundle/fixtures/cases.yaml
new file mode 100644
index 000000000..75c140ba3
--- /dev/null
+++ b/crates/registry-mint/demo/evidence-bundle/fixtures/cases.yaml
@@ -0,0 +1,31 @@
+fixture: registry.mint.demo.delegation/v1
+synthetic_only: true
+common:
+  observed_at: '2026-08-02T00:00:00Z'
+  selectors:
+    subject:
+      profile: demographics-v1
+      values: {given_name: Amara, family_name: Okafor, birth_date: '1998-04-02'}
+  expectedRequestParts:
+    query: []
+    body:
+      lookup: {given_name: Amara, family_name: Okafor, birth_date: '1998-04-02'}
+      fields: [official_residence_code]
+      limit: 2
+  expectedTransport:
+    path: /v1/facts
+    fixedHeaders: [{name: Accept, value: application/json}]
+cases:
+  - {id: positive, source: {total: 1, official_residence_code: R-101}, expected_value: REGION-NORTH, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: negative-unknown-code, source: {total: 1, official_residence_code: R-999}, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: negative-overly-precise-output, injected_derivation: [{concept_id: urn:example:demo:concept:residence-region, value: R-101}], expected: output-gate-rejection}
+  - {id: boundary-other-coarse-region, source: {total: 1, official_residence_code: R-201}, expected_value: REGION-SOUTH, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: missing-fact, source: {total: 1}, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: no-match, source: {total: 0}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: ambiguous, source: {total: 2}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: source-failure, source_failure: http-503, expected_public_problem: dependency_unavailable, signed_success: false}
+  - {id: anti-reconstruction, companion_bundle: geographic-overlap, expected: bundle-rejection}
+privacy_expectation:
+  evidence_contains: [urn:example:demo:concept:residence-region, REGION-NORTH]
+  evidence_excludes: [official_residence_code, given_name, family_name, birth_date, R-101]
+  diagnostics_exclude: [Amara, Okafor, '1998-04-02', R-101, REGION-NORTH]
diff --git a/crates/registry-mint/demo/evidence-bundle/schemas/adapter-parameters.schema.yaml b/crates/registry-mint/demo/evidence-bundle/schemas/adapter-parameters.schema.yaml
new file mode 100644
index 000000000..39fc57931
--- /dev/null
+++ b/crates/registry-mint/demo/evidence-bundle/schemas/adapter-parameters.schema.yaml
@@ -0,0 +1,7 @@
+type: object
+additionalProperties: false
+required: [requestedFields, resultLimit]
+properties:
+  requestedFields:
+    const: [official_residence_code]
+  resultLimit: {const: 2}
diff --git a/crates/registry-mint/demo/evidence-bundle/schemas/facts.schema.yaml b/crates/registry-mint/demo/evidence-bundle/schemas/facts.schema.yaml
new file mode 100644
index 000000000..d3e45d7b6
--- /dev/null
+++ b/crates/registry-mint/demo/evidence-bundle/schemas/facts.schema.yaml
@@ -0,0 +1,5 @@
+type: object
+additionalProperties: false
+required: [official_residence_code]
+properties:
+  official_residence_code: {type: string, minLength: 1, maxLength: 32}
diff --git a/crates/registry-mint/demo/evidence-bundle/schemas/response.schema.yaml b/crates/registry-mint/demo/evidence-bundle/schemas/response.schema.yaml
new file mode 100644
index 000000000..70d83308f
--- /dev/null
+++ b/crates/registry-mint/demo/evidence-bundle/schemas/response.schema.yaml
@@ -0,0 +1,6 @@
+type: object
+additionalProperties: false
+required: [total]
+properties:
+  total: {type: integer, minimum: 0, maximum: 1000000}
+  official_residence_code: {type: string, minLength: 1, maxLength: 32}
diff --git a/crates/registry-mint/demo/run.sh b/crates/registry-mint/demo/run.sh
new file mode 100755
index 000000000..71de1e15b
--- /dev/null
+++ b/crates/registry-mint/demo/run.sh
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Start a throwaway Mint and Evidence deployment on loopback, run the delegation
+# walkthrough against them, then tear everything down.
+#
+# Nothing here is the demonstration. `walkthrough.py` is.
+set -euo pipefail
+
+demo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+workspace="$(cd "${demo_dir}/../../.." && pwd)"
+run_dir="${demo_dir}/.run"
+log_dir="${run_dir}/logs"
+
+# The source's bearer token. Generated per run, exported to the two processes
+# that need it, and never printed or passed as an argument.
+DEMO_SOURCE_TOKEN="$(openssl rand -hex 24)"
+export DEMO_SOURCE_TOKEN
+
+pids=()
+cleanup() {
+  for pid in "${pids[@]:-}"; do
+    kill "${pid}" 2>/dev/null || true
+  done
+  wait 2>/dev/null || true
+}
+trap cleanup EXIT
+
+wait_for_port() {
+  local port="$1" name="$2"
+  for _ in $(seq 1 100); do
+    if nc -z 127.0.0.1 "${port}" 2>/dev/null; then
+      return 0
+    fi
+    sleep 0.1
+  done
+  printf 'error: %s never listened on port %s\n' "${name}" "${port}" >&2
+  printf 'see %s/%s.log\n' "${log_dir}" "${name}" >&2
+  return 1
+}
+
+printf '== building mint and evidence\n'
+cargo build --locked --manifest-path "${workspace}/Cargo.toml" \
+  -p registry-mint -p registry-evidence --bins >/dev/null
+
+printf '== provisioning a throwaway deployment in %s\n' "${run_dir}"
+uv run --quiet "${demo_dir}/support/provision.py" "${run_dir}" "${demo_dir}/evidence-bundle" \
+  >/dev/null
+mkdir -p "${log_dir}"
+
+printf '== starting the stand-in registry source, Mint, its TLS front, and Evidence\n'
+uv run --quiet "${demo_dir}/support/mock_source.py" 8092 >"${log_dir}/source.log" 2>&1 &
+pids+=("$!")
+
+"${workspace}/target/debug/mint" serve --config "${run_dir}/mint/mint.yaml" \
+  >"${log_dir}/mint.log" 2>&1 &
+pids+=("$!")
+wait_for_port 8090 mint
+
+uv run --quiet "${demo_dir}/support/tls_front.py" 8443 8090 \
+  "${run_dir}/tls.pem" "${run_dir}/tls.key" >"${log_dir}/tls.log" 2>&1 &
+pids+=("$!")
+
+# Evidence fetches Mint's key set over HTTPS. SSL_CERT_FILE is how the demo's
+# private CA becomes trusted for this process, and only this process.
+SSL_CERT_FILE="${run_dir}/ca.pem" \
+  "${workspace}/target/debug/evidence" --runtime "${run_dir}/evidence/runtime.yaml" serve \
+  >"${log_dir}/evidence.log" 2>&1 &
+pids+=("$!")
+
+wait_for_port 8092 source
+wait_for_port 8443 tls
+wait_for_port 8080 evidence
+
+printf '\n'
+uv run --quiet "${demo_dir}/walkthrough.py" "${run_dir}"
diff --git a/crates/registry-mint/demo/support/mock_source.py b/crates/registry-mint/demo/support/mock_source.py
new file mode 100644
index 000000000..8dada5bd8
--- /dev/null
+++ b/crates/registry-mint/demo/support/mock_source.py
@@ -0,0 +1,65 @@
+#!/usr/bin/env python3
+"""A stand-in registry source for the delegation demonstration.
+
+Deployment plumbing, not part of the security story. Evidence has to call
+*something* to answer a requirement; this is the smallest thing that answers.
+
+It serves one route, `POST /v1/facts`, and answers from a fixed synthetic table.
+Everything it knows is invented.
+"""
+
+import json
+import os
+import sys
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+# Synthetic people, synthetic residence codes. The bundle's codelist maps
+# R-101 to REGION-NORTH and R-201 to REGION-SOUTH.
+RECORDS = {
+    ("Amara", "Okafor", "1998-04-02"): "R-101",
+    ("Kofi", "Mensah", "1971-11-30"): "R-201",
+}
+
+EXPECTED_BEARER = os.environ["DEMO_SOURCE_TOKEN"]
+
+
+class Handler(BaseHTTPRequestHandler):
+    def do_POST(self):
+        if self.path != "/v1/facts":
+            return self.reply(404, {"error": "not_found"})
+        if self.headers.get("Authorization") != f"Bearer {EXPECTED_BEARER}":
+            return self.reply(401, {"error": "unauthorized"})
+
+        length = int(self.headers.get("Content-Length", "0"))
+        body = json.loads(self.rfile.read(length) or b"{}")
+        lookup = body.get("lookup", {})
+        key = (
+            lookup.get("given_name"),
+            lookup.get("family_name"),
+            lookup.get("birth_date"),
+        )
+
+        # Note what the source receives: the person's identifying details, and
+        # nothing about the requirement, the purpose, or the caller.
+        print(f"source  <- lookup for {key[0]} {key[1]}", file=sys.stderr, flush=True)
+
+        code = RECORDS.get(key)
+        if code is None:
+            return self.reply(200, {"total": 0})
+        return self.reply(200, {"total": 1, "official_residence_code": code})
+
+    def reply(self, status, payload):
+        encoded = json.dumps(payload).encode()
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(encoded)))
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def log_message(self, format, *args):  # noqa: A002 - the base class names it
+        pass  # the one line printed in do_POST is the whole log we want
+
+
+if __name__ == "__main__":
+    port = int(sys.argv[1])
+    HTTPServer(("127.0.0.1", port), Handler).serve_forever()
diff --git a/crates/registry-mint/demo/support/provision.py b/crates/registry-mint/demo/support/provision.py
new file mode 100644
index 000000000..88e147941
--- /dev/null
+++ b/crates/registry-mint/demo/support/provision.py
@@ -0,0 +1,264 @@
+#!/usr/bin/env python3
+# /// script
+# requires-python = ">=3.11"
+# dependencies = ["cryptography>=42"]
+# ///
+"""Lay out a throwaway deployment of Mint and Evidence for the demonstration.
+
+Deployment plumbing, not part of the security story: keys, certificates,
+configuration files, and file permissions. The walkthrough in `walkthrough.py`
+is the part worth reading.
+
+Everything this writes is disposable and local. The keys are generated fresh on
+every run and are worthless outside this directory.
+"""
+
+import base64
+import datetime as dt
+import json
+import os
+import secrets
+import shutil
+import stat
+import sys
+from pathlib import Path
+
+from cryptography import x509
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import ed25519
+from cryptography.x509.oid import NameOID
+
+MINT_PORT = 8090
+TLS_PORT = 8443
+EVIDENCE_PORT = 8080
+SOURCE_PORT = 8092
+
+MINT_ORIGIN = f"https://localhost:{TLS_PORT}"
+AGENT = "urn:example:demo:agent:appointment-scheduler"
+
+
+def b64(raw: bytes) -> str:
+    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
+
+
+def ed25519_jwk(kid: str) -> tuple[dict, dict]:
+    """Return (private JWK, public JWK) for a fresh Ed25519 key."""
+    private = ed25519.Ed25519PrivateKey.generate()
+    x = b64(
+        private.public_key().public_bytes(
+            serialization.Encoding.Raw, serialization.PublicFormat.Raw
+        )
+    )
+    d = b64(
+        private.private_bytes(
+            serialization.Encoding.Raw,
+            serialization.PrivateFormat.Raw,
+            serialization.NoEncryption(),
+        )
+    )
+    public_jwk = {"kty": "OKP", "crv": "Ed25519", "kid": kid, "alg": "EdDSA", "x": x}
+    return {**public_jwk, "d": d}, public_jwk
+
+
+def write(path: Path, text: str, mode: int = 0o644) -> Path:
+    """Write a file everyone on the machine may read: certificates, configuration."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(text, encoding="utf-8")
+    path.chmod(mode)
+    return path
+
+
+def write_secret(path: Path, text: str) -> Path:
+    """Write a file that is never wider than owner read/write, not even briefly.
+
+    Creating the file and then narrowing it would leave a freshly generated
+    signing key readable by anyone on the machine for the length of the write.
+    `os.open` carries the mode into the creation; the `chmod` after it only
+    undoes the umask.
+    """
+    path.parent.mkdir(parents=True, exist_ok=True)
+    descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+        handle.write(text)
+    path.chmod(0o600)
+    return path
+
+
+def issue_tls_certificate(root: Path) -> None:
+    """A private CA and one `localhost` server certificate.
+
+    Evidence insists the token issuer and its key set be HTTPS, with no
+    exception for loopback. That is the right default and the demonstration
+    respects it rather than working around it.
+    """
+    now = dt.datetime.now(dt.timezone.utc)
+    ca_key = ed25519.Ed25519PrivateKey.generate()
+    ca_name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "registry-stack demo CA")])
+    ca_certificate = (
+        x509.CertificateBuilder()
+        .subject_name(ca_name)
+        .issuer_name(ca_name)
+        .public_key(ca_key.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(now - dt.timedelta(minutes=5))
+        .not_valid_after(now + dt.timedelta(days=1))
+        .add_extension(x509.BasicConstraints(ca=True, path_length=0), critical=True)
+        .sign(ca_key, None)
+    )
+
+    server_key = ed25519.Ed25519PrivateKey.generate()
+    server_certificate = (
+        x509.CertificateBuilder()
+        .subject_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "localhost")]))
+        .issuer_name(ca_name)
+        .public_key(server_key.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(now - dt.timedelta(minutes=5))
+        .not_valid_after(now + dt.timedelta(days=1))
+        .add_extension(x509.BasicConstraints(ca=False, path_length=None), critical=True)
+        .add_extension(x509.SubjectAlternativeName([x509.DNSName("localhost")]), critical=False)
+        .sign(ca_key, None)
+    )
+
+    pem = serialization.Encoding.PEM
+    write(root / "ca.pem", ca_certificate.public_bytes(pem).decode())
+    write(root / "tls.pem", server_certificate.public_bytes(pem).decode())
+    write_secret(
+        root / "tls.key",
+        server_key.private_bytes(
+            pem, serialization.PrivateFormat.PKCS8, serialization.NoEncryption()
+        ).decode(),
+    )
+
+
+def provision_mint(root: Path) -> None:
+    mint = root / "mint"
+    signing_private, _ = ed25519_jwk("mint-key-1")
+    write_secret(mint / "secrets/signing.jwk", json.dumps(signing_private))
+    write_secret(mint / "secrets/audit-hmac-key", secrets.token_hex(32))
+
+    for client_id in ("scheduler", "service-desk"):
+        private, public = ed25519_jwk(f"{client_id}-key-1")
+        write_secret(root / f"client-keys/{client_id}.jwk", json.dumps(private))
+
+        # `scheduler` is the delegated caller. Its registration is the whole
+        # authorization decision Mint makes: which agents it may act as, and
+        # which selector fields it may bind, at which claim paths.
+        delegation = (
+            "delegation:\n"
+            f"  actors: [{AGENT}]\n"
+            "  subjectClaims:\n"
+            "    given_name: identity.given_name\n"
+            "    family_name: identity.family_name\n"
+            "    birth_date: identity.birth_date\n"
+            if client_id == "scheduler"
+            else ""
+        )
+        write(
+            mint / f"clients/{client_id}.yaml",
+            f"clientId: {client_id}\n"
+            f"principal: urn:example:demo:principal:{client_id}\n"
+            f"evidenceAudience: https://{client_id}.demo.invalid\n"
+            "requesterTags: [demo-agent]\n"
+            f"keys: [{json.dumps(public)}]\n" + delegation,
+        )
+
+    write(
+        mint / "mint.yaml",
+        f"""version: 1
+issuer: {MINT_ORIGIN}
+listener: {{address: 127.0.0.1, port: {MINT_PORT}}}
+signing:
+  algorithm: EdDSA
+  activeKeyId: mint-key-1
+  activeKeyFile: secrets/signing.jwk
+audit:
+  path: audit/mint.jsonl
+  maximumFileBytes: 1073741824
+  hashKeyFile: secrets/audit-hmac-key
+  hashKeyVersion: 1
+accessTokens:
+  audiences: [evidence.demo.invalid]
+  lifetimeSeconds: 300
+  claims:
+    principal: sub
+    requesterTags: evidence_tags
+    evidenceAudience: evidence_audience
+    grantId: evidence_grant_id
+    grantAuthority: evidence_authority
+    actor: evidence_actor
+clientAssertion:
+  audience: {MINT_ORIGIN}/token
+  algorithms: [EdDSA]
+clients:
+  directory: clients
+""",
+    )
+
+
+def provision_evidence(root: Path, bundle_source: Path) -> None:
+    evidence = root / "evidence"
+
+    # Evidence refuses a bundle it could write to, so the copy is frozen.
+    bundle = evidence / "bundle"
+    shutil.copytree(bundle_source, bundle)
+    for path in sorted(bundle.rglob("*"), reverse=True):
+        path.chmod(0o555 if path.is_dir() else 0o444)
+    bundle.chmod(0o555)
+
+    # `secretProviders.file.root` in the runtime file below. The name stays
+    # clear of the word "secret" because this is a directory path, written into
+    # a world-readable configuration file, and a scanner that reads names alone
+    # cannot tell it apart from the material inside it.
+    provider_root = evidence / "secrets"
+    provider_root.mkdir(parents=True, exist_ok=True)
+    provider_root.chmod(0o700)  # Evidence refuses a group- or world-readable root
+
+    signing_private, _ = ed25519_jwk("demo-evidence-key")
+    write_secret(provider_root / "signing-key", json.dumps(signing_private))
+    write_secret(provider_root / "audit-hash-key", secrets.token_hex(32))
+    write_secret(provider_root / "subject-binding-key", secrets.token_hex(32))
+    write_secret(provider_root / "source-token", os.environ["DEMO_SOURCE_TOKEN"])
+
+    (evidence / "audit").mkdir(parents=True, exist_ok=True)
+    write(
+        evidence / "runtime.yaml",
+        f"""version: 1
+bundleDirectory: {bundle}
+listener:
+  bindHost: 127.0.0.1
+  port: {EVIDENCE_PORT}
+  tlsTermination: operator-controlled-upstream
+  trustProxyIdentityHeaders: false
+  maximumRequestBytes: 65536
+  maximumConcurrentRequests: 64
+  requestTimeoutMilliseconds: 10000
+  shutdownGraceMilliseconds: 5000
+secretProviders:
+  file:
+    root: {provider_root}
+auditStorage:
+  path: {evidence / "audit/evidence.jsonl"}
+  maximumFileBytes: 1073741824
+outboundTls:
+  systemRoots: true
+  trustProfiles: {{}}
+""",
+        0o444,  # Evidence refuses a runtime file it could write to
+    )
+
+
+if __name__ == "__main__":
+    root = Path(sys.argv[1]).resolve()
+    bundle_source = Path(sys.argv[2]).resolve()
+    if root.exists():
+        # Frozen directories need their write bit back before removal.
+        for path in sorted(root.rglob("*"), reverse=True):
+            path.chmod(path.stat().st_mode | stat.S_IWUSR)
+        shutil.rmtree(root)
+    root.mkdir(parents=True)
+
+    issue_tls_certificate(root)
+    provision_mint(root)
+    provision_evidence(root, bundle_source)
+    print(f"provisioned {root}")
diff --git a/crates/registry-mint/demo/support/test_provision.py b/crates/registry-mint/demo/support/test_provision.py
new file mode 100644
index 000000000..d4cbf5f2a
--- /dev/null
+++ b/crates/registry-mint/demo/support/test_provision.py
@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+"""Tests for the demonstration's provisioning plumbing.
+
+Only the part that matters outside the demonstration: a private key or a bearer
+token must not exist on disk readable by anyone else, not even for the moment
+between creating the file and narrowing it.
+
+Run with `uv run --with cryptography --no-project python -m unittest
+crates/registry-mint/demo/support/test_provision.py`; the tests skip where
+`cryptography` is unavailable.
+"""
+
+import importlib.util
+import os
+import stat
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+SUPPORT = Path(__file__).resolve().parent
+
+
+def load_module():
+    specification = importlib.util.spec_from_file_location(
+        "demo_provision", SUPPORT / "provision.py"
+    )
+    module = importlib.util.module_from_spec(specification)
+    try:
+        specification.loader.exec_module(module)
+    except ImportError as error:  # pragma: no cover - depends on the environment
+        raise unittest.SkipTest(f"provision.py needs {error.name}") from None
+    return module
+
+
+try:
+    provision = load_module()
+except unittest.SkipTest:  # pragma: no cover - depends on the environment
+    provision = None
+
+
+@unittest.skipIf(provision is None, "cryptography is not installed")
+class SecretFileModeTests(unittest.TestCase):
+    def setUp(self):
+        self.root = Path(tempfile.mkdtemp())
+        previous = os.umask(0)
+        self.addCleanup(os.umask, previous)
+
+    def test_a_secret_is_never_wider_than_owner_read_write(self):
+        path = provision.write_secret(self.root / "signing.jwk", "not-a-real-key")
+
+        self.assertEqual(0o600, stat.S_IMODE(path.stat().st_mode))
+        self.assertEqual("not-a-real-key", path.read_text())
+
+    def test_the_file_is_created_at_its_final_mode_not_narrowed_afterwards(self):
+        modes = []
+        real_open = os.open
+
+        def spy(path, flags, mode, **rest):
+            modes.append(mode)
+            return real_open(path, flags, mode, **rest)
+
+        os.open = spy
+        self.addCleanup(setattr, os, "open", real_open)
+        provision.write_secret(self.root / "audit-hash-key", "not-a-real-key")
+
+        self.assertEqual([0o600], modes)
+
+    def test_ordinary_files_keep_their_readable_mode(self):
+        path = provision.write(self.root / "ca.pem", "not-a-real-certificate")
+
+        self.assertEqual(0o644, stat.S_IMODE(path.stat().st_mode))
+
+
+if __name__ == "__main__":
+    sys.exit(0 if unittest.main(exit=False).result.wasSuccessful() else 1)
diff --git a/crates/registry-mint/demo/support/test_tls_front.py b/crates/registry-mint/demo/support/test_tls_front.py
new file mode 100644
index 000000000..26b7e49da
--- /dev/null
+++ b/crates/registry-mint/demo/support/test_tls_front.py
@@ -0,0 +1,225 @@
+#!/usr/bin/env python3
+"""Tests for the demonstration's TLS front.
+
+The front is deployment plumbing, but it is plumbing in a public repository, so
+the two properties worth pinning are the ones a real ingress would be judged on:
+it forwards only the routes the deployment declares, and it never relays a
+header it cannot write safely.
+"""
+
+import importlib.util
+import shutil
+import socket
+import ssl
+import subprocess
+import sys
+import tempfile
+import threading
+import unittest
+from http.server import ThreadingHTTPServer
+from pathlib import Path
+
+SUPPORT = Path(__file__).resolve().parent
+
+
+def load_module():
+    specification = importlib.util.spec_from_file_location(
+        "demo_tls_front", SUPPORT / "tls_front.py"
+    )
+    module = importlib.util.module_from_spec(specification)
+    specification.loader.exec_module(module)
+    return module
+
+
+tls_front = load_module()
+
+
+class RouteAllowlistTests(unittest.TestCase):
+    def test_declared_routes_forward_to_a_constant_path(self):
+        self.assertEqual("/token", tls_front.route_for("POST", "/token"))
+        self.assertEqual(
+            "/.well-known/jwks.json",
+            tls_front.route_for("GET", "/.well-known/jwks.json"),
+        )
+
+    def test_every_forwarded_path_is_one_this_file_declares(self):
+        for method in ("GET", "POST", "PUT"):
+            for path in ("/token", "/.well-known/jwks.json", "/anything"):
+                forwarded = tls_front.route_for(method, path)
+                if forwarded is not None:
+                    self.assertIn((method, forwarded), tls_front.ROUTES)
+
+    def test_undeclared_routes_are_refused(self):
+        for method, path in (
+            ("GET", "/token"),  # right path, wrong method
+            ("POST", "/.well-known/jwks.json"),
+            ("GET", "/health"),
+            ("GET", "/"),
+            ("GET", "/token/../admin"),
+            ("GET", "http://elsewhere.invalid/token"),  # absolute-form request line
+            ("GET", "//elsewhere.invalid/token"),
+            ("GET", "/.well-known/jwks.json?x=1"),
+        ):
+            with self.subTest(method=method, path=path):
+                self.assertIsNone(tls_front.route_for(method, path))
+
+
+class HeaderValidationTests(unittest.TestCase):
+    def test_ordinary_headers_are_well_formed(self):
+        self.assertTrue(tls_front.well_formed("Content-Type", "application/json"))
+
+    def test_control_characters_are_rejected_in_name_or_value(self):
+        for name, value in (
+            ("X-Demo", "ok\r\nInjected: yes"),
+            ("X-Demo", "ok\nInjected: yes"),
+            ("X-Demo", "ok\r"),
+            ("X-Demo", "ok\x00"),
+            ("X-Demo\r\nInjected", "ok"),
+            ("X-Demo\n", "ok"),
+        ):
+            with self.subTest(name=name, value=value):
+                self.assertFalse(tls_front.well_formed(name, value))
+
+
+class TlsContextTests(unittest.TestCase):
+    def test_the_listener_refuses_anything_below_tls_1_2(self):
+        certificate, key = write_self_signed()
+        context = tls_front.tls_context(certificate, key)
+        self.assertEqual(ssl.TLSVersion.TLSv1_2, context.minimum_version)
+
+
+class ForwardingTests(unittest.TestCase):
+    """End to end over real sockets, with a stub standing in for Mint."""
+
+    def setUp(self):
+        self.upstream = StubUpstream()
+        self.upstream.start()
+        self.addCleanup(self.upstream.stop)
+
+        tls_front.UPSTREAM_PORT = self.upstream.port
+        self.front = ThreadingHTTPServer(("127.0.0.1", 0), tls_front.Handler)
+        threading.Thread(target=self.front.serve_forever, daemon=True).start()
+        self.addCleanup(self.front.server_close)  # cleanups run last-registered first
+        self.addCleanup(self.front.shutdown)
+        self.port = self.front.server_address[1]
+
+    def request(self, raw: bytes) -> bytes:
+        # `Connection: close` so the read below ends at end of message rather
+        # than waiting out the keep-alive.
+        raw = raw[: -len(b"\r\n\r\n")] + b"\r\nConnection: close\r\n\r\n"
+        with socket.create_connection(("127.0.0.1", self.port), timeout=5) as client:
+            client.sendall(raw)
+            chunks = []
+            while True:
+                chunk = client.recv(4096)
+                if not chunk:
+                    return b"".join(chunks)
+                chunks.append(chunk)
+
+    def test_a_declared_route_round_trips(self):
+        self.upstream.reply = (
+            b"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\n"
+            b"Content-Length: 2\r\n\r\n{}"
+        )
+        response = self.request(
+            b"GET /.well-known/jwks.json HTTP/1.1\r\nHost: localhost\r\n\r\n"
+        )
+        self.assertIn(b"200 OK", response)
+        self.assertIn(b"{}", response)
+        self.assertEqual(["/.well-known/jwks.json"], self.upstream.seen)
+
+    def test_an_undeclared_route_never_reaches_the_upstream(self):
+        response = self.request(b"GET /health HTTP/1.1\r\nHost: localhost\r\n\r\n")
+        self.assertIn(b"404", response)
+        self.assertEqual([], self.upstream.seen)
+
+    def test_a_request_header_carrying_a_control_character_is_refused(self):
+        response = self.request(
+            b"GET /.well-known/jwks.json HTTP/1.1\r\nHost: localhost\r\n"
+            b"X-Demo: first\r\n\tsecond\r\n\r\n"
+        )
+        self.assertIn(b"400", response)
+        self.assertEqual([], self.upstream.seen)
+
+    def test_an_upstream_header_that_cannot_be_written_safely_is_not_relayed(self):
+        # An obs-folded header: `http.client` hands this back with the newline
+        # still in the value, and writing it out verbatim would split the
+        # response.
+        self.upstream.reply = (
+            b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n"
+            b"X-Demo: first\r\n\tsecond\r\n\r\n{}"
+        )
+        response = self.request(
+            b"GET /.well-known/jwks.json HTTP/1.1\r\nHost: localhost\r\n\r\n"
+        )
+        self.assertIn(b"502", response)
+        self.assertNotIn(b"second", response)
+
+
+class StubUpstream:
+    """A raw socket server so a test can send bytes `http.server` would refuse."""
+
+    def __init__(self):
+        self.reply = b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}"
+        self.seen: list[str] = []
+        self.socket = socket.socket()
+        self.socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        self.socket.bind(("127.0.0.1", 0))
+        self.socket.listen(8)
+        self.port = self.socket.getsockname()[1]
+        self.running = True
+
+    def start(self):
+        threading.Thread(target=self.serve, daemon=True).start()
+
+    def serve(self):
+        while self.running:
+            try:
+                connection, _ = self.socket.accept()
+            except OSError:
+                return
+            with connection:
+                connection.settimeout(5)
+                try:
+                    request = connection.recv(65536)
+                except OSError:
+                    continue
+                if not request:
+                    continue
+                self.seen.append(request.split(b" ")[1].decode())
+                connection.sendall(self.reply)
+
+    def stop(self):
+        self.running = False
+        self.socket.close()
+
+
+def write_self_signed() -> tuple[str, str]:
+    """A throwaway certificate and key, via `openssl`.
+
+    The demonstration's own provisioning uses `cryptography`, but nothing in
+    this repository's continuous integration installs it, and a test that skips
+    is a test that does not hold. `openssl` is already what `run.sh` reaches for
+    and is present wherever this suite runs.
+    """
+    openssl = shutil.which("openssl")
+    if openssl is None:  # pragma: no cover - depends on the environment
+        raise unittest.SkipTest("openssl is not installed")
+
+    directory = Path(tempfile.mkdtemp())
+    certificate_path = directory / "tls.pem"
+    key_path = directory / "tls.key"
+    subprocess.run(
+        [
+            openssl, "req", "-x509", "-newkey", "ed25519", "-noenc",
+            "-days", "1", "-subj", "/CN=localhost",
+            "-keyout", str(key_path), "-out", str(certificate_path),
+        ],
+        check=True,
+        capture_output=True,
+    )
+    return str(certificate_path), str(key_path)
+
+
+if __name__ == "__main__":
+    sys.exit(0 if unittest.main(exit=False).result.wasSuccessful() else 1)
diff --git a/crates/registry-mint/demo/support/tls_front.py b/crates/registry-mint/demo/support/tls_front.py
new file mode 100644
index 000000000..242d7a74e
--- /dev/null
+++ b/crates/registry-mint/demo/support/tls_front.py
@@ -0,0 +1,139 @@
+#!/usr/bin/env python3
+"""A TLS terminator in front of Mint, for the delegation demonstration.
+
+Deployment plumbing, not part of the security story. Mint speaks plain HTTP and
+expects an operator-controlled TLS front, and Evidence refuses a non-HTTPS token
+issuer, so the demonstration supplies one. In production this is your ingress.
+
+It forwards to Mint on loopback and adds nothing. What it does do is what an
+ingress is expected to do: publish only the routes the deployment declares, and
+refuse anything it cannot pass on without changing the shape of a message.
+"""
+
+import http.client
+import json
+import ssl
+import sys
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+# The only routes this deployment puts through the front: Mint's key set, which
+# Evidence fetches, and its token endpoint, which the client posts to. Mint's
+# other routes stay on loopback.
+ROUTES = (
+    ("GET", "/.well-known/jwks.json"),
+    ("POST", "/token"),
+)
+
+# Hop-by-hop headers belong to one connection and are not relayed onto the next.
+NOT_RELAYED = ("transfer-encoding", "connection", "content-length")
+
+# A header carrying one of these would end the header block early, so the front
+# refuses the message rather than passing on something it cannot write intact.
+CONTROL_CHARACTERS = ("\r", "\n", "\x00")
+
+UPSTREAM_PORT = None
+
+
+def route_for(method: str, path: str) -> str | None:
+    """The upstream path for a request, or `None` if the front does not serve it.
+
+    The value returned is one of this file's own literals, never the caller's
+    request line: the target of the upstream request is fixed here and cannot be
+    steered from outside.
+    """
+    for allowed_method, allowed_path in ROUTES:
+        if method == allowed_method and path == allowed_path:
+            return allowed_path
+    return None
+
+
+def well_formed(name: str, value: str) -> bool:
+    """Whether a header can be relayed without changing the message's framing."""
+    return not any(
+        character in name or character in value for character in CONTROL_CHARACTERS
+    )
+
+
+def tls_context(certificate: str, key: str) -> ssl.SSLContext:
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    # An ingress sets its own floor rather than inheriting whatever the runtime
+    # happens to allow.
+    context.minimum_version = ssl.TLSVersion.TLSv1_2
+    context.load_cert_chain(certificate, key)
+    return context
+
+
+class Handler(BaseHTTPRequestHandler):
+    protocol_version = "HTTP/1.1"
+
+    def do_GET(self):
+        self.forward("GET", None)
+
+    def do_POST(self):
+        length = int(self.headers.get("Content-Length", "0"))
+        self.forward("POST", self.rfile.read(length))
+
+    def forward(self, method, body):
+        target = route_for(method, self.path)
+        if target is None:
+            self.refuse(404, "no such route")
+            return
+
+        headers = {
+            name: value
+            for name, value in self.headers.items()
+            if name.lower() not in ("host", "connection")
+        }
+        if not all(well_formed(name, value) for name, value in headers.items()):
+            self.refuse(400, "request header carried a control character")
+            return
+
+        upstream = http.client.HTTPConnection("127.0.0.1", UPSTREAM_PORT, timeout=10)
+        try:
+            upstream.request(method, target, body=body, headers=headers)
+            response = upstream.getresponse()
+            payload = response.read()
+            status = response.status
+            relayed = [
+                (name, value)
+                for name, value in response.getheaders()
+                if name.lower() not in NOT_RELAYED
+            ]
+        finally:
+            upstream.close()
+
+        if not all(well_formed(name, value) for name, value in relayed):
+            self.refuse(502, "upstream header carried a control character")
+            return
+
+        self.send_response(status)
+        for name, value in relayed:
+            self.send_header(name, value)
+        self.send_header("Content-Length", str(len(payload)))
+        self.end_headers()
+        self.wfile.write(payload)
+
+    def refuse(self, status, reason):
+        payload = json.dumps({"error": reason}).encode()
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(payload)))
+        self.end_headers()
+        self.wfile.write(payload)
+
+    def log_message(self, format, *args):  # noqa: A002 - the base class names it
+        pass
+
+
+if __name__ == "__main__":
+    listen_port, UPSTREAM_PORT, certificate, key = (
+        int(sys.argv[1]),
+        int(sys.argv[2]),
+        sys.argv[3],
+        sys.argv[4],
+    )
+    server = ThreadingHTTPServer(("127.0.0.1", listen_port), Handler)
+    server.socket = tls_context(certificate, key).wrap_socket(
+        server.socket, server_side=True
+    )
+    server.serve_forever()
diff --git a/crates/registry-mint/demo/walkthrough.py b/crates/registry-mint/demo/walkthrough.py
new file mode 100644
index 000000000..81ea29b85
--- /dev/null
+++ b/crates/registry-mint/demo/walkthrough.py
@@ -0,0 +1,311 @@
+#!/usr/bin/env python3
+# /// script
+# requires-python = ">=3.11"
+# dependencies = ["cryptography>=42", "requests>=2.31"]
+# ///
+"""Delegated, subject-bound access, end to end.
+
+An agent needs to know which region one person lives in. It must not be able to
+learn that about anyone else, even if the agent's own code is wrong.
+
+  1. The client signs a request for a token, naming the agent it is acting as
+     and the person it is acting for.
+  2. Mint checks that request against the client's registration and issues a
+     token carrying both.
+  3. The client asks Evidence for evidence, and does not name the person.
+  4. The client tries to name a different person, and cannot.
+
+Two further steps show the refusals that hold that shape up: what Mint will not
+issue, and what a token without a delegation cannot reach.
+
+Every request below is printed before it is sent. Run it with:
+
+    crates/registry-mint/demo/run.sh
+"""
+
+import base64
+import json
+import secrets
+import sys
+from pathlib import Path
+
+import requests
+from cryptography.hazmat.primitives.asymmetric import ed25519
+
+MINT = "https://localhost:8443"
+EVIDENCE = "http://127.0.0.1:8080"
+
+REQUIREMENT = "urn:example:demo:requirement:residence-region:v1"
+PURPOSE = "demo-routing"
+AGENT = "urn:example:demo:agent:appointment-scheduler"
+
+AMARA = {"given_name": "Amara", "family_name": "Okafor", "birth_date": "1998-04-02"}
+KOFI = {"given_name": "Kofi", "family_name": "Mensah", "birth_date": "1971-11-30"}
+
+
+# --------------------------------------------------------------------------
+# Step 1: the client assertion.
+#
+# The client authenticates to Mint with a JWT it signs with its own key
+# (RFC 7523 `private_key_jwt`). There is no shared secret to leak, and Mint
+# holds only public keys.
+#
+# The delegation request rides *inside* that JWT, in `on_behalf_of`. That
+# placement is the point: the actor and the subject are covered by the client's
+# signature, so nothing between the client and Mint can alter who the token is
+# for.
+# --------------------------------------------------------------------------
+
+
+def build_client_assertion(client_id, private_key, jti, on_behalf_of=None):
+    claims = {
+        "iss": client_id,
+        "sub": client_id,
+        "aud": f"{MINT}/token",
+        "iat": now(),
+        "exp": now() + 120,
+        "jti": jti,  # Mint refuses a second assertion with the same jti
+    }
+    if on_behalf_of is not None:
+        claims["on_behalf_of"] = on_behalf_of
+
+    announce("the client assertion the client is about to sign", claims)
+    return sign_jwt({"alg": "EdDSA", "typ": "JWT", "kid": private_key["kid"]}, claims,
+                    private_key)
+
+
+# --------------------------------------------------------------------------
+# Step 2: the token request.
+#
+# Mint verifies the signature against the keys registered for this client, then
+# checks the delegation request against the same registration: is this an actor
+# the client may act as, and are these exactly the selector fields it may bind?
+# Neither answer comes from the request.
+# --------------------------------------------------------------------------
+
+
+def request_token(assertion):
+    form = {
+        "grant_type": "client_credentials",
+        "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+        "client_assertion": assertion,
+    }
+    announce(f"POST {MINT}/token", {**form, "client_assertion": "<the JWT above>"})
+    return requests.post(f"{MINT}/token", data=form, verify=CA, timeout=10)
+
+
+# --------------------------------------------------------------------------
+# Step 3: the evidence request.
+#
+# Note what is *not* in this body: the person. The bundle declares the subject's
+# `valueOrigin` as `authenticated-context`, so Evidence reads the selector out
+# of the token's claims and refuses to read it from the request.
+# --------------------------------------------------------------------------
+
+
+def request_evidence(token, subject_values=None):
+    selector = {"profile": "demographics-v1"}
+    if subject_values is not None:
+        selector["values"] = subject_values
+    body = {
+        # A caller-generated correlation value. Evidence echoes it into the
+        # assertion and keeps it away from authorization, sources, and audit.
+        "requestNonce": request_nonce(),
+        "requirement": REQUIREMENT,
+        "purpose": PURPOSE,
+        "subjects": [{"role": "subject", "selector": selector}],
+    }
+    announce(f"POST {EVIDENCE}/v1/evidence", body, header="Authorization: Bearer <the token>")
+    return requests.post(
+        f"{EVIDENCE}/v1/evidence",
+        json=body,
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=30,
+    )
+
+
+def main(run_dir):
+    global CA
+    CA = str(run_dir / "ca.pem")
+    scheduler = load_jwk(run_dir / "client-keys/scheduler.jwk")
+    service_desk = load_jwk(run_dir / "client-keys/service-desk.jwk")
+
+    heading("1. The client asks Mint for a token to act for one person")
+    assertion = build_client_assertion(
+        "scheduler",
+        scheduler,
+        "demo-1",
+        on_behalf_of={"actor": AGENT, "subject": AMARA},
+    )
+    response = request_token(assertion)
+    expect(response, 200)
+    token = response.json()["access_token"]
+
+    heading("2. What Mint put in the token")
+    claims = decode_jwt_claims(token)
+    show(claims)
+    note(
+        "`evidence_actor` says who is acting. `identity.*` says who they are acting for.",
+        "Both were checked against the client's registration, not taken on trust.",
+    )
+
+    heading("3. The client asks Evidence for evidence, naming no one")
+    response = request_evidence(token)
+    expect(response, 200)
+    show(decode_evidence(response.json()))
+    note(
+        "Evidence resolved the subject from the token, called the source, and",
+        "returned a coarse region. The person's name and their residence code",
+        "are in neither the request nor the answer. The subject appears only as",
+        "an opaque binding that cannot be reversed into a name.",
+    )
+
+    heading("4. The same token, pointed at somebody else")
+    response = request_evidence(token, subject_values=KOFI)
+    expect(response, 400)
+    show(response.json())
+    note(
+        "This is the containment. A bug in the client that puts the wrong person",
+        "in the request body does not reach that person: Evidence refuses the",
+        "request for carrying selector values at all, not for carrying the wrong",
+        "ones. There is no request this token can make about Kofi Mensah.",
+    )
+
+    heading("5. Mint refuses what it was not asked to allow")
+    for jti, description, client_id, key, on_behalf_of in (
+        (
+            "demo-wrong-actor",
+            "an actor this client may not act as",
+            "scheduler",
+            scheduler,
+            {"actor": "urn:example:demo:agent:someone-else", "subject": AMARA},
+        ),
+        (
+            "demo-undelegated",
+            "a client with no delegation in its registration",
+            "service-desk",
+            service_desk,
+            {"actor": AGENT, "subject": AMARA},
+        ),
+        (
+            "demo-extra-field",
+            "a subject carrying a field the registration does not bind",
+            "scheduler",
+            scheduler,
+            {"actor": AGENT, "subject": {**AMARA, "national_id": "synthetic-1"}},
+        ),
+    ):
+        response = request_token(
+            build_client_assertion(client_id, key, jti, on_behalf_of=on_behalf_of)
+        )
+        expect(response, 401)
+        print(f"  refused: {description} -> {response.status_code} {response.json()}\n")
+
+    heading("6. And an undelegated token cannot use the delegated grant")
+    response = request_token(build_client_assertion("service-desk", service_desk, "demo-plain"))
+    expect(response, 200)
+    plain_token = response.json()["access_token"]
+    note(
+        "This token is valid and carries the same requester tag. It simply has no",
+        "`evidence_actor` and no `identity.*`, so there is no subject to resolve.",
+    )
+    response = request_evidence(plain_token)
+    expect(response, 400)
+    show(response.json())
+    note(
+        "Worth being precise about the shape of this refusal. Evidence confines",
+        "an actor-bearing token to `kind: delegated` authority profiles, but it",
+        "does not require an actor to reach one. So this token matches the grant",
+        "and is stopped when the subject cannot be resolved, rather than at the",
+        "authority match. Nothing leaks either way.",
+    )
+
+    print("\nAll six steps behaved as described.")
+
+
+# --------------------------------------------------------------------------
+# Below here is only formatting and JWT mechanics. Nothing decides anything.
+# --------------------------------------------------------------------------
+
+
+def now():
+    import time
+
+    return int(time.time())
+
+
+def b64url(raw: bytes) -> str:
+    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
+
+
+def request_nonce() -> str:
+    """32 random bytes, base64url without padding. Evidence rejects anything else."""
+    return b64url(secrets.token_bytes(32))
+
+
+def unb64url(text: str) -> bytes:
+    return base64.urlsafe_b64decode(text + "=" * (-len(text) % 4))
+
+
+def load_jwk(path: Path) -> dict:
+    return json.loads(path.read_text())
+
+
+def sign_jwt(header: dict, claims: dict, private_jwk: dict) -> str:
+    key = ed25519.Ed25519PrivateKey.from_private_bytes(unb64url(private_jwk["d"]))
+    signing_input = ".".join(
+        b64url(json.dumps(part, separators=(",", ":")).encode()) for part in (header, claims)
+    )
+    return f"{signing_input}.{b64url(key.sign(signing_input.encode()))}"
+
+
+def decode_jwt_claims(token: str) -> dict:
+    """Read the claims without verifying. Evidence verifies; this only shows."""
+    return json.loads(unb64url(token.split(".")[1]))
+
+
+def decode_evidence(assertion: dict) -> dict:
+    """Show the signed evidence assertion's payload rather than its base64.
+
+    A verifier would check the signature over `protected` and `payload` against
+    Evidence's published key set. This only makes the answer legible.
+    """
+    return {
+        "protected": json.loads(unb64url(assertion["protected"])),
+        "payload": json.loads(unb64url(assertion["payload"])),
+        "signature": assertion["signature"][:16] + "...",
+    }
+
+
+def heading(text):
+    print(f"\n{'=' * 76}\n{text}\n{'=' * 76}")
+
+
+def announce(what, payload, header=None):
+    print(f"\n  {what}")
+    if header:
+        print(f"    {header}")
+    for line in json.dumps(payload, indent=2).splitlines():
+        print(f"    {line}")
+    print()
+
+
+def show(payload):
+    for line in json.dumps(payload, indent=2).splitlines():
+        print(f"    {line}")
+
+
+def note(*lines):
+    print()
+    for line in lines:
+        print(f"  -> {line}")
+
+
+def expect(response, status):
+    if response.status_code != status:
+        print(f"\nunexpected {response.status_code}: {response.text}", file=sys.stderr)
+        raise SystemExit(1)
+
+
+if __name__ == "__main__":
+    main(Path(sys.argv[1]).resolve())
diff --git a/crates/registry-mint/src/assertion.rs b/crates/registry-mint/src/assertion.rs
new file mode 100644
index 000000000..6ed81be25
--- /dev/null
+++ b/crates/registry-mint/src/assertion.rs
@@ -0,0 +1,1053 @@
+//! RFC 7523 `private_key_jwt` client authentication.
+//!
+//! The single most important property in this module is that an assertion is
+//! verified against **only the keys registered for the client it claims to be**.
+//!
+//! The alternative, pooling every client key into one JWK set, is what makes
+//! distributing signing keys unsafe: key selection happens by `kid`, which the
+//! signer chooses, and nothing downstream re-checks which key was used against
+//! the claims that were signed. In a pooled set, client A signs with A's key,
+//! writes `iss: client-b`, and verification succeeds. Selecting the key set by
+//! the asserted client id *before* verifying removes that move entirely: A's
+//! key simply is not in B's set, so the signature fails.
+//!
+//! Everything else here is bounding: strict structural preflight, an audience
+//! bound to this endpoint, a bounded assertion lifetime, and single-use `jti`.
+
+use std::{collections::BTreeMap, sync::Arc, time::Duration};
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use registry_platform_canonical_json::parse_json_strict;
+use registry_platform_oidc::{JwksFetcher, JwksFetcherConfig, TokenVerifier, TokenVerifierConfig};
+use serde_json::Value;
+
+use crate::{
+    clients::{ClientRegistry, Delegation, RegisteredClient},
+    config::ClientAssertionConfig,
+    error::TokenError,
+    replay::{ReplayCache, ReplayError},
+    ON_BEHALF_OF_CLAIM,
+};
+
+/// Bounds chosen so a hostile caller cannot make Mint allocate before any
+/// signature has been checked.
+const MAX_ASSERTION_BYTES: usize = 16 * 1024;
+const MAX_HEADER_BYTES: usize = 8 * 1024;
+const MAX_CLAIMS_BYTES: usize = 8 * 1024;
+const MAX_CLIENT_ID_BYTES: usize = 256;
+const MAX_JTI_BYTES: usize = 256;
+/// Evidence rejects an actor longer than this, and a selector value longer than
+/// this could not satisfy any selector profile.
+const MAX_DELEGATION_VALUE_BYTES: usize = 512;
+
+/// Tolerance for clock difference between a caller and Mint. Applied to the
+/// assertion's own `exp` and `nbf`, not to the tokens Mint issues.
+const CLOCK_SKEW_SECONDS: i64 = 30;
+
+/// `JWT` is the conventional RFC 7523 assertion type. The explicit type is
+/// accepted too, for callers that prefer unambiguous typing.
+const ALLOWED_ASSERTION_TYP: [&str; 2] = ["JWT", "client-assertion+jwt"];
+
+/// The parsed but *unverified* surface of an assertion, used only to decide
+/// which client's keys to verify against.
+struct AssertionPreflight {
+    claims: Value,
+}
+
+/// A delegation request that the registry permits, ready to be minted.
+///
+/// Every value here came from the signed assertion and was then checked against
+/// the client's registration: the actor against its permitted set, and the
+/// subject against the exact selector fields it declared. Nothing unbounded or
+/// undeclared survives into this type.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct ResolvedDelegation {
+    actor: String,
+    /// Selector field to its value, keyed exactly as the registration declared.
+    subject: BTreeMap<String, Value>,
+}
+
+impl ResolvedDelegation {
+    /// Crate-internal because the type's meaning is that its contents already
+    /// passed [`build_delegation`]; nothing outside this crate may assert one.
+    pub(crate) fn new(actor: String, subject: BTreeMap<String, Value>) -> Self {
+        Self { actor, subject }
+    }
+
+    #[must_use]
+    pub fn actor(&self) -> &str {
+        &self.actor
+    }
+
+    #[must_use]
+    pub fn subject(&self) -> &BTreeMap<String, Value> {
+        &self.subject
+    }
+}
+
+/// An authenticated client, and the delegation it authenticated for.
+#[derive(Clone, Debug)]
+pub struct AuthenticatedClient {
+    pub client: Arc<RegisteredClient>,
+    pub delegation: Option<ResolvedDelegation>,
+}
+
+/// Authenticates client assertions against a registry snapshot.
+///
+/// One verifier is built per registered client at construction time, each bound
+/// to that client's own static JWK set.
+pub struct ClientAuthenticator {
+    registry: Arc<ClientRegistry>,
+    verifiers: BTreeMap<String, Arc<TokenVerifier>>,
+    maximum_lifetime_seconds: i64,
+    replay: Arc<ReplayCache>,
+}
+
+impl std::fmt::Debug for ClientAuthenticator {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("ClientAuthenticator")
+            .field("clients", &self.verifiers.len())
+            .field("maximum_lifetime_seconds", &self.maximum_lifetime_seconds)
+            .finish_non_exhaustive()
+    }
+}
+
+impl ClientAuthenticator {
+    /// Build one verifier per registered client.
+    ///
+    /// The `replay` cache is passed in rather than created here so that
+    /// reloading the registry never forgets spent assertion identifiers.
+    #[must_use]
+    pub fn new(
+        registry: Arc<ClientRegistry>,
+        config: &ClientAssertionConfig,
+        replay: Arc<ReplayCache>,
+    ) -> Self {
+        let algorithms = config
+            .algorithms
+            .iter()
+            .map(|algorithm| algorithm.as_jsonwebtoken())
+            .collect::<Vec<_>>();
+        let allowed_typ = ALLOWED_ASSERTION_TYP.map(ToOwned::to_owned).to_vec();
+
+        let mut verifiers = BTreeMap::new();
+        for client_id in registry.client_ids() {
+            let client = registry
+                .get(client_id)
+                .expect("client id came from this registry");
+            // The static set holds this client's public keys and nothing else.
+            let fetcher = Arc::new(JwksFetcher::new_static(
+                client.jwks().clone(),
+                JwksFetcherConfig::defaults(),
+            ));
+            let verifier_config = TokenVerifierConfig::access_token_profile(
+                // An assertion issues from the client itself.
+                client_id.to_owned(),
+                vec![config.audience.clone()],
+                algorithms.clone(),
+                allowed_typ.clone(),
+            )
+            .with_leeway(Duration::from_secs(CLOCK_SKEW_SECONDS.unsigned_abs()));
+            verifiers.insert(
+                client_id.to_owned(),
+                Arc::new(TokenVerifier::new(verifier_config, fetcher)),
+            );
+        }
+
+        Self {
+            registry,
+            verifiers,
+            maximum_lifetime_seconds: config.maximum_lifetime_seconds as i64,
+            replay,
+        }
+    }
+
+    #[must_use]
+    pub fn registry(&self) -> &Arc<ClientRegistry> {
+        &self.registry
+    }
+
+    /// Authenticate a client assertion and return the client it proves.
+    ///
+    /// The returned client is the registry entry, which is where all authority
+    /// is read from. The one thing carried forward from the assertion payload
+    /// is the delegation request, and only after the registry has confirmed
+    /// that this client may delegate, to that actor, over exactly those subject
+    /// fields.
+    pub async fn authenticate(
+        &self,
+        assertion: &str,
+        now: i64,
+    ) -> Result<AuthenticatedClient, TokenError> {
+        let preflight = preflight(assertion)?;
+        let client_id = asserted_client_id(&preflight.claims)?;
+
+        // Selecting the key set before verifying is the whole point: an
+        // unknown client never reaches a signature check, and a known one is
+        // checked against its own keys only.
+        let client = self
+            .registry
+            .get(client_id)
+            .ok_or_else(|| TokenError::invalid_client("unknown client"))?;
+        let verifier = self
+            .verifiers
+            .get(client_id)
+            .ok_or_else(|| TokenError::server_error("registry and verifiers disagree"))?;
+
+        let verified = verifier
+            .verify(assertion)
+            .await
+            .map_err(|_| TokenError::invalid_client("assertion signature or claims rejected"))?;
+
+        // RFC 7523 section 3: for client authentication the subject is the
+        // client itself. Without this an assertion could name a different
+        // subject while still being signed by a legitimate client key.
+        let subject = verified
+            .claims
+            .sub
+            .as_deref()
+            .ok_or_else(|| TokenError::invalid_client("assertion has no subject"))?;
+        if subject != client_id {
+            return Err(TokenError::invalid_client(
+                "assertion subject does not match its issuer",
+            ));
+        }
+
+        let issued_at = verified
+            .claims
+            .iat
+            .ok_or_else(|| TokenError::invalid_client("assertion has no issued-at"))?;
+        let expires_at = verified
+            .claims
+            .exp
+            .ok_or_else(|| TokenError::invalid_client("assertion has no expiry"))?;
+        // A long-lived assertion is a long-lived bearer credential. Bound it
+        // regardless of what the caller chose.
+        if expires_at <= issued_at
+            || expires_at.saturating_sub(issued_at) > self.maximum_lifetime_seconds
+        {
+            return Err(TokenError::invalid_client(
+                "assertion lifetime exceeds the configured maximum",
+            ));
+        }
+        // The verifier also checks expiry, but against its own read of the
+        // system clock. Freshness, the replay window, and the audit record must
+        // agree on one instant, so they are all decided against `now`.
+        if expires_at.saturating_add(CLOCK_SKEW_SECONDS) <= now {
+            return Err(TokenError::invalid_client("assertion has expired"));
+        }
+        if issued_at.saturating_sub(CLOCK_SKEW_SECONDS) > now {
+            return Err(TokenError::invalid_client("assertion is not yet issued"));
+        }
+
+        // Resolved before the assertion is spent so a rejected delegation does
+        // not burn the caller's jti.
+        let delegation = resolve_delegation(client, &verified.claims.extra)?;
+
+        let jti = verified
+            .claims
+            .extra
+            .get("jti")
+            .and_then(Value::as_str)
+            .ok_or_else(|| TokenError::invalid_client("assertion has no jti"))?;
+        if jti.is_empty() || jti.len() > MAX_JTI_BYTES {
+            return Err(TokenError::invalid_client("assertion jti is not bounded"));
+        }
+        // Namespaced by client so two clients choosing the same jti do not
+        // lock each other out.
+        let replay_key = format!("{client_id}\u{0}{jti}");
+        // Remembered past `exp` by the same skew the freshness check tolerates.
+        // Forgetting it at `exp` would leave a window in which the assertion is
+        // still accepted but no longer recorded as spent.
+        self.replay
+            .remember(
+                &replay_key,
+                expires_at.saturating_add(CLOCK_SKEW_SECONDS),
+                now,
+            )
+            .map_err(|error| match error {
+                ReplayError::AlreadyUsed => TokenError::invalid_client("assertion already used"),
+                ReplayError::Saturated => TokenError::server_error("replay cache saturated"),
+                ReplayError::Poisoned => TokenError::server_error("replay cache poisoned"),
+            })?;
+
+        Ok(AuthenticatedClient {
+            client: Arc::clone(client),
+            delegation,
+        })
+    }
+}
+
+/// Reconcile the delegation the assertion asks for with the one the registry
+/// permits.
+///
+/// Both directions fail closed. A client with no registered delegation cannot
+/// obtain an actor or a bound subject by asking for one, and a client that *is*
+/// registered for delegation cannot obtain an ordinary unbounded token by
+/// omitting the request. The second half is what stops a delegated caller
+/// quietly widening its own reach.
+fn resolve_delegation(
+    client: &RegisteredClient,
+    claims: &serde_json::Map<String, Value>,
+) -> Result<Option<ResolvedDelegation>, TokenError> {
+    let requested = claims.get(ON_BEHALF_OF_CLAIM);
+    match (client.delegation(), requested) {
+        (None, None) => Ok(None),
+        (None, Some(_)) => Err(TokenError::invalid_client(
+            "client is not registered to act on behalf of a subject",
+        )),
+        (Some(_), None) => Err(TokenError::invalid_client(
+            "a delegated client must name the actor and subject it acts for",
+        )),
+        (Some(registered), Some(requested)) => Ok(Some(build_delegation(registered, requested)?)),
+    }
+}
+
+fn build_delegation(
+    registered: &Delegation,
+    requested: &Value,
+) -> Result<ResolvedDelegation, TokenError> {
+    let invalid = |reason: &'static str| TokenError::invalid_client(reason);
+
+    let requested = requested
+        .as_object()
+        .ok_or_else(|| invalid("the delegation request is malformed"))?;
+    // An unrecognized member would be silently dropped, leaving the caller
+    // believing it constrained something it did not.
+    if requested.len() != 2 || !requested.contains_key("actor") {
+        return Err(invalid("the delegation request is malformed"));
+    }
+
+    let actor = requested
+        .get("actor")
+        .and_then(Value::as_str)
+        .ok_or_else(|| invalid("the delegation request is malformed"))?;
+    if actor.trim().is_empty() || actor.len() > MAX_DELEGATION_VALUE_BYTES {
+        return Err(invalid("the delegated actor is not bounded"));
+    }
+    if !registered.permits_actor(actor) {
+        return Err(invalid("the client may not act as this actor"));
+    }
+
+    let subject = requested
+        .get("subject")
+        .and_then(Value::as_object)
+        .ok_or_else(|| invalid("the delegation request is malformed"))?;
+    // Exactly the declared fields: a missing one would leave the resource
+    // server unable to resolve the subject, and an extra one would be minted
+    // nowhere while looking to the caller as though it had been honoured.
+    if subject.len() != registered.subject_claims.len() {
+        return Err(invalid(
+            "the delegated subject does not match its registration",
+        ));
+    }
+    let mut resolved = BTreeMap::new();
+    for field in registered.subject_claims.keys() {
+        let value = subject
+            .get(field)
+            .ok_or_else(|| invalid("the delegated subject does not match its registration"))?;
+        resolved.insert(field.clone(), bounded_selector_value(value)?);
+    }
+
+    Ok(ResolvedDelegation::new(actor.to_owned(), resolved))
+}
+
+/// The value shapes a resource server can read back out as a selector value.
+fn bounded_selector_value(value: &Value) -> Result<Value, TokenError> {
+    match value {
+        Value::String(text) if !text.is_empty() && text.len() <= MAX_DELEGATION_VALUE_BYTES => {
+            Ok(value.clone())
+        }
+        Value::Bool(_) => Ok(value.clone()),
+        // Only integers survive a JSON round trip into a selector value.
+        Value::Number(number) if number.is_i64() => Ok(value.clone()),
+        _ => Err(TokenError::invalid_client(
+            "a delegated subject value is not a bounded string, integer, or boolean",
+        )),
+    }
+}
+
+/// Structural validation performed before any allocation-heavy or
+/// cryptographic work, mirroring the strictness Evidence applies to bearer
+/// tokens.
+fn preflight(assertion: &str) -> Result<AssertionPreflight, TokenError> {
+    let malformed = || TokenError::invalid_client("assertion is malformed");
+
+    if assertion.is_empty() || assertion.len() > MAX_ASSERTION_BYTES {
+        return Err(malformed());
+    }
+    let segments = assertion.split('.').collect::<Vec<_>>();
+    if segments.len() != 3 || segments.iter().any(|segment| segment.is_empty()) {
+        return Err(malformed());
+    }
+
+    let header = decode_segment(segments[0], MAX_HEADER_BYTES)?;
+    if !header.is_object() {
+        return Err(malformed());
+    }
+    let claims = decode_segment(segments[1], MAX_CLAIMS_BYTES)?;
+    if !claims.is_object() {
+        return Err(malformed());
+    }
+    // A present but undecodable or empty signature is malformed regardless of
+    // what the verifier would later say about it.
+    let signature = URL_SAFE_NO_PAD
+        .decode(segments[2])
+        .map_err(|_| malformed())?;
+    if signature.is_empty() {
+        return Err(malformed());
+    }
+
+    Ok(AssertionPreflight { claims })
+}
+
+/// Decode one base64url segment into strictly parsed JSON.
+///
+/// `parse_json_strict` rejects duplicate members, so a header or claim set that
+/// says one thing to a lenient parser and another to a strict one cannot get
+/// past this point.
+fn decode_segment(segment: &str, maximum_bytes: usize) -> Result<Value, TokenError> {
+    let malformed = || TokenError::invalid_client("assertion is malformed");
+    if segment.len() > maximum_bytes {
+        return Err(malformed());
+    }
+    let bytes = URL_SAFE_NO_PAD.decode(segment).map_err(|_| malformed())?;
+    if bytes.len() > maximum_bytes {
+        return Err(malformed());
+    }
+    parse_json_strict(&bytes).map_err(|_| malformed())
+}
+
+fn asserted_client_id(claims: &Value) -> Result<&str, TokenError> {
+    let issuer = claims
+        .get("iss")
+        .and_then(Value::as_str)
+        .ok_or_else(|| TokenError::invalid_client("assertion has no issuer"))?;
+    if issuer.is_empty() || issuer.len() > MAX_CLIENT_ID_BYTES {
+        return Err(TokenError::invalid_client(
+            "assertion issuer is not bounded",
+        ));
+    }
+    Ok(issuer)
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+    use crate::config::Algorithm;
+    use serde_json::json;
+
+    // Deterministic per-seed Ed25519 keys so tests can hold several distinct
+    // client identities at once.
+    pub(crate) fn test_key(seed: u8) -> (registry_platform_crypto::PrivateJwk, Value) {
+        let seed_bytes = [seed; 32];
+        let signing = ed25519_dalek::SigningKey::from_bytes(&seed_bytes);
+        let x = URL_SAFE_NO_PAD.encode(signing.verifying_key().to_bytes());
+        let d = URL_SAFE_NO_PAD.encode(seed_bytes);
+        let kid = format!("key-{seed}");
+        let private = registry_platform_crypto::PrivateJwk::parse(
+            &json!({"kty": "OKP", "crv": "Ed25519", "kid": kid, "alg": "EdDSA", "x": x, "d": d})
+                .to_string(),
+        )
+        .expect("test private JWK parses");
+        let public = json!({"kty": "OKP", "crv": "Ed25519", "kid": kid, "alg": "EdDSA", "x": x});
+        (private, public)
+    }
+
+    fn sign_assertion(
+        private: &registry_platform_crypto::PrivateJwk,
+        typ: &str,
+        claims: &Value,
+    ) -> String {
+        let kid = private.kid.clone().expect("test key has a kid");
+        let header = json!({"alg": "EdDSA", "typ": typ, "kid": kid});
+        let encode = |value: &Value| {
+            URL_SAFE_NO_PAD.encode(serde_json::to_vec(value).expect("value serializes"))
+        };
+        let signing_input = format!("{}.{}", encode(&header), encode(claims));
+        let signature = registry_platform_crypto::sign(signing_input.as_bytes(), private)
+            .expect("test key signs");
+        format!("{signing_input}.{}", URL_SAFE_NO_PAD.encode(signature))
+    }
+
+    const AUDIENCE: &str = "https://mint.example.org/token";
+    const NOW: i64 = 1_800_000_000;
+
+    fn assertion_claims(client_id: &str, jti: &str) -> Value {
+        json!({
+            "iss": client_id,
+            "sub": client_id,
+            "aud": AUDIENCE,
+            "iat": NOW,
+            "exp": NOW + 120,
+            "jti": jti,
+        })
+    }
+
+    fn registry_with(clients: &[(&str, &Value)]) -> Arc<ClientRegistry> {
+        registry_of(
+            &clients
+                .iter()
+                .map(|(id, key)| (*id, *key, ""))
+                .collect::<Vec<_>>(),
+        )
+    }
+
+    /// Each entry is a client id, its public key, and any extra registration
+    /// lines (a `delegation:` block, in these tests).
+    fn registry_of(clients: &[(&str, &Value, &str)]) -> Arc<ClientRegistry> {
+        let directory = tempfile::tempdir().expect("temp dir");
+        for (client_id, public, extra) in clients {
+            let document = format!(
+                "clientId: {client_id}\nprincipal: urn:example:{client_id}\nevidenceAudience: https://{client_id}.example.org\nrequesterTags: [tag-{client_id}]\nkeys: [{public}]\n{extra}"
+            );
+            std::fs::write(directory.path().join(format!("{client_id}.yaml")), document)
+                .expect("write client registration");
+        }
+        Arc::new(ClientRegistry::load(directory.path()).expect("registry loads"))
+    }
+
+    fn authenticator(registry: Arc<ClientRegistry>) -> ClientAuthenticator {
+        let config = ClientAssertionConfig {
+            audience: AUDIENCE.to_owned(),
+            maximum_lifetime_seconds: 300,
+            algorithms: vec![Algorithm::EdDSA],
+            replay_cache_entries: 256,
+        };
+        ClientAuthenticator::new(registry, &config, Arc::new(ReplayCache::new(256)))
+    }
+
+    #[tokio::test]
+    async fn a_valid_assertion_authenticates_its_client() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_with(&[("client-a", &public)]));
+        let assertion = sign_assertion(&private, "JWT", &assertion_claims("client-a", "jti-1"));
+
+        let authenticated = authenticator
+            .authenticate(&assertion, NOW)
+            .await
+            .expect("valid assertion authenticates");
+        assert_eq!(authenticated.client.client_id(), "client-a");
+        assert_eq!(authenticated.client.principal(), "urn:example:client-a");
+        assert_eq!(authenticated.delegation, None);
+    }
+
+    /// The core security property. Client A holds a real, registered key. It
+    /// cannot use that key to speak as client B.
+    #[tokio::test]
+    async fn one_clients_key_cannot_sign_an_assertion_for_another_client() {
+        let (private_a, public_a) = test_key(1);
+        let (_private_b, public_b) = test_key(2);
+        let authenticator = authenticator(registry_with(&[
+            ("client-a", &public_a),
+            ("client-b", &public_b),
+        ]));
+
+        // A signs an assertion that claims to be B.
+        let forged = sign_assertion(&private_a, "JWT", &assertion_claims("client-b", "jti-1"));
+
+        let error = authenticator
+            .authenticate(&forged, NOW)
+            .await
+            .expect_err("a forged assertion must be rejected");
+        assert_eq!(
+            error,
+            TokenError::invalid_client("assertion signature or claims rejected")
+        );
+    }
+
+    /// Even naming its own kid does not help: the kid is looked up inside the
+    /// asserted client's key set, where A's key does not exist.
+    #[tokio::test]
+    async fn naming_a_foreign_kid_does_not_reach_another_clients_key_set() {
+        let (private_a, public_a) = test_key(1);
+        let (_private_b, public_b) = test_key(2);
+        let authenticator = authenticator(registry_with(&[
+            ("client-a", &public_a),
+            ("client-b", &public_b),
+        ]));
+
+        let mut claims = assertion_claims("client-b", "jti-1");
+        claims["sub"] = json!("client-b");
+        let forged = sign_assertion(&private_a, "JWT", &claims);
+        assert!(authenticator.authenticate(&forged, NOW).await.is_err());
+    }
+
+    #[tokio::test]
+    async fn an_unknown_client_is_rejected_before_any_signature_check() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_with(&[("client-a", &public)]));
+        let assertion = sign_assertion(&private, "JWT", &assertion_claims("client-z", "jti-1"));
+
+        let error = authenticator
+            .authenticate(&assertion, NOW)
+            .await
+            .expect_err("unknown clients are rejected");
+        assert_eq!(error, TokenError::invalid_client("unknown client"));
+    }
+
+    #[tokio::test]
+    async fn the_subject_must_equal_the_issuer() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_with(&[("client-a", &public)]));
+        let mut claims = assertion_claims("client-a", "jti-1");
+        claims["sub"] = json!("someone-else");
+        let assertion = sign_assertion(&private, "JWT", &claims);
+
+        let error = authenticator
+            .authenticate(&assertion, NOW)
+            .await
+            .expect_err("a mismatched subject is rejected");
+        assert_eq!(
+            error,
+            TokenError::invalid_client("assertion subject does not match its issuer")
+        );
+    }
+
+    #[tokio::test]
+    async fn an_assertion_is_single_use() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_with(&[("client-a", &public)]));
+        let assertion = sign_assertion(&private, "JWT", &assertion_claims("client-a", "jti-1"));
+
+        assert!(authenticator.authenticate(&assertion, NOW).await.is_ok());
+        let error = authenticator
+            .authenticate(&assertion, NOW)
+            .await
+            .expect_err("a replayed assertion is rejected");
+        assert_eq!(error, TokenError::invalid_client("assertion already used"));
+    }
+
+    /// Freshness tolerates clock skew, so an assertion stays acceptable for a
+    /// short window past its own `exp`. The replay record has to outlive that
+    /// window: if it expired first, a captured assertion would become
+    /// replayable exactly as it was about to stop being useful.
+    #[tokio::test]
+    async fn an_assertion_stays_single_use_for_as_long_as_it_stays_acceptable() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_with(&[("client-a", &public)]));
+        let assertion = sign_assertion(&private, "JWT", &assertion_claims("client-a", "jti-1"));
+
+        assert!(authenticator.authenticate(&assertion, NOW).await.is_ok());
+
+        // One second past `exp`, still inside the accepted skew window.
+        let error = authenticator
+            .authenticate(&assertion, NOW + 121)
+            .await
+            .expect_err("a replayed assertion is rejected while it is still accepted");
+        assert_eq!(error, TokenError::invalid_client("assertion already used"));
+
+        // Past the window the assertion is refused on freshness instead, so the
+        // replay record has no further work to do.
+        let error = authenticator
+            .authenticate(&assertion, NOW + 151)
+            .await
+            .expect_err("an assertion past the skew window is refused");
+        assert_eq!(error, TokenError::invalid_client("assertion has expired"));
+    }
+
+    #[tokio::test]
+    async fn two_clients_may_use_the_same_jti_value() {
+        let (private_a, public_a) = test_key(1);
+        let (private_b, public_b) = test_key(2);
+        let authenticator = authenticator(registry_with(&[
+            ("client-a", &public_a),
+            ("client-b", &public_b),
+        ]));
+
+        let from_a = sign_assertion(&private_a, "JWT", &assertion_claims("client-a", "shared"));
+        let from_b = sign_assertion(&private_b, "JWT", &assertion_claims("client-b", "shared"));
+        assert!(authenticator.authenticate(&from_a, NOW).await.is_ok());
+        assert!(authenticator.authenticate(&from_b, NOW).await.is_ok());
+    }
+
+    #[tokio::test]
+    async fn an_assertion_for_another_audience_is_rejected() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_with(&[("client-a", &public)]));
+        let mut claims = assertion_claims("client-a", "jti-1");
+        claims["aud"] = json!("https://another-service.example.org/token");
+        let assertion = sign_assertion(&private, "JWT", &claims);
+
+        assert!(authenticator.authenticate(&assertion, NOW).await.is_err());
+    }
+
+    #[tokio::test]
+    async fn expired_and_over_long_assertions_are_rejected() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_with(&[("client-a", &public)]));
+
+        let mut expired = assertion_claims("client-a", "jti-1");
+        expired["iat"] = json!(NOW - 400);
+        expired["exp"] = json!(NOW - 300);
+        let assertion = sign_assertion(&private, "JWT", &expired);
+        assert_eq!(
+            authenticator
+                .authenticate(&assertion, NOW)
+                .await
+                .expect_err("an expired assertion is rejected"),
+            TokenError::invalid_client("assertion has expired")
+        );
+
+        let mut ahead = assertion_claims("client-a", "jti-3");
+        ahead["iat"] = json!(NOW + 400);
+        ahead["exp"] = json!(NOW + 500);
+        let assertion = sign_assertion(&private, "JWT", &ahead);
+        assert_eq!(
+            authenticator
+                .authenticate(&assertion, NOW)
+                .await
+                .expect_err("an assertion issued in the future is rejected"),
+            TokenError::invalid_client("assertion is not yet issued")
+        );
+
+        let mut over_long = assertion_claims("client-a", "jti-2");
+        over_long["exp"] = json!(NOW + 4_000);
+        let assertion = sign_assertion(&private, "JWT", &over_long);
+        let error = authenticator
+            .authenticate(&assertion, NOW)
+            .await
+            .expect_err("an over-long assertion is rejected");
+        assert_eq!(
+            error,
+            TokenError::invalid_client("assertion lifetime exceeds the configured maximum")
+        );
+    }
+
+    #[tokio::test]
+    async fn an_assertion_without_a_jti_is_rejected() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_with(&[("client-a", &public)]));
+        let mut claims = assertion_claims("client-a", "jti-1");
+        claims.as_object_mut().expect("claims object").remove("jti");
+        let assertion = sign_assertion(&private, "JWT", &claims);
+
+        let error = authenticator
+            .authenticate(&assertion, NOW)
+            .await
+            .expect_err("a jti is required");
+        assert_eq!(error, TokenError::invalid_client("assertion has no jti"));
+    }
+
+    #[tokio::test]
+    async fn an_unsigned_or_malformed_assertion_never_reaches_the_registry() {
+        let authenticator = authenticator(registry_with(&[("client-a", &test_key(1).1)]));
+        let header = URL_SAFE_NO_PAD.encode(br#"{"alg":"none","typ":"JWT","kid":"key-1"}"#);
+        let claims = URL_SAFE_NO_PAD
+            .encode(serde_json::to_vec(&assertion_claims("client-a", "jti-1")).expect("claims"));
+
+        for candidate in [
+            String::new(),
+            "not-a-jwt".to_owned(),
+            "a.b".to_owned(),
+            "a.b.c.d".to_owned(),
+            format!("{header}.{claims}."),
+            format!("{header}..x"),
+            format!("{header}.{claims}.!!!"),
+        ] {
+            let error = authenticator
+                .authenticate(&candidate, NOW)
+                .await
+                .expect_err("malformed assertions are rejected");
+            assert_eq!(error, TokenError::invalid_client("assertion is malformed"));
+        }
+    }
+
+    #[tokio::test]
+    async fn duplicate_json_members_are_rejected_by_the_strict_preflight() {
+        let (private, _public) = test_key(1);
+        let public = test_key(1).1;
+        let authenticator = authenticator(registry_with(&[("client-a", &public)]));
+
+        // Two `iss` members: a lenient parser would take one, a strict parser
+        // refuses to guess.
+        let raw_claims = format!(
+            r#"{{"iss":"client-a","iss":"client-b","sub":"client-a","aud":"{AUDIENCE}","iat":{NOW},"exp":{},"jti":"jti-1"}}"#,
+            NOW + 120
+        );
+        let header = URL_SAFE_NO_PAD.encode(br#"{"alg":"EdDSA","typ":"JWT","kid":"key-1"}"#);
+        let claims = URL_SAFE_NO_PAD.encode(raw_claims.as_bytes());
+        let signing_input = format!("{header}.{claims}");
+        let signature = registry_platform_crypto::sign(signing_input.as_bytes(), &private)
+            .expect("test key signs");
+        let assertion = format!("{signing_input}.{}", URL_SAFE_NO_PAD.encode(signature));
+
+        let error = authenticator
+            .authenticate(&assertion, NOW)
+            .await
+            .expect_err("duplicate members are rejected");
+        assert_eq!(error, TokenError::invalid_client("assertion is malformed"));
+    }
+
+    const DELEGATION: &str = "delegation:\n  actors: [urn:example:agent-one, urn:example:agent-two]\n  subjectClaims:\n    given_name: identity.given_name\n    birth_date: identity.birth_date\n";
+
+    fn on_behalf_of(jti: &str, request: Value) -> Value {
+        let mut claims = assertion_claims("client-a", jti);
+        claims[ON_BEHALF_OF_CLAIM] = request;
+        claims
+    }
+
+    fn subject_request() -> Value {
+        json!({
+            "actor": "urn:example:agent-one",
+            "subject": {"given_name": "Amara", "birth_date": "1998-04-02"},
+        })
+    }
+
+    /// A delegated assertion carries the actor and the subject; both survive
+    /// only because the registration named them.
+    #[tokio::test]
+    async fn a_delegated_assertion_resolves_the_actor_and_subject_it_names() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_of(&[("client-a", &public, DELEGATION)]));
+        let assertion = sign_assertion(&private, "JWT", &on_behalf_of("jti-1", subject_request()));
+
+        let authenticated = authenticator
+            .authenticate(&assertion, NOW)
+            .await
+            .expect("a permitted delegation authenticates");
+        let delegation = authenticated.delegation.expect("delegation resolved");
+        assert_eq!(delegation.actor(), "urn:example:agent-one");
+        assert_eq!(
+            delegation.subject(),
+            &BTreeMap::from([
+                ("birth_date".to_owned(), json!("1998-04-02")),
+                ("given_name".to_owned(), json!("Amara")),
+            ])
+        );
+    }
+
+    /// Asking is not enough. Delegation is a property of the registration.
+    #[tokio::test]
+    async fn a_client_with_no_registered_delegation_cannot_ask_for_one() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_with(&[("client-a", &public)]));
+        let assertion = sign_assertion(&private, "JWT", &on_behalf_of("jti-1", subject_request()));
+
+        let error = authenticator
+            .authenticate(&assertion, NOW)
+            .await
+            .expect_err("an undelegated client is refused");
+        assert_eq!(
+            error,
+            TokenError::invalid_client("client is not registered to act on behalf of a subject")
+        );
+    }
+
+    /// The other direction, and the one that is easy to miss: if omitting the
+    /// request produced an ordinary token, a delegated caller could widen its
+    /// own reach from one subject to every subject by leaving out a claim.
+    #[tokio::test]
+    async fn a_delegated_client_cannot_widen_itself_by_omitting_the_request() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_of(&[("client-a", &public, DELEGATION)]));
+        let assertion = sign_assertion(&private, "JWT", &assertion_claims("client-a", "jti-1"));
+
+        let error = authenticator
+            .authenticate(&assertion, NOW)
+            .await
+            .expect_err("a delegated client must name its subject");
+        assert_eq!(
+            error,
+            TokenError::invalid_client(
+                "a delegated client must name the actor and subject it acts for"
+            )
+        );
+    }
+
+    #[tokio::test]
+    async fn an_actor_outside_the_registered_set_is_refused() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_of(&[("client-a", &public, DELEGATION)]));
+        let mut request = subject_request();
+        request["actor"] = json!("urn:example:agent-three");
+        let assertion = sign_assertion(&private, "JWT", &on_behalf_of("jti-1", request));
+
+        let error = authenticator
+            .authenticate(&assertion, NOW)
+            .await
+            .expect_err("an unregistered actor is refused");
+        assert_eq!(
+            error,
+            TokenError::invalid_client("the client may not act as this actor")
+        );
+    }
+
+    /// Without an `actors` list the client names its own actor, so the actor is
+    /// an audit label rather than a bound. The subject binding is unaffected.
+    #[tokio::test]
+    async fn an_open_actor_list_still_binds_the_subject() {
+        let (private, public) = test_key(1);
+        let open = "delegation:\n  subjectClaims:\n    given_name: identity.given_name\n    birth_date: identity.birth_date\n";
+        let authenticator = authenticator(registry_of(&[("client-a", &public, open)]));
+        let mut request = subject_request();
+        request["actor"] = json!("urn:example:anything");
+        let assertion = sign_assertion(&private, "JWT", &on_behalf_of("jti-1", request));
+
+        let authenticated = authenticator
+            .authenticate(&assertion, NOW)
+            .await
+            .expect("any actor is permitted");
+        let delegation = authenticated.delegation.expect("delegation resolved");
+        assert_eq!(delegation.actor(), "urn:example:anything");
+        assert_eq!(delegation.subject().len(), 2);
+    }
+
+    /// A missing field would leave the resource server unable to resolve the
+    /// subject; an extra one would be minted nowhere while looking to the caller
+    /// as though it had been honoured.
+    #[tokio::test]
+    async fn the_subject_must_carry_exactly_the_registered_fields() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_of(&[("client-a", &public, DELEGATION)]));
+
+        let mut missing = subject_request();
+        missing["subject"] = json!({"given_name": "Amara"});
+        let mut extra = subject_request();
+        extra["subject"] = json!({
+            "given_name": "Amara",
+            "birth_date": "1998-04-02",
+            "national_id": "some-identifier",
+        });
+        let mut renamed = subject_request();
+        renamed["subject"] = json!({"given_name": "Amara", "family_name": "Okafor"});
+
+        for (index, request) in [missing, extra, renamed].into_iter().enumerate() {
+            let assertion = sign_assertion(
+                &private,
+                "JWT",
+                &on_behalf_of(&format!("jti-{index}"), request),
+            );
+            let error = authenticator
+                .authenticate(&assertion, NOW)
+                .await
+                .expect_err("a mismatched subject is refused");
+            assert_eq!(
+                error,
+                TokenError::invalid_client("the delegated subject does not match its registration")
+            );
+        }
+    }
+
+    /// Only the shapes a resource server can read back out as a selector value.
+    #[tokio::test]
+    async fn a_subject_value_that_is_not_a_selector_value_is_refused() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_of(&[("client-a", &public, DELEGATION)]));
+
+        for (index, value) in [
+            json!(null),
+            json!(""),
+            json!(1.5),
+            json!(["Amara"]),
+            json!({"value": "Amara"}),
+            json!("x".repeat(513)),
+        ]
+        .into_iter()
+        .enumerate()
+        {
+            let mut request = subject_request();
+            request["subject"] = json!({"given_name": value, "birth_date": "1998-04-02"});
+            let assertion = sign_assertion(
+                &private,
+                "JWT",
+                &on_behalf_of(&format!("jti-{index}"), request),
+            );
+            let error = authenticator
+                .authenticate(&assertion, NOW)
+                .await
+                .expect_err("an unusable subject value is refused");
+            assert_eq!(
+                error,
+                TokenError::invalid_client(
+                    "a delegated subject value is not a bounded string, integer, or boolean"
+                )
+            );
+        }
+
+        // Integers and booleans are selector values, so they are accepted.
+        let mut numeric = subject_request();
+        numeric["subject"] = json!({"given_name": 42, "birth_date": true});
+        let assertion = sign_assertion(&private, "JWT", &on_behalf_of("jti-ok", numeric));
+        assert!(authenticator.authenticate(&assertion, NOW).await.is_ok());
+    }
+
+    /// A malformed request must not cost the caller its `jti`: the delegation is
+    /// reconciled before the assertion is spent, so correcting the request and
+    /// retrying works.
+    #[tokio::test]
+    async fn a_refused_delegation_does_not_spend_the_assertion() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_of(&[("client-a", &public, DELEGATION)]));
+
+        let mut wrong = subject_request();
+        wrong["actor"] = json!("urn:example:agent-three");
+        let refused = sign_assertion(&private, "JWT", &on_behalf_of("jti-1", wrong));
+        assert!(authenticator.authenticate(&refused, NOW).await.is_err());
+
+        // Same jti, corrected request.
+        let corrected = sign_assertion(&private, "JWT", &on_behalf_of("jti-1", subject_request()));
+        assert!(authenticator.authenticate(&corrected, NOW).await.is_ok());
+    }
+
+    #[tokio::test]
+    async fn a_structurally_malformed_delegation_request_is_refused() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_of(&[("client-a", &public, DELEGATION)]));
+
+        let mut unknown_member = subject_request();
+        unknown_member["scope"] = json!("everything");
+        let mut no_subject = subject_request();
+        no_subject
+            .as_object_mut()
+            .expect("request object")
+            .remove("subject");
+
+        for (index, request) in [
+            json!("urn:example:agent-one"),
+            json!([{"actor": "urn:example:agent-one"}]),
+            json!({"subject": {"given_name": "Amara", "birth_date": "1998-04-02"}}),
+            json!({"actor": "urn:example:agent-one", "subject": "Amara"}),
+            unknown_member,
+            no_subject,
+        ]
+        .into_iter()
+        .enumerate()
+        {
+            let assertion = sign_assertion(
+                &private,
+                "JWT",
+                &on_behalf_of(&format!("jti-{index}"), request),
+            );
+            let error = authenticator
+                .authenticate(&assertion, NOW)
+                .await
+                .expect_err("a malformed delegation request is refused");
+            assert_eq!(
+                error,
+                TokenError::invalid_client("the delegation request is malformed")
+            );
+        }
+
+        let mut blank_actor = subject_request();
+        blank_actor["actor"] = json!("   ");
+        let assertion = sign_assertion(&private, "JWT", &on_behalf_of("jti-blank", blank_actor));
+        assert_eq!(
+            authenticator
+                .authenticate(&assertion, NOW)
+                .await
+                .expect_err("a blank actor is refused"),
+            TokenError::invalid_client("the delegated actor is not bounded")
+        );
+    }
+
+    #[tokio::test]
+    async fn an_access_token_type_is_not_accepted_as_a_client_assertion() {
+        let (private, public) = test_key(1);
+        let authenticator = authenticator(registry_with(&[("client-a", &public)]));
+        let assertion = sign_assertion(&private, "at+jwt", &assertion_claims("client-a", "jti-1"));
+
+        assert!(authenticator.authenticate(&assertion, NOW).await.is_err());
+    }
+}
diff --git a/crates/registry-mint/src/audit.rs b/crates/registry-mint/src/audit.rs
new file mode 100644
index 000000000..cdf1ea842
--- /dev/null
+++ b/crates/registry-mint/src/audit.rs
@@ -0,0 +1,374 @@
+//! Fail-closed Mint audit over one durable, segmented keyed JSONL chain.
+
+use registry_platform_audit::{
+    verify_segmented_audit_chain, AuditChainHasher, AuditEnvelope, AuditError, AuditHashSecret,
+    AuditKeyHasher, ChainState, DurableSegmentedJsonlSink,
+};
+use registry_platform_canonical_json::canonicalize_json;
+use serde::Serialize;
+use thiserror::Error;
+
+use crate::{
+    assertion::AuthenticatedClient,
+    config::AuditConfig,
+    secretfile::{self, SecretFileError},
+    token::MintedToken,
+};
+
+const AUDIT_SCHEMA: &str = "registry.mint.audit/v1";
+
+#[derive(Debug, Error)]
+pub enum MintAuditError {
+    #[error("the audit hash key could not be read")]
+    Secret(#[source] SecretFileError),
+    #[error("the audit chain could not be initialized or written")]
+    Audit(#[from] AuditError),
+    #[error("an audit-safe reference could not be constructed")]
+    Reference,
+    #[error(
+        "sealed segment {sequence} is archived or missing from the chain; this is not corruption"
+    )]
+    SegmentMissing { sequence: u64 },
+}
+
+#[derive(Debug, Clone, Copy, Serialize)]
+#[serde(rename_all = "kebab-case")]
+enum AuditPhase {
+    TokenRelease,
+    Denial,
+}
+
+#[derive(Debug, Clone, Copy, Serialize)]
+#[serde(rename_all = "kebab-case")]
+enum AuditDecision {
+    Issued,
+    Rejected,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct MintAuditEvent {
+    schema: &'static str,
+    operation: String,
+    phase: AuditPhase,
+    decision: AuditDecision,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    client_pseudonym: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    authority_pseudonym: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    actor_pseudonym: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    subject_pseudonym: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    token_id: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    signing_key_id: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    expires_at_unix: Option<i64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    delegated: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    safe_error_category: Option<String>,
+}
+
+/// Minimal operator report returned by `mint verify-audit`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct MintAuditSummary {
+    pub segments: usize,
+    pub records: usize,
+    pub last_hash: Option<[u8; 32]>,
+    pub first_sequence: Option<u64>,
+    pub last_sequence: Option<u64>,
+    pub active_verified: bool,
+}
+
+/// Process-lifetime Mint audit boundary.
+pub struct MintAuditLog {
+    sink: DurableSegmentedJsonlSink,
+    chain: ChainState,
+    key_hasher: AuditKeyHasher,
+    key_version: u32,
+    scope: String,
+}
+
+impl std::fmt::Debug for MintAuditLog {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("MintAuditLog")
+            .field("path", &self.sink.path())
+            .field("key_version", &self.key_version)
+            .finish_non_exhaustive()
+    }
+}
+
+impl MintAuditLog {
+    pub async fn initialize(config: &AuditConfig, issuer: &str) -> Result<Self, MintAuditError> {
+        let secret =
+            secretfile::read_owner_only(&config.hash_key_file).map_err(MintAuditError::Secret)?;
+        let secret = AuditHashSecret::new(secret.as_bytes().to_vec())?;
+        let chain_hasher = AuditChainHasher::keyed(secret.clone());
+        let key_hasher = AuditKeyHasher::Keyed(secret);
+        let sink = DurableSegmentedJsonlSink::open(config.path.clone(), config.maximum_file_bytes)?;
+        let chain = ChainState::bootstrap_or_start_empty(&sink, chain_hasher).await?;
+        Ok(Self {
+            sink,
+            chain,
+            key_hasher,
+            key_version: config.hash_key_version,
+            scope: issuer.to_owned(),
+        })
+    }
+
+    /// Check the audit configuration without taking the serving writer lock.
+    ///
+    /// `mint check` reads a configuration while the deployment it describes is
+    /// usually still serving, and the chain admits one writer for the life of
+    /// that process. Opening the sink here would report a healthy deployment
+    /// back as a broken one. The hash key is what a misconfigured deployment
+    /// actually gets wrong, and reading it takes nothing the writer holds.
+    pub fn check(config: &AuditConfig) -> Result<(), MintAuditError> {
+        let secret =
+            secretfile::read_owner_only(&config.hash_key_file).map_err(MintAuditError::Secret)?;
+        AuditHashSecret::new(secret.as_bytes().to_vec())?;
+        Ok(())
+    }
+
+    /// Verify the retained chain without taking the serving writer lock.
+    pub fn verify(config: &AuditConfig) -> Result<MintAuditSummary, MintAuditError> {
+        let secret =
+            secretfile::read_owner_only(&config.hash_key_file).map_err(MintAuditError::Secret)?;
+        let secret = AuditHashSecret::new(secret.as_bytes().to_vec())?;
+        let summary = verify_segmented_audit_chain(&config.path, &AuditChainHasher::keyed(secret))
+            .map_err(|error| match error {
+                AuditError::SegmentMissing { sequence } => {
+                    MintAuditError::SegmentMissing { sequence }
+                }
+                error => MintAuditError::Audit(error),
+            })?;
+        Ok(MintAuditSummary {
+            segments: summary.segments,
+            records: summary.records,
+            last_hash: summary.last_hash,
+            first_sequence: summary.first_sequence,
+            last_sequence: summary.last_sequence,
+            active_verified: summary.active_verified,
+        })
+    }
+
+    pub async fn append_issued(
+        &self,
+        operation: &str,
+        authenticated: &AuthenticatedClient,
+        token: &MintedToken,
+    ) -> Result<AuditEnvelope, MintAuditError> {
+        let client_pseudonym = self.pseudonym("client", authenticated.client.client_id())?;
+        let grant = authenticated
+            .client
+            .grant()
+            .map(|grant| serde_json::json!({"id": grant.id, "authority": grant.authority}));
+        let authority = serde_json::json!({
+            "principal": authenticated.client.principal(),
+            "evidenceAudience": authenticated.client.evidence_audience(),
+            "requesterTags": authenticated.client.requester_tags(),
+            "grant": grant,
+        });
+        let authority = canonicalize_json(&authority).map_err(|_| MintAuditError::Reference)?;
+        let authority = String::from_utf8(authority).map_err(|_| MintAuditError::Reference)?;
+        let authority_pseudonym = self.pseudonym("authority", &authority)?;
+        let (actor_pseudonym, subject_pseudonym) = match &authenticated.delegation {
+            Some(delegation) => {
+                let actor = self.pseudonym("actor", delegation.actor())?;
+                let subject = serde_json::to_value(delegation.subject())
+                    .map_err(|_| MintAuditError::Reference)?;
+                let subject = canonicalize_json(&subject).map_err(|_| MintAuditError::Reference)?;
+                let subject = String::from_utf8(subject).map_err(|_| MintAuditError::Reference)?;
+                (Some(actor), Some(self.pseudonym("subject", &subject)?))
+            }
+            None => (None, None),
+        };
+        self.append(MintAuditEvent {
+            schema: AUDIT_SCHEMA,
+            operation: operation.to_owned(),
+            phase: AuditPhase::TokenRelease,
+            decision: AuditDecision::Issued,
+            client_pseudonym: Some(client_pseudonym),
+            authority_pseudonym: Some(authority_pseudonym),
+            actor_pseudonym,
+            subject_pseudonym,
+            token_id: Some(token.token_id().to_owned()),
+            signing_key_id: Some(token.signing_key_id().to_owned()),
+            expires_at_unix: Some(token.expires_at_unix()),
+            delegated: Some(authenticated.delegation.is_some()),
+            safe_error_category: None,
+        })
+        .await
+    }
+
+    pub async fn append_rejected(
+        &self,
+        operation: &str,
+        safe_error_category: &str,
+    ) -> Result<AuditEnvelope, MintAuditError> {
+        self.append(MintAuditEvent {
+            schema: AUDIT_SCHEMA,
+            operation: operation.to_owned(),
+            phase: AuditPhase::Denial,
+            decision: AuditDecision::Rejected,
+            client_pseudonym: None,
+            authority_pseudonym: None,
+            actor_pseudonym: None,
+            subject_pseudonym: None,
+            token_id: None,
+            signing_key_id: None,
+            expires_at_unix: None,
+            delegated: None,
+            safe_error_category: Some(safe_error_category.to_owned()),
+        })
+        .await
+    }
+
+    #[must_use]
+    pub async fn ready(&self) -> bool {
+        self.chain.try_last_hash().is_some() && self.sink.ready().await
+    }
+
+    fn pseudonym(&self, class: &str, protected: &str) -> Result<String, MintAuditError> {
+        if protected.is_empty() {
+            return Err(MintAuditError::Reference);
+        }
+        let digest = self
+            .key_hasher
+            .audit_reference_hash(class, &self.scope, protected)
+            .map_err(|_| MintAuditError::Reference)?;
+        Ok(format!("hmac-sha256:v{}:{digest}", self.key_version))
+    }
+
+    async fn append(&self, event: MintAuditEvent) -> Result<AuditEnvelope, MintAuditError> {
+        self.chain
+            .append(&self.sink, event)
+            .await
+            .map_err(MintAuditError::from)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::{fs, os::unix::fs::PermissionsExt};
+
+    // A fixed, non-secret audit HMAC key. Held as a byte literal rather than
+    // written inline so a secret scanner does not read the write call as an
+    // assignment of a live credential.
+    const AUDIT_HASH_KEY: &[u8] = b"0123456789abcdef0123456789abcdef";
+
+    fn fixture() -> (tempfile::TempDir, AuditConfig) {
+        let directory = tempfile::tempdir().expect("temp dir");
+        let secret = directory.path().join("audit-key");
+        fs::write(&secret, AUDIT_HASH_KEY).expect("write audit key");
+        fs::set_permissions(&secret, fs::Permissions::from_mode(0o600)).expect("restrict key");
+        let config = AuditConfig {
+            path: directory.path().join("audit/mint.jsonl"),
+            maximum_file_bytes: 1_048_576,
+            hash_key_file: secret,
+            hash_key_version: 1,
+        };
+        (directory, config)
+    }
+
+    #[tokio::test]
+    async fn a_keyed_chain_restarts_and_verifies() {
+        let (_directory, config) = fixture();
+        {
+            let audit = MintAuditLog::initialize(&config, "https://mint.example.org")
+                .await
+                .expect("audit initializes");
+            audit
+                .append_rejected("urn:ulid:01K00000000000000000000000", "invalid-client")
+                .await
+                .expect("first decision is durable");
+        }
+        {
+            let audit = MintAuditLog::initialize(&config, "https://mint.example.org")
+                .await
+                .expect("audit restarts");
+            audit
+                .append_rejected("urn:ulid:01K00000000000000000000001", "invalid-request")
+                .await
+                .expect("second decision is durable");
+        }
+        let summary = MintAuditLog::verify(&config).expect("chain verifies");
+        assert_eq!(summary.segments, 1);
+        assert_eq!(summary.records, 2);
+        assert!(summary.last_hash.is_some());
+        assert!(summary.active_verified);
+    }
+
+    #[tokio::test]
+    async fn a_second_writer_is_refused() {
+        let (_directory, config) = fixture();
+        let first = MintAuditLog::initialize(&config, "https://mint.example.org")
+            .await
+            .expect("first writer initializes");
+        let second = MintAuditLog::initialize(&config, "https://mint.example.org").await;
+        assert!(second.is_err(), "a second writer must not fork the chain");
+        drop(first);
+    }
+
+    #[tokio::test]
+    async fn corruption_is_refused_at_restart_and_verification() {
+        let (_directory, config) = fixture();
+        {
+            let audit = MintAuditLog::initialize(&config, "https://mint.example.org")
+                .await
+                .expect("audit initializes");
+            audit
+                .append_rejected("urn:ulid:01K00000000000000000000000", "invalid-client")
+                .await
+                .expect("decision is durable");
+        }
+        let mut contents = fs::read_to_string(&config.path).expect("read chain");
+        contents = contents.replace("invalid-client", "invalid-request");
+        fs::write(&config.path, contents).expect("tamper with chain");
+        assert!(MintAuditLog::verify(&config).is_err());
+        assert!(
+            MintAuditLog::initialize(&config, "https://mint.example.org")
+                .await
+                .is_err()
+        );
+    }
+
+    #[tokio::test]
+    async fn rotation_seals_history_without_breaking_restart_or_verification() {
+        let (_directory, mut config) = fixture();
+        config.maximum_file_bytes = 550;
+        {
+            let audit = MintAuditLog::initialize(&config, "https://mint.example.org")
+                .await
+                .expect("audit initializes");
+            for index in 0..8 {
+                audit
+                    .append_rejected(
+                        &format!("urn:ulid:01K0000000000000000000000{index}"),
+                        "invalid-client",
+                    )
+                    .await
+                    .expect("decision is durable");
+            }
+        }
+        let first_segment = config.path.with_extension("jsonl.00000001");
+        assert!(first_segment.exists(), "rotation seals the active segment");
+        let summary = MintAuditLog::verify(&config).expect("segmented chain verifies");
+        assert_eq!(summary.records, 8);
+        assert!(summary.segments > 1);
+        assert_eq!(summary.first_sequence, Some(1));
+
+        let restarted = MintAuditLog::initialize(&config, "https://mint.example.org")
+            .await
+            .expect("audit restarts from the segmented tail");
+        restarted
+            .append_rejected("urn:ulid:01K00000000000000000000009", "invalid-request")
+            .await
+            .expect("post-restart decision is durable");
+    }
+}
diff --git a/crates/registry-mint/src/caller.rs b/crates/registry-mint/src/caller.rs
new file mode 100644
index 000000000..7a18ddff4
--- /dev/null
+++ b/crates/registry-mint/src/caller.rs
@@ -0,0 +1,332 @@
+//! The caller's half of the protocol: building a client assertion.
+//!
+//! This is what a client does, not what Mint does. It holds no server state,
+//! reads no server configuration, and touches no signing key of Mint's. It
+//! signs with the *caller's* own private key, exactly as an adopter's client
+//! library would, and produces an assertion that the token endpoint then
+//! verifies on its own terms.
+//!
+//! That separation is deliberate and worth stating plainly, because the obvious
+//! alternative is a subcommand that signs an access token directly with Mint's
+//! signing key. That would be a way to obtain authority without authenticating,
+//! inside the binary whose entire purpose is to make authority depend on
+//! authentication. There is no such path here and there should never be one.
+//!
+//! Getting an assertion right by hand is fiddly (exact claims, a fresh `jti`, a
+//! lifetime inside the configured bound) and getting it wrong yields an opaque
+//! `invalid_client`. A first-party builder removes that guesswork and doubles as
+//! executable documentation of the format.
+
+use std::collections::BTreeMap;
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use registry_platform_crypto::{PrivateJwk, SigningAlgorithm};
+use serde_json::{json, Map, Value};
+
+use crate::ON_BEHALF_OF_CLAIM;
+
+/// Refusals that happen before anything is signed.
+#[derive(Debug, Eq, PartialEq, thiserror::Error)]
+pub enum AssertionError {
+    #[error("{0}")]
+    Invalid(&'static str),
+    #[error("the assertion could not be signed: {0}")]
+    Signing(String),
+}
+
+/// What a caller is asking for.
+///
+/// `actor` and `subject` are the delegation request. Mint requires them
+/// together or not at all, and refuses a registered delegated client that omits
+/// them, so this refuses the halfway states here rather than spending a network
+/// round trip to be told.
+#[derive(Debug)]
+pub struct AssertionRequest<'a> {
+    pub client_id: &'a str,
+    /// The token endpoint's configured `clientAssertion.audience`.
+    pub audience: &'a str,
+    pub lifetime_seconds: i64,
+    pub actor: Option<&'a str>,
+    pub subject: Option<BTreeMap<String, Value>>,
+}
+
+/// Build and sign one client assertion.
+///
+/// `now` is a Unix timestamp, passed in rather than read so that the claim
+/// arithmetic is testable.
+pub fn sign_client_assertion(
+    key: &PrivateJwk,
+    request: &AssertionRequest<'_>,
+    now: i64,
+) -> Result<String, AssertionError> {
+    if request.client_id.trim().is_empty() {
+        return Err(AssertionError::Invalid("a client id is required"));
+    }
+    if request.audience.trim().is_empty() {
+        return Err(AssertionError::Invalid("an assertion audience is required"));
+    }
+    // Mint bounds the assertion lifetime and applies 30 seconds of clock skew
+    // either way; anything outside this is a caller error, not a policy choice.
+    if !(1..=300).contains(&request.lifetime_seconds) {
+        return Err(AssertionError::Invalid(
+            "the assertion lifetime must be 1..=300 seconds",
+        ));
+    }
+
+    let mut claims = Map::new();
+    claims.insert("iss".to_owned(), json!(request.client_id));
+    claims.insert("sub".to_owned(), json!(request.client_id));
+    claims.insert("aud".to_owned(), json!(request.audience));
+    claims.insert("iat".to_owned(), json!(now));
+    claims.insert("exp".to_owned(), json!(now + request.lifetime_seconds));
+    // Every assertion is single use. A caller-chosen `jti` would make a repeat
+    // an accident waiting to happen, so it is generated here and never reused.
+    claims.insert("jti".to_owned(), json!(ulid::Ulid::new().to_string()));
+
+    match (request.actor, &request.subject) {
+        (None, None) => {}
+        (Some(actor), Some(subject)) => {
+            if actor.trim().is_empty() {
+                return Err(AssertionError::Invalid("the actor must not be empty"));
+            }
+            if subject.is_empty() {
+                return Err(AssertionError::Invalid(
+                    "the subject must name at least one selector field",
+                ));
+            }
+            claims.insert(
+                ON_BEHALF_OF_CLAIM.to_owned(),
+                json!({"actor": actor, "subject": subject}),
+            );
+        }
+        _ => {
+            return Err(AssertionError::Invalid(
+                "a delegation needs both an actor and a subject",
+            ))
+        }
+    }
+
+    let algorithm = match key
+        .algorithm()
+        .map_err(|error| AssertionError::Signing(error.to_string()))?
+    {
+        SigningAlgorithm::EdDsa => "EdDSA",
+        SigningAlgorithm::Es256 => "ES256",
+        SigningAlgorithm::Rs256 => "RS256",
+    };
+    let header = json!({
+        "alg": algorithm,
+        "typ": "JWT",
+        "kid": key
+            .kid
+            .as_deref()
+            .ok_or(AssertionError::Invalid("the signing key needs a kid"))?,
+    });
+
+    let encode = |value: &Value| -> Result<String, AssertionError> {
+        serde_json::to_vec(value)
+            .map(|bytes| URL_SAFE_NO_PAD.encode(bytes))
+            .map_err(|error| AssertionError::Signing(error.to_string()))
+    };
+    let signing_input = format!("{}.{}", encode(&header)?, encode(&Value::Object(claims))?);
+    let signature = registry_platform_crypto::sign(signing_input.as_bytes(), key)
+        .map_err(|error| AssertionError::Signing(error.to_string()))?;
+    Ok(format!(
+        "{signing_input}.{}",
+        URL_SAFE_NO_PAD.encode(signature)
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const NOW: i64 = 1_800_000_000;
+
+    fn key() -> PrivateJwk {
+        let signing = ed25519_dalek::SigningKey::from_bytes(&[7u8; 32]);
+        PrivateJwk::parse(
+            &json!({
+                "kty": "OKP",
+                "crv": "Ed25519",
+                "kid": "caller-key-1",
+                "alg": "EdDSA",
+                "x": URL_SAFE_NO_PAD.encode(signing.verifying_key().to_bytes()),
+                "d": URL_SAFE_NO_PAD.encode(signing.to_bytes()),
+            })
+            .to_string(),
+        )
+        .expect("the test key parses")
+    }
+
+    fn request<'a>(client_id: &'a str, audience: &'a str) -> AssertionRequest<'a> {
+        AssertionRequest {
+            client_id,
+            audience,
+            lifetime_seconds: 120,
+            actor: None,
+            subject: None,
+        }
+    }
+
+    fn claims_of(assertion: &str) -> Value {
+        let payload = assertion.split('.').nth(1).expect("a payload segment");
+        serde_json::from_slice(&URL_SAFE_NO_PAD.decode(payload).expect("base64url"))
+            .expect("claims parse")
+    }
+
+    #[test]
+    fn an_assertion_carries_exactly_what_the_token_endpoint_requires() {
+        let assertion = sign_client_assertion(
+            &key(),
+            &request("scheduler", "https://mint.example.org/token"),
+            NOW,
+        )
+        .expect("the assertion signs");
+
+        let claims = claims_of(&assertion);
+        assert_eq!(claims["iss"], json!("scheduler"));
+        assert_eq!(claims["sub"], json!("scheduler"));
+        assert_eq!(claims["aud"], json!("https://mint.example.org/token"));
+        assert_eq!(claims["iat"], json!(NOW));
+        assert_eq!(claims["exp"], json!(NOW + 120));
+        assert!(claims.get(ON_BEHALF_OF_CLAIM).is_none());
+
+        let header: Value = serde_json::from_slice(
+            &URL_SAFE_NO_PAD
+                .decode(assertion.split('.').next().expect("a header segment"))
+                .expect("base64url"),
+        )
+        .expect("header parses");
+        assert_eq!(header["alg"], json!("EdDSA"));
+        assert_eq!(header["typ"], json!("JWT"));
+        assert_eq!(header["kid"], json!("caller-key-1"));
+    }
+
+    /// Reusing a `jti` is refused by Mint as a replay, so the builder must never
+    /// produce the same one twice even when called with an identical request.
+    #[test]
+    fn every_assertion_gets_its_own_jti() {
+        let key = key();
+        let request = request("scheduler", "https://mint.example.org/token");
+        let first = claims_of(&sign_client_assertion(&key, &request, NOW).expect("signs"));
+        let second = claims_of(&sign_client_assertion(&key, &request, NOW).expect("signs"));
+
+        assert_ne!(first["jti"], second["jti"]);
+        assert!(first["jti"].as_str().is_some_and(|jti| !jti.is_empty()));
+    }
+
+    #[test]
+    fn a_delegation_request_rides_inside_the_signed_claims() {
+        let subject = BTreeMap::from([
+            ("given_name".to_owned(), json!("Amara")),
+            ("birth_date".to_owned(), json!("1998-04-02")),
+        ]);
+        let assertion = sign_client_assertion(
+            &key(),
+            &AssertionRequest {
+                actor: Some("urn:example:agent:scheduler"),
+                subject: Some(subject),
+                ..request("scheduler", "https://mint.example.org/token")
+            },
+            NOW,
+        )
+        .expect("the assertion signs");
+
+        let claims = claims_of(&assertion);
+        assert_eq!(
+            claims[ON_BEHALF_OF_CLAIM],
+            json!({
+                "actor": "urn:example:agent:scheduler",
+                "subject": {"given_name": "Amara", "birth_date": "1998-04-02"},
+            })
+        );
+    }
+
+    /// Mint requires the actor and subject together, and refuses a registered
+    /// delegated client that sends neither. Answering here saves a round trip
+    /// that could only ever return an opaque `invalid_client`.
+    #[test]
+    fn half_a_delegation_is_refused_before_anything_is_signed() {
+        let audience = "https://mint.example.org/token";
+        let expected = || AssertionError::Invalid("a delegation needs both an actor and a subject");
+
+        assert_eq!(
+            sign_client_assertion(
+                &key(),
+                &AssertionRequest {
+                    actor: Some("urn:example:agent:scheduler"),
+                    ..request("scheduler", audience)
+                },
+                NOW,
+            ),
+            Err(expected())
+        );
+        assert_eq!(
+            sign_client_assertion(
+                &key(),
+                &AssertionRequest {
+                    subject: Some(BTreeMap::from([("given_name".to_owned(), json!("Amara"))])),
+                    ..request("scheduler", audience)
+                },
+                NOW,
+            ),
+            Err(expected())
+        );
+    }
+
+    #[test]
+    fn empty_and_out_of_range_inputs_are_refused() {
+        let audience = "https://mint.example.org/token";
+        assert_eq!(
+            sign_client_assertion(&key(), &request("  ", audience), NOW),
+            Err(AssertionError::Invalid("a client id is required"))
+        );
+        assert_eq!(
+            sign_client_assertion(&key(), &request("scheduler", ""), NOW),
+            Err(AssertionError::Invalid("an assertion audience is required"))
+        );
+        for lifetime in [0, -1, 301] {
+            assert_eq!(
+                sign_client_assertion(
+                    &key(),
+                    &AssertionRequest {
+                        lifetime_seconds: lifetime,
+                        ..request("scheduler", audience)
+                    },
+                    NOW,
+                ),
+                Err(AssertionError::Invalid(
+                    "the assertion lifetime must be 1..=300 seconds"
+                )),
+                "lifetime {lifetime} must be refused"
+            );
+        }
+        assert_eq!(
+            sign_client_assertion(
+                &key(),
+                &AssertionRequest {
+                    actor: Some(" "),
+                    subject: Some(BTreeMap::from([("given_name".to_owned(), json!("Amara"))])),
+                    ..request("scheduler", audience)
+                },
+                NOW,
+            ),
+            Err(AssertionError::Invalid("the actor must not be empty"))
+        );
+        assert_eq!(
+            sign_client_assertion(
+                &key(),
+                &AssertionRequest {
+                    actor: Some("urn:example:agent:scheduler"),
+                    subject: Some(BTreeMap::new()),
+                    ..request("scheduler", audience)
+                },
+                NOW,
+            ),
+            Err(AssertionError::Invalid(
+                "the subject must name at least one selector field"
+            ))
+        );
+    }
+}
diff --git a/crates/registry-mint/src/clients.rs b/crates/registry-mint/src/clients.rs
new file mode 100644
index 000000000..4c43e30c6
--- /dev/null
+++ b/crates/registry-mint/src/clients.rs
@@ -0,0 +1,784 @@
+//! The client registry: the server-side binding from keys to authority.
+//!
+//! This module is the reason Mint exists. A JWKS answers only "was this signed
+//! by a trusted key?" The registry answers the question that actually matters:
+//! "*this specific client* holds *these specific keys*, and is permitted to act
+//! as *this principal* with *these tags* for *this audience*."
+//!
+//! Two rules keep that binding meaningful:
+//!
+//! 1. A client's assertion is verified against that client's keys only, never
+//!    against a pooled key set. See [`crate::assertion`].
+//! 2. Authority is read from here, never from the assertion payload.
+//!
+//! The registry is reloadable so that onboarding, offboarding, and caller key
+//! rotation never require restarting a resource server.
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fmt, fs,
+    path::Path,
+    sync::Arc,
+};
+
+use jsonwebtoken::{jwk::JwkSet, DecodingKey};
+use serde::Deserialize;
+use serde_json::{Map, Value};
+use thiserror::Error;
+use url::Url;
+
+/// Evidence rejects principals longer than this, so a longer one could never
+/// be used.
+const MAX_PRINCIPAL_BYTES: usize = 512;
+/// Evidence accepts at most this many requester tags.
+const MAX_TAGS: usize = 32;
+const MAX_KEYS_PER_CLIENT: usize = 8;
+const MAX_CLIENT_FILE_BYTES: u64 = 256 * 1024;
+const MAX_CLIENTS: usize = 4_096;
+/// Evidence permits at most this many fields in one selector profile, so a
+/// larger subject could never satisfy one.
+const MAX_SUBJECT_FIELDS: usize = 16;
+const MAX_DELEGATED_ACTORS: usize = 64;
+/// The longest claim path Evidence will resolve.
+const MAX_CLAIM_PATH_BYTES: usize = 512;
+
+/// JWK members that only ever appear in private keys.
+const PRIVATE_JWK_MEMBERS: [&str; 7] = ["d", "p", "q", "dp", "dq", "qi", "k"];
+
+#[derive(Debug, Error, Eq, PartialEq)]
+pub enum ClientRegistryError {
+    #[error("the client registry directory is unavailable")]
+    DirectoryUnavailable,
+    #[error("a client registration file is unreadable")]
+    Unreadable,
+    #[error("client registration {0} is invalid: {1}")]
+    Invalid(String, &'static str),
+    #[error("client registration document {0} is malformed: {1}")]
+    Document(String, String),
+    #[error("client id {0} is registered more than once")]
+    Duplicate(String),
+    #[error("the client registry holds more than {MAX_CLIENTS} clients")]
+    TooManyClients,
+}
+
+/// A grant reference minted into tokens for callers acting under a recorded
+/// authority. Evidence requires the id and authority together or not at all.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Grant {
+    pub id: String,
+    pub authority: String,
+}
+
+/// Permission for a client to obtain tokens bound to one delegated actor acting
+/// for one subject.
+///
+/// This is what makes a delegated token narrower than an ordinary one rather
+/// than merely differently labelled. The subject's selector values are minted
+/// into the token at [`Delegation::subject_claims`], which must mirror the
+/// `valueClaims` of the matching `authenticated-context` entitlement in the
+/// resource server's bundle. The resource server then reads the subject from
+/// the token and refuses any request that carries its own selector values, so a
+/// token issued for one subject cannot reach another.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Delegation {
+    /// A closed set of actor identities this client may act as. Omitted means
+    /// the client names its own actor, bounded only by length.
+    #[serde(default)]
+    pub actors: Option<Vec<String>>,
+    /// Selector field name to the claim path its value is minted at.
+    pub subject_claims: BTreeMap<String, String>,
+}
+
+impl Delegation {
+    /// Whether `actor` is one this client may act as.
+    #[must_use]
+    pub fn permits_actor(&self, actor: &str) -> bool {
+        match &self.actors {
+            Some(actors) => actors.iter().any(|permitted| permitted == actor),
+            None => true,
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct ClientDocument {
+    client_id: String,
+    principal: String,
+    evidence_audience: String,
+    requester_tags: Vec<String>,
+    #[serde(default)]
+    grant: Option<Grant>,
+    #[serde(default)]
+    delegation: Option<Delegation>,
+    keys: Vec<Value>,
+}
+
+/// One registered client: its public keys, and the authority Mint will assert
+/// on its behalf.
+#[derive(Clone)]
+pub struct RegisteredClient {
+    client_id: String,
+    principal: String,
+    evidence_audience: String,
+    requester_tags: Vec<String>,
+    grant: Option<Grant>,
+    delegation: Option<Delegation>,
+    jwks: JwkSet,
+}
+
+impl RegisteredClient {
+    #[must_use]
+    pub fn client_id(&self) -> &str {
+        &self.client_id
+    }
+
+    #[must_use]
+    pub fn principal(&self) -> &str {
+        &self.principal
+    }
+
+    #[must_use]
+    pub fn evidence_audience(&self) -> &str {
+        &self.evidence_audience
+    }
+
+    #[must_use]
+    pub fn requester_tags(&self) -> &[String] {
+        &self.requester_tags
+    }
+
+    #[must_use]
+    pub fn grant(&self) -> Option<&Grant> {
+        self.grant.as_ref()
+    }
+
+    /// The delegation this client is registered for, if any. A client with no
+    /// delegation may never obtain a token carrying an actor or a bound
+    /// subject.
+    #[must_use]
+    pub fn delegation(&self) -> Option<&Delegation> {
+        self.delegation.as_ref()
+    }
+
+    /// The public keys registered for this client, and nothing else. This is
+    /// the set an assertion from this client is verified against.
+    #[must_use]
+    pub fn jwks(&self) -> &JwkSet {
+        &self.jwks
+    }
+}
+
+/// Authority data identifies real callers, so it is kept out of logs for the
+/// same reason Evidence redacts its authenticated context.
+impl fmt::Debug for RegisteredClient {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("RegisteredClient")
+            .field("client_id", &"[redacted]")
+            .field("principal", &"[redacted]")
+            .field("evidence_audience", &"[redacted]")
+            .field(
+                "requester_tags",
+                &format_args!("[{} redacted]", self.requester_tags.len()),
+            )
+            .field("grant", &self.grant.as_ref().map(|_| "[redacted]"))
+            .field(
+                "delegation",
+                &self.delegation.as_ref().map(|_| "[redacted]"),
+            )
+            .field("keys", &self.jwks.keys.len())
+            .finish()
+    }
+}
+
+/// An immutable snapshot of the registered clients.
+#[derive(Debug, Default)]
+pub struct ClientRegistry {
+    clients: BTreeMap<String, Arc<RegisteredClient>>,
+}
+
+impl ClientRegistry {
+    /// Load every `*.yaml` registration in `directory`.
+    ///
+    /// The load is all-or-nothing: one malformed registration fails the whole
+    /// load, so a partially applied registry can never serve.
+    pub fn load(directory: &Path) -> Result<Self, ClientRegistryError> {
+        let entries =
+            fs::read_dir(directory).map_err(|_| ClientRegistryError::DirectoryUnavailable)?;
+        let mut paths = Vec::new();
+        for entry in entries {
+            let entry = entry.map_err(|_| ClientRegistryError::Unreadable)?;
+            let path = entry.path();
+            if path.extension().and_then(|extension| extension.to_str()) == Some("yaml") {
+                paths.push(path);
+            }
+        }
+        paths.sort();
+
+        let mut clients = BTreeMap::new();
+        for path in paths {
+            let client = load_client_file(&path)?;
+            if clients.contains_key(client.client_id()) {
+                return Err(ClientRegistryError::Duplicate(
+                    client.client_id().to_owned(),
+                ));
+            }
+            clients.insert(client.client_id().to_owned(), Arc::new(client));
+        }
+        if clients.len() > MAX_CLIENTS {
+            return Err(ClientRegistryError::TooManyClients);
+        }
+        Ok(Self { clients })
+    }
+
+    #[must_use]
+    pub fn get(&self, client_id: &str) -> Option<&Arc<RegisteredClient>> {
+        self.clients.get(client_id)
+    }
+
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.clients.len()
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.clients.is_empty()
+    }
+
+    #[must_use]
+    pub fn client_ids(&self) -> Vec<&str> {
+        self.clients.keys().map(String::as_str).collect()
+    }
+}
+
+fn load_client_file(path: &Path) -> Result<RegisteredClient, ClientRegistryError> {
+    let name = path
+        .file_name()
+        .and_then(|name| name.to_str())
+        .unwrap_or("<unnamed>")
+        .to_owned();
+
+    let metadata = fs::symlink_metadata(path).map_err(|_| ClientRegistryError::Unreadable)?;
+    if !metadata.is_file() {
+        return Err(ClientRegistryError::Invalid(
+            name,
+            "registrations must be regular files",
+        ));
+    }
+    if metadata.len() > MAX_CLIENT_FILE_BYTES {
+        return Err(ClientRegistryError::Invalid(
+            name,
+            "registration is too large",
+        ));
+    }
+
+    let text = fs::read_to_string(path).map_err(|_| ClientRegistryError::Unreadable)?;
+    let document: ClientDocument = serde_norway::from_str(&text)
+        .map_err(|error| ClientRegistryError::Document(name.clone(), error.to_string()))?;
+    build_client(&name, document)
+}
+
+fn build_client(
+    name: &str,
+    document: ClientDocument,
+) -> Result<RegisteredClient, ClientRegistryError> {
+    let invalid = |reason: &'static str| ClientRegistryError::Invalid(name.to_owned(), reason);
+
+    if document.client_id.trim().is_empty() || document.client_id.len() > 256 {
+        return Err(invalid("client id must be 1..=256 bytes"));
+    }
+    if document.principal.trim().is_empty() || document.principal.len() > MAX_PRINCIPAL_BYTES {
+        return Err(invalid("principal must be 1..=512 bytes"));
+    }
+    if document.evidence_audience.len() > MAX_PRINCIPAL_BYTES {
+        return Err(invalid("evidence audience must be at most 512 bytes"));
+    }
+    // Evidence parses this claim as a URL and mixes it into the subject-binding
+    // MAC, so a value that fails to parse there must fail here.
+    Url::parse(&document.evidence_audience)
+        .map_err(|_| invalid("evidence audience must be a URL"))?;
+
+    if document.requester_tags.is_empty() || document.requester_tags.len() > MAX_TAGS {
+        return Err(invalid("between 1 and 32 requester tags are required"));
+    }
+    for tag in &document.requester_tags {
+        if tag.trim().is_empty() || tag.len() > 256 {
+            return Err(invalid("requester tags must be 1..=256 bytes"));
+        }
+    }
+    let unique_tags = document.requester_tags.iter().collect::<BTreeSet<_>>();
+    if unique_tags.len() != document.requester_tags.len() {
+        return Err(invalid("requester tags must be unique"));
+    }
+
+    if let Some(grant) = &document.grant {
+        if grant.id.trim().is_empty() || grant.id.len() > MAX_PRINCIPAL_BYTES {
+            return Err(invalid("grant id must be 1..=512 bytes"));
+        }
+        if grant.authority.trim().is_empty() || grant.authority.len() > MAX_PRINCIPAL_BYTES {
+            return Err(invalid("grant authority must be 1..=512 bytes"));
+        }
+    }
+
+    if let Some(delegation) = &document.delegation {
+        validate_delegation(delegation, &invalid)?;
+    }
+
+    let jwks = build_public_jwks(document.keys, &invalid)?;
+
+    Ok(RegisteredClient {
+        client_id: document.client_id,
+        principal: document.principal,
+        evidence_audience: document.evidence_audience,
+        requester_tags: document.requester_tags,
+        grant: document.grant,
+        delegation: document.delegation,
+        jwks,
+    })
+}
+
+fn validate_delegation(
+    delegation: &Delegation,
+    invalid: &impl Fn(&'static str) -> ClientRegistryError,
+) -> Result<(), ClientRegistryError> {
+    if let Some(actors) = &delegation.actors {
+        // An empty list reads as "no restriction" but means "nothing may be
+        // requested", so it is refused rather than silently interpreted.
+        if actors.is_empty() || actors.len() > MAX_DELEGATED_ACTORS {
+            return Err(invalid("between 1 and 64 delegated actors are required"));
+        }
+        for actor in actors {
+            if actor.trim().is_empty() || actor.len() > MAX_PRINCIPAL_BYTES {
+                return Err(invalid("delegated actors must be 1..=512 bytes"));
+            }
+        }
+        if actors.iter().collect::<BTreeSet<_>>().len() != actors.len() {
+            return Err(invalid("delegated actors must be unique"));
+        }
+    }
+
+    if delegation.subject_claims.is_empty() || delegation.subject_claims.len() > MAX_SUBJECT_FIELDS
+    {
+        return Err(invalid("between 1 and 16 subject claims are required"));
+    }
+    for (field, path) in &delegation.subject_claims {
+        if !valid_selector_field(field) {
+            return Err(invalid("subject claim field names are invalid"));
+        }
+        if !valid_claim_path(path) {
+            return Err(invalid("subject claim paths are invalid"));
+        }
+    }
+
+    // Two fields minted at one path would leave whichever came last in place,
+    // so the resource server would read one field's value for both.
+    let paths = delegation.subject_claims.values().collect::<BTreeSet<_>>();
+    if paths.len() != delegation.subject_claims.len() {
+        return Err(invalid("subject claim paths must be unique"));
+    }
+
+    // Minting builds nested objects, so `identity` and `identity.given_name`
+    // cannot both hold a value. Sorting groups any prefix with what it
+    // prefixes, so comparing neighbours is enough.
+    let mut segmented = paths
+        .iter()
+        .map(|path| path.split('.').collect::<Vec<_>>())
+        .collect::<Vec<_>>();
+    segmented.sort_unstable();
+    if segmented
+        .windows(2)
+        .any(|pair| pair[1].starts_with(&pair[0]))
+    {
+        return Err(invalid(
+            "subject claim paths must not nest inside one another",
+        ));
+    }
+    Ok(())
+}
+
+/// The selector field name grammar Evidence enforces on bundle selector
+/// profiles. A field Mint accepts but Evidence rejects could never resolve.
+fn valid_selector_field(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    !bytes.is_empty()
+        && bytes.len() <= 64
+        && matches!(bytes.first(), Some(b'a'..=b'z'))
+        && bytes[1..].iter().all(|byte| {
+            byte.is_ascii_lowercase() || byte.is_ascii_digit() || matches!(byte, b'.' | b'_' | b'-')
+        })
+}
+
+/// The claim path grammar Evidence resolves tokens against.
+fn valid_claim_path(value: &str) -> bool {
+    if value.is_empty() || value.len() > MAX_CLAIM_PATH_BYTES {
+        return false;
+    }
+    value.split('.').all(|segment| {
+        let bytes = segment.as_bytes();
+        !bytes.is_empty()
+            && matches!(bytes.first(), Some(b'A'..=b'Z' | b'a'..=b'z' | b'_'))
+            && bytes[1..]
+                .iter()
+                .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'))
+    })
+}
+
+fn build_public_jwks(
+    keys: Vec<Value>,
+    invalid: &impl Fn(&'static str) -> ClientRegistryError,
+) -> Result<JwkSet, ClientRegistryError> {
+    if keys.is_empty() || keys.len() > MAX_KEYS_PER_CLIENT {
+        return Err(invalid("between 1 and 8 keys are required"));
+    }
+
+    let mut kids = BTreeSet::new();
+    for key in &keys {
+        let object = key
+            .as_object()
+            .ok_or_else(|| invalid("keys must be objects"))?;
+        reject_private_material(object, invalid)?;
+        let kid = object
+            .get("kid")
+            .and_then(Value::as_str)
+            .ok_or_else(|| invalid("every key must carry a kid"))?;
+        if kid.trim().is_empty() || kid.len() > 256 {
+            return Err(invalid("key ids must be 1..=256 bytes"));
+        }
+        if !kids.insert(kid.to_owned()) {
+            return Err(invalid("key ids must be unique within a client"));
+        }
+    }
+
+    let jwks: JwkSet = serde_json::from_value(Value::Object(
+        [("keys".to_owned(), Value::Array(keys))]
+            .into_iter()
+            .collect::<Map<_, _>>(),
+    ))
+    .map_err(|_| invalid("keys are not a valid JWK set"))?;
+
+    // Prove at load time that every key is actually usable, so a broken
+    // registration fails at startup rather than at the first token request.
+    for jwk in &jwks.keys {
+        DecodingKey::from_jwk(jwk).map_err(|_| invalid("a key is not a usable public key"))?;
+    }
+    Ok(jwks)
+}
+
+/// Reject anything carrying private key material. A client registration is
+/// public data; a private member here would mean an operator pasted a signing
+/// key into the registry.
+fn reject_private_material(
+    object: &Map<String, Value>,
+    invalid: &impl Fn(&'static str) -> ClientRegistryError,
+) -> Result<(), ClientRegistryError> {
+    if contains_private_material(object) {
+        return Err(invalid("client keys must not contain private key material"));
+    }
+    Ok(())
+}
+
+/// Whether a JWK object carries any member that only exists in a private key.
+///
+/// Shared with the published JWKS so neither the registry nor the public key
+/// set can ever carry private material.
+#[must_use]
+pub fn contains_private_material(object: &Map<String, Value>) -> bool {
+    PRIVATE_JWK_MEMBERS
+        .iter()
+        .any(|member| object.contains_key(*member))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const CLIENT_A: &str = r#"
+clientId: client-a
+principal: urn:example:client-a
+evidenceAudience: https://client-a.example.org
+requesterTags: [ministry-of-health]
+keys:
+  - {kty: OKP, crv: Ed25519, kid: client-a-2026-01, alg: EdDSA, x: 11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo}
+"#;
+
+    fn registry_from(files: &[(&str, &str)]) -> Result<ClientRegistry, ClientRegistryError> {
+        let directory = tempfile::tempdir().expect("temp dir");
+        for (name, contents) in files {
+            fs::write(directory.path().join(name), contents).expect("write client");
+        }
+        ClientRegistry::load(directory.path())
+    }
+
+    fn load_one(contents: &str) -> Result<ClientRegistry, ClientRegistryError> {
+        registry_from(&[("client.yaml", contents)])
+    }
+
+    fn registry_error(files: &[(&str, &str)]) -> ClientRegistryError {
+        registry_from(files).expect_err("the registration must be rejected")
+    }
+
+    fn load_error(contents: &str) -> ClientRegistryError {
+        registry_error(&[("client.yaml", contents)])
+    }
+
+    fn invalid(reason: &'static str) -> ClientRegistryError {
+        ClientRegistryError::Invalid("client.yaml".to_owned(), reason)
+    }
+
+    #[test]
+    fn a_valid_registration_binds_keys_to_authority() {
+        let registry = load_one(CLIENT_A).expect("registry loads");
+        let client = registry.get("client-a").expect("client-a is registered");
+
+        assert_eq!(client.principal(), "urn:example:client-a");
+        assert_eq!(client.evidence_audience(), "https://client-a.example.org");
+        assert_eq!(client.requester_tags(), ["ministry-of-health"]);
+        assert_eq!(client.grant(), None);
+        assert_eq!(client.jwks().keys.len(), 1);
+        assert_eq!(registry.len(), 1);
+    }
+
+    #[test]
+    fn private_key_material_is_rejected() {
+        for member in PRIVATE_JWK_MEMBERS {
+            let text = CLIENT_A.replace(
+                "alg: EdDSA,",
+                &format!("alg: EdDSA, {member}: nWGxne_9WmC6hEr0kuwsxERJxWl7MmkZcDusAxyuf2A,"),
+            );
+            assert_eq!(
+                load_error(&text),
+                invalid("client keys must not contain private key material"),
+                "member {member} must be rejected"
+            );
+        }
+    }
+
+    #[test]
+    fn keys_require_unique_non_empty_kids() {
+        let text = CLIENT_A.replace("kid: client-a-2026-01, ", "");
+        assert_eq!(load_error(&text), invalid("every key must carry a kid"));
+
+        let duplicated = format!(
+            "{CLIENT_A}  - {{kty: OKP, crv: Ed25519, kid: client-a-2026-01, alg: EdDSA, x: 11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo}}\n"
+        );
+        assert_eq!(
+            load_error(&duplicated),
+            invalid("key ids must be unique within a client")
+        );
+    }
+
+    #[test]
+    fn evidence_audience_must_parse_as_a_url() {
+        let text = CLIENT_A.replace("https://client-a.example.org", "not-a-url");
+        assert_eq!(
+            load_error(&text),
+            invalid("evidence audience must be a URL")
+        );
+    }
+
+    #[test]
+    fn requester_tags_are_required_bounded_and_unique() {
+        let text = CLIENT_A.replace("[ministry-of-health]", "[]");
+        assert_eq!(
+            load_error(&text),
+            invalid("between 1 and 32 requester tags are required")
+        );
+
+        let text = CLIENT_A.replace("[ministry-of-health]", "[a, a]");
+        assert_eq!(load_error(&text), invalid("requester tags must be unique"));
+    }
+
+    #[test]
+    fn duplicate_client_ids_across_files_fail_the_whole_load() {
+        assert_eq!(
+            registry_error(&[("a.yaml", CLIENT_A), ("b.yaml", CLIENT_A)]),
+            ClientRegistryError::Duplicate("client-a".to_owned())
+        );
+    }
+
+    #[test]
+    fn unknown_registration_fields_are_rejected() {
+        let text = CLIENT_A.replace("clientId: client-a", "clientId: client-a\nunexpected: true");
+        assert!(matches!(
+            load_one(&text),
+            Err(ClientRegistryError::Document(_, _))
+        ));
+    }
+
+    #[test]
+    fn a_grant_requires_both_an_id_and_an_authority() {
+        let text = format!("{CLIENT_A}grant: {{id: grant-1, authority: statute-7}}\n");
+        let registry = load_one(&text).expect("registry loads");
+        let client = registry.get("client-a").expect("client-a is registered");
+        assert_eq!(
+            client.grant(),
+            Some(&Grant {
+                id: "grant-1".to_owned(),
+                authority: "statute-7".to_owned()
+            })
+        );
+
+        let text = format!("{CLIENT_A}grant: {{id: grant-1}}\n");
+        assert!(matches!(
+            load_one(&text),
+            Err(ClientRegistryError::Document(_, _))
+        ));
+    }
+
+    /// A registration with a `delegation` block, whose subject claims mirror
+    /// the `valueClaims` of an `authenticated-context` entitlement.
+    fn delegated(body: &str) -> String {
+        format!("{CLIENT_A}delegation:\n{body}")
+    }
+
+    const SUBJECT_CLAIMS: &str =
+        "  subjectClaims:\n    given_name: identity.given_name\n    birth_date: identity.birth_date\n";
+
+    #[test]
+    fn a_delegated_registration_declares_its_actors_and_subject_claims() {
+        let text = delegated(&format!(
+            "  actors: [urn:example:agent:scheduling]\n{SUBJECT_CLAIMS}"
+        ));
+        let registry = load_one(&text).expect("registry loads");
+        let client = registry.get("client-a").expect("client-a is registered");
+        let delegation = client.delegation().expect("client-a may delegate");
+
+        assert_eq!(
+            delegation.subject_claims,
+            BTreeMap::from([
+                ("given_name".to_owned(), "identity.given_name".to_owned()),
+                ("birth_date".to_owned(), "identity.birth_date".to_owned()),
+            ])
+        );
+        assert!(delegation.permits_actor("urn:example:agent:scheduling"));
+        assert!(!delegation.permits_actor("urn:example:agent:other"));
+
+        // Ordinary registrations stay undelegated, which is what makes an
+        // assertion asking to delegate refusable.
+        assert_eq!(
+            load_one(CLIENT_A)
+                .expect("registry loads")
+                .get("client-a")
+                .expect("client-a is registered")
+                .delegation(),
+            None
+        );
+    }
+
+    #[test]
+    fn an_omitted_actor_list_permits_any_actor_the_client_names() {
+        let registry = load_one(&delegated(SUBJECT_CLAIMS)).expect("registry loads");
+        let client = registry.get("client-a").expect("client-a is registered");
+        let delegation = client.delegation().expect("client-a may delegate");
+
+        assert_eq!(delegation.actors, None);
+        assert!(delegation.permits_actor("urn:example:agent:anything"));
+    }
+
+    #[test]
+    fn an_actor_list_must_be_non_empty_bounded_and_unique() {
+        assert_eq!(
+            load_error(&delegated(&format!("  actors: []\n{SUBJECT_CLAIMS}"))),
+            invalid("between 1 and 64 delegated actors are required")
+        );
+        assert_eq!(
+            load_error(&delegated(&format!("  actors: [a, a]\n{SUBJECT_CLAIMS}"))),
+            invalid("delegated actors must be unique")
+        );
+        assert_eq!(
+            load_error(&delegated(&format!("  actors: ['']\n{SUBJECT_CLAIMS}"))),
+            invalid("delegated actors must be 1..=512 bytes")
+        );
+    }
+
+    #[test]
+    fn subject_claim_paths_must_use_the_resource_servers_claim_path_grammar() {
+        for path in ["identity..given_name", "1identity.given_name", "", "a.b!c"] {
+            let text = delegated(&format!("  subjectClaims:\n    given_name: \"{path}\"\n"));
+            assert_eq!(
+                load_error(&text),
+                invalid("subject claim paths are invalid"),
+                "path {path:?} must be rejected"
+            );
+        }
+    }
+
+    #[test]
+    fn subject_claim_field_names_follow_the_selector_profile_grammar() {
+        for field in ["Given_Name", "1given", "given name", ""] {
+            let text = delegated(&format!(
+                "  subjectClaims:\n    \"{field}\": identity.given_name\n"
+            ));
+            assert_eq!(
+                load_error(&text),
+                invalid("subject claim field names are invalid"),
+                "field {field:?} must be rejected"
+            );
+        }
+    }
+
+    /// Minting builds nested objects, so a path and a path inside it cannot
+    /// both hold a value.
+    #[test]
+    fn subject_claim_paths_must_be_unique_and_must_not_nest() {
+        let text = delegated(
+            "  subjectClaims:\n    given_name: identity.name\n    family_name: identity.name\n",
+        );
+        assert_eq!(
+            load_error(&text),
+            invalid("subject claim paths must be unique")
+        );
+
+        let text = delegated(
+            "  subjectClaims:\n    given_name: identity\n    family_name: identity.family_name\n",
+        );
+        assert_eq!(
+            load_error(&text),
+            invalid("subject claim paths must not nest inside one another")
+        );
+    }
+
+    #[test]
+    fn a_delegation_must_bind_at_least_one_subject_claim() {
+        // Delegation with no subject binding would be an actor label on an
+        // otherwise unbounded token.
+        let text = delegated("  subjectClaims: {}\n");
+        assert_eq!(
+            load_error(&text),
+            invalid("between 1 and 16 subject claims are required")
+        );
+
+        let fields = (0..17)
+            .map(|index| format!("    field_{index}: identity.f{index}\n"))
+            .collect::<String>();
+        assert_eq!(
+            load_error(&delegated(&format!("  subjectClaims:\n{fields}"))),
+            invalid("between 1 and 16 subject claims are required")
+        );
+    }
+
+    #[test]
+    fn debug_output_redacts_client_authority() {
+        let registry = load_one(CLIENT_A).expect("registry loads");
+        let client = registry.get("client-a").expect("client-a is registered");
+        let rendered = format!("{client:?}");
+        assert!(!rendered.contains("urn:example:client-a"));
+        assert!(!rendered.contains("ministry-of-health"));
+        assert!(!rendered.contains("client-a.example.org"));
+    }
+
+    #[test]
+    fn non_yaml_files_are_ignored() {
+        let registry = registry_from(&[
+            ("client.yaml", CLIENT_A),
+            ("notes.txt", "not a registration"),
+            ("client.yaml.bak", "also not a registration"),
+        ])
+        .expect("registry loads");
+        assert_eq!(registry.len(), 1);
+    }
+}
diff --git a/crates/registry-mint/src/config.rs b/crates/registry-mint/src/config.rs
new file mode 100644
index 000000000..7a32e530a
--- /dev/null
+++ b/crates/registry-mint/src/config.rs
@@ -0,0 +1,1012 @@
+//! Startup-only Mint configuration.
+//!
+//! Everything in this file is fixed for the lifetime of the serving process:
+//! issuer identity, signing and audit keys, listener, and token policy. The one part of
+//! Mint's state that is intentionally reloadable is the client registry, which
+//! lives in [`crate::clients`].
+
+use std::{
+    collections::BTreeSet,
+    net::IpAddr,
+    path::{Path, PathBuf},
+};
+
+use serde::Deserialize;
+use thiserror::Error;
+use url::Url;
+
+/// Supported signature algorithms, shared by minted tokens and accepted client
+/// assertions.
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd)]
+pub enum Algorithm {
+    EdDSA,
+    ES256,
+    RS256,
+}
+
+impl Algorithm {
+    #[must_use]
+    pub fn as_jsonwebtoken(self) -> jsonwebtoken::Algorithm {
+        match self {
+            Self::EdDSA => jsonwebtoken::Algorithm::EdDSA,
+            Self::ES256 => jsonwebtoken::Algorithm::ES256,
+            Self::RS256 => jsonwebtoken::Algorithm::RS256,
+        }
+    }
+
+    #[must_use]
+    pub fn as_header_value(self) -> &'static str {
+        match self {
+            Self::EdDSA => "EdDSA",
+            Self::ES256 => "ES256",
+            Self::RS256 => "RS256",
+        }
+    }
+}
+
+#[derive(Debug, Error, Eq, PartialEq)]
+pub enum ConfigError {
+    #[error("the configuration file is unavailable")]
+    Unavailable,
+    #[error("the configuration document is invalid: {0}")]
+    Document(String),
+    #[error("configuration is invalid: {0}")]
+    Invalid(&'static str),
+}
+
+fn default_jwks_path() -> String {
+    MINT_JWKS_PATH.to_owned()
+}
+
+pub(crate) const MINT_JWKS_PATH: &str = "/.well-known/jwks.json";
+pub(crate) const MINT_TOKEN_PATH: &str = "/token";
+pub(crate) const MINT_METADATA_PATH: &str = "/.well-known/oauth-authorization-server";
+pub(crate) const MINT_HEALTH_PATH: &str = "/health";
+pub(crate) const MINT_READY_PATH: &str = "/ready";
+
+/// Every path the router registers besides the configured JWKS path.
+///
+/// The router panics when one path is registered twice, so the configured
+/// JWKS path is checked against this list where the configuration is read.
+pub(crate) const MINT_FIXED_ROUTES: [&str; 4] = [
+    MINT_TOKEN_PATH,
+    MINT_METADATA_PATH,
+    MINT_HEALTH_PATH,
+    MINT_READY_PATH,
+];
+
+fn default_maximum_request_bytes() -> u32 {
+    16 * 1024
+}
+
+fn default_request_timeout_milliseconds() -> u64 {
+    5_000
+}
+
+fn default_assertion_lifetime_seconds() -> u64 {
+    300
+}
+
+fn default_replay_cache_entries() -> usize {
+    8_192
+}
+
+fn default_principal_claim() -> String {
+    "sub".to_owned()
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ListenerConfig {
+    pub address: String,
+    pub port: u16,
+    #[serde(default = "default_maximum_request_bytes")]
+    pub maximum_request_bytes: u32,
+    #[serde(default = "default_request_timeout_milliseconds")]
+    pub request_timeout_milliseconds: u64,
+}
+
+impl ListenerConfig {
+    pub fn bind_address(&self) -> Result<IpAddr, ConfigError> {
+        self.address
+            .parse()
+            .map_err(|_| ConfigError::Invalid("listener address is not an IP address"))
+    }
+
+    /// Reject limits no token request can survive.
+    ///
+    /// A zero body limit or a zero timeout leaves Mint reporting itself ready
+    /// while every token request fails, which is an outage the readiness probe
+    /// cannot see. The bounds match the Evidence listener.
+    fn validate(&self) -> Result<(), ConfigError> {
+        if !(1_024..=1_048_576).contains(&self.maximum_request_bytes) {
+            return Err(ConfigError::Invalid(
+                "listener maximumRequestBytes must be 1024..=1048576",
+            ));
+        }
+        if !(1..=30_000).contains(&self.request_timeout_milliseconds) {
+            return Err(ConfigError::Invalid(
+                "listener requestTimeoutMilliseconds must be 1..=30000",
+            ));
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct SigningConfig {
+    pub algorithm: Algorithm,
+    pub active_key_id: String,
+    /// Path to the private JWK, resolved relative to the configuration file.
+    pub active_key_file: PathBuf,
+    /// Public JWKs of keys that no longer sign but may still have live tokens.
+    #[serde(default)]
+    pub retired_public_jwk_files: Vec<PathBuf>,
+    #[serde(default = "default_jwks_path")]
+    pub jwks_path: String,
+}
+
+/// Required, fail-closed audit storage for token decisions.
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct AuditConfig {
+    /// Append-only keyed JSONL chain, resolved relative to the configuration.
+    pub path: PathBuf,
+    /// Per-segment rotation threshold. Sealed segments are never deleted.
+    pub maximum_file_bytes: u64,
+    /// Owner-only master HMAC key, resolved relative to the configuration.
+    pub hash_key_file: PathBuf,
+    /// Version label written into privacy-preserving audit handles.
+    pub hash_key_version: u32,
+}
+
+/// Names of the claims Mint writes into minted access tokens.
+///
+/// These must match the resource server's `authentication` block. Evidence, for
+/// example, reads its principal, requester tags, evidence audience, and grant
+/// pair from configurable claim names.
+#[derive(Clone, Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ClaimNames {
+    #[serde(default = "default_principal_claim")]
+    pub principal: String,
+    pub requester_tags: String,
+    pub evidence_audience: String,
+    pub grant_id: String,
+    pub grant_authority: String,
+    /// The delegated actor identity, present only where a deployment issues
+    /// delegated tokens. Omitting it is what stops a registry entry that
+    /// declares delegation from ever being served.
+    #[serde(default)]
+    pub actor: Option<String>,
+}
+
+impl ClaimNames {
+    fn validate(&self) -> Result<(), ConfigError> {
+        let mut names = vec![
+            self.principal.as_str(),
+            self.requester_tags.as_str(),
+            self.evidence_audience.as_str(),
+            self.grant_id.as_str(),
+            self.grant_authority.as_str(),
+        ];
+        names.extend(self.actor.as_deref());
+        for name in &names {
+            if name.trim().is_empty() || name.len() > 128 {
+                return Err(ConfigError::Invalid("claim names must be 1..=128 bytes"));
+            }
+        }
+        // A duplicated name would make one claim silently overwrite another,
+        // so authority could be smuggled through the wrong field.
+        let unique = names.iter().collect::<BTreeSet<_>>();
+        if unique.len() != names.len() {
+            return Err(ConfigError::Invalid("claim names must be distinct"));
+        }
+        // These are written by Mint itself and must not be overridable. Minting
+        // writes the registered claims last, so any of these reused as a claim
+        // name would silently replace what Mint decided with what the registry
+        // did: an `aud` shadow yields a token whose audience is the principal
+        // and which still verifies.
+        for reserved in ["iss", "aud", "exp", "iat", "nbf", "jti", "client_id"] {
+            if names.contains(&reserved) {
+                return Err(ConfigError::Invalid(
+                    "authority claim names must not shadow registered JWT claims",
+                ));
+            }
+        }
+        // `sub` is the exception. It always carries the principal, so naming
+        // the principal claim `sub` rewrites the same value and is the default;
+        // any other claim named `sub` would replace the principal.
+        if names.iter().skip(1).any(|name| *name == "sub") {
+            return Err(ConfigError::Invalid(
+                "authority claim names must not shadow registered JWT claims",
+            ));
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct AccessTokenConfig {
+    /// The `aud` written into minted tokens. Matches the resource server's
+    /// configured audiences.
+    pub audiences: Vec<String>,
+    pub lifetime_seconds: u64,
+    pub claims: ClaimNames,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ClientAssertionConfig {
+    /// The value clients must set as the assertion `aud`. Binding assertions to
+    /// this endpoint stops one presented to another service being replayed here.
+    pub audience: String,
+    #[serde(default = "default_assertion_lifetime_seconds")]
+    pub maximum_lifetime_seconds: u64,
+    pub algorithms: Vec<Algorithm>,
+    #[serde(default = "default_replay_cache_entries")]
+    pub replay_cache_entries: usize,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ClientsConfig {
+    /// Directory of per-client registration files, relative to the config file.
+    pub directory: PathBuf,
+}
+
+/// The transport validation boundary selected for this Mint process.
+///
+/// The strict default preserves Mint's HTTPS-only deployment contract.
+/// `SupervisedLocalDevelopment` is an explicit exception for a supervised
+/// process pair on one canonical loopback origin.
+#[derive(Clone, Copy, Debug, Default, Deserialize, Eq, PartialEq)]
+#[serde(rename_all = "kebab-case")]
+pub enum ValidationMode {
+    #[default]
+    Strict,
+    SupervisedLocalDevelopment,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct MintConfig {
+    pub version: u32,
+    #[serde(default)]
+    pub validation_mode: ValidationMode,
+    pub issuer: String,
+    pub listener: ListenerConfig,
+    pub signing: SigningConfig,
+    pub audit: AuditConfig,
+    pub access_tokens: AccessTokenConfig,
+    pub client_assertion: ClientAssertionConfig,
+    pub clients: ClientsConfig,
+}
+
+impl MintConfig {
+    /// Load and validate a configuration document, resolving every path
+    /// relative to the document's own directory.
+    pub fn load(path: &Path) -> Result<Self, ConfigError> {
+        let text = std::fs::read_to_string(path).map_err(|_| ConfigError::Unavailable)?;
+        let mut config: Self = serde_norway::from_str(&text)
+            .map_err(|error| ConfigError::Document(error.to_string()))?;
+        let root = path
+            .parent()
+            .ok_or(ConfigError::Invalid("configuration path has no parent"))?;
+        config.resolve_paths(root);
+        config.validate()?;
+        Ok(config)
+    }
+
+    fn resolve_paths(&mut self, root: &Path) {
+        let resolve = |path: &Path| -> PathBuf {
+            if path.is_absolute() {
+                path.to_path_buf()
+            } else {
+                root.join(path)
+            }
+        };
+        self.signing.active_key_file = resolve(&self.signing.active_key_file);
+        self.signing.retired_public_jwk_files = self
+            .signing
+            .retired_public_jwk_files
+            .iter()
+            .map(|path| resolve(path))
+            .collect();
+        self.audit.path = resolve(&self.audit.path);
+        self.audit.hash_key_file = resolve(&self.audit.hash_key_file);
+        self.clients.directory = resolve(&self.clients.directory);
+    }
+
+    fn validate(&self) -> Result<(), ConfigError> {
+        if self.version != 1 {
+            return Err(ConfigError::Invalid(
+                "only configuration version 1 is supported",
+            ));
+        }
+        match self.validation_mode {
+            ValidationMode::Strict => validate_https_issuer(&self.issuer)?,
+            ValidationMode::SupervisedLocalDevelopment => {
+                self.validate_supervised_local_development_transport()?;
+            }
+        }
+        self.listener.bind_address()?;
+        self.listener.validate()?;
+
+        if self.signing.active_key_id.trim().is_empty() || self.signing.active_key_id.len() > 256 {
+            return Err(ConfigError::Invalid("active key id must be 1..=256 bytes"));
+        }
+        if !self.signing.jwks_path.starts_with('/') {
+            return Err(ConfigError::Invalid("jwks path must be absolute"));
+        }
+        if !is_plain_route_path(&self.signing.jwks_path) {
+            return Err(ConfigError::Invalid(
+                "jwks path must be a plain absolute path with no query, fragment, or route pattern",
+            ));
+        }
+        if MINT_FIXED_ROUTES.contains(&self.signing.jwks_path.as_str()) {
+            return Err(ConfigError::Invalid(
+                "jwks path must not take a route Mint already serves",
+            ));
+        }
+        if self.audit.path.as_os_str().is_empty()
+            || self.audit.hash_key_file.as_os_str().is_empty()
+            || self.audit.hash_key_version == 0
+        {
+            return Err(ConfigError::Invalid(
+                "audit path, hash key file, and non-zero hash key version are required",
+            ));
+        }
+        if !(1_048_576..=1_099_511_627_776).contains(&self.audit.maximum_file_bytes) {
+            return Err(ConfigError::Invalid(
+                "audit maximumFileBytes must be 1048576..=1099511627776",
+            ));
+        }
+        if self.audit.path == self.audit.hash_key_file
+            || self.audit.path == self.signing.active_key_file
+            || self.audit.hash_key_file == self.signing.active_key_file
+        {
+            return Err(ConfigError::Invalid(
+                "audit storage and secret paths must be distinct from signing material",
+            ));
+        }
+
+        if self.access_tokens.audiences.is_empty() || self.access_tokens.audiences.len() > 16 {
+            return Err(ConfigError::Invalid(
+                "between 1 and 16 audiences are required",
+            ));
+        }
+        for audience in &self.access_tokens.audiences {
+            if audience.trim().is_empty() || audience.len() > 512 {
+                return Err(ConfigError::Invalid("audiences must be 1..=512 bytes"));
+            }
+        }
+        // A long-lived bearer token is the thing Mint exists to avoid, and a
+        // token shorter than the verifier's clock skew is unusable.
+        if !(60..=3600).contains(&self.access_tokens.lifetime_seconds) {
+            return Err(ConfigError::Invalid(
+                "access token lifetime must be 60..=3600 seconds",
+            ));
+        }
+        self.access_tokens.claims.validate()?;
+
+        if self.validation_mode == ValidationMode::Strict {
+            validate_https_endpoint(&self.client_assertion.audience)?;
+        }
+        if !(30..=600).contains(&self.client_assertion.maximum_lifetime_seconds) {
+            return Err(ConfigError::Invalid(
+                "client assertion lifetime must be 30..=600 seconds",
+            ));
+        }
+        if self.client_assertion.algorithms.is_empty() {
+            return Err(ConfigError::Invalid(
+                "at least one client assertion algorithm is required",
+            ));
+        }
+        if self.client_assertion.replay_cache_entries < 256 {
+            return Err(ConfigError::Invalid(
+                "the replay cache must hold at least 256 entries",
+            ));
+        }
+        Ok(())
+    }
+
+    fn validate_supervised_local_development_transport(&self) -> Result<(), ConfigError> {
+        let port = parse_canonical_supervised_local_origin(&self.issuer)?;
+        if self.listener.address != "127.0.0.1" || self.listener.port != port {
+            return Err(ConfigError::Invalid(
+                "supervised local development listener must exactly match its canonical issuer origin",
+            ));
+        }
+        if self.signing.jwks_path != MINT_JWKS_PATH {
+            return Err(ConfigError::Invalid(
+                "supervised local development JWKS path must match the fixed Mint path",
+            ));
+        }
+        if self.client_assertion.audience != format!("{}{MINT_TOKEN_PATH}", self.issuer) {
+            return Err(ConfigError::Invalid(
+                "supervised local development client assertion audience must match the fixed Mint token endpoint",
+            ));
+        }
+        Ok(())
+    }
+}
+
+/// Accept only a path that survives both trips the JWKS path has to make.
+///
+/// The router registers this string literally and the metadata document
+/// publishes it as `jwks_uri`. A query or fragment is lost on the way back: a
+/// client fetching the advertised URI sends the path alone, so it would never
+/// reach a route registered with the decoration attached. A route pattern is
+/// the opposite failure, matching paths the metadata never advertised. Either
+/// way Mint reports itself ready while its published key set does not resolve,
+/// which is an outage no probe can see.
+///
+/// So: one or more non-empty segments of unreserved path characters, no dot
+/// segments, and nothing that could be read as a pattern.
+fn is_plain_route_path(path: &str) -> bool {
+    let Some(rest) = path.strip_prefix('/') else {
+        return false;
+    };
+    rest.split('/').all(|segment| {
+        !segment.is_empty()
+            && segment != "."
+            && segment != ".."
+            && segment.bytes().all(|byte| {
+                byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'.' | b'_' | b'~')
+            })
+    })
+}
+
+/// Parse the only HTTP origin admitted for supervised local development.
+///
+/// Exact reconstruction rejects URL-parser aliases such as a trailing slash,
+/// leading-zero port, alternate IPv4 spelling, credentials, query, or fragment.
+fn parse_canonical_supervised_local_origin(value: &str) -> Result<u16, ConfigError> {
+    let port = value
+        .strip_prefix("http://127.0.0.1:")
+        .filter(|port| !port.is_empty() && port.bytes().all(|byte| byte.is_ascii_digit()))
+        .filter(|port| !port.starts_with('0'))
+        .and_then(|port| port.parse::<u16>().ok())
+        .filter(|port| *port != 0)
+        .ok_or(ConfigError::Invalid(
+            "supervised local development issuer must be a canonical 127.0.0.1 HTTP origin with an explicit non-zero port",
+        ))?;
+    if value != format!("http://127.0.0.1:{port}") {
+        return Err(ConfigError::Invalid(
+            "supervised local development issuer must be a canonical 127.0.0.1 HTTP origin with an explicit non-zero port",
+        ));
+    }
+    Ok(port)
+}
+
+/// Require an issuer that is `https`, has a host, and carries no credentials,
+/// query, or fragment. Resource servers compare this string exactly, so any
+/// variable part of it would weaken the comparison.
+pub fn validate_https_issuer(issuer: &str) -> Result<(), ConfigError> {
+    let url =
+        Url::parse(issuer).map_err(|_| ConfigError::Invalid("issuer must be an absolute URL"))?;
+    if url.scheme() != "https" {
+        return Err(ConfigError::Invalid("issuer must use https"));
+    }
+    if !url.has_host() {
+        return Err(ConfigError::Invalid("issuer must have a host"));
+    }
+    if !url.username().is_empty() || url.password().is_some() {
+        return Err(ConfigError::Invalid("issuer must not carry credentials"));
+    }
+    if url.query().is_some() || url.fragment().is_some() {
+        return Err(ConfigError::Invalid(
+            "issuer must not carry a query or fragment",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_https_endpoint(endpoint: &str) -> Result<(), ConfigError> {
+    let url = Url::parse(endpoint)
+        .map_err(|_| ConfigError::Invalid("client assertion audience must be an absolute URL"))?;
+    if url.scheme() != "https" {
+        return Err(ConfigError::Invalid(
+            "client assertion audience must use https",
+        ));
+    }
+    if !url.has_host() {
+        return Err(ConfigError::Invalid(
+            "client assertion audience must have a host",
+        ));
+    }
+    if !url.username().is_empty() || url.password().is_some() {
+        return Err(ConfigError::Invalid(
+            "client assertion audience must not carry credentials",
+        ));
+    }
+    if url.query().is_some() || url.fragment().is_some() {
+        return Err(ConfigError::Invalid(
+            "client assertion audience must not carry a query or fragment",
+        ));
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+    use std::fs;
+
+    pub(crate) const VALID: &str = r#"
+version: 1
+issuer: https://mint.example.org
+listener: {address: 127.0.0.1, port: 8081}
+signing:
+  algorithm: EdDSA
+  activeKeyId: mint-2026-01
+  activeKeyFile: secrets/signing.jwk
+audit:
+  path: audit/mint.jsonl
+  maximumFileBytes: 1073741824
+  hashKeyFile: secrets/audit-hmac-key
+  hashKeyVersion: 1
+accessTokens:
+  audiences: [evidence]
+  lifetimeSeconds: 300
+  claims:
+    principal: sub
+    requesterTags: evidence_tags
+    evidenceAudience: evidence_audience
+    grantId: evidence_grant_id
+    grantAuthority: evidence_authority
+clientAssertion:
+  audience: https://mint.example.org/token
+  algorithms: [EdDSA]
+clients:
+  directory: clients
+"#;
+
+    fn load_from(text: &str) -> Result<MintConfig, ConfigError> {
+        let directory = tempfile::tempdir().expect("temp dir");
+        let path = directory.path().join("mint.yaml");
+        fs::write(&path, text).expect("write config");
+        MintConfig::load(&path)
+    }
+
+    fn load_error(text: &str) -> ConfigError {
+        load_from(text).expect_err("the document must be rejected")
+    }
+
+    /// A valid configuration for tests in other modules that need one but do
+    /// not exercise loading itself.
+    pub(crate) fn sample_config() -> MintConfig {
+        load_from(VALID).expect("the sample configuration is valid")
+    }
+
+    #[test]
+    fn a_valid_document_loads_and_resolves_paths_against_the_config_directory() {
+        let directory = tempfile::tempdir().expect("temp dir");
+        let path = directory.path().join("mint.yaml");
+        fs::write(&path, VALID).expect("write config");
+        let config = MintConfig::load(&path).expect("valid config loads");
+
+        assert_eq!(config.issuer, "https://mint.example.org");
+        assert_eq!(config.validation_mode, ValidationMode::Strict);
+        assert_eq!(
+            config.signing.active_key_file,
+            directory.path().join("secrets/signing.jwk")
+        );
+        assert_eq!(config.clients.directory, directory.path().join("clients"));
+        assert_eq!(config.audit.path, directory.path().join("audit/mint.jsonl"));
+        assert_eq!(config.audit.maximum_file_bytes, 1_073_741_824);
+        assert_eq!(
+            config.audit.hash_key_file,
+            directory.path().join("secrets/audit-hmac-key")
+        );
+        assert_eq!(config.audit.hash_key_version, 1);
+        assert_eq!(config.signing.jwks_path, "/.well-known/jwks.json");
+        assert_eq!(config.client_assertion.maximum_lifetime_seconds, 300);
+    }
+
+    #[test]
+    fn audit_configuration_is_required_bounded_and_separate_from_secrets() {
+        assert!(load_from(&VALID.replace(
+            "audit:\n  path: audit/mint.jsonl\n  maximumFileBytes: 1073741824\n  hashKeyFile: secrets/audit-hmac-key\n  hashKeyVersion: 1\n",
+            ""
+        ))
+        .is_err());
+        assert_eq!(
+            load_error(&VALID.replace("hashKeyVersion: 1", "hashKeyVersion: 0")),
+            ConfigError::Invalid(
+                "audit path, hash key file, and non-zero hash key version are required"
+            )
+        );
+        assert_eq!(
+            load_error(&VALID.replace("maximumFileBytes: 1073741824", "maximumFileBytes: 1024")),
+            ConfigError::Invalid("audit maximumFileBytes must be 1048576..=1099511627776")
+        );
+        assert_eq!(
+            load_error(&VALID.replace(
+                "hashKeyFile: secrets/audit-hmac-key",
+                "hashKeyFile: secrets/signing.jwk"
+            )),
+            ConfigError::Invalid(
+                "audit storage and secret paths must be distinct from signing material"
+            )
+        );
+    }
+
+    #[test]
+    fn a_jwks_path_may_not_take_a_route_mint_already_serves() {
+        for path in MINT_FIXED_ROUTES {
+            let text = VALID.replace(
+                "activeKeyFile: secrets/signing.jwk",
+                &format!("activeKeyFile: secrets/signing.jwk\n  jwksPath: {path}"),
+            );
+            assert_eq!(
+                load_error(&text),
+                ConfigError::Invalid("jwks path must not take a route Mint already serves"),
+                "jwks path {path} must be rejected"
+            );
+        }
+    }
+
+    #[test]
+    fn a_jwks_path_must_be_a_path_a_client_can_fetch() {
+        // The path is registered as a route and published as `jwks_uri`. A
+        // query or fragment survives neither trip: the router matches the
+        // literal string, and a client sends only the path back. A route
+        // pattern is worse, because it matches paths the metadata never named.
+        for path in [
+            "/keys?tenant=a",
+            "/keys#v1",
+            "/keys/{tenant}",
+            "/{*rest}",
+            "/keys//v1",
+            "/keys/",
+            "/keys/../token",
+            "/keys/.",
+            "/keys v1",
+            "/keys%2ftoken",
+        ] {
+            let text = VALID.replace(
+                "activeKeyFile: secrets/signing.jwk",
+                &format!("activeKeyFile: secrets/signing.jwk\n  jwksPath: \"{path}\""),
+            );
+            assert_eq!(
+                load_error(&text),
+                ConfigError::Invalid("jwks path must be a plain absolute path with no query, fragment, or route pattern"),
+                "jwks path {path} must be rejected"
+            );
+        }
+    }
+
+    #[test]
+    fn a_plain_absolute_jwks_path_is_accepted() {
+        for path in [
+            "/.well-known/jwks.json",
+            "/keys",
+            "/v1/keys.json",
+            "/a~b-c_d",
+        ] {
+            let text = VALID.replace(
+                "activeKeyFile: secrets/signing.jwk",
+                &format!("activeKeyFile: secrets/signing.jwk\n  jwksPath: \"{path}\""),
+            );
+            let config = load_from(&text).expect("a plain absolute path loads");
+            assert_eq!(config.signing.jwks_path, path);
+        }
+    }
+
+    #[test]
+    fn listener_limits_must_admit_a_request() {
+        for (field, value) in [
+            ("maximumRequestBytes", 0),
+            ("maximumRequestBytes", 1_048_577),
+            ("requestTimeoutMilliseconds", 0),
+            ("requestTimeoutMilliseconds", 30_001),
+        ] {
+            let text = VALID.replace(
+                "listener: {address: 127.0.0.1, port: 8081}",
+                &format!("listener: {{address: 127.0.0.1, port: 8081, {field}: {value}}}"),
+            );
+            assert!(
+                matches!(load_from(&text), Err(ConfigError::Invalid(_))),
+                "{field} {value} must be rejected"
+            );
+        }
+    }
+
+    #[test]
+    fn unknown_fields_are_rejected() {
+        let text = VALID.replace("version: 1", "version: 1\nunexpected: true");
+        assert!(matches!(load_from(&text), Err(ConfigError::Document(_))));
+    }
+
+    #[test]
+    fn issuers_must_be_https_hosts_without_credentials_or_query() {
+        for issuer in [
+            "http://mint.example.org",
+            "https://user:pass@mint.example.org",
+            "https://mint.example.org?tenant=a",
+            "https://mint.example.org#frag",
+            "mint.example.org",
+            "https://",
+        ] {
+            let text = VALID.replace("https://mint.example.org\n", &format!("{issuer}\n"));
+            assert!(
+                matches!(load_from(&text), Err(ConfigError::Invalid(_))),
+                "issuer {issuer} must be rejected"
+            );
+        }
+    }
+
+    #[test]
+    fn supervised_local_development_accepts_only_the_exact_mint_transport() {
+        let local = VALID
+            .replace(
+                "version: 1",
+                "version: 1\nvalidationMode: supervised-local-development",
+            )
+            .replace(
+                "issuer: https://mint.example.org",
+                "issuer: http://127.0.0.1:8081",
+            )
+            .replace(
+                "audience: https://mint.example.org/token",
+                "audience: http://127.0.0.1:8081/token",
+            );
+        let config = load_from(&local).expect("the supervised local transport is valid");
+        assert_eq!(
+            config.validation_mode,
+            ValidationMode::SupervisedLocalDevelopment
+        );
+
+        for port in [1_u16, u16::MAX] {
+            let boundary = local.replace("8081", &port.to_string());
+            load_from(&boundary).unwrap_or_else(|error| {
+                panic!("canonical boundary port {port} must be accepted: {error}")
+            });
+        }
+
+        for invalid_issuer in [
+            "http://localhost:8081",
+            "http://[::1]:8081",
+            "http://127.0.0.2:8081",
+            "http://127.00.0.1:8081",
+            "http://127.0.0.1",
+            "http://127.0.0.1:0",
+            "http://127.0.0.1:08081",
+            "http://127.0.0.1:65536",
+            "http://user@127.0.0.1:8081",
+            "http://127.0.0.1:8081/",
+            "http://127.0.0.1:8081?tenant=x",
+            "http://127.0.0.1:8081#fragment",
+            "https://127.0.0.1:8081",
+        ] {
+            let invalid = local.replace(
+                "issuer: http://127.0.0.1:8081",
+                &format!("issuer: {invalid_issuer}"),
+            );
+            assert!(
+                load_from(&invalid).is_err(),
+                "accepted supervised local issuer {invalid_issuer}"
+            );
+        }
+
+        for invalid_audience in [
+            "http://127.0.0.1:8081",
+            "http://127.0.0.1:8081/token/",
+            "http://127.0.0.1:8081/TOKEN",
+            "http://127.0.0.1:8081/oauth/token",
+            "http://127.0.0.1:8081/token?tenant=x",
+            "http://127.0.0.1:8081/token#fragment",
+            "http://127.0.0.1:8082/token",
+        ] {
+            let invalid = local.replace(
+                "audience: http://127.0.0.1:8081/token",
+                &format!("audience: {invalid_audience}"),
+            );
+            assert!(
+                load_from(&invalid).is_err(),
+                "accepted supervised local assertion audience {invalid_audience}"
+            );
+        }
+
+        for replacement in [
+            "listener: {address: 127.0.0.2, port: 8081}",
+            "listener: {address: 127.0.0.1, port: 8082}",
+            "listener: {address: 127.0.0.1, port: 0}",
+        ] {
+            let invalid = local.replace("listener: {address: 127.0.0.1, port: 8081}", replacement);
+            assert!(
+                load_from(&invalid).is_err(),
+                "accepted mismatched listener {replacement}"
+            );
+        }
+
+        let wrong_jwks = local.replace(
+            "activeKeyFile: secrets/signing.jwk",
+            "activeKeyFile: secrets/signing.jwk\n  jwksPath: /.well-known/keys.json",
+        );
+        assert!(
+            load_from(&wrong_jwks).is_err(),
+            "accepted a non-Mint JWKS path"
+        );
+    }
+
+    #[test]
+    fn strict_mode_is_the_https_only_default() {
+        let default = load_from(VALID).expect("the existing strict document remains valid");
+        assert_eq!(default.validation_mode, ValidationMode::Strict);
+
+        let explicit = VALID.replace("version: 1", "version: 1\nvalidationMode: strict");
+        assert_eq!(
+            load_from(&explicit)
+                .expect("the explicit strict mode is valid")
+                .validation_mode,
+            ValidationMode::Strict
+        );
+
+        let local_without_mode = VALID
+            .replace(
+                "issuer: https://mint.example.org",
+                "issuer: http://127.0.0.1:8081",
+            )
+            .replace(
+                "audience: https://mint.example.org/token",
+                "audience: http://127.0.0.1:8081/token",
+            );
+        assert!(
+            load_from(&local_without_mode).is_err(),
+            "strict Mint inherited the local HTTP exception"
+        );
+
+        for invalid_audience in [
+            "http://127.0.0.1:8081/token",
+            "https://user:pass@mint.example.org/token",
+            "https://mint.example.org/token?tenant=x",
+            "https://mint.example.org/token#fragment",
+            "mint.example.org/token",
+            "https://",
+        ] {
+            let invalid = VALID.replace(
+                "audience: https://mint.example.org/token",
+                &format!("audience: {invalid_audience}"),
+            );
+            assert!(
+                load_from(&invalid).is_err(),
+                "strict Mint accepted assertion audience {invalid_audience}"
+            );
+        }
+    }
+
+    #[test]
+    fn access_token_lifetime_is_bounded_on_both_sides() {
+        for lifetime in ["1", "59", "3601", "86400"] {
+            let text = VALID.replace(
+                "lifetimeSeconds: 300",
+                &format!("lifetimeSeconds: {lifetime}"),
+            );
+            assert_eq!(
+                load_error(&text),
+                ConfigError::Invalid("access token lifetime must be 60..=3600 seconds"),
+                "lifetime {lifetime} must be rejected"
+            );
+        }
+    }
+
+    #[test]
+    fn duplicate_claim_names_are_rejected() {
+        let text = VALID.replace("grantId: evidence_grant_id", "grantId: evidence_tags");
+        assert_eq!(
+            load_error(&text),
+            ConfigError::Invalid("claim names must be distinct")
+        );
+    }
+
+    #[test]
+    fn authority_claims_cannot_shadow_registered_jwt_claims() {
+        for reserved in ["iss", "aud", "exp", "jti", "client_id"] {
+            let text = VALID.replace(
+                "requesterTags: evidence_tags",
+                &format!("requesterTags: {reserved}"),
+            );
+            assert_eq!(
+                load_error(&text),
+                ConfigError::Invalid("authority claim names must not shadow registered JWT claims"),
+                "claim {reserved} must be rejected"
+            );
+        }
+    }
+
+    #[test]
+    fn the_principal_claim_is_bound_by_the_same_rule_as_the_others() {
+        // Minting writes the registered claims after the JWT ones, so a
+        // principal named for a reserved claim would overwrite it. `aud` is the
+        // one that matters most: the token would carry the principal as its
+        // audience and still verify.
+        for reserved in ["iss", "aud", "exp", "iat", "nbf", "jti", "client_id"] {
+            let text = VALID.replace("principal: sub", &format!("principal: {reserved}"));
+            assert_eq!(
+                load_error(&text),
+                ConfigError::Invalid("authority claim names must not shadow registered JWT claims"),
+                "principal {reserved} must be rejected"
+            );
+        }
+    }
+
+    #[test]
+    fn only_the_principal_may_be_named_sub() {
+        // `sub` always carries the principal, so naming the principal claim
+        // `sub` is the default and merely rewrites the same value.
+        load_from(VALID).expect("principal may be named sub");
+
+        // Any other claim named `sub` would replace the principal with its own
+        // value, which for requester tags is not even a string. The principal
+        // moves off `sub` first, so this is the shadowing rule answering rather
+        // than the distinctness rule.
+        let renamed = VALID.replace("principal: sub", "principal: evidence_principal");
+        for field in [
+            "requesterTags: evidence_tags",
+            "evidenceAudience: evidence_audience",
+            "grantId: evidence_grant_id",
+            "grantAuthority: evidence_authority",
+        ] {
+            let name = field.split(':').next().expect("a claim field name");
+            let text = renamed.replace(field, &format!("{name}: sub"));
+            assert_eq!(
+                load_error(&text),
+                ConfigError::Invalid("authority claim names must not shadow registered JWT claims"),
+                "{name} must not be named sub"
+            );
+        }
+    }
+
+    #[test]
+    fn the_actor_claim_is_optional_and_obeys_every_other_claim_name_rule() {
+        // A deployment that never delegates names no actor claim at all.
+        assert!(sample_config().access_tokens.claims.actor.is_none());
+
+        let with_actor = |name: &str| {
+            VALID.replace(
+                "grantAuthority: evidence_authority",
+                &format!("grantAuthority: evidence_authority\n    actor: {name}"),
+            )
+        };
+
+        let config = load_from(&with_actor("evidence_actor")).expect("an actor claim is accepted");
+        assert_eq!(
+            config.access_tokens.claims.actor.as_deref(),
+            Some("evidence_actor")
+        );
+
+        // Reusing another authority claim would let the actor overwrite it.
+        assert_eq!(
+            load_error(&with_actor("evidence_tags")),
+            ConfigError::Invalid("claim names must be distinct")
+        );
+        assert_eq!(
+            load_error(&with_actor("client_id")),
+            ConfigError::Invalid("authority claim names must not shadow registered JWT claims")
+        );
+        assert_eq!(
+            load_error(&with_actor("\"\"")),
+            ConfigError::Invalid("claim names must be 1..=128 bytes")
+        );
+    }
+
+    #[test]
+    fn version_must_be_one_and_audiences_must_be_present() {
+        let text = VALID.replace("version: 1", "version: 2");
+        assert_eq!(
+            load_error(&text),
+            ConfigError::Invalid("only configuration version 1 is supported")
+        );
+
+        let text = VALID.replace("audiences: [evidence]", "audiences: []");
+        assert_eq!(
+            load_error(&text),
+            ConfigError::Invalid("between 1 and 16 audiences are required")
+        );
+    }
+}
diff --git a/crates/registry-mint/src/error.rs b/crates/registry-mint/src/error.rs
new file mode 100644
index 000000000..1531c3b87
--- /dev/null
+++ b/crates/registry-mint/src/error.rs
@@ -0,0 +1,161 @@
+//! OAuth 2.0 token endpoint errors.
+//!
+//! The public error code is deliberately coarse. Whether a client is unknown,
+//! presented a bad signature, replayed a `jti`, or sent an expired assertion,
+//! the caller sees `invalid_client`. Distinguishing those cases on the wire
+//! would turn the token endpoint into an oracle for probing the client
+//! registry. The specific reason is retained for operator logs only.
+
+use axum::{
+    http::StatusCode,
+    response::{IntoResponse, Response},
+    Json,
+};
+use serde::Serialize;
+
+/// RFC 6749 section 5.2 error codes, restricted to the ones Mint can return.
+#[derive(Debug, Clone, Copy, Eq, PartialEq)]
+pub enum TokenErrorCode {
+    InvalidRequest,
+    InvalidClient,
+    UnsupportedGrantType,
+    ServerError,
+}
+
+impl TokenErrorCode {
+    #[must_use]
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::InvalidRequest => "invalid_request",
+            Self::InvalidClient => "invalid_client",
+            Self::UnsupportedGrantType => "unsupported_grant_type",
+            Self::ServerError => "server_error",
+        }
+    }
+
+    #[must_use]
+    pub fn status(self) -> StatusCode {
+        match self {
+            Self::InvalidRequest | Self::UnsupportedGrantType => StatusCode::BAD_REQUEST,
+            Self::InvalidClient => StatusCode::UNAUTHORIZED,
+            Self::ServerError => StatusCode::INTERNAL_SERVER_ERROR,
+        }
+    }
+}
+
+#[derive(Debug, Serialize)]
+struct TokenErrorBody {
+    error: &'static str,
+}
+
+/// A token endpoint failure carrying a public code and a private reason.
+#[derive(Debug, Clone, Eq, PartialEq)]
+pub struct TokenError {
+    code: TokenErrorCode,
+    reason: &'static str,
+}
+
+impl TokenError {
+    #[must_use]
+    pub fn new(code: TokenErrorCode, reason: &'static str) -> Self {
+        Self { code, reason }
+    }
+
+    #[must_use]
+    pub fn invalid_request(reason: &'static str) -> Self {
+        Self::new(TokenErrorCode::InvalidRequest, reason)
+    }
+
+    /// Every client authentication failure collapses to this variant.
+    #[must_use]
+    pub fn invalid_client(reason: &'static str) -> Self {
+        Self::new(TokenErrorCode::InvalidClient, reason)
+    }
+
+    #[must_use]
+    pub fn unsupported_grant_type(reason: &'static str) -> Self {
+        Self::new(TokenErrorCode::UnsupportedGrantType, reason)
+    }
+
+    #[must_use]
+    pub fn server_error(reason: &'static str) -> Self {
+        Self::new(TokenErrorCode::ServerError, reason)
+    }
+
+    #[must_use]
+    pub fn code(&self) -> TokenErrorCode {
+        self.code
+    }
+
+    /// Operator-facing detail. Never sent to the caller.
+    #[must_use]
+    pub fn reason(&self) -> &'static str {
+        self.reason
+    }
+
+    /// Render a token-operation failure with its privacy-safe correlation id.
+    #[must_use]
+    pub fn into_operation_response(self, operation: &str) -> Response {
+        self.respond(Some(operation))
+    }
+
+    fn respond(self, operation: Option<&str>) -> Response {
+        tracing::warn!(
+            target: "registry_mint::token",
+            operation,
+            error = self.code.as_str(),
+            reason = self.reason,
+            "token request rejected"
+        );
+        let mut response = (
+            self.code.status(),
+            Json(TokenErrorBody {
+                error: self.code.as_str(),
+            }),
+        )
+            .into_response();
+        if self.code == TokenErrorCode::InvalidClient {
+            response.headers_mut().insert(
+                axum::http::header::WWW_AUTHENTICATE,
+                axum::http::HeaderValue::from_static("Bearer error=\"invalid_client\""),
+            );
+        }
+        response
+    }
+}
+
+impl IntoResponse for TokenError {
+    fn into_response(self) -> Response {
+        self.respond(None)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn client_authentication_failures_share_one_public_code() {
+        for reason in [
+            "unknown client",
+            "signature did not verify",
+            "assertion replayed",
+            "assertion expired",
+        ] {
+            let error = TokenError::invalid_client(reason);
+            assert_eq!(error.code().as_str(), "invalid_client");
+            assert_eq!(error.code().status(), StatusCode::UNAUTHORIZED);
+        }
+    }
+
+    #[test]
+    fn public_codes_match_the_oauth_registry() {
+        assert_eq!(TokenErrorCode::InvalidRequest.as_str(), "invalid_request");
+        assert_eq!(TokenErrorCode::InvalidClient.as_str(), "invalid_client");
+        assert_eq!(
+            TokenErrorCode::UnsupportedGrantType.as_str(),
+            "unsupported_grant_type"
+        );
+        assert_eq!(TokenErrorCode::ServerError.as_str(), "server_error");
+    }
+}
diff --git a/crates/registry-mint/src/lib.rs b/crates/registry-mint/src/lib.rs
new file mode 100644
index 000000000..21d1c44de
--- /dev/null
+++ b/crates/registry-mint/src/lib.rs
@@ -0,0 +1,66 @@
+//! Registry Mint: a minimal OAuth 2.0 token issuer for RegistryStack services.
+//!
+//! Mint exists to answer one question that a JWKS alone cannot answer: *which
+//! principal signed this token, and what is that principal allowed to assert?*
+//!
+//! A resource server such as Evidence verifies an access token by selecting a
+//! key from a JWKS using the token's own `kid` header, then reading the
+//! authority claims out of the payload. Nothing in that flow binds a key to a
+//! permitted claim set, so every key published in a JWKS is equally
+//! authoritative for every claim. Distributing signing keys directly to callers
+//! therefore makes each caller an issuer able to speak as any other.
+//!
+//! Mint keeps that binding server-side. Callers hold their own private keys and
+//! authenticate with an RFC 7523 `private_key_jwt` client assertion. Mint
+//! verifies that assertion against **only the keys registered for the asserted
+//! client**, then mints an access token whose authority claims are read from
+//! the server-side client registry and never from the assertion. A caller can
+//! prove who it is; it cannot choose what it is allowed to say.
+//!
+//! # Trust split
+//!
+//! - Issuer identity, signing and audit keys, listener, and token policy are startup-only
+//!   and immutable for the process lifetime.
+//! - The client registry is reloadable, so onboarding, offboarding, and key
+//!   rotation for callers never require restarting a resource server.
+//!
+//! That split is the point of running Mint as a separate process: Evidence
+//! keeps its immutable governed bundle while the caller population changes.
+//!
+//! # Naming
+//!
+//! "Issuer" here means OAuth token issuance. It is unrelated to the verifiable
+//! credential issuance performed by Registry Notary.
+
+#[cfg(not(unix))]
+compile_error!(
+    "registry-mint requires a Unix target for owner-only signing and audit file guarantees"
+);
+
+pub mod assertion;
+pub mod audit;
+pub mod caller;
+pub mod clients;
+pub mod config;
+pub mod error;
+pub mod replay;
+pub mod secretfile;
+pub mod server;
+pub mod token;
+
+/// RFC 7523 client assertion type for `private_key_jwt` authentication.
+pub const CLIENT_ASSERTION_TYPE: &str = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+
+/// The only grant type Mint issues tokens for.
+pub const GRANT_TYPE_CLIENT_CREDENTIALS: &str = "client_credentials";
+
+/// Media type of the minted access tokens.
+pub const ACCESS_TOKEN_TYP: &str = "at+jwt";
+
+/// The client assertion member naming the actor and subject a delegated token
+/// is requested for.
+///
+/// This is Mint's own member, not RFC 8693 `act`: token exchange presents a
+/// subject's own credential, which is precisely what a deployment without an
+/// identity provider does not have.
+pub const ON_BEHALF_OF_CLAIM: &str = "on_behalf_of";
diff --git a/crates/registry-mint/src/main.rs b/crates/registry-mint/src/main.rs
new file mode 100644
index 000000000..29d8e52ad
--- /dev/null
+++ b/crates/registry-mint/src/main.rs
@@ -0,0 +1,387 @@
+//! The `mint` binary.
+//!
+//! Three subcommands. `check` validates a deployment without opening a socket
+//! and `serve` runs the token endpoint; `SIGHUP` reloads the client registry in
+//! place so onboarding a caller never restarts the service.
+//!
+//! `token` is the odd one out: it is a *caller* tool, not an operator one. It
+//! reads no server configuration and never touches Mint's signing key. It signs
+//! a client assertion with the caller's own key and presents it to a running
+//! token endpoint, which then decides on its own terms. Obtaining a token still
+//! requires authenticating, in the CLI exactly as over the wire.
+
+use std::{
+    collections::BTreeMap,
+    path::{Path, PathBuf},
+    process::ExitCode,
+    sync::Arc,
+};
+
+use clap::{Parser, Subcommand};
+use registry_mint::{
+    audit::MintAuditLog,
+    caller::{sign_client_assertion, AssertionRequest},
+    config::MintConfig,
+    secretfile,
+    server::{serve, MintService},
+    CLIENT_ASSERTION_TYPE, GRANT_TYPE_CLIENT_CREDENTIALS,
+};
+use registry_platform_audit::OptionalHashHex;
+use serde_json::Value;
+
+#[derive(Debug, Parser)]
+#[command(name = "mint", about = "Registry Stack token issuer", version)]
+struct Cli {
+    #[command(subcommand)]
+    command: Command,
+}
+
+#[derive(Debug, Subcommand)]
+enum Command {
+    /// Load the configuration, keys, audit chain, and client registry, then exit.
+    Check {
+        #[arg(long, env = "MINT_CONFIG")]
+        config: PathBuf,
+    },
+    /// Serve the token endpoint until terminated.
+    Serve {
+        #[arg(long, env = "MINT_CONFIG")]
+        config: PathBuf,
+    },
+    /// Verify the retained keyed Mint audit chain named by the configuration.
+    VerifyAudit {
+        #[arg(long, env = "MINT_CONFIG")]
+        config: PathBuf,
+    },
+    /// Obtain an access token from a running token endpoint, as a client would.
+    ///
+    /// This authenticates. It signs a client assertion with the caller's own
+    /// key and posts it; the endpoint decides. Nothing here can produce a token
+    /// the same request over the wire would not have produced.
+    Token {
+        /// The token endpoint, for example `https://mint.example.org/token`.
+        #[arg(long)]
+        url: String,
+        /// The `clientId` this caller is registered under.
+        #[arg(long)]
+        client_id: String,
+        /// The caller's private JWK. Must be owner-only and not a symlink.
+        #[arg(long)]
+        key: PathBuf,
+        /// The endpoint's configured `clientAssertion.audience`. Defaults to
+        /// `--url`, which is the usual configuration.
+        #[arg(long)]
+        audience: Option<String>,
+        /// Request a delegated token for this actor. Requires `--subject-file`.
+        #[arg(long)]
+        actor: Option<String>,
+        /// A JSON object of subject selector fields, for the actor to act for.
+        ///
+        /// A file rather than repeated flags on purpose: these are a real
+        /// person's identifying details, and command lines are visible to every
+        /// process on the host and land in shell history.
+        #[arg(long)]
+        subject_file: Option<PathBuf>,
+        /// Assertion lifetime in seconds.
+        #[arg(long, default_value_t = 120)]
+        lifetime_seconds: i64,
+        /// Trust this PEM certificate bundle in addition to the system roots,
+        /// for a development deployment behind a private CA.
+        #[arg(long)]
+        ca_certificate: Option<PathBuf>,
+        /// Print the full endpoint response instead of the access token alone.
+        #[arg(long)]
+        verbose: bool,
+    },
+}
+
+fn main() -> ExitCode {
+    let cli = Cli::parse();
+
+    // `token` writes the access token to stdout and nothing else, so its
+    // diagnostics go to stderr and the caller can pipe the token straight into
+    // whatever needs it. The services keep structured logs on stdout.
+    let logs = tracing_subscriber::fmt()
+        .with_env_filter(
+            tracing_subscriber::EnvFilter::try_from_default_env()
+                .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),
+        )
+        .json();
+    if matches!(cli.command, Command::Token { .. }) {
+        logs.with_writer(std::io::stderr).init();
+    } else {
+        logs.init();
+    }
+
+    match run(cli) {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(message) => {
+            // Startup failures name the failing stage, never the key material
+            // or the file contents that produced them.
+            tracing::error!(target: "registry_mint", "{message}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run(cli: Cli) -> Result<(), String> {
+    match cli.command {
+        Command::Check { config } => {
+            let config = MintConfig::load(&config)
+                .map_err(|error| format!("the configuration could not be loaded: {error}"))?;
+            let clients = MintService::check(&config)
+                .map_err(|error| format!("the configuration cannot be served: {error}"))?;
+            tracing::info!(
+                target: "registry_mint",
+                issuer = config.issuer,
+                clients,
+                "configuration is valid"
+            );
+            Ok(())
+        }
+        Command::Serve { config } => {
+            let runtime = tokio::runtime::Builder::new_multi_thread()
+                .enable_all()
+                .build()
+                .map_err(|error| format!("the async runtime could not start: {error}"))?;
+            runtime.block_on(async move {
+                let service = Arc::new(load(&config).await?);
+                let reloads = Arc::clone(&service);
+                tokio::spawn(async move { reload_on_hangup(reloads).await });
+                serve(service, shutdown_signal())
+                    .await
+                    .map_err(|error| format!("the listener failed: {error}"))
+            })
+        }
+        Command::VerifyAudit { config } => {
+            let config = MintConfig::load(&config)
+                .map_err(|error| format!("the configuration could not be loaded: {error}"))?;
+            let summary = MintAuditLog::verify(&config.audit)
+                .map_err(|error| format!("the audit chain did not verify: {error}"))?;
+            let sealed_sequence = match (summary.first_sequence, summary.last_sequence) {
+                (Some(first), Some(last)) => format!("{first}-{last}"),
+                _ => "none".to_owned(),
+            };
+            let active_segment = if summary.active_verified {
+                "verified"
+            } else {
+                "not verified: a running writer holds it, so only sealed history was proven"
+            };
+            println!(
+                "segments: {}\nrecords: {}\nsealed-sequence: {}\nhead: {}\nactive-segment: {}",
+                summary.segments,
+                summary.records,
+                sealed_sequence,
+                OptionalHashHex(summary.last_hash),
+                active_segment,
+            );
+            Ok(())
+        }
+        Command::Token {
+            url,
+            client_id,
+            key,
+            audience,
+            actor,
+            subject_file,
+            lifetime_seconds,
+            ca_certificate,
+            verbose,
+        } => {
+            // The caller's key gets the same file guarantees as Mint's own:
+            // a regular file, owned by this user, unreadable by anyone else,
+            // and reached without traversing a symlink.
+            let key = secretfile::read_owner_only(&key)
+                .map_err(|error| format!("the client key could not be read: {error}"))?;
+            let key = registry_platform_crypto::PrivateJwk::parse(&key)
+                .map_err(|error| format!("the client key is not a usable private JWK: {error}"))?;
+
+            let subject = subject_file.as_deref().map(read_subject).transpose()?;
+            let assertion = sign_client_assertion(
+                &key,
+                &AssertionRequest {
+                    client_id: &client_id,
+                    audience: audience.as_deref().unwrap_or(&url),
+                    lifetime_seconds,
+                    actor: actor.as_deref(),
+                    subject,
+                },
+                now_seconds()?,
+            )
+            .map_err(|error| format!("the client assertion could not be built: {error}"))?;
+
+            let runtime = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .map_err(|error| format!("the async runtime could not start: {error}"))?;
+            let response =
+                runtime.block_on(request_token(&url, &assertion, ca_certificate.as_deref()))?;
+
+            if verbose {
+                println!("{response}");
+            } else {
+                let token = response
+                    .get("access_token")
+                    .and_then(Value::as_str)
+                    .ok_or_else(|| "the endpoint returned no access token".to_owned())?;
+                println!("{token}");
+            }
+            Ok(())
+        }
+    }
+}
+
+/// Read the delegation subject: a flat JSON object of selector fields.
+fn read_subject(path: &Path) -> Result<BTreeMap<String, Value>, String> {
+    let bytes = std::fs::read(path)
+        .map_err(|error| format!("the subject file could not be read: {error}"))?;
+    let subject: Value = serde_json::from_slice(&bytes)
+        .map_err(|error| format!("the subject file is not JSON: {error}"))?;
+    let Value::Object(fields) = subject else {
+        return Err("the subject file must hold a JSON object of selector fields".to_owned());
+    };
+    // Selector values are scalars. Rejecting anything else here names the
+    // problem, where the endpoint could only answer `invalid_client`.
+    for (name, value) in &fields {
+        if value.is_object() || value.is_array() || value.is_null() {
+            return Err(format!("the subject field `{name}` must be a scalar value"));
+        }
+    }
+    Ok(fields.into_iter().collect())
+}
+
+async fn request_token(
+    url: &str,
+    assertion: &str,
+    ca_certificate: Option<&Path>,
+) -> Result<Value, String> {
+    let mut client = reqwest::Client::builder();
+    if let Some(path) = ca_certificate {
+        let pem = std::fs::read(path)
+            .map_err(|error| format!("the CA certificate could not be read: {error}"))?;
+        for certificate in reqwest::Certificate::from_pem_bundle(&pem)
+            .map_err(|error| format!("the CA certificate could not be parsed: {error}"))?
+        {
+            client = client.add_root_certificate(certificate);
+        }
+    }
+    let client = client
+        .build()
+        .map_err(|error| format!("the HTTP client could not be built: {error}"))?;
+
+    let response = client
+        .post(url)
+        .form(&[
+            ("grant_type", GRANT_TYPE_CLIENT_CREDENTIALS),
+            ("client_assertion_type", CLIENT_ASSERTION_TYPE),
+            ("client_assertion", assertion),
+        ])
+        .send()
+        .await
+        .map_err(|error| format!("the token request failed: {error}"))?;
+
+    let status = response.status();
+    let body = response
+        .text()
+        .await
+        .map_err(|error| format!("the token response could not be read: {error}"))?;
+    if !status.is_success() {
+        // The request carried a signed client assertion, which is a bearer
+        // credential at the endpoint it is bound to until it expires. Whatever
+        // answered here is not necessarily that endpoint, and a refusal body is
+        // free to quote the form back. Report the two bounded OAuth fields and
+        // drop the rest rather than write the assertion into stderr, the
+        // operator's logs, and their scrollback.
+        return Err(format!(
+            "the endpoint refused the request ({status}): {}",
+            oauth_error(&body)
+        ));
+    }
+    serde_json::from_str(&body).map_err(|error| format!("the token response is not JSON: {error}"))
+}
+
+/// Summarize a refusal using only the two fields RFC 6749 defines for one.
+///
+/// Both are reproduced as printable ASCII within the length the RFC's own
+/// grammar allows, so a hostile or merely careless endpoint cannot use the
+/// refusal to write arbitrary bytes, control sequences, or the caller's own
+/// request into the terminal.
+fn oauth_error(body: &str) -> String {
+    let Ok(Value::Object(fields)) = serde_json::from_str::<Value>(body) else {
+        return "the response carried no OAuth error".to_owned();
+    };
+    let field = |name: &str| -> Option<String> {
+        let value = fields.get(name)?.as_str()?;
+        let bounded: String = value
+            .chars()
+            .filter(|character| {
+                character.is_ascii_graphic() || *character == ' ' || *character == '\t'
+            })
+            .take(200)
+            .collect();
+        (!bounded.is_empty()).then_some(bounded)
+    };
+    match (field("error"), field("error_description")) {
+        (Some(error), Some(description)) => format!("{error}: {description}"),
+        (Some(error), None) => error,
+        _ => "the response carried no OAuth error".to_owned(),
+    }
+}
+
+fn now_seconds() -> Result<i64, String> {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|elapsed| elapsed.as_secs() as i64)
+        .map_err(|_| "the system clock is before the Unix epoch".to_owned())
+}
+
+async fn load(config: &Path) -> Result<MintService, String> {
+    let config = MintConfig::load(config)
+        .map_err(|error| format!("the configuration could not be loaded: {error}"))?;
+    MintService::load(config)
+        .await
+        .map_err(|error| format!("the service could not start: {error}"))
+}
+
+/// Reload the client registry on every `SIGHUP`, keeping the previous registry
+/// when the new one does not load.
+async fn reload_on_hangup(service: Arc<MintService>) {
+    let mut hangup = match tokio::signal::unix::signal(tokio::signal::unix::SignalKind::hangup()) {
+        Ok(hangup) => hangup,
+        Err(error) => {
+            tracing::error!(target: "registry_mint", "the hangup handler could not be installed: {error}");
+            return;
+        }
+    };
+    while hangup.recv().await.is_some() {
+        match service.reload_clients() {
+            Ok(clients) => {
+                tracing::info!(target: "registry_mint", clients, "client registry reloaded");
+            }
+            Err(error) => {
+                tracing::error!(
+                    target: "registry_mint",
+                    "the client registry was not reloaded and the previous one is still in use: {error}"
+                );
+            }
+        }
+    }
+}
+
+async fn shutdown_signal() {
+    let interrupt = async {
+        let _ = tokio::signal::ctrl_c().await;
+    };
+    let terminate = async {
+        match tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate()) {
+            Ok(mut terminate) => {
+                terminate.recv().await;
+            }
+            Err(_) => std::future::pending::<()>().await,
+        }
+    };
+    tokio::select! {
+        () = interrupt => {}
+        () = terminate => {}
+    }
+}
diff --git a/crates/registry-mint/src/replay.rs b/crates/registry-mint/src/replay.rs
new file mode 100644
index 000000000..931d89e6c
--- /dev/null
+++ b/crates/registry-mint/src/replay.rs
@@ -0,0 +1,116 @@
+//! Single-use enforcement for client assertion `jti` values.
+//!
+//! A captured client assertion is a bearer credential until it expires. The
+//! cache remembers every accepted `jti` until its own expiry, so a captured
+//! assertion buys an attacker nothing.
+
+use std::{collections::HashMap, sync::Mutex};
+
+use thiserror::Error;
+
+#[derive(Debug, Error, Eq, PartialEq)]
+pub enum ReplayError {
+    #[error("the assertion identifier has already been used")]
+    AlreadyUsed,
+    #[error("the replay cache is saturated")]
+    Saturated,
+    #[error("the replay cache is poisoned")]
+    Poisoned,
+}
+
+/// A bounded set of assertion identifiers that have already been spent.
+#[derive(Debug)]
+pub struct ReplayCache {
+    capacity: usize,
+    entries: Mutex<HashMap<String, i64>>,
+}
+
+impl ReplayCache {
+    #[must_use]
+    pub fn new(capacity: usize) -> Self {
+        Self {
+            capacity,
+            entries: Mutex::new(HashMap::new()),
+        }
+    }
+
+    /// Record `jti` as spent until `expires_at`.
+    ///
+    /// Saturation fails closed rather than evicting a live entry. Evicting the
+    /// oldest entry would let a caller flush the cache with fresh assertions
+    /// and then replay the one it evicted, which is precisely what this cache
+    /// exists to prevent. Only clients that already passed signature
+    /// verification can reach this code, so the failure is bounded to
+    /// authenticated misbehaviour and is visible to operators.
+    pub fn remember(&self, jti: &str, expires_at: i64, now: i64) -> Result<(), ReplayError> {
+        let mut entries = self.entries.lock().map_err(|_| ReplayError::Poisoned)?;
+        entries.retain(|_, entry_expiry| *entry_expiry > now);
+        if entries.contains_key(jti) {
+            return Err(ReplayError::AlreadyUsed);
+        }
+        if entries.len() >= self.capacity {
+            return Err(ReplayError::Saturated);
+        }
+        entries.insert(jti.to_owned(), expires_at);
+        Ok(())
+    }
+
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.entries
+            .lock()
+            .map(|entries| entries.len())
+            .unwrap_or(0)
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_fresh_identifier_is_accepted_once_and_then_refused() {
+        let cache = ReplayCache::new(16);
+        assert_eq!(cache.remember("jti-1", 100, 0), Ok(()));
+        assert_eq!(
+            cache.remember("jti-1", 100, 0),
+            Err(ReplayError::AlreadyUsed)
+        );
+    }
+
+    #[test]
+    fn distinct_identifiers_do_not_collide() {
+        let cache = ReplayCache::new(16);
+        assert_eq!(cache.remember("jti-1", 100, 0), Ok(()));
+        assert_eq!(cache.remember("jti-2", 100, 0), Ok(()));
+        assert_eq!(cache.len(), 2);
+    }
+
+    #[test]
+    fn entries_are_pruned_once_their_own_expiry_passes() {
+        let cache = ReplayCache::new(16);
+        assert_eq!(cache.remember("jti-1", 100, 0), Ok(()));
+        // At 101 the assertion is expired anyway, so forgetting it is safe and
+        // the slot is reclaimed.
+        assert_eq!(cache.remember("jti-2", 200, 101), Ok(()));
+        assert_eq!(cache.len(), 1);
+    }
+
+    #[test]
+    fn saturation_fails_closed_instead_of_evicting_a_live_entry() {
+        let cache = ReplayCache::new(2);
+        assert_eq!(cache.remember("jti-1", 100, 0), Ok(()));
+        assert_eq!(cache.remember("jti-2", 100, 0), Ok(()));
+        assert_eq!(cache.remember("jti-3", 100, 0), Err(ReplayError::Saturated));
+        // The entry an attacker would have wanted evicted is still remembered.
+        assert_eq!(
+            cache.remember("jti-1", 100, 0),
+            Err(ReplayError::AlreadyUsed)
+        );
+    }
+}
diff --git a/crates/registry-mint/src/secretfile.rs b/crates/registry-mint/src/secretfile.rs
new file mode 100644
index 000000000..1cc693df2
--- /dev/null
+++ b/crates/registry-mint/src/secretfile.rs
@@ -0,0 +1,116 @@
+//! Bounded, owner-only reads of private key material.
+//!
+//! Mint holds an access-token signing key and an audit HMAC key. Client
+//! registrations carry public keys only, so this module is deliberately small
+//! and is the single file-read boundary for private material.
+
+use std::{fs, os::unix::fs::MetadataExt, path::Path};
+
+use thiserror::Error;
+use zeroize::Zeroizing;
+
+/// Upper bound on a Mint secret file, generous for any supported JWK or HMAC key.
+pub const MAX_SECRET_BYTES: u64 = 64 * 1024;
+
+#[derive(Debug, Error, Eq, PartialEq)]
+pub enum SecretFileError {
+    #[error("the secret file is unavailable")]
+    Unavailable,
+    #[error("the secret file is not a regular, single-link, owner-only file")]
+    Unsafe,
+    #[error("the secret file is too large")]
+    TooLarge,
+    #[error("the secret file could not be read")]
+    Read,
+    #[error("the secret file is not valid UTF-8")]
+    InvalidValue,
+}
+
+/// Read a secret file that must be a regular file, owned by the running user,
+/// unreadable by group and other, and reachable without traversing a symlink.
+///
+/// `symlink_metadata` is used rather than `metadata` so a symlink fails the
+/// regular-file check instead of being silently followed to its target. The
+/// link count is pinned to one so a hard link created by another user cannot
+/// alias the same inode under weaker permissions.
+pub fn read_owner_only(path: &Path) -> Result<Zeroizing<String>, SecretFileError> {
+    let metadata = fs::symlink_metadata(path).map_err(|_| SecretFileError::Unavailable)?;
+    if !metadata.is_file() || metadata.nlink() != 1 {
+        return Err(SecretFileError::Unsafe);
+    }
+    if metadata.uid() != rustix::process::geteuid().as_raw() {
+        return Err(SecretFileError::Unsafe);
+    }
+    if metadata.mode() & 0o077 != 0 {
+        return Err(SecretFileError::Unsafe);
+    }
+    if metadata.len() > MAX_SECRET_BYTES {
+        return Err(SecretFileError::TooLarge);
+    }
+    let bytes = Zeroizing::new(fs::read(path).map_err(|_| SecretFileError::Read)?);
+    let text = std::str::from_utf8(&bytes).map_err(|_| SecretFileError::InvalidValue)?;
+    Ok(Zeroizing::new(text.trim().to_owned()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::{io::Write, os::unix::fs::PermissionsExt};
+
+    fn write_key(directory: &Path, name: &str, mode: u32) -> std::path::PathBuf {
+        let path = directory.join(name);
+        let mut file = fs::File::create(&path).expect("create key file");
+        file.write_all(b"  key-material  ").expect("write key file");
+        fs::set_permissions(&path, fs::Permissions::from_mode(mode)).expect("set mode");
+        path
+    }
+
+    #[test]
+    fn owner_only_files_are_read_and_trimmed() {
+        let directory = tempfile::tempdir().expect("temp dir");
+        let path = write_key(directory.path(), "signing.jwk", 0o600);
+        let value = read_owner_only(&path).expect("owner-only file reads");
+        assert_eq!(&*value, "key-material");
+    }
+
+    #[test]
+    fn group_or_world_readable_files_are_rejected() {
+        let directory = tempfile::tempdir().expect("temp dir");
+        for mode in [0o640, 0o604, 0o644, 0o660] {
+            let path = write_key(directory.path(), &format!("key-{mode:o}.jwk"), mode);
+            assert_eq!(
+                read_owner_only(&path),
+                Err(SecretFileError::Unsafe),
+                "mode {mode:o} must be rejected"
+            );
+        }
+    }
+
+    #[test]
+    fn symlinked_and_hard_linked_secrets_are_rejected() {
+        let directory = tempfile::tempdir().expect("temp dir");
+        let target = write_key(directory.path(), "target.jwk", 0o600);
+
+        let symlink = directory.path().join("symlink.jwk");
+        std::os::unix::fs::symlink(&target, &symlink).expect("create symlink");
+        assert_eq!(read_owner_only(&symlink), Err(SecretFileError::Unsafe));
+
+        let hard_link = directory.path().join("hard.jwk");
+        fs::hard_link(&target, &hard_link).expect("create hard link");
+        assert_eq!(read_owner_only(&hard_link), Err(SecretFileError::Unsafe));
+        assert_eq!(read_owner_only(&target), Err(SecretFileError::Unsafe));
+    }
+
+    #[test]
+    fn directories_and_missing_paths_are_rejected() {
+        let directory = tempfile::tempdir().expect("temp dir");
+        assert_eq!(
+            read_owner_only(directory.path()),
+            Err(SecretFileError::Unsafe)
+        );
+        assert_eq!(
+            read_owner_only(&directory.path().join("absent.jwk")),
+            Err(SecretFileError::Unavailable)
+        );
+    }
+}
diff --git a/crates/registry-mint/src/server.rs b/crates/registry-mint/src/server.rs
new file mode 100644
index 000000000..5c6cca1f4
--- /dev/null
+++ b/crates/registry-mint/src/server.rs
@@ -0,0 +1,666 @@
+//! The Mint HTTP boundary.
+//!
+//! Four routes: the token endpoint, the published key set, authorization server
+//! metadata, and the two liveness probes. Everything a caller sends is treated
+//! as an unauthenticated claim about identity until the client assertion has
+//! been verified against that client's own registered keys.
+//!
+//! The service holds two kinds of state with deliberately different lifetimes.
+//! Issuer identity, signing and audit keys, listener, and token policy are startup-only:
+//! changing them means restarting. The client registry is reloadable, so
+//! onboarding or removing a caller never restarts a resource server.
+
+use std::{
+    future::{Future, IntoFuture},
+    io,
+    net::SocketAddr,
+    sync::{Arc, RwLock},
+    time::Duration,
+};
+
+use axum::{
+    body::{to_bytes, Body},
+    extract::State,
+    http::{
+        header::{CACHE_CONTROL, CONTENT_TYPE, PRAGMA},
+        HeaderMap, HeaderValue, Request, StatusCode,
+    },
+    middleware::{from_fn, Next},
+    response::{IntoResponse, Response},
+    routing::{get, post},
+    Router,
+};
+use serde_json::{json, Value};
+use thiserror::Error;
+use tokio::net::TcpListener;
+
+use crate::{
+    assertion::ClientAuthenticator,
+    audit::{MintAuditError, MintAuditLog},
+    clients::{ClientRegistry, ClientRegistryError},
+    config::{MintConfig, MINT_HEALTH_PATH, MINT_METADATA_PATH, MINT_READY_PATH, MINT_TOKEN_PATH},
+    error::TokenError,
+    replay::ReplayCache,
+    token::{MinterError, TokenMinter},
+    CLIENT_ASSERTION_TYPE, GRANT_TYPE_CLIENT_CREDENTIALS,
+};
+
+const FORM_MEDIA_TYPE: &str = "application/x-www-form-urlencoded";
+const JSON_MEDIA_TYPE: &str = "application/json";
+const JWKS_MEDIA_TYPE: &str = "application/jwk-set+json";
+
+#[derive(Debug, Error)]
+pub enum ServiceError {
+    #[error("the signing key could not be loaded: {0}")]
+    Minter(#[from] MinterError),
+    #[error("the client registry could not be loaded: {0}")]
+    Registry(#[from] ClientRegistryError),
+    #[error("the audit boundary could not be initialized: {0}")]
+    Audit(#[from] MintAuditError),
+    #[error("client {0} cannot be served: {1}")]
+    Delegation(String, &'static str),
+}
+
+/// The whole serving state: an immutable minter over a reloadable registry.
+pub struct MintService {
+    config: MintConfig,
+    minter: TokenMinter,
+    /// Swapped wholesale on reload. Readers clone the `Arc` and release the
+    /// lock before any await, so a reload never blocks in-flight requests.
+    authenticator: RwLock<Arc<ClientAuthenticator>>,
+    /// Owned by the service rather than the authenticator so that reloading the
+    /// registry never forgets which assertion identifiers were already spent.
+    replay: Arc<ReplayCache>,
+    audit: MintAuditLog,
+    metadata: Value,
+}
+
+impl std::fmt::Debug for MintService {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("MintService")
+            .field("issuer", &self.config.issuer)
+            .field("clients", &self.client_count())
+            .finish_non_exhaustive()
+    }
+}
+
+impl MintService {
+    /// Load the keys, audit chain, and client registry described by `config`.
+    pub async fn load(config: MintConfig) -> Result<Self, ServiceError> {
+        let minter = TokenMinter::new(&config)?;
+        let registry = Arc::new(ClientRegistry::load(&config.clients.directory)?);
+        check_delegations(&registry, minter.claims())?;
+        let replay = Arc::new(ReplayCache::new(
+            config.client_assertion.replay_cache_entries,
+        ));
+        let authenticator =
+            ClientAuthenticator::new(registry, &config.client_assertion, Arc::clone(&replay));
+        let audit = MintAuditLog::initialize(&config.audit, &config.issuer).await?;
+        let metadata = build_metadata(&config);
+        Ok(Self {
+            config,
+            minter,
+            authenticator: RwLock::new(Arc::new(authenticator)),
+            replay,
+            audit,
+            metadata,
+        })
+    }
+
+    /// Validate a configuration without taking what a serving instance holds.
+    ///
+    /// Everything [`MintService::load`] does except claiming the audit writer,
+    /// so an operator can check an edited configuration against the deployment
+    /// it is about to replace. Returns the number of registered clients.
+    pub fn check(config: &MintConfig) -> Result<usize, ServiceError> {
+        let minter = TokenMinter::new(config)?;
+        let registry = ClientRegistry::load(&config.clients.directory)?;
+        check_delegations(&registry, minter.claims())?;
+        MintAuditLog::check(&config.audit)?;
+        Ok(registry.len())
+    }
+
+    /// Re-read the client registry directory and swap it in atomically.
+    ///
+    /// A failed reload leaves the previous registry in place: a malformed file
+    /// dropped into the directory must not silently revoke every caller.
+    pub fn reload_clients(&self) -> Result<usize, ServiceError> {
+        let registry = Arc::new(ClientRegistry::load(&self.config.clients.directory)?);
+        // Checked on every reload, not only at startup: a registration dropped
+        // into the directory later must clear the same bar.
+        check_delegations(&registry, self.minter.claims())?;
+        let count = registry.len();
+        let authenticator = Arc::new(ClientAuthenticator::new(
+            registry,
+            &self.config.client_assertion,
+            Arc::clone(&self.replay),
+        ));
+        *self
+            .authenticator
+            .write()
+            .expect("the client registry lock is never poisoned") = authenticator;
+        Ok(count)
+    }
+
+    #[must_use]
+    pub fn client_count(&self) -> usize {
+        self.authenticator().registry().len()
+    }
+
+    #[must_use]
+    pub fn issuer(&self) -> &str {
+        &self.config.issuer
+    }
+
+    #[must_use]
+    pub fn jwks(&self) -> &Value {
+        self.minter.jwks()
+    }
+
+    fn authenticator(&self) -> Arc<ClientAuthenticator> {
+        Arc::clone(
+            &self
+                .authenticator
+                .read()
+                .expect("the client registry lock is never poisoned"),
+        )
+    }
+
+    /// Authenticate a token request and mint the authority its registry entry
+    /// carries. Nothing is read from the assertion payload.
+    async fn issue(
+        &self,
+        operation: &str,
+        request: &TokenRequest,
+        now: i64,
+    ) -> Result<Response, TokenError> {
+        if request.grant_type != GRANT_TYPE_CLIENT_CREDENTIALS {
+            return Err(TokenError::unsupported_grant_type(
+                "grant type is not supported",
+            ));
+        }
+        if request.client_assertion_type != CLIENT_ASSERTION_TYPE {
+            return Err(TokenError::invalid_request(
+                "client assertion type is not supported",
+            ));
+        }
+
+        // Cloned out of the lock so a concurrent reload cannot block here.
+        let authenticator = self.authenticator();
+        let authenticated = authenticator
+            .authenticate(&request.client_assertion, now)
+            .await?;
+        let token = self.minter.mint(&authenticated, now).await?;
+        let body = serde_json::to_vec(&token)
+            .map_err(|_| TokenError::server_error("the token response could not be serialized"))?;
+        self.audit
+            .append_issued(operation, &authenticated, &token)
+            .await
+            .map_err(|_| TokenError::server_error("the token release could not be audited"))?;
+        Ok(json_response(StatusCode::OK, JSON_MEDIA_TYPE, body))
+    }
+
+    async fn reject(&self, operation: &str, error: TokenError) -> Response {
+        if self
+            .audit
+            .append_rejected(operation, error.code().as_str())
+            .await
+            .is_err()
+        {
+            tracing::error!(
+                target: "registry_mint::audit",
+                operation,
+                "the token denial could not be audited"
+            );
+            return TokenError::server_error("the token decision could not be audited")
+                .into_operation_response(operation);
+        }
+        error.into_operation_response(operation)
+    }
+
+    #[must_use]
+    async fn ready(&self) -> bool {
+        self.client_count() > 0 && self.audit.ready().await
+    }
+}
+
+/// Refuse a registry whose delegations this configuration cannot express.
+///
+/// The registry and the claim-name configuration are loaded independently, so
+/// this is the only place their agreement can be established. A disagreement
+/// caught here is an operator error at startup or reload; caught at the first
+/// token request instead, it would be an outage for one caller and a token
+/// missing its actor for another.
+fn check_delegations(
+    registry: &ClientRegistry,
+    claims: &crate::config::ClaimNames,
+) -> Result<(), ServiceError> {
+    // The claims Mint writes itself. A subject minted over one of these would
+    // replace authority the registry, not the caller, is supposed to decide.
+    let mut reserved = vec!["iss", "aud", "exp", "iat", "nbf", "jti", "client_id", "sub"];
+    reserved.push(claims.principal.as_str());
+    reserved.push(claims.requester_tags.as_str());
+    reserved.push(claims.evidence_audience.as_str());
+    reserved.push(claims.grant_id.as_str());
+    reserved.push(claims.grant_authority.as_str());
+    reserved.extend(claims.actor.as_deref());
+
+    for client_id in registry.client_ids() {
+        let client = registry
+            .get(client_id)
+            .expect("client id came from this registry");
+        let Some(delegation) = client.delegation() else {
+            continue;
+        };
+        if claims.actor.is_none() {
+            return Err(ServiceError::Delegation(
+                client_id.to_owned(),
+                "it declares a delegation but no actor claim name is configured",
+            ));
+        }
+        for path in delegation.subject_claims.values() {
+            let root = path.split('.').next().unwrap_or(path);
+            if reserved.contains(&root) {
+                return Err(ServiceError::Delegation(
+                    client_id.to_owned(),
+                    "a subject claim path would overwrite an authority claim",
+                ));
+            }
+        }
+    }
+    Ok(())
+}
+
+fn build_metadata(config: &MintConfig) -> Value {
+    let issuer = config.issuer.trim_end_matches('/');
+    let algorithms = {
+        let mut algorithms = config
+            .client_assertion
+            .algorithms
+            .iter()
+            .map(|algorithm| algorithm.as_header_value())
+            .collect::<Vec<_>>();
+        algorithms.sort_unstable();
+        algorithms.dedup();
+        algorithms
+    };
+    json!({
+        "issuer": config.issuer,
+        "token_endpoint": format!("{issuer}{MINT_TOKEN_PATH}"),
+        "jwks_uri": format!("{issuer}{}", config.signing.jwks_path),
+        "grant_types_supported": [GRANT_TYPE_CLIENT_CREDENTIALS],
+        "token_endpoint_auth_methods_supported": ["private_key_jwt"],
+        "token_endpoint_auth_signing_alg_values_supported": algorithms,
+        // Mint has no authorization endpoint: there is no user to redirect.
+        "response_types_supported": [],
+    })
+}
+
+/// The three parameters Mint reads from a token request.
+///
+/// RFC 6749 section 3.1 requires unrecognized parameters to be ignored and
+/// forbids any parameter appearing more than once, so this is parsed by hand
+/// rather than through a permissive form deserializer.
+#[derive(Debug)]
+struct TokenRequest {
+    grant_type: String,
+    client_assertion_type: String,
+    client_assertion: String,
+}
+
+fn parse_token_request(body: &[u8]) -> Result<TokenRequest, TokenError> {
+    let mut grant_type = None;
+    let mut client_assertion_type = None;
+    let mut client_assertion = None;
+
+    for (name, value) in url::form_urlencoded::parse(body) {
+        let slot = match name.as_ref() {
+            "grant_type" => &mut grant_type,
+            "client_assertion_type" => &mut client_assertion_type,
+            "client_assertion" => &mut client_assertion,
+            // Ignored by RFC 6749 section 3.1.
+            _ => continue,
+        };
+        // A repeated parameter leaves which value was authenticated ambiguous.
+        if slot.is_some() {
+            return Err(TokenError::invalid_request(
+                "a request parameter was repeated",
+            ));
+        }
+        *slot = Some(value.into_owned());
+    }
+
+    Ok(TokenRequest {
+        grant_type: grant_type
+            .ok_or_else(|| TokenError::invalid_request("grant_type is missing"))?,
+        client_assertion_type: client_assertion_type
+            .ok_or_else(|| TokenError::invalid_request("client_assertion_type is missing"))?,
+        client_assertion: client_assertion
+            .ok_or_else(|| TokenError::invalid_request("client_assertion is missing"))?,
+    })
+}
+
+/// Build the router over an already loaded service.
+pub fn build_app(service: Arc<MintService>) -> Router {
+    let jwks_path = service.config.signing.jwks_path.clone();
+    let routes = Router::new()
+        .route(MINT_TOKEN_PATH, post(token))
+        .route(&jwks_path, get(jwks))
+        .route(MINT_METADATA_PATH, get(metadata))
+        .route(MINT_HEALTH_PATH, get(health))
+        .route(MINT_READY_PATH, get(ready))
+        .fallback(unknown_route)
+        .method_not_allowed_fallback(unknown_route)
+        .with_state(service);
+    routes.layer(from_fn(add_no_store))
+}
+
+/// Bind the configured listener and serve until `shutdown` resolves.
+pub async fn serve<F>(service: Arc<MintService>, shutdown: F) -> io::Result<()>
+where
+    F: Future<Output = ()> + Send + 'static,
+{
+    let bind_ip = service
+        .config
+        .listener
+        .bind_address()
+        .map_err(|error| io::Error::new(io::ErrorKind::InvalidInput, error))?;
+    let address = SocketAddr::new(bind_ip, service.config.listener.port);
+    let listener = TcpListener::bind(address).await?;
+    tracing::info!(
+        target: "registry_mint::server",
+        issuer = %service.config.issuer,
+        clients = service.client_count(),
+        "mint listening"
+    );
+    let app = build_app(service);
+    axum::serve(listener, app)
+        .with_graceful_shutdown(shutdown)
+        .into_future()
+        .await
+}
+
+async fn token(State(service): State<Arc<MintService>>, request: Request<Body>) -> Response {
+    let operation = format!("urn:ulid:{}", ulid::Ulid::new());
+    if !has_exact_content_type(request.headers(), FORM_MEDIA_TYPE) {
+        return service
+            .reject(
+                &operation,
+                TokenError::invalid_request("content type must be form encoded"),
+            )
+            .await;
+    }
+
+    let maximum_bytes = service.config.listener.maximum_request_bytes as usize;
+    let timeout = Duration::from_millis(service.config.listener.request_timeout_milliseconds);
+    let body =
+        match tokio::time::timeout(timeout, to_bytes(request.into_body(), maximum_bytes)).await {
+            Ok(Ok(body)) => body,
+            Ok(Err(_)) => {
+                return service
+                    .reject(
+                        &operation,
+                        TokenError::invalid_request("the request body could not be read"),
+                    )
+                    .await
+            }
+            Err(_) => {
+                return service
+                    .reject(
+                        &operation,
+                        TokenError::invalid_request("the request body timed out"),
+                    )
+                    .await;
+            }
+        };
+
+    let now = time::OffsetDateTime::now_utc().unix_timestamp();
+    let parsed = match parse_token_request(&body) {
+        Ok(parsed) => parsed,
+        Err(error) => return service.reject(&operation, error).await,
+    };
+    match service.issue(&operation, &parsed, now).await {
+        Ok(response) => response,
+        Err(error) => service.reject(&operation, error).await,
+    }
+}
+
+async fn jwks(State(service): State<Arc<MintService>>) -> Response {
+    match serde_json::to_vec(service.jwks()) {
+        Ok(body) => json_response(StatusCode::OK, JWKS_MEDIA_TYPE, body),
+        Err(_) => TokenError::server_error("the key set could not be serialized").into_response(),
+    }
+}
+
+async fn metadata(State(service): State<Arc<MintService>>) -> Response {
+    match serde_json::to_vec(&service.metadata) {
+        Ok(body) => json_response(StatusCode::OK, JSON_MEDIA_TYPE, body),
+        Err(_) => TokenError::server_error("the metadata could not be serialized").into_response(),
+    }
+}
+
+async fn health() -> Response {
+    json_response(
+        StatusCode::OK,
+        JSON_MEDIA_TYPE,
+        br#"{"status":"ok"}"#.to_vec(),
+    )
+}
+
+async fn ready(State(service): State<Arc<MintService>>) -> Response {
+    // A Mint with no clients or a poisoned audit writer is live but cannot
+    // safely issue a token, so admission fails until the process is repaired.
+    if !service.ready().await {
+        return json_response(
+            StatusCode::SERVICE_UNAVAILABLE,
+            JSON_MEDIA_TYPE,
+            br#"{"status":"not ready"}"#.to_vec(),
+        );
+    }
+    json_response(
+        StatusCode::OK,
+        JSON_MEDIA_TYPE,
+        br#"{"status":"ready"}"#.to_vec(),
+    )
+}
+
+async fn unknown_route() -> Response {
+    TokenError::invalid_request("no such route").into_response()
+}
+
+/// RFC 6749 section 5.1 requires both headers on token responses. Applying them
+/// to every route keeps the key set and metadata out of shared caches too.
+async fn add_no_store(request: Request<Body>, next: Next) -> Response {
+    let mut response = next.run(request).await;
+    let headers = response.headers_mut();
+    headers.insert(CACHE_CONTROL, HeaderValue::from_static("no-store"));
+    headers.insert(PRAGMA, HeaderValue::from_static("no-cache"));
+    headers.insert(
+        http::header::X_CONTENT_TYPE_OPTIONS,
+        HeaderValue::from_static("nosniff"),
+    );
+    response
+}
+
+fn json_response(status: StatusCode, media_type: &'static str, body: Vec<u8>) -> Response {
+    (
+        status,
+        [(CONTENT_TYPE, HeaderValue::from_static(media_type))],
+        body,
+    )
+        .into_response()
+}
+
+fn has_exact_content_type(headers: &HeaderMap, expected: &str) -> bool {
+    let Some(value) = headers
+        .get(CONTENT_TYPE)
+        .and_then(|value| value.to_str().ok())
+    else {
+        return false;
+    };
+    // Only a bare type or one carrying the redundant charset is accepted; a
+    // multipart or otherwise decorated type is not this endpoint's input.
+    let (media_type, parameters) = match value.split_once(';') {
+        Some((media_type, parameters)) => (media_type, Some(parameters)),
+        None => (value, None),
+    };
+    if !media_type.trim().eq_ignore_ascii_case(expected) {
+        return false;
+    }
+    match parameters {
+        None => true,
+        Some(parameters) => parameters.trim().eq_ignore_ascii_case("charset=utf-8"),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_repeated_parameter_is_rejected() {
+        let error = parse_token_request(b"grant_type=a&grant_type=b")
+            .expect_err("a repeated parameter must be rejected");
+        assert_eq!(
+            error,
+            TokenError::invalid_request("a request parameter was repeated")
+        );
+    }
+
+    #[test]
+    fn unrecognized_parameters_are_ignored() {
+        let request = parse_token_request(
+            b"grant_type=client_credentials&scope=anything&client_assertion_type=t&client_assertion=a",
+        )
+        .expect("unrecognized parameters must be ignored");
+        assert_eq!(request.grant_type, "client_credentials");
+        assert_eq!(request.client_assertion_type, "t");
+        assert_eq!(request.client_assertion, "a");
+    }
+
+    #[test]
+    fn each_required_parameter_is_required() {
+        for body in [
+            &b"client_assertion_type=t&client_assertion=a"[..],
+            &b"grant_type=g&client_assertion=a"[..],
+            &b"grant_type=g&client_assertion_type=t"[..],
+        ] {
+            let error =
+                parse_token_request(body).expect_err("a missing parameter must be rejected");
+            assert_eq!(error.code(), crate::error::TokenErrorCode::InvalidRequest);
+        }
+    }
+
+    #[test]
+    fn content_type_must_be_the_form_media_type() {
+        let mut headers = HeaderMap::new();
+        for (value, expected) in [
+            ("application/x-www-form-urlencoded", true),
+            ("application/x-www-form-urlencoded; charset=utf-8", true),
+            ("application/x-www-form-urlencoded; charset=UTF-8", true),
+            ("application/json", false),
+            ("multipart/form-data; boundary=x", false),
+            ("application/x-www-form-urlencoded; boundary=x", false),
+        ] {
+            headers.insert(CONTENT_TYPE, HeaderValue::from_str(value).expect("header"));
+            assert_eq!(
+                has_exact_content_type(&headers, FORM_MEDIA_TYPE),
+                expected,
+                "{value}"
+            );
+        }
+    }
+
+    fn registry_with(extra: &str) -> ClientRegistry {
+        let directory = tempfile::tempdir().expect("temp dir");
+        let public = crate::assertion::tests::test_key(1).1;
+        std::fs::write(
+            directory.path().join("client-a.yaml"),
+            format!("clientId: client-a\nprincipal: urn:example:client-a\nevidenceAudience: https://client-a.example.org\nrequesterTags: [tag-a]\nkeys: [{public}]\n{extra}"),
+        )
+        .expect("write client registration");
+        ClientRegistry::load(directory.path()).expect("registry loads")
+    }
+
+    fn claim_names() -> crate::config::ClaimNames {
+        crate::config::tests::sample_config().access_tokens.claims
+    }
+
+    const DELEGATION: &str = "delegation:\n  subjectClaims:\n    given_name: identity.given_name\n";
+
+    /// The registry and the claim-name configuration are loaded independently,
+    /// so a delegation with nowhere to mint its actor has to be caught here or
+    /// not at all.
+    #[test]
+    fn a_delegation_without_a_configured_actor_claim_refuses_to_load() {
+        let mut claims = claim_names();
+        claims.actor = None;
+        let error = check_delegations(&registry_with(DELEGATION), &claims)
+            .expect_err("an unconfigured actor claim must refuse the registry");
+        assert!(matches!(error, ServiceError::Delegation(client, _) if client == "client-a"));
+
+        claims.actor = Some("evidence_actor".to_owned());
+        assert!(check_delegations(&registry_with(DELEGATION), &claims).is_ok());
+    }
+
+    /// A subject path rooted at a claim Mint writes itself would let the caller
+    /// choose authority the registry is supposed to decide.
+    #[test]
+    fn a_subject_path_rooted_at_an_authority_claim_refuses_to_load() {
+        let mut claims = claim_names();
+        claims.actor = Some("evidence_actor".to_owned());
+
+        for root in [
+            "iss",
+            "sub",
+            "jti",
+            "client_id",
+            claims.requester_tags.as_str(),
+            claims.evidence_audience.as_str(),
+            claims.grant_id.as_str(),
+            claims.grant_authority.as_str(),
+            "evidence_actor",
+        ] {
+            let registry = registry_with(&format!(
+                "delegation:\n  subjectClaims:\n    given_name: {root}.given_name\n"
+            ));
+            assert!(
+                check_delegations(&registry, &claims).is_err(),
+                "a subject path rooted at {root} must be refused"
+            );
+        }
+    }
+
+    /// A registry with no delegations is unaffected by the actor claim either
+    /// way, so an existing deployment does not have to configure one.
+    #[test]
+    fn an_undelegated_registry_loads_without_an_actor_claim() {
+        let mut claims = claim_names();
+        claims.actor = None;
+        assert!(check_delegations(&registry_with(""), &claims).is_ok());
+    }
+
+    #[test]
+    fn metadata_describes_the_endpoints_a_client_needs() {
+        let config = crate::config::tests::sample_config();
+        let metadata = build_metadata(&config);
+        assert_eq!(metadata["issuer"], json!("https://mint.example.org"));
+        assert_eq!(
+            metadata["token_endpoint"],
+            json!("https://mint.example.org/token")
+        );
+        assert_eq!(
+            metadata["jwks_uri"],
+            json!("https://mint.example.org/.well-known/jwks.json")
+        );
+        assert_eq!(
+            metadata["token_endpoint_auth_methods_supported"],
+            json!(["private_key_jwt"])
+        );
+        assert_eq!(
+            metadata["grant_types_supported"],
+            json!(["client_credentials"])
+        );
+    }
+}
diff --git a/crates/registry-mint/src/token.rs b/crates/registry-mint/src/token.rs
new file mode 100644
index 000000000..ef8b9ef4c
--- /dev/null
+++ b/crates/registry-mint/src/token.rs
@@ -0,0 +1,831 @@
+//! Access token minting.
+//!
+//! Every authority claim written here is read from the server-side client
+//! registry. That is what makes a caller's private key a proof of *identity*
+//! rather than a licence to assert whatever it likes: the caller chooses which
+//! registry entry it authenticates as, and the registry chooses what that entry
+//! may say.
+//!
+//! A delegated token is the one case where values reach a token from the
+//! caller, and they arrive already reconciled against the registration by
+//! [`crate::assertion`]: the actor is one the client may act as, and the
+//! subject holds exactly the selector fields the registration declared, minted
+//! at exactly the claim paths it declared. The registry still fixes the shape;
+//! the caller only fills it in.
+//!
+//! Minting the subject into the token is what bounds a delegated token to one
+//! person. A resource server configured to read that subject from the token
+//! refuses any request carrying its own selector values, so a token issued for
+//! one subject cannot be turned toward another, however the caller misbehaves.
+
+use std::path::Path;
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use registry_platform_crypto::{LocalJwkSigner, PrivateJwk, SigningProvider};
+use serde::Serialize;
+use serde_json::{json, Map, Value};
+use thiserror::Error;
+
+use crate::{
+    assertion::AuthenticatedClient,
+    clients::{contains_private_material, Delegation, RegisteredClient},
+    config::{Algorithm, ClaimNames, MintConfig},
+    error::TokenError,
+    secretfile::{self, SecretFileError},
+    ACCESS_TOKEN_TYP,
+};
+
+#[derive(Debug, Error)]
+pub enum MinterError {
+    #[error("the signing key file could not be read: {0}")]
+    SigningKeyFile(#[from] SecretFileError),
+    #[error("the signing key is invalid: {0}")]
+    SigningKey(&'static str),
+    #[error("a retired public key is invalid: {0}")]
+    RetiredKey(&'static str),
+}
+
+/// A minted access token and the lifetime the caller should assume.
+#[derive(Debug, Serialize)]
+pub struct MintedToken {
+    pub access_token: String,
+    pub token_type: &'static str,
+    pub expires_in: u64,
+    #[serde(skip)]
+    token_id: String,
+    #[serde(skip)]
+    signing_key_id: String,
+    #[serde(skip)]
+    expires_at_unix: i64,
+}
+
+impl MintedToken {
+    #[must_use]
+    pub(crate) fn token_id(&self) -> &str {
+        &self.token_id
+    }
+
+    #[must_use]
+    pub(crate) fn signing_key_id(&self) -> &str {
+        &self.signing_key_id
+    }
+
+    #[must_use]
+    pub(crate) fn expires_at_unix(&self) -> i64 {
+        self.expires_at_unix
+    }
+}
+
+/// Signs access tokens with the configured active key.
+pub struct TokenMinter {
+    issuer: String,
+    audience: Value,
+    lifetime_seconds: i64,
+    claims: ClaimNames,
+    algorithm: Algorithm,
+    signer: LocalJwkSigner,
+    jwks: Value,
+}
+
+impl std::fmt::Debug for TokenMinter {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("TokenMinter")
+            .field("issuer", &self.issuer)
+            .field("algorithm", &self.algorithm)
+            .field("key_id", &self.signer.key_id())
+            .finish_non_exhaustive()
+    }
+}
+
+impl TokenMinter {
+    /// Load the active signing key and build the published JWK set.
+    pub fn new(config: &MintConfig) -> Result<Self, MinterError> {
+        let key_text = secretfile::read_owner_only(&config.signing.active_key_file)?;
+        let private = PrivateJwk::parse(&key_text)
+            .map_err(|_| MinterError::SigningKey("not a private JWK"))?;
+
+        // A mismatch here would publish one key id and sign with another, so
+        // verifiers would fail to find the key that actually signed.
+        if private.kid.as_deref() != Some(config.signing.active_key_id.as_str()) {
+            return Err(MinterError::SigningKey(
+                "key id does not match the configured active key id",
+            ));
+        }
+        let signer =
+            LocalJwkSigner::new(private).map_err(|_| MinterError::SigningKey("is not usable"))?;
+        if signer.public_jwk().alg.as_deref() != Some(config.signing.algorithm.as_header_value()) {
+            return Err(MinterError::SigningKey(
+                "algorithm does not match the configured signing algorithm",
+            ));
+        }
+
+        let jwks = build_jwks(&signer, &config.signing.retired_public_jwk_files)?;
+
+        let audience = if config.access_tokens.audiences.len() == 1 {
+            Value::String(config.access_tokens.audiences[0].clone())
+        } else {
+            Value::Array(
+                config
+                    .access_tokens
+                    .audiences
+                    .iter()
+                    .map(|audience| Value::String(audience.clone()))
+                    .collect(),
+            )
+        };
+
+        Ok(Self {
+            issuer: config.issuer.clone(),
+            audience,
+            lifetime_seconds: config.access_tokens.lifetime_seconds as i64,
+            claims: config.access_tokens.claims.clone(),
+            algorithm: config.signing.algorithm,
+            signer,
+            jwks,
+        })
+    }
+
+    /// The public key set resource servers fetch to verify minted tokens.
+    #[must_use]
+    pub fn jwks(&self) -> &Value {
+        &self.jwks
+    }
+
+    #[must_use]
+    pub fn issuer(&self) -> &str {
+        &self.issuer
+    }
+
+    /// The claim names this minter writes authority into.
+    #[must_use]
+    pub fn claims(&self) -> &ClaimNames {
+        &self.claims
+    }
+
+    /// Mint an access token carrying the registry's authority for `client`.
+    pub async fn mint(
+        &self,
+        authenticated: &AuthenticatedClient,
+        now: i64,
+    ) -> Result<MintedToken, TokenError> {
+        let client: &RegisteredClient = &authenticated.client;
+        let expires_at = now + self.lifetime_seconds;
+        let token_id = ulid::Ulid::new().to_string();
+        let mut claims = Map::new();
+        claims.insert("iss".to_owned(), Value::String(self.issuer.clone()));
+        claims.insert("aud".to_owned(), self.audience.clone());
+        claims.insert("iat".to_owned(), json!(now));
+        claims.insert("nbf".to_owned(), json!(now));
+        claims.insert("exp".to_owned(), json!(expires_at));
+        claims.insert("jti".to_owned(), Value::String(token_id.clone()));
+        // `client_id` records which registration authenticated; the principal
+        // is what the resource server acts on. They are allowed to differ.
+        claims.insert(
+            "client_id".to_owned(),
+            Value::String(client.client_id().to_owned()),
+        );
+
+        // `sub` always carries the principal so the token is meaningful to a
+        // standard OAuth consumer, even when the resource server reads the
+        // principal from a differently named claim.
+        claims.insert(
+            "sub".to_owned(),
+            Value::String(client.principal().to_owned()),
+        );
+        claims.insert(
+            self.claims.principal.clone(),
+            Value::String(client.principal().to_owned()),
+        );
+        claims.insert(
+            self.claims.requester_tags.clone(),
+            Value::Array(
+                client
+                    .requester_tags()
+                    .iter()
+                    .map(|tag| Value::String(tag.clone()))
+                    .collect(),
+            ),
+        );
+        claims.insert(
+            self.claims.evidence_audience.clone(),
+            Value::String(client.evidence_audience().to_owned()),
+        );
+        // Evidence requires the grant id and authority together or not at all,
+        // which the registry already guarantees by construction.
+        if let Some(grant) = client.grant() {
+            claims.insert(
+                self.claims.grant_id.clone(),
+                Value::String(grant.id.clone()),
+            );
+            claims.insert(
+                self.claims.grant_authority.clone(),
+                Value::String(grant.authority.clone()),
+            );
+        }
+
+        if let Some(delegation) = &authenticated.delegation {
+            let registered = client.delegation().ok_or_else(|| {
+                TokenError::server_error("a delegation was resolved for an undelegated client")
+            })?;
+            // Startup refuses a registry that declares delegation without a
+            // configured actor claim, so reaching here means the two disagree.
+            let actor_claim = self.claims.actor.as_ref().ok_or_else(|| {
+                TokenError::server_error("no actor claim is configured for delegated tokens")
+            })?;
+            claims.insert(
+                actor_claim.clone(),
+                Value::String(delegation.actor().to_owned()),
+            );
+            write_subject_claims(&mut claims, registered, delegation)?;
+        }
+
+        let header = json!({
+            "alg": self.algorithm.as_header_value(),
+            "typ": ACCESS_TOKEN_TYP,
+            "kid": self.signer.key_id(),
+        });
+        let signing_input = format!(
+            "{}.{}",
+            encode_json(&header)?,
+            encode_json(&Value::Object(claims))?
+        );
+        let signature = self
+            .signer
+            .sign(signing_input.as_bytes())
+            .await
+            .map_err(|_| TokenError::server_error("the access token could not be signed"))?;
+
+        Ok(MintedToken {
+            access_token: format!("{signing_input}.{}", URL_SAFE_NO_PAD.encode(signature)),
+            token_type: "Bearer",
+            expires_in: self.lifetime_seconds as u64,
+            token_id,
+            signing_key_id: self.signer.key_id().to_owned(),
+            expires_at_unix: expires_at,
+        })
+    }
+}
+
+/// Write each subject selector value at the claim path its registration
+/// declared, creating the intermediate objects the path implies.
+///
+/// The registration's paths were checked at load time to be well formed,
+/// unique, and non-nesting, so no write here can overwrite another. Anything
+/// that would still collide is a bug rather than a caller's doing, and is
+/// refused rather than allowed to overwrite an authority claim.
+fn write_subject_claims(
+    claims: &mut Map<String, Value>,
+    registered: &Delegation,
+    delegation: &crate::assertion::ResolvedDelegation,
+) -> Result<(), TokenError> {
+    let collision =
+        || TokenError::server_error("a subject claim path collides with an authority claim");
+
+    for (field, path) in &registered.subject_claims {
+        let value = delegation
+            .subject()
+            .get(field)
+            .ok_or_else(|| TokenError::server_error("a resolved subject field is missing"))?;
+
+        let mut segments = path.split('.').peekable();
+        let mut current = &mut *claims;
+        while let Some(segment) = segments.next() {
+            if segments.peek().is_none() {
+                if current.contains_key(segment) {
+                    return Err(collision());
+                }
+                current.insert(segment.to_owned(), value.clone());
+                break;
+            }
+            let entry = current
+                .entry(segment.to_owned())
+                .or_insert_with(|| Value::Object(Map::new()));
+            current = entry.as_object_mut().ok_or_else(collision)?;
+        }
+    }
+    Ok(())
+}
+
+fn encode_json(value: &Value) -> Result<String, TokenError> {
+    let bytes = serde_json::to_vec(value)
+        .map_err(|_| TokenError::server_error("a token component could not be serialized"))?;
+    Ok(URL_SAFE_NO_PAD.encode(bytes))
+}
+
+/// Publish the active public key plus any retired public keys whose tokens may
+/// still be in flight.
+fn build_jwks(
+    signer: &LocalJwkSigner,
+    retired: &[std::path::PathBuf],
+) -> Result<Value, MinterError> {
+    let active = serde_json::to_value(signer.public_jwk())
+        .map_err(|_| MinterError::SigningKey("public key could not be serialized"))?;
+    let mut keys = vec![active];
+    for path in retired {
+        keys.push(load_retired_public_key(path)?);
+    }
+    // One key id must resolve to one key. A verifier that indexes the set by
+    // `kid` is free to keep either entry, so a repeated id could leave the
+    // retired key standing in for the key every new token is signed with,
+    // with Mint still reporting itself ready.
+    let mut key_ids = std::collections::BTreeSet::new();
+    for key in &keys {
+        let key_id = key
+            .get("kid")
+            .and_then(Value::as_str)
+            .ok_or(MinterError::RetiredKey("has no key id"))?;
+        if !key_ids.insert(key_id) {
+            return Err(MinterError::RetiredKey(
+                "repeats a key id already in the published set",
+            ));
+        }
+    }
+    Ok(json!({ "keys": keys }))
+}
+
+fn load_retired_public_key(path: &Path) -> Result<Value, MinterError> {
+    let text =
+        std::fs::read_to_string(path).map_err(|_| MinterError::RetiredKey("is unreadable"))?;
+    let value: Value =
+        serde_json::from_str(&text).map_err(|_| MinterError::RetiredKey("is not JSON"))?;
+    let object = value
+        .as_object()
+        .ok_or(MinterError::RetiredKey("is not a JSON object"))?;
+    // The whole point of the published set is that it is public.
+    if contains_private_material(object) {
+        return Err(MinterError::RetiredKey("contains private key material"));
+    }
+    if !object.get("kid").is_some_and(Value::is_string) {
+        return Err(MinterError::RetiredKey("has no key id"));
+    }
+    Ok(value)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::clients::ClientRegistry;
+    use std::{fs, os::unix::fs::PermissionsExt};
+
+    const NOW: i64 = 1_800_000_000;
+
+    fn ed25519_key(seed: u8, kid: &str) -> (String, Value) {
+        let seed_bytes = [seed; 32];
+        let signing = ed25519_dalek::SigningKey::from_bytes(&seed_bytes);
+        let x = URL_SAFE_NO_PAD.encode(signing.verifying_key().to_bytes());
+        let d = URL_SAFE_NO_PAD.encode(seed_bytes);
+        let private =
+            json!({"kty": "OKP", "crv": "Ed25519", "kid": kid, "alg": "EdDSA", "x": x, "d": d});
+        let public = json!({"kty": "OKP", "crv": "Ed25519", "kid": kid, "alg": "EdDSA", "x": x});
+        (private.to_string(), public)
+    }
+
+    struct Fixture {
+        _directory: tempfile::TempDir,
+        minter: TokenMinter,
+        registry: ClientRegistry,
+    }
+
+    fn fixture(grant: Option<&str>) -> Fixture {
+        build_fixture(grant, "", "")
+    }
+
+    /// `registration` appends lines to the client registration, `claim` appends
+    /// lines to the configured claim names. Both are how the delegation tests
+    /// reach a shape the plain fixture does not have.
+    fn build_fixture(grant: Option<&str>, registration: &str, claim: &str) -> Fixture {
+        let directory = tempfile::tempdir().expect("temp dir");
+        let root = directory.path();
+        fs::create_dir_all(root.join("clients")).expect("client dir");
+
+        let (private, _public) = ed25519_key(9, "mint-2026-01");
+        let key_path = root.join("signing.jwk");
+        fs::write(&key_path, private).expect("write signing key");
+        fs::set_permissions(&key_path, fs::Permissions::from_mode(0o600)).expect("chmod");
+
+        let grant_line = grant
+            .map(|value| format!("grant: {value}\n"))
+            .unwrap_or_default();
+        fs::write(
+            root.join("clients/client-a.yaml"),
+            format!("clientId: client-a\nprincipal: urn:example:client-a\nevidenceAudience: https://client-a.example.org\nrequesterTags: [ministry-of-health, tier-one]\n{grant_line}keys: [{}]\n{registration}", ed25519_key(1, "client-a-1").1),
+        )
+        .expect("write client");
+
+        let config_path = root.join("mint.yaml");
+        let mut document = String::from(
+            r#"
+version: 1
+issuer: https://mint.example.org
+listener: {address: 127.0.0.1, port: 8081}
+signing:
+  algorithm: EdDSA
+  activeKeyId: mint-2026-01
+  activeKeyFile: signing.jwk
+audit:
+  path: audit/mint.jsonl
+  maximumFileBytes: 1073741824
+  hashKeyFile: audit-hmac-key
+  hashKeyVersion: 1
+accessTokens:
+  audiences: [evidence]
+  lifetimeSeconds: 300
+  claims:
+    principal: sub
+    requesterTags: evidence_tags
+    evidenceAudience: evidence_audience
+    grantId: evidence_grant_id
+    grantAuthority: evidence_authority
+"#,
+        );
+        document.push_str(claim);
+        document.push_str(
+            r#"clientAssertion:
+  audience: https://mint.example.org/token
+  algorithms: [EdDSA]
+clients:
+  directory: clients
+"#,
+        );
+        fs::write(&config_path, document).expect("write config");
+
+        let config = MintConfig::load(&config_path).expect("config loads");
+        let registry = ClientRegistry::load(&config.clients.directory).expect("registry loads");
+        let minter = TokenMinter::new(&config).expect("minter builds");
+        Fixture {
+            _directory: directory,
+            minter,
+            registry,
+        }
+    }
+
+    /// The active signer the published set is built around, matching the
+    /// `mint-2026-01` key id the fixture configuration declares.
+    fn active_signer() -> LocalJwkSigner {
+        let (private, _public) = ed25519_key(9, "mint-2026-01");
+        LocalJwkSigner::new(PrivateJwk::parse(&private).expect("private JWK parses"))
+            .expect("signer builds")
+    }
+
+    fn write_public_key(directory: &Path, name: &str, seed: u8, kid: &str) -> std::path::PathBuf {
+        let path = directory.join(name);
+        let (_private, public) = ed25519_key(seed, kid);
+        fs::write(&path, public.to_string()).expect("write public key");
+        path
+    }
+
+    #[test]
+    fn retired_keys_publish_beside_the_active_key() {
+        let directory = tempfile::tempdir().expect("temp dir");
+        let retired = write_public_key(directory.path(), "retired.jwk", 4, "mint-2025-07");
+
+        let jwks = build_jwks(&active_signer(), &[retired]).expect("set builds");
+
+        let ids: Vec<&str> = jwks["keys"]
+            .as_array()
+            .expect("keys is an array")
+            .iter()
+            .map(|key| key["kid"].as_str().expect("key id is a string"))
+            .collect();
+        assert_eq!(ids, ["mint-2026-01", "mint-2025-07"]);
+    }
+
+    #[test]
+    fn a_retired_key_may_not_repeat_the_active_key_id() {
+        let directory = tempfile::tempdir().expect("temp dir");
+        // Different key material published under the id the active key already
+        // uses. A verifier keyed by `kid` would be free to resolve either, so
+        // the retired key could displace the key every new token is signed
+        // with while Mint went on reporting itself ready.
+        let retired = write_public_key(directory.path(), "retired.jwk", 4, "mint-2026-01");
+
+        let error = build_jwks(&active_signer(), &[retired]).expect_err("duplicate id is rejected");
+
+        assert!(matches!(error, MinterError::RetiredKey(_)), "{error:?}");
+    }
+
+    #[test]
+    fn two_retired_keys_may_not_repeat_one_key_id() {
+        let directory = tempfile::tempdir().expect("temp dir");
+        let first = write_public_key(directory.path(), "first.jwk", 4, "mint-2025-07");
+        let second = write_public_key(directory.path(), "second.jwk", 5, "mint-2025-07");
+
+        let error =
+            build_jwks(&active_signer(), &[first, second]).expect_err("duplicate id is rejected");
+
+        assert!(matches!(error, MinterError::RetiredKey(_)), "{error:?}");
+    }
+
+    fn undelegated(client: &std::sync::Arc<RegisteredClient>) -> AuthenticatedClient {
+        AuthenticatedClient {
+            client: std::sync::Arc::clone(client),
+            delegation: None,
+        }
+    }
+
+    fn decode_claims(token: &str) -> Value {
+        let segment = token.split('.').nth(1).expect("token has a claims segment");
+        serde_json::from_slice(&URL_SAFE_NO_PAD.decode(segment).expect("claims decode"))
+            .expect("claims parse")
+    }
+
+    fn decode_header(token: &str) -> Value {
+        let segment = token.split('.').next().expect("token has a header segment");
+        serde_json::from_slice(&URL_SAFE_NO_PAD.decode(segment).expect("header decode"))
+            .expect("header parse")
+    }
+
+    #[tokio::test]
+    async fn minted_claims_come_from_the_registry() {
+        let fixture = fixture(None);
+        let client = fixture.registry.get("client-a").expect("client registered");
+        let minted = fixture
+            .minter
+            .mint(&undelegated(client), NOW)
+            .await
+            .expect("token mints");
+
+        let claims = decode_claims(&minted.access_token);
+        assert_eq!(claims["iss"], json!("https://mint.example.org"));
+        assert_eq!(claims["aud"], json!("evidence"));
+        assert_eq!(claims["sub"], json!("urn:example:client-a"));
+        assert_eq!(claims["client_id"], json!("client-a"));
+        assert_eq!(
+            claims["evidence_tags"],
+            json!(["ministry-of-health", "tier-one"])
+        );
+        assert_eq!(
+            claims["evidence_audience"],
+            json!("https://client-a.example.org")
+        );
+        assert_eq!(claims["iat"], json!(NOW));
+        assert_eq!(claims["nbf"], json!(NOW));
+        assert_eq!(claims["exp"], json!(NOW + 300));
+        assert_eq!(minted.expires_in, 300);
+        assert_eq!(minted.token_type, "Bearer");
+    }
+
+    #[tokio::test]
+    async fn the_header_names_the_active_key_and_access_token_type() {
+        let fixture = fixture(None);
+        let client = fixture.registry.get("client-a").expect("client registered");
+        let minted = fixture
+            .minter
+            .mint(&undelegated(client), NOW)
+            .await
+            .expect("token mints");
+
+        assert_eq!(
+            decode_header(&minted.access_token),
+            json!({"alg": "EdDSA", "typ": "at+jwt", "kid": "mint-2026-01"})
+        );
+    }
+
+    #[tokio::test]
+    async fn a_grant_is_minted_as_a_matched_pair_or_not_at_all() {
+        let without = fixture(None);
+        let client = without.registry.get("client-a").expect("client registered");
+        let claims = decode_claims(
+            &without
+                .minter
+                .mint(&undelegated(client), NOW)
+                .await
+                .expect("token mints")
+                .access_token,
+        );
+        assert!(claims.get("evidence_grant_id").is_none());
+        assert!(claims.get("evidence_authority").is_none());
+
+        let with = fixture(Some("{id: grant-1, authority: statute-7}"));
+        let client = with.registry.get("client-a").expect("client registered");
+        let claims = decode_claims(
+            &with
+                .minter
+                .mint(&undelegated(client), NOW)
+                .await
+                .expect("token mints")
+                .access_token,
+        );
+        assert_eq!(claims["evidence_grant_id"], json!("grant-1"));
+        assert_eq!(claims["evidence_authority"], json!("statute-7"));
+    }
+
+    #[tokio::test]
+    async fn every_token_carries_a_distinct_identifier() {
+        let fixture = fixture(None);
+        let client = fixture.registry.get("client-a").expect("client registered");
+        let first = fixture
+            .minter
+            .mint(&undelegated(client), NOW)
+            .await
+            .expect("token mints");
+        let second = fixture
+            .minter
+            .mint(&undelegated(client), NOW)
+            .await
+            .expect("token mints");
+
+        let first_jti = decode_claims(&first.access_token)["jti"].clone();
+        let second_jti = decode_claims(&second.access_token)["jti"].clone();
+        assert_ne!(first_jti, second_jti);
+    }
+
+    const DELEGATION: &str =
+        "delegation:\n  actors: [urn:example:agent-one]\n  subjectClaims:\n    given_name: identity.given_name\n    birth_date: identity.birth_date\n";
+    const ACTOR_CLAIM: &str = "    actor: evidence_actor\n";
+
+    fn delegated_fixture() -> Fixture {
+        build_fixture(None, DELEGATION, ACTOR_CLAIM)
+    }
+
+    fn delegation(subject: &[(&str, Value)]) -> crate::assertion::ResolvedDelegation {
+        crate::assertion::ResolvedDelegation::new(
+            "urn:example:agent-one".to_owned(),
+            subject
+                .iter()
+                .map(|(field, value)| ((*field).to_owned(), value.clone()))
+                .collect(),
+        )
+    }
+
+    fn delegated(
+        client: &std::sync::Arc<RegisteredClient>,
+        subject: &[(&str, Value)],
+    ) -> AuthenticatedClient {
+        AuthenticatedClient {
+            client: std::sync::Arc::clone(client),
+            delegation: Some(delegation(subject)),
+        }
+    }
+
+    /// The subject is minted at exactly the claim paths the registration
+    /// declared, which is what lets a resource server read it back out as the
+    /// selector it will not accept from the request body.
+    #[tokio::test]
+    async fn a_delegated_token_carries_the_actor_and_the_subject_at_their_declared_paths() {
+        let fixture = delegated_fixture();
+        let client = fixture.registry.get("client-a").expect("client registered");
+        let minted = fixture
+            .minter
+            .mint(
+                &delegated(
+                    client,
+                    &[
+                        ("given_name", json!("Amara")),
+                        ("birth_date", json!("1998-04-02")),
+                    ],
+                ),
+                NOW,
+            )
+            .await
+            .expect("token mints");
+
+        let claims = decode_claims(&minted.access_token);
+        assert_eq!(claims["evidence_actor"], json!("urn:example:agent-one"));
+        assert_eq!(
+            claims["identity"],
+            json!({"given_name": "Amara", "birth_date": "1998-04-02"})
+        );
+        // The registry's own authority is unchanged by the delegation.
+        assert_eq!(claims["sub"], json!("urn:example:client-a"));
+        assert_eq!(claims["client_id"], json!("client-a"));
+    }
+
+    /// An ordinary token from the same minter carries neither, so a resource
+    /// server reading the subject from the token has nothing to read.
+    #[tokio::test]
+    async fn an_undelegated_token_carries_no_actor_and_no_subject() {
+        let fixture = delegated_fixture();
+        let client = fixture.registry.get("client-a").expect("client registered");
+        let minted = fixture
+            .minter
+            .mint(&undelegated(client), NOW)
+            .await
+            .expect("token mints");
+
+        let claims = decode_claims(&minted.access_token);
+        assert!(claims.get("evidence_actor").is_none());
+        assert!(claims.get("identity").is_none());
+    }
+
+    /// Startup refuses a registry that declares delegation without a configured
+    /// actor claim, so this can only be reached by a bug. It must fail rather
+    /// than mint a token whose subject no resource server can attribute.
+    #[tokio::test]
+    async fn minting_a_delegation_without_a_configured_actor_claim_is_a_server_error() {
+        let fixture = build_fixture(None, DELEGATION, "");
+        let client = fixture.registry.get("client-a").expect("client registered");
+        let error = fixture
+            .minter
+            .mint(
+                &delegated(
+                    client,
+                    &[
+                        ("given_name", json!("Amara")),
+                        ("birth_date", json!("1998-04-02")),
+                    ],
+                ),
+                NOW,
+            )
+            .await
+            .expect_err("an unconfigured actor claim must not mint");
+        assert_eq!(
+            error,
+            TokenError::server_error("no actor claim is configured for delegated tokens")
+        );
+    }
+
+    #[tokio::test]
+    async fn a_delegation_resolved_for_an_undelegated_client_is_a_server_error() {
+        let fixture = build_fixture(None, "", ACTOR_CLAIM);
+        let client = fixture.registry.get("client-a").expect("client registered");
+        let error = fixture
+            .minter
+            .mint(&delegated(client, &[("given_name", json!("Amara"))]), NOW)
+            .await
+            .expect_err("an undelegated client must not mint a delegation");
+        assert_eq!(
+            error,
+            TokenError::server_error("a delegation was resolved for an undelegated client")
+        );
+    }
+
+    /// Two fields under one path prefix have to nest into one object rather than
+    /// the second overwriting the first.
+    #[tokio::test]
+    async fn subject_claims_sharing_a_path_prefix_nest_into_one_object() {
+        let deep = "delegation:\n  subjectClaims:\n    given_name: subject.identity.given_name\n    region: subject.residence.region\n";
+        let fixture = build_fixture(None, deep, ACTOR_CLAIM);
+        let client = fixture.registry.get("client-a").expect("client registered");
+        let minted = fixture
+            .minter
+            .mint(
+                &delegated(
+                    client,
+                    &[("given_name", json!("Amara")), ("region", json!("north"))],
+                ),
+                NOW,
+            )
+            .await
+            .expect("token mints");
+
+        assert_eq!(
+            decode_claims(&minted.access_token)["subject"],
+            json!({"identity": {"given_name": "Amara"}, "residence": {"region": "north"}})
+        );
+    }
+
+    /// The startup check refuses a subject path rooted at an authority claim, so
+    /// this is unreachable in a loaded server. If it were ever reached, the
+    /// delegation must not be allowed to overwrite the authority.
+    #[tokio::test]
+    async fn a_subject_path_colliding_with_an_authority_claim_is_a_server_error() {
+        let colliding =
+            "delegation:\n  subjectClaims:\n    given_name: evidence_audience.given_name\n";
+        let fixture = build_fixture(None, colliding, ACTOR_CLAIM);
+        let client = fixture.registry.get("client-a").expect("client registered");
+        let error = fixture
+            .minter
+            .mint(&delegated(client, &[("given_name", json!("Amara"))]), NOW)
+            .await
+            .expect_err("a colliding subject path must not mint");
+        assert_eq!(
+            error,
+            TokenError::server_error("a subject claim path collides with an authority claim")
+        );
+    }
+
+    #[test]
+    fn the_published_key_set_carries_public_material_only() {
+        let fixture = fixture(None);
+        let rendered = serde_json::to_string(fixture.minter.jwks()).expect("jwks serializes");
+        for member in [
+            "\"d\"", "\"p\"", "\"q\"", "\"dp\"", "\"dq\"", "\"qi\"", "\"k\"",
+        ] {
+            assert!(
+                !rendered.contains(member),
+                "the published key set must not contain {member}"
+            );
+        }
+        assert!(rendered.contains("mint-2026-01"));
+    }
+
+    #[test]
+    fn debug_output_never_reveals_the_signing_key() {
+        let fixture = fixture(None);
+        let rendered = format!("{:?}", fixture.minter);
+
+        // Useful for operators: which key is live, and under what identity.
+        assert!(rendered.contains("mint-2026-01"));
+        assert!(rendered.contains("https://mint.example.org"));
+
+        // The private scalar of the fixture's signing key, verbatim. Debug is
+        // the easiest place for key material to escape into a log line.
+        let private_scalar = URL_SAFE_NO_PAD.encode([9u8; 32]);
+        assert!(
+            !rendered.contains(&private_scalar),
+            "the debug output must never carry private key material"
+        );
+    }
+}
diff --git a/crates/registry-mint/tests/delegated_subject_binding.rs b/crates/registry-mint/tests/delegated_subject_binding.rs
new file mode 100644
index 000000000..31520528d
--- /dev/null
+++ b/crates/registry-mint/tests/delegated_subject_binding.rs
@@ -0,0 +1,649 @@
+//! End-to-end proof that a delegated token Mint issues is bound to one subject.
+//!
+//! The claim is narrow and worth stating precisely: a client that is registered
+//! for delegation asks Mint for a token *for a named person*, and the resulting
+//! token can only ever produce evidence about that person. Not because the
+//! client is well behaved, but because Evidence reads the subject out of the
+//! token and refuses to read it from the request at all.
+//!
+//! Nothing here stubs a boundary. The Mint router is the real one, the bundle is
+//! the demonstration bundle under `demo/evidence-bundle`, and the authorization
+//! decision is Evidence's own `match_entitlement` and `resolve_selectors`.
+
+use std::{collections::BTreeMap, fs, os::unix::fs::PermissionsExt, path::Path, sync::Arc};
+
+use axum_test::TestServer;
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use registry_evidence::{
+    auth::{AuthenticatedContext, AuthenticationClaimsConfig, Authenticator},
+    bundle::Bundle,
+    config::{AuthorityKind, ValueOrigin},
+    model::{EvidenceRequest, RequestedSelector, RequestedSubject, SelectorValue},
+    selector::{authorize_and_resolve, AuthorizationError, ResolvedSelectorValue},
+};
+use registry_mint::{
+    config::MintConfig,
+    server::{build_app, MintService},
+    CLIENT_ASSERTION_TYPE, GRANT_TYPE_CLIENT_CREDENTIALS, ON_BEHALF_OF_CLAIM,
+};
+use registry_platform_crypto::PrivateJwk;
+use registry_platform_oidc::{JwksFetcher, JwksFetcherConfig, TokenVerifier, TokenVerifierConfig};
+use serde_json::{json, Value};
+
+/// These four must agree with `demo/evidence-bundle/evidence.yaml`. If they ever
+/// drift, this test is the thing that says so.
+const ISSUER: &str = "https://localhost:8443";
+const EVIDENCE_AUDIENCE: &str = "evidence.demo.invalid";
+const ACTOR_CLAIM: &str = "evidence_actor";
+const REQUIREMENT: &str = "urn:example:demo:requirement:residence-region:v1";
+const PURPOSE: &str = "demo-routing";
+const ASSERTION_AUDIENCE: &str = "https://localhost:8443/token";
+
+const AGENT: &str = "urn:example:demo:agent:appointment-scheduler";
+
+// A fixed, non-secret audit HMAC key. Held as a byte literal rather than
+// written inline so a secret scanner does not read the write call as an
+// assignment of a live credential.
+const AUDIT_HASH_KEY: &[u8] = b"0123456789abcdef0123456789abcdef";
+
+fn key_pair(seed: u8) -> (PrivateJwk, Value, Value) {
+    let seed_bytes = [seed; 32];
+    let signing = ed25519_dalek::SigningKey::from_bytes(&seed_bytes);
+    let x = URL_SAFE_NO_PAD.encode(signing.verifying_key().to_bytes());
+    let d = URL_SAFE_NO_PAD.encode(seed_bytes);
+    let kid = format!("key-{seed}");
+    let public = json!({"kty": "OKP", "crv": "Ed25519", "kid": kid, "alg": "EdDSA", "x": x});
+    let private_document =
+        json!({"kty": "OKP", "crv": "Ed25519", "kid": kid, "alg": "EdDSA", "x": x, "d": d});
+    let private = PrivateJwk::parse(&private_document.to_string()).expect("private JWK parses");
+    (private, public, private_document)
+}
+
+struct Deployment {
+    _directory: tempfile::TempDir,
+    service: Arc<MintService>,
+    audit_path: std::path::PathBuf,
+}
+
+/// A Mint deployment whose claim names, issuer, and audience are the ones the
+/// demonstration bundle expects.
+async fn deployment() -> Deployment {
+    let directory = tempfile::tempdir().expect("temp dir");
+    let root = directory.path();
+    fs::create_dir(root.join("secrets")).expect("create secrets directory");
+    fs::create_dir(root.join("clients")).expect("create clients directory");
+
+    let (_, _, signing_document) = key_pair(9);
+    let signing_path = root.join("secrets/signing.jwk");
+    fs::write(&signing_path, signing_document.to_string()).expect("write signing key");
+    fs::set_permissions(&signing_path, fs::Permissions::from_mode(0o600))
+        .expect("restrict signing key");
+    let audit_key_path = root.join("secrets/audit-hmac-key");
+    fs::write(&audit_key_path, AUDIT_HASH_KEY).expect("write audit key");
+    fs::set_permissions(&audit_key_path, fs::Permissions::from_mode(0o600))
+        .expect("restrict audit key");
+    let audit_path = root.join("audit/mint.jsonl");
+
+    // The delegated caller: it may act as one agent, over exactly three
+    // selector fields, minted at exactly the paths the bundle reads.
+    let (_, scheduler_public, _) = key_pair(1);
+    fs::write(
+        root.join("clients/scheduler.yaml"),
+        format!(
+            "clientId: scheduler\nprincipal: urn:example:demo:principal:scheduler\nevidenceAudience: https://scheduler.demo.invalid\nrequesterTags: [demo-agent]\nkeys: [{scheduler_public}]\ndelegation:\n  actors: [{AGENT}]\n  subjectClaims:\n    given_name: identity.given_name\n    family_name: identity.family_name\n    birth_date: identity.birth_date\n"
+        ),
+    )
+    .expect("write delegated client");
+
+    // The same authority, without delegation. Its tokens carry no actor.
+    let (_, desk_public, _) = key_pair(2);
+    fs::write(
+        root.join("clients/service-desk.yaml"),
+        format!(
+            "clientId: service-desk\nprincipal: urn:example:demo:principal:service-desk\nevidenceAudience: https://service-desk.demo.invalid\nrequesterTags: [demo-agent]\nkeys: [{desk_public}]\n"
+        ),
+    )
+    .expect("write undelegated client");
+
+    let config_path = root.join("mint.yaml");
+    fs::write(
+        &config_path,
+        format!(
+            r#"
+version: 1
+issuer: {ISSUER}
+listener: {{address: 127.0.0.1, port: 0}}
+signing:
+  algorithm: EdDSA
+  activeKeyId: key-9
+  activeKeyFile: secrets/signing.jwk
+audit:
+  path: audit/mint.jsonl
+  maximumFileBytes: 1073741824
+  hashKeyFile: secrets/audit-hmac-key
+  hashKeyVersion: 1
+accessTokens:
+  audiences: [{EVIDENCE_AUDIENCE}]
+  lifetimeSeconds: 300
+  claims:
+    principal: sub
+    requesterTags: evidence_tags
+    evidenceAudience: evidence_audience
+    grantId: evidence_grant_id
+    grantAuthority: evidence_authority
+    actor: {ACTOR_CLAIM}
+clientAssertion:
+  audience: {ASSERTION_AUDIENCE}
+  algorithms: [EdDSA]
+clients:
+  directory: clients
+"#
+        ),
+    )
+    .expect("write config");
+
+    let config = MintConfig::load(&config_path).expect("the deployment configuration is valid");
+    let service = Arc::new(
+        MintService::load(config)
+            .await
+            .expect("the deployment loads"),
+    );
+    Deployment {
+        _directory: directory,
+        service,
+        audit_path,
+    }
+}
+
+fn sign_assertion(private: &PrivateJwk, claims: &Value) -> String {
+    let kid = private.kid.clone().expect("the test key has a kid");
+    let header = json!({"alg": "EdDSA", "typ": "JWT", "kid": kid});
+    let encode = |value: &Value| {
+        URL_SAFE_NO_PAD.encode(serde_json::to_vec(value).expect("value serializes"))
+    };
+    let signing_input = format!("{}.{}", encode(&header), encode(claims));
+    let signature =
+        registry_platform_crypto::sign(signing_input.as_bytes(), private).expect("the key signs");
+    format!("{signing_input}.{}", URL_SAFE_NO_PAD.encode(signature))
+}
+
+fn assertion_claims(client_id: &str, jti: &str) -> Value {
+    let now = time::OffsetDateTime::now_utc().unix_timestamp();
+    json!({
+        "iss": client_id,
+        "sub": client_id,
+        "aud": ASSERTION_AUDIENCE,
+        "iat": now,
+        "exp": now + 120,
+        "jti": jti,
+    })
+}
+
+/// The delegation request, carried inside the client's own signed assertion so
+/// the values are covered by the client's signature rather than travelling as
+/// unauthenticated form parameters.
+fn delegated_claims(jti: &str, subject: &[(&str, &str)]) -> Value {
+    let mut claims = assertion_claims("scheduler", jti);
+    claims[ON_BEHALF_OF_CLAIM] = json!({
+        "actor": AGENT,
+        "subject": subject
+            .iter()
+            .map(|(field, value)| ((*field).to_owned(), json!(value)))
+            .collect::<serde_json::Map<_, _>>(),
+    });
+    claims
+}
+
+fn token_form(assertion: &str) -> Vec<(String, String)> {
+    vec![
+        (
+            "grant_type".to_owned(),
+            GRANT_TYPE_CLIENT_CREDENTIALS.to_owned(),
+        ),
+        (
+            "client_assertion_type".to_owned(),
+            CLIENT_ASSERTION_TYPE.to_owned(),
+        ),
+        ("client_assertion".to_owned(), assertion.to_owned()),
+    ]
+}
+
+async fn mint_token(http: &TestServer, assertion: &str) -> String {
+    let response = http.post("/token").form(&token_form(assertion)).await;
+    response.assert_status_ok();
+    response.json::<Value>()["access_token"]
+        .as_str()
+        .expect("the response carries an access token")
+        .to_owned()
+}
+
+/// Evidence's authenticator over the key set Mint published, configured exactly
+/// as the demonstration bundle configures it.
+fn evidence_authenticator(jwks: &Value) -> Authenticator {
+    let key_set: jsonwebtoken::jwk::JwkSet =
+        serde_json::from_value(jwks.clone()).expect("Mint publishes a parsable JWK set");
+    let verifier_config = TokenVerifierConfig::access_token_profile(
+        ISSUER.to_owned(),
+        vec![EVIDENCE_AUDIENCE.to_owned()],
+        vec![jsonwebtoken::Algorithm::EdDSA],
+        vec!["at+jwt".to_owned()],
+    );
+    Authenticator::new(
+        Arc::new(TokenVerifier::new(
+            verifier_config,
+            Arc::new(JwksFetcher::new_static(
+                key_set,
+                JwksFetcherConfig::defaults(),
+            )),
+        )),
+        AuthenticationClaimsConfig {
+            principal_claim: "sub".to_owned(),
+            requester_tags_claim: "evidence_tags".to_owned(),
+            evidence_audience_claim: "evidence_audience".to_owned(),
+            grant_id_claim: "evidence_grant_id".to_owned(),
+            grant_authority_claim: "evidence_authority".to_owned(),
+            actor_claim: Some(ACTOR_CLAIM.to_owned()),
+        },
+    )
+}
+
+struct LoadedBundle {
+    _directory: tempfile::TempDir,
+    bundle: Bundle,
+}
+
+/// Evidence refuses a writable bundle, so the demonstration bundle is copied to
+/// a temporary root and frozen before loading.
+fn demo_bundle() -> LoadedBundle {
+    let directory = tempfile::tempdir().expect("temp dir");
+    let root = directory.path().join("bundle");
+    fs::create_dir(&root).expect("create bundle root");
+    copy_tree(
+        &Path::new(env!("CARGO_MANIFEST_DIR")).join("demo/evidence-bundle"),
+        &root,
+    );
+    make_read_only(&root);
+    let bundle = Bundle::load(&root).expect("the demonstration bundle loads");
+    LoadedBundle {
+        _directory: directory,
+        bundle,
+    }
+}
+
+fn copy_tree(source: &Path, target: &Path) {
+    for entry in fs::read_dir(source).expect("the demonstration bundle is readable") {
+        let entry = entry.expect("bundle entry is readable");
+        let destination = target.join(entry.file_name());
+        if entry.file_type().expect("entry type is readable").is_dir() {
+            fs::create_dir(&destination).expect("bundle directory is copied");
+            copy_tree(&entry.path(), &destination);
+        } else {
+            fs::copy(entry.path(), destination).expect("bundle file is copied");
+        }
+    }
+}
+
+fn make_read_only(path: &Path) {
+    for entry in fs::read_dir(path).expect("copied bundle is readable") {
+        let entry = entry.expect("bundle entry is readable");
+        let child = entry.path();
+        if entry.file_type().expect("entry type is readable").is_dir() {
+            make_read_only(&child);
+            fs::set_permissions(&child, fs::Permissions::from_mode(0o555))
+                .expect("bundle directory is immutable");
+        } else {
+            fs::set_permissions(&child, fs::Permissions::from_mode(0o444))
+                .expect("bundle file is immutable");
+        }
+    }
+    fs::set_permissions(path, fs::Permissions::from_mode(0o555)).expect("bundle root is immutable");
+}
+
+/// The request a delegated caller sends: it names the requirement, the purpose,
+/// and the *shape* of the subject, and carries no selector values at all.
+fn subject_bound_request() -> EvidenceRequest {
+    EvidenceRequest {
+        // The nonce is a caller correlation value that never reaches
+        // authorization, which is the only thing under test here.
+        request_nonce: registry_evidence::model::OFFLINE_EVALUATION_REQUEST_NONCE.to_owned(),
+        requirement: REQUIREMENT.to_owned(),
+        purpose: PURPOSE.to_owned(),
+        subjects: vec![RequestedSubject {
+            role: "subject".to_owned(),
+            selector: RequestedSelector {
+                profile: "demographics-v1".to_owned(),
+                values: None,
+            },
+        }],
+        // A holder key belongs to the SD-JWT VC response format and never
+        // reaches authorization, which is the only thing under test here.
+        holder_key: None,
+    }
+}
+
+fn resolved_values(
+    authorization: &registry_evidence::selector::ResolvedAuthorization,
+) -> BTreeMap<String, String> {
+    authorization
+        .subjects
+        .iter()
+        .flat_map(|subject| subject.fields.iter())
+        .map(|field| {
+            let value = match &field.value {
+                ResolvedSelectorValue::String(value) => value.clone(),
+                ResolvedSelectorValue::Date(value) => value.to_string(),
+                other => format!("{other:?}"),
+            };
+            (field.name.clone(), value)
+        })
+        .collect()
+}
+
+async fn context_for(http: &TestServer, jwks: &Value, assertion: &str) -> AuthenticatedContext {
+    let token = mint_token(http, assertion).await;
+    evidence_authenticator(jwks)
+        .authenticate(&token)
+        .await
+        .expect("Evidence accepts a token Mint issued")
+}
+
+/// The whole point, in one test: the subject the client named to Mint is the
+/// subject Evidence resolves, and the client never names it again.
+#[tokio::test]
+async fn a_delegated_token_authorizes_evidence_about_exactly_its_own_subject() {
+    let deployment = deployment().await;
+    let http = TestServer::new(build_app(Arc::clone(&deployment.service)));
+    let jwks = http.get("/.well-known/jwks.json").await.json::<Value>();
+    let loaded = demo_bundle();
+
+    let (private, _, _) = key_pair(1);
+    let assertion = sign_assertion(
+        &private,
+        &delegated_claims(
+            "jti-1",
+            &[
+                ("given_name", "Amara"),
+                ("family_name", "Okafor"),
+                ("birth_date", "1998-04-02"),
+            ],
+        ),
+    );
+    let context = context_for(&http, &jwks, &assertion).await;
+    assert_eq!(context.actor(), Some(AGENT));
+
+    let audit = fs::read_to_string(&deployment.audit_path).expect("read Mint audit");
+    assert!(audit.contains("\"phase\":\"token-release\""));
+    assert!(audit.contains("\"decision\":\"issued\""));
+    assert!(audit.contains("\"clientPseudonym\":\"hmac-sha256:v1:"));
+    assert!(audit.contains("\"authorityPseudonym\":\"hmac-sha256:v1:"));
+    assert!(audit.contains("\"subjectPseudonym\":\"hmac-sha256:v1:"));
+    for protected in [
+        "scheduler",
+        "urn:example:demo:principal:scheduler",
+        AGENT,
+        "Amara",
+        "Okafor",
+        "1998-04-02",
+        &assertion,
+    ] {
+        assert!(
+            !audit.contains(protected),
+            "Mint audit retained protected token input"
+        );
+    }
+
+    let authorization = authorize_and_resolve(&loaded.bundle, &subject_bound_request(), &context)
+        .expect("a delegated token authorizes its own subject");
+
+    assert_eq!(authorization.authority_kind, AuthorityKind::Delegated);
+    assert_eq!(authorization.subjects.len(), 1);
+    assert_eq!(
+        authorization.subjects[0].value_origin,
+        ValueOrigin::AuthenticatedContext
+    );
+    assert_eq!(
+        resolved_values(&authorization),
+        BTreeMap::from([
+            ("given_name".to_owned(), "Amara".to_owned()),
+            ("family_name".to_owned(), "Okafor".to_owned()),
+            ("birth_date".to_owned(), "1998-04-02".to_owned()),
+        ])
+    );
+}
+
+/// The containment Jeremi asked for. A client holding a token for one person
+/// cannot reach a second person by putting their details in the request: the
+/// request is refused for carrying selector values at all, so there is no
+/// version of this request that reaches a different subject.
+#[tokio::test]
+async fn a_delegated_token_cannot_be_pointed_at_a_different_subject() {
+    let deployment = deployment().await;
+    let http = TestServer::new(build_app(Arc::clone(&deployment.service)));
+    let jwks = http.get("/.well-known/jwks.json").await.json::<Value>();
+    let loaded = demo_bundle();
+
+    let (private, _, _) = key_pair(1);
+    let assertion = sign_assertion(
+        &private,
+        &delegated_claims(
+            "jti-1",
+            &[
+                ("given_name", "Amara"),
+                ("family_name", "Okafor"),
+                ("birth_date", "1998-04-02"),
+            ],
+        ),
+    );
+    let context = context_for(&http, &jwks, &assertion).await;
+
+    let mut request = subject_bound_request();
+    request.subjects[0].selector.values = Some(BTreeMap::from([
+        (
+            "given_name".to_owned(),
+            SelectorValue::String("Kofi".to_owned()),
+        ),
+        (
+            "family_name".to_owned(),
+            SelectorValue::String("Mensah".to_owned()),
+        ),
+        (
+            "birth_date".to_owned(),
+            SelectorValue::String("1971-11-30".to_owned()),
+        ),
+    ]));
+
+    let error = authorize_and_resolve(&loaded.bundle, &request, &context)
+        .expect_err("a request carrying its own selector values is refused");
+    assert_eq!(error, AuthorizationError::Selector);
+
+    // And repeating the caller's own subject does not help either: the refusal
+    // is for supplying values, not for supplying the wrong ones.
+    let mut echoed = subject_bound_request();
+    echoed.subjects[0].selector.values = Some(BTreeMap::from([
+        (
+            "given_name".to_owned(),
+            SelectorValue::String("Amara".to_owned()),
+        ),
+        (
+            "family_name".to_owned(),
+            SelectorValue::String("Okafor".to_owned()),
+        ),
+        (
+            "birth_date".to_owned(),
+            SelectorValue::String("1998-04-02".to_owned()),
+        ),
+    ]));
+    assert_eq!(
+        authorize_and_resolve(&loaded.bundle, &echoed, &context)
+            .expect_err("supplying values is refused even when they match"),
+        AuthorizationError::Selector
+    );
+}
+
+/// Two tokens from the same client and the same key resolve to two different
+/// people, so the binding is a property of the token rather than of the client.
+#[tokio::test]
+async fn each_token_carries_its_own_subject() {
+    let deployment = deployment().await;
+    let http = TestServer::new(build_app(Arc::clone(&deployment.service)));
+    let jwks = http.get("/.well-known/jwks.json").await.json::<Value>();
+    let loaded = demo_bundle();
+    let (private, _, _) = key_pair(1);
+
+    let first = sign_assertion(
+        &private,
+        &delegated_claims(
+            "jti-1",
+            &[
+                ("given_name", "Amara"),
+                ("family_name", "Okafor"),
+                ("birth_date", "1998-04-02"),
+            ],
+        ),
+    );
+    let second = sign_assertion(
+        &private,
+        &delegated_claims(
+            "jti-2",
+            &[
+                ("given_name", "Kofi"),
+                ("family_name", "Mensah"),
+                ("birth_date", "1971-11-30"),
+            ],
+        ),
+    );
+
+    let first = context_for(&http, &jwks, &first).await;
+    let second = context_for(&http, &jwks, &second).await;
+
+    let resolve = |context: &AuthenticatedContext| {
+        resolved_values(
+            &authorize_and_resolve(&loaded.bundle, &subject_bound_request(), context)
+                .expect("each delegated token authorizes its own subject"),
+        )
+    };
+    assert_eq!(resolve(&first)["given_name"], "Amara");
+    assert_eq!(resolve(&second)["given_name"], "Kofi");
+}
+
+/// A token with no actor cannot produce evidence from the subject-bound grant,
+/// because there is nowhere for the subject to come from: the grant reads it
+/// from claims the token does not carry, and refuses to read it from the
+/// request.
+///
+/// Note the shape of the refusal. Evidence confines an *actor-bearing* token to
+/// `kind: delegated` profiles, but it does not conversely require an actor to
+/// reach one, so this token matches the grant and is stopped at selector
+/// resolution rather than at entitlement matching. Nothing leaks either way, but
+/// the two are not interchangeable: were this grant to gain a subject role whose
+/// values come from the request, an undelegated token would reach it.
+#[tokio::test]
+async fn an_undelegated_token_cannot_use_the_delegated_grant() {
+    let deployment = deployment().await;
+    let http = TestServer::new(build_app(Arc::clone(&deployment.service)));
+    let jwks = http.get("/.well-known/jwks.json").await.json::<Value>();
+    let loaded = demo_bundle();
+
+    let (private, _, _) = key_pair(2);
+    let assertion = sign_assertion(&private, &assertion_claims("service-desk", "jti-1"));
+    let context = context_for(&http, &jwks, &assertion).await;
+    assert_eq!(context.actor(), None);
+
+    assert_eq!(
+        authorize_and_resolve(&loaded.bundle, &subject_bound_request(), &context)
+            .expect_err("an undelegated token has no subject to resolve"),
+        AuthorizationError::Selector
+    );
+
+    // Supplying the subject in the request does not rescue it: the grant refuses
+    // request-borne selector values from any caller.
+    let mut request = subject_bound_request();
+    request.subjects[0].selector.values = Some(BTreeMap::from([
+        (
+            "given_name".to_owned(),
+            SelectorValue::String("Amara".to_owned()),
+        ),
+        (
+            "family_name".to_owned(),
+            SelectorValue::String("Okafor".to_owned()),
+        ),
+        (
+            "birth_date".to_owned(),
+            SelectorValue::String("1998-04-02".to_owned()),
+        ),
+    ]));
+    assert_eq!(
+        authorize_and_resolve(&loaded.bundle, &request, &context)
+            .expect_err("an undelegated token cannot name a subject either"),
+        AuthorizationError::Selector
+    );
+}
+
+/// Mint refuses the request before it ever becomes a token: the actor is not one
+/// this registration may act as.
+#[tokio::test]
+async fn mint_refuses_an_actor_the_registration_does_not_permit() {
+    let deployment = deployment().await;
+    let http = TestServer::new(build_app(Arc::clone(&deployment.service)));
+
+    let (private, _, _) = key_pair(1);
+    let mut claims = delegated_claims(
+        "jti-1",
+        &[
+            ("given_name", "Amara"),
+            ("family_name", "Okafor"),
+            ("birth_date", "1998-04-02"),
+        ],
+    );
+    claims[ON_BEHALF_OF_CLAIM]["actor"] = json!("urn:example:demo:agent:someone-else");
+    let assertion = sign_assertion(&private, &claims);
+
+    let response = http.post("/token").form(&token_form(&assertion)).await;
+    assert_eq!(response.status_code(), 401);
+    assert_eq!(response.json::<Value>(), json!({"error": "invalid_client"}));
+    let audit = fs::read_to_string(&deployment.audit_path).expect("read Mint audit");
+    assert!(audit.contains("\"phase\":\"denial\""));
+    assert!(audit.contains("\"safeErrorCategory\":\"invalid_client\""));
+    assert!(!audit.contains("someone-else"));
+}
+
+/// A signed access token is not released unless its audit record is durable.
+#[tokio::test]
+async fn an_unwritable_audit_chain_prevents_token_release() {
+    let deployment = deployment().await;
+    fs::set_permissions(&deployment.audit_path, fs::Permissions::from_mode(0o400))
+        .expect("make audit unwritable");
+    let http = TestServer::new(build_app(Arc::clone(&deployment.service)));
+
+    let (private, _, _) = key_pair(2);
+    let assertion = sign_assertion(
+        &private,
+        &assertion_claims("service-desk", "jti-audit-down"),
+    );
+    let response = http.post("/token").form(&token_form(&assertion)).await;
+    assert_eq!(response.status_code(), 500);
+    assert_eq!(response.json::<Value>(), json!({"error": "server_error"}));
+
+    let readiness = http.get("/ready").await;
+    assert_eq!(readiness.status_code(), 503);
+}
+
+/// The other direction: an undelegated registration cannot obtain a subject
+/// binding by asking for one.
+#[tokio::test]
+async fn mint_refuses_a_delegation_from_an_undelegated_client() {
+    let deployment = deployment().await;
+    let http = TestServer::new(build_app(Arc::clone(&deployment.service)));
+
+    let (private, _, _) = key_pair(2);
+    let mut claims = assertion_claims("service-desk", "jti-1");
+    claims[ON_BEHALF_OF_CLAIM] = json!({
+        "actor": AGENT,
+        "subject": {"given_name": "Amara", "family_name": "Okafor", "birth_date": "1998-04-02"},
+    });
+    let assertion = sign_assertion(&private, &claims);
+
+    let response = http.post("/token").form(&token_form(&assertion)).await;
+    assert_eq!(response.status_code(), 401);
+    assert_eq!(response.json::<Value>(), json!({"error": "invalid_client"}));
+}
diff --git a/crates/registry-mint/tests/evidence_compatibility.rs b/crates/registry-mint/tests/evidence_compatibility.rs
new file mode 100644
index 000000000..1bd1ecee8
--- /dev/null
+++ b/crates/registry-mint/tests/evidence_compatibility.rs
@@ -0,0 +1,581 @@
+//! End-to-end proof that a token Mint issues is one Evidence accepts.
+//!
+//! This is the test that justifies the crate existing. It drives the real Mint
+//! router over a real deployment on disk, and feeds the resulting access token
+//! to the real Evidence authenticator. Nothing here stubs a boundary: if the
+//! two products ever disagree about claim names, algorithms, token type,
+//! issuer, or audience, this fails.
+
+use std::{error::Error, fs, os::unix::fs::PermissionsExt, path::Path, sync::Arc, time::Duration};
+
+use axum_test::TestServer;
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use registry_evidence::{
+    auth::{AuthenticationClaimsConfig, Authenticator},
+    config::{
+        AccessTokenAlgorithm, AccessTokenType, AssuranceProfile, AuthenticationConfig,
+        AuthenticationKind,
+    },
+};
+use registry_mint::{
+    config::MintConfig,
+    server::{build_app, serve, MintService},
+    CLIENT_ASSERTION_TYPE, GRANT_TYPE_CLIENT_CREDENTIALS,
+};
+use registry_platform_crypto::PrivateJwk;
+use registry_platform_oidc::{JwksFetcher, JwksFetcherConfig, TokenVerifier, TokenVerifierConfig};
+use serde_json::{json, Value};
+
+// A fixed, non-secret audit HMAC key. Held as a byte literal rather than
+// written inline so a secret scanner does not read the write call as an
+// assignment of a live credential.
+const AUDIT_HASH_KEY: &[u8] = b"0123456789abcdef0123456789abcdef";
+const ISSUER: &str = "https://mint.example.org";
+const ASSERTION_AUDIENCE: &str = "https://mint.example.org/token";
+const LOCAL_ISSUER: &str = "http://127.0.0.1:18081";
+const LOCAL_ASSERTION_AUDIENCE: &str = "http://127.0.0.1:18081/token";
+const EVIDENCE_AUDIENCE: &str = "evidence.example.org";
+
+/// The claim names shared by the two configuration documents. Evidence reads
+/// exactly these, and Mint writes exactly these.
+const PRINCIPAL_CLAIM: &str = "sub";
+const REQUESTER_TAGS_CLAIM: &str = "evidence_tags";
+const EVIDENCE_AUDIENCE_CLAIM: &str = "evidence_audience";
+const GRANT_ID_CLAIM: &str = "evidence_grant_id";
+const GRANT_AUTHORITY_CLAIM: &str = "evidence_authority";
+
+/// Deterministic Ed25519 material, so a test can hold several distinct
+/// identities and know which one signed what.
+fn key_pair(seed: u8) -> (PrivateJwk, Value, Value) {
+    let seed_bytes = [seed; 32];
+    let signing = ed25519_dalek::SigningKey::from_bytes(&seed_bytes);
+    let x = URL_SAFE_NO_PAD.encode(signing.verifying_key().to_bytes());
+    let d = URL_SAFE_NO_PAD.encode(seed_bytes);
+    let kid = format!("key-{seed}");
+    let public = json!({"kty": "OKP", "crv": "Ed25519", "kid": kid, "alg": "EdDSA", "x": x});
+    let private_document =
+        json!({"kty": "OKP", "crv": "Ed25519", "kid": kid, "alg": "EdDSA", "x": x, "d": d});
+    let private = PrivateJwk::parse(&private_document.to_string()).expect("private JWK parses");
+    (private, public, private_document)
+}
+
+struct Deployment {
+    /// Held so the directory outlives the service that reads from it.
+    _directory: tempfile::TempDir,
+    service: Arc<MintService>,
+}
+
+/// Write a complete Mint deployment to disk and load it exactly as the binary
+/// would, including the owner-only permission requirement on the signing key.
+async fn deployment() -> Deployment {
+    deployment_with_transport(None, ISSUER, 0, ASSERTION_AUDIENCE).await
+}
+
+async fn supervised_local_development_deployment() -> Deployment {
+    deployment_with_transport(
+        Some("supervised-local-development"),
+        LOCAL_ISSUER,
+        18081,
+        LOCAL_ASSERTION_AUDIENCE,
+    )
+    .await
+}
+
+async fn deployment_with_transport(
+    validation_mode: Option<&str>,
+    issuer: &str,
+    listener_port: u16,
+    assertion_audience: &str,
+) -> Deployment {
+    let directory = tempfile::tempdir().expect("temp dir");
+    let root = directory.path();
+    fs::create_dir(root.join("secrets")).expect("create secrets directory");
+    fs::create_dir(root.join("clients")).expect("create clients directory");
+
+    let (_, _, signing_document) = key_pair(9);
+    let signing_path = root.join("secrets/signing.jwk");
+    fs::write(&signing_path, signing_document.to_string()).expect("write signing key");
+    fs::set_permissions(&signing_path, fs::Permissions::from_mode(0o600))
+        .expect("restrict signing key");
+    let audit_key_path = root.join("secrets/audit-hmac-key");
+    fs::write(&audit_key_path, AUDIT_HASH_KEY).expect("write audit key");
+    fs::set_permissions(&audit_key_path, fs::Permissions::from_mode(0o600))
+        .expect("restrict audit key");
+
+    let (_, health_public, _) = key_pair(1);
+    write_client(
+        root,
+        "health-ministry",
+        &health_public,
+        Some(("grant-7", "statute-12")),
+    );
+    let (_, statistics_public, _) = key_pair(2);
+    write_client(root, "statistics-office", &statistics_public, None);
+
+    let config_path = root.join("mint.yaml");
+    let validation_mode = validation_mode
+        .map(|mode| format!("validationMode: {mode}\n"))
+        .unwrap_or_default();
+    fs::write(
+        &config_path,
+        format!(
+            r#"
+version: 1
+{validation_mode}issuer: {issuer}
+listener: {{address: 127.0.0.1, port: {listener_port}}}
+signing:
+  algorithm: EdDSA
+  activeKeyId: key-9
+  activeKeyFile: secrets/signing.jwk
+audit:
+  path: audit/mint.jsonl
+  maximumFileBytes: 1073741824
+  hashKeyFile: secrets/audit-hmac-key
+  hashKeyVersion: 1
+accessTokens:
+  audiences: [{EVIDENCE_AUDIENCE}]
+  lifetimeSeconds: 300
+  claims:
+    principal: {PRINCIPAL_CLAIM}
+    requesterTags: {REQUESTER_TAGS_CLAIM}
+    evidenceAudience: {EVIDENCE_AUDIENCE_CLAIM}
+    grantId: {GRANT_ID_CLAIM}
+    grantAuthority: {GRANT_AUTHORITY_CLAIM}
+clientAssertion:
+  audience: {assertion_audience}
+  algorithms: [EdDSA]
+clients:
+  directory: clients
+"#
+        ),
+    )
+    .expect("write config");
+
+    let config = MintConfig::load(&config_path).expect("the deployment configuration is valid");
+    let service = Arc::new(
+        MintService::load(config)
+            .await
+            .expect("the deployment loads"),
+    );
+    Deployment {
+        _directory: directory,
+        service,
+    }
+}
+
+fn write_client(root: &Path, client_id: &str, public: &Value, grant: Option<(&str, &str)>) {
+    let mut document = format!(
+        "clientId: {client_id}\nprincipal: urn:example:{client_id}\nevidenceAudience: https://{client_id}.example.org\nrequesterTags: [{client_id}]\nkeys: [{public}]\n"
+    );
+    if let Some((id, authority)) = grant {
+        document.push_str(&format!("grant: {{id: {id}, authority: {authority}}}\n"));
+    }
+    fs::write(root.join(format!("clients/{client_id}.yaml")), document)
+        .expect("write client registration");
+}
+
+fn sign_assertion(private: &PrivateJwk, claims: &Value) -> String {
+    let kid = private.kid.clone().expect("the test key has a kid");
+    let header = json!({"alg": "EdDSA", "typ": "JWT", "kid": kid});
+    let encode = |value: &Value| {
+        URL_SAFE_NO_PAD.encode(serde_json::to_vec(value).expect("value serializes"))
+    };
+    let signing_input = format!("{}.{}", encode(&header), encode(claims));
+    let signature =
+        registry_platform_crypto::sign(signing_input.as_bytes(), private).expect("the key signs");
+    format!("{signing_input}.{}", URL_SAFE_NO_PAD.encode(signature))
+}
+
+fn assertion_claims(client_id: &str, jti: &str) -> Value {
+    assertion_claims_for_audience(client_id, jti, ASSERTION_AUDIENCE)
+}
+
+fn assertion_claims_for_audience(client_id: &str, jti: &str, audience: &str) -> Value {
+    let now = time::OffsetDateTime::now_utc().unix_timestamp();
+    json!({
+        "iss": client_id,
+        "sub": client_id,
+        "aud": audience,
+        "iat": now,
+        "exp": now + 120,
+        "jti": jti,
+    })
+}
+
+fn token_form(assertion: &str) -> Vec<(String, String)> {
+    vec![
+        (
+            "grant_type".to_owned(),
+            GRANT_TYPE_CLIENT_CREDENTIALS.to_owned(),
+        ),
+        (
+            "client_assertion_type".to_owned(),
+            CLIENT_ASSERTION_TYPE.to_owned(),
+        ),
+        ("client_assertion".to_owned(), assertion.to_owned()),
+    ]
+}
+
+/// Build the Evidence authenticator the way `Authenticator::from_config` does,
+/// but over the key set Mint actually published rather than an HTTPS fetch.
+fn evidence_authenticator(jwks: &Value) -> Authenticator {
+    evidence_authenticator_for_issuer(jwks, ISSUER)
+}
+
+fn evidence_authenticator_for_issuer(jwks: &Value, issuer: &str) -> Authenticator {
+    let key_set: jsonwebtoken::jwk::JwkSet =
+        serde_json::from_value(jwks.clone()).expect("Mint publishes a parsable JWK set");
+    let verifier_config = TokenVerifierConfig::access_token_profile(
+        issuer.to_owned(),
+        vec![EVIDENCE_AUDIENCE.to_owned()],
+        vec![jsonwebtoken::Algorithm::EdDSA],
+        vec!["at+jwt".to_owned()],
+    );
+    let fetcher = Arc::new(JwksFetcher::new_static(
+        key_set,
+        JwksFetcherConfig::defaults(),
+    ));
+    Authenticator::new(
+        Arc::new(TokenVerifier::new(verifier_config, fetcher)),
+        AuthenticationClaimsConfig {
+            principal_claim: PRINCIPAL_CLAIM.to_owned(),
+            requester_tags_claim: REQUESTER_TAGS_CLAIM.to_owned(),
+            evidence_audience_claim: EVIDENCE_AUDIENCE_CLAIM.to_owned(),
+            grant_id_claim: GRANT_ID_CLAIM.to_owned(),
+            grant_authority_claim: GRANT_AUTHORITY_CLAIM.to_owned(),
+            actor_claim: None,
+        },
+    )
+}
+
+#[tokio::test]
+async fn a_client_signing_with_its_own_key_receives_a_token_evidence_accepts() {
+    let deployment = deployment().await;
+    let http = TestServer::new(build_app(Arc::clone(&deployment.service)));
+
+    let jwks = http.get("/.well-known/jwks.json").await;
+    jwks.assert_status_ok();
+    assert_eq!(jwks.header("content-type"), "application/jwk-set+json");
+    let published = jwks.json::<Value>();
+
+    let (private, _, _) = key_pair(1);
+    let assertion = sign_assertion(&private, &assertion_claims("health-ministry", "jti-1"));
+    let response = http.post("/token").form(&token_form(&assertion)).await;
+    response.assert_status_ok();
+    // RFC 6749 section 5.1: a token response must never be cached.
+    assert_eq!(response.header("cache-control"), "no-store");
+    let body = response.json::<Value>();
+    assert_eq!(body["token_type"], json!("Bearer"));
+    assert_eq!(body["expires_in"], json!(300));
+    let access_token = body["access_token"]
+        .as_str()
+        .expect("the response carries an access token")
+        .to_owned();
+
+    let context = evidence_authenticator(&published)
+        .authenticate(&access_token)
+        .await
+        .expect("Evidence accepts a token Mint issued");
+
+    // Every one of these came from the server-side registry, not the assertion.
+    assert_eq!(context.principal(), "urn:example:health-ministry");
+    assert_eq!(context.requester_tags(), ["health-ministry"]);
+    assert_eq!(
+        context.evidence_audience(),
+        "https://health-ministry.example.org"
+    );
+    assert_eq!(context.grant_id(), Some("grant-7"));
+    assert_eq!(context.grant_authority(), Some("statute-12"));
+    assert_eq!(context.actor(), None);
+}
+
+#[tokio::test]
+async fn supervised_local_development_tokens_remain_evidence_compatible() {
+    let deployment = supervised_local_development_deployment().await;
+    let http = TestServer::new(build_app(Arc::clone(&deployment.service)));
+    let published = http.get("/.well-known/jwks.json").await.json::<Value>();
+
+    let (private, _, _) = key_pair(1);
+    let claims = assertion_claims_for_audience(
+        "health-ministry",
+        "jti-supervised-local",
+        LOCAL_ASSERTION_AUDIENCE,
+    );
+    let assertion = sign_assertion(&private, &claims);
+    let response = http.post("/token").form(&token_form(&assertion)).await;
+    response.assert_status_ok();
+    let access_token = response.json::<Value>()["access_token"]
+        .as_str()
+        .expect("the response carries an access token")
+        .to_owned();
+
+    let context = evidence_authenticator_for_issuer(&published, LOCAL_ISSUER)
+        .authenticate(&access_token)
+        .await
+        .expect("Evidence accepts a token from the supervised local Mint mode");
+    assert_eq!(context.principal(), "urn:example:health-ministry");
+    assert_eq!(context.requester_tags(), ["health-ministry"]);
+}
+
+#[tokio::test]
+async fn evidence_fetches_keys_from_a_real_supervised_local_mint() {
+    // Hold the OS allocation while the matching deployment is authored and
+    // loaded. Release it only immediately before public `serve` binds it.
+    let reservation =
+        std::net::TcpListener::bind(("127.0.0.1", 0)).expect("reserve a loopback port");
+    let port = reservation
+        .local_addr()
+        .expect("read reserved address")
+        .port();
+    let issuer = format!("http://127.0.0.1:{port}");
+    let token_endpoint = format!("{issuer}/token");
+    let jwks_uri = format!("{issuer}/.well-known/jwks.json");
+    let deployment = deployment_with_transport(
+        Some("supervised-local-development"),
+        &issuer,
+        port,
+        &token_endpoint,
+    )
+    .await;
+
+    let (shutdown_tx, shutdown_rx) = tokio::sync::oneshot::channel();
+    let service = Arc::clone(&deployment.service);
+    drop(reservation);
+    let server = tokio::spawn(async move {
+        serve(service, async {
+            let _ = shutdown_rx.await;
+        })
+        .await
+    });
+
+    // Keep every fallible boundary inside this result so Mint is asked to shut
+    // down even when the real HTTP exchange or verification fails.
+    let proof: Result<_, Box<dyn Error>> = async {
+        let client = reqwest::Client::builder()
+            .no_proxy()
+            .timeout(Duration::from_secs(1))
+            .build()?;
+        tokio::time::timeout(Duration::from_secs(5), async {
+            loop {
+                if server.is_finished() {
+                    return Err(std::io::Error::other(
+                        "Mint stopped before its readiness endpoint responded",
+                    ));
+                }
+                if client
+                    .get(format!("{issuer}/ready"))
+                    .send()
+                    .await
+                    .is_ok_and(|response| response.status().is_success())
+                {
+                    return Ok(());
+                }
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+        })
+        .await??;
+
+        let (private, _, _) = key_pair(1);
+        let claims = assertion_claims_for_audience(
+            "health-ministry",
+            "jti-real-supervised-local",
+            &token_endpoint,
+        );
+        let assertion = sign_assertion(&private, &claims);
+        let response = client
+            .post(&token_endpoint)
+            .form(&token_form(&assertion))
+            .send()
+            .await?;
+        if !response.status().is_success() {
+            return Err(std::io::Error::other(format!(
+                "Mint token endpoint returned {}",
+                response.status()
+            ))
+            .into());
+        }
+        let body = response.json::<Value>().await?;
+        let access_token = body["access_token"]
+            .as_str()
+            .ok_or_else(|| std::io::Error::other("token response has no access token"))?;
+
+        let authentication = AuthenticationConfig {
+            kind: AuthenticationKind::OidcAccessToken,
+            issuer: issuer.clone(),
+            audiences: vec![EVIDENCE_AUDIENCE.to_owned()],
+            token_types: vec![AccessTokenType::AtJwt],
+            algorithms: vec![AccessTokenAlgorithm::EdDSA],
+            jwks_uri,
+            principal_claim: PRINCIPAL_CLAIM.to_owned(),
+            requester_tags_claim: REQUESTER_TAGS_CLAIM.to_owned(),
+            evidence_audience_claim: EVIDENCE_AUDIENCE_CLAIM.to_owned(),
+            grant_id_claim: GRANT_ID_CLAIM.to_owned(),
+            grant_authority_claim: GRANT_AUTHORITY_CLAIM.to_owned(),
+            actor_claim: None,
+        };
+        Authenticator::from_config(&authentication, AssuranceProfile::Local)
+            .authenticate(access_token)
+            .await
+            .map_err(Into::into)
+    }
+    .await;
+
+    let _ = shutdown_tx.send(());
+    tokio::time::timeout(Duration::from_secs(5), server)
+        .await
+        .expect("Mint shuts down within the grace period")
+        .expect("Mint server task joins")
+        .expect("Mint shuts down cleanly");
+
+    let context = proof.expect("the real local Mint and Evidence boundary is compatible");
+    assert_eq!(context.principal(), "urn:example:health-ministry");
+    assert_eq!(context.requester_tags(), ["health-ministry"]);
+    assert_eq!(
+        context.claim_path("iss"),
+        Some(&Value::String(issuer.clone()))
+    );
+    assert_eq!(
+        context.claim_path("aud"),
+        Some(&Value::String(EVIDENCE_AUDIENCE.to_owned()))
+    );
+    assert_eq!(
+        context.evidence_audience(),
+        "https://health-ministry.example.org"
+    );
+    assert_eq!(context.grant_id(), Some("grant-7"));
+    assert_eq!(context.grant_authority(), Some("statute-12"));
+    assert_eq!(context.actor(), None);
+}
+
+#[tokio::test]
+async fn a_registered_client_cannot_borrow_another_clients_authority() {
+    let deployment = deployment().await;
+    let http = TestServer::new(build_app(Arc::clone(&deployment.service)));
+
+    // The health ministry's own key, but claiming to be the statistics office.
+    let (health_private, _, _) = key_pair(1);
+    let forged = sign_assertion(
+        &health_private,
+        &assertion_claims("statistics-office", "jti-forged"),
+    );
+    let response = http.post("/token").form(&token_form(&forged)).await;
+
+    assert_eq!(response.status_code(), 401);
+    // The public error never distinguishes an unknown client from a bad
+    // signature, so it cannot be used to enumerate the registry.
+    assert_eq!(response.json::<Value>(), json!({"error": "invalid_client"}));
+
+    let unknown = sign_assertion(
+        &health_private,
+        &assertion_claims("no-such-client", "jti-x"),
+    );
+    let response = http.post("/token").form(&token_form(&unknown)).await;
+    assert_eq!(response.status_code(), 401);
+    assert_eq!(response.json::<Value>(), json!({"error": "invalid_client"}));
+}
+
+#[tokio::test]
+async fn an_assertion_cannot_be_presented_twice() {
+    let deployment = deployment().await;
+    let http = TestServer::new(build_app(Arc::clone(&deployment.service)));
+
+    let (private, _, _) = key_pair(2);
+    let assertion = sign_assertion(&private, &assertion_claims("statistics-office", "jti-once"));
+
+    let first = http.post("/token").form(&token_form(&assertion)).await;
+    first.assert_status_ok();
+
+    let replayed = http.post("/token").form(&token_form(&assertion)).await;
+    assert_eq!(replayed.status_code(), 401);
+    assert_eq!(replayed.json::<Value>(), json!({"error": "invalid_client"}));
+}
+
+#[tokio::test]
+async fn a_client_without_a_registered_grant_receives_no_grant_claims() {
+    let deployment = deployment().await;
+    let http = TestServer::new(build_app(Arc::clone(&deployment.service)));
+    let published = http.get("/.well-known/jwks.json").await.json::<Value>();
+
+    let (private, _, _) = key_pair(2);
+    let assertion = sign_assertion(&private, &assertion_claims("statistics-office", "jti-2"));
+    let response = http.post("/token").form(&token_form(&assertion)).await;
+    response.assert_status_ok();
+    let access_token = response.json::<Value>()["access_token"]
+        .as_str()
+        .expect("the response carries an access token")
+        .to_owned();
+
+    let context = evidence_authenticator(&published)
+        .authenticate(&access_token)
+        .await
+        .expect("Evidence accepts the token");
+    assert_eq!(context.principal(), "urn:example:statistics-office");
+    assert_eq!(context.grant_id(), None);
+    assert_eq!(context.grant_authority(), None);
+}
+
+#[tokio::test]
+async fn the_published_metadata_points_at_the_endpoints_that_exist() {
+    let deployment = deployment().await;
+    let http = TestServer::new(build_app(Arc::clone(&deployment.service)));
+
+    let metadata = http.get("/.well-known/oauth-authorization-server").await;
+    metadata.assert_status_ok();
+    let document = metadata.json::<Value>();
+    assert_eq!(document["issuer"], json!(ISSUER));
+    assert_eq!(document["token_endpoint"], json!(ASSERTION_AUDIENCE));
+    assert_eq!(
+        document["jwks_uri"],
+        json!(format!("{ISSUER}/.well-known/jwks.json"))
+    );
+    assert_eq!(
+        document["token_endpoint_auth_methods_supported"],
+        json!(["private_key_jwt"])
+    );
+
+    // The metadata must describe routes this router actually serves.
+    http.get("/.well-known/jwks.json").await.assert_status_ok();
+    let ready = http.get("/ready").await;
+    ready.assert_status_ok();
+}
+
+#[tokio::test]
+async fn the_token_endpoint_refuses_anything_but_the_supported_grant() {
+    let deployment = deployment().await;
+    let http = TestServer::new(build_app(Arc::clone(&deployment.service)));
+
+    let (private, _, _) = key_pair(1);
+    let assertion = sign_assertion(&private, &assertion_claims("health-ministry", "jti-grant"));
+
+    let mut form = token_form(&assertion);
+    form[0].1 = "password".to_owned();
+    let response = http.post("/token").form(&form).await;
+    assert_eq!(response.status_code(), 400);
+    assert_eq!(
+        response.json::<Value>(),
+        json!({"error": "unsupported_grant_type"})
+    );
+
+    let mut form = token_form(&assertion);
+    form[1].1 = "urn:example:something-else".to_owned();
+    let response = http.post("/token").form(&form).await;
+    assert_eq!(response.status_code(), 400);
+    assert_eq!(
+        response.json::<Value>(),
+        json!({"error": "invalid_request"})
+    );
+
+    // A bearer-style secret is not an accepted authentication method.
+    let response = http
+        .post("/token")
+        .form(&vec![(
+            "grant_type".to_owned(),
+            GRANT_TYPE_CLIENT_CREDENTIALS.to_owned(),
+        )])
+        .await;
+    assert_eq!(response.status_code(), 400);
+    assert_eq!(
+        response.json::<Value>(),
+        json!({"error": "invalid_request"})
+    );
+}
diff --git a/crates/registry-mint/tests/token_cli.rs b/crates/registry-mint/tests/token_cli.rs
new file mode 100644
index 000000000..0acaee19e
--- /dev/null
+++ b/crates/registry-mint/tests/token_cli.rs
@@ -0,0 +1,488 @@
+//! `mint token` against a real `mint serve`, as two processes.
+//!
+//! The point of the subcommand is that it is an ordinary client: it proves who
+//! it is and the endpoint decides. Testing it at the process boundary is what
+//! shows that. It also pins the output contract the subcommand exists for, that
+//! stdout carries the access token and nothing else, which no in-process test
+//! of the builder could observe.
+
+use std::{
+    fs,
+    io::ErrorKind,
+    net::{TcpListener, TcpStream},
+    os::unix::fs::PermissionsExt,
+    path::{Path, PathBuf},
+    process::{Child, Command, Output, Stdio},
+    time::{Duration, Instant},
+};
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use serde_json::{json, Value};
+
+const ISSUER: &str = "https://mint.example.org";
+const ASSERTION_AUDIENCE: &str = "https://mint.example.org/token";
+const ACTOR: &str = "urn:example:agent:scheduler";
+
+/// Deterministic Ed25519 material, so a test knows which identity signed what.
+fn key_pair(seed: u8) -> (Value, Value) {
+    let seed_bytes = [seed; 32];
+    let signing = ed25519_dalek::SigningKey::from_bytes(&seed_bytes);
+    let x = URL_SAFE_NO_PAD.encode(signing.verifying_key().to_bytes());
+    let kid = format!("key-{seed}");
+    (
+        json!({"kty": "OKP", "crv": "Ed25519", "kid": kid, "alg": "EdDSA", "x": x}),
+        json!({"kty": "OKP", "crv": "Ed25519", "kid": kid, "alg": "EdDSA", "x": x,
+               "d": URL_SAFE_NO_PAD.encode(seed_bytes)}),
+    )
+}
+
+/// A running `mint serve`, killed when the test drops it however it ends.
+struct Server {
+    _directory: tempfile::TempDir,
+    child: Child,
+    port: u16,
+    root: PathBuf,
+    config: PathBuf,
+}
+
+impl Drop for Server {
+    fn drop(&mut self) {
+        let _ = self.child.kill();
+        let _ = self.child.wait();
+    }
+}
+
+impl Server {
+    fn token_url(&self) -> String {
+        format!("http://127.0.0.1:{}/token", self.port)
+    }
+
+    fn caller_key(&self, client_id: &str) -> PathBuf {
+        self.root.join(format!("{client_id}.jwk"))
+    }
+}
+
+fn write_owner_only(path: &Path, contents: &str) {
+    fs::write(path, contents).expect("write secret");
+    fs::set_permissions(path, fs::Permissions::from_mode(0o600)).expect("restrict secret");
+}
+
+/// Write a deployment, start the binary on it, and wait for the listener.
+fn server() -> Server {
+    let directory = tempfile::tempdir().expect("temp dir");
+    let root = directory.path().to_path_buf();
+    fs::create_dir(root.join("secrets")).expect("create secrets directory");
+    fs::create_dir(root.join("clients")).expect("create clients directory");
+
+    let (_, signing_private) = key_pair(9);
+    write_owner_only(
+        &root.join("secrets/signing.jwk"),
+        &signing_private.to_string(),
+    );
+    write_owner_only(
+        &root.join("secrets/audit-hmac-key"),
+        "0123456789abcdef0123456789abcdef",
+    );
+
+    // `listener.port: 0` would leave the test unable to find the port, so an
+    // ephemeral one is reserved and released. The window is a test-only risk.
+    let port = TcpListener::bind("127.0.0.1:0")
+        .expect("reserve a port")
+        .local_addr()
+        .expect("the reserved port")
+        .port();
+
+    let (scheduler_public, scheduler_private) = key_pair(1);
+    write_owner_only(&root.join("scheduler.jwk"), &scheduler_private.to_string());
+    fs::write(
+        root.join("clients/scheduler.yaml"),
+        format!(
+            "clientId: scheduler
+principal: urn:example:principal:scheduler
+evidenceAudience: https://scheduler.example.org
+requesterTags: [scheduler]
+keys: [{scheduler_public}]
+delegation:
+  actors: [{ACTOR}]
+  subjectClaims:
+    given_name: identity.given_name
+    birth_date: identity.birth_date
+"
+        ),
+    )
+    .expect("write scheduler registration");
+
+    let (reporter_public, reporter_private) = key_pair(2);
+    write_owner_only(&root.join("reporter.jwk"), &reporter_private.to_string());
+    fs::write(
+        root.join("clients/reporter.yaml"),
+        format!(
+            "clientId: reporter
+principal: urn:example:principal:reporter
+evidenceAudience: https://reporter.example.org
+requesterTags: [reporter]
+keys: [{reporter_public}]
+"
+        ),
+    )
+    .expect("write reporter registration");
+
+    let config = root.join("mint.yaml");
+    fs::write(
+        &config,
+        format!(
+            "version: 1
+issuer: {ISSUER}
+listener: {{address: 127.0.0.1, port: {port}}}
+signing:
+  algorithm: EdDSA
+  activeKeyId: key-9
+  activeKeyFile: secrets/signing.jwk
+audit:
+  path: audit/mint.jsonl
+  maximumFileBytes: 1073741824
+  hashKeyFile: secrets/audit-hmac-key
+  hashKeyVersion: 1
+accessTokens:
+  audiences: [evidence.example.org]
+  lifetimeSeconds: 300
+  claims:
+    principal: sub
+    requesterTags: evidence_tags
+    evidenceAudience: evidence_audience
+    grantId: evidence_grant_id
+    grantAuthority: evidence_authority
+    actor: evidence_actor
+clientAssertion:
+  audience: {ASSERTION_AUDIENCE}
+  algorithms: [EdDSA]
+clients:
+  directory: clients
+"
+        ),
+    )
+    .expect("write config");
+
+    let child = Command::new(env!("CARGO_BIN_EXE_mint"))
+        .arg("serve")
+        .arg("--config")
+        .arg(&config)
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .spawn()
+        .expect("the mint binary starts");
+
+    let server = Server {
+        _directory: directory,
+        child,
+        port,
+        root,
+        config,
+    };
+    wait_for_listener(port);
+    server
+}
+
+fn wait_for_listener(port: u16) {
+    let deadline = Instant::now() + Duration::from_secs(20);
+    loop {
+        match TcpStream::connect(("127.0.0.1", port)) {
+            Ok(_) => return,
+            Err(error) if error.kind() == ErrorKind::ConnectionRefused => {
+                assert!(
+                    Instant::now() < deadline,
+                    "the token endpoint never accepted"
+                );
+                std::thread::sleep(Duration::from_millis(25));
+            }
+            Err(error) => panic!("the token endpoint could not be reached: {error}"),
+        }
+    }
+}
+
+fn mint_token(server: &Server, client_id: &str, extra: &[&str]) -> Output {
+    let mut command = Command::new(env!("CARGO_BIN_EXE_mint"));
+    command
+        .arg("token")
+        .arg("--url")
+        .arg(server.token_url())
+        // The endpoint is reached over loopback but its configured assertion
+        // audience is its public URL, which is the deployment shape behind a
+        // TLS terminator and the reason the flag exists.
+        .arg("--audience")
+        .arg(ASSERTION_AUDIENCE)
+        .arg("--client-id")
+        .arg(client_id)
+        .arg("--key")
+        .arg(server.caller_key(client_id))
+        .args(extra);
+    command.output().expect("the mint binary runs")
+}
+
+fn claims_of(token: &str) -> Value {
+    let segments: Vec<&str> = token.split('.').collect();
+    assert_eq!(segments.len(), 3, "an access token has three segments");
+    serde_json::from_slice(&URL_SAFE_NO_PAD.decode(segments[1]).expect("base64url"))
+        .expect("claims parse")
+}
+
+fn stdout_of(output: &Output) -> String {
+    assert!(
+        output.status.success(),
+        "the command failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    String::from_utf8(output.stdout.clone()).expect("stdout is UTF-8")
+}
+
+#[test]
+fn the_subcommand_obtains_a_token_the_endpoint_agreed_to_issue() {
+    let server = server();
+    let output = mint_token(&server, "reporter", &[]);
+    let stdout = stdout_of(&output);
+
+    // Exactly one line, so `TOKEN=$(mint token ...)` is the whole usage.
+    assert_eq!(stdout.lines().count(), 1, "stdout was: {stdout:?}");
+    let claims = claims_of(stdout.trim());
+
+    assert_eq!(claims["iss"], json!(ISSUER));
+    assert_eq!(claims["sub"], json!("urn:example:principal:reporter"));
+    assert_eq!(claims["client_id"], json!("reporter"));
+    assert_eq!(claims["evidence_tags"], json!(["reporter"]));
+    assert_eq!(
+        claims["evidence_audience"],
+        json!("https://reporter.example.org")
+    );
+    // The authority came from the registry, not from anything the caller sent.
+    assert!(claims.get("evidence_actor").is_none());
+
+    let verification = Command::new(env!("CARGO_BIN_EXE_mint"))
+        .arg("verify-audit")
+        .arg("--config")
+        .arg(&server.config)
+        .output()
+        .expect("the verifier runs");
+    assert!(verification.status.success());
+    let verification = String::from_utf8_lossy(&verification.stdout);
+    assert!(verification.contains("active-segment: not verified"));
+}
+
+#[test]
+fn the_configuration_check_runs_against_a_deployment_that_is_already_serving() {
+    // The whole point of `mint check` is to read a configuration before
+    // restarting the service that is running on it. One writer holds the audit
+    // chain for the life of the serving process, so a check that took the
+    // writer would report every live deployment as broken.
+    let server = server();
+    let output = Command::new(env!("CARGO_BIN_EXE_mint"))
+        .arg("check")
+        .arg("--config")
+        .arg(&server.config)
+        .output()
+        .expect("the checker runs");
+
+    assert!(
+        output.status.success(),
+        "check failed\nstdout:\n{}\nstderr:\n{}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+}
+
+#[test]
+fn a_delegated_token_carries_the_actor_and_the_subject_from_the_registry_paths() {
+    let server = server();
+    let subject = server.root.join("subject.json");
+    fs::write(
+        &subject,
+        json!({"given_name": "Amara", "birth_date": "1998-04-02"}).to_string(),
+    )
+    .expect("write subject file");
+
+    let output = mint_token(
+        &server,
+        "scheduler",
+        &[
+            "--actor",
+            ACTOR,
+            "--subject-file",
+            subject.to_str().expect("a UTF-8 path"),
+        ],
+    );
+    let claims = claims_of(stdout_of(&output).trim());
+
+    assert_eq!(claims["evidence_actor"], json!(ACTOR));
+    assert_eq!(
+        claims["identity"],
+        json!({"given_name": "Amara", "birth_date": "1998-04-02"}),
+        "the claim paths are the registry's, not the request's"
+    );
+}
+
+/// The subcommand authenticates; it does not decide. An actor the registration
+/// does not permit must be refused by the endpoint, with no token printed.
+#[test]
+fn an_unregistered_actor_is_refused_by_the_endpoint() {
+    let server = server();
+    let subject = server.root.join("other-subject.json");
+    fs::write(
+        &subject,
+        json!({"given_name": "Amara", "birth_date": "1998-04-02"}).to_string(),
+    )
+    .expect("write subject file");
+
+    let output = mint_token(
+        &server,
+        "scheduler",
+        &[
+            "--actor",
+            "urn:example:agent:not-registered",
+            "--subject-file",
+            subject.to_str().expect("a UTF-8 path"),
+        ],
+    );
+
+    assert!(!output.status.success());
+    assert!(
+        output.stdout.is_empty(),
+        "a refusal must print no token: {:?}",
+        String::from_utf8_lossy(&output.stdout)
+    );
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        stderr.contains("invalid_client"),
+        "the refusal should be reported: {stderr}"
+    );
+}
+
+/// A refused request must not put the signed assertion back on the terminal.
+///
+/// `--url` and `--audience` are separate flags precisely so the assertion can be
+/// audience-bound to the public endpoint while the request travels over
+/// loopback. Point `--url` at the wrong host and the assertion, still valid at
+/// the real Mint until it expires, is now that host's to echo. Repeating an
+/// arbitrary body into stderr writes it to the operator's logs and scrollback
+/// too, which is a second place to lose it from.
+#[test]
+fn a_refusal_does_not_echo_the_signed_assertion_back() {
+    let listener = TcpListener::bind(("127.0.0.1", 0)).expect("bind an echoing endpoint");
+    let port = listener.local_addr().expect("a bound address").port();
+    let echo = std::thread::spawn(move || {
+        let (mut stream, _) = listener.accept().expect("accept the token request");
+        let mut request = Vec::new();
+        // The form is small and the client closes after it, so reading to the
+        // content length is not worth a parser here.
+        let mut buffer = [0u8; 8192];
+        loop {
+            let read = std::io::Read::read(&mut stream, &mut buffer).expect("read the request");
+            request.extend_from_slice(&buffer[..read]);
+            if read == 0 || request.windows(4).any(|window| window == b"\r\n\r\n") {
+                break;
+            }
+        }
+        let body = String::from_utf8_lossy(&request).into_owned();
+        let payload = json!({
+            "error": "invalid_request",
+            "error_description": "unrecognized request",
+            "received": body,
+        })
+        .to_string();
+        let response = format!(
+            "HTTP/1.1 400 Bad Request\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{payload}",
+            payload.len()
+        );
+        std::io::Write::write_all(&mut stream, response.as_bytes()).expect("write the refusal");
+        body
+    });
+
+    let server = server();
+    let mut command = Command::new(env!("CARGO_BIN_EXE_mint"));
+    command
+        .arg("token")
+        .arg("--url")
+        .arg(format!("http://127.0.0.1:{port}/token"))
+        .arg("--audience")
+        .arg(ASSERTION_AUDIENCE)
+        .arg("--client-id")
+        .arg("scheduler")
+        .arg("--key")
+        .arg(server.caller_key("scheduler"));
+    let output = command.output().expect("the mint binary runs");
+    let received = echo.join().expect("the echoing endpoint finished");
+
+    let assertion = received
+        .split("client_assertion=")
+        .nth(1)
+        .expect("the endpoint received an assertion")
+        .split('&')
+        .next()
+        .expect("the assertion is a form value")
+        .to_owned();
+    assert!(
+        assertion.len() > 64,
+        "the test needs a real assertion to look for: {assertion}"
+    );
+
+    assert!(!output.status.success());
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        !stderr.contains(&assertion),
+        "the refusal echoed the signed assertion back"
+    );
+    // The status and the OAuth error stay, because that is what tells an
+    // operator which endpoint refused and why.
+    assert!(
+        stderr.contains("400") && stderr.contains("invalid_request"),
+        "the refusal should still name the status and the error: {stderr}"
+    );
+}
+
+/// A subject file that is not a flat object of scalars is a caller mistake with
+/// an opaque server-side answer, so it is named locally instead.
+#[test]
+fn a_malformed_subject_file_is_refused_before_the_request() {
+    let server = server();
+    let subject = server.root.join("nested-subject.json");
+    fs::write(
+        &subject,
+        json!({"identity": {"given_name": "Amara"}}).to_string(),
+    )
+    .expect("write subject file");
+
+    let output = mint_token(
+        &server,
+        "scheduler",
+        &[
+            "--actor",
+            ACTOR,
+            "--subject-file",
+            subject.to_str().expect("a UTF-8 path"),
+        ],
+    );
+
+    assert!(!output.status.success());
+    assert!(output.stdout.is_empty());
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        stderr.contains("must be a scalar value"),
+        "the mistake should be named: {stderr}"
+    );
+}
+
+/// A key file anyone else can read is a key that should be assumed leaked.
+#[test]
+fn a_group_readable_client_key_is_refused() {
+    let server = server();
+    let key = server.caller_key("reporter");
+    fs::set_permissions(&key, fs::Permissions::from_mode(0o644)).expect("loosen the key file");
+
+    let output = mint_token(&server, "reporter", &[]);
+
+    assert!(!output.status.success());
+    assert!(output.stdout.is_empty());
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        stderr.contains("client key could not be read"),
+        "the refusal should name the key file: {stderr}"
+    );
+}
diff --git a/crates/registry-notary-client/Cargo.toml b/crates/registry-notary-client/Cargo.toml
deleted file mode 100644
index eda1ce25b..000000000
--- a/crates/registry-notary-client/Cargo.toml
+++ /dev/null
@@ -1,50 +0,0 @@
-[package]
-name = "registry-notary-client"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Registry Notary HTTP client and binding facade."
-readme = "README.md"
-repository.workspace = true
-publish = false
-
-[lints]
-workspace = true
-
-[features]
-default = ["rustls"]
-rustls = []
-native-tls = []
-oid4vci = ["dep:registry-platform-oid4vci"]
-federation = []
-json-facade = []
-test-support = []
-verifier = ["dep:base64", "dep:flate2", "dep:registry-platform-crypto", "dep:sha2"]
-
-[dependencies]
-async-trait.workspace = true
-base64 = { workspace = true, optional = true }
-flate2 = { version = "1", optional = true }
-registry-notary-core.workspace = true
-registry-platform-crypto = { workspace = true, optional = true }
-registry-platform-httputil.workspace = true
-registry-platform-oid4vci = { workspace = true, optional = true }
-reqwest.workspace = true
-secrecy.workspace = true
-serde.workspace = true
-serde_json.workspace = true
-sha2 = { workspace = true, optional = true }
-thiserror.workspace = true
-time.workspace = true
-tokio.workspace = true
-tracing.workspace = true
-
-[dev-dependencies]
-axum.workspace = true
-axum-test = { version = "20" }
-registry-platform-crypto.workspace = true
-registry-platform-sdjwt.workspace = true
-registry-notary-server = { workspace = true, features = ["registry-notary-cel"] }
-serde_norway.workspace = true
-tempfile = { version = "3" }
-tokio.workspace = true
diff --git a/crates/registry-notary-client/README.md b/crates/registry-notary-client/README.md
deleted file mode 100644
index 98247977d..000000000
--- a/crates/registry-notary-client/README.md
+++ /dev/null
@@ -1,138 +0,0 @@
-# registry-notary-client
-
-Typed Rust HTTP client for Registry Notary.
-
-Use this crate when Rust application code needs to call Registry Notary without
-reimplementing request shapes, purpose handling, route-specific retry,
-bounded-response reads, JWKS refresh behavior, or redacted error mapping.
-
-## Quick Start
-
-```rust
-use registry_notary_client::RegistryNotaryClient;
-
-let client = RegistryNotaryClient::builder("https://notary.example.gov")
-    .bearer_token("access-token")
-    .default_purpose("benefits_eligibility")
-    .user_agent("benefits-api/1.0")
-    .build()?;
-```
-
-Evaluate one target:
-
-```rust
-let response = client
-    .evaluate_target("Person")
-    .target_identifier("national_id", "person-1")
-    .target_identifier_issuer("civil_registry")
-    .relationship("self")
-    .claims(["person-is-alive"])
-    .disclosure("predicate")
-    .send()
-    .await?;
-
-if let Some(result) = response.body.first_result() {
-    println!("{} = {:?}", result.claim_id, result.satisfied);
-}
-```
-
-## Main API
-
-- `RegistryNotaryClient::builder(base_url)` creates a client.
-- `evaluate_target(target_type)` starts the ergonomic evaluation builder.
-- `evaluate_request`, `batch_evaluate_request`, `render_request`, and
-  `issue_credential_request` accept core wire request types. `render_request`
-  extracts `evaluation_id` into the route path before sending the body.
-- `health`, `ready`, `admin_reload`, `openapi_json`, `metrics`, `list_claims`,
-  `get_claim`, and `list_formats` cover operational, discovery, claim catalog,
-  and format routes.
-- `service_document`, `issuer_jwks`, `refresh_jwks`, and `raw_issuer_jwks`
-  cover discovery and key rotation workflows.
-- `credential_status` and `update_credential_status` cover minimal credential
-  lifecycle status.
-- `oid4vci_*` methods are available with the `oid4vci` feature.
-- `federation_evaluate_jws` is available with the `federation` feature.
-- `verify_sd_jwt_vc`, `verify_credential_response`, and
-  `verify_oid4vci_credential` are available with the `verifier` feature. These
-  methods are explicit and opt-in; response decoding never verifies
-  credentials implicitly.
-- `facade::NotaryClientHandle` is available with the `json-facade` feature for
-  binding authors.
-
-See [`docs/client-sdk-guide.md`](../../docs/client-sdk-guide.md) for examples in
-Rust, Python, and Node.js.
-
-## Features
-
-- `oid4vci`: OpenID4VCI endpoint helpers.
-- `federation`: delegated evaluation JWS submission.
-- `json-facade`: canonical wire-shape JSON facade.
-- `verifier`: explicit SD-JWT VC verification against trusted issuer JWKS.
-- `test-support`: test-only HTTP client override and loopback HTTP allowance.
-
-## Explicit SD-JWT VC Verification
-
-Enable the `verifier` feature to verify credential material after a caller has
-chosen the trust policy:
-
-```rust
-use registry_notary_client::{HolderBindingPolicy, VerifyOptions};
-
-let options = VerifyOptions::new("did:web:notary.example")
-    .expected_vct("https://credentials.example/vct/person-is-alive")
-    .holder_binding(HolderBindingPolicy::Required);
-
-let verified = client
-    .verify_credential_response(&credential.body, options)
-    .await?;
-```
-
-Verification resolves the JWS `kid` against the client's trusted issuer JWKS,
-uses the normal JWKS TTL cache, forces one refresh on `key.unknown`, and then
-stops. It checks the allowed algorithm list, header type, issuer, `vct`,
-`exp`/`nbf`/`iat` with bounded skew, disclosure digests, and required
-holder-binding confirmation. When an SD-JWT VC presentation includes a
-key-binding JWT, the verifier separates it from disclosures and verifies its
-holder proof signature against `cnf.jwk`. When required holder binding is paired
-with `VerifyOptions::key_binding_challenge`, the trailing key-binding JWT is
-mandatory and must match the expected audience and nonce. Verifier errors expose
-stable redacted codes such as `signature.invalid`, `key.unknown`,
-`algorithm.disallowed`, `claim.issuer_mismatch`, `claim.time_invalid`,
-`disclosure.digest_mismatch`, and `holder_binding.required`.
-
-Python and Node wrappers do not expose verifier wrappers in this first phase;
-use the Rust verifier or perform verification in application-specific wallet
-code.
-
-## Safety Contract
-
-The client:
-
-- rejects multiple auth modes at build time;
-- requires HTTPS for non-loopback hosts, with HTTP loopback allowed only in
-  debug or `test-support` builds;
-- disables redirects and ignores proxy environment variables;
-- bounds every response body;
-- returns successful response status in `NotaryResponse<T>`;
-- captures `X-Request-Id` before body decoding;
-- rejects `Idempotency-Key` on routes that do not honor it;
-- retries only GET routes and idempotent batch evaluation;
-- redacts raw Problem Details `detail`, compact credentials, holder proofs,
-  nonces, SD-JWT disclosures, token material, and credential response bodies
-  from `Debug`, `Display`, and portable errors.
-
-## Wire Contract
-
-Request types come from `registry-notary-core` where the server wire contract is
-shared. Batch evaluation uses `registry_notary_core::BatchEvaluateResponse`
-directly. Client-owned wrappers such as `Evaluation` and
-`CredentialIssueResponse` exist for ergonomic accessors or redacted formatting,
-not as compatibility workarounds.
-
-## Verification
-
-```bash
-cargo test -p registry-notary-client
-cargo test -p registry-notary-client --features json-facade,oid4vci,federation,verifier
-cargo doc -p registry-notary-client --no-deps --all-features
-```
diff --git a/crates/registry-notary-client/src/auth.rs b/crates/registry-notary-client/src/auth.rs
deleted file mode 100644
index a1a60abb7..000000000
--- a/crates/registry-notary-client/src/auth.rs
+++ /dev/null
@@ -1,81 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Authentication primitives for the Registry Notary client.
-
-use async_trait::async_trait;
-use secrecy::{ExposeSecret, SecretString};
-
-use crate::error::NotaryClientError;
-
-/// Static authentication material configured on a client.
-///
-/// `Debug` output redacts the underlying secret. The public builder exposes
-/// this through [`crate::NotaryClientBuilder::bearer_token`] and
-/// [`crate::NotaryClientBuilder::api_key`].
-#[derive(Clone)]
-pub enum Auth {
-    /// Send an `Authorization: Bearer ...` header.
-    Bearer(SecretString),
-    /// Send an `X-Api-Key` header.
-    ApiKey(SecretString),
-}
-
-impl std::fmt::Debug for Auth {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Bearer(_) => f.write_str("Bearer(<redacted>)"),
-            Self::ApiKey(_) => f.write_str("ApiKey(<redacted>)"),
-        }
-    }
-}
-
-/// One resolved authentication header for a single request.
-///
-/// Implementations of [`AuthProvider`] return this type when credentials are
-/// minted or refreshed dynamically. `Debug` and `Display` never print the
-/// secret value.
-#[derive(Clone)]
-pub enum AuthHeader {
-    /// A complete `Authorization` header value, for example `Bearer <token>`.
-    Authorization(SecretString),
-    /// An `X-Api-Key` header value.
-    ApiKey(SecretString),
-}
-
-impl std::fmt::Debug for AuthHeader {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Authorization(_) => f.write_str("Authorization(<redacted>)"),
-            Self::ApiKey(_) => f.write_str("ApiKey(<redacted>)"),
-        }
-    }
-}
-
-impl std::fmt::Display for AuthHeader {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.write_str("<redacted>")
-    }
-}
-
-impl Auth {
-    pub(crate) fn header(&self) -> AuthHeader {
-        match self {
-            Self::Bearer(token) => AuthHeader::Authorization(SecretString::from(format!(
-                "Bearer {}",
-                token.expose_secret()
-            ))),
-            Self::ApiKey(token) => AuthHeader::ApiKey(token.clone()),
-        }
-    }
-}
-
-#[async_trait]
-/// Dynamic per-request authentication provider.
-///
-/// Use this when a caller needs to refresh an access token, consult a secure
-/// credential store, or mint short-lived credentials before each request. The
-/// client awaits the provider before sending the request and still enforces the
-/// single-auth-mode rule at build time.
-pub trait AuthProvider: Send + Sync {
-    /// Return the authentication header to attach to the next request.
-    async fn auth_header(&self) -> Result<AuthHeader, NotaryClientError>;
-}
diff --git a/crates/registry-notary-client/src/client.rs b/crates/registry-notary-client/src/client.rs
deleted file mode 100644
index 6f2dca23c..000000000
--- a/crates/registry-notary-client/src/client.rs
+++ /dev/null
@@ -1,1403 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Typed Registry Notary HTTP client.
-
-use std::collections::BTreeMap;
-use std::sync::{Arc, Mutex};
-use std::time::{Duration, Instant};
-
-use registry_notary_core::{
-    BatchEvaluateRequest, ClaimRef, CredentialIssueRequest, EvaluateRequest, EvidenceEntity,
-    EvidenceIdentifier, EvidenceOnBehalfOf, EvidenceRelationship, RenderEvaluationRequest,
-    RenderRequest, RequestVariables, FORMAT_CLAIM_RESULT_JSON, MAX_BATCH_EVALUATION_MEMBERS_V1,
-};
-use registry_platform_httputil::read_bounded;
-use reqwest::{Method, StatusCode, Url};
-use secrecy::SecretString;
-use serde::de::DeserializeOwned;
-use serde::Serialize;
-
-use crate::auth::{Auth, AuthHeader, AuthProvider};
-use crate::error::{
-    parse_retry_after, NotaryClientBuildError, NotaryClientError, Oid4vciError, ProblemDetails,
-};
-use crate::headers;
-use crate::options::{RequestOptions, RetryPolicy};
-use crate::responses::{
-    AdminReloadResponse, CredentialIssueResponse, CredentialStatusResponse,
-    CredentialStatusUpdateRequest, EvaluateResponse, Evaluation, FormatsResponse, HealthResponse,
-    ListClaimsResponse, NotaryResponse, ReadinessResponse,
-};
-#[cfg(feature = "verifier")]
-use crate::verifier::{VerificationError, VerifiedCredential, VerifyOptions};
-
-const LIMIT_SMALL: u64 = 64 * 1024;
-const LIMIT_DISCOVERY: u64 = 2 * 1024 * 1024;
-const LIMIT_OPERATION: u64 = 8 * 1024 * 1024;
-const LIMIT_BATCH: u64 = 16 * 1024 * 1024;
-const JWKS_TTL: Duration = Duration::from_secs(10 * 60);
-
-#[derive(Clone)]
-enum AuthState {
-    Static(Auth),
-    Provider(Arc<dyn AuthProvider>),
-}
-
-impl std::fmt::Debug for AuthState {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Static(auth) => f.debug_tuple("Static").field(auth).finish(),
-            Self::Provider(_) => f.write_str("Provider(<redacted>)"),
-        }
-    }
-}
-
-/// Cloneable typed HTTP client for a Registry Notary service.
-///
-/// Construct with [`RegistryNotaryClient::builder`]. Clones share the same
-/// underlying `reqwest::Client` and JWKS cache.
-#[derive(Debug, Clone)]
-pub struct RegistryNotaryClient {
-    base_url: Url,
-    http: reqwest::Client,
-    auth: Option<AuthState>,
-    default_purpose: Option<String>,
-    retry_policy: RetryPolicy,
-    jwks_cache: Arc<Mutex<Option<CachedJwks>>>,
-}
-
-#[derive(Debug, Clone)]
-struct CachedJwks {
-    body: serde_json::Value,
-    expires_at: Instant,
-}
-
-/// Builder for [`RegistryNotaryClient`].
-///
-/// Exactly one authentication mode may be configured. The builder rejects
-/// non-HTTPS base URLs except HTTP loopback in debug or `test-support` builds.
-#[derive(Default)]
-pub struct NotaryClientBuilder {
-    base_url: Option<String>,
-    bearer_token: Option<SecretString>,
-    api_key: Option<SecretString>,
-    auth_provider: Option<Arc<dyn AuthProvider>>,
-    default_purpose: Option<String>,
-    timeout: Option<Duration>,
-    user_agent: Option<String>,
-    retry_policy: Option<RetryPolicy>,
-    #[cfg(any(test, feature = "test-support"))]
-    reqwest_client: Option<reqwest::Client>,
-}
-
-impl std::fmt::Debug for NotaryClientBuilder {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("NotaryClientBuilder")
-            .field("base_url", &self.base_url)
-            .field(
-                "bearer_token",
-                &self.bearer_token.as_ref().map(|_| "<redacted>"),
-            )
-            .field("api_key", &self.api_key.as_ref().map(|_| "<redacted>"))
-            .field(
-                "auth_provider",
-                &self.auth_provider.as_ref().map(|_| "<redacted>"),
-            )
-            .field("default_purpose", &self.default_purpose)
-            .field("timeout", &self.timeout)
-            .field("user_agent", &self.user_agent)
-            .field("retry_policy", &self.retry_policy)
-            .finish()
-    }
-}
-
-impl RegistryNotaryClient {
-    /// Start building a client for `base_url`.
-    ///
-    /// `base_url` may include a path prefix; route paths are joined under that
-    /// prefix.
-    #[must_use]
-    pub fn builder(base_url: impl Into<String>) -> NotaryClientBuilder {
-        NotaryClientBuilder {
-            base_url: Some(base_url.into()),
-            ..NotaryClientBuilder::default()
-        }
-    }
-
-    /// Fetch `GET /healthz`.
-    pub async fn health(&self) -> Result<NotaryResponse<HealthResponse>, NotaryClientError> {
-        self.get_json(
-            "/healthz",
-            RequestOptions::default(),
-            LIMIT_SMALL,
-            ErrorKind::Problem,
-        )
-        .await
-    }
-
-    /// Fetch `GET /ready`.
-    pub async fn ready(&self) -> Result<NotaryResponse<ReadinessResponse>, NotaryClientError> {
-        self.get_json(
-            "/ready",
-            RequestOptions::default(),
-            LIMIT_SMALL,
-            ErrorKind::Problem,
-        )
-        .await
-    }
-
-    /// Trigger `POST /admin/v1/reload`.
-    ///
-    /// Requires the server-side admin scope or equivalent API key.
-    pub async fn admin_reload(
-        &self,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<AdminReloadResponse>, NotaryClientError> {
-        self.post_json(
-            "/admin/v1/reload",
-            &serde_json::json!({}),
-            options,
-            LIMIT_SMALL,
-            RouteRetry::PostNoRetry,
-            ErrorKind::Problem,
-        )
-        .await
-    }
-
-    /// Fetch the generated OpenAPI document from `GET /openapi.json`.
-    pub async fn openapi_json(
-        &self,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<serde_json::Value>, NotaryClientError> {
-        self.get_json(
-            "/openapi.json",
-            options,
-            LIMIT_DISCOVERY,
-            ErrorKind::Problem,
-        )
-        .await
-    }
-
-    /// Fetch `GET /.well-known/evidence-service`.
-    pub async fn service_document(
-        &self,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<serde_json::Value>, NotaryClientError> {
-        self.get_json(
-            "/.well-known/evidence-service",
-            options,
-            LIMIT_DISCOVERY,
-            ErrorKind::Problem,
-        )
-        .await
-    }
-
-    /// Fetch and cache `GET /.well-known/evidence/jwks.json`.
-    ///
-    /// Calls without request options use a short in-process cache. Use
-    /// [`Self::refresh_jwks`] to force a refresh, or [`Self::raw_issuer_jwks`]
-    /// to fetch without updating the cache.
-    pub async fn issuer_jwks(
-        &self,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<serde_json::Value>, NotaryClientError> {
-        if options.is_empty() {
-            let cached = self
-                .jwks_cache
-                .lock()
-                .expect("jwks cache lock poisoned")
-                .as_ref()
-                .filter(|cached| cached.expires_at > Instant::now())
-                .map(|cached| cached.body.clone());
-            if let Some(body) = cached {
-                return Ok(NotaryResponse {
-                    body,
-                    status: StatusCode::OK,
-                    request_id: None,
-                    retry_after: None,
-                });
-            }
-        }
-        self.fetch_issuer_jwks(options).await
-    }
-
-    /// Force-refresh the evidence issuer JWKS cache.
-    pub async fn refresh_jwks(
-        &self,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<serde_json::Value>, NotaryClientError> {
-        self.fetch_issuer_jwks(options).await
-    }
-
-    /// Fetch Prometheus metrics from `GET /metrics`.
-    ///
-    /// Metrics are operational data and are returned as text.
-    pub async fn metrics(
-        &self,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<String>, NotaryClientError> {
-        self.reject_idempotency(&options)?;
-        let response = self
-            .execute(
-                Method::GET,
-                "/metrics",
-                None,
-                options,
-                LIMIT_DISCOVERY,
-                RouteRetry::Get,
-                ErrorKind::Problem,
-                None,
-                None,
-            )
-            .await?;
-        let request_id = response.request_id.clone();
-        let status = response.status;
-        String::from_utf8(response.body).map_or_else(
-            |_| Err(NotaryClientError::Decode { status, request_id }),
-            |body| {
-                Ok(NotaryResponse {
-                    body,
-                    status,
-                    request_id: response.request_id,
-                    retry_after: response.retry_after,
-                })
-            },
-        )
-    }
-
-    async fn fetch_issuer_jwks(
-        &self,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<serde_json::Value>, NotaryClientError> {
-        let response: NotaryResponse<serde_json::Value> = self
-            .get_json(
-                "/.well-known/evidence/jwks.json",
-                options,
-                LIMIT_DISCOVERY,
-                ErrorKind::Problem,
-            )
-            .await?;
-        let cached = CachedJwks {
-            body: response.body.clone(),
-            expires_at: Instant::now() + JWKS_TTL,
-        };
-        *self.jwks_cache.lock().expect("jwks cache lock poisoned") = Some(cached);
-        Ok(response)
-    }
-
-    /// Fetch the issuer JWKS without using or updating the client cache.
-    pub async fn raw_issuer_jwks(
-        &self,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<serde_json::Value>, NotaryClientError> {
-        self.get_json(
-            "/.well-known/evidence/jwks.json",
-            options,
-            LIMIT_DISCOVERY,
-            ErrorKind::Problem,
-        )
-        .await
-    }
-
-    #[cfg(feature = "verifier")]
-    /// Explicitly verify an SD-JWT VC compact credential against issuer JWKS.
-    ///
-    /// This method is opt-in. Transport methods continue to decode response
-    /// bodies without performing verification. Verification reuses the
-    /// `issuer_jwks` TTL cache, forces one `refresh_jwks` on `key.unknown`,
-    /// and never performs an unbounded refresh loop. A status-bearing
-    /// credential additionally requires [`crate::StatusListPolicy`] in the
-    /// options. Its signed status list is fetched through a DNS-pinned,
-    /// no-redirect, no-proxy, bounded HTTPS request and fails closed.
-    pub async fn verify_sd_jwt_vc(
-        &self,
-        compact: &str,
-        options: VerifyOptions,
-    ) -> Result<VerifiedCredential, VerificationError> {
-        let mut jwks = self
-            .issuer_jwks(RequestOptions::default())
-            .await
-            .map_err(|_| VerificationError::jwks_unavailable())?
-            .body;
-        let pending = match crate::verifier::verify_sd_jwt_vc_pending(compact, &jwks, &options) {
-            Err(error) if error.is_unknown_key() => {
-                jwks = self
-                    .refresh_jwks(RequestOptions::default())
-                    .await
-                    .map_err(|_| VerificationError::jwks_unavailable())?
-                    .body;
-                crate::verifier::verify_sd_jwt_vc_pending(compact, &jwks, &options)?
-            }
-            Err(error) => return Err(error),
-            Ok(pending) => pending,
-        };
-        if let Some(status) = &pending.status {
-            let status_token = crate::verifier::fetch_status_list_token(status, &options).await?;
-            match crate::verifier::verify_status_list_token(&status_token, status, &jwks, &options)
-            {
-                Err(error) if error.is_status_unknown_key() => {
-                    jwks = self
-                        .refresh_jwks(RequestOptions::default())
-                        .await
-                        .map_err(|_| VerificationError::jwks_unavailable())?
-                        .body;
-                    crate::verifier::verify_status_list_token(
-                        &status_token,
-                        status,
-                        &jwks,
-                        &options,
-                    )?;
-                }
-                Err(error) => return Err(error),
-                Ok(()) => {}
-            }
-        }
-        Ok(pending.credential)
-    }
-
-    #[cfg(feature = "verifier")]
-    /// Explicitly verify a direct credential-issuance response.
-    pub async fn verify_credential_response(
-        &self,
-        response: &CredentialIssueResponse,
-        options: VerifyOptions,
-    ) -> Result<VerifiedCredential, VerificationError> {
-        self.verify_sd_jwt_vc(&response.credential, options).await
-    }
-
-    #[cfg(feature = "oid4vci")]
-    /// Fetch OpenID4VCI issuer metadata.
-    ///
-    /// This helper wraps the endpoint only. It does not generate holder proofs.
-    pub async fn oid4vci_issuer_metadata(
-        &self,
-        options: RequestOptions,
-    ) -> Result<
-        NotaryResponse<registry_platform_oid4vci::CredentialIssuerMetadata>,
-        NotaryClientError,
-    > {
-        self.reject_idempotency(&options)?;
-        self.get_json(
-            "/.well-known/openid-credential-issuer",
-            options,
-            LIMIT_DISCOVERY,
-            ErrorKind::Oid4vci,
-        )
-        .await
-    }
-
-    #[cfg(feature = "oid4vci")]
-    /// Submit an OpenID4VCI credential request.
-    ///
-    /// The caller is responsible for holder-key custody and proof JWT creation.
-    pub async fn oid4vci_credential(
-        &self,
-        request: registry_platform_oid4vci::CredentialRequest,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<registry_platform_oid4vci::CredentialResponse>, NotaryClientError>
-    {
-        self.reject_idempotency(&options)?;
-        self.post_json(
-            "/oid4vci/credential",
-            &request,
-            options,
-            LIMIT_OPERATION,
-            RouteRetry::PostNoRetry,
-            ErrorKind::Oid4vci,
-        )
-        .await
-    }
-
-    #[cfg(all(feature = "oid4vci", feature = "verifier"))]
-    /// Explicitly verify an OpenID4VCI credential response.
-    pub async fn verify_oid4vci_credential(
-        &self,
-        response: &registry_platform_oid4vci::CredentialResponse,
-        options: VerifyOptions,
-    ) -> Result<VerifiedCredential, VerificationError> {
-        self.verify_sd_jwt_vc(oid4vci_compact_credential(&response.credential)?, options)
-            .await
-    }
-
-    /// List configured claim definitions with `GET /v1/claims`.
-    ///
-    /// The current server contract returns a bounded, unpaginated list.
-    pub async fn list_claims(
-        &self,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<ListClaimsResponse>, NotaryClientError> {
-        self.get_json("/v1/claims", options, LIMIT_DISCOVERY, ErrorKind::Problem)
-            .await
-    }
-
-    /// Fetch one claim definition by claim id.
-    pub async fn get_claim(
-        &self,
-        claim_id: &str,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<serde_json::Value>, NotaryClientError> {
-        self.get_json(
-            &format!("/v1/claims/{}", encode_path_segment(claim_id)),
-            options,
-            LIMIT_DISCOVERY,
-            ErrorKind::Problem,
-        )
-        .await
-    }
-
-    /// List evidence formats supported by the service.
-    pub async fn list_formats(
-        &self,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<FormatsResponse>, NotaryClientError> {
-        self.get_json("/v1/formats", options, LIMIT_DISCOVERY, ErrorKind::Problem)
-            .await
-    }
-
-    /// Start the ergonomic evaluation builder for one target entity.
-    #[must_use]
-    pub fn evaluate_target(&self, target_type: impl Into<String>) -> EvaluateBuilder<'_> {
-        EvaluateBuilder {
-            client: self,
-            target: EvidenceEntity::new(target_type),
-            requester: None,
-            relationship: None,
-            on_behalf_of: None,
-            variables: BTreeMap::new(),
-            claims: Vec::new(),
-            disclosure: None,
-            format: None,
-            purpose: None,
-            request_id: None,
-            traceparent: None,
-        }
-    }
-
-    /// Start the ergonomic evaluation builder for a Person target id.
-    ///
-    /// This convenience helper maps to the v1 `target` request model. Prefer
-    /// [`Self::evaluate_target`] when the caller needs identifiers, attributes,
-    /// requester context, or non-person targets.
-    #[must_use]
-    pub fn evaluate(&self, subject_id: impl Into<String>) -> EvaluateBuilder<'_> {
-        self.evaluate_target("Person").target_id(subject_id)
-    }
-
-    /// Submit a raw typed [`EvaluateRequest`].
-    ///
-    /// This method is best when the caller already has the core wire request.
-    /// It applies default purpose and claim-result format handling before
-    /// sending.
-    pub async fn evaluate_request(
-        &self,
-        mut request: EvaluateRequest,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<EvaluateResponse>, NotaryClientError> {
-        let mut options = self.prepare_purpose(options, request.purpose.as_deref())?;
-        options.accept = options
-            .accept
-            .or_else(|| Some(FORMAT_CLAIM_RESULT_JSON.to_string()));
-        if request.purpose.is_none() {
-            request.purpose = options.purpose.clone();
-        }
-        let mut request = request;
-        if request.format.is_none() {
-            request.format = Some(FORMAT_CLAIM_RESULT_JSON.to_string());
-        }
-        self.post_json(
-            "/v1/evaluations",
-            &request,
-            options,
-            LIMIT_OPERATION,
-            RouteRetry::PostNoRetry,
-            ErrorKind::Problem,
-        )
-        .await
-    }
-
-    /// Submit a raw typed [`BatchEvaluateRequest`].
-    ///
-    /// Batch evaluation is the only POST route where the client allows
-    /// `Idempotency-Key`; retries require that key. Requests above the hard
-    /// 100-member platform ceiling fail locally before transport.
-    pub async fn batch_evaluate_request(
-        &self,
-        mut request: BatchEvaluateRequest,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<registry_notary_core::BatchEvaluateResponse>, NotaryClientError>
-    {
-        if request.items.len() > MAX_BATCH_EVALUATION_MEMBERS_V1 {
-            return Err(NotaryClientBuildError::BatchTooLarge {
-                actual: request.items.len(),
-                maximum: MAX_BATCH_EVALUATION_MEMBERS_V1,
-            }
-            .into());
-        }
-        let mut options = self.prepare_purpose(options, request.purpose.as_deref())?;
-        options.accept = options
-            .accept
-            .or_else(|| Some(FORMAT_CLAIM_RESULT_JSON.to_string()));
-        if request.purpose.is_none() {
-            request.purpose = options.purpose.clone();
-        }
-        if request.format.is_none() {
-            request.format = Some(FORMAT_CLAIM_RESULT_JSON.to_string());
-        }
-        self.post_json(
-            "/v1/batch-evaluations",
-            &request,
-            options,
-            LIMIT_BATCH,
-            RouteRetry::PostBatch,
-            ErrorKind::Problem,
-        )
-        .await
-    }
-
-    /// Render a stored evaluation into a requested evidence format.
-    ///
-    /// The server models `evaluation_id` as a path parameter. This method accepts
-    /// the core [`RenderRequest`] DTO for caller ergonomics, then moves
-    /// `evaluation_id` into `/v1/evaluations/{evaluation_id}/render` before the
-    /// request body is serialized.
-    pub async fn render_request(
-        &self,
-        request: RenderRequest,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<serde_json::Value>, NotaryClientError> {
-        self.reject_idempotency(&options)?;
-        let path = format!(
-            "/v1/evaluations/{}/render",
-            encode_path_segment(&request.evaluation_id)
-        );
-        let body = RenderEvaluationRequest::from(request);
-        self.post_json(
-            &path,
-            &body,
-            options,
-            LIMIT_OPERATION,
-            RouteRetry::PostNoRetry,
-            ErrorKind::Problem,
-        )
-        .await
-    }
-
-    /// Issue a credential from a stored evaluation.
-    ///
-    /// Returned credential material is present in typed fields but redacted from
-    /// `Debug` output.
-    pub async fn issue_credential_request(
-        &self,
-        mut request: CredentialIssueRequest,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<CredentialIssueResponse>, NotaryClientError> {
-        self.reject_idempotency(&options)?;
-        let options = self.prepare_purpose(options, request.purpose.as_deref())?;
-        if request.purpose.is_none() {
-            request.purpose = options.purpose.clone();
-        }
-        self.post_json(
-            "/v1/credentials",
-            &request,
-            options,
-            LIMIT_OPERATION,
-            RouteRetry::PostNoRetry,
-            ErrorKind::Problem,
-        )
-        .await
-    }
-
-    /// Fetch minimal credential status by credential id.
-    pub async fn credential_status(
-        &self,
-        credential_id: &str,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<CredentialStatusResponse>, NotaryClientError> {
-        self.get_json(
-            &format!(
-                "/v1/credentials/{}/status",
-                encode_path_segment(credential_id)
-            ),
-            options,
-            LIMIT_SMALL,
-            ErrorKind::Problem,
-        )
-        .await
-    }
-
-    /// Update minimal credential status through the admin route.
-    pub async fn update_credential_status(
-        &self,
-        credential_id: &str,
-        status: impl Into<String>,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<CredentialStatusResponse>, NotaryClientError> {
-        self.reject_idempotency(&options)?;
-        self.post_json(
-            &format!(
-                "/admin/v1/credentials/{}/status",
-                encode_path_segment(credential_id)
-            ),
-            &CredentialStatusUpdateRequest {
-                status: status.into(),
-            },
-            options,
-            LIMIT_SMALL,
-            RouteRetry::PostNoRetry,
-            ErrorKind::Problem,
-        )
-        .await
-    }
-
-    #[cfg(feature = "federation")]
-    /// Submit an already-signed federation evaluation JWS.
-    ///
-    /// The client does not mint or sign federation JWTs.
-    pub async fn federation_evaluate_jws(
-        &self,
-        compact_jws: &str,
-        options: RequestOptions,
-    ) -> Result<NotaryResponse<String>, NotaryClientError> {
-        self.reject_idempotency(&options)?;
-        self.execute(
-            Method::POST,
-            "/federation/v1/evaluations",
-            Some(compact_jws.as_bytes().to_vec()),
-            options,
-            LIMIT_OPERATION,
-            RouteRetry::PostNoRetry,
-            ErrorKind::Problem,
-            Some(headers::APPLICATION_JWT),
-            None,
-        )
-        .await
-        .and_then(|response| {
-            let request_id = response.request_id.clone();
-            let status = response.status;
-            String::from_utf8(response.body).map_or_else(
-                |_| Err(NotaryClientError::Decode { status, request_id }),
-                |body| {
-                    Ok(NotaryResponse {
-                        body,
-                        status,
-                        request_id: response.request_id,
-                        retry_after: response.retry_after,
-                    })
-                },
-            )
-        })
-    }
-
-    async fn get_json<T: DeserializeOwned>(
-        &self,
-        path: &str,
-        options: RequestOptions,
-        limit: u64,
-        error_kind: ErrorKind,
-    ) -> Result<NotaryResponse<T>, NotaryClientError> {
-        self.get_json_accepting_status(path, options, limit, error_kind, None)
-            .await
-    }
-
-    async fn get_json_accepting_status<T: DeserializeOwned>(
-        &self,
-        path: &str,
-        options: RequestOptions,
-        limit: u64,
-        error_kind: ErrorKind,
-        accepted_status: Option<StatusCode>,
-    ) -> Result<NotaryResponse<T>, NotaryClientError> {
-        self.reject_idempotency(&options)?;
-        let response = self
-            .execute(
-                Method::GET,
-                path,
-                None,
-                options,
-                limit,
-                RouteRetry::Get,
-                error_kind,
-                None,
-                accepted_status,
-            )
-            .await?;
-        let body =
-            serde_json::from_slice(&response.body).map_err(|_| NotaryClientError::Decode {
-                status: response.status,
-                request_id: response.request_id.clone(),
-            })?;
-        Ok(response.map(body))
-    }
-
-    async fn post_json<B: Serialize + ?Sized, T: DeserializeOwned>(
-        &self,
-        path: &str,
-        body: &B,
-        mut options: RequestOptions,
-        limit: u64,
-        retry: RouteRetry,
-        error_kind: ErrorKind,
-    ) -> Result<NotaryResponse<T>, NotaryClientError> {
-        if matches!(retry, RouteRetry::PostNoRetry) {
-            self.reject_idempotency(&options)?;
-        }
-        options.accept = options
-            .accept
-            .or_else(|| Some(headers::APPLICATION_JSON.to_string()));
-        let raw =
-            serde_json::to_vec(body).map_err(|_| NotaryClientBuildError::RequestSerialization)?;
-        let response = self
-            .execute(
-                Method::POST,
-                path,
-                Some(raw),
-                options,
-                limit,
-                retry,
-                error_kind,
-                Some(headers::APPLICATION_JSON),
-                None,
-            )
-            .await?;
-        let body =
-            serde_json::from_slice(&response.body).map_err(|_| NotaryClientError::Decode {
-                status: response.status,
-                request_id: response.request_id.clone(),
-            })?;
-        Ok(response.map(body))
-    }
-
-    #[allow(clippy::too_many_arguments)]
-    async fn execute(
-        &self,
-        method: Method,
-        path: &str,
-        body: Option<Vec<u8>>,
-        options: RequestOptions,
-        limit: u64,
-        route_retry: RouteRetry,
-        error_kind: ErrorKind,
-        content_type: Option<&str>,
-        accepted_status: Option<StatusCode>,
-    ) -> Result<NotaryResponse<Vec<u8>>, NotaryClientError> {
-        let attempts = allowed_attempts(&self.retry_policy, route_retry, &options);
-        let mut attempt = 0;
-        loop {
-            attempt += 1;
-            let result = self
-                .send_once(
-                    method.clone(),
-                    path,
-                    body.clone(),
-                    options.clone(),
-                    limit,
-                    error_kind,
-                    content_type,
-                    accepted_status,
-                )
-                .await;
-            match result {
-                Ok(response) => return Ok(response),
-                Err(error) if attempt < attempts && should_retry(&self.retry_policy, &error) => {
-                    let delay = retry_delay(&self.retry_policy, attempt, &error);
-                    tokio::time::sleep(delay).await;
-                }
-                Err(error) => return Err(error),
-            }
-        }
-    }
-
-    #[allow(clippy::too_many_arguments)]
-    async fn send_once(
-        &self,
-        method: Method,
-        path: &str,
-        body: Option<Vec<u8>>,
-        options: RequestOptions,
-        limit: u64,
-        error_kind: ErrorKind,
-        content_type: Option<&str>,
-        accepted_status: Option<StatusCode>,
-    ) -> Result<NotaryResponse<Vec<u8>>, NotaryClientError> {
-        let url = self.url(path)?;
-        let auth_header = match &self.auth {
-            Some(AuthState::Static(auth)) => Some(auth.header()),
-            Some(AuthState::Provider(provider)) => Some(provider.auth_header().await?),
-            None => None,
-        };
-        let mut request = self.http.request(method, url);
-        if let Some(auth) = auth_header {
-            request = match auth {
-                AuthHeader::Authorization(value) => request.header(
-                    reqwest::header::AUTHORIZATION,
-                    secrecy::ExposeSecret::expose_secret(&value),
-                ),
-                AuthHeader::ApiKey(value) => {
-                    request.header("x-api-key", secrecy::ExposeSecret::expose_secret(&value))
-                }
-            };
-        }
-        if let Some(accept) = &options.accept {
-            request = request.header(reqwest::header::ACCEPT, accept);
-        }
-        if let Some(content_type) = content_type {
-            request = request.header(reqwest::header::CONTENT_TYPE, content_type);
-        }
-        if let Some(purpose) = &options.purpose {
-            request = request.header(headers::DATA_PURPOSE, purpose);
-        }
-        if let Some(request_id) = &options.request_id {
-            request = request.header(headers::REQUEST_ID, request_id);
-        }
-        if let Some(traceparent) = &options.traceparent {
-            request = request.header(headers::TRACEPARENT, traceparent);
-        }
-        if let Some(idempotency_key) = &options.idempotency_key {
-            request = request.header(headers::IDEMPOTENCY_KEY, idempotency_key);
-        }
-        if let Some(body) = body {
-            request = request.body(body);
-        }
-        let response = request.send().await.map_err(NotaryClientError::Transport)?;
-        let status = response.status();
-        let request_id = response
-            .headers()
-            .get(headers::REQUEST_ID)
-            .and_then(|value| value.to_str().ok())
-            .map(ToOwned::to_owned);
-        let retry_after = parse_retry_after(
-            response
-                .headers()
-                .get(headers::RETRY_AFTER)
-                .and_then(|value| value.to_str().ok()),
-            response
-                .headers()
-                .get(headers::DATE)
-                .and_then(|value| value.to_str().ok()),
-        );
-        let bytes =
-            read_bounded(response, limit)
-                .await
-                .map_err(|_| NotaryClientError::BodyTooLarge {
-                    request_id: request_id.clone(),
-                })?;
-        if status.is_success() || accepted_status == Some(status) {
-            return Ok(NotaryResponse {
-                body: bytes,
-                status,
-                request_id,
-                retry_after,
-            });
-        }
-        match error_kind {
-            ErrorKind::Problem => {
-                let problem = serde_json::from_slice::<ProblemDetails>(&bytes).map_err(|_| {
-                    NotaryClientError::Decode {
-                        status,
-                        request_id: request_id.clone(),
-                    }
-                })?;
-                Err(NotaryClientError::Problem {
-                    status,
-                    problem: Box::new(problem),
-                    request_id,
-                    retry_after,
-                })
-            }
-            ErrorKind::Oid4vci => {
-                let error = serde_json::from_slice::<Oid4vciError>(&bytes).map_err(|_| {
-                    NotaryClientError::Decode {
-                        status,
-                        request_id: request_id.clone(),
-                    }
-                })?;
-                Err(NotaryClientError::Oid4vci {
-                    status,
-                    error,
-                    request_id,
-                    retry_after,
-                })
-            }
-        }
-    }
-
-    fn prepare_purpose(
-        &self,
-        mut options: RequestOptions,
-        body_purpose: Option<&str>,
-    ) -> Result<RequestOptions, NotaryClientBuildError> {
-        if options.purpose.is_none() {
-            options.purpose = self
-                .default_purpose
-                .clone()
-                .or_else(|| body_purpose.map(ToOwned::to_owned));
-        }
-        if let (Some(header), Some(body)) = (options.purpose.as_deref(), body_purpose) {
-            if header != body {
-                return Err(NotaryClientBuildError::PurposeConflict);
-            }
-        }
-        Ok(options)
-    }
-
-    fn reject_idempotency(&self, options: &RequestOptions) -> Result<(), NotaryClientBuildError> {
-        if options.idempotency_key.is_some() {
-            Err(NotaryClientBuildError::UnsupportedIdempotencyKey)
-        } else {
-            Ok(())
-        }
-    }
-
-    fn url(&self, path: &str) -> Result<Url, NotaryClientBuildError> {
-        self.base_url
-            .join(path.trim_start_matches('/'))
-            .map_err(|err| NotaryClientBuildError::Url(err.to_string()))
-    }
-}
-
-#[cfg(all(feature = "oid4vci", feature = "verifier"))]
-fn oid4vci_compact_credential(
-    credential: &registry_platform_oid4vci::CredentialValue,
-) -> Result<&str, VerificationError> {
-    match credential {
-        registry_platform_oid4vci::CredentialValue::String(compact) => Ok(compact.as_str()),
-        registry_platform_oid4vci::CredentialValue::Object(_) => {
-            Err(VerificationError::UnsupportedCredentialShape {
-                code: "credential.unsupported_shape",
-            })
-        }
-    }
-}
-
-impl NotaryClientBuilder {
-    /// Configure bearer-token authentication.
-    #[must_use]
-    pub fn bearer_token(mut self, token: impl Into<String>) -> Self {
-        self.bearer_token = Some(SecretString::from(token.into()));
-        self
-    }
-
-    /// Configure API-key authentication.
-    #[must_use]
-    pub fn api_key(mut self, token: impl Into<String>) -> Self {
-        self.api_key = Some(SecretString::from(token.into()));
-        self
-    }
-
-    /// Configure dynamic authentication.
-    #[must_use]
-    pub fn auth_provider(mut self, provider: Arc<dyn AuthProvider>) -> Self {
-        self.auth_provider = Some(provider);
-        self
-    }
-
-    /// Configure the default data purpose for evaluation requests.
-    ///
-    /// A body purpose must match this value unless overridden through
-    /// [`RequestOptions`].
-    #[must_use]
-    pub fn default_purpose(mut self, purpose: impl Into<String>) -> Self {
-        self.default_purpose = Some(purpose.into());
-        self
-    }
-
-    /// Configure request timeout. Defaults to 30 seconds.
-    #[must_use]
-    pub fn timeout(mut self, timeout: Duration) -> Self {
-        self.timeout = Some(timeout);
-        self
-    }
-
-    /// Configure the `User-Agent` header.
-    #[must_use]
-    pub fn user_agent(mut self, user_agent: impl Into<String>) -> Self {
-        self.user_agent = Some(user_agent.into());
-        self
-    }
-
-    /// Configure route-aware retry behavior.
-    #[must_use]
-    pub fn retry_policy(mut self, retry_policy: RetryPolicy) -> Self {
-        self.retry_policy = Some(retry_policy);
-        self
-    }
-
-    #[cfg(any(test, feature = "test-support"))]
-    /// Override the HTTP client in tests.
-    ///
-    /// This is intentionally unavailable in production builds because it can
-    /// bypass transport safety defaults.
-    #[must_use]
-    pub fn reqwest_client(mut self, client: reqwest::Client) -> Self {
-        self.reqwest_client = Some(client);
-        self
-    }
-
-    /// Build the client and validate base URL and auth configuration.
-    pub fn build(self) -> Result<RegistryNotaryClient, NotaryClientBuildError> {
-        let base_url = self.base_url.unwrap_or_default();
-        let mut base_url =
-            Url::parse(&base_url).map_err(|err| NotaryClientBuildError::Url(err.to_string()))?;
-        if !base_url.path().ends_with('/') {
-            base_url
-                .path_segments_mut()
-                .map_err(|_| NotaryClientBuildError::Url("base URL cannot be a base".to_string()))?
-                .push("");
-        }
-        validate_base_url(&base_url)?;
-        let auth_count = usize::from(self.bearer_token.is_some())
-            + usize::from(self.api_key.is_some())
-            + usize::from(self.auth_provider.is_some());
-        if auth_count > 1 {
-            return Err(NotaryClientBuildError::MultipleAuthModes);
-        }
-        let auth = if let Some(token) = self.bearer_token {
-            Some(AuthState::Static(Auth::Bearer(token)))
-        } else if let Some(token) = self.api_key {
-            Some(AuthState::Static(Auth::ApiKey(token)))
-        } else {
-            self.auth_provider.map(AuthState::Provider)
-        };
-        #[cfg(any(test, feature = "test-support"))]
-        let http = if let Some(client) = self.reqwest_client {
-            client
-        } else {
-            build_http_client(self.timeout, self.user_agent)
-        };
-        #[cfg(not(any(test, feature = "test-support")))]
-        let http = build_http_client(self.timeout, self.user_agent);
-        Ok(RegistryNotaryClient {
-            base_url,
-            http,
-            auth,
-            default_purpose: self.default_purpose,
-            retry_policy: self.retry_policy.unwrap_or_default(),
-            jwks_cache: Arc::new(Mutex::new(None)),
-        })
-    }
-}
-
-#[derive(Debug, Clone, Copy)]
-enum ErrorKind {
-    Problem,
-    #[cfg_attr(not(feature = "oid4vci"), allow(dead_code))]
-    Oid4vci,
-}
-
-#[derive(Debug, Clone, Copy)]
-enum RouteRetry {
-    Get,
-    PostBatch,
-    PostNoRetry,
-}
-
-fn allowed_attempts(policy: &RetryPolicy, route: RouteRetry, options: &RequestOptions) -> usize {
-    match route {
-        RouteRetry::Get => policy.max_attempts.max(1),
-        RouteRetry::PostBatch if options.idempotency_key.is_some() => policy.max_attempts.max(1),
-        RouteRetry::PostBatch | RouteRetry::PostNoRetry => 1,
-    }
-}
-
-fn should_retry(policy: &RetryPolicy, error: &NotaryClientError) -> bool {
-    match error {
-        NotaryClientError::Transport(_) => policy.retry_transport_errors,
-        NotaryClientError::Problem { status, .. } | NotaryClientError::Oid4vci { status, .. } => {
-            (*status == StatusCode::TOO_MANY_REQUESTS && policy.retry_rate_limited)
-                || (*status == StatusCode::SERVICE_UNAVAILABLE && policy.retry_unavailable)
-        }
-        _ => false,
-    }
-}
-
-fn retry_delay(policy: &RetryPolicy, attempt: usize, error: &NotaryClientError) -> Duration {
-    if let Some(crate::RetryAfter::Delta(delay)) = error.retry_after() {
-        return (*delay).min(policy.max_delay);
-    }
-    let multiplier = 1_u32
-        .checked_shl(attempt.saturating_sub(1) as u32)
-        .unwrap_or(u32::MAX);
-    policy
-        .base_delay
-        .saturating_mul(multiplier)
-        .min(policy.max_delay)
-}
-
-fn build_http_client(timeout: Option<Duration>, user_agent: Option<String>) -> reqwest::Client {
-    let mut builder = reqwest::Client::builder()
-        .timeout(timeout.unwrap_or(Duration::from_secs(30)))
-        .redirect(reqwest::redirect::Policy::none())
-        .no_proxy();
-    if let Some(user_agent) = user_agent {
-        builder = builder.user_agent(user_agent);
-    }
-    builder
-        .build()
-        .expect("registry notary client options are valid")
-}
-
-fn validate_base_url(url: &Url) -> Result<(), NotaryClientBuildError> {
-    if url.scheme() == "https" {
-        return Ok(());
-    }
-    #[cfg(any(debug_assertions, feature = "test-support"))]
-    {
-        if url.scheme() == "http"
-            && matches!(url.host_str(), Some("127.0.0.1" | "localhost" | "::1"))
-        {
-            return Ok(());
-        }
-    }
-    Err(NotaryClientBuildError::InsecureBaseUrl)
-}
-
-fn encode_path_segment(segment: &str) -> String {
-    segment
-        .bytes()
-        .flat_map(|byte| match byte {
-            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
-                vec![byte as char]
-            }
-            _ => format!("%{byte:02X}").chars().collect(),
-        })
-        .collect()
-}
-
-/// Fluent builder for one high-level evaluation request.
-pub struct EvaluateBuilder<'a> {
-    client: &'a RegistryNotaryClient,
-    target: EvidenceEntity,
-    requester: Option<EvidenceEntity>,
-    relationship: Option<EvidenceRelationship>,
-    on_behalf_of: Option<EvidenceOnBehalfOf>,
-    variables: BTreeMap<String, String>,
-    claims: Vec<ClaimRef>,
-    disclosure: Option<String>,
-    format: Option<String>,
-    purpose: Option<String>,
-    request_id: Option<String>,
-    traceparent: Option<String>,
-}
-
-impl<'a> EvaluateBuilder<'a> {
-    /// Set the target entity id.
-    #[must_use]
-    pub fn target_id(mut self, id: impl Into<String>) -> Self {
-        self.target.id = Some(id.into());
-        self
-    }
-
-    /// Add a target identifier.
-    #[must_use]
-    pub fn target_identifier(
-        mut self,
-        scheme: impl Into<String>,
-        value: impl Into<String>,
-    ) -> Self {
-        self.target.identifiers.push(EvidenceIdentifier {
-            scheme: scheme.into(),
-            value: value.into(),
-            issuer: None,
-            country: None,
-        });
-        self
-    }
-
-    /// Set the issuer on the most recently added target identifier.
-    #[must_use]
-    pub fn target_identifier_issuer(mut self, issuer: impl Into<String>) -> Self {
-        if let Some(identifier) = self.target.identifiers.last_mut() {
-            identifier.issuer = Some(issuer.into());
-        }
-        self
-    }
-
-    /// Set the country on the most recently added target identifier.
-    #[must_use]
-    pub fn target_identifier_country(mut self, country: impl Into<String>) -> Self {
-        if let Some(identifier) = self.target.identifiers.last_mut() {
-            identifier.country = Some(country.into());
-        }
-        self
-    }
-
-    /// Add a target matching attribute.
-    #[must_use]
-    pub fn target_attribute(
-        mut self,
-        name: impl Into<String>,
-        value: impl Into<serde_json::Value>,
-    ) -> Self {
-        self.target.attributes.insert(name.into(), value.into());
-        self
-    }
-
-    /// Set a pre-built target entity.
-    #[must_use]
-    pub fn target(mut self, target: EvidenceEntity) -> Self {
-        self.target = target;
-        self
-    }
-
-    /// Set the requester entity.
-    #[must_use]
-    pub fn requester(mut self, requester: EvidenceEntity) -> Self {
-        self.requester = Some(requester);
-        self
-    }
-
-    /// Set the relationship type between requester and target.
-    #[must_use]
-    pub fn relationship(mut self, relationship_type: impl Into<String>) -> Self {
-        self.relationship = Some(EvidenceRelationship {
-            relationship_type: relationship_type.into(),
-            attributes: BTreeMap::new(),
-        });
-        self
-    }
-
-    /// Add an attribute to the requester-target relationship.
-    #[must_use]
-    pub fn relationship_attribute(
-        mut self,
-        name: impl Into<String>,
-        value: impl Into<serde_json::Value>,
-    ) -> Self {
-        let relationship = self
-            .relationship
-            .get_or_insert_with(|| EvidenceRelationship {
-                relationship_type: "unspecified".to_string(),
-                attributes: BTreeMap::new(),
-            });
-        relationship.attributes.insert(name.into(), value.into());
-        self
-    }
-
-    /// Set the delegated/on-behalf-of context using the frozen minimal actor
-    /// envelope. Simple deployments omit this entirely.
-    #[must_use]
-    pub fn on_behalf_of(mut self, on_behalf_of: EvidenceOnBehalfOf) -> Self {
-        self.on_behalf_of = Some(on_behalf_of);
-        self
-    }
-
-    /// Add one declared RFC 3339 full-date request variable.
-    #[must_use]
-    pub fn request_variable_date(
-        mut self,
-        name: impl Into<String>,
-        value: impl Into<String>,
-    ) -> Self {
-        self.variables.insert(name.into(), value.into());
-        self
-    }
-
-    /// Set the identifier type for the first target identifier.
-    ///
-    /// Prefer [`Self::target_identifier`] for new code.
-    #[must_use]
-    pub fn id_type(mut self, id_type: impl Into<String>) -> Self {
-        let subject_id = self.target.id.take().unwrap_or_default();
-        self.target.identifiers.insert(
-            0,
-            EvidenceIdentifier {
-                scheme: id_type.into(),
-                value: subject_id,
-                issuer: None,
-                country: None,
-            },
-        );
-        self
-    }
-
-    /// Add one claim id.
-    #[must_use]
-    pub fn claim(mut self, claim: impl Into<String>) -> Self {
-        self.claims.push(ClaimRef::new(claim.into()));
-        self
-    }
-
-    /// Add multiple claim ids.
-    #[must_use]
-    pub fn claims<I, S>(mut self, claims: I) -> Self
-    where
-        I: IntoIterator<Item = S>,
-        S: Into<String>,
-    {
-        self.claims
-            .extend(claims.into_iter().map(|claim| ClaimRef::new(claim.into())));
-        self
-    }
-
-    /// Set the disclosure mode.
-    #[must_use]
-    pub fn disclosure(mut self, disclosure: impl Into<String>) -> Self {
-        self.disclosure = Some(disclosure.into());
-        self
-    }
-
-    /// Set the requested response format.
-    #[must_use]
-    pub fn format(mut self, format: impl Into<String>) -> Self {
-        self.format = Some(format.into());
-        self
-    }
-
-    /// Set the data purpose for this request.
-    #[must_use]
-    pub fn purpose(mut self, purpose: impl Into<String>) -> Self {
-        self.purpose = Some(purpose.into());
-        self
-    }
-
-    /// Set `X-Request-Id` for this request.
-    #[must_use]
-    pub fn request_id(mut self, request_id: impl Into<String>) -> Self {
-        self.request_id = Some(request_id.into());
-        self
-    }
-
-    /// Set W3C `traceparent` for this request.
-    #[must_use]
-    pub fn traceparent(mut self, traceparent: impl Into<String>) -> Self {
-        self.traceparent = Some(traceparent.into());
-        self
-    }
-
-    /// Send the evaluation request.
-    pub async fn send(self) -> Result<NotaryResponse<Evaluation>, NotaryClientError> {
-        let variables = RequestVariables::try_new(self.variables)
-            .map_err(|_| NotaryClientBuildError::RequestSerialization)?;
-        let request = EvaluateRequest {
-            requester: self.requester,
-            target: Some(self.target),
-            relationship: self.relationship,
-            on_behalf_of: self.on_behalf_of,
-            variables,
-            claims: self.claims,
-            disclosure: self.disclosure,
-            format: self.format,
-            purpose: self.purpose.clone(),
-        };
-        let options = RequestOptions {
-            purpose: self.purpose,
-            request_id: self.request_id,
-            traceparent: self.traceparent,
-            accept: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-            ..RequestOptions::default()
-        };
-        self.client
-            .evaluate_request(request, options)
-            .await
-            .map(|response| {
-                let request_id = response.request_id;
-                let retry_after = response.retry_after;
-                let results = response.body.results;
-                NotaryResponse {
-                    body: Evaluation { results },
-                    status: response.status,
-                    request_id,
-                    retry_after,
-                }
-            })
-    }
-}
diff --git a/crates/registry-notary-client/src/error.rs b/crates/registry-notary-client/src/error.rs
deleted file mode 100644
index c3cdec691..000000000
--- a/crates/registry-notary-client/src/error.rs
+++ /dev/null
@@ -1,384 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Error types for the Registry Notary client.
-
-use crate::options::RetryAfter;
-use crate::responses::ReadinessChecks;
-
-use std::time::Duration;
-
-use time::format_description::well_known::Rfc2822;
-use time::OffsetDateTime;
-
-/// Errors raised while constructing a client or preparing a request.
-#[derive(Debug, thiserror::Error)]
-pub enum NotaryClientBuildError {
-    /// The base URL could not be parsed.
-    #[error("invalid base URL")]
-    Url(String),
-    /// The base URL is not HTTPS. Debug and `test-support` builds allow HTTP
-    /// loopback for local tests.
-    #[error("base URL must use https unless test-support HTTP loopback is enabled")]
-    InsecureBaseUrl,
-    /// More than one auth mode was configured.
-    #[error("multiple authentication modes configured")]
-    MultipleAuthModes,
-    /// The purpose in [`crate::RequestOptions`] conflicts with the request body.
-    #[error("request purpose conflicts with request body purpose")]
-    PurposeConflict,
-    /// The request body failed to serialize before sending.
-    #[error("request body could not be serialized")]
-    RequestSerialization,
-    /// An idempotency key was supplied on a route that ignores it.
-    #[error("idempotency key is not supported for this route")]
-    UnsupportedIdempotencyKey,
-    /// The request exceeds the hard Registry Notary batch ceiling.
-    #[error("batch contains {actual} members; the hard maximum is {maximum}")]
-    BatchTooLarge { actual: usize, maximum: usize },
-}
-
-/// RFC 9457 Problem Details emitted by Registry Notary.
-///
-/// The server may include sensitive details such as subject identifiers or
-/// source-field names in `detail`. `Debug`, `Display`, and portable errors do
-/// not render that field.
-#[derive(Clone, serde::Serialize, serde::Deserialize, PartialEq, Eq)]
-pub struct ProblemDetails {
-    /// Problem type URI, deserialized from the JSON `type` field.
-    #[serde(rename = "type")]
-    pub problem_type: Option<String>,
-    /// Human-readable title.
-    pub title: String,
-    /// HTTP status code.
-    pub status: u16,
-    /// Sensitive detail. Do not log this directly.
-    pub detail: String,
-    /// Stable machine-readable code.
-    pub code: String,
-    /// Server request/correlation id, when included in the problem body.
-    #[serde(default)]
-    pub request_id: Option<String>,
-    /// Readiness status for `GET /ready` failures.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub readiness_status: Option<String>,
-    /// Typed readiness checks for `GET /ready` failures.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub checks: Option<ReadinessChecks>,
-}
-
-impl std::fmt::Debug for ProblemDetails {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("ProblemDetails")
-            .field("problem_type", &self.problem_type)
-            .field("title", &self.title)
-            .field("status", &self.status)
-            .field("detail", &"<redacted>")
-            .field("code", &self.code)
-            .field("request_id", &self.request_id)
-            .field("readiness_status", &self.readiness_status)
-            .finish()
-    }
-}
-
-impl std::fmt::Display for ProblemDetails {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "{} ({})", self.title, self.code)
-    }
-}
-
-/// OpenID4VCI error envelope.
-///
-/// `error_description` can include holder or credential details and is redacted
-/// from incidental formatting.
-#[derive(Clone, serde::Serialize, serde::Deserialize, PartialEq, Eq)]
-pub struct Oid4vciError {
-    /// OAuth/OID4VCI error code.
-    pub error: String,
-    /// Optional sensitive description.
-    #[serde(default)]
-    pub error_description: Option<String>,
-}
-
-impl std::fmt::Debug for Oid4vciError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("Oid4vciError")
-            .field("error", &self.error)
-            .field(
-                "error_description",
-                &self.error_description.as_ref().map(|_| "<redacted>"),
-            )
-            .finish()
-    }
-}
-
-impl std::fmt::Display for Oid4vciError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.write_str(&self.error)
-    }
-}
-
-/// Language-binding-safe error family.
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "snake_case")]
-pub enum PortableErrorKind {
-    /// Registry Notary Problem Details.
-    Problem,
-    /// OpenID4VCI error envelope.
-    Oid4vci,
-    /// Response body could not be decoded.
-    Decode,
-    /// Response body exceeded the client limit.
-    BodyTooLarge,
-    /// Transport failure before a response was decoded.
-    Transport,
-    /// Client build or request preparation failure.
-    Build,
-}
-
-/// Redacted error envelope intended for Python, Node, and FFI boundaries.
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize, PartialEq, Eq)]
-pub struct PortableClientError {
-    /// Broad error family.
-    pub kind: PortableErrorKind,
-    /// HTTP status when a response was available.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub status: Option<u16>,
-    /// Stable problem or client error code.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub code: Option<String>,
-    /// Safe title suitable for application logs.
-    pub title: String,
-    /// Whether retry may be useful if the route also allows retry.
-    pub retryable: bool,
-    /// Server request id, when present.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub request_id: Option<String>,
-}
-
-/// Errors returned by client operations.
-///
-/// `Display` is intentionally opaque for decode/body failures and redacts
-/// sensitive problem or OID4VCI detail. Use [`Self::request_id`],
-/// [`Self::status`], and [`Self::problem_code`] for safe logging.
-#[derive(Debug, thiserror::Error)]
-pub enum NotaryClientError {
-    /// Build or request-preparation failure.
-    #[error(transparent)]
-    Build(#[from] NotaryClientBuildError),
-    /// Request transport failed.
-    #[error("transport error")]
-    Transport(#[source] reqwest::Error),
-    /// Registry Notary returned Problem Details.
-    #[error("registry notary problem: {problem}")]
-    Problem {
-        status: reqwest::StatusCode,
-        problem: Box<ProblemDetails>,
-        request_id: Option<String>,
-        retry_after: Option<RetryAfter>,
-    },
-    /// OpenID4VCI endpoint returned an OID4VCI error envelope.
-    #[error("openid4vci error: {error}")]
-    Oid4vci {
-        status: reqwest::StatusCode,
-        error: Oid4vciError,
-        request_id: Option<String>,
-        retry_after: Option<RetryAfter>,
-    },
-    /// Response body could not be decoded.
-    #[error("failed to decode response body")]
-    Decode {
-        status: reqwest::StatusCode,
-        request_id: Option<String>,
-    },
-    /// Response body exceeded the configured route limit.
-    #[error("response body exceeded configured size limit")]
-    BodyTooLarge { request_id: Option<String> },
-}
-
-impl NotaryClientError {
-    /// HTTP status associated with the error, when available.
-    #[must_use]
-    pub fn status(&self) -> Option<reqwest::StatusCode> {
-        match self {
-            Self::Problem { status, .. } | Self::Oid4vci { status, .. } => Some(*status),
-            Self::Decode { status, .. } => Some(*status),
-            _ => None,
-        }
-    }
-
-    /// Stable server or OID4VCI problem code, when available.
-    #[must_use]
-    pub fn problem_code(&self) -> Option<&str> {
-        match self {
-            Self::Problem { problem, .. } => Some(problem.code.as_str()),
-            Self::Oid4vci { error, .. } => Some(error.error.as_str()),
-            _ => None,
-        }
-    }
-
-    /// Server request id captured before decoding the response body.
-    #[must_use]
-    pub fn request_id(&self) -> Option<&str> {
-        match self {
-            Self::Problem { request_id, .. }
-            | Self::Oid4vci { request_id, .. }
-            | Self::Decode { request_id, .. }
-            | Self::BodyTooLarge { request_id } => request_id.as_deref(),
-            _ => None,
-        }
-    }
-
-    /// Parsed `Retry-After` header, when the server provided one.
-    #[must_use]
-    pub fn retry_after(&self) -> Option<&RetryAfter> {
-        match self {
-            Self::Problem { retry_after, .. } | Self::Oid4vci { retry_after, .. } => {
-                retry_after.as_ref()
-            }
-            _ => None,
-        }
-    }
-
-    /// Whether the error class is retryable in principle.
-    ///
-    /// Route-specific retry rules still apply.
-    #[must_use]
-    pub fn is_retryable(&self) -> bool {
-        matches!(self.status().map(|status| status.as_u16()), Some(429 | 503))
-            || matches!(self, Self::Transport(_))
-    }
-
-    /// Convert to a redacted portable envelope for bindings or FFI.
-    #[must_use]
-    pub fn portable(&self) -> PortableClientError {
-        match self {
-            Self::Problem {
-                status,
-                problem,
-                request_id,
-                ..
-            } => PortableClientError {
-                kind: PortableErrorKind::Problem,
-                status: Some(status.as_u16()),
-                code: Some(problem.code.clone()),
-                title: problem.title.clone(),
-                retryable: self.is_retryable(),
-                request_id: request_id.clone(),
-            },
-            Self::Oid4vci {
-                status,
-                error,
-                request_id,
-                ..
-            } => PortableClientError {
-                kind: PortableErrorKind::Oid4vci,
-                status: Some(status.as_u16()),
-                code: Some(error.error.clone()),
-                title: "OpenID4VCI error".to_string(),
-                retryable: self.is_retryable(),
-                request_id: request_id.clone(),
-            },
-            Self::Decode { status, request_id } => PortableClientError {
-                kind: PortableErrorKind::Decode,
-                status: Some(status.as_u16()),
-                code: Some("decode.failed".to_string()),
-                title: "Failed to decode response body".to_string(),
-                retryable: false,
-                request_id: request_id.clone(),
-            },
-            Self::BodyTooLarge { request_id } => PortableClientError {
-                kind: PortableErrorKind::BodyTooLarge,
-                status: None,
-                code: Some("body.too_large".to_string()),
-                title: "Response body exceeded configured size limit".to_string(),
-                retryable: false,
-                request_id: request_id.clone(),
-            },
-            Self::Transport(_) => PortableClientError {
-                kind: PortableErrorKind::Transport,
-                status: None,
-                code: Some("transport.failed".to_string()),
-                title: "Transport error".to_string(),
-                retryable: true,
-                request_id: None,
-            },
-            Self::Build(error) => PortableClientError {
-                kind: PortableErrorKind::Build,
-                status: None,
-                code: Some(
-                    match error {
-                        NotaryClientBuildError::Url(_) => "build.invalid_url",
-                        NotaryClientBuildError::InsecureBaseUrl => "build.insecure_base_url",
-                        NotaryClientBuildError::MultipleAuthModes => "build.multiple_auth_modes",
-                        NotaryClientBuildError::PurposeConflict => "request.purpose_conflict",
-                        NotaryClientBuildError::RequestSerialization => {
-                            "request.serialization_failed"
-                        }
-                        NotaryClientBuildError::UnsupportedIdempotencyKey => {
-                            "request.unsupported_idempotency_key"
-                        }
-                        NotaryClientBuildError::BatchTooLarge { .. } => "batch.too_large",
-                    }
-                    .to_string(),
-                ),
-                title: error.to_string(),
-                retryable: false,
-                request_id: None,
-            },
-        }
-    }
-}
-
-pub(crate) fn parse_retry_after(raw: Option<&str>, date_raw: Option<&str>) -> Option<RetryAfter> {
-    let raw = raw?.trim();
-    if raw.is_empty() {
-        return None;
-    }
-    if let Ok(seconds) = raw.parse::<u64>() {
-        return Some(RetryAfter::Delta(Duration::from_secs(seconds)));
-    }
-    if let (Some(retry_at), Some(server_at)) = (
-        parse_http_date(raw),
-        date_raw.and_then(|value| parse_http_date(value.trim())),
-    ) {
-        let delta = retry_at - server_at;
-        if delta <= time::Duration::ZERO {
-            return Some(RetryAfter::Delta(Duration::ZERO));
-        }
-        return Some(RetryAfter::Delta(Duration::new(
-            delta.whole_seconds() as u64,
-            delta.subsec_nanoseconds() as u32,
-        )));
-    }
-    Some(RetryAfter::HttpDate(raw.to_string()))
-}
-
-fn parse_http_date(raw: &str) -> Option<OffsetDateTime> {
-    OffsetDateTime::parse(raw, &Rfc2822).ok()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn retry_after_http_date_uses_server_date_for_delta() {
-        let retry_after = parse_retry_after(
-            Some("Wed, 31 Dec 2099 00:00:02 GMT"),
-            Some("Wed, 31 Dec 2099 00:00:00 GMT"),
-        );
-
-        assert_eq!(retry_after, Some(RetryAfter::Delta(Duration::from_secs(2))));
-    }
-
-    #[test]
-    fn retry_after_http_date_without_valid_date_preserves_raw_value() {
-        let retry_after = parse_retry_after(Some("Wed, 31 Dec 2099 00:00:02 GMT"), None);
-
-        assert_eq!(
-            retry_after,
-            Some(RetryAfter::HttpDate(
-                "Wed, 31 Dec 2099 00:00:02 GMT".to_string()
-            ))
-        );
-    }
-}
diff --git a/crates/registry-notary-client/src/facade.rs b/crates/registry-notary-client/src/facade.rs
deleted file mode 100644
index 63820ab9a..000000000
--- a/crates/registry-notary-client/src/facade.rs
+++ /dev/null
@@ -1,144 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Binding-safe JSON facade over the typed client.
-
-use registry_notary_core::{
-    BatchEvaluateRequest, CredentialIssueRequest, EvaluateRequest, RenderRequest,
-};
-
-use crate::{PortableClientError, RegistryNotaryClient, RequestOptions};
-
-/// JSON facade for language bindings.
-///
-/// Inputs and outputs use canonical wire JSON shape: snake_case field names and
-/// the same request/response structure as the HTTP API. The facade converts typed client
-/// errors into redacted [`PortableClientError`] values.
-#[derive(Debug, Clone)]
-pub struct NotaryClientHandle {
-    client: RegistryNotaryClient,
-}
-
-impl NotaryClientHandle {
-    /// Wrap a typed client.
-    #[must_use]
-    pub fn new(client: RegistryNotaryClient) -> Self {
-        Self { client }
-    }
-
-    /// Submit canonical JSON for `POST /v1/evaluations`.
-    pub async fn evaluate_json(
-        &self,
-        request: serde_json::Value,
-        options: serde_json::Value,
-    ) -> Result<serde_json::Value, PortableClientError> {
-        let request = parse_value::<EvaluateRequest>(request)?;
-        let options = parse_options(options)?;
-        self.client
-            .evaluate_request(request, options)
-            .await
-            .map(|response| serde_json::to_value(response.body).expect("response serializes"))
-            .map_err(|error| error.portable())
-    }
-
-    /// Submit canonical JSON for `POST /v1/batch-evaluations`.
-    pub async fn batch_evaluate_json(
-        &self,
-        request: serde_json::Value,
-        options: serde_json::Value,
-    ) -> Result<serde_json::Value, PortableClientError> {
-        let request = parse_value::<BatchEvaluateRequest>(request)?;
-        let options = parse_options(options)?;
-        self.client
-            .batch_evaluate_request(request, options)
-            .await
-            .map(|response| serde_json::to_value(response.body).expect("response serializes"))
-            .map_err(|error| error.portable())
-    }
-
-    /// Submit canonical JSON for `POST /v1/evaluations/{evaluation_id}/render`.
-    pub async fn render_json(
-        &self,
-        request: serde_json::Value,
-        options: serde_json::Value,
-    ) -> Result<serde_json::Value, PortableClientError> {
-        let request = parse_value::<RenderRequest>(request)?;
-        let options = parse_options(options)?;
-        self.client
-            .render_request(request, options)
-            .await
-            .map(|response| response.body)
-            .map_err(|error| error.portable())
-    }
-
-    /// Submit canonical JSON for `POST /v1/credentials`.
-    pub async fn issue_credential_json(
-        &self,
-        request: serde_json::Value,
-        options: serde_json::Value,
-    ) -> Result<serde_json::Value, PortableClientError> {
-        let request = parse_value::<CredentialIssueRequest>(request)?;
-        let options = parse_options(options)?;
-        self.client
-            .issue_credential_request(request, options)
-            .await
-            .map(|response| serde_json::to_value(response.body).expect("response serializes"))
-            .map_err(|error| error.portable())
-    }
-
-    /// Fetch `GET /v1/claims`.
-    pub async fn list_claims_json(
-        &self,
-        options: serde_json::Value,
-    ) -> Result<serde_json::Value, PortableClientError> {
-        let options = parse_options(options)?;
-        self.client
-            .list_claims(options)
-            .await
-            .map(|response| serde_json::to_value(response.body).expect("response serializes"))
-            .map_err(|error| error.portable())
-    }
-
-    /// Fetch `GET /v1/claims/{claim_id}`.
-    pub async fn get_claim_json(
-        &self,
-        claim_id: String,
-        options: serde_json::Value,
-    ) -> Result<serde_json::Value, PortableClientError> {
-        let options = parse_options(options)?;
-        self.client
-            .get_claim(&claim_id, options)
-            .await
-            .map(|response| response.body)
-            .map_err(|error| error.portable())
-    }
-
-    /// Fetch `GET /v1/credentials/{credential_id}/status`.
-    pub async fn credential_status_json(
-        &self,
-        credential_id: String,
-        options: serde_json::Value,
-    ) -> Result<serde_json::Value, PortableClientError> {
-        let options = parse_options(options)?;
-        self.client
-            .credential_status(&credential_id, options)
-            .await
-            .map(|response| serde_json::to_value(response.body).expect("response serializes"))
-            .map_err(|error| error.portable())
-    }
-}
-
-fn parse_options(options: serde_json::Value) -> Result<RequestOptions, PortableClientError> {
-    parse_value::<RequestOptions>(options)
-}
-
-fn parse_value<T: serde::de::DeserializeOwned>(
-    value: serde_json::Value,
-) -> Result<T, PortableClientError> {
-    serde_json::from_value(value).map_err(|_| PortableClientError {
-        kind: crate::PortableErrorKind::Decode,
-        status: None,
-        code: Some("decode.failed".to_string()),
-        title: "Failed to decode request JSON".to_string(),
-        retryable: false,
-        request_id: None,
-    })
-}
diff --git a/crates/registry-notary-client/src/federation/mod.rs b/crates/registry-notary-client/src/federation/mod.rs
deleted file mode 100644
index 525ad15d7..000000000
--- a/crates/registry-notary-client/src/federation/mod.rs
+++ /dev/null
@@ -1,4 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Federation helper module.
-
-pub use crate::client::RegistryNotaryClient;
diff --git a/crates/registry-notary-client/src/headers.rs b/crates/registry-notary-client/src/headers.rs
deleted file mode 100644
index af384ad3c..000000000
--- a/crates/registry-notary-client/src/headers.rs
+++ /dev/null
@@ -1,12 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Header and media-type constants for Registry Notary clients.
-
-pub const DATA_PURPOSE: &str = "data-purpose";
-pub const IDEMPOTENCY_KEY: &str = "Idempotency-Key";
-pub const REQUEST_ID: &str = "x-request-id";
-pub const TRACEPARENT: &str = "traceparent";
-pub const RETRY_AFTER: &str = "retry-after";
-pub const DATE: &str = "date";
-pub const APPLICATION_JSON: &str = "application/json";
-pub const APPLICATION_PROBLEM_JSON: &str = "application/problem+json";
-pub const APPLICATION_JWT: &str = "application/jwt";
diff --git a/crates/registry-notary-client/src/lib.rs b/crates/registry-notary-client/src/lib.rs
deleted file mode 100644
index 587dcc958..000000000
--- a/crates/registry-notary-client/src/lib.rs
+++ /dev/null
@@ -1,94 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Typed Registry Notary HTTP client.
-//!
-//! This crate is the Rust client for Registry Notary. It wraps the HTTP API
-//! with typed request and response types, strict transport defaults, bounded
-//! response reads, route-aware retries, and redacted error surfaces.
-//!
-//! # Quick start
-//!
-//! ```no_run
-//! # async fn run() -> Result<(), Box<dyn std::error::Error>> {
-//! use registry_notary_client::RegistryNotaryClient;
-//!
-//! let client = RegistryNotaryClient::builder("https://notary.example.gov")
-//!     .bearer_token("token")
-//!     .default_purpose("benefits_eligibility")
-//!     .user_agent("benefits-api/1.0")
-//!     .build()?;
-//!
-//! let evaluation = client
-//!     .evaluate_target("Person")
-//!     .target_identifier("national_id", "person-1")
-//!     .relationship("self")
-//!     .claims(["person-is-alive"])
-//!     .disclosure("predicate")
-//!     .send()
-//!     .await?;
-//!
-//! if let Some(result) = evaluation.body.first_result() {
-//!     println!("{} = {:?}", result.claim_id, result.satisfied);
-//! }
-//! # Ok(())
-//! # }
-//! ```
-//!
-//! # Wire request types and helper wrappers
-//!
-//! Request types come from `registry-notary-core` for routes whose wire shapes
-//! are part of the service contract. Batch evaluation now uses
-//! [`registry_notary_core::BatchEvaluateResponse`] directly. The helper
-//! wrappers in [`responses`] are not compatibility workarounds; they add
-//! redacted formatting or ergonomic accessors on top of the wire responses.
-//!
-//! # Feature flags
-//!
-//! - `oid4vci` enables OpenID4VCI endpoint helpers.
-//! - `federation` enables delegated evaluation JWS submission.
-//! - `json-facade` enables a binding-safe JSON facade for Python and Node
-//!   wrappers.
-//! - `verifier` enables explicit, opt-in SD-JWT VC verification helpers.
-//! - `test-support` exposes the test-only `reqwest::Client` override and
-//!   loopback HTTP allowance.
-//!
-//! # Safety contract
-//!
-//! The client rejects multiple authentication modes, disables redirects,
-//! ignores proxy environment variables, bounds every response body, and redacts
-//! raw Problem Details `detail`, compact credentials, holder proofs, nonces,
-//! SD-JWT disclosures, and token material from incidental formatting surfaces.
-
-pub mod auth;
-mod client;
-pub mod error;
-pub mod headers;
-pub mod options;
-pub mod responses;
-
-#[cfg(feature = "json-facade")]
-pub mod facade;
-#[cfg(feature = "federation")]
-pub mod federation;
-#[cfg(feature = "oid4vci")]
-pub mod oid4vci;
-#[cfg(feature = "verifier")]
-pub mod verifier;
-
-pub use client::{EvaluateBuilder, NotaryClientBuilder, RegistryNotaryClient};
-pub use error::{
-    NotaryClientBuildError, NotaryClientError, Oid4vciError, PortableClientError,
-    PortableErrorKind, ProblemDetails,
-};
-pub use options::{RequestOptions, RetryAfter, RetryPolicy};
-pub use responses::{
-    AdminReloadResponse, CredentialIssueResponse, CredentialStatusResponse,
-    CredentialStatusUpdateRequest, EnabledSignerSurfaceChecks, EvaluateResponse, Evaluation,
-    FormatsResponse, HealthResponse, ListClaimsResponse, NotaryResponse, ReadinessChecks,
-    ReadinessResponse, SignerCustodyChecks, SignerCustodySurfaces, SignerSurfaceChecks,
-    SigningProviderReadinessChecks,
-};
-#[cfg(feature = "verifier")]
-pub use verifier::{
-    HolderBindingPolicy, StatusListPolicy, StatusListPolicyError, VerificationError,
-    VerifiedCredential, VerifyOptions,
-};
diff --git a/crates/registry-notary-client/src/oid4vci/metadata.rs b/crates/registry-notary-client/src/oid4vci/metadata.rs
deleted file mode 100644
index 0c46adf9d..000000000
--- a/crates/registry-notary-client/src/oid4vci/metadata.rs
+++ /dev/null
@@ -1,6 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! OpenID4VCI metadata re-exports.
-
-pub use registry_platform_oid4vci::{
-    CredentialIssuerMetadata, CredentialOffer, CredentialRequest, CredentialResponse,
-};
diff --git a/crates/registry-notary-client/src/oid4vci/mod.rs b/crates/registry-notary-client/src/oid4vci/mod.rs
deleted file mode 100644
index b7cede456..000000000
--- a/crates/registry-notary-client/src/oid4vci/mod.rs
+++ /dev/null
@@ -1,4 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! OpenID4VCI helper module.
-
-pub mod metadata;
diff --git a/crates/registry-notary-client/src/options.rs b/crates/registry-notary-client/src/options.rs
deleted file mode 100644
index 28888cb3e..000000000
--- a/crates/registry-notary-client/src/options.rs
+++ /dev/null
@@ -1,137 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Per-request options and retry policy.
-
-use std::time::Duration;
-
-/// Per-request options shared by route methods.
-///
-/// These map to safe request headers. Unsupported combinations, such as an
-/// idempotency key on a route that does not honor it, are rejected before a
-/// request is sent.
-#[derive(Debug, Clone, Default, serde::Serialize, serde::Deserialize)]
-#[non_exhaustive]
-pub struct RequestOptions {
-    /// Data-purpose value sent as the `Data-Purpose` header.
-    pub purpose: Option<String>,
-    /// Caller-supplied request id sent as `X-Request-Id`.
-    pub request_id: Option<String>,
-    /// `Idempotency-Key` for routes that explicitly support replay-safe POST.
-    pub idempotency_key: Option<String>,
-    /// Override the route's default `Accept` header.
-    pub accept: Option<String>,
-    /// W3C trace context header to propagate to the server.
-    pub traceparent: Option<String>,
-}
-
-impl RequestOptions {
-    /// Start building request options fluently.
-    #[must_use]
-    pub fn builder() -> RequestOptionsBuilder {
-        RequestOptionsBuilder::default()
-    }
-
-    pub(crate) fn is_empty(&self) -> bool {
-        self.purpose.is_none()
-            && self.request_id.is_none()
-            && self.idempotency_key.is_none()
-            && self.accept.is_none()
-            && self.traceparent.is_none()
-    }
-}
-
-/// Builder for [`RequestOptions`].
-#[derive(Debug, Clone, Default)]
-pub struct RequestOptionsBuilder {
-    options: RequestOptions,
-}
-
-impl RequestOptionsBuilder {
-    /// Set the `Data-Purpose` header.
-    #[must_use]
-    pub fn purpose(mut self, purpose: impl Into<String>) -> Self {
-        self.options.purpose = Some(purpose.into());
-        self
-    }
-
-    /// Set the `X-Request-Id` header.
-    #[must_use]
-    pub fn request_id(mut self, request_id: impl Into<String>) -> Self {
-        self.options.request_id = Some(request_id.into());
-        self
-    }
-
-    /// Set the `Idempotency-Key` header.
-    ///
-    /// The client only permits this on batch evaluation, where the server has a
-    /// replay contract.
-    #[must_use]
-    pub fn idempotency_key(mut self, key: impl Into<String>) -> Self {
-        self.options.idempotency_key = Some(key.into());
-        self
-    }
-
-    /// Override the `Accept` header for this request.
-    #[must_use]
-    pub fn accept(mut self, accept: impl Into<String>) -> Self {
-        self.options.accept = Some(accept.into());
-        self
-    }
-
-    /// Set the W3C `traceparent` header.
-    #[must_use]
-    pub fn traceparent(mut self, traceparent: impl Into<String>) -> Self {
-        self.options.traceparent = Some(traceparent.into());
-        self
-    }
-
-    /// Finish building the options.
-    #[must_use]
-    pub fn build(self) -> RequestOptions {
-        self.options
-    }
-}
-
-/// Route-aware retry policy.
-///
-/// Retries are conservative by default. GET routes may retry when the selected
-/// error class is enabled. Batch evaluation may retry only when an
-/// `Idempotency-Key` is supplied. Non-deduplicated POST routes such as
-/// evaluation, render, credential issuance, OID4VCI credential, and federation
-/// submission are not retried even when this policy allows retryable errors.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct RetryPolicy {
-    /// Maximum attempts, including the first request.
-    pub max_attempts: usize,
-    /// Base exponential-backoff delay.
-    pub base_delay: Duration,
-    /// Maximum delay between attempts.
-    pub max_delay: Duration,
-    /// Retry transport errors on retry-eligible routes.
-    pub retry_transport_errors: bool,
-    /// Retry HTTP 429 on retry-eligible routes.
-    pub retry_rate_limited: bool,
-    /// Retry HTTP 503 on retry-eligible routes.
-    pub retry_unavailable: bool,
-}
-
-impl Default for RetryPolicy {
-    fn default() -> Self {
-        Self {
-            max_attempts: 1,
-            base_delay: Duration::from_millis(50),
-            max_delay: Duration::from_secs(1),
-            retry_transport_errors: false,
-            retry_rate_limited: false,
-            retry_unavailable: false,
-        }
-    }
-}
-
-/// Parsed `Retry-After` header value.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum RetryAfter {
-    /// Delta-seconds form.
-    Delta(Duration),
-    /// HTTP-date form. Callers can log or interpret this if needed.
-    HttpDate(String),
-}
diff --git a/crates/registry-notary-client/src/responses.rs b/crates/registry-notary-client/src/responses.rs
deleted file mode 100644
index e73e92c12..000000000
--- a/crates/registry-notary-client/src/responses.rs
+++ /dev/null
@@ -1,343 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Client-owned response types and ergonomic wrappers.
-
-use std::{collections::BTreeMap, fmt};
-
-use registry_notary_core::{BatchEvaluateResponse, ClaimResultView};
-use reqwest::StatusCode;
-use serde::{Deserialize, Serialize};
-
-use crate::options::RetryAfter;
-
-#[doc(hidden)]
-pub trait SafeDebug {
-    fn fmt_debug(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result;
-}
-
-macro_rules! impl_safe_debug {
-    ($($t:ty),* $(,)?) => {
-        $(
-            impl SafeDebug for $t {
-                fn fmt_debug(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-                    fmt::Debug::fmt(self, f)
-                }
-            }
-        )*
-    };
-}
-
-/// Response body for `POST /v1/evaluations`.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct EvaluateResponse {
-    /// Claim results returned by the server.
-    pub results: Vec<ClaimResultView>,
-}
-
-/// Response body for `GET /v1/claims`.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ListClaimsResponse {
-    /// Claim definitions as server-owned JSON documents.
-    pub data: Vec<serde_json::Value>,
-}
-
-/// Response body for `GET /v1/formats`.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct FormatsResponse {
-    /// Supported evidence formats.
-    pub formats: Vec<registry_notary_core::EvidenceFormat>,
-}
-
-/// Response body for direct credential issuance.
-///
-/// This contains credential material intentionally. `Debug` redacts the compact
-/// credential, issuer-signed JWT, and disclosures.
-#[derive(Clone, Serialize, Deserialize)]
-pub struct CredentialIssueResponse {
-    /// Server credential id.
-    pub credential_id: String,
-    /// Credential profile used for issuance.
-    pub credential_profile: String,
-    /// Credential format, for example SD-JWT VC.
-    pub format: String,
-    /// Issuer identifier.
-    pub issuer: String,
-    /// Credential expiry timestamp.
-    pub expires_at: String,
-    /// Compact credential body.
-    pub credential: String,
-    /// Issuer-signed JWT component.
-    pub issuer_signed_jwt: String,
-    /// SD-JWT disclosures.
-    pub disclosures: Vec<String>,
-}
-
-impl fmt::Debug for CredentialIssueResponse {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("CredentialIssueResponse")
-            .field("credential_id", &self.credential_id)
-            .field("credential_profile", &self.credential_profile)
-            .field("format", &self.format)
-            .field("issuer", &self.issuer)
-            .field("expires_at", &self.expires_at)
-            .field("credential", &"<redacted>")
-            .field("issuer_signed_jwt", &"<redacted>")
-            .field("disclosures", &"<redacted>")
-            .finish()
-    }
-}
-
-/// Response body for credential status lookup and update.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct CredentialStatusResponse {
-    /// Server credential id.
-    pub credential_id: String,
-    /// Issuer identifier.
-    pub issuer: String,
-    /// Credential profile used for issuance.
-    pub credential_profile: String,
-    /// Current lifecycle status.
-    pub status: String,
-    /// Issuance timestamp.
-    pub issued_at: String,
-    /// Expiry timestamp.
-    pub expires_at: String,
-    /// Last status update timestamp.
-    pub updated_at: String,
-}
-
-/// Request body for admin credential status update.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct CredentialStatusUpdateRequest {
-    /// New status value.
-    pub status: String,
-}
-
-/// Response body for `POST /admin/v1/reload`.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct AdminReloadResponse {
-    /// Whether reload executed.
-    pub reloaded: bool,
-    /// Reload status.
-    pub status: String,
-    /// Human-readable detail.
-    pub detail: String,
-}
-
-/// Health response body.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct HealthResponse {
-    /// Overall status.
-    pub status: String,
-    /// Service-specific checks.
-    pub checks: serde_json::Value,
-}
-
-/// Readiness response body.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct ReadinessResponse {
-    /// Overall readiness status.
-    pub status: String,
-    /// Readiness checks, including signer-custody facts.
-    pub checks: ReadinessChecks,
-}
-
-/// Aggregate readiness checks returned on both success and failure.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct ReadinessChecks {
-    /// Total number of readiness checks.
-    pub total: usize,
-    /// Checks that are ready.
-    pub ok: usize,
-    /// Checks that are serving with reduced assurance.
-    pub degraded: usize,
-    /// Checks that are not ready.
-    pub failed: usize,
-    /// Signing-provider health and custody facts.
-    pub signing_providers: SigningProviderReadinessChecks,
-}
-
-/// Runtime signer health and custody checks.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct SigningProviderReadinessChecks {
-    /// Active signing providers checked by the runtime.
-    pub total: usize,
-    /// Signing providers that are ready.
-    pub ok: usize,
-    /// Signing providers that are not ready.
-    pub failed: usize,
-    /// Custody facts for configured signing roles.
-    pub custody: SignerCustodyChecks,
-}
-
-/// Public, non-secret signer-custody facts.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct SignerCustodyChecks {
-    /// Active provider kinds and their counts.
-    pub active_provider_counts: BTreeMap<String, usize>,
-    /// Distinct providers bound to custody-relevant signing roles.
-    pub signing_provider_count: usize,
-    /// Custody-relevant providers using local JWK or file material.
-    pub local_software_signing_provider_count: usize,
-    /// Whether the deployment profile requires explicit custody approval.
-    pub custody_approval_required: bool,
-    /// Whether the operator declared that custody review has approved the signers.
-    pub custody_approved: bool,
-    /// Custody-relevant providers not covered by approval.
-    pub unapproved_signing_provider_count: usize,
-    /// Counts grouped by signing surface.
-    pub surfaces: SignerCustodySurfaces,
-}
-
-/// Signer-custody facts grouped by Notary signing surface.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct SignerCustodySurfaces {
-    /// Credential issuance signer facts.
-    pub credential_issuance: SignerSurfaceChecks,
-    /// Access-token issuance signer facts.
-    pub access_token_issuance: EnabledSignerSurfaceChecks,
-    /// Federation response signer facts.
-    pub federation: EnabledSignerSurfaceChecks,
-}
-
-/// Signer counts for an always-available signing surface.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct SignerSurfaceChecks {
-    /// Distinct signing providers used by the surface.
-    pub signing_provider_count: usize,
-    /// Surface providers using local JWK or file material.
-    pub local_software_signing_provider_count: usize,
-    /// Surface providers not covered by custody approval.
-    pub unapproved_signing_provider_count: usize,
-}
-
-/// Signer counts for an optional signing surface.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct EnabledSignerSurfaceChecks {
-    /// Whether the optional surface is enabled.
-    pub enabled: bool,
-    /// Distinct signing providers used by the surface.
-    pub signing_provider_count: usize,
-    /// Surface providers using local JWK or file material.
-    pub local_software_signing_provider_count: usize,
-    /// Surface providers not covered by custody approval.
-    pub unapproved_signing_provider_count: usize,
-}
-
-impl_safe_debug!(
-    EvaluateResponse,
-    ListClaimsResponse,
-    FormatsResponse,
-    CredentialIssueResponse,
-    CredentialStatusResponse,
-    AdminReloadResponse,
-    HealthResponse,
-    ReadinessResponse,
-    ReadinessChecks,
-    SigningProviderReadinessChecks,
-    SignerCustodyChecks,
-    SignerCustodySurfaces,
-    SignerSurfaceChecks,
-    EnabledSignerSurfaceChecks,
-    BatchEvaluateResponse,
-    serde_json::Value,
-    String,
-);
-
-impl<T: fmt::Debug> SafeDebug for Vec<T> {
-    fn fmt_debug(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        fmt::Debug::fmt(self, f)
-    }
-}
-
-#[cfg(feature = "oid4vci")]
-impl_safe_debug!(
-    registry_platform_oid4vci::CredentialIssuerMetadata,
-    registry_platform_oid4vci::CredentialOffer,
-);
-
-#[cfg(feature = "oid4vci")]
-impl SafeDebug for registry_platform_oid4vci::CredentialResponse {
-    fn fmt_debug(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str("<redacted>")
-    }
-}
-
-/// HTTP response wrapper returned by all typed client methods.
-///
-/// The wrapper preserves selected response metadata captured before body
-/// decoding. `Debug` uses [`SafeDebug`] to avoid accidental credential leaks for
-/// sensitive body types.
-#[derive(Clone)]
-pub struct NotaryResponse<T> {
-    /// Decoded response body.
-    pub body: T,
-    /// HTTP status returned by the server.
-    pub status: StatusCode,
-    /// Server `X-Request-Id`, when present.
-    pub request_id: Option<String>,
-    /// Server `Retry-After`, when present.
-    pub retry_after: Option<RetryAfter>,
-}
-
-struct SafeDebugBody<'a, T>(&'a T);
-
-impl<T: SafeDebug> fmt::Debug for SafeDebugBody<'_, T> {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        self.0.fmt_debug(f)
-    }
-}
-
-impl<T: SafeDebug> fmt::Debug for NotaryResponse<T> {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("NotaryResponse")
-            .field("body", &SafeDebugBody(&self.body))
-            .field("status", &self.status)
-            .field("request_id", &self.request_id)
-            .field("retry_after", &self.retry_after)
-            .finish()
-    }
-}
-
-impl<T> NotaryResponse<T> {
-    pub(crate) fn map<U>(self, body: U) -> NotaryResponse<U> {
-        NotaryResponse {
-            body,
-            status: self.status,
-            request_id: self.request_id,
-            retry_after: self.retry_after,
-        }
-    }
-}
-
-/// Ergonomic wrapper over an evaluation response.
-#[derive(Debug, Clone)]
-pub struct Evaluation {
-    /// Claim results returned by the server.
-    pub results: Vec<ClaimResultView>,
-}
-
-impl Evaluation {
-    /// Return the first result's evaluation id.
-    #[must_use]
-    pub fn evaluation_id(&self) -> Option<&str> {
-        self.results
-            .first()
-            .map(|result| result.evaluation_id.as_str())
-    }
-
-    /// Return the first claim result.
-    #[must_use]
-    pub fn first_result(&self) -> Option<&ClaimResultView> {
-        self.results.first()
-    }
-
-    /// Return the first result matching `claim_id`.
-    #[must_use]
-    pub fn result_for(&self, claim_id: &str) -> Option<&ClaimResultView> {
-        self.results
-            .iter()
-            .find(|result| result.claim_id == claim_id)
-    }
-}
-
-impl_safe_debug!(Evaluation);
diff --git a/crates/registry-notary-client/src/verifier.rs b/crates/registry-notary-client/src/verifier.rs
deleted file mode 100644
index b446f8b16..000000000
--- a/crates/registry-notary-client/src/verifier.rs
+++ /dev/null
@@ -1,1434 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Explicit SD-JWT VC verification helpers.
-
-use std::collections::BTreeSet;
-use std::fmt;
-use std::io::Read;
-use std::time::Duration;
-
-use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-use base64::Engine;
-use flate2::read::ZlibDecoder;
-use registry_notary_core::SD_JWT_VC_JWT_TYP;
-use registry_platform_crypto::{verify, PublicJwk, SigningAlgorithm};
-use registry_platform_httputil::{read_bounded, BoundedReadError, FetchUrlError, FetchUrlPolicy};
-use reqwest::header::{ACCEPT, ACCEPT_ENCODING, CONTENT_ENCODING, CONTENT_TYPE};
-use reqwest::{StatusCode, Url};
-use serde_json::Value;
-use sha2::{Digest, Sha256};
-use thiserror::Error;
-use time::OffsetDateTime;
-
-const STATUS_LIST_MEDIA_TYPE: &str = "application/statuslist+jwt";
-const STATUS_LIST_FETCH_TIMEOUT: Duration = Duration::from_secs(10);
-const STATUS_LIST_DNS_TIMEOUT: Duration = Duration::from_secs(3);
-const MAX_STATUS_LIST_RESPONSE_BYTES: u64 = 256 * 1024;
-const MAX_STATUS_LIST_COMPRESSED_BYTES: usize = 128 * 1024;
-const MAX_STATUS_LIST_DECOMPRESSED_BYTES: usize = 128 * 1024;
-const MAX_STATUS_LIST_URI_BYTES: usize = 4_096;
-const MAX_STATUS_LIST_ORIGINS: usize = 16;
-const MAX_STATUS_LIST_TOKEN_LIFETIME_SECONDS: i64 = 300;
-const MAX_STATUS_LIST_CLOCK_SKEW_SECONDS: u64 = 60;
-
-/// Trusted status-list origins associated with exactly one credential issuer.
-///
-/// The primary origin is required. Additional origins are accepted only after
-/// the caller adds each exact HTTPS origin explicitly. Paths, queries,
-/// fragments, URL credentials, localhost, private networks, and unsafe DNS
-/// answers are still rejected by the fetch path.
-#[derive(Clone, PartialEq, Eq)]
-pub struct StatusListPolicy {
-    issuer: String,
-    origins: BTreeSet<String>,
-    #[cfg(any(test, feature = "test-support"))]
-    allow_loopback_http: bool,
-}
-
-impl fmt::Debug for StatusListPolicy {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("StatusListPolicy")
-            .field("issuer", &"<redacted>")
-            .field("trusted_origin_count", &self.origins.len())
-            .finish()
-    }
-}
-
-impl StatusListPolicy {
-    /// Bind an issuer to its primary trusted HTTPS status origin.
-    pub fn new(
-        issuer: impl Into<String>,
-        trusted_origin: impl AsRef<str>,
-    ) -> Result<Self, StatusListPolicyError> {
-        let issuer = issuer.into();
-        if issuer.trim().is_empty() {
-            return Err(StatusListPolicyError::InvalidIssuer);
-        }
-        let origin = parse_status_origin(trusted_origin.as_ref(), false)?;
-        Ok(Self {
-            issuer,
-            origins: BTreeSet::from([origin]),
-            #[cfg(any(test, feature = "test-support"))]
-            allow_loopback_http: false,
-        })
-    }
-
-    /// Add one exact HTTPS origin that is trusted for the same issuer.
-    pub fn allow_origin(mut self, origin: impl AsRef<str>) -> Result<Self, StatusListPolicyError> {
-        if self.origins.len() >= MAX_STATUS_LIST_ORIGINS {
-            return Err(StatusListPolicyError::TooManyOrigins);
-        }
-        let origin = parse_status_origin(origin.as_ref(), false)?;
-        self.origins.insert(origin);
-        Ok(self)
-    }
-
-    /// Construct a loopback-only HTTP policy for local test harnesses.
-    ///
-    /// This escape hatch is absent from production release builds. It does not
-    /// admit non-loopback HTTP origins.
-    #[cfg(any(test, feature = "test-support"))]
-    pub fn loopback_for_testing(
-        issuer: impl Into<String>,
-        trusted_origin: impl AsRef<str>,
-    ) -> Result<Self, StatusListPolicyError> {
-        let issuer = issuer.into();
-        if issuer.trim().is_empty() {
-            return Err(StatusListPolicyError::InvalidIssuer);
-        }
-        let origin = parse_status_origin(trusted_origin.as_ref(), true)?;
-        Ok(Self {
-            issuer,
-            origins: BTreeSet::from([origin]),
-            allow_loopback_http: true,
-        })
-    }
-
-    fn permits(&self, issuer: &str, url: &Url) -> Result<(), VerificationError> {
-        if self.issuer != issuer {
-            return Err(VerificationError::StatusPolicy {
-                code: "status.policy_issuer_mismatch",
-            });
-        }
-        let origin = url.origin().ascii_serialization();
-        if !self.origins.contains(&origin) {
-            return Err(VerificationError::StatusPolicy {
-                code: "status.origin_untrusted",
-            });
-        }
-        Ok(())
-    }
-
-    fn fetch_url_policy(&self) -> FetchUrlPolicy {
-        #[cfg(any(test, feature = "test-support"))]
-        if self.allow_loopback_http {
-            return FetchUrlPolicy::dev();
-        }
-        FetchUrlPolicy::strict()
-    }
-}
-
-/// Invalid caller-owned status trust configuration.
-#[derive(Debug, Error, Clone, PartialEq, Eq)]
-#[non_exhaustive]
-pub enum StatusListPolicyError {
-    #[error("status-list issuer must not be empty")]
-    InvalidIssuer,
-    #[error("status-list origin must be an exact HTTPS origin")]
-    InvalidOrigin,
-    #[error("status-list origin contains URL credentials or resource components")]
-    OriginHasResourceComponents,
-    #[error("status-list origin allow-list exceeds the supported bound")]
-    TooManyOrigins,
-}
-
-/// Caller-owned policy for explicit SD-JWT VC verification.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct VerifyOptions {
-    /// Issuer identifier expected in the `iss` claim.
-    pub expected_issuer: String,
-    /// Accepted JWS algorithms. Defaults to `EdDSA`.
-    pub accepted_algorithms: BTreeSet<String>,
-    /// Expected SD-JWT VC `vct`, when the caller wants a concrete profile.
-    pub expected_vct: Option<String>,
-    /// Allowed skew for `exp`, `nbf`, and future `iat` checks.
-    pub clock_skew: Duration,
-    /// Holder-binding policy for the embedded `cnf` confirmation.
-    pub holder_binding: HolderBindingPolicy,
-    /// Expected key-binding JWT audience for verifier-controlled challenges.
-    pub expected_key_binding_audience: Option<String>,
-    /// Expected key-binding JWT nonce for verifier-controlled challenges.
-    pub expected_key_binding_nonce: Option<String>,
-    /// Mandatory trust policy when the credential carries a status reference.
-    pub status_list: Option<StatusListPolicy>,
-    /// Test hook for deterministic time checks. Production callers should leave
-    /// this unset.
-    pub now: Option<OffsetDateTime>,
-}
-
-impl VerifyOptions {
-    #[must_use]
-    pub fn new(expected_issuer: impl Into<String>) -> Self {
-        Self {
-            expected_issuer: expected_issuer.into(),
-            accepted_algorithms: BTreeSet::from(["EdDSA".to_string()]),
-            expected_vct: None,
-            clock_skew: Duration::from_secs(60),
-            holder_binding: HolderBindingPolicy::NotRequired,
-            expected_key_binding_audience: None,
-            expected_key_binding_nonce: None,
-            status_list: None,
-            now: None,
-        }
-    }
-
-    #[must_use]
-    pub fn expected_vct(mut self, expected_vct: impl Into<String>) -> Self {
-        self.expected_vct = Some(expected_vct.into());
-        self
-    }
-
-    #[must_use]
-    pub fn accepted_algorithms(
-        mut self,
-        algorithms: impl IntoIterator<Item = impl Into<String>>,
-    ) -> Self {
-        self.accepted_algorithms = algorithms.into_iter().map(Into::into).collect();
-        self
-    }
-
-    #[must_use]
-    pub fn clock_skew(mut self, clock_skew: Duration) -> Self {
-        self.clock_skew = clock_skew;
-        self
-    }
-
-    #[must_use]
-    pub fn holder_binding(mut self, holder_binding: HolderBindingPolicy) -> Self {
-        self.holder_binding = holder_binding;
-        self
-    }
-
-    #[must_use]
-    pub fn key_binding_challenge(
-        mut self,
-        expected_audience: impl Into<String>,
-        expected_nonce: impl Into<String>,
-    ) -> Self {
-        self.expected_key_binding_audience = Some(expected_audience.into());
-        self.expected_key_binding_nonce = Some(expected_nonce.into());
-        self
-    }
-
-    /// Configure fail-closed verification for status-bearing credentials.
-    #[must_use]
-    pub fn status_list(mut self, policy: StatusListPolicy) -> Self {
-        self.status_list = Some(policy);
-        self
-    }
-
-    #[must_use]
-    pub fn now(mut self, now: OffsetDateTime) -> Self {
-        self.now = Some(now);
-        self
-    }
-}
-
-/// Holder-binding expectation for the credential confirmation.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum HolderBindingPolicy {
-    /// Do not require a holder confirmation.
-    NotRequired,
-    /// Require `cnf.jwk`, and validate that it is a public JWK.
-    Required,
-    /// Require `cnf.jwk` and this exact `cnf.kid`.
-    RequiredKid(String),
-}
-
-/// Verified credential metadata returned after successful verification.
-#[derive(Clone, PartialEq, Eq)]
-pub struct VerifiedCredential {
-    pub issuer: String,
-    pub subject: Option<String>,
-    pub credential_id: Option<String>,
-    pub vct: String,
-    pub key_id: String,
-    pub algorithm: String,
-    pub expires_at: i64,
-    pub not_before: Option<i64>,
-    pub issued_at: i64,
-    pub disclosure_count: usize,
-    pub holder_key_id: Option<String>,
-}
-
-impl fmt::Debug for VerifiedCredential {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("VerifiedCredential")
-            .field("issuer", &self.issuer)
-            .field("subject", &self.subject.as_ref().map(|_| "<redacted>"))
-            .field("credential_id", &self.credential_id)
-            .field("vct", &self.vct)
-            .field("key_id", &self.key_id)
-            .field("algorithm", &self.algorithm)
-            .field("expires_at", &self.expires_at)
-            .field("not_before", &self.not_before)
-            .field("issued_at", &self.issued_at)
-            .field("disclosure_count", &self.disclosure_count)
-            .field("holder_key_id", &self.holder_key_id)
-            .finish()
-    }
-}
-
-/// Redacted verifier error with a stable policy code.
-#[derive(Debug, Error, Clone, PartialEq, Eq)]
-#[non_exhaustive]
-pub enum VerificationError {
-    #[error("SD-JWT VC is malformed")]
-    Malformed { code: &'static str },
-    #[error("SD-JWT VC header uses an unsupported type")]
-    HeaderType { code: &'static str },
-    #[error("SD-JWT VC header contains an untrusted key reference")]
-    UntrustedKeyReference { code: &'static str },
-    #[error("SD-JWT VC algorithm is not accepted")]
-    AlgorithmDisallowed { code: &'static str },
-    #[error("SD-JWT VC signing key metadata does not match the header")]
-    AlgorithmKeyMismatch { code: &'static str },
-    #[error("SD-JWT VC signing key is missing")]
-    MissingKeyId { code: &'static str },
-    #[error("SD-JWT VC signing key is unknown")]
-    UnknownKey { code: &'static str },
-    #[error("SD-JWT VC signature is invalid")]
-    InvalidSignature { code: &'static str },
-    #[error("SD-JWT VC issuer does not match policy")]
-    IssuerMismatch { code: &'static str },
-    #[error("SD-JWT VC credential profile does not match policy")]
-    VctMismatch { code: &'static str },
-    #[error("SD-JWT VC time claim is invalid")]
-    TimeClaim { code: &'static str },
-    #[error("SD-JWT VC disclosure digest does not match")]
-    DisclosureDigestMismatch { code: &'static str },
-    #[error("SD-JWT VC holder binding does not match policy")]
-    HolderBinding { code: &'static str },
-    #[error("OID4VCI credential response does not contain a compact SD-JWT VC")]
-    UnsupportedCredentialShape { code: &'static str },
-    #[error("issuer JWKS could not be loaded")]
-    JwksUnavailable { code: &'static str },
-    #[error("credential status trust policy is missing or does not match")]
-    StatusPolicy { code: &'static str },
-    #[error("status-bearing credentials require the asynchronous client verifier")]
-    StatusVerificationRequired { code: &'static str },
-    #[error("credential status endpoint could not be reached safely")]
-    StatusFetch { code: &'static str },
-    #[error("credential status response does not satisfy transport policy")]
-    StatusResponse { code: &'static str },
-    #[error("credential status-list token is invalid")]
-    StatusToken { code: &'static str },
-    #[error("credential status is not valid")]
-    CredentialStatus { code: &'static str },
-}
-
-impl VerificationError {
-    #[must_use]
-    pub const fn code(&self) -> &'static str {
-        match self {
-            Self::Malformed { code }
-            | Self::HeaderType { code }
-            | Self::UntrustedKeyReference { code }
-            | Self::AlgorithmDisallowed { code }
-            | Self::AlgorithmKeyMismatch { code }
-            | Self::MissingKeyId { code }
-            | Self::UnknownKey { code }
-            | Self::InvalidSignature { code }
-            | Self::IssuerMismatch { code }
-            | Self::VctMismatch { code }
-            | Self::TimeClaim { code }
-            | Self::DisclosureDigestMismatch { code }
-            | Self::HolderBinding { code }
-            | Self::UnsupportedCredentialShape { code }
-            | Self::JwksUnavailable { code }
-            | Self::StatusPolicy { code }
-            | Self::StatusVerificationRequired { code }
-            | Self::StatusFetch { code }
-            | Self::StatusResponse { code }
-            | Self::StatusToken { code }
-            | Self::CredentialStatus { code } => code,
-        }
-    }
-
-    #[must_use]
-    pub const fn is_unknown_key(&self) -> bool {
-        matches!(self, Self::UnknownKey { .. })
-    }
-
-    #[must_use]
-    pub(crate) fn is_status_unknown_key(&self) -> bool {
-        matches!(self, Self::StatusToken { code } if *code == "status.key.unknown")
-    }
-
-    pub(crate) const fn jwks_unavailable() -> Self {
-        Self::JwksUnavailable {
-            code: "jwks.unavailable",
-        }
-    }
-}
-
-/// Verify one status-free SD-JWT VC against caller-supplied trusted JWKS.
-///
-/// A status-bearing credential always fails with `status.policy_required` or
-/// `status.fetch_required`. Use [`crate::RegistryNotaryClient::verify_sd_jwt_vc`]
-/// so the status material is fetched and verified under [`StatusListPolicy`].
-pub fn verify_sd_jwt_vc(
-    compact: &str,
-    jwks: &Value,
-    options: &VerifyOptions,
-) -> Result<VerifiedCredential, VerificationError> {
-    let pending = verify_sd_jwt_vc_pending(compact, jwks, options)?;
-    if pending.status.is_some() {
-        return if options.status_list.is_some() {
-            Err(VerificationError::StatusVerificationRequired {
-                code: "status.fetch_required",
-            })
-        } else {
-            Err(VerificationError::StatusPolicy {
-                code: "status.policy_required",
-            })
-        };
-    }
-    Ok(pending.credential)
-}
-
-pub(crate) struct PendingCredentialVerification {
-    pub(crate) credential: VerifiedCredential,
-    pub(crate) status: Option<StatusListReference>,
-}
-
-#[derive(Clone)]
-pub(crate) struct StatusListReference {
-    uri: Url,
-    index: u64,
-}
-
-pub(crate) fn verify_sd_jwt_vc_pending(
-    compact: &str,
-    jwks: &Value,
-    options: &VerifyOptions,
-) -> Result<PendingCredentialVerification, VerificationError> {
-    let parsed = ParsedSdJwt::parse(compact)?;
-    let header = decode_segment(parsed.header_b64)?;
-    let payload = decode_segment(parsed.payload_b64)?;
-
-    reject_untrusted_header_references(&header)?;
-    let alg = required_string(&header, "alg")?;
-    if !options.accepted_algorithms.contains(alg) {
-        return Err(VerificationError::AlgorithmDisallowed {
-            code: "algorithm.disallowed",
-        });
-    }
-    if header.get("typ").and_then(Value::as_str) != Some(SD_JWT_VC_JWT_TYP) {
-        return Err(VerificationError::HeaderType {
-            code: "header.typ_mismatch",
-        });
-    }
-    let kid = required_string(&header, "kid").map_err(|_| VerificationError::MissingKeyId {
-        code: "key.missing",
-    })?;
-    let jwk = find_jwk(jwks, kid)?;
-    if jwk_alg(&jwk) != Some(alg) || jwk.alg.as_deref().is_some_and(|jwk_alg| jwk_alg != alg) {
-        return Err(VerificationError::AlgorithmKeyMismatch {
-            code: "algorithm.key_mismatch",
-        });
-    }
-    let signature =
-        URL_SAFE_NO_PAD
-            .decode(parsed.signature_b64)
-            .map_err(|_| VerificationError::Malformed {
-                code: "token.malformed",
-            })?;
-    verify(parsed.signing_input().as_bytes(), &signature, &jwk).map_err(|_| {
-        VerificationError::InvalidSignature {
-            code: "signature.invalid",
-        }
-    })?;
-
-    verify_claims(&payload, &parsed, options, alg, kid)
-}
-
-fn verify_claims(
-    payload: &Value,
-    parsed: &ParsedSdJwt<'_>,
-    options: &VerifyOptions,
-    alg: &str,
-    kid: &str,
-) -> Result<PendingCredentialVerification, VerificationError> {
-    let issuer = required_string(payload, "iss")?;
-    if issuer != options.expected_issuer {
-        return Err(VerificationError::IssuerMismatch {
-            code: "claim.issuer_mismatch",
-        });
-    }
-    let vct = required_string(payload, "vct")?;
-    if options
-        .expected_vct
-        .as_deref()
-        .is_some_and(|expected| expected != vct)
-    {
-        return Err(VerificationError::VctMismatch {
-            code: "claim.vct_mismatch",
-        });
-    }
-
-    let now = options
-        .now
-        .unwrap_or_else(OffsetDateTime::now_utc)
-        .unix_timestamp();
-    let skew = i64::try_from(options.clock_skew.as_secs()).unwrap_or(i64::MAX);
-    let exp = required_i64(payload, "exp")?;
-    let iat = required_i64(payload, "iat")?;
-    let nbf = optional_i64(payload, "nbf")?;
-    if exp <= now.saturating_sub(skew) || iat > now.saturating_add(skew) {
-        return Err(VerificationError::TimeClaim {
-            code: "claim.time_invalid",
-        });
-    }
-    if let Some(nbf) = nbf {
-        if nbf > now.saturating_add(skew) {
-            return Err(VerificationError::TimeClaim {
-                code: "claim.time_invalid",
-            });
-        }
-    }
-
-    let disclosed_status = verify_disclosures(payload, &parsed.disclosures)?;
-    let holder_key_id = verify_holder_binding(HolderBindingContext {
-        payload,
-        policy: &options.holder_binding,
-        key_binding_jwt: parsed.key_binding_jwt,
-        sd_hash_input: parsed.sd_hash_input,
-        expected_audience: options.expected_key_binding_audience.as_deref(),
-        expected_nonce: options.expected_key_binding_nonce.as_deref(),
-        now,
-        skew,
-    })?;
-    let status = parse_status_reference(payload, disclosed_status.as_ref())?;
-    let credential = VerifiedCredential {
-        issuer: issuer.to_string(),
-        subject: payload
-            .get("sub")
-            .and_then(Value::as_str)
-            .map(ToString::to_string),
-        credential_id: payload
-            .get("jti")
-            .or_else(|| payload.get("id"))
-            .and_then(Value::as_str)
-            .map(ToString::to_string),
-        vct: vct.to_string(),
-        key_id: kid.to_string(),
-        algorithm: alg.to_string(),
-        expires_at: exp,
-        not_before: nbf,
-        issued_at: iat,
-        disclosure_count: parsed.disclosures.len(),
-        holder_key_id,
-    };
-    Ok(PendingCredentialVerification { credential, status })
-}
-
-fn parse_status_reference(
-    payload: &Value,
-    disclosed_status: Option<&Value>,
-) -> Result<Option<StatusListReference>, VerificationError> {
-    let status = match (payload.get("status"), disclosed_status) {
-        (None, None) => return Ok(None),
-        (Some(status), None) | (None, Some(status)) => status,
-        (Some(_), Some(_)) => {
-            return Err(VerificationError::StatusToken {
-                code: "status.reference_malformed",
-            })
-        }
-    };
-    let status_list = status
-        .as_object()
-        .and_then(|status| status.get("status_list"))
-        .and_then(Value::as_object)
-        .ok_or(VerificationError::StatusToken {
-            code: "status.reference_malformed",
-        })?;
-    let index =
-        status_list
-            .get("idx")
-            .and_then(Value::as_u64)
-            .ok_or(VerificationError::StatusToken {
-                code: "status.index.invalid",
-            })?;
-    let raw_uri = status_list
-        .get("uri")
-        .and_then(Value::as_str)
-        .filter(|uri| !uri.is_empty() && uri.len() <= MAX_STATUS_LIST_URI_BYTES)
-        .ok_or(VerificationError::StatusToken {
-            code: "status.reference_malformed",
-        })?;
-    let uri = Url::parse(raw_uri).map_err(|_| VerificationError::StatusToken {
-        code: "status.reference_malformed",
-    })?;
-    if uri.host().is_none()
-        || !uri.username().is_empty()
-        || uri.password().is_some()
-        || uri.fragment().is_some()
-    {
-        return Err(VerificationError::StatusToken {
-            code: "status.reference_malformed",
-        });
-    }
-    Ok(Some(StatusListReference { uri, index }))
-}
-
-pub(crate) async fn fetch_status_list_token(
-    reference: &StatusListReference,
-    options: &VerifyOptions,
-) -> Result<String, VerificationError> {
-    let policy = options
-        .status_list
-        .as_ref()
-        .ok_or(VerificationError::StatusPolicy {
-            code: "status.policy_required",
-        })?;
-    policy.permits(&options.expected_issuer, &reference.uri)?;
-    let validated = policy
-        .fetch_url_policy()
-        .validate_for_immediate_fetch_with_timeout(&reference.uri, STATUS_LIST_DNS_TIMEOUT)
-        .await
-        .map_err(map_status_fetch_url_error)?;
-    let response = validated
-        .immediate_get_with_timeout(STATUS_LIST_FETCH_TIMEOUT)
-        .map_err(map_status_fetch_url_error)?
-        .header(ACCEPT, STATUS_LIST_MEDIA_TYPE)
-        .header(ACCEPT_ENCODING, "identity")
-        .send()
-        .await
-        .map_err(|_| VerificationError::StatusFetch {
-            code: "status.unreachable",
-        })?;
-
-    if response.status().is_redirection() {
-        return Err(VerificationError::StatusFetch {
-            code: "status.redirect_denied",
-        });
-    }
-    if response.status() != StatusCode::OK {
-        return Err(VerificationError::StatusResponse {
-            code: "status.http_status_invalid",
-        });
-    }
-    if !has_exact_status_list_media_type(response.headers()) {
-        return Err(VerificationError::StatusResponse {
-            code: "status.media_type_invalid",
-        });
-    }
-    if !has_identity_content_encoding(response.headers()) {
-        return Err(VerificationError::StatusResponse {
-            code: "status.content_encoding_denied",
-        });
-    }
-    let body = read_bounded(response, MAX_STATUS_LIST_RESPONSE_BYTES)
-        .await
-        .map_err(map_status_body_error)?;
-    let compact = String::from_utf8(body).map_err(|_| VerificationError::StatusToken {
-        code: "status.token_malformed",
-    })?;
-    if compact.trim() != compact || !is_compact_jws(&compact) {
-        return Err(VerificationError::StatusToken {
-            code: "status.token_malformed",
-        });
-    }
-    Ok(compact)
-}
-
-pub(crate) fn verify_status_list_token(
-    compact: &str,
-    reference: &StatusListReference,
-    jwks: &Value,
-    options: &VerifyOptions,
-) -> Result<(), VerificationError> {
-    let mut parts = compact.split('.');
-    let header_b64 =
-        parts
-            .next()
-            .filter(|part| !part.is_empty())
-            .ok_or(VerificationError::StatusToken {
-                code: "status.token_malformed",
-            })?;
-    let payload_b64 =
-        parts
-            .next()
-            .filter(|part| !part.is_empty())
-            .ok_or(VerificationError::StatusToken {
-                code: "status.token_malformed",
-            })?;
-    let signature_b64 =
-        parts
-            .next()
-            .filter(|part| !part.is_empty())
-            .ok_or(VerificationError::StatusToken {
-                code: "status.token_malformed",
-            })?;
-    if parts.next().is_some() {
-        return Err(VerificationError::StatusToken {
-            code: "status.token_malformed",
-        });
-    }
-
-    let header = decode_status_segment(header_b64)?;
-    if ["crit", "jku", "jwk", "x5u", "x5c"]
-        .iter()
-        .any(|forbidden| header.get(forbidden).is_some())
-    {
-        return Err(VerificationError::StatusToken {
-            code: "status.header.untrusted_key_reference",
-        });
-    }
-    if header.get("typ").and_then(Value::as_str) != Some("statuslist+jwt") {
-        return Err(VerificationError::StatusToken {
-            code: "status.header.typ_mismatch",
-        });
-    }
-    let algorithm = status_required_string(&header, "alg")?;
-    if !options.accepted_algorithms.contains(algorithm) {
-        return Err(VerificationError::StatusToken {
-            code: "status.algorithm.disallowed",
-        });
-    }
-    let kid = status_required_string(&header, "kid")?;
-    let jwk = find_jwk(jwks, kid).map_err(|_| VerificationError::StatusToken {
-        code: "status.key.unknown",
-    })?;
-    if jwk_alg(&jwk) != Some(algorithm)
-        || jwk
-            .alg
-            .as_deref()
-            .is_some_and(|jwk_algorithm| jwk_algorithm != algorithm)
-    {
-        return Err(VerificationError::StatusToken {
-            code: "status.algorithm.key_mismatch",
-        });
-    }
-    let signature =
-        URL_SAFE_NO_PAD
-            .decode(signature_b64)
-            .map_err(|_| VerificationError::StatusToken {
-                code: "status.token_malformed",
-            })?;
-    let signing_input = format!("{header_b64}.{payload_b64}");
-    verify(signing_input.as_bytes(), &signature, &jwk).map_err(|_| {
-        VerificationError::StatusToken {
-            code: "status.signature.invalid",
-        }
-    })?;
-
-    let payload = decode_status_segment(payload_b64)?;
-    let status_uri = reference.uri.as_str();
-    if status_required_string(&payload, "iss")? != options.expected_issuer {
-        return Err(VerificationError::StatusToken {
-            code: "status.claim.issuer_mismatch",
-        });
-    }
-    if status_required_string(&payload, "sub")? != status_uri {
-        return Err(VerificationError::StatusToken {
-            code: "status.claim.uri_mismatch",
-        });
-    }
-    if !exact_audience_matches(&payload, status_uri) {
-        return Err(VerificationError::StatusToken {
-            code: "status.claim.audience_mismatch",
-        });
-    }
-    verify_status_time_claims(&payload, options)?;
-    let status = indexed_status(&payload, reference.index)?;
-    match status {
-        0 => Ok(()),
-        1 => Err(VerificationError::CredentialStatus {
-            code: "status.revoked",
-        }),
-        2 => Err(VerificationError::CredentialStatus {
-            code: "status.suspended",
-        }),
-        _ => Err(VerificationError::CredentialStatus {
-            code: "status.unknown",
-        }),
-    }
-}
-
-fn verify_status_time_claims(
-    payload: &Value,
-    options: &VerifyOptions,
-) -> Result<(), VerificationError> {
-    let now = options
-        .now
-        .unwrap_or_else(OffsetDateTime::now_utc)
-        .unix_timestamp();
-    let skew = i64::try_from(
-        options
-            .clock_skew
-            .as_secs()
-            .min(MAX_STATUS_LIST_CLOCK_SKEW_SECONDS),
-    )
-    .expect("bounded status clock skew fits i64");
-    let iat = payload
-        .get("iat")
-        .and_then(Value::as_i64)
-        .ok_or(VerificationError::StatusToken {
-            code: "status.claim.time_invalid",
-        })?;
-    let exp = payload
-        .get("exp")
-        .and_then(Value::as_i64)
-        .ok_or(VerificationError::StatusToken {
-            code: "status.claim.time_invalid",
-        })?;
-    let ttl = payload
-        .get("ttl")
-        .and_then(Value::as_i64)
-        .filter(|ttl| *ttl > 0 && *ttl <= MAX_STATUS_LIST_TOKEN_LIFETIME_SECONDS)
-        .ok_or(VerificationError::StatusToken {
-            code: "status.claim.time_invalid",
-        })?;
-    let nbf = match payload.get("nbf") {
-        None => None,
-        Some(value) => Some(value.as_i64().ok_or(VerificationError::StatusToken {
-            code: "status.claim.time_invalid",
-        })?),
-    };
-    let lifetime = exp.checked_sub(iat).ok_or(VerificationError::StatusToken {
-        code: "status.claim.time_invalid",
-    })?;
-    if lifetime <= 0
-        || lifetime > ttl
-        || exp <= now.saturating_sub(skew)
-        || iat > now.saturating_add(skew)
-        || nbf.is_some_and(|not_before| not_before > now.saturating_add(skew))
-        || nbf.is_some_and(|not_before| not_before >= exp)
-    {
-        return Err(VerificationError::StatusToken {
-            code: "status.claim.time_invalid",
-        });
-    }
-    Ok(())
-}
-
-fn indexed_status(payload: &Value, index: u64) -> Result<u8, VerificationError> {
-    let status_list = payload
-        .get("status_list")
-        .and_then(Value::as_object)
-        .ok_or(VerificationError::StatusToken {
-            code: "status.list.malformed",
-        })?;
-    let bits = status_list
-        .get("bits")
-        .and_then(Value::as_u64)
-        .filter(|bits| matches!(bits, 1 | 2 | 4 | 8))
-        .ok_or(VerificationError::StatusToken {
-            code: "status.list.malformed",
-        })? as u8;
-    let encoded = status_list
-        .get("lst")
-        .and_then(Value::as_str)
-        .filter(|encoded| !encoded.is_empty())
-        .ok_or(VerificationError::StatusToken {
-            code: "status.list.malformed",
-        })?;
-    let compressed =
-        URL_SAFE_NO_PAD
-            .decode(encoded)
-            .map_err(|_| VerificationError::StatusToken {
-                code: "status.list.malformed",
-            })?;
-    if compressed.len() > MAX_STATUS_LIST_COMPRESSED_BYTES {
-        return Err(VerificationError::StatusToken {
-            code: "status.list.compressed_too_large",
-        });
-    }
-    let list = decompress_status_list(&compressed)?;
-    let entries_per_byte = u64::from(8 / bits);
-    let byte_index = index / entries_per_byte;
-    let byte_index = usize::try_from(byte_index).map_err(|_| VerificationError::StatusToken {
-        code: "status.index.invalid",
-    })?;
-    let byte = list
-        .get(byte_index)
-        .copied()
-        .ok_or(VerificationError::StatusToken {
-            code: "status.index.invalid",
-        })?;
-    let shift = u8::try_from((index % entries_per_byte) * u64::from(bits)).map_err(|_| {
-        VerificationError::StatusToken {
-            code: "status.index.invalid",
-        }
-    })?;
-    let mask = if bits == 8 {
-        u8::MAX
-    } else {
-        (1_u8 << bits) - 1
-    };
-    Ok((byte >> shift) & mask)
-}
-
-fn decompress_status_list(compressed: &[u8]) -> Result<Vec<u8>, VerificationError> {
-    let mut decoder = ZlibDecoder::new(compressed);
-    let mut decompressed = Vec::with_capacity(MAX_STATUS_LIST_DECOMPRESSED_BYTES.min(8_192));
-    (&mut decoder)
-        .take((MAX_STATUS_LIST_DECOMPRESSED_BYTES + 1) as u64)
-        .read_to_end(&mut decompressed)
-        .map_err(|_| VerificationError::StatusToken {
-            code: "status.list.malformed",
-        })?;
-    if decompressed.len() > MAX_STATUS_LIST_DECOMPRESSED_BYTES
-        || decoder.total_in() != compressed.len() as u64
-    {
-        return Err(VerificationError::StatusToken {
-            code: "status.list.decompression_limit",
-        });
-    }
-    Ok(decompressed)
-}
-
-fn decode_status_segment(segment: &str) -> Result<Value, VerificationError> {
-    let decoded = URL_SAFE_NO_PAD
-        .decode(segment)
-        .map_err(|_| VerificationError::StatusToken {
-            code: "status.token_malformed",
-        })?;
-    serde_json::from_slice(&decoded).map_err(|_| VerificationError::StatusToken {
-        code: "status.token_malformed",
-    })
-}
-
-fn status_required_string<'a>(value: &'a Value, field: &str) -> Result<&'a str, VerificationError> {
-    value
-        .get(field)
-        .and_then(Value::as_str)
-        .filter(|value| !value.trim().is_empty())
-        .ok_or(VerificationError::StatusToken {
-            code: "status.token_malformed",
-        })
-}
-
-fn exact_audience_matches(payload: &Value, expected: &str) -> bool {
-    match payload.get("aud") {
-        Some(Value::String(audience)) => audience == expected,
-        Some(Value::Array(audiences)) if audiences.len() == 1 => {
-            audiences[0].as_str() == Some(expected)
-        }
-        _ => false,
-    }
-}
-
-fn has_exact_status_list_media_type(headers: &reqwest::header::HeaderMap) -> bool {
-    let mut values = headers.get_all(CONTENT_TYPE).iter();
-    matches!(
-        (values.next(), values.next()),
-        (Some(value), None)
-            if value
-                .to_str()
-                .is_ok_and(|value| value.eq_ignore_ascii_case(STATUS_LIST_MEDIA_TYPE))
-    )
-}
-
-fn has_identity_content_encoding(headers: &reqwest::header::HeaderMap) -> bool {
-    let mut values = headers.get_all(CONTENT_ENCODING).iter();
-    match (values.next(), values.next()) {
-        (None, None) => true,
-        (Some(value), None) => value
-            .to_str()
-            .is_ok_and(|value| value.eq_ignore_ascii_case("identity")),
-        _ => false,
-    }
-}
-
-fn map_status_fetch_url_error(error: FetchUrlError) -> VerificationError {
-    match error {
-        FetchUrlError::Dns { .. }
-        | FetchUrlError::NoAddresses
-        | FetchUrlError::ValidationTimeout { .. }
-        | FetchUrlError::ValidationTask(_) => VerificationError::StatusFetch {
-            code: "status.unreachable",
-        },
-        _ => VerificationError::StatusFetch {
-            code: "status.destination_unsafe",
-        },
-    }
-}
-
-fn map_status_body_error(error: BoundedReadError) -> VerificationError {
-    match error {
-        BoundedReadError::ContentLengthExceeded { .. }
-        | BoundedReadError::BodyTooLarge { .. }
-        | BoundedReadError::LengthOverflow => VerificationError::StatusResponse {
-            code: "status.response_too_large",
-        },
-        BoundedReadError::Transport(_) => VerificationError::StatusFetch {
-            code: "status.unreachable",
-        },
-        _ => VerificationError::StatusResponse {
-            code: "status.response_invalid",
-        },
-    }
-}
-
-fn parse_status_origin(
-    raw_origin: &str,
-    allow_loopback_http: bool,
-) -> Result<String, StatusListPolicyError> {
-    if raw_origin.len() > MAX_STATUS_LIST_URI_BYTES {
-        return Err(StatusListPolicyError::InvalidOrigin);
-    }
-    let origin = Url::parse(raw_origin).map_err(|_| StatusListPolicyError::InvalidOrigin)?;
-    if origin.host().is_none() || origin.port() == Some(0) {
-        return Err(StatusListPolicyError::InvalidOrigin);
-    }
-    if !origin.username().is_empty()
-        || origin.password().is_some()
-        || origin.path() != "/"
-        || origin.query().is_some()
-        || origin.fragment().is_some()
-    {
-        return Err(StatusListPolicyError::OriginHasResourceComponents);
-    }
-    let valid_scheme = origin.scheme() == "https"
-        || (allow_loopback_http
-            && origin.scheme() == "http"
-            && matches!(origin.host_str(), Some("127.0.0.1" | "localhost" | "::1")));
-    if !valid_scheme {
-        return Err(StatusListPolicyError::InvalidOrigin);
-    }
-    Ok(origin.origin().ascii_serialization())
-}
-
-fn verify_disclosures(
-    payload: &Value,
-    disclosures: &[&str],
-) -> Result<Option<Value>, VerificationError> {
-    if disclosures.is_empty() && payload.get("_sd").is_none() {
-        return Ok(None);
-    }
-    if payload.get("_sd_alg").and_then(Value::as_str) != Some("sha-256") {
-        return Err(VerificationError::DisclosureDigestMismatch {
-            code: "disclosure.digest_mismatch",
-        });
-    }
-    let expected = payload
-        .get("_sd")
-        .and_then(Value::as_array)
-        .ok_or(VerificationError::DisclosureDigestMismatch {
-            code: "disclosure.digest_mismatch",
-        })?
-        .iter()
-        .map(|digest| {
-            digest.as_str().map(ToString::to_string).ok_or(
-                VerificationError::DisclosureDigestMismatch {
-                    code: "disclosure.digest_mismatch",
-                },
-            )
-        })
-        .collect::<Result<BTreeSet<_>, _>>()?;
-
-    let mut actual = BTreeSet::new();
-    let mut disclosed_status = None;
-    for disclosure in disclosures {
-        let decoded = URL_SAFE_NO_PAD.decode(disclosure).map_err(|_| {
-            VerificationError::DisclosureDigestMismatch {
-                code: "disclosure.digest_mismatch",
-            }
-        })?;
-        let value: Value = serde_json::from_slice(&decoded).map_err(|_| {
-            VerificationError::DisclosureDigestMismatch {
-                code: "disclosure.digest_mismatch",
-            }
-        })?;
-        let Some(items) = value.as_array().filter(|items| items.len() >= 3) else {
-            return Err(VerificationError::DisclosureDigestMismatch {
-                code: "disclosure.digest_mismatch",
-            });
-        };
-        let digest = URL_SAFE_NO_PAD.encode(Sha256::digest(disclosure.as_bytes()));
-        if !expected.contains(&digest) || !actual.insert(digest) {
-            return Err(VerificationError::DisclosureDigestMismatch {
-                code: "disclosure.digest_mismatch",
-            });
-        }
-        if items.get(1).and_then(Value::as_str) == Some("status")
-            && disclosed_status.replace(items[2].clone()).is_some()
-        {
-            return Err(VerificationError::StatusToken {
-                code: "status.reference_malformed",
-            });
-        }
-    }
-    Ok(disclosed_status)
-}
-
-struct HolderBindingContext<'a> {
-    payload: &'a Value,
-    policy: &'a HolderBindingPolicy,
-    key_binding_jwt: Option<&'a str>,
-    sd_hash_input: &'a str,
-    expected_audience: Option<&'a str>,
-    expected_nonce: Option<&'a str>,
-    now: i64,
-    skew: i64,
-}
-
-fn verify_holder_binding(
-    context: HolderBindingContext<'_>,
-) -> Result<Option<String>, VerificationError> {
-    if matches!(context.policy, HolderBindingPolicy::NotRequired)
-        && (context.key_binding_jwt.is_none()
-            || context.expected_audience.is_none()
-            || context.expected_nonce.is_none())
-    {
-        return Ok(context
-            .payload
-            .get("cnf")
-            .and_then(|cnf| cnf.get("kid"))
-            .and_then(Value::as_str)
-            .map(ToString::to_string));
-    }
-    let cnf = context
-        .payload
-        .get("cnf")
-        .ok_or(VerificationError::HolderBinding {
-            code: "holder_binding.required",
-        })?;
-    let jwk_value = cnf.get("jwk").ok_or(VerificationError::HolderBinding {
-        code: "holder_binding.required",
-    })?;
-    let jwk_json =
-        serde_json::to_string(jwk_value).map_err(|_| VerificationError::HolderBinding {
-            code: "holder_binding.invalid",
-        })?;
-    let holder_jwk = PublicJwk::parse(&jwk_json).map_err(|_| VerificationError::HolderBinding {
-        code: "holder_binding.invalid",
-    })?;
-    let actual_kid = cnf
-        .get("kid")
-        .and_then(Value::as_str)
-        .map(ToString::to_string);
-    if let HolderBindingPolicy::RequiredKid(expected) = context.policy {
-        if actual_kid.as_deref() != Some(expected.as_str()) {
-            return Err(VerificationError::HolderBinding {
-                code: "holder_binding.kid_mismatch",
-            });
-        }
-    }
-    if context.key_binding_jwt.is_none()
-        && context.expected_audience.is_some()
-        && context.expected_nonce.is_some()
-    {
-        return Err(VerificationError::HolderBinding {
-            code: "holder_binding.challenge_required",
-        });
-    }
-    if let Some(key_binding_jwt) = context.key_binding_jwt {
-        verify_key_binding_jwt(
-            key_binding_jwt,
-            context.sd_hash_input,
-            &holder_jwk,
-            context.expected_audience,
-            context.expected_nonce,
-            context.now,
-            context.skew,
-        )?;
-    }
-    Ok(actual_kid)
-}
-
-fn verify_key_binding_jwt(
-    compact: &str,
-    sd_hash_input: &str,
-    holder_jwk: &PublicJwk,
-    expected_audience: Option<&str>,
-    expected_nonce: Option<&str>,
-    now: i64,
-    skew: i64,
-) -> Result<(), VerificationError> {
-    let mut parts = compact.split('.');
-    let header_b64 = parts.next().ok_or(VerificationError::HolderBinding {
-        code: "holder_binding.proof_invalid",
-    })?;
-    let payload_b64 = parts.next().ok_or(VerificationError::HolderBinding {
-        code: "holder_binding.proof_invalid",
-    })?;
-    let signature_b64 = parts.next().ok_or(VerificationError::HolderBinding {
-        code: "holder_binding.proof_invalid",
-    })?;
-    if parts.next().is_some()
-        || header_b64.is_empty()
-        || payload_b64.is_empty()
-        || signature_b64.is_empty()
-    {
-        return Err(VerificationError::HolderBinding {
-            code: "holder_binding.proof_invalid",
-        });
-    }
-    let header = decode_segment(header_b64).map_err(|_| VerificationError::HolderBinding {
-        code: "holder_binding.proof_invalid",
-    })?;
-    reject_untrusted_header_references(&header)?;
-    if header.get("alg").and_then(Value::as_str) != Some("EdDSA")
-        || header.get("typ").and_then(Value::as_str) != Some("kb+jwt")
-    {
-        return Err(VerificationError::HolderBinding {
-            code: "holder_binding.proof_invalid",
-        });
-    }
-    let signature =
-        URL_SAFE_NO_PAD
-            .decode(signature_b64)
-            .map_err(|_| VerificationError::HolderBinding {
-                code: "holder_binding.proof_invalid",
-            })?;
-    let signing_input = format!("{header_b64}.{payload_b64}");
-    verify(signing_input.as_bytes(), &signature, holder_jwk).map_err(|_| {
-        VerificationError::HolderBinding {
-            code: "holder_binding.proof_invalid",
-        }
-    })?;
-    let payload = decode_segment(payload_b64).map_err(|_| VerificationError::HolderBinding {
-        code: "holder_binding.proof_invalid",
-    })?;
-    let iat =
-        payload
-            .get("iat")
-            .and_then(Value::as_i64)
-            .ok_or(VerificationError::HolderBinding {
-                code: "holder_binding.proof_invalid",
-            })?;
-    if iat > now.saturating_add(skew) {
-        return Err(VerificationError::HolderBinding {
-            code: "holder_binding.proof_invalid",
-        });
-    }
-    let exp =
-        payload
-            .get("exp")
-            .and_then(Value::as_i64)
-            .ok_or(VerificationError::HolderBinding {
-                code: "holder_binding.proof_invalid",
-            })?;
-    if exp <= now.saturating_sub(skew) {
-        return Err(VerificationError::HolderBinding {
-            code: "holder_binding.proof_invalid",
-        });
-    }
-    if payload
-        .get("nbf")
-        .and_then(Value::as_i64)
-        .is_some_and(|nbf| nbf > now.saturating_add(skew))
-    {
-        return Err(VerificationError::HolderBinding {
-            code: "holder_binding.proof_invalid",
-        });
-    }
-    let expected_sd_hash = URL_SAFE_NO_PAD.encode(Sha256::digest(sd_hash_input.as_bytes()));
-    if payload.get("sd_hash").and_then(Value::as_str) != Some(expected_sd_hash.as_str()) {
-        return Err(VerificationError::HolderBinding {
-            code: "holder_binding.proof_invalid",
-        });
-    }
-    let (Some(expected_audience), Some(expected_nonce)) = (expected_audience, expected_nonce)
-    else {
-        return Err(VerificationError::HolderBinding {
-            code: "holder_binding.challenge_required",
-        });
-    };
-    if !audience_matches(&payload, expected_audience) {
-        return Err(VerificationError::HolderBinding {
-            code: "holder_binding.proof_invalid",
-        });
-    }
-    if payload.get("nonce").and_then(Value::as_str) != Some(expected_nonce) {
-        return Err(VerificationError::HolderBinding {
-            code: "holder_binding.proof_invalid",
-        });
-    }
-    Ok(())
-}
-
-fn audience_matches(payload: &Value, expected_audience: &str) -> bool {
-    match payload.get("aud") {
-        Some(Value::String(audience)) => audience == expected_audience,
-        Some(Value::Array(audiences)) => audiences
-            .iter()
-            .any(|audience| audience.as_str() == Some(expected_audience)),
-        _ => false,
-    }
-}
-
-fn reject_untrusted_header_references(header: &Value) -> Result<(), VerificationError> {
-    for forbidden in ["crit", "jku", "jwk", "x5u", "x5c"] {
-        if header.get(forbidden).is_some() {
-            return Err(VerificationError::UntrustedKeyReference {
-                code: "header.untrusted_key_reference",
-            });
-        }
-    }
-    Ok(())
-}
-
-fn find_jwk(jwks: &Value, kid: &str) -> Result<PublicJwk, VerificationError> {
-    let keys = jwks
-        .get("keys")
-        .and_then(Value::as_array)
-        .ok_or(VerificationError::UnknownKey {
-            code: "key.unknown",
-        })?;
-    for key in keys {
-        if key.get("kid").and_then(Value::as_str) == Some(kid) {
-            let json = serde_json::to_string(key).map_err(|_| VerificationError::UnknownKey {
-                code: "key.unknown",
-            })?;
-            return PublicJwk::parse(&json).map_err(|_| VerificationError::UnknownKey {
-                code: "key.unknown",
-            });
-        }
-    }
-    Err(VerificationError::UnknownKey {
-        code: "key.unknown",
-    })
-}
-
-fn jwk_alg(jwk: &PublicJwk) -> Option<&'static str> {
-    match jwk.algorithm().ok()? {
-        SigningAlgorithm::EdDsa => Some("EdDSA"),
-        SigningAlgorithm::Rs256 => Some("RS256"),
-        SigningAlgorithm::Es256 => Some("ES256"),
-    }
-}
-
-fn decode_segment(segment: &str) -> Result<Value, VerificationError> {
-    let decoded = URL_SAFE_NO_PAD
-        .decode(segment)
-        .map_err(|_| VerificationError::Malformed {
-            code: "token.malformed",
-        })?;
-    serde_json::from_slice(&decoded).map_err(|_| VerificationError::Malformed {
-        code: "token.malformed",
-    })
-}
-
-fn required_string<'a>(value: &'a Value, field: &str) -> Result<&'a str, VerificationError> {
-    value
-        .get(field)
-        .and_then(Value::as_str)
-        .filter(|s| !s.trim().is_empty())
-        .ok_or(VerificationError::Malformed {
-            code: "token.malformed",
-        })
-}
-
-fn required_i64(value: &Value, field: &str) -> Result<i64, VerificationError> {
-    value
-        .get(field)
-        .and_then(Value::as_i64)
-        .ok_or(VerificationError::TimeClaim {
-            code: "claim.time_invalid",
-        })
-}
-
-fn optional_i64(value: &Value, field: &str) -> Result<Option<i64>, VerificationError> {
-    value
-        .get(field)
-        .map(|raw| {
-            raw.as_i64().ok_or(VerificationError::TimeClaim {
-                code: "claim.time_invalid",
-            })
-        })
-        .transpose()
-}
-
-struct ParsedSdJwt<'a> {
-    header_b64: &'a str,
-    payload_b64: &'a str,
-    signature_b64: &'a str,
-    disclosures: Vec<&'a str>,
-    key_binding_jwt: Option<&'a str>,
-    sd_hash_input: &'a str,
-}
-
-impl<'a> ParsedSdJwt<'a> {
-    fn parse(compact: &'a str) -> Result<Self, VerificationError> {
-        let mut parts = compact.split('~');
-        let issuer_jwt =
-            parts
-                .next()
-                .filter(|part| !part.is_empty())
-                .ok_or(VerificationError::Malformed {
-                    code: "token.malformed",
-                })?;
-        let mut presentation_parts = parts.filter(|part| !part.is_empty()).collect::<Vec<_>>();
-        let key_binding_jwt = presentation_parts
-            .last()
-            .copied()
-            .filter(|part| is_compact_jws(part));
-        if key_binding_jwt.is_some() {
-            presentation_parts.pop();
-        }
-        if presentation_parts.iter().any(|part| is_compact_jws(part)) {
-            return Err(VerificationError::Malformed {
-                code: "token.malformed",
-            });
-        }
-        let sd_hash_input = if let Some(key_binding_jwt) = key_binding_jwt {
-            compact
-                .strip_suffix(key_binding_jwt)
-                .ok_or(VerificationError::Malformed {
-                    code: "token.malformed",
-                })?
-        } else {
-            compact
-        };
-        let mut jwt_parts = issuer_jwt.split('.');
-        let header_b64 = jwt_parts.next().ok_or(VerificationError::Malformed {
-            code: "token.malformed",
-        })?;
-        let payload_b64 = jwt_parts.next().ok_or(VerificationError::Malformed {
-            code: "token.malformed",
-        })?;
-        let signature_b64 = jwt_parts.next().ok_or(VerificationError::Malformed {
-            code: "token.malformed",
-        })?;
-        if jwt_parts.next().is_some()
-            || header_b64.is_empty()
-            || payload_b64.is_empty()
-            || signature_b64.is_empty()
-        {
-            return Err(VerificationError::Malformed {
-                code: "token.malformed",
-            });
-        }
-        Ok(Self {
-            header_b64,
-            payload_b64,
-            signature_b64,
-            disclosures: presentation_parts,
-            key_binding_jwt,
-            sd_hash_input,
-        })
-    }
-
-    fn signing_input(&self) -> String {
-        format!("{}.{}", self.header_b64, self.payload_b64)
-    }
-}
-
-fn is_compact_jws(value: &str) -> bool {
-    let mut parts = value.split('.');
-    let Some(header) = parts.next() else {
-        return false;
-    };
-    let Some(payload) = parts.next() else {
-        return false;
-    };
-    let Some(signature) = parts.next() else {
-        return false;
-    };
-    parts.next().is_none() && !header.is_empty() && !payload.is_empty() && !signature.is_empty()
-}
diff --git a/crates/registry-notary-client/tests/client_contract.rs b/crates/registry-notary-client/tests/client_contract.rs
deleted file mode 100644
index c98ce2790..000000000
--- a/crates/registry-notary-client/tests/client_contract.rs
+++ /dev/null
@@ -1,1491 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use std::net::SocketAddr;
-use std::sync::{
-    atomic::{AtomicUsize, Ordering},
-    Arc,
-};
-use std::time::{Duration, Instant};
-
-use axum::body::Bytes;
-use axum::extract::{Path, State};
-use axum::http::{HeaderMap, StatusCode, Uri};
-use axum::response::{IntoResponse, Response};
-use axum::routing::{get, post};
-use axum::{Json, Router};
-use registry_notary_client::auth::{AuthHeader, AuthProvider};
-use registry_notary_client::{
-    CredentialIssueResponse, NotaryClientBuildError, NotaryClientError, NotaryResponse,
-    RegistryNotaryClient, RequestOptions, RetryPolicy,
-};
-use registry_notary_core::{
-    BatchEvaluateResponse, BatchStatus, FORMAT_CLAIM_RESULT_JSON, MAX_BATCH_EVALUATION_MEMBERS_V1,
-};
-use secrecy::SecretString;
-use serde_json::json;
-use tokio::net::TcpListener;
-
-#[tokio::test]
-async fn builder_rejects_multiple_auth_modes() {
-    let error = RegistryNotaryClient::builder("https://notary.example")
-        .bearer_token("bearer-secret")
-        .api_key("api-secret")
-        .build()
-        .expect_err("multiple auth modes are rejected");
-
-    assert!(matches!(error, NotaryClientBuildError::MultipleAuthModes));
-}
-
-#[tokio::test]
-async fn builder_rejects_non_loopback_http() {
-    let error = RegistryNotaryClient::builder("http://example.com")
-        .bearer_token("bearer-secret")
-        .build()
-        .expect_err("non-loopback http is rejected");
-
-    assert!(matches!(error, NotaryClientBuildError::InsecureBaseUrl));
-}
-
-#[tokio::test]
-async fn builder_preserves_encoded_base_path_when_adding_trailing_slash() {
-    let app = Router::new().fallback(get(base_path_health_handler));
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(format!("{base}/tenant%20one"))
-        .build()
-        .expect("client builds");
-
-    let response = client.health().await.expect("health response");
-
-    assert_eq!(response.body.status, "ok");
-}
-
-#[tokio::test]
-async fn debug_redacts_auth_material() {
-    let builder = RegistryNotaryClient::builder("https://notary.example")
-        .bearer_token("super-secret-token")
-        .api_key("another-secret");
-
-    let rendered = format!("{builder:?}");
-    assert!(!rendered.contains("super-secret-token"));
-    assert!(!rendered.contains("another-secret"));
-    assert!(rendered.contains("<redacted>"));
-}
-
-#[test]
-fn credential_issue_response_debug_redacts_credential_material() {
-    let response = CredentialIssueResponse {
-        credential_id: "cred-1".to_string(),
-        credential_profile: "profile-1".to_string(),
-        format: "application/dc+sd-jwt".to_string(),
-        issuer: "did:web:notary.example".to_string(),
-        expires_at: "2026-05-29T00:00:00Z".to_string(),
-        credential: "issuer.jwt~disclosure-secret~".to_string(),
-        issuer_signed_jwt: "issuer.jwt".to_string(),
-        disclosures: vec!["disclosure-secret".to_string()],
-    };
-
-    let debug = format!("{response:?}");
-
-    assert!(debug.contains("cred-1"));
-    assert!(debug.contains("<redacted>"));
-    assert!(!debug.contains("issuer.jwt"));
-    assert!(!debug.contains("disclosure-secret"));
-    assert!(!debug.contains("issuer.jwt~disclosure-secret~"));
-
-    let wrapped = NotaryResponse {
-        body: response,
-        status: StatusCode::OK,
-        request_id: Some("req-credential".to_string()),
-        retry_after: None,
-    };
-    let wrapped_debug = format!("{wrapped:?}");
-
-    assert!(wrapped_debug.contains("req-credential"));
-    assert!(wrapped_debug.contains("<redacted>"));
-    assert!(!wrapped_debug.contains("issuer.jwt"));
-    assert!(!wrapped_debug.contains("disclosure-secret"));
-}
-
-#[test]
-fn serialization_build_error_has_specific_portable_code() {
-    let error = NotaryClientError::Build(NotaryClientBuildError::RequestSerialization);
-
-    assert_eq!(
-        error.portable().code.as_deref(),
-        Some("request.serialization_failed")
-    );
-}
-
-#[test]
-fn notary_response_debug_keeps_non_sensitive_body_metadata() {
-    let response = NotaryResponse {
-        body: registry_notary_client::HealthResponse {
-            status: "ok".to_string(),
-            checks: json!({ "database": "ready" }),
-        },
-        status: StatusCode::OK,
-        request_id: Some("req-health".to_string()),
-        retry_after: None,
-    };
-
-    let debug = format!("{response:?}");
-
-    assert!(debug.contains("req-health"));
-    assert!(debug.contains("ok"));
-    assert!(debug.contains("database"));
-    assert!(!debug.contains("<redacted>"));
-}
-
-struct FixedAuthProvider;
-
-#[async_trait::async_trait]
-impl AuthProvider for FixedAuthProvider {
-    async fn auth_header(&self) -> Result<AuthHeader, NotaryClientError> {
-        Ok(AuthHeader::ApiKey(SecretString::from(
-            "provider-secret".to_string(),
-        )))
-    }
-}
-
-#[tokio::test]
-async fn auth_provider_sends_redacted_dynamic_header() {
-    let app = Router::new().route(
-        "/healthz",
-        get(|headers: HeaderMap| async move {
-            assert_eq!(
-                headers
-                    .get("x-api-key")
-                    .and_then(|value| value.to_str().ok()),
-                Some("provider-secret")
-            );
-            Json(json!({ "status": "ok", "checks": {} }))
-        }),
-    );
-    let base = spawn(app).await;
-    let provider: Arc<dyn AuthProvider> = Arc::new(FixedAuthProvider);
-    let client = RegistryNotaryClient::builder(base)
-        .auth_provider(provider)
-        .build()
-        .expect("client builds");
-
-    let response = client.health().await.expect("health succeeds");
-
-    assert_eq!(response.body.status, "ok");
-}
-
-#[tokio::test]
-async fn batch_response_family_deserializes_from_wire_json() {
-    let value = json!({
-        "batch_id": "batch-1",
-        "status": "completed",
-        "claims": ["claim-a"],
-        "items": [],
-        "summary": { "succeeded": 0, "failed": 0 }
-    });
-
-    let parsed: BatchEvaluateResponse =
-        serde_json::from_value(value).expect("batch response deserializes");
-    assert_eq!(parsed.batch_id, "batch-1");
-    assert!(matches!(parsed.status, BatchStatus::Completed));
-}
-
-#[tokio::test]
-async fn evaluate_sends_safe_headers_and_parses_metadata() {
-    let app = Router::new().route("/v1/evaluations", post(evaluate_handler));
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .bearer_token("bearer-secret")
-        .default_purpose("benefits")
-        .build()
-        .expect("client builds");
-
-    let response = client
-        .evaluate_target("Person")
-        .target_identifier("NATIONAL_ID", "subject-1")
-        .target_identifier_issuer("civil_registry")
-        .relationship("self")
-        .request_variable_date("as_of_date", "2026-01-01")
-        .claim("claim-a")
-        .request_id("req-123")
-        .send()
-        .await
-        .expect("evaluate succeeds");
-
-    assert_eq!(response.request_id.as_deref(), Some("req-123"));
-    assert!(response.body.results.is_empty());
-}
-
-#[tokio::test]
-async fn ready_200_returns_typed_custody_checks() {
-    let app = Router::new().route(
-        "/ready",
-        get(|| async {
-            Json(json!({
-                "status": "ready",
-                "checks": readiness_checks_json(true, 0),
-            }))
-        }),
-    );
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .build()
-        .expect("client builds");
-
-    let response = client.ready().await.expect("ready response parses");
-
-    assert_eq!(response.body.status, "ready");
-    let custody = response.body.checks.signing_providers.custody;
-    assert!(custody.custody_approval_required);
-    assert!(custody.custody_approved);
-    assert_eq!(custody.unapproved_signing_provider_count, 0);
-    assert_eq!(custody.active_provider_counts.get("pkcs11"), Some(&1));
-}
-
-#[tokio::test]
-async fn ready_503_returns_problem_details() {
-    let app = Router::new().route(
-        "/ready",
-        get(|| async {
-            (
-                StatusCode::SERVICE_UNAVAILABLE,
-                [("content-type", "application/problem+json")],
-                Json(json!({
-                    "type": "https://id.registrystack.org/problems/registry-notary/readiness/not-ready",
-                    "title": "Evidence runtime is not ready",
-                    "status": 503,
-                    "detail": "one or more readiness checks are not ready",
-                    "code": "readiness.not_ready",
-                    "request_id": "01J00000000000000000000000",
-                    "readiness_status": "not_ready",
-                    "checks": readiness_checks_json(false, 1)
-                })),
-            )
-        }),
-    );
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .build()
-        .expect("client builds");
-
-    let error = client.ready().await.expect_err("ready 503 is a problem");
-
-    match error {
-        NotaryClientError::Problem {
-            status, problem, ..
-        } => {
-            assert_eq!(status, StatusCode::SERVICE_UNAVAILABLE);
-            assert_eq!(problem.code, "readiness.not_ready");
-            assert_eq!(
-                problem.request_id.as_deref(),
-                Some("01J00000000000000000000000")
-            );
-            assert_eq!(problem.readiness_status.as_deref(), Some("not_ready"));
-            let custody = &problem
-                .checks
-                .as_ref()
-                .expect("readiness checks are retained")
-                .signing_providers
-                .custody;
-            assert!(custody.custody_approval_required);
-            assert!(!custody.custody_approved);
-            assert_eq!(custody.unapproved_signing_provider_count, 1);
-        }
-        other => panic!("expected readiness problem, got {other:?}"),
-    }
-}
-
-fn readiness_checks_json(custody_approved: bool, unapproved_count: usize) -> serde_json::Value {
-    json!({
-        "total": 3,
-        "ok": if unapproved_count == 0 { 3 } else { 1 },
-        "degraded": 0,
-        "failed": usize::from(unapproved_count > 0),
-        "signing_providers": {
-            "total": 1,
-            "ok": 1,
-            "failed": 0,
-            "custody": {
-                "active_provider_counts": {
-                    "pkcs11": 1,
-                },
-                "signing_provider_count": 1,
-                "local_software_signing_provider_count": 0,
-                "custody_approval_required": true,
-                "custody_approved": custody_approved,
-                "unapproved_signing_provider_count": unapproved_count,
-                "surfaces": {
-                    "credential_issuance": {
-                        "signing_provider_count": 1,
-                        "local_software_signing_provider_count": 0,
-                        "unapproved_signing_provider_count": unapproved_count,
-                    },
-                    "access_token_issuance": {
-                        "enabled": false,
-                        "signing_provider_count": 0,
-                        "local_software_signing_provider_count": 0,
-                        "unapproved_signing_provider_count": 0,
-                    },
-                    "federation": {
-                        "enabled": false,
-                        "signing_provider_count": 0,
-                        "local_software_signing_provider_count": 0,
-                        "unapproved_signing_provider_count": 0,
-                    },
-                },
-            },
-        },
-    })
-}
-
-#[tokio::test]
-async fn jwks_uses_ttl_cache_and_refresh_forces_reload() {
-    let state = Arc::new(AtomicUsize::new(0));
-    let app = Router::new()
-        .route("/.well-known/evidence/jwks.json", get(jwks_handler))
-        .with_state(Arc::clone(&state));
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .build()
-        .expect("client builds");
-
-    let first = client
-        .issuer_jwks(RequestOptions::default())
-        .await
-        .expect("first fetch succeeds");
-    let second = client
-        .issuer_jwks(RequestOptions::default())
-        .await
-        .expect("second fetch uses cache");
-    let refreshed = client
-        .refresh_jwks(RequestOptions::default())
-        .await
-        .expect("refresh fetches network");
-
-    assert_eq!(first.body["keys"][0]["kid"], "kid-1");
-    assert_eq!(second.body["keys"][0]["kid"], "kid-1");
-    assert_eq!(refreshed.body["keys"][0]["kid"], "kid-2");
-    assert_eq!(state.load(Ordering::SeqCst), 2);
-}
-
-#[tokio::test]
-async fn metrics_returns_text_body() {
-    let app = Router::new().route("/metrics", get(|| async { "requests_total 1\n" }));
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .build()
-        .expect("client builds");
-
-    let response = client
-        .metrics(RequestOptions::default())
-        .await
-        .expect("metrics parses");
-
-    assert_eq!(response.body, "requests_total 1\n");
-}
-
-#[tokio::test]
-async fn typed_route_methods_parse_success_responses_and_escape_paths() {
-    let app = Router::new()
-        .route("/healthz", get(health_handler))
-        .route("/admin/v1/reload", post(admin_reload_handler))
-        .route(
-            "/openapi.json",
-            get(|| async { Json(json!({ "openapi": "3.1.0" })) }),
-        )
-        .route(
-            "/.well-known/evidence-service",
-            get(|| async { Json(json!({ "issuer": "notary.example" })) }),
-        )
-        .route("/.well-known/evidence/jwks.json", get(jwks_static_handler))
-        .route("/v1/claims/{claim_id}", get(claim_handler))
-        .route(
-            "/v1/formats",
-            get(|| async {
-                Json(json!({
-                    "formats": [
-                        { "id": FORMAT_CLAIM_RESULT_JSON, "kind": "json", "status": "active" }
-                    ]
-                }))
-            }),
-        )
-        .route(
-            "/v1/evaluations/{evaluation_id}/render",
-            post(render_handler),
-        )
-        .route("/v1/credentials", post(issue_credential_handler))
-        .route(
-            "/v1/credentials/{credential_id}/status",
-            get(credential_status_handler),
-        )
-        .route(
-            "/admin/v1/credentials/{credential_id}/status",
-            post(update_credential_status_handler),
-        );
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .api_key("api-secret")
-        .build()
-        .expect("client builds");
-
-    assert_eq!(client.health().await.expect("health").body.status, "ok");
-    assert_eq!(
-        client
-            .admin_reload(RequestOptions::default())
-            .await
-            .expect("admin reload")
-            .body
-            .status,
-        "noop"
-    );
-    assert_eq!(
-        client
-            .openapi_json(RequestOptions::default())
-            .await
-            .expect("openapi")
-            .body["openapi"],
-        "3.1.0"
-    );
-    assert_eq!(
-        client
-            .service_document(RequestOptions::default())
-            .await
-            .expect("service document")
-            .body["issuer"],
-        "notary.example"
-    );
-    assert_eq!(
-        client
-            .raw_issuer_jwks(RequestOptions::default())
-            .await
-            .expect("raw jwks")
-            .body["keys"][0]["kid"],
-        "kid-static"
-    );
-    assert_eq!(
-        client
-            .get_claim("claim one", RequestOptions::default())
-            .await
-            .expect("claim")
-            .body["id"],
-        "claim one"
-    );
-    assert_eq!(
-        client
-            .list_formats(RequestOptions::default())
-            .await
-            .expect("formats")
-            .body
-            .formats[0]
-            .id,
-        FORMAT_CLAIM_RESULT_JSON
-    );
-    assert_eq!(
-        client
-            .render_request(
-                registry_notary_core::RenderRequest {
-                    evaluation_id: "eval-1".to_string(),
-                    format: FORMAT_CLAIM_RESULT_JSON.to_string(),
-                    disclosure: None,
-                    claims: None,
-                    purpose: None,
-                },
-                RequestOptions::default(),
-            )
-            .await
-            .expect("render")
-            .body["rendered"],
-        true
-    );
-    assert_eq!(
-        client
-            .issue_credential_request(
-                registry_notary_core::CredentialIssueRequest {
-                    evaluation_id: "eval-1".to_string(),
-                    credential_profile: None,
-                    format: None,
-                    claims: None,
-                    disclosure: None,
-                    purpose: None,
-                    holder: None,
-                },
-                RequestOptions::default(),
-            )
-            .await
-            .expect("credential issue")
-            .body
-            .credential_id,
-        "cred-1"
-    );
-    assert_eq!(
-        client
-            .credential_status("cred 1", RequestOptions::default())
-            .await
-            .expect("credential status")
-            .body
-            .status,
-        "valid"
-    );
-    assert_eq!(
-        client
-            .update_credential_status("cred 1", "revoked", RequestOptions::default())
-            .await
-            .expect("credential status update")
-            .body
-            .status,
-        "revoked"
-    );
-}
-
-#[tokio::test]
-async fn purpose_conflict_fails_client_side() {
-    let app = Router::new().route("/v1/evaluations", post(evaluate_handler));
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .bearer_token("bearer-secret")
-        .default_purpose("header-purpose")
-        .build()
-        .expect("client builds");
-
-    let error = client
-        .evaluate_request(
-            registry_notary_core::EvaluateRequest {
-                requester: None,
-                target: Some(registry_notary_core::EvidenceEntity::from_subject_request(
-                    "Person",
-                    registry_notary_core::SubjectRequest {
-                        id: "subject-1".to_string(),
-                        id_type: None,
-                    },
-                )),
-                relationship: None,
-                on_behalf_of: None,
-                variables: Default::default(),
-                claims: vec![registry_notary_core::ClaimRef::new("claim-a")],
-                disclosure: None,
-                format: None,
-                purpose: Some("body-purpose".to_string()),
-            },
-            RequestOptions::default(),
-        )
-        .await
-        .expect_err("purpose conflict fails before request");
-
-    assert!(matches!(
-        error,
-        NotaryClientError::Build(NotaryClientBuildError::PurposeConflict)
-    ));
-}
-
-#[tokio::test]
-async fn raw_evaluate_preserves_body_only_purpose() {
-    let app = Router::new().route("/v1/evaluations", post(body_purpose_evaluate_handler));
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .bearer_token("bearer-secret")
-        .build()
-        .expect("client builds");
-
-    let response = client
-        .evaluate_request(
-            registry_notary_core::EvaluateRequest {
-                requester: None,
-                target: Some(registry_notary_core::EvidenceEntity::from_subject_request(
-                    "Person",
-                    registry_notary_core::SubjectRequest {
-                        id: "subject-1".to_string(),
-                        id_type: None,
-                    },
-                )),
-                relationship: None,
-                on_behalf_of: None,
-                variables: Default::default(),
-                claims: vec![registry_notary_core::ClaimRef::new("claim-a")],
-                disclosure: None,
-                format: None,
-                purpose: Some("body-purpose".to_string()),
-            },
-            RequestOptions::default(),
-        )
-        .await
-        .expect("evaluate succeeds");
-
-    assert!(response.body.results.is_empty());
-}
-
-#[tokio::test]
-async fn raw_batch_preserves_body_only_purpose() {
-    let app = Router::new().route("/v1/batch-evaluations", post(body_purpose_batch_handler));
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .bearer_token("bearer-secret")
-        .build()
-        .expect("client builds");
-
-    let response = client
-        .batch_evaluate_request(
-            registry_notary_core::BatchEvaluateRequest {
-                items: vec![registry_notary_core::BatchEvaluateItemRequest::from(
-                    registry_notary_core::BatchSubjectRequest {
-                        id: "subject-1".to_string(),
-                        id_type: None,
-                        purpose: None,
-                    },
-                )],
-                claims: vec![registry_notary_core::ClaimRef::new("claim-a")],
-                disclosure: None,
-                format: None,
-                purpose: Some("body-purpose".to_string()),
-            },
-            RequestOptions::default(),
-        )
-        .await
-        .expect("batch evaluate succeeds");
-
-    assert_eq!(response.body.batch_id, "batch-1");
-}
-
-#[tokio::test]
-async fn typed_batch_rejects_platform_ceiling_plus_one_before_transport() {
-    let calls = Arc::new(AtomicUsize::new(0));
-    let app = Router::new()
-        .route(
-            "/v1/batch-evaluations",
-            post(|State(calls): State<Arc<AtomicUsize>>| async move {
-                calls.fetch_add(1, Ordering::SeqCst);
-                body_purpose_batch_handler(
-                    HeaderMap::new(),
-                    Bytes::from_static(br#"{"purpose":"body-purpose"}"#),
-                )
-                .await
-            }),
-        )
-        .with_state(Arc::clone(&calls));
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .bearer_token("bearer-secret")
-        .build()
-        .expect("client builds");
-    let item = registry_notary_core::BatchEvaluateItemRequest::from(
-        registry_notary_core::BatchSubjectRequest {
-            id: "subject-1".to_string(),
-            id_type: None,
-            purpose: None,
-        },
-    );
-    let error = client
-        .batch_evaluate_request(
-            registry_notary_core::BatchEvaluateRequest {
-                items: vec![item; MAX_BATCH_EVALUATION_MEMBERS_V1 + 1],
-                claims: vec![registry_notary_core::ClaimRef::new("claim-a")],
-                disclosure: None,
-                format: None,
-                purpose: Some("body-purpose".to_string()),
-            },
-            RequestOptions::default(),
-        )
-        .await
-        .expect_err("the typed client rejects the hard ceiling plus one");
-
-    assert!(matches!(
-        error,
-        NotaryClientError::Build(NotaryClientBuildError::BatchTooLarge {
-            actual,
-            maximum: MAX_BATCH_EVALUATION_MEMBERS_V1,
-        }) if actual == MAX_BATCH_EVALUATION_MEMBERS_V1 + 1
-    ));
-    assert_eq!(calls.load(Ordering::SeqCst), 0);
-}
-
-#[tokio::test]
-async fn raw_credential_issue_preserves_body_only_purpose() {
-    let app = Router::new().route(
-        "/v1/credentials",
-        post(body_purpose_issue_credential_handler),
-    );
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .bearer_token("bearer-secret")
-        .build()
-        .expect("client builds");
-
-    let response = client
-        .issue_credential_request(
-            registry_notary_core::CredentialIssueRequest {
-                evaluation_id: "eval-1".to_string(),
-                credential_profile: None,
-                format: None,
-                claims: None,
-                disclosure: None,
-                purpose: Some("body-purpose".to_string()),
-                holder: None,
-            },
-            RequestOptions::default(),
-        )
-        .await
-        .expect("credential issue succeeds");
-
-    assert_eq!(response.body.credential_id, "cred-1");
-}
-
-#[tokio::test]
-async fn idempotency_is_rejected_on_routes_that_ignore_it() {
-    let app = Router::new().route(
-        "/v1/evaluations/{evaluation_id}/render",
-        post(|| async { Json(json!({})) }),
-    );
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .bearer_token("bearer-secret")
-        .build()
-        .expect("client builds");
-
-    let error = client
-        .render_request(
-            registry_notary_core::RenderRequest {
-                evaluation_id: "eval-1".to_string(),
-                format: FORMAT_CLAIM_RESULT_JSON.to_string(),
-                disclosure: None,
-                claims: None,
-                purpose: None,
-            },
-            RequestOptions::builder()
-                .idempotency_key("ignored-key")
-                .build(),
-        )
-        .await
-        .expect_err("unsupported idempotency is rejected");
-
-    assert!(matches!(
-        error,
-        NotaryClientError::Build(NotaryClientBuildError::UnsupportedIdempotencyKey)
-    ));
-}
-
-#[tokio::test]
-async fn batch_retry_requires_idempotency_key() {
-    let state = Arc::new(AtomicUsize::new(0));
-    let app = Router::new()
-        .route("/v1/batch-evaluations", post(flaky_batch_handler))
-        .with_state(Arc::clone(&state));
-    let base = spawn(app).await;
-    let retry_policy = RetryPolicy {
-        max_attempts: 2,
-        retry_unavailable: true,
-        ..RetryPolicy::default()
-    };
-    let client = RegistryNotaryClient::builder(base)
-        .bearer_token("bearer-secret")
-        .default_purpose("benefits")
-        .retry_policy(retry_policy)
-        .build()
-        .expect("client builds");
-
-    let request = registry_notary_core::BatchEvaluateRequest {
-        items: vec![registry_notary_core::BatchEvaluateItemRequest::from(
-            registry_notary_core::BatchSubjectRequest {
-                id: "subject-1".to_string(),
-                id_type: None,
-                purpose: None,
-            },
-        )],
-        claims: vec![registry_notary_core::ClaimRef::new("claim-a")],
-        disclosure: None,
-        format: None,
-        purpose: None,
-    };
-
-    let without_key = client
-        .batch_evaluate_request(request.clone(), RequestOptions::default())
-        .await
-        .expect_err("without key no retry occurs");
-    assert!(matches!(without_key, NotaryClientError::Problem { .. }));
-    assert_eq!(state.load(Ordering::SeqCst), 1);
-    state.store(0, Ordering::SeqCst);
-
-    let with_key = client
-        .batch_evaluate_request(
-            request,
-            RequestOptions::builder()
-                .idempotency_key("batch-key")
-                .build(),
-        )
-        .await
-        .expect("with idempotency key retry succeeds");
-    assert_eq!(with_key.body.batch_id, "batch-1");
-    assert_eq!(state.load(Ordering::SeqCst), 2);
-}
-
-#[tokio::test]
-async fn retry_after_delta_on_problem_controls_retry_delay() {
-    let state = Arc::new(AtomicUsize::new(0));
-    let app = Router::new()
-        .route("/v1/claims", get(retry_after_then_claims_handler))
-        .with_state(Arc::clone(&state));
-    let base = spawn(app).await;
-    let retry_policy = RetryPolicy {
-        max_attempts: 2,
-        base_delay: Duration::from_secs(5),
-        max_delay: Duration::from_secs(5),
-        retry_unavailable: true,
-        ..RetryPolicy::default()
-    };
-    let client = RegistryNotaryClient::builder(base)
-        .retry_policy(retry_policy)
-        .build()
-        .expect("client builds");
-
-    let started = Instant::now();
-    let response = client
-        .list_claims(RequestOptions::default())
-        .await
-        .expect("retry-after zero allows immediate retry");
-
-    assert!(started.elapsed() < Duration::from_millis(500));
-    assert!(response.body.data.is_empty());
-    assert_eq!(state.load(Ordering::SeqCst), 2);
-}
-
-#[tokio::test]
-async fn retry_after_http_date_uses_server_date_for_retry_delay() {
-    let state = Arc::new(AtomicUsize::new(0));
-    let app = Router::new()
-        .route("/v1/claims", get(retry_after_http_date_then_claims_handler))
-        .with_state(Arc::clone(&state));
-    let base = spawn(app).await;
-    let retry_policy = RetryPolicy {
-        max_attempts: 2,
-        base_delay: Duration::from_secs(5),
-        max_delay: Duration::from_secs(5),
-        retry_unavailable: true,
-        ..RetryPolicy::default()
-    };
-    let client = RegistryNotaryClient::builder(base)
-        .retry_policy(retry_policy)
-        .build()
-        .expect("client builds");
-
-    let started = Instant::now();
-    let response = client
-        .list_claims(RequestOptions::default())
-        .await
-        .expect("retry-after HTTP-date equal to server date allows immediate retry");
-
-    assert!(started.elapsed() < Duration::from_millis(500));
-    assert!(response.body.data.is_empty());
-    assert_eq!(state.load(Ordering::SeqCst), 2);
-}
-
-#[tokio::test]
-async fn accepted_status_decode_error_keeps_response_status() {
-    let app = Router::new().route(
-        "/ready",
-        get(|| async {
-            (
-                StatusCode::SERVICE_UNAVAILABLE,
-                [("x-request-id", "req-ready-decode")],
-                "not-json",
-            )
-        }),
-    );
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .build()
-        .expect("client builds");
-
-    let error = client.ready().await.expect_err("invalid ready JSON fails");
-
-    match error {
-        NotaryClientError::Decode { status, request_id } => {
-            assert_eq!(status, StatusCode::SERVICE_UNAVAILABLE);
-            assert_eq!(request_id.as_deref(), Some("req-ready-decode"));
-        }
-        other => panic!("expected decode error, got {other:?}"),
-    }
-}
-
-#[tokio::test]
-async fn decode_error_display_is_opaque() {
-    let app = Router::new().route(
-        "/v1/claims",
-        get(|| async {
-            (
-                StatusCode::OK,
-                [("x-request-id", "req-decode")],
-                "not-json-with-secret-token",
-            )
-        }),
-    );
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .bearer_token("bearer-secret")
-        .build()
-        .expect("client builds");
-
-    let error = client
-        .list_claims(RequestOptions::default())
-        .await
-        .expect_err("invalid JSON fails");
-    assert_eq!(error.to_string(), "failed to decode response body");
-    assert!(!format!("{error:?}").contains("not-json-with-secret-token"));
-    assert_eq!(error.request_id(), Some("req-decode"));
-}
-
-#[tokio::test]
-async fn problem_debug_redacts_detail() {
-    let app = Router::new().route("/v1/claims", get(problem_with_sensitive_detail));
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .bearer_token("bearer-secret")
-        .build()
-        .expect("client builds");
-
-    let error = client
-        .list_claims(RequestOptions::default())
-        .await
-        .expect_err("problem maps");
-    assert!(!format!("{error:?}").contains("subj-sensitive"));
-    assert!(!error.to_string().contains("subj-sensitive"));
-}
-
-#[tokio::test]
-async fn body_too_large_error_is_opaque_and_carries_request_id() {
-    let body = format!("credential-secret-{}", "x".repeat(80 * 1024));
-    let app = Router::new().route(
-        "/healthz",
-        get(move || {
-            let body = body.clone();
-            async move { (StatusCode::OK, [("x-request-id", "req-large")], body) }
-        }),
-    );
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .build()
-        .expect("client builds");
-
-    let error = client.health().await.expect_err("body cap triggers");
-    assert!(matches!(error, NotaryClientError::BodyTooLarge { .. }));
-    assert_eq!(error.request_id(), Some("req-large"));
-    assert_eq!(
-        error.to_string(),
-        "response body exceeded configured size limit"
-    );
-    assert!(!format!("{error:?}").contains("credential-secret"));
-}
-
-#[tokio::test]
-async fn content_encoding_header_is_not_auto_decompressed() {
-    let app = Router::new().route(
-        "/v1/claims",
-        get(|| async {
-            (
-                StatusCode::OK,
-                [("content-encoding", "gzip")],
-                Json(json!({ "data": [] })),
-            )
-        }),
-    );
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .bearer_token("bearer-secret")
-        .build()
-        .expect("client builds");
-
-    let response = client
-        .list_claims(RequestOptions::default())
-        .await
-        .expect("plain body is not decompressed despite header");
-    assert!(response.body.data.is_empty());
-}
-
-#[cfg(feature = "federation")]
-#[tokio::test]
-async fn federation_posts_already_signed_jws_without_minting() {
-    let app = Router::new().route("/federation/v1/evaluations", post(federation_handler));
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .bearer_token("bearer-secret")
-        .build()
-        .expect("client builds");
-
-    let response = client
-        .federation_evaluate_jws("header.payload.signature", RequestOptions::default())
-        .await
-        .expect("federation succeeds");
-
-    assert_eq!(response.body, "signed-response-jws");
-}
-
-#[cfg(feature = "oid4vci")]
-#[tokio::test]
-async fn oid4vci_errors_use_oid4vci_envelope() {
-    let app = Router::new().route(
-        "/oid4vci/credential",
-        post(|| async {
-            (
-                StatusCode::BAD_REQUEST,
-                [("content-type", "application/json")],
-                Json(json!({
-                    "error": "invalid_request",
-                    "error_description": "nonce request contained sensitive value subj-1"
-                })),
-            )
-        }),
-    );
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .build()
-        .expect("client builds");
-
-    let error = client
-        .oid4vci_credential(
-            registry_platform_oid4vci::CredentialRequest {
-                format: registry_platform_oid4vci::SD_JWT_VC_FORMAT.to_string(),
-                credential_identifier: Some("person_is_alive_sd_jwt".to_string()),
-                credential_configuration_id: None,
-                vct: None,
-                proof: registry_platform_oid4vci::CredentialRequestProof {
-                    proof_type: registry_platform_oid4vci::PROOF_TYPE_JWT.to_string(),
-                    jwt: "proof-jwt".to_string(),
-                },
-                proofs: registry_platform_oid4vci::CredentialRequestProofs::default(),
-            },
-            RequestOptions::default(),
-        )
-        .await
-        .expect_err("oid4vci error maps");
-
-    assert_eq!(error.to_string(), "openid4vci error: invalid_request");
-    assert!(!format!("{error:?}").contains("subj-1"));
-
-    match error {
-        NotaryClientError::Oid4vci { error, .. } => {
-            assert_eq!(error.error, "invalid_request");
-            let portable = NotaryClientError::Oid4vci {
-                status: StatusCode::BAD_REQUEST,
-                error,
-                request_id: None,
-                retry_after: None,
-            }
-            .portable();
-            let rendered = serde_json::to_value(portable).expect("portable serializes");
-            assert!(rendered.get("detail").is_none());
-            assert!(!rendered.to_string().contains("subj-1"));
-        }
-        other => panic!("expected oid4vci error, got {other:?}"),
-    }
-}
-
-#[cfg(feature = "oid4vci")]
-#[tokio::test]
-async fn oid4vci_success_routes_parse_typed_responses() {
-    let app = Router::new()
-        .route(
-            "/.well-known/openid-credential-issuer",
-            get(oid4vci_metadata_handler),
-        )
-        .route("/oid4vci/credential", post(oid4vci_credential_handler));
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .build()
-        .expect("client builds");
-
-    let metadata = client
-        .oid4vci_issuer_metadata(RequestOptions::default())
-        .await
-        .expect("metadata");
-    let credential = client
-        .oid4vci_credential(
-            registry_platform_oid4vci::CredentialRequest {
-                format: registry_platform_oid4vci::SD_JWT_VC_FORMAT.to_string(),
-                credential_identifier: Some("person_is_alive_sd_jwt".to_string()),
-                credential_configuration_id: None,
-                vct: None,
-                proof: registry_platform_oid4vci::CredentialRequestProof {
-                    proof_type: registry_platform_oid4vci::PROOF_TYPE_JWT.to_string(),
-                    jwt: "proof-jwt".to_string(),
-                },
-                proofs: registry_platform_oid4vci::CredentialRequestProofs::default(),
-            },
-            RequestOptions::default(),
-        )
-        .await
-        .expect("credential");
-
-    assert_eq!(metadata.body.credential_issuer, "https://issuer.example");
-    assert_eq!(
-        credential.body.credential,
-        registry_platform_oid4vci::CredentialValue::from("sd-jwt-credential")
-    );
-
-    let metadata_debug = format!("{metadata:?}");
-    assert!(metadata_debug.contains("https://issuer.example"));
-
-    let credential_debug = format!("{credential:?}");
-    assert!(credential_debug.contains("<redacted>"));
-    assert!(!credential_debug.contains("sd-jwt-credential"));
-    assert!(!credential_debug.contains("proof-jwt"));
-}
-
-#[cfg(all(feature = "oid4vci", feature = "verifier"))]
-#[tokio::test]
-async fn oid4vci_verifier_rejects_object_credential_shape_before_jwks_fetch() {
-    let client = RegistryNotaryClient::builder("http://127.0.0.1:9")
-        .build()
-        .expect("client builds");
-    let response = registry_platform_oid4vci::CredentialResponse {
-        credential: registry_platform_oid4vci::CredentialValue::Object(json!({
-            "credential": "not-a-compact-sd-jwt"
-        })),
-        credentials: Vec::new(),
-        format: Some(registry_platform_oid4vci::SD_JWT_VC_FORMAT.to_string()),
-        c_nonce: None,
-        c_nonce_expires_in: None,
-    };
-
-    let error = client
-        .verify_oid4vci_credential(
-            &response,
-            registry_notary_client::VerifyOptions::new("https://issuer.example"),
-        )
-        .await
-        .expect_err("object credential shape is not a compact SD-JWT VC");
-
-    assert_eq!(error.code(), "credential.unsupported_shape");
-}
-
-async fn evaluate_handler(headers: HeaderMap, body: Bytes) -> Response {
-    assert_eq!(
-        headers
-            .get("authorization")
-            .and_then(|value| value.to_str().ok()),
-        Some("Bearer bearer-secret")
-    );
-    assert_eq!(
-        headers.get("accept").and_then(|value| value.to_str().ok()),
-        Some(FORMAT_CLAIM_RESULT_JSON)
-    );
-    assert_eq!(
-        headers
-            .get("data-purpose")
-            .and_then(|value| value.to_str().ok()),
-        Some("benefits")
-    );
-    let parsed: serde_json::Value = serde_json::from_slice(&body).expect("body parses");
-    assert_eq!(parsed["format"], json!(FORMAT_CLAIM_RESULT_JSON));
-    assert_eq!(parsed["target"]["type"], json!("Person"));
-    assert_eq!(
-        parsed["target"]["identifiers"],
-        json!([{
-            "scheme": "NATIONAL_ID",
-            "value": "subject-1",
-            "issuer": "civil_registry"
-        }])
-    );
-    assert_eq!(parsed["relationship"]["type"], json!("self"));
-    assert_eq!(parsed["variables"]["as_of_date"], json!("2026-01-01"));
-    (
-        StatusCode::OK,
-        [("x-request-id", "req-123")],
-        Json(json!({ "results": [] })),
-    )
-        .into_response()
-}
-
-async fn body_purpose_evaluate_handler(headers: HeaderMap, body: Bytes) -> Response {
-    assert_eq!(
-        headers
-            .get("authorization")
-            .and_then(|value| value.to_str().ok()),
-        Some("Bearer bearer-secret")
-    );
-    assert_eq!(
-        headers
-            .get("data-purpose")
-            .and_then(|value| value.to_str().ok()),
-        Some("body-purpose")
-    );
-    let parsed: serde_json::Value = serde_json::from_slice(&body).expect("body parses");
-    assert_eq!(parsed["purpose"], json!("body-purpose"));
-    assert_eq!(parsed["format"], json!(FORMAT_CLAIM_RESULT_JSON));
-    Json(json!({ "results": [] })).into_response()
-}
-
-async fn body_purpose_batch_handler(headers: HeaderMap, body: Bytes) -> Response {
-    assert_eq!(
-        headers
-            .get("authorization")
-            .and_then(|value| value.to_str().ok()),
-        Some("Bearer bearer-secret")
-    );
-    assert_eq!(
-        headers
-            .get("data-purpose")
-            .and_then(|value| value.to_str().ok()),
-        Some("body-purpose")
-    );
-    let parsed: serde_json::Value = serde_json::from_slice(&body).expect("body parses");
-    assert_eq!(parsed["purpose"], json!("body-purpose"));
-    assert_eq!(parsed["format"], json!(FORMAT_CLAIM_RESULT_JSON));
-    Json(json!({
-        "batch_id": "batch-1",
-        "status": "completed",
-        "claims": ["claim-a"],
-        "items": [],
-        "summary": { "succeeded": 0, "failed": 0 }
-    }))
-    .into_response()
-}
-
-async fn body_purpose_issue_credential_handler(headers: HeaderMap, body: Bytes) -> Response {
-    assert_eq!(
-        headers
-            .get("authorization")
-            .and_then(|value| value.to_str().ok()),
-        Some("Bearer bearer-secret")
-    );
-    assert_eq!(
-        headers
-            .get("data-purpose")
-            .and_then(|value| value.to_str().ok()),
-        Some("body-purpose")
-    );
-    let parsed: serde_json::Value = serde_json::from_slice(&body).expect("issue body parses");
-    assert_eq!(parsed["purpose"], json!("body-purpose"));
-    issue_credential_json()
-}
-
-async fn health_handler() -> Response {
-    Json(json!({ "status": "ok", "checks": {} })).into_response()
-}
-
-async fn base_path_health_handler(uri: Uri) -> Response {
-    assert_eq!(uri.path(), "/tenant%20one/healthz");
-    health_handler().await
-}
-
-async fn admin_reload_handler(headers: HeaderMap) -> Response {
-    assert_eq!(
-        headers
-            .get("x-api-key")
-            .and_then(|value| value.to_str().ok()),
-        Some("api-secret")
-    );
-    Json(json!({ "reloaded": false, "status": "noop", "detail": "unchanged" })).into_response()
-}
-
-async fn jwks_static_handler() -> Response {
-    Json(json!({ "keys": [{ "kty": "OKP", "kid": "kid-static", "crv": "Ed25519", "x": "abc" }] }))
-        .into_response()
-}
-
-async fn claim_handler(Path(claim_id): Path<String>, uri: Uri) -> Response {
-    assert_eq!(uri.path(), "/v1/claims/claim%20one");
-    Json(json!({ "id": claim_id, "title": "Claim One" })).into_response()
-}
-
-async fn render_handler(Path(evaluation_id): Path<String>, body: Bytes) -> Response {
-    assert_eq!(evaluation_id, "eval-1");
-    let parsed: serde_json::Value = serde_json::from_slice(&body).expect("render body parses");
-    assert!(parsed.get("evaluation_id").is_none());
-    Json(json!({ "rendered": true })).into_response()
-}
-
-async fn issue_credential_handler(body: Bytes) -> Response {
-    let parsed: serde_json::Value = serde_json::from_slice(&body).expect("issue body parses");
-    assert_eq!(parsed["evaluation_id"], "eval-1");
-    issue_credential_json()
-}
-
-fn issue_credential_json() -> Response {
-    Json(json!({
-        "credential_id": "cred-1",
-        "credential_profile": "profile-1",
-        "format": "application/dc+sd-jwt",
-        "issuer": "did:web:notary.example",
-        "expires_at": "2026-05-29T00:00:00Z",
-        "credential": "issuer.jwt~disclosure~",
-        "issuer_signed_jwt": "issuer.jwt",
-        "disclosures": ["disclosure"]
-    }))
-    .into_response()
-}
-
-async fn credential_status_handler(Path(credential_id): Path<String>, uri: Uri) -> Response {
-    assert_eq!(uri.path(), "/v1/credentials/cred%201/status");
-    Json(credential_status_json(&credential_id, "valid")).into_response()
-}
-
-async fn update_credential_status_handler(
-    Path(credential_id): Path<String>,
-    body: Bytes,
-) -> Response {
-    let parsed: serde_json::Value = serde_json::from_slice(&body).expect("status body parses");
-    assert_eq!(parsed["status"], "revoked");
-    Json(credential_status_json(&credential_id, "revoked")).into_response()
-}
-
-fn credential_status_json(credential_id: &str, status: &str) -> serde_json::Value {
-    json!({
-        "credential_id": credential_id,
-        "issuer": "did:web:notary.example",
-        "credential_profile": "profile-1",
-        "status": status,
-        "issued_at": "2026-05-29T00:00:00Z",
-        "expires_at": "2026-05-30T00:00:00Z",
-        "updated_at": "2026-05-29T01:00:00Z"
-    })
-}
-
-async fn flaky_batch_handler(
-    State(counter): State<Arc<AtomicUsize>>,
-    headers: HeaderMap,
-) -> Response {
-    let call = counter.fetch_add(1, Ordering::SeqCst) + 1;
-    if call == 1 {
-        return problem(StatusCode::SERVICE_UNAVAILABLE);
-    }
-    if headers
-        .get("idempotency-key")
-        .and_then(|value| value.to_str().ok())
-        != Some("batch-key")
-    {
-        return problem(StatusCode::SERVICE_UNAVAILABLE);
-    }
-    Json(json!({
-        "batch_id": "batch-1",
-        "status": "completed",
-        "claims": ["claim-a"],
-        "items": [],
-        "summary": { "succeeded": 0, "failed": 0 }
-    }))
-    .into_response()
-}
-
-async fn retry_after_then_claims_handler(State(counter): State<Arc<AtomicUsize>>) -> Response {
-    let call = counter.fetch_add(1, Ordering::SeqCst) + 1;
-    if call == 1 {
-        return (
-            StatusCode::SERVICE_UNAVAILABLE,
-            [("retry-after", "0")],
-            Json(json!({
-                "type": "https://id.registrystack.org/problems/registry-notary/source/unavailable",
-                "title": "Evidence not available",
-                "status": 503,
-                "detail": "evidence not available",
-                "code": "evidence.not_available"
-            })),
-        )
-            .into_response();
-    }
-    Json(json!({ "data": [] })).into_response()
-}
-
-async fn retry_after_http_date_then_claims_handler(
-    State(counter): State<Arc<AtomicUsize>>,
-) -> Response {
-    let call = counter.fetch_add(1, Ordering::SeqCst) + 1;
-    if call == 1 {
-        return (
-            StatusCode::SERVICE_UNAVAILABLE,
-            [
-                ("retry-after", "Wed, 31 Dec 2099 00:00:00 GMT"),
-                ("date", "Wed, 31 Dec 2099 00:00:00 GMT"),
-            ],
-            Json(json!({
-                "type": "https://id.registrystack.org/problems/registry-notary/source/unavailable",
-                "title": "Evidence not available",
-                "status": 503,
-                "detail": "evidence not available",
-                "code": "evidence.not_available"
-            })),
-        )
-            .into_response();
-    }
-    Json(json!({ "data": [] })).into_response()
-}
-
-async fn jwks_handler(State(counter): State<Arc<AtomicUsize>>) -> Response {
-    let call = counter.fetch_add(1, Ordering::SeqCst) + 1;
-    Json(json!({
-        "keys": [
-            { "kty": "OKP", "kid": format!("kid-{call}"), "crv": "Ed25519", "x": "abc" }
-        ]
-    }))
-    .into_response()
-}
-
-#[cfg(feature = "federation")]
-async fn federation_handler(headers: HeaderMap, body: Bytes) -> Response {
-    assert_eq!(
-        headers
-            .get("content-type")
-            .and_then(|value| value.to_str().ok()),
-        Some("application/jwt")
-    );
-    assert_eq!(body.as_ref(), b"header.payload.signature");
-    "signed-response-jws".into_response()
-}
-
-#[cfg(feature = "oid4vci")]
-async fn oid4vci_metadata_handler() -> Response {
-    Json(json!({
-        "credential_issuer": "https://issuer.example",
-        "credential_endpoint": "https://issuer.example/oid4vci/credential",
-        "credential_configurations_supported": {}
-    }))
-    .into_response()
-}
-
-#[cfg(feature = "oid4vci")]
-async fn oid4vci_credential_handler(body: Bytes) -> Response {
-    let parsed: serde_json::Value = serde_json::from_slice(&body).expect("credential body parses");
-    assert_eq!(parsed["proof"]["jwt"], "proof-jwt");
-    Json(json!({
-        "credential": "sd-jwt-credential",
-        "format": "dc+sd-jwt"
-    }))
-    .into_response()
-}
-
-fn problem(status: StatusCode) -> Response {
-    (
-        status,
-        [("content-type", "application/problem+json")],
-        Json(json!({
-            "type": "https://id.registrystack.org/problems/registry-notary/source/unavailable",
-            "title": "Evidence not available",
-            "status": status.as_u16(),
-            "detail": "the requested evidence is unavailable",
-            "code": "evidence.not_available"
-        })),
-    )
-        .into_response()
-}
-
-async fn problem_with_sensitive_detail() -> Response {
-    (
-        StatusCode::NOT_FOUND,
-        [("content-type", "application/problem+json")],
-        Json(json!({
-            "type": "https://id.registrystack.org/problems/registry-notary/source/not-found",
-            "title": "Source missing",
-            "status": 404,
-            "detail": "subject subj-sensitive was not found",
-            "code": "source.not_found"
-        })),
-    )
-        .into_response()
-}
-
-async fn spawn(app: Router) -> String {
-    let listener = TcpListener::bind("127.0.0.1:0")
-        .await
-        .expect("test server binds");
-    let addr: SocketAddr = listener.local_addr().expect("local addr available");
-    tokio::spawn(async move {
-        axum::serve(listener, app)
-            .await
-            .expect("test server serves");
-    });
-    format!("http://{addr}")
-}
diff --git a/crates/registry-notary-client/tests/facade_contract.rs b/crates/registry-notary-client/tests/facade_contract.rs
deleted file mode 100644
index 18a75a6af..000000000
--- a/crates/registry-notary-client/tests/facade_contract.rs
+++ /dev/null
@@ -1,230 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-#![cfg(feature = "json-facade")]
-
-use std::net::SocketAddr;
-
-use axum::http::{HeaderMap, StatusCode};
-use axum::response::{IntoResponse, Response};
-use axum::routing::{get, post};
-use axum::{Json, Router};
-use registry_notary_client::facade::NotaryClientHandle;
-use registry_notary_client::{PortableErrorKind, RegistryNotaryClient};
-use registry_notary_core::FORMAT_CLAIM_RESULT_JSON;
-use serde_json::json;
-use tokio::net::TcpListener;
-
-#[tokio::test]
-async fn facade_accepts_canonical_snake_case_json() {
-    let app = Router::new().route("/v1/evaluations", post(evaluate_handler));
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .bearer_token("bearer-secret")
-        .default_purpose("benefits")
-        .build()
-        .expect("client builds");
-    let handle = NotaryClientHandle::new(client);
-
-    let response = handle
-        .evaluate_json(
-            json!({
-                "target": {
-                    "type": "Person",
-                    "identifiers": [{ "scheme": "NATIONAL_ID", "value": "subject-1" }]
-                },
-                "claims": ["claim-a"]
-            }),
-            json!({}),
-        )
-        .await
-        .expect("facade evaluate succeeds");
-
-    assert_eq!(response, json!({ "results": [] }));
-}
-
-#[tokio::test]
-async fn facade_core_methods_share_typed_validation_and_wire_shape() {
-    let app = Router::new()
-        .route("/v1/batch-evaluations", post(batch_handler))
-        .route(
-            "/v1/evaluations/{evaluation_id}/render",
-            post(render_handler),
-        )
-        .route("/v1/credentials", post(issue_handler))
-        .route(
-            "/v1/claims",
-            get(|| async { Json(json!({ "data": [{ "id": "claim-a" }] })) }),
-        )
-        .route(
-            "/v1/claims/claim-a",
-            get(|| async { Json(json!({ "id": "claim-a" })) }),
-        )
-        .route(
-            "/v1/credentials/cred-1/status",
-            get(|| async { Json(credential_status("valid")) }),
-        );
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .default_purpose("benefits")
-        .build()
-        .expect("client builds");
-    let handle = NotaryClientHandle::new(client);
-
-    let batch = handle
-        .batch_evaluate_json(
-            json!({
-                "items": [{
-                    "target": {
-                        "type": "Person",
-                        "identifiers": [{ "scheme": "NATIONAL_ID", "value": "subject-1" }]
-                    }
-                }],
-                "claims": ["claim-a"]
-            }),
-            json!({ "idempotency_key": "batch-key" }),
-        )
-        .await
-        .expect("facade batch succeeds");
-    let rendered = handle
-        .render_json(
-            json!({ "evaluation_id": "eval-1", "format": FORMAT_CLAIM_RESULT_JSON }),
-            json!({}),
-        )
-        .await
-        .expect("facade render succeeds");
-    let issued = handle
-        .issue_credential_json(json!({ "evaluation_id": "eval-1" }), json!({}))
-        .await
-        .expect("facade issue succeeds");
-    let claims = handle
-        .list_claims_json(json!({}))
-        .await
-        .expect("facade list claims succeeds");
-    let claim = handle
-        .get_claim_json("claim-a".to_string(), json!({}))
-        .await
-        .expect("facade get claim succeeds");
-    let status = handle
-        .credential_status_json("cred-1".to_string(), json!({}))
-        .await
-        .expect("facade credential status succeeds");
-
-    assert_eq!(batch["batch_id"], "batch-1");
-    assert_eq!(rendered["rendered"], true);
-    assert_eq!(issued["credential_id"], "cred-1");
-    assert_eq!(claims["data"][0]["id"], "claim-a");
-    assert_eq!(claim["id"], "claim-a");
-    assert_eq!(status["status"], "valid");
-}
-
-#[tokio::test]
-async fn facade_error_excludes_detail() {
-    let app = Router::new().route("/v1/claims", get(problem_handler));
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .bearer_token("bearer-secret")
-        .build()
-        .expect("client builds");
-    let handle = NotaryClientHandle::new(client);
-
-    let error = handle
-        .list_claims_json(json!({}))
-        .await
-        .expect_err("problem maps to portable error");
-
-    assert_eq!(error.kind, PortableErrorKind::Problem);
-    assert_eq!(error.status, Some(404));
-    assert_eq!(error.code.as_deref(), Some("target.not_found"));
-    assert_eq!(error.title, "Target not found");
-    let rendered = serde_json::to_value(&error).expect("portable error serializes");
-    assert!(rendered.get("detail").is_none());
-}
-
-async fn evaluate_handler(headers: HeaderMap) -> Response {
-    assert_eq!(
-        headers
-            .get("data-purpose")
-            .and_then(|value| value.to_str().ok()),
-        Some("benefits")
-    );
-    assert_eq!(
-        headers.get("accept").and_then(|value| value.to_str().ok()),
-        Some(FORMAT_CLAIM_RESULT_JSON)
-    );
-    Json(json!({ "results": [] })).into_response()
-}
-
-async fn batch_handler(headers: HeaderMap) -> Response {
-    assert_eq!(
-        headers
-            .get("idempotency-key")
-            .and_then(|value| value.to_str().ok()),
-        Some("batch-key")
-    );
-    Json(json!({
-        "batch_id": "batch-1",
-        "status": "completed",
-        "claims": ["claim-a"],
-        "items": [],
-        "summary": { "succeeded": 0, "failed": 0 }
-    }))
-    .into_response()
-}
-
-async fn render_handler() -> Response {
-    Json(json!({ "rendered": true })).into_response()
-}
-
-async fn issue_handler() -> Response {
-    Json(json!({
-        "credential_id": "cred-1",
-        "credential_profile": "profile-1",
-        "format": "application/dc+sd-jwt",
-        "issuer": "did:web:notary.example",
-        "expires_at": "2026-05-29T00:00:00Z",
-        "credential": "issuer.jwt~disclosure~",
-        "issuer_signed_jwt": "issuer.jwt",
-        "disclosures": ["disclosure"]
-    }))
-    .into_response()
-}
-
-fn credential_status(status: &str) -> serde_json::Value {
-    json!({
-        "credential_id": "cred-1",
-        "issuer": "did:web:notary.example",
-        "credential_profile": "profile-1",
-        "status": status,
-        "issued_at": "2026-05-29T00:00:00Z",
-        "expires_at": "2026-05-30T00:00:00Z",
-        "updated_at": "2026-05-29T01:00:00Z"
-    })
-}
-
-async fn problem_handler() -> Response {
-    (
-        StatusCode::NOT_FOUND,
-        [("content-type", "application/problem+json")],
-        Json(json!({
-            "type": "https://id.registrystack.org/problems/registry-notary/target/not-found",
-            "title": "Target not found",
-            "status": 404,
-            "detail": "target identifier subj-sensitive was not found",
-            "code": "target.not_found"
-        })),
-    )
-        .into_response()
-}
-
-async fn spawn(app: Router) -> String {
-    let listener = TcpListener::bind("127.0.0.1:0")
-        .await
-        .expect("test server binds");
-    let addr: SocketAddr = listener.local_addr().expect("local addr available");
-    tokio::spawn(async move {
-        axum::serve(listener, app)
-            .await
-            .expect("test server serves");
-    });
-    format!("http://{addr}")
-}
diff --git a/crates/registry-notary-client/tests/status_verifier_contract.rs b/crates/registry-notary-client/tests/status_verifier_contract.rs
deleted file mode 100644
index 83c53e94a..000000000
--- a/crates/registry-notary-client/tests/status_verifier_contract.rs
+++ /dev/null
@@ -1,527 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-#![cfg(all(feature = "verifier", feature = "test-support"))]
-
-use std::collections::BTreeMap;
-use std::io::Write;
-use std::sync::{Arc, Mutex};
-
-use axum::body::Body;
-use axum::extract::State;
-use axum::http::{header, HeaderValue, Response, StatusCode};
-use axum::routing::get;
-use axum::{Json, Router};
-use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-use base64::Engine;
-use flate2::write::ZlibEncoder;
-use flate2::Compression;
-use registry_notary_client::verifier;
-use registry_notary_client::{
-    RegistryNotaryClient, StatusListPolicy, VerificationError, VerifyOptions,
-};
-use registry_platform_crypto::PrivateJwk;
-use registry_platform_sdjwt::{Disclosure, SdJwtIssuanceInput, SdJwtIssuer};
-use serde_json::{json, Value};
-use time::OffsetDateTime;
-use tokio::net::TcpListener;
-
-const ISSUER: &str = "did:web:issuer.test";
-const VCT: &str = "https://vct.example/test";
-const NOW: i64 = 1_700_000_010;
-const ISSUER_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"did:web:issuer.test#key-1"}"#;
-
-#[derive(Clone)]
-struct HarnessState {
-    jwks: Value,
-    status: Arc<Mutex<StatusHttpResponse>>,
-}
-
-#[derive(Clone)]
-struct StatusHttpResponse {
-    status: StatusCode,
-    content_type: Option<&'static str>,
-    content_encoding: Option<&'static str>,
-    location: Option<&'static str>,
-    body: String,
-}
-
-impl Default for StatusHttpResponse {
-    fn default() -> Self {
-        Self {
-            status: StatusCode::SERVICE_UNAVAILABLE,
-            content_type: Some("application/statuslist+jwt"),
-            content_encoding: None,
-            location: None,
-            body: String::new(),
-        }
-    }
-}
-
-struct StatusHarness {
-    base_url: String,
-    status_uri: String,
-    state: HarnessState,
-    client: RegistryNotaryClient,
-}
-
-impl StatusHarness {
-    async fn start() -> Self {
-        let state = HarnessState {
-            jwks: jwks(),
-            status: Arc::new(Mutex::new(StatusHttpResponse::default())),
-        };
-        let app = Router::new()
-            .route("/.well-known/evidence/jwks.json", get(jwks_handler))
-            .route("/status", get(status_handler))
-            .with_state(state.clone());
-        let listener = TcpListener::bind("127.0.0.1:0")
-            .await
-            .expect("test listener binds");
-        let address = listener.local_addr().expect("test listener has address");
-        tokio::spawn(async move {
-            axum::serve(listener, app)
-                .await
-                .expect("test server remains available");
-        });
-        let base_url = format!("http://{address}");
-        let status_uri = format!("{base_url}/status");
-        let client = RegistryNotaryClient::builder(&base_url)
-            .build()
-            .expect("test client builds");
-        Self {
-            base_url,
-            status_uri,
-            state,
-            client,
-        }
-    }
-
-    fn options(&self) -> VerifyOptions {
-        VerifyOptions::new(ISSUER)
-            .now(OffsetDateTime::from_unix_timestamp(NOW).expect("test time is valid"))
-            .status_list(
-                StatusListPolicy::loopback_for_testing(ISSUER, &self.base_url)
-                    .expect("loopback test policy is valid"),
-            )
-    }
-
-    async fn credential(&self, status_uri: &str, index: u64) -> String {
-        issuer()
-            .issue(SdJwtIssuanceInput {
-                iss: ISSUER.to_string(),
-                sub_ref: "subject-ref".to_string(),
-                credential_id: Some("urn:ulid:01HG0000000000000000000000".to_string()),
-                iat: NOW,
-                exp: NOW + 600,
-                vct: VCT.to_string(),
-                status: Some(json!({
-                    "status_list": {
-                        "idx": index,
-                        "uri": status_uri,
-                    }
-                })),
-                public_claims: BTreeMap::new(),
-                cnf: None,
-                disclosures: vec![Disclosure {
-                    name: "claim-a".to_string(),
-                    value: json!({"satisfied": true}),
-                }],
-            })
-            .await
-            .expect("status-bearing credential issues")
-            .jwt
-    }
-
-    async fn signed_status(&self, payload: Value) -> String {
-        issuer()
-            .sign_compact_jwt("statuslist+jwt", payload)
-            .await
-            .expect("status token signs")
-    }
-
-    fn valid_payload(&self, encoded_list: &str) -> Value {
-        json!({
-            "iss": ISSUER,
-            "sub": self.status_uri,
-            "aud": self.status_uri,
-            "iat": NOW,
-            "exp": NOW + 100,
-            "ttl": 100,
-            "status_list": {
-                "bits": 8,
-                "lst": encoded_list,
-            }
-        })
-    }
-
-    fn respond(&self, response: StatusHttpResponse) {
-        *self.state.status.lock().expect("status response lock") = response;
-    }
-
-    async fn respond_with_token(&self, token: String) {
-        self.respond(StatusHttpResponse {
-            status: StatusCode::OK,
-            body: token,
-            ..StatusHttpResponse::default()
-        });
-    }
-}
-
-#[tokio::test]
-async fn async_verifier_accepts_signed_valid_status() {
-    let harness = StatusHarness::start().await;
-    let credential = harness.credential(&harness.status_uri, 0).await;
-    let token = harness
-        .signed_status(harness.valid_payload("eJxjAAAAAQAB"))
-        .await;
-    harness.respond_with_token(token).await;
-
-    let verified = harness
-        .client
-        .verify_sd_jwt_vc(&credential, harness.options())
-        .await
-        .expect("valid status-bearing credential verifies");
-
-    assert_eq!(verified.issuer, ISSUER);
-}
-
-#[tokio::test]
-async fn synchronous_verifier_never_skips_status() {
-    let harness = StatusHarness::start().await;
-    let credential = harness.credential(&harness.status_uri, 0).await;
-
-    let missing_policy = verifier::verify_sd_jwt_vc(
-        &credential,
-        &jwks(),
-        &VerifyOptions::new(ISSUER)
-            .now(OffsetDateTime::from_unix_timestamp(NOW).expect("test time is valid")),
-    )
-    .expect_err("status cannot be skipped without policy");
-    assert_code(missing_policy, "status.policy_required");
-
-    let requires_fetch = verifier::verify_sd_jwt_vc(&credential, &jwks(), &harness.options())
-        .expect_err("synchronous verification cannot skip the fetch");
-    assert_code(requires_fetch, "status.fetch_required");
-}
-
-#[tokio::test]
-async fn revoked_suspended_and_unknown_status_fail_closed() {
-    for (encoded, expected_code) in [
-        ("eJxjBAAAAgAC", "status.revoked"),
-        ("eJxjAgAAAwAD", "status.suspended"),
-        (&encoded_status_list(&[3]), "status.unknown"),
-    ] {
-        let harness = StatusHarness::start().await;
-        let credential = harness.credential(&harness.status_uri, 0).await;
-        let token = harness.signed_status(harness.valid_payload(encoded)).await;
-        harness.respond_with_token(token).await;
-
-        let error = harness
-            .client
-            .verify_sd_jwt_vc(&credential, harness.options())
-            .await
-            .expect_err("non-valid status is rejected");
-        assert_code(error, expected_code);
-    }
-}
-
-#[tokio::test]
-async fn invalid_status_claims_signature_index_and_compression_fail_closed() {
-    let harness = StatusHarness::start().await;
-    let mut cases = Vec::new();
-
-    let mut wrong_issuer = harness.valid_payload("eJxjAAAAAQAB");
-    wrong_issuer["iss"] = json!("did:web:other.example");
-    cases.push((wrong_issuer, 0, "status.claim.issuer_mismatch"));
-
-    let mut wrong_uri = harness.valid_payload("eJxjAAAAAQAB");
-    wrong_uri["sub"] = json!(format!("{}/other", harness.base_url));
-    cases.push((wrong_uri, 0, "status.claim.uri_mismatch"));
-
-    let mut wrong_audience = harness.valid_payload("eJxjAAAAAQAB");
-    wrong_audience["aud"] = json!("https://verifier.example");
-    cases.push((wrong_audience, 0, "status.claim.audience_mismatch"));
-
-    let mut stale = harness.valid_payload("eJxjAAAAAQAB");
-    stale["iat"] = json!(NOW - 400);
-    stale["exp"] = json!(NOW - 300);
-    cases.push((stale, 0, "status.claim.time_invalid"));
-
-    let mut excessive_lifetime = harness.valid_payload("eJxjAAAAAQAB");
-    excessive_lifetime["exp"] = json!(NOW + 301);
-    excessive_lifetime["ttl"] = json!(301);
-    cases.push((excessive_lifetime, 0, "status.claim.time_invalid"));
-
-    cases.push((
-        harness.valid_payload("eJxjAAAAAQAB"),
-        1,
-        "status.index.invalid",
-    ));
-
-    let decompression_bomb = encoded_status_list(&vec![0; 128 * 1024 + 1]);
-    cases.push((
-        harness.valid_payload(&decompression_bomb),
-        0,
-        "status.list.decompression_limit",
-    ));
-
-    for (payload, index, expected_code) in cases {
-        let credential = harness.credential(&harness.status_uri, index).await;
-        let token = harness.signed_status(payload).await;
-        harness.respond_with_token(token).await;
-        let error = harness
-            .client
-            .verify_sd_jwt_vc(&credential, harness.options())
-            .await
-            .expect_err("invalid status material is rejected");
-        assert_code(error, expected_code);
-    }
-
-    let credential = harness.credential(&harness.status_uri, 0).await;
-    let token = harness
-        .signed_status(harness.valid_payload("eJxjAAAAAQAB"))
-        .await;
-    harness.respond_with_token(tamper_signature(&token)).await;
-    let error = harness
-        .client
-        .verify_sd_jwt_vc(&credential, harness.options())
-        .await
-        .expect_err("invalid status signature is rejected");
-    assert_code(error, "status.signature.invalid");
-
-    let valid_token = harness
-        .signed_status(harness.valid_payload("eJxjAAAAAQAB"))
-        .await;
-    for (token, expected_code) in [
-        (
-            rewrite_status_header(&valid_token, |header| {
-                header["kid"] = json!("did:web:issuer.test#unknown")
-            }),
-            "status.key.unknown",
-        ),
-        (
-            rewrite_status_header(&valid_token, |header| header["alg"] = json!("RS256")),
-            "status.algorithm.disallowed",
-        ),
-        (
-            rewrite_status_header(&valid_token, |header| {
-                header["jku"] = json!("https://attacker.example/jwks.json")
-            }),
-            "status.header.untrusted_key_reference",
-        ),
-    ] {
-        harness.respond_with_token(token).await;
-        let error = harness
-            .client
-            .verify_sd_jwt_vc(&credential, harness.options())
-            .await
-            .expect_err("untrusted status signing metadata is rejected");
-        assert_code(error, expected_code);
-    }
-}
-
-#[tokio::test]
-async fn status_transport_rejects_redirect_media_type_encoding_and_size() {
-    let harness = StatusHarness::start().await;
-    let credential = harness.credential(&harness.status_uri, 0).await;
-
-    let cases = [
-        (
-            StatusHttpResponse {
-                status: StatusCode::SERVICE_UNAVAILABLE,
-                ..StatusHttpResponse::default()
-            },
-            "status.http_status_invalid",
-        ),
-        (
-            StatusHttpResponse {
-                status: StatusCode::FOUND,
-                location: Some("https://other.example/status"),
-                ..StatusHttpResponse::default()
-            },
-            "status.redirect_denied",
-        ),
-        (
-            StatusHttpResponse {
-                status: StatusCode::OK,
-                content_type: Some("application/json"),
-                body: "not-a-token".to_string(),
-                ..StatusHttpResponse::default()
-            },
-            "status.media_type_invalid",
-        ),
-        (
-            StatusHttpResponse {
-                status: StatusCode::OK,
-                content_encoding: Some("gzip"),
-                body: "not-a-token".to_string(),
-                ..StatusHttpResponse::default()
-            },
-            "status.content_encoding_denied",
-        ),
-        (
-            StatusHttpResponse {
-                status: StatusCode::OK,
-                body: "not-a-compact-jwt".to_string(),
-                ..StatusHttpResponse::default()
-            },
-            "status.token_malformed",
-        ),
-        (
-            StatusHttpResponse {
-                status: StatusCode::OK,
-                body: "x".repeat(256 * 1024 + 1),
-                ..StatusHttpResponse::default()
-            },
-            "status.response_too_large",
-        ),
-    ];
-
-    for (response, expected_code) in cases {
-        harness.respond(response);
-        let error = harness
-            .client
-            .verify_sd_jwt_vc(&credential, harness.options())
-            .await
-            .expect_err("unsafe status response is rejected");
-        assert_code(error, expected_code);
-    }
-}
-
-#[tokio::test]
-async fn status_origin_and_destination_must_be_explicit_and_safe() {
-    let harness = StatusHarness::start().await;
-    let untrusted_uri = "https://status.other.example/status";
-    let credential = harness.credential(untrusted_uri, 0).await;
-    let error = harness
-        .client
-        .verify_sd_jwt_vc(&credential, harness.options())
-        .await
-        .expect_err("unlisted status origin is rejected before fetch");
-    assert_code(error, "status.origin_untrusted");
-
-    let unsafe_uri = "https://127.0.0.1/status";
-    let credential = harness.credential(unsafe_uri, 0).await;
-    let options = VerifyOptions::new(ISSUER)
-        .now(OffsetDateTime::from_unix_timestamp(NOW).expect("test time is valid"))
-        .status_list(
-            StatusListPolicy::new(ISSUER, "https://127.0.0.1")
-                .expect("structurally valid HTTPS origin"),
-        );
-    let error = harness
-        .client
-        .verify_sd_jwt_vc(&credential, options)
-        .await
-        .expect_err("private destination is rejected");
-    assert_code(error, "status.destination_unsafe");
-
-    let closed_listener = TcpListener::bind("127.0.0.1:0")
-        .await
-        .expect("closed-port probe binds");
-    let closed_address = closed_listener
-        .local_addr()
-        .expect("closed-port probe has address");
-    drop(closed_listener);
-    let unreachable_origin = format!("http://{closed_address}");
-    let unreachable_uri = format!("{unreachable_origin}/status");
-    let credential = harness.credential(&unreachable_uri, 0).await;
-    let options = VerifyOptions::new(ISSUER)
-        .now(OffsetDateTime::from_unix_timestamp(NOW).expect("test time is valid"))
-        .status_list(
-            StatusListPolicy::loopback_for_testing(ISSUER, unreachable_origin)
-                .expect("loopback test policy is valid"),
-        );
-    let error = harness
-        .client
-        .verify_sd_jwt_vc(&credential, options)
-        .await
-        .expect_err("unreachable status endpoint is rejected");
-    assert_code(error, "status.unreachable");
-}
-
-#[test]
-fn status_policy_requires_exact_https_origins() {
-    assert!(StatusListPolicy::new(ISSUER, "http://status.example").is_err());
-    assert!(StatusListPolicy::new(ISSUER, "https://status.example/path").is_err());
-    assert!(StatusListPolicy::new(ISSUER, "https://user@status.example").is_err());
-    assert!(StatusListPolicy::new(ISSUER, "https://status.example")
-        .expect("primary origin is accepted")
-        .allow_origin("https://status-backup.example:8443")
-        .is_ok());
-}
-
-fn issuer() -> SdJwtIssuer {
-    SdJwtIssuer::from_jwk(PrivateJwk::parse(ISSUER_JWK).expect("issuer JWK parses"))
-        .expect("issuer builds")
-}
-
-fn jwks() -> Value {
-    let public = PrivateJwk::parse(ISSUER_JWK)
-        .expect("issuer JWK parses")
-        .public();
-    json!({"keys": [serde_json::to_value(public).expect("public JWK serializes")]})
-}
-
-fn encoded_status_list(bytes: &[u8]) -> String {
-    let mut encoder = ZlibEncoder::new(Vec::new(), Compression::default());
-    encoder.write_all(bytes).expect("status list compresses");
-    URL_SAFE_NO_PAD.encode(encoder.finish().expect("status compression finishes"))
-}
-
-fn rewrite_status_header(token: &str, mutate: impl FnOnce(&mut Value)) -> String {
-    let mut parts = token.split('.');
-    let encoded_header = parts.next().expect("status token has header");
-    let payload = parts.next().expect("status token has payload");
-    let signature = parts.next().expect("status token has signature");
-    assert!(parts.next().is_none());
-    let mut header: Value = serde_json::from_slice(
-        &URL_SAFE_NO_PAD
-            .decode(encoded_header)
-            .expect("status header decodes"),
-    )
-    .expect("status header is JSON");
-    mutate(&mut header);
-    let header = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&header).expect("header serializes"));
-    format!("{header}.{payload}.{signature}")
-}
-
-fn tamper_signature(token: &str) -> String {
-    let mut parts = token.split('.');
-    let header = parts.next().expect("status token has header");
-    let payload = parts.next().expect("status token has payload");
-    let encoded_signature = parts.next().expect("status token has signature");
-    assert!(parts.next().is_none());
-    let mut signature = URL_SAFE_NO_PAD
-        .decode(encoded_signature)
-        .expect("status signature decodes");
-    signature[0] ^= 1;
-    format!("{header}.{payload}.{}", URL_SAFE_NO_PAD.encode(signature))
-}
-
-fn assert_code(error: VerificationError, expected: &str) {
-    assert_eq!(error.code(), expected, "unexpected verifier error: {error}");
-}
-
-async fn jwks_handler(State(state): State<HarnessState>) -> Json<Value> {
-    Json(state.jwks)
-}
-
-async fn status_handler(State(state): State<HarnessState>) -> Response<Body> {
-    let response = state.status.lock().expect("status response lock").clone();
-    let mut builder = Response::builder().status(response.status);
-    if let Some(content_type) = response.content_type {
-        builder = builder.header(header::CONTENT_TYPE, HeaderValue::from_static(content_type));
-    }
-    if let Some(content_encoding) = response.content_encoding {
-        builder = builder.header(
-            header::CONTENT_ENCODING,
-            HeaderValue::from_static(content_encoding),
-        );
-    }
-    if let Some(location) = response.location {
-        builder = builder.header(header::LOCATION, HeaderValue::from_static(location));
-    }
-    builder
-        .body(Body::from(response.body))
-        .expect("test response builds")
-}
diff --git a/crates/registry-notary-client/tests/verifier_contract.rs b/crates/registry-notary-client/tests/verifier_contract.rs
deleted file mode 100644
index c9b5ce009..000000000
--- a/crates/registry-notary-client/tests/verifier_contract.rs
+++ /dev/null
@@ -1,638 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-#![cfg(feature = "verifier")]
-
-use std::collections::BTreeMap;
-use std::net::SocketAddr;
-use std::sync::{
-    atomic::{AtomicUsize, Ordering},
-    Arc,
-};
-
-use axum::extract::State;
-use axum::routing::get;
-use axum::{Json, Router};
-use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-use base64::Engine;
-use registry_notary_client::verifier;
-use registry_notary_client::{
-    HolderBindingPolicy, RegistryNotaryClient, VerificationError, VerifyOptions,
-};
-use registry_notary_core::SD_JWT_VC_JWT_TYP;
-use registry_platform_crypto::{did_jwk_from_public_jwk, sign, PrivateJwk};
-use registry_platform_sdjwt::{Disclosure, HolderConfirmation, SdJwtIssuanceInput, SdJwtIssuer};
-use serde_json::{json, Value};
-use sha2::{Digest, Sha256};
-use tokio::net::TcpListener;
-
-const ISSUER: &str = "did:web:issuer.test";
-const VCT: &str = "https://vct.example/test";
-const NOW: i64 = 1_700_000_010;
-const KB_AUD: &str = "https://verifier.example/callback";
-const KB_NONCE: &str = "nonce-1700000010";
-const ISSUER_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"did:web:issuer.test#key-1"}"#;
-const ISSUER_P256_JWK: &str = r#"{"kty":"EC","crv":"P-256","d":"MInq88dvxx-e1-MEfmdes4I6Gt2QbsKoEmYyk2j0Oj4","x":"3kpzAK6fK6xyfqbdp0HvfZCqfgz7MajMviKyM6bsNE4","y":"GkSdSn8xqge52rp9Sv-4qPaw1Q9TJ2eMUyY22flavLU","alg":"ES256","kid":"did:web:issuer.test#p256-key-1"}"#;
-const ROTATED_ISSUER_JWK: &str = r#"{"crv":"Ed25519","d":"f4QIxnAyRWzhuBOmNRgvBTE56mWePdsPL0mvCtl8Gys","x":"pv4e_hXHBLN27rcs6VDFV1ED0TiU8M3xy9vsuWFEsec","kty":"OKP","alg":"EdDSA","kid":"did:web:issuer.test#key-2"}"#;
-const HOLDER_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"holder-key-1"}"#;
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_accepts_valid_holder_bound_credential() {
-    let holder = holder_did();
-    let compact = issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, Some(&holder)).await;
-    let verified = verifier::verify_sd_jwt_vc(
-        &compact,
-        &jwks(ISSUER_JWK),
-        &options().holder_binding(HolderBindingPolicy::RequiredKid(holder.clone())),
-    )
-    .expect("credential verifies");
-
-    assert_eq!(verified.issuer, ISSUER);
-    assert_eq!(verified.vct, VCT);
-    assert_eq!(verified.key_id, "did:web:issuer.test#key-1");
-    assert_eq!(verified.algorithm, "EdDSA");
-    assert_eq!(verified.disclosure_count, 1);
-    assert_eq!(verified.holder_key_id.as_deref(), Some(holder.as_str()));
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_accepts_credential_without_disclosures() {
-    let compact = issue_plain_jwt_vc(ISSUER_JWK, ISSUER, NOW, NOW + 50);
-
-    let verified = verifier::verify_sd_jwt_vc(&compact, &jwks(ISSUER_JWK), &options())
-        .expect("credential without disclosures verifies");
-
-    assert_eq!(verified.issuer, ISSUER);
-    assert_eq!(verified.disclosure_count, 0);
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_accepts_es256_credential() {
-    let compact = issue_sd_jwt(ISSUER_P256_JWK, ISSUER, NOW, NOW + 50, None).await;
-
-    let verified = verifier::verify_sd_jwt_vc(
-        &compact,
-        &jwks(ISSUER_P256_JWK),
-        &options().accepted_algorithms(["ES256"]),
-    )
-    .expect("ES256 credential verifies");
-
-    assert_eq!(verified.issuer, ISSUER);
-    assert_eq!(verified.vct, VCT);
-    assert_eq!(verified.key_id, "did:web:issuer.test#p256-key-1");
-    assert_eq!(verified.algorithm, "ES256");
-    assert_eq!(verified.disclosure_count, 1);
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_accepts_selectively_disclosed_subset() {
-    let compact = issue_sd_jwt_with_claims(
-        ISSUER_JWK,
-        ISSUER,
-        NOW,
-        NOW + 50,
-        None,
-        &["claim-a", "claim-b"],
-    )
-    .await;
-    let presentation = keep_first_disclosure(&compact);
-
-    let verified = verifier::verify_sd_jwt_vc(&presentation, &jwks(ISSUER_JWK), &options())
-        .expect("selective disclosure verifies");
-
-    assert_eq!(verified.disclosure_count, 1);
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_rejects_duplicate_presented_disclosure() {
-    let compact = issue_sd_jwt_with_claims(
-        ISSUER_JWK,
-        ISSUER,
-        NOW,
-        NOW + 50,
-        None,
-        &["claim-a", "claim-b"],
-    )
-    .await;
-    let presentation = duplicate_first_disclosure(&compact);
-
-    let error = verifier::verify_sd_jwt_vc(&presentation, &jwks(ISSUER_JWK), &options())
-        .expect_err("duplicate disclosure is rejected");
-
-    assert_code(error, "disclosure.digest_mismatch");
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_separates_key_binding_jwt_from_disclosures() {
-    let compact = issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, Some(&holder_did())).await;
-    let presentation = format!("{compact}{}", signed_key_binding_jwt(&compact));
-
-    let verified = verifier::verify_sd_jwt_vc(
-        &presentation,
-        &jwks(ISSUER_JWK),
-        &options()
-            .holder_binding(HolderBindingPolicy::Required)
-            .key_binding_challenge(KB_AUD, KB_NONCE),
-    )
-    .expect("key binding jwt is not treated as a disclosure");
-
-    assert_eq!(verified.disclosure_count, 1);
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_rejects_key_binding_without_expected_challenge() {
-    let compact = issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, Some(&holder_did())).await;
-    let presentation = format!("{compact}{}", signed_key_binding_jwt(&compact));
-
-    let error = verifier::verify_sd_jwt_vc(
-        &presentation,
-        &jwks(ISSUER_JWK),
-        &options().holder_binding(HolderBindingPolicy::Required),
-    )
-    .expect_err("key binding challenge is required");
-
-    assert_code(error, "holder_binding.challenge_required");
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_rejects_missing_key_binding_for_expected_challenge() {
-    let compact = issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, Some(&holder_did())).await;
-
-    let error = verifier::verify_sd_jwt_vc(
-        &compact,
-        &jwks(ISSUER_JWK),
-        &options()
-            .holder_binding(HolderBindingPolicy::Required)
-            .key_binding_challenge(KB_AUD, KB_NONCE),
-    )
-    .expect_err("missing key binding jwt is rejected for verifier challenge");
-
-    assert_code(error, "holder_binding.challenge_required");
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_accepts_optional_key_binding_without_challenge() {
-    let compact = issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, Some(&holder_did())).await;
-    let presentation = format!("{compact}{}", signed_key_binding_jwt(&compact));
-
-    let verified = verifier::verify_sd_jwt_vc(&presentation, &jwks(ISSUER_JWK), &options())
-        .expect("optional key binding does not require a verifier challenge");
-
-    assert_eq!(
-        verified.holder_key_id.as_deref(),
-        Some(holder_did().as_str())
-    );
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_rejects_wrong_key_binding_audience() {
-    let compact = issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, Some(&holder_did())).await;
-    let presentation = format!("{compact}{}", signed_key_binding_jwt(&compact));
-
-    let error = verifier::verify_sd_jwt_vc(
-        &presentation,
-        &jwks(ISSUER_JWK),
-        &options()
-            .holder_binding(HolderBindingPolicy::Required)
-            .key_binding_challenge("https://other-verifier.example/callback", KB_NONCE),
-    )
-    .expect_err("key binding audience must match");
-
-    assert_code(error, "holder_binding.proof_invalid");
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_rejects_wrong_key_binding_nonce() {
-    let compact = issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, Some(&holder_did())).await;
-    let presentation = format!("{compact}{}", signed_key_binding_jwt(&compact));
-
-    let error = verifier::verify_sd_jwt_vc(
-        &presentation,
-        &jwks(ISSUER_JWK),
-        &options()
-            .holder_binding(HolderBindingPolicy::Required)
-            .key_binding_challenge(KB_AUD, "stale-nonce"),
-    )
-    .expect_err("key binding nonce must match");
-
-    assert_code(error, "holder_binding.proof_invalid");
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_rejects_wrong_key_binding_sd_hash() {
-    let compact = issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, Some(&holder_did())).await;
-    let presentation = format!(
-        "{compact}{}",
-        signed_key_binding_jwt_with_payload(json!({
-            "iat": NOW,
-            "exp": NOW + 30,
-            "aud": KB_AUD,
-            "nonce": KB_NONCE,
-            "sd_hash": "wrong"
-        }))
-    );
-
-    let error = verifier::verify_sd_jwt_vc(
-        &presentation,
-        &jwks(ISSUER_JWK),
-        &options()
-            .holder_binding(HolderBindingPolicy::Required)
-            .key_binding_challenge(KB_AUD, KB_NONCE),
-    )
-    .expect_err("key binding sd_hash must match");
-
-    assert_code(error, "holder_binding.proof_invalid");
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_rejects_key_binding_sd_hash_without_trailing_separator() {
-    let compact = issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, Some(&holder_did())).await;
-    let presentation = format!(
-        "{compact}{}",
-        signed_key_binding_jwt_with_payload(json!({
-            "iat": NOW,
-            "exp": NOW + 30,
-            "aud": KB_AUD,
-            "nonce": KB_NONCE,
-            "sd_hash": URL_SAFE_NO_PAD.encode(Sha256::digest(
-                compact.strip_suffix('~').unwrap_or(&compact).as_bytes()
-            )),
-        }))
-    );
-
-    let error = verifier::verify_sd_jwt_vc(
-        &presentation,
-        &jwks(ISSUER_JWK),
-        &options()
-            .holder_binding(HolderBindingPolicy::Required)
-            .key_binding_challenge(KB_AUD, KB_NONCE),
-    )
-    .expect_err("key binding sd_hash must cover the trailing separator");
-
-    assert_code(error, "holder_binding.proof_invalid");
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_rejects_expired_key_binding_jwt() {
-    let compact = issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, Some(&holder_did())).await;
-    let presentation = format!(
-        "{compact}{}",
-        signed_key_binding_jwt_with_payload(json!({
-            "iat": NOW - 300,
-            "exp": NOW - 200,
-            "aud": KB_AUD,
-            "nonce": KB_NONCE,
-            "sd_hash": URL_SAFE_NO_PAD.encode(Sha256::digest(
-                compact.as_bytes()
-            )),
-        }))
-    );
-
-    let error = verifier::verify_sd_jwt_vc(
-        &presentation,
-        &jwks(ISSUER_JWK),
-        &options()
-            .holder_binding(HolderBindingPolicy::Required)
-            .key_binding_challenge(KB_AUD, KB_NONCE),
-    )
-    .expect_err("expired key binding jwt must be rejected");
-
-    assert_code(error, "holder_binding.proof_invalid");
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_rejects_bad_key_binding_jwt() {
-    let compact = issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, Some(&holder_did())).await;
-    let presentation = format!("{compact}{}", unsigned_compact_jws());
-
-    let error = verifier::verify_sd_jwt_vc(
-        &presentation,
-        &jwks(ISSUER_JWK),
-        &options()
-            .holder_binding(HolderBindingPolicy::Required)
-            .key_binding_challenge(KB_AUD, KB_NONCE),
-    )
-    .expect_err("bad key binding jwt is rejected");
-
-    assert_code(error, "holder_binding.proof_invalid");
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_rejects_bad_signature() {
-    let compact = tamper_signature(&issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, None).await);
-    let error = verifier::verify_sd_jwt_vc(&compact, &jwks(ISSUER_JWK), &options())
-        .expect_err("bad signature is rejected");
-
-    assert_code(error, "signature.invalid");
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_rejects_unknown_kid() {
-    let compact = rewrite_header(
-        &issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, None).await,
-        |header| header["kid"] = json!("did:web:issuer.test#missing"),
-    );
-    let error = verifier::verify_sd_jwt_vc(&compact, &jwks(ISSUER_JWK), &options())
-        .expect_err("unknown kid is rejected");
-
-    assert_code(error, "key.unknown");
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_rejects_disallowed_algorithm() {
-    let compact = rewrite_header(
-        &issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, None).await,
-        |header| header["alg"] = json!("RS256"),
-    );
-    let error = verifier::verify_sd_jwt_vc(&compact, &jwks(ISSUER_JWK), &options())
-        .expect_err("disallowed alg is rejected");
-
-    assert_code(error, "algorithm.disallowed");
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_rejects_wrong_issuer() {
-    let compact = issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, None).await;
-    let error = verifier::verify_sd_jwt_vc(
-        &compact,
-        &jwks(ISSUER_JWK),
-        &VerifyOptions::new("did:web:other.example").now(now()),
-    )
-    .expect_err("wrong issuer is rejected");
-
-    assert_code(error, "claim.issuer_mismatch");
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_rejects_expired_credential() {
-    let compact = issue_sd_jwt(ISSUER_JWK, ISSUER, NOW - 300, NOW - 200, None).await;
-    let error = verifier::verify_sd_jwt_vc(&compact, &jwks(ISSUER_JWK), &options())
-        .expect_err("expired credential is rejected");
-
-    assert_code(error, "claim.time_invalid");
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_rejects_invalid_disclosure_digest() {
-    let compact = tamper_disclosure(&issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, None).await);
-    let error = verifier::verify_sd_jwt_vc(&compact, &jwks(ISSUER_JWK), &options())
-        .expect_err("invalid disclosure digest is rejected");
-
-    assert_code(error, "disclosure.digest_mismatch");
-}
-
-#[tokio::test]
-async fn verify_sd_jwt_vc_rejects_missing_required_holder_binding() {
-    let compact = issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, None).await;
-    let error = verifier::verify_sd_jwt_vc(
-        &compact,
-        &jwks(ISSUER_JWK),
-        &options().holder_binding(HolderBindingPolicy::Required),
-    )
-    .expect_err("missing holder binding is rejected");
-
-    assert_code(error, "holder_binding.required");
-}
-
-#[tokio::test]
-async fn verifier_errors_do_not_render_credential_fragments() {
-    let compact = issue_sd_jwt(ISSUER_JWK, ISSUER, NOW, NOW + 50, None).await;
-    let error = verifier::verify_sd_jwt_vc(
-        &compact,
-        &jwks(ISSUER_JWK),
-        &VerifyOptions::new("did:web:other.example").now(now()),
-    )
-    .expect_err("wrong issuer is rejected");
-    let rendered = format!("{error:?} {error}");
-
-    assert!(rendered.contains("claim.issuer_mismatch"));
-    assert!(!rendered.contains(&compact));
-    for fragment in compact.split(['.', '~']) {
-        if fragment.len() > 12 {
-            assert!(
-                !rendered.contains(fragment),
-                "error rendered compact credential fragment"
-            );
-        }
-    }
-}
-
-#[tokio::test]
-async fn client_verifier_refreshes_once_on_unknown_kid() {
-    let counter = Arc::new(AtomicUsize::new(0));
-    let app = Router::new()
-        .route(
-            "/.well-known/evidence/jwks.json",
-            get(rotating_jwks_handler),
-        )
-        .with_state(Arc::clone(&counter));
-    let base = spawn(app).await;
-    let client = RegistryNotaryClient::builder(base)
-        .build()
-        .expect("client builds");
-    let compact = issue_sd_jwt(ROTATED_ISSUER_JWK, ISSUER, NOW, NOW + 50, None).await;
-
-    let verified = client
-        .verify_sd_jwt_vc(&compact, options())
-        .await
-        .expect("refresh finds rotated key");
-
-    assert_eq!(verified.key_id, "did:web:issuer.test#key-2");
-    assert_eq!(counter.load(Ordering::SeqCst), 2);
-}
-
-async fn issue_sd_jwt(
-    private_jwk: &str,
-    issuer_id: &str,
-    iat: i64,
-    exp: i64,
-    holder_id: Option<&str>,
-) -> String {
-    issue_sd_jwt_with_claims(private_jwk, issuer_id, iat, exp, holder_id, &["claim-a"]).await
-}
-
-async fn issue_sd_jwt_with_claims(
-    private_jwk: &str,
-    issuer_id: &str,
-    iat: i64,
-    exp: i64,
-    holder_id: Option<&str>,
-    claim_names: &[&str],
-) -> String {
-    let sd_jwt_issuer =
-        SdJwtIssuer::from_jwk(PrivateJwk::parse(private_jwk).expect("issuer jwk parses"))
-            .expect("issuer builds");
-    let holder_confirmation = holder_id.map(|kid| {
-        let holder = PrivateJwk::parse(HOLDER_JWK).expect("holder jwk parses");
-        HolderConfirmation {
-            jwk: holder.public(),
-            kid: Some(kid.to_string()),
-        }
-    });
-    sd_jwt_issuer
-        .issue(SdJwtIssuanceInput {
-            iss: issuer_id.to_string(),
-            sub_ref: holder_id.unwrap_or("subject-ref").to_string(),
-            credential_id: Some("urn:ulid:01HG0000000000000000000000".to_string()),
-            iat,
-            exp,
-            vct: VCT.to_string(),
-            status: None,
-            public_claims: BTreeMap::new(),
-            cnf: holder_confirmation,
-            disclosures: claim_names
-                .iter()
-                .map(|claim_name| Disclosure {
-                    name: (*claim_name).to_string(),
-                    value: json!({"satisfied": true}),
-                })
-                .collect(),
-        })
-        .await
-        .expect("sd-jwt issues")
-        .jwt
-}
-
-fn issue_plain_jwt_vc(private_jwk: &str, issuer_id: &str, iat: i64, exp: i64) -> String {
-    let issuer = PrivateJwk::parse(private_jwk).expect("issuer jwk parses");
-    let header = URL_SAFE_NO_PAD.encode(
-        serde_json::to_vec(&json!({
-            "alg": "EdDSA",
-            "kid": "did:web:issuer.test#key-1",
-            "typ": SD_JWT_VC_JWT_TYP,
-        }))
-        .expect("header serializes"),
-    );
-    let payload = URL_SAFE_NO_PAD.encode(
-        serde_json::to_vec(&json!({
-            "iss": issuer_id,
-            "sub": "subject-ref",
-            "jti": "urn:ulid:01HG0000000000000000000000",
-            "iat": iat,
-            "exp": exp,
-            "vct": VCT,
-        }))
-        .expect("payload serializes"),
-    );
-    let signing_input = format!("{header}.{payload}");
-    let signature = sign(signing_input.as_bytes(), &issuer).expect("issuer signs");
-    format!("{}.{}", signing_input, URL_SAFE_NO_PAD.encode(signature))
-}
-
-fn options() -> VerifyOptions {
-    VerifyOptions::new(ISSUER).expected_vct(VCT).now(now())
-}
-
-fn now() -> time::OffsetDateTime {
-    time::OffsetDateTime::from_unix_timestamp(NOW).expect("test timestamp")
-}
-
-fn jwks(private_jwk: &str) -> Value {
-    let public = PrivateJwk::parse(private_jwk).expect("jwk parses").public();
-    json!({ "keys": [serde_json::to_value(public).expect("public jwk serializes")] })
-}
-
-fn holder_did() -> String {
-    let holder = PrivateJwk::parse(HOLDER_JWK).expect("holder jwk parses");
-    did_jwk_from_public_jwk(&holder.public()).expect("holder did encodes")
-}
-
-fn assert_code(error: VerificationError, code: &str) {
-    assert_eq!(error.code(), code);
-}
-
-fn tamper_signature(compact: &str) -> String {
-    let (jwt, suffix) = compact.split_once('~').expect("sd-jwt has disclosure");
-    let mut parts = jwt.split('.').collect::<Vec<_>>();
-    let mut signature = URL_SAFE_NO_PAD
-        .decode(parts[2])
-        .expect("signature base64 decodes");
-    signature[0] ^= 0x01;
-    let signature = URL_SAFE_NO_PAD.encode(signature);
-    parts[2] = &signature;
-    format!("{}~{suffix}", parts.join("."))
-}
-
-fn tamper_disclosure(compact: &str) -> String {
-    let mut parts = compact.split('~').collect::<Vec<_>>();
-    let mut disclosure = parts[1].to_string();
-    let replacement = if disclosure.ends_with('A') { "B" } else { "A" };
-    disclosure.pop();
-    disclosure.push_str(replacement);
-    parts[1] = &disclosure;
-    parts.join("~")
-}
-
-fn keep_first_disclosure(compact: &str) -> String {
-    let mut parts = compact.split('~');
-    let jwt = parts.next().expect("issuer jwt");
-    let first_disclosure = parts.next().expect("first disclosure");
-    format!("{jwt}~{first_disclosure}~")
-}
-
-fn duplicate_first_disclosure(compact: &str) -> String {
-    let mut parts = compact.split('~');
-    let jwt = parts.next().expect("issuer jwt");
-    let first_disclosure = parts.next().expect("first disclosure");
-    format!("{jwt}~{first_disclosure}~{first_disclosure}~")
-}
-
-fn unsigned_compact_jws() -> String {
-    let header = URL_SAFE_NO_PAD.encode(br#"{"alg":"EdDSA","typ":"kb+jwt"}"#);
-    let payload = URL_SAFE_NO_PAD.encode(br#"{"iat":1700000010}"#);
-    format!("{header}.{payload}.signature")
-}
-
-fn signed_key_binding_jwt(sd_jwt: &str) -> String {
-    signed_key_binding_jwt_with_payload(json!({
-        "iat": NOW,
-        "exp": NOW + 30,
-        "aud": KB_AUD,
-        "nonce": KB_NONCE,
-        "sd_hash": URL_SAFE_NO_PAD.encode(Sha256::digest(sd_jwt.as_bytes())),
-    }))
-}
-
-fn signed_key_binding_jwt_with_payload(payload: Value) -> String {
-    let holder = PrivateJwk::parse(HOLDER_JWK).expect("holder jwk parses");
-    let header = URL_SAFE_NO_PAD.encode(br#"{"alg":"EdDSA","typ":"kb+jwt","kid":"holder-key-1"}"#);
-    let payload = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&payload).expect("payload serializes"));
-    let signing_input = format!("{header}.{payload}");
-    let signature = sign(signing_input.as_bytes(), &holder).expect("holder proof signs");
-    format!("{}.{}", signing_input, URL_SAFE_NO_PAD.encode(signature))
-}
-
-fn rewrite_header(compact: &str, mutate: impl FnOnce(&mut Value)) -> String {
-    let (jwt, suffix) = compact.split_once('~').expect("sd-jwt has disclosure");
-    let mut parts = jwt.split('.').collect::<Vec<_>>();
-    let mut header: Value = serde_json::from_slice(
-        &URL_SAFE_NO_PAD
-            .decode(parts[0])
-            .expect("header base64 decodes"),
-    )
-    .expect("header json decodes");
-    mutate(&mut header);
-    let header_b64 =
-        URL_SAFE_NO_PAD.encode(serde_json::to_vec(&header).expect("header serializes"));
-    parts[0] = &header_b64;
-    format!("{}~{suffix}", parts.join("."))
-}
-
-async fn rotating_jwks_handler(State(counter): State<Arc<AtomicUsize>>) -> Json<Value> {
-    let call = counter.fetch_add(1, Ordering::SeqCst);
-    if call == 0 {
-        Json(jwks(ISSUER_JWK))
-    } else {
-        Json(jwks(ROTATED_ISSUER_JWK))
-    }
-}
-
-async fn spawn(app: Router) -> String {
-    let listener = TcpListener::bind("127.0.0.1:0")
-        .await
-        .expect("bind test server");
-    let addr: SocketAddr = listener.local_addr().expect("local addr");
-    tokio::spawn(async move {
-        axum::serve(listener, app).await.expect("test server runs");
-    });
-    format!("http://{addr}")
-}
diff --git a/crates/registry-notary-core/Cargo.toml b/crates/registry-notary-core/Cargo.toml
deleted file mode 100644
index c7b9cac39..000000000
--- a/crates/registry-notary-core/Cargo.toml
+++ /dev/null
@@ -1,38 +0,0 @@
-[package]
-name = "registry-notary-core"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Core Registry Notary domain, configuration, and credential primitives."
-readme = "README.md"
-repository.workspace = true
-publish = false
-
-[lints]
-workspace = true
-
-[dependencies]
-base64.workspace = true
-humantime-serde.workspace = true
-ipnet = { workspace = true, features = ["serde"] }
-registry-platform-authcommon.workspace = true
-registry-platform-config.workspace = true
-registry-platform-crypto.workspace = true
-registry-platform-httputil.workspace = true
-registry-platform-oid4vci.workspace = true
-registry-platform-ops.workspace = true
-registry-platform-sdjwt.workspace = true
-schemars.workspace = true
-serde.workspace = true
-serde_json.workspace = true
-sha2.workspace = true
-thiserror.workspace = true
-time.workspace = true
-ulid.workspace = true
-url.workspace = true
-utoipa.workspace = true
-
-[dev-dependencies]
-serde_norway.workspace = true
-tempfile.workspace = true
-tokio.workspace = true
diff --git a/crates/registry-notary-core/README.md b/crates/registry-notary-core/README.md
deleted file mode 100644
index 541d25d8c..000000000
--- a/crates/registry-notary-core/README.md
+++ /dev/null
@@ -1,45 +0,0 @@
-# registry-notary-core
-
-Portable Registry Notary domain model, configuration, and credential
-primitives.
-
-This crate owns the serializable contracts shared by the server, binary, tests,
-and downstream tooling.
-
-## What It Provides
-
-- Standalone Registry Notary configuration types and validation.
-- Claim, requester/target evidence, source binding, disclosure, and evaluation
-  models.
-- Static-peer federation config models, validation constants, and audit fields
-  for delegated evaluation.
-- Error types used across the workspace.
-- SD-JWT VC issuance helpers for claim views.
-- OpenAPI-compatible schema derives for public contract types.
-
-## Typical Use
-
-```rust
-use registry_notary_core::StandaloneRegistryNotaryConfig;
-
-fn load(raw_yaml: &str) -> Result<StandaloneRegistryNotaryConfig, Box<dyn std::error::Error>> {
-    let config: StandaloneRegistryNotaryConfig = serde_norway::from_str(raw_yaml)?;
-    config.validate()?;
-    Ok(config)
-}
-```
-
-## Boundary
-
-This crate is runtime-neutral. It should not own Axum routes, outbound HTTP
-clients, tracing setup, process startup, or storage for evaluated evidence.
-
-## Testing
-
-```sh
-cargo test -p registry-notary-core
-```
-
-## License
-
-Apache-2.0.
diff --git a/crates/registry-notary-core/config/documentation-intent.json b/crates/registry-notary-core/config/documentation-intent.json
deleted file mode 100644
index 0e2aba9c5..000000000
--- a/crates/registry-notary-core/config/documentation-intent.json
+++ /dev/null
@@ -1,7804 +0,0 @@
-{
-  "$schema": "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.runtime.configuration_intent.v1.schema.json",
-  "format_version": "1.0",
-  "runtime_schema": "notary",
-  "schema_id": "https://id.registrystack.org/schemas/registry-notary/registry-notary.config.schema.json",
-  "schema_source": "registry-notary.config.schema.json",
-  "profiles": [
-    {
-      "id": "notary_audit_internal",
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ]
-    },
-    {
-      "id": "notary_audit_secret_reference",
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ]
-    },
-    {
-      "id": "notary_audit_sensitive",
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ]
-    },
-    {
-      "id": "notary_auth_internal",
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ]
-    },
-    {
-      "id": "notary_auth_oidc_scope_map_open_map",
-      "purpose": "Each reviewed key is an external token scope and each value is the bounded Notary scope mapping granted for that exact token scope.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "open_map_semantics": "Each reviewed key is an external token scope and each value is the bounded Notary scope mapping granted for that exact token scope."
-    },
-    {
-      "id": "notary_auth_secret_reference",
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ]
-    },
-    {
-      "id": "notary_auth_sensitive",
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ]
-    },
-    {
-      "id": "notary_cel_internal",
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ]
-    },
-    {
-      "id": "notary_config_trust_internal",
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ]
-    },
-    {
-      "id": "notary_config_trust_sensitive",
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ]
-    },
-    {
-      "id": "notary_credential_status_sensitive",
-      "purpose": "Controls Notary credential-status publication and retention behavior.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ]
-    },
-    {
-      "id": "notary_deployment_internal",
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ]
-    },
-    {
-      "id": "notary_deployment_sensitive",
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ]
-    },
-    {
-      "id": "notary_evidence_claims_evidence_mode_consultations_inputs_open_map",
-      "purpose": "Each reviewed key names a consultation input and each value binds it to an approved claim or variable source.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "open_map_semantics": "Each reviewed key names a consultation input and each value binds it to an approved claim or variable source."
-    },
-    {
-      "id": "notary_evidence_claims_evidence_mode_consultations_open_map",
-      "purpose": "Each reviewed key names a Relay consultation and each value defines the bounded consultation contract used to support this evidence claim.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "open_map_semantics": "Each reviewed key names a Relay consultation and each value defines the bounded consultation contract used to support this evidence claim."
-    },
-    {
-      "id": "notary_evidence_claims_evidence_mode_consultations_output_fields_open_map",
-      "purpose": "Each reviewed key names a closed structured output field and each value defines its requiredness and bounded recursive schema.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.16.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "open_map_semantics": "Each reviewed key names a closed structured output field and each value defines its requiredness and bounded recursive schema."
-    },
-    {
-      "id": "notary_evidence_claims_evidence_mode_consultations_outputs_open_map",
-      "purpose": "Each reviewed key names a consultation output and each value defines its bounded evidence-result interpretation.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "open_map_semantics": "Each reviewed key names a consultation output and each value defines its bounded evidence-result interpretation."
-    },
-    {
-      "id": "notary_evidence_credential_profiles_open_map",
-      "purpose": "Each reviewed key names a credential profile and each value defines its exact claims, format, and issuance contract.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "open_map_semantics": "Each reviewed key names a credential profile and each value defines its exact claims, format, and issuance contract."
-    },
-    {
-      "id": "notary_evidence_internal",
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ]
-    },
-    {
-      "id": "notary_evidence_secret_reference",
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ]
-    },
-    {
-      "id": "notary_evidence_sensitive",
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ]
-    },
-    {
-      "id": "notary_evidence_signing_keys_open_map",
-      "purpose": "Each reviewed key names a signing-key binding and each value references the operator-managed signing material and lifecycle metadata.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "open_map_semantics": "Each reviewed key names a signing-key binding and each value references the operator-managed signing material and lifecycle metadata."
-    },
-    {
-      "id": "notary_evidence_variables_open_map",
-      "purpose": "Each reviewed key names a Notary evidence variable and each value defines its bounded source and evaluation contract.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "open_map_semantics": "Each reviewed key names a Notary evidence variable and each value defines its bounded source and evaluation contract."
-    },
-    {
-      "id": "notary_federation_internal",
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ]
-    },
-    {
-      "id": "notary_federation_secret_reference",
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ]
-    },
-    {
-      "id": "notary_federation_sensitive",
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ]
-    },
-    {
-      "id": "notary_instance_internal",
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ]
-    },
-    {
-      "id": "notary_instance_sensitive",
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ]
-    },
-    {
-      "id": "notary_oid4vci_credential_configurations_open_map",
-      "purpose": "Each reviewed key names an OpenID4VCI credential configuration and each value defines the advertised and issued credential contract.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "open_map_semantics": "Each reviewed key names an OpenID4VCI credential configuration and each value defines the advertised and issued credential contract."
-    },
-    {
-      "id": "notary_oid4vci_internal",
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ]
-    },
-    {
-      "id": "notary_oid4vci_sensitive",
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ]
-    },
-    {
-      "id": "notary_root_structural",
-      "purpose": "Defines the complete Notary runtime configuration boundary consumed when a Notary instance starts.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ]
-    },
-    {
-      "id": "notary_server_internal",
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ]
-    },
-    {
-      "id": "notary_server_sensitive",
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ]
-    },
-    {
-      "id": "notary_state_internal",
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ]
-    },
-    {
-      "id": "notary_state_secret_reference",
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ]
-    },
-    {
-      "id": "notary_state_sensitive",
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ]
-    },
-    {
-      "id": "notary_subject_access_sensitive",
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "introduced_in": "0.13.0",
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ]
-    }
-  ],
-  "assignments": [
-    {
-      "schema": "notary",
-      "pointer": "",
-      "key_path": "",
-      "path_kind": "root",
-      "profile": "notary_root_structural",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/audit",
-      "key_path": "audit",
-      "path_kind": "property",
-      "profile": "notary_audit_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuditConfig/properties/hash_secret_env",
-      "key_path": "audit.hash_secret_env",
-      "path_kind": "property",
-      "profile": "notary_audit_secret_reference",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuditConfig/properties/max_files",
-      "key_path": "audit.max_files",
-      "path_kind": "property",
-      "profile": "notary_audit_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuditConfig/properties/max_size_mb",
-      "key_path": "audit.max_size_mb",
-      "path_kind": "property",
-      "profile": "notary_audit_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuditConfig/properties/path",
-      "key_path": "audit.path",
-      "path_kind": "property",
-      "profile": "notary_audit_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuditConfig/properties/sink",
-      "key_path": "audit.sink",
-      "path_kind": "property",
-      "profile": "notary_audit_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuditConfig/properties/syslog_socket_path",
-      "key_path": "audit.syslog_socket_path",
-      "path_kind": "property",
-      "profile": "notary_audit_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/auth",
-      "key_path": "auth",
-      "path_kind": "property",
-      "profile": "notary_auth_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthConfig/properties/access_token_signing",
-      "key_path": "auth.access_token_signing",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/AccessTokenSigningConfig/properties/access_token_ttl_seconds",
-      "key_path": "auth.access_token_signing.access_token_ttl_seconds",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms",
-      "key_path": "auth.access_token_signing.allowed_algorithms",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms/items",
-      "key_path": "auth.access_token_signing.allowed_algorithms[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences",
-      "key_path": "auth.access_token_signing.audiences",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences/items",
-      "key_path": "auth.access_token_signing.audiences[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/AccessTokenSigningConfig/properties/enabled",
-      "key_path": "auth.access_token_signing.enabled",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/AccessTokenSigningConfig/properties/issuer",
-      "key_path": "auth.access_token_signing.issuer",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/AccessTokenSigningConfig/properties/signing_key_id",
-      "key_path": "auth.access_token_signing.signing_key_id",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/AccessTokenSigningConfig/properties/token_typ",
-      "key_path": "auth.access_token_signing.token_typ",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids",
-      "key_path": "auth.access_token_signing.verification_key_ids",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "schema_description",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids/items",
-      "key_path": "auth.access_token_signing.verification_key_ids[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys",
-      "key_path": "auth.api_keys",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys/items",
-      "key_path": "auth.api_keys[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details",
-      "key_path": "auth.api_keys[].authorization_details",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "schema_description",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode",
-      "key_path": "auth.api_keys[].authorization_details.access_mode",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions",
-      "key_path": "auth.api_keys[].authorization_details.actions",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items",
-      "key_path": "auth.api_keys[].authorization_details.actions[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context",
-      "key_path": "auth.api_keys[].authorization_details.assisted_access_context",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel",
-      "key_path": "auth.api_keys[].authorization_details.assisted_access_context.channel",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level",
-      "key_path": "auth.api_keys[].authorization_details.assurance_level",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims",
-      "key_path": "auth.api_keys[].authorization_details.claims",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items",
-      "key_path": "auth.api_keys[].authorization_details.claims[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimRefObject/properties/id",
-      "key_path": "auth.api_keys[].authorization_details.claims[].id",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimRefObject/properties/version",
-      "key_path": "auth.api_keys[].authorization_details.claims[].version",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref",
-      "key_path": "auth.api_keys[].authorization_details.consent_ref",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure",
-      "key_path": "auth.api_keys[].authorization_details.disclosure",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format",
-      "key_path": "auth.api_keys[].authorization_details.format",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction",
-      "key_path": "auth.api_keys[].authorization_details.jurisdiction",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref",
-      "key_path": "auth.api_keys[].authorization_details.legal_basis_ref",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations",
-      "key_path": "auth.api_keys[].authorization_details.locations",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items",
-      "key_path": "auth.api_keys[].authorization_details.locations[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose",
-      "key_path": "auth.api_keys[].authorization_details.purpose",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship",
-      "key_path": "auth.api_keys[].authorization_details.relationship",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim",
-      "key_path": "auth.api_keys[].authorization_details.relationship.proof_claim",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type",
-      "key_path": "auth.api_keys[].authorization_details.relationship.relationship_type",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version",
-      "key_path": "auth.api_keys[].authorization_details.schema_version",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject",
-      "key_path": "auth.api_keys[].authorization_details.subject",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim",
-      "key_path": "auth.api_keys[].authorization_details.subject.binding_claim",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type",
-      "key_path": "auth.api_keys[].authorization_details.subject.id_type",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target",
-      "key_path": "auth.api_keys[].authorization_details.target",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id",
-      "key_path": "auth.api_keys[].authorization_details.target.id",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type",
-      "key_path": "auth.api_keys[].authorization_details.target.id_type",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type",
-      "key_path": "auth.api_keys[].authorization_details.type",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint",
-      "key_path": "auth.api_keys[].fingerprint",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialFingerprintRef/properties/name",
-      "key_path": "auth.api_keys[].fingerprint.name",
-      "path_kind": "property",
-      "profile": "notary_auth_secret_reference",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialFingerprintRef/properties/path",
-      "key_path": "auth.api_keys[].fingerprint.path",
-      "path_kind": "property",
-      "profile": "notary_auth_secret_reference",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialFingerprintRef/properties/provider",
-      "key_path": "auth.api_keys[].fingerprint.provider",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceCredentialConfig/properties/id",
-      "key_path": "auth.api_keys[].id",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes",
-      "key_path": "auth.api_keys[].scopes",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items",
-      "key_path": "auth.api_keys[].scopes[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens",
-      "key_path": "auth.bearer_tokens",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens/items",
-      "key_path": "auth.bearer_tokens[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details",
-      "key_path": "auth.bearer_tokens[].authorization_details",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "schema_description",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode",
-      "key_path": "auth.bearer_tokens[].authorization_details.access_mode",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions",
-      "key_path": "auth.bearer_tokens[].authorization_details.actions",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items",
-      "key_path": "auth.bearer_tokens[].authorization_details.actions[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context",
-      "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel",
-      "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context.channel",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level",
-      "key_path": "auth.bearer_tokens[].authorization_details.assurance_level",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims",
-      "key_path": "auth.bearer_tokens[].authorization_details.claims",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items",
-      "key_path": "auth.bearer_tokens[].authorization_details.claims[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimRefObject/properties/id",
-      "key_path": "auth.bearer_tokens[].authorization_details.claims[].id",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimRefObject/properties/version",
-      "key_path": "auth.bearer_tokens[].authorization_details.claims[].version",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref",
-      "key_path": "auth.bearer_tokens[].authorization_details.consent_ref",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure",
-      "key_path": "auth.bearer_tokens[].authorization_details.disclosure",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format",
-      "key_path": "auth.bearer_tokens[].authorization_details.format",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction",
-      "key_path": "auth.bearer_tokens[].authorization_details.jurisdiction",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref",
-      "key_path": "auth.bearer_tokens[].authorization_details.legal_basis_ref",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations",
-      "key_path": "auth.bearer_tokens[].authorization_details.locations",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items",
-      "key_path": "auth.bearer_tokens[].authorization_details.locations[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose",
-      "key_path": "auth.bearer_tokens[].authorization_details.purpose",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship",
-      "key_path": "auth.bearer_tokens[].authorization_details.relationship",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim",
-      "key_path": "auth.bearer_tokens[].authorization_details.relationship.proof_claim",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type",
-      "key_path": "auth.bearer_tokens[].authorization_details.relationship.relationship_type",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version",
-      "key_path": "auth.bearer_tokens[].authorization_details.schema_version",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject",
-      "key_path": "auth.bearer_tokens[].authorization_details.subject",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim",
-      "key_path": "auth.bearer_tokens[].authorization_details.subject.binding_claim",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type",
-      "key_path": "auth.bearer_tokens[].authorization_details.subject.id_type",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target",
-      "key_path": "auth.bearer_tokens[].authorization_details.target",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id",
-      "key_path": "auth.bearer_tokens[].authorization_details.target.id",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type",
-      "key_path": "auth.bearer_tokens[].authorization_details.target.id_type",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type",
-      "key_path": "auth.bearer_tokens[].authorization_details.type",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint",
-      "key_path": "auth.bearer_tokens[].fingerprint",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialFingerprintRef/properties/name",
-      "key_path": "auth.bearer_tokens[].fingerprint.name",
-      "path_kind": "property",
-      "profile": "notary_auth_secret_reference",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialFingerprintRef/properties/path",
-      "key_path": "auth.bearer_tokens[].fingerprint.path",
-      "path_kind": "property",
-      "profile": "notary_auth_secret_reference",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialFingerprintRef/properties/provider",
-      "key_path": "auth.bearer_tokens[].fingerprint.provider",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceCredentialConfig/properties/id",
-      "key_path": "auth.bearer_tokens[].id",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes",
-      "key_path": "auth.bearer_tokens[].scopes",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items",
-      "key_path": "auth.bearer_tokens[].scopes[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthConfig/properties/oidc",
-      "key_path": "auth.oidc",
-      "path_kind": "property",
-      "profile": "notary_auth_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allow_insecure_localhost",
-      "key_path": "auth.oidc.allow_insecure_localhost",
-      "path_kind": "property",
-      "profile": "notary_auth_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms",
-      "key_path": "auth.oidc.allowed_algorithms",
-      "path_kind": "property",
-      "profile": "notary_auth_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms/items",
-      "key_path": "auth.oidc.allowed_algorithms[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients",
-      "key_path": "auth.oidc.allowed_clients",
-      "path_kind": "property",
-      "profile": "notary_auth_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients/items",
-      "key_path": "auth.oidc.allowed_clients[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types",
-      "key_path": "auth.oidc.allowed_token_types",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types/items",
-      "key_path": "auth.oidc.allowed_token_types[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences",
-      "key_path": "auth.oidc.audiences",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences/items",
-      "key_path": "auth.oidc.audiences[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/issuer",
-      "key_path": "auth.oidc.issuer",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/jwks_url",
-      "key_path": "auth.oidc.jwks_url",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/leeway",
-      "key_path": "auth.oidc.leeway",
-      "path_kind": "property",
-      "profile": "notary_auth_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/principal_claim",
-      "key_path": "auth.oidc.principal_claim",
-      "path_kind": "property",
-      "profile": "notary_auth_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_claim",
-      "key_path": "auth.oidc.scope_claim",
-      "path_kind": "property",
-      "profile": "notary_auth_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map",
-      "key_path": "auth.oidc.scope_map",
-      "path_kind": "property",
-      "profile": "notary_auth_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties",
-      "key_path": "auth.oidc.scope_map.*",
-      "path_kind": "map_value",
-      "profile": "notary_auth_oidc_scope_map_open_map",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties/items",
-      "key_path": "auth.oidc.scope_map.*[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_separator",
-      "key_path": "auth.oidc.scope_separator",
-      "path_kind": "property",
-      "profile": "notary_auth_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_endpoint",
-      "key_path": "auth.oidc.userinfo_endpoint",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers",
-      "key_path": "auth.oidc.userinfo_issuers",
-      "path_kind": "property",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers/items",
-      "key_path": "auth.oidc.userinfo_issuers[]",
-      "path_kind": "array_item",
-      "profile": "notary_auth_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/cel",
-      "key_path": "cel",
-      "path_kind": "property",
-      "profile": "notary_cel_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryCelConfig/properties/allow_regex",
-      "key_path": "cel.allow_regex",
-      "path_kind": "property",
-      "profile": "notary_cel_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryCelConfig/properties/eval_timeout_ms",
-      "key_path": "cel.eval_timeout_ms",
-      "path_kind": "property",
-      "profile": "notary_cel_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_binding_json_bytes",
-      "key_path": "cel.max_binding_json_bytes",
-      "path_kind": "property",
-      "profile": "notary_cel_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_expression_bytes",
-      "key_path": "cel.max_expression_bytes",
-      "path_kind": "property",
-      "profile": "notary_cel_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_list_items",
-      "key_path": "cel.max_list_items",
-      "path_kind": "property",
-      "profile": "notary_cel_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_depth",
-      "key_path": "cel.max_object_depth",
-      "path_kind": "property",
-      "profile": "notary_cel_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_keys",
-      "key_path": "cel.max_object_keys",
-      "path_kind": "property",
-      "profile": "notary_cel_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_result_json_bytes",
-      "key_path": "cel.max_result_json_bytes",
-      "path_kind": "property",
-      "profile": "notary_cel_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_string_bytes",
-      "key_path": "cel.max_string_bytes",
-      "path_kind": "property",
-      "profile": "notary_cel_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryCelConfig/properties/mode",
-      "key_path": "cel.mode",
-      "path_kind": "property",
-      "profile": "notary_cel_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_count",
-      "key_path": "cel.worker_count",
-      "path_kind": "property",
-      "profile": "notary_cel_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_memory_bytes",
-      "key_path": "cel.worker_memory_bytes",
-      "path_kind": "property",
-      "profile": "notary_cel_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_stderr_bytes",
-      "key_path": "cel.worker_stderr_bytes",
-      "path_kind": "property",
-      "profile": "notary_cel_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/config_trust",
-      "key_path": "config_trust",
-      "path_kind": "property",
-      "profile": "notary_config_trust_internal",
-      "purpose_source": "schema_description",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path",
-      "key_path": "config_trust.antirollback_state_path",
-      "path_kind": "property",
-      "profile": "notary_config_trust_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path",
-      "key_path": "config_trust.break_glass_override_path",
-      "path_kind": "property",
-      "profile": "notary_config_trust_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path",
-      "key_path": "config_trust.bundle_path",
-      "path_kind": "property",
-      "profile": "notary_config_trust_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path",
-      "key_path": "config_trust.trust_anchor_path",
-      "path_kind": "property",
-      "profile": "notary_config_trust_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/credential_status",
-      "key_path": "credential_status",
-      "path_kind": "property",
-      "profile": "notary_credential_status_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialStatusConfig/properties/base_url",
-      "key_path": "credential_status.base_url",
-      "path_kind": "property",
-      "profile": "notary_credential_status_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialStatusConfig/properties/enabled",
-      "key_path": "credential_status.enabled",
-      "path_kind": "property",
-      "profile": "notary_credential_status_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialStatusConfig/properties/retention_seconds",
-      "key_path": "credential_status.retention_seconds",
-      "path_kind": "property",
-      "profile": "notary_credential_status_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/deployment",
-      "key_path": "deployment",
-      "path_kind": "property",
-      "profile": "notary_deployment_internal",
-      "purpose_source": "schema_description",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentConfig/properties/evidence",
-      "key_path": "deployment.evidence",
-      "path_kind": "property",
-      "profile": "notary_deployment_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path",
-      "key_path": "deployment.evidence.audit_ack_cursor_path",
-      "path_kind": "property",
-      "profile": "notary_deployment_sensitive",
-      "purpose_source": "schema_description",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs",
-      "key_path": "deployment.evidence.audit_ack_max_age_secs",
-      "path_kind": "property",
-      "profile": "notary_deployment_internal",
-      "purpose_source": "schema_description",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping",
-      "key_path": "deployment.evidence.audit_offhost_shipping",
-      "path_kind": "property",
-      "profile": "notary_deployment_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentEvidenceConfig/properties/signer_custody_approved",
-      "key_path": "deployment.evidence.signer_custody_approved",
-      "path_kind": "property",
-      "profile": "notary_deployment_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentConfig/properties/multi_instance",
-      "key_path": "deployment.multi_instance",
-      "path_kind": "property",
-      "profile": "notary_deployment_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentConfig/properties/profile",
-      "key_path": "deployment.profile",
-      "path_kind": "property",
-      "profile": "notary_deployment_internal",
-      "purpose_source": "schema_description",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentConfig/properties/waivers",
-      "key_path": "deployment.waivers",
-      "path_kind": "property",
-      "profile": "notary_deployment_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentConfig/properties/waivers/items",
-      "key_path": "deployment.waivers[]",
-      "path_kind": "array_item",
-      "profile": "notary_deployment_internal",
-      "purpose_source": "schema_description",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentWaiverConfig/properties/expires",
-      "key_path": "deployment.waivers[].expires",
-      "path_kind": "property",
-      "profile": "notary_deployment_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentWaiverConfig/properties/finding",
-      "key_path": "deployment.waivers[].finding",
-      "path_kind": "property",
-      "profile": "notary_deployment_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentWaiverConfig/properties/reference",
-      "key_path": "deployment.waivers[].reference",
-      "path_kind": "property",
-      "profile": "notary_deployment_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentWaiverConfig/properties/summary",
-      "key_path": "deployment.waivers[].summary",
-      "path_kind": "property",
-      "profile": "notary_deployment_internal",
-      "purpose_source": "schema_description",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/evidence",
-      "key_path": "evidence",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "schema_description",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes",
-      "key_path": "evidence.allowed_purposes",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes/items",
-      "key_path": "evidence.allowed_purposes[]",
-      "path_kind": "array_item",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/api_base_url",
-      "key_path": "evidence.api_base_url",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/api_version",
-      "key_path": "evidence.api_version",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/claims",
-      "key_path": "evidence.claims",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/claims_url",
-      "key_path": "evidence.claims_url",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/claims/items",
-      "key_path": "evidence.claims[]",
-      "path_kind": "array_item",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/cccev",
-      "key_path": "evidence.claims[].cccev",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CccevConfig/properties/evidence_type",
-      "key_path": "evidence.claims[].cccev.evidence_type",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CccevConfig/properties/evidence_type_iri",
-      "key_path": "evidence.claims[].cccev.evidence_type_iri",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CccevConfig/properties/requirement_type",
-      "key_path": "evidence.claims[].cccev.requirement_type",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/credential_profiles",
-      "key_path": "evidence.claims[].credential_profiles",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/credential_profiles/items",
-      "key_path": "evidence.claims[].credential_profiles[]",
-      "path_kind": "array_item",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/depends_on",
-      "key_path": "evidence.claims[].depends_on",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/depends_on/items",
-      "key_path": "evidence.claims[].depends_on[]",
-      "path_kind": "array_item",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/disclosure",
-      "key_path": "evidence.claims[].disclosure",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DisclosureConfig/properties/allowed",
-      "key_path": "evidence.claims[].disclosure.allowed",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DisclosureConfig/properties/allowed/items",
-      "key_path": "evidence.claims[].disclosure.allowed[]",
-      "path_kind": "array_item",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DisclosureConfig/properties/default",
-      "key_path": "evidence.claims[].disclosure.default",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DisclosureConfig/properties/downgrade",
-      "key_path": "evidence.claims[].disclosure.downgrade",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/evidence_mode",
-      "key_path": "evidence.claims[].evidence_mode",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/consultations",
-      "key_path": "evidence.claims[].evidence_mode.consultations",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/consultations/additionalProperties",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*",
-      "path_kind": "map_value",
-      "profile": "notary_evidence_claims_evidence_mode_consultations_open_map",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayConsultationConfig/properties/inputs",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayConsultationConfig/properties/inputs/additionalProperties",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs.*",
-      "path_kind": "map_value",
-      "profile": "notary_evidence_claims_evidence_mode_consultations_inputs_open_map",
-      "purpose_source": "schema_description",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayConsultationConfig/properties/outputs",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayConsultationConfig/properties/outputs/additionalProperties",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*",
-      "path_kind": "map_value",
-      "profile": "notary_evidence_claims_evidence_mode_consultations_outputs_open_map",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayOutputContract/oneOf/4/properties/fields",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayOutputContract/oneOf/4/properties/fields/additionalProperties",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*",
-      "path_kind": "map_value",
-      "profile": "notary_evidence_claims_evidence_mode_consultations_output_fields_open_map",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayOutputObjectFieldContract/properties/required",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*.required",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayOutputObjectFieldContract/properties/schema",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*.schema",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayOutputContract/oneOf/5/properties/items",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.items",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayOutputContract/oneOf/2/properties/max_bytes",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.max_bytes",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayOutputContract/oneOf/5/properties/max_items",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.max_items",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/maximum",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.maximum",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/minimum",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.minimum",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/nullable",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.nullable",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/type",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.type",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayConsultationConfig/properties/profile",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.profile",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayConsultationProfileRef/properties/contract_hash",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.contract_hash",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayConsultationProfileRef/properties/id",
-      "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.id",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/type",
-      "key_path": "evidence.claims[].evidence_mode.type",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/formats",
-      "key_path": "evidence.claims[].formats",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/formats/items",
-      "key_path": "evidence.claims[].formats[]",
-      "path_kind": "array_item",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/id",
-      "key_path": "evidence.claims[].id",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/inputs",
-      "key_path": "evidence.claims[].inputs",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/inputs/items",
-      "key_path": "evidence.claims[].inputs[]",
-      "path_kind": "array_item",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimInputConfig/properties/name",
-      "key_path": "evidence.claims[].inputs[].name",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimInputConfig/properties/type",
-      "key_path": "evidence.claims[].inputs[].type",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/oots",
-      "key_path": "evidence.claims[].oots",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/OotsConfig/properties/authentication_level_of_assurance",
-      "key_path": "evidence.claims[].oots.authentication_level_of_assurance",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/OotsConfig/properties/enabled",
-      "key_path": "evidence.claims[].oots.enabled",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/OotsConfig/properties/evidence_type_classification",
-      "key_path": "evidence.claims[].oots.evidence_type_classification",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/OotsConfig/properties/evidence_type_list",
-      "key_path": "evidence.claims[].oots.evidence_type_list",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/OotsConfig/properties/languages",
-      "key_path": "evidence.claims[].oots.languages",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/OotsConfig/properties/languages/items",
-      "key_path": "evidence.claims[].oots.languages[]",
-      "path_kind": "array_item",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/OotsConfig/properties/reference_framework",
-      "key_path": "evidence.claims[].oots.reference_framework",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/OotsConfig/properties/requirement",
-      "key_path": "evidence.claims[].oots.requirement",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/operations",
-      "key_path": "evidence.claims[].operations",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimOperationsConfig/properties/batch_evaluate",
-      "key_path": "evidence.claims[].operations.batch_evaluate",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/BatchOperationConfig/properties/enabled",
-      "key_path": "evidence.claims[].operations.batch_evaluate.enabled",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/BatchOperationConfig/properties/max_subjects",
-      "key_path": "evidence.claims[].operations.batch_evaluate.max_subjects",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimOperationsConfig/properties/evaluate",
-      "key_path": "evidence.claims[].operations.evaluate",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/OperationConfig/properties/enabled",
-      "key_path": "evidence.claims[].operations.evaluate.enabled",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/purpose",
-      "key_path": "evidence.claims[].purpose",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/required_scopes",
-      "key_path": "evidence.claims[].required_scopes",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/required_scopes/items",
-      "key_path": "evidence.claims[].required_scopes[]",
-      "path_kind": "array_item",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/rule",
-      "key_path": "evidence.claims[].rule",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RuleConfig/oneOf/0/properties/consultation",
-      "key_path": "evidence.claims[].rule.consultation",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RuleConfig/oneOf/2/properties/expression",
-      "key_path": "evidence.claims[].rule.expression",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RuleConfig/oneOf/0/properties/output",
-      "key_path": "evidence.claims[].rule.output",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RuleConfig/oneOf/0/properties/type",
-      "key_path": "evidence.claims[].rule.type",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/semantics",
-      "key_path": "evidence.claims[].semantics",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimSemanticConfig/properties/concept",
-      "key_path": "evidence.claims[].semantics.concept",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from",
-      "key_path": "evidence.claims[].semantics.derived_from",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from/items",
-      "key_path": "evidence.claims[].semantics.derived_from[]",
-      "path_kind": "array_item",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimSemanticConfig/properties/predicate",
-      "key_path": "evidence.claims[].semantics.predicate",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimSemanticConfig/properties/property",
-      "key_path": "evidence.claims[].semantics.property",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimSemanticConfig/properties/value_mapping",
-      "key_path": "evidence.claims[].semantics.value_mapping",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimSemanticConfig/properties/vocabulary",
-      "key_path": "evidence.claims[].semantics.vocabulary",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/subject_type",
-      "key_path": "evidence.claims[].subject_type",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/title",
-      "key_path": "evidence.claims[].title",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/value",
-      "key_path": "evidence.claims[].value",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimValueConfig/properties/max_bytes",
-      "key_path": "evidence.claims[].value.max_bytes",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimValueConfig/properties/nullable",
-      "key_path": "evidence.claims[].value.nullable",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimValueConfig/properties/type",
-      "key_path": "evidence.claims[].value.type",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimValueConfig/properties/unit",
-      "key_path": "evidence.claims[].value.unit",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/version",
-      "key_path": "evidence.claims[].version",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/concurrency",
-      "key_path": "evidence.concurrency",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ConcurrencyConfig/properties/subjects",
-      "key_path": "evidence.concurrency.subjects",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/credential_profiles",
-      "key_path": "evidence.credential_profiles",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/credential_profiles/additionalProperties",
-      "key_path": "evidence.credential_profiles.*",
-      "path_kind": "map_value",
-      "profile": "notary_evidence_credential_profiles_open_map",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims",
-      "key_path": "evidence.credential_profiles.*.allowed_claims",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims/items",
-      "key_path": "evidence.credential_profiles.*.allowed_claims[]",
-      "path_kind": "array_item",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialProfileConfig/properties/disclosure",
-      "key_path": "evidence.credential_profiles.*.disclosure",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed",
-      "key_path": "evidence.credential_profiles.*.disclosure.allowed",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed/items",
-      "key_path": "evidence.credential_profiles.*.disclosure.allowed[]",
-      "path_kind": "array_item",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialProfileConfig/properties/format",
-      "key_path": "evidence.credential_profiles.*.format",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialProfileConfig/properties/holder_binding",
-      "key_path": "evidence.credential_profiles.*.holder_binding",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods",
-      "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods/items",
-      "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods[]",
-      "path_kind": "array_item",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/HolderBindingConfig/properties/mode",
-      "key_path": "evidence.credential_profiles.*.holder_binding.mode",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/HolderBindingConfig/properties/proof_of_possession",
-      "key_path": "evidence.credential_profiles.*.holder_binding.proof_of_possession",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialProfileConfig/properties/issuer",
-      "key_path": "evidence.credential_profiles.*.issuer",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialProfileConfig/properties/signing_key",
-      "key_path": "evidence.credential_profiles.*.signing_key",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialProfileConfig/properties/validity_seconds",
-      "key_path": "evidence.credential_profiles.*.validity_seconds",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialProfileConfig/properties/vct",
-      "key_path": "evidence.credential_profiles.*.vct",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/enabled",
-      "key_path": "evidence.enabled",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/formats_url",
-      "key_path": "evidence.formats_url",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/inline_batch_limit",
-      "key_path": "evidence.inline_batch_limit",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/machine_quota",
-      "key_path": "evidence.machine_quota",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/MachineQuotaConfig/properties/enabled",
-      "key_path": "evidence.machine_quota.enabled",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/MachineQuotaConfig/properties/subjects_per_minute",
-      "key_path": "evidence.machine_quota.subjects_per_minute",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/max_credential_validity_seconds",
-      "key_path": "evidence.max_credential_validity_seconds",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/relay",
-      "key_path": "evidence.relay",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "schema_description",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayConnectionConfig/properties/allow_insecure_localhost",
-      "key_path": "evidence.relay.allow_insecure_localhost",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayConnectionConfig/properties/allow_insecure_private_network",
-      "key_path": "evidence.relay.allow_insecure_private_network",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs",
-      "key_path": "evidence.relay.allowed_private_cidrs",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs/items",
-      "key_path": "evidence.relay.allowed_private_cidrs[]",
-      "path_kind": "array_item",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "schema_description",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayConnectionConfig/properties/base_url",
-      "key_path": "evidence.relay.base_url",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayConnectionConfig/properties/max_in_flight",
-      "key_path": "evidence.relay.max_in_flight",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayConnectionConfig/properties/root_certificate_path",
-      "key_path": "evidence.relay.root_certificate_path",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayConnectionConfig/properties/token_file",
-      "key_path": "evidence.relay.token_file",
-      "path_kind": "property",
-      "profile": "notary_evidence_secret_reference",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RelayConnectionConfig/properties/workload_client_id",
-      "key_path": "evidence.relay.workload_client_id",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/service_id",
-      "key_path": "evidence.service_id",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/signing_keys",
-      "key_path": "evidence.signing_keys",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/signing_keys/additionalProperties",
-      "key_path": "evidence.signing_keys.*",
-      "path_kind": "map_value",
-      "profile": "notary_evidence_signing_keys_open_map",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SigningKeyConfig/properties/alg",
-      "key_path": "evidence.signing_keys.*.alg",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SigningKeyConfig/properties/key_id_hex",
-      "key_path": "evidence.signing_keys.*.key_id_hex",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SigningKeyConfig/properties/key_label",
-      "key_path": "evidence.signing_keys.*.key_label",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SigningKeyConfig/properties/kid",
-      "key_path": "evidence.signing_keys.*.kid",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SigningKeyConfig/properties/module_path",
-      "key_path": "evidence.signing_keys.*.module_path",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SigningKeyConfig/properties/password_env",
-      "key_path": "evidence.signing_keys.*.password_env",
-      "path_kind": "property",
-      "profile": "notary_evidence_secret_reference",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SigningKeyConfig/properties/path",
-      "key_path": "evidence.signing_keys.*.path",
-      "path_kind": "property",
-      "profile": "notary_evidence_secret_reference",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SigningKeyConfig/properties/pin_env",
-      "key_path": "evidence.signing_keys.*.pin_env",
-      "path_kind": "property",
-      "profile": "notary_evidence_secret_reference",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SigningKeyConfig/properties/private_jwk_env",
-      "key_path": "evidence.signing_keys.*.private_jwk_env",
-      "path_kind": "property",
-      "profile": "notary_evidence_secret_reference",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SigningKeyConfig/properties/provider",
-      "key_path": "evidence.signing_keys.*.provider",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SigningKeyConfig/properties/public_jwk_env",
-      "key_path": "evidence.signing_keys.*.public_jwk_env",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SigningKeyConfig/properties/publish_until_unix_seconds",
-      "key_path": "evidence.signing_keys.*.publish_until_unix_seconds",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SigningKeyConfig/properties/status",
-      "key_path": "evidence.signing_keys.*.status",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SigningKeyConfig/properties/token_label",
-      "key_path": "evidence.signing_keys.*.token_label",
-      "path_kind": "property",
-      "profile": "notary_evidence_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/variables",
-      "key_path": "evidence.variables",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/variables/additionalProperties",
-      "key_path": "evidence.variables.*",
-      "path_kind": "map_value",
-      "profile": "notary_evidence_variables_open_map",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RequestVariableConfig/properties/from",
-      "key_path": "evidence.variables.*.from",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RequestVariableConfig/properties/type",
-      "key_path": "evidence.variables.*.type",
-      "path_kind": "property",
-      "profile": "notary_evidence_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/federation",
-      "key_path": "federation",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/clock_leeway_seconds",
-      "key_path": "federation.clock_leeway_seconds",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/emergency_denylist",
-      "key_path": "federation.emergency_denylist",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids",
-      "key_path": "federation.emergency_denylist.kids",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids/items",
-      "key_path": "federation.emergency_denylist.kids[]",
-      "path_kind": "array_item",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids",
-      "key_path": "federation.emergency_denylist.node_ids",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids/items",
-      "key_path": "federation.emergency_denylist.node_ids[]",
-      "path_kind": "array_item",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/enabled",
-      "key_path": "federation.enabled",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/evaluation_profiles",
-      "key_path": "federation.evaluation_profiles",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/evaluation_profiles/items",
-      "key_path": "federation.evaluation_profiles[]",
-      "path_kind": "array_item",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEvaluationProfileConfig/properties/assurance_level",
-      "key_path": "federation.evaluation_profiles[].assurance_level",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEvaluationProfileConfig/properties/claim_id",
-      "key_path": "federation.evaluation_profiles[].claim_id",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEvaluationProfileConfig/properties/consent_ref",
-      "key_path": "federation.evaluation_profiles[].consent_ref",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEvaluationProfileConfig/properties/disclosure",
-      "key_path": "federation.evaluation_profiles[].disclosure",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEvaluationProfileConfig/properties/id",
-      "key_path": "federation.evaluation_profiles[].id",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEvaluationProfileConfig/properties/jurisdiction",
-      "key_path": "federation.evaluation_profiles[].jurisdiction",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEvaluationProfileConfig/properties/legal_basis_ref",
-      "key_path": "federation.evaluation_profiles[].legal_basis_ref",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEvaluationProfileConfig/properties/max_claim_result_age_seconds",
-      "key_path": "federation.evaluation_profiles[].max_claim_result_age_seconds",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEvaluationProfileConfig/properties/ruleset",
-      "key_path": "federation.evaluation_profiles[].ruleset",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEvaluationProfileConfig/properties/subject_id_type",
-      "key_path": "federation.evaluation_profiles[].subject_id_type",
-      "path_kind": "property",
-      "profile": "notary_federation_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/federation_api",
-      "key_path": "federation.federation_api",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/inbound_body_limit_bytes",
-      "key_path": "federation.inbound_body_limit_bytes",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/issuer",
-      "key_path": "federation.issuer",
-      "path_kind": "property",
-      "profile": "notary_federation_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/jwks_uri",
-      "key_path": "federation.jwks_uri",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/max_request_lifetime_seconds",
-      "key_path": "federation.max_request_lifetime_seconds",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/node_id",
-      "key_path": "federation.node_id",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/pairwise_subject_hash",
-      "key_path": "federation.pairwise_subject_hash",
-      "path_kind": "property",
-      "profile": "notary_federation_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationPairwiseSubjectHashConfig/properties/secret_env",
-      "key_path": "federation.pairwise_subject_hash.secret_env",
-      "path_kind": "property",
-      "profile": "notary_federation_secret_reference",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/peers",
-      "key_path": "federation.peers",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/peers/items",
-      "key_path": "federation.peers[]",
-      "path_kind": "array_item",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_localhost",
-      "key_path": "federation.peers[].allow_insecure_localhost",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_private_network",
-      "key_path": "federation.peers[].allow_insecure_private_network",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles",
-      "key_path": "federation.peers[].allowed_profiles",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles/items",
-      "key_path": "federation.peers[].allowed_profiles[]",
-      "path_kind": "array_item",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions",
-      "key_path": "federation.peers[].allowed_protocol_versions",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions/items",
-      "key_path": "federation.peers[].allowed_protocol_versions[]",
-      "path_kind": "array_item",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes",
-      "key_path": "federation.peers[].allowed_purposes",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes/items",
-      "key_path": "federation.peers[].allowed_purposes[]",
-      "path_kind": "array_item",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes",
-      "key_path": "federation.peers[].evaluation_scopes",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes/items",
-      "key_path": "federation.peers[].evaluation_scopes[]",
-      "path_kind": "array_item",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationPeerConfig/properties/issuer",
-      "key_path": "federation.peers[].issuer",
-      "path_kind": "property",
-      "profile": "notary_federation_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationPeerConfig/properties/jwks_uri",
-      "key_path": "federation.peers[].jwks_uri",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationPeerConfig/properties/node_id",
-      "key_path": "federation.peers[].node_id",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/response_shaping",
-      "key_path": "federation.response_shaping",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationResponseShapingConfig/properties/minimum_denial_latency_ms",
-      "key_path": "federation.response_shaping.minimum_denial_latency_ms",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/signing",
-      "key_path": "federation.signing",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationSigningConfig/properties/signing_key",
-      "key_path": "federation.signing.signing_key",
-      "path_kind": "property",
-      "profile": "notary_federation_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions",
-      "key_path": "federation.supported_protocol_versions",
-      "path_kind": "property",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions/items",
-      "key_path": "federation.supported_protocol_versions[]",
-      "path_kind": "array_item",
-      "profile": "notary_federation_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/instance",
-      "key_path": "instance",
-      "path_kind": "property",
-      "profile": "notary_instance_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/NotaryInstanceConfig/properties/environment",
-      "key_path": "instance.environment",
-      "path_kind": "property",
-      "profile": "notary_instance_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/NotaryInstanceConfig/properties/id",
-      "key_path": "instance.id",
-      "path_kind": "property",
-      "profile": "notary_instance_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/NotaryInstanceConfig/properties/jurisdiction",
-      "key_path": "instance.jurisdiction",
-      "path_kind": "property",
-      "profile": "notary_instance_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/NotaryInstanceConfig/properties/owner",
-      "key_path": "instance.owner",
-      "path_kind": "property",
-      "profile": "notary_instance_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/NotaryInstanceConfig/properties/public_base_url",
-      "key_path": "instance.public_base_url",
-      "path_kind": "property",
-      "profile": "notary_instance_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/oid4vci",
-      "key_path": "oid4vci",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences",
-      "key_path": "oid4vci.accepted_token_audiences",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences/items",
-      "key_path": "oid4vci.accepted_token_audiences[]",
-      "path_kind": "array_item",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/authorization",
-      "key_path": "oid4vci.authorization",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers",
-      "key_path": "oid4vci.authorization_servers",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers/items",
-      "key_path": "oid4vci.authorization_servers[]",
-      "path_kind": "array_item",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciAuthorizationConfig/properties/require_pkce_method",
-      "key_path": "oid4vci.authorization.require_pkce_method",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations",
-      "key_path": "oid4vci.credential_configurations",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations/additionalProperties",
-      "key_path": "oid4vci.credential_configurations.*",
-      "path_kind": "map_value",
-      "profile": "notary_oid4vci_credential_configurations_open_map",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claim_id",
-      "key_path": "oid4vci.credential_configurations.*.claim_id",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims",
-      "key_path": "oid4vci.credential_configurations.*.claims",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims/items",
-      "key_path": "oid4vci.credential_configurations.*.claims[]",
-      "path_kind": "array_item",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/display_name",
-      "key_path": "oid4vci.credential_configurations.*.claims[].display_name",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/id",
-      "key_path": "oid4vci.credential_configurations.*.claims[].id",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path",
-      "key_path": "oid4vci.credential_configurations.*.claims[].output_path",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path/items",
-      "key_path": "oid4vci.credential_configurations.*.claims[].output_path[]",
-      "path_kind": "array_item",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/sd",
-      "key_path": "oid4vci.credential_configurations.*.claims[].sd",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/credential_profile",
-      "key_path": "oid4vci.credential_configurations.*.credential_profile",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported",
-      "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported/items",
-      "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported[]",
-      "path_kind": "array_item",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display",
-      "key_path": "oid4vci.credential_configurations.*.display",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display_name",
-      "key_path": "oid4vci.credential_configurations.*.display_name",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_color",
-      "key_path": "oid4vci.credential_configurations.*.display.background_color",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_image",
-      "key_path": "oid4vci.credential_configurations.*.display.background_image",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-      "key_path": "oid4vci.credential_configurations.*.display.background_image.alt_text",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-      "key_path": "oid4vci.credential_configurations.*.display.background_image.uri",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-      "key_path": "oid4vci.credential_configurations.*.display.background_image.url",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/description",
-      "key_path": "oid4vci.credential_configurations.*.display.description",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/locale",
-      "key_path": "oid4vci.credential_configurations.*.display.locale",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/logo",
-      "key_path": "oid4vci.credential_configurations.*.display.logo",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-      "key_path": "oid4vci.credential_configurations.*.display.logo.alt_text",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-      "key_path": "oid4vci.credential_configurations.*.display.logo.uri",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-      "key_path": "oid4vci.credential_configurations.*.display.logo.url",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/secondary_image",
-      "key_path": "oid4vci.credential_configurations.*.display.secondary_image",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-      "key_path": "oid4vci.credential_configurations.*.display.secondary_image.alt_text",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-      "key_path": "oid4vci.credential_configurations.*.display.secondary_image.uri",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-      "key_path": "oid4vci.credential_configurations.*.display.secondary_image.url",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/text_color",
-      "key_path": "oid4vci.credential_configurations.*.display.text_color",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/format",
-      "key_path": "oid4vci.credential_configurations.*.format",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported",
-      "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported/items",
-      "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported[]",
-      "path_kind": "array_item",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/representative_issuance",
-      "key_path": "oid4vci.credential_configurations.*.representative_issuance",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciRepresentativeIssuanceConfig/properties/ceremony",
-      "key_path": "oid4vci.credential_configurations.*.representative_issuance.ceremony",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciRepresentativeIssuanceConfig/properties/relationship",
-      "key_path": "oid4vci.credential_configurations.*.representative_issuance.relationship",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/scope",
-      "key_path": "oid4vci.credential_configurations.*.scope",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/vct",
-      "key_path": "oid4vci.credential_configurations.*.vct",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/credential_endpoint",
-      "key_path": "oid4vci.credential_endpoint",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/credential_issuer",
-      "key_path": "oid4vci.credential_issuer",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/display",
-      "key_path": "oid4vci.display",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/display/items",
-      "key_path": "oid4vci.display[]",
-      "path_kind": "array_item",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/locale",
-      "key_path": "oid4vci.display[].locale",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/logo",
-      "key_path": "oid4vci.display[].logo",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-      "key_path": "oid4vci.display[].logo.alt_text",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-      "key_path": "oid4vci.display[].logo.uri",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-      "key_path": "oid4vci.display[].logo.url",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/name",
-      "key_path": "oid4vci.display[].name",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/enabled",
-      "key_path": "oid4vci.enabled",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/nonce",
-      "key_path": "oid4vci.nonce",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/nonce_endpoint",
-      "key_path": "oid4vci.nonce_endpoint",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciNonceConfig/properties/enabled",
-      "key_path": "oid4vci.nonce.enabled",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciNonceConfig/properties/ttl_seconds",
-      "key_path": "oid4vci.nonce.ttl_seconds",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/offer_endpoint",
-      "key_path": "oid4vci.offer_endpoint",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/pre_authorized_code",
-      "key_path": "oid4vci.pre_authorized_code",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/enabled",
-      "key_path": "oid4vci.pre_authorized_code.enabled",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/esignet",
-      "key_path": "oid4vci.pre_authorized_code.esignet",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/allow_insecure_localhost",
-      "key_path": "oid4vci.pre_authorized_code.esignet.allow_insecure_localhost",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/authorize_url",
-      "key_path": "oid4vci.pre_authorized_code.esignet.authorize_url",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_id",
-      "key_path": "oid4vci.pre_authorized_code.esignet.client_id",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_signing_key_id",
-      "key_path": "oid4vci.pre_authorized_code.esignet.client_signing_key_id",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/issuer",
-      "key_path": "oid4vci.pre_authorized_code.esignet.issuer",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/jwks_uri",
-      "key_path": "oid4vci.pre_authorized_code.esignet.jwks_uri",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/login_state_ttl_seconds",
-      "key_path": "oid4vci.pre_authorized_code.esignet.login_state_ttl_seconds",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/redirect_uri",
-      "key_path": "oid4vci.pre_authorized_code.esignet.redirect_uri",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes",
-      "key_path": "oid4vci.pre_authorized_code.esignet.scopes",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes/items",
-      "key_path": "oid4vci.pre_authorized_code.esignet.scopes[]",
-      "path_kind": "array_item",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/token_url",
-      "key_path": "oid4vci.pre_authorized_code.esignet.token_url",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/userinfo_url",
-      "key_path": "oid4vci.pre_authorized_code.esignet.userinfo_url",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_sensitive",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/pre_authorized_code_ttl_seconds",
-      "key_path": "oid4vci.pre_authorized_code.pre_authorized_code_ttl_seconds",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/tx_code",
-      "key_path": "oid4vci.pre_authorized_code.tx_code",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciTxCodeConfig/properties/input_mode",
-      "key_path": "oid4vci.pre_authorized_code.tx_code.input_mode",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciTxCodeConfig/properties/length",
-      "key_path": "oid4vci.pre_authorized_code.tx_code.length",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciTxCodeConfig/properties/required",
-      "key_path": "oid4vci.pre_authorized_code.tx_code.required",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciConfig/properties/proof",
-      "key_path": "oid4vci.proof",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciProofConfig/properties/max_age_seconds",
-      "key_path": "oid4vci.proof.max_age_seconds",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciProofConfig/properties/max_clock_skew_seconds",
-      "key_path": "oid4vci.proof.max_clock_skew_seconds",
-      "path_kind": "property",
-      "profile": "notary_oid4vci_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/server",
-      "key_path": "server",
-      "path_kind": "property",
-      "profile": "notary_server_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryHttpConfig/properties/admin_listener",
-      "key_path": "server.admin_listener",
-      "path_kind": "property",
-      "profile": "notary_server_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/bind",
-      "key_path": "server.admin_listener.bind",
-      "path_kind": "property",
-      "profile": "notary_server_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/mode",
-      "key_path": "server.admin_listener.mode",
-      "path_kind": "property",
-      "profile": "notary_server_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryHttpConfig/properties/bind",
-      "key_path": "server.bind",
-      "path_kind": "property",
-      "profile": "notary_server_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryHttpConfig/properties/cors",
-      "key_path": "server.cors",
-      "path_kind": "property",
-      "profile": "notary_server_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins",
-      "key_path": "server.cors.allowed_origins",
-      "path_kind": "property",
-      "profile": "notary_server_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins/items",
-      "key_path": "server.cors.allowed_origins[]",
-      "path_kind": "array_item",
-      "profile": "notary_server_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryHttpConfig/properties/http1_header_read_timeout",
-      "key_path": "server.http1_header_read_timeout",
-      "path_kind": "property",
-      "profile": "notary_server_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryHttpConfig/properties/max_connections",
-      "key_path": "server.max_connections",
-      "path_kind": "property",
-      "profile": "notary_server_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryHttpConfig/properties/openapi_requires_auth",
-      "key_path": "server.openapi_requires_auth",
-      "path_kind": "property",
-      "profile": "notary_server_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_body_timeout",
-      "key_path": "server.request_body_timeout",
-      "path_kind": "property",
-      "profile": "notary_server_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_timeout",
-      "key_path": "server.request_timeout",
-      "path_kind": "property",
-      "profile": "notary_server_internal",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips",
-      "key_path": "server.trusted_proxy_ips",
-      "path_kind": "property",
-      "profile": "notary_server_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips/items",
-      "key_path": "server.trusted_proxy_ips[]",
-      "path_kind": "array_item",
-      "profile": "notary_server_internal",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/state",
-      "key_path": "state",
-      "path_kind": "property",
-      "profile": "notary_state_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/StateConfig/properties/postgresql",
-      "key_path": "state.postgresql",
-      "path_kind": "property",
-      "profile": "notary_state_internal",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/StatePostgresqlConfig/properties/connect_timeout_ms",
-      "key_path": "state.postgresql.connect_timeout_ms",
-      "path_kind": "property",
-      "profile": "notary_state_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/StatePostgresqlConfig/properties/max_connections",
-      "key_path": "state.postgresql.max_connections",
-      "path_kind": "property",
-      "profile": "notary_state_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/StatePostgresqlConfig/properties/operation_timeout_ms",
-      "key_path": "state.postgresql.operation_timeout_ms",
-      "path_kind": "property",
-      "profile": "notary_state_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/StatePostgresqlConfig/properties/root_certificate_path",
-      "key_path": "state.postgresql.root_certificate_path",
-      "path_kind": "property",
-      "profile": "notary_state_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/StatePostgresqlConfig/properties/sensitive_state_key_env",
-      "key_path": "state.postgresql.sensitive_state_key_env",
-      "path_kind": "property",
-      "profile": "notary_state_secret_reference",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/StatePostgresqlConfig/properties/url_env",
-      "key_path": "state.postgresql.url_env",
-      "path_kind": "property",
-      "profile": "notary_state_secret_reference",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/StateConfig/properties/storage",
-      "key_path": "state.storage",
-      "path_kind": "property",
-      "profile": "notary_state_internal",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/subject_access",
-      "key_path": "subject_access",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "reviewed_runtime_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/allowed_claims",
-      "key_path": "subject_access.allowed_claims",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/allowed_claims/items",
-      "key_path": "subject_access.allowed_claims[]",
-      "path_kind": "array_item",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/allowed_disclosures",
-      "key_path": "subject_access.allowed_disclosures",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/allowed_disclosures/items",
-      "key_path": "subject_access.allowed_disclosures[]",
-      "path_kind": "array_item",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/allowed_formats",
-      "key_path": "subject_access.allowed_formats",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/allowed_formats/items",
-      "key_path": "subject_access.allowed_formats[]",
-      "path_kind": "array_item",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/allowed_operations",
-      "key_path": "subject_access.allowed_operations",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessOperationsConfig/properties/batch_evaluate",
-      "key_path": "subject_access.allowed_operations.batch_evaluate",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessOperationsConfig/properties/evaluate",
-      "key_path": "subject_access.allowed_operations.evaluate",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessOperationsConfig/properties/issue_credential",
-      "key_path": "subject_access.allowed_operations.issue_credential",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessOperationsConfig/properties/render",
-      "key_path": "subject_access.allowed_operations.render",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/allowed_purposes",
-      "key_path": "subject_access.allowed_purposes",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/allowed_purposes/items",
-      "key_path": "subject_access.allowed_purposes[]",
-      "path_kind": "array_item",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/allowed_wallet_origins",
-      "key_path": "subject_access.allowed_wallet_origins",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/allowed_wallet_origins/items",
-      "key_path": "subject_access.allowed_wallet_origins[]",
-      "path_kind": "array_item",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/citizen_clients",
-      "key_path": "subject_access.citizen_clients",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_audiences",
-      "key_path": "subject_access.citizen_clients.allowed_audiences",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_audiences/items",
-      "key_path": "subject_access.citizen_clients.allowed_audiences[]",
-      "path_kind": "array_item",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_client_ids",
-      "key_path": "subject_access.citizen_clients.allowed_client_ids",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_client_ids/items",
-      "key_path": "subject_access.citizen_clients.allowed_client_ids[]",
-      "path_kind": "array_item",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/credential_profiles",
-      "key_path": "subject_access.credential_profiles",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/credential_profiles/items",
-      "key_path": "subject_access.credential_profiles[]",
-      "path_kind": "array_item",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/delegation",
-      "key_path": "subject_access.delegation",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessDelegationConfig/properties/allowed_relationships",
-      "key_path": "subject_access.delegation.allowed_relationships",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessDelegationConfig/properties/allowed_relationships/items",
-      "key_path": "subject_access.delegation.allowed_relationships[]",
-      "path_kind": "array_item",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_claims",
-      "key_path": "subject_access.delegation.allowed_relationships[].allowed_claims",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_claims/items",
-      "key_path": "subject_access.delegation.allowed_relationships[].allowed_claims[]",
-      "path_kind": "array_item",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_disclosures",
-      "key_path": "subject_access.delegation.allowed_relationships[].allowed_disclosures",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_disclosures/items",
-      "key_path": "subject_access.delegation.allowed_relationships[].allowed_disclosures[]",
-      "path_kind": "array_item",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_formats",
-      "key_path": "subject_access.delegation.allowed_relationships[].allowed_formats",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_formats/items",
-      "key_path": "subject_access.delegation.allowed_relationships[].allowed_formats[]",
-      "path_kind": "array_item",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_purposes",
-      "key_path": "subject_access.delegation.allowed_relationships[].allowed_purposes",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_purposes/items",
-      "key_path": "subject_access.delegation.allowed_relationships[].allowed_purposes[]",
-      "path_kind": "array_item",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/max_proof_age_seconds",
-      "key_path": "subject_access.delegation.allowed_relationships[].max_proof_age_seconds",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/proof_claim",
-      "key_path": "subject_access.delegation.allowed_relationships[].proof_claim",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/relationship_type",
-      "key_path": "subject_access.delegation.allowed_relationships[].relationship_type",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "no_schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/target_id_type",
-      "key_path": "subject_access.delegation.allowed_relationships[].target_id_type",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessDelegationConfig/properties/enabled",
-      "key_path": "subject_access.delegation.enabled",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/enabled",
-      "key_path": "subject_access.enabled",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/rate_limits",
-      "key_path": "subject_access.rate_limits",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/credential_issuance_per_principal_per_hour",
-      "key_path": "subject_access.rate_limits.credential_issuance_per_principal_per_hour",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/invalid_token_per_client_address_per_minute",
-      "key_path": "subject_access.rate_limits.invalid_token_per_client_address_per_minute",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/per_holder_per_hour",
-      "key_path": "subject_access.rate_limits.per_holder_per_hour",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/per_principal_per_minute",
-      "key_path": "subject_access.rate_limits.per_principal_per_minute",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/subject_mismatch_per_principal_per_hour",
-      "key_path": "subject_access.rate_limits.subject_mismatch_per_principal_per_hour",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/tx_code_attempts_per_code_per_minute",
-      "key_path": "subject_access.rate_limits.tx_code_attempts_per_code_per_minute",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "schema_description",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/required_scopes",
-      "key_path": "subject_access.required_scopes",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/required_scopes/items",
-      "key_path": "subject_access.required_scopes[]",
-      "path_kind": "array_item",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/scope_policy",
-      "key_path": "subject_access.scope_policy",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/subject_binding",
-      "key_path": "subject_access.subject_binding",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/allow_sub_as_civil_id",
-      "key_path": "subject_access.subject_binding.allow_sub_as_civil_id",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/claim_source",
-      "key_path": "subject_access.subject_binding.claim_source",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/id_type",
-      "key_path": "subject_access.subject_binding.id_type",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/normalize",
-      "key_path": "subject_access.subject_binding.normalize",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/request_field",
-      "key_path": "subject_access.subject_binding.request_field",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/token_claim",
-      "key_path": "subject_access.subject_binding.token_claim",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessConfig/properties/token_policy",
-      "key_path": "subject_access.token_policy",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/assurance_claim_source",
-      "key_path": "subject_access.token_policy.assurance_claim_source",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_access_token_lifetime_seconds",
-      "key_path": "subject_access.token_policy.max_access_token_lifetime_seconds",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_auth_age_seconds",
-      "key_path": "subject_access.token_policy.max_auth_age_seconds",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_clock_leeway_seconds",
-      "key_path": "subject_access.token_policy.max_clock_leeway_seconds",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_credential_validity_seconds",
-      "key_path": "subject_access.token_policy.max_credential_validity_seconds",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_evaluation_age_seconds",
-      "key_path": "subject_access.token_policy.max_evaluation_age_seconds",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/required_acr_values",
-      "key_path": "subject_access.token_policy.required_acr_values",
-      "path_kind": "property",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "schema_default",
-      "schema_facts_reviewed": true
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/required_acr_values/items",
-      "key_path": "subject_access.token_policy.required_acr_values[]",
-      "path_kind": "array_item",
-      "profile": "notary_subject_access_sensitive",
-      "purpose_source": "profile",
-      "default_source": "not_applicable",
-      "schema_facts_reviewed": true
-    }
-  ],
-  "overrides": [
-    {
-      "schema": "notary",
-      "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids",
-      "key_path": "auth.access_token_signing.verification_key_ids",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details",
-      "key_path": "auth.api_keys[].authorization_details",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode",
-      "key_path": "auth.api_keys[].authorization_details.access_mode",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions",
-      "key_path": "auth.api_keys[].authorization_details.actions",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context",
-      "key_path": "auth.api_keys[].authorization_details.assisted_access_context",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level",
-      "key_path": "auth.api_keys[].authorization_details.assurance_level",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims",
-      "key_path": "auth.api_keys[].authorization_details.claims",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref",
-      "key_path": "auth.api_keys[].authorization_details.consent_ref",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure",
-      "key_path": "auth.api_keys[].authorization_details.disclosure",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format",
-      "key_path": "auth.api_keys[].authorization_details.format",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction",
-      "key_path": "auth.api_keys[].authorization_details.jurisdiction",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref",
-      "key_path": "auth.api_keys[].authorization_details.legal_basis_ref",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations",
-      "key_path": "auth.api_keys[].authorization_details.locations",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose",
-      "key_path": "auth.api_keys[].authorization_details.purpose",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship",
-      "key_path": "auth.api_keys[].authorization_details.relationship",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject",
-      "key_path": "auth.api_keys[].authorization_details.subject",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target",
-      "key_path": "auth.api_keys[].authorization_details.target",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialFingerprintRef/properties/name",
-      "key_path": "auth.api_keys[].fingerprint.name",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialFingerprintRef/properties/path",
-      "key_path": "auth.api_keys[].fingerprint.path",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details",
-      "key_path": "auth.bearer_tokens[].authorization_details",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode",
-      "key_path": "auth.bearer_tokens[].authorization_details.access_mode",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions",
-      "key_path": "auth.bearer_tokens[].authorization_details.actions",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context",
-      "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level",
-      "key_path": "auth.bearer_tokens[].authorization_details.assurance_level",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims",
-      "key_path": "auth.bearer_tokens[].authorization_details.claims",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref",
-      "key_path": "auth.bearer_tokens[].authorization_details.consent_ref",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure",
-      "key_path": "auth.bearer_tokens[].authorization_details.disclosure",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format",
-      "key_path": "auth.bearer_tokens[].authorization_details.format",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction",
-      "key_path": "auth.bearer_tokens[].authorization_details.jurisdiction",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref",
-      "key_path": "auth.bearer_tokens[].authorization_details.legal_basis_ref",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations",
-      "key_path": "auth.bearer_tokens[].authorization_details.locations",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose",
-      "key_path": "auth.bearer_tokens[].authorization_details.purpose",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship",
-      "key_path": "auth.bearer_tokens[].authorization_details.relationship",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject",
-      "key_path": "auth.bearer_tokens[].authorization_details.subject",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target",
-      "key_path": "auth.bearer_tokens[].authorization_details.target",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialFingerprintRef/properties/name",
-      "key_path": "auth.bearer_tokens[].fingerprint.name",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CredentialFingerprintRef/properties/path",
-      "key_path": "auth.bearer_tokens[].fingerprint.path",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/cel",
-      "key_path": "cel",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/config_trust",
-      "key_path": "config_trust",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path",
-      "key_path": "config_trust.break_glass_override_path",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/credential_status",
-      "key_path": "credential_status",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/deployment",
-      "key_path": "deployment",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path",
-      "key_path": "deployment.evidence.audit_ack_cursor_path",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs",
-      "key_path": "deployment.evidence.audit_ack_max_age_secs",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentConfig/properties/profile",
-      "key_path": "deployment.profile",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentConfig/properties/waivers",
-      "key_path": "deployment.waivers",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/DeploymentWaiverConfig/properties/summary",
-      "key_path": "deployment.waivers[].summary",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CccevConfig/properties/evidence_type",
-      "key_path": "evidence.claims[].cccev.evidence_type",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/CccevConfig/properties/evidence_type_iri",
-      "key_path": "evidence.claims[].cccev.evidence_type_iri",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimDefinition/properties/semantics",
-      "key_path": "evidence.claims[].semantics",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimSemanticConfig/properties/concept",
-      "key_path": "evidence.claims[].semantics.concept",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from",
-      "key_path": "evidence.claims[].semantics.derived_from",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimSemanticConfig/properties/predicate",
-      "key_path": "evidence.claims[].semantics.predicate",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimSemanticConfig/properties/property",
-      "key_path": "evidence.claims[].semantics.property",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimSemanticConfig/properties/value_mapping",
-      "key_path": "evidence.claims[].semantics.value_mapping",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimSemanticConfig/properties/vocabulary",
-      "key_path": "evidence.claims[].semantics.vocabulary",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimValueConfig/properties/max_bytes",
-      "key_path": "evidence.claims[].value.max_bytes",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a per-claim string byte ceiling."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/ClaimValueConfig/properties/nullable",
-      "key_path": "evidence.claims[].value.nullable",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/EvidenceConfig/properties/relay",
-      "key_path": "evidence.relay",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/SigningKeyConfig/properties/publish_until_unix_seconds",
-      "key_path": "evidence.signing_keys.*.publish_until_unix_seconds",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/federation",
-      "key_path": "federation",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEvaluationProfileConfig/properties/assurance_level",
-      "key_path": "federation.evaluation_profiles[].assurance_level",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEvaluationProfileConfig/properties/consent_ref",
-      "key_path": "federation.evaluation_profiles[].consent_ref",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEvaluationProfileConfig/properties/disclosure",
-      "key_path": "federation.evaluation_profiles[].disclosure",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEvaluationProfileConfig/properties/jurisdiction",
-      "key_path": "federation.evaluation_profiles[].jurisdiction",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEvaluationProfileConfig/properties/legal_basis_ref",
-      "key_path": "federation.evaluation_profiles[].legal_basis_ref",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/FederationEvaluationProfileConfig/properties/max_claim_result_age_seconds",
-      "key_path": "federation.evaluation_profiles[].max_claim_result_age_seconds",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/instance",
-      "key_path": "instance",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/NotaryInstanceConfig/properties/jurisdiction",
-      "key_path": "instance.jurisdiction",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/NotaryInstanceConfig/properties/owner",
-      "key_path": "instance.owner",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/NotaryInstanceConfig/properties/public_base_url",
-      "key_path": "instance.public_base_url",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/oid4vci",
-      "key_path": "oid4vci",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claim_id",
-      "key_path": "oid4vci.credential_configurations.*.claim_id",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims",
-      "key_path": "oid4vci.credential_configurations.*.claims",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/representative_issuance",
-      "key_path": "oid4vci.credential_configurations.*.representative_issuance",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_color",
-      "key_path": "oid4vci.credential_configurations.*.display.background_color",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_image",
-      "key_path": "oid4vci.credential_configurations.*.display.background_image",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-      "key_path": "oid4vci.credential_configurations.*.display.background_image.alt_text",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-      "key_path": "oid4vci.credential_configurations.*.display.background_image.uri",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-      "key_path": "oid4vci.credential_configurations.*.display.background_image.url",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/description",
-      "key_path": "oid4vci.credential_configurations.*.display.description",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/locale",
-      "key_path": "oid4vci.credential_configurations.*.display.locale",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/logo",
-      "key_path": "oid4vci.credential_configurations.*.display.logo",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-      "key_path": "oid4vci.credential_configurations.*.display.logo.alt_text",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-      "key_path": "oid4vci.credential_configurations.*.display.logo.uri",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-      "key_path": "oid4vci.credential_configurations.*.display.logo.url",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/secondary_image",
-      "key_path": "oid4vci.credential_configurations.*.display.secondary_image",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-      "key_path": "oid4vci.credential_configurations.*.display.secondary_image.alt_text",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-      "key_path": "oid4vci.credential_configurations.*.display.secondary_image.uri",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-      "key_path": "oid4vci.credential_configurations.*.display.secondary_image.url",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/text_color",
-      "key_path": "oid4vci.credential_configurations.*.display.text_color",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/locale",
-      "key_path": "oid4vci.display[].locale",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/logo",
-      "key_path": "oid4vci.display[].logo",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-      "key_path": "oid4vci.display[].logo.alt_text",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-      "key_path": "oid4vci.display[].logo.uri",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-      "key_path": "oid4vci.display[].logo.url",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryHttpConfig/properties/admin_listener",
-      "key_path": "server.admin_listener",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/mode",
-      "key_path": "server.admin_listener.mode",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryHttpConfig/properties/openapi_requires_auth",
-      "key_path": "server.openapi_requires_auth",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips",
-      "key_path": "server.trusted_proxy_ips",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/state",
-      "key_path": "state",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/StateConfig/properties/postgresql",
-      "key_path": "state.postgresql",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/$defs/StatePostgresqlConfig/properties/root_certificate_path",
-      "key_path": "state.postgresql.root_certificate_path",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-    },
-    {
-      "schema": "notary",
-      "pointer": "/properties/subject_access",
-      "key_path": "subject_access",
-      "path_kind": "property",
-      "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-    }
-  ]
-}
diff --git a/crates/registry-notary-core/src/config.rs b/crates/registry-notary-core/src/config.rs
deleted file mode 100644
index 9e001e5e2..000000000
--- a/crates/registry-notary-core/src/config.rs
+++ /dev/null
@@ -1,60 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Registry Notary configuration model.
-
-use std::collections::BTreeMap;
-use std::collections::BTreeSet;
-use std::collections::HashSet;
-use std::net::{IpAddr, SocketAddr};
-use std::path::PathBuf;
-use std::time::{Duration, SystemTime};
-
-use registry_platform_authcommon::CredentialFingerprintRef;
-use registry_platform_config::DeprecatedConfigField;
-use registry_platform_crypto::validate_did_web_https_issuer_binding;
-use registry_platform_crypto::PublicJwk;
-pub use registry_platform_crypto::{
-    KeyProviderKind as SigningKeyProviderConfig, KeyStatus as SigningKeyStatus,
-};
-use registry_platform_oid4vci::{
-    CREDENTIAL_SIGNING_ALG_EDDSA, CRYPTOGRAPHIC_BINDING_METHOD_DID_JWK,
-    SD_JWT_VC_FORMAT as OID4VCI_SD_JWT_VC_FORMAT,
-};
-use schemars::JsonSchema;
-use serde::{Deserialize, Serialize};
-
-use crate::deployment::DeploymentConfig;
-use crate::model::{
-    is_request_variable_name, DisclosureProfile, EvidenceAuthorizationDetails, FORMAT_CCCEV_JSONLD,
-    FORMAT_CLAIM_RESULT_JSON, FORMAT_SD_JWT_VC, MAX_REQUEST_VARIABLES_V1,
-    SD_JWT_VC_HOLDER_BINDING_METHOD, SD_JWT_VC_SIGNING_ALG,
-};
-
-mod audit;
-mod auth;
-mod cel;
-mod credential_status;
-mod errors;
-mod evidence;
-mod federation;
-mod http;
-mod oid4vci;
-mod root;
-pub mod schema;
-mod state;
-mod subject_access;
-
-pub use audit::*;
-pub use auth::*;
-pub use cel::*;
-pub use credential_status::*;
-pub use errors::*;
-pub use evidence::*;
-pub use federation::*;
-pub use http::*;
-pub use oid4vci::*;
-pub use root::*;
-pub use state::*;
-pub use subject_access::*;
-
-#[cfg(test)]
-mod tests;
diff --git a/crates/registry-notary-core/src/config/audit.rs b/crates/registry-notary-core/src/config/audit.rs
deleted file mode 100644
index d898404b9..000000000
--- a/crates/registry-notary-core/src/config/audit.rs
+++ /dev/null
@@ -1,59 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Evidence audit sink configuration.
-
-use super::*;
-
-#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct EvidenceAuditConfig {
-    #[serde(default = "default_audit_sink")]
-    pub sink: String,
-    #[serde(default)]
-    pub path: Option<String>,
-    #[serde(default)]
-    pub hash_secret_env: Option<String>,
-    #[serde(default)]
-    pub max_size_mb: Option<u64>,
-    #[serde(default)]
-    pub max_files: Option<u32>,
-    #[serde(default)]
-    pub syslog_socket_path: Option<String>,
-}
-
-impl Default for EvidenceAuditConfig {
-    fn default() -> Self {
-        Self {
-            sink: default_audit_sink(),
-            path: None,
-            hash_secret_env: None,
-            max_size_mb: None,
-            max_files: None,
-            syslog_socket_path: None,
-        }
-    }
-}
-
-impl EvidenceAuditConfig {
-    pub const DEFAULT_MAX_SIZE_MB: u64 = 100;
-    pub const DEFAULT_MAX_FILES: u32 = 14;
-
-    pub fn max_size_bytes(&self) -> u64 {
-        self.max_size_mb.unwrap_or(Self::DEFAULT_MAX_SIZE_MB) * 1024 * 1024
-    }
-
-    pub fn max_files(&self) -> u32 {
-        self.max_files.unwrap_or(Self::DEFAULT_MAX_FILES)
-    }
-}
-
-pub(super) fn default_audit_sink() -> String {
-    "stdout".to_string()
-}
-
-/// A durable audit sink retains the evidence trail beyond process stdout.
-///
-/// `stdout` and `none` are not durable, retained sinks for a production-shaped
-/// deployment; `file`, `jsonl`, and `syslog` write to a retained destination.
-pub(super) fn audit_sink_is_durable(config: &EvidenceAuditConfig) -> bool {
-    matches!(config.sink.as_str(), "file" | "jsonl" | "syslog")
-}
diff --git a/crates/registry-notary-core/src/config/auth.rs b/crates/registry-notary-core/src/config/auth.rs
deleted file mode 100644
index 0a55962d8..000000000
--- a/crates/registry-notary-core/src/config/auth.rs
+++ /dev/null
@@ -1,237 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Caller authentication and token-signing configuration.
-
-use super::*;
-
-#[derive(Debug, Clone, Default, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct RegistryNotaryCorsConfig {
-    #[serde(default)]
-    pub allowed_origins: Vec<String>,
-}
-
-#[derive(Debug, Clone, Default, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct EvidenceAuthConfig {
-    #[serde(default)]
-    pub api_keys: Vec<EvidenceCredentialConfig>,
-    #[serde(default)]
-    pub bearer_tokens: Vec<EvidenceCredentialConfig>,
-    #[serde(default)]
-    pub oidc: Option<EvidenceOidcAuthConfig>,
-    /// Trust anchor for Notary-minted access tokens (the pre-authorized-code
-    /// flow's second verifier). Disabled by default so existing configs load
-    /// unchanged.
-    #[serde(default)]
-    pub access_token_signing: AccessTokenSigningConfig,
-}
-
-/// Self-issued access-token signing configuration.
-///
-/// When `enabled`, the Notary mints its own access tokens (for the
-/// pre-authorized-code flow) signed with a dedicated `signing_keys` entry that
-/// MUST be distinct from any credential-signing key. The minted token's
-/// `iss`/`aud`/`typ`/alg pin the second verifier's trust anchor.
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct AccessTokenSigningConfig {
-    #[serde(default)]
-    pub enabled: bool,
-    /// Issuer (`iss`) the Notary stamps into its own access tokens.
-    #[serde(default)]
-    pub issuer: String,
-    /// Audiences (`aud`) accepted for Notary-minted access tokens.
-    #[serde(default)]
-    pub audiences: Vec<String>,
-    /// Allowed signing algorithms. Only EdDSA is supported.
-    #[serde(default = "default_access_token_signing_algorithms")]
-    pub allowed_algorithms: Vec<String>,
-    /// Header `typ` stamped into Notary access tokens, distinct from the
-    /// credential `typ` so a token cannot be replayed as another class.
-    #[serde(default = "default_access_token_typ")]
-    pub token_typ: String,
-    /// `evidence.signing_keys` entry used to sign access tokens. Must be a
-    /// dedicated key, never a credential-signing key.
-    #[serde(default)]
-    pub signing_key_id: String,
-    /// Additional publish-only `evidence.signing_keys` entries accepted for
-    /// verifying previously minted Notary access tokens and pre-authorized
-    /// codes during a governed key rotation.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub verification_key_ids: Vec<String>,
-    /// Access-token lifetime in seconds.
-    #[serde(default = "default_access_token_ttl_seconds")]
-    pub access_token_ttl_seconds: u64,
-}
-
-impl Default for AccessTokenSigningConfig {
-    fn default() -> Self {
-        Self {
-            enabled: false,
-            issuer: String::new(),
-            audiences: Vec::new(),
-            allowed_algorithms: default_access_token_signing_algorithms(),
-            token_typ: default_access_token_typ(),
-            signing_key_id: String::new(),
-            verification_key_ids: Vec::new(),
-            access_token_ttl_seconds: default_access_token_ttl_seconds(),
-        }
-    }
-}
-
-pub(super) fn default_access_token_signing_algorithms() -> Vec<String> {
-    vec![CREDENTIAL_SIGNING_ALG_EDDSA.to_string()]
-}
-
-pub(super) fn default_access_token_typ() -> String {
-    "registry-notary-access+jwt".to_string()
-}
-
-pub(super) const fn default_access_token_ttl_seconds() -> u64 {
-    300
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema, PartialEq, Eq)]
-#[serde(deny_unknown_fields)]
-pub struct EvidenceCredentialConfig {
-    pub id: String,
-    #[schemars(with = "schema::CredentialFingerprintSchema")]
-    pub fingerprint: CredentialFingerprintRef,
-    #[serde(default)]
-    pub scopes: Vec<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub authorization_details: Option<EvidenceAuthorizationDetails>,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct EvidenceOidcAuthConfig {
-    pub issuer: String,
-    pub jwks_url: String,
-    #[serde(default)]
-    pub userinfo_endpoint: Option<String>,
-    #[serde(default)]
-    pub userinfo_issuers: Vec<String>,
-    #[serde(default)]
-    pub audiences: Vec<String>,
-    #[serde(default)]
-    pub allowed_clients: Vec<String>,
-    #[serde(default = "default_oidc_allowed_algorithms")]
-    pub allowed_algorithms: Vec<String>,
-    #[serde(default = "default_oidc_allowed_token_types")]
-    pub allowed_token_types: Vec<String>,
-    #[serde(default = "default_oidc_scope_claim")]
-    pub scope_claim: String,
-    #[serde(default = "default_oidc_scope_separator")]
-    pub scope_separator: String,
-    #[serde(default)]
-    pub scope_map: BTreeMap<String, Vec<String>>,
-    #[serde(default = "default_oidc_principal_claim")]
-    pub principal_claim: String,
-    #[serde(default = "default_oidc_leeway", with = "humantime_serde")]
-    #[schemars(with = "schema::HumantimeDurationSchema")]
-    pub leeway: Duration,
-    #[serde(default)]
-    pub allow_insecure_localhost: bool,
-}
-
-pub(super) fn default_oidc_allowed_algorithms() -> Vec<String> {
-    vec![SD_JWT_VC_SIGNING_ALG.to_string()]
-}
-
-pub(super) fn default_oidc_allowed_token_types() -> Vec<String> {
-    vec!["JWT".to_string()]
-}
-
-pub(super) fn default_oidc_scope_claim() -> String {
-    "scope".to_string()
-}
-
-pub(super) fn default_oidc_scope_separator() -> String {
-    " ".to_string()
-}
-
-pub(super) fn default_oidc_principal_claim() -> String {
-    "sub".to_string()
-}
-
-pub(super) fn default_oidc_leeway() -> Duration {
-    Duration::from_secs(60)
-}
-
-impl EvidenceOidcAuthConfig {
-    pub(super) fn validate(&self) -> Result<(), EvidenceConfigError> {
-        if self.issuer.trim().is_empty() {
-            return Err(EvidenceConfigError::InvalidOidcConfig {
-                reason: "issuer must not be empty".to_string(),
-            });
-        }
-        if self.jwks_url.trim().is_empty() {
-            return Err(EvidenceConfigError::InvalidOidcConfig {
-                reason: "jwks_url must not be empty".to_string(),
-            });
-        }
-        validate_jwks_url_transport(&self.jwks_url, self.allow_insecure_localhost)?;
-        if let Some(userinfo_endpoint) = self.userinfo_endpoint.as_deref() {
-            if userinfo_endpoint.trim().is_empty() {
-                return Err(EvidenceConfigError::InvalidOidcConfig {
-                    reason: "userinfo_endpoint must not be empty when configured".to_string(),
-                });
-            }
-            validate_jwks_url_transport(userinfo_endpoint, self.allow_insecure_localhost)?;
-        }
-        validate_entries("auth.oidc.userinfo_issuers", &self.userinfo_issuers)?;
-        if self.audiences.is_empty() {
-            return Err(EvidenceConfigError::InvalidOidcConfig {
-                reason: "audiences must list at least one accepted audience".to_string(),
-            });
-        }
-        if self.scope_separator.chars().count() != 1 {
-            return Err(EvidenceConfigError::InvalidOidcConfig {
-                reason: "scope_separator must be exactly one character".to_string(),
-            });
-        }
-        if self.principal_claim.trim().is_empty() {
-            return Err(EvidenceConfigError::InvalidOidcConfig {
-                reason: "principal_claim must not be empty".to_string(),
-            });
-        }
-        Ok(())
-    }
-}
-
-pub(super) fn validate_jwks_url_transport(
-    jwks_url: &str,
-    allow_insecure_localhost: bool,
-) -> Result<(), EvidenceConfigError> {
-    let jwks_url = jwks_url.trim();
-    if jwks_url.starts_with("https://")
-        || (allow_insecure_localhost && is_insecure_localhost_url(jwks_url))
-    {
-        return Ok(());
-    }
-    Err(EvidenceConfigError::InvalidOidcConfig {
-        reason:
-            "jwks_url must use https unless allow_insecure_localhost permits an http localhost URL"
-                .to_string(),
-    })
-}
-
-pub(super) fn is_insecure_localhost_url(url: &str) -> bool {
-    let Some(rest) = url.strip_prefix("http://") else {
-        return false;
-    };
-    let authority = rest
-        .split(['/', '?', '#'])
-        .next()
-        .unwrap_or_default()
-        .rsplit('@')
-        .next()
-        .unwrap_or_default();
-    let host = if let Some(after_bracket) = authority.strip_prefix('[') {
-        after_bracket.split(']').next().unwrap_or_default()
-    } else {
-        authority.split(':').next().unwrap_or_default()
-    };
-    matches!(host, "localhost" | "127.0.0.1" | "::1")
-}
diff --git a/crates/registry-notary-core/src/config/cel.rs b/crates/registry-notary-core/src/config/cel.rs
deleted file mode 100644
index 991ebb3aa..000000000
--- a/crates/registry-notary-core/src/config/cel.rs
+++ /dev/null
@@ -1,157 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! CEL worker configuration.
-
-use super::*;
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct RegistryNotaryCelConfig {
-    #[serde(default = "default_cel_mode")]
-    pub mode: String,
-    #[serde(default = "default_cel_worker_count")]
-    pub worker_count: usize,
-    #[serde(default = "default_cel_eval_timeout_ms")]
-    pub eval_timeout_ms: u64,
-    #[serde(default)]
-    pub allow_regex: bool,
-    #[serde(default = "default_cel_max_expression_bytes")]
-    pub max_expression_bytes: usize,
-    #[serde(default = "default_cel_max_binding_json_bytes")]
-    pub max_binding_json_bytes: usize,
-    #[serde(default = "default_cel_max_result_json_bytes")]
-    pub max_result_json_bytes: usize,
-    #[serde(default = "default_cel_max_string_bytes")]
-    pub max_string_bytes: usize,
-    #[serde(default = "default_cel_max_list_items")]
-    pub max_list_items: usize,
-    #[serde(default = "default_cel_max_object_depth")]
-    pub max_object_depth: usize,
-    #[serde(default = "default_cel_max_object_keys")]
-    pub max_object_keys: usize,
-    #[serde(default = "default_cel_worker_memory_bytes")]
-    pub worker_memory_bytes: u64,
-    #[serde(default = "default_cel_worker_stderr_bytes")]
-    pub worker_stderr_bytes: usize,
-}
-
-impl Default for RegistryNotaryCelConfig {
-    fn default() -> Self {
-        Self {
-            mode: default_cel_mode(),
-            worker_count: default_cel_worker_count(),
-            eval_timeout_ms: default_cel_eval_timeout_ms(),
-            allow_regex: false,
-            max_expression_bytes: default_cel_max_expression_bytes(),
-            max_binding_json_bytes: default_cel_max_binding_json_bytes(),
-            max_result_json_bytes: default_cel_max_result_json_bytes(),
-            max_string_bytes: default_cel_max_string_bytes(),
-            max_list_items: default_cel_max_list_items(),
-            max_object_depth: default_cel_max_object_depth(),
-            max_object_keys: default_cel_max_object_keys(),
-            worker_memory_bytes: default_cel_worker_memory_bytes(),
-            worker_stderr_bytes: default_cel_worker_stderr_bytes(),
-        }
-    }
-}
-
-impl RegistryNotaryCelConfig {
-    pub(super) fn validate(&self) -> Result<(), EvidenceConfigError> {
-        if self.mode != "worker" && self.mode != "disabled" {
-            return invalid_cel("cel.mode must be worker or disabled");
-        }
-        if self.worker_count == 0 || self.worker_count > 16 {
-            return invalid_cel("cel.worker_count must be between 1 and 16");
-        }
-        if self.eval_timeout_ms == 0 || self.eval_timeout_ms > 30_000 {
-            return invalid_cel("cel.eval_timeout_ms must be between 1 and 30000");
-        }
-        if self.max_expression_bytes == 0 || self.max_expression_bytes > 256 * 1024 {
-            return invalid_cel("cel.max_expression_bytes must be between 1 and 262144");
-        }
-        if self.max_binding_json_bytes == 0 || self.max_binding_json_bytes > 1024 * 1024 {
-            return invalid_cel("cel.max_binding_json_bytes must be between 1 and 1048576");
-        }
-        if self.max_result_json_bytes == 0 || self.max_result_json_bytes > 1024 * 1024 {
-            return invalid_cel("cel.max_result_json_bytes must be between 1 and 1048576");
-        }
-        if self.max_string_bytes == 0 || self.max_string_bytes > 256 * 1024 {
-            return invalid_cel("cel.max_string_bytes must be between 1 and 262144");
-        }
-        if self.max_list_items == 0 || self.max_list_items > 100_000 {
-            return invalid_cel("cel.max_list_items must be between 1 and 100000");
-        }
-        if self.max_object_depth == 0 || self.max_object_depth > 64 {
-            return invalid_cel("cel.max_object_depth must be between 1 and 64");
-        }
-        if self.max_object_keys == 0 || self.max_object_keys > 2048 {
-            return invalid_cel("cel.max_object_keys must be between 1 and 2048");
-        }
-        if self.worker_memory_bytes < 32 * 1024 * 1024
-            || self.worker_memory_bytes > 1024 * 1024 * 1024
-        {
-            return invalid_cel("cel.worker_memory_bytes must be between 33554432 and 1073741824");
-        }
-        if self.worker_stderr_bytes == 0 || self.worker_stderr_bytes > 64 * 1024 {
-            return invalid_cel("cel.worker_stderr_bytes must be between 1 and 65536");
-        }
-        Ok(())
-    }
-}
-
-pub(super) fn registry_notary_cel_config_is_default(config: &RegistryNotaryCelConfig) -> bool {
-    config == &RegistryNotaryCelConfig::default()
-}
-
-pub(super) fn invalid_cel<T>(reason: impl Into<String>) -> Result<T, EvidenceConfigError> {
-    Err(EvidenceConfigError::InvalidCelConfig {
-        reason: reason.into(),
-    })
-}
-
-pub(super) fn default_cel_mode() -> String {
-    "worker".to_string()
-}
-
-pub(super) const fn default_cel_worker_count() -> usize {
-    2
-}
-
-pub(super) const fn default_cel_eval_timeout_ms() -> u64 {
-    2_000
-}
-
-pub(super) const fn default_cel_max_expression_bytes() -> usize {
-    8 * 1024
-}
-
-pub(super) const fn default_cel_max_binding_json_bytes() -> usize {
-    64 * 1024
-}
-
-pub(super) const fn default_cel_max_result_json_bytes() -> usize {
-    16 * 1024
-}
-
-pub(super) const fn default_cel_max_string_bytes() -> usize {
-    16 * 1024
-}
-
-pub(super) const fn default_cel_max_list_items() -> usize {
-    1024
-}
-
-pub(super) const fn default_cel_max_object_depth() -> usize {
-    16
-}
-
-pub(super) const fn default_cel_max_object_keys() -> usize {
-    256
-}
-
-pub(super) const fn default_cel_worker_memory_bytes() -> u64 {
-    128 * 1024 * 1024
-}
-
-pub(super) const fn default_cel_worker_stderr_bytes() -> usize {
-    1024
-}
diff --git a/crates/registry-notary-core/src/config/credential_status.rs b/crates/registry-notary-core/src/config/credential_status.rs
deleted file mode 100644
index fab4a0de1..000000000
--- a/crates/registry-notary-core/src/config/credential_status.rs
+++ /dev/null
@@ -1,88 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Credential status store configuration.
-
-use super::*;
-
-pub const CREDENTIAL_STATUS_VALID: &str = "valid";
-pub const CREDENTIAL_STATUS_SUSPENDED: &str = "suspended";
-pub const CREDENTIAL_STATUS_REVOKED: &str = "revoked";
-pub const CREDENTIAL_STATUS_EXPIRED: &str = "expired";
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct CredentialStatusConfig {
-    #[serde(default)]
-    pub enabled: bool,
-    #[serde(default)]
-    pub base_url: String,
-    #[serde(default = "default_credential_status_retention_seconds")]
-    pub retention_seconds: u64,
-}
-
-impl Default for CredentialStatusConfig {
-    fn default() -> Self {
-        Self {
-            enabled: false,
-            base_url: String::new(),
-            retention_seconds: default_credential_status_retention_seconds(),
-        }
-    }
-}
-
-impl CredentialStatusConfig {
-    pub(super) fn validate(&self) -> Result<(), EvidenceConfigError> {
-        if !self.enabled {
-            return Ok(());
-        }
-        validate_credential_status_http_url("credential_status.base_url", &self.base_url)?;
-        if self.retention_seconds == 0 {
-            return invalid_credential_status(
-                "credential_status.retention_seconds must be greater than zero",
-            );
-        }
-        Ok(())
-    }
-}
-
-pub(super) fn credential_status_config_is_default(config: &CredentialStatusConfig) -> bool {
-    config == &CredentialStatusConfig::default()
-}
-
-pub(super) const fn default_credential_status_retention_seconds() -> u64 {
-    86_400
-}
-
-pub(super) fn validate_credential_status_non_empty(
-    field: &str,
-    value: &str,
-) -> Result<(), EvidenceConfigError> {
-    if value.trim().is_empty() {
-        return invalid_credential_status(format!("{field} must not be empty"));
-    }
-    Ok(())
-}
-
-pub(super) fn validate_credential_status_http_url(
-    field: &str,
-    value: &str,
-) -> Result<(), EvidenceConfigError> {
-    validate_credential_status_non_empty(field, value)?;
-    let Some(rest) = value
-        .strip_prefix("https://")
-        .or_else(|| value.strip_prefix("http://"))
-    else {
-        return invalid_credential_status(format!("{field} must be an HTTP or HTTPS URL"));
-    };
-    let host = rest.split(['/', '?', '#']).next().unwrap_or_default();
-    if host.is_empty() || host.contains('@') {
-        return invalid_credential_status(format!("{field} must include a valid host"));
-    }
-    Ok(())
-}
-
-pub(super) fn invalid_credential_status<T>(
-    reason: impl Into<String>,
-) -> Result<T, EvidenceConfigError> {
-    Err(EvidenceConfigError::InvalidCredentialStatusConfig {
-        reason: reason.into(),
-    })
-}
diff --git a/crates/registry-notary-core/src/config/errors.rs b/crates/registry-notary-core/src/config/errors.rs
deleted file mode 100644
index 5d6e8a4a5..000000000
--- a/crates/registry-notary-core/src/config/errors.rs
+++ /dev/null
@@ -1,163 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Configuration validation errors.
-
-#[derive(Debug, thiserror::Error)]
-pub enum EvidenceConfigError {
-    #[error("evidence.enabled must be true for the standalone Registry Notary")]
-    EvidenceDisabled,
-    #[error("at least one API key, bearer token, or OIDC authenticator must be configured")]
-    NoCredentialsConfigured,
-    #[error("invalid auth config: {reason}")]
-    InvalidAuthConfig { reason: String },
-    #[error("invalid auth.oidc config: {reason}")]
-    InvalidOidcConfig { reason: String },
-    #[error("invalid subject_access config: {reason}")]
-    InvalidSubjectAccessConfig { reason: String },
-    #[error("invalid oid4vci config: {reason}")]
-    InvalidOid4vciConfig { reason: String },
-    #[error("invalid auth.access_token_signing config: {reason}")]
-    InvalidAccessTokenSigningConfig { reason: String },
-    #[error("invalid state config: {reason}")]
-    InvalidStateConfig { reason: String },
-    #[error("invalid credential status config: {reason}")]
-    InvalidCredentialStatusConfig { reason: String },
-    #[error("invalid cel config: {reason}")]
-    InvalidCelConfig { reason: String },
-    #[error("invalid federation config: {reason}")]
-    InvalidFederationConfig { reason: String },
-    #[error("invalid server config: {reason}")]
-    InvalidServerConfig { reason: String },
-    #[error("invalid config_trust config: {reason}")]
-    InvalidConfigTrustConfig { reason: String },
-    #[error("invalid deployment config: {reason}")]
-    InvalidDeploymentConfig { reason: String },
-    #[error(
-        "deployment.evidence.audit_ack_max_age_secs is set but deployment.evidence.audit_ack_cursor_path is not; a freshness window is meaningless with no cursor to read. Set audit_ack_cursor_path to the registry.audit.ack_cursor.v1 file the audit shipper maintains, or remove audit_ack_max_age_secs"
-    )]
-    AuditAckMaxAgeWithoutCursor,
-    #[error(
-        "deployment.evidence.audit_ack_cursor_path is set with a local file audit sink but deployment.evidence.audit_offhost_shipping is false; an ack cursor asserts observed off-host shipping that has not been declared. Set audit_offhost_shipping: true once shipping is in place, or remove audit_ack_cursor_path"
-    )]
-    AuditAckCursorWithoutShippingDeclared,
-    #[error("invalid evidence.relay config: {reason}")]
-    InvalidRelayConfig { reason: String },
-    #[error("invalid evidence.variables config: {reason}")]
-    InvalidRequestVariableConfig { reason: String },
-    #[error("claim id must not be empty")]
-    InvalidClaim,
-    /// REQ-DM-CLAIM-001 requires a claim's `id` to be unique across the
-    /// configuration; RS-DM-CLAIM Section 10 previously documented this as an
-    /// operator responsibility the loader did not enforce.
-    #[error("claim id '{claim}' is used by more than one claim; claim ids must be unique")]
-    DuplicateClaimId { claim: String },
-    #[error("claim '{claim}' has invalid semantics config: {reason}")]
-    InvalidClaimSemantics { claim: String, reason: String },
-    #[error("claim '{claim}' has invalid value config: {reason}")]
-    InvalidClaimValueConfig { claim: String, reason: String },
-    #[error("claim '{claim}' has invalid evidence_mode: {reason}")]
-    InvalidClaimEvidenceMode { claim: String, reason: String },
-    #[error("claim '{claim}' dependency closure exceeds v1 bounds ({nodes} nodes, {edges} edges)")]
-    ClaimDependencyGraphTooLarge {
-        claim: String,
-        nodes: usize,
-        edges: usize,
-    },
-    /// REQ-DM-CLAIM-008 requires a claim's `disclosure.default` to be a
-    /// member of `disclosure.allowed`; RS-DM-CLAIM Section 10 previously
-    /// documented this as unchecked at load, surfacing only when a result
-    /// was rendered.
-    #[error(
-        "claim '{claim}' disclosure.default '{default}' is not a member of \
-         disclosure.allowed ({allowed}); a claim's default disclosure mode must be one \
-         it is permitted to render",
-        allowed = allowed.join(", ")
-    )]
-    ClaimDisclosureDefaultNotAllowed {
-        claim: String,
-        default: String,
-        allowed: Vec<String>,
-    },
-    #[error(
-        "claim '{claim}' formats must not be empty; omit formats to use the default \
-         application/vnd.registry-notary.claim-result+json representation, or list one or more response formats"
-    )]
-    EmptyClaimFormats { claim: String },
-    #[error(
-        "claim '{claim}' formats must include the canonical evaluation response format \
-         application/vnd.registry-notary.claim-result+json; add it alongside any supported additional evaluation renderers"
-    )]
-    MissingCanonicalClaimFormat { claim: String },
-    #[error(
-        "claim '{claim}' has unsupported evaluation response format '{format}' in formats; \
-         supported formats are application/vnd.registry-notary.claim-result+json and \
-         application/ld+json; profile=\"cccev\". SD-JWT VC belongs in credential_profiles, not claim formats"
-    )]
-    UnsupportedClaimFormat { claim: String, format: String },
-    #[error("allowed purpose must not be empty")]
-    InvalidPurpose,
-    #[error("concurrency.subjects must be >= 1")]
-    InvalidConcurrency,
-    #[error("invalid evidence.machine_quota config: {reason}")]
-    InvalidMachineQuotaConfig { reason: String },
-    #[error("invalid evidence batch config: {reason}")]
-    InvalidBatchConfig { reason: String },
-    /// Credential holder binding only works with did:jwk because holder_jwk()
-    /// only implements did:jwk resolution. Restrict allowed_did_methods to
-    /// ["did:jwk"] or leave it empty when holder binding is disabled.
-    #[error(
-        "credential profile '{profile}': holder binding is only supported with did:jwk, \
-         but allowed_did_methods contains unsupported method(s): {methods}; \
-         restrict allowed_did_methods to [\"did:jwk\"]",
-        methods = methods.join(", ")
-    )]
-    UnsupportedCredentialProfileDidMethods {
-        profile: String,
-        methods: Vec<String>,
-    },
-    #[error("claim '{claim}' depends_on unknown claim '{unknown}'")]
-    DependsOnUnknownClaim { claim: String, unknown: String },
-    #[error(
-        "depends_on cycle detected: {cycle}",
-        cycle = cycle.join(" -> ")
-    )]
-    DependsOnCycle { cycle: Vec<String> },
-    /// A credential profile with an empty `allowed_claims` would short-circuit
-    /// the issuance-time claim filter (api.rs treats empty as "all claims
-    /// allowed"). Reject at load time so operators must explicitly enumerate
-    /// the claims a profile may bind to.
-    #[error(
-        "credential profile '{profile}': allowed_claims must list at least one \
-         claim; an empty list would permit any claim at issuance"
-    )]
-    EmptyAllowedClaims { profile: String },
-    #[error("invalid credential claim binding: {reason}")]
-    InvalidCredentialClaimBinding { reason: String },
-    /// Registry Notary currently issues only SD-JWT VC credentials using the
-    /// current `application/dc+sd-jwt` media type. Reject aliases and profile
-    /// labels so operator config cannot drift from the wire contract.
-    #[error(
-        "credential profile '{profile}': unsupported format '{format}'; \
-         supported credential format is application/dc+sd-jwt"
-    )]
-    UnsupportedCredentialProfileFormat { profile: String, format: String },
-    #[error("signing key '{key}' is invalid: {reason}")]
-    InvalidSigningKeyConfig { key: String, reason: String },
-    #[error("credential profile '{profile}' references unknown signing key '{key}'")]
-    UnknownCredentialProfileSigningKey { profile: String, key: String },
-    #[error("credential profile '{profile}' references non-active signing key '{key}'")]
-    CredentialProfileSigningKeyNotActive { profile: String, key: String },
-    #[error(
-        "credential profile '{profile}' validity_seconds {validity_seconds} must be between 1 and {max_validity_seconds}"
-    )]
-    InvalidCredentialProfileValidity {
-        profile: String,
-        validity_seconds: i64,
-        max_validity_seconds: u64,
-    },
-    #[error("credential profile '{profile}' issuer does not match signing key '{key}': {reason}")]
-    CredentialProfileSigningKeyIssuerMismatch {
-        profile: String,
-        key: String,
-        reason: String,
-    },
-}
diff --git a/crates/registry-notary-core/src/config/evidence/claims.rs b/crates/registry-notary-core/src/config/evidence/claims.rs
deleted file mode 100644
index 978e26432..000000000
--- a/crates/registry-notary-core/src/config/evidence/claims.rs
+++ /dev/null
@@ -1,1117 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Claim definitions, rules, and operation configuration.
-
-use std::borrow::Cow;
-
-use schemars::{Schema, SchemaGenerator};
-
-use super::*;
-
-pub const MAX_CLAIM_DEPENDENCY_NODES_V1: usize = 64;
-pub const MAX_CLAIM_DEPENDENCY_EDGES_V1: usize = 256;
-pub const MAX_CLAIM_VALUE_STRING_BYTES_V1: u32 = 64 * 1024;
-pub const MAX_RELAY_OUTPUT_SCHEMA_DEPTH_V1: usize = 8;
-pub const MAX_RELAY_OUTPUT_SCHEMA_NODES_V1: usize = 256;
-pub const MAX_RELAY_OUTPUT_EXPANDED_NODES_V1: usize = 4_096;
-pub const MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1: usize = 32;
-pub const MAX_RELAY_OUTPUT_ARRAY_ITEMS_V1: u16 = 256;
-pub const MAX_RELAY_OUTPUT_NAME_BYTES_V1: usize = 128;
-pub const MAX_RELAY_OUTPUT_VALUE_BYTES_V1: u32 = 64 * 1024;
-
-// The platform decoder wraps consultation outputs in the Relay result root and
-// its closed `outputs` object. The remaining fixed result fields consume 18
-// more nodes. Reserving all 20 fixed nodes here ensures an accepted authored
-// contract cannot fail later when the complete result decoder is compiled.
-const RELAY_OUTPUT_ROOT_DEPTH_V1: usize = 3;
-const RELAY_RESULT_ENVELOPE_NODES_V1: usize = 20;
-
-fn default_claim_formats() -> Vec<String> {
-    vec![FORMAT_CLAIM_RESULT_JSON.to_string()]
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct ClaimDefinition {
-    pub id: String,
-    pub title: String,
-    pub version: String,
-    pub subject_type: String,
-    /// Sealed registry provenance configuration. This field is intentionally
-    /// required so every claim names its compiler-pinned Relay consultation.
-    pub evidence_mode: ClaimEvidenceMode,
-    #[serde(default)]
-    pub value: ClaimValueConfig,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub semantics: Option<ClaimSemanticConfig>,
-    #[serde(default)]
-    pub inputs: Vec<ClaimInputConfig>,
-    #[serde(default)]
-    pub depends_on: Vec<String>,
-    #[serde(default)]
-    pub purpose: Option<String>,
-    /// Caller scopes checked before any registry consultation is dispatched.
-    #[serde(default)]
-    pub required_scopes: Vec<String>,
-    pub rule: RuleConfig,
-    #[serde(default)]
-    pub operations: ClaimOperationsConfig,
-    #[serde(default)]
-    pub disclosure: DisclosureConfig,
-    /// Omitting this field keeps existing authored claims renderable using the
-    /// canonical claim-result representation. An explicitly empty list is
-    /// rejected during configuration validation.
-    #[serde(default = "default_claim_formats")]
-    pub formats: Vec<String>,
-    #[serde(default)]
-    pub credential_profiles: Vec<String>,
-    #[serde(default)]
-    pub cccev: Option<CccevConfig>,
-    #[serde(default)]
-    pub oots: Option<OotsConfig>,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
-#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
-pub enum ClaimEvidenceMode {
-    RegistryBacked {
-        consultations: BTreeMap<String, RelayConsultationConfig>,
-    },
-    /// Uninhabited internal variant that keeps downstream destructuring
-    /// refutable without adding another wire-level evidence mode.
-    #[doc(hidden)]
-    #[serde(skip)]
-    Impossible {
-        impossible: std::convert::Infallible,
-    },
-}
-
-impl<'de> Deserialize<'de> for ClaimEvidenceMode {
-    fn deserialize<Deserializer>(deserializer: Deserializer) -> Result<Self, Deserializer::Error>
-    where
-        Deserializer: serde::Deserializer<'de>,
-    {
-        match SealedClaimEvidenceMode::deserialize(deserializer)? {
-            SealedClaimEvidenceMode::RegistryBacked { consultations } => {
-                Ok(Self::RegistryBacked { consultations })
-            }
-        }
-    }
-}
-
-/// The tagged configuration wire contract shared by deserialization and schema generation.
-#[derive(Deserialize, JsonSchema)]
-#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
-enum SealedClaimEvidenceMode {
-    RegistryBacked {
-        consultations: BTreeMap<String, RelayConsultationConfig>,
-    },
-}
-
-impl JsonSchema for ClaimEvidenceMode {
-    fn schema_name() -> Cow<'static, str> {
-        "ClaimEvidenceMode".into()
-    }
-
-    fn json_schema(generator: &mut SchemaGenerator) -> Schema {
-        generator.subschema_for::<SealedClaimEvidenceMode>()
-    }
-}
-
-impl ClaimEvidenceMode {
-    #[must_use]
-    pub const fn name(&self) -> &'static str {
-        match self {
-            Self::RegistryBacked { .. } => "registry_backed",
-            Self::Impossible { impossible } => match *impossible {},
-        }
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct RelayConsultationConfig {
-    pub profile: RelayConsultationProfileRef,
-    #[schemars(with = "BTreeMap<String, schema::RelayConsultationInputSchema>")]
-    pub inputs: BTreeMap<String, RelayConsultationInput>,
-    /// Complete closed public output schema expected from the pinned profile.
-    #[serde(default)]
-    pub outputs: BTreeMap<String, RelayOutputContract>,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct RelayConsultationProfileRef {
-    pub id: String,
-    pub contract_hash: String,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Deserialize, Serialize, JsonSchema)]
-#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
-pub enum RelayOutputContract {
-    Boolean {
-        #[serde(default)]
-        nullable: bool,
-    },
-    Integer {
-        #[serde(default)]
-        nullable: bool,
-        minimum: i64,
-        maximum: i64,
-    },
-    String {
-        #[serde(default)]
-        nullable: bool,
-        max_bytes: u32,
-    },
-    Date {
-        #[serde(default)]
-        nullable: bool,
-    },
-    Object {
-        #[serde(default)]
-        nullable: bool,
-        max_bytes: u32,
-        fields: BTreeMap<String, RelayOutputObjectFieldContract>,
-    },
-    Array {
-        #[serde(default)]
-        nullable: bool,
-        max_bytes: u32,
-        max_items: u16,
-        items: Box<RelayOutputContract>,
-    },
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct RelayOutputObjectFieldContract {
-    pub required: bool,
-    pub schema: Box<RelayOutputContract>,
-}
-
-impl RelayOutputContract {
-    #[must_use]
-    pub const fn nullable(&self) -> bool {
-        match self {
-            Self::Boolean { nullable }
-            | Self::Integer { nullable, .. }
-            | Self::String { nullable, .. }
-            | Self::Date { nullable }
-            | Self::Object { nullable, .. }
-            | Self::Array { nullable, .. } => *nullable,
-        }
-    }
-
-    #[must_use]
-    pub const fn value_type(&self) -> &'static str {
-        match self {
-            Self::Boolean { .. } => "boolean",
-            Self::Integer { .. } => "integer",
-            Self::String { .. } => "string",
-            Self::Date { .. } => "date",
-            Self::Object { .. } => "object",
-            Self::Array { .. } => "array",
-        }
-    }
-
-    #[must_use]
-    pub const fn is_scalar(&self) -> bool {
-        matches!(
-            self,
-            Self::Boolean { .. } | Self::Integer { .. } | Self::String { .. } | Self::Date { .. }
-        )
-    }
-
-    /// Validate one exact public Relay value without retaining a serialized
-    /// copy or exposing value-bearing error details.
-    #[must_use]
-    pub fn validates_value(&self, value: &serde_json::Value) -> bool {
-        if value.is_null() {
-            return self.nullable();
-        }
-        match (self, value) {
-            (Self::Boolean { .. }, serde_json::Value::Bool(_)) => true,
-            (
-                Self::Integer {
-                    minimum, maximum, ..
-                },
-                serde_json::Value::Number(value),
-            ) => exact_json_i64(value).is_some_and(|value| value >= *minimum && value <= *maximum),
-            (Self::String { max_bytes, .. }, serde_json::Value::String(value)) => {
-                value.len() <= *max_bytes as usize
-            }
-            (Self::Date { .. }, serde_json::Value::String(value)) => {
-                crate::is_rfc3339_full_date(value)
-            }
-            (
-                Self::Object {
-                    max_bytes, fields, ..
-                },
-                serde_json::Value::Object(value),
-            ) => {
-                serialized_value_fits(value, *max_bytes)
-                    && value.keys().all(|name| fields.contains_key(name))
-                    && fields.iter().all(|(name, field)| {
-                        value
-                            .get(name)
-                            .is_some_and(|value| field.schema.validates_value(value))
-                            || !field.required && !value.contains_key(name)
-                    })
-            }
-            (
-                Self::Array {
-                    max_bytes,
-                    max_items,
-                    items,
-                    ..
-                },
-                serde_json::Value::Array(value),
-            ) => {
-                value.len() <= usize::from(*max_items)
-                    && serialized_value_fits(value, *max_bytes)
-                    && value.iter().all(|value| items.validates_value(value))
-            }
-            _ => false,
-        }
-    }
-}
-
-fn exact_json_i64(value: &serde_json::Number) -> Option<i64> {
-    value
-        .as_i64()
-        .or_else(|| value.as_u64().and_then(|value| i64::try_from(value).ok()))
-}
-
-fn serialized_value_fits<T: ?Sized + Serialize>(value: &T, max_bytes: u32) -> bool {
-    struct ByteLimitWriter {
-        remaining: usize,
-    }
-
-    impl std::io::Write for ByteLimitWriter {
-        fn write(&mut self, bytes: &[u8]) -> std::io::Result<usize> {
-            if bytes.len() > self.remaining {
-                return Err(std::io::Error::other("serialized value exceeds its bound"));
-            }
-            self.remaining -= bytes.len();
-            Ok(bytes.len())
-        }
-
-        fn flush(&mut self) -> std::io::Result<()> {
-            Ok(())
-        }
-    }
-
-    serde_json::to_writer(
-        ByteLimitWriter {
-            remaining: max_bytes as usize,
-        },
-        value,
-    )
-    .is_ok()
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct RequestVariableConfig {
-    pub from: String,
-    #[serde(rename = "type")]
-    pub value_type: RequestVariableType,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(rename_all = "snake_case")]
-pub enum RequestVariableType {
-    Date,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum RelayConsultationInput {
-    TargetId,
-    TargetIdentifier(String),
-    TargetAttribute(String),
-    RequesterId,
-    RequesterIdentifier(String),
-}
-
-impl RelayConsultationInput {
-    #[must_use]
-    pub fn request_path(&self) -> &str {
-        match self {
-            Self::TargetId => "target.id",
-            Self::TargetIdentifier(path) => path,
-            Self::TargetAttribute(path) => path,
-            Self::RequesterId => "request.requester.id",
-            Self::RequesterIdentifier(path) => path,
-        }
-    }
-
-    #[must_use]
-    pub fn request_context_path(&self) -> &str {
-        self.request_path()
-            .strip_prefix("request.")
-            .unwrap_or(self.request_path())
-    }
-
-    #[must_use]
-    pub const fn is_requester_derived(&self) -> bool {
-        matches!(self, Self::RequesterId | Self::RequesterIdentifier(_))
-    }
-
-    #[must_use]
-    pub const fn is_target_derived(&self) -> bool {
-        matches!(
-            self,
-            Self::TargetId | Self::TargetIdentifier(_) | Self::TargetAttribute(_)
-        )
-    }
-
-    #[must_use]
-    pub const fn is_authenticated_target_identifier(&self) -> bool {
-        matches!(self, Self::TargetId | Self::TargetIdentifier(_))
-    }
-}
-
-impl Serialize for RelayConsultationInput {
-    fn serialize<Serializer>(
-        &self,
-        serializer: Serializer,
-    ) -> Result<Serializer::Ok, Serializer::Error>
-    where
-        Serializer: serde::Serializer,
-    {
-        serializer.serialize_str(self.request_path())
-    }
-}
-
-impl<'de> Deserialize<'de> for RelayConsultationInput {
-    fn deserialize<Deserializer>(deserializer: Deserializer) -> Result<Self, Deserializer::Error>
-    where
-        Deserializer: serde::Deserializer<'de>,
-    {
-        let mapping = String::deserialize(deserializer)?;
-        match mapping.as_str() {
-            "target.id" => Ok(Self::TargetId),
-            "request.requester.id" => Ok(Self::RequesterId),
-            _ if mapping
-                .strip_prefix("request.target.identifiers.")
-                .is_some_and(is_request_identifier_name) =>
-            {
-                Ok(Self::TargetIdentifier(mapping))
-            }
-            _ if mapping
-                .strip_prefix("request.target.attributes.")
-                .is_some_and(is_target_attribute_name) =>
-            {
-                Ok(Self::TargetAttribute(mapping))
-            }
-            _ if mapping
-                .strip_prefix("request.requester.identifiers.")
-                .is_some_and(is_request_identifier_name) =>
-            {
-                Ok(Self::RequesterIdentifier(mapping))
-            }
-            _ => Err(serde::de::Error::custom(
-                "unsupported consultation input mapping; v1 permits target.id, request.requester.id, request.target.identifiers.<stable-id>, request.target.attributes.<stable-name>, or request.requester.identifiers.<stable-id>",
-            )),
-        }
-    }
-}
-
-pub(in crate::config) fn validate_claim_evidence_mode(
-    claim: &ClaimDefinition,
-    relay_configured: bool,
-) -> Result<(), EvidenceConfigError> {
-    validate_claim_required_scopes(claim)?;
-    match &claim.evidence_mode {
-        ClaimEvidenceMode::RegistryBacked { consultations } => {
-            if !relay_configured {
-                return invalid_claim_evidence_mode(
-                    claim,
-                    "registry_backed requires evidence.relay",
-                );
-            }
-            if claim.purpose.as_deref().is_none_or(|purpose| {
-                purpose.is_empty()
-                    || purpose.len() > 256
-                    || purpose.contains(',')
-                    || purpose
-                        .chars()
-                        .any(|character| character.is_control() || character.is_whitespace())
-            }) {
-                return invalid_claim_evidence_mode(
-                    claim,
-                    "registry_backed requires one explicit bounded purpose token",
-                );
-            }
-            if claim.required_scopes.is_empty() {
-                return invalid_claim_evidence_mode(
-                    claim,
-                    "registry_backed requires required_scopes to contain at least one entry",
-                );
-            }
-            if consultations.len() != 1 {
-                return invalid_claim_evidence_mode(
-                    claim,
-                    "registry_backed requires exactly one named consultation in v1",
-                );
-            }
-            let (consultation_name, consultation) = consultations
-                .first_key_value()
-                .expect("exactly one consultation was checked above");
-            validate_consultation(claim, consultation_name, consultation)?;
-            match &claim.rule {
-                RuleConfig::ConsultationOutput {
-                    consultation: rule_consultation,
-                    output,
-                } => {
-                    if rule_consultation != consultation_name {
-                        return invalid_claim_evidence_mode(
-                            claim,
-                            "registry_backed consultation_output rule.consultation must match its consultation name",
-                        );
-                    }
-                    if !is_input_name(output) {
-                        return invalid_claim_evidence_mode(
-                            claim,
-                            "registry_backed consultation_output rule.output must be one top-level Relay output name",
-                        );
-                    }
-                    if let Some(output_config) = consultation.outputs.get(output) {
-                        if claim.value.value_type != output_config.value_type()
-                            || !claim.value.nullable
-                        {
-                            return invalid_claim_evidence_mode(
-                                claim,
-                                "registry_backed consultation_output claim value type must match its declared output and remain nullable for no_match",
-                            );
-                        }
-                    } else if consultation.outputs.is_empty() {
-                        if claim.value.value_type != "string" {
-                            return invalid_claim_evidence_mode(
-                                claim,
-                                "registry_backed consultation_output claim value.type must be string in v1 unless typed outputs are declared",
-                            );
-                        }
-                    } else {
-                        return invalid_claim_evidence_mode(
-                            claim,
-                            "registry_backed consultation_output rule.output must name a declared consultation output",
-                        );
-                    }
-                }
-                RuleConfig::ConsultationMatched {
-                    consultation: rule_consultation,
-                } => {
-                    if rule_consultation != consultation_name {
-                        return invalid_claim_evidence_mode(
-                            claim,
-                            "registry_backed consultation_matched rule.consultation must match its consultation name",
-                        );
-                    }
-                    if claim.value.value_type != "boolean" {
-                        return invalid_claim_evidence_mode(
-                            claim,
-                            "registry_backed consultation_matched claim value.type must be boolean",
-                        );
-                    }
-                }
-                RuleConfig::Cel { .. } => {
-                    if consultation.outputs.is_empty() {
-                        return invalid_claim_evidence_mode(
-                            claim,
-                            "registry_backed supports only consultation_matched and consultation_output rules in v1 unless a complete typed consultation output schema is declared",
-                        );
-                    }
-                    if !matches!(
-                        claim.value.value_type.as_str(),
-                        "boolean" | "integer" | "string" | "date"
-                    ) {
-                        return invalid_claim_evidence_mode(
-                            claim,
-                            "registry_backed CEL result type must be boolean, integer, string, or date; generic Number is not supported",
-                        );
-                    }
-                }
-            }
-        }
-        ClaimEvidenceMode::Impossible { impossible } => match *impossible {},
-    }
-    Ok(())
-}
-
-pub(in crate::config) fn validate_claim_value_config(
-    claim: &ClaimDefinition,
-) -> Result<(), EvidenceConfigError> {
-    let Some(max_bytes) = claim.value.max_bytes else {
-        return Ok(());
-    };
-    if claim.value.value_type != "string" {
-        return Err(EvidenceConfigError::InvalidClaimValueConfig {
-            claim: claim.id.clone(),
-            reason: "value.max_bytes is allowed only when value.type is string".to_string(),
-        });
-    }
-    if !(1..=MAX_CLAIM_VALUE_STRING_BYTES_V1).contains(&max_bytes) {
-        return Err(EvidenceConfigError::InvalidClaimValueConfig {
-            claim: claim.id.clone(),
-            reason: format!(
-                "value.max_bytes must be between 1 and {MAX_CLAIM_VALUE_STRING_BYTES_V1}"
-            ),
-        });
-    }
-    Ok(())
-}
-
-pub(in crate::config) fn validate_relay_activation_shape(
-    claims: &[ClaimDefinition],
-) -> Result<(), EvidenceConfigError> {
-    let mut outputs_by_client = BTreeMap::new();
-    for claim in claims {
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-            unreachable!("registry_backed is the only configured evidence mode");
-        };
-        let (_, consultation) = consultations
-            .first_key_value()
-            .expect("individual mode validation requires one consultation");
-        let input_name = consultation
-            .inputs
-            .first_key_value()
-            .expect("individual mode validation requires one input")
-            .0;
-        let client_key = (
-            consultation.profile.clone(),
-            claim
-                .purpose
-                .clone()
-                .expect("individual mode validation requires one purpose"),
-            input_name.clone(),
-        );
-        let legacy_output = consultation
-            .outputs
-            .is_empty()
-            .then(|| match &claim.rule {
-                RuleConfig::ConsultationOutput { output, .. } => Some(output.clone()),
-                RuleConfig::ConsultationMatched { .. } => None,
-                RuleConfig::Cel { .. } => None,
-            })
-            .flatten();
-        match outputs_by_client.get_mut(&client_key) {
-            Some((expected_outputs, expected_legacy_output))
-                if expected_outputs != &consultation.outputs =>
-            {
-                return invalid_claim_evidence_mode(
-                    claim,
-                    "claims sharing one Relay profile, purpose, and input name must declare one identical result contract",
-                );
-            }
-            Some((_, Some(expected)))
-                if legacy_output
-                    .as_ref()
-                    .is_some_and(|actual| actual != expected) =>
-            {
-                return invalid_claim_evidence_mode(
-                    claim,
-                    "legacy claims sharing one Relay profile, purpose, and input name must select one shared string output",
-                );
-            }
-            Some((_, expected @ None)) if legacy_output.is_some() => {
-                *expected = legacy_output;
-            }
-            None => {
-                outputs_by_client.insert(client_key, (consultation.outputs.clone(), legacy_output));
-            }
-            Some(_) => {}
-        }
-    }
-    Ok(())
-}
-
-pub(in crate::config) fn validate_claim_dependency_bounds(
-    claims: &[ClaimDefinition],
-) -> Result<(), EvidenceConfigError> {
-    if claims.len() > MAX_CLAIM_DEPENDENCY_NODES_V1 {
-        return Err(EvidenceConfigError::ClaimDependencyGraphTooLarge {
-            claim: "*".to_string(),
-            nodes: claims.len(),
-            edges: 0,
-        });
-    }
-    for root in claims {
-        let mut pending = vec![root.id.as_str()];
-        let mut visited = HashSet::new();
-        let mut edges = 0usize;
-        while let Some(claim_id) = pending.pop() {
-            if !visited.insert(claim_id) {
-                continue;
-            }
-            let Some(claim) = claims.iter().find(|candidate| candidate.id == claim_id) else {
-                continue;
-            };
-            edges = edges.saturating_add(claim.depends_on.len());
-            if visited.len() > MAX_CLAIM_DEPENDENCY_NODES_V1
-                || edges > MAX_CLAIM_DEPENDENCY_EDGES_V1
-            {
-                return Err(EvidenceConfigError::ClaimDependencyGraphTooLarge {
-                    claim: root.id.clone(),
-                    nodes: visited.len(),
-                    edges,
-                });
-            }
-            pending.extend(claim.depends_on.iter().map(String::as_str));
-        }
-    }
-    Ok(())
-}
-
-fn validate_claim_required_scopes(claim: &ClaimDefinition) -> Result<(), EvidenceConfigError> {
-    if claim.required_scopes.len() > 16 {
-        return invalid_claim_evidence_mode(
-            claim,
-            "required_scopes cannot contain more than 16 entries",
-        );
-    }
-    let mut seen = HashSet::new();
-    for scope in &claim.required_scopes {
-        if scope.is_empty()
-            || scope.len() > 128
-            || !scope
-                .bytes()
-                .all(|byte| matches!(byte, b'!' | b'#'..=b'[' | b']'..=b'~'))
-        {
-            return invalid_claim_evidence_mode(
-                claim,
-                "required_scopes entries must be bounded OAuth scope tokens",
-            );
-        }
-        if !seen.insert(scope.as_str()) {
-            return invalid_claim_evidence_mode(
-                claim,
-                "required_scopes must not contain duplicate entries",
-            );
-        }
-    }
-    Ok(())
-}
-
-fn validate_sha256_uri(value: &str) -> Result<(), &'static str> {
-    let Some(hex) = value.strip_prefix("sha256:") else {
-        return Err("must start with sha256:");
-    };
-    if hex.len() != 64 {
-        return Err("must contain 64 lowercase hex characters");
-    }
-    if !hex
-        .bytes()
-        .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
-    {
-        return Err("must contain only lowercase hex characters");
-    }
-    Ok(())
-}
-
-fn validate_consultation(
-    claim: &ClaimDefinition,
-    name: &str,
-    consultation: &RelayConsultationConfig,
-) -> Result<(), EvidenceConfigError> {
-    if !is_stable_id(name) {
-        return invalid_claim_evidence_mode(
-            claim,
-            "consultation names must use the bounded Relay stable-id grammar",
-        );
-    }
-    if !is_stable_id(&consultation.profile.id) {
-        return invalid_claim_evidence_mode(
-            claim,
-            "consultation profile.id must match [a-z][a-z0-9._-]{0,95}",
-        );
-    }
-    validate_sha256_uri(&consultation.profile.contract_hash).map_err(|reason| {
-        EvidenceConfigError::InvalidClaimEvidenceMode {
-            claim: claim.id.clone(),
-            reason: format!("consultation profile.contract_hash {reason}"),
-        }
-    })?;
-    if !(1..=16).contains(&consultation.inputs.len()) {
-        return invalid_claim_evidence_mode(
-            claim,
-            "consultation inputs must contain one to sixteen typed request mappings in v1",
-        );
-    }
-    let mut request_paths = BTreeSet::new();
-    for (input_name, input) in &consultation.inputs {
-        if !is_input_name(input_name) {
-            return invalid_claim_evidence_mode(
-                claim,
-                "consultation input names must match [a-z][a-z0-9_]{0,95}",
-            );
-        }
-        if !request_paths.insert(input.request_path()) {
-            return invalid_claim_evidence_mode(
-                claim,
-                "consultation inputs must map injectively to request context paths",
-            );
-        }
-    }
-    if !(1..=MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1).contains(&consultation.outputs.len()) {
-        return invalid_claim_evidence_mode(
-            claim,
-            "consultation outputs must contain one to 32 entries",
-        );
-    }
-    let mut schema_nodes = RELAY_RESULT_ENVELOPE_NODES_V1;
-    let mut expanded_nodes = RELAY_RESULT_ENVELOPE_NODES_V1;
-    for (output_name, output) in &consultation.outputs {
-        if !is_input_name(output_name) || matches!(output_name.as_str(), "matched" | "outcome") {
-            return invalid_claim_evidence_mode(
-                claim,
-                "consultation output names must match [a-z][a-z0-9_]{0,95} and cannot be matched or outcome",
-            );
-        }
-        let expanded = validate_relay_output_schema(
-            output,
-            RELAY_OUTPUT_ROOT_DEPTH_V1,
-            &mut schema_nodes,
-        )
-        .ok_or_else(|| EvidenceConfigError::InvalidClaimEvidenceMode {
-            claim: claim.id.clone(),
-            reason: "consultation output schema must be closed and remain within platform depth, field, item, node, name, numeric, and byte bounds".to_string(),
-        })?;
-        expanded_nodes = expanded_nodes.checked_add(expanded).ok_or_else(|| {
-            EvidenceConfigError::InvalidClaimEvidenceMode {
-                claim: claim.id.clone(),
-                reason: "consultation output schema exceeds the platform expanded-node bound"
-                    .to_string(),
-            }
-        })?;
-        if expanded_nodes > MAX_RELAY_OUTPUT_EXPANDED_NODES_V1 {
-            return invalid_claim_evidence_mode(
-                claim,
-                "consultation output schema exceeds the platform expanded-node bound",
-            );
-        }
-    }
-    Ok(())
-}
-
-fn validate_relay_output_schema(
-    schema: &RelayOutputContract,
-    depth: usize,
-    nodes: &mut usize,
-) -> Option<usize> {
-    *nodes = nodes.checked_add(1)?;
-    if depth > MAX_RELAY_OUTPUT_SCHEMA_DEPTH_V1 || *nodes > MAX_RELAY_OUTPUT_SCHEMA_NODES_V1 {
-        return None;
-    }
-    match schema {
-        RelayOutputContract::Boolean { .. } | RelayOutputContract::Date { .. } => Some(1),
-        RelayOutputContract::Integer {
-            minimum, maximum, ..
-        } if valid_json_integer_bounds(*minimum, *maximum) => Some(1),
-        RelayOutputContract::String { max_bytes, .. }
-            if (1..=MAX_RELAY_OUTPUT_VALUE_BYTES_V1).contains(max_bytes) =>
-        {
-            Some(1)
-        }
-        RelayOutputContract::Object {
-            max_bytes, fields, ..
-        } => {
-            if !(1..=MAX_RELAY_OUTPUT_VALUE_BYTES_V1).contains(max_bytes)
-                || !(1..=MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1).contains(&fields.len())
-            {
-                return None;
-            }
-            let mut expanded = 1_usize;
-            for (name, field) in fields {
-                if !valid_relay_output_name(name) {
-                    return None;
-                }
-                expanded = expanded.checked_add(validate_relay_output_schema(
-                    &field.schema,
-                    depth + 1,
-                    nodes,
-                )?)?;
-            }
-            Some(expanded)
-        }
-        RelayOutputContract::Array {
-            max_bytes,
-            max_items,
-            items,
-            ..
-        } => {
-            if !(1..=MAX_RELAY_OUTPUT_VALUE_BYTES_V1).contains(max_bytes)
-                || !(1..=MAX_RELAY_OUTPUT_ARRAY_ITEMS_V1).contains(max_items)
-            {
-                return None;
-            }
-            validate_relay_output_schema(items, depth + 1, nodes)?
-                .checked_mul(usize::from(*max_items))
-                .and_then(|expanded| expanded.checked_add(1))
-        }
-        RelayOutputContract::Integer { .. } | RelayOutputContract::String { .. } => None,
-    }
-}
-
-fn valid_json_integer_bounds(minimum: i64, maximum: i64) -> bool {
-    const MAX_SAFE_INTEGER: i64 = (1_i64 << 53) - 1;
-    minimum <= maximum && minimum >= -MAX_SAFE_INTEGER && maximum <= MAX_SAFE_INTEGER
-}
-
-fn valid_relay_output_name(value: &str) -> bool {
-    !value.is_empty()
-        && value.len() <= MAX_RELAY_OUTPUT_NAME_BYTES_V1
-        && !value.chars().any(char::is_control)
-}
-
-fn is_request_identifier_name(value: &str) -> bool {
-    let mut bytes = value.bytes();
-    matches!(bytes.next(), Some(b'A'..=b'Z' | b'a'..=b'z'))
-        && value.len() <= 96
-        && bytes.all(|byte| {
-            matches!(
-                byte,
-                b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'.' | b'-' | b'_'
-            )
-        })
-}
-
-fn is_target_attribute_name(value: &str) -> bool {
-    let mut bytes = value.bytes();
-    matches!(bytes.next(), Some(b'a'..=b'z'))
-        && value.len() <= 64
-        && bytes.all(|byte| matches!(byte, b'a'..=b'z' | b'0'..=b'9' | b'_'))
-}
-
-fn is_stable_id(value: &str) -> bool {
-    let mut bytes = value.bytes();
-    matches!(bytes.next(), Some(b'a'..=b'z'))
-        && value.len() <= 96
-        && bytes.all(|byte| matches!(byte, b'a'..=b'z' | b'0'..=b'9' | b'.' | b'-' | b'_'))
-}
-
-fn is_input_name(value: &str) -> bool {
-    let mut bytes = value.bytes();
-    matches!(bytes.next(), Some(b'a'..=b'z'))
-        && value.len() <= 96
-        && bytes.all(|byte| matches!(byte, b'a'..=b'z' | b'0'..=b'9' | b'_'))
-}
-
-fn invalid_claim_evidence_mode<T>(
-    claim: &ClaimDefinition,
-    reason: impl Into<String>,
-) -> Result<T, EvidenceConfigError> {
-    Err(EvidenceConfigError::InvalidClaimEvidenceMode {
-        claim: claim.id.clone(),
-        reason: reason.into(),
-    })
-}
-
-#[derive(Debug, Clone, Default, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct ClaimSemanticConfig {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub concept: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub property: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub vocabulary: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub predicate: Option<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub derived_from: Vec<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub value_mapping: Option<String>,
-}
-
-#[derive(Debug, Clone, Default, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct ClaimValueConfig {
-    #[serde(rename = "type", default)]
-    pub value_type: String,
-    #[serde(default, skip_serializing_if = "is_false")]
-    pub nullable: bool,
-    /// Optional evaluated UTF-8 string byte ceiling. Absence preserves the
-    /// direct-configuration behavior that predates per-claim byte bounds.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    #[schemars(range(min = 1, max = 65536))]
-    pub max_bytes: Option<u32>,
-    #[serde(default)]
-    pub unit: Option<String>,
-}
-
-fn is_false(value: &bool) -> bool {
-    !*value
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct ClaimInputConfig {
-    pub name: String,
-    #[serde(rename = "type")]
-    pub input_type: String,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema)]
-#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
-pub enum RuleConfig {
-    ConsultationOutput {
-        consultation: String,
-        output: String,
-    },
-    ConsultationMatched {
-        consultation: String,
-    },
-    Cel {
-        expression: String,
-    },
-}
-
-pub(in crate::config) fn validate_claim_semantics(
-    claim: &ClaimDefinition,
-) -> Result<(), EvidenceConfigError> {
-    let Some(semantics) = &claim.semantics else {
-        return Ok(());
-    };
-    let mut has_term = false;
-    for (field, value) in [
-        ("concept", semantics.concept.as_deref()),
-        ("property", semantics.property.as_deref()),
-        ("vocabulary", semantics.vocabulary.as_deref()),
-        ("predicate", semantics.predicate.as_deref()),
-    ] {
-        let Some(value) = value else {
-            continue;
-        };
-        has_term = true;
-        validate_semantic_reference(&claim.id, field, value)?;
-    }
-    for value in &semantics.derived_from {
-        has_term = true;
-        validate_semantic_reference(&claim.id, "derived_from", value)?;
-    }
-    if let Some(value_mapping) = semantics.value_mapping.as_deref() {
-        if value_mapping.trim().is_empty() {
-            return invalid_claim_semantics(&claim.id, "value_mapping must not be empty");
-        }
-    }
-    if !has_term {
-        return invalid_claim_semantics(
-            &claim.id,
-            "at least one of concept, property, vocabulary, predicate, or derived_from must be set",
-        );
-    }
-    if semantics.property.is_some() && semantics.predicate.is_some() {
-        return invalid_claim_semantics(
-            &claim.id,
-            "property and predicate are mutually exclusive; use derived_from for predicate inputs",
-        );
-    }
-    Ok(())
-}
-
-pub(in crate::config) fn validate_semantic_reference(
-    claim_id: &str,
-    field: &str,
-    value: &str,
-) -> Result<(), EvidenceConfigError> {
-    let value = value.trim();
-    if value.is_empty() {
-        return invalid_claim_semantics(claim_id, format!("{field} must not be empty"));
-    }
-    if value.starts_with("https://") || value.starts_with("http://") || value.starts_with("urn:") {
-        return Ok(());
-    }
-    invalid_claim_semantics(
-        claim_id,
-        format!("{field} must be an absolute http(s) URI or urn"),
-    )
-}
-
-pub(in crate::config) fn invalid_claim_semantics<T>(
-    claim: &str,
-    reason: impl Into<String>,
-) -> Result<T, EvidenceConfigError> {
-    Err(EvidenceConfigError::InvalidClaimSemantics {
-        claim: claim.to_string(),
-        reason: reason.into(),
-    })
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct ClaimOperationsConfig {
-    #[serde(default = "default_enabled_operation")]
-    pub evaluate: OperationConfig,
-    #[serde(default)]
-    pub batch_evaluate: BatchOperationConfig,
-}
-
-impl Default for ClaimOperationsConfig {
-    fn default() -> Self {
-        Self {
-            evaluate: OperationConfig { enabled: true },
-            batch_evaluate: BatchOperationConfig::default(),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct OperationConfig {
-    #[serde(default)]
-    pub enabled: bool,
-}
-
-pub(in crate::config) fn default_enabled_operation() -> OperationConfig {
-    OperationConfig { enabled: true }
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct BatchOperationConfig {
-    #[serde(default)]
-    pub enabled: bool,
-    #[serde(default = "default_inline_batch_limit")]
-    #[schemars(range(min = 1, max = 100))]
-    pub max_subjects: usize,
-}
-
-impl Default for BatchOperationConfig {
-    fn default() -> Self {
-        Self {
-            enabled: false,
-            max_subjects: default_inline_batch_limit(),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Default, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct CccevConfig {
-    #[serde(default)]
-    pub requirement_type: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub evidence_type: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub evidence_type_iri: Option<String>,
-}
-
-#[derive(Debug, Clone, Default, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct OotsConfig {
-    #[serde(default)]
-    pub enabled: bool,
-    #[serde(default)]
-    pub requirement: Option<String>,
-    #[serde(default)]
-    pub reference_framework: Option<String>,
-    #[serde(default)]
-    pub evidence_type_classification: Option<String>,
-    #[serde(default)]
-    pub evidence_type_list: Option<String>,
-    #[serde(default)]
-    pub languages: Vec<String>,
-    #[serde(default)]
-    pub authentication_level_of_assurance: Option<String>,
-}
diff --git a/crates/registry-notary-core/src/config/evidence/disclosure.rs b/crates/registry-notary-core/src/config/evidence/disclosure.rs
deleted file mode 100644
index f2ffd5ae2..000000000
--- a/crates/registry-notary-core/src/config/evidence/disclosure.rs
+++ /dev/null
@@ -1,44 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Claim and credential disclosure configuration.
-
-use super::*;
-
-#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct DisclosureConfig {
-    #[serde(default = "default_disclosure_profile")]
-    pub default: String,
-    #[serde(default = "default_disclosure_allowed")]
-    pub allowed: Vec<String>,
-    #[serde(default = "default_disclosure_downgrade")]
-    pub downgrade: String,
-}
-
-impl Default for DisclosureConfig {
-    fn default() -> Self {
-        Self {
-            default: default_disclosure_profile(),
-            allowed: default_disclosure_allowed(),
-            downgrade: default_disclosure_downgrade(),
-        }
-    }
-}
-
-pub(in crate::config) fn default_disclosure_profile() -> String {
-    "redacted".to_string()
-}
-
-pub(in crate::config) fn default_disclosure_allowed() -> Vec<String> {
-    vec!["redacted".to_string()]
-}
-
-pub(in crate::config) fn default_disclosure_downgrade() -> String {
-    "deny".to_string()
-}
-
-#[derive(Debug, Clone, Default, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct CredentialDisclosureConfig {
-    #[serde(default)]
-    pub allowed: Vec<String>,
-}
diff --git a/crates/registry-notary-core/src/config/evidence/limits.rs b/crates/registry-notary-core/src/config/evidence/limits.rs
deleted file mode 100644
index 4632f83df..000000000
--- a/crates/registry-notary-core/src/config/evidence/limits.rs
+++ /dev/null
@@ -1,67 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Evaluation concurrency and machine quota configuration.
-
-use super::*;
-
-/// Per-request cap on concurrently evaluated subjects.
-#[derive(Debug, Clone, Copy, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct ConcurrencyConfig {
-    #[serde(default = "default_concurrency_subjects")]
-    pub subjects: usize,
-}
-
-impl Default for ConcurrencyConfig {
-    fn default() -> Self {
-        Self {
-            subjects: default_concurrency_subjects(),
-        }
-    }
-}
-
-impl ConcurrencyConfig {
-    pub fn validate(&self) -> Result<(), EvidenceConfigError> {
-        if self.subjects < 1 {
-            return Err(EvidenceConfigError::InvalidConcurrency);
-        }
-        Ok(())
-    }
-}
-
-const fn default_concurrency_subjects() -> usize {
-    16
-}
-
-/// Per-principal quota for machine `evaluate`/`batch_evaluate` traffic.
-#[derive(Debug, Clone, Copy, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct MachineQuotaConfig {
-    #[serde(default)]
-    pub enabled: bool,
-    #[serde(default = "default_machine_quota_subjects_per_minute")]
-    pub subjects_per_minute: u32,
-}
-
-impl Default for MachineQuotaConfig {
-    fn default() -> Self {
-        Self {
-            enabled: false,
-            subjects_per_minute: default_machine_quota_subjects_per_minute(),
-        }
-    }
-}
-
-impl MachineQuotaConfig {
-    pub fn validate(&self) -> Result<(), EvidenceConfigError> {
-        if self.enabled && self.subjects_per_minute == 0 {
-            return Err(EvidenceConfigError::InvalidMachineQuotaConfig {
-                reason: "subjects_per_minute must be greater than zero when enabled".to_string(),
-            });
-        }
-        Ok(())
-    }
-}
-
-const fn default_machine_quota_subjects_per_minute() -> u32 {
-    6000
-}
diff --git a/crates/registry-notary-core/src/config/evidence/mod.rs b/crates/registry-notary-core/src/config/evidence/mod.rs
deleted file mode 100644
index bda2e3d08..000000000
--- a/crates/registry-notary-core/src/config/evidence/mod.rs
+++ /dev/null
@@ -1,195 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Evidence, source, claim, disclosure, and signing configuration.
-
-use super::*;
-
-mod claims;
-mod disclosure;
-mod limits;
-mod relay;
-mod signing;
-
-pub use claims::*;
-pub use disclosure::*;
-pub use limits::*;
-pub use relay::*;
-pub use signing::*;
-
-/// Hard 1.0 platform ceiling for synchronous batch evaluation members.
-///
-/// Operator settings may reduce this value, but never raise it.
-pub const MAX_BATCH_EVALUATION_MEMBERS_V1: usize = 100;
-
-/// Registry Notary configuration. Disabled by default so existing
-/// Registry Relay deployments load unchanged.
-#[derive(Debug, Clone, Default, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct EvidenceConfig {
-    #[serde(default)]
-    pub enabled: bool,
-    #[serde(default = "default_service_id")]
-    pub service_id: String,
-    #[serde(default = "default_api_version")]
-    pub api_version: String,
-    #[serde(default = "default_api_base_url")]
-    pub api_base_url: String,
-    #[serde(default = "default_claims_url")]
-    pub claims_url: String,
-    #[serde(default = "default_formats_url")]
-    pub formats_url: String,
-    #[serde(default = "default_inline_batch_limit")]
-    #[schemars(range(min = 1, max = 100))]
-    pub inline_batch_limit: usize,
-    #[serde(default = "default_max_credential_validity_seconds")]
-    pub max_credential_validity_seconds: u64,
-    #[serde(default)]
-    pub allowed_purposes: Vec<String>,
-    /// Closed union of request variables declared by authored services.
-    #[serde(default)]
-    pub variables: BTreeMap<String, RequestVariableConfig>,
-    #[serde(default)]
-    pub claims: Vec<ClaimDefinition>,
-    #[serde(default)]
-    pub signing_keys: BTreeMap<String, SigningKeyConfig>,
-    #[serde(default)]
-    pub credential_profiles: BTreeMap<String, CredentialProfileConfig>,
-    /// The one Registry Relay connection available to registry-backed claims.
-    /// Authentication remains a reloadable local file reference; core never
-    /// loads the bearer token value.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub relay: Option<RelayConnectionConfig>,
-    /// Per-request cap for concurrently evaluated subjects.
-    #[serde(default)]
-    pub concurrency: ConcurrencyConfig,
-    /// Per-principal budget for machine `evaluate`/`batch_evaluate` traffic,
-    /// counted in subjects (a single evaluate consumes 1; a batch consumes
-    /// `items.len()`) over a fixed one-minute window. Disabled by default.
-    #[serde(default)]
-    pub machine_quota: MachineQuotaConfig,
-}
-
-pub(in crate::config) const fn default_max_credential_validity_seconds() -> u64 {
-    600
-}
-
-impl EvidenceConfig {
-    pub(in crate::config) fn validate_batch_limits(&self) -> Result<(), EvidenceConfigError> {
-        if !(1..=MAX_BATCH_EVALUATION_MEMBERS_V1).contains(&self.inline_batch_limit) {
-            return Err(EvidenceConfigError::InvalidBatchConfig {
-                reason: format!(
-                    "evidence.inline_batch_limit must be between 1 and {MAX_BATCH_EVALUATION_MEMBERS_V1}"
-                ),
-            });
-        }
-        for claim in &self.claims {
-            let max_subjects = claim.operations.batch_evaluate.max_subjects;
-            if !(1..=MAX_BATCH_EVALUATION_MEMBERS_V1).contains(&max_subjects) {
-                return Err(EvidenceConfigError::InvalidBatchConfig {
-                    reason: format!(
-                        "claim '{}' operations.batch_evaluate.max_subjects must be between 1 and {MAX_BATCH_EVALUATION_MEMBERS_V1}",
-                        claim.id
-                    ),
-                });
-            }
-        }
-        Ok(())
-    }
-
-    pub(in crate::config) fn validate_signing_keys(&self) -> Result<(), EvidenceConfigError> {
-        let mut published_kids = HashSet::new();
-        for (key_id, key) in &self.signing_keys {
-            validate_signing_key_id(key_id)?;
-            key.validate(key_id)?;
-            if key.status.may_publish() && !published_kids.insert(key.kid.as_str()) {
-                return Err(EvidenceConfigError::InvalidSigningKeyConfig {
-                    key: key_id.clone(),
-                    reason: format!("duplicate published kid '{}'", key.kid),
-                });
-            }
-        }
-        Ok(())
-    }
-
-    /// Validate resolved signing-capable key material after runtime providers
-    /// have loaded their public JWKs. Static config can compare ids and kids,
-    /// but only the resolved JWKs reveal whether different active entries reuse
-    /// the same key material under different ids or kids.
-    ///
-    /// The reuse comparison is confined to the separated EdDSA signing roles
-    /// issue #173 names: the access-token signing key and every credential
-    /// profile signing key, plus the federation signing key (the documented
-    /// separation boundary in `validate_signing_key_alg_usage` treats all three
-    /// as distinct EdDSA roles). `reuse_scoped_key_ids` carries exactly those
-    /// role keys. The eSignet pre-authorized-code RP client key is a separate,
-    /// relaxed role that is deliberately allowed to share material with the
-    /// credential issuer key, so callers must leave it out of
-    /// `reuse_scoped_key_ids`; resolved JWKs for keys outside the set are not
-    /// compared.
-    pub fn validate_resolved_signing_key_material<'a, I>(
-        &self,
-        resolved_public_jwks: I,
-        reuse_scoped_key_ids: &HashSet<&str>,
-    ) -> Result<(), EvidenceConfigError>
-    where
-        I: IntoIterator<Item = (&'a str, &'a PublicJwk)>,
-    {
-        let mut thumbprints_by_key_id = BTreeMap::new();
-        for (key_id, public_jwk) in resolved_public_jwks {
-            let Some(key) = self.signing_keys.get(key_id) else {
-                return invalid_signing_key(
-                    key_id,
-                    "resolved public JWK does not match a configured signing key",
-                );
-            };
-            if !key.status.may_sign() {
-                continue;
-            }
-            // Only the separated signing roles (#173) are compared against one
-            // another; keys outside that set (notably the eSignet RP client
-            // key) are allowed to reuse credential material by design.
-            if !reuse_scoped_key_ids.contains(key_id) {
-                continue;
-            }
-            let thumbprint =
-                public_jwk
-                    .jkt()
-                    .map_err(|_| EvidenceConfigError::InvalidSigningKeyConfig {
-                        key: key_id.to_string(),
-                        reason: "resolved public JWK could not be thumbprinted".to_string(),
-                    })?;
-            if let Some(previous_key_id) =
-                thumbprints_by_key_id.insert(thumbprint, key_id.to_string())
-            {
-                return invalid_signing_key(
-                    key_id,
-                    format!("reuses public key material with signing key '{previous_key_id}'"),
-                );
-            }
-        }
-        Ok(())
-    }
-}
-
-pub(in crate::config) fn default_service_id() -> String {
-    "registry-notary".to_string()
-}
-
-pub(in crate::config) fn default_api_version() -> String {
-    "2026-05".to_string()
-}
-
-pub(in crate::config) fn default_api_base_url() -> String {
-    "/".to_string()
-}
-
-pub(in crate::config) fn default_claims_url() -> String {
-    "/v1/claims".to_string()
-}
-
-pub(in crate::config) fn default_formats_url() -> String {
-    "/v1/formats".to_string()
-}
-
-pub(in crate::config) const fn default_inline_batch_limit() -> usize {
-    MAX_BATCH_EVALUATION_MEMBERS_V1
-}
diff --git a/crates/registry-notary-core/src/config/evidence/relay.rs b/crates/registry-notary-core/src/config/evidence/relay.rs
deleted file mode 100644
index 859130269..000000000
--- a/crates/registry-notary-core/src/config/evidence/relay.rs
+++ /dev/null
@@ -1,296 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Sealed Registry Relay connection configuration.
-
-use std::collections::BTreeSet;
-use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
-use std::path::Path;
-
-use ipnet::IpNet;
-
-use super::*;
-
-const MAX_RELAY_BASE_URL_BYTES: usize = 2_048;
-const MAX_RELAY_TOKEN_FILE_BYTES: usize = 4_096;
-const MAX_RELAY_PRIVATE_CIDRS: usize = 16;
-const MAX_RELAY_IN_FLIGHT: usize = 64;
-
-const fn default_relay_max_in_flight() -> usize {
-    8
-}
-
-#[derive(Clone, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct RelayConnectionConfig {
-    pub base_url: String,
-    pub workload_client_id: String,
-    pub token_file: PathBuf,
-    /// Optional private root bundle for the exact HTTPS Relay destination.
-    ///
-    /// The deployment must provide a bounded regular file owned by root or
-    /// the Notary effective user, readable by its owner, and inaccessible to
-    /// group and other users (0400 or 0600).
-    #[serde(default)]
-    pub root_certificate_path: Option<PathBuf>,
-    #[serde(default)]
-    #[schemars(with = "Vec<schema::IpNetSchema>")]
-    pub allowed_private_cidrs: Vec<IpNet>,
-    #[serde(default)]
-    pub allow_insecure_localhost: bool,
-    /// Permit this signed Notary-to-Relay service hop to use application HTTP.
-    /// Runtime resolution remains confined to eligible private addresses.
-    #[serde(default)]
-    pub allow_insecure_private_network: bool,
-    #[serde(default = "default_relay_max_in_flight")]
-    pub max_in_flight: usize,
-}
-
-impl std::fmt::Debug for RelayConnectionConfig {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("RelayConnectionConfig")
-            .field("base_url", &"<redacted>")
-            .field("token_file", &"<redacted>")
-            .field(
-                "custom_root_certificate",
-                &self.root_certificate_path.is_some(),
-            )
-            .field(
-                "allowed_private_cidr_count",
-                &self.allowed_private_cidrs.len(),
-            )
-            .field("allow_insecure_localhost", &self.allow_insecure_localhost)
-            .field(
-                "allow_insecure_private_network",
-                &self.allow_insecure_private_network,
-            )
-            .field("max_in_flight", &self.max_in_flight)
-            .finish()
-    }
-}
-
-impl RelayConnectionConfig {
-    pub(in crate::config) fn validate(
-        &self,
-        deployment_profile: Option<crate::deployment::DeploymentProfile>,
-    ) -> Result<(), EvidenceConfigError> {
-        if self.base_url.is_empty()
-            || self.base_url.len() > MAX_RELAY_BASE_URL_BYTES
-            || self.base_url.trim() != self.base_url
-        {
-            return invalid_relay("base_url must be a non-empty URL of bounded length");
-        }
-        if !stable_workload_id(&self.workload_client_id) {
-            return invalid_relay(
-                "workload_client_id must be a stable lowercase workload identifier",
-            );
-        }
-        let Some(origin) = parse_relay_origin(&self.base_url) else {
-            return invalid_relay(
-                "base_url must be an absolute HTTP(S) origin with path exactly / and no credentials, query, or fragment",
-            );
-        };
-        validate_private_cidrs(&self.allowed_private_cidrs)?;
-        if self.allow_insecure_localhost && self.allow_insecure_private_network {
-            return invalid_relay(
-                "allow_insecure_localhost and allow_insecure_private_network are mutually exclusive",
-            );
-        }
-        if self.allow_insecure_private_network && origin.scheme() != "http" {
-            return invalid_relay("allow_insecure_private_network requires an HTTP base_url");
-        }
-        match origin.scheme() {
-            "https" => {}
-            "http" if self.allow_insecure_localhost && is_loopback_origin(&origin) => {}
-            "http"
-                if self.allow_insecure_private_network
-                    && matches!(origin.host(), Some(url::Host::Domain(_))) => {}
-            "http"
-                if deployment_profile == Some(crate::deployment::DeploymentProfile::Local)
-                    && private_origin_has_exact_allowlist_entry(
-                        &origin,
-                        &self.allowed_private_cidrs,
-                    ) => {}
-            "http" => {
-                return invalid_relay(
-                    "base_url must use https unless an explicit loopback, private service, or local exact-private-IP HTTP profile applies",
-                );
-            }
-            _ => return invalid_relay("base_url must use the http or https scheme"),
-        }
-        if !valid_token_file(&self.token_file) {
-            return invalid_relay("token_file must be a bounded absolute canonical file path");
-        }
-        if self
-            .root_certificate_path
-            .as_ref()
-            .is_some_and(|path| !valid_token_file(path))
-        {
-            return invalid_relay(
-                "root_certificate_path must be a bounded absolute canonical file path",
-            );
-        }
-        if self.root_certificate_path.is_some() && origin.scheme() != "https" {
-            return invalid_relay("root_certificate_path requires an https base_url");
-        }
-        if !(1..=MAX_RELAY_IN_FLIGHT).contains(&self.max_in_flight) {
-            return invalid_relay("max_in_flight must be between 1 and 64");
-        }
-        Ok(())
-    }
-
-    #[must_use]
-    pub fn uses_insecure_url(&self) -> bool {
-        self.base_url.starts_with("http://")
-    }
-
-    #[must_use]
-    pub fn uses_insecure_loopback_url(&self) -> bool {
-        parse_relay_origin(&self.base_url)
-            .is_some_and(|origin| origin.scheme() == "http" && is_loopback_origin(&origin))
-    }
-
-    #[must_use]
-    pub fn uses_insecure_private_network_url(&self) -> bool {
-        self.allow_insecure_private_network
-            && parse_relay_origin(&self.base_url).is_some_and(|origin| {
-                origin.scheme() == "http" && matches!(origin.host(), Some(url::Host::Domain(_)))
-            })
-    }
-}
-
-fn private_origin_has_exact_allowlist_entry(origin: &url::Url, cidrs: &[IpNet]) -> bool {
-    match origin.host() {
-        Some(url::Host::Ipv4(address)) => cidrs.iter().any(|cidr| {
-            matches!(cidr, IpNet::V4(cidr) if cidr.prefix_len() == 32 && cidr.network() == address)
-        }),
-        Some(url::Host::Ipv6(address)) => cidrs.iter().any(|cidr| {
-            matches!(cidr, IpNet::V6(cidr) if cidr.prefix_len() == 128 && cidr.network() == address)
-        }),
-        Some(url::Host::Domain(_)) | None => false,
-    }
-}
-
-fn stable_workload_id(value: &str) -> bool {
-    let mut bytes = value.bytes();
-    matches!(bytes.next(), Some(b'a'..=b'z'))
-        && value.len() <= 96
-        && bytes.all(|byte| matches!(byte, b'a'..=b'z' | b'0'..=b'9' | b'.' | b'_' | b'-'))
-}
-
-fn is_loopback_origin(origin: &url::Url) -> bool {
-    match origin.host() {
-        Some(url::Host::Ipv4(address)) => address.is_loopback(),
-        Some(url::Host::Ipv6(address)) => address.is_loopback(),
-        Some(url::Host::Domain(_)) | None => false,
-    }
-}
-
-fn parse_relay_origin(value: &str) -> Option<url::Url> {
-    let (scheme, rest) = value.split_once("://")?;
-    if !matches!(scheme, "http" | "https") || rest.is_empty() || rest.contains(['?', '#']) {
-        return None;
-    }
-    // Check the raw shape before URL normalization so `/private/..` cannot
-    // normalize into the accepted root origin.
-    let authority = rest.strip_suffix('/').unwrap_or(rest);
-    if authority.is_empty() || authority.contains('/') {
-        return None;
-    }
-    let origin = url::Url::parse(value).ok()?;
-    (!origin.cannot_be_a_base()
-        && origin.host().is_some()
-        && origin.port() != Some(0)
-        && origin.username().is_empty()
-        && origin.password().is_none()
-        && origin.path() == "/"
-        && origin.query().is_none()
-        && origin.fragment().is_none())
-    .then_some(origin)
-}
-
-fn valid_token_file(path: &Path) -> bool {
-    let Some(text) = path.to_str() else {
-        return false;
-    };
-    !text.is_empty()
-        && text.len() <= MAX_RELAY_TOKEN_FILE_BYTES
-        && text.starts_with('/')
-        && text != "/"
-        && !text.starts_with("//")
-        && !text.ends_with('/')
-        && !text.contains('\\')
-        && !text.bytes().any(|byte| byte.is_ascii_control())
-        && !text
-            .split('/')
-            .skip(1)
-            .any(|component| component.is_empty() || matches!(component, "." | ".."))
-}
-
-fn validate_private_cidrs(cidrs: &[IpNet]) -> Result<(), EvidenceConfigError> {
-    if cidrs.len() > MAX_RELAY_PRIVATE_CIDRS {
-        return invalid_relay("allowed_private_cidrs cannot contain more than 16 entries");
-    }
-    let mut seen = BTreeSet::new();
-    for cidr in cidrs {
-        if cidr.trunc() != *cidr
-            || !eligible_private_cidr(*cidr)
-            || metadata_singleton(*cidr)
-            || !seen.insert(*cidr)
-        {
-            return invalid_relay(
-                "allowed_private_cidrs must contain unique canonical RFC 1918, RFC 6598, or IPv6 ULA networks",
-            );
-        }
-    }
-    Ok(())
-}
-
-fn eligible_private_cidr(cidr: IpNet) -> bool {
-    match cidr {
-        IpNet::V4(cidr) => {
-            let address = cidr.network();
-            let prefix = cidr.prefix_len();
-            (prefix >= 8 && ipv4_in_prefix(address, Ipv4Addr::new(10, 0, 0, 0), 8))
-                || (prefix >= 12 && ipv4_in_prefix(address, Ipv4Addr::new(172, 16, 0, 0), 12))
-                || (prefix >= 16 && ipv4_in_prefix(address, Ipv4Addr::new(192, 168, 0, 0), 16))
-                || (prefix >= 10 && ipv4_in_prefix(address, Ipv4Addr::new(100, 64, 0, 0), 10))
-        }
-        IpNet::V6(cidr) => {
-            cidr.prefix_len() >= 7
-                && ipv6_in_prefix(
-                    cidr.network(),
-                    Ipv6Addr::new(0xfc00, 0, 0, 0, 0, 0, 0, 0),
-                    7,
-                )
-        }
-    }
-}
-
-fn ipv4_in_prefix(address: Ipv4Addr, network: Ipv4Addr, prefix: u8) -> bool {
-    let mask = u32::MAX << (32 - prefix);
-    u32::from(address) & mask == u32::from(network) & mask
-}
-
-fn ipv6_in_prefix(address: Ipv6Addr, network: Ipv6Addr, prefix: u8) -> bool {
-    let mask = u128::MAX << (128 - prefix);
-    u128::from(address) & mask == u128::from(network) & mask
-}
-
-fn metadata_singleton(cidr: IpNet) -> bool {
-    match cidr {
-        IpNet::V4(cidr) if cidr.prefix_len() == 32 => {
-            IpAddr::V4(cidr.network()) == IpAddr::V4(Ipv4Addr::new(100, 100, 100, 200))
-        }
-        IpNet::V6(cidr) if cidr.prefix_len() == 128 => {
-            IpAddr::V6(cidr.network())
-                == IpAddr::V6(Ipv6Addr::new(0xfd00, 0x0ec2, 0, 0, 0, 0, 0, 0x0254))
-        }
-        _ => false,
-    }
-}
-
-fn invalid_relay<T>(reason: &str) -> Result<T, EvidenceConfigError> {
-    Err(EvidenceConfigError::InvalidRelayConfig {
-        reason: reason.to_string(),
-    })
-}
diff --git a/crates/registry-notary-core/src/config/evidence/signing.rs b/crates/registry-notary-core/src/config/evidence/signing.rs
deleted file mode 100644
index f0768d97c..000000000
--- a/crates/registry-notary-core/src/config/evidence/signing.rs
+++ /dev/null
@@ -1,323 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Credential profile and signing-key configuration.
-
-use super::*;
-
-pub(in crate::config) fn validate_credential_profile_validity(
-    profile_id: &str,
-    profile: &CredentialProfileConfig,
-    max_validity_seconds: u64,
-) -> Result<(), EvidenceConfigError> {
-    if profile.validity_seconds <= 0 {
-        return Err(EvidenceConfigError::InvalidCredentialProfileValidity {
-            profile: profile_id.to_string(),
-            validity_seconds: profile.validity_seconds,
-            max_validity_seconds,
-        });
-    }
-    let validity_seconds = u64::try_from(profile.validity_seconds).map_err(|_| {
-        EvidenceConfigError::InvalidCredentialProfileValidity {
-            profile: profile_id.to_string(),
-            validity_seconds: profile.validity_seconds,
-            max_validity_seconds,
-        }
-    })?;
-    if validity_seconds > max_validity_seconds {
-        return Err(EvidenceConfigError::InvalidCredentialProfileValidity {
-            profile: profile_id.to_string(),
-            validity_seconds: profile.validity_seconds,
-            max_validity_seconds,
-        });
-    }
-    Ok(())
-}
-
-pub fn signing_provider_uses_local_software_custody(provider: SigningKeyProviderConfig) -> bool {
-    matches!(
-        provider,
-        SigningKeyProviderConfig::LocalJwkEnv
-            | SigningKeyProviderConfig::FileWatch
-            | SigningKeyProviderConfig::LocalPkcs12File
-    )
-}
-
-pub fn signing_key_uses_local_software_custody(key: &SigningKeyConfig) -> bool {
-    key.status.may_sign() && signing_provider_uses_local_software_custody(key.provider)
-}
-
-pub(in crate::config) fn validate_signing_key_id(key_id: &str) -> Result<(), EvidenceConfigError> {
-    if key_id.trim().is_empty() {
-        return Err(EvidenceConfigError::InvalidSigningKeyConfig {
-            key: key_id.to_string(),
-            reason: "signing key id must not be empty".to_string(),
-        });
-    }
-    Ok(())
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct CredentialProfileConfig {
-    pub format: String,
-    pub issuer: String,
-    pub signing_key: String,
-    pub vct: String,
-    #[serde(default = "default_credential_validity_seconds")]
-    pub validity_seconds: i64,
-    #[serde(default)]
-    pub holder_binding: HolderBindingConfig,
-    #[serde(default)]
-    pub allowed_claims: Vec<String>,
-    #[serde(default)]
-    pub disclosure: CredentialDisclosureConfig,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct SigningKeyConfig {
-    #[schemars(with = "schema::SigningKeyProviderSchema")]
-    pub provider: SigningKeyProviderConfig,
-    pub alg: String,
-    pub kid: String,
-    #[schemars(with = "schema::SigningKeyStatusSchema")]
-    pub status: SigningKeyStatus,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub publish_until_unix_seconds: Option<u64>,
-    #[serde(default)]
-    pub private_jwk_env: String,
-    #[serde(default)]
-    pub public_jwk_env: String,
-    #[serde(default)]
-    pub module_path: String,
-    #[serde(default)]
-    pub token_label: String,
-    #[serde(default)]
-    pub pin_env: String,
-    #[serde(default)]
-    pub key_label: String,
-    #[serde(default)]
-    pub key_id_hex: String,
-    #[serde(default)]
-    pub path: String,
-    #[serde(default)]
-    pub password_env: String,
-}
-
-impl SigningKeyConfig {
-    pub(super) fn validate(&self, key_id: &str) -> Result<(), EvidenceConfigError> {
-        validate_signing_key_non_empty(key_id, "alg", &self.alg)?;
-        if self.alg != CREDENTIAL_SIGNING_ALG_EDDSA
-            && self.alg != CREDENTIAL_SIGNING_ALG_ES256
-            && self.alg != CLIENT_ASSERTION_SIGNING_ALG_RS256
-        {
-            return invalid_signing_key(
-                key_id,
-                format!(
-                    "alg must be {CREDENTIAL_SIGNING_ALG_EDDSA}, {CREDENTIAL_SIGNING_ALG_ES256}, or {CLIENT_ASSERTION_SIGNING_ALG_RS256}"
-                ),
-            );
-        }
-        validate_signing_key_non_empty(key_id, "kid", &self.kid)?;
-        if self.publish_until_unix_seconds.is_some()
-            && !matches!(self.status, SigningKeyStatus::PublishOnly)
-        {
-            return invalid_signing_key(
-                key_id,
-                "publish_until_unix_seconds is valid only for publish_only signing keys",
-            );
-        }
-        match self.provider {
-            SigningKeyProviderConfig::LocalJwkEnv => {
-                if self.status.may_sign() {
-                    validate_signing_key_non_empty(
-                        key_id,
-                        "private_jwk_env",
-                        &self.private_jwk_env,
-                    )?;
-                }
-                if matches!(self.status, SigningKeyStatus::PublishOnly) {
-                    validate_signing_key_non_empty(key_id, "public_jwk_env", &self.public_jwk_env)?;
-                    validate_signing_key_absent(key_id, "private_jwk_env", &self.private_jwk_env)?;
-                }
-                validate_signing_key_absent(key_id, "module_path", &self.module_path)?;
-                validate_signing_key_absent(key_id, "token_label", &self.token_label)?;
-                validate_signing_key_absent(key_id, "pin_env", &self.pin_env)?;
-                validate_signing_key_absent(key_id, "key_label", &self.key_label)?;
-                validate_signing_key_absent(key_id, "key_id_hex", &self.key_id_hex)?;
-                validate_signing_key_absent(key_id, "path", &self.path)?;
-                validate_signing_key_absent(key_id, "password_env", &self.password_env)?;
-            }
-            SigningKeyProviderConfig::Pkcs11 => {
-                if self.alg != CREDENTIAL_SIGNING_ALG_EDDSA {
-                    return invalid_signing_key(key_id, "pkcs11 provider supports only EdDSA");
-                }
-                if self.status.may_publish() {
-                    validate_signing_key_non_empty(key_id, "public_jwk_env", &self.public_jwk_env)?;
-                }
-                if self.status.may_sign() {
-                    validate_signing_key_non_empty(key_id, "module_path", &self.module_path)?;
-                    if !std::path::Path::new(&self.module_path).is_absolute() {
-                        return invalid_signing_key(key_id, "module_path must be absolute");
-                    }
-                    validate_signing_key_non_empty(key_id, "token_label", &self.token_label)?;
-                    validate_signing_key_non_empty(key_id, "pin_env", &self.pin_env)?;
-                    validate_signing_key_non_empty(key_id, "key_label", &self.key_label)?;
-                    validate_signing_key_non_empty(key_id, "key_id_hex", &self.key_id_hex)?;
-                    if !self.key_id_hex.len().is_multiple_of(2)
-                        || !self.key_id_hex.chars().all(|ch| ch.is_ascii_hexdigit())
-                    {
-                        return invalid_signing_key(key_id, "key_id_hex must be even-length hex");
-                    }
-                }
-                if matches!(self.status, SigningKeyStatus::PublishOnly) {
-                    validate_signing_key_absent(key_id, "module_path", &self.module_path)?;
-                    validate_signing_key_absent(key_id, "token_label", &self.token_label)?;
-                    validate_signing_key_absent(key_id, "pin_env", &self.pin_env)?;
-                    validate_signing_key_absent(key_id, "key_label", &self.key_label)?;
-                    validate_signing_key_absent(key_id, "key_id_hex", &self.key_id_hex)?;
-                }
-                validate_signing_key_absent(key_id, "private_jwk_env", &self.private_jwk_env)?;
-                validate_signing_key_absent(key_id, "path", &self.path)?;
-                validate_signing_key_absent(key_id, "password_env", &self.password_env)?;
-            }
-            SigningKeyProviderConfig::FileWatch => {
-                if matches!(self.status, SigningKeyStatus::PublishOnly) {
-                    return invalid_signing_key(
-                        key_id,
-                        "file_watch provider supports only active or disabled signing keys",
-                    );
-                }
-                if self.status.may_sign() {
-                    validate_signing_key_non_empty(key_id, "path", &self.path)?;
-                }
-                validate_signing_key_absent(key_id, "private_jwk_env", &self.private_jwk_env)?;
-                validate_signing_key_absent(key_id, "public_jwk_env", &self.public_jwk_env)?;
-                validate_signing_key_absent(key_id, "module_path", &self.module_path)?;
-                validate_signing_key_absent(key_id, "token_label", &self.token_label)?;
-                validate_signing_key_absent(key_id, "pin_env", &self.pin_env)?;
-                validate_signing_key_absent(key_id, "key_label", &self.key_label)?;
-                validate_signing_key_absent(key_id, "key_id_hex", &self.key_id_hex)?;
-                validate_signing_key_absent(key_id, "password_env", &self.password_env)?;
-            }
-            SigningKeyProviderConfig::LocalPkcs12File => {
-                invalid_signing_key(
-                    key_id,
-                    "local_pkcs12_file provider is intentionally not implemented yet",
-                )?;
-            }
-            _ => {
-                invalid_signing_key(key_id, "signing key provider is unsupported by this Notary")?;
-            }
-        }
-        Ok(())
-    }
-
-    pub fn may_publish_at(&self, now_unix_seconds: u64) -> bool {
-        if !self.status.may_publish() {
-            return false;
-        }
-        self.publish_until_unix_seconds
-            .is_none_or(|publish_until| now_unix_seconds <= publish_until)
-    }
-}
-
-pub(in crate::config) fn validate_signing_key_non_empty(
-    key_id: &str,
-    field: &str,
-    value: &str,
-) -> Result<(), EvidenceConfigError> {
-    if value.trim().is_empty() {
-        return invalid_signing_key(key_id, format!("{field} must not be empty"));
-    }
-    Ok(())
-}
-
-pub(in crate::config) fn validate_signing_key_absent(
-    key_id: &str,
-    field: &str,
-    value: &str,
-) -> Result<(), EvidenceConfigError> {
-    if !value.trim().is_empty() {
-        return invalid_signing_key(
-            key_id,
-            format!("{field} is not valid for this signing key provider"),
-        );
-    }
-    Ok(())
-}
-
-pub(in crate::config) fn invalid_signing_key<T>(
-    key_id: &str,
-    reason: impl Into<String>,
-) -> Result<T, EvidenceConfigError> {
-    Err(EvidenceConfigError::InvalidSigningKeyConfig {
-        key: key_id.to_string(),
-        reason: reason.into(),
-    })
-}
-
-pub(in crate::config) fn validate_profile_signing_key_issuer_binding(
-    profile_id: &str,
-    profile: &CredentialProfileConfig,
-    key: &SigningKeyConfig,
-) -> Result<(), EvidenceConfigError> {
-    if let Some(kid_did) = key
-        .kid
-        .split('#')
-        .next()
-        .filter(|did| did.starts_with("did:web:"))
-    {
-        if profile.issuer.starts_with("did:web:") && profile.issuer != kid_did {
-            return Err(
-                EvidenceConfigError::CredentialProfileSigningKeyIssuerMismatch {
-                    profile: profile_id.to_string(),
-                    key: profile.signing_key.clone(),
-                    reason: "did:web issuer must match signing key kid DID".to_string(),
-                },
-            );
-        }
-        if profile.issuer.starts_with("https://") {
-            validate_did_web_https_issuer_binding(kid_did, &profile.issuer).map_err(|error| {
-                EvidenceConfigError::CredentialProfileSigningKeyIssuerMismatch {
-                    profile: profile_id.to_string(),
-                    key: profile.signing_key.clone(),
-                    reason: error.to_string(),
-                }
-            })?;
-        }
-    }
-    Ok(())
-}
-
-pub(in crate::config) const fn default_credential_validity_seconds() -> i64 {
-    600
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct HolderBindingConfig {
-    #[serde(default = "default_holder_binding_mode")]
-    pub mode: String,
-    #[serde(default)]
-    pub proof_of_possession: Option<String>,
-    #[serde(default = "default_holder_binding_allowed_did_methods")]
-    pub allowed_did_methods: Vec<String>,
-}
-
-impl Default for HolderBindingConfig {
-    fn default() -> Self {
-        Self {
-            mode: default_holder_binding_mode(),
-            proof_of_possession: None,
-            allowed_did_methods: default_holder_binding_allowed_did_methods(),
-        }
-    }
-}
-
-pub(in crate::config) fn default_holder_binding_mode() -> String {
-    "did".to_string()
-}
-
-pub(in crate::config) fn default_holder_binding_allowed_did_methods() -> Vec<String> {
-    vec![SD_JWT_VC_HOLDER_BINDING_METHOD.to_string()]
-}
diff --git a/crates/registry-notary-core/src/config/federation.rs b/crates/registry-notary-core/src/config/federation.rs
deleted file mode 100644
index 70375a07c..000000000
--- a/crates/registry-notary-core/src/config/federation.rs
+++ /dev/null
@@ -1,469 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Federated evaluation configuration.
-
-use super::*;
-
-pub const FEDERATION_PROTOCOL_V0_1: &str = "registry-notary-federation/v0.1";
-pub const FEDERATION_REQUEST_JWT_TYP: &str = "registry-notary-request+jwt";
-pub const FEDERATION_RESPONSE_JWT_TYP: &str = "registry-notary-response+jwt";
-pub const FEDERATION_SIGNING_ALG_EDDSA: &str = "EdDSA";
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct FederationConfig {
-    #[serde(default)]
-    pub enabled: bool,
-    #[serde(default)]
-    pub node_id: String,
-    #[serde(default)]
-    pub issuer: String,
-    #[serde(default)]
-    pub jwks_uri: String,
-    #[serde(default)]
-    pub federation_api: String,
-    #[serde(default)]
-    pub supported_protocol_versions: Vec<String>,
-    #[serde(default = "default_federation_inbound_body_limit_bytes")]
-    pub inbound_body_limit_bytes: usize,
-    #[serde(default = "default_federation_max_request_lifetime_seconds")]
-    pub max_request_lifetime_seconds: u64,
-    #[serde(default = "default_federation_clock_leeway_seconds")]
-    pub clock_leeway_seconds: u64,
-    #[serde(default)]
-    pub signing: FederationSigningConfig,
-    #[serde(default)]
-    pub pairwise_subject_hash: FederationPairwiseSubjectHashConfig,
-    #[serde(default)]
-    pub response_shaping: FederationResponseShapingConfig,
-    #[serde(default)]
-    pub emergency_denylist: FederationEmergencyDenylistConfig,
-    #[serde(default)]
-    pub peers: Vec<FederationPeerConfig>,
-    #[serde(default)]
-    pub evaluation_profiles: Vec<FederationEvaluationProfileConfig>,
-}
-
-impl Default for FederationConfig {
-    fn default() -> Self {
-        Self {
-            enabled: false,
-            node_id: String::new(),
-            issuer: String::new(),
-            jwks_uri: String::new(),
-            federation_api: String::new(),
-            supported_protocol_versions: Vec::new(),
-            inbound_body_limit_bytes: default_federation_inbound_body_limit_bytes(),
-            max_request_lifetime_seconds: default_federation_max_request_lifetime_seconds(),
-            clock_leeway_seconds: default_federation_clock_leeway_seconds(),
-            signing: FederationSigningConfig::default(),
-            pairwise_subject_hash: FederationPairwiseSubjectHashConfig::default(),
-            response_shaping: FederationResponseShapingConfig::default(),
-            emergency_denylist: FederationEmergencyDenylistConfig::default(),
-            peers: Vec::new(),
-            evaluation_profiles: Vec::new(),
-        }
-    }
-}
-
-pub(super) fn federation_config_is_default(config: &FederationConfig) -> bool {
-    config == &FederationConfig::default()
-}
-
-pub(super) const fn default_federation_inbound_body_limit_bytes() -> usize {
-    16 * 1024
-}
-
-pub(super) const fn default_federation_max_request_lifetime_seconds() -> u64 {
-    300
-}
-
-pub(super) const fn default_federation_clock_leeway_seconds() -> u64 {
-    60
-}
-
-impl FederationConfig {
-    pub(super) fn validate(&self, evidence: &EvidenceConfig) -> Result<(), EvidenceConfigError> {
-        if !self.enabled {
-            return Ok(());
-        }
-        validate_federation_non_empty("federation.node_id", &self.node_id)?;
-        validate_federation_non_empty("federation.issuer", &self.issuer)?;
-        validate_federation_https_url("federation.issuer", &self.issuer)?;
-        validate_federation_https_url("federation.jwks_uri", &self.jwks_uri)?;
-        validate_federation_https_url("federation.federation_api", &self.federation_api)?;
-        validate_did_web_https_issuer_binding(&self.node_id, &self.issuer).map_err(|error| {
-            EvidenceConfigError::InvalidFederationConfig {
-                reason: format!("federation.node_id must bind to federation.issuer: {error}"),
-            }
-        })?;
-        if !self
-            .supported_protocol_versions
-            .iter()
-            .any(|version| version == FEDERATION_PROTOCOL_V0_1)
-        {
-            return invalid_federation("federation.supported_protocol_versions must include registry-notary-federation/v0.1");
-        }
-        if self.inbound_body_limit_bytes == 0 {
-            return invalid_federation(
-                "federation.inbound_body_limit_bytes must be greater than zero",
-            );
-        }
-        if self.max_request_lifetime_seconds == 0 {
-            return invalid_federation(
-                "federation.max_request_lifetime_seconds must be greater than zero",
-            );
-        }
-        validate_federation_non_empty("federation.signing.signing_key", &self.signing.signing_key)?;
-        let signing_key = evidence
-            .signing_keys
-            .get(self.signing.signing_key.as_str())
-            .ok_or_else(|| EvidenceConfigError::InvalidFederationConfig {
-                reason: format!(
-                    "federation.signing.signing_key references unknown signing key '{}'",
-                    self.signing.signing_key
-                ),
-            })?;
-        if !signing_key.status.may_sign() {
-            return invalid_federation(
-                "federation.signing.signing_key must reference an active signing key",
-            );
-        }
-        validate_federation_non_empty(
-            "federation.pairwise_subject_hash.secret_env",
-            &self.pairwise_subject_hash.secret_env,
-        )?;
-        if self.peers.is_empty() {
-            return invalid_federation("federation.peers must list at least one peer");
-        }
-        if self.evaluation_profiles.is_empty() {
-            return invalid_federation(
-                "federation.evaluation_profiles must list at least one profile",
-            );
-        }
-        let mut profile_ids = HashSet::new();
-        for profile in &self.evaluation_profiles {
-            validate_federation_non_empty("federation.evaluation_profiles[].id", &profile.id)?;
-            if !profile_ids.insert(profile.id.as_str()) {
-                return invalid_federation("federation.evaluation_profiles contains duplicate id");
-            }
-            validate_federation_non_empty(
-                "federation.evaluation_profiles[].ruleset",
-                &profile.ruleset,
-            )?;
-            validate_federation_non_empty(
-                "federation.evaluation_profiles[].claim_id",
-                &profile.claim_id,
-            )?;
-            validate_federation_non_empty(
-                "federation.evaluation_profiles[].subject_id_type",
-                &profile.subject_id_type,
-            )?;
-            let claim = evidence
-                .claims
-                .iter()
-                .find(|claim| claim.id == profile.claim_id)
-                .ok_or_else(|| EvidenceConfigError::InvalidFederationConfig {
-                    reason:
-                        "federation.evaluation_profiles[].claim_id must reference an evidence claim"
-                            .to_string(),
-                })?;
-            validate_federation_claim_inputs(evidence, profile, claim)?;
-            if let Some(disclosure) = profile.disclosure.as_deref() {
-                if DisclosureProfile::parse(disclosure).is_none() {
-                    return invalid_federation(
-                        "federation.evaluation_profiles[].disclosure must be value, predicate, or redacted",
-                    );
-                }
-            }
-        }
-        let mut peer_nodes = HashSet::new();
-        for peer in &self.peers {
-            validate_federation_non_empty("federation.peers[].node_id", &peer.node_id)?;
-            validate_federation_non_empty("federation.peers[].issuer", &peer.issuer)?;
-            validate_federation_https_url("federation.peers[].issuer", &peer.issuer)?;
-            if peer.allow_insecure_private_network {
-                validate_federation_http_or_https_url(
-                    "federation.peers[].jwks_uri",
-                    &peer.jwks_uri,
-                )?;
-            } else if peer.allow_insecure_localhost {
-                validate_federation_localhost_or_https_url(
-                    "federation.peers[].jwks_uri",
-                    &peer.jwks_uri,
-                )?;
-            } else {
-                validate_federation_https_url("federation.peers[].jwks_uri", &peer.jwks_uri)?;
-            }
-            validate_did_web_https_issuer_binding(&peer.node_id, &peer.issuer).map_err(
-                |error| EvidenceConfigError::InvalidFederationConfig {
-                    reason: format!("federation.peers[].node_id must bind to issuer: {error}"),
-                },
-            )?;
-            if !peer_nodes.insert(peer.node_id.as_str()) {
-                return invalid_federation("federation.peers contains duplicate node_id");
-            }
-            if !peer
-                .allowed_protocol_versions
-                .iter()
-                .any(|version| version == FEDERATION_PROTOCOL_V0_1)
-            {
-                return invalid_federation(
-                    "federation.peers[].allowed_protocol_versions must include registry-notary-federation/v0.1",
-                );
-            }
-            for purpose in &peer.allowed_purposes {
-                validate_federation_https_url("federation.peers[].allowed_purposes[]", purpose)?;
-            }
-            for profile in &peer.allowed_profiles {
-                let profile_config = self
-                    .evaluation_profiles
-                    .iter()
-                    .find(|candidate| candidate.id == profile.as_str())
-                    .ok_or_else(|| EvidenceConfigError::InvalidFederationConfig {
-                        reason: "federation.peers[].allowed_profiles must reference an evaluation profile"
-                            .to_string(),
-                    })?;
-                validate_federation_peer_profile_scopes(evidence, peer, profile_config)?;
-            }
-        }
-        Ok(())
-    }
-}
-
-fn validate_federation_claim_inputs(
-    evidence: &EvidenceConfig,
-    profile: &FederationEvaluationProfileConfig,
-    root: &ClaimDefinition,
-) -> Result<(), EvidenceConfigError> {
-    let expected_path = format!("request.target.identifiers.{}", profile.subject_id_type);
-    let mut pending = vec![root.id.as_str()];
-    let mut visited = HashSet::new();
-    while let Some(claim_id) = pending.pop() {
-        if !visited.insert(claim_id) {
-            continue;
-        }
-        let claim = evidence
-            .claims
-            .iter()
-            .find(|candidate| candidate.id == claim_id)
-            .ok_or_else(|| EvidenceConfigError::InvalidFederationConfig {
-                reason: format!(
-                    "federation evaluation profile '{}' references an incomplete claim dependency closure",
-                    profile.id
-                ),
-            })?;
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-            return invalid_federation(format!(
-                "federation evaluation profile '{}' must select only registry_backed claims",
-                profile.id
-            ));
-        };
-        if consultations
-            .values()
-            .flat_map(|consultation| consultation.inputs.values())
-            .any(|input| {
-                !matches!(
-                    input,
-                    RelayConsultationInput::TargetIdentifier(path) if path == &expected_path
-                )
-            })
-        {
-            return invalid_federation(format!(
-                "federation evaluation profile '{}' claim '{}' Relay inputs must derive from {}",
-                profile.id, claim.id, expected_path
-            ));
-        }
-        pending.extend(claim.depends_on.iter().map(String::as_str));
-    }
-    Ok(())
-}
-
-fn validate_federation_peer_profile_scopes(
-    evidence: &EvidenceConfig,
-    peer: &FederationPeerConfig,
-    profile: &FederationEvaluationProfileConfig,
-) -> Result<(), EvidenceConfigError> {
-    let available_scopes: HashSet<&str> =
-        peer.evaluation_scopes.iter().map(String::as_str).collect();
-    let mut pending = vec![profile.claim_id.as_str()];
-    let mut visited = HashSet::new();
-    while let Some(claim_id) = pending.pop() {
-        if !visited.insert(claim_id) {
-            continue;
-        }
-        let claim = evidence
-            .claims
-            .iter()
-            .find(|candidate| candidate.id == claim_id)
-            .ok_or_else(|| EvidenceConfigError::InvalidFederationConfig {
-                reason: format!(
-                    "federation evaluation profile '{}' references an incomplete claim dependency closure",
-                    profile.id
-                ),
-            })?;
-        if let Some(scope) = claim
-            .required_scopes
-            .iter()
-            .find(|scope| !available_scopes.contains(scope.as_str()))
-        {
-            return invalid_federation(format!(
-                "federation peer '{}' evaluation_scopes must include required scope '{}' for profile '{}' claim '{}'",
-                peer.node_id, scope, profile.id, claim.id
-            ));
-        }
-        pending.extend(claim.depends_on.iter().map(String::as_str));
-    }
-    Ok(())
-}
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct FederationSigningConfig {
-    pub signing_key: String,
-}
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct FederationPairwiseSubjectHashConfig {
-    #[serde(default)]
-    pub secret_env: String,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct FederationResponseShapingConfig {
-    #[serde(default = "default_minimum_denial_latency_ms")]
-    pub minimum_denial_latency_ms: u64,
-}
-
-impl Default for FederationResponseShapingConfig {
-    fn default() -> Self {
-        Self {
-            minimum_denial_latency_ms: default_minimum_denial_latency_ms(),
-        }
-    }
-}
-
-pub(super) const fn default_minimum_denial_latency_ms() -> u64 {
-    250
-}
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct FederationEmergencyDenylistConfig {
-    #[serde(default)]
-    pub node_ids: Vec<String>,
-    #[serde(default)]
-    pub kids: Vec<String>,
-}
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct FederationPeerConfig {
-    pub node_id: String,
-    pub issuer: String,
-    pub jwks_uri: String,
-    #[serde(default)]
-    pub allow_insecure_localhost: bool,
-    #[serde(default)]
-    pub allow_insecure_private_network: bool,
-    #[serde(default)]
-    pub allowed_protocol_versions: Vec<String>,
-    #[serde(default)]
-    pub allowed_purposes: Vec<String>,
-    #[serde(default)]
-    pub allowed_profiles: Vec<String>,
-    #[serde(default)]
-    pub evaluation_scopes: Vec<String>,
-}
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct FederationEvaluationProfileConfig {
-    pub id: String,
-    pub ruleset: String,
-    pub claim_id: String,
-    pub subject_id_type: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub disclosure: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub max_claim_result_age_seconds: Option<u64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub legal_basis_ref: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub consent_ref: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub jurisdiction: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub assurance_level: Option<String>,
-}
-
-pub(super) fn invalid_federation<T>(reason: impl Into<String>) -> Result<T, EvidenceConfigError> {
-    Err(EvidenceConfigError::InvalidFederationConfig {
-        reason: reason.into(),
-    })
-}
-
-pub(super) fn validate_federation_non_empty(
-    field: &str,
-    value: &str,
-) -> Result<(), EvidenceConfigError> {
-    if value.trim().is_empty() {
-        return invalid_federation(format!("{field} must not be empty"));
-    }
-    Ok(())
-}
-
-pub(super) fn validate_federation_https_url(
-    field: &str,
-    value: &str,
-) -> Result<(), EvidenceConfigError> {
-    validate_federation_non_empty(field, value)?;
-    let Some(rest) = value.strip_prefix("https://") else {
-        return invalid_federation(format!("{field} must be an HTTPS URL"));
-    };
-    let host = rest.split(['/', '?', '#']).next().unwrap_or_default();
-    if host.is_empty() || host.contains('@') {
-        return invalid_federation(format!("{field} must include a valid host"));
-    }
-    Ok(())
-}
-
-pub(super) fn validate_federation_localhost_or_https_url(
-    field: &str,
-    value: &str,
-) -> Result<(), EvidenceConfigError> {
-    if value.starts_with("https://") {
-        return validate_federation_https_url(field, value);
-    }
-    let Some(rest) = value.strip_prefix("http://") else {
-        return invalid_federation(format!("{field} must be HTTPS or localhost HTTP"));
-    };
-    let host = rest.split(['/', '?', '#']).next().unwrap_or_default();
-    if host.starts_with("127.0.0.1:")
-        || host == "127.0.0.1"
-        || host.starts_with("localhost:")
-        || host == "localhost"
-    {
-        Ok(())
-    } else {
-        invalid_federation(format!("{field} permits HTTP only for localhost"))
-    }
-}
-
-pub(super) fn validate_federation_http_or_https_url(
-    field: &str,
-    value: &str,
-) -> Result<(), EvidenceConfigError> {
-    validate_federation_non_empty(field, value)?;
-    let Some(rest) = value
-        .strip_prefix("https://")
-        .or_else(|| value.strip_prefix("http://"))
-    else {
-        return invalid_federation(format!("{field} must be an HTTP or HTTPS URL"));
-    };
-    let host = rest.split(['/', '?', '#']).next().unwrap_or_default();
-    if host.is_empty() || host.contains('@') {
-        return invalid_federation(format!("{field} must include a valid host"));
-    }
-    Ok(())
-}
diff --git a/crates/registry-notary-core/src/config/http.rs b/crates/registry-notary-core/src/config/http.rs
deleted file mode 100644
index 557a47ada..000000000
--- a/crates/registry-notary-core/src/config/http.rs
+++ /dev/null
@@ -1,175 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! HTTP listener configuration.
-
-use super::*;
-
-#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct RegistryNotaryHttpConfig {
-    #[serde(default = "default_bind_addr")]
-    #[schemars(with = "schema::SocketAddrSchema")]
-    pub bind: SocketAddr,
-    #[serde(
-        default = "default_openapi_requires_auth",
-        skip_serializing_if = "openapi_requires_auth_is_default"
-    )]
-    pub openapi_requires_auth: bool,
-    #[serde(default, skip_serializing_if = "admin_listener_config_is_default")]
-    pub admin_listener: RegistryNotaryAdminListenerConfig,
-    #[serde(default)]
-    pub cors: RegistryNotaryCorsConfig,
-    #[serde(default = "default_request_timeout", with = "humantime_serde")]
-    #[schemars(with = "schema::HumantimeDurationSchema")]
-    pub request_timeout: Duration,
-    #[serde(default = "default_request_body_timeout", with = "humantime_serde")]
-    #[schemars(with = "schema::HumantimeDurationSchema")]
-    pub request_body_timeout: Duration,
-    #[serde(
-        default = "default_http1_header_read_timeout",
-        with = "humantime_serde"
-    )]
-    #[schemars(with = "schema::HumantimeDurationSchema")]
-    pub http1_header_read_timeout: Duration,
-    #[serde(default = "default_max_connections")]
-    pub max_connections: usize,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub trusted_proxy_ips: Vec<IpAddr>,
-}
-
-impl Default for RegistryNotaryHttpConfig {
-    fn default() -> Self {
-        Self {
-            bind: default_bind_addr(),
-            openapi_requires_auth: default_openapi_requires_auth(),
-            admin_listener: RegistryNotaryAdminListenerConfig::default(),
-            cors: RegistryNotaryCorsConfig::default(),
-            request_timeout: default_request_timeout(),
-            request_body_timeout: default_request_body_timeout(),
-            http1_header_read_timeout: default_http1_header_read_timeout(),
-            max_connections: default_max_connections(),
-            trusted_proxy_ips: Vec::new(),
-        }
-    }
-}
-
-impl RegistryNotaryHttpConfig {
-    pub(super) fn validate(&self) -> Result<(), EvidenceConfigError> {
-        if self.request_timeout.is_zero()
-            || self.request_body_timeout.is_zero()
-            || self.http1_header_read_timeout.is_zero()
-            || self.max_connections == 0
-        {
-            return Err(EvidenceConfigError::InvalidServerConfig {
-                reason:
-                    "server timeouts must be non-zero and max_connections must be greater than zero"
-                        .to_string(),
-            });
-        }
-        Ok(())
-    }
-}
-
-pub(super) fn default_bind_addr() -> SocketAddr {
-    // SAFETY: the literal is a valid loopback socket address.
-    "127.0.0.1:8081"
-        .parse()
-        .expect("default bind address is valid")
-}
-
-pub(super) fn default_openapi_requires_auth() -> bool {
-    true
-}
-
-pub(super) fn openapi_requires_auth_is_default(value: &bool) -> bool {
-    *value == default_openapi_requires_auth()
-}
-
-pub(super) fn default_request_timeout() -> Duration {
-    Duration::from_secs(30)
-}
-
-pub(super) fn default_request_body_timeout() -> Duration {
-    Duration::from_secs(10)
-}
-
-pub(super) fn default_http1_header_read_timeout() -> Duration {
-    Duration::from_secs(10)
-}
-
-pub(super) fn default_max_connections() -> usize {
-    1024
-}
-
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(rename_all = "snake_case")]
-pub enum RegistryNotaryAdminListenerMode {
-    SharedWithPublic,
-    Dedicated,
-    #[default]
-    Disabled,
-}
-
-impl RegistryNotaryAdminListenerMode {
-    pub fn as_str(self) -> &'static str {
-        match self {
-            Self::SharedWithPublic => "shared_with_public",
-            Self::Dedicated => "dedicated",
-            Self::Disabled => "disabled",
-        }
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct RegistryNotaryAdminListenerConfig {
-    #[serde(default, skip_serializing_if = "admin_listener_mode_is_default")]
-    pub mode: RegistryNotaryAdminListenerMode,
-    #[serde(default = "default_admin_bind_addr")]
-    #[schemars(with = "schema::SocketAddrSchema")]
-    pub bind: SocketAddr,
-}
-
-impl RegistryNotaryAdminListenerConfig {
-    pub(super) fn validate(
-        &self,
-        public_bind: SocketAddr,
-        governed_config_enabled: bool,
-    ) -> Result<(), EvidenceConfigError> {
-        if governed_config_enabled && self.mode != RegistryNotaryAdminListenerMode::Dedicated {
-            return Err(EvidenceConfigError::InvalidServerConfig {
-                reason: "config_trust requires server.admin_listener.mode = dedicated".to_string(),
-            });
-        }
-        if self.mode == RegistryNotaryAdminListenerMode::Dedicated && self.bind == public_bind {
-            return Err(EvidenceConfigError::InvalidServerConfig {
-                reason: "server.admin_listener.bind must differ from server.bind in dedicated mode"
-                    .to_string(),
-            });
-        }
-        Ok(())
-    }
-}
-
-impl Default for RegistryNotaryAdminListenerConfig {
-    fn default() -> Self {
-        Self {
-            mode: RegistryNotaryAdminListenerMode::Disabled,
-            bind: default_admin_bind_addr(),
-        }
-    }
-}
-
-pub(super) fn default_admin_bind_addr() -> SocketAddr {
-    // SAFETY: the literal is a valid loopback socket address.
-    "127.0.0.1:8082"
-        .parse()
-        .expect("default admin bind address is valid")
-}
-
-pub(super) fn admin_listener_config_is_default(config: &RegistryNotaryAdminListenerConfig) -> bool {
-    config == &RegistryNotaryAdminListenerConfig::default()
-}
-
-pub(super) fn admin_listener_mode_is_default(mode: &RegistryNotaryAdminListenerMode) -> bool {
-    mode == &RegistryNotaryAdminListenerMode::default()
-}
diff --git a/crates/registry-notary-core/src/config/oid4vci.rs b/crates/registry-notary-core/src/config/oid4vci.rs
deleted file mode 100644
index f569744fb..000000000
--- a/crates/registry-notary-core/src/config/oid4vci.rs
+++ /dev/null
@@ -1,1340 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! OpenID4VCI issuer configuration.
-
-use super::*;
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct Oid4vciConfig {
-    #[serde(default)]
-    pub enabled: bool,
-    #[serde(default)]
-    pub credential_issuer: String,
-    #[serde(default)]
-    pub authorization_servers: Vec<String>,
-    #[serde(default)]
-    pub accepted_token_audiences: Vec<String>,
-    #[serde(default)]
-    pub credential_endpoint: String,
-    #[serde(default)]
-    pub offer_endpoint: String,
-    #[serde(default)]
-    pub nonce_endpoint: Option<String>,
-    #[serde(default)]
-    pub nonce: Oid4vciNonceConfig,
-    #[serde(default)]
-    pub authorization: Oid4vciAuthorizationConfig,
-    #[serde(default)]
-    pub proof: Oid4vciProofConfig,
-    /// Issuer-initiated pre-authorized-code flow settings. This is the only
-    /// wallet-facing issuance grant in the 1.0 profile.
-    #[serde(default)]
-    pub pre_authorized_code: Oid4vciPreAuthorizedCodeConfig,
-    #[serde(default)]
-    pub display: Vec<Oid4vciIssuerDisplayConfig>,
-    #[serde(default)]
-    pub credential_configurations: BTreeMap<String, Oid4vciCredentialConfigurationConfig>,
-}
-
-pub(super) fn oid4vci_config_is_default(config: &Oid4vciConfig) -> bool {
-    config == &Oid4vciConfig::default()
-}
-
-impl Oid4vciConfig {
-    pub(super) fn validate(
-        &self,
-        subject_access: &SubjectAccessConfig,
-        evidence: &EvidenceConfig,
-        credential_status: &CredentialStatusConfig,
-    ) -> Result<(), EvidenceConfigError> {
-        // The pre-authorized-code block is validated regardless of the oid4vci
-        // enable toggle so a partially-configured flow is rejected, but the
-        // flow is an OID4VCI grant and so requires oid4vci itself enabled.
-        if self.pre_authorized_code.enabled && !self.enabled {
-            return invalid_oid4vci(
-                "pre_authorized_code.enabled = true requires oid4vci.enabled = true",
-            );
-        }
-        self.pre_authorized_code.validate()?;
-        // The eSignet RP client assertion is signed with this key, so it must
-        // resolve to an active signing key. Surface that at config time rather
-        // than as a startup failure when the pre-auth flow is first built.
-        if self.pre_authorized_code.enabled {
-            let key_id = self
-                .pre_authorized_code
-                .esignet
-                .client_signing_key_id
-                .as_str();
-            let key = evidence.signing_keys.get(key_id).ok_or_else(|| {
-                EvidenceConfigError::InvalidOid4vciConfig {
-                    reason: format!(
-                        "pre_authorized_code.esignet.client_signing_key_id '{key_id}' must reference an evidence.signing_keys entry"
-                    ),
-                }
-            })?;
-            if !key.status.may_sign() {
-                return invalid_oid4vci(format!(
-                    "pre_authorized_code.esignet.client_signing_key_id '{key_id}' must reference an active signing key"
-                ));
-            }
-        }
-        // The pre-auth callback resolves the subject-binding claim from the
-        // eSignet userinfo endpoint when the claim is userinfo-sourced, so the
-        // endpoint must be configured for that path to work.
-        if self.pre_authorized_code.enabled
-            && subject_access.subject_binding.claim_source == SubjectAccessClaimSource::Userinfo
-            && self
-                .pre_authorized_code
-                .esignet
-                .userinfo_url
-                .trim()
-                .is_empty()
-        {
-            return invalid_oid4vci(
-                "pre_authorized_code.esignet.userinfo_url must be set when subject_access.subject_binding.claim_source = userinfo",
-            );
-        }
-        if self.pre_authorized_code.enabled
-            && self.pre_authorized_code.tx_code.required
-            && subject_access
-                .rate_limits
-                .tx_code_attempts_per_code_per_minute
-                == 0
-        {
-            return invalid_oid4vci(
-                "subject_access.rate_limits.tx_code_attempts_per_code_per_minute must be greater than zero when pre_authorized_code.enabled = true and tx_code.required = true",
-            );
-        }
-        if !self.enabled {
-            return Ok(());
-        }
-        if !self.pre_authorized_code.enabled {
-            return invalid_oid4vci(
-                "enabled oid4vci requires pre_authorized_code.enabled = true; wallet-facing authorization_code issuance is not supported in 1.0",
-            );
-        }
-        if !subject_access.enabled {
-            return invalid_oid4vci("enabled oid4vci requires subject_access.enabled = true");
-        }
-        validate_oid4vci_public_url("oid4vci.credential_issuer", &self.credential_issuer)?;
-        validate_oid4vci_endpoint_url(
-            "oid4vci.credential_endpoint",
-            &self.credential_endpoint,
-            &self.credential_issuer,
-        )?;
-        if !self.offer_endpoint.trim().is_empty() {
-            validate_oid4vci_endpoint_url(
-                "oid4vci.offer_endpoint",
-                &self.offer_endpoint,
-                &self.credential_issuer,
-            )?;
-        }
-        validate_oid4vci_non_empty_entries(
-            "oid4vci.authorization_servers",
-            &self.authorization_servers,
-        )?;
-        for server in &self.authorization_servers {
-            validate_oid4vci_public_url("oid4vci.authorization_servers", server)?;
-        }
-        validate_oid4vci_non_empty_entries(
-            "oid4vci.accepted_token_audiences",
-            &self.accepted_token_audiences,
-        )?;
-        if self.credential_configurations.is_empty() {
-            return invalid_oid4vci("credential_configurations must not be empty");
-        }
-        if !self.nonce.enabled {
-            return invalid_oid4vci(
-                "oid4vci.nonce.enabled must be true for the transaction-scoped token nonce",
-            );
-        }
-        if self.nonce_endpoint.is_some() {
-            return invalid_oid4vci(
-                "oid4vci.nonce_endpoint must be omitted; 1.0 has no public unbound nonce endpoint",
-            );
-        }
-        self.nonce.validate()?;
-        self.authorization.validate()?;
-        self.proof.validate()?;
-        for display in &self.display {
-            display.validate("oid4vci.display")?;
-        }
-
-        let claim_ids: HashSet<&str> = evidence
-            .claims
-            .iter()
-            .map(|claim| claim.id.as_str())
-            .collect();
-        let allowed_claim_ids: HashSet<&str> = subject_access
-            .allowed_claims
-            .iter()
-            .map(String::as_str)
-            .collect();
-        let allowed_profiles: HashSet<&str> = subject_access
-            .credential_profiles
-            .iter()
-            .map(String::as_str)
-            .collect();
-
-        let mut configured_vcts = HashSet::new();
-        let validation = Oid4vciCredentialValidationContext {
-            credential_issuer: &self.credential_issuer,
-            subject_access,
-            evidence,
-            credential_status,
-            claim_ids: &claim_ids,
-            allowed_claim_ids: &allowed_claim_ids,
-            allowed_profiles: &allowed_profiles,
-        };
-        for (configuration_id, configuration) in &self.credential_configurations {
-            configuration.validate(configuration_id, &validation)?;
-            if !configured_vcts.insert(configuration.vct.as_str()) {
-                return invalid_oid4vci(format!(
-                    "credential configuration '{configuration_id}' vct must be unique"
-                ));
-            }
-        }
-        Ok(())
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct Oid4vciNonceConfig {
-    #[serde(default)]
-    pub enabled: bool,
-    #[serde(default = "default_oid4vci_nonce_ttl_seconds")]
-    pub ttl_seconds: u64,
-}
-
-impl Default for Oid4vciNonceConfig {
-    fn default() -> Self {
-        Self {
-            enabled: false,
-            ttl_seconds: default_oid4vci_nonce_ttl_seconds(),
-        }
-    }
-}
-
-impl Oid4vciNonceConfig {
-    fn validate(&self) -> Result<(), EvidenceConfigError> {
-        if self.ttl_seconds == 0 || self.ttl_seconds > 600 {
-            return invalid_oid4vci("nonce.ttl_seconds must be between 1 and 600");
-        }
-        Ok(())
-    }
-}
-
-pub(super) const fn default_oid4vci_nonce_ttl_seconds() -> u64 {
-    300
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct Oid4vciAuthorizationConfig {
-    #[serde(default = "default_oid4vci_pkce_method")]
-    pub require_pkce_method: String,
-}
-
-impl Default for Oid4vciAuthorizationConfig {
-    fn default() -> Self {
-        Self {
-            require_pkce_method: default_oid4vci_pkce_method(),
-        }
-    }
-}
-
-impl Oid4vciAuthorizationConfig {
-    fn validate(&self) -> Result<(), EvidenceConfigError> {
-        if self.require_pkce_method != PKCE_METHOD_S256 {
-            return invalid_oid4vci("authorization.require_pkce_method must be S256");
-        }
-        Ok(())
-    }
-}
-
-pub(super) fn default_oid4vci_pkce_method() -> String {
-    PKCE_METHOD_S256.to_string()
-}
-
-/// Pre-authorized-code flow configuration.
-///
-/// All fields default so existing configs that omit this block load unchanged
-/// with the flow disabled. When `enabled`, the eSignet RP login settings, the
-/// callback redirect, and the TTLs become required (validated cross-block).
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct Oid4vciPreAuthorizedCodeConfig {
-    #[serde(default)]
-    pub enabled: bool,
-    #[serde(default)]
-    pub tx_code: Oid4vciTxCodeConfig,
-    /// eSignet RP settings for the citizen login leg.
-    #[serde(default)]
-    pub esignet: Oid4vciEsignetRpConfig,
-    /// Pre-authorized-code lifetime in seconds.
-    #[serde(default = "default_pre_authorized_code_ttl_seconds")]
-    pub pre_authorized_code_ttl_seconds: u64,
-}
-
-impl Default for Oid4vciPreAuthorizedCodeConfig {
-    fn default() -> Self {
-        Self {
-            enabled: false,
-            tx_code: Oid4vciTxCodeConfig::default(),
-            esignet: Oid4vciEsignetRpConfig::default(),
-            pre_authorized_code_ttl_seconds: default_pre_authorized_code_ttl_seconds(),
-        }
-    }
-}
-
-impl Oid4vciPreAuthorizedCodeConfig {
-    fn validate(&self) -> Result<(), EvidenceConfigError> {
-        if !self.enabled {
-            return Ok(());
-        }
-        self.tx_code.validate()?;
-        self.esignet.validate()?;
-        if self.pre_authorized_code_ttl_seconds == 0 || self.pre_authorized_code_ttl_seconds > 600 {
-            return invalid_oid4vci(
-                "pre_authorized_code.pre_authorized_code_ttl_seconds must be between 1 and 600",
-            );
-        }
-        if !self.tx_code.required
-            && self.pre_authorized_code_ttl_seconds > MAX_BEARER_PRE_AUTHORIZED_CODE_TTL_SECONDS
-        {
-            return invalid_oid4vci(
-                "pre_authorized_code.pre_authorized_code_ttl_seconds must be between 1 and 300 when pre_authorized_code.tx_code.required = false",
-            );
-        }
-        Ok(())
-    }
-}
-
-pub const MAX_BEARER_PRE_AUTHORIZED_CODE_TTL_SECONDS: u64 = 300;
-
-pub(super) const fn default_pre_authorized_code_ttl_seconds() -> u64 {
-    300
-}
-
-/// `tx_code` (PIN) policy for the pre-authorized-code grant. A `tx_code` is
-/// required by default because a code without a PIN is a bearer credential.
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct Oid4vciTxCodeConfig {
-    #[serde(default = "default_tx_code_required")]
-    pub required: bool,
-    #[serde(default = "default_tx_code_input_mode")]
-    pub input_mode: String,
-    #[serde(default = "default_tx_code_length")]
-    pub length: u64,
-}
-
-impl Default for Oid4vciTxCodeConfig {
-    fn default() -> Self {
-        Self {
-            required: default_tx_code_required(),
-            input_mode: default_tx_code_input_mode(),
-            length: default_tx_code_length(),
-        }
-    }
-}
-
-impl Oid4vciTxCodeConfig {
-    fn validate(&self) -> Result<(), EvidenceConfigError> {
-        if !self.required {
-            return Ok(());
-        }
-        if self.input_mode != TX_CODE_INPUT_MODE_NUMERIC {
-            return invalid_oid4vci("pre_authorized_code.tx_code.input_mode must be numeric");
-        }
-        if !(4..=12).contains(&self.length) {
-            return invalid_oid4vci("pre_authorized_code.tx_code.length must be between 4 and 12");
-        }
-        Ok(())
-    }
-}
-
-pub(super) const fn default_tx_code_required() -> bool {
-    true
-}
-
-pub(super) fn default_tx_code_input_mode() -> String {
-    TX_CODE_INPUT_MODE_NUMERIC.to_string()
-}
-
-pub(super) const fn default_tx_code_length() -> u64 {
-    6
-}
-
-/// eSignet relying-party settings for the citizen login leg of the
-/// pre-authorized-code flow.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct Oid4vciEsignetRpConfig {
-    /// Confidential client id the Notary presents to eSignet.
-    #[serde(default)]
-    pub client_id: String,
-    /// `evidence.signing_keys` entry used to sign the eSignet
-    /// `private_key_jwt` client assertion.
-    #[serde(default)]
-    pub client_signing_key_id: String,
-    /// Notary callback the citizen browser is redirected back to.
-    #[serde(default)]
-    pub redirect_uri: String,
-    /// eSignet authorize endpoint.
-    #[serde(default)]
-    pub authorize_url: String,
-    /// eSignet token endpoint.
-    #[serde(default)]
-    pub token_url: String,
-    /// eSignet OIDC issuer, pinned when validating the returned `id_token`.
-    #[serde(default)]
-    pub issuer: String,
-    /// eSignet JWKS URI, used to resolve the `id_token` signing key by `kid`.
-    #[serde(default)]
-    pub jwks_uri: String,
-    /// eSignet userinfo endpoint. Required when the subject-binding claim is
-    /// sourced from userinfo rather than the `id_token`; the callback fetches
-    /// the userinfo JWS with the eSignet access token and reads the binding
-    /// claim from it.
-    #[serde(default)]
-    pub userinfo_url: String,
-    /// OAuth scopes requested at eSignet.
-    #[serde(default)]
-    pub scopes: Vec<String>,
-    /// Lifetime of the short-lived login state (PKCE verifier + nonce +
-    /// selection) reserved between `offer/start` and `offer/callback`.
-    #[serde(default = "default_login_state_ttl_seconds")]
-    pub login_state_ttl_seconds: u64,
-    /// Allow `http` loopback URLs for the eSignet endpoints and JWKS transport.
-    /// For local development and tests only.
-    #[serde(default)]
-    pub allow_insecure_localhost: bool,
-}
-
-impl Oid4vciEsignetRpConfig {
-    fn validate(&self) -> Result<(), EvidenceConfigError> {
-        if self.client_id.trim().is_empty() {
-            return invalid_oid4vci("pre_authorized_code.esignet.client_id must not be empty");
-        }
-        if self.client_signing_key_id.trim().is_empty() {
-            return invalid_oid4vci(
-                "pre_authorized_code.esignet.client_signing_key_id must not be empty",
-            );
-        }
-        validate_oid4vci_public_url(
-            "pre_authorized_code.esignet.redirect_uri",
-            &self.redirect_uri,
-        )?;
-        validate_oid4vci_public_url(
-            "pre_authorized_code.esignet.authorize_url",
-            &self.authorize_url,
-        )?;
-        validate_oid4vci_public_url("pre_authorized_code.esignet.token_url", &self.token_url)?;
-        validate_oid4vci_public_url("pre_authorized_code.esignet.issuer", &self.issuer)?;
-        validate_oid4vci_public_url("pre_authorized_code.esignet.jwks_uri", &self.jwks_uri)?;
-        if !self.userinfo_url.trim().is_empty() {
-            validate_oid4vci_public_url(
-                "pre_authorized_code.esignet.userinfo_url",
-                &self.userinfo_url,
-            )?;
-        }
-        validate_oid4vci_non_empty_entries("pre_authorized_code.esignet.scopes", &self.scopes)?;
-        if self.login_state_ttl_seconds == 0 || self.login_state_ttl_seconds > 600 {
-            return invalid_oid4vci(
-                "pre_authorized_code.esignet.login_state_ttl_seconds must be between 1 and 600",
-            );
-        }
-        Ok(())
-    }
-}
-
-pub(super) const fn default_login_state_ttl_seconds() -> u64 {
-    300
-}
-
-const TX_CODE_INPUT_MODE_NUMERIC: &str = "numeric";
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct Oid4vciProofConfig {
-    #[serde(default = "default_oid4vci_proof_max_age_seconds")]
-    pub max_age_seconds: u64,
-    #[serde(default = "default_oid4vci_proof_max_clock_skew_seconds")]
-    pub max_clock_skew_seconds: u64,
-}
-
-impl Default for Oid4vciProofConfig {
-    fn default() -> Self {
-        Self {
-            max_age_seconds: default_oid4vci_proof_max_age_seconds(),
-            max_clock_skew_seconds: default_oid4vci_proof_max_clock_skew_seconds(),
-        }
-    }
-}
-
-impl Oid4vciProofConfig {
-    fn validate(&self) -> Result<(), EvidenceConfigError> {
-        if self.max_age_seconds == 0 || self.max_age_seconds > 600 {
-            return invalid_oid4vci("proof.max_age_seconds must be between 1 and 600");
-        }
-        if self.max_clock_skew_seconds > 60 {
-            return invalid_oid4vci("proof.max_clock_skew_seconds must be at most 60");
-        }
-        Ok(())
-    }
-}
-
-pub(super) const fn default_oid4vci_proof_max_age_seconds() -> u64 {
-    300
-}
-
-pub(super) const fn default_oid4vci_proof_max_clock_skew_seconds() -> u64 {
-    60
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct Oid4vciCredentialConfigurationConfig {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub claim_id: Option<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub claims: Vec<Oid4vciCredentialClaimConfig>,
-    pub credential_profile: String,
-    pub format: String,
-    pub scope: String,
-    pub vct: String,
-    pub display_name: String,
-    #[serde(default)]
-    pub display: Oid4vciCredentialDisplayConfig,
-    #[serde(default = "default_oid4vci_proof_signing_alg_values_supported")]
-    pub proof_signing_alg_values_supported: Vec<String>,
-    #[serde(default = "default_oid4vci_cryptographic_binding_methods_supported")]
-    pub cryptographic_binding_methods_supported: Vec<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub representative_issuance: Option<Oid4vciRepresentativeIssuanceConfig>,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct Oid4vciRepresentativeIssuanceConfig {
-    pub ceremony: Oid4vciRepresentativeIssuanceCeremony,
-    pub relationship: String,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(rename_all = "snake_case")]
-pub enum Oid4vciRepresentativeIssuanceCeremony {
-    DigitallyAuthenticatedRepresentative,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct Oid4vciCredentialClaimConfig {
-    pub id: String,
-    pub output_path: Vec<String>,
-    pub display_name: String,
-    pub sd: String,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum Oid4vciCredentialClaimMode<'a> {
-    LegacyClaimWrapper {
-        claim_id: &'a str,
-    },
-    FieldProjection {
-        entries: &'a [Oid4vciCredentialClaimConfig],
-    },
-}
-
-impl Oid4vciCredentialClaimMode<'_> {
-    #[must_use]
-    pub fn is_field_projection(&self) -> bool {
-        matches!(self, Self::FieldProjection { .. })
-    }
-}
-
-impl Oid4vciCredentialConfigurationConfig {
-    #[must_use]
-    pub fn credential_claim_mode(&self) -> Oid4vciCredentialClaimMode<'_> {
-        if let Some(claim_id) = self.claim_id.as_deref() {
-            Oid4vciCredentialClaimMode::LegacyClaimWrapper { claim_id }
-        } else {
-            Oid4vciCredentialClaimMode::FieldProjection {
-                entries: &self.claims,
-            }
-        }
-    }
-
-    #[must_use]
-    pub fn credential_claim_ids(&self) -> Vec<String> {
-        match self.credential_claim_mode() {
-            Oid4vciCredentialClaimMode::LegacyClaimWrapper { claim_id } => {
-                vec![claim_id.to_string()]
-            }
-            Oid4vciCredentialClaimMode::FieldProjection { entries } => {
-                entries.iter().map(|entry| entry.id.clone()).collect()
-            }
-        }
-    }
-
-    fn validate(
-        &self,
-        configuration_id: &str,
-        context: &Oid4vciCredentialValidationContext<'_>,
-    ) -> Result<(), EvidenceConfigError> {
-        let Oid4vciCredentialValidationContext {
-            credential_issuer,
-            subject_access,
-            evidence,
-            credential_status,
-            claim_ids,
-            allowed_claim_ids,
-            allowed_profiles,
-        } = context;
-        if configuration_id.trim().is_empty() {
-            return invalid_oid4vci("credential_configurations must not contain a blank id");
-        }
-        let claim_mode = self.validate_claim_mode(configuration_id)?;
-        validate_oid4vci_non_empty_value(
-            "credential_configurations.credential_profile",
-            &self.credential_profile,
-        )?;
-        validate_oid4vci_non_empty_value("credential_configurations.scope", &self.scope)?;
-        validate_oid4vci_non_empty_value(
-            "credential_configurations.display_name",
-            &self.display_name,
-        )?;
-        self.display.validate("credential_configurations.display")?;
-        let profile = evidence
-            .credential_profiles
-            .get(&self.credential_profile)
-            .ok_or_else(|| EvidenceConfigError::InvalidOid4vciConfig {
-                reason: format!(
-                    "credential configuration '{configuration_id}' references unknown credential profile '{}'",
-                    self.credential_profile
-                ),
-            })?;
-        if !allowed_profiles.contains(self.credential_profile.as_str()) {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' references credential profile '{}' outside subject_access.credential_profiles",
-                self.credential_profile
-            ));
-        }
-        if self.format != OID4VCI_SD_JWT_VC_FORMAT {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' format must be dc+sd-jwt"
-            ));
-        }
-        if profile.format != FORMAT_SD_JWT_VC {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' references credential profile '{}' with unsupported format '{}'",
-                self.credential_profile, profile.format
-            ));
-        }
-        let mut projection_purpose = None;
-        for claim_id in self.credential_claim_ids() {
-            let claim = validate_oid4vci_credential_claim_reference(
-                configuration_id,
-                &claim_id,
-                &self.credential_profile,
-                evidence,
-                profile,
-                claim_ids,
-                self.representative_issuance
-                    .is_none()
-                    .then_some(*allowed_claim_ids),
-            )?;
-            if claim_mode.is_field_projection() {
-                let purpose = claim.purpose.as_deref().ok_or_else(|| {
-                    EvidenceConfigError::InvalidOid4vciConfig {
-                        reason: format!(
-                            "credential configuration '{configuration_id}' field projection claim '{claim_id}' must define purpose"
-                        ),
-                    }
-                })?;
-                if let Some(previous) = projection_purpose {
-                    if previous != purpose {
-                        return invalid_oid4vci(format!(
-                            "credential configuration '{configuration_id}' field projection claims must share one purpose"
-                        ));
-                    }
-                } else {
-                    projection_purpose = Some(purpose);
-                }
-                if claim.disclosure.default != "value" {
-                    return invalid_oid4vci(format!(
-                        "credential configuration '{configuration_id}' field projection claim '{claim_id}' must use value as the default disclosure"
-                    ));
-                }
-            }
-        }
-        if self.vct != profile.vct {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' vct must match credential profile '{}'",
-                self.credential_profile
-            ));
-        }
-        validate_oid4vci_public_url("credential_configurations.vct", &self.vct)?;
-        validate_oid4vci_endpoint_url(
-            "credential_configurations.vct",
-            &self.vct,
-            credential_issuer,
-        )?;
-        let Some((_, _, vct_path)) = split_absolute_url(&self.vct) else {
-            return invalid_oid4vci("credential_configurations.vct must be an absolute URL");
-        };
-        let Some(expected_vct_prefix) = oid4vci_credentials_path_prefix(credential_issuer) else {
-            return invalid_oid4vci("oid4vci.credential_issuer must be an absolute URL");
-        };
-        if !vct_path.starts_with(&expected_vct_prefix) {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' vct path must start with {expected_vct_prefix}"
-            ));
-        }
-        validate_oid4vci_non_empty_entries(
-            "credential_configurations.proof_signing_alg_values_supported",
-            &self.proof_signing_alg_values_supported,
-        )?;
-        for alg in &self.proof_signing_alg_values_supported {
-            if alg != CREDENTIAL_SIGNING_ALG_EDDSA {
-                return invalid_oid4vci(format!(
-                    "credential configuration '{configuration_id}' supports unsupported proof signing algorithm '{alg}'"
-                ));
-            }
-        }
-        validate_oid4vci_non_empty_entries(
-            "credential_configurations.cryptographic_binding_methods_supported",
-            &self.cryptographic_binding_methods_supported,
-        )?;
-        for method in &self.cryptographic_binding_methods_supported {
-            if method != CRYPTOGRAPHIC_BINDING_METHOD_DID_JWK {
-                return invalid_oid4vci(format!(
-                    "credential configuration '{configuration_id}' supports unsupported binding method '{method}'"
-                ));
-            }
-        }
-        self.validate_representative_issuance(
-            configuration_id,
-            subject_access,
-            evidence,
-            credential_status,
-        )?;
-        Ok(())
-    }
-
-    fn validate_representative_issuance(
-        &self,
-        configuration_id: &str,
-        subject_access: &SubjectAccessConfig,
-        evidence: &EvidenceConfig,
-        credential_status: &CredentialStatusConfig,
-    ) -> Result<(), EvidenceConfigError> {
-        let Some(representative) = self.representative_issuance.as_ref() else {
-            return Ok(());
-        };
-        if !subject_access.delegation.enabled {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' representative_issuance requires subject_access.delegation.enabled = true"
-            ));
-        }
-        if !subject_access.allowed_operations.evaluate {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' representative_issuance requires subject_access.allowed_operations.evaluate = true"
-            ));
-        }
-        if !subject_access.allowed_operations.issue_credential {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' representative_issuance requires subject_access.allowed_operations.issue_credential = true"
-            ));
-        }
-        if !credential_status.enabled {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' representative_issuance requires credential_status.enabled = true"
-            ));
-        }
-        if representative.relationship.trim().is_empty() {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' representative_issuance.relationship must not be empty"
-            ));
-        }
-        let relationship = subject_access
-            .delegation
-            .relationship(&representative.relationship)
-            .ok_or_else(|| EvidenceConfigError::InvalidOid4vciConfig {
-                reason: format!(
-                    "credential configuration '{configuration_id}' representative_issuance references unknown relationship '{}'",
-                    representative.relationship
-                ),
-            })?;
-        let claim_ids = self.credential_claim_ids();
-        let [claim_id] = claim_ids.as_slice() else {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' representative_issuance requires exactly one credential claim root"
-            ));
-        };
-        if subject_access
-            .allowed_claims
-            .iter()
-            .any(|allowed| allowed == claim_id)
-        {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' representative_issuance claim '{claim_id}' must not appear in subject_access.allowed_claims; representative roots are delegated-only"
-            ));
-        }
-        if !relationship
-            .allowed_claims
-            .iter()
-            .any(|allowed| allowed == claim_id)
-        {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' representative_issuance claim '{claim_id}' is not allowed by relationship '{}'",
-                relationship.relationship_type
-            ));
-        }
-        let claim = evidence
-            .claims
-            .iter()
-            .find(|claim| claim.id == *claim_id)
-            .ok_or_else(|| EvidenceConfigError::InvalidOid4vciConfig {
-                reason: format!(
-                    "credential configuration '{configuration_id}' representative_issuance references unknown claim '{claim_id}'"
-                ),
-            })?;
-        if !claim
-            .depends_on
-            .iter()
-            .any(|dependency| dependency == &relationship.proof_claim)
-        {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' representative_issuance claim '{claim_id}' must depend_on proof claim '{}'",
-                relationship.proof_claim
-            ));
-        }
-        let requester_id_type = subject_access.subject_binding.id_type.as_str();
-        let target_id_type = relationship
-            .target_id_type
-            .as_deref()
-            .unwrap_or(requester_id_type);
-        let requester_path = format!("requester.identifiers.{requester_id_type}");
-        let target_path = format!("target.identifiers.{target_id_type}");
-        validate_representative_credential_closure_inputs(
-            configuration_id,
-            claim,
-            &relationship.proof_claim,
-            evidence,
-            &requester_path,
-            &target_path,
-        )?;
-        let proof_claim = evidence
-            .claims
-            .iter()
-            .find(|candidate| candidate.id == relationship.proof_claim)
-            .ok_or_else(|| EvidenceConfigError::InvalidOid4vciConfig {
-                reason: format!(
-                    "credential configuration '{configuration_id}' representative_issuance references unknown proof claim '{}'",
-                    relationship.proof_claim
-                ),
-            })?;
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &proof_claim.evidence_mode else {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' representative_issuance proof claim '{}' must be registry_backed",
-                relationship.proof_claim
-            ));
-        };
-        let Some((_, consultation)) = consultations
-            .first_key_value()
-            .filter(|_| consultations.len() == 1)
-        else {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' representative_issuance proof claim '{}' must declare exactly one Relay consultation",
-                relationship.proof_claim
-            ));
-        };
-        let expected_inputs = BTreeSet::from([requester_path, target_path]);
-        let actual_inputs = consultation
-            .inputs
-            .values()
-            .map(|input| input.request_context_path().to_string())
-            .collect::<BTreeSet<_>>();
-        if actual_inputs != expected_inputs {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' representative_issuance proof claim '{}' consultation must map exactly the authenticated requester identifier and selected target identifier",
-                relationship.proof_claim
-            ));
-        }
-        Ok(())
-    }
-
-    fn validate_claim_mode(
-        &self,
-        configuration_id: &str,
-    ) -> Result<Oid4vciCredentialClaimMode<'_>, EvidenceConfigError> {
-        match (self.claim_id.as_deref(), self.claims.is_empty()) {
-            (Some(claim_id), true) => {
-                validate_oid4vci_non_empty_value("credential_configurations.claim_id", claim_id)?;
-                Ok(Oid4vciCredentialClaimMode::LegacyClaimWrapper { claim_id })
-            }
-            (None, false) => {
-                validate_oid4vci_projection_claims(configuration_id, &self.claims)?;
-                Ok(Oid4vciCredentialClaimMode::FieldProjection {
-                    entries: &self.claims,
-                })
-            }
-            (Some(_), false) => invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' must set exactly one of claim_id or claims"
-            )),
-            (None, true) => invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' must set exactly one of claim_id or claims"
-            )),
-        }
-    }
-}
-
-fn validate_representative_credential_closure_inputs(
-    configuration_id: &str,
-    root: &ClaimDefinition,
-    proof_claim_id: &str,
-    evidence: &EvidenceConfig,
-    requester_path: &str,
-    target_path: &str,
-) -> Result<(), EvidenceConfigError> {
-    let mut pending = vec![root];
-    let mut visited = BTreeSet::new();
-    while let Some(claim) = pending.pop() {
-        if !visited.insert(claim.id.as_str()) || claim.id == proof_claim_id {
-            continue;
-        }
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' representative_issuance claim '{}' must be registry_backed",
-                claim.id
-            ));
-        };
-        for (consultation_name, consultation) in consultations {
-            let mut consumes_target = false;
-            for (input_name, input) in &consultation.inputs {
-                let path = input.request_context_path();
-                if path != requester_path && path != target_path {
-                    return invalid_oid4vci(format!(
-                        "credential configuration '{configuration_id}' representative_issuance claim '{}' consultation '{consultation_name}' input '{input_name}' maps '{path}' outside the representative ceremony; expected '{requester_path}' or '{target_path}'",
-                        claim.id
-                    ));
-                }
-                consumes_target |= path == target_path;
-            }
-            if !consumes_target {
-                let actual_inputs = consultation
-                    .inputs
-                    .iter()
-                    .map(|(input_name, input)| {
-                        format!("'{input_name}' maps '{}'", input.request_context_path())
-                    })
-                    .collect::<Vec<_>>()
-                    .join(", ");
-                return invalid_oid4vci(format!(
-                    "credential configuration '{configuration_id}' representative_issuance claim '{}' consultation '{consultation_name}' does not consume the selected target; {actual_inputs}; required target path is '{target_path}' and the only additional allowed canonical path is '{requester_path}'",
-                    claim.id
-                ));
-            }
-        }
-        for dependency_id in &claim.depends_on {
-            let dependency = evidence
-                .claims
-                .iter()
-                .find(|candidate| candidate.id == *dependency_id)
-                .ok_or_else(|| EvidenceConfigError::InvalidOid4vciConfig {
-                    reason: format!(
-                        "credential configuration '{configuration_id}' representative_issuance claim '{}' dependency closure references unknown claim '{dependency_id}'",
-                        root.id
-                    ),
-                })?;
-            pending.push(dependency);
-        }
-    }
-    Ok(())
-}
-
-pub(super) fn validate_oid4vci_projection_claims(
-    configuration_id: &str,
-    claims: &[Oid4vciCredentialClaimConfig],
-) -> Result<(), EvidenceConfigError> {
-    let mut ids = BTreeSet::new();
-    let mut paths = BTreeSet::new();
-    for claim in claims {
-        validate_oid4vci_non_empty_value("credential_configurations.claims[].id", &claim.id)?;
-        if !ids.insert(claim.id.as_str()) {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' contains duplicate claims[].id"
-            ));
-        }
-        validate_oid4vci_non_empty_value(
-            "credential_configurations.claims[].display_name",
-            &claim.display_name,
-        )?;
-        validate_oid4vci_non_empty_value("credential_configurations.claims[].sd", &claim.sd)?;
-        if claim.sd != "always" {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' claims[].sd must be always"
-            ));
-        }
-        if claim.output_path.is_empty() {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' claims[].output_path must not be empty"
-            ));
-        }
-        if claim.output_path.len() != 1 {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' claims[].output_path must be a single segment in V1"
-            ));
-        }
-        let segment = &claim.output_path[0];
-        validate_oid4vci_non_empty_value(
-            "credential_configurations.claims[].output_path",
-            segment,
-        )?;
-        if is_reserved_oid4vci_projection_output_name(segment) {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' claims[].output_path uses reserved claim name '{segment}'"
-            ));
-        }
-        if !paths.insert(segment.as_str()) {
-            return invalid_oid4vci(format!(
-                "credential configuration '{configuration_id}' contains duplicate claims[].output_path"
-            ));
-        }
-    }
-    Ok(())
-}
-
-struct Oid4vciCredentialValidationContext<'a> {
-    credential_issuer: &'a str,
-    subject_access: &'a SubjectAccessConfig,
-    evidence: &'a EvidenceConfig,
-    credential_status: &'a CredentialStatusConfig,
-    claim_ids: &'a HashSet<&'a str>,
-    allowed_claim_ids: &'a HashSet<&'a str>,
-    allowed_profiles: &'a HashSet<&'a str>,
-}
-
-pub(super) fn validate_oid4vci_credential_claim_reference<'a>(
-    configuration_id: &str,
-    claim_id: &str,
-    credential_profile_id: &str,
-    evidence: &'a EvidenceConfig,
-    profile: &CredentialProfileConfig,
-    claim_ids: &HashSet<&str>,
-    allowed_claim_ids: Option<&HashSet<&str>>,
-) -> Result<&'a ClaimDefinition, EvidenceConfigError> {
-    if !claim_ids.contains(claim_id) {
-        return invalid_oid4vci(format!(
-            "credential configuration '{configuration_id}' references unknown claim '{claim_id}'"
-        ));
-    }
-    if allowed_claim_ids.is_some_and(|allowed| !allowed.contains(claim_id)) {
-        return invalid_oid4vci(format!(
-            "credential configuration '{configuration_id}' references claim '{claim_id}' outside subject_access.allowed_claims"
-        ));
-    }
-    if !profile
-        .allowed_claims
-        .iter()
-        .any(|allowed_claim_id| allowed_claim_id == claim_id)
-    {
-        return invalid_oid4vci(format!(
-            "credential configuration '{configuration_id}' maps claim '{claim_id}' to credential profile '{credential_profile_id}' but the profile does not allow that claim"
-        ));
-    }
-    let claim = evidence
-        .claims
-        .iter()
-        .find(|claim| claim.id == claim_id)
-        .ok_or_else(|| EvidenceConfigError::InvalidOid4vciConfig {
-            reason: format!(
-                "credential configuration '{configuration_id}' references unknown claim '{claim_id}'"
-            ),
-        })?;
-    if !claim
-        .credential_profiles
-        .iter()
-        .any(|profile_id| profile_id == credential_profile_id)
-    {
-        return invalid_oid4vci(format!(
-            "credential configuration '{configuration_id}' maps claim '{claim_id}' to credential profile '{credential_profile_id}' but the claim does not reference that profile"
-        ));
-    }
-    Ok(claim)
-}
-
-pub(super) fn is_reserved_oid4vci_projection_output_name(value: &str) -> bool {
-    const RESERVED: [&str; 17] = [
-        "iss",
-        "sub",
-        "aud",
-        "iat",
-        "nbf",
-        "exp",
-        "vct",
-        "vct#integrity",
-        "id",
-        "jti",
-        "_sd",
-        "_sd_alg",
-        "cnf",
-        "status",
-        "issuanceDate",
-        "expirationDate",
-        "credential_configuration_id",
-    ];
-    RESERVED.contains(&value)
-}
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct Oid4vciIssuerDisplayConfig {
-    pub name: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub locale: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub logo: Option<Oid4vciDisplayImageConfig>,
-}
-
-impl Oid4vciIssuerDisplayConfig {
-    fn validate(&self, name: &str) -> Result<(), EvidenceConfigError> {
-        validate_oid4vci_non_empty_value(&format!("{name}.name"), &self.name)?;
-        validate_optional_oid4vci_non_empty_value(
-            &format!("{name}.locale"),
-            self.locale.as_deref(),
-        )?;
-        validate_oid4vci_display_image(&format!("{name}.logo"), &self.logo)
-    }
-}
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct Oid4vciCredentialDisplayConfig {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub locale: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub logo: Option<Oid4vciDisplayImageConfig>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub background_color: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub text_color: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub background_image: Option<Oid4vciDisplayImageConfig>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub secondary_image: Option<Oid4vciDisplayImageConfig>,
-}
-
-impl Oid4vciCredentialDisplayConfig {
-    fn validate(&self, name: &str) -> Result<(), EvidenceConfigError> {
-        validate_optional_oid4vci_non_empty_value(
-            &format!("{name}.locale"),
-            self.locale.as_deref(),
-        )?;
-        validate_optional_oid4vci_non_empty_value(
-            &format!("{name}.description"),
-            self.description.as_deref(),
-        )?;
-        validate_optional_oid4vci_non_empty_value(
-            &format!("{name}.background_color"),
-            self.background_color.as_deref(),
-        )?;
-        validate_optional_oid4vci_non_empty_value(
-            &format!("{name}.text_color"),
-            self.text_color.as_deref(),
-        )?;
-        validate_oid4vci_display_image(&format!("{name}.logo"), &self.logo)?;
-        validate_oid4vci_display_image(
-            &format!("{name}.background_image"),
-            &self.background_image,
-        )?;
-        validate_oid4vci_display_image(&format!("{name}.secondary_image"), &self.secondary_image)
-    }
-}
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct Oid4vciDisplayImageConfig {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub uri: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub url: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub alt_text: Option<String>,
-}
-
-pub(super) fn default_oid4vci_proof_signing_alg_values_supported() -> Vec<String> {
-    vec![CREDENTIAL_SIGNING_ALG_EDDSA.to_string()]
-}
-
-pub(super) fn default_oid4vci_cryptographic_binding_methods_supported() -> Vec<String> {
-    vec![CRYPTOGRAPHIC_BINDING_METHOD_DID_JWK.to_string()]
-}
-
-pub(super) fn validate_oid4vci_public_url(
-    name: &str,
-    url: &str,
-) -> Result<(), EvidenceConfigError> {
-    let url = url.trim();
-    let (scheme, authority, _) =
-        split_absolute_url(url).ok_or_else(|| EvidenceConfigError::InvalidOid4vciConfig {
-            reason: format!("{name} must be an absolute URL"),
-        })?;
-    if scheme != "https" && !(scheme == "http" && is_insecure_localhost_url(url)) {
-        return invalid_oid4vci(format!(
-            "{name} must use https unless it is an http loopback URL"
-        ));
-    }
-    if authority.is_empty() {
-        return invalid_oid4vci(format!("{name} must include a host"));
-    }
-    if url.contains('#') {
-        return invalid_oid4vci(format!("{name} must not include a fragment"));
-    }
-    Ok(())
-}
-
-pub(super) fn validate_oid4vci_endpoint_url(
-    name: &str,
-    url: &str,
-    credential_issuer: &str,
-) -> Result<(), EvidenceConfigError> {
-    validate_oid4vci_public_url(name, url)?;
-    let Some((_, _, path)) = split_absolute_url(url) else {
-        return invalid_oid4vci(format!("{name} must be an absolute URL"));
-    };
-    if path.is_empty() || path == "/" {
-        return invalid_oid4vci(format!("{name} must include an endpoint path"));
-    }
-    if url.contains('?') {
-        return invalid_oid4vci(format!("{name} must not include a query string"));
-    }
-    let issuer_prefix = credential_issuer.trim().trim_end_matches('/');
-    if !url.trim().starts_with(&format!("{issuer_prefix}/")) {
-        return invalid_oid4vci(format!("{name} must be under oid4vci.credential_issuer"));
-    }
-    Ok(())
-}
-
-pub(super) fn oid4vci_credentials_path_prefix(credential_issuer: &str) -> Option<String> {
-    let (_, _, issuer_path) = split_absolute_url(credential_issuer.trim())?;
-    let issuer_path = issuer_path.trim_end_matches('/');
-    if issuer_path.is_empty() {
-        Some("/credentials/".to_string())
-    } else {
-        Some(format!("{issuer_path}/credentials/"))
-    }
-}
-
-pub(super) fn split_absolute_url(url: &str) -> Option<(&str, &str, &str)> {
-    let (scheme, rest) = url.split_once("://")?;
-    if scheme.is_empty() || rest.is_empty() {
-        return None;
-    }
-    let authority_end = rest.find(['/', '?', '#']).unwrap_or(rest.len());
-    let authority = &rest[..authority_end];
-    if authority.is_empty() {
-        return None;
-    }
-    let path = if rest[authority_end..].starts_with('/') {
-        rest[authority_end..]
-            .split(['?', '#'])
-            .next()
-            .unwrap_or_default()
-    } else {
-        ""
-    };
-    Some((scheme, authority, path))
-}
-
-pub(super) fn validate_oid4vci_non_empty_entries(
-    name: &str,
-    values: &[String],
-) -> Result<(), EvidenceConfigError> {
-    if values.is_empty() {
-        return invalid_oid4vci(format!("{name} must not be empty"));
-    }
-    for value in values {
-        validate_oid4vci_non_empty_value(name, value)?;
-    }
-    Ok(())
-}
-
-pub(super) fn validate_oid4vci_non_empty_value(
-    name: &str,
-    value: &str,
-) -> Result<(), EvidenceConfigError> {
-    if value.trim().is_empty() {
-        return invalid_oid4vci(format!("{name} must not contain blank entries"));
-    }
-    Ok(())
-}
-
-pub(super) fn validate_optional_oid4vci_non_empty_value(
-    name: &str,
-    value: Option<&str>,
-) -> Result<(), EvidenceConfigError> {
-    if let Some(value) = value {
-        validate_oid4vci_non_empty_value(name, value)?;
-    }
-    Ok(())
-}
-
-pub(super) fn validate_oid4vci_display_image(
-    name: &str,
-    image: &Option<Oid4vciDisplayImageConfig>,
-) -> Result<(), EvidenceConfigError> {
-    let Some(image) = image else {
-        return Ok(());
-    };
-    validate_optional_oid4vci_non_empty_value(&format!("{name}.uri"), image.uri.as_deref())?;
-    validate_optional_oid4vci_non_empty_value(&format!("{name}.url"), image.url.as_deref())?;
-    validate_optional_oid4vci_non_empty_value(
-        &format!("{name}.alt_text"),
-        image.alt_text.as_deref(),
-    )?;
-    match (image.uri.as_deref(), image.url.as_deref()) {
-        (None, None) => invalid_oid4vci(format!("{name} must include uri or url")),
-        (uri, url) => {
-            if let Some(uri) = uri {
-                validate_oid4vci_public_url(&format!("{name}.uri"), uri)?;
-            }
-            if let Some(url) = url {
-                validate_oid4vci_public_url(&format!("{name}.url"), url)?;
-            }
-            Ok(())
-        }
-    }
-}
-
-pub(super) fn invalid_oid4vci<T>(reason: impl Into<String>) -> Result<T, EvidenceConfigError> {
-    Err(EvidenceConfigError::InvalidOid4vciConfig {
-        reason: reason.into(),
-    })
-}
-
-pub(super) fn invalid_access_token_signing<T>(
-    reason: impl Into<String>,
-) -> Result<T, EvidenceConfigError> {
-    Err(EvidenceConfigError::InvalidAccessTokenSigningConfig {
-        reason: reason.into(),
-    })
-}
-
-pub(super) fn validate_access_token_signing_entries(
-    field: &str,
-    values: &[String],
-) -> Result<(), EvidenceConfigError> {
-    if values.is_empty() {
-        return invalid_access_token_signing(format!("{field} must not be empty when enabled"));
-    }
-    if values.iter().any(|value| value.trim().is_empty()) {
-        return invalid_access_token_signing(format!("{field} must not contain blank entries"));
-    }
-    Ok(())
-}
diff --git a/crates/registry-notary-core/src/config/root.rs b/crates/registry-notary-core/src/config/root.rs
deleted file mode 100644
index dec0d6c4a..000000000
--- a/crates/registry-notary-core/src/config/root.rs
+++ /dev/null
@@ -1,813 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Root Registry Notary configuration and cross-domain validation.
-
-use super::*;
-use registry_platform_httputil::destination::MAX_SERVICE_HOP_OPERATION_TIMEOUT;
-
-pub(super) const PKCE_METHOD_S256: &str = "S256";
-const RELAY_SERVICE_HOP_REQUEST_RESERVE: Duration = Duration::from_secs(5);
-const MIN_RELAY_OUTER_REQUEST_TIMEOUT: Duration = Duration::from_secs(
-    MAX_SERVICE_HOP_OPERATION_TIMEOUT.as_secs() + RELAY_SERVICE_HOP_REQUEST_RESERVE.as_secs(),
-);
-
-/// Non-EdDSA signing algorithms accepted for credential-profile signing.
-/// Access-token and federation signing stay EdDSA; `validate_signing_key_alg_usage`
-/// enforces that separation.
-pub const CREDENTIAL_SIGNING_ALG_ES256: &str = "ES256";
-pub const CLIENT_ASSERTION_SIGNING_ALG_RS256: &str = "RS256";
-
-#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct StandaloneRegistryNotaryConfig {
-    #[serde(default, skip_serializing_if = "instance_config_is_default")]
-    pub instance: NotaryInstanceConfig,
-    #[serde(default)]
-    pub server: RegistryNotaryHttpConfig,
-    pub evidence: EvidenceConfig,
-    pub auth: EvidenceAuthConfig,
-    #[serde(default)]
-    pub audit: EvidenceAuditConfig,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub config_trust: Option<ConfigTrustConfig>,
-    #[serde(default, skip_serializing_if = "state_config_is_default")]
-    pub state: StateConfig,
-    #[serde(default, skip_serializing_if = "credential_status_config_is_default")]
-    pub credential_status: CredentialStatusConfig,
-    #[serde(default, skip_serializing_if = "registry_notary_cel_config_is_default")]
-    pub cel: RegistryNotaryCelConfig,
-    #[serde(default, skip_serializing_if = "subject_access_config_is_default")]
-    pub subject_access: SubjectAccessConfig,
-    #[serde(default, skip_serializing_if = "oid4vci_config_is_default")]
-    pub oid4vci: Oid4vciConfig,
-    #[serde(default, skip_serializing_if = "federation_config_is_default")]
-    pub federation: FederationConfig,
-    #[serde(default, skip_serializing_if = "DeploymentConfig::is_default")]
-    pub deployment: DeploymentConfig,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct NotaryInstanceConfig {
-    #[serde(default = "default_instance_id")]
-    pub id: String,
-    #[serde(default = "default_instance_environment")]
-    pub environment: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub owner: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub jurisdiction: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub public_base_url: Option<String>,
-}
-
-/// Optional governed-configuration local trust state.
-///
-/// Simple local deployments omit this block. Signed/governed apply requires it
-/// so anti-rollback state lives in an explicit durable location.
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct ConfigTrustConfig {
-    pub trust_anchor_path: PathBuf,
-    pub bundle_path: PathBuf,
-    pub antirollback_state_path: PathBuf,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub break_glass_override_path: Option<PathBuf>,
-}
-
-impl Default for NotaryInstanceConfig {
-    fn default() -> Self {
-        Self {
-            id: default_instance_id(),
-            environment: default_instance_environment(),
-            owner: None,
-            jurisdiction: None,
-            public_base_url: None,
-        }
-    }
-}
-
-pub(super) fn instance_config_is_default(config: &NotaryInstanceConfig) -> bool {
-    config == &NotaryInstanceConfig::default()
-}
-
-pub(super) fn default_instance_id() -> String {
-    "registry-notary-standalone".to_string()
-}
-
-pub(super) fn default_instance_environment() -> String {
-    "development".to_string()
-}
-
-impl StandaloneRegistryNotaryConfig {
-    pub fn validate(&self) -> Result<(), EvidenceConfigError> {
-        if !self.evidence.enabled {
-            return Err(EvidenceConfigError::EvidenceDisabled);
-        }
-        self.server.validate()?;
-        self.server
-            .admin_listener
-            .validate(self.server.bind, self.config_trust.is_some())?;
-        if let Some(config_trust) = &self.config_trust {
-            if config_trust.trust_anchor_path.as_os_str().is_empty() {
-                return Err(EvidenceConfigError::InvalidConfigTrustConfig {
-                    reason: "config_trust.trust_anchor_path must not be empty".to_string(),
-                });
-            }
-            if config_trust.bundle_path.as_os_str().is_empty() {
-                return Err(EvidenceConfigError::InvalidConfigTrustConfig {
-                    reason: "config_trust.bundle_path must not be empty".to_string(),
-                });
-            }
-            if config_trust.antirollback_state_path.as_os_str().is_empty() {
-                return Err(EvidenceConfigError::InvalidConfigTrustConfig {
-                    reason: "config_trust.antirollback_state_path must not be empty".to_string(),
-                });
-            }
-            if config_trust
-                .break_glass_override_path
-                .as_ref()
-                .is_some_and(|path| path.as_os_str().is_empty())
-            {
-                return Err(EvidenceConfigError::InvalidConfigTrustConfig {
-                    reason: "config_trust.break_glass_override_path must not be empty when set"
-                        .to_string(),
-                });
-            }
-        }
-        self.state
-            .validate(&self.deployment, self.oid4vci.pre_authorized_code.enabled)?;
-        validate_static_credential_ids(&self.auth.api_keys, &self.auth.bearer_tokens)?;
-        if self.auth.api_keys.is_empty()
-            && self.auth.bearer_tokens.is_empty()
-            && self.auth.oidc.is_none()
-        {
-            return Err(EvidenceConfigError::NoCredentialsConfigured);
-        }
-        if let Some(oidc) = &self.auth.oidc {
-            if !self.auth.bearer_tokens.is_empty() {
-                return Err(EvidenceConfigError::InvalidOidcConfig {
-                    reason: "auth.bearer_tokens cannot be combined with auth.oidc because both use Authorization: Bearer"
-                        .to_string(),
-                });
-            }
-            oidc.validate()?;
-        }
-        self.evidence.concurrency.validate()?;
-        self.evidence.machine_quota.validate()?;
-        self.evidence.validate_batch_limits()?;
-        if let Some(relay) = &self.evidence.relay {
-            relay.validate(self.deployment.profile)?;
-            if self.evidence.claims.is_empty() {
-                return Err(EvidenceConfigError::InvalidRelayConfig {
-                    reason: "evidence.relay requires at least one registry_backed claim"
-                        .to_string(),
-                });
-            }
-            if self.server.request_timeout < MIN_RELAY_OUTER_REQUEST_TIMEOUT {
-                return Err(EvidenceConfigError::InvalidRelayConfig {
-                    reason: "server.request_timeout must be at least 30 seconds for registry_backed claims, reserving 5 seconds outside the fixed 25-second Relay service hop"
-                        .to_string(),
-                });
-            }
-        }
-        self.cel.validate()?;
-        if self.evidence.max_credential_validity_seconds == 0 {
-            return Err(EvidenceConfigError::InvalidCredentialProfileValidity {
-                profile: "*".to_string(),
-                validity_seconds: self.evidence.max_credential_validity_seconds as i64,
-                max_validity_seconds: self.evidence.max_credential_validity_seconds,
-            });
-        }
-        if self
-            .evidence
-            .allowed_purposes
-            .iter()
-            .any(|purpose| purpose.trim().is_empty())
-        {
-            return Err(EvidenceConfigError::InvalidPurpose);
-        }
-        if self.evidence.variables.len() > MAX_REQUEST_VARIABLES_V1 {
-            return Err(EvidenceConfigError::InvalidRequestVariableConfig {
-                reason: format!(
-                    "at most {MAX_REQUEST_VARIABLES_V1} request variables may be declared"
-                ),
-            });
-        }
-        for (name, variable) in &self.evidence.variables {
-            if !is_request_variable_name(name)
-                || variable.from != format!("request.variables.{name}")
-                || variable.value_type != RequestVariableType::Date
-            {
-                return Err(EvidenceConfigError::InvalidRequestVariableConfig {
-                    reason: "v1 variables must use a stable name, the exact matching request.variables path, and type date"
-                        .to_string(),
-                });
-            }
-        }
-        self.credential_status.validate()?;
-        validate_claim_dependency_bounds(&self.evidence.claims)?;
-        let mut seen_claim_ids: HashSet<&str> = HashSet::new();
-        for claim in &self.evidence.claims {
-            if claim.id.trim().is_empty() {
-                return Err(EvidenceConfigError::InvalidClaim);
-            }
-            // REQ-DM-CLAIM-001: reject a duplicate claim id at load rather
-            // than letting a later claim silently shadow an earlier one.
-            if !seen_claim_ids.insert(claim.id.as_str()) {
-                return Err(EvidenceConfigError::DuplicateClaimId {
-                    claim: claim.id.clone(),
-                });
-            }
-            validate_claim_semantics(claim)?;
-            validate_claim_value_config(claim)?;
-            validate_claim_evidence_mode(claim, self.evidence.relay.is_some())?;
-            // REQ-DM-CLAIM-008: reject a disclosure default outside the
-            // allowed set at load; this is the most consequential of the
-            // three RS-DM-CLAIM Section 10 gaps because a privacy-sensitive
-            // claim could otherwise load with an internally inconsistent
-            // disclosure policy that only fails on first render.
-            if !claim
-                .disclosure
-                .allowed
-                .iter()
-                .any(|mode| mode == &claim.disclosure.default)
-            {
-                return Err(EvidenceConfigError::ClaimDisclosureDefaultNotAllowed {
-                    claim: claim.id.clone(),
-                    default: claim.disclosure.default.clone(),
-                    allowed: claim.disclosure.allowed.clone(),
-                });
-            }
-            // REQ-DM-CLAIM-009: omitted formats deserialize to the canonical
-            // claim-result representation, but an authored empty list cannot
-            // render any response and must fail before startup. The response
-            // format set is closed: credential issuance formats do not render
-            // evaluation responses.
-            if claim.formats.is_empty() {
-                return Err(EvidenceConfigError::EmptyClaimFormats {
-                    claim: claim.id.clone(),
-                });
-            }
-            for format in &claim.formats {
-                if format != FORMAT_CLAIM_RESULT_JSON && format != FORMAT_CCCEV_JSONLD {
-                    return Err(EvidenceConfigError::UnsupportedClaimFormat {
-                        claim: claim.id.clone(),
-                        format: format.clone(),
-                    });
-                }
-            }
-            if !claim
-                .formats
-                .iter()
-                .any(|format| format == FORMAT_CLAIM_RESULT_JSON)
-            {
-                return Err(EvidenceConfigError::MissingCanonicalClaimFormat {
-                    claim: claim.id.clone(),
-                });
-            }
-        }
-        // Registry Notary currently resolves holder material only from
-        // did:jwk. Reject any other configured method so discovery metadata
-        // cannot advertise support that issuance cannot satisfy.
-        self.evidence.validate_signing_keys()?;
-        for (profile_id, profile) in &self.evidence.credential_profiles {
-            validate_credential_profile_validity(
-                profile_id,
-                profile,
-                self.evidence.max_credential_validity_seconds,
-            )?;
-            if profile.format != FORMAT_SD_JWT_VC {
-                return Err(EvidenceConfigError::UnsupportedCredentialProfileFormat {
-                    profile: profile_id.clone(),
-                    format: profile.format.clone(),
-                });
-            }
-            let unsupported: Vec<String> = profile
-                .holder_binding
-                .allowed_did_methods
-                .iter()
-                .filter(|m| m.as_str() != SD_JWT_VC_HOLDER_BINDING_METHOD)
-                .cloned()
-                .collect();
-            if !unsupported.is_empty() {
-                return Err(
-                    EvidenceConfigError::UnsupportedCredentialProfileDidMethods {
-                        profile: profile_id.clone(),
-                        methods: unsupported,
-                    },
-                );
-            }
-            // An empty allowed_claims short-circuits the issuance-time filter
-            // in api.rs (`is_empty()` means "any claim allowed"). Require
-            // operators to enumerate the claims a profile may bind to. A list
-            // composed only of blank entries is treated the same as empty so
-            // operators cannot trip the short-circuit via `[""]`.
-            if profile
-                .allowed_claims
-                .iter()
-                .all(|claim| claim.trim().is_empty())
-            {
-                return Err(EvidenceConfigError::EmptyAllowedClaims {
-                    profile: profile_id.clone(),
-                });
-            }
-            let key = self
-                .evidence
-                .signing_keys
-                .get(profile.signing_key.as_str())
-                .ok_or_else(|| EvidenceConfigError::UnknownCredentialProfileSigningKey {
-                    profile: profile_id.clone(),
-                    key: profile.signing_key.clone(),
-                })?;
-            if !key.status.may_sign() {
-                return Err(EvidenceConfigError::CredentialProfileSigningKeyNotActive {
-                    profile: profile_id.clone(),
-                    key: profile.signing_key.clone(),
-                });
-            }
-            validate_profile_signing_key_issuer_binding(profile_id, profile, key)?;
-        }
-        // Finding 8: detect cycles in the depends_on graph using DFS with
-        // grey (in-progress) and black (done) sets.
-        let claim_ids: HashSet<&str> = self.evidence.claims.iter().map(|c| c.id.as_str()).collect();
-        for claim in &self.evidence.claims {
-            for dep in &claim.depends_on {
-                if !claim_ids.contains(dep.as_str()) {
-                    return Err(EvidenceConfigError::DependsOnUnknownClaim {
-                        claim: claim.id.clone(),
-                        unknown: dep.clone(),
-                    });
-                }
-            }
-        }
-        let mut grey: HashSet<String> = HashSet::new();
-        let mut black: HashSet<String> = HashSet::new();
-        for claim in &self.evidence.claims {
-            if !black.contains(&claim.id) {
-                detect_depends_on_cycle(
-                    &self.evidence.claims,
-                    &claim.id,
-                    &mut grey,
-                    &mut black,
-                    &mut Vec::new(),
-                )?;
-            }
-        }
-        validate_relay_activation_shape(&self.evidence.claims)?;
-        self.subject_access.validate(&self.auth, &self.evidence)?;
-        self.validate_oid4vci_cross_block()?;
-        validate_credential_claim_bindings(&self.evidence)?;
-        self.validate_access_token_signing_cross_block()?;
-        self.federation.validate(&self.evidence)?;
-        self.validate_signing_key_alg_usage()?;
-        self.deployment.validate().map_err(|error| {
-            EvidenceConfigError::InvalidDeploymentConfig {
-                reason: error.to_string(),
-            }
-        })?;
-        self.validate_audit_ack_cursor()?;
-        Ok(())
-    }
-
-    /// Validate the off-host ack cursor configuration against the audit sink.
-    ///
-    /// A freshness window with no cursor to read is meaningless, and pointing a
-    /// cursor at a local file sink that does not declare off-host shipping
-    /// asserts observed shipping that the operator never attested. Both are
-    /// config errors so the contradiction is caught at load, not papered over.
-    fn validate_audit_ack_cursor(&self) -> Result<(), EvidenceConfigError> {
-        let evidence = &self.deployment.evidence;
-        if evidence.audit_ack_max_age_secs.is_some() && evidence.audit_ack_cursor_path.is_none() {
-            return Err(EvidenceConfigError::AuditAckMaxAgeWithoutCursor);
-        }
-        if evidence.audit_ack_cursor_path.is_some()
-            && matches!(self.audit.sink.as_str(), "file" | "jsonl")
-            && !evidence.audit_offhost_shipping
-        {
-            return Err(EvidenceConfigError::AuditAckCursorWithoutShippingDeclared);
-        }
-        Ok(())
-    }
-
-    pub fn validate_governed_runtime(&self) -> Result<(), EvidenceConfigError> {
-        self.validate()?;
-        self.server.admin_listener.validate(self.server.bind, true)
-    }
-
-    /// Snapshot the configuration facts the deployment gate engine reads.
-    ///
-    /// Boot-time projection is configuration-only. A configured cursor clears
-    /// the static shipping-unverified gate, while runtime readiness and posture
-    /// must sample and bind it before shipping-stale clears. Keeping filesystem
-    /// I/O out of this path prevents startup from blocking on a stalled mount.
-    pub fn gate_input(&self) -> crate::deployment::GateInput {
-        self.gate_input_with_ack_observation(&registry_platform_ops::AckObservation::unverified())
-    }
-
-    /// Read the current off-host shipping cursor once for callers that need to
-    /// project both deployment gates and posture from the same observation.
-    pub fn audit_ack_observation(&self) -> registry_platform_ops::AckObservation {
-        self.audit_ack_observation_at(SystemTime::now())
-    }
-
-    /// Deterministic form of [`Self::audit_ack_observation`] for tests.
-    pub fn audit_ack_observation_at(
-        &self,
-        now: SystemTime,
-    ) -> registry_platform_ops::AckObservation {
-        registry_platform_ops::evaluate_ack_health(
-            self.deployment.evidence.audit_ack_cursor_path(),
-            now,
-            self.deployment.evidence.audit_ack_max_age(),
-        )
-    }
-
-    /// Snapshot gate facts as of `now`, including a synchronous cursor read.
-    ///
-    /// `now` is threaded through so cursor contract tests and offline commands
-    /// can evaluate freshness deterministically. Public runtime handlers use a
-    /// bounded async worker instead of this synchronous path.
-    pub fn gate_input_at(&self, now: SystemTime) -> crate::deployment::GateInput {
-        let ack_observation = self.audit_ack_observation_at(now);
-        self.gate_input_with_ack_observation(&ack_observation)
-    }
-
-    /// Project gate facts using an already sampled shipping observation.
-    /// Keeping filesystem I/O outside the pure projection lets one HTTP response
-    /// use a single cursor snapshot for its gate and posture fields.
-    pub fn gate_input_with_ack_observation(
-        &self,
-        ack_observation: &registry_platform_ops::AckObservation,
-    ) -> crate::deployment::GateInput {
-        crate::deployment::GateInput {
-            state_in_memory: self.state.storage == STATE_STORAGE_IN_MEMORY,
-            federation_enabled: self.federation.enabled,
-            oid4vci_preauth_enabled: self.oid4vci.enabled
-                && self.oid4vci.pre_authorized_code.enabled,
-            holder_proof_required: self.evidence.credential_profiles.values().any(|profile| {
-                profile.holder_binding.proof_of_possession.as_deref() == Some("required")
-            }),
-            wallet_facing: self.subject_access.enabled,
-            multi_instance: self.deployment.multi_instance,
-            audit_sink_class_durable: audit_sink_is_durable(&self.audit),
-            // A local file sink caps retention to whatever the host disk
-            // holds; an attacker with host access can destroy it. stdout and
-            // syslog are exempt: their retention is owned by the orchestrator
-            // log pipeline or the syslog daemon's own forwarding surface.
-            audit_retention_local_only: matches!(self.audit.sink.as_str(), "file" | "jsonl")
-                && !self.deployment.evidence.audit_offhost_shipping,
-            audit_shipping_target_configured: matches!(
-                self.audit.sink.as_str(),
-                "stdout" | "syslog"
-            ) || (matches!(
-                self.audit.sink.as_str(),
-                "file" | "jsonl"
-            ) && self
-                .deployment
-                .evidence
-                .audit_offhost_shipping),
-            audit_ack_cursor_configured: self.deployment.evidence.audit_ack_cursor_path().is_some(),
-            audit_ack_health_ok: ack_observation.health == registry_platform_ops::AckHealth::Ok,
-            admin_shared_exposure: self.server.admin_listener.mode
-                == RegistryNotaryAdminListenerMode::SharedWithPublic,
-            openapi_public: !self.server.openapi_requires_auth,
-            config_unsigned: self.config_trust.is_none(),
-            subject_access_enabled: self.subject_access.enabled,
-            transaction_token_anchor_configured: self.auth.access_token_signing.enabled,
-            // DPoP/mTLS proof validation for transaction tokens is not yet
-            // implemented. Keep this explicit so production/evidence profiles
-            // surface the missing sender-constraint assurance.
-            transaction_token_sender_constrained: false,
-            signer_without_custody_approval: !self.deployment.evidence.signer_custody_approved
-                && self.custody_scoped_signing_key_ids().iter().any(|key_id| {
-                    self.evidence
-                        .signing_keys
-                        .get(*key_id)
-                        .is_some_and(|key| key.status.may_sign())
-                }),
-        }
-    }
-
-    /// Signing-key ids used to issue credentials or access tokens, or to sign
-    /// federation responses. These are the custody-relevant Notary roles. The
-    /// eSignet RP client key is intentionally excluded because it signs an
-    /// outbound client assertion rather than a Notary-issued artifact.
-    pub fn custody_scoped_signing_key_ids(&self) -> HashSet<&str> {
-        let mut scoped: HashSet<&str> = self
-            .evidence
-            .credential_profiles
-            .values()
-            .map(|profile| profile.signing_key.as_str())
-            .collect();
-        if self.auth.access_token_signing.enabled {
-            let access_token_key = self.auth.access_token_signing.signing_key_id.as_str();
-            if !access_token_key.is_empty() {
-                scoped.insert(access_token_key);
-            }
-        }
-        if self.federation.enabled {
-            let federation_key = self.federation.signing.signing_key.as_str();
-            if !federation_key.is_empty() {
-                scoped.insert(federation_key);
-            }
-        }
-        scoped
-    }
-
-    /// Signing-key ids whose resolved public material must not be shared, per
-    /// issue #173. These are the separated signing roles: every credential
-    /// profile signing key, the access-token signing key (when enabled), and the
-    /// federation signing key (when enabled). The eSignet pre-authorized-code RP
-    /// client key is intentionally excluded: it is a separate role that is
-    /// allowed to reuse the credential issuer's key material.
-    pub fn reuse_scoped_signing_key_ids(&self) -> HashSet<&str> {
-        self.custody_scoped_signing_key_ids()
-    }
-
-    /// Confine ES256 signing keys to credential profiles and confine RS256 to
-    /// the eSignet pre-authorized-code RP client assertion. Access-token
-    /// signing and federation signing must reference EdDSA keys.
-    fn validate_signing_key_alg_usage(&self) -> Result<(), EvidenceConfigError> {
-        for (key_id, key) in &self.evidence.signing_keys {
-            if key.alg == CREDENTIAL_SIGNING_ALG_EDDSA {
-                continue;
-            }
-            if self.auth.access_token_signing.signing_key_id == *key_id {
-                return invalid_signing_key(
-                    key_id,
-                    "non-EdDSA signing key is used as the access-token signing key \
-                     (auth.access_token_signing.signing_key_id); non-EdDSA signing keys may only \
-                     be used by credential profiles or as the eSignet pre-authorized-code RP \
-                     client assertion key (oid4vci.pre_authorized_code.esignet.client_signing_key_id)",
-                );
-            }
-            if self.federation.signing.signing_key == *key_id {
-                return invalid_signing_key(
-                    key_id,
-                    "non-EdDSA signing key is used as the federation signing key \
-                     (federation.signing.signing_key); non-EdDSA signing keys may only be used by \
-                     credential profiles or as the eSignet pre-authorized-code RP client assertion \
-                     key (oid4vci.pre_authorized_code.esignet.client_signing_key_id)",
-                );
-            }
-            if key.alg == CLIENT_ASSERTION_SIGNING_ALG_RS256
-                && self
-                    .evidence
-                    .credential_profiles
-                    .values()
-                    .any(|profile| profile.signing_key == *key_id)
-            {
-                return invalid_signing_key(
-                    key_id,
-                    "RS256 signing key is used by a credential profile; credential profile \
-                     signing keys must use EdDSA or ES256, and RS256 is reserved for the eSignet \
-                     pre-authorized-code RP client assertion key \
-                     (oid4vci.pre_authorized_code.esignet.client_signing_key_id)",
-                );
-            }
-        }
-        Ok(())
-    }
-
-    fn validate_oid4vci_cross_block(&self) -> Result<(), EvidenceConfigError> {
-        self.oid4vci.validate(
-            &self.subject_access,
-            &self.evidence,
-            &self.credential_status,
-        )
-    }
-
-    fn validate_access_token_signing_cross_block(&self) -> Result<(), EvidenceConfigError> {
-        let signing = &self.auth.access_token_signing;
-        if !signing.enabled {
-            return Ok(());
-        }
-        if signing.issuer.trim().is_empty() {
-            return invalid_access_token_signing("issuer must not be empty when enabled");
-        }
-        validate_access_token_signing_entries("audiences", &signing.audiences)?;
-        if signing.allowed_algorithms.is_empty()
-            || signing
-                .allowed_algorithms
-                .iter()
-                .any(|alg| alg != CREDENTIAL_SIGNING_ALG_EDDSA)
-        {
-            return invalid_access_token_signing(format!(
-                "allowed_algorithms must list only {CREDENTIAL_SIGNING_ALG_EDDSA}"
-            ));
-        }
-        if signing.token_typ.trim().is_empty() {
-            return invalid_access_token_signing("token_typ must not be empty when enabled");
-        }
-        // The access-token `typ` must differ from the pre-authorized-code `typ`,
-        // or a pre-authorized code would also verify as an access token (the two
-        // are distinguished only by header `typ`).
-        if signing.token_typ == crate::tokens::PRE_AUTHORIZED_CODE_JWT_TYP {
-            return invalid_access_token_signing(format!(
-                "token_typ must not equal the pre-authorized-code typ '{}'",
-                crate::tokens::PRE_AUTHORIZED_CODE_JWT_TYP
-            ));
-        }
-        if signing.access_token_ttl_seconds == 0 || signing.access_token_ttl_seconds > 600 {
-            return invalid_access_token_signing(
-                "access_token_ttl_seconds must be between 1 and 600",
-            );
-        }
-        if signing.signing_key_id.trim().is_empty() {
-            return invalid_access_token_signing("signing_key_id must not be empty when enabled");
-        }
-        let key = self
-            .evidence
-            .signing_keys
-            .get(signing.signing_key_id.as_str())
-            .ok_or_else(|| EvidenceConfigError::InvalidAccessTokenSigningConfig {
-                reason: format!(
-                    "signing_key_id '{}' must reference an evidence.signing_keys entry",
-                    signing.signing_key_id
-                ),
-            })?;
-        if !key.status.may_sign() {
-            return invalid_access_token_signing(format!(
-                "signing_key_id '{}' must be an active signing key",
-                signing.signing_key_id
-            ));
-        }
-        // The access-token key MUST be distinct from every credential-signing
-        // key so a confusion or compromise of one is not the other.
-        for (profile_id, profile) in &self.evidence.credential_profiles {
-            if profile.signing_key == signing.signing_key_id {
-                return invalid_access_token_signing(format!(
-                    "signing_key_id '{}' must be distinct from credential profile '{profile_id}' signing key",
-                    signing.signing_key_id
-                ));
-            }
-        }
-        let mut verification_keys = std::collections::BTreeSet::new();
-        for key_id in &signing.verification_key_ids {
-            if key_id.trim().is_empty() {
-                return invalid_access_token_signing(
-                    "verification_key_ids must not contain blank entries",
-                );
-            }
-            if key_id == &signing.signing_key_id {
-                return invalid_access_token_signing(format!(
-                    "verification_key_ids must not repeat active signing_key_id '{}'",
-                    signing.signing_key_id
-                ));
-            }
-            if !verification_keys.insert(key_id.as_str()) {
-                return invalid_access_token_signing(format!(
-                    "verification_key_ids contains duplicate key '{key_id}'"
-                ));
-            }
-            let key = self.evidence.signing_keys.get(key_id).ok_or_else(|| {
-                EvidenceConfigError::InvalidAccessTokenSigningConfig {
-                    reason: format!(
-                        "verification_key_ids entry '{key_id}' must reference an evidence.signing_keys entry"
-                    ),
-                }
-            })?;
-            if !key.status.may_publish() || key.status.may_sign() {
-                return invalid_access_token_signing(format!(
-                    "verification_key_ids entry '{key_id}' must be a publish_only signing key"
-                ));
-            }
-            if key.alg != CREDENTIAL_SIGNING_ALG_EDDSA {
-                return invalid_access_token_signing(format!(
-                    "verification_key_ids entry '{key_id}' must use {CREDENTIAL_SIGNING_ALG_EDDSA}"
-                ));
-            }
-            for (profile_id, profile) in &self.evidence.credential_profiles {
-                if profile.signing_key == *key_id {
-                    return invalid_access_token_signing(format!(
-                        "verification_key_ids entry '{key_id}' must be distinct from credential profile '{profile_id}' signing key"
-                    ));
-                }
-            }
-        }
-        Ok(())
-    }
-}
-
-/// Close both sides of every credential claim/profile binding at load time.
-///
-/// A credential profile is a signing capability. Keeping this validation at
-/// the shared root prevents direct issuance, subject-access issuance, and
-/// OID4VCI from interpreting a one-sided binding differently.
-fn validate_credential_claim_bindings(
-    evidence: &EvidenceConfig,
-) -> Result<(), EvidenceConfigError> {
-    for (profile_id, profile) in &evidence.credential_profiles {
-        for claim_id in &profile.allowed_claims {
-            let claim = evidence
-                .claims
-                .iter()
-                .find(|claim| claim.id == *claim_id)
-                .ok_or_else(|| EvidenceConfigError::InvalidCredentialClaimBinding {
-                    reason: format!(
-                        "credential profile '{profile_id}' allowed_claims references unknown claim '{claim_id}'"
-                    ),
-                })?;
-            if !claim
-                .credential_profiles
-                .iter()
-                .any(|candidate| candidate == profile_id)
-            {
-                return Err(EvidenceConfigError::InvalidCredentialClaimBinding {
-                    reason: format!(
-                        "credential profile '{profile_id}' allows claim '{claim_id}', but the claim does not reference that profile"
-                    ),
-                });
-            }
-            let mut pending = claim
-                .depends_on
-                .iter()
-                .map(String::as_str)
-                .collect::<Vec<_>>();
-            let mut visited = HashSet::new();
-            while let Some(dependency_id) = pending.pop() {
-                if !visited.insert(dependency_id) {
-                    continue;
-                }
-                let dependency = evidence
-                    .claims
-                    .iter()
-                    .find(|candidate| candidate.id == dependency_id)
-                    .ok_or_else(|| EvidenceConfigError::InvalidCredentialClaimBinding {
-                        reason: format!(
-                            "credential profile '{profile_id}' claim '{claim_id}' dependency closure references unknown claim '{dependency_id}'"
-                        ),
-                    })?;
-                if dependency.purpose != claim.purpose {
-                    return Err(EvidenceConfigError::InvalidCredentialClaimBinding {
-                        reason: format!(
-                            "credential profile '{profile_id}' claim '{claim_id}' dependency '{dependency_id}' must declare the same canonical purpose"
-                        ),
-                    });
-                }
-                pending.extend(dependency.depends_on.iter().map(String::as_str));
-            }
-        }
-    }
-
-    for claim in &evidence.claims {
-        for profile_id in &claim.credential_profiles {
-            let profile = evidence
-                .credential_profiles
-                .get(profile_id)
-                .ok_or_else(|| EvidenceConfigError::InvalidCredentialClaimBinding {
-                    reason: format!(
-                        "claim '{}' references unknown credential profile '{profile_id}'",
-                        claim.id
-                    ),
-                })?;
-            if !profile
-                .allowed_claims
-                .iter()
-                .any(|candidate| candidate == &claim.id)
-            {
-                return Err(EvidenceConfigError::InvalidCredentialClaimBinding {
-                    reason: format!(
-                        "claim '{}' references credential profile '{profile_id}', but the profile allowed_claims does not include that claim",
-                        claim.id
-                    ),
-                });
-            }
-        }
-    }
-    Ok(())
-}
-
-pub(super) fn validate_static_credential_ids(
-    api_keys: &[EvidenceCredentialConfig],
-    bearer_tokens: &[EvidenceCredentialConfig],
-) -> Result<(), EvidenceConfigError> {
-    let mut ids = HashSet::with_capacity(api_keys.len() + bearer_tokens.len());
-    for (field, credentials) in [
-        ("auth.api_keys", api_keys),
-        ("auth.bearer_tokens", bearer_tokens),
-    ] {
-        for credential in credentials {
-            if ids.insert(credential.id.as_str()) {
-                continue;
-            }
-            return Err(EvidenceConfigError::InvalidAuthConfig {
-                reason: format!("{field} contains duplicate id '{}'", credential.id),
-            });
-        }
-    }
-    Ok(())
-}
-
-pub fn deprecated_config_fields() -> Vec<DeprecatedConfigField> {
-    vec![
-        DeprecatedConfigField::renamed("auth.oidc.jwks_uri", "auth.oidc.jwks_url"),
-        DeprecatedConfigField::renamed("auth.oidc.leeway_seconds", "auth.oidc.leeway"),
-        DeprecatedConfigField::renamed("auth.oidc.allowed_typ", "auth.oidc.allowed_token_types"),
-        DeprecatedConfigField::renamed("audit.max_size_bytes", "audit.max_size_mb"),
-        DeprecatedConfigField::removed(
-            "server.cors.allow_credentials",
-            "Notary now always disables credentialed CORS; remove the field",
-        ),
-    ]
-}
diff --git a/crates/registry-notary-core/src/config/schema.rs b/crates/registry-notary-core/src/config/schema.rs
deleted file mode 100644
index 16fa870f2..000000000
--- a/crates/registry-notary-core/src/config/schema.rs
+++ /dev/null
@@ -1,204 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Reproducible Draft 2020-12 schema for the complete Notary runtime config.
-
-#![allow(
-    dead_code,
-    reason = "schema adapter types are compile-time descriptions and are never constructed"
-)]
-
-use std::borrow::Cow;
-
-use registry_platform_authcommon::CredentialFingerprintProvider;
-use schemars::{generate::SchemaSettings, json_schema, JsonSchema, Schema, SchemaGenerator};
-use serde_json::{json, Value};
-
-use super::{SigningKeyProviderConfig, SigningKeyStatus, StandaloneRegistryNotaryConfig};
-
-/// Stable identifier for the product-owned Notary runtime configuration schema.
-pub const CONFIG_SCHEMA_ID: &str =
-    "https://id.registrystack.org/schemas/registry-notary/registry-notary.config.schema.json";
-
-/// Schema-only deployment-waiver reference contract shared with posture.
-pub(crate) struct DeploymentWaiverReferenceSchema;
-
-impl JsonSchema for DeploymentWaiverReferenceSchema {
-    fn schema_name() -> Cow<'static, str> {
-        "DeploymentWaiverReference".into()
-    }
-
-    fn json_schema(_: &mut SchemaGenerator) -> Schema {
-        registry_platform_ops::deployment_waiver_reference_schema_fragment()
-            .try_into()
-            .expect("the shared waiver-reference fragment is a valid JSON Schema")
-    }
-}
-
-/// Schema-only structural deployment-waiver summary contract shared with posture.
-pub(crate) struct DeploymentWaiverSummarySchema;
-
-impl JsonSchema for DeploymentWaiverSummarySchema {
-    fn schema_name() -> Cow<'static, str> {
-        "DeploymentWaiverSummary".into()
-    }
-
-    fn json_schema(_: &mut SchemaGenerator) -> Schema {
-        registry_platform_ops::deployment_waiver_summary_schema_fragment()
-            .try_into()
-            .expect("the shared waiver-summary fragment is a valid JSON Schema")
-    }
-}
-
-/// Schema-only contract for values parsed by `humantime_serde`.
-pub(crate) struct HumantimeDurationSchema;
-
-impl JsonSchema for HumantimeDurationSchema {
-    fn schema_name() -> Cow<'static, str> {
-        "HumantimeDuration".into()
-    }
-
-    fn json_schema(_: &mut SchemaGenerator) -> Schema {
-        json_schema!({
-            "description": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
-            "type": "string"
-        })
-    }
-}
-
-/// Schema-only contract for YAML socket addresses parsed by `SocketAddr`.
-pub(crate) struct SocketAddrSchema;
-
-impl JsonSchema for SocketAddrSchema {
-    fn schema_name() -> Cow<'static, str> {
-        "SocketAddr".into()
-    }
-
-    fn json_schema(_: &mut SchemaGenerator) -> Schema {
-        json_schema!({
-            "description": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.",
-            "type": "string"
-        })
-    }
-}
-
-/// Schema-only contract for `IpNet` CIDR values.
-pub(crate) struct IpNetSchema;
-
-impl JsonSchema for IpNetSchema {
-    fn schema_name() -> Cow<'static, str> {
-        "IpNet".into()
-    }
-
-    fn json_schema(_: &mut SchemaGenerator) -> Schema {
-        json_schema!({
-            "description": "An IP network CIDR string. The runtime parser remains authoritative for address and prefix validity.",
-            "type": "string"
-        })
-    }
-}
-
-pub(crate) struct CredentialFingerprintSchema;
-
-impl JsonSchema for CredentialFingerprintSchema {
-    fn schema_name() -> Cow<'static, str> {
-        "CredentialFingerprintRef".into()
-    }
-
-    fn json_schema(_: &mut SchemaGenerator) -> Schema {
-        // `CredentialFingerprintRef` has a custom deserializer. It accepts
-        // either provider together with zero, one, or both optional references;
-        // doctor/runtime validation decides whether the selected provider has a
-        // usable, non-ambiguous reference. Keep that division of responsibility
-        // instead of making the schema stricter than deserialization.
-        json_schema!({
-            "type": "object",
-            "additionalProperties": false,
-            "required": ["provider"],
-            "properties": {
-                "provider": string_enum(CredentialFingerprintProvider::ALL.iter().map(|provider| provider.as_str())),
-                "name": { "type": ["string", "null"] },
-                "path": { "type": ["string", "null"] }
-            }
-        })
-    }
-}
-
-pub(crate) struct SigningKeyProviderSchema;
-
-impl JsonSchema for SigningKeyProviderSchema {
-    fn schema_name() -> Cow<'static, str> {
-        "SigningKeyProviderSchema".into()
-    }
-
-    fn json_schema(_: &mut SchemaGenerator) -> Schema {
-        string_enum(
-            SigningKeyProviderConfig::ALL
-                .iter()
-                .map(|provider| provider.as_str()),
-        )
-    }
-}
-
-pub(crate) struct SigningKeyStatusSchema;
-
-impl JsonSchema for SigningKeyStatusSchema {
-    fn schema_name() -> Cow<'static, str> {
-        "SigningKeyStatusSchema".into()
-    }
-
-    fn json_schema(_: &mut SchemaGenerator) -> Schema {
-        string_enum(SigningKeyStatus::ALL.iter().map(|status| status.as_str()))
-    }
-}
-
-fn string_enum(labels: impl Iterator<Item = &'static str>) -> Schema {
-    json!({
-        "type": "string",
-        "enum": labels.collect::<Vec<_>>()
-    })
-    .try_into()
-    .expect("a JSON object is always a valid JSON Schema")
-}
-
-/// Schema-only representation of the string-only consultation-input deserializer.
-pub(crate) struct RelayConsultationInputSchema;
-
-impl JsonSchema for RelayConsultationInputSchema {
-    fn schema_name() -> Cow<'static, str> {
-        "RelayConsultationInput".into()
-    }
-
-    fn json_schema(_: &mut SchemaGenerator) -> Schema {
-        json_schema!({
-            "description": "A supported consultation input path. The runtime parser remains authoritative for exact stable-name bounds.",
-            "type": "string",
-            "minLength": 1
-        })
-    }
-}
-
-/// Generate the deserialization contract for [`StandaloneRegistryNotaryConfig`].
-#[must_use]
-pub fn document() -> Value {
-    let schema = SchemaSettings::draft2020_12()
-        .into_generator()
-        .into_root_schema_for::<StandaloneRegistryNotaryConfig>();
-    let mut value = serde_json::to_value(schema).expect("JSON Schema serializes to JSON");
-    let root = value.as_object_mut().expect("root schema is an object");
-    root.insert(
-        "$id".to_string(),
-        Value::String(CONFIG_SCHEMA_ID.to_string()),
-    );
-    root.insert(
-        "title".to_string(),
-        Value::String("Registry Notary config".to_string()),
-    );
-    value
-}
-
-/// Serialize the generated schema deterministically with exactly one trailing LF.
-#[must_use]
-pub fn document_json() -> String {
-    let mut output = serde_json::to_string_pretty(&document()).expect("JSON Schema serializes");
-    output.push('\n');
-    output
-}
diff --git a/crates/registry-notary-core/src/config/state.rs b/crates/registry-notary-core/src/config/state.rs
deleted file mode 100644
index b08e5dcbe..000000000
--- a/crates/registry-notary-core/src/config/state.rs
+++ /dev/null
@@ -1,163 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Registry Notary correctness-state storage configuration.
-
-use super::*;
-
-pub const STATE_STORAGE_IN_MEMORY: &str = "in_memory";
-pub const STATE_STORAGE_POSTGRESQL: &str = "postgresql";
-pub const STATE_POSTGRESQL_MAX_CONNECTIONS: usize = 256;
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct StateConfig {
-    #[serde(default = "default_state_storage")]
-    pub storage: String,
-    #[serde(default, skip_serializing_if = "state_postgresql_config_is_default")]
-    pub postgresql: StatePostgresqlConfig,
-}
-
-impl Default for StateConfig {
-    fn default() -> Self {
-        Self {
-            storage: default_state_storage(),
-            postgresql: StatePostgresqlConfig::default(),
-        }
-    }
-}
-
-impl StateConfig {
-    pub(super) fn validate(
-        &self,
-        deployment: &DeploymentConfig,
-        preauthorization_enabled: bool,
-    ) -> Result<(), EvidenceConfigError> {
-        match self.storage.as_str() {
-            STATE_STORAGE_POSTGRESQL => {
-                validate_state_non_empty("state.postgresql.url_env", &self.postgresql.url_env)?;
-                if self.postgresql.connect_timeout_ms == 0 {
-                    return invalid_state(
-                        "state.postgresql.connect_timeout_ms must be greater than zero",
-                    );
-                }
-                if self.postgresql.operation_timeout_ms == 0 {
-                    return invalid_state(
-                        "state.postgresql.operation_timeout_ms must be greater than zero",
-                    );
-                }
-                if !(1..=STATE_POSTGRESQL_MAX_CONNECTIONS)
-                    .contains(&self.postgresql.max_connections)
-                {
-                    return invalid_state(
-                        "state.postgresql.max_connections must be between 1 and 256",
-                    );
-                }
-                if self
-                    .postgresql
-                    .root_certificate_path
-                    .as_ref()
-                    .is_some_and(|path| path.as_os_str().is_empty())
-                {
-                    return invalid_state(
-                        "state.postgresql.root_certificate_path must not be empty when set",
-                    );
-                }
-                if preauthorization_enabled {
-                    validate_state_non_empty(
-                        "state.postgresql.sensitive_state_key_env",
-                        &self.postgresql.sensitive_state_key_env,
-                    )?;
-                }
-                Ok(())
-            }
-            STATE_STORAGE_IN_MEMORY => {
-                if deployment.profile != Some(crate::deployment::DeploymentProfile::Local) {
-                    return invalid_state(
-                        "state.storage = in_memory requires deployment.profile = local",
-                    );
-                }
-                if deployment.multi_instance {
-                    return invalid_state(
-                        "state.storage = in_memory requires deployment.multi_instance = false",
-                    );
-                }
-                Ok(())
-            }
-            _ => invalid_state("state.storage must be postgresql or in_memory"),
-        }
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct StatePostgresqlConfig {
-    #[serde(default = "default_state_postgresql_url_env")]
-    pub url_env: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub root_certificate_path: Option<PathBuf>,
-    #[serde(default = "default_state_postgresql_connect_timeout_ms")]
-    pub connect_timeout_ms: u64,
-    #[serde(default = "default_state_postgresql_operation_timeout_ms")]
-    pub operation_timeout_ms: u64,
-    #[serde(default = "default_state_postgresql_max_connections")]
-    pub max_connections: usize,
-    #[serde(default = "default_sensitive_state_key_env")]
-    pub sensitive_state_key_env: String,
-}
-
-impl Default for StatePostgresqlConfig {
-    fn default() -> Self {
-        Self {
-            url_env: default_state_postgresql_url_env(),
-            root_certificate_path: None,
-            connect_timeout_ms: default_state_postgresql_connect_timeout_ms(),
-            operation_timeout_ms: default_state_postgresql_operation_timeout_ms(),
-            max_connections: default_state_postgresql_max_connections(),
-            sensitive_state_key_env: default_sensitive_state_key_env(),
-        }
-    }
-}
-
-pub(super) fn state_config_is_default(config: &StateConfig) -> bool {
-    config == &StateConfig::default()
-}
-
-pub(super) fn state_postgresql_config_is_default(config: &StatePostgresqlConfig) -> bool {
-    config == &StatePostgresqlConfig::default()
-}
-
-pub(super) fn default_state_storage() -> String {
-    STATE_STORAGE_POSTGRESQL.to_string()
-}
-
-pub(super) fn default_state_postgresql_url_env() -> String {
-    "REGISTRY_NOTARY_POSTGRES_URL".to_string()
-}
-
-pub(super) const fn default_state_postgresql_connect_timeout_ms() -> u64 {
-    5_000
-}
-
-pub(super) const fn default_state_postgresql_operation_timeout_ms() -> u64 {
-    2_000
-}
-
-pub(super) const fn default_state_postgresql_max_connections() -> usize {
-    16
-}
-
-pub(super) fn default_sensitive_state_key_env() -> String {
-    "REGISTRY_NOTARY_SENSITIVE_STATE_KEY".to_string()
-}
-
-fn validate_state_non_empty(field: &str, value: &str) -> Result<(), EvidenceConfigError> {
-    if value.trim().is_empty() {
-        return invalid_state(format!("{field} must not be empty"));
-    }
-    Ok(())
-}
-
-fn invalid_state<T>(reason: impl Into<String>) -> Result<T, EvidenceConfigError> {
-    Err(EvidenceConfigError::InvalidStateConfig {
-        reason: reason.into(),
-    })
-}
diff --git a/crates/registry-notary-core/src/config/subject_access.rs b/crates/registry-notary-core/src/config/subject_access.rs
deleted file mode 100644
index be9bc802a..000000000
--- a/crates/registry-notary-core/src/config/subject_access.rs
+++ /dev/null
@@ -1,1204 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Subject-bound and delegated subject-access configuration.
-
-use super::*;
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct SubjectAccessConfig {
-    #[serde(default)]
-    pub enabled: bool,
-    #[serde(default)]
-    pub subject_binding: SubjectAccessSubjectBindingConfig,
-    #[serde(default)]
-    pub citizen_clients: SubjectAccessCitizenClientsConfig,
-    #[serde(default)]
-    pub token_policy: SubjectAccessTokenPolicyConfig,
-    #[serde(default)]
-    pub allowed_operations: SubjectAccessOperationsConfig,
-    #[serde(default)]
-    pub allowed_purposes: Vec<String>,
-    #[serde(default)]
-    pub allowed_claims: Vec<String>,
-    #[serde(default)]
-    pub allowed_formats: Vec<String>,
-    #[serde(default)]
-    pub allowed_disclosures: Vec<String>,
-    #[serde(default)]
-    pub scope_policy: SubjectAccessScopePolicy,
-    #[serde(default)]
-    pub required_scopes: Vec<String>,
-    #[serde(default)]
-    pub allowed_wallet_origins: Vec<String>,
-    #[serde(default)]
-    pub credential_profiles: Vec<String>,
-    #[serde(default)]
-    pub delegation: SubjectAccessDelegationConfig,
-    #[serde(default)]
-    pub rate_limits: SubjectAccessRateLimitsConfig,
-}
-
-pub(super) fn subject_access_config_is_default(config: &SubjectAccessConfig) -> bool {
-    config == &SubjectAccessConfig::default()
-}
-
-impl SubjectAccessConfig {
-    pub(super) fn validate(
-        &self,
-        auth: &EvidenceAuthConfig,
-        evidence: &EvidenceConfig,
-    ) -> Result<(), EvidenceConfigError> {
-        if !self.enabled {
-            return Ok(());
-        }
-        let oidc =
-            auth.oidc
-                .as_ref()
-                .ok_or_else(|| EvidenceConfigError::InvalidSubjectAccessConfig {
-                    reason: "enabled subject_access requires auth.oidc".to_string(),
-                })?;
-
-        self.subject_binding.validate()?;
-        self.citizen_clients.validate(oidc)?;
-        self.token_policy.validate(oidc)?;
-        if self.subject_binding.claim_source == SubjectAccessClaimSource::Userinfo
-            && oidc
-                .userinfo_endpoint
-                .as_deref()
-                .unwrap_or_default()
-                .is_empty()
-        {
-            return self.invalid(
-                "subject_binding.claim_source = userinfo requires auth.oidc.userinfo_endpoint",
-            );
-        }
-        self.allowed_operations.validate()?;
-        self.delegation
-            .validate(evidence, &self.subject_binding.id_type)?;
-        if self.allowed_claims.is_empty() {
-            if !self.delegation.enabled {
-                return self.invalid(
-                    "subject_access.allowed_claims must not be empty unless delegation is enabled",
-                );
-            }
-            if !self.allowed_purposes.is_empty()
-                || !self.allowed_formats.is_empty()
-                || !self.allowed_disclosures.is_empty()
-            {
-                return self.invalid(
-                    "delegation-only subject_access requires allowed_purposes, allowed_formats, and allowed_disclosures to be empty; configure them on each delegated relationship",
-                );
-            }
-        } else {
-            validate_non_empty_entries("subject_access.allowed_purposes", &self.allowed_purposes)?;
-            validate_non_empty_entries("subject_access.allowed_formats", &self.allowed_formats)?;
-            validate_non_empty_entries(
-                "subject_access.allowed_disclosures",
-                &self.allowed_disclosures,
-            )?;
-        }
-        validate_entries("subject_access.allowed_claims", &self.allowed_claims)?;
-        if self.scope_policy != SubjectAccessScopePolicy::Disabled
-            && self.required_scopes.is_empty()
-        {
-            return self.invalid("scope_policy requires required_scopes unless it is disabled");
-        }
-        if self.scope_policy == SubjectAccessScopePolicy::Disabled
-            && !self.required_scopes.is_empty()
-        {
-            return self.invalid("scope_policy = disabled requires required_scopes to be empty");
-        }
-        if self.scope_policy != SubjectAccessScopePolicy::Disabled {
-            validate_non_empty_entries("subject_access.required_scopes", &self.required_scopes)?;
-        } else {
-            validate_entries("subject_access.required_scopes", &self.required_scopes)?;
-        }
-        validate_non_empty_entries(
-            "subject_access.credential_profiles",
-            &self.credential_profiles,
-        )?;
-        for relationship in &self.delegation.allowed_relationships {
-            if relationship.max_proof_age_seconds > self.token_policy.max_evaluation_age_seconds {
-                return self.invalid(format!(
-                    "subject_access.delegation relationship '{}' max_proof_age_seconds must not exceed token_policy.max_evaluation_age_seconds",
-                    relationship.relationship_type
-                ));
-            }
-        }
-        self.rate_limits.validate()?;
-        validate_exact_wallet_origins(&self.allowed_wallet_origins)?;
-
-        let claim_ids: HashSet<&str> = evidence
-            .claims
-            .iter()
-            .map(|claim| claim.id.as_str())
-            .collect();
-        let allowed_claim_ids: HashSet<&str> =
-            self.allowed_claims.iter().map(String::as_str).collect();
-        let subject_access_claim_ids: HashSet<&str> = allowed_claim_ids
-            .iter()
-            .copied()
-            .chain(
-                self.delegation
-                    .allowed_relationships
-                    .iter()
-                    .flat_map(|relationship| {
-                        relationship.allowed_claims.iter().map(String::as_str)
-                    }),
-            )
-            .collect();
-        let allowed_purposes: HashSet<&str> =
-            self.allowed_purposes.iter().map(String::as_str).collect();
-        let allowed_formats: HashSet<&str> =
-            self.allowed_formats.iter().map(String::as_str).collect();
-        let allowed_disclosures: HashSet<&str> = self
-            .allowed_disclosures
-            .iter()
-            .map(String::as_str)
-            .collect();
-        let allowed_profiles: HashSet<&str> = self
-            .credential_profiles
-            .iter()
-            .map(String::as_str)
-            .collect();
-
-        for claim_id in &self.allowed_claims {
-            if !claim_ids.contains(claim_id.as_str()) {
-                return Err(EvidenceConfigError::InvalidSubjectAccessConfig {
-                    reason: format!("allowed_claims references unknown claim '{claim_id}'"),
-                });
-            }
-        }
-
-        for profile_id in &self.credential_profiles {
-            if !evidence.credential_profiles.contains_key(profile_id) {
-                return Err(EvidenceConfigError::InvalidSubjectAccessConfig {
-                    reason: format!(
-                        "credential_profiles references unknown profile '{profile_id}'"
-                    ),
-                });
-            }
-        }
-
-        for profile_id in &self.credential_profiles {
-            let profile = evidence
-                .credential_profiles
-                .get(profile_id)
-                // SAFETY: the preceding credential_profiles loop rejects
-                // every profile id missing from evidence.credential_profiles.
-                .expect("profile id was checked above");
-            validate_subject_access_profile(
-                profile_id,
-                profile,
-                &claim_ids,
-                &subject_access_claim_ids,
-                self.token_policy.max_credential_validity_seconds,
-            )?;
-        }
-
-        for claim_id in &self.allowed_claims {
-            let claim = evidence
-                .claims
-                .iter()
-                .find(|claim| claim.id == *claim_id)
-                // SAFETY: the preceding allowed_claims loop rejects every
-                // claim id missing from evidence.claims.
-                .expect("claim id was checked above");
-            validate_subject_access_claim(
-                claim,
-                &allowed_purposes,
-                &allowed_formats,
-                &allowed_disclosures,
-                &allowed_profiles,
-                self.allowed_operations.issue_credential,
-            )?;
-            validate_subject_bound_registry_inputs(claim, &self.subject_binding.id_type)?;
-        }
-
-        validate_subject_access_allow_lists_are_supported(self, evidence)?;
-        if self.scope_policy != SubjectAccessScopePolicy::Disabled {
-            validate_required_scope_mappings(self, oidc)?;
-        }
-        Ok(())
-    }
-
-    fn invalid<T>(&self, reason: impl Into<String>) -> Result<T, EvidenceConfigError> {
-        Err(EvidenceConfigError::InvalidSubjectAccessConfig {
-            reason: reason.into(),
-        })
-    }
-}
-
-fn validate_subject_bound_registry_inputs(
-    claim: &ClaimDefinition,
-    subject_id_type: &str,
-) -> Result<(), EvidenceConfigError> {
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-        return Ok(());
-    };
-    let target_path = format!("target.identifiers.{subject_id_type}");
-    let requester_path = format!("requester.identifiers.{subject_id_type}");
-    for consultation in consultations.values() {
-        for input in consultation.inputs.values() {
-            let path = input.request_context_path();
-            if path != target_path && path != requester_path {
-                return invalid_subject_access(format!(
-                    "allowed registry_backed claim '{}' maps Relay input '{}' outside the authenticated subject binding; expected '{}' or '{}'",
-                    claim.id, path, target_path, requester_path
-                ));
-            }
-        }
-    }
-    Ok(())
-}
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct SubjectAccessDelegationConfig {
-    #[serde(default)]
-    pub enabled: bool,
-    #[serde(default)]
-    pub allowed_relationships: Vec<SubjectAccessDelegatedRelationshipConfig>,
-}
-
-impl SubjectAccessDelegationConfig {
-    fn validate(
-        &self,
-        evidence: &EvidenceConfig,
-        requester_id_type: &str,
-    ) -> Result<(), EvidenceConfigError> {
-        if !self.enabled {
-            if !self.allowed_relationships.is_empty() {
-                return Err(EvidenceConfigError::InvalidSubjectAccessConfig {
-                    reason:
-                        "subject_access.delegation.enabled=false requires allowed_relationships to be empty"
-                            .to_string(),
-                });
-            }
-            return Ok(());
-        }
-        if self.allowed_relationships.is_empty() {
-            return Err(EvidenceConfigError::InvalidSubjectAccessConfig {
-                reason: "subject_access.delegation.enabled requires allowed_relationships"
-                    .to_string(),
-            });
-        }
-        let claim_ids: HashSet<&str> = evidence
-            .claims
-            .iter()
-            .map(|claim| claim.id.as_str())
-            .collect();
-        let mut relationship_types = HashSet::new();
-        for relationship in &self.allowed_relationships {
-            relationship.validate(evidence, &claim_ids, requester_id_type)?;
-            if !relationship_types.insert(relationship.relationship_type.as_str()) {
-                return Err(EvidenceConfigError::InvalidSubjectAccessConfig {
-                    reason: format!(
-                        "subject_access.delegation.allowed_relationships contains duplicate relationship_type '{}'",
-                        relationship.relationship_type
-                    ),
-                });
-            }
-        }
-        Ok(())
-    }
-
-    #[must_use]
-    pub fn relationship(
-        &self,
-        relationship_type: &str,
-    ) -> Option<&SubjectAccessDelegatedRelationshipConfig> {
-        self.allowed_relationships
-            .iter()
-            .find(|relationship| relationship.relationship_type == relationship_type)
-    }
-}
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct SubjectAccessDelegatedRelationshipConfig {
-    pub relationship_type: String,
-    pub proof_claim: String,
-    #[serde(default)]
-    pub target_id_type: Option<String>,
-    #[serde(default = "default_delegated_max_proof_age_seconds")]
-    #[schemars(range(min = 1, max = 600))]
-    pub max_proof_age_seconds: u64,
-    #[serde(default)]
-    pub allowed_claims: Vec<String>,
-    #[serde(default)]
-    pub allowed_purposes: Vec<String>,
-    #[serde(default)]
-    pub allowed_formats: Vec<String>,
-    #[serde(default)]
-    pub allowed_disclosures: Vec<String>,
-}
-
-const fn default_delegated_max_proof_age_seconds() -> u64 {
-    300
-}
-
-impl SubjectAccessDelegatedRelationshipConfig {
-    fn validate(
-        &self,
-        evidence: &EvidenceConfig,
-        claim_ids: &HashSet<&str>,
-        requester_id_type: &str,
-    ) -> Result<(), EvidenceConfigError> {
-        if self.relationship_type.trim().is_empty() {
-            return Err(EvidenceConfigError::InvalidSubjectAccessConfig {
-                reason:
-                    "subject_access.delegation.allowed_relationships.relationship_type is required"
-                        .to_string(),
-            });
-        }
-        if self.proof_claim.trim().is_empty() || !claim_ids.contains(self.proof_claim.as_str()) {
-            return Err(EvidenceConfigError::InvalidSubjectAccessConfig {
-                reason: format!(
-                    "subject_access.delegation proof_claim references unknown claim '{}'",
-                    self.proof_claim
-                ),
-            });
-        }
-        let Some(proof_claim) = evidence
-            .claims
-            .iter()
-            .find(|claim| claim.id == self.proof_claim)
-        else {
-            return Err(EvidenceConfigError::InvalidSubjectAccessConfig {
-                reason: format!(
-                    "subject_access.delegation proof_claim references unknown claim '{}'",
-                    self.proof_claim
-                ),
-            });
-        };
-        validate_delegated_proof_claim_binding(self, proof_claim)?;
-        if let Some(target_id_type) = self.target_id_type.as_deref() {
-            if target_id_type.trim().is_empty() {
-                return Err(EvidenceConfigError::InvalidSubjectAccessConfig {
-                    reason: "subject_access.delegation target_id_type must not be blank"
-                        .to_string(),
-                });
-            }
-        }
-        if self.max_proof_age_seconds == 0 || self.max_proof_age_seconds > 600 {
-            return invalid_subject_access(
-                "subject_access.delegation.allowed_relationships.max_proof_age_seconds must be between 1 and 600",
-            );
-        }
-        validate_non_empty_entries(
-            "subject_access.delegation.allowed_claims",
-            &self.allowed_claims,
-        )?;
-        validate_non_empty_entries(
-            "subject_access.delegation.allowed_purposes",
-            &self.allowed_purposes,
-        )?;
-        validate_non_empty_entries(
-            "subject_access.delegation.allowed_formats",
-            &self.allowed_formats,
-        )?;
-        validate_non_empty_entries(
-            "subject_access.delegation.allowed_disclosures",
-            &self.allowed_disclosures,
-        )?;
-        let allowed_purposes: HashSet<&str> =
-            self.allowed_purposes.iter().map(String::as_str).collect();
-        let allowed_formats: HashSet<&str> =
-            self.allowed_formats.iter().map(String::as_str).collect();
-        let allowed_disclosures: HashSet<&str> = self
-            .allowed_disclosures
-            .iter()
-            .map(String::as_str)
-            .collect();
-        for claim_id in &self.allowed_claims {
-            if !claim_ids.contains(claim_id.as_str()) {
-                return Err(EvidenceConfigError::InvalidSubjectAccessConfig {
-                    reason: format!(
-                        "subject_access.delegation allowed_claims references unknown claim '{claim_id}'"
-                    ),
-                });
-            }
-            let Some(claim) = evidence.claims.iter().find(|claim| claim.id == *claim_id) else {
-                return Err(EvidenceConfigError::InvalidSubjectAccessConfig {
-                    reason: format!(
-                        "subject_access.delegation allowed_claims references unknown claim '{claim_id}'"
-                    ),
-                });
-            };
-            if !claim.depends_on.iter().any(|dep| dep == &self.proof_claim) {
-                return Err(EvidenceConfigError::InvalidSubjectAccessConfig {
-                    reason: format!(
-                        "delegated claim '{claim_id}' must depend_on proof_claim '{}'",
-                        self.proof_claim
-                    ),
-                });
-            }
-            if claim.purpose != proof_claim.purpose {
-                return invalid_subject_access(format!(
-                    "delegated claim '{claim_id}' and proof_claim '{}' must declare the same purpose",
-                    self.proof_claim
-                ));
-            }
-            validate_delegated_subject_access_claim(
-                claim,
-                &allowed_purposes,
-                &allowed_formats,
-                &allowed_disclosures,
-            )?;
-            validate_delegated_registry_closure_inputs(
-                &self.relationship_type,
-                claim,
-                &self.proof_claim,
-                evidence,
-                requester_id_type,
-                self.target_id_type.as_deref().unwrap_or(requester_id_type),
-            )?;
-        }
-        validate_delegated_subject_access_allow_lists_are_supported(self, evidence)?;
-        Ok(())
-    }
-}
-
-fn validate_delegated_registry_closure_inputs(
-    relationship_type: &str,
-    root: &ClaimDefinition,
-    proof_claim_id: &str,
-    evidence: &EvidenceConfig,
-    requester_id_type: &str,
-    target_id_type: &str,
-) -> Result<(), EvidenceConfigError> {
-    let requester_path = format!("requester.identifiers.{requester_id_type}");
-    let target_path = format!("target.identifiers.{target_id_type}");
-    let mut pending = vec![root];
-    let mut visited = BTreeSet::new();
-
-    while let Some(claim) = pending.pop() {
-        if !visited.insert(claim.id.as_str()) || claim.id == proof_claim_id {
-            continue;
-        }
-        if let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode {
-            for (consultation_name, consultation) in consultations {
-                let mut consumes_target = false;
-                for (input_name, input) in &consultation.inputs {
-                    let path = input.request_context_path();
-                    if path != requester_path && path != target_path {
-                        return invalid_subject_access(format!(
-                            "delegated relationship '{relationship_type}' allowed claim '{}' closure claim '{}' consultation '{consultation_name}' input '{input_name}' maps non-canonical path '{path}'; allowed canonical paths are '{requester_path}' and '{target_path}'",
-                            root.id, claim.id
-                        ));
-                    }
-                    consumes_target |= path == target_path;
-                }
-                if !consumes_target {
-                    let actual_inputs = consultation
-                        .inputs
-                        .iter()
-                        .map(|(input_name, input)| {
-                            format!("'{input_name}' maps '{}'", input.request_context_path())
-                        })
-                        .collect::<Vec<_>>()
-                        .join(", ");
-                    return invalid_subject_access(format!(
-                        "delegated relationship '{relationship_type}' allowed claim '{}' closure claim '{}' consultation '{consultation_name}' does not consume the selected target; {actual_inputs}; required target path is '{target_path}' and the only additional allowed canonical path is '{requester_path}'",
-                        root.id, claim.id
-                    ));
-                }
-            }
-        }
-        for dependency_id in &claim.depends_on {
-            let dependency = evidence
-                .claims
-                .iter()
-                .find(|candidate| candidate.id == *dependency_id)
-                .ok_or_else(|| EvidenceConfigError::InvalidSubjectAccessConfig {
-                    reason: format!(
-                        "delegated relationship '{relationship_type}' allowed claim '{}' dependency closure references unknown claim '{dependency_id}'",
-                        root.id
-                    ),
-                })?;
-            pending.push(dependency);
-        }
-    }
-    Ok(())
-}
-
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(rename_all = "snake_case")]
-pub enum SubjectAccessScopePolicy {
-    #[default]
-    Required,
-    Optional,
-    Disabled,
-}
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct SubjectAccessSubjectBindingConfig {
-    #[serde(default)]
-    pub token_claim: String,
-    #[serde(default)]
-    pub claim_source: SubjectAccessClaimSource,
-    #[serde(default)]
-    pub request_field: SubjectId,
-    #[serde(default)]
-    pub id_type: String,
-    #[serde(default)]
-    pub normalize: SubjectBindingNormalize,
-    #[serde(default)]
-    pub allow_sub_as_civil_id: bool,
-}
-
-impl SubjectAccessSubjectBindingConfig {
-    fn validate(&self) -> Result<(), EvidenceConfigError> {
-        if self.token_claim.is_empty() {
-            return invalid_subject_access("subject_binding.token_claim must not be empty");
-        }
-        if !self
-            .token_claim
-            .chars()
-            .all(|ch| ch.is_ascii_alphanumeric() || matches!(ch, '_' | ':' | '/' | '.' | '-'))
-        {
-            return invalid_subject_access(
-                "subject_binding.token_claim must match [A-Za-z0-9_:/\\.\\-]+",
-            );
-        }
-        if self.token_claim == "sub" && !self.allow_sub_as_civil_id {
-            return invalid_subject_access(
-                "subject_binding.token_claim = sub requires allow_sub_as_civil_id = true",
-            );
-        }
-        if self.id_type.trim().is_empty() {
-            return invalid_subject_access("subject_binding.id_type must not be empty");
-        }
-        if self.normalize != SubjectBindingNormalize::Exact {
-            return invalid_subject_access("subject_binding.normalize must be exact");
-        }
-        Ok(())
-    }
-}
-
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(rename_all = "snake_case")]
-pub enum SubjectAccessClaimSource {
-    #[default]
-    AccessToken,
-    Userinfo,
-}
-
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-pub enum SubjectId {
-    #[default]
-    SubjectId,
-}
-
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(rename_all = "snake_case")]
-pub enum SubjectBindingNormalize {
-    #[default]
-    Exact,
-}
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct SubjectAccessCitizenClientsConfig {
-    #[serde(default)]
-    pub allowed_client_ids: Vec<String>,
-    #[serde(default)]
-    pub allowed_audiences: Vec<String>,
-}
-
-impl SubjectAccessCitizenClientsConfig {
-    fn validate(&self, oidc: &EvidenceOidcAuthConfig) -> Result<(), EvidenceConfigError> {
-        if self.allowed_client_ids.is_empty() && self.allowed_audiences.is_empty() {
-            return invalid_subject_access(
-                "citizen_clients must list at least one allowed client id or audience",
-            );
-        }
-        validate_entries(
-            "subject_access.citizen_clients.allowed_client_ids",
-            &self.allowed_client_ids,
-        )?;
-        validate_entries(
-            "subject_access.citizen_clients.allowed_audiences",
-            &self.allowed_audiences,
-        )?;
-        for audience in &self.allowed_audiences {
-            if !oidc.audiences.iter().any(|accepted| accepted == audience) {
-                return invalid_subject_access(format!(
-                    "citizen audience '{audience}' is not listed in auth.oidc.audiences"
-                ));
-            }
-        }
-        if !oidc.allowed_clients.is_empty() {
-            for client_id in &self.allowed_client_ids {
-                if !oidc
-                    .allowed_clients
-                    .iter()
-                    .any(|accepted| accepted == client_id)
-                {
-                    return invalid_subject_access(format!(
-                        "citizen client '{client_id}' is not listed in auth.oidc.allowed_clients"
-                    ));
-                }
-            }
-        }
-        Ok(())
-    }
-}
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct SubjectAccessTokenPolicyConfig {
-    #[serde(default)]
-    pub required_acr_values: Vec<String>,
-    #[serde(default)]
-    pub assurance_claim_source: SubjectAccessAssuranceClaimSource,
-    #[serde(default)]
-    pub max_auth_age_seconds: u64,
-    #[serde(default)]
-    pub max_access_token_lifetime_seconds: u64,
-    #[serde(default)]
-    pub max_evaluation_age_seconds: u64,
-    #[serde(default)]
-    pub max_credential_validity_seconds: u64,
-    #[serde(default)]
-    pub max_clock_leeway_seconds: u64,
-}
-
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(rename_all = "snake_case")]
-pub enum SubjectAccessAssuranceClaimSource {
-    #[default]
-    AccessToken,
-    IdToken,
-}
-
-impl SubjectAccessTokenPolicyConfig {
-    fn validate(&self, oidc: &EvidenceOidcAuthConfig) -> Result<(), EvidenceConfigError> {
-        validate_entries(
-            "subject_access.token_policy.required_acr_values",
-            &self.required_acr_values,
-        )?;
-        if self.max_auth_age_seconds == 0 {
-            return invalid_subject_access(
-                "token_policy.max_auth_age_seconds must be greater than zero",
-            );
-        }
-        if self.max_access_token_lifetime_seconds == 0 {
-            return invalid_subject_access(
-                "token_policy.max_access_token_lifetime_seconds must be greater than zero",
-            );
-        }
-        if self.max_evaluation_age_seconds == 0 || self.max_evaluation_age_seconds > 600 {
-            return invalid_subject_access(
-                "token_policy.max_evaluation_age_seconds must be between 1 and 600",
-            );
-        }
-        if self.max_credential_validity_seconds == 0 {
-            return invalid_subject_access(
-                "token_policy.max_credential_validity_seconds must be greater than zero",
-            );
-        }
-        if self.max_clock_leeway_seconds == 0 || self.max_clock_leeway_seconds > 60 {
-            return invalid_subject_access(
-                "token_policy.max_clock_leeway_seconds must be between 1 and 60",
-            );
-        }
-        if oidc.leeway > Duration::from_secs(self.max_clock_leeway_seconds) {
-            return invalid_subject_access(
-                "auth.oidc.leeway must not exceed token_policy.max_clock_leeway_seconds",
-            );
-        }
-        Ok(())
-    }
-}
-
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct SubjectAccessOperationsConfig {
-    #[serde(default)]
-    pub evaluate: bool,
-    #[serde(default)]
-    pub render: bool,
-    #[serde(default)]
-    pub issue_credential: bool,
-    #[serde(default)]
-    pub batch_evaluate: bool,
-}
-
-impl SubjectAccessOperationsConfig {
-    fn validate(&self) -> Result<(), EvidenceConfigError> {
-        if self.batch_evaluate {
-            return invalid_subject_access("allowed_operations.batch_evaluate must be false in v1");
-        }
-        if !self.evaluate && !self.render && !self.issue_credential {
-            return invalid_subject_access(
-                "allowed_operations must enable at least one subject-access operation",
-            );
-        }
-        Ok(())
-    }
-}
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct SubjectAccessRateLimitsConfig {
-    #[serde(default)]
-    pub invalid_token_per_client_address_per_minute: u32,
-    #[serde(default)]
-    pub per_principal_per_minute: u32,
-    #[serde(default)]
-    pub subject_mismatch_per_principal_per_hour: u32,
-    #[serde(default)]
-    pub per_holder_per_hour: u32,
-    #[serde(default)]
-    pub credential_issuance_per_principal_per_hour: u32,
-    /// Per-minute cap on `tx_code` attempts against a single
-    /// `pre-authorized_code`. Bounds brute force of the numeric PIN at the
-    /// pre-authorized-code token endpoint. Defaults to zero so existing
-    /// configs that do not enable pre-auth still validate; it must be greater
-    /// than zero only when the pre-authorized-code flow is enabled.
-    #[serde(default)]
-    pub tx_code_attempts_per_code_per_minute: u32,
-}
-
-impl SubjectAccessRateLimitsConfig {
-    fn validate(&self) -> Result<(), EvidenceConfigError> {
-        if self.invalid_token_per_client_address_per_minute == 0
-            || self.per_principal_per_minute == 0
-            || self.subject_mismatch_per_principal_per_hour == 0
-            || self.per_holder_per_hour == 0
-            || self.credential_issuance_per_principal_per_hour == 0
-        {
-            return invalid_subject_access("rate_limits values must all be greater than zero");
-        }
-        Ok(())
-    }
-}
-
-pub(super) fn validate_non_empty_entries(
-    name: &str,
-    values: &[String],
-) -> Result<(), EvidenceConfigError> {
-    if values.is_empty() {
-        return invalid_subject_access(format!("{name} must not be empty"));
-    }
-    validate_entries(name, values)
-}
-
-pub(super) fn validate_entries(name: &str, values: &[String]) -> Result<(), EvidenceConfigError> {
-    if values.iter().any(|value| value.trim().is_empty()) {
-        return invalid_subject_access(format!("{name} must not contain blank entries"));
-    }
-    Ok(())
-}
-
-pub(super) fn validate_exact_wallet_origins(origins: &[String]) -> Result<(), EvidenceConfigError> {
-    for origin in origins {
-        if origin == "*" || origin.contains('*') {
-            return invalid_subject_access(
-                "allowed_wallet_origins must contain exact origins, not wildcards",
-            );
-        }
-        if !origin.starts_with("https://") {
-            return invalid_subject_access("allowed_wallet_origins must use https origins");
-        }
-    }
-    Ok(())
-}
-
-pub(super) fn validate_subject_access_claim(
-    claim: &ClaimDefinition,
-    allowed_purposes: &HashSet<&str>,
-    allowed_formats: &HashSet<&str>,
-    allowed_disclosures: &HashSet<&str>,
-    allowed_profiles: &HashSet<&str>,
-    issue_credential: bool,
-) -> Result<(), EvidenceConfigError> {
-    if !claim.operations.evaluate.enabled {
-        return invalid_subject_access(format!(
-            "allowed claim '{}' must enable evaluate",
-            claim.id
-        ));
-    }
-    let purpose = claim.purpose.as_deref().ok_or_else(|| {
-        EvidenceConfigError::InvalidSubjectAccessConfig {
-            reason: format!("allowed claim '{}' must declare purpose", claim.id),
-        }
-    })?;
-    if !allowed_purposes.contains(purpose) {
-        return invalid_subject_access(format!(
-            "allowed claim '{}' declares unallowed purpose '{}'",
-            claim.id, purpose
-        ));
-    }
-    if !claim
-        .formats
-        .iter()
-        .any(|format| allowed_formats.contains(format.as_str()))
-    {
-        return invalid_subject_access(format!(
-            "allowed claim '{}' must support at least one allowed format",
-            claim.id
-        ));
-    }
-    if !claim
-        .disclosure
-        .allowed
-        .iter()
-        .any(|disclosure| allowed_disclosures.contains(disclosure.as_str()))
-    {
-        return invalid_subject_access(format!(
-            "allowed claim '{}' must support at least one allowed disclosure",
-            claim.id
-        ));
-    }
-    if issue_credential
-        && !claim
-            .credential_profiles
-            .iter()
-            .any(|profile| allowed_profiles.contains(profile.as_str()))
-    {
-        return invalid_subject_access(format!(
-            "allowed claim '{}' must reference an allowed credential profile",
-            claim.id
-        ));
-    }
-    Ok(())
-}
-
-pub(super) fn validate_subject_access_profile(
-    profile_id: &str,
-    profile: &CredentialProfileConfig,
-    claim_ids: &HashSet<&str>,
-    allowed_claim_ids: &HashSet<&str>,
-    max_credential_validity_seconds: u64,
-) -> Result<(), EvidenceConfigError> {
-    if profile.validity_seconds <= 0 {
-        return invalid_subject_access(format!(
-            "credential profile '{profile_id}' validity_seconds must be greater than zero"
-        ));
-    }
-    let validity_seconds = u64::try_from(profile.validity_seconds).map_err(|_| {
-        EvidenceConfigError::InvalidSubjectAccessConfig {
-            reason: format!(
-                "credential profile '{profile_id}' validity_seconds must be greater than zero"
-            ),
-        }
-    })?;
-    if validity_seconds > max_credential_validity_seconds {
-        return invalid_subject_access(format!(
-            "credential profile '{profile_id}' validity_seconds must not exceed the subject-access ceiling"
-        ));
-    }
-    if profile.holder_binding.mode != "did" {
-        return invalid_subject_access(format!(
-            "credential profile '{profile_id}' holder_binding.mode must be did"
-        ));
-    }
-    if profile.holder_binding.proof_of_possession.as_deref() != Some("required") {
-        return invalid_subject_access(format!(
-            "credential profile '{profile_id}' holder_binding.proof_of_possession must be required"
-        ));
-    }
-    if profile.holder_binding.allowed_did_methods.is_empty()
-        || profile
-            .holder_binding
-            .allowed_did_methods
-            .iter()
-            .any(|method| method != SD_JWT_VC_HOLDER_BINDING_METHOD)
-    {
-        return invalid_subject_access(format!(
-            "credential profile '{profile_id}' holder_binding.allowed_did_methods must only contain did:jwk"
-        ));
-    }
-    for claim_id in &profile.allowed_claims {
-        if !claim_ids.contains(claim_id.as_str()) {
-            return invalid_subject_access(format!(
-                "credential profile '{profile_id}' references unknown claim '{claim_id}'"
-            ));
-        }
-    }
-    if !profile
-        .allowed_claims
-        .iter()
-        .any(|claim_id| allowed_claim_ids.contains(claim_id.as_str()))
-    {
-        return invalid_subject_access(format!(
-            "credential profile '{profile_id}' must allow at least one subject-access claim"
-        ));
-    }
-    Ok(())
-}
-
-pub(super) fn validate_subject_access_allow_lists_are_supported(
-    config: &SubjectAccessConfig,
-    evidence: &EvidenceConfig,
-) -> Result<(), EvidenceConfigError> {
-    let allowed_claims: Vec<&ClaimDefinition> = config
-        .allowed_claims
-        .iter()
-        .filter_map(|claim_id| evidence.claims.iter().find(|claim| claim.id == *claim_id))
-        .collect();
-    let allowed_profiles: Vec<&CredentialProfileConfig> = config
-        .credential_profiles
-        .iter()
-        .filter_map(|profile_id| evidence.credential_profiles.get(profile_id))
-        .collect();
-
-    for purpose in &config.allowed_purposes {
-        if !allowed_claims
-            .iter()
-            .any(|claim| claim.purpose.as_deref() == Some(purpose.as_str()))
-        {
-            return invalid_subject_access(format!(
-                "allowed_purposes entry '{purpose}' is not used by any allowed claim"
-            ));
-        }
-    }
-
-    for format in &config.allowed_formats {
-        let supported_by_claim = allowed_claims
-            .iter()
-            .any(|claim| claim.formats.iter().any(|candidate| candidate == format));
-        if !supported_by_claim {
-            return invalid_subject_access(format!(
-                "allowed_formats entry '{format}' is not supported by any allowed claim"
-            ));
-        }
-    }
-
-    for disclosure in &config.allowed_disclosures {
-        let supported_by_claim = allowed_claims.iter().any(|claim| {
-            claim
-                .disclosure
-                .allowed
-                .iter()
-                .any(|candidate| candidate == disclosure)
-        });
-        let supported_by_profile = allowed_profiles.iter().any(|profile| {
-            profile
-                .disclosure
-                .allowed
-                .iter()
-                .any(|candidate| candidate == disclosure)
-        });
-        if !supported_by_claim && !supported_by_profile {
-            return invalid_subject_access(format!(
-                "allowed_disclosures entry '{disclosure}' is not supported by any allowed claim or profile"
-            ));
-        }
-    }
-
-    Ok(())
-}
-
-pub(super) fn validate_delegated_proof_claim_binding(
-    relationship: &SubjectAccessDelegatedRelationshipConfig,
-    proof_claim: &ClaimDefinition,
-) -> Result<(), EvidenceConfigError> {
-    if !proof_claim.depends_on.is_empty() {
-        return invalid_subject_access(format!(
-            "delegated proof_claim '{}' must not depend_on other claims so the relationship is proven before the delegated claim closure runs",
-            relationship.proof_claim
-        ));
-    }
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &proof_claim.evidence_mode else {
-        return invalid_subject_access(format!(
-            "delegated proof_claim '{}' must be registry_backed",
-            relationship.proof_claim
-        ));
-    };
-    let Some((_, consultation)) = consultations
-        .first_key_value()
-        .filter(|_| consultations.len() == 1)
-    else {
-        return invalid_subject_access(format!(
-            "delegated proof_claim '{}' must declare exactly one Relay consultation",
-            relationship.proof_claim
-        ));
-    };
-    let has_requester = consultation
-        .inputs
-        .values()
-        .any(RelayConsultationInput::is_requester_derived);
-    let has_target = consultation
-        .inputs
-        .values()
-        .any(RelayConsultationInput::is_authenticated_target_identifier);
-    if !has_requester || !has_target {
-        return invalid_subject_access(format!(
-            "delegated proof_claim '{}' must map both a requester-derived input and an authenticated target identifier",
-            relationship.proof_claim
-        ));
-    }
-    if proof_claim.value.value_type != "boolean" {
-        return invalid_subject_access(format!(
-            "delegated proof_claim '{}' must produce a boolean result",
-            relationship.proof_claim
-        ));
-    }
-    if proof_claim.purpose.as_deref().is_none() {
-        return invalid_subject_access(format!(
-            "delegated proof_claim '{}' must declare purpose",
-            relationship.proof_claim
-        ));
-    }
-    Ok(())
-}
-
-pub(super) fn validate_delegated_subject_access_claim(
-    claim: &ClaimDefinition,
-    allowed_purposes: &HashSet<&str>,
-    allowed_formats: &HashSet<&str>,
-    allowed_disclosures: &HashSet<&str>,
-) -> Result<(), EvidenceConfigError> {
-    if !claim.operations.evaluate.enabled {
-        return invalid_subject_access(format!(
-            "delegated claim '{}' must enable evaluate",
-            claim.id
-        ));
-    }
-    let purpose = claim.purpose.as_deref().ok_or_else(|| {
-        EvidenceConfigError::InvalidSubjectAccessConfig {
-            reason: format!("delegated claim '{}' must declare purpose", claim.id),
-        }
-    })?;
-    if !allowed_purposes.contains(purpose) {
-        return invalid_subject_access(format!(
-            "delegated claim '{}' declares unallowed purpose '{}'",
-            claim.id, purpose
-        ));
-    }
-    if !claim
-        .formats
-        .iter()
-        .any(|format| allowed_formats.contains(format.as_str()))
-    {
-        return invalid_subject_access(format!(
-            "delegated claim '{}' must support at least one allowed format",
-            claim.id
-        ));
-    }
-    if !claim
-        .disclosure
-        .allowed
-        .iter()
-        .any(|disclosure| allowed_disclosures.contains(disclosure.as_str()))
-    {
-        return invalid_subject_access(format!(
-            "delegated claim '{}' must support at least one allowed disclosure",
-            claim.id
-        ));
-    }
-    Ok(())
-}
-
-pub(super) fn validate_delegated_subject_access_allow_lists_are_supported(
-    relationship: &SubjectAccessDelegatedRelationshipConfig,
-    evidence: &EvidenceConfig,
-) -> Result<(), EvidenceConfigError> {
-    let allowed_claims: Vec<&ClaimDefinition> = relationship
-        .allowed_claims
-        .iter()
-        .filter_map(|claim_id| evidence.claims.iter().find(|claim| claim.id == *claim_id))
-        .collect();
-    for purpose in &relationship.allowed_purposes {
-        if !allowed_claims
-            .iter()
-            .any(|claim| claim.purpose.as_deref() == Some(purpose.as_str()))
-        {
-            return invalid_subject_access(format!(
-                "subject_access.delegation allowed_purposes entry '{purpose}' is not used by any allowed claim"
-            ));
-        }
-    }
-
-    for format in &relationship.allowed_formats {
-        let supported_by_claim = allowed_claims
-            .iter()
-            .any(|claim| claim.formats.iter().any(|candidate| candidate == format));
-        if !supported_by_claim {
-            return invalid_subject_access(format!(
-                "subject_access.delegation allowed_formats entry '{format}' is not supported by any allowed claim"
-            ));
-        }
-    }
-
-    for disclosure in &relationship.allowed_disclosures {
-        let supported_by_claim = allowed_claims.iter().any(|claim| {
-            claim
-                .disclosure
-                .allowed
-                .iter()
-                .any(|candidate| candidate == disclosure)
-        });
-        if !supported_by_claim {
-            return invalid_subject_access(format!(
-                "subject_access.delegation allowed_disclosures entry '{disclosure}' is not supported by any allowed claim"
-            ));
-        }
-    }
-
-    Ok(())
-}
-
-pub(super) fn validate_required_scope_mappings(
-    config: &SubjectAccessConfig,
-    oidc: &EvidenceOidcAuthConfig,
-) -> Result<(), EvidenceConfigError> {
-    let required_scopes: HashSet<&str> =
-        config.required_scopes.iter().map(String::as_str).collect();
-    for scope in &required_scopes {
-        if !oidc
-            .scope_map
-            .values()
-            .any(|mapped_scopes| mapped_scopes.iter().any(|mapped| mapped == scope))
-        {
-            return invalid_subject_access(format!(
-                "required scope '{scope}' must be present in auth.oidc.scope_map"
-            ));
-        }
-    }
-
-    Ok(())
-}
-
-pub(super) fn invalid_subject_access<T>(
-    reason: impl Into<String>,
-) -> Result<T, EvidenceConfigError> {
-    Err(EvidenceConfigError::InvalidSubjectAccessConfig {
-        reason: reason.into(),
-    })
-}
-
-pub(super) fn detect_depends_on_cycle(
-    claims: &[ClaimDefinition],
-    claim_id: &str,
-    grey: &mut HashSet<String>,
-    black: &mut HashSet<String>,
-    path: &mut Vec<String>,
-) -> Result<(), EvidenceConfigError> {
-    grey.insert(claim_id.to_string());
-    path.push(claim_id.to_string());
-    let claim = claims.iter().find(|c| c.id == claim_id);
-    if let Some(claim) = claim {
-        for dep in &claim.depends_on {
-            if grey.contains(dep.as_str()) {
-                // Back edge found: build the cycle path from where dep appears.
-                let cycle_start = path.iter().position(|id| id == dep).unwrap_or(0);
-                let mut cycle = path[cycle_start..].to_vec();
-                cycle.push(dep.clone());
-                return Err(EvidenceConfigError::DependsOnCycle { cycle });
-            }
-            if !black.contains(dep.as_str()) {
-                detect_depends_on_cycle(claims, dep, grey, black, path)?;
-            }
-        }
-    }
-    path.pop();
-    grey.remove(claim_id);
-    black.insert(claim_id.to_string());
-    Ok(())
-}
diff --git a/crates/registry-notary-core/src/config/tests.rs b/crates/registry-notary-core/src/config/tests.rs
deleted file mode 100644
index 409c050b9..000000000
--- a/crates/registry-notary-core/src/config/tests.rs
+++ /dev/null
@@ -1,9 +0,0 @@
-pub(super) use super::*;
-mod auth;
-mod credentials;
-mod infrastructure;
-mod issuance;
-mod preauth;
-mod relay;
-mod root;
-mod support;
diff --git a/crates/registry-notary-core/src/config/tests/auth.rs b/crates/registry-notary-core/src/config/tests/auth.rs
deleted file mode 100644
index 1ca032028..000000000
--- a/crates/registry-notary-core/src/config/tests/auth.rs
+++ /dev/null
@@ -1,319 +0,0 @@
-use super::support::*;
-use super::*;
-#[allow(unused_imports)]
-use super::{credentials::*, infrastructure::*, issuance::*, preauth::*, root::*};
-
-#[test]
-pub(super) fn at_least_one_authenticator_is_required() {
-    let mut config = minimal_config();
-    config.auth.api_keys.clear();
-    config.auth.bearer_tokens.clear();
-    config.auth.oidc = None;
-
-    let err = config
-        .validate()
-        .expect_err("an empty auth configuration must fail");
-
-    assert!(matches!(err, EvidenceConfigError::NoCredentialsConfigured));
-}
-
-#[test]
-pub(super) fn oidc_auth_validates_required_settings() {
-    let mut config = minimal_config();
-    config.auth.api_keys.clear();
-    config.auth.oidc = Some(EvidenceOidcAuthConfig {
-        issuer: "https://issuer.example".to_string(),
-        jwks_url: "https://issuer.example/jwks.json".to_string(),
-        userinfo_endpoint: None,
-        userinfo_issuers: Vec::new(),
-        audiences: vec!["registry-notary".to_string()],
-        allowed_clients: vec!["registry-client".to_string()],
-        allowed_algorithms: vec!["EdDSA".to_string()],
-        allowed_token_types: vec!["JWT".to_string()],
-        scope_claim: "scope".to_string(),
-        scope_separator: " ".to_string(),
-        scope_map: BTreeMap::new(),
-        principal_claim: "sub".to_string(),
-        leeway: Duration::from_secs(60),
-        allow_insecure_localhost: false,
-    });
-
-    assert!(config.validate().is_ok());
-}
-
-#[test]
-pub(super) fn duplicate_static_credential_api_key_id_rejected() {
-    let mut config = minimal_config();
-    let duplicate = config.auth.api_keys[0].clone();
-    config.auth.api_keys.push(duplicate);
-
-    let reason = match config
-        .validate()
-        .expect_err("duplicate API key id must fail validation")
-    {
-        EvidenceConfigError::InvalidAuthConfig { reason } => reason,
-        other => panic!("unexpected error variant: {other}"),
-    };
-
-    assert!(
-        reason.contains("auth.api_keys") && reason.contains("test-key"),
-        "unexpected reason: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn duplicate_static_credential_bearer_token_id_rejected() {
-    let mut config = minimal_config();
-    let mut token = config.auth.api_keys[0].clone();
-    token.id = "shared-bearer-token".to_string();
-    config.auth.bearer_tokens.push(token.clone());
-    config.auth.bearer_tokens.push(token);
-
-    let reason = match config
-        .validate()
-        .expect_err("duplicate bearer token id must fail validation")
-    {
-        EvidenceConfigError::InvalidAuthConfig { reason } => reason,
-        other => panic!("unexpected error variant: {other}"),
-    };
-
-    assert!(
-        reason.contains("auth.bearer_tokens") && reason.contains("shared-bearer-token"),
-        "unexpected reason: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn duplicate_static_credential_id_across_api_key_and_bearer_token_rejected() {
-    let mut config = minimal_config();
-    config
-        .auth
-        .bearer_tokens
-        .push(config.auth.api_keys[0].clone());
-
-    let reason = match config
-        .validate()
-        .expect_err("duplicate static credential id across types must fail validation")
-    {
-        EvidenceConfigError::InvalidAuthConfig { reason } => reason,
-        other => panic!("unexpected error variant: {other}"),
-    };
-
-    assert!(
-        reason.contains("auth.bearer_tokens") && reason.contains("test-key"),
-        "unexpected reason: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oidc_jwks_url_must_use_https() {
-    let mut config = minimal_config();
-    config.auth.api_keys.clear();
-    config.auth.oidc = Some(EvidenceOidcAuthConfig {
-        issuer: "https://issuer.example".to_string(),
-        jwks_url: "http://issuer.example/jwks.json".to_string(),
-        userinfo_endpoint: None,
-        userinfo_issuers: Vec::new(),
-        audiences: vec!["registry-notary".to_string()],
-        allowed_clients: vec!["registry-client".to_string()],
-        allowed_algorithms: vec!["EdDSA".to_string()],
-        allowed_token_types: vec!["JWT".to_string()],
-        scope_claim: "scope".to_string(),
-        scope_separator: " ".to_string(),
-        scope_map: BTreeMap::new(),
-        principal_claim: "sub".to_string(),
-        leeway: Duration::from_secs(60),
-        allow_insecure_localhost: false,
-    });
-
-    let err = config
-        .validate()
-        .expect_err("remote http jwks_url must fail validation");
-    match err {
-        EvidenceConfigError::InvalidOidcConfig { reason } => {
-            assert!(
-                reason.contains("jwks_url must use https"),
-                "unexpected: {reason}"
-            );
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-
-    config
-        .auth
-        .oidc
-        .as_mut()
-        .expect("oidc config exists")
-        .allow_insecure_localhost = true;
-    let err = config
-        .validate()
-        .expect_err("allow_insecure_localhost must not permit remote http");
-    assert!(matches!(err, EvidenceConfigError::InvalidOidcConfig { .. }));
-}
-
-#[test]
-pub(super) fn oidc_jwks_url_allows_insecure_localhost_only_when_enabled() {
-    let mut config = minimal_config();
-    config.auth.api_keys.clear();
-    config.auth.oidc = Some(EvidenceOidcAuthConfig {
-        issuer: "https://issuer.example".to_string(),
-        jwks_url: "http://127.0.0.1:8080/jwks.json".to_string(),
-        userinfo_endpoint: None,
-        userinfo_issuers: Vec::new(),
-        audiences: vec!["registry-notary".to_string()],
-        allowed_clients: vec!["registry-client".to_string()],
-        allowed_algorithms: vec!["EdDSA".to_string()],
-        allowed_token_types: vec!["JWT".to_string()],
-        scope_claim: "scope".to_string(),
-        scope_separator: " ".to_string(),
-        scope_map: BTreeMap::new(),
-        principal_claim: "sub".to_string(),
-        leeway: Duration::from_secs(60),
-        allow_insecure_localhost: false,
-    });
-
-    let err = config
-        .validate()
-        .expect_err("localhost http jwks_url needs explicit opt-in");
-    assert!(matches!(err, EvidenceConfigError::InvalidOidcConfig { .. }));
-
-    config
-        .auth
-        .oidc
-        .as_mut()
-        .expect("oidc config exists")
-        .allow_insecure_localhost = true;
-    config
-        .validate()
-        .expect("localhost http jwks_url is allowed only with the opt-in");
-}
-
-#[test]
-pub(super) fn api_key_plaintext_is_never_loaded_only_fingerprint() {
-    let err = serde_norway::from_str::<StandaloneRegistryNotaryConfig>(
-        r#"
-evidence:
-  enabled: true
-auth:
-  api_keys:
-    - id: test-key
-      token_env: TEST_TOKEN
-"#,
-    )
-    .expect_err("plaintext token_env is not part of the credential schema");
-
-    assert!(
-        err.to_string().contains("unknown field `token_env`"),
-        "unexpected error: {err}"
-    );
-}
-
-#[test]
-pub(super) fn legacy_api_key_fingerprint_commitment_rejected() {
-    let err = serde_norway::from_str::<StandaloneRegistryNotaryConfig>(
-        r#"
-evidence:
-  enabled: true
-auth:
-  api_keys:
-    - id: test-key
-      fingerprint:
-        provider: env
-        name: TEST_TOKEN_HASH
-        commitment: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-"#,
-    )
-    .expect_err("legacy fingerprint commitment must fail deserialization");
-
-    assert!(
-        err.to_string()
-            .contains("fingerprint.commitment was removed"),
-        "unexpected error: {err}"
-    );
-}
-
-#[test]
-pub(super) fn legacy_bearer_token_fingerprint_commitment_rejected() {
-    let err = serde_norway::from_str::<StandaloneRegistryNotaryConfig>(
-        r#"
-evidence:
-  enabled: true
-auth:
-  bearer_tokens:
-    - id: test-bearer
-      fingerprint:
-        provider: env
-        name: TEST_BEARER_HASH
-        commitment: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-"#,
-    )
-    .expect_err("legacy bearer token fingerprint commitment must fail deserialization");
-
-    assert!(
-        err.to_string()
-            .contains("fingerprint.commitment was removed"),
-        "unexpected error: {err}"
-    );
-}
-
-#[test]
-pub(super) fn removed_auth_mode_is_rejected_at_parse_time() {
-    let err = serde_norway::from_str::<StandaloneRegistryNotaryConfig>(
-        r#"
-evidence:
-  enabled: true
-auth:
-  mode: oauth2
-"#,
-    )
-    .expect_err("the removed auth mode field must fail deserialization");
-
-    let message = err.to_string();
-    assert!(
-        message.contains("mode") || message.contains("unknown field"),
-        "unexpected error: {message}"
-    );
-}
-
-#[test]
-pub(super) fn oidc_auth_allows_api_key_credentials() {
-    let mut config = valid_subject_access_config();
-    config.auth.api_keys.push(EvidenceCredentialConfig {
-        id: "legacy-api-key".to_string(),
-        fingerprint: CredentialFingerprintRef {
-            provider: registry_platform_authcommon::CredentialFingerprintProvider::Env,
-            name: Some("LEGACY_API_KEY_HASH".to_string()),
-            path: None,
-        },
-        scopes: vec!["subject_access".to_string()],
-        authorization_details: None,
-    });
-
-    config
-        .validate()
-        .expect("OIDC and API-key authenticators use distinct carriers");
-}
-
-#[test]
-pub(super) fn oidc_auth_rejects_static_bearer_credentials() {
-    let mut config = valid_subject_access_config();
-    config.auth.bearer_tokens.push(EvidenceCredentialConfig {
-        id: "ambiguous-bearer".to_string(),
-        fingerprint: CredentialFingerprintRef {
-            provider: registry_platform_authcommon::CredentialFingerprintProvider::Env,
-            name: Some("AMBIGUOUS_BEARER_HASH".to_string()),
-            path: None,
-        },
-        scopes: vec!["subject_access".to_string()],
-        authorization_details: None,
-    });
-
-    let reason = match config
-        .validate()
-        .expect_err("OIDC and static bearer tokens share one carrier")
-    {
-        EvidenceConfigError::InvalidOidcConfig { reason } => reason,
-        other => panic!("unexpected error variant: {other}"),
-    };
-    assert!(reason.contains("Authorization: Bearer"));
-}
diff --git a/crates/registry-notary-core/src/config/tests/credentials.rs b/crates/registry-notary-core/src/config/tests/credentials.rs
deleted file mode 100644
index 29dc25eed..000000000
--- a/crates/registry-notary-core/src/config/tests/credentials.rs
+++ /dev/null
@@ -1,1111 +0,0 @@
-use super::support::*;
-use super::*;
-#[allow(unused_imports)]
-use super::{auth::*, infrastructure::*, issuance::*, preauth::*, root::*};
-
-#[test]
-pub(super) fn proof_of_possession_required_with_only_did_jwk_is_valid() {
-    let mut config = minimal_config();
-    let profile: CredentialProfileConfig = serde_norway::from_str(
-        r#"
-format: application/dc+sd-jwt
-issuer: https://issuer.example
-signing_key: issuer-key
-vct: https://vct.example/test
-holder_binding:
-  mode: did
-  proof_of_possession: required
-  allowed_did_methods:
-    - did:jwk
-allowed_claims:
-  - some-claim
-"#,
-    )
-    .expect("profile YAML is valid");
-    config
-        .evidence
-        .credential_profiles
-        .insert("test-profile".to_string(), profile);
-    add_registry_credential_claim(&mut config, "some-claim", "test-profile");
-    assert!(
-        config.validate().is_ok(),
-        "did:jwk only should pass validation"
-    );
-}
-
-#[test]
-pub(super) fn credential_profile_format_must_use_current_sd_jwt_vc_media_type() {
-    let mut config = minimal_config();
-    let profile: CredentialProfileConfig = serde_norway::from_str(
-        r#"
-format: sd_jwt_vc
-issuer: https://issuer.example
-signing_key: issuer-key
-vct: https://vct.example/test
-allowed_claims:
-  - some-claim
-"#,
-    )
-    .expect("profile YAML is valid");
-    config
-        .evidence
-        .credential_profiles
-        .insert("legacy-alias".to_string(), profile);
-
-    let err = config
-        .validate()
-        .expect_err("legacy profile format alias must fail validation");
-    match err {
-        EvidenceConfigError::UnsupportedCredentialProfileFormat { profile, format } => {
-            assert_eq!(profile, "legacy-alias");
-            assert_eq!(format, "sd_jwt_vc");
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-#[test]
-pub(super) fn credential_profile_default_validity_is_short_lived() {
-    let profile: CredentialProfileConfig = serde_norway::from_str(
-        r#"
-format: application/dc+sd-jwt
-issuer: https://issuer.example
-signing_key: issuer-key
-vct: https://vct.example/test
-allowed_claims:
-  - some-claim
-"#,
-    )
-    .expect("profile YAML is valid");
-
-    assert_eq!(profile.validity_seconds, 600);
-}
-
-#[test]
-pub(super) fn credential_profile_default_holder_binding_is_did_jwk() {
-    let profile: CredentialProfileConfig = serde_norway::from_str(
-        r#"
-format: application/dc+sd-jwt
-issuer: https://issuer.example
-signing_key: issuer-key
-vct: https://vct.example/test
-allowed_claims:
-  - some-claim
-"#,
-    )
-    .expect("profile YAML is valid");
-
-    assert_eq!(profile.holder_binding.mode, "did");
-    assert_eq!(
-        profile.holder_binding.allowed_did_methods,
-        vec!["did:jwk".to_string()]
-    );
-    assert!(profile.holder_binding.proof_of_possession.is_none());
-}
-
-#[test]
-pub(super) fn credential_profile_can_explicitly_opt_out_of_holder_binding() {
-    let profile: CredentialProfileConfig = serde_norway::from_str(
-        r#"
-format: application/dc+sd-jwt
-issuer: https://issuer.example
-signing_key: issuer-key
-vct: https://vct.example/test
-holder_binding:
-  mode: none
-allowed_claims:
-  - some-claim
-"#,
-    )
-    .expect("profile YAML is valid");
-
-    assert_eq!(profile.holder_binding.mode, "none");
-    assert_eq!(
-        profile.holder_binding.allowed_did_methods,
-        vec!["did:jwk".to_string()]
-    );
-}
-
-#[test]
-pub(super) fn credential_profile_explicit_validity_is_honored() {
-    let profile: CredentialProfileConfig = serde_norway::from_str(
-        r#"
-format: application/dc+sd-jwt
-issuer: https://issuer.example
-signing_key: issuer-key
-vct: https://vct.example/test
-validity_seconds: 300
-allowed_claims:
-  - some-claim
-"#,
-    )
-    .expect("profile YAML is valid");
-
-    assert_eq!(profile.validity_seconds, 300);
-}
-
-#[test]
-pub(super) fn credential_profile_validity_above_general_ceiling_is_rejected() {
-    let mut config = minimal_config();
-    let profile: CredentialProfileConfig = serde_norway::from_str(
-        r#"
-format: application/dc+sd-jwt
-issuer: did:web:issuer.example
-signing_key: issuer-key
-vct: https://vct.example/test
-validity_seconds: 601
-allowed_claims:
-  - some-claim
-"#,
-    )
-    .expect("profile YAML is valid");
-    config
-        .evidence
-        .credential_profiles
-        .insert("long-lived".to_string(), profile);
-
-    let err = config
-        .validate()
-        .expect_err("over-ceiling credential validity must fail");
-    assert!(matches!(
-        err,
-        EvidenceConfigError::InvalidCredentialProfileValidity {
-            profile,
-            validity_seconds: 601,
-            max_validity_seconds: 600
-        } if profile == "long-lived"
-    ));
-}
-
-#[test]
-pub(super) fn credential_profile_non_positive_validity_is_rejected() {
-    for invalid in [0, -1] {
-        let mut config = minimal_config();
-        let mut profile: CredentialProfileConfig = serde_norway::from_str(
-            r#"
-format: application/dc+sd-jwt
-issuer: did:web:issuer.example
-signing_key: issuer-key
-vct: https://vct.example/test
-allowed_claims:
-  - some-claim
-"#,
-        )
-        .expect("profile YAML is valid");
-        profile.validity_seconds = invalid;
-        config
-            .evidence
-            .credential_profiles
-            .insert("invalid-validity".to_string(), profile);
-
-        let err = config
-            .validate()
-            .expect_err("non-positive credential validity must fail");
-        assert!(matches!(
-            err,
-            EvidenceConfigError::InvalidCredentialProfileValidity { .. }
-        ));
-    }
-}
-
-#[test]
-pub(super) fn signing_keys_are_configured_separately_from_credential_profiles() {
-    let mut config = minimal_config();
-    config.evidence.signing_keys = serde_norway::from_str(
-        r#"
-issuer-2026:
-  provider: local_jwk_env
-  private_jwk_env: ISSUER_KEY
-  alg: EdDSA
-  kid: did:web:issuer.example#issuer-2026
-  status: active
-issuer-2025:
-  provider: local_jwk_env
-  public_jwk_env: OLD_ISSUER_PUBLIC_KEY
-  alg: EdDSA
-  kid: did:web:issuer.example#issuer-2025
-  status: publish_only
-"#,
-    )
-    .expect("signing key YAML is valid");
-    let profile: CredentialProfileConfig = serde_norway::from_str(
-        r#"
-format: application/dc+sd-jwt
-issuer: https://issuer.example
-signing_key: issuer-2026
-vct: https://vct.example/test
-allowed_claims:
-  - some-claim
-"#,
-    )
-    .expect("profile YAML is valid");
-    config
-        .evidence
-        .credential_profiles
-        .insert("test-profile".to_string(), profile);
-    add_registry_credential_claim(&mut config, "some-claim", "test-profile");
-
-    config
-        .validate()
-        .expect("profile may reference an active signing key");
-}
-
-#[test]
-pub(super) fn credential_profiles_must_reference_active_signing_keys() {
-    let mut config = minimal_config();
-    config.evidence.signing_keys = serde_norway::from_str(
-        r#"
-issuer-2025:
-  provider: local_jwk_env
-  public_jwk_env: OLD_ISSUER_PUBLIC_KEY
-  alg: EdDSA
-  kid: did:web:issuer.example#issuer-2025
-  status: publish_only
-"#,
-    )
-    .expect("signing key YAML is valid");
-    let profile: CredentialProfileConfig = serde_norway::from_str(
-        r#"
-format: application/dc+sd-jwt
-issuer: https://issuer.example
-signing_key: issuer-2025
-vct: https://vct.example/test
-allowed_claims:
-  - some-claim
-"#,
-    )
-    .expect("profile YAML is valid");
-    config
-        .evidence
-        .credential_profiles
-        .insert("test-profile".to_string(), profile);
-
-    let err = config
-        .validate()
-        .expect_err("publish-only keys must not be used for new issuance");
-    match err {
-        EvidenceConfigError::CredentialProfileSigningKeyNotActive { profile, key } => {
-            assert_eq!(profile, "test-profile");
-            assert_eq!(key, "issuer-2025");
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-#[test]
-pub(super) fn publish_only_local_jwk_uses_public_jwk_env_only() {
-    let mut config = minimal_config();
-    config.evidence.signing_keys = serde_norway::from_str(
-        r#"
-issuer-2025:
-  provider: local_jwk_env
-  private_jwk_env: OLD_ISSUER_KEY
-  alg: EdDSA
-  kid: did:web:issuer.example#issuer-2025
-  status: publish_only
-"#,
-    )
-    .expect("signing key YAML is valid");
-
-    let err = config
-        .validate()
-        .expect_err("publish-only local keys must not require private material");
-    assert!(
-        err.to_string().contains("public_jwk_env must not be empty"),
-        "unexpected error: {err}"
-    );
-}
-
-#[test]
-pub(super) fn publish_only_signing_key_accepts_bounded_publication_window() {
-    let mut config = minimal_config();
-    config.evidence.signing_keys = serde_norway::from_str(
-        r#"
-issuer-2025:
-  provider: local_jwk_env
-  public_jwk_env: OLD_ISSUER_PUBLIC_KEY
-  alg: EdDSA
-  kid: did:web:issuer.example#issuer-2025
-  status: publish_only
-  publish_until_unix_seconds: 1893456000
-"#,
-    )
-    .expect("signing key YAML is valid");
-
-    let key = config
-        .evidence
-        .signing_keys
-        .get("issuer-2025")
-        .expect("publish-only key exists");
-    assert_eq!(key.publish_until_unix_seconds, Some(1_893_456_000));
-    assert!(key.may_publish_at(1_893_456_000));
-    assert!(!key.may_publish_at(1_893_456_001));
-    config
-        .validate()
-        .expect("publish-only key may carry a publication deadline");
-}
-
-#[test]
-pub(super) fn active_signing_key_rejects_publication_window() {
-    let mut config = minimal_config();
-    let active = config
-        .evidence
-        .signing_keys
-        .values_mut()
-        .find(|key| key.status == SigningKeyStatus::Active)
-        .expect("minimal config has an active key");
-    active.publish_until_unix_seconds = Some(1_893_456_000);
-
-    let err = config
-        .validate()
-        .expect_err("active signing keys cannot carry a publication deadline");
-    assert!(
-        err.to_string()
-            .contains("publish_until_unix_seconds is valid only for publish_only signing keys"),
-        "unexpected error: {err}"
-    );
-}
-
-#[test]
-pub(super) fn pkcs11_signing_key_shape_validates_without_loading_module() {
-    let mut config = minimal_config();
-    config.evidence.signing_keys = serde_norway::from_str(
-        r#"
-issuer-hsm:
-  provider: pkcs11
-  module_path: /usr/lib/softhsm/libsofthsm2.so
-  token_label: registry-notary
-  pin_env: REGISTRY_NOTARY_PKCS11_PIN
-  key_label: issuer-signing-key
-  key_id_hex: 01ab23cd
-  public_jwk_env: REGISTRY_NOTARY_ISSUER_PUBLIC_JWK
-  alg: EdDSA
-  kid: did:web:issuer.example#issuer-hsm
-  status: active
-"#,
-    )
-    .expect("signing key YAML is valid");
-    let profile: CredentialProfileConfig = serde_norway::from_str(
-        r#"
-format: application/dc+sd-jwt
-issuer: did:web:issuer.example
-signing_key: issuer-hsm
-vct: https://vct.example/test
-allowed_claims:
-  - some-claim
-"#,
-    )
-    .expect("profile YAML is valid");
-    config
-        .evidence
-        .credential_profiles
-        .insert("test-profile".to_string(), profile);
-    add_registry_credential_claim(&mut config, "some-claim", "test-profile");
-
-    config.validate().expect("PKCS#11 key shape validates");
-}
-
-#[test]
-pub(super) fn file_watch_signing_key_shape_validates_without_secret_material_in_config() {
-    let mut config = minimal_config();
-    config.evidence.signing_keys = serde_norway::from_str(
-        r#"
-issuer-file:
-  provider: file_watch
-  path: /run/secrets/issuer.jwk
-  alg: EdDSA
-  kid: did:web:issuer.example#issuer-file
-  status: active
-"#,
-    )
-    .expect("signing key YAML is valid");
-    let profile: CredentialProfileConfig = serde_norway::from_str(
-        r#"
-format: application/dc+sd-jwt
-issuer: did:web:issuer.example
-signing_key: issuer-file
-vct: https://vct.example/test
-allowed_claims:
-  - some-claim
-"#,
-    )
-    .expect("profile YAML is valid");
-    config
-        .evidence
-        .credential_profiles
-        .insert("test-profile".to_string(), profile);
-    add_registry_credential_claim(&mut config, "some-claim", "test-profile");
-
-    config.validate().expect("file-watch key shape validates");
-}
-
-#[test]
-pub(super) fn file_watch_signing_key_rejects_secret_fields_and_missing_path() {
-    let mut config = minimal_config();
-    config.evidence.signing_keys = serde_norway::from_str(
-        r#"
-issuer-file:
-  provider: file_watch
-  private_jwk_env: REGISTRY_NOTARY_ISSUER_JWK
-  alg: EdDSA
-  kid: did:web:issuer.example#issuer-file
-  status: active
-"#,
-    )
-    .expect("signing key YAML is valid");
-    let err = config
-        .validate()
-        .expect_err("file-watch key must use a local path");
-    assert!(
-        err.to_string().contains("path must not be empty"),
-        "unexpected error: {err}"
-    );
-
-    config.evidence.signing_keys = serde_norway::from_str(
-        r#"
-issuer-file:
-  provider: file_watch
-  path: /run/secrets/issuer.jwk
-  private_jwk_env: REGISTRY_NOTARY_ISSUER_JWK
-  alg: EdDSA
-  kid: did:web:issuer.example#issuer-file
-  status: active
-"#,
-    )
-    .expect("signing key YAML is valid");
-    let err = config
-        .validate()
-        .expect_err("file-watch key must not carry env-backed private material");
-    assert!(
-        err.to_string()
-            .contains("private_jwk_env is not valid for this signing key provider"),
-        "unexpected error: {err}"
-    );
-}
-
-#[test]
-pub(super) fn pkcs11_signing_key_requires_absolute_module_path() {
-    let mut config = minimal_config();
-    config.evidence.signing_keys = serde_norway::from_str(
-        r#"
-issuer-hsm:
-  provider: pkcs11
-  module_path: libsofthsm2.so
-  token_label: registry-notary
-  pin_env: REGISTRY_NOTARY_PKCS11_PIN
-  key_label: issuer-signing-key
-  key_id_hex: 01ab23cd
-  public_jwk_env: REGISTRY_NOTARY_ISSUER_PUBLIC_JWK
-  alg: EdDSA
-  kid: did:web:issuer.example#issuer-hsm
-  status: active
-"#,
-    )
-    .expect("signing key YAML is valid");
-
-    let err = config
-        .validate()
-        .expect_err("relative module path must fail validation");
-    assert!(
-        err.to_string().contains("module_path must be absolute"),
-        "unexpected error: {err}"
-    );
-}
-
-#[test]
-pub(super) fn pkcs11_signing_key_rejects_rs256_algorithm() {
-    let mut config = minimal_config();
-    config.evidence.signing_keys = serde_norway::from_str(
-        r#"
-issuer-hsm:
-  provider: pkcs11
-  module_path: /usr/lib/softhsm/libsofthsm2.so
-  token_label: registry-notary
-  pin_env: REGISTRY_NOTARY_PKCS11_PIN
-  key_label: issuer-signing-key
-  key_id_hex: 01ab23cd
-  public_jwk_env: REGISTRY_NOTARY_ISSUER_PUBLIC_JWK
-  alg: RS256
-  kid: did:web:issuer.example#issuer-hsm
-  status: active
-"#,
-    )
-    .expect("signing key YAML is valid");
-
-    let err = config
-        .validate()
-        .expect_err("PKCS#11 signing only supports EdDSA");
-    assert!(
-        err.to_string()
-            .contains("pkcs11 provider supports only EdDSA"),
-        "unexpected error: {err}"
-    );
-}
-
-#[test]
-pub(super) fn publish_only_pkcs11_key_uses_public_jwk_env_only() {
-    let mut config = minimal_config();
-    config.evidence.signing_keys = serde_norway::from_str(
-        r#"
-issuer-hsm-old:
-  provider: pkcs11
-  public_jwk_env: REGISTRY_NOTARY_OLD_ISSUER_PUBLIC_JWK
-  alg: EdDSA
-  kid: did:web:issuer.example#issuer-hsm-old
-  status: publish_only
-"#,
-    )
-    .expect("signing key YAML is valid");
-
-    config
-        .validate()
-        .expect("publish-only PKCS#11 key needs only public metadata");
-
-    config.evidence.signing_keys = serde_norway::from_str(
-        r#"
-issuer-hsm-old:
-  provider: pkcs11
-  module_path: /usr/lib/softhsm/libsofthsm2.so
-  public_jwk_env: REGISTRY_NOTARY_OLD_ISSUER_PUBLIC_JWK
-  alg: EdDSA
-  kid: did:web:issuer.example#issuer-hsm-old
-  status: publish_only
-"#,
-    )
-    .expect("signing key YAML is valid");
-    let err = config
-        .validate()
-        .expect_err("publish-only PKCS#11 key must not require HSM access");
-    assert!(
-        err.to_string()
-            .contains("module_path is not valid for this signing key provider"),
-        "unexpected error: {err}"
-    );
-}
-
-#[test]
-pub(super) fn local_pkcs12_file_provider_is_deferred_without_partial_support() {
-    let mut config = minimal_config();
-    config.evidence.signing_keys = serde_norway::from_str(
-        r#"
-issuer-p12:
-  provider: local_pkcs12_file
-  path: /run/secrets/issuer.p12
-  password_env: REGISTRY_NOTARY_P12_PASSWORD
-  alg: EdDSA
-  kid: did:web:issuer.example#issuer-p12
-  status: active
-"#,
-    )
-    .expect("signing key YAML is valid");
-
-    let err = config
-        .validate()
-        .expect_err("PKCS#12 support must fail closed until it is implemented");
-    assert!(
-        err.to_string()
-            .contains("local_pkcs12_file provider is intentionally not implemented yet"),
-        "unexpected error: {err}"
-    );
-}
-
-#[test]
-pub(super) fn proof_of_possession_required_with_non_jwk_method_is_rejected() {
-    let mut config = minimal_config();
-    let profile: CredentialProfileConfig = serde_norway::from_str(
-        r#"
-format: application/dc+sd-jwt
-issuer: https://issuer.example
-signing_key: issuer-key
-vct: https://vct.example/test
-holder_binding:
-  mode: did
-  proof_of_possession: required
-  allowed_did_methods:
-    - did:jwk
-    - did:key
-allowed_claims:
-  - some-claim
-"#,
-    )
-    .expect("profile YAML is valid");
-    config
-        .evidence
-        .credential_profiles
-        .insert("test-profile".to_string(), profile);
-
-    let err = config
-        .validate()
-        .expect_err("did:key with proof_of_possession required must fail");
-    match &err {
-        EvidenceConfigError::UnsupportedCredentialProfileDidMethods { profile, methods } => {
-            assert_eq!(profile, "test-profile");
-            assert!(
-                methods.contains(&"did:key".to_string()),
-                "error must name did:key, got: {methods:?}"
-            );
-            assert!(
-                !methods.contains(&"did:jwk".to_string()),
-                "did:jwk must not appear in the unsupported list"
-            );
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-#[test]
-pub(super) fn non_jwk_methods_are_rejected_even_without_proof_of_possession() {
-    let mut config = minimal_config();
-    let profile: CredentialProfileConfig = serde_norway::from_str(
-        r#"
-format: application/dc+sd-jwt
-issuer: https://issuer.example
-signing_key: issuer-key
-vct: https://vct.example/test
-holder_binding:
-  mode: did
-  allowed_did_methods:
-    - did:jwk
-    - did:key
-    - did:web
-allowed_claims:
-  - some-claim
-"#,
-    )
-    .expect("profile YAML is valid");
-    config
-        .evidence
-        .credential_profiles
-        .insert("test-profile".to_string(), profile);
-    let err = config
-        .validate()
-        .expect_err("non-did:jwk holder methods must fail validation");
-    match &err {
-        EvidenceConfigError::UnsupportedCredentialProfileDidMethods { profile, methods } => {
-            assert_eq!(profile, "test-profile");
-            assert_eq!(methods, &vec!["did:key".to_string(), "did:web".to_string()]);
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-// -----------------------------------------------------------------------
-// Finding 8: depends_on cycle detection
-// -----------------------------------------------------------------------
-
-#[test]
-pub(super) fn valid_dag_passes_cycle_detection() {
-    // A -> B -> C (no cycle)
-    let mut config = minimal_config();
-    let mut claim_a = minimal_claim("claim-a");
-    claim_a.depends_on = vec!["claim-b".to_string()];
-    let mut claim_b = minimal_claim("claim-b");
-    claim_b.depends_on = vec!["claim-c".to_string()];
-    let claim_c = minimal_claim("claim-c");
-    config.evidence.claims = vec![claim_a, claim_b, claim_c];
-    assert!(config.validate().is_ok(), "A->B->C DAG should pass");
-}
-
-#[test]
-pub(super) fn two_node_cycle_is_detected() {
-    // A -> B -> A
-    let mut config = minimal_config();
-    let mut claim_a = minimal_claim("claim-a");
-    claim_a.depends_on = vec!["claim-b".to_string()];
-    let mut claim_b = minimal_claim("claim-b");
-    claim_b.depends_on = vec!["claim-a".to_string()];
-    config.evidence.claims = vec![claim_a, claim_b];
-
-    let err = config
-        .validate()
-        .expect_err("A->B->A cycle must fail validation");
-    match &err {
-        EvidenceConfigError::DependsOnCycle { cycle } => {
-            assert!(
-                cycle.contains(&"claim-a".to_string()),
-                "cycle must mention claim-a, got: {cycle:?}"
-            );
-            assert!(
-                cycle.contains(&"claim-b".to_string()),
-                "cycle must mention claim-b, got: {cycle:?}"
-            );
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-#[test]
-pub(super) fn self_loop_is_detected() {
-    // A -> A
-    let mut config = minimal_config();
-    let mut claim_a = minimal_claim("claim-a");
-    claim_a.depends_on = vec!["claim-a".to_string()];
-    config.evidence.claims = vec![claim_a];
-
-    let err = config
-        .validate()
-        .expect_err("self-loop must fail validation");
-    match &err {
-        EvidenceConfigError::DependsOnCycle { cycle } => {
-            assert!(
-                cycle.contains(&"claim-a".to_string()),
-                "cycle must mention claim-a, got: {cycle:?}"
-            );
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-#[test]
-pub(super) fn unknown_depends_on_is_rejected() {
-    let mut config = minimal_config();
-    let mut claim_a = minimal_claim("claim-a");
-    claim_a.depends_on = vec!["claim-nonexistent".to_string()];
-    config.evidence.claims = vec![claim_a];
-
-    let err = config
-        .validate()
-        .expect_err("depends_on unknown claim must fail validation");
-    match &err {
-        EvidenceConfigError::DependsOnUnknownClaim { claim, unknown } => {
-            assert_eq!(claim, "claim-a");
-            assert_eq!(unknown, "claim-nonexistent");
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-// -----------------------------------------------------------------------
-// GH#170 / RS-DM-CLAIM Section 10: load-time validation for invariants
-// the loader previously deferred to request/evaluation time.
-// -----------------------------------------------------------------------
-
-#[test]
-pub(super) fn duplicate_claim_id_is_rejected() {
-    // REQ-DM-CLAIM-001: two claims sharing an id previously loaded
-    // cleanly; the loader must now reject it.
-    let mut config = minimal_config();
-    let claim_a = minimal_claim("repeated-id");
-    let claim_b = minimal_claim("repeated-id");
-    config.evidence.claims = vec![claim_a, claim_b];
-
-    let err = config
-        .validate()
-        .expect_err("duplicate claim id must fail validation");
-    match &err {
-        EvidenceConfigError::DuplicateClaimId { claim } => {
-            assert_eq!(claim, "repeated-id");
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-    assert!(
-        err.to_string().contains("repeated-id"),
-        "error must name the offending claim id: {err}"
-    );
-}
-
-#[test]
-pub(super) fn disclosure_default_outside_allowed_is_rejected() {
-    // REQ-DM-CLAIM-008: a disclosure default outside the allowed set
-    // previously surfaced only when a result was rendered. This is the
-    // most consequential of the three Section 10 gaps: a
-    // privacy-sensitive claim could otherwise ship an internally
-    // inconsistent disclosure policy that only fails on first render.
-    let mut config = minimal_config();
-    let mut claim = minimal_claim("residency-status");
-    claim.disclosure = DisclosureConfig {
-        default: "value".to_string(),
-        allowed: vec!["redacted".to_string()],
-        downgrade: "deny".to_string(),
-    };
-    config.evidence.claims = vec![claim];
-
-    let err = config
-        .validate()
-        .expect_err("disclosure default outside allowed must fail validation");
-    match &err {
-        EvidenceConfigError::ClaimDisclosureDefaultNotAllowed {
-            claim,
-            default,
-            allowed,
-        } => {
-            assert_eq!(claim, "residency-status");
-            assert_eq!(default, "value");
-            assert_eq!(allowed, &vec!["redacted".to_string()]);
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-    let message = err.to_string();
-    assert!(
-        message.contains("residency-status") && message.contains("disclosure"),
-        "error must name the offending claim id and field: {message}"
-    );
-}
-
-#[test]
-pub(super) fn omitted_claim_formats_default_to_claim_result_json() {
-    let claim = minimal_claim("default-format");
-
-    assert_eq!(
-        claim.formats,
-        vec![FORMAT_CLAIM_RESULT_JSON.to_string()],
-        "omitted formats must retain the canonical evaluation representation"
-    );
-}
-
-#[test]
-pub(super) fn explicit_empty_claim_formats_are_rejected() {
-    let mut config = minimal_config();
-    let mut claim = minimal_claim("empty-format");
-    claim.formats.clear();
-    config.evidence.claims = vec![claim];
-
-    let err = config
-        .validate()
-        .expect_err("an explicitly empty formats list must fail validation");
-    match &err {
-        EvidenceConfigError::EmptyClaimFormats { claim } => {
-            assert_eq!(claim, "empty-format");
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-    let message = err.to_string();
-    assert!(
-        message.contains("empty-format") && message.contains("omit formats"),
-        "error must name the claim and explain how to use the default: {message}"
-    );
-}
-
-#[test]
-pub(super) fn canonical_claim_format_is_valid() {
-    let mut config = minimal_config();
-    let mut claim = minimal_claim("canonical-format");
-    claim.formats = vec![FORMAT_CLAIM_RESULT_JSON.to_string()];
-    config.evidence.claims = vec![claim];
-
-    config
-        .validate()
-        .expect("the canonical evaluation format must validate");
-}
-
-#[test]
-pub(super) fn canonical_and_cccev_claim_formats_are_valid() {
-    let mut config = minimal_config();
-    let mut claim = minimal_claim("canonical-and-cccev");
-    claim.formats = vec![
-        FORMAT_CLAIM_RESULT_JSON.to_string(),
-        FORMAT_CCCEV_JSONLD.to_string(),
-    ];
-    config.evidence.claims = vec![claim];
-
-    config
-        .validate()
-        .expect("the canonical and CCCEV evaluation formats must validate");
-}
-
-#[test]
-pub(super) fn cccev_without_canonical_claim_format_is_rejected() {
-    let mut config = minimal_config();
-    let mut claim = minimal_claim("cccev-only");
-    claim.formats = vec![FORMAT_CCCEV_JSONLD.to_string()];
-    config.evidence.claims = vec![claim];
-
-    let err = config
-        .validate()
-        .expect_err("CCCEV-only formats must fail validation");
-    match &err {
-        EvidenceConfigError::MissingCanonicalClaimFormat { claim } => {
-            assert_eq!(claim, "cccev-only");
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-    let message = err.to_string();
-    assert!(
-        message.contains("cccev-only") && message.contains(FORMAT_CLAIM_RESULT_JSON),
-        "error must name the claim and canonical format: {message}"
-    );
-}
-
-#[test]
-pub(super) fn sd_jwt_vc_claim_format_is_rejected_before_canonical_omission() {
-    let mut config = minimal_config();
-    let mut claim = minimal_claim("sd-jwt-only");
-    claim.formats = vec![FORMAT_SD_JWT_VC.to_string()];
-    config.evidence.claims = vec![claim];
-
-    let err = config
-        .validate()
-        .expect_err("SD-JWT VC is not an evaluation response format");
-    match &err {
-        EvidenceConfigError::UnsupportedClaimFormat { claim, format } => {
-            assert_eq!(claim, "sd-jwt-only");
-            assert_eq!(format, FORMAT_SD_JWT_VC);
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-    let message = err.to_string();
-    assert!(
-        message.contains("credential_profiles") && message.contains(FORMAT_SD_JWT_VC),
-        "error must identify SD-JWT VC and its configuration home: {message}"
-    );
-}
-
-#[test]
-pub(super) fn mixed_claim_formats_reject_the_first_unsupported_format() {
-    let mut config = minimal_config();
-    let mut claim = minimal_claim("mixed-formats");
-    claim.formats = vec![
-        FORMAT_CLAIM_RESULT_JSON.to_string(),
-        FORMAT_SD_JWT_VC.to_string(),
-        "application/example+json".to_string(),
-    ];
-    config.evidence.claims = vec![claim];
-
-    let err = config
-        .validate()
-        .expect_err("mixed formats must reject the unsupported SD-JWT VC entry");
-    match &err {
-        EvidenceConfigError::UnsupportedClaimFormat { claim, format } => {
-            assert_eq!(claim, "mixed-formats");
-            assert_eq!(format, FORMAT_SD_JWT_VC);
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-#[test]
-pub(super) fn unknown_claim_format_is_rejected() {
-    let mut config = minimal_config();
-    let mut claim = minimal_claim("unknown-format");
-    claim.formats = vec![
-        FORMAT_CLAIM_RESULT_JSON.to_string(),
-        "application/example+json".to_string(),
-    ];
-    config.evidence.claims = vec![claim];
-
-    let err = config
-        .validate()
-        .expect_err("unknown evaluation formats must fail validation");
-    match &err {
-        EvidenceConfigError::UnsupportedClaimFormat { claim, format } => {
-            assert_eq!(claim, "unknown-format");
-            assert_eq!(format, "application/example+json");
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-    assert!(
-        err.to_string().contains("application/example+json"),
-        "error must name the offending format: {err}"
-    );
-}
-
-#[test]
-pub(super) fn empty_allowed_claims_is_rejected() {
-    // A credential profile with an empty allowed_claims would silently
-    // accept every claim at issue time (see api.rs `is_empty()` short
-    // circuit). Reject at config-load time so the operator must opt in.
-    let mut config = minimal_config();
-    let profile: CredentialProfileConfig = serde_norway::from_str(
-        r#"
-format: application/dc+sd-jwt
-issuer: https://issuer.example
-signing_key: issuer-key
-vct: https://vct.example/test
-"#,
-    )
-    .expect("profile YAML is valid");
-    config
-        .evidence
-        .credential_profiles
-        .insert("the_profile_id".to_string(), profile);
-
-    let err = config
-        .validate()
-        .expect_err("empty allowed_claims must fail validation");
-    match &err {
-        EvidenceConfigError::EmptyAllowedClaims { profile } => {
-            assert_eq!(profile, "the_profile_id");
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-// -----------------------------------------------------------------------
-// Stage 1: concurrency config and the kill-switch
-// -----------------------------------------------------------------------
-
-#[test]
-pub(super) fn default_concurrency_has_documented_defaults() {
-    let cfg = ConcurrencyConfig::default();
-    assert_eq!(cfg.subjects, 16);
-    assert!(cfg.validate().is_ok());
-}
-
-#[test]
-pub(super) fn concurrency_zero_subjects_is_rejected() {
-    let mut config = minimal_config();
-    config.evidence.concurrency = ConcurrencyConfig { subjects: 0 };
-    let err = config
-        .validate()
-        .expect_err("subjects=0 must fail validation");
-    assert!(matches!(err, EvidenceConfigError::InvalidConcurrency));
-}
-
-#[test]
-pub(super) fn concurrency_subjects_one_validates() {
-    let mut config = minimal_config();
-    config.evidence.concurrency = ConcurrencyConfig { subjects: 1 };
-    assert!(config.validate().is_ok());
-}
-
-// -----------------------------------------------------------------------
-// Machine quota config
-// -----------------------------------------------------------------------
-
-#[test]
-pub(super) fn machine_quota_defaults_to_disabled_with_documented_limit() {
-    let cfg = MachineQuotaConfig::default();
-    assert!(!cfg.enabled);
-    assert_eq!(cfg.subjects_per_minute, 6000);
-    assert!(cfg.validate().is_ok());
-}
-
-#[test]
-pub(super) fn machine_quota_disabled_zero_limit_still_validates() {
-    // A zero subjects_per_minute is only invalid once the quota is
-    // enabled; an operator-provided but unused value must not block
-    // deployments that leave the quota off.
-    let cfg = MachineQuotaConfig {
-        enabled: false,
-        subjects_per_minute: 0,
-    };
-    assert!(cfg.validate().is_ok());
-}
-
-#[test]
-pub(super) fn machine_quota_enabled_zero_limit_is_rejected() {
-    let mut config = minimal_config();
-    config.evidence.machine_quota = MachineQuotaConfig {
-        enabled: true,
-        subjects_per_minute: 0,
-    };
-    let err = config
-        .validate()
-        .expect_err("enabled machine_quota with subjects_per_minute=0 must fail validation");
-    match &err {
-        EvidenceConfigError::InvalidMachineQuotaConfig { reason } => {
-            assert!(reason.contains("subjects_per_minute"));
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-#[test]
-pub(super) fn machine_quota_enabled_with_positive_limit_validates() {
-    let mut config = minimal_config();
-    config.evidence.machine_quota = MachineQuotaConfig {
-        enabled: true,
-        subjects_per_minute: 1,
-    };
-    assert!(config.validate().is_ok());
-}
diff --git a/crates/registry-notary-core/src/config/tests/infrastructure.rs b/crates/registry-notary-core/src/config/tests/infrastructure.rs
deleted file mode 100644
index 8c705242b..000000000
--- a/crates/registry-notary-core/src/config/tests/infrastructure.rs
+++ /dev/null
@@ -1,508 +0,0 @@
-use super::support::*;
-use super::*;
-#[allow(unused_imports)]
-use super::{auth::*, credentials::*, issuance::*, preauth::*, root::*};
-
-#[test]
-pub(super) fn state_postgresql_config_parses_and_validates() {
-    let mut config = minimal_config();
-    config.state = serde_norway::from_str(
-        r#"
-storage: postgresql
-postgresql:
-  url_env: REGISTRY_NOTARY_POSTGRES_URL
-  root_certificate_path: /run/secrets/notary-postgres-ca.pem
-  connect_timeout_ms: 5000
-  operation_timeout_ms: 2000
-  max_connections: 12
-  sensitive_state_key_env: REGISTRY_NOTARY_SENSITIVE_STATE_KEY
-"#,
-    )
-    .expect("PostgreSQL state config parses");
-
-    config
-        .validate()
-        .expect("PostgreSQL state config validates");
-    assert_eq!(config.state.storage, STATE_STORAGE_POSTGRESQL);
-    assert_eq!(
-        config.state.postgresql.root_certificate_path.as_deref(),
-        Some(std::path::Path::new("/run/secrets/notary-postgres-ca.pem"))
-    );
-}
-
-#[test]
-pub(super) fn state_defaults_to_postgresql_contract() {
-    let config = minimal_config();
-
-    assert_eq!(config.state.storage, STATE_STORAGE_POSTGRESQL);
-    assert_eq!(
-        config.state.postgresql.url_env,
-        "REGISTRY_NOTARY_POSTGRES_URL"
-    );
-    assert_eq!(config.state.postgresql.connect_timeout_ms, 5_000);
-    assert_eq!(config.state.postgresql.operation_timeout_ms, 2_000);
-    assert_eq!(config.state.postgresql.max_connections, 16);
-    assert_eq!(
-        config.state.postgresql.sensitive_state_key_env,
-        "REGISTRY_NOTARY_SENSITIVE_STATE_KEY"
-    );
-    config.validate().expect("default state config validates");
-}
-
-#[test]
-pub(super) fn state_postgresql_config_rejects_invalid_connection_shape() {
-    let mut config = minimal_config();
-    config.state.postgresql.url_env.clear();
-    let reason = expect_state_error(&config);
-    assert!(
-        reason.contains("state.postgresql.url_env"),
-        "unexpected: {reason}"
-    );
-
-    config = minimal_config();
-    config.state.postgresql.connect_timeout_ms = 0;
-    let reason = expect_state_error(&config);
-    assert!(
-        reason.contains("connect_timeout_ms"),
-        "unexpected: {reason}"
-    );
-
-    config = minimal_config();
-    config.state.postgresql.operation_timeout_ms = 0;
-    let reason = expect_state_error(&config);
-    assert!(
-        reason.contains("operation_timeout_ms"),
-        "unexpected: {reason}"
-    );
-
-    config = minimal_config();
-    config.state.postgresql.max_connections = 0;
-    let reason = expect_state_error(&config);
-    assert!(reason.contains("max_connections"), "unexpected: {reason}");
-
-    config = minimal_config();
-    config.state.postgresql.max_connections = STATE_POSTGRESQL_MAX_CONNECTIONS + 1;
-    let reason = expect_state_error(&config);
-    assert!(reason.contains("max_connections"), "unexpected: {reason}");
-
-    config = minimal_config();
-    config.state.postgresql.root_certificate_path = Some(std::path::PathBuf::new());
-    let reason = expect_state_error(&config);
-    assert!(
-        reason.contains("root_certificate_path"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn state_in_memory_is_limited_to_local_single_instance() {
-    let mut config = minimal_config();
-    config.state.storage = STATE_STORAGE_IN_MEMORY.to_string();
-
-    let reason = expect_state_error(&config);
-    assert!(
-        reason.contains("deployment.profile = local"),
-        "unexpected: {reason}"
-    );
-
-    config.deployment.profile = Some(crate::deployment::DeploymentProfile::HostedLab);
-    let reason = expect_state_error(&config);
-    assert!(
-        reason.contains("deployment.profile = local"),
-        "unexpected: {reason}"
-    );
-
-    config.deployment.profile = Some(crate::deployment::DeploymentProfile::Local);
-    config.deployment.multi_instance = true;
-    let reason = expect_state_error(&config);
-    assert!(
-        reason.contains("deployment.multi_instance = false"),
-        "unexpected: {reason}"
-    );
-
-    config.deployment.multi_instance = false;
-    config
-        .validate()
-        .expect("local single-instance in-memory state validates");
-}
-
-#[test]
-pub(super) fn state_rejects_unknown_storage() {
-    let mut config = minimal_config();
-    config.state.storage = "redis".to_string();
-
-    let reason = expect_state_error(&config);
-    assert!(
-        reason.contains("postgresql or in_memory"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn state_postgresql_requires_sensitive_key_env_for_preauthorization() {
-    let mut config = valid_pre_auth_config();
-    config.state.postgresql.sensitive_state_key_env.clear();
-
-    let reason = expect_state_error(&config);
-    assert!(
-        reason.contains("sensitive_state_key_env"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn removed_per_domain_storage_selectors_are_rejected() {
-    let replay = serde_norway::from_str::<StandaloneRegistryNotaryConfig>(
-        r#"
-evidence:
-  enabled: true
-  signing_keys:
-    issuer-key:
-      provider: local_jwk_env
-      private_jwk_env: ISSUER_KEY
-      alg: EdDSA
-      kid: did:web:issuer.example#key-1
-      status: active
-auth:
-  api_keys:
-    - id: test-key
-      fingerprint:
-        provider: env
-        name: TEST_TOKEN_HASH
-replay:
-  storage: redis
-"#,
-    )
-    .expect_err("top-level replay config was removed");
-    assert!(replay.to_string().contains("replay"));
-
-    let credential_status = serde_norway::from_str::<CredentialStatusConfig>(
-        r#"
-enabled: true
-base_url: https://issuer.example
-storage: redis
-redis:
-  url_env: REGISTRY_NOTARY_STATUS_REDIS_URL
-"#,
-    )
-    .expect_err("credential-status storage selectors were removed");
-    let error = credential_status.to_string();
-    assert!(error.contains("storage") || error.contains("redis"));
-}
-
-#[test]
-pub(super) fn credential_status_config_requires_base_url_when_enabled() {
-    let mut config = minimal_config();
-    config.credential_status = serde_norway::from_str(
-        r#"
-enabled: true
-base_url: ""
-"#,
-    )
-    .expect("credential status config parses");
-
-    let reason = expect_credential_status_error(&config);
-    assert!(
-        reason.contains("credential_status.base_url"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn audit_config_deserializes_rotation_and_syslog_fields() {
-    let file: EvidenceAuditConfig = serde_norway::from_str(
-        r#"
-sink: file
-path: /var/log/registry-notary/audit.jsonl
-hash_secret_env: REGISTRY_NOTARY_AUDIT_HASH_SECRET
-max_size_mb: 4
-max_files: 3
-"#,
-    )
-    .expect("file audit config is valid YAML");
-
-    assert_eq!(file.sink, "file");
-    assert_eq!(
-        file.path.as_deref(),
-        Some("/var/log/registry-notary/audit.jsonl")
-    );
-    assert_eq!(file.max_size_bytes(), 4 * 1024 * 1024);
-    assert_eq!(file.max_files(), 3);
-    assert_eq!(file.syslog_socket_path, None);
-
-    let syslog: EvidenceAuditConfig = serde_norway::from_str(
-        r#"
-sink: syslog
-hash_secret_env: REGISTRY_NOTARY_AUDIT_HASH_SECRET
-syslog_socket_path: /dev/log
-"#,
-    )
-    .expect("syslog audit config is valid YAML");
-
-    assert_eq!(syslog.sink, "syslog");
-    assert_eq!(syslog.path, None);
-    assert_eq!(syslog.max_size_bytes(), 100 * 1024 * 1024);
-    assert_eq!(syslog.max_files(), 14);
-    assert_eq!(syslog.syslog_socket_path.as_deref(), Some("/dev/log"));
-}
-
-pub(super) fn valid_federation_config() -> StandaloneRegistryNotaryConfig {
-    let mut config = minimal_config();
-    let mut claim = minimal_claim("disability-status");
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-        panic!("minimal claim is registry backed")
-    };
-    consultations
-        .get_mut("test_source")
-        .expect("minimal consultation exists")
-        .inputs
-        .insert(
-            "subject_id".to_string(),
-            RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.national_id".to_string(),
-            ),
-        );
-    config.evidence.claims = vec![claim];
-    config.federation = FederationConfig {
-        enabled: true,
-        node_id: "did:web:agency-a.example.gov".to_string(),
-        issuer: "https://agency-a.example.gov".to_string(),
-        jwks_uri: "https://agency-a.example.gov/federation/jwks.json".to_string(),
-        federation_api: "https://agency-a.example.gov/federation/v1".to_string(),
-        supported_protocol_versions: vec![FEDERATION_PROTOCOL_V0_1.to_string()],
-        signing: FederationSigningConfig {
-            signing_key: "federation-key".to_string(),
-        },
-        pairwise_subject_hash: FederationPairwiseSubjectHashConfig {
-            secret_env: "FEDERATION_PAIRWISE_SECRET".to_string(),
-        },
-        peers: vec![FederationPeerConfig {
-            node_id: "did:web:agency-b.example.gov".to_string(),
-            issuer: "https://agency-b.example.gov".to_string(),
-            jwks_uri: "https://agency-b.example.gov/federation/jwks.json".to_string(),
-            allowed_protocol_versions: vec![FEDERATION_PROTOCOL_V0_1.to_string()],
-            allowed_purposes: vec![
-                "https://purpose.example.gov/social-protection/service-delivery".to_string(),
-            ],
-            allowed_profiles: vec!["disability_status_predicate".to_string()],
-            evaluation_scopes: vec!["registry:consult:test-source".to_string()],
-            ..FederationPeerConfig::default()
-        }],
-        evaluation_profiles: vec![FederationEvaluationProfileConfig {
-            id: "disability_status_predicate".to_string(),
-            ruleset: "disability-status-v1".to_string(),
-            claim_id: "disability-status".to_string(),
-            subject_id_type: "national_id".to_string(),
-            disclosure: Some("predicate".to_string()),
-            max_claim_result_age_seconds: Some(300),
-            ..FederationEvaluationProfileConfig::default()
-        }],
-        ..FederationConfig::default()
-    };
-    config.evidence.signing_keys.insert(
-        "federation-key".to_string(),
-        SigningKeyConfig {
-            provider: SigningKeyProviderConfig::LocalJwkEnv,
-            alg: FEDERATION_SIGNING_ALG_EDDSA.to_string(),
-            kid: "agency-a-fed-1".to_string(),
-            status: SigningKeyStatus::Active,
-            publish_until_unix_seconds: None,
-            private_jwk_env: "FEDERATION_SIGNING_KEY".to_string(),
-            public_jwk_env: String::new(),
-            module_path: String::new(),
-            token_label: String::new(),
-            pin_env: String::new(),
-            key_label: String::new(),
-            key_id_hex: String::new(),
-            path: String::new(),
-            password_env: String::new(),
-        },
-    );
-    config
-}
-
-#[test]
-pub(super) fn federation_config_validates_enabled_mvp_shape() {
-    valid_federation_config()
-        .validate()
-        .expect("federation config validates");
-}
-
-#[test]
-pub(super) fn federation_profile_rejects_relay_inputs_unavailable_from_subject() {
-    let mut config = valid_federation_config();
-    let ClaimEvidenceMode::RegistryBacked { consultations } =
-        &mut config.evidence.claims[0].evidence_mode
-    else {
-        panic!("federation claim is registry backed")
-    };
-    consultations
-        .get_mut("test_source")
-        .expect("federation consultation exists")
-        .inputs
-        .insert("subject_id".to_string(), RelayConsultationInput::TargetId);
-
-    let reason = expect_federation_error(&config);
-
-    assert!(
-        reason.contains("Relay inputs must derive from request.target.identifiers.national_id"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn federation_peer_rejects_profile_with_missing_dependency_scope() {
-    let mut config = valid_federation_config();
-    let mut dependency = config.evidence.claims[0].clone();
-    dependency.id = "disability-status-dependency".to_string();
-    dependency.required_scopes = vec!["registry:consult:dependency".to_string()];
-    config.evidence.claims[0].depends_on = vec![dependency.id.clone()];
-    config.evidence.claims.push(dependency);
-
-    let reason = expect_federation_error(&config);
-
-    assert!(
-        reason.contains(
-            "evaluation_scopes must include required scope 'registry:consult:dependency'"
-        ),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn federation_signing_key_must_reference_active_named_signing_key() {
-    let mut config = valid_federation_config();
-    config.federation.signing.signing_key = "missing-key".to_string();
-    let reason = expect_federation_error(&config);
-    assert!(
-        reason.contains("unknown signing key 'missing-key'"),
-        "unexpected: {reason}"
-    );
-
-    config = valid_federation_config();
-    let federation_key = config
-        .evidence
-        .signing_keys
-        .get_mut("federation-key")
-        .expect("federation signing key exists");
-    federation_key.status = SigningKeyStatus::PublishOnly;
-    federation_key.private_jwk_env = String::new();
-    federation_key.public_jwk_env = "FEDERATION_SIGNING_PUBLIC_KEY".to_string();
-    let reason = expect_federation_error(&config);
-    assert!(
-        reason.contains("must reference an active signing key"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn federation_replay_storage_selector_is_rejected() {
-    let error = serde_norway::from_str::<FederationConfig>(
-        r#"
-replay:
-  storage: redis
-"#,
-    )
-    .expect_err("federation replay storage selection was removed");
-    assert!(error.to_string().contains("replay"));
-}
-
-#[test]
-pub(super) fn federation_peer_private_network_jwks_escape_hatch_deserializes_and_validates() {
-    let mut config = valid_federation_config();
-    let peer: FederationPeerConfig = serde_norway::from_str(
-        r#"
-node_id: did:web:agency-b.example.gov
-issuer: https://agency-b.example.gov
-jwks_uri: http://federation-peer-jwks:8080/jwks.json
-allow_insecure_private_network: true
-allowed_protocol_versions:
-  - registry-notary-federation/v0.1
-allowed_purposes:
-  - https://purpose.example.gov/social-protection/service-delivery
-allowed_profiles:
-  - disability_status_predicate
-evaluation_scopes:
-  - registry:consult:test-source
-"#,
-    )
-    .expect("private-network peer YAML parses");
-    assert!(peer.allow_insecure_private_network);
-    config.federation.peers = vec![peer];
-    config
-        .validate()
-        .expect("private-network peer JWKS is accepted only with explicit opt-in");
-}
-
-#[test]
-pub(super) fn federation_rejects_removed_source_named_fields() {
-    let peer_error = serde_norway::from_str::<FederationPeerConfig>(
-        r#"
-node_id: did:web:agency-b.example.gov
-issuer: https://agency-b.example.gov
-jwks_uri: https://agency-b.example.gov/.well-known/jwks.json
-source_scopes:
-  - civil_registry:evidence_verification
-"#,
-    )
-    .expect_err("the unreleased source_scopes field must not remain an alias");
-    assert!(peer_error.to_string().contains("source_scopes"));
-
-    let profile_error = serde_norway::from_str::<FederationEvaluationProfileConfig>(
-        r#"
-id: disability_status_predicate
-ruleset: disability-status-v1
-claim_id: disability-status
-subject_id_type: national_id
-max_source_observed_age_seconds: 300
-"#,
-    )
-    .expect_err("the unreleased source-age field must not remain an alias");
-    assert!(profile_error
-        .to_string()
-        .contains("max_source_observed_age_seconds"));
-}
-
-#[test]
-pub(super) fn federation_peer_http_private_network_jwks_requires_escape_hatch() {
-    let mut config = valid_federation_config();
-    config.federation.peers[0].jwks_uri = "http://federation-peer-jwks:8080/jwks.json".to_string();
-    let reason = expect_federation_error(&config);
-    assert!(reason.contains("jwks_uri must be an HTTPS URL"));
-}
-
-#[test]
-pub(super) fn federation_config_rejects_bad_did_issuer_binding() {
-    let mut config = valid_federation_config();
-    config.federation.issuer = "https://other-agency.example.gov".to_string();
-    let reason = expect_federation_error(&config);
-    assert!(reason.contains("node_id must bind"));
-}
-
-#[test]
-pub(super) fn federation_config_rejects_missing_protocol_and_bad_profile_reference() {
-    let mut missing_protocol = valid_federation_config();
-    missing_protocol
-        .federation
-        .supported_protocol_versions
-        .clear();
-    let reason = expect_federation_error(&missing_protocol);
-    assert!(reason.contains("supported_protocol_versions"));
-
-    let mut bad_profile = valid_federation_config();
-    bad_profile.federation.evaluation_profiles[0].claim_id = "unknown".to_string();
-    let reason = expect_federation_error(&bad_profile);
-    assert!(reason.contains("claim_id must reference"));
-}
-
-#[test]
-pub(super) fn federation_profile_disclosure_must_be_known_profile() {
-    let mut config = valid_federation_config();
-    config.federation.evaluation_profiles[0].disclosure = Some("raw".to_string());
-    let reason = expect_federation_error(&config);
-    assert!(reason.contains("disclosure must be value, predicate, or redacted"));
-}
-
-// -----------------------------------------------------------------------
-// Finding 3: holder binding / did-method mismatch
-// -----------------------------------------------------------------------
diff --git a/crates/registry-notary-core/src/config/tests/issuance.rs b/crates/registry-notary-core/src/config/tests/issuance.rs
deleted file mode 100644
index b69661571..000000000
--- a/crates/registry-notary-core/src/config/tests/issuance.rs
+++ /dev/null
@@ -1,1532 +0,0 @@
-use super::support::*;
-use super::*;
-#[allow(unused_imports)]
-use super::{auth::*, credentials::*, infrastructure::*, preauth::*, root::*};
-
-#[test]
-pub(super) fn subject_access_is_disabled_by_default() {
-    let config = minimal_config();
-    assert!(!config.subject_access.enabled);
-    assert!(config.validate().is_ok());
-}
-
-#[test]
-pub(super) fn oid4vci_is_disabled_by_default() {
-    let config = minimal_config();
-    assert!(!config.oid4vci.enabled);
-    assert!(config.validate().is_ok());
-}
-
-#[test]
-pub(super) fn disabled_default_subject_access_is_omitted_from_serialized_config() {
-    let config = minimal_config();
-    let serialized = serde_json::to_value(&config).expect("config serializes as JSON");
-
-    assert!(
-        serialized.get("subject_access").is_none(),
-        "disabled default subject_access must stay compact when serialized: {serialized}",
-    );
-}
-
-#[test]
-pub(super) fn disabled_default_oid4vci_is_omitted_from_serialized_config() {
-    let config = minimal_config();
-    let serialized = serde_json::to_value(&config).expect("config serializes as JSON");
-
-    assert!(
-        serialized.get("oid4vci").is_none(),
-        "disabled default oid4vci must stay compact when serialized: {serialized}",
-    );
-}
-
-#[test]
-pub(super) fn valid_subject_access_config_passes_validation() {
-    let config = valid_subject_access_config();
-    assert!(config.validate().is_ok());
-}
-
-#[test]
-pub(super) fn delegated_subject_access_accepts_compiler_pinned_relay_proofs() {
-    let config = valid_delegated_subject_access_config();
-    config
-        .validate()
-        .expect("Relay-backed delegated proof config validates");
-}
-
-#[test]
-pub(super) fn valid_oid4vci_config_passes_validation() {
-    let config = valid_oid4vci_config();
-    assert!(config.validate().is_ok());
-}
-
-fn valid_representative_oid4vci_config() -> StandaloneRegistryNotaryConfig {
-    let oid4vci_base = valid_oid4vci_config();
-    let mut config = valid_delegated_subject_access_config();
-    config.oid4vci = oid4vci_base.oid4vci;
-    config.auth.access_token_signing = oid4vci_base.auth.access_token_signing;
-    config
-        .subject_access
-        .rate_limits
-        .tx_code_attempts_per_code_per_minute = 5;
-    config.evidence.signing_keys.insert(
-        "access-token-key".to_string(),
-        oid4vci_base
-            .evidence
-            .signing_keys
-            .get("access-token-key")
-            .expect("access token key exists")
-            .clone(),
-    );
-    let profile = config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("credential profile exists");
-    profile.vct = "http://127.0.0.1:4325/credentials/civil-status".to_string();
-    profile
-        .allowed_claims
-        .push("dependent-date-of-birth".to_string());
-
-    let mut dependent = config
-        .evidence
-        .claims
-        .iter()
-        .find(|claim| claim.id == "date-of-birth")
-        .expect("registry-backed source claim exists")
-        .clone();
-    dependent.id = "dependent-date-of-birth".to_string();
-    dependent.title = "Dependent date of birth".to_string();
-    dependent.purpose = Some("dependent_attestation".to_string());
-    dependent.depends_on = vec!["guardian-link".to_string()];
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut dependent.evidence_mode else {
-        panic!("representative credential root is registry-backed");
-    };
-    let inputs = &mut consultations
-        .get_mut("civil_status")
-        .expect("civil status consultation exists")
-        .inputs;
-    inputs.remove("national_id");
-    inputs.insert(
-        "civil_registration_id".to_string(),
-        RelayConsultationInput::TargetIdentifier(
-            "request.target.identifiers.civil_registration_id".to_string(),
-        ),
-    );
-    *config
-        .evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "dependent-date-of-birth")
-        .expect("delegated root exists") = dependent;
-    config.subject_access.allowed_claims.clear();
-    config.subject_access.allowed_purposes.clear();
-    config.subject_access.allowed_formats.clear();
-    config.subject_access.allowed_disclosures.clear();
-
-    let credential = config
-        .oid4vci
-        .credential_configurations
-        .get_mut("date_of_birth_sd_jwt")
-        .expect("credential configuration exists");
-    credential.claim_id = Some("dependent-date-of-birth".to_string());
-    credential.representative_issuance = Some(Oid4vciRepresentativeIssuanceConfig {
-        ceremony: Oid4vciRepresentativeIssuanceCeremony::DigitallyAuthenticatedRepresentative,
-        relationship: "guardian".to_string(),
-    });
-    config.credential_status = CredentialStatusConfig {
-        enabled: true,
-        base_url: "http://127.0.0.1:4325".to_string(),
-        ..CredentialStatusConfig::default()
-    };
-    config
-}
-
-#[test]
-fn representative_oid4vci_accepts_a_delegation_only_target_contract() {
-    valid_representative_oid4vci_config()
-        .validate()
-        .expect("representative issuance configuration validates");
-}
-
-#[test]
-fn representative_oid4vci_rejects_a_requester_only_credential_root() {
-    let mut config = valid_representative_oid4vci_config();
-    let root = config
-        .evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "dependent-date-of-birth")
-        .expect("representative credential root exists");
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut root.evidence_mode else {
-        panic!("representative credential root is registry-backed");
-    };
-    let inputs = &mut consultations
-        .get_mut("civil_status")
-        .expect("civil status consultation exists")
-        .inputs;
-    inputs.clear();
-    inputs.insert(
-        "requester_id".to_string(),
-        RelayConsultationInput::RequesterIdentifier(
-            "request.requester.identifiers.national_id".to_string(),
-        ),
-    );
-
-    let reason = expect_subject_access_error(&config);
-    assert!(
-        reason.contains("delegated relationship 'guardian'")
-            && reason.contains("allowed claim 'dependent-date-of-birth'")
-            && reason.contains("closure claim 'dependent-date-of-birth'")
-            && reason.contains("consultation 'civil_status'")
-            && reason.contains("does not consume the selected target")
-            && reason.contains("'requester_id' maps 'requester.identifiers.national_id'")
-            && reason.contains("target.identifiers.civil_registration_id"),
-        "unexpected error: {reason}"
-    );
-}
-
-#[test]
-fn representative_oid4vci_rejects_a_requester_only_credential_dependency() {
-    let mut config = valid_representative_oid4vci_config();
-    let mut dependency = config
-        .evidence
-        .claims
-        .iter()
-        .find(|claim| claim.id == "dependent-date-of-birth")
-        .expect("representative credential root exists")
-        .clone();
-    dependency.id = "dependent-source-record".to_string();
-    dependency.title = "Dependent source record".to_string();
-    dependency.depends_on.clear();
-    dependency.credential_profiles.clear();
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut dependency.evidence_mode else {
-        panic!("representative dependency is registry-backed");
-    };
-    let inputs = &mut consultations
-        .get_mut("civil_status")
-        .expect("civil status consultation exists")
-        .inputs;
-    inputs.clear();
-    inputs.insert(
-        "requester_id".to_string(),
-        RelayConsultationInput::RequesterIdentifier(
-            "request.requester.identifiers.national_id".to_string(),
-        ),
-    );
-    config.evidence.claims.push(dependency);
-    config
-        .evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "dependent-date-of-birth")
-        .expect("representative credential root exists")
-        .depends_on
-        .push("dependent-source-record".to_string());
-
-    let reason = expect_subject_access_error(&config);
-    assert!(
-        reason.contains("delegated relationship 'guardian'")
-            && reason.contains("allowed claim 'dependent-date-of-birth'")
-            && reason.contains("closure claim 'dependent-source-record'")
-            && reason.contains("consultation 'civil_status'")
-            && reason.contains("does not consume the selected target")
-            && reason.contains("'requester_id' maps 'requester.identifiers.national_id'")
-            && reason.contains("target.identifiers.civil_registration_id"),
-        "unexpected error: {reason}"
-    );
-}
-
-#[test]
-fn representative_oid4vci_requires_delegated_evaluation() {
-    let mut config = valid_representative_oid4vci_config();
-    config.subject_access.allowed_operations.evaluate = false;
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("allowed_operations.evaluate = true"),
-        "unexpected error: {reason}"
-    );
-}
-
-#[test]
-fn representative_oid4vci_requires_credential_issuance() {
-    let mut config = valid_representative_oid4vci_config();
-    config.subject_access.allowed_operations.issue_credential = false;
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("allowed_operations.issue_credential = true"),
-        "unexpected error: {reason}"
-    );
-}
-
-#[test]
-fn representative_oid4vci_rejects_a_subject_bound_root() {
-    let mut config = valid_representative_oid4vci_config();
-    config.subject_access.allowed_claims = vec!["dependent-date-of-birth".to_string()];
-    config.subject_access.allowed_purposes = vec!["dependent_attestation".to_string()];
-    config.subject_access.allowed_formats =
-        vec!["application/vnd.registry-notary.claim-result+json".to_string()];
-    config.subject_access.allowed_disclosures = vec!["value".to_string()];
-    config.subject_access.delegation.allowed_relationships[0].target_id_type =
-        Some("national_id".to_string());
-    for claim_id in ["dependent-date-of-birth", "guardian-link"] {
-        let claim = config
-            .evidence
-            .claims
-            .iter_mut()
-            .find(|claim| claim.id == claim_id)
-            .expect("representative claim exists");
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-            panic!("representative claim is registry-backed");
-        };
-        for input in consultations
-            .values_mut()
-            .flat_map(|consultation| consultation.inputs.values_mut())
-        {
-            if let RelayConsultationInput::TargetIdentifier(path) = input {
-                *path = "request.target.identifiers.national_id".to_string();
-            }
-        }
-    }
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains(
-            "representative_issuance claim 'dependent-date-of-birth' must not appear in subject_access.allowed_claims"
-        ),
-        "unexpected error: {reason}"
-    );
-}
-
-#[test]
-fn representative_oid4vci_requires_status_and_an_exact_relationship() {
-    let mut without_status = valid_representative_oid4vci_config();
-    without_status.credential_status.enabled = false;
-    let reason = expect_oid4vci_error(&without_status);
-    assert!(reason.contains("credential_status.enabled = true"));
-
-    let mut unknown_relationship = valid_representative_oid4vci_config();
-    unknown_relationship
-        .oid4vci
-        .credential_configurations
-        .get_mut("date_of_birth_sd_jwt")
-        .expect("credential configuration exists")
-        .representative_issuance
-        .as_mut()
-        .expect("representative issuance exists")
-        .relationship = "unknown".to_string();
-    let reason = expect_oid4vci_error(&unknown_relationship);
-    assert!(reason.contains("unknown relationship 'unknown'"));
-
-    let mut proof_outlives_evaluation = valid_representative_oid4vci_config();
-    let proof_age = proof_outlives_evaluation
-        .subject_access
-        .delegation
-        .allowed_relationships[0]
-        .max_proof_age_seconds;
-    proof_outlives_evaluation
-        .subject_access
-        .token_policy
-        .max_evaluation_age_seconds = proof_age - 1;
-    let error = proof_outlives_evaluation
-        .validate()
-        .expect_err("relationship proof freshness cannot outlive stored evaluation authority");
-    assert!(
-        error
-            .to_string()
-            .contains("must not exceed token_policy.max_evaluation_age_seconds"),
-        "unexpected error: {error}"
-    );
-}
-
-#[test]
-fn representative_oid4vci_requires_an_atomic_relationship_proof() {
-    let mut config = valid_representative_oid4vci_config();
-    config
-        .evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "guardian-link")
-        .expect("relationship proof exists")
-        .depends_on = vec!["date-of-birth".to_string()];
-
-    let error = config
-        .validate()
-        .expect_err("a relationship proof with dependencies must be rejected");
-    assert!(
-        error
-            .to_string()
-            .contains("must not depend_on other claims so the relationship is proven before"),
-        "unexpected error: {error}"
-    );
-}
-
-#[test]
-fn representative_oid4vci_rejects_proof_inputs_the_ceremony_cannot_supply() {
-    let mut config = valid_representative_oid4vci_config();
-    let proof = config
-        .evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "guardian-link")
-        .expect("relationship proof exists");
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut proof.evidence_mode else {
-        panic!("relationship proof is registry-backed");
-    };
-    consultations
-        .first_entry()
-        .expect("relationship proof consultation exists")
-        .get_mut()
-        .inputs
-        .insert(
-            "relationship_kind".to_string(),
-            RelayConsultationInput::TargetAttribute(
-                "request.target.attributes.relationship_kind".to_string(),
-            ),
-        );
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains(
-            "must map exactly the authenticated requester identifier and selected target identifier"
-        ),
-        "unexpected error: {reason}"
-    );
-}
-
-#[test]
-fn representative_oid4vci_rejects_credential_inputs_the_ceremony_cannot_supply() {
-    let mut config = valid_representative_oid4vci_config();
-    let root = config
-        .evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "dependent-date-of-birth")
-        .expect("representative credential root exists");
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut root.evidence_mode else {
-        panic!("representative credential root is registry-backed");
-    };
-    consultations
-        .get_mut("civil_status")
-        .expect("civil status consultation exists")
-        .inputs
-        .insert(
-            "case_reference".to_string(),
-            RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.case_reference".to_string(),
-            ),
-        );
-
-    let reason = expect_subject_access_error(&config);
-    assert!(
-        reason.contains("delegated relationship 'guardian'")
-            && reason.contains("closure claim 'dependent-date-of-birth'")
-            && reason.contains("consultation 'civil_status'")
-            && reason.contains("input 'case_reference'")
-            && reason.contains("target.identifiers.case_reference")
-            && reason.contains("target.identifiers.civil_registration_id"),
-        "unexpected error: {reason}"
-    );
-}
-
-#[test]
-fn representative_oid4vci_rejects_transitive_inputs_the_ceremony_cannot_supply() {
-    let mut config = valid_representative_oid4vci_config();
-    let mut dependency = config
-        .evidence
-        .claims
-        .iter()
-        .find(|claim| claim.id == "dependent-date-of-birth")
-        .expect("representative credential root exists")
-        .clone();
-    dependency.id = "dependent-source-record".to_string();
-    dependency.title = "Dependent source record".to_string();
-    dependency.depends_on.clear();
-    dependency.credential_profiles.clear();
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut dependency.evidence_mode else {
-        panic!("representative dependency is registry-backed");
-    };
-    consultations
-        .get_mut("civil_status")
-        .expect("civil status consultation exists")
-        .inputs
-        .insert(
-            "case_reference".to_string(),
-            RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.case_reference".to_string(),
-            ),
-        );
-    config.evidence.claims.push(dependency);
-    config
-        .evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "dependent-date-of-birth")
-        .expect("representative credential root exists")
-        .depends_on
-        .push("dependent-source-record".to_string());
-
-    let reason = expect_subject_access_error(&config);
-    assert!(
-        reason.contains("delegated relationship 'guardian'")
-            && reason.contains("closure claim 'dependent-source-record'")
-            && reason.contains("consultation 'civil_status'")
-            && reason.contains("input 'case_reference'")
-            && reason.contains("target.identifiers.case_reference")
-            && reason.contains("target.identifiers.civil_registration_id"),
-        "unexpected error: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_rejects_wallet_authorization_code_profile() {
-    let mut config = valid_oid4vci_config();
-    config.oid4vci.pre_authorized_code = Oid4vciPreAuthorizedCodeConfig::default();
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("pre_authorized_code.enabled = true")
-            && reason.contains("authorization_code issuance is not supported"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn valid_oid4vci_projection_config_passes_validation() {
-    let config = valid_oid4vci_projection_config();
-    config
-        .validate()
-        .expect("projection credential config validates");
-}
-
-#[test]
-pub(super) fn credential_claim_and_profile_bindings_must_be_mutual() {
-    let mut config = valid_subject_access_config();
-    config.subject_access = SubjectAccessConfig::default();
-    config.oid4vci = Oid4vciConfig::default();
-    config.evidence.claims[0].credential_profiles.clear();
-
-    let error = config
-        .validate()
-        .expect_err("one-sided profile binding must fail startup");
-    assert!(matches!(
-        error,
-        EvidenceConfigError::InvalidCredentialClaimBinding { ref reason }
-            if reason.contains("does not reference")
-    ));
-}
-
-#[test]
-pub(super) fn credential_root_accepts_registry_backed_dependency_closure() {
-    let mut config = valid_subject_access_config();
-    let root = config.evidence.claims[0].clone();
-    let mut dependency = root.clone();
-    dependency.id = "civil-status-source-record".to_string();
-    dependency.title = "Civil status source record".to_string();
-    dependency.credential_profiles.clear();
-    config.evidence.claims[0]
-        .depends_on
-        .push(dependency.id.clone());
-    config.evidence.claims.push(dependency);
-
-    config
-        .validate()
-        .expect("credential root may retain an exact registry-backed dependency closure");
-}
-
-#[test]
-pub(super) fn oid4vci_projection_rejects_claim_id_and_claims_together() {
-    let mut config = valid_oid4vci_projection_config();
-    config
-        .oid4vci
-        .credential_configurations
-        .get_mut("date_of_birth_sd_jwt")
-        .unwrap()
-        .claim_id = Some("date-of-birth".to_string());
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("exactly one of claim_id or claims"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_projection_rejects_missing_claim_mode() {
-    let mut config = valid_oid4vci_config();
-    let credential = config
-        .oid4vci
-        .credential_configurations
-        .get_mut("date_of_birth_sd_jwt")
-        .unwrap();
-    credential.claim_id = None;
-    credential.claims.clear();
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("exactly one of claim_id or claims"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_projection_rejects_duplicate_output_paths() {
-    let mut config = valid_oid4vci_projection_config();
-    let credential = config
-        .oid4vci
-        .credential_configurations
-        .get_mut("date_of_birth_sd_jwt")
-        .unwrap();
-    credential.claims[1].output_path = vec!["birth_date".to_string()];
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("duplicate") && reason.contains("output_path"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_projection_rejects_duplicate_claim_ids() {
-    let mut config = valid_oid4vci_projection_config();
-    let credential = config
-        .oid4vci
-        .credential_configurations
-        .get_mut("date_of_birth_sd_jwt")
-        .unwrap();
-    credential.claims[1].id = "date-of-birth".to_string();
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("duplicate") && reason.contains("claims[].id"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_projection_rejects_reserved_output_paths() {
-    for reserved in [
-        "iss",
-        "sub",
-        "aud",
-        "iat",
-        "nbf",
-        "exp",
-        "vct",
-        "vct#integrity",
-        "id",
-        "jti",
-        "_sd",
-        "_sd_alg",
-        "cnf",
-        "status",
-        "issuanceDate",
-        "expirationDate",
-    ] {
-        let mut config = valid_oid4vci_projection_config();
-        config
-            .oid4vci
-            .credential_configurations
-            .get_mut("date_of_birth_sd_jwt")
-            .unwrap()
-            .claims[0]
-            .output_path = vec![reserved.to_string()];
-
-        let reason = expect_oid4vci_error(&config);
-        assert!(
-            reason.contains("reserved") && reason.contains(reserved),
-            "unexpected for {reserved}: {reason}"
-        );
-    }
-}
-
-#[test]
-pub(super) fn oid4vci_projection_rejects_nested_output_paths_in_v1() {
-    let mut config = valid_oid4vci_projection_config();
-    config
-        .oid4vci
-        .credential_configurations
-        .get_mut("date_of_birth_sd_jwt")
-        .unwrap()
-        .claims[0]
-        .output_path = vec!["birth".to_string(), "date".to_string()];
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(reason.contains("single segment"), "unexpected: {reason}");
-}
-
-#[test]
-pub(super) fn oid4vci_projection_rejects_unknown_claim_reference() {
-    let mut config = valid_oid4vci_projection_config();
-    config
-        .oid4vci
-        .credential_configurations
-        .get_mut("date_of_birth_sd_jwt")
-        .unwrap()
-        .claims[0]
-        .id = "missing-claim".to_string();
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("unknown claim 'missing-claim'"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_projection_rejects_claim_outside_profile_allow_list() {
-    let mut config = valid_oid4vci_projection_config();
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .unwrap()
-        .allowed_claims
-        .retain(|claim_id| claim_id != "birth-place");
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("profile") && reason.contains("does not allow"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_projection_rejects_mixed_claim_purposes() {
-    let mut config = valid_oid4vci_projection_config();
-    config
-        .subject_access
-        .allowed_purposes
-        .push("other_purpose".to_string());
-    let claim = config
-        .evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "birth-place")
-        .expect("projection claim exists");
-    claim.purpose = Some("other_purpose".to_string());
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(reason.contains("share one purpose"), "unexpected: {reason}");
-}
-
-#[test]
-pub(super) fn oid4vci_projection_rejects_non_value_default_disclosure() {
-    let mut config = valid_oid4vci_projection_config();
-    let claim = config
-        .evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "birth-place")
-        .expect("projection claim exists");
-    claim.disclosure.default = "redacted".to_string();
-    claim.disclosure.allowed = vec!["redacted".to_string(), "value".to_string()];
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("must use value as the default disclosure"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_accepts_vct_under_path_prefixed_credential_issuer() {
-    let mut config = valid_oid4vci_config();
-    config.oid4vci.credential_issuer = "http://127.0.0.1:4325/notary".to_string();
-    config.oid4vci.credential_endpoint =
-        "http://127.0.0.1:4325/notary/oid4vci/credential".to_string();
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .unwrap()
-        .vct = "http://127.0.0.1:4325/notary/credentials/civil-status".to_string();
-    config
-        .oid4vci
-        .credential_configurations
-        .get_mut("date_of_birth_sd_jwt")
-        .unwrap()
-        .vct = "http://127.0.0.1:4325/notary/credentials/civil-status".to_string();
-
-    assert!(config.validate().is_ok());
-}
-
-#[test]
-pub(super) fn oid4vci_deserializes_absent_block_with_default() {
-    let config = valid_subject_access_config();
-    assert_eq!(config.oid4vci, Oid4vciConfig::default());
-}
-
-#[test]
-pub(super) fn oid4vci_requires_enabled_subject_access() {
-    let mut config = valid_oid4vci_config();
-    config.subject_access.enabled = false;
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("subject_access.enabled"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_rejects_missing_accepted_audiences() {
-    let mut config = valid_oid4vci_config();
-    config.oid4vci.accepted_token_audiences.clear();
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("accepted_token_audiences"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_rejects_unknown_claim_reference() {
-    let mut config = valid_oid4vci_config();
-    config
-        .oid4vci
-        .credential_configurations
-        .get_mut("date_of_birth_sd_jwt")
-        .unwrap()
-        .claim_id = Some("missing-claim".to_string());
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("unknown claim 'missing-claim'"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_rejects_unknown_credential_profile_reference() {
-    let mut config = valid_oid4vci_config();
-    config
-        .oid4vci
-        .credential_configurations
-        .get_mut("date_of_birth_sd_jwt")
-        .unwrap()
-        .credential_profile = "missing-profile".to_string();
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("unknown credential profile 'missing-profile'"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_rejects_non_loopback_http_urls() {
-    let mut config = valid_oid4vci_config();
-    config.oid4vci.credential_issuer = "http://issuer.example".to_string();
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("https") && reason.contains("loopback"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_rejects_endpoint_without_path() {
-    let mut config = valid_oid4vci_config();
-    config.oid4vci.credential_endpoint = "http://127.0.0.1:4325".to_string();
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(reason.contains("endpoint path"), "unexpected: {reason}");
-}
-
-#[test]
-pub(super) fn oid4vci_rejects_vct_outside_credential_issuer() {
-    let mut config = valid_oid4vci_config();
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .unwrap()
-        .vct = "https://vct.example/credentials/civil-status".to_string();
-    config
-        .oid4vci
-        .credential_configurations
-        .get_mut("date_of_birth_sd_jwt")
-        .unwrap()
-        .vct = "https://vct.example/credentials/civil-status".to_string();
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("credential_configurations.vct")
-            && reason.contains("oid4vci.credential_issuer"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_rejects_vct_outside_credentials_path() {
-    let mut config = valid_oid4vci_config();
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .unwrap()
-        .vct = "http://127.0.0.1:4325/not-credentials/civil-status".to_string();
-    config
-        .oid4vci
-        .credential_configurations
-        .get_mut("date_of_birth_sd_jwt")
-        .unwrap()
-        .vct = "http://127.0.0.1:4325/not-credentials/civil-status".to_string();
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("vct path") && reason.contains("/credentials/"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_rejects_duplicate_credential_configuration_vct() {
-    let mut config = valid_oid4vci_config();
-    let duplicate = config
-        .oid4vci
-        .credential_configurations
-        .get("date_of_birth_sd_jwt")
-        .unwrap()
-        .clone();
-    config
-        .oid4vci
-        .credential_configurations
-        .insert("duplicate_sd_jwt".to_string(), duplicate);
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("vct") && reason.contains("unique"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_rejects_public_nonce_endpoint() {
-    let mut config = valid_oid4vci_config();
-    config.oid4vci.nonce_endpoint = Some("http://127.0.0.1:4325/oid4vci/nonce".to_string());
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("nonce_endpoint") && reason.contains("must be omitted"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_rejects_bad_nonce_and_proof_timing_bounds() {
-    let mut config = valid_oid4vci_config();
-    config.oid4vci.nonce.ttl_seconds = 0;
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(reason.contains("nonce.ttl_seconds"), "unexpected: {reason}");
-
-    config.oid4vci.nonce.ttl_seconds = 300;
-    config.oid4vci.proof.max_age_seconds = 601;
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("proof.max_age_seconds"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn oid4vci_rejects_bad_algorithm_lists() {
-    let mut config = valid_oid4vci_config();
-    config
-        .oid4vci
-        .credential_configurations
-        .get_mut("date_of_birth_sd_jwt")
-        .unwrap()
-        .proof_signing_alg_values_supported
-        .push("ES256".to_string());
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(reason.contains("ES256"), "unexpected: {reason}");
-}
-
-#[test]
-pub(super) fn oid4vci_rejects_bad_binding_methods() {
-    let mut config = valid_oid4vci_config();
-    config
-        .oid4vci
-        .credential_configurations
-        .get_mut("date_of_birth_sd_jwt")
-        .unwrap()
-        .cryptographic_binding_methods_supported
-        .push("did:key".to_string());
-
-    let reason = expect_oid4vci_error(&config);
-    assert!(reason.contains("did:key"), "unexpected: {reason}");
-}
-
-#[test]
-pub(super) fn subject_access_requires_oidc_authenticator() {
-    let mut config = valid_subject_access_config();
-    config.auth.oidc = None;
-    config.auth.api_keys.push(EvidenceCredentialConfig {
-        id: "api".to_string(),
-        fingerprint: CredentialFingerprintRef {
-            provider: registry_platform_authcommon::CredentialFingerprintProvider::Env,
-            name: Some("API_HASH".to_string()),
-            path: None,
-        },
-        scopes: Vec::new(),
-        authorization_details: None,
-    });
-
-    let reason = expect_subject_access_error(&config);
-    assert!(reason.contains("auth.oidc"), "unexpected: {reason}");
-}
-
-#[test]
-pub(super) fn subject_access_rejects_unsafe_subject_claim_names() {
-    let mut config = valid_subject_access_config();
-    config.subject_access.subject_binding.token_claim = "national id".to_string();
-
-    let reason = expect_subject_access_error(&config);
-    assert!(reason.contains("token_claim"), "unexpected: {reason}");
-}
-
-#[test]
-pub(super) fn subject_access_rejects_sub_without_explicit_civil_id_opt_in() {
-    let mut config = valid_subject_access_config();
-    config.subject_access.subject_binding.token_claim = "sub".to_string();
-
-    let reason = expect_subject_access_error(&config);
-    assert!(
-        reason.contains("allow_sub_as_civil_id"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn subject_access_allows_sub_with_explicit_civil_id_opt_in() {
-    let mut config = valid_subject_access_config();
-    config.subject_access.subject_binding.token_claim = "sub".to_string();
-    config.subject_access.subject_binding.allow_sub_as_civil_id = true;
-
-    assert!(config.validate().is_ok());
-}
-
-#[test]
-pub(super) fn subject_access_subject_request_field_only_accepts_subject_id() {
-    let err = serde_norway::from_str::<StandaloneRegistryNotaryConfig>(
-        r#"
-evidence:
-  enabled: true
-auth:
-  oidc:
-    issuer: https://id.example.gov
-    jwks_url: https://id.example.gov/keys
-    audiences:
-      - registry-notary-citizen
-subject_access:
-  enabled: true
-  subject_binding:
-    token_claim: https://id.example.gov/claims/national_id
-    request_field: SubjectHeader
-    id_type: national_id
-"#,
-    )
-    .expect_err("unsupported request_field variant must fail deserialization");
-    let msg = err.to_string();
-    assert!(
-        msg.contains("SubjectHeader") || msg.contains("unknown variant"),
-        "unexpected error: {msg}"
-    );
-}
-
-#[test]
-pub(super) fn shared_canonical_oidc_fixture_parses() {
-    let config = serde_norway::from_str::<StandaloneRegistryNotaryConfig>(
-        r#"
-evidence:
-  enabled: true
-auth:
-  oidc:
-    issuer: https://id.example.gov
-    audiences:
-      - registry-notary
-    jwks_url: https://id.example.gov/oauth/v2/keys
-    allowed_algorithms:
-      - EdDSA
-    allowed_token_types:
-      - JWT
-    leeway: 30s
-"#,
-    )
-    .expect("shared canonical OIDC fixture parses");
-    let oidc = config.auth.oidc.expect("oidc config");
-
-    assert_eq!(oidc.issuer, "https://id.example.gov");
-    assert_eq!(oidc.audiences, vec!["registry-notary"]);
-    assert_eq!(oidc.jwks_url, "https://id.example.gov/oauth/v2/keys");
-    assert_eq!(oidc.allowed_algorithms, vec!["EdDSA"]);
-    assert_eq!(oidc.allowed_token_types, vec!["JWT"]);
-    assert_eq!(oidc.leeway, Duration::from_secs(30));
-}
-
-#[test]
-pub(super) fn subject_access_rejects_non_exact_normalization() {
-    let err = serde_norway::from_str::<StandaloneRegistryNotaryConfig>(
-        r#"
-evidence:
-  enabled: true
-auth:
-  oidc:
-    issuer: https://id.example.gov
-    jwks_url: https://id.example.gov/keys
-    audiences:
-      - registry-notary-citizen
-subject_access:
-  enabled: true
-  subject_binding:
-    token_claim: https://id.example.gov/claims/national_id
-    request_field: SubjectId
-    id_type: national_id
-    normalize: lowercase
-"#,
-    )
-    .expect_err("unsupported normalize variant must fail deserialization");
-    let msg = err.to_string();
-    assert!(
-        msg.contains("lowercase") || msg.contains("unknown variant"),
-        "unexpected error: {msg}"
-    );
-}
-
-#[test]
-pub(super) fn subject_access_requires_nonempty_allow_lists() {
-    let mut config = valid_subject_access_config();
-    config.subject_access.allowed_claims.clear();
-
-    let reason = expect_subject_access_error(&config);
-    assert!(
-        reason.contains("allowed_claims must not be empty"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn subject_access_rejects_unused_allow_list_entries() {
-    let mut config = valid_subject_access_config();
-    config
-        .subject_access
-        .allowed_formats
-        .push("application/unsupported".to_string());
-
-    let reason = expect_subject_access_error(&config);
-    assert!(
-        reason.contains("allowed_formats entry"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn subject_access_rejects_batch_evaluate_operation() {
-    let mut config = valid_subject_access_config();
-    config.subject_access.allowed_operations.batch_evaluate = true;
-
-    let reason = expect_subject_access_error(&config);
-    assert!(reason.contains("batch_evaluate"), "unexpected: {reason}");
-}
-
-#[test]
-pub(super) fn subject_access_rejects_wildcard_wallet_origins() {
-    let mut config = valid_subject_access_config();
-    config.subject_access.allowed_wallet_origins = vec!["*".to_string()];
-
-    let reason = expect_subject_access_error(&config);
-    assert!(reason.contains("wildcards"), "unexpected: {reason}");
-}
-
-#[test]
-pub(super) fn subject_access_allows_empty_wallet_origins_for_non_browser_flows() {
-    let mut config = valid_subject_access_config();
-    config.subject_access.allowed_wallet_origins.clear();
-
-    config
-        .validate()
-        .expect("wallet origins are optional for CLI and server-side flows");
-}
-
-#[test]
-pub(super) fn subject_access_rejects_zero_rate_limits() {
-    let mut config = valid_subject_access_config();
-    config.subject_access.rate_limits.per_principal_per_minute = 0;
-
-    let reason = expect_subject_access_error(&config);
-    assert!(reason.contains("rate_limits"), "unexpected: {reason}");
-}
-
-#[test]
-pub(super) fn subject_access_requires_allowed_client_or_audience() {
-    let mut config = valid_subject_access_config();
-    config
-        .subject_access
-        .citizen_clients
-        .allowed_client_ids
-        .clear();
-    config
-        .subject_access
-        .citizen_clients
-        .allowed_audiences
-        .clear();
-
-    let reason = expect_subject_access_error(&config);
-    assert!(reason.contains("citizen_clients"), "unexpected: {reason}");
-}
-
-#[test]
-pub(super) fn subject_access_requires_scopes_to_be_mapped() {
-    let mut config = valid_subject_access_config();
-    config.auth.oidc.as_mut().unwrap().scope_map.clear();
-
-    let reason = expect_subject_access_error(&config);
-    assert!(reason.contains("scope_map"), "unexpected: {reason}");
-}
-
-#[test]
-pub(super) fn subject_access_required_scope_policy_requires_scopes() {
-    let mut config = valid_subject_access_config();
-    config.subject_access.required_scopes.clear();
-
-    let reason = expect_subject_access_error(&config);
-    assert!(
-        reason.contains("scope_policy requires required_scopes"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn subject_access_optional_scope_policy_still_requires_scope_mapping() {
-    let mut config = valid_subject_access_config();
-    config.subject_access.scope_policy = SubjectAccessScopePolicy::Optional;
-    config.auth.oidc.as_mut().unwrap().scope_map.clear();
-
-    let reason = expect_subject_access_error(&config);
-    assert!(reason.contains("scope_map"), "unexpected: {reason}");
-}
-
-#[test]
-pub(super) fn subject_access_optional_scope_policy_passes_with_required_scopes() {
-    let mut config = valid_subject_access_config();
-    config.subject_access.scope_policy = SubjectAccessScopePolicy::Optional;
-
-    config
-        .validate()
-        .expect("optional scope policy uses configured subject-access scopes");
-}
-
-#[test]
-pub(super) fn subject_access_disabled_scope_policy_rejects_required_scopes() {
-    let mut config = valid_subject_access_config();
-    config.subject_access.scope_policy = SubjectAccessScopePolicy::Disabled;
-
-    let reason = expect_subject_access_error(&config);
-    assert!(
-        reason.contains("scope_policy = disabled"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn subject_access_rejects_leeway_above_token_policy() {
-    let mut config = valid_subject_access_config();
-    config.auth.oidc.as_mut().unwrap().leeway = Duration::from_secs(61);
-
-    let reason = expect_subject_access_error(&config);
-    assert!(reason.contains("leeway"), "unexpected: {reason}");
-}
-
-#[test]
-pub(super) fn subject_access_rejects_unknown_claim_references() {
-    let mut config = valid_subject_access_config();
-    config.subject_access.allowed_claims = vec!["missing-claim".to_string()];
-
-    let reason = expect_subject_access_error(&config);
-    assert!(
-        reason.contains("unknown claim 'missing-claim'"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn subject_access_rejects_unallowed_claim_purpose() {
-    let mut config = valid_subject_access_config();
-    config.evidence.claims[0].purpose = Some("machine_verification".to_string());
-
-    let reason = expect_subject_access_error(&config);
-    assert!(reason.contains("unallowed purpose"), "unexpected: {reason}");
-}
-
-#[test]
-pub(super) fn subject_access_rejects_claim_without_purpose() {
-    let mut config = valid_subject_access_config();
-    config.evidence.claims[0].purpose = None;
-
-    let error = config
-        .validate()
-        .expect_err("every registry-backed claim requires a purpose");
-    assert!(matches!(
-        error,
-        EvidenceConfigError::InvalidClaimEvidenceMode { ref reason, .. }
-            if reason.contains("explicit bounded purpose")
-    ));
-}
-
-#[test]
-pub(super) fn subject_access_rejects_unknown_profile_references() {
-    let mut config = valid_subject_access_config();
-    config.subject_access.credential_profiles = vec!["missing-profile".to_string()];
-
-    let reason = expect_subject_access_error(&config);
-    assert!(
-        reason.contains("unknown profile 'missing-profile'"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn subject_access_rejects_citizen_profile_validity_above_ceiling() {
-    let mut config = valid_subject_access_config();
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .unwrap()
-        .validity_seconds = 601;
-
-    let error = config
-        .validate()
-        .expect_err("validity above general ceiling is rejected");
-    assert!(matches!(
-        error,
-        EvidenceConfigError::InvalidCredentialProfileValidity {
-            profile,
-            validity_seconds: 601,
-            max_validity_seconds: 600,
-        } if profile == "civil_status_sd_jwt"
-    ));
-}
-
-#[test]
-pub(super) fn subject_access_accepts_citizen_profile_validity_at_configured_ceiling() {
-    const AGENCY_CREDENTIAL_VALIDITY_SECONDS: u64 = 31_536_000;
-    let mut config = valid_subject_access_config();
-    config.evidence.max_credential_validity_seconds = AGENCY_CREDENTIAL_VALIDITY_SECONDS;
-    config
-        .subject_access
-        .token_policy
-        .max_credential_validity_seconds = AGENCY_CREDENTIAL_VALIDITY_SECONDS;
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .unwrap()
-        .validity_seconds = AGENCY_CREDENTIAL_VALIDITY_SECONDS as i64;
-
-    config
-        .validate()
-        .expect("wallet-held credential validity may reach the configured ceiling");
-}
-
-#[test]
-pub(super) fn subject_access_profile_without_validity_uses_default_under_ceiling() {
-    let mut config = valid_subject_access_config();
-    let profile: CredentialProfileConfig = serde_norway::from_str(
-        r#"
-format: application/dc+sd-jwt
-issuer: did:web:issuer.example
-signing_key: issuer-key
-vct: https://issuer.example/credentials/civil-status
-holder_binding:
-  mode: did
-  proof_of_possession: required
-  allowed_did_methods:
-    - did:jwk
-allowed_claims:
-  - date-of-birth
-disclosure:
-  allowed:
-    - value
-"#,
-    )
-    .expect("profile YAML is valid");
-    config
-        .evidence
-        .credential_profiles
-        .insert("civil_status_sd_jwt".to_string(), profile);
-
-    config
-        .validate()
-        .expect("omitted credential validity defaults under subject-access ceiling");
-    assert_eq!(
-        config
-            .evidence
-            .credential_profiles
-            .get("civil_status_sd_jwt")
-            .unwrap()
-            .validity_seconds,
-        600
-    );
-}
-
-#[test]
-pub(super) fn subject_access_rejects_profile_without_did_holder_binding() {
-    let mut config = valid_subject_access_config();
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .unwrap()
-        .holder_binding
-        .mode = "none".to_string();
-
-    let reason = expect_subject_access_error(&config);
-    assert!(
-        reason.contains("holder_binding.mode must be did"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn subject_access_rejects_profile_without_required_holder_proof() {
-    let mut config = valid_subject_access_config();
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .unwrap()
-        .holder_binding
-        .proof_of_possession = None;
-
-    let reason = expect_subject_access_error(&config);
-    assert!(
-        reason.contains("holder_binding.proof_of_possession must be required"),
-        "unexpected: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn subject_access_keeps_did_jwk_proof_of_possession_validation() {
-    let mut config = valid_subject_access_config();
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .unwrap()
-        .holder_binding
-        .allowed_did_methods
-        .push("did:key".to_string());
-
-    let err = config
-        .validate()
-        .expect_err("did:key must still fail proof-of-possession validation");
-    assert!(matches!(
-        err,
-        EvidenceConfigError::UnsupportedCredentialProfileDidMethods { .. }
-    ));
-}
-
-pub(super) fn second_signing_key() -> SigningKeyConfig {
-    serde_norway::from_str(
-        r#"
-provider: local_jwk_env
-private_jwk_env: ACCESS_TOKEN_KEY
-alg: EdDSA
-kid: did:web:issuer.example#access-token-key
-status: active
-"#,
-    )
-    .expect("access-token signing key is valid YAML")
-}
-
-pub(super) fn publish_only_access_token_verification_key(kid: &str) -> SigningKeyConfig {
-    let mut key = second_signing_key();
-    key.kid = kid.to_string();
-    key.status = SigningKeyStatus::PublishOnly;
-    key.private_jwk_env = String::new();
-    key.public_jwk_env = "ACCESS_TOKEN_PUBLIC_KEY".to_string();
-    key
-}
-
-pub(super) fn test_public_jwk(kid: &str, x: &str) -> PublicJwk {
-    PublicJwk::parse(
-        &serde_json::json!({
-            "kty": "OKP",
-            "crv": "Ed25519",
-            "x": x,
-            "alg": "EdDSA",
-            "kid": kid,
-        })
-        .to_string(),
-    )
-    .expect("test public JWK parses")
-}
-
-/// A pre-auth-enabled oid4vci config with a dedicated access-token signing
-/// key, distinct from the credential-signing key.
-pub(super) fn valid_pre_auth_config() -> StandaloneRegistryNotaryConfig {
-    let mut config = valid_oid4vci_config();
-    config
-        .subject_access
-        .rate_limits
-        .tx_code_attempts_per_code_per_minute = 5;
-    config
-        .evidence
-        .signing_keys
-        .insert("access-token-key".to_string(), second_signing_key());
-    config.oid4vci.pre_authorized_code = serde_norway::from_str(
-        r#"
-enabled: true
-tx_code:
-  required: true
-  input_mode: numeric
-  length: 6
-esignet:
-  client_id: registry-lab-live-client
-  client_signing_key_id: issuer-key
-  redirect_uri: http://127.0.0.1:4325/oid4vci/offer/callback
-  authorize_url: https://id.example.gov/authorize
-  token_url: https://id.example.gov/oauth/v2/token
-  issuer: https://id.example.gov
-  jwks_uri: https://id.example.gov/oauth/.well-known/jwks.json
-  scopes:
-    - openid
-pre_authorized_code_ttl_seconds: 300
-"#,
-    )
-    .expect("pre-auth config is valid YAML");
-    config.auth.access_token_signing = serde_norway::from_str(
-        r#"
-enabled: true
-issuer: http://127.0.0.1:4325
-audiences:
-  - http://127.0.0.1:4325
-allowed_algorithms:
-  - EdDSA
-token_typ: registry-notary-access+jwt
-signing_key_id: access-token-key
-access_token_ttl_seconds: 300
-"#,
-    )
-    .expect("access-token signing config is valid YAML");
-    config
-}
-
-pub(super) fn expect_access_token_signing_error(config: &StandaloneRegistryNotaryConfig) -> String {
-    match config
-        .validate()
-        .expect_err("access-token signing config must fail validation")
-    {
-        EvidenceConfigError::InvalidAccessTokenSigningConfig { reason } => reason,
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
diff --git a/crates/registry-notary-core/src/config/tests/preauth.rs b/crates/registry-notary-core/src/config/tests/preauth.rs
deleted file mode 100644
index dd5b7ad3e..000000000
--- a/crates/registry-notary-core/src/config/tests/preauth.rs
+++ /dev/null
@@ -1,561 +0,0 @@
-use super::support::*;
-use super::*;
-#[allow(unused_imports)]
-use super::{auth::*, credentials::*, infrastructure::*, issuance::*, root::*};
-
-#[test]
-pub(super) fn pre_auth_and_access_token_signing_are_disabled_by_default() {
-    let config = minimal_config();
-    assert!(!config.oid4vci.pre_authorized_code.enabled);
-    assert!(!config.auth.access_token_signing.enabled);
-    config
-        .validate()
-        .expect("a config that omits the pre-auth blocks still validates");
-}
-
-#[test]
-pub(super) fn omitted_pre_auth_blocks_use_safe_defaults() {
-    let config = minimal_config();
-    let tx_code = &config.oid4vci.pre_authorized_code.tx_code;
-    assert!(tx_code.required, "tx_code is required by default");
-    assert_eq!(tx_code.input_mode, "numeric");
-    let signing = &config.auth.access_token_signing;
-    assert_eq!(signing.allowed_algorithms, vec!["EdDSA".to_string()]);
-    assert_eq!(signing.token_typ, "registry-notary-access+jwt");
-}
-
-#[test]
-pub(super) fn valid_pre_auth_config_validates() {
-    valid_pre_auth_config()
-        .validate()
-        .expect("a fully-configured pre-auth config validates");
-}
-
-#[test]
-pub(super) fn access_token_signing_enabled_requires_issuer() {
-    let mut config = valid_pre_auth_config();
-    config.auth.access_token_signing.issuer = String::new();
-    let reason = expect_access_token_signing_error(&config);
-    assert!(reason.contains("issuer"));
-}
-
-#[test]
-pub(super) fn access_token_signing_enabled_requires_audiences() {
-    let mut config = valid_pre_auth_config();
-    config.auth.access_token_signing.audiences = Vec::new();
-    let reason = expect_access_token_signing_error(&config);
-    assert!(reason.contains("audiences"));
-}
-
-#[test]
-pub(super) fn access_token_signing_requires_known_signing_key() {
-    let mut config = valid_pre_auth_config();
-    config.auth.access_token_signing.signing_key_id = "missing-key".to_string();
-    let reason = expect_access_token_signing_error(&config);
-    assert!(reason.contains("evidence.signing_keys"));
-}
-
-#[test]
-pub(super) fn access_token_signing_key_must_be_distinct_from_credential_key() {
-    let mut config = valid_pre_auth_config();
-    // Point the access-token key at the credential-signing key.
-    config.auth.access_token_signing.signing_key_id = "issuer-key".to_string();
-    let reason = expect_access_token_signing_error(&config);
-    assert!(reason.contains("distinct from credential profile"));
-}
-
-#[test]
-pub(super) fn resolved_signing_key_material_must_not_be_reused_under_distinct_kids() {
-    let config = valid_pre_auth_config();
-    let credential_public_jwk = test_public_jwk(
-        "did:web:issuer.example#key-1",
-        "1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc",
-    );
-    let access_token_public_jwk = test_public_jwk(
-        "did:web:issuer.example#access-token-key",
-        "1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc",
-    );
-
-    let reuse_scoped_key_ids = config.reuse_scoped_signing_key_ids();
-    let err = config
-        .evidence
-        .validate_resolved_signing_key_material(
-            [
-                ("issuer-key", &credential_public_jwk),
-                ("access-token-key", &access_token_public_jwk),
-            ],
-            &reuse_scoped_key_ids,
-        )
-        .expect_err("same public key material under different kids must fail");
-
-    match err {
-        EvidenceConfigError::InvalidSigningKeyConfig { key, reason } => {
-            assert_eq!(key, "access-token-key");
-            assert!(reason.contains("reuses public key material"));
-            assert!(reason.contains("issuer-key"));
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-#[test]
-pub(super) fn resolved_signing_key_material_accepts_distinct_public_keys() {
-    let config = valid_pre_auth_config();
-    let credential_public_jwk = test_public_jwk(
-        "did:web:issuer.example#key-1",
-        "1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc",
-    );
-    let access_token_public_jwk = test_public_jwk(
-        "did:web:issuer.example#access-token-key",
-        "pv4e_hXHBLN27rcs6VDFV1ED0TiU8M3xy9vsuWFEsec",
-    );
-
-    let reuse_scoped_key_ids = config.reuse_scoped_signing_key_ids();
-    config
-        .evidence
-        .validate_resolved_signing_key_material(
-            [
-                ("issuer-key", &credential_public_jwk),
-                ("access-token-key", &access_token_public_jwk),
-            ],
-            &reuse_scoped_key_ids,
-        )
-        .expect("distinct public key material is valid");
-}
-
-#[test]
-pub(super) fn resolved_signing_key_material_allows_esignet_rp_key_to_reuse_credential_material() {
-    // Issue #173 confines reuse detection to the separated EdDSA roles. The
-    // eSignet pre-authorized-code RP client key is a relaxed role that is
-    // deliberately allowed to share material with the credential issuer key,
-    // so it must not appear in the reuse-scoped set and must not trip the
-    // detector even when its resolved material matches a credential key.
-    let mut config = valid_pre_auth_config();
-    let mut esignet_key = second_signing_key();
-    esignet_key.kid = "did:web:rp.example#esignet-rp-key".to_string();
-    config
-        .evidence
-        .signing_keys
-        .insert("esignet-rp-key".to_string(), esignet_key);
-    config
-        .oid4vci
-        .pre_authorized_code
-        .esignet
-        .client_signing_key_id = "esignet-rp-key".to_string();
-    let credential_public_jwk = test_public_jwk(
-        "did:web:issuer.example#key-1",
-        "1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc",
-    );
-    let esignet_public_jwk = test_public_jwk(
-        "did:web:rp.example#esignet-rp-key",
-        "1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc",
-    );
-
-    let reuse_scoped_key_ids = config.reuse_scoped_signing_key_ids();
-    assert!(
-        !reuse_scoped_key_ids.contains("esignet-rp-key"),
-        "the eSignet RP client key must be excluded from reuse-scoped roles"
-    );
-
-    config
-        .evidence
-        .validate_resolved_signing_key_material(
-            [
-                ("issuer-key", &credential_public_jwk),
-                ("esignet-rp-key", &esignet_public_jwk),
-            ],
-            &reuse_scoped_key_ids,
-        )
-        .expect("eSignet RP key may reuse credential key material");
-}
-
-#[test]
-pub(super) fn access_token_signing_key_must_be_active() {
-    let mut config = valid_pre_auth_config();
-    config
-        .evidence
-        .signing_keys
-        .get_mut("access-token-key")
-        .expect("access-token key exists")
-        .status = SigningKeyStatus::PublishOnly;
-    // PublishOnly requires public_jwk_env and no private_jwk_env.
-    let key = config
-        .evidence
-        .signing_keys
-        .get_mut("access-token-key")
-        .expect("access-token key exists");
-    key.public_jwk_env = "ACCESS_TOKEN_PUBLIC_KEY".to_string();
-    key.private_jwk_env = String::new();
-    let reason = expect_access_token_signing_error(&config);
-    assert!(reason.contains("active signing key"));
-}
-
-#[test]
-pub(super) fn access_token_signing_rejects_non_eddsa_algorithms() {
-    let mut config = valid_pre_auth_config();
-    config.auth.access_token_signing.allowed_algorithms = vec!["RS256".to_string()];
-    let reason = expect_access_token_signing_error(&config);
-    assert!(reason.contains("EdDSA"));
-}
-
-#[test]
-pub(super) fn access_token_verification_key_ids_accept_publish_only_old_keys() {
-    let mut config = valid_pre_auth_config();
-    config.evidence.signing_keys.insert(
-        "access-token-key-old".to_string(),
-        publish_only_access_token_verification_key("did:web:issuer.example#access-token-key-old"),
-    );
-    config.auth.access_token_signing.verification_key_ids =
-        vec!["access-token-key-old".to_string()];
-
-    config
-        .validate()
-        .expect("publish-only verification keys are valid during rotation");
-}
-
-#[test]
-pub(super) fn access_token_verification_key_ids_must_not_repeat_active_key() {
-    let mut config = valid_pre_auth_config();
-    config.auth.access_token_signing.verification_key_ids = vec!["access-token-key".to_string()];
-
-    let reason = expect_access_token_signing_error(&config);
-    assert!(reason.contains("must not repeat active signing_key_id"));
-}
-
-#[test]
-pub(super) fn access_token_verification_key_ids_must_be_unique() {
-    let mut config = valid_pre_auth_config();
-    config.evidence.signing_keys.insert(
-        "access-token-key-old".to_string(),
-        publish_only_access_token_verification_key("did:web:issuer.example#access-token-key-old"),
-    );
-    config.auth.access_token_signing.verification_key_ids = vec![
-        "access-token-key-old".to_string(),
-        "access-token-key-old".to_string(),
-    ];
-
-    let reason = expect_access_token_signing_error(&config);
-    assert!(reason.contains("duplicate key"));
-}
-
-#[test]
-pub(super) fn access_token_verification_key_ids_must_be_publish_only() {
-    let mut config = valid_pre_auth_config();
-    let mut active_old_key = second_signing_key();
-    active_old_key.kid = "did:web:issuer.example#access-token-key-old".to_string();
-    config
-        .evidence
-        .signing_keys
-        .insert("access-token-key-old".to_string(), active_old_key);
-    config.auth.access_token_signing.verification_key_ids =
-        vec!["access-token-key-old".to_string()];
-
-    let reason = expect_access_token_signing_error(&config);
-    assert!(reason.contains("publish_only"));
-}
-
-/// A local JWK signing key entry. Config validation only checks the alg
-/// string and the per-provider fields, so a dummy private_jwk_env name
-/// suffices; the JWK itself is not decoded at validation time.
-pub(super) fn local_jwk_signing_key_with_alg(
-    alg: &str,
-    private_jwk_env: &str,
-    kid: &str,
-) -> SigningKeyConfig {
-    SigningKeyConfig {
-        provider: SigningKeyProviderConfig::LocalJwkEnv,
-        alg: alg.to_string(),
-        kid: kid.to_string(),
-        status: SigningKeyStatus::Active,
-        publish_until_unix_seconds: None,
-        private_jwk_env: private_jwk_env.to_string(),
-        public_jwk_env: String::new(),
-        module_path: String::new(),
-        token_label: String::new(),
-        pin_env: String::new(),
-        key_label: String::new(),
-        key_id_hex: String::new(),
-        path: String::new(),
-        password_env: String::new(),
-    }
-}
-
-pub(super) fn rs256_signing_key(private_jwk_env: &str, kid: &str) -> SigningKeyConfig {
-    local_jwk_signing_key_with_alg(CLIENT_ASSERTION_SIGNING_ALG_RS256, private_jwk_env, kid)
-}
-
-pub(super) fn es256_signing_key(private_jwk_env: &str, kid: &str) -> SigningKeyConfig {
-    local_jwk_signing_key_with_alg(CREDENTIAL_SIGNING_ALG_ES256, private_jwk_env, kid)
-}
-
-pub(super) fn expect_signing_key_error(config: &StandaloneRegistryNotaryConfig) -> String {
-    match config
-        .validate()
-        .expect_err("signing-key config must fail validation")
-    {
-        EvidenceConfigError::InvalidSigningKeyConfig { reason, .. } => reason,
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-#[test]
-pub(super) fn esignet_rp_client_assertion_key_may_be_rs256() {
-    let mut config = valid_pre_auth_config();
-    config.evidence.signing_keys.insert(
-        "esignet-rp-key".to_string(),
-        rs256_signing_key("ESIGNET_RP_KEY", "did:web:rp.example#esignet-rp-key"),
-    );
-    config
-        .oid4vci
-        .pre_authorized_code
-        .esignet
-        .client_signing_key_id = "esignet-rp-key".to_string();
-    config
-        .validate()
-        .expect("an RS256 eSignet RP client-assertion key validates");
-}
-
-#[test]
-pub(super) fn pre_auth_client_signing_key_must_exist() {
-    let mut config = valid_pre_auth_config();
-    config
-        .oid4vci
-        .pre_authorized_code
-        .esignet
-        .client_signing_key_id = "missing-rp-key".to_string();
-    let reason = match config
-        .validate()
-        .expect_err("a missing RP client-assertion key must fail validation")
-    {
-        EvidenceConfigError::InvalidOid4vciConfig { reason } => reason,
-        other => panic!("unexpected error variant: {other}"),
-    };
-    assert!(reason.contains("client_signing_key_id"));
-    assert!(reason.contains("evidence.signing_keys"));
-}
-
-#[test]
-pub(super) fn pre_auth_client_signing_key_must_be_active() {
-    let mut config = valid_pre_auth_config();
-    config.evidence.signing_keys.insert(
-        "esignet-rp-key".to_string(),
-        rs256_signing_key("ESIGNET_RP_KEY", "did:web:rp.example#esignet-rp-key"),
-    );
-    config
-        .oid4vci
-        .pre_authorized_code
-        .esignet
-        .client_signing_key_id = "esignet-rp-key".to_string();
-    // PublishOnly cannot sign; it requires public_jwk_env and no private_jwk_env.
-    let key = config
-        .evidence
-        .signing_keys
-        .get_mut("esignet-rp-key")
-        .expect("esignet rp key exists");
-    key.status = SigningKeyStatus::PublishOnly;
-    key.public_jwk_env = "ESIGNET_RP_PUBLIC_KEY".to_string();
-    key.private_jwk_env = String::new();
-    let reason = match config
-        .validate()
-        .expect_err("an inactive RP client-assertion key must fail validation")
-    {
-        EvidenceConfigError::InvalidOid4vciConfig { reason } => reason,
-        other => panic!("unexpected error variant: {other}"),
-    };
-    assert!(reason.contains("active signing key"));
-}
-
-#[test]
-pub(super) fn rs256_signing_key_rejected_as_credential_profile_key() {
-    let mut config = valid_pre_auth_config();
-    config.evidence.signing_keys.insert(
-        "esignet-rp-key".to_string(),
-        rs256_signing_key("ESIGNET_RP_KEY", "did:web:issuer.example#esignet-rp-key"),
-    );
-    // Point a credential profile at the RS256 key.
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("civil status credential profile exists")
-        .signing_key = "esignet-rp-key".to_string();
-    let reason = expect_signing_key_error(&config);
-    assert!(reason.contains("RS256"));
-    assert!(reason.contains("credential profile"));
-}
-
-#[test]
-pub(super) fn es256_signing_key_may_be_credential_profile_key() {
-    let mut config = valid_pre_auth_config();
-    config.evidence.signing_keys.insert(
-        "issuer-p256-key".to_string(),
-        es256_signing_key("ISSUER_P256_KEY", "did:web:issuer.example#p256-key"),
-    );
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("civil status credential profile exists")
-        .signing_key = "issuer-p256-key".to_string();
-    config
-        .validate()
-        .expect("an ES256 credential profile signing key validates");
-}
-
-#[test]
-pub(super) fn non_eddsa_signing_key_rejected_as_access_token_key() {
-    let mut config = valid_pre_auth_config();
-    config.evidence.signing_keys.insert(
-        "esignet-rp-key".to_string(),
-        es256_signing_key("ESIGNET_RP_KEY", "did:web:rp.example#esignet-rp-key"),
-    );
-    config.auth.access_token_signing.signing_key_id = "esignet-rp-key".to_string();
-    let reason = expect_signing_key_error(&config);
-    assert!(reason.contains("client_signing_key_id"));
-}
-
-#[test]
-pub(super) fn non_eddsa_signing_key_rejected_as_federation_key() {
-    let mut config = valid_federation_config();
-    config.evidence.signing_keys.insert(
-        "esignet-rp-key".to_string(),
-        es256_signing_key("ESIGNET_RP_KEY", "did:web:rp.example#esignet-rp-key"),
-    );
-    config.federation.signing.signing_key = "esignet-rp-key".to_string();
-    let reason = expect_signing_key_error(&config);
-    assert!(reason.contains("client_signing_key_id"));
-}
-
-#[test]
-pub(super) fn signing_key_alg_must_be_eddsa_es256_or_rs256() {
-    let mut config = valid_pre_auth_config();
-    config
-        .evidence
-        .signing_keys
-        .get_mut("issuer-key")
-        .expect("issuer-key exists")
-        .alg = "PS256".to_string();
-    let reason = expect_signing_key_error(&config);
-    assert!(reason.contains(CREDENTIAL_SIGNING_ALG_EDDSA));
-    assert!(reason.contains(CREDENTIAL_SIGNING_ALG_ES256));
-    assert!(reason.contains(CLIENT_ASSERTION_SIGNING_ALG_RS256));
-}
-
-#[test]
-pub(super) fn pre_auth_enabled_requires_oid4vci_enabled() {
-    let mut config = valid_pre_auth_config();
-    config.oid4vci.enabled = false;
-    let reason = expect_oid4vci_error(&config);
-    assert!(reason.contains("requires oid4vci.enabled = true"));
-}
-
-#[test]
-pub(super) fn pre_auth_allows_optional_tx_code() {
-    let mut config = valid_pre_auth_config();
-    config.oid4vci.pre_authorized_code.tx_code.required = false;
-    config
-        .oid4vci
-        .pre_authorized_code
-        .pre_authorized_code_ttl_seconds = MAX_BEARER_PRE_AUTHORIZED_CODE_TTL_SECONDS;
-    config
-        .validate()
-        .expect("operators may explicitly disable tx_code when required for wallet interop");
-}
-
-#[test]
-pub(super) fn pre_auth_optional_tx_code_caps_bearer_offer_ttl() {
-    let mut config = valid_pre_auth_config();
-    config.oid4vci.pre_authorized_code.tx_code.required = false;
-    config
-        .oid4vci
-        .pre_authorized_code
-        .pre_authorized_code_ttl_seconds = MAX_BEARER_PRE_AUTHORIZED_CODE_TTL_SECONDS + 1;
-    let reason = expect_oid4vci_error(&config);
-    assert!(reason.contains("tx_code.required = false"));
-
-    config
-        .oid4vci
-        .pre_authorized_code
-        .pre_authorized_code_ttl_seconds = MAX_BEARER_PRE_AUTHORIZED_CODE_TTL_SECONDS;
-    config
-        .validate()
-        .expect("bearer-offer mode validates at the explicit cap");
-}
-
-#[test]
-pub(super) fn pre_auth_requires_esignet_client_id() {
-    let mut config = valid_pre_auth_config();
-    config.oid4vci.pre_authorized_code.esignet.client_id = String::new();
-    let reason = expect_oid4vci_error(&config);
-    assert!(reason.contains("esignet.client_id"));
-}
-
-#[test]
-pub(super) fn pre_auth_rejects_out_of_range_code_ttl() {
-    let mut config = valid_pre_auth_config();
-    config
-        .oid4vci
-        .pre_authorized_code
-        .pre_authorized_code_ttl_seconds = 0;
-    let reason = expect_oid4vci_error(&config);
-    assert!(reason.contains("pre_authorized_code_ttl_seconds"));
-}
-
-#[test]
-pub(super) fn pre_auth_requires_tx_code_rate_limit() {
-    let mut config = valid_pre_auth_config();
-    config
-        .subject_access
-        .rate_limits
-        .tx_code_attempts_per_code_per_minute = 0;
-    let reason = expect_oid4vci_error(&config);
-    assert!(reason.contains("tx_code_attempts_per_code_per_minute"));
-}
-
-#[test]
-pub(super) fn pre_auth_optional_tx_code_does_not_require_tx_code_rate_limit() {
-    let mut config = valid_pre_auth_config();
-    config.oid4vci.pre_authorized_code.tx_code.required = false;
-    config
-        .oid4vci
-        .pre_authorized_code
-        .pre_authorized_code_ttl_seconds = MAX_BEARER_PRE_AUTHORIZED_CODE_TTL_SECONDS;
-    config
-        .subject_access
-        .rate_limits
-        .tx_code_attempts_per_code_per_minute = 0;
-    config
-        .validate()
-        .expect("tx_code attempt limits are only required when tx_code is required");
-}
-
-#[test]
-pub(super) fn pre_auth_userinfo_binding_requires_esignet_userinfo_url() {
-    let mut config = valid_pre_auth_config();
-    config.subject_access.subject_binding.claim_source = SubjectAccessClaimSource::Userinfo;
-    // Satisfy the resource-server userinfo rule so the failure is
-    // specifically the missing pre-auth eSignet userinfo endpoint.
-    if let Some(oidc) = config.auth.oidc.as_mut() {
-        oidc.userinfo_endpoint = Some("https://id.example.gov/userinfo".to_string());
-    }
-    config.oid4vci.pre_authorized_code.esignet.userinfo_url = String::new();
-    let reason = expect_oid4vci_error(&config);
-    assert!(
-        reason.contains("esignet.userinfo_url"),
-        "unexpected reason: {reason}"
-    );
-}
-
-#[test]
-pub(super) fn pre_auth_userinfo_binding_accepts_configured_userinfo_url() {
-    let mut config = valid_pre_auth_config();
-    config.subject_access.subject_binding.claim_source = SubjectAccessClaimSource::Userinfo;
-    if let Some(oidc) = config.auth.oidc.as_mut() {
-        oidc.userinfo_endpoint = Some("https://id.example.gov/userinfo".to_string());
-    }
-    config.oid4vci.pre_authorized_code.esignet.userinfo_url =
-        "https://id.example.gov/userinfo".to_string();
-    config
-        .validate()
-        .expect("userinfo-sourced pre-auth binding validates with a userinfo_url");
-}
diff --git a/crates/registry-notary-core/src/config/tests/relay.rs b/crates/registry-notary-core/src/config/tests/relay.rs
deleted file mode 100644
index 6880695a3..000000000
--- a/crates/registry-notary-core/src/config/tests/relay.rs
+++ /dev/null
@@ -1,1789 +0,0 @@
-use super::root::{
-    expect_subject_access_error, minimal_claim, valid_delegated_subject_access_config,
-    valid_subject_access_config,
-};
-use super::support::minimal_config;
-use super::*;
-
-const CONTRACT_HASH: &str =
-    "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
-
-fn relay_connection() -> RelayConnectionConfig {
-    serde_norway::from_str(
-        r#"
-base_url: https://relay.internal.example
-workload_client_id: registry-notary
-token_file: /run/secrets/registry-notary-relay.jwt
-"#,
-    )
-    .expect("Relay connection parses")
-}
-
-fn registry_mode(consultation_name: &str) -> ClaimEvidenceMode {
-    ClaimEvidenceMode::RegistryBacked {
-        consultations: std::collections::BTreeMap::from([(
-            consultation_name.to_string(),
-            RelayConsultationConfig {
-                profile: RelayConsultationProfileRef {
-                    id: "example.person-status.exact".to_string(),
-                    contract_hash: CONTRACT_HASH.to_string(),
-                },
-                inputs: std::collections::BTreeMap::from([(
-                    "subject_id".to_string(),
-                    RelayConsultationInput::TargetId,
-                )]),
-                outputs: std::collections::BTreeMap::from([(
-                    "registration_status".to_string(),
-                    RelayOutputContract::String {
-                        nullable: true,
-                        max_bytes: 64,
-                    },
-                )]),
-            },
-        )]),
-    }
-}
-
-fn make_registry_backed(claim: &mut ClaimDefinition, consultation_name: &str) {
-    claim.evidence_mode = registry_mode(consultation_name);
-    claim.purpose = Some("benefit-verification".to_string());
-    claim.required_scopes = vec!["registry:consult:person-status".to_string()];
-    claim.value.value_type = "string".to_string();
-    claim.value.nullable = true;
-    claim.rule = RuleConfig::ConsultationOutput {
-        consultation: consultation_name.to_string(),
-        output: "registration_status".to_string(),
-    };
-}
-
-fn valid_registry_backed_config() -> StandaloneRegistryNotaryConfig {
-    let mut config = minimal_config();
-    config.evidence.relay = Some(relay_connection());
-    let mut claim = minimal_claim("person-status-known");
-    make_registry_backed(&mut claim, "person_status");
-    config.evidence.claims = vec![claim];
-    config
-}
-
-fn registry_backed_config_with_output(
-    output_name: &str,
-    output: RelayOutputContract,
-) -> StandaloneRegistryNotaryConfig {
-    let mut config = valid_registry_backed_config();
-    let value_type = output.value_type().to_string();
-    let claim = &mut config.evidence.claims[0];
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-        panic!("registry-backed mode")
-    };
-    consultations
-        .get_mut("person_status")
-        .expect("consultation exists")
-        .outputs = BTreeMap::from([(output_name.to_string(), output)]);
-    claim.rule = RuleConfig::ConsultationOutput {
-        consultation: "person_status".to_string(),
-        output: output_name.to_string(),
-    };
-    claim.value.value_type = value_type;
-    claim.value.nullable = true;
-    config
-}
-
-fn expect_mode_error(config: &StandaloneRegistryNotaryConfig, expected: &str) {
-    let error = config
-        .validate()
-        .expect_err("invalid claim evidence mode must fail validation");
-    assert!(
-        matches!(
-            error,
-            EvidenceConfigError::InvalidClaimEvidenceMode { ref reason, .. }
-                if reason.contains(expected)
-        ),
-        "unexpected error: {error:?}"
-    );
-}
-
-#[test]
-fn consultation_rules_reject_removed_source_named_variants() {
-    let output: RuleConfig = serde_norway::from_str(
-        r#"
-type: consultation_output
-consultation: person_status
-output: registration_status
-"#,
-    )
-    .expect("consultation output rule parses");
-    assert!(matches!(output, RuleConfig::ConsultationOutput { .. }));
-
-    let matched: RuleConfig = serde_norway::from_str(
-        r#"
-type: consultation_matched
-consultation: person_status
-"#,
-    )
-    .expect("consultation matched rule parses");
-    assert!(matches!(matched, RuleConfig::ConsultationMatched { .. }));
-
-    for removed in [
-        "type: extract\nsource: person_status\nfield: registration_status\n",
-        "type: exists\nsource: person_status\n",
-    ] {
-        serde_norway::from_str::<RuleConfig>(removed)
-            .expect_err("unreleased source-named rule variants must not remain aliases");
-    }
-}
-
-#[test]
-fn claim_evidence_mode_is_required_and_closed() {
-    let missing = serde_norway::from_str::<ClaimDefinition>(
-        r#"
-id: missing-mode
-title: Missing mode
-version: "1"
-subject_type: person
-rule:
-  type: cel
-  expression: "true"
-"#,
-    )
-    .expect_err("missing evidence_mode must fail deserialization");
-    assert!(missing.to_string().contains("evidence_mode"));
-
-    serde_norway::from_str::<ClaimDefinition>(
-        r#"
-id: unknown-mode
-title: Unknown mode
-version: "1"
-subject_type: person
-evidence_mode:
-  type: inferred
-rule:
-  type: cel
-  expression: "true"
-"#,
-    )
-    .expect_err("unknown evidence_mode must fail deserialization");
-
-    serde_norway::from_str::<ClaimDefinition>(
-        r#"
-id: removed-mode
-title: Removed mode
-version: "1"
-subject_type: person
-evidence_mode:
-  type: self_attested
-rule:
-  type: cel
-  expression: "true"
-"#,
-    )
-    .expect_err("the removed self_attested evidence mode must remain rejected");
-}
-
-#[test]
-fn consultation_shape_rejects_native_capabilities_and_redacts_bad_target_mapping() {
-    serde_norway::from_str::<ClaimDefinition>(
-        r#"
-id: native-route
-title: Native route
-version: "1"
-subject_type: person
-evidence_mode:
-  type: registry_backed
-  consultations:
-    person_status:
-      profile:
-        id: example.person-status.exact
-        contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-      inputs:
-        subject_id: target.id
-      route: /private/person
-rule:
-  type: consultation_matched
-  consultation: person_status
-"#,
-    )
-    .expect_err("native routes must not fit the closed consultation schema");
-
-    let sensitive_target = "actual-person-identifier";
-    let error = serde_norway::from_str::<ClaimDefinition>(&format!(
-        r#"
-id: bad-input
-title: Bad input
-version: "1"
-subject_type: person
-evidence_mode:
-  type: registry_backed
-  consultations:
-    person_status:
-      profile:
-        id: example.person-status.exact
-        contract_hash: {CONTRACT_HASH}
-      inputs:
-        subject_id: {sensitive_target}
-rule:
-  type: consultation_matched
-  consultation: person_status
-"#
-    ))
-    .expect_err("only a closed symbolic target mapping is accepted");
-    assert!(!error.to_string().contains(sensitive_target));
-}
-
-#[test]
-fn consultation_accepts_bounded_named_target_identifiers() {
-    let claim: ClaimDefinition = serde_norway::from_str(
-        r#"
-id: named-identifier
-title: Named identifier
-version: "1"
-subject_type: person
-evidence_mode:
-  type: registry_backed
-  consultations:
-    birth_record:
-      profile:
-        id: example.birth-record.exact
-        contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-      inputs:
-        uin: request.target.identifiers.UIN
-purpose: civil-registration-verification
-required_scopes: [registry:consult:birth-record]
-value:
-  type: boolean
-rule:
-  type: consultation_matched
-  consultation: birth_record
-"#,
-    )
-    .expect("named target identifier mapping parses");
-
-    let ClaimEvidenceMode::RegistryBacked { consultations } = claim.evidence_mode;
-    let mapping = consultations["birth_record"].inputs["uin"].clone();
-    assert_eq!(mapping.request_path(), "request.target.identifiers.UIN");
-    assert_eq!(mapping.request_context_path(), "target.identifiers.UIN");
-    assert_eq!(
-        serde_json::to_value(mapping).expect("mapping serializes"),
-        "request.target.identifiers.UIN"
-    );
-
-    for invalid in [
-        "request.target.identifiers.",
-        "request.target.identifiers.1UIN",
-        "request.target.identifiers.UIN/other",
-        "request.target.identifiers.UIN value",
-    ] {
-        let yaml = format!(
-            r#"
-profile:
-  id: example.birth-record.exact
-  contract_hash: {CONTRACT_HASH}
-inputs:
-  uin: {invalid}
-"#,
-        );
-        serde_norway::from_str::<RelayConsultationConfig>(&yaml)
-            .expect_err("invalid target identifier mapping is rejected");
-    }
-}
-
-#[test]
-fn consultation_accepts_closed_target_attributes() {
-    let consultation: RelayConsultationConfig = serde_norway::from_str(&format!(
-        r#"
-profile:
-  id: example.birth-record.exact
-  contract_hash: {CONTRACT_HASH}
-inputs:
-  given_name: request.target.attributes.given_name
-  family_name: request.target.attributes.family_name
-  birthdate: request.target.attributes.birthdate
-outputs:
-  exists: {{ type: boolean, nullable: false }}
-"#,
-    ))
-    .expect("closed target attribute mappings parse");
-    assert!(consultation.inputs["given_name"].is_target_derived());
-    assert!(
-        !consultation.inputs["given_name"].is_authenticated_target_identifier(),
-        "caller-supplied target attributes are not authenticated identifiers"
-    );
-    assert_eq!(
-        consultation.inputs["birthdate"].request_context_path(),
-        "target.attributes.birthdate"
-    );
-
-    for invalid in [
-        "request.target.attributes.",
-        "request.target.attributes.GivenName",
-        "request.target.attributes.family-name",
-        "request.target.attributes.name.given",
-        "request.target.attributes.given name",
-    ] {
-        let yaml = format!(
-            r#"
-profile:
-  id: example.birth-record.exact
-  contract_hash: {CONTRACT_HASH}
-inputs:
-  value: {invalid}
-outputs:
-  exists: {{ type: boolean, nullable: false }}
-"#,
-        );
-        serde_norway::from_str::<RelayConsultationConfig>(&yaml)
-            .expect_err("open target attribute mapping is rejected");
-    }
-}
-
-#[test]
-fn consultation_accepts_only_closed_requester_identifiers() {
-    let consultation: RelayConsultationConfig = serde_norway::from_str(&format!(
-        r#"
-profile:
-  id: example.guardian-link.exact
-  contract_hash: {CONTRACT_HASH}
-inputs:
-  requester_id: request.requester.id
-  requester_national_id: request.requester.identifiers.national_id
-outputs:
-  established: {{ type: boolean, nullable: true }}
-"#,
-    ))
-    .expect("closed requester mappings parse");
-    assert!(consultation.inputs["requester_id"].is_requester_derived());
-    assert_eq!(
-        consultation.inputs["requester_national_id"].request_context_path(),
-        "requester.identifiers.national_id"
-    );
-
-    for invalid in [
-        "requester.id",
-        "request.requester.identifiers.",
-        "request.requester.identifiers.1national_id",
-        "request.requester.attributes.national_id",
-    ] {
-        let yaml = format!(
-            r#"
-profile:
-  id: example.guardian-link.exact
-  contract_hash: {CONTRACT_HASH}
-inputs:
-  requester: {invalid}
-outputs:
-  established: {{ type: boolean, nullable: true }}
-"#,
-        );
-        serde_norway::from_str::<RelayConsultationConfig>(&yaml)
-            .expect_err("open requester mapping is rejected");
-    }
-}
-
-#[test]
-fn registry_backed_claim_accepts_one_pinned_consultation() {
-    let config = valid_registry_backed_config();
-    config
-        .validate()
-        .expect("one pinned Relay consultation validates");
-
-    let serialized =
-        serde_json::to_value(&config.evidence.claims[0].evidence_mode).expect("mode serializes");
-    assert_eq!(serialized["type"], "registry_backed");
-    assert_eq!(
-        serialized["consultations"]["person_status"]["inputs"]["subject_id"],
-        "target.id"
-    );
-}
-
-#[test]
-fn relay_activation_allows_independent_profiles_purposes_inputs_and_outputs() {
-    let mut config = valid_registry_backed_config();
-    let mut exists = config.evidence.claims[0].clone();
-    exists.id = "person-status-present".to_string();
-    exists.title = "Person status known".to_string();
-    exists.rule = RuleConfig::ConsultationMatched {
-        consultation: "person_status".to_string(),
-    };
-    exists.value.value_type = "boolean".to_string();
-    config.evidence.claims.push(exists);
-    config
-        .validate()
-        .expect("consultation rules may share one pinned consultation");
-
-    let mut exists_only = config.clone();
-    exists_only.evidence.claims.remove(0);
-    exists_only
-        .validate()
-        .expect("an exists-only journey retains the declared Relay output contract");
-
-    let mut independent = config.clone();
-    let ClaimEvidenceMode::RegistryBacked { consultations } =
-        &mut independent.evidence.claims[1].evidence_mode
-    else {
-        panic!("registry-backed mode")
-    };
-    let consultation = consultations
-        .get_mut("person_status")
-        .expect("consultation");
-    consultation.profile.id = "example.other-status.exact".to_string();
-    consultation.inputs = BTreeMap::from([(
-        "uin".to_string(),
-        RelayConsultationInput::TargetIdentifier("request.target.identifiers.UIN".to_string()),
-    )]);
-    consultation.outputs = BTreeMap::from([(
-        "other_status".to_string(),
-        RelayOutputContract::String {
-            nullable: true,
-            max_bytes: 64,
-        },
-    )]);
-    independent.evidence.claims[1].purpose = Some("civil-registration-verification".to_string());
-    independent.evidence.claims[1].rule = RuleConfig::ConsultationOutput {
-        consultation: "person_status".to_string(),
-        output: "other_status".to_string(),
-    };
-    independent.evidence.claims[1].value.value_type = "string".to_string();
-    independent
-        .validate()
-        .expect("independent Relay client identities may coexist");
-
-    let mut different_output = config.clone();
-    different_output.evidence.claims[1].rule = RuleConfig::ConsultationOutput {
-        consultation: "person_status".to_string(),
-        output: "other_status".to_string(),
-    };
-    different_output.evidence.claims[1].value.value_type = "string".to_string();
-    expect_mode_error(
-        &different_output,
-        "must name a declared consultation output",
-    );
-}
-
-#[test]
-fn registry_backed_consultation_accepts_one_to_sixteen_injective_inputs() {
-    let mut config = valid_registry_backed_config();
-    let ClaimEvidenceMode::RegistryBacked { consultations } =
-        &mut config.evidence.claims[0].evidence_mode
-    else {
-        panic!("registry-backed mode")
-    };
-    consultations
-        .get_mut("person_status")
-        .expect("consultation")
-        .inputs = BTreeMap::from([
-        ("subject_id".to_string(), RelayConsultationInput::TargetId),
-        (
-            "birth_date".to_string(),
-            RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.birth_date".to_string(),
-            ),
-        ),
-        (
-            "country_code".to_string(),
-            RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.country_code".to_string(),
-            ),
-        ),
-        (
-            "registry_id".to_string(),
-            RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.registry_id".to_string(),
-            ),
-        ),
-    ]);
-    config.validate().expect("four typed inputs are valid");
-
-    let ClaimEvidenceMode::RegistryBacked { consultations } =
-        &mut config.evidence.claims[0].evidence_mode
-    else {
-        panic!("registry-backed mode")
-    };
-    let inputs = &mut consultations
-        .get_mut("person_status")
-        .expect("consultation")
-        .inputs;
-    for index in 5..=16 {
-        inputs.insert(
-            format!("input_{index}"),
-            RelayConsultationInput::TargetIdentifier(format!(
-                "request.target.identifiers.input_{index}"
-            )),
-        );
-    }
-    config.validate().expect("sixteen typed inputs are valid");
-    let ClaimEvidenceMode::RegistryBacked { consultations } =
-        &mut config.evidence.claims[0].evidence_mode
-    else {
-        panic!("registry-backed mode")
-    };
-    consultations
-        .get_mut("person_status")
-        .expect("consultation")
-        .inputs
-        .insert(
-            "input_17".to_string(),
-            RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.input_17".to_string(),
-            ),
-        );
-    expect_mode_error(&config, "one to sixteen");
-
-    let mut duplicate_mapping = valid_registry_backed_config();
-    let ClaimEvidenceMode::RegistryBacked { consultations } =
-        &mut duplicate_mapping.evidence.claims[0].evidence_mode
-    else {
-        panic!("registry-backed mode")
-    };
-    consultations
-        .get_mut("person_status")
-        .expect("consultation")
-        .inputs
-        .insert(
-            "duplicate_subject".to_string(),
-            RelayConsultationInput::TargetId,
-        );
-    expect_mode_error(&duplicate_mapping, "injectively");
-}
-
-#[test]
-fn registry_backed_claim_requires_relay_connection() {
-    let mut config = valid_registry_backed_config();
-    config.evidence.relay = None;
-    expect_mode_error(&config, "requires evidence.relay");
-}
-
-#[test]
-fn registry_backed_claim_enforces_gates_cardinality_and_rule_binding() {
-    let mut config = valid_registry_backed_config();
-    config.evidence.claims[0].purpose = None;
-    expect_mode_error(&config, "explicit bounded purpose token");
-
-    let mut config = valid_registry_backed_config();
-    config.evidence.claims[0].required_scopes.clear();
-    expect_mode_error(&config, "required_scopes");
-
-    let mut config = valid_registry_backed_config();
-    config.evidence.claims[0].operations.batch_evaluate.enabled = true;
-    config
-        .validate()
-        .expect("registry-backed claims may enable the pre-1.0 batch contract");
-
-    let mut config = valid_registry_backed_config();
-    let ClaimEvidenceMode::RegistryBacked { consultations } =
-        &mut config.evidence.claims[0].evidence_mode
-    else {
-        panic!("registry-backed mode")
-    };
-    let duplicate = consultations
-        .first_key_value()
-        .expect("consultation")
-        .1
-        .clone();
-    consultations.insert("other_status".to_string(), duplicate);
-    expect_mode_error(&config, "exactly one named consultation");
-
-    let mut config = valid_registry_backed_config();
-    config.evidence.claims[0].rule = RuleConfig::ConsultationMatched {
-        consultation: "other_status".to_string(),
-    };
-    expect_mode_error(&config, "rule.consultation must match");
-
-    let mut config = valid_registry_backed_config();
-    config.evidence.claims[0].rule = RuleConfig::Cel {
-        expression: "true".to_string(),
-    };
-    config
-        .validate()
-        .expect("registry-backed CEL may evaluate the declared output namespace");
-}
-
-#[test]
-fn registry_backed_claim_matches_relay_identifier_and_scalar_contract() {
-    let mut config = valid_registry_backed_config();
-    let ClaimEvidenceMode::RegistryBacked { consultations } =
-        &mut config.evidence.claims[0].evidence_mode
-    else {
-        panic!("registry-backed mode")
-    };
-    consultations
-        .get_mut("person_status")
-        .expect("consultation")
-        .profile
-        .id = "Uppercase.profile".to_string();
-    expect_mode_error(&config, "profile.id");
-
-    let mut config = valid_registry_backed_config();
-    let ClaimEvidenceMode::RegistryBacked { consultations } =
-        &mut config.evidence.claims[0].evidence_mode
-    else {
-        panic!("registry-backed mode")
-    };
-    consultations
-        .get_mut("person_status")
-        .expect("consultation")
-        .inputs
-        .clear();
-    expect_mode_error(&config, "one to sixteen typed request mappings");
-
-    let mut config = valid_registry_backed_config();
-    config.evidence.claims[0].rule = RuleConfig::ConsultationMatched {
-        consultation: "person_status".to_string(),
-    };
-    expect_mode_error(
-        &config,
-        "consultation_matched claim value.type must be boolean",
-    );
-
-    let mut config = valid_registry_backed_config();
-    config.evidence.claims[0].rule = RuleConfig::ConsultationOutput {
-        consultation: "person_status".to_string(),
-        output: "nested.status".to_string(),
-    };
-    config.evidence.claims[0].value.value_type = "string".to_string();
-    expect_mode_error(&config, "one top-level Relay output name");
-
-    for unsupported in ["boolean", "integer", "number", "object"] {
-        let mut config = valid_registry_backed_config();
-        config.evidence.claims[0].rule = RuleConfig::ConsultationOutput {
-            consultation: "person_status".to_string(),
-            output: "registration_status".to_string(),
-        };
-        config.evidence.claims[0].value.value_type = unsupported.to_string();
-        expect_mode_error(&config, "must match its declared output");
-    }
-}
-
-#[test]
-fn relay_connection_is_single_closed_bounded_and_redacted() {
-    let relay: RelayConnectionConfig = serde_norway::from_str(
-        r#"
-base_url: https://relay.internal.example
-workload_client_id: registry-notary
-token_file: /run/secrets/private-relay.jwt
-root_certificate_path: /run/secrets/private-relay-ca.pem
-allowed_private_cidrs: [10.42.0.0/16, fd42::/64]
-"#,
-    )
-    .expect("Relay connection parses");
-    relay.validate(None).expect("Relay connection validates");
-    assert_eq!(relay.allowed_private_cidrs.len(), 2);
-    assert_eq!(relay.max_in_flight, 8);
-    let debug = format!("{relay:?}");
-    assert!(!debug.contains("relay.internal.example"));
-    assert!(!debug.contains("private-relay.jwt"));
-    assert!(!debug.contains("private-relay-ca.pem"));
-    assert!(debug.contains("custom_root_certificate: true"));
-    assert!(!debug.contains("10.42.0.0/16"));
-
-    serde_norway::from_str::<RelayConnectionConfig>(
-        r#"
-base_url: https://relay.internal.example
-workload_client_id: registry-notary
-token_file: /run/secrets/relay.jwt
-retry_on_5xx: true
-"#,
-    )
-    .expect_err("retry controls are not part of the closed Relay connection");
-
-    for workload_client_id in ["", "Registry-Notary", "registry:notary"] {
-        let mut relay = relay_connection();
-        relay.workload_client_id = workload_client_id.to_string();
-        assert!(matches!(
-            relay.validate(None),
-            Err(EvidenceConfigError::InvalidRelayConfig { ref reason })
-                if reason.contains("workload_client_id")
-        ));
-    }
-}
-
-#[test]
-fn relay_custom_root_requires_an_https_origin_and_canonical_absolute_path() {
-    let mut relay = relay_connection();
-    relay.root_certificate_path = Some(PathBuf::from("relay-ca.pem"));
-    assert!(matches!(
-        relay.validate(None),
-        Err(EvidenceConfigError::InvalidRelayConfig { ref reason })
-            if reason.contains("root_certificate_path")
-    ));
-
-    relay.root_certificate_path = Some(PathBuf::from("/run/secrets/relay-ca.pem"));
-    relay.base_url = "http://127.0.0.1:8080".to_string();
-    relay.allow_insecure_localhost = true;
-    assert!(matches!(
-        relay.validate(None),
-        Err(EvidenceConfigError::InvalidRelayConfig { ref reason })
-            if reason.contains("requires an https")
-    ));
-}
-
-#[test]
-fn relay_token_file_and_private_cidrs_are_exact_and_bounded() {
-    relay_connection()
-        .validate(None)
-        .expect("target POSIX token path is valid on every configuration host");
-    for token_file in [
-        PathBuf::from("relative/relay.jwt"),
-        PathBuf::from("/run/secrets/../relay.jwt"),
-        PathBuf::from("/run/./secrets/relay.jwt"),
-        PathBuf::from("//run/secrets/relay.jwt"),
-        PathBuf::from("/run/secrets/relay.jwt/"),
-        PathBuf::from("/run\\secrets\\relay.jwt"),
-        PathBuf::from("C:\\run\\secrets\\relay.jwt"),
-        PathBuf::from("/"),
-    ] {
-        let mut relay = relay_connection();
-        relay.token_file = token_file;
-        assert!(matches!(
-            relay.validate(None),
-            Err(EvidenceConfigError::InvalidRelayConfig { ref reason })
-                if reason.contains("token_file")
-        ));
-    }
-
-    for cidrs in [
-        vec!["10.42.0.1/16"],
-        vec!["93.184.216.0/24"],
-        vec!["100.100.100.200/32"],
-        vec!["fd00:ec2::254/128"],
-        vec!["10.42.0.0/16", "10.42.0.0/16"],
-    ] {
-        let mut relay = relay_connection();
-        relay.allowed_private_cidrs = cidrs
-            .into_iter()
-            .map(|cidr| cidr.parse().expect("test CIDR parses"))
-            .collect();
-        assert!(matches!(
-            relay.validate(None),
-            Err(EvidenceConfigError::InvalidRelayConfig { ref reason })
-                if reason.contains("allowed_private_cidrs")
-        ));
-    }
-
-    let mut relay = relay_connection();
-    relay.allowed_private_cidrs = (0..=16)
-        .map(|index| {
-            format!("10.{index}.0.0/16")
-                .parse()
-                .expect("test CIDR parses")
-        })
-        .collect();
-    assert!(matches!(
-        relay.validate(None),
-        Err(EvidenceConfigError::InvalidRelayConfig { ref reason })
-            if reason.contains("more than 16")
-    ));
-
-    serde_norway::from_str::<RelayConnectionConfig>(
-        r#"
-base_url: https://relay.internal.example
-workload_client_id: registry-notary
-token_env: REMOVED_RELAY_TOKEN
-"#,
-    )
-    .expect_err("the removed static environment-token mode is rejected");
-
-    serde_norway::from_str::<RelayConnectionConfig>(
-        r#"
-base_url: https://relay.internal.example
-workload_client_id: registry-notary
-token_file: /run/secrets/relay.jwt
-token_issuer: REMOVED_DUPLICATE_IDENTITY
-"#,
-    )
-    .expect_err("duplicated local workload-token semantics are rejected");
-}
-
-#[test]
-fn relay_connection_concurrency_is_operator_bounded() {
-    for value in [0, 65] {
-        let mut relay = relay_connection();
-        relay.max_in_flight = value;
-        assert!(matches!(
-            relay.validate(None),
-            Err(EvidenceConfigError::InvalidRelayConfig { ref reason })
-                if reason.contains("max_in_flight")
-        ));
-    }
-
-    let mut relay = relay_connection();
-    relay.max_in_flight = 64;
-    relay.validate(None).expect("hard ceiling is accepted");
-}
-
-#[test]
-fn relay_connection_is_rejected_when_no_registry_backed_claim_uses_it() {
-    let mut config = minimal_config();
-    config.evidence.claims.clear();
-    config.evidence.relay = Some(relay_connection());
-    let error = config
-        .validate()
-        .expect_err("an unused Relay connection must not be silently accepted");
-    assert!(matches!(
-        error,
-        EvidenceConfigError::InvalidRelayConfig { ref reason }
-            if reason.contains("at least one registry_backed claim")
-    ));
-}
-
-#[test]
-fn registry_backed_notary_reserves_five_seconds_around_the_service_hop() {
-    let mut config = valid_registry_backed_config();
-    config.server.request_timeout = Duration::from_secs(29) + Duration::from_millis(999);
-    let error = config
-        .validate()
-        .expect_err("the request timeout must not expire before the Relay service hop");
-    assert!(matches!(
-        error,
-        EvidenceConfigError::InvalidRelayConfig { ref reason }
-            if reason.contains("at least 30 seconds")
-    ));
-
-    config.server.request_timeout = Duration::from_secs(30);
-    config
-        .validate()
-        .expect("the outer request minimum reserves five seconds around the service hop");
-}
-
-#[test]
-fn relay_connection_requires_https_origin_or_explicit_loopback() {
-    let mut config = valid_registry_backed_config();
-    let mut relay = relay_connection();
-    relay.base_url = "http://relay.internal.example".to_string();
-    relay.allow_insecure_localhost = true;
-    config.evidence.relay = Some(relay);
-    let error = config
-        .validate()
-        .expect_err("remote HTTP must fail despite localhost escape");
-    assert!(matches!(
-        error,
-        EvidenceConfigError::InvalidRelayConfig { .. }
-    ));
-
-    let mut config = valid_registry_backed_config();
-    let mut relay = relay_connection();
-    relay.base_url = "http://127.0.0.1:8080".to_string();
-    relay.allow_insecure_localhost = true;
-    config.evidence.relay = Some(relay);
-    config.deployment.profile = Some(crate::deployment::DeploymentProfile::Local);
-    config
-        .validate()
-        .expect("explicit HTTP loopback is permitted for a colocated Relay");
-
-    let mut config = valid_registry_backed_config();
-    let mut relay = relay_connection();
-    relay.base_url = "http://localhost:8080".to_string();
-    relay.allow_insecure_localhost = true;
-    config.evidence.relay = Some(relay);
-    config.deployment.profile = Some(crate::deployment::DeploymentProfile::Local);
-    config
-        .validate()
-        .expect_err("local development HTTP requires a literal loopback origin");
-
-    let mut config = valid_registry_backed_config();
-    let mut relay = relay_connection();
-    relay.base_url = "http://127.0.0.1:8080".to_string();
-    relay.allow_insecure_localhost = true;
-    config.evidence.relay = Some(relay);
-    config.deployment.profile = Some(crate::deployment::DeploymentProfile::HostedLab);
-    config
-        .validate()
-        .expect("hosted Notary can use the paired Relay through its loopback namespace");
-
-    let sensitive_path = "private-route";
-    let mut config = valid_registry_backed_config();
-    let mut relay = relay_connection();
-    relay.base_url = format!("https://relay.internal.example/{sensitive_path}");
-    config.evidence.relay = Some(relay);
-    let error = config
-        .validate()
-        .expect_err("Relay base URL must be an origin in v1");
-    let rendered = error.to_string();
-    assert!(rendered.contains("path exactly /"));
-    assert!(!rendered.contains("relay.internal.example"));
-    assert!(!rendered.contains(sensitive_path));
-
-    let mut config = valid_registry_backed_config();
-    let mut relay = relay_connection();
-    relay.base_url = "https://relay.internal.example/private/..".to_string();
-    config.evidence.relay = Some(relay);
-    config
-        .validate()
-        .expect_err("a resource path must fail before URL normalization");
-}
-
-#[test]
-fn local_private_http_relay_requires_an_exact_ip_allowlist_entry() {
-    let mut config = valid_registry_backed_config();
-    config.deployment.profile = Some(crate::deployment::DeploymentProfile::Local);
-    let relay = config.evidence.relay.as_mut().expect("Relay connection");
-    relay.base_url = "http://10.89.0.4:8080".to_string();
-    relay.allowed_private_cidrs = vec!["10.89.0.4/32".parse().expect("test CIDR parses")];
-    config
-        .validate()
-        .expect("local profile accepts the exact private Relay IP and singleton CIDR");
-
-    for (base_url, cidrs) in [
-        ("http://10.89.0.4:8080", vec![]),
-        ("http://10.89.0.4:8080", vec!["10.89.0.0/24"]),
-        ("http://10.89.0.4:8080", vec!["10.89.0.5/32"]),
-        ("http://relay.internal.example:8080", vec!["10.89.0.4/32"]),
-        ("http://169.254.169.254:8080", vec!["169.254.169.254/32"]),
-        ("http://100.100.100.200:8080", vec!["100.100.100.200/32"]),
-        ("http://0.0.0.0:8080", vec!["0.0.0.0/32"]),
-    ] {
-        let mut config = valid_registry_backed_config();
-        config.deployment.profile = Some(crate::deployment::DeploymentProfile::Local);
-        let relay = config.evidence.relay.as_mut().expect("Relay connection");
-        relay.base_url = base_url.to_string();
-        relay.allowed_private_cidrs = cidrs
-            .into_iter()
-            .map(|cidr| cidr.parse().expect("test CIDR parses"))
-            .collect();
-        assert!(matches!(
-            config.validate(),
-            Err(EvidenceConfigError::InvalidRelayConfig { .. })
-        ));
-    }
-}
-
-#[test]
-fn private_http_relay_is_rejected_outside_the_local_profile() {
-    for profile in [
-        None,
-        Some(crate::deployment::DeploymentProfile::HostedLab),
-        Some(crate::deployment::DeploymentProfile::Production),
-        Some(crate::deployment::DeploymentProfile::EvidenceGrade),
-    ] {
-        let mut config = valid_registry_backed_config();
-        config.deployment.profile = profile;
-        let relay = config.evidence.relay.as_mut().expect("Relay connection");
-        relay.base_url = "http://10.89.0.4:8080".to_string();
-        relay.allowed_private_cidrs = vec!["10.89.0.4/32".parse().expect("test CIDR parses")];
-        assert!(matches!(
-            config.validate(),
-            Err(EvidenceConfigError::InvalidRelayConfig { .. })
-        ));
-    }
-}
-
-#[test]
-fn signed_private_service_http_relay_is_profile_independent_and_explicit() {
-    for profile in [
-        crate::deployment::DeploymentProfile::Local,
-        crate::deployment::DeploymentProfile::HostedLab,
-        crate::deployment::DeploymentProfile::Production,
-        crate::deployment::DeploymentProfile::EvidenceGrade,
-    ] {
-        let mut config = valid_registry_backed_config();
-        config.deployment.profile = Some(profile);
-        let relay = config.evidence.relay.as_mut().expect("Relay connection");
-        relay.base_url = "http://registry-relay-consultation:8080".to_string();
-        relay.allow_insecure_private_network = true;
-        config
-            .validate()
-            .expect("signed private service HTTP is valid in every deployment profile");
-    }
-
-    for base_url in [
-        "http://registry-relay-consultation:8080",
-        "http://127.0.0.1:8080",
-        "https://registry-relay-consultation:8080",
-    ] {
-        let mut config = valid_registry_backed_config();
-        let relay = config.evidence.relay.as_mut().expect("Relay connection");
-        relay.base_url = base_url.to_string();
-        relay.allow_insecure_private_network =
-            base_url != "http://registry-relay-consultation:8080";
-        assert!(matches!(
-            config.validate(),
-            Err(EvidenceConfigError::InvalidRelayConfig { .. })
-        ));
-    }
-}
-
-#[test]
-fn removed_plugin_rule_is_rejected_during_deserialization() {
-    let error = serde_norway::from_str::<RuleConfig>("type: plugin\nplugin: unavailable\n")
-        .expect_err("the unreleased plugin rule must not remain accepted");
-    assert!(error.to_string().contains("plugin"));
-}
-
-#[test]
-fn subject_access_allows_exact_subject_bound_registry_claims() {
-    let mut config = valid_subject_access_config();
-    config.evidence.relay = Some(relay_connection());
-    make_registry_backed(&mut config.evidence.claims[0], "civil_status");
-    config.evidence.claims[0].purpose = Some("citizen_subject_access".to_string());
-    config.evidence.claims[0].required_scopes = vec!["subject_access".to_string()];
-    let ClaimEvidenceMode::RegistryBacked { consultations } =
-        &mut config.evidence.claims[0].evidence_mode
-    else {
-        panic!("claim is registry backed");
-    };
-    consultations
-        .get_mut("civil_status")
-        .expect("consultation exists")
-        .inputs
-        .insert(
-            "subject_id".to_string(),
-            RelayConsultationInput::TargetIdentifier("target.identifiers.national_id".to_string()),
-        );
-    config
-        .validate()
-        .expect("the exact authenticated subject identifier may be consulted");
-
-    let mut wrong_binding = config.clone();
-    let ClaimEvidenceMode::RegistryBacked { consultations } =
-        &mut wrong_binding.evidence.claims[0].evidence_mode
-    else {
-        panic!("claim is registry backed");
-    };
-    consultations
-        .get_mut("civil_status")
-        .expect("consultation exists")
-        .inputs
-        .insert(
-            "subject_id".to_string(),
-            RelayConsultationInput::TargetIdentifier("target.identifiers.other_person".to_string()),
-        );
-    let reason = expect_subject_access_error(&wrong_binding);
-    assert!(reason.contains("outside the authenticated subject binding"));
-}
-
-#[test]
-fn registry_backed_claim_accepts_registry_backed_dependency() {
-    let mut config = valid_registry_backed_config();
-    let mut dependency = minimal_claim("registry-dependency");
-    make_registry_backed(&mut dependency, "registry_dependency");
-    config.evidence.claims[0]
-        .depends_on
-        .push(dependency.id.clone());
-    config.evidence.claims.push(dependency);
-    config
-        .validate()
-        .expect("registry-backed claim dependency is supported");
-}
-
-#[test]
-fn claim_dependency_graph_has_fixed_v1_node_and_edge_bounds() {
-    let mut too_many_nodes = minimal_config();
-    too_many_nodes.evidence.claims = (0..=MAX_CLAIM_DEPENDENCY_NODES_V1)
-        .map(|index| minimal_claim(&format!("claim-{index}")))
-        .collect();
-    assert!(matches!(
-        too_many_nodes.validate(),
-        Err(EvidenceConfigError::ClaimDependencyGraphTooLarge { nodes, .. })
-            if nodes == MAX_CLAIM_DEPENDENCY_NODES_V1 + 1
-    ));
-
-    let mut too_many_edges = minimal_config();
-    for index in 0..24 {
-        let mut claim = minimal_claim(&format!("claim-{index}"));
-        claim.depends_on = (0..index)
-            .map(|dependency| format!("claim-{dependency}"))
-            .collect();
-        too_many_edges.evidence.claims.push(claim);
-    }
-    assert!(matches!(
-        too_many_edges.validate(),
-        Err(EvidenceConfigError::ClaimDependencyGraphTooLarge { edges, .. })
-            if edges > MAX_CLAIM_DEPENDENCY_EDGES_V1
-    ));
-}
-
-#[test]
-fn delegated_subject_access_allows_registry_backed_dependency_closures() {
-    let config = valid_delegated_subject_access_config();
-    config
-        .validate()
-        .expect("configured delegated Relay proof edge validates");
-
-    let mut registry_dependent = config;
-    let delegated = registry_dependent
-        .evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "dependent-date-of-birth")
-        .expect("delegated claim");
-    make_registry_backed(delegated, "civil_status");
-    delegated.purpose = Some("dependent_attestation".to_string());
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut delegated.evidence_mode else {
-        panic!("delegated claim is registry-backed");
-    };
-    consultations
-        .get_mut("civil_status")
-        .expect("civil status consultation exists")
-        .inputs
-        .insert(
-            "subject_id".to_string(),
-            RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.civil_registration_id".to_string(),
-            ),
-        );
-    registry_dependent
-        .validate()
-        .expect("a delegated root may use its committed registry-backed dependency closure");
-}
-
-#[test]
-fn delegated_subject_access_rejects_non_canonical_root_inputs() {
-    let cases = [
-        RelayConsultationInput::TargetAttribute("request.target.attributes.birthdate".to_string()),
-        RelayConsultationInput::TargetIdentifier(
-            "request.target.identifiers.national_id".to_string(),
-        ),
-    ];
-
-    for input in cases {
-        let mut config = valid_delegated_subject_access_config();
-        delegated_claim_consultation_mut(&mut config)
-            .inputs
-            .insert("national_id".to_string(), input);
-
-        let reason = expect_subject_access_error(&config);
-        assert!(
-            reason.contains("delegated relationship 'guardian'")
-                && reason.contains("allowed claim 'dependent-date-of-birth'")
-                && reason.contains("closure claim 'dependent-date-of-birth'")
-                && reason.contains("consultation 'civil_status'")
-                && reason.contains("input 'national_id'")
-                && reason.contains("target.identifiers.civil_registration_id")
-                && reason.contains("requester.identifiers.national_id"),
-            "unexpected error: {reason}"
-        );
-    }
-}
-
-#[test]
-fn delegated_subject_access_rejects_non_canonical_transitive_inputs() {
-    let mut config = valid_delegated_subject_access_config();
-    let mut dependency = config
-        .evidence
-        .claims
-        .iter()
-        .find(|claim| claim.id == "dependent-date-of-birth")
-        .expect("delegated root exists")
-        .clone();
-    dependency.id = "dependent-source-record".to_string();
-    dependency.title = "Dependent source record".to_string();
-    dependency.depends_on.clear();
-    dependency.credential_profiles.clear();
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut dependency.evidence_mode else {
-        panic!("delegated dependency is registry-backed");
-    };
-    consultations
-        .get_mut("civil_status")
-        .expect("civil status consultation exists")
-        .inputs
-        .insert(
-            "national_id".to_string(),
-            RelayConsultationInput::TargetAttribute(
-                "request.target.attributes.birthdate".to_string(),
-            ),
-        );
-    config.evidence.claims.push(dependency);
-    config
-        .evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "dependent-date-of-birth")
-        .expect("delegated root exists")
-        .depends_on
-        .push("dependent-source-record".to_string());
-
-    let reason = expect_subject_access_error(&config);
-    assert!(
-        reason.contains("delegated relationship 'guardian'")
-            && reason.contains("allowed claim 'dependent-date-of-birth'")
-            && reason.contains("closure claim 'dependent-source-record'")
-            && reason.contains("consultation 'civil_status'")
-            && reason.contains("input 'national_id'")
-            && reason.contains("target.attributes.birthdate")
-            && reason.contains("target.identifiers.civil_registration_id"),
-        "unexpected error: {reason}"
-    );
-}
-
-#[test]
-fn delegated_relay_proof_requires_requester_target_boolean_and_purpose_alignment() {
-    let mut missing_requester = valid_delegated_subject_access_config();
-    delegated_proof_consultation_mut(&mut missing_requester)
-        .inputs
-        .retain(|_, input| input.is_target_derived());
-    let reason = expect_subject_access_error(&missing_requester);
-    assert!(reason.contains("authenticated target identifier"));
-
-    let mut missing_target = valid_delegated_subject_access_config();
-    delegated_proof_consultation_mut(&mut missing_target)
-        .inputs
-        .retain(|_, input| input.is_requester_derived());
-    let reason = expect_subject_access_error(&missing_target);
-    assert!(reason.contains("authenticated target identifier"));
-
-    let mut caller_supplied_attribute = valid_delegated_subject_access_config();
-    let consultation = delegated_proof_consultation_mut(&mut caller_supplied_attribute);
-    consultation.inputs.remove("target_id");
-    consultation.inputs.insert(
-        "target_context".to_string(),
-        RelayConsultationInput::TargetAttribute(
-            "request.target.attributes.person_sequence".to_string(),
-        ),
-    );
-    let reason = expect_subject_access_error(&caller_supplied_attribute);
-    assert!(reason.contains("authenticated target identifier"));
-
-    let mut non_boolean = valid_delegated_subject_access_config();
-    let proof = non_boolean
-        .evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "guardian-link")
-        .expect("delegated proof claim");
-    proof.value.value_type = "string".to_string();
-    delegated_proof_consultation_mut(&mut non_boolean).outputs = BTreeMap::from([(
-        "established".to_string(),
-        RelayOutputContract::String {
-            nullable: true,
-            max_bytes: 16,
-        },
-    )]);
-    let reason = expect_subject_access_error(&non_boolean);
-    assert!(reason.contains("must produce a boolean result"));
-
-    let mut wrong_purpose = valid_delegated_subject_access_config();
-    wrong_purpose
-        .evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "guardian-link")
-        .expect("delegated proof claim")
-        .purpose = Some("different-purpose".to_string());
-    let reason = expect_subject_access_error(&wrong_purpose);
-    assert!(reason.contains("must declare the same purpose"));
-}
-
-fn delegated_proof_consultation_mut(
-    config: &mut StandaloneRegistryNotaryConfig,
-) -> &mut RelayConsultationConfig {
-    let proof = config
-        .evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "guardian-link")
-        .expect("delegated proof claim");
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut proof.evidence_mode else {
-        panic!("delegated proof is registry backed")
-    };
-    consultations
-        .get_mut("guardian_link")
-        .expect("delegated proof consultation")
-}
-
-fn delegated_claim_consultation_mut(
-    config: &mut StandaloneRegistryNotaryConfig,
-) -> &mut RelayConsultationConfig {
-    let claim = config
-        .evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "dependent-date-of-birth")
-        .expect("delegated claim exists");
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-        panic!("delegated claim is registry-backed");
-    };
-    consultations
-        .get_mut("civil_status")
-        .expect("delegated consultation exists")
-}
-
-#[test]
-fn registry_backed_cel_accepts_one_complete_typed_output_map_and_full_date_variable() {
-    let mut config = valid_registry_backed_config();
-    config.evidence.variables.insert(
-        "as_of_date".to_string(),
-        RequestVariableConfig {
-            from: "request.variables.as_of_date".to_string(),
-            value_type: RequestVariableType::Date,
-        },
-    );
-    let claim = &mut config.evidence.claims[0];
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-        panic!("registry-backed mode")
-    };
-    let consultation = consultations
-        .get_mut("person_status")
-        .expect("consultation exists");
-    consultation.outputs = BTreeMap::from([
-        (
-            "date_of_birth".to_string(),
-            RelayOutputContract::Date { nullable: true },
-        ),
-        (
-            "sequence".to_string(),
-            RelayOutputContract::Integer {
-                nullable: false,
-                minimum: 0,
-                maximum: 9_007_199_254_740_991,
-            },
-        ),
-        (
-            "status".to_string(),
-            RelayOutputContract::String {
-                nullable: false,
-                max_bytes: 64,
-            },
-        ),
-    ]);
-    claim.rule = RuleConfig::Cel {
-        expression: "person_status.matched && person_status.date_of_birth != null ? date.age_on(person_status.date_of_birth, as_of_date) >= 18 : false".to_string(),
-    };
-    claim.value.value_type = "boolean".to_string();
-    claim.value.nullable = false;
-    config
-        .validate()
-        .expect("typed registry CEL config validates");
-
-    let mut generic_number = config.clone();
-    generic_number.evidence.claims[0].value.value_type = "number".to_string();
-    expect_mode_error(&generic_number, "generic Number is not supported");
-
-    config
-        .evidence
-        .variables
-        .get_mut("as_of_date")
-        .expect("variable exists")
-        .from = "request.target.attributes.as_of_date".to_string();
-    assert!(matches!(
-        config.validate(),
-        Err(EvidenceConfigError::InvalidRequestVariableConfig { .. })
-    ));
-}
-
-#[test]
-fn authored_typed_output_and_variable_yaml_shape_is_closed() {
-    let evidence: EvidenceConfig = serde_norway::from_str(
-        r#"
-enabled: true
-variables:
-  as_of_date:
-    from: request.variables.as_of_date
-    type: date
-"#,
-    )
-    .expect("authored request-variable union parses");
-    assert_eq!(
-        evidence.variables["as_of_date"].value_type,
-        RequestVariableType::Date
-    );
-
-    let consultation: RelayConsultationConfig = serde_norway::from_str(
-        r#"
-profile:
-  id: opencrvs.birth-record.exact
-  contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-inputs:
-  uin: request.target.identifiers.UIN
-outputs:
-  active: { type: boolean, nullable: false }
-  date_of_birth: { type: date, nullable: true }
-  sequence: { type: integer, nullable: false, minimum: 0, maximum: 9007199254740991 }
-  given_name: { type: string, nullable: true, max_bytes: 128 }
-  parents:
-    type: array
-    nullable: false
-    max_bytes: 4096
-    max_items: 2
-    items:
-      type: object
-      nullable: false
-      max_bytes: 2048
-      fields:
-        type:
-          required: true
-          schema: { type: string, nullable: false, max_bytes: 16 }
-        name:
-          required: true
-          schema: { type: string, nullable: false, max_bytes: 256 }
-        identifier:
-          required: false
-          schema: { type: string, nullable: true, max_bytes: 128 }
-"#,
-    )
-    .expect("authored typed consultation parses");
-    assert_eq!(consultation.outputs.len(), 5);
-    assert!(matches!(
-        consultation.outputs.get("date_of_birth"),
-        Some(RelayOutputContract::Date { nullable: true })
-    ));
-    let parents = consultation
-        .outputs
-        .get("parents")
-        .expect("parents contract exists");
-    let RelayOutputContract::Array {
-        nullable,
-        max_bytes,
-        max_items,
-        items,
-    } = parents
-    else {
-        panic!("parents is an array contract")
-    };
-    assert!(!nullable);
-    assert_eq!(*max_bytes, 4096);
-    assert_eq!(*max_items, 2);
-    assert!(matches!(
-        items.as_ref(),
-        RelayOutputContract::Object { fields, .. }
-            if !fields["identifier"].required
-                && matches!(
-                    fields["name"].schema.as_ref(),
-                    RelayOutputContract::String {
-                        nullable: false,
-                        max_bytes: 256
-                    }
-                )
-    ));
-
-    assert!(serde_norway::from_str::<RelayConsultationConfig>(
-        r#"
-profile:
-  id: opencrvs.birth-record.exact
-  contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-inputs: { uin: request.target.identifiers.UIN }
-outputs:
-  score: { type: number, nullable: false }
-"#,
-    )
-    .is_err());
-}
-
-#[test]
-fn recursive_output_contract_serde_is_closed_and_preserves_scalar_shapes() {
-    let wire = serde_json::json!({
-        "type": "object",
-        "nullable": true,
-        "max_bytes": 1024,
-        "fields": {
-            "active": {
-                "required": true,
-                "schema": { "type": "boolean", "nullable": false }
-            },
-            "children": {
-                "required": false,
-                "schema": {
-                    "type": "array",
-                    "nullable": true,
-                    "max_bytes": 512,
-                    "max_items": 4,
-                    "items": { "type": "integer", "nullable": false, "minimum": 0, "maximum": 9 }
-                }
-            }
-        }
-    });
-    let contract: RelayOutputContract =
-        serde_json::from_value(wire.clone()).expect("recursive contract parses");
-    assert_eq!(
-        serde_json::to_value(contract).expect("recursive contract serializes"),
-        wire
-    );
-
-    for invalid in [
-        serde_json::json!({
-            "type": "object",
-            "nullable": false,
-            "max_bytes": 64,
-            "fields": {},
-            "open": true
-        }),
-        serde_json::json!({
-            "type": "object",
-            "nullable": false,
-            "max_bytes": 64,
-            "fields": {
-                "value": {
-                    "required": true,
-                    "schema": { "type": "string", "nullable": false, "max_bytes": 8 },
-                    "default": "secret"
-                }
-            }
-        }),
-        serde_json::json!({
-            "type": "array",
-            "nullable": false,
-            "max_bytes": 64,
-            "max_items": 2,
-            "items": {
-                "type": "string",
-                "nullable": false,
-                "max_bytes": 8,
-                "pattern": ".*"
-            }
-        }),
-    ] {
-        serde_json::from_value::<RelayOutputContract>(invalid)
-            .expect_err("recursive contract variants must remain closed");
-    }
-}
-
-#[test]
-fn recursive_output_contract_validates_exact_values_and_composite_byte_bounds() {
-    let parent = RelayOutputContract::Object {
-        nullable: false,
-        max_bytes: 128,
-        fields: BTreeMap::from([
-            (
-                "birth_date".to_string(),
-                RelayOutputObjectFieldContract {
-                    required: false,
-                    schema: Box::new(RelayOutputContract::Date { nullable: false }),
-                },
-            ),
-            (
-                "name".to_string(),
-                RelayOutputObjectFieldContract {
-                    required: true,
-                    schema: Box::new(RelayOutputContract::String {
-                        nullable: false,
-                        max_bytes: 8,
-                    }),
-                },
-            ),
-            (
-                "sequence".to_string(),
-                RelayOutputObjectFieldContract {
-                    required: true,
-                    schema: Box::new(RelayOutputContract::Integer {
-                        nullable: false,
-                        minimum: 0,
-                        maximum: 2,
-                    }),
-                },
-            ),
-        ]),
-    };
-    let parents = RelayOutputContract::Array {
-        nullable: true,
-        max_bytes: 256,
-        max_items: 2,
-        items: Box::new(parent),
-    };
-
-    assert!(parents.validates_value(&serde_json::Value::Null));
-    assert!(parents.validates_value(&serde_json::json!([
-        { "name": "Ada", "sequence": 0, "birth_date": "2000-02-29" },
-        { "name": "Grace", "sequence": 2 }
-    ])));
-    for invalid in [
-        serde_json::json!({ "name": "Ada", "sequence": 0 }),
-        serde_json::json!([{ "sequence": 0 }]),
-        serde_json::json!([{ "name": "Ada", "sequence": 0, "unknown": true }]),
-        serde_json::json!([{ "name": "too-long-name", "sequence": 0 }]),
-        serde_json::json!([{ "name": "Ada", "sequence": 3 }]),
-        serde_json::json!([{ "name": "Ada", "sequence": 1.0 }]),
-        serde_json::json!([{ "name": "Ada", "sequence": 0, "birth_date": null }]),
-        serde_json::json!([{ "name": "Ada", "sequence": 0, "birth_date": "2001-02-29" }]),
-        serde_json::json!([
-            { "name": "Ada", "sequence": 0 },
-            { "name": "Grace", "sequence": 1 },
-            { "name": "Linus", "sequence": 2 }
-        ]),
-    ] {
-        assert!(
-            !parents.validates_value(&invalid),
-            "wrong type, shape, or bound must fail"
-        );
-    }
-
-    let byte_bounded = RelayOutputContract::Object {
-        nullable: false,
-        max_bytes: 8,
-        fields: BTreeMap::from([(
-            "a".to_string(),
-            RelayOutputObjectFieldContract {
-                required: true,
-                schema: Box::new(RelayOutputContract::String {
-                    nullable: false,
-                    max_bytes: 64,
-                }),
-            },
-        )]),
-    };
-    assert!(
-        !byte_bounded.validates_value(&serde_json::json!({ "a": "x" })),
-        "compact serialized object is nine bytes"
-    );
-
-    let nested_byte_bounded = RelayOutputContract::Object {
-        nullable: false,
-        max_bytes: 64,
-        fields: BTreeMap::from([(
-            "inner".to_string(),
-            RelayOutputObjectFieldContract {
-                required: true,
-                schema: Box::new(byte_bounded),
-            },
-        )]),
-    };
-    assert!(
-        !nested_byte_bounded.validates_value(&serde_json::json!({ "inner": { "a": "x" } })),
-        "every composite enforces its own serialized byte bound"
-    );
-}
-
-#[test]
-fn direct_consultation_output_accepts_object_and_array_claim_types_but_cel_stays_scalar() {
-    let parent_fields = BTreeMap::from([(
-        "name".to_string(),
-        RelayOutputObjectFieldContract {
-            required: true,
-            schema: Box::new(RelayOutputContract::String {
-                nullable: false,
-                max_bytes: 128,
-            }),
-        },
-    )]);
-    let object = RelayOutputContract::Object {
-        nullable: false,
-        max_bytes: 1024,
-        fields: parent_fields.clone(),
-    };
-    registry_backed_config_with_output("parent", object)
-        .validate()
-        .expect("direct object-valued consultation output validates");
-
-    let array = RelayOutputContract::Array {
-        nullable: false,
-        max_bytes: 4096,
-        max_items: 2,
-        items: Box::new(RelayOutputContract::Object {
-            nullable: false,
-            max_bytes: 1024,
-            fields: parent_fields,
-        }),
-    };
-    let config = registry_backed_config_with_output("parents", array);
-    config
-        .validate()
-        .expect("direct array-valued consultation output validates");
-
-    let mut wrong_claim_type = config.clone();
-    wrong_claim_type.evidence.claims[0].value.value_type = "object".to_string();
-    expect_mode_error(&wrong_claim_type, "must match its declared output");
-
-    let mut cel = config;
-    cel.evidence.claims[0].rule = RuleConfig::Cel {
-        expression: "true".to_string(),
-    };
-    cel.evidence.claims[0].value.value_type = "boolean".to_string();
-    cel.evidence.claims[0].value.nullable = false;
-    cel.validate()
-        .expect("a scalar CEL claim may share a consultation with direct composite outputs");
-}
-
-#[test]
-fn recursive_output_schema_enforces_envelope_compatible_platform_bounds() {
-    fn array_layers(depth: usize) -> RelayOutputContract {
-        if depth == 1 {
-            RelayOutputContract::Boolean { nullable: false }
-        } else {
-            RelayOutputContract::Array {
-                nullable: false,
-                max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1,
-                max_items: 1,
-                items: Box::new(array_layers(depth - 1)),
-            }
-        }
-    }
-
-    registry_backed_config_with_output("value", array_layers(6))
-        .validate()
-        .expect("six output-schema levels fit beneath the two-level Relay envelope");
-
-    for output in [
-        array_layers(7),
-        RelayOutputContract::Array {
-            nullable: false,
-            max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1,
-            max_items: MAX_RELAY_OUTPUT_ARRAY_ITEMS_V1 + 1,
-            items: Box::new(RelayOutputContract::Boolean { nullable: false }),
-        },
-        RelayOutputContract::Array {
-            nullable: false,
-            max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1 + 1,
-            max_items: 1,
-            items: Box::new(RelayOutputContract::Boolean { nullable: false }),
-        },
-        RelayOutputContract::Array {
-            nullable: false,
-            max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1,
-            max_items: 256,
-            items: Box::new(RelayOutputContract::Array {
-                nullable: false,
-                max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1,
-                max_items: 16,
-                items: Box::new(RelayOutputContract::Boolean { nullable: false }),
-            }),
-        },
-        RelayOutputContract::Object {
-            nullable: false,
-            max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1,
-            fields: (0..33)
-                .map(|index| {
-                    (
-                        format!("field_{index}"),
-                        RelayOutputObjectFieldContract {
-                            required: true,
-                            schema: Box::new(RelayOutputContract::Boolean { nullable: false }),
-                        },
-                    )
-                })
-                .collect(),
-        },
-        RelayOutputContract::Object {
-            nullable: false,
-            max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1,
-            fields: BTreeMap::from([(
-                "x".repeat(MAX_RELAY_OUTPUT_NAME_BYTES_V1 + 1),
-                RelayOutputObjectFieldContract {
-                    required: true,
-                    schema: Box::new(RelayOutputContract::Boolean { nullable: false }),
-                },
-            )]),
-        },
-        RelayOutputContract::Object {
-            nullable: false,
-            max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1,
-            fields: (0..8)
-                .map(|outer| {
-                    (
-                        format!("outer_{outer}"),
-                        RelayOutputObjectFieldContract {
-                            required: true,
-                            schema: Box::new(RelayOutputContract::Object {
-                                nullable: false,
-                                max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1,
-                                fields: (0..32)
-                                    .map(|inner| {
-                                        (
-                                            format!("inner_{inner}"),
-                                            RelayOutputObjectFieldContract {
-                                                required: true,
-                                                schema: Box::new(RelayOutputContract::Boolean {
-                                                    nullable: false,
-                                                }),
-                                            },
-                                        )
-                                    })
-                                    .collect(),
-                            }),
-                        },
-                    )
-                })
-                .collect(),
-        },
-    ] {
-        expect_mode_error(
-            &registry_backed_config_with_output("value", output),
-            "consultation output schema",
-        );
-    }
-}
diff --git a/crates/registry-notary-core/src/config/tests/root.rs b/crates/registry-notary-core/src/config/tests/root.rs
deleted file mode 100644
index aed0bc237..000000000
--- a/crates/registry-notary-core/src/config/tests/root.rs
+++ /dev/null
@@ -1,1279 +0,0 @@
-use super::support::*;
-use super::*;
-#[allow(unused_imports)]
-use super::{auth::*, credentials::*, infrastructure::*, issuance::*, preauth::*};
-
-#[test]
-pub(super) fn batch_limits_accept_only_lower_or_equal_platform_overrides() {
-    let mut config = valid_subject_access_config();
-    config.evidence.inline_batch_limit = MAX_BATCH_EVALUATION_MEMBERS_V1;
-    config.evidence.claims[0]
-        .operations
-        .batch_evaluate
-        .max_subjects = MAX_BATCH_EVALUATION_MEMBERS_V1;
-    config
-        .validate()
-        .expect("the hard platform ceiling is a valid operator value");
-
-    config.evidence.inline_batch_limit = 17;
-    config.evidence.claims[0]
-        .operations
-        .batch_evaluate
-        .max_subjects = 9;
-    config
-        .validate()
-        .expect("operators may lower either batch limit");
-}
-
-#[test]
-pub(super) fn batch_limits_reject_zero_and_values_above_the_platform_ceiling() {
-    for invalid in [0, MAX_BATCH_EVALUATION_MEMBERS_V1 + 1] {
-        let mut config = valid_subject_access_config();
-        config.evidence.inline_batch_limit = invalid;
-        let error = config
-            .validate()
-            .expect_err("the global batch override must stay within the platform range");
-        assert!(matches!(
-            error,
-            EvidenceConfigError::InvalidBatchConfig { .. }
-        ));
-
-        let mut config = valid_subject_access_config();
-        config.evidence.claims[0]
-            .operations
-            .batch_evaluate
-            .max_subjects = invalid;
-        let error = config
-            .validate()
-            .expect_err("the claim batch override must stay within the platform range");
-        assert!(matches!(
-            error,
-            EvidenceConfigError::InvalidBatchConfig { .. }
-        ));
-    }
-}
-
-#[test]
-pub(super) fn gate_input_defaults_are_low_risk_for_minimal_config() {
-    let config = minimal_config();
-    let input = config.gate_input();
-    // A minimal config uses PostgreSQL state and stdout audit by default.
-    assert!(!input.state_in_memory);
-    assert!(!input.audit_sink_class_durable);
-    // No high-risk modes are declared.
-    assert!(!input.requires_shared_state());
-    // Local YAML config without config_trust is unsigned.
-    assert!(input.config_unsigned);
-    // Admin listener is disabled by default, so no shared exposure.
-    assert!(!input.admin_shared_exposure);
-    // OpenAPI requires auth by default.
-    assert!(!input.openapi_public);
-    // An active but unreferenced key is not a Notary signing role.
-    assert!(!input.signer_without_custody_approval);
-}
-
-#[test]
-pub(super) fn gate_input_reports_federation_as_high_risk() {
-    let mut config = minimal_config();
-    config.federation.enabled = true;
-    assert!(config.gate_input().requires_shared_state());
-}
-
-#[test]
-pub(super) fn gate_input_reports_durable_audit_sink() {
-    let mut config = minimal_config();
-    config.audit.sink = "file".to_string();
-    assert!(config.gate_input().audit_sink_class_durable);
-}
-
-#[test]
-pub(super) fn gate_input_reports_audit_retention_local_only_for_file_sink_without_attestation() {
-    let mut config = minimal_config();
-    config.audit.sink = "file".to_string();
-    assert!(config.gate_input().audit_retention_local_only);
-}
-
-#[test]
-pub(super) fn gate_input_reports_audit_retention_local_only_for_jsonl_sink_without_attestation() {
-    let mut config = minimal_config();
-    config.audit.sink = "jsonl".to_string();
-    assert!(config.gate_input().audit_retention_local_only);
-}
-
-#[test]
-pub(super) fn gate_input_clears_audit_retention_local_only_when_attested() {
-    let mut config = minimal_config();
-    config.audit.sink = "file".to_string();
-    config.deployment.evidence.audit_offhost_shipping = true;
-    assert!(!config.gate_input().audit_retention_local_only);
-}
-
-#[test]
-pub(super) fn gate_input_requires_custody_approval_for_referenced_signer() {
-    let mut config = minimal_config();
-    config.auth.access_token_signing.enabled = true;
-    config.auth.access_token_signing.signing_key_id = "issuer-key".to_string();
-
-    assert!(config.gate_input().signer_without_custody_approval);
-}
-
-#[test]
-pub(super) fn gate_input_does_not_treat_pkcs11_as_custody_approval() {
-    let mut config = minimal_config();
-    config.auth.access_token_signing.enabled = true;
-    config.auth.access_token_signing.signing_key_id = "issuer-key".to_string();
-    config
-        .evidence
-        .signing_keys
-        .get_mut("issuer-key")
-        .expect("issuer key exists")
-        .provider = SigningKeyProviderConfig::Pkcs11;
-
-    assert!(config.gate_input().signer_without_custody_approval);
-}
-
-#[test]
-pub(super) fn gate_input_clears_signer_custody_when_approved() {
-    let mut config = minimal_config();
-    config.auth.access_token_signing.enabled = true;
-    config.auth.access_token_signing.signing_key_id = "issuer-key".to_string();
-    config.deployment.evidence.signer_custody_approved = true;
-
-    assert!(!config.gate_input().signer_without_custody_approval);
-}
-
-#[test]
-pub(super) fn gate_input_clears_audit_retention_local_only_for_stdout_sink() {
-    // Minimal config defaults to the stdout sink.
-    let config = minimal_config();
-    assert!(!config.gate_input().audit_retention_local_only);
-}
-
-#[test]
-pub(super) fn gate_input_clears_audit_retention_local_only_for_syslog_sink() {
-    let mut config = minimal_config();
-    config.audit.sink = "syslog".to_string();
-    assert!(!config.gate_input().audit_retention_local_only);
-}
-
-/// The fixture ack cursor's `acked_at` (`2026-06-04T09:59:00Z`) as a
-/// `SystemTime`, so tests can pin `now` relative to it deterministically.
-pub(super) fn fixture_acked_at() -> SystemTime {
-    let acked = time::OffsetDateTime::parse(
-        "2026-06-04T09:59:00Z",
-        &time::format_description::well_known::Rfc3339,
-    )
-    .expect("fixture acked_at parses");
-    SystemTime::from(acked)
-}
-
-pub(super) fn write_ack_cursor(dir: &std::path::Path, contents: &str) -> std::path::PathBuf {
-    let path = dir.join("ack-cursor.json");
-    std::fs::write(&path, contents).expect("ack cursor writes");
-    path
-}
-
-#[test]
-pub(super) fn gate_input_reports_shipping_declared_external_for_attested_file_sink() {
-    let mut config = minimal_config();
-    config.audit.sink = "file".to_string();
-    config.deployment.evidence.audit_offhost_shipping = true;
-    assert!(config.gate_input().audit_shipping_target_configured);
-}
-
-#[test]
-pub(super) fn gate_input_clears_shipping_declared_external_without_attestation() {
-    let mut config = minimal_config();
-    config.audit.sink = "file".to_string();
-    assert!(!config.gate_input().audit_shipping_target_configured);
-}
-
-#[test]
-pub(super) fn gate_input_reports_shipping_target_for_stdout_sink() {
-    let mut config = minimal_config();
-    config.deployment.evidence.audit_offhost_shipping = true;
-    assert!(config.gate_input().audit_shipping_target_configured);
-}
-
-#[test]
-pub(super) fn gate_input_reports_ack_cursor_configured_when_path_set() {
-    let mut config = minimal_config();
-    assert!(!config.gate_input().audit_ack_cursor_configured);
-    config.deployment.evidence.audit_ack_cursor_path =
-        Some(std::path::PathBuf::from("/nonexistent/ack-cursor.json"));
-    assert!(config.gate_input().audit_ack_cursor_configured);
-}
-
-#[test]
-pub(super) fn gate_input_reports_ack_health_ok_only_after_fresh_cursor_binds_to_tail() {
-    let dir = tempfile::tempdir().expect("tempdir");
-    let path = write_ack_cursor(
-        dir.path(),
-        registry_platform_ops::AUDIT_ACK_CURSOR_FIXTURE_V1,
-    );
-    let mut config = minimal_config();
-    config.deployment.evidence.audit_ack_cursor_path = Some(path);
-    // now is 60s after the cursor's acked_at, well within the 900s window.
-    let now = fixture_acked_at() + Duration::from_secs(60);
-    assert!(!config.gate_input_at(now).audit_ack_health_ok);
-    let observation = config
-        .audit_ack_observation_at(now)
-        .bind_to_audit_tail(Some([0x44; 32]));
-    assert!(
-        config
-            .gate_input_with_ack_observation(&observation)
-            .audit_ack_health_ok
-    );
-}
-
-#[test]
-pub(super) fn gate_input_at_reports_ack_health_not_ok_for_stale_cursor() {
-    let dir = tempfile::tempdir().expect("tempdir");
-    let path = write_ack_cursor(
-        dir.path(),
-        registry_platform_ops::AUDIT_ACK_CURSOR_FIXTURE_V1,
-    );
-    let mut config = minimal_config();
-    config.deployment.evidence.audit_ack_cursor_path = Some(path);
-    // now is 901s after acked_at, one second past the default window.
-    let now = fixture_acked_at() + Duration::from_secs(901);
-    assert!(!config.gate_input_at(now).audit_ack_health_ok);
-}
-
-#[test]
-pub(super) fn gate_input_at_reports_ack_health_not_ok_for_missing_cursor() {
-    let mut config = minimal_config();
-    config.deployment.evidence.audit_ack_cursor_path =
-        Some(std::path::PathBuf::from("/nonexistent/ack-cursor.json"));
-    let now = fixture_acked_at() + Duration::from_secs(60);
-    assert!(!config.gate_input_at(now).audit_ack_health_ok);
-}
-
-#[test]
-pub(super) fn gate_input_at_honors_custom_max_age_window() {
-    let dir = tempfile::tempdir().expect("tempdir");
-    let path = write_ack_cursor(
-        dir.path(),
-        registry_platform_ops::AUDIT_ACK_CURSOR_FIXTURE_V1,
-    );
-    let mut config = minimal_config();
-    config.deployment.evidence.audit_ack_cursor_path = Some(path);
-    config.deployment.evidence.audit_ack_max_age_secs = Some(30);
-    // 60s after acked_at is stale under a 30s window.
-    let now = fixture_acked_at() + Duration::from_secs(60);
-    assert!(!config.gate_input_at(now).audit_ack_health_ok);
-}
-
-#[test]
-pub(super) fn validate_rejects_ack_max_age_without_cursor() {
-    let mut config = minimal_config();
-    config.deployment.evidence.audit_ack_max_age_secs = Some(600);
-    let error = config
-        .validate()
-        .expect_err("max age without cursor rejected");
-    assert!(matches!(
-        error,
-        EvidenceConfigError::AuditAckMaxAgeWithoutCursor
-    ));
-}
-
-#[test]
-pub(super) fn validate_rejects_ack_cursor_on_local_file_sink_without_shipping_declared() {
-    let mut config = minimal_config();
-    config.audit.sink = "file".to_string();
-    config.deployment.evidence.audit_ack_cursor_path = Some(std::path::PathBuf::from(
-        "/var/lib/registry/ack-cursor.json",
-    ));
-    let error = config
-        .validate()
-        .expect_err("cursor on undeclared local file sink rejected");
-    assert!(matches!(
-        error,
-        EvidenceConfigError::AuditAckCursorWithoutShippingDeclared
-    ));
-}
-
-#[test]
-pub(super) fn validate_allows_ack_cursor_on_attested_local_file_sink() {
-    let mut config = minimal_config();
-    config.audit.sink = "file".to_string();
-    config.audit.path = Some("/var/log/registry/audit.jsonl".to_string());
-    config.audit.hash_secret_env = Some("TEST_TOKEN_HASH".to_string());
-    config.deployment.evidence.audit_offhost_shipping = true;
-    config.deployment.evidence.audit_ack_cursor_path = Some(std::path::PathBuf::from(
-        "/var/lib/registry/ack-cursor.json",
-    ));
-    config
-        .validate()
-        .expect("cursor on attested local file sink is valid");
-}
-
-#[test]
-pub(super) fn validate_allows_ack_cursor_on_stdout_sink_without_shipping_declared() {
-    // stdout retention is owned off-box, so a cursor there does not require
-    // the off-host shipping attestation.
-    let mut config = minimal_config();
-    config.deployment.evidence.audit_ack_cursor_path = Some(std::path::PathBuf::from(
-        "/var/lib/registry/ack-cursor.json",
-    ));
-    config
-        .validate()
-        .expect("cursor on stdout sink is valid without attestation");
-}
-
-#[test]
-pub(super) fn gate_input_reports_assisted_access_transaction_token_posture() {
-    let mut config = minimal_config();
-    config.subject_access.enabled = true;
-    let input_without_anchor = config.gate_input();
-    assert!(input_without_anchor.subject_access_enabled);
-    assert!(!input_without_anchor.transaction_token_anchor_configured);
-
-    config.auth.access_token_signing.enabled = true;
-    let input_with_anchor = config.gate_input();
-    assert!(input_with_anchor.transaction_token_anchor_configured);
-    assert!(
-        !input_with_anchor.transaction_token_sender_constrained,
-        "DPoP/mTLS proof validation is not implemented yet"
-    );
-}
-
-#[test]
-pub(super) fn gate_input_reports_admin_shared_exposure() {
-    let mut config = minimal_config();
-    config.server.admin_listener.mode = RegistryNotaryAdminListenerMode::SharedWithPublic;
-    assert!(config.gate_input().admin_shared_exposure);
-}
-
-#[test]
-pub(super) fn gate_input_clears_admin_shared_exposure_when_listener_disabled() {
-    let config = minimal_config();
-    // Default admin listener mode is Disabled; shared exposure must be false.
-    assert!(!config.gate_input().admin_shared_exposure);
-}
-
-#[test]
-pub(super) fn gate_input_reports_openapi_public() {
-    let mut config = minimal_config();
-    config.server.openapi_requires_auth = false;
-    assert!(config.gate_input().openapi_public);
-}
-
-#[test]
-pub(super) fn gate_input_clears_openapi_public_when_auth_required() {
-    let config = minimal_config();
-    // Default requires auth; openapi_public must be false.
-    assert!(!config.gate_input().openapi_public);
-}
-
-#[test]
-pub(super) fn gate_input_clears_config_unsigned_when_config_trust_configured() {
-    let mut config = minimal_config();
-    config.server.admin_listener.mode = RegistryNotaryAdminListenerMode::Dedicated;
-    config.config_trust = Some(valid_config_trust());
-    assert!(!config.gate_input().config_unsigned);
-}
-
-#[test]
-pub(super) fn gate_input_reports_config_unsigned_without_trust() {
-    let config = minimal_config();
-    // Minimal config has no config_trust block; must project as unsigned.
-    assert!(config.gate_input().config_unsigned);
-}
-
-#[test]
-pub(super) fn deployment_block_round_trips_through_yaml() {
-    let mut config = minimal_config();
-    config.deployment = serde_norway::from_str(
-        r#"
-profile: production
-waivers:
-  - finding: notary.openapi.public
-    reference: OPS-2026-0042
-    summary: Synthetic partner integration waiver
-    expires: 2099-09-30
-"#,
-    )
-    .expect("deployment block parses");
-    assert_eq!(
-        config.deployment.profile,
-        Some(crate::deployment::DeploymentProfile::Production)
-    );
-    config
-        .validate()
-        .expect("production config with waivable waiver validates");
-}
-
-#[test]
-pub(super) fn deployment_waiver_rejects_legacy_reason_as_unknown() {
-    let result: Result<crate::deployment::DeploymentConfig, _> = serde_norway::from_str(
-        r#"
-profile: hosted_lab
-waivers:
-  - finding: notary.openapi.public
-    reference: OPS-2026-0042
-    reason: legacy waiver text
-    expires: 2099-09-30
-"#,
-    );
-    assert!(
-        result.is_err(),
-        "the removed reason field must fail strict deserialization"
-    );
-}
-
-#[test]
-pub(super) fn deployment_waiver_rejects_missing_reference() {
-    let result: Result<crate::deployment::DeploymentConfig, _> = serde_norway::from_str(
-        r#"
-profile: hosted_lab
-waivers:
-  - finding: notary.openapi.public
-    expires: 2099-09-30
-"#,
-    );
-    assert!(
-        result.is_err(),
-        "a waiver without the required reference must fail deserialization"
-    );
-}
-
-#[test]
-pub(super) fn deployment_waiver_rejects_explicit_null_summary() {
-    let result: Result<crate::deployment::DeploymentConfig, _> = serde_norway::from_str(
-        r#"
-profile: hosted_lab
-waivers:
-  - finding: notary.openapi.public
-    reference: OPS-2026-0042
-    summary: null
-    expires: 2099-09-30
-"#,
-    );
-    assert!(
-        result.is_err(),
-        "summary must be a string when present, not null: {result:?}"
-    );
-}
-
-#[test]
-pub(super) fn deployment_evidence_block_round_trips_through_yaml() {
-    let mut config = minimal_config();
-    config.deployment = serde_norway::from_str(
-        r#"
-profile: production
-evidence:
-  audit_offhost_shipping: true
-"#,
-    )
-    .expect("deployment evidence block parses");
-    assert!(config.deployment.evidence.audit_offhost_shipping);
-}
-
-#[test]
-pub(super) fn deployment_evidence_rejects_unknown_field_through_yaml() {
-    let result: Result<crate::deployment::DeploymentConfig, _> = serde_norway::from_str(
-        r#"
-profile: production
-evidence:
-  audit_offhost_shipping: true
-  made_up_field: true
-"#,
-    );
-    assert!(
-        result.is_err(),
-        "unknown field inside deployment.evidence must fail deserialization"
-    );
-}
-
-#[test]
-pub(super) fn invalid_profile_value_fails_config_load() {
-    let result: Result<StandaloneRegistryNotaryConfig, _> = serde_norway::from_str(
-        r#"
-evidence:
-  enabled: true
-auth:
-deployment:
-  profile: prod
-"#,
-    );
-    assert!(
-        result.is_err(),
-        "an invalid profile string must fail to load"
-    );
-}
-
-pub(super) fn use_dedicated_admin_listener(config: &mut StandaloneRegistryNotaryConfig) {
-    config.server.admin_listener.mode = RegistryNotaryAdminListenerMode::Dedicated;
-}
-
-pub(super) fn valid_config_trust() -> ConfigTrustConfig {
-    ConfigTrustConfig {
-        trust_anchor_path: PathBuf::from("/etc/registry-notary/config-anchor.json"),
-        bundle_path: PathBuf::from("/etc/registry-notary/config-bundle"),
-        antirollback_state_path: PathBuf::from(
-            "/var/lib/registry-notary/config-state/antirollback.json",
-        ),
-        break_glass_override_path: None,
-    }
-}
-
-pub(super) fn minimal_claim(id: &str) -> ClaimDefinition {
-    serde_norway::from_str(&format!(
-        r#"
-id: {id}
-title: Test Claim
-version: "1.0"
-subject_type: person
-purpose: test-purpose
-required_scopes:
-  - registry:consult:test-source
-evidence_mode:
-  type: registry_backed
-  consultations:
-    test_source:
-      profile:
-        id: example.test-source.exact
-        contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-      inputs:
-        subject_id: target.id
-      outputs:
-        registration_found:
-          type: boolean
-          nullable: false
-rule:
-  type: consultation_matched
-  consultation: test_source
-value:
-  type: boolean
-"#
-    ))
-    .expect("minimal claim is valid YAML")
-}
-
-#[test]
-pub(super) fn claim_value_max_bytes_is_optional_for_direct_configs() {
-    let value: ClaimValueConfig = serde_norway::from_str("type: string\n")
-        .expect("legacy direct claim value config remains valid");
-    assert_eq!(value.max_bytes, None);
-    assert!(!serde_norway::to_string(&value)
-        .expect("claim value config serializes")
-        .contains("max_bytes"));
-}
-
-#[test]
-pub(super) fn string_claim_value_max_bytes_accepts_the_closed_platform_range() {
-    for max_bytes in [1, MAX_CLAIM_VALUE_STRING_BYTES_V1] {
-        let mut config = minimal_config();
-        let mut claim = minimal_claim("bounded-string");
-        claim.value.value_type = "string".to_string();
-        claim.value.max_bytes = Some(max_bytes);
-        claim.rule = RuleConfig::Cel {
-            expression: r#""value""#.to_string(),
-        };
-        config.evidence.claims.push(claim);
-        config
-            .validate()
-            .unwrap_or_else(|error| panic!("max_bytes {max_bytes} must validate: {error}"));
-    }
-}
-
-#[test]
-pub(super) fn claim_value_max_bytes_rejects_out_of_range_and_non_string_use() {
-    for max_bytes in [0, MAX_CLAIM_VALUE_STRING_BYTES_V1 + 1] {
-        let mut config = minimal_config();
-        let mut claim = minimal_claim("invalid-bound");
-        claim.value.value_type = "string".to_string();
-        claim.value.max_bytes = Some(max_bytes);
-        config.evidence.claims.push(claim);
-        let error = config
-            .validate()
-            .expect_err("out-of-range max_bytes must fail configuration validation");
-        assert!(matches!(
-            error,
-            EvidenceConfigError::InvalidClaimValueConfig { ref claim, ref reason }
-                if claim == "invalid-bound"
-                    && reason.contains("between 1 and 65536")
-        ));
-    }
-
-    let mut config = minimal_config();
-    let mut claim = minimal_claim("non-string-bound");
-    claim.value.value_type = "boolean".to_string();
-    claim.value.max_bytes = Some(16);
-    config.evidence.claims.push(claim);
-    let error = config
-        .validate()
-        .expect_err("non-string max_bytes must fail configuration validation");
-    assert!(matches!(
-        error,
-        EvidenceConfigError::InvalidClaimValueConfig { ref claim, ref reason }
-            if claim == "non-string-bound"
-                && reason.contains("only when value.type is string")
-    ));
-}
-
-pub(super) fn add_registry_credential_claim(
-    config: &mut StandaloneRegistryNotaryConfig,
-    claim_id: &str,
-    profile_id: &str,
-) {
-    config.evidence.relay = Some(
-        serde_norway::from_str(
-            r#"
-base_url: https://relay.internal.example
-workload_client_id: registry-notary
-token_file: /run/secrets/registry-notary-relay.jwt
-"#,
-        )
-        .expect("Relay connection parses"),
-    );
-    config.evidence.allowed_purposes = vec!["credential-test".to_string()];
-    let mut claim = minimal_claim(claim_id);
-    claim.purpose = Some("credential-test".to_string());
-    claim.required_scopes = vec!["credential:test".to_string()];
-    claim.value.value_type = "boolean".to_string();
-    claim.evidence_mode = ClaimEvidenceMode::RegistryBacked {
-        consultations: BTreeMap::from([(
-            "credential_test".to_string(),
-            RelayConsultationConfig {
-                profile: RelayConsultationProfileRef {
-                    id: "example.credential-test.exact".to_string(),
-                    contract_hash:
-                        "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-                            .to_string(),
-                },
-                inputs: BTreeMap::from([(
-                    "subject_id".to_string(),
-                    RelayConsultationInput::TargetId,
-                )]),
-                outputs: BTreeMap::from([(
-                    "active".to_string(),
-                    RelayOutputContract::Boolean { nullable: false },
-                )]),
-            },
-        )]),
-    };
-    claim.rule = RuleConfig::ConsultationMatched {
-        consultation: "credential_test".to_string(),
-    };
-    claim.credential_profiles = vec![profile_id.to_string()];
-    config.evidence.claims = vec![claim];
-}
-
-#[test]
-pub(super) fn config_trust_is_optional_but_requires_explicit_antirollback_path() {
-    let mut config = minimal_config();
-    assert!(config.config_trust.is_none());
-    config.validate().expect("simple local config validates");
-    use_dedicated_admin_listener(&mut config);
-
-    let mut trust = valid_config_trust();
-    trust.trust_anchor_path = PathBuf::from("");
-    config.config_trust = Some(trust);
-    let error = config
-        .validate()
-        .expect_err("empty trust-anchor path must fail validation");
-    assert!(matches!(
-        error,
-        EvidenceConfigError::InvalidConfigTrustConfig { .. }
-    ));
-
-    let mut trust = valid_config_trust();
-    trust.bundle_path = PathBuf::from("");
-    config.config_trust = Some(trust);
-    let error = config
-        .validate()
-        .expect_err("empty bundle path must fail validation");
-    assert!(matches!(
-        error,
-        EvidenceConfigError::InvalidConfigTrustConfig { .. }
-    ));
-
-    let mut trust = valid_config_trust();
-    trust.antirollback_state_path = PathBuf::from("");
-    config.config_trust = Some(trust);
-    let error = config
-        .validate()
-        .expect_err("empty anti-rollback path must fail validation");
-    assert!(matches!(
-        error,
-        EvidenceConfigError::InvalidConfigTrustConfig { .. }
-    ));
-
-    let mut trust = valid_config_trust();
-    trust.break_glass_override_path = Some(PathBuf::from(""));
-    config.config_trust = Some(trust);
-    let error = config
-        .validate()
-        .expect_err("empty break-glass override path must fail validation");
-    assert!(matches!(
-        error,
-        EvidenceConfigError::InvalidConfigTrustConfig { .. }
-    ));
-
-    config.config_trust = Some(valid_config_trust());
-    config
-        .validate()
-        .expect("explicit config bundle trust paths validate");
-}
-
-#[test]
-pub(super) fn cel_config_defaults_and_validates_operator_limits() {
-    let config = minimal_config();
-    assert_eq!(config.cel.mode, "worker");
-    assert_eq!(config.cel.worker_count, 2);
-    assert!(!config.cel.allow_regex);
-    config.validate().expect("default CEL config validates");
-}
-
-#[test]
-pub(super) fn cel_config_rejects_removed_queue_max() {
-    let error = serde_norway::from_str::<RegistryNotaryCelConfig>("queue_max: 0\n")
-        .expect_err("the unreleased CEL queue setting must not remain accepted");
-    assert!(error.to_string().contains("queue_max"));
-}
-
-#[test]
-pub(super) fn cel_config_deserializes_production_surface() {
-    let config: StandaloneRegistryNotaryConfig = serde_norway::from_str(
-        r#"
-evidence:
-  enabled: true
-  signing_keys:
-    issuer-key:
-      provider: local_jwk_env
-      private_jwk_env: ISSUER_KEY
-      alg: EdDSA
-      kid: did:web:issuer.example#key-1
-      status: active
-auth:
-  api_keys:
-    - id: test-key
-      fingerprint:
-        provider: env
-        name: TEST_TOKEN_HASH
-cel:
-  mode: worker
-  worker_count: 4
-  eval_timeout_ms: 1500
-  allow_regex: false
-  max_expression_bytes: 4096
-  max_binding_json_bytes: 32768
-  max_result_json_bytes: 8192
-  max_string_bytes: 4096
-  max_list_items: 128
-  max_object_depth: 8
-  max_object_keys: 64
-  worker_memory_bytes: 67108864
-  worker_stderr_bytes: 512
-"#,
-    )
-    .expect("CEL config deserializes");
-
-    assert_eq!(config.cel.worker_count, 4);
-    assert_eq!(config.cel.eval_timeout_ms, 1500);
-    assert_eq!(config.cel.max_result_json_bytes, 8192);
-    config.validate().expect("CEL config validates");
-}
-
-pub(super) fn valid_subject_access_config() -> StandaloneRegistryNotaryConfig {
-    serde_norway::from_str(
-        r#"
-evidence:
-  enabled: true
-  relay:
-    base_url: https://relay.internal.example
-    workload_client_id: registry-notary
-    token_file: /run/secrets/registry-notary-relay.jwt
-  signing_keys:
-    issuer-key:
-      provider: local_jwk_env
-      private_jwk_env: ISSUER_KEY
-      alg: EdDSA
-      kid: did:web:issuer.example#key-1
-      status: active
-  credential_profiles:
-    civil_status_sd_jwt:
-      format: application/dc+sd-jwt
-      issuer: did:web:issuer.example
-      signing_key: issuer-key
-      vct: https://issuer.example/credentials/civil-status
-      validity_seconds: 600
-      holder_binding:
-        mode: did
-        proof_of_possession: required
-        allowed_did_methods:
-          - did:jwk
-      allowed_claims:
-        - date-of-birth
-      disclosure:
-        allowed:
-          - value
-  claims:
-    - id: date-of-birth
-      title: Date of birth
-      version: "1.0"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          civil_status:
-            profile:
-              id: example.civil-status.exact
-              contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-            inputs:
-              national_id: request.target.identifiers.national_id
-            outputs:
-              value:
-                type: boolean
-                nullable: true
-      value:
-        type: boolean
-        nullable: true
-      purpose: citizen_subject_access
-      required_scopes:
-        - subject_access
-      rule:
-        type: consultation_output
-        consultation: civil_status
-        output: value
-      disclosure:
-        default: value
-        allowed:
-          - value
-      formats:
-        - application/vnd.registry-notary.claim-result+json
-      credential_profiles:
-        - civil_status_sd_jwt
-auth:
-  oidc:
-    issuer: https://id.example.gov
-    jwks_url: https://id.example.gov/oauth/v2/keys
-    audiences:
-      - registry-notary-citizen
-    allowed_clients:
-      - citizen-portal
-    scope_claim: scope
-    scope_map:
-      citizen_subject_access:
-        - subject_access
-    leeway: 30s
-subject_access:
-  enabled: true
-  subject_binding:
-    token_claim: https://id.example.gov/claims/national_id
-    request_field: SubjectId
-    id_type: national_id
-    normalize: exact
-    allow_sub_as_civil_id: false
-  citizen_clients:
-    allowed_client_ids:
-      - citizen-portal
-    allowed_audiences:
-      - registry-notary-citizen
-  token_policy:
-    required_acr_values:
-      - urn:example:loa:substantial
-    max_auth_age_seconds: 900
-    max_access_token_lifetime_seconds: 900
-    max_evaluation_age_seconds: 600
-    max_credential_validity_seconds: 600
-    max_clock_leeway_seconds: 60
-  allowed_operations:
-    evaluate: true
-    render: true
-    issue_credential: true
-    batch_evaluate: false
-  allowed_purposes:
-    - citizen_subject_access
-  allowed_claims:
-    - date-of-birth
-  allowed_formats:
-    - application/vnd.registry-notary.claim-result+json
-  allowed_disclosures:
-    - value
-  required_scopes:
-    - subject_access
-  allowed_wallet_origins:
-    - https://wallet.example.gov
-  credential_profiles:
-    - civil_status_sd_jwt
-  rate_limits:
-    invalid_token_per_client_address_per_minute: 20
-    per_principal_per_minute: 10
-    subject_mismatch_per_principal_per_hour: 5
-    per_holder_per_hour: 10
-    credential_issuance_per_principal_per_hour: 5
-"#,
-    )
-    .expect("subject-access config is valid YAML")
-}
-
-pub(super) fn valid_delegated_subject_access_config() -> StandaloneRegistryNotaryConfig {
-    let mut config = valid_subject_access_config();
-    config.evidence.relay = Some(
-        serde_norway::from_str(
-            r#"
-base_url: https://relay.internal.example
-workload_client_id: registry-notary
-token_file: /run/secrets/registry-notary-relay.jwt
-"#,
-        )
-        .expect("Relay connection parses"),
-    );
-    let mut proof = config.evidence.claims[0].clone();
-    proof.id = "guardian-link".to_string();
-    proof.title = "Guardian link".to_string();
-    proof.subject_type = "relationship".to_string();
-    proof.purpose = Some("dependent_attestation".to_string());
-    proof.required_scopes = vec!["subject_access".to_string()];
-    proof.evidence_mode = ClaimEvidenceMode::RegistryBacked {
-        consultations: BTreeMap::from([(
-            "guardian_link".to_string(),
-            RelayConsultationConfig {
-                profile: RelayConsultationProfileRef {
-                    id: "example.guardian-link.exact".to_string(),
-                    contract_hash:
-                        "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-                            .to_string(),
-                },
-                inputs: BTreeMap::from([
-                    (
-                        "requester_id".to_string(),
-                        RelayConsultationInput::RequesterIdentifier(
-                            "request.requester.identifiers.national_id".to_string(),
-                        ),
-                    ),
-                    (
-                        "target_id".to_string(),
-                        RelayConsultationInput::TargetIdentifier(
-                            "request.target.identifiers.civil_registration_id".to_string(),
-                        ),
-                    ),
-                ]),
-                outputs: BTreeMap::from([(
-                    "established".to_string(),
-                    RelayOutputContract::Boolean { nullable: true },
-                )]),
-            },
-        )]),
-    };
-    proof.value.nullable = true;
-    proof.credential_profiles.clear();
-    proof.rule = RuleConfig::ConsultationOutput {
-        consultation: "guardian_link".to_string(),
-        output: "established".to_string(),
-    };
-
-    let mut dependent = config.evidence.claims[0].clone();
-    dependent.id = "dependent-date-of-birth".to_string();
-    dependent.title = "Dependent date of birth".to_string();
-    dependent.purpose = Some("dependent_attestation".to_string());
-    dependent.depends_on = vec!["guardian-link".to_string()];
-    dependent.credential_profiles.clear();
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut dependent.evidence_mode else {
-        panic!("delegated claim is registry-backed");
-    };
-    consultations
-        .get_mut("civil_status")
-        .expect("civil status consultation exists")
-        .inputs
-        .insert(
-            "national_id".to_string(),
-            RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.civil_registration_id".to_string(),
-            ),
-        );
-
-    config.evidence.claims.push(proof);
-    config.evidence.claims.push(dependent);
-    config.subject_access.delegation = SubjectAccessDelegationConfig {
-        enabled: true,
-        allowed_relationships: vec![SubjectAccessDelegatedRelationshipConfig {
-            relationship_type: "guardian".to_string(),
-            proof_claim: "guardian-link".to_string(),
-            target_id_type: Some("civil_registration_id".to_string()),
-            max_proof_age_seconds: 300,
-            allowed_claims: vec!["dependent-date-of-birth".to_string()],
-            allowed_purposes: vec!["dependent_attestation".to_string()],
-            allowed_formats: vec!["application/vnd.registry-notary.claim-result+json".to_string()],
-            allowed_disclosures: vec!["value".to_string()],
-        }],
-    };
-    config
-}
-
-pub(super) fn valid_oid4vci_config() -> StandaloneRegistryNotaryConfig {
-    let mut config = valid_subject_access_config();
-    config
-        .subject_access
-        .rate_limits
-        .tx_code_attempts_per_code_per_minute = 5;
-    config
-        .evidence
-        .signing_keys
-        .insert("access-token-key".to_string(), second_signing_key());
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("civil status credential profile exists")
-        .vct = "http://127.0.0.1:4325/credentials/civil-status".to_string();
-    config.oid4vci = serde_norway::from_str(
-        r#"
-enabled: true
-credential_issuer: http://127.0.0.1:4325
-authorization_servers:
-  - http://localhost:8088/v1/esignet
-accepted_token_audiences:
-  - http://127.0.0.1:4325
-credential_endpoint: http://127.0.0.1:4325/oid4vci/credential
-nonce:
-  enabled: true
-  ttl_seconds: 300
-authorization:
-  require_pkce_method: S256
-proof:
-  max_age_seconds: 300
-  max_clock_skew_seconds: 30
-credential_configurations:
-  date_of_birth_sd_jwt:
-    claim_id: date-of-birth
-    credential_profile: civil_status_sd_jwt
-    format: dc+sd-jwt
-    scope: date-of-birth
-    vct: http://127.0.0.1:4325/credentials/civil-status
-    display_name: Date of birth
-    proof_signing_alg_values_supported:
-      - EdDSA
-    cryptographic_binding_methods_supported:
-      - did:jwk
-pre_authorized_code:
-  enabled: true
-  tx_code:
-    required: true
-    input_mode: numeric
-    length: 6
-  esignet:
-    client_id: registry-lab-live-client
-    client_signing_key_id: issuer-key
-    redirect_uri: http://127.0.0.1:4325/oid4vci/offer/callback
-    authorize_url: https://id.example.gov/authorize
-    token_url: https://id.example.gov/oauth/v2/token
-    issuer: https://id.example.gov
-    jwks_uri: https://id.example.gov/oauth/.well-known/jwks.json
-    scopes:
-      - openid
-  pre_authorized_code_ttl_seconds: 300
-"#,
-    )
-    .expect("oid4vci config is valid YAML");
-    config.auth.access_token_signing = serde_norway::from_str(
-        r#"
-enabled: true
-issuer: http://127.0.0.1:4325
-audiences:
-  - http://127.0.0.1:4325
-allowed_algorithms:
-  - EdDSA
-token_typ: registry-notary-access+jwt
-signing_key_id: access-token-key
-access_token_ttl_seconds: 300
-"#,
-    )
-    .expect("access-token signing config is valid YAML");
-    config
-}
-
-pub(super) fn add_oid4vci_projection_claim(
-    config: &mut StandaloneRegistryNotaryConfig,
-    claim_id: &str,
-    title: &str,
-) {
-    let mut claim = config
-        .evidence
-        .claims
-        .iter()
-        .find(|claim| claim.id == "date-of-birth")
-        .expect("base claim exists")
-        .clone();
-    claim.id = claim_id.to_string();
-    claim.title = title.to_string();
-    claim.credential_profiles = vec!["civil_status_sd_jwt".to_string()];
-    config.evidence.claims.push(claim);
-    config
-        .subject_access
-        .allowed_claims
-        .push(claim_id.to_string());
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("profile exists")
-        .allowed_claims
-        .push(claim_id.to_string());
-}
-
-pub(super) fn valid_oid4vci_projection_config() -> StandaloneRegistryNotaryConfig {
-    let mut config = valid_oid4vci_config();
-    add_oid4vci_projection_claim(&mut config, "birth-place", "Birth place");
-    let credential = config
-        .oid4vci
-        .credential_configurations
-        .get_mut("date_of_birth_sd_jwt")
-        .expect("credential configuration exists");
-    credential.claim_id = None;
-    credential.claims = vec![
-        Oid4vciCredentialClaimConfig {
-            id: "date-of-birth".to_string(),
-            output_path: vec!["birth_date".to_string()],
-            display_name: "Date of birth".to_string(),
-            sd: "always".to_string(),
-        },
-        Oid4vciCredentialClaimConfig {
-            id: "birth-place".to_string(),
-            output_path: vec!["birth_place_name".to_string()],
-            display_name: "Birth place".to_string(),
-            sd: "always".to_string(),
-        },
-    ];
-    config
-}
-
-pub(super) fn expect_subject_access_error(config: &StandaloneRegistryNotaryConfig) -> String {
-    match config
-        .validate()
-        .expect_err("subject-access config must fail validation")
-    {
-        EvidenceConfigError::InvalidSubjectAccessConfig { reason } => reason,
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-pub(super) fn expect_oid4vci_error(config: &StandaloneRegistryNotaryConfig) -> String {
-    match config
-        .validate()
-        .expect_err("oid4vci config must fail validation")
-    {
-        EvidenceConfigError::InvalidOid4vciConfig { reason } => reason,
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-pub(super) fn expect_federation_error(config: &StandaloneRegistryNotaryConfig) -> String {
-    match config
-        .validate()
-        .expect_err("federation config must fail validation")
-    {
-        EvidenceConfigError::InvalidFederationConfig { reason } => reason,
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-pub(super) fn expect_state_error(config: &StandaloneRegistryNotaryConfig) -> String {
-    match config
-        .validate()
-        .expect_err("state config must fail validation")
-    {
-        EvidenceConfigError::InvalidStateConfig { reason } => reason,
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-pub(super) fn expect_credential_status_error(config: &StandaloneRegistryNotaryConfig) -> String {
-    match config
-        .validate()
-        .expect_err("credential status config must fail validation")
-    {
-        EvidenceConfigError::InvalidCredentialStatusConfig { reason } => reason,
-        other => panic!("unexpected error variant: {other}"),
-    }
-}
-
-#[test]
-pub(super) fn admin_listener_defaults_to_disabled_for_simple_local_config() {
-    let config = minimal_config();
-
-    assert_eq!(
-        config.server.admin_listener.mode,
-        RegistryNotaryAdminListenerMode::Disabled
-    );
-    config
-        .validate()
-        .expect("simple local config may disable admin listener by default");
-}
-
-#[test]
-pub(super) fn server_limits_default_to_relay_parity_values() {
-    let config = minimal_config();
-    assert_eq!(config.server.request_timeout, Duration::from_secs(30));
-    assert_eq!(config.server.request_body_timeout, Duration::from_secs(10));
-    assert_eq!(
-        config.server.http1_header_read_timeout,
-        Duration::from_secs(10)
-    );
-    assert_eq!(config.server.max_connections, 1024);
-}
-
-#[test]
-pub(super) fn cel_evaluation_timeout_keeps_the_fail_closed_product_default() {
-    let config = minimal_config();
-    assert_eq!(config.cel.eval_timeout_ms, 2_000);
-}
-
-#[test]
-pub(super) fn server_limits_must_be_nonzero() {
-    let mut config = minimal_config();
-    config.server.request_timeout = Duration::ZERO;
-    config.server.request_body_timeout = Duration::ZERO;
-    config.server.http1_header_read_timeout = Duration::ZERO;
-    config.server.max_connections = 0;
-
-    let err = config
-        .validate()
-        .expect_err("zero server limits must fail validation");
-    match err {
-        EvidenceConfigError::InvalidServerConfig { reason } => {
-            assert!(reason.contains("server timeouts must be non-zero"));
-            assert!(reason.contains("max_connections"));
-        }
-        other => panic!("unexpected error: {other:?}"),
-    }
-}
-
-#[test]
-pub(super) fn governed_config_requires_dedicated_admin_listener() {
-    let mut config = minimal_config();
-    config.config_trust = Some(valid_config_trust());
-
-    let error = config
-        .validate()
-        .expect_err("governed config must not default to shared admin listener");
-    match error {
-        EvidenceConfigError::InvalidServerConfig { reason } => {
-            assert!(reason.contains("server.admin_listener.mode = dedicated"));
-        }
-        other => panic!("unexpected error variant: {other}"),
-    }
-
-    config.server.admin_listener.mode = RegistryNotaryAdminListenerMode::Dedicated;
-    config
-        .validate()
-        .expect("governed config validates with dedicated admin listener");
-}
-
-#[test]
-pub(super) fn dedicated_admin_listener_must_not_reuse_public_bind() {
-    let mut config = minimal_config();
-    config.server.admin_listener.mode = RegistryNotaryAdminListenerMode::Dedicated;
-    config.server.admin_listener.bind = config.server.bind;
-
-    let error = config
-        .validate()
-        .expect_err("dedicated admin bind must differ from public bind");
-    assert!(matches!(
-        error,
-        EvidenceConfigError::InvalidServerConfig { .. }
-    ));
-}
diff --git a/crates/registry-notary-core/src/config/tests/support.rs b/crates/registry-notary-core/src/config/tests/support.rs
deleted file mode 100644
index f4f09f2c4..000000000
--- a/crates/registry-notary-core/src/config/tests/support.rs
+++ /dev/null
@@ -1,54 +0,0 @@
-use super::*;
-/// Builds a minimal valid config from which individual tests can deviate.
-pub(super) fn minimal_config() -> StandaloneRegistryNotaryConfig {
-    serde_norway::from_str(
-        r#"
-evidence:
-  enabled: true
-  claims:
-    - id: test-claim
-      title: Test Claim
-      version: "1.0"
-      subject_type: person
-      purpose: test-purpose
-      required_scopes:
-        - registry:consult:test-source
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          test_source:
-            profile:
-              id: example.test-source.exact
-              contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-            inputs:
-              subject_id: target.id
-            outputs:
-              registration_found:
-                type: boolean
-                nullable: false
-      rule:
-        type: consultation_matched
-        consultation: test_source
-      value:
-        type: boolean
-  relay:
-    base_url: https://relay.internal.example
-    workload_client_id: registry-notary
-    token_file: /run/secrets/registry-notary-relay.jwt
-  signing_keys:
-    issuer-key:
-      provider: local_jwk_env
-      private_jwk_env: ISSUER_KEY
-      alg: EdDSA
-      kid: did:web:issuer.example#key-1
-      status: active
-auth:
-  api_keys:
-    - id: test-key
-      fingerprint:
-        provider: env
-        name: TEST_TOKEN_HASH
-"#,
-    )
-    .expect("minimal config is valid YAML")
-}
diff --git a/crates/registry-notary-core/src/deployment.rs b/crates/registry-notary-core/src/deployment.rs
deleted file mode 100644
index 8b5e6ca33..000000000
--- a/crates/registry-notary-core/src/deployment.rs
+++ /dev/null
@@ -1,1660 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Operator-declared deployment profile and gate evaluation.
-//!
-//! A deployment profile is an explicit operator declaration of how a Notary
-//! instance is deployed. It is never inferred from the environment label, the
-//! hostname, or the network position. The profile binds a set of gates; each
-//! gate inspects the running configuration and reports an effect at a defined
-//! severity. An undeclared deployment is a startup failure; `local` is the
-//! explicit opt-out for development.
-
-use std::path::{Path, PathBuf};
-use std::time::Duration;
-
-use schemars::JsonSchema;
-use serde::{Deserialize, Serialize};
-
-/// The set of deployment profiles an operator can declare.
-///
-/// Frozen at introduction; new profiles may be added but existing ones never
-/// change meaning. Deserialization is strict: an unknown profile string fails,
-/// which surfaces as a startup error.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(rename_all = "snake_case")]
-pub enum DeploymentProfile {
-    Local,
-    HostedLab,
-    Production,
-    EvidenceGrade,
-}
-
-impl DeploymentProfile {
-    pub const fn as_str(self) -> &'static str {
-        match self {
-            Self::Local => "local",
-            Self::HostedLab => "hosted_lab",
-            Self::Production => "production",
-            Self::EvidenceGrade => "evidence_grade",
-        }
-    }
-}
-
-/// Severity vocabulary shared across products.
-///
-/// `startup_fail` and `readiness_fail` are hard gates and bind only on declared
-/// profiles. `finding_error` and `finding_warn` surface as posture findings.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(rename_all = "snake_case")]
-pub enum GateSeverity {
-    StartupFail,
-    ReadinessFail,
-    FindingError,
-    FindingWarn,
-}
-
-impl GateSeverity {
-    pub const fn as_str(self) -> &'static str {
-        match self {
-            Self::StartupFail => "startup_fail",
-            Self::ReadinessFail => "readiness_fail",
-            Self::FindingError => "finding_error",
-            Self::FindingWarn => "finding_warn",
-        }
-    }
-
-    /// Hard deployment gates cannot be waived. `startup_fail` means running at
-    /// all would falsify the profile claim; `readiness_fail` means the process
-    /// may run but must not report ready until the condition is cleared.
-    pub const fn is_waivable(self) -> bool {
-        matches!(self, Self::FindingError | Self::FindingWarn)
-    }
-}
-
-/// Status of a finding in posture output.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(rename_all = "snake_case")]
-pub enum DeploymentFindingStatus {
-    Active,
-    Waived,
-}
-
-impl DeploymentFindingStatus {
-    pub const fn as_str(self) -> &'static str {
-        match self {
-            Self::Active => "active",
-            Self::Waived => "waived",
-        }
-    }
-}
-
-/// The operator-declared `deployment` config block.
-///
-/// An absent profile means an undeclared deployment, which refuses startup. The
-/// `multi_instance` flag is an operator declaration that the instance is one of
-/// several sharing the same workload; it is never inferred.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct DeploymentConfig {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub profile: Option<DeploymentProfile>,
-    #[serde(default)]
-    pub multi_instance: bool,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub waivers: Vec<DeploymentWaiverConfig>,
-    /// Operator declarations of assurance evidence the runtime cannot observe
-    /// for itself. Absent declarations leave the corresponding gates active.
-    #[serde(default)]
-    pub evidence: DeploymentEvidenceConfig,
-}
-
-impl DeploymentConfig {
-    pub fn is_default(&self) -> bool {
-        self == &Self::default()
-    }
-}
-
-/// Operator-asserted assurance evidence for conditions the runtime cannot
-/// observe directly. Each flag defaults to `false`, meaning "no evidence
-/// declared", which keeps the corresponding gate active until the operator
-/// asserts the control is in place out of band.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-pub struct DeploymentEvidenceConfig {
-    /// Operator asserts audit log events are shipped off-host (for example to
-    /// a log aggregator or SIEM) so a local file sink does not cap retention.
-    #[serde(default)]
-    pub audit_offhost_shipping: bool,
-    /// Optional path to a `registry.audit.ack_cursor.v1` file maintained by
-    /// whatever ships audit events off-host. Runtime health requires both a
-    /// fresh timestamp and a watermark equal to the live keyed audit-chain tail.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub audit_ack_cursor_path: Option<PathBuf>,
-    /// Optional freshness window, in seconds, for the off-host ack cursor.
-    /// Unset defaults to [`DEFAULT_AUDIT_ACK_MAX_AGE`] (900s). Meaningless
-    /// without `audit_ack_cursor_path`; config load rejects that combination.
-    ///
-    /// [`DEFAULT_AUDIT_ACK_MAX_AGE`]: registry_platform_ops::DEFAULT_AUDIT_ACK_MAX_AGE
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub audit_ack_max_age_secs: Option<u64>,
-    /// Operator asserts a production review has approved signer custody for
-    /// this deployment. Provider kind is not proof of custody: PKCS#11 modules
-    /// can be backed by either hardware or software tokens.
-    #[serde(default)]
-    pub signer_custody_approved: bool,
-}
-
-impl DeploymentEvidenceConfig {
-    /// The off-host ack cursor path, if the operator configured one.
-    pub fn audit_ack_cursor_path(&self) -> Option<&Path> {
-        self.audit_ack_cursor_path.as_deref()
-    }
-
-    /// Freshness window for the off-host ack cursor, defaulting to
-    /// [`DEFAULT_AUDIT_ACK_MAX_AGE`] when `audit_ack_max_age_secs` is unset.
-    ///
-    /// [`DEFAULT_AUDIT_ACK_MAX_AGE`]: registry_platform_ops::DEFAULT_AUDIT_ACK_MAX_AGE
-    pub fn audit_ack_max_age(&self) -> Duration {
-        self.audit_ack_max_age_secs
-            .map(Duration::from_secs)
-            .unwrap_or(registry_platform_ops::DEFAULT_AUDIT_ACK_MAX_AGE)
-    }
-}
-
-/// One operator-configured waiver.
-///
-/// A waiver names exactly one finding id, a required operator reference, an
-/// optional summary, and a mandatory expiry date (`YYYY-MM-DD`). The shared
-/// operations contract validates metadata before it can reach posture or logs.
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(deny_unknown_fields, from = "DeploymentWaiverConfigDocument")]
-#[schemars(!from)]
-pub struct DeploymentWaiverConfig {
-    pub finding: String,
-    #[schemars(with = "crate::config::schema::DeploymentWaiverReferenceSchema")]
-    pub reference: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    #[schemars(with = "crate::config::schema::DeploymentWaiverSummarySchema")]
-    pub summary: Option<String>,
-    pub expires: String,
-}
-
-#[derive(Deserialize)]
-#[serde(deny_unknown_fields)]
-struct DeploymentWaiverConfigDocument {
-    finding: String,
-    reference: String,
-    #[serde(default)]
-    summary: registry_platform_ops::OptionalDeploymentWaiverSummary,
-    expires: String,
-}
-
-impl From<DeploymentWaiverConfigDocument> for DeploymentWaiverConfig {
-    fn from(value: DeploymentWaiverConfigDocument) -> Self {
-        Self {
-            finding: value.finding,
-            reference: value.reference,
-            summary: value.summary.into(),
-            expires: value.expires,
-        }
-    }
-}
-
-/// Errors raised while validating the deployment block at config load.
-#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
-pub enum DeploymentConfigError {
-    #[error("deployment.waivers[{index}].finding must not be empty")]
-    EmptyWaiverFinding { index: usize },
-    #[error("deployment.waivers[{index}].{field} is invalid: {error}")]
-    InvalidWaiverMetadata {
-        index: usize,
-        field: &'static str,
-        error: registry_platform_ops::DeploymentWaiverMetadataError,
-    },
-    #[error("deployment.waivers[{index}].expires must be a YYYY-MM-DD date")]
-    InvalidWaiverExpiry { index: usize },
-    #[error(
-        "deployment.waivers[{index}] waives finding '{finding}', a hard deployment gate that cannot be waived; remove the waiver and fix the underlying condition it reports (audit shipping findings require deployment.evidence.audit_ack_cursor_path to name the shipper's fresh cursor and require its last_acked_hash to match the live keyed audit-chain tail, including for stdout and syslog sinks)"
-    )]
-    HardGateNotWaivable { index: usize, finding: String },
-    #[error(
-        "deployment.waivers[{index}] waives unknown finding id '{finding}'; check the catalog"
-    )]
-    UnknownWaivedFinding { index: usize, finding: String },
-}
-
-impl DeploymentConfig {
-    /// Validate the deployment block at config load.
-    ///
-    /// This checks waiver shape (shared metadata contract, parseable expiry)
-    /// and the hard rule that `startup_fail` and `readiness_fail` gates can
-    /// never be waived under the declared profile. An undeclared profile still
-    /// validates waiver shape here so typos are caught early; startup refusal
-    /// is handled by gate evaluation.
-    pub fn validate(&self) -> Result<(), DeploymentConfigError> {
-        for (index, waiver) in self.waivers.iter().enumerate() {
-            if waiver.finding.trim().is_empty() {
-                return Err(DeploymentConfigError::EmptyWaiverFinding { index });
-            }
-            registry_platform_ops::validate_deployment_waiver_metadata(
-                &waiver.reference,
-                waiver.summary.as_deref(),
-            )
-            .map_err(|error| DeploymentConfigError::InvalidWaiverMetadata {
-                index,
-                field: error.field(),
-                error,
-            })?;
-            if parse_iso_date(&waiver.expires).is_none() {
-                return Err(DeploymentConfigError::InvalidWaiverExpiry { index });
-            }
-            let Some(gate) = gate_catalog().iter().find(|gate| gate.id == waiver.finding) else {
-                return Err(DeploymentConfigError::UnknownWaivedFinding {
-                    index,
-                    finding: waiver.finding.clone(),
-                });
-            };
-            if let Some(profile) = self.profile {
-                if let Some(severity) = gate.severity_for(profile) {
-                    if !severity.is_waivable() {
-                        return Err(DeploymentConfigError::HardGateNotWaivable {
-                            index,
-                            finding: waiver.finding.clone(),
-                        });
-                    }
-                }
-            }
-        }
-        Ok(())
-    }
-}
-
-/// Snapshot of the configuration facts every gate predicate reads.
-///
-/// Building this once keeps gate predicates pure and free of config-shape
-/// knowledge, which makes the catalog easy to read and test.
-#[derive(Debug, Clone, Default)]
-pub struct GateInput {
-    pub state_in_memory: bool,
-    pub federation_enabled: bool,
-    pub oid4vci_preauth_enabled: bool,
-    pub holder_proof_required: bool,
-    pub wallet_facing: bool,
-    pub multi_instance: bool,
-    pub audit_sink_class_durable: bool,
-    pub audit_retention_local_only: bool,
-    /// A shipping target is configured (stdout, syslog, or a local file with
-    /// `audit_offhost_shipping` attested) and therefore needs a bound ack cursor
-    /// under evidence-grade policy.
-    pub audit_shipping_target_configured: bool,
-    /// An off-host ack cursor path is configured, so shipping freshness is
-    /// observed rather than merely declared.
-    pub audit_ack_cursor_configured: bool,
-    /// The configured ack cursor's observed health is `ok` (fresh). False for
-    /// every other observation (stale, missing, invalid) and when no cursor is
-    /// configured: the shipping-stale gate fails closed on anything but `ok`.
-    pub audit_ack_health_ok: bool,
-    pub admin_shared_exposure: bool,
-    pub openapi_public: bool,
-    pub config_unsigned: bool,
-    pub subject_access_enabled: bool,
-    pub transaction_token_anchor_configured: bool,
-    pub transaction_token_sender_constrained: bool,
-    pub signer_without_custody_approval: bool,
-}
-
-impl GateInput {
-    /// True when a declared mode relies on shared, durable correctness state.
-    pub fn requires_shared_state(&self) -> bool {
-        self.federation_enabled
-            || self.oid4vci_preauth_enabled
-            || self.holder_proof_required
-            || self.wallet_facing
-            || self.multi_instance
-    }
-}
-
-/// A finding row in the catalog: an id and its severity under each profile that
-/// binds it. A profile with no entry leaves the gate unbound.
-struct Gate {
-    id: &'static str,
-    hosted_lab: Option<GateSeverity>,
-    production: Option<GateSeverity>,
-    evidence_grade: Option<GateSeverity>,
-    /// Predicate over the gate input; true means the gate condition is met.
-    condition: fn(&GateInput) -> bool,
-}
-
-impl Gate {
-    fn severity_for(&self, profile: DeploymentProfile) -> Option<GateSeverity> {
-        match profile {
-            DeploymentProfile::Local => None,
-            DeploymentProfile::HostedLab => self.hosted_lab,
-            DeploymentProfile::Production => self.production,
-            DeploymentProfile::EvidenceGrade => self.evidence_grade,
-        }
-    }
-}
-
-// Finding ids. Stable once shipped; consumers treat unknown ids as opaque.
-pub const FINDING_STATE_IN_MEMORY_HIGH_RISK: &str = "notary.state.in_memory_high_risk";
-pub const FINDING_AUDIT_SINK_MISSING: &str = "notary.audit.sink_missing";
-pub const FINDING_AUDIT_RETENTION_LOCAL_ONLY: &str = "notary.audit.retention_local_only";
-pub const FINDING_AUDIT_SHIPPING_UNVERIFIED: &str = "notary.audit.shipping_unverified";
-pub const FINDING_AUDIT_SHIPPING_STALE: &str = "notary.audit.shipping_stale";
-pub const FINDING_ADMIN_SHARED_EXPOSURE: &str = "notary.admin.shared_exposure";
-pub const FINDING_OPENAPI_PUBLIC: &str = "notary.openapi.public";
-pub const FINDING_CONFIG_UNSIGNED: &str = "notary.config.unsigned";
-pub const FINDING_ASSISTED_ACCESS_TRANSACTION_TOKEN_ANCHOR_MISSING: &str =
-    "notary.assisted_access.transaction_token_anchor_missing";
-pub const FINDING_ASSISTED_ACCESS_SENDER_CONSTRAINT_MISSING: &str =
-    "notary.assisted_access.sender_constraint_missing";
-pub const FINDING_SIGNER_CUSTODY_UNAPPROVED: &str = "notary.signer_custody.unapproved";
-
-// Diagnostic finding ids emitted by the framework itself.
-pub const FINDING_PROFILE_UNDECLARED: &str = "deployment.profile_undeclared";
-pub const FINDING_WAIVER_EXPIRED: &str = "deployment.waiver_expired";
-
-/// The severity `gate_id` binds under `profile`, or `None` if the gate is
-/// unbound at that profile (including an undeclared profile) or `gate_id` is
-/// unknown. Lets callers outside the gate-evaluation path (e.g. doctor
-/// diagnostics) check whether a gate already covers a finding before also
-/// reporting it explicitly.
-pub fn gate_severity_for_profile(
-    gate_id: &str,
-    profile: Option<DeploymentProfile>,
-) -> Option<GateSeverity> {
-    let profile = profile?;
-    gate_catalog()
-        .iter()
-        .find(|gate| gate.id == gate_id)
-        .and_then(|gate| gate.severity_for(profile))
-}
-
-fn gate_catalog() -> &'static [Gate] {
-    use GateSeverity::{FindingError, FindingWarn, ReadinessFail, StartupFail};
-    &[
-        // notary.state.in_memory_high_risk: process-local correctness state
-        // while a mode requiring shared state is declared. (#206)
-        Gate {
-            id: FINDING_STATE_IN_MEMORY_HIGH_RISK,
-            hosted_lab: Some(FindingError),
-            production: Some(ReadinessFail),
-            evidence_grade: Some(StartupFail),
-            condition: |input| input.state_in_memory && input.requires_shared_state(),
-        },
-        // notary.audit.sink_missing: no durable, retained audit sink. (#207)
-        Gate {
-            id: FINDING_AUDIT_SINK_MISSING,
-            hosted_lab: Some(FindingError),
-            production: Some(StartupFail),
-            evidence_grade: Some(StartupFail),
-            condition: |input| !input.audit_sink_class_durable,
-        },
-        // notary.audit.retention_local_only: a local file sink caps retention
-        // and an attacker with host access can destroy audit evidence; the
-        // audit hash chain also cannot detect leading or trailing truncation
-        // of a local-only log, so off-host shipping (plus its attestation) is
-        // the completeness evidence that clears this gate. Under production
-        // this is only a warn, so the warning is the operator's single signal.
-        // stdout and syslog are exempt: their retention is owned by the
-        // orchestrator log pipeline or the syslog daemon's own forwarding
-        // surface.
-        Gate {
-            id: FINDING_AUDIT_RETENTION_LOCAL_ONLY,
-            hosted_lab: None,
-            production: Some(FindingWarn),
-            evidence_grade: Some(StartupFail),
-            condition: |input| input.audit_retention_local_only,
-        },
-        // notary.audit.shipping_unverified: a shipping target is configured but
-        // no ack cursor is configured. This warns under production and refuses
-        // evidence-grade startup because the static observation capability is
-        // absent. Runtime loss or lag is handled by shipping_stale below.
-        Gate {
-            id: FINDING_AUDIT_SHIPPING_UNVERIFIED,
-            hosted_lab: None,
-            production: Some(FindingWarn),
-            evidence_grade: Some(StartupFail),
-            condition: |input| {
-                input.audit_shipping_target_configured && !input.audit_ack_cursor_configured
-            },
-        },
-        // notary.audit.shipping_stale: an ack cursor is configured but its
-        // observed health is not ok. Fail closed: stale, missing, unsafe,
-        // malformed, and chain-mismatched cursors all count. Escalates to readiness_fail under
-        // evidence_grade so the instance refuses to report ready.
-        Gate {
-            id: FINDING_AUDIT_SHIPPING_STALE,
-            hosted_lab: None,
-            production: Some(FindingError),
-            evidence_grade: Some(ReadinessFail),
-            condition: |input| input.audit_ack_cursor_configured && !input.audit_ack_health_ok,
-        },
-        // Risky-but-legal defaults, surfaced as profile-bound findings. (#208)
-        Gate {
-            id: FINDING_ADMIN_SHARED_EXPOSURE,
-            hosted_lab: Some(FindingError),
-            production: Some(ReadinessFail),
-            evidence_grade: Some(StartupFail),
-            condition: |input| input.admin_shared_exposure,
-        },
-        Gate {
-            id: FINDING_OPENAPI_PUBLIC,
-            hosted_lab: Some(FindingWarn),
-            production: Some(FindingError),
-            evidence_grade: Some(FindingError),
-            condition: |input| input.openapi_public,
-        },
-        Gate {
-            id: FINDING_CONFIG_UNSIGNED,
-            hosted_lab: Some(FindingWarn),
-            production: Some(FindingError),
-            evidence_grade: Some(StartupFail),
-            condition: |input| input.config_unsigned,
-        },
-        Gate {
-            id: FINDING_ASSISTED_ACCESS_TRANSACTION_TOKEN_ANCHOR_MISSING,
-            hosted_lab: Some(FindingError),
-            production: Some(ReadinessFail),
-            evidence_grade: Some(StartupFail),
-            condition: |input| {
-                input.subject_access_enabled && !input.transaction_token_anchor_configured
-            },
-        },
-        Gate {
-            id: FINDING_ASSISTED_ACCESS_SENDER_CONSTRAINT_MISSING,
-            hosted_lab: Some(FindingWarn),
-            production: Some(FindingError),
-            evidence_grade: Some(ReadinessFail),
-            condition: |input| {
-                input.transaction_token_anchor_configured
-                    && !input.transaction_token_sender_constrained
-            },
-        },
-        // notary.signer_custody.unapproved: provider kind cannot prove custody
-        // because PKCS#11 can be hardware- or software-backed. Production and
-        // evidence-grade deployments therefore require explicit custody
-        // approval for each configured signing role.
-        Gate {
-            id: FINDING_SIGNER_CUSTODY_UNAPPROVED,
-            hosted_lab: None,
-            production: Some(ReadinessFail),
-            evidence_grade: Some(StartupFail),
-            condition: |input| input.signer_without_custody_approval,
-        },
-    ]
-}
-
-/// A finding produced by gate evaluation, ready to render into posture.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct EvaluatedFinding {
-    pub id: String,
-    pub severity: GateSeverity,
-    pub status: DeploymentFindingStatus,
-    pub waiver: Option<EvaluatedWaiver>,
-}
-
-/// An active waiver echoed into posture so Trust Operations can review it.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct EvaluatedWaiver {
-    pub finding: String,
-    pub reference: String,
-    pub summary: Option<String>,
-    pub expires: String,
-}
-
-/// The full result of evaluating gates for a declared profile.
-#[derive(Debug, Clone, Default, PartialEq, Eq)]
-pub struct GateEvaluation {
-    /// Finding ids whose effect is `startup_fail` (never waived). A non-empty
-    /// list means the process must refuse to start.
-    pub startup_failures: Vec<String>,
-    /// Finding ids whose effect is `readiness_fail`. The process runs but
-    /// readiness reports not-ready.
-    pub readiness_failures: Vec<String>,
-    /// Findings to render into posture, both active and waived.
-    pub findings: Vec<EvaluatedFinding>,
-    /// Active waivers, including ones whose gate is not currently triggered.
-    pub active_waivers: Vec<EvaluatedWaiver>,
-}
-
-/// Evaluate the gate catalog for a configuration snapshot.
-///
-/// `today` is the date used to decide whether a waiver has expired, passed in
-/// so callers and tests can be deterministic. An undeclared profile (`None`)
-/// emits `deployment.profile_undeclared` as a startup failure.
-pub fn evaluate_gates(
-    profile: Option<DeploymentProfile>,
-    input: &GateInput,
-    waivers: &[DeploymentWaiverConfig],
-    today: &str,
-) -> GateEvaluation {
-    let Some(profile) = profile else {
-        return GateEvaluation {
-            startup_failures: vec![FINDING_PROFILE_UNDECLARED.to_string()],
-            readiness_failures: Vec::new(),
-            findings: vec![EvaluatedFinding {
-                id: FINDING_PROFILE_UNDECLARED.to_string(),
-                severity: GateSeverity::StartupFail,
-                status: DeploymentFindingStatus::Active,
-                waiver: None,
-            }],
-            active_waivers: Vec::new(),
-        };
-    };
-
-    let mut evaluation = GateEvaluation::default();
-    let mut waived_findings: Vec<&DeploymentWaiverConfig> = Vec::new();
-
-    // An expired waiver stops suppressing its finding and additionally emits a
-    // diagnostic error finding so Trust Operations sees the lapse.
-    for waiver in waivers {
-        if waiver_is_expired(&waiver.expires, today) {
-            evaluation.findings.push(EvaluatedFinding {
-                id: FINDING_WAIVER_EXPIRED.to_string(),
-                severity: GateSeverity::FindingError,
-                status: DeploymentFindingStatus::Active,
-                waiver: Some(EvaluatedWaiver {
-                    finding: waiver.finding.clone(),
-                    reference: waiver.reference.clone(),
-                    summary: waiver.summary.clone(),
-                    expires: waiver.expires.clone(),
-                }),
-            });
-        } else {
-            let Some(severity) = gate_catalog()
-                .iter()
-                .find(|gate| gate.id == waiver.finding)
-                .and_then(|gate| gate.severity_for(profile))
-            else {
-                continue;
-            };
-            if !severity.is_waivable() {
-                continue;
-            }
-            waived_findings.push(waiver);
-            evaluation.active_waivers.push(EvaluatedWaiver {
-                finding: waiver.finding.clone(),
-                reference: waiver.reference.clone(),
-                summary: waiver.summary.clone(),
-                expires: waiver.expires.clone(),
-            });
-        }
-    }
-
-    for gate in gate_catalog() {
-        let Some(severity) = gate.severity_for(profile) else {
-            continue;
-        };
-        if !(gate.condition)(input) {
-            continue;
-        }
-
-        // A waiver only suppresses waivable severities. startup_fail is never
-        // waivable, so even an active waiver leaves it as a hard failure.
-        let active_waiver = if severity.is_waivable() {
-            waived_findings
-                .iter()
-                .find(|waiver| waiver.finding == gate.id)
-                .copied()
-        } else {
-            None
-        };
-
-        if let Some(waiver) = active_waiver {
-            evaluation.findings.push(EvaluatedFinding {
-                id: gate.id.to_string(),
-                severity,
-                status: DeploymentFindingStatus::Waived,
-                waiver: Some(EvaluatedWaiver {
-                    finding: waiver.finding.clone(),
-                    reference: waiver.reference.clone(),
-                    summary: waiver.summary.clone(),
-                    expires: waiver.expires.clone(),
-                }),
-            });
-            continue;
-        }
-
-        match severity {
-            GateSeverity::StartupFail => evaluation.startup_failures.push(gate.id.to_string()),
-            GateSeverity::ReadinessFail => evaluation.readiness_failures.push(gate.id.to_string()),
-            GateSeverity::FindingError | GateSeverity::FindingWarn => {}
-        }
-        evaluation.findings.push(EvaluatedFinding {
-            id: gate.id.to_string(),
-            severity,
-            status: DeploymentFindingStatus::Active,
-            waiver: None,
-        });
-    }
-
-    evaluation
-}
-
-/// Parse a strict `YYYY-MM-DD` date into a comparable tuple.
-///
-/// Lexicographic string comparison of `YYYY-MM-DD` dates is equivalent to
-/// chronological order, so callers compare the raw strings; this function only
-/// validates the shape and ranges.
-fn parse_iso_date(value: &str) -> Option<(u16, u8, u8)> {
-    let bytes = value.as_bytes();
-    if bytes.len() != 10 || bytes[4] != b'-' || bytes[7] != b'-' {
-        return None;
-    }
-    let year: u16 = value.get(0..4)?.parse().ok()?;
-    let month: u8 = value.get(5..7)?.parse().ok()?;
-    let day: u8 = value.get(8..10)?.parse().ok()?;
-    if !(1..=12).contains(&month) || !(1..=31).contains(&day) {
-        return None;
-    }
-    Some((year, month, day))
-}
-
-/// A waiver is expired once its expiry date is strictly before today.
-fn waiver_is_expired(expires: &str, today: &str) -> bool {
-    match (parse_iso_date(expires), parse_iso_date(today)) {
-        (Some(_), Some(_)) => expires < today,
-        // An unparseable expiry was rejected at config load; treat it as
-        // expired here so a bad value never silently suppresses a finding.
-        _ => true,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn waiver(finding: &str, expires: &str) -> DeploymentWaiverConfig {
-        DeploymentWaiverConfig {
-            finding: finding.to_string(),
-            reference: "OPS-TEST-DEPLOYMENT".to_string(),
-            summary: Some("Synthetic test waiver summary".to_string()),
-            expires: expires.to_string(),
-        }
-    }
-
-    fn high_risk_in_memory_input() -> GateInput {
-        GateInput {
-            state_in_memory: true,
-            federation_enabled: true,
-            audit_sink_class_durable: true,
-            ..GateInput::default()
-        }
-    }
-
-    #[test]
-    fn undeclared_profile_is_startup_failure() {
-        let input = high_risk_in_memory_input();
-        let evaluation = evaluate_gates(None, &input, &[], "2026-06-13");
-        assert_eq!(
-            evaluation.startup_failures,
-            vec![FINDING_PROFILE_UNDECLARED.to_string()]
-        );
-        assert!(evaluation.readiness_failures.is_empty());
-        assert_eq!(evaluation.findings.len(), 1);
-        assert_eq!(evaluation.findings[0].id, FINDING_PROFILE_UNDECLARED);
-        assert_eq!(evaluation.findings[0].severity, GateSeverity::StartupFail);
-    }
-
-    #[test]
-    fn local_profile_binds_no_gates() {
-        let input = high_risk_in_memory_input();
-        let evaluation = evaluate_gates(Some(DeploymentProfile::Local), &input, &[], "2026-06-13");
-        assert!(evaluation.startup_failures.is_empty());
-        assert!(evaluation.readiness_failures.is_empty());
-        assert!(evaluation.findings.is_empty());
-    }
-
-    #[test]
-    fn evidence_grade_in_memory_high_risk_is_startup_fail() {
-        let input = high_risk_in_memory_input();
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::EvidenceGrade),
-            &input,
-            &[],
-            "2026-06-13",
-        );
-        assert!(evaluation
-            .startup_failures
-            .contains(&FINDING_STATE_IN_MEMORY_HIGH_RISK.to_string()));
-    }
-
-    #[test]
-    fn production_in_memory_high_risk_is_readiness_fail() {
-        let input = high_risk_in_memory_input();
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::Production),
-            &input,
-            &[],
-            "2026-06-13",
-        );
-        assert!(evaluation
-            .readiness_failures
-            .contains(&FINDING_STATE_IN_MEMORY_HIGH_RISK.to_string()));
-        assert!(evaluation.startup_failures.is_empty());
-    }
-
-    #[test]
-    fn hosted_lab_high_risk_is_waivable_finding_error() {
-        let input = high_risk_in_memory_input();
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::HostedLab),
-            &input,
-            &[],
-            "2026-06-13",
-        );
-        let finding = evaluation
-            .findings
-            .iter()
-            .find(|f| f.id == FINDING_STATE_IN_MEMORY_HIGH_RISK)
-            .expect("high-risk finding present");
-        assert_eq!(finding.severity, GateSeverity::FindingError);
-        assert_eq!(finding.status, DeploymentFindingStatus::Active);
-    }
-
-    #[test]
-    fn waiver_suppresses_waivable_finding_and_reports_waived() {
-        let input = high_risk_in_memory_input();
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::HostedLab),
-            &input,
-            &[waiver(FINDING_STATE_IN_MEMORY_HIGH_RISK, "2099-01-01")],
-            "2026-06-13",
-        );
-        let finding = evaluation
-            .findings
-            .iter()
-            .find(|f| f.id == FINDING_STATE_IN_MEMORY_HIGH_RISK)
-            .expect("waived finding present");
-        assert_eq!(finding.status, DeploymentFindingStatus::Waived);
-        assert!(finding.waiver.is_some());
-        assert_eq!(evaluation.active_waivers.len(), 1);
-    }
-
-    #[test]
-    fn expired_waiver_re_triggers_finding_and_emits_waiver_expired() {
-        let input = high_risk_in_memory_input();
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::Production),
-            &input,
-            &[waiver(FINDING_STATE_IN_MEMORY_HIGH_RISK, "2020-01-01")],
-            "2026-06-13",
-        );
-        // The gate re-triggers at full severity.
-        assert!(evaluation
-            .readiness_failures
-            .contains(&FINDING_STATE_IN_MEMORY_HIGH_RISK.to_string()));
-        // The expiry diagnostic is emitted.
-        assert!(evaluation
-            .findings
-            .iter()
-            .any(|f| f.id == FINDING_WAIVER_EXPIRED && f.severity == GateSeverity::FindingError));
-        // The expired waiver is not active.
-        assert!(evaluation.active_waivers.is_empty());
-    }
-
-    #[test]
-    fn startup_fail_gate_is_not_waivable_even_with_active_waiver() {
-        let input = high_risk_in_memory_input();
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::EvidenceGrade),
-            &input,
-            &[waiver(FINDING_STATE_IN_MEMORY_HIGH_RISK, "2099-01-01")],
-            "2026-06-13",
-        );
-        assert!(evaluation
-            .startup_failures
-            .contains(&FINDING_STATE_IN_MEMORY_HIGH_RISK.to_string()));
-    }
-
-    #[test]
-    fn readiness_fail_gate_is_not_waivable_even_with_active_waiver() {
-        let input = high_risk_in_memory_input();
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::Production),
-            &input,
-            &[waiver(FINDING_STATE_IN_MEMORY_HIGH_RISK, "2099-01-01")],
-            "2026-06-13",
-        );
-        assert!(evaluation
-            .readiness_failures
-            .contains(&FINDING_STATE_IN_MEMORY_HIGH_RISK.to_string()));
-        let finding = evaluation
-            .findings
-            .iter()
-            .find(|finding| finding.id == FINDING_STATE_IN_MEMORY_HIGH_RISK)
-            .expect("high-risk replay finding exists");
-        assert_eq!(finding.status, DeploymentFindingStatus::Active);
-        assert!(evaluation.active_waivers.is_empty());
-    }
-
-    #[test]
-    fn validate_rejects_waiver_for_hard_startup_gate() {
-        let config = DeploymentConfig {
-            profile: Some(DeploymentProfile::EvidenceGrade),
-            multi_instance: false,
-            waivers: vec![waiver(FINDING_AUDIT_SINK_MISSING, "2099-01-01")],
-            evidence: DeploymentEvidenceConfig::default(),
-        };
-        let error = config.validate().expect_err("startup_fail waiver rejected");
-        assert!(matches!(
-            error,
-            DeploymentConfigError::HardGateNotWaivable { .. }
-        ));
-    }
-
-    #[test]
-    fn validate_rejects_waiver_for_hard_readiness_gate() {
-        let config = DeploymentConfig {
-            profile: Some(DeploymentProfile::Production),
-            multi_instance: false,
-            waivers: vec![waiver(FINDING_STATE_IN_MEMORY_HIGH_RISK, "2099-01-01")],
-            evidence: DeploymentEvidenceConfig::default(),
-        };
-        let error = config
-            .validate()
-            .expect_err("readiness_fail waiver rejected");
-        assert!(matches!(
-            error,
-            DeploymentConfigError::HardGateNotWaivable { .. }
-        ));
-    }
-
-    #[test]
-    fn validate_rejects_unknown_waived_finding() {
-        let config = DeploymentConfig {
-            profile: Some(DeploymentProfile::Production),
-            multi_instance: false,
-            waivers: vec![waiver("notary.made.up", "2099-01-01")],
-            evidence: DeploymentEvidenceConfig::default(),
-        };
-        let error = config.validate().expect_err("unknown finding rejected");
-        assert!(matches!(
-            error,
-            DeploymentConfigError::UnknownWaivedFinding { .. }
-        ));
-    }
-
-    #[test]
-    fn validate_accepts_absent_summary_and_ordinary_metadata() {
-        let mut waiver_config = waiver(FINDING_OPENAPI_PUBLIC, "2099-01-01");
-        waiver_config.reference = "OPS-2026:INC_42".to_string();
-        waiver_config.summary = None;
-        let config = DeploymentConfig {
-            profile: Some(DeploymentProfile::HostedLab),
-            multi_instance: false,
-            waivers: vec![waiver_config],
-            evidence: DeploymentEvidenceConfig::default(),
-        };
-        config
-            .validate()
-            .expect("ordinary reference with absent summary is valid");
-
-        let mut waiver_config = waiver(FINDING_OPENAPI_PUBLIC, "2099-01-01");
-        waiver_config.summary =
-            Some("Public API catalog approved in the operations ticket".to_string());
-        let config = DeploymentConfig {
-            profile: Some(DeploymentProfile::HostedLab),
-            multi_instance: false,
-            waivers: vec![waiver_config],
-            evidence: DeploymentEvidenceConfig::default(),
-        };
-        config.validate().expect("ordinary short summary is valid");
-    }
-
-    #[test]
-    fn validate_rejects_invalid_waiver_metadata_with_field_and_limit() {
-        let mut cases = Vec::new();
-        for reference in ["", " OPS-42", "OPS/42"] {
-            let mut waiver_config = waiver(FINDING_OPENAPI_PUBLIC, "2099-01-01");
-            waiver_config.reference = reference.to_string();
-            cases.push((waiver_config, "reference", "128"));
-        }
-        let mut waiver_config = waiver(FINDING_OPENAPI_PUBLIC, "2099-01-01");
-        waiver_config.reference = "x".repeat(129);
-        cases.push((waiver_config, "reference", "128"));
-
-        for summary in [
-            "",
-            " summary",
-            "summary\ncontinued",
-            "Bearer credential-value",
-            "Basic credential-value",
-            "rotated leaked Bearer abcdef",
-            "-----BEGIN OPENSSH PRIVATE KEY-----",
-            concat!("-----BEGIN PGP PRIVATE KEY ", "BLOCK-----"),
-        ] {
-            let mut waiver_config = waiver(FINDING_OPENAPI_PUBLIC, "2099-01-01");
-            waiver_config.summary = Some(summary.to_string());
-            cases.push((waiver_config, "summary", "256"));
-        }
-        let mut waiver_config = waiver(FINDING_OPENAPI_PUBLIC, "2099-01-01");
-        waiver_config.summary = Some("x".repeat(257));
-        cases.push((waiver_config, "summary", "256"));
-
-        for (waiver, field, limit) in cases {
-            let config = DeploymentConfig {
-                profile: Some(DeploymentProfile::HostedLab),
-                multi_instance: false,
-                waivers: vec![waiver],
-                evidence: DeploymentEvidenceConfig::default(),
-            };
-            let error = config.validate().expect_err("invalid metadata rejected");
-            let rendered = error.to_string();
-            assert!(rendered.contains(&format!("deployment.waivers[0].{field}")));
-            assert!(rendered.contains(limit), "limit missing from: {rendered}");
-        }
-    }
-
-    #[test]
-    fn validate_rejects_missing_or_malformed_expiry() {
-        let config = DeploymentConfig {
-            profile: Some(DeploymentProfile::Production),
-            multi_instance: false,
-            waivers: vec![waiver(FINDING_OPENAPI_PUBLIC, "not-a-date")],
-            evidence: DeploymentEvidenceConfig::default(),
-        };
-        let error = config.validate().expect_err("malformed expiry rejected");
-        assert!(matches!(
-            error,
-            DeploymentConfigError::InvalidWaiverExpiry { .. }
-        ));
-    }
-
-    #[test]
-    fn audit_sink_missing_binds_startup_fail_under_production() {
-        let input = GateInput {
-            audit_sink_class_durable: false,
-            ..GateInput::default()
-        };
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::Production),
-            &input,
-            &[],
-            "2026-06-13",
-        );
-        assert!(evaluation
-            .startup_failures
-            .contains(&FINDING_AUDIT_SINK_MISSING.to_string()));
-    }
-
-    #[test]
-    fn audit_sink_durable_clears_the_gate() {
-        let input = GateInput {
-            audit_sink_class_durable: true,
-            ..GateInput::default()
-        };
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::Production),
-            &input,
-            &[],
-            "2026-06-13",
-        );
-        assert!(evaluation.startup_failures.is_empty());
-        assert!(evaluation.findings.is_empty());
-    }
-
-    #[test]
-    fn audit_retention_local_only_binds_finding_warn_under_production() {
-        let input = GateInput {
-            audit_sink_class_durable: true,
-            audit_retention_local_only: true,
-            ..GateInput::default()
-        };
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::Production),
-            &input,
-            &[],
-            "2026-06-13",
-        );
-        let finding = evaluation
-            .findings
-            .iter()
-            .find(|f| f.id == FINDING_AUDIT_RETENTION_LOCAL_ONLY)
-            .expect("retention finding present under production");
-        assert_eq!(finding.severity, GateSeverity::FindingWarn);
-        assert_eq!(finding.status, DeploymentFindingStatus::Active);
-        assert!(evaluation.startup_failures.is_empty());
-        assert!(evaluation.readiness_failures.is_empty());
-    }
-
-    #[test]
-    fn audit_retention_local_only_binds_startup_fail_under_evidence_grade() {
-        let input = GateInput {
-            audit_sink_class_durable: true,
-            audit_retention_local_only: true,
-            ..GateInput::default()
-        };
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::EvidenceGrade),
-            &input,
-            &[],
-            "2026-06-13",
-        );
-        let finding = evaluation
-            .findings
-            .iter()
-            .find(|f| f.id == FINDING_AUDIT_RETENTION_LOCAL_ONLY)
-            .expect("retention finding present under evidence_grade");
-        assert_eq!(finding.severity, GateSeverity::StartupFail);
-        assert_eq!(
-            evaluation.startup_failures,
-            vec![FINDING_AUDIT_RETENTION_LOCAL_ONLY.to_string()]
-        );
-        assert!(evaluation.readiness_failures.is_empty());
-    }
-
-    #[test]
-    fn audit_retention_local_only_is_unbound_under_local_and_hosted_lab() {
-        let input = GateInput {
-            audit_sink_class_durable: true,
-            audit_retention_local_only: true,
-            ..GateInput::default()
-        };
-        for profile in [DeploymentProfile::Local, DeploymentProfile::HostedLab] {
-            let evaluation = evaluate_gates(Some(profile), &input, &[], "2026-06-13");
-            assert!(
-                !evaluation
-                    .findings
-                    .iter()
-                    .any(|f| f.id == FINDING_AUDIT_RETENTION_LOCAL_ONLY),
-                "retention finding must be unbound under profile '{}'",
-                profile.as_str()
-            );
-        }
-    }
-
-    #[test]
-    fn audit_retention_local_only_absent_when_condition_not_met() {
-        let input = GateInput {
-            audit_sink_class_durable: true,
-            audit_retention_local_only: false,
-            ..GateInput::default()
-        };
-        for profile in [
-            DeploymentProfile::Production,
-            DeploymentProfile::EvidenceGrade,
-        ] {
-            let evaluation = evaluate_gates(Some(profile), &input, &[], "2026-06-13");
-            assert!(
-                !evaluation
-                    .findings
-                    .iter()
-                    .any(|f| f.id == FINDING_AUDIT_RETENTION_LOCAL_ONLY),
-                "retention finding must be absent under profile '{}' when unattested sink is not local-only",
-                profile.as_str()
-            );
-        }
-    }
-
-    #[test]
-    fn audit_shipping_unverified_warns_under_production() {
-        let input = GateInput {
-            audit_sink_class_durable: true,
-            audit_shipping_target_configured: true,
-            audit_ack_cursor_configured: false,
-            ..GateInput::default()
-        };
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::Production),
-            &input,
-            &[],
-            "2026-06-13",
-        );
-        let finding = evaluation
-            .findings
-            .iter()
-            .find(|f| f.id == FINDING_AUDIT_SHIPPING_UNVERIFIED)
-            .expect("shipping_unverified finding present under production");
-        assert_eq!(finding.severity, GateSeverity::FindingWarn);
-        assert_eq!(finding.status, DeploymentFindingStatus::Active);
-        assert!(evaluation.startup_failures.is_empty());
-        assert!(evaluation.readiness_failures.is_empty());
-    }
-
-    #[test]
-    fn audit_shipping_unverified_refuses_startup_under_evidence_grade() {
-        let input = GateInput {
-            audit_sink_class_durable: true,
-            audit_shipping_target_configured: true,
-            audit_ack_cursor_configured: false,
-            ..GateInput::default()
-        };
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::EvidenceGrade),
-            &input,
-            &[],
-            "2026-06-13",
-        );
-        let finding = evaluation
-            .findings
-            .iter()
-            .find(|f| f.id == FINDING_AUDIT_SHIPPING_UNVERIFIED)
-            .expect("shipping_unverified finding present under evidence_grade");
-        assert_eq!(finding.severity, GateSeverity::StartupFail);
-        assert_eq!(finding.status, DeploymentFindingStatus::Active);
-        assert_eq!(
-            evaluation.startup_failures,
-            vec![FINDING_AUDIT_SHIPPING_UNVERIFIED.to_string()]
-        );
-        assert!(evaluation.readiness_failures.is_empty());
-    }
-
-    #[test]
-    fn audit_shipping_unverified_is_unbound_under_local_and_hosted_lab() {
-        let input = GateInput {
-            audit_sink_class_durable: true,
-            audit_shipping_target_configured: true,
-            ..GateInput::default()
-        };
-        for profile in [DeploymentProfile::Local, DeploymentProfile::HostedLab] {
-            let evaluation = evaluate_gates(Some(profile), &input, &[], "2026-06-13");
-            assert!(
-                !evaluation
-                    .findings
-                    .iter()
-                    .any(|f| f.id == FINDING_AUDIT_SHIPPING_UNVERIFIED),
-                "shipping_unverified finding must be unbound under profile '{}'",
-                profile.as_str()
-            );
-        }
-    }
-
-    #[test]
-    fn audit_shipping_unverified_absent_when_cursor_configured() {
-        let input = GateInput {
-            audit_sink_class_durable: true,
-            audit_shipping_target_configured: true,
-            audit_ack_cursor_configured: true,
-            audit_ack_health_ok: true,
-            ..GateInput::default()
-        };
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::Production),
-            &input,
-            &[],
-            "2026-06-13",
-        );
-        assert!(
-            !evaluation
-                .findings
-                .iter()
-                .any(|f| f.id == FINDING_AUDIT_SHIPPING_UNVERIFIED),
-            "a configured ack cursor clears shipping_unverified"
-        );
-    }
-
-    #[test]
-    fn audit_shipping_unverified_absent_without_declared_external() {
-        let input = GateInput {
-            audit_sink_class_durable: true,
-            audit_shipping_target_configured: false,
-            audit_ack_cursor_configured: false,
-            ..GateInput::default()
-        };
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::Production),
-            &input,
-            &[],
-            "2026-06-13",
-        );
-        assert!(
-            !evaluation
-                .findings
-                .iter()
-                .any(|f| f.id == FINDING_AUDIT_SHIPPING_UNVERIFIED),
-            "shipping_unverified only binds when the target is declared_external"
-        );
-    }
-
-    #[test]
-    fn audit_shipping_stale_binds_finding_error_under_production() {
-        let input = GateInput {
-            audit_sink_class_durable: true,
-            audit_ack_cursor_configured: true,
-            audit_ack_health_ok: false,
-            ..GateInput::default()
-        };
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::Production),
-            &input,
-            &[],
-            "2026-06-13",
-        );
-        let finding = evaluation
-            .findings
-            .iter()
-            .find(|f| f.id == FINDING_AUDIT_SHIPPING_STALE)
-            .expect("shipping_stale finding present under production");
-        assert_eq!(finding.severity, GateSeverity::FindingError);
-        assert_eq!(finding.status, DeploymentFindingStatus::Active);
-        assert!(evaluation.readiness_failures.is_empty());
-    }
-
-    #[test]
-    fn audit_shipping_stale_binds_readiness_fail_under_evidence_grade() {
-        let input = GateInput {
-            audit_sink_class_durable: true,
-            audit_ack_cursor_configured: true,
-            audit_ack_health_ok: false,
-            ..GateInput::default()
-        };
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::EvidenceGrade),
-            &input,
-            &[],
-            "2026-06-13",
-        );
-        let finding = evaluation
-            .findings
-            .iter()
-            .find(|f| f.id == FINDING_AUDIT_SHIPPING_STALE)
-            .expect("shipping_stale finding present under evidence_grade");
-        assert_eq!(finding.severity, GateSeverity::ReadinessFail);
-        assert_eq!(
-            evaluation.readiness_failures,
-            vec![FINDING_AUDIT_SHIPPING_STALE.to_string()]
-        );
-        assert!(evaluation.startup_failures.is_empty());
-    }
-
-    #[test]
-    fn audit_shipping_stale_cleared_when_health_ok() {
-        let input = GateInput {
-            audit_sink_class_durable: true,
-            audit_ack_cursor_configured: true,
-            audit_ack_health_ok: true,
-            ..GateInput::default()
-        };
-        for profile in [
-            DeploymentProfile::Production,
-            DeploymentProfile::EvidenceGrade,
-        ] {
-            let evaluation = evaluate_gates(Some(profile), &input, &[], "2026-06-13");
-            assert!(
-                !evaluation
-                    .findings
-                    .iter()
-                    .any(|f| f.id == FINDING_AUDIT_SHIPPING_STALE),
-                "a fresh cursor clears shipping_stale under profile '{}'",
-                profile.as_str()
-            );
-        }
-    }
-
-    #[test]
-    fn audit_shipping_stale_is_unbound_under_local_and_hosted_lab() {
-        let input = GateInput {
-            audit_sink_class_durable: true,
-            audit_ack_cursor_configured: true,
-            audit_ack_health_ok: false,
-            ..GateInput::default()
-        };
-        for profile in [DeploymentProfile::Local, DeploymentProfile::HostedLab] {
-            let evaluation = evaluate_gates(Some(profile), &input, &[], "2026-06-13");
-            assert!(
-                !evaluation
-                    .findings
-                    .iter()
-                    .any(|f| f.id == FINDING_AUDIT_SHIPPING_STALE),
-                "shipping_stale finding must be unbound under profile '{}'",
-                profile.as_str()
-            );
-        }
-    }
-
-    #[test]
-    fn validate_rejects_waiver_for_shipping_stale_under_evidence_grade() {
-        // shipping_stale is readiness_fail under evidence_grade, so it is a hard
-        // gate that cannot be waived. A waiver naming it must be rejected at load.
-        let config = DeploymentConfig {
-            profile: Some(DeploymentProfile::EvidenceGrade),
-            multi_instance: false,
-            waivers: vec![waiver(FINDING_AUDIT_SHIPPING_STALE, "2099-01-01")],
-            evidence: DeploymentEvidenceConfig::default(),
-        };
-        let error = config
-            .validate()
-            .expect_err("readiness_fail shipping_stale waiver rejected");
-        assert!(matches!(
-            error,
-            DeploymentConfigError::HardGateNotWaivable { .. }
-        ));
-    }
-
-    #[test]
-    fn validate_rejects_waiver_for_shipping_unverified_under_evidence_grade() {
-        let config = DeploymentConfig {
-            profile: Some(DeploymentProfile::EvidenceGrade),
-            multi_instance: false,
-            waivers: vec![waiver(FINDING_AUDIT_SHIPPING_UNVERIFIED, "2099-01-01")],
-            evidence: DeploymentEvidenceConfig::default(),
-        };
-        let error = config
-            .validate()
-            .expect_err("readiness_fail shipping_unverified waiver rejected");
-        assert!(matches!(
-            error,
-            DeploymentConfigError::HardGateNotWaivable { .. }
-        ));
-    }
-
-    #[test]
-    fn validate_allows_waiver_for_shipping_stale_under_production() {
-        // shipping_stale is finding_error (waivable) under production, so a
-        // waiver naming it is accepted at load.
-        let config = DeploymentConfig {
-            profile: Some(DeploymentProfile::Production),
-            multi_instance: false,
-            waivers: vec![waiver(FINDING_AUDIT_SHIPPING_STALE, "2099-01-01")],
-            evidence: DeploymentEvidenceConfig::default(),
-        };
-        config
-            .validate()
-            .expect("finding_error shipping_stale waiver accepted under production");
-    }
-
-    #[test]
-    fn audit_retention_local_only_waiver_suppresses_production_finding() {
-        let input = GateInput {
-            audit_sink_class_durable: true,
-            audit_retention_local_only: true,
-            ..GateInput::default()
-        };
-        let evaluation = evaluate_gates(
-            Some(DeploymentProfile::Production),
-            &input,
-            &[waiver(FINDING_AUDIT_RETENTION_LOCAL_ONLY, "2099-01-01")],
-            "2026-06-13",
-        );
-        let finding = evaluation
-            .findings
-            .iter()
-            .find(|f| f.id == FINDING_AUDIT_RETENTION_LOCAL_ONLY)
-            .expect("waived retention finding present");
-        assert_eq!(finding.status, DeploymentFindingStatus::Waived);
-        assert!(finding.waiver.is_some());
-    }
-
-    #[test]
-    fn deployment_evidence_rejects_unknown_field() {
-        let result: Result<DeploymentConfig, _> = serde_json::from_str(
-            r#"{ "evidence": { "audit_offhost_shipping": true, "made_up": true } }"#,
-        );
-        assert!(result.is_err());
-    }
-
-    // Gate-binding tests for the #208 risky-but-legal findings.
-    //
-    // Each case pairs a triggering GateInput with the expected severity per
-    // profile, and a non-triggering GateInput that must produce no finding.
-    // All three bound profiles (hosted_lab, production, evidence_grade) are
-    // checked; local is skipped because it binds no gates.
-
-    struct GateCase {
-        id: &'static str,
-        triggering: GateInput,
-        non_triggering: GateInput,
-        hosted_lab: GateSeverity,
-        production: GateSeverity,
-        evidence_grade: GateSeverity,
-    }
-
-    fn gate_cases() -> Vec<GateCase> {
-        vec![
-            GateCase {
-                id: FINDING_ADMIN_SHARED_EXPOSURE,
-                triggering: GateInput {
-                    admin_shared_exposure: true,
-                    ..GateInput::default()
-                },
-                non_triggering: GateInput {
-                    admin_shared_exposure: false,
-                    ..GateInput::default()
-                },
-                hosted_lab: GateSeverity::FindingError,
-                production: GateSeverity::ReadinessFail,
-                evidence_grade: GateSeverity::StartupFail,
-            },
-            GateCase {
-                id: FINDING_OPENAPI_PUBLIC,
-                triggering: GateInput {
-                    openapi_public: true,
-                    ..GateInput::default()
-                },
-                non_triggering: GateInput {
-                    openapi_public: false,
-                    ..GateInput::default()
-                },
-                hosted_lab: GateSeverity::FindingWarn,
-                production: GateSeverity::FindingError,
-                evidence_grade: GateSeverity::FindingError,
-            },
-            GateCase {
-                id: FINDING_CONFIG_UNSIGNED,
-                triggering: GateInput {
-                    config_unsigned: true,
-                    ..GateInput::default()
-                },
-                non_triggering: GateInput {
-                    config_unsigned: false,
-                    ..GateInput::default()
-                },
-                hosted_lab: GateSeverity::FindingWarn,
-                production: GateSeverity::FindingError,
-                evidence_grade: GateSeverity::StartupFail,
-            },
-            GateCase {
-                id: FINDING_ASSISTED_ACCESS_TRANSACTION_TOKEN_ANCHOR_MISSING,
-                triggering: GateInput {
-                    subject_access_enabled: true,
-                    transaction_token_anchor_configured: false,
-                    ..GateInput::default()
-                },
-                non_triggering: GateInput {
-                    subject_access_enabled: true,
-                    transaction_token_anchor_configured: true,
-                    ..GateInput::default()
-                },
-                hosted_lab: GateSeverity::FindingError,
-                production: GateSeverity::ReadinessFail,
-                evidence_grade: GateSeverity::StartupFail,
-            },
-            GateCase {
-                id: FINDING_ASSISTED_ACCESS_SENDER_CONSTRAINT_MISSING,
-                triggering: GateInput {
-                    transaction_token_anchor_configured: true,
-                    transaction_token_sender_constrained: false,
-                    ..GateInput::default()
-                },
-                non_triggering: GateInput {
-                    transaction_token_anchor_configured: true,
-                    transaction_token_sender_constrained: true,
-                    ..GateInput::default()
-                },
-                hosted_lab: GateSeverity::FindingWarn,
-                production: GateSeverity::FindingError,
-                evidence_grade: GateSeverity::ReadinessFail,
-            },
-        ]
-    }
-
-    #[test]
-    fn risky_default_findings_bind_correct_severity_per_profile() {
-        for case in gate_cases() {
-            for (profile, expected_severity) in [
-                (DeploymentProfile::HostedLab, case.hosted_lab),
-                (DeploymentProfile::Production, case.production),
-                (DeploymentProfile::EvidenceGrade, case.evidence_grade),
-            ] {
-                let evaluation = evaluate_gates(Some(profile), &case.triggering, &[], "2026-06-13");
-
-                // For startup_fail findings the finding also lands in
-                // startup_failures; for readiness_fail it lands in
-                // readiness_failures. Both paths still push into findings.
-                let found = evaluation
-                    .findings
-                    .iter()
-                    .find(|f| f.id == case.id)
-                    .unwrap_or_else(|| {
-                        panic!(
-                            "expected finding '{}' under profile '{}' (triggering input)",
-                            case.id,
-                            profile.as_str()
-                        )
-                    });
-                assert_eq!(
-                    found.severity,
-                    expected_severity,
-                    "finding '{}' under profile '{}': expected severity {:?}, got {:?}",
-                    case.id,
-                    profile.as_str(),
-                    expected_severity,
-                    found.severity
-                );
-
-                // startup_fail and readiness_fail findings must also appear
-                // in their respective hard-gate lists.
-                match expected_severity {
-                    GateSeverity::StartupFail => {
-                        assert!(
-                            evaluation.startup_failures.contains(&case.id.to_string()),
-                            "finding '{}' under profile '{}' must be in startup_failures",
-                            case.id,
-                            profile.as_str()
-                        );
-                    }
-                    GateSeverity::ReadinessFail => {
-                        assert!(
-                            evaluation.readiness_failures.contains(&case.id.to_string()),
-                            "finding '{}' under profile '{}' must be in readiness_failures",
-                            case.id,
-                            profile.as_str()
-                        );
-                    }
-                    GateSeverity::FindingError | GateSeverity::FindingWarn => {}
-                }
-            }
-        }
-    }
-
-    #[test]
-    fn risky_default_findings_absent_when_condition_not_met() {
-        for case in gate_cases() {
-            for profile in [
-                DeploymentProfile::HostedLab,
-                DeploymentProfile::Production,
-                DeploymentProfile::EvidenceGrade,
-            ] {
-                let evaluation =
-                    evaluate_gates(Some(profile), &case.non_triggering, &[], "2026-06-13");
-
-                // The non-triggering input must not produce the finding.
-                assert!(
-                    !evaluation.findings.iter().any(|f| f.id == case.id),
-                    "finding '{}' must be absent under profile '{}' with non-triggering input",
-                    case.id,
-                    profile.as_str()
-                );
-                assert!(
-                    !evaluation.startup_failures.contains(&case.id.to_string()),
-                    "finding '{}' must not be in startup_failures under profile '{}' (non-triggering)",
-                    case.id,
-                    profile.as_str()
-                );
-                assert!(
-                    !evaluation.readiness_failures.contains(&case.id.to_string()),
-                    "finding '{}' must not be in readiness_failures under profile '{}' (non-triggering)",
-                    case.id,
-                    profile.as_str()
-                );
-            }
-        }
-    }
-
-    #[test]
-    fn signer_custody_gate_rejects_unapproved_production_custody() {
-        let triggering = GateInput {
-            signer_without_custody_approval: true,
-            ..GateInput::default()
-        };
-        let non_triggering = GateInput {
-            signer_without_custody_approval: false,
-            ..GateInput::default()
-        };
-        let cases = [
-            (DeploymentProfile::Local, None),
-            (DeploymentProfile::HostedLab, None),
-            (
-                DeploymentProfile::Production,
-                Some(GateSeverity::ReadinessFail),
-            ),
-            (
-                DeploymentProfile::EvidenceGrade,
-                Some(GateSeverity::StartupFail),
-            ),
-        ];
-        for (profile, expected_severity) in cases {
-            let evaluation = evaluate_gates(Some(profile), &triggering, &[], "2026-06-13");
-            let found = evaluation
-                .findings
-                .iter()
-                .find(|finding| finding.id == FINDING_SIGNER_CUSTODY_UNAPPROVED);
-            match expected_severity {
-                Some(severity) => {
-                    let finding = found.unwrap_or_else(|| {
-                        panic!(
-                            "expected finding '{}' under profile '{}'",
-                            FINDING_SIGNER_CUSTODY_UNAPPROVED,
-                            profile.as_str()
-                        )
-                    });
-                    assert_eq!(finding.severity, severity);
-                    match severity {
-                        GateSeverity::StartupFail => assert!(evaluation
-                            .startup_failures
-                            .contains(&FINDING_SIGNER_CUSTODY_UNAPPROVED.to_string())),
-                        GateSeverity::ReadinessFail => assert!(evaluation
-                            .readiness_failures
-                            .contains(&FINDING_SIGNER_CUSTODY_UNAPPROVED.to_string())),
-                        GateSeverity::FindingError | GateSeverity::FindingWarn => {}
-                    }
-                }
-                None => assert!(
-                    found.is_none(),
-                    "finding '{}' must be unbound under profile '{}'",
-                    FINDING_SIGNER_CUSTODY_UNAPPROVED,
-                    profile.as_str()
-                ),
-            }
-
-            let clear_evaluation =
-                evaluate_gates(Some(profile), &non_triggering, &[], "2026-06-13");
-            assert!(
-                !clear_evaluation
-                    .findings
-                    .iter()
-                    .any(|finding| finding.id == FINDING_SIGNER_CUSTODY_UNAPPROVED),
-                "finding '{}' must be absent under profile '{}' with non-triggering input",
-                FINDING_SIGNER_CUSTODY_UNAPPROVED,
-                profile.as_str()
-            );
-        }
-    }
-
-    #[test]
-    fn invalid_profile_string_fails_deserialization() {
-        let result: Result<DeploymentConfig, _> = serde_json::from_str(r#"{ "profile": "prod" }"#);
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn iso_date_parser_accepts_valid_and_rejects_invalid() {
-        assert!(parse_iso_date("2026-06-13").is_some());
-        assert!(parse_iso_date("2026-13-01").is_none());
-        assert!(parse_iso_date("2026-06-32").is_none());
-        assert!(parse_iso_date("2026/06/13").is_none());
-        assert!(parse_iso_date("26-06-13").is_none());
-    }
-}
diff --git a/crates/registry-notary-core/src/error.rs b/crates/registry-notary-core/src/error.rs
deleted file mode 100644
index a327d5d31..000000000
--- a/crates/registry-notary-core/src/error.rs
+++ /dev/null
@@ -1,188 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Registry Notary stable error taxonomy.
-
-use crate::model::SubjectAccessDenialCode;
-
-use thiserror::Error;
-
-#[derive(Debug, Error)]
-#[non_exhaustive]
-pub enum EvidenceError {
-    #[error("evidence server is disabled")]
-    ServerDisabled,
-    #[error("claim was not found")]
-    ClaimNotFound,
-    #[error("claim version was not found")]
-    ClaimVersionNotFound,
-    #[error("claim operation is unsupported")]
-    OperationUnsupported,
-    #[error("evidence request is invalid")]
-    InvalidRequest,
-    #[error("registry-backed batch consultation request is invalid")]
-    ConsultationInvalidRequest,
-    #[error("requested disclosure is not allowed")]
-    DisclosureNotAllowed,
-    #[error("purpose is not allowed")]
-    PurposeNotAllowed,
-    #[error("policy decision denied the request: {code}")]
-    PolicyDenied {
-        code: &'static str,
-        policy_id: Option<String>,
-        policy_hash: Option<String>,
-        evaluated_rule_ids: Vec<String>,
-    },
-    #[error("evidence request profile is unsupported")]
-    ProfileUnsupported,
-    #[error("evidence is not available")]
-    EvidenceNotAvailable,
-    #[error("batch request is too large")]
-    BatchTooLarge,
-    #[error("evaluation was not found")]
-    EvaluationNotFound,
-    #[error("evaluation binding mismatch")]
-    EvaluationBindingMismatch,
-    #[error("format is unsupported")]
-    FormatUnsupported,
-    #[error("credential issuer is not configured")]
-    CredentialIssuerNotConfigured,
-    #[error("holder proof is required")]
-    HolderProofRequired,
-    #[error("holder proof has already been used")]
-    HolderProofReplay,
-    #[error("credential issuance failed")]
-    CredentialIssuanceFailed,
-    #[error("claim rule evaluation failed")]
-    RuleEvaluationFailed,
-    #[error("idempotency key was reused with a different request")]
-    IdempotencyConflict,
-    #[error("purpose is required")]
-    PurposeRequired,
-    #[error("credential is missing")]
-    MissingCredential,
-    #[error("multiple authentication credentials were provided")]
-    MultipleCredentials,
-    #[error("required scope is missing")]
-    ScopeDenied { required: String },
-    #[error("subject-access request is denied")]
-    SubjectAccessDenied { reason: SubjectAccessDenialCode },
-    #[error("subject-access request is rate limited")]
-    SubjectAccessRateLimited,
-    #[error("subject-access token is invalid")]
-    SubjectAccessInvalidToken,
-    #[error("subject-access assurance policy denied the request")]
-    SubjectAccessAssuranceDenied,
-    #[error("machine evaluation quota was exceeded")]
-    MachineQuotaExceeded { retry_after_seconds: u64 },
-}
-
-impl EvidenceError {
-    #[must_use]
-    pub fn code(&self) -> &'static str {
-        match self {
-            Self::ServerDisabled => "evidence.server_disabled",
-            Self::ClaimNotFound => "claim.not_found",
-            Self::ClaimVersionNotFound => "claim.version_not_found",
-            Self::OperationUnsupported => "claim.operation_unsupported",
-            Self::InvalidRequest => "request.invalid",
-            Self::ConsultationInvalidRequest => "consultation.invalid_request",
-            Self::DisclosureNotAllowed => "claim.disclosure_not_allowed",
-            Self::PurposeNotAllowed => "purpose.not_allowed",
-            Self::PolicyDenied { code, .. } => code,
-            Self::ProfileUnsupported => "profile.unsupported",
-            Self::EvidenceNotAvailable => "evidence.not_available",
-            Self::BatchTooLarge => "batch.too_large",
-            Self::EvaluationNotFound => "evaluation.not_found",
-            Self::EvaluationBindingMismatch => "evaluation.binding_mismatch",
-            Self::FormatUnsupported => "claim.format_not_supported",
-            Self::CredentialIssuerNotConfigured => "credential.issuer_not_configured",
-            Self::HolderProofRequired => "credential.holder_proof_required",
-            Self::HolderProofReplay => "credential.holder_proof_replay",
-            Self::CredentialIssuanceFailed => "credential.issuance_failed",
-            Self::RuleEvaluationFailed => "claim.rule_evaluation_failed",
-            Self::IdempotencyConflict => "idempotency.conflict",
-            Self::PurposeRequired => "auth.purpose_required",
-            Self::MissingCredential => "auth.missing_credential",
-            Self::MultipleCredentials => "auth.multiple_credentials",
-            Self::ScopeDenied { .. } => "auth.scope_denied",
-            Self::SubjectAccessDenied { .. } => "subject_access.denied",
-            Self::SubjectAccessRateLimited => "subject_access.rate_limited",
-            Self::SubjectAccessInvalidToken | Self::SubjectAccessAssuranceDenied => {
-                "subject_access.denied"
-            }
-            Self::MachineQuotaExceeded { .. } => "evaluation.quota_exceeded",
-        }
-    }
-
-    #[must_use]
-    pub fn audit_code(&self) -> &'static str {
-        match self {
-            Self::SubjectAccessDenied { reason } => reason.as_str(),
-            Self::SubjectAccessInvalidToken => SubjectAccessDenialCode::InvalidToken.as_str(),
-            Self::SubjectAccessAssuranceDenied => SubjectAccessDenialCode::AssuranceDenied.as_str(),
-            Self::PolicyDenied { code, .. } => code,
-            _ => self.code(),
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn subject_access_denial_keeps_generic_public_code_and_specific_audit_code() {
-        let error = EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::SubjectMismatch,
-        };
-
-        assert_eq!(error.code(), "subject_access.denied");
-        assert_eq!(error.audit_code(), "subject_access.subject_mismatch");
-    }
-
-    #[test]
-    fn subject_access_specific_errors_have_stable_codes() {
-        assert_eq!(
-            EvidenceError::SubjectAccessRateLimited.code(),
-            "subject_access.rate_limited"
-        );
-        assert_eq!(
-            EvidenceError::SubjectAccessInvalidToken.code(),
-            "subject_access.denied"
-        );
-        assert_eq!(
-            EvidenceError::SubjectAccessInvalidToken.audit_code(),
-            "subject_access.invalid_token"
-        );
-        assert_eq!(
-            EvidenceError::SubjectAccessAssuranceDenied.code(),
-            "subject_access.denied"
-        );
-        assert_eq!(
-            EvidenceError::SubjectAccessAssuranceDenied.audit_code(),
-            "subject_access.assurance_denied"
-        );
-    }
-
-    #[test]
-    fn machine_quota_exceeded_has_stable_code() {
-        let error = EvidenceError::MachineQuotaExceeded {
-            retry_after_seconds: 42,
-        };
-
-        assert_eq!(error.code(), "evaluation.quota_exceeded");
-        assert_eq!(error.audit_code(), "evaluation.quota_exceeded");
-    }
-
-    #[test]
-    fn policy_denials_keep_stable_pdp_code() {
-        let error = EvidenceError::PolicyDenied {
-            code: "pdp.assurance_insufficient",
-            policy_id: None,
-            policy_hash: None,
-            evaluated_rule_ids: Vec::new(),
-        };
-
-        assert_eq!(error.code(), "pdp.assurance_insufficient");
-        assert_eq!(error.audit_code(), "pdp.assurance_insufficient");
-    }
-}
diff --git a/crates/registry-notary-core/src/lib.rs b/crates/registry-notary-core/src/lib.rs
deleted file mode 100644
index 3c796a9d0..000000000
--- a/crates/registry-notary-core/src/lib.rs
+++ /dev/null
@@ -1,14 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Shared Registry Notary domain model and credential primitives.
-
-pub mod config;
-pub mod deployment;
-pub mod error;
-pub mod model;
-pub mod sd_jwt;
-pub mod tokens;
-
-pub use config::*;
-pub use deployment::*;
-pub use error::EvidenceError;
-pub use model::*;
diff --git a/crates/registry-notary-core/src/model.rs b/crates/registry-notary-core/src/model.rs
deleted file mode 100644
index ce2af6467..000000000
--- a/crates/registry-notary-core/src/model.rs
+++ /dev/null
@@ -1,2818 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Registry Notary request, response, and view types.
-
-use std::borrow::Cow;
-use std::collections::{BTreeMap, BTreeSet};
-use std::fmt;
-use std::marker::PhantomData;
-
-use schemars::{JsonSchema, Schema, SchemaGenerator};
-use serde::de::{self, Visitor};
-use serde::{Deserialize, Deserializer, Serialize, Serializer};
-use serde_json::Value;
-
-pub const FORMAT_CLAIM_RESULT_JSON: &str = "application/vnd.registry-notary.claim-result+json";
-pub const FORMAT_CCCEV_JSONLD: &str = "application/ld+json; profile=\"cccev\"";
-pub const FORMAT_SD_JWT_VC: &str = "application/dc+sd-jwt";
-pub const SD_JWT_VC_JWT_TYP: &str = "dc+sd-jwt";
-pub const SD_JWT_VC_SIGNING_ALG: &str = "EdDSA";
-pub const SD_JWT_VC_ISSUER_KEY_TYPE: &str = "OKP/Ed25519";
-pub const SD_JWT_VC_HOLDER_BINDING_METHOD: &str = "did:jwk";
-pub const MAX_BOUNDED_CLAIM_ID_LEN: usize = 128;
-pub const MAX_CONFIG_METADATA_LEN: usize = 256;
-pub const MAX_CORRELATION_ID_LEN: usize = 128;
-pub const MAX_POLICY_ID_LEN: usize = 128;
-pub const MAX_RATE_LIMIT_BUCKET_LEN: usize = 128;
-pub const MAX_TOKEN_CLAIM_VALUE_LEN: usize = 512;
-pub const MAX_VERIFIED_CLAIM_NAME_LEN: usize = 256;
-pub const MAX_VERIFIED_CLAIM_VALUE_LEN: usize = 512;
-pub const MAX_REQUEST_VARIABLES_V1: usize = 16;
-pub const MAX_REQUEST_VARIABLE_NAME_BYTES_V1: usize = 96;
-
-pub type BoundedClaimId = Bounded<MAX_BOUNDED_CLAIM_ID_LEN>;
-pub type BoundedCorrelationId = Bounded<MAX_CORRELATION_ID_LEN>;
-pub type BoundedPolicyId = Bounded<MAX_POLICY_ID_LEN>;
-pub type ConfigMetadata = Bounded<MAX_CONFIG_METADATA_LEN>;
-pub type RateLimitBucket = Bounded<MAX_RATE_LIMIT_BUCKET_LEN>;
-pub type VerifiedClaimName = Bounded<MAX_VERIFIED_CLAIM_NAME_LEN>;
-pub type VerifiedClaimValue = Bounded<MAX_VERIFIED_CLAIM_VALUE_LEN>;
-
-/// Closed v1 request variables. The first contract admits only named RFC 3339
-/// full-date strings, with service configuration deciding which names exist.
-#[derive(Clone, Default, PartialEq, Eq, Serialize, utoipa::ToSchema)]
-#[serde(transparent)]
-pub struct RequestVariables(BTreeMap<String, String>);
-
-impl fmt::Debug for RequestVariables {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str("RequestVariables([REDACTED])")
-    }
-}
-
-impl RequestVariables {
-    pub fn try_new(values: BTreeMap<String, String>) -> Result<Self, &'static str> {
-        if values.len() > MAX_REQUEST_VARIABLES_V1
-            || values.iter().any(|(name, value)| {
-                !is_request_variable_name(name) || !is_rfc3339_full_date(value)
-            })
-        {
-            return Err("request variables must be bounded named RFC 3339 full-date strings");
-        }
-        Ok(Self(values))
-    }
-
-    #[must_use]
-    pub fn get(&self, name: &str) -> Option<&str> {
-        self.0.get(name).map(String::as_str)
-    }
-
-    pub fn iter(&self) -> impl ExactSizeIterator<Item = (&str, &str)> {
-        self.0
-            .iter()
-            .map(|(name, value)| (name.as_str(), value.as_str()))
-    }
-
-    #[must_use]
-    pub fn is_empty(&self) -> bool {
-        self.0.is_empty()
-    }
-}
-
-impl<'de> Deserialize<'de> for RequestVariables {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        let values = BTreeMap::<String, String>::deserialize(deserializer)?;
-        Self::try_new(values).map_err(de::Error::custom)
-    }
-}
-
-#[must_use]
-pub fn is_request_variable_name(value: &str) -> bool {
-    let mut bytes = value.bytes();
-    matches!(bytes.next(), Some(b'a'..=b'z'))
-        && value.len() <= MAX_REQUEST_VARIABLE_NAME_BYTES_V1
-        && bytes.all(|byte| matches!(byte, b'a'..=b'z' | b'0'..=b'9' | b'_'))
-}
-
-#[must_use]
-pub fn is_rfc3339_full_date(value: &str) -> bool {
-    let bytes = value.as_bytes();
-    if bytes.len() != 10
-        || bytes[4] != b'-'
-        || bytes[7] != b'-'
-        || bytes
-            .iter()
-            .enumerate()
-            .any(|(index, byte)| !matches!(index, 4 | 7) && !byte.is_ascii_digit())
-    {
-        return false;
-    }
-    let number = |range: std::ops::Range<usize>| value[range].parse::<u16>().ok();
-    let (Some(year), Some(month), Some(day)) = (number(0..4), number(5..7), number(8..10)) else {
-        return false;
-    };
-    let Ok(month) = time::Month::try_from(u8::try_from(month).unwrap_or(0)) else {
-        return false;
-    };
-    time::Date::from_calendar_date(i32::from(year), month, u8::try_from(day).unwrap_or(0)).is_ok()
-}
-
-/// The authentication trust profile that produced an [`EvidencePrincipal`].
-///
-/// These identifiers are deliberately closed and credential-independent so
-/// they can safely participate in caller binding without incorporating raw
-/// API keys, bearer tokens, or attacker-controlled token claims.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Deserialize, Serialize)]
-#[serde(rename_all = "snake_case")]
-pub enum EvidenceAuthProfileId {
-    StaticApiKey,
-    StaticBearer,
-    ExternalOidc,
-    NotaryAccessToken,
-    Federation,
-}
-
-impl EvidenceAuthProfileId {
-    #[must_use]
-    pub const fn as_str(self) -> &'static str {
-        match self {
-            Self::StaticApiKey => "static_api_key",
-            Self::StaticBearer => "static_bearer",
-            Self::ExternalOidc => "external_oidc",
-            Self::NotaryAccessToken => "notary_access_token",
-            Self::Federation => "federation",
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-#[serde(rename_all = "snake_case")]
-pub enum AccessMode {
-    Unknown,
-    #[default]
-    MachineClient,
-    SubjectBound,
-    DelegatedSubjectAccess,
-}
-
-impl AccessMode {
-    #[must_use]
-    pub const fn as_str(self) -> &'static str {
-        match self {
-            Self::Unknown => "unknown",
-            Self::MachineClient => "machine_client",
-            Self::SubjectBound => "subject_bound",
-            Self::DelegatedSubjectAccess => "delegated_subject_access",
-        }
-    }
-
-    #[must_use]
-    pub fn parse(value: &str) -> Option<Self> {
-        match value {
-            "unknown" => Some(Self::Unknown),
-            "machine_client" => Some(Self::MachineClient),
-            "subject_bound" => Some(Self::SubjectBound),
-            "delegated_subject_access" => Some(Self::DelegatedSubjectAccess),
-            _ => None,
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum SubjectAccessDenialCode {
-    Disabled,
-    OperationDenied,
-    ClaimDenied,
-    DisclosureDenied,
-    FormatDenied,
-    ProfileDenied,
-    SubjectClaimMissing,
-    SubjectMismatch,
-    RateLimited,
-    InvalidToken,
-    AssuranceDenied,
-    BatchDenied,
-    DelegatedRelationshipUnproven,
-    DelegatedRelationshipNotAllowed,
-    DelegatedClaimDenied,
-    DelegatedSubjectNotPermitted,
-    DelegatedProofDenied,
-}
-
-impl SubjectAccessDenialCode {
-    #[must_use]
-    pub const fn as_str(self) -> &'static str {
-        match self {
-            Self::Disabled => "subject_access.disabled",
-            Self::OperationDenied => "subject_access.operation_denied",
-            Self::ClaimDenied => "subject_access.claim_denied",
-            Self::DisclosureDenied => "subject_access.disclosure_denied",
-            Self::FormatDenied => "subject_access.format_denied",
-            Self::ProfileDenied => "subject_access.profile_denied",
-            Self::SubjectClaimMissing => "subject_access.subject_claim_missing",
-            Self::SubjectMismatch => "subject_access.subject_mismatch",
-            Self::RateLimited => "subject_access.rate_limited",
-            Self::InvalidToken => "subject_access.invalid_token",
-            Self::AssuranceDenied => "subject_access.assurance_denied",
-            Self::BatchDenied => "subject_access.batch_denied",
-            Self::DelegatedRelationshipUnproven => "delegated.relationship_unproven",
-            Self::DelegatedRelationshipNotAllowed => "delegated.relationship_not_allowed",
-            Self::DelegatedClaimDenied => "delegated.claim_denied",
-            Self::DelegatedSubjectNotPermitted => "delegated.subject_not_permitted",
-            Self::DelegatedProofDenied => "delegated.proof_denied",
-        }
-    }
-
-    #[must_use]
-    pub fn parse(value: &str) -> Option<Self> {
-        match value {
-            "subject_access.disabled" => Some(Self::Disabled),
-            "subject_access.operation_denied" => Some(Self::OperationDenied),
-            "subject_access.claim_denied" => Some(Self::ClaimDenied),
-            "subject_access.disclosure_denied" => Some(Self::DisclosureDenied),
-            "subject_access.format_denied" => Some(Self::FormatDenied),
-            "subject_access.profile_denied" => Some(Self::ProfileDenied),
-            "subject_access.subject_claim_missing" => Some(Self::SubjectClaimMissing),
-            "subject_access.subject_mismatch" => Some(Self::SubjectMismatch),
-            "subject_access.rate_limited" => Some(Self::RateLimited),
-            "subject_access.invalid_token" => Some(Self::InvalidToken),
-            "subject_access.assurance_denied" => Some(Self::AssuranceDenied),
-            "subject_access.batch_denied" => Some(Self::BatchDenied),
-            "delegated.relationship_unproven" => Some(Self::DelegatedRelationshipUnproven),
-            "delegated.relationship_not_allowed" => Some(Self::DelegatedRelationshipNotAllowed),
-            "delegated.claim_denied" => Some(Self::DelegatedClaimDenied),
-            "delegated.subject_not_permitted" => Some(Self::DelegatedSubjectNotPermitted),
-            "delegated.proof_denied" => Some(Self::DelegatedProofDenied),
-            _ => None,
-        }
-    }
-}
-
-impl Serialize for SubjectAccessDenialCode {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        serializer.serialize_str(self.as_str())
-    }
-}
-
-impl<'de> Deserialize<'de> for SubjectAccessDenialCode {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        let value = String::deserialize(deserializer)?;
-        Self::parse(&value).ok_or_else(|| de::Error::custom("unknown subject-access denial code"))
-    }
-}
-
-#[derive(Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
-pub struct Bounded<const N: usize>(String);
-
-impl<const N: usize> Bounded<N> {
-    pub fn new(value: impl Into<String>) -> Result<Self, BoundedStringError> {
-        let value = value.into();
-        if value.len() > N {
-            return Err(BoundedStringError {
-                max: N,
-                actual: value.len(),
-            });
-        }
-        Ok(Self(value))
-    }
-
-    #[must_use]
-    pub fn as_str(&self) -> &str {
-        &self.0
-    }
-
-    #[must_use]
-    pub fn into_inner(self) -> String {
-        self.0
-    }
-}
-
-impl<const N: usize> fmt::Debug for Bounded<N> {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_tuple("Bounded").field(&self.0).finish()
-    }
-}
-
-impl<const N: usize> TryFrom<String> for Bounded<N> {
-    type Error = BoundedStringError;
-
-    fn try_from(value: String) -> Result<Self, Self::Error> {
-        Self::new(value)
-    }
-}
-
-impl<const N: usize> TryFrom<&str> for Bounded<N> {
-    type Error = BoundedStringError;
-
-    fn try_from(value: &str) -> Result<Self, Self::Error> {
-        Self::new(value)
-    }
-}
-
-impl<const N: usize> Serialize for Bounded<N> {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        serializer.serialize_str(&self.0)
-    }
-}
-
-impl<'de, const N: usize> Deserialize<'de> for Bounded<N> {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        let value = String::deserialize(deserializer)?;
-        Self::new(value).map_err(de::Error::custom)
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct BoundedStringError {
-    pub max: usize,
-    pub actual: usize,
-}
-
-impl fmt::Display for BoundedStringError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(
-            f,
-            "bounded string length {} exceeds maximum {}",
-            self.actual, self.max
-        )
-    }
-}
-
-impl std::error::Error for BoundedStringError {}
-
-#[derive(Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
-pub struct Hashed<T> {
-    value: String,
-    _marker: PhantomData<T>,
-}
-
-impl<T> Hashed<T> {
-    #[must_use]
-    pub fn from_hash(value: impl Into<String>) -> Self {
-        Self {
-            value: value.into(),
-            _marker: PhantomData,
-        }
-    }
-
-    #[must_use]
-    pub fn as_str(&self) -> &str {
-        &self.value
-    }
-
-    #[must_use]
-    pub fn into_inner(self) -> String {
-        self.value
-    }
-}
-
-impl<T> fmt::Debug for Hashed<T> {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_tuple("Hashed").field(&self.value).finish()
-    }
-}
-
-impl<T> Serialize for Hashed<T> {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        serializer.serialize_str(&self.value)
-    }
-}
-
-impl<'de, T> Deserialize<'de> for Hashed<T> {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        struct HashedVisitor<T>(PhantomData<T>);
-
-        impl<T> Visitor<'_> for HashedVisitor<T> {
-            type Value = Hashed<T>;
-
-            fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-                formatter.write_str("a hashed identifier string")
-            }
-
-            fn visit_str<E>(self, value: &str) -> Result<Self::Value, E>
-            where
-                E: de::Error,
-            {
-                Ok(Hashed::from_hash(value))
-            }
-
-            fn visit_string<E>(self, value: String) -> Result<Self::Value, E>
-            where
-                E: de::Error,
-            {
-                Ok(Hashed::from_hash(value))
-            }
-        }
-
-        deserializer.deserialize_string(HashedVisitor(PhantomData))
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum PrincipalIdentifier {}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum SubjectBinding {}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum EvidenceEntityReference {}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum HolderIdentifier {}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum PreAuthorizedCodeIdentifier {}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum CredentialIdentifier {}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum ClaimSet {}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum PolicyIdentifier {}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum RequestIdentifier {}
-
-#[derive(Clone, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct BoundedVerifiedClaims {
-    pub issuer: VerifiedClaimValue,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub audiences: Vec<VerifiedClaimValue>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub client_id: Option<VerifiedClaimValue>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub token_type: Option<VerifiedClaimValue>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub credential_configuration_id: Option<VerifiedClaimValue>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub issuance_transaction_id: Option<VerifiedClaimValue>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub issuance_transaction_commitment: Option<VerifiedClaimValue>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub scopes: Vec<VerifiedClaimValue>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub subject: Option<VerifiedClaimValue>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub subject_binding_claim: Option<VerifiedClaimName>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub subject_binding_value: Option<VerifiedClaimValue>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub acr: Option<VerifiedClaimValue>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub auth_time: Option<i64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub exp: Option<i64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub iat: Option<i64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub nbf: Option<i64>,
-}
-
-impl fmt::Debug for BoundedVerifiedClaims {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("BoundedVerifiedClaims")
-            .field("issuer", &self.issuer)
-            .field("audiences", &self.audiences)
-            .field("client_id", &self.client_id)
-            .field("token_type", &self.token_type)
-            .field(
-                "credential_configuration_id",
-                &self.credential_configuration_id,
-            )
-            .field("issuance_transaction_id", &"<redacted>")
-            .field(
-                "issuance_transaction_commitment",
-                &self.issuance_transaction_commitment,
-            )
-            .field("scopes", &self.scopes)
-            .field("subject", &self.subject.as_ref().map(|_| "<redacted>"))
-            .field("subject_binding_claim", &self.subject_binding_claim)
-            .field(
-                "subject_binding_value",
-                &self.subject_binding_value.as_ref().map(|_| "<redacted>"),
-            )
-            .field("acr", &self.acr)
-            .field("auth_time", &self.auth_time)
-            .field("exp", &self.exp)
-            .field("iat", &self.iat)
-            .field("nbf", &self.nbf)
-            .finish()
-    }
-}
-
-impl BoundedVerifiedClaims {
-    #[must_use]
-    pub fn has_scope(&self, scope: &str) -> bool {
-        self.scopes
-            .iter()
-            .any(|candidate| candidate.as_str() == scope)
-    }
-
-    #[must_use]
-    pub fn claim_value(&self, claim_name: &str) -> Option<&str> {
-        match claim_name {
-            "iss" => Some(self.issuer.as_str()),
-            "sub" => self.subject.as_ref().map(Bounded::as_str),
-            "typ" | "token_type" => self.token_type.as_ref().map(Bounded::as_str),
-            "credential_configuration_id" => self
-                .credential_configuration_id
-                .as_ref()
-                .map(Bounded::as_str),
-            "issuance_transaction_id" => self.issuance_transaction_id.as_ref().map(Bounded::as_str),
-            "issuance_transaction_commitment" => self
-                .issuance_transaction_commitment
-                .as_ref()
-                .map(Bounded::as_str),
-            "client_id" | "azp" => self.client_id.as_ref().map(Bounded::as_str),
-            "acr" => self.acr.as_ref().map(Bounded::as_str),
-            other => self
-                .subject_binding_claim
-                .as_ref()
-                .filter(|configured| configured.as_str() == other)
-                .and(self.subject_binding_value.as_ref())
-                .map(Bounded::as_str),
-        }
-    }
-
-    #[must_use]
-    pub fn subject_binding_value(&self, claim_name: &str) -> Option<&str> {
-        self.subject_binding_claim
-            .as_ref()
-            .filter(|configured| configured.as_str() == claim_name)
-            .and(self.subject_binding_value.as_ref())
-            .map(Bounded::as_str)
-            .filter(|value| !value.trim().is_empty())
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(tag = "mode", rename_all = "snake_case")]
-pub enum EvaluationCapability {
-    Machine {
-        #[serde(default, skip_serializing_if = "BTreeSet::is_empty")]
-        scopes: BTreeSet<String>,
-    },
-    SubjectBound {
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        claim_id: Option<BoundedClaimId>,
-        #[serde(default, skip_serializing_if = "BTreeSet::is_empty")]
-        allowed_claim_ids: BTreeSet<BoundedClaimId>,
-        subject_binding_hash: Hashed<SubjectBinding>,
-    },
-    DelegatedSubjectAccess {
-        proof_claim_id: BoundedClaimId,
-        #[serde(default, skip_serializing_if = "BTreeSet::is_empty")]
-        allowed_claim_ids: BTreeSet<BoundedClaimId>,
-        requester_subject_binding_hash: Hashed<SubjectBinding>,
-        dependent_target_hash: Hashed<SubjectBinding>,
-        relationship_type: ConfigMetadata,
-    },
-}
-
-impl EvaluationCapability {
-    #[must_use]
-    pub fn access_mode(&self) -> AccessMode {
-        match self {
-            Self::Machine { .. } => AccessMode::MachineClient,
-            Self::SubjectBound { .. } => AccessMode::SubjectBound,
-            Self::DelegatedSubjectAccess { .. } => AccessMode::DelegatedSubjectAccess,
-        }
-    }
-
-    #[must_use]
-    pub fn allows_scope(&self, scope: &str) -> bool {
-        match self {
-            Self::Machine { scopes } => scopes.contains(scope),
-            Self::SubjectBound { .. } => false,
-            Self::DelegatedSubjectAccess { .. } => false,
-        }
-    }
-
-    #[must_use]
-    pub fn allows_subject_access_claim(&self, claim_id: &str) -> bool {
-        match self {
-            Self::Machine { .. } => false,
-            Self::SubjectBound {
-                claim_id: allowed,
-                allowed_claim_ids,
-                ..
-            } => {
-                allowed
-                    .as_ref()
-                    .is_some_and(|allowed| allowed.as_str() == claim_id)
-                    || allowed_claim_ids
-                        .iter()
-                        .any(|allowed| allowed.as_str() == claim_id)
-            }
-            Self::DelegatedSubjectAccess { .. } => false,
-        }
-    }
-
-    #[must_use]
-    pub fn allows_delegated_claim(&self, claim_id: &str) -> bool {
-        match self {
-            Self::DelegatedSubjectAccess {
-                proof_claim_id,
-                allowed_claim_ids,
-                ..
-            } => {
-                proof_claim_id.as_str() == claim_id
-                    || allowed_claim_ids
-                        .iter()
-                        .any(|allowed| allowed.as_str() == claim_id)
-            }
-            Self::Machine { .. } | Self::SubjectBound { .. } => false,
-        }
-    }
-
-    #[must_use]
-    pub fn required_delegated_proof_for_claim(&self, claim_id: &str) -> Option<&str> {
-        match self {
-            Self::DelegatedSubjectAccess {
-                proof_claim_id,
-                allowed_claim_ids,
-                ..
-            } if proof_claim_id.as_str() != claim_id
-                && allowed_claim_ids
-                    .iter()
-                    .any(|allowed| allowed.as_str() == claim_id) =>
-            {
-                Some(proof_claim_id.as_str())
-            }
-            _ => None,
-        }
-    }
-
-    #[must_use]
-    pub fn is_delegated_proof_claim(&self, claim_id: &str) -> bool {
-        match self {
-            Self::DelegatedSubjectAccess { proof_claim_id, .. } => {
-                proof_claim_id.as_str() == claim_id
-            }
-            Self::Machine { .. } | Self::SubjectBound { .. } => false,
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
-#[serde(rename_all = "snake_case")]
-pub enum DisclosureProfile {
-    Value,
-    Predicate,
-    Redacted,
-}
-
-impl DisclosureProfile {
-    #[must_use]
-    pub fn parse(value: &str) -> Option<Self> {
-        match value {
-            "value" => Some(Self::Value),
-            "predicate" => Some(Self::Predicate),
-            "redacted" => Some(Self::Redacted),
-            _ => None,
-        }
-    }
-
-    #[must_use]
-    pub const fn as_str(self) -> &'static str {
-        match self {
-            Self::Value => "value",
-            Self::Predicate => "predicate",
-            Self::Redacted => "redacted",
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
-#[serde(rename_all = "snake_case")]
-pub enum DisclosureDowngrade {
-    Deny,
-    Default,
-    Redacted,
-}
-
-impl DisclosureDowngrade {
-    #[must_use]
-    pub fn parse(value: &str) -> Option<Self> {
-        match value {
-            "deny" | "none" => Some(Self::Deny),
-            "default" => Some(Self::Default),
-            "redacted" => Some(Self::Redacted),
-            _ => None,
-        }
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, utoipa::ToSchema)]
-#[serde(deny_unknown_fields)]
-pub struct ClaimRef {
-    pub id: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub version: Option<String>,
-}
-
-impl ClaimRef {
-    #[must_use]
-    pub fn new(id: impl Into<String>) -> Self {
-        Self {
-            id: id.into(),
-            version: None,
-        }
-    }
-
-    #[must_use]
-    pub fn with_version(id: impl Into<String>, version: impl Into<String>) -> Self {
-        Self {
-            id: id.into(),
-            version: Some(version.into()),
-        }
-    }
-}
-
-impl From<String> for ClaimRef {
-    fn from(id: String) -> Self {
-        Self::new(id)
-    }
-}
-
-impl From<&str> for ClaimRef {
-    fn from(id: &str) -> Self {
-        Self::new(id)
-    }
-}
-
-impl std::ops::Deref for ClaimRef {
-    type Target = str;
-
-    fn deref(&self) -> &Self::Target {
-        self.id.as_str()
-    }
-}
-
-#[derive(Deserialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-struct ClaimRefObject {
-    id: String,
-    #[serde(default)]
-    version: Option<String>,
-}
-
-#[derive(Deserialize, JsonSchema)]
-#[serde(untagged)]
-enum WireClaimRef {
-    Id(String),
-    Object(ClaimRefObject),
-}
-
-impl<'de> Deserialize<'de> for ClaimRef {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: serde::Deserializer<'de>,
-    {
-        match WireClaimRef::deserialize(deserializer)? {
-            WireClaimRef::Id(id) => Ok(Self::new(id)),
-            WireClaimRef::Object(object) => Ok(Self {
-                id: object.id,
-                version: object.version,
-            }),
-        }
-    }
-}
-
-impl JsonSchema for ClaimRef {
-    fn schema_name() -> Cow<'static, str> {
-        "ClaimRef".into()
-    }
-
-    fn json_schema(generator: &mut SchemaGenerator) -> Schema {
-        generator.subschema_for::<WireClaimRef>()
-    }
-}
-
-/// Frozen minimal actor/delegation envelope for `on_behalf_of`.
-///
-/// Replaces the previous free-form `Option<Value>`. This is the beta-frozen
-/// shape per the 2026-06-11 evidence-contracts decision record (D4): a
-/// structured actor plus an opaque `delegation_ref`. Simple deployments send no
-/// envelope at all (the field stays optional). No OAuth token exchange, RAR, or
-/// CIBA machinery is required here; those arrive post-1.0 as additive profiles
-/// (notary#180) that map the actor onto OAuth `act`-claim semantics. The shape
-/// does not bake in a single-actor assumption: an actor chain is expressed by
-/// `delegation_ref` indirection, so the additive mapping stays open.
-#[derive(Debug, Clone, Deserialize, Serialize, utoipa::ToSchema)]
-#[serde(deny_unknown_fields)]
-pub struct EvidenceOnBehalfOf {
-    pub actor: EvidenceActor,
-    /// Opaque reference to an out-of-band delegation record. The envelope does
-    /// not interpret its contents; it is the indirection point through which a
-    /// later OAuth profile resolves an actor chain.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub delegation_ref: Option<String>,
-}
-
-/// A structured actor in the delegation envelope. The same vocabulary is reused
-/// for stored delegation-chain entries so wire requests and stored evaluations
-/// do not diverge.
-#[derive(Debug, Clone, Deserialize, Serialize, utoipa::ToSchema)]
-#[serde(deny_unknown_fields)]
-pub struct EvidenceActor {
-    #[serde(rename = "type")]
-    pub actor_type: String,
-    /// Keyed-hash identifier of the actor in `hmac-sha256:<hex>` format per the
-    /// D7 vocabulary. Never a raw principal value.
-    pub id_hash: String,
-    /// Optional assurance level of the actor (for example an `acr` value).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub assurance: Option<String>,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, utoipa::ToSchema)]
-#[serde(deny_unknown_fields)]
-pub struct EvaluateRequest {
-    #[serde(default)]
-    pub requester: Option<EvidenceEntity>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub target: Option<EvidenceEntity>,
-    #[serde(default)]
-    pub relationship: Option<EvidenceRelationship>,
-    #[serde(default)]
-    pub on_behalf_of: Option<EvidenceOnBehalfOf>,
-    #[serde(default, skip_serializing_if = "RequestVariables::is_empty")]
-    pub variables: RequestVariables,
-    pub claims: Vec<ClaimRef>,
-    #[serde(default)]
-    pub disclosure: Option<String>,
-    #[serde(default)]
-    pub format: Option<String>,
-    #[serde(default)]
-    pub purpose: Option<String>,
-}
-
-impl EvaluateRequest {
-    #[must_use]
-    pub fn target_subject(&self) -> Option<SubjectRequest> {
-        self.target
-            .as_ref()
-            .and_then(EvidenceEntity::to_subject_request)
-    }
-
-    #[must_use]
-    pub fn request_context(&self) -> Option<EvidenceRequestContext> {
-        self.target.as_ref().map(|target| EvidenceRequestContext {
-            requester: self.requester.clone(),
-            target: target.clone(),
-            relationship: self.relationship.clone(),
-            on_behalf_of: self.on_behalf_of.clone(),
-            variables: self.variables.clone(),
-        })
-    }
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-pub struct EvidenceRequestContext {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub requester: Option<EvidenceEntity>,
-    pub target: EvidenceEntity,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub relationship: Option<EvidenceRelationship>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub on_behalf_of: Option<EvidenceOnBehalfOf>,
-    #[serde(default, skip_serializing_if = "RequestVariables::is_empty")]
-    pub variables: RequestVariables,
-}
-
-impl EvidenceRequestContext {
-    #[must_use]
-    pub fn target_subject(&self) -> Option<SubjectRequest> {
-        self.target.to_subject_request()
-    }
-
-    #[must_use]
-    pub fn lookup_value(&self, path: &str) -> Option<Value> {
-        match path {
-            "target.id" => self
-                .target
-                .id
-                .as_ref()
-                .map(|value| Value::String(value.clone())),
-            "requester.id" => self
-                .requester
-                .as_ref()
-                .and_then(|requester| requester.id.as_ref())
-                .map(|value| Value::String(value.clone())),
-            _ if path.starts_with("target.attributes.") => {
-                let key = path.strip_prefix("target.attributes.")?;
-                self.target.attributes.get(key).cloned()
-            }
-            _ if path.starts_with("requester.attributes.") => {
-                let key = path.strip_prefix("requester.attributes.")?;
-                self.requester
-                    .as_ref()
-                    .and_then(|requester| requester.attributes.get(key))
-                    .cloned()
-            }
-            _ if path.starts_with("relationship.attributes.") => {
-                let key = path.strip_prefix("relationship.attributes.")?;
-                self.relationship
-                    .as_ref()
-                    .and_then(|relationship| relationship.attributes.get(key))
-                    .cloned()
-            }
-            _ if path.starts_with("target.identifiers.") => {
-                let scheme = path.strip_prefix("target.identifiers.")?;
-                self.target
-                    .identifier_value(scheme)
-                    .map(|value| Value::String(value.to_string()))
-            }
-            _ if path.starts_with("requester.identifiers.") => {
-                let scheme = path.strip_prefix("requester.identifiers.")?;
-                self.requester
-                    .as_ref()
-                    .and_then(|requester| requester.identifier_value(scheme))
-                    .map(|value| Value::String(value.to_string()))
-            }
-            _ if path.starts_with("variables.") => {
-                let name = path.strip_prefix("variables.")?;
-                self.variables
-                    .get(name)
-                    .map(|value| Value::String(value.to_string()))
-            }
-            _ => None,
-        }
-    }
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, utoipa::ToSchema)]
-#[serde(deny_unknown_fields)]
-pub struct EvidenceEntity {
-    #[serde(rename = "type")]
-    pub entity_type: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub id: Option<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub identifiers: Vec<EvidenceIdentifier>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub attributes: BTreeMap<String, Value>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub assurance: Option<EvidenceAssurance>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub profile: Option<String>,
-}
-
-impl EvidenceEntity {
-    #[must_use]
-    pub fn new(entity_type: impl Into<String>) -> Self {
-        Self {
-            entity_type: entity_type.into(),
-            id: None,
-            identifiers: Vec::new(),
-            attributes: BTreeMap::new(),
-            assurance: None,
-            profile: None,
-        }
-    }
-
-    #[must_use]
-    pub fn with_identifier(
-        entity_type: impl Into<String>,
-        scheme: impl Into<String>,
-        value: impl Into<String>,
-    ) -> Self {
-        Self {
-            entity_type: entity_type.into(),
-            id: None,
-            identifiers: vec![EvidenceIdentifier {
-                scheme: scheme.into(),
-                value: value.into(),
-                issuer: None,
-                country: None,
-            }],
-            attributes: BTreeMap::new(),
-            assurance: None,
-            profile: None,
-        }
-    }
-
-    #[must_use]
-    pub fn from_subject_request(entity_type: impl Into<String>, subject: SubjectRequest) -> Self {
-        match subject.id_type {
-            Some(id_type) => Self::with_identifier(entity_type, id_type, subject.id),
-            None => {
-                let mut entity = Self::new(entity_type);
-                entity.id = Some(subject.id);
-                entity
-            }
-        }
-    }
-
-    #[must_use]
-    pub fn to_subject_request(&self) -> Option<SubjectRequest> {
-        if let Some(identifier) = self.identifiers.first() {
-            return Some(SubjectRequest {
-                id: identifier.value.clone(),
-                id_type: Some(identifier.scheme.clone()),
-            });
-        }
-        self.id.as_ref().map(|id| SubjectRequest {
-            id: id.clone(),
-            id_type: None,
-        })
-    }
-
-    #[must_use]
-    pub fn identifier_value(&self, scheme: &str) -> Option<&str> {
-        self.identifiers
-            .iter()
-            .find(|identifier| identifier.scheme == scheme)
-            .map(|identifier| identifier.value.as_str())
-    }
-
-    #[must_use]
-    pub fn has_matching_input(&self) -> bool {
-        self.id.as_ref().is_some_and(|id| !id.trim().is_empty())
-            || self
-                .identifiers
-                .iter()
-                .any(|identifier| !identifier.value.trim().is_empty())
-            || !self.attributes.is_empty()
-    }
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, utoipa::ToSchema)]
-#[serde(deny_unknown_fields)]
-pub struct EvidenceIdentifier {
-    pub scheme: String,
-    pub value: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub issuer: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub country: Option<String>,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, utoipa::ToSchema)]
-#[serde(deny_unknown_fields)]
-pub struct EvidenceAssurance {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub method: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub level_scheme: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub level: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub verified_at: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub issuer: Option<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub evidence: Vec<Value>,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, utoipa::ToSchema)]
-#[serde(deny_unknown_fields)]
-pub struct EvidenceRelationship {
-    #[serde(rename = "type")]
-    pub relationship_type: String,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub attributes: BTreeMap<String, Value>,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, utoipa::ToSchema)]
-#[serde(deny_unknown_fields)]
-pub struct SubjectRequest {
-    pub id: String,
-    #[serde(default)]
-    pub id_type: Option<String>,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, utoipa::ToSchema)]
-#[serde(deny_unknown_fields)]
-pub struct BatchSubjectRequest {
-    pub id: String,
-    #[serde(default)]
-    pub id_type: Option<String>,
-    #[serde(default)]
-    pub purpose: Option<String>,
-}
-
-impl From<BatchSubjectRequest> for SubjectRequest {
-    fn from(subject: BatchSubjectRequest) -> Self {
-        Self {
-            id: subject.id,
-            id_type: subject.id_type,
-        }
-    }
-}
-
-impl From<SubjectRequest> for BatchSubjectRequest {
-    fn from(subject: SubjectRequest) -> Self {
-        Self {
-            id: subject.id,
-            id_type: subject.id_type,
-            purpose: None,
-        }
-    }
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, utoipa::ToSchema)]
-#[serde(deny_unknown_fields)]
-pub struct BatchEvaluateItemRequest {
-    pub target: EvidenceEntity,
-    #[serde(default)]
-    pub requester: Option<EvidenceEntity>,
-    #[serde(default)]
-    pub relationship: Option<EvidenceRelationship>,
-    #[serde(default)]
-    pub on_behalf_of: Option<EvidenceOnBehalfOf>,
-    #[serde(default)]
-    pub purpose: Option<String>,
-}
-
-impl BatchEvaluateItemRequest {
-    #[must_use]
-    pub fn target_subject(&self) -> Option<SubjectRequest> {
-        self.target.to_subject_request()
-    }
-
-    #[must_use]
-    pub fn request_context(&self) -> EvidenceRequestContext {
-        EvidenceRequestContext {
-            requester: self.requester.clone(),
-            target: self.target.clone(),
-            relationship: self.relationship.clone(),
-            on_behalf_of: self.on_behalf_of.clone(),
-            variables: RequestVariables::default(),
-        }
-    }
-}
-
-impl From<BatchSubjectRequest> for BatchEvaluateItemRequest {
-    fn from(subject: BatchSubjectRequest) -> Self {
-        let purpose = subject.purpose.clone();
-        Self {
-            target: EvidenceEntity::from_subject_request("Person", SubjectRequest::from(subject)),
-            requester: None,
-            relationship: None,
-            on_behalf_of: None,
-            purpose,
-        }
-    }
-}
-
-impl From<SubjectRequest> for BatchEvaluateItemRequest {
-    fn from(subject: SubjectRequest) -> Self {
-        Self {
-            target: EvidenceEntity::from_subject_request("Person", subject),
-            requester: None,
-            relationship: None,
-            on_behalf_of: None,
-            purpose: None,
-        }
-    }
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, utoipa::ToSchema)]
-#[serde(deny_unknown_fields)]
-pub struct BatchEvaluateRequest {
-    pub items: Vec<BatchEvaluateItemRequest>,
-    pub claims: Vec<ClaimRef>,
-    #[serde(default)]
-    pub disclosure: Option<String>,
-    #[serde(default)]
-    pub format: Option<String>,
-    #[serde(default)]
-    pub purpose: Option<String>,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct BatchEvaluateResponse {
-    pub batch_id: String,
-    pub status: BatchStatus,
-    pub claims: Vec<String>,
-    pub items: Vec<BatchItemResponse>,
-    pub summary: BatchSummary,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum BatchStatus {
-    Completed,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct BatchSummary {
-    pub succeeded: usize,
-    pub failed: usize,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct BatchItemResponse {
-    pub input_index: usize,
-    pub target_ref: TargetRefView,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub requester_ref: Option<EvidenceEntityRef>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub evaluation_id: Option<String>,
-    pub status: BatchItemStatus,
-    pub claim_results: Vec<BatchClaimResultView>,
-    pub errors: Vec<BatchItemError>,
-    /// Request-local consultation evidence for restricted audit assembly.
-    /// This is never serialized into the public response or durable state.
-    #[doc(hidden)]
-    #[serde(skip)]
-    pub runtime_audit: BatchItemRuntimeAudit,
-}
-
-/// Request-local, value-free consultation evidence for a batch member.
-#[doc(hidden)]
-#[derive(Clone, Default)]
-pub struct BatchItemRuntimeAudit {
-    pub relay_forwarded_count: u64,
-    pub relay_consultation_ids: Vec<String>,
-}
-
-impl std::fmt::Debug for BatchItemRuntimeAudit {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("BatchItemRuntimeAudit")
-            .field("relay_forwarded_count", &self.relay_forwarded_count)
-            .field("relay_consultation_ids", &"[REDACTED]")
-            .finish()
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum BatchItemStatus {
-    Succeeded,
-    Failed,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct BatchClaimResultView {
-    pub result_id: String,
-    pub claim_id: String,
-    pub claim_version: String,
-    pub value_type: String,
-    pub value: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub satisfied: Option<bool>,
-    pub disclosure: String,
-    pub provenance: ClaimProvenance,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct BatchItemError {
-    pub code: String,
-    pub title: String,
-    pub retryable: bool,
-    #[serde(default, skip)]
-    pub audit_code: Option<String>,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, utoipa::ToSchema)]
-#[serde(deny_unknown_fields)]
-pub struct RenderRequest {
-    pub evaluation_id: String,
-    pub format: String,
-    #[serde(default)]
-    pub disclosure: Option<String>,
-    #[serde(default)]
-    pub claims: Option<Vec<String>>,
-    #[serde(default)]
-    pub purpose: Option<String>,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, utoipa::ToSchema)]
-#[serde(deny_unknown_fields)]
-pub struct RenderEvaluationRequest {
-    pub format: String,
-    #[serde(default)]
-    pub disclosure: Option<String>,
-    #[serde(default)]
-    pub claims: Option<Vec<String>>,
-    #[serde(default)]
-    pub purpose: Option<String>,
-}
-
-impl RenderEvaluationRequest {
-    #[must_use]
-    pub fn with_evaluation_id(self, evaluation_id: String) -> RenderRequest {
-        RenderRequest {
-            evaluation_id,
-            format: self.format,
-            disclosure: self.disclosure,
-            claims: self.claims,
-            purpose: self.purpose,
-        }
-    }
-}
-
-impl From<RenderRequest> for RenderEvaluationRequest {
-    fn from(request: RenderRequest) -> Self {
-        Self {
-            format: request.format,
-            disclosure: request.disclosure,
-            claims: request.claims,
-            purpose: request.purpose,
-        }
-    }
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, utoipa::ToSchema)]
-#[serde(deny_unknown_fields)]
-pub struct CredentialIssueRequest {
-    pub evaluation_id: String,
-    #[serde(default)]
-    pub credential_profile: Option<String>,
-    #[serde(default)]
-    pub format: Option<String>,
-    #[serde(default)]
-    pub claims: Option<Vec<String>>,
-    #[serde(default)]
-    pub disclosure: Option<String>,
-    #[serde(default)]
-    pub purpose: Option<String>,
-    #[serde(default)]
-    pub holder: Option<HolderRequest>,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, utoipa::ToSchema)]
-#[serde(deny_unknown_fields)]
-pub struct HolderRequest {
-    #[serde(default)]
-    pub binding: Option<String>,
-    #[serde(default)]
-    pub id: Option<String>,
-    #[serde(default)]
-    pub proof: Option<String>,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct EvidenceFormat {
-    pub id: String,
-    pub kind: String,
-    pub status: String,
-}
-
-#[derive(Clone, Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct ClaimResultView {
-    pub evaluation_id: String,
-    pub claim_id: String,
-    pub claim_version: String,
-    pub subject_type: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub requester_ref: Option<EvidenceEntityRef>,
-    pub target_ref: TargetRefView,
-    pub value: Option<Value>,
-    pub satisfied: Option<bool>,
-    pub disclosure: String,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub redacted_fields: Vec<String>,
-    pub format: String,
-    pub issued_at: String,
-    pub expires_at: Option<String>,
-    pub provenance: ClaimProvenance,
-}
-
-impl std::fmt::Debug for ClaimResultView {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("ClaimResultView")
-            .field("evaluation_id", &"[REDACTED]")
-            .field("claim_id", &self.claim_id)
-            .field("claim_version", &self.claim_version)
-            .field("subject_type", &self.subject_type)
-            .field("requester_ref", &"[REDACTED]")
-            .field("target_ref", &"[REDACTED]")
-            .field("value", &"[REDACTED]")
-            .field("satisfied", &self.satisfied)
-            .field("disclosure", &self.disclosure)
-            .field("redacted_fields", &self.redacted_fields)
-            .field("format", &self.format)
-            .field("issued_at", &self.issued_at)
-            .field("expires_at", &self.expires_at)
-            .field("provenance", &self.provenance)
-            .finish()
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct TargetRefView {
-    #[serde(rename = "type", default, skip_serializing_if = "String::is_empty")]
-    pub entity_type: String,
-    pub handle: String,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub identifier_schemes: Vec<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub profile: Option<String>,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct EvidenceEntityRef {
-    #[serde(rename = "type")]
-    pub entity_type: String,
-    pub handle: String,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub identifier_schemes: Vec<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub profile: Option<String>,
-}
-
-/// `schema_version` value carried by every [`ClaimProvenance`]. V2 names the
-/// consumed boundary as Relay consultations and removes unreleased source
-/// runtime aliases.
-pub const CLAIM_PROVENANCE_SCHEMA_VERSION: &str = "registry-notary-claim-provenance/v2";
-
-/// The `type` value for a claim-evaluation provenance record.
-pub const PROVENANCE_GENERATED_BY_CLAIM_EVALUATION: &str = "claim_evaluation";
-
-/// Versioned claim provenance attached to every public claim result.
-///
-/// This contract lets a verifier answer which evaluation produced the result,
-/// under which policy, and across how many Relay consultations. The shape is
-/// documented as PROV-mappable but is not PROV-O.
-/// Requester-side identity (client, actor, subject) is deliberately absent;
-/// those live in restricted audit, never on the public wire.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct ClaimProvenance {
-    pub schema_version: String,
-    pub generated_by: ProvenanceGeneratedBy,
-    pub used: ProvenanceUsed,
-    /// Upstream provenance records this result was derived from. Reserved for
-    /// cross-evaluation linking; always empty in v2 but present in the shape so
-    /// adding entries later is additive.
-    pub derived_from: Vec<Value>,
-}
-
-impl ClaimProvenance {
-    /// Construct a provenance record at the current schema version with the
-    /// canonical `generated_by.type`.
-    #[must_use]
-    pub fn new(
-        service_id: String,
-        evaluation_id: String,
-        claim_id: String,
-        claim_version: String,
-        used: ProvenanceUsed,
-    ) -> Self {
-        Self {
-            schema_version: CLAIM_PROVENANCE_SCHEMA_VERSION.to_string(),
-            generated_by: ProvenanceGeneratedBy {
-                entry_type: PROVENANCE_GENERATED_BY_CLAIM_EVALUATION.to_string(),
-                service_id,
-                evaluation_id,
-                claim_id,
-                claim_version,
-                policy_id: None,
-                policy_version: None,
-                policy_hash: None,
-                pack_id: None,
-                pack_version: None,
-            },
-            used,
-            derived_from: Vec::new(),
-        }
-    }
-}
-
-/// The producing side of a claim provenance record.
-///
-/// `policy_id` here names the *evaluation* policy under which the result was
-/// produced.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct ProvenanceGeneratedBy {
-    #[serde(rename = "type")]
-    pub entry_type: String,
-    /// Identifier of the service that produced the result. Replaces the
-    /// dropped `computed_by` field; the CCCEV renderer maps its provider agent
-    /// from here.
-    pub service_id: String,
-    pub evaluation_id: String,
-    pub claim_id: String,
-    pub claim_version: String,
-    /// Evaluation policy identifier. Present for flows evaluated under a named
-    /// policy (e.g. subject-access); omitted for machine-client flows with no
-    /// evaluation policy.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub policy_id: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub policy_version: Option<String>,
-    /// `sha256:<hex>` digest of the evaluation policy. Public in v1: a hash,
-    /// revealing no policy content, that lets a verifier correlate the result
-    /// with a policy evidence-pack later.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub policy_hash: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub pack_id: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub pack_version: Option<String>,
-}
-
-/// The consumed side of a claim provenance record: how many Relay consultations
-/// contributed to the claim.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct ProvenanceUsed {
-    pub relay_consultation_count: usize,
-}
-
-#[derive(Clone, Serialize, Deserialize)]
-pub struct StoredEvaluation {
-    pub client_id: String,
-    pub purpose: String,
-    pub claim_ids: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub claim_refs: Vec<ClaimRef>,
-    pub disclosure: String,
-    pub format: String,
-    pub results: Vec<ClaimResultView>,
-    pub created_at: String,
-    pub expires_at: String,
-    pub request_hash: String,
-    /// Private issuance-only Relay provenance for the selected dependency closure.
-    ///
-    /// This is deliberately separate from public [`ClaimProvenance`]. It is
-    /// persisted only for credential-capable selections so a later credential
-    /// request can prove that every fact being signed came from the exact
-    /// compiler-pinned Relay consultation. Evaluation-only selections retain
-    /// no private Relay execution identifiers. Evaluations written before this
-    /// field existed remain readable, but are not credential-issuable and must
-    /// be evaluated again.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub issuance_provenance: Option<StoredIssuanceProvenance>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub subject_access: Option<StoredSubjectAccessMetadata>,
-}
-
-impl std::fmt::Debug for StoredEvaluation {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("StoredEvaluation")
-            .field("client_id", &"[REDACTED]")
-            .field("purpose", &self.purpose)
-            .field("claim_ids", &self.claim_ids)
-            .field("claim_refs", &self.claim_refs)
-            .field("disclosure", &self.disclosure)
-            .field("format", &self.format)
-            .field("result_count", &self.results.len())
-            .field("created_at", &self.created_at)
-            .field("expires_at", &self.expires_at)
-            .field("request_hash", &"[REDACTED]")
-            .field("issuance_provenance", &self.issuance_provenance)
-            .field("subject_access", &self.subject_access)
-            .finish()
-    }
-}
-
-impl StoredEvaluation {
-    #[must_use]
-    pub fn access_mode(&self) -> AccessMode {
-        self.subject_access
-            .as_ref()
-            .map(|metadata| metadata.access_mode)
-            .unwrap_or(AccessMode::MachineClient)
-    }
-
-    #[must_use]
-    pub fn selected_claim_refs(&self) -> Vec<ClaimRef> {
-        if self.claim_refs.is_empty() {
-            self.claim_ids
-                .iter()
-                .map(|claim_id| ClaimRef::from(claim_id.as_str()))
-                .collect()
-        } else {
-            self.claim_refs.clone()
-        }
-    }
-}
-
-/// Bounded private provenance retained for credential issuance.
-///
-/// The runtime admits at most the v1 claim-closure bound and the issuance
-/// verifier rejects an over-sized or incomplete set before any signer or
-/// credential-status side effect. Consultation identifiers remain restricted
-/// state and never appear in evaluation, render, or credential responses.
-#[derive(Clone, Serialize, Deserialize)]
-pub struct StoredIssuanceProvenance {
-    pub claims: Vec<StoredIssuanceClaimProvenance>,
-    /// Unique Relay executions referenced by the claim closure.
-    ///
-    /// Keeping executions separate permits one coalesced Relay consultation to
-    /// support several claim pins without duplicating the restricted execution
-    /// record. A missing empty legacy field is readable but nonissuable.
-    #[serde(default)]
-    pub consultations: Vec<StoredIssuanceConsultationProvenance>,
-    /// Keyed commitment joining the complete opaque evaluated target reference
-    /// to the target's canonical primary authorization identity. The
-    /// commitment permits a later RAR comparison without retaining the raw
-    /// identity. Evaluations stored before this field existed remain readable,
-    /// but cannot initiate a registry-client credential offer.
-    #[serde(default)]
-    pub authorization_target_binding: String,
-}
-
-impl std::fmt::Debug for StoredIssuanceProvenance {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("StoredIssuanceProvenance")
-            .field("claim_count", &self.claims.len())
-            .field("consultation_count", &self.consultations.len())
-            .finish()
-    }
-}
-
-/// The exact compiler pin and successful Relay execution for one claim in a
-/// selected root's dependency closure. This restricted persistence shape is
-/// not a public API model.
-#[derive(Clone, Serialize, Deserialize)]
-pub struct StoredIssuanceClaimProvenance {
-    pub claim_id: String,
-    pub claim_version: String,
-    pub relay_profile_id: String,
-    pub relay_contract_hash: String,
-    pub canonical_purpose: String,
-    pub consultation_id: String,
-    /// Deterministic SHA-256 commitment over this compiler pin, its Relay
-    /// execution record, and the claim result provenance produced by the
-    /// evaluation. A missing legacy value remains readable but is not
-    /// credential-issuable.
-    #[serde(default)]
-    pub execution_binding: String,
-    /// Canonical commitment to the exact evaluated result retained for
-    /// issuance. The value itself is deliberately not duplicated into this
-    /// restricted provenance record.
-    #[serde(default)]
-    pub result_content_binding: String,
-}
-
-impl std::fmt::Debug for StoredIssuanceClaimProvenance {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("StoredIssuanceClaimProvenance")
-            .field("claim_id", &self.claim_id)
-            .field("claim_version", &self.claim_version)
-            .field("relay_profile_id", &self.relay_profile_id)
-            .field("relay_contract_hash", &self.relay_contract_hash)
-            .field("canonical_purpose", &self.canonical_purpose)
-            .field("consultation_id", &"[REDACTED]")
-            .field("execution_binding", &self.execution_binding)
-            .field("result_content_binding", &self.result_content_binding)
-            .finish()
-    }
-}
-
-/// One unique successful Relay execution retained for issuance verification.
-#[derive(Clone, Serialize, Deserialize)]
-pub struct StoredIssuanceConsultationProvenance {
-    pub consultation_id: String,
-    pub acquired_at: String,
-}
-
-impl std::fmt::Debug for StoredIssuanceConsultationProvenance {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("StoredIssuanceConsultationProvenance")
-            .field("consultation_id", &"[REDACTED]")
-            .field("acquired_at", &"[REDACTED]")
-            .finish()
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct StoredSubjectAccessMetadata {
-    #[serde(default = "subject_access_access_mode")]
-    pub access_mode: AccessMode,
-    pub issuer: VerifiedClaimValue,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub audiences: Vec<VerifiedClaimValue>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub client_id: Option<VerifiedClaimValue>,
-    pub principal_hash: Hashed<PrincipalIdentifier>,
-    pub subject_id_type: ConfigMetadata,
-    pub subject_binding_claim: ConfigMetadata,
-    pub subject_binding_hash: Hashed<SubjectBinding>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub dependent_target_hash: Option<Hashed<SubjectBinding>>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub relationship_type: Option<ConfigMetadata>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub proof_claim_id: Option<BoundedClaimId>,
-    pub requested_claims_hash: Hashed<ClaimSet>,
-    pub disclosure: ConfigMetadata,
-    pub result_format: ConfigMetadata,
-    /// Delegation chain in the frozen envelope vocabulary (D4). Empty in v1;
-    /// populated post-1.0 by the additive OAuth profile (notary#180). The empty
-    /// case serializes identically to the previous placeholder.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub delegation_chain: Vec<EvidenceActor>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub policy_version: Option<BoundedPolicyId>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub policy_hash: Option<Hashed<PolicyIdentifier>>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub evaluation_expires_at: Option<String>,
-}
-
-const fn subject_access_access_mode() -> AccessMode {
-    AccessMode::SubjectBound
-}
-
-/// Versioned authorization fields shared by static configuration and token/OIDC JSON.
-///
-/// Unknown metadata is intentionally ignored for forward-compatible interoperability.
-/// Authorization decisions consume only the modeled fields and must never infer authority
-/// from an unrecognized extension.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-pub struct EvidenceAuthorizationDetails {
-    #[serde(rename = "type")]
-    pub detail_type: String,
-    pub schema_version: String,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub actions: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub locations: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub claims: Vec<ClaimRef>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub disclosure: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub format: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub purpose: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub legal_basis_ref: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub consent_ref: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub jurisdiction: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub assurance_level: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub subject: Option<EvidenceAuthorizationSubject>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub target: Option<EvidenceAuthorizationTarget>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub relationship: Option<EvidenceAuthorizationRelationship>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub access_mode: Option<AccessMode>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub assisted_access_context: Option<EvidenceAssistedAccessContext>,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-pub struct EvidenceAuthorizationSubject {
-    pub binding_claim: String,
-    pub id_type: String,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-pub struct EvidenceAuthorizationTarget {
-    pub id_type: String,
-    pub id: String,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-pub struct EvidenceAuthorizationRelationship {
-    pub relationship_type: String,
-    pub proof_claim: String,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
-pub struct EvidenceAssistedAccessContext {
-    pub channel: String,
-}
-
-#[derive(Debug, Clone)]
-pub struct EvidencePrincipal {
-    pub auth_profile_id: EvidenceAuthProfileId,
-    pub principal_id: String,
-    pub scopes: Vec<String>,
-    pub access_mode: AccessMode,
-    pub verified_claims: Option<BoundedVerifiedClaims>,
-    pub authorization_details: Option<EvidenceAuthorizationDetails>,
-}
-
-impl EvidencePrincipal {
-    #[must_use]
-    pub fn has_scope(&self, scope: &str) -> bool {
-        self.scopes.iter().any(|candidate| candidate == scope)
-    }
-
-    #[must_use]
-    pub fn has_any_scope<'a>(&self, scopes: impl IntoIterator<Item = &'a str>) -> bool {
-        scopes.into_iter().any(|scope| self.has_scope(scope))
-    }
-
-    #[must_use]
-    pub const fn access_mode(&self) -> AccessMode {
-        self.access_mode
-    }
-
-    #[must_use]
-    pub const fn is_subject_access(&self) -> bool {
-        matches!(
-            self.access_mode,
-            AccessMode::SubjectBound | AccessMode::DelegatedSubjectAccess
-        )
-    }
-
-    #[must_use]
-    pub fn verified_claim(&self, claim_name: &str) -> Option<&str> {
-        self.verified_claims
-            .as_ref()
-            .and_then(|claims| claims.claim_value(claim_name))
-    }
-
-    #[must_use]
-    pub fn verified_subject_binding_value(&self, claim_name: &str) -> Option<&str> {
-        self.verified_claims
-            .as_ref()
-            .and_then(|claims| claims.subject_binding_value(claim_name))
-    }
-}
-
-#[derive(Clone, Deserialize, Serialize)]
-pub struct EvidenceAuditEvent {
-    pub event_id: String,
-    pub occurred_at: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub principal_id_hash: Option<Hashed<PrincipalIdentifier>>,
-    #[serde(default)]
-    pub scopes_used: Vec<String>,
-    pub decision: String,
-    pub method: String,
-    pub path: String,
-    pub status: u16,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub verification_id: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub claim_hash: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub purposes: Option<Vec<String>>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub row_count: Option<u64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub relay_consultation_count: Option<u64>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub relay_consultation_ids: Vec<String>,
-    /// Conservative dispatch-attempt marker. `true` means Notary committed to
-    /// Relay work that may have reached Relay, not that Relay received it.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub forwarded: Option<bool>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub error_code: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub access_mode: Option<AccessMode>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub federation_peer_id_hash: Option<Hashed<PrincipalIdentifier>>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub federation_issuer: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub federation_profile: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub federation_purpose: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub federation_request_jti_hash: Option<Hashed<RequestIdentifier>>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub federation_subject_ref_hash: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub denial_code: Option<SubjectAccessDenialCode>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub token_claim_name: Option<ConfigMetadata>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub correlation_id_hash: Option<Hashed<RequestIdentifier>>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub credential_profile: Option<ConfigMetadata>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub protocol: Option<ConfigMetadata>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub credential_configuration_id: Option<ConfigMetadata>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub holder_binding_mode: Option<ConfigMetadata>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub rate_limit_bucket: Option<RateLimitBucket>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub policy_version: Option<BoundedPolicyId>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub policy_hash: Option<Hashed<PolicyIdentifier>>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub target_type: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub target_ref_hash: Option<Hashed<EvidenceEntityReference>>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub requester_type: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub requester_ref_hash: Option<Hashed<EvidenceEntityReference>>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub redacted_fields: Option<Vec<String>>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub batch_items: Option<Vec<EvidenceBatchItemAuditEvent>>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub config: Option<ConfigAuditEvent>,
-}
-
-impl std::fmt::Debug for EvidenceAuditEvent {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("EvidenceAuditEvent")
-            .field("event_id", &"[REDACTED]")
-            .field("decision", &self.decision)
-            .field("method", &self.method)
-            .field("path", &self.path)
-            .field("status", &self.status)
-            .field("verification_id", &"[REDACTED]")
-            .field("relay_consultation_ids", &"[REDACTED]")
-            .field("forwarded", &self.forwarded)
-            .field("error_code", &self.error_code)
-            .finish_non_exhaustive()
-    }
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize)]
-pub struct ConfigAuditEvent {
-    pub action: String,
-    pub source: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub acceptance_identity: Option<registry_platform_config::ProductAcceptanceIdentityV1>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub bundle_id: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub bundle_manifest_hash: Option<String>,
-    #[serde(
-        default,
-        rename = "bundle_sequence",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub sequence: Option<u64>,
-    pub signer_kids: Vec<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub previous_config_hash: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub previous_hash_matched: Option<bool>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub config_hash: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub anchor_digest: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub anchor_version: Option<u64>,
-    pub product_validation_result: String,
-    pub apply_result: String,
-    pub posture_result: String,
-    pub applied: bool,
-    pub restart_required: bool,
-    pub change_classes: Vec<String>,
-    pub break_glass: bool,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub break_glass_approval_reference: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub break_glass_approved_by: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub break_glass_reason_hash: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub break_glass_emergency_change_class: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub break_glass_expires_at_unix_seconds: Option<u64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub break_glass_rate_limit_identity: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub local_approval_reference: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub local_approval_approved_by: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub local_approval_reason_hash: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub local_approval_change_class: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub local_approval_expires_at_unix_seconds: Option<u64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub local_approval_rate_limit_identity: Option<String>,
-}
-
-#[derive(Clone, Deserialize, Serialize)]
-pub struct EvidenceBatchItemAuditEvent {
-    pub input_index: usize,
-    #[serde(default)]
-    pub outcome: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub error_code: Option<String>,
-    #[serde(default)]
-    pub relay_consultation_count: u64,
-    #[serde(default)]
-    pub forwarded: bool,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub relay_consultation_ids: Vec<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub target_type: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub target_ref_hash: Option<Hashed<EvidenceEntityReference>>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub requester_type: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub requester_ref_hash: Option<Hashed<EvidenceEntityReference>>,
-}
-
-impl std::fmt::Debug for EvidenceBatchItemAuditEvent {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("EvidenceBatchItemAuditEvent")
-            .field("input_index", &self.input_index)
-            .field("outcome", &self.outcome)
-            .field("error_code", &self.error_code)
-            .field("relay_consultation_count", &self.relay_consultation_count)
-            .field("forwarded", &self.forwarded)
-            .field("relay_consultation_ids", &"[REDACTED]")
-            .finish_non_exhaustive()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use serde_json::json;
-
-    fn bounded<const N: usize>(value: &str) -> Bounded<N> {
-        Bounded::new(value).expect("test value is bounded")
-    }
-
-    #[test]
-    fn access_mode_serializes_as_stable_snake_case() {
-        assert_eq!(
-            serde_json::to_value(AccessMode::SubjectBound).expect("access mode serializes"),
-            json!("subject_bound")
-        );
-        assert_eq!(
-            AccessMode::parse("machine_client"),
-            Some(AccessMode::MachineClient)
-        );
-    }
-
-    #[test]
-    fn evidence_auth_profile_ids_are_closed_and_stable() {
-        for (profile, expected) in [
-            (EvidenceAuthProfileId::StaticApiKey, "static_api_key"),
-            (EvidenceAuthProfileId::StaticBearer, "static_bearer"),
-            (EvidenceAuthProfileId::ExternalOidc, "external_oidc"),
-            (
-                EvidenceAuthProfileId::NotaryAccessToken,
-                "notary_access_token",
-            ),
-            (EvidenceAuthProfileId::Federation, "federation"),
-        ] {
-            assert_eq!(profile.as_str(), expected);
-            assert_eq!(
-                serde_json::to_value(profile).expect("auth profile serializes"),
-                json!(expected)
-            );
-            assert_eq!(
-                serde_json::from_value::<EvidenceAuthProfileId>(json!(expected))
-                    .expect("known auth profile deserializes"),
-                profile
-            );
-        }
-        assert!(
-            serde_json::from_value::<EvidenceAuthProfileId>(json!("attacker_selected")).is_err()
-        );
-    }
-
-    #[test]
-    fn claim_ref_deserializes_string_and_versioned_object() {
-        let legacy: ClaimRef =
-            serde_json::from_value(json!("person-is-alive")).expect("legacy claim id deserializes");
-        assert_eq!(legacy.id, "person-is-alive");
-        assert_eq!(legacy.version, None);
-
-        let versioned: ClaimRef =
-            serde_json::from_value(json!({ "id": "person-is-alive", "version": "2026-05" }))
-                .expect("versioned claim ref deserializes");
-        assert_eq!(versioned.id, "person-is-alive");
-        assert_eq!(versioned.version.as_deref(), Some("2026-05"));
-    }
-
-    #[test]
-    fn private_issuance_target_binding_is_backward_readable_and_debug_redacted() {
-        let legacy: StoredIssuanceProvenance = serde_json::from_value(json!({
-            "claims": [],
-            "consultations": [],
-        }))
-        .expect("legacy private provenance remains readable");
-        assert!(legacy.authorization_target_binding.is_empty());
-
-        let stored = StoredIssuanceProvenance {
-            claims: Vec::new(),
-            consultations: Vec::new(),
-            authorization_target_binding:
-                "hmac-sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-                    .to_string(),
-        };
-        let debug = format!("{stored:?}");
-        assert!(!debug.contains("hmac-sha256"));
-        assert!(!debug.contains("aaaaaaaa"));
-    }
-
-    #[test]
-    fn evaluate_request_deserializes_identity_bundle_target() {
-        let request: EvaluateRequest = serde_json::from_value(json!({
-            "requester": {
-                "type": "person",
-                "identifiers": [
-                    { "scheme": "national_id", "value": "NID-9001", "country": "RW" }
-                ]
-            },
-            "target": {
-                "type": "person",
-                "identifiers": [
-                    { "scheme": "national_id", "value": "NID-1001" }
-                ],
-                "attributes": {
-                    "given_name": "Amina",
-                    "family_name": "Kamanzi",
-                    "date_of_birth": "1990-01-15"
-                },
-                "assurance": {
-                    "method": "oidc",
-                    "level_scheme": "example-loa",
-                    "level": "substantial"
-                }
-            },
-            "relationship": {
-                "type": "self"
-            },
-            "on_behalf_of": {
-                "actor": {
-                    "type": "operator",
-                    "id_hash": "hmac-sha256:abc123"
-                }
-            },
-            "claims": ["person-is-alive"],
-            "purpose": "https://purpose.example/social-protection"
-        }))
-        .expect("new request shape deserializes");
-
-        let target = request.target.as_ref().expect("target is present");
-        assert_eq!(target.entity_type, "person");
-        assert_eq!(
-            request
-                .target_subject()
-                .expect("identifier target maps to source subject")
-                .id_type
-                .as_deref(),
-            Some("national_id")
-        );
-        assert_eq!(target.attributes["date_of_birth"], json!("1990-01-15"));
-    }
-
-    #[test]
-    fn evaluate_request_variables_are_closed_bounded_full_dates() {
-        let request: EvaluateRequest = serde_json::from_value(json!({
-            "target": { "type": "person", "id": "person-1" },
-            "variables": { "as_of_date": "2026-01-01" },
-            "claims": ["age-band"]
-        }))
-        .expect("declared-shape request variable parses");
-        assert_eq!(request.variables.get("as_of_date"), Some("2026-01-01"));
-        assert_eq!(
-            request
-                .request_context()
-                .and_then(|context| context.lookup_value("variables.as_of_date")),
-            Some(json!("2026-01-01"))
-        );
-        let debug = format!("{:?}", request.variables);
-        assert!(debug.contains("[REDACTED]"));
-        assert!(!debug.contains("2026-01-01"));
-
-        for variables in [
-            json!({ "AsOf": "2026-01-01" }),
-            json!({ "as_of_date": "2026-02-30" }),
-            json!({ "as_of_date": 20260101 }),
-        ] {
-            assert!(serde_json::from_value::<EvaluateRequest>(json!({
-                "target": { "type": "person", "id": "person-1" },
-                "variables": variables,
-                "claims": ["age-band"]
-            }))
-            .is_err());
-        }
-        let too_many = (0..=MAX_REQUEST_VARIABLES_V1)
-            .map(|index| (format!("date_{index}"), json!("2026-01-01")))
-            .collect::<serde_json::Map<_, _>>();
-        assert!(serde_json::from_value::<EvaluateRequest>(json!({
-            "target": { "type": "person", "id": "person-1" },
-            "variables": too_many,
-            "claims": ["age-band"]
-        }))
-        .is_err());
-    }
-
-    #[test]
-    fn evaluate_request_allows_missing_target_for_server_derived_context() {
-        let request: EvaluateRequest = serde_json::from_value(json!({
-            "claims": ["person-is-alive"],
-            "purpose": "https://purpose.example/self"
-        }))
-        .expect("target may be omitted when the server derives subject-access context");
-
-        assert!(request.target.is_none());
-        assert!(request.target_subject().is_none());
-        assert!(request.request_context().is_none());
-    }
-
-    #[test]
-    fn evaluate_request_rejects_old_subject_shape() {
-        let error = serde_json::from_value::<EvaluateRequest>(json!({
-            "subject": { "id": "NID-1001", "id_type": "national_id" },
-            "claims": ["person-is-alive"]
-        }))
-        .expect_err("old subject shape is no longer accepted");
-
-        assert!(
-            error.to_string().contains("missing field `target`")
-                || error.to_string().contains("unknown field `subject`"),
-            "unexpected serde error: {error}"
-        );
-    }
-
-    #[test]
-    fn evidence_entity_reports_matching_input_only_when_non_empty() {
-        let mut entity = EvidenceEntity::new("Person");
-        assert!(!entity.has_matching_input());
-
-        entity.id = Some("   ".to_string());
-        entity.identifiers.push(EvidenceIdentifier {
-            scheme: "national_id".to_string(),
-            value: "  ".to_string(),
-            issuer: None,
-            country: None,
-        });
-        assert!(!entity.has_matching_input());
-
-        entity.identifiers[0].value = "NID-1001".to_string();
-        assert!(entity.has_matching_input());
-
-        entity.identifiers[0].value = "  ".to_string();
-        entity
-            .attributes
-            .insert("district".to_string(), json!("north"));
-        assert!(entity.has_matching_input());
-    }
-
-    #[test]
-    fn batch_evaluate_request_deserializes_items_with_mixed_targets() {
-        let request: BatchEvaluateRequest = serde_json::from_value(json!({
-            "items": [
-                {
-                    "target": {
-                        "type": "person",
-                        "identifiers": [
-                            { "scheme": "national_id", "value": "NID-1001" }
-                        ]
-                    }
-                },
-                {
-                    "target": {
-                        "type": "land_parcel",
-                        "identifiers": [
-                            { "scheme": "parcel_id", "value": "LP-42" }
-                        ]
-                    },
-                    "purpose": "https://purpose.example/land"
-                }
-            ],
-            "claims": ["eligibility"]
-        }))
-        .expect("batch request shape deserializes");
-
-        assert_eq!(request.items.len(), 2);
-        assert_eq!(
-            request.items[1]
-                .target_subject()
-                .expect("target maps to source subject")
-                .id_type
-                .as_deref(),
-            Some("parcel_id")
-        );
-    }
-
-    #[test]
-    fn result_views_serialize_target_ref_without_subject_ref_or_id_type() {
-        let result = ClaimResultView {
-            evaluation_id: "eval-1".to_string(),
-            claim_id: "person-is-alive".to_string(),
-            claim_version: "1.0.0".to_string(),
-            subject_type: "person".to_string(),
-            requester_ref: None,
-            target_ref: TargetRefView {
-                entity_type: "Person".to_string(),
-                handle: "rnref:v1:test".to_string(),
-                identifier_schemes: Vec::new(),
-                profile: None,
-            },
-            value: Some(json!(true)),
-            satisfied: Some(true),
-            disclosure: "predicate".to_string(),
-            redacted_fields: Vec::new(),
-            format: FORMAT_CLAIM_RESULT_JSON.to_string(),
-            issued_at: "2026-05-31T00:00:00Z".to_string(),
-            expires_at: None,
-            provenance: ClaimProvenance::new(
-                "test".to_string(),
-                "eval-1".to_string(),
-                "person-is-alive".to_string(),
-                "1.0.0".to_string(),
-                ProvenanceUsed {
-                    relay_consultation_count: 1,
-                },
-            ),
-        };
-
-        let value = serde_json::to_value(result).expect("result serializes");
-        assert!(value.get("target_ref").is_some());
-        assert!(value.get("subject_ref").is_none());
-        assert!(value["target_ref"].get("id_type").is_none());
-    }
-
-    #[test]
-    fn claim_provenance_v2_serializes_relay_consultation_shape() {
-        let mut provenance = ClaimProvenance::new(
-            "registry-notary".to_string(),
-            "eval_01HX".to_string(),
-            "person_is_alive".to_string(),
-            "1".to_string(),
-            ProvenanceUsed {
-                relay_consultation_count: 1,
-            },
-        );
-        provenance.generated_by.policy_id = Some("subject-access".to_string());
-        provenance.generated_by.policy_version = Some("v1".to_string());
-        provenance.generated_by.policy_hash = Some("sha256:def456".to_string());
-
-        let value = serde_json::to_value(&provenance).expect("provenance serializes");
-
-        assert_eq!(
-            value["schema_version"],
-            json!("registry-notary-claim-provenance/v2")
-        );
-        let generated_by = &value["generated_by"];
-        assert_eq!(generated_by["type"], json!("claim_evaluation"));
-        assert_eq!(generated_by["service_id"], json!("registry-notary"));
-        assert_eq!(generated_by["evaluation_id"], json!("eval_01HX"));
-        assert_eq!(generated_by["claim_id"], json!("person_is_alive"));
-        assert_eq!(generated_by["claim_version"], json!("1"));
-        assert_eq!(generated_by["policy_id"], json!("subject-access"));
-        assert_eq!(generated_by["policy_version"], json!("v1"));
-        assert_eq!(generated_by["policy_hash"], json!("sha256:def456"));
-
-        let used = &value["used"];
-        assert_eq!(used["relay_consultation_count"], json!(1));
-        assert!(used.get("source_count").is_none());
-        assert!(used.get("source_versions").is_none());
-        assert_eq!(value["derived_from"], json!([]));
-    }
-
-    #[test]
-    fn claim_provenance_v2_round_trips() {
-        let provenance = ClaimProvenance::new(
-            "registry-notary".to_string(),
-            "eval_01HX".to_string(),
-            "person_is_alive".to_string(),
-            "1".to_string(),
-            ProvenanceUsed {
-                relay_consultation_count: 2,
-            },
-        );
-        let value = serde_json::to_value(&provenance).expect("serializes");
-        let parsed: ClaimProvenance =
-            serde_json::from_value(value).expect("provenance round-trips");
-        assert_eq!(parsed.schema_version, CLAIM_PROVENANCE_SCHEMA_VERSION);
-        assert_eq!(parsed.used.relay_consultation_count, 2);
-        assert!(parsed.generated_by.policy_id.is_none());
-    }
-
-    #[test]
-    fn claim_provenance_omits_computed_by_and_requester_side_fields() {
-        let provenance = ClaimProvenance::new(
-            "registry-notary".to_string(),
-            "eval_01HX".to_string(),
-            "claim".to_string(),
-            "1".to_string(),
-            ProvenanceUsed {
-                relay_consultation_count: 0,
-            },
-        );
-        let value = serde_json::to_value(&provenance).expect("serializes");
-        let text = value.to_string();
-        assert!(
-            !text.contains("computed_by"),
-            "computed_by must be gone from the provenance wire shape"
-        );
-        for forbidden in ["client", "actor", "subject"] {
-            assert!(
-                value.get(forbidden).is_none()
-                    && value["generated_by"].get(forbidden).is_none()
-                    && value["used"].get(forbidden).is_none(),
-                "requester-side field {forbidden} must not appear in claim provenance"
-            );
-        }
-    }
-
-    #[test]
-    fn on_behalf_of_envelope_serializes_and_round_trips() {
-        let envelope = EvidenceOnBehalfOf {
-            actor: EvidenceActor {
-                actor_type: "service_account".to_string(),
-                id_hash: "hmac-sha256:abc123".to_string(),
-                assurance: Some("urn:example:loa:substantial".to_string()),
-            },
-            delegation_ref: Some("urn:delegation:42".to_string()),
-        };
-        let value = serde_json::to_value(&envelope).expect("envelope serializes");
-        assert_eq!(value["actor"]["type"], json!("service_account"));
-        assert_eq!(value["actor"]["id_hash"], json!("hmac-sha256:abc123"));
-        assert_eq!(
-            value["actor"]["assurance"],
-            json!("urn:example:loa:substantial")
-        );
-        assert_eq!(value["delegation_ref"], json!("urn:delegation:42"));
-
-        let parsed: EvidenceOnBehalfOf =
-            serde_json::from_value(value).expect("envelope round-trips");
-        assert_eq!(parsed.actor.actor_type, "service_account");
-        assert_eq!(parsed.delegation_ref.as_deref(), Some("urn:delegation:42"));
-    }
-
-    #[test]
-    fn on_behalf_of_minimal_envelope_omits_optional_fields() {
-        let envelope = EvidenceOnBehalfOf {
-            actor: EvidenceActor {
-                actor_type: "operator".to_string(),
-                id_hash: "hmac-sha256:def456".to_string(),
-                assurance: None,
-            },
-            delegation_ref: None,
-        };
-        let value = serde_json::to_value(&envelope).expect("envelope serializes");
-        assert!(value.get("delegation_ref").is_none());
-        assert!(value["actor"].get("assurance").is_none());
-    }
-
-    #[test]
-    fn on_behalf_of_rejects_free_form_payloads() {
-        let legacy = json!({ "delegator": "did:example:123", "scope": "read" });
-        let err = serde_json::from_value::<EvidenceOnBehalfOf>(legacy)
-            .expect_err("free-form on_behalf_of must be rejected");
-        let message = err.to_string();
-        assert!(
-            message.contains("unknown field") || message.contains("missing field"),
-            "rejection should be a schema mismatch, got: {message}"
-        );
-    }
-
-    #[test]
-    fn on_behalf_of_rejects_unknown_actor_field() {
-        let payload = json!({
-            "actor": {
-                "type": "operator",
-                "id_hash": "hmac-sha256:def456",
-                "raw_id": "leaked"
-            }
-        });
-        let err = serde_json::from_value::<EvidenceOnBehalfOf>(payload)
-            .expect_err("unknown actor field must be rejected");
-        assert!(err.to_string().contains("unknown field"));
-    }
-
-    #[test]
-    fn evaluate_request_accepts_envelope_and_rejects_loose_json() {
-        let accepted = serde_json::from_value::<EvaluateRequest>(json!({
-            "target": { "type": "Person", "identifiers": [{ "scheme": "id", "value": "x" }] },
-            "claims": ["person_is_alive"],
-            "on_behalf_of": {
-                "actor": { "type": "operator", "id_hash": "hmac-sha256:abc" }
-            }
-        }));
-        assert!(accepted.is_ok(), "structured envelope must be accepted");
-
-        let rejected = serde_json::from_value::<EvaluateRequest>(json!({
-            "target": { "type": "Person", "identifiers": [{ "scheme": "id", "value": "x" }] },
-            "claims": ["person_is_alive"],
-            "on_behalf_of": { "anything": "goes" }
-        }));
-        assert!(
-            rejected.is_err(),
-            "free-form on_behalf_of must be rejected at request level"
-        );
-    }
-
-    #[test]
-    fn bounded_rejects_values_over_limit() {
-        let err = Bounded::<4>::new("12345").expect_err("value exceeds limit");
-        assert_eq!(err.max, 4);
-        assert_eq!(err.actual, 5);
-    }
-
-    #[test]
-    fn verified_claim_lookup_exposes_only_bounded_allow_listed_claims() {
-        let claims = BoundedVerifiedClaims {
-            issuer: bounded("https://id.example.gov"),
-            audiences: vec![bounded("registry-notary-citizen")],
-            client_id: Some(bounded("citizen-portal")),
-            token_type: Some(bounded("JWT")),
-            credential_configuration_id: None,
-            issuance_transaction_id: None,
-            issuance_transaction_commitment: None,
-            scopes: vec![bounded("subject_access")],
-            subject: Some(bounded("login-subject")),
-            subject_binding_claim: Some(bounded("https://id.example.gov/claims/national_id")),
-            subject_binding_value: Some(bounded("NAT-123")),
-            acr: Some(bounded("urn:example:loa:substantial")),
-            auth_time: Some(1_800_000_000),
-            exp: Some(1_800_000_900),
-            iat: Some(1_800_000_000),
-            nbf: None,
-        };
-
-        assert!(claims.has_scope("subject_access"));
-        assert_eq!(claims.claim_value("sub"), Some("login-subject"));
-        assert_eq!(claims.claim_value("email"), None);
-        assert_eq!(
-            claims.subject_binding_value("https://id.example.gov/claims/national_id"),
-            Some("NAT-123")
-        );
-    }
-
-    #[test]
-    fn verified_claim_lookup_treats_blank_subject_binding_value_as_missing() {
-        for blank in ["", "   "] {
-            let claims = BoundedVerifiedClaims {
-                issuer: bounded("https://id.example.gov"),
-                audiences: vec![bounded("registry-notary-citizen")],
-                client_id: Some(bounded("citizen-portal")),
-                token_type: Some(bounded("JWT")),
-                credential_configuration_id: None,
-                issuance_transaction_id: None,
-                issuance_transaction_commitment: None,
-                scopes: vec![bounded("subject_access")],
-                subject: Some(bounded("login-subject")),
-                subject_binding_claim: Some(bounded("https://id.example.gov/claims/national_id")),
-                subject_binding_value: Some(bounded(blank)),
-                acr: None,
-                auth_time: None,
-                exp: None,
-                iat: None,
-                nbf: None,
-            };
-
-            assert_eq!(
-                claims.subject_binding_value("https://id.example.gov/claims/national_id"),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn evaluation_capability_separates_machine_scopes_from_subject_access_claims() {
-        let machine = EvaluationCapability::Machine {
-            scopes: BTreeSet::from(["civil_registry:evidence_verification".to_string()]),
-        };
-        assert_eq!(machine.access_mode(), AccessMode::MachineClient);
-        assert!(machine.allows_scope("civil_registry:evidence_verification"));
-        assert!(!machine.allows_subject_access_claim("person-is-alive"));
-
-        let citizen = EvaluationCapability::SubjectBound {
-            claim_id: Some(bounded("person-is-alive")),
-            allowed_claim_ids: BTreeSet::new(),
-            subject_binding_hash: Hashed::from_hash("sha256:test"),
-        };
-        assert_eq!(citizen.access_mode(), AccessMode::SubjectBound);
-        assert!(!citizen.allows_scope("civil_registry:evidence_verification"));
-        assert!(citizen.allows_subject_access_claim("person-is-alive"));
-    }
-
-    #[test]
-    fn audit_subject_access_fields_round_trip_without_raw_values() {
-        let event = EvidenceAuditEvent {
-            event_id: "01HX".to_string(),
-            occurred_at: "2026-05-25T00:00:00Z".to_string(),
-            principal_id_hash: Some(Hashed::from_hash("hmac-sha256:principal")),
-            scopes_used: vec!["subject_access".to_string()],
-            decision: "denied".to_string(),
-            method: "POST".to_string(),
-            path: "/v1/evaluations".to_string(),
-            status: 403,
-            verification_id: None,
-            claim_hash: Some("sha256:claims".to_string()),
-            purposes: None,
-            row_count: None,
-            relay_consultation_count: None,
-            relay_consultation_ids: vec!["01JRELAYCORRELATIONSENSITIVE".to_string()],
-            forwarded: None,
-            error_code: Some("subject_access.denied".to_string()),
-            access_mode: Some(AccessMode::SubjectBound),
-            federation_peer_id_hash: None,
-            federation_issuer: None,
-            federation_profile: None,
-            federation_purpose: None,
-            federation_request_jti_hash: None,
-            federation_subject_ref_hash: None,
-            denial_code: Some(SubjectAccessDenialCode::SubjectMismatch),
-            token_claim_name: Some(bounded("national_id")),
-            correlation_id_hash: Some(Hashed::from_hash("hmac-sha256:req-123")),
-            credential_profile: None,
-            protocol: Some(bounded("openid4vci")),
-            credential_configuration_id: Some(bounded("person_is_alive_sd_jwt")),
-            holder_binding_mode: None,
-            rate_limit_bucket: None,
-            policy_version: Some(bounded("citizen-v1")),
-            policy_hash: Some(Hashed::from_hash("sha256:policy")),
-            target_type: Some("person".to_string()),
-            target_ref_hash: Some(Hashed::from_hash("hmac-sha256:target")),
-            requester_type: Some("person".to_string()),
-            requester_ref_hash: Some(Hashed::from_hash("hmac-sha256:requester")),
-            redacted_fields: None,
-            batch_items: Some(vec![EvidenceBatchItemAuditEvent {
-                input_index: 0,
-                outcome: "failed".to_string(),
-                error_code: Some("evidence.not_available".to_string()),
-                relay_consultation_count: 1,
-                forwarded: true,
-                relay_consultation_ids: vec!["01JRELAYBATCHSENSITIVE".to_string()],
-                target_type: Some("person".to_string()),
-                target_ref_hash: Some(Hashed::from_hash("hmac-sha256:batch-target")),
-                requester_type: Some("person".to_string()),
-                requester_ref_hash: Some(Hashed::from_hash("hmac-sha256:batch-requester")),
-            }]),
-            config: None,
-        };
-
-        let value = serde_json::to_value(&event).expect("audit event serializes");
-        assert_eq!(
-            value["relay_consultation_ids"],
-            json!(["01JRELAYCORRELATIONSENSITIVE"])
-        );
-        let debug = format!("{event:?}");
-        assert!(!debug.contains("01JRELAYCORRELATIONSENSITIVE"));
-        assert!(!debug.contains("01JRELAYBATCHSENSITIVE"));
-        assert!(debug.contains("relay_consultation_ids: \"[REDACTED]\""));
-        assert_eq!(value["access_mode"], json!("subject_bound"));
-        assert_eq!(
-            value["denial_code"],
-            json!("subject_access.subject_mismatch")
-        );
-        assert_eq!(value["token_claim_name"], json!("national_id"));
-        assert_eq!(value["correlation_id_hash"], json!("hmac-sha256:req-123"));
-        assert!(value.get("correlation_id").is_none());
-        assert_eq!(value["protocol"], json!("openid4vci"));
-        assert_eq!(
-            value["credential_configuration_id"],
-            json!("person_is_alive_sd_jwt")
-        );
-        assert_eq!(value["principal_id_hash"], json!("hmac-sha256:principal"));
-        assert_eq!(value["scopes_used"], json!(["subject_access"]));
-        assert!(value.get("principal_id").is_none());
-        assert!(value.get("subject_binding_value").is_none());
-        assert_eq!(value["target_type"], json!("person"));
-        assert_eq!(value["target_ref_hash"], json!("hmac-sha256:target"));
-        assert_eq!(value["requester_type"], json!("person"));
-        assert_eq!(value["requester_ref_hash"], json!("hmac-sha256:requester"));
-        assert_eq!(
-            value["batch_items"][0]["target_ref_hash"],
-            json!("hmac-sha256:batch-target")
-        );
-        assert!(value.get("target_id").is_none());
-        assert!(value.get("target_attributes").is_none());
-        assert!(value.get("requester_id").is_none());
-
-        let decoded: EvidenceAuditEvent =
-            serde_json::from_value(value).expect("audit event deserializes");
-        assert_eq!(decoded.event_id, event.event_id);
-        assert_eq!(decoded.scopes_used, vec!["subject_access"]);
-        assert_eq!(decoded.access_mode, Some(AccessMode::SubjectBound));
-        assert_eq!(
-            decoded.denial_code,
-            Some(SubjectAccessDenialCode::SubjectMismatch)
-        );
-        assert_eq!(
-            decoded.token_claim_name.as_ref().map(Bounded::as_str),
-            Some("national_id")
-        );
-        assert_eq!(
-            decoded.correlation_id_hash.as_ref().map(Hashed::as_str),
-            Some("hmac-sha256:req-123")
-        );
-        assert_eq!(
-            decoded.policy_hash.as_ref().map(Hashed::as_str),
-            Some("sha256:policy")
-        );
-        assert_eq!(decoded.target_type.as_deref(), Some("person"));
-        assert_eq!(
-            decoded.target_ref_hash.as_ref().map(Hashed::as_str),
-            Some("hmac-sha256:target")
-        );
-        assert_eq!(decoded.requester_type.as_deref(), Some("person"));
-        assert_eq!(
-            decoded.requester_ref_hash.as_ref().map(Hashed::as_str),
-            Some("hmac-sha256:requester")
-        );
-        assert_eq!(decoded.batch_items.as_ref().map(Vec::len), Some(1));
-    }
-
-    #[test]
-    fn audit_event_missing_optional_fields_defaults_to_none() {
-        let decoded: EvidenceAuditEvent = serde_json::from_value(json!({
-            "event_id": "01HX",
-            "occurred_at": "2026-05-25T00:00:00Z",
-            "decision": "allowed",
-            "method": "GET",
-            "path": "/v1/claims",
-            "status": 200
-        }))
-        .expect("legacy audit event deserializes");
-
-        assert!(decoded.verification_id.is_none());
-        assert!(decoded.claim_hash.is_none());
-        assert!(decoded.purposes.is_none());
-        assert!(decoded.scopes_used.is_empty());
-        assert!(decoded.row_count.is_none());
-        assert!(decoded.error_code.is_none());
-        assert!(decoded.access_mode.is_none());
-        assert!(decoded.target_type.is_none());
-        assert!(decoded.target_ref_hash.is_none());
-        assert!(decoded.requester_type.is_none());
-        assert!(decoded.requester_ref_hash.is_none());
-        assert!(decoded.batch_items.is_none());
-    }
-
-    #[test]
-    fn config_audit_governance_evidence_is_optional_for_legacy_records() {
-        let decoded: ConfigAuditEvent = serde_json::from_value(json!({
-            "action": "boot",
-            "source": "signed_bundle_file",
-            "signer_kids": [],
-            "product_validation_result": "accepted",
-            "apply_result": "applied",
-            "posture_result": "accepted",
-            "applied": true,
-            "restart_required": false,
-            "change_classes": [],
-            "break_glass": false
-        }))
-        .expect("legacy config audit deserializes");
-
-        assert!(decoded.acceptance_identity.is_none());
-        assert!(decoded.bundle_manifest_hash.is_none());
-        assert!(decoded.anchor_digest.is_none());
-        assert!(decoded.anchor_version.is_none());
-    }
-
-    #[test]
-    fn stored_evaluation_without_subject_access_defaults_to_machine_client() {
-        let raw = json!({
-            "client_id": "client",
-            "purpose": "verification",
-            "claim_ids": ["person-is-alive"],
-            "disclosure": "predicate",
-            "format": FORMAT_CLAIM_RESULT_JSON,
-            "results": [],
-            "created_at": "2026-05-25T00:00:00Z",
-            "expires_at": "2026-05-25T00:15:00Z",
-            "request_hash": "sha256:request"
-        });
-        let stored: StoredEvaluation =
-            serde_json::from_value(raw).expect("legacy stored evaluation deserializes");
-        assert_eq!(stored.access_mode(), AccessMode::MachineClient);
-        assert_eq!(
-            stored.selected_claim_refs(),
-            vec![ClaimRef::from("person-is-alive")]
-        );
-        assert!(stored.issuance_provenance.is_none());
-        assert!(stored.subject_access.is_none());
-    }
-}
diff --git a/crates/registry-notary-core/src/sd_jwt.rs b/crates/registry-notary-core/src/sd_jwt.rs
deleted file mode 100644
index de794b316..000000000
--- a/crates/registry-notary-core/src/sd_jwt.rs
+++ /dev/null
@@ -1,1114 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Minimal SD-JWT VC issuer for Registry Notary claim views.
-
-use registry_platform_crypto::{parse_did_jwk, PrivateJwk, PublicJwk, SigningProvider};
-use registry_platform_sdjwt::{
-    new_credential_id as platform_new_credential_id, Disclosure, HolderConfirmation,
-    SdJwtIssuanceInput, SdJwtIssuer,
-};
-use serde_json::{json, Value};
-use std::collections::BTreeMap;
-use std::fmt;
-use std::sync::Arc;
-use time::format_description::well_known::Rfc3339;
-use time::OffsetDateTime;
-
-use crate::config::CredentialProfileConfig;
-use crate::error::EvidenceError;
-use crate::model::{ClaimResultView, SD_JWT_VC_SIGNING_ALG};
-
-#[derive(Clone)]
-pub struct SignedSdJwtVc {
-    pub credential_id: String,
-    pub issuer: String,
-    pub expires_at: String,
-    pub compact: String,
-    pub issuer_signed_jwt: String,
-    pub disclosures: Vec<String>,
-}
-
-impl fmt::Debug for SignedSdJwtVc {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("SignedSdJwtVc")
-            .field("credential_id", &self.credential_id)
-            .field("issuer", &self.issuer)
-            .field("expires_at", &self.expires_at)
-            .field("compact", &"[redacted]")
-            .field("issuer_signed_jwt", &"[redacted]")
-            .field("disclosures", &"[redacted]")
-            .finish()
-    }
-}
-
-#[derive(Clone)]
-pub struct EvidenceIssuer {
-    verification_method_id: String,
-    issuer: SdJwtIssuer,
-    public_jwk: Value,
-}
-
-impl fmt::Debug for EvidenceIssuer {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("EvidenceIssuer")
-            .field("verification_method_id", &self.verification_method_id)
-            .field("public_jwk", &"[omitted]")
-            .finish_non_exhaustive()
-    }
-}
-
-impl EvidenceIssuer {
-    pub fn from_jwk_str(raw: &str, verification_method_id: String) -> Result<Self, EvidenceError> {
-        let mut jwk =
-            PrivateJwk::parse(raw).map_err(|_| EvidenceError::CredentialIssuanceFailed)?;
-        jwk.kid = Some(verification_method_id.clone());
-        jwk.alg
-            .get_or_insert_with(|| SD_JWT_VC_SIGNING_ALG.to_string());
-        let public = jwk.public();
-        let public_jwk =
-            serde_json::to_value(public).map_err(|_| EvidenceError::CredentialIssuanceFailed)?;
-        let issuer =
-            SdJwtIssuer::from_jwk(jwk).map_err(|_| EvidenceError::CredentialIssuanceFailed)?;
-        Ok(Self {
-            verification_method_id,
-            issuer,
-            public_jwk,
-        })
-    }
-
-    pub fn from_signing_provider(
-        provider: Arc<dyn SigningProvider>,
-    ) -> Result<Self, EvidenceError> {
-        let verification_method_id = provider.key_id().to_string();
-        if verification_method_id.trim().is_empty() {
-            return Err(EvidenceError::CredentialIssuanceFailed);
-        }
-        let public = provider.public_jwk();
-        if public.kid.as_deref() != Some(verification_method_id.as_str()) {
-            return Err(EvidenceError::CredentialIssuanceFailed);
-        }
-        let public_jwk =
-            serde_json::to_value(public).map_err(|_| EvidenceError::CredentialIssuanceFailed)?;
-        let issuer = SdJwtIssuer::from_signing_provider(provider);
-        Ok(Self {
-            verification_method_id,
-            issuer,
-            public_jwk,
-        })
-    }
-
-    #[must_use]
-    pub fn public_jwk(&self) -> Value {
-        self.public_jwk.clone()
-    }
-
-    pub async fn sign_compact_jwt(
-        &self,
-        typ: &str,
-        payload: Value,
-    ) -> Result<String, EvidenceError> {
-        self.issuer
-            .sign_compact_jwt(typ, payload)
-            .await
-            .map_err(|_| EvidenceError::CredentialIssuanceFailed)
-    }
-}
-
-#[derive(Clone, Debug, Default)]
-pub struct IssueOptions {
-    pub credential_id: Option<String>,
-    pub status: Option<Value>,
-    pub projection: Option<Vec<SdJwtProjectionClaim>>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct SdJwtProjectionClaim {
-    pub claim_id: String,
-    pub output_name: String,
-}
-
-pub async fn issue(
-    profile: &CredentialProfileConfig,
-    issuer: &EvidenceIssuer,
-    results: &[ClaimResultView],
-    subject_ref: &str,
-    holder_id: Option<&str>,
-    iat: OffsetDateTime,
-    options: IssueOptions,
-) -> Result<SignedSdJwtVc, EvidenceError> {
-    let holder_confirmation = holder_id.map(holder_confirmation).transpose()?;
-    if profile.holder_binding.mode != "none" && holder_confirmation.is_none() {
-        return Err(EvidenceError::HolderProofRequired);
-    }
-    if subject_ref.trim().is_empty() {
-        return Err(EvidenceError::InvalidRequest);
-    }
-    let expires_at = iat
-        .checked_add(time::Duration::seconds(profile.validity_seconds))
-        .ok_or(EvidenceError::CredentialIssuanceFailed)?;
-    let public_claims = BTreeMap::from([
-        ("issuanceDate".to_string(), json!(format_time(iat))),
-        ("expirationDate".to_string(), json!(format_time(expires_at))),
-    ]);
-    let disclosures = disclosures_for_results(results, options.projection.as_deref())?;
-    let signed = issuer
-        .issuer
-        .issue(SdJwtIssuanceInput {
-            iss: profile.issuer.clone(),
-            sub_ref: subject_ref.to_string(),
-            credential_id: options.credential_id,
-            iat: iat.unix_timestamp(),
-            exp: expires_at.unix_timestamp(),
-            vct: profile.vct.clone(),
-            status: options.status,
-            public_claims,
-            cnf: holder_confirmation,
-            disclosures,
-        })
-        .await
-        .map_err(|_| EvidenceError::CredentialIssuanceFailed)?;
-    let (issuer_signed_jwt, disclosures) = split_sd_jwt_compact(&signed.jwt)?;
-    Ok(SignedSdJwtVc {
-        credential_id: signed.credential_id,
-        issuer: profile.issuer.clone(),
-        expires_at: format_time(expires_at),
-        compact: signed.jwt,
-        issuer_signed_jwt,
-        disclosures,
-    })
-}
-
-fn disclosures_for_results(
-    results: &[ClaimResultView],
-    projection: Option<&[SdJwtProjectionClaim]>,
-) -> Result<Vec<Disclosure>, EvidenceError> {
-    if let Some(projection) = projection {
-        return projection
-            .iter()
-            .map(|entry| {
-                let result = results
-                    .iter()
-                    .find(|result| result.claim_id == entry.claim_id)
-                    .ok_or(EvidenceError::CredentialIssuanceFailed)?;
-                if result.satisfied == Some(false) {
-                    return Err(EvidenceError::CredentialIssuanceFailed);
-                }
-                let Some(value) = result
-                    .value
-                    .as_ref()
-                    .filter(|value| !value.is_null())
-                    .cloned()
-                else {
-                    return Err(EvidenceError::CredentialIssuanceFailed);
-                };
-                Ok(Disclosure {
-                    name: entry.output_name.clone(),
-                    value,
-                })
-            })
-            .collect();
-    }
-
-    Ok(results
-        .iter()
-        .map(|result| Disclosure {
-            name: result.claim_id.clone(),
-            value: json!({
-                "claim_id": result.claim_id,
-                "version": result.claim_version,
-                "value": result.value,
-                "satisfied": result.satisfied,
-                "subject_type": result.subject_type,
-                "issued_at": result.issued_at,
-            }),
-        })
-        .collect())
-}
-
-#[must_use]
-pub fn new_credential_id() -> String {
-    platform_new_credential_id()
-}
-
-fn split_sd_jwt_compact(compact: &str) -> Result<(String, Vec<String>), EvidenceError> {
-    let mut parts = compact.split('~');
-    let issuer_signed_jwt = parts
-        .next()
-        .filter(|jwt| !jwt.is_empty())
-        .ok_or(EvidenceError::CredentialIssuanceFailed)?
-        .to_string();
-    let disclosures = parts
-        .filter(|part| !part.is_empty())
-        .map(ToString::to_string)
-        .collect();
-    Ok((issuer_signed_jwt, disclosures))
-}
-
-fn holder_confirmation(holder_id: &str) -> Result<HolderConfirmation, EvidenceError> {
-    Ok(HolderConfirmation {
-        jwk: holder_jwk(holder_id)?,
-        kid: Some(holder_id.to_string()),
-    })
-}
-
-pub fn holder_jwk(holder_id: &str) -> Result<PublicJwk, EvidenceError> {
-    parse_did_jwk(holder_id).map_err(|_| EvidenceError::HolderProofRequired)
-}
-
-fn format_time(value: OffsetDateTime) -> String {
-    value
-        .format(&Rfc3339)
-        .expect("OffsetDateTime within supported RFC3339 range")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::config::HolderBindingConfig;
-    use crate::model::{ClaimProvenance, TargetRefView, FORMAT_SD_JWT_VC, SD_JWT_VC_JWT_TYP};
-    use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-    use base64::Engine;
-    use registry_platform_crypto::did_jwk_from_public_jwk;
-    use sha2::{Digest, Sha256};
-
-    const RAW_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA"}"#;
-
-    fn issue(
-        profile: &CredentialProfileConfig,
-        issuer: &EvidenceIssuer,
-        results: &[ClaimResultView],
-        subject_ref: &str,
-        holder_id: Option<&str>,
-        iat: OffsetDateTime,
-        options: IssueOptions,
-    ) -> Result<SignedSdJwtVc, EvidenceError> {
-        tokio::runtime::Builder::new_current_thread()
-            .enable_all()
-            .build()
-            .expect("test runtime builds")
-            .block_on(super::issue(
-                profile,
-                issuer,
-                results,
-                subject_ref,
-                holder_id,
-                iat,
-                options,
-            ))
-    }
-
-    #[test]
-    fn signing_algorithm_header_value_is_stable() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let signed = issue(
-            &test_profile(),
-            &issuer,
-            &[claim_result("first")],
-            "subject-ref",
-            None,
-            OffsetDateTime::now_utc(),
-            IssueOptions::default(),
-        )
-        .expect("credential issues");
-        let compact = signed.compact.split('~').next().expect("compact jwt");
-        let header = compact.split('.').next().expect("compact jwt has header");
-        let header: Value = serde_json::from_slice(
-            &URL_SAFE_NO_PAD
-                .decode(header)
-                .expect("header decodes as base64url"),
-        )
-        .expect("header decodes as JSON");
-        assert_eq!(header["alg"], SD_JWT_VC_SIGNING_ALG);
-        assert_eq!(header["typ"], SD_JWT_VC_JWT_TYP);
-    }
-
-    #[test]
-    fn evidence_issuer_can_be_backed_by_signing_provider() {
-        let mut jwk = PrivateJwk::parse(RAW_JWK).expect("test JWK parses");
-        jwk.kid = Some("did:web:issuer.test#provider-key".to_string());
-        jwk.alg = Some(SD_JWT_VC_SIGNING_ALG.to_string());
-        let signer =
-            registry_platform_crypto::LocalJwkSigner::new(jwk).expect("local signer builds");
-        let issuer = EvidenceIssuer::from_signing_provider(std::sync::Arc::new(signer))
-            .expect("provider-backed issuer builds");
-
-        assert_eq!(
-            issuer.public_jwk()["kid"],
-            "did:web:issuer.test#provider-key"
-        );
-        let signed = issue(
-            &test_profile(),
-            &issuer,
-            &[claim_result("first")],
-            "subject-ref",
-            None,
-            OffsetDateTime::now_utc(),
-            IssueOptions::default(),
-        )
-        .expect("credential issues");
-        let compact = signed.compact.split('~').next().expect("compact jwt");
-        let header = compact.split('.').next().expect("compact jwt has header");
-        let header: Value = serde_json::from_slice(
-            &URL_SAFE_NO_PAD
-                .decode(header)
-                .expect("header decodes as base64url"),
-        )
-        .expect("header decodes as JSON");
-        assert_eq!(header["kid"], "did:web:issuer.test#provider-key");
-    }
-
-    #[test]
-    fn issued_credential_payload_includes_jti() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let signed = issue(
-            &test_profile(),
-            &issuer,
-            &[claim_result("first")],
-            "subject-ref",
-            None,
-            OffsetDateTime::now_utc(),
-            IssueOptions::default(),
-        )
-        .expect("credential issues");
-        let payload = payload(&signed);
-
-        assert_eq!(payload["jti"], signed.credential_id);
-        assert_eq!(payload["id"], signed.credential_id);
-    }
-
-    #[test]
-    fn issued_credential_payload_can_include_status_claim() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let credential_id = new_credential_id();
-        let status = json!({
-            "status_list": {
-                "idx": 0,
-                "uri": format!("https://issuer.example/v1/credentials/{credential_id}/status")
-            }
-        });
-        let signed = issue(
-            &test_profile(),
-            &issuer,
-            &[claim_result("first")],
-            "subject-ref",
-            None,
-            OffsetDateTime::now_utc(),
-            IssueOptions {
-                credential_id: Some(credential_id.clone()),
-                status: Some(status.clone()),
-                projection: None,
-            },
-        )
-        .expect("credential issues");
-        let payload = payload(&signed);
-
-        assert_eq!(signed.credential_id, credential_id);
-        assert_eq!(payload["id"], credential_id);
-        assert_eq!(payload["jti"], credential_id);
-        assert_eq!(payload["status"], status);
-    }
-
-    #[test]
-    fn issuing_with_overflowing_validity_returns_error() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let mut profile = test_profile();
-        profile.validity_seconds = i64::MAX;
-
-        let error = issue(
-            &profile,
-            &issuer,
-            &[claim_result("first")],
-            "subject-ref",
-            None,
-            OffsetDateTime::now_utc(),
-            IssueOptions::default(),
-        )
-        .expect_err("overflowing validity is rejected");
-
-        assert!(matches!(error, EvidenceError::CredentialIssuanceFailed));
-    }
-
-    #[test]
-    fn golden_sd_jwt_vc_fixture_matches_conformance_profile() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let holder = holder_did_jwk();
-        let iat = OffsetDateTime::from_unix_timestamp(1_700_000_000)
-            .expect("test fixture timestamp is valid");
-        let mut result = claim_result("first");
-        result.target_ref = target_ref_view("registry-subject-ref");
-        let signed = issue(
-            &holder_required_profile(),
-            &issuer,
-            &[result],
-            &holder,
-            Some(&holder),
-            iat,
-            IssueOptions::default(),
-        )
-        .expect("credential issues");
-
-        let header = header(&signed);
-        let payload = payload(&signed);
-
-        assert_eq!(header["alg"], SD_JWT_VC_SIGNING_ALG);
-        assert_eq!(header["typ"], SD_JWT_VC_JWT_TYP);
-        assert_eq!(header["kid"], "did:web:issuer.test#key-1");
-        assert_eq!(payload["iss"], "did:web:issuer.test");
-        assert_eq!(payload["sub"], holder);
-        assert_eq!(payload["iat"], iat.unix_timestamp());
-        assert_eq!(payload["exp"], iat.unix_timestamp() + 60);
-        assert_eq!(payload["vct"], "https://vct.example/test");
-        assert_eq!(payload["jti"], signed.credential_id);
-        assert_eq!(payload["id"], signed.credential_id);
-        assert_eq!(payload["cnf"]["kid"], holder);
-        assert_eq!(payload["cnf"]["jwk"]["kty"], "OKP");
-        assert_eq!(payload["cnf"]["jwk"]["crv"], "Ed25519");
-        assert!(payload["cnf"]["jwk"].get("d").is_none());
-        assert_eq!(payload_sd(&signed), disclosure_digests(&signed));
-        assert_eq!(signed.disclosures.len(), 1);
-        assert!(
-            !payload.to_string().contains("registry-subject-ref"),
-            "holder-bound payload must not expose the raw registry subject_ref",
-        );
-    }
-
-    #[test]
-    fn issued_credential_exposes_verifiable_jwt_separately_from_disclosures() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let signed = issue(
-            &test_profile(),
-            &issuer,
-            &[claim_result("first")],
-            "subject-ref",
-            None,
-            OffsetDateTime::now_utc(),
-            IssueOptions::default(),
-        )
-        .expect("credential issues");
-
-        assert_eq!(
-            signed.issuer_signed_jwt,
-            signed.compact.split('~').next().expect("sd-jwt has jwt")
-        );
-        assert!(!signed.issuer_signed_jwt.contains('~'));
-        let segments = signed.issuer_signed_jwt.split('.').collect::<Vec<_>>();
-        assert_eq!(segments.len(), 3);
-        for segment in segments {
-            URL_SAFE_NO_PAD
-                .decode(segment)
-                .expect("JWT segment is base64url without SD-JWT disclosure tail");
-        }
-        assert_eq!(signed.disclosures.len(), 1);
-        assert!(signed.compact.ends_with('~'));
-    }
-
-    #[test]
-    fn issued_credential_disclosures_do_not_reintroduce_redacted_object_fields() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let source_value = json!({
-            "name": "Ada",
-            "household_id": "hh-1",
-            "ssn": "123-45-6789"
-        });
-        assert!(
-            source_value.to_string().contains("123-45-6789"),
-            "the source fixture must contain the PII this regression protects"
-        );
-        let mut redacted_value = source_value
-            .as_object()
-            .expect("source fixture is an object")
-            .clone();
-        assert!(
-            redacted_value.remove("ssn").is_some(),
-            "the test redaction fixture must remove an existing field"
-        );
-        let mut result = claim_result("household-summary");
-        result.value = Some(Value::Object(redacted_value));
-
-        let signed = issue(
-            &test_profile(),
-            &issuer,
-            &[result],
-            "subject-ref",
-            None,
-            OffsetDateTime::now_utc(),
-            IssueOptions::default(),
-        )
-        .expect("credential issues");
-        let disclosures = decoded_disclosures(&signed);
-        let household_disclosure = disclosures
-            .iter()
-            .find(|disclosure| disclosure.get(1) == Some(&json!("household-summary")))
-            .expect("household-summary disclosure exists");
-        let disclosure_json = serde_json::to_string(&disclosures).expect("disclosures serialize");
-
-        assert!(disclosure_json.contains("household-summary"));
-        assert!(disclosure_json.contains("Ada"));
-        assert_eq!(household_disclosure[2]["value"]["name"], json!("Ada"));
-        assert_eq!(
-            household_disclosure[2]["value"]["household_id"],
-            json!("hh-1")
-        );
-        assert!(household_disclosure[2]["value"].get("ssn").is_none());
-        assert!(!disclosure_json.contains("ssn"), "{disclosure_json}");
-        assert!(
-            !disclosure_json.contains("123-45-6789"),
-            "{disclosure_json}"
-        );
-    }
-
-    #[test]
-    fn legacy_credential_disclosure_keeps_notary_result_wrapper() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let mut result = claim_result("date-of-birth");
-        result.value = Some(json!("2016-01-15"));
-
-        let signed = issue(
-            &test_profile(),
-            &issuer,
-            &[result],
-            "subject-ref",
-            None,
-            OffsetDateTime::now_utc(),
-            IssueOptions::default(),
-        )
-        .expect("credential issues");
-        let disclosures = decoded_disclosures(&signed);
-        let disclosure = disclosures
-            .iter()
-            .find(|disclosure| disclosure.get(1) == Some(&json!("date-of-birth")))
-            .expect("date-of-birth disclosure exists");
-
-        assert_eq!(disclosure[2]["claim_id"], json!("date-of-birth"));
-        assert_eq!(disclosure[2]["version"], json!("1.0.0"));
-        assert_eq!(disclosure[2]["value"], json!("2016-01-15"));
-        assert_eq!(disclosure[2]["satisfied"], json!(true));
-    }
-
-    #[test]
-    fn projected_credential_disclosures_use_output_names_and_domain_values() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let mut date = claim_result("date-of-birth");
-        date.value = Some(json!("2016-01-15"));
-        date.satisfied = None;
-        let mut place = claim_result("place-of-birth");
-        place.value = Some(json!("North City"));
-        place.satisfied = None;
-
-        let signed = issue(
-            &test_profile(),
-            &issuer,
-            &[date, place],
-            "subject-ref",
-            None,
-            OffsetDateTime::now_utc(),
-            IssueOptions {
-                projection: Some(vec![
-                    SdJwtProjectionClaim {
-                        claim_id: "date-of-birth".to_string(),
-                        output_name: "birth_date".to_string(),
-                    },
-                    SdJwtProjectionClaim {
-                        claim_id: "place-of-birth".to_string(),
-                        output_name: "birth_place_name".to_string(),
-                    },
-                ]),
-                ..IssueOptions::default()
-            },
-        )
-        .expect("projected credential issues");
-        let disclosures = decoded_disclosures(&signed);
-        let birth_date = disclosures
-            .iter()
-            .find(|disclosure| disclosure.get(1) == Some(&json!("birth_date")))
-            .expect("birth_date disclosure exists");
-        let birth_place = disclosures
-            .iter()
-            .find(|disclosure| disclosure.get(1) == Some(&json!("birth_place_name")))
-            .expect("birth_place_name disclosure exists");
-
-        assert_eq!(birth_date[2], json!("2016-01-15"));
-        assert_eq!(birth_place[2], json!("North City"));
-        assert!(birth_date[2].get("claim_id").is_none());
-        assert!(birth_place[2].get("version").is_none());
-    }
-
-    #[test]
-    fn projected_credential_rejects_missing_failed_or_null_results() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let projection = vec![SdJwtProjectionClaim {
-            claim_id: "date-of-birth".to_string(),
-            output_name: "birth_date".to_string(),
-        }];
-
-        let missing = issue(
-            &test_profile(),
-            &issuer,
-            &[claim_result("other")],
-            "subject-ref",
-            None,
-            OffsetDateTime::now_utc(),
-            IssueOptions {
-                projection: Some(projection.clone()),
-                ..IssueOptions::default()
-            },
-        )
-        .expect_err("missing projected result rejects");
-        assert!(matches!(missing, EvidenceError::CredentialIssuanceFailed));
-
-        let mut failed = claim_result("date-of-birth");
-        failed.satisfied = Some(false);
-        let failed_error = issue(
-            &test_profile(),
-            &issuer,
-            &[failed],
-            "subject-ref",
-            None,
-            OffsetDateTime::now_utc(),
-            IssueOptions {
-                projection: Some(projection.clone()),
-                ..IssueOptions::default()
-            },
-        )
-        .expect_err("failed projected result rejects");
-        assert!(matches!(
-            failed_error,
-            EvidenceError::CredentialIssuanceFailed
-        ));
-
-        let mut null = claim_result("date-of-birth");
-        null.value = Some(Value::Null);
-        let null_error = issue(
-            &test_profile(),
-            &issuer,
-            &[null],
-            "subject-ref",
-            None,
-            OffsetDateTime::now_utc(),
-            IssueOptions {
-                projection: Some(projection),
-                ..IssueOptions::default()
-            },
-        )
-        .expect_err("null projected result rejects");
-        assert!(matches!(
-            null_error,
-            EvidenceError::CredentialIssuanceFailed
-        ));
-    }
-
-    #[test]
-    fn issued_credential_uses_platform_holder_confirmation() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let holder = holder_did_jwk();
-        let signed = issue(
-            &test_profile(),
-            &issuer,
-            &[claim_result("first")],
-            &holder,
-            Some(&holder),
-            OffsetDateTime::now_utc(),
-            IssueOptions::default(),
-        )
-        .expect("credential issues");
-        let payload = payload(&signed);
-
-        assert_eq!(payload["cnf"]["kid"], holder);
-        assert_eq!(payload["cnf"]["jwk"]["kty"], "OKP");
-        assert_eq!(payload["cnf"]["jwk"]["crv"], "Ed25519");
-        assert!(payload["cnf"]["jwk"].get("d").is_none());
-    }
-
-    #[test]
-    fn holder_bound_credential_uses_holder_did_as_subject() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let holder = holder_did_jwk();
-        let mut result = claim_result("first");
-        result.target_ref = target_ref_view("registry-subject-ref");
-
-        let signed = issue(
-            &test_profile(),
-            &issuer,
-            &[result],
-            &holder,
-            Some(&holder),
-            OffsetDateTime::now_utc(),
-            IssueOptions::default(),
-        )
-        .expect("credential issues");
-        let payload = payload(&signed);
-
-        assert_eq!(payload["sub"], holder);
-        assert!(
-            !payload.to_string().contains("registry-subject-ref"),
-            "holder-bound JWT payload must not expose the raw registry subject_ref",
-        );
-    }
-
-    #[test]
-    fn credential_without_holder_uses_registry_subject_ref() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let mut result = claim_result("first");
-        result.target_ref = target_ref_view("registry-subject-ref");
-
-        let signed = issue(
-            &test_profile(),
-            &issuer,
-            &[result],
-            "registry-subject-ref",
-            None,
-            OffsetDateTime::now_utc(),
-            IssueOptions::default(),
-        )
-        .expect("credential issues");
-        let payload = payload(&signed);
-
-        assert_eq!(payload["sub"], "registry-subject-ref");
-    }
-
-    #[test]
-    fn default_holder_binding_rejects_credential_without_holder() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let profile = default_bound_profile();
-
-        let err = issue(
-            &profile,
-            &issuer,
-            &[claim_result("first")],
-            "registry-subject-ref",
-            None,
-            OffsetDateTime::now_utc(),
-            IssueOptions::default(),
-        )
-        .expect_err("default holder-bound profile requires holder material");
-
-        assert!(matches!(err, EvidenceError::HolderProofRequired));
-    }
-
-    #[test]
-    fn holder_required_profile_rejects_missing_or_unsupported_holder_binding() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let profile = holder_required_profile();
-        let iat = OffsetDateTime::from_unix_timestamp(1_700_000_000)
-            .expect("test fixture timestamp is valid");
-
-        let missing_holder = issue(
-            &profile,
-            &issuer,
-            &[claim_result("first")],
-            "subject-ref",
-            None,
-            iat,
-            IssueOptions::default(),
-        )
-        .expect_err("holder-bound profile requires holder proof material");
-        assert!(matches!(missing_holder, EvidenceError::HolderProofRequired));
-
-        let unsupported_holder = issue(
-            &profile,
-            &issuer,
-            &[claim_result("first")],
-            "did:key:z6Mkunsupported",
-            Some("did:key:z6Mkunsupported"),
-            iat,
-            IssueOptions::default(),
-        )
-        .expect_err("only did:jwk holder identifiers are supported");
-        assert!(matches!(
-            unsupported_holder,
-            EvidenceError::HolderProofRequired
-        ));
-    }
-
-    #[test]
-    fn issued_credential_iat_is_threaded_through_issue_not_recomputed() {
-        // Two re-issuances of the same evaluation must produce identical JWT
-        // `iat` because the caller threads `result.issued_at` through. The
-        // signed JWT payload `iat` is the load-bearing assertion: prior to
-        // the fix it was `OffsetDateTime::now_utc()` per call and drifted.
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let results = vec![claim_result("first"), claim_result("second")];
-        // Pin iat to a fixed instant in the past so wall-clock drift between
-        // the two issue() calls cannot accidentally produce equal values.
-        let pinned_iat =
-            OffsetDateTime::from_unix_timestamp(1_700_000_000).expect("valid unix timestamp");
-
-        let signed_1 = issue(
-            &test_profile(),
-            &issuer,
-            &results,
-            "subject-ref",
-            None,
-            pinned_iat,
-            IssueOptions::default(),
-        )
-        .expect("first issue");
-        // Force a measurable wall-clock gap between calls.
-        std::thread::sleep(std::time::Duration::from_millis(20));
-        let signed_2 = issue(
-            &test_profile(),
-            &issuer,
-            &results,
-            "subject-ref",
-            None,
-            pinned_iat,
-            IssueOptions::default(),
-        )
-        .expect("second issue");
-
-        let iat_1 = payload(&signed_1)["iat"]
-            .as_i64()
-            .expect("iat decodes as i64");
-        let iat_2 = payload(&signed_2)["iat"]
-            .as_i64()
-            .expect("iat decodes as i64");
-        assert_eq!(
-            iat_1, iat_2,
-            "JWT iat must be pinned to the threaded value, not OffsetDateTime::now_utc() per call",
-        );
-        assert_eq!(
-            iat_1,
-            pinned_iat.unix_timestamp(),
-            "JWT iat must equal the threaded OffsetDateTime",
-        );
-        // exp is derived from iat + validity, so it must also match.
-        let exp_1 = payload(&signed_1)["exp"].as_i64().expect("exp decodes");
-        let exp_2 = payload(&signed_2)["exp"].as_i64().expect("exp decodes");
-        assert_eq!(exp_1, exp_2, "exp must be derived from the threaded iat");
-        assert_eq!(
-            payload(&signed_1)["issuanceDate"],
-            json!("2023-11-14T22:13:20Z")
-        );
-        assert_eq!(
-            payload(&signed_1)["expirationDate"],
-            json!("2023-11-14T22:14:20Z")
-        );
-    }
-
-    #[test]
-    fn evidence_issuer_debug_omits_key_material() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let debug = format!("{issuer:?}");
-
-        assert!(debug.contains("EvidenceIssuer"));
-        assert!(debug.contains("did:web:issuer.test#key-1"));
-        assert!(!debug.contains("2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw"));
-        assert!(!debug.contains("1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc"));
-        assert!(!debug.contains("encoding_key"));
-    }
-
-    #[test]
-    fn signed_sd_jwt_vc_debug_redacts_compact_material() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let signed = issue(
-            &test_profile(),
-            &issuer,
-            &[claim_result("person-is-alive")],
-            "subject-ref",
-            None,
-            OffsetDateTime::now_utc(),
-            IssueOptions::default(),
-        )
-        .expect("credential issues");
-        let debug = format!("{signed:?}");
-
-        assert!(debug.contains("SignedSdJwtVc"));
-        assert!(debug.contains(&signed.credential_id));
-        assert!(debug.contains(&signed.issuer));
-        assert!(debug.contains(&signed.expires_at));
-        assert!(!debug.contains(&signed.compact));
-        assert!(!debug.contains(&signed.issuer_signed_jwt));
-        for disclosure in &signed.disclosures {
-            assert!(!debug.contains(disclosure));
-        }
-    }
-
-    #[test]
-    fn issued_sd_digests_are_sorted_by_digest() {
-        let issuer = EvidenceIssuer::from_jwk_str(RAW_JWK, "did:web:issuer.test#key-1".to_string())
-            .expect("test issuer builds");
-        let results = vec![
-            claim_result("third"),
-            claim_result("first"),
-            claim_result("second"),
-            claim_result("fourth"),
-        ];
-        let signed = issue(
-            &test_profile(),
-            &issuer,
-            &results,
-            "subject-ref",
-            None,
-            OffsetDateTime::now_utc(),
-            IssueOptions::default(),
-        )
-        .expect("credential issues");
-
-        let sd = payload_sd(&signed);
-        let mut sorted_disclosure_digests = disclosure_digests(&signed);
-        sorted_disclosure_digests.sort_unstable();
-
-        assert_eq!(sd, sorted_disclosure_digests);
-    }
-
-    fn test_profile() -> CredentialProfileConfig {
-        CredentialProfileConfig {
-            format: FORMAT_SD_JWT_VC.to_string(),
-            issuer: "did:web:issuer.test".to_string(),
-            signing_key: "issuer-key".to_string(),
-            vct: "https://vct.example/test".to_string(),
-            validity_seconds: 60,
-            holder_binding: HolderBindingConfig {
-                mode: "none".to_string(),
-                proof_of_possession: None,
-                allowed_did_methods: Vec::new(),
-            },
-            allowed_claims: Vec::new(),
-            disclosure: Default::default(),
-        }
-    }
-
-    fn default_bound_profile() -> CredentialProfileConfig {
-        CredentialProfileConfig {
-            holder_binding: Default::default(),
-            ..test_profile()
-        }
-    }
-
-    fn holder_required_profile() -> CredentialProfileConfig {
-        let mut profile = test_profile();
-        profile.holder_binding.mode = "did".to_string();
-        profile.holder_binding.proof_of_possession = Some("required".to_string());
-        profile.holder_binding.allowed_did_methods = vec!["did:jwk".to_string()];
-        profile
-    }
-
-    fn claim_result(claim_id: &str) -> ClaimResultView {
-        ClaimResultView {
-            evaluation_id: "eval-1".to_string(),
-            claim_id: claim_id.to_string(),
-            claim_version: "1.0.0".to_string(),
-            subject_type: "person".to_string(),
-            requester_ref: None,
-            target_ref: target_ref_view("subject-ref"),
-            value: Some(json!({ "claim": claim_id })),
-            satisfied: Some(true),
-            disclosure: "redacted".to_string(),
-            redacted_fields: Vec::new(),
-            format: "json".to_string(),
-            issued_at: "2026-05-23T00:00:00Z".to_string(),
-            expires_at: None,
-            provenance: ClaimProvenance::new(
-                "test".to_string(),
-                "eval-test".to_string(),
-                "claim".to_string(),
-                "1".to_string(),
-                crate::model::ProvenanceUsed {
-                    relay_consultation_count: 0,
-                },
-            ),
-        }
-    }
-
-    fn holder_did_jwk() -> String {
-        let holder = PrivateJwk::parse(RAW_JWK).expect("holder JWK parses");
-        did_jwk_from_public_jwk(&holder.public()).expect("did:jwk encodes")
-    }
-
-    fn payload_sd(signed: &SignedSdJwtVc) -> Vec<String> {
-        let payload = payload(signed);
-        payload["_sd"]
-            .as_array()
-            .expect("_sd is an array")
-            .iter()
-            .map(|value| value.as_str().expect("_sd digest is a string").to_string())
-            .collect()
-    }
-
-    fn payload(signed: &SignedSdJwtVc) -> Value {
-        let compact_jwt = signed
-            .compact
-            .split('~')
-            .next()
-            .expect("sd-jwt has compact jwt");
-        let payload = compact_jwt
-            .split('.')
-            .nth(1)
-            .expect("compact jwt has payload");
-        serde_json::from_slice(
-            &URL_SAFE_NO_PAD
-                .decode(payload)
-                .expect("payload decodes as base64url"),
-        )
-        .expect("payload decodes as JSON")
-    }
-
-    fn header(signed: &SignedSdJwtVc) -> Value {
-        let compact_jwt = signed
-            .compact
-            .split('~')
-            .next()
-            .expect("sd-jwt has compact jwt");
-        let header = compact_jwt
-            .split('.')
-            .next()
-            .expect("compact jwt has header");
-        serde_json::from_slice(
-            &URL_SAFE_NO_PAD
-                .decode(header)
-                .expect("header decodes as base64url"),
-        )
-        .expect("header decodes as JSON")
-    }
-
-    fn target_ref_view(handle: &str) -> TargetRefView {
-        TargetRefView {
-            entity_type: "Person".to_string(),
-            handle: handle.to_string(),
-            identifier_schemes: Vec::new(),
-            profile: None,
-        }
-    }
-
-    fn disclosure_digests(signed: &SignedSdJwtVc) -> Vec<String> {
-        signed
-            .compact
-            .split('~')
-            .skip(1)
-            .filter(|disclosure| !disclosure.is_empty())
-            .map(|disclosure| URL_SAFE_NO_PAD.encode(Sha256::digest(disclosure.as_bytes())))
-            .collect()
-    }
-
-    fn decoded_disclosures(signed: &SignedSdJwtVc) -> Vec<Value> {
-        signed
-            .disclosures
-            .iter()
-            .map(|disclosure| {
-                serde_json::from_slice(
-                    &URL_SAFE_NO_PAD
-                        .decode(disclosure)
-                        .expect("disclosure decodes as base64url"),
-                )
-                .expect("disclosure decodes as JSON")
-            })
-            .collect()
-    }
-}
diff --git a/crates/registry-notary-core/src/tokens.rs b/crates/registry-notary-core/src/tokens.rs
deleted file mode 100644
index 149341d8a..000000000
--- a/crates/registry-notary-core/src/tokens.rs
+++ /dev/null
@@ -1,1080 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Notary-issued JWT primitives for the pre-authorized-code OID4VCI flow.
-//!
-//! Two token classes are minted with the dedicated access-token signing key
-//! (never the SD-JWT VC credential-signing key):
-//!
-//! - The `pre-authorized_code`: a short-TTL JWT carrying a `jti` for single-use
-//!   tracking and the eSignet-verified subject claims, handed to the wallet
-//!   inside the credential offer.
-//! - The Notary access token: redeemed at the token endpoint and accepted by
-//!   the existing credential-endpoint consumers unchanged. Its `iss`/`aud`/`typ`
-//!   and alg pin the second verifier's trust anchor; its claim set reproduces
-//!   what an eSignet token would carry so subject binding, audience, and
-//!   subject-access classification pass identically.
-//!
-//! The verify helpers here are sufficient for unit-testing the mint/verify
-//! round-trip. PR3 wires the real middleware verification via the platform
-//! `TokenVerifier`.
-
-use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-use base64::Engine;
-use registry_platform_crypto::{verify as verify_signature, PublicJwk, SigningProvider};
-use serde_json::{Map, Value};
-use std::fmt;
-
-use crate::error::EvidenceError;
-
-/// JWT `alg` (and signing-key alg) for Notary-issued tokens.
-pub const NOTARY_TOKEN_SIGNING_ALG: &str = "EdDSA";
-
-/// Default header `typ` for the `pre-authorized_code` JWT.
-pub const PRE_AUTHORIZED_CODE_JWT_TYP: &str = "registry-notary-preauth-code+jwt";
-
-/// Default header `typ` for the Notary access token.
-pub const NOTARY_ACCESS_TOKEN_JWT_TYP: &str = "registry-notary-access+jwt";
-
-/// Header `typ` for Notary transaction tokens minted by the platform STS.
-pub const NOTARY_TRANSACTION_TOKEN_JWT_TYP: &str = "at+jwt";
-pub const NOTARY_AUTHORIZATION_DETAILS_TYPE: &str = "registry_notary_evidence_transaction";
-pub const NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION: &str =
-    "registry-notary-authorization-details/v1";
-
-/// The eSignet-verified subject the Notary binds a pre-authorized code and the
-/// resulting access token to. Captured at the offer callback.
-///
-/// `subject_binding_value` (the civil ID identified by `subject_binding_claim`)
-/// is load-bearing: the credential endpoint attests the claim for this subject.
-#[derive(Clone)]
-pub struct BoundSubject {
-    /// Token `sub`.
-    pub subject: String,
-    /// Claim name holding the civil ID (e.g.
-    /// `subject_access.subject_binding.token_claim`).
-    pub subject_binding_claim: String,
-    /// The civil ID value, reproduced exactly from the eSignet id_token.
-    pub subject_binding_value: String,
-    /// Citizen `client_id` mapped to an allowed citizen client.
-    pub client_id: String,
-    /// OAuth scopes; must include the subject-access required scopes.
-    pub scopes: Vec<String>,
-    /// Assurance level (`acr`), if present.
-    pub acr: Option<String>,
-    /// Authentication time (`auth_time`), if present.
-    pub auth_time: Option<i64>,
-}
-
-impl fmt::Debug for BoundSubject {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("BoundSubject")
-            .field("subject", &"[redacted]")
-            .field("subject_binding_claim", &self.subject_binding_claim)
-            .field("subject_binding_value", &"[redacted]")
-            .field("client_id", &self.client_id)
-            .field("scopes", &self.scopes)
-            .field("acr", &self.acr)
-            .field("auth_time", &self.auth_time)
-            .finish()
-    }
-}
-
-/// Inputs for minting a `pre-authorized_code` JWT.
-#[derive(Clone, Debug)]
-pub struct PreAuthorizedCodeClaims {
-    /// Notary token issuer (`iss`).
-    pub issuer: String,
-    /// Single-use identifier tracked in the replay store by PR3 (`jti`).
-    pub jti: String,
-    /// Selected credential configuration the code is bound to.
-    pub credential_configuration_id: String,
-    /// Opaque identifier of the immutable registry-backed issuance transaction.
-    pub issuance_transaction_id: String,
-    /// Versioned commitment over the authority-bearing transaction fields.
-    pub issuance_transaction_commitment: String,
-    /// Whether this individual code requires the holder-presented transaction
-    /// code advertised with its credential offer.
-    pub tx_code_required: bool,
-    /// eSignet-verified subject claims carried into the code.
-    pub subject: BoundSubject,
-    /// Issued-at (unix seconds).
-    pub iat: i64,
-    /// Expiry (unix seconds).
-    pub exp: i64,
-}
-
-/// Inputs for minting a Notary access token.
-#[derive(Clone, Debug)]
-pub struct AccessTokenClaims {
-    /// Notary token issuer (`iss`); must equal the second verifier's pinned
-    /// issuer.
-    pub issuer: String,
-    /// Optional JWT id (`jti`) for transaction-token replay protection.
-    pub jti: Option<String>,
-    /// Accepted audiences (`aud`); must satisfy
-    /// `oid4vci.accepted_token_audiences` and
-    /// `subject_access.citizen_clients.allowed_audiences`.
-    pub audiences: Vec<String>,
-    /// Token-type claim surfaced to the credential endpoint.
-    pub token_type: String,
-    /// Credential configuration the token is scoped to.
-    pub credential_configuration_id: String,
-    /// Opaque identifier of the immutable registry-backed issuance transaction.
-    pub issuance_transaction_id: String,
-    /// Versioned commitment copied from the pre-authorized code transaction.
-    pub issuance_transaction_commitment: String,
-    /// eSignet-verified subject claims.
-    pub subject: BoundSubject,
-    /// OAuth 2.0 Rich Authorization Requests-shaped authorization details.
-    pub authorization_details: Vec<Value>,
-    /// Sender constraint confirmation (`cnf`) copied from the verified subject
-    /// token when the deployment profile requires sender-constrained tokens.
-    pub confirmation: Option<Value>,
-    /// Verified assisted-access actor envelope. Public responses must not copy
-    /// this wholesale; it is for restricted audit/evaluation records.
-    pub actor: Option<Value>,
-    /// Issued-at (unix seconds).
-    pub iat: i64,
-    /// Expiry (unix seconds).
-    pub exp: i64,
-}
-
-/// A minted, signed Notary JWT. The compact form is a secret (it is a bearer
-/// token), so its `Debug` redacts it.
-#[derive(Clone)]
-pub struct SignedNotaryToken {
-    /// Header `typ`.
-    pub typ: String,
-    /// `jti` for the pre-authorized code; `None` for access tokens.
-    pub jti: Option<String>,
-    /// Compact `header.payload.signature` JWT.
-    pub compact: String,
-}
-
-impl fmt::Debug for SignedNotaryToken {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("SignedNotaryToken")
-            .field("typ", &self.typ)
-            .field("jti", &self.jti)
-            .field("compact", &"[redacted]")
-            .finish()
-    }
-}
-
-/// Mint a signed `pre-authorized_code` JWT with the access-token signing key.
-pub async fn mint_pre_authorized_code(
-    signer: &dyn SigningProvider,
-    typ: &str,
-    claims: &PreAuthorizedCodeClaims,
-) -> Result<SignedNotaryToken, EvidenceError> {
-    let mut payload = Map::new();
-    payload.insert("iss".to_string(), Value::String(claims.issuer.clone()));
-    payload.insert("jti".to_string(), Value::String(claims.jti.clone()));
-    payload.insert(
-        "credential_configuration_id".to_string(),
-        Value::String(claims.credential_configuration_id.clone()),
-    );
-    payload.insert(
-        "issuance_transaction_id".to_string(),
-        Value::String(claims.issuance_transaction_id.clone()),
-    );
-    payload.insert(
-        "issuance_transaction_commitment".to_string(),
-        Value::String(claims.issuance_transaction_commitment.clone()),
-    );
-    payload.insert(
-        "tx_code_required".to_string(),
-        Value::Bool(claims.tx_code_required),
-    );
-    payload.insert("iat".to_string(), Value::from(claims.iat));
-    payload.insert("nbf".to_string(), Value::from(claims.iat));
-    payload.insert("exp".to_string(), Value::from(claims.exp));
-    insert_subject_claims(&mut payload, &claims.subject)?;
-    let compact = sign_compact_jwt(signer, typ, Value::Object(payload)).await?;
-    Ok(SignedNotaryToken {
-        typ: typ.to_string(),
-        jti: Some(claims.jti.clone()),
-        compact,
-    })
-}
-
-/// Mint a signed Notary access token with the access-token signing key.
-///
-/// The claim set is the security-critical contract consumed unchanged by the
-/// credential endpoint: `iss`, `aud`, `sub`, `client_id`, `token_type`,
-/// `scope`, the subject-binding claim, `acr`/`auth_time`, and `iat`/`nbf`/`exp`.
-pub async fn mint_access_token(
-    signer: &dyn SigningProvider,
-    typ: &str,
-    claims: &AccessTokenClaims,
-) -> Result<SignedNotaryToken, EvidenceError> {
-    let mut payload = Map::new();
-    payload.insert("iss".to_string(), Value::String(claims.issuer.clone()));
-    if let Some(jti) = &claims.jti {
-        payload.insert("jti".to_string(), Value::String(jti.clone()));
-    }
-    payload.insert("aud".to_string(), audience_value(&claims.audiences));
-    payload.insert(
-        "token_type".to_string(),
-        Value::String(claims.token_type.clone()),
-    );
-    payload.insert(
-        "credential_configuration_id".to_string(),
-        Value::String(claims.credential_configuration_id.clone()),
-    );
-    payload.insert(
-        "issuance_transaction_id".to_string(),
-        Value::String(claims.issuance_transaction_id.clone()),
-    );
-    payload.insert(
-        "issuance_transaction_commitment".to_string(),
-        Value::String(claims.issuance_transaction_commitment.clone()),
-    );
-    payload.insert("iat".to_string(), Value::from(claims.iat));
-    payload.insert("nbf".to_string(), Value::from(claims.iat));
-    payload.insert("exp".to_string(), Value::from(claims.exp));
-    if !claims.authorization_details.is_empty() {
-        payload.insert(
-            "authorization_details".to_string(),
-            Value::Array(claims.authorization_details.clone()),
-        );
-    }
-    if let Some(cnf) = &claims.confirmation {
-        payload.insert("cnf".to_string(), cnf.clone());
-    }
-    if let Some(actor) = &claims.actor {
-        payload.insert("act".to_string(), actor.clone());
-    }
-    insert_subject_claims(&mut payload, &claims.subject)?;
-    let compact = sign_compact_jwt(signer, typ, Value::Object(payload)).await?;
-    Ok(SignedNotaryToken {
-        typ: typ.to_string(),
-        jti: None,
-        compact,
-    })
-}
-
-/// The decoded header and payload of a verified Notary token, exposed so unit
-/// tests can assert on the exact claim set.
-#[derive(Clone, Debug)]
-pub struct VerifiedNotaryToken {
-    pub header: Value,
-    pub payload: Value,
-}
-
-impl VerifiedNotaryToken {
-    #[must_use]
-    pub fn claim_str(&self, name: &str) -> Option<&str> {
-        self.payload.get(name).and_then(Value::as_str)
-    }
-
-    #[must_use]
-    pub fn claim_i64(&self, name: &str) -> Option<i64> {
-        self.payload.get(name).and_then(Value::as_i64)
-    }
-
-    /// Space-separated `scope` claim split into individual scopes. Empty
-    /// segments (from leading, trailing, or repeated spaces) are dropped.
-    #[must_use]
-    pub fn scopes(&self) -> Vec<String> {
-        self.claim_str("scope")
-            .map(|scope| {
-                scope
-                    .split(' ')
-                    .filter(|segment| !segment.is_empty())
-                    .map(ToString::to_string)
-                    .collect()
-            })
-            .unwrap_or_default()
-    }
-}
-
-/// Verify a Notary token against the access-token signing key's public JWK.
-///
-/// Enforces: header alg in the allow-list, the expected `typ`, signature,
-/// `iss` exactly equal, `aud` membership (when expected audiences are given),
-/// and `exp`/`nbf` against `now`. This mirrors what PR3's middleware verifier
-/// pins and is sufficient for the unit-test round-trip. Every failure collapses
-/// to `EvidenceError::MissingCredential`, matching the middleware's no-info-leak
-/// failure mapping.
-pub fn verify_notary_token(
-    compact: &str,
-    public_jwk: &PublicJwk,
-    expected_typ: &str,
-    expected_issuer: &str,
-    expected_audiences: &[String],
-    now: i64,
-) -> Result<VerifiedNotaryToken, EvidenceError> {
-    let (header_b64, payload_b64, signature_b64) = split_compact(compact)?;
-    // Verify the signature over the raw segments BEFORE decoding any JSON, so a
-    // malformed or hostile header/payload never reaches the JSON parser on an
-    // unauthenticated token. The expected key is supplied by the caller, so the
-    // header is not needed to locate it; the key fixes the algorithm.
-    let signing_input = format!("{header_b64}.{payload_b64}");
-    let signature = URL_SAFE_NO_PAD
-        .decode(signature_b64)
-        .map_err(|_| EvidenceError::MissingCredential)?;
-    verify_signature(signing_input.as_bytes(), &signature, public_jwk)
-        .map_err(|_| EvidenceError::MissingCredential)?;
-    let header = decode_segment_json(header_b64)?;
-    if header.get("alg").and_then(Value::as_str) != Some(NOTARY_TOKEN_SIGNING_ALG) {
-        return Err(EvidenceError::MissingCredential);
-    }
-    if header.get("typ").and_then(Value::as_str) != Some(expected_typ) {
-        return Err(EvidenceError::MissingCredential);
-    }
-    if expected_typ == NOTARY_TRANSACTION_TOKEN_JWT_TYP
-        && header
-            .get("kid")
-            .and_then(Value::as_str)
-            .map(str::is_empty)
-            .unwrap_or(true)
-    {
-        return Err(EvidenceError::MissingCredential);
-    }
-    let payload = decode_segment_json(payload_b64)?;
-    if expected_typ == NOTARY_TRANSACTION_TOKEN_JWT_TYP {
-        require_nonempty_claim(&payload, "jti")?;
-        require_nonempty_claim(&payload, "sub")?;
-        require_nonempty_claim(&payload, "scope")?;
-        require_authorization_details(&payload)?;
-        if payload.get("cnf").is_some() {
-            return Err(EvidenceError::MissingCredential);
-        }
-    }
-    if payload.get("iss").and_then(Value::as_str) != Some(expected_issuer) {
-        return Err(EvidenceError::MissingCredential);
-    }
-    if !expected_audiences.is_empty() && !audience_matches(&payload, expected_audiences) {
-        return Err(EvidenceError::MissingCredential);
-    }
-    let exp = payload
-        .get("exp")
-        .and_then(Value::as_i64)
-        .ok_or(EvidenceError::MissingCredential)?;
-    if now >= exp {
-        return Err(EvidenceError::MissingCredential);
-    }
-    if let Some(nbf) = payload.get("nbf").and_then(Value::as_i64) {
-        if now < nbf {
-            return Err(EvidenceError::MissingCredential);
-        }
-    }
-    Ok(VerifiedNotaryToken { header, payload })
-}
-
-/// Claim names the Notary tokens already populate. A configured
-/// `subject_binding_claim` must not collide with any of these, or inserting it
-/// would overwrite a standard or required claim (`iss`/`aud`/`exp`/...).
-const RESERVED_TOKEN_CLAIMS: &[&str] = &[
-    "iss",
-    "sub",
-    "aud",
-    "exp",
-    "nbf",
-    "iat",
-    "jti",
-    "authorization_details",
-    "cnf",
-    "act",
-    "scope",
-    "client_id",
-    "token_type",
-    "credential_configuration_id",
-    "issuance_transaction_id",
-    "issuance_transaction_commitment",
-    "tx_code_required",
-    "acr",
-    "auth_time",
-];
-
-fn insert_subject_claims(
-    payload: &mut Map<String, Value>,
-    subject: &BoundSubject,
-) -> Result<(), EvidenceError> {
-    // A subject-binding claim configured to a reserved/emitted claim name would
-    // overwrite it (e.g. clobbering `aud` with the civil ID). Refuse to mint
-    // rather than emit a malformed token.
-    if RESERVED_TOKEN_CLAIMS.contains(&subject.subject_binding_claim.as_str()) {
-        return Err(EvidenceError::CredentialIssuanceFailed);
-    }
-    payload.insert("sub".to_string(), Value::String(subject.subject.clone()));
-    payload.insert(
-        "client_id".to_string(),
-        Value::String(subject.client_id.clone()),
-    );
-    payload.insert("scope".to_string(), Value::String(subject.scopes.join(" ")));
-    // The subject-binding claim (the civil ID) is load-bearing: the credential
-    // endpoint reads it to identify whose status is attested.
-    payload.insert(
-        subject.subject_binding_claim.clone(),
-        Value::String(subject.subject_binding_value.clone()),
-    );
-    if let Some(acr) = &subject.acr {
-        payload.insert("acr".to_string(), Value::String(acr.clone()));
-    }
-    if let Some(auth_time) = subject.auth_time {
-        payload.insert("auth_time".to_string(), Value::from(auth_time));
-    }
-    Ok(())
-}
-
-fn require_nonempty_claim(payload: &Value, name: &str) -> Result<(), EvidenceError> {
-    if payload
-        .get(name)
-        .and_then(Value::as_str)
-        .is_some_and(|value| !value.trim().is_empty())
-    {
-        return Ok(());
-    }
-    Err(EvidenceError::MissingCredential)
-}
-
-fn require_authorization_details(payload: &Value) -> Result<(), EvidenceError> {
-    let Some(details) = payload
-        .get("authorization_details")
-        .and_then(Value::as_array)
-    else {
-        return Err(EvidenceError::MissingCredential);
-    };
-    let has_matching_detail = details.iter().filter_map(Value::as_object).any(|detail| {
-        detail.get("type").and_then(Value::as_str) == Some(NOTARY_AUTHORIZATION_DETAILS_TYPE)
-            && detail.get("schema_version").and_then(Value::as_str)
-                == Some(NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION)
-    });
-    if !has_matching_detail {
-        return Err(EvidenceError::MissingCredential);
-    }
-    Ok(())
-}
-
-fn audience_value(audiences: &[String]) -> Value {
-    if audiences.len() == 1 {
-        Value::String(audiences[0].clone())
-    } else {
-        Value::Array(audiences.iter().cloned().map(Value::String).collect())
-    }
-}
-
-fn audience_matches(payload: &Value, expected: &[String]) -> bool {
-    match payload.get("aud") {
-        Some(Value::String(aud)) => expected.iter().any(|candidate| candidate == aud),
-        Some(Value::Array(values)) => values
-            .iter()
-            .filter_map(Value::as_str)
-            .any(|aud| expected.iter().any(|candidate| candidate.as_str() == aud)),
-        _ => false,
-    }
-}
-
-async fn sign_compact_jwt(
-    signer: &dyn SigningProvider,
-    typ: &str,
-    payload: Value,
-) -> Result<String, EvidenceError> {
-    let public_jwk = signer.public_jwk();
-    let kid = public_jwk
-        .kid
-        .clone()
-        .filter(|kid| kid == signer.key_id())
-        .ok_or(EvidenceError::CredentialIssuanceFailed)?;
-    let header = serde_json::json!({
-        "alg": NOTARY_TOKEN_SIGNING_ALG,
-        "typ": typ,
-        "kid": kid,
-    });
-    let header_b64 = URL_SAFE_NO_PAD
-        .encode(serde_json::to_vec(&header).map_err(|_| EvidenceError::CredentialIssuanceFailed)?);
-    let payload_b64 = URL_SAFE_NO_PAD
-        .encode(serde_json::to_vec(&payload).map_err(|_| EvidenceError::CredentialIssuanceFailed)?);
-    let signing_input = format!("{header_b64}.{payload_b64}");
-    let signature = signer
-        .sign(signing_input.as_bytes())
-        .await
-        .map_err(|_| EvidenceError::CredentialIssuanceFailed)?;
-    // Self-check so a misbehaving signer cannot emit an unverifiable token.
-    verify_signature(signing_input.as_bytes(), &signature, &public_jwk)
-        .map_err(|_| EvidenceError::CredentialIssuanceFailed)?;
-    Ok(format!(
-        "{signing_input}.{}",
-        URL_SAFE_NO_PAD.encode(signature)
-    ))
-}
-
-fn split_compact(compact: &str) -> Result<(&str, &str, &str), EvidenceError> {
-    let mut parts = compact.split('.');
-    let header = parts.next().ok_or(EvidenceError::MissingCredential)?;
-    let payload = parts.next().ok_or(EvidenceError::MissingCredential)?;
-    let signature = parts.next().ok_or(EvidenceError::MissingCredential)?;
-    if parts.next().is_some() || header.is_empty() || payload.is_empty() || signature.is_empty() {
-        return Err(EvidenceError::MissingCredential);
-    }
-    Ok((header, payload, signature))
-}
-
-fn decode_segment_json(segment: &str) -> Result<Value, EvidenceError> {
-    let bytes = URL_SAFE_NO_PAD
-        .decode(segment)
-        .map_err(|_| EvidenceError::MissingCredential)?;
-    serde_json::from_slice(&bytes).map_err(|_| EvidenceError::MissingCredential)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use registry_platform_crypto::{LocalJwkSigner, PrivateJwk};
-
-    // Stands in for the dedicated access-token signing key.
-    const ACCESS_TOKEN_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA"}"#;
-    // Stands in for the SD-JWT VC credential-signing key (a different key).
-    const CREDENTIAL_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"f4QIxnAyRWzhuBOmNRgvBTE56mWePdsPL0mvCtl8Gys","x":"pv4e_hXHBLN27rcs6VDFV1ED0TiU8M3xy9vsuWFEsec","alg":"EdDSA"}"#;
-
-    const ISSUER: &str = "http://127.0.0.1:4325";
-    const AUDIENCE: &str = "http://127.0.0.1:4325";
-    const SUBJECT_BINDING_CLAIM: &str = "https://id.example.gov/claims/national_id";
-    const CIVIL_ID: &str = "NAT-123456";
-    const NOW: i64 = 1_700_000_000;
-
-    fn signer(raw: &str, kid: &str) -> LocalJwkSigner {
-        let mut jwk = PrivateJwk::parse(raw).expect("test JWK parses");
-        jwk.kid = Some(kid.to_string());
-        jwk.alg = Some(NOTARY_TOKEN_SIGNING_ALG.to_string());
-        LocalJwkSigner::new(jwk).expect("local signer builds")
-    }
-
-    fn access_token_signer() -> LocalJwkSigner {
-        signer(ACCESS_TOKEN_JWK, "did:web:issuer.example#access-token-key")
-    }
-
-    fn credential_signer() -> LocalJwkSigner {
-        signer(CREDENTIAL_JWK, "did:web:issuer.example#credential-key")
-    }
-
-    fn bound_subject() -> BoundSubject {
-        BoundSubject {
-            subject: "citizen-subject-1".to_string(),
-            subject_binding_claim: SUBJECT_BINDING_CLAIM.to_string(),
-            subject_binding_value: CIVIL_ID.to_string(),
-            client_id: "registry-lab-live-client".to_string(),
-            scopes: vec!["openid".to_string(), "subject_access".to_string()],
-            acr: Some("urn:example:loa:substantial".to_string()),
-            auth_time: Some(NOW - 30),
-        }
-    }
-
-    fn access_token_claims() -> AccessTokenClaims {
-        AccessTokenClaims {
-            issuer: ISSUER.to_string(),
-            jti: None,
-            audiences: vec![AUDIENCE.to_string()],
-            token_type: "Bearer".to_string(),
-            credential_configuration_id: "date_of_birth_sd_jwt".to_string(),
-            issuance_transaction_id: "transaction-123".to_string(),
-            issuance_transaction_commitment: "sha256:transaction".to_string(),
-            subject: bound_subject(),
-            authorization_details: Vec::new(),
-            confirmation: None,
-            actor: None,
-            iat: NOW,
-            exp: NOW + 300,
-        }
-    }
-
-    fn transaction_token_claims() -> AccessTokenClaims {
-        AccessTokenClaims {
-            issuer: ISSUER.to_string(),
-            jti: Some("01J0000000000000000000TXN1".to_string()),
-            audiences: vec![AUDIENCE.to_string()],
-            token_type: "Bearer".to_string(),
-            credential_configuration_id: "date_of_birth_sd_jwt".to_string(),
-            issuance_transaction_id: "transaction-123".to_string(),
-            issuance_transaction_commitment: "sha256:transaction".to_string(),
-            subject: bound_subject(),
-            authorization_details: vec![serde_json::json!({
-                "type": NOTARY_AUTHORIZATION_DETAILS_TYPE,
-                "schema_version": NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION,
-                "actions": ["evaluate"],
-                "locations": [AUDIENCE],
-            })],
-            confirmation: None,
-            actor: Some(serde_json::json!({
-                "actor_id_hash": "hmac-sha256:actor",
-                "assurance": "workforce-login",
-                "delegation_ref": "delegation-123",
-            })),
-            iat: NOW,
-            exp: NOW + 300,
-        }
-    }
-
-    fn pre_authorized_code_claims() -> PreAuthorizedCodeClaims {
-        PreAuthorizedCodeClaims {
-            issuer: ISSUER.to_string(),
-            jti: "01J0000000000000000000PREAU".to_string(),
-            credential_configuration_id: "date_of_birth_sd_jwt".to_string(),
-            issuance_transaction_id: "01J0000000000000000000PREAU".to_string(),
-            issuance_transaction_commitment: "sha256:transaction".to_string(),
-            tx_code_required: true,
-            subject: bound_subject(),
-            iat: NOW,
-            exp: NOW + 120,
-        }
-    }
-
-    fn block_on<F: std::future::Future>(future: F) -> F::Output {
-        tokio::runtime::Builder::new_current_thread()
-            .enable_all()
-            .build()
-            .expect("test runtime builds")
-            .block_on(future)
-    }
-
-    #[test]
-    fn access_token_round_trip_carries_full_required_claim_set() {
-        let signer = access_token_signer();
-        let token = block_on(mint_access_token(
-            &signer,
-            NOTARY_ACCESS_TOKEN_JWT_TYP,
-            &access_token_claims(),
-        ))
-        .expect("access token mints");
-        assert!(token.jti.is_none());
-
-        let verified = verify_notary_token(
-            &token.compact,
-            &signer.public_jwk(),
-            NOTARY_ACCESS_TOKEN_JWT_TYP,
-            ISSUER,
-            &[AUDIENCE.to_string()],
-            NOW + 1,
-        )
-        .expect("access token verifies");
-
-        // Header: alg + the distinct access-token typ + the access-token kid.
-        assert_eq!(verified.header["alg"], NOTARY_TOKEN_SIGNING_ALG);
-        assert_eq!(verified.header["typ"], NOTARY_ACCESS_TOKEN_JWT_TYP);
-        assert_eq!(
-            verified.header["kid"],
-            "did:web:issuer.example#access-token-key"
-        );
-
-        // iss: pinned by the second verifier (standalone.rs authenticate_oidc).
-        assert_eq!(verified.claim_str("iss"), Some(ISSUER));
-        // aud: require_oid4vci_token_audience (api.rs:2296) + citizen audience.
-        assert_eq!(verified.payload["aud"], AUDIENCE);
-        // sub + subject_binding claim: oid4vci_bound_subject (api.rs:2317) and
-        // bounded_verified_claims_from_oidc (standalone.rs:2437).
-        assert_eq!(verified.claim_str("sub"), Some("citizen-subject-1"));
-        assert_eq!(verified.claim_str(SUBJECT_BINDING_CLAIM), Some(CIVIL_ID));
-        // client_id + scope: classify_subject_access_principal (api.rs:2585).
-        assert_eq!(
-            verified.claim_str("client_id"),
-            Some("registry-lab-live-client")
-        );
-        assert_eq!(
-            verified.scopes(),
-            vec!["openid".to_string(), "subject_access".to_string()]
-        );
-        // token_type, acr, auth_time, exp, iat, nbf: BoundedVerifiedClaims.
-        assert_eq!(verified.claim_str("token_type"), Some("Bearer"));
-        assert_eq!(
-            verified.claim_str("acr"),
-            Some("urn:example:loa:substantial")
-        );
-        assert_eq!(verified.claim_i64("auth_time"), Some(NOW - 30));
-        assert_eq!(verified.claim_i64("iat"), Some(NOW));
-        assert_eq!(verified.claim_i64("nbf"), Some(NOW));
-        assert_eq!(verified.claim_i64("exp"), Some(NOW + 300));
-        assert_eq!(
-            verified.claim_str("credential_configuration_id"),
-            Some("date_of_birth_sd_jwt")
-        );
-    }
-
-    #[test]
-    fn pre_authorized_code_round_trip_carries_jti_subject_and_tx_code_requirement() {
-        let signer = access_token_signer();
-        let claims = pre_authorized_code_claims();
-        let token = block_on(mint_pre_authorized_code(
-            &signer,
-            PRE_AUTHORIZED_CODE_JWT_TYP,
-            &claims,
-        ))
-        .expect("pre-authorized code mints");
-        assert_eq!(token.jti.as_deref(), Some(claims.jti.as_str()));
-
-        let verified = verify_notary_token(
-            &token.compact,
-            &signer.public_jwk(),
-            PRE_AUTHORIZED_CODE_JWT_TYP,
-            ISSUER,
-            &[],
-            NOW + 1,
-        )
-        .expect("pre-authorized code verifies");
-
-        assert_eq!(verified.header["typ"], PRE_AUTHORIZED_CODE_JWT_TYP);
-        assert_eq!(verified.claim_str("jti"), Some(claims.jti.as_str()));
-        assert_eq!(verified.claim_str("sub"), Some("citizen-subject-1"));
-        assert_eq!(verified.claim_str(SUBJECT_BINDING_CLAIM), Some(CIVIL_ID));
-        assert_eq!(
-            verified.claim_str("credential_configuration_id"),
-            Some("date_of_birth_sd_jwt")
-        );
-        assert_eq!(verified.payload["tx_code_required"], true);
-    }
-
-    #[test]
-    fn transaction_token_round_trip_requires_jti_authz_details_and_actor() {
-        let signer = access_token_signer();
-        let claims = transaction_token_claims();
-        let token = block_on(mint_access_token(
-            &signer,
-            NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-            &claims,
-        ))
-        .expect("transaction token mints");
-
-        let verified = verify_notary_token(
-            &token.compact,
-            &signer.public_jwk(),
-            NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-            ISSUER,
-            &[AUDIENCE.to_string()],
-            NOW + 1,
-        )
-        .expect("transaction token verifies");
-
-        assert_eq!(verified.header["typ"], NOTARY_TRANSACTION_TOKEN_JWT_TYP);
-        assert_eq!(
-            verified.header["kid"],
-            "did:web:issuer.example#access-token-key"
-        );
-        assert_eq!(
-            verified.claim_str("jti"),
-            Some("01J0000000000000000000TXN1")
-        );
-        assert!(verified.payload.get("cnf").is_none());
-        assert_eq!(
-            verified.payload["authorization_details"][0]["type"],
-            NOTARY_AUTHORIZATION_DETAILS_TYPE
-        );
-        assert_eq!(
-            verified.payload["authorization_details"][0]["schema_version"],
-            NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION
-        );
-        assert_eq!(
-            verified.payload["act"]["actor_id_hash"],
-            "hmac-sha256:actor"
-        );
-        assert_eq!(verified.payload["act"]["delegation_ref"], "delegation-123");
-    }
-
-    #[test]
-    fn transaction_token_accepts_matching_authorization_details_after_other_entries() {
-        let signer = access_token_signer();
-        let mut claims = transaction_token_claims();
-        claims.authorization_details.insert(
-            0,
-            serde_json::json!({
-                "type": "unrelated_authorization_detail",
-                "schema_version": "example/v1",
-            }),
-        );
-        let token = block_on(mint_access_token(
-            &signer,
-            NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-            &claims,
-        ))
-        .expect("transaction token mints");
-
-        verify_notary_token(
-            &token.compact,
-            &signer.public_jwk(),
-            NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-            ISSUER,
-            &[AUDIENCE.to_string()],
-            NOW + 1,
-        )
-        .expect("matching authorization_details need not be first");
-    }
-
-    #[test]
-    fn transaction_token_verify_rejects_unvalidated_sender_constraint() {
-        let signer = access_token_signer();
-        let claims = AccessTokenClaims {
-            confirmation: Some(serde_json::json!({"jkt": "sender-key-thumbprint"})),
-            ..transaction_token_claims()
-        };
-        let token = block_on(mint_access_token(
-            &signer,
-            NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-            &claims,
-        ))
-        .expect("transaction token mints");
-
-        let error = verify_notary_token(
-            &token.compact,
-            &signer.public_jwk(),
-            NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-            ISSUER,
-            &[AUDIENCE.to_string()],
-            NOW + 1,
-        )
-        .expect_err("cnf without proof validation must be rejected");
-
-        assert!(matches!(error, EvidenceError::MissingCredential));
-    }
-
-    #[test]
-    fn transaction_token_verify_rejects_missing_authorization_details() {
-        let signer = access_token_signer();
-        let claims = AccessTokenClaims {
-            authorization_details: Vec::new(),
-            ..transaction_token_claims()
-        };
-        let token = block_on(mint_access_token(
-            &signer,
-            NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-            &claims,
-        ))
-        .expect("transaction token mints");
-
-        let error = verify_notary_token(
-            &token.compact,
-            &signer.public_jwk(),
-            NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-            ISSUER,
-            &[AUDIENCE.to_string()],
-            NOW + 1,
-        )
-        .expect_err("missing authorization_details must be rejected");
-
-        assert!(matches!(error, EvidenceError::MissingCredential));
-    }
-
-    #[test]
-    fn transaction_token_verify_rejects_wrong_authorization_details_type() {
-        let signer = access_token_signer();
-        let claims = AccessTokenClaims {
-            authorization_details: vec![serde_json::json!({
-                "type": "registry_notary_subject_access",
-                "schema_version": NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION,
-            })],
-            ..transaction_token_claims()
-        };
-        let token = block_on(mint_access_token(
-            &signer,
-            NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-            &claims,
-        ))
-        .expect("transaction token mints");
-
-        let error = verify_notary_token(
-            &token.compact,
-            &signer.public_jwk(),
-            NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-            ISSUER,
-            &[AUDIENCE.to_string()],
-            NOW + 1,
-        )
-        .expect_err("wrong authorization_details type must be rejected");
-
-        assert!(matches!(error, EvidenceError::MissingCredential));
-    }
-
-    #[test]
-    fn verify_rejects_token_signed_by_a_different_key() {
-        let access = access_token_signer();
-        let credential = credential_signer();
-        // Sign with the access-token key, then verify against the credential
-        // key's public JWK.
-        let token = block_on(mint_access_token(
-            &access,
-            NOTARY_ACCESS_TOKEN_JWT_TYP,
-            &access_token_claims(),
-        ))
-        .expect("access token mints");
-
-        let error = verify_notary_token(
-            &token.compact,
-            &credential.public_jwk(),
-            NOTARY_ACCESS_TOKEN_JWT_TYP,
-            ISSUER,
-            &[AUDIENCE.to_string()],
-            NOW + 1,
-        )
-        .expect_err("a token signed by a different key must be rejected");
-        assert!(matches!(error, EvidenceError::MissingCredential));
-    }
-
-    #[test]
-    fn verify_rejects_token_signed_by_the_credential_key() {
-        // A token claiming the Notary issuer/typ but signed by the credential
-        // key must not verify against the access-token public key.
-        let credential = credential_signer();
-        let access = access_token_signer();
-        let token = block_on(mint_access_token(
-            &credential,
-            NOTARY_ACCESS_TOKEN_JWT_TYP,
-            &access_token_claims(),
-        ))
-        .expect("token mints with the credential key");
-
-        let error = verify_notary_token(
-            &token.compact,
-            &access.public_jwk(),
-            NOTARY_ACCESS_TOKEN_JWT_TYP,
-            ISSUER,
-            &[AUDIENCE.to_string()],
-            NOW + 1,
-        )
-        .expect_err("a credential-key-signed token must be rejected");
-        assert!(matches!(error, EvidenceError::MissingCredential));
-    }
-
-    #[test]
-    fn verify_rejects_wrong_typ() {
-        let signer = access_token_signer();
-        let token = block_on(mint_access_token(
-            &signer,
-            NOTARY_ACCESS_TOKEN_JWT_TYP,
-            &access_token_claims(),
-        ))
-        .expect("access token mints");
-
-        let error = verify_notary_token(
-            &token.compact,
-            &signer.public_jwk(),
-            PRE_AUTHORIZED_CODE_JWT_TYP,
-            ISSUER,
-            &[AUDIENCE.to_string()],
-            NOW + 1,
-        )
-        .expect_err("a token with the wrong typ must be rejected");
-        assert!(matches!(error, EvidenceError::MissingCredential));
-    }
-
-    #[test]
-    fn verify_rejects_wrong_issuer() {
-        let signer = access_token_signer();
-        let token = block_on(mint_access_token(
-            &signer,
-            NOTARY_ACCESS_TOKEN_JWT_TYP,
-            &access_token_claims(),
-        ))
-        .expect("access token mints");
-
-        let error = verify_notary_token(
-            &token.compact,
-            &signer.public_jwk(),
-            NOTARY_ACCESS_TOKEN_JWT_TYP,
-            "https://attacker.example",
-            &[AUDIENCE.to_string()],
-            NOW + 1,
-        )
-        .expect_err("a token with the wrong issuer must be rejected");
-        assert!(matches!(error, EvidenceError::MissingCredential));
-    }
-
-    #[test]
-    fn verify_rejects_wrong_audience() {
-        let signer = access_token_signer();
-        let token = block_on(mint_access_token(
-            &signer,
-            NOTARY_ACCESS_TOKEN_JWT_TYP,
-            &access_token_claims(),
-        ))
-        .expect("access token mints");
-
-        let error = verify_notary_token(
-            &token.compact,
-            &signer.public_jwk(),
-            NOTARY_ACCESS_TOKEN_JWT_TYP,
-            ISSUER,
-            &["https://other.example".to_string()],
-            NOW + 1,
-        )
-        .expect_err("a token with no accepted audience must be rejected");
-        assert!(matches!(error, EvidenceError::MissingCredential));
-    }
-
-    #[test]
-    fn verify_rejects_expired_token() {
-        let signer = access_token_signer();
-        let token = block_on(mint_access_token(
-            &signer,
-            NOTARY_ACCESS_TOKEN_JWT_TYP,
-            &access_token_claims(),
-        ))
-        .expect("access token mints");
-
-        let error = verify_notary_token(
-            &token.compact,
-            &signer.public_jwk(),
-            NOTARY_ACCESS_TOKEN_JWT_TYP,
-            ISSUER,
-            &[AUDIENCE.to_string()],
-            NOW + 301,
-        )
-        .expect_err("an expired token must be rejected");
-        assert!(matches!(error, EvidenceError::MissingCredential));
-    }
-
-    #[test]
-    fn signed_token_debug_redacts_compact() {
-        let signer = access_token_signer();
-        let token = block_on(mint_access_token(
-            &signer,
-            NOTARY_ACCESS_TOKEN_JWT_TYP,
-            &access_token_claims(),
-        ))
-        .expect("access token mints");
-        let debug = format!("{token:?}");
-
-        assert!(debug.contains("SignedNotaryToken"));
-        assert!(debug.contains(NOTARY_ACCESS_TOKEN_JWT_TYP));
-        assert!(!debug.contains(&token.compact));
-    }
-
-    #[test]
-    fn bound_subject_debug_redacts_subject_and_civil_id() {
-        let subject = bound_subject();
-        let debug = format!("{subject:?}");
-
-        assert!(debug.contains("BoundSubject"));
-        assert!(debug.contains(SUBJECT_BINDING_CLAIM));
-        assert!(!debug.contains("citizen-subject-1"));
-        assert!(!debug.contains(CIVIL_ID));
-    }
-
-    #[test]
-    fn pre_authorized_code_claims_debug_does_not_render_civil_id() {
-        let claims = pre_authorized_code_claims();
-        let debug = format!("{claims:?}");
-
-        // The derived Debug recurses into BoundSubject's redacting Debug.
-        assert!(!debug.contains("citizen-subject-1"));
-        assert!(!debug.contains(CIVIL_ID));
-    }
-
-    #[test]
-    fn mint_rejects_subject_binding_claim_colliding_with_a_reserved_claim() {
-        // A subject_binding_claim configured to a reserved/emitted claim name
-        // would overwrite that claim; minting must fail loudly instead.
-        for &reserved in RESERVED_TOKEN_CLAIMS {
-            let mut subject = bound_subject();
-            subject.subject_binding_claim = reserved.to_string();
-            let claims = AccessTokenClaims {
-                subject,
-                ..access_token_claims()
-            };
-            let error = block_on(mint_access_token(
-                &access_token_signer(),
-                NOTARY_ACCESS_TOKEN_JWT_TYP,
-                &claims,
-            ))
-            .expect_err("a reserved subject-binding claim must be rejected");
-            assert!(matches!(error, EvidenceError::CredentialIssuanceFailed));
-        }
-    }
-}
diff --git a/crates/registry-notary-server/Cargo.toml b/crates/registry-notary-server/Cargo.toml
deleted file mode 100644
index 816044f43..000000000
--- a/crates/registry-notary-server/Cargo.toml
+++ /dev/null
@@ -1,101 +0,0 @@
-[package]
-name = "registry-notary-server"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Standalone Registry Notary routes, Relay-backed runtime, auth, and audit."
-readme = "README.md"
-repository.workspace = true
-publish = false
-
-# not opted into [workspace.lints]: unsafe std::env::set_var/remove_var in
-# #[cfg(test)] code (src/standalone.rs, tests/)
-
-[features]
-default = []
-registry-notary-cel = ["dep:crosswalk-core", "dep:registry-notary-worker-harness"]
-cel-worker-fixture = ["registry-notary-cel"]
-pkcs11 = ["dep:cryptoki", "dep:hex"]
-relay-contract-test-support = ["registry-platform-httputil/test-support"]
-
-[dependencies]
-registry-notary-core.workspace = true
-registry-platform-audit.workspace = true
-registry-platform-authcommon.workspace = true
-registry-platform-cache.workspace = true
-registry-platform-config.workspace = true
-registry-platform-crypto.workspace = true
-registry-platform-httpsec.workspace = true
-registry-platform-httputil.workspace = true
-registry-platform-oid4vci.workspace = true
-registry-platform-oidc.workspace = true
-registry-platform-ops.workspace = true
-registry-platform-pdp.workspace = true
-registry-platform-replay.workspace = true
-registry-platform-sdjwt.workspace = true
-axum.workspace = true
-async-trait.workspace = true
-aws-lc-rs.workspace = true
-base64.workspace = true
-crosswalk-core = { workspace = true, optional = true }
-deadpool.workspace = true
-registry-notary-worker-harness = { workspace = true, optional = true }
-cryptoki = { workspace = true, optional = true }
-getrandom.workspace = true
-hex = { workspace = true, optional = true }
-hmac.workspace = true
-jsonwebtoken.workspace = true
-native-tls.workspace = true
-postgres-native-tls.workspace = true
-reqwest.workspace = true
-rustix.workspace = true
-serde.workspace = true
-serde_json.workspace = true
-serde_norway.workspace = true
-sha2.workspace = true
-subtle.workspace = true
-thiserror.workspace = true
-time.workspace = true
-tokio.workspace = true
-tokio-postgres.workspace = true
-tower-http.workspace = true
-tracing.workspace = true
-ulid.workspace = true
-utoipa.workspace = true
-zeroize.workspace = true
-
-[dev-dependencies]
-axum-test = { version = "20" }
-chrono = { version = "0.4" }
-registry-notary-client = { workspace = true, features = ["test-support", "verifier"] }
-registry-platform-testing = { workspace = true, features = ["test-utils"] }
-jsonschema.workspace = true
-tempfile = { version = "3" }
-wiremock = { version = "0.6" }
-# Criterion drives the microbenchmarks under `benches/`. The benches are
-# manually invoked via `cargo bench`; CI smoke-checks `cargo bench --no-run`.
-criterion = { version = "0.8", features = ["html_reports"] }
-
-[[bench]]
-name = "auth_bench"
-harness = false
-
-[[bench]]
-name = "sd_jwt_bench"
-harness = false
-
-[[bench]]
-name = "json_bench"
-harness = false
-
-[[bin]]
-name = "registry-notary-cel-worker"
-path = "src/bin/registry_notary_cel_worker.rs"
-required-features = ["registry-notary-cel"]
-test = false
-
-[[bin]]
-name = "registry-notary-cel-worker-fixture"
-path = "src/bin/registry_notary_cel_worker_fixture.rs"
-required-features = ["cel-worker-fixture"]
-test = false
diff --git a/crates/registry-notary-server/README.md b/crates/registry-notary-server/README.md
deleted file mode 100644
index 69a74d3c3..000000000
--- a/crates/registry-notary-server/README.md
+++ /dev/null
@@ -1,263 +0,0 @@
-# registry-notary-server
-
-Standalone Registry Notary runtime, API routes, auth, audit, Relay
-consultations, renderers, and credential issuance wiring.
-
-## What It Provides
-
-- Axum routers for the Registry Notary API.
-- Runtime claim evaluation with dependency ordering and request-scoped Relay
-  consultation coalescing.
-- Hash-pinned, semantically verified Relay consultations for registry-backed
-  evidence.
-- Subject-bound and delegated subject access to Relay-backed evidence.
-- API-key and bearer-token auth through `registry-platform` primitives.
-- Redacted audit event emission.
-- JSON, SD-JWT VC, and credential response renderers.
-- Static-peer federated delegated evaluation at `/federation/v1/evaluations`
-  when federation is enabled in config.
-- Prometheus metrics contract for `/metrics` with safe, low-cardinality labels.
-- OpenAPI document generation.
-
-## Typical Use
-
-```rust
-use registry_notary_core::StandaloneRegistryNotaryConfig;
-use registry_notary_server::{
-    compile_notary_runtime, notary_public_router_from_runtime, StandaloneServerError,
-};
-
-async fn app(
-    config: StandaloneRegistryNotaryConfig,
-) -> Result<axum::Router, StandaloneServerError> {
-    let runtime = compile_notary_runtime(config)?;
-    let runtime = runtime.activate().await?;
-    notary_public_router_from_runtime(runtime)
-}
-```
-
-The asynchronous `standalone_router` convenience helper is limited to explicit
-local `state.storage: in_memory` configurations and must be awaited:
-
-```rust
-let router = registry_notary_server::standalone_router(config).await?;
-```
-
-Both construction paths eagerly verify the retained audit chain before a
-router can be returned. Confirmed integrity failures latch `/ready` until the
-operator performs offline quarantine recovery and restarts the process. The
-runtime-to-router functions reject snapshots that have not passed through this
-verification boundary. PostgreSQL state and Registry-backed claims require the
-full asynchronous activation sequence in the example before a listener is
-built.
-
-The example builds only the public router. Embedders that deliberately select
-`server.admin_listener.mode: shared_with_public` can instead use
-`notary_shared_router_from_runtime`. Dedicated admin listeners require
-`notary_routers_from_runtime` and separate public and admin binds.
-
-## Features
-
-- Default: no CEL runtime.
-- `registry-notary-cel`: enables CEL-backed claim expression evaluation through
-  `crosswalk-core` in a hardened worker process with bounded IO, environment
-  scrubbing, resource limits where supported, timeout kill, and worker
-  replacement.
-- `pkcs11`: enables HSM-backed SD-JWT VC issuer signing through PKCS#11. The
-  provider supports Ed25519 EdDSA keys and is configured through
-  `evidence.signing_keys`. See
-  [`../../docs/signing-key-provider.md`](../../docs/signing-key-provider.md).
-
-Run server tests without default features when checking the beta binary shape:
-
-```sh
-cargo test -p registry-notary-server --no-default-features
-```
-
-Run the PKCS#11 feature path separately:
-
-```sh
-cargo test -p registry-notary-server --no-default-features --features pkcs11 --lib
-```
-
-When SoftHSM and OpenSSL are installed, that feature test includes a live
-PKCS#11 signing smoke test.
-
-## Correctness state configuration
-
-Registry Notary stores replay decisions, consumable nonces, evaluations,
-idempotency records, credential status, quotas, and preauthorization state in
-one Notary-owned PostgreSQL schema:
-
-```yaml
-state:
-  storage: postgresql
-  postgresql:
-    url_env: REGISTRY_NOTARY_POSTGRES_URL
-    connect_timeout_ms: 5000
-    operation_timeout_ms: 2000
-    max_connections: 16
-```
-
-Run `registry-notary state install` with a restricted migration login before
-starting the service. Runtime connections require Transport Layer Security
-(TLS), attest the exact schema and runtime role, and fail readiness when the
-database is unavailable, read-only, incompatible, or configured with unsafe
-durability settings. `max_connections` is a hard physical-connection cap per
-Notary replica. Size the database budget as replica count multiplied by this
-value, plus operator and migration connections.
-
-Local, single-process development can select the process-local backend
-explicitly:
-
-```yaml
-deployment:
-  profile: local
-  multi_instance: false
-state:
-  storage: in_memory
-```
-
-`in_memory` is rejected outside the local, single-instance profile. It loses
-correctness state on restart and does not provide cross-replica decisions.
-
-## Credential Lifecycle
-
-SD-JWT VC issuance is intentionally short-lived and status-free by default.
-Each credential profile controls the credential lifetime with
-`validity_seconds`, which defaults to 600 seconds when omitted.
-
-Set `credential_status.enabled = true` to add a storage-backed credential
-status endpoint. Issued SD-JWT VC payloads then include a
-`status.status_list.uri` pointing at `/v1/credentials/{credential_id}/status`.
-The same URL serves `application/statuslist+jwt` for verifiers and the JSON
-lifecycle representation for operational compatibility. The global
-correctness-state backend stores status rows. The JSON endpoint returns
-`valid`, `suspended`, `revoked`, or derived `expired`; admins update mutable
-states through
-`POST /admin/v1/credentials/{credential_id}/status` with the
-`registry_notary:admin` scope. Status records contain only credential lifecycle
-metadata, not subject ids, holder keys, claim values, disclosures, or source
-rows.
-
-## Metrics
-
-`/metrics` is the Prometheus scrape surface for server metrics. Metric families
-and labels must be safe for operational scraping: use bounded labels such as
-endpoint kind, method, status code, status class, error code, outcome, profile,
-and source id. Do not label or emit subject ids, principal ids, holder keys,
-access tokens, source rows, request or correlation ids, SD-JWT disclosures, or
-raw error details. The endpoint requires an authenticated principal with the
-`registry_notary:metrics_read` scope, so Prometheus scrape jobs must send a
-dedicated metrics credential. Static-auth deployments can use a metrics bearer
-token or a metrics API key in `x-api-key`; OIDC deployments can use a token
-whose mapped scopes include `registry_notary:metrics_read`. An internal-only
-listener/proxy is defense in depth only and must still forward or inject a valid
-metrics credential. It should still be exposed only through the deployment's
-normal network and scrape controls.
-
-Example Prometheus scrape shape:
-
-```yaml
-scrape_configs:
-  - job_name: registry-notary
-    metrics_path: /metrics
-    authorization:
-      type: Bearer
-      credentials_file: /run/secrets/registry-notary-metrics-token
-    static_configs:
-      - targets: ["registry-notary:4325"]
-```
-
-## Operations Posture
-
-`GET /admin/v1/posture` returns the redacted `registry.ops.posture.v1`
-operations document for fleet polling. It requires an authenticated principal
-with exactly the read-only `registry_notary:ops_read` scope; the write-capable
-`registry_notary:admin` scope does not authorize posture unless the same
-credential also carries `registry_notary:ops_read`.
-
-Registry Notary supports a dedicated admin listener with
-`server.admin_listener.mode: dedicated`. In that mode `/admin/v1/*` and
-`/metrics` are not mounted on the public listener. Simple local deployments may
-use `server.admin_listener.mode: shared_with_public`, but governed
-configuration with `config_trust` requires dedicated admin mode at startup.
-Every topology still enforces the application scope checks.
-
-## Audit Configuration
-
-`standalone_router(...).await` builds the audit pipeline from
-`StandaloneRegistryNotaryConfig.audit` and eagerly verifies retained records
-before returning. The pipeline writes one redacted, tamper-evident JSON
-envelope per security-relevant event and fails closed if the configured hash
-secret is unavailable.
-
-```yaml
-audit:
-  sink: file
-  path: /var/log/registry-notary/audit.jsonl
-  hash_secret_env: REGISTRY_NOTARY_AUDIT_HASH_SECRET
-  max_size_mb: 100
-  max_files: 14
-```
-
-Sink options:
-
-- `stdout` writes JSONL to process stdout and is appropriate when platform log
-  collection provides durability.
-- `file` and `jsonl` require `path`. Use `max_size_mb` for active-file rotation
-  and `max_files` for retained file count. `max_files` includes the active
-  file; `max_size_mb: 0` disables rotation.
-- `syslog` writes JSONL envelopes to a local Unix datagram syslog socket. Set
-  `syslog_socket_path` to override the platform default:
-
-```yaml
-audit:
-  sink: syslog
-  syslog_socket_path: /run/systemd/journal/syslog
-  hash_secret_env: REGISTRY_NOTARY_AUDIT_HASH_SECRET
-```
-
-`hash_secret_env` names an environment variable containing the deployment HMAC
-secret used for audit identifier hashing. Use a generated, high-entropy value,
-keep it out of config files, and keep it stable for the retention period where
-auditors must correlate records.
-
-Audit envelopes contain `prev_hash` and `record_hash`. File/jsonl sinks resume
-from the retained tail hash on startup. `registry-platform-audit::verify_chain`
-proves internal consistency of the retained record set: edits, insertions,
-reordering, and deletions of interior records are detected. It cannot prove
-completeness of the retained set on its own, since a suffix truncation or a
-fully replaced log stays self-consistent. Completeness is an off-host
-shipping guarantee: declare `deployment.evidence.audit_offhost_shipping: true`
-once audit events are actually shipped to a log aggregator or SIEM outside
-this host. Evidence-grade deployments refuse to start when the audit sink is
-`file` or `jsonl` and that declaration is missing.
-
-## Security Notes
-
-- The server starts fail-closed when credentials are missing or invalid.
-- SD-JWT VC credential profiles default to 600-second validity when
-  `validity_seconds` is omitted; subject-access keeps profiles within the
-  configured credential validity ceiling.
-- Federated evaluation routes are not mounted unless `federation.enabled` is
-  true, and accepted requests must be signed compact JWS bodies from configured
-  peers.
-- Production and active-active deployments use the typed Notary PostgreSQL
-  state plane. Process-local state is limited to explicit local development.
-- Registry-backed evaluation is available only through an authenticated,
-  purpose-bound Relay consultation whose public contract is verified before
-  readiness succeeds.
-- Runtime readiness attests the PostgreSQL schema, role, write authority, and
-  durability settings before serving correctness-dependent traffic.
-
-## Testing
-
-```sh
-cargo test -p registry-notary-server --no-default-features
-cargo test -p registry-notary-server --all-features
-```
-
-## License
-
-Apache-2.0.
diff --git a/crates/registry-notary-server/benches/auth_bench.rs b/crates/registry-notary-server/benches/auth_bench.rs
deleted file mode 100644
index da60c9a33..000000000
--- a/crates/registry-notary-server/benches/auth_bench.rs
+++ /dev/null
@@ -1,77 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Microbenchmarks for the standalone-notary auth hot path.
-//!
-//! Covers:
-//! - `find_credential` linear scan with hashed API-key verification for a hit
-//!   in a small token table and a miss against the same table.
-//! - platform Bearer header parser on a typical "Bearer <token>" value
-//!   and on an invalid input (missing scheme).
-//!
-//! Notary compares request tokens against fixed-length stored fingerprints.
-//! These benches lock in the per-call cost at a realistic small N (4
-//! credentials, matching the medium perf profile).
-
-use std::hint::black_box;
-
-use criterion::{criterion_group, criterion_main, Criterion};
-use registry_notary_server::standalone::{find_credential, ResolvedCredential};
-use registry_platform_authcommon::parse_bearer_token;
-
-const VALID_TOKEN: &str = "perf-bench-bearer-token-target0-0000000000-099";
-const WRONG_TOKEN: &str = "perf-bench-bearer-token-wrong00-0000000000-000";
-
-fn build_credentials() -> Vec<ResolvedCredential> {
-    vec![
-        cred("client_a", "perf-bench-bearer-token-clienta-0000000000-001"),
-        cred("client_b", "perf-bench-bearer-token-clientb-0000000000-002"),
-        cred("client_c", "perf-bench-bearer-token-clientc-0000000000-003"),
-        cred("bench_client", VALID_TOKEN),
-    ]
-}
-
-fn cred(id: &str, token: &str) -> ResolvedCredential {
-    ResolvedCredential {
-        id: id.to_string(),
-        fingerprint: registry_platform_authcommon::fingerprint_api_key(token),
-        scopes: vec!["civil-registry.read".into(), "farmer-registry.read".into()],
-        authorization_details: None,
-    }
-}
-
-fn benchmark_find_credential_hit(c: &mut Criterion) {
-    let credentials = build_credentials();
-    c.bench_function("auth/find_credential_hit", |b| {
-        b.iter(|| find_credential(black_box(&credentials), black_box(VALID_TOKEN)));
-    });
-}
-
-fn benchmark_find_credential_miss(c: &mut Criterion) {
-    let credentials = build_credentials();
-    c.bench_function("auth/find_credential_miss", |b| {
-        b.iter(|| find_credential(black_box(&credentials), black_box(WRONG_TOKEN)));
-    });
-}
-
-fn benchmark_parse_bearer_token_ok(c: &mut Criterion) {
-    let header = format!("Bearer {VALID_TOKEN}");
-    c.bench_function("auth/parse_bearer_token_ok", |b| {
-        b.iter(|| parse_bearer_token(black_box(&header)));
-    });
-}
-
-fn benchmark_parse_bearer_token_bad(c: &mut Criterion) {
-    let header = format!("Basic {VALID_TOKEN}");
-    c.bench_function("auth/parse_bearer_token_bad_scheme", |b| {
-        b.iter(|| parse_bearer_token(black_box(&header)));
-    });
-}
-
-criterion_group! {
-    name = benches;
-    config = Criterion::default().sample_size(50);
-    targets = benchmark_find_credential_hit,
-              benchmark_find_credential_miss,
-              benchmark_parse_bearer_token_ok,
-              benchmark_parse_bearer_token_bad
-}
-criterion_main!(benches);
diff --git a/crates/registry-notary-server/benches/json_bench.rs b/crates/registry-notary-server/benches/json_bench.rs
deleted file mode 100644
index af919c8d6..000000000
--- a/crates/registry-notary-server/benches/json_bench.rs
+++ /dev/null
@@ -1,139 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Microbenchmarks for the JSON serialization/deserialization hot paths.
-//!
-//! Covers:
-//! - `EvidenceAuditEvent` serialization (written as a JSONL line on every request).
-//! - `ClaimResultView` serialization (returned in `/v1/evaluations` and
-//!   `/v1/batch-evaluations` responses).
-use std::hint::black_box;
-
-use criterion::{criterion_group, criterion_main, Criterion};
-use registry_notary_core::model::{
-    ClaimProvenance, ClaimResultView, EvidenceAuditEvent, EvidenceEntityRef,
-    EvidenceEntityReference, Hashed, PrincipalIdentifier, TargetRefView,
-};
-use serde_json::json;
-
-// ---------------------------------------------------------------------------
-// Builder helpers
-// ---------------------------------------------------------------------------
-
-fn build_audit_event() -> EvidenceAuditEvent {
-    EvidenceAuditEvent {
-        event_id: "01HWQZPJ3VXKM8N2BF5CSRTE4D".to_string(),
-        occurred_at: "2026-05-24T12:00:00Z".to_string(),
-        principal_id_hash: Some(Hashed::<PrincipalIdentifier>::from_hash(
-            "hmac-sha256:client-bench-001",
-        )),
-        scopes_used: vec!["farmer_registry:evidence_verification".to_string()],
-        decision: "allow".to_string(),
-        method: "POST".to_string(),
-        path: "/v1/evaluations".to_string(),
-        status: 200,
-        verification_id: Some("01HWQZPJ3VXKM8N2BF5CSRTE4E".to_string()),
-        claim_hash: Some(
-            "sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890".to_string(),
-        ),
-        purposes: None,
-        row_count: None,
-        relay_consultation_count: None,
-        relay_consultation_ids: Vec::new(),
-        forwarded: None,
-        error_code: None,
-        access_mode: None,
-        federation_peer_id_hash: None,
-        federation_issuer: None,
-        federation_profile: None,
-        federation_purpose: None,
-        federation_request_jti_hash: None,
-        federation_subject_ref_hash: None,
-        denial_code: None,
-        token_claim_name: None,
-        correlation_id_hash: None,
-        credential_profile: None,
-        protocol: None,
-        credential_configuration_id: None,
-        holder_binding_mode: None,
-        rate_limit_bucket: None,
-        policy_version: None,
-        policy_hash: None,
-        target_type: Some("Person".to_string()),
-        target_ref_hash: Some(Hashed::<EvidenceEntityReference>::from_hash(
-            "hmac-sha256:target-bench-0000007",
-        )),
-        requester_type: Some("Agency".to_string()),
-        requester_ref_hash: Some(Hashed::<EvidenceEntityReference>::from_hash(
-            "hmac-sha256:requester-bench-001",
-        )),
-        redacted_fields: None,
-        batch_items: None,
-        config: None,
-    }
-}
-
-fn build_claim_result_view() -> ClaimResultView {
-    ClaimResultView {
-        evaluation_id: "01HWQZPJ3VXKM8N2BF5CSRTE4F".to_string(),
-        claim_id: "date-of-birth".to_string(),
-        claim_version: "1.0.0".to_string(),
-        subject_type: "national_id".to_string(),
-        requester_ref: Some(EvidenceEntityRef {
-            entity_type: "Agency".to_string(),
-            handle: "rnref:v1:requester-bench-001".to_string(),
-            identifier_schemes: vec!["agency_id".to_string()],
-            profile: Some("civil-registry".to_string()),
-        }),
-        target_ref: TargetRefView {
-            entity_type: "Person".to_string(),
-            handle: "rnref:v1:target-bench-0000007".to_string(),
-            identifier_schemes: vec!["national_id".to_string()],
-            profile: Some("resident".to_string()),
-        },
-        value: Some(json!("1990-01-01")),
-        satisfied: Some(true),
-        disclosure: "full_disclosure".to_string(),
-        redacted_fields: Vec::new(),
-        format: "json".to_string(),
-        issued_at: "2026-05-24T12:00:00Z".to_string(),
-        expires_at: None,
-        provenance: ClaimProvenance::new(
-            "registry-notary-server".to_string(),
-            "eval-bench".to_string(),
-            "date-of-birth".to_string(),
-            "1".to_string(),
-            registry_notary_core::ProvenanceUsed {
-                relay_consultation_count: 1,
-            },
-        ),
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Benchmark functions
-// ---------------------------------------------------------------------------
-
-fn benchmark_serialize_audit_event(c: &mut Criterion) {
-    let event = build_audit_event();
-    c.bench_function("json/serialize_audit_event", |b| {
-        b.iter(|| serde_json::to_vec(black_box(&event)).expect("audit event must serialize"));
-    });
-}
-
-fn benchmark_serialize_claim_result_view(c: &mut Criterion) {
-    let view = build_claim_result_view();
-    c.bench_function("json/serialize_claim_result_view", |b| {
-        b.iter(|| serde_json::to_vec(black_box(&view)).expect("claim result view must serialize"));
-    });
-}
-
-// ---------------------------------------------------------------------------
-// Registration
-// ---------------------------------------------------------------------------
-
-criterion_group! {
-    name = benches;
-    config = Criterion::default().sample_size(50);
-    targets = benchmark_serialize_audit_event,
-              benchmark_serialize_claim_result_view
-}
-criterion_main!(benches);
diff --git a/crates/registry-notary-server/benches/sd_jwt_bench.rs b/crates/registry-notary-server/benches/sd_jwt_bench.rs
deleted file mode 100644
index fa6174c3d..000000000
--- a/crates/registry-notary-server/benches/sd_jwt_bench.rs
+++ /dev/null
@@ -1,179 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Microbenchmarks for the SD-JWT VC issuance hot path.
-//!
-//! Covers:
-//! - `EvidenceIssuer::from_jwk_str`: JWK parsing and Ed25519 key loading.
-//! - `issue` with one disclosure: the minimal single-claim credential.
-//! - `issue` with three disclosures: a realistic multi-claim credential.
-//!
-//! All `issue` benches use holder_binding.mode = "none", holder_id = None,
-//! and a fixed iat (OffsetDateTime::UNIX_EPOCH) to avoid wall-clock noise.
-
-use std::hint::black_box;
-
-use criterion::{criterion_group, criterion_main, Criterion};
-use registry_notary_core::config::{
-    CredentialDisclosureConfig, CredentialProfileConfig, HolderBindingConfig,
-};
-use registry_notary_core::model::{
-    ClaimProvenance, ClaimResultView, EvidenceEntityRef, TargetRefView,
-};
-use registry_notary_core::sd_jwt::{issue, EvidenceIssuer, IssueOptions};
-use time::OffsetDateTime;
-
-const TEST_ISSUER_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA"}"#;
-const VM_ID: &str = "did:web:perf.registry-notary.example#perf-key-1";
-
-fn build_profile() -> CredentialProfileConfig {
-    CredentialProfileConfig {
-        format: registry_notary_core::FORMAT_SD_JWT_VC.to_string(),
-        issuer: "did:web:perf.registry-notary.example".to_string(),
-        signing_key: "perf-key".to_string(),
-        vct: "https://data.example.gov/credentials/smallholder/v1".to_string(),
-        validity_seconds: 24 * 60 * 60,
-        holder_binding: HolderBindingConfig {
-            mode: "none".to_string(),
-            proof_of_possession: None,
-            allowed_did_methods: Vec::new(),
-        },
-        allowed_claims: vec![
-            "date-of-birth".into(),
-            "farmer-under-4ha".into(),
-            "farmed-land-size".into(),
-        ],
-        disclosure: CredentialDisclosureConfig::default(),
-    }
-}
-
-fn build_issuer() -> EvidenceIssuer {
-    EvidenceIssuer::from_jwk_str(TEST_ISSUER_JWK, VM_ID.to_string())
-        .expect("test JWK must load without error")
-}
-
-fn claim_result(claim_id: &str, value: serde_json::Value) -> ClaimResultView {
-    ClaimResultView {
-        evaluation_id: "eval-perf-bench".to_string(),
-        claim_id: claim_id.to_string(),
-        claim_version: "1.0.0".to_string(),
-        subject_type: "farmer".to_string(),
-        requester_ref: Some(EvidenceEntityRef {
-            entity_type: "Agency".to_string(),
-            handle: "rnref:v1:requester-perf-ref".to_string(),
-            identifier_schemes: vec!["agency_id".to_string()],
-            profile: Some("benefits".to_string()),
-        }),
-        target_ref: TargetRefView {
-            entity_type: "Farmer".to_string(),
-            handle: "rnref:v1:target-perf-ref".to_string(),
-            identifier_schemes: vec!["farmer_id".to_string()],
-            profile: Some("smallholder".to_string()),
-        },
-        value: Some(value),
-        satisfied: Some(true),
-        disclosure: "value".to_string(),
-        redacted_fields: Vec::new(),
-        format: registry_notary_core::FORMAT_SD_JWT_VC.to_string(),
-        issued_at: "2026-01-01T00:00:00Z".to_string(),
-        expires_at: None,
-        provenance: ClaimProvenance::new(
-            "bench".to_string(),
-            "eval-bench".to_string(),
-            "claim".to_string(),
-            "1".to_string(),
-            registry_notary_core::ProvenanceUsed {
-                relay_consultation_count: 1,
-            },
-        ),
-    }
-}
-
-fn build_single_claim() -> Vec<ClaimResultView> {
-    vec![claim_result(
-        "date-of-birth",
-        serde_json::json!("1990-01-01"),
-    )]
-}
-
-fn build_three_claims() -> Vec<ClaimResultView> {
-    vec![
-        claim_result("date-of-birth", serde_json::json!("1990-01-01")),
-        claim_result("farmer-under-4ha", serde_json::json!(true)),
-        claim_result("farmed-land-size", serde_json::json!(3.2)),
-    ]
-}
-
-fn benchmark_evidence_issuer_from_jwk_str(c: &mut Criterion) {
-    c.bench_function("sd_jwt/evidence_issuer_from_jwk_str", |b| {
-        b.iter(|| {
-            // `from_jwk_str` takes the verification-method id by value, so a
-            // fresh `String` allocation per call is part of the measured path.
-            let vm_id = black_box(VM_ID).to_string();
-            EvidenceIssuer::from_jwk_str(black_box(TEST_ISSUER_JWK), vm_id).expect("JWK must load")
-        });
-    });
-}
-
-// `issue()` invokes `getrandom::fill` (16 bytes of CSPRNG) once per claim
-// disclosure. That entropy cost is unavoidable on the production path and is
-// included in the measurement. With 3 claims it accounts for 3 syscalls per
-// iteration on Linux, which dominates the noise floor of these benches.
-fn benchmark_issue_single_claim(c: &mut Criterion) {
-    let profile = build_profile();
-    let issuer = build_issuer();
-    let results = build_single_claim();
-    let iat = OffsetDateTime::UNIX_EPOCH;
-    let runtime = tokio::runtime::Builder::new_current_thread()
-        .enable_all()
-        .build()
-        .expect("bench runtime builds");
-    c.bench_function("sd_jwt/issue_single_claim", |b| {
-        b.iter(|| {
-            runtime
-                .block_on(issue(
-                    black_box(&profile),
-                    black_box(&issuer),
-                    black_box(&results),
-                    black_box("bench-subject"),
-                    black_box(None),
-                    black_box(iat),
-                    black_box(IssueOptions::default()),
-                ))
-                .expect("issue must succeed")
-        });
-    });
-}
-
-fn benchmark_issue_three_claims(c: &mut Criterion) {
-    let profile = build_profile();
-    let issuer = build_issuer();
-    let results = build_three_claims();
-    let iat = OffsetDateTime::UNIX_EPOCH;
-    let runtime = tokio::runtime::Builder::new_current_thread()
-        .enable_all()
-        .build()
-        .expect("bench runtime builds");
-    c.bench_function("sd_jwt/issue_three_claims", |b| {
-        b.iter(|| {
-            runtime
-                .block_on(issue(
-                    black_box(&profile),
-                    black_box(&issuer),
-                    black_box(&results),
-                    black_box("bench-subject"),
-                    black_box(None),
-                    black_box(iat),
-                    black_box(IssueOptions::default()),
-                ))
-                .expect("issue must succeed")
-        });
-    });
-}
-
-criterion_group! {
-    name = benches;
-    config = Criterion::default().sample_size(50);
-    targets = benchmark_evidence_issuer_from_jwk_str,
-              benchmark_issue_single_claim,
-              benchmark_issue_three_claims
-}
-criterion_main!(benches);
diff --git a/crates/registry-notary-server/resources/scalar/api-reference.js b/crates/registry-notary-server/resources/scalar/api-reference.js
deleted file mode 100644
index cf1d93a6f..000000000
--- a/crates/registry-notary-server/resources/scalar/api-reference.js
+++ /dev/null
@@ -1,2364 +0,0 @@
-/**
- *    _____ _________    __    ___    ____
- *   / ___// ____/   |  / /   /   |  / __ \
- *   \__ \/ /   / /| | / /   / /| | / /_/ /
- *  ___/ / /___/ ___ |/ /___/ ___ |/ _, _/
- * /____/\____/_/  |_/_____/_/  |_/_/ |_|
- *
- * @scalar/api-reference 1.57.1
- *
- * Website: https://scalar.com
- * GitHub:  https://github.com/scalar/scalar
- * License: https://github.com/scalar/scalar/blob/main/LICENSE
-**/
-
-(function(){try{if(typeof document<`u`){var e=document.createElement(`style`);e.appendChild(document.createTextNode(`/*! tailwindcss v4.2.1 | MIT License | https://tailwindcss.com */@layer properties{@supports (((-webkit-hyphens:none)) and (not (margin-trim:inline))) or ((-moz-orient:inline) and (not (color:rgb(from red r g b)))){*,:before,:after,::backdrop{--tw-font-weight:initial;--tw-backdrop-blur:initial;--tw-backdrop-brightness:initial;--tw-backdrop-contrast:initial;--tw-backdrop-grayscale:initial;--tw-backdrop-hue-rotate:initial;--tw-backdrop-invert:initial;--tw-backdrop-opacity:initial;--tw-backdrop-saturate:initial;--tw-backdrop-sepia:initial;--tw-shadow:0 0 #0000;--tw-shadow-color:initial;--tw-shadow-alpha:100%;--tw-inset-shadow:0 0 #0000;--tw-inset-shadow-color:initial;--tw-inset-shadow-alpha:100%;--tw-ring-color:initial;--tw-ring-shadow:0 0 #0000;--tw-inset-ring-color:initial;--tw-inset-ring-shadow:0 0 #0000;--tw-ring-inset:initial;--tw-ring-offset-width:0;--tw-ring-offset-color:#fff;--tw-ring-offset-shadow:0 0 #0000;--tw-translate-x:0;--tw-translate-y:0;--tw-translate-z:0;--tw-scale-x:1;--tw-scale-y:1;--tw-scale-z:1;--tw-rotate-x:initial;--tw-rotate-y:initial;--tw-rotate-z:initial;--tw-skew-x:initial;--tw-skew-y:initial;--tw-space-x-reverse:0;--tw-divide-y-reverse:0;--tw-border-style:solid;--tw-gradient-position:initial;--tw-gradient-from:#0000;--tw-gradient-via:#0000;--tw-gradient-to:#0000;--tw-gradient-stops:initial;--tw-gradient-via-stops:initial;--tw-gradient-from-position:0%;--tw-gradient-via-position:50%;--tw-gradient-to-position:100%;--tw-mask-linear:linear-gradient(#fff, #fff);--tw-mask-radial:linear-gradient(#fff, #fff);--tw-mask-conic:linear-gradient(#fff, #fff);--tw-mask-left:linear-gradient(#fff, #fff);--tw-mask-right:linear-gradient(#fff, #fff);--tw-mask-bottom:linear-gradient(#fff, #fff);--tw-mask-top:linear-gradient(#fff, #fff);--tw-mask-top-from-position:0%;--tw-mask-top-to-position:100%;--tw-mask-top-from-color:black;--tw-mask-top-to-color:transparent;--tw-mask-bottom-from-position:0%;--tw-mask-bottom-to-position:100%;--tw-mask-bottom-from-color:black;--tw-mask-bottom-to-color:transparent;--tw-leading:initial;--tw-ordinal:initial;--tw-slashed-zero:initial;--tw-numeric-figure:initial;--tw-numeric-spacing:initial;--tw-numeric-fraction:initial;--tw-outline-style:solid;--tw-blur:initial;--tw-brightness:initial;--tw-contrast:initial;--tw-grayscale:initial;--tw-hue-rotate:initial;--tw-invert:initial;--tw-opacity:initial;--tw-saturate:initial;--tw-sepia:initial;--tw-drop-shadow:initial;--tw-drop-shadow-color:initial;--tw-drop-shadow-alpha:100%;--tw-drop-shadow-size:initial;--tw-duration:initial;--tw-ease:initial;--tw-content:""}[data-v-b258a15f],[data-v-b258a15f]:before,[data-v-b258a15f]:after,[data-v-b258a15f]::backdrop{--tw-outline-style:solid}}}@layer scalar-base{body{line-height:inherit;margin:0}:root{--scalar-border-width:.5px;--scalar-radius:3px;--scalar-radius-lg:6px;--scalar-radius-xl:8px;--scalar-font:"Inter", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, Cantarell, "Open Sans", "Helvetica Neue", sans-serif;--scalar-font-code:"JetBrains Mono", ui-monospace, Menlo, Monaco, "Cascadia Mono", "Segoe UI Mono", "Roboto Mono", "Oxygen Mono", "Ubuntu Monospace", "Source Code Pro", "Fira Mono", "Droid Sans Mono", "Courier New", monospace;--scalar-heading-1:24px;--scalar-page-description:16px;--scalar-heading-2:20px;--scalar-heading-3:16px;--scalar-heading-4:16px;--scalar-heading-5:16px;--scalar-heading-6:16px;--scalar-paragraph:16px;--scalar-small:14px;--scalar-mini:13px;--scalar-micro:12px;--scalar-bold:600;--scalar-semibold:500;--scalar-regular:400;--scalar-font-size-1:21px;--scalar-font-size-2:16px;--scalar-font-size-3:14px;--scalar-font-size-4:13px;--scalar-font-size-5:12px;--scalar-font-size-6:12px;--scalar-font-size-7:10px;--scalar-line-height-1:32px;--scalar-line-height-2:24px;--scalar-line-height-3:20px;--scalar-line-height-4:18px;--scalar-line-height-5:16px;--scalar-font-normal:400;--scalar-font-medium:500;--scalar-font-bold:700;--scalar-text-decoration:none;--scalar-text-decoration-hover:underline;--scalar-link-font-weight:inherit;--scalar-sidebar-indent:20px;--scalar-sidebar-padding:12px}.dark-mode{--lightningcss-light: ;--lightningcss-dark:initial;color-scheme:dark;--scalar-scrollbar-color:#ffffff2e;--scalar-scrollbar-color-active:#ffffff5c;--scalar-button-1:#fff;--scalar-button-1-hover:#ffffffe6;--scalar-button-1-color:black;--scalar-shadow-1:0 1px 3px 0 #0000001a;--scalar-shadow-2:0 0 0 .5px var(--scalar-border-color), #0f0f0f33 0px 3px 6px, #0f0f0f66 0px 9px 24px;--scalar-lifted-brightness:1.45;--scalar-backdrop-brightness:.5;--scalar-text-decoration-color:currentColor;--scalar-text-decoration-color-hover:currentColor}.light-mode{--lightningcss-light:initial;--lightningcss-dark: ;color-scheme:light;--scalar-scrollbar-color-active:#0000005c;--scalar-scrollbar-color:#0000002e;--scalar-button-1:#000;--scalar-button-1-hover:#000c;--scalar-button-1-color:#ffffffe6;--scalar-shadow-1:0 1px 3px 0 #0000001c;--scalar-shadow-2:#00000014 0px 13px 20px 0px, #00000014 0px 3px 8px 0px, #eeeeed 0px 0 0 .5px;--scalar-lifted-brightness:1;--scalar-backdrop-brightness:1;--scalar-text-decoration-color:currentColor;--scalar-text-decoration-color-hover:currentColor}.light-mode .dark-mode{--lightningcss-light: !important;--lightningcss-dark:initial!important;color-scheme:dark!important}@media (width<=460px){:root{--scalar-font-size-1:22px;--scalar-font-size-2:14px;--scalar-font-size-3:12px}}@media (width<=720px){:root{--scalar-heading-1:24px;--scalar-page-description:20px}}:root{--scalar-text-decoration:underline;--scalar-text-decoration-hover:underline}.light-mode{--scalar-background-1:#fff;--scalar-background-2:#f6f6f6;--scalar-background-3:#e7e7e7;--scalar-background-accent:#8ab4f81f;--scalar-color-1:#1b1b1b;--scalar-color-2:#757575;--scalar-color-3:#8e8e8e;--scalar-color-accent:#09f;--scalar-border-color:#dfdfdf}.dark-mode{--scalar-background-1:#0f0f0f;--scalar-background-2:#1a1a1a;--scalar-background-3:#272727;--scalar-color-1:#e7e7e7;--scalar-color-2:#a4a4a4;--scalar-color-3:#797979;--scalar-color-accent:#00aeff;--scalar-background-accent:#3ea6ff1f;--scalar-border-color:#2d2d2d}.light-mode,.dark-mode{--scalar-sidebar-background-1:var(--scalar-background-1);--scalar-sidebar-color-1:var(--scalar-color-1);--scalar-sidebar-color-2:var(--scalar-color-2);--scalar-sidebar-border-color:var(--scalar-border-color);--scalar-sidebar-item-hover-background:var(--scalar-background-2);--scalar-sidebar-item-hover-color:var(--scalar-sidebar-color-2);--scalar-sidebar-item-active-background:var(--scalar-background-2);--scalar-sidebar-color-active:var(--scalar-sidebar-color-1);--scalar-sidebar-indent-border:var(--scalar-sidebar-border-color);--scalar-sidebar-indent-border-hover:var(--scalar-sidebar-border-color);--scalar-sidebar-indent-border-active:var(--scalar-sidebar-border-color);--scalar-sidebar-search-background:var(--scalar-background-2)}@supports (color:color-mix(in lab, red, red)){.light-mode,.dark-mode{--scalar-sidebar-search-background:color-mix(in srgb, var(--scalar-background-2), var(--scalar-background-1))}}.light-mode,.dark-mode{--scalar-sidebar-search-color:var(--scalar-color-3);--scalar-sidebar-search-border-color:var(--scalar-border-color)}.light-mode{--scalar-color-green:#069061;--scalar-color-red:#ef0006;--scalar-color-yellow:#edbe20;--scalar-color-blue:#0082d0;--scalar-color-orange:#ff5800;--scalar-color-purple:#5203d1;--scalar-link-color:var(--scalar-color-1);--scalar-link-color-hover:var(--scalar-link-color);--scalar-button-1:#000;--scalar-button-1-hover:#000c;--scalar-button-1-color:#ffffffe6;--scalar-tooltip-background:#1a1a1ae6;--scalar-tooltip-color:#ffffffd9;--scalar-color-alert:var(--scalar-color-orange)}@supports (color:color-mix(in lab, red, red)){.light-mode{--scalar-color-alert:color-mix(in srgb, var(--scalar-color-orange), var(--scalar-color-1) 20%)}}.light-mode{--scalar-color-danger:var(--scalar-color-red)}@supports (color:color-mix(in lab, red, red)){.light-mode{--scalar-color-danger:color-mix(in srgb, var(--scalar-color-red), var(--scalar-color-1) 20%)}}.light-mode{--scalar-background-alert:var(--scalar-color-orange)}@supports (color:color-mix(in lab, red, red)){.light-mode{--scalar-background-alert:color-mix(in srgb, var(--scalar-color-orange), var(--scalar-background-1) 95%)}}.light-mode{--scalar-background-danger:var(--scalar-color-red)}@supports (color:color-mix(in lab, red, red)){.light-mode{--scalar-background-danger:color-mix(in srgb, var(--scalar-color-red), var(--scalar-background-1) 95%)}}.dark-mode{--scalar-color-green:#00b648;--scalar-color-red:#dc1b19;--scalar-color-yellow:#ffc90d;--scalar-color-blue:#4eb3ec;--scalar-color-orange:#ff8d4d;--scalar-color-purple:#b191f9;--scalar-link-color:var(--scalar-color-1);--scalar-link-color-hover:var(--scalar-link-color);--scalar-button-1:#fff;--scalar-button-1-hover:#ffffffe6;--scalar-button-1-color:black;--scalar-tooltip-background:var(--scalar-background-1)}@supports (color:color-mix(in lab, red, red)){.dark-mode{--scalar-tooltip-background:color-mix(in srgb, var(--scalar-background-1), #fff 10%)}}.dark-mode{--scalar-tooltip-color:#fffffff2;--scalar-color-danger:var(--scalar-color-red)}@supports (color:color-mix(in lab, red, red)){.dark-mode{--scalar-color-danger:color-mix(in srgb, var(--scalar-color-red), var(--scalar-background-1) 20%)}}.dark-mode{--scalar-background-alert:var(--scalar-color-orange)}@supports (color:color-mix(in lab, red, red)){.dark-mode{--scalar-background-alert:color-mix(in srgb, var(--scalar-color-orange), var(--scalar-background-1) 95%)}}.dark-mode{--scalar-background-danger:var(--scalar-color-red)}@supports (color:color-mix(in lab, red, red)){.dark-mode{--scalar-background-danger:color-mix(in srgb, var(--scalar-color-red), var(--scalar-background-1) 95%)}}@supports (color:color(display-p3 1 1 1)){.light-mode{--scalar-color-accent:color(display-p3 0 .6 1);--scalar-color-green:color(display-p3 .023529 .564706 .380392);--scalar-color-red:color(display-p3 .937255 0 .023529);--scalar-color-yellow:color(display-p3 .929412 .745098 .12549);--scalar-color-blue:color(display-p3 0 .509804 .815686);--scalar-color-orange:color(display-p3 1 .4 .02);--scalar-color-purple:color(display-p3 .321569 .011765 .819608)}.dark-mode{--scalar-color-accent:color(display-p3 .07 .67 1);--scalar-color-green:color(display-p3 0 .713725 .282353);--scalar-color-red:color(display-p3 .862745 .105882 .098039);--scalar-color-yellow:color(display-p3 1 .788235 .05098);--scalar-color-blue:color(display-p3 .305882 .701961 .92549);--scalar-color-orange:color(display-p3 1 .552941 .301961);--scalar-color-purple:color(display-p3 .694118 .568627 .976471)}}:root,:host{--leading-snug:1.375;--leading-normal:1.5;--leading-relaxed:1.625;--ease-in:cubic-bezier(.4, 0, 1, 1);--ease-out:cubic-bezier(0, 0, .2, 1);--ease-in-out:cubic-bezier(.4, 0, .2, 1);--animate-pulse:pulse 2s cubic-bezier(.4, 0, .6, 1) infinite;--default-transition-duration:.15s;--default-transition-timing-function:cubic-bezier(.4, 0, .2, 1)}body{background-color:var(--scalar-background-1);margin:0}}@layer scalar-theme;:where(.scalar-app){font-family:var(--scalar-font);color:var(--scalar-color-1);-webkit-text-size-adjust:100%;tab-size:4;line-height:1.15}:where(.scalar-app) *,:where(.scalar-app) :before,:where(.scalar-app) :after{box-sizing:border-box;border-style:solid;border-width:0;border-color:var(--scalar-border-color);outline-width:1px;outline-style:none;outline-color:var(--scalar-color-accent);font-feature-settings:inherit;font-variation-settings:inherit;font-family:inherit;font-size:inherit;font-weight:inherit;font-style:inherit;-webkit-text-decoration:inherit;-webkit-text-decoration:inherit;-webkit-text-decoration:inherit;text-decoration:inherit;text-align:inherit;line-height:inherit;color:inherit;margin:unset;padding:unset;text-rendering:optimizelegibility;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}:where(.scalar-app) :before,:where(.scalar-app) :after{--tw-content:""}:where(.scalar-app) button,:where(.scalar-app) input,:where(.scalar-app) optgroup,:where(.scalar-app) select,:where(.scalar-app) textarea{background:0 0}:where(.scalar-app) ::file-selector-button{background:0 0}:where(.scalar-app) ol,:where(.scalar-app) ul,:where(.scalar-app) menu{list-style:none}:where(.scalar-app) input:where(:not([type=button],[type=reset],[type=submit])),:where(.scalar-app) select,:where(.scalar-app) textarea{border-radius:var(--scalar-radius);border-width:1px}:where(.scalar-app) input::placeholder{color:var(--scalar-color-3);font-family:var(--scalar-font)}:where(.scalar-app) input[type=search]::-webkit-search-cancel-button{appearance:none}:where(.scalar-app) input[type=search]::-webkit-search-decoration{appearance:none}:where(.scalar-app) summary::-webkit-details-marker{display:none}:where(.scalar-app) input:-webkit-autofill{-webkit-background-clip:text!important;background-clip:text!important}:where(.scalar-app) :focus-visible{border-radius:var(--scalar-radius);outline-style:solid}:where(.scalar-app) button:focus-visible,:where(.scalar-app) [role=button]:focus-visible{outline-offset:-1px}:where(.scalar-app) button,:where(.scalar-app) [role=button]{cursor:pointer}:where(.scalar-app) :disabled{cursor:default}:where(.scalar-app) img,:where(.scalar-app) svg,:where(.scalar-app) video,:where(.scalar-app) canvas,:where(.scalar-app) audio,:where(.scalar-app) iframe,:where(.scalar-app) embed,:where(.scalar-app) object{vertical-align:middle;display:block}:where(.scalar-app) [hidden]{display:none}.scalar-app .cm-scroller,.scalar-app .custom-scroll{scrollbar-color:transparent transparent;scrollbar-width:thin;-webkit-overflow-scrolling:touch;overflow-y:auto}.scalar-app .custom-scroll-self-contain-overflow{overscroll-behavior:contain}.scalar-app .cm-scroller:hover,.scalar-app .custom-scroll:hover,.scalar-app.scalar-scrollbars-obtrusive .cm-scroller,.scalar-app.scalar-scrollbars-obtrusive .custom-scroll{scrollbar-color:var(--scalar-scrollbar-color,transparent) transparent}.scalar-app .cm-scroller:hover::-webkit-scrollbar-thumb{background:var(--scalar-scrollbar-color);background-clip:content-box;border:3px solid #0000}.scalar-app .custom-scroll:hover::-webkit-scrollbar-thumb{background:var(--scalar-scrollbar-color);background-clip:content-box;border:3px solid #0000}.scalar-app .cm-scroller::-webkit-scrollbar-thumb:active{background:var(--scalar-scrollbar-color-active);background-clip:content-box;border:3px solid #0000}.scalar-app .custom-scroll::-webkit-scrollbar-thumb:active{background:var(--scalar-scrollbar-color-active);background-clip:content-box;border:3px solid #0000}.scalar-app .cm-scroller::-webkit-scrollbar-corner{background:0 0}.scalar-app .custom-scroll::-webkit-scrollbar-corner{background:0 0}.scalar-app .cm-scroller::-webkit-scrollbar{width:12px;height:12px}.scalar-app .custom-scroll::-webkit-scrollbar{width:12px;height:12px}.scalar-app .cm-scroller::-webkit-scrollbar-track{background:0 0}.scalar-app .custom-scroll::-webkit-scrollbar-track{background:0 0}.scalar-app .cm-scroller::-webkit-scrollbar-thumb{background:padding-box content-box;border:3px solid #0000;border-radius:20px}.scalar-app .custom-scroll::-webkit-scrollbar-thumb{background:padding-box content-box;border:3px solid #0000;border-radius:20px}@media (pointer:coarse){.scalar-app .cm-scroller,.scalar-app .custom-scroll{padding-right:12px}}:where(.scalar-app) [class*=rotate-],:where(.scalar-app) [class*=translate-],:where(.scalar-app) [class*=scale-]{transform:none}.loader-wrapper[data-v-27df5cd8]{--loader-size:50%;justify-content:center;align-items:center;display:flex;position:relative}.svg-loader[data-v-27df5cd8]{width:var(--loader-size);height:var(--loader-size);fill:none;stroke:currentColor;background-color:#0000;top:1rem;right:.9rem;overflow:visible}.svg-path[data-v-27df5cd8]{stroke-width:12px;fill:none;transition:all .3s}.svg-x-mark[data-v-27df5cd8]{stroke-dasharray:57;stroke-dashoffset:57px;transition-delay:0s}.svg-check-mark[data-v-27df5cd8]{stroke-dasharray:149;stroke-dashoffset:149px;transition-delay:0s}.icon-is-invalid .svg-x-mark[data-v-27df5cd8],.icon-is-valid .svg-check-mark[data-v-27df5cd8]{stroke-dashoffset:0;transition-delay:.3s}.circular-loader[data-v-27df5cd8]{transform-origin:50%;background:0 0;animation:.7s linear infinite rotate-27df5cd8,.4s fade-in-27df5cd8;transform:scale(3.5)}.loader-path[data-v-27df5cd8]{stroke-dasharray:50 200;stroke-dashoffset:-100px;stroke-linecap:round}.loader-path-off[data-v-27df5cd8]{stroke-dasharray:50 200;stroke-dashoffset:-100px;opacity:0;transition:opacity .3s}@keyframes fade-in-27df5cd8{0%{opacity:0}70%{opacity:0}to{opacity:1}}@keyframes rotate-27df5cd8{0%{transform:scale(3.5)rotate(0)}to{transform:scale(3.5)rotate(360deg)}}.scalar-code-block.bg-b-1 .scalar-code-copy-backdrop{background-color:var(--scalar-background-1)}.scalar-code-block.bg-b-2 .scalar-code-copy-backdrop{background-color:var(--scalar-background-2)}.scalar-code-block.bg-b-2 .scalar-code-copy{background-color:var(--scalar-background-3)}.toggle-icon-ellipse[data-v-60be8692]{background:var(--scalar-background-1);border-radius:50%;width:7px;height:7px;transition:width .3s ease-in-out,height .3s ease-in-out;display:inline-block;position:relative;overflow:hidden;box-shadow:inset 0 0 0 1px}.toggle-icon-moon-mask[data-v-60be8692]{background:var(--scalar-background-1);border:1px solid;border-radius:50%;width:100%;height:100%;transition:transform .3s ease-in-out;display:block;position:absolute;bottom:2.5px;left:2.5px;transform:translate(4px,-4px)}.toggle-icon-sun-ray[data-v-60be8692]{background:currentColor;border-radius:8px;width:12px;height:1px;transition:transform .3s ease-in-out;position:absolute}.toggle-icon-sun-ray[data-v-60be8692]:nth-of-type(2){transform:rotate(90deg)}.toggle-icon-sun-ray[data-v-60be8692]:nth-of-type(3){transform:rotate(45deg)}.toggle-icon-sun-ray[data-v-60be8692]:nth-of-type(4){transform:rotate(-45deg)}.toggle-icon-dark .toggle-icon-ellipse[data-v-60be8692]{width:10px;height:10px;-webkit-mask-image:radial-gradient(circle at 0 100%,pink 10px,#0000 12px);mask-image:radial-gradient(circle at 0 100%,pink 10px,#0000 12px)}.toggle-icon-dark .toggle-icon-sun-ray[data-v-60be8692]{transform:scale(0)}.toggle-icon-dark .toggle-icon-moon-mask[data-v-60be8692]{transform:translate(0)}.dark-mode .scalar-dropdown-item[data-v-f5e0d3d8]:hover,.dark-mode .scalar-dropdown-item[data-highlighted][data-v-f5e0d3d8],.dark-mode .scalar-dropdown-item[data-v-3402682d]:hover{filter:brightness(1.1)}.scalar-icon[data-v-b651bb23],.scalar-icon[data-v-b651bb23] *{stroke-width:var(--c07589c2)}.scalar-app :where(code.hljs) *{font-size:inherit;font-family:var(--scalar-font-code);text-align:left;white-space:pre;word-spacing:normal;word-break:normal;word-wrap:normal;tab-size:4;line-height:1.4}.scalar-app code.hljs{all:unset;font-size:inherit;color:var(--scalar-color-2);font-family:var(--scalar-font-code);counter-reset:linenumber}.scalar-app .hljs{color:var(--scalar-color-2);background:0 0}.scalar-app .hljs .line:before{color:var(--scalar-color-3);counter-increment:linenumber;content:counter(linenumber);min-width:calc(var(--line-digits) * 1ch);text-align:right;margin-right:.875rem;display:inline-block}.scalar-app .hljs-comment,.scalar-app .hljs-quote{color:var(--scalar-color-3);font-style:italic}.scalar-app .hljs-number{color:var(--scalar-color-orange)}.scalar-app .hljs-regexp,.scalar-app .hljs-string,.scalar-app .hljs-built_in{color:var(--scalar-color-blue)}.scalar-app .hljs-title.class_{color:var(--scalar-color-1)}.scalar-app .hljs-keyword{color:var(--scalar-color-purple)}.scalar-app .hljs-title.function_{color:var(--scalar-color-orange)}.scalar-app .hljs-subst,.scalar-app .hljs-name{color:var(--scalar-color-blue)}.scalar-app .hljs-attr,.scalar-app .hljs-attribute{color:var(--scalar-color-1)}.scalar-app .hljs-addition,.scalar-app .hljs-literal,.scalar-app .hljs-selector-tag,.scalar-app .hljs-type{color:var(--scalar-color-green)}.scalar-app .hljs-selector-attr,.scalar-app .hljs-selector-pseudo{color:var(--scalar-color-orange)}.scalar-app .hljs-doctag,.scalar-app .hljs-section,.scalar-app .hljs-title{color:var(--scalar-color-blue)}.scalar-app .hljs-selector-id,.scalar-app .hljs-template-variable,.scalar-app .hljs-variable{color:var(--scalar-color-1)}.scalar-app .hljs-name,.scalar-app .hljs-section,.scalar-app .hljs-strong{font-weight:var(--scalar-semibold)}.scalar-app .hljs-bullet,.scalar-app .hljs-link,.scalar-app .hljs-meta,.scalar-app .hljs-symbol{color:var(--scalar-color-blue)}.scalar-app .hljs-deletion{color:var(--scalar-color-red)}.scalar-app .hljs-formula{background:var(--scalar-color-1)}.scalar-app .hljs-emphasis{font-style:italic}.scalar-app .credential .credential-value{color:#0000;font-size:0}.scalar-app .credential:after{content:"·····";color:var(--scalar-color-3);-webkit-user-select:none;user-select:none}.hljs.language-html{color:var(--scalar-color-1)}.hljs.language-html .hljs-attr{color:var(--scalar-color-2)}.hljs.language-curl .hljs-string{color:var(--scalar-color-blue)}.hljs.language-curl .hljs-literal{color:var(--scalar-color-1)}.hljs.language-php .hljs-variable{color:var(--scalar-color-blue)}.hljs.language-objectivec .hljs-meta{color:var(--scalar-color-1)}.hljs.language-objectivec .hljs-built_in,.hljs-built_in{color:var(--scalar-color-orange)}.scalar-app .markdown{--scalar-refs-heading-spacing:24px;--markdown-border:var(--scalar-border-width) solid var(--scalar-border-color);--markdown-spacing-sm:12px;--markdown-spacing-md:16px;--markdown-line-height:1.625;--markdown-heading-line-height:1.15;font-family:var(--scalar-font);word-break:break-word;line-height:var(--markdown-line-height)}.scalar-app .markdown>*{margin-bottom:var(--markdown-spacing-md)}.scalar-app .markdown>:not(h1):not(h2):not(h3):not(h4):not(h5):not(h6):last-child{margin-bottom:0}.scalar-app .markdown h1,.scalar-app .markdown h2,.scalar-app .markdown h3,.scalar-app .markdown h4,.scalar-app .markdown h5,.scalar-app .markdown h6{font-weight:var(--scalar-bold);margin-top:var(--scalar-refs-heading-spacing);margin-bottom:var(--markdown-spacing-sm);line-height:var(--markdown-heading-line-height,1.15);scroll-margin-top:1rem;display:block}.scalar-app .markdown h1{font-size:1.5rem}.scalar-app .markdown h2,.scalar-app .markdown h3{font-size:1.25rem}.scalar-app .markdown h4,.scalar-app .markdown h5,.scalar-app .markdown h6{font-size:1rem}.scalar-app .markdown b,.scalar-app .markdown strong{font-weight:var(--scalar-bold)}.scalar-app .markdown p{color:inherit;line-height:var(--markdown-line-height);display:block}.scalar-app .markdown img{border-radius:var(--scalar-radius);max-width:100%;display:inline-block;overflow:hidden}.scalar-app .markdown ul,.scalar-app .markdown ol{line-height:var(--markdown-line-height);flex-direction:column;gap:2px;padding-left:1.6em;display:flex}.scalar-app .markdown li{margin-top:2px;padding-left:7px}.scalar-app ol>li::marker{font:var(--scalar-font);font-variant-numeric:tabular-nums;font-weight:var(--scalar-semibold);white-space:nowrap}.scalar-app ol>*>li::marker{font:var(--scalar-font);font-variant-numeric:tabular-nums;font-weight:var(--scalar-semibold);white-space:nowrap}.scalar-app .markdown ol{list-style-type:decimal}.scalar-app .markdown ol ol{list-style-type:lower-alpha}.scalar-app .markdown ol ol ol ol,.scalar-app .markdown ol ol ol ol ol ol ol{list-style-type:decimal}.scalar-app .markdown ol ol ol ol ol,.scalar-app .markdown ol ol ol ol ol ol ol ol{list-style-type:lower-alpha}.scalar-app .markdown ol ol ol,.scalar-app .markdown ol ol ol ol ol ol,.scalar-app .markdown ol ol ol ol ol ol ol ol ol{list-style-type:lower-roman}.scalar-app .markdown ul>li,.scalar-app .markdown ul>*>li{list-style-type:disc}.scalar-app .markdown table{table-layout:fixed;border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:var(--scalar-radius);border-spacing:0;width:max-content;max-width:100%;margin:1em 0;display:table;position:relative;overflow-x:auto}.scalar-app .markdown tbody,.scalar-app .markdown thead{vertical-align:middle}.scalar-app .markdown tbody{display:table-row-group}.scalar-app .markdown thead{display:table-header-group}.scalar-app .markdown tr{border-color:inherit;vertical-align:inherit;display:table-row}.scalar-app .markdown td,.scalar-app .markdown th{vertical-align:top;min-width:1em;line-height:var(--markdown-line-height);word-break:break-word;font-size:var(--scalar-small);color:var(--scalar-color-1);border-right:var(--markdown-border);border-bottom:var(--markdown-border);padding:8.5px 16px;display:table-cell;position:relative}.scalar-app .markdown td>*,.scalar-app .markdown th>*{margin-bottom:0}.scalar-app .markdown th:empty{display:none}.scalar-app .markdown td:first-of-type,.scalar-app .markdown th:first-of-type{border-left:none}.scalar-app .markdown td:last-of-type,.scalar-app .markdown th:last-of-type{border-right:none}.scalar-app .markdown tr:last-of-type td{border-bottom:none}.scalar-app .markdown th{font-weight:var(--scalar-bold);text-align:left;background:var(--scalar-background-2);border-left-color:#0000}.scalar-app .markdown th:first-of-type{border-top-left-radius:var(--scalar-radius)}.scalar-app .markdown th:last-of-type{border-top-right-radius:var(--scalar-radius)}.scalar-app .markdown tr>[align=left]{text-align:left}.scalar-app .markdown tr>[align=right]{text-align:right}.scalar-app .markdown tr>[align=center]{text-align:center}.scalar-app .markdown details{border:var(--markdown-border);border-radius:var(--scalar-radius-xl);color:var(--scalar-color-1)}.scalar-app .markdown details>:not(summary){margin:var(--markdown-spacing-md);margin-bottom:0}.scalar-app .markdown details>p:has(>strong):not(:has(:not(strong))){margin-bottom:8px}.scalar-app .markdown details>p:has(>strong):not(:has(:not(strong)))+*{margin-top:0}.scalar-app .markdown details>table{width:calc(100% - calc(var(--markdown-spacing-md) * 2))}.scalar-app .markdown summary{min-height:40px;font-weight:var(--scalar-semibold);line-height:var(--markdown-line-height);cursor:pointer;-webkit-user-select:none;user-select:none;border-radius:2.5px;align-items:flex-start;gap:8px;padding:7px 14px;display:flex;position:relative}.scalar-app .markdown summary:hover{background-color:var(--scalar-background-2)}.scalar-app .markdown details[open]{padding-bottom:var(--markdown-spacing-md)}.scalar-app .markdown details[open]>summary{border-bottom:var(--markdown-border);border-bottom-right-radius:0;border-bottom-left-radius:0}.scalar-app .markdown summary:before{content:"";width:var(--markdown-spacing-md);height:var(--markdown-spacing-md);background-color:var(--scalar-color-3);flex-shrink:0;margin-top:5px;display:block;-webkit-mask-image:url("data:image/svg+xml,<svg xmlns=\\"http://www.w3.org/2000/svg\\" viewBox=\\"0 0 256 256\\" fill=\\"currentColor\\" width=\\"1em\\" height=\\"1em\\"><path d=\\"M181.66,133.66l-80,80a8,8,0,0,1-11.32-11.32L164.69,128,90.34,53.66a8,8,0,0,1,11.32-11.32l80,80A8,8,0,0,1,181.66,133.66Z\\"></path></svg>");mask-image:url("data:image/svg+xml,<svg xmlns=\\"http://www.w3.org/2000/svg\\" viewBox=\\"0 0 256 256\\" fill=\\"currentColor\\" width=\\"1em\\" height=\\"1em\\"><path d=\\"M181.66,133.66l-80,80a8,8,0,0,1-11.32-11.32L164.69,128,90.34,53.66a8,8,0,0,1,11.32-11.32l80,80A8,8,0,0,1,181.66,133.66Z\\"></path></svg>")}.scalar-app .markdown summary:hover:before{background-color:var(--scalar-color-1)}.scalar-app .markdown details[open]>summary:before{transition:transform .1s ease-in-out;transform:rotate(90deg)}.scalar-app .markdown details:has(+details){border-bottom:0;border-bottom-right-radius:0;border-bottom-left-radius:0;margin-bottom:0}.scalar-app .markdown details:has(+details)+details{border-top-left-radius:0;border-top-right-radius:0}.scalar-app .markdown details:has(+details)+details>summary{border-top-left-radius:0;border-top-right-radius:0}.scalar-app .markdown a{--font-color:var(--scalar-link-color,var(--scalar-color-accent));--font-visited:var(--scalar-link-color-visited,var(--scalar-color-2));-webkit-text-decoration:var(--scalar-text-decoration);-webkit-text-decoration:var(--scalar-text-decoration);-webkit-text-decoration:var(--scalar-text-decoration);text-decoration:var(--scalar-text-decoration);color:var(--font-color);font-weight:var(--scalar-link-font-weight,var(--scalar-semibold));text-underline-offset:.25rem;text-decoration-thickness:1px;-webkit-text-decoration-color:var(--font-color);-webkit-text-decoration-color:var(--font-color);-webkit-text-decoration-color:var(--font-color);text-decoration-color:var(--font-color)}@supports (color:color-mix(in lab, red, red)){.scalar-app .markdown a{-webkit-text-decoration-color:color-mix(in srgb, var(--font-color) 30%, transparent);-webkit-text-decoration-color:color-mix(in srgb, var(--font-color) 30%, transparent);-webkit-text-decoration-color:color-mix(in srgb, var(--font-color) 30%, transparent);text-decoration-color:color-mix(in srgb, var(--font-color) 30%, transparent)}}.scalar-app .markdown a:hover{-webkit-text-decoration-color:var(--scalar-color-1,currentColor);-webkit-text-decoration-color:var(--scalar-color-1,currentColor);-webkit-text-decoration-color:var(--scalar-color-1,currentColor);text-decoration-color:var(--scalar-color-1,currentColor);color:var(--scalar-link-color-hover,var(--scalar-color-accent));-webkit-text-decoration:var(--scalar-text-decoration-hover);-webkit-text-decoration:var(--scalar-text-decoration-hover);-webkit-text-decoration:var(--scalar-text-decoration-hover);-webkit-text-decoration:var(--scalar-text-decoration-hover);text-decoration:var(--scalar-text-decoration-hover)}.scalar-app .markdown a:visited{color:var(--font-visited)}.scalar-app .markdown em{font-style:italic}.scalar-app .markdown sup,.scalar-app .markdown sub{font-size:var(--scalar-micro);font-weight:450}.scalar-app .markdown sup{vertical-align:super}.scalar-app .markdown sub{vertical-align:sub}.scalar-app .markdown del{text-decoration:line-through}.scalar-app .markdown code{font-family:var(--scalar-font-code);background-color:var(--scalar-background-2);box-shadow:0 0 0 var(--scalar-border-width) var(--scalar-border-color);font-size:var(--scalar-micro);border-radius:2px;padding:0 3px}.scalar-app .markdown .hljs{font-size:var(--scalar-small)}.scalar-app .markdown pre code{white-space:pre;padding:var(--markdown-spacing-sm);margin:var(--markdown-spacing-sm) 0;-webkit-overflow-scrolling:touch;min-width:100px;max-width:100%;line-height:1.5;display:block;overflow-x:auto}.scalar-app .markdown hr{border:none;border-bottom:var(--markdown-border)}.scalar-app .markdown blockquote{border-left:2px solid var(--scalar-border-color);padding-left:var(--markdown-spacing-sm)}.scalar-app .markdown blockquote>*{margin-bottom:var(--markdown-spacing-sm)}.scalar-app .markdown li.task-list-item{list-style:none;position:relative}.scalar-app .markdown li.task-list-item>input{appearance:none;width:var(--markdown-spacing-md);height:var(--markdown-spacing-md);border:1px solid var(--scalar-color-3);border-radius:var(--scalar-radius);display:inline;position:absolute;top:.225em;left:-1.4em}.scalar-app .markdown li.task-list-item>input[type=checkbox]:checked{background-color:var(--scalar-color-1);border-color:var(--scalar-color-1)}.scalar-app .markdown li.task-list-item>input[type=checkbox]:before{content:"";border:solid var(--scalar-background-1);opacity:0;border-width:0 1.5px 1.5px 0;width:5px;height:10px;position:absolute;top:1px;left:5px;transform:rotate(45deg)}.scalar-app .markdown li.task-list-item>input[type=checkbox]:checked:before{opacity:1}.scalar-app .markdown .markdown-alert{border-radius:var(--scalar-radius);background-color:var(--scalar-background-2);align-items:stretch}@supports (color:color-mix(in lab, red, red)){.scalar-app .markdown .markdown-alert{background-color:color-mix(in srgb, var(--scalar-background-2), transparent)}}.scalar-app .markdown .markdown-alert{border:var(--markdown-border);gap:var(--markdown-spacing-sm);padding:10px 14px;display:flex;position:relative}.scalar-app .markdown .markdown-alert .markdown-alert-icon:before{content:"";background-color:currentColor;flex-shrink:0;width:18px;height:18px;margin-top:3px;display:block;-webkit-mask-position:50%;mask-position:50%;-webkit-mask-size:contain;mask-size:contain;-webkit-mask-repeat:no-repeat;mask-repeat:no-repeat}.scalar-app .markdown .markdown-alert.markdown-alert-note{background-color:var(--scalar-color-blue)}@supports (color:color-mix(in lab, red, red)){.scalar-app .markdown .markdown-alert.markdown-alert-note{background-color:color-mix(in srgb, var(--scalar-color-blue), transparent 97%)}}.scalar-app .markdown .markdown-alert.markdown-alert-note{border:var(--scalar-border-width) solid var(--scalar-color-blue)}@supports (color:color-mix(in lab, red, red)){.scalar-app .markdown .markdown-alert.markdown-alert-note{border:var(--scalar-border-width) solid color-mix(in srgb, var(--scalar-color-blue), transparent 50%)}}.scalar-app .markdown .markdown-alert.markdown-alert-tip{background-color:var(--scalar-color-2)}@supports (color:color-mix(in lab, red, red)){.scalar-app .markdown .markdown-alert.markdown-alert-tip{background-color:color-mix(in srgb, var(--scalar-color-2), transparent 97%)}}.scalar-app .markdown .markdown-alert.markdown-alert-tip{border:var(--scalar-border-width) solid var(--scalar-color-2)}@supports (color:color-mix(in lab, red, red)){.scalar-app .markdown .markdown-alert.markdown-alert-tip{border:var(--scalar-border-width) solid color-mix(in srgb, var(--scalar-color-2), transparent 50%)}}.scalar-app .markdown .markdown-alert.markdown-alert-note .markdown-alert-icon:before,.scalar-app .markdown .markdown-alert.markdown-alert-tip .markdown-alert-icon:before{color:var(--scalar-color-blue);-webkit-mask-image:url("data:image/svg+xml,<svg data-v-852d534d=\\"\\" xmlns=\\"http://www.w3.org/2000/svg\\" viewBox=\\"0 0 256 256\\" fill=\\"currentColor\\" class=\\"icon-placeholder\\"><path d=\\"M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm0,192a88,88,0,1,1,88-88A88.1,88.1,0,0,1,128,216Zm16-40a8,8,0,0,1-8,8,16,16,0,0,1-16-16V128a8,8,0,0,1,0-16,16,16,0,0,1,16,16v40A8,8,0,0,1,144,176ZM112,84a12,12,0,1,1,12,12A12,12,0,0,1,112,84Z\\"></path></svg>");mask-image:url("data:image/svg+xml,<svg data-v-852d534d=\\"\\" xmlns=\\"http://www.w3.org/2000/svg\\" viewBox=\\"0 0 256 256\\" fill=\\"currentColor\\" class=\\"icon-placeholder\\"><path d=\\"M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm0,192a88,88,0,1,1,88-88A88.1,88.1,0,0,1,128,216Zm16-40a8,8,0,0,1-8,8,16,16,0,0,1-16-16V128a8,8,0,0,1,0-16,16,16,0,0,1,16,16v40A8,8,0,0,1,144,176ZM112,84a12,12,0,1,1,12,12A12,12,0,0,1,112,84Z\\"></path></svg>")}.scalar-app .markdown .markdown-alert.markdown-alert-important,.scalar-app .markdown .markdown-alert.markdown-alert-warning{background-color:var(--scalar-color-orange)}@supports (color:color-mix(in lab, red, red)){.scalar-app .markdown .markdown-alert.markdown-alert-important,.scalar-app .markdown .markdown-alert.markdown-alert-warning{background-color:color-mix(in srgb, var(--scalar-color-orange), transparent 97%)}}.scalar-app .markdown .markdown-alert.markdown-alert-important,.scalar-app .markdown .markdown-alert.markdown-alert-warning{border:var(--scalar-border-width) solid var(--scalar-color-orange)}@supports (color:color-mix(in lab, red, red)){.scalar-app .markdown .markdown-alert.markdown-alert-important,.scalar-app .markdown .markdown-alert.markdown-alert-warning{border:var(--scalar-border-width) solid color-mix(in srgb, var(--scalar-color-orange), transparent 50%)}}.scalar-app .markdown .markdown-alert.markdown-alert-important .markdown-alert-icon:before,.scalar-app .markdown .markdown-alert.markdown-alert-warning .markdown-alert-icon:before{-webkit-mask-image:url("data:image/svg+xml,<svg data-v-852d534d=\\"\\" xmlns=\\"http://www.w3.org/2000/svg\\" viewBox=\\"0 0 256 256\\" fill=\\"currentColor\\" class=\\"icon-placeholder\\"><path d=\\"M236.8,188.09,149.35,36.22h0a24.76,24.76,0,0,0-42.7,0L19.2,188.09a23.51,23.51,0,0,0,0,23.72A24.35,24.35,0,0,0,40.55,224h174.9a24.35,24.35,0,0,0,21.33-12.19A23.51,23.51,0,0,0,236.8,188.09ZM222.93,203.8a8.5,8.5,0,0,1-7.48,4.2H40.55a8.5,8.5,0,0,1-7.48-4.2,7.59,7.59,0,0,1,0-7.72L120.52,44.21a8.75,8.75,0,0,1,15,0l87.45,151.87A7.59,7.59,0,0,1,222.93,203.8ZM120,144V104a8,8,0,0,1,16,0v40a8,8,0,0,1-16,0Zm20,36a12,12,0,1,1-12-12A12,12,0,0,1,140,180Z\\"></path></svg>");mask-image:url("data:image/svg+xml,<svg data-v-852d534d=\\"\\" xmlns=\\"http://www.w3.org/2000/svg\\" viewBox=\\"0 0 256 256\\" fill=\\"currentColor\\" class=\\"icon-placeholder\\"><path d=\\"M236.8,188.09,149.35,36.22h0a24.76,24.76,0,0,0-42.7,0L19.2,188.09a23.51,23.51,0,0,0,0,23.72A24.35,24.35,0,0,0,40.55,224h174.9a24.35,24.35,0,0,0,21.33-12.19A23.51,23.51,0,0,0,236.8,188.09ZM222.93,203.8a8.5,8.5,0,0,1-7.48,4.2H40.55a8.5,8.5,0,0,1-7.48-4.2,7.59,7.59,0,0,1,0-7.72L120.52,44.21a8.75,8.75,0,0,1,15,0l87.45,151.87A7.59,7.59,0,0,1,222.93,203.8ZM120,144V104a8,8,0,0,1,16,0v40a8,8,0,0,1-16,0Zm20,36a12,12,0,1,1-12-12A12,12,0,0,1,140,180Z\\"></path></svg>")}.scalar-app .markdown .markdown-alert.markdown-alert-caution{background-color:var(--scalar-color-red)}@supports (color:color-mix(in lab, red, red)){.scalar-app .markdown .markdown-alert.markdown-alert-caution{background-color:color-mix(in srgb, var(--scalar-color-red), transparent 97%)}}.scalar-app .markdown .markdown-alert.markdown-alert-caution{border:var(--scalar-border-width) solid var(--scalar-color-red)}@supports (color:color-mix(in lab, red, red)){.scalar-app .markdown .markdown-alert.markdown-alert-caution{border:var(--scalar-border-width) solid color-mix(in srgb, var(--scalar-color-red), transparent 50%)}}.scalar-app .markdown .markdown-alert.markdown-alert-caution .markdown-alert-icon:before{color:var(--scalar-color-red);-webkit-mask-image:url("data:image/svg+xml,<svg data-v-852d534d=\\"\\" xmlns=\\"http://www.w3.org/2000/svg\\" viewBox=\\"0 0 256 256\\" fill=\\"currentColor\\" class=\\"icon-placeholder\\"><path d=\\"M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm0,192a88,88,0,1,1,88-88A88.1,88.1,0,0,1,128,216Zm-8-80V80a8,8,0,0,1,16,0v56a8,8,0,0,1-16,0Zm20,36a12,12,0,1,1-12-12A12,12,0,0,1,140,172Z\\"></path></svg>");mask-image:url("data:image/svg+xml,<svg data-v-852d534d=\\"\\" xmlns=\\"http://www.w3.org/2000/svg\\" viewBox=\\"0 0 256 256\\" fill=\\"currentColor\\" class=\\"icon-placeholder\\"><path d=\\"M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm0,192a88,88,0,1,1,88-88A88.1,88.1,0,0,1,128,216Zm-8-80V80a8,8,0,0,1,16,0v56a8,8,0,0,1-16,0Zm20,36a12,12,0,1,1-12-12A12,12,0,0,1,140,172Z\\"></path></svg>")}.scalar-app .markdown .markdown-alert.markdown-alert-success{background-color:var(--scalar-color-green)}@supports (color:color-mix(in lab, red, red)){.scalar-app .markdown .markdown-alert.markdown-alert-success{background-color:color-mix(in srgb, var(--scalar-color-green), transparent 97%)}}.scalar-app .markdown .markdown-alert.markdown-alert-success{border:var(--scalar-border-width) solid var(--scalar-color-green)}@supports (color:color-mix(in lab, red, red)){.scalar-app .markdown .markdown-alert.markdown-alert-success{border:var(--scalar-border-width) solid color-mix(in srgb, var(--scalar-color-green), transparent 50%)}}.scalar-app .markdown .markdown-alert.markdown-alert-success .markdown-alert-icon:before{color:var(--scalar-color-green);-webkit-mask-image:url("data:image/svg+xml,<svg data-v-852d534d=\\"\\" xmlns=\\"http://www.w3.org/2000/svg\\" viewBox=\\"0 0 256 256\\" fill=\\"currentColor\\" class=\\"icon-placeholder\\"><path d=\\"M173.66,98.34a8,8,0,0,1,0,11.32l-56,56a8,8,0,0,1-11.32,0l-24-24a8,8,0,0,1,11.32-11.32L112,148.69l50.34-50.35A8,8,0,0,1,173.66,98.34ZM232,128A104,104,0,1,1,128,24,104.11,104.11,0,0,1,232,128Zm-16,0a88,88,0,1,0-88,88A88.1,88.1,0,0,0,216,128Z\\"></path></svg>");mask-image:url("data:image/svg+xml,<svg data-v-852d534d=\\"\\" xmlns=\\"http://www.w3.org/2000/svg\\" viewBox=\\"0 0 256 256\\" fill=\\"currentColor\\" class=\\"icon-placeholder\\"><path d=\\"M173.66,98.34a8,8,0,0,1,0,11.32l-56,56a8,8,0,0,1-11.32,0l-24-24a8,8,0,0,1,11.32-11.32L112,148.69l50.34-50.35A8,8,0,0,1,173.66,98.34ZM232,128A104,104,0,1,1,128,24,104.11,104.11,0,0,1,232,128Zm-16,0a88,88,0,1,0-88,88A88.1,88.1,0,0,0,216,128Z\\"></path></svg>")}.scalar-app .markdown .markdown-alert.markdown-alert-note .markdown-alert-icon:before{color:var(--scalar-color-blue)}.scalar-app .markdown .markdown-alert.markdown-alert-tip .markdown-alert-icon:before{color:var(--scalar-color-2)}.scalar-app .markdown .markdown-alert.markdown-alert-important .markdown-alert-icon:before{color:var(--scalar-color-purple)}.scalar-app .markdown .markdown-alert.markdown-alert-warning .markdown-alert-icon:before{color:var(--scalar-color-orange)}.scalar-app .markdown .markdown-alert .markdown-alert-content{line-height:var(--markdown-line-height);margin:0}.scalar-app .markdown.markdown-summary.markdown-summary :before,.scalar-app .markdown.markdown-summary.markdown-summary :after{content:none}.scalar-app .markdown.markdown-summary.markdown-summary :not(strong,em,a){font-size:inherit;font-weight:inherit;line-height:var(--markdown-line-height);display:contents}.scalar-app .markdown.markdown-summary.markdown-summary img,.scalar-app .markdown.markdown-summary.markdown-summary svg,.scalar-app .markdown.markdown-summary.markdown-summary hr,.scalar-app .markdown.markdown-summary.markdown-summary pre{display:none}.scalar-modal-layout[data-v-5bb1dcc2]{animation:.3s ease-in-out forwards fadein-layout-5bb1dcc2}.scalar-modal[data-v-5bb1dcc2]{box-shadow:var(--scalar-shadow-2);animation:.3s ease-in-out .1s forwards fadein-modal-5bb1dcc2;transform:translateY(10px)}.scalar-modal-layout-full[data-v-5bb1dcc2]{opacity:1!important;background:0 0!important}.modal-content-search .modal-body[data-v-5bb1dcc2]{flex-direction:column;max-height:440px;padding:0;display:flex;overflow:hidden}@media (width<=720px) and (height<=480px){.scalar-modal-layout .scalar-modal[data-v-5bb1dcc2]{max-height:90svh;margin-top:5svh}}@keyframes fadein-layout-5bb1dcc2{0%{opacity:0}to{opacity:1}}@keyframes fadein-modal-5bb1dcc2{0%{opacity:0;transform:translateY(10px)}to{opacity:1;transform:translate(0)}}.full-size-styles[data-v-5bb1dcc2]{margin:initial;border-right:var(--scalar-border-width) solid var(--scalar-border-color);animation:.3s ease-in-out forwards fadein-layout-5bb1dcc2;left:0;transform:translate(0);background-color:var(--scalar-background-1)!important;max-height:100%!important;box-shadow:none!important;border-radius:0!important;position:absolute!important;top:0!important}@media (width>=800px){.full-size-styles[data-v-5bb1dcc2]{width:50dvw!important}}.full-size-styles[data-v-5bb1dcc2]:after{content:"";width:50dvw;height:100dvh;position:absolute;top:0;right:-50dvw}.group\\/item>*>.scalar-sidebar-indent .scalar-sidebar-indent-border[data-v-3e080c68]{inset-block:-1px}.group\\/item:first-child>*>.scalar-sidebar-indent .scalar-sidebar-indent-border[data-v-3e080c68]{top:0}.group\\/item:last-child>*>.scalar-sidebar-indent .scalar-sidebar-indent-border[data-v-3e080c68]{bottom:0}.group\\/item:last-of-type>.group\\/button>.group\\/button-label>.group\\/button-loading{width:66.6667%}.group\\/items.-translate-x-full .group\\/button{transition-behavior:allow-discrete;max-height:0;transition-property:display,max-height;transition-duration:0s;transition-delay:.3s;display:none}.group\\/item.group\\/nested-items-open>*>.group\\/items.translate-x-0 .group\\/button{max-height:3.40282e38px;display:flex}.animate-sidebar-border-bottom{animation:forwards border-bottom;animation-timeline:scroll();animation-range-end:1px}@keyframes border-bottom{0%{border-bottom-width:0}to{border-bottom-width:var(--scalar-border-width)}}.group\\/sidebar-section:first-of-type>.group\\/spacer-before,.group\\/sidebar-section:last-of-type>.group\\/spacer-after{height:0}.group\\/sidebar-section:has(+.group\\/sidebar-section)>.group\\/spacer-after{height:0;margin-bottom:-1px}:where(body)>.scalar-tooltip{--scalar-tooltip-padding:8px;padding:calc(var(--scalar-tooltip-padding) + var(--scalar-tooltip-offset));z-index:99999;max-width:320px;font-size:var(--scalar-font-size-5);--tw-font-weight:var(--scalar-semibold);line-height:16px;font-weight:var(--scalar-semibold);overflow-wrap:break-word;color:var(--scalar-tooltip-color)}:where(body)>.scalar-tooltip:before{content:"";inset:var(--scalar-tooltip-offset);z-index:calc(1 * -1);border-radius:var(--scalar-radius);background-color:var(--scalar-tooltip-background);--tw-backdrop-blur:blur(8px);-webkit-backdrop-filter:var(--tw-backdrop-blur, ) var(--tw-backdrop-brightness, ) var(--tw-backdrop-contrast, ) var(--tw-backdrop-grayscale, ) var(--tw-backdrop-hue-rotate, ) var(--tw-backdrop-invert, ) var(--tw-backdrop-opacity, ) var(--tw-backdrop-saturate, ) var(--tw-backdrop-sepia, );backdrop-filter:var(--tw-backdrop-blur, ) var(--tw-backdrop-brightness, ) var(--tw-backdrop-contrast, ) var(--tw-backdrop-grayscale, ) var(--tw-backdrop-hue-rotate, ) var(--tw-backdrop-invert, ) var(--tw-backdrop-opacity, ) var(--tw-backdrop-saturate, ) var(--tw-backdrop-sepia, );position:absolute}:where(body.dark-mode)>.scalar-tooltip:before{--tw-shadow:inset 0 0 0 var(--tw-shadow-color,var(--scalar-border-width)) var(--scalar-border-color);box-shadow:var(--tw-inset-shadow), var(--tw-inset-ring-shadow), var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow)}@property --tw-font-weight{syntax:"*";inherits:false}@property --tw-backdrop-blur{syntax:"*";inherits:false}@property --tw-backdrop-brightness{syntax:"*";inherits:false}@property --tw-backdrop-contrast{syntax:"*";inherits:false}@property --tw-backdrop-grayscale{syntax:"*";inherits:false}@property --tw-backdrop-hue-rotate{syntax:"*";inherits:false}@property --tw-backdrop-invert{syntax:"*";inherits:false}@property --tw-backdrop-opacity{syntax:"*";inherits:false}@property --tw-backdrop-saturate{syntax:"*";inherits:false}@property --tw-backdrop-sepia{syntax:"*";inherits:false}@property --tw-shadow{syntax:"*";inherits:false;initial-value:0 0 #0000}@property --tw-shadow-color{syntax:"*";inherits:false}@property --tw-shadow-alpha{syntax:"<percentage>";inherits:false;initial-value:100%}@property --tw-inset-shadow{syntax:"*";inherits:false;initial-value:0 0 #0000}@property --tw-inset-shadow-color{syntax:"*";inherits:false}@property --tw-inset-shadow-alpha{syntax:"<percentage>";inherits:false;initial-value:100%}@property --tw-ring-color{syntax:"*";inherits:false}@property --tw-ring-shadow{syntax:"*";inherits:false;initial-value:0 0 #0000}@property --tw-inset-ring-color{syntax:"*";inherits:false}@property --tw-inset-ring-shadow{syntax:"*";inherits:false;initial-value:0 0 #0000}@property --tw-ring-inset{syntax:"*";inherits:false}@property --tw-ring-offset-width{syntax:"<length>";inherits:false;initial-value:0}@property --tw-ring-offset-color{syntax:"*";inherits:false;initial-value:#fff}@property --tw-ring-offset-shadow{syntax:"*";inherits:false;initial-value:0 0 #0000}.scalar-virtual-text-search-input[data-v-95edadbb]::-webkit-search-cancel-button{display:none}.scalar-virtual-text[data-v-b50a85e1]:focus{outline:none}.scalar-virtual-text-highlight[data-v-b50a85e1]{background:var(--scalar-background-accent);color:inherit;border-radius:2px;padding:1px 0}.scalar-virtual-text-highlight-active[data-v-b50a85e1]{background:var(--scalar-color-accent);color:var(--scalar-background-1);border-radius:2px}.sidebar-heading-type[data-v-1857170e]{text-transform:uppercase;color:var(--method-color,var(--scalar-color-1));font-size:10px;line-height:14px;font-weight:var(--scalar-bold);font-family:var(--scalar-font-code);white-space:nowrap;flex-shrink:0;align-items:center;gap:4px;display:inline-flex;overflow:hidden}.http-bg-gradient[data-v-7a19f363]{background:linear-gradient(#ffffffbf,#00000009)}.http-bg-gradient[data-v-7a19f363]:hover{background:linear-gradient(#00000009,#ffffffbf)}.dark-mode .http-bg-gradient[data-v-7a19f363]{background:linear-gradient(#ffffff09,#00000026)}.dark-mode .http-bg-gradient[data-v-7a19f363]:hover{background:linear-gradient(#00000026,#ffffff09)}.ascii-art-animate .ascii-art-line[data-v-9a695e58]{border-right:1ch solid #0000;animation:4s step-end 1s both typewriter-9a695e58,.5s step-end infinite blinkTextCursor-9a695e58}@keyframes typewriter-9a695e58{0%{width:0}to{width:100%}}@keyframes blinkTextCursor-9a695e58{0%{border-right-color:currentColor}50%{border-right-color:#0000}}.open-api-client-button[data-v-264dd42f]{cursor:pointer;text-align:center;white-space:nowrap;width:100%;height:31px;font-size:var(--scalar-small);border-radius:var(--scalar-radius);box-shadow:0 0 0 .5px var(--scalar-border-color);color:var(--scalar-sidebar-color-1);justify-content:center;align-items:center;gap:6px;padding:9px 12px;line-height:1.385;text-decoration:none;display:flex}.open-api-client-button[data-v-264dd42f]:hover{background:var(--scalar-sidebar-item-hover-background,var(--scalar-background-2))}.address-bar-history-button[data-v-2cc840c9]:hover{background:var(--scalar-background-3)}.address-bar-history-button[data-v-2cc840c9]:focus-within{background:var(--scalar-background-2)}[data-v-3118bf46] .cm-editor{background:0 0;outline:none;height:100%;padding:0}[data-v-3118bf46] .cm-placeholder{color:var(--scalar-color-3)}[data-v-3118bf46] .cm-content{font-family:var(--scalar-font-code);font-size:var(--scalar-small);max-height:20px;padding:8px 0}[data-v-3118bf46] .cm-tooltip{filter:brightness(var(--scalar-lifted-brightness));border-radius:var(--scalar-radius);box-shadow:var(--scalar-shadow-2);background:0 0!important;border:none!important;outline:none!important;overflow:hidden!important}[data-v-3118bf46] .cm-tooltip-autocomplete ul li{padding:3px 6px!important}[data-v-3118bf46] .cm-completionIcon-type:after{color:var(--scalar-color-3)!important}[data-v-3118bf46] .cm-tooltip-autocomplete ul li[aria-selected]{background:var(--scalar-background-2)!important;color:var(--scalar-color-1)!important}[data-v-3118bf46] .cm-tooltip-autocomplete ul{position:relative;padding:6px!important}[data-v-3118bf46] .cm-tooltip-autocomplete ul li:hover{border-radius:3px;color:var(--scalar-color-1)!important;background:var(--scalar-background-3)!important}[data-v-3118bf46] .cm-activeLine,[data-v-3118bf46] .cm-activeLineGutter{background-color:#0000}[data-v-3118bf46] .cm-selectionMatch,[data-v-3118bf46] .cm-matchingBracket{border-radius:var(--scalar-radius);background:var(--scalar-background-4)!important}[data-v-3118bf46] .cm-css-color-picker-wrapper{outline:1px solid var(--scalar-background-3);border-radius:3px;display:inline-flex;overflow:hidden}[data-v-3118bf46] .cm-gutters{color:var(--scalar-color-3);font-size:var(--scalar-small);background-color:#0000;border-right:none;border-radius:0 0 0 3px;line-height:22px}[data-v-3118bf46] .cm-gutters:before{content:"";border-radius:var(--scalar-radius) 0 0 var(--scalar-radius);background-color:var(--scalar-background-1);width:calc(100% - 2px);height:calc(100% - 4px);position:absolute;top:2px;left:2px}[data-v-3118bf46] .cm-gutterElement{justify-content:flex-end;align-items:center;display:flex;position:relative;font-family:var(--scalar-font-code)!important;padding-left:0!important;padding-right:6px!important}[data-v-3118bf46] .cm-lineNumbers .cm-gutterElement{min-width:fit-content}[data-v-3118bf46] .cm-gutter+.cm-gutter :not(.cm-foldGutter) .cm-gutterElement{padding-left:0!important}[data-v-3118bf46] .cm-scroller{overflow:auto}.line-wrapping[data-v-3118bf46]:focus-within .cm-content{white-space:break-spaces;word-break:break-all;min-height:fit-content;padding:3px 6px;display:inline-table}.cm-pill{font-size:var(--scalar-small);border-radius:30px;padding:0 9px;display:inline-block;color:var(--scalar-color-1)!important}.light-mode .cm-pill{background:var(--scalar-background-3)!important}.dark-mode .cm-pill{background:var(--tw-bg-base)!important}@supports (color:color-mix(in lab, red, red)){.dark-mode .cm-pill{background:color-mix(in srgb, var(--tw-bg-base), transparent 90%)!important}}.cm-pill--context-fn{border:1px dashed var(--scalar-color-3)}@supports (color:color-mix(in lab, red, red)){.cm-pill--context-fn{border:1px dashed color-mix(in srgb, var(--scalar-color-3), transparent 35%)}}.cm-pill--context-fn{padding:0 8px}.light-mode .cm-pill--context-fn{background:var(--scalar-background-3)!important}@supports (color:color-mix(in lab, red, red)){.light-mode .cm-pill--context-fn{background:color-mix(in srgb, var(--scalar-background-3), transparent 40%)!important}}.dark-mode .cm-pill--context-fn{background:var(--scalar-background-3)!important}@supports (color:color-mix(in lab, red, red)){.dark-mode .cm-pill--context-fn{background:color-mix(in srgb, var(--scalar-background-3), transparent 55%)!important}}.cm-pill:first-of-type{margin-left:0}.cm-editor .cm-widgetBuffer{display:none}.cm-foldPlaceholder:hover{color:var(--scalar-color-1)}.cm-foldGutter .cm-gutterElement{font-size:var(--scalar-heading-4);padding:2px!important}.cm-foldGutter .cm-gutterElement:first-of-type{display:none}.cm-foldGutter .cm-gutterElement .cm-foldMarker{padding:2px}.cm-foldGutter .cm-gutterElement:hover .cm-foldMarker{background:var(--scalar-background-2);border-radius:var(--scalar-radius);color:var(--scalar-color-1)}.description[data-v-1b7a32a4] .markdown{font-weight:var(--scalar-semibold);color:var(--scalar-color--1);padding:0;display:block}.description[data-v-1b7a32a4] .markdown>:first-child{margin-top:0}[data-v-4d85ebb9] .cm-editor{outline:none;width:100%;height:100%}[data-v-4d85ebb9] .cm-line{padding:0}[data-v-4d85ebb9] .cm-content{font-size:var(--scalar-small);align-items:center;padding:0;display:flex}.scroll-timeline-x[data-v-4d85ebb9]{-ms-overflow-style:none;-webkit-mask-image:linear-gradient(90deg,#0000 0,#000 6px calc(100% - 24px),#0000 100%);mask-image:linear-gradient(90deg,#0000 0,#000 6px calc(100% - 24px),#0000 100%)}.scroll-timeline-x-hidden[data-v-4d85ebb9]{overflow-x:auto}.scroll-timeline-x-hidden[data-v-4d85ebb9] .cm-scroller{scrollbar-width:none;-ms-overflow-style:none;padding-right:20px;overflow:auto}.scroll-timeline-x-hidden[data-v-4d85ebb9]::-webkit-scrollbar{width:0;height:0;display:none}.scroll-timeline-x-hidden[data-v-4d85ebb9] .cm-scroller::-webkit-scrollbar{width:0;height:0;display:none}.scroll-timeline-x-address[data-v-4d85ebb9]{scrollbar-width:none;line-height:27px}.scroll-timeline-x-address[data-v-4d85ebb9]:after{content:"";cursor:text;width:24px;height:100%;position:absolute;right:0}.scroll-timeline-x-address[data-v-4d85ebb9]:empty:before{content:"Enter URL or cURL request";color:var(--scalar-color-3);pointer-events:none}.address-bar-bg-states[data-v-4d85ebb9]{--scalar-address-bar-bg:var(--scalar-background-1)}@supports (color:color-mix(in lab, red, red)){.address-bar-bg-states[data-v-4d85ebb9]{--scalar-address-bar-bg:color-mix(in srgb, var(--scalar-background-1), var(--scalar-background-2))}}.address-bar-bg-states[data-v-4d85ebb9]{background:var(--scalar-address-bar-bg)}.address-bar-bg-states[data-v-4d85ebb9]:has(.cm-focused){--scalar-address-bar-bg:var(--scalar-background-1);border-color:var(--scalar-border-color);outline-width:1px;outline-style:solid}.app-exit-button[data-v-b1eef1b6]{color:#fff;background:#0000001a}.app-exit-button[data-v-b1eef1b6]:hover{background:#ffffff1a}.fade-request-section-content[data-v-f97cc68c]{background:linear-gradient(to left, var(--scalar-background-1) 64%, transparent)}.filter-hover[data-v-f97cc68c]{height:100%;padding-left:24px;padding-right:39px;transition:width 0s ease-in-out .2s;position:absolute;right:0;overflow:hidden}.filter-hover[data-v-f97cc68c]:hover{z-index:10;width:100%}.filter-hover[data-v-f97cc68c]:has(:focus-visible){z-index:10;width:100%}.filter-hover[data-v-f97cc68c]:before{content:"";background-color:var(--scalar-background-1);opacity:0;pointer-events:none;width:100%;height:fit-content;transition:all .3s ease-in-out;position:absolute;top:0;left:0}.filter-hover-item[data-v-f97cc68c]{opacity:0}.filter-hover-item[data-v-f97cc68c]:not(:last-of-type){transform:translateY(3px)}.filter-hover:hover .filter-hover-item[data-v-f97cc68c]{transition:opacity .2s ease-in-out,transform .2s ease-in-out}.filter-hover:hover .filter-hover-item[data-v-f97cc68c]:last-of-type{transition-delay:50ms}.filter-hover:hover .filter-hover-item[data-v-f97cc68c]:nth-last-of-type(2){transition-delay:.1s}.filter-hover:hover .filter-hover-item[data-v-f97cc68c]:nth-last-of-type(3){transition-delay:.15s}.filter-hover:hover .filter-hover-item[data-v-f97cc68c]:nth-last-of-type(4){transition-delay:.2s}.filter-hover:hover .filter-hover-item[data-v-f97cc68c]:nth-last-of-type(5){transition-delay:.25s}.filter-hover:hover .filter-hover-item[data-v-f97cc68c]:nth-last-of-type(6){transition-delay:.3s}.filter-hover:hover .filter-hover-item[data-v-f97cc68c]:nth-last-of-type(7){transition-delay:.35s}.filter-hover:hover .filter-hover-item[data-v-f97cc68c]{opacity:1;transform:translate(0)}.filter-hover:has(:focus-visible) .filter-hover-item[data-v-f97cc68c]{opacity:1;transform:translate(0)}.filter-hover[data-v-f97cc68c]:hover:before{opacity:.9;-webkit-backdrop-filter:blur(10px);backdrop-filter:blur(10px)}.filter-hover[data-v-f97cc68c]:has(:focus-visible):before{opacity:.9;-webkit-backdrop-filter:blur(10px);backdrop-filter:blur(10px)}.filter-button[data-v-f97cc68c]{top:50%;transform:translateY(-50%)}.context-bar-group:hover .context-bar-group-hover\\:text-c-1[data-v-f97cc68c]{--tw-text-opacity:1;color:rgb(var(--scalar-color-1) / var(--tw-text-opacity))}.context-bar-group:has(:focus-visible) .context-bar-group-hover\\:text-c-1[data-v-f97cc68c]{--tw-text-opacity:1;color:rgb(var(--scalar-color-1) / var(--tw-text-opacity))}.context-bar-group:hover .context-bar-group-hover\\:hidden[data-v-f97cc68c]{display:none}.context-bar-group:has(:focus-visible) .context-bar-group-hover\\:hidden[data-v-f97cc68c]{display:none}[data-v-36811e28] .cm-editor{padding:0}[data-v-36811e28] .cm-content{font-family:var(--scalar-font);font-size:var(--scalar-small);background-color:#0000;align-items:center;width:100%;padding:5px 8px;display:flex}[data-v-36811e28] .cm-content:has(.cm-pill){padding:5px 8px}[data-v-36811e28] .cm-content .cm-pill:not(:last-of-type){margin-right:.5px}[data-v-36811e28] .cm-content .cm-pill:not(:first-of-type){margin-left:.5px}[data-v-36811e28] .cm-line{text-overflow:ellipsis;padding:0;overflow:hidden}.filemask[data-v-36811e28]{-webkit-mask-image:linear-gradient(to right, transparent 0, var(--scalar-background-2) 20px);-webkit-mask-image:linear-gradient(to right, transparent 0, var(--scalar-background-2) 20px);-webkit-mask-image:linear-gradient(to right, transparent 0, var(--scalar-background-2) 20px);mask-image:linear-gradient(to right, transparent 0, var(--scalar-background-2) 20px)}[data-v-0362e671] .cm-content{font-size:var(--scalar-small)}.oauth-scope-row-action-rail{--oauth-scope-row-rail-bg:var(--scalar-background-1)}@supports (color:color-mix(in lab, red, red)){.oauth-scope-row-action-rail{--oauth-scope-row-rail-bg:color-mix(in srgb, var(--scalar-background-1), var(--scalar-background-2))}}.oauth-scope-row-action-rail{background:linear-gradient(90deg, var(--oauth-scope-row-rail-bg) 0%, var(--oauth-scope-row-rail-bg) 30%, var(--oauth-scope-row-rail-bg) 100%)}@supports (color:color-mix(in lab, red, red)){.oauth-scope-row-action-rail{background:linear-gradient(90deg, color-mix(in srgb, var(--oauth-scope-row-rail-bg), transparent 100%) 0%, color-mix(in srgb, var(--oauth-scope-row-rail-bg), transparent 20%) 30%, var(--oauth-scope-row-rail-bg) 100%)}}.no-scrollbar::-webkit-scrollbar{display:none}.no-scrollbar{-ms-overflow-style:none;scrollbar-width:none}[data-v-819cea32] .cm-editor{padding:0}[data-v-819cea32] .cm-content{font-family:var(--scalar-font);font-size:var(--scalar-small);background-color:#0000;align-items:center;width:100%;padding:5px 8px;display:flex}[data-v-819cea32] .cm-content:has(.cm-pill){padding:5px 8px}[data-v-819cea32] .cm-content .cm-pill:not(:last-of-type){margin-right:.5px}[data-v-819cea32] .cm-content .cm-pill:not(:first-of-type){margin-left:.5px}[data-v-819cea32] .cm-line{text-overflow:ellipsis;word-break:break-word;padding:0;overflow:hidden}.required[data-v-819cea32]:after{content:"Required"}input[data-v-819cea32]::placeholder{color:var(--scalar-color-3)}.scalar-password-input[data-v-819cea32]{text-security:disc;-webkit-text-security:disc;-moz-text-security:disc}.request-section-content[data-v-dc6f670a]{--scalar-border-width:.5px}.request-section-content-filter[data-v-dc6f670a]{box-shadow:0 -10px 0 10px var(--scalar-background-1)}.request-item:focus-within .request-meta-buttons[data-v-dc6f670a]{opacity:1}.group-hover-input[data-v-dc6f670a]{border-width:var(--scalar-border-width);border-color:#0000}.group:hover .group-hover-input[data-v-dc6f670a]{background:var(--scalar-background-1)}@supports (color:color-mix(in lab, red, red)){.group:hover .group-hover-input[data-v-dc6f670a]{background:color-mix(in srgb, var(--scalar-background-1), var(--scalar-background-2))}}.group:hover .group-hover-input[data-v-dc6f670a]{border-color:var(--scalar-border-color)}.group-hover-input[data-v-dc6f670a]:focus{border-color:var(--scalar-border-color)!important;background:0 0!important}[data-v-20050fd6] .cm-editor{font-size:var(--scalar-small);background-color:#0000;outline:none}[data-v-20050fd6] .cm-gutters{background-color:var(--scalar-background-1);border-radius:var(--scalar-radius) 0 0 var(--scalar-radius)}[data-v-20050fd6] .cm-scroller{min-width:100%;overflow:auto}.light-mode .bg-preview[data-v-65a8f4ce]{background-image:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' fill='%23000' fill-opacity='10%25'%3E%3Crect width='8' height='8' /%3E%3Crect x='8' y='8' width='8' height='8' /%3E%3C/svg%3E")}.dark-mode .bg-preview[data-v-65a8f4ce]{background-image:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' fill='%23FFF' fill-opacity='10%25'%3E%3Crect width='8' height='8' /%3E%3Crect x='8' y='8' width='8' height='8' /%3E%3C/svg%3E")}.scalar-code-block[data-v-bb31ac6f] .hljs *{font-size:var(--scalar-small)}.response-body-virtual[data-headlessui-state=open],.response-body-virtual[data-headlessui-state=open] .diclosure-panel{flex-direction:column;flex-grow:1;display:flex}.scalar-version-number[data-v-ab8886a2]{width:76px;height:76px;font-size:8px;font-family:var(--scalar-font-code);box-shadow:inset 2px 0px 0 2px var(--scalar-background-2);text-align:center;text-transform:initial;-webkit-text-decoration-color:var(--scalar-color-3);-webkit-text-decoration-color:var(--scalar-color-3);-webkit-text-decoration-color:var(--scalar-color-3);text-decoration-color:var(--scalar-color-3);border-radius:9px 9px 16px 12px;flex-direction:column;justify-content:center;align-items:center;margin-top:-113px;margin-left:-36px;line-height:11px;display:flex;position:absolute;transform:skewY(13deg)}.scalar-version-number a[data-v-ab8886a2]{background:var(--scalar-background-2);border:.5px solid var(--scalar-border-color);border-radius:3px;padding:2px 4px;font-weight:700;text-decoration:none}.gitbook-show[data-v-ab8886a2]{display:none}.v-enter-active[data-v-21dc7abd]{transition:opacity .5s}.v-enter-from[data-v-21dc7abd]{opacity:0}.animate-response-heading .response-heading[data-v-82f4df98]{opacity:1;animation:.2s ease-in-out forwards push-response-82f4df98}@keyframes push-response-82f4df98{0%{opacity:1;transform:translateY(0)}to{opacity:0;transform:translateY(-4px)}}.animate-response-heading .animate-response-children[data-v-82f4df98]{opacity:0;animation:.2s ease-in-out 50ms forwards response-spans-82f4df98}@keyframes response-spans-82f4df98{0%{opacity:0;transform:translateY(4px)}to{opacity:1;transform:translateY(0)}}.request-card[data-v-8d155354]{color:var(--scalar-color-1);font-size:var(--scalar-font-size-3)}.request-method[data-v-8d155354]{font-family:var(--scalar-font-code);text-transform:uppercase;margin-right:6px}.request-card-footer[data-v-8d155354]{flex-shrink:0;justify-content:flex-end;padding:6px;display:flex;position:relative}.request-card-footer-addon[data-v-8d155354]{flex:1;align-items:center;min-width:0;display:flex}.request-editor-section[data-v-8d155354]{flex:1;display:flex}.request-card-simple[data-v-8d155354]{font-size:var(--scalar-small);justify-content:space-between;align-items:center;padding:8px 8px 8px 12px;display:flex}.code-snippet[data-v-8d155354]{flex-direction:column;width:100%;display:flex}[data-radix-popper-content-wrapper]:has(.scalar-api-client-context-menu){z-index:1000!important}.resizer[data-v-e2c54c18]{cursor:col-resize;z-index:100;border-right:2px solid #0000;width:5px;transition:border-right-color .3s;position:absolute;top:0;bottom:0;right:0}.scalar-dragging{cursor:col-resize}.resizer:hover,.scalar-dragging .resizer{border-right-color:var(--scalar-background-3)}.scalar-dragging:after{content:"";display:block;position:absolute;inset:0}[data-v-28c8509c] .cm-editor{padding:0}[data-v-28c8509c] .cm-content{font-family:var(--scalar-font);font-size:var(--scalar-small);background-color:#0000;align-items:center;width:100%;padding:5px 8px;display:flex}[data-v-28c8509c] .cm-content:has(.cm-pill){padding:5px 8px}[data-v-28c8509c] .cm-content .cm-pill:not(:last-of-type){margin-right:.5px}[data-v-28c8509c] .cm-content .cm-pill:not(:first-of-type){margin-left:.5px}[data-v-28c8509c] .cm-line{text-overflow:ellipsis;padding:0;overflow:hidden}.scalar .scalar-app-layout[data-v-ae5e8531]{background:var(--scalar-background-1);border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:8px;width:100%;max-width:1390px;height:calc(100% - 120px);margin:auto;position:relative;overflow:hidden}@media (width<=720px) and (height<=480px){.scalar .scalar-app-layout[data-v-ae5e8531]{height:100%;max-height:90svh}}.scalar .scalar-app-exit[data-v-ae5e8531]{cursor:pointer;z-index:-1;background:#00000038;width:100vw;height:100vh;position:fixed;top:0;left:0}.dark-mode .scalar .scalar-app-exit[data-v-ae5e8531]{background:#00000073}.scalar .scalar-app-exit[data-v-ae5e8531]:before{text-align:center;color:#fff;opacity:.6;font-family:sans-serif;font-size:30px;font-weight:100;line-height:50px;position:absolute;top:0;right:12px}.scalar .scalar-app-exit[data-v-ae5e8531]:hover:before{opacity:1}.scalar-container[data-v-ae5e8531]{visibility:hidden;opacity:0;pointer-events:none;will-change:opacity;justify-content:center;align-items:center;width:100%;height:100%;transition:opacity .35s,visibility 0s linear .35s;display:flex;position:fixed;top:0;bottom:0;left:0;overflow:hidden}.scalar-container.scalar-client--open[data-v-ae5e8531]{opacity:1;visibility:visible;pointer-events:auto;transition:opacity .35s}.scalar .url-form-input[data-v-ae5e8531]{min-height:auto!important}.scalar .scalar-container[data-v-ae5e8531]{line-height:normal}.ref-search-meta[data-v-a00657cc]{background:var(--scalar-background-1);border-bottom-left-radius:var(--scalar-radius-lg);border-bottom-right-radius:var(--scalar-radius-lg);font-size:var(--scalar-font-size-4);color:var(--scalar-color-3);font-weight:var(--scalar-semibold);border-top:var(--scalar-border-width) solid var(--scalar-border-color);gap:12px;padding:6px 12px;display:flex}.authenticationProvided[data-v-e3416cd5]{color:var(--scalar-color-1);font-weight:var(--scalar-semibold);min-height:40px;font-size:var(--scalar-font-size-3);align-items:center;gap:6px;display:flex;position:relative}.authenticationRequired[data-v-d15ef40b]{color:var(--scalar-color-blue);font-weight:var(--scalar-semibold);min-height:40px;font-size:var(--scalar-font-size-3);align-items:center;gap:6px;display:flex;position:relative}.askForAuthentication[data-v-3e7aa176]{border-top:var(--scalar-border-width) solid var(--scalar-border-color);border-bottom:var(--scalar-border-width) solid var(--scalar-border-color);width:100%;box-shadow:0 var(--scalar-border-width) 0 var(--scalar-background-1), 0 calc(-1 * var(--scalar-border-width)) 0 var(--scalar-background-1);flex-direction:column;margin-bottom:12px;padding:0;display:flex;position:relative}.authContent[data-v-3e7aa176]{grid-template-rows:0fr;width:100%;max-width:520px;min-height:0;margin:auto;transition:grid-template-rows .2s ease-out;display:grid;overflow:hidden}.authContentInner[data-v-3e7aa176]>div{margin:36px 0 48px}.authContent[data-v-3e7aa176] .markdown{margin-bottom:0!important}.askForAuthentication.open .authContent[data-v-3e7aa176]{grid-template-rows:1fr}.continueButton[data-v-3e7aa176]{align-self:flex-end}.toggleButton[data-v-3e7aa176]{cursor:pointer;text-align:left;color:var(--scalar-color-3);border-radius:var(--scalar-radius-lg);background:0 0;border:none;justify-content:space-between;align-items:center;display:flex;position:relative}.authContentInner[data-v-3e7aa176]{min-height:0;overflow:hidden}.authorizeButton[data-v-3e7aa176]{z-index:1;gap:5px;display:flex;background:var(--scalar-color-blue)!important;color:#fff!important;margin:0!important}.autosendPaused[data-v-d08225db]{color:var(--scalar-color-blue);font-weight:var(--scalar-semibold);min-height:40px;font-size:var(--scalar-font-size-3);align-items:center;gap:6px;display:flex;position:relative}.playIcon[data-v-5749c429]{z-index:1;background:var(--scalar-background-1);border-radius:50%;justify-content:center;align-items:center;width:16px;height:16px;padding:4px;display:flex;position:relative}.playIcon[data-v-5749c429]:before{content:"";box-sizing:border-box;border:1.75px solid;border-bottom-color:#0000;border-image:initial;background:var(--scalar-background-1);border-radius:50%;width:16px;height:16px;animation:.42s linear infinite rotation-5749c429;display:inline-block;position:absolute}.buildingRequest[data-v-5749c429]{color:var(--scalar-color-blue);font-weight:var(--scalar-semibold);min-height:40px;font-size:var(--scalar-font-size-3);align-items:center;gap:6px;display:flex;position:relative}.buildingRequest svg[data-v-5749c429]{z-index:1;border-radius:50%;width:100%;height:100%}@keyframes rotation-5749c429{0%{transform:rotate(0)}to{transform:rotate(360deg)}}.requestApproved[data-v-bb311586]{color:var(--scalar-color-green);font-weight:var(--scalar-semibold);min-height:40px;font-size:var(--scalar-font-size-3);align-items:center;gap:6px;display:flex;position:relative}.requestFailed[data-v-bc27e533]{color:var(--scalar-color-red);font-weight:var(--scalar-semibold);min-height:40px;font-size:var(--scalar-font-size-3);align-items:center;gap:6px;display:flex;position:relative}.requestFailedIcon[data-v-bc27e533]{border-radius:50%;width:16px;height:16px;padding:4px;box-shadow:inset 0 0 0 1.5px}.requestRejected[data-v-9803a54c]{color:var(--scalar-color-red);font-weight:var(--scalar-semibold);min-height:40px;font-size:var(--scalar-font-size-3);align-items:center;gap:6px;display:flex;position:relative}.requestSuccess[data-v-acc2c0d8]{color:var(--scalar-color-1);font-weight:var(--scalar-semibold);min-height:40px;font-size:var(--scalar-font-size-3);align-items:center;gap:6px;display:flex;position:relative}.light-mode .bg-preview[data-v-92f84612]{background-image:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' fill='%23000' fill-opacity='10%25'%3E%3Crect width='8' height='8' /%3E%3Crect x='8' y='8' width='8' height='8' /%3E%3C/svg%3E")}.dark-mode .bg-preview[data-v-92f84612]{background-image:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' fill='%23FFF' fill-opacity='10%25'%3E%3Crect width='8' height='8' /%3E%3Crect x='8' y='8' width='8' height='8' /%3E%3C/svg%3E")}.playIcon[data-v-65dc6dfb]{z-index:1;background:var(--scalar-background-1);border-radius:50%;justify-content:center;align-items:center;width:16px;height:16px;padding:4px;display:flex;position:relative}.playIcon[data-v-65dc6dfb]:before{content:"";box-sizing:border-box;border:1.75px solid;border-bottom-color:#0000;border-image:initial;background:var(--scalar-background-1);border-radius:50%;width:16px;height:16px;animation:.42s linear infinite rotation-65dc6dfb;display:inline-block;position:absolute}.sendingRequest[data-v-65dc6dfb]{color:var(--scalar-color-blue);font-weight:var(--scalar-semibold);min-height:40px;font-size:var(--scalar-font-size-3);align-items:center;gap:6px;display:flex;position:relative}.sendingRequest svg[data-v-65dc6dfb]{z-index:1;border-radius:50%;width:100%;height:100%}@keyframes rotation-65dc6dfb{0%{transform:rotate(0)}to{transform:rotate(360deg)}}.requestHeaderContainer[data-v-0eb5f95d]{justify-content:space-between;align-items:center;padding:0 5px;display:flex}.requestPreview[data-v-0eb5f95d]{border-radius:12px;flex-direction:column;width:100%;display:flex;position:relative}.requestContent[data-v-0eb5f95d]{grid-template-rows:0fr;min-height:0;transition:grid-template-rows .2s ease-out;display:grid;overflow:hidden}.requestPreview.open .requestContent[data-v-0eb5f95d]{grid-template-rows:1fr}.requestPreview.succeeded[data-v-0eb5f95d]{padding:0}.requestContentInner[data-v-0eb5f95d]{min-height:0;overflow:hidden}.code[data-v-0eb5f95d]{font-size:var(--scalar-font-size-4);background:var(--scalar-background-2);border-radius:12px;flex-direction:column;display:flex}@supports (color:color-mix(in lab, red, red)){.code[data-v-0eb5f95d]{background:color-mix(in srgb, var(--scalar-background-2), var(--scalar-background-1))}}.code[data-v-0eb5f95d]{margin-bottom:12px;overflow:hidden}.dark-mode .code[data-v-0eb5f95d]{background:var(--scalar-background-2)}.code h1[data-v-0eb5f95d]{font-size:var(--scalar-font-size-3);color:var(--scalar-color-3);padding:8px}.code[data-v-0eb5f95d] .codeBlock{max-height:calc(50vh - 100px);padding-top:0}.autosendContainer[data-v-0eb5f95d]{justify-content:space-between;display:flex}.sendButton[data-v-0eb5f95d]{background:var(--scalar-color-blue);color:#fff;font-weight:var(--scalar-semibold);padding:5px 10px}.sendButton[data-v-0eb5f95d]:hover,.sendButton[data-v-0eb5f95d]:active{background:var(--scalar-color-blue)}@supports (color:color-mix(in lab, red, red)){.sendButton[data-v-0eb5f95d]:hover,.sendButton[data-v-0eb5f95d]:active{background:color-mix(in srgb, var(--scalar-color-blue), black 10%)}}.sendButton[data-v-0eb5f95d]:hover,.sendButton[data-v-0eb5f95d]:active{color:#fff!important}.toggleButton[data-v-0eb5f95d]{cursor:pointer;text-align:left;color:var(--scalar-color-3);border-radius:var(--scalar-radius-lg);background:0 0;border:none;justify-content:space-between;align-items:center;display:flex;position:relative}.toggleButton[data-v-0eb5f95d]:hover{text-decoration:underline}.executeRequestTool[data-v-3e825a81]{border-top:var(--scalar-border-width) solid var(--scalar-border-color);border-bottom:var(--scalar-border-width) solid var(--scalar-border-color);box-shadow:0 var(--scalar-border-width) 0 var(--scalar-background-1), 0 calc(-1 * var(--scalar-border-width)) 0 var(--scalar-background-1);flex-direction:column;gap:10px;margin-bottom:12px;display:flex}.tool[data-v-3e825a81]{border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:15px;margin-bottom:20px;padding:15px}.playIcon[data-v-9d9724d2]{z-index:1;background:var(--scalar-background-1);border-radius:50%;justify-content:center;align-items:center;width:16px;height:16px;padding:4px;display:flex;position:relative}.playIcon[data-v-9d9724d2]:before{content:"";box-sizing:border-box;border:1.5px solid;border-bottom-color:#0000;border-image:initial;background:var(--scalar-background-1);border-radius:50%;width:16px;height:16px;animation:.42s linear infinite rotation-9d9724d2;display:inline-block;position:absolute}.loadingApiSpecs[data-v-9d9724d2]{color:var(--scalar-color-2);font-weight:var(--scalar-semibold);font-size:var(--scalar-font-size-3);align-items:center;gap:6px;margin-bottom:10px;display:flex}.loadingApiSpecs svg[data-v-9d9724d2]{z-index:1;border-radius:50%;width:100%;height:100%}@keyframes rotation-9d9724d2{0%{transform:rotate(0)}to{transform:rotate(360deg)}}.contextItem[data-v-e6786ce3]{white-space:nowrap;color:var(--scalar-color-2);cursor:pointer;vertical-align:middle;background:var(--scalar-background-2);border-radius:12px;align-items:center;padding:5px 10px;font-size:10px;display:flex}@supports (color:color-mix(in lab, red, red)){.contextItem[data-v-e6786ce3]{background:color-mix(in srgb, var(--scalar-background-2), var(--scalar-background-1))}}.contextItem[data-v-e6786ce3]{max-width:200px}.contextItemText[data-v-e6786ce3]{text-overflow:ellipsis;white-space:nowrap;overflow:hidden}.shimmer[data-v-e6786ce3]{background:var(--scalar-background-2);background-image:linear-gradient(90deg, #202020 0%, var(--scalar-background-2) 40%, var(--scalar-background-3) 80%);background-size:200% 100%;animation:1.4s ease-in-out infinite shimmer-e6786ce3}.light-mode .shimmer[data-v-e6786ce3]{background:var(--scalar-background-2);background-image:linear-gradient(90deg, #fafafa 0%, var(--scalar-background-2) 40%, var(--scalar-background-3) 80%);background-size:200% 100%;animation:1.4s ease-in-out infinite shimmer-e6786ce3}@keyframes shimmer-e6786ce3{0%{background-position:200% 0}to{background-position:-200% 0}}.playIcon[data-v-6e0ac42c]{z-index:1;background:var(--scalar-background-1);border-radius:50%;justify-content:center;align-items:center;width:16px;height:16px;padding:4px;display:flex;position:relative}.playIcon[data-v-6e0ac42c]:before{content:"";box-sizing:border-box;border:1.5px solid;border-bottom-color:#0000;border-image:initial;background:var(--scalar-background-1);border-radius:50%;width:16px;height:16px;animation:.42s linear infinite rotation-6e0ac42c;display:inline-block;position:absolute}.sendingRequest[data-v-6e0ac42c]{color:var(--scalar-color-2);font-weight:var(--scalar-semibold);font-size:var(--scalar-font-size-3);align-items:center;gap:6px;margin-bottom:10px;display:flex}.sendingRequest svg[data-v-6e0ac42c]{z-index:1;border-radius:50%;width:100%;height:100%}@keyframes rotation-6e0ac42c{0%{transform:rotate(0)}to{transform:rotate(360deg)}}.operations[data-v-43dd2b86]{flex-wrap:wrap;align-items:center;gap:5px;margin-bottom:12px;display:flex}.operations[data-v-43dd2b86]:empty{margin-bottom:-12px}.overflowPopover[data-v-43dd2b86]{flex-direction:column;gap:5px;padding:8px;display:flex}.catalogModal .scalar-modal-body{flex-direction:column;display:flex}.searchInput[data-v-bc24f891]{border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:var(--scalar-radius-lg);margin-bottom:10px}.catalog[data-v-bc24f891]{font-size:var(--scalar-font-size-3);grid-template-columns:1fr 1fr;gap:10px;display:grid;overflow-y:scroll}.item[data-v-bc24f891]{background-color:var(--scalar-background-2);border-radius:var(--scalar-radius-lg);align-items:center;gap:10px;padding:15px;transition:background-color .16s;display:flex}.item[data-v-bc24f891]:hover{background-color:var(--scalar-background-3)!important}@supports (color:color-mix(in lab, red, red)){.item[data-v-bc24f891]:hover{background-color:color-mix(in srgb, var(--scalar-background-3), transparent 40%)!important}}.left[data-v-bc24f891]{align-items:center}.right[data-v-bc24f891]{flex-direction:column;display:flex}.logo[data-v-bc24f891]{width:25px}.item-top[data-v-bc24f891]{gap:10px;display:flex}.version[data-v-bc24f891]{background:var(--scalar-background-3);border-radius:var(--scalar-radius);font-size:var(--scalar-font-size-5);color:var(--scalar-color-3);padding:2px 5px}.description[data-v-bc24f891]{color:var(--scalar-color-2)}.dropdown-item[data-v-2d142bb5]{align-items:center;gap:10px;display:flex}.approvalSection[data-v-a7e6c699]{background:var(--scalar-color-blue);width:100%;margin-bottom:-16px;padding:8px 8px 24px 12px}@supports (color:color-mix(in lab, red, red)){.approvalSection[data-v-a7e6c699]{background:color-mix(in srgb, var(--scalar-color-blue), var(--scalar-background-1) 95%)}}.approvalSection[data-v-a7e6c699]{border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:16px 16px 0 0;justify-content:space-between;align-items:center;display:flex;position:absolute;top:0;transform:translateY(calc(16px - 100%))}.approvalText[data-v-a7e6c699]{font-weight:var(--scalar-semibold);font-size:var(--scalar-font-size-3)}.approveContainer[data-v-a7e6c699]{gap:5px;display:flex}.actionButton[data-v-a7e6c699]{font-weight:var(--scalar-semibold);font-size:var(--scalar-font-size-3);border-radius:50px;align-items:center;padding:6px 12px;display:flex}.rejectButton[data-v-a7e6c699]{color:#fff;background:var(--scalar-color-red)}.rejectButton[data-v-a7e6c699]:hover,.rejectButton[data-v-a7e6c699]:active{background:var(--scalar-color-red)}@supports (color:color-mix(in lab, red, red)){.rejectButton[data-v-a7e6c699]:hover,.rejectButton[data-v-a7e6c699]:active{background:color-mix(in srgb, var(--scalar-color-red), var(--scalar-background-1) 10%)}}.rejectButton[data-v-a7e6c699]:hover,.rejectButton[data-v-a7e6c699]:active{color:#fff!important}.approveButton[data-v-a7e6c699]{color:#fff;background:var(--scalar-color-blue)}.approveButton[data-v-a7e6c699]:hover,.approveButton[data-v-a7e6c699]:active{background:var(--scalar-color-blue)}@supports (color:color-mix(in lab, red, red)){.approveButton[data-v-a7e6c699]:hover,.approveButton[data-v-a7e6c699]:active{background:color-mix(in srgb, var(--scalar-color-blue), var(--scalar-background-1) 10%)}}.approveButton[data-v-a7e6c699]:hover,.approveButton[data-v-a7e6c699]:active{color:#fff!important}.error[data-v-63a481da]{border:var(--scalar-border-width) solid var(--scalar-border-color);background:var(--scalar-color-red);border-radius:16px 16px 0 0;align-items:center;margin-bottom:-16px;padding:8px 8px 24px 12px;display:flex}@supports (color:color-mix(in lab, red, red)){.error[data-v-63a481da]{background:color-mix(in srgb, var(--scalar-color-red), var(--scalar-background-1) 95%)}}.error[data-v-63a481da]{font-weight:var(--scalar-semibold);font-size:var(--scalar-font-size-3);position:absolute;top:0;transform:translateY(calc(16px - 100%))}.freeMessagesInfoSection[data-v-913a3815]{background:var(--scalar-color-blue);width:100%;margin-bottom:-16px;padding:8px 8px 24px 12px;position:relative}@supports (color:color-mix(in lab, red, red)){.freeMessagesInfoSection[data-v-913a3815]{background:color-mix(in srgb, var(--scalar-color-blue), var(--scalar-background-1) 95%)}}.freeMessagesInfoSection[data-v-913a3815]{border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:16px 16px 0 0;justify-content:space-between;align-items:center;display:flex}.infoText[data-v-913a3815]{font-weight:var(--scalar-semibold);font-size:var(--scalar-font-size-3)}.actionsContainer[data-v-913a3815]{align-items:center;gap:8px;display:flex}.actionButton[data-v-913a3815]{font-weight:var(--scalar-semibold);border-radius:50px;align-items:center;padding:6px 12px;display:flex}.upgradeButton[data-v-913a3815]{color:#fff;font-size:var(--scalar-font-size-3);background:var(--scalar-color-blue)}.upgradeButton[data-v-913a3815]:hover,.upgradeButton[data-v-913a3815]:active{background:var(--scalar-color-blue)}@supports (color:color-mix(in lab, red, red)){.upgradeButton[data-v-913a3815]:hover,.upgradeButton[data-v-913a3815]:active{background:color-mix(in srgb, var(--scalar-color-blue), var(--scalar-background-1) 10%)}}.upgradeButton[data-v-913a3815]:hover,.upgradeButton[data-v-913a3815]:active{color:#fff!important}.closeButton[data-v-913a3815]{width:28px;height:28px;color:var(--scalar-color-2);cursor:pointer;background:0 0;border:none;border-radius:50%;justify-content:center;align-items:center;display:flex}.closeButton[data-v-913a3815]:hover{background:var(--scalar-color-blue)}@supports (color:color-mix(in lab, red, red)){.closeButton[data-v-913a3815]:hover{background:color-mix(in srgb, var(--scalar-color-blue), var(--scalar-background-1) 80%)}}.closeButton[data-v-913a3815]:hover{color:var(--scalar-color-1)}.paymentSection[data-v-8f005a5c]{background:var(--scalar-color-blue);width:100%;margin-bottom:-16px;padding:8px 8px 24px 12px;position:relative}@supports (color:color-mix(in lab, red, red)){.paymentSection[data-v-8f005a5c]{background:color-mix(in srgb, var(--scalar-color-blue), var(--scalar-background-1) 95%)}}.paymentSection[data-v-8f005a5c]{border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:16px 16px 0 0;justify-content:space-between;align-items:center;display:flex;position:absolute;top:0;transform:translateY(calc(16px - 100%))}.approvalText[data-v-8f005a5c]{font-weight:var(--scalar-semibold);font-size:var(--scalar-font-size-3)}.paymentContainer[data-v-8f005a5c]{gap:5px;display:flex}.actionButton[data-v-8f005a5c]{font-weight:var(--scalar-semibold);border-radius:50px;align-items:center;padding:6px 12px;display:flex}.rejectButton[data-v-8f005a5c]{color:#fff;background:var(--scalar-color-red)}.rejectButton[data-v-8f005a5c]:hover,.rejectButton[data-v-8f005a5c]:active{background:var(--scalar-color-red)}@supports (color:color-mix(in lab, red, red)){.rejectButton[data-v-8f005a5c]:hover,.rejectButton[data-v-8f005a5c]:active{background:color-mix(in srgb, var(--scalar-color-red), var(--scalar-background-1) 10%)}}.rejectButton[data-v-8f005a5c]:hover,.rejectButton[data-v-8f005a5c]:active{color:#fff!important}.approveButton[data-v-8f005a5c]{color:#fff;font-size:var(--scalar-font-size-3);background:var(--scalar-color-blue)}.approveButton[data-v-8f005a5c]:hover,.approveButton[data-v-8f005a5c]:active{background:var(--scalar-color-blue)}@supports (color:color-mix(in lab, red, red)){.approveButton[data-v-8f005a5c]:hover,.approveButton[data-v-8f005a5c]:active{background:color-mix(in srgb, var(--scalar-color-blue), var(--scalar-background-1) 10%)}}.approveButton[data-v-8f005a5c]:hover,.approveButton[data-v-8f005a5c]:active{color:#fff!important}.paymentInfo[data-v-8f005a5c]{width:300px;box-shadow:var(--scalar-shadow-2);background:var(--scalar-background-1);pointer-events:none;opacity:0;border-radius:16px;padding:12px;transition:all .2s ease-in-out;position:absolute;bottom:70px;right:0;transform:translateY(-5px)}.paymentInfo h3[data-v-8f005a5c]{font-size:var(--scalar-font-size-1);font-weight:var(--scalar-bold);margin-bottom:18px}.paymentInfo h3 span[data-v-8f005a5c]{font-size:var(--scalar-font-size-2)}.dark-mode .paymentInfo[data-v-8f005a5c]{background:var(--scalar-background-2)}.paymentContainer:hover .paymentInfo[data-v-8f005a5c]{opacity:1;transform:translate(0)}.paymentInfoItem[data-v-8f005a5c]{font-size:var(--scalar-font-size-3);color:var(--scalar-color-2);font-weight:var(--scalar-semibold);justify-content:space-between;margin-top:8px;display:flex}.paymentInfoSection[data-v-8f005a5c]:not(:last-child){border-bottom:var(--scalar-border-width) solid var(--scalar-border-color);padding-bottom:8px}.searchItem[data-v-7945f74c]{font-size:var(--scalar-font-size-3);align-items:center;gap:9px;padding:8px 10px;display:flex}.searchInput[data-v-7945f74c]{margin-bottom:5px}.searchItem[data-v-7945f74c]:hover{background:var(--scalar-background-2)}.searchItemLogo[data-v-7945f74c]{width:15px}.searchIcon[data-v-7945f74c]{margin-right:7px}.searchResultsEmpty[data-v-7945f74c]{font-size:var(--scalar-font-size-3);color:var(--scalar-color-2);margin:10px}.uploadSection[data-v-9551cf83]{background:var(--scalar-color-blue);width:100%;margin-bottom:-16px;padding:8px 8px 24px 12px;position:relative}@supports (color:color-mix(in lab, red, red)){.uploadSection[data-v-9551cf83]{background:color-mix(in srgb, var(--scalar-color-blue), var(--scalar-background-1) 95%)}}.uploadSection[data-v-9551cf83]{border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:16px 16px 0 0;justify-content:space-between;align-items:center;display:flex;position:absolute;top:0;transform:translateY(calc(16px - 100%))}.uploadSection.error[data-v-9551cf83]{background:var(--scalar-color-red)}@supports (color:color-mix(in lab, red, red)){.uploadSection.error[data-v-9551cf83]{background:color-mix(in srgb, var(--scalar-color-red), var(--scalar-background-1) 95%)}}.uploadSection.done[data-v-9551cf83]{background:var(--scalar-color-green)}@supports (color:color-mix(in lab, red, red)){.uploadSection.done[data-v-9551cf83]{background:color-mix(in srgb, var(--scalar-color-green), var(--scalar-background-1) 95%)}}.uploadText[data-v-9551cf83]{font-weight:var(--scalar-semibold);font-size:var(--scalar-font-size-3)}.icon[data-v-9551cf83]{width:20px;height:20px}.actionContainer[data-v-e7c7c266]{background:var(--scalar-background-2)}@supports (color:color-mix(in lab, red, red)){.actionContainer[data-v-e7c7c266]{background:color-mix(in srgb, var(--scalar-background-2), var(--scalar-background-1))}}.actionContainer[data-v-e7c7c266]{border:var(--scalar-border-width) solid var(--scalar-border-color);width:100%;box-shadow:0 24px 0 2px var(--scalar-background-1);border-radius:16px;position:relative}.promptForm[data-v-e7c7c266]{background:var(--scalar-background-1);width:100%;box-shadow:var(--scalar-shadow-1), 0 0 0 var(--scalar-border-width) var(--scalar-border-color);border-radius:16px;flex-direction:column;display:flex;position:relative}.inputActionsContainer[data-v-e7c7c266]{justify-content:space-between;padding:0 8px 8px;display:flex}.inputActionsLeft[data-v-e7c7c266]{flex-wrap:wrap;align-items:center;gap:5px;display:flex}.inputActionsRight[data-v-e7c7c266]{gap:5px;display:flex;position:relative}.apiPill[data-v-e7c7c266]{font-size:var(--scalar-font-size-3);border:var(--scalar-border-width) solid var(--scalar-border-color);color:var(--scalar-color-2);font-weight:var(--scalar-semibold);pointer-events:all;z-index:1;-webkit-user-select:none;user-select:none;border-radius:16px;align-items:center;gap:4px;height:28px;padding:0 8px;display:flex}.apiPillLogo[data-v-e7c7c266]{width:15px}.apiPillRemove[data-v-e7c7c266]{border-radius:50%;justify-content:center;align-items:center;width:24px;height:24px;margin-right:-6px;display:flex}.apiPill:hover .apiPillRemove[data-v-e7c7c266]{background:var(--scalar-background-2)}.dark-mode .apiPill:hover .apiPillRemove[data-v-e7c7c266]{background:var(--scalar-background-3)}.apiPillRemove[data-v-e7c7c266]:hover{color:var(--scalar-color-1)}.prompt[data-v-e7c7c266]{resize:none;field-sizing:content;z-index:1;scrollbar-width:thin;word-wrap:break-word;width:100%;max-width:100%;min-height:64px;max-height:250px;font-family:var(--scalar-font);border:none;outline:none;padding:12px 12px 14px;font-size:16px;overflow-y:auto}.dark-mode .promptForm[data-v-e7c7c266]{background:var(--scalar-background-2)}.prompt[data-v-e7c7c266]:disabled{color:var(--scalar-color-3)}.addAPIButton[data-v-e7c7c266]{color:var(--scalar-color-2);font-size:var(--scalar-font-size-3);width:28px;height:28px;font-weight:var(--scalar-bold);pointer-events:all;z-index:1;box-shadow:0 0 0 var(--scalar-border-width) var(--scalar-border-color);border-radius:100%;justify-content:center;align-items:center;gap:4px;display:flex}.addAPIButton[data-v-e7c7c266]:hover{background:var(--scalar-background-2)}@supports (color:color-mix(in lab, red, red)){.addAPIButton[data-v-e7c7c266]:hover{background:color-mix(in srgb, var(--scalar-background-2), var(--scalar-background-1))}}.addAPIButton[data-v-e7c7c266]:hover{box-shadow:0 0 0 var(--scalar-border-width) var(--scalar-border-color)}.dark-mode .addAPIButton[data-v-e7c7c266]:hover{background:var(--scalar-background-3)}.settingsButton[data-v-e7c7c266]{z-index:1;color:var(--scalar-color-3)!important;border-radius:50%!important;margin:0!important}.settingsButton[aria-disabled=true][data-v-e7c7c266]{background:var(--scalar-background-2)}.dark-mode .settingsButton[data-v-e7c7c266]:hover{background:var(--scalar-background-3)}.sendButton[data-v-e7c7c266]{z-index:1;border:var(--scalar-border-width) solid var(--scalar-color-blue);background:var(--scalar-color-blue)!important;border-radius:50%!important;margin:0!important}.sendButton[data-v-e7c7c266]:not([aria-disabled=true]){color:#fff!important}.sendButton[data-v-e7c7c266]:not([aria-disabled=true]):hover{background:var(--scalar-color-blue)!important}@supports (color:color-mix(in lab, red, red)){.sendButton[data-v-e7c7c266]:not([aria-disabled=true]):hover{background:color-mix(in srgb, var(--scalar-color-blue), transparent 10%)!important}}.sendButton[aria-disabled=true][data-v-e7c7c266]{border:var(--scalar-border-width) solid var(--scalar-border-color);background:var(--scalar-background-2)!important;color:var(--scalar-color-3)!important}.dark-mode .sendButton[aria-disabled=true][data-v-e7c7c266]{background:var(--scalar-background-3)!important}.contextContainer[data-v-e7c7c266]{width:100%;color:var(--scalar-color-2);font-size:var(--scalar-font-size-3);-webkit-user-select:none;user-select:none;justify-content:space-between;padding:10px 12px 12px;display:flex}.settingsButton[data-v-e7c7c266]{font-weight:var(--scalar-semibold);border-radius:var(--scalar-radius-lg);margin:-4px -6px;padding:4px 6px}.settingsButton[data-v-e7c7c266]:hover{background:var(--scalar-background-2);box-shadow:0 0 var(--scalar-border-width) 0 var(--scalar-border-color);cursor:pointer}.agentLabel[data-v-e7c7c266]{cursor:text;width:100%;height:100%;font-size:0;position:absolute}.sendCheckboxContinue[data-v-e7c7c266]:has(input){background:var(--scalar-background-2);box-shadow:0 0 0 1.5px var(--scalar-background-2);color:var(--scalar-color-2);font-size:var(--scalar-font-size-3);font-weight:var(--scalar-semibold);-webkit-user-select:none;user-select:none;border-radius:14px;align-items:center;height:28px;display:flex}.dark-mode .sendCheckboxContinue[data-v-e7c7c266]:has(input){background:var(--scalar-background-3);box-shadow:0 0 0 1.5px var(--scalar-background-3)}.addMoreContext[data-v-e7c7c266]{height:40px;font-size:var(--scalar-font-size-3);color:var(--scalar-color-3);align-items:center;padding:0 8px 0 12px;display:flex;position:relative}.addMoreContext[data-v-e7c7c266]:before{content:"";background:var(--scalar-background-1);width:8px;height:8px}@supports (color:color-mix(in lab, red, red)){.addMoreContext[data-v-e7c7c266]:before{background:color-mix(in srgb, var(--scalar-background-1), var(--scalar-background-2))}}.addMoreContext[data-v-e7c7c266]:before{box-shadow:-.5px -.5px 0 var(--scalar-border-color), inset .5px .5px 1px var(--scalar-border-color);position:absolute;top:-3px;left:18px;transform:rotate(45deg)}.dark-mode .addMoreContext[data-v-e7c7c266]:before{box-shadow:-.5px -.5px 0 var(--scalar-border-color)}.addAPIContext[data-v-e7c7c266]{border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:50%;justify-content:center;align-items:center;width:28px;height:28px;display:flex}.termsAgree[data-v-e7c7c266]{cursor:pointer;height:inherit;border-radius:14px;align-items:center;gap:5px;margin:0 5px;display:flex}.termsAgree[data-v-e7c7c266]:hover{color:var(--scalar-color-1)}.termsAgree:hover .termsAgreeIcon[data-v-e7c7c266]{background:var(--scalar-color-1);color:var(--scalar-background-1)}.termsAgreeIcon[data-v-e7c7c266]{width:inherit;height:inherit;background:var(--scalar-background-2);border-radius:50%;padding:2px}.chat[data-v-8e43ed7a]{flex-direction:column;flex:1;width:100%;max-width:744px;padding:24px 0;display:flex}.userMessage[data-v-8e43ed7a]{background:var(--scalar-background-2);width:fit-content;max-width:80%;color:var(--scalar-color-1);padding-top:6px;padding-bottom:6px;border-radius:18px;margin-bottom:12px;margin-left:auto;padding-inline:16px;font-size:16px;line-height:24px}div+.userMessage[data-v-8e43ed7a]{margin-top:64px}.chat[data-v-8e43ed7a]>div:has(.executeRequestTool)+div:has(.executeRequestTool){margin-top:-12px}.spacer[data-v-8e43ed7a]{width:100%;min-height:280px}.formContainer[data-v-8e43ed7a]{z-index:1;width:100%;max-width:744px;position:fixed;bottom:20px}.chat[data-v-8e43ed7a] .markdown{margin-bottom:12px}.agentLogo[data-v-56f7e8dd]{margin-bottom:15px}.startContainer[data-v-56f7e8dd]{flex-direction:column;justify-content:center;align-items:center;width:100%;max-width:720px;height:100%;display:flex;position:relative}.heading[data-v-56f7e8dd]{font-size:1.5rem;font-weight:var(--scalar-font-bold);margin-bottom:50px}.disclaimerText[data-v-56f7e8dd]{text-align:center;color:var(--scalar-color-3);font-size:var(--scalar-font-size-3);text-wrap:balance;margin-top:40px;line-height:1.44}.disclaimerLink[data-v-56f7e8dd]{text-decoration:underline}.wrapper[data-v-f1eee0af]{flex-direction:column;align-items:center;width:100%;height:100%;display:flex}.docSettings[data-v-01a25619]{font-size:var(--scalar-font-size-3);flex-direction:column;gap:12px;max-height:600px;margin-bottom:12px;display:flex}.documentName[data-v-01a25619]{font-weight:var(--scalar-semibold)}.settingsModal .scalar-modal-layout{z-index:10!important}.settingsModal .scalar-modal-body{overflow:hidden auto}.documentList[data-v-9843da37]{font-size:var(--scalar-font-size-3);flex-direction:column;margin-bottom:12px;display:flex}.document[data-v-9843da37]{border-top:var(--scalar-border-width) solid var(--scalar-border-color);border-bottom:var(--scalar-border-width) solid var(--scalar-border-color);flex-direction:column;width:calc(100% + 24px);padding:0 12px;display:flex;position:relative;left:-12px}.document[data-v-9843da37]:first-of-type:not(:last-of-type){border-bottom:none}.documentName[data-v-9843da37]{font-weight:var(--scalar-semibold);color:var(--scalar-color-2);align-items:center;gap:4px;padding:12px 0;display:flex}.documentNameActive[data-v-9843da37]{color:var(--scalar-color-1)}.settingsHeading[data-v-9843da37]{font-size:19px;font-weight:var(--scalar-semibold);align-items:center;gap:5px;margin-bottom:12px;display:flex}.proxyUrlContainer[data-v-9843da37]{font-size:var(--scalar-font-size-3);flex-direction:column;gap:5px;display:flex}.proxyUrlContainer label[data-v-9843da37]{font-weight:var(--scalar-semibold)}.noDocuments[data-v-9843da37]{color:var(--scalar-color-2);margin-bottom:10px}.scalar-app .\\@container{container-type:inline-size}.scalar-app .pointer-events-auto{pointer-events:auto}.scalar-app .pointer-events-none{pointer-events:none}.scalar-app .collapse{visibility:collapse}.scalar-app .invisible{visibility:hidden}.scalar-app .visible{visibility:visible}.scalar-app .floating-bg:before{background-color:var(--scalar-background-2);border-radius:var(--scalar-radius);content:"";opacity:0;z-index:1;width:calc(100% + 8px);height:calc(100% - 4px);transition:opacity .2s ease-in-out;position:absolute;top:2.5px;left:-4px}.scalar-app .floating-bg:hover:before{opacity:1}.scalar-app .centered{--tw-translate-y:calc(calc(1 / 2 * 100%) * -1);--tw-translate-x:calc(calc(1 / 2 * 100%) * -1);translate:var(--tw-translate-x) var(--tw-translate-y);position:absolute;top:50%;left:50%}.scalar-app .centered-y{--tw-translate-y:calc(calc(1 / 2 * 100%) * -1);translate:var(--tw-translate-x) var(--tw-translate-y);position:absolute;top:50%}.scalar-app .sr-only{clip-path:inset(50%);white-space:nowrap;border-width:0;width:1px;height:1px;margin:-1px;padding:0;position:absolute;overflow:hidden}.scalar-app .absolute{position:absolute}.scalar-app .fixed{position:fixed}.scalar-app .relative{position:relative}.scalar-app .static{position:static}.scalar-app .sticky{position:sticky}.scalar-app .inset-0{inset:0}.scalar-app .inset-x-0{inset-inline:0}.scalar-app .inset-x-1{inset-inline:4px}.scalar-app .inset-x-px{inset-inline:1px}.scalar-app .-inset-y-0\\.5{inset-block:-2px}.scalar-app .-inset-y-0\\.75{inset-block:-3px}.scalar-app .inset-y-0{inset-block:0}.scalar-app .inset-y-0\\.5{inset-block:2px}.scalar-app .start{inset-inline-start:4px}.scalar-app .end{inset-inline-end:4px}.scalar-app .-top-1{top:-4px}.scalar-app .-top-2{top:-8px}.scalar-app .top-\\(--nested-items-offset\\)\\!{top:var(--nested-items-offset)!important}.scalar-app .top-\\(--refs-header-height\\){top:var(--refs-header-height)}.scalar-app .top-\\(--scalar-custom-header-height\\,0\\){top:var(--scalar-custom-header-height,0)}.scalar-app .top-\\(--scalar-sidebar-sticky-offset\\,0\\){top:var(--scalar-sidebar-sticky-offset,0)}.scalar-app .top-0{top:0}.scalar-app .top-0\\.5{top:2px}.scalar-app .top-1\\/2{top:50%}.scalar-app .top-2{top:8px}.scalar-app .top-2\\.5{top:10px}.scalar-app .top-3\\.5{top:14px}.scalar-app .top-12{top:48px}.scalar-app .top-\\[1lh\\]{top:1lh}.scalar-app .top-\\[calc\\(10px\\+0\\.5lh\\)\\]{top:calc(10px + .5lh)}.scalar-app .top-\\[calc\\(100\\%\\+4px\\)\\]{top:calc(100% + 4px)}.scalar-app .top-px{top:1px}.scalar-app .-right-1{right:-4px}.scalar-app .-right-1\\.5{right:-6px}.scalar-app .-right-\\[30px\\]{right:-30px}.scalar-app .right-0{right:0}.scalar-app .right-0\\.75{right:3px}.scalar-app .right-1{right:4px}.scalar-app .right-1\\.5{right:6px}.scalar-app .right-1\\.25{right:5px}.scalar-app .right-2{right:8px}.scalar-app .right-2\\.5{right:10px}.scalar-app .right-4{right:16px}.scalar-app .right-7{right:28px}.scalar-app .right-12{right:48px}.scalar-app .bottom-1{bottom:4px}.scalar-app .bottom-4{bottom:16px}.scalar-app .bottom-\\[var\\(--scalar-border-width\\)\\]{bottom:var(--scalar-border-width)}.scalar-app .-left-4\\.5{left:-18px}.scalar-app .-left-5{left:-20px}.scalar-app .-left-6{left:-24px}.scalar-app .left-0{left:0}.scalar-app .left-1\\/2{left:50%}.scalar-app .left-2{left:8px}.scalar-app .left-2\\.5{left:10px}.scalar-app .left-3{left:12px}.scalar-app .left-4{left:16px}.scalar-app .left-border{left:var(--scalar-border-width)}.scalar-app .left-px{left:1px}.scalar-app .left-refs-w-sidebar{left:var(--refs-sidebar-width)}.scalar-app .-z-1{z-index:calc(1 * -1)}.scalar-app .-z-2{z-index:calc(2 * -1)}.scalar-app .z-0{z-index:0}.scalar-app .z-1{z-index:1}.scalar-app .z-10{z-index:10;z-index:10}.scalar-app .z-50{z-index:50;z-index:50}.scalar-app .z-\\[1\\]{z-index:1}.scalar-app .z-context{z-index:1000}.scalar-app .z-context-plus{z-index:1001}.scalar-app .z-overlay{z-index:10000}.scalar-app .z-tooltip{z-index:99999}.scalar-app .order-789{order:789}.scalar-app .order-last{order:9999}.scalar-app .col-span-full{grid-column:1/-1}.scalar-app .container{width:100%}@media (width>=400px){.scalar-app .container{max-width:400px}}@media (width>=600px){.scalar-app .container{max-width:600px}}@media (width>=800px){.scalar-app .container{max-width:800px}}@media (width>=1000px){.scalar-app .container{max-width:1000px}}@media (width>=1200px){.scalar-app .container{max-width:1200px}}@media (width>=96rem){.scalar-app .container{max-width:96rem}}.scalar-app .\\!m-0{margin:0!important}.scalar-app .-m-0\\.5{margin:-2px}.scalar-app .-m-1{margin:-4px}.scalar-app .-m-2{margin:-8px}.scalar-app .-m-px{margin:-1px}.scalar-app .m-0{margin:0}.scalar-app .m-1{margin:4px}.scalar-app .m-auto{margin:auto}.scalar-app .-mx-\\(--scalar-sidebar-padding\\){margin-inline:calc(var(--scalar-sidebar-padding) * -1)}.scalar-app .-mx-0\\.25{margin-inline:-1px}.scalar-app .-mx-0\\.75{margin-inline:-3px}.scalar-app .-mx-2{margin-inline:-8px}.scalar-app .-mx-px{margin-inline:-1px}.scalar-app .mx-0\\.5{margin-inline:2px}.scalar-app .mx-1{margin-inline:4px}.scalar-app .mx-1\\.5{margin-inline:6px}.scalar-app .mx-px{margin-inline:1px}.scalar-app .-my-0\\.5{margin-block:-2px}.scalar-app .-my-1{margin-block:-4px}.scalar-app .-my-1\\.5{margin-block:-6px}.scalar-app .-my-2{margin-block:-8px}.scalar-app .-my-px{margin-block:-1px}.scalar-app .my-0\\.75{margin-block:3px}.scalar-app .my-1\\.5{margin-block:6px}.scalar-app .my-2{margin-block:8px}.scalar-app .my-3{margin-block:12px}.scalar-app .my-12{margin-block:48px}.scalar-app .-mt-\\(--scalar-sidebar-padding\\){margin-top:calc(var(--scalar-sidebar-padding) * -1)}.scalar-app .-mt-1{margin-top:-4px}.scalar-app .-mt-1\\.5{margin-top:-6px}.scalar-app .-mt-\\[\\.5px\\]{margin-top:-.5px}.scalar-app .mt-0{margin-top:0}.scalar-app .mt-0\\.5{margin-top:2px}.scalar-app .mt-0\\.25{margin-top:1px}.scalar-app .mt-1{margin-top:4px}.scalar-app .mt-2{margin-top:8px}.scalar-app .mt-3{margin-top:12px}.scalar-app .mt-6{margin-top:24px}.scalar-app .mt-\\[15svh\\]{margin-top:15svh}.scalar-app .mt-\\[20svh\\]{margin-top:20svh}.scalar-app .mt-auto{margin-top:auto}.scalar-app .mt-px{margin-top:1px}.scalar-app .-mr-0\\.5{margin-right:-2px}.scalar-app .-mr-1{margin-right:-4px}.scalar-app .-mr-1\\.5{margin-right:-6px}.scalar-app .-mr-px{margin-right:-1px}.scalar-app .mr-0{margin-right:0}.scalar-app .mr-0\\.5{margin-right:2px}.scalar-app .mr-0\\.75{margin-right:3px}.scalar-app .mr-1{margin-right:4px}.scalar-app .mr-1\\.5{margin-right:6px}.scalar-app .mr-1\\.25{margin-right:5px}.scalar-app .mr-2{margin-right:8px}.scalar-app .mr-3{margin-right:12px}.scalar-app .mr-\\[calc\\(20px-var\\(--scalar-sidebar-indent\\)\\)\\]{margin-right:calc(20px - var(--scalar-sidebar-indent))}.scalar-app .-mb-1{margin-bottom:-4px}.scalar-app .-mb-\\[var\\(--scalar-border-width\\)\\]{margin-bottom:calc(var(--scalar-border-width) * -1)}.scalar-app .mb-0{margin-bottom:0}.scalar-app .mb-1{margin-bottom:4px}.scalar-app .mb-2{margin-bottom:8px}.scalar-app .mb-3{margin-bottom:12px}.scalar-app .mb-4{margin-bottom:16px}.scalar-app .-ml-0\\.5{margin-left:-2px}.scalar-app .-ml-0\\.25{margin-left:-1px}.scalar-app .-ml-0\\.75{margin-left:-3px}.scalar-app .ml-1{margin-left:4px}.scalar-app .ml-2{margin-left:8px}.scalar-app .ml-auto{margin-left:auto}.scalar-app .box-border{box-sizing:border-box}.scalar-app .box-content{box-sizing:content-box}.scalar-app .flex-center{justify-content:center;align-items:center;display:flex}.scalar-app .line-clamp-\\(--markdown-clamp\\){-webkit-line-clamp:var(--markdown-clamp);-webkit-box-orient:vertical;display:-webkit-box;overflow:hidden}.scalar-app .line-clamp-1{-webkit-line-clamp:1;-webkit-box-orient:vertical;display:-webkit-box;overflow:hidden}.scalar-app .\\!block{display:block!important}.scalar-app .\\!hidden{display:none!important}.scalar-app .block{display:block}.scalar-app .contents{display:contents}.scalar-app .flex{display:flex}.scalar-app .grid{display:grid}.scalar-app .hidden{display:none}.scalar-app .inline{display:inline}.scalar-app .inline-block{display:inline-block}.scalar-app .inline-flex{display:inline-flex}.scalar-app .table{display:table}.scalar-app .field-sizing-content{field-sizing:content}.scalar-app .aspect-\\[4\\/3\\]{aspect-ratio:4/3}.scalar-app .aspect-square{aspect-ratio:1}.scalar-app .size-1\\.5{width:6px;height:6px}.scalar-app .size-2\\.5{width:10px;height:10px}.scalar-app .size-2\\.75{width:11px;height:11px}.scalar-app .size-3{width:12px;height:12px}.scalar-app .size-3\\.5{width:14px;height:14px}.scalar-app .size-3\\/4{width:75%;height:75%}.scalar-app .size-4{width:16px;height:16px}.scalar-app .size-4\\.5{width:18px;height:18px}.scalar-app .size-5{width:20px;height:20px}.scalar-app .size-6{width:24px;height:24px}.scalar-app .size-8{width:32px;height:32px}.scalar-app .size-10{width:40px;height:40px}.scalar-app .size-\\[23px\\]{width:23px;height:23px}.scalar-app .size-full{width:100%;height:100%}.scalar-app .h-\\(--refs-sidebar-height\\){height:var(--refs-sidebar-height)}.scalar-app .h-\\(--scalar-address-bar-height\\){height:var(--scalar-address-bar-height)}.scalar-app .h-\\(--scalar-header-height\\){height:var(--scalar-header-height)}.scalar-app .h-0{height:0}.scalar-app .h-1{height:4px}.scalar-app .h-1\\.5{height:6px}.scalar-app .h-2{height:8px}.scalar-app .h-2\\.5{height:10px}.scalar-app .h-2\\.25{height:9px}.scalar-app .h-3{height:12px}.scalar-app .h-3\\.5{height:14px}.scalar-app .h-4{height:16px}.scalar-app .h-4\\.5{height:18px}.scalar-app .h-5{height:20px}.scalar-app .h-6{height:24px}.scalar-app .h-7{height:28px}.scalar-app .h-8{height:32px}.scalar-app .h-10{height:40px}.scalar-app .h-\\[calc\\(100\\%\\+16px\\)\\]{height:calc(100% + 16px)}.scalar-app .h-\\[calc\\(100\\%_-_50px\\)\\]{height:calc(100% - 50px)}.scalar-app .h-auto{height:auto}.scalar-app .h-border{height:var(--scalar-border-width)}.scalar-app .h-dvh{height:100dvh}.scalar-app .h-fit{height:fit-content}.scalar-app .h-full{height:100%}.scalar-app .h-lh{height:1lh}.scalar-app .h-min{height:min-content}.scalar-app .h-px{height:1px}.scalar-app .\\!max-h-\\[initial\\]{max-height:initial!important}.scalar-app .max-h-8{max-height:32px}.scalar-app .max-h-40{max-height:160px}.scalar-app .max-h-80{max-height:320px}.scalar-app .max-h-\\[60svh\\]{max-height:60svh}.scalar-app .max-h-\\[60vh\\]{max-height:60vh}.scalar-app .max-h-\\[80svh\\]{max-height:80svh}.scalar-app .max-h-\\[90svh\\]{max-height:90svh}.scalar-app .max-h-\\[auto\\]{max-height:auto}.scalar-app .max-h-\\[calc\\(100\\%-32px\\)\\]{max-height:calc(100% - 32px)}.scalar-app .max-h-\\[inherit\\]{max-height:inherit}.scalar-app .max-h-dvh{max-height:100dvh}.scalar-app .max-h-fit{max-height:fit-content}.scalar-app .max-h-radix-popper{max-height:calc(var(--radix-popper-available-height) - 8px);max-height:calc(var(--radix-popper-available-height) - 8px);max-height:calc(var(--radix-popper-available-height) - 8px);max-height:calc(var(--radix-popper-available-height) - 8px);max-height:calc(var(--radix-popper-available-height) - 8px);max-height:calc(var(--radix-popper-available-height) - 8px);max-height:calc(var(--radix-popper-available-height) - 8px)}.scalar-app .max-h-screen{max-height:100vh}.scalar-app .min-h-0{min-height:0}.scalar-app .min-h-3{min-height:12px}.scalar-app .min-h-7{min-height:28px}.scalar-app .min-h-8{min-height:32px}.scalar-app .min-h-10{min-height:40px}.scalar-app .min-h-11{min-height:44px}.scalar-app .min-h-16{min-height:64px}.scalar-app .min-h-20{min-height:80px}.scalar-app .min-h-\\[64px\\]{min-height:64px}.scalar-app .min-h-\\[calc\\(4rem\\+0\\.5px\\)\\]{min-height:calc(4rem + .5px)}.scalar-app .min-h-fit{min-height:fit-content}.scalar-app .min-h-header{min-height:48px}.scalar-app .\\!w-fit{width:fit-content!important}.scalar-app .w-\\(--refs-sidebar-width\\){width:var(--refs-sidebar-width)}.scalar-app .w-0\\.5{width:2px}.scalar-app .w-1\\.5{width:6px}.scalar-app .w-2\\.5{width:10px}.scalar-app .w-2\\.25{width:9px}.scalar-app .w-3{width:12px}.scalar-app .w-4{width:16px}.scalar-app .w-4\\.5{width:18px}.scalar-app .w-5{width:20px}.scalar-app .w-6{width:24px}.scalar-app .w-7{width:28px}.scalar-app .w-8{width:32px}.scalar-app .w-36{width:144px}.scalar-app .w-40{width:160px}.scalar-app .w-56{width:224px}.scalar-app .w-64{width:256px}.scalar-app .w-72{width:288px}.scalar-app .w-120{width:480px}.scalar-app .w-\\[38px\\]{width:38px}.scalar-app .w-\\[calc\\(100vw-12px\\)\\]{width:calc(100vw - 12px)}.scalar-app .w-\\[var\\(--scalar-sidebar-indent\\)\\]{width:var(--scalar-sidebar-indent)}.scalar-app .w-auto{width:auto}.scalar-app .w-border{width:var(--scalar-border-width)}.scalar-app .w-content{width:720px}.scalar-app .w-dvw{width:100dvw}.scalar-app .w-fit{width:fit-content}.scalar-app .w-full{width:100%}.scalar-app .w-max{width:max-content}.scalar-app .w-px{width:1px}.scalar-app .max-w-\\(--refs-content-max-width\\){max-width:var(--refs-content-max-width)}.scalar-app .max-w-3xl{max-width:768px}.scalar-app .max-w-64{max-width:256px}.scalar-app .max-w-\\[9rem\\]{max-width:9rem}.scalar-app .max-w-\\[100\\%\\]{max-width:100%}.scalar-app .max-w-\\[160px\\]{max-width:160px}.scalar-app .max-w-\\[220px\\]{max-width:220px}.scalar-app .max-w-\\[360px\\]{max-width:360px}.scalar-app .max-w-\\[480px\\]{max-width:480px}.scalar-app .max-w-\\[540px\\]{max-width:540px}.scalar-app .max-w-\\[640px\\]{max-width:640px}.scalar-app .max-w-\\[800px\\]{max-width:800px}.scalar-app .max-w-\\[1000px\\]{max-width:1000px}.scalar-app .max-w-\\[inherit\\]{max-width:inherit}.scalar-app .max-w-full{max-width:100%}.scalar-app .max-w-screen-padded-4{max-width:calc(100vw - 32px)}.scalar-app .max-w-xs{max-width:320px}.scalar-app .min-w-0{min-width:0}.scalar-app .min-w-2\\.25{min-width:9px}.scalar-app .min-w-3{min-width:12px}.scalar-app .min-w-4{min-width:16px}.scalar-app .min-w-4\\.5{min-width:18px}.scalar-app .min-w-6{min-width:24px}.scalar-app .min-w-7{min-width:28px}.scalar-app .min-w-8{min-width:32px}.scalar-app .min-w-32{min-width:128px}.scalar-app .min-w-48{min-width:192px}.scalar-app .min-w-\\[4\\.5rem\\]{min-width:4.5rem}.scalar-app .min-w-fit{min-width:fit-content}.scalar-app .min-w-full{min-width:100%}.scalar-app .min-w-min{min-width:min-content}.scalar-app .flex-1{flex:1}.scalar-app .flex-shrink,.scalar-app .shrink{flex-shrink:1}.scalar-app .shrink-0{flex-shrink:0}.scalar-app .flex-grow,.scalar-app .grow{flex-grow:1}.scalar-app .grow-3{flex-grow:3}.scalar-app .-translate-x-1\\/2{--tw-translate-x:calc(calc(1 / 2 * 100%) * -1);translate:var(--tw-translate-x) var(--tw-translate-y)}.scalar-app .-translate-x-full{--tw-translate-x:-100%;translate:var(--tw-translate-x) var(--tw-translate-y)}.scalar-app .translate-x-0{--tw-translate-x:calc(4px * 0);translate:var(--tw-translate-x) var(--tw-translate-y)}.scalar-app .translate-x-2\\.5{--tw-translate-x:calc(4px * 2.5);translate:var(--tw-translate-x) var(--tw-translate-y)}.scalar-app .translate-x-\\[14px\\]{--tw-translate-x:14px;translate:var(--tw-translate-x) var(--tw-translate-y)}.scalar-app .translate-x-full{--tw-translate-x:100%;translate:var(--tw-translate-x) var(--tw-translate-y)}.scalar-app .-translate-y-1\\.5{--tw-translate-y:calc(4px * -1.5);translate:var(--tw-translate-x) var(--tw-translate-y)}.scalar-app .-translate-y-1\\/2{--tw-translate-y:calc(calc(1 / 2 * 100%) * -1);translate:var(--tw-translate-x) var(--tw-translate-y)}.scalar-app .translate-y-0{--tw-translate-y:calc(4px * 0);translate:var(--tw-translate-x) var(--tw-translate-y)}.scalar-app .translate-y-1\\.5{--tw-translate-y:calc(4px * 1.5);translate:var(--tw-translate-x) var(--tw-translate-y)}.scalar-app .translate-y-\\[200\\%\\]{--tw-translate-y:200%;translate:var(--tw-translate-x) var(--tw-translate-y)}.scalar-app .scale-0{--tw-scale-x:0%;--tw-scale-y:0%;--tw-scale-z:0%;scale:var(--tw-scale-x) var(--tw-scale-y)}.scalar-app .scale-100{--tw-scale-x:100%;--tw-scale-y:100%;--tw-scale-z:100%;scale:var(--tw-scale-x) var(--tw-scale-y)}.scalar-app .rotate-45{rotate:45deg}.scalar-app .rotate-90{rotate:90deg}.scalar-app .rotate-180{rotate:180deg}.scalar-app .transform{transform:var(--tw-rotate-x,) var(--tw-rotate-y,) var(--tw-rotate-z,) var(--tw-skew-x,) var(--tw-skew-y,)}.scalar-app .animate-pulse{animation:var(--animate-pulse)}.scalar-app .cursor-auto{cursor:auto}.scalar-app .cursor-default{cursor:default}.scalar-app .cursor-help{cursor:help}.scalar-app .cursor-not-allowed{cursor:not-allowed}.scalar-app .cursor-pointer{cursor:pointer}.scalar-app .cursor-text{cursor:text}.scalar-app .resize{resize:both}.scalar-app .resize-none{resize:none}.scalar-app .scroll-mt-16{scroll-margin-top:64px}.scalar-app .scroll-mt-24{scroll-margin-top:96px}.scalar-app .list-none{list-style-type:none}.scalar-app .appearance-none{appearance:none}.scalar-app .grid-flow-col{grid-auto-flow:column}.scalar-app .auto-rows-auto{grid-auto-rows:auto}.scalar-app .grid-cols-2{grid-template-columns:repeat(2,minmax(0,1fr))}.scalar-app .grid-cols-\\[44px_1fr_repeat\\(3\\,auto\\)\\]{grid-template-columns:44px 1fr repeat(3,auto)}.scalar-app .flex-col{flex-direction:column}.scalar-app .flex-row{flex-direction:row}.scalar-app .flex-wrap{flex-wrap:wrap}.scalar-app .content-end{align-content:flex-end}.scalar-app .content-start{align-content:flex-start}.scalar-app .items-baseline{align-items:baseline}.scalar-app .items-center{align-items:center}.scalar-app .items-end{align-items:flex-end}.scalar-app .items-start{align-items:flex-start}.scalar-app .items-stretch{align-items:stretch}.scalar-app .justify-between{justify-content:space-between}.scalar-app .justify-center{justify-content:center}.scalar-app .justify-end{justify-content:flex-end}.scalar-app .justify-start{justify-content:flex-start}.scalar-app .justify-stretch{justify-content:stretch}.scalar-app .gap-0\\.5{gap:2px}.scalar-app .gap-0\\.75{gap:3px}.scalar-app .gap-1{gap:4px}.scalar-app .gap-1\\.5{gap:6px}.scalar-app .gap-1\\.75{gap:7px}.scalar-app .gap-2{gap:8px}.scalar-app .gap-2\\.5{gap:10px}.scalar-app .gap-2\\.25{gap:9px}.scalar-app .gap-3{gap:12px}.scalar-app .gap-4{gap:16px}.scalar-app .gap-6{gap:24px}.scalar-app .gap-7{gap:28px}.scalar-app .gap-10{gap:40px}.scalar-app .gap-12{gap:48px}.scalar-app .gap-\\[1\\.5px\\]{gap:1.5px}.scalar-app .gap-px{gap:1px}.scalar-app .gap-x-2\\.5{column-gap:10px}:where(.scalar-app .space-x-1>:not(:last-child)){--tw-space-x-reverse:0;margin-inline-start:calc(calc(4px * 1) * var(--tw-space-x-reverse));margin-inline-end:calc(calc(4px * 1) * calc(1 - var(--tw-space-x-reverse)))}:where(.scalar-app .divide-y>:not(:last-child)){--tw-divide-y-reverse:0;border-bottom-style:var(--tw-border-style);border-top-style:var(--tw-border-style);border-top-width:calc(var(--scalar-border-width) * var(--tw-divide-y-reverse));border-bottom-width:calc(var(--scalar-border-width) * calc(1 - var(--tw-divide-y-reverse)))}.scalar-app .self-center{align-self:center}.scalar-app .self-end{align-self:flex-end}.scalar-app .self-start{align-self:flex-start}.scalar-app .truncate{text-overflow:ellipsis;white-space:nowrap;overflow:hidden}.scalar-app .overflow-auto{overflow:auto}.scalar-app .overflow-hidden{overflow:hidden}.scalar-app .overflow-visible{overflow:visible}.scalar-app .overflow-x-auto{overflow-x:auto}.scalar-app .overflow-x-hidden{overflow-x:hidden}.scalar-app .overflow-y-auto{overflow-y:auto}.scalar-app .overflow-y-hidden{overflow-y:hidden}.scalar-app .overflow-y-scroll{overflow-y:scroll}.scalar-app .overscroll-contain{overscroll-behavior:contain}.scalar-app .\\!rounded-none{border-radius:0!important}.scalar-app .rounded{border-radius:var(--scalar-radius)}.scalar-app .rounded-\\[inherit\\]{border-radius:inherit}.scalar-app .rounded-full{border-radius:9999px}.scalar-app .rounded-lg{border-radius:var(--scalar-radius-lg)}.scalar-app .rounded-md{border-radius:var(--scalar-radius)}.scalar-app .rounded-none{border-radius:0}.scalar-app .rounded-px{border-radius:1px}.scalar-app .rounded-xl{border-radius:var(--scalar-radius-xl)}.scalar-app .rounded-t{border-top-left-radius:var(--scalar-radius);border-top-right-radius:var(--scalar-radius)}.scalar-app .rounded-t-lg{border-top-left-radius:var(--scalar-radius-lg);border-top-right-radius:var(--scalar-radius-lg)}.scalar-app .rounded-t-none{border-top-left-radius:0;border-top-right-radius:0}.scalar-app .rounded-t-xl{border-top-left-radius:var(--scalar-radius-xl);border-top-right-radius:var(--scalar-radius-xl)}.scalar-app .\\!rounded-b-xl{border-bottom-right-radius:var(--scalar-radius-xl)!important;border-bottom-left-radius:var(--scalar-radius-xl)!important}.scalar-app .rounded-b{border-bottom-right-radius:var(--scalar-radius);border-bottom-left-radius:var(--scalar-radius)}.scalar-app .rounded-b-lg{border-bottom-right-radius:var(--scalar-radius-lg);border-bottom-left-radius:var(--scalar-radius-lg)}.scalar-app .rounded-b-none{border-bottom-right-radius:0;border-bottom-left-radius:0}.scalar-app .rounded-b-xl{border-bottom-right-radius:var(--scalar-radius-xl);border-bottom-left-radius:var(--scalar-radius-xl)}.scalar-app .border{border-style:var(--tw-border-style);border-width:var(--scalar-border-width)}.scalar-app .border-0{border-style:var(--tw-border-style);border-width:0}.scalar-app .border-1,.scalar-app .border-\\[1px\\]{border-style:var(--tw-border-style);border-width:1px}.scalar-app .border-x{border-inline-style:var(--tw-border-style);border-inline-width:var(--scalar-border-width)}.scalar-app .border-x-0{border-inline-style:var(--tw-border-style);border-inline-width:0}.scalar-app .border-y{border-block-style:var(--tw-border-style);border-block-width:var(--scalar-border-width)}.scalar-app .border-t{border-top-style:var(--tw-border-style);border-top-width:var(--scalar-border-width)}.scalar-app .border-t-0{border-top-style:var(--tw-border-style);border-top-width:0}.scalar-app .\\!border-r{border-right-style:var(--tw-border-style)!important;border-right-width:var(--scalar-border-width)!important}.scalar-app .border-r{border-right-style:var(--tw-border-style);border-right-width:var(--scalar-border-width)}.scalar-app .border-r-0{border-right-style:var(--tw-border-style);border-right-width:0}.scalar-app .border-b{border-bottom-style:var(--tw-border-style);border-bottom-width:var(--scalar-border-width)}.scalar-app .border-b-0{border-bottom-style:var(--tw-border-style);border-bottom-width:0}.scalar-app .border-l{border-left-style:var(--tw-border-style);border-left-width:var(--scalar-border-width)}.scalar-app .border-l-0{border-left-style:var(--tw-border-style);border-left-width:0}.scalar-app .border-dashed{--tw-border-style:dashed;border-style:dashed}.scalar-app .border-none{--tw-border-style:none;border-style:none}.scalar-app .\\!border-current{border-color:currentColor!important}.scalar-app .border-\\(--scalar-background-3\\){border-color:var(--scalar-background-3)}.scalar-app .border-border-header{border-color:var(--scalar-header-border-color,var(--scalar-border-color))}.scalar-app .border-c-accent,.scalar-app .border-c-accent\\/30{border-color:var(--scalar-color-accent)}@supports (color:color-mix(in lab, red, red)){.scalar-app .border-c-accent\\/30{border-color:color-mix(in oklab, var(--scalar-color-accent) 30%, transparent)}}.scalar-app .border-c-alert{border-color:var(--scalar-color-alert)}.scalar-app .border-c-danger{border-color:var(--scalar-color-danger)}.scalar-app .border-sidebar-border{border-color:var(--scalar-sidebar-border-color,var(--scalar-border-color))}.scalar-app .border-sidebar-border-search{border-color:var(--scalar-sidebar-search-border-color,var(--scalar-border-color))}.scalar-app .border-transparent{border-color:#0000}.scalar-app .border-r-transparent{border-right-color:#0000}.scalar-app .border-b-sidebar-border{border-bottom-color:var(--scalar-sidebar-border-color,var(--scalar-border-color))}.scalar-app .bg-\\(--bg-light\\){background-color:var(--bg-light)}.scalar-app .bg-b-1,.scalar-app .bg-b-1\\.5{background-color:var(--scalar-background-1)}@supports (color:color-mix(in lab, red, red)){.scalar-app .bg-b-1\\.5{background-color:color-mix(in srgb, var(--scalar-background-1), var(--scalar-background-2))}}.scalar-app .bg-b-2{background-color:var(--scalar-background-2)}.scalar-app .bg-b-3{background-color:var(--scalar-background-3)}.scalar-app .bg-b-alert{background-color:var(--scalar-background-alert)}.scalar-app .bg-b-btn{background-color:var(--scalar-button-1)}.scalar-app .bg-b-danger{background-color:var(--scalar-background-danger)}.scalar-app .bg-b-header-1{background-color:var(--scalar-header-background-1,var(--scalar-background-1))}.scalar-app .bg-b-header-cta{background-color:var(--scalar-header-call-to-action-color,var(--scalar-button-1))}.scalar-app .bg-b-tooltip{background-color:var(--scalar-tooltip-background)}.scalar-app .bg-backdrop{background-color:#00000038}.scalar-app .bg-border{background-color:var(--scalar-border-color)}.scalar-app .bg-c-accent,.scalar-app .bg-c-accent\\/5{background-color:var(--scalar-color-accent)}@supports (color:color-mix(in lab, red, red)){.scalar-app .bg-c-accent\\/5{background-color:color-mix(in oklab, var(--scalar-color-accent) 5%, transparent)}}.scalar-app .bg-c-accent\\/10{background-color:var(--scalar-color-accent)}@supports (color:color-mix(in lab, red, red)){.scalar-app .bg-c-accent\\/10{background-color:color-mix(in oklab, var(--scalar-color-accent) 10%, transparent)}}.scalar-app .bg-c-danger{background-color:var(--scalar-color-danger)}.scalar-app .bg-current{background-color:currentColor}.scalar-app .bg-inherit{background-color:inherit}.scalar-app .bg-sidebar-b-1{background-color:var(--scalar-sidebar-background-1,var(--scalar-background-1))}.scalar-app .bg-sidebar-b-active{background-color:var(--scalar-sidebar-item-active-background,var(--scalar-background-2))}.scalar-app .bg-sidebar-b-search{background-color:var(--scalar-sidebar-search-background,var(--scalar-background-2))}.scalar-app .bg-sidebar-c-2\\/15{background-color:var(--scalar-sidebar-color-2,var(--scalar-color-2))}@supports (color:color-mix(in lab, red, red)){.scalar-app .bg-sidebar-c-2\\/15{background-color:color-mix(in oklab, var(--scalar-sidebar-color-2,var(--scalar-color-2)) 15%, transparent)}}.scalar-app .bg-sidebar-indent-border{background-color:var(--scalar-sidebar-indent-border,var(--scalar-border-color))}.scalar-app .bg-sidebar-indent-border-active{background-color:var(--scalar-sidebar-indent-border-active,var(--scalar-color-accent))}.scalar-app .bg-transparent{background-color:#0000}.scalar-app .bg-linear-to-b{--tw-gradient-position:to bottom}@supports (background-image:linear-gradient(in lab, red, red)){.scalar-app .bg-linear-to-b{--tw-gradient-position:to bottom in oklab}}.scalar-app .bg-linear-to-b{background-image:linear-gradient(var(--tw-gradient-stops))}.scalar-app .bg-linear-to-l{--tw-gradient-position:to left}@supports (background-image:linear-gradient(in lab, red, red)){.scalar-app .bg-linear-to-l{--tw-gradient-position:to left in oklab}}.scalar-app .bg-linear-to-l{background-image:linear-gradient(var(--tw-gradient-stops))}.scalar-app .from-b-1{--tw-gradient-from:var(--scalar-background-1);--tw-gradient-stops:var(--tw-gradient-via-stops,var(--tw-gradient-position), var(--tw-gradient-from) var(--tw-gradient-from-position), var(--tw-gradient-to) var(--tw-gradient-to-position))}.scalar-app .from-40\\%{--tw-gradient-from-position:40%}.scalar-app .to-b-1\\.5{--tw-gradient-to:var(--scalar-background-1)}@supports (color:color-mix(in lab, red, red)){.scalar-app .to-b-1\\.5{--tw-gradient-to:color-mix(in srgb, var(--scalar-background-1), var(--scalar-background-2))}}.scalar-app .to-b-1\\.5{--tw-gradient-stops:var(--tw-gradient-via-stops,var(--tw-gradient-position), var(--tw-gradient-from) var(--tw-gradient-from-position), var(--tw-gradient-to) var(--tw-gradient-to-position))}.scalar-app .to-b-2{--tw-gradient-to:var(--scalar-background-2);--tw-gradient-stops:var(--tw-gradient-via-stops,var(--tw-gradient-position), var(--tw-gradient-from) var(--tw-gradient-from-position), var(--tw-gradient-to) var(--tw-gradient-to-position))}.scalar-app .to-transparent{--tw-gradient-to:transparent;--tw-gradient-stops:var(--tw-gradient-via-stops,var(--tw-gradient-position), var(--tw-gradient-from) var(--tw-gradient-from-position), var(--tw-gradient-to) var(--tw-gradient-to-position))}.scalar-app .mask-y-from-\\[calc\\(100\\%-8px\\)\\]{-webkit-mask-image:var(--tw-mask-linear), var(--tw-mask-radial), var(--tw-mask-conic);-webkit-mask-image:var(--tw-mask-linear), var(--tw-mask-radial), var(--tw-mask-conic);-webkit-mask-image:var(--tw-mask-linear), var(--tw-mask-radial), var(--tw-mask-conic);mask-image:var(--tw-mask-linear), var(--tw-mask-radial), var(--tw-mask-conic);--tw-mask-linear:var(--tw-mask-left), var(--tw-mask-right), var(--tw-mask-bottom), var(--tw-mask-top);--tw-mask-top:linear-gradient(to top, var(--tw-mask-top-from-color) var(--tw-mask-top-from-position), var(--tw-mask-top-to-color) var(--tw-mask-top-to-position));--tw-mask-top-from-position:calc(100% - 8px);--tw-mask-bottom:linear-gradient(to bottom, var(--tw-mask-bottom-from-color) var(--tw-mask-bottom-from-position), var(--tw-mask-bottom-to-color) var(--tw-mask-bottom-to-position));--tw-mask-bottom-from-position:calc(100% - 8px);-webkit-mask-composite:source-in;-webkit-mask-composite:source-in;-webkit-mask-composite:source-in;mask-composite:intersect}.scalar-app .mask-y-to-100\\%{-webkit-mask-image:var(--tw-mask-linear), var(--tw-mask-radial), var(--tw-mask-conic);-webkit-mask-image:var(--tw-mask-linear), var(--tw-mask-radial), var(--tw-mask-conic);-webkit-mask-image:var(--tw-mask-linear), var(--tw-mask-radial), var(--tw-mask-conic);mask-image:var(--tw-mask-linear), var(--tw-mask-radial), var(--tw-mask-conic);--tw-mask-linear:var(--tw-mask-left), var(--tw-mask-right), var(--tw-mask-bottom), var(--tw-mask-top);--tw-mask-top:linear-gradient(to top, var(--tw-mask-top-from-color) var(--tw-mask-top-from-position), var(--tw-mask-top-to-color) var(--tw-mask-top-to-position));--tw-mask-top-to-position:100%;--tw-mask-bottom:linear-gradient(to bottom, var(--tw-mask-bottom-from-color) var(--tw-mask-bottom-from-position), var(--tw-mask-bottom-to-color) var(--tw-mask-bottom-to-position));--tw-mask-bottom-to-position:100%;-webkit-mask-composite:source-in;-webkit-mask-composite:source-in;-webkit-mask-composite:source-in;mask-composite:intersect}.scalar-app .mask-repeat{-webkit-mask-repeat:repeat;mask-repeat:repeat}.scalar-app .fill-current{fill:currentColor}.scalar-app .\\!p-0{padding:0!important}.scalar-app .p-\\(--scalar-sidebar-padding\\){padding:var(--scalar-sidebar-padding)}.scalar-app .p-0{padding:0}.scalar-app .p-0\\.5{padding:2px}.scalar-app .p-0\\.75{padding:3px}.scalar-app .p-1{padding:4px}.scalar-app .p-1\\.5{padding:6px}.scalar-app .p-1\\.25{padding:5px}.scalar-app .p-1\\.75{padding:7px}.scalar-app .p-2{padding:8px}.scalar-app .p-2\\.5{padding:10px}.scalar-app .p-3{padding:12px}.scalar-app .p-4{padding:16px}.scalar-app .p-7{padding:28px}.scalar-app .p-\\[3px\\]{padding:3px}.scalar-app .p-px{padding:1px}.scalar-app .px-\\(--scalar-sidebar-padding\\){padding-inline:var(--scalar-sidebar-padding)}.scalar-app .px-0{padding-inline:0}.scalar-app .px-0\\.5{padding-inline:2px}.scalar-app .px-0\\.75{padding-inline:3px}.scalar-app .px-1{padding-inline:4px}.scalar-app .px-1\\.5{padding-inline:6px}.scalar-app .px-1\\.25{padding-inline:5px}.scalar-app .px-2{padding-inline:8px}.scalar-app .px-2\\.5{padding-inline:10px}.scalar-app .px-3{padding-inline:12px}.scalar-app .px-3\\.5{padding-inline:14px}.scalar-app .px-4{padding-inline:16px}.scalar-app .px-5{padding-inline:20px}.scalar-app .px-6{padding-inline:24px}.scalar-app .px-15{padding-inline:60px}.scalar-app .py-0{padding-block:0}.scalar-app .py-0\\.5{padding-block:2px}.scalar-app .py-0\\.25{padding-block:1px}.scalar-app .py-0\\.75{padding-block:3px}.scalar-app .py-1{padding-block:4px}.scalar-app .py-1\\.5{padding-block:6px}.scalar-app .py-1\\.25{padding-block:5px}.scalar-app .py-1\\.75{padding-block:7px}.scalar-app .py-2{padding-block:8px}.scalar-app .py-2\\.5{padding-block:10px}.scalar-app .py-2\\.25{padding-block:9px}.scalar-app .py-3{padding-block:12px}.scalar-app .py-4{padding-block:16px}.scalar-app .py-\\[6\\.75px\\]{padding-block:6.75px}.scalar-app .py-px{padding-block:1px}.scalar-app .pt-\\(--scalar-sidebar-padding\\){padding-top:var(--scalar-sidebar-padding)}.scalar-app .pt-1{padding-top:4px}.scalar-app .pt-2{padding-top:8px}.scalar-app .pt-3{padding-top:12px}.scalar-app .pt-px{padding-top:1px}.scalar-app .pr-0{padding-right:0}.scalar-app .pr-0\\.75{padding-right:3px}.scalar-app .pr-1{padding-right:4px}.scalar-app .pr-1\\.5{padding-right:6px}.scalar-app .pr-2{padding-right:8px}.scalar-app .pr-2\\.5{padding-right:10px}.scalar-app .pr-2\\.25{padding-right:9px}.scalar-app .pr-3{padding-right:12px}.scalar-app .pr-6{padding-right:24px}.scalar-app .pr-8{padding-right:32px}.scalar-app .pr-10{padding-right:40px}.scalar-app .pr-12{padding-right:48px}.scalar-app .pr-20{padding-right:80px}.scalar-app .pr-\\[100\\%\\]{padding-right:100%}.scalar-app .pb-1{padding-bottom:4px}.scalar-app .pb-1\\.5{padding-bottom:6px}.scalar-app .pb-3{padding-bottom:12px}.scalar-app .pb-6{padding-bottom:24px}.scalar-app .pb-12{padding-bottom:48px}.scalar-app .\\!pl-3{padding-left:12px!important}.scalar-app .pl-1{padding-left:4px}.scalar-app .pl-1\\.25{padding-left:5px}.scalar-app .pl-2{padding-left:8px}.scalar-app .pl-3{padding-left:12px}.scalar-app .pl-4{padding-left:16px}.scalar-app .pl-8{padding-left:32px}.scalar-app .pl-8\\.5{padding-left:34px}.scalar-app .pl-\\[100\\%\\]{padding-left:100%}.scalar-app .pl-px{padding-left:1px}.scalar-app .text-center{text-align:center}.scalar-app .text-left{text-align:left}.scalar-app .text-right{text-align:right}.scalar-app .font-code{font-family:var(--scalar-font-code)}.scalar-app .font-sans{font-family:var(--scalar-font)}.scalar-app .text-base{font-size:var(--scalar-font-size-3);line-height:var(--tw-leading,calc(1 / .875))}.scalar-app .text-base\\/4{font-size:var(--scalar-font-size-3);line-height:16px}.scalar-app .text-base\\/5{font-size:var(--scalar-font-size-3);line-height:20px}.scalar-app .text-base\\/5\\.25{font-size:var(--scalar-font-size-3);line-height:21px}.scalar-app .text-lg{font-size:var(--scalar-font-size-2);line-height:var(--tw-leading,calc(1.25 / 1))}.scalar-app .text-sm\\/4{font-size:var(--scalar-font-size-4);line-height:16px}.scalar-app .text-sm\\/none{font-size:var(--scalar-font-size-4);line-height:1}.scalar-app .text-xs\\/4{font-size:var(--scalar-font-size-5);line-height:16px}.scalar-app .text-3xs{font-size:var(--scalar-font-size-7)}.scalar-app .text-\\[6px\\]{font-size:6px}.scalar-app .text-\\[9px\\]{font-size:9px}.scalar-app .text-\\[10px\\]{font-size:10px}.scalar-app .text-\\[11px\\]{font-size:11px}.scalar-app .text-sm{font-size:var(--scalar-font-size-4)}.scalar-app .text-xs{font-size:var(--scalar-font-size-5)}.scalar-app .text-xxs{font-size:var(--scalar-font-size-6)}.scalar-app .leading-5{--tw-leading:calc(4px * 5);line-height:20px}.scalar-app .leading-5\\.5{--tw-leading:calc(4px * 5.5);line-height:22px}.scalar-app .leading-6{--tw-leading:calc(4px * 6);line-height:24px}.scalar-app .leading-\\[1\\.44\\]{--tw-leading:1.44;line-height:1.44}.scalar-app .leading-\\[1\\.45\\]{--tw-leading:1.45;line-height:1.45}.scalar-app .leading-\\[7px\\]{--tw-leading:7px;line-height:7px}.scalar-app .leading-\\[20px\\]{--tw-leading:20px;line-height:20px}.scalar-app .leading-\\[22px\\]{--tw-leading:22px;line-height:22px}.scalar-app .leading-\\[normal\\]{--tw-leading:normal;line-height:normal}.scalar-app .leading-none{--tw-leading:1;line-height:1}.scalar-app .leading-normal{--tw-leading:var(--leading-normal);line-height:var(--leading-normal)}.scalar-app .leading-relaxed{--tw-leading:var(--leading-relaxed);line-height:var(--leading-relaxed)}.scalar-app .leading-snug{--tw-leading:var(--leading-snug);line-height:var(--leading-snug)}.scalar-app .font-bold{--tw-font-weight:var(--scalar-bold);font-weight:var(--scalar-bold)}.scalar-app .font-medium{--tw-font-weight:var(--scalar-semibold);font-weight:var(--scalar-semibold)}.scalar-app .font-normal{--tw-font-weight:var(--scalar-regular);font-weight:var(--scalar-regular)}.scalar-app .font-sidebar{--tw-font-weight:var(--scalar-sidebar-font-weight,var(--scalar-regular));font-weight:var(--scalar-sidebar-font-weight,var(--scalar-regular))}.scalar-app .font-sidebar-active{--tw-font-weight:var(--scalar-sidebar-font-weight-active,var(--scalar-semibold));font-weight:var(--scalar-sidebar-font-weight-active,var(--scalar-semibold))}.scalar-app .text-balance{text-wrap:balance}.scalar-app .text-nowrap{text-wrap:nowrap}.scalar-app .text-pretty{text-wrap:pretty}.scalar-app .text-wrap{text-wrap:wrap}.scalar-app .break-words,.scalar-app .wrap-break-word{overflow-wrap:break-word}.scalar-app .text-ellipsis{text-overflow:ellipsis}.scalar-app .whitespace-nowrap{white-space:nowrap}.scalar-app .whitespace-pre{white-space:pre}.scalar-app .whitespace-pre-wrap{white-space:pre-wrap}.scalar-app .\\!text-c-1{color:var(--scalar-color-1)!important}.scalar-app .text-\\[color\\:var\\(--scalar-color-3\\)\\]{color:var(--scalar-color-3)}.scalar-app .text-b-1{color:var(--scalar-background-1)}.scalar-app .text-b-2{color:var(--scalar-background-2)}.scalar-app .text-blue{color:var(--scalar-color-blue)}.scalar-app .text-c-1{color:var(--scalar-color-1)}.scalar-app .text-c-2{color:var(--scalar-color-2)}.scalar-app .text-c-3{color:var(--scalar-color-3)}.scalar-app .text-c-accent{color:var(--scalar-color-accent)}.scalar-app .text-c-alert{color:var(--scalar-color-alert)}.scalar-app .text-c-btn{color:var(--scalar-button-1-color)}.scalar-app .text-c-danger{color:var(--scalar-color-danger)}.scalar-app .text-c-header-1{color:var(--scalar-header-color-1,var(--scalar-color-1))}.scalar-app .text-c-header-2{color:var(--scalar-header-color-2,var(--scalar-color-2))}.scalar-app .text-c-header-cta{color:var(--scalar-button-1-color)}.scalar-app .text-c-tooltip{color:var(--scalar-tooltip-color)}.scalar-app .text-current{color:currentColor}.scalar-app .text-green{color:var(--scalar-color-green)}.scalar-app .text-grey{color:var(--scalar-color-3)}.scalar-app .text-orange{color:var(--scalar-color-orange)}.scalar-app .text-purple{color:var(--scalar-color-purple)}.scalar-app .text-red{color:var(--scalar-color-red)}.scalar-app .text-sidebar-c-1{color:var(--scalar-sidebar-color-1,var(--scalar-color-1))}.scalar-app .text-sidebar-c-2{color:var(--scalar-sidebar-color-2,var(--scalar-color-2))}.scalar-app .text-sidebar-c-active{color:var(--scalar-sidebar-color-active,var(--scalar-sidebar-color-1))}.scalar-app .text-sidebar-c-search{color:var(--scalar-sidebar-search-color,var(--scalar-color-3))}.scalar-app .text-transparent{color:#0000}.scalar-app .text-white{color:#fff}.scalar-app .text-yellow{color:var(--scalar-color-yellow)}.scalar-app .capitalize{text-transform:capitalize}.scalar-app .uppercase{text-transform:uppercase}.scalar-app .italic{font-style:italic}.scalar-app .tabular-nums{--tw-numeric-spacing:tabular-nums;font-variant-numeric:var(--tw-ordinal,) var(--tw-slashed-zero,) var(--tw-numeric-figure,) var(--tw-numeric-spacing,) var(--tw-numeric-fraction,)}.scalar-app .line-through{text-decoration-line:line-through}.scalar-app .no-underline{text-decoration-line:none}.scalar-app .underline{text-decoration-line:underline}.scalar-app .decoration-c-3{-webkit-text-decoration-color:var(--scalar-color-3);-webkit-text-decoration-color:var(--scalar-color-3);-webkit-text-decoration-color:var(--scalar-color-3);text-decoration-color:var(--scalar-color-3)}.scalar-app .decoration-dotted{text-decoration-style:dotted}.scalar-app .underline-offset-2{text-underline-offset:2px}.scalar-app .opacity-0{opacity:0}.scalar-app .opacity-40{opacity:.4}.scalar-app .opacity-50{opacity:.5}.scalar-app .opacity-100{opacity:1}.scalar-app .bg-blend-normal{background-blend-mode:normal}.scalar-app .shadow{--tw-shadow:var(--scalar-shadow-1);box-shadow:var(--tw-inset-shadow), var(--tw-inset-ring-shadow), var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow)}.scalar-app .shadow-\\[-8px_0_4px_var\\(--scalar-background-1\\)\\]{--tw-shadow:-8px 0 4px var(--tw-shadow-color,var(--scalar-background-1));box-shadow:var(--tw-inset-shadow), var(--tw-inset-ring-shadow), var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow)}.scalar-app .shadow-border{--tw-shadow:inset 0 0 0 var(--tw-shadow-color,var(--scalar-border-width)) var(--scalar-border-color);box-shadow:var(--tw-inset-shadow), var(--tw-inset-ring-shadow), var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow)}.scalar-app .shadow-lg{--tw-shadow:var(--scalar-shadow-2);box-shadow:var(--tw-inset-shadow), var(--tw-inset-ring-shadow), var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow)}.scalar-app .shadow-md{--tw-shadow:var(--scalar-shadow-1);box-shadow:var(--tw-inset-shadow), var(--tw-inset-ring-shadow), var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow)}.scalar-app .shadow-none{--tw-shadow:0 0 #0000;box-shadow:var(--tw-inset-shadow), var(--tw-inset-ring-shadow), var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow)}.scalar-app .outline{outline-style:var(--tw-outline-style);outline-width:1px}.scalar-app .-outline-offset-1{outline-offset:calc(1px * -1)}.scalar-app .-outline-offset-2{outline-offset:calc(2px * -1)}.scalar-app .outline-offset-1{outline-offset:1px}.scalar-app .outline-offset-2{outline-offset:2px}.scalar-app .outline-offset-\\[-1px\\]{outline-offset:-1px}.scalar-app .outline-c-danger{outline-color:var(--scalar-color-danger)}.scalar-app .blur{--tw-blur:blur(8px);filter:var(--tw-blur,) var(--tw-brightness,) var(--tw-contrast,) var(--tw-grayscale,) var(--tw-hue-rotate,) var(--tw-invert,) var(--tw-saturate,) var(--tw-sepia,) var(--tw-drop-shadow,)}.scalar-app .brightness-90{--tw-brightness:brightness(90%);filter:var(--tw-blur,) var(--tw-brightness,) var(--tw-contrast,) var(--tw-grayscale,) var(--tw-hue-rotate,) var(--tw-invert,) var(--tw-saturate,) var(--tw-sepia,) var(--tw-drop-shadow,)}.scalar-app .brightness-lifted{--tw-brightness:brightness(var(--scalar-lifted-brightness));filter:var(--tw-blur,) var(--tw-brightness,) var(--tw-contrast,) var(--tw-grayscale,) var(--tw-hue-rotate,) var(--tw-invert,) var(--tw-saturate,) var(--tw-sepia,) var(--tw-drop-shadow,)}.scalar-app .filter{filter:var(--tw-blur,) var(--tw-brightness,) var(--tw-contrast,) var(--tw-grayscale,) var(--tw-hue-rotate,) var(--tw-invert,) var(--tw-saturate,) var(--tw-sepia,) var(--tw-drop-shadow,)}.scalar-app .backdrop-blur{--tw-backdrop-blur:blur(8px);-webkit-backdrop-filter:var(--tw-backdrop-blur,) var(--tw-backdrop-brightness,) var(--tw-backdrop-contrast,) var(--tw-backdrop-grayscale,) var(--tw-backdrop-hue-rotate,) var(--tw-backdrop-invert,) var(--tw-backdrop-opacity,) var(--tw-backdrop-saturate,) var(--tw-backdrop-sepia,);backdrop-filter:var(--tw-backdrop-blur,) var(--tw-backdrop-brightness,) var(--tw-backdrop-contrast,) var(--tw-backdrop-grayscale,) var(--tw-backdrop-hue-rotate,) var(--tw-backdrop-invert,) var(--tw-backdrop-opacity,) var(--tw-backdrop-saturate,) var(--tw-backdrop-sepia,)}.scalar-app .backdrop-filter{-webkit-backdrop-filter:var(--tw-backdrop-blur,) var(--tw-backdrop-brightness,) var(--tw-backdrop-contrast,) var(--tw-backdrop-grayscale,) var(--tw-backdrop-hue-rotate,) var(--tw-backdrop-invert,) var(--tw-backdrop-opacity,) var(--tw-backdrop-saturate,) var(--tw-backdrop-sepia,);backdrop-filter:var(--tw-backdrop-blur,) var(--tw-backdrop-brightness,) var(--tw-backdrop-contrast,) var(--tw-backdrop-grayscale,) var(--tw-backdrop-hue-rotate,) var(--tw-backdrop-invert,) var(--tw-backdrop-opacity,) var(--tw-backdrop-saturate,) var(--tw-backdrop-sepia,)}.scalar-app .transition{transition-property:color,background-color,border-color,outline-color,text-decoration-color,fill,stroke,--tw-gradient-from,--tw-gradient-via,--tw-gradient-to,opacity,box-shadow,transform,translate,scale,rotate,filter,-webkit-backdrop-filter,backdrop-filter,display,content-visibility,overlay,pointer-events;transition-timing-function:var(--tw-ease,var(--default-transition-timing-function));transition-duration:var(--tw-duration,var(--default-transition-duration))}.scalar-app .transition-colors{transition-property:color,background-color,border-color,outline-color,text-decoration-color,fill,stroke,--tw-gradient-from,--tw-gradient-via,--tw-gradient-to;transition-timing-function:var(--tw-ease,var(--default-transition-timing-function));transition-duration:var(--tw-duration,var(--default-transition-duration))}.scalar-app .transition-opacity{transition-property:opacity;transition-timing-function:var(--tw-ease,var(--default-transition-timing-function));transition-duration:var(--tw-duration,var(--default-transition-duration))}.scalar-app .transition-transform{transition-property:transform,translate,scale,rotate;transition-timing-function:var(--tw-ease,var(--default-transition-timing-function));transition-duration:var(--tw-duration,var(--default-transition-duration))}.scalar-app .transition-none{transition-property:none}.scalar-app .duration-100{--tw-duration:.1s;transition-duration:.1s}.scalar-app .duration-150{--tw-duration:.15s;transition-duration:.15s}.scalar-app .duration-200{--tw-duration:.2s;transition-duration:.2s}.scalar-app .duration-300{--tw-duration:.3s;transition-duration:.3s}.scalar-app .duration-400{--tw-duration:.4s;transition-duration:.4s}.scalar-app .duration-500{--tw-duration:.5s;transition-duration:.5s}.scalar-app .ease-\\[cubic-bezier\\(0\\.77\\,0\\,0\\.175\\,1\\)\\]{--tw-ease:cubic-bezier(.77,0,.175,1);transition-timing-function:cubic-bezier(.77,0,.175,1)}.scalar-app .ease-in{--tw-ease:var(--ease-in);transition-timing-function:var(--ease-in)}.scalar-app .ease-in-out{--tw-ease:var(--ease-in-out);transition-timing-function:var(--ease-in-out)}.scalar-app .ease-out{--tw-ease:var(--ease-out);transition-timing-function:var(--ease-out)}.scalar-app .ease-spring{--tw-ease:linear(0, .008 1.1%, .034 2.3%, .134 4.9%, .264 7.3%, .683 14.3%, .797 16.5%, .89 18.6%, .967 20.7%, 1.027 22.8%, 1.073 25%, 1.104 27.3%, 1.123 30.6%, 1.119 34.3%, 1.018 49.5%, .988 58.6%, .985 65.2%, 1 84.5%, 1);transition-timing-function:linear(0, .008 1.1%, .034 2.3%, .134 4.9%, .264 7.3%, .683 14.3%, .797 16.5%, .89 18.6%, .967 20.7%, 1.027 22.8%, 1.073 25%, 1.104 27.3%, 1.123 30.6%, 1.119 34.3%, 1.018 49.5%, .988 58.6%, .985 65.2%, 1 84.5%, 1)}.scalar-app .outline-none{--tw-outline-style:none;outline-style:none}.scalar-app .select-none{-webkit-user-select:none;user-select:none}.scalar-app .\\[--scalar-address-bar-height\\:0px\\]{--scalar-address-bar-height:0px}.scalar-app .\\[--scalar-address-bar-height\\:32px\\]{--scalar-address-bar-height:32px}.scalar-app .\\[grid-area\\:header\\]{grid-area:header}.scalar-app .\\[grid-area\\:navigation\\]{grid-area:navigation}:is(.scalar-app .\\*\\:flex>*){display:flex}:is(.scalar-app .\\*\\:size-3>*){width:12px;height:12px}:is(.scalar-app .\\*\\:size-4>*){width:16px;height:16px}:is(.scalar-app .\\*\\:h-5>*){height:20px}:is(.scalar-app .\\*\\:h-8>*){height:32px}:is(.scalar-app .\\*\\:min-w-5>*){min-width:20px}:is(.scalar-app .\\*\\:flex-1>*){flex:1}:is(.scalar-app .\\*\\:cursor-pointer>*){cursor:pointer}:is(.scalar-app .\\*\\:items-center>*){align-items:center}:is(.scalar-app .\\*\\:justify-center>*){justify-content:center}:is(.scalar-app .\\*\\:gap-1>*){gap:4px}:is(.scalar-app .\\*\\:rounded>*){border-radius:var(--scalar-radius)}:is(.scalar-app .\\*\\:rounded-none>*){border-radius:0}:is(.scalar-app .\\*\\:border>*){border-style:var(--tw-border-style);border-width:var(--scalar-border-width)}:is(.scalar-app .\\*\\:border-t>*){border-top-style:var(--tw-border-style);border-top-width:var(--scalar-border-width)}:is(.scalar-app .\\*\\:border-border-tooltip>*){border-color:var(--scalar-tooltip-color)}@supports (color:color-mix(in lab, red, red)){:is(.scalar-app .\\*\\:border-border-tooltip>*){border-color:color-mix(in srgb, var(--scalar-tooltip-color), var(--scalar-tooltip-background))}}:is(.scalar-app .\\*\\:px-1>*){padding-inline:4px}:is(.scalar-app .\\*\\:px-1\\.5>*){padding-inline:6px}:is(.scalar-app .\\*\\:pl-4>*){padding-left:16px}.scalar-app .group-first\\/row\\:border-t-0:is(:where(.group\\/row):first-child *){border-top-style:var(--tw-border-style);border-top-width:0}.scalar-app .group-last\\:mr-0:is(:where(.group):last-child *){margin-right:0}.scalar-app .group-last\\:border-b-transparent:is(:where(.group):last-child *){border-bottom-color:#0000}.scalar-app .group-last\\/label\\:rounded-br-lg:is(:where(.group\\/label):last-child *){border-bottom-right-radius:var(--scalar-radius-lg)}.scalar-app .group-open\\:rotate-90:is(:where(.group):is([open],:popover-open,:open) *){rotate:90deg}.scalar-app .group-open\\:flex-wrap:is(:where(.group):is([open],:popover-open,:open) *){flex-wrap:wrap}.scalar-app .group-open\\:whitespace-normal:is(:where(.group):is([open],:popover-open,:open) *){white-space:normal}.scalar-app .group-focus-within\\:flex:is(:where(.group):focus-within *){display:flex}.scalar-app .group-focus-within\\/parameter-item\\:opacity-100:is(:where(.group\\/parameter-item):focus-within *),.scalar-app .group-focus-within\\/scope-row\\:opacity-100:is(:where(.group\\/scope-row):focus-within *){opacity:1}@media (hover:hover){.scalar-app .group-hover\\:flex:is(:where(.group):hover *){display:flex}.scalar-app .group-hover\\:pr-10:is(:where(.group):hover *){padding-right:40px}.scalar-app .group-hover\\:text-c-1:is(:where(.group):hover *){color:var(--scalar-color-1)}.scalar-app .group-hover\\:opacity-100:is(:where(.group):hover *){opacity:1}.scalar-app .group-hover\\/button\\:bg-sidebar-indent-border-hover:is(:where(.group\\/button):hover *){background-color:var(--scalar-sidebar-indent-border-hover,var(--scalar-border-color))}.scalar-app .group-hover\\/button\\:text-c-header-1:is(:where(.group\\/button):hover *){color:var(--scalar-header-color-1,var(--scalar-color-1))}.scalar-app .group-hover\\/button\\:opacity-0:is(:where(.group\\/button):hover *){opacity:0}.scalar-app .group-hover\\/heading\\:opacity-100:is(:where(.group\\/heading):hover *),.scalar-app .group-hover\\/item\\:opacity-100:is(:where(.group\\/item):hover *),.scalar-app .group-hover\\/parameter-item\\:opacity-100:is(:where(.group\\/parameter-item):hover *),.scalar-app .group-hover\\/params\\:opacity-100:is(:where(.group\\/params):hover *){opacity:1}.scalar-app .group-hover\\/row\\:flex:is(:where(.group\\/row):hover *){display:flex}.scalar-app .group-hover\\/scope-row\\:text-c-1:is(:where(.group\\/scope-row):hover *){color:var(--scalar-color-1)}.scalar-app .group-hover\\/scope-row\\:opacity-100:is(:where(.group\\/scope-row):hover *){opacity:1}.scalar-app .group-hover\\/scopes-accordion\\:text-c-2:is(:where(.group\\/scopes-accordion):hover *){color:var(--scalar-color-2)}}.scalar-app .group-focus-visible\\:outline:is(:where(.group):focus-visible *){outline-style:var(--tw-outline-style);outline-width:1px}.scalar-app .group-focus-visible\\/button\\:opacity-0:is(:where(.group\\/button):focus-visible *){opacity:0}.scalar-app .group-focus-visible\\/toggle\\:outline:is(:where(.group\\/toggle):focus-visible *){outline-style:var(--tw-outline-style);outline-width:1px}.scalar-app .group-has-focus-visible\\/heading\\:opacity-100:is(:where(.group\\/heading):has(:focus-visible) *){opacity:1}.scalar-app .group-has-\\[\\.cm-focused\\]\\:z-1:is(:where(.group):has(.cm-focused) *){z-index:1}.scalar-app .group-has-\\[\\.cm-focused\\]\\:flex:is(:where(.group):has(.cm-focused) *){display:flex}.scalar-app .group-has-\\[\\.cm-focused\\]\\:pr-10:is(:where(.group):has(.cm-focused) *){padding-right:40px}.scalar-app .group-has-\\[\\:focus-visible\\]\\/cell\\:border-c-accent:is(:where(.group\\/cell):has(:focus-visible) *){border-color:var(--scalar-color-accent)}.scalar-app .group-has-\\[\\:focus-visible\\]\\/cell\\:opacity-100:is(:where(.group\\/cell):has(:focus-visible) *){opacity:1}.scalar-app .group-has-\\[\\:focus-visible\\]\\/input\\:block:is(:where(.group\\/input):has(:focus-visible) *){display:block}.scalar-app .group-has-\\[input\\]\\/label\\:mr-0:is(:where(.group\\/label):has(:is(input)) *){margin-right:0}.scalar-app .group-has-\\[\\~\\*_\\[aria-expanded\\=true\\]\\]\\/button\\:opacity-0:is(:where(.group\\/button):has(~* [aria-expanded=true]) *),.scalar-app .group-has-\\[\\~\\*\\:focus-within\\]\\/button\\:opacity-0:is(:where(.group\\/button):has(~:focus-within) *),.scalar-app .group-has-\\[\\~\\*\\:hover\\]\\/button\\:opacity-0:is(:where(.group\\/button):has(~:hover) *){opacity:0}.scalar-app .group-aria-expanded\\/button\\:rotate-180:is(:where(.group\\/button)[aria-expanded=true] *),.scalar-app .group-aria-expanded\\/combobox-button\\:rotate-180:is(:where(.group\\/combobox-button)[aria-expanded=true] *){rotate:180deg}.scalar-app .group-hocus\\/copy-button\\:sr-only:is(:is(:where(.group\\/copy-button):hover,:where(.group\\/copy-button):focus-visible) *){clip-path:inset(50%);white-space:nowrap;border-width:0;width:1px;height:1px;margin:-1px;padding:0;position:absolute;overflow:hidden}.scalar-app .group-hocus\\/copy-button\\:not-sr-only:is(:is(:where(.group\\/copy-button):hover,:where(.group\\/copy-button):focus-visible) *){clip-path:none;white-space:normal;width:auto;height:auto;margin:0;padding:0;position:static;overflow:visible}.scalar-app .group-hocus\\/copy-button\\:block:is(:is(:where(.group\\/copy-button):hover,:where(.group\\/copy-button):focus-visible) *){display:block}.scalar-app .group-hocus-within\\/code-block\\:-left-0\\.5:is(:is(:where(.group\\/code-block):hover,:where(.group\\/code-block):focus-within) *){left:-2px}.scalar-app .group-hocus-within\\/code-block\\:inline:is(:is(:where(.group\\/code-block):hover,:where(.group\\/code-block):focus-within) *){display:inline}.scalar-app .group-hocus-within\\/code-block\\:opacity-100:is(:is(:where(.group\\/code-block):hover,:where(.group\\/code-block):focus-within) *){opacity:1}.scalar-app .group-\\[\\.alert\\]\\:bg-b-alert:is(:where(.group).alert *){background-color:var(--scalar-background-alert)}.scalar-app .group-\\[\\.alert\\]\\:bg-transparent:is(:where(.group).alert *){background-color:#0000}.scalar-app .group-\\[\\.alert\\]\\:shadow-none:is(:where(.group).alert *){--tw-shadow:0 0 #0000;box-shadow:var(--tw-inset-shadow), var(--tw-inset-ring-shadow), var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow)}.scalar-app .group-\\[\\.alert\\]\\:outline-orange:is(:where(.group).alert *){outline-color:var(--scalar-color-orange)}.scalar-app .group-\\[\\.error\\]\\:bg-b-danger:is(:where(.group).error *){background-color:var(--scalar-background-danger)}.scalar-app .group-\\[\\.error\\]\\:bg-transparent:is(:where(.group).error *){background-color:#0000}.scalar-app .group-\\[\\.error\\]\\:text-red:is(:where(.group).error *){color:var(--scalar-color-red)}.scalar-app .group-\\[\\.error\\]\\:shadow-none:is(:where(.group).error *){--tw-shadow:0 0 #0000;box-shadow:var(--tw-inset-shadow), var(--tw-inset-ring-shadow), var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow)}.scalar-app .group-\\[\\.error\\]\\:outline-red:is(:where(.group).error *){outline-color:var(--scalar-color-red)}.scalar-app .peer-checked\\:text-c-1:is(:where(.peer):checked~*){color:var(--scalar-color-1)}@media (hover:hover){.scalar-app .peer-hover\\/button\\:opacity-100:is(:where(.peer\\/button):hover~*){opacity:1}}.scalar-app .peer-focus-visible\\/button\\:opacity-100:is(:where(.peer\\/button):focus-visible~*){opacity:1}.scalar-app .peer-has-\\[\\.cm-focused\\]\\:opacity-0:is(:where(.peer):has(.cm-focused)~*){opacity:0}.scalar-app .peer-has-\\[\\.color-selector\\]\\:hidden:is(:where(.peer):has(.color-selector)~*){display:none}.scalar-app .placeholder\\:font-\\[inherit\\]::placeholder{font-family:inherit}:is(.scalar-app .\\*\\:not-first\\:before\\:content-\\[\\'_·_\\'\\]>*):not(:first-child):before{--tw-content:" · ";content:var(--tw-content)}.scalar-app .after\\:pointer-events-none:after{content:var(--tw-content);pointer-events:none}.scalar-app .after\\:absolute:after{content:var(--tw-content);position:absolute}.scalar-app .after\\:inset-0:after{content:var(--tw-content);inset:0}.scalar-app .after\\:inset-x-0:after{content:var(--tw-content);inset-inline:0}.scalar-app .after\\:-top-0\\.5:after{content:var(--tw-content);top:-2px}.scalar-app .after\\:-bottom-0\\.5:after{content:var(--tw-content);bottom:-2px}.scalar-app .after\\:block:after{content:var(--tw-content);display:block}.scalar-app .after\\:h-0\\.75:after{content:var(--tw-content);height:3px}.scalar-app .after\\:rounded:after{content:var(--tw-content);border-radius:var(--scalar-radius)}.scalar-app .after\\:bg-blue:after{content:var(--tw-content);background-color:var(--scalar-color-blue)}.scalar-app .after\\:opacity-15:after{content:var(--tw-content);opacity:.15}.scalar-app .after\\:content-\\[\\'\\:\\'\\]:after{--tw-content:":";content:var(--tw-content)}.scalar-app .first\\:rounded-t-\\[inherit\\]:first-child{border-top-left-radius:inherit;border-top-right-radius:inherit}:is(.scalar-app .\\*\\:first\\:rounded-l>*):first-child{border-top-left-radius:var(--scalar-radius);border-bottom-left-radius:var(--scalar-radius)}:is(.scalar-app .\\*\\:first\\:border-t-0>*):first-child,:is(.scalar-app .first\\:\\*\\:border-t-0:first-child>*){border-top-style:var(--tw-border-style);border-top-width:0}:is(.scalar-app .\\*\\:first\\:p-3>*):first-child{padding:12px}.scalar-app .last\\:rounded-b-\\[inherit\\]:last-child{border-bottom-right-radius:inherit;border-bottom-left-radius:inherit}.scalar-app .last\\:rounded-b-lg:last-child{border-bottom-right-radius:var(--scalar-radius-lg);border-bottom-left-radius:var(--scalar-radius-lg)}.scalar-app .last\\:border-r-0:last-child{border-right-style:var(--tw-border-style);border-right-width:0}:is(.scalar-app .\\*\\:last\\:rounded-r>*):last-child{border-top-right-radius:var(--scalar-radius);border-bottom-right-radius:var(--scalar-radius)}.scalar-app .last-of-type\\:first-of-type\\:border-b-0:last-of-type:first-of-type{border-bottom-style:var(--tw-border-style);border-bottom-width:0}.scalar-app .empty\\:hidden:empty{display:none}.scalar-app .focus-within\\:bg-b-1:focus-within{background-color:var(--scalar-background-1)}.scalar-app .focus-within\\:text-c-1:focus-within{color:var(--scalar-color-1)}.scalar-app .focus-within\\:opacity-100:focus-within{opacity:1}.scalar-app .focus-within\\:outline-none:focus-within{--tw-outline-style:none;outline-style:none}@media (hover:hover){.scalar-app .hover\\:bg-b-2:hover{background-color:var(--scalar-background-2)}.scalar-app .hover\\:bg-b-3:hover{background-color:var(--scalar-background-3)}.scalar-app .hover\\:bg-b-header-2:hover{background-color:var(--scalar-header-background-2,var(--scalar-background-2))}.scalar-app .hover\\:bg-c-accent\\/20:hover{background-color:var(--scalar-color-accent)}@supports (color:color-mix(in lab, red, red)){.scalar-app .hover\\:bg-c-accent\\/20:hover{background-color:color-mix(in oklab, var(--scalar-color-accent) 20%, transparent)}}.scalar-app .hover\\:bg-h-btn:hover{background-color:var(--scalar-button-1-hover)}.scalar-app .hover\\:bg-h-header-cta:hover{background-color:var(--scalar-header-call-to-action-color,var(--scalar-button-1))}@supports (color:color-mix(in lab, red, red)){.scalar-app .hover\\:bg-h-header-cta:hover{background-color:color-mix(in srgb, var(--scalar-header-call-to-action-color,var(--scalar-button-1)), var(--scalar-header-background-1,var(--scalar-background-1)) 15%)}}.scalar-app .hover\\:bg-sidebar-b-1:hover{background-color:var(--scalar-sidebar-background-1,var(--scalar-background-1))}.scalar-app .hover\\:bg-sidebar-b-hover:hover{background-color:var(--scalar-sidebar-item-hover-background,var(--scalar-background-2))}.scalar-app .hover\\:bg-linear-to-b:hover{--tw-gradient-position:to bottom}@supports (background-image:linear-gradient(in lab, red, red)){.scalar-app .hover\\:bg-linear-to-b:hover{--tw-gradient-position:to bottom in oklab}}.scalar-app .hover\\:bg-linear-to-b:hover{background-image:linear-gradient(var(--tw-gradient-stops))}.scalar-app .hover\\:bg-linear-to-t:hover{--tw-gradient-position:to top}@supports (background-image:linear-gradient(in lab, red, red)){.scalar-app .hover\\:bg-linear-to-t:hover{--tw-gradient-position:to top in oklab}}.scalar-app .hover\\:bg-linear-to-t:hover{background-image:linear-gradient(var(--tw-gradient-stops))}.scalar-app .hover\\:text-c-1:hover{color:var(--scalar-color-1)}.scalar-app .hover\\:text-c-2:hover{color:var(--scalar-color-2)}.scalar-app .hover\\:text-c-header-1:hover{color:var(--scalar-header-color-1,var(--scalar-color-1))}.scalar-app .hover\\:text-sidebar-c-1:hover{color:var(--scalar-sidebar-color-1,var(--scalar-color-1))}.scalar-app .hover\\:text-sidebar-c-hover:hover{color:var(--scalar-sidebar-item-hover-color,var(--scalar-sidebar-color-2))}.scalar-app .hover\\:underline:hover{text-decoration-line:underline}.scalar-app .hover\\:opacity-100:hover{opacity:1}.scalar-app .hover\\:brightness-75:hover{--tw-brightness:brightness(75%);filter:var(--tw-blur,) var(--tw-brightness,) var(--tw-contrast,) var(--tw-grayscale,) var(--tw-hue-rotate,) var(--tw-invert,) var(--tw-saturate,) var(--tw-sepia,) var(--tw-drop-shadow,)}.scalar-app .hover\\:brightness-90:hover{--tw-brightness:brightness(90%);filter:var(--tw-blur,) var(--tw-brightness,) var(--tw-contrast,) var(--tw-grayscale,) var(--tw-hue-rotate,) var(--tw-invert,) var(--tw-saturate,) var(--tw-sepia,) var(--tw-drop-shadow,)}}.scalar-app .focus\\:border-b-1:focus{border-bottom-style:var(--tw-border-style);border-bottom-width:1px;border-color:var(--scalar-background-1)}.scalar-app .focus\\:text-c-1:focus{color:var(--scalar-color-1)}.scalar-app .focus\\:outline-none:focus{--tw-outline-style:none;outline-style:none}.scalar-app .focus-visible\\:border-c-btn:focus-visible{border-color:var(--scalar-button-1-color)}.scalar-app .focus-visible\\:opacity-100:focus-visible{opacity:1}.scalar-app .focus-visible\\:outline:focus-visible{outline-style:var(--tw-outline-style);outline-width:1px}.scalar-app .focus-visible\\:outline-offset-2:focus-visible{outline-offset:2px}.scalar-app .active\\:bg-b-btn:active{background-color:var(--scalar-button-1)}.scalar-app .active\\:text-c-1:active{color:var(--scalar-color-1)}.scalar-app .active\\:brightness-90:active{--tw-brightness:brightness(90%);filter:var(--tw-blur,) var(--tw-brightness,) var(--tw-contrast,) var(--tw-grayscale,) var(--tw-hue-rotate,) var(--tw-invert,) var(--tw-saturate,) var(--tw-sepia,) var(--tw-drop-shadow,)}.scalar-app .disabled\\:pointer-events-none:disabled{pointer-events:none}.scalar-app .disabled\\:cursor-default:disabled{cursor:default}.scalar-app .disabled\\:text-c-2:disabled{color:var(--scalar-color-2)}.scalar-app .disabled\\:opacity-30:disabled{opacity:.3}.scalar-app .has-focus-visible\\:outline:has(:focus-visible){outline-style:var(--tw-outline-style);outline-width:1px}.scalar-app .has-\\[\\:focus-visible\\]\\:absolute:has(:focus-visible){position:absolute}.scalar-app .has-\\[\\:focus-visible\\]\\:z-1:has(:focus-visible){z-index:1}.scalar-app .has-\\[\\:focus-visible\\]\\:rounded-\\[4px\\]:has(:focus-visible){border-radius:4px}.scalar-app .has-\\[\\:focus-visible\\]\\:bg-b-1:has(:focus-visible){background-color:var(--scalar-background-1)}.scalar-app .has-\\[\\:focus-visible\\]\\:bg-sidebar-b-1:has(:focus-visible){background-color:var(--scalar-sidebar-background-1,var(--scalar-background-1))}.scalar-app .has-\\[\\:focus-visible\\]\\:opacity-100:has(:focus-visible){opacity:1}:is(.scalar-app .has-\\[\\:focus-visible\\]\\:outline:has(:focus-visible),.scalar-app .has-\\[input\\:focus-visible\\]\\:outline:has(:is(input:focus-visible))){outline-style:var(--tw-outline-style);outline-width:1px}.scalar-app .has-\\[\\&\\[aria-expanded\\=true\\]\\]\\:opacity-100:has([aria-expanded=true]){opacity:1}@media not all and (width>=800px){.scalar-app .max-md\\:absolute\\!{position:absolute!important}.scalar-app .max-md\\:top-4{top:16px}.scalar-app .max-md\\:z-5{z-index:5}.scalar-app .max-md\\:w-full\\!{width:100%!important}.scalar-app .max-md\\:pt-2{padding-top:8px}.scalar-app .max-md\\:pt-12{padding-top:48px}.scalar-app .max-md\\:pl-4\\!{padding-left:16px!important}.scalar-app .max-md\\:pl-10{padding-left:40px}.scalar-app .max-md\\:pl-14{padding-left:56px}}@media (width>=800px){.scalar-app .md\\:pointer-events-none{pointer-events:none}.scalar-app .md\\:absolute{position:absolute}.scalar-app .md\\:inset-x-1{inset-inline:4px}.scalar-app .md\\:top-1\\/2{top:50%}.scalar-app .md\\:mt-0{margin-top:0}.scalar-app .md\\:-ml-1\\.25{margin-left:-5px}.scalar-app .md\\:w-\\[calc\\(100vw-16px\\)\\]{width:calc(100vw - 16px)}.scalar-app .md\\:-translate-y-1\\/2{--tw-translate-y:calc(calc(1 / 2 * 100%) * -1);translate:var(--tw-translate-x) var(--tw-translate-y)}.scalar-app .md\\:flex-row{flex-direction:row}.scalar-app .md\\:px-1\\.5{padding-inline:6px}.scalar-app .md\\:opacity-0{opacity:0}:is(.scalar-app .md\\:\\*\\:border-t-0>*){border-top-style:var(--tw-border-style);border-top-width:0}@media (hover:hover){.scalar-app .md\\:group-hover\\/upload\\:pointer-events-auto:is(:where(.group\\/upload):hover *){pointer-events:auto}.scalar-app .md\\:group-hover\\/upload\\:opacity-100:is(:where(.group\\/upload):hover *){opacity:1}}}@media (width>=1000px){.scalar-app .lg\\:-mr-1{margin-right:-4px}.scalar-app .lg\\:flex{display:flex}.scalar-app .lg\\:hidden{display:none}.scalar-app .lg\\:min-h-header{min-height:48px}.scalar-app .lg\\:w-\\[calc\\(100vw-32px\\)\\]{width:calc(100vw - 32px)}.scalar-app .lg\\:w-full{width:100%}.scalar-app .lg\\:p-0{padding:0}.scalar-app .lg\\:pr-24{padding-right:96px}}@media (width>=1200px){.scalar-app .xl\\:mb-1\\.5{margin-bottom:6px}.scalar-app .xl\\:flex{display:flex}.scalar-app .xl\\:h-full{height:100%}.scalar-app .xl\\:min-w-0{min-width:0}.scalar-app .xl\\:flex-row{flex-direction:row}.scalar-app .xl\\:gap-12{gap:48px}.scalar-app .xl\\:overflow-hidden{overflow:hidden}.scalar-app .xl\\:rounded-none{border-radius:0}.scalar-app .xl\\:border-r{border-right-style:var(--tw-border-style);border-right-width:var(--scalar-border-width)}.scalar-app .xl\\:border-none{--tw-border-style:none;border-style:none}.scalar-app .xl\\:pr-0\\.5{padding-right:2px}.scalar-app .xl\\:pl-2{padding-left:8px}:is(.scalar-app .\\*\\:xl\\:border-t-0>*){border-top-style:var(--tw-border-style);border-top-width:0}:is(.scalar-app .\\*\\:xl\\:border-l>*){border-left-style:var(--tw-border-style);border-left-width:var(--scalar-border-width)}.scalar-app .xl\\:first\\:ml-auto:first-child{margin-left:auto}:is(.scalar-app .\\*\\:first\\:xl\\:border-l-0>*):first-child{border-left-style:var(--tw-border-style);border-left-width:0}}@container (width>=768px){.scalar-app .\\@3xl\\:order-0{order:0}.scalar-app .\\@3xl\\:mb-0{margin-bottom:0}.scalar-app .\\@3xl\\:ml-0\\.75{margin-left:3px}.scalar-app .\\@3xl\\:flex{display:flex}.scalar-app .\\@3xl\\:hidden{display:none}.scalar-app .\\@3xl\\:flex-nowrap{flex-wrap:nowrap}}.scalar-app .dark\\:bg-\\(--bg-dark\\):where(.dark-mode,.dark-mode *){background-color:var(--bg-dark)}.scalar-app .dark\\:bg-b-3:where(.dark-mode,.dark-mode *){background-color:var(--scalar-background-3)}.scalar-app .dark\\:bg-backdrop-dark:where(.dark-mode,.dark-mode *){background-color:#00000073}.scalar-app .dark\\:bg-linear-to-t:where(.dark-mode,.dark-mode *){--tw-gradient-position:to top}@supports (background-image:linear-gradient(in lab, red, red)){.scalar-app .dark\\:bg-linear-to-t:where(.dark-mode,.dark-mode *){--tw-gradient-position:to top in oklab}}.scalar-app .dark\\:bg-linear-to-t:where(.dark-mode,.dark-mode *){background-image:linear-gradient(var(--tw-gradient-stops))}@media (hover:hover){.scalar-app .dark\\:hover\\:bg-b-3:where(.dark-mode,.dark-mode *):hover{background-color:var(--scalar-background-3)}.scalar-app .dark\\:hover\\:bg-linear-to-b:where(.dark-mode,.dark-mode *):hover{--tw-gradient-position:to bottom}@supports (background-image:linear-gradient(in lab, red, red)){.scalar-app .dark\\:hover\\:bg-linear-to-b:where(.dark-mode,.dark-mode *):hover{--tw-gradient-position:to bottom in oklab}}.scalar-app .dark\\:hover\\:bg-linear-to-b:where(.dark-mode,.dark-mode *):hover{background-image:linear-gradient(var(--tw-gradient-stops))}.scalar-app .dark\\:hover\\:bg-linear-to-t:where(.dark-mode,.dark-mode *):hover{--tw-gradient-position:to top}@supports (background-image:linear-gradient(in lab, red, red)){.scalar-app .dark\\:hover\\:bg-linear-to-t:where(.dark-mode,.dark-mode *):hover{--tw-gradient-position:to top in oklab}}.scalar-app .dark\\:hover\\:bg-linear-to-t:where(.dark-mode,.dark-mode *):hover{background-image:linear-gradient(var(--tw-gradient-stops))}}.scalar-app .ui-open\\:rotate-90[data-headlessui-state~=open],:where([data-headlessui-state~=open]) :is(.scalar-app .ui-open\\:rotate-90){rotate:90deg}.scalar-app .ui-open\\:rotate-180[data-headlessui-state~=open],:where([data-headlessui-state~=open]) :is(.scalar-app .ui-open\\:rotate-180){rotate:180deg}.scalar-app .last\\:ui-open\\:border-b-0:last-child[data-headlessui-state~=open],:where([data-headlessui-state~=open]) .scalar-app .last\\:ui-open\\:border-b-0:last-child{border-bottom-style:var(--tw-border-style);border-bottom-width:0}.scalar-app .ui-not-open\\:hidden[data-headlessui-state]:not([data-headlessui-state~=open]),:where([data-headlessui-state]:not([data-headlessui-state~=open])) :is(.scalar-app .ui-not-open\\:hidden):not([data-headlessui-state]){display:none}.scalar-app .ui-not-open\\:rotate-0[data-headlessui-state]:not([data-headlessui-state~=open]),:where([data-headlessui-state]:not([data-headlessui-state~=open])) :is(.scalar-app .ui-not-open\\:rotate-0):not([data-headlessui-state]){rotate:none}:is(.scalar-app .ui-active\\:\\*\\:bg-b-2[data-headlessui-state~=active]>*),:is(:where([data-headlessui-state~=active]) :is(.scalar-app .ui-active\\:\\*\\:bg-b-2)>*){background-color:var(--scalar-background-2)}@media (width<=720px) and (height<=480px){.scalar-app .zoomed\\:static{position:static}.scalar-app .zoomed\\:p-1{padding:4px}.scalar-app .zoomed\\:whitespace-normal\\!{white-space:normal!important}}.scalar-app .highlighted\\:bg-b-2[data-highlighted]{background-color:var(--scalar-background-2)}.app-platform-mac :is(.scalar-app .mac\\:h-12){height:48px}.app-platform-mac :is(.scalar-app .mac\\:app-drag-region){-webkit-app-region:drag;-webkit-app-region:drag}.scalar-app .\\[\\&_a\\]\\:underline a{text-decoration-line:underline}.scalar-app .\\[\\&_a\\:hover\\]\\:text-c-1 a:hover{color:var(--scalar-color-1)}.scalar-app .\\[\\&_code\\]\\:font-code code{font-family:var(--scalar-font-code)}.scalar-app .\\[\\&_em\\]\\:text-c-1 em{color:var(--scalar-color-1)}.scalar-app .\\[\\&_em\\]\\:not-italic em{font-style:normal}@property --tw-translate-x{syntax:"*";inherits:false;initial-value:0}@property --tw-translate-y{syntax:"*";inherits:false;initial-value:0}@property --tw-translate-z{syntax:"*";inherits:false;initial-value:0}@property --tw-scale-x{syntax:"*";inherits:false;initial-value:1}@property --tw-scale-y{syntax:"*";inherits:false;initial-value:1}@property --tw-scale-z{syntax:"*";inherits:false;initial-value:1}@property --tw-rotate-x{syntax:"*";inherits:false}@property --tw-rotate-y{syntax:"*";inherits:false}@property --tw-rotate-z{syntax:"*";inherits:false}@property --tw-skew-x{syntax:"*";inherits:false}@property --tw-skew-y{syntax:"*";inherits:false}@property --tw-space-x-reverse{syntax:"*";inherits:false;initial-value:0}@property --tw-divide-y-reverse{syntax:"*";inherits:false;initial-value:0}@property --tw-border-style{syntax:"*";inherits:false;initial-value:solid}@property --tw-gradient-position{syntax:"*";inherits:false}@property --tw-gradient-from{syntax:"<color>";inherits:false;initial-value:#0000}@property --tw-gradient-via{syntax:"<color>";inherits:false;initial-value:#0000}@property --tw-gradient-to{syntax:"<color>";inherits:false;initial-value:#0000}@property --tw-gradient-stops{syntax:"*";inherits:false}@property --tw-gradient-via-stops{syntax:"*";inherits:false}@property --tw-gradient-from-position{syntax:"<length-percentage>";inherits:false;initial-value:0%}@property --tw-gradient-via-position{syntax:"<length-percentage>";inherits:false;initial-value:50%}@property --tw-gradient-to-position{syntax:"<length-percentage>";inherits:false;initial-value:100%}@property --tw-mask-linear{syntax:"*";inherits:false;initial-value:linear-gradient(#fff, #fff)}@property --tw-mask-radial{syntax:"*";inherits:false;initial-value:linear-gradient(#fff, #fff)}@property --tw-mask-conic{syntax:"*";inherits:false;initial-value:linear-gradient(#fff, #fff)}@property --tw-mask-left{syntax:"*";inherits:false;initial-value:linear-gradient(#fff, #fff)}@property --tw-mask-right{syntax:"*";inherits:false;initial-value:linear-gradient(#fff, #fff)}@property --tw-mask-bottom{syntax:"*";inherits:false;initial-value:linear-gradient(#fff, #fff)}@property --tw-mask-top{syntax:"*";inherits:false;initial-value:linear-gradient(#fff, #fff)}@property --tw-mask-top-from-position{syntax:"*";inherits:false;initial-value:0%}@property --tw-mask-top-to-position{syntax:"*";inherits:false;initial-value:100%}@property --tw-mask-top-from-color{syntax:"*";inherits:false;initial-value:black}@property --tw-mask-top-to-color{syntax:"*";inherits:false;initial-value:transparent}@property --tw-mask-bottom-from-position{syntax:"*";inherits:false;initial-value:0%}@property --tw-mask-bottom-to-position{syntax:"*";inherits:false;initial-value:100%}@property --tw-mask-bottom-from-color{syntax:"*";inherits:false;initial-value:black}@property --tw-mask-bottom-to-color{syntax:"*";inherits:false;initial-value:transparent}@property --tw-leading{syntax:"*";inherits:false}@property --tw-ordinal{syntax:"*";inherits:false}@property --tw-slashed-zero{syntax:"*";inherits:false}@property --tw-numeric-figure{syntax:"*";inherits:false}@property --tw-numeric-spacing{syntax:"*";inherits:false}@property --tw-numeric-fraction{syntax:"*";inherits:false}@property --tw-outline-style{syntax:"*";inherits:false;initial-value:solid}@property --tw-blur{syntax:"*";inherits:false}@property --tw-brightness{syntax:"*";inherits:false}@property --tw-contrast{syntax:"*";inherits:false}@property --tw-grayscale{syntax:"*";inherits:false}@property --tw-hue-rotate{syntax:"*";inherits:false}@property --tw-invert{syntax:"*";inherits:false}@property --tw-opacity{syntax:"*";inherits:false}@property --tw-saturate{syntax:"*";inherits:false}@property --tw-sepia{syntax:"*";inherits:false}@property --tw-drop-shadow{syntax:"*";inherits:false}@property --tw-drop-shadow-color{syntax:"*";inherits:false}@property --tw-drop-shadow-alpha{syntax:"<percentage>";inherits:false;initial-value:100%}@property --tw-drop-shadow-size{syntax:"*";inherits:false}@property --tw-duration{syntax:"*";inherits:false}@property --tw-ease{syntax:"*";inherits:false}@property --tw-content{syntax:"*";inherits:false;initial-value:""}@keyframes pulse{50%{opacity:.5}}@media (width<=1000px){.agent-scalar.agent-scalar[data-v-a9f22fa8]{border-top-left-radius:var(--scalar-radius-lg);border-top-right-radius:var(--scalar-radius-lg);inset-inline:0;top:48px}.agent-scalar.agent-scalar[data-v-a9f22fa8],.agent-scalar-overlay.agent-scalar-overlay[data-v-a9f22fa8]{z-index:15}}.scalar-mcp-layer[data-v-496918d9]{background:0 0;flex-direction:column;justify-content:flex-end;gap:2px;height:32px;transition:all .4s ease-in-out;display:flex;position:relative}.scalar-mcp-layer[data-v-496918d9]:hover{height:172px}.scalar-mcp-layer-link[data-v-496918d9]:hover{cursor:pointer!important}.scalar-mcp-layer .scalar-mcp-layer-link[data-v-496918d9]{cursor:pointer;text-align:center;white-space:nowrap;width:100%;height:31px;font-size:var(--scalar-small);border-radius:var(--scalar-radius);border:var(--scalar-border-width) solid var(--scalar-border-color);color:var(--scalar-sidebar-color-1);background:var(--scalar-background-1);align-items:center;gap:6px;padding:9px 6px;line-height:1.385;text-decoration:none;transition:transform .2s ease-in-out;display:flex;position:absolute;bottom:0}.scalar-mcp-layer-link[data-v-496918d9]:after{content:"";width:100%;height:2px;position:absolute;bottom:-2px;left:0}.scalar-mcp-layer div.scalar-mcp-layer-link[data-v-496918d9]{cursor:default}.scalar-mcp-layer .scalar-mcp-layer-link[data-v-496918d9]:last-child{position:relative;transform:translate(0,0)}.scalar-mcp-layer .scalar-mcp-layer-link[data-v-496918d9]:nth-last-child(2){transform:translateY(-2px)scale(.99)}.scalar-mcp-layer:hover a[data-v-496918d9]:nth-last-child(2){transform:translateY(calc(-100% - 2px))scale(.99)}.scalar-mcp-layer .scalar-mcp-layer-link[data-v-496918d9]:nth-last-child(3){transform:translateY(-4px)scale(.98)}.scalar-mcp-layer:hover a[data-v-496918d9]:nth-last-child(3){transform:translateY(calc(-200% - 4px))scale(1)}.scalar-mcp-layer .scalar-mcp-layer-link[data-v-496918d9]:nth-last-child(4){transform:translateY(-6px)scale(.97)}.scalar-mcp-layer:hover a[data-v-496918d9]:nth-last-child(4){transform:translateY(calc(-300% - 6px))scale(1)}.scalar-mcp-layer .scalar-mcp-layer-link[data-v-496918d9]:nth-last-child(5){transform:translateY(-8px)scale(.96)}.scalar-mcp-layer:hover .scalar-mcp-layer-link[data-v-496918d9]:nth-last-child(5){transform:translateY(calc(-400% - 8px))scale(1)}.scalar-mcp-layer:hover .scalar-mcp-layer-link[data-v-496918d9]{transition:transform .2s ease-in-out .1s}.scalar-mcp-layer .scalar-mcp-layer-link[data-v-496918d9]:hover{background:var(--scalar-background-2)}.scalar-mcp-layer .mcp-logo[data-v-496918d9]{width:16px;height:16px;color:var(--scalar-sidebar-color-1)}.mcp-nav[data-v-496918d9]{color:var(--scalar-sidebar-color-2)}.references-classic-header[data-v-8a3822ca]{max-width:var(--refs-content-max-width);align-items:center;gap:12px;margin:auto;padding:12px 0;display:flex}.references-classic-header-content[data-v-8a3822ca]{flex-grow:1;gap:12px;display:flex}.references-classic-header-container[data-v-8a3822ca]{padding:0 60px;position:relative}@container narrow-references-container (width<=900px){.references-classic-header[data-v-8a3822ca]{padding:12px 24px}.references-classic-header-container[data-v-8a3822ca]{padding:0}}.references-classic-header-icon[data-v-8a3822ca]{height:24px;color:var(--scalar-color-1)}.client-libraries-content[data-v-75d206b8]{background-color:var(--scalar-background-1);border-left:var(--scalar-border-width) solid var(--scalar-border-color);border-right:var(--scalar-border-width) solid var(--scalar-border-color);justify-content:center;padding:0 12px;display:flex;overflow:hidden;container:client-libraries-content/inline-size}.client-libraries[data-v-75d206b8]{cursor:pointer;white-space:nowrap;width:100%;color:var(--scalar-color-3);-webkit-user-select:none;user-select:none;border-bottom:1px solid #0000;justify-content:center;align-items:center;gap:6px;padding:8px 2px;display:flex;position:relative}.client-libraries[data-v-75d206b8]:not(.client-libraries__active):hover:before{content:"";background:var(--scalar-background-2);z-index:0;border-radius:var(--scalar-radius);width:calc(100% - 4px);height:calc(100% - 4px);position:absolute;top:2px;left:2px}.client-libraries[data-v-75d206b8]:active{color:var(--scalar-color-1)}.client-libraries[data-v-75d206b8]:focus-visible{box-shadow:inset 0 0 0 1px var(--scalar-color-accent);outline:none}@media screen and (width<=450px){.client-libraries[data-v-75d206b8]:nth-of-type(4),.client-libraries[data-v-75d206b8]:nth-of-type(5){display:none}}.client-libraries-icon[data-v-75d206b8]{aspect-ratio:1;box-sizing:border-box;color:currentColor;justify-content:center;align-items:center;width:100%;min-width:14px;max-width:14px;max-height:14px;display:flex;position:relative}.client-libraries-icon__more svg[data-v-75d206b8]{height:initial}@container client-libraries-content (width<400px){.client-libraries__select[data-v-75d206b8]{width:fit-content}.client-libraries__select .client-libraries-icon__more+span[data-v-75d206b8]{display:none}}@container client-libraries-content (width<380px){.client-libraries[data-v-75d206b8]{width:100%}.client-libraries span[data-v-75d206b8]{display:none}}.client-libraries__active[data-v-75d206b8]{color:var(--scalar-color-1);border-bottom:1px solid var(--scalar-color-1)}@keyframes codeloader-75d206b8{0%{transform:rotate(0)}to{transform:rotate(1turn)}}.client-libraries .client-libraries-text[data-v-75d206b8]{font-size:var(--scalar-small);align-items:center;display:flex;position:relative}.client-libraries__active .client-libraries-text[data-v-75d206b8]{color:var(--scalar-color-1);font-weight:var(--scalar-semibold)}@media screen and (width<=600px){.references-classic .client-libraries[data-v-75d206b8]{flex-direction:column}}.selected-client[data-v-c6251633]{color:var(--scalar-color-1);font-size:var(--scalar-small);font-family:var(--scalar-font-code);white-space:nowrap;text-overflow:ellipsis;background:var(--scalar-background-1);border-top:none;border:var(--scalar-border-width) solid var(--scalar-border-color);border-bottom-left-radius:var(--scalar-radius-xl);border-bottom-right-radius:var(--scalar-radius-xl);min-height:fit-content;padding:9px 12px;overflow:hidden}.client-libraries-heading[data-v-c6251633]{font-size:var(--scalar-small);font-weight:var(--scalar-font-medium);color:var(--scalar-color-1);background-color:var(--scalar-background-2);border:var(--scalar-border-width) solid var(--scalar-border-color);border-top-left-radius:var(--scalar-radius-xl);border-top-right-radius:var(--scalar-radius-xl);align-items:center;max-height:32px;padding:9px 12px;display:flex}[data-v-c6251633] .scalar-codeblock-pre .hljs{margin-top:8px}:where(.badge[data-v-fb946bb8]){color:var(--badge-text-color,var(--scalar-color-2));font-size:var(--scalar-mini);background:var(--badge-background-color,var(--scalar-background-2));border:var(--scalar-border-width) solid var(--badge-border-color,var(--scalar-border-color));border-radius:12px;padding:2px 6px;display:inline-block}:where(.badge).text-orange[data-v-fb946bb8]{background:color-mix(in srgb, var(--scalar-color-orange), transparent 90%);border:#0000}:where(.badge).text-yellow[data-v-fb946bb8]{background:color-mix(in srgb, var(--scalar-color-yellow), transparent 90%);border:#0000}:where(.badge).text-red[data-v-fb946bb8]{background:color-mix(in srgb, var(--scalar-color-red), transparent 90%);border:#0000}:where(.badge).text-purple[data-v-fb946bb8]{background:color-mix(in srgb, var(--scalar-color-purple), transparent 90%);border:#0000}:where(.badge).text-green[data-v-fb946bb8]{background:color-mix(in srgb, var(--scalar-color-green), transparent 90%);border:#0000}.download-container[data-v-b258a15f]{z-index:1;flex-direction:column;gap:16px;width:fit-content;margin:0 .5px 8px;display:flex;position:relative}.download-container.download-both[data-v-b258a15f]:hover:before{content:"";border-radius:var(--scalar-radius-lg);width:calc(100% + 24px);height:90px;box-shadow:var(--scalar-shadow-2);pointer-events:none;background:var(--scalar-background-1);position:absolute;top:-11px;left:-12px}.download-container[data-v-b258a15f]:has(:focus-visible):before{content:"";border-radius:var(--scalar-radius-lg);width:calc(100% + 24px);height:90px;box-shadow:var(--scalar-shadow-2);pointer-events:none;background:var(--scalar-background-1);position:absolute;top:-11px;left:-12px}.download-button[data-v-b258a15f]{color:var(--scalar-link-color);cursor:pointer;outline:none;justify-content:center;align-items:center;gap:4px;height:fit-content;padding:0;display:flex;position:relative;white-space:nowrap!important}.download-button[data-v-b258a15f]:before{border-radius:var(--scalar-radius);content:"";width:calc(100% + 18px);height:calc(100% + 16px);position:absolute;top:-8px;left:-9px}.download-button[data-v-b258a15f]:last-of-type:before{width:calc(100% + 15px)}.download-button[data-v-b258a15f]:hover:before{background:var(--scalar-background-2);border:var(--scalar-border-width) solid var(--scalar-border-color)}.download-button[data-v-b258a15f]:focus-visible:before{background:var(--scalar-background-2);border:var(--scalar-border-width) solid var(--scalar-border-color);outline-style:var(--tw-outline-style);outline-width:1px}.download-button span[data-v-b258a15f]{--font-color:var(--scalar-link-color,var(--scalar-color-accent));--font-visited:var(--scalar-link-color-visited,var(--scalar-color-2));-webkit-text-decoration:var(--scalar-text-decoration);-webkit-text-decoration:var(--scalar-text-decoration);-webkit-text-decoration:var(--scalar-text-decoration);text-decoration:var(--scalar-text-decoration);color:var(--font-color);font-weight:var(--scalar-link-font-weight,var(--scalar-semibold));text-underline-offset:.25rem;text-decoration-thickness:1px;-webkit-text-decoration-color:var(--font-color);-webkit-text-decoration-color:var(--font-color);-webkit-text-decoration-color:var(--font-color);text-decoration-color:var(--font-color)}@supports (color:color-mix(in lab, red, red)){.download-button span[data-v-b258a15f]{-webkit-text-decoration-color:color-mix(in srgb, var(--font-color) 30%, transparent);-webkit-text-decoration-color:color-mix(in srgb, var(--font-color) 30%, transparent);-webkit-text-decoration-color:color-mix(in srgb, var(--font-color) 30%, transparent);text-decoration-color:color-mix(in srgb, var(--font-color) 30%, transparent)}}.download-button span[data-v-b258a15f]{z-index:1;align-items:center;gap:6px;line-height:1.625;display:flex}.download-button:hover span[data-v-b258a15f]{-webkit-text-decoration-color:var(--scalar-color-1,currentColor);-webkit-text-decoration-color:var(--scalar-color-1,currentColor);-webkit-text-decoration-color:var(--scalar-color-1,currentColor);text-decoration-color:var(--scalar-color-1,currentColor);color:var(--scalar-link-color-hover,var(--scalar-color-accent));-webkit-text-decoration:var(--scalar-text-decoration-hover);-webkit-text-decoration:var(--scalar-text-decoration-hover);-webkit-text-decoration:var(--scalar-text-decoration-hover);-webkit-text-decoration:var(--scalar-text-decoration-hover);text-decoration:var(--scalar-text-decoration-hover)}.download-button[data-v-b258a15f]:nth-of-type(2){clip-path:inset(50%);white-space:nowrap;border-width:0;width:1px;height:1px;margin:-1px;padding:0;position:absolute;overflow:hidden}.download-container:hover .download-button[data-v-b258a15f]:nth-of-type(2){clip-path:none;white-space:normal;width:auto;height:auto;margin:0;padding:0;position:absolute;top:42px;overflow:visible}.download-container:has(:focus-visible) .download-button[data-v-b258a15f]:nth-of-type(2){clip-path:none;white-space:normal;width:auto;height:auto;margin:0;padding:0;position:absolute;top:42px;overflow:visible}.extension[data-v-b258a15f]{z-index:1;background:var(--scalar-link-color,var(--scalar-color-accent));color:var(--scalar-background-1)}.download-container:hover .extension[data-v-b258a15f]{opacity:1}.download-container:has(:focus-visible) .extension[data-v-b258a15f]{opacity:1}.download-link[data-v-b258a15f]{--font-color:var(--scalar-link-color,var(--scalar-color-accent));--font-visited:var(--scalar-link-color-visited,var(--scalar-color-2));-webkit-text-decoration:var(--scalar-text-decoration);-webkit-text-decoration:var(--scalar-text-decoration);-webkit-text-decoration:var(--scalar-text-decoration);text-decoration:var(--scalar-text-decoration);color:var(--font-color);font-weight:var(--scalar-link-font-weight,var(--scalar-semibold));text-underline-offset:.25rem;text-decoration-thickness:1px;-webkit-text-decoration-color:var(--font-color);-webkit-text-decoration-color:var(--font-color);-webkit-text-decoration-color:var(--font-color);text-decoration-color:var(--font-color)}@supports (color:color-mix(in lab, red, red)){.download-link[data-v-b258a15f]{-webkit-text-decoration-color:color-mix(in srgb, var(--font-color) 30%, transparent);-webkit-text-decoration-color:color-mix(in srgb, var(--font-color) 30%, transparent);-webkit-text-decoration-color:color-mix(in srgb, var(--font-color) 30%, transparent);text-decoration-color:color-mix(in srgb, var(--font-color) 30%, transparent)}}.download-link[data-v-b258a15f]:hover{--font-color:var(--scalar-link-color,var(--scalar-color-accent));-webkit-text-decoration-color:var(--font-color);-webkit-text-decoration-color:var(--font-color);-webkit-text-decoration-color:var(--font-color);text-decoration-color:var(--font-color)}.introduction-card[data-v-5764c94a]{flex-direction:column;gap:12px;display:flex}.introduction-card-row[data-v-5764c94a]{gap:24px}@media (width>=600px){.introduction-card-row[data-v-5764c94a]{flex-flow:wrap}}.introduction-card-row[data-v-5764c94a]>*{flex:1}@media (width>=600px){.introduction-card-row[data-v-5764c94a]>*{min-width:min-content}}@media (width<=600px){.introduction-card-row[data-v-5764c94a]>*{max-width:100%}}@container (width<=900px){.introduction-card-row[data-v-5764c94a]{flex-direction:column;align-items:stretch;gap:0}}.introduction-card[data-v-5764c94a] .security-scheme-label{text-transform:uppercase;font-weight:var(--scalar-semibold)}.introduction-card-row[data-v-5764c94a] .scalar-card:nth-of-type(2) .scalar-card-header{display:none}.introduction-card-row[data-v-5764c94a] .scalar-card:nth-of-type(2) .scalar-card-header.scalar-card--borderless+.scalar-card-content{margin-top:0}.section[data-v-be4443e9]{max-width:var(--refs-content-max-width);scroll-margin-top:var(--refs-viewport-offset);flex-direction:column;margin:auto;padding:90px 0;display:flex;position:relative}.section[data-v-be4443e9]:has(~div.contents){border-bottom:var(--scalar-border-width) solid var(--scalar-border-color)}.references-classic .section[data-v-be4443e9]{gap:24px;padding:48px 0}@container narrow-references-container (width<=900px){.references-classic .section[data-v-be4443e9],.section[data-v-be4443e9]{padding:48px 24px}}.section[data-v-be4443e9]:not(:last-of-type){border-bottom:var(--scalar-border-width) solid var(--scalar-border-color)}.section-wrapper[data-v-ff689b94]{color:var(--scalar-color-1);margin-top:-12px;padding-top:12px}.section-accordion[data-v-ff689b94]{border-radius:var(--scalar-radius-lg);background:var(--scalar-background-2);scroll-margin-top:var(--refs-viewport-offset);flex-direction:column;display:flex}.section-accordion-transparent[data-v-ff689b94]{border:var(--scalar-border-width) solid var(--scalar-border-color);background:0 0}.section-accordion-button[data-v-ff689b94]{cursor:pointer;align-items:center;gap:6px;padding:6px;display:flex}.section-accordion-button-content[data-v-ff689b94]{flex:1;min-width:0}.section-accordion-button-actions[data-v-ff689b94]{color:var(--scalar-color-3);align-items:center;gap:6px;display:flex}.section-accordion-chevron[data-v-ff689b94]{cursor:pointer;opacity:1;color:var(--scalar-color-3);margin-right:4px}.section-accordion-button:hover .section-accordion-chevron[data-v-ff689b94]{color:var(--scalar-color-1)}.section-accordion-content[data-v-ff689b94]{border-top:var(--scalar-border-width) solid var(--scalar-border-color);flex-direction:column;display:flex}.section-accordion-description[data-v-ff689b94]{font-weight:var(--scalar-semibold);font-size:var(--scalar-mini);color:var(--scalar-color--1);padding:10px 12px 0}.section-accordion-content-card[data-v-ff689b94] .property:last-of-type{padding-bottom:9px}.section-column[data-v-699c28e3]{flex:1;min-width:0}@container narrow-references-container (width<=900px){.section-column[data-v-699c28e3]:nth-of-type(2){padding-top:0}}.section-columns[data-v-8b9602bf]{gap:48px;display:flex}@container narrow-references-container (width<=900px){.section-columns[data-v-8b9602bf]{flex-direction:column;gap:24px}}.section-container[data-v-20a1472a]{border-top:var(--scalar-border-width) solid var(--scalar-border-color);width:100%;padding:0 60px;position:relative}.section-container[data-v-20a1472a]:has(.introduction-section){border-top:none}@container narrow-references-container (width<=900px){.section-container[data-v-20a1472a]{padding:0}}.section-accordion-wrapper[data-v-9419dd23]{padding:0 60px}.section-accordion[data-v-9419dd23]{width:100%;max-width:var(--refs-content-max-width);margin:auto;position:relative}.section-accordion-content[data-v-9419dd23]{flex-direction:column;gap:12px;padding-top:12px;display:flex}.section-accordion-button[data-v-9419dd23]{cursor:pointer;border-radius:var(--scalar-radius);width:100%;margin:-6px 0;padding:6px 0;display:flex}.section-accordion-chevron[data-v-9419dd23]{color:var(--scalar-color-3);position:absolute;top:12px;left:-22px}.section-accordion-button:hover .section-accordion-chevron[data-v-9419dd23]{color:var(--scalar-color-1)}.section-accordion-title[data-v-9419dd23]{flex-direction:column;flex:1;align-items:flex-start;padding:0 6px;display:flex}.section-accordion-title[data-v-9419dd23] .section-header-wrapper{grid-template-columns:1fr}.section-accordion-title[data-v-9419dd23] .section-header{margin-bottom:0}@container narrow-references-container (width<=900px){.section-accordion-chevron[data-v-9419dd23]{width:16px;top:14px;left:-16px}.section-accordion-wrapper[data-v-9419dd23]{padding:calc(var(--refs-viewport-offset)) 24px 0 24px}}.loading[data-v-8e0226d7]{background:var(--scalar-background-3);border-radius:var(--scalar-radius-lg);max-width:100%;min-height:1.6em;margin:.6em 0;animation:1.5s infinite alternate loading-skeleton-8e0226d7}.loading[data-v-8e0226d7]:first-of-type{min-height:3em;margin-top:0;margin-bottom:24px}.loading[data-v-8e0226d7]:last-of-type{width:60%}.loading.single-line[data-v-8e0226d7]{max-width:80%;min-height:3em;margin:.6em 0}@keyframes loading-skeleton-8e0226d7{0%{opacity:1}to{opacity:.33}}@container narrow-references-container (width<=900px){.section-content--with-columns[data-v-9735459e]{flex-direction:column;gap:24px}}.section-header-wrapper[data-v-8a5913a9]{grid-template-columns:1fr;display:grid}@media (width>=1200px){.section-header-wrapper[data-v-8a5913a9]{grid-template-columns:repeat(2,1fr)}}.section-header[data-v-8a5913a9]{font-size:var(--font-size,var(--scalar-heading-1));font-weight:var(--font-weight,var(--scalar-bold));color:var(--scalar-color-1);word-wrap:break-word;margin-top:0;line-height:1.45}.section-header.tight[data-v-8a5913a9]{margin-bottom:6px}.section-header.loading[data-v-8a5913a9]{width:80%}.section-header-label[data-v-f1ac6c38]{display:inline}.screenreader-only[data-v-df2e1026]{clip:rect(0, 0, 0, 0);border:0;width:1px;height:1px;margin:-1px;padding:0;position:absolute;overflow:hidden}.collapsible-section[data-v-999a158a]{border-top:var(--scalar-border-width) solid var(--scalar-border-color);position:relative}.collapsible-section-header[data-v-999a158a]{color:var(--scalar-color-1)}.collapsible-section .collapsible-section-trigger[data-v-999a158a]{cursor:pointer;font-size:var(--scalar-font-size-3);z-index:1;align-items:center;padding:10px 0;display:flex;position:relative}.collapsible-section-trigger svg[data-v-999a158a]{color:var(--scalar-color-3);position:absolute;left:-19px}.collapsible-section:hover .collapsible-section-trigger svg[data-v-999a158a]{color:var(--scalar-color-1)}.collapsible-section .collapsible-section-trigger[data-v-999a158a] .anchor-copy{line-height:18.5px}.collapsible-section-content[data-v-999a158a]{margin:0 0 10px;padding:0;scroll-margin-top:140px}.references-classic .introduction-description[data-v-0370764f] img{max-width:720px}.icons-only[data-v-b59b0acf] span{display:none}.sticky-cards[data-v-6c24d687]{top:calc(var(--refs-viewport-offset) + 24px);flex-direction:column;display:flex;position:sticky}.introduction-card-item[data-v-dfab866f]{flex-direction:column;justify-content:flex-start;display:flex}.introduction-card-item[data-v-dfab866f]:empty{display:none}.introduction-card-item[data-v-dfab866f]:has(.description) .server-form-container{border-bottom-right-radius:0;border-bottom-left-radius:0}.introduction-card-item[data-v-dfab866f] .request-item{border-bottom:0}.schema-type-icon[data-v-70cb5c13]{color:var(--scalar-color-1);display:none}.schema-type[data-v-70cb5c13]{font-family:var(--scalar-font-code);color:var(--scalar-color-1)}.property-enum-value[data-v-f4b54bdd]{color:var(--scalar-color-3);overflow-wrap:break-word;--decorator-width:1px;--decorator-color:color-mix(in srgb, var(--scalar-background-1), var(--scalar-color-1) 25%);align-items:stretch;line-height:1.5;display:flex;position:relative}.property-enum-value-content[data-v-f4b54bdd]{flex-direction:column;padding:3px 0;display:flex}.property-enum-value-label[data-v-f4b54bdd]{font-family:var(--scalar-font-code);color:var(--scalar-color-1);font-size:var(--scalar-font-size-4);position:relative}.property-enum-value:last-of-type .property-enum-value-label[data-v-f4b54bdd]{padding-bottom:0}.property-enum-value[data-v-f4b54bdd]:before{content:"";width:var(--decorator-width);background-color:var(--decorator-color);margin-right:12px;display:block}.property-enum-value[data-v-f4b54bdd]:last-of-type:before{height:calc(.5lh + 4px)}.property-enum-values:has(.enum-toggle-button) .property-enum-value[data-v-f4b54bdd]:nth-last-child(2):before{height:calc(.5lh + 4px)}.property-enum-value-label[data-v-f4b54bdd]:after{content:"";width:8px;height:var(--decorator-width);background-color:var(--decorator-color);position:absolute;top:.5lh;left:-12px}.property-enum-value[data-v-f4b54bdd]:last-of-type:after{background:var(--scalar-background-1);border-top:var(--scalar-border-width) solid var(--decorator-color);height:50%;bottom:0}.property-enum-value-description[data-v-f4b54bdd]{color:var(--scalar-color-3)}.property-heading:empty+.property-description[data-v-55c01b89]:last-of-type,.property-description[data-v-55c01b89]:first-of-type:last-of-type{margin-top:0}.property-list[data-v-55c01b89]{border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:var(--scalar-radius);margin-top:10px}.property-list .property[data-v-55c01b89]:last-of-type{padding-bottom:10px}.property-enum-values[data-v-55c01b89]{font-size:var(--scalar-font-size-3);margin-top:8px;padding-left:2px;list-style:none}.enum-toggle-button[data-v-55c01b89]:hover{color:var(--scalar-color-1)}.property-enum-property-names[data-v-55c01b89]{font-size:var(--scalar-font-size-4);color:var(--scalar-color-2);margin-top:8px;padding:0 2px;display:inline-block}.property-default[data-v-4da5c70a]{font-size:var(--scalar-mini);flex-direction:column;display:flex;position:relative}.property-default[data-v-4da5c70a]:hover:before{content:"";border-radius:var(--scalar-radius);width:100%;height:20px;position:absolute;top:0;left:0}.property-default:hover .property-default-label span[data-v-4da5c70a]{color:var(--scalar-color-1)}.property-default-label span[data-v-4da5c70a]{color:var(--scalar-color-3);border-bottom:var(--scalar-border-width) dotted currentColor;position:relative}.property-default-value[data-v-4da5c70a]{font-family:var(--scalar-font-code);align-items:center;gap:8px;width:100%;padding:6px;display:flex}.property-default-value span[data-v-4da5c70a]{text-overflow:ellipsis;white-space:nowrap;display:block;overflow:hidden}.property-default-value[data-v-4da5c70a] svg{color:var(--scalar-color-3)}.property-default-value[data-v-4da5c70a]:hover svg{color:var(--scalar-color-1)}.property-default-value[data-v-4da5c70a]{background:var(--scalar-background-2);border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:var(--scalar-radius)}.property-default-value-list[data-v-4da5c70a]{background-color:var(--scalar-background-1);box-shadow:var(--scalar-shadow-1);border-radius:var(--scalar-radius-lg);border:var(--scalar-border-width) solid var(--scalar-border-color);z-index:2;flex-direction:column;gap:3px;min-width:200px;max-width:300px;padding:9px;display:none;position:absolute;top:18px;left:50%;overflow:auto;transform:translate(-50%)}.property-default:hover .property-default-value-list[data-v-4da5c70a],.property-default:focus-within .property-default-value-list[data-v-4da5c70a]{display:flex}.property-detail[data-v-1295f965]{display:inline-flex}.property-detail+.property-detail[data-v-1295f965]:before{content:"·";margin:0 .5ch;display:block}.property-detail-truncate[data-v-1295f965]{overflow:hidden}.property-detail-truncate>.property-detail-value[data-v-1295f965]{text-overflow:ellipsis;white-space:nowrap;overflow:hidden}.property-detail-prefix[data-v-1295f965]{color:var(--scalar-color-2)}code.property-detail-value[data-v-1295f965]{font-family:var(--scalar-font-code);font-size:var(--scalar-font-size-3);color:var(--scalar-color-2);background:color-mix(in srgb, var(--scalar-background-2), var(--scalar-background-1));border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:var(--scalar-radius);padding:0 4px}.property-example[data-v-77f8279d]{font-size:var(--scalar-mini);flex-direction:column;display:flex;position:relative}.property-example[data-v-77f8279d]:hover:before{content:"";border-radius:var(--scalar-radius);width:100%;height:20px;position:absolute;top:0;left:0}.property-example-value[data-v-77f8279d]{font-family:var(--scalar-font-code);align-items:center;gap:8px;width:100%;padding:6px;display:flex}.property-example-value span[data-v-77f8279d]{text-overflow:ellipsis;white-space:nowrap;display:block;overflow:hidden}.property-example-value[data-v-77f8279d] svg{color:var(--scalar-color-3)}.property-example-value[data-v-77f8279d]:hover svg{color:var(--scalar-color-1)}.property-example-value[data-v-77f8279d]{background:var(--scalar-background-2);border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:var(--scalar-radius)}.property-example-value-list[data-v-77f8279d]{background-color:var(--scalar-background-1);box-shadow:var(--scalar-shadow-1);border-radius:var(--scalar-radius-lg);border:var(--scalar-border-width) solid var(--scalar-border-color);z-index:1000;flex-direction:column;gap:3px;min-width:200px;max-width:300px;padding:9px;display:none;position:absolute;top:18px;left:50%;overflow:auto;transform:translate(-50%)}.property-example:hover .property-example-value-list[data-v-77f8279d],.property-example:focus-within .property-example-value-list[data-v-77f8279d]{display:flex}.property-heading[data-v-3264097c]{white-space:nowrap;flex-wrap:wrap;align-items:baseline;row-gap:9px;display:flex}:is(.property-heading[data-v-3264097c]:has(+.children),.property-heading[data-v-3264097c]:has(+.property-rule)){margin-bottom:9px}.property-heading[data-v-3264097c]>*{margin-right:9px}.property-heading[data-v-3264097c]:last-child,.property-heading>.property-detail[data-v-3264097c]:not(:last-of-type){margin-right:0}.property-name[data-v-3264097c]{max-width:100%;font-family:var(--scalar-font-code);font-weight:var(--scalar-bold);font-size:var(--scalar-font-size-4);white-space:normal;overflow-wrap:break-word}.property-additional[data-v-3264097c]{font-family:var(--scalar-font-code)}.property-required[data-v-3264097c],.property-optional[data-v-3264097c]{color:var(--scalar-color-2)}.property-required[data-v-3264097c]{font-size:var(--scalar-mini);color:var(--scalar-color-orange)}.property-read-only[data-v-3264097c]{font-size:var(--scalar-mini);color:var(--scalar-color-blue)}.property-write-only[data-v-3264097c]{font-size:var(--scalar-mini);color:var(--scalar-color-green)}.property-discriminator[data-v-3264097c]{font-size:var(--scalar-mini);color:var(--scalar-color-purple)}.property-detail[data-v-3264097c]{font-size:var(--scalar-mini);color:var(--scalar-color-2);align-items:center;min-width:0;display:flex}.property-const[data-v-3264097c]{color:var(--scalar-color-1)}.deprecated[data-v-3264097c]{text-decoration:line-through}.property[data-v-c8e3c666]{color:var(--scalar-color-1);font-size:var(--scalar-small);flex-direction:column;padding:10px;display:flex;position:relative}.property.property--level-0[data-v-c8e3c666]:has(>.property-rule>.schema-card>.schema-properties.schema-properties-open>ul>li.property){padding-top:0}.property--compact.property--level-0[data-v-c8e3c666],.property--compact.property--level-1[data-v-c8e3c666]{padding:10px 0}.composition-panel .property.property.property.property--level-0[data-v-c8e3c666]{padding:0}.property--compact.property--level-0 .composition-panel .property--compact.property--level-1[data-v-c8e3c666]{padding:8px}.property[data-v-c8e3c666]:has(>.property-rule:first-of-type):not(.property--compact){padding-top:8px;padding-bottom:8px}.property--deprecated[data-v-c8e3c666]{background:repeating-linear-gradient(-45deg, var(--scalar-background-2) 0, var(--scalar-background-2) 2px, transparent 2px, transparent 5px);background-size:100%}.property--deprecated[data-v-c8e3c666]>*{opacity:.75}.property-description[data-v-c8e3c666]{line-height:1.4;font-size:var(--scalar-small);margin-top:6px}.property-description[data-v-c8e3c666]:has(+.property-rule){margin-bottom:9px}[data-v-c8e3c666] .property-description *{color:var(--scalar-color-2)!important}.property[data-v-c8e3c666]:not(:last-of-type){border-bottom:var(--scalar-border-width) solid var(--scalar-border-color)}.property-description+.children[data-v-c8e3c666],.children+.property-rule[data-v-c8e3c666]{margin-top:9px}.children[data-v-c8e3c666]{flex-direction:column;display:flex}.children .property--compact.property--level-1[data-v-c8e3c666]{padding:12px}.property-example-value[data-v-c8e3c666]{all:unset;font-family:var(--scalar-font-code);border-top:var(--scalar-border-width) solid var(--scalar-border-color);padding:6px}.property-rule[data-v-c8e3c666]{border-radius:var(--scalar-radius-lg);flex-direction:column;display:flex}.property--level-2[data-v-c8e3c666] .relative>button{left:-2rem}.property-rule[data-v-c8e3c666] .composition-panel .schema-card--level-1>.schema-properties.schema-properties-open{border-radius:0 0 var(--scalar-radius-lg) var(--scalar-radius-lg)}.property-rule[data-v-c8e3c666] .composition-panel>.schema-card>.schema-card-description{border-left:var(--scalar-border-width) solid var(--scalar-border-color);border-right:var(--scalar-border-width) solid var(--scalar-border-color);padding:10px}.property-rule[data-v-c8e3c666] .composition-panel>.schema-card>.schema-card-description+.schema-properties{margin-top:0}.property-example[data-v-c8e3c666]{background:0 0;border:none;flex-direction:row;gap:8px;display:flex}.property-example-label[data-v-c8e3c666],.property-example-value[data-v-c8e3c666]{padding:3px 0 0}.property-example-value[data-v-c8e3c666]{background:var(--scalar-background-2);border-radius:var(--scalar-radius);border-top:0;padding:3px 4px}.property-name[data-v-c8e3c666]{font-family:var(--scalar-font-code);font-weight:var(--scalar-semibold)}.property-name-additional-properties[data-v-c8e3c666]:before,.property-name-pattern-properties[data-v-c8e3c666]:before{text-transform:uppercase;font-size:var(--scalar-micro);border-radius:var(--scalar-radius);color:var(--scalar-color-1);border:var(--scalar-border-width) solid var(--scalar-border-color);background-color:var(--scalar-background-2);margin-right:4px;padding:2px 4px;display:inline-block}.property-name-pattern-properties[data-v-c8e3c666]:before{content:"regex"}.property-name-additional-properties[data-v-c8e3c666],.property-name-pattern-properties[data-v-c8e3c666]{border:1px dashed var(--scalar-border-color);color:var(--scalar-color-accent);border-radius:var(--scalar-radius);padding:2px;display:inline-block}.error[data-v-c988b726]{background-color:var(--scalar-color-red)}.schema-card[data-v-c988b726]{font-size:var(--scalar-font-size-4);color:var(--scalar-color-1)}.schema-card-title[data-v-c988b726]{height:var(--schema-title-height);color:var(--scalar-color-2);font-weight:var(--scalar-semibold);font-size:var(--scalar-mini);border-bottom:var(--scalar-border-width) solid transparent;align-items:center;gap:4px;padding:6px 8px;display:flex}button.schema-card-title[data-v-c988b726]{cursor:pointer}button.schema-card-title[data-v-c988b726]:hover{color:var(--scalar-color-1)}.schema-card-title-icon--open[data-v-c988b726]{transform:rotate(45deg)}.schema-properties-open>.schema-card-title[data-v-c988b726]{border-bottom:var(--scalar-border-width) solid var(--scalar-border-color);border-bottom-right-radius:0;border-bottom-left-radius:0}.schema-properties-open>.schema-properties[data-v-c988b726]{width:fit-content}.schema-card-description[data-v-c988b726]{color:var(--scalar-color-2)}.schema-card-description+.schema-properties[data-v-c988b726]{width:fit-content;margin-top:8px}.schema-card--level-0:first-of-type>.schema-card-description[data-v-c988b726]:has(+.schema-properties){border-bottom:var(--scalar-border-width) solid var(--scalar-border-color);margin-bottom:-8px;padding-bottom:8px}.schema-card--level-0~.schema-card--level-0>.schema-card-description[data-v-c988b726]:has(+.schema-properties){padding-top:8px}.schema-properties-open.schema-properties[data-v-c988b726],.schema-properties-open>.schema-card--open[data-v-c988b726]{width:100%}.schema-properties[data-v-c988b726]{border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:var(--scalar-radius-lg);flex-direction:column;width:fit-content;display:flex}.schema-properties-name[data-v-c988b726]{width:100%}.schema-properties .schema-properties[data-v-c988b726]{border-radius:13.5px}.schema-properties .schema-properties.schema-properties-open[data-v-c988b726]{border-radius:var(--scalar-radius-lg)}.schema-properties-open[data-v-c988b726]{width:100%}.schema-card--compact[data-v-c988b726]{align-self:flex-start}.schema-card--compact.schema-card--open[data-v-c988b726]{align-self:initial}.schema-card-title--compact[data-v-c988b726]{color:var(--scalar-color-2);border-bottom:none;height:auto;padding:6px 10px 6px 8px}.schema-card-title--compact>.schema-card-title-icon[data-v-c988b726]{margin:0}.schema-card-title--compact>.schema-card-title-icon--open[data-v-c988b726]{transform:rotate(45deg)}.schema-properties-open>.schema-card-title--compact[data-v-c988b726]{position:static}.property--level-0>.schema-properties>.schema-card--level-0>.schema-properties[data-v-c988b726]{border:none}.property--level-0 .schema-card--level-0:not(.schema-card--compact) .property--level-1[data-v-c988b726]{padding:0 0 8px}:not(.composition-panel)>.schema-card--compact.schema-card--level-0>.schema-properties[data-v-c988b726]{border:none}[data-v-c988b726] .schema-card-description p{font-size:var(--scalar-small,var(--scalar-paragraph));color:var(--scalar-color-2);margin-bottom:6px;display:block}.children .schema-card-description[data-v-c988b726]:first-of-type{padding-top:0}.reference-models-anchor[data-v-5aa6b456]{color:var(--scalar-color-1);align-items:center;padding-left:6px;font-size:20px;display:flex}.reference-models-label[data-v-5aa6b456]{font-size:var(--scalar-mini);display:block}.reference-models-label[data-v-5aa6b456] em{font-weight:var(--scalar-bold)}.show-more[data-v-d1c2b649]{appearance:none;border:none;border:var(--scalar-border-width) solid var(--scalar-border-color);color:var(--scalar-color-1);font-weight:var(--scalar-semibold);font-size:var(--scalar-small);border-radius:30px;justify-content:center;align-items:center;gap:6px;margin:auto;padding:8px 12px 8px 16px;display:flex;position:relative;top:-48px}.show-more[data-v-d1c2b649]:hover{background:var(--scalar-background-2);cursor:pointer}.show-more[data-v-d1c2b649]:active{box-shadow:0 0 0 1px var(--scalar-border-color)}@container narrow-references-container (width<=900px){.show-more[data-v-d1c2b649]{top:-24px}}.tag-section[data-v-d4f47ce7]{margin-bottom:48px}.tag-name[data-v-d4f47ce7]{text-transform:capitalize}.tag-description[data-v-d4f47ce7]{text-align:left;padding-bottom:4px}.tag-section-group .tag-group-name[data-v-d4f47ce7]{grid-template-columns:auto 1fr;align-self:stretch;gap:12px}.tag-group-name[data-v-d4f47ce7]:after{content:"";background:var(--scalar-border-color);align-self:center;height:1px;display:block}:is(.tag-group-name[data-v-d4f47ce7]:has(*>:hover),.tag-group-name[data-v-d4f47ce7]:has(:focus-visible)){gap:32px}.tag-section-group .tag-section[data-v-d4f47ce7]{margin-bottom:24px;padding-inline:0}.tag-section-group .tag-section[data-v-d4f47ce7]:last-of-type{margin-bottom:0}.endpoint[data-v-ad8530a6]{white-space:nowrap;cursor:pointer;text-decoration:none;display:flex}.endpoint:hover .endpoint-path[data-v-ad8530a6],.endpoint:focus-visible .endpoint-path[data-v-ad8530a6]{text-decoration:underline}.endpoint .post[data-v-ad8530a6],.endpoint .get[data-v-ad8530a6],.endpoint .delete[data-v-ad8530a6],.endpoint .put[data-v-ad8530a6]{white-space:nowrap}.endpoint-method[data-v-ad8530a6],.endpoint-path[data-v-ad8530a6]{color:var(--scalar-color-1);min-width:62px;line-height:1.55;font-family:var(--scalar-font-code);font-size:var(--scalar-small);cursor:pointer;display:inline-flex}.endpoint-method[data-v-ad8530a6]{text-align:right}.endpoint-path[data-v-ad8530a6]{text-transform:initial;margin-left:12px}.deprecated[data-v-ad8530a6]{text-decoration:line-through}.endpoints-card[data-v-f726f753]{top:calc(var(--refs-viewport-offset) + 24px);font-size:var(--scalar-font-size-3);position:sticky}.endpoints[data-v-f726f753]{background:var(--scalar-background-2);width:100%;padding:10px 12px;overflow:auto}.section-container[data-v-8f1a275c]{border-top:var(--scalar-border-width) solid var(--scalar-border-color)}.section-container[data-v-8f1a275c]:has(.show-more){background-color:color-mix(in srgb, var(--scalar-background-2), transparent)}.operation-path[data-v-ec6c8861]{word-wrap:break-word;font-weight:var(--scalar-semibold);line-break:anywhere;overflow:hidden}.deprecated[data-v-ec6c8861]{text-decoration:line-through}.empty-state[data-v-6aae906d]{text-align:center;font-size:var(--scalar-mini);border-radius:var(--scalar-radius-lg);min-height:56px;color:var(--scalar-color-2);justify-content:center;align-items:center;margin:10px 0 10px 12px;display:flex}.rule-title[data-v-6aae906d]{font-family:var(--scalar-font-code);color:var(--scalar-color-1);border-radius:var(--scalar-radius);margin:12px 0 6px;display:inline-block}.rule[data-v-6aae906d]{border-radius:var(--scalar-radius-lg);margin:0 12px}.rule-items[data-v-6aae906d]{counter-reset:list-number;border-left:1px solid var(--scalar-border-color);flex-direction:column;gap:12px;padding:12px 0;display:flex}.rule-item[data-v-6aae906d]{counter-increment:list-number;border:1px solid var(--scalar-border-color);border-radius:var(--scalar-radius-lg);margin-left:24px;overflow:hidden}.rule-item[data-v-6aae906d]:before{border:1px solid var(--scalar-border-color);content:" ";border-radius:0 0 0 var(--scalar-radius-lg);width:24px;height:6px;color:var(--scalar-color-1);border-top:0;border-right:0;margin-top:6px;display:block;position:absolute;transform:translate(-25px)}.tab[data-v-804dba49]{font-size:var(--scalar-small);font-family:var(--scalar-font);font-weight:var(--scalar-font-normal);color:var(--scalar-color-2);line-height:calc(var(--scalar-small) + 2px);white-space:nowrap;cursor:pointer;text-transform:uppercase;background:0 0;border:none;margin-right:3px;padding:0;line-height:22px;position:relative}.tab[data-v-804dba49]:before{content:"";z-index:0;border-radius:var(--scalar-radius);background:var(--scalar-background-3);opacity:0;width:calc(100% + 12px);height:calc(100% + 4px);position:absolute;top:-2px;left:-6px}.tab[data-v-804dba49]:hover:before,.tab[data-v-804dba49]:focus-visible:before{opacity:1}.tab[data-v-804dba49]:focus-visible:before{outline:1px solid var(--scalar-color-accent)}.tab span[data-v-804dba49]{z-index:1;position:relative}.tab-selected[data-v-804dba49]{color:var(--scalar-color-1);font-weight:var(--scalar-semibold)}.tab-selected[data-v-804dba49]:after{content:"";width:100%;height:1px;left:0;bottom:calc(var(--tab-list-padding-y) * -1);background:currentColor;position:absolute}.tab-list[data-v-fec8fbbb]{--tab-list-padding-y:7px;--tab-list-padding-x:12px;padding:var(--tab-list-padding-y) var(--tab-list-padding-x);flex:1;gap:6px;display:flex;position:relative;overflow:auto}.scalar-card-header.scalar-card-header-tabs[data-v-fec8fbbb]{padding:0}.response-card[data-v-4e56e3cf]{font-size:var(--scalar-font-size-3)}.code-copy[data-v-4e56e3cf]{appearance:none;cursor:pointer;color:var(--scalar-color-3);background:0 0;border:none;outline:none;justify-content:center;align-items:center;margin-right:12px;padding:0;display:flex}.code-copy[data-v-4e56e3cf]:hover{color:var(--scalar-color-1)}.code-copy svg[data-v-4e56e3cf]{width:13px;height:13px}.response-card-footer[data-v-4e56e3cf]{flex-flow:row-reverse wrap;flex-shrink:0;justify-content:start;column-gap:8px;padding:7px 12px;display:flex}.response-example-selector[data-v-4e56e3cf]{flex-shrink:0;margin:-4px}.response-description[data-v-4e56e3cf]{font-weight:var(--scalar-semibold);font-size:var(--scalar-small);color:var(--scalar-color--1);box-sizing:border-box;flex-grow:1}.response-description-markdown[data-v-4e56e3cf]{max-height:3lh}.response-description-markdown[data-v-4e56e3cf] *{margin:0}.schema-type[data-v-4e56e3cf]{font-size:var(--scalar-micro);color:var(--scalar-color-2);font-weight:var(--scalar-semibold);background:var(--scalar-background-3);border-radius:4px;margin-right:4px;padding:2px 4px}.schema-example[data-v-4e56e3cf]{font-size:var(--scalar-micro);color:var(--scalar-color-2);font-weight:var(--scalar-semibold)}.example-response-tab[data-v-4e56e3cf]{margin:6px;display:block}.scalar-card-checkbox[data-v-4e56e3cf]{cursor:pointer;-webkit-user-select:none;user-select:none;min-height:17px;font-size:var(--scalar-small);font-weight:var(--scalar-font-normal);color:var(--scalar-color-2);white-space:nowrap;justify-content:center;align-items:center;gap:6px;width:fit-content;padding:7px 6px;display:flex;position:relative}.scalar-card-checkbox:has(.scalar-card-checkbox-input:focus-visible) .scalar-card-checkbox-checkmark[data-v-4e56e3cf]{outline:1px solid var(--scalar-color-accent)}.scalar-card-checkbox[data-v-4e56e3cf]:hover{color:var(--scalar-color--1)}.scalar-card-checkbox .scalar-card-checkbox-input[data-v-4e56e3cf]{opacity:0;cursor:pointer;width:0;height:0;position:absolute}.scalar-card-checkbox-checkmark[data-v-4e56e3cf]{border-radius:var(--scalar-radius);background-color:#0000;background-color:var(--scalar-background-3);width:16px;height:16px;box-shadow:inset 0 0 0 var(--scalar-border-width) var(--scalar-border-color)}.scalar-card-checkbox[data-v-4e56e3cf]:has(.scalar-card-checkbox-input:checked){color:var(--scalar-color-1);font-weight:var(--scalar-semibold)}.scalar-card-checkbox .scalar-card-checkbox-input:checked~.scalar-card-checkbox-checkmark[data-v-4e56e3cf]{background-color:var(--scalar-button-1);box-shadow:none}.scalar-card-checkbox-checkmark[data-v-4e56e3cf]:after{content:"";display:none;position:absolute}.scalar-card-checkbox .scalar-card-checkbox-input:checked~.scalar-card-checkbox-checkmark[data-v-4e56e3cf]:after{display:block}.scalar-card-checkbox .scalar-card-checkbox-checkmark[data-v-4e56e3cf]:after{border:solid 1px var(--scalar-button-1-color);border-width:0 1.5px 1.5px 0;width:5px;height:9px;top:12.5px;right:11.5px;transform:rotate(45deg)}.headers-card[data-v-ab19704d]{z-index:0;font-size:var(--scalar-font-size-4);color:var(--scalar-color-1);align-self:flex-start;margin-top:12px;margin-bottom:6px;position:relative}.headers-card.headers-card--open[data-v-ab19704d]{align-self:initial}.headers-card-title[data-v-ab19704d]{color:var(--scalar-color-3);font-weight:var(--scalar-semibold);font-size:var(--scalar-micro);border-radius:13.5px;align-items:center;gap:4px;padding:6px 10px;display:flex}button.headers-card-title[data-v-ab19704d]{cursor:pointer}button.headers-card-title[data-v-ab19704d]:hover{color:var(--scalar-color-1)}.headers-card-title-icon--open[data-v-ab19704d]{transform:rotate(45deg)}.headers-properties[data-v-ab19704d]{border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:13.5px;flex-direction:column;width:fit-content;display:flex}.headers-properties-open>.headers-card-title[data-v-ab19704d]{border-bottom:var(--scalar-border-width) solid var(--scalar-border-color);border-bottom-right-radius:0;border-bottom-left-radius:0}.headers-properties-open[data-v-ab19704d]{border-radius:var(--scalar-radius-lg);width:100%}.headers-card .property[data-v-ab19704d]:last-of-type{padding-bottom:10px}.headers-card-title>.headers-card-title-icon[data-v-ab19704d]{width:14px;height:14px;margin:0}.headers-card-title>.headers-card-title-icon--open[data-v-ab19704d]{transform:rotate(45deg)}.parameter-item[data-v-bd50387f]{border-top:var(--scalar-border-width) solid var(--scalar-border-color);flex-direction:column;display:flex;position:relative}.parameter-item:last-of-type .parameter-schema[data-v-bd50387f]{padding-bottom:0}.parameter-item-container[data-v-bd50387f]{padding:0}.parameter-item-headers[data-v-bd50387f]{border:var(--scalar-border-width) solid var(--scalar-border-color)}.parameter-item-name[data-v-bd50387f]{font-weight:var(--scalar-bold);font-size:var(--scalar-font-size-4);font-family:var(--scalar-font-code);color:var(--scalar-color-1);overflow-wrap:break-word;position:relative}.parameter-item-description[data-v-bd50387f],.parameter-item-description-summary[data-v-bd50387f]{font-size:var(--scalar-mini);color:var(--scalar-color-2)}.parameter-item-description-summary.parameter-item-description-summary[data-v-bd50387f]>*{--markdown-line-height:var(--scalar-line-height-5)}.parameter-item-trigger~.parameter-item-container[data-v-bd50387f] .property--level-0>.property-heading .property-detail-value{font-size:var(--scalar-micro)}.parameter-item-required-optional[data-v-bd50387f]{color:var(--scalar-color-2);font-weight:var(--scalar-semibold);margin-right:6px;position:relative}.parameter-item--required[data-v-bd50387f]{text-transform:uppercase;font-size:var(--scalar-micro);font-weight:var(--scalar-semibold);color:var(--scalar-color-orange)}.parameter-item-description[data-v-bd50387f]{font-size:var(--scalar-small);color:var(--scalar-color-2);margin-top:6px;line-height:1.4}.parameter-item-description[data-v-bd50387f] p{font-size:var(--scalar-small);color:var(--scalar-color-2);margin-top:4px}.parameter-schema[data-v-bd50387f]{margin-top:3px;padding-bottom:9px}.parameter-item-trigger[data-v-bd50387f]{line-height:var(--scalar-line-height-5);outline:none;flex-wrap:wrap;align-items:baseline;gap:6px;padding:10px 0;display:flex}.parameter-item-trigger-open[data-v-bd50387f]{padding-bottom:0}.parameter-item-icon[data-v-bd50387f]{color:var(--scalar-color-3);position:absolute;top:.5lh;left:-19px;translate:0 -50%}.parameter-item-trigger:hover .parameter-item-icon[data-v-bd50387f],.parameter-item-trigger:focus-visible .parameter-item-icon[data-v-bd50387f]{color:var(--scalar-color-1)}.parameter-item-trigger:focus-visible .parameter-item-icon[data-v-bd50387f]{outline:1px solid var(--scalar-color-accent);outline-offset:2px;border-radius:var(--scalar-radius)}.request-body[data-v-e475e108]{margin-top:24px}.request-body-header[data-v-e475e108]{border-bottom:var(--scalar-border-width) solid var(--scalar-border-color);flex-flow:wrap;justify-content:space-between;align-items:center;padding-bottom:12px;display:flex}.request-body-title[data-v-e475e108]{font-size:var(--scalar-font-size-2);font-weight:var(--scalar-semibold);color:var(--scalar-color-1);align-items:center;gap:8px;display:flex}.request-body-required[data-v-e475e108]{font-size:var(--scalar-micro);color:var(--scalar-color-orange);border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:16px;height:20px;padding:2px 8px;font-weight:400}.request-body-description[data-v-e475e108]{font-size:var(--scalar-small);width:100%;margin-top:6px}:is(.request-body-header+.request-body-schema[data-v-e475e108]:has(>.schema-card>.schema-card-description),.request-body-header+.request-body-schema[data-v-e475e108]:has(>.schema-card>.schema-properties>*>.property--level-0)){padding-top:8px}.request-body-description[data-v-e475e108] .markdown *{color:var(--scalar-color-2)!important}.callback-sticky-offset[data-v-12fe1373]{top:var(--refs-viewport-offset,0px);z-index:1}.callback-operation-container[data-v-12fe1373] .request-body,.callback-operation-container[data-v-12fe1373] .request-body-description,.callback-operation-container[data-v-12fe1373] .request-body-header{margin-top:0}.callback-operation-container[data-v-12fe1373] .request-body-header{--scalar-font-size-2:var(--scalar-font-size-4);border-bottom:none;border:.5px solid var(--scalar-border-color);border-radius:var(--scalar-radius-lg) var(--scalar-radius-lg) 0 0;background:color-mix(in srgb, var(--scalar-background-2) 50%, transparent);padding:10px}.callback-operation-container[data-v-12fe1373] .request-body-schema>.schema-card>.schema-card-description{padding-inline:8px}.callback-operation-container[data-v-12fe1373] ul li.property.property--level-1{padding:10px}.callback-operation-container[data-v-12fe1373] .request-body-schema{background-color:var(--scalar-background-1);border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:0 0 var(--scalar-radius-lg) var(--scalar-radius-lg);border-top:none;overflow:hidden}.callback-operation-container[data-v-12fe1373] .parameter-list{margin-top:0}.callback-operation-container[data-v-12fe1373] .parameter-list-title{background:color-mix(in srgb, var(--scalar-background-2) 50%, transparent);border-radius:var(--scalar-radius-lg) var(--scalar-radius-lg) 0 0;border:var(--scalar-border-width) solid var(--scalar-border-color);--scalar-font-size-2:var(--scalar-font-size-4);border-bottom:none;margin-bottom:0;padding:10px}.callback-operation-container[data-v-12fe1373] .parameter-list-items{border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:0 0 var(--scalar-radius-lg) var(--scalar-radius-lg)}.callback-operation-container[data-v-12fe1373] .parameter-list-items>li:first-of-type{border-top:none}.callback-operation-container[data-v-12fe1373] .parameter-list-items>li{padding:0 8px}.show-api-client-button[data-v-15e312d9]{appearance:none;white-space:nowrap;border-radius:var(--scalar-radius);font-weight:var(--scalar-semibold);font-size:var(--scalar-small);color:var(--scalar-background-2);line-height:22px;font-family:var(--scalar-font);background:var(--scalar-button-1);cursor:pointer;box-sizing:border-box;outline-offset:2px;border:none;justify-content:center;align-items:center;padding:1px 6px;display:flex;position:relative;box-shadow:inset 0 0 0 1px #0000001a}.show-api-client-button span[data-v-15e312d9],.show-api-client-button svg[data-v-15e312d9]{fill:currentColor;color:var(--scalar-button-1-color);z-index:1}.show-api-client-button[data-v-15e312d9]:hover{background:var(--scalar-button-1-hover)}.show-api-client-button svg[data-v-15e312d9]{margin-right:4px}.operation-title[data-v-8f643b1c]{justify-content:space-between;display:flex}.operation-details[data-v-8f643b1c]{flex-shrink:1;align-items:center;gap:9px;min-width:0;margin-top:0;display:flex}.operation-details[data-v-8f643b1c] .endpoint-anchor .scalar-button svg{width:16px;height:16px}.endpoint-type[data-v-8f643b1c]{z-index:0;width:60px;font-size:var(--scalar-small);text-transform:uppercase;font-weight:var(--scalar-bold);font-family:var(--scalar-font);flex-shrink:0;justify-content:center;align-items:center;gap:6px;padding:6px;display:flex;position:relative}.endpoint-type[data-v-8f643b1c]:after{content:"";z-index:-1;opacity:.15;border-radius:var(--scalar-radius);background:currentColor;position:absolute;inset:0}.endpoint-anchor[data-v-8f643b1c]{flex-shrink:1;align-items:center;min-width:0;display:flex}.endpoint-anchor.label[data-v-8f643b1c]{display:flex}.endpoint-label[data-v-8f643b1c]{min-width:0;color:var(--scalar-color-1);flex-shrink:1;align-items:baseline;gap:9px;display:flex}.endpoint-label-path[data-v-8f643b1c]{font-family:var(--scalar-font-code);font-size:var(--scalar-mini);text-overflow:ellipsis;white-space:nowrap;overflow:hidden}.endpoint-label-path[data-v-8f643b1c] em{color:var(--scalar-color-2)}.endpoint-label-name[data-v-8f643b1c]{color:var(--scalar-color-2);font-size:var(--scalar-small);text-overflow:ellipsis;white-space:nowrap;flex-shrink:1000000000;overflow:hidden}.endpoint-try-hint[data-v-8f643b1c]{flex-shrink:0;padding:2px}.endpoint-copy[data-v-8f643b1c]{color:currentColor}.endpoint-copy[data-v-8f643b1c] svg{stroke-width:2px}.endpoint-content[data-v-8f643b1c]{grid-auto-columns:1fr;grid-auto-flow:row;gap:9px;padding:9px;display:grid}@media (width>=1000px){.endpoint-content[data-v-8f643b1c]{grid-auto-flow:column}}@container (width<=900px){.endpoint-content[data-v-8f643b1c]{grid-template-columns:1fr}}.endpoint-content[data-v-8f643b1c]>*{min-width:0}.operation-details-card[data-v-8f643b1c]{flex-direction:column;gap:12px;min-width:0;display:flex}:is(.operation-details-card-item[data-v-8f643b1c] .parameter-list,.operation-details-card-item[data-v-8f643b1c] .callbacks-list){border:var(--scalar-border-width) solid var(--scalar-border-color);border-radius:var(--scalar-radius-lg);margin-top:0}.operation-details-card-item[data-v-8f643b1c]{flex-direction:column;gap:12px;display:flex}.operation-details-card-item[data-v-8f643b1c] .parameter-list-items{margin-bottom:0}.operation-details-card[data-v-8f643b1c] .parameter-item:last-of-type .parameter-schema{padding-bottom:12px}.operation-details-card[data-v-8f643b1c] .parameter-list .parameter-list{margin-bottom:12px}.operation-details-card[data-v-8f643b1c] .parameter-item{margin:0;padding:0}.operation-details-card[data-v-8f643b1c] .property{margin:0;padding:9px}:is(.operation-details-card[data-v-8f643b1c] .parameter-list-title,.operation-details-card[data-v-8f643b1c] .request-body-title,.operation-details-card[data-v-8f643b1c] .callbacks-title){text-transform:uppercase;font-weight:var(--scalar-bold);font-size:var(--scalar-mini);color:var(--scalar-color-2);margin:0;padding:9px;line-height:1.33}.operation-details-card[data-v-8f643b1c] .callback-list-item-title{padding-left:28px;padding-right:12px}.operation-details-card[data-v-8f643b1c] .callback-list-item-icon{left:6px}.operation-details-card[data-v-8f643b1c] .callback-operation-container{padding-inline:9px;padding-bottom:9px}:is(.operation-details-card[data-v-8f643b1c] .callback-operation-container>.request-body,.operation-details-card[data-v-8f643b1c] .callback-operation-container>.parameter-list){border:none}.operation-details-card[data-v-8f643b1c] .callback-operation-container>.request-body>.request-body-header{border-bottom:var(--scalar-border-width) solid var(--scalar-border-color);padding:0 0 9px}.operation-details-card[data-v-8f643b1c] .request-body-description{border-top:var(--scalar-border-width) solid var(--scalar-border-color);margin-top:0;padding:9px 9px 0}.operation-details-card[data-v-8f643b1c] .request-body{border-radius:var(--scalar-radius-lg);border:var(--scalar-border-width) solid var(--scalar-border-color);margin-top:0}.operation-details-card[data-v-8f643b1c] .request-body .schema-card--level-0>.schema-card-description{padding-inline:9px}.operation-details-card[data-v-8f643b1c] .request-body-header{border-bottom:0;padding-bottom:0}.operation-details-card[data-v-8f643b1c] .contents button{margin-right:9px}.operation-details-card[data-v-8f643b1c] .schema-card--open+.schema-card:not(.schema-card--open){margin-inline:9px;margin-bottom:9px}.operation-details-card[data-v-8f643b1c] .request-body-schema .property--level-0{padding:0}.operation-details-card[data-v-8f643b1c] .selected-content-type{margin-right:9px}.operation-example-card[data-v-8f643b1c]{top:calc(var(--refs-viewport-offset) + 24px);max-height:calc(var(--refs-viewport-height) - 48px);position:sticky}@media (width<=600px){.operation-example-card[data-v-8f643b1c]{max-height:unset;position:static}}.agent-button-container[data-v-78f5377c]{color:var(--scalar-color-1);background:color-mix(in srgb, var(--scalar-background-3), white 15%);cursor:pointer;border-radius:var(--scalar-radius);z-index:2;align-items:center;height:100%;margin-right:4px;padding:1px 6px;display:flex;position:relative}.agent-button-container[data-v-78f5377c]:hover:not(:focus-within){background:color-mix(in srgb, var(--scalar-background-3), white 20%)}.agent-button-container[data-v-78f5377c]:focus-within{border-radius:var(--scalar-radius-lg);height:auto;margin-right:0;position:absolute;inset:2px}.agent-button-container[data-v-78f5377c]:has(.ask-agent-scalar-input-not-empty){border-radius:var(--scalar-radius-lg);height:auto;margin-right:0;position:absolute;inset:2px}.agent-button-container[data-v-78f5377c]:has(.ask-agent-scalar-input:focus-visible){outline-style:solid}.ask-agent-scalar-input[data-v-78f5377c]{opacity:0;border:none;width:0;font-size:0}.agent-button-container:focus-within .ask-agent-scalar-input[data-v-78f5377c]{width:100%;font-size:inherit;opacity:1;outline:none;padding-inline:4px;line-height:20px}.agent-button-container:has(.ask-agent-scalar-input-not-empty) .ask-agent-scalar-input[data-v-78f5377c]{width:100%;font-size:inherit;opacity:1;outline:none;padding-inline:4px;line-height:20px}.ask-agent-scalar-input[data-v-78f5377c]::placeholder{color:var(--scalar-color-2);font-family:inherit}.ask-agent-scalar-input-label[data-v-78f5377c]{color:var(--scalar-color-1);font-weight:var(--scalar-semibold);margin-left:4px}.agent-button-container:focus-within .ask-agent-scalar-input-label[data-v-78f5377c]{display:none}.agent-button-container:has(.ask-agent-scalar-input-not-empty) .ask-agent-scalar-input-label[data-v-78f5377c]{display:none}.ask-agent-scalar-send[data-v-78f5377c]{background:var(--scalar-color-blue);color:#fff;border-radius:var(--scalar-radius);outline-offset:1px;flex-shrink:0;justify-content:center;align-items:center;width:24px;height:24px;display:none}.agent-button-container:has(.ask-agent-scalar-input-not-empty) .ask-agent-scalar-send[data-v-78f5377c]{display:flex}.ask-agent-scalar-send[data-v-78f5377c]:hover{background:color-mix(in srgb, var(--scalar-color-blue), transparent 10%)}.examples[data-v-1f2d95d2]{top:calc(var(--refs-viewport-offset) + 24px);position:sticky}.examples[data-v-1f2d95d2]>*{max-height:calc((var(--refs-viewport-height) - 60px) / 2);position:relative}.examples[data-v-1f2d95d2]>:first-of-type:last-of-type{max-height:calc((var(--refs-viewport-height) - 60px))}@media (width<=600px){.examples[data-v-1f2d95d2]>*{max-height:unset}}.deprecated[data-v-1f2d95d2] *{text-decoration:line-through}.operation-header[data-v-1f2d95d2]{flex-direction:column;justify-content:space-between;align-items:flex-start;gap:4px;margin-bottom:12px;display:flex}@media (width>=600px){.operation-header[data-v-1f2d95d2]{flex-direction:row;align-items:center}}.section-flare[data-v-5cebff7a]{pointer-events:none;position:fixed;top:0;right:0}.narrow-references-container{container:narrow-references-container/inline-size}.ref-search-meta[data-v-9b0e55ef]{background:var(--scalar-background-1);border-bottom-left-radius:var(--scalar-radius-lg);border-bottom-right-radius:var(--scalar-radius-lg);font-size:var(--scalar-font-size-4);color:var(--scalar-color-3);font-weight:var(--scalar-semibold);border-top:var(--scalar-border-width) solid var(--scalar-border-color);gap:12px;padding:6px 12px;display:flex}:root{--scalar-loaded-api-reference:true}@layer scalar-config{.scalar-api-reference[data-v-e26e2526]{--refs-header-height:calc(var(--scalar-custom-header-height,0px) + var(--scalar-header-height,0px));--refs-viewport-offset:calc(var(--refs-header-height,0px) + var(--refs-content-offset,0px));--refs-viewport-height:calc(var(--full-height,100dvh) - var(--refs-viewport-offset,0px));--refs-sidebar-width:var(--scalar-sidebar-width,0px);--refs-sidebar-height:calc(var(--full-height,100dvh) - var(--refs-header-height,0px));--refs-content-max-width:var(--scalar-content-max-width,1540px)}.scalar-api-reference.references-classic[data-v-e26e2526]{--refs-content-max-width:var(--scalar-content-max-width,1420px);--refs-sidebar-width:0;min-height:100dvh}.references-sidebar[data-v-e26e2526]{--refs-sidebar-width:var(--scalar-sidebar-width,288px)}}.t-doc__sidebar[data-v-e26e2526]{z-index:10}.references-layout[data-v-e26e2526]{--full-height:100dvh;grid-template-rows:var(--scalar-header-height,0px) repeat(2, auto);background:var(--scalar-background-1);flex:1;grid-template-columns:auto 1fr;grid-template-areas:"header header""navigation rendered""footer footer";min-width:100%;max-width:100%;min-height:100dvh;display:grid}.references-editor[data-v-e26e2526]{background:var(--scalar-background-1);grid-area:editor;min-width:0;display:flex}.references-rendered[data-v-e26e2526]{background:var(--scalar-background-1);grid-area:rendered;min-width:0;position:relative}.scalar-api-reference.references-classic[data-v-e26e2526],.references-classic .references-rendered[data-v-e26e2526]{height:initial!important;max-height:initial!important}.references-footer[data-v-e26e2526]{grid-area:footer}@media (width<=1000px){.references-developer-tools[data-v-e26e2526]{display:none}.references-layout[data-v-e26e2526]{--refs-sidebar-height:calc(var(--full-height,100dvh) - var(--scalar-custom-header-height,0px));grid-template-columns:100%;grid-template-rows:var(--scalar-header-height,0px) 0px auto auto;grid-template-areas:"header""navigation""rendered""footer"}.references-editable[data-v-e26e2526]{grid-template-areas:"header""navigation""editor"}.references-rendered[data-v-e26e2526]{position:static}.scalar-api-references-standalone-mobile[data-v-e26e2526]:not(.references-classic){--scalar-header-height:50px}}.darklight-reference[data-v-e26e2526]{width:100%;margin-top:auto}/*$vite$:1*/`)),document.head.appendChild(e)}}catch(e){console.error(`vite-plugin-css-injected-by-js`,e)}})();
-(function(e,t){typeof exports==`object`&&typeof module<`u`?t(require(`radix-vue/namespaced`)):typeof define==`function`&&define.amd?define([`radix-vue/namespaced`],t):(e=typeof globalThis<`u`?globalThis:e||self,t(e[`{}`]))})(this,function(e){var t=Object.create,n=Object.defineProperty,r=Object.getOwnPropertyDescriptor,i=Object.getOwnPropertyNames,a=Object.getPrototypeOf,o=Object.prototype.hasOwnProperty,s=(e,t)=>()=>(e&&(t=e(e=0)),t),c=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports),l=(e,t)=>{let r={};for(var i in e)n(r,i,{get:e[i],enumerable:!0});return t||n(r,Symbol.toStringTag,{value:`Module`}),r},u=(e,t,a,s)=>{if(t&&typeof t==`object`||typeof t==`function`)for(var c=i(t),l=0,u=c.length,d;l<u;l++)d=c[l],!o.call(e,d)&&d!==a&&n(e,d,{get:(e=>t[e]).bind(null,d),enumerable:!(s=r(t,d))||s.enumerable});return e},d=(e,r,i)=>(i=e==null?{}:t(a(e)),u(r||!e||!e.__esModule?n(i,`default`,{value:e,enumerable:!0}):i,e)),f,p=s((()=>{f=e=>{if(typeof e!=`object`||!e)return!1;let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}})),m,h=s((()=>{p(),m=(e,t)=>{if(!e)return!1;if(e.type===`any`||e.type===`unknown`)return!0;if(e.type===`function`)return typeof t==`function`;if(e.type===`number`)return typeof t==`number`&&!Number.isNaN(t)&&Number.isFinite(t);if(e.type===`string`)return typeof t==`string`;if(e.type===`boolean`)return typeof t==`boolean`;if(e.type===`nullable`)return t===null;if(e.type===`notDefined`)return t===void 0;if(e.type===`array`)return Array.isArray(t)&&t.every(t=>m(e.items,t));if(e.type===`record`)return f(t)?Object.keys(t).every(n=>m(e.key,n)&&m(e.value,t[n])):!1;if(e.type===`object`)return f(t)?Object.keys(e.properties).every(n=>m(e.properties[n],t[n])):!1;if(e.type===`optional`)return t===void 0||m(e.schema,t);if(e.type===`union`)return e.schemas.some(e=>m(e,t));if(e.type===`intersection`)return e.schemas.length===0?!0:f(t)?e.schemas.every(e=>m(e,t)):!1;if(e.type===`literal`)return t===e.value;if(e.type===`lazy`)return m(e.schema(),t);if(e.type===`evaluate`)return m(e.schema,e.expression(t));let n=e;return console.warn(`Unknown schema type:`,n),!1}})),g,_,v,y=s((()=>{p(),h(),g=e=>e.type===`optional`?g(e.schema):e.type===`literal`?!0:e.type===`union`?e.schemas.length>0&&e.schemas.every(g):!1,_=(e,t)=>e.type===`object`?f(t)?Object.keys(e.properties).reduce((n,r)=>{if(!(r in t))return n;let i=e.properties[r],a=t[r],o=_(i,a);return g(i)?n+(o>0?o*10:0):n+(o>0?o:1)},0):0:e.type===`array`?Array.isArray(t)?1:0:e.type===`record`?f(t)?1:0:e.type===`optional`?t===void 0?1:_(e.schema,t):e.type===`union`?Math.max(...e.schemas.map(e=>_(e,t))):e.type===`intersection`?e.schemas.length===0?1:e.schemas.reduce((e,n)=>e+_(n,t),0):e.type===`lazy`?_(e.schema(),t):e.type===`evaluate`?_(e.schema,e.expression(t)):m(e,t)?1:0,v=(e,t,n=new WeakMap)=>{if(f(t)&&n.get(t)?.has(e))return t;if(f(t)){let r=n.get(t)||new Set;r.add(e),n.set(t,r)}if(!e||e.type===`any`||e.type===`unknown`)return t;if(e.type===`function`)return typeof t==`function`?t:(()=>void 0);if(e.type===`number`)return m(e,t)?t:e.default??0;if(e.type===`string`)return m(e,t)?t:e.default??``;if(e.type===`boolean`)return m(e,t)?t:e.default??!1;if(e.type===`nullable`)return null;if(e.type===`notDefined`)return;if(e.type===`optional`)return t===void 0?void 0:v(e.schema,t,n);if(e.type===`array`)return Array.isArray(t)?t.map(t=>v(e.items,t,n)):[];if(e.type===`record`)return f(t)?Object.fromEntries(Object.entries(t).map(([t,r])=>[t,v(e.value,r,n)])):{};if(e.type===`object`){let r=Object.keys(e.properties),i=f(t)?t:null,a=[];for(let t of r){let r=e.properties[t],o=i?.[t];r.type===`optional`&&o===void 0||a.push([t,v(r,o,n)])}return Object.fromEntries(a)}if(e.type===`union`)return v(e.schemas.reduce((e,n)=>{let r=_(n,t);return r>e.score?{schema:n,score:r}:e},{schema:e.schemas[0],score:0}).schema,t,n);if(e.type===`intersection`)return e.schemas.reduce((e,r)=>Object.assign(e,v(r,t,n)),{});if(e.type===`literal`)return e.value;if(e.type===`lazy`)return v(e.schema(),t,n);if(e.type===`evaluate`)return v(e.schema,e.expression(t),n);let r=e;return console.warn(`Unknown schema type:`,r),t}})),b,x,S,C,w,ee,te,ne,re,T,ie,ae,E,D,oe,se,ce=s((()=>{b=e=>({type:`number`,default:e?.default,typeName:e?.typeName,typeComment:e?.typeComment}),x=e=>({type:`string`,default:e?.default,typeName:e?.typeName,typeComment:e?.typeComment}),S=e=>({type:`boolean`,default:e?.default,typeName:e?.typeName,typeComment:e?.typeComment}),C=e=>({type:`nullable`,typeName:e?.typeName,typeComment:e?.typeComment}),w=e=>({type:`any`,typeName:e?.typeName,typeComment:e?.typeComment}),ee=e=>({type:`unknown`,typeName:e?.typeName,typeComment:e?.typeComment}),te=e=>({type:`function`,typeName:e?.typeName,typeComment:e?.typeComment}),ne=(e,t)=>({type:`array`,items:e,typeName:t?.typeName,typeComment:t?.typeComment}),re=(e,t,n)=>({type:`record`,key:e,value:t,typeName:n?.typeName,typeComment:n?.typeComment}),T=(e,t)=>({type:`object`,properties:e,typeName:t?.typeName,typeComment:t?.typeComment}),ie=(e,t)=>({type:`union`,schemas:e,typeName:t?.typeName,typeComment:t?.typeComment}),ae=(e,t)=>({type:`intersection`,schemas:e,typeName:t?.typeName,typeComment:t?.typeComment}),E=(e,t)=>({type:`optional`,schema:e,typeName:t?.typeName,typeComment:t?.typeComment}),D=e=>({type:`literal`,value:e}),oe=e=>({type:`lazy`,schema:e}),se=(e,t)=>({type:`evaluate`,expression:e,schema:t})})),le=s((()=>{y(),ce(),h()})),ue,de,fe=s((()=>{le(),T({name:x({typeComment:"Name of specification extension property. Has to start with `x-`."}),component:ee({typeComment:`Vue component to render the specification extension`}),renderer:E(ee({typeComment:`Custom renderer to render the specification extension`}))}),ue=T({component:ee({typeComment:`Vue component to render in the view`}),renderer:E(ee({typeComment:`Custom renderer to render the view component (e.g., ReactRenderer)`})),props:E(re(x(),w()),{typeComment:`Additional props to pass to the component`})}),T({"content.end":E(ne(ue),{typeComment:`Components to render at specific views in the API Reference`})}),T({onInit:E(te()),onConfigChange:E(te()),onDestroy:E(te())}),de=te()})),pe,me,he=s((()=>{le(),pe=T({dashboardUrl:x({default:`https://dashboard.scalar.com`}),registryUrl:x({default:`https://registry.scalar.com`}),proxyUrl:x({default:`https://proxy.scalar.com`}),apiBaseUrl:x({default:`https://api.scalar.com`})},{typeComment:`External service URLs used by Scalar packages`}),me=T({title:E(x(),{typeComment:`The title of the OpenAPI document.`}),slug:E(x(),{typeComment:`The slug of the OpenAPI document used in the URL. If none is passed, the title will be used. If no title is used, it will just use the index.`}),authentication:E(w(),{typeComment:`Prefill authentication`}),baseServerURL:E(x(),{typeComment:`Base URL for the API server`}),hideClientButton:S({default:!1,typeComment:`Whether to hide the client button`}),proxyUrl:E(x(),{typeComment:`URL to a request proxy for the API client`}),oauth2RedirectUri:E(x(),{typeComment:`Default OAuth 2.0 redirect URI used to prefill auth flows in the API client.`}),searchHotKey:E(ie([D(`a`),D(`b`),D(`c`),D(`d`),D(`e`),D(`f`),D(`g`),D(`h`),D(`i`),D(`j`),D(`k`),D(`l`),D(`m`),D(`n`),D(`o`),D(`p`),D(`q`),D(`r`),D(`s`),D(`t`),D(`u`),D(`v`),D(`w`),D(`x`),D(`y`),D(`z`)]),{typeComment:`Key used with CTRL/CMD to open the search modal (defaults to 'k' e.g. CMD+k)`}),servers:E(ne(w()),{typeComment:`List of OpenAPI server objects`}),showSidebar:S({default:!0,typeComment:`Whether to show the sidebar`}),showDeveloperTools:ie([D(`localhost`),D(`always`),D(`never`)],{typeComment:`Whether and when to show the developer tools.`}),showToolbar:ie([D(`localhost`),D(`always`),D(`never`)],{typeComment:`@deprecated Use showDeveloperTools instead`}),operationTitleSource:ie([D(`summary`),D(`path`)],{typeComment:`Whether to use the operation summary or the operation path for the sidebar and search`}),theme:ie([D(`default`),D(`alternate`),D(`moon`),D(`purple`),D(`solarized`),D(`bluePlanet`),D(`deepSpace`),D(`saturn`),D(`kepler`),D(`elysiajs`),D(`fastify`),D(`mars`),D(`laserwave`),D(`none`)],{typeComment:`A string to use one of the color presets`}),_integration:E(ie([D(`adonisjs`),D(`astro`),D(`docusaurus`),D(`dotnet`),D(`elysiajs`),D(`express`),D(`fastapi`),D(`fastify`),D(`go`),D(`hono`),D(`html`),D(`laravel`),D(`litestar`),D(`nestjs`),D(`nextjs`),D(`nitro`),D(`nuxt`),D(`platformatic`),D(`react`),D(`rust`),D(`svelte`),D(`vue`),C()]),{typeComment:`Integration type identifier`}),onRequestSent:E(te(),{typeComment:`onRequestSent is fired when a request is sent`}),persistAuth:S({default:!1,typeComment:`Whether to persist auth to local storage`}),telemetry:S({default:!0,typeComment:`Enables / disables telemetry`}),externalUrls:pe})})),ge,_e,ve=s((()=>{le(),ge=ie([x(),C(),re(x(),w()),te()]),_e=T({default:S({default:!1}),url:E(x(),{typeComment:`URL to an OpenAPI/Swagger document`}),content:E(ge,{typeComment:`Directly embed the OpenAPI document. Can be a string, object, function returning an object, or null. It is recommended to pass a URL instead of content.`}),title:E(x(),{typeComment:"The title of the OpenAPI document. @deprecated Please move `title` to the top level and remove the `spec` prefix."}),slug:E(x(),{typeComment:"The slug of the OpenAPI document used in the URL. @deprecated Please move `slug` to the top level and remove the `spec` prefix."}),spec:E(T({url:E(x()),content:E(ge)}),{typeComment:"@deprecated Use `url` and `content` on the top level instead."}),agent:E(T({key:E(x()),disabled:E(S()),hideAddApi:E(S(),{typeComment:`When true, hide the control to add more APIs in the agent chat. Only preloaded/registry documents are shown; the public API list is not offered.`})}),{typeComment:`Agent Scalar configuration`})})})),ye,be,xe,Se,Ce=s((()=>{le(),fe(),he(),ve(),ye=ae([me,_e,T({layout:ie([D(`modern`),D(`classic`)],{typeComment:`The layout to use for the references`}),proxy:E(x(),{typeComment:`@deprecated Use proxyUrl instead`}),fetch:E(te(),{typeComment:`Custom fetch function for custom logic. Can be used to add custom headers, handle auth, etc.`}),plugins:E(ne(de),{typeComment:`Plugins for the API reference`}),isEditable:S({default:!1,typeComment:`Allows the user to inject an editor for the spec`}),isLoading:S({default:!1,typeComment:`Controls whether the references show a loading state in the intro`}),hideModels:S({default:!1,typeComment:`Whether to show models in the sidebar, search, and content.`}),documentDownloadType:ie([D(`both`),D(`yaml`),D(`json`),D(`direct`),D(`none`)],{typeComment:"Sets the file type of the document to download, set to `none` to hide the download button"}),hideDownloadButton:E(S(),{typeComment:"@deprecated Use `documentDownloadType: 'none'` instead"}),hideTestRequestButton:S({default:!1,typeComment:`Whether to show the "Test Request" button`}),hideSearch:S({default:!1,typeComment:`Whether to show the sidebar search bar`}),showOperationId:S({default:!1,typeComment:`Whether to show the operationId`}),darkMode:E(S(),{typeComment:`Whether dark mode is on or off initially (light mode)`}),forceDarkModeState:E(ie([D(`dark`),D(`light`)]),{typeComment:`forceDarkModeState makes it always this state no matter what`}),hideDarkModeToggle:S({default:!1,typeComment:`Whether to show the dark mode toggle`}),metaData:E(w(),{typeComment:`If used, passed data will be added to the HTML header. @see https://unhead.unjs.io/usage/composables/use-seo-meta`}),favicon:E(x(),{typeComment:`Path to a favicon image`}),hiddenClients:E(ie([re(x(),ie([S(),ne(x())])),ne(x()),D(!0)]),{typeComment:"List of httpsnippet clients to hide from the clients menu. By default hides Unirest, pass `[]` to show all clients"}),defaultHttpClient:E(T({targetKey:x(),clientKey:x()}),{typeComment:`Determine the HTTP client that is selected by default`}),customCss:E(x(),{typeComment:`Custom CSS to be added to the page`}),onSpecUpdate:E(te(),{typeComment:`onSpecUpdate is fired on spec/swagger content change`}),onServerChange:E(te(),{typeComment:`onServerChange is fired on selected server change`}),onDocumentSelect:E(te(),{typeComment:`onDocumentSelect is fired when the config is selected`}),onLoaded:E(te(),{typeComment:`Callback fired when the reference is fully loaded`}),onBeforeRequest:E(te(),{typeComment:`Fired before the outbound request is built; callback receives a mutable request builder. Experimental API.`}),onShowMore:E(te(),{typeComment:`onShowMore is fired when the user clicks the "Show more" button on the references`}),onSidebarClick:E(te(),{typeComment:`onSidebarClick is fired when the user clicks on a sidebar item`}),pathRouting:E(T({basePath:x()}),{typeComment:`Route using paths instead of hashes, your server MUST support this. @experimental`}),mcp:E(T({name:E(x(),{typeComment:`Display name for the MCP server`}),url:E(x(),{typeComment:`URL of the MCP server`}),disabled:E(S(),{typeComment:`When true, disables the MCP integration`})}),{typeComment:`MCP (Model Context Protocol) configuration. When provided, enables MCP integration with the given name and url.`}),generateHeadingSlug:E(te(),{typeComment:`Customize the heading portion of the hash`}),generateModelSlug:E(te(),{typeComment:`Customize the model portion of the hash`}),generateTagSlug:E(te(),{typeComment:`Customize the tag portion of the hash`}),generateOperationSlug:E(te(),{typeComment:`Customize the operation portion of the hash`}),generateWebhookSlug:E(te(),{typeComment:`Customize the webhook portion of the hash`}),redirect:E(te(),{typeComment:`To handle redirects, pass a function that receives the current path/hash and passes that to history.replaceState`}),withDefaultFonts:S({default:!0,typeComment:`Whether to include default fonts`}),defaultOpenFirstTag:S({default:!0,typeComment:`Whether to expand the first tag in the sidebar when no specific URL target is present`}),defaultOpenAllTags:S({default:!1,typeComment:`Whether to expand all tags by default. Warning: this can cause performance issues on big documents`}),expandAllModelSections:S({default:!1,typeComment:`Whether to expand all models by default. Warning: this can cause performance issues on big documents`}),expandAllResponses:S({default:!1,typeComment:`Whether to expand all responses by default. Warning: this can cause performance issues on big documents`}),tagsSorter:E(ie([D(`alpha`),te()]),{typeComment:`Function to sort tags`}),operationsSorter:E(ie([D(`alpha`),D(`method`),te()]),{typeComment:`Function to sort operations`}),orderSchemaPropertiesBy:ie([D(`alpha`),D(`preserve`)],{typeComment:`Order the schema properties by`}),orderRequiredPropertiesFirst:S({default:!0,typeComment:`Sort the schema properties by required ones first`})})]),be=`https://api.scalar.com/request-proxy`,xe=`https://proxy.scalar.com`,Se=e=>{let t=v(ye,e);return t.hideDownloadButton&&(console.warn(`[DEPRECATED] You're using the deprecated 'hideDownloadButton' attribute. Use 'documentDownloadType: 'none'' instead.`),t.documentDownloadType=`none`),t.spec?.url&&(console.warn(`[DEPRECATED] You're using the deprecated 'spec.url' attribute. Remove the spec prefix and move the 'url' attribute to the top level.`),t.url=t.spec.url,delete t.spec),t.spec?.content&&(console.warn(`[DEPRECATED] You're using the deprecated 'spec.content' attribute. Remove the spec prefix and move the 'content' attribute to the top level.`),t.content=t.spec.content,delete t.spec),t.proxy&&(console.warn(`[DEPRECATED] You're using the deprecated 'proxy' attribute. Use 'proxyUrl' instead.`),t.proxyUrl||=t.proxy,delete t.proxy),t.proxyUrl===be&&(console.warn(`[DEPRECATED] Warning: configuration.proxyUrl points to our old proxy (${be}).`),console.warn(`[DEPRECATED] We are overwriting the value and use the new proxy URL (${xe}) instead.`),console.warn(`[DEPRECATED] Action Required: You should manually update your configuration to use the new URL (${xe}). Read more: https://github.com/scalar/scalar`),t.proxyUrl=xe),t.showToolbar&&t.showToolbar!==`localhost`&&(console.warn(`[DEPRECATED] You're using the deprecated 'showToolbar' attribute. Use 'showDeveloperTools' instead.`),t.showDeveloperTools=t.showToolbar,delete t.showToolbar),t}})),we=s((()=>{le(),T({cdn:x({default:`https://cdn.jsdelivr.net/npm/@scalar/api-reference`}),pageTitle:x({default:`Scalar API Reference`})})})),Te=s((()=>{Ce(),we()}));Te();function Ee(e,t={},n){for(let r in e){let i=e[r],a=n?`${n}:${r}`:r;typeof i==`object`&&i?Ee(i,t,a):typeof i==`function`&&(t[a]=i)}return t}var De=(()=>{if(console.createTask)return console.createTask;let e={run:e=>e()};return()=>e})();function Oe(e,t,n,r){for(let i=n;i<e.length;i+=1)try{let n=r?r.run(()=>e[i](...t)):e[i](...t);if(n instanceof Promise)return n.then(()=>Oe(e,t,i+1,r))}catch(e){return Promise.reject(e)}}function ke(e,t,n){if(e.length>0)return Oe(e,t,0,De(n))}function Ae(e,t,n){if(e.length>0){let r=De(n);return Promise.all(e.map(e=>r.run(()=>e(...t))))}}function je(e,t){for(let n of[...e])n(t)}var Me=class{_hooks;_before;_after;_deprecatedHooks;_deprecatedMessages;constructor(){this._hooks={},this._before=void 0,this._after=void 0,this._deprecatedMessages=void 0,this._deprecatedHooks={},this.hook=this.hook.bind(this),this.callHook=this.callHook.bind(this),this.callHookWith=this.callHookWith.bind(this)}hook(e,t,n={}){if(!e||typeof t!=`function`)return()=>{};let r=e,i;for(;this._deprecatedHooks[e];)i=this._deprecatedHooks[e],e=i.to;if(i&&!n.allowDeprecated){let e=i.message;e||=`${r} hook has been deprecated`+(i.to?`, please use ${i.to}`:``),this._deprecatedMessages||=new Set,this._deprecatedMessages.has(e)||(console.warn(e),this._deprecatedMessages.add(e))}if(!t.name)try{Object.defineProperty(t,`name`,{get:()=>`_`+e.replace(/\W+/g,`_`)+`_hook_cb`,configurable:!0})}catch{}return this._hooks[e]=this._hooks[e]||[],this._hooks[e].push(t),()=>{t&&=(this.removeHook(e,t),void 0)}}hookOnce(e,t){let n,r=(...e)=>(typeof n==`function`&&n(),n=void 0,r=void 0,t(...e));return n=this.hook(e,r),n}removeHook(e,t){let n=this._hooks[e];if(n){let r=n.indexOf(t);r!==-1&&n.splice(r,1),n.length===0&&(this._hooks[e]=void 0)}}deprecateHook(e,t){this._deprecatedHooks[e]=typeof t==`string`?{to:t}:t;let n=this._hooks[e]||[];this._hooks[e]=void 0;for(let t of n)this.hook(e,t)}deprecateHooks(e){for(let t in e)this.deprecateHook(t,e[t])}addHooks(e){let t=Ee(e),n=Object.keys(t).map(e=>this.hook(e,t[e]));return()=>{for(let e of n)e();n.length=0}}removeHooks(e){let t=Ee(e);for(let e in t)this.removeHook(e,t[e])}removeAllHooks(){this._hooks={}}callHook(e,...t){return this.callHookWith(ke,e,t)}callHookParallel(e,...t){return this.callHookWith(Ae,e,t)}callHookWith(e,t,n){let r=this._before||this._after?{name:t,args:n,context:{}}:void 0;this._before&&je(this._before,r);let i=e(this._hooks[t]?[...this._hooks[t]]:[],n,t);return i instanceof Promise?i.finally(()=>{this._after&&r&&je(this._after,r)}):(this._after&&r&&je(this._after,r),i)}beforeEach(e){return this._before=this._before||[],this._before.push(e),()=>{if(this._before!==void 0){let t=this._before.indexOf(e);t!==-1&&this._before.splice(t,1)}}}afterEach(e){return this._after=this._after||[],this._after.push(e),()=>{if(this._after!==void 0){let t=this._after.indexOf(e);t!==-1&&this._after.splice(t,1)}}}};function Ne(){return new Me}var Pe=new Set([`link`,`style`,`script`,`noscript`]),Fe=new Set([`title`,`titleTemplate`,`script`,`style`,`noscript`]),Ie=new Set([`base`,`meta`,`link`,`style`,`script`,`noscript`]),Le=new Set([`title`,`base`,`htmlAttrs`,`bodyAttrs`,`meta`,`link`,`style`,`script`,`noscript`]),Re=new Set([`base`,`title`,`titleTemplate`,`bodyAttrs`,`htmlAttrs`,`templateParams`]),ze=new Set([`key`,`tagPosition`,`tagPriority`,`tagDuplicateStrategy`,`innerHTML`,`textContent`,`processTemplateParams`]),Be=new Set([`templateParams`,`htmlAttrs`,`bodyAttrs`]),Ve=new Set([`theme-color`,`google-site-verification`,`og`,`article`,`book`,`profile`,`twitter`,`author`]),He=[`name`,`property`,`http-equiv`],Ue=new Set([`viewport`,`description`,`keywords`,`robots`]);function We(e){let t=e.split(`:`);return t.length?Ve.has(t[1]):!1}function Ge(e){let{props:t,tag:n}=e;if(Re.has(n))return n;if(n===`link`&&t.rel===`canonical`)return`canonical`;if(n===`link`&&t.rel===`alternate`){let e=t.hreflang||t.type;if(e)return`alternate:${e}`}if(t.charset)return`charset`;if(e.tag===`meta`){for(let r of He)if(t[r]!==void 0){let i=t[r],a=i&&typeof i==`string`&&i.includes(`:`),o=i&&Ue.has(i);return`${n}:${i}${!(a||o)&&e.key?`:key:${e.key}`:``}`}}if(e.key)return`${n}:key:${e.key}`;if(t.id)return`${n}:id:${t.id}`;if(n===`link`&&t.rel===`alternate`)return`alternate:${t.href||``}`;if(Fe.has(n)){let t=e.textContent||e.innerHTML;if(t)return`${n}:content:${t}`}}function Ke(e){return e._h||e._d||e.textContent||e.innerHTML||`${e.tag}:${Object.entries(e.props).map(([e,t])=>`${e}:${String(t)}`).join(`,`)}`}function qe(e,t,n){typeof e==`function`&&(!n||n!==`titleTemplate`&&!(n[0]===`o`&&n[1]===`n`))&&(e=e());let r=t?t(n,e):e;if(Array.isArray(r))return r.map(e=>qe(e,t));if(r?.constructor===Object){let e={};for(let n of Object.keys(r))e[n]=qe(r[n],t,n);return e}return r}function Je(e,t){let n=e===`style`?new Map:new Set;function r(t){if(t==null||t===void 0)return;let r=String(t).trim();if(r)if(e===`style`){let[e,...t]=r.split(`:`).map(e=>e?e.trim():``);e&&t.length&&n.set(e,t.join(`:`))}else r.split(` `).filter(Boolean).forEach(e=>n.add(e))}return typeof t==`string`?e===`style`?t.split(`;`).forEach(r):r(t):Array.isArray(t)?t.forEach(e=>r(e)):t&&typeof t==`object`&&Object.entries(t).forEach(([t,i])=>{i&&i!==`false`&&(e===`style`?n.set(String(t).trim(),String(i)):r(t))}),n}function Ye(e,t){if(e.props=e.props||{},!t)return e;if(e.tag===`templateParams`)return e.props=t,e;let n=Ie.has(e.tag)||e.tag===`htmlAttrs`||e.tag===`bodyAttrs`;return Object.entries(t).forEach(([r,i])=>{if(r===`__proto__`||r===`constructor`||r===`prototype`)return;if(i===null){e.props[r]=null;return}if(r===`class`||r===`style`){e.props[r]=Je(r,i);return}if(ze.has(r)){if((r===`textContent`||r===`innerHTML`)&&typeof i==`object`){let n=t.type;if(t.type||(n=`application/json`),!n?.endsWith(`json`)&&n!==`speculationrules`)return;t.type=n,e.props.type=n,e[r]=JSON.stringify(i)}else e[r]=i;return}let a=r.startsWith(`data-`),o=n&&!a?r.toLowerCase():r,s=String(i),c=e.tag===`meta`&&o===`content`;s===`true`||s===``?e.props[o]=a||c?s:!0:!i&&a&&s===`false`?e.props[o]=`false`:i!==void 0&&(e.props[o]=i)}),e}function eee(e,t){let n=Ye({tag:e,props:{}},typeof t==`object`&&typeof t!=`function`?t:{[e===`script`||e===`noscript`||e===`style`?`innerHTML`:`textContent`]:t});return n.key&&Pe.has(n.tag)&&(n.props[`data-hid`]=n._h=n.key),n.tag===`script`&&typeof n.innerHTML==`object`&&(n.innerHTML=JSON.stringify(n.innerHTML),n.props.type=n.props.type||`application/json`),Array.isArray(n.props.content)?n.props.content.map(e=>({...n,props:{...n.props,content:e}})):n}function Xe(e,t){if(!e)return[];typeof e==`function`&&(e=e());let n=(e,n)=>{for(let r=0;r<t.length;r++)n=t[r](e,n);return n};e=n(void 0,e);let r=[];return e=qe(e,n),Object.entries(e||{}).forEach(([e,t])=>{if(t!==void 0)for(let n of Array.isArray(t)?t:[t])r.push(eee(e,n))}),r.flat()}var Ze=(e,t)=>e._w===t._w?e._p-t._p:e._w-t._w,tee={base:-10,title:10},nee={critical:-8,high:-1,low:2},ree={meta:{"content-security-policy":-30,charset:-20,viewport:-15},link:{preconnect:20,stylesheet:60,preload:70,modulepreload:70,prefetch:90,"dns-prefetch":90,prerender:90},script:{async:30,defer:80,sync:50},style:{imported:40,sync:60}},iee=/@import/,Qe=e=>e===``||e===!0;function aee(e,t){if(typeof t.tagPriority==`number`)return t.tagPriority;let n=100,r=nee[t.tagPriority]||0,i=e.resolvedOptions.disableCapoSorting?{link:{},script:{},style:{}}:ree;if(t.tag in tee)n=tee[t.tag];else if(t.tag===`meta`){let e=t.props[`http-equiv`]===`content-security-policy`?`content-security-policy`:t.props.charset?`charset`:t.props.name===`viewport`?`viewport`:null;e&&(n=ree.meta[e])}else if(t.tag===`link`&&t.props.rel)n=i.link[t.props.rel];else if(t.tag===`script`){let e=String(t.props.type);Qe(t.props.async)?n=i.script.async:t.props.src&&!Qe(t.props.defer)&&!Qe(t.props.async)&&e!==`module`&&!e.endsWith(`json`)||t.innerHTML&&!e.endsWith(`json`)?n=i.script.sync:(Qe(t.props.defer)&&t.props.src&&!Qe(t.props.async)||e===`module`)&&(n=i.script.defer)}else t.tag===`style`&&(n=t.innerHTML&&iee.test(t.innerHTML)?i.style.imported:i.style.sync);return(n||100)+r}function oee(e,t){let n=typeof t==`function`?t(e):t,r=n.key||String(e.plugins.size+1);e.plugins.get(r)||(e.plugins.set(r,n),e.hooks.addHooks(n.hooks||{}))}function see(e={}){let t=Ne();t.addHooks(e.hooks||{});let n=!e.document,r=new Map,i=new Map,a=new Set,o={_entryCount:1,plugins:i,dirty:!1,resolvedOptions:e,hooks:t,ssr:n,entries:r,headEntries(){return[...r.values()]},use:e=>oee(o,e),push(e,i){let s={...i||{}};delete s.head;let c=s._index??o._entryCount++,l={_i:c,input:e,options:s},u={_poll(e=!1){o.dirty=!0,!e&&a.add(c),t.callHook(`entries:updated`,o)},dispose(){r.delete(c)&&o.invalidate()},patch(e){(!s.mode||s.mode===`server`&&n||s.mode===`client`&&!n)&&(l.input=e,r.set(c,l),u._poll())}};return u.patch(e),u},async resolveTags(){let n={tagMap:new Map,tags:[],entries:[...o.entries.values()]};for(await t.callHook(`entries:resolve`,n);a.size;){let n=a.values().next().value;a.delete(n);let i=r.get(n);if(i){let n={tags:Xe(i.input,e.propResolvers||[]).map(e=>Object.assign(e,i.options)),entry:i};await t.callHook(`entries:normalize`,n),i._tags=n.tags.map((e,t)=>(e._w=aee(o,e),e._p=(i._i<<10)+t,e._d=Ge(e),e._d||(e._h=Ke(e)),e))}}let i=!1;n.entries.flatMap(e=>(e._tags||[]).map(e=>({...e,props:{...e.props}}))).sort(Ze).reduce((e,t)=>{let n=t._d||t._h;if(!e.has(n))return e.set(n,t);let r=e.get(n);if((t?.tagDuplicateStrategy||(Be.has(t.tag)?`merge`:null)||(t.key&&t.key===r.key?`merge`:null))===`merge`){let i={...r.props};Object.entries(t.props).forEach(([e,t])=>i[e]=e===`style`?new Map([...r.props.style||new Map,...t]):e===`class`?new Set([...r.props.class||new Set,...t]):t),e.set(n,{...t,props:i})}else t._p>>10==r._p>>10&&t.tag===`meta`&&We(n)?(e.set(n,Object.assign([...Array.isArray(r)?r:[r],t],t)),i=!0):(t._w===r._w?t._p>r._p:t?._w<r?._w)&&e.set(n,t);return e},n.tagMap);let s=n.tagMap.get(`title`),c=n.tagMap.get(`titleTemplate`);if(o._title=s?.textContent,c){let e=c?.textContent;if(o._titleTemplate=e,e){let t=typeof e==`function`?e(s?.textContent):e;typeof t==`string`&&!o.plugins.has(`template-params`)&&(t=t.replace(`%s`,s?.textContent||``)),s?t===null?n.tagMap.delete(`title`):n.tagMap.set(`title`,{...s,textContent:t}):(c.tag=`title`,c.textContent=t)}}n.tags=Array.from(n.tagMap.values()),i&&(n.tags=n.tags.flat().sort(Ze)),await t.callHook(`tags:beforeResolve`,n),await t.callHook(`tags:resolve`,n),await t.callHook(`tags:afterResolve`,n);let l=[];for(let e of n.tags){let{innerHTML:t,tag:n,props:r}=e;Le.has(n)&&(Object.keys(r).length===0&&!e.innerHTML&&!e.textContent||n===`meta`&&!r.content&&!r[`http-equiv`]&&!r.charset||(n===`script`&&t&&(String(r.type).endsWith(`json`)?e.innerHTML=(typeof t==`string`?t:JSON.stringify(t)).replace(/</g,`\\u003C`):typeof t==`string`&&(e.innerHTML=t.replace(RegExp(`</${n}`,`g`),`<\\/${n}`)),e._d=Ge(e)),l.push(e)))}return l},invalidate(){for(let e of r.values())a.add(e._i);o.dirty=!0,t.callHook(`entries:updated`,o)}};return(e?.plugins||[]).forEach(e=>oee(o,e)),o.hooks.callHook(`init`,o),e.init?.forEach(e=>e&&o.push(e)),o}async function cee(e,t={}){let n=t.document||e.resolvedOptions.document;if(!n||!e.dirty)return;let r={shouldRender:!0,tags:[]};if(await e.hooks.callHook(`dom:beforeRender`,r),r.shouldRender)return e._domUpdatePromise||=new Promise(async t=>{let r=new Map,i=new Promise(t=>{e.resolveTags().then(e=>{t(e.map(e=>{let t=r.get(e._d)||0,n={tag:e,id:(t?`${e._d}:${t}`:e._d)||e._h,shouldRender:!0};return e._d&&We(e._d)&&r.set(e._d,t+1),n}))})}),a=e._dom;if(!a){a={title:n.title,elMap:new Map().set(`htmlAttrs`,n.documentElement).set(`bodyAttrs`,n.body)};for(let e of[`body`,`head`]){let t=n[e]?.children;for(let e of t){let t=e.tagName.toLowerCase();if(!Ie.has(t))continue;let n=Ye({tag:t,props:{}},{innerHTML:e.innerHTML,...e.getAttributeNames().reduce((t,n)=>(t[n]=e.getAttribute(n),t),{})||{}});if(n.key=e.getAttribute(`data-hid`)||void 0,n._d=Ge(n)||Ke(n),a.elMap.has(n._d)){let t=1,r=n._d;for(;a.elMap.has(r);)r=`${n._d}:${t++}`;a.elMap.set(r,e)}else a.elMap.set(n._d,e)}}}a.pendingSideEffects={...a.sideEffects},a.sideEffects={};function o(e,t,n){let r=`${e}:${t}`;a.sideEffects[r]=n,delete a.pendingSideEffects[r]}function s({id:e,$el:t,tag:r}){let i=r.tag.endsWith(`Attrs`);a.elMap.set(e,t),i||(r.textContent&&r.textContent!==t.textContent&&(t.textContent=r.textContent),r.innerHTML&&r.innerHTML!==t.innerHTML&&(t.innerHTML=r.innerHTML),o(e,`el`,()=>{t?.remove(),a.elMap.delete(e)}));for(let a in r.props){if(!Object.prototype.hasOwnProperty.call(r.props,a))continue;let s=r.props[a];if(a.startsWith(`on`)&&typeof s==`function`){let e=t?.dataset;if(e&&e[`${a}fired`]){let e=a.slice(0,-5);s.call(t,new Event(e.substring(2)))}t.getAttribute(`data-${a}`)!==``&&((r.tag===`bodyAttrs`?n.defaultView:t).addEventListener(a.substring(2),s.bind(t)),t.setAttribute(`data-${a}`,``));continue}let c=`attr:${a}`;if(a===`class`){if(!s)continue;for(let n of s)i&&o(e,`${c}:${n}`,()=>t.classList.remove(n)),!t.classList.contains(n)&&t.classList.add(n)}else if(a===`style`){if(!s)continue;for(let[n,r]of s)o(e,`${c}:${n}`,()=>{t.style.removeProperty(n)}),t.style.setProperty(n,r)}else s!==!1&&s!==null&&(t.getAttribute(a)!==s&&t.setAttribute(a,s===!0?``:String(s)),i&&o(e,c,()=>t.removeAttribute(a)))}}let c=[],l={bodyClose:void 0,bodyOpen:void 0,head:void 0},u=await i;for(let e of u){let{tag:t,shouldRender:r,id:i}=e;if(r){if(t.tag===`title`){n.title=t.textContent,o(`title`,``,()=>n.title=a.title);continue}e.$el=e.$el||a.elMap.get(i),e.$el?s(e):Ie.has(t.tag)&&c.push(e)}}for(let e of c){let t=e.tag.tagPosition||`head`;e.$el=n.createElement(e.tag.tag),s(e),l[t]=l[t]||n.createDocumentFragment(),l[t].appendChild(e.$el)}for(let t of u)await e.hooks.callHook(`dom:renderTag`,t,n,o);l.head&&n.head.appendChild(l.head),l.bodyOpen&&n.body.insertBefore(l.bodyOpen,n.body.firstChild),l.bodyClose&&n.body.appendChild(l.bodyClose);for(let e in a.pendingSideEffects)a.pendingSideEffects[e]();e._dom=a,await e.hooks.callHook(`dom:rendered`,{renders:u}),t()}).finally(()=>{e._domUpdatePromise=void 0,e.dirty=!1}),e._domUpdatePromise}function lee(e={}){let t=e.domOptions?.render||cee;e.document=e.document||(typeof window<`u`?document:void 0);let n=e.document?.head.querySelector(`script[id="unhead:payload"]`)?.innerHTML||!1;return see({...e,plugins:[...e.plugins||[],{key:`client`,hooks:{"entries:updated":t}}],init:[n?JSON.parse(n):!1,...e.init||[]]})}function uee(e,t){let n=0;return()=>{let r=++n;t(()=>{n===r&&e()})}}var $e={META:new Set([`twitter`]),OG:new Set([`og`,`book`,`article`,`profile`,`fb`]),MEDIA:new Set([`ogImage`,`ogVideo`,`ogAudio`,`twitterImage`]),HTTP_EQUIV:new Set([`contentType`,`defaultStyle`,`xUaCompatible`])},dee={articleExpirationTime:`article:expiration_time`,articleModifiedTime:`article:modified_time`,articlePublishedTime:`article:published_time`,bookReleaseDate:`book:release_date`,fbAppId:`fb:app_id`,ogAudioSecureUrl:`og:audio:secure_url`,ogAudioUrl:`og:audio`,ogImageSecureUrl:`og:image:secure_url`,ogImageUrl:`og:image`,ogSiteName:`og:site_name`,ogVideoSecureUrl:`og:video:secure_url`,ogVideoUrl:`og:video`,profileFirstName:`profile:first_name`,profileLastName:`profile:last_name`,profileUsername:`profile:username`,msapplicationConfig:`msapplication-Config`,msapplicationTileColor:`msapplication-TileColor`,msapplicationTileImage:`msapplication-TileImage`},fee={appleItunesApp:{unpack:{entrySeparator:`, `,resolve:({key:e,value:t})=>`${et(e)}=${t}`}},refresh:{metaKey:`http-equiv`,unpack:{entrySeparator:`;`,resolve:({key:e,value:t})=>e===`seconds`?`${t}`:void 0}},robots:{unpack:{entrySeparator:`, `,resolve:({key:e,value:t})=>typeof t==`boolean`?et(e):`${et(e)}:${t}`}},contentSecurityPolicy:{metaKey:`http-equiv`,unpack:{entrySeparator:`; `,resolve:({key:e,value:t})=>`${et(e)} ${t}`}},charset:{}};function et(e){let t=e.replace(/([A-Z])/g,`-$1`).toLowerCase(),n=t.indexOf(`-`);return n===-1?t:$e.META.has(t.slice(0,n))||$e.OG.has(t.slice(0,n))?e.replace(/([A-Z])/g,`:$1`).toLowerCase():t}function pee(e){return Object.fromEntries(Object.entries(e).filter(([e,t])=>String(t)!==`false`&&e))}function tt(e){return Array.isArray(e)?e.map(tt):!e||typeof e!=`object`?e:Object.fromEntries(Object.entries(e).map(([e,t])=>[et(e),tt(t)]))}function mee(e,t={}){let{entrySeparator:n=``,keyValueSeparator:r=``,wrapValue:i,resolve:a}=t;return Object.entries(e).map(([e,n])=>{if(a){let t=a({key:e,value:n});if(t!==void 0)return t}return`${e}${r}${typeof n==`object`?mee(n,t):typeof n==`number`?n.toString():typeof n==`string`&&i?`${i}${n.replace(new RegExp(i,`g`),`\\${i}`)}${i}`:n}`}).join(n)}function hee(e,t){let n=pee(t),r=et(e),i=gee(r);return Ve.has(r)?nt(Object.fromEntries(Object.entries(n).map(([t,n])=>[`${e}${t===`url`?``:`${t[0].toUpperCase()}${t.slice(1)}`}`,n]))||{}).sort((e,t)=>(e[i]?.length||0)-(t[i]?.length||0)):[{[i]:r,...n}]}function gee(e){if(fee[e]?.metaKey===`http-equiv`||$e.HTTP_EQUIV.has(e))return`http-equiv`;let t=et(e),n=t.indexOf(`:`);return n===-1?`name`:$e.OG.has(t.slice(0,n))?`property`:`name`}function _ee(e){return dee[e]||et(e)}function vee(e,t){return t===`refresh`?`${e.seconds};url=${e.url}`:mee(tt(e),{keyValueSeparator:`=`,entrySeparator:`, `,resolve:({value:e,key:t})=>e===null?``:typeof e==`boolean`?t:void 0,...fee[t]?.unpack})}function nt(e){let t=[],n={};for(let[r,i]of Object.entries(e)){if(Array.isArray(i)){if(r===`themeColor`){i.forEach(e=>{typeof e==`object`&&e&&t.push({name:`theme-color`,...e})});continue}for(let e of i)if(typeof e==`object`&&e){let n=[],i=[];for(let[t,a]of Object.entries(e)){let e=nt({[`${r}${t===`url`?``:`:${t}`}`]:a});(t===`url`?n:i).push(...e)}t.push(...n,...i)}else t.push(...typeof e==`string`?nt({[r]:e}):hee(r,e));continue}if(typeof i==`object`&&i)if($e.MEDIA.has(r)){let e=r.startsWith(`twitter`)?`twitter`:`og`,n=r.replace(/^(og|twitter)/,``).toLowerCase(),a=e===`twitter`?`name`:`property`;i.url&&t.push({[a]:`${e}:${n}`,content:i.url}),i.secureUrl&&t.push({[a]:`${e}:${n}:secure_url`,content:i.secureUrl});for(let[r,o]of Object.entries(i))r!==`url`&&r!==`secureUrl`&&t.push({[a]:`${e}:${n}:${r}`,content:o})}else Ve.has(et(r))?t.push(...hee(r,i)):n[r]=pee(i);else n[r]=i}let r=Object.entries(n).map(([e,t])=>{if(e===`charset`)return{charset:t===null?`_null`:t};let n=gee(e),r=_ee(e),i=t===null?`_null`:typeof t==`object`?vee(t,e):typeof t==`number`?t.toString():t;return n===`http-equiv`?{"http-equiv":r,content:i}:{[n]:r,content:i}});return[...t,...r].map(e=>`content`in e&&e.content===`_null`?{...e,content:null}:e)}function yee(e){return e}var bee=yee({key:`flatMeta`,hooks:{"entries:normalize":e=>{let t=[];e.tags=e.tags.map(e=>e.tag===`_flatMeta`?(t.push(nt(e.props).map(t=>({...e,tag:`meta`,props:t}))),!1):e).filter(Boolean).concat(...t)}}});function xee(e){if(Array.isArray(e))return e.map(xee);if(e&&typeof e==`object`){let t={};for(let n of Object.keys(e))n===`__proto__`||n===`constructor`||n===`prototype`||(t[n]=xee(e[n]));return t}return e}function rt(e){let t=Object.create(null);for(let n of e.split(`,`))t[n]=1;return e=>e in t}function it(e){if(_t(e)){let t={};for(let n=0;n<e.length;n++){let r=e[n],i=St(r)?See(r):it(r);if(i)for(let e in i)t[e]=i[e]}return t}else if(St(e)||wt(e))return e}function See(e){let t={};return e.replace(Pee,``).split(Mee).forEach(e=>{if(e){let n=e.split(Nee);n.length>1&&(t[n[0].trim()]=n[1].trim())}}),t}function O(e){let t=``;if(St(e))t=e;else if(_t(e))for(let n=0;n<e.length;n++){let r=O(e[n]);r&&(t+=r+` `)}else if(wt(e))for(let n in e)e[n]&&(t+=n+` `);return t.trim()}function at(e){if(!e)return null;let{class:t,style:n}=e;return t&&!St(t)&&(e.class=O(t)),n&&(e.style=it(n)),e}function Cee(e){return!!e||e===``}function wee(e,t){if(e.length!==t.length)return!1;let n=!0;for(let r=0;n&&r<e.length;r++)n=ot(e[r],t[r]);return n}function ot(e,t){if(e===t)return!0;let n=bt(e),r=bt(t);if(n||r)return n&&r?e.getTime()===t.getTime():!1;if(n=Ct(e),r=Ct(t),n||r)return e===t;if(n=_t(e),r=_t(t),n||r)return n&&r?wee(e,t):!1;if(n=wt(e),r=wt(t),n||r){if(!n||!r||Object.keys(e).length!==Object.keys(t).length)return!1;for(let n in e){let r=e.hasOwnProperty(n),i=t.hasOwnProperty(n);if(r&&!i||!r&&i||!ot(e[n],t[n]))return!1}}return String(e)===String(t)}function st(e,t){return e.findIndex(e=>ot(e,t))}function Tee(e){return e==null?`initial`:typeof e==`string`?e===``?` `:e:String(e)}var ct,lt,ut,dt,ft,pt,mt,ht,Eee,gt,_t,vt,yt,bt,xt,St,Ct,wt,Tt,Et,Dt,Dee,Ot,kt,At,jt,Oee,Mt,kee,Nt,Pt,Ft,It,Lt,Rt,zt,Aee,jee,Bt,Mee,Nee,Pee,Vt,Fee,Ht,k,Ut,Wt,Gt=s((()=>{ct={},lt=[],ut=()=>{},dt=()=>!1,ft=e=>e.charCodeAt(0)===111&&e.charCodeAt(1)===110&&(e.charCodeAt(2)>122||e.charCodeAt(2)<97),pt=e=>e.startsWith(`onUpdate:`),mt=Object.assign,ht=(e,t)=>{let n=e.indexOf(t);n>-1&&e.splice(n,1)},Eee=Object.prototype.hasOwnProperty,gt=(e,t)=>Eee.call(e,t),_t=Array.isArray,vt=e=>Dt(e)===`[object Map]`,yt=e=>Dt(e)===`[object Set]`,bt=e=>Dt(e)===`[object Date]`,xt=e=>typeof e==`function`,St=e=>typeof e==`string`,Ct=e=>typeof e==`symbol`,wt=e=>typeof e==`object`&&!!e,Tt=e=>(wt(e)||xt(e))&&xt(e.then)&&xt(e.catch),Et=Object.prototype.toString,Dt=e=>Et.call(e),Dee=e=>Dt(e).slice(8,-1),Ot=e=>Dt(e)===`[object Object]`,kt=e=>St(e)&&e!==`NaN`&&e[0]!==`-`&&``+parseInt(e,10)===e,At=rt(`,key,ref,ref_for,ref_key,onVnodeBeforeMount,onVnodeMounted,onVnodeBeforeUpdate,onVnodeUpdated,onVnodeBeforeUnmount,onVnodeUnmounted`),jt=e=>{let t=Object.create(null);return(n=>t[n]||(t[n]=e(n)))},Oee=/-\w/g,Mt=jt(e=>e.replace(Oee,e=>e.slice(1).toUpperCase())),kee=/\B([A-Z])/g,Nt=jt(e=>e.replace(kee,`-$1`).toLowerCase()),Pt=jt(e=>e.charAt(0).toUpperCase()+e.slice(1)),Ft=jt(e=>e?`on${Pt(e)}`:``),It=(e,t)=>!Object.is(e,t),Lt=(e,...t)=>{for(let n=0;n<e.length;n++)e[n](...t)},Rt=(e,t,n,r=!1)=>{Object.defineProperty(e,t,{configurable:!0,enumerable:!1,writable:r,value:n})},zt=e=>{let t=parseFloat(e);return isNaN(t)?e:t},Aee=e=>{let t=St(e)?Number(e):NaN;return isNaN(t)?e:t},Bt=()=>jee||=typeof globalThis<`u`?globalThis:typeof self<`u`?self:typeof window<`u`?window:typeof global<`u`?global:{},Mee=/;(?![^(]*\))/g,Nee=/:([^]+)/,Pee=/\/\*[^]*?\*\//g,Vt=`itemscope,allowfullscreen,formnovalidate,ismap,nomodule,novalidate,readonly`,Fee=rt(Vt),rt(Vt+`,async,autofocus,autoplay,controls,default,defer,disabled,hidden,inert,loop,open,required,reversed,scoped,seamless,checked,muted,multiple,selected`),Ht=e=>!!(e&&e.__v_isRef===!0),k=e=>St(e)?e:e==null?``:_t(e)||wt(e)&&(e.toString===Et||!xt(e.toString))?Ht(e)?k(e.value):JSON.stringify(e,Ut,2):String(e),Ut=(e,t)=>Ht(t)?Ut(e,t.value):vt(t)?{[`Map(${t.size})`]:[...t.entries()].reduce((e,[t,n],r)=>(e[Wt(t,r)+` =>`]=n,e),{})}:yt(t)?{[`Set(${t.size})`]:[...t.values()].map(e=>Wt(e))}:Ct(t)?Wt(t):wt(t)&&!_t(t)&&!Ot(t)?String(t):t,Wt=(e,t=``)=>Ct(e)?`Symbol(${e.description??t})`:e}));function Kt(){return En}function qt(e,t=!1){En&&En.cleanups.push(e)}function Iee(e,t=!1){if(e.flags|=8,t){e.next=Mn,Mn=e;return}e.next=jn,jn=e}function Jt(){An++}function Yt(){if(--An>0)return;if(Mn){let e=Mn;for(Mn=void 0;e;){let t=e.next;e.next=void 0,e.flags&=-9,e=t}}let e;for(;jn;){let t=jn;for(jn=void 0;t;){let n=t.next;if(t.next=void 0,t.flags&=-9,t.flags&1)try{t.trigger()}catch(t){e||=t}t=n}}if(e)throw e}function Lee(e){for(let t=e.deps;t;t=t.nextDep)t.version=-1,t.prevActiveLink=t.dep.activeLink,t.dep.activeLink=t}function Ree(e){let t,n=e.depsTail,r=n;for(;r;){let e=r.prevDep;r.version===-1?(r===n&&(n=e),Zt(r),Bee(r)):t=r,r.dep.activeLink=r.prevActiveLink,r.prevActiveLink=void 0,r=e}e.deps=t,e.depsTail=n}function Xt(e){for(let t=e.deps;t;t=t.nextDep)if(t.dep.version!==t.version||t.dep.computed&&(zee(t.dep.computed)||t.dep.version!==t.version))return!0;return!!e._dirty}function zee(e){if(e.flags&4&&!(e.flags&16)||(e.flags&=-17,e.globalVersion===Fn)||(e.globalVersion=Fn,!e.isSSR&&e.flags&128&&(!e.deps&&!e._dirty||!Xt(e))))return;e.flags|=2;let t=e.dep,n=Dn,r=Nn;Dn=e,Nn=!0;try{Lee(e);let n=e.fn(e._value);(t.version===0||It(n,e._value))&&(e.flags|=128,e._value=n,t.version++)}catch(e){throw t.version++,e}finally{Dn=n,Nn=r,Ree(e),e.flags&=-3}}function Zt(e,t=!1){let{dep:n,prevSub:r,nextSub:i}=e;if(r&&(r.nextSub=i,e.prevSub=void 0),i&&(i.prevSub=r,e.nextSub=void 0),n.subs===e&&(n.subs=r,!r&&n.computed)){n.computed.flags&=-5;for(let e=n.computed.deps;e;e=e.nextDep)Zt(e,!0)}!t&&!--n.sc&&n.map&&n.map.delete(n.key)}function Bee(e){let{prevDep:t,nextDep:n}=e;t&&(t.nextDep=n,e.prevDep=void 0),n&&(n.prevDep=t,e.nextDep=void 0)}function Qt(){Pn.push(Nn),Nn=!1}function $t(){let e=Pn.pop();Nn=e===void 0?!0:e}function Vee(e){let{cleanup:t}=e;if(e.cleanup=void 0,t){let e=Dn;Dn=void 0;try{t()}finally{Dn=e}}}function Hee(e){if(e.dep.sc++,e.sub.flags&4){let t=e.dep.computed;if(t&&!e.dep.subs){t.flags|=20;for(let e=t.deps;e;e=e.nextDep)Hee(e)}let n=e.dep.subs;n!==e&&(e.prevSub=n,n&&(n.nextSub=e)),e.dep.subs=e}}function en(e,t,n){if(Nn&&Dn){let t=Ln.get(e);t||Ln.set(e,t=new Map);let r=t.get(n);r||(t.set(n,r=new In),r.map=t,r.key=n),r.track()}}function tn(e,t,n,r,i,a){let o=Ln.get(e);if(!o){Fn++;return}let s=e=>{e&&e.trigger()};if(Jt(),t===`clear`)o.forEach(s);else{let i=_t(e),a=i&&kt(n);if(i&&n===`length`){let e=Number(r);o.forEach((t,n)=>{(n===`length`||n===Bn||!Ct(n)&&n>=e)&&s(t)})}else switch((n!==void 0||o.has(void 0))&&s(o.get(n)),a&&s(o.get(Bn)),t){case`add`:i?a&&s(o.get(`length`)):(s(o.get(Rn)),vt(e)&&s(o.get(zn)));break;case`delete`:i||(s(o.get(Rn)),vt(e)&&s(o.get(zn)));break;case`set`:vt(e)&&s(o.get(Rn));break}}Yt()}function Uee(e,t){let n=Ln.get(e);return n&&n.get(t)}function nn(e){let t=bn(e);return t===e?t:(en(t,`iterate`,Bn),vn(e)?t:t.map(Zn))}function rn(e){return en(e=bn(e),`iterate`,Bn),e}function an(e,t){return _n(e)?gn(e)?Qn(Zn(t)):Qn(t):Zn(t)}function on(e,t,n){let r=rn(e),i=r[t]();return r!==e&&!vn(e)&&(i._next=i.next,i.next=()=>{let e=i._next();return e.done||(e.value=n(e.value)),e}),i}function sn(e,t,n,r,i,a){let o=rn(e),s=o!==e&&!vn(e),c=o[t];if(c!==ute[t]){let t=c.apply(e,a);return s?Zn(t):t}let l=n;o!==e&&(s?l=function(t,r){return n.call(this,an(e,t),r,e)}:n.length>2&&(l=function(t,r){return n.call(this,t,r,e)}));let u=c.call(o,l,r);return s&&i?i(u):u}function Wee(e,t,n,r){let i=rn(e),a=i!==e&&!vn(e),o=n,s=!1;i!==e&&(a?(s=r.length===0,o=function(t,r,i){return s&&(s=!1,t=an(e,t)),n.call(this,t,an(e,r),i,e)}):n.length>3&&(o=function(t,r,i){return n.call(this,t,r,i,e)}));let c=i[t](o,...r);return s?an(e,c):c}function cn(e,t,n){let r=bn(e);en(r,`iterate`,Bn);let i=r[t](...n);return(i===-1||i===!1)&&yn(n[0])?(n[0]=bn(n[0]),r[t](...n)):i}function ln(e,t,n=[]){Qt(),Jt();let r=bn(e)[t].apply(e,n);return Yt(),$t(),r}function Gee(e){Ct(e)||(e=String(e));let t=bn(this);return en(t,`has`,e),t.hasOwnProperty(e)}function Kee(e,t,n){return function(...r){let i=this.__v_raw,a=bn(i),o=vt(a),s=e===`entries`||e===Symbol.iterator&&o,c=e===`keys`&&o,l=i[e](...r),u=n?Gn:t?Qn:Zn;return!t&&en(a,`iterate`,c?zn:Rn),mt(Object.create(l),{next(){let{value:e,done:t}=l.next();return t?{value:e,done:t}:{value:s?[u(e[0]),u(e[1])]:u(e),done:t}}})}}function un(e){return function(...t){return e===`delete`?!1:e===`clear`?void 0:this}}function qee(e,t){let n={get(n){let r=this.__v_raw,i=bn(r),a=bn(n);e||(It(n,a)&&en(i,`get`,n),en(i,`get`,a));let{has:o}=Kn(i),s=t?Gn:e?Qn:Zn;if(o.call(i,n))return s(r.get(n));if(o.call(i,a))return s(r.get(a));r!==i&&r.get(n)},get size(){let t=this.__v_raw;return!e&&en(bn(t),`iterate`,Rn),t.size},has(t){let n=this.__v_raw,r=bn(n),i=bn(t);return e||(It(t,i)&&en(r,`has`,t),en(r,`has`,i)),t===i?n.has(t):n.has(t)||n.has(i)},forEach(n,r){let i=this,a=i.__v_raw,o=bn(a),s=t?Gn:e?Qn:Zn;return!e&&en(o,`iterate`,Rn),a.forEach((e,t)=>n.call(r,s(e),s(t),i))}};return mt(n,e?{add:un(`add`),set:un(`set`),delete:un(`delete`),clear:un(`clear`)}:{add(e){let n=bn(this),r=Kn(n),i=bn(e),a=!t&&!vn(e)&&!_n(e)?i:e;return r.has.call(n,a)||It(e,a)&&r.has.call(n,e)||It(i,a)&&r.has.call(n,i)||(n.add(a),tn(n,`add`,a,a)),this},set(e,n){!t&&!vn(n)&&!_n(n)&&(n=bn(n));let r=bn(this),{has:i,get:a}=Kn(r),o=i.call(r,e);o||=(e=bn(e),i.call(r,e));let s=a.call(r,e);return r.set(e,n),o?It(n,s)&&tn(r,`set`,e,n,s):tn(r,`add`,e,n),this},delete(e){let t=bn(this),{has:n,get:r}=Kn(t),i=n.call(t,e);i||=(e=bn(e),n.call(t,e));let a=r?r.call(t,e):void 0,o=t.delete(e);return i&&tn(t,`delete`,e,void 0,a),o},clear(){let e=bn(this),t=e.size!==0,n=e.clear();return t&&tn(e,`clear`,void 0,void 0,void 0),n}}),[`keys`,`values`,`entries`,Symbol.iterator].forEach(r=>{n[r]=Kee(r,e,t)}),n}function dn(e,t){let n=qee(e,t);return(t,r,i)=>r===`__v_isReactive`?!e:r===`__v_isReadonly`?e:r===`__v_raw`?t:Reflect.get(gt(n,r)&&r in t?n:t,r,i)}function Jee(e){switch(e){case`Object`:case`Array`:return 1;case`Map`:case`Set`:case`WeakMap`:case`WeakSet`:return 2;default:return 0}}function Yee(e){return e.__v_skip||!Object.isExtensible(e)?0:Jee(Dee(e))}function fn(e){return _n(e)?e:hn(e,!1,fte,gte,qn)}function Xee(e){return hn(e,!1,mte,_te,Jn)}function pn(e){return hn(e,!0,pte,vte,Yn)}function mn(e){return hn(e,!0,hte,yte,Xn)}function hn(e,t,n,r,i){if(!wt(e)||e.__v_raw&&!(t&&e.__v_isReactive))return e;let a=Yee(e);if(a===0)return e;let o=i.get(e);if(o)return o;let s=new Proxy(e,a===2?r:n);return i.set(e,s),s}function gn(e){return _n(e)?gn(e.__v_raw):!!(e&&e.__v_isReactive)}function _n(e){return!!(e&&e.__v_isReadonly)}function vn(e){return!!(e&&e.__v_isShallow)}function yn(e){return e?!!e.__v_raw:!1}function bn(e){let t=e&&e.__v_raw;return t?bn(t):e}function Zee(e){return!gt(e,`__v_skip`)&&Object.isExtensible(e)&&Rt(e,`__v_skip`,!0),e}function xn(e){return e?e.__v_isRef===!0:!1}function A(e){return Qee(e,!1)}function Sn(e){return Qee(e,!0)}function Qee(e,t){return xn(e)?e:new bte(e,t)}function $ee(e){e.dep&&e.dep.trigger()}function j(e){return xn(e)?e.value:e}function Cn(e){return xt(e)?e():j(e)}function ete(e){return gn(e)?e:new Proxy(e,xte)}function tte(e){return new Ste(e)}function nte(e){let t=_t(e)?Array(e.length):{};for(let n in e)t[n]=rte(e,n);return t}function wn(e,t,n){return xn(e)?e:xt(e)?new wte(e):wt(e)&&arguments.length>1?rte(e,t,n):A(e)}function rte(e,t,n){return new Cte(e,t,n)}function ite(e,t,n=!1){let r,i;return xt(e)?r=e:(r=e.get,i=e.set),new Tte(r,i,n)}function ate(e,t=!1,n=tr){if(n){let t=er.get(n);t||er.set(n,t=[]),t.push(e)}}function ote(e,t,n=ct){let{immediate:r,deep:i,once:a,scheduler:o,augmentJob:s,call:c}=n,l=e=>i?e:vn(e)||i===!1||i===0?Tn(e,1):Tn(e),u,d,f,p,m=!1,h=!1;if(xn(e)?(d=()=>e.value,m=vn(e)):gn(e)?(d=()=>l(e),m=!0):_t(e)?(h=!0,m=e.some(e=>gn(e)||vn(e)),d=()=>e.map(e=>{if(xn(e))return e.value;if(gn(e))return l(e);if(xt(e))return c?c(e,2):e()})):d=xt(e)?t?c?()=>c(e,2):e:()=>{if(f){Qt();try{f()}finally{$t()}}let t=tr;tr=u;try{return c?c(e,3,[p]):e(p)}finally{tr=t}}:ut,t&&i){let e=d,t=i===!0?1/0:i;d=()=>Tn(e(),t)}let g=Kt(),_=()=>{u.stop(),g&&g.active&&ht(g.effects,u)};if(a&&t){let e=t;t=(...t)=>{e(...t),_()}}let v=h?Array(e.length).fill($n):$n,y=e=>{if(!(!(u.flags&1)||!u.dirty&&!e))if(t){let e=u.run();if(i||m||(h?e.some((e,t)=>It(e,v[t])):It(e,v))){f&&f();let n=tr;tr=u;try{let n=[e,v===$n?void 0:h&&v[0]===$n?[]:v,p];v=e,c?c(t,3,n):t(...n)}finally{tr=n}}}else u.run()};return s&&s(y),u=new kn(d),u.scheduler=o?()=>o(y,!1):y,p=e=>ate(e,!1,u),f=u.onStop=()=>{let e=er.get(u);if(e){if(c)c(e,4);else for(let t of e)t();er.delete(u)}},t?r?y(!0):v=u.run():o?o(y.bind(null,!0),!0):u.run(),_.pause=u.pause.bind(u),_.resume=u.resume.bind(u),_.stop=_,_}function Tn(e,t=1/0,n){if(t<=0||!wt(e)||e.__v_skip||(n||=new Map,(n.get(e)||0)>=t))return e;if(n.set(e,t),t--,xn(e))Tn(e.value,t,n);else if(_t(e))for(let r=0;r<e.length;r++)Tn(e[r],t,n);else if(yt(e)||vt(e))e.forEach(e=>{Tn(e,t,n)});else if(Ot(e)){for(let r in e)Tn(e[r],t,n);for(let r of Object.getOwnPropertySymbols(e))Object.prototype.propertyIsEnumerable.call(e,r)&&Tn(e[r],t,n)}return e}var En,ste,Dn,On,kn,An,jn,Mn,Nn,Pn,Fn,cte,In,Ln,Rn,zn,Bn,lte,ute,dte,Vn,Hn,Un,Wn,fte,pte,mte,hte,Gn,Kn,gte,_te,vte,yte,qn,Jn,Yn,Xn,Zn,Qn,bte,xte,Ste,Cte,wte,Tte,$n,er,tr,Ete=s((()=>{Gt(),ste=class{constructor(e=!1){this.detached=e,this._active=!0,this._on=0,this.effects=[],this.cleanups=[],this._isPaused=!1,this.__v_skip=!0,this.parent=En,!e&&En&&(this.index=(En.scopes||=[]).push(this)-1)}get active(){return this._active}pause(){if(this._active){this._isPaused=!0;let e,t;if(this.scopes)for(e=0,t=this.scopes.length;e<t;e++)this.scopes[e].pause();for(e=0,t=this.effects.length;e<t;e++)this.effects[e].pause()}}resume(){if(this._active&&this._isPaused){this._isPaused=!1;let e,t;if(this.scopes)for(e=0,t=this.scopes.length;e<t;e++)this.scopes[e].resume();for(e=0,t=this.effects.length;e<t;e++)this.effects[e].resume()}}run(e){if(this._active){let t=En;try{return En=this,e()}finally{En=t}}}on(){++this._on===1&&(this.prevScope=En,En=this)}off(){this._on>0&&--this._on===0&&(En=this.prevScope,this.prevScope=void 0)}stop(e){if(this._active){this._active=!1;let t,n;for(t=0,n=this.effects.length;t<n;t++)this.effects[t].stop();for(this.effects.length=0,t=0,n=this.cleanups.length;t<n;t++)this.cleanups[t]();if(this.cleanups.length=0,this.scopes){for(t=0,n=this.scopes.length;t<n;t++)this.scopes[t].stop(!0);this.scopes.length=0}if(!this.detached&&this.parent&&!e){let e=this.parent.scopes.pop();e&&e!==this&&(this.parent.scopes[this.index]=e,e.index=this.index)}this.parent=void 0}}},On=new WeakSet,kn=class{constructor(e){this.fn=e,this.deps=void 0,this.depsTail=void 0,this.flags=5,this.next=void 0,this.cleanup=void 0,this.scheduler=void 0,En&&En.active&&En.effects.push(this)}pause(){this.flags|=64}resume(){this.flags&64&&(this.flags&=-65,On.has(this)&&(On.delete(this),this.trigger()))}notify(){this.flags&2&&!(this.flags&32)||this.flags&8||Iee(this)}run(){if(!(this.flags&1))return this.fn();this.flags|=2,Vee(this),Lee(this);let e=Dn,t=Nn;Dn=this,Nn=!0;try{return this.fn()}finally{Ree(this),Dn=e,Nn=t,this.flags&=-3}}stop(){if(this.flags&1){for(let e=this.deps;e;e=e.nextDep)Zt(e);this.deps=this.depsTail=void 0,Vee(this),this.onStop&&this.onStop(),this.flags&=-2}}trigger(){this.flags&64?On.add(this):this.scheduler?this.scheduler():this.runIfDirty()}runIfDirty(){Xt(this)&&this.run()}get dirty(){return Xt(this)}},An=0,Nn=!0,Pn=[],Fn=0,cte=class{constructor(e,t){this.sub=e,this.dep=t,this.version=t.version,this.nextDep=this.prevDep=this.nextSub=this.prevSub=this.prevActiveLink=void 0}},In=class{constructor(e){this.computed=e,this.version=0,this.activeLink=void 0,this.subs=void 0,this.map=void 0,this.key=void 0,this.sc=0,this.__v_skip=!0}track(e){if(!Dn||!Nn||Dn===this.computed)return;let t=this.activeLink;if(t===void 0||t.sub!==Dn)t=this.activeLink=new cte(Dn,this),Dn.deps?(t.prevDep=Dn.depsTail,Dn.depsTail.nextDep=t,Dn.depsTail=t):Dn.deps=Dn.depsTail=t,Hee(t);else if(t.version===-1&&(t.version=this.version,t.nextDep)){let e=t.nextDep;e.prevDep=t.prevDep,t.prevDep&&(t.prevDep.nextDep=e),t.prevDep=Dn.depsTail,t.nextDep=void 0,Dn.depsTail.nextDep=t,Dn.depsTail=t,Dn.deps===t&&(Dn.deps=e)}return t}trigger(e){this.version++,Fn++,this.notify(e)}notify(e){Jt();try{for(let e=this.subs;e;e=e.prevSub)e.sub.notify()&&e.sub.dep.notify()}finally{Yt()}}},Ln=new WeakMap,Rn=Symbol(``),zn=Symbol(``),Bn=Symbol(``),lte={__proto__:null,[Symbol.iterator](){return on(this,Symbol.iterator,e=>an(this,e))},concat(...e){return nn(this).concat(...e.map(e=>_t(e)?nn(e):e))},entries(){return on(this,`entries`,e=>(e[1]=an(this,e[1]),e))},every(e,t){return sn(this,`every`,e,t,void 0,arguments)},filter(e,t){return sn(this,`filter`,e,t,e=>e.map(e=>an(this,e)),arguments)},find(e,t){return sn(this,`find`,e,t,e=>an(this,e),arguments)},findIndex(e,t){return sn(this,`findIndex`,e,t,void 0,arguments)},findLast(e,t){return sn(this,`findLast`,e,t,e=>an(this,e),arguments)},findLastIndex(e,t){return sn(this,`findLastIndex`,e,t,void 0,arguments)},forEach(e,t){return sn(this,`forEach`,e,t,void 0,arguments)},includes(...e){return cn(this,`includes`,e)},indexOf(...e){return cn(this,`indexOf`,e)},join(e){return nn(this).join(e)},lastIndexOf(...e){return cn(this,`lastIndexOf`,e)},map(e,t){return sn(this,`map`,e,t,void 0,arguments)},pop(){return ln(this,`pop`)},push(...e){return ln(this,`push`,e)},reduce(e,...t){return Wee(this,`reduce`,e,t)},reduceRight(e,...t){return Wee(this,`reduceRight`,e,t)},shift(){return ln(this,`shift`)},some(e,t){return sn(this,`some`,e,t,void 0,arguments)},splice(...e){return ln(this,`splice`,e)},toReversed(){return nn(this).toReversed()},toSorted(e){return nn(this).toSorted(e)},toSpliced(...e){return nn(this).toSpliced(...e)},unshift(...e){return ln(this,`unshift`,e)},values(){return on(this,`values`,e=>an(this,e))}},ute=Array.prototype,dte=rt(`__proto__,__v_isRef,__isVue`),Vn=new Set(Object.getOwnPropertyNames(Symbol).filter(e=>e!==`arguments`&&e!==`caller`).map(e=>Symbol[e]).filter(Ct)),Hn=class{constructor(e=!1,t=!1){this._isReadonly=e,this._isShallow=t}get(e,t,n){if(t===`__v_skip`)return e.__v_skip;let r=this._isReadonly,i=this._isShallow;if(t===`__v_isReactive`)return!r;if(t===`__v_isReadonly`)return r;if(t===`__v_isShallow`)return i;if(t===`__v_raw`)return n===(r?i?Xn:Yn:i?Jn:qn).get(e)||Object.getPrototypeOf(e)===Object.getPrototypeOf(n)?e:void 0;let a=_t(e);if(!r){let e;if(a&&(e=lte[t]))return e;if(t===`hasOwnProperty`)return Gee}let o=Reflect.get(e,t,xn(e)?e:n);if((Ct(t)?Vn.has(t):dte(t))||(r||en(e,`get`,t),i))return o;if(xn(o)){let e=a&&kt(t)?o:o.value;return r&&wt(e)?pn(e):e}return wt(o)?r?pn(o):fn(o):o}},Un=class extends Hn{constructor(e=!1){super(!1,e)}set(e,t,n,r){let i=e[t],a=_t(e)&&kt(t);if(!this._isShallow){let e=_n(i);if(!vn(n)&&!_n(n)&&(i=bn(i),n=bn(n)),!a&&xn(i)&&!xn(n))return e||(i.value=n),!0}let o=a?Number(t)<e.length:gt(e,t),s=Reflect.set(e,t,n,xn(e)?e:r);return e===bn(r)&&(o?It(n,i)&&tn(e,`set`,t,n,i):tn(e,`add`,t,n)),s}deleteProperty(e,t){let n=gt(e,t),r=e[t],i=Reflect.deleteProperty(e,t);return i&&n&&tn(e,`delete`,t,void 0,r),i}has(e,t){let n=Reflect.has(e,t);return(!Ct(t)||!Vn.has(t))&&en(e,`has`,t),n}ownKeys(e){return en(e,`iterate`,_t(e)?`length`:Rn),Reflect.ownKeys(e)}},Wn=class extends Hn{constructor(e=!1){super(!0,e)}set(e,t){return!0}deleteProperty(e,t){return!0}},fte=new Un,pte=new Wn,mte=new Un(!0),hte=new Wn(!0),Gn=e=>e,Kn=e=>Reflect.getPrototypeOf(e),gte={get:dn(!1,!1)},_te={get:dn(!1,!0)},vte={get:dn(!0,!1)},yte={get:dn(!0,!0)},qn=new WeakMap,Jn=new WeakMap,Yn=new WeakMap,Xn=new WeakMap,Zn=e=>wt(e)?fn(e):e,Qn=e=>wt(e)?pn(e):e,bte=class{constructor(e,t){this.dep=new In,this.__v_isRef=!0,this.__v_isShallow=!1,this._rawValue=t?e:bn(e),this._value=t?e:Zn(e),this.__v_isShallow=t}get value(){return this.dep.track(),this._value}set value(e){let t=this._rawValue,n=this.__v_isShallow||vn(e)||_n(e);e=n?e:bn(e),It(e,t)&&(this._rawValue=e,this._value=n?e:Zn(e),this.dep.trigger())}},xte={get:(e,t,n)=>t===`__v_raw`?e:j(Reflect.get(e,t,n)),set:(e,t,n,r)=>{let i=e[t];return xn(i)&&!xn(n)?(i.value=n,!0):Reflect.set(e,t,n,r)}},Ste=class{constructor(e){this.__v_isRef=!0,this._value=void 0;let t=this.dep=new In,{get:n,set:r}=e(t.track.bind(t),t.trigger.bind(t));this._get=n,this._set=r}get value(){return this._value=this._get()}set value(e){this._set(e)}},Cte=class{constructor(e,t,n){this._object=e,this._key=t,this._defaultValue=n,this.__v_isRef=!0,this._value=void 0,this._raw=bn(e);let r=!0,i=e;if(!_t(e)||!kt(String(t)))do r=!yn(i)||vn(i);while(r&&(i=i.__v_raw));this._shallow=r}get value(){let e=this._object[this._key];return this._shallow&&(e=j(e)),this._value=e===void 0?this._defaultValue:e}set value(e){if(this._shallow&&xn(this._raw[this._key])){let t=this._object[this._key];if(xn(t)){t.value=e;return}}this._object[this._key]=e}get dep(){return Uee(this._raw,this._key)}},wte=class{constructor(e){this._getter=e,this.__v_isRef=!0,this.__v_isReadonly=!0,this._value=void 0}get value(){return this._value=this._getter()}},Tte=class{constructor(e,t,n){this.fn=e,this.setter=t,this._value=void 0,this.dep=new In(this),this.__v_isRef=!0,this.deps=void 0,this.depsTail=void 0,this.flags=16,this.globalVersion=Fn-1,this.next=void 0,this.effect=this,this.__v_isReadonly=!t,this.isSSR=n}notify(){if(this.flags|=16,!(this.flags&8)&&Dn!==this)return Iee(this,!0),!0}get value(){let e=this.dep.track();return zee(this),e&&(e.version=this.dep.version),this._value}set value(e){this.setter&&this.setter(e)}},$n={},er=new WeakMap,tr=void 0}));function nr(e,t,n,r){try{return r?e(...r):e()}catch(e){ir(e,t,n)}}function rr(e,t,n,r){if(xt(e)){let i=nr(e,t,n,r);return i&&Tt(i)&&i.catch(e=>{ir(e,t,n)}),i}if(_t(e)){let i=[];for(let a=0;a<e.length;a++)i.push(rr(e[a],t,n,r));return i}}function ir(e,t,n,r=!0){let i=t?t.vnode:null,{errorHandler:a,throwUnhandledErrorInProduction:o}=t&&t.appContext.config||ct;if(t){let r=t.parent,i=t.proxy,o=`https://vuejs.org/error-reference/#runtime-${n}`;for(;r;){let t=r.ec;if(t){for(let n=0;n<t.length;n++)if(t[n](e,i,o)===!1)return}r=r.parent}if(a){Qt(),nr(a,null,10,[e,i,o]),$t();return}}Dte(e,n,i,r,o)}function Dte(e,t,n,r=!0,i=!1){if(i)throw e;console.error(e)}function ar(e){let t=hi||mi;return e?t.then(this?e.bind(this):e):t}function Ote(e){let t=ui+1,n=li.length;for(;t<n;){let r=t+n>>>1,i=li[r],a=gi(i);a<e||a===e&&i.flags&2?t=r+1:n=r}return t}function or(e){if(!(e.flags&1)){let t=gi(e),n=li[li.length-1];!n||!(e.flags&2)&&t>=gi(n)?li.push(e):li.splice(Ote(t),0,e),e.flags|=1,kte()}}function kte(){hi||=mi.then(Mte)}function Ate(e){_t(e)?di.push(...e):fi&&e.id===-1?fi.splice(pi+1,0,e):e.flags&1||(di.push(e),e.flags|=1),kte()}function jte(e,t,n=ui+1){for(;n<li.length;n++){let t=li[n];if(t&&t.flags&2){if(e&&t.id!==e.uid)continue;li.splice(n,1),n--,t.flags&4&&(t.flags&=-2),t(),t.flags&4||(t.flags&=-2)}}}function sr(e){if(di.length){let e=[...new Set(di)].sort((e,t)=>gi(e)-gi(t));if(di.length=0,fi){fi.push(...e);return}for(fi=e,pi=0;pi<fi.length;pi++){let e=fi[pi];e.flags&4&&(e.flags&=-2),e.flags&8||e(),e.flags&=-2}fi=null,pi=0}}function Mte(e){try{for(ui=0;ui<li.length;ui++){let e=li[ui];e&&!(e.flags&8)&&(e.flags&4&&(e.flags&=-2),nr(e,e.i,e.i?15:14),e.flags&4||(e.flags&=-2))}}finally{for(;ui<li.length;ui++){let e=li[ui];e&&(e.flags&=-2)}ui=-1,li.length=0,sr(e),hi=null,(li.length||di.length)&&Mte(e)}}function cr(e){let t=_i;return _i=e,vi=e&&e.type.__scopeId||null,t}function M(e,t=_i,n){if(!t||e._n)return e;let r=(...n)=>{r._d&&Xr(-1);let i=cr(t),a;try{a=e(...n)}finally{cr(i),r._d&&Xr(1)}return a};return r._n=!0,r._c=!0,r._d=!0,r}function lr(e,t){if(_i===null)return e;let n=si(_i),r=e.dirs||=[];for(let e=0;e<t.length;e++){let[i,a,o,s=ct]=t[e];i&&(xt(i)&&(i={mounted:i,updated:i}),i.deep&&Tn(a),r.push({dir:i,instance:n,value:a,oldValue:void 0,arg:o,modifiers:s}))}return e}function ur(e,t,n,r){let i=e.dirs,a=t&&t.dirs;for(let o=0;o<i.length;o++){let s=i[o];a&&(s.oldValue=a[o].value);let c=s.dir[r];c&&(Qt(),rr(c,n,8,[e.el,s,e,t]),$t())}}function dr(e,t){if(ya){let n=ya.provides,r=ya.parent&&ya.parent.provides;r===n&&(n=ya.provides=Object.create(r)),n[e]=t}}function fr(e,t,n=!1){let r=ba();if(r||$i){let i=$i?$i._context.provides:r?r.parent==null||r.ce?r.vnode.appContext&&r.vnode.appContext.provides:r.parent.provides:void 0;if(i&&e in i)return i[e];if(arguments.length>1)return n&&xt(t)?t.call(r&&r.proxy):t}}function Nte(){return!!(ba()||$i)}function pr(e,t){return hr(e,null,t)}function Pte(e,t){return hr(e,null,{flush:`sync`})}function mr(e,t,n){return hr(e,t,n)}function hr(e,t,n=ct){let{immediate:r,deep:i,flush:a,once:o}=n,s=mt({},n),c=t&&r||!t&&a!==`post`,l;if(Ta){if(a===`sync`){let e=qne();l=e.__watcherHandles||=[]}else if(!c){let e=()=>{};return e.stop=ut,e.resume=ut,e.pause=ut,e}}let u=ya;s.call=(e,t,n)=>rr(e,u,t,n);let d=!1;a===`post`?s.scheduler=e=>{la(e,u&&u.suspense)}:a!==`sync`&&(d=!0,s.scheduler=(e,t)=>{t?e():or(e)}),s.augmentJob=e=>{t&&(e.flags|=4),d&&(e.flags|=2,u&&(e.id=u.uid,e.i=u))};let f=ote(e,t,s);return Ta&&(l?l.push(f):c&&f()),f}function Fte(e,t,n){let r=this.proxy,i=St(e)?e.includes(`.`)?Ite(r,e):()=>r[e]:e.bind(r,r),a;xt(t)?a=t:(a=t.handler,n=t);let o=Ca(this),s=hr(i,a.bind(r),n);return o(),s}function Ite(e,t){let n=t.split(`.`);return()=>{let t=e;for(let e=0;e<n.length&&t;e++)t=t[n[e]];return t}}function gr(e,t,n,{o:{insert:r},m:i},a=2){a===0&&r(e.targetAnchor,t,n);let{el:o,anchor:s,shapeFlag:c,children:l,props:u}=e,d=a===2;if(d&&r(o,t,n),(!d||xi(u))&&c&16)for(let e=0;e<l.length;e++)i(l[e],t,n,2);d&&r(s,t,n)}function Lte(e,t,n,r,i,a,{o:{nextSibling:o,parentNode:s,querySelector:c,insert:l,createText:u}},d){function f(e,n){let r=n;for(;r;){if(r&&r.nodeType===8){if(r.data===`teleport start anchor`)t.targetStart=r;else if(r.data===`teleport anchor`){t.targetAnchor=r,e._lpa=t.targetAnchor&&o(t.targetAnchor);break}}r=o(r)}}function p(e,t){t.anchor=d(o(e),t,s(e),n,r,i,a)}let m=t.target=Ti(t.props,c),h=xi(t.props);if(m){let c=m._lpa||m.firstChild;t.shapeFlag&16&&(h?(p(e,t),f(m,c),t.targetAnchor||vr(m,t,u,l,s(e)===m?e:null)):(t.anchor=o(e),f(m,c),t.targetAnchor||vr(m,t,u,l),d(c&&o(c),t,m,n,r,i,a))),_r(t,h)}else h&&t.shapeFlag&16&&(p(e,t),t.targetStart=e,t.targetAnchor=o(e));return t.anchor&&o(t.anchor)}function _r(e,t){let n=e.ctx;if(n&&n.ut){let r,i;for(t?(r=e.el,i=e.anchor):(r=e.targetStart,i=e.targetAnchor);r&&r!==i;)r.nodeType===1&&r.setAttribute(`data-v-owner`,n.uid),r=r.nextSibling;n.ut()}}function vr(e,t,n,r,i=null){let a=t.targetStart=n(``),o=t.targetAnchor=n(``);return a[yi]=o,e&&(r(a,e,i),r(o,e,i)),o}function Rte(){let e={isMounted:!1,isLeaving:!1,isUnmounting:!1,leavingVNodes:new Map};return Hi(()=>{e.isMounted=!0}),Wi(()=>{e.isUnmounting=!0}),e}function zte(e){let t=e[0];if(e.length>1){for(let n of e)if(n.type!==fa){t=n;break}}return t}function Bte(e,t){let{leavingVNodes:n}=e,r=n.get(t.type);return r||(r=Object.create(null),n.set(t.type,r)),r}function yr(e,t,n,r,i){let{appear:a,mode:o,persisted:s=!1,onBeforeEnter:c,onEnter:l,onAfterEnter:u,onEnterCancelled:d,onBeforeLeave:f,onLeave:p,onAfterLeave:m,onLeaveCancelled:h,onBeforeAppear:g,onAppear:_,onAfterAppear:v,onAppearCancelled:y}=t,b=String(e.key),x=Bte(n,e),S=(e,t)=>{e&&rr(e,r,9,t)},C=(e,t)=>{let n=t[1];S(e,t),_t(e)?e.every(e=>e.length<=1)&&n():e.length<=1&&n()},w={mode:o,persisted:s,beforeEnter(t){let r=c;if(!n.isMounted)if(a)r=g||c;else return;t[Oi]&&t[Oi](!0);let i=x[b];i&&Qr(e,i)&&i.el[Oi]&&i.el[Oi](),S(r,[t])},enter(t){if(x[b]===e)return;let r=l,i=u,o=d;if(!n.isMounted)if(a)r=_||l,i=v||u,o=y||d;else return;let s=!1;t[ki]=e=>{s||(s=!0,S(e?o:i,[t]),w.delayedLeave&&w.delayedLeave(),t[ki]=void 0)};let c=t[ki].bind(null,!1);r?C(r,[t,c]):c()},leave(t,r){let i=String(e.key);if(t[ki]&&t[ki](!0),n.isUnmounting)return r();S(f,[t]);let a=!1;t[Oi]=n=>{a||(a=!0,r(),S(n?h:m,[t]),t[Oi]=void 0,x[i]===e&&delete x[i])};let o=t[Oi].bind(null,!1);x[i]=e,p?C(p,[t,o]):o()},clone(e){let a=yr(e,t,n,r,i);return i&&i(a),a}};return w}function br(e){if(zi(e))return e=ei(e),e.children=null,e}function Vte(e){if(!zi(e))return bi(e.type)&&e.children?zte(e.children):e;if(e.component)return e.component.subTree;let{shapeFlag:t,children:n}=e;if(n){if(t&16)return n[0];if(t&32&&xt(n.default))return n.default()}}function xr(e,t){e.shapeFlag&6&&e.component?(e.transition=t,xr(e.component.subTree,t)):e.shapeFlag&128?(e.ssContent.transition=t.clone(e.ssContent),e.ssFallback.transition=t.clone(e.ssFallback)):e.transition=t}function Hte(e,t=!1,n){let r=[],i=0;for(let a=0;a<e.length;a++){let o=e[a],s=n==null?o.key:String(n)+String(o.key==null?a:o.key);o.type===V?(o.patchFlag&128&&i++,r=r.concat(Hte(o.children,t,s))):(t||o.type!==fa)&&r.push(s==null?o:ei(o,{key:s}))}if(i>1)for(let e=0;e<r.length;e++)r[e].patchFlag=-2;return r}function N(e,t){return xt(e)?mt({name:e.name},t,{setup:e}):e}function Sr(){let e=ba();return e?(e.appContext.config.idPrefix||`v`)+`-`+e.ids[0]+ e.ids[1]++:``}function Cr(e){e.ids=[e.ids[0]+ e.ids[2]+++`-`,0,0]}function wr(e){let t=ba(),n=Sn(null);if(t){let r=t.refs===ct?t.refs={}:t.refs;Object.defineProperty(r,e,{enumerable:!0,get:()=>n.value,set:e=>n.value=e})}return n}function Ute(e,t){let n;return!!((n=Object.getOwnPropertyDescriptor(e,t))&&!n.configurable)}function Tr(e,t,n,r,i=!1){if(_t(e)){e.forEach((e,a)=>Tr(e,t&&(_t(t)?t[a]:t),n,r,i));return}if(Ri(r)&&!i){r.shapeFlag&512&&r.type.__asyncResolved&&r.component.subTree.component&&Tr(e,t,n,r.component.subTree);return}let a=r.shapeFlag&4?si(r.component):r.el,o=i?null:a,{i:s,r:c}=e,l=t&&t.r,u=s.refs===ct?s.refs={}:s.refs,d=s.setupState,f=bn(d),p=d===ct?dt:e=>Ute(u,e)?!1:gt(f,e),m=(e,t)=>!(t&&Ute(u,t));if(l!=null&&l!==c){if(Wte(t),St(l))u[l]=null,p(l)&&(d[l]=null);else if(xn(l)){let e=t;m(l,e.k)&&(l.value=null),e.k&&(u[e.k]=null)}}if(xt(c))nr(c,s,12,[o,u]);else{let t=St(c),r=xn(c);if(t||r){let s=()=>{if(e.f){let n=t?p(c)?d[c]:u[c]:m(c)||!e.k?c.value:u[e.k];if(i)_t(n)&&ht(n,a);else if(_t(n))n.includes(a)||n.push(a);else if(t)u[c]=[a],p(c)&&(d[c]=u[c]);else{let t=[a];m(c,e.k)&&(c.value=t),e.k&&(u[e.k]=t)}}else t?(u[c]=o,p(c)&&(d[c]=o)):r&&(m(c,e.k)&&(c.value=o),e.k&&(u[e.k]=o))};if(o){let t=()=>{s(),Ni.delete(e)};t.id=-1,Ni.set(e,t),la(t,n)}else Wte(e),s()}}}function Wte(e){let t=Ni.get(e);t&&(t.flags|=8,Ni.delete(e))}function Gte(e){let{mt:t,p:n,o:{patchProp:r,createText:i,nextSibling:a,parentNode:o,remove:s,insert:c,createComment:l}}=e,u=(e,t)=>{if(!t.hasChildNodes()){n(null,e,t),sr(),t._vnode=e;return}d(t.firstChild,e,null,null,null),sr(),t._vnode=e},d=(n,r,s,l,u,y=!1)=>{y||=!!r.dynamicChildren;let b=Ii(n)&&n.data===`[`,x=()=>h(n,r,s,l,u,b),{type:S,ref:C,shapeFlag:w,patchFlag:ee}=r,te=n.nodeType;r.el=n,ee===-2&&(y=!1,r.dynamicChildren=null);let ne=null;switch(S){case da:te===3?(n.data!==r.children&&(Pi(),n.data=r.children),ne=a(n)):r.children===``?(c(r.el=i(``),o(n),n),ne=n):ne=x();break;case fa:v(n)?(ne=a(n),_(r.el=n.content.firstChild,n,s)):ne=te!==8||b?x():a(n);break;case pa:if(b&&(n=a(n),te=n.nodeType),te===1||te===3){ne=n;let e=!r.children.length;for(let t=0;t<r.staticCount;t++)e&&(r.children+=ne.nodeType===1?ne.outerHTML:ne.data),t===r.staticCount-1&&(r.anchor=ne),ne=a(ne);return b?a(ne):ne}else x();break;case V:ne=b?m(n,r,s,l,u,y):x();break;default:if(w&1)ne=(te!==1||r.type.toLowerCase()!==n.tagName.toLowerCase())&&!v(n)?x():f(n,r,s,l,u,y);else if(w&6){r.slotScopeIds=u;let e=o(n);if(ne=b?g(n):Ii(n)&&n.data===`teleport start`?g(n,n.data,`teleport end`):a(n),t(r,e,null,s,l,Fi(e),y),Ri(r)&&!r.type.__asyncResolved){let t;b?(t=H(V),t.anchor=ne?ne.previousSibling:e.lastChild):t=n.nodeType===3?z(``):H(`div`),t.el=n,r.component.subTree=t}}else w&64?ne=te===8?r.type.hydrate(n,r,s,l,u,y,e,p):x():w&128&&(ne=r.type.hydrate(n,r,s,l,Fi(o(n)),u,y,e,d))}return C!=null&&Tr(C,null,l,r),ne},f=(e,t,n,i,a,o)=>{o||=!!t.dynamicChildren;let{type:c,props:l,patchFlag:u,shapeFlag:d,dirs:f,transition:m}=t,h=c===`input`||c===`option`;if(h||u!==-1){f&&ur(t,null,n,`created`);let c=!1;if(v(e)){c=One(null,m)&&n&&n.vnode.props&&n.vnode.props.appear;let r=e.content.firstChild;if(c){let e=r.getAttribute(`class`);e&&(r.$cls=e),m.beforeEnter(r)}_(r,e,n),t.el=e=r}if(d&16&&!(l&&(l.innerHTML||l.textContent))){let r=p(e.firstChild,t,e,n,i,a,o);for(;r;){Er(e,1)||Pi();let t=r;r=r.nextSibling,s(t)}}else if(d&8){let n=t.children;n[0]===`
-`&&(e.tagName===`PRE`||e.tagName===`TEXTAREA`)&&(n=n.slice(1));let{textContent:r}=e;r!==n&&r!==n.replace(/\r\n|\r/g,`
-`)&&(Er(e,0)||Pi(),e.textContent=t.children)}if(l){if(h||!o||u&48){let t=e.tagName.includes(`-`);for(let i in l)(h&&(i.endsWith(`value`)||i===`indeterminate`)||ft(i)&&!At(i)||i[0]===`.`||t&&!At(i))&&r(e,i,null,l[i],void 0,n)}else if(l.onClick)r(e,`onClick`,null,l.onClick,void 0,n);else if(u&4&&gn(l.style))for(let e in l.style)l.style[e]}let g;(g=l&&l.onVnodeBeforeMount)&&oi(g,n,t),f&&ur(t,null,n,`beforeMount`),((g=l&&l.onVnodeMounted)||f||c)&&Nne(()=>{g&&oi(g,n,t),c&&m.enter(e),f&&ur(t,null,n,`mounted`)},i)}return e.nextSibling},p=(e,t,r,o,s,l,u)=>{u||=!!t.dynamicChildren;let f=t.children,p=f.length;for(let t=0;t<p;t++){let m=u?f[t]:f[t]=ni(f[t]),h=m.type===da;e?(h&&!u&&t+1<p&&ni(f[t+1]).type===da&&(c(i(e.data.slice(m.children.length)),r,a(e)),e.data=m.children),e=d(e,m,o,s,l,u)):h&&!m.children?c(m.el=i(``),r):(Er(r,1)||Pi(),n(null,m,r,null,o,s,Fi(r),l))}return e},m=(e,t,n,r,i,s)=>{let{slotScopeIds:u}=t;u&&(i=i?i.concat(u):u);let d=o(e),f=p(a(e),t,d,n,r,i,s);return f&&Ii(f)&&f.data===`]`?a(t.anchor=f):(Pi(),c(t.anchor=l(`]`),d,f),f)},h=(e,t,r,i,c,l)=>{if(Er(e.parentElement,1)||Pi(),t.el=null,l){let t=g(e);for(;;){let n=a(e);if(n&&n!==t)s(n);else break}}let u=a(e),d=o(e);return s(e),n(null,t,d,u,r,i,Fi(d),c),r&&(r.vnode.el=t.el,yne(r,t.el)),u},g=(e,t=`[`,n=`]`)=>{let r=0;for(;e;)if(e=a(e),e&&Ii(e)&&(e.data===t&&r++,e.data===n)){if(r===0)return a(e);r--}return e},_=(e,t,n)=>{let r=t.parentNode;r&&r.replaceChild(e,t);let i=n;for(;i;)i.vnode.el===t&&(i.vnode.el=i.subTree.el=e),i=i.parent},v=e=>e.nodeType===1&&e.tagName===`TEMPLATE`;return[u,d]}function Er(e,t){if(t===0||t===1)for(;e&&!e.hasAttribute(Li);)e=e.parentElement;let n=e&&e.getAttribute(Li);if(n==null)return!1;if(n===``)return!0;{let e=n.split(`,`);return t===0&&e.includes(`children`)?!0:e.includes($ne[t])}}function Kte(e,t){if(Ii(e)&&e.data===`[`){let n=1,r=e.nextSibling;for(;r;){if(r.nodeType===1){if(t(r)===!1)break}else if(Ii(r))if(r.data===`]`){if(--n===0)break}else r.data===`[`&&n++;r=r.nextSibling}}else t(e)}function qte(e){xt(e)&&(e={loader:e});let{loader:t,loadingComponent:n,errorComponent:r,delay:i=200,hydrate:a,timeout:o,suspensible:s=!0,onError:c}=e,l=null,u,d=0,f=()=>(d++,l=null,p()),p=()=>{let e;return l||(e=l=t().catch(e=>{if(e=e instanceof Error?e:Error(String(e)),c)return new Promise((t,n)=>{c(e,()=>t(f()),()=>n(e),d+1)});throw e}).then(t=>e!==l&&l?l:(t&&(t.__esModule||t[Symbol.toStringTag]===`Module`)&&(t=t.default),u=t,t)))};return N({name:`AsyncComponentWrapper`,__asyncLoader:p,__asyncHydrate(e,t,n){let r=!1;(t.bu||=[]).push(()=>r=!0);let i=()=>{r||n()},o=a?()=>{let n=a(i,t=>Kte(e,t));n&&(t.bum||=[]).push(n)}:i;u?o():p().then(()=>!t.isUnmounted&&o())},get __asyncResolved(){return u},setup(){let e=ya;if(Cr(e),u)return()=>Dr(u,e);let t=t=>{l=null,ir(t,e,13,!r)};if(s&&e.suspense||Ta)return p().then(t=>()=>Dr(t,e)).catch(e=>(t(e),()=>r?H(r,{error:e}):null));let a=A(!1),c=A(),d=A(!!i);return i&&setTimeout(()=>{d.value=!1},i),o!=null&&setTimeout(()=>{if(!a.value&&!c.value){let e=Error(`Async component timed out after ${o}ms.`);t(e),c.value=e}},o),p().then(()=>{a.value=!0,e.parent&&zi(e.parent.vnode)&&e.parent.update()}).catch(e=>{t(e),c.value=e}),()=>{if(a.value&&u)return Dr(u,e);if(c.value&&r)return H(r,{error:c.value});if(n&&!d.value)return Dr(n,e)}}})}function Dr(e,t){let{ref:n,props:r,children:i,ce:a}=t.vnode,o=H(e,r,i);return o.ref=n,o.ce=a,delete t.vnode.ce,o}function Jte(e,t){Xte(e,`a`,t)}function Yte(e,t){Xte(e,`da`,t)}function Xte(e,t,n=ya){let r=e.__wdc||=()=>{let t=n;for(;t;){if(t.isDeactivated)return;t=t.parent}return e()};if(Or(t,r,n),n){let e=n.parent;for(;e&&e.parent;)zi(e.parent.vnode)&&Zte(r,t,n,e),e=e.parent}}function Zte(e,t,n,r){let i=Or(t,e,r,!0);Gi(()=>{ht(r[t],i)},n)}function Or(e,t,n=ya,r=!1){if(n){let i=n[e]||(n[e]=[]),a=t.__weh||=(...r)=>{Qt();let i=Ca(n),a=rr(t,n,e,r);return i(),$t(),a};return r?i.unshift(a):i.push(a),a}}function Qte(e,t=ya){Or(`ec`,e,t)}function $te(e,t){return ene(qi,e,!0,t)||e}function kr(e){return St(e)?ene(qi,e,!1)||e:e||Ji}function ene(e,t,n=!0,r=!1){let i=_i||ya;if(i){let n=i.type;if(e===qi){let e=Wne(n,!1);if(e&&(e===t||e===Mt(t)||e===Pt(Mt(t))))return n}let a=tne(i[e]||n[e],t)||tne(i.appContext[e],t);return!a&&r?n:a}}function tne(e,t){return e&&(e[t]||e[Mt(t)]||e[Pt(Mt(t))])}function Ar(e,t,n,r){let i,a=n&&n[r],o=_t(e);if(o||St(e)){let n=o&&gn(e),r=!1,s=!1;n&&(r=!vn(e),s=_n(e),e=rn(e)),i=Array(e.length);for(let n=0,o=e.length;n<o;n++)i[n]=t(r?s?Qn(Zn(e[n])):Zn(e[n]):e[n],n,void 0,a&&a[n])}else if(typeof e==`number`){i=Array(e);for(let n=0;n<e;n++)i[n]=t(n+1,n,void 0,a&&a[n])}else if(wt(e))if(e[Symbol.iterator])i=Array.from(e,(e,n)=>t(e,n,void 0,a&&a[n]));else{let n=Object.keys(e);i=Array(n.length);for(let r=0,o=n.length;r<o;r++){let o=n[r];i[r]=t(e[o],o,r,a&&a[r])}}else i=[];return n&&(n[r]=i),i}function jr(e,t){for(let n=0;n<t.length;n++){let r=t[n];if(_t(r))for(let t=0;t<r.length;t++)e[r[t].name]=r[t].fn;else r&&(e[r.name]=r.key?(...e)=>{let t=r.fn(...e);return t&&(t.key=r.key),t}:r.fn)}return e}function P(e,t,n={},r,i){if(_i.ce||_i.parent&&Ri(_i.parent)&&_i.parent.ce){let e=Object.keys(n).length>0;return t!==`default`&&(n.name=t),F(),L(V,null,[H(`slot`,n,r&&r())],e?-2:64)}let a=e[t];a&&a._c&&(a._d=!1),F();let o=a&&Mr(a(n)),s=n.key||o&&o.key,c=L(V,{key:(s&&!Ct(s)?s:`_${t}`)+(!o&&r?`_fb`:``)},o||(r?r():[]),o&&e._===1?64:-2);return!i&&c.scopeId&&(c.slotScopeIds=[c.scopeId+`-s`]),a&&a._c&&(a._d=!0),c}function Mr(e){return e.some(e=>Zr(e)?!(e.type===fa||e.type===V&&!Mr(e.children)):!0)?e:null}function Nr(e,t){let n={};for(let r in e)n[t&&/[A-Z]/.test(r)?`on:${r}`:Ft(r)]=e[r];return n}function Pr(){return nne(`useSlots`).slots}function Fr(){return nne(`useAttrs`).attrs}function nne(e){let t=ba();return t.setupContext||=Une(t)}function Ir(e){return _t(e)?e.reduce((e,t)=>(e[t]=null,e),{}):e}function Lr(e,t){return!e||!t?e||t:_t(e)&&_t(t)?e.concat(t):mt({},Ir(e),Ir(t))}function rne(e,t){let n={};for(let r in e)t.includes(r)||Object.defineProperty(n,r,{enumerable:!0,get:()=>e[r]});return n}function ine(e){let t=Rr(e),n=e.proxy,r=e.ctx;Qi=!1,t.beforeCreate&&one(t.beforeCreate,e,`bc`);let{data:i,computed:a,methods:o,watch:s,provide:c,inject:l,created:u,beforeMount:d,mounted:f,beforeUpdate:p,updated:m,activated:h,deactivated:g,beforeDestroy:_,beforeUnmount:v,destroyed:y,unmounted:b,render:x,renderTracked:S,renderTriggered:C,errorCaptured:w,serverPrefetch:ee,expose:te,inheritAttrs:ne,components:re,directives:T,filters:ie}=t;if(l&&ane(l,r,null),o)for(let e in o){let t=o[e];xt(t)&&(r[e]=t.bind(n))}if(i){let t=i.call(n,n);wt(t)&&(e.data=fn(t))}if(Qi=!0,a)for(let e in a){let t=a[e],i=U({get:xt(t)?t.bind(n,n):xt(t.get)?t.get.bind(n,n):ut,set:!xt(t)&&xt(t.set)?t.set.bind(n):ut});Object.defineProperty(r,e,{enumerable:!0,configurable:!0,get:()=>i.value,set:e=>i.value=e})}if(s)for(let e in s)sne(s[e],r,n,e);if(c){let e=xt(c)?c.call(n):c;Reflect.ownKeys(e).forEach(t=>{dr(t,e[t])})}u&&one(u,e,`c`);function ae(e,t){_t(t)?t.forEach(t=>e(t.bind(n))):t&&e(t.bind(n))}if(ae(Vi,d),ae(Hi,f),ae(Ui,p),ae(ere,m),ae(Jte,h),ae(Yte,g),ae(Qte,w),ae(nre,S),ae(tre,C),ae(Wi,v),ae(Gi,b),ae(Ki,ee),_t(te))if(te.length){let t=e.exposed||={};te.forEach(e=>{Object.defineProperty(t,e,{get:()=>n[e],set:t=>n[e]=t,enumerable:!0})})}else e.exposed||={};x&&e.render===ut&&(e.render=x),ne!=null&&(e.inheritAttrs=ne),re&&(e.components=re),T&&(e.directives=T),ee&&Cr(e)}function ane(e,t,n=ut){_t(e)&&(e=Br(e));for(let n in e){let r=e[n],i;i=wt(r)?`default`in r?fr(r.from||n,r.default,!0):fr(r.from||n):fr(r),xn(i)?Object.defineProperty(t,n,{enumerable:!0,configurable:!0,get:()=>i.value,set:e=>i.value=e}):t[n]=i}}function one(e,t,n){rr(_t(e)?e.map(e=>e.bind(t.proxy)):e.bind(t.proxy),t,n)}function sne(e,t,n,r){let i=r.includes(`.`)?Ite(n,r):()=>n[r];if(St(e)){let n=t[e];xt(n)&&mr(i,n)}else if(xt(e))mr(i,e.bind(n));else if(wt(e))if(_t(e))e.forEach(e=>sne(e,t,n,r));else{let r=xt(e.handler)?e.handler.bind(n):t[e.handler];xt(r)&&mr(i,r,e)}}function Rr(e){let t=e.type,{mixins:n,extends:r}=t,{mixins:i,optionsCache:a,config:{optionMergeStrategies:o}}=e.appContext,s=a.get(t),c;return s?c=s:!i.length&&!n&&!r?c=t:(c={},i.length&&i.forEach(e=>zr(c,e,o,!0)),zr(c,t,o)),wt(t)&&a.set(t,c),c}function zr(e,t,n,r=!1){let{mixins:i,extends:a}=t;a&&zr(e,a,n,!0),i&&i.forEach(t=>zr(e,t,n,!0));for(let i in t)if(!(r&&i===`expose`)){let r=ire[i]||n&&n[i];e[i]=r?r(e[i],t[i]):t[i]}return e}function cne(e,t){return t?e?function(){return mt(xt(e)?e.call(this,this):e,xt(t)?t.call(this,this):t)}:t:e}function lne(e,t){return Hr(Br(e),Br(t))}function Br(e){if(_t(e)){let t={};for(let n=0;n<e.length;n++)t[e[n]]=e[n];return t}return e}function Vr(e,t){return e?[...new Set([].concat(e,t))]:t}function Hr(e,t){return e?mt(Object.create(null),e,t):t}function une(e,t){return e?_t(e)&&_t(t)?[...new Set([...e,...t])]:mt(Object.create(null),Ir(e),Ir(t??{})):t}function dne(e,t){if(!e)return t;if(!t)return e;let n=mt(Object.create(null),e);for(let r in t)n[r]=Vr(e[r],t[r]);return n}function fne(){return{app:null,config:{isNativeTag:dt,performance:!1,globalProperties:{},optionMergeStrategies:{},errorHandler:void 0,warnHandler:void 0,compilerOptions:{}},mixins:[],components:{},directives:{},provides:Object.create(null),optionsCache:new WeakMap,propsCache:new WeakMap,emitsCache:new WeakMap}}function pne(e,t){return function(n,r=null){xt(n)||(n=mt({},n)),r!=null&&!wt(r)&&(r=null);let i=fne(),a=new WeakSet,o=[],s=!1,c=i.app={_uid:are++,_component:n,_props:r,_container:null,_context:i,_instance:null,version:vre,get config(){return i.config},set config(e){},use(e,...t){return a.has(e)||(e&&xt(e.install)?(a.add(e),e.install(c,...t)):xt(e)&&(a.add(e),e(c,...t))),c},mixin(e){return i.mixins.includes(e)||i.mixins.push(e),c},component(e,t){return t?(i.components[e]=t,c):i.components[e]},directive(e,t){return t?(i.directives[e]=t,c):i.directives[e]},mount(a,o,l){if(!s){let u=c._ceVNode||H(n,r);return u.appContext=i,l===!0?l=`svg`:l===!1&&(l=void 0),o&&t?t(u,a):e(u,a,l),s=!0,c._container=a,a.__vue_app__=c,si(u.component)}},onUnmount(e){o.push(e)},unmount(){s&&(rr(o,c._instance,16),e(null,c._container),delete c._container.__vue_app__)},provide(e,t){return i.provides[e]=t,c},runWithContext(e){let t=$i;$i=c;try{return e()}finally{$i=t}}};return c}}function Ur(e,t,n=ct){let r=ba(),i=Mt(t),a=Nt(t),o=ea(e,i),s=tte((o,s)=>{let c,l=ct,u;return Pte(()=>{let t=e[i];It(c,t)&&(c=t,s())}),{get(){return o(),n.get?n.get(c):c},set(e){let o=n.set?n.set(e):e;if(!It(o,c)&&!(l!==ct&&It(e,l)))return;let d=r.vnode.props;d&&(t in d||i in d||a in d)&&(`onUpdate:${t}`in d||`onUpdate:${i}`in d||`onUpdate:${a}`in d)||(c=e,s()),r.emit(`update:${t}`,o),It(e,o)&&It(e,l)&&!It(o,u)&&s(),l=e,u=o}}});return s[Symbol.iterator]=()=>{let e=0;return{next(){return e<2?{value:e++?o||ct:s,done:!1}:{done:!0}}}},s}function mne(e,t,...n){if(e.isUnmounted)return;let r=e.vnode.props||ct,i=n,a=t.startsWith(`update:`),o=a&&ea(r,t.slice(7));o&&(o.trim&&(i=n.map(e=>St(e)?e.trim():e)),o.number&&(i=n.map(zt)));let s,c=r[s=Ft(t)]||r[s=Ft(Mt(t))];!c&&a&&(c=r[s=Ft(Nt(t))]),c&&rr(c,e,6,i);let l=r[s+`Once`];if(l){if(!e.emitted)e.emitted={};else if(e.emitted[s])return;e.emitted[s]=!0,rr(l,e,6,i)}}function hne(e,t,n=!1){let r=n?ore:t.emitsCache,i=r.get(e);if(i!==void 0)return i;let a=e.emits,o={},s=!1;if(!xt(e)){let r=e=>{let n=hne(e,t,!0);n&&(s=!0,mt(o,n))};!n&&t.mixins.length&&t.mixins.forEach(r),e.extends&&r(e.extends),e.mixins&&e.mixins.forEach(r)}return!a&&!s?(wt(e)&&r.set(e,null),null):(_t(a)?a.forEach(e=>o[e]=null):mt(o,a),wt(e)&&r.set(e,o),o)}function Wr(e,t){return!e||!ft(t)?!1:(t=t.slice(2).replace(/Once$/,``),gt(e,t[0].toLowerCase()+t.slice(1))||gt(e,Nt(t))||gt(e,t))}function Gr(e){let{type:t,vnode:n,proxy:r,withProxy:i,propsOptions:[a],slots:o,attrs:s,emit:c,render:l,renderCache:u,props:d,data:f,setupState:p,ctx:m,inheritAttrs:h}=e,g=cr(e),_,v;try{if(n.shapeFlag&4){let e=i||r,t=e;_=ni(l.call(t,e,u,d,p,f,m)),v=s}else{let e=t;_=ni(e.length>1?e(d,{attrs:s,slots:o,emit:c}):e(d,null)),v=t.props?s:sre(s)}}catch(t){ma.length=0,ir(t,e,1),_=H(fa)}let y=_;if(v&&h!==!1){let e=Object.keys(v),{shapeFlag:t}=y;e.length&&t&7&&(a&&e.some(pt)&&(v=cre(v,a)),y=ei(y,v,!1,!0))}return n.dirs&&(y=ei(y,null,!1,!0),y.dirs=y.dirs?y.dirs.concat(n.dirs):n.dirs),n.transition&&xr(y,n.transition),_=y,cr(g),_}function gne(e,t,n){let{props:r,children:i,component:a}=e,{props:o,children:s,patchFlag:c}=t,l=a.emitsOptions;if(t.dirs||t.transition)return!0;if(n&&c>=0){if(c&1024)return!0;if(c&16)return r?_ne(r,o,l):!!o;if(c&8){let e=t.dynamicProps;for(let t=0;t<e.length;t++){let n=e[t];if(vne(o,r,n)&&!Wr(l,n))return!0}}}else return(i||s)&&(!s||!s.$stable)?!0:r===o?!1:r?o?_ne(r,o,l):!0:!!o;return!1}function _ne(e,t,n){let r=Object.keys(t);if(r.length!==Object.keys(e).length)return!0;for(let i=0;i<r.length;i++){let a=r[i];if(vne(t,e,a)&&!Wr(n,a))return!0}return!1}function vne(e,t,n){let r=e[n],i=t[n];return n===`style`&&wt(r)&&wt(i)?!ot(r,i):r!==i}function yne({vnode:e,parent:t},n){for(;t;){let r=t.subTree;if(r.suspense&&r.suspense.activeBranch===e&&(r.el=e.el),r===e)(e=t.vnode).el=n,t=t.parent;else break}}function bne(e,t,n,r=!1){let i={},a=na();e.propsDefaults=Object.create(null),Sne(e,t,i,a);for(let t in e.propsOptions[0])t in i||(i[t]=void 0);n?e.props=r?i:Xee(i):e.type.props?e.props=i:e.props=a,e.attrs=a}function xne(e,t,n,r){let{props:i,attrs:a,vnode:{patchFlag:o}}=e,s=bn(i),[c]=e.propsOptions,l=!1;if((r||o>0)&&!(o&16)){if(o&8){let n=e.vnode.dynamicProps;for(let r=0;r<n.length;r++){let o=n[r];if(Wr(e.emitsOptions,o))continue;let u=t[o];if(c)if(gt(a,o))u!==a[o]&&(a[o]=u,l=!0);else{let t=Mt(o);i[t]=Kr(c,s,t,u,e,!1)}else u!==a[o]&&(a[o]=u,l=!0)}}}else{Sne(e,t,i,a)&&(l=!0);let r;for(let a in s)(!t||!gt(t,a)&&((r=Nt(a))===a||!gt(t,r)))&&(c?n&&(n[a]!==void 0||n[r]!==void 0)&&(i[a]=Kr(c,s,a,void 0,e,!0)):delete i[a]);if(a!==s)for(let e in a)(!t||!gt(t,e))&&(delete a[e],l=!0)}l&&tn(e.attrs,`set`,``)}function Sne(e,t,n,r){let[i,a]=e.propsOptions,o=!1,s;if(t)for(let c in t){if(At(c))continue;let l=t[c],u;i&&gt(i,u=Mt(c))?!a||!a.includes(u)?n[u]=l:(s||={})[u]=l:Wr(e.emitsOptions,c)||(!(c in r)||l!==r[c])&&(r[c]=l,o=!0)}if(a){let t=bn(n),r=s||ct;for(let o=0;o<a.length;o++){let s=a[o];n[s]=Kr(i,t,s,r[s],e,!gt(r,s))}}return o}function Kr(e,t,n,r,i,a){let o=e[n];if(o!=null){let e=gt(o,`default`);if(e&&r===void 0){let e=o.default;if(o.type!==Function&&!o.skipFactory&&xt(e)){let{propsDefaults:a}=i;if(n in a)r=a[n];else{let o=Ca(i);r=a[n]=e.call(null,t),o()}}else r=e;i.ce&&i.ce._setProp(n,r)}o[0]&&(a&&!e?r=!1:o[1]&&(r===``||r===Nt(n))&&(r=!0))}return r}function Cne(e,t,n=!1){let r=n?lre:t.propsCache,i=r.get(e);if(i)return i;let a=e.props,o={},s=[],c=!1;if(!xt(e)){let r=e=>{c=!0;let[n,r]=Cne(e,t,!0);mt(o,n),r&&s.push(...r)};!n&&t.mixins.length&&t.mixins.forEach(r),e.extends&&r(e.extends),e.mixins&&e.mixins.forEach(r)}if(!a&&!c)return wt(e)&&r.set(e,lt),lt;if(_t(a))for(let e=0;e<a.length;e++){let t=Mt(a[e]);wne(t)&&(o[t]=ct)}else if(a)for(let e in a){let t=Mt(e);if(wne(t)){let n=a[e],r=o[t]=_t(n)||xt(n)?{type:n}:mt({},n),i=r.type,c=!1,l=!0;if(_t(i))for(let e=0;e<i.length;++e){let t=i[e],n=xt(t)&&t.name;if(n===`Boolean`){c=!0;break}else n===`String`&&(l=!1)}else c=xt(i)&&i.name===`Boolean`;r[0]=c,r[1]=l,(c||gt(r,`default`))&&s.push(t)}}let l=[o,s];return wt(e)&&r.set(e,l),l}function wne(e){return e[0]!==`$`&&!At(e)}function Tne(e){return Dne(e)}function Ene(e){return Dne(e,Gte)}function Dne(e,t){let n=Bt();n.__VUE__=!0;let{insert:r,remove:i,patchProp:a,createElement:o,createText:s,createComment:c,setText:l,setElementText:u,parentNode:d,nextSibling:f,setScopeId:p=ut,insertStaticContent:m}=e,h=(e,t,n,r=null,i=null,a=null,o=void 0,s=null,c=!!t.dynamicChildren)=>{if(e===t)return;e&&!Qr(e,t)&&(r=he(e),ue(e,i,a,!0),e=null),t.patchFlag===-2&&(c=!1,t.dynamicChildren=null);let{type:l,ref:u,shapeFlag:d}=t;switch(l){case da:g(e,t,n,r);break;case fa:_(e,t,n,r);break;case pa:e??v(t,n,r,o);break;case V:re(e,t,n,r,i,a,o,s,c);break;default:d&1?x(e,t,n,r,i,a,o,s,c):d&6?T(e,t,n,r,i,a,o,s,c):(d&64||d&128)&&l.process(e,t,n,r,i,a,o,s,c,ve)}u!=null&&i?Tr(u,e&&e.ref,a,t||e,!t):u==null&&e&&e.ref!=null&&Tr(e.ref,null,a,e,!0)},g=(e,t,n,i)=>{if(e==null)r(t.el=s(t.children),n,i);else{let n=t.el=e.el;t.children!==e.children&&l(n,t.children)}},_=(e,t,n,i)=>{e==null?r(t.el=c(t.children||``),n,i):t.el=e.el},v=(e,t,n,r)=>{[e.el,e.anchor]=m(e.children,t,n,r,e.el,e.anchor)},y=({el:e,anchor:t},n,i)=>{let a;for(;e&&e!==t;)a=f(e),r(e,n,i),e=a;r(t,n,i)},b=({el:e,anchor:t})=>{let n;for(;e&&e!==t;)n=f(e),i(e),e=n;i(t)},x=(e,t,n,r,i,a,o,s,c)=>{if(t.type===`svg`?o=`svg`:t.type===`math`&&(o=`mathml`),e==null)S(t,n,r,i,a,o,s,c);else{let n=e.el&&e.el._isVueCE?e.el:null;try{n&&n._beginPatch(),ee(e,t,i,a,o,s,c)}finally{n&&n._endPatch()}}},S=(e,t,n,i,s,c,l,d)=>{let f,p,{props:m,shapeFlag:h,transition:g,dirs:_}=e;if(f=e.el=o(e.type,c,m&&m.is,m),h&8?u(f,e.children):h&16&&w(e.children,f,null,i,s,qr(e,c),l,d),_&&ur(e,null,i,`created`),C(f,e,e.scopeId,l,i),m){for(let e in m)e!==`value`&&!At(e)&&a(f,e,null,m[e],c,i);`value`in m&&a(f,`value`,null,m.value,c),(p=m.onVnodeBeforeMount)&&oi(p,i,e)}_&&ur(e,null,i,`beforeMount`);let v=One(s,g);v&&g.beforeEnter(f),r(f,t,n),((p=m&&m.onVnodeMounted)||v||_)&&la(()=>{p&&oi(p,i,e),v&&g.enter(f),_&&ur(e,null,i,`mounted`)},s)},C=(e,t,n,r,i)=>{if(n&&p(e,n),r)for(let t=0;t<r.length;t++)p(e,r[t]);if(i){let n=i.subTree;if(t===n||ua(n.type)&&(n.ssContent===t||n.ssFallback===t)){let t=i.vnode;C(e,t,t.scopeId,t.slotScopeIds,i.parent)}}},w=(e,t,n,r,i,a,o,s,c=0)=>{for(let l=c;l<e.length;l++)h(null,e[l]=s?ri(e[l]):ni(e[l]),t,n,r,i,a,o,s)},ee=(e,t,n,r,i,o,s)=>{let c=t.el=e.el,{patchFlag:l,dynamicChildren:d,dirs:f}=t;l|=e.patchFlag&16;let p=e.props||ct,m=t.props||ct,h;if(n&&Jr(n,!1),(h=m.onVnodeBeforeUpdate)&&oi(h,n,t,e),f&&ur(t,e,n,`beforeUpdate`),n&&Jr(n,!0),(p.innerHTML&&m.innerHTML==null||p.textContent&&m.textContent==null)&&u(c,``),d?te(e.dynamicChildren,d,c,n,r,qr(t,i),o):s||oe(e,t,c,null,n,r,qr(t,i),o,!1),l>0){if(l&16)ne(c,p,m,n,i);else if(l&2&&p.class!==m.class&&a(c,`class`,null,m.class,i),l&4&&a(c,`style`,p.style,m.style,i),l&8){let e=t.dynamicProps;for(let t=0;t<e.length;t++){let r=e[t],o=p[r],s=m[r];(s!==o||r===`value`)&&a(c,r,o,s,i,n)}}l&1&&e.children!==t.children&&u(c,t.children)}else !s&&d==null&&ne(c,p,m,n,i);((h=m.onVnodeUpdated)||f)&&la(()=>{h&&oi(h,n,t,e),f&&ur(t,e,n,`updated`)},r)},te=(e,t,n,r,i,a,o)=>{for(let s=0;s<t.length;s++){let c=e[s],l=t[s];h(c,l,c.el&&(c.type===V||!Qr(c,l)||c.shapeFlag&198)?d(c.el):n,null,r,i,a,o,!0)}},ne=(e,t,n,r,i)=>{if(t!==n){if(t!==ct)for(let o in t)!At(o)&&!(o in n)&&a(e,o,t[o],null,i,r);for(let o in n){if(At(o))continue;let s=n[o],c=t[o];s!==c&&o!==`value`&&a(e,o,c,s,i,r)}`value`in n&&a(e,`value`,t.value,n.value,i)}},re=(e,t,n,i,a,o,c,l,u)=>{let d=t.el=e?e.el:s(``),f=t.anchor=e?e.anchor:s(``),{patchFlag:p,dynamicChildren:m,slotScopeIds:h}=t;h&&(l=l?l.concat(h):h),e==null?(r(d,n,i),r(f,n,i),w(t.children||[],n,f,a,o,c,l,u)):p>0&&p&64&&m&&e.dynamicChildren&&e.dynamicChildren.length===m.length?(te(e.dynamicChildren,m,n,a,o,c,l),(t.key!=null||a&&t===a.subTree)&&Yr(e,t,!0)):oe(e,t,n,f,a,o,c,l,u)},T=(e,t,n,r,i,a,o,s,c)=>{t.slotScopeIds=s,e==null?t.shapeFlag&512?i.ctx.activate(t,n,r,o,c):ie(t,n,r,i,a,o,c):ae(e,t,c)},ie=(e,t,n,r,i,a,o)=>{let s=e.component=Lne(e,r,i);if(zi(e)&&(s.ctx.renderer=ve),zne(s,!1,o),s.asyncDep){if(i&&i.registerDep(s,E,o),!e.el){let r=s.subTree=H(fa);_(null,r,t,n),e.placeholder=r.el}}else E(s,e,t,n,i,a,o)},ae=(e,t,n)=>{let r=t.component=e.component;if(gne(e,t,n))if(r.asyncDep&&!r.asyncResolved){D(r,t,n);return}else r.next=t,r.update();else t.el=e.el,r.vnode=t},E=(e,t,n,r,i,a,o)=>{let s=()=>{if(e.isMounted){let{next:t,bu:n,u:r,parent:s,vnode:c}=e;{let n=Ane(e);if(n){t&&(t.el=c.el,D(e,t,o)),n.asyncDep.then(()=>{la(()=>{e.isUnmounted||l()},i)});return}}let u=t,f;Jr(e,!1),t?(t.el=c.el,D(e,t,o)):t=c,n&&Lt(n),(f=t.props&&t.props.onVnodeBeforeUpdate)&&oi(f,s,t,c),Jr(e,!0);let p=Gr(e),m=e.subTree;e.subTree=p,h(m,p,d(m.el),he(m),e,i,a),t.el=p.el,u===null&&yne(e,p.el),r&&la(r,i),(f=t.props&&t.props.onVnodeUpdated)&&la(()=>oi(f,s,t,c),i)}else{let o,{el:s,props:c}=t,{bm:l,m:u,parent:d,root:f,type:p}=e,m=Ri(t);if(Jr(e,!1),l&&Lt(l),!m&&(o=c&&c.onVnodeBeforeMount)&&oi(o,d,t),Jr(e,!0),s&&be){let t=()=>{e.subTree=Gr(e),be(s,e.subTree,e,i,null)};m&&p.__asyncHydrate?p.__asyncHydrate(s,e,t):t()}else{f.ce&&f.ce._hasShadowRoot()&&f.ce._injectChildStyle(p,e.parent?e.parent.type:void 0);let o=e.subTree=Gr(e);h(null,o,n,r,e,i,a),t.el=o.el}if(u&&la(u,i),!m&&(o=c&&c.onVnodeMounted)){let e=t;la(()=>oi(o,d,e),i)}(t.shapeFlag&256||d&&Ri(d.vnode)&&d.vnode.shapeFlag&256)&&e.a&&la(e.a,i),e.isMounted=!0,t=n=r=null}};e.scope.on();let c=e.effect=new kn(s);e.scope.off();let l=e.update=c.run.bind(c),u=e.job=c.runIfDirty.bind(c);u.i=e,u.id=e.uid,c.scheduler=()=>or(u),Jr(e,!0),l()},D=(e,t,n)=>{t.component=e;let r=e.vnode.props;e.vnode=t,e.next=null,xne(e,t.props,r,n),fre(e,t.children,n),Qt(),jte(e),$t()},oe=(e,t,n,r,i,a,o,s,c=!1)=>{let l=e&&e.children,d=e?e.shapeFlag:0,f=t.children,{patchFlag:p,shapeFlag:m}=t;if(p>0){if(p&128){ce(l,f,n,r,i,a,o,s,c);return}else if(p&256){se(l,f,n,r,i,a,o,s,c);return}}m&8?(d&16&&me(l,i,a),f!==l&&u(n,f)):d&16?m&16?ce(l,f,n,r,i,a,o,s,c):me(l,i,a,!0):(d&8&&u(n,``),m&16&&w(f,n,r,i,a,o,s,c))},se=(e,t,n,r,i,a,o,s,c)=>{e||=lt,t||=lt;let l=e.length,u=t.length,d=Math.min(l,u),f;for(f=0;f<d;f++){let r=t[f]=c?ri(t[f]):ni(t[f]);h(e[f],r,n,null,i,a,o,s,c)}l>u?me(e,i,a,!0,!1,d):w(t,n,r,i,a,o,s,c,d)},ce=(e,t,n,r,i,a,o,s,c)=>{let l=0,u=t.length,d=e.length-1,f=u-1;for(;l<=d&&l<=f;){let r=e[l],u=t[l]=c?ri(t[l]):ni(t[l]);if(Qr(r,u))h(r,u,n,null,i,a,o,s,c);else break;l++}for(;l<=d&&l<=f;){let r=e[d],l=t[f]=c?ri(t[f]):ni(t[f]);if(Qr(r,l))h(r,l,n,null,i,a,o,s,c);else break;d--,f--}if(l>d){if(l<=f){let e=f+1,d=e<u?t[e].el:r;for(;l<=f;)h(null,t[l]=c?ri(t[l]):ni(t[l]),n,d,i,a,o,s,c),l++}}else if(l>f)for(;l<=d;)ue(e[l],i,a,!0),l++;else{let p=l,m=l,g=new Map;for(l=m;l<=f;l++){let e=t[l]=c?ri(t[l]):ni(t[l]);e.key!=null&&g.set(e.key,l)}let _,v=0,y=f-m+1,b=!1,x=0,S=Array(y);for(l=0;l<y;l++)S[l]=0;for(l=p;l<=d;l++){let r=e[l];if(v>=y){ue(r,i,a,!0);continue}let u;if(r.key!=null)u=g.get(r.key);else for(_=m;_<=f;_++)if(S[_-m]===0&&Qr(r,t[_])){u=_;break}u===void 0?ue(r,i,a,!0):(S[u-m]=l+1,u>=x?x=u:b=!0,h(r,t[u],n,null,i,a,o,s,c),v++)}let C=b?kne(S):lt;for(_=C.length-1,l=y-1;l>=0;l--){let e=m+l,d=t[e],f=t[e+1],p=e+1<u?f.el||Mne(f):r;S[l]===0?h(null,d,n,p,i,a,o,s,c):b&&(_<0||l!==C[_]?le(d,n,p,2):_--)}}},le=(e,t,n,a,o=null)=>{let{el:s,type:c,transition:l,children:u,shapeFlag:d}=e;if(d&6){le(e.component.subTree,t,n,a);return}if(d&128){e.suspense.move(t,n,a);return}if(d&64){c.move(e,t,n,ve);return}if(c===V){r(s,t,n);for(let e=0;e<u.length;e++)le(u[e],t,n,a);r(e.anchor,t,n);return}if(c===pa){y(e,t,n);return}if(a!==2&&d&1&&l)if(a===0)l.beforeEnter(s),r(s,t,n),la(()=>l.enter(s),o);else{let{leave:a,delayLeave:o,afterLeave:c}=l,u=()=>{e.ctx.isUnmounted?i(s):r(s,t,n)},d=()=>{s._isLeaving&&s[Oi](!0),a(s,()=>{u(),c&&c()})};o?o(s,u,d):d()}else r(s,t,n)},ue=(e,t,n,r=!1,i=!1)=>{let{type:a,props:o,ref:s,children:c,dynamicChildren:l,shapeFlag:u,patchFlag:d,dirs:f,cacheIndex:p}=e;if(d===-2&&(i=!1),s!=null&&(Qt(),Tr(s,null,n,e,!0),$t()),p!=null&&(t.renderCache[p]=void 0),u&256){t.ctx.deactivate(e);return}let m=u&1&&f,h=!Ri(e),g;if(h&&(g=o&&o.onVnodeBeforeUnmount)&&oi(g,t,e),u&6)pe(e.component,n,r);else{if(u&128){e.suspense.unmount(n,r);return}m&&ur(e,null,t,`beforeUnmount`),u&64?e.type.remove(e,t,n,ve,r):l&&!l.hasOnce&&(a!==V||d>0&&d&64)?me(l,t,n,!1,!0):(a===V&&d&384||!i&&u&16)&&me(c,t,n),r&&de(e)}(h&&(g=o&&o.onVnodeUnmounted)||m)&&la(()=>{g&&oi(g,t,e),m&&ur(e,null,t,`unmounted`)},n)},de=e=>{let{type:t,el:n,anchor:r,transition:a}=e;if(t===V){fe(n,r);return}if(t===pa){b(e);return}let o=()=>{i(n),a&&!a.persisted&&a.afterLeave&&a.afterLeave()};if(e.shapeFlag&1&&a&&!a.persisted){let{leave:t,delayLeave:r}=a,i=()=>t(n,o);r?r(e.el,o,i):i()}else o()},fe=(e,t)=>{let n;for(;e!==t;)n=f(e),i(e),e=n;i(t)},pe=(e,t,n)=>{let{bum:r,scope:i,job:a,subTree:o,um:s,m:c,a:l}=e;jne(c),jne(l),r&&Lt(r),i.stop(),a&&(a.flags|=8,ue(o,e,t,n)),s&&la(s,t),la(()=>{e.isUnmounted=!0},t)},me=(e,t,n,r=!1,i=!1,a=0)=>{for(let o=a;o<e.length;o++)ue(e[o],t,n,r,i)},he=e=>{if(e.shapeFlag&6)return he(e.component.subTree);if(e.shapeFlag&128)return e.suspense.next();let t=f(e.anchor||e.el),n=t&&t[yi];return n?f(n):t},ge=!1,_e=(e,t,n)=>{let r;e==null?t._vnode&&(ue(t._vnode,null,null,!0),r=t._vnode.component):h(t._vnode||null,e,t,null,null,null,n),t._vnode=e,ge||=(ge=!0,jte(r),sr(),!1)},ve={p:h,um:ue,m:le,r:de,mt:ie,mc:w,pc:oe,pbc:te,n:he,o:e},ye,be;return t&&([ye,be]=t(ve)),{render:_e,hydrate:ye,createApp:pne(_e,ye)}}function qr({type:e,props:t},n){return n===`svg`&&e===`foreignObject`||n===`mathml`&&e===`annotation-xml`&&t&&t.encoding&&t.encoding.includes(`html`)?void 0:n}function Jr({effect:e,job:t},n){n?(e.flags|=32,t.flags|=4):(e.flags&=-33,t.flags&=-5)}function One(e,t){return(!e||e&&!e.pendingBranch)&&t&&!t.persisted}function Yr(e,t,n=!1){let r=e.children,i=t.children;if(_t(r)&&_t(i))for(let e=0;e<r.length;e++){let t=r[e],a=i[e];a.shapeFlag&1&&!a.dynamicChildren&&((a.patchFlag<=0||a.patchFlag===32)&&(a=i[e]=ri(i[e]),a.el=t.el),!n&&a.patchFlag!==-2&&Yr(t,a)),a.type===da&&(a.patchFlag===-1&&(a=i[e]=ri(a)),a.el=t.el),a.type===fa&&!a.el&&(a.el=t.el)}}function kne(e){let t=e.slice(),n=[0],r,i,a,o,s,c=e.length;for(r=0;r<c;r++){let c=e[r];if(c!==0){if(i=n[n.length-1],e[i]<c){t[r]=i,n.push(r);continue}for(a=0,o=n.length-1;a<o;)s=a+o>>1,e[n[s]]<c?a=s+1:o=s;c<e[n[a]]&&(a>0&&(t[r]=n[a-1]),n[a]=r)}}for(a=n.length,o=n[a-1];a-- >0;)n[a]=o,o=t[o];return n}function Ane(e){let t=e.subTree.component;if(t)return t.asyncDep&&!t.asyncResolved?t:Ane(t)}function jne(e){if(e)for(let t=0;t<e.length;t++)e[t].flags|=8}function Mne(e){if(e.placeholder)return e.placeholder;let t=e.component;return t?Mne(t.subTree):null}function Nne(e,t){t&&t.pendingBranch?_t(e)?t.effects.push(...e):t.effects.push(e):Ate(e)}function F(e=!1){ma.push(ha=e?null:[])}function Pne(){ma.pop(),ha=ma[ma.length-1]||null}function Xr(e,t=!1){ga+=e,e<0&&ha&&t&&(ha.hasOnce=!0)}function Fne(e){return e.dynamicChildren=ga>0?ha||lt:null,Pne(),ga>0&&ha&&ha.push(e),e}function I(e,t,n,r,i,a){return Fne(R(e,t,n,r,i,a,!0))}function L(e,t,n,r,i){return Fne(H(e,t,n,r,i,!0))}function Zr(e){return e?e.__v_isVNode===!0:!1}function Qr(e,t){return e.type===t.type&&e.key===t.key}function R(e,t=null,n=null,r=0,i=null,a=e===V?0:1,o=!1,s=!1){let c={__v_isVNode:!0,__v_skip:!0,type:e,props:t,key:t&&_a(t),ref:t&&va(t),scopeId:vi,slotScopeIds:null,children:n,component:null,suspense:null,ssContent:null,ssFallback:null,dirs:null,transition:null,el:null,anchor:null,target:null,targetStart:null,targetAnchor:null,staticCount:0,shapeFlag:a,patchFlag:r,dynamicProps:i,dynamicChildren:null,appContext:null,ctx:_i};return s?(ii(c,n),a&128&&e.normalize(c)):n&&(c.shapeFlag|=St(n)?8:16),ga>0&&!o&&ha&&(c.patchFlag>0||a&6)&&c.patchFlag!==32&&ha.push(c),c}function Ine(e,t=null,n=null,r=0,i=null,a=!1){if((!e||e===Ji)&&(e=fa),Zr(e)){let r=ei(e,t,!0);return n&&ii(r,n),ga>0&&!a&&ha&&(r.shapeFlag&6?ha[ha.indexOf(e)]=r:ha.push(r)),r.patchFlag=-2,r}if(Gne(e)&&(e=e.__vccOpts),t){t=$r(t);let{class:e,style:n}=t;e&&!St(e)&&(t.class=O(e)),wt(n)&&(yn(n)&&!_t(n)&&(n=mt({},n)),t.style=it(n))}let o=St(e)?1:ua(e)?128:bi(e)?64:wt(e)?4:xt(e)?2:0;return R(e,t,n,r,i,o,a,!0)}function $r(e){return e?yn(e)||ra(e)?mt({},e):e:null}function ei(e,t,n=!1,r=!1){let{props:i,ref:a,patchFlag:o,children:s,transition:c}=e,l=t?ai(i||{},t):i,u={__v_isVNode:!0,__v_skip:!0,type:e.type,props:l,key:l&&_a(l),ref:t&&t.ref?n&&a?_t(a)?a.concat(va(t)):[a,va(t)]:va(t):a,scopeId:e.scopeId,slotScopeIds:e.slotScopeIds,children:s,target:e.target,targetStart:e.targetStart,targetAnchor:e.targetAnchor,staticCount:e.staticCount,shapeFlag:e.shapeFlag,patchFlag:t&&e.type!==V?o===-1?16:o|16:o,dynamicProps:e.dynamicProps,dynamicChildren:e.dynamicChildren,appContext:e.appContext,dirs:e.dirs,transition:c,component:e.component,suspense:e.suspense,ssContent:e.ssContent&&ei(e.ssContent),ssFallback:e.ssFallback&&ei(e.ssFallback),placeholder:e.placeholder,el:e.el,anchor:e.anchor,ctx:e.ctx,ce:e.ce};return c&&r&&xr(u,c.clone(u)),u}function z(e=` `,t=0){return H(da,null,e,t)}function ti(e,t){let n=H(pa,null,e);return n.staticCount=t,n}function B(e=``,t=!1){return t?(F(),L(fa,null,e)):H(fa,null,e)}function ni(e){return e==null||typeof e==`boolean`?H(fa):_t(e)?H(V,null,e.slice()):Zr(e)?ri(e):H(da,null,String(e))}function ri(e){return e.el===null&&e.patchFlag!==-1||e.memo?e:ei(e)}function ii(e,t){let n=0,{shapeFlag:r}=e;if(t==null)t=null;else if(_t(t))n=16;else if(typeof t==`object`)if(r&65){let n=t.default;n&&(n._c&&(n._d=!1),ii(e,n()),n._c&&(n._d=!0));return}else{n=32;let r=t._;!r&&!ra(t)?t._ctx=_i:r===3&&_i&&(_i.slots._===1?t._=1:(t._=2,e.patchFlag|=1024))}else xt(t)?(t={default:t,_ctx:_i},n=32):(t=String(t),r&64?(n=16,t=[z(t)]):n=8);e.children=t,e.shapeFlag|=n}function ai(...e){let t={};for(let n=0;n<e.length;n++){let r=e[n];for(let e in r)if(e===`class`)t.class!==r.class&&(t.class=O([t.class,r.class]));else if(e===`style`)t.style=it([t.style,r.style]);else if(ft(e)){let n=t[e],i=r[e];i&&n!==i&&!(_t(n)&&n.includes(i))&&(t[e]=n?[].concat(n,i):i)}else e!==``&&(t[e]=r[e])}return t}function oi(e,t,n,r=null){rr(e,t,7,[n,r])}function Lne(e,t,n){let r=e.type,i=(t?t.appContext:e.appContext)||pre,a={uid:mre++,vnode:e,type:r,parent:t,appContext:i,root:null,next:null,subTree:null,effect:null,update:null,job:null,scope:new ste(!0),render:null,proxy:null,exposed:null,exposeProxy:null,withProxy:null,provides:t?t.provides:Object.create(i.provides),ids:t?t.ids:[``,0,0],accessCache:null,renderCache:[],components:null,directives:null,propsOptions:Cne(r,i),emitsOptions:hne(r,i),emit:null,emitted:null,propsDefaults:ct,inheritAttrs:r.inheritAttrs,ctx:ct,data:ct,props:ct,attrs:ct,slots:ct,refs:ct,setupState:ct,setupContext:null,suspense:n,suspenseId:n?n.pendingId:0,asyncDep:null,asyncResolved:!1,isMounted:!1,isUnmounted:!1,isDeactivated:!1,bc:null,c:null,bm:null,m:null,bu:null,u:null,um:null,bum:null,da:null,a:null,rtg:null,rtc:null,ec:null,sp:null};return a.ctx={_:a},a.root=t?t.root:a,a.emit=mne.bind(null,a),e.ce&&e.ce(a),a}function Rne(e){return e.vnode.shapeFlag&4}function zne(e,t=!1,n=!1){t&&Sa(t);let{props:r,children:i}=e.vnode,a=Rne(e);bne(e,r,a,t),dre(e,i,n||t);let o=a?Bne(e,t):void 0;return t&&Sa(!1),o}function Bne(e,t){let n=e.type;e.accessCache=Object.create(null),e.proxy=new Proxy(e.ctx,rre);let{setup:r}=n;if(r){Qt();let n=e.setupContext=r.length>1?Une(e):null,i=Ca(e),a=nr(r,e,0,[e.props,n]),o=Tt(a);if($t(),i(),(o||e.sp)&&!Ri(e)&&Cr(e),o){if(a.then(wa,wa),t)return a.then(n=>{Vne(e,n,t)}).catch(t=>{ir(t,e,0)});e.asyncDep=a}else Vne(e,a,t)}else Hne(e,t)}function Vne(e,t,n){xt(t)?e.type.__ssrInlineRender?e.ssrRender=t:e.render=t:wt(t)&&(e.setupState=ete(t)),Hne(e,n)}function Hne(e,t,n){let r=e.type;if(!e.render){if(!t&&hre&&!r.render){let t=r.template||Rr(e).template;if(t){let{isCustomElement:n,compilerOptions:i}=e.appContext.config,{delimiters:a,compilerOptions:o}=r;r.render=hre(t,mt(mt({isCustomElement:n,delimiters:a},i),o))}}e.render=r.render||ut,gre&&gre(e)}{let t=Ca(e);Qt();try{ine(e)}finally{$t(),t()}}}function Une(e){return{attrs:new Proxy(e.attrs,_re),slots:e.slots,emit:e.emit,expose:t=>{e.exposed=t||{}}}}function si(e){return e.exposed?e.exposeProxy||=new Proxy(ete(Zee(e.exposed)),{get(t,n){if(n in t)return t[n];if(n in Xi)return Xi[n](e)},has(e,t){return t in e||t in Xi}}):e.proxy}function Wne(e,t=!0){return xt(e)?e.displayName||e.name:e.name||t&&e.__name}function Gne(e){return xt(e)&&`__vccOpts`in e}function ci(e,t,n){try{Xr(-1);let r=arguments.length;return r===2?wt(t)&&!_t(t)?Zr(t)?H(e,null,[t]):H(e,t):H(e,null,t):(r>3?n=Array.prototype.slice.call(arguments,2):r===3&&Zr(n)&&(n=[n]),H(e,t,n))}finally{Xr(1)}}var li,ui,di,fi,pi,mi,hi,gi,_i,vi,Kne,qne,yi,bi,xi,Si,Ci,wi,Ti,Ei,Di,Oi,ki,Ai,ji,Mi,Jne,Yne,Ni,Xne,Pi,Zne,Qne,Fi,Ii,Li,$ne,Ri,zi,Bi,Vi,Hi,Ui,ere,Wi,Gi,Ki,tre,nre,qi,Ji,Yi,Xi,Zi,rre,Qi,ire,are,$i,ea,ore,sre,cre,ta,na,ra,lre,ia,aa,ure,oa,sa,ca,dre,fre,la,ua,V,da,fa,pa,ma,ha,ga,_a,va,H,pre,mre,ya,ba,xa,Sa,Ca,wa,Ta,hre,gre,_re,U,vre,Ea=s((()=>{Ete(),Gt(),li=[],ui=-1,di=[],fi=null,pi=0,mi=Promise.resolve(),hi=null,gi=e=>e.id==null?e.flags&2?-1:1/0:e.id,_i=null,vi=null,Kne=Symbol.for(`v-scx`),qne=()=>fr(Kne),yi=Symbol(`_vte`),bi=e=>e.__isTeleport,xi=e=>e&&(e.disabled||e.disabled===``),Si=e=>e&&(e.defer||e.defer===``),Ci=e=>typeof SVGElement<`u`&&e instanceof SVGElement,wi=e=>typeof MathMLElement==`function`&&e instanceof MathMLElement,Ti=(e,t)=>{let n=e&&e.to;return St(n)?t?t(n):null:n},Ei={name:`Teleport`,__isTeleport:!0,process(e,t,n,r,i,a,o,s,c,l){let{mc:u,pc:d,pbc:f,o:{insert:p,querySelector:m,createText:h,createComment:g}}=l,_=xi(t.props),{shapeFlag:v,children:y,dynamicChildren:b}=t;if(e==null){let e=t.el=h(``),l=t.anchor=h(``);p(e,n,r),p(l,n,r);let d=(e,t)=>{v&16&&u(y,e,t,i,a,o,s,c)},f=()=>{let e=t.target=Ti(t.props,m),n=vr(e,t,h,p);e&&(o!==`svg`&&Ci(e)?o=`svg`:o!==`mathml`&&wi(e)&&(o=`mathml`),i&&i.isCE&&(i.ce._teleportTargets||(i.ce._teleportTargets=new Set)).add(e),_||(d(e,n),_r(t,!1)))};_&&(d(n,l),_r(t,!0)),Si(t.props)?(t.el.__isMounted=!1,la(()=>{f(),delete t.el.__isMounted},a)):f()}else{if(Si(t.props)&&e.el.__isMounted===!1){la(()=>{Ei.process(e,t,n,r,i,a,o,s,c,l)},a);return}t.el=e.el,t.targetStart=e.targetStart;let u=t.anchor=e.anchor,p=t.target=e.target,h=t.targetAnchor=e.targetAnchor,g=xi(e.props),v=g?n:p,y=g?u:h;if(o===`svg`||Ci(p)?o=`svg`:(o===`mathml`||wi(p))&&(o=`mathml`),b?(f(e.dynamicChildren,b,v,i,a,o,s),Yr(e,t,!0)):c||d(e,t,v,y,i,a,o,s,!1),_)g?t.props&&e.props&&t.props.to!==e.props.to&&(t.props.to=e.props.to):gr(t,n,u,l,1);else if((t.props&&t.props.to)!==(e.props&&e.props.to)){let e=t.target=Ti(t.props,m);e&&gr(t,e,null,l,0)}else g&&gr(t,p,h,l,1);_r(t,_)}},remove(e,t,n,{um:r,o:{remove:i}},a){let{shapeFlag:o,children:s,anchor:c,targetStart:l,targetAnchor:u,target:d,props:f}=e;if(d&&(i(l),i(u)),a&&i(c),o&16){let e=a||!xi(f);for(let i=0;i<s.length;i++){let a=s[i];r(a,t,n,e,!!a.dynamicChildren)}}},move:gr,hydrate:Lte},Di=Ei,Oi=Symbol(`_leaveCb`),ki=Symbol(`_enterCb`),Ai=[Function,Array],ji={mode:String,appear:Boolean,persisted:Boolean,onBeforeEnter:Ai,onEnter:Ai,onAfterEnter:Ai,onEnterCancelled:Ai,onBeforeLeave:Ai,onLeave:Ai,onAfterLeave:Ai,onLeaveCancelled:Ai,onBeforeAppear:Ai,onAppear:Ai,onAfterAppear:Ai,onAppearCancelled:Ai},Mi=e=>{let t=e.subTree;return t.component?Mi(t.component):t},Jne={name:`BaseTransition`,props:ji,setup(e,{slots:t}){let n=ba(),r=Rte();return()=>{let i=t.default&&Hte(t.default(),!0);if(!i||!i.length)return;let a=zte(i),o=bn(e),{mode:s}=o;if(r.isLeaving)return br(a);let c=Vte(a);if(!c)return br(a);let l=yr(c,o,r,n,e=>l=e);c.type!==fa&&xr(c,l);let u=n.subTree&&Vte(n.subTree);if(u&&u.type!==fa&&!Qr(u,c)&&Mi(n).type!==fa){let e=yr(u,o,r,n);if(xr(u,e),s===`out-in`&&c.type!==fa)return r.isLeaving=!0,e.afterLeave=()=>{r.isLeaving=!1,n.job.flags&8||n.update(),delete e.afterLeave,u=void 0},br(a);s===`in-out`&&c.type!==fa?e.delayLeave=(e,t,n)=>{let i=Bte(r,u);i[String(u.key)]=u,e[Oi]=()=>{t(),e[Oi]=void 0,delete l.delayedLeave,u=void 0},l.delayedLeave=()=>{n(),delete l.delayedLeave,u=void 0}}:u=void 0}else u&&=void 0;return a}}},Yne=Jne,Ni=new WeakMap,Xne=!1,Pi=()=>{Xne||=(console.error(`Hydration completed but contains mismatches.`),!0)},Zne=e=>e.namespaceURI.includes(`svg`)&&e.tagName!==`foreignObject`,Qne=e=>e.namespaceURI.includes(`MathML`),Fi=e=>{if(e.nodeType===1){if(Zne(e))return`svg`;if(Qne(e))return`mathml`}},Ii=e=>e.nodeType===8,Li=`data-allow-mismatch`,$ne={0:`text`,1:`children`,2:`class`,3:`style`,4:`attribute`},Bt().requestIdleCallback,Bt().cancelIdleCallback,Ri=e=>!!e.type.__asyncLoader,zi=e=>e.type.__isKeepAlive,Bi=e=>(t,n=ya)=>{(!Ta||e===`sp`)&&Or(e,(...e)=>t(...e),n)},Vi=Bi(`bm`),Hi=Bi(`m`),Ui=Bi(`bu`),ere=Bi(`u`),Wi=Bi(`bum`),Gi=Bi(`um`),Ki=Bi(`sp`),tre=Bi(`rtg`),nre=Bi(`rtc`),qi=`components`,Ji=Symbol.for(`v-ndc`),Yi=e=>e?Rne(e)?si(e):Yi(e.parent):null,Xi=mt(Object.create(null),{$:e=>e,$el:e=>e.vnode.el,$data:e=>e.data,$props:e=>e.props,$attrs:e=>e.attrs,$slots:e=>e.slots,$refs:e=>e.refs,$parent:e=>Yi(e.parent),$root:e=>Yi(e.root),$host:e=>e.ce,$emit:e=>e.emit,$options:e=>Rr(e),$forceUpdate:e=>e.f||=()=>{or(e.update)},$nextTick:e=>e.n||=ar.bind(e.proxy),$watch:e=>Fte.bind(e)}),Zi=(e,t)=>e!==ct&&!e.__isScriptSetup&&gt(e,t),rre={get({_:e},t){if(t===`__v_skip`)return!0;let{ctx:n,setupState:r,data:i,props:a,accessCache:o,type:s,appContext:c}=e;if(t[0]!==`$`){let e=o[t];if(e!==void 0)switch(e){case 1:return r[t];case 2:return i[t];case 4:return n[t];case 3:return a[t]}else if(Zi(r,t))return o[t]=1,r[t];else if(i!==ct&&gt(i,t))return o[t]=2,i[t];else if(gt(a,t))return o[t]=3,a[t];else if(n!==ct&&gt(n,t))return o[t]=4,n[t];else Qi&&(o[t]=0)}let l=Xi[t],u,d;if(l)return t===`$attrs`&&en(e.attrs,`get`,``),l(e);if((u=s.__cssModules)&&(u=u[t]))return u;if(n!==ct&&gt(n,t))return o[t]=4,n[t];if(d=c.config.globalProperties,gt(d,t))return d[t]},set({_:e},t,n){let{data:r,setupState:i,ctx:a}=e;return Zi(i,t)?(i[t]=n,!0):r!==ct&&gt(r,t)?(r[t]=n,!0):gt(e.props,t)||t[0]===`$`&&t.slice(1)in e?!1:(a[t]=n,!0)},has({_:{data:e,setupState:t,accessCache:n,ctx:r,appContext:i,props:a,type:o}},s){let c;return!!(n[s]||e!==ct&&s[0]!==`$`&&gt(e,s)||Zi(t,s)||gt(a,s)||gt(r,s)||gt(Xi,s)||gt(i.config.globalProperties,s)||(c=o.__cssModules)&&c[s])},defineProperty(e,t,n){return n.get==null?gt(n,`value`)&&this.set(e,t,n.value,null):e._.accessCache[t]=0,Reflect.defineProperty(e,t,n)}},Qi=!0,ire={data:cne,props:une,emits:une,methods:Hr,computed:Hr,beforeCreate:Vr,created:Vr,beforeMount:Vr,mounted:Vr,beforeUpdate:Vr,updated:Vr,beforeDestroy:Vr,beforeUnmount:Vr,destroyed:Vr,unmounted:Vr,activated:Vr,deactivated:Vr,errorCaptured:Vr,serverPrefetch:Vr,components:Hr,directives:Hr,watch:dne,provide:cne,inject:lne},are=0,$i=null,ea=(e,t)=>t===`modelValue`||t===`model-value`?e.modelModifiers:e[`${t}Modifiers`]||e[`${Mt(t)}Modifiers`]||e[`${Nt(t)}Modifiers`],ore=new WeakMap,sre=e=>{let t;for(let n in e)(n===`class`||n===`style`||ft(n))&&((t||={})[n]=e[n]);return t},cre=(e,t)=>{let n={};for(let r in e)(!pt(r)||!(r.slice(9)in t))&&(n[r]=e[r]);return n},ta={},na=()=>Object.create(ta),ra=e=>Object.getPrototypeOf(e)===ta,lre=new WeakMap,ia=e=>e===`_`||e===`_ctx`||e===`$stable`,aa=e=>_t(e)?e.map(ni):[ni(e)],ure=(e,t,n)=>{if(t._n)return t;let r=M((...e)=>aa(t(...e)),n);return r._c=!1,r},oa=(e,t,n)=>{let r=e._ctx;for(let n in e){if(ia(n))continue;let i=e[n];if(xt(i))t[n]=ure(n,i,r);else if(i!=null){let e=aa(i);t[n]=()=>e}}},sa=(e,t)=>{let n=aa(t);e.slots.default=()=>n},ca=(e,t,n)=>{for(let r in t)(n||!ia(r))&&(e[r]=t[r])},dre=(e,t,n)=>{let r=e.slots=na();if(e.vnode.shapeFlag&32){let e=t._;e?(ca(r,t,n),n&&Rt(r,`_`,e,!0)):oa(t,r)}else t&&sa(e,t)},fre=(e,t,n)=>{let{vnode:r,slots:i}=e,a=!0,o=ct;if(r.shapeFlag&32){let e=t._;e?n&&e===1?a=!1:ca(i,t,n):(a=!t.$stable,oa(t,i)),o=t}else t&&(sa(e,t),o={default:1});if(a)for(let e in i)!ia(e)&&o[e]==null&&delete i[e]},la=Nne,ua=e=>e.__isSuspense,V=Symbol.for(`v-fgt`),da=Symbol.for(`v-txt`),fa=Symbol.for(`v-cmt`),pa=Symbol.for(`v-stc`),ma=[],ha=null,ga=1,_a=({key:e})=>e??null,va=({ref:e,ref_key:t,ref_for:n})=>(typeof e==`number`&&(e=``+e),e==null?null:St(e)||xn(e)||xt(e)?{i:_i,r:e,k:t,f:!!n}:e),H=Ine,pre=fne(),mre=0,ya=null,ba=()=>ya||_i;{let e=Bt(),t=(t,n)=>{let r;return(r=e[t])||(r=e[t]=[]),r.push(n),e=>{r.length>1?r.forEach(t=>t(e)):r[0](e)}};xa=t(`__VUE_INSTANCE_SETTERS__`,e=>ya=e),Sa=t(`__VUE_SSR_SETTERS__`,e=>Ta=e)}Ca=e=>{let t=ya;return xa(e),e.scope.on(),()=>{e.scope.off(),xa(t)}},wa=()=>{ya&&ya.scope.off(),xa(null)},Ta=!1,_re={get(e,t){return en(e,`get`,``),e[t]}},U=(e,t)=>ite(e,t,Ta),vre=`3.5.30`}));function yre(e){let t={};for(let n in e)n in Ga||(t[n]=e[n]);if(e.css===!1)return t;let{name:n=`v`,type:r,duration:i,enterFromClass:a=`${n}-enter-from`,enterActiveClass:o=`${n}-enter-active`,enterToClass:s=`${n}-enter-to`,appearFromClass:c=a,appearActiveClass:l=o,appearToClass:u=s,leaveFromClass:d=`${n}-leave-from`,leaveActiveClass:f=`${n}-leave-active`,leaveToClass:p=`${n}-leave-to`}=e,m=bre(i),h=m&&m[0],g=m&&m[1],{onBeforeEnter:_,onEnter:v,onEnterCancelled:y,onLeave:b,onLeaveCancelled:x,onBeforeAppear:S=_,onAppear:C=v,onAppearCancelled:w=y}=t,ee=(e,t,n,r)=>{e._enterCancelled=r,ka(e,t?u:s),ka(e,t?l:o),n&&n()},te=(e,t)=>{e._isLeaving=!1,ka(e,d),ka(e,p),ka(e,f),t&&t()},ne=e=>(t,n)=>{let i=e?C:v,o=()=>ee(t,e,n);qa(i,[t,o]),xre(()=>{ka(t,e?c:a),Oa(t,e?u:s),Ja(i)||Sre(t,r,h,o)})};return mt(t,{onBeforeEnter(e){qa(_,[e]),Oa(e,a),Oa(e,o)},onBeforeAppear(e){qa(S,[e]),Oa(e,c),Oa(e,l)},onEnter:ne(!1),onAppear:ne(!0),onLeave(e,t){e._isLeaving=!0;let n=()=>te(e,t);Oa(e,d),e._enterCancelled?(Oa(e,f),Ere(e)):(Ere(e),Oa(e,f)),xre(()=>{e._isLeaving&&(ka(e,d),Oa(e,p),Ja(b)||Sre(e,r,g,n))}),qa(b,[e,n])},onEnterCancelled(e){ee(e,!1,void 0,!0),qa(y,[e])},onAppearCancelled(e){ee(e,!0,void 0,!0),qa(w,[e])},onLeaveCancelled(e){te(e),qa(x,[e])}})}function bre(e){if(e==null)return null;if(wt(e))return[Da(e.enter),Da(e.leave)];{let t=Da(e);return[t,t]}}function Da(e){return Aee(e)}function Oa(e,t){t.split(/\s+/).forEach(t=>t&&e.classList.add(t)),(e[Wa]||(e[Wa]=new Set)).add(t)}function ka(e,t){t.split(/\s+/).forEach(t=>t&&e.classList.remove(t));let n=e[Wa];n&&(n.delete(t),n.size||(e[Wa]=void 0))}function xre(e){requestAnimationFrame(()=>{requestAnimationFrame(e)})}function Sre(e,t,n,r){let i=e._endId=++nie,a=()=>{i===e._endId&&r()};if(n!=null)return setTimeout(a,n);let{type:o,timeout:s,propCount:c}=Cre(e,t);if(!o)return r();let l=o+`end`,u=0,d=()=>{e.removeEventListener(l,f),a()},f=t=>{t.target===e&&++u>=c&&d()};setTimeout(()=>{u<c&&d()},s+1),e.addEventListener(l,f)}function Cre(e,t){let n=window.getComputedStyle(e),r=e=>(n[e]||``).split(`, `),i=r(`${Ha}Delay`),a=r(`${Ha}Duration`),o=wre(i,a),s=r(`${Ua}Delay`),c=r(`${Ua}Duration`),l=wre(s,c),u=null,d=0,f=0;t===Ha?o>0&&(u=Ha,d=o,f=a.length):t===Ua?l>0&&(u=Ua,d=l,f=c.length):(d=Math.max(o,l),u=d>0?o>l?Ha:Ua:null,f=u?u===Ha?a.length:c.length:0);let p=u===Ha&&/\b(?:transform|all)(?:,|$)/.test(r(`${Ha}Property`).toString());return{type:u,timeout:d,propCount:f,hasTransform:p}}function wre(e,t){for(;e.length<t.length;)e=e.concat(e);return Math.max(...t.map((t,n)=>Tre(t)+Tre(e[n])))}function Tre(e){return e===`auto`?0:Number(e.slice(0,-1).replace(`,`,`.`))*1e3}function Ere(e){return(e?e.ownerDocument:document).body.offsetHeight}function Dre(e,t,n){let r=e[Wa];r&&(t=(t?[t,...r]:[...r]).join(` `)),t==null?e.removeAttribute(`class`):n?e.setAttribute(`class`,t):e.className=t}function Aa(e,t){e.style.display=t?e[Ya]:`none`,e[Xa]=!t}function Ore(e){let t=ba();if(!t)return;let n=t.ut=(n=e(t.proxy))=>{Array.from(document.querySelectorAll(`[data-v-owner="${t.uid}"]`)).forEach(e=>Ma(e,n))},r=()=>{let r=e(t.proxy);t.ce?Ma(t.ce,r):ja(t.subTree,r),n(r)};Ui(()=>{Ate(r)}),Hi(()=>{mr(r,ut,{flush:`post`});let e=new MutationObserver(r);e.observe(t.subTree.el.parentNode,{childList:!0}),Gi(()=>e.disconnect())})}function ja(e,t){if(e.shapeFlag&128){let n=e.suspense;e=n.activeBranch,n.pendingBranch&&!n.isHydrating&&n.effects.push(()=>{ja(n.activeBranch,t)})}for(;e.component;)e=e.component.subTree;if(e.shapeFlag&1&&e.el)Ma(e.el,t);else if(e.type===V)e.children.forEach(e=>ja(e,t));else if(e.type===pa){let{el:n,anchor:r}=e;for(;n&&(Ma(n,t),n!==r);)n=n.nextSibling}}function Ma(e,t){if(e.nodeType===1){let n=e.style,r=``;for(let e in t){let i=Tee(t[e]);n.setProperty(`--${e}`,i),r+=`--${e}: ${i};`}n[Qa]=r}}function kre(e,t,n){let r=e.style,i=St(n),a=!1;if(n&&!i){if(t)if(St(t))for(let e of t.split(`;`)){let t=e.slice(0,e.indexOf(`:`)).trim();n[t]??Na(r,t,``)}else for(let e in t)n[e]??Na(r,e,``);for(let e in n)e===`display`&&(a=!0),Na(r,e,n[e])}else if(i){if(t!==n){let e=r[Qa];e&&(n+=`;`+e),r.cssText=n,a=rie.test(n)}}else t&&e.removeAttribute(`style`);Ya in e&&(e[Ya]=a?r.display:``,e[Xa]&&(r.display=`none`))}function Na(e,t,n){if(_t(n))n.forEach(n=>Na(e,t,n));else if(n??=``,t.startsWith(`--`))e.setProperty(t,n);else{let r=Are(e,t);$a.test(n)?e.setProperty(Nt(r),n.replace($a,``),`important`):e[r]=n}}function Are(e,t){let n=to[t];if(n)return n;let r=Mt(t);if(r!==`filter`&&r in e)return to[t]=r;r=Pt(r);for(let n=0;n<eo.length;n++){let i=eo[n]+r;if(i in e)return to[t]=i}return t}function jre(e,t,n,r,i,a=Fee(t)){r&&t.startsWith(`xlink:`)?n==null?e.removeAttributeNS(no,t.slice(6,t.length)):e.setAttributeNS(no,t,n):n==null||a&&!Cee(n)?e.removeAttribute(t):e.setAttribute(t,a?``:Ct(n)?String(n):n)}function Mre(e,t,n,r,i){if(t===`innerHTML`||t===`textContent`){n!=null&&(e[t]=t===`innerHTML`?za(n):n);return}let a=e.tagName;if(t===`value`&&a!==`PROGRESS`&&!a.includes(`-`)){let r=a===`OPTION`?e.getAttribute(`value`)||``:e.value,i=n==null?e.type===`checkbox`?`on`:``:String(n);(r!==i||!(`_value`in e))&&(e.value=i),n??e.removeAttribute(t),e._value=n;return}let o=!1;if(n===``||n==null){let r=typeof e[t];r===`boolean`?n=Cee(n):n==null&&r===`string`?(n=``,o=!0):r===`number`&&(n=0,o=!0)}try{e[t]=n}catch{}o&&e.removeAttribute(i||t)}function Pa(e,t,n,r){e.addEventListener(t,n,r)}function Nre(e,t,n,r){e.removeEventListener(t,n,r)}function Pre(e,t,n,r,i=null){let a=e[ro]||(e[ro]={}),o=a[t];if(r&&o)o.value=r;else{let[n,s]=Fre(t);r?Pa(e,n,a[t]=Ire(r,i),s):o&&(Nre(e,n,o,s),a[t]=void 0)}}function Fre(e){let t;if(io.test(e)){t={};let n;for(;n=e.match(io);)e=e.slice(0,e.length-n[0].length),t[n[0].toLowerCase()]=!0}return[e[2]===`:`?e.slice(3):Nt(e.slice(2)),t]}function Ire(e,t){let n=e=>{if(!e._vts)e._vts=Date.now();else if(e._vts<=n.attached)return;rr(Lre(e,n.value),t,5,[e])};return n.value=e,n.attached=aie(),n}function Lre(e,t){if(_t(t)){let n=e.stopImmediatePropagation;return e.stopImmediatePropagation=()=>{n.call(e),e._stopped=!0},t.map(e=>t=>!t._stopped&&e&&e(t))}else return t}function Rre(e,t,n,r){if(r)return!!(t===`innerHTML`||t===`textContent`||t in e&&oo(t)&&xt(n));if(t===`spellcheck`||t===`draggable`||t===`translate`||t===`autocorrect`||t===`sandbox`&&e.tagName===`IFRAME`||t===`form`||t===`list`&&e.tagName===`INPUT`||t===`type`&&e.tagName===`TEXTAREA`)return!1;if(t===`width`||t===`height`){let t=e.tagName;if(t===`IMG`||t===`VIDEO`||t===`CANVAS`||t===`SOURCE`)return!1}return oo(t)&&St(n)?!1:t in e}function zre(e,t){let n=e._def.props;if(!n)return!1;let r=Mt(t);return Array.isArray(n)?n.some(e=>Mt(e)===r):Object.keys(n).some(e=>Mt(e)===r)}function Bre(e){e.target.composing=!0}function Vre(e){let t=e.target;t.composing&&(t.composing=!1,t.dispatchEvent(new Event(`input`)))}function Hre(e,t,n){return t&&(e=e.trim()),n&&(e=zt(e)),e}function Ure(e,{value:t,oldValue:n},r){e._modelValue=t;let i;if(_t(t))i=st(t,r.props.value)>-1;else if(yt(t))i=t.has(r.props.value);else{if(t===n)return;i=ot(t,Gre(e,!0))}e.checked!==i&&(e.checked=i)}function Wre(e,t){let n=e.multiple,r=_t(t);if(!(n&&!r&&!yt(t))){for(let i=0,a=e.options.length;i<a;i++){let a=e.options[i],o=Fa(a);if(n)if(r){let e=typeof o;e===`string`||e===`number`?a.selected=t.some(e=>String(e)===String(o)):a.selected=st(t,o)>-1}else a.selected=t.has(o);else if(ot(Fa(a),t)){e.selectedIndex!==i&&(e.selectedIndex=i);return}}!n&&e.selectedIndex!==-1&&(e.selectedIndex=-1)}}function Fa(e){return`_value`in e?e._value:e.value}function Gre(e,t){let n=t?`_trueValue`:`_falseValue`;return n in e?e[n]:t}function Kre(e,t){switch(e){case`SELECT`:return cie;case`TEXTAREA`:return lo;default:switch(t){case`checkbox`:return uo;case`radio`:return sie;default:return lo}}}function Ia(e,t,n,r,i){let a=Kre(e.tagName,n.props&&n.props.type)[i];a&&a(e,t,n,r)}function qre(){return go||=Tne(ho)}function Jre(){return go=_o?go:Ene(ho),_o=!0,go}function Yre(e){if(e instanceof SVGElement)return`svg`;if(typeof MathMLElement==`function`&&e instanceof MathMLElement)return`mathml`}function Xre(e){return St(e)?document.querySelector(e):e}var La,Ra,za,Zre,Qre,Ba,Va,$re,Ha,Ua,Wa,Ga,eie,tie,Ka,qa,Ja,nie,Ya,Xa,Za,Qa,rie,$a,eo,to,no,ro,io,ao,iie,aie,oo,oie,so,co,lo,uo,sie,cie,fo,lie,uie,po,die,mo,ho,go,_o,fie,vo,pie,mie=s((()=>{if(Ea(),Ea(),Gt(),La=void 0,Ra=typeof window<`u`&&window.trustedTypes,Ra)try{La=Ra.createPolicy(`vue`,{createHTML:e=>e})}catch{}za=La?e=>La.createHTML(e):e=>e,Zre=`http://www.w3.org/2000/svg`,Qre=`http://www.w3.org/1998/Math/MathML`,Ba=typeof document<`u`?document:null,Va=Ba&&Ba.createElement(`template`),$re={insert:(e,t,n)=>{t.insertBefore(e,n||null)},remove:e=>{let t=e.parentNode;t&&t.removeChild(e)},createElement:(e,t,n,r)=>{let i=t===`svg`?Ba.createElementNS(Zre,e):t===`mathml`?Ba.createElementNS(Qre,e):n?Ba.createElement(e,{is:n}):Ba.createElement(e);return e===`select`&&r&&r.multiple!=null&&i.setAttribute(`multiple`,r.multiple),i},createText:e=>Ba.createTextNode(e),createComment:e=>Ba.createComment(e),setText:(e,t)=>{e.nodeValue=t},setElementText:(e,t)=>{e.textContent=t},parentNode:e=>e.parentNode,nextSibling:e=>e.nextSibling,querySelector:e=>Ba.querySelector(e),setScopeId(e,t){e.setAttribute(t,``)},insertStaticContent(e,t,n,r,i,a){let o=n?n.previousSibling:t.lastChild;if(i&&(i===a||i.nextSibling))for(;t.insertBefore(i.cloneNode(!0),n),!(i===a||!(i=i.nextSibling)););else{Va.innerHTML=za(r===`svg`?`<svg>${e}</svg>`:r===`mathml`?`<math>${e}</math>`:e);let i=Va.content;if(r===`svg`||r===`mathml`){let e=i.firstChild;for(;e.firstChild;)i.appendChild(e.firstChild);i.removeChild(e)}t.insertBefore(i,n)}return[o?o.nextSibling:t.firstChild,n?n.previousSibling:t.lastChild]}},Ha=`transition`,Ua=`animation`,Wa=Symbol(`_vtc`),Ga={name:String,type:String,css:{type:Boolean,default:!0},duration:[String,Number,Object],enterFromClass:String,enterActiveClass:String,enterToClass:String,appearFromClass:String,appearActiveClass:String,appearToClass:String,leaveFromClass:String,leaveActiveClass:String,leaveToClass:String},eie=mt({},ji,Ga),tie=e=>(e.displayName=`Transition`,e.props=eie,e),Ka=tie((e,{slots:t})=>ci(Yne,yre(e),t)),qa=(e,t=[])=>{_t(e)?e.forEach(e=>e(...t)):e&&e(...t)},Ja=e=>e?_t(e)?e.some(e=>e.length>1):e.length>1:!1,nie=0,Ya=Symbol(`_vod`),Xa=Symbol(`_vsh`),Za={name:`show`,beforeMount(e,{value:t},{transition:n}){e[Ya]=e.style.display===`none`?``:e.style.display,n&&t?n.beforeEnter(e):Aa(e,t)},mounted(e,{value:t},{transition:n}){n&&t&&n.enter(e)},updated(e,{value:t,oldValue:n},{transition:r}){!t!=!n&&(r?t?(r.beforeEnter(e),Aa(e,!0),r.enter(e)):r.leave(e,()=>{Aa(e,!1)}):Aa(e,t))},beforeUnmount(e,{value:t}){Aa(e,t)}},Qa=Symbol(``),rie=/(?:^|;)\s*display\s*:/,$a=/\s*!important$/,eo=[`Webkit`,`Moz`,`ms`],to={},no=`http://www.w3.org/1999/xlink`,ro=Symbol(`_vei`),io=/(?:Once|Passive|Capture)$/,ao=0,iie=Promise.resolve(),aie=()=>ao||=(iie.then(()=>ao=0),Date.now()),oo=e=>e.charCodeAt(0)===111&&e.charCodeAt(1)===110&&e.charCodeAt(2)>96&&e.charCodeAt(2)<123,oie=(e,t,n,r,i,a)=>{let o=i===`svg`;t===`class`?Dre(e,r,o):t===`style`?kre(e,n,r):ft(t)?pt(t)||Pre(e,t,n,r,a):(t[0]===`.`?(t=t.slice(1),!0):t[0]===`^`?(t=t.slice(1),!1):Rre(e,t,r,o))?(Mre(e,t,r),!e.tagName.includes(`-`)&&(t===`value`||t===`checked`||t===`selected`)&&jre(e,t,r,o,a,t!==`value`)):e._isVueCE&&(zre(e,t)||e._def.__asyncLoader&&(/[A-Z]/.test(t)||!St(r)))?Mre(e,Mt(t),r,a,t):(t===`true-value`?e._trueValue=r:t===`false-value`&&(e._falseValue=r),jre(e,t,r,o))},so=e=>{let t=e.props[`onUpdate:modelValue`]||!1;return _t(t)?e=>Lt(t,e):t},co=Symbol(`_assign`),lo={created(e,{modifiers:{lazy:t,trim:n,number:r}},i){e[co]=so(i);let a=r||i.props&&i.props.type===`number`;Pa(e,t?`change`:`input`,t=>{t.target.composing||e[co](Hre(e.value,n,a))}),(n||a)&&Pa(e,`change`,()=>{e.value=Hre(e.value,n,a)}),t||(Pa(e,`compositionstart`,Bre),Pa(e,`compositionend`,Vre),Pa(e,`change`,Vre))},mounted(e,{value:t}){e.value=t??``},beforeUpdate(e,{value:t,oldValue:n,modifiers:{lazy:r,trim:i,number:a}},o){if(e[co]=so(o),e.composing)return;let s=(a||e.type===`number`)&&!/^0\d/.test(e.value)?zt(e.value):e.value,c=t??``;s!==c&&(document.activeElement===e&&e.type!==`range`&&(r&&t===n||i&&e.value.trim()===c)||(e.value=c))}},uo={deep:!0,created(e,t,n){e[co]=so(n),Pa(e,`change`,()=>{let t=e._modelValue,n=Fa(e),r=e.checked,i=e[co];if(_t(t)){let e=st(t,n),a=e!==-1;if(r&&!a)i(t.concat(n));else if(!r&&a){let n=[...t];n.splice(e,1),i(n)}}else if(yt(t)){let e=new Set(t);r?e.add(n):e.delete(n),i(e)}else i(Gre(e,r))})},mounted:Ure,beforeUpdate(e,t,n){e[co]=so(n),Ure(e,t,n)}},sie={created(e,{value:t},n){e.checked=ot(t,n.props.value),e[co]=so(n),Pa(e,`change`,()=>{e[co](Fa(e))})},beforeUpdate(e,{value:t,oldValue:n},r){e[co]=so(r),t!==n&&(e.checked=ot(t,r.props.value))}},cie={deep:!0,created(e,{value:t,modifiers:{number:n}},r){let i=yt(t);Pa(e,`change`,()=>{let t=Array.prototype.filter.call(e.options,e=>e.selected).map(e=>n?zt(Fa(e)):Fa(e));e[co](e.multiple?i?new Set(t):t:t[0]),e._assigning=!0,ar(()=>{e._assigning=!1})}),e[co]=so(r)},mounted(e,{value:t}){Wre(e,t)},beforeUpdate(e,t,n){e[co]=so(n)},updated(e,{value:t}){e._assigning||Wre(e,t)}},fo={created(e,t,n){Ia(e,t,n,null,`created`)},mounted(e,t,n){Ia(e,t,n,null,`mounted`)},beforeUpdate(e,t,n,r){Ia(e,t,n,r,`beforeUpdate`)},updated(e,t,n,r){Ia(e,t,n,r,`updated`)}},lie=[`ctrl`,`shift`,`alt`,`meta`],uie={stop:e=>e.stopPropagation(),prevent:e=>e.preventDefault(),self:e=>e.target!==e.currentTarget,ctrl:e=>!e.ctrlKey,shift:e=>!e.shiftKey,alt:e=>!e.altKey,meta:e=>!e.metaKey,left:e=>`button`in e&&e.button!==0,middle:e=>`button`in e&&e.button!==1,right:e=>`button`in e&&e.button!==2,exact:(e,t)=>lie.some(n=>e[`${n}Key`]&&!t.includes(n))},po=(e,t)=>{if(!e)return e;let n=e._withMods||={},r=t.join(`.`);return n[r]||(n[r]=((n,...r)=>{for(let e=0;e<t.length;e++){let r=uie[t[e]];if(r&&r(n,t))return}return e(n,...r)}))},die={esc:`escape`,space:` `,up:`arrow-up`,left:`arrow-left`,right:`arrow-right`,down:`arrow-down`,delete:`backspace`},mo=(e,t)=>{let n=e._withKeys||={},r=t.join(`.`);return n[r]||(n[r]=(n=>{if(!(`key`in n))return;let r=Nt(n.key);if(t.some(e=>e===r||die[e]===r))return e(n)}))},ho=mt({patchProp:oie},$re),_o=!1,fie=((...e)=>{qre().render(...e)}),vo=((...e)=>{let t=qre().createApp(...e),{mount:n}=t;return t.mount=e=>{let r=Xre(e);if(!r)return;let i=t._component;!xt(i)&&!i.render&&!i.template&&(i.template=r.innerHTML),r.nodeType===1&&(r.textContent=``);let a=n(r,!1,Yre(r));return r instanceof Element&&(r.removeAttribute(`v-cloak`),r.setAttribute(`data-v-app`,``)),a},t}),pie=((...e)=>{let t=Jre().createApp(...e),{mount:n}=t;return t.mount=e=>{let t=Xre(e);if(t)return n(t,!0,Yre(t))},t})})),W=s((()=>{mie()}));W();var hie=(e,t)=>xn(t)?Cn(t):t;W();var gie=`usehead`;function _ie(e){return{install(t){t.config.globalProperties.$unhead=e,t.config.globalProperties.$head=e,t.provide(gie,e)}}.install}function vie(){if(Nte()){let e=fr(gie);if(e)return e}throw Error(`useHead() was called without provide context, ensure you call it through the setup() function.`)}function yie(e,t={}){let n=t.head||vie();return n.ssr?n.push(e||{},t):bie(n,e,t)}function bie(e,t,n={}){let r=A(!1),i;return pr(()=>{let a=r.value?{}:qe(t,hie);i?i.patch(a):i=e.push(a,n)}),ba()&&(Wi(()=>{i.dispose()}),Yte(()=>{r.value=!0}),Jte(()=>{r.value=!1})),i}function xie(e={},t={}){(t.head||vie()).use(bee);let{title:n,titleTemplate:r,...i}=e;return yie({title:n,titleTemplate:r,_flatMeta:i},t)}W();function Sie(e={}){let t=lee({domOptions:{render:uee(()=>cee(t),e=>setTimeout(e,0))},...e});return t.install=_ie(t),t}function yo(e,t,n){let r=n.initialDeps??[],i;return()=>{var a;let o;n.key&&n.debug?.call(n)&&(o=Date.now());let s=e();if(!(s.length!==r.length||s.some((e,t)=>r[t]!==e)))return i;r=s;let c;if(n.key&&n.debug?.call(n)&&(c=Date.now()),i=t(...s),n.key&&n.debug?.call(n)){let e=Math.round((Date.now()-o)*100)/100,t=Math.round((Date.now()-c)*100)/100,r=t/16,i=(e,t)=>{for(e=String(e);e.length<t;)e=` `+e;return e};console.info(`%c⏱ ${i(t,5)} /${i(e,5)} ms`,`
-            font-size: .6rem;
-            font-weight: bold;
-            color: hsl(${Math.max(0,Math.min(120-120*r,120))}deg 100% 31%);`,n?.key)}return(a=n?.onChange)==null||a.call(n,i),i}}function bo(e,t){if(e===void 0)throw Error(`Unexpected undefined${t?`: ${t}`:``}`);return e}var Cie,wie,Tie=s((()=>{Cie=(e,t)=>Math.abs(e-t)<1,wie=(e,t,n)=>{let r;return function(...i){e.clearTimeout(r),r=e.setTimeout(()=>t.apply(this,i),n)}}}));function Eie({measurements:e,outerSize:t,scrollOffset:n}){let r=e.length-1,i=So(0,r,t=>e[t].start,n),a=i;for(;a<r&&e[a].end<n+t;)a++;return{startIndex:i,endIndex:a}}var Die,Oie,kie,xo,Aie,jie,Mie,Nie,Pie,So,Fie=s((()=>{Tie(),Die=e=>e,Oie=e=>{let t=Math.max(e.startIndex-e.overscan,0),n=Math.min(e.endIndex+e.overscan,e.count-1),r=[];for(let e=t;e<=n;e++)r.push(e);return r},kie=(e,t)=>{let n=e.scrollElement;if(!n)return;let r=e.targetWindow;if(!r)return;let i=e=>{let{width:n,height:r}=e;t({width:Math.round(n),height:Math.round(r)})};if(i(n.getBoundingClientRect()),!r.ResizeObserver)return()=>{};let a=new r.ResizeObserver(e=>{let t=e[0];if(t?.borderBoxSize){let e=t.borderBoxSize[0];if(e){i({width:e.inlineSize,height:e.blockSize});return}}i(n.getBoundingClientRect())});return a.observe(n,{box:`border-box`}),()=>{a.unobserve(n)}},xo={passive:!0},Aie=typeof window>`u`?!0:`onscrollend`in window,jie=(e,t)=>{let n=e.scrollElement;if(!n)return;let r=e.targetWindow;if(!r)return;let i=0,a=Aie?()=>void 0:wie(r,()=>{t(i,!1)},e.options.isScrollingResetDelay),o=r=>()=>{i=n[e.options.horizontal?`scrollLeft`:`scrollTop`],a(),t(i,r)},s=o(!0),c=o(!1);return c(),n.addEventListener(`scroll`,s,xo),n.addEventListener(`scrollend`,c,xo),()=>{n.removeEventListener(`scroll`,s),n.removeEventListener(`scrollend`,c)}},Mie=(e,t,n)=>{if(t?.borderBoxSize){let e=t.borderBoxSize[0];if(e)return Math.round(e[n.options.horizontal?`inlineSize`:`blockSize`])}return Math.round(e.getBoundingClientRect()[n.options.horizontal?`width`:`height`])},Nie=(e,{adjustments:t=0,behavior:n},r)=>{var i,a;let o=e+t;(a=(i=r.scrollElement)?.scrollTo)==null||a.call(i,{[r.options.horizontal?`left`:`top`]:o,behavior:n})},Pie=class{constructor(e){this.unsubs=[],this.scrollElement=null,this.targetWindow=null,this.isScrolling=!1,this.scrollToIndexTimeoutId=null,this.measurementsCache=[],this.itemSizeCache=new Map,this.pendingMeasuredCacheIndexes=[],this.scrollRect=null,this.scrollOffset=null,this.scrollDirection=null,this.scrollAdjustments=0,this.elementsCache=new Map,this.observer=(()=>{let e=null,t=()=>e||(!this.targetWindow||!this.targetWindow.ResizeObserver?null:e=new this.targetWindow.ResizeObserver(e=>{e.forEach(e=>{this._measureElement(e.target,e)})}));return{disconnect:()=>t()?.disconnect(),observe:e=>t()?.observe(e,{box:`border-box`}),unobserve:e=>t()?.unobserve(e)}})(),this.range=null,this.setOptions=e=>{Object.entries(e).forEach(([t,n])=>{n===void 0&&delete e[t]}),this.options={debug:!1,initialOffset:0,overscan:1,paddingStart:0,paddingEnd:0,scrollPaddingStart:0,scrollPaddingEnd:0,horizontal:!1,getItemKey:Die,rangeExtractor:Oie,onChange:()=>{},measureElement:Mie,initialRect:{width:0,height:0},scrollMargin:0,gap:0,indexAttribute:`data-index`,initialMeasurementsCache:[],lanes:1,isScrollingResetDelay:150,enabled:!0,...e}},this.notify=(e,t)=>{var n,r;let{startIndex:i,endIndex:a}=this.range??{startIndex:void 0,endIndex:void 0},o=this.calculateRange();(e||i!==o?.startIndex||a!==o?.endIndex)&&((r=(n=this.options).onChange)==null||r.call(n,this,t))},this.cleanup=()=>{this.unsubs.filter(Boolean).forEach(e=>e()),this.unsubs=[],this.scrollElement=null,this.targetWindow=null,this.observer.disconnect(),this.elementsCache.clear()},this._didMount=()=>()=>{this.cleanup()},this._willUpdate=()=>{let e=this.options.enabled?this.options.getScrollElement():null;if(this.scrollElement!==e){if(this.cleanup(),!e){this.notify(!1,!1);return}this.scrollElement=e,this.scrollElement&&`ownerDocument`in this.scrollElement?this.targetWindow=this.scrollElement.ownerDocument.defaultView:this.targetWindow=this.scrollElement?.window??null,this._scrollToOffset(this.getScrollOffset(),{adjustments:void 0,behavior:void 0}),this.unsubs.push(this.options.observeElementRect(this,e=>{this.scrollRect=e,this.notify(!1,!1)})),this.unsubs.push(this.options.observeElementOffset(this,(e,t)=>{this.scrollAdjustments=0,this.scrollDirection=t?this.getScrollOffset()<e?`forward`:`backward`:null,this.scrollOffset=e;let n=this.isScrolling;this.isScrolling=t,this.notify(n!==t,t)}))}},this.getSize=()=>this.options.enabled?(this.scrollRect=this.scrollRect??this.options.initialRect,this.scrollRect[this.options.horizontal?`width`:`height`]):(this.scrollRect=null,0),this.getScrollOffset=()=>this.options.enabled?(this.scrollOffset=this.scrollOffset??(typeof this.options.initialOffset==`function`?this.options.initialOffset():this.options.initialOffset),this.scrollOffset):(this.scrollOffset=null,0),this.getFurthestMeasurement=(e,t)=>{let n=new Map,r=new Map;for(let i=t-1;i>=0;i--){let t=e[i];if(n.has(t.lane))continue;let a=r.get(t.lane);if(a==null||t.end>a.end?r.set(t.lane,t):t.end<a.end&&n.set(t.lane,!0),n.size===this.options.lanes)break}return r.size===this.options.lanes?Array.from(r.values()).sort((e,t)=>e.end===t.end?e.index-t.index:e.end-t.end)[0]:void 0},this.getMeasurementOptions=yo(()=>[this.options.count,this.options.paddingStart,this.options.scrollMargin,this.options.getItemKey,this.options.enabled],(e,t,n,r,i)=>(this.pendingMeasuredCacheIndexes=[],{count:e,paddingStart:t,scrollMargin:n,getItemKey:r,enabled:i}),{key:!1}),this.getMeasurements=yo(()=>[this.getMeasurementOptions(),this.itemSizeCache],({count:e,paddingStart:t,scrollMargin:n,getItemKey:r,enabled:i},a)=>{if(!i)return this.measurementsCache=[],this.itemSizeCache.clear(),[];this.measurementsCache.length===0&&(this.measurementsCache=this.options.initialMeasurementsCache,this.measurementsCache.forEach(e=>{this.itemSizeCache.set(e.key,e.size)}));let o=this.pendingMeasuredCacheIndexes.length>0?Math.min(...this.pendingMeasuredCacheIndexes):0;this.pendingMeasuredCacheIndexes=[];let s=this.measurementsCache.slice(0,o);for(let i=o;i<e;i++){let e=this.measurementsCache[i]?.measureElement;e||=e=>{let t=r(i),n=this.elementsCache.get(t);if(!e){n&&(this.observer.unobserve(n),this.elementsCache.delete(t));return}n!==e&&(n&&this.observer.unobserve(n),this.observer.observe(e),this.elementsCache.set(t,e)),e.isConnected&&this.resizeItem(i,this.options.measureElement(e,void 0,this))};let o=r(i),c=this.options.lanes===1?s[i-1]:this.getFurthestMeasurement(s,i),l=c?c.end+this.options.gap:t+n,u=a.get(o),d=typeof u==`number`?u:this.options.estimateSize(i),f=l+d,p=c?c.lane:i%this.options.lanes;s[i]={index:i,start:l,size:d,end:f,key:o,lane:p,measureElement:e}}return this.measurementsCache=s,s},{key:!1,debug:()=>this.options.debug}),this.calculateRange=yo(()=>[this.getMeasurements(),this.getSize(),this.getScrollOffset()],(e,t,n)=>this.range=e.length>0&&t>0?Eie({measurements:e,outerSize:t,scrollOffset:n}):null,{key:!1,debug:()=>this.options.debug}),this.getIndexes=yo(()=>[this.options.rangeExtractor,this.calculateRange(),this.options.overscan,this.options.count],(e,t,n,r)=>t===null?[]:e({startIndex:t.startIndex,endIndex:t.endIndex,overscan:n,count:r}),{key:!1,debug:()=>this.options.debug}),this.indexFromElement=e=>{let t=this.options.indexAttribute,n=e.getAttribute(t);return n?parseInt(n,10):(console.warn(`Missing attribute name '${t}={index}' on measured element.`),-1)},this._measureElement=(e,t)=>{let n=this.indexFromElement(e),r=this.getMeasurements()[n];if(!r||!e.isConnected){this.elementsCache.forEach((t,n)=>{t===e&&(this.observer.unobserve(e),this.elementsCache.delete(n))});return}let i=this.elementsCache.get(r.key);i!==e&&(i&&this.observer.unobserve(i),this.observer.observe(e),this.elementsCache.set(r.key,e)),this.resizeItem(n,this.options.measureElement(e,t,this))},this.resizeItem=(e,t)=>{let n=this.getMeasurements()[e];if(!n)return;let r=t-(this.itemSizeCache.get(n.key)??n.size);r!==0&&((this.shouldAdjustScrollPositionOnItemSizeChange===void 0?n.start<this.getScrollOffset()+this.scrollAdjustments:this.shouldAdjustScrollPositionOnItemSizeChange(n,r,this))&&this._scrollToOffset(this.getScrollOffset(),{adjustments:this.scrollAdjustments+=r,behavior:void 0}),this.pendingMeasuredCacheIndexes.push(n.index),this.itemSizeCache=new Map(this.itemSizeCache.set(n.key,t)),this.notify(!0,!1))},this.measureElement=e=>{e&&this._measureElement(e,void 0)},this.getVirtualItems=yo(()=>[this.getIndexes(),this.getMeasurements()],(e,t)=>{let n=[];for(let r=0,i=e.length;r<i;r++){let i=t[e[r]];n.push(i)}return n},{key:!1,debug:()=>this.options.debug}),this.getVirtualItemForOffset=e=>{let t=this.getMeasurements();if(t.length!==0)return bo(t[So(0,t.length-1,e=>bo(t[e]).start,e)])},this.getOffsetForAlignment=(e,t)=>{let n=this.getSize(),r=this.getScrollOffset();t===`auto`&&(t=e<=r?`start`:e>=r+n?`end`:`start`),t===`start`?e=e:t===`end`?e-=n:t===`center`&&(e-=n/2);let i=this.options.horizontal?`scrollWidth`:`scrollHeight`,a=(this.scrollElement?`document`in this.scrollElement?this.scrollElement.document.documentElement[i]:this.scrollElement[i]:0)-n;return Math.max(Math.min(a,e),0)},this.getOffsetForIndex=(e,t=`auto`)=>{e=Math.max(0,Math.min(e,this.options.count-1));let n=this.getMeasurements()[e];if(!n)return;let r=this.getSize(),i=this.getScrollOffset();if(t===`auto`)if(n.end>=i+r-this.options.scrollPaddingEnd)t=`end`;else if(n.start<=i+this.options.scrollPaddingStart)t=`start`;else return[i,t];let a=t===`end`?n.end+this.options.scrollPaddingEnd:n.start-this.options.scrollPaddingStart;return[this.getOffsetForAlignment(a,t),t]},this.isDynamicMode=()=>this.elementsCache.size>0,this.cancelScrollToIndex=()=>{this.scrollToIndexTimeoutId!==null&&this.targetWindow&&(this.targetWindow.clearTimeout(this.scrollToIndexTimeoutId),this.scrollToIndexTimeoutId=null)},this.scrollToOffset=(e,{align:t=`start`,behavior:n}={})=>{this.cancelScrollToIndex(),n===`smooth`&&this.isDynamicMode()&&console.warn("The `smooth` scroll behavior is not fully supported with dynamic size."),this._scrollToOffset(this.getOffsetForAlignment(e,t),{adjustments:void 0,behavior:n})},this.scrollToIndex=(e,{align:t=`auto`,behavior:n}={})=>{e=Math.max(0,Math.min(e,this.options.count-1)),this.cancelScrollToIndex(),n===`smooth`&&this.isDynamicMode()&&console.warn("The `smooth` scroll behavior is not fully supported with dynamic size.");let r=this.getOffsetForIndex(e,t);if(!r)return;let[i,a]=r;this._scrollToOffset(i,{adjustments:void 0,behavior:n}),n!==`smooth`&&this.isDynamicMode()&&this.targetWindow&&(this.scrollToIndexTimeoutId=this.targetWindow.setTimeout(()=>{if(this.scrollToIndexTimeoutId=null,this.elementsCache.has(this.options.getItemKey(e))){let[t]=bo(this.getOffsetForIndex(e,a));Cie(t,this.getScrollOffset())||this.scrollToIndex(e,{align:a,behavior:n})}else this.scrollToIndex(e,{align:a,behavior:n})}))},this.scrollBy=(e,{behavior:t}={})=>{this.cancelScrollToIndex(),t===`smooth`&&this.isDynamicMode()&&console.warn("The `smooth` scroll behavior is not fully supported with dynamic size."),this._scrollToOffset(this.getScrollOffset()+e,{adjustments:void 0,behavior:t})},this.getTotalSize=()=>{let e=this.getMeasurements(),t;return t=e.length===0?this.options.paddingStart:this.options.lanes===1?e[e.length-1]?.end??0:Math.max(...e.slice(-this.options.lanes).map(e=>e.end)),t-this.options.scrollMargin+this.options.paddingEnd},this._scrollToOffset=(e,{adjustments:t,behavior:n})=>{this.options.scrollToFn(e,{behavior:n,adjustments:t},this)},this.measure=()=>{var e,t;this.itemSizeCache=new Map,(t=(e=this.options).onChange)==null||t.call(e,this,!1)},this.setOptions(e)}},So=(e,t,n,r)=>{for(;e<=t;){let i=(e+t)/2|0,a=n(i);if(a<r)e=i+1;else if(a>r)t=i-1;else return i}return e>0?e-1:0}}));function Iie(e){let t=new Pie(j(e)),n=Sn(t),r=t._didMount();return mr(()=>j(e).getScrollElement(),e=>{e&&t._willUpdate()},{immediate:!0}),mr(()=>j(e),e=>{t.setOptions({...e,onChange:(t,r)=>{var i;$ee(n),(i=e.onChange)==null||i.call(e,t,r)}}),t._willUpdate(),$ee(n)},{immediate:!0}),qt(r),n}function Lie(e){return Iie(U(()=>({observeElementRect:kie,observeElementOffset:jie,scrollToFn:Nie,...j(e)})))}var Rie=s((()=>{Fie(),Fie(),W()}));function Co(e,t,n){let r=A(n?.value),i=U(()=>e.value!==void 0);return[U(()=>i.value?e.value:r.value),function(e){return i.value||(r.value=e),t?.(e)}]}var wo=s((()=>{W()}));function To(e){typeof queueMicrotask==`function`?queueMicrotask(e):Promise.resolve().then(e).catch(e=>setTimeout(()=>{throw e}))}var Eo=s((()=>{}));function Do(){let e=[],t={addEventListener(e,n,r,i){return e.addEventListener(n,r,i),t.add(()=>e.removeEventListener(n,r,i))},requestAnimationFrame(...e){let n=requestAnimationFrame(...e);t.add(()=>cancelAnimationFrame(n))},nextFrame(...e){t.requestAnimationFrame(()=>{t.requestAnimationFrame(...e)})},setTimeout(...e){let n=setTimeout(...e);t.add(()=>clearTimeout(n))},microTask(...e){let n={current:!0};return To(()=>{n.current&&e[0]()}),t.add(()=>{n.current=!1})},style(e,t,n){let r=e.style.getPropertyValue(t);return Object.assign(e.style,{[t]:n}),this.add(()=>{Object.assign(e.style,{[t]:r})})},group(e){let t=Do();return e(t),this.add(()=>t.dispose())},add(t){return e.push(t),()=>{let n=e.indexOf(t);if(n>=0)for(let t of e.splice(n,1))t()}},dispose(){for(let t of e.splice(0))t()}};return t}var Oo=s((()=>{Eo()}));function zie(){let e=Do();return Gi(()=>e.dispose()),e}var Bie=s((()=>{W(),Oo()}));function Vie(){let e=zie();return t=>{e.dispose(),e.nextFrame(t)}}var Hie=s((()=>{Bie()}));function Uie(e){dr(ko,e)}var ko,Wie,Ao,jo=s((()=>{W(),ko=Symbol(`headlessui.useid`),Wie=0,Ao=Sr??function(){return fr(ko,()=>`${++Wie}`)()}}));function G(e){if(e==null||e.value==null)return null;let t=e.value.$el??e.value;return t instanceof Node?t:null}var Mo=s((()=>{}));function No(e,t,...n){if(e in t){let r=t[e];return typeof r==`function`?r(...n):r}let r=Error(`Tried to handle "${e}" but there is no handler defined. Only defined handlers are: ${Object.keys(t).map(e=>`"${e}"`).join(`, `)}.`);throw Error.captureStackTrace&&Error.captureStackTrace(r,No),r}var Po=s((()=>{})),Gie,Kie,Fo,qie,Io,Lo=s((()=>{Gie=Object.defineProperty,Kie=(e,t,n)=>t in e?Gie(e,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[t]=n,Fo=(e,t,n)=>(Kie(e,typeof t==`symbol`?t:t+``,n),n),qie=class{constructor(){Fo(this,`current`,this.detect()),Fo(this,`currentId`,0)}set(e){this.current!==e&&(this.currentId=0,this.current=e)}reset(){this.set(this.detect())}nextId(){return++this.currentId}get isServer(){return this.current===`server`}get isClient(){return this.current===`client`}detect(){return typeof window>`u`||typeof document>`u`?`server`:`client`}},Io=new qie}));function Ro(e){if(Io.isServer)return null;if(e instanceof Node)return e.ownerDocument;if(e!=null&&e.hasOwnProperty(`value`)){let t=G(e);if(t)return t.ownerDocument}return document}var zo=s((()=>{Mo(),Lo()}));function Bo(e=document.body){return e==null?[]:Array.from(e.querySelectorAll(Go)).sort((e,t)=>Math.sign((e.tabIndex||2**53-1)-(t.tabIndex||2**53-1)))}function Vo(e,t=0){return e===Ro(e)?.body?!1:No(t,{0(){return e.matches(Go)},1(){let t=e;for(;t!==null;){if(t.matches(Go))return!0;t=t.parentElement}return!1}})}function Jie(e){let t=Ro(e);ar(()=>{t&&!Vo(t.activeElement,0)&&Ho(e)})}function Ho(e){e?.focus({preventScroll:!0})}function Yie(e){return(e?.matches)?.call(e,$ie)??!1}function Uo(e,t=e=>e){return e.slice().sort((e,n)=>{let r=t(e),i=t(n);if(r===null||i===null)return 0;let a=r.compareDocumentPosition(i);return a&Node.DOCUMENT_POSITION_FOLLOWING?-1:a&Node.DOCUMENT_POSITION_PRECEDING?1:0})}function Xie(e,t){return Wo(Bo(),t,{relativeTo:e})}function Wo(e,t,{sorted:n=!0,relativeTo:r=null,skipElements:i=[]}={}){let a=(Array.isArray(e)?e.length>0?e[0].ownerDocument:document:e?.ownerDocument)??document,o=Array.isArray(e)?n?Uo(e):e:Bo(e);i.length>0&&o.length>1&&(o=o.filter(e=>!i.includes(e))),r??=a.activeElement;let s=(()=>{if(t&5)return 1;if(t&10)return-1;throw Error(`Missing Focus.First, Focus.Previous, Focus.Next or Focus.Last`)})(),c=(()=>{if(t&1)return 0;if(t&2)return Math.max(0,o.indexOf(r))-1;if(t&4)return Math.max(0,o.indexOf(r))+1;if(t&8)return o.length-1;throw Error(`Missing Focus.First, Focus.Previous, Focus.Next or Focus.Last`)})(),l=t&32?{preventScroll:!0}:{},u=0,d=o.length,f;do{if(u>=d||u+d<=0)return 0;let e=c+u;if(t&16)e=(e+d)%d;else{if(e<0)return 3;if(e>=d)return 1}f=o[e],f?.focus(l),u+=s}while(f!==a.activeElement);return t&6&&Yie(f)&&f.select(),2}var Go,Ko,qo,Zie,Jo,Qie,$ie,Yo=s((()=>{W(),Po(),zo(),Go=[`[contentEditable=true]`,`[tabindex]`,`a[href]`,`area[href]`,`button:not([disabled])`,`iframe`,`input:not([disabled])`,`select:not([disabled])`,`textarea:not([disabled])`].map(e=>`${e}:not([tabindex='-1'])`).join(`,`),Ko=(e=>(e[e.First=1]=`First`,e[e.Previous=2]=`Previous`,e[e.Next=4]=`Next`,e[e.Last=8]=`Last`,e[e.WrapAround=16]=`WrapAround`,e[e.NoScroll=32]=`NoScroll`,e))(Ko||{}),qo=(e=>(e[e.Error=0]=`Error`,e[e.Overflow=1]=`Overflow`,e[e.Success=2]=`Success`,e[e.Underflow=3]=`Underflow`,e))(qo||{}),Zie=(e=>(e[e.Previous=-1]=`Previous`,e[e.Next=1]=`Next`,e))(Zie||{}),Jo=(e=>(e[e.Strict=0]=`Strict`,e[e.Loose=1]=`Loose`,e))(Jo||{}),Qie=(e=>(e[e.Keyboard=0]=`Keyboard`,e[e.Mouse=1]=`Mouse`,e))(Qie||{}),typeof window<`u`&&typeof document<`u`&&(document.addEventListener(`keydown`,e=>{e.metaKey||e.altKey||e.ctrlKey||(document.documentElement.dataset.headlessuiFocusVisible=``)},!0),document.addEventListener(`click`,e=>{e.detail===1?delete document.documentElement.dataset.headlessuiFocusVisible:e.detail===0&&(document.documentElement.dataset.headlessuiFocusVisible=``)},!0)),$ie=[`textarea`,`input`].join(`,`)}));function eae(){return/iPhone/gi.test(window.navigator.platform)||/Mac/gi.test(window.navigator.platform)&&window.navigator.maxTouchPoints>0}function tae(){return/Android/gi.test(window.navigator.userAgent)}function nae(){return eae()||tae()}var Xo=s((()=>{}));function Zo(e,t,n){Io.isServer||pr(r=>{document.addEventListener(e,t,n),r(()=>document.removeEventListener(e,t,n))})}var rae=s((()=>{W(),Lo()}));function iae(e,t,n){Io.isServer||pr(r=>{window.addEventListener(e,t,n),r(()=>window.removeEventListener(e,t,n))})}var aae=s((()=>{W(),Lo()}));function Qo(e,t,n=U(()=>!0)){function r(r,i){if(!n.value||r.defaultPrevented)return;let a=i(r);if(a===null||!a.getRootNode().contains(a))return;let o=function e(t){return typeof t==`function`?e(t()):Array.isArray(t)||t instanceof Set?t:[t]}(e);for(let e of o){if(e===null)continue;let t=e instanceof HTMLElement?e:G(e);if(t!=null&&t.contains(a)||r.composed&&r.composedPath().includes(t))return}return!Vo(a,Jo.Loose)&&a.tabIndex!==-1&&r.preventDefault(),t(r,a)}let i=A(null);Zo(`pointerdown`,e=>{n.value&&(i.value=e.composedPath?.call(e)?.[0]||e.target)},!0),Zo(`mousedown`,e=>{n.value&&(i.value=e.composedPath?.call(e)?.[0]||e.target)},!0),Zo(`click`,e=>{nae()||(i.value&&=(r(e,()=>i.value),null))},!0),Zo(`touchend`,e=>r(e,()=>e.target instanceof HTMLElement?e.target:null),!0),iae(`blur`,e=>r(e,()=>window.document.activeElement instanceof HTMLIFrameElement?window.document.activeElement:null),!0)}var $o=s((()=>{W(),Mo(),Yo(),Xo(),rae(),aae()}));function oae(e,t){if(e)return e;let n=t??`button`;if(typeof n==`string`&&n.toLowerCase()===`button`)return`button`}function es(e,t){let n=A(oae(e.value.type,e.value.as));return Hi(()=>{n.value=oae(e.value.type,e.value.as)}),pr(()=>{var e;n.value||G(t)&&G(t)instanceof HTMLButtonElement&&!((e=G(t))!=null&&e.hasAttribute(`type`))&&(n.value=`button`)}),n}var ts=s((()=>{W(),Mo()}));function sae(e){return[e.screenX,e.screenY]}function ns(){let e=A([-1,-1]);return{wasMoved(t){let n=sae(t);return e.value[0]===n[0]&&e.value[1]===n[1]?!1:(e.value=n,!0)},update(t){e.value=sae(t)}}}var rs=s((()=>{W()}));function is({container:e,accept:t,walk:n,enabled:r}){pr(()=>{let i=e.value;if(!i||r!==void 0&&!r.value)return;let a=Ro(e);if(!a)return;let o=Object.assign(e=>t(e),{acceptNode:t}),s=a.createTreeWalker(i,NodeFilter.SHOW_ELEMENT,o,!1);for(;s.nextNode();)n(s.currentNode)})}var as=s((()=>{W(),zo()}));function os({visible:e=!0,features:t=0,ourProps:n,theirProps:r,...i}){var a;let o=lae(r,n),s=Object.assign(i,{props:o});return e||t&2&&o.static?ss(s):t&1?No((a=o.unmount)==null||a?0:1,{0(){return null},1(){return ss({...i,props:{...o,hidden:!0,style:{display:`none`}}})}}):ss(s)}function ss({props:e,attrs:t,slots:n,slot:r,name:i}){let{as:a,...o}=ls(e,[`unmount`,`static`]),s=n.default?.call(n,r),c={};if(r){let e=!1,t=[];for(let[n,i]of Object.entries(r))typeof i==`boolean`&&(e=!0),i===!0&&t.push(n);e&&(c[`data-headlessui-state`]=t.join(` `))}if(a===`template`){if(s=cae(s??[]),Object.keys(o).length>0||Object.keys(t).length>0){let[e,...n]=s??[];if(!uae(e)||n.length>0)throw Error([`Passing props on "template"!`,``,`The current component <${i} /> is rendering a "template".`,`However we need to passthrough the following props:`,Object.keys(o).concat(Object.keys(t)).map(e=>e.trim()).filter((e,t,n)=>n.indexOf(e)===t).sort((e,t)=>e.localeCompare(t)).map(e=>`  - ${e}`).join(`
-`),``,`You can apply a few solutions:`,['Add an `as="..."` prop, to ensure that we render an actual element instead of a "template".',`Render a single element as the child so that we can forward the props onto that element.`].map(e=>`  - ${e}`).join(`
-`)].join(`
-`));let r=lae(e.props??{},o,c),a=ei(e,r,!0);for(let e in r)e.startsWith(`on`)&&(a.props||={},a.props[e]=r[e]);return a}return Array.isArray(s)&&s.length===1?s[0]:s}return ci(a,Object.assign({},o,c),{default:()=>s})}function cae(e){return e.flatMap(e=>e.type===V?cae(e.children):[e])}function lae(...e){if(e.length===0)return{};if(e.length===1)return e[0];let t={},n={};for(let r of e)for(let e in r)e.startsWith(`on`)&&typeof r[e]==`function`?(n[e]??(n[e]=[]),n[e].push(r[e])):t[e]=r[e];if(t.disabled||t[`aria-disabled`])return Object.assign(t,Object.fromEntries(Object.keys(n).map(e=>[e,void 0])));for(let e in n)Object.assign(t,{[e](t,...r){let i=n[e];for(let e of i){if(t instanceof Event&&t.defaultPrevented)return;e(t,...r)}}});return t}function cs(e){let t=Object.assign({},e);for(let e in t)t[e]===void 0&&delete t[e];return t}function ls(e,t=[]){let n=Object.assign({},e);for(let e of t)e in n&&delete n[e];return n}function uae(e){return e==null?!1:typeof e.type==`string`||typeof e.type==`object`||typeof e.type==`function`}var us,ds,fs=s((()=>{W(),Po(),us=(e=>(e[e.None=0]=`None`,e[e.RenderStrategy=1]=`RenderStrategy`,e[e.Static=2]=`Static`,e))(us||{}),ds=(e=>(e[e.Unmount=0]=`Unmount`,e[e.Hidden=1]=`Hidden`,e))(ds||{})})),ps,ms,hs=s((()=>{W(),fs(),ps=(e=>(e[e.None=1]=`None`,e[e.Focusable=2]=`Focusable`,e[e.Hidden=4]=`Hidden`,e))(ps||{}),ms=N({name:`Hidden`,props:{as:{type:[Object,String],default:`div`},features:{type:Number,default:1}},setup(e,{slots:t,attrs:n}){return()=>{let{features:r,...i}=e;return os({ourProps:{"aria-hidden":(r&2)==2?!0:i[`aria-hidden`]??void 0,hidden:(r&4)==4?!0:void 0,style:{position:`fixed`,top:1,left:1,width:1,height:0,padding:0,margin:-1,overflow:`hidden`,clip:`rect(0, 0, 0, 0)`,whiteSpace:`nowrap`,borderWidth:`0`,...(r&4)==4&&(r&2)!=2&&{display:`none`}}},theirProps:i,slot:{},attrs:n,slots:t,name:`Hidden`})}}})}));function dae(){return gs()!==null}function gs(){return fr(vs,null)}function _s(e){dr(vs,e)}var vs,ys,bs=s((()=>{W(),vs=Symbol(`Context`),ys=(e=>(e[e.Open=1]=`Open`,e[e.Closed=2]=`Closed`,e[e.Closing=4]=`Closing`,e[e.Opening=8]=`Opening`,e))(ys||{})})),xs,Ss=s((()=>{xs=(e=>(e.Space=` `,e.Enter=`Enter`,e.Escape=`Escape`,e.Backspace=`Backspace`,e.Delete=`Delete`,e.ArrowLeft=`ArrowLeft`,e.ArrowUp=`ArrowUp`,e.ArrowRight=`ArrowRight`,e.ArrowDown=`ArrowDown`,e.Home=`Home`,e.End=`End`,e.PageUp=`PageUp`,e.PageDown=`PageDown`,e.Tab=`Tab`,e))(xs||{})})),Cs,fae=s((()=>{Cs=(e=>(e[e.Left=0]=`Left`,e[e.Right=2]=`Right`,e))(Cs||{})}));function pae(e){function t(){document.readyState!==`loading`&&(e(),document.removeEventListener(`DOMContentLoaded`,t))}typeof window<`u`&&typeof document<`u`&&(document.addEventListener(`DOMContentLoaded`,t),t())}var mae=s((()=>{})),ws,hae=s((()=>{mae(),ws=[],pae(()=>{function e(e){e.target instanceof HTMLElement&&e.target!==document.body&&ws[0]!==e.target&&(ws.unshift(e.target),ws=ws.filter(e=>e!=null&&e.isConnected),ws.splice(10))}window.addEventListener(`click`,e,{capture:!0}),window.addEventListener(`mousedown`,e,{capture:!0}),window.addEventListener(`focus`,e,{capture:!0}),document.body.addEventListener(`click`,e,{capture:!0}),document.body.addEventListener(`mousedown`,e,{capture:!0}),document.body.addEventListener(`focus`,e,{capture:!0})})}));function gae(e){throw Error(`Unexpected object: `+e)}function Ts(e,t){let n=t.resolveItems();if(n.length<=0)return null;let r=t.resolveActiveIndex(),i=r??-1;switch(e.focus){case 0:for(let e=0;e<n.length;++e)if(!t.resolveDisabled(n[e],e,n))return e;return r;case 1:i===-1&&(i=n.length);for(let e=i-1;e>=0;--e)if(!t.resolveDisabled(n[e],e,n))return e;return r;case 2:for(let e=i+1;e<n.length;++e)if(!t.resolveDisabled(n[e],e,n))return e;return r;case 3:for(let e=n.length-1;e>=0;--e)if(!t.resolveDisabled(n[e],e,n))return e;return r;case 4:for(let r=0;r<n.length;++r)if(t.resolveId(n[r],r,n)===e.id)return r;return r;case 5:return null;default:gae(e)}}var Es,Ds=s((()=>{Es=(e=>(e[e.First=0]=`First`,e[e.Previous=1]=`Previous`,e[e.Next=2]=`Next`,e[e.Last=3]=`Last`,e[e.Specific=4]=`Specific`,e[e.Nothing=5]=`Nothing`,e))(Es||{})}));function Os(e={},t=null,n=[]){for(let[r,i]of Object.entries(e))vae(n,_ae(t,r),i);return n}function _ae(e,t){return e?e+`[`+t+`]`:t}function vae(e,t,n){if(Array.isArray(n))for(let[r,i]of n.entries())vae(e,_ae(t,r.toString()),i);else n instanceof Date?e.push([t,n.toISOString()]):typeof n==`boolean`?e.push([t,n?`1`:`0`]):typeof n==`string`?e.push([t,n]):typeof n==`number`?e.push([t,`${n}`]):n==null?e.push([t,``]):Os(n,t,e)}function yae(e){var t;let n=e?.form??e.closest(`form`);if(n){for(let t of n.elements)if(t!==e&&(t.tagName===`INPUT`&&t.type===`submit`||t.tagName===`BUTTON`&&t.type===`submit`||t.nodeName===`INPUT`&&t.type===`image`)){t.click();return}(t=n.requestSubmit)==null||t.call(n)}}var ks=s((()=>{}));function bae(e,t){return e===t}function As(e){let t=fr(js,null);if(t===null){let t=Error(`<${e} /> is missing a parent <Combobox /> component.`);throw Error.captureStackTrace&&Error.captureStackTrace(t,As),t}return t}var xae,Sae,Cae,js,Ms,wae,Tae=s((()=>{Rie(),W(),wo(),Hie(),jo(),$o(),ts(),rs(),as(),hs(),bs(),Ss(),fae(),hae(),Ds(),Oo(),Mo(),Yo(),ks(),Po(),zo(),Xo(),fs(),xae=(e=>(e[e.Open=0]=`Open`,e[e.Closed=1]=`Closed`,e))(xae||{}),Sae=(e=>(e[e.Single=0]=`Single`,e[e.Multi=1]=`Multi`,e))(Sae||{}),Cae=(e=>(e[e.Pointer=0]=`Pointer`,e[e.Focus=1]=`Focus`,e[e.Other=2]=`Other`,e))(Cae||{}),js=Symbol(`ComboboxContext`),Ms=Symbol(`VirtualContext`),wae=N({name:`VirtualProvider`,setup(e,{slots:t}){let n=As(`VirtualProvider`),r=U(()=>{let e=G(n.optionsRef);if(!e)return{start:0,end:0};let t=window.getComputedStyle(e);return{start:parseFloat(t.paddingBlockStart||t.paddingTop),end:parseFloat(t.paddingBlockEnd||t.paddingBottom)}}),i=Lie(U(()=>({scrollPaddingStart:r.value.start,scrollPaddingEnd:r.value.end,count:n.virtual.value.options.length,estimateSize(){return 40},getScrollElement(){return G(n.optionsRef)},overscan:12}))),a=U(()=>n.virtual.value?.options),o=A(0);return mr([a],()=>{o.value+=1}),dr(Ms,n.virtual.value?i:null),()=>[ci(`div`,{style:{position:`relative`,width:`100%`,height:`${i.value.getTotalSize()}px`},ref:e=>{if(e){if(typeof process<`u`&&process.env.JEST_WORKER_ID!==void 0||n.activationTrigger.value===0)return;n.activeOptionIndex.value!==null&&n.virtual.value.options.length>n.activeOptionIndex.value&&i.value.scrollToIndex(n.activeOptionIndex.value)}}},i.value.getVirtualItems().map(e=>ei(t.default({option:n.virtual.value.options[e.index],open:n.comboboxState.value===0})[0],{key:`${o.value}-${e.index}`,"data-index":e.index,"aria-setsize":n.virtual.value.options.length,"aria-posinset":e.index+1,style:{position:`absolute`,top:0,left:0,transform:`translateY(${e.start}px)`,overflowAnchor:`none`}})))]}}),N({name:`Combobox`,emits:{"update:modelValue":e=>!0},props:{as:{type:[Object,String],default:`template`},disabled:{type:[Boolean],default:!1},by:{type:[String,Function],nullable:!0,default:null},modelValue:{type:[Object,String,Number,Boolean],default:void 0},defaultValue:{type:[Object,String,Number,Boolean],default:void 0},form:{type:String,optional:!0},name:{type:String,optional:!0},nullable:{type:Boolean,default:!1},multiple:{type:[Boolean],default:!1},immediate:{type:[Boolean],default:!1},virtual:{type:Object,default:null}},inheritAttrs:!1,setup(e,{slots:t,attrs:n,emit:r}){let i=A(1),a=A(null),o=A(null),s=A(null),c=A(null),l=A({static:!1,hold:!1}),u=A([]),d=A(null),f=A(2),p=A(!1);function m(e=e=>e){let t=d.value===null?null:u.value[d.value],n=e(u.value.slice()),r=n.length>0&&n[0].dataRef.order.value!==null?n.sort((e,t)=>e.dataRef.order.value-t.dataRef.order.value):Uo(n,e=>G(e.dataRef.domRef)),i=t?r.indexOf(t):null;return i===-1&&(i=null),{options:r,activeOptionIndex:i}}let h=U(()=>e.multiple?1:0),g=U(()=>e.nullable),[_,v]=Co(U(()=>e.modelValue),e=>r(`update:modelValue`,e),U(()=>e.defaultValue)),y=U(()=>_.value===void 0?No(h.value,{1:[],0:void 0}):_.value),b=null,x=null;function S(e){return No(h.value,{0(){return v?.(e)},1:()=>{let t=bn(C.value.value).slice(),n=bn(e),r=t.findIndex(e=>C.compare(n,bn(e)));return r===-1?t.push(n):t.splice(r,1),v?.(t)}})}mr([U(()=>{})],([e],[t])=>{if(C.virtual.value&&e&&t&&d.value!==null){let n=e.indexOf(t[d.value]);n===-1?d.value=null:d.value=n}});let C={comboboxState:i,value:y,mode:h,compare(t,n){if(typeof e.by==`string`){let r=e.by;return t?.[r]===n?.[r]}return e.by===null?bae(t,n):e.by(t,n)},calculateIndex(t){return C.virtual.value?e.by===null?C.virtual.value.options.indexOf(t):C.virtual.value.options.findIndex(e=>C.compare(e,t)):u.value.findIndex(e=>C.compare(e.dataRef.value,t))},defaultValue:U(()=>e.defaultValue),nullable:g,immediate:U(()=>!1),virtual:U(()=>null),inputRef:o,labelRef:a,buttonRef:s,optionsRef:c,disabled:U(()=>e.disabled),options:u,change(e){v(e)},activeOptionIndex:U(()=>{if(p.value&&d.value===null&&(C.virtual.value?C.virtual.value.options.length>0:u.value.length>0)){if(C.virtual.value){let e=C.virtual.value.options.findIndex(e=>{var t;return!((t=C.virtual.value)!=null&&t.disabled(e))});if(e!==-1)return e}let e=u.value.findIndex(e=>!e.dataRef.disabled);if(e!==-1)return e}return d.value}),activationTrigger:f,optionsPropsRef:l,closeCombobox(){p.value=!1,!e.disabled&&i.value!==1&&(i.value=1,d.value=null)},openCombobox(){if(p.value=!0,!e.disabled&&i.value!==0){if(C.value.value){let e=C.calculateIndex(C.value.value);e!==-1&&(d.value=e)}i.value=0}},setActivationTrigger(e){f.value=e},goToOption(t,n,r){p.value=!1,b!==null&&cancelAnimationFrame(b),b=requestAnimationFrame(()=>{if(e.disabled||c.value&&!l.value.static&&i.value===1)return;if(C.virtual.value){d.value=t===Es.Specific?n:Ts({focus:t},{resolveItems:()=>C.virtual.value.options,resolveActiveIndex:()=>C.activeOptionIndex.value??C.virtual.value.options.findIndex(e=>{var t;return!((t=C.virtual.value)!=null&&t.disabled(e))})??null,resolveDisabled:e=>C.virtual.value.disabled(e),resolveId(){throw Error(`Function not implemented.`)}}),f.value=r??2;return}let a=m();if(a.activeOptionIndex===null){let e=a.options.findIndex(e=>!e.dataRef.disabled);e!==-1&&(a.activeOptionIndex=e)}d.value=t===Es.Specific?n:Ts({focus:t},{resolveItems:()=>a.options,resolveActiveIndex:()=>a.activeOptionIndex,resolveId:e=>e.id,resolveDisabled:e=>e.dataRef.disabled}),f.value=r??2,u.value=a.options})},selectOption(e){let t=u.value.find(t=>t.id===e);if(!t)return;let{dataRef:n}=t;S(n.value)},selectActiveOption(){if(C.activeOptionIndex.value!==null){if(C.virtual.value)S(C.virtual.value.options[C.activeOptionIndex.value]);else{let{dataRef:e}=u.value[C.activeOptionIndex.value];S(e.value)}C.goToOption(Es.Specific,C.activeOptionIndex.value)}},registerOption(e,t){let n=fn({id:e,dataRef:t});if(C.virtual.value){u.value.push(n);return}x&&cancelAnimationFrame(x);let r=m(e=>(e.push(n),e));d.value===null&&C.isSelected(t.value.value)&&(r.activeOptionIndex=r.options.indexOf(n)),u.value=r.options,d.value=r.activeOptionIndex,f.value=2,r.options.some(e=>!G(e.dataRef.domRef))&&(x=requestAnimationFrame(()=>{let e=m();u.value=e.options,d.value=e.activeOptionIndex}))},unregisterOption(e,t){if(b!==null&&cancelAnimationFrame(b),t&&(p.value=!0),C.virtual.value){u.value=u.value.filter(t=>t.id!==e);return}let n=m(t=>{let n=t.findIndex(t=>t.id===e);return n!==-1&&t.splice(n,1),t});u.value=n.options,d.value=n.activeOptionIndex,f.value=2},isSelected(e){return No(h.value,{0:()=>C.compare(bn(C.value.value),bn(e)),1:()=>bn(C.value.value).some(t=>C.compare(bn(t),bn(e)))})},isActive(e){return d.value===C.calculateIndex(e)}};Qo([o,s,c],()=>C.closeCombobox(),U(()=>i.value===0)),dr(js,C),_s(U(()=>No(i.value,{0:ys.Open,1:ys.Closed})));let w=U(()=>G(o)?.closest(`form`));return Hi(()=>{mr([w],()=>{if(!w.value||e.defaultValue===void 0)return;function t(){C.change(e.defaultValue)}return w.value.addEventListener(`reset`,t),()=>{var e;(e=w.value)==null||e.removeEventListener(`reset`,t)}},{immediate:!0})}),()=>{let{name:r,disabled:a,form:o,...s}=e,c={open:i.value===0,disabled:a,activeIndex:C.activeOptionIndex.value,activeOption:C.activeOptionIndex.value===null?null:C.virtual.value?C.virtual.value.options[C.activeOptionIndex.value??0]:C.options.value[C.activeOptionIndex.value]?.dataRef.value??null,value:y.value};return ci(V,[...r!=null&&y.value!=null?Os({[r]:y.value}).map(([e,t])=>ci(ms,cs({features:ps.Hidden,key:e,as:`input`,type:`hidden`,hidden:!0,readOnly:!0,form:o,disabled:a,name:e,value:t}))):[],os({theirProps:{...n,...ls(s,[`by`,`defaultValue`,`immediate`,`modelValue`,`multiple`,`nullable`,`onUpdate:modelValue`,`virtual`])},ourProps:{},slot:c,slots:t,attrs:n,name:`Combobox`})])}}}),N({name:`ComboboxLabel`,props:{as:{type:[Object,String],default:`label`},id:{type:String,default:null}},setup(e,{attrs:t,slots:n}){let r=e.id??`headlessui-combobox-label-${Ao()}`,i=As(`ComboboxLabel`);function a(){var e;(e=G(i.inputRef))==null||e.focus({preventScroll:!0})}return()=>{let o={open:i.comboboxState.value===0,disabled:i.disabled.value},{...s}=e;return os({ourProps:{id:r,ref:i.labelRef,onClick:a},theirProps:s,slot:o,attrs:t,slots:n,name:`ComboboxLabel`})}}}),N({name:`ComboboxButton`,props:{as:{type:[Object,String],default:`button`},id:{type:String,default:null}},setup(e,{attrs:t,slots:n,expose:r}){let i=e.id??`headlessui-combobox-button-${Ao()}`,a=As(`ComboboxButton`);r({el:a.buttonRef,$el:a.buttonRef});function o(e){a.disabled.value||(a.comboboxState.value===0?a.closeCombobox():(e.preventDefault(),a.openCombobox()),ar(()=>G(a.inputRef)?.focus({preventScroll:!0})))}function s(e){switch(e.key){case xs.ArrowDown:e.preventDefault(),e.stopPropagation(),a.comboboxState.value===1&&a.openCombobox(),ar(()=>a.inputRef.value?.focus({preventScroll:!0}));return;case xs.ArrowUp:e.preventDefault(),e.stopPropagation(),a.comboboxState.value===1&&(a.openCombobox(),ar(()=>{a.value.value||a.goToOption(Es.Last)})),ar(()=>a.inputRef.value?.focus({preventScroll:!0}));return;case xs.Escape:if(a.comboboxState.value!==0)return;e.preventDefault(),a.optionsRef.value&&!a.optionsPropsRef.value.static&&e.stopPropagation(),a.closeCombobox(),ar(()=>a.inputRef.value?.focus({preventScroll:!0}));return}}let c=es(U(()=>({as:e.as,type:t.type})),a.buttonRef);return()=>{let r={open:a.comboboxState.value===0,disabled:a.disabled.value,value:a.value.value},{...l}=e;return os({ourProps:{ref:a.buttonRef,id:i,type:c.value,tabindex:`-1`,"aria-haspopup":`listbox`,"aria-controls":G(a.optionsRef)?.id,"aria-expanded":a.comboboxState.value===0,"aria-labelledby":a.labelRef.value?[G(a.labelRef)?.id,i].join(` `):void 0,disabled:a.disabled.value===!0?!0:void 0,onKeydown:s,onClick:o},theirProps:l,slot:r,attrs:t,slots:n,name:`ComboboxButton`})}}}),N({name:`ComboboxInput`,props:{as:{type:[Object,String],default:`input`},static:{type:Boolean,default:!1},unmount:{type:Boolean,default:!0},displayValue:{type:Function},defaultValue:{type:String,default:void 0},id:{type:String,default:null}},emits:{change:e=>!0},setup(e,{emit:t,attrs:n,slots:r,expose:i}){let a=e.id??`headlessui-combobox-input-${Ao()}`,o=As(`ComboboxInput`),s=U(()=>Ro(G(o.inputRef))),c={value:!1};i({el:o.inputRef,$el:o.inputRef});function l(){o.change(null);let e=G(o.optionsRef);e&&(e.scrollTop=0),o.goToOption(Es.Nothing)}let u=U(()=>{let t=o.value.value;return G(o.inputRef)?e.displayValue!==void 0&&t!==void 0?e.displayValue(t)??``:typeof t==`string`?t:``:``});Hi(()=>{mr([u,o.comboboxState,s],([e,t],[n,r])=>{if(c.value)return;let i=G(o.inputRef);i&&((r===0&&t===1||e!==n)&&(i.value=e),requestAnimationFrame(()=>{if(c.value||!i||s.value?.activeElement!==i)return;let{selectionStart:e,selectionEnd:t}=i;Math.abs((t??0)-(e??0))===0&&e===0&&i.setSelectionRange(i.value.length,i.value.length)}))},{immediate:!0}),mr([o.comboboxState],([e],[t])=>{if(e===0&&t===1){if(c.value)return;let e=G(o.inputRef);if(!e)return;let t=e.value,{selectionStart:n,selectionEnd:r,selectionDirection:i}=e;e.value=``,e.value=t,i===null?e.setSelectionRange(n,r):e.setSelectionRange(n,r,i)}})});let d=A(!1);function f(){d.value=!0}function p(){Do().nextFrame(()=>{d.value=!1})}let m=Vie();function h(e){switch(c.value=!0,m(()=>{c.value=!1}),e.key){case xs.Enter:if(c.value=!1,o.comboboxState.value!==0||d.value)return;if(e.preventDefault(),e.stopPropagation(),o.activeOptionIndex.value===null){o.closeCombobox();return}o.selectActiveOption(),o.mode.value===0&&o.closeCombobox();break;case xs.ArrowDown:return c.value=!1,e.preventDefault(),e.stopPropagation(),No(o.comboboxState.value,{0:()=>o.goToOption(Es.Next),1:()=>o.openCombobox()});case xs.ArrowUp:return c.value=!1,e.preventDefault(),e.stopPropagation(),No(o.comboboxState.value,{0:()=>o.goToOption(Es.Previous),1:()=>{o.openCombobox(),ar(()=>{o.value.value||o.goToOption(Es.Last)})}});case xs.Home:if(e.shiftKey)break;return c.value=!1,e.preventDefault(),e.stopPropagation(),o.goToOption(Es.First);case xs.PageUp:return c.value=!1,e.preventDefault(),e.stopPropagation(),o.goToOption(Es.First);case xs.End:if(e.shiftKey)break;return c.value=!1,e.preventDefault(),e.stopPropagation(),o.goToOption(Es.Last);case xs.PageDown:return c.value=!1,e.preventDefault(),e.stopPropagation(),o.goToOption(Es.Last);case xs.Escape:if(c.value=!1,o.comboboxState.value!==0)return;e.preventDefault(),o.optionsRef.value&&!o.optionsPropsRef.value.static&&e.stopPropagation(),o.nullable.value&&o.mode.value===0&&o.value.value===null&&l(),o.closeCombobox();break;case xs.Tab:if(c.value=!1,o.comboboxState.value!==0)return;o.mode.value===0&&o.activationTrigger.value!==1&&o.selectActiveOption(),o.closeCombobox();break}}function g(e){t(`change`,e),o.nullable.value&&o.mode.value===0&&e.target.value===``&&l(),o.openCombobox()}function _(e){var t,n;let r=e.relatedTarget??ws.find(t=>t!==e.currentTarget);if(c.value=!1,!((t=G(o.optionsRef))!=null&&t.contains(r))&&!((n=G(o.buttonRef))!=null&&n.contains(r))&&o.comboboxState.value===0)return e.preventDefault(),o.mode.value===0&&(o.nullable.value&&o.value.value===null?l():o.activationTrigger.value!==1&&o.selectActiveOption()),o.closeCombobox()}function v(e){var t,n;let r=e.relatedTarget??ws.find(t=>t!==e.currentTarget);(t=G(o.buttonRef))!=null&&t.contains(r)||(n=G(o.optionsRef))!=null&&n.contains(r)||o.disabled.value||o.immediate.value&&o.comboboxState.value!==0&&(o.openCombobox(),Do().nextFrame(()=>{o.setActivationTrigger(1)}))}let y=U(()=>e.defaultValue??(o.defaultValue.value===void 0?null:e.displayValue?.call(e,o.defaultValue.value))??o.defaultValue.value??``);return()=>{let t={open:o.comboboxState.value===0},{displayValue:i,onChange:s,...c}=e;return os({ourProps:{"aria-controls":o.optionsRef.value?.id,"aria-expanded":o.comboboxState.value===0,"aria-activedescendant":o.activeOptionIndex.value===null?void 0:o.virtual.value?o.options.value.find(e=>!o.virtual.value.disabled(e.dataRef.value)&&o.compare(e.dataRef.value,o.virtual.value.options[o.activeOptionIndex.value]))?.id:o.options.value[o.activeOptionIndex.value]?.id,"aria-labelledby":G(o.labelRef)?.id??G(o.buttonRef)?.id,"aria-autocomplete":`list`,id:a,onCompositionstart:f,onCompositionend:p,onKeydown:h,onInput:g,onFocus:v,onBlur:_,role:`combobox`,type:n.type??`text`,tabIndex:0,ref:o.inputRef,defaultValue:y.value,disabled:o.disabled.value===!0?!0:void 0},theirProps:c,slot:t,attrs:n,slots:r,features:us.RenderStrategy|us.Static,name:`ComboboxInput`})}}}),N({name:`ComboboxOptions`,props:{as:{type:[Object,String],default:`ul`},static:{type:Boolean,default:!1},unmount:{type:Boolean,default:!0},hold:{type:[Boolean],default:!1}},setup(e,{attrs:t,slots:n,expose:r}){let i=As(`ComboboxOptions`),a=`headlessui-combobox-options-${Ao()}`;r({el:i.optionsRef,$el:i.optionsRef}),pr(()=>{i.optionsPropsRef.value.static=e.static}),pr(()=>{i.optionsPropsRef.value.hold=e.hold});let o=gs(),s=U(()=>o===null?i.comboboxState.value===0:(o.value&ys.Open)===ys.Open);is({container:U(()=>G(i.optionsRef)),enabled:U(()=>i.comboboxState.value===0),accept(e){return e.getAttribute(`role`)===`option`?NodeFilter.FILTER_REJECT:e.hasAttribute(`role`)?NodeFilter.FILTER_SKIP:NodeFilter.FILTER_ACCEPT},walk(e){e.setAttribute(`role`,`none`)}});function c(e){e.preventDefault()}return()=>{let r={open:i.comboboxState.value===0};return os({ourProps:{"aria-labelledby":G(i.labelRef)?.id??G(i.buttonRef)?.id,id:a,ref:i.optionsRef,role:`listbox`,"aria-multiselectable":i.mode.value===1?!0:void 0,onMousedown:c},theirProps:ls(e,[`hold`]),slot:r,attrs:t,slots:i.virtual.value&&i.comboboxState.value===0?{...n,default:()=>[ci(wae,{},n.default)]}:n,features:us.RenderStrategy|us.Static,visible:s.value,name:`ComboboxOptions`})}}}),N({name:`ComboboxOption`,props:{as:{type:[Object,String],default:`li`},value:{type:[Object,String,Number,Boolean]},disabled:{type:Boolean,default:!1},order:{type:[Number],default:null}},setup(e,{slots:t,attrs:n,expose:r}){let i=As(`ComboboxOption`),a=`headlessui-combobox-option-${Ao()}`,o=A(null),s=U(()=>e.disabled);r({el:o,$el:o});let c=U(()=>i.virtual.value?i.activeOptionIndex.value===i.calculateIndex(e.value):i.activeOptionIndex.value===null?!1:i.options.value[i.activeOptionIndex.value]?.id===a),l=U(()=>i.isSelected(e.value)),u=fr(Ms,null),d=U(()=>({disabled:e.disabled,value:e.value,domRef:o,order:U(()=>e.order)}));Hi(()=>i.registerOption(a,d)),Gi(()=>i.unregisterOption(a,c.value)),pr(()=>{let e=G(o);e&&u?.value.measureElement(e)}),pr(()=>{i.comboboxState.value===0&&c.value&&(i.virtual.value||i.activationTrigger.value!==0&&ar(()=>{var e;return((e=G(o))?.scrollIntoView)?.call(e,{block:`nearest`})}))});function f(e){e.preventDefault(),e.button===Cs.Left&&(s.value||(i.selectOption(a),nae()||requestAnimationFrame(()=>G(i.inputRef)?.focus({preventScroll:!0})),i.mode.value===0&&i.closeCombobox()))}function p(){var t;if(e.disabled||(t=i.virtual.value)!=null&&t.disabled(e.value))return i.goToOption(Es.Nothing);let n=i.calculateIndex(e.value);i.goToOption(Es.Specific,n)}let m=ns();function h(e){m.update(e)}function g(t){var n;if(!m.wasMoved(t)||e.disabled||(n=i.virtual.value)!=null&&n.disabled(e.value)||c.value)return;let r=i.calculateIndex(e.value);i.goToOption(Es.Specific,r,0)}function _(t){var n;m.wasMoved(t)&&(e.disabled||(n=i.virtual.value)!=null&&n.disabled(e.value)||c.value&&(i.optionsPropsRef.value.hold||i.goToOption(Es.Nothing)))}return()=>{let{disabled:r}=e,i={active:c.value,selected:l.value,disabled:r};return os({ourProps:{id:a,ref:o,role:`option`,tabIndex:r===!0?void 0:-1,"aria-disabled":r===!0?!0:void 0,"aria-selected":l.value,disabled:void 0,onMousedown:f,onFocus:p,onPointerenter:h,onMouseenter:h,onPointermove:g,onMousemove:g,onPointerleave:_,onMouseleave:_},theirProps:ls(e,[`order`,`value`]),slot:i,attrs:n,slots:t,name:`ComboboxOption`})}}})}));function Ns(e,t,n,r){Io.isServer||pr(i=>{e??=window,e.addEventListener(t,n,r),i(()=>e.removeEventListener(t,n,r))})}var Ps=s((()=>{W(),Lo()}));function Fs(){let e=A(0);return iae(`keydown`,t=>{t.key===`Tab`&&(e.value=t.shiftKey?1:0)}),e}var Is,Eae=s((()=>{W(),aae(),Is=(e=>(e[e.Forwards=0]=`Forwards`,e[e.Backwards=1]=`Backwards`,e))(Is||{})}));function Dae(e){if(!e)return new Set;if(typeof e==`function`)return new Set(e());let t=new Set;for(let n of e.value){let e=G(n);e instanceof HTMLElement&&t.add(e)}return t}function Oae(e){let t=A(ws.slice());return mr([e],([e],[n])=>{n===!0&&e===!1?To(()=>{t.value.splice(0)}):n===!1&&e===!0&&(t.value=ws.slice())},{flush:`post`}),()=>t.value.find(e=>e!=null&&e.isConnected)??null}function kae({ownerDocument:e},t){let n=Oae(t);Hi(()=>{pr(()=>{t.value||e.value?.activeElement===e.value?.body&&Ho(n())},{flush:`post`})}),Gi(()=>{t.value&&Ho(n())})}function Aae({ownerDocument:e,container:t,initialFocus:n},r){let i=A(null),a=A(!1);return Hi(()=>a.value=!0),Gi(()=>a.value=!1),Hi(()=>{mr([t,n,r],(o,s)=>{if(o.every((e,t)=>s?.[t]===e)||!r.value)return;let c=G(t);c&&To(()=>{if(!a.value)return;let t=G(n),r=e.value?.activeElement;if(t){if(t===r){i.value=r;return}}else if(c.contains(r)){i.value=r;return}t?Ho(t):Wo(c,Ko.First|Ko.NoScroll)===qo.Error&&console.warn(`There are no focusable elements inside the <FocusTrap />`),i.value=e.value?.activeElement})},{immediate:!0,flush:`post`})}),i}function jae({ownerDocument:e,container:t,containers:n,previousActiveElement:r},i){Ns(e.value?.defaultView,`focus`,e=>{if(!i.value)return;let a=Dae(n);G(t)instanceof HTMLElement&&a.add(G(t));let o=r.value;if(!o)return;let s=e.target;s&&s instanceof HTMLElement?Mae(a,s)?(r.value=s,Ho(s)):(e.preventDefault(),e.stopPropagation(),Ho(o)):Ho(r.value)},!0)}function Mae(e,t){for(let n of e)if(n.contains(t))return!0;return!1}var Ls,Rs,Nae=s((()=>{W(),Ps(),Eae(),hs(),hae(),Mo(),Yo(),Po(),Eo(),zo(),fs(),Ls=(e=>(e[e.None=1]=`None`,e[e.InitialFocus=2]=`InitialFocus`,e[e.TabLock=4]=`TabLock`,e[e.FocusLock=8]=`FocusLock`,e[e.RestoreFocus=16]=`RestoreFocus`,e[e.All=30]=`All`,e))(Ls||{}),Rs=Object.assign(N({name:`FocusTrap`,props:{as:{type:[Object,String],default:`div`},initialFocus:{type:Object,default:null},features:{type:Number,default:30},containers:{type:[Object,Function],default:A(new Set)}},inheritAttrs:!1,setup(e,{attrs:t,slots:n,expose:r}){let i=A(null);r({el:i,$el:i});let a=U(()=>Ro(i)),o=A(!1);Hi(()=>o.value=!0),Gi(()=>o.value=!1),kae({ownerDocument:a},U(()=>o.value&&!!(e.features&16)));let s=Aae({ownerDocument:a,container:i,initialFocus:U(()=>e.initialFocus)},U(()=>o.value&&!!(e.features&2)));jae({ownerDocument:a,container:i,containers:e.containers,previousActiveElement:s},U(()=>o.value&&!!(e.features&8)));let c=Fs();function l(e){let t=G(i);t&&(e=>e())(()=>{No(c.value,{[Is.Forwards]:()=>{Wo(t,Ko.First,{skipElements:[e.relatedTarget]})},[Is.Backwards]:()=>{Wo(t,Ko.Last,{skipElements:[e.relatedTarget]})}})})}let u=A(!1);function d(e){e.key===`Tab`&&(u.value=!0,requestAnimationFrame(()=>{u.value=!1}))}function f(t){if(!o.value)return;let n=Dae(e.containers);G(i)instanceof HTMLElement&&n.add(G(i));let r=t.relatedTarget;r instanceof HTMLElement&&r.dataset.headlessuiFocusGuard!==`true`&&(Mae(n,r)||(u.value?Wo(G(i),No(c.value,{[Is.Forwards]:()=>Ko.Next,[Is.Backwards]:()=>Ko.Previous})|Ko.WrapAround,{relativeTo:t.target}):t.target instanceof HTMLElement&&Ho(t.target)))}return()=>{let r={},a={ref:i,onKeydown:d,onFocusout:f},{features:o,initialFocus:s,containers:c,...u}=e;return ci(V,[!!(o&4)&&ci(ms,{as:`button`,type:`button`,"data-headlessui-focus-guard":!0,onFocus:l,features:ps.Focusable}),os({ourProps:a,theirProps:{...t,...u},slot:r,attrs:t,slots:n,name:`FocusTrap`}),!!(o&4)&&ci(ms,{as:`button`,type:`button`,"data-headlessui-focus-guard":!0,onFocus:l,features:ps.Focusable})])}}}),{features:Ls})}));function Pae(e){let t=Sn(e.getSnapshot());return Gi(e.subscribe(()=>{t.value=e.getSnapshot()})),t}var Fae=s((()=>{W()}));function Iae(e,t){let n=e(),r=new Set;return{getSnapshot(){return n},subscribe(e){return r.add(e),()=>r.delete(e)},dispatch(e,...i){let a=t[e].call(n,...i);a&&(n=a,r.forEach(e=>e()))}}}var Lae=s((()=>{}));function Rae(){let e;return{before({doc:t}){let n=t.documentElement;e=(t.defaultView??window).innerWidth-n.clientWidth},after({doc:t,d:n}){let r=t.documentElement,i=r.clientWidth-r.offsetWidth,a=e-i;n.style(r,`paddingRight`,`${a}px`)}}}var zae=s((()=>{}));function Bae(){return eae()?{before({doc:e,d:t,meta:n}){function r(e){return n.containers.flatMap(e=>e()).some(t=>t.contains(e))}t.microTask(()=>{if(window.getComputedStyle(e.documentElement).scrollBehavior!==`auto`){let n=Do();n.style(e.documentElement,`scrollBehavior`,`auto`),t.add(()=>t.microTask(()=>n.dispose()))}let n=window.scrollY??window.pageYOffset,i=null;t.addEventListener(e,`click`,t=>{if(t.target instanceof HTMLElement)try{let n=t.target.closest(`a`);if(!n)return;let{hash:a}=new URL(n.href),o=e.querySelector(a);o&&!r(o)&&(i=o)}catch{}},!0),t.addEventListener(e,`touchstart`,e=>{if(e.target instanceof HTMLElement)if(r(e.target)){let n=e.target;for(;n.parentElement&&r(n.parentElement);)n=n.parentElement;t.style(n,`overscrollBehavior`,`contain`)}else t.style(e.target,`touchAction`,`none`)}),t.addEventListener(e,`touchmove`,e=>{if(e.target instanceof HTMLElement){if(e.target.tagName===`INPUT`)return;if(r(e.target)){let t=e.target;for(;t.parentElement&&t.dataset.headlessuiPortal!==``&&!(t.scrollHeight>t.clientHeight||t.scrollWidth>t.clientWidth);)t=t.parentElement;t.dataset.headlessuiPortal===``&&e.preventDefault()}else e.preventDefault()}},{passive:!1}),t.add(()=>{n!==(window.scrollY??window.pageYOffset)&&window.scrollTo(0,n),i&&i.isConnected&&(i.scrollIntoView({block:`nearest`}),i=null)})})}}:{}}var Vae=s((()=>{Oo(),Xo()}));function Hae(){return{before({doc:e,d:t}){t.style(e.documentElement,`overflow`,`hidden`)}}}var Uae=s((()=>{}));function Wae(e){let t={};for(let n of e)Object.assign(t,n(t));return t}var zs,Gae=s((()=>{Oo(),Lae(),zae(),Vae(),Uae(),zs=Iae(()=>new Map,{PUSH(e,t){let n=this.get(e)??{doc:e,count:0,d:Do(),meta:new Set};return n.count++,n.meta.add(t),this.set(e,n),this},POP(e,t){let n=this.get(e);return n&&(n.count--,n.meta.delete(t)),this},SCROLL_PREVENT({doc:e,d:t,meta:n}){let r={doc:e,d:t,meta:Wae(n)},i=[Bae(),Rae(),Hae()];i.forEach(({before:e})=>e?.(r)),i.forEach(({after:e})=>e?.(r))},SCROLL_ALLOW({d:e}){e.dispose()},TEARDOWN({doc:e}){this.delete(e)}}),zs.subscribe(()=>{let e=zs.getSnapshot(),t=new Map;for(let[n]of e)t.set(n,n.documentElement.style.overflow);for(let n of e.values()){let e=t.get(n.doc)===`hidden`,r=n.count!==0;(r&&!e||!r&&e)&&zs.dispatch(n.count>0?`SCROLL_PREVENT`:`SCROLL_ALLOW`,n),n.count===0&&zs.dispatch(`TEARDOWN`,n)}})}));function Kae(e,t,n){let r=Pae(zs),i=U(()=>{let t=e.value?r.value.get(e.value):void 0;return t?t.count>0:!1});return mr([e,t],([e,t],[r],i)=>{if(!e||!t)return;zs.dispatch(`PUSH`,e,n);let a=!1;i(()=>{a||=(zs.dispatch(`POP`,r??e,n),!0)})},{immediate:!0}),i}var qae=s((()=>{W(),Fae(),Gae()}));function Jae(e,t=A(!0)){pr(n=>{if(!t.value)return;let r=G(e);if(!r)return;n(function(){if(!r)return;let e=Vs.get(r)??1;if(e===1?Vs.delete(r):Vs.set(r,e-1),e!==1)return;let t=Bs.get(r);t&&(t[`aria-hidden`]===null?r.removeAttribute(`aria-hidden`):r.setAttribute(`aria-hidden`,t[`aria-hidden`]),r.inert=t.inert,Bs.delete(r))});let i=Vs.get(r)??0;Vs.set(r,i+1),i===0&&(Bs.set(r,{"aria-hidden":r.getAttribute(`aria-hidden`),inert:r.inert}),r.setAttribute(`aria-hidden`,`true`),r.inert=!0)})}var Bs,Vs,Yae=s((()=>{W(),Mo(),Bs=new Map,Vs=new Map}));function Xae({defaultContainers:e=[],portals:t,mainTreeNodeRef:n}={}){let r=A(null),i=Ro(r);function a(){let n=[];for(let t of e)t!==null&&(t instanceof HTMLElement?n.push(t):`value`in t&&t.value instanceof HTMLElement&&n.push(t.value));if(t!=null&&t.value)for(let e of t.value)n.push(e);for(let e of i?.querySelectorAll(`html > *, body > *`)??[])e!==document.body&&e!==document.head&&e instanceof HTMLElement&&e.id!==`headlessui-portal-root`&&(e.contains(G(r))||e.contains(G(r)?.getRootNode()?.host)||n.some(t=>e.contains(t))||n.push(e));return n}return{resolveContainers:a,contains(e){return a().some(t=>t.contains(e))},mainTreeNodeRef:r,MainTreeNode(){return n==null?ci(ms,{features:ps.Hidden,ref:r}):null}}}function Zae(){let e=A(null);return{mainTreeNodeRef:e,MainTreeNode(){return ci(ms,{features:ps.Hidden,ref:e})}}}var Qae=s((()=>{W(),hs(),Mo(),zo()}));function $ae(){return fr(Hs,!1)}var Hs,Us,eoe=s((()=>{W(),fs(),Hs=Symbol(`ForcePortalRootContext`),Us=N({name:`ForcePortalRoot`,props:{as:{type:[Object,String],default:`template`},force:{type:Boolean,default:!1}},setup(e,{slots:t,attrs:n}){return dr(Hs,e.force),()=>{let{force:r,...i}=e;return os({theirProps:i,ourProps:{},slot:{},slots:t,attrs:n,name:`ForcePortalRoot`})}}})}));function toe(){return fr(Ws,()=>{})}function noe({type:e,enabled:t,element:n,onUpdate:r}){let i=toe();function a(...e){r?.(...e),i(...e)}Hi(()=>{mr(t,(t,r)=>{t?a(0,e,n):r===!0&&a(1,e,n)},{immediate:!0,flush:`sync`})}),Gi(()=>{t.value&&a(1,e,n)}),dr(Ws,a)}var Ws,Gs,roe=s((()=>{W(),Ws=Symbol(`StackContext`),Gs=(e=>(e[e.Add=0]=`Add`,e[e.Remove=1]=`Remove`,e))(Gs||{})}));function ioe(){let e=fr(qs,null);if(e===null)throw Error(`Missing parent`);return e}function Ks({slot:e=A({}),name:t=`Description`,props:n={}}={}){let r=A([]);function i(e){return r.value.push(e),()=>{let t=r.value.indexOf(e);t!==-1&&r.value.splice(t,1)}}return dr(qs,{register:i,slot:e,name:t,props:n}),U(()=>r.value.length>0?r.value.join(` `):void 0)}var qs,Js=s((()=>{W(),jo(),fs(),qs=Symbol(`DescriptionContext`),N({name:`Description`,props:{as:{type:[Object,String],default:`p`},id:{type:String,default:null}},setup(e,{attrs:t,slots:n}){let r=e.id??`headlessui-description-${Ao()}`,i=ioe();return Hi(()=>Gi(i.register(r))),()=>{let{name:a=`Description`,slot:o=A({}),props:s={}}=i,{...c}=e;return os({ourProps:{...Object.entries(s).reduce((e,[t,n])=>Object.assign(e,{[t]:j(n)}),{}),id:r},theirProps:c,slot:o.value,attrs:t,slots:n,name:a})}}})}));function aoe(e){let t=Ro(e);if(!t){if(e===null)return null;throw Error(`[Headless UI]: Cannot find ownerDocument for contextElement: ${e}`)}let n=t.getElementById(`headlessui-portal-root`);if(n)return n;let r=t.createElement(`div`);return r.setAttribute(`id`,`headlessui-portal-root`),t.body.appendChild(r)}function ooe(e){return Ys.get(e)??0}function soe(e,t){let n=t(ooe(e));return n<=0?Ys.delete(e):Ys.set(e,n),n}function coe(){let e=fr(Zs,null),t=A([]);function n(n){return t.value.push(n),e&&e.register(n),()=>r(n)}function r(n){let r=t.value.indexOf(n);r!==-1&&t.value.splice(r,1),e&&e.unregister(n)}let i={register:n,unregister:r,portals:t};return[t,N({name:`PortalWrapper`,setup(e,{slots:t}){return dr(Zs,i),()=>t.default?.call(t)}})]}var Ys,Xs,Zs,Qs,loe,uoe=s((()=>{W(),eoe(),Mo(),zo(),fs(),Ys=new WeakMap,Xs=N({name:`Portal`,props:{as:{type:[Object,String],default:`div`}},setup(e,{slots:t,attrs:n}){let r=A(null),i=U(()=>Ro(r)),a=$ae(),o=fr(Qs,null),s=A(a===!0||o==null?aoe(r.value):o.resolveTarget());s.value&&soe(s.value,e=>e+1);let c=A(!1);Hi(()=>{c.value=!0}),pr(()=>{a||o!=null&&(s.value=o.resolveTarget())});let l=fr(Zs,null),u=!1,d=ba();return mr(r,()=>{if(u||!l)return;let e=G(r);e&&(Gi(l.register(e),d),u=!0)}),Gi(()=>{var e;let t=i.value?.getElementById(`headlessui-portal-root`);!t||s.value!==t||soe(s.value,e=>e-1)||s.value.children.length>0||(e=s.value.parentElement)==null||e.removeChild(s.value)}),()=>{if(!c.value||s.value===null)return null;let i={ref:r,"data-headlessui-portal":``};return ci(Di,{to:s.value},os({ourProps:i,theirProps:e,slot:{},attrs:n,slots:t,name:`Portal`}))}}}),Zs=Symbol(`PortalParentContext`),Qs=Symbol(`PortalGroupContext`),loe=N({name:`PortalGroup`,props:{as:{type:[Object,String],default:`template`},target:{type:Object,default:null}},setup(e,{attrs:t,slots:n}){return dr(Qs,fn({resolveTarget(){return e.target}})),()=>{let{target:r,...i}=e;return os({theirProps:i,ourProps:{},slot:{},attrs:t,slots:n,name:`PortalGroup`})}}})}));function $s(e){let t=fr(ec,null);if(t===null){let t=Error(`<${e} /> is missing a parent <Dialog /> component.`);throw Error.captureStackTrace&&Error.captureStackTrace(t,$s),t}return t}var doe,ec,tc,foe,poe,moe,hoe=s((()=>{W(),Nae(),qae(),Ps(),jo(),Yae(),$o(),Qae(),bs(),eoe(),roe(),Ss(),Mo(),Po(),zo(),fs(),Js(),uoe(),doe=(e=>(e[e.Open=0]=`Open`,e[e.Closed=1]=`Closed`,e))(doe||{}),ec=Symbol(`DialogContext`),tc=`DC8F892D-2EBD-447C-A4C8-A03058436FF4`,foe=N({name:`Dialog`,inheritAttrs:!1,props:{as:{type:[Object,String],default:`div`},static:{type:Boolean,default:!1},unmount:{type:Boolean,default:!0},open:{type:[Boolean,String],default:tc},initialFocus:{type:Object,default:null},id:{type:String,default:null},role:{type:String,default:`dialog`}},emits:{close:e=>!0},setup(e,{emit:t,attrs:n,slots:r,expose:i}){let a=e.id??`headlessui-dialog-${Ao()}`,o=A(!1);Hi(()=>{o.value=!0});let s=!1,c=U(()=>e.role===`dialog`||e.role===`alertdialog`?e.role:(s||(s=!0,console.warn(`Invalid role [${c}] passed to <Dialog />. Only \`dialog\` and and \`alertdialog\` are supported. Using \`dialog\` instead.`)),`dialog`)),l=A(0),u=gs(),d=U(()=>e.open===tc&&u!==null?(u.value&ys.Open)===ys.Open:e.open),f=A(null),p=U(()=>Ro(f));if(i({el:f,$el:f}),!(e.open!==tc||u!==null))throw Error("You forgot to provide an `open` prop to the `Dialog`.");if(typeof d.value!=`boolean`)throw Error(`You provided an \`open\` prop to the \`Dialog\`, but the value is not a boolean. Received: ${d.value===tc?void 0:e.open}`);let m=U(()=>o.value&&d.value?0:1),h=U(()=>m.value===0),g=U(()=>l.value>1),_=fr(ec,null)!==null,[v,y]=coe(),{resolveContainers:b,mainTreeNodeRef:x,MainTreeNode:S}=Xae({portals:v,defaultContainers:[U(()=>T.panelRef.value??f.value)]}),C=U(()=>g.value?`parent`:`leaf`),w=U(()=>u===null?!1:(u.value&ys.Closing)===ys.Closing),ee=U(()=>_||w.value?!1:h.value);Jae(U(()=>Array.from(p.value?.querySelectorAll(`body > *`)??[]).find(e=>e.id===`headlessui-portal-root`?!1:e.contains(G(x))&&e instanceof HTMLElement)??null),ee);let te=U(()=>g.value?!0:h.value);Jae(U(()=>Array.from(p.value?.querySelectorAll(`[data-headlessui-portal]`)??[]).find(e=>e.contains(G(x))&&e instanceof HTMLElement)??null),te),noe({type:`Dialog`,enabled:U(()=>m.value===0),element:f,onUpdate:(e,t)=>{if(t===`Dialog`)return No(e,{[Gs.Add]:()=>l.value+=1,[Gs.Remove]:()=>--l.value})}});let ne=Ks({name:`DialogDescription`,slot:U(()=>({open:d.value}))}),re=A(null),T={titleId:re,panelRef:A(null),dialogState:m,setTitleId(e){re.value!==e&&(re.value=e)},close(){t(`close`,!1)}};dr(ec,T),Qo(b,(e,t)=>{e.preventDefault(),T.close(),ar(()=>t?.focus())},U(()=>!(!h.value||g.value)));let ie=U(()=>!(g.value||m.value!==0));return Ns(p.value?.defaultView,`keydown`,e=>{ie.value&&(e.defaultPrevented||e.key===xs.Escape&&(e.preventDefault(),e.stopPropagation(),T.close()))}),Kae(p,U(()=>!(w.value||m.value!==0||_)),e=>({containers:[...e.containers??[],b]})),pr(e=>{if(m.value!==0)return;let t=G(f);if(!t)return;let n=new ResizeObserver(e=>{for(let t of e){let e=t.target.getBoundingClientRect();e.x===0&&e.y===0&&e.width===0&&e.height===0&&T.close()}});n.observe(t),e(()=>n.disconnect())}),()=>{let{open:t,initialFocus:i,...o}=e,s={...n,ref:f,id:a,role:c.value,"aria-modal":m.value===0?!0:void 0,"aria-labelledby":re.value,"aria-describedby":ne.value},l={open:m.value===0};return ci(Us,{force:!0},()=>[ci(Xs,()=>ci(loe,{target:f.value},()=>ci(Us,{force:!1},()=>ci(Rs,{initialFocus:i,containers:b,features:h.value?No(C.value,{parent:Rs.features.RestoreFocus,leaf:Rs.features.All&~Rs.features.FocusLock}):Rs.features.None},()=>ci(y,{},()=>os({ourProps:s,theirProps:{...o,...n},slot:l,attrs:n,slots:r,visible:m.value===0,features:us.RenderStrategy|us.Static,name:`Dialog`})))))),ci(S)])}}}),N({name:`DialogOverlay`,props:{as:{type:[Object,String],default:`div`},id:{type:String,default:null}},setup(e,{attrs:t,slots:n}){let r=e.id??`headlessui-dialog-overlay-${Ao()}`,i=$s(`DialogOverlay`);function a(e){e.target===e.currentTarget&&(e.preventDefault(),e.stopPropagation(),i.close())}return()=>{let{...o}=e;return os({ourProps:{id:r,"aria-hidden":!0,onClick:a},theirProps:o,slot:{open:i.dialogState.value===0},attrs:t,slots:n,name:`DialogOverlay`})}}}),N({name:`DialogBackdrop`,props:{as:{type:[Object,String],default:`div`},id:{type:String,default:null}},inheritAttrs:!1,setup(e,{attrs:t,slots:n,expose:r}){let i=e.id??`headlessui-dialog-backdrop-${Ao()}`,a=$s(`DialogBackdrop`),o=A(null);return r({el:o,$el:o}),Hi(()=>{if(a.panelRef.value===null)throw Error(`A <DialogBackdrop /> component is being used, but a <DialogPanel /> component is missing.`)}),()=>{let{...r}=e,s={id:i,ref:o,"aria-hidden":!0};return ci(Us,{force:!0},()=>ci(Xs,()=>os({ourProps:s,theirProps:{...t,...r},slot:{open:a.dialogState.value===0},attrs:t,slots:n,name:`DialogBackdrop`})))}}}),poe=N({name:`DialogPanel`,props:{as:{type:[Object,String],default:`div`},id:{type:String,default:null}},setup(e,{attrs:t,slots:n,expose:r}){let i=e.id??`headlessui-dialog-panel-${Ao()}`,a=$s(`DialogPanel`);r({el:a.panelRef,$el:a.panelRef});function o(e){e.stopPropagation()}return()=>{let{...r}=e;return os({ourProps:{id:i,ref:a.panelRef,onClick:o},theirProps:r,slot:{open:a.dialogState.value===0},attrs:t,slots:n,name:`DialogPanel`})}}}),moe=N({name:`DialogTitle`,props:{as:{type:[Object,String],default:`h2`},id:{type:String,default:null}},setup(e,{attrs:t,slots:n}){let r=e.id??`headlessui-dialog-title-${Ao()}`,i=$s(`DialogTitle`);return Hi(()=>{i.setTitleId(r),Gi(()=>i.setTitleId(null))}),()=>{let{...a}=e;return os({ourProps:{id:r},theirProps:a,slot:{open:i.dialogState.value===0},attrs:t,slots:n,name:`DialogTitle`})}}})}));function nc(e){let t=fr(rc,null);if(t===null){let t=Error(`<${e} /> is missing a parent <Disclosure /> component.`);throw Error.captureStackTrace&&Error.captureStackTrace(t,nc),t}return t}function goe(){return fr(ic,null)}var _oe,rc,ic,ac,oc,sc,voe=s((()=>{W(),jo(),ts(),bs(),Ss(),Mo(),Po(),fs(),_oe=(e=>(e[e.Open=0]=`Open`,e[e.Closed=1]=`Closed`,e))(_oe||{}),rc=Symbol(`DisclosureContext`),ic=Symbol(`DisclosurePanelContext`),ac=N({name:`Disclosure`,props:{as:{type:[Object,String],default:`template`},defaultOpen:{type:[Boolean],default:!1}},setup(e,{slots:t,attrs:n}){let r=A(e.defaultOpen?0:1),i=A(null),a=A(null),o={buttonId:A(`headlessui-disclosure-button-${Ao()}`),panelId:A(`headlessui-disclosure-panel-${Ao()}`),disclosureState:r,panel:i,button:a,toggleDisclosure(){r.value=No(r.value,{0:1,1:0})},closeDisclosure(){r.value!==1&&(r.value=1)},close(e){o.closeDisclosure(),(e?e instanceof HTMLElement?e:e.value instanceof HTMLElement?G(e):G(o.button):G(o.button))?.focus()}};return dr(rc,o),_s(U(()=>No(r.value,{0:ys.Open,1:ys.Closed}))),()=>{let{defaultOpen:i,...a}=e;return os({theirProps:a,ourProps:{},slot:{open:r.value===0,close:o.close},slots:t,attrs:n,name:`Disclosure`})}}}),oc=N({name:`DisclosureButton`,props:{as:{type:[Object,String],default:`button`},disabled:{type:[Boolean],default:!1},id:{type:String,default:null}},setup(e,{attrs:t,slots:n,expose:r}){let i=nc(`DisclosureButton`),a=goe(),o=U(()=>a===null?!1:a.value===i.panelId.value);Hi(()=>{o.value||e.id!==null&&(i.buttonId.value=e.id)}),Gi(()=>{o.value||(i.buttonId.value=null)});let s=A(null);r({el:s,$el:s}),o.value||pr(()=>{i.button.value=s.value});let c=es(U(()=>({as:e.as,type:t.type})),s);function l(){var t;e.disabled||(o.value?(i.toggleDisclosure(),(t=G(i.button))==null||t.focus()):i.toggleDisclosure())}function u(t){var n;if(!e.disabled)if(o.value)switch(t.key){case xs.Space:case xs.Enter:t.preventDefault(),t.stopPropagation(),i.toggleDisclosure(),(n=G(i.button))==null||n.focus();break}else switch(t.key){case xs.Space:case xs.Enter:t.preventDefault(),t.stopPropagation(),i.toggleDisclosure();break}}function d(e){switch(e.key){case xs.Space:e.preventDefault();break}}return()=>{let r={open:i.disclosureState.value===0},{id:a,...f}=e;return os({ourProps:o.value?{ref:s,type:c.value,onClick:l,onKeydown:u}:{id:i.buttonId.value??a,ref:s,type:c.value,"aria-expanded":i.disclosureState.value===0,"aria-controls":i.disclosureState.value===0||G(i.panel)?i.panelId.value:void 0,disabled:e.disabled?!0:void 0,onClick:l,onKeydown:u,onKeyup:d},theirProps:f,slot:r,attrs:t,slots:n,name:`DisclosureButton`})}}}),sc=N({name:`DisclosurePanel`,props:{as:{type:[Object,String],default:`div`},static:{type:Boolean,default:!1},unmount:{type:Boolean,default:!0},id:{type:String,default:null}},setup(e,{attrs:t,slots:n,expose:r}){let i=nc(`DisclosurePanel`);Hi(()=>{e.id!==null&&(i.panelId.value=e.id)}),Gi(()=>{i.panelId.value=null}),r({el:i.panel,$el:i.panel}),dr(ic,i.panelId);let a=gs(),o=U(()=>a===null?i.disclosureState.value===0:(a.value&ys.Open)===ys.Open);return()=>{let r={open:i.disclosureState.value===0,close:i.close},{id:a,...s}=e;return os({ourProps:{id:i.panelId.value??a,ref:i.panel},theirProps:s,slot:r,attrs:t,slots:n,features:us.RenderStrategy|us.Static,visible:o.value,name:`DisclosurePanel`})}}})}));function yoe(e){let t=e.innerText??``,n=e.cloneNode(!0);if(!(n instanceof HTMLElement))return t;let r=!1;for(let e of n.querySelectorAll(`[hidden],[aria-hidden],[role="img"]`))e.remove(),r=!0;let i=r?n.innerText??``:t;return cc.test(i)&&(i=i.replace(cc,``)),i}function boe(e){let t=e.getAttribute(`aria-label`);if(typeof t==`string`)return t.trim();let n=e.getAttribute(`aria-labelledby`);if(n){let e=n.split(` `).map(e=>{let t=document.getElementById(e);if(t){let e=t.getAttribute(`aria-label`);return typeof e==`string`?e.trim():yoe(t).trim()}return null}).filter(Boolean);if(e.length>0)return e.join(`, `)}return yoe(e).trim()}var cc,xoe=s((()=>{cc=/([\u2700-\u27BF]|[\uE000-\uF8FF]|\uD83C[\uDC00-\uDFFF]|\uD83D[\uDC00-\uDFFF]|[\u2011-\u26FF]|\uD83E[\uDD10-\uDDFF])/g}));function Soe(e){let t=A(``),n=A(``);return()=>{let r=G(e);if(!r)return``;let i=r.innerText;if(t.value===i)return n.value;let a=boe(r).trim().toLowerCase();return t.value=i,n.value=a,a}}var Coe=s((()=>{W(),Mo(),xoe()}));function woe(e,t){return e===t}function Toe(e){requestAnimationFrame(()=>requestAnimationFrame(e))}function lc(e){let t=fr(uc,null);if(t===null){let t=Error(`<${e} /> is missing a parent <Listbox /> component.`);throw Error.captureStackTrace&&Error.captureStackTrace(t,lc),t}return t}var Eoe,Doe,Ooe,uc,koe,Aoe,joe,Moe,Noe,Poe=s((()=>{W(),wo(),jo(),$o(),ts(),Coe(),rs(),hs(),bs(),Ss(),Ds(),Mo(),Yo(),ks(),Po(),fs(),Eoe=(e=>(e[e.Open=0]=`Open`,e[e.Closed=1]=`Closed`,e))(Eoe||{}),Doe=(e=>(e[e.Single=0]=`Single`,e[e.Multi=1]=`Multi`,e))(Doe||{}),Ooe=(e=>(e[e.Pointer=0]=`Pointer`,e[e.Other=1]=`Other`,e))(Ooe||{}),uc=Symbol(`ListboxContext`),koe=N({name:`Listbox`,emits:{"update:modelValue":e=>!0},props:{as:{type:[Object,String],default:`template`},disabled:{type:[Boolean],default:!1},by:{type:[String,Function],default:()=>woe},horizontal:{type:[Boolean],default:!1},modelValue:{type:[Object,String,Number,Boolean],default:void 0},defaultValue:{type:[Object,String,Number,Boolean],default:void 0},form:{type:String,optional:!0},name:{type:String,optional:!0},multiple:{type:[Boolean],default:!1}},inheritAttrs:!1,setup(e,{slots:t,attrs:n,emit:r}){let i=A(1),a=A(null),o=A(null),s=A(null),c=A([]),l=A(``),u=A(null),d=A(1);function f(e=e=>e){let t=u.value===null?null:c.value[u.value],n=Uo(e(c.value.slice()),e=>G(e.dataRef.domRef)),r=t?n.indexOf(t):null;return r===-1&&(r=null),{options:n,activeOptionIndex:r}}let p=U(()=>e.multiple?1:0),[m,h]=Co(U(()=>e.modelValue),e=>r(`update:modelValue`,e),U(()=>e.defaultValue)),g=U(()=>m.value===void 0?No(p.value,{1:[],0:void 0}):m.value),_={listboxState:i,value:g,mode:p,compare(t,n){if(typeof e.by==`string`){let r=e.by;return t?.[r]===n?.[r]}return e.by(t,n)},orientation:U(()=>e.horizontal?`horizontal`:`vertical`),labelRef:a,buttonRef:o,optionsRef:s,disabled:U(()=>e.disabled),options:c,searchQuery:l,activeOptionIndex:u,activationTrigger:d,closeListbox(){e.disabled||i.value!==1&&(i.value=1,u.value=null)},openListbox(){e.disabled||i.value!==0&&(i.value=0)},goToOption(t,n,r){if(e.disabled||i.value===1)return;let a=f(),o=Ts(t===Es.Specific?{focus:Es.Specific,id:n}:{focus:t},{resolveItems:()=>a.options,resolveActiveIndex:()=>a.activeOptionIndex,resolveId:e=>e.id,resolveDisabled:e=>e.dataRef.disabled});l.value=``,u.value=o,d.value=r??1,c.value=a.options},search(t){if(e.disabled||i.value===1)return;let n=l.value===``?1:0;l.value+=t.toLowerCase();let r=(u.value===null?c.value:c.value.slice(u.value+n).concat(c.value.slice(0,u.value+n))).find(e=>e.dataRef.textValue.startsWith(l.value)&&!e.dataRef.disabled),a=r?c.value.indexOf(r):-1;a===-1||a===u.value||(u.value=a,d.value=1)},clearSearch(){e.disabled||i.value!==1&&l.value!==``&&(l.value=``)},registerOption(e,t){let n=f(n=>[...n,{id:e,dataRef:t}]);c.value=n.options,u.value=n.activeOptionIndex},unregisterOption(e){let t=f(t=>{let n=t.findIndex(t=>t.id===e);return n!==-1&&t.splice(n,1),t});c.value=t.options,u.value=t.activeOptionIndex,d.value=1},theirOnChange(t){e.disabled||h(t)},select(t){e.disabled||h(No(p.value,{0:()=>t,1:()=>{let e=bn(_.value.value).slice(),n=bn(t),r=e.findIndex(e=>_.compare(n,bn(e)));return r===-1?e.push(n):e.splice(r,1),e}}))}};Qo([o,s],(e,t)=>{var n;_.closeListbox(),Vo(t,Jo.Loose)||(e.preventDefault(),(n=G(o))==null||n.focus())},U(()=>i.value===0)),dr(uc,_),_s(U(()=>No(i.value,{0:ys.Open,1:ys.Closed})));let v=U(()=>G(o)?.closest(`form`));return Hi(()=>{mr([v],()=>{if(!v.value||e.defaultValue===void 0)return;function t(){_.theirOnChange(e.defaultValue)}return v.value.addEventListener(`reset`,t),()=>{var e;(e=v.value)==null||e.removeEventListener(`reset`,t)}},{immediate:!0})}),()=>{let{name:r,modelValue:a,disabled:o,form:s,...c}=e,l={open:i.value===0,disabled:o,value:g.value};return ci(V,[...r!=null&&g.value!=null?Os({[r]:g.value}).map(([e,t])=>ci(ms,cs({features:ps.Hidden,key:e,as:`input`,type:`hidden`,hidden:!0,readOnly:!0,form:s,disabled:o,name:e,value:t}))):[],os({ourProps:{},theirProps:{...n,...ls(c,[`defaultValue`,`onUpdate:modelValue`,`horizontal`,`multiple`,`by`])},slot:l,slots:t,attrs:n,name:`Listbox`})])}}}),Aoe=N({name:`ListboxLabel`,props:{as:{type:[Object,String],default:`label`},id:{type:String,default:null}},setup(e,{attrs:t,slots:n}){let r=e.id??`headlessui-listbox-label-${Ao()}`,i=lc(`ListboxLabel`);function a(){var e;(e=G(i.buttonRef))==null||e.focus({preventScroll:!0})}return()=>{let o={open:i.listboxState.value===0,disabled:i.disabled.value},{...s}=e;return os({ourProps:{id:r,ref:i.labelRef,onClick:a},theirProps:s,slot:o,attrs:t,slots:n,name:`ListboxLabel`})}}}),joe=N({name:`ListboxButton`,props:{as:{type:[Object,String],default:`button`},id:{type:String,default:null}},setup(e,{attrs:t,slots:n,expose:r}){let i=e.id??`headlessui-listbox-button-${Ao()}`,a=lc(`ListboxButton`);r({el:a.buttonRef,$el:a.buttonRef});function o(e){switch(e.key){case xs.Space:case xs.Enter:case xs.ArrowDown:e.preventDefault(),a.openListbox(),ar(()=>{var e;(e=G(a.optionsRef))==null||e.focus({preventScroll:!0}),a.value.value||a.goToOption(Es.First)});break;case xs.ArrowUp:e.preventDefault(),a.openListbox(),ar(()=>{var e;(e=G(a.optionsRef))==null||e.focus({preventScroll:!0}),a.value.value||a.goToOption(Es.Last)});break}}function s(e){switch(e.key){case xs.Space:e.preventDefault();break}}function c(e){a.disabled.value||(a.listboxState.value===0?(a.closeListbox(),ar(()=>G(a.buttonRef)?.focus({preventScroll:!0}))):(e.preventDefault(),a.openListbox(),Toe(()=>G(a.optionsRef)?.focus({preventScroll:!0}))))}let l=es(U(()=>({as:e.as,type:t.type})),a.buttonRef);return()=>{let r={open:a.listboxState.value===0,disabled:a.disabled.value,value:a.value.value},{...u}=e;return os({ourProps:{ref:a.buttonRef,id:i,type:l.value,"aria-haspopup":`listbox`,"aria-controls":G(a.optionsRef)?.id,"aria-expanded":a.listboxState.value===0,"aria-labelledby":a.labelRef.value?[G(a.labelRef)?.id,i].join(` `):void 0,disabled:a.disabled.value===!0?!0:void 0,onKeydown:o,onKeyup:s,onClick:c},theirProps:u,slot:r,attrs:t,slots:n,name:`ListboxButton`})}}}),Moe=N({name:`ListboxOptions`,props:{as:{type:[Object,String],default:`ul`},static:{type:Boolean,default:!1},unmount:{type:Boolean,default:!0},id:{type:String,default:null}},setup(e,{attrs:t,slots:n,expose:r}){let i=e.id??`headlessui-listbox-options-${Ao()}`,a=lc(`ListboxOptions`),o=A(null);r({el:a.optionsRef,$el:a.optionsRef});function s(e){switch(o.value&&clearTimeout(o.value),e.key){case xs.Space:if(a.searchQuery.value!==``)return e.preventDefault(),e.stopPropagation(),a.search(e.key);case xs.Enter:if(e.preventDefault(),e.stopPropagation(),a.activeOptionIndex.value!==null){let e=a.options.value[a.activeOptionIndex.value];a.select(e.dataRef.value)}a.mode.value===0&&(a.closeListbox(),ar(()=>G(a.buttonRef)?.focus({preventScroll:!0})));break;case No(a.orientation.value,{vertical:xs.ArrowDown,horizontal:xs.ArrowRight}):return e.preventDefault(),e.stopPropagation(),a.goToOption(Es.Next);case No(a.orientation.value,{vertical:xs.ArrowUp,horizontal:xs.ArrowLeft}):return e.preventDefault(),e.stopPropagation(),a.goToOption(Es.Previous);case xs.Home:case xs.PageUp:return e.preventDefault(),e.stopPropagation(),a.goToOption(Es.First);case xs.End:case xs.PageDown:return e.preventDefault(),e.stopPropagation(),a.goToOption(Es.Last);case xs.Escape:e.preventDefault(),e.stopPropagation(),a.closeListbox(),ar(()=>G(a.buttonRef)?.focus({preventScroll:!0}));break;case xs.Tab:e.preventDefault(),e.stopPropagation();break;default:e.key.length===1&&(a.search(e.key),o.value=setTimeout(()=>a.clearSearch(),350));break}}let c=gs(),l=U(()=>c===null?a.listboxState.value===0:(c.value&ys.Open)===ys.Open);return()=>{var r;let o={open:a.listboxState.value===0},{...c}=e;return os({ourProps:{"aria-activedescendant":a.activeOptionIndex.value===null||(r=a.options.value[a.activeOptionIndex.value])==null?void 0:r.id,"aria-multiselectable":a.mode.value===1?!0:void 0,"aria-labelledby":G(a.buttonRef)?.id,"aria-orientation":a.orientation.value,id:i,onKeydown:s,role:`listbox`,tabIndex:0,ref:a.optionsRef},theirProps:c,slot:o,attrs:t,slots:n,features:us.RenderStrategy|us.Static,visible:l.value,name:`ListboxOptions`})}}}),Noe=N({name:`ListboxOption`,props:{as:{type:[Object,String],default:`li`},value:{type:[Object,String,Number,Boolean]},disabled:{type:Boolean,default:!1},id:{type:String,default:null}},setup(e,{slots:t,attrs:n,expose:r}){let i=e.id??`headlessui-listbox-option-${Ao()}`,a=lc(`ListboxOption`),o=A(null);r({el:o,$el:o});let s=U(()=>a.activeOptionIndex.value===null?!1:a.options.value[a.activeOptionIndex.value].id===i),c=U(()=>No(a.mode.value,{0:()=>a.compare(bn(a.value.value),bn(e.value)),1:()=>bn(a.value.value).some(t=>a.compare(bn(t),bn(e.value)))})),l=U(()=>No(a.mode.value,{1:()=>{let e=bn(a.value.value);return a.options.value.find(t=>e.some(e=>a.compare(bn(e),bn(t.dataRef.value))))?.id===i},0:()=>c.value})),u=Soe(o),d=U(()=>({disabled:e.disabled,value:e.value,get textValue(){return u()},domRef:o}));Hi(()=>a.registerOption(i,d)),Gi(()=>a.unregisterOption(i)),Hi(()=>{mr([a.listboxState,c],()=>{a.listboxState.value===0&&c.value&&No(a.mode.value,{1:()=>{l.value&&a.goToOption(Es.Specific,i)},0:()=>{a.goToOption(Es.Specific,i)}})},{immediate:!0})}),pr(()=>{a.listboxState.value===0&&s.value&&a.activationTrigger.value!==0&&ar(()=>{var e;return((e=G(o))?.scrollIntoView)?.call(e,{block:`nearest`})})});function f(t){if(e.disabled)return t.preventDefault();a.select(e.value),a.mode.value===0&&(a.closeListbox(),ar(()=>G(a.buttonRef)?.focus({preventScroll:!0})))}function p(){if(e.disabled)return a.goToOption(Es.Nothing);a.goToOption(Es.Specific,i)}let m=ns();function h(e){m.update(e)}function g(t){m.wasMoved(t)&&(e.disabled||s.value||a.goToOption(Es.Specific,i,0))}function _(t){m.wasMoved(t)&&(e.disabled||s.value&&a.goToOption(Es.Nothing))}return()=>{let{disabled:r}=e,a={active:s.value,selected:c.value,disabled:r},{value:l,disabled:u,...d}=e;return os({ourProps:{id:i,ref:o,role:`option`,tabIndex:r===!0?void 0:-1,"aria-disabled":r===!0?!0:void 0,"aria-selected":c.value,disabled:void 0,onClick:f,onFocus:p,onPointerenter:h,onMouseenter:h,onPointermove:g,onMousemove:g,onPointerleave:_,onMouseleave:_},theirProps:d,slot:a,attrs:n,slots:t,name:`ListboxOption`})}}})}));function Foe(e){requestAnimationFrame(()=>requestAnimationFrame(e))}function dc(e){let t=fr(fc,null);if(t===null){let t=Error(`<${e} /> is missing a parent <Menu /> component.`);throw Error.captureStackTrace&&Error.captureStackTrace(t,dc),t}return t}var Ioe,Loe,fc,Roe,zoe,Boe,Voe,Hoe=s((()=>{W(),jo(),$o(),ts(),Coe(),rs(),as(),bs(),Ss(),Ds(),Mo(),Yo(),Po(),fs(),Ioe=(e=>(e[e.Open=0]=`Open`,e[e.Closed=1]=`Closed`,e))(Ioe||{}),Loe=(e=>(e[e.Pointer=0]=`Pointer`,e[e.Other=1]=`Other`,e))(Loe||{}),fc=Symbol(`MenuContext`),Roe=N({name:`Menu`,props:{as:{type:[Object,String],default:`template`}},setup(e,{slots:t,attrs:n}){let r=A(1),i=A(null),a=A(null),o=A([]),s=A(``),c=A(null),l=A(1);function u(e=e=>e){let t=c.value===null?null:o.value[c.value],n=Uo(e(o.value.slice()),e=>G(e.dataRef.domRef)),r=t?n.indexOf(t):null;return r===-1&&(r=null),{items:n,activeItemIndex:r}}let d={menuState:r,buttonRef:i,itemsRef:a,items:o,searchQuery:s,activeItemIndex:c,activationTrigger:l,closeMenu:()=>{r.value=1,c.value=null},openMenu:()=>r.value=0,goToItem(e,t,n){let r=u(),i=Ts(e===Es.Specific?{focus:Es.Specific,id:t}:{focus:e},{resolveItems:()=>r.items,resolveActiveIndex:()=>r.activeItemIndex,resolveId:e=>e.id,resolveDisabled:e=>e.dataRef.disabled});s.value=``,c.value=i,l.value=n??1,o.value=r.items},search(e){let t=s.value===``?1:0;s.value+=e.toLowerCase();let n=(c.value===null?o.value:o.value.slice(c.value+t).concat(o.value.slice(0,c.value+t))).find(e=>e.dataRef.textValue.startsWith(s.value)&&!e.dataRef.disabled),r=n?o.value.indexOf(n):-1;r===-1||r===c.value||(c.value=r,l.value=1)},clearSearch(){s.value=``},registerItem(e,t){let n=u(n=>[...n,{id:e,dataRef:t}]);o.value=n.items,c.value=n.activeItemIndex,l.value=1},unregisterItem(e){let t=u(t=>{let n=t.findIndex(t=>t.id===e);return n!==-1&&t.splice(n,1),t});o.value=t.items,c.value=t.activeItemIndex,l.value=1}};return Qo([i,a],(e,t)=>{var n;d.closeMenu(),Vo(t,Jo.Loose)||(e.preventDefault(),(n=G(i))==null||n.focus())},U(()=>r.value===0)),dr(fc,d),_s(U(()=>No(r.value,{0:ys.Open,1:ys.Closed}))),()=>os({ourProps:{},theirProps:e,slot:{open:r.value===0,close:d.closeMenu},slots:t,attrs:n,name:`Menu`})}}),zoe=N({name:`MenuButton`,props:{disabled:{type:Boolean,default:!1},as:{type:[Object,String],default:`button`},id:{type:String,default:null}},setup(e,{attrs:t,slots:n,expose:r}){let i=e.id??`headlessui-menu-button-${Ao()}`,a=dc(`MenuButton`);r({el:a.buttonRef,$el:a.buttonRef});function o(e){switch(e.key){case xs.Space:case xs.Enter:case xs.ArrowDown:e.preventDefault(),e.stopPropagation(),a.openMenu(),ar(()=>{var e;(e=G(a.itemsRef))==null||e.focus({preventScroll:!0}),a.goToItem(Es.First)});break;case xs.ArrowUp:e.preventDefault(),e.stopPropagation(),a.openMenu(),ar(()=>{var e;(e=G(a.itemsRef))==null||e.focus({preventScroll:!0}),a.goToItem(Es.Last)});break}}function s(e){switch(e.key){case xs.Space:e.preventDefault();break}}function c(t){e.disabled||(a.menuState.value===0?(a.closeMenu(),ar(()=>G(a.buttonRef)?.focus({preventScroll:!0}))):(t.preventDefault(),a.openMenu(),Foe(()=>G(a.itemsRef)?.focus({preventScroll:!0}))))}let l=es(U(()=>({as:e.as,type:t.type})),a.buttonRef);return()=>{let r={open:a.menuState.value===0},{...u}=e;return os({ourProps:{ref:a.buttonRef,id:i,type:l.value,"aria-haspopup":`menu`,"aria-controls":G(a.itemsRef)?.id,"aria-expanded":a.menuState.value===0,onKeydown:o,onKeyup:s,onClick:c},theirProps:u,slot:r,attrs:t,slots:n,name:`MenuButton`})}}}),Boe=N({name:`MenuItems`,props:{as:{type:[Object,String],default:`div`},static:{type:Boolean,default:!1},unmount:{type:Boolean,default:!0},id:{type:String,default:null}},setup(e,{attrs:t,slots:n,expose:r}){let i=e.id??`headlessui-menu-items-${Ao()}`,a=dc(`MenuItems`),o=A(null);r({el:a.itemsRef,$el:a.itemsRef}),is({container:U(()=>G(a.itemsRef)),enabled:U(()=>a.menuState.value===0),accept(e){return e.getAttribute(`role`)===`menuitem`?NodeFilter.FILTER_REJECT:e.hasAttribute(`role`)?NodeFilter.FILTER_SKIP:NodeFilter.FILTER_ACCEPT},walk(e){e.setAttribute(`role`,`none`)}});function s(e){var t;switch(o.value&&clearTimeout(o.value),e.key){case xs.Space:if(a.searchQuery.value!==``)return e.preventDefault(),e.stopPropagation(),a.search(e.key);case xs.Enter:if(e.preventDefault(),e.stopPropagation(),a.activeItemIndex.value!==null){let e=a.items.value[a.activeItemIndex.value];(t=G(e.dataRef.domRef))==null||t.click()}a.closeMenu(),Jie(G(a.buttonRef));break;case xs.ArrowDown:return e.preventDefault(),e.stopPropagation(),a.goToItem(Es.Next);case xs.ArrowUp:return e.preventDefault(),e.stopPropagation(),a.goToItem(Es.Previous);case xs.Home:case xs.PageUp:return e.preventDefault(),e.stopPropagation(),a.goToItem(Es.First);case xs.End:case xs.PageDown:return e.preventDefault(),e.stopPropagation(),a.goToItem(Es.Last);case xs.Escape:e.preventDefault(),e.stopPropagation(),a.closeMenu(),ar(()=>G(a.buttonRef)?.focus({preventScroll:!0}));break;case xs.Tab:e.preventDefault(),e.stopPropagation(),a.closeMenu(),ar(()=>Xie(G(a.buttonRef),e.shiftKey?Ko.Previous:Ko.Next));break;default:e.key.length===1&&(a.search(e.key),o.value=setTimeout(()=>a.clearSearch(),350));break}}function c(e){switch(e.key){case xs.Space:e.preventDefault();break}}let l=gs(),u=U(()=>l===null?a.menuState.value===0:(l.value&ys.Open)===ys.Open);return()=>{var r;let o={open:a.menuState.value===0},{...l}=e;return os({ourProps:{"aria-activedescendant":a.activeItemIndex.value===null||(r=a.items.value[a.activeItemIndex.value])==null?void 0:r.id,"aria-labelledby":G(a.buttonRef)?.id,id:i,onKeydown:s,onKeyup:c,role:`menu`,tabIndex:0,ref:a.itemsRef},theirProps:l,slot:o,attrs:t,slots:n,features:us.RenderStrategy|us.Static,visible:u.value,name:`MenuItems`})}}}),Voe=N({name:`MenuItem`,inheritAttrs:!1,props:{as:{type:[Object,String],default:`template`},disabled:{type:Boolean,default:!1},id:{type:String,default:null}},setup(e,{slots:t,attrs:n,expose:r}){let i=e.id??`headlessui-menu-item-${Ao()}`,a=dc(`MenuItem`),o=A(null);r({el:o,$el:o});let s=U(()=>a.activeItemIndex.value===null?!1:a.items.value[a.activeItemIndex.value].id===i),c=Soe(o),l=U(()=>({disabled:e.disabled,get textValue(){return c()},domRef:o}));Hi(()=>a.registerItem(i,l)),Gi(()=>a.unregisterItem(i)),pr(()=>{a.menuState.value===0&&s.value&&a.activationTrigger.value!==0&&ar(()=>{var e;return((e=G(o))?.scrollIntoView)?.call(e,{block:`nearest`})})});function u(t){if(e.disabled)return t.preventDefault();a.closeMenu(),Jie(G(a.buttonRef))}function d(){if(e.disabled)return a.goToItem(Es.Nothing);a.goToItem(Es.Specific,i)}let f=ns();function p(e){f.update(e)}function m(t){f.wasMoved(t)&&(e.disabled||s.value||a.goToItem(Es.Specific,i,0))}function h(t){f.wasMoved(t)&&(e.disabled||s.value&&a.goToItem(Es.Nothing))}return()=>{let{disabled:r,...c}=e,l={active:s.value,disabled:r,close:a.closeMenu};return os({ourProps:{id:i,ref:o,role:`menuitem`,tabIndex:r===!0?void 0:-1,"aria-disabled":r===!0?!0:void 0,onClick:u,onFocus:d,onPointerenter:p,onMouseenter:p,onPointermove:m,onMousemove:m,onPointerleave:h,onMouseleave:h},theirProps:{...n,...c},slot:l,attrs:n,slots:t,name:`MenuItem`})}}})}));function pc(e){let t=fr(mc,null);if(t===null){let t=Error(`<${e} /> is missing a parent <${_c.name} /> component.`);throw Error.captureStackTrace&&Error.captureStackTrace(t,pc),t}return t}function Uoe(){return fr(hc,null)}function Woe(){return fr(gc,null)}var Goe,mc,hc,gc,_c,vc,yc,Koe=s((()=>{W(),uoe(),Ps(),jo(),$o(),ts(),Qae(),Eae(),hs(),bs(),Ss(),Mo(),Yo(),Po(),zo(),fs(),Goe=(e=>(e[e.Open=0]=`Open`,e[e.Closed=1]=`Closed`,e))(Goe||{}),mc=Symbol(`PopoverContext`),hc=Symbol(`PopoverGroupContext`),gc=Symbol(`PopoverPanelContext`),_c=N({name:`Popover`,inheritAttrs:!1,props:{as:{type:[Object,String],default:`div`}},setup(e,{slots:t,attrs:n,expose:r}){let i=A(null);r({el:i,$el:i});let a=A(1),o=A(null),s=A(null),c=A(null),l=A(null),u=U(()=>Ro(i)),d=U(()=>{var e,t;if(!G(o)||!G(l))return!1;for(let e of document.querySelectorAll(`body > *`))if(Number(e?.contains(G(o)))^Number(e?.contains(G(l))))return!0;let n=Bo(),r=n.indexOf(G(o)),i=(r+n.length-1)%n.length,a=(r+1)%n.length,s=n[i],c=n[a];return!((e=G(l))!=null&&e.contains(s))&&!((t=G(l))!=null&&t.contains(c))}),f={popoverState:a,buttonId:A(null),panelId:A(null),panel:l,button:o,isPortalled:d,beforePanelSentinel:s,afterPanelSentinel:c,togglePopover(){a.value=No(a.value,{0:1,1:0})},closePopover(){a.value!==1&&(a.value=1)},close(e){f.closePopover(),(e?e instanceof HTMLElement?e:e.value instanceof HTMLElement?G(e):G(f.button):G(f.button))?.focus()}};dr(mc,f),_s(U(()=>No(a.value,{0:ys.Open,1:ys.Closed})));let p={buttonId:f.buttonId,panelId:f.panelId,close(){f.closePopover()}},m=Uoe(),h=m?.registerPopover,[g,_]=coe(),v=Xae({mainTreeNodeRef:m?.mainTreeNodeRef,portals:g,defaultContainers:[o,l]});function y(){return m?.isFocusWithinPopoverGroup()??(u.value?.activeElement&&(G(o)?.contains(u.value.activeElement)||G(l)?.contains(u.value.activeElement)))}return pr(()=>h?.(p)),Ns(u.value?.defaultView,`focus`,e=>{var t,n;e.target!==window&&e.target instanceof HTMLElement&&a.value===0&&(y()||o&&l&&(v.contains(e.target)||(t=G(f.beforePanelSentinel))!=null&&t.contains(e.target)||(n=G(f.afterPanelSentinel))!=null&&n.contains(e.target)||f.closePopover()))},!0),Qo(v.resolveContainers,(e,t)=>{var n;f.closePopover(),Vo(t,Jo.Loose)||(e.preventDefault(),(n=G(o))==null||n.focus())},U(()=>a.value===0)),()=>{let r={open:a.value===0,close:f.close};return ci(V,[ci(_,{},()=>os({theirProps:{...e,...n},ourProps:{ref:i},slot:r,slots:t,attrs:n,name:`Popover`})),ci(v.MainTreeNode)])}}}),vc=N({name:`PopoverButton`,props:{as:{type:[Object,String],default:`button`},disabled:{type:[Boolean],default:!1},id:{type:String,default:null}},inheritAttrs:!1,setup(e,{attrs:t,slots:n,expose:r}){let i=e.id??`headlessui-popover-button-${Ao()}`,a=pc(`PopoverButton`),o=U(()=>Ro(a.button));r({el:a.button,$el:a.button}),Hi(()=>{a.buttonId.value=i}),Gi(()=>{a.buttonId.value=null});let s=Uoe()?.closeOthers,c=Woe(),l=U(()=>c===null?!1:c.value===a.panelId.value),u=A(null),d=`headlessui-focus-sentinel-${Ao()}`;l.value||pr(()=>{a.button.value=G(u)});let f=es(U(()=>({as:e.as,type:t.type})),u);function p(e){var t,n,r,i,c;if(l.value){if(a.popoverState.value===1)return;switch(e.key){case xs.Space:case xs.Enter:e.preventDefault(),(n=(t=e.target).click)==null||n.call(t),a.closePopover(),(r=G(a.button))==null||r.focus();break}}else switch(e.key){case xs.Space:case xs.Enter:e.preventDefault(),e.stopPropagation(),a.popoverState.value===1&&s?.(a.buttonId.value),a.togglePopover();break;case xs.Escape:if(a.popoverState.value!==0)return s?.(a.buttonId.value);if(!G(a.button)||(i=o.value)!=null&&i.activeElement&&!((c=G(a.button))!=null&&c.contains(o.value.activeElement)))return;e.preventDefault(),e.stopPropagation(),a.closePopover();break}}function m(e){l.value||e.key===xs.Space&&e.preventDefault()}function h(t){var n,r;e.disabled||(l.value?(a.closePopover(),(n=G(a.button))==null||n.focus()):(t.preventDefault(),t.stopPropagation(),a.popoverState.value===1&&s?.(a.buttonId.value),a.togglePopover(),(r=G(a.button))==null||r.focus()))}function g(e){e.preventDefault(),e.stopPropagation()}let _=Fs();function v(){let e=G(a.panel);if(!e)return;function t(){No(_.value,{[Is.Forwards]:()=>Wo(e,Ko.First),[Is.Backwards]:()=>Wo(e,Ko.Last)})===qo.Error&&Wo(Bo().filter(e=>e.dataset.headlessuiFocusGuard!==`true`),No(_.value,{[Is.Forwards]:Ko.Next,[Is.Backwards]:Ko.Previous}),{relativeTo:G(a.button)})}t()}return()=>{let r=a.popoverState.value===0,o={open:r},{...s}=e;return ci(V,[os({ourProps:l.value?{ref:u,type:f.value,onKeydown:p,onClick:h}:{ref:u,id:i,type:f.value,"aria-expanded":a.popoverState.value===0,"aria-controls":G(a.panel)?a.panelId.value:void 0,disabled:e.disabled?!0:void 0,onKeydown:p,onKeyup:m,onClick:h,onMousedown:g},theirProps:{...t,...s},slot:o,attrs:t,slots:n,name:`PopoverButton`}),r&&!l.value&&a.isPortalled.value&&ci(ms,{id:d,features:ps.Focusable,"data-headlessui-focus-guard":!0,as:`button`,type:`button`,onFocus:v})])}}}),N({name:`PopoverOverlay`,props:{as:{type:[Object,String],default:`div`},static:{type:Boolean,default:!1},unmount:{type:Boolean,default:!0}},setup(e,{attrs:t,slots:n}){let r=pc(`PopoverOverlay`),i=`headlessui-popover-overlay-${Ao()}`,a=gs(),o=U(()=>a===null?r.popoverState.value===0:(a.value&ys.Open)===ys.Open);function s(){r.closePopover()}return()=>{let a={open:r.popoverState.value===0};return os({ourProps:{id:i,"aria-hidden":!0,onClick:s},theirProps:e,slot:a,attrs:t,slots:n,features:us.RenderStrategy|us.Static,visible:o.value,name:`PopoverOverlay`})}}}),yc=N({name:`PopoverPanel`,props:{as:{type:[Object,String],default:`div`},static:{type:Boolean,default:!1},unmount:{type:Boolean,default:!0},focus:{type:Boolean,default:!1},id:{type:String,default:null}},inheritAttrs:!1,setup(e,{attrs:t,slots:n,expose:r}){let i=e.id??`headlessui-popover-panel-${Ao()}`,{focus:a}=e,o=pc(`PopoverPanel`),s=U(()=>Ro(o.panel)),c=`headlessui-focus-sentinel-before-${Ao()}`,l=`headlessui-focus-sentinel-after-${Ao()}`;r({el:o.panel,$el:o.panel}),Hi(()=>{o.panelId.value=i}),Gi(()=>{o.panelId.value=null}),dr(gc,o.panelId),pr(()=>{var e;if(!a||o.popoverState.value!==0||!o.panel)return;let t=s.value?.activeElement;(e=G(o.panel))!=null&&e.contains(t)||Wo(G(o.panel),Ko.First)});let u=gs(),d=U(()=>u===null?o.popoverState.value===0:(u.value&ys.Open)===ys.Open);function f(e){var t,n;switch(e.key){case xs.Escape:if(o.popoverState.value!==0||!G(o.panel)||s.value&&!((t=G(o.panel))!=null&&t.contains(s.value.activeElement)))return;e.preventDefault(),e.stopPropagation(),o.closePopover(),(n=G(o.button))==null||n.focus();break}}function p(e){var t,n,r,i,a;let s=e.relatedTarget;s&&G(o.panel)&&((t=G(o.panel))!=null&&t.contains(s)||(o.closePopover(),((r=(n=G(o.beforePanelSentinel))?.contains)!=null&&r.call(n,s)||(a=(i=G(o.afterPanelSentinel))?.contains)!=null&&a.call(i,s))&&s.focus({preventScroll:!0})))}let m=Fs();function h(){let e=G(o.panel);if(!e)return;function t(){No(m.value,{[Is.Forwards]:()=>{var t;Wo(e,Ko.First)===qo.Error&&((t=G(o.afterPanelSentinel))==null||t.focus())},[Is.Backwards]:()=>{var e;(e=G(o.button))==null||e.focus({preventScroll:!0})}})}t()}function g(){let e=G(o.panel);if(!e)return;function t(){No(m.value,{[Is.Forwards]:()=>{let e=G(o.button),t=G(o.panel);if(!e)return;let n=Bo(),r=n.indexOf(e),i=n.slice(0,r+1),a=[...n.slice(r+1),...i];for(let e of a.slice())if(e.dataset.headlessuiFocusGuard===`true`||t!=null&&t.contains(e)){let t=a.indexOf(e);t!==-1&&a.splice(t,1)}Wo(a,Ko.First,{sorted:!1})},[Is.Backwards]:()=>{var t;Wo(e,Ko.Previous)===qo.Error&&((t=G(o.button))==null||t.focus())}})}t()}return()=>{let r={open:o.popoverState.value===0,close:o.close},{focus:s,...u}=e;return os({ourProps:{ref:o.panel,id:i,onKeydown:f,onFocusout:a&&o.popoverState.value===0?p:void 0,tabIndex:-1},theirProps:{...t,...u},attrs:t,slot:r,slots:{...n,default:(...e)=>[ci(V,[d.value&&o.isPortalled.value&&ci(ms,{id:c,ref:o.beforePanelSentinel,features:ps.Focusable,"data-headlessui-focus-guard":!0,as:`button`,type:`button`,onFocus:h}),n.default?.call(n,...e),d.value&&o.isPortalled.value&&ci(ms,{id:l,ref:o.afterPanelSentinel,features:ps.Focusable,"data-headlessui-focus-guard":!0,as:`button`,type:`button`,onFocus:g})])]},features:us.RenderStrategy|us.Static,visible:d.value,name:`PopoverPanel`})}}}),N({name:`PopoverGroup`,inheritAttrs:!1,props:{as:{type:[Object,String],default:`div`}},setup(e,{attrs:t,slots:n,expose:r}){let i=A(null),a=Sn([]),o=U(()=>Ro(i)),s=Zae();r({el:i,$el:i});function c(e){let t=a.value.indexOf(e);t!==-1&&a.value.splice(t,1)}function l(e){return a.value.push(e),()=>{c(e)}}function u(){var e;let t=o.value;if(!t)return!1;let n=t.activeElement;return(e=G(i))!=null&&e.contains(n)?!0:a.value.some(e=>t.getElementById(e.buttonId.value)?.contains(n)||t.getElementById(e.panelId.value)?.contains(n))}function d(e){for(let t of a.value)t.buttonId.value!==e&&t.close()}return dr(hc,{registerPopover:l,unregisterPopover:c,isFocusWithinPopoverGroup:u,closeOthers:d,mainTreeNodeRef:s.mainTreeNodeRef}),()=>ci(V,[os({ourProps:{ref:i},theirProps:{...e,...t},slot:{},attrs:t,slots:n,name:`PopoverGroup`}),ci(s.MainTreeNode)])}})}));function qoe(){let e=fr(xc,null);if(e===null){let e=Error(`You used a <Label /> component, but it is not inside a parent.`);throw Error.captureStackTrace&&Error.captureStackTrace(e,qoe),e}return e}function bc({slot:e={},name:t=`Label`,props:n={}}={}){let r=A([]);function i(e){return r.value.push(e),()=>{let t=r.value.indexOf(e);t!==-1&&r.value.splice(t,1)}}return dr(xc,{register:i,slot:e,name:t,props:n}),U(()=>r.value.length>0?r.value.join(` `):void 0)}var xc,Joe=s((()=>{W(),jo(),fs(),xc=Symbol(`LabelContext`),N({name:`Label`,props:{as:{type:[Object,String],default:`label`},passive:{type:[Boolean],default:!1},id:{type:String,default:null}},setup(e,{slots:t,attrs:n}){let r=e.id??`headlessui-label-${Ao()}`,i=qoe();return Hi(()=>Gi(i.register(r))),()=>{let{name:a=`Label`,slot:o={},props:s={}}=i,{passive:c,...l}=e,u={...Object.entries(s).reduce((e,[t,n])=>Object.assign(e,{[t]:j(n)}),{}),id:r};return c&&(delete u.onClick,delete u.htmlFor,delete l.onClick),os({ourProps:u,theirProps:l,slot:o,attrs:n,slots:t,name:a})}}})}));function Yoe(e,t){return e===t}function Xoe(e){let t=fr(Sc,null);if(t===null){let t=Error(`<${e} /> is missing a parent <RadioGroup /> component.`);throw Error.captureStackTrace&&Error.captureStackTrace(t,Xoe),t}return t}var Sc,Zoe,Qoe=s((()=>{W(),wo(),jo(),as(),hs(),Ss(),Mo(),Yo(),ks(),zo(),fs(),Js(),Joe(),Sc=Symbol(`RadioGroupContext`),N({name:`RadioGroup`,emits:{"update:modelValue":e=>!0},props:{as:{type:[Object,String],default:`div`},disabled:{type:[Boolean],default:!1},by:{type:[String,Function],default:()=>Yoe},modelValue:{type:[Object,String,Number,Boolean],default:void 0},defaultValue:{type:[Object,String,Number,Boolean],default:void 0},form:{type:String,optional:!0},name:{type:String,optional:!0},id:{type:String,default:null}},inheritAttrs:!1,setup(e,{emit:t,attrs:n,slots:r,expose:i}){let a=e.id??`headlessui-radiogroup-${Ao()}`,o=A(null),s=A([]),c=bc({name:`RadioGroupLabel`}),l=Ks({name:`RadioGroupDescription`});i({el:o,$el:o});let[u,d]=Co(U(()=>e.modelValue),e=>t(`update:modelValue`,e),U(()=>e.defaultValue)),f={options:s,value:u,disabled:U(()=>e.disabled),firstOption:U(()=>s.value.find(e=>!e.propsRef.disabled)),containsCheckedOption:U(()=>s.value.some(t=>f.compare(bn(t.propsRef.value),bn(e.modelValue)))),compare(t,n){if(typeof e.by==`string`){let r=e.by;return t?.[r]===n?.[r]}return e.by(t,n)},change(t){if(e.disabled||f.compare(bn(u.value),bn(t)))return!1;let n=s.value.find(e=>f.compare(bn(e.propsRef.value),bn(t)))?.propsRef;return n!=null&&n.disabled?!1:(d(t),!0)},registerOption(e){s.value.push(e),s.value=Uo(s.value,e=>e.element)},unregisterOption(e){let t=s.value.findIndex(t=>t.id===e);t!==-1&&s.value.splice(t,1)}};dr(Sc,f),is({container:U(()=>G(o)),accept(e){return e.getAttribute(`role`)===`radio`?NodeFilter.FILTER_REJECT:e.hasAttribute(`role`)?NodeFilter.FILTER_SKIP:NodeFilter.FILTER_ACCEPT},walk(e){e.setAttribute(`role`,`none`)}});function p(e){if(!o.value||!o.value.contains(e.target))return;let t=s.value.filter(e=>e.propsRef.disabled===!1).map(e=>e.element);switch(e.key){case xs.Enter:yae(e.currentTarget);break;case xs.ArrowLeft:case xs.ArrowUp:if(e.preventDefault(),e.stopPropagation(),Wo(t,Ko.Previous|Ko.WrapAround)===qo.Success){let e=s.value.find(e=>e.element===Ro(o)?.activeElement);e&&f.change(e.propsRef.value)}break;case xs.ArrowRight:case xs.ArrowDown:if(e.preventDefault(),e.stopPropagation(),Wo(t,Ko.Next|Ko.WrapAround)===qo.Success){let e=s.value.find(e=>e.element===Ro(e.element)?.activeElement);e&&f.change(e.propsRef.value)}break;case xs.Space:{e.preventDefault(),e.stopPropagation();let t=s.value.find(e=>e.element===Ro(e.element)?.activeElement);t&&f.change(t.propsRef.value)}break}}let m=U(()=>G(o)?.closest(`form`));return Hi(()=>{mr([m],()=>{if(!m.value||e.defaultValue===void 0)return;function t(){f.change(e.defaultValue)}return m.value.addEventListener(`reset`,t),()=>{var e;(e=m.value)==null||e.removeEventListener(`reset`,t)}},{immediate:!0})}),()=>{let{disabled:t,name:i,form:s,...d}=e,f={ref:o,id:a,role:`radiogroup`,"aria-labelledby":c.value,"aria-describedby":l.value,onKeydown:p};return ci(V,[...i!=null&&u.value!=null?Os({[i]:u.value}).map(([e,n])=>ci(ms,cs({features:ps.Hidden,key:e,as:`input`,type:`hidden`,hidden:!0,readOnly:!0,form:s,disabled:t,name:e,value:n}))):[],os({ourProps:f,theirProps:{...n,...ls(d,[`modelValue`,`defaultValue`,`by`])},slot:{},attrs:n,slots:r,name:`RadioGroup`})])}}}),Zoe=(e=>(e[e.Empty=1]=`Empty`,e[e.Active=2]=`Active`,e))(Zoe||{}),N({name:`RadioGroupOption`,props:{as:{type:[Object,String],default:`div`},value:{type:[Object,String,Number,Boolean]},disabled:{type:Boolean,default:!1},id:{type:String,default:null}},setup(e,{attrs:t,slots:n,expose:r}){let i=e.id??`headlessui-radiogroup-option-${Ao()}`,a=Xoe(`RadioGroupOption`),o=bc({name:`RadioGroupLabel`}),s=Ks({name:`RadioGroupDescription`}),c=A(null),l=U(()=>({value:e.value,disabled:e.disabled})),u=A(1);r({el:c,$el:c});let d=U(()=>G(c));Hi(()=>a.registerOption({id:i,element:d,propsRef:l})),Gi(()=>a.unregisterOption(i));let f=U(()=>a.firstOption.value?.id===i),p=U(()=>a.disabled.value||e.disabled),m=U(()=>a.compare(bn(a.value.value),bn(e.value))),h=U(()=>p.value?-1:m.value||!a.containsCheckedOption.value&&f.value?0:-1);function g(){var t;a.change(e.value)&&(u.value|=2,(t=G(c))==null||t.focus())}function _(){u.value|=2}function v(){u.value&=-3}return()=>{let{value:r,disabled:a,...l}=e,d={checked:m.value,disabled:p.value,active:!!(u.value&2)};return os({ourProps:{id:i,ref:c,role:`radio`,"aria-checked":m.value?`true`:`false`,"aria-labelledby":o.value,"aria-describedby":s.value,"aria-disabled":p.value?!0:void 0,tabIndex:h.value,onClick:p.value?void 0:g,onFocus:p.value?void 0:_,onBlur:p.value?void 0:v},theirProps:l,slot:d,attrs:t,slots:n,name:`RadioGroupOption`})}}})})),Cc,$oe=s((()=>{W(),wo(),jo(),ts(),hs(),Ss(),Mo(),ks(),fs(),Js(),Joe(),Cc=Symbol(`GroupContext`),N({name:`SwitchGroup`,props:{as:{type:[Object,String],default:`template`}},setup(e,{slots:t,attrs:n}){let r=A(null);return dr(Cc,{switchRef:r,labelledby:bc({name:`SwitchLabel`,props:{htmlFor:U(()=>r.value?.id),onClick(e){r.value&&(e.currentTarget.tagName===`LABEL`&&e.preventDefault(),r.value.click(),r.value.focus({preventScroll:!0}))}}}),describedby:Ks({name:`SwitchDescription`})}),()=>os({theirProps:e,ourProps:{},slot:{},slots:t,attrs:n,name:`SwitchGroup`})}}),N({name:`Switch`,emits:{"update:modelValue":e=>!0},props:{as:{type:[Object,String],default:`button`},modelValue:{type:Boolean,default:void 0},defaultChecked:{type:Boolean,optional:!0},form:{type:String,optional:!0},name:{type:String,optional:!0},value:{type:String,optional:!0},id:{type:String,default:null},disabled:{type:Boolean,default:!1},tabIndex:{type:Number,default:0}},inheritAttrs:!1,setup(e,{emit:t,attrs:n,slots:r,expose:i}){let a=e.id??`headlessui-switch-${Ao()}`,o=fr(Cc,null),[s,c]=Co(U(()=>e.modelValue),e=>t(`update:modelValue`,e),U(()=>e.defaultChecked));function l(){c(!s.value)}let u=A(null),d=o===null?u:o.switchRef,f=es(U(()=>({as:e.as,type:n.type})),d);i({el:d,$el:d});function p(e){e.preventDefault(),l()}function m(e){e.key===xs.Space?(e.preventDefault(),l()):e.key===xs.Enter&&yae(e.currentTarget)}function h(e){e.preventDefault()}let g=U(()=>{var e;return((e=G(d))?.closest)?.call(e,`form`)});return Hi(()=>{mr([g],()=>{if(!g.value||e.defaultChecked===void 0)return;function t(){c(e.defaultChecked)}return g.value.addEventListener(`reset`,t),()=>{var e;(e=g.value)==null||e.removeEventListener(`reset`,t)}},{immediate:!0})}),()=>{let{name:t,value:i,form:c,tabIndex:l,...u}=e,g={checked:s.value},_={id:a,ref:d,role:`switch`,type:f.value,tabIndex:l===-1?0:l,"aria-checked":s.value,"aria-labelledby":o?.labelledby.value,"aria-describedby":o?.describedby.value,onClick:p,onKeyup:m,onKeypress:h};return ci(V,[t!=null&&s.value!=null?ci(ms,cs({features:ps.Hidden,as:`input`,type:`checkbox`,hidden:!0,readOnly:!0,checked:s.value,form:c,disabled:u.disabled,name:t,value:i})):null,os({ourProps:_,theirProps:{...n,...ls(u,[`modelValue`,`defaultChecked`])},slot:g,attrs:n,slots:r,name:`Switch`})])}}})})),ese,tse=s((()=>{W(),hs(),ese=N({props:{onFocus:{type:Function,required:!0}},setup(e){let t=A(!0);return()=>t.value?ci(ms,{as:`button`,type:`button`,features:ps.Focusable,onFocus(n){n.preventDefault();let r,i=50;function a(){var n;if(i--<=0){r&&cancelAnimationFrame(r);return}if((n=e.onFocus)!=null&&n.call(e)){t.value=!1,cancelAnimationFrame(r);return}r=requestAnimationFrame(a)}r=requestAnimationFrame(a)}}):null}})}));function wc(e){let t=fr(Tc,null);if(t===null){let t=Error(`<${e} /> is missing a parent <TabGroup /> component.`);throw Error.captureStackTrace&&Error.captureStackTrace(t,wc),t}return t}var nse,rse,Tc,Ec,Dc,Oc,kc,ise,ase,ose=s((()=>{W(),jo(),ts(),tse(),hs(),Ss(),Mo(),Yo(),Po(),Eo(),zo(),fs(),nse=(e=>(e[e.Forwards=0]=`Forwards`,e[e.Backwards=1]=`Backwards`,e))(nse||{}),rse=(e=>(e[e.Less=-1]=`Less`,e[e.Equal=0]=`Equal`,e[e.Greater=1]=`Greater`,e))(rse||{}),Tc=Symbol(`TabsContext`),Ec=Symbol(`TabsSSRContext`),Dc=N({name:`TabGroup`,emits:{change:e=>!0},props:{as:{type:[Object,String],default:`template`},selectedIndex:{type:[Number],default:null},defaultIndex:{type:[Number],default:0},vertical:{type:[Boolean],default:!1},manual:{type:[Boolean],default:!1}},inheritAttrs:!1,setup(e,{slots:t,attrs:n,emit:r}){let i=A(e.selectedIndex??e.defaultIndex),a=A([]),o=A([]),s=U(()=>e.selectedIndex!==null),c=U(()=>s.value?e.selectedIndex:i.value);function l(e){let t=Uo(u.tabs.value,G),n=Uo(u.panels.value,G),r=t.filter(e=>{var t;return!((t=G(e))!=null&&t.hasAttribute(`disabled`))});if(e<0||e>t.length-1){let a=No(No(i.value===null?0:Math.sign(e-i.value),{[-1]:()=>1,0:()=>No(Math.sign(e),{[-1]:()=>0,0:()=>0,1:()=>1}),1:()=>0}),{0:()=>t.indexOf(r[0]),1:()=>t.indexOf(r[r.length-1])});a!==-1&&(i.value=a),u.tabs.value=t,u.panels.value=n}else{let a=t.slice(0,e),o=[...t.slice(e),...a].find(e=>r.includes(e));if(!o)return;let s=t.indexOf(o)??u.selectedIndex.value;s===-1&&(s=u.selectedIndex.value),i.value=s,u.tabs.value=t,u.panels.value=n}}let u={selectedIndex:U(()=>i.value??e.defaultIndex??null),orientation:U(()=>e.vertical?`vertical`:`horizontal`),activation:U(()=>e.manual?`manual`:`auto`),tabs:a,panels:o,setSelectedIndex(e){c.value!==e&&r(`change`,e),s.value||l(e)},registerTab(e){if(a.value.includes(e))return;let t=a.value[i.value];if(a.value.push(e),a.value=Uo(a.value,G),!s.value){let e=a.value.indexOf(t)??i.value;e!==-1&&(i.value=e)}},unregisterTab(e){let t=a.value.indexOf(e);t!==-1&&a.value.splice(t,1)},registerPanel(e){o.value.includes(e)||(o.value.push(e),o.value=Uo(o.value,G))},unregisterPanel(e){let t=o.value.indexOf(e);t!==-1&&o.value.splice(t,1)}};dr(Tc,u);let d=A({tabs:[],panels:[]}),f=A(!1);Hi(()=>{f.value=!0}),dr(Ec,U(()=>f.value?null:d.value));let p=U(()=>e.selectedIndex);return Hi(()=>{mr([p],()=>l(e.selectedIndex??e.defaultIndex),{immediate:!0})}),pr(()=>{if(!s.value||c.value==null||u.tabs.value.length<=0)return;let e=Uo(u.tabs.value,G);e.some((e,t)=>G(u.tabs.value[t])!==G(e))&&u.setSelectedIndex(e.findIndex(e=>G(e)===G(u.tabs.value[c.value])))}),()=>{let r={selectedIndex:i.value};return ci(V,[a.value.length<=0&&ci(ese,{onFocus:()=>{for(let e of a.value){let t=G(e);if(t?.tabIndex===0)return t.focus(),!0}return!1}}),os({theirProps:{...n,...ls(e,[`selectedIndex`,`defaultIndex`,`manual`,`vertical`,`onChange`])},ourProps:{},slot:r,slots:t,attrs:n,name:`TabGroup`})])}}}),Oc=N({name:`TabList`,props:{as:{type:[Object,String],default:`div`}},setup(e,{attrs:t,slots:n}){let r=wc(`TabList`);return()=>{let i={selectedIndex:r.selectedIndex.value};return os({ourProps:{role:`tablist`,"aria-orientation":r.orientation.value},theirProps:e,slot:i,attrs:t,slots:n,name:`TabList`})}}}),kc=N({name:`Tab`,props:{as:{type:[Object,String],default:`button`},disabled:{type:[Boolean],default:!1},id:{type:String,default:null}},setup(e,{attrs:t,slots:n,expose:r}){let i=e.id??`headlessui-tabs-tab-${Ao()}`,a=wc(`Tab`),o=A(null);r({el:o,$el:o}),Hi(()=>a.registerTab(o)),Gi(()=>a.unregisterTab(o));let s=fr(Ec),c=U(()=>{if(s.value){let e=s.value.tabs.indexOf(i);return e===-1?s.value.tabs.push(i)-1:e}return-1}),l=U(()=>{let e=a.tabs.value.indexOf(o);return e===-1?c.value:e}),u=U(()=>l.value===a.selectedIndex.value);function d(e){let t=e();if(t===qo.Success&&a.activation.value===`auto`){let e=Ro(o)?.activeElement,t=a.tabs.value.findIndex(t=>G(t)===e);t!==-1&&a.setSelectedIndex(t)}return t}function f(e){let t=a.tabs.value.map(e=>G(e)).filter(Boolean);if(e.key===xs.Space||e.key===xs.Enter){e.preventDefault(),e.stopPropagation(),a.setSelectedIndex(l.value);return}switch(e.key){case xs.Home:case xs.PageUp:return e.preventDefault(),e.stopPropagation(),d(()=>Wo(t,Ko.First));case xs.End:case xs.PageDown:return e.preventDefault(),e.stopPropagation(),d(()=>Wo(t,Ko.Last))}if(d(()=>No(a.orientation.value,{vertical(){return e.key===xs.ArrowUp?Wo(t,Ko.Previous|Ko.WrapAround):e.key===xs.ArrowDown?Wo(t,Ko.Next|Ko.WrapAround):qo.Error},horizontal(){return e.key===xs.ArrowLeft?Wo(t,Ko.Previous|Ko.WrapAround):e.key===xs.ArrowRight?Wo(t,Ko.Next|Ko.WrapAround):qo.Error}}))===qo.Success)return e.preventDefault()}let p=A(!1);function m(){var t;p.value||(p.value=!0,!e.disabled&&((t=G(o))==null||t.focus({preventScroll:!0}),a.setSelectedIndex(l.value),To(()=>{p.value=!1})))}function h(e){e.preventDefault()}let g=es(U(()=>({as:e.as,type:t.type})),o);return()=>{let r={selected:u.value,disabled:e.disabled??!1},{...s}=e;return os({ourProps:{ref:o,onKeydown:f,onMousedown:h,onClick:m,id:i,role:`tab`,type:g.value,"aria-controls":G(a.panels.value[l.value])?.id,"aria-selected":u.value,tabIndex:u.value?0:-1,disabled:e.disabled?!0:void 0},theirProps:s,slot:r,attrs:t,slots:n,name:`Tab`})}}}),ise=N({name:`TabPanels`,props:{as:{type:[Object,String],default:`div`}},setup(e,{slots:t,attrs:n}){let r=wc(`TabPanels`);return()=>os({theirProps:e,ourProps:{},slot:{selectedIndex:r.selectedIndex.value},attrs:n,slots:t,name:`TabPanels`})}}),ase=N({name:`TabPanel`,props:{as:{type:[Object,String],default:`div`},static:{type:Boolean,default:!1},unmount:{type:Boolean,default:!0},id:{type:String,default:null},tabIndex:{type:Number,default:0}},setup(e,{attrs:t,slots:n,expose:r}){let i=e.id??`headlessui-tabs-panel-${Ao()}`,a=wc(`TabPanel`),o=A(null);r({el:o,$el:o}),Hi(()=>a.registerPanel(o)),Gi(()=>a.unregisterPanel(o));let s=fr(Ec),c=U(()=>{if(s.value){let e=s.value.panels.indexOf(i);return e===-1?s.value.panels.push(i)-1:e}return-1}),l=U(()=>{let e=a.panels.value.indexOf(o);return e===-1?c.value:e}),u=U(()=>l.value===a.selectedIndex.value);return()=>{let r={selected:u.value},{tabIndex:s,...c}=e,d={ref:o,id:i,role:`tabpanel`,"aria-labelledby":G(a.tabs.value[l.value])?.id,tabIndex:u.value?s:-1};return!u.value&&e.unmount&&!e.static?ci(ms,{as:`span`,"aria-hidden":!0,...d}):os({ourProps:d,theirProps:c,slot:r,attrs:t,slots:n,features:us.Static|us.RenderStrategy,visible:u.value,name:`TabPanel`})}}})}));function sse(e){let t={called:!1};return(...n)=>{if(!t.called)return t.called=!0,e(...n)}}var cse=s((()=>{}));function Ac(e,...t){e&&t.length>0&&e.classList.add(...t)}function jc(e,...t){e&&t.length>0&&e.classList.remove(...t)}function lse(e,t){let n=Do();if(!e)return n.dispose;let{transitionDuration:r,transitionDelay:i}=getComputedStyle(e),[a,o]=[r,i].map(e=>{let[t=0]=e.split(`,`).filter(Boolean).map(e=>e.includes(`ms`)?parseFloat(e):parseFloat(e)*1e3).sort((e,t)=>t-e);return t});return a===0?t(`finished`):n.setTimeout(()=>t(`finished`),a+o),n.add(()=>t(`cancelled`)),n.dispose}function use(e,t,n,r,i,a){let o=Do(),s=a===void 0?()=>{}:sse(a);return jc(e,...i),Ac(e,...t,...n),o.nextFrame(()=>{jc(e,...n),Ac(e,...r),o.add(lse(e,n=>(jc(e,...r,...t),Ac(e,...i),s(n))))}),o.add(()=>jc(e,...t,...n,...r,...i)),o.add(()=>s(`cancelled`)),o.dispose}var Mc,dse=s((()=>{Oo(),cse(),Mc=(e=>(e.Finished=`finished`,e.Cancelled=`cancelled`,e))(Mc||{})}));function Nc(e=``){return e.split(/\s+/).filter(e=>e.length>1)}function fse(){return fr(Fc,null)!==null}function pse(){let e=fr(Fc,null);if(e===null)throw Error(`A <TransitionChild /> is used but it is missing a parent <TransitionRoot />.`);return e}function mse(){let e=fr(Ic,null);if(e===null)throw Error(`A <TransitionChild /> is used but it is missing a parent <TransitionRoot />.`);return e}function Pc(e){return`children`in e?Pc(e.children):e.value.filter(({state:e})=>e===`visible`).length>0}function hse(e){let t=A([]),n=A(!1);Hi(()=>n.value=!0),Gi(()=>n.value=!1);function r(r,i=ds.Hidden){let a=t.value.findIndex(({id:e})=>e===r);a!==-1&&(No(i,{[ds.Unmount](){t.value.splice(a,1)},[ds.Hidden](){t.value[a].state=`hidden`}}),!Pc(t)&&n.value&&e?.())}function i(e){let n=t.value.find(({id:t})=>t===e);return n?n.state!==`visible`&&(n.state=`visible`):t.value.push({id:e,state:`visible`}),()=>r(e,ds.Unmount)}return{children:t,register:i,unregister:r}}var Fc,gse,Ic,Lc,_se,vse,yse,bse=s((()=>{W(),jo(),bs(),Mo(),Lo(),Po(),fs(),dse(),Fc=Symbol(`TransitionContext`),gse=(e=>(e.Visible=`visible`,e.Hidden=`hidden`,e))(gse||{}),Ic=Symbol(`NestingContext`),Lc=us.RenderStrategy,_se=N({props:{as:{type:[Object,String],default:`div`},show:{type:[Boolean],default:null},unmount:{type:[Boolean],default:!0},appear:{type:[Boolean],default:!1},enter:{type:[String],default:``},enterFrom:{type:[String],default:``},enterTo:{type:[String],default:``},entered:{type:[String],default:``},leave:{type:[String],default:``},leaveFrom:{type:[String],default:``},leaveTo:{type:[String],default:``}},emits:{beforeEnter:()=>!0,afterEnter:()=>!0,beforeLeave:()=>!0,afterLeave:()=>!0},setup(e,{emit:t,attrs:n,slots:r,expose:i}){let a=A(0);function o(){a.value|=ys.Opening,t(`beforeEnter`)}function s(){a.value&=~ys.Opening,t(`afterEnter`)}function c(){a.value|=ys.Closing,t(`beforeLeave`)}function l(){a.value&=~ys.Closing,t(`afterLeave`)}if(!fse()&&dae())return()=>ci(yse,{...e,onBeforeEnter:o,onAfterEnter:s,onBeforeLeave:c,onAfterLeave:l},r);let u=A(null),d=U(()=>e.unmount?ds.Unmount:ds.Hidden);i({el:u,$el:u});let{show:f,appear:p}=pse(),{register:m,unregister:h}=mse(),g=A(f.value?`visible`:`hidden`),_={value:!0},v=Ao(),y={value:!1},b=hse(()=>{!y.value&&g.value!==`hidden`&&(g.value=`hidden`,h(v),l())});Hi(()=>{Gi(m(v))}),pr(()=>{if(d.value===ds.Hidden&&v){if(f.value&&g.value!==`visible`){g.value=`visible`;return}No(g.value,{hidden:()=>h(v),visible:()=>m(v)})}});let x=Nc(e.enter),S=Nc(e.enterFrom),C=Nc(e.enterTo),w=Nc(e.entered),ee=Nc(e.leave),te=Nc(e.leaveFrom),ne=Nc(e.leaveTo);Hi(()=>{pr(()=>{if(g.value===`visible`){let e=G(u);if(e instanceof Comment&&e.data===``)throw Error("Did you forget to passthrough the `ref` to the actual DOM node?")}})});function re(e){let t=_.value&&!p.value,n=G(u);!n||!(n instanceof HTMLElement)||t||(y.value=!0,f.value&&o(),f.value||c(),e(f.value?use(n,x,S,C,w,e=>{y.value=!1,e===Mc.Finished&&s()}):use(n,ee,te,ne,w,e=>{y.value=!1,e===Mc.Finished&&(Pc(b)||(g.value=`hidden`,h(v),l()))})))}return Hi(()=>{mr([f],(e,t,n)=>{re(n),_.value=!1},{immediate:!0})}),dr(Ic,b),_s(U(()=>No(g.value,{visible:ys.Open,hidden:ys.Closed})|a.value)),()=>{let{appear:t,show:i,enter:a,enterFrom:o,enterTo:s,entered:c,leave:l,leaveFrom:d,leaveTo:m,...h}=e,_={ref:u};return os({theirProps:{...h,...p.value&&f.value&&Io.isServer?{class:O([n.class,h.class,...x,...S])}:{}},ourProps:_,slot:{},slots:r,attrs:n,features:Lc,visible:g.value===`visible`,name:`TransitionChild`})}}}),vse=_se,yse=N({inheritAttrs:!1,props:{as:{type:[Object,String],default:`div`},show:{type:[Boolean],default:null},unmount:{type:[Boolean],default:!0},appear:{type:[Boolean],default:!1},enter:{type:[String],default:``},enterFrom:{type:[String],default:``},enterTo:{type:[String],default:``},entered:{type:[String],default:``},leave:{type:[String],default:``},leaveFrom:{type:[String],default:``},leaveTo:{type:[String],default:``}},emits:{beforeEnter:()=>!0,afterEnter:()=>!0,beforeLeave:()=>!0,afterLeave:()=>!0},setup(e,{emit:t,attrs:n,slots:r}){let i=gs(),a=U(()=>e.show===null&&i!==null?(i.value&ys.Open)===ys.Open:e.show);pr(()=>{if(![!0,!1].includes(a.value))throw Error('A <Transition /> is used but it is missing a `:show="true | false"` prop.')});let o=A(a.value?`visible`:`hidden`),s=hse(()=>{o.value=`hidden`}),c=A(!0),l={show:a,appear:U(()=>e.appear||!c.value)};return Hi(()=>{pr(()=>{c.value=!1,a.value?o.value=`visible`:Pc(s)||(o.value=`hidden`)})}),dr(Ic,s),dr(Fc,l),()=>{let i=ls(e,[`show`,`appear`,`unmount`,`onBeforeEnter`,`onBeforeLeave`,`onAfterEnter`,`onAfterLeave`]),a={unmount:e.unmount};return os({ourProps:{...a,as:`template`},theirProps:{},slot:{},slots:{...r,default:()=>[ci(vse,{onBeforeEnter:()=>t(`beforeEnter`),onAfterEnter:()=>t(`afterEnter`),onBeforeLeave:()=>t(`beforeLeave`),onAfterLeave:()=>t(`afterLeave`),...n,...a,...i},r.default)]},attrs:{},features:Lc,visible:o.value===`visible`,name:`Transition`})}}})})),Rc=s((()=>{Tae(),hoe(),voe(),Nae(),Poe(),Hoe(),Koe(),Qoe(),$oe(),ose(),bse(),jo()})),zc,Bc=s((()=>{zc=(e,t)=>{let n=e.__vccOpts||e;for(let[e,r]of t)n[e]=r;return n}}));function Vc(e={}){let t=U(()=>e.label?{"aria-label":e.label}:{"aria-hidden":!0,role:`presentation`});return{bind:U(()=>({width:`1em`,height:`1em`,...t.value})),weight:U(()=>e.weight??xse)}}var xse,Hc=s((()=>{W(),xse=`regular`})),Sse,Cse,wse,Tse,Ese,Dse,Ose,kse=s((()=>{Hc(),W(),Sse={key:0},Cse={key:1},wse={key:2},Tse={key:3},Ese={key:4},Dse={key:5},Ose=N({name:`ScalarIconArrowRight`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Sse,[...r[0]||=[R(`path`,{d:`M224.49,136.49l-72,72a12,12,0,0,1-17-17L187,140H40a12,12,0,0,1,0-24H187L135.51,64.48a12,12,0,0,1,17-17l72,72A12,12,0,0,1,224.49,136.49Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Cse,[...r[1]||=[R(`path`,{d:`M216,128l-72,72V56Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M221.66,122.34l-72-72A8,8,0,0,0,136,56v64H40a8,8,0,0,0,0,16h96v64a8,8,0,0,0,13.66,5.66l72-72A8,8,0,0,0,221.66,122.34ZM152,180.69V75.31L204.69,128Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,wse,[...r[2]||=[R(`path`,{d:`M221.66,133.66l-72,72A8,8,0,0,1,136,200V136H40a8,8,0,0,1,0-16h96V56a8,8,0,0,1,13.66-5.66l72,72A8,8,0,0,1,221.66,133.66Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Tse,[...r[3]||=[R(`path`,{d:`M220.24,132.24l-72,72a6,6,0,0,1-8.48-8.48L201.51,134H40a6,6,0,0,1,0-12H201.51L139.76,60.24a6,6,0,0,1,8.48-8.48l72,72A6,6,0,0,1,220.24,132.24Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Ese,[...r[4]||=[R(`path`,{d:`M221.66,133.66l-72,72a8,8,0,0,1-11.32-11.32L196.69,136H40a8,8,0,0,1,0-16H196.69L138.34,61.66a8,8,0,0,1,11.32-11.32l72,72A8,8,0,0,1,221.66,133.66Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Dse,[...r[5]||=[R(`path`,{d:`M218.83,130.83l-72,72a4,4,0,0,1-5.66-5.66L206.34,132H40a4,4,0,0,1,0-8H206.34L141.17,58.83a4,4,0,0,1,5.66-5.66l72,72A4,4,0,0,1,218.83,130.83Z`},null,-1)]])):B(``,!0)],16))}})})),Ase,jse=s((()=>{kse(),Ase=Ose})),Mse,Nse,Pse,Fse,Ise,Lse,Rse,zse=s((()=>{Hc(),W(),Mse={key:0},Nse={key:1},Pse={key:2},Fse={key:3},Ise={key:4},Lse={key:5},Rse=N({name:`ScalarIconArrowUp`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Mse,[...r[0]||=[R(`path`,{d:`M208.49,120.49a12,12,0,0,1-17,0L140,69V216a12,12,0,0,1-24,0V69L64.49,120.49a12,12,0,0,1-17-17l72-72a12,12,0,0,1,17,0l72,72A12,12,0,0,1,208.49,120.49Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Nse,[...r[1]||=[R(`path`,{d:`M200,112H56l72-72Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M205.66,106.34l-72-72a8,8,0,0,0-11.32,0l-72,72A8,8,0,0,0,56,120h64v96a8,8,0,0,0,16,0V120h64a8,8,0,0,0,5.66-13.66ZM75.31,104,128,51.31,180.69,104Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Pse,[...r[2]||=[R(`path`,{d:`M207.39,115.06A8,8,0,0,1,200,120H136v96a8,8,0,0,1-16,0V120H56a8,8,0,0,1-5.66-13.66l72-72a8,8,0,0,1,11.32,0l72,72A8,8,0,0,1,207.39,115.06Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Fse,[...r[3]||=[R(`path`,{d:`M204.24,116.24a6,6,0,0,1-8.48,0L134,54.49V216a6,6,0,0,1-12,0V54.49L60.24,116.24a6,6,0,0,1-8.48-8.48l72-72a6,6,0,0,1,8.48,0l72,72A6,6,0,0,1,204.24,116.24Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Ise,[...r[4]||=[R(`path`,{d:`M205.66,117.66a8,8,0,0,1-11.32,0L136,59.31V216a8,8,0,0,1-16,0V59.31L61.66,117.66a8,8,0,0,1-11.32-11.32l72-72a8,8,0,0,1,11.32,0l72,72A8,8,0,0,1,205.66,117.66Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Lse,[...r[5]||=[R(`path`,{d:`M202.83,114.83a4,4,0,0,1-5.66,0L132,49.66V216a4,4,0,0,1-8,0V49.66L58.83,114.83a4,4,0,0,1-5.66-5.66l72-72a4,4,0,0,1,5.66,0l72,72A4,4,0,0,1,202.83,114.83Z`},null,-1)]])):B(``,!0)],16))}})})),Uc,Bse=s((()=>{zse(),Uc=Rse})),Vse,Hse,Use,Wse,Gse,Kse,qse,Jse=s((()=>{Hc(),W(),Vse={key:0},Hse={key:1},Use={key:2},Wse={key:3},Gse={key:4},Kse={key:5},qse=N({name:`ScalarIconArrowUpRight`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Vse,[...r[0]||=[R(`path`,{d:`M204,64V168a12,12,0,0,1-24,0V93L72.49,200.49a12,12,0,0,1-17-17L163,76H88a12,12,0,0,1,0-24H192A12,12,0,0,1,204,64Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Hse,[...r[1]||=[R(`path`,{d:`M192,64V168L88,64Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M192,56H88a8,8,0,0,0-5.66,13.66L128.69,116,58.34,186.34a8,8,0,0,0,11.32,11.32L140,127.31l46.34,46.35A8,8,0,0,0,200,168V64A8,8,0,0,0,192,56Zm-8,92.69-38.34-38.34h0L107.31,72H184Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Use,[...r[2]||=[R(`path`,{d:`M200,64V168a8,8,0,0,1-13.66,5.66L140,127.31,69.66,197.66a8,8,0,0,1-11.32-11.32L128.69,116,82.34,69.66A8,8,0,0,1,88,56H192A8,8,0,0,1,200,64Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Wse,[...r[3]||=[R(`path`,{d:`M198,64V168a6,6,0,0,1-12,0V78.48L68.24,196.24a6,6,0,0,1-8.48-8.48L177.52,70H88a6,6,0,0,1,0-12H192A6,6,0,0,1,198,64Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Gse,[...r[4]||=[R(`path`,{d:`M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Kse,[...r[5]||=[R(`path`,{d:`M196,64V168a4,4,0,0,1-8,0V73.66L66.83,194.83a4,4,0,0,1-5.66-5.66L182.34,68H88a4,4,0,0,1,0-8H192A4,4,0,0,1,196,64Z`},null,-1)]])):B(``,!0)],16))}})})),Wc,Yse=s((()=>{Jse(),Wc=qse})),Xse,Zse,Qse,$se,ece,tce,nce,rce=s((()=>{Hc(),W(),Xse={key:0},Zse={key:1},Qse={key:2},$se={key:3},ece={key:4},tce={key:5},nce=N({name:`ScalarIconBook`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Xse,[...r[0]||=[R(`path`,{d:`M208,20H72A36,36,0,0,0,36,56V224a12,12,0,0,0,12,12H192a12,12,0,0,0,0-24H60v-4a12,12,0,0,1,12-12H208a12,12,0,0,0,12-12V32A12,12,0,0,0,208,20ZM196,172H72a35.59,35.59,0,0,0-12,2.06V56A12,12,0,0,1,72,44H196Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Zse,[...r[1]||=[R(`path`,{d:`M208,32V192H72a24,24,0,0,0-24,24V56A24,24,0,0,1,72,32Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M208,24H72A32,32,0,0,0,40,56V224a8,8,0,0,0,8,8H192a8,8,0,0,0,0-16H56a16,16,0,0,1,16-16H208a8,8,0,0,0,8-8V32A8,8,0,0,0,208,24Zm-8,160H72a31.82,31.82,0,0,0-16,4.29V56A16,16,0,0,1,72,40H200Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Qse,[...r[2]||=[R(`path`,{d:`M216,32V192a8,8,0,0,1-8,8H72a16,16,0,0,0-16,16H192a8,8,0,0,1,0,16H48a8,8,0,0,1-8-8V56A32,32,0,0,1,72,24H208A8,8,0,0,1,216,32Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,$se,[...r[3]||=[R(`path`,{d:`M208,26H72A30,30,0,0,0,42,56V224a6,6,0,0,0,6,6H192a6,6,0,0,0,0-12H54v-2a18,18,0,0,1,18-18H208a6,6,0,0,0,6-6V32A6,6,0,0,0,208,26Zm-6,160H72a29.87,29.87,0,0,0-18,6V56A18,18,0,0,1,72,38H202Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,ece,[...r[4]||=[R(`path`,{d:`M208,24H72A32,32,0,0,0,40,56V224a8,8,0,0,0,8,8H192a8,8,0,0,0,0-16H56a16,16,0,0,1,16-16H208a8,8,0,0,0,8-8V32A8,8,0,0,0,208,24Zm-8,160H72a31.82,31.82,0,0,0-16,4.29V56A16,16,0,0,1,72,40H200Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,tce,[...r[5]||=[R(`path`,{d:`M208,28H72A28,28,0,0,0,44,56V224a4,4,0,0,0,4,4H192a4,4,0,0,0,0-8H52v-4a20,20,0,0,1,20-20H208a4,4,0,0,0,4-4V32A4,4,0,0,0,208,28Zm-4,160H72a27.94,27.94,0,0,0-20,8.42V56A20,20,0,0,1,72,36H204Z`},null,-1)]])):B(``,!0)],16))}})})),Gc,ice=s((()=>{rce(),Gc=nce})),ace,oce,sce,cce,lce,uce,dce,fce=s((()=>{Hc(),W(),ace={key:0},oce={key:1},sce={key:2},cce={key:3},lce={key:4},uce={key:5},dce=N({name:`ScalarIconBookOpen`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,ace,[...r[0]||=[R(`path`,{d:`M232,44H160a43.86,43.86,0,0,0-32,13.85A43.86,43.86,0,0,0,96,44H24A12,12,0,0,0,12,56V200a12,12,0,0,0,12,12H96a20,20,0,0,1,20,20,12,12,0,0,0,24,0,20,20,0,0,1,20-20h72a12,12,0,0,0,12-12V56A12,12,0,0,0,232,44ZM96,188H36V68H96a20,20,0,0,1,20,20V192.81A43.79,43.79,0,0,0,96,188Zm124,0H160a43.71,43.71,0,0,0-20,4.83V88a20,20,0,0,1,20-20h60Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,oce,[...r[1]||=[R(`path`,{d:`M232,56V200H160a32,32,0,0,0-32,32,32,32,0,0,0-32-32H24V56H96a32,32,0,0,1,32,32,32,32,0,0,1,32-32Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M232,48H160a40,40,0,0,0-32,16A40,40,0,0,0,96,48H24a8,8,0,0,0-8,8V200a8,8,0,0,0,8,8H96a24,24,0,0,1,24,24,8,8,0,0,0,16,0,24,24,0,0,1,24-24h72a8,8,0,0,0,8-8V56A8,8,0,0,0,232,48ZM96,192H32V64H96a24,24,0,0,1,24,24V200A39.81,39.81,0,0,0,96,192Zm128,0H160a39.81,39.81,0,0,0-24,8V88a24,24,0,0,1,24-24h64Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,sce,[...r[2]||=[R(`path`,{d:`M240,56V200a8,8,0,0,1-8,8H160a24,24,0,0,0-24,23.94,7.9,7.9,0,0,1-5.12,7.55A8,8,0,0,1,120,232a24,24,0,0,0-24-24H24a8,8,0,0,1-8-8V56a8,8,0,0,1,8-8H88a32,32,0,0,1,32,32v87.73a8.17,8.17,0,0,0,7.47,8.25,8,8,0,0,0,8.53-8V80a32,32,0,0,1,32-32h64A8,8,0,0,1,240,56Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,cce,[...r[3]||=[R(`path`,{d:`M232,50H160a38,38,0,0,0-32,17.55A38,38,0,0,0,96,50H24a6,6,0,0,0-6,6V200a6,6,0,0,0,6,6H96a26,26,0,0,1,26,26,6,6,0,0,0,12,0,26,26,0,0,1,26-26h72a6,6,0,0,0,6-6V56A6,6,0,0,0,232,50ZM96,194H30V62H96a26,26,0,0,1,26,26V204.31A37.86,37.86,0,0,0,96,194Zm130,0H160a37.87,37.87,0,0,0-26,10.32V88a26,26,0,0,1,26-26h66Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,lce,[...r[4]||=[R(`path`,{d:`M232,48H160a40,40,0,0,0-32,16A40,40,0,0,0,96,48H24a8,8,0,0,0-8,8V200a8,8,0,0,0,8,8H96a24,24,0,0,1,24,24,8,8,0,0,0,16,0,24,24,0,0,1,24-24h72a8,8,0,0,0,8-8V56A8,8,0,0,0,232,48ZM96,192H32V64H96a24,24,0,0,1,24,24V200A39.81,39.81,0,0,0,96,192Zm128,0H160a39.81,39.81,0,0,0-24,8V88a24,24,0,0,1,24-24h64Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,uce,[...r[5]||=[R(`path`,{d:`M232,52H160a36,36,0,0,0-32,19.54A36,36,0,0,0,96,52H24a4,4,0,0,0-4,4V200a4,4,0,0,0,4,4H96a28,28,0,0,1,28,28,4,4,0,0,0,8,0,28,28,0,0,1,28-28h72a4,4,0,0,0,4-4V56A4,4,0,0,0,232,52ZM96,196H28V60H96a28,28,0,0,1,28,28V209.4A35.93,35.93,0,0,0,96,196Zm132,0H160a35.94,35.94,0,0,0-28,13.41V88a28,28,0,0,1,28-28h68Z`},null,-1)]])):B(``,!0)],16))}})})),pce,mce=s((()=>{fce(),pce=dce})),hce,gce,_ce,vce,yce,bce,xce,Sce=s((()=>{Hc(),W(),hce={key:0},gce={key:1},_ce={key:2},vce={key:3},yce={key:4},bce={key:5},xce=N({name:`ScalarIconBookOpenText`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,hce,[...r[0]||=[R(`path`,{d:`M232,44H160a43.86,43.86,0,0,0-32,13.85A43.86,43.86,0,0,0,96,44H24A12,12,0,0,0,12,56V200a12,12,0,0,0,12,12H96a20,20,0,0,1,20,20,12,12,0,0,0,24,0,20,20,0,0,1,20-20h72a12,12,0,0,0,12-12V56A12,12,0,0,0,232,44ZM96,188H36V68H96a20,20,0,0,1,20,20V192.81A43.79,43.79,0,0,0,96,188Zm124,0H160a43.71,43.71,0,0,0-20,4.83V88a20,20,0,0,1,20-20h60ZM164,96h32a12,12,0,0,1,0,24H164a12,12,0,0,1,0-24Zm44,52a12,12,0,0,1-12,12H164a12,12,0,0,1,0-24h32A12,12,0,0,1,208,148Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,gce,[...r[1]||=[R(`path`,{d:`M232,56V200H160a32,32,0,0,0-32,32V88a32,32,0,0,1,32-32Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M232,48H160a40,40,0,0,0-32,16A40,40,0,0,0,96,48H24a8,8,0,0,0-8,8V200a8,8,0,0,0,8,8H96a24,24,0,0,1,24,24,8,8,0,0,0,16,0,24,24,0,0,1,24-24h72a8,8,0,0,0,8-8V56A8,8,0,0,0,232,48ZM96,192H32V64H96a24,24,0,0,1,24,24V200A39.81,39.81,0,0,0,96,192Zm128,0H160a39.81,39.81,0,0,0-24,8V88a24,24,0,0,1,24-24h64ZM160,88h40a8,8,0,0,1,0,16H160a8,8,0,0,1,0-16Zm48,40a8,8,0,0,1-8,8H160a8,8,0,0,1,0-16h40A8,8,0,0,1,208,128Zm0,32a8,8,0,0,1-8,8H160a8,8,0,0,1,0-16h40A8,8,0,0,1,208,160Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,_ce,[...r[2]||=[R(`path`,{d:`M232,48H168a32,32,0,0,0-32,32v87.73a8.17,8.17,0,0,1-7.47,8.25,8,8,0,0,1-8.53-8V80A32,32,0,0,0,88,48H24a8,8,0,0,0-8,8V200a8,8,0,0,0,8,8H96a24,24,0,0,1,24,23.94,7.9,7.9,0,0,0,5.12,7.55A8,8,0,0,0,136,232a24,24,0,0,1,24-24h72a8,8,0,0,0,8-8V56A8,8,0,0,0,232,48ZM208,168H168.27a8.17,8.17,0,0,1-8.25-7.47,8,8,0,0,1,8-8.53h39.73a8.17,8.17,0,0,1,8.25,7.47A8,8,0,0,1,208,168Zm0-32H168.27a8.17,8.17,0,0,1-8.25-7.47,8,8,0,0,1,8-8.53h39.73a8.17,8.17,0,0,1,8.25,7.47A8,8,0,0,1,208,136Zm0-32H168.27A8.17,8.17,0,0,1,160,96.53,8,8,0,0,1,168,88h39.73A8.17,8.17,0,0,1,216,95.47,8,8,0,0,1,208,104Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,vce,[...r[3]||=[R(`path`,{d:`M232,50H160a38,38,0,0,0-32,17.55A38,38,0,0,0,96,50H24a6,6,0,0,0-6,6V200a6,6,0,0,0,6,6H96a26,26,0,0,1,26,26,6,6,0,0,0,12,0,26,26,0,0,1,26-26h72a6,6,0,0,0,6-6V56A6,6,0,0,0,232,50ZM96,194H30V62H96a26,26,0,0,1,26,26V204.31A37.86,37.86,0,0,0,96,194Zm130,0H160a37.87,37.87,0,0,0-26,10.32V88a26,26,0,0,1,26-26h66ZM160,90h40a6,6,0,0,1,0,12H160a6,6,0,0,1,0-12Zm46,38a6,6,0,0,1-6,6H160a6,6,0,0,1,0-12h40A6,6,0,0,1,206,128Zm0,32a6,6,0,0,1-6,6H160a6,6,0,0,1,0-12h40A6,6,0,0,1,206,160Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,yce,[...r[4]||=[R(`path`,{d:`M232,48H160a40,40,0,0,0-32,16A40,40,0,0,0,96,48H24a8,8,0,0,0-8,8V200a8,8,0,0,0,8,8H96a24,24,0,0,1,24,24,8,8,0,0,0,16,0,24,24,0,0,1,24-24h72a8,8,0,0,0,8-8V56A8,8,0,0,0,232,48ZM96,192H32V64H96a24,24,0,0,1,24,24V200A39.81,39.81,0,0,0,96,192Zm128,0H160a39.81,39.81,0,0,0-24,8V88a24,24,0,0,1,24-24h64ZM160,88h40a8,8,0,0,1,0,16H160a8,8,0,0,1,0-16Zm48,40a8,8,0,0,1-8,8H160a8,8,0,0,1,0-16h40A8,8,0,0,1,208,128Zm0,32a8,8,0,0,1-8,8H160a8,8,0,0,1,0-16h40A8,8,0,0,1,208,160Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,bce,[...r[5]||=[R(`path`,{d:`M232,52H160a36,36,0,0,0-32,19.54A36,36,0,0,0,96,52H24a4,4,0,0,0-4,4V200a4,4,0,0,0,4,4H96a28,28,0,0,1,28,28,4,4,0,0,0,8,0,28,28,0,0,1,28-28h72a4,4,0,0,0,4-4V56A4,4,0,0,0,232,52ZM96,196H28V60H96a28,28,0,0,1,28,28V209.4A35.94,35.94,0,0,0,96,196Zm132,0H160a35.94,35.94,0,0,0-28,13.41V88a28,28,0,0,1,28-28h68ZM160,92h40a4,4,0,0,1,0,8H160a4,4,0,0,1,0-8Zm44,36a4,4,0,0,1-4,4H160a4,4,0,0,1,0-8h40A4,4,0,0,1,204,128Zm0,32a4,4,0,0,1-4,4H160a4,4,0,0,1,0-8h40A4,4,0,0,1,204,160Z`},null,-1)]])):B(``,!0)],16))}})})),Cce,wce=s((()=>{Sce(),Cce=xce})),Tce,Ece,Dce,Oce,kce,Ace,Kc,jce=s((()=>{Hc(),W(),Tce={key:0},Ece={key:1},Dce={key:2},Oce={key:3},kce={key:4},Ace={key:5},Kc=N({name:`ScalarIconBracketsCurly`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Tce,[...r[0]||=[R(`path`,{d:`M54.8,119.49A35.06,35.06,0,0,1,49.05,128a35.06,35.06,0,0,1,5.75,8.51C60,147.24,60,159.83,60,172c0,25.94,1.84,32,20,32a12,12,0,0,1,0,24c-19.14,0-32.2-6.9-38.8-20.51C36,196.76,36,184.17,36,172c0-25.94-1.84-32-20-32a12,12,0,0,1,0-24c18.16,0,20-6.06,20-32,0-12.17,0-24.76,5.2-35.49C47.8,34.9,60.86,28,80,28a12,12,0,0,1,0,24c-18.16,0-20,6.06-20,32C60,96.17,60,108.76,54.8,119.49ZM240,116c-18.16,0-20-6.06-20-32,0-12.17,0-24.76-5.2-35.49C208.2,34.9,195.14,28,176,28a12,12,0,0,0,0,24c18.16,0,20,6.06,20,32,0,12.17,0,24.76,5.2,35.49A35.06,35.06,0,0,0,207,128a35.06,35.06,0,0,0-5.75,8.51C196,147.24,196,159.83,196,172c0,25.94-1.84,32-20,32a12,12,0,0,0,0,24c19.14,0,32.2-6.9,38.8-20.51C220,196.76,220,184.17,220,172c0-25.94,1.84-32,20-32a12,12,0,0,0,0-24Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Ece,[...r[1]||=[R(`path`,{d:`M240,128c-64,0,0,88-64,88H80c-64,0,0-88-64-88,64,0,0-88,64-88h96C240,40,176,128,240,128Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M43.18,128a29.78,29.78,0,0,1,8,10.26c4.8,9.9,4.8,22,4.8,33.74,0,24.31,1,36,24,36a8,8,0,0,1,0,16c-17.48,0-29.32-6.14-35.2-18.26-4.8-9.9-4.8-22-4.8-33.74,0-24.31-1-36-24-36a8,8,0,0,1,0-16c23,0,24-11.69,24-36,0-11.72,0-23.84,4.8-33.74C50.68,38.14,62.52,32,80,32a8,8,0,0,1,0,16C57,48,56,59.69,56,84c0,11.72,0,23.84-4.8,33.74A29.78,29.78,0,0,1,43.18,128ZM240,120c-23,0-24-11.69-24-36,0-11.72,0-23.84-4.8-33.74C205.32,38.14,193.48,32,176,32a8,8,0,0,0,0,16c23,0,24,11.69,24,36,0,11.72,0,23.84,4.8,33.74a29.78,29.78,0,0,0,8,10.26,29.78,29.78,0,0,0-8,10.26c-4.8,9.9-4.8,22-4.8,33.74,0,24.31-1,36-24,36a8,8,0,0,0,0,16c17.48,0,29.32-6.14,35.2-18.26,4.8-9.9,4.8-22,4.8-33.74,0-24.31,1-36,24-36a8,8,0,0,0,0-16Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Dce,[...r[2]||=[R(`path`,{d:`M216,40H40A16,16,0,0,0,24,56V200a16,16,0,0,0,16,16H216a16,16,0,0,0,16-16V56A16,16,0,0,0,216,40ZM88,155.84c.29,14.26.41,20.16,16,20.16a8,8,0,0,1,0,16c-31.27,0-31.72-22.43-32-35.84C71.71,141.9,71.59,136,56,136a8,8,0,0,1,0-16c15.59,0,15.71-5.9,16-20.16C72.28,86.43,72.73,64,104,64a8,8,0,0,1,0,16c-15.59,0-15.71,5.9-16,20.16-.17,8.31-.41,20.09-8,27.84C87.59,135.75,87.83,147.53,88,155.84ZM200,136c-15.59,0-15.71,5.9-16,20.16-.28,13.41-.73,35.84-32,35.84a8,8,0,0,1,0-16c15.59,0,15.71-5.9,16-20.16.17-8.31.41-20.09,8-27.84-7.6-7.75-7.84-19.53-8-27.84C167.71,85.9,167.59,80,152,80a8,8,0,0,1,0-16c31.27,0,31.72,22.43,32,35.84.29,14.26.41,20.16,16,20.16a8,8,0,0,1,0,16Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Oce,[...r[3]||=[R(`path`,{d:`M39.91,128a27.68,27.68,0,0,1,9.49,11.13C54,148.62,54,160.51,54,172c0,24.27,1.21,38,26,38a6,6,0,0,1,0,12c-16.88,0-27.81-5.6-33.4-17.13C42,195.38,42,183.49,42,172c0-24.27-1.21-38-26-38a6,6,0,0,1,0-12c24.79,0,26-13.73,26-38,0-11.49,0-23.38,4.6-32.87C52.19,39.6,63.12,34,80,34a6,6,0,0,1,0,12C55.21,46,54,59.73,54,84c0,11.49,0,23.38-4.6,32.87A27.68,27.68,0,0,1,39.91,128ZM240,122c-24.79,0-26-13.73-26-38,0-11.49,0-23.38-4.6-32.87C203.81,39.6,192.88,34,176,34a6,6,0,0,0,0,12c24.79,0,26,13.73,26,38,0,11.49,0,23.38,4.6,32.87A27.68,27.68,0,0,0,216.09,128a27.68,27.68,0,0,0-9.49,11.13C202,148.62,202,160.51,202,172c0,24.27-1.21,38-26,38a6,6,0,0,0,0,12c16.88,0,27.81-5.6,33.4-17.13,4.6-9.49,4.6-21.38,4.6-32.87,0-24.27,1.21-38,26-38a6,6,0,0,0,0-12Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,kce,[...r[4]||=[R(`path`,{d:`M43.18,128a29.78,29.78,0,0,1,8,10.26c4.8,9.9,4.8,22,4.8,33.74,0,24.31,1,36,24,36a8,8,0,0,1,0,16c-17.48,0-29.32-6.14-35.2-18.26-4.8-9.9-4.8-22-4.8-33.74,0-24.31-1-36-24-36a8,8,0,0,1,0-16c23,0,24-11.69,24-36,0-11.72,0-23.84,4.8-33.74C50.68,38.14,62.52,32,80,32a8,8,0,0,1,0,16C57,48,56,59.69,56,84c0,11.72,0,23.84-4.8,33.74A29.78,29.78,0,0,1,43.18,128ZM240,120c-23,0-24-11.69-24-36,0-11.72,0-23.84-4.8-33.74C205.32,38.14,193.48,32,176,32a8,8,0,0,0,0,16c23,0,24,11.69,24,36,0,11.72,0,23.84,4.8,33.74a29.78,29.78,0,0,0,8,10.26,29.78,29.78,0,0,0-8,10.26c-4.8,9.9-4.8,22-4.8,33.74,0,24.31-1,36-24,36a8,8,0,0,0,0,16c17.48,0,29.32-6.14,35.2-18.26,4.8-9.9,4.8-22,4.8-33.74,0-24.31,1-36,24-36a8,8,0,0,0,0-16Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Ace,[...r[5]||=[R(`path`,{d:`M35.89,128C52,136.23,52,155.64,52,172c0,24.8,1.35,40,28,40a4,4,0,0,1,0,8c-36,0-36-26.61-36-48,0-24.8-1.35-40-28-40a4,4,0,0,1,0-8c26.65,0,28-15.2,28-40,0-21.39,0-48,36-48a4,4,0,0,1,0,8C53.35,44,52,59.2,52,84,52,100.36,52,119.77,35.89,128ZM240,124c-26.65,0-28-15.2-28-40,0-21.39,0-48-36-48a4,4,0,0,0,0,8c26.65,0,28,15.2,28,40,0,16.36,0,35.77,16.11,44C204,136.23,204,155.64,204,172c0,24.8-1.35,40-28,40a4,4,0,0,0,0,8c36,0,36-26.61,36-48,0-24.8,1.35-40,28-40a4,4,0,0,0,0-8Z`},null,-1)]])):B(``,!0)],16))}})})),qc,Mce=s((()=>{jce(),qc=Kc})),Jc,Yc,Xc,Zc,Qc,$c,el,Nce=s((()=>{Hc(),W(),Jc={key:0},Yc={key:1},Xc={key:2},Zc={key:3},Qc={key:4},$c={key:5},el=N({name:`ScalarIconCaretDown`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Jc,[...r[0]||=[R(`path`,{d:`M216.49,104.49l-80,80a12,12,0,0,1-17,0l-80-80a12,12,0,0,1,17-17L128,159l71.51-71.52a12,12,0,0,1,17,17Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Yc,[...r[1]||=[R(`path`,{d:`M208,96l-80,80L48,96Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M215.39,92.94A8,8,0,0,0,208,88H48a8,8,0,0,0-5.66,13.66l80,80a8,8,0,0,0,11.32,0l80-80A8,8,0,0,0,215.39,92.94ZM128,164.69,67.31,104H188.69Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Xc,[...r[2]||=[R(`path`,{d:`M213.66,101.66l-80,80a8,8,0,0,1-11.32,0l-80-80A8,8,0,0,1,48,88H208a8,8,0,0,1,5.66,13.66Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Zc,[...r[3]||=[R(`path`,{d:`M212.24,100.24l-80,80a6,6,0,0,1-8.48,0l-80-80a6,6,0,0,1,8.48-8.48L128,167.51l75.76-75.75a6,6,0,0,1,8.48,8.48Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Qc,[...r[4]||=[R(`path`,{d:`M213.66,101.66l-80,80a8,8,0,0,1-11.32,0l-80-80A8,8,0,0,1,53.66,90.34L128,164.69l74.34-74.35a8,8,0,0,1,11.32,11.32Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,$c,[...r[5]||=[R(`path`,{d:`M210.83,98.83l-80,80a4,4,0,0,1-5.66,0l-80-80a4,4,0,0,1,5.66-5.66L128,170.34l77.17-77.17a4,4,0,1,1,5.66,5.66Z`},null,-1)]])):B(``,!0)],16))}})})),tl,Pce=s((()=>{Nce(),tl=el})),nl,rl,il,al,ol,sl,cl,Fce=s((()=>{Hc(),W(),nl={key:0},rl={key:1},il={key:2},al={key:3},ol={key:4},sl={key:5},cl=N({name:`ScalarIconCaretRight`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,nl,[...r[0]||=[R(`path`,{d:`M184.49,136.49l-80,80a12,12,0,0,1-17-17L159,128,87.51,56.49a12,12,0,1,1,17-17l80,80A12,12,0,0,1,184.49,136.49Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,rl,[...r[1]||=[R(`path`,{d:`M176,128,96,208V48Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M181.66,122.34l-80-80A8,8,0,0,0,88,48V208a8,8,0,0,0,13.66,5.66l80-80A8,8,0,0,0,181.66,122.34ZM104,188.69V67.31L164.69,128Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,il,[...r[2]||=[R(`path`,{d:`M181.66,133.66l-80,80A8,8,0,0,1,88,208V48a8,8,0,0,1,13.66-5.66l80,80A8,8,0,0,1,181.66,133.66Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,al,[...r[3]||=[R(`path`,{d:`M180.24,132.24l-80,80a6,6,0,0,1-8.48-8.48L167.51,128,91.76,52.24a6,6,0,0,1,8.48-8.48l80,80A6,6,0,0,1,180.24,132.24Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,ol,[...r[4]||=[R(`path`,{d:`M181.66,133.66l-80,80a8,8,0,0,1-11.32-11.32L164.69,128,90.34,53.66a8,8,0,0,1,11.32-11.32l80,80A8,8,0,0,1,181.66,133.66Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,sl,[...r[5]||=[R(`path`,{d:`M178.83,130.83l-80,80a4,4,0,0,1-5.66-5.66L170.34,128,93.17,50.83a4,4,0,0,1,5.66-5.66l80,80A4,4,0,0,1,178.83,130.83Z`},null,-1)]])):B(``,!0)],16))}})})),ll,Ice=s((()=>{Fce(),ll=cl})),ul,dl,fl,pl,ml,hl,gl,Lce=s((()=>{Hc(),W(),ul={key:0},dl={key:1},fl={key:2},pl={key:3},ml={key:4},hl={key:5},gl=N({name:`ScalarIconCaretUp`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,ul,[...r[0]||=[R(`path`,{d:`M216.49,168.49a12,12,0,0,1-17,0L128,97,56.49,168.49a12,12,0,0,1-17-17l80-80a12,12,0,0,1,17,0l80,80A12,12,0,0,1,216.49,168.49Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,dl,[...r[1]||=[R(`path`,{d:`M208,160H48l80-80Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M213.66,154.34l-80-80a8,8,0,0,0-11.32,0l-80,80A8,8,0,0,0,48,168H208a8,8,0,0,0,5.66-13.66ZM67.31,152,128,91.31,188.69,152Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,fl,[...r[2]||=[R(`path`,{d:`M215.39,163.06A8,8,0,0,1,208,168H48a8,8,0,0,1-5.66-13.66l80-80a8,8,0,0,1,11.32,0l80,80A8,8,0,0,1,215.39,163.06Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,pl,[...r[3]||=[R(`path`,{d:`M212.24,164.24a6,6,0,0,1-8.48,0L128,88.49,52.24,164.24a6,6,0,0,1-8.48-8.48l80-80a6,6,0,0,1,8.48,0l80,80A6,6,0,0,1,212.24,164.24Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,ml,[...r[4]||=[R(`path`,{d:`M213.66,165.66a8,8,0,0,1-11.32,0L128,91.31,53.66,165.66a8,8,0,0,1-11.32-11.32l80-80a8,8,0,0,1,11.32,0l80,80A8,8,0,0,1,213.66,165.66Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,hl,[...r[5]||=[R(`path`,{d:`M210.83,162.83a4,4,0,0,1-5.66,0L128,85.66,50.83,162.83a4,4,0,0,1-5.66-5.66l80-80a4,4,0,0,1,5.66,0l80,80A4,4,0,0,1,210.83,162.83Z`},null,-1)]])):B(``,!0)],16))}})})),_l,Rce=s((()=>{Lce(),_l=gl})),vl,yl,bl,xl,Sl,Cl,wl,zce=s((()=>{Hc(),W(),vl={key:0},yl={key:1},bl={key:2},xl={key:3},Sl={key:4},Cl={key:5},wl=N({name:`ScalarIconCheck`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,vl,[...r[0]||=[R(`path`,{d:`M232.49,80.49l-128,128a12,12,0,0,1-17,0l-56-56a12,12,0,1,1,17-17L96,183,215.51,63.51a12,12,0,0,1,17,17Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,yl,[...r[1]||=[R(`path`,{d:`M232,56V200a16,16,0,0,1-16,16H40a16,16,0,0,1-16-16V56A16,16,0,0,1,40,40H216A16,16,0,0,1,232,56Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M205.66,85.66l-96,96a8,8,0,0,1-11.32,0l-40-40a8,8,0,0,1,11.32-11.32L104,164.69l90.34-90.35a8,8,0,0,1,11.32,11.32Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,bl,[...r[2]||=[R(`path`,{d:`M216,40H40A16,16,0,0,0,24,56V200a16,16,0,0,0,16,16H216a16,16,0,0,0,16-16V56A16,16,0,0,0,216,40ZM205.66,85.66l-96,96a8,8,0,0,1-11.32,0l-40-40a8,8,0,0,1,11.32-11.32L104,164.69l90.34-90.35a8,8,0,0,1,11.32,11.32Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,xl,[...r[3]||=[R(`path`,{d:`M228.24,76.24l-128,128a6,6,0,0,1-8.48,0l-56-56a6,6,0,0,1,8.48-8.48L96,191.51,219.76,67.76a6,6,0,0,1,8.48,8.48Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Sl,[...r[4]||=[R(`path`,{d:`M229.66,77.66l-128,128a8,8,0,0,1-11.32,0l-56-56a8,8,0,0,1,11.32-11.32L96,188.69,218.34,66.34a8,8,0,0,1,11.32,11.32Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Cl,[...r[5]||=[R(`path`,{d:`M226.83,74.83l-128,128a4,4,0,0,1-5.66,0l-56-56a4,4,0,0,1,5.66-5.66L96,194.34,221.17,69.17a4,4,0,1,1,5.66,5.66Z`},null,-1)]])):B(``,!0)],16))}})})),Tl,Bce=s((()=>{zce(),Tl=wl})),El,Dl,Ol,kl,Al,jl,Ml,Vce=s((()=>{Hc(),W(),El={key:0},Dl={key:1},Ol={key:2},kl={key:3},Al={key:4},jl={key:5},Ml=N({name:`ScalarIconCloud`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,El,[...r[0]||=[R(`path`,{d:`M160,36A92.09,92.09,0,0,0,79,84.36,68,68,0,1,0,72,220h88a92,92,0,0,0,0-184Zm0,160H72a44,44,0,0,1-1.82-88A91.86,91.86,0,0,0,68,128a12,12,0,0,0,24,0,68,68,0,1,1,68,68Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Dl,[...r[1]||=[R(`path`,{d:`M240,128a80,80,0,0,1-80,80H72A56,56,0,1,1,85.92,97.74l0,.1A80,80,0,0,1,240,128Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M160,40A88.09,88.09,0,0,0,81.29,88.67,64,64,0,1,0,72,216h88a88,88,0,0,0,0-176Zm0,160H72a48,48,0,0,1,0-96c1.1,0,2.2,0,3.29.11A88,88,0,0,0,72,128a8,8,0,0,0,16,0,72,72,0,1,1,72,72Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Ol,[...r[2]||=[R(`path`,{d:`M160.06,40A88.1,88.1,0,0,0,81.29,88.67h0A87.48,87.48,0,0,0,72,127.73,8.18,8.18,0,0,1,64.57,136,8,8,0,0,1,56,128a103.66,103.66,0,0,1,5.34-32.92,4,4,0,0,0-4.75-5.18A64.09,64.09,0,0,0,8,152c0,35.19,29.75,64,65,64H160a88.09,88.09,0,0,0,87.93-91.48C246.11,77.54,207.07,40,160.06,40Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,kl,[...r[3]||=[R(`path`,{d:`M160,42A86.11,86.11,0,0,0,82.43,90.88,62,62,0,1,0,72,214h88a86,86,0,0,0,0-172Zm0,160H72a50,50,0,0,1,0-100,50.67,50.67,0,0,1,5.91.35A85.61,85.61,0,0,0,74,128a6,6,0,0,0,12,0,74,74,0,1,1,74,74Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Al,[...r[4]||=[R(`path`,{d:`M160,40A88.09,88.09,0,0,0,81.29,88.67,64,64,0,1,0,72,216h88a88,88,0,0,0,0-176Zm0,160H72a48,48,0,0,1,0-96c1.1,0,2.2,0,3.29.11A88,88,0,0,0,72,128a8,8,0,0,0,16,0,72,72,0,1,1,72,72Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,jl,[...r[5]||=[R(`path`,{d:`M160,44A84.11,84.11,0,0,0,83.59,93.12,60.71,60.71,0,0,0,72,92a60,60,0,0,0,0,120h88a84,84,0,0,0,0-168Zm0,160H72a52,52,0,1,1,8.55-103.3A83.66,83.66,0,0,0,76,128a4,4,0,0,0,8,0,76,76,0,1,1,76,76Z`},null,-1)]])):B(``,!0)],16))}})})),Nl,Hce=s((()=>{Vce(),Nl=Ml})),Pl,Fl,Il,Ll,Rl,zl,Bl,Uce=s((()=>{Hc(),W(),Pl={key:0},Fl={key:1},Il={key:2},Ll={key:3},Rl={key:4},zl={key:5},Bl=N({name:`ScalarIconCopy`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Pl,[...r[0]||=[R(`path`,{d:`M216,28H88A12,12,0,0,0,76,40V76H40A12,12,0,0,0,28,88V216a12,12,0,0,0,12,12H168a12,12,0,0,0,12-12V180h36a12,12,0,0,0,12-12V40A12,12,0,0,0,216,28ZM156,204H52V100H156Zm48-48H180V88a12,12,0,0,0-12-12H100V52H204Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Fl,[...r[1]||=[R(`path`,{d:`M216,40V168H168V88H88V40Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M216,32H88a8,8,0,0,0-8,8V80H40a8,8,0,0,0-8,8V216a8,8,0,0,0,8,8H168a8,8,0,0,0,8-8V176h40a8,8,0,0,0,8-8V40A8,8,0,0,0,216,32ZM160,208H48V96H160Zm48-48H176V88a8,8,0,0,0-8-8H96V48H208Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Il,[...r[2]||=[R(`path`,{d:`M216,32H88a8,8,0,0,0-8,8V80H40a8,8,0,0,0-8,8V216a8,8,0,0,0,8,8H168a8,8,0,0,0,8-8V176h40a8,8,0,0,0,8-8V40A8,8,0,0,0,216,32Zm-8,128H176V88a8,8,0,0,0-8-8H96V48H208Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Ll,[...r[3]||=[R(`path`,{d:`M216,34H88a6,6,0,0,0-6,6V82H40a6,6,0,0,0-6,6V216a6,6,0,0,0,6,6H168a6,6,0,0,0,6-6V174h42a6,6,0,0,0,6-6V40A6,6,0,0,0,216,34ZM162,210H46V94H162Zm48-48H174V88a6,6,0,0,0-6-6H94V46H210Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Rl,[...r[4]||=[R(`path`,{d:`M216,32H88a8,8,0,0,0-8,8V80H40a8,8,0,0,0-8,8V216a8,8,0,0,0,8,8H168a8,8,0,0,0,8-8V176h40a8,8,0,0,0,8-8V40A8,8,0,0,0,216,32ZM160,208H48V96H160Zm48-48H176V88a8,8,0,0,0-8-8H96V48H208Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,zl,[...r[5]||=[R(`path`,{d:`M216,36H88a4,4,0,0,0-4,4V84H40a4,4,0,0,0-4,4V216a4,4,0,0,0,4,4H168a4,4,0,0,0,4-4V172h44a4,4,0,0,0,4-4V40A4,4,0,0,0,216,36ZM164,212H44V92H164Zm48-48H172V88a4,4,0,0,0-4-4H92V44H212Z`},null,-1)]])):B(``,!0)],16))}})})),Vl,Wce=s((()=>{Uce(),Vl=Bl})),Hl,Ul,Wl,Gl,Kl,ql,Jl,Gce=s((()=>{Hc(),W(),Hl={key:0},Ul={key:1},Wl={key:2},Gl={key:3},Kl={key:4},ql={key:5},Jl=N({name:`ScalarIconDiscordLogo`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Hl,[...r[0]||=[R(`path`,{d:`M108,136a16,16,0,1,1-16-16A16,16,0,0,1,108,136Zm56-16a16,16,0,1,0,16,16A16,16,0,0,0,164,120Zm76.07,76.56-67,29.71A20.15,20.15,0,0,1,146,214.9l-8.54-23.13c-3.13.14-6.27.24-9.45.24s-6.32-.1-9.45-.24L110,214.9a20.19,20.19,0,0,1-27.08,11.37l-67-29.71A19.93,19.93,0,0,1,4.62,173.41L34.15,57A20,20,0,0,1,50.37,42.19l36.06-5.93A20.26,20.26,0,0,1,109.22,51.1l4.41,17.41c4.74-.33,9.52-.51,14.37-.51s9.63.18,14.37.51l4.41-17.41a20.25,20.25,0,0,1,22.79-14.84l36.06,5.93A20,20,0,0,1,221.85,57l29.53,116.38A19.93,19.93,0,0,1,240.07,196.56ZM227.28,176,199.23,65.46l-30.07-4.94-2.84,11.17c2.9.58,5.78,1.2,8.61,1.92a12,12,0,1,1-5.86,23.27A168.43,168.43,0,0,0,128,92a168.43,168.43,0,0,0-41.07,4.88,12,12,0,0,1-5.86-23.27c2.83-.72,5.71-1.34,8.61-1.92L86.85,60.52,56.77,65.46,28.72,176l60.22,26.7,5-13.57c-4.37-.76-8.67-1.65-12.88-2.71a12,12,0,0,1,5.86-23.28A168.43,168.43,0,0,0,128,168a168.43,168.43,0,0,0,41.07-4.88,12,12,0,0,1,5.86,23.28c-4.21,1.06-8.51,1.95-12.88,2.71l5,13.57Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Ul,[...r[1]||=[R(`path`,{d:`M235.21,185.59l-67,29.7a8.15,8.15,0,0,1-11-4.56L147,183.06a190.5,190.5,0,0,1-19,.94,190.5,190.5,0,0,1-19-.94L98.75,210.73a8.15,8.15,0,0,1-11,4.56l-67-29.7a8,8,0,0,1-4.55-9.24L45.77,60A8.08,8.08,0,0,1,52.31,54l36.06-5.92a8.1,8.1,0,0,1,9.21,6l5,19.63a192.32,192.32,0,0,1,50.88,0l5-19.63a8.1,8.1,0,0,1,9.21-6L203.69,54A8.08,8.08,0,0,1,210.23,60l29.53,116.37A8,8,0,0,1,235.21,185.59Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M104,140a12,12,0,1,1-12-12A12,12,0,0,1,104,140Zm60-12a12,12,0,1,0,12,12A12,12,0,0,0,164,128Zm74.45,64.9-67,29.71a16.17,16.17,0,0,1-21.71-9.1l-8.11-22q-6.72.45-13.63.46t-13.63-.46l-8.11,22a16.18,16.18,0,0,1-21.71,9.1l-67-29.71a15.94,15.94,0,0,1-9.06-18.51L38,58A16.08,16.08,0,0,1,51,46.13l36.06-5.92a16.21,16.21,0,0,1,18.26,11.88l3.26,12.83Q118.11,64,128,64t19.4.92l3.26-12.83a16.22,16.22,0,0,1,18.26-11.88L205,46.13A16.08,16.08,0,0,1,218,58l29.53,116.38A15.94,15.94,0,0,1,238.45,192.9ZM232,178.28,202.47,62s0,0-.08,0L166.33,56a.17.17,0,0,0-.17,0l-2.83,11.14c5,.94,10,2.06,14.83,3.42A8,8,0,0,1,176,86.31a8.09,8.09,0,0,1-2.16-.3A172.25,172.25,0,0,0,128,80a172.25,172.25,0,0,0-45.84,6,8,8,0,1,1-4.32-15.4c4.82-1.36,9.78-2.48,14.82-3.42L89.83,56a.21.21,0,0,0-.12,0h0L53.61,61.92a.24.24,0,0,0-.09,0L24,178.33,91,208a.21.21,0,0,0,.22,0L98,189.72a173.2,173.2,0,0,1-20.14-4.32A8,8,0,0,1,82.16,170,171.85,171.85,0,0,0,128,176a171.85,171.85,0,0,0,45.84-6,8,8,0,0,1,4.32,15.41A173.2,173.2,0,0,1,158,189.72L164.75,208a.22.22,0,0,0,.21,0Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Wl,[...r[2]||=[R(`path`,{d:`M247.51,174.39,218,58a16.08,16.08,0,0,0-13-11.88l-36.06-5.92a16.22,16.22,0,0,0-18.26,11.88l-.21.85a4,4,0,0,0,3.27,4.93,155.62,155.62,0,0,1,24.41,5.62,8.2,8.2,0,0,1,5.62,9.7,8,8,0,0,1-10.19,5.64,155.4,155.4,0,0,0-90.8-.1,8.22,8.22,0,0,1-10.28-4.81,8,8,0,0,1,5.08-10.33,156.85,156.85,0,0,1,24.72-5.72,4,4,0,0,0,3.27-4.93l-.21-.85A16.21,16.21,0,0,0,87.08,40.21L51,46.13A16.08,16.08,0,0,0,38,58L8.49,174.39a15.94,15.94,0,0,0,9.06,18.51l67,29.71a16.17,16.17,0,0,0,21.71-9.1l3.49-9.45a4,4,0,0,0-3.27-5.35,158.13,158.13,0,0,1-28.63-6.2,8.2,8.2,0,0,1-5.61-9.67,8,8,0,0,1,10.2-5.66,155.59,155.59,0,0,0,91.12,0,8,8,0,0,1,10.19,5.65,8.19,8.19,0,0,1-5.61,9.68,157.84,157.84,0,0,1-28.62,6.2,4,4,0,0,0-3.27,5.35l3.49,9.45a16.18,16.18,0,0,0,21.71,9.1l67-29.71A15.94,15.94,0,0,0,247.51,174.39ZM92,152a12,12,0,1,1,12-12A12,12,0,0,1,92,152Zm72,0a12,12,0,1,1,12-12A12,12,0,0,1,164,152Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Gl,[...r[3]||=[R(`path`,{d:`M102,140a10,10,0,1,1-10-10A10,10,0,0,1,102,140Zm62-10a10,10,0,1,0,10,10A10,10,0,0,0,164,130Zm73.64,61.08-67,29.71a14.43,14.43,0,0,1-5.77,1.21,14.13,14.13,0,0,1-13.25-9.18L143,189.43c-4.93.37-9.92.58-15,.58s-10.06-.21-15-.58l-8.63,23.39A14.13,14.13,0,0,1,91.13,222a14.43,14.43,0,0,1-5.77-1.21l-67-29.71a14,14,0,0,1-7.93-16.2L40,58.5A14.07,14.07,0,0,1,51.34,48.11L87.4,42.19a14.19,14.19,0,0,1,16,10.39l3.69,14.53a197.5,197.5,0,0,1,41.82,0l3.69-14.53a14.19,14.19,0,0,1,16-10.39l36.06,5.92A14.07,14.07,0,0,1,216,58.5l29.53,116.38A14,14,0,0,1,237.64,191.08Zm-3.7-13.25L204.41,61.45a2.08,2.08,0,0,0-1.7-1.5L166.65,54a2.13,2.13,0,0,0-2.42,1.5l-3.36,13.24a169.28,169.28,0,0,1,16.75,3.76A6,6,0,0,1,176,84.31a5.71,5.71,0,0,1-1.62-.23A174.26,174.26,0,0,0,128,78a174.26,174.26,0,0,0-46.38,6.08,6,6,0,1,1-3.24-11.55,169.28,169.28,0,0,1,16.75-3.76L91.77,55.53A2.12,2.12,0,0,0,89.35,54L53.29,60a2.08,2.08,0,0,0-1.7,1.5L22.06,177.83a2,2,0,0,0,1.16,2.28l67,29.7a2.19,2.19,0,0,0,1.76,0,2.07,2.07,0,0,0,1.14-1.17l7.58-20.55a171.46,171.46,0,0,1-22.33-4.64,6,6,0,1,1,3.24-11.55A174.26,174.26,0,0,0,128,178a174.26,174.26,0,0,0,46.38-6.08,6,6,0,1,1,3.24,11.55,171.46,171.46,0,0,1-22.33,4.64l7.58,20.55a2.07,2.07,0,0,0,1.14,1.17,2.19,2.19,0,0,0,1.76,0l67-29.7A2,2,0,0,0,233.94,177.83Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Kl,[...r[4]||=[R(`path`,{d:`M104,140a12,12,0,1,1-12-12A12,12,0,0,1,104,140Zm60-12a12,12,0,1,0,12,12A12,12,0,0,0,164,128Zm74.45,64.9-67,29.71a16.17,16.17,0,0,1-21.71-9.1l-8.11-22q-6.72.45-13.63.46t-13.63-.46l-8.11,22a16.18,16.18,0,0,1-21.71,9.1l-67-29.71a15.93,15.93,0,0,1-9.06-18.51L38,58A16.07,16.07,0,0,1,51,46.14l36.06-5.93a16.22,16.22,0,0,1,18.26,11.88l3.26,12.84Q118.11,64,128,64t19.4.93l3.26-12.84a16.21,16.21,0,0,1,18.26-11.88L205,46.14A16.07,16.07,0,0,1,218,58l29.53,116.38A15.93,15.93,0,0,1,238.45,192.9ZM232,178.28,202.47,62s0,0-.08,0L166.33,56a.17.17,0,0,0-.17,0l-2.83,11.14c5,.94,10,2.06,14.83,3.42A8,8,0,0,1,176,86.31a8.09,8.09,0,0,1-2.16-.3A172.25,172.25,0,0,0,128,80a172.25,172.25,0,0,0-45.84,6,8,8,0,1,1-4.32-15.4c4.82-1.36,9.78-2.48,14.82-3.42L89.83,56s0,0-.12,0h0L53.61,61.93a.17.17,0,0,0-.09,0L24,178.33,91,208a.23.23,0,0,0,.22,0L98,189.72a173.2,173.2,0,0,1-20.14-4.32A8,8,0,0,1,82.16,170,171.85,171.85,0,0,0,128,176a171.85,171.85,0,0,0,45.84-6,8,8,0,0,1,4.32,15.41A173.2,173.2,0,0,1,158,189.72L164.75,208a.22.22,0,0,0,.21,0Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,ql,[...r[5]||=[R(`path`,{d:`M100,140a8,8,0,1,1-8-8A8,8,0,0,1,100,140Zm64-8a8,8,0,1,0,8,8A8,8,0,0,0,164,132Zm72.83,57.25-67,29.71a12.36,12.36,0,0,1-5,1,12.13,12.13,0,0,1-11.38-7.88l-9.15-24.81c-5.36.45-10.81.69-16.34.69s-11-.24-16.34-.69l-9.15,24.81A12.13,12.13,0,0,1,91.13,220a12.36,12.36,0,0,1-5-1l-67-29.71a12,12,0,0,1-6.8-13.88L41.9,59a12.06,12.06,0,0,1,9.77-8.91l36.06-5.92a12.18,12.18,0,0,1,13.73,8.91l4.12,16.22a195.47,195.47,0,0,1,44.84,0l4.12-16.22a12.18,12.18,0,0,1,13.73-8.91l36.06,5.92A12.06,12.06,0,0,1,214.1,59l29.53,116.38A12,12,0,0,1,236.83,189.25Zm-1-11.91L206.35,61A4.07,4.07,0,0,0,203,58L167,52.05a4.15,4.15,0,0,0-4.69,3L158.4,70.38a166.74,166.74,0,0,1,18.68,4.08,4,4,0,1,1-2.16,7.7A176.21,176.21,0,0,0,128,76a176.21,176.21,0,0,0-46.92,6.16,4,4,0,1,1-2.16-7.7A166.74,166.74,0,0,1,97.6,70.38L93.71,55a4.15,4.15,0,0,0-4.69-3L53,58a4.07,4.07,0,0,0-3.31,3L20.12,177.34a4,4,0,0,0,2.29,4.59l67,29.71a4.16,4.16,0,0,0,3.35,0A4,4,0,0,0,95,209.35l8.45-22.88a171.49,171.49,0,0,1-24.53-4.92,4,4,0,0,1,2.16-7.71A176.21,176.21,0,0,0,128,180a176.21,176.21,0,0,0,46.92-6.16,4,4,0,0,1,2.16,7.71,171.49,171.49,0,0,1-24.53,4.92L161,209.35a4,4,0,0,0,2.23,2.32,4.16,4.16,0,0,0,3.35,0l67-29.71A4,4,0,0,0,235.88,177.34Z`},null,-1)]])):B(``,!0)],16))}})})),Yl,Kce=s((()=>{Gce(),Yl=Jl})),Xl,Zl,Ql,$l,eu,tu,nu,qce=s((()=>{Hc(),W(),Xl={key:0},Zl={key:1},Ql={key:2},$l={key:3},eu={key:4},tu={key:5},nu=N({name:`ScalarIconEnvelopeSimple`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Xl,[...r[0]||=[R(`path`,{d:`M224,44H32A12,12,0,0,0,20,56V192a20,20,0,0,0,20,20H216a20,20,0,0,0,20-20V56A12,12,0,0,0,224,44ZM193.15,68,128,127.72,62.85,68ZM44,188V83.28l75.89,69.57a12,12,0,0,0,16.22,0L212,83.28V188Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Zl,[...r[1]||=[R(`path`,{d:`M224,56l-96,88L32,56Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M224,48H32a8,8,0,0,0-8,8V192a16,16,0,0,0,16,16H216a16,16,0,0,0,16-16V56A8,8,0,0,0,224,48ZM203.43,64,128,133.15,52.57,64ZM216,192H40V74.19l82.59,75.71a8,8,0,0,0,10.82,0L216,74.19V192Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Ql,[...r[2]||=[R(`path`,{d:`M224,48H32a8,8,0,0,0-8,8V192a16,16,0,0,0,16,16H216a16,16,0,0,0,16-16V56A8,8,0,0,0,224,48Zm-8,144H40V74.19l82.59,75.71a8,8,0,0,0,10.82,0L216,74.19V192Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,$l,[...r[3]||=[R(`path`,{d:`M224,50H32a6,6,0,0,0-6,6V192a14,14,0,0,0,14,14H216a14,14,0,0,0,14-14V56A6,6,0,0,0,224,50ZM208.58,62,128,135.86,47.42,62ZM216,194H40a2,2,0,0,1-2-2V69.64l86,78.78a6,6,0,0,0,8.1,0L218,69.64V192A2,2,0,0,1,216,194Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,eu,[...r[4]||=[R(`path`,{d:`M224,48H32a8,8,0,0,0-8,8V192a16,16,0,0,0,16,16H216a16,16,0,0,0,16-16V56A8,8,0,0,0,224,48ZM203.43,64,128,133.15,52.57,64ZM216,192H40V74.19l82.59,75.71a8,8,0,0,0,10.82,0L216,74.19V192Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,tu,[...r[5]||=[R(`path`,{d:`M224,52H32a4,4,0,0,0-4,4V192a12,12,0,0,0,12,12H216a12,12,0,0,0,12-12V56A4,4,0,0,0,224,52Zm-10.28,8L128,138.57,42.28,60ZM216,196H40a4,4,0,0,1-4-4V65.09L125.3,147a4,4,0,0,0,5.4,0L220,65.09V192A4,4,0,0,1,216,196Z`},null,-1)]])):B(``,!0)],16))}})})),ru,Jce=s((()=>{qce(),ru=nu})),iu,au,ou,su,cu,lu,uu,Yce=s((()=>{Hc(),W(),iu={key:0},au={key:1},ou={key:2},su={key:3},cu={key:4},lu={key:5},uu=N({name:`ScalarIconEye`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,iu,[...r[0]||=[R(`path`,{d:`M251,123.13c-.37-.81-9.13-20.26-28.48-39.61C196.63,57.67,164,44,128,44S59.37,57.67,33.51,83.52C14.16,102.87,5.4,122.32,5,123.13a12.08,12.08,0,0,0,0,9.75c.37.82,9.13,20.26,28.49,39.61C59.37,198.34,92,212,128,212s68.63-13.66,94.48-39.51c19.36-19.35,28.12-38.79,28.49-39.61A12.08,12.08,0,0,0,251,123.13Zm-46.06,33C183.47,177.27,157.59,188,128,188s-55.47-10.73-76.91-31.88A130.36,130.36,0,0,1,29.52,128,130.45,130.45,0,0,1,51.09,99.89C72.54,78.73,98.41,68,128,68s55.46,10.73,76.91,31.89A130.36,130.36,0,0,1,226.48,128,130.45,130.45,0,0,1,204.91,156.12ZM128,84a44,44,0,1,0,44,44A44.05,44.05,0,0,0,128,84Zm0,64a20,20,0,1,1,20-20A20,20,0,0,1,128,148Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,au,[...r[1]||=[R(`path`,{d:`M128,56C48,56,16,128,16,128s32,72,112,72,112-72,112-72S208,56,128,56Zm0,112a40,40,0,1,1,40-40A40,40,0,0,1,128,168Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M247.31,124.76c-.35-.79-8.82-19.58-27.65-38.41C194.57,61.26,162.88,48,128,48S61.43,61.26,36.34,86.35C17.51,105.18,9,124,8.69,124.76a8,8,0,0,0,0,6.5c.35.79,8.82,19.57,27.65,38.4C61.43,194.74,93.12,208,128,208s66.57-13.26,91.66-38.34c18.83-18.83,27.3-37.61,27.65-38.4A8,8,0,0,0,247.31,124.76ZM128,192c-30.78,0-57.67-11.19-79.93-33.25A133.47,133.47,0,0,1,25,128,133.33,133.33,0,0,1,48.07,97.25C70.33,75.19,97.22,64,128,64s57.67,11.19,79.93,33.25A133.46,133.46,0,0,1,231.05,128C223.84,141.46,192.43,192,128,192Zm0-112a48,48,0,1,0,48,48A48.05,48.05,0,0,0,128,80Zm0,80a32,32,0,1,1,32-32A32,32,0,0,1,128,160Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,ou,[...r[2]||=[R(`path`,{d:`M247.31,124.76c-.35-.79-8.82-19.58-27.65-38.41C194.57,61.26,162.88,48,128,48S61.43,61.26,36.34,86.35C17.51,105.18,9,124,8.69,124.76a8,8,0,0,0,0,6.5c.35.79,8.82,19.57,27.65,38.4C61.43,194.74,93.12,208,128,208s66.57-13.26,91.66-38.34c18.83-18.83,27.3-37.61,27.65-38.4A8,8,0,0,0,247.31,124.76ZM128,168a40,40,0,1,1,40-40A40,40,0,0,1,128,168Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,su,[...r[3]||=[R(`path`,{d:`M245.48,125.57c-.34-.78-8.66-19.23-27.24-37.81C201,70.54,171.38,50,128,50S55,70.54,37.76,87.76c-18.58,18.58-26.9,37-27.24,37.81a6,6,0,0,0,0,4.88c.34.77,8.66,19.22,27.24,37.8C55,185.47,84.62,206,128,206s73-20.53,90.24-37.75c18.58-18.58,26.9-37,27.24-37.8A6,6,0,0,0,245.48,125.57ZM128,194c-31.38,0-58.78-11.42-81.45-33.93A134.77,134.77,0,0,1,22.69,128,134.56,134.56,0,0,1,46.55,95.94C69.22,73.42,96.62,62,128,62s58.78,11.42,81.45,33.94A134.56,134.56,0,0,1,233.31,128C226.94,140.21,195,194,128,194Zm0-112a46,46,0,1,0,46,46A46.06,46.06,0,0,0,128,82Zm0,80a34,34,0,1,1,34-34A34,34,0,0,1,128,162Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,cu,[...r[4]||=[R(`path`,{d:`M247.31,124.76c-.35-.79-8.82-19.58-27.65-38.41C194.57,61.26,162.88,48,128,48S61.43,61.26,36.34,86.35C17.51,105.18,9,124,8.69,124.76a8,8,0,0,0,0,6.5c.35.79,8.82,19.57,27.65,38.4C61.43,194.74,93.12,208,128,208s66.57-13.26,91.66-38.34c18.83-18.83,27.3-37.61,27.65-38.4A8,8,0,0,0,247.31,124.76ZM128,192c-30.78,0-57.67-11.19-79.93-33.25A133.47,133.47,0,0,1,25,128,133.33,133.33,0,0,1,48.07,97.25C70.33,75.19,97.22,64,128,64s57.67,11.19,79.93,33.25A133.46,133.46,0,0,1,231.05,128C223.84,141.46,192.43,192,128,192Zm0-112a48,48,0,1,0,48,48A48.05,48.05,0,0,0,128,80Zm0,80a32,32,0,1,1,32-32A32,32,0,0,1,128,160Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,lu,[...r[5]||=[R(`path`,{d:`M243.66,126.38c-.34-.76-8.52-18.89-26.83-37.2C199.87,72.22,170.7,52,128,52S56.13,72.22,39.17,89.18c-18.31,18.31-26.49,36.44-26.83,37.2a4.08,4.08,0,0,0,0,3.25c.34.77,8.52,18.89,26.83,37.2,17,17,46.14,37.17,88.83,37.17s71.87-20.21,88.83-37.17c18.31-18.31,26.49-36.43,26.83-37.2A4.08,4.08,0,0,0,243.66,126.38Zm-32.7,35c-23.07,23-51,34.62-83,34.62s-59.89-11.65-83-34.62A135.71,135.71,0,0,1,20.44,128,135.69,135.69,0,0,1,45,94.62C68.11,71.65,96,60,128,60s59.89,11.65,83,34.62A135.79,135.79,0,0,1,235.56,128,135.71,135.71,0,0,1,211,161.38ZM128,84a44,44,0,1,0,44,44A44.05,44.05,0,0,0,128,84Zm0,80a36,36,0,1,1,36-36A36,36,0,0,1,128,164Z`},null,-1)]])):B(``,!0)],16))}})})),du,Xce=s((()=>{Yce(),du=uu})),fu,pu,mu,Zce,Qce,$ce,ele,tle=s((()=>{Hc(),W(),fu={key:0},pu={key:1},mu={key:2},Zce={key:3},Qce={key:4},$ce={key:5},ele=N({name:`ScalarIconEyeSlash`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,fu,[...r[0]||=[R(`path`,{d:`M56.88,31.93A12,12,0,1,0,39.12,48.07l16,17.65C20.67,88.66,5.72,121.58,5,123.13a12.08,12.08,0,0,0,0,9.75c.37.82,9.13,20.26,28.49,39.61C59.37,198.34,92,212,128,212a131.34,131.34,0,0,0,51-10l20.09,22.1a12,12,0,0,0,17.76-16.14ZM128,188c-29.59,0-55.47-10.73-76.91-31.88A130.69,130.69,0,0,1,29.52,128c5.27-9.31,18.79-29.9,42-44.29l90.09,99.11A109.33,109.33,0,0,1,128,188Zm123-55.12c-.36.81-9,20-28,39.16a12,12,0,1,1-17-16.9A130.48,130.48,0,0,0,226.48,128a130.36,130.36,0,0,0-21.57-28.12C183.46,78.73,157.59,68,128,68c-3.35,0-6.7.14-10,.42a12,12,0,1,1-2-23.91c3.93-.34,8-.51,12-.51,36,0,68.63,13.67,94.49,39.52,19.35,19.35,28.11,38.8,28.48,39.61A12.08,12.08,0,0,1,251,132.88Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,pu,[...r[1]||=[R(`path`,{d:`M128,56C48,56,16,128,16,128s32,72,112,72,112-72,112-72S208,56,128,56Zm0,112a40,40,0,1,1,40-40A40,40,0,0,1,128,168Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M53.92,34.62A8,8,0,1,0,42.08,45.38L61.32,66.55C25,88.84,9.38,123.2,8.69,124.76a8,8,0,0,0,0,6.5c.35.79,8.82,19.57,27.65,38.4C61.43,194.74,93.12,208,128,208a127.11,127.11,0,0,0,52.07-10.83l22,24.21a8,8,0,1,0,11.84-10.76Zm47.33,75.84,41.67,45.85a32,32,0,0,1-41.67-45.85ZM128,192c-30.78,0-57.67-11.19-79.93-33.25A133.16,133.16,0,0,1,25,128c4.69-8.79,19.66-33.39,47.35-49.38l18,19.75a48,48,0,0,0,63.66,70l14.73,16.2A112,112,0,0,1,128,192Zm6-95.43a8,8,0,0,1,3-15.72,48.16,48.16,0,0,1,38.77,42.64,8,8,0,0,1-7.22,8.71,6.39,6.39,0,0,1-.75,0,8,8,0,0,1-8-7.26A32.09,32.09,0,0,0,134,96.57Zm113.28,34.69c-.42.94-10.55,23.37-33.36,43.8a8,8,0,1,1-10.67-11.92A132.77,132.77,0,0,0,231.05,128a133.15,133.15,0,0,0-23.12-30.77C185.67,75.19,158.78,64,128,64a118.37,118.37,0,0,0-19.36,1.57A8,8,0,1,1,106,49.79,134,134,0,0,1,128,48c34.88,0,66.57,13.26,91.66,38.35,18.83,18.83,27.3,37.62,27.65,38.41A8,8,0,0,1,247.31,131.26Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,mu,[...r[2]||=[R(`path`,{d:`M96.68,57.87a4,4,0,0,1,2.08-6.6A130.13,130.13,0,0,1,128,48c34.88,0,66.57,13.26,91.66,38.35,18.83,18.83,27.3,37.62,27.65,38.41a8,8,0,0,1,0,6.5c-.35.79-8.82,19.57-27.65,38.4q-4.28,4.26-8.79,8.07a4,4,0,0,1-5.55-.36ZM213.92,210.62a8,8,0,1,1-11.84,10.76L180,197.13A127.21,127.21,0,0,1,128,208c-34.88,0-66.57-13.26-91.66-38.34C17.51,150.83,9,132.05,8.69,131.26a8,8,0,0,1,0-6.5C9,124,17.51,105.18,36.34,86.35a135,135,0,0,1,25-19.78L42.08,45.38A8,8,0,1,1,53.92,34.62Zm-65.49-48.25-52.69-58a40,40,0,0,0,52.69,58Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Zce,[...r[3]||=[R(`path`,{d:`M52.44,36A6,6,0,0,0,43.56,44L64.44,67c-37.28,21.9-53.23,57-53.92,58.57a6,6,0,0,0,0,4.88c.34.77,8.66,19.22,27.24,37.8C55,185.47,84.62,206,128,206a124.91,124.91,0,0,0,52.57-11.25l23,25.29a6,6,0,0,0,8.88-8.08Zm48.62,71.32,45,49.52a34,34,0,0,1-45-49.52ZM128,194c-31.38,0-58.78-11.42-81.45-33.93A134.57,134.57,0,0,1,22.69,128c4.29-8.2,20.1-35.18,50-51.91L92.89,98.3a46,46,0,0,0,61.35,67.48l17.81,19.6A113.47,113.47,0,0,1,128,194Zm6.4-99.4a6,6,0,0,1,2.25-11.79,46.17,46.17,0,0,1,37.15,40.87,6,6,0,0,1-5.42,6.53l-.56,0a6,6,0,0,1-6-5.45A34.1,34.1,0,0,0,134.4,94.6Zm111.08,35.85c-.41.92-10.37,23-32.86,43.12a6,6,0,1,1-8-8.94A134.07,134.07,0,0,0,233.31,128a134.67,134.67,0,0,0-23.86-32.07C186.78,73.42,159.38,62,128,62a120.19,120.19,0,0,0-19.69,1.6,6,6,0,1,1-2-11.83A131.12,131.12,0,0,1,128,50c43.38,0,73,20.54,90.24,37.76,18.58,18.58,26.9,37,27.24,37.81A6,6,0,0,1,245.48,130.45Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Qce,[...r[4]||=[R(`path`,{d:`M53.92,34.62A8,8,0,1,0,42.08,45.38L61.32,66.55C25,88.84,9.38,123.2,8.69,124.76a8,8,0,0,0,0,6.5c.35.79,8.82,19.57,27.65,38.4C61.43,194.74,93.12,208,128,208a127.11,127.11,0,0,0,52.07-10.83l22,24.21a8,8,0,1,0,11.84-10.76Zm47.33,75.84,41.67,45.85a32,32,0,0,1-41.67-45.85ZM128,192c-30.78,0-57.67-11.19-79.93-33.25A133.16,133.16,0,0,1,25,128c4.69-8.79,19.66-33.39,47.35-49.38l18,19.75a48,48,0,0,0,63.66,70l14.73,16.2A112,112,0,0,1,128,192Zm6-95.43a8,8,0,0,1,3-15.72,48.16,48.16,0,0,1,38.77,42.64,8,8,0,0,1-7.22,8.71,6.39,6.39,0,0,1-.75,0,8,8,0,0,1-8-7.26A32.09,32.09,0,0,0,134,96.57Zm113.28,34.69c-.42.94-10.55,23.37-33.36,43.8a8,8,0,1,1-10.67-11.92A132.77,132.77,0,0,0,231.05,128a133.15,133.15,0,0,0-23.12-30.77C185.67,75.19,158.78,64,128,64a118.37,118.37,0,0,0-19.36,1.57A8,8,0,1,1,106,49.79,134,134,0,0,1,128,48c34.88,0,66.57,13.26,91.66,38.35,18.83,18.83,27.3,37.62,27.65,38.41A8,8,0,0,1,247.31,131.26Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,$ce,[...r[5]||=[R(`path`,{d:`M51,37.31A4,4,0,0,0,45,42.69L67.59,67.5C29.34,89,13,124.81,12.34,126.38a4.08,4.08,0,0,0,0,3.25c.34.77,8.52,18.89,26.83,37.2,17,17,46.14,37.17,88.83,37.17a122.59,122.59,0,0,0,53.06-11.69l24,26.38a4,4,0,1,0,5.92-5.38ZM149.1,157.16A36,36,0,0,1,101,104.22ZM128,196c-32,0-59.89-11.65-83-34.62A135.81,135.81,0,0,1,20.44,128c3.65-7.23,20.09-36.81,52.68-54.43l22.45,24.7a44,44,0,0,0,59,64.83l20.89,23A114.94,114.94,0,0,1,128,196Zm6.78-103.36a4,4,0,0,1,1.49-7.86,44.15,44.15,0,0,1,35.54,39.09,4,4,0,0,1-3.61,4.35l-.38,0a4,4,0,0,1-4-3.63A36.1,36.1,0,0,0,134.78,92.64Zm108.88,37c-.41.91-10.2,22.58-32.38,42.45a4,4,0,0,1-2.67,1,4,4,0,0,1-2.67-7A136.71,136.71,0,0,0,235.56,128,136.07,136.07,0,0,0,211,94.62C187.89,71.65,160,60,128,60a122,122,0,0,0-20,1.63,4,4,0,0,1-1.32-7.89A129.3,129.3,0,0,1,128,52c42.7,0,71.87,20.22,88.83,37.18,18.31,18.31,26.49,36.44,26.83,37.2A4.08,4.08,0,0,1,243.66,129.63Z`},null,-1)]])):B(``,!0)],16))}})})),nle,rle=s((()=>{tle(),nle=ele})),ile,ale,ole,sle,cle,lle,ule,dle=s((()=>{Hc(),W(),ile={key:0},ale={key:1},ole={key:2},sle={key:3},cle={key:4},lle={key:5},ule=N({name:`ScalarIconFileDashed`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,ile,[...r[0]||=[R(`path`,{d:`M84,224a12,12,0,0,1-12,12H56a20,20,0,0,1-20-20V184a12,12,0,0,1,24,0v28H72A12,12,0,0,1,84,224ZM220,88v48a12,12,0,0,1-24,0V104H148a12,12,0,0,1-12-12V44H120a12,12,0,0,1,0-24h32a12,12,0,0,1,8.49,3.51l56,56A12,12,0,0,1,220,88Zm-60-8h23L160,57ZM80,20H56A20,20,0,0,0,36,40V64a12,12,0,0,0,24,0V44H80a12,12,0,0,0,0-24ZM208,164a12,12,0,0,0-12,12v36h-4a12,12,0,0,0,0,24h8a20,20,0,0,0,20-20V176A12,12,0,0,0,208,164ZM48,156a12,12,0,0,0,12-12V104a12,12,0,0,0-24,0v40A12,12,0,0,0,48,156Zm104,56H112a12,12,0,0,0,0,24h40a12,12,0,0,0,0-24Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,ale,[...r[1]||=[R(`path`,{d:`M208,88H152V32Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M80,224a8,8,0,0,1-8,8H56a16,16,0,0,1-16-16V184a8,8,0,0,1,16,0v32H72A8,8,0,0,1,80,224ZM216,88v48a8,8,0,0,1-16,0V96H152a8,8,0,0,1-8-8V40H120a8,8,0,0,1,0-16h32a8,8,0,0,1,5.66,2.34l56,56A8,8,0,0,1,216,88Zm-56-8h28.69L160,51.31ZM80,24H56A16,16,0,0,0,40,40V64a8,8,0,0,0,16,0V40H80a8,8,0,0,0,0-16ZM208,168a8,8,0,0,0-8,8v40h-8a8,8,0,0,0,0,16h8a16,16,0,0,0,16-16V176A8,8,0,0,0,208,168ZM48,152a8,8,0,0,0,8-8V104a8,8,0,0,0-16,0v40A8,8,0,0,0,48,152Zm104,64H112a8,8,0,0,0,0,16h40a8,8,0,0,0,0-16Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,ole,[...r[2]||=[R(`path`,{d:`M80,224a8,8,0,0,1-8,8H56a16,16,0,0,1-16-16V184a8,8,0,0,1,16,0v32H72A8,8,0,0,1,80,224ZM213.66,82.34l-56-56A8,8,0,0,0,152,24H120a8,8,0,0,0,0,16h24V88a8,8,0,0,0,8,8h48v40a8,8,0,0,0,16,0V88A8,8,0,0,0,213.66,82.34ZM80,24H56A16,16,0,0,0,40,40V64a8,8,0,0,0,16,0V40H80a8,8,0,0,0,0-16ZM208,168a8,8,0,0,0-8,8v40h-8a8,8,0,0,0,0,16h8a16,16,0,0,0,16-16V176A8,8,0,0,0,208,168ZM48,152a8,8,0,0,0,8-8V104a8,8,0,0,0-16,0v40A8,8,0,0,0,48,152Zm104,64H112a8,8,0,0,0,0,16h40a8,8,0,0,0,0-16Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,sle,[...r[3]||=[R(`path`,{d:`M78,224a6,6,0,0,1-6,6H56a14,14,0,0,1-14-14V184a6,6,0,0,1,12,0v32a2,2,0,0,0,2,2H72A6,6,0,0,1,78,224ZM214,88v48a6,6,0,0,1-12,0V94H152a6,6,0,0,1-6-6V38H120a6,6,0,0,1,0-12h32a6,6,0,0,1,4.24,1.76l56,56A6,6,0,0,1,214,88Zm-56-6h35.51L158,46.49ZM80,26H56A14,14,0,0,0,42,40V64a6,6,0,0,0,12,0V40a2,2,0,0,1,2-2H80a6,6,0,0,0,0-12ZM208,170a6,6,0,0,0-6,6v40a2,2,0,0,1-2,2h-8a6,6,0,0,0,0,12h8a14,14,0,0,0,14-14V176A6,6,0,0,0,208,170ZM48,150a6,6,0,0,0,6-6V104a6,6,0,0,0-12,0v40A6,6,0,0,0,48,150Zm104,68H112a6,6,0,0,0,0,12h40a6,6,0,0,0,0-12Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,cle,[...r[4]||=[R(`path`,{d:`M80,224a8,8,0,0,1-8,8H56a16,16,0,0,1-16-16V184a8,8,0,0,1,16,0v32H72A8,8,0,0,1,80,224ZM216,88v48a8,8,0,0,1-16,0V96H152a8,8,0,0,1-8-8V40H120a8,8,0,0,1,0-16h32a8,8,0,0,1,5.66,2.34l56,56A8,8,0,0,1,216,88Zm-56-8h28.69L160,51.31ZM80,24H56A16,16,0,0,0,40,40V64a8,8,0,0,0,16,0V40H80a8,8,0,0,0,0-16ZM208,168a8,8,0,0,0-8,8v40h-8a8,8,0,0,0,0,16h8a16,16,0,0,0,16-16V176A8,8,0,0,0,208,168ZM48,152a8,8,0,0,0,8-8V104a8,8,0,0,0-16,0v40A8,8,0,0,0,48,152Zm104,64H112a8,8,0,0,0,0,16h40a8,8,0,0,0,0-16Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,lle,[...r[5]||=[R(`path`,{d:`M76,224a4,4,0,0,1-4,4H56a12,12,0,0,1-12-12V184a4,4,0,0,1,8,0v32a4,4,0,0,0,4,4H72A4,4,0,0,1,76,224ZM212,88v48a4,4,0,0,1-8,0V92H152a4,4,0,0,1-4-4V36H120a4,4,0,0,1,0-8h32a4,4,0,0,1,2.83,1.17l56,56A4,4,0,0,1,212,88Zm-56-4h42.34L156,41.66ZM80,28H56A12,12,0,0,0,44,40V64a4,4,0,0,0,8,0V40a4,4,0,0,1,4-4H80a4,4,0,0,0,0-8ZM208,172a4,4,0,0,0-4,4v40a4,4,0,0,1-4,4h-8a4,4,0,0,0,0,8h8a12,12,0,0,0,12-12V176A4,4,0,0,0,208,172ZM48,148a4,4,0,0,0,4-4V104a4,4,0,0,0-8,0v40A4,4,0,0,0,48,148Zm104,72H112a4,4,0,0,0,0,8h40a4,4,0,0,0,0-8Z`},null,-1)]])):B(``,!0)],16))}})})),fle,ple=s((()=>{dle(),fle=ule})),mle,hle,gle,_le,vle,yle,ble,xle=s((()=>{Hc(),W(),mle={key:0},hle={key:1},gle={key:2},_le={key:3},vle={key:4},yle={key:5},ble=N({name:`ScalarIconFileMd`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,mle,[...r[0]||=[R(`path`,{d:`M100,152v56a12,12,0,0,1-24,0V190.07l-6.17,8.81a12,12,0,0,1-19.66,0L44,190.07V208a12,12,0,0,1-24,0V152a12,12,0,0,1,21.83-6.88L60,171.07l18.17-25.95A12,12,0,0,1,100,152Zm84,28a40,40,0,0,1-40,40H128a12,12,0,0,1-12-12V152a12,12,0,0,1,12-12h16A40,40,0,0,1,184,180Zm-24,0a16,16,0,0,0-16-16h-4v32h4A16,16,0,0,0,160,180Zm60-92V224a12,12,0,0,1-24,0V104H148a12,12,0,0,1-12-12V44H60v64a12,12,0,0,1-24,0V40A20,20,0,0,1,56,20h96a12,12,0,0,1,8.49,3.52l56,56A12,12,0,0,1,220,88Zm-60-8h23L160,57Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,hle,[...r[1]||=[R(`path`,{d:`M208,88H152V32Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M213.66,82.34l-56-56A8,8,0,0,0,152,24H56A16,16,0,0,0,40,40v72a8,8,0,0,0,16,0V40h88V88a8,8,0,0,0,8,8h48V224a8,8,0,0,0,16,0V88A8,8,0,0,0,213.66,82.34ZM160,51.31,188.69,80H160ZM144,144H128a8,8,0,0,0-8,8v56a8,8,0,0,0,8,8h16a36,36,0,0,0,0-72Zm0,56h-8V160h8a20,20,0,0,1,0,40Zm-40-48v56a8,8,0,0,1-16,0V177.38L74.55,196.59a8,8,0,0,1-13.1,0L48,177.38V208a8,8,0,0,1-16,0V152a8,8,0,0,1,14.55-4.59L68,178.05l21.45-30.64A8,8,0,0,1,104,152Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,gle,[...r[2]||=[R(`path`,{d:`M213.66,82.34l-56-56A8,8,0,0,0,152,24H56A16,16,0,0,0,40,40v76a4,4,0,0,0,4,4H196a4,4,0,0,1,4,4V224a8,8,0,0,0,9.19,7.91,8.15,8.15,0,0,0,6.81-8.16V88A8,8,0,0,0,213.66,82.34ZM152,88V44l44,44Zm-8,56H128a8,8,0,0,0-8,8v56a8,8,0,0,0,8,8h15.32c19.66,0,36.21-15.48,36.67-35.13A36,36,0,0,0,144,144Zm-.49,56H136V160h8a20,20,0,0,1,20,20.77C163.58,191.59,154.34,200,143.51,200ZM104,152v55.73A8.17,8.17,0,0,1,96.53,216,8,8,0,0,1,88,208V177.38l-13.32,19a8.3,8.3,0,0,1-4.2,3.2,8,8,0,0,1-9-3L48,177.38v30.35A8.17,8.17,0,0,1,40.53,216,8,8,0,0,1,32,208V152.31a8.27,8.27,0,0,1,4.56-7.53,8,8,0,0,1,10,2.63L68,178.05l21.27-30.39a8.28,8.28,0,0,1,8.06-3.55A8,8,0,0,1,104,152Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,_le,[...r[3]||=[R(`path`,{d:`M212.24,83.76l-56-56A6,6,0,0,0,152,26H56A14,14,0,0,0,42,40v72a6,6,0,0,0,12,0V40a2,2,0,0,1,2-2h90V88a6,6,0,0,0,6,6h50V224a6,6,0,0,0,12,0V88A6,6,0,0,0,212.24,83.76ZM158,46.48,193.52,82H158ZM144,146H128a6,6,0,0,0-6,6v56a6,6,0,0,0,6,6h16a34,34,0,0,0,0-68Zm0,56H134V158h10a22,22,0,0,1,0,44Zm-42-50v56a6,6,0,0,1-12,0V171L72.92,195.44a6,6,0,0,1-9.84,0L46,171v37a6,6,0,0,1-12,0V152a6,6,0,0,1,10.92-3.44l23.08,33,23.08-33A6,6,0,0,1,102,152Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,vle,[...r[4]||=[R(`path`,{d:`M213.66,82.34l-56-56A8,8,0,0,0,152,24H56A16,16,0,0,0,40,40v72a8,8,0,0,0,16,0V40h88V88a8,8,0,0,0,8,8h48V224a8,8,0,0,0,16,0V88A8,8,0,0,0,213.66,82.34ZM160,51.31,188.69,80H160ZM144,144H128a8,8,0,0,0-8,8v56a8,8,0,0,0,8,8h16a36,36,0,0,0,0-72Zm0,56h-8V160h8a20,20,0,0,1,0,40Zm-40-48v56a8,8,0,0,1-16,0V177.38L74.55,196.59a8,8,0,0,1-13.1,0L48,177.38V208a8,8,0,0,1-16,0V152a8,8,0,0,1,14.55-4.59L68,178.05l21.45-30.64A8,8,0,0,1,104,152Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,yle,[...r[5]||=[R(`path`,{d:`M210.83,85.17l-56-56A4,4,0,0,0,152,28H56A12,12,0,0,0,44,40v72a4,4,0,0,0,8,0V40a4,4,0,0,1,4-4h92V88a4,4,0,0,0,4,4h52V224a4,4,0,0,0,8,0V88A4,4,0,0,0,210.83,85.17ZM156,41.65,198.34,84H156ZM144,148H128a4,4,0,0,0-4,4v56a4,4,0,0,0,4,4h16a32,32,0,0,0,0-64Zm0,56H132V156h12a24,24,0,0,1,0,48Zm-44-52v56a4,4,0,0,1-8,0V164.69l-20.72,29.6a4,4,0,0,1-6.56,0L44,164.69V208a4,4,0,0,1-8,0V152a4,4,0,0,1,7.28-2.29L68,185l24.72-35.31A4,4,0,0,1,100,152Z`},null,-1)]])):B(``,!0)],16))}})})),Sle,Cle=s((()=>{xle(),Sle=ble})),wle,Tle,Ele,Dle,Ole,kle,Ale,jle=s((()=>{Hc(),W(),wle={key:0},Tle={key:1},Ele={key:2},Dle={key:3},Ole={key:4},kle={key:5},Ale=N({name:`ScalarIconFileText`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,wle,[...r[0]||=[R(`path`,{d:`M216.49,79.52l-56-56A12,12,0,0,0,152,20H56A20,20,0,0,0,36,40V216a20,20,0,0,0,20,20H200a20,20,0,0,0,20-20V88A12,12,0,0,0,216.49,79.52ZM160,57l23,23H160ZM60,212V44h76V92a12,12,0,0,0,12,12h48V212Zm112-80a12,12,0,0,1-12,12H96a12,12,0,0,1,0-24h64A12,12,0,0,1,172,132Zm0,40a12,12,0,0,1-12,12H96a12,12,0,0,1,0-24h64A12,12,0,0,1,172,172Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Tle,[...r[1]||=[R(`path`,{d:`M208,88H152V32Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M213.66,82.34l-56-56A8,8,0,0,0,152,24H56A16,16,0,0,0,40,40V216a16,16,0,0,0,16,16H200a16,16,0,0,0,16-16V88A8,8,0,0,0,213.66,82.34ZM160,51.31,188.69,80H160ZM200,216H56V40h88V88a8,8,0,0,0,8,8h48V216Zm-32-80a8,8,0,0,1-8,8H96a8,8,0,0,1,0-16h64A8,8,0,0,1,168,136Zm0,32a8,8,0,0,1-8,8H96a8,8,0,0,1,0-16h64A8,8,0,0,1,168,168Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Ele,[...r[2]||=[R(`path`,{d:`M213.66,82.34l-56-56A8,8,0,0,0,152,24H56A16,16,0,0,0,40,40V216a16,16,0,0,0,16,16H200a16,16,0,0,0,16-16V88A8,8,0,0,0,213.66,82.34ZM160,176H96a8,8,0,0,1,0-16h64a8,8,0,0,1,0,16Zm0-32H96a8,8,0,0,1,0-16h64a8,8,0,0,1,0,16Zm-8-56V44l44,44Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Dle,[...r[3]||=[R(`path`,{d:`M212.24,83.76l-56-56A6,6,0,0,0,152,26H56A14,14,0,0,0,42,40V216a14,14,0,0,0,14,14H200a14,14,0,0,0,14-14V88A6,6,0,0,0,212.24,83.76ZM158,46.48,193.52,82H158ZM200,218H56a2,2,0,0,1-2-2V40a2,2,0,0,1,2-2h90V88a6,6,0,0,0,6,6h50V216A2,2,0,0,1,200,218Zm-34-82a6,6,0,0,1-6,6H96a6,6,0,0,1,0-12h64A6,6,0,0,1,166,136Zm0,32a6,6,0,0,1-6,6H96a6,6,0,0,1,0-12h64A6,6,0,0,1,166,168Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Ole,[...r[4]||=[R(`path`,{d:`M213.66,82.34l-56-56A8,8,0,0,0,152,24H56A16,16,0,0,0,40,40V216a16,16,0,0,0,16,16H200a16,16,0,0,0,16-16V88A8,8,0,0,0,213.66,82.34ZM160,51.31,188.69,80H160ZM200,216H56V40h88V88a8,8,0,0,0,8,8h48V216Zm-32-80a8,8,0,0,1-8,8H96a8,8,0,0,1,0-16h64A8,8,0,0,1,168,136Zm0,32a8,8,0,0,1-8,8H96a8,8,0,0,1,0-16h64A8,8,0,0,1,168,168Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,kle,[...r[5]||=[R(`path`,{d:`M210.83,85.17l-56-56A4,4,0,0,0,152,28H56A12,12,0,0,0,44,40V216a12,12,0,0,0,12,12H200a12,12,0,0,0,12-12V88A4,4,0,0,0,210.83,85.17ZM156,41.65,198.34,84H156ZM200,220H56a4,4,0,0,1-4-4V40a4,4,0,0,1,4-4h92V88a4,4,0,0,0,4,4h52V216A4,4,0,0,1,200,220Zm-36-84a4,4,0,0,1-4,4H96a4,4,0,0,1,0-8h64A4,4,0,0,1,164,136Zm0,32a4,4,0,0,1-4,4H96a4,4,0,0,1,0-8h64A4,4,0,0,1,164,168Z`},null,-1)]])):B(``,!0)],16))}})})),Mle,Nle=s((()=>{jle(),Mle=Ale})),Ple,Fle,Ile,Lle,Rle,zle,Ble,Vle=s((()=>{Hc(),W(),Ple={key:0},Fle={key:1},Ile={key:2},Lle={key:3},Rle={key:4},zle={key:5},Ble=N({name:`ScalarIconGavel`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Ple,[...r[0]||=[R(`path`,{d:`M246.14,113.86l-16-16a20,20,0,0,0-23.06-3.75l-45.2-45.2a20,20,0,0,0-3.74-23.06l-16-16a20,20,0,0,0-28.28,0l-64,64a20,20,0,0,0,0,28.28l16,16a20,20,0,0,0,23,3.79L29.36,181.38a32,32,0,0,0,45.26,45.26L134,167.21a20,20,0,0,0,3.81,22.94l16,16a20,20,0,0,0,28.29,0l64-64a20,20,0,0,0,0-28.29ZM80,98.34,69.64,88,128,29.65,138.34,40ZM57.64,209.67a8,8,0,0,1-11.31-11.32l59.52-59.52,11.31,11.32Zm92.7-60.29-43.72-43.72,39-39,43.72,43.72Zm17.65,37L157.65,176,216,117.66,226.34,128Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Fle,[...r[1]||=[R(`path`,{d:`M149.66,45.66l-64,64a8,8,0,0,1-11.32,0l-16-16a8,8,0,0,1,0-11.32l64-64a8,8,0,0,1,11.32,0l16,16A8,8,0,0,1,149.66,45.66Zm88,76.68-16-16a8,8,0,0,0-11.32,0l-64,64a8,8,0,0,0,0,11.32l16,16a8,8,0,0,0,11.32,0l64-64A8,8,0,0,0,237.66,122.34Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M243.32,116.69l-16-16a16,16,0,0,0-20.84-1.53L156.84,49.52a16,16,0,0,0-1.52-20.84l-16-16a16,16,0,0,0-22.63,0l-64,64a16,16,0,0,0,0,22.63l16,16a16,16,0,0,0,20.83,1.52L96.69,124,31.31,189.38A25,25,0,0,0,66.63,224.7L132,159.32l7.17,7.16a16,16,0,0,0,1.52,20.84l16,16a16,16,0,0,0,22.63,0l64-64A16,16,0,0,0,243.32,116.69ZM80,104,64,88l64-64,16,16ZM55.32,213.38a9,9,0,0,1-12.69,0,9,9,0,0,1,0-12.68L108,135.32,120.69,148ZM101,105.66,145.66,61,195,110.34,150.35,155ZM168,192l-16-16,4-4h0l56-56h0l4-4,16,16Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Ile,[...r[2]||=[R(`path`,{d:`M52.69,99.31a16,16,0,0,1,0-22.63l64-64a16,16,0,0,1,22.63,22.63l-64,64a16,16,0,0,1-22.63,0Zm190.63,17.37a16,16,0,0,0-22.63,0l-64,64a16,16,0,0,0,0,22.63h0a16,16,0,0,0,22.63,0l64-64A16,16,0,0,0,243.32,116.68Zm-35.11-15.8L155.12,47.79a4,4,0,0,0-5.66,0L87.8,109.45a4,4,0,0,0,0,5.66L103,130.34,28.69,204.69a16,16,0,0,0,22.62,22.62L125.66,153l15.23,15.23a4,4,0,0,0,5.66,0l61.66-61.66A4,4,0,0,0,208.21,100.88Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Lle,[...r[3]||=[R(`path`,{d:`M241.91,118.1l-16-16a14,14,0,0,0-19.55-.23L154.13,49.64a14,14,0,0,0-.23-19.55l-16-16a14,14,0,0,0-19.8,0l-64,64a14,14,0,0,0,0,19.8l16,16a14,14,0,0,0,19.55.23L99.52,124,32.73,190.79a23,23,0,0,0,32.48,32.49L132,156.49l9.87,9.87a14,14,0,0,0,.23,19.55l16,16a14,14,0,0,0,19.8,0l64-64A14,14,0,0,0,241.91,118.1Zm-91.56,39.76-52.21-52.2,47.52-47.52,52.2,52.2ZM78.59,105.41l-16-16a2,2,0,0,1,0-2.83l64-64a2,2,0,0,1,2.83,0l16,16a2,2,0,0,1,0,2.83l-64,64A2,2,0,0,1,78.59,105.41ZM56.73,214.8a11,11,0,0,1-15.52-15.52L108,132.49,123.52,148Zm176.69-85.38-64,64a2,2,0,0,1-2.83,0l-16-16a2,2,0,0,1,0-2.83l64-64a2,2,0,0,1,2.83,0l16,16A2,2,0,0,1,233.42,129.42Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Rle,[...r[4]||=[R(`path`,{d:`M243.32,116.69l-16-16a16,16,0,0,0-20.84-1.53L156.84,49.52a16,16,0,0,0-1.52-20.84l-16-16a16,16,0,0,0-22.63,0l-64,64a16,16,0,0,0,0,22.63l16,16a16,16,0,0,0,20.83,1.52L96.69,124,31.31,189.38A25,25,0,0,0,66.63,224.7L132,159.32l7.17,7.16a16,16,0,0,0,1.52,20.84l16,16a16,16,0,0,0,22.63,0l64-64A16,16,0,0,0,243.32,116.69ZM80,104,64,88l64-64,16,16ZM55.32,213.38a9,9,0,0,1-12.69,0,9,9,0,0,1,0-12.68L108,135.32,120.69,148ZM101,105.66,145.66,61,195,110.34,150.35,155ZM168,192l-16-16,4-4h0l56-56h0l4-4,16,16Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,zle,[...r[5]||=[R(`path`,{d:`M240.49,119.52l-16-16a12,12,0,0,0-17,0l-1.17,1.17-55-55,1.18-1.17a12,12,0,0,0,0-17l-16-16a12,12,0,0,0-17,0l-64,64a12,12,0,0,0,0,17l16,16a12,12,0,0,0,17,0l1.17-1.18L102.34,124l-68.2,68.21A21,21,0,0,0,63.8,221.87L132,153.66l12.69,12.69-1.18,1.17a12,12,0,0,0,0,17l16,16a12,12,0,0,0,17,0l64-64a12,12,0,0,0,0-17ZM77.17,106.83l-16-16a4,4,0,0,1,0-5.66l64-64a4,4,0,0,1,5.66,0l16,16a4,4,0,0,1,0,5.65l-64,64A4,4,0,0,1,77.17,106.83Zm-19,109.38A13,13,0,1,1,39.8,197.87L108,129.66,126.34,148ZM95.31,105.66l50.35-50.35,55,55-50.35,50.35Zm139.52,25.17-64,64a4,4,0,0,1-5.66,0l-16-16a4,4,0,0,1,0-5.65l64-64a4,4,0,0,1,5.66,0l16,16a4,4,0,0,1,0,5.66Z`},null,-1)]])):B(``,!0)],16))}})})),hu,Hle=s((()=>{Vle(),hu=Ble})),Ule,Wle,Gle,Kle,qle,Jle,Yle,Xle=s((()=>{Hc(),W(),Ule={key:0},Wle={key:1},Gle={key:2},Kle={key:3},qle={key:4},Jle={key:5},Yle=N({name:`ScalarIconGear`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Ule,[...r[0]||=[R(`path`,{d:`M128,76a52,52,0,1,0,52,52A52.06,52.06,0,0,0,128,76Zm0,80a28,28,0,1,1,28-28A28,28,0,0,1,128,156Zm92-27.21v-1.58l14-17.51a12,12,0,0,0,2.23-10.59A111.75,111.75,0,0,0,225,71.89,12,12,0,0,0,215.89,66L193.61,63.5l-1.11-1.11L190,40.1A12,12,0,0,0,184.11,31a111.67,111.67,0,0,0-27.23-11.27A12,12,0,0,0,146.3,22L128.79,36h-1.58L109.7,22a12,12,0,0,0-10.59-2.23A111.75,111.75,0,0,0,71.89,31.05,12,12,0,0,0,66,40.11L63.5,62.39,62.39,63.5,40.1,66A12,12,0,0,0,31,71.89,111.67,111.67,0,0,0,19.77,99.12,12,12,0,0,0,22,109.7l14,17.51v1.58L22,146.3a12,12,0,0,0-2.23,10.59,111.75,111.75,0,0,0,11.29,27.22A12,12,0,0,0,40.11,190l22.28,2.48,1.11,1.11L66,215.9A12,12,0,0,0,71.89,225a111.67,111.67,0,0,0,27.23,11.27A12,12,0,0,0,109.7,234l17.51-14h1.58l17.51,14a12,12,0,0,0,10.59,2.23A111.75,111.75,0,0,0,184.11,225a12,12,0,0,0,5.91-9.06l2.48-22.28,1.11-1.11L215.9,190a12,12,0,0,0,9.06-5.91,111.67,111.67,0,0,0,11.27-27.23A12,12,0,0,0,234,146.3Zm-24.12-4.89a70.1,70.1,0,0,1,0,8.2,12,12,0,0,0,2.61,8.22l12.84,16.05A86.47,86.47,0,0,1,207,166.86l-20.43,2.27a12,12,0,0,0-7.65,4,69,69,0,0,1-5.8,5.8,12,12,0,0,0-4,7.65L166.86,207a86.47,86.47,0,0,1-10.49,4.35l-16.05-12.85a12,12,0,0,0-7.5-2.62c-.24,0-.48,0-.72,0a70.1,70.1,0,0,1-8.2,0,12.06,12.06,0,0,0-8.22,2.6L99.63,211.33A86.47,86.47,0,0,1,89.14,207l-2.27-20.43a12,12,0,0,0-4-7.65,69,69,0,0,1-5.8-5.8,12,12,0,0,0-7.65-4L49,166.86a86.47,86.47,0,0,1-4.35-10.49l12.84-16.05a12,12,0,0,0,2.61-8.22,70.1,70.1,0,0,1,0-8.2,12,12,0,0,0-2.61-8.22L44.67,99.63A86.47,86.47,0,0,1,49,89.14l20.43-2.27a12,12,0,0,0,7.65-4,69,69,0,0,1,5.8-5.8,12,12,0,0,0,4-7.65L89.14,49a86.47,86.47,0,0,1,10.49-4.35l16.05,12.85a12.06,12.06,0,0,0,8.22,2.6,70.1,70.1,0,0,1,8.2,0,12,12,0,0,0,8.22-2.6l16.05-12.85A86.47,86.47,0,0,1,166.86,49l2.27,20.43a12,12,0,0,0,4,7.65,69,69,0,0,1,5.8,5.8,12,12,0,0,0,7.65,4L207,89.14a86.47,86.47,0,0,1,4.35,10.49l-12.84,16.05A12,12,0,0,0,195.88,123.9Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Wle,[...r[1]||=[R(`path`,{d:`M207.86,123.18l16.78-21a99.14,99.14,0,0,0-10.07-24.29l-26.7-3a81,81,0,0,0-6.81-6.81l-3-26.71a99.43,99.43,0,0,0-24.3-10l-21,16.77a81.59,81.59,0,0,0-9.64,0l-21-16.78A99.14,99.14,0,0,0,77.91,41.43l-3,26.7a81,81,0,0,0-6.81,6.81l-26.71,3a99.43,99.43,0,0,0-10,24.3l16.77,21a81.59,81.59,0,0,0,0,9.64l-16.78,21a99.14,99.14,0,0,0,10.07,24.29l26.7,3a81,81,0,0,0,6.81,6.81l3,26.71a99.43,99.43,0,0,0,24.3,10l21-16.77a81.59,81.59,0,0,0,9.64,0l21,16.78a99.14,99.14,0,0,0,24.29-10.07l3-26.7a81,81,0,0,0,6.81-6.81l26.71-3a99.43,99.43,0,0,0,10-24.3l-16.77-21A81.59,81.59,0,0,0,207.86,123.18ZM128,168a40,40,0,1,1,40-40A40,40,0,0,1,128,168Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M128,80a48,48,0,1,0,48,48A48.05,48.05,0,0,0,128,80Zm0,80a32,32,0,1,1,32-32A32,32,0,0,1,128,160Zm88-29.84q.06-2.16,0-4.32l14.92-18.64a8,8,0,0,0,1.48-7.06,107.6,107.6,0,0,0-10.88-26.25,8,8,0,0,0-6-3.93l-23.72-2.64q-1.48-1.56-3-3L186,40.54a8,8,0,0,0-3.94-6,107.29,107.29,0,0,0-26.25-10.86,8,8,0,0,0-7.06,1.48L130.16,40Q128,40,125.84,40L107.2,25.11a8,8,0,0,0-7.06-1.48A107.6,107.6,0,0,0,73.89,34.51a8,8,0,0,0-3.93,6L67.32,64.27q-1.56,1.49-3,3L40.54,70a8,8,0,0,0-6,3.94,107.71,107.71,0,0,0-10.87,26.25,8,8,0,0,0,1.49,7.06L40,125.84Q40,128,40,130.16L25.11,148.8a8,8,0,0,0-1.48,7.06,107.6,107.6,0,0,0,10.88,26.25,8,8,0,0,0,6,3.93l23.72,2.64q1.49,1.56,3,3L70,215.46a8,8,0,0,0,3.94,6,107.71,107.71,0,0,0,26.25,10.87,8,8,0,0,0,7.06-1.49L125.84,216q2.16.06,4.32,0l18.64,14.92a8,8,0,0,0,7.06,1.48,107.21,107.21,0,0,0,26.25-10.88,8,8,0,0,0,3.93-6l2.64-23.72q1.56-1.48,3-3L215.46,186a8,8,0,0,0,6-3.94,107.71,107.71,0,0,0,10.87-26.25,8,8,0,0,0-1.49-7.06Zm-16.1-6.5a73.93,73.93,0,0,1,0,8.68,8,8,0,0,0,1.74,5.48l14.19,17.73a91.57,91.57,0,0,1-6.23,15L187,173.11a8,8,0,0,0-5.1,2.64,74.11,74.11,0,0,1-6.14,6.14,8,8,0,0,0-2.64,5.1l-2.51,22.58a91.32,91.32,0,0,1-15,6.23l-17.74-14.19a8,8,0,0,0-5-1.75h-.48a73.93,73.93,0,0,1-8.68,0,8.06,8.06,0,0,0-5.48,1.74L100.45,215.8a91.57,91.57,0,0,1-15-6.23L82.89,187a8,8,0,0,0-2.64-5.1,74.11,74.11,0,0,1-6.14-6.14,8,8,0,0,0-5.1-2.64L46.43,170.6a91.32,91.32,0,0,1-6.23-15l14.19-17.74a8,8,0,0,0,1.74-5.48,73.93,73.93,0,0,1,0-8.68,8,8,0,0,0-1.74-5.48L40.2,100.45a91.57,91.57,0,0,1,6.23-15L69,82.89a8,8,0,0,0,5.1-2.64,74.11,74.11,0,0,1,6.14-6.14A8,8,0,0,0,82.89,69L85.4,46.43a91.32,91.32,0,0,1,15-6.23l17.74,14.19a8,8,0,0,0,5.48,1.74,73.93,73.93,0,0,1,8.68,0,8.06,8.06,0,0,0,5.48-1.74L155.55,40.2a91.57,91.57,0,0,1,15,6.23L173.11,69a8,8,0,0,0,2.64,5.1,74.11,74.11,0,0,1,6.14,6.14,8,8,0,0,0,5.1,2.64l22.58,2.51a91.32,91.32,0,0,1,6.23,15l-14.19,17.74A8,8,0,0,0,199.87,123.66Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Gle,[...r[2]||=[R(`path`,{d:`M216,130.16q.06-2.16,0-4.32l14.92-18.64a8,8,0,0,0,1.48-7.06,107.6,107.6,0,0,0-10.88-26.25,8,8,0,0,0-6-3.93l-23.72-2.64q-1.48-1.56-3-3L186,40.54a8,8,0,0,0-3.94-6,107.29,107.29,0,0,0-26.25-10.86,8,8,0,0,0-7.06,1.48L130.16,40Q128,40,125.84,40L107.2,25.11a8,8,0,0,0-7.06-1.48A107.6,107.6,0,0,0,73.89,34.51a8,8,0,0,0-3.93,6L67.32,64.27q-1.56,1.49-3,3L40.54,70a8,8,0,0,0-6,3.94,107.71,107.71,0,0,0-10.87,26.25,8,8,0,0,0,1.49,7.06L40,125.84Q40,128,40,130.16L25.11,148.8a8,8,0,0,0-1.48,7.06,107.6,107.6,0,0,0,10.88,26.25,8,8,0,0,0,6,3.93l23.72,2.64q1.49,1.56,3,3L70,215.46a8,8,0,0,0,3.94,6,107.71,107.71,0,0,0,26.25,10.87,8,8,0,0,0,7.06-1.49L125.84,216q2.16.06,4.32,0l18.64,14.92a8,8,0,0,0,7.06,1.48,107.21,107.21,0,0,0,26.25-10.88,8,8,0,0,0,3.93-6l2.64-23.72q1.56-1.48,3-3L215.46,186a8,8,0,0,0,6-3.94,107.71,107.71,0,0,0,10.87-26.25,8,8,0,0,0-1.49-7.06ZM128,168a40,40,0,1,1,40-40A40,40,0,0,1,128,168Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Kle,[...r[3]||=[R(`path`,{d:`M128,82a46,46,0,1,0,46,46A46.06,46.06,0,0,0,128,82Zm0,80a34,34,0,1,1,34-34A34,34,0,0,1,128,162ZM214,130.84c.06-1.89.06-3.79,0-5.68L229.33,106a6,6,0,0,0,1.11-5.29A105.34,105.34,0,0,0,219.76,74.9a6,6,0,0,0-4.53-3l-24.45-2.71q-1.93-2.07-4-4l-2.72-24.46a6,6,0,0,0-3-4.53,105.65,105.65,0,0,0-25.77-10.66A6,6,0,0,0,150,26.68l-19.2,15.37c-1.89-.06-3.79-.06-5.68,0L106,26.67a6,6,0,0,0-5.29-1.11A105.34,105.34,0,0,0,74.9,36.24a6,6,0,0,0-3,4.53L69.23,65.22q-2.07,1.94-4,4L40.76,72a6,6,0,0,0-4.53,3,105.65,105.65,0,0,0-10.66,25.77A6,6,0,0,0,26.68,106l15.37,19.2c-.06,1.89-.06,3.79,0,5.68L26.67,150.05a6,6,0,0,0-1.11,5.29A105.34,105.34,0,0,0,36.24,181.1a6,6,0,0,0,4.53,3l24.45,2.71q1.94,2.07,4,4L72,215.24a6,6,0,0,0,3,4.53,105.65,105.65,0,0,0,25.77,10.66,6,6,0,0,0,5.29-1.11L125.16,214c1.89.06,3.79.06,5.68,0l19.21,15.38a6,6,0,0,0,3.75,1.31,6.2,6.2,0,0,0,1.54-.2,105.34,105.34,0,0,0,25.76-10.68,6,6,0,0,0,3-4.53l2.71-24.45q2.07-1.93,4-4l24.46-2.72a6,6,0,0,0,4.53-3,105.49,105.49,0,0,0,10.66-25.77,6,6,0,0,0-1.11-5.29Zm-3.1,41.63-23.64,2.63a6,6,0,0,0-3.82,2,75.14,75.14,0,0,1-6.31,6.31,6,6,0,0,0-2,3.82l-2.63,23.63A94.28,94.28,0,0,1,155.14,218l-18.57-14.86a6,6,0,0,0-3.75-1.31h-.36a78.07,78.07,0,0,1-8.92,0,6,6,0,0,0-4.11,1.3L100.87,218a94.13,94.13,0,0,1-17.34-7.17L80.9,187.21a6,6,0,0,0-2-3.82,75.14,75.14,0,0,1-6.31-6.31,6,6,0,0,0-3.82-2l-23.63-2.63A94.28,94.28,0,0,1,38,155.14l14.86-18.57a6,6,0,0,0,1.3-4.11,78.07,78.07,0,0,1,0-8.92,6,6,0,0,0-1.3-4.11L38,100.87a94.13,94.13,0,0,1,7.17-17.34L68.79,80.9a6,6,0,0,0,3.82-2,75.14,75.14,0,0,1,6.31-6.31,6,6,0,0,0,2-3.82l2.63-23.63A94.28,94.28,0,0,1,100.86,38l18.57,14.86a6,6,0,0,0,4.11,1.3,78.07,78.07,0,0,1,8.92,0,6,6,0,0,0,4.11-1.3L155.13,38a94.13,94.13,0,0,1,17.34,7.17l2.63,23.64a6,6,0,0,0,2,3.82,75.14,75.14,0,0,1,6.31,6.31,6,6,0,0,0,3.82,2l23.63,2.63A94.28,94.28,0,0,1,218,100.86l-14.86,18.57a6,6,0,0,0-1.3,4.11,78.07,78.07,0,0,1,0,8.92,6,6,0,0,0,1.3,4.11L218,155.13A94.13,94.13,0,0,1,210.85,172.47Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,qle,[...r[4]||=[R(`path`,{d:`M128,80a48,48,0,1,0,48,48A48.05,48.05,0,0,0,128,80Zm0,80a32,32,0,1,1,32-32A32,32,0,0,1,128,160Zm88-29.84q.06-2.16,0-4.32l14.92-18.64a8,8,0,0,0,1.48-7.06,107.21,107.21,0,0,0-10.88-26.25,8,8,0,0,0-6-3.93l-23.72-2.64q-1.48-1.56-3-3L186,40.54a8,8,0,0,0-3.94-6,107.71,107.71,0,0,0-26.25-10.87,8,8,0,0,0-7.06,1.49L130.16,40Q128,40,125.84,40L107.2,25.11a8,8,0,0,0-7.06-1.48A107.6,107.6,0,0,0,73.89,34.51a8,8,0,0,0-3.93,6L67.32,64.27q-1.56,1.49-3,3L40.54,70a8,8,0,0,0-6,3.94,107.71,107.71,0,0,0-10.87,26.25,8,8,0,0,0,1.49,7.06L40,125.84Q40,128,40,130.16L25.11,148.8a8,8,0,0,0-1.48,7.06,107.21,107.21,0,0,0,10.88,26.25,8,8,0,0,0,6,3.93l23.72,2.64q1.49,1.56,3,3L70,215.46a8,8,0,0,0,3.94,6,107.71,107.71,0,0,0,26.25,10.87,8,8,0,0,0,7.06-1.49L125.84,216q2.16.06,4.32,0l18.64,14.92a8,8,0,0,0,7.06,1.48,107.21,107.21,0,0,0,26.25-10.88,8,8,0,0,0,3.93-6l2.64-23.72q1.56-1.48,3-3L215.46,186a8,8,0,0,0,6-3.94,107.71,107.71,0,0,0,10.87-26.25,8,8,0,0,0-1.49-7.06Zm-16.1-6.5a73.93,73.93,0,0,1,0,8.68,8,8,0,0,0,1.74,5.48l14.19,17.73a91.57,91.57,0,0,1-6.23,15L187,173.11a8,8,0,0,0-5.1,2.64,74.11,74.11,0,0,1-6.14,6.14,8,8,0,0,0-2.64,5.1l-2.51,22.58a91.32,91.32,0,0,1-15,6.23l-17.74-14.19a8,8,0,0,0-5-1.75h-.48a73.93,73.93,0,0,1-8.68,0,8,8,0,0,0-5.48,1.74L100.45,215.8a91.57,91.57,0,0,1-15-6.23L82.89,187a8,8,0,0,0-2.64-5.1,74.11,74.11,0,0,1-6.14-6.14,8,8,0,0,0-5.1-2.64L46.43,170.6a91.32,91.32,0,0,1-6.23-15l14.19-17.74a8,8,0,0,0,1.74-5.48,73.93,73.93,0,0,1,0-8.68,8,8,0,0,0-1.74-5.48L40.2,100.45a91.57,91.57,0,0,1,6.23-15L69,82.89a8,8,0,0,0,5.1-2.64,74.11,74.11,0,0,1,6.14-6.14A8,8,0,0,0,82.89,69L85.4,46.43a91.32,91.32,0,0,1,15-6.23l17.74,14.19a8,8,0,0,0,5.48,1.74,73.93,73.93,0,0,1,8.68,0,8,8,0,0,0,5.48-1.74L155.55,40.2a91.57,91.57,0,0,1,15,6.23L173.11,69a8,8,0,0,0,2.64,5.1,74.11,74.11,0,0,1,6.14,6.14,8,8,0,0,0,5.1,2.64l22.58,2.51a91.32,91.32,0,0,1,6.23,15l-14.19,17.74A8,8,0,0,0,199.87,123.66Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Jle,[...r[5]||=[R(`path`,{d:`M128,84a44,44,0,1,0,44,44A44.05,44.05,0,0,0,128,84Zm0,80a36,36,0,1,1,36-36A36,36,0,0,1,128,164Zm83.93-32.49q.13-3.51,0-7l15.83-19.79a4,4,0,0,0,.75-3.53A103.64,103.64,0,0,0,218,75.9a4,4,0,0,0-3-2l-25.19-2.8c-1.58-1.71-3.24-3.37-4.95-4.95L182.07,41a4,4,0,0,0-2-3A104,104,0,0,0,154.82,27.5a4,4,0,0,0-3.53.74L131.51,44.07q-3.51-.14-7,0L104.7,28.24a4,4,0,0,0-3.53-.75A103.64,103.64,0,0,0,75.9,38a4,4,0,0,0-2,3l-2.8,25.19c-1.71,1.58-3.37,3.24-4.95,4.95L41,73.93a4,4,0,0,0-3,2A104,104,0,0,0,27.5,101.18a4,4,0,0,0,.74,3.53l15.83,19.78q-.14,3.51,0,7L28.24,151.3a4,4,0,0,0-.75,3.53A103.64,103.64,0,0,0,38,180.1a4,4,0,0,0,3,2l25.19,2.8c1.58,1.71,3.24,3.37,4.95,4.95l2.8,25.2a4,4,0,0,0,2,3,104,104,0,0,0,25.28,10.46,4,4,0,0,0,3.53-.74l19.78-15.83q3.51.13,7,0l19.79,15.83a4,4,0,0,0,2.5.88,4,4,0,0,0,1-.13A103.64,103.64,0,0,0,180.1,218a4,4,0,0,0,2-3l2.8-25.19c1.71-1.58,3.37-3.24,4.95-4.95l25.2-2.8a4,4,0,0,0,3-2,104,104,0,0,0,10.46-25.28,4,4,0,0,0-.74-3.53Zm.17,42.83-24.67,2.74a4,4,0,0,0-2.55,1.32,76.2,76.2,0,0,1-6.48,6.48,4,4,0,0,0-1.32,2.55l-2.74,24.66a95.45,95.45,0,0,1-19.64,8.15l-19.38-15.51a4,4,0,0,0-2.5-.87h-.24a73.67,73.67,0,0,1-9.16,0,4,4,0,0,0-2.74.87l-19.37,15.5a95.33,95.33,0,0,1-19.65-8.13l-2.74-24.67a4,4,0,0,0-1.32-2.55,76.2,76.2,0,0,1-6.48-6.48,4,4,0,0,0-2.55-1.32l-24.66-2.74a95.45,95.45,0,0,1-8.15-19.64l15.51-19.38a4,4,0,0,0,.87-2.74,77.76,77.76,0,0,1,0-9.16,4,4,0,0,0-.87-2.74l-15.5-19.37A95.33,95.33,0,0,1,43.9,81.66l24.67-2.74a4,4,0,0,0,2.55-1.32,76.2,76.2,0,0,1,6.48-6.48,4,4,0,0,0,1.32-2.55l2.74-24.66a95.45,95.45,0,0,1,19.64-8.15l19.38,15.51a4,4,0,0,0,2.74.87,73.67,73.67,0,0,1,9.16,0,4,4,0,0,0,2.74-.87l19.37-15.5a95.33,95.33,0,0,1,19.65,8.13l2.74,24.67a4,4,0,0,0,1.32,2.55,76.2,76.2,0,0,1,6.48,6.48,4,4,0,0,0,2.55,1.32l24.66,2.74a95.45,95.45,0,0,1,8.15,19.64l-15.51,19.38a4,4,0,0,0-.87,2.74,77.76,77.76,0,0,1,0,9.16,4,4,0,0,0,.87,2.74l15.5,19.37A95.33,95.33,0,0,1,212.1,174.34Z`},null,-1)]])):B(``,!0)],16))}})})),Zle,Qle=s((()=>{Xle(),Zle=Yle})),$le,eue,tue,nue,rue,iue,aue,oue=s((()=>{Hc(),W(),$le={key:0},eue={key:1},tue={key:2},nue={key:3},rue={key:4},iue={key:5},aue=N({name:`ScalarIconGearSix`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,$le,[...r[0]||=[R(`path`,{d:`M128,76a52,52,0,1,0,52,52A52.06,52.06,0,0,0,128,76Zm0,80a28,28,0,1,1,28-28A28,28,0,0,1,128,156Zm113.86-49.57A12,12,0,0,0,236,98.34L208.21,82.49l-.11-31.31a12,12,0,0,0-4.25-9.12,116,116,0,0,0-38-21.41,12,12,0,0,0-9.68.89L128,37.27,99.83,21.53a12,12,0,0,0-9.7-.9,116.06,116.06,0,0,0-38,21.47,12,12,0,0,0-4.24,9.1l-.14,31.34L20,98.35a12,12,0,0,0-5.85,8.11,110.7,110.7,0,0,0,0,43.11A12,12,0,0,0,20,157.66l27.82,15.85.11,31.31a12,12,0,0,0,4.25,9.12,116,116,0,0,0,38,21.41,12,12,0,0,0,9.68-.89L128,218.73l28.14,15.74a12,12,0,0,0,9.7.9,116.06,116.06,0,0,0,38-21.47,12,12,0,0,0,4.24-9.1l.14-31.34,27.81-15.81a12,12,0,0,0,5.85-8.11A110.7,110.7,0,0,0,241.86,106.43Zm-22.63,33.18-26.88,15.28a11.94,11.94,0,0,0-4.55,4.59c-.54,1-1.11,1.93-1.7,2.88a12,12,0,0,0-1.83,6.31L184.13,199a91.83,91.83,0,0,1-21.07,11.87l-27.15-15.19a12,12,0,0,0-5.86-1.53h-.29c-1.14,0-2.3,0-3.44,0a12.08,12.08,0,0,0-6.14,1.51L93,210.82A92.27,92.27,0,0,1,71.88,199l-.11-30.24a12,12,0,0,0-1.83-6.32c-.58-.94-1.16-1.91-1.7-2.88A11.92,11.92,0,0,0,63.7,155L36.8,139.63a86.53,86.53,0,0,1,0-23.24l26.88-15.28a12,12,0,0,0,4.55-4.58c.54-1,1.11-1.94,1.7-2.89a12,12,0,0,0,1.83-6.31L71.87,57A91.83,91.83,0,0,1,92.94,45.17l27.15,15.19a11.92,11.92,0,0,0,6.15,1.52c1.14,0,2.3,0,3.44,0a12.08,12.08,0,0,0,6.14-1.51L163,45.18A92.27,92.27,0,0,1,184.12,57l.11,30.24a12,12,0,0,0,1.83,6.32c.58.94,1.16,1.91,1.7,2.88A11.92,11.92,0,0,0,192.3,101l26.9,15.33A86.53,86.53,0,0,1,219.23,139.61Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,eue,[...r[1]||=[R(`path`,{d:`M230.1,108.76,198.25,90.62c-.64-1.16-1.31-2.29-2-3.41l-.12-36A104.61,104.61,0,0,0,162,32L130,49.89c-1.34,0-2.69,0-4,0L94,32A104.58,104.58,0,0,0,59.89,51.25l-.16,36c-.7,1.12-1.37,2.26-2,3.41l-31.84,18.1a99.15,99.15,0,0,0,0,38.46l31.85,18.14c.64,1.16,1.31,2.29,2,3.41l.12,36A104.61,104.61,0,0,0,94,224l32-17.87c1.34,0,2.69,0,4,0L162,224a104.58,104.58,0,0,0,34.08-19.25l.16-36c.7-1.12,1.37-2.26,2-3.41l31.84-18.1A99.15,99.15,0,0,0,230.1,108.76ZM128,168a40,40,0,1,1,40-40A40,40,0,0,1,128,168Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M128,80a48,48,0,1,0,48,48A48.05,48.05,0,0,0,128,80Zm0,80a32,32,0,1,1,32-32A32,32,0,0,1,128,160Zm109.94-52.79a8,8,0,0,0-3.89-5.4l-29.83-17-.12-33.62a8,8,0,0,0-2.83-6.08,111.91,111.91,0,0,0-36.72-20.67,8,8,0,0,0-6.46.59L128,41.85,97.88,25a8,8,0,0,0-6.47-.6A111.92,111.92,0,0,0,54.73,45.15a8,8,0,0,0-2.83,6.07l-.15,33.65-29.83,17a8,8,0,0,0-3.89,5.4,106.47,106.47,0,0,0,0,41.56,8,8,0,0,0,3.89,5.4l29.83,17,.12,33.63a8,8,0,0,0,2.83,6.08,111.91,111.91,0,0,0,36.72,20.67,8,8,0,0,0,6.46-.59L128,214.15,158.12,231a7.91,7.91,0,0,0,3.9,1,8.09,8.09,0,0,0,2.57-.42,112.1,112.1,0,0,0,36.68-20.73,8,8,0,0,0,2.83-6.07l.15-33.65,29.83-17a8,8,0,0,0,3.89-5.4A106.47,106.47,0,0,0,237.94,107.21Zm-15,34.91-28.57,16.25a8,8,0,0,0-3,3c-.58,1-1.19,2.06-1.81,3.06a7.94,7.94,0,0,0-1.22,4.21l-.15,32.25a95.89,95.89,0,0,1-25.37,14.3L134,199.13a8,8,0,0,0-3.91-1h-.19c-1.21,0-2.43,0-3.64,0a8.1,8.1,0,0,0-4.1,1l-28.84,16.1A96,96,0,0,1,67.88,201l-.11-32.2a8,8,0,0,0-1.22-4.22c-.62-1-1.23-2-1.8-3.06a8.09,8.09,0,0,0-3-3.06l-28.6-16.29a90.49,90.49,0,0,1,0-28.26L61.67,97.63a8,8,0,0,0,3-3c.58-1,1.19-2.06,1.81-3.06a7.94,7.94,0,0,0,1.22-4.21l.15-32.25a95.89,95.89,0,0,1,25.37-14.3L122,56.87a8,8,0,0,0,4.1,1c1.21,0,2.43,0,3.64,0a8,8,0,0,0,4.1-1l28.84-16.1A96,96,0,0,1,188.12,55l.11,32.2a8,8,0,0,0,1.22,4.22c.62,1,1.23,2,1.8,3.06a8.09,8.09,0,0,0,3,3.06l28.6,16.29A90.49,90.49,0,0,1,222.9,142.12Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,tue,[...r[2]||=[R(`path`,{d:`M237.94,107.21a8,8,0,0,0-3.89-5.4l-29.83-17-.12-33.62a8,8,0,0,0-2.83-6.08,111.91,111.91,0,0,0-36.72-20.67,8,8,0,0,0-6.46.59L128,41.85,97.88,25a8,8,0,0,0-6.47-.6A111.92,111.92,0,0,0,54.73,45.15a8,8,0,0,0-2.83,6.07l-.15,33.65-29.83,17a8,8,0,0,0-3.89,5.4,106.47,106.47,0,0,0,0,41.56,8,8,0,0,0,3.89,5.4l29.83,17,.12,33.63a8,8,0,0,0,2.83,6.08,111.91,111.91,0,0,0,36.72,20.67,8,8,0,0,0,6.46-.59L128,214.15,158.12,231a7.91,7.91,0,0,0,3.9,1,8.09,8.09,0,0,0,2.57-.42,112.1,112.1,0,0,0,36.68-20.73,8,8,0,0,0,2.83-6.07l.15-33.65,29.83-17a8,8,0,0,0,3.89-5.4A106.47,106.47,0,0,0,237.94,107.21ZM128,168a40,40,0,1,1,40-40A40,40,0,0,1,128,168Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,nue,[...r[3]||=[R(`path`,{d:`M128,82a46,46,0,1,0,46,46A46.06,46.06,0,0,0,128,82Zm0,80a34,34,0,1,1,34-34A34,34,0,0,1,128,162Zm108-54.4a6,6,0,0,0-2.92-4L202.64,86.22l-.42-.71L202.1,51.2A6,6,0,0,0,200,46.64a110.12,110.12,0,0,0-36.07-20.31,6,6,0,0,0-4.84.45L128.46,43.86h-1L96.91,26.76a6,6,0,0,0-4.86-.44A109.92,109.92,0,0,0,56,46.68a6,6,0,0,0-2.12,4.55l-.16,34.34c-.14.23-.28.47-.41.71L22.91,103.57A6,6,0,0,0,20,107.62a104.81,104.81,0,0,0,0,40.78,6,6,0,0,0,2.92,4l30.42,17.33.42.71.12,34.31A6,6,0,0,0,56,209.36a110.12,110.12,0,0,0,36.07,20.31,6,6,0,0,0,4.84-.45l30.61-17.08h1l30.56,17.1A6.09,6.09,0,0,0,162,230a5.83,5.83,0,0,0,1.93-.32,109.92,109.92,0,0,0,36-20.36,6,6,0,0,0,2.12-4.55l.16-34.34c.14-.23.28-.47.41-.71l30.42-17.29a6,6,0,0,0,2.92-4.05A104.81,104.81,0,0,0,236,107.6Zm-11.25,35.79L195.32,160.1a6.07,6.07,0,0,0-2.28,2.3c-.59,1-1.21,2.11-1.86,3.14a6,6,0,0,0-.91,3.16l-.16,33.21a98.15,98.15,0,0,1-27.52,15.53L133,200.88a6,6,0,0,0-2.93-.77h-.14c-1.24,0-2.5,0-3.74,0a6,6,0,0,0-3.07.76L93.45,217.43a98,98,0,0,1-27.56-15.49l-.12-33.17a6,6,0,0,0-.91-3.16c-.64-1-1.27-2.08-1.86-3.14a6,6,0,0,0-2.27-2.3L31.3,143.4a93,93,0,0,1,0-30.79L60.68,95.9A6.07,6.07,0,0,0,63,93.6c.59-1,1.21-2.11,1.86-3.14a6,6,0,0,0,.91-3.16l.16-33.21A98.15,98.15,0,0,1,93.41,38.56L123,55.12a5.81,5.81,0,0,0,3.07.76c1.24,0,2.5,0,3.74,0a6,6,0,0,0,3.07-.76l29.65-16.56a98,98,0,0,1,27.56,15.49l.12,33.17a6,6,0,0,0,.91,3.16c.64,1,1.27,2.08,1.86,3.14a6,6,0,0,0,2.27,2.3L224.7,112.6A93,93,0,0,1,224.73,143.39Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,rue,[...r[4]||=[R(`path`,{d:`M128,80a48,48,0,1,0,48,48A48.05,48.05,0,0,0,128,80Zm0,80a32,32,0,1,1,32-32A32,32,0,0,1,128,160Zm109.94-52.79a8,8,0,0,0-3.89-5.4l-29.83-17-.12-33.62a8,8,0,0,0-2.83-6.08,111.91,111.91,0,0,0-36.72-20.67,8,8,0,0,0-6.46.59L128,41.85,97.88,25a8,8,0,0,0-6.47-.6A112.1,112.1,0,0,0,54.73,45.15a8,8,0,0,0-2.83,6.07l-.15,33.65-29.83,17a8,8,0,0,0-3.89,5.4,106.47,106.47,0,0,0,0,41.56,8,8,0,0,0,3.89,5.4l29.83,17,.12,33.62a8,8,0,0,0,2.83,6.08,111.91,111.91,0,0,0,36.72,20.67,8,8,0,0,0,6.46-.59L128,214.15,158.12,231a7.91,7.91,0,0,0,3.9,1,8.09,8.09,0,0,0,2.57-.42,112.1,112.1,0,0,0,36.68-20.73,8,8,0,0,0,2.83-6.07l.15-33.65,29.83-17a8,8,0,0,0,3.89-5.4A106.47,106.47,0,0,0,237.94,107.21Zm-15,34.91-28.57,16.25a8,8,0,0,0-3,3c-.58,1-1.19,2.06-1.81,3.06a7.94,7.94,0,0,0-1.22,4.21l-.15,32.25a95.89,95.89,0,0,1-25.37,14.3L134,199.13a8,8,0,0,0-3.91-1h-.19c-1.21,0-2.43,0-3.64,0a8.08,8.08,0,0,0-4.1,1l-28.84,16.1A96,96,0,0,1,67.88,201l-.11-32.2a8,8,0,0,0-1.22-4.22c-.62-1-1.23-2-1.8-3.06a8.09,8.09,0,0,0-3-3.06l-28.6-16.29a90.49,90.49,0,0,1,0-28.26L61.67,97.63a8,8,0,0,0,3-3c.58-1,1.19-2.06,1.81-3.06a7.94,7.94,0,0,0,1.22-4.21l.15-32.25a95.89,95.89,0,0,1,25.37-14.3L122,56.87a8,8,0,0,0,4.1,1c1.21,0,2.43,0,3.64,0a8.08,8.08,0,0,0,4.1-1l28.84-16.1A96,96,0,0,1,188.12,55l.11,32.2a8,8,0,0,0,1.22,4.22c.62,1,1.23,2,1.8,3.06a8.09,8.09,0,0,0,3,3.06l28.6,16.29A90.49,90.49,0,0,1,222.9,142.12Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,iue,[...r[5]||=[R(`path`,{d:`M128,84a44,44,0,1,0,44,44A44.05,44.05,0,0,0,128,84Zm0,80a36,36,0,1,1,36-36A36,36,0,0,1,128,164Zm106-56a4,4,0,0,0-2-2.7l-30.89-17.6q-.47-.82-1-1.62L200.1,51.2a3.94,3.94,0,0,0-1.42-3,107.8,107.8,0,0,0-35.41-19.94,4,4,0,0,0-3.23.29L129,45.87h-2l-31-17.36a4,4,0,0,0-3.23-.3,108.05,108.05,0,0,0-35.39,20,4,4,0,0,0-1.41,3l-.16,34.9-1,1.62L23.9,105.3A4,4,0,0,0,22,108a102.76,102.76,0,0,0,0,40,4,4,0,0,0,1.95,2.7l30.89,17.6q.47.83,1,1.62l.12,34.87a3.94,3.94,0,0,0,1.42,3,107.8,107.8,0,0,0,35.41,19.94,4,4,0,0,0,3.23-.29L127,210.13h2l31,17.36a4,4,0,0,0,3.23.3,108.05,108.05,0,0,0,35.39-20,4,4,0,0,0,1.41-3l.16-34.9,1-1.62L232.1,150.7a4,4,0,0,0,2-2.71A102.76,102.76,0,0,0,234,108Zm-7.48,36.67L196.3,161.84a4,4,0,0,0-1.51,1.53c-.61,1.09-1.25,2.17-1.91,3.24a3.92,3.92,0,0,0-.61,2.1l-.16,34.15a99.8,99.8,0,0,1-29.7,16.77l-30.4-17a4.06,4.06,0,0,0-2-.51H130c-1.28,0-2.57,0-3.84,0a4.1,4.1,0,0,0-2.05.51l-30.45,17A100.23,100.23,0,0,1,63.89,202.9l-.12-34.12a3.93,3.93,0,0,0-.61-2.11c-.66-1-1.3-2.14-1.91-3.23a4,4,0,0,0-1.51-1.53L29.49,144.68a94.78,94.78,0,0,1,0-33.34L59.7,94.16a4,4,0,0,0,1.51-1.53c.61-1.09,1.25-2.17,1.91-3.23a4,4,0,0,0,.61-2.11l.16-34.15a99.8,99.8,0,0,1,29.7-16.77l30.4,17a4.1,4.1,0,0,0,2.05.51c1.28,0,2.57,0,3.84,0a4,4,0,0,0,2.05-.51l30.45-17A100.23,100.23,0,0,1,192.11,53.1l.12,34.12a3.93,3.93,0,0,0,.61,2.11c.66,1,1.3,2.14,1.91,3.23a4,4,0,0,0,1.51,1.53l30.25,17.23A94.78,94.78,0,0,1,226.54,144.66Z`},null,-1)]])):B(``,!0)],16))}})})),sue,cue=s((()=>{oue(),sue=aue})),lue,uue,due,fue,pue,mue,hue,gue=s((()=>{Hc(),W(),lue={key:0},uue={key:1},due={key:2},fue={key:3},pue={key:4},mue={key:5},hue=N({name:`ScalarIconGitBranch`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,lue,[...r[0]||=[R(`path`,{d:`M236,64a36,36,0,1,0-48,33.94V112a4,4,0,0,1-4,4H96a27.8,27.8,0,0,0-4,.29V97.94a36,36,0,1,0-24,0v60.12a36,36,0,1,0,24,0V144a4,4,0,0,1,4-4h88a28,28,0,0,0,28-28V97.94A36.07,36.07,0,0,0,236,64ZM80,52A12,12,0,1,1,68,64,12,12,0,0,1,80,52Zm0,152a12,12,0,1,1,12-12A12,12,0,0,1,80,204ZM200,76a12,12,0,1,1,12-12A12,12,0,0,1,200,76Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,uue,[...r[1]||=[R(`path`,{d:`M224,64a24,24,0,1,1-24-24A24,24,0,0,1,224,64Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M232,64a32,32,0,1,0-40,31v17a8,8,0,0,1-8,8H96a23.84,23.84,0,0,0-8,1.38V95a32,32,0,1,0-16,0v66a32,32,0,1,0,16,0V144a8,8,0,0,1,8-8h88a24,24,0,0,0,24-24V95A32.06,32.06,0,0,0,232,64ZM64,64A16,16,0,1,1,80,80,16,16,0,0,1,64,64ZM96,192a16,16,0,1,1-16-16A16,16,0,0,1,96,192ZM200,80a16,16,0,1,1,16-16A16,16,0,0,1,200,80Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,due,[...r[2]||=[R(`path`,{d:`M232,64a32,32,0,1,0-40,31v17a8,8,0,0,1-8,8H96a23.84,23.84,0,0,0-8,1.38V95a32,32,0,1,0-16,0v66a32,32,0,1,0,16,0V144a8,8,0,0,1,8-8h88a24,24,0,0,0,24-24V95A32.06,32.06,0,0,0,232,64ZM64,64A16,16,0,1,1,80,80,16,16,0,0,1,64,64ZM96,192a16,16,0,1,1-16-16A16,16,0,0,1,96,192Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,fue,[...r[3]||=[R(`path`,{d:`M230,64a30,30,0,1,0-36,29.4V112a10,10,0,0,1-10,10H96a21.84,21.84,0,0,0-10,2.42v-31a30,30,0,1,0-12,0v69.2a30,30,0,1,0,12,0V144a10,10,0,0,1,10-10h88a22,22,0,0,0,22-22V93.4A30.05,30.05,0,0,0,230,64ZM62,64A18,18,0,1,1,80,82,18,18,0,0,1,62,64ZM98,192a18,18,0,1,1-18-18A18,18,0,0,1,98,192ZM200,82a18,18,0,1,1,18-18A18,18,0,0,1,200,82Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,pue,[...r[4]||=[R(`path`,{d:`M232,64a32,32,0,1,0-40,31v17a8,8,0,0,1-8,8H96a23.84,23.84,0,0,0-8,1.38V95a32,32,0,1,0-16,0v66a32,32,0,1,0,16,0V144a8,8,0,0,1,8-8h88a24,24,0,0,0,24-24V95A32.06,32.06,0,0,0,232,64ZM64,64A16,16,0,1,1,80,80,16,16,0,0,1,64,64ZM96,192a16,16,0,1,1-16-16A16,16,0,0,1,96,192ZM200,80a16,16,0,1,1,16-16A16,16,0,0,1,200,80Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,mue,[...r[5]||=[R(`path`,{d:`M228,64a28,28,0,1,0-32,27.71V112a12,12,0,0,1-12,12H96a19.91,19.91,0,0,0-12,4V91.71a28,28,0,1,0-8,0v72.58a28,28,0,1,0,8,0V144a12,12,0,0,1,12-12h88a20,20,0,0,0,20-20V91.71A28,28,0,0,0,228,64ZM60,64A20,20,0,1,1,80,84,20,20,0,0,1,60,64Zm40,128a20,20,0,1,1-20-20A20,20,0,0,1,100,192ZM200,84a20,20,0,1,1,20-20A20,20,0,0,1,200,84Z`},null,-1)]])):B(``,!0)],16))}})})),_ue,vue=s((()=>{gue(),_ue=hue})),yue,bue,xue,Sue,Cue,wue,Tue,Eue=s((()=>{Hc(),W(),yue={key:0},bue={key:1},xue={key:2},Sue={key:3},Cue={key:4},wue={key:5},Tue=N({name:`ScalarIconGithubLogo`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,yue,[...r[0]||=[R(`path`,{d:`M212.62,75.17A63.7,63.7,0,0,0,206.39,26,12,12,0,0,0,196,20a63.71,63.71,0,0,0-50,24H126A63.71,63.71,0,0,0,76,20a12,12,0,0,0-10.39,6,63.7,63.7,0,0,0-6.23,49.17A61.5,61.5,0,0,0,52,104v8a60.1,60.1,0,0,0,45.76,58.28A43.66,43.66,0,0,0,92,192v4H76a20,20,0,0,1-20-20,44.05,44.05,0,0,0-44-44,12,12,0,0,0,0,24,20,20,0,0,1,20,20,44.05,44.05,0,0,0,44,44H92v12a12,12,0,0,0,24,0V192a20,20,0,0,1,40,0v40a12,12,0,0,0,24,0V192a43.66,43.66,0,0,0-5.76-21.72A60.1,60.1,0,0,0,220,112v-8A61.5,61.5,0,0,0,212.62,75.17ZM196,112a36,36,0,0,1-36,36H112a36,36,0,0,1-36-36v-8a37.87,37.87,0,0,1,6.13-20.12,11.65,11.65,0,0,0,1.58-11.49,39.9,39.9,0,0,1-.4-27.72,39.87,39.87,0,0,1,26.41,17.8A12,12,0,0,0,119.82,68h32.35a12,12,0,0,0,10.11-5.53,39.84,39.84,0,0,1,26.41-17.8,39.9,39.9,0,0,1-.4,27.72,12,12,0,0,0,1.61,11.53A37.85,37.85,0,0,1,196,104Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,bue,[...r[1]||=[R(`path`,{d:`M208,104v8a48,48,0,0,1-48,48H136a32,32,0,0,1,32,32v40H104V192a32,32,0,0,1,32-32H112a48,48,0,0,1-48-48v-8a49.28,49.28,0,0,1,8.51-27.3A51.92,51.92,0,0,1,76,32a52,52,0,0,1,43.83,24h32.34A52,52,0,0,1,196,32a51.92,51.92,0,0,1,3.49,44.7A49.28,49.28,0,0,1,208,104Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M208.3,75.68A59.74,59.74,0,0,0,202.93,28,8,8,0,0,0,196,24a59.75,59.75,0,0,0-48,24H124A59.75,59.75,0,0,0,76,24a8,8,0,0,0-6.93,4,59.78,59.78,0,0,0-5.38,47.68A58.14,58.14,0,0,0,56,104v8a56.06,56.06,0,0,0,48.44,55.47A39.8,39.8,0,0,0,96,192v8H72a24,24,0,0,1-24-24A40,40,0,0,0,8,136a8,8,0,0,0,0,16,24,24,0,0,1,24,24,40,40,0,0,0,40,40H96v16a8,8,0,0,0,16,0V192a24,24,0,0,1,48,0v40a8,8,0,0,0,16,0V192a39.8,39.8,0,0,0-8.44-24.53A56.06,56.06,0,0,0,216,112v-8A58,58,0,0,0,208.3,75.68ZM200,112a40,40,0,0,1-40,40H112a40,40,0,0,1-40-40v-8a41.74,41.74,0,0,1,6.9-22.48A8,8,0,0,0,80,73.83a43.81,43.81,0,0,1,.79-33.58,43.88,43.88,0,0,1,32.32,20.06A8,8,0,0,0,119.82,64h32.35a8,8,0,0,0,6.74-3.69,43.87,43.87,0,0,1,32.32-20.06A43.81,43.81,0,0,1,192,73.83a8.09,8.09,0,0,0,1,7.65A41.76,41.76,0,0,1,200,104Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,xue,[...r[2]||=[R(`path`,{d:`M216,104v8a56.06,56.06,0,0,1-48.44,55.47A39.8,39.8,0,0,1,176,192v40a8,8,0,0,1-8,8H104a8,8,0,0,1-8-8V216H72a40,40,0,0,1-40-40A24,24,0,0,0,8,152a8,8,0,0,1,0-16,40,40,0,0,1,40,40,24,24,0,0,0,24,24H96v-8a39.8,39.8,0,0,1,8.44-24.53A56.06,56.06,0,0,1,56,112v-8a58.14,58.14,0,0,1,7.69-28.32A59.78,59.78,0,0,1,69.07,28,8,8,0,0,1,76,24a59.75,59.75,0,0,1,48,24h24a59.75,59.75,0,0,1,48-24,8,8,0,0,1,6.93,4,59.74,59.74,0,0,1,5.37,47.68A58,58,0,0,1,216,104Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Sue,[...r[3]||=[R(`path`,{d:`M206.13,75.92A57.79,57.79,0,0,0,201.2,29a6,6,0,0,0-5.2-3,57.77,57.77,0,0,0-47,24H123A57.77,57.77,0,0,0,76,26a6,6,0,0,0-5.2,3,57.79,57.79,0,0,0-4.93,46.92A55.88,55.88,0,0,0,58,104v8a54.06,54.06,0,0,0,50.45,53.87A37.85,37.85,0,0,0,98,192v10H72a26,26,0,0,1-26-26A38,38,0,0,0,8,138a6,6,0,0,0,0,12,26,26,0,0,1,26,26,38,38,0,0,0,38,38H98v18a6,6,0,0,0,12,0V192a26,26,0,0,1,52,0v40a6,6,0,0,0,12,0V192a37.85,37.85,0,0,0-10.45-26.13A54.06,54.06,0,0,0,214,112v-8A55.88,55.88,0,0,0,206.13,75.92ZM202,112a42,42,0,0,1-42,42H112a42,42,0,0,1-42-42v-8a43.86,43.86,0,0,1,7.3-23.69,6,6,0,0,0,.81-5.76,45.85,45.85,0,0,1,1.43-36.42,45.85,45.85,0,0,1,35.23,21.1A6,6,0,0,0,119.83,62h32.34a6,6,0,0,0,5.06-2.76,45.83,45.83,0,0,1,35.23-21.11,45.85,45.85,0,0,1,1.43,36.42,6,6,0,0,0,.79,5.74A43.78,43.78,0,0,1,202,104Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Cue,[...r[4]||=[R(`path`,{d:`M208.31,75.68A59.78,59.78,0,0,0,202.93,28,8,8,0,0,0,196,24a59.75,59.75,0,0,0-48,24H124A59.75,59.75,0,0,0,76,24a8,8,0,0,0-6.93,4,59.78,59.78,0,0,0-5.38,47.68A58.14,58.14,0,0,0,56,104v8a56.06,56.06,0,0,0,48.44,55.47A39.8,39.8,0,0,0,96,192v8H72a24,24,0,0,1-24-24A40,40,0,0,0,8,136a8,8,0,0,0,0,16,24,24,0,0,1,24,24,40,40,0,0,0,40,40H96v16a8,8,0,0,0,16,0V192a24,24,0,0,1,48,0v40a8,8,0,0,0,16,0V192a39.8,39.8,0,0,0-8.44-24.53A56.06,56.06,0,0,0,216,112v-8A58.14,58.14,0,0,0,208.31,75.68ZM200,112a40,40,0,0,1-40,40H112a40,40,0,0,1-40-40v-8a41.74,41.74,0,0,1,6.9-22.48A8,8,0,0,0,80,73.83a43.81,43.81,0,0,1,.79-33.58,43.88,43.88,0,0,1,32.32,20.06A8,8,0,0,0,119.82,64h32.35a8,8,0,0,0,6.74-3.69,43.87,43.87,0,0,1,32.32-20.06A43.81,43.81,0,0,1,192,73.83a8.09,8.09,0,0,0,1,7.65A41.72,41.72,0,0,1,200,104Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,wue,[...r[5]||=[R(`path`,{d:`M203.94,76.16A55.73,55.73,0,0,0,199.46,30,4,4,0,0,0,196,28a55.78,55.78,0,0,0-46,24H122A55.78,55.78,0,0,0,76,28a4,4,0,0,0-3.46,2,55.73,55.73,0,0,0-4.48,46.16A53.78,53.78,0,0,0,60,104v8a52.06,52.06,0,0,0,52,52h1.41A36,36,0,0,0,100,192v12H72a28,28,0,0,1-28-28A36,36,0,0,0,8,140a4,4,0,0,0,0,8,28,28,0,0,1,28,28,36,36,0,0,0,36,36h28v20a4,4,0,0,0,8,0V192a28,28,0,0,1,56,0v40a4,4,0,0,0,8,0V192a36,36,0,0,0-13.41-28H160a52.06,52.06,0,0,0,52-52v-8A53.78,53.78,0,0,0,203.94,76.16ZM204,112a44.05,44.05,0,0,1-44,44H112a44.05,44.05,0,0,1-44-44v-8a45.76,45.76,0,0,1,7.71-24.89,4,4,0,0,0,.53-3.84,47.82,47.82,0,0,1,2.1-39.21,47.8,47.8,0,0,1,38.12,22.1A4,4,0,0,0,119.83,60h32.34a4,4,0,0,0,3.37-1.84,47.8,47.8,0,0,1,38.12-22.1,47.82,47.82,0,0,1,2.1,39.21,4,4,0,0,0,.53,3.83A45.85,45.85,0,0,1,204,104Z`},null,-1)]])):B(``,!0)],16))}})})),Due,Oue=s((()=>{Eue(),Due=Tue})),kue,Aue,jue,Mue,Nue,Pue,Fue,Iue=s((()=>{Hc(),W(),kue={key:0},Aue={key:1},jue={key:2},Mue={key:3},Nue={key:4},Pue={key:5},Fue=N({name:`ScalarIconGlobe`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,kue,[...r[0]||=[R(`path`,{d:`M128,20A108,108,0,1,0,236,128,108.12,108.12,0,0,0,128,20Zm0,187a113.4,113.4,0,0,1-20.39-35h40.82a116.94,116.94,0,0,1-10,20.77A108.61,108.61,0,0,1,128,207Zm-26.49-59a135.42,135.42,0,0,1,0-40h53a135.42,135.42,0,0,1,0,40ZM44,128a83.49,83.49,0,0,1,2.43-20H77.25a160.63,160.63,0,0,0,0,40H46.43A83.49,83.49,0,0,1,44,128Zm84-79a113.4,113.4,0,0,1,20.39,35H107.59a116.94,116.94,0,0,1,10-20.77A108.61,108.61,0,0,1,128,49Zm50.73,59h30.82a83.52,83.52,0,0,1,0,40H178.75a160.63,160.63,0,0,0,0-40Zm20.77-24H173.71a140.82,140.82,0,0,0-15.5-34.36A84.51,84.51,0,0,1,199.52,84ZM97.79,49.64A140.82,140.82,0,0,0,82.29,84H56.48A84.51,84.51,0,0,1,97.79,49.64ZM56.48,172H82.29a140.82,140.82,0,0,0,15.5,34.36A84.51,84.51,0,0,1,56.48,172Zm101.73,34.36A140.82,140.82,0,0,0,173.71,172h25.81A84.51,84.51,0,0,1,158.21,206.36Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Aue,[...r[1]||=[R(`path`,{d:`M224,128a96,96,0,1,1-96-96A96,96,0,0,1,224,128Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M128,24h0A104,104,0,1,0,232,128,104.12,104.12,0,0,0,128,24Zm88,104a87.61,87.61,0,0,1-3.33,24H174.16a157.44,157.44,0,0,0,0-48h38.51A87.61,87.61,0,0,1,216,128ZM102,168H154a115.11,115.11,0,0,1-26,45A115.27,115.27,0,0,1,102,168Zm-3.9-16a140.84,140.84,0,0,1,0-48h59.88a140.84,140.84,0,0,1,0,48ZM40,128a87.61,87.61,0,0,1,3.33-24H81.84a157.44,157.44,0,0,0,0,48H43.33A87.61,87.61,0,0,1,40,128ZM154,88H102a115.11,115.11,0,0,1,26-45A115.27,115.27,0,0,1,154,88Zm52.33,0H170.71a135.28,135.28,0,0,0-22.3-45.6A88.29,88.29,0,0,1,206.37,88ZM107.59,42.4A135.28,135.28,0,0,0,85.29,88H49.63A88.29,88.29,0,0,1,107.59,42.4ZM49.63,168H85.29a135.28,135.28,0,0,0,22.3,45.6A88.29,88.29,0,0,1,49.63,168Zm98.78,45.6a135.28,135.28,0,0,0,22.3-45.6h35.66A88.29,88.29,0,0,1,148.41,213.6Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,jue,[...r[2]||=[R(`path`,{d:`M128,24h0A104,104,0,1,0,232,128,104.12,104.12,0,0,0,128,24Zm78.36,64H170.71a135.28,135.28,0,0,0-22.3-45.6A88.29,88.29,0,0,1,206.37,88ZM216,128a87.61,87.61,0,0,1-3.33,24H174.16a157.44,157.44,0,0,0,0-48h38.51A87.61,87.61,0,0,1,216,128ZM128,43a115.27,115.27,0,0,1,26,45H102A115.11,115.11,0,0,1,128,43ZM102,168H154a115.11,115.11,0,0,1-26,45A115.27,115.27,0,0,1,102,168Zm-3.9-16a140.84,140.84,0,0,1,0-48h59.88a140.84,140.84,0,0,1,0,48Zm50.35,61.6a135.28,135.28,0,0,0,22.3-45.6h35.66A88.29,88.29,0,0,1,148.41,213.6Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Mue,[...r[3]||=[R(`path`,{d:`M128,26A102,102,0,1,0,230,128,102.12,102.12,0,0,0,128,26Zm81.57,64H169.19a132.58,132.58,0,0,0-25.73-50.67A90.29,90.29,0,0,1,209.57,90ZM218,128a89.7,89.7,0,0,1-3.83,26H171.81a155.43,155.43,0,0,0,0-52h42.36A89.7,89.7,0,0,1,218,128Zm-90,87.83a110,110,0,0,1-15.19-19.45A124.24,124.24,0,0,1,99.35,166h57.3a124.24,124.24,0,0,1-13.46,30.38A110,110,0,0,1,128,215.83ZM96.45,154a139.18,139.18,0,0,1,0-52h63.1a139.18,139.18,0,0,1,0,52ZM38,128a89.7,89.7,0,0,1,3.83-26H84.19a155.43,155.43,0,0,0,0,52H41.83A89.7,89.7,0,0,1,38,128Zm90-87.83a110,110,0,0,1,15.19,19.45A124.24,124.24,0,0,1,156.65,90H99.35a124.24,124.24,0,0,1,13.46-30.38A110,110,0,0,1,128,40.17Zm-15.46-.84A132.58,132.58,0,0,0,86.81,90H46.43A90.29,90.29,0,0,1,112.54,39.33ZM46.43,166H86.81a132.58,132.58,0,0,0,25.73,50.67A90.29,90.29,0,0,1,46.43,166Zm97,50.67A132.58,132.58,0,0,0,169.19,166h40.38A90.29,90.29,0,0,1,143.46,216.67Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Nue,[...r[4]||=[R(`path`,{d:`M128,24h0A104,104,0,1,0,232,128,104.12,104.12,0,0,0,128,24Zm88,104a87.61,87.61,0,0,1-3.33,24H174.16a157.44,157.44,0,0,0,0-48h38.51A87.61,87.61,0,0,1,216,128ZM102,168H154a115.11,115.11,0,0,1-26,45A115.27,115.27,0,0,1,102,168Zm-3.9-16a140.84,140.84,0,0,1,0-48h59.88a140.84,140.84,0,0,1,0,48ZM40,128a87.61,87.61,0,0,1,3.33-24H81.84a157.44,157.44,0,0,0,0,48H43.33A87.61,87.61,0,0,1,40,128ZM154,88H102a115.11,115.11,0,0,1,26-45A115.27,115.27,0,0,1,154,88Zm52.33,0H170.71a135.28,135.28,0,0,0-22.3-45.6A88.29,88.29,0,0,1,206.37,88ZM107.59,42.4A135.28,135.28,0,0,0,85.29,88H49.63A88.29,88.29,0,0,1,107.59,42.4ZM49.63,168H85.29a135.28,135.28,0,0,0,22.3,45.6A88.29,88.29,0,0,1,49.63,168Zm98.78,45.6a135.28,135.28,0,0,0,22.3-45.6h35.66A88.29,88.29,0,0,1,148.41,213.6Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Pue,[...r[5]||=[R(`path`,{d:`M128,28h0A100,100,0,1,0,228,128,100.11,100.11,0,0,0,128,28Zm0,190.61c-6.33-6.09-23-24.41-31.27-54.61h62.54C151,194.2,134.33,212.52,128,218.61ZM94.82,156a140.42,140.42,0,0,1,0-56h66.36a140.42,140.42,0,0,1,0,56ZM128,37.39c6.33,6.09,23,24.41,31.27,54.61H96.73C105,61.8,121.67,43.48,128,37.39ZM169.41,100h46.23a92.09,92.09,0,0,1,0,56H169.41a152.65,152.65,0,0,0,0-56Zm43.25-8h-45a129.39,129.39,0,0,0-29.19-55.4A92.25,92.25,0,0,1,212.66,92ZM117.54,36.6A129.39,129.39,0,0,0,88.35,92h-45A92.25,92.25,0,0,1,117.54,36.6ZM40.36,100H86.59a152.65,152.65,0,0,0,0,56H40.36a92.09,92.09,0,0,1,0-56Zm3,64h45a129.39,129.39,0,0,0,29.19,55.4A92.25,92.25,0,0,1,43.34,164Zm95.12,55.4A129.39,129.39,0,0,0,167.65,164h45A92.25,92.25,0,0,1,138.46,219.4Z`},null,-1)]])):B(``,!0)],16))}})})),Lue,Rue=s((()=>{Iue(),Lue=Fue})),zue,Bue,Vue,Hue,Uue,Wue,Gue,Kue=s((()=>{Hc(),W(),zue={key:0},Bue={key:1},Vue={key:2},Hue={key:3},Uue={key:4},Wue={key:5},Gue=N({name:`ScalarIconGlobeSimple`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,zue,[...r[0]||=[R(`path`,{d:`M128,20A108,108,0,1,0,236,128,108.12,108.12,0,0,0,128,20Zm83.13,96H179.56a144.3,144.3,0,0,0-21.35-66.36A84.22,84.22,0,0,1,211.13,116ZM128,207c-9.36-10.81-24.46-33.13-27.45-67h54.94a119.74,119.74,0,0,1-17.11,52.77A108.61,108.61,0,0,1,128,207Zm-27.45-91a119.74,119.74,0,0,1,17.11-52.77A108.61,108.61,0,0,1,128,49c9.36,10.81,24.46,33.13,27.45,67ZM97.79,49.64A144.3,144.3,0,0,0,76.44,116H44.87A84.22,84.22,0,0,1,97.79,49.64ZM44.87,140H76.44a144.3,144.3,0,0,0,21.35,66.36A84.22,84.22,0,0,1,44.87,140Zm113.34,66.36A144.3,144.3,0,0,0,179.56,140h31.57A84.22,84.22,0,0,1,158.21,206.36Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Bue,[...r[1]||=[R(`path`,{d:`M224,128a96,96,0,1,1-96-96A96,96,0,0,1,224,128Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M128,24h0A104,104,0,1,0,232,128,104.12,104.12,0,0,0,128,24Zm87.62,96H175.79C174,83.49,159.94,57.67,148.41,42.4A88.19,88.19,0,0,1,215.63,120ZM96.23,136h63.54c-2.31,41.61-22.23,67.11-31.77,77C118.45,203.1,98.54,177.6,96.23,136Zm0-16C98.54,78.39,118.46,52.89,128,43c9.55,9.93,29.46,35.43,31.77,77Zm11.36-77.6C96.06,57.67,82,83.49,80.21,120H40.37A88.19,88.19,0,0,1,107.59,42.4ZM40.37,136H80.21c1.82,36.51,15.85,62.33,27.38,77.6A88.19,88.19,0,0,1,40.37,136Zm108,77.6c11.53-15.27,25.56-41.09,27.38-77.6h39.84A88.19,88.19,0,0,1,148.41,213.6Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Vue,[...r[2]||=[R(`path`,{d:`M128,24h0A104,104,0,1,0,232,128,104.12,104.12,0,0,0,128,24Zm87.62,96H175.79C174,83.49,159.94,57.67,148.41,42.4A88.19,88.19,0,0,1,215.63,120ZM96.23,136h63.54c-2.31,41.61-22.23,67.11-31.77,77C118.45,203.1,98.54,177.6,96.23,136Zm0-16C98.54,78.39,118.46,52.89,128,43c9.55,9.93,29.46,35.43,31.77,77Zm52.18,93.6c11.53-15.27,25.56-41.09,27.38-77.6h39.84A88.19,88.19,0,0,1,148.41,213.6Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Hue,[...r[3]||=[R(`path`,{d:`M128,26A102,102,0,1,0,230,128,102.12,102.12,0,0,0,128,26Zm89.8,96H173.89c-1.54-40.77-18.48-68.23-30.43-82.67A90.19,90.19,0,0,1,217.8,122ZM128,215.83a110,110,0,0,1-15.19-19.45A128.37,128.37,0,0,1,94.13,134h67.74a128.37,128.37,0,0,1-18.68,62.38A110,110,0,0,1,128,215.83ZM94.13,122a128.37,128.37,0,0,1,18.68-62.38A110,110,0,0,1,128,40.17a110,110,0,0,1,15.19,19.45A128.37,128.37,0,0,1,161.87,122Zm18.41-82.67c-12,14.44-28.89,41.9-30.43,82.67H38.2A90.19,90.19,0,0,1,112.54,39.33ZM38.2,134H82.11c1.54,40.77,18.48,68.23,30.43,82.67A90.19,90.19,0,0,1,38.2,134Zm105.26,82.67c11.95-14.44,28.89-41.9,30.43-82.67H217.8A90.19,90.19,0,0,1,143.46,216.67Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Uue,[...r[4]||=[R(`path`,{d:`M128,24h0A104,104,0,1,0,232,128,104.12,104.12,0,0,0,128,24Zm87.62,96H175.79C174,83.49,159.94,57.67,148.41,42.4A88.19,88.19,0,0,1,215.63,120ZM96.23,136h63.54c-2.31,41.61-22.23,67.11-31.77,77C118.45,203.1,98.54,177.6,96.23,136Zm0-16C98.54,78.39,118.46,52.89,128,43c9.55,9.93,29.46,35.43,31.77,77Zm11.36-77.6C96.06,57.67,82,83.49,80.21,120H40.37A88.19,88.19,0,0,1,107.59,42.4ZM40.37,136H80.21c1.82,36.51,15.85,62.33,27.38,77.6A88.19,88.19,0,0,1,40.37,136Zm108,77.6c11.53-15.27,25.56-41.09,27.38-77.6h39.84A88.19,88.19,0,0,1,148.41,213.6Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Wue,[...r[5]||=[R(`path`,{d:`M128,28h0A100,100,0,1,0,228,128,100.11,100.11,0,0,0,128,28Zm91.9,96h-48c-1.15-45.55-21.74-74.52-33.48-87.4A92.14,92.14,0,0,1,219.91,124ZM128,218.61c-8.32-8-34.57-37.13-35.93-86.61h71.86C162.57,181.48,136.32,210.61,128,218.61ZM92.07,124C93.43,74.52,119.68,45.39,128,37.39c8.32,8,34.57,37.13,35.93,86.61Zm25.47-87.4C105.8,49.48,85.21,78.45,84.06,124h-48A92.14,92.14,0,0,1,117.54,36.6ZM36.09,132h48c1.15,45.55,21.74,74.52,33.48,87.4A92.14,92.14,0,0,1,36.09,132Zm102.37,87.4c11.74-12.88,32.33-41.85,33.48-87.4h48A92.14,92.14,0,0,1,138.46,219.4Z`},null,-1)]])):B(``,!0)],16))}})})),que,Jue=s((()=>{Kue(),que=Gue})),Yue,Xue,Zue,Que,$ue,ede,tde,nde=s((()=>{Hc(),W(),Yue={key:0},Xue={key:1},Zue={key:2},Que={key:3},$ue={key:4},ede={key:5},tde=N({name:`ScalarIconHash`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Yue,[...r[0]||=[R(`path`,{d:`M224,84H180.2l7.61-41.85a12,12,0,0,0-23.62-4.3L155.8,84H116.2l7.61-41.85a12,12,0,1,0-23.62-4.3L91.8,84H48a12,12,0,0,0,0,24H87.44l-7.27,40H32a12,12,0,0,0,0,24H75.8l-7.61,41.85a12,12,0,0,0,9.66,14A11.43,11.43,0,0,0,80,228a12,12,0,0,0,11.8-9.86L100.2,172h39.6l-7.61,41.85a12,12,0,0,0,9.66,14,11.43,11.43,0,0,0,2.16.2,12,12,0,0,0,11.8-9.86L164.2,172H208a12,12,0,0,0,0-24H168.56l7.27-40H224a12,12,0,0,0,0-24Zm-79.83,64H104.56l7.27-40h39.61Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Xue,[...r[1]||=[R(`path`,{d:`M165.82,96l-11.64,64h-64l11.64-64Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M224,88H175.4l8.47-46.57a8,8,0,0,0-15.74-2.86l-9,49.43H111.4l8.47-46.57a8,8,0,0,0-15.74-2.86L95.14,88H48a8,8,0,0,0,0,16H92.23L83.5,152H32a8,8,0,0,0,0,16H80.6l-8.47,46.57a8,8,0,0,0,6.44,9.3A7.79,7.79,0,0,0,80,224a8,8,0,0,0,7.86-6.57l9-49.43H144.6l-8.47,46.57a8,8,0,0,0,6.44,9.3A7.79,7.79,0,0,0,144,224a8,8,0,0,0,7.86-6.57l9-49.43H208a8,8,0,0,0,0-16H163.77l8.73-48H224a8,8,0,0,0,0-16Zm-76.5,64H99.77l8.73-48h47.73Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Zue,[...r[2]||=[R(`path`,{d:`M116.25,112h31.5l-8,32h-31.5ZM224,48V208a16,16,0,0,1-16,16H48a16,16,0,0,1-16-16V48A16,16,0,0,1,48,32H208A16,16,0,0,1,224,48Zm-16,56a8,8,0,0,0-8-8H168.25l7.51-30.06a8,8,0,0,0-15.52-3.88L151.75,96h-31.5l7.51-30.06a8,8,0,0,0-15.52-3.88L103.75,96H64a8,8,0,0,0,0,16H99.75l-8,32H56a8,8,0,0,0,0,16H87.75l-7.51,30.06a8,8,0,0,0,5.82,9.7,8.13,8.13,0,0,0,2,.24,8,8,0,0,0,7.75-6.06L104.25,160h31.5l-7.51,30.06a8,8,0,0,0,5.82,9.7A8.13,8.13,0,0,0,136,200a8,8,0,0,0,7.75-6.06L152.25,160H192a8,8,0,0,0,0-16H156.25l8-32H200A8,8,0,0,0,208,104Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Que,[...r[3]||=[R(`path`,{d:`M224,90H173l8.89-48.93a6,6,0,1,0-11.8-2.14L160.81,90H109l8.89-48.93a6,6,0,0,0-11.8-2.14L96.81,90H48a6,6,0,0,0,0,12H94.63l-9.46,52H32a6,6,0,0,0,0,12H83L74.1,214.93a6,6,0,0,0,4.83,7A5.64,5.64,0,0,0,80,222a6,6,0,0,0,5.89-4.93L95.19,166H147l-8.89,48.93a6,6,0,0,0,4.83,7,5.64,5.64,0,0,0,1.08.1,6,6,0,0,0,5.89-4.93L159.19,166H208a6,6,0,0,0,0-12H161.37l9.46-52H224a6,6,0,0,0,0-12Zm-74.83,64H97.37l9.46-52h51.8Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,$ue,[...r[4]||=[R(`path`,{d:`M224,88H175.4l8.47-46.57a8,8,0,0,0-15.74-2.86l-9,49.43H111.4l8.47-46.57a8,8,0,0,0-15.74-2.86L95.14,88H48a8,8,0,0,0,0,16H92.23L83.5,152H32a8,8,0,0,0,0,16H80.6l-8.47,46.57a8,8,0,0,0,6.44,9.3A7.79,7.79,0,0,0,80,224a8,8,0,0,0,7.86-6.57l9-49.43H144.6l-8.47,46.57a8,8,0,0,0,6.44,9.3A7.79,7.79,0,0,0,144,224a8,8,0,0,0,7.86-6.57l9-49.43H208a8,8,0,0,0,0-16H163.77l8.73-48H224a8,8,0,0,0,0-16Zm-76.5,64H99.77l8.73-48h47.73Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,ede,[...r[5]||=[R(`path`,{d:`M224,92H170.61l9.33-51.28a4,4,0,1,0-7.88-1.44L162.48,92H106.61l9.33-51.28a4,4,0,1,0-7.88-1.44L98.48,92H48a4,4,0,0,0,0,8H97L86.84,156H32a4,4,0,0,0,0,8H85.39l-9.33,51.28a4,4,0,0,0,3.22,4.65A3.65,3.65,0,0,0,80,220a4,4,0,0,0,3.94-3.29L93.52,164h55.87l-9.33,51.28a4,4,0,0,0,3.22,4.65,3.65,3.65,0,0,0,.72.07,4,4,0,0,0,3.94-3.29L157.52,164H208a4,4,0,0,0,0-8H159l10.19-56H224a4,4,0,0,0,0-8Zm-73.16,64H95l10.19-56H161Z`},null,-1)]])):B(``,!0)],16))}})})),rde,ide=s((()=>{nde(),rde=tde})),ade,ode,sde,cde,lde,ude,dde,fde=s((()=>{Hc(),W(),ade={key:0},ode={key:1},sde={key:2},cde={key:3},lde={key:4},ude={key:5},dde=N({name:`ScalarIconHouse`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,ade,[...r[0]||=[R(`path`,{d:`M222.14,105.85l-80-80a20,20,0,0,0-28.28,0l-80,80A19.86,19.86,0,0,0,28,120v96a12,12,0,0,0,12,12h64a12,12,0,0,0,12-12V164h24v52a12,12,0,0,0,12,12h64a12,12,0,0,0,12-12V120A19.86,19.86,0,0,0,222.14,105.85ZM204,204H164V152a12,12,0,0,0-12-12H104a12,12,0,0,0-12,12v52H52V121.65l76-76,76,76Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,ode,[...r[1]||=[R(`path`,{d:`M216,120v96H152V152H104v64H40V120a8,8,0,0,1,2.34-5.66l80-80a8,8,0,0,1,11.32,0l80,80A8,8,0,0,1,216,120Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M219.31,108.68l-80-80a16,16,0,0,0-22.62,0l-80,80A15.87,15.87,0,0,0,32,120v96a8,8,0,0,0,8,8h64a8,8,0,0,0,8-8V160h32v56a8,8,0,0,0,8,8h64a8,8,0,0,0,8-8V120A15.87,15.87,0,0,0,219.31,108.68ZM208,208H160V152a8,8,0,0,0-8-8H104a8,8,0,0,0-8,8v56H48V120l80-80,80,80Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,sde,[...r[2]||=[R(`path`,{d:`M224,120v96a8,8,0,0,1-8,8H160a8,8,0,0,1-8-8V164a4,4,0,0,0-4-4H108a4,4,0,0,0-4,4v52a8,8,0,0,1-8,8H40a8,8,0,0,1-8-8V120a16,16,0,0,1,4.69-11.31l80-80a16,16,0,0,1,22.62,0l80,80A16,16,0,0,1,224,120Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,cde,[...r[3]||=[R(`path`,{d:`M217.9,110.1l-80-80a14,14,0,0,0-19.8,0l-80,80A13.92,13.92,0,0,0,34,120v96a6,6,0,0,0,6,6h64a6,6,0,0,0,6-6V158h36v58a6,6,0,0,0,6,6h64a6,6,0,0,0,6-6V120A13.92,13.92,0,0,0,217.9,110.1ZM210,210H158V152a6,6,0,0,0-6-6H104a6,6,0,0,0-6,6v58H46V120a2,2,0,0,1,.58-1.42l80-80a2,2,0,0,1,2.84,0l80,80A2,2,0,0,1,210,120Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,lde,[...r[4]||=[R(`path`,{d:`M219.31,108.68l-80-80a16,16,0,0,0-22.62,0l-80,80A15.87,15.87,0,0,0,32,120v96a8,8,0,0,0,8,8h64a8,8,0,0,0,8-8V160h32v56a8,8,0,0,0,8,8h64a8,8,0,0,0,8-8V120A15.87,15.87,0,0,0,219.31,108.68ZM208,208H160V152a8,8,0,0,0-8-8H104a8,8,0,0,0-8,8v56H48V120l80-80,80,80Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,ude,[...r[5]||=[R(`path`,{d:`M216.49,111.51l-80-80a12,12,0,0,0-17,0l-80,80A12,12,0,0,0,36,120v96a4,4,0,0,0,4,4h64a4,4,0,0,0,4-4V156h40v60a4,4,0,0,0,4,4h64a4,4,0,0,0,4-4V120A12,12,0,0,0,216.49,111.51ZM212,212H156V152a4,4,0,0,0-4-4H104a4,4,0,0,0-4,4v60H44V120a4,4,0,0,1,1.17-2.83l80-80a4,4,0,0,1,5.66,0l80,80A4,4,0,0,1,212,120Z`},null,-1)]])):B(``,!0)],16))}})})),pde,mde=s((()=>{fde(),pde=dde})),hde,gde,_de,vde,yde,bde,xde,Sde=s((()=>{Hc(),W(),hde={key:0},gde={key:1},_de={key:2},vde={key:3},yde={key:4},bde={key:5},xde=N({name:`ScalarIconInfo`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,hde,[...r[0]||=[R(`path`,{d:`M108,84a16,16,0,1,1,16,16A16,16,0,0,1,108,84Zm128,44A108,108,0,1,1,128,20,108.12,108.12,0,0,1,236,128Zm-24,0a84,84,0,1,0-84,84A84.09,84.09,0,0,0,212,128Zm-72,36.68V132a20,20,0,0,0-20-20,12,12,0,0,0-4,23.32V168a20,20,0,0,0,20,20,12,12,0,0,0,4-23.32Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,gde,[...r[1]||=[R(`path`,{d:`M224,128a96,96,0,1,1-96-96A96,96,0,0,1,224,128Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M144,176a8,8,0,0,1-8,8,16,16,0,0,1-16-16V128a8,8,0,0,1,0-16,16,16,0,0,1,16,16v40A8,8,0,0,1,144,176Zm88-48A104,104,0,1,1,128,24,104.11,104.11,0,0,1,232,128Zm-16,0a88,88,0,1,0-88,88A88.1,88.1,0,0,0,216,128ZM124,96a12,12,0,1,0-12-12A12,12,0,0,0,124,96Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,_de,[...r[2]||=[R(`path`,{d:`M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm-4,48a12,12,0,1,1-12,12A12,12,0,0,1,124,72Zm12,112a16,16,0,0,1-16-16V128a8,8,0,0,1,0-16,16,16,0,0,1,16,16v40a8,8,0,0,1,0,16Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,vde,[...r[3]||=[R(`path`,{d:`M142,176a6,6,0,0,1-6,6,14,14,0,0,1-14-14V128a2,2,0,0,0-2-2,6,6,0,0,1,0-12,14,14,0,0,1,14,14v40a2,2,0,0,0,2,2A6,6,0,0,1,142,176ZM124,94a10,10,0,1,0-10-10A10,10,0,0,0,124,94Zm106,34A102,102,0,1,1,128,26,102.12,102.12,0,0,1,230,128Zm-12,0a90,90,0,1,0-90,90A90.1,90.1,0,0,0,218,128Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,yde,[...r[4]||=[R(`path`,{d:`M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm0,192a88,88,0,1,1,88-88A88.1,88.1,0,0,1,128,216Zm16-40a8,8,0,0,1-8,8,16,16,0,0,1-16-16V128a8,8,0,0,1,0-16,16,16,0,0,1,16,16v40A8,8,0,0,1,144,176ZM112,84a12,12,0,1,1,12,12A12,12,0,0,1,112,84Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,bde,[...r[5]||=[R(`path`,{d:`M140,176a4,4,0,0,1-4,4,12,12,0,0,1-12-12V128a4,4,0,0,0-4-4,4,4,0,0,1,0-8,12,12,0,0,1,12,12v40a4,4,0,0,0,4,4A4,4,0,0,1,140,176ZM124,92a8,8,0,1,0-8-8A8,8,0,0,0,124,92Zm104,36A100,100,0,1,1,128,28,100.11,100.11,0,0,1,228,128Zm-8,0a92,92,0,1,0-92,92A92.1,92.1,0,0,0,220,128Z`},null,-1)]])):B(``,!0)],16))}})})),gu,Cde=s((()=>{Sde(),gu=xde})),wde,Tde,Ede,Dde,Ode,kde,Ade,jde=s((()=>{Hc(),W(),wde={key:0},Tde={key:1},Ede={key:2},Dde={key:3},Ode={key:4},kde={key:5},Ade=N({name:`ScalarIconLink`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,wde,[...r[0]||=[R(`path`,{d:`M117.18,188.74a12,12,0,0,1,0,17l-5.12,5.12A58.26,58.26,0,0,1,70.6,228h0A58.62,58.62,0,0,1,29.14,127.92L63.89,93.17a58.64,58.64,0,0,1,98.56,28.11,12,12,0,1,1-23.37,5.44,34.65,34.65,0,0,0-58.22-16.58L46.11,144.89A34.62,34.62,0,0,0,70.57,204h0a34.41,34.41,0,0,0,24.49-10.14l5.11-5.12A12,12,0,0,1,117.18,188.74ZM226.83,45.17a58.65,58.65,0,0,0-82.93,0l-5.11,5.11a12,12,0,0,0,17,17l5.12-5.12a34.63,34.63,0,1,1,49,49L175.1,145.86A34.39,34.39,0,0,1,150.61,156h0a34.63,34.63,0,0,1-33.69-26.72,12,12,0,0,0-23.38,5.44A58.64,58.64,0,0,0,150.56,180h.05a58.28,58.28,0,0,0,41.47-17.17l34.75-34.75a58.62,58.62,0,0,0,0-82.91Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Tde,[...r[1]||=[R(`path`,{d:`M218.34,119.6,183.6,154.34a46.58,46.58,0,0,1-44.31,12.26c-.31.34-.62.67-.95,1L103.6,202.34A46.63,46.63,0,1,1,37.66,136.4L72.4,101.66A46.6,46.6,0,0,1,116.71,89.4c.31-.34.62-.67,1-1L152.4,53.66a46.63,46.63,0,0,1,65.94,65.94Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M240,88.23a54.43,54.43,0,0,1-16,37L189.25,160a54.27,54.27,0,0,1-38.63,16h-.05A54.63,54.63,0,0,1,96,119.84a8,8,0,0,1,16,.45A38.62,38.62,0,0,0,150.58,160h0a38.39,38.39,0,0,0,27.31-11.31l34.75-34.75a38.63,38.63,0,0,0-54.63-54.63l-11,11A8,8,0,0,1,135.7,59l11-11A54.65,54.65,0,0,1,224,48,54.86,54.86,0,0,1,240,88.23ZM109,185.66l-11,11A38.41,38.41,0,0,1,70.6,208h0a38.63,38.63,0,0,1-27.29-65.94L78,107.31A38.63,38.63,0,0,1,144,135.71a8,8,0,0,0,7.78,8.22H152a8,8,0,0,0,8-7.78A54.86,54.86,0,0,0,144,96a54.65,54.65,0,0,0-77.27,0L32,130.75A54.62,54.62,0,0,0,70.56,224h0a54.28,54.28,0,0,0,38.64-16l11-11A8,8,0,0,0,109,185.66Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Ede,[...r[2]||=[R(`path`,{d:`M208,32H48A16,16,0,0,0,32,48V208a16,16,0,0,0,16,16H208a16,16,0,0,0,16-16V48A16,16,0,0,0,208,32ZM115.7,192.49a43.31,43.31,0,0,1-55-66.43l25.37-25.37a43.35,43.35,0,0,1,61.25,0,42.9,42.9,0,0,1,9.95,15.43,8,8,0,1,1-15,5.6A27.33,27.33,0,0,0,97.37,112L72,137.37a27.32,27.32,0,0,0,34.68,41.91,8,8,0,1,1,9,13.21Zm79.61-62.55-25.37,25.37A43,43,0,0,1,139.32,168h0a43.35,43.35,0,0,1-40.53-28.12,8,8,0,1,1,15-5.6A27.35,27.35,0,0,0,139.28,152h0a27.14,27.14,0,0,0,19.32-8L184,118.63a27.32,27.32,0,0,0-34.68-41.91,8,8,0,1,1-9-13.21,43.32,43.32,0,0,1,55,66.43Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Dde,[...r[3]||=[R(`path`,{d:`M238,88.18a52.42,52.42,0,0,1-15.4,35.66l-34.75,34.75A52.28,52.28,0,0,1,150.62,174h-.05A52.63,52.63,0,0,1,98,119.9a6,6,0,0,1,6-5.84h.17a6,6,0,0,1,5.83,6.16A40.62,40.62,0,0,0,150.58,162h0a40.4,40.4,0,0,0,28.73-11.9l34.75-34.74A40.63,40.63,0,0,0,156.63,57.9l-11,11a6,6,0,0,1-8.49-8.49l11-11a52.62,52.62,0,0,1,74.43,0A52.83,52.83,0,0,1,238,88.18Zm-127.62,98.9-11,11A40.36,40.36,0,0,1,70.6,210h0a40.63,40.63,0,0,1-28.7-69.36L76.62,105.9A40.63,40.63,0,0,1,146,135.77a6,6,0,0,0,5.83,6.16H152a6,6,0,0,0,6-5.84A52.63,52.63,0,0,0,68.14,97.42L33.38,132.16A52.63,52.63,0,0,0,70.56,222h0a52.26,52.26,0,0,0,37.22-15.42l11-11a6,6,0,1,0-8.49-8.48Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Ode,[...r[4]||=[R(`path`,{d:`M240,88.23a54.43,54.43,0,0,1-16,37L189.25,160a54.27,54.27,0,0,1-38.63,16h-.05A54.63,54.63,0,0,1,96,119.84a8,8,0,0,1,16,.45A38.62,38.62,0,0,0,150.58,160h0a38.39,38.39,0,0,0,27.31-11.31l34.75-34.75a38.63,38.63,0,0,0-54.63-54.63l-11,11A8,8,0,0,1,135.7,59l11-11A54.65,54.65,0,0,1,224,48,54.86,54.86,0,0,1,240,88.23ZM109,185.66l-11,11A38.41,38.41,0,0,1,70.6,208h0a38.63,38.63,0,0,1-27.29-65.94L78,107.31A38.63,38.63,0,0,1,144,135.71a8,8,0,0,0,16,.45A54.86,54.86,0,0,0,144,96a54.65,54.65,0,0,0-77.27,0L32,130.75A54.62,54.62,0,0,0,70.56,224h0a54.28,54.28,0,0,0,38.64-16l11-11A8,8,0,0,0,109,185.66Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,kde,[...r[5]||=[R(`path`,{d:`M236,88.12a50.44,50.44,0,0,1-14.81,34.31l-34.75,34.74A50.33,50.33,0,0,1,150.62,172h-.05A50.63,50.63,0,0,1,100,120a4,4,0,0,1,4-3.89h.11a4,4,0,0,1,3.89,4.11A42.64,42.64,0,0,0,150.58,164h0a42.32,42.32,0,0,0,30.14-12.49l34.75-34.74a42.63,42.63,0,1,0-60.29-60.28l-11,11a4,4,0,0,1-5.66-5.65l11-11A50.64,50.64,0,0,1,236,88.12ZM111.78,188.49l-11,11A42.33,42.33,0,0,1,70.6,212h0a42.63,42.63,0,0,1-30.11-72.77l34.75-34.74A42.63,42.63,0,0,1,148,135.82a4,4,0,0,0,8,.23A50.64,50.64,0,0,0,69.55,98.83L34.8,133.57A50.63,50.63,0,0,0,70.56,220h0a50.33,50.33,0,0,0,35.81-14.83l11-11a4,4,0,1,0-5.65-5.66Z`},null,-1)]])):B(``,!0)],16))}})})),Mde,Nde=s((()=>{jde(),Mde=Ade})),Pde,Fde,Ide,Lde,Rde,zde,Bde,Vde=s((()=>{Hc(),W(),Pde={key:0},Fde={key:1},Ide={key:2},Lde={key:3},Rde={key:4},zde={key:5},Bde=N({name:`ScalarIconList`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Pde,[...r[0]||=[R(`path`,{d:`M228,128a12,12,0,0,1-12,12H40a12,12,0,0,1,0-24H216A12,12,0,0,1,228,128ZM40,76H216a12,12,0,0,0,0-24H40a12,12,0,0,0,0,24ZM216,180H40a12,12,0,0,0,0,24H216a12,12,0,0,0,0-24Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Fde,[...r[1]||=[R(`path`,{d:`M216,64V192H40V64Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M224,128a8,8,0,0,1-8,8H40a8,8,0,0,1,0-16H216A8,8,0,0,1,224,128ZM40,72H216a8,8,0,0,0,0-16H40a8,8,0,0,0,0,16ZM216,184H40a8,8,0,0,0,0,16H216a8,8,0,0,0,0-16Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Ide,[...r[2]||=[R(`path`,{d:`M208,32H48A16,16,0,0,0,32,48V208a16,16,0,0,0,16,16H208a16,16,0,0,0,16-16V48A16,16,0,0,0,208,32ZM192,184H64a8,8,0,0,1,0-16H192a8,8,0,0,1,0,16Zm0-48H64a8,8,0,0,1,0-16H192a8,8,0,0,1,0,16Zm0-48H64a8,8,0,0,1,0-16H192a8,8,0,0,1,0,16Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Lde,[...r[3]||=[R(`path`,{d:`M222,128a6,6,0,0,1-6,6H40a6,6,0,0,1,0-12H216A6,6,0,0,1,222,128ZM40,70H216a6,6,0,0,0,0-12H40a6,6,0,0,0,0,12ZM216,186H40a6,6,0,0,0,0,12H216a6,6,0,0,0,0-12Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Rde,[...r[4]||=[R(`path`,{d:`M224,128a8,8,0,0,1-8,8H40a8,8,0,0,1,0-16H216A8,8,0,0,1,224,128ZM40,72H216a8,8,0,0,0,0-16H40a8,8,0,0,0,0,16ZM216,184H40a8,8,0,0,0,0,16H216a8,8,0,0,0,0-16Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,zde,[...r[5]||=[R(`path`,{d:`M220,128a4,4,0,0,1-4,4H40a4,4,0,0,1,0-8H216A4,4,0,0,1,220,128ZM40,68H216a4,4,0,0,0,0-8H40a4,4,0,0,0,0,8ZM216,188H40a4,4,0,0,0,0,8H216a4,4,0,0,0,0-8Z`},null,-1)]])):B(``,!0)],16))}})})),Hde,Ude=s((()=>{Vde(),Hde=Bde})),Wde,Gde,Kde,qde,Jde,Yde,Xde,Zde=s((()=>{Hc(),W(),Wde={key:0},Gde={key:1},Kde={key:2},qde={key:3},Jde={key:4},Yde={key:5},Xde=N({name:`ScalarIconLockSimple`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Wde,[...r[0]||=[R(`path`,{d:`M208,76H180V56A52,52,0,0,0,76,56V76H48A20,20,0,0,0,28,96V208a20,20,0,0,0,20,20H208a20,20,0,0,0,20-20V96A20,20,0,0,0,208,76ZM100,56a28,28,0,0,1,56,0V76H100ZM204,204H52V100H204Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Gde,[...r[1]||=[R(`path`,{d:`M216,96V208a8,8,0,0,1-8,8H48a8,8,0,0,1-8-8V96a8,8,0,0,1,8-8H208A8,8,0,0,1,216,96Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M208,80H176V56a48,48,0,0,0-96,0V80H48A16,16,0,0,0,32,96V208a16,16,0,0,0,16,16H208a16,16,0,0,0,16-16V96A16,16,0,0,0,208,80ZM96,56a32,32,0,0,1,64,0V80H96ZM208,208H48V96H208V208Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Kde,[...r[2]||=[R(`path`,{d:`M208,80H176V56a48,48,0,0,0-96,0V80H48A16,16,0,0,0,32,96V208a16,16,0,0,0,16,16H208a16,16,0,0,0,16-16V96A16,16,0,0,0,208,80ZM96,56a32,32,0,0,1,64,0V80H96Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,qde,[...r[3]||=[R(`path`,{d:`M208,82H174V56a46,46,0,0,0-92,0V82H48A14,14,0,0,0,34,96V208a14,14,0,0,0,14,14H208a14,14,0,0,0,14-14V96A14,14,0,0,0,208,82ZM94,56a34,34,0,0,1,68,0V82H94ZM210,208a2,2,0,0,1-2,2H48a2,2,0,0,1-2-2V96a2,2,0,0,1,2-2H208a2,2,0,0,1,2,2Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Jde,[...r[4]||=[R(`path`,{d:`M208,80H176V56a48,48,0,0,0-96,0V80H48A16,16,0,0,0,32,96V208a16,16,0,0,0,16,16H208a16,16,0,0,0,16-16V96A16,16,0,0,0,208,80ZM96,56a32,32,0,0,1,64,0V80H96ZM208,208H48V96H208V208Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Yde,[...r[5]||=[R(`path`,{d:`M208,84H172V56a44,44,0,0,0-88,0V84H48A12,12,0,0,0,36,96V208a12,12,0,0,0,12,12H208a12,12,0,0,0,12-12V96A12,12,0,0,0,208,84ZM92,56a36,36,0,0,1,72,0V84H92ZM212,208a4,4,0,0,1-4,4H48a4,4,0,0,1-4-4V96a4,4,0,0,1,4-4H208a4,4,0,0,1,4,4Z`},null,-1)]])):B(``,!0)],16))}})})),_u,Qde=s((()=>{Zde(),_u=Xde})),$de,efe,tfe,nfe,rfe,ife,afe,ofe=s((()=>{Hc(),W(),$de={key:0},efe={key:1},tfe={key:2},nfe={key:3},rfe={key:4},ife={key:5},afe=N({name:`ScalarIconLockSimpleOpen`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,$de,[...r[0]||=[R(`path`,{d:`M208,76H100V56a28,28,0,0,1,28-28c13.51,0,25.65,9.62,28.24,22.39a12,12,0,1,0,23.52-4.78C174.87,21.5,153.1,4,128,4A52.06,52.06,0,0,0,76,56V76H48A20,20,0,0,0,28,96V208a20,20,0,0,0,20,20H208a20,20,0,0,0,20-20V96A20,20,0,0,0,208,76Zm-4,128H52V100H204Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,efe,[...r[1]||=[R(`path`,{d:`M216,96V208a8,8,0,0,1-8,8H48a8,8,0,0,1-8-8V96a8,8,0,0,1,8-8H208A8,8,0,0,1,216,96Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M208,80H96V56a32,32,0,0,1,32-32c15.37,0,29.2,11,32.16,25.59a8,8,0,0,0,15.68-3.18C171.32,24.15,151.2,8,128,8A48.05,48.05,0,0,0,80,56V80H48A16,16,0,0,0,32,96V208a16,16,0,0,0,16,16H208a16,16,0,0,0,16-16V96A16,16,0,0,0,208,80Zm0,128H48V96H208V208Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,tfe,[...r[2]||=[R(`path`,{d:`M224,96V208a16,16,0,0,1-16,16H48a16,16,0,0,1-16-16V96A16,16,0,0,1,48,80H80V56A48.05,48.05,0,0,1,128,8c23.2,0,43.32,16.15,47.84,38.41a8,8,0,0,1-15.68,3.18C157.2,35,143.37,24,128,24A32,32,0,0,0,96,56V80H208A16,16,0,0,1,224,96Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,nfe,[...r[3]||=[R(`path`,{d:`M208,82H94V56a34,34,0,0,1,34-34c16.3,0,31,11.69,34.12,27.19a6,6,0,0,0,11.76-2.38C169.55,25.48,150.26,10,128,10A46.06,46.06,0,0,0,82,56V82H48A14,14,0,0,0,34,96V208a14,14,0,0,0,14,14H208a14,14,0,0,0,14-14V96A14,14,0,0,0,208,82Zm2,126a2,2,0,0,1-2,2H48a2,2,0,0,1-2-2V96a2,2,0,0,1,2-2H208a2,2,0,0,1,2,2Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,rfe,[...r[4]||=[R(`path`,{d:`M208,80H96V56a32,32,0,0,1,32-32c15.37,0,29.2,11,32.16,25.59a8,8,0,0,0,15.68-3.18C171.32,24.15,151.2,8,128,8A48.05,48.05,0,0,0,80,56V80H48A16,16,0,0,0,32,96V208a16,16,0,0,0,16,16H208a16,16,0,0,0,16-16V96A16,16,0,0,0,208,80Zm0,128H48V96H208V208Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,ife,[...r[5]||=[R(`path`,{d:`M208,84H92V56a36,36,0,0,1,36-36c17.24,0,32.75,12.38,36.08,28.8a4,4,0,1,0,7.84-1.6C167.78,26.81,149.31,12,128,12A44.05,44.05,0,0,0,84,56V84H48A12,12,0,0,0,36,96V208a12,12,0,0,0,12,12H208a12,12,0,0,0,12-12V96A12,12,0,0,0,208,84Zm4,124a4,4,0,0,1-4,4H48a4,4,0,0,1-4-4V96a4,4,0,0,1,4-4H208a4,4,0,0,1,4,4Z`},null,-1)]])):B(``,!0)],16))}})})),sfe,cfe=s((()=>{ofe(),sfe=afe})),lfe,ufe,dfe,ffe,pfe,mfe,hfe,gfe=s((()=>{Hc(),W(),lfe={key:0},ufe={key:1},dfe={key:2},ffe={key:3},pfe={key:4},mfe={key:5},hfe=N({name:`ScalarIconMagnifyingGlass`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,lfe,[...r[0]||=[R(`path`,{d:`M232.49,215.51,185,168a92.12,92.12,0,1,0-17,17l47.53,47.54a12,12,0,0,0,17-17ZM44,112a68,68,0,1,1,68,68A68.07,68.07,0,0,1,44,112Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,ufe,[...r[1]||=[R(`path`,{d:`M192,112a80,80,0,1,1-80-80A80,80,0,0,1,192,112Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M229.66,218.34,179.6,168.28a88.21,88.21,0,1,0-11.32,11.31l50.06,50.07a8,8,0,0,0,11.32-11.32ZM40,112a72,72,0,1,1,72,72A72.08,72.08,0,0,1,40,112Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,dfe,[...r[2]||=[R(`path`,{d:`M168,112a56,56,0,1,1-56-56A56,56,0,0,1,168,112Zm61.66,117.66a8,8,0,0,1-11.32,0l-50.06-50.07a88,88,0,1,1,11.32-11.31l50.06,50.06A8,8,0,0,1,229.66,229.66ZM112,184a72,72,0,1,0-72-72A72.08,72.08,0,0,0,112,184Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,ffe,[...r[3]||=[R(`path`,{d:`M228.24,219.76l-51.38-51.38a86.15,86.15,0,1,0-8.48,8.48l51.38,51.38a6,6,0,0,0,8.48-8.48ZM38,112a74,74,0,1,1,74,74A74.09,74.09,0,0,1,38,112Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,pfe,[...r[4]||=[R(`path`,{d:`M229.66,218.34l-50.07-50.06a88.11,88.11,0,1,0-11.31,11.31l50.06,50.07a8,8,0,0,0,11.32-11.32ZM40,112a72,72,0,1,1,72,72A72.08,72.08,0,0,1,40,112Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,mfe,[...r[5]||=[R(`path`,{d:`M226.83,221.17l-52.7-52.7a84.1,84.1,0,1,0-5.66,5.66l52.7,52.7a4,4,0,0,0,5.66-5.66ZM36,112a76,76,0,1,1,76,76A76.08,76.08,0,0,1,36,112Z`},null,-1)]])):B(``,!0)],16))}})})),vu,_fe=s((()=>{gfe(),vu=hfe})),vfe,yfe,bfe,xfe,Sfe,Cfe,wfe,Tfe=s((()=>{Hc(),W(),vfe={key:0},yfe={key:1},bfe={key:2},xfe={key:3},Sfe={key:4},Cfe={key:5},wfe=N({name:`ScalarIconMinus`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,vfe,[...r[0]||=[R(`path`,{d:`M228,128a12,12,0,0,1-12,12H40a12,12,0,0,1,0-24H216A12,12,0,0,1,228,128Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,yfe,[...r[1]||=[R(`path`,{d:`M216,56V200a16,16,0,0,1-16,16H56a16,16,0,0,1-16-16V56A16,16,0,0,1,56,40H200A16,16,0,0,1,216,56Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M224,128a8,8,0,0,1-8,8H40a8,8,0,0,1,0-16H216A8,8,0,0,1,224,128Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,bfe,[...r[2]||=[R(`path`,{d:`M208,32H48A16,16,0,0,0,32,48V208a16,16,0,0,0,16,16H208a16,16,0,0,0,16-16V48A16,16,0,0,0,208,32ZM184,136H72a8,8,0,0,1,0-16H184a8,8,0,0,1,0,16Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,xfe,[...r[3]||=[R(`path`,{d:`M222,128a6,6,0,0,1-6,6H40a6,6,0,0,1,0-12H216A6,6,0,0,1,222,128Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Sfe,[...r[4]||=[R(`path`,{d:`M224,128a8,8,0,0,1-8,8H40a8,8,0,0,1,0-16H216A8,8,0,0,1,224,128Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Cfe,[...r[5]||=[R(`path`,{d:`M220,128a4,4,0,0,1-4,4H40a4,4,0,0,1,0-8H216A4,4,0,0,1,220,128Z`},null,-1)]])):B(``,!0)],16))}})})),Efe,Dfe=s((()=>{Tfe(),Efe=wfe})),Ofe,kfe,Afe,jfe,Mfe,Nfe,Pfe,Ffe=s((()=>{Hc(),W(),Ofe={key:0},kfe={key:1},Afe={key:2},jfe={key:3},Mfe={key:4},Nfe={key:5},Pfe=N({name:`ScalarIconNotepad`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Ofe,[...r[0]||=[R(`path`,{d:`M172,124a12,12,0,0,1-12,12H96a12,12,0,0,1,0-24h64A12,12,0,0,1,172,124Zm-12,28H96a12,12,0,0,0,0,24h64a12,12,0,0,0,0-24ZM220,40V200a36,36,0,0,1-36,36H72a36,36,0,0,1-36-36V40A12,12,0,0,1,48,28H72V24a12,12,0,0,1,24,0v4h20V24a12,12,0,0,1,24,0v4h20V24a12,12,0,0,1,24,0v4h24A12,12,0,0,1,220,40ZM196,52H184v4a12,12,0,0,1-24,0V52H140v4a12,12,0,0,1-24,0V52H96v4a12,12,0,0,1-24,0V52H60V200a12,12,0,0,0,12,12H184a12,12,0,0,0,12-12Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,kfe,[...r[1]||=[R(`path`,{d:`M208,40V200a24,24,0,0,1-24,24H72a24,24,0,0,1-24-24V40Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M168,128a8,8,0,0,1-8,8H96a8,8,0,0,1,0-16h64A8,8,0,0,1,168,128Zm-8,24H96a8,8,0,0,0,0,16h64a8,8,0,0,0,0-16ZM216,40V200a32,32,0,0,1-32,32H72a32,32,0,0,1-32-32V40a8,8,0,0,1,8-8H72V24a8,8,0,0,1,16,0v8h32V24a8,8,0,0,1,16,0v8h32V24a8,8,0,0,1,16,0v8h24A8,8,0,0,1,216,40Zm-16,8H184v8a8,8,0,0,1-16,0V48H136v8a8,8,0,0,1-16,0V48H88v8a8,8,0,0,1-16,0V48H56V200a16,16,0,0,0,16,16H184a16,16,0,0,0,16-16Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Afe,[...r[2]||=[R(`path`,{d:`M208,32H184V24a8,8,0,0,0-16,0v8H136V24a8,8,0,0,0-16,0v8H88V24a8,8,0,0,0-16,0v8H48a8,8,0,0,0-8,8V200a32,32,0,0,0,32,32H184a32,32,0,0,0,32-32V40A8,8,0,0,0,208,32ZM120,56a8,8,0,0,1,16,0v8a8,8,0,0,1-16,0ZM80,72a8,8,0,0,1-8-8V56a8,8,0,0,1,16,0v8A8,8,0,0,1,80,72Zm80,96H96a8,8,0,0,1,0-16h64a8,8,0,0,1,0,16Zm0-32H96a8,8,0,0,1,0-16h64a8,8,0,0,1,0,16Zm24-72a8,8,0,0,1-16,0V56a8,8,0,0,1,16,0Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,jfe,[...r[3]||=[R(`path`,{d:`M166,128a6,6,0,0,1-6,6H96a6,6,0,0,1,0-12h64A6,6,0,0,1,166,128Zm-6,26H96a6,6,0,0,0,0,12h64a6,6,0,0,0,0-12ZM214,40V200a30,30,0,0,1-30,30H72a30,30,0,0,1-30-30V40a6,6,0,0,1,6-6H74V24a6,6,0,0,1,12,0V34h36V24a6,6,0,0,1,12,0V34h36V24a6,6,0,0,1,12,0V34h26A6,6,0,0,1,214,40Zm-12,6H182V56a6,6,0,0,1-12,0V46H134V56a6,6,0,0,1-12,0V46H86V56a6,6,0,0,1-12,0V46H54V200a18,18,0,0,0,18,18H184a18,18,0,0,0,18-18Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Mfe,[...r[4]||=[R(`path`,{d:`M168,128a8,8,0,0,1-8,8H96a8,8,0,0,1,0-16h64A8,8,0,0,1,168,128Zm-8,24H96a8,8,0,0,0,0,16h64a8,8,0,0,0,0-16ZM216,40V200a32,32,0,0,1-32,32H72a32,32,0,0,1-32-32V40a8,8,0,0,1,8-8H72V24a8,8,0,0,1,16,0v8h32V24a8,8,0,0,1,16,0v8h32V24a8,8,0,0,1,16,0v8h24A8,8,0,0,1,216,40Zm-16,8H184v8a8,8,0,0,1-16,0V48H136v8a8,8,0,0,1-16,0V48H88v8a8,8,0,0,1-16,0V48H56V200a16,16,0,0,0,16,16H184a16,16,0,0,0,16-16Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Nfe,[...r[5]||=[R(`path`,{d:`M164,128a4,4,0,0,1-4,4H96a4,4,0,0,1,0-8h64A4,4,0,0,1,164,128Zm-4,28H96a4,4,0,0,0,0,8h64a4,4,0,0,0,0-8ZM212,40V200a28,28,0,0,1-28,28H72a28,28,0,0,1-28-28V40a4,4,0,0,1,4-4H76V24a4,4,0,0,1,8,0V36h40V24a4,4,0,0,1,8,0V36h40V24a4,4,0,0,1,8,0V36h28A4,4,0,0,1,212,40Zm-8,4H180V56a4,4,0,0,1-8,0V44H132V56a4,4,0,0,1-8,0V44H84V56a4,4,0,0,1-8,0V44H52V200a20,20,0,0,0,20,20H184a20,20,0,0,0,20-20Z`},null,-1)]])):B(``,!0)],16))}})})),Ife,Lfe=s((()=>{Ffe(),Ife=Pfe})),Rfe,zfe,Bfe,Vfe,Hfe,Ufe,Wfe,Gfe=s((()=>{Hc(),W(),Rfe={key:0},zfe={key:1},Bfe={key:2},Vfe={key:3},Hfe={key:4},Ufe={key:5},Wfe=N({name:`ScalarIconPencilSimple`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Rfe,[...r[0]||=[R(`path`,{d:`M230.14,70.54,185.46,25.85a20,20,0,0,0-28.29,0L33.86,149.17A19.85,19.85,0,0,0,28,163.31V208a20,20,0,0,0,20,20H92.69a19.86,19.86,0,0,0,14.14-5.86L230.14,98.82a20,20,0,0,0,0-28.28ZM91,204H52V165l84-84,39,39ZM192,103,153,64l18.34-18.34,39,39Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,zfe,[...r[1]||=[R(`path`,{d:`M221.66,90.34,192,120,136,64l29.66-29.66a8,8,0,0,1,11.31,0L221.66,79A8,8,0,0,1,221.66,90.34Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M227.31,73.37,182.63,28.68a16,16,0,0,0-22.63,0L36.69,152A15.86,15.86,0,0,0,32,163.31V208a16,16,0,0,0,16,16H92.69A15.86,15.86,0,0,0,104,219.31L227.31,96a16,16,0,0,0,0-22.63ZM92.69,208H48V163.31l88-88L180.69,120ZM192,108.68,147.31,64l24-24L216,84.68Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Bfe,[...r[2]||=[R(`path`,{d:`M227.31,73.37,182.63,28.68a16,16,0,0,0-22.63,0L36.69,152A15.86,15.86,0,0,0,32,163.31V208a16,16,0,0,0,16,16H92.69A15.86,15.86,0,0,0,104,219.31L227.31,96a16,16,0,0,0,0-22.63ZM192,108.68,147.31,64l24-24L216,84.68Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Vfe,[...r[3]||=[R(`path`,{d:`M225.9,74.78,181.21,30.09a14,14,0,0,0-19.8,0L38.1,153.41a13.94,13.94,0,0,0-4.1,9.9V208a14,14,0,0,0,14,14H92.69a13.94,13.94,0,0,0,9.9-4.1L225.9,94.58a14,14,0,0,0,0-19.8ZM94.1,209.41a2,2,0,0,1-1.41.59H48a2,2,0,0,1-2-2V163.31a2,2,0,0,1,.59-1.41L136,72.48,183.51,120ZM217.41,86.1,192,111.51,144.49,64,169.9,38.58a2,2,0,0,1,2.83,0l44.68,44.69a2,2,0,0,1,0,2.83Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Hfe,[...r[4]||=[R(`path`,{d:`M227.31,73.37,182.63,28.68a16,16,0,0,0-22.63,0L36.69,152A15.86,15.86,0,0,0,32,163.31V208a16,16,0,0,0,16,16H92.69A15.86,15.86,0,0,0,104,219.31L227.31,96a16,16,0,0,0,0-22.63ZM92.69,208H48V163.31l88-88L180.69,120ZM192,108.68,147.31,64l24-24L216,84.68Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Ufe,[...r[5]||=[R(`path`,{d:`M224.49,76.2,179.8,31.51a12,12,0,0,0-17,0L133.17,61.17h0L39.52,154.83A11.9,11.9,0,0,0,36,163.31V208a12,12,0,0,0,12,12H92.69a12,12,0,0,0,8.48-3.51L224.48,93.17a12,12,0,0,0,0-17Zm-129,134.63A4,4,0,0,1,92.69,212H48a4,4,0,0,1-4-4V163.31a4,4,0,0,1,1.17-2.83L136,69.65,186.34,120ZM218.83,87.51,192,114.34,141.66,64l26.82-26.83a4,4,0,0,1,5.66,0l44.69,44.68a4,4,0,0,1,0,5.66Z`},null,-1)]])):B(``,!0)],16))}})})),yu,Kfe=s((()=>{Gfe(),yu=Wfe})),qfe,Jfe,Yfe,Xfe,Zfe,Qfe,$fe,epe=s((()=>{Hc(),W(),qfe={key:0},Jfe={key:1},Yfe={key:2},Xfe={key:3},Zfe={key:4},Qfe={key:5},$fe=N({name:`ScalarIconPlay`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,qfe,[...r[0]||=[R(`path`,{d:`M234.49,111.07,90.41,22.94A20,20,0,0,0,60,39.87V216.13a20,20,0,0,0,30.41,16.93l144.08-88.13a19.82,19.82,0,0,0,0-33.86ZM84,208.85V47.15L216.16,128Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Jfe,[...r[1]||=[R(`path`,{d:`M228.23,134.69,84.15,222.81A8,8,0,0,1,72,216.12V39.88a8,8,0,0,1,12.15-6.69l144.08,88.12A7.82,7.82,0,0,1,228.23,134.69Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M232.4,114.49,88.32,26.35a16,16,0,0,0-16.2-.3A15.86,15.86,0,0,0,64,39.87V216.13A15.94,15.94,0,0,0,80,232a16.07,16.07,0,0,0,8.36-2.35L232.4,141.51a15.81,15.81,0,0,0,0-27ZM80,215.94V40l143.83,88Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Yfe,[...r[2]||=[R(`path`,{d:`M240,128a15.74,15.74,0,0,1-7.6,13.51L88.32,229.65a16,16,0,0,1-16.2.3A15.86,15.86,0,0,1,64,216.13V39.87a15.86,15.86,0,0,1,8.12-13.82,16,16,0,0,1,16.2.3L232.4,114.49A15.74,15.74,0,0,1,240,128Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Xfe,[...r[3]||=[R(`path`,{d:`M231.36,116.19,87.28,28.06a14,14,0,0,0-14.18-.27A13.69,13.69,0,0,0,66,39.87V216.13a13.69,13.69,0,0,0,7.1,12.08,14,14,0,0,0,14.18-.27l144.08-88.13a13.82,13.82,0,0,0,0-23.62Zm-6.26,13.38L81,217.7a2,2,0,0,1-2.06,0,1.78,1.78,0,0,1-1-1.61V39.87a1.78,1.78,0,0,1,1-1.61A2.06,2.06,0,0,1,80,38a2,2,0,0,1,1,.31L225.1,126.43a1.82,1.82,0,0,1,0,3.14Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Zfe,[...r[4]||=[R(`path`,{d:`M232.4,114.49,88.32,26.35a16,16,0,0,0-16.2-.3A15.86,15.86,0,0,0,64,39.87V216.13A15.94,15.94,0,0,0,80,232a16.07,16.07,0,0,0,8.36-2.35L232.4,141.51a15.81,15.81,0,0,0,0-27ZM80,215.94V40l143.83,88Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Qfe,[...r[5]||=[R(`path`,{d:`M230.32,117.9,86.24,29.79a11.91,11.91,0,0,0-12.17-.23A11.71,11.71,0,0,0,68,39.89V216.11a11.71,11.71,0,0,0,6.07,10.33,11.91,11.91,0,0,0,12.17-.23L230.32,138.1a11.82,11.82,0,0,0,0-20.2Zm-4.18,13.37L82.06,219.39a4,4,0,0,1-4.07.07,3.77,3.77,0,0,1-2-3.35V39.89a3.77,3.77,0,0,1,2-3.35,4,4,0,0,1,4.07.07l144.08,88.12a3.8,3.8,0,0,1,0,6.54Z`},null,-1)]])):B(``,!0)],16))}})})),bu,tpe=s((()=>{epe(),bu=$fe})),npe,rpe,ipe,ape,ope,spe,cpe,lpe=s((()=>{Hc(),W(),npe={key:0},rpe={key:1},ipe={key:2},ape={key:3},ope={key:4},spe={key:5},cpe=N({name:`ScalarIconPlus`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,npe,[...r[0]||=[R(`path`,{d:`M228,128a12,12,0,0,1-12,12H140v76a12,12,0,0,1-24,0V140H40a12,12,0,0,1,0-24h76V40a12,12,0,0,1,24,0v76h76A12,12,0,0,1,228,128Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,rpe,[...r[1]||=[R(`path`,{d:`M216,56V200a16,16,0,0,1-16,16H56a16,16,0,0,1-16-16V56A16,16,0,0,1,56,40H200A16,16,0,0,1,216,56Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M224,128a8,8,0,0,1-8,8H136v80a8,8,0,0,1-16,0V136H40a8,8,0,0,1,0-16h80V40a8,8,0,0,1,16,0v80h80A8,8,0,0,1,224,128Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,ipe,[...r[2]||=[R(`path`,{d:`M208,32H48A16,16,0,0,0,32,48V208a16,16,0,0,0,16,16H208a16,16,0,0,0,16-16V48A16,16,0,0,0,208,32ZM184,136H136v48a8,8,0,0,1-16,0V136H72a8,8,0,0,1,0-16h48V72a8,8,0,0,1,16,0v48h48a8,8,0,0,1,0,16Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,ape,[...r[3]||=[R(`path`,{d:`M222,128a6,6,0,0,1-6,6H134v82a6,6,0,0,1-12,0V134H40a6,6,0,0,1,0-12h82V40a6,6,0,0,1,12,0v82h82A6,6,0,0,1,222,128Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,ope,[...r[4]||=[R(`path`,{d:`M224,128a8,8,0,0,1-8,8H136v80a8,8,0,0,1-16,0V136H40a8,8,0,0,1,0-16h80V40a8,8,0,0,1,16,0v80h80A8,8,0,0,1,224,128Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,spe,[...r[5]||=[R(`path`,{d:`M220,128a4,4,0,0,1-4,4H132v84a4,4,0,0,1-8,0V132H40a4,4,0,0,1,0-8h84V40a4,4,0,0,1,8,0v84h84A4,4,0,0,1,220,128Z`},null,-1)]])):B(``,!0)],16))}})})),xu,upe=s((()=>{lpe(),xu=cpe})),dpe,fpe,ppe,mpe,hpe,gpe,_pe,vpe=s((()=>{Hc(),W(),dpe={key:0},fpe={key:1},ppe={key:2},mpe={key:3},hpe={key:4},gpe={key:5},_pe=N({name:`ScalarIconScroll`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,dpe,[...r[0]||=[R(`path`,{d:`M92,92a12,12,0,0,1,12-12h60a12,12,0,0,1,0,24H104A12,12,0,0,1,92,92Zm12,52h60a12,12,0,0,0,0-24H104a12,12,0,0,0,0,24Zm132,48a36,36,0,0,1-36,36H88a36,36,0,0,1-36-36V64a12,12,0,0,0-24,0c0,3.73,3.35,6.51,3.38,6.54l-.18-.14h0A12,12,0,1,1,16.81,89.59h0C15.49,88.62,4,79.55,4,64A36,36,0,0,1,40,28H176a36,36,0,0,1,36,36V164h4a12,12,0,0,1,7.2,2.4C224.51,167.38,236,176.45,236,192ZM92.62,172.2A12,12,0,0,1,104,164h84V64a12,12,0,0,0-12-12H73.94A35.88,35.88,0,0,1,76,64V192a12,12,0,0,0,24,0c0-3.58-3.17-6.38-3.2-6.4A12,12,0,0,1,92.62,172.2ZM212,192a7.69,7.69,0,0,0-1.24-4h-87a30.32,30.32,0,0,1,.26,4,35.84,35.84,0,0,1-2.06,12H200A12,12,0,0,0,212,192Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,fpe,[...r[1]||=[R(`path`,{d:`M200,176H104s8,6,8,16a24,24,0,0,1-48,0V64A24,24,0,0,0,40,40H176a24,24,0,0,1,24,24Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M96,104a8,8,0,0,1,8-8h64a8,8,0,0,1,0,16H104A8,8,0,0,1,96,104Zm8,40h64a8,8,0,0,0,0-16H104a8,8,0,0,0,0,16Zm128,48a32,32,0,0,1-32,32H88a32,32,0,0,1-32-32V64a16,16,0,0,0-32,0c0,5.74,4.83,9.62,4.88,9.66h0A8,8,0,0,1,24,88a7.89,7.89,0,0,1-4.79-1.61h0C18.05,85.54,8,77.61,8,64A32,32,0,0,1,40,32H176a32,32,0,0,1,32,32V168h8a8,8,0,0,1,4.8,1.6C222,170.46,232,178.39,232,192ZM96.26,173.48A8.07,8.07,0,0,1,104,168h88V64a16,16,0,0,0-16-16H67.69A31.71,31.71,0,0,1,72,64V192a16,16,0,0,0,32,0c0-5.74-4.83-9.62-4.88-9.66A7.82,7.82,0,0,1,96.26,173.48ZM216,192a12.58,12.58,0,0,0-3.23-8h-94a26.92,26.92,0,0,1,1.21,8,31.82,31.82,0,0,1-4.29,16H200A16,16,0,0,0,216,192Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,ppe,[...r[2]||=[R(`path`,{d:`M220.8,169.6A8,8,0,0,0,216,168h-8V64a32,32,0,0,0-32-32H40A32,32,0,0,0,8,64C8,77.61,18.05,85.54,19.2,86.4h0A7.89,7.89,0,0,0,24,88a8,8,0,0,0,4.87-14.33h0C28.83,73.62,24,69.74,24,64a16,16,0,0,1,32,0V192a32,32,0,0,0,32,32H200a32,32,0,0,0,32-32C232,178.39,222,170.46,220.8,169.6ZM104,96h64a8,8,0,0,1,0,16H104a8,8,0,0,1,0-16Zm-8,40a8,8,0,0,1,8-8h64a8,8,0,0,1,0,16H104A8,8,0,0,1,96,136Zm104,72H107.71A31.82,31.82,0,0,0,112,192a26.92,26.92,0,0,0-1.21-8h102a12.58,12.58,0,0,1,3.23,8A16,16,0,0,1,200,208Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,mpe,[...r[3]||=[R(`path`,{d:`M98,136a6,6,0,0,1,6-6h64a6,6,0,0,1,0,12H104A6,6,0,0,1,98,136Zm6-26h64a6,6,0,0,0,0-12H104a6,6,0,0,0,0,12Zm126,82a30,30,0,0,1-30,30H88a30,30,0,0,1-30-30V64a18,18,0,0,0-36,0c0,6.76,5.58,11.19,5.64,11.23A6,6,0,1,1,20.4,84.8C20,84.48,10,76.85,10,64A30,30,0,0,1,40,34H176a30,30,0,0,1,30,30V170h10a6,6,0,0,1,3.6,1.2C220,171.52,230,179.15,230,192Zm-124,0c0-6.76-5.59-11.19-5.64-11.23A6,6,0,0,1,104,170h90V64a18,18,0,0,0-18-18H64a29.82,29.82,0,0,1,6,18V192a18,18,0,0,0,36,0Zm112,0a14.94,14.94,0,0,0-4.34-10H115.88A24.83,24.83,0,0,1,118,192a29.87,29.87,0,0,1-6,18h88A18,18,0,0,0,218,192Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,hpe,[...r[4]||=[R(`path`,{d:`M96,104a8,8,0,0,1,8-8h64a8,8,0,0,1,0,16H104A8,8,0,0,1,96,104Zm8,40h64a8,8,0,0,0,0-16H104a8,8,0,0,0,0,16Zm128,48a32,32,0,0,1-32,32H88a32,32,0,0,1-32-32V64a16,16,0,0,0-32,0c0,5.74,4.83,9.62,4.88,9.66h0A8,8,0,0,1,24,88a7.89,7.89,0,0,1-4.79-1.61h0C18.05,85.54,8,77.61,8,64A32,32,0,0,1,40,32H176a32,32,0,0,1,32,32V168h8a8,8,0,0,1,4.8,1.6C222,170.46,232,178.39,232,192ZM96.26,173.48A8.07,8.07,0,0,1,104,168h88V64a16,16,0,0,0-16-16H67.69A31.71,31.71,0,0,1,72,64V192a16,16,0,0,0,32,0c0-5.74-4.83-9.62-4.88-9.66A7.82,7.82,0,0,1,96.26,173.48ZM216,192a12.58,12.58,0,0,0-3.23-8h-94a26.92,26.92,0,0,1,1.21,8,31.82,31.82,0,0,1-4.29,16H200A16,16,0,0,0,216,192Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,gpe,[...r[5]||=[R(`path`,{d:`M100,104a4,4,0,0,1,4-4h64a4,4,0,0,1,0,8H104A4,4,0,0,1,100,104Zm4,36h64a4,4,0,0,0,0-8H104a4,4,0,0,0,0,8Zm124,52a28,28,0,0,1-28,28H88a28,28,0,0,1-28-28V64a20,20,0,0,0-40,0c0,7.78,6.34,12.75,6.4,12.8a4,4,0,1,1-4.8,6.4C21.21,82.91,12,75.86,12,64A28,28,0,0,1,40,36H176a28,28,0,0,1,28,28V172h12a4,4,0,0,1,2.4.8C218.79,173.09,228,180.14,228,192Zm-120,0c0-7.78-6.34-12.75-6.4-12.8A4,4,0,0,1,104,172h92V64a20,20,0,0,0-20-20H59.57A27.9,27.9,0,0,1,68,64V192a20,20,0,0,0,40,0Zm112,0c0-6-3.74-10.3-5.5-12H112.61A23.31,23.31,0,0,1,116,192a27.94,27.94,0,0,1-8.42,20H200A20,20,0,0,0,220,192Z`},null,-1)]])):B(``,!0)],16))}})})),ype,bpe=s((()=>{vpe(),ype=_pe})),xpe,Spe,Cpe,wpe,Tpe,Epe,Dpe,Ope=s((()=>{Hc(),W(),xpe={key:0},Spe={key:1},Cpe={key:2},wpe={key:3},Tpe={key:4},Epe={key:5},Dpe=N({name:`ScalarIconSparkle`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,xpe,[...r[0]||=[R(`path`,{d:`M199,125.31l-49.88-18.39L130.69,57a19.92,19.92,0,0,0-37.38,0L74.92,106.92,25,125.31a19.92,19.92,0,0,0,0,37.38l49.88,18.39L93.31,231a19.92,19.92,0,0,0,37.38,0l18.39-49.88L199,162.69a19.92,19.92,0,0,0,0-37.38Zm-63.38,35.16a12,12,0,0,0-7.11,7.11L112,212.28l-16.47-44.7a12,12,0,0,0-7.11-7.11L43.72,144l44.7-16.47a12,12,0,0,0,7.11-7.11L112,75.72l16.47,44.7a12,12,0,0,0,7.11,7.11L180.28,144ZM140,40a12,12,0,0,1,12-12h12V16a12,12,0,0,1,24,0V28h12a12,12,0,0,1,0,24H188V64a12,12,0,0,1-24,0V52H152A12,12,0,0,1,140,40ZM252,88a12,12,0,0,1-12,12h-4v4a12,12,0,0,1-24,0v-4h-4a12,12,0,0,1,0-24h4V72a12,12,0,0,1,24,0v4h4A12,12,0,0,1,252,88Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Spe,[...r[1]||=[R(`path`,{d:`M194.82,151.43l-55.09,20.3-20.3,55.09a7.92,7.92,0,0,1-14.86,0l-20.3-55.09-55.09-20.3a7.92,7.92,0,0,1,0-14.86l55.09-20.3,20.3-55.09a7.92,7.92,0,0,1,14.86,0l20.3,55.09,55.09,20.3A7.92,7.92,0,0,1,194.82,151.43Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M197.58,129.06,146,110l-19-51.62a15.92,15.92,0,0,0-29.88,0L78,110l-51.62,19a15.92,15.92,0,0,0,0,29.88L78,178l19,51.62a15.92,15.92,0,0,0,29.88,0L146,178l51.62-19a15.92,15.92,0,0,0,0-29.88ZM137,164.22a8,8,0,0,0-4.74,4.74L112,223.85,91.78,169A8,8,0,0,0,87,164.22L32.15,144,87,123.78A8,8,0,0,0,91.78,119L112,64.15,132.22,119a8,8,0,0,0,4.74,4.74L191.85,144ZM144,40a8,8,0,0,1,8-8h16V16a8,8,0,0,1,16,0V32h16a8,8,0,0,1,0,16H184V64a8,8,0,0,1-16,0V48H152A8,8,0,0,1,144,40ZM248,88a8,8,0,0,1-8,8h-8v8a8,8,0,0,1-16,0V96h-8a8,8,0,0,1,0-16h8V72a8,8,0,0,1,16,0v8h8A8,8,0,0,1,248,88Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Cpe,[...r[2]||=[R(`path`,{d:`M208,144a15.78,15.78,0,0,1-10.42,14.94L146,178l-19,51.62a15.92,15.92,0,0,1-29.88,0L78,178l-51.62-19a15.92,15.92,0,0,1,0-29.88L78,110l19-51.62a15.92,15.92,0,0,1,29.88,0L146,110l51.62,19A15.78,15.78,0,0,1,208,144ZM152,48h16V64a8,8,0,0,0,16,0V48h16a8,8,0,0,0,0-16H184V16a8,8,0,0,0-16,0V32H152a8,8,0,0,0,0,16Zm88,32h-8V72a8,8,0,0,0-16,0v8h-8a8,8,0,0,0,0,16h8v8a8,8,0,0,0,16,0V96h8a8,8,0,0,0,0-16Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,wpe,[...r[3]||=[R(`path`,{d:`M196.89,130.94,144.4,111.6,125.06,59.11a13.92,13.92,0,0,0-26.12,0L79.6,111.6,27.11,130.94a13.92,13.92,0,0,0,0,26.12L79.6,176.4l19.34,52.49a13.92,13.92,0,0,0,26.12,0L144.4,176.4l52.49-19.34a13.92,13.92,0,0,0,0-26.12Zm-4.15,14.86-55.08,20.3a6,6,0,0,0-3.56,3.56l-20.3,55.08a1.92,1.92,0,0,1-3.6,0L89.9,169.66a6,6,0,0,0-3.56-3.56L31.26,145.8a1.92,1.92,0,0,1,0-3.6l55.08-20.3a6,6,0,0,0,3.56-3.56l20.3-55.08a1.92,1.92,0,0,1,3.6,0l20.3,55.08a6,6,0,0,0,3.56,3.56l55.08,20.3a1.92,1.92,0,0,1,0,3.6ZM146,40a6,6,0,0,1,6-6h18V16a6,6,0,0,1,12,0V34h18a6,6,0,0,1,0,12H182V64a6,6,0,0,1-12,0V46H152A6,6,0,0,1,146,40ZM246,88a6,6,0,0,1-6,6H230v10a6,6,0,0,1-12,0V94H208a6,6,0,0,1,0-12h10V72a6,6,0,0,1,12,0V82h10A6,6,0,0,1,246,88Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Tpe,[...r[4]||=[R(`path`,{d:`M197.58,129.06,146,110l-19-51.62a15.92,15.92,0,0,0-29.88,0L78,110l-51.62,19a15.92,15.92,0,0,0,0,29.88L78,178l19,51.62a15.92,15.92,0,0,0,29.88,0L146,178l51.62-19a15.92,15.92,0,0,0,0-29.88ZM137,164.22a8,8,0,0,0-4.74,4.74L112,223.85,91.78,169A8,8,0,0,0,87,164.22L32.15,144,87,123.78A8,8,0,0,0,91.78,119L112,64.15,132.22,119a8,8,0,0,0,4.74,4.74L191.85,144ZM144,40a8,8,0,0,1,8-8h16V16a8,8,0,0,1,16,0V32h16a8,8,0,0,1,0,16H184V64a8,8,0,0,1-16,0V48H152A8,8,0,0,1,144,40ZM248,88a8,8,0,0,1-8,8h-8v8a8,8,0,0,1-16,0V96h-8a8,8,0,0,1,0-16h8V72a8,8,0,0,1,16,0v8h8A8,8,0,0,1,248,88Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Epe,[...r[5]||=[R(`path`,{d:`M196.2,132.81l-53.36-19.65L123.19,59.8a11.93,11.93,0,0,0-22.38,0L81.16,113.16,27.8,132.81a11.93,11.93,0,0,0,0,22.38l53.36,19.65,19.65,53.36a11.93,11.93,0,0,0,22.38,0l19.65-53.36,53.36-19.65a11.93,11.93,0,0,0,0-22.38Zm-2.77,14.87L138.35,168a4,4,0,0,0-2.37,2.37l-20.3,55.08a3.92,3.92,0,0,1-7.36,0L88,170.35A4,4,0,0,0,85.65,168l-55.08-20.3a3.92,3.92,0,0,1,0-7.36L85.65,120A4,4,0,0,0,88,117.65l20.3-55.08a3.92,3.92,0,0,1,7.36,0L136,117.65a4,4,0,0,0,2.37,2.37l55.08,20.3a3.92,3.92,0,0,1,0,7.36ZM148,40a4,4,0,0,1,4-4h20V16a4,4,0,0,1,8,0V36h20a4,4,0,0,1,0,8H180V64a4,4,0,0,1-8,0V44H152A4,4,0,0,1,148,40Zm96,48a4,4,0,0,1-4,4H228v12a4,4,0,0,1-8,0V92H208a4,4,0,0,1,0-8h12V72a4,4,0,0,1,8,0V84h12A4,4,0,0,1,244,88Z`},null,-1)]])):B(``,!0)],16))}})})),Su,kpe=s((()=>{Ope(),Su=Dpe})),Ape,jpe,Mpe,Npe,Ppe,Fpe,Ipe,Lpe=s((()=>{Hc(),W(),Ape={key:0},jpe={key:1},Mpe={key:2},Npe={key:3},Ppe={key:4},Fpe={key:5},Ipe=N({name:`ScalarIconSwap`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Ape,[...r[0]||=[R(`path`,{d:`M228,48V152a20,20,0,0,1-20,20H112.92a12,12,0,0,1-17.41,16.49l-20-20a12,12,0,0,1,0-17l20-20A12,12,0,0,1,112.92,148H204V52H100a12,12,0,0,1-24,0V48A20,20,0,0,1,96,28H208A20,20,0,0,1,228,48ZM168,192a12,12,0,0,0-12,12H52V108h91.08a12,12,0,0,0,17.41,16.49l20-20a12,12,0,0,0,0-17l-20-20A12,12,0,0,0,143.08,84H48a20,20,0,0,0-20,20V208a20,20,0,0,0,20,20H160a20,20,0,0,0,20-20v-4A12,12,0,0,0,168,192Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,jpe,[...r[1]||=[R(`path`,{d:`M216,48V152a8,8,0,0,1-8,8H168v48a8,8,0,0,1-8,8H48a8,8,0,0,1-8-8V104a8,8,0,0,1,8-8H88V48a8,8,0,0,1,8-8H208A8,8,0,0,1,216,48Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M224,48V152a16,16,0,0,1-16,16H99.31l10.35,10.34a8,8,0,0,1-11.32,11.32l-24-24a8,8,0,0,1,0-11.32l24-24a8,8,0,0,1,11.32,11.32L99.31,152H208V48H96v8a8,8,0,0,1-16,0V48A16,16,0,0,1,96,32H208A16,16,0,0,1,224,48ZM168,192a8,8,0,0,0-8,8v8H48V104H156.69l-10.35,10.34a8,8,0,0,0,11.32,11.32l24-24a8,8,0,0,0,0-11.32l-24-24a8,8,0,0,0-11.32,11.32L156.69,88H48a16,16,0,0,0-16,16V208a16,16,0,0,0,16,16H160a16,16,0,0,0,16-16v-8A8,8,0,0,0,168,192Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Mpe,[...r[2]||=[R(`path`,{d:`M224,48V152a16,16,0,0,1-16,16H112v16a8,8,0,0,1-13.66,5.66l-24-24a8,8,0,0,1,0-11.32l24-24A8,8,0,0,1,112,136v16h96V48H96v8a8,8,0,0,1-16,0V48A16,16,0,0,1,96,32H208A16,16,0,0,1,224,48ZM168,192a8,8,0,0,0-8,8v8H48V104h96v16a8,8,0,0,0,13.66,5.66l24-24a8,8,0,0,0,0-11.32l-24-24A8,8,0,0,0,144,72V88H48a16,16,0,0,0-16,16V208a16,16,0,0,0,16,16H160a16,16,0,0,0,16-16v-8A8,8,0,0,0,168,192Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Npe,[...r[3]||=[R(`path`,{d:`M222,48V152a14,14,0,0,1-14,14H94.49l13.75,13.76a6,6,0,1,1-8.48,8.48l-24-24a6,6,0,0,1,0-8.48l24-24a6,6,0,0,1,8.48,8.48L94.49,154H208a2,2,0,0,0,2-2V48a2,2,0,0,0-2-2H96a2,2,0,0,0-2,2v8a6,6,0,0,1-12,0V48A14,14,0,0,1,96,34H208A14,14,0,0,1,222,48ZM168,194a6,6,0,0,0-6,6v8a2,2,0,0,1-2,2H48a2,2,0,0,1-2-2V104a2,2,0,0,1,2-2H161.51l-13.75,13.76a6,6,0,1,0,8.48,8.48l24-24a6,6,0,0,0,0-8.48l-24-24a6,6,0,0,0-8.48,8.48L161.51,90H48a14,14,0,0,0-14,14V208a14,14,0,0,0,14,14H160a14,14,0,0,0,14-14v-8A6,6,0,0,0,168,194Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Ppe,[...r[4]||=[R(`path`,{d:`M224,48V152a16,16,0,0,1-16,16H99.31l10.35,10.34a8,8,0,0,1-11.32,11.32l-24-24a8,8,0,0,1,0-11.32l24-24a8,8,0,0,1,11.32,11.32L99.31,152H208V48H96v8a8,8,0,0,1-16,0V48A16,16,0,0,1,96,32H208A16,16,0,0,1,224,48ZM168,192a8,8,0,0,0-8,8v8H48V104H156.69l-10.35,10.34a8,8,0,0,0,11.32,11.32l24-24a8,8,0,0,0,0-11.32l-24-24a8,8,0,0,0-11.32,11.32L156.69,88H48a16,16,0,0,0-16,16V208a16,16,0,0,0,16,16H160a16,16,0,0,0,16-16v-8A8,8,0,0,0,168,192Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Fpe,[...r[5]||=[R(`path`,{d:`M220,48V152a12,12,0,0,1-12,12H89.66l17.17,17.17a4,4,0,0,1-5.66,5.66l-24-24a4,4,0,0,1,0-5.66l24-24a4,4,0,0,1,5.66,5.66L89.66,156H208a4,4,0,0,0,4-4V48a4,4,0,0,0-4-4H96a4,4,0,0,0-4,4v8a4,4,0,0,1-8,0V48A12,12,0,0,1,96,36H208A12,12,0,0,1,220,48ZM168,196a4,4,0,0,0-4,4v8a4,4,0,0,1-4,4H48a4,4,0,0,1-4-4V104a4,4,0,0,1,4-4H166.34l-17.17,17.17a4,4,0,0,0,5.66,5.66l24-24a4,4,0,0,0,0-5.66l-24-24a4,4,0,0,0-5.66,5.66L166.34,92H48a12,12,0,0,0-12,12V208a12,12,0,0,0,12,12H160a12,12,0,0,0,12-12v-8A4,4,0,0,0,168,196Z`},null,-1)]])):B(``,!0)],16))}})})),Rpe,zpe=s((()=>{Lpe(),Rpe=Ipe})),Bpe,Vpe,Hpe,Upe,Wpe,Gpe,Kpe,qpe=s((()=>{Hc(),W(),Bpe={key:0},Vpe={key:1},Hpe={key:2},Upe={key:3},Wpe={key:4},Gpe={key:5},Kpe=N({name:`ScalarIconTag`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Bpe,[...r[0]||=[R(`path`,{d:`M246.15,133.18,146.83,33.86A19.85,19.85,0,0,0,132.69,28H40A12,12,0,0,0,28,40v92.69a19.85,19.85,0,0,0,5.86,14.14l99.32,99.32a20,20,0,0,0,28.28,0l84.69-84.69A20,20,0,0,0,246.15,133.18Zm-98.83,93.17L52,131V52h79l95.32,95.32ZM104,88A16,16,0,1,1,88,72,16,16,0,0,1,104,88Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Vpe,[...r[1]||=[R(`path`,{d:`M237.66,153,153,237.66a8,8,0,0,1-11.31,0L42.34,138.34A8,8,0,0,1,40,132.69V40h92.69a8,8,0,0,1,5.65,2.34l99.32,99.32A8,8,0,0,1,237.66,153Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M243.31,136,144,36.69A15.86,15.86,0,0,0,132.69,32H40a8,8,0,0,0-8,8v92.69A15.86,15.86,0,0,0,36.69,144L136,243.31a16,16,0,0,0,22.63,0l84.68-84.68a16,16,0,0,0,0-22.63Zm-96,96L48,132.69V48h84.69L232,147.31ZM96,84A12,12,0,1,1,84,72,12,12,0,0,1,96,84Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Hpe,[...r[2]||=[R(`path`,{d:`M243.31,136,144,36.69A15.86,15.86,0,0,0,132.69,32H40a8,8,0,0,0-8,8v92.69A15.86,15.86,0,0,0,36.69,144L136,243.31a16,16,0,0,0,22.63,0l84.68-84.68a16,16,0,0,0,0-22.63ZM84,96A12,12,0,1,1,96,84,12,12,0,0,1,84,96Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Upe,[...r[3]||=[R(`path`,{d:`M241.91,137.42,142.59,38.1a13.94,13.94,0,0,0-9.9-4.1H40a6,6,0,0,0-6,6v92.69a13.94,13.94,0,0,0,4.1,9.9l99.32,99.32a14,14,0,0,0,19.8,0l84.69-84.69A14,14,0,0,0,241.91,137.42Zm-8.49,11.31-84.69,84.69a2,2,0,0,1-2.83,0L46.59,134.1a2,2,0,0,1-.59-1.41V46h86.69a2,2,0,0,1,1.41.59l99.32,99.31A2,2,0,0,1,233.42,148.73ZM94,84A10,10,0,1,1,84,74,10,10,0,0,1,94,84Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Wpe,[...r[4]||=[R(`path`,{d:`M243.31,136,144,36.69A15.86,15.86,0,0,0,132.69,32H40a8,8,0,0,0-8,8v92.69A15.86,15.86,0,0,0,36.69,144L136,243.31a16,16,0,0,0,22.63,0l84.68-84.68a16,16,0,0,0,0-22.63Zm-96,96L48,132.69V48h84.69L232,147.31ZM96,84A12,12,0,1,1,84,72,12,12,0,0,1,96,84Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Gpe,[...r[5]||=[R(`path`,{d:`M240.49,138.83,141.17,39.51A11.93,11.93,0,0,0,132.69,36H40a4,4,0,0,0-4,4v92.69a11.93,11.93,0,0,0,3.51,8.48l99.32,99.32a12,12,0,0,0,17,0l84.69-84.69a12,12,0,0,0,0-17Zm-5.66,11.31-84.69,84.69a4,4,0,0,1-5.65,0L45.17,135.51A4,4,0,0,1,44,132.69V44h88.69a4,4,0,0,1,2.82,1.17l99.32,99.32A4,4,0,0,1,234.83,150.14ZM92,84a8,8,0,1,1-8-8A8,8,0,0,1,92,84Z`},null,-1)]])):B(``,!0)],16))}})})),Jpe,Ype=s((()=>{qpe(),Jpe=Kpe})),Xpe,Zpe,Qpe,$pe,eme,tme,nme,rme=s((()=>{Hc(),W(),Xpe={key:0},Zpe={key:1},Qpe={key:2},$pe={key:3},eme={key:4},tme={key:5},nme=N({name:`ScalarIconTerminalWindow`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Xpe,[...r[0]||=[R(`path`,{d:`M72.5,150.63,100.79,128,72.5,105.37a12,12,0,1,1,15-18.74l40,32a12,12,0,0,1,0,18.74l-40,32a12,12,0,0,1-15-18.74ZM144,172h32a12,12,0,0,0,0-24H144a12,12,0,0,0,0,24ZM236,56V200a20,20,0,0,1-20,20H40a20,20,0,0,1-20-20V56A20,20,0,0,1,40,36H216A20,20,0,0,1,236,56Zm-24,4H44V196H212Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Zpe,[...r[1]||=[R(`path`,{d:`M224,56V200a8,8,0,0,1-8,8H40a8,8,0,0,1-8-8V56a8,8,0,0,1,8-8H216A8,8,0,0,1,224,56Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M128,128a8,8,0,0,1-3,6.25l-40,32a8,8,0,1,1-10-12.5L107.19,128,75,102.25a8,8,0,1,1,10-12.5l40,32A8,8,0,0,1,128,128Zm48,24H136a8,8,0,0,0,0,16h40a8,8,0,0,0,0-16Zm56-96V200a16,16,0,0,1-16,16H40a16,16,0,0,1-16-16V56A16,16,0,0,1,40,40H216A16,16,0,0,1,232,56ZM216,200V56H40V200H216Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Qpe,[...r[2]||=[R(`path`,{d:`M216,40H40A16,16,0,0,0,24,56V200a16,16,0,0,0,16,16H216a16,16,0,0,0,16-16V56A16,16,0,0,0,216,40Zm-91,94.25-40,32a8,8,0,1,1-10-12.5L107.19,128,75,102.25a8,8,0,1,1,10-12.5l40,32a8,8,0,0,1,0,12.5ZM176,168H136a8,8,0,0,1,0-16h40a8,8,0,0,1,0,16Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,$pe,[...r[3]||=[R(`path`,{d:`M126,128a6,6,0,0,1-2.25,4.69l-40,32a6,6,0,0,1-7.5-9.38L110.4,128,76.25,100.69a6,6,0,1,1,7.5-9.38l40,32A6,6,0,0,1,126,128Zm50,26H136a6,6,0,0,0,0,12h40a6,6,0,0,0,0-12Zm54-98V200a14,14,0,0,1-14,14H40a14,14,0,0,1-14-14V56A14,14,0,0,1,40,42H216A14,14,0,0,1,230,56Zm-12,0a2,2,0,0,0-2-2H40a2,2,0,0,0-2,2V200a2,2,0,0,0,2,2H216a2,2,0,0,0,2-2Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,eme,[...r[4]||=[R(`path`,{d:`M128,128a8,8,0,0,1-3,6.25l-40,32a8,8,0,1,1-10-12.5L107.19,128,75,102.25a8,8,0,1,1,10-12.5l40,32A8,8,0,0,1,128,128Zm48,24H136a8,8,0,0,0,0,16h40a8,8,0,0,0,0-16Zm56-96V200a16,16,0,0,1-16,16H40a16,16,0,0,1-16-16V56A16,16,0,0,1,40,40H216A16,16,0,0,1,232,56ZM216,200V56H40V200H216Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,tme,[...r[5]||=[R(`path`,{d:`M122.5,124.88a4,4,0,0,1,0,6.24l-40,32a4,4,0,0,1-5-6.24L113.6,128,77.5,99.12a4,4,0,0,1,5-6.24ZM176,156H136a4,4,0,0,0,0,8h40a4,4,0,0,0,0-8ZM228,56V200a12,12,0,0,1-12,12H40a12,12,0,0,1-12-12V56A12,12,0,0,1,40,44H216A12,12,0,0,1,228,56Zm-8,0a4,4,0,0,0-4-4H40a4,4,0,0,0-4,4V200a4,4,0,0,0,4,4H216a4,4,0,0,0,4-4Z`},null,-1)]])):B(``,!0)],16))}})})),Cu,ime=s((()=>{rme(),Cu=nme})),ame,ome,sme,cme,lme,ume,dme,fme=s((()=>{Hc(),W(),ame={key:0},ome={key:1},sme={key:2},cme={key:3},lme={key:4},ume={key:5},dme=N({name:`ScalarIconTextAlignLeft`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,ame,[...r[0]||=[R(`path`,{d:`M28,64A12,12,0,0,1,40,52H216a12,12,0,0,1,0,24H40A12,12,0,0,1,28,64Zm12,52H168a12,12,0,0,0,0-24H40a12,12,0,0,0,0,24Zm176,16H40a12,12,0,0,0,0,24H216a12,12,0,0,0,0-24Zm-48,40H40a12,12,0,0,0,0,24H168a12,12,0,0,0,0-24Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,ome,[...r[1]||=[R(`path`,{d:`M216,64V168a16,16,0,0,1-16,16H40V64Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M32,64a8,8,0,0,1,8-8H216a8,8,0,0,1,0,16H40A8,8,0,0,1,32,64Zm8,48H168a8,8,0,0,0,0-16H40a8,8,0,0,0,0,16Zm176,24H40a8,8,0,0,0,0,16H216a8,8,0,0,0,0-16Zm-48,40H40a8,8,0,0,0,0,16H168a8,8,0,0,0,0-16Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,sme,[...r[2]||=[R(`path`,{d:`M208,32H48A16,16,0,0,0,32,48V208a16,16,0,0,0,16,16H208a16,16,0,0,0,16-16V48A16,16,0,0,0,208,32ZM160,184H64a8,8,0,0,1,0-16h96a8,8,0,0,1,0,16Zm32-32H64a8,8,0,0,1,0-16H192a8,8,0,0,1,0,16ZM56,112a8,8,0,0,1,8-8h96a8,8,0,0,1,0,16H64A8,8,0,0,1,56,112ZM192,88H64a8,8,0,0,1,0-16H192a8,8,0,0,1,0,16Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,cme,[...r[3]||=[R(`path`,{d:`M34,64a6,6,0,0,1,6-6H216a6,6,0,0,1,0,12H40A6,6,0,0,1,34,64Zm6,46H168a6,6,0,0,0,0-12H40a6,6,0,0,0,0,12Zm176,28H40a6,6,0,0,0,0,12H216a6,6,0,0,0,0-12Zm-48,40H40a6,6,0,0,0,0,12H168a6,6,0,0,0,0-12Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,lme,[...r[4]||=[R(`path`,{d:`M32,64a8,8,0,0,1,8-8H216a8,8,0,0,1,0,16H40A8,8,0,0,1,32,64Zm8,48H168a8,8,0,0,0,0-16H40a8,8,0,0,0,0,16Zm176,24H40a8,8,0,0,0,0,16H216a8,8,0,0,0,0-16Zm-48,40H40a8,8,0,0,0,0,16H168a8,8,0,0,0,0-16Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,ume,[...r[5]||=[R(`path`,{d:`M36,64a4,4,0,0,1,4-4H216a4,4,0,0,1,0,8H40A4,4,0,0,1,36,64Zm4,44H168a4,4,0,0,0,0-8H40a4,4,0,0,0,0,8Zm176,32H40a4,4,0,0,0,0,8H216a4,4,0,0,0,0-8Zm-48,40H40a4,4,0,0,0,0,8H168a4,4,0,0,0,0-8Z`},null,-1)]])):B(``,!0)],16))}})})),pme,mme=s((()=>{fme(),pme=dme})),hme,wu,gme,_me,vme,yme,bme,xme=s((()=>{Hc(),W(),hme={key:0},wu={key:1},gme={key:2},_me={key:3},vme={key:4},yme={key:5},bme=N({name:`ScalarIconTrash`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,hme,[...r[0]||=[R(`path`,{d:`M216,48H180V36A28,28,0,0,0,152,8H104A28,28,0,0,0,76,36V48H40a12,12,0,0,0,0,24h4V208a20,20,0,0,0,20,20H192a20,20,0,0,0,20-20V72h4a12,12,0,0,0,0-24ZM100,36a4,4,0,0,1,4-4h48a4,4,0,0,1,4,4V48H100Zm88,168H68V72H188ZM116,104v64a12,12,0,0,1-24,0V104a12,12,0,0,1,24,0Zm48,0v64a12,12,0,0,1-24,0V104a12,12,0,0,1,24,0Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,wu,[...r[1]||=[R(`path`,{d:`M200,56V208a8,8,0,0,1-8,8H64a8,8,0,0,1-8-8V56Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M216,48H176V40a24,24,0,0,0-24-24H104A24,24,0,0,0,80,40v8H40a8,8,0,0,0,0,16h8V208a16,16,0,0,0,16,16H192a16,16,0,0,0,16-16V64h8a8,8,0,0,0,0-16ZM96,40a8,8,0,0,1,8-8h48a8,8,0,0,1,8,8v8H96Zm96,168H64V64H192ZM112,104v64a8,8,0,0,1-16,0V104a8,8,0,0,1,16,0Zm48,0v64a8,8,0,0,1-16,0V104a8,8,0,0,1,16,0Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,gme,[...r[2]||=[R(`path`,{d:`M216,48H176V40a24,24,0,0,0-24-24H104A24,24,0,0,0,80,40v8H40a8,8,0,0,0,0,16h8V208a16,16,0,0,0,16,16H192a16,16,0,0,0,16-16V64h8a8,8,0,0,0,0-16ZM112,168a8,8,0,0,1-16,0V104a8,8,0,0,1,16,0Zm48,0a8,8,0,0,1-16,0V104a8,8,0,0,1,16,0Zm0-120H96V40a8,8,0,0,1,8-8h48a8,8,0,0,1,8,8Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,_me,[...r[3]||=[R(`path`,{d:`M216,50H174V40a22,22,0,0,0-22-22H104A22,22,0,0,0,82,40V50H40a6,6,0,0,0,0,12H50V208a14,14,0,0,0,14,14H192a14,14,0,0,0,14-14V62h10a6,6,0,0,0,0-12ZM94,40a10,10,0,0,1,10-10h48a10,10,0,0,1,10,10V50H94ZM194,208a2,2,0,0,1-2,2H64a2,2,0,0,1-2-2V62H194ZM110,104v64a6,6,0,0,1-12,0V104a6,6,0,0,1,12,0Zm48,0v64a6,6,0,0,1-12,0V104a6,6,0,0,1,12,0Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,vme,[...r[4]||=[R(`path`,{d:`M216,48H176V40a24,24,0,0,0-24-24H104A24,24,0,0,0,80,40v8H40a8,8,0,0,0,0,16h8V208a16,16,0,0,0,16,16H192a16,16,0,0,0,16-16V64h8a8,8,0,0,0,0-16ZM96,40a8,8,0,0,1,8-8h48a8,8,0,0,1,8,8v8H96Zm96,168H64V64H192ZM112,104v64a8,8,0,0,1-16,0V104a8,8,0,0,1,16,0Zm48,0v64a8,8,0,0,1-16,0V104a8,8,0,0,1,16,0Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,yme,[...r[5]||=[R(`path`,{d:`M216,52H172V40a20,20,0,0,0-20-20H104A20,20,0,0,0,84,40V52H40a4,4,0,0,0,0,8H52V208a12,12,0,0,0,12,12H192a12,12,0,0,0,12-12V60h12a4,4,0,0,0,0-8ZM92,40a12,12,0,0,1,12-12h48a12,12,0,0,1,12,12V52H92ZM196,208a4,4,0,0,1-4,4H64a4,4,0,0,1-4-4V60H196ZM108,104v64a4,4,0,0,1-8,0V104a4,4,0,0,1,8,0Zm48,0v64a4,4,0,0,1-8,0V104a4,4,0,0,1,8,0Z`},null,-1)]])):B(``,!0)],16))}})})),Tu,Sme=s((()=>{xme(),Tu=bme})),Cme,wme,Tme,Eme,Dme,Ome,kme,Ame=s((()=>{Hc(),W(),Cme={key:0},wme={key:1},Tme={key:2},Eme={key:3},Dme={key:4},Ome={key:5},kme=N({name:`ScalarIconUpload`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Cme,[...r[0]||=[R(`path`,{d:`M188,184a16,16,0,1,1,16-16A16,16,0,0,1,188,184Zm36-68H180a12,12,0,0,0,0,24h40v56H36V140H76a12,12,0,0,0,0-24H32a20,20,0,0,0-20,20v64a20,20,0,0,0,20,20H224a20,20,0,0,0,20-20V136A20,20,0,0,0,224,116ZM88.49,80.49,116,53v75a12,12,0,0,0,24,0V53l27.51,27.52a12,12,0,1,0,17-17l-48-48a12,12,0,0,0-17,0l-48,48a12,12,0,1,0,17,17Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,wme,[...r[1]||=[R(`path`,{d:`M232,136v64a8,8,0,0,1-8,8H32a8,8,0,0,1-8-8V136a8,8,0,0,1,8-8H224A8,8,0,0,1,232,136Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M240,136v64a16,16,0,0,1-16,16H32a16,16,0,0,1-16-16V136a16,16,0,0,1,16-16H80a8,8,0,0,1,0,16H32v64H224V136H176a8,8,0,0,1,0-16h48A16,16,0,0,1,240,136ZM85.66,77.66,120,43.31V128a8,8,0,0,0,16,0V43.31l34.34,34.35a8,8,0,0,0,11.32-11.32l-48-48a8,8,0,0,0-11.32,0l-48,48A8,8,0,0,0,85.66,77.66ZM200,168a12,12,0,1,0-12,12A12,12,0,0,0,200,168Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Tme,[...r[2]||=[R(`path`,{d:`M74.34,77.66a8,8,0,0,1,0-11.32l48-48a8,8,0,0,1,11.32,0l48,48a8,8,0,0,1-11.32,11.32L136,43.31V128a8,8,0,0,1-16,0V43.31L85.66,77.66A8,8,0,0,1,74.34,77.66ZM240,136v64a16,16,0,0,1-16,16H32a16,16,0,0,1-16-16V136a16,16,0,0,1,16-16h68a4,4,0,0,1,4,4v3.46c0,13.45,11,24.79,24.46,24.54A24,24,0,0,0,152,128v-4a4,4,0,0,1,4-4h68A16,16,0,0,1,240,136Zm-40,32a12,12,0,1,0-12,12A12,12,0,0,0,200,168Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Eme,[...r[3]||=[R(`path`,{d:`M238,136v64a14,14,0,0,1-14,14H32a14,14,0,0,1-14-14V136a14,14,0,0,1,14-14H80a6,6,0,0,1,0,12H32a2,2,0,0,0-2,2v64a2,2,0,0,0,2,2H224a2,2,0,0,0,2-2V136a2,2,0,0,0-2-2H176a6,6,0,0,1,0-12h48A14,14,0,0,1,238,136ZM84.24,76.24,122,38.49V128a6,6,0,0,0,12,0V38.49l37.76,37.75a6,6,0,0,0,8.48-8.48l-48-48a6,6,0,0,0-8.48,0l-48,48a6,6,0,0,0,8.48,8.48ZM198,168a10,10,0,1,0-10,10A10,10,0,0,0,198,168Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Dme,[...r[4]||=[R(`path`,{d:`M240,136v64a16,16,0,0,1-16,16H32a16,16,0,0,1-16-16V136a16,16,0,0,1,16-16H80a8,8,0,0,1,0,16H32v64H224V136H176a8,8,0,0,1,0-16h48A16,16,0,0,1,240,136ZM85.66,77.66,120,43.31V128a8,8,0,0,0,16,0V43.31l34.34,34.35a8,8,0,0,0,11.32-11.32l-48-48a8,8,0,0,0-11.32,0l-48,48A8,8,0,0,0,85.66,77.66ZM200,168a12,12,0,1,0-12,12A12,12,0,0,0,200,168Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Ome,[...r[5]||=[R(`path`,{d:`M236,136v64a12,12,0,0,1-12,12H32a12,12,0,0,1-12-12V136a12,12,0,0,1,12-12H80a4,4,0,0,1,0,8H32a4,4,0,0,0-4,4v64a4,4,0,0,0,4,4H224a4,4,0,0,0,4-4V136a4,4,0,0,0-4-4H176a4,4,0,0,1,0-8h48A12,12,0,0,1,236,136ZM82.83,74.83,124,33.66V128a4,4,0,0,0,8,0V33.66l41.17,41.17a4,4,0,1,0,5.66-5.66l-48-48a4,4,0,0,0-5.66,0l-48,48a4,4,0,0,0,5.66,5.66ZM196,168a8,8,0,1,0-8,8A8,8,0,0,0,196,168Z`},null,-1)]])):B(``,!0)],16))}})})),jme,Mme=s((()=>{Ame(),jme=kme})),Nme,Pme,Fme,Ime,Lme,Rme,zme,Bme=s((()=>{Hc(),W(),Nme={key:0},Pme={key:1},Fme={key:2},Ime={key:3},Lme={key:4},Rme={key:5},zme=N({name:`ScalarIconWarning`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Nme,[...r[0]||=[R(`path`,{d:`M240.26,186.1,152.81,34.23h0a28.74,28.74,0,0,0-49.62,0L15.74,186.1a27.45,27.45,0,0,0,0,27.71A28.31,28.31,0,0,0,40.55,228h174.9a28.31,28.31,0,0,0,24.79-14.19A27.45,27.45,0,0,0,240.26,186.1Zm-20.8,15.7a4.46,4.46,0,0,1-4,2.2H40.55a4.46,4.46,0,0,1-4-2.2,3.56,3.56,0,0,1,0-3.73L124,46.2a4.77,4.77,0,0,1,8,0l87.44,151.87A3.56,3.56,0,0,1,219.46,201.8ZM116,136V104a12,12,0,0,1,24,0v32a12,12,0,0,1-24,0Zm28,40a16,16,0,1,1-16-16A16,16,0,0,1,144,176Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Pme,[...r[1]||=[R(`path`,{d:`M215.46,216H40.54C27.92,216,20,202.79,26.13,192.09L113.59,40.22c6.3-11,22.52-11,28.82,0l87.46,151.87C236,202.79,228.08,216,215.46,216Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M236.8,188.09,149.35,36.22h0a24.76,24.76,0,0,0-42.7,0L19.2,188.09a23.51,23.51,0,0,0,0,23.72A24.35,24.35,0,0,0,40.55,224h174.9a24.35,24.35,0,0,0,21.33-12.19A23.51,23.51,0,0,0,236.8,188.09ZM222.93,203.8a8.5,8.5,0,0,1-7.48,4.2H40.55a8.5,8.5,0,0,1-7.48-4.2,7.59,7.59,0,0,1,0-7.72L120.52,44.21a8.75,8.75,0,0,1,15,0l87.45,151.87A7.59,7.59,0,0,1,222.93,203.8ZM120,144V104a8,8,0,0,1,16,0v40a8,8,0,0,1-16,0Zm20,36a12,12,0,1,1-12-12A12,12,0,0,1,140,180Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Fme,[...r[2]||=[R(`path`,{d:`M236.8,188.09,149.35,36.22h0a24.76,24.76,0,0,0-42.7,0L19.2,188.09a23.51,23.51,0,0,0,0,23.72A24.35,24.35,0,0,0,40.55,224h174.9a24.35,24.35,0,0,0,21.33-12.19A23.51,23.51,0,0,0,236.8,188.09ZM120,104a8,8,0,0,1,16,0v40a8,8,0,0,1-16,0Zm8,88a12,12,0,1,1,12-12A12,12,0,0,1,128,192Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Ime,[...r[3]||=[R(`path`,{d:`M235.07,189.09,147.61,37.22h0a22.75,22.75,0,0,0-39.22,0L20.93,189.09a21.53,21.53,0,0,0,0,21.72A22.35,22.35,0,0,0,40.55,222h174.9a22.35,22.35,0,0,0,19.6-11.19A21.53,21.53,0,0,0,235.07,189.09ZM224.66,204.8a10.46,10.46,0,0,1-9.21,5.2H40.55a10.46,10.46,0,0,1-9.21-5.2,9.51,9.51,0,0,1,0-9.72L118.79,43.21a10.75,10.75,0,0,1,18.42,0l87.46,151.87A9.51,9.51,0,0,1,224.66,204.8ZM122,144V104a6,6,0,0,1,12,0v40a6,6,0,0,1-12,0Zm16,36a10,10,0,1,1-10-10A10,10,0,0,1,138,180Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,Lme,[...r[4]||=[R(`path`,{d:`M236.8,188.09,149.35,36.22h0a24.76,24.76,0,0,0-42.7,0L19.2,188.09a23.51,23.51,0,0,0,0,23.72A24.35,24.35,0,0,0,40.55,224h174.9a24.35,24.35,0,0,0,21.33-12.19A23.51,23.51,0,0,0,236.8,188.09ZM222.93,203.8a8.5,8.5,0,0,1-7.48,4.2H40.55a8.5,8.5,0,0,1-7.48-4.2,7.59,7.59,0,0,1,0-7.72L120.52,44.21a8.75,8.75,0,0,1,15,0l87.45,151.87A7.59,7.59,0,0,1,222.93,203.8ZM120,144V104a8,8,0,0,1,16,0v40a8,8,0,0,1-16,0Zm20,36a12,12,0,1,1-12-12A12,12,0,0,1,140,180Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Rme,[...r[5]||=[R(`path`,{d:`M233.34,190.09,145.88,38.22h0a20.75,20.75,0,0,0-35.76,0L22.66,190.09a19.52,19.52,0,0,0,0,19.71A20.36,20.36,0,0,0,40.54,220H215.46a20.36,20.36,0,0,0,17.86-10.2A19.52,19.52,0,0,0,233.34,190.09ZM226.4,205.8a12.47,12.47,0,0,1-10.94,6.2H40.54a12.47,12.47,0,0,1-10.94-6.2,11.45,11.45,0,0,1,0-11.72L117.05,42.21a12.76,12.76,0,0,1,21.9,0L226.4,194.08A11.45,11.45,0,0,1,226.4,205.8ZM124,144V104a4,4,0,0,1,8,0v40a4,4,0,0,1-8,0Zm12,36a8,8,0,1,1-8-8A8,8,0,0,1,136,180Z`},null,-1)]])):B(``,!0)],16))}})})),Vme,Hme=s((()=>{Bme(),Vme=zme})),Ume,Wme,Gme,Kme,qme,Jme,Yme,Xme=s((()=>{Hc(),W(),Ume={key:0},Wme={key:1},Gme={key:2},Kme={key:3},qme={key:4},Jme={key:5},Yme=N({name:`ScalarIconWarningCircle`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Ume,[...r[0]||=[R(`path`,{d:`M128,20A108,108,0,1,0,236,128,108.12,108.12,0,0,0,128,20Zm0,192a84,84,0,1,1,84-84A84.09,84.09,0,0,1,128,212Zm-12-80V80a12,12,0,0,1,24,0v52a12,12,0,0,1-24,0Zm28,40a16,16,0,1,1-16-16A16,16,0,0,1,144,172Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Wme,[...r[1]||=[R(`path`,{d:`M224,128a96,96,0,1,1-96-96A96,96,0,0,1,224,128Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm0,192a88,88,0,1,1,88-88A88.1,88.1,0,0,1,128,216Zm-8-80V80a8,8,0,0,1,16,0v56a8,8,0,0,1-16,0Zm20,36a12,12,0,1,1-12-12A12,12,0,0,1,140,172Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,Gme,[...r[2]||=[R(`path`,{d:`M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm-8,56a8,8,0,0,1,16,0v56a8,8,0,0,1-16,0Zm8,104a12,12,0,1,1,12-12A12,12,0,0,1,128,184Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Kme,[...r[3]||=[R(`path`,{d:`M128,26A102,102,0,1,0,230,128,102.12,102.12,0,0,0,128,26Zm0,192a90,90,0,1,1,90-90A90.1,90.1,0,0,1,128,218Zm-6-82V80a6,6,0,0,1,12,0v56a6,6,0,0,1-12,0Zm16,36a10,10,0,1,1-10-10A10,10,0,0,1,138,172Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,qme,[...r[4]||=[R(`path`,{d:`M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm0,192a88,88,0,1,1,88-88A88.1,88.1,0,0,1,128,216Zm-8-80V80a8,8,0,0,1,16,0v56a8,8,0,0,1-16,0Zm20,36a12,12,0,1,1-12-12A12,12,0,0,1,140,172Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Jme,[...r[5]||=[R(`path`,{d:`M128,28A100,100,0,1,0,228,128,100.11,100.11,0,0,0,128,28Zm0,192a92,92,0,1,1,92-92A92.1,92.1,0,0,1,128,220Zm-4-84V80a4,4,0,0,1,8,0v56a4,4,0,0,1-8,0Zm12,36a8,8,0,1,1-8-8A8,8,0,0,1,136,172Z`},null,-1)]])):B(``,!0)],16))}})})),Zme,Qme=s((()=>{Xme(),Zme=Yme})),$me,ehe,the,nhe,rhe,ihe,ahe,ohe=s((()=>{Hc(),W(),$me={key:0},ehe={key:1},the={key:2},nhe={key:3},rhe={key:4},ihe={key:5},ahe=N({name:`ScalarIconWarningOctagon`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,$me,[...r[0]||=[R(`path`,{d:`M116,132V80a12,12,0,0,1,24,0v52a12,12,0,0,1-24,0ZM236,91.55v72.9a19.86,19.86,0,0,1-5.86,14.14l-51.55,51.55A19.85,19.85,0,0,1,164.45,236H91.55a19.85,19.85,0,0,1-14.14-5.86L25.86,178.59A19.86,19.86,0,0,1,20,164.45V91.55a19.86,19.86,0,0,1,5.86-14.14L77.41,25.86A19.85,19.85,0,0,1,91.55,20h72.9a19.85,19.85,0,0,1,14.14,5.86l51.55,51.55A19.86,19.86,0,0,1,236,91.55Zm-24,1.66L162.79,44H93.21L44,93.21v69.58L93.21,212h69.58L212,162.79ZM128,156a16,16,0,1,0,16,16A16,16,0,0,0,128,156Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,ehe,[...r[1]||=[R(`path`,{d:`M224,91.55v72.9a8,8,0,0,1-2.34,5.66l-51.55,51.55a8,8,0,0,1-5.66,2.34H91.55a8,8,0,0,1-5.66-2.34L34.34,170.11A8,8,0,0,1,32,164.45V91.55a8,8,0,0,1,2.34-5.66L85.89,34.34A8,8,0,0,1,91.55,32h72.9a8,8,0,0,1,5.66,2.34l51.55,51.55A8,8,0,0,1,224,91.55Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M120,136V80a8,8,0,0,1,16,0v56a8,8,0,0,1-16,0ZM232,91.55v72.9a15.86,15.86,0,0,1-4.69,11.31l-51.55,51.55A15.86,15.86,0,0,1,164.45,232H91.55a15.86,15.86,0,0,1-11.31-4.69L28.69,175.76A15.86,15.86,0,0,1,24,164.45V91.55a15.86,15.86,0,0,1,4.69-11.31L80.24,28.69A15.86,15.86,0,0,1,91.55,24h72.9a15.86,15.86,0,0,1,11.31,4.69l51.55,51.55A15.86,15.86,0,0,1,232,91.55Zm-16,0L164.45,40H91.55L40,91.55v72.9L91.55,216h72.9L216,164.45ZM128,160a12,12,0,1,0,12,12A12,12,0,0,0,128,160Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,the,[...r[2]||=[R(`path`,{d:`M227.31,80.23,175.77,28.69A16.13,16.13,0,0,0,164.45,24H91.55a16.13,16.13,0,0,0-11.32,4.69L28.69,80.23A16.13,16.13,0,0,0,24,91.55v72.9a16.13,16.13,0,0,0,4.69,11.32l51.54,51.54A16.13,16.13,0,0,0,91.55,232h72.9a16.13,16.13,0,0,0,11.32-4.69l51.54-51.54A16.13,16.13,0,0,0,232,164.45V91.55A16.13,16.13,0,0,0,227.31,80.23ZM120,80a8,8,0,0,1,16,0v56a8,8,0,0,1-16,0Zm8,104a12,12,0,1,1,12-12A12,12,0,0,1,128,184Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,nhe,[...r[3]||=[R(`path`,{d:`M122,136V80a6,6,0,0,1,12,0v56a6,6,0,0,1-12,0ZM230,91.55v72.9a13.92,13.92,0,0,1-4.1,9.9L174.35,225.9a13.92,13.92,0,0,1-9.9,4.1H91.55a13.92,13.92,0,0,1-9.9-4.1L30.1,174.35a13.92,13.92,0,0,1-4.1-9.9V91.55a13.92,13.92,0,0,1,4.1-9.9L81.65,30.1a13.92,13.92,0,0,1,9.9-4.1h72.9a13.92,13.92,0,0,1,9.9,4.1L225.9,81.65A13.92,13.92,0,0,1,230,91.55Zm-12,0a2,2,0,0,0-.59-1.42L165.87,38.59a2,2,0,0,0-1.42-.59H91.55a2,2,0,0,0-1.41.59L38.58,90.13A2,2,0,0,0,38,91.55v72.9a2,2,0,0,0,.59,1.42l51.54,51.54a2,2,0,0,0,1.42.59h72.9a2,2,0,0,0,1.41-.59l51.56-51.54a2,2,0,0,0,.58-1.42ZM128,162a10,10,0,1,0,10,10A10,10,0,0,0,128,162Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,rhe,[...r[4]||=[R(`path`,{d:`M120,136V80a8,8,0,0,1,16,0v56a8,8,0,0,1-16,0ZM232,91.55v72.9a15.86,15.86,0,0,1-4.69,11.31l-51.55,51.55A15.86,15.86,0,0,1,164.45,232H91.55a15.86,15.86,0,0,1-11.31-4.69L28.69,175.76A15.86,15.86,0,0,1,24,164.45V91.55a15.86,15.86,0,0,1,4.69-11.31L80.24,28.69A15.86,15.86,0,0,1,91.55,24h72.9a15.86,15.86,0,0,1,11.31,4.69l51.55,51.55A15.86,15.86,0,0,1,232,91.55Zm-16,0L164.45,40H91.55L40,91.55v72.9L91.55,216h72.9L216,164.45ZM128,160a12,12,0,1,0,12,12A12,12,0,0,0,128,160Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,ihe,[...r[5]||=[R(`path`,{d:`M124,136V80a4,4,0,0,1,8,0v56a4,4,0,0,1-8,0ZM228,91.55v72.9a12,12,0,0,1-3.51,8.49l-51.55,51.55a12,12,0,0,1-8.49,3.51H91.55a12,12,0,0,1-8.49-3.51L31.51,172.94A12,12,0,0,1,28,164.45V91.55a12,12,0,0,1,3.51-8.49L83.06,31.51A12,12,0,0,1,91.55,28h72.9a12,12,0,0,1,8.49,3.51l51.55,51.55A12,12,0,0,1,228,91.55Zm-8,0a4,4,0,0,0-1.17-2.83L167.28,37.17A4.06,4.06,0,0,0,164.45,36H91.55a4.06,4.06,0,0,0-2.83,1.17L37.17,88.72A4,4,0,0,0,36,91.55v72.9a4,4,0,0,0,1.17,2.83l51.55,51.55A4.06,4.06,0,0,0,91.55,220h72.9a4.06,4.06,0,0,0,2.83-1.17l51.55-51.55a4,4,0,0,0,1.17-2.83ZM128,164a8,8,0,1,0,8,8A8,8,0,0,0,128,164Z`},null,-1)]])):B(``,!0)],16))}})})),she,che=s((()=>{ohe(),she=ahe})),lhe,uhe,dhe,fhe,phe,mhe,hhe,ghe=s((()=>{Hc(),W(),lhe={key:0},uhe={key:1},dhe={key:2},fhe={key:3},phe={key:4},mhe={key:5},hhe=N({name:`ScalarIconWebhooksLogo`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,lhe,[...r[0]||=[R(`path`,{d:`M192,180H118.71a56,56,0,1,1-104.6-37.46,12,12,0,1,1,21.37,10.92A31.64,31.64,0,0,0,32,168a32,32,0,0,0,64,0,12,12,0,0,1,12-12h84a12,12,0,0,1,0,24Zm0-68a55.9,55.9,0,0,0-18.45,3.12L138.22,57.71a12,12,0,0,0-20.44,12.58l40.94,66.52a12,12,0,0,0,16.52,3.93,32,32,0,1,1,19.68,59.13A12,12,0,0,0,196,223.82a10.05,10.05,0,0,0,1.09,0A56,56,0,0,0,192,112ZM57.71,178.22a12,12,0,0,0,16.51-3.93l40.94-66.52a12,12,0,0,0-3.92-16.51,32,32,0,1,1,45.28-41.8,12,12,0,1,0,21.37-10.92A56,56,0,1,0,89.1,104.32L53.78,161.71A12,12,0,0,0,57.71,178.22Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,uhe,[...r[1]||=[R(`path`,{d:`M128,104a40,40,0,1,1,40-40A40,40,0,0,1,128,104Zm64,24a40,40,0,1,0,40,40A40,40,0,0,0,192,128ZM64,128a40,40,0,1,0,40,40A40,40,0,0,0,64,128Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M178.16,176H111.32A48,48,0,1,1,25.6,139.19a8,8,0,0,1,12.8,9.61A31.69,31.69,0,0,0,32,168a32,32,0,0,0,64,0,8,8,0,0,1,8-8h74.16a16,16,0,1,1,0,16ZM64,184a16,16,0,0,0,14.08-23.61l35.77-58.14a8,8,0,0,0-2.62-11,32,32,0,1,1,46.1-40.06A8,8,0,1,0,172,44.79a48,48,0,1,0-75.62,55.33L64.44,152c-.15,0-.29,0-.44,0a16,16,0,0,0,0,32Zm128-64a48.18,48.18,0,0,0-18,3.49L142.08,71.6A16,16,0,1,0,128,80l.44,0,35.78,58.15a8,8,0,0,0,11,2.61A32,32,0,1,1,192,200a8,8,0,0,0,0,16,48,48,0,0,0,0-96Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,dhe,[...r[2]||=[R(`path`,{d:`M50.15,160,89.07,92.57l-2.24-3.88a48,48,0,1,1,85.05-44.17,8.17,8.17,0,0,1-3.19,10.4,8,8,0,0,1-11.35-3.72,32,32,0,1,0-56.77,29.3.57.57,0,0,1,.08.13l13.83,23.94a8,8,0,0,1,0,8L77.86,176a16,16,0,0,1-27.71-16Zm141-40H178.81L141.86,56a16,16,0,0,0-27.71,16l34.64,60a8,8,0,0,0,6.92,4h35.63c17.89,0,32.95,14.64,32.66,32.53A32,32,0,0,1,192.31,200a8.23,8.23,0,0,0-8.28,7.33,8,8,0,0,0,8,8.67,48.05,48.05,0,0,0,48-48.93C239.49,140.79,217.48,120,191.19,120ZM208,167.23c-.4-8.61-7.82-15.23-16.43-15.23H114.81a8,8,0,0,0-6.93,4L91.72,184h0a32,32,0,1,1-53.47-35,8.2,8.2,0,0,0-.92-11,8,8,0,0,0-11.72,1.17A47.63,47.63,0,0,0,16,167.54,48,48,0,0,0,105.55,192v0l4.62-8H192A16,16,0,0,0,208,167.23Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,fhe,[...r[3]||=[R(`path`,{d:`M179.37,174H109.6a46,46,0,1,1-82.4-33.61,6,6,0,0,1,9.6,7.21A33.68,33.68,0,0,0,30,168a34,34,0,0,0,68,0,6,6,0,0,1,6-6h75.37a14,14,0,1,1,0,12ZM64,182a14,14,0,0,0,11.73-21.62l36.42-59.18a6,6,0,0,0-2-8.25,34,34,0,1,1,49-42.57,6,6,0,1,0,11-4.79A46,46,0,1,0,99,99.7L65.52,154.08c-.5-.05-1-.08-1.52-.08a14,14,0,0,0,0,28Zm128-60a46,46,0,0,0-18.8,4L139.73,71.61A14,14,0,1,0,128,78a12.79,12.79,0,0,0,1.52-.09l36.4,59.17a6.05,6.05,0,0,0,3.73,2.69,6,6,0,0,0,4.53-.73A34,34,0,1,1,192,202a6,6,0,0,0,0,12,46,46,0,0,0,0-92Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,phe,[...r[4]||=[R(`path`,{d:`M178.16,176H111.32A48,48,0,1,1,25.6,139.19a8,8,0,0,1,12.8,9.61A31.69,31.69,0,0,0,32,168a32,32,0,0,0,64,0,8,8,0,0,1,8-8h74.16a16,16,0,1,1,0,16ZM64,184a16,16,0,0,0,14.08-23.61l35.77-58.14a8,8,0,0,0-2.62-11,32,32,0,1,1,46.1-40.06A8,8,0,1,0,172,44.79a48,48,0,1,0-75.62,55.33L64.44,152c-.15,0-.29,0-.44,0a16,16,0,0,0,0,32Zm128-64a48.18,48.18,0,0,0-18,3.49L142.08,71.6A16,16,0,1,0,128,80l.44,0,35.78,58.15a8,8,0,0,0,11,2.61A32,32,0,1,1,192,200a8,8,0,0,0,0,16,48,48,0,0,0,0-96Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,mhe,[...r[5]||=[R(`path`,{d:`M180.7,172H107.81a44,44,0,1,1-79-30.41,4,4,0,0,1,6.4,4.81A35.67,35.67,0,0,0,28,168a36,36,0,0,0,72,0,4,4,0,0,1,4-4h76.7a12,12,0,1,1,0,8ZM64,180a12,12,0,0,0,9.33-19.54l37.11-60.3a4,4,0,0,0-1.31-5.51A36,36,0,1,1,161,49.58a4,4,0,1,0,7.33-3.19,44,44,0,1,0-66.71,52.83l-35.1,57.05A11.58,11.58,0,0,0,64,156a12,12,0,0,0,0,24Zm128-56a44,44,0,0,0-19.56,4.58l-35.11-57A12,12,0,1,0,128,76a12.24,12.24,0,0,0,2.52-.27L167.63,136a4,4,0,0,0,5.5,1.31A36,36,0,1,1,192,204a4,4,0,0,0,0,8,44,44,0,0,0,0-88Z`},null,-1)]])):B(``,!0)],16))}})})),Eu,_he=s((()=>{ghe(),Eu=hhe})),vhe,yhe,bhe,xhe,She,Che,whe,The=s((()=>{Hc(),W(),vhe={key:0},yhe={key:1},bhe={key:2},xhe={key:3},She={key:4},Che={key:5},whe=N({name:`ScalarIconX`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,vhe,[...r[0]||=[R(`path`,{d:`M208.49,191.51a12,12,0,0,1-17,17L128,145,64.49,208.49a12,12,0,0,1-17-17L111,128,47.51,64.49a12,12,0,0,1,17-17L128,111l63.51-63.52a12,12,0,0,1,17,17L145,128Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,yhe,[...r[1]||=[R(`path`,{d:`M216,56V200a16,16,0,0,1-16,16H56a16,16,0,0,1-16-16V56A16,16,0,0,1,56,40H200A16,16,0,0,1,216,56Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M205.66,194.34a8,8,0,0,1-11.32,11.32L128,139.31,61.66,205.66a8,8,0,0,1-11.32-11.32L116.69,128,50.34,61.66A8,8,0,0,1,61.66,50.34L128,116.69l66.34-66.35a8,8,0,0,1,11.32,11.32L139.31,128Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,bhe,[...r[2]||=[R(`path`,{d:`M208,32H48A16,16,0,0,0,32,48V208a16,16,0,0,0,16,16H208a16,16,0,0,0,16-16V48A16,16,0,0,0,208,32ZM181.66,170.34a8,8,0,0,1-11.32,11.32L128,139.31,85.66,181.66a8,8,0,0,1-11.32-11.32L116.69,128,74.34,85.66A8,8,0,0,1,85.66,74.34L128,116.69l42.34-42.35a8,8,0,0,1,11.32,11.32L139.31,128Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,xhe,[...r[3]||=[R(`path`,{d:`M204.24,195.76a6,6,0,1,1-8.48,8.48L128,136.49,60.24,204.24a6,6,0,0,1-8.48-8.48L119.51,128,51.76,60.24a6,6,0,0,1,8.48-8.48L128,119.51l67.76-67.75a6,6,0,0,1,8.48,8.48L136.49,128Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,She,[...r[4]||=[R(`path`,{d:`M205.66,194.34a8,8,0,0,1-11.32,11.32L128,139.31,61.66,205.66a8,8,0,0,1-11.32-11.32L116.69,128,50.34,61.66A8,8,0,0,1,61.66,50.34L128,116.69l66.34-66.35a8,8,0,0,1,11.32,11.32L139.31,128Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Che,[...r[5]||=[R(`path`,{d:`M202.83,197.17a4,4,0,0,1-5.66,5.66L128,133.66,58.83,202.83a4,4,0,0,1-5.66-5.66L122.34,128,53.17,58.83a4,4,0,0,1,5.66-5.66L128,122.34l69.17-69.17a4,4,0,1,1,5.66,5.66L133.66,128Z`},null,-1)]])):B(``,!0)],16))}})})),Du,Ehe=s((()=>{The(),Du=whe})),Dhe,Ohe,khe,Ahe,jhe,Mhe,Nhe,Phe=s((()=>{Hc(),W(),Dhe={key:0},Ohe={key:1},khe={key:2},Ahe={key:3},jhe={key:4},Mhe={key:5},Nhe=N({name:`ScalarIconXCircle`,props:{label:{},weight:{}},setup(e){let{bind:t,weight:n}=Vc(e);return(e,r)=>(F(),I(`svg`,ai({xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 256 256`,fill:`currentColor`},j(t)),[P(e.$slots,`default`),j(n)===`bold`?(F(),I(`g`,Dhe,[...r[0]||=[R(`path`,{d:`M168.49,104.49,145,128l23.52,23.51a12,12,0,0,1-17,17L128,145l-23.51,23.52a12,12,0,0,1-17-17L111,128,87.51,104.49a12,12,0,0,1,17-17L128,111l23.51-23.52a12,12,0,0,1,17,17ZM236,128A108,108,0,1,1,128,20,108.12,108.12,0,0,1,236,128Zm-24,0a84,84,0,1,0-84,84A84.09,84.09,0,0,0,212,128Z`},null,-1)]])):j(n)===`duotone`?(F(),I(`g`,Ohe,[...r[1]||=[R(`path`,{d:`M224,128a96,96,0,1,1-96-96A96,96,0,0,1,224,128Z`,opacity:`0.2`},null,-1),R(`path`,{d:`M165.66,101.66,139.31,128l26.35,26.34a8,8,0,0,1-11.32,11.32L128,139.31l-26.34,26.35a8,8,0,0,1-11.32-11.32L116.69,128,90.34,101.66a8,8,0,0,1,11.32-11.32L128,116.69l26.34-26.35a8,8,0,0,1,11.32,11.32ZM232,128A104,104,0,1,1,128,24,104.11,104.11,0,0,1,232,128Zm-16,0a88,88,0,1,0-88,88A88.1,88.1,0,0,0,216,128Z`},null,-1)]])):j(n)===`fill`?(F(),I(`g`,khe,[...r[2]||=[R(`path`,{d:`M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm37.66,130.34a8,8,0,0,1-11.32,11.32L128,139.31l-26.34,26.35a8,8,0,0,1-11.32-11.32L116.69,128,90.34,101.66a8,8,0,0,1,11.32-11.32L128,116.69l26.34-26.35a8,8,0,0,1,11.32,11.32L139.31,128Z`},null,-1)]])):j(n)===`light`?(F(),I(`g`,Ahe,[...r[3]||=[R(`path`,{d:`M164.24,100.24,136.48,128l27.76,27.76a6,6,0,1,1-8.48,8.48L128,136.48l-27.76,27.76a6,6,0,0,1-8.48-8.48L119.52,128,91.76,100.24a6,6,0,0,1,8.48-8.48L128,119.52l27.76-27.76a6,6,0,0,1,8.48,8.48ZM230,128A102,102,0,1,1,128,26,102.12,102.12,0,0,1,230,128Zm-12,0a90,90,0,1,0-90,90A90.1,90.1,0,0,0,218,128Z`},null,-1)]])):j(n)===`regular`?(F(),I(`g`,jhe,[...r[4]||=[R(`path`,{d:`M165.66,101.66,139.31,128l26.35,26.34a8,8,0,0,1-11.32,11.32L128,139.31l-26.34,26.35a8,8,0,0,1-11.32-11.32L116.69,128,90.34,101.66a8,8,0,0,1,11.32-11.32L128,116.69l26.34-26.35a8,8,0,0,1,11.32,11.32ZM232,128A104,104,0,1,1,128,24,104.11,104.11,0,0,1,232,128Zm-16,0a88,88,0,1,0-88,88A88.1,88.1,0,0,0,216,128Z`},null,-1)]])):j(n)===`thin`?(F(),I(`g`,Mhe,[...r[5]||=[R(`path`,{d:`M162.83,98.83,133.66,128l29.17,29.17a4,4,0,0,1-5.66,5.66L128,133.66,98.83,162.83a4,4,0,0,1-5.66-5.66L122.34,128,93.17,98.83a4,4,0,0,1,5.66-5.66L128,122.34l29.17-29.17a4,4,0,1,1,5.66,5.66ZM228,128A100,100,0,1,1,128,28,100.11,100.11,0,0,1,228,128Zm-8,0a92,92,0,1,0-92,92A92.1,92.1,0,0,0,220,128Z`},null,-1)]])):B(``,!0)],16))}})})),Fhe,Ihe=s((()=>{Phe(),Fhe=Nhe})),Ou=s((()=>{jse(),Bse(),Yse(),ice(),mce(),wce(),Mce(),Pce(),Ice(),Rce(),Bce(),Hce(),Wce(),Kce(),Jce(),Xce(),rle(),ple(),Cle(),Nle(),Hle(),Qle(),cue(),vue(),Oue(),Rue(),Jue(),ide(),mde(),Cde(),Nde(),Ude(),Qde(),cfe(),_fe(),Dfe(),Lfe(),Kfe(),tpe(),upe(),bpe(),kpe(),zpe(),Ype(),ime(),mme(),Sme(),Mme(),Hme(),Qme(),che(),_he(),Ehe(),Ihe()})),ku,Au=s((()=>{ku={PROTOCOL:/^(?:https?|ftp|file|mailto|tel|data|wss?)*:\/\//,MULTIPLE_SLASHES:/(?<!:)\/{2,}/g,VARIABLES:/{{((?:[^{}]|{[^{}]*})*)}}/g,PATH:/(?:{)([^{}]+)}(?!})/g,REF_NAME:/\/([^\/]+)$/,TEMPLATE_VARIABLE:/{{\s*([^}\s]+?)\s*}}|{\s*([^}\s]+?)\s*}|:\b[\w.]+\b/g}})),ju,Mu=s((()=>{Au(),ju=e=>!(ku.PROTOCOL.test(e)||/^[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+(\/|$)/.test(e))}));function Lhe(e){return ku.PROTOCOL.test(e)?e:`http://${e.replace(/^\//,``)}`}var Rhe=s((()=>{Au()})),Nu,Pu,Fu,Iu=s((()=>{Au(),Mu(),Rhe(),Nu=(...e)=>{let t={};e.forEach(e=>{let n=Array.from(e.keys());new Set(n).forEach(n=>{let r=e.getAll(n);t[n]=r.length>1?r:r[0]??``})});let n=new URLSearchParams;return Object.entries(t).forEach(([e,t])=>{Array.isArray(t)?t.forEach(t=>n.append(e,t)):n.append(e,t)}),n},Pu=(e,t)=>!t||e===t?e.trim():e?`${e.trim()}/${t.trim()}`.replace(ku.MULTIPLE_SLASHES,`/`):t.trim(),Fu=(e,t,n=new URLSearchParams,r=!1)=>{if(e&&(!ju(e)||typeof window<`u`)){let[i=``,a]=(r?e:ju(e)?Pu(window.location.origin,e):Lhe(e)).split(`?`),o=new URLSearchParams(a||``),[s=``,c]=t.split(`?`),l=new URLSearchParams(c||``),u=e===t?i:Pu(i,s),d=Nu(o,l,n).toString();return d?`${u}?${d}`:u}return t?Pu(e,t):``}})),Lu,zhe=s((()=>{Iu(),Lu=(e,{baseUrl:t,basePath:n}={})=>{if(typeof window>`u`&&!t)return e;try{return new URL(e),e}catch{}try{let r=t||window.location.href;return n&&(r=Pu(t?new URL(t).origin:window.location.origin,n+`/`)),new URL(e,r).toString()}catch{return e}}})),Bhe,Vhe,Hhe=s((()=>{W(),Ou(),zhe(),Bhe=[`href`],Vhe=N({__name:`OpenApiClientButton`,props:{buttonSource:{},source:{default:`api-reference`},isDevelopment:{type:Boolean},integration:{},url:{}},setup(e){let t=U(()=>{let t=e.url??(typeof window<`u`?window.location.href:void 0);if(!t)return;let n=Lu(t);if(!n?.length)return;let r=new URL(e.isDevelopment?`http://localhost:5065`:`https://client.scalar.com`);if(r.searchParams.set(`url`,n),e.integration!==null&&r.searchParams.set(`integration`,e.integration??`vue`),r.searchParams.set(`utm_source`,`api-reference`),r.searchParams.set(`utm_medium`,`button`),r.searchParams.set(`utm_campaign`,e.buttonSource),e.source===`gitbook`){r.searchParams.set(`utm_source`,`gitbook`);let e=document.querySelector(`img.dark\\:block[alt='Logo']`),t=document.querySelector(`img.dark\\:hidden[alt='Logo']`);e&&e instanceof HTMLImageElement&&r.searchParams.set(`dark_logo`,encodeURIComponent(e.src)),t&&t instanceof HTMLImageElement&&r.searchParams.set(`light_logo`,encodeURIComponent(t.src))}return r.toString()});return(e,n)=>t.value?(F(),I(`a`,{key:0,class:`open-api-client-button`,href:t.value,target:`_blank`},[H(j(Wc),{class:`size-3`,weight:`regular`}),n[0]||=z(` Open API Client `,-1)],8,Bhe)):B(``,!0)}})})),Ru,Uhe=s((()=>{Bc(),Hhe(),Ru=zc(Vhe,[[`__scopeId`,`data-v-264dd42f`]])})),zu,Whe=s((()=>{zu=e=>`getSetCookie`in e&&typeof e.getSetCookie==`function`?e.getSetCookie():[]})),Bu,Ghe,Khe=s((()=>{Bu=(e,t)=>{for(let n of t)if(n.responseBody){for(let t of n.responseBody)if(Ghe(e,t.mimeTypes))return t}},Ghe=(e,t)=>{let n=e.toLowerCase();for(let e of t){let t=e.toLowerCase();if(t===n)return!0;if(t.includes(`*`)){let e=t.replace(/[.+?^${}()|[\]\\]/g,`\\$&`).replace(/\*/g,`.*`);if(RegExp(`^${e}$`).test(n))return!0}}return!1}})),Vu,qhe,Jhe,Hu,Uu,Wu=s((()=>{Vu=/^[!#$%&'*+\-.^_`|~A-Za-z0-9]+$/,qhe=e=>`"${e.replaceAll(/(["\\])/g,`\\$1`)}"`,Jhe=e=>{let t=e.indexOf(`=`);if(t===-1)return null;let n=e.slice(0,t).trim().toLowerCase();if(!n||!Vu.test(n))return null;let r=e.slice(t+1).trim();return r?r.startsWith(`"`)&&r.endsWith(`"`)&&r.length>=2?[n,r.slice(1,-1).replaceAll(/\\(["\\])/g,`$1`)]:[n,r]:null},Hu=e=>{let[t=``,n=``]=e.split(`/`,2),r=t.trim().toLowerCase(),i=n.trim().toLowerCase();if(!r||!i||!Vu.test(r)||!Vu.test(i))throw Error(`Invalid MIME type: "${e}"`);return{essence:`${r}/${i}`,type:r,subtype:i}},Uu=(e=`text/plain`)=>{let[t=``,...n]=e.split(`;`),r;try{r=Hu(t)}catch{r=Hu(`text/plain`)}let{essence:i,type:a,subtype:o}=r,s=new Map;return n.forEach(e=>{let t=Jhe(e);if(!t)return;let[n,r]=t;s.set(n,r)}),{essence:i,type:a,subtype:o,parameters:s,toString:()=>{let e=Array.from(s.entries()).map(([e,t])=>`${e}=${Vu.test(t)?t:qhe(t)}`);return e.length?`${i}; ${e.join(`; `)}`:i}}}})),Gu,Ku,Yhe=s((()=>{Wu(),Gu=e=>e??`text/plain;charset=UTF-8`,Ku=e=>Uu(Gu(e))}));function qu(e){let t=Ju[e];if(t)return t;if(e.endsWith(`+json`))return{extension:`.json`,raw:!0,language:`json`,preview:`json`}}function Xhe(e){return!!qu(e)?.raw}var Ju,Zhe,Yu=s((()=>{Ju={"application/epub+zip":{extension:`.epub`},"application/gzip":{extension:`.gz`},"application/java-archive":{extension:`.jar`},"application/javascript":{extension:`.js`,raw:!0},"application/json":{extension:`.json`,raw:!0,language:`json`,preview:`json`},"application/ld+json":{extension:`.jsonld`,raw:!0,language:`json`,preview:`json`},"application/problem+json":{extension:`.json`,raw:!0,language:`json`,preview:`json`},"application/vnd.api+json":{extension:`.json`,raw:!0,language:`json`,preview:`json`},"application/dns-json":{extension:`.json`,raw:!0,language:`json`,preview:`json`},"application/msword":{extension:`.doc`},"application/octet-stream":{extension:`.bin`},"application/ogg":{extension:`.ogx`},"application/pdf":{extension:`.pdf`,preview:`object`},"application/rtf":{extension:`.rtf`,raw:!0},"application/vnd.amazon.ebook":{extension:`.azw`},"application/vnd.apple.installer+xml":{extension:`.mpkg`,raw:!0,language:`xml`},"application/vnd.mozilla.xul+xml":{extension:`.xul`,raw:!0,language:`xml`},"application/vnd.ms-excel":{extension:`.xls`},"application/vnd.ms-fontobject":{extension:`.eot`},"application/vnd.ms-powerpoint":{extension:`.ppt`},"application/vnd.oasis.opendocument.presentation":{extension:`.odp`},"application/vnd.oasis.opendocument.spreadsheet":{extension:`.ods`},"application/vnd.oasis.opendocument.text":{extension:`.odt`},"application/vnd.openxmlformats-officedocument.presentationml.presentation":{extension:`.pptx`},"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet":{extension:`.xlsx`},"application/vnd.openxmlformats-officedocument.wordprocessingml.document":{extension:`.docx`},"application/vnd.rar":{extension:`.rar`},"application/vnd.visio":{extension:`.vsd`},"application/x-7z-compressed":{extension:`.7z`},"application/x-abiword":{extension:`.abw`},"application/x-bzip":{extension:`.bz`},"application/x-bzip2":{extension:`.bz2`},"application/x-cdf":{extension:`.cda`},"application/x-csh":{extension:`.csh`},"application/x-freearc":{extension:`.arc`},"application/x-httpd-php":{extension:`.php`,raw:!0},"application/x-sh":{extension:`.sh`,raw:!0},"application/x-tar":{extension:`.tar`},"application/xhtml+xml":{extension:`.xhtml`,raw:!0,language:`html`},"application/xml":{extension:`.xml`,raw:!0,language:`xml`},"application/yaml":{extension:`.yaml`,raw:!0,language:`yaml`},"application/zip":{extension:`.zip`},"audio/aac":{extension:`.aac`},"audio/midi":{extension:`.midi`},"audio/mpeg":{extension:`.mp3`,preview:`audio`},"audio/ogg":{extension:`.oga`},"audio/wav":{extension:`.wav`},"audio/webm":{extension:`.weba`},"font/otf":{extension:`.otf`},"font/ttf":{extension:`.ttf`},"font/woff":{extension:`.woff`},"font/woff2":{extension:`.woff2`},"image/apng":{extension:`.apng`,preview:`image`,alpha:!0},"image/avif":{extension:`.avif`,preview:`image`},"image/bmp":{extension:`.bmp`,preview:`image`},"image/gif":{extension:`.gif`,preview:`image`,alpha:!0},"image/jpeg":{extension:`.jpg`,preview:`image`},"image/png":{extension:`.png`,preview:`image`,alpha:!0},"image/svg+xml":{extension:`.svg`,raw:!0,language:`xml`,preview:`image`,alpha:!0},"image/tiff":{extension:`.tiff`},"image/vnd.microsoft.icon":{extension:`.ico`,preview:`image`},"image/webp":{extension:`.webp`,preview:`image`,alpha:!0},"text/calendar":{extension:`.ics`,raw:!0},"text/css":{extension:`.css`,raw:!0,language:`css`},"text/csv":{extension:`.csv`,raw:!0},"text/html":{extension:`.html`,raw:!0,language:`html`,preview:`object`},"text/javascript":{extension:`.js`,raw:!0},"text/json":{extension:`.json`,raw:!0,language:`json`,preview:`json`},"text/plain":{extension:`.txt`,raw:!0},"text/xml":{extension:`.xml`,raw:!0,language:`xml`},"text/yaml":{extension:`.yaml`,raw:!0,language:`yaml`},"video/3gpp":{extension:`.3gp`},"audio/3gpp":{extension:`.3gp`},"video/3gpp2":{extension:`.3g2`},"audio/3gpp2":{extension:`.3g2`},"video/mp2t":{extension:`.ts`},"video/mp4":{extension:`.mp4`,preview:`video`},"video/mpeg":{extension:`.mpeg`},"video/ogg":{extension:`.ogv`},"video/webm":{extension:`.webm`,preview:`video`},"video/x-msvideo":{extension:`.avi`}},Zhe=Object.entries(Ju).filter(([,e])=>e?.raw).map(([e])=>e)})),Qhe,$he=s((()=>{Yu(),Wu(),Qhe=async(e,t,n)=>{let r=Uu(t);return n?.decode?await n.decode(e,t):Xhe(r.essence)?new TextDecoder(r.parameters.get(`charset`)).decode(e):new Blob([e],{type:r.essence})}})),Xu,Zu,ege,tge=s((()=>{Xu={BUILDING_REQUEST_FAILED:`An error occurred while building the request`,DEFAULT:`An unknown error has occurred.`,INVALID_URL:`The URL seems to be invalid. Try adding a valid URL.`,INVALID_URL_PROTOCOL:`The URL must start with http:// or https://.`,INVALID_HEADER:`There is an invalid header present, please double check your params.`,MISSING_FILE:`File uploads are not saved in history, you must re-upload the file.`,REQUEST_ABORTED:`The request has been cancelled`,REQUEST_FAILED:`An error occurred while making the request`,URL_EMPTY:`The address bar input seems to be empty. Try adding a URL.`,ON_BEFORE_REQUEST_FAILED:`onBeforeRequest request hook failed`},Zu=e=>e===`Failed to execute 'append' on 'FormData': parameter 2 is not of type 'Blob'.`?Xu.MISSING_FILE:e===`Failed to construct 'URL': Invalid URL`?Xu.INVALID_URL:e.includes(`Invalid URL protocol`)?Xu.INVALID_URL_PROTOCOL:e===`Failed to execute 'fetch' on 'Window': Invalid name`?Xu.INVALID_HEADER:e,ege=(e,t=Xu.DEFAULT)=>(console.error(e),e instanceof Error?(e.message=Zu(e.message),e):typeof e==`string`?Error(Zu(e)):Error(t))})),Qu,$u=s((()=>{Qu=()=>typeof window<`u`&&`electron`in window})),nge,ed,td,nd=s((()=>{$u(),nge=new Set([`post`,`put`,`patch`,`delete`]),ed=(e,t=!1)=>{let n=e.toLowerCase();return Qu()&&!t?!0:nge.has(n)},td=(e,t)=>new Request(e,{...t,body:ed(t.method??`GET`,!0)?t.body:null})})),rd,id=s((()=>{rd={100:{name:`Continue`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/100`,color:`var(--scalar-color-blue)`},101:{name:`Switching Protocols`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/101`,color:`var(--scalar-color-blue)`},102:{name:`Processing`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/102`,color:`var(--scalar-color-blue)`},103:{name:`Early Hints`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/103`,color:`var(--scalar-color-blue)`},200:{name:`OK`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/200`,color:`var(--scalar-color-green)`},201:{name:`Created`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/201`,color:`var(--scalar-color-green)`},202:{name:`Accepted`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/202`,color:`var(--scalar-color-green)`},203:{name:`Non-Authoritative Information`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/203`,color:`var(--scalar-color-green)`},204:{name:`No Content`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/204`,color:`var(--scalar-color-green)`},205:{name:`Reset Content`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/205`,color:`var(--scalar-color-green)`},206:{name:`Partial Content`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/206`,color:`var(--scalar-color-green)`},207:{name:`Multi-Status`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/207`,color:`var(--scalar-color-green)`},208:{name:`Already Reported`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/208`,color:`var(--scalar-color-green)`},226:{name:`IM Used`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/226`,color:`var(--scalar-color-green)`},300:{name:`Multiple Choices`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/300`,color:`var(--scalar-color-yellow)`},301:{name:`Moved Permanently`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/301`,color:`var(--scalar-color-yellow)`},302:{name:`Found`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/302`,color:`var(--scalar-color-yellow)`},303:{name:`See Other`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/303`,color:`var(--scalar-color-yellow)`},304:{name:`Not Modified`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/304`,color:`var(--scalar-color-yellow)`},305:{name:`Use Proxy`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/305`,color:`var(--scalar-color-yellow)`},306:{name:`(Unused)`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/306`,color:`var(--scalar-color-yellow)`},307:{name:`Temporary Redirect`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/307`,color:`var(--scalar-color-yellow)`},308:{name:`Permanent Redirect`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/308`,color:`var(--scalar-color-yellow)`},400:{name:`Bad Request`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/400`,color:`var(--scalar-color-red)`},401:{name:`Unauthorized`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401`,color:`var(--scalar-color-red)`},402:{name:`Payment Required`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/402`,color:`var(--scalar-color-red)`},403:{name:`Forbidden`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403`,color:`var(--scalar-color-red)`},404:{name:`Not Found`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404`,color:`var(--scalar-color-red)`},405:{name:`Method Not Allowed`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/405`,color:`var(--scalar-color-red)`},406:{name:`Not Acceptable`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/406`,color:`var(--scalar-color-red)`},407:{name:`Proxy Authentication Required`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/407`,color:`var(--scalar-color-red)`},408:{name:`Request Timeout`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/408`,color:`var(--scalar-color-red)`},409:{name:`Conflict`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/409`,color:`var(--scalar-color-red)`},410:{name:`Gone`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/410`,color:`var(--scalar-color-red)`},411:{name:`Length Required`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/411`,color:`var(--scalar-color-red)`},412:{name:`Precondition Failed`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/412`,color:`var(--scalar-color-red)`},413:{name:`Content Too Large`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/413`,color:`var(--scalar-color-red)`},414:{name:`URI Too Long`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/414`,color:`var(--scalar-color-red)`},415:{name:`Unsupported Media Type`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/415`,color:`var(--scalar-color-red)`},416:{name:`Range Not Satisfiable`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/416`,color:`var(--scalar-color-red)`},417:{name:`Expectation Failed`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/417`,color:`var(--scalar-color-red)`},418:{name:`I'm a teapot`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/418`,color:`var(--scalar-color-red)`},421:{name:`Misdirected Request`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/421`,color:`var(--scalar-color-red)`},422:{name:`Unprocessable Content`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/422`,color:`var(--scalar-color-red)`},423:{name:`Locked`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/423`,color:`var(--scalar-color-red)`},424:{name:`Failed Dependency`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/424`,color:`var(--scalar-color-red)`},425:{name:`Too Early`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/425`,color:`var(--scalar-color-red)`},426:{name:`Upgrade Required`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/426`,color:`var(--scalar-color-red)`},428:{name:`Precondition Required`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/428`,color:`var(--scalar-color-red)`},429:{name:`Too Many Requests`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/429`,color:`var(--scalar-color-red)`},431:{name:`Request Header Fields Too Large`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/431`,color:`var(--scalar-color-red)`},451:{name:`Unavailable For Legal Reasons`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/451`,color:`var(--scalar-color-red)`},500:{name:`Internal Server Error`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/500`,color:`var(--scalar-color-red)`},501:{name:`Not Implemented`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/501`,color:`var(--scalar-color-red)`},502:{name:`Bad Gateway`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/502`,color:`var(--scalar-color-red)`},503:{name:`Service Unavailable`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/503`,color:`var(--scalar-color-red)`},504:{name:`Gateway Timeout`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/504`,color:`var(--scalar-color-red)`},505:{name:`HTTP Version Not Supported`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/505`,color:`var(--scalar-color-red)`},506:{name:`Variant Also Negotiates`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/506`,color:`var(--scalar-color-red)`},507:{name:`Insufficient Storage`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/507`,color:`var(--scalar-color-red)`},508:{name:`Loop Detected`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/508`,color:`var(--scalar-color-red)`},510:{name:`Not Extended`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/510`,color:`var(--scalar-color-red)`},511:{name:`Network Authentication Required`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/511`,color:`var(--scalar-color-red)`}}})),rge,ige,age,oge,sge,cge,ad=s((()=>{rge=`x-scalar-cookie`,ige=`x-scalar-set-cookie`,age=`x-scalar-user-agent`,oge=`x-scalar-date`,sge=`x-scalar-dnt`,cge=`x-scalar-referer`})),lge,uge,dge=s((()=>{ad(),lge=(e,t=!1)=>{let n=Object.fromEntries(e);t&&[`Access-Control-Allow-Credentials`,`Access-Control-Allow-Headers`,`Access-Control-Allow-Methods`,`Access-Control-Allow-Origin`,`Access-Control-Expose-Headers`].map(e=>e.toLowerCase()).forEach(e=>delete n[e]),delete n[ige];let r=Object.keys(n).find(e=>e.toLowerCase()===`x-scalar-modified-headers`),i=r?n[r]?.toString().split(`, `)?.map(e=>e.toLowerCase())??[]:[];return Object.keys(n).forEach(e=>{i.includes(e.toLowerCase())&&delete n[e]}),r&&delete n[r],Object.keys(n).forEach(e=>{let t=/^x-scalar-original-/i;if(t.test(e)){let r=e.replace(t,``);n[e]&&(n[r]=n[e],delete n[e])}}),Object.keys(n).forEach(e=>{let t=uge(e);e!==t&&n[e]&&(n[t]=n[e],delete n[e])}),Object.fromEntries(Object.entries(n).sort(([e],[t])=>e.localeCompare(t)))},uge=e=>e.split(`-`).map(e=>e.charAt(0).toUpperCase()+e.toLowerCase().slice(1)).join(`-`)})),fge=c((e=>{Object.defineProperty(e,`__esModule`,{value:!0}),e.parseCookie=c,e.parse=c,e.stringifyCookie=l,e.stringifySetCookie=u,e.serialize=u,e.parseSetCookie=d,e.stringifySetCookie=u,e.serialize=u;var t=/^[\u0021-\u003A\u003C\u003E-\u007E]+$/,n=/^[\u0021-\u003A\u003C-\u007E]*$/,r=/^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i,i=/^[\u0020-\u003A\u003D-\u007E]*$/,a=/^-?\d+$/,o=Object.prototype.toString,s=(()=>{let e=function(){};return e.prototype=Object.create(null),e})();function c(e,t){let n=new s,r=e.length;if(r<2)return n;let i=t?.decode||h,a=0;do{let t=p(e,a,r);if(t===-1)break;let o=f(e,a,r);if(t>o){a=e.lastIndexOf(`;`,t-1)+1;continue}let s=m(e,a,t);n[s]===void 0&&(n[s]=i(m(e,t+1,o))),a=o+1}while(a<r);return n}function l(e,r){let i=r?.encode||encodeURIComponent,a=[];for(let r of Object.keys(e)){let o=e[r];if(o===void 0)continue;if(!t.test(r))throw TypeError(`cookie name is invalid: ${r}`);let s=i(o);if(!n.test(s))throw TypeError(`cookie val is invalid: ${o}`);a.push(`${r}=${s}`)}return a.join(`; `)}function u(e,a,o){let s=typeof e==`object`?e:{...o,name:e,value:String(a)},c=(typeof a==`object`?a:o)?.encode||encodeURIComponent;if(!t.test(s.name))throw TypeError(`argument name is invalid: ${s.name}`);let l=s.value?c(s.value):``;if(!n.test(l))throw TypeError(`argument val is invalid: ${s.value}`);let u=s.name+`=`+l;if(s.maxAge!==void 0){if(!Number.isInteger(s.maxAge))throw TypeError(`option maxAge is invalid: ${s.maxAge}`);u+=`; Max-Age=`+s.maxAge}if(s.domain){if(!r.test(s.domain))throw TypeError(`option domain is invalid: ${s.domain}`);u+=`; Domain=`+s.domain}if(s.path){if(!i.test(s.path))throw TypeError(`option path is invalid: ${s.path}`);u+=`; Path=`+s.path}if(s.expires){if(!g(s.expires)||!Number.isFinite(s.expires.valueOf()))throw TypeError(`option expires is invalid: ${s.expires}`);u+=`; Expires=`+s.expires.toUTCString()}if(s.httpOnly&&(u+=`; HttpOnly`),s.secure&&(u+=`; Secure`),s.partitioned&&(u+=`; Partitioned`),s.priority)switch(typeof s.priority==`string`?s.priority.toLowerCase():void 0){case`low`:u+=`; Priority=Low`;break;case`medium`:u+=`; Priority=Medium`;break;case`high`:u+=`; Priority=High`;break;default:throw TypeError(`option priority is invalid: ${s.priority}`)}if(s.sameSite)switch(typeof s.sameSite==`string`?s.sameSite.toLowerCase():s.sameSite){case!0:case`strict`:u+=`; SameSite=Strict`;break;case`lax`:u+=`; SameSite=Lax`;break;case`none`:u+=`; SameSite=None`;break;default:throw TypeError(`option sameSite is invalid: ${s.sameSite}`)}return u}function d(e,t){let n=t?.decode||h,r=e.length,i=f(e,0,r),o=p(e,0,i),s=o===-1?{name:``,value:n(m(e,0,i))}:{name:m(e,0,o),value:n(m(e,o+1,i))},c=i+1;for(;c<r;){let t=f(e,c,r),n=p(e,c,t),i=n===-1?m(e,c,t):m(e,c,n),o=n===-1?void 0:m(e,n+1,t);switch(i.toLowerCase()){case`httponly`:s.httpOnly=!0;break;case`secure`:s.secure=!0;break;case`partitioned`:s.partitioned=!0;break;case`domain`:s.domain=o;break;case`path`:s.path=o;break;case`max-age`:o&&a.test(o)&&(s.maxAge=Number(o));break;case`expires`:if(!o)break;let e=new Date(o);Number.isFinite(e.valueOf())&&(s.expires=e);break;case`priority`:if(!o)break;let t=o.toLowerCase();(t===`low`||t===`medium`||t===`high`)&&(s.priority=t);break;case`samesite`:if(!o)break;let n=o.toLowerCase();(n===`lax`||n===`strict`||n===`none`)&&(s.sameSite=n);break}c=t+1}return s}function f(e,t,n){let r=e.indexOf(`;`,t);return r===-1?n:r}function p(e,t,n){let r=e.indexOf(`=`,t);return r<n?r:-1}function m(e,t,n){let r=t,i=n;do{let t=e.charCodeAt(r);if(t!==32&&t!==9)break}while(++r<i);for(;i>r;){let t=e.charCodeAt(i-1);if(t!==32&&t!==9)break;i--}return e.slice(r,i)}function h(e){if(e.indexOf(`%`)===-1)return e;try{return decodeURIComponent(e)}catch{return e}}function g(e){return o.call(e)===`[object Date]`}}));function od(e){return typeof e!=`string`||e in{}}function sd(){return Object.create(null)}function pge(e){return typeof e==`string`&&!!e.trim()}function cd(e,t){var n=e.split(`;`).filter(pge),r=mge(n.shift()),i=r.name,a=r.value;if(t=t?Object.assign({},ud,t):ud,od(i))return null;try{a=t.decodeValues?decodeURIComponent(a):a}catch(e){console.error(`set-cookie-parser: failed to decode cookie value. Set options.decodeValues=false to disable decoding.`,e)}var o=sd();return o.name=i,o.value=a,n.forEach(function(e){var t=e.split(`=`),n=t.shift().trimLeft().toLowerCase();if(!od(n)){var r=t.join(`=`);if(n===`expires`)o.expires=new Date(r);else if(n===`max-age`){var i=parseInt(r,10);Number.isNaN(i)||(o.maxAge=i)}else n===`secure`?o.secure=!0:n===`httponly`?o.httpOnly=!0:n===`samesite`?o.sameSite=r:n===`partitioned`?o.partitioned=!0:n&&(o[n]=r)}}),o}function mge(e){var t=``,n=``,r=e.split(`=`);return r.length>1?(t=r.shift(),n=r.join(`=`)):n=e,{name:t,value:n}}function ld(e,t){if(t=t?Object.assign({},ud,t):ud,!e)return t.map?sd():[];if(e.headers)if(typeof e.headers.getSetCookie==`function`)e=e.headers.getSetCookie();else if(e.headers[`set-cookie`])e=e.headers[`set-cookie`];else{var n=e.headers[Object.keys(e.headers).find(function(e){return e.toLowerCase()===`set-cookie`})];!n&&e.headers.cookie&&!t.silent&&console.warn(`Warning: set-cookie-parser appears to have been called on a request object. It is designed to parse Set-Cookie headers from responses, not Cookie headers from requests. Set the option {silent: true} to suppress this warning.`),e=n}var r=t.split,i=Array.isArray(e);if(r===`auto`&&(r=!i),i||(e=[e]),e=e.filter(pge),r&&(e=e.map(hge).flat()),t.map){var a=sd();return e.reduce(function(e,n){var r=cd(n,t);return r&&!od(r.name)&&(e[r.name]=r),e},a)}else return e.map(function(e){return cd(e,t)}).filter(Boolean)}function hge(e){if(Array.isArray(e))return e;if(typeof e!=`string`)return[];var t=[],n=0,r,i,a,o,s;function c(){for(;n<e.length&&/\s/.test(e.charAt(n));)n+=1;return n<e.length}function l(){return i=e.charAt(n),i!==`=`&&i!==`;`&&i!==`,`}for(;n<e.length;){for(r=n,s=!1;c();)if(i=e.charAt(n),i===`,`){for(a=n,n+=1,c(),o=n;n<e.length&&l();)n+=1;n<e.length&&e.charAt(n)===`=`?(s=!0,n=o,t.push(e.substring(r,a)),r=n):n=a+1}else n+=1;(!s||n>=e.length)&&t.push(e.substring(r,e.length))}return t}var ud,gge=s((()=>{ud={decodeValues:!0,map:!1,silent:!1,split:`auto`},ld.parseSetCookie=ld,ld.parse=ld,ld.parseString=cd,ld.splitCookiesString=hge})),_ge,vge,yge,dd,bge,xge,Sge=s((()=>{Whe(),Khe(),Yhe(),$he(),tge(),$u(),nd(),id(),dge(),ad(),_ge=d(fge(),1),gge(),vge=[204,205,304],yge=async({isUsingProxy:e,requestPayload:t,plugins:n=[],customFetch:r=fetch})=>{try{let i=performance.now(),a=Qu()?await r(...t):await r(td(...t)),o=performance.now(),s=Date.now(),c=o-i,l=a.headers.get(`content-type`),u=lge(a.headers,e),d=new URL(a.url),f=d.pathname+d.search,p=a.statusText||rd[a.status]?.name||``,m=t[1].method??`GET`,h=vge.includes(a.status);return l?.startsWith(`text/event-stream`)&&a.body?bge({response:a,requestPayload:t,timestamp:s,duration:c,responseHeaders:u,statusText:p,method:m,fullPath:f}):xge({response:a,requestPayload:t,timestamp:s,duration:c,responseHeaders:u,statusText:p,method:m,fullPath:f,contentType:l,shouldSkipBody:h,plugins:n})}catch(e){return[ege(e,Xu.REQUEST_FAILED),null]}},dd=e=>{let t=ld(e.headers.get(`x-scalar-set-cookie`)??``).map(e=>_ge.serialize(e.name,e.value,{...e,sameSite:e.sameSite,encode:e=>e}));return t.length?t:null},bge=({response:e,requestPayload:t,timestamp:n,duration:r,responseHeaders:i,statusText:a,method:o,fullPath:s})=>{let c=new Response(null,{status:e.status,statusText:a,headers:e.headers}),l=dd(c)??zu(c.headers);return[null,{timestamp:n,requestPayload:t,response:{...c,headers:i,cookieHeaderKeys:l,reader:e.body.getReader(),duration:r,method:o,path:s},originalResponse:c.clone()}]},xge=async({response:e,requestPayload:t,timestamp:n,duration:r,responseHeaders:i,statusText:a,method:o,fullPath:s,contentType:c,shouldSkipBody:l,plugins:u})=>{let d=await e.clone().arrayBuffer(),f=Gu(c),p=Ku(c).essence,m=await Qhe(d,f,Bu(p,u)),h=new Response(l?null:d,{status:e.status,statusText:a,headers:e.headers}),g=dd(h)??zu(h.headers);return[null,{timestamp:n,requestPayload:t,response:{...h,headers:i,cookieHeaderKeys:g,data:m,size:d.byteLength,duration:r,method:o,status:e.status,path:s},originalResponse:e.clone()}]}}));function Cge(e){var t,n,r=``;if(typeof e==`string`||typeof e==`number`)r+=e;else if(typeof e==`object`)if(Array.isArray(e)){var i=e.length;for(t=0;t<i;t++)e[t]&&(n=Cge(e[t]))&&(r&&(r+=` `),r+=n)}else for(n in e)e[n]&&(r&&(r+=` `),r+=n);return r}function fd(){for(var e,t,n=0,r=``,i=arguments.length;n<i;n++)(e=arguments[n])&&(t=Cge(e))&&(r&&(r+=` `),r+=t);return r}var wge=s((()=>{})),pd,md,Tge,Ege,Dge,Oge=s((()=>{wge(),pd=e=>typeof e==`boolean`?`${e}`:e===0?`0`:e,md=e=>{let t=function(){for(var t=arguments.length,n=Array(t),r=0;r<t;r++)n[r]=arguments[r];return e?.hooks?.[`cx:done`]===void 0?e?.hooks?.onComplete===void 0?fd(n):e?.hooks.onComplete(fd(n)):e?.hooks[`cx:done`](fd(n))};return{compose:function(){for(var e=arguments.length,n=Array(e),r=0;r<e;r++)n[r]=arguments[r];return e=>{let r=Object.fromEntries(Object.entries(e||{}).filter(e=>{let[t]=e;return![`class`,`className`].includes(t)}));return t(n.map(e=>e(r)),e?.class,e?.className)}},cva:e=>n=>{if(e?.variants==null)return t(e?.base,n?.class,n?.className);let{variants:r,defaultVariants:i}=e,a=Object.keys(r).map(e=>{let t=n?.[e],a=i?.[e],o=pd(t)||pd(a);return r[e][o]}),o={...i,...n&&Object.entries(n).reduce((e,t)=>{let[n,r]=t;return r===void 0?e:{...e,[n]:r}},{})},s=e?.compoundVariants?.reduce((e,t)=>{let{class:n,className:r,...i}=t;return Object.entries(i).every(e=>{let[t,n]=e,r=o[t];return Array.isArray(n)?n.includes(r):r===n})?[...e,n,r]:e},[]);return t(e?.base,a,s,n?.class,n?.className)},cx:t}},{compose:Tge,cva:Ege,cx:Dge}=md()})),kge,Age,hd,gd,_d,jge,Mge,vd,Nge,Pge,Fge,yd,Ige,Lge,Rge,zge,bd,Bge,Vge,xd,Sd,Hge,Cd,Uge,Wge,Gge,Kge,qge,Jge,wd,Td,Yge,Ed,Dd,Od,Xge,Zge,Qge,$ge,e_e,t_e,kd,Ad,jd,Md,Nd,Pd,n_e,Fd,r_e,i_e,a_e,o_e,Id,Ld,Rd,s_e,c_e,zd,l_e,Bd,Vd,Hd,u_e,Ud,d_e,f_e,Wd,p_e,Gd,Kd,qd,Jd,Yd,Xd,m_e,Zd,Qd,$d,ef,h_e,tf,nf,rf,af,g_e,__e=s((()=>{kge=(e,t)=>{let n=Array(e.length+t.length);for(let t=0;t<e.length;t++)n[t]=e[t];for(let r=0;r<t.length;r++)n[e.length+r]=t[r];return n},Age=(e,t)=>({classGroupId:e,validator:t}),hd=(e=new Map,t=null,n)=>({nextPart:e,validators:t,classGroupId:n}),gd=`-`,_d=[],jge=`arbitrary..`,Mge=e=>{let t=Pge(e),{conflictingClassGroups:n,conflictingClassGroupModifiers:r}=e;return{getClassGroupId:e=>{if(e.startsWith(`[`)&&e.endsWith(`]`))return Nge(e);let n=e.split(gd);return vd(n,n[0]===``&&n.length>1?1:0,t)},getConflictingClassGroupIds:(e,t)=>{if(t){let t=r[e],i=n[e];return t?i?kge(i,t):t:i||_d}return n[e]||_d}}},vd=(e,t,n)=>{if(e.length-t===0)return n.classGroupId;let r=e[t],i=n.nextPart.get(r);if(i){let n=vd(e,t+1,i);if(n)return n}let a=n.validators;if(a===null)return;let o=t===0?e.join(gd):e.slice(t).join(gd),s=a.length;for(let e=0;e<s;e++){let t=a[e];if(t.validator(o))return t.classGroupId}},Nge=e=>e.slice(1,-1).indexOf(`:`)===-1?void 0:(()=>{let t=e.slice(1,-1),n=t.indexOf(`:`),r=t.slice(0,n);return r?jge+r:void 0})(),Pge=e=>{let{theme:t,classGroups:n}=e;return Fge(n,t)},Fge=(e,t)=>{let n=hd();for(let r in e){let i=e[r];yd(i,n,r,t)}return n},yd=(e,t,n,r)=>{let i=e.length;for(let a=0;a<i;a++){let i=e[a];Ige(i,t,n,r)}},Ige=(e,t,n,r)=>{if(typeof e==`string`){Lge(e,t,n);return}if(typeof e==`function`){Rge(e,t,n,r);return}zge(e,t,n,r)},Lge=(e,t,n)=>{let r=e===``?t:bd(t,e);r.classGroupId=n},Rge=(e,t,n,r)=>{if(Bge(e)){yd(e(r),t,n,r);return}t.validators===null&&(t.validators=[]),t.validators.push(Age(n,e))},zge=(e,t,n,r)=>{let i=Object.entries(e),a=i.length;for(let e=0;e<a;e++){let[a,o]=i[e];yd(o,bd(t,a),n,r)}},bd=(e,t)=>{let n=e,r=t.split(gd),i=r.length;for(let e=0;e<i;e++){let t=r[e],i=n.nextPart.get(t);i||(i=hd(),n.nextPart.set(t,i)),n=i}return n},Bge=e=>`isThemeGetter`in e&&e.isThemeGetter===!0,Vge=e=>{if(e<1)return{get:()=>void 0,set:()=>{}};let t=0,n=Object.create(null),r=Object.create(null),i=(i,a)=>{n[i]=a,t++,t>e&&(t=0,r=n,n=Object.create(null))};return{get(e){let t=n[e];if(t!==void 0)return t;if((t=r[e])!==void 0)return i(e,t),t},set(e,t){e in n?n[e]=t:i(e,t)}}},xd=`!`,Sd=`:`,Hge=[],Cd=(e,t,n,r,i)=>({modifiers:e,hasImportantModifier:t,baseClassName:n,maybePostfixModifierPosition:r,isExternal:i}),Uge=e=>{let{prefix:t,experimentalParseClassName:n}=e,r=e=>{let t=[],n=0,r=0,i=0,a,o=e.length;for(let s=0;s<o;s++){let o=e[s];if(n===0&&r===0){if(o===Sd){t.push(e.slice(i,s)),i=s+1;continue}if(o===`/`){a=s;continue}}o===`[`?n++:o===`]`?n--:o===`(`?r++:o===`)`&&r--}let s=t.length===0?e:e.slice(i),c=s,l=!1;s.endsWith(xd)?(c=s.slice(0,-1),l=!0):s.startsWith(xd)&&(c=s.slice(1),l=!0);let u=a&&a>i?a-i:void 0;return Cd(t,l,c,u)};if(t){let e=t+Sd,n=r;r=t=>t.startsWith(e)?n(t.slice(e.length)):Cd(Hge,!1,t,void 0,!0)}if(n){let e=r;r=t=>n({className:t,parseClassName:e})}return r},Wge=e=>{let t=new Map;return e.orderSensitiveModifiers.forEach((e,n)=>{t.set(e,1e6+n)}),e=>{let n=[],r=[];for(let i=0;i<e.length;i++){let a=e[i],o=a[0]===`[`,s=t.has(a);o||s?(r.length>0&&(r.sort(),n.push(...r),r=[]),n.push(a)):r.push(a)}return r.length>0&&(r.sort(),n.push(...r)),n}},Gge=e=>({cache:Vge(e.cacheSize),parseClassName:Uge(e),sortModifiers:Wge(e),...Mge(e)}),Kge=/\s+/,qge=(e,t)=>{let{parseClassName:n,getClassGroupId:r,getConflictingClassGroupIds:i,sortModifiers:a}=t,o=[],s=e.trim().split(Kge),c=``;for(let e=s.length-1;e>=0;--e){let t=s[e],{isExternal:l,modifiers:u,hasImportantModifier:d,baseClassName:f,maybePostfixModifierPosition:p}=n(t);if(l){c=t+(c.length>0?` `+c:c);continue}let m=!!p,h=r(m?f.substring(0,p):f);if(!h){if(!m){c=t+(c.length>0?` `+c:c);continue}if(h=r(f),!h){c=t+(c.length>0?` `+c:c);continue}m=!1}let g=u.length===0?``:u.length===1?u[0]:a(u).join(`:`),_=d?g+xd:g,v=_+h;if(o.indexOf(v)>-1)continue;o.push(v);let y=i(h,m);for(let e=0;e<y.length;++e){let t=y[e];o.push(_+t)}c=t+(c.length>0?` `+c:c)}return c},Jge=(...e)=>{let t=0,n,r,i=``;for(;t<e.length;)(n=e[t++])&&(r=wd(n))&&(i&&(i+=` `),i+=r);return i},wd=e=>{if(typeof e==`string`)return e;let t,n=``;for(let r=0;r<e.length;r++)e[r]&&(t=wd(e[r]))&&(n&&(n+=` `),n+=t);return n},Td=(e,...t)=>{let n,r,i,a,o=o=>(n=Gge(t.reduce((e,t)=>t(e),e())),r=n.cache.get,i=n.cache.set,a=s,s(o)),s=e=>{let t=r(e);if(t)return t;let a=qge(e,n);return i(e,a),a};return a=o,(...e)=>a(Jge(...e))},Yge=[],Ed=e=>{let t=t=>t[e]||Yge;return t.isThemeGetter=!0,t},Dd=/^\[(?:(\w[\w-]*):)?(.+)\]$/i,Od=/^\((?:(\w[\w-]*):)?(.+)\)$/i,Xge=/^\d+(?:\.\d+)?\/\d+(?:\.\d+)?$/,Zge=/^(\d+(\.\d+)?)?(xs|sm|md|lg|xl)$/,Qge=/\d+(%|px|r?em|[sdl]?v([hwib]|min|max)|pt|pc|in|cm|mm|cap|ch|ex|r?lh|cq(w|h|i|b|min|max))|\b(calc|min|max|clamp)\(.+\)|^0$/,$ge=/^(rgba?|hsla?|hwb|(ok)?(lab|lch)|color-mix)\(.+\)$/,e_e=/^(inset_)?-?((\d+)?\.?(\d+)[a-z]+|0)_-?((\d+)?\.?(\d+)[a-z]+|0)/,t_e=/^(url|image|image-set|cross-fade|element|(repeating-)?(linear|radial|conic)-gradient)\(.+\)$/,kd=e=>Xge.test(e),Ad=e=>!!e&&!Number.isNaN(Number(e)),jd=e=>!!e&&Number.isInteger(Number(e)),Md=e=>e.endsWith(`%`)&&Ad(e.slice(0,-1)),Nd=e=>Zge.test(e),Pd=()=>!0,n_e=e=>Qge.test(e)&&!$ge.test(e),Fd=()=>!1,r_e=e=>e_e.test(e),i_e=e=>t_e.test(e),a_e=e=>!Id(e)&&!Vd(e),o_e=e=>Gd(e,Yd,Fd),Id=e=>Dd.test(e),Ld=e=>Gd(e,Xd,n_e),Rd=e=>Gd(e,m_e,Ad),s_e=e=>Gd(e,Qd,Pd),c_e=e=>Gd(e,Zd,Fd),zd=e=>Gd(e,qd,Fd),l_e=e=>Gd(e,Jd,i_e),Bd=e=>Gd(e,$d,r_e),Vd=e=>Od.test(e),Hd=e=>Kd(e,Xd),u_e=e=>Kd(e,Zd),Ud=e=>Kd(e,qd),d_e=e=>Kd(e,Yd),f_e=e=>Kd(e,Jd),Wd=e=>Kd(e,$d,!0),p_e=e=>Kd(e,Qd,!0),Gd=(e,t,n)=>{let r=Dd.exec(e);return r?r[1]?t(r[1]):n(r[2]):!1},Kd=(e,t,n=!1)=>{let r=Od.exec(e);return r?r[1]?t(r[1]):n:!1},qd=e=>e===`position`||e===`percentage`,Jd=e=>e===`image`||e===`url`,Yd=e=>e===`length`||e===`size`||e===`bg-size`,Xd=e=>e===`length`,m_e=e=>e===`number`,Zd=e=>e===`family-name`,Qd=e=>e===`number`||e===`weight`,$d=e=>e===`shadow`,ef=()=>{let e=Ed(`color`),t=Ed(`font`),n=Ed(`text`),r=Ed(`font-weight`),i=Ed(`tracking`),a=Ed(`leading`),o=Ed(`breakpoint`),s=Ed(`container`),c=Ed(`spacing`),l=Ed(`radius`),u=Ed(`shadow`),d=Ed(`inset-shadow`),f=Ed(`text-shadow`),p=Ed(`drop-shadow`),m=Ed(`blur`),h=Ed(`perspective`),g=Ed(`aspect`),_=Ed(`ease`),v=Ed(`animate`),y=()=>[`auto`,`avoid`,`all`,`avoid-page`,`page`,`left`,`right`,`column`],b=()=>[`center`,`top`,`bottom`,`left`,`right`,`top-left`,`left-top`,`top-right`,`right-top`,`bottom-right`,`right-bottom`,`bottom-left`,`left-bottom`],x=()=>[...b(),Vd,Id],S=()=>[`auto`,`hidden`,`clip`,`visible`,`scroll`],C=()=>[`auto`,`contain`,`none`],w=()=>[Vd,Id,c],ee=()=>[kd,`full`,`auto`,...w()],te=()=>[jd,`none`,`subgrid`,Vd,Id],ne=()=>[`auto`,{span:[`full`,jd,Vd,Id]},jd,Vd,Id],re=()=>[jd,`auto`,Vd,Id],T=()=>[`auto`,`min`,`max`,`fr`,Vd,Id],ie=()=>[`start`,`end`,`center`,`between`,`around`,`evenly`,`stretch`,`baseline`,`center-safe`,`end-safe`],ae=()=>[`start`,`end`,`center`,`stretch`,`center-safe`,`end-safe`],E=()=>[`auto`,...w()],D=()=>[kd,`auto`,`full`,`dvw`,`dvh`,`lvw`,`lvh`,`svw`,`svh`,`min`,`max`,`fit`,...w()],oe=()=>[kd,`screen`,`full`,`dvw`,`lvw`,`svw`,`min`,`max`,`fit`,...w()],se=()=>[kd,`screen`,`full`,`lh`,`dvh`,`lvh`,`svh`,`min`,`max`,`fit`,...w()],ce=()=>[e,Vd,Id],le=()=>[...b(),Ud,zd,{position:[Vd,Id]}],ue=()=>[`no-repeat`,{repeat:[``,`x`,`y`,`space`,`round`]}],de=()=>[`auto`,`cover`,`contain`,d_e,o_e,{size:[Vd,Id]}],fe=()=>[Md,Hd,Ld],pe=()=>[``,`none`,`full`,l,Vd,Id],me=()=>[``,Ad,Hd,Ld],he=()=>[`solid`,`dashed`,`dotted`,`double`],ge=()=>[`normal`,`multiply`,`screen`,`overlay`,`darken`,`lighten`,`color-dodge`,`color-burn`,`hard-light`,`soft-light`,`difference`,`exclusion`,`hue`,`saturation`,`color`,`luminosity`],_e=()=>[Ad,Md,Ud,zd],ve=()=>[``,`none`,m,Vd,Id],ye=()=>[`none`,Ad,Vd,Id],be=()=>[`none`,Ad,Vd,Id],xe=()=>[Ad,Vd,Id],Se=()=>[kd,`full`,...w()];return{cacheSize:500,theme:{animate:[`spin`,`ping`,`pulse`,`bounce`],aspect:[`video`],blur:[Nd],breakpoint:[Nd],color:[Pd],container:[Nd],"drop-shadow":[Nd],ease:[`in`,`out`,`in-out`],font:[a_e],"font-weight":[`thin`,`extralight`,`light`,`normal`,`medium`,`semibold`,`bold`,`extrabold`,`black`],"inset-shadow":[Nd],leading:[`none`,`tight`,`snug`,`normal`,`relaxed`,`loose`],perspective:[`dramatic`,`near`,`normal`,`midrange`,`distant`,`none`],radius:[Nd],shadow:[Nd],spacing:[`px`,Ad],text:[Nd],"text-shadow":[Nd],tracking:[`tighter`,`tight`,`normal`,`wide`,`wider`,`widest`]},classGroups:{aspect:[{aspect:[`auto`,`square`,kd,Id,Vd,g]}],container:[`container`],columns:[{columns:[Ad,Id,Vd,s]}],"break-after":[{"break-after":y()}],"break-before":[{"break-before":y()}],"break-inside":[{"break-inside":[`auto`,`avoid`,`avoid-page`,`avoid-column`]}],"box-decoration":[{"box-decoration":[`slice`,`clone`]}],box:[{box:[`border`,`content`]}],display:[`block`,`inline-block`,`inline`,`flex`,`inline-flex`,`table`,`inline-table`,`table-caption`,`table-cell`,`table-column`,`table-column-group`,`table-footer-group`,`table-header-group`,`table-row-group`,`table-row`,`flow-root`,`grid`,`inline-grid`,`contents`,`list-item`,`hidden`],sr:[`sr-only`,`not-sr-only`],float:[{float:[`right`,`left`,`none`,`start`,`end`]}],clear:[{clear:[`left`,`right`,`both`,`none`,`start`,`end`]}],isolation:[`isolate`,`isolation-auto`],"object-fit":[{object:[`contain`,`cover`,`fill`,`none`,`scale-down`]}],"object-position":[{object:x()}],overflow:[{overflow:S()}],"overflow-x":[{"overflow-x":S()}],"overflow-y":[{"overflow-y":S()}],overscroll:[{overscroll:C()}],"overscroll-x":[{"overscroll-x":C()}],"overscroll-y":[{"overscroll-y":C()}],position:[`static`,`fixed`,`absolute`,`relative`,`sticky`],inset:[{inset:ee()}],"inset-x":[{"inset-x":ee()}],"inset-y":[{"inset-y":ee()}],start:[{"inset-s":ee(),start:ee()}],end:[{"inset-e":ee(),end:ee()}],"inset-bs":[{"inset-bs":ee()}],"inset-be":[{"inset-be":ee()}],top:[{top:ee()}],right:[{right:ee()}],bottom:[{bottom:ee()}],left:[{left:ee()}],visibility:[`visible`,`invisible`,`collapse`],z:[{z:[jd,`auto`,Vd,Id]}],basis:[{basis:[kd,`full`,`auto`,s,...w()]}],"flex-direction":[{flex:[`row`,`row-reverse`,`col`,`col-reverse`]}],"flex-wrap":[{flex:[`nowrap`,`wrap`,`wrap-reverse`]}],flex:[{flex:[Ad,kd,`auto`,`initial`,`none`,Id]}],grow:[{grow:[``,Ad,Vd,Id]}],shrink:[{shrink:[``,Ad,Vd,Id]}],order:[{order:[jd,`first`,`last`,`none`,Vd,Id]}],"grid-cols":[{"grid-cols":te()}],"col-start-end":[{col:ne()}],"col-start":[{"col-start":re()}],"col-end":[{"col-end":re()}],"grid-rows":[{"grid-rows":te()}],"row-start-end":[{row:ne()}],"row-start":[{"row-start":re()}],"row-end":[{"row-end":re()}],"grid-flow":[{"grid-flow":[`row`,`col`,`dense`,`row-dense`,`col-dense`]}],"auto-cols":[{"auto-cols":T()}],"auto-rows":[{"auto-rows":T()}],gap:[{gap:w()}],"gap-x":[{"gap-x":w()}],"gap-y":[{"gap-y":w()}],"justify-content":[{justify:[...ie(),`normal`]}],"justify-items":[{"justify-items":[...ae(),`normal`]}],"justify-self":[{"justify-self":[`auto`,...ae()]}],"align-content":[{content:[`normal`,...ie()]}],"align-items":[{items:[...ae(),{baseline:[``,`last`]}]}],"align-self":[{self:[`auto`,...ae(),{baseline:[``,`last`]}]}],"place-content":[{"place-content":ie()}],"place-items":[{"place-items":[...ae(),`baseline`]}],"place-self":[{"place-self":[`auto`,...ae()]}],p:[{p:w()}],px:[{px:w()}],py:[{py:w()}],ps:[{ps:w()}],pe:[{pe:w()}],pbs:[{pbs:w()}],pbe:[{pbe:w()}],pt:[{pt:w()}],pr:[{pr:w()}],pb:[{pb:w()}],pl:[{pl:w()}],m:[{m:E()}],mx:[{mx:E()}],my:[{my:E()}],ms:[{ms:E()}],me:[{me:E()}],mbs:[{mbs:E()}],mbe:[{mbe:E()}],mt:[{mt:E()}],mr:[{mr:E()}],mb:[{mb:E()}],ml:[{ml:E()}],"space-x":[{"space-x":w()}],"space-x-reverse":[`space-x-reverse`],"space-y":[{"space-y":w()}],"space-y-reverse":[`space-y-reverse`],size:[{size:D()}],"inline-size":[{inline:[`auto`,...oe()]}],"min-inline-size":[{"min-inline":[`auto`,...oe()]}],"max-inline-size":[{"max-inline":[`none`,...oe()]}],"block-size":[{block:[`auto`,...se()]}],"min-block-size":[{"min-block":[`auto`,...se()]}],"max-block-size":[{"max-block":[`none`,...se()]}],w:[{w:[s,`screen`,...D()]}],"min-w":[{"min-w":[s,`screen`,`none`,...D()]}],"max-w":[{"max-w":[s,`screen`,`none`,`prose`,{screen:[o]},...D()]}],h:[{h:[`screen`,`lh`,...D()]}],"min-h":[{"min-h":[`screen`,`lh`,`none`,...D()]}],"max-h":[{"max-h":[`screen`,`lh`,...D()]}],"font-size":[{text:[`base`,n,Hd,Ld]}],"font-smoothing":[`antialiased`,`subpixel-antialiased`],"font-style":[`italic`,`not-italic`],"font-weight":[{font:[r,p_e,s_e]}],"font-stretch":[{"font-stretch":[`ultra-condensed`,`extra-condensed`,`condensed`,`semi-condensed`,`normal`,`semi-expanded`,`expanded`,`extra-expanded`,`ultra-expanded`,Md,Id]}],"font-family":[{font:[u_e,c_e,t]}],"font-features":[{"font-features":[Id]}],"fvn-normal":[`normal-nums`],"fvn-ordinal":[`ordinal`],"fvn-slashed-zero":[`slashed-zero`],"fvn-figure":[`lining-nums`,`oldstyle-nums`],"fvn-spacing":[`proportional-nums`,`tabular-nums`],"fvn-fraction":[`diagonal-fractions`,`stacked-fractions`],tracking:[{tracking:[i,Vd,Id]}],"line-clamp":[{"line-clamp":[Ad,`none`,Vd,Rd]}],leading:[{leading:[a,...w()]}],"list-image":[{"list-image":[`none`,Vd,Id]}],"list-style-position":[{list:[`inside`,`outside`]}],"list-style-type":[{list:[`disc`,`decimal`,`none`,Vd,Id]}],"text-alignment":[{text:[`left`,`center`,`right`,`justify`,`start`,`end`]}],"placeholder-color":[{placeholder:ce()}],"text-color":[{text:ce()}],"text-decoration":[`underline`,`overline`,`line-through`,`no-underline`],"text-decoration-style":[{decoration:[...he(),`wavy`]}],"text-decoration-thickness":[{decoration:[Ad,`from-font`,`auto`,Vd,Ld]}],"text-decoration-color":[{decoration:ce()}],"underline-offset":[{"underline-offset":[Ad,`auto`,Vd,Id]}],"text-transform":[`uppercase`,`lowercase`,`capitalize`,`normal-case`],"text-overflow":[`truncate`,`text-ellipsis`,`text-clip`],"text-wrap":[{text:[`wrap`,`nowrap`,`balance`,`pretty`]}],indent:[{indent:w()}],"vertical-align":[{align:[`baseline`,`top`,`middle`,`bottom`,`text-top`,`text-bottom`,`sub`,`super`,Vd,Id]}],whitespace:[{whitespace:[`normal`,`nowrap`,`pre`,`pre-line`,`pre-wrap`,`break-spaces`]}],break:[{break:[`normal`,`words`,`all`,`keep`]}],wrap:[{wrap:[`break-word`,`anywhere`,`normal`]}],hyphens:[{hyphens:[`none`,`manual`,`auto`]}],content:[{content:[`none`,Vd,Id]}],"bg-attachment":[{bg:[`fixed`,`local`,`scroll`]}],"bg-clip":[{"bg-clip":[`border`,`padding`,`content`,`text`]}],"bg-origin":[{"bg-origin":[`border`,`padding`,`content`]}],"bg-position":[{bg:le()}],"bg-repeat":[{bg:ue()}],"bg-size":[{bg:de()}],"bg-image":[{bg:[`none`,{linear:[{to:[`t`,`tr`,`r`,`br`,`b`,`bl`,`l`,`tl`]},jd,Vd,Id],radial:[``,Vd,Id],conic:[jd,Vd,Id]},f_e,l_e]}],"bg-color":[{bg:ce()}],"gradient-from-pos":[{from:fe()}],"gradient-via-pos":[{via:fe()}],"gradient-to-pos":[{to:fe()}],"gradient-from":[{from:ce()}],"gradient-via":[{via:ce()}],"gradient-to":[{to:ce()}],rounded:[{rounded:pe()}],"rounded-s":[{"rounded-s":pe()}],"rounded-e":[{"rounded-e":pe()}],"rounded-t":[{"rounded-t":pe()}],"rounded-r":[{"rounded-r":pe()}],"rounded-b":[{"rounded-b":pe()}],"rounded-l":[{"rounded-l":pe()}],"rounded-ss":[{"rounded-ss":pe()}],"rounded-se":[{"rounded-se":pe()}],"rounded-ee":[{"rounded-ee":pe()}],"rounded-es":[{"rounded-es":pe()}],"rounded-tl":[{"rounded-tl":pe()}],"rounded-tr":[{"rounded-tr":pe()}],"rounded-br":[{"rounded-br":pe()}],"rounded-bl":[{"rounded-bl":pe()}],"border-w":[{border:me()}],"border-w-x":[{"border-x":me()}],"border-w-y":[{"border-y":me()}],"border-w-s":[{"border-s":me()}],"border-w-e":[{"border-e":me()}],"border-w-bs":[{"border-bs":me()}],"border-w-be":[{"border-be":me()}],"border-w-t":[{"border-t":me()}],"border-w-r":[{"border-r":me()}],"border-w-b":[{"border-b":me()}],"border-w-l":[{"border-l":me()}],"divide-x":[{"divide-x":me()}],"divide-x-reverse":[`divide-x-reverse`],"divide-y":[{"divide-y":me()}],"divide-y-reverse":[`divide-y-reverse`],"border-style":[{border:[...he(),`hidden`,`none`]}],"divide-style":[{divide:[...he(),`hidden`,`none`]}],"border-color":[{border:ce()}],"border-color-x":[{"border-x":ce()}],"border-color-y":[{"border-y":ce()}],"border-color-s":[{"border-s":ce()}],"border-color-e":[{"border-e":ce()}],"border-color-bs":[{"border-bs":ce()}],"border-color-be":[{"border-be":ce()}],"border-color-t":[{"border-t":ce()}],"border-color-r":[{"border-r":ce()}],"border-color-b":[{"border-b":ce()}],"border-color-l":[{"border-l":ce()}],"divide-color":[{divide:ce()}],"outline-style":[{outline:[...he(),`none`,`hidden`]}],"outline-offset":[{"outline-offset":[Ad,Vd,Id]}],"outline-w":[{outline:[``,Ad,Hd,Ld]}],"outline-color":[{outline:ce()}],shadow:[{shadow:[``,`none`,u,Wd,Bd]}],"shadow-color":[{shadow:ce()}],"inset-shadow":[{"inset-shadow":[`none`,d,Wd,Bd]}],"inset-shadow-color":[{"inset-shadow":ce()}],"ring-w":[{ring:me()}],"ring-w-inset":[`ring-inset`],"ring-color":[{ring:ce()}],"ring-offset-w":[{"ring-offset":[Ad,Ld]}],"ring-offset-color":[{"ring-offset":ce()}],"inset-ring-w":[{"inset-ring":me()}],"inset-ring-color":[{"inset-ring":ce()}],"text-shadow":[{"text-shadow":[`none`,f,Wd,Bd]}],"text-shadow-color":[{"text-shadow":ce()}],opacity:[{opacity:[Ad,Vd,Id]}],"mix-blend":[{"mix-blend":[...ge(),`plus-darker`,`plus-lighter`]}],"bg-blend":[{"bg-blend":ge()}],"mask-clip":[{"mask-clip":[`border`,`padding`,`content`,`fill`,`stroke`,`view`]},`mask-no-clip`],"mask-composite":[{mask:[`add`,`subtract`,`intersect`,`exclude`]}],"mask-image-linear-pos":[{"mask-linear":[Ad]}],"mask-image-linear-from-pos":[{"mask-linear-from":_e()}],"mask-image-linear-to-pos":[{"mask-linear-to":_e()}],"mask-image-linear-from-color":[{"mask-linear-from":ce()}],"mask-image-linear-to-color":[{"mask-linear-to":ce()}],"mask-image-t-from-pos":[{"mask-t-from":_e()}],"mask-image-t-to-pos":[{"mask-t-to":_e()}],"mask-image-t-from-color":[{"mask-t-from":ce()}],"mask-image-t-to-color":[{"mask-t-to":ce()}],"mask-image-r-from-pos":[{"mask-r-from":_e()}],"mask-image-r-to-pos":[{"mask-r-to":_e()}],"mask-image-r-from-color":[{"mask-r-from":ce()}],"mask-image-r-to-color":[{"mask-r-to":ce()}],"mask-image-b-from-pos":[{"mask-b-from":_e()}],"mask-image-b-to-pos":[{"mask-b-to":_e()}],"mask-image-b-from-color":[{"mask-b-from":ce()}],"mask-image-b-to-color":[{"mask-b-to":ce()}],"mask-image-l-from-pos":[{"mask-l-from":_e()}],"mask-image-l-to-pos":[{"mask-l-to":_e()}],"mask-image-l-from-color":[{"mask-l-from":ce()}],"mask-image-l-to-color":[{"mask-l-to":ce()}],"mask-image-x-from-pos":[{"mask-x-from":_e()}],"mask-image-x-to-pos":[{"mask-x-to":_e()}],"mask-image-x-from-color":[{"mask-x-from":ce()}],"mask-image-x-to-color":[{"mask-x-to":ce()}],"mask-image-y-from-pos":[{"mask-y-from":_e()}],"mask-image-y-to-pos":[{"mask-y-to":_e()}],"mask-image-y-from-color":[{"mask-y-from":ce()}],"mask-image-y-to-color":[{"mask-y-to":ce()}],"mask-image-radial":[{"mask-radial":[Vd,Id]}],"mask-image-radial-from-pos":[{"mask-radial-from":_e()}],"mask-image-radial-to-pos":[{"mask-radial-to":_e()}],"mask-image-radial-from-color":[{"mask-radial-from":ce()}],"mask-image-radial-to-color":[{"mask-radial-to":ce()}],"mask-image-radial-shape":[{"mask-radial":[`circle`,`ellipse`]}],"mask-image-radial-size":[{"mask-radial":[{closest:[`side`,`corner`],farthest:[`side`,`corner`]}]}],"mask-image-radial-pos":[{"mask-radial-at":b()}],"mask-image-conic-pos":[{"mask-conic":[Ad]}],"mask-image-conic-from-pos":[{"mask-conic-from":_e()}],"mask-image-conic-to-pos":[{"mask-conic-to":_e()}],"mask-image-conic-from-color":[{"mask-conic-from":ce()}],"mask-image-conic-to-color":[{"mask-conic-to":ce()}],"mask-mode":[{mask:[`alpha`,`luminance`,`match`]}],"mask-origin":[{"mask-origin":[`border`,`padding`,`content`,`fill`,`stroke`,`view`]}],"mask-position":[{mask:le()}],"mask-repeat":[{mask:ue()}],"mask-size":[{mask:de()}],"mask-type":[{"mask-type":[`alpha`,`luminance`]}],"mask-image":[{mask:[`none`,Vd,Id]}],filter:[{filter:[``,`none`,Vd,Id]}],blur:[{blur:ve()}],brightness:[{brightness:[Ad,Vd,Id]}],contrast:[{contrast:[Ad,Vd,Id]}],"drop-shadow":[{"drop-shadow":[``,`none`,p,Wd,Bd]}],"drop-shadow-color":[{"drop-shadow":ce()}],grayscale:[{grayscale:[``,Ad,Vd,Id]}],"hue-rotate":[{"hue-rotate":[Ad,Vd,Id]}],invert:[{invert:[``,Ad,Vd,Id]}],saturate:[{saturate:[Ad,Vd,Id]}],sepia:[{sepia:[``,Ad,Vd,Id]}],"backdrop-filter":[{"backdrop-filter":[``,`none`,Vd,Id]}],"backdrop-blur":[{"backdrop-blur":ve()}],"backdrop-brightness":[{"backdrop-brightness":[Ad,Vd,Id]}],"backdrop-contrast":[{"backdrop-contrast":[Ad,Vd,Id]}],"backdrop-grayscale":[{"backdrop-grayscale":[``,Ad,Vd,Id]}],"backdrop-hue-rotate":[{"backdrop-hue-rotate":[Ad,Vd,Id]}],"backdrop-invert":[{"backdrop-invert":[``,Ad,Vd,Id]}],"backdrop-opacity":[{"backdrop-opacity":[Ad,Vd,Id]}],"backdrop-saturate":[{"backdrop-saturate":[Ad,Vd,Id]}],"backdrop-sepia":[{"backdrop-sepia":[``,Ad,Vd,Id]}],"border-collapse":[{border:[`collapse`,`separate`]}],"border-spacing":[{"border-spacing":w()}],"border-spacing-x":[{"border-spacing-x":w()}],"border-spacing-y":[{"border-spacing-y":w()}],"table-layout":[{table:[`auto`,`fixed`]}],caption:[{caption:[`top`,`bottom`]}],transition:[{transition:[``,`all`,`colors`,`opacity`,`shadow`,`transform`,`none`,Vd,Id]}],"transition-behavior":[{transition:[`normal`,`discrete`]}],duration:[{duration:[Ad,`initial`,Vd,Id]}],ease:[{ease:[`linear`,`initial`,_,Vd,Id]}],delay:[{delay:[Ad,Vd,Id]}],animate:[{animate:[`none`,v,Vd,Id]}],backface:[{backface:[`hidden`,`visible`]}],perspective:[{perspective:[h,Vd,Id]}],"perspective-origin":[{"perspective-origin":x()}],rotate:[{rotate:ye()}],"rotate-x":[{"rotate-x":ye()}],"rotate-y":[{"rotate-y":ye()}],"rotate-z":[{"rotate-z":ye()}],scale:[{scale:be()}],"scale-x":[{"scale-x":be()}],"scale-y":[{"scale-y":be()}],"scale-z":[{"scale-z":be()}],"scale-3d":[`scale-3d`],skew:[{skew:xe()}],"skew-x":[{"skew-x":xe()}],"skew-y":[{"skew-y":xe()}],transform:[{transform:[Vd,Id,``,`none`,`gpu`,`cpu`]}],"transform-origin":[{origin:x()}],"transform-style":[{transform:[`3d`,`flat`]}],translate:[{translate:Se()}],"translate-x":[{"translate-x":Se()}],"translate-y":[{"translate-y":Se()}],"translate-z":[{"translate-z":Se()}],"translate-none":[`translate-none`],accent:[{accent:ce()}],appearance:[{appearance:[`none`,`auto`]}],"caret-color":[{caret:ce()}],"color-scheme":[{scheme:[`normal`,`dark`,`light`,`light-dark`,`only-dark`,`only-light`]}],cursor:[{cursor:[`auto`,`default`,`pointer`,`wait`,`text`,`move`,`help`,`not-allowed`,`none`,`context-menu`,`progress`,`cell`,`crosshair`,`vertical-text`,`alias`,`copy`,`no-drop`,`grab`,`grabbing`,`all-scroll`,`col-resize`,`row-resize`,`n-resize`,`e-resize`,`s-resize`,`w-resize`,`ne-resize`,`nw-resize`,`se-resize`,`sw-resize`,`ew-resize`,`ns-resize`,`nesw-resize`,`nwse-resize`,`zoom-in`,`zoom-out`,Vd,Id]}],"field-sizing":[{"field-sizing":[`fixed`,`content`]}],"pointer-events":[{"pointer-events":[`auto`,`none`]}],resize:[{resize:[`none`,``,`y`,`x`]}],"scroll-behavior":[{scroll:[`auto`,`smooth`]}],"scroll-m":[{"scroll-m":w()}],"scroll-mx":[{"scroll-mx":w()}],"scroll-my":[{"scroll-my":w()}],"scroll-ms":[{"scroll-ms":w()}],"scroll-me":[{"scroll-me":w()}],"scroll-mbs":[{"scroll-mbs":w()}],"scroll-mbe":[{"scroll-mbe":w()}],"scroll-mt":[{"scroll-mt":w()}],"scroll-mr":[{"scroll-mr":w()}],"scroll-mb":[{"scroll-mb":w()}],"scroll-ml":[{"scroll-ml":w()}],"scroll-p":[{"scroll-p":w()}],"scroll-px":[{"scroll-px":w()}],"scroll-py":[{"scroll-py":w()}],"scroll-ps":[{"scroll-ps":w()}],"scroll-pe":[{"scroll-pe":w()}],"scroll-pbs":[{"scroll-pbs":w()}],"scroll-pbe":[{"scroll-pbe":w()}],"scroll-pt":[{"scroll-pt":w()}],"scroll-pr":[{"scroll-pr":w()}],"scroll-pb":[{"scroll-pb":w()}],"scroll-pl":[{"scroll-pl":w()}],"snap-align":[{snap:[`start`,`end`,`center`,`align-none`]}],"snap-stop":[{snap:[`normal`,`always`]}],"snap-type":[{snap:[`none`,`x`,`y`,`both`]}],"snap-strictness":[{snap:[`mandatory`,`proximity`]}],touch:[{touch:[`auto`,`none`,`manipulation`]}],"touch-x":[{"touch-pan":[`x`,`left`,`right`]}],"touch-y":[{"touch-pan":[`y`,`up`,`down`]}],"touch-pz":[`touch-pinch-zoom`],select:[{select:[`none`,`text`,`all`,`auto`]}],"will-change":[{"will-change":[`auto`,`scroll`,`contents`,`transform`,Vd,Id]}],fill:[{fill:[`none`,...ce()]}],"stroke-w":[{stroke:[Ad,Hd,Ld,Rd]}],stroke:[{stroke:[`none`,...ce()]}],"forced-color-adjust":[{"forced-color-adjust":[`auto`,`none`]}]},conflictingClassGroups:{overflow:[`overflow-x`,`overflow-y`],overscroll:[`overscroll-x`,`overscroll-y`],inset:[`inset-x`,`inset-y`,`inset-bs`,`inset-be`,`start`,`end`,`top`,`right`,`bottom`,`left`],"inset-x":[`right`,`left`],"inset-y":[`top`,`bottom`],flex:[`basis`,`grow`,`shrink`],gap:[`gap-x`,`gap-y`],p:[`px`,`py`,`ps`,`pe`,`pbs`,`pbe`,`pt`,`pr`,`pb`,`pl`],px:[`pr`,`pl`],py:[`pt`,`pb`],m:[`mx`,`my`,`ms`,`me`,`mbs`,`mbe`,`mt`,`mr`,`mb`,`ml`],mx:[`mr`,`ml`],my:[`mt`,`mb`],size:[`w`,`h`],"font-size":[`leading`],"fvn-normal":[`fvn-ordinal`,`fvn-slashed-zero`,`fvn-figure`,`fvn-spacing`,`fvn-fraction`],"fvn-ordinal":[`fvn-normal`],"fvn-slashed-zero":[`fvn-normal`],"fvn-figure":[`fvn-normal`],"fvn-spacing":[`fvn-normal`],"fvn-fraction":[`fvn-normal`],"line-clamp":[`display`,`overflow`],rounded:[`rounded-s`,`rounded-e`,`rounded-t`,`rounded-r`,`rounded-b`,`rounded-l`,`rounded-ss`,`rounded-se`,`rounded-ee`,`rounded-es`,`rounded-tl`,`rounded-tr`,`rounded-br`,`rounded-bl`],"rounded-s":[`rounded-ss`,`rounded-es`],"rounded-e":[`rounded-se`,`rounded-ee`],"rounded-t":[`rounded-tl`,`rounded-tr`],"rounded-r":[`rounded-tr`,`rounded-br`],"rounded-b":[`rounded-br`,`rounded-bl`],"rounded-l":[`rounded-tl`,`rounded-bl`],"border-spacing":[`border-spacing-x`,`border-spacing-y`],"border-w":[`border-w-x`,`border-w-y`,`border-w-s`,`border-w-e`,`border-w-bs`,`border-w-be`,`border-w-t`,`border-w-r`,`border-w-b`,`border-w-l`],"border-w-x":[`border-w-r`,`border-w-l`],"border-w-y":[`border-w-t`,`border-w-b`],"border-color":[`border-color-x`,`border-color-y`,`border-color-s`,`border-color-e`,`border-color-bs`,`border-color-be`,`border-color-t`,`border-color-r`,`border-color-b`,`border-color-l`],"border-color-x":[`border-color-r`,`border-color-l`],"border-color-y":[`border-color-t`,`border-color-b`],translate:[`translate-x`,`translate-y`,`translate-none`],"translate-none":[`translate`,`translate-x`,`translate-y`,`translate-z`],"scroll-m":[`scroll-mx`,`scroll-my`,`scroll-ms`,`scroll-me`,`scroll-mbs`,`scroll-mbe`,`scroll-mt`,`scroll-mr`,`scroll-mb`,`scroll-ml`],"scroll-mx":[`scroll-mr`,`scroll-ml`],"scroll-my":[`scroll-mt`,`scroll-mb`],"scroll-p":[`scroll-px`,`scroll-py`,`scroll-ps`,`scroll-pe`,`scroll-pbs`,`scroll-pbe`,`scroll-pt`,`scroll-pr`,`scroll-pb`,`scroll-pl`],"scroll-px":[`scroll-pr`,`scroll-pl`],"scroll-py":[`scroll-pt`,`scroll-pb`],touch:[`touch-x`,`touch-y`,`touch-pz`],"touch-x":[`touch`],"touch-y":[`touch`],"touch-pz":[`touch`]},conflictingClassGroupModifiers:{"font-size":[`leading`]},orderSensitiveModifiers:[`*`,`**`,`after`,`backdrop`,`before`,`details-content`,`file`,`first-letter`,`first-line`,`marker`,`placeholder`,`selection`]}},h_e=(e,{cacheSize:t,prefix:n,experimentalParseClassName:r,extend:i={},override:a={}})=>(tf(e,`cacheSize`,t),tf(e,`prefix`,n),tf(e,`experimentalParseClassName`,r),nf(e.theme,a.theme),nf(e.classGroups,a.classGroups),nf(e.conflictingClassGroups,a.conflictingClassGroups),nf(e.conflictingClassGroupModifiers,a.conflictingClassGroupModifiers),tf(e,`orderSensitiveModifiers`,a.orderSensitiveModifiers),rf(e.theme,i.theme),rf(e.classGroups,i.classGroups),rf(e.conflictingClassGroups,i.conflictingClassGroups),rf(e.conflictingClassGroupModifiers,i.conflictingClassGroupModifiers),af(e,i,`orderSensitiveModifiers`),e),tf=(e,t,n)=>{n!==void 0&&(e[t]=n)},nf=(e,t)=>{if(t)for(let n in t)tf(e,n,t[n])},rf=(e,t)=>{if(t)for(let n in t)af(e,t,n)},af=(e,t,n)=>{let r=t[n];r!==void 0&&(e[n]=e[n]?e[n].concat(r):r)},g_e=(e,...t)=>typeof e==`function`?Td(ef,e,...t):Td(()=>h_e(ef(),e),...t)})),v_e,of,sf,y_e,b_e=s((()=>{Oge(),__e(),v_e=g_e({extend:{classGroups:{"font-size":[`text-3xs`,`text-xxs`],"font-weight":[`font-sidebar`,`font-sidebar-active`],"max-w":[{"max-w":[e=>!!e]}],w:[{w:[e=>!!e]}]}}}),{cva:of,cx:sf,compose:y_e}=md({hooks:{onComplete:e=>v_e(e)}})}));function cf(){let e=Fr(),t=U(()=>{let{class:t,style:n,...r}=e;return{class:t||``,style:n,rest:r}});function n(...e){return{class:sf(...e,t.value.class),style:t.value.style,...t.value.rest}}function r(...e){return{class:sf(...e,t.value.class),style:t.value.style}}return{cx:n,stylingAttrsCx:r,otherAttrs:U(()=>t.value.rest)}}var x_e=s((()=>{W(),b_e()})),lf=s((()=>{b_e(),x_e()})),S_e,C_e,w_e=s((()=>{lf(),W(),S_e={class:`circular-loader`},C_e=N({inheritAttrs:!1,__name:`ScalarLoading`,props:{loader:{},size:{}},setup(e){let{cx:t}=cf(),n=of({variants:{size:{xs:`size-3`,sm:`size-3.5`,md:`size-4`,lg:`size-5`,xl:`size-6`,"2xl":`size-8`,"3xl":`size-10`,full:`size-full`}},defaultVariants:{size:`full`}});return(r,i)=>e.loader?(F(),I(`div`,at(ai({key:0},j(t)(`loader-wrapper`,j(n)({size:e.size})))),[(F(),I(`svg`,{class:O([`svg-loader`,{"icon-is-valid":e.loader.isValid,"icon-is-invalid":e.loader.isInvalid}]),viewBox:`0 0 100 100`,xmlns:`http://www.w3.org/2000/svg`,"xmlns:xlink":`http://www.w3.org/1999/xlink`},[i[0]||=ti(`<path class="svg-path svg-check-mark" d="m 0 60 l 30 30 l 70 -80" data-v-27df5cd8></path><path class="svg-path svg-x-mark" d="m 50 50 l 40 -40" data-v-27df5cd8></path><path class="svg-path svg-x-mark" d="m 50 50 l 40 40" data-v-27df5cd8></path><path class="svg-path svg-x-mark" d="m 50 50 l -40 -40" data-v-27df5cd8></path><path class="svg-path svg-x-mark" d="m 50 50 l -40 40" data-v-27df5cd8></path>`,5),R(`g`,S_e,[R(`circle`,{class:O([`loader-path`,{"loader-path-off":!e.loader.isLoading}]),cx:`50`,cy:`50`,fill:`none`,r:`20`,"stroke-width":`3`},null,2)])],2))],16)):B(``,!0)}})})),uf,df=s((()=>{uf=(e,t)=>{let n=e.__vccOpts||e;for(let[e,r]of t)n[e]=r;return n}})),ff,pf=s((()=>{w_e(),df(),ff=uf(C_e,[[`__scopeId`,`data-v-27df5cd8`]])}));function mf(){return fn({isValid:!1,isInvalid:!1,isLoading:!1,isActive:!1,start(){this.isLoading=!0,this.isActive=!0,this.isInvalid=!1,this.isValid=!1},validate(e={}){let{duration:t=1100,persist:n=!1}=e;this.isLoading=!1,this.isInvalid=!1,this.isValid=!0,this.isActive=!0;let r=n?t:t-300;return new Promise(e=>n?setTimeout(()=>e(),r):setTimeout(()=>this.clear().then(()=>e()),r))},invalidate(e={}){let{duration:t=1100,persist:n=!1}=e??{};this.isLoading=!1,this.isValid=!1,this.isInvalid=!0,this.isActive=!0;let r=n?t:t-300;return new Promise(e=>n?setTimeout(()=>e(),r):setTimeout(()=>this.clear().then(()=>e()),r))},clear(e={}){let{duration:t=300}=e;return this.isValid=!1,this.isInvalid=!1,this.isLoading=!1,new Promise(e=>{setTimeout(()=>{this.isActive=!1,e()},t)})}})}var T_e=s((()=>{W()})),hf,E_e=s((()=>{hf={solid:[`scalar-button-solid`,`bg-b-btn text-c-btn focus-visible:border-c-btn active:bg-b-btn hover:bg-h-btn outline-offset-1`],outlined:[`scalar-button-outlined`,`active:bg-btn-1 shadow-border bg-b-1 text-c-1 hover:bg-b-2`],ghost:[`scalar-button-ghost`,`bg-transparent text-c-2 active:text-c-1 hover:text-c-1`],gradient:[`scalar-button-gradient`,`shadow-border bg-b-1.5 bg-linear-to-b from-b-1 to-b-2 hover:bg-linear-to-t`,`dark:bg-linear-to-t dark:hover:bg-linear-to-b`],danger:[`scalar-button-danger`,`bg-c-danger text-white active:brightness-90 hover:brightness-90`]}})),D_e,O_e,k_e=s((()=>{pf(),E_e(),lf(),W(),D_e={key:3,class:`centered`},O_e=N({inheritAttrs:!1,__name:`ScalarButton`,props:{is:{default:`button`},variant:{default:`solid`},size:{default:`md`},disabled:{type:Boolean},icon:{type:[Object,Function]},loader:{}},setup(e){let t=of({base:`scalar-button flex cursor-pointer items-center justify-center rounded font-medium -outline-offset-1`,variants:{disabled:{true:`bg-b-2 text-color-3 shadow-none`},size:{xs:`px-2 py-1 text-xs/4`,sm:`px-3.5 py-2 text-sm/4`,md:`px-5 py-3 text-sm/4`},variant:hf},compoundVariants:[{disabled:!0,variant:[`solid`,`outlined`,`ghost`,`gradient`,`danger`],class:`bg-b-2 text-c-3 shadow-none hover:bg-b-[_] cursor-not-allowed active:bg-b-[_] hover:text-c-[_] active:text-c-[_]`},{disabled:!0,variant:[`gradient`],class:`to-b-1.5 bg-linear-to-b hover:bg-linear-to-b dark:hover:bg-linear-to-t`}]}),n=of({base:`shrink-0`,variants:{size:{xs:`size-2.75 -ml-0.25 mr-1`,sm:`size-3.5 -ml-0.25 mr-1`,md:`size-3.5 -ml-0.5 mr-1.5`}}}),r=of({variants:{size:{xs:`size-4`,sm:`size-5`,md:`size-6`}}}),{cx:i}=cf();return(a,o)=>(F(),L(kr(e.is),ai({"aria-disabled":e.disabled||void 0,type:e.is===`button`?`button`:void 0},j(i)(j(t)({disabled:e.disabled,size:e.size,variant:e.variant}),{relative:e.loader?.isActive})),{default:M(()=>[a.$slots.icon||e.icon?(F(),I(`div`,{key:0,class:O([j(n)({size:e.size}),{invisible:e.loader?.isActive}])},[P(a.$slots,`icon`,{},()=>[(F(),L(kr(e.icon),{class:`size-full`}))])],2)):B(``,!0),e.loader?(F(),I(`span`,{key:1,class:O({invisible:e.loader?.isActive})},[P(a.$slots,`default`)],2)):P(a.$slots,`default`,{key:2}),e.loader?.isActive?(F(),I(`div`,D_e,[H(j(ff),{class:O(j(r)({size:e.size})),loader:e.loader},null,8,[`class`,`loader`])])):B(``,!0)]),_:3},16,[`aria-disabled`,`type`]))}})})),gf,_f=s((()=>{k_e(),gf=O_e})),vf,A_e,j_e,M_e=s((()=>{W(),vf=Symbol(),A_e=e=>{let t=fr(vf,void 0);t&&(t.value=e)},j_e=()=>{let e=A();return dr(vf,e),{id:e}}})),N_e,P_e=s((()=>{M_e(),lf(),W(),N_e=N({inheritAttrs:!1,__name:`ScalarCard`,props:{label:{}},setup(e){let{id:t}=j_e(),n=U(()=>e.label?{"aria-label":e.label}:t.value?{"aria-labelledby":t.value}:{}),{cx:r}=cf();return(e,t)=>(F(),I(`div`,ai({role:`group`},{...n.value,...j(r)(`scalar-card bg-b-2 flex flex-col divide-y rounded-xl border`)}),[P(e.$slots,`default`)],16))}})})),yf,F_e=s((()=>{P_e(),yf=N_e})),I_e,L_e=s((()=>{lf(),W(),I_e=N({inheritAttrs:!1,__name:`ScalarCardSection`,setup(e){let{cx:t}=cf();return(e,n)=>(F(),I(`div`,at($r(j(t)(`scalar-card-content flex overflow-auto first:rounded-t-[inherit] last:rounded-b-[inherit]`))),[P(e.$slots,`default`)],16))}})})),bf,xf=s((()=>{L_e(),bf=I_e})),R_e,z_e=s((()=>{xf(),lf(),W(),R_e=N({inheritAttrs:!1,__name:`ScalarCardFooter`,setup(e){let{cx:t}=cf();return(e,n)=>(F(),L(bf,at($r(j(t)(`scalar-card-footer`))),{default:M(()=>[P(e.$slots,`default`)]),_:3},16))}})})),Sf,B_e=s((()=>{z_e(),Sf=R_e})),V_e,H_e,U_e,W_e=s((()=>{M_e(),xf(),lf(),W(),V_e=[`id`],H_e={key:0,class:`flex`},U_e=N({inheritAttrs:!1,__name:`ScalarCardHeader`,setup(e){let{cx:t}=cf(),n=Sr();return A_e(n),(e,r)=>(F(),L(bf,at($r(j(t)(`scalar-card-header leading-[22px] font-medium py-[6.75px] px-3 shrink-0`))),{default:M(()=>[R(`div`,{id:j(n),class:`scalar-card-header-title min-w-0 flex-1 truncate`},[P(e.$slots,`default`)],8,V_e),e.$slots.actions?(F(),I(`div`,H_e,[P(e.$slots,`actions`)])):B(``,!0)]),_:3},16))}})})),Cf,G_e=s((()=>{W_e(),Cf=U_e})),K_e,q_e=s((()=>{W(),Ou(),K_e=N({__name:`ScalarCheckbox`,props:{selected:{type:Boolean},indeterminate:{type:Boolean,default:!1},type:{default:`checkbox`}},setup(e){let t=e;return(e,n)=>(F(),I(`div`,{class:O([`flex size-4 items-center justify-center p-0.75`,[t.selected||t.indeterminate&&t.type===`checkbox`?`bg-c-accent text-b-1`:`text-transparent shadow-border`,t.type===`checkbox`?`rounded`:`rounded-full`]])},[t.selected?(F(),L(j(Tl),{key:0,class:`size-3`,weight:`bold`})):t.indeterminate&&t.type===`checkbox`?(F(),L(j(Efe),{key:1,"aria-hidden":`true`,class:`size-3`,weight:`bold`})):B(``,!0)],2))}})})),J_e,Y_e=s((()=>{q_e(),J_e=K_e})),X_e=s((()=>{lf(),W()})),Z_e=s((()=>{X_e()})),Q_e=s((()=>{lf(),W()})),$_e=s((()=>{Q_e()})),eve,tve,nve=s((()=>{lf(),W(),eve={key:0,class:`flex items-start justify-between gap-2 text-sm/none text-c-1 whitespace-nowrap font-medium`},tve=N({inheritAttrs:!1,__name:`ScalarFormField`,props:{is:{default:`label`}},setup(e){let{cx:t}=cf();return(n,r)=>(F(),L(kr(e.is),at($r(j(t)(`flex flex-col gap-1.5 rounded`))),{default:M(()=>[n.$slots.label?(F(),I(`div`,eve,[P(n.$slots,`label`)])):B(``,!0),P(n.$slots,`default`),n.$slots.below?(F(),I(`span`,{key:1,class:O(j(t)(`-mt-1.5 text-sm`))},[P(n.$slots,`below`)],2)):B(``,!0)]),_:3},16))}})})),wf,rve=s((()=>{nve(),wf=tve})),Tf,ive,ave,ove=s((()=>{W(),Tf=Symbol(),ive=()=>fr(Tf,!1),ave=()=>{dr(Tf,!0)}})),sve,cve=s((()=>{ove(),lf(),W(),sve=N({inheritAttrs:!1,__name:`ScalarFormInput`,props:{is:{default:`button`}},setup(e){let{cx:t}=cf(),n=ive(),r=of({base:[`bg-b-1.5 flex items-center text-c-2 gap-0.75 p-3 text-base`,`outline-offset-[-1px] has-[:focus-visible]:outline`],variants:{grouped:{true:`first:rounded-t-[inherit] last:rounded-b-[inherit]`,false:`rounded shadow-border`},button:{true:`cursor-pointer hover:bg-b-2`}}});return(i,a)=>(F(),L(kr(e.is),ai({type:e.is===`button`?`button`:void 0},j(t)(j(r)({button:e.is===`button`,grouped:j(n)}))),{default:M(()=>[P(i.$slots,`default`)]),_:3},16,[`type`]))}})})),Ef,Df=s((()=>{cve(),Ef=sve})),lve,uve=s((()=>{ove(),lf(),W(),lve=N({inheritAttrs:!1,__name:`ScalarFormInputGroup`,props:{is:{default:`div`}},setup(e){let{cx:t}=cf();return ave(),(n,r)=>(F(),L(kr(e.is),at($r(j(t)(`flex flex-col border rounded divide-y`))),{default:M(()=>[P(n.$slots,`default`)]),_:3},16))}})})),Of,kf=s((()=>{uve(),Of=lve})),dve,fve=s((()=>{dve={}}));function pve(e,t,n,r,i,a){return F(),I(`fieldset`,mve,[R(`legend`,hve,[R(`span`,gve,[P(e.$slots,`label`)])]),P(e.$slots,`default`)])}var mve,hve,gve,Af,_ve=s((()=>{df(),fve(),W(),mve={class:`flex min-w-0 flex-col gap-3`},hve={class:`contents`},gve={class:`text-base font-medium text-c-1`},Af=uf(dve,[[`render`,pve]])})),vve,yve,bve,xve=s((()=>{Y_e(),Df(),lf(),W(),vve={class:`flex-1 text-left min-w-0 truncate`},yve=[`type`],bve=N({inheritAttrs:!1,__name:`ScalarCheckboxInput`,props:Lr({type:{default:`checkbox`},indeterminate:{type:Boolean,default:!1}},{modelValue:{type:Boolean},modelModifiers:{}}),emits:[`update:modelValue`],setup(e){let t=e,n=Ur(e,`modelValue`),{stylingAttrsCx:r,otherAttrs:i}=cf();return(e,a)=>(F(),L(j(Ef),ai({is:`label`},j(r)(`cursor-pointer gap-2 hover:bg-b-2`,{"text-c-1":n.value})),{default:M(()=>[H(J_e,{class:`shrink-0`,indeterminate:t.indeterminate&&t.type===`checkbox`,selected:n.value,type:t.type},null,8,[`indeterminate`,`selected`,`type`]),R(`div`,vve,[P(e.$slots,`default`)]),lr(R(`input`,ai({ref:`inputEl`,"onUpdate:modelValue":a[0]||=e=>n.value=e,class:`sr-only`,type:t.type},j(i)),null,16,yve),[[fo,n.value]])]),_:3},16))}})})),Sve,jf=s((()=>{xve(),Sve=bve})),Cve=s((()=>{kf(),jf(),W()})),wve=s((()=>{Cve()})),Tve,Eve=s((()=>{kf(),jf(),W(),Tve=N({__name:`ScalarCheckboxRadioGroup`,props:Lr({options:{default:()=>[]}},{modelValue:{},modelModifiers:{}}),emits:[`update:modelValue`],setup(e){let t=Ur(e,`modelValue`),n=Sr();return(r,i)=>(F(),L(j(Of),null,{default:M(()=>[(F(!0),I(V,null,Ar(e.options,e=>(F(),L(Sve,{key:e.value,modelValue:t.value?.value===e.value,name:j(n),type:`radio`,value:e.value,"onUpdate:modelValue":n=>t.value=n?e:void 0},{default:M(()=>[z(k(e.label),1)]),_:2},1032,[`modelValue`,`name`,`value`,`onUpdate:modelValue`]))),128))]),_:1}))}})})),Dve,Ove=s((()=>{Eve(),Dve=Tve})),kve,Ave=s((()=>{lf(),W(),kve=N({inheritAttrs:!1,__name:`ScalarCopyBackdrop`,setup(e){let{cx:t}=cf();return(e,n)=>(F(),I(`div`,at($r(j(t)(`absolute inset-y-0.5 -z-2 left-0 right-0 bg-b-1 rounded`))),null,16))}})})),Mf,Nf=s((()=>{Ave(),Mf=kve})),jve,Mve,Nve,Pve,Fve,Ive=s((()=>{Nf(),lf(),W(),Ou(),jve={"aria-hidden":`true`,class:`flex items-center py-1.5 mask-y-from-[calc(100%-8px)] mask-y-to-100%`},Mve={key:0,class:`whitespace-nowrap px-1.5`},Nve={key:0,class:`sr-only`,role:`alert`},Pve={key:1,class:`sr-only`},Fve=N({inheritAttrs:!1,__name:`ScalarCopyButton`,props:Lr({showLabel:{type:Boolean},placement:{default:`right`}},{copied:{type:Boolean,default:!1},copiedModifiers:{}}),emits:[`update:copied`],setup(e){let t=Ur(e,`copied`),{cx:n}=cf(),r=U(()=>t.value?Tl:Vl);return(i,a)=>(F(),I(`button`,ai({type:`button`},j(n)(`group/copy-button relative z-0 flex items-center justify-center`,`size-6 p-1.25 -m-1 rounded text-xs bg-b-2`,t.value?`text-c-1`:`text-c-2 hover:text-c-1`)),[H(Ka,{enterActiveClass:`transition-transform`,enterFromClass:`scale-0`,enterToClass:`scale-100`,leaveActiveClass:`transition-transform`,leaveFromClass:`scale-100`,leaveToClass:`scale-0`,mode:`out-in`},{default:M(()=>[(F(),L(kr(r.value),{class:`size-full`}))]),_:1}),a[4]||=R(`div`,{class:`bg-inherit rounded-[inherit] absolute inset-0 -z-1`},null,-1),R(`div`,{class:O([`group/copy-label absolute flex items-center -inset-y-0.5 rounded`,{"left-0 pl-[100%]":e.placement===`right`,"right-0 pr-[100%]":e.placement===`left`}])},[R(`div`,jve,[H(Ka,{enterActiveClass:`transition-transform ease-out`,enterFromClass:`translate-y-1.5`,enterToClass:`translate-y-0`,leaveActiveClass:`transition-transform ease-in`,leaveFromClass:`translate-y-0`,leaveToClass:`-translate-y-1.5`,mode:`out-in`},{default:M(()=>[t.value?(F(),I(`div`,Mve,[P(i.$slots,`copied`,{},()=>[a[0]||=z(`Copied`,-1)])])):(F(),I(`div`,{key:1,class:O([`whitespace-nowrap px-1.5`,{"group-hocus/copy-button:block hidden":!e.showLabel&&!t.value}])},[P(i.$slots,`copy`,{},()=>[a[1]||=z(`Copy`,-1)])],2))]),_:3})]),t.value?(F(),I(`div`,Nve,[P(i.$slots,`copied`,{},()=>[a[2]||=z(`Copied`,-1)])])):(F(),I(`div`,Pve,[P(i.$slots,`copy`,{},()=>[a[3]||=z(`Copy`,-1)])])),P(i.$slots,`backdrop`,{},()=>[H(Mf)])],2)],16))}})})),Pf,Ff=s((()=>{Ive(),Pf=Fve}));function If(e){return Kt()?(qt(e),!0):!1}function Lve(){return Rf&&(window==null?void 0:window.navigator)?.userAgent&&(/iP(?:ad|hone|od)/.test(window.navigator.userAgent)||(window==null?void 0:window.navigator)?.maxTouchPoints>2&&/iPad|Macintosh/.test(window==null?void 0:window.navigator.userAgent))}function Rve(...e){if(e.length!==1)return wn(...e);let t=e[0];return typeof t==`function`?pn(tte(()=>({get:t,set:Bf}))):A(t)}function zve(e,t){function n(...n){return new Promise((r,i)=>{Promise.resolve(e(()=>t.apply(this,n),{fn:t,thisArg:this,args:n})).then(r).catch(i)})}return n}function Bve(e,t={}){let n,r,i=Bf,a=e=>{clearTimeout(e),i(),i=Bf},o;return s=>{let c=Cn(e),l=Cn(t.maxWait);return n&&a(n),c<=0||l!==void 0&&l<=0?(r&&=(a(r),void 0),Promise.resolve(s())):new Promise((e,u)=>{i=t.rejectOnCancel?u:e,o=s,l&&!r&&(r=setTimeout(()=>{n&&a(n),r=void 0,e(o())},l)),n=setTimeout(()=>{r&&a(r),r=void 0,e(s())},c)})}}function Vve(e){let t;function n(){return t||=e(),t}return n.reset=async()=>{let e=t;t=void 0,e&&await e},n}function Lf(e){return Array.isArray(e)?e:[e]}function Hve(e,t=200,n={}){return zve(Bve(t,n),e)}function Uve(e,t,n={}){let{eventFilter:r=Yve,...i}=n;return mr(e,zve(r,t),i)}function Wve(e,t,n={}){let{immediate:r=!0,immediateCallback:i=!1}=n,a=Sn(!1),o;function s(){o&&=(clearTimeout(o),void 0)}function c(){a.value=!1,s()}function l(...n){i&&e(),s(),a.value=!0,o=setTimeout(()=>{a.value=!1,o=void 0,e(...n)},Cn(t))}return r&&(a.value=!0,Rf&&l()),If(c),{isPending:mn(a),start:l,stop:c}}function Gve(e,t,n={}){let{debounce:r=0,maxWait:i=void 0,...a}=n;return Uve(e,t,{...a,eventFilter:Bve(r,{maxWait:i})})}function Kve(e,t,n){return mr(e,t,{...n,immediate:!0})}var Rf,zf,qve,Jve,Bf,Vf,Yve,Hf=s((()=>{W(),Rf=typeof window<`u`&&typeof document<`u`,typeof WorkerGlobalScope<`u`&&globalThis instanceof WorkerGlobalScope,zf=e=>e!=null,qve=Object.prototype.toString,Jve=e=>qve.call(e)===`[object Object]`,Bf=()=>{},Vf=Lve(),Yve=e=>e()}));function Uf(e){let t=Cn(e);return t?.$el??t}function Wf(...e){let t=[],n=()=>{t.forEach(e=>e()),t.length=0},r=(e,t,n,r)=>(e.addEventListener(t,n,r),()=>e.removeEventListener(t,n,r)),i=U(()=>{let t=Lf(Cn(e[0])).filter(e=>e!=null);return t.every(e=>typeof e!=`string`)?t:void 0}),a=Kve(()=>[i.value?.map(e=>Uf(e))??[qf].filter(e=>e!=null),Lf(Cn(i.value?e[1]:e[0])),Lf(j(i.value?e[2]:e[1])),Cn(i.value?e[3]:e[2])],([e,i,a,o])=>{if(n(),!e?.length||!i?.length||!a?.length)return;let s=Jve(o)?{...o}:o;t.push(...e.flatMap(e=>i.flatMap(t=>a.map(n=>r(e,t,n,s)))))},{flush:`post`});return If(n),()=>{a(),n()}}function Xve(e,t,n={}){let{window:r=qf,ignore:i=[],capture:a=!0,detectIframe:o=!1,controls:s=!1}=n;if(!r)return s?{stop:Bf,cancel:Bf,trigger:Bf}:Bf;if(Vf&&!Yf){Yf=!0;let e={passive:!0};Array.from(r.document.body.children).forEach(t=>t.addEventListener(`click`,Bf,e)),r.document.documentElement.addEventListener(`click`,Bf,e)}let c=!0,l=e=>Cn(i).some(t=>{if(typeof t==`string`)return Array.from(r.document.querySelectorAll(t)).some(t=>t===e.target||e.composedPath().includes(t));{let n=Uf(t);return n&&(e.target===n||e.composedPath().includes(n))}});function u(e){let t=Cn(e);return t&&t.$.subTree.shapeFlag===16}function d(e,t){let n=Cn(e),r=n.$.subTree&&n.$.subTree.children;return r==null||!Array.isArray(r)?!1:r.some(e=>e.el===t.target||t.composedPath().includes(e.el))}let f=n=>{let r=Uf(e);if(n.target!=null&&!(!(r instanceof Element)&&u(e)&&d(e,n))&&!(!r||r===n.target||n.composedPath().includes(r))){if(`detail`in n&&n.detail===0&&(c=!l(n)),!c){c=!0;return}t(n)}},p=!1,m=[Wf(r,`click`,e=>{p||(p=!0,setTimeout(()=>{p=!1},0),f(e))},{passive:!0,capture:a}),Wf(r,`pointerdown`,t=>{let n=Uf(e);c=!l(t)&&!!(n&&!t.composedPath().includes(n))},{passive:!0}),o&&Wf(r,`blur`,n=>{setTimeout(()=>{let i=Uf(e);r.document.activeElement?.tagName===`IFRAME`&&!i?.contains(r.document.activeElement)&&t(n)},0)},{passive:!0})].filter(Boolean),h=()=>m.forEach(e=>e());return s?{stop:h,cancel:()=>{c=!1},trigger:e=>{c=!0,f(e),c=!1}}:h}function Zve(){let e=Sn(!1),t=ba();return t&&Hi(()=>{e.value=!0},t),e}function Gf(e){let t=Zve();return U(()=>(t.value,!!e()))}function Qve(e,t,n={}){let{window:r=qf,...i}=n,a,o=Gf(()=>r&&`MutationObserver`in r),s=()=>{a&&=(a.disconnect(),void 0)},c=mr(U(()=>{let t=Lf(Cn(e)).map(Uf).filter(zf);return new Set(t)}),e=>{s(),o.value&&e.size&&(a=new MutationObserver(t),e.forEach(e=>a.observe(e,i)))},{immediate:!0,flush:`post`}),l=()=>a?.takeRecords(),u=()=>{c(),s()};return If(u),{isSupported:o,stop:u,takeRecords:l}}function $ve(e,t,n={}){let{window:r=qf,document:i=r?.document,flush:a=`sync`}=n;if(!r||!i)return Bf;let o,s=e=>{o?.(),o=e},c=pr(()=>{let n=Uf(e);if(n){let{stop:e}=Qve(i,e=>{e.map(e=>[...e.removedNodes]).flat().some(e=>e===n||e.contains(n))&&t(e)},{window:r,childList:!0,subtree:!0});s(e)}},{flush:a}),l=()=>{c(),s()};return If(l),l}function eye(e={}){let{window:t=qf,deep:n=!0,triggerOnRemoval:r=!1}=e,i=e.document??t?.document,a=()=>{let e=i?.activeElement;if(n)for(;e?.shadowRoot;)e=e?.shadowRoot?.activeElement;return e},o=Sn(),s=()=>{o.value=a()};if(t){let e={capture:!0,passive:!0};Wf(t,`blur`,e=>{e.relatedTarget===null&&s()},e),Wf(t,`focus`,s,e)}return r&&$ve(o,s,{document:i}),s(),o}function tye(e,t={}){let{controls:n=!1,navigator:r=Jf}=t,i=Gf(()=>r&&`permissions`in r),a=Sn(),o=typeof e==`string`?{name:e}:e,s=Sn(),c=()=>{s.value=a.value?.state??`prompt`};Wf(a,`change`,c,{passive:!0});let l=Vve(async()=>{if(i.value){if(!a.value)try{a.value=await r.permissions.query(o)}catch{a.value=void 0}finally{c()}if(n)return bn(a.value)}});return l(),n?{state:s,isSupported:i,query:l}:s}function nye(e={}){let{navigator:t=Jf,read:n=!1,source:r,copiedDuring:i=1500,legacy:a=!1}=e,o=Gf(()=>t&&`clipboard`in t),s=tye(`clipboard-read`),c=tye(`clipboard-write`),l=U(()=>o.value||a),u=Sn(``),d=Sn(!1),f=Wve(()=>d.value=!1,i,{immediate:!1});async function p(){let e=!(o.value&&_(s.value));if(!e)try{u.value=await t.clipboard.readText()}catch{e=!0}e&&(u.value=g())}l.value&&n&&Wf([`copy`,`cut`],p,{passive:!0});async function m(e=Cn(r)){if(l.value&&e!=null){let n=!(o.value&&_(c.value));if(!n)try{await t.clipboard.writeText(e)}catch{n=!0}n&&h(e),u.value=e,d.value=!0,f.start()}}function h(e){let t=document.createElement(`textarea`);t.value=e??``,t.style.position=`absolute`,t.style.opacity=`0`,document.body.appendChild(t),t.select(),document.execCommand(`copy`),t.remove()}function g(){return((document==null?void 0:document.getSelection)?.call(document))?.toString()??``}function _(e){return e===`granted`||e===`prompt`}return{isSupported:l,text:u,copied:d,copy:m}}function rye(e,t,n={}){let{window:r=qf,...i}=n,a,o=Gf(()=>r&&`ResizeObserver`in r),s=()=>{a&&=(a.disconnect(),void 0)},c=mr(U(()=>{let t=Cn(e);return Array.isArray(t)?t.map(e=>Uf(e)):[Uf(t)]}),e=>{if(s(),o.value&&r){a=new ResizeObserver(t);for(let t of e)t&&a.observe(t,i)}},{immediate:!0,flush:`post`}),l=()=>{s(),c()};return If(l),{isSupported:o,stop:l}}function iye(e,t={}){let{delayEnter:n=0,delayLeave:r=0,triggerOnRemoval:i=!1,window:a=qf}=t,o=Sn(!1),s,c=e=>{let t=e?n:r;s&&=(clearTimeout(s),void 0),t?s=setTimeout(()=>o.value=e,t):o.value=e};return a?(Wf(e,`mouseenter`,()=>c(!0),{passive:!0}),Wf(e,`mouseleave`,()=>c(!1),{passive:!0}),i&&$ve(U(()=>Uf(e)),()=>c(!1)),o):o}function aye(e,t,n={}){let{root:r,rootMargin:i=`0px`,threshold:a=0,window:o=qf,immediate:s=!0}=n,c=Gf(()=>o&&`IntersectionObserver`in o),l=U(()=>Lf(Cn(e)).map(Uf).filter(zf)),u=Bf,d=Sn(s),f=c.value?mr(()=>[l.value,Uf(r),d.value],([e,n])=>{if(u(),!d.value||!e.length)return;let r=new IntersectionObserver(t,{root:Uf(n),rootMargin:i,threshold:a});e.forEach(e=>e&&r.observe(e)),u=()=>{r.disconnect(),u=Bf}},{immediate:s,flush:`post`}):Bf,p=()=>{u(),f(),d.value=!1};return If(p),{isSupported:c,isActive:d,pause(){u(),d.value=!1},resume(){d.value=!0},stop:p}}function oye(e=null,t={}){let{baseUrl:n=``,rel:r=`icon`,document:i=dye}=t,a=Rve(e),o=e=>{let t=i?.head.querySelectorAll(`link[rel*="${r}"]`);if(!t||t.length===0){let t=i?.createElement(`link`);t&&(t.rel=r,t.href=`${n}${e}`,t.type=`image/${e.split(`.`).pop()}`,i?.head.append(t));return}t?.forEach(t=>t.href=`${n}${e}`)};return mr(a,(e,t)=>{typeof e==`string`&&e!==t&&o(e)},{immediate:!0}),a}function sye(e,t={}){let{window:n=qf}=t,r=U(()=>Uf(e)),i=Sn(!1),a=U(()=>i.value);if(!n||!eye(t).value)return{focused:a};let o={passive:!0};return Wf(r,fye,()=>i.value=!0,o),Wf(r,pye,()=>{var e;return i.value=((e=r.value)?.matches)?.call(e,mye)??!1},o),{focused:a}}function Kf(e){return typeof Window<`u`&&e instanceof Window?e.document.documentElement:typeof Document<`u`&&e instanceof Document?e.documentElement:e}function cye(e){let t=window.getComputedStyle(e);if(t.overflowX===`scroll`||t.overflowY===`scroll`||t.overflowX===`auto`&&e.clientWidth<e.scrollWidth||t.overflowY===`auto`&&e.clientHeight<e.scrollHeight)return!0;{let t=e.parentNode;return!t||t.tagName===`BODY`?!1:cye(t)}}function lye(e){let t=e||window.event,n=t.target;return cye(n)?!1:t.touches.length>1?!0:(t.preventDefault&&t.preventDefault(),!1)}function uye(e,t=!1){let n=Sn(t),r=null,i=``;mr(Rve(e),e=>{let t=Kf(Cn(e));if(t){let e=t;if(Xf.get(e)||Xf.set(e,e.style.overflow),e.style.overflow!==`hidden`&&(i=e.style.overflow),e.style.overflow===`hidden`)return n.value=!0;if(n.value)return e.style.overflow=`hidden`}},{immediate:!0});let a=()=>{let t=Kf(Cn(e));!t||n.value||(Vf&&(r=Wf(t,`touchmove`,e=>{lye(e)},{passive:!1})),t.style.overflow=`hidden`,n.value=!0)},o=()=>{let t=Kf(Cn(e));!t||!n.value||(Vf&&r?.(),t.style.overflow=i,Xf.delete(t),n.value=!1)};return If(o),U({get(){return n.value},set(e){e?a():o()}})}var qf,dye,Jf,Yf,fye,pye,mye,Xf,Zf=s((()=>{Hf(),Hf(),W(),qf=Rf?window:void 0,dye=Rf?window.document:void 0,Jf=Rf?window.navigator:void 0,Rf&&window.location,Yf=!1,fye=`focusin`,pye=`focusout`,mye=`:focus-within`,Xf=new WeakMap})),hye,gye=s((()=>{Ff(),W(),Zf(),hye=N({__name:`ScalarCopy`,props:Lr({content:{default:``},placement:{},showLabel:{type:Boolean},duration:{default:1500},immediate:{type:Boolean}},{copied:{type:Boolean,default:!1},copiedModifiers:{}}),emits:[`update:copied`],setup(e){let t=Ur(e,`copied`);Hi(()=>{e.immediate&&n(e.content)});let{copy:n,copied:r}=nye({legacy:!0,copiedDuring:e.duration});return mr(r,e=>t.value=e),(i,a)=>(F(),L(Pf,{copied:t.value||j(r),placement:e.placement,showLabel:e.showLabel,onClick:a[0]||=t=>j(n)(e.content)},jr({_:2},[i.$slots.copy?{name:`copy`,fn:M(()=>[P(i.$slots,`copy`)]),key:`0`}:void 0,i.$slots.copied?{name:`copied`,fn:M(()=>[P(i.$slots,`copied`)]),key:`1`}:void 0,i.$slots.backdrop?{name:`backdrop`,fn:M(()=>[P(i.$slots,`backdrop`)]),key:`2`}:void 0]),1032,[`copied`,`placement`,`showLabel`]))}})})),_ye,vye=s((()=>{gye(),_ye=hye})),Qf,yye=s((()=>{Qf={bash:`Bash`,c:`C`,clojure:`Clojure`,cpp:`C++`,csharp:`C#`,css:`CSS`,curl:`cURL`,dart:`Dart`,diff:`Diff`,docker:`Docker`,dockerfile:`Dockerfile`,elixir:`Elixir`,fsharp:`F#`,go:`Go`,graphql:`GraphQL`,haskell:`Haskell`,html:`HTML`,http:`HTTP`,ini:`INI`,java:`Java`,javascript:`JavaScript`,json:`JSON`,kotlin:`Kotlin`,less:`Less`,lua:`Lua`,makefile:`Makefile`,markdown:`Markdown`,matlab:`MATLAB`,nginx:`Nginx`,objectivec:`Objective-C`,ocaml:`OCaml`,perl:`Perl`,php:`PHP`,plaintext:`Plain Text`,powershell:`PowerShell`,properties:`Properties`,python:`Python`,r:`R`,ruby:`Ruby`,rust:`Rust`,scala:`Scala`,scss:`SCSS`,shell:`Shell`,sql:`SQL`,swift:`Swift`,toml:`TOML`,typescript:`TypeScript`,xml:`XML`,yaml:`YAML`}})),bye,xye,Sye=s((()=>{vye(),yye(),lf(),W(),bye={class:`hidden group-hocus-within/code-block:inline`},xye=N({inheritAttrs:!1,__name:`ScalarCodeBlockCopy`,props:Lr({showLang:{type:Boolean},content:{},lang:{}},{copied:{type:Boolean,default:!1},copiedModifiers:{}}),emits:[`update:copied`],setup(e){let t=Ur(e,`copied`),n=U(()=>typeof e.content==`string`?e.content:JSON.stringify(e.content,null,2)),r=e=>e in Qf,{cx:i}=cf();return(a,o)=>(F(),L(j(_ye),ai({content:n.value,showLabel:``,copied:t.value,"onUpdate:copied":o[0]||=e=>t.value=e,placement:`left`},{...j(i)(t.value?`opacity-100`:`opacity-0 group-hocus-within/code-block:opacity-100`)}),jr({backdrop:M(()=>[P(a.$slots,`backdrop`)]),_:2},[e.lang?{name:`copy`,fn:M(()=>[R(`span`,bye,[e.showLang?(F(),I(`span`,{key:0,class:O([`group-hocus/copy-button:sr-only`,{capitalize:!r(e.lang)}])},k(r(e.lang)?j(Qf)[e.lang]:e.lang),3)):B(``,!0),R(`span`,{class:O({"group-hocus/copy-button:not-sr-only sr-only":e.showLang})},`Copy`,2)])]),key:`0`}:void 0]),1040,[`content`,`copied`]))}})})),$f,Cye=s((()=>{Sye(),$f=xye})),ep=s((()=>{})),tp,wye=s((()=>{tp=class{constructor(e,t,n){this.normal=t,this.property=e,n&&(this.space=n)}},tp.prototype.normal={},tp.prototype.property={},tp.prototype.space=void 0}));function Tye(e,t){let n={},r={};for(let t of e)Object.assign(n,t.property),Object.assign(r,t.normal);return new tp(n,r,t)}var Eye=s((()=>{wye()}));function np(e){return e.toLowerCase()}var rp=s((()=>{})),ip,Dye=s((()=>{ip=class{constructor(e,t){this.attribute=t,this.property=e}},ip.prototype.attribute=``,ip.prototype.booleanish=!1,ip.prototype.boolean=!1,ip.prototype.commaOrSpaceSeparated=!1,ip.prototype.commaSeparated=!1,ip.prototype.defined=!1,ip.prototype.mustUseProperty=!1,ip.prototype.number=!1,ip.prototype.overloadedBoolean=!1,ip.prototype.property=``,ip.prototype.spaceSeparated=!1,ip.prototype.space=void 0})),ap=l({boolean:()=>sp,booleanish:()=>cp,commaOrSpaceSeparated:()=>pp,commaSeparated:()=>fp,number:()=>up,overloadedBoolean:()=>lp,spaceSeparated:()=>dp});function op(){return 2**++Oye}var Oye,sp,cp,lp,up,dp,fp,pp,mp=s((()=>{Oye=0,sp=op(),cp=op(),lp=op(),up=op(),dp=op(),fp=op(),pp=op()}));function kye(e,t,n){n&&(e[t]=n)}var hp,gp,Aye=s((()=>{Dye(),mp(),hp=Object.keys(ap),gp=class extends ip{constructor(e,t,n,r){let i=-1;if(super(e,t),kye(this,`space`,r),typeof n==`number`)for(;++i<hp.length;){let e=hp[i];kye(this,hp[i],(n&ap[e])===ap[e])}}},gp.prototype.defined=!0}));function _p(e){let t={},n={};for(let[r,i]of Object.entries(e.properties)){let a=new gp(r,e.transform(e.attributes||{},r),i,e.space);e.mustUseProperty&&e.mustUseProperty.includes(r)&&(a.mustUseProperty=!0),t[r]=a,n[np(r)]=r,n[np(a.attribute)]=r}return new tp(t,n,e.space)}var vp=s((()=>{rp(),Aye(),wye()})),yp,jye=s((()=>{vp(),mp(),yp=_p({properties:{ariaActiveDescendant:null,ariaAtomic:cp,ariaAutoComplete:null,ariaBusy:cp,ariaChecked:cp,ariaColCount:up,ariaColIndex:up,ariaColSpan:up,ariaControls:dp,ariaCurrent:null,ariaDescribedBy:dp,ariaDetails:null,ariaDisabled:cp,ariaDropEffect:dp,ariaErrorMessage:null,ariaExpanded:cp,ariaFlowTo:dp,ariaGrabbed:cp,ariaHasPopup:null,ariaHidden:cp,ariaInvalid:null,ariaKeyShortcuts:null,ariaLabel:null,ariaLabelledBy:dp,ariaLevel:up,ariaLive:null,ariaModal:cp,ariaMultiLine:cp,ariaMultiSelectable:cp,ariaOrientation:null,ariaOwns:dp,ariaPlaceholder:null,ariaPosInSet:up,ariaPressed:cp,ariaReadOnly:cp,ariaRelevant:null,ariaRequired:cp,ariaRoleDescription:dp,ariaRowCount:up,ariaRowIndex:up,ariaRowSpan:up,ariaSelected:cp,ariaSetSize:up,ariaSort:null,ariaValueMax:up,ariaValueMin:up,ariaValueNow:up,ariaValueText:null,role:null},transform(e,t){return t===`role`?t:`aria-`+t.slice(4).toLowerCase()}})}));function Mye(e,t){return t in e?e[t]:t}var Nye=s((()=>{}));function Pye(e,t){return Mye(e,t.toLowerCase())}var Fye=s((()=>{Nye()})),Iye,Lye=s((()=>{Fye(),vp(),mp(),Iye=_p({attributes:{acceptcharset:`accept-charset`,classname:`class`,htmlfor:`for`,httpequiv:`http-equiv`},mustUseProperty:[`checked`,`multiple`,`muted`,`selected`],properties:{abbr:null,accept:fp,acceptCharset:dp,accessKey:dp,action:null,allow:null,allowFullScreen:sp,allowPaymentRequest:sp,allowUserMedia:sp,alt:null,as:null,async:sp,autoCapitalize:null,autoComplete:dp,autoFocus:sp,autoPlay:sp,blocking:dp,capture:null,charSet:null,checked:sp,cite:null,className:dp,cols:up,colSpan:null,content:null,contentEditable:cp,controls:sp,controlsList:dp,coords:up|fp,crossOrigin:null,data:null,dateTime:null,decoding:null,default:sp,defer:sp,dir:null,dirName:null,disabled:sp,download:lp,draggable:cp,encType:null,enterKeyHint:null,fetchPriority:null,form:null,formAction:null,formEncType:null,formMethod:null,formNoValidate:sp,formTarget:null,headers:dp,height:up,hidden:lp,high:up,href:null,hrefLang:null,htmlFor:dp,httpEquiv:dp,id:null,imageSizes:null,imageSrcSet:null,inert:sp,inputMode:null,integrity:null,is:null,isMap:sp,itemId:null,itemProp:dp,itemRef:dp,itemScope:sp,itemType:dp,kind:null,label:null,lang:null,language:null,list:null,loading:null,loop:sp,low:up,manifest:null,max:null,maxLength:up,media:null,method:null,min:null,minLength:up,multiple:sp,muted:sp,name:null,nonce:null,noModule:sp,noValidate:sp,onAbort:null,onAfterPrint:null,onAuxClick:null,onBeforeMatch:null,onBeforePrint:null,onBeforeToggle:null,onBeforeUnload:null,onBlur:null,onCancel:null,onCanPlay:null,onCanPlayThrough:null,onChange:null,onClick:null,onClose:null,onContextLost:null,onContextMenu:null,onContextRestored:null,onCopy:null,onCueChange:null,onCut:null,onDblClick:null,onDrag:null,onDragEnd:null,onDragEnter:null,onDragExit:null,onDragLeave:null,onDragOver:null,onDragStart:null,onDrop:null,onDurationChange:null,onEmptied:null,onEnded:null,onError:null,onFocus:null,onFormData:null,onHashChange:null,onInput:null,onInvalid:null,onKeyDown:null,onKeyPress:null,onKeyUp:null,onLanguageChange:null,onLoad:null,onLoadedData:null,onLoadedMetadata:null,onLoadEnd:null,onLoadStart:null,onMessage:null,onMessageError:null,onMouseDown:null,onMouseEnter:null,onMouseLeave:null,onMouseMove:null,onMouseOut:null,onMouseOver:null,onMouseUp:null,onOffline:null,onOnline:null,onPageHide:null,onPageShow:null,onPaste:null,onPause:null,onPlay:null,onPlaying:null,onPopState:null,onProgress:null,onRateChange:null,onRejectionHandled:null,onReset:null,onResize:null,onScroll:null,onScrollEnd:null,onSecurityPolicyViolation:null,onSeeked:null,onSeeking:null,onSelect:null,onSlotChange:null,onStalled:null,onStorage:null,onSubmit:null,onSuspend:null,onTimeUpdate:null,onToggle:null,onUnhandledRejection:null,onUnload:null,onVolumeChange:null,onWaiting:null,onWheel:null,open:sp,optimum:up,pattern:null,ping:dp,placeholder:null,playsInline:sp,popover:null,popoverTarget:null,popoverTargetAction:null,poster:null,preload:null,readOnly:sp,referrerPolicy:null,rel:dp,required:sp,reversed:sp,rows:up,rowSpan:up,sandbox:dp,scope:null,scoped:sp,seamless:sp,selected:sp,shadowRootClonable:sp,shadowRootDelegatesFocus:sp,shadowRootMode:null,shape:null,size:up,sizes:null,slot:null,span:up,spellCheck:cp,src:null,srcDoc:null,srcLang:null,srcSet:null,start:up,step:null,style:null,tabIndex:up,target:null,title:null,translate:null,type:null,typeMustMatch:sp,useMap:null,value:cp,width:up,wrap:null,writingSuggestions:null,align:null,aLink:null,archive:dp,axis:null,background:null,bgColor:null,border:up,borderColor:null,bottomMargin:up,cellPadding:null,cellSpacing:null,char:null,charOff:null,classId:null,clear:null,code:null,codeBase:null,codeType:null,color:null,compact:sp,declare:sp,event:null,face:null,frame:null,frameBorder:null,hSpace:up,leftMargin:up,link:null,longDesc:null,lowSrc:null,marginHeight:up,marginWidth:up,noResize:sp,noHref:sp,noShade:sp,noWrap:sp,object:null,profile:null,prompt:null,rev:null,rightMargin:up,rules:null,scheme:null,scrolling:cp,standby:null,summary:null,text:null,topMargin:up,valueType:null,version:null,vAlign:null,vLink:null,vSpace:up,allowTransparency:null,autoCorrect:null,autoSave:null,disablePictureInPicture:sp,disableRemotePlayback:sp,prefix:null,property:null,results:up,security:null,unselectable:null},space:`html`,transform:Pye})})),Rye,zye=s((()=>{Nye(),vp(),mp(),Rye=_p({attributes:{accentHeight:`accent-height`,alignmentBaseline:`alignment-baseline`,arabicForm:`arabic-form`,baselineShift:`baseline-shift`,capHeight:`cap-height`,className:`class`,clipPath:`clip-path`,clipRule:`clip-rule`,colorInterpolation:`color-interpolation`,colorInterpolationFilters:`color-interpolation-filters`,colorProfile:`color-profile`,colorRendering:`color-rendering`,crossOrigin:`crossorigin`,dataType:`datatype`,dominantBaseline:`dominant-baseline`,enableBackground:`enable-background`,fillOpacity:`fill-opacity`,fillRule:`fill-rule`,floodColor:`flood-color`,floodOpacity:`flood-opacity`,fontFamily:`font-family`,fontSize:`font-size`,fontSizeAdjust:`font-size-adjust`,fontStretch:`font-stretch`,fontStyle:`font-style`,fontVariant:`font-variant`,fontWeight:`font-weight`,glyphName:`glyph-name`,glyphOrientationHorizontal:`glyph-orientation-horizontal`,glyphOrientationVertical:`glyph-orientation-vertical`,hrefLang:`hreflang`,horizAdvX:`horiz-adv-x`,horizOriginX:`horiz-origin-x`,horizOriginY:`horiz-origin-y`,imageRendering:`image-rendering`,letterSpacing:`letter-spacing`,lightingColor:`lighting-color`,markerEnd:`marker-end`,markerMid:`marker-mid`,markerStart:`marker-start`,navDown:`nav-down`,navDownLeft:`nav-down-left`,navDownRight:`nav-down-right`,navLeft:`nav-left`,navNext:`nav-next`,navPrev:`nav-prev`,navRight:`nav-right`,navUp:`nav-up`,navUpLeft:`nav-up-left`,navUpRight:`nav-up-right`,onAbort:`onabort`,onActivate:`onactivate`,onAfterPrint:`onafterprint`,onBeforePrint:`onbeforeprint`,onBegin:`onbegin`,onCancel:`oncancel`,onCanPlay:`oncanplay`,onCanPlayThrough:`oncanplaythrough`,onChange:`onchange`,onClick:`onclick`,onClose:`onclose`,onCopy:`oncopy`,onCueChange:`oncuechange`,onCut:`oncut`,onDblClick:`ondblclick`,onDrag:`ondrag`,onDragEnd:`ondragend`,onDragEnter:`ondragenter`,onDragExit:`ondragexit`,onDragLeave:`ondragleave`,onDragOver:`ondragover`,onDragStart:`ondragstart`,onDrop:`ondrop`,onDurationChange:`ondurationchange`,onEmptied:`onemptied`,onEnd:`onend`,onEnded:`onended`,onError:`onerror`,onFocus:`onfocus`,onFocusIn:`onfocusin`,onFocusOut:`onfocusout`,onHashChange:`onhashchange`,onInput:`oninput`,onInvalid:`oninvalid`,onKeyDown:`onkeydown`,onKeyPress:`onkeypress`,onKeyUp:`onkeyup`,onLoad:`onload`,onLoadedData:`onloadeddata`,onLoadedMetadata:`onloadedmetadata`,onLoadStart:`onloadstart`,onMessage:`onmessage`,onMouseDown:`onmousedown`,onMouseEnter:`onmouseenter`,onMouseLeave:`onmouseleave`,onMouseMove:`onmousemove`,onMouseOut:`onmouseout`,onMouseOver:`onmouseover`,onMouseUp:`onmouseup`,onMouseWheel:`onmousewheel`,onOffline:`onoffline`,onOnline:`ononline`,onPageHide:`onpagehide`,onPageShow:`onpageshow`,onPaste:`onpaste`,onPause:`onpause`,onPlay:`onplay`,onPlaying:`onplaying`,onPopState:`onpopstate`,onProgress:`onprogress`,onRateChange:`onratechange`,onRepeat:`onrepeat`,onReset:`onreset`,onResize:`onresize`,onScroll:`onscroll`,onSeeked:`onseeked`,onSeeking:`onseeking`,onSelect:`onselect`,onShow:`onshow`,onStalled:`onstalled`,onStorage:`onstorage`,onSubmit:`onsubmit`,onSuspend:`onsuspend`,onTimeUpdate:`ontimeupdate`,onToggle:`ontoggle`,onUnload:`onunload`,onVolumeChange:`onvolumechange`,onWaiting:`onwaiting`,onZoom:`onzoom`,overlinePosition:`overline-position`,overlineThickness:`overline-thickness`,paintOrder:`paint-order`,panose1:`panose-1`,pointerEvents:`pointer-events`,referrerPolicy:`referrerpolicy`,renderingIntent:`rendering-intent`,shapeRendering:`shape-rendering`,stopColor:`stop-color`,stopOpacity:`stop-opacity`,strikethroughPosition:`strikethrough-position`,strikethroughThickness:`strikethrough-thickness`,strokeDashArray:`stroke-dasharray`,strokeDashOffset:`stroke-dashoffset`,strokeLineCap:`stroke-linecap`,strokeLineJoin:`stroke-linejoin`,strokeMiterLimit:`stroke-miterlimit`,strokeOpacity:`stroke-opacity`,strokeWidth:`stroke-width`,tabIndex:`tabindex`,textAnchor:`text-anchor`,textDecoration:`text-decoration`,textRendering:`text-rendering`,transformOrigin:`transform-origin`,typeOf:`typeof`,underlinePosition:`underline-position`,underlineThickness:`underline-thickness`,unicodeBidi:`unicode-bidi`,unicodeRange:`unicode-range`,unitsPerEm:`units-per-em`,vAlphabetic:`v-alphabetic`,vHanging:`v-hanging`,vIdeographic:`v-ideographic`,vMathematical:`v-mathematical`,vectorEffect:`vector-effect`,vertAdvY:`vert-adv-y`,vertOriginX:`vert-origin-x`,vertOriginY:`vert-origin-y`,wordSpacing:`word-spacing`,writingMode:`writing-mode`,xHeight:`x-height`,playbackOrder:`playbackorder`,timelineBegin:`timelinebegin`},properties:{about:pp,accentHeight:up,accumulate:null,additive:null,alignmentBaseline:null,alphabetic:up,amplitude:up,arabicForm:null,ascent:up,attributeName:null,attributeType:null,azimuth:up,bandwidth:null,baselineShift:null,baseFrequency:null,baseProfile:null,bbox:null,begin:null,bias:up,by:null,calcMode:null,capHeight:up,className:dp,clip:null,clipPath:null,clipPathUnits:null,clipRule:null,color:null,colorInterpolation:null,colorInterpolationFilters:null,colorProfile:null,colorRendering:null,content:null,contentScriptType:null,contentStyleType:null,crossOrigin:null,cursor:null,cx:null,cy:null,d:null,dataType:null,defaultAction:null,descent:up,diffuseConstant:up,direction:null,display:null,dur:null,divisor:up,dominantBaseline:null,download:sp,dx:null,dy:null,edgeMode:null,editable:null,elevation:up,enableBackground:null,end:null,event:null,exponent:up,externalResourcesRequired:null,fill:null,fillOpacity:up,fillRule:null,filter:null,filterRes:null,filterUnits:null,floodColor:null,floodOpacity:null,focusable:null,focusHighlight:null,fontFamily:null,fontSize:null,fontSizeAdjust:null,fontStretch:null,fontStyle:null,fontVariant:null,fontWeight:null,format:null,fr:null,from:null,fx:null,fy:null,g1:fp,g2:fp,glyphName:fp,glyphOrientationHorizontal:null,glyphOrientationVertical:null,glyphRef:null,gradientTransform:null,gradientUnits:null,handler:null,hanging:up,hatchContentUnits:null,hatchUnits:null,height:null,href:null,hrefLang:null,horizAdvX:up,horizOriginX:up,horizOriginY:up,id:null,ideographic:up,imageRendering:null,initialVisibility:null,in:null,in2:null,intercept:up,k:up,k1:up,k2:up,k3:up,k4:up,kernelMatrix:pp,kernelUnitLength:null,keyPoints:null,keySplines:null,keyTimes:null,kerning:null,lang:null,lengthAdjust:null,letterSpacing:null,lightingColor:null,limitingConeAngle:up,local:null,markerEnd:null,markerMid:null,markerStart:null,markerHeight:null,markerUnits:null,markerWidth:null,mask:null,maskContentUnits:null,maskUnits:null,mathematical:null,max:null,media:null,mediaCharacterEncoding:null,mediaContentEncodings:null,mediaSize:up,mediaTime:null,method:null,min:null,mode:null,name:null,navDown:null,navDownLeft:null,navDownRight:null,navLeft:null,navNext:null,navPrev:null,navRight:null,navUp:null,navUpLeft:null,navUpRight:null,numOctaves:null,observer:null,offset:null,onAbort:null,onActivate:null,onAfterPrint:null,onBeforePrint:null,onBegin:null,onCancel:null,onCanPlay:null,onCanPlayThrough:null,onChange:null,onClick:null,onClose:null,onCopy:null,onCueChange:null,onCut:null,onDblClick:null,onDrag:null,onDragEnd:null,onDragEnter:null,onDragExit:null,onDragLeave:null,onDragOver:null,onDragStart:null,onDrop:null,onDurationChange:null,onEmptied:null,onEnd:null,onEnded:null,onError:null,onFocus:null,onFocusIn:null,onFocusOut:null,onHashChange:null,onInput:null,onInvalid:null,onKeyDown:null,onKeyPress:null,onKeyUp:null,onLoad:null,onLoadedData:null,onLoadedMetadata:null,onLoadStart:null,onMessage:null,onMouseDown:null,onMouseEnter:null,onMouseLeave:null,onMouseMove:null,onMouseOut:null,onMouseOver:null,onMouseUp:null,onMouseWheel:null,onOffline:null,onOnline:null,onPageHide:null,onPageShow:null,onPaste:null,onPause:null,onPlay:null,onPlaying:null,onPopState:null,onProgress:null,onRateChange:null,onRepeat:null,onReset:null,onResize:null,onScroll:null,onSeeked:null,onSeeking:null,onSelect:null,onShow:null,onStalled:null,onStorage:null,onSubmit:null,onSuspend:null,onTimeUpdate:null,onToggle:null,onUnload:null,onVolumeChange:null,onWaiting:null,onZoom:null,opacity:null,operator:null,order:null,orient:null,orientation:null,origin:null,overflow:null,overlay:null,overlinePosition:up,overlineThickness:up,paintOrder:null,panose1:null,path:null,pathLength:up,patternContentUnits:null,patternTransform:null,patternUnits:null,phase:null,ping:dp,pitch:null,playbackOrder:null,pointerEvents:null,points:null,pointsAtX:up,pointsAtY:up,pointsAtZ:up,preserveAlpha:null,preserveAspectRatio:null,primitiveUnits:null,propagate:null,property:pp,r:null,radius:null,referrerPolicy:null,refX:null,refY:null,rel:pp,rev:pp,renderingIntent:null,repeatCount:null,repeatDur:null,requiredExtensions:pp,requiredFeatures:pp,requiredFonts:pp,requiredFormats:pp,resource:null,restart:null,result:null,rotate:null,rx:null,ry:null,scale:null,seed:null,shapeRendering:null,side:null,slope:null,snapshotTime:null,specularConstant:up,specularExponent:up,spreadMethod:null,spacing:null,startOffset:null,stdDeviation:null,stemh:null,stemv:null,stitchTiles:null,stopColor:null,stopOpacity:null,strikethroughPosition:up,strikethroughThickness:up,string:null,stroke:null,strokeDashArray:pp,strokeDashOffset:null,strokeLineCap:null,strokeLineJoin:null,strokeMiterLimit:up,strokeOpacity:up,strokeWidth:null,style:null,surfaceScale:up,syncBehavior:null,syncBehaviorDefault:null,syncMaster:null,syncTolerance:null,syncToleranceDefault:null,systemLanguage:pp,tabIndex:up,tableValues:null,target:null,targetX:up,targetY:up,textAnchor:null,textDecoration:null,textRendering:null,textLength:null,timelineBegin:null,title:null,transformBehavior:null,type:null,typeOf:pp,to:null,transform:null,transformOrigin:null,u1:null,u2:null,underlinePosition:up,underlineThickness:up,unicode:null,unicodeBidi:null,unicodeRange:null,unitsPerEm:up,values:null,vAlphabetic:up,vMathematical:up,vectorEffect:null,vHanging:up,vIdeographic:up,version:null,vertAdvY:up,vertOriginX:up,vertOriginY:up,viewBox:null,viewTarget:null,visibility:null,width:null,widths:null,wordSpacing:null,writingMode:null,x:null,x1:null,x2:null,xChannelSelector:null,xHeight:up,y:null,y1:null,y2:null,yChannelSelector:null,z:null,zoomAndPan:null},space:`svg`,transform:Mye})})),bp,Bye=s((()=>{vp(),bp=_p({properties:{xLinkActuate:null,xLinkArcRole:null,xLinkHref:null,xLinkRole:null,xLinkShow:null,xLinkTitle:null,xLinkType:null},space:`xlink`,transform(e,t){return`xlink:`+t.slice(5).toLowerCase()}})})),xp,Vye=s((()=>{vp(),Fye(),xp=_p({attributes:{xmlnsxlink:`xmlns:xlink`},properties:{xmlnsXLink:null,xmlns:null},space:`xmlns`,transform:Pye})})),Sp,Hye=s((()=>{vp(),Sp=_p({properties:{xmlBase:null,xmlLang:null,xmlSpace:null},space:`xml`,transform(e,t){return`xml:`+t.slice(3).toLowerCase()}})}));function Cp(e,t){let n=np(t),r=t,i=ip;if(n in e.normal)return e.property[e.normal[n]];if(n.length>4&&n.slice(0,4)===`data`&&Kye.test(t)){if(t.charAt(4)===`-`){let e=t.slice(5).replace(wp,Wye);r=`data`+e.charAt(0).toUpperCase()+e.slice(1)}else{let e=t.slice(4);if(!wp.test(e)){let n=e.replace(Gye,Uye);n.charAt(0)!==`-`&&(n=`-`+n),t=`data`+n}}i=gp}return new i(r,t)}function Uye(e){return`-`+e.toLowerCase()}function Wye(e){return e.charAt(1).toUpperCase()}var Gye,wp,Kye,qye=s((()=>{Aye(),Dye(),rp(),Gye=/[A-Z]/g,wp=/-[a-z]/g,Kye=/^data[-\w.:]+$/i})),Tp,Ep,Dp=s((()=>{Eye(),jye(),Lye(),zye(),Bye(),Vye(),Hye(),qye(),rp(),Tp=Tye([yp,Iye,bp,xp,Sp],`html`),Ep=Tye([yp,Rye,bp,xp,Sp],`svg`)}));function Jye(e){let t=[],n=String(e||``),r=n.indexOf(`,`),i=0,a=!1;for(;!a;){r===-1&&(r=n.length,a=!0);let e=n.slice(i,r).trim();(e||!a)&&t.push(e),i=r+1,r=n.indexOf(`,`,i)}return t}function Yye(e,t){let n=t||{};return(e[e.length-1]===``?[...e,``]:e).join((n.padRight?` `:``)+`,`+(n.padLeft===!1?``:` `)).trim()}var Op=s((()=>{}));function Xye(e,t){let n=e||``,r={},i=0,a,o;for(;i<n.length;){kp.lastIndex=i;let e=kp.exec(n),t=n.slice(i,e?e.index:n.length);t&&(a?a===`#`?r.id=t:Array.isArray(r.className)?r.className.push(t):r.className=[t]:o=t,i+=t.length),e&&(a=e[0],i++)}return{type:`element`,tagName:o||t||`div`,properties:r,children:[]}}var kp,Zye=s((()=>{kp=/[#.]/g})),Qye=s((()=>{Zye()}));function Ap(e){let t=String(e||``).trim();return t?t.split(/[ \t\n\r\f]+/g):[]}function $ye(e){return e.join(` `).trim()}var jp=s((()=>{}));function ebe(e,t,n){let r=n&&abe(n);function i(n,i,...a){let o=-1,s;if(n==null){s={type:`root`,children:[]};let e=i;a.unshift(e)}else if(s=Xye(n,t),s.tagName=s.tagName.toLowerCase(),r&&Np.call(r,s.tagName)&&(s.tagName=r[s.tagName]),tbe(i,s.tagName)){let t;for(t in i)Np.call(i,t)&&nbe(e,s.properties,t,i[t])}else a.unshift(i);for(;++o<a.length;)Mp(s.children,a[o]);return s.type===`element`&&s.tagName===`template`&&(s.content={type:`root`,children:s.children},s.children=[]),s}return i}function tbe(e,t){return typeof e!=`object`||!e||Array.isArray(e)?!1:t===`input`||!e.type||typeof e.type!=`string`?!0:`children`in e&&Array.isArray(e.children)?!1:t===`button`?obe.has(e.type.toLowerCase()):!(`value`in e)}function nbe(e,t,n,r){let i=Cp(e,n),a=-1,o;if(r!=null){if(typeof r==`number`){if(Number.isNaN(r))return;o=r}else o=typeof r==`boolean`?r:typeof r==`string`?i.spaceSeparated?Ap(r):i.commaSeparated?Jye(r):i.commaOrSpaceSeparated?Ap(Jye(r).join(` `)):rbe(i,i.property,r):Array.isArray(r)?r.concat():i.property===`style`?ibe(r):String(r);if(Array.isArray(o)){let e=[];for(;++a<o.length;)e[a]=rbe(i,i.property,o[a]);o=e}if(i.property===`className`&&Array.isArray(t.className)){let e=o;o=t.className.concat(e)}t[i.property]=o}}function Mp(e,t){let n=-1;if(t!=null)if(typeof t==`string`||typeof t==`number`)e.push({type:`text`,value:String(t)});else if(Array.isArray(t))for(;++n<t.length;)Mp(e,t[n]);else if(typeof t==`object`&&`type`in t)t.type===`root`?Mp(e,t.children):e.push(t);else throw Error("Expected node, nodes, or string, got `"+t+"`")}function rbe(e,t,n){if(typeof n==`string`){if(e.number&&n&&!Number.isNaN(Number(n)))return Number(n);if((e.boolean||e.overloadedBoolean)&&(n===``||np(n)===np(t)))return!0}return n}function ibe(e){let t=[],n;for(n in e)Np.call(e,n)&&t.push([n,e[n]].join(`: `));return t.join(`; `)}function abe(e){let t={},n=-1;for(;++n<e.length;)t[e[n].toLowerCase()]=e[n];return t}var obe,Np,sbe=s((()=>{Op(),Qye(),Dp(),jp(),obe=new Set([`button`,`menu`,`reset`,`submit`]),Np={}.hasOwnProperty})),cbe,lbe=s((()=>{cbe=`altGlyph.altGlyphDef.altGlyphItem.animateColor.animateMotion.animateTransform.clipPath.feBlend.feColorMatrix.feComponentTransfer.feComposite.feConvolveMatrix.feDiffuseLighting.feDisplacementMap.feDistantLight.feDropShadow.feFlood.feFuncA.feFuncB.feFuncG.feFuncR.feGaussianBlur.feImage.feMerge.feMergeNode.feMorphology.feOffset.fePointLight.feSpecularLighting.feSpotLight.feTile.feTurbulence.foreignObject.glyphRef.linearGradient.radialGradient.solidColor.textArea.textPath`.split(`.`)})),ube,dbe,fbe=s((()=>{Dp(),sbe(),lbe(),ube=ebe(Tp,`div`),dbe=ebe(Ep,`g`,cbe)})),pbe=s((()=>{fbe()}));function mbe(e){let t=String(e),n=[];for(Pp.lastIndex=0;Pp.test(t);)n.push(Pp.lastIndex);return n.push(t.length+1),{toPoint:r,toOffset:i};function r(e){let t=-1;if(typeof e==`number`&&e>-1&&e<n[n.length-1]){for(;++t<n.length;)if(n[t]>e)return{line:t+1,column:e-(t>0?n[t-1]:0)+1,offset:e}}}function i(e){let t=e&&e.line,r=e&&e.column;if(typeof t==`number`&&typeof r==`number`&&!Number.isNaN(t)&&!Number.isNaN(r)&&t-1 in n){let e=(n[t-2]||0)+r-1||0;if(e>-1&&e<n[n.length-1])return e}}}var Pp,hbe=s((()=>{Pp=/\r?\n|\r/g})),gbe=s((()=>{hbe()})),Fp,Ip=s((()=>{Fp={html:`http://www.w3.org/1999/xhtml`,mathml:`http://www.w3.org/1998/Math/MathML`,svg:`http://www.w3.org/2000/svg`,xlink:`http://www.w3.org/1999/xlink`,xml:`http://www.w3.org/XML/1998/namespace`,xmlns:`http://www.w3.org/2000/xmlns/`}}));function _be(e,t){let n=t||{};return Lp({file:n.file||void 0,location:!1,schema:n.space===`svg`?Ep:Tp,verbose:n.verbose||!1},e)}function Lp(e,t){let n;switch(t.nodeName){case`#comment`:{let r=t;return n={type:`comment`,value:r.data},Rp(e,r,n),n}case`#document`:case`#document-fragment`:{let r=t,i=`mode`in r?r.mode===`quirks`||r.mode===`limited-quirks`:!1;if(n={type:`root`,children:vbe(e,t.childNodes),data:{quirksMode:i}},e.file&&e.location){let t=String(e.file),r=mbe(t),i=r.toPoint(0),a=r.toPoint(t.length);n.position={start:i,end:a}}return n}case`#documentType`:{let r=t;return n={type:`doctype`},Rp(e,r,n),n}case`#text`:{let r=t;return n={type:`text`,value:r.value},Rp(e,r,n),n}default:return n=ybe(e,t),n}}function vbe(e,t){let n=-1,r=[];for(;++n<t.length;){let i=Lp(e,t[n]);r.push(i)}return r}function ybe(e,t){let n=e.schema;e.schema=t.namespaceURI===Fp.svg?Ep:Tp;let r=-1,i={};for(;++r<t.attrs.length;){let e=t.attrs[r],n=(e.prefix?e.prefix+`:`:``)+e.name;Bp.call(Sbe,n)||(i[n]=e.value)}let a=(e.schema.space===`svg`?dbe:ube)(t.tagName,i,vbe(e,t.childNodes));if(Rp(e,t,a),a.tagName===`template`){let n=t,r=n.sourceCodeLocation,i=r&&r.startTag&&zp(r.startTag),o=r&&r.endTag&&zp(r.endTag),s=Lp(e,n.content);i&&o&&e.file&&(s.position={start:i.end,end:o.start}),a.content=s}return e.schema=n,a}function Rp(e,t,n){if(`sourceCodeLocation`in t&&t.sourceCodeLocation&&e.file){let r=bbe(e,n,t.sourceCodeLocation);r&&(e.location=!0,n.position=r)}}function bbe(e,t,n){let r=zp(n);if(t.type===`element`){let i=t.children[t.children.length-1];if(r&&!n.endTag&&i&&i.position&&i.position.end&&(r.end=Object.assign({},i.position.end)),e.verbose){let r={},i;if(n.attrs)for(i in n.attrs)Bp.call(n.attrs,i)&&(r[Cp(e.schema,i).property]=zp(n.attrs[i]));n.startTag;let a=zp(n.startTag),o=n.endTag?zp(n.endTag):void 0,s={opening:a};o&&(s.closing=o),s.properties=r,t.data={position:s}}}return r}function zp(e){let t=xbe({line:e.startLine,column:e.startCol,offset:e.startOffset}),n=xbe({line:e.endLine,column:e.endCol,offset:e.endOffset});return t||n?{start:t,end:n}:void 0}function xbe(e){return e.line&&e.column?e:void 0}var Bp,Sbe,Cbe=s((()=>{ep(),pbe(),Dp(),gbe(),Ip(),Bp={}.hasOwnProperty,Sbe=Object.prototype})),wbe=s((()=>{Cbe()}));function Tbe(e){return e>=55296&&e<=57343}function Ebe(e){return e>=56320&&e<=57343}function Dbe(e,t){return(e-55296)*1024+9216+t}function Obe(e){return e!==32&&e!==10&&e!==13&&e!==9&&e!==12&&e>=1&&e<=31||e>=127&&e<=159}function kbe(e){return e>=64976&&e<=65007||Abe.has(e)}var Abe,K,Vp,Hp=s((()=>{Abe=new Set([65534,65535,131070,131071,196606,196607,262142,262143,327678,327679,393214,393215,458750,458751,524286,524287,589822,589823,655358,655359,720894,720895,786430,786431,851966,851967,917502,917503,983038,983039,1048574,1048575,1114110,1114111]),(function(e){e[e.EOF=-1]=`EOF`,e[e.NULL=0]=`NULL`,e[e.TABULATION=9]=`TABULATION`,e[e.CARRIAGE_RETURN=13]=`CARRIAGE_RETURN`,e[e.LINE_FEED=10]=`LINE_FEED`,e[e.FORM_FEED=12]=`FORM_FEED`,e[e.SPACE=32]=`SPACE`,e[e.EXCLAMATION_MARK=33]=`EXCLAMATION_MARK`,e[e.QUOTATION_MARK=34]=`QUOTATION_MARK`,e[e.AMPERSAND=38]=`AMPERSAND`,e[e.APOSTROPHE=39]=`APOSTROPHE`,e[e.HYPHEN_MINUS=45]=`HYPHEN_MINUS`,e[e.SOLIDUS=47]=`SOLIDUS`,e[e.DIGIT_0=48]=`DIGIT_0`,e[e.DIGIT_9=57]=`DIGIT_9`,e[e.SEMICOLON=59]=`SEMICOLON`,e[e.LESS_THAN_SIGN=60]=`LESS_THAN_SIGN`,e[e.EQUALS_SIGN=61]=`EQUALS_SIGN`,e[e.GREATER_THAN_SIGN=62]=`GREATER_THAN_SIGN`,e[e.QUESTION_MARK=63]=`QUESTION_MARK`,e[e.LATIN_CAPITAL_A=65]=`LATIN_CAPITAL_A`,e[e.LATIN_CAPITAL_Z=90]=`LATIN_CAPITAL_Z`,e[e.RIGHT_SQUARE_BRACKET=93]=`RIGHT_SQUARE_BRACKET`,e[e.GRAVE_ACCENT=96]=`GRAVE_ACCENT`,e[e.LATIN_SMALL_A=97]=`LATIN_SMALL_A`,e[e.LATIN_SMALL_Z=122]=`LATIN_SMALL_Z`})(K||={}),Vp={DASH_DASH:`--`,CDATA_START:`[CDATA[`,DOCTYPE:`doctype`,SCRIPT:`script`,PUBLIC:`public`,SYSTEM:`system`}})),Up,Wp=s((()=>{(function(e){e.controlCharacterInInputStream=`control-character-in-input-stream`,e.noncharacterInInputStream=`noncharacter-in-input-stream`,e.surrogateInInputStream=`surrogate-in-input-stream`,e.nonVoidHtmlElementStartTagWithTrailingSolidus=`non-void-html-element-start-tag-with-trailing-solidus`,e.endTagWithAttributes=`end-tag-with-attributes`,e.endTagWithTrailingSolidus=`end-tag-with-trailing-solidus`,e.unexpectedSolidusInTag=`unexpected-solidus-in-tag`,e.unexpectedNullCharacter=`unexpected-null-character`,e.unexpectedQuestionMarkInsteadOfTagName=`unexpected-question-mark-instead-of-tag-name`,e.invalidFirstCharacterOfTagName=`invalid-first-character-of-tag-name`,e.unexpectedEqualsSignBeforeAttributeName=`unexpected-equals-sign-before-attribute-name`,e.missingEndTagName=`missing-end-tag-name`,e.unexpectedCharacterInAttributeName=`unexpected-character-in-attribute-name`,e.unknownNamedCharacterReference=`unknown-named-character-reference`,e.missingSemicolonAfterCharacterReference=`missing-semicolon-after-character-reference`,e.unexpectedCharacterAfterDoctypeSystemIdentifier=`unexpected-character-after-doctype-system-identifier`,e.unexpectedCharacterInUnquotedAttributeValue=`unexpected-character-in-unquoted-attribute-value`,e.eofBeforeTagName=`eof-before-tag-name`,e.eofInTag=`eof-in-tag`,e.missingAttributeValue=`missing-attribute-value`,e.missingWhitespaceBetweenAttributes=`missing-whitespace-between-attributes`,e.missingWhitespaceAfterDoctypePublicKeyword=`missing-whitespace-after-doctype-public-keyword`,e.missingWhitespaceBetweenDoctypePublicAndSystemIdentifiers=`missing-whitespace-between-doctype-public-and-system-identifiers`,e.missingWhitespaceAfterDoctypeSystemKeyword=`missing-whitespace-after-doctype-system-keyword`,e.missingQuoteBeforeDoctypePublicIdentifier=`missing-quote-before-doctype-public-identifier`,e.missingQuoteBeforeDoctypeSystemIdentifier=`missing-quote-before-doctype-system-identifier`,e.missingDoctypePublicIdentifier=`missing-doctype-public-identifier`,e.missingDoctypeSystemIdentifier=`missing-doctype-system-identifier`,e.abruptDoctypePublicIdentifier=`abrupt-doctype-public-identifier`,e.abruptDoctypeSystemIdentifier=`abrupt-doctype-system-identifier`,e.cdataInHtmlContent=`cdata-in-html-content`,e.incorrectlyOpenedComment=`incorrectly-opened-comment`,e.eofInScriptHtmlCommentLikeText=`eof-in-script-html-comment-like-text`,e.eofInDoctype=`eof-in-doctype`,e.nestedComment=`nested-comment`,e.abruptClosingOfEmptyComment=`abrupt-closing-of-empty-comment`,e.eofInComment=`eof-in-comment`,e.incorrectlyClosedComment=`incorrectly-closed-comment`,e.eofInCdata=`eof-in-cdata`,e.absenceOfDigitsInNumericCharacterReference=`absence-of-digits-in-numeric-character-reference`,e.nullCharacterReference=`null-character-reference`,e.surrogateCharacterReference=`surrogate-character-reference`,e.characterReferenceOutsideUnicodeRange=`character-reference-outside-unicode-range`,e.controlCharacterReference=`control-character-reference`,e.noncharacterCharacterReference=`noncharacter-character-reference`,e.missingWhitespaceBeforeDoctypeName=`missing-whitespace-before-doctype-name`,e.missingDoctypeName=`missing-doctype-name`,e.invalidCharacterSequenceAfterDoctypeName=`invalid-character-sequence-after-doctype-name`,e.duplicateAttribute=`duplicate-attribute`,e.nonConformingDoctype=`non-conforming-doctype`,e.missingDoctype=`missing-doctype`,e.misplacedDoctype=`misplaced-doctype`,e.endTagWithoutMatchingOpenElement=`end-tag-without-matching-open-element`,e.closingOfElementWithOpenChildElements=`closing-of-element-with-open-child-elements`,e.disallowedContentInNoscriptInHead=`disallowed-content-in-noscript-in-head`,e.openElementsLeftAfterEof=`open-elements-left-after-eof`,e.abandonedHeadElementChild=`abandoned-head-element-child`,e.misplacedStartTagForHeadElement=`misplaced-start-tag-for-head-element`,e.nestedNoscriptInHead=`nested-noscript-in-head`,e.eofInElementThatCanContainOnlyText=`eof-in-element-that-can-contain-only-text`})(Up||={})})),jbe,Mbe,Nbe=s((()=>{Hp(),Wp(),jbe=65536,Mbe=class{constructor(e){this.handler=e,this.html=``,this.pos=-1,this.lastGapPos=-2,this.gapStack=[],this.skipNextNewLine=!1,this.lastChunkWritten=!1,this.endOfChunkHit=!1,this.bufferWaterline=jbe,this.isEol=!1,this.lineStartPos=0,this.droppedBufferSize=0,this.line=1,this.lastErrOffset=-1}get col(){return this.pos-this.lineStartPos+Number(this.lastGapPos!==this.pos)}get offset(){return this.droppedBufferSize+this.pos}getError(e,t){let{line:n,col:r,offset:i}=this,a=r+t,o=i+t;return{code:e,startLine:n,endLine:n,startCol:a,endCol:a,startOffset:o,endOffset:o}}_err(e){this.handler.onParseError&&this.lastErrOffset!==this.offset&&(this.lastErrOffset=this.offset,this.handler.onParseError(this.getError(e,0)))}_addGap(){this.gapStack.push(this.lastGapPos),this.lastGapPos=this.pos}_processSurrogate(e){if(this.pos!==this.html.length-1){let t=this.html.charCodeAt(this.pos+1);if(Ebe(t))return this.pos++,this._addGap(),Dbe(e,t)}else if(!this.lastChunkWritten)return this.endOfChunkHit=!0,K.EOF;return this._err(Up.surrogateInInputStream),e}willDropParsedChunk(){return this.pos>this.bufferWaterline}dropParsedChunk(){this.willDropParsedChunk()&&(this.html=this.html.substring(this.pos),this.lineStartPos-=this.pos,this.droppedBufferSize+=this.pos,this.pos=0,this.lastGapPos=-2,this.gapStack.length=0)}write(e,t){this.html.length>0?this.html+=e:this.html=e,this.endOfChunkHit=!1,this.lastChunkWritten=t}insertHtmlAtCurrentPos(e){this.html=this.html.substring(0,this.pos+1)+e+this.html.substring(this.pos+1),this.endOfChunkHit=!1}startsWith(e,t){if(this.pos+e.length>this.html.length)return this.endOfChunkHit=!this.lastChunkWritten,!1;if(t)return this.html.startsWith(e,this.pos);for(let t=0;t<e.length;t++)if((this.html.charCodeAt(this.pos+t)|32)!==e.charCodeAt(t))return!1;return!0}peek(e){let t=this.pos+e;if(t>=this.html.length)return this.endOfChunkHit=!this.lastChunkWritten,K.EOF;let n=this.html.charCodeAt(t);return n===K.CARRIAGE_RETURN?K.LINE_FEED:n}advance(){if(this.pos++,this.isEol&&(this.isEol=!1,this.line++,this.lineStartPos=this.pos),this.pos>=this.html.length)return this.endOfChunkHit=!this.lastChunkWritten,K.EOF;let e=this.html.charCodeAt(this.pos);return e===K.CARRIAGE_RETURN?(this.isEol=!0,this.skipNextNewLine=!0,K.LINE_FEED):e===K.LINE_FEED&&(this.isEol=!0,this.skipNextNewLine)?(this.line--,this.skipNextNewLine=!1,this._addGap(),this.advance()):(this.skipNextNewLine=!1,Tbe(e)&&(e=this._processSurrogate(e)),this.handler.onParseError===null||e>31&&e<127||e===K.LINE_FEED||e===K.CARRIAGE_RETURN||e>159&&e<64976||this._checkForProblematicCharacters(e),e)}_checkForProblematicCharacters(e){Obe(e)?this._err(Up.controlCharacterInInputStream):kbe(e)&&this._err(Up.noncharacterInInputStream)}retreat(e){for(this.pos-=e;this.pos<this.lastGapPos;)this.lastGapPos=this.gapStack.pop(),this.pos--;this.isEol=!1}}}));function Pbe(e,t){for(let n=e.attrs.length-1;n>=0;n--)if(e.attrs[n].name===t)return e.attrs[n].value;return null}var Gp,Kp=s((()=>{(function(e){e[e.CHARACTER=0]=`CHARACTER`,e[e.NULL_CHARACTER=1]=`NULL_CHARACTER`,e[e.WHITESPACE_CHARACTER=2]=`WHITESPACE_CHARACTER`,e[e.START_TAG=3]=`START_TAG`,e[e.END_TAG=4]=`END_TAG`,e[e.COMMENT=5]=`COMMENT`,e[e.DOCTYPE=6]=`DOCTYPE`,e[e.EOF=7]=`EOF`,e[e.HIBERNATION=8]=`HIBERNATION`})(Gp||={})})),Fbe,Ibe=s((()=>{Fbe=new Uint16Array(`ᵁ<Õıʊҝջאٵ۞ޢߖࠏ੊ઑඡ๭༉༦჊ረዡᐕᒝᓃᓟᔥ\0\0\0\0\0\0ᕫᛍᦍᰒᷝ὾⁠↰⊍⏀⏻⑂⠤⤒ⴈ⹈⿎〖㊺㘹㞬㣾㨨㩱㫠㬮ࠀEMabcfglmnoprstu\\bfms„‹•˜¦³¹ÈÏlig耻Æ䃆P耻&䀦cute耻Á䃁reve;䄂Āiyx}rc耻Â䃂;䐐r;쀀𝔄rave耻À䃀pha;䎑acr;䄀d;橓Āgp¡on;䄄f;쀀𝔸plyFunction;恡ing耻Å䃅Ācs¾Ãr;쀀𝒜ign;扔ilde耻Ã䃃ml耻Ä䃄ЀaceforsuåûþėĜĢħĪĀcrêòkslash;或Ŷöø;櫧ed;挆y;䐑ƀcrtąċĔause;戵noullis;愬a;䎒r;쀀𝔅pf;쀀𝔹eve;䋘còēmpeq;扎܀HOacdefhilorsuōőŖƀƞƢƵƷƺǜȕɳɸɾcy;䐧PY耻©䂩ƀcpyŝŢźute;䄆Ā;iŧŨ拒talDifferentialD;慅leys;愭ȀaeioƉƎƔƘron;䄌dil耻Ç䃇rc;䄈nint;戰ot;䄊ĀdnƧƭilla;䂸terDot;䂷òſi;䎧rcleȀDMPTLJNjǑǖot;抙inus;抖lus;投imes;抗oĀcsǢǸkwiseContourIntegral;戲eCurlyĀDQȃȏoubleQuote;思uote;怙ȀlnpuȞȨɇɕonĀ;eȥȦ户;橴ƀgitȯȶȺruent;扡nt;戯ourIntegral;戮ĀfrɌɎ;愂oduct;成nterClockwiseContourIntegral;戳oss;樯cr;쀀𝒞pĀ;Cʄʅ拓ap;才րDJSZacefiosʠʬʰʴʸˋ˗ˡ˦̳ҍĀ;oŹʥtrahd;椑cy;䐂cy;䐅cy;䐏ƀgrsʿ˄ˇger;怡r;憡hv;櫤Āayː˕ron;䄎;䐔lĀ;t˝˞戇a;䎔r;쀀𝔇Āaf˫̧Ācm˰̢riticalȀADGT̖̜̀̆cute;䂴oŴ̋̍;䋙bleAcute;䋝rave;䁠ilde;䋜ond;拄ferentialD;慆Ѱ̽\0\0\0͔͂\0Ѕf;쀀𝔻ƀ;DE͈͉͍䂨ot;惜qual;扐blèCDLRUVͣͲ΂ϏϢϸontourIntegraìȹoɴ͹\0\0ͻ»͉nArrow;懓Āeo·ΤftƀARTΐΖΡrrow;懐ightArrow;懔eåˊngĀLRΫτeftĀARγιrrow;柸ightArrow;柺ightArrow;柹ightĀATϘϞrrow;懒ee;抨pɁϩ\0\0ϯrrow;懑ownArrow;懕erticalBar;戥ǹABLRTaВЪаўѿͼrrowƀ;BUНОТ憓ar;椓pArrow;懵reve;䌑eft˒к\0ц\0ѐightVector;楐eeVector;楞ectorĀ;Bљњ憽ar;楖ightǔѧ\0ѱeeVector;楟ectorĀ;BѺѻ懁ar;楗eeĀ;A҆҇护rrow;憧ĀctҒҗr;쀀𝒟rok;䄐ࠀNTacdfglmopqstuxҽӀӄӋӞӢӧӮӵԡԯԶՒ՝ՠեG;䅊H耻Ð䃐cute耻É䃉ƀaiyӒӗӜron;䄚rc耻Ê䃊;䐭ot;䄖r;쀀𝔈rave耻È䃈ement;戈ĀapӺӾcr;䄒tyɓԆ\0\0ԒmallSquare;旻erySmallSquare;斫ĀgpԦԪon;䄘f;쀀𝔼silon;䎕uĀaiԼՉlĀ;TՂՃ橵ilde;扂librium;懌Āci՗՚r;愰m;橳a;䎗ml耻Ë䃋Āipժկsts;戃onentialE;慇ʀcfiosօֈ֍ֲ׌y;䐤r;쀀𝔉lledɓ֗\0\0֣mallSquare;旼erySmallSquare;斪Ͱֺ\0ֿ\0\0ׄf;쀀𝔽All;戀riertrf;愱cò׋؀JTabcdfgorstר׬ׯ׺؀ؒؖ؛؝أ٬ٲcy;䐃耻>䀾mmaĀ;d׷׸䎓;䏜reve;䄞ƀeiy؇،ؐdil;䄢rc;䄜;䐓ot;䄠r;쀀𝔊;拙pf;쀀𝔾eater̀EFGLSTصلَٖٛ٦qualĀ;Lؾؿ扥ess;招ullEqual;执reater;檢ess;扷lantEqual;橾ilde;扳cr;쀀𝒢;扫ЀAacfiosuڅڋږڛڞڪھۊRDcy;䐪Āctڐڔek;䋇;䁞irc;䄤r;愌lbertSpace;愋ǰگ\0ڲf;愍izontalLine;攀Āctۃۅòکrok;䄦mpńېۘownHumðįqual;扏܀EJOacdfgmnostuۺ۾܃܇܎ܚܞܡܨ݄ݸދޏޕcy;䐕lig;䄲cy;䐁cute耻Í䃍Āiyܓܘrc耻Î䃎;䐘ot;䄰r;愑rave耻Ì䃌ƀ;apܠܯܿĀcgܴܷr;䄪inaryI;慈lieóϝǴ݉\0ݢĀ;eݍݎ戬Āgrݓݘral;戫section;拂isibleĀCTݬݲomma;恣imes;恢ƀgptݿރވon;䄮f;쀀𝕀a;䎙cr;愐ilde;䄨ǫޚ\0ޞcy;䐆l耻Ï䃏ʀcfosuެ޷޼߂ߐĀiyޱ޵rc;䄴;䐙r;쀀𝔍pf;쀀𝕁ǣ߇\0ߌr;쀀𝒥rcy;䐈kcy;䐄΀HJacfosߤߨ߽߬߱ࠂࠈcy;䐥cy;䐌ppa;䎚Āey߶߻dil;䄶;䐚r;쀀𝔎pf;쀀𝕂cr;쀀𝒦րJTaceflmostࠥࠩࠬࡐࡣ঳সে্਷ੇcy;䐉耻<䀼ʀcmnpr࠷࠼ࡁࡄࡍute;䄹bda;䎛g;柪lacetrf;愒r;憞ƀaeyࡗ࡜ࡡron;䄽dil;䄻;䐛Āfsࡨ॰tԀACDFRTUVarࡾࢩࢱࣦ࣠ࣼयज़ΐ४Ānrࢃ࢏gleBracket;柨rowƀ;BR࢙࢚࢞憐ar;懤ightArrow;懆eiling;挈oǵࢷ\0ࣃbleBracket;柦nǔࣈ\0࣒eeVector;楡ectorĀ;Bࣛࣜ懃ar;楙loor;挊ightĀAV࣯ࣵrrow;憔ector;楎Āerँगeƀ;AVउऊऐ抣rrow;憤ector;楚iangleƀ;BEतथऩ抲ar;槏qual;抴pƀDTVषूौownVector;楑eeVector;楠ectorĀ;Bॖॗ憿ar;楘ectorĀ;B॥०憼ar;楒ightáΜs̀EFGLSTॾঋকঝঢভqualGreater;拚ullEqual;扦reater;扶ess;檡lantEqual;橽ilde;扲r;쀀𝔏Ā;eঽা拘ftarrow;懚idot;䄿ƀnpw৔ਖਛgȀLRlr৞৷ਂਐeftĀAR০৬rrow;柵ightArrow;柷ightArrow;柶eftĀarγਊightáοightáϊf;쀀𝕃erĀLRਢਬeftArrow;憙ightArrow;憘ƀchtਾੀੂòࡌ;憰rok;䅁;扪Ѐacefiosuਗ਼੝੠੷੼અઋ઎p;椅y;䐜Ādl੥੯iumSpace;恟lintrf;愳r;쀀𝔐nusPlus;戓pf;쀀𝕄cò੶;䎜ҀJacefostuણધભીଔଙඑ඗ඞcy;䐊cute;䅃ƀaey઴હાron;䅇dil;䅅;䐝ƀgswે૰଎ativeƀMTV૓૟૨ediumSpace;怋hiĀcn૦૘ë૙eryThiî૙tedĀGL૸ଆreaterGreateòٳessLesóੈLine;䀊r;쀀𝔑ȀBnptଢନଷ଺reak;恠BreakingSpace;䂠f;愕ڀ;CDEGHLNPRSTV୕ୖ୪୼஡௫ఄ౞಄ದ೘ൡඅ櫬Āou୛୤ngruent;扢pCap;扭oubleVerticalBar;戦ƀlqxஃஊ஛ement;戉ualĀ;Tஒஓ扠ilde;쀀≂̸ists;戄reater΀;EFGLSTஶஷ஽௉௓௘௥扯qual;扱ullEqual;쀀≧̸reater;쀀≫̸ess;批lantEqual;쀀⩾̸ilde;扵umpń௲௽ownHump;쀀≎̸qual;쀀≏̸eĀfsఊధtTriangleƀ;BEచఛడ拪ar;쀀⧏̸qual;括s̀;EGLSTవశ఼ౄోౘ扮qual;扰reater;扸ess;쀀≪̸lantEqual;쀀⩽̸ilde;扴estedĀGL౨౹reaterGreater;쀀⪢̸essLess;쀀⪡̸recedesƀ;ESಒಓಛ技qual;쀀⪯̸lantEqual;拠ĀeiಫಹverseElement;戌ghtTriangleƀ;BEೋೌ೒拫ar;쀀⧐̸qual;拭ĀquೝഌuareSuĀbp೨೹setĀ;E೰ೳ쀀⊏̸qual;拢ersetĀ;Eഃആ쀀⊐̸qual;拣ƀbcpഓതൎsetĀ;Eഛഞ쀀⊂⃒qual;抈ceedsȀ;ESTലള഻െ抁qual;쀀⪰̸lantEqual;拡ilde;쀀≿̸ersetĀ;E൘൛쀀⊃⃒qual;抉ildeȀ;EFT൮൯൵ൿ扁qual;扄ullEqual;扇ilde;扉erticalBar;戤cr;쀀𝒩ilde耻Ñ䃑;䎝܀Eacdfgmoprstuvලෂ෉෕ෛ෠෧෼ขภยา฿ไlig;䅒cute耻Ó䃓Āiy෎ීrc耻Ô䃔;䐞blac;䅐r;쀀𝔒rave耻Ò䃒ƀaei෮ෲ෶cr;䅌ga;䎩cron;䎟pf;쀀𝕆enCurlyĀDQฎบoubleQuote;怜uote;怘;橔Āclวฬr;쀀𝒪ash耻Ø䃘iŬื฼de耻Õ䃕es;樷ml耻Ö䃖erĀBP๋๠Āar๐๓r;怾acĀek๚๜;揞et;掴arenthesis;揜Ҁacfhilors๿ງຊຏຒດຝະ໼rtialD;戂y;䐟r;쀀𝔓i;䎦;䎠usMinus;䂱Āipຢອncareplanåڝf;愙Ȁ;eio຺ູ໠໤檻cedesȀ;EST່້໏໚扺qual;檯lantEqual;扼ilde;找me;怳Ādp໩໮uct;戏ortionĀ;aȥ໹l;戝Āci༁༆r;쀀𝒫;䎨ȀUfos༑༖༛༟OT耻"䀢r;쀀𝔔pf;愚cr;쀀𝒬؀BEacefhiorsu༾གྷཇའཱིྦྷྪྭ႖ႩႴႾarr;椐G耻®䂮ƀcnrཎནབute;䅔g;柫rĀ;tཛྷཝ憠l;椖ƀaeyཧཬཱron;䅘dil;䅖;䐠Ā;vླྀཹ愜erseĀEUྂྙĀlq྇ྎement;戋uilibrium;懋pEquilibrium;楯r»ཹo;䎡ghtЀACDFTUVa࿁࿫࿳ဢဨၛႇϘĀnr࿆࿒gleBracket;柩rowƀ;BL࿜࿝࿡憒ar;懥eftArrow;懄eiling;按oǵ࿹\0စbleBracket;柧nǔည\0နeeVector;楝ectorĀ;Bဝသ懂ar;楕loor;挋Āerိ၃eƀ;AVဵံြ抢rrow;憦ector;楛iangleƀ;BEၐၑၕ抳ar;槐qual;抵pƀDTVၣၮၸownVector;楏eeVector;楜ectorĀ;Bႂႃ憾ar;楔ectorĀ;B႑႒懀ar;楓Āpuႛ႞f;愝ndImplies;楰ightarrow;懛ĀchႹႼr;愛;憱leDelayed;槴ڀHOacfhimoqstuფჱჷჽᄙᄞᅑᅖᅡᅧᆵᆻᆿĀCcჩხHcy;䐩y;䐨FTcy;䐬cute;䅚ʀ;aeiyᄈᄉᄎᄓᄗ檼ron;䅠dil;䅞rc;䅜;䐡r;쀀𝔖ortȀDLRUᄪᄴᄾᅉownArrow»ОeftArrow»࢚ightArrow»࿝pArrow;憑gma;䎣allCircle;战pf;쀀𝕊ɲᅭ\0\0ᅰt;戚areȀ;ISUᅻᅼᆉᆯ斡ntersection;抓uĀbpᆏᆞsetĀ;Eᆗᆘ抏qual;抑ersetĀ;Eᆨᆩ抐qual;抒nion;抔cr;쀀𝒮ar;拆ȀbcmpᇈᇛሉላĀ;sᇍᇎ拐etĀ;Eᇍᇕqual;抆ĀchᇠህeedsȀ;ESTᇭᇮᇴᇿ扻qual;檰lantEqual;扽ilde;承Tháྌ;我ƀ;esሒሓሣ拑rsetĀ;Eሜም抃qual;抇et»ሓրHRSacfhiorsሾቄ቉ቕ቞ቱቶኟዂወዑORN耻Þ䃞ADE;愢ĀHc቎ቒcy;䐋y;䐦Ābuቚቜ;䀉;䎤ƀaeyብቪቯron;䅤dil;䅢;䐢r;쀀𝔗Āeiቻ኉Dzኀ\0ኇefore;戴a;䎘Ācn኎ኘkSpace;쀀  Space;怉ldeȀ;EFTካኬኲኼ戼qual;扃ullEqual;扅ilde;扈pf;쀀𝕋ipleDot;惛Āctዖዛr;쀀𝒯rok;䅦ૡዷጎጚጦ\0ጬጱ\0\0\0\0\0ጸጽ፷ᎅ\0᏿ᐄᐊᐐĀcrዻጁute耻Ú䃚rĀ;oጇገ憟cir;楉rǣጓ\0጖y;䐎ve;䅬Āiyጞጣrc耻Û䃛;䐣blac;䅰r;쀀𝔘rave耻Ù䃙acr;䅪Ādiፁ፩erĀBPፈ፝Āarፍፐr;䁟acĀekፗፙ;揟et;掵arenthesis;揝onĀ;P፰፱拃lus;抎Āgp፻፿on;䅲f;쀀𝕌ЀADETadps᎕ᎮᎸᏄϨᏒᏗᏳrrowƀ;BDᅐᎠᎤar;椒ownArrow;懅ownArrow;憕quilibrium;楮eeĀ;AᏋᏌ报rrow;憥ownáϳerĀLRᏞᏨeftArrow;憖ightArrow;憗iĀ;lᏹᏺ䏒on;䎥ing;䅮cr;쀀𝒰ilde;䅨ml耻Ü䃜ҀDbcdefosvᐧᐬᐰᐳᐾᒅᒊᒐᒖash;披ar;櫫y;䐒ashĀ;lᐻᐼ抩;櫦Āerᑃᑅ;拁ƀbtyᑌᑐᑺar;怖Ā;iᑏᑕcalȀBLSTᑡᑥᑪᑴar;戣ine;䁼eparator;杘ilde;所ThinSpace;怊r;쀀𝔙pf;쀀𝕍cr;쀀𝒱dash;抪ʀcefosᒧᒬᒱᒶᒼirc;䅴dge;拀r;쀀𝔚pf;쀀𝕎cr;쀀𝒲Ȁfiosᓋᓐᓒᓘr;쀀𝔛;䎞pf;쀀𝕏cr;쀀𝒳ҀAIUacfosuᓱᓵᓹᓽᔄᔏᔔᔚᔠcy;䐯cy;䐇cy;䐮cute耻Ý䃝Āiyᔉᔍrc;䅶;䐫r;쀀𝔜pf;쀀𝕐cr;쀀𝒴ml;䅸ЀHacdefosᔵᔹᔿᕋᕏᕝᕠᕤcy;䐖cute;䅹Āayᕄᕉron;䅽;䐗ot;䅻Dzᕔ\0ᕛoWidtè૙a;䎖r;愨pf;愤cr;쀀𝒵௡ᖃᖊᖐ\0ᖰᖶᖿ\0\0\0\0ᗆᗛᗫᙟ᙭\0ᚕ᚛ᚲᚹ\0ᚾcute耻á䃡reve;䄃̀;Ediuyᖜᖝᖡᖣᖨᖭ戾;쀀∾̳;房rc耻â䃢te肻´̆;䐰lig耻æ䃦Ā;r²ᖺ;쀀𝔞rave耻à䃠ĀepᗊᗖĀfpᗏᗔsym;愵èᗓha;䎱ĀapᗟcĀclᗤᗧr;䄁g;樿ɤᗰ\0\0ᘊʀ;adsvᗺᗻᗿᘁᘇ戧nd;橕;橜lope;橘;橚΀;elmrszᘘᘙᘛᘞᘿᙏᙙ戠;榤e»ᘙsdĀ;aᘥᘦ戡ѡᘰᘲᘴᘶᘸᘺᘼᘾ;榨;榩;榪;榫;榬;榭;榮;榯tĀ;vᙅᙆ戟bĀ;dᙌᙍ抾;榝Āptᙔᙗh;戢»¹arr;捼Āgpᙣᙧon;䄅f;쀀𝕒΀;Eaeiop዁ᙻᙽᚂᚄᚇᚊ;橰cir;橯;扊d;手s;䀧roxĀ;e዁ᚒñᚃing耻å䃥ƀctyᚡᚦᚨr;쀀𝒶;䀪mpĀ;e዁ᚯñʈilde耻ã䃣ml耻ä䃤Āciᛂᛈoninôɲnt;樑ࠀNabcdefiklnoprsu᛭ᛱᜰ᜼ᝃᝈ᝸᝽០៦ᠹᡐᜍ᤽᥈ᥰot;櫭Ācrᛶ᜞kȀcepsᜀᜅᜍᜓong;扌psilon;䏶rime;怵imĀ;e᜚᜛戽q;拍Ŷᜢᜦee;抽edĀ;gᜬᜭ挅e»ᜭrkĀ;t፜᜷brk;掶Āoyᜁᝁ;䐱quo;怞ʀcmprtᝓ᝛ᝡᝤᝨausĀ;eĊĉptyv;榰séᜌnoõēƀahwᝯ᝱ᝳ;䎲;愶een;扬r;쀀𝔟g΀costuvwឍឝឳេ៕៛៞ƀaiuបពរðݠrc;旯p»፱ƀdptឤឨឭot;樀lus;樁imes;樂ɱឹ\0\0ើcup;樆ar;昅riangleĀdu៍្own;施p;斳plus;樄eåᑄåᒭarow;植ƀako៭ᠦᠵĀcn៲ᠣkƀlst៺֫᠂ozenge;槫riangleȀ;dlr᠒᠓᠘᠝斴own;斾eft;旂ight;斸k;搣Ʊᠫ\0ᠳƲᠯ\0ᠱ;斒;斑4;斓ck;斈ĀeoᠾᡍĀ;qᡃᡆ쀀=⃥uiv;쀀≡⃥t;挐Ȁptwxᡙᡞᡧᡬf;쀀𝕓Ā;tᏋᡣom»Ꮜtie;拈؀DHUVbdhmptuvᢅᢖᢪᢻᣗᣛᣬ᣿ᤅᤊᤐᤡȀLRlrᢎᢐᢒᢔ;敗;敔;敖;敓ʀ;DUduᢡᢢᢤᢦᢨ敐;敦;敩;敤;敧ȀLRlrᢳᢵᢷᢹ;敝;敚;敜;教΀;HLRhlrᣊᣋᣍᣏᣑᣓᣕ救;敬;散;敠;敫;敢;敟ox;槉ȀLRlrᣤᣦᣨᣪ;敕;敒;攐;攌ʀ;DUduڽ᣷᣹᣻᣽;敥;敨;攬;攴inus;抟lus;択imes;抠ȀLRlrᤙᤛᤝ᤟;敛;敘;攘;攔΀;HLRhlrᤰᤱᤳᤵᤷ᤻᤹攂;敪;敡;敞;攼;攤;攜Āevģ᥂bar耻¦䂦Ȁceioᥑᥖᥚᥠr;쀀𝒷mi;恏mĀ;e᜚᜜lƀ;bhᥨᥩᥫ䁜;槅sub;柈Ŭᥴ᥾lĀ;e᥹᥺怢t»᥺pƀ;Eeįᦅᦇ;檮Ā;qۜۛೡᦧ\0᧨ᨑᨕᨲ\0ᨷᩐ\0\0᪴\0\0᫁\0\0ᬡᬮ᭍᭒\0᯽\0ᰌƀcpr᦭ᦲ᧝ute;䄇̀;abcdsᦿᧀᧄ᧊᧕᧙戩nd;橄rcup;橉Āau᧏᧒p;橋p;橇ot;橀;쀀∩︀Āeo᧢᧥t;恁îړȀaeiu᧰᧻ᨁᨅǰ᧵\0᧸s;橍on;䄍dil耻ç䃧rc;䄉psĀ;sᨌᨍ橌m;橐ot;䄋ƀdmnᨛᨠᨦil肻¸ƭptyv;榲t脀¢;eᨭᨮ䂢räƲr;쀀𝔠ƀceiᨽᩀᩍy;䑇ckĀ;mᩇᩈ朓ark»ᩈ;䏇r΀;Ecefms᩟᩠ᩢᩫ᪤᪪᪮旋;槃ƀ;elᩩᩪᩭ䋆q;扗eɡᩴ\0\0᪈rrowĀlr᩼᪁eft;憺ight;憻ʀRSacd᪒᪔᪖᪚᪟»ཇ;擈st;抛irc;抚ash;抝nint;樐id;櫯cir;槂ubsĀ;u᪻᪼晣it»᪼ˬ᫇᫔᫺\0ᬊonĀ;eᫍᫎ䀺Ā;qÇÆɭ᫙\0\0᫢aĀ;t᫞᫟䀬;䁀ƀ;fl᫨᫩᫫戁îᅠeĀmx᫱᫶ent»᫩eóɍǧ᫾\0ᬇĀ;dኻᬂot;橭nôɆƀfryᬐᬔᬗ;쀀𝕔oäɔ脀©;sŕᬝr;愗Āaoᬥᬩrr;憵ss;朗Ācuᬲᬷr;쀀𝒸Ābpᬼ᭄Ā;eᭁᭂ櫏;櫑Ā;eᭉᭊ櫐;櫒dot;拯΀delprvw᭠᭬᭷ᮂᮬᯔ᯹arrĀlr᭨᭪;椸;椵ɰ᭲\0\0᭵r;拞c;拟arrĀ;p᭿ᮀ憶;椽̀;bcdosᮏᮐᮖᮡᮥᮨ截rcap;橈Āauᮛᮞp;橆p;橊ot;抍r;橅;쀀∪︀Ȁalrv᮵ᮿᯞᯣrrĀ;mᮼᮽ憷;椼yƀevwᯇᯔᯘqɰᯎ\0\0ᯒreã᭳uã᭵ee;拎edge;拏en耻¤䂤earrowĀlrᯮ᯳eft»ᮀight»ᮽeäᯝĀciᰁᰇoninôǷnt;戱lcty;挭ঀAHabcdefhijlorstuwz᰸᰻᰿ᱝᱩᱵᲊᲞᲬᲷ᳻᳿ᴍᵻᶑᶫᶻ᷆᷍rò΁ar;楥Ȁglrs᱈ᱍ᱒᱔ger;怠eth;愸òᄳhĀ;vᱚᱛ怐»ऊūᱡᱧarow;椏aã̕Āayᱮᱳron;䄏;䐴ƀ;ao̲ᱼᲄĀgrʿᲁr;懊tseq;橷ƀglmᲑᲔᲘ耻°䂰ta;䎴ptyv;榱ĀirᲣᲨsht;楿;쀀𝔡arĀlrᲳᲵ»ࣜ»သʀaegsv᳂͸᳖᳜᳠mƀ;oș᳊᳔ndĀ;ș᳑uit;晦amma;䏝in;拲ƀ;io᳧᳨᳸䃷de脀÷;o᳧ᳰntimes;拇nø᳷cy;䑒cɯᴆ\0\0ᴊrn;挞op;挍ʀlptuwᴘᴝᴢᵉᵕlar;䀤f;쀀𝕕ʀ;emps̋ᴭᴷᴽᵂqĀ;d͒ᴳot;扑inus;戸lus;戔quare;抡blebarwedgåúnƀadhᄮᵝᵧownarrowóᲃarpoonĀlrᵲᵶefôᲴighôᲶŢᵿᶅkaro÷གɯᶊ\0\0ᶎrn;挟op;挌ƀcotᶘᶣᶦĀryᶝᶡ;쀀𝒹;䑕l;槶rok;䄑Ādrᶰᶴot;拱iĀ;fᶺ᠖斿Āah᷀᷃ròЩaòྦangle;榦Āci᷒ᷕy;䑟grarr;柿ऀDacdefglmnopqrstuxḁḉḙḸոḼṉṡṾấắẽỡἪἷὄ὎὚ĀDoḆᴴoôᲉĀcsḎḔute耻é䃩ter;橮ȀaioyḢḧḱḶron;䄛rĀ;cḭḮ扖耻ê䃪lon;払;䑍ot;䄗ĀDrṁṅot;扒;쀀𝔢ƀ;rsṐṑṗ檚ave耻è䃨Ā;dṜṝ檖ot;檘Ȁ;ilsṪṫṲṴ檙nters;揧;愓Ā;dṹṺ檕ot;檗ƀapsẅẉẗcr;䄓tyƀ;svẒẓẕ戅et»ẓpĀ1;ẝẤijạả;怄;怅怃ĀgsẪẬ;䅋p;怂ĀgpẴẸon;䄙f;쀀𝕖ƀalsỄỎỒrĀ;sỊị拕l;槣us;橱iƀ;lvỚớở䎵on»ớ;䏵ȀcsuvỪỳἋἣĀioữḱrc»Ḯɩỹ\0\0ỻíՈantĀglἂἆtr»ṝess»Ṻƀaeiἒ἖Ἒls;䀽st;扟vĀ;DȵἠD;橸parsl;槥ĀDaἯἳot;打rr;楱ƀcdiἾὁỸr;愯oô͒ĀahὉὋ;䎷耻ð䃰Āmrὓὗl耻ë䃫o;悬ƀcipὡὤὧl;䀡sôծĀeoὬὴctatioîՙnentialåչৡᾒ\0ᾞ\0ᾡᾧ\0\0ῆῌ\0ΐ\0ῦῪ \0 ⁚llingdotseñṄy;䑄male;晀ƀilrᾭᾳ῁lig;耀ffiɩᾹ\0\0᾽g;耀ffig;耀ffl;쀀𝔣lig;耀filig;쀀fjƀaltῙ῜ῡt;晭ig;耀flns;斱of;䆒ǰ΅\0ῳf;쀀𝕗ĀakֿῷĀ;vῼ´拔;櫙artint;樍Āao‌⁕Ācs‑⁒ႉ‸⁅⁈\0⁐β•‥‧‪‬\0‮耻½䂽;慓耻¼䂼;慕;慙;慛Ƴ‴\0‶;慔;慖ʴ‾⁁\0\0⁃耻¾䂾;慗;慜5;慘ƶ⁌\0⁎;慚;慝8;慞l;恄wn;挢cr;쀀𝒻ࢀEabcdefgijlnorstv₂₉₟₥₰₴⃰⃵⃺⃿℃ℒℸ̗ℾ⅒↞Ā;lٍ₇;檌ƀcmpₐₕ₝ute;䇵maĀ;dₜ᳚䎳;檆reve;䄟Āiy₪₮rc;䄝;䐳ot;䄡Ȁ;lqsؾق₽⃉ƀ;qsؾٌ⃄lanô٥Ȁ;cdl٥⃒⃥⃕c;檩otĀ;o⃜⃝檀Ā;l⃢⃣檂;檄Ā;e⃪⃭쀀⋛︀s;檔r;쀀𝔤Ā;gٳ؛mel;愷cy;䑓Ȁ;Eajٚℌℎℐ;檒;檥;檤ȀEaesℛℝ℩ℴ;扩pĀ;p℣ℤ檊rox»ℤĀ;q℮ℯ檈Ā;q℮ℛim;拧pf;쀀𝕘Āci⅃ⅆr;愊mƀ;el٫ⅎ⅐;檎;檐茀>;cdlqr׮ⅠⅪⅮⅳⅹĀciⅥⅧ;檧r;橺ot;拗Par;榕uest;橼ʀadelsↄⅪ←ٖ↛ǰ↉\0↎proø₞r;楸qĀlqؿ↖lesó₈ií٫Āen↣↭rtneqq;쀀≩︀Å↪ԀAabcefkosy⇄⇇⇱⇵⇺∘∝∯≨≽ròΠȀilmr⇐⇔⇗⇛rsðᒄf»․ilôکĀdr⇠⇤cy;䑊ƀ;cwࣴ⇫⇯ir;楈;憭ar;意irc;䄥ƀalr∁∎∓rtsĀ;u∉∊晥it»∊lip;怦con;抹r;쀀𝔥sĀew∣∩arow;椥arow;椦ʀamopr∺∾≃≞≣rr;懿tht;戻kĀlr≉≓eftarrow;憩ightarrow;憪f;쀀𝕙bar;怕ƀclt≯≴≸r;쀀𝒽asè⇴rok;䄧Ābp⊂⊇ull;恃hen»ᱛૡ⊣\0⊪\0⊸⋅⋎\0⋕⋳\0\0⋸⌢⍧⍢⍿\0⎆⎪⎴cute耻í䃭ƀ;iyݱ⊰⊵rc耻î䃮;䐸Ācx⊼⊿y;䐵cl耻¡䂡ĀfrΟ⋉;쀀𝔦rave耻ì䃬Ȁ;inoܾ⋝⋩⋮Āin⋢⋦nt;樌t;戭fin;槜ta;愩lig;䄳ƀaop⋾⌚⌝ƀcgt⌅⌈⌗r;䄫ƀelpܟ⌏⌓inåގarôܠh;䄱f;抷ed;䆵ʀ;cfotӴ⌬⌱⌽⍁are;愅inĀ;t⌸⌹戞ie;槝doô⌙ʀ;celpݗ⍌⍐⍛⍡al;抺Āgr⍕⍙eróᕣã⍍arhk;樗rod;樼Ȁcgpt⍯⍲⍶⍻y;䑑on;䄯f;쀀𝕚a;䎹uest耻¿䂿Āci⎊⎏r;쀀𝒾nʀ;EdsvӴ⎛⎝⎡ӳ;拹ot;拵Ā;v⎦⎧拴;拳Ā;iݷ⎮lde;䄩ǫ⎸\0⎼cy;䑖l耻ï䃯̀cfmosu⏌⏗⏜⏡⏧⏵Āiy⏑⏕rc;䄵;䐹r;쀀𝔧ath;䈷pf;쀀𝕛ǣ⏬\0⏱r;쀀𝒿rcy;䑘kcy;䑔Ѐacfghjos␋␖␢␧␭␱␵␻ppaĀ;v␓␔䎺;䏰Āey␛␠dil;䄷;䐺r;쀀𝔨reen;䄸cy;䑅cy;䑜pf;쀀𝕜cr;쀀𝓀஀ABEHabcdefghjlmnoprstuv⑰⒁⒆⒍⒑┎┽╚▀♎♞♥♹♽⚚⚲⛘❝❨➋⟀⠁⠒ƀart⑷⑺⑼rò৆òΕail;椛arr;椎Ā;gঔ⒋;檋ar;楢ॣ⒥\0⒪\0⒱\0\0\0\0\0⒵Ⓔ\0ⓆⓈⓍ\0⓹ute;䄺mptyv;榴raîࡌbda;䎻gƀ;dlࢎⓁⓃ;榑åࢎ;檅uo耻«䂫rЀ;bfhlpst࢙ⓞⓦⓩ⓫⓮⓱⓵Ā;f࢝ⓣs;椟s;椝ë≒p;憫l;椹im;楳l;憢ƀ;ae⓿─┄檫il;椙Ā;s┉┊檭;쀀⪭︀ƀabr┕┙┝rr;椌rk;杲Āak┢┬cĀek┨┪;䁻;䁛Āes┱┳;榋lĀdu┹┻;榏;榍Ȁaeuy╆╋╖╘ron;䄾Ādi═╔il;䄼ìࢰâ┩;䐻Ȁcqrs╣╦╭╽a;椶uoĀ;rนᝆĀdu╲╷har;楧shar;楋h;憲ʀ;fgqs▋▌উ◳◿扤tʀahlrt▘▤▷◂◨rrowĀ;t࢙□aé⓶arpoonĀdu▯▴own»њp»०eftarrows;懇ightƀahs◍◖◞rrowĀ;sࣴࢧarpoonó྘quigarro÷⇰hreetimes;拋ƀ;qs▋ও◺lanôবʀ;cdgsব☊☍☝☨c;檨otĀ;o☔☕橿Ā;r☚☛檁;檃Ā;e☢☥쀀⋚︀s;檓ʀadegs☳☹☽♉♋pproøⓆot;拖qĀgq♃♅ôউgtò⒌ôছiíলƀilr♕࣡♚sht;楼;쀀𝔩Ā;Eজ♣;檑š♩♶rĀdu▲♮Ā;l॥♳;楪lk;斄cy;䑙ʀ;achtੈ⚈⚋⚑⚖rò◁orneòᴈard;楫ri;旺Āio⚟⚤dot;䅀ustĀ;a⚬⚭掰che»⚭ȀEaes⚻⚽⛉⛔;扨pĀ;p⛃⛄檉rox»⛄Ā;q⛎⛏檇Ā;q⛎⚻im;拦Ѐabnoptwz⛩⛴⛷✚✯❁❇❐Ānr⛮⛱g;柬r;懽rëࣁgƀlmr⛿✍✔eftĀar০✇ightá৲apsto;柼ightá৽parrowĀlr✥✩efô⓭ight;憬ƀafl✶✹✽r;榅;쀀𝕝us;樭imes;樴š❋❏st;戗áፎƀ;ef❗❘᠀旊nge»❘arĀ;l❤❥䀨t;榓ʀachmt❳❶❼➅➇ròࢨorneòᶌarĀ;d྘➃;業;怎ri;抿̀achiqt➘➝ੀ➢➮➻quo;怹r;쀀𝓁mƀ;egল➪➬;檍;檏Ābu┪➳oĀ;rฟ➹;怚rok;䅂萀<;cdhilqrࠫ⟒☹⟜⟠⟥⟪⟰Āci⟗⟙;檦r;橹reå◲mes;拉arr;楶uest;橻ĀPi⟵⟹ar;榖ƀ;ef⠀भ᠛旃rĀdu⠇⠍shar;楊har;楦Āen⠗⠡rtneqq;쀀≨︀Å⠞܀Dacdefhilnopsu⡀⡅⢂⢎⢓⢠⢥⢨⣚⣢⣤ઃ⣳⤂Dot;戺Ȁclpr⡎⡒⡣⡽r耻¯䂯Āet⡗⡙;時Ā;e⡞⡟朠se»⡟Ā;sျ⡨toȀ;dluျ⡳⡷⡻owîҌefôएðᏑker;斮Āoy⢇⢌mma;権;䐼ash;怔asuredangle»ᘦr;쀀𝔪o;愧ƀcdn⢯⢴⣉ro耻µ䂵Ȁ;acdᑤ⢽⣀⣄sôᚧir;櫰ot肻·Ƶusƀ;bd⣒ᤃ⣓戒Ā;uᴼ⣘;横ţ⣞⣡p;櫛ò−ðઁĀdp⣩⣮els;抧f;쀀𝕞Āct⣸⣽r;쀀𝓂pos»ᖝƀ;lm⤉⤊⤍䎼timap;抸ఀGLRVabcdefghijlmoprstuvw⥂⥓⥾⦉⦘⧚⧩⨕⨚⩘⩝⪃⪕⪤⪨⬄⬇⭄⭿⮮ⰴⱧⱼ⳩Āgt⥇⥋;쀀⋙̸Ā;v⥐௏쀀≫⃒ƀelt⥚⥲⥶ftĀar⥡⥧rrow;懍ightarrow;懎;쀀⋘̸Ā;v⥻ే쀀≪⃒ightarrow;懏ĀDd⦎⦓ash;抯ash;抮ʀbcnpt⦣⦧⦬⦱⧌la»˞ute;䅄g;쀀∠⃒ʀ;Eiop඄⦼⧀⧅⧈;쀀⩰̸d;쀀≋̸s;䅉roø඄urĀ;a⧓⧔普lĀ;s⧓ସdz⧟\0⧣p肻\xA0ଷmpĀ;e௹ఀʀaeouy⧴⧾⨃⨐⨓ǰ⧹\0⧻;橃on;䅈dil;䅆ngĀ;dൾ⨊ot;쀀⩭̸p;橂;䐽ash;怓΀;Aadqsxஒ⨩⨭⨻⩁⩅⩐rr;懗rĀhr⨳⨶k;椤Ā;oᏲᏰot;쀀≐̸uiöୣĀei⩊⩎ar;椨í஘istĀ;s஠டr;쀀𝔫ȀEest௅⩦⩹⩼ƀ;qs஼⩭௡ƀ;qs஼௅⩴lanô௢ií௪Ā;rஶ⪁»ஷƀAap⪊⪍⪑rò⥱rr;憮ar;櫲ƀ;svྍ⪜ྌĀ;d⪡⪢拼;拺cy;䑚΀AEadest⪷⪺⪾⫂⫅⫶⫹rò⥦;쀀≦̸rr;憚r;急Ȁ;fqs఻⫎⫣⫯tĀar⫔⫙rro÷⫁ightarro÷⪐ƀ;qs఻⪺⫪lanôౕĀ;sౕ⫴»శiíౝĀ;rవ⫾iĀ;eచథiäඐĀpt⬌⬑f;쀀𝕟膀¬;in⬙⬚⬶䂬nȀ;Edvஉ⬤⬨⬮;쀀⋹̸ot;쀀⋵̸ǡஉ⬳⬵;拷;拶iĀ;vಸ⬼ǡಸ⭁⭃;拾;拽ƀaor⭋⭣⭩rȀ;ast୻⭕⭚⭟lleì୻l;쀀⫽⃥;쀀∂̸lint;樔ƀ;ceಒ⭰⭳uåಥĀ;cಘ⭸Ā;eಒ⭽ñಘȀAait⮈⮋⮝⮧rò⦈rrƀ;cw⮔⮕⮙憛;쀀⤳̸;쀀↝̸ghtarrow»⮕riĀ;eೋೖ΀chimpqu⮽⯍⯙⬄୸⯤⯯Ȁ;cerല⯆ഷ⯉uå൅;쀀𝓃ortɭ⬅\0\0⯖ará⭖mĀ;e൮⯟Ā;q൴൳suĀbp⯫⯭å೸åഋƀbcp⯶ⰑⰙȀ;Ees⯿ⰀഢⰄ抄;쀀⫅̸etĀ;eഛⰋqĀ;qണⰀcĀ;eലⰗñസȀ;EesⰢⰣൟⰧ抅;쀀⫆̸etĀ;e൘ⰮqĀ;qൠⰣȀgilrⰽⰿⱅⱇìௗlde耻ñ䃱çృiangleĀlrⱒⱜeftĀ;eచⱚñదightĀ;eೋⱥñ೗Ā;mⱬⱭ䎽ƀ;esⱴⱵⱹ䀣ro;愖p;怇ҀDHadgilrsⲏⲔⲙⲞⲣⲰⲶⳓⳣash;抭arr;椄p;쀀≍⃒ash;抬ĀetⲨⲬ;쀀≥⃒;쀀>⃒nfin;槞ƀAetⲽⳁⳅrr;椂;쀀≤⃒Ā;rⳊⳍ쀀<⃒ie;쀀⊴⃒ĀAtⳘⳜrr;椃rie;쀀⊵⃒im;쀀∼⃒ƀAan⳰⳴ⴂrr;懖rĀhr⳺⳽k;椣Ā;oᏧᏥear;椧ቓ᪕\0\0\0\0\0\0\0\0\0\0\0\0\0ⴭ\0ⴸⵈⵠⵥ⵲ⶄᬇ\0\0ⶍⶫ\0ⷈⷎ\0ⷜ⸙⸫⸾⹃Ācsⴱ᪗ute耻ó䃳ĀiyⴼⵅrĀ;c᪞ⵂ耻ô䃴;䐾ʀabios᪠ⵒⵗLjⵚlac;䅑v;樸old;榼lig;䅓Ācr⵩⵭ir;榿;쀀𝔬ͯ⵹\0\0⵼\0ⶂn;䋛ave耻ò䃲;槁Ābmⶈ෴ar;榵Ȁacitⶕ⶘ⶥⶨrò᪀Āir⶝ⶠr;榾oss;榻nå๒;槀ƀaeiⶱⶵⶹcr;䅍ga;䏉ƀcdnⷀⷅǍron;䎿;榶pf;쀀𝕠ƀaelⷔ⷗ǒr;榷rp;榹΀;adiosvⷪⷫⷮ⸈⸍⸐⸖戨rò᪆Ȁ;efmⷷⷸ⸂⸅橝rĀ;oⷾⷿ愴f»ⷿ耻ª䂪耻º䂺gof;抶r;橖lope;橗;橛ƀclo⸟⸡⸧ò⸁ash耻ø䃸l;折iŬⸯ⸴de耻õ䃵esĀ;aǛ⸺s;樶ml耻ö䃶bar;挽ૡ⹞\0⹽\0⺀⺝\0⺢⺹\0\0⻋ຜ\0⼓\0\0⼫⾼\0⿈rȀ;astЃ⹧⹲຅脀¶;l⹭⹮䂶leìЃɩ⹸\0\0⹻m;櫳;櫽y;䐿rʀcimpt⺋⺏⺓ᡥ⺗nt;䀥od;䀮il;怰enk;怱r;쀀𝔭ƀimo⺨⺰⺴Ā;v⺭⺮䏆;䏕maô੶ne;明ƀ;tv⺿⻀⻈䏀chfork»´;䏖Āau⻏⻟nĀck⻕⻝kĀ;h⇴⻛;愎ö⇴sҀ;abcdemst⻳⻴ᤈ⻹⻽⼄⼆⼊⼎䀫cir;樣ir;樢Āouᵀ⼂;樥;橲n肻±ຝim;樦wo;樧ƀipu⼙⼠⼥ntint;樕f;쀀𝕡nd耻£䂣Ԁ;Eaceinosu່⼿⽁⽄⽇⾁⾉⾒⽾⾶;檳p;檷uå໙Ā;c໎⽌̀;acens່⽙⽟⽦⽨⽾pproø⽃urlyeñ໙ñ໎ƀaes⽯⽶⽺pprox;檹qq;檵im;拨iíໟmeĀ;s⾈ຮ怲ƀEas⽸⾐⽺ð⽵ƀdfp໬⾙⾯ƀals⾠⾥⾪lar;挮ine;挒urf;挓Ā;t໻⾴ï໻rel;抰Āci⿀⿅r;쀀𝓅;䏈ncsp;怈̀fiopsu⿚⋢⿟⿥⿫⿱r;쀀𝔮pf;쀀𝕢rime;恗cr;쀀𝓆ƀaeo⿸〉〓tĀei⿾々rnionóڰnt;樖stĀ;e【】䀿ñἙô༔઀ABHabcdefhilmnoprstux぀けさすムㄎㄫㅇㅢㅲㆎ㈆㈕㈤㈩㉘㉮㉲㊐㊰㊷ƀartぇおがròႳòϝail;検aròᱥar;楤΀cdenqrtとふへみわゔヌĀeuねぱ;쀀∽̱te;䅕iãᅮmptyv;榳gȀ;del࿑らるろ;榒;榥å࿑uo耻»䂻rր;abcfhlpstw࿜ガクシスゼゾダッデナp;極Ā;f࿠ゴs;椠;椳s;椞ë≝ð✮l;楅im;楴l;憣;憝Āaiパフil;椚oĀ;nホボ戶aló༞ƀabrョリヮrò៥rk;杳ĀakンヽcĀekヹ・;䁽;䁝Āes㄂㄄;榌lĀduㄊㄌ;榎;榐Ȁaeuyㄗㄜㄧㄩron;䅙Ādiㄡㄥil;䅗ì࿲âヺ;䑀Ȁclqsㄴㄷㄽㅄa;椷dhar;楩uoĀ;rȎȍh;憳ƀacgㅎㅟངlȀ;ipsླྀㅘㅛႜnåႻarôྩt;断ƀilrㅩဣㅮsht;楽;쀀𝔯ĀaoㅷㆆrĀduㅽㅿ»ѻĀ;l႑ㆄ;楬Ā;vㆋㆌ䏁;䏱ƀgns㆕ㇹㇼht̀ahlrstㆤㆰ㇂㇘㇤㇮rrowĀ;t࿜ㆭaéトarpoonĀduㆻㆿowîㅾp»႒eftĀah㇊㇐rrowó࿪arpoonóՑightarrows;應quigarro÷ニhreetimes;拌g;䋚ingdotseñἲƀahm㈍㈐㈓rò࿪aòՑ;怏oustĀ;a㈞㈟掱che»㈟mid;櫮Ȁabpt㈲㈽㉀㉒Ānr㈷㈺g;柭r;懾rëဃƀafl㉇㉊㉎r;榆;쀀𝕣us;樮imes;樵Āap㉝㉧rĀ;g㉣㉤䀩t;榔olint;樒arò㇣Ȁachq㉻㊀Ⴜ㊅quo;怺r;쀀𝓇Ābu・㊊oĀ;rȔȓƀhir㊗㊛㊠reåㇸmes;拊iȀ;efl㊪ၙᠡ㊫方tri;槎luhar;楨;愞ൡ㋕㋛㋟㌬㌸㍱\0㍺㎤\0\0㏬㏰\0㐨㑈㑚㒭㒱㓊㓱\0㘖\0\0㘳cute;䅛quï➺Ԁ;Eaceinpsyᇭ㋳㋵㋿㌂㌋㌏㌟㌦㌩;檴ǰ㋺\0㋼;檸on;䅡uåᇾĀ;dᇳ㌇il;䅟rc;䅝ƀEas㌖㌘㌛;檶p;檺im;择olint;樓iíሄ;䑁otƀ;be㌴ᵇ㌵担;橦΀Aacmstx㍆㍊㍗㍛㍞㍣㍭rr;懘rĀhr㍐㍒ë∨Ā;oਸ਼਴t耻§䂧i;䀻war;椩mĀin㍩ðnuóñt;朶rĀ;o㍶⁕쀀𝔰Ȁacoy㎂㎆㎑㎠rp;景Āhy㎋㎏cy;䑉;䑈rtɭ㎙\0\0㎜iäᑤaraì⹯耻­䂭Āgm㎨㎴maƀ;fv㎱㎲㎲䏃;䏂Ѐ;deglnprካ㏅㏉㏎㏖㏞㏡㏦ot;橪Ā;q኱ኰĀ;E㏓㏔檞;檠Ā;E㏛㏜檝;檟e;扆lus;樤arr;楲aròᄽȀaeit㏸㐈㐏㐗Āls㏽㐄lsetmé㍪hp;樳parsl;槤Ādlᑣ㐔e;挣Ā;e㐜㐝檪Ā;s㐢㐣檬;쀀⪬︀ƀflp㐮㐳㑂tcy;䑌Ā;b㐸㐹䀯Ā;a㐾㐿槄r;挿f;쀀𝕤aĀdr㑍ЂesĀ;u㑔㑕晠it»㑕ƀcsu㑠㑹㒟Āau㑥㑯pĀ;sᆈ㑫;쀀⊓︀pĀ;sᆴ㑵;쀀⊔︀uĀbp㑿㒏ƀ;esᆗᆜ㒆etĀ;eᆗ㒍ñᆝƀ;esᆨᆭ㒖etĀ;eᆨ㒝ñᆮƀ;afᅻ㒦ְrť㒫ֱ»ᅼaròᅈȀcemt㒹㒾㓂㓅r;쀀𝓈tmîñiì㐕aræᆾĀar㓎㓕rĀ;f㓔ឿ昆Āan㓚㓭ightĀep㓣㓪psiloîỠhé⺯s»⡒ʀbcmnp㓻㕞ሉ㖋㖎Ҁ;Edemnprs㔎㔏㔑㔕㔞㔣㔬㔱㔶抂;櫅ot;檽Ā;dᇚ㔚ot;櫃ult;櫁ĀEe㔨㔪;櫋;把lus;檿arr;楹ƀeiu㔽㕒㕕tƀ;en㔎㕅㕋qĀ;qᇚ㔏eqĀ;q㔫㔨m;櫇Ābp㕚㕜;櫕;櫓c̀;acensᇭ㕬㕲㕹㕻㌦pproø㋺urlyeñᇾñᇳƀaes㖂㖈㌛pproø㌚qñ㌗g;晪ڀ123;Edehlmnps㖩㖬㖯ሜ㖲㖴㗀㗉㗕㗚㗟㗨㗭耻¹䂹耻²䂲耻³䂳;櫆Āos㖹㖼t;檾ub;櫘Ā;dሢ㗅ot;櫄sĀou㗏㗒l;柉b;櫗arr;楻ult;櫂ĀEe㗤㗦;櫌;抋lus;櫀ƀeiu㗴㘉㘌tƀ;enሜ㗼㘂qĀ;qሢ㖲eqĀ;q㗧㗤m;櫈Ābp㘑㘓;櫔;櫖ƀAan㘜㘠㘭rr;懙rĀhr㘦㘨ë∮Ā;oਫ਩war;椪lig耻ß䃟௡㙑㙝㙠ዎ㙳㙹\0㙾㛂\0\0\0\0\0㛛㜃\0㜉㝬\0\0\0㞇ɲ㙖\0\0㙛get;挖;䏄rë๟ƀaey㙦㙫㙰ron;䅥dil;䅣;䑂lrec;挕r;쀀𝔱Ȁeiko㚆㚝㚵㚼Dz㚋\0㚑eĀ4fኄኁaƀ;sv㚘㚙㚛䎸ym;䏑Ācn㚢㚲kĀas㚨㚮pproø዁im»ኬsðኞĀas㚺㚮ð዁rn耻þ䃾Ǭ̟㛆⋧es膀×;bd㛏㛐㛘䃗Ā;aᤏ㛕r;樱;樰ƀeps㛡㛣㜀á⩍Ȁ;bcf҆㛬㛰㛴ot;挶ir;櫱Ā;o㛹㛼쀀𝕥rk;櫚á㍢rime;怴ƀaip㜏㜒㝤dåቈ΀adempst㜡㝍㝀㝑㝗㝜㝟ngleʀ;dlqr㜰㜱㜶㝀㝂斵own»ᶻeftĀ;e⠀㜾ñम;扜ightĀ;e㊪㝋ñၚot;旬inus;樺lus;樹b;槍ime;樻ezium;揢ƀcht㝲㝽㞁Āry㝷㝻;쀀𝓉;䑆cy;䑛rok;䅧Āio㞋㞎xô᝷headĀlr㞗㞠eftarro÷ࡏightarrow»ཝऀAHabcdfghlmoprstuw㟐㟓㟗㟤㟰㟼㠎㠜㠣㠴㡑㡝㡫㢩㣌㣒㣪㣶ròϭar;楣Ācr㟜㟢ute耻ú䃺òᅐrǣ㟪\0㟭y;䑞ve;䅭Āiy㟵㟺rc耻û䃻;䑃ƀabh㠃㠆㠋ròᎭlac;䅱aòᏃĀir㠓㠘sht;楾;쀀𝔲rave耻ù䃹š㠧㠱rĀlr㠬㠮»ॗ»ႃlk;斀Āct㠹㡍ɯ㠿\0\0㡊rnĀ;e㡅㡆挜r»㡆op;挏ri;旸Āal㡖㡚cr;䅫肻¨͉Āgp㡢㡦on;䅳f;쀀𝕦̀adhlsuᅋ㡸㡽፲㢑㢠ownáᎳarpoonĀlr㢈㢌efô㠭ighô㠯iƀ;hl㢙㢚㢜䏅»ᏺon»㢚parrows;懈ƀcit㢰㣄㣈ɯ㢶\0\0㣁rnĀ;e㢼㢽挝r»㢽op;挎ng;䅯ri;旹cr;쀀𝓊ƀdir㣙㣝㣢ot;拰lde;䅩iĀ;f㜰㣨»᠓Āam㣯㣲rò㢨l耻ü䃼angle;榧ހABDacdeflnoprsz㤜㤟㤩㤭㦵㦸㦽㧟㧤㧨㧳㧹㧽㨁㨠ròϷarĀ;v㤦㤧櫨;櫩asèϡĀnr㤲㤷grt;榜΀eknprst㓣㥆㥋㥒㥝㥤㦖appá␕othinçẖƀhir㓫⻈㥙opô⾵Ā;hᎷ㥢ïㆍĀiu㥩㥭gmá㎳Ābp㥲㦄setneqĀ;q㥽㦀쀀⊊︀;쀀⫋︀setneqĀ;q㦏㦒쀀⊋︀;쀀⫌︀Āhr㦛㦟etá㚜iangleĀlr㦪㦯eft»थight»ၑy;䐲ash»ံƀelr㧄㧒㧗ƀ;beⷪ㧋㧏ar;抻q;扚lip;拮Ābt㧜ᑨaòᑩr;쀀𝔳tré㦮suĀbp㧯㧱»ജ»൙pf;쀀𝕧roð໻tré㦴Ācu㨆㨋r;쀀𝓋Ābp㨐㨘nĀEe㦀㨖»㥾nĀEe㦒㨞»㦐igzag;榚΀cefoprs㨶㨻㩖㩛㩔㩡㩪irc;䅵Ādi㩀㩑Ābg㩅㩉ar;機eĀ;qᗺ㩏;扙erp;愘r;쀀𝔴pf;쀀𝕨Ā;eᑹ㩦atèᑹcr;쀀𝓌ૣណ㪇\0㪋\0㪐㪛\0\0㪝㪨㪫㪯\0\0㫃㫎\0㫘ៜ៟tré៑r;쀀𝔵ĀAa㪔㪗ròσrò৶;䎾ĀAa㪡㪤ròθrò৫að✓is;拻ƀdptឤ㪵㪾Āfl㪺ឩ;쀀𝕩imåឲĀAa㫇㫊ròώròਁĀcq㫒ីr;쀀𝓍Āpt៖㫜ré។Ѐacefiosu㫰㫽㬈㬌㬑㬕㬛㬡cĀuy㫶㫻te耻ý䃽;䑏Āiy㬂㬆rc;䅷;䑋n耻¥䂥r;쀀𝔶cy;䑗pf;쀀𝕪cr;쀀𝓎Ācm㬦㬩y;䑎l耻ÿ䃿Ԁacdefhiosw㭂㭈㭔㭘㭤㭩㭭㭴㭺㮀cute;䅺Āay㭍㭒ron;䅾;䐷ot;䅼Āet㭝㭡træᕟa;䎶r;쀀𝔷cy;䐶grarr;懝pf;쀀𝕫cr;쀀𝓏Ājn㮅㮇;怍j;怌`.split(``).map(e=>e.charCodeAt(0)))}));function Lbe(e){return e>=55296&&e<=57343||e>1114111?65533:Rbe.get(e)??e}var Rbe,zbe=s((()=>{Rbe=new Map([[0,65533],[128,8364],[130,8218],[131,402],[132,8222],[133,8230],[134,8224],[135,8225],[136,710],[137,8240],[138,352],[139,8249],[140,338],[142,381],[145,8216],[146,8217],[147,8220],[148,8221],[149,8226],[150,8211],[151,8212],[152,732],[153,8482],[154,353],[155,8250],[156,339],[158,382],[159,376]]),String.fromCodePoint}));function qp(e){return e>=Jp.ZERO&&e<=Jp.NINE}function Bbe(e){return e>=Jp.UPPER_A&&e<=Jp.UPPER_F||e>=Jp.LOWER_A&&e<=Jp.LOWER_F}function Vbe(e){return e>=Jp.UPPER_A&&e<=Jp.UPPER_Z||e>=Jp.LOWER_A&&e<=Jp.LOWER_Z||qp(e)}function Hbe(e){return e===Jp.EQUALS||Vbe(e)}function Ube(e,t,n,r){let i=(t&Yp.BRANCH_LENGTH)>>7,a=t&Yp.JUMP_TABLE;if(i===0)return a!==0&&r===a?n:-1;if(a){let t=r-a;return t<0||t>=i?-1:e[n+t]-1}let o=n,s=o+i-1;for(;o<=s;){let t=o+s>>>1,n=e[t];if(n<r)o=t+1;else if(n>r)s=t-1;else return e[t+i]}return-1}var Jp,Wbe,Yp,Xp,Zp,Gbe,Kbe=s((()=>{zbe(),Ibe(),(function(e){e[e.NUM=35]=`NUM`,e[e.SEMI=59]=`SEMI`,e[e.EQUALS=61]=`EQUALS`,e[e.ZERO=48]=`ZERO`,e[e.NINE=57]=`NINE`,e[e.LOWER_A=97]=`LOWER_A`,e[e.LOWER_F=102]=`LOWER_F`,e[e.LOWER_X=120]=`LOWER_X`,e[e.LOWER_Z=122]=`LOWER_Z`,e[e.UPPER_A=65]=`UPPER_A`,e[e.UPPER_F=70]=`UPPER_F`,e[e.UPPER_Z=90]=`UPPER_Z`})(Jp||={}),Wbe=32,(function(e){e[e.VALUE_LENGTH=49152]=`VALUE_LENGTH`,e[e.BRANCH_LENGTH=16256]=`BRANCH_LENGTH`,e[e.JUMP_TABLE=127]=`JUMP_TABLE`})(Yp||={}),(function(e){e[e.EntityStart=0]=`EntityStart`,e[e.NumericStart=1]=`NumericStart`,e[e.NumericDecimal=2]=`NumericDecimal`,e[e.NumericHex=3]=`NumericHex`,e[e.NamedEntity=4]=`NamedEntity`})(Xp||={}),(function(e){e[e.Legacy=0]=`Legacy`,e[e.Strict=1]=`Strict`,e[e.Attribute=2]=`Attribute`})(Zp||={}),Gbe=class{constructor(e,t,n){this.decodeTree=e,this.emitCodePoint=t,this.errors=n,this.state=Xp.EntityStart,this.consumed=1,this.result=0,this.treeIndex=0,this.excess=1,this.decodeMode=Zp.Strict}startEntity(e){this.decodeMode=e,this.state=Xp.EntityStart,this.result=0,this.treeIndex=0,this.excess=1,this.consumed=1}write(e,t){switch(this.state){case Xp.EntityStart:return e.charCodeAt(t)===Jp.NUM?(this.state=Xp.NumericStart,this.consumed+=1,this.stateNumericStart(e,t+1)):(this.state=Xp.NamedEntity,this.stateNamedEntity(e,t));case Xp.NumericStart:return this.stateNumericStart(e,t);case Xp.NumericDecimal:return this.stateNumericDecimal(e,t);case Xp.NumericHex:return this.stateNumericHex(e,t);case Xp.NamedEntity:return this.stateNamedEntity(e,t)}}stateNumericStart(e,t){return t>=e.length?-1:(e.charCodeAt(t)|Wbe)===Jp.LOWER_X?(this.state=Xp.NumericHex,this.consumed+=1,this.stateNumericHex(e,t+1)):(this.state=Xp.NumericDecimal,this.stateNumericDecimal(e,t))}addToNumericResult(e,t,n,r){if(t!==n){let i=n-t;this.result=this.result*r**+i+Number.parseInt(e.substr(t,i),r),this.consumed+=i}}stateNumericHex(e,t){let n=t;for(;t<e.length;){let r=e.charCodeAt(t);if(qp(r)||Bbe(r))t+=1;else return this.addToNumericResult(e,n,t,16),this.emitNumericEntity(r,3)}return this.addToNumericResult(e,n,t,16),-1}stateNumericDecimal(e,t){let n=t;for(;t<e.length;){let r=e.charCodeAt(t);if(qp(r))t+=1;else return this.addToNumericResult(e,n,t,10),this.emitNumericEntity(r,2)}return this.addToNumericResult(e,n,t,10),-1}emitNumericEntity(e,t){var n;if(this.consumed<=t)return(n=this.errors)==null||n.absenceOfDigitsInNumericCharacterReference(this.consumed),0;if(e===Jp.SEMI)this.consumed+=1;else if(this.decodeMode===Zp.Strict)return 0;return this.emitCodePoint(Lbe(this.result),this.consumed),this.errors&&(e!==Jp.SEMI&&this.errors.missingSemicolonAfterCharacterReference(),this.errors.validateNumericCharacterReference(this.result)),this.consumed}stateNamedEntity(e,t){let{decodeTree:n}=this,r=n[this.treeIndex],i=(r&Yp.VALUE_LENGTH)>>14;for(;t<e.length;t++,this.excess++){let a=e.charCodeAt(t);if(this.treeIndex=Ube(n,r,this.treeIndex+Math.max(1,i),a),this.treeIndex<0)return this.result===0||this.decodeMode===Zp.Attribute&&(i===0||Hbe(a))?0:this.emitNotTerminatedNamedEntity();if(r=n[this.treeIndex],i=(r&Yp.VALUE_LENGTH)>>14,i!==0){if(a===Jp.SEMI)return this.emitNamedEntityData(this.treeIndex,i,this.consumed+this.excess);this.decodeMode!==Zp.Strict&&(this.result=this.treeIndex,this.consumed+=this.excess,this.excess=0)}}return-1}emitNotTerminatedNamedEntity(){var e;let{result:t,decodeTree:n}=this,r=(n[t]&Yp.VALUE_LENGTH)>>14;return this.emitNamedEntityData(t,r,this.consumed),(e=this.errors)==null||e.missingSemicolonAfterCharacterReference(),this.consumed}emitNamedEntityData(e,t,n){let{decodeTree:r}=this;return this.emitCodePoint(t===1?r[e]&~Yp.VALUE_LENGTH:r[e+1],n),t===3&&this.emitCodePoint(r[e+2],n),n}end(){var e;switch(this.state){case Xp.NamedEntity:return this.result!==0&&(this.decodeMode!==Zp.Attribute||this.result===this.treeIndex)?this.emitNotTerminatedNamedEntity():0;case Xp.NumericDecimal:return this.emitNumericEntity(0,2);case Xp.NumericHex:return this.emitNumericEntity(0,3);case Xp.NumericStart:return(e=this.errors)==null||e.absenceOfDigitsInNumericCharacterReference(this.consumed),0;case Xp.EntityStart:return 0}}}}));function Qp(e){return qbe.get(e)??J.UNKNOWN}var $p,em,tm,q,J,qbe,nm,Jbe,rm,im=s((()=>{(function(e){e.HTML=`http://www.w3.org/1999/xhtml`,e.MATHML=`http://www.w3.org/1998/Math/MathML`,e.SVG=`http://www.w3.org/2000/svg`,e.XLINK=`http://www.w3.org/1999/xlink`,e.XML=`http://www.w3.org/XML/1998/namespace`,e.XMLNS=`http://www.w3.org/2000/xmlns/`})($p||={}),(function(e){e.TYPE=`type`,e.ACTION=`action`,e.ENCODING=`encoding`,e.PROMPT=`prompt`,e.NAME=`name`,e.COLOR=`color`,e.FACE=`face`,e.SIZE=`size`})(em||={}),(function(e){e.NO_QUIRKS=`no-quirks`,e.QUIRKS=`quirks`,e.LIMITED_QUIRKS=`limited-quirks`})(tm||={}),(function(e){e.A=`a`,e.ADDRESS=`address`,e.ANNOTATION_XML=`annotation-xml`,e.APPLET=`applet`,e.AREA=`area`,e.ARTICLE=`article`,e.ASIDE=`aside`,e.B=`b`,e.BASE=`base`,e.BASEFONT=`basefont`,e.BGSOUND=`bgsound`,e.BIG=`big`,e.BLOCKQUOTE=`blockquote`,e.BODY=`body`,e.BR=`br`,e.BUTTON=`button`,e.CAPTION=`caption`,e.CENTER=`center`,e.CODE=`code`,e.COL=`col`,e.COLGROUP=`colgroup`,e.DD=`dd`,e.DESC=`desc`,e.DETAILS=`details`,e.DIALOG=`dialog`,e.DIR=`dir`,e.DIV=`div`,e.DL=`dl`,e.DT=`dt`,e.EM=`em`,e.EMBED=`embed`,e.FIELDSET=`fieldset`,e.FIGCAPTION=`figcaption`,e.FIGURE=`figure`,e.FONT=`font`,e.FOOTER=`footer`,e.FOREIGN_OBJECT=`foreignObject`,e.FORM=`form`,e.FRAME=`frame`,e.FRAMESET=`frameset`,e.H1=`h1`,e.H2=`h2`,e.H3=`h3`,e.H4=`h4`,e.H5=`h5`,e.H6=`h6`,e.HEAD=`head`,e.HEADER=`header`,e.HGROUP=`hgroup`,e.HR=`hr`,e.HTML=`html`,e.I=`i`,e.IMG=`img`,e.IMAGE=`image`,e.INPUT=`input`,e.IFRAME=`iframe`,e.KEYGEN=`keygen`,e.LABEL=`label`,e.LI=`li`,e.LINK=`link`,e.LISTING=`listing`,e.MAIN=`main`,e.MALIGNMARK=`malignmark`,e.MARQUEE=`marquee`,e.MATH=`math`,e.MENU=`menu`,e.META=`meta`,e.MGLYPH=`mglyph`,e.MI=`mi`,e.MO=`mo`,e.MN=`mn`,e.MS=`ms`,e.MTEXT=`mtext`,e.NAV=`nav`,e.NOBR=`nobr`,e.NOFRAMES=`noframes`,e.NOEMBED=`noembed`,e.NOSCRIPT=`noscript`,e.OBJECT=`object`,e.OL=`ol`,e.OPTGROUP=`optgroup`,e.OPTION=`option`,e.P=`p`,e.PARAM=`param`,e.PLAINTEXT=`plaintext`,e.PRE=`pre`,e.RB=`rb`,e.RP=`rp`,e.RT=`rt`,e.RTC=`rtc`,e.RUBY=`ruby`,e.S=`s`,e.SCRIPT=`script`,e.SEARCH=`search`,e.SECTION=`section`,e.SELECT=`select`,e.SOURCE=`source`,e.SMALL=`small`,e.SPAN=`span`,e.STRIKE=`strike`,e.STRONG=`strong`,e.STYLE=`style`,e.SUB=`sub`,e.SUMMARY=`summary`,e.SUP=`sup`,e.TABLE=`table`,e.TBODY=`tbody`,e.TEMPLATE=`template`,e.TEXTAREA=`textarea`,e.TFOOT=`tfoot`,e.TD=`td`,e.TH=`th`,e.THEAD=`thead`,e.TITLE=`title`,e.TR=`tr`,e.TRACK=`track`,e.TT=`tt`,e.U=`u`,e.UL=`ul`,e.SVG=`svg`,e.VAR=`var`,e.WBR=`wbr`,e.XMP=`xmp`})(q||={}),(function(e){e[e.UNKNOWN=0]=`UNKNOWN`,e[e.A=1]=`A`,e[e.ADDRESS=2]=`ADDRESS`,e[e.ANNOTATION_XML=3]=`ANNOTATION_XML`,e[e.APPLET=4]=`APPLET`,e[e.AREA=5]=`AREA`,e[e.ARTICLE=6]=`ARTICLE`,e[e.ASIDE=7]=`ASIDE`,e[e.B=8]=`B`,e[e.BASE=9]=`BASE`,e[e.BASEFONT=10]=`BASEFONT`,e[e.BGSOUND=11]=`BGSOUND`,e[e.BIG=12]=`BIG`,e[e.BLOCKQUOTE=13]=`BLOCKQUOTE`,e[e.BODY=14]=`BODY`,e[e.BR=15]=`BR`,e[e.BUTTON=16]=`BUTTON`,e[e.CAPTION=17]=`CAPTION`,e[e.CENTER=18]=`CENTER`,e[e.CODE=19]=`CODE`,e[e.COL=20]=`COL`,e[e.COLGROUP=21]=`COLGROUP`,e[e.DD=22]=`DD`,e[e.DESC=23]=`DESC`,e[e.DETAILS=24]=`DETAILS`,e[e.DIALOG=25]=`DIALOG`,e[e.DIR=26]=`DIR`,e[e.DIV=27]=`DIV`,e[e.DL=28]=`DL`,e[e.DT=29]=`DT`,e[e.EM=30]=`EM`,e[e.EMBED=31]=`EMBED`,e[e.FIELDSET=32]=`FIELDSET`,e[e.FIGCAPTION=33]=`FIGCAPTION`,e[e.FIGURE=34]=`FIGURE`,e[e.FONT=35]=`FONT`,e[e.FOOTER=36]=`FOOTER`,e[e.FOREIGN_OBJECT=37]=`FOREIGN_OBJECT`,e[e.FORM=38]=`FORM`,e[e.FRAME=39]=`FRAME`,e[e.FRAMESET=40]=`FRAMESET`,e[e.H1=41]=`H1`,e[e.H2=42]=`H2`,e[e.H3=43]=`H3`,e[e.H4=44]=`H4`,e[e.H5=45]=`H5`,e[e.H6=46]=`H6`,e[e.HEAD=47]=`HEAD`,e[e.HEADER=48]=`HEADER`,e[e.HGROUP=49]=`HGROUP`,e[e.HR=50]=`HR`,e[e.HTML=51]=`HTML`,e[e.I=52]=`I`,e[e.IMG=53]=`IMG`,e[e.IMAGE=54]=`IMAGE`,e[e.INPUT=55]=`INPUT`,e[e.IFRAME=56]=`IFRAME`,e[e.KEYGEN=57]=`KEYGEN`,e[e.LABEL=58]=`LABEL`,e[e.LI=59]=`LI`,e[e.LINK=60]=`LINK`,e[e.LISTING=61]=`LISTING`,e[e.MAIN=62]=`MAIN`,e[e.MALIGNMARK=63]=`MALIGNMARK`,e[e.MARQUEE=64]=`MARQUEE`,e[e.MATH=65]=`MATH`,e[e.MENU=66]=`MENU`,e[e.META=67]=`META`,e[e.MGLYPH=68]=`MGLYPH`,e[e.MI=69]=`MI`,e[e.MO=70]=`MO`,e[e.MN=71]=`MN`,e[e.MS=72]=`MS`,e[e.MTEXT=73]=`MTEXT`,e[e.NAV=74]=`NAV`,e[e.NOBR=75]=`NOBR`,e[e.NOFRAMES=76]=`NOFRAMES`,e[e.NOEMBED=77]=`NOEMBED`,e[e.NOSCRIPT=78]=`NOSCRIPT`,e[e.OBJECT=79]=`OBJECT`,e[e.OL=80]=`OL`,e[e.OPTGROUP=81]=`OPTGROUP`,e[e.OPTION=82]=`OPTION`,e[e.P=83]=`P`,e[e.PARAM=84]=`PARAM`,e[e.PLAINTEXT=85]=`PLAINTEXT`,e[e.PRE=86]=`PRE`,e[e.RB=87]=`RB`,e[e.RP=88]=`RP`,e[e.RT=89]=`RT`,e[e.RTC=90]=`RTC`,e[e.RUBY=91]=`RUBY`,e[e.S=92]=`S`,e[e.SCRIPT=93]=`SCRIPT`,e[e.SEARCH=94]=`SEARCH`,e[e.SECTION=95]=`SECTION`,e[e.SELECT=96]=`SELECT`,e[e.SOURCE=97]=`SOURCE`,e[e.SMALL=98]=`SMALL`,e[e.SPAN=99]=`SPAN`,e[e.STRIKE=100]=`STRIKE`,e[e.STRONG=101]=`STRONG`,e[e.STYLE=102]=`STYLE`,e[e.SUB=103]=`SUB`,e[e.SUMMARY=104]=`SUMMARY`,e[e.SUP=105]=`SUP`,e[e.TABLE=106]=`TABLE`,e[e.TBODY=107]=`TBODY`,e[e.TEMPLATE=108]=`TEMPLATE`,e[e.TEXTAREA=109]=`TEXTAREA`,e[e.TFOOT=110]=`TFOOT`,e[e.TD=111]=`TD`,e[e.TH=112]=`TH`,e[e.THEAD=113]=`THEAD`,e[e.TITLE=114]=`TITLE`,e[e.TR=115]=`TR`,e[e.TRACK=116]=`TRACK`,e[e.TT=117]=`TT`,e[e.U=118]=`U`,e[e.UL=119]=`UL`,e[e.SVG=120]=`SVG`,e[e.VAR=121]=`VAR`,e[e.WBR=122]=`WBR`,e[e.XMP=123]=`XMP`})(J||={}),qbe=new Map([[q.A,J.A],[q.ADDRESS,J.ADDRESS],[q.ANNOTATION_XML,J.ANNOTATION_XML],[q.APPLET,J.APPLET],[q.AREA,J.AREA],[q.ARTICLE,J.ARTICLE],[q.ASIDE,J.ASIDE],[q.B,J.B],[q.BASE,J.BASE],[q.BASEFONT,J.BASEFONT],[q.BGSOUND,J.BGSOUND],[q.BIG,J.BIG],[q.BLOCKQUOTE,J.BLOCKQUOTE],[q.BODY,J.BODY],[q.BR,J.BR],[q.BUTTON,J.BUTTON],[q.CAPTION,J.CAPTION],[q.CENTER,J.CENTER],[q.CODE,J.CODE],[q.COL,J.COL],[q.COLGROUP,J.COLGROUP],[q.DD,J.DD],[q.DESC,J.DESC],[q.DETAILS,J.DETAILS],[q.DIALOG,J.DIALOG],[q.DIR,J.DIR],[q.DIV,J.DIV],[q.DL,J.DL],[q.DT,J.DT],[q.EM,J.EM],[q.EMBED,J.EMBED],[q.FIELDSET,J.FIELDSET],[q.FIGCAPTION,J.FIGCAPTION],[q.FIGURE,J.FIGURE],[q.FONT,J.FONT],[q.FOOTER,J.FOOTER],[q.FOREIGN_OBJECT,J.FOREIGN_OBJECT],[q.FORM,J.FORM],[q.FRAME,J.FRAME],[q.FRAMESET,J.FRAMESET],[q.H1,J.H1],[q.H2,J.H2],[q.H3,J.H3],[q.H4,J.H4],[q.H5,J.H5],[q.H6,J.H6],[q.HEAD,J.HEAD],[q.HEADER,J.HEADER],[q.HGROUP,J.HGROUP],[q.HR,J.HR],[q.HTML,J.HTML],[q.I,J.I],[q.IMG,J.IMG],[q.IMAGE,J.IMAGE],[q.INPUT,J.INPUT],[q.IFRAME,J.IFRAME],[q.KEYGEN,J.KEYGEN],[q.LABEL,J.LABEL],[q.LI,J.LI],[q.LINK,J.LINK],[q.LISTING,J.LISTING],[q.MAIN,J.MAIN],[q.MALIGNMARK,J.MALIGNMARK],[q.MARQUEE,J.MARQUEE],[q.MATH,J.MATH],[q.MENU,J.MENU],[q.META,J.META],[q.MGLYPH,J.MGLYPH],[q.MI,J.MI],[q.MO,J.MO],[q.MN,J.MN],[q.MS,J.MS],[q.MTEXT,J.MTEXT],[q.NAV,J.NAV],[q.NOBR,J.NOBR],[q.NOFRAMES,J.NOFRAMES],[q.NOEMBED,J.NOEMBED],[q.NOSCRIPT,J.NOSCRIPT],[q.OBJECT,J.OBJECT],[q.OL,J.OL],[q.OPTGROUP,J.OPTGROUP],[q.OPTION,J.OPTION],[q.P,J.P],[q.PARAM,J.PARAM],[q.PLAINTEXT,J.PLAINTEXT],[q.PRE,J.PRE],[q.RB,J.RB],[q.RP,J.RP],[q.RT,J.RT],[q.RTC,J.RTC],[q.RUBY,J.RUBY],[q.S,J.S],[q.SCRIPT,J.SCRIPT],[q.SEARCH,J.SEARCH],[q.SECTION,J.SECTION],[q.SELECT,J.SELECT],[q.SOURCE,J.SOURCE],[q.SMALL,J.SMALL],[q.SPAN,J.SPAN],[q.STRIKE,J.STRIKE],[q.STRONG,J.STRONG],[q.STYLE,J.STYLE],[q.SUB,J.SUB],[q.SUMMARY,J.SUMMARY],[q.SUP,J.SUP],[q.TABLE,J.TABLE],[q.TBODY,J.TBODY],[q.TEMPLATE,J.TEMPLATE],[q.TEXTAREA,J.TEXTAREA],[q.TFOOT,J.TFOOT],[q.TD,J.TD],[q.TH,J.TH],[q.THEAD,J.THEAD],[q.TITLE,J.TITLE],[q.TR,J.TR],[q.TRACK,J.TRACK],[q.TT,J.TT],[q.U,J.U],[q.UL,J.UL],[q.SVG,J.SVG],[q.VAR,J.VAR],[q.WBR,J.WBR],[q.XMP,J.XMP]]),nm=J,Jbe={[$p.HTML]:new Set([nm.ADDRESS,nm.APPLET,nm.AREA,nm.ARTICLE,nm.ASIDE,nm.BASE,nm.BASEFONT,nm.BGSOUND,nm.BLOCKQUOTE,nm.BODY,nm.BR,nm.BUTTON,nm.CAPTION,nm.CENTER,nm.COL,nm.COLGROUP,nm.DD,nm.DETAILS,nm.DIR,nm.DIV,nm.DL,nm.DT,nm.EMBED,nm.FIELDSET,nm.FIGCAPTION,nm.FIGURE,nm.FOOTER,nm.FORM,nm.FRAME,nm.FRAMESET,nm.H1,nm.H2,nm.H3,nm.H4,nm.H5,nm.H6,nm.HEAD,nm.HEADER,nm.HGROUP,nm.HR,nm.HTML,nm.IFRAME,nm.IMG,nm.INPUT,nm.LI,nm.LINK,nm.LISTING,nm.MAIN,nm.MARQUEE,nm.MENU,nm.META,nm.NAV,nm.NOEMBED,nm.NOFRAMES,nm.NOSCRIPT,nm.OBJECT,nm.OL,nm.P,nm.PARAM,nm.PLAINTEXT,nm.PRE,nm.SCRIPT,nm.SECTION,nm.SELECT,nm.SOURCE,nm.STYLE,nm.SUMMARY,nm.TABLE,nm.TBODY,nm.TD,nm.TEMPLATE,nm.TEXTAREA,nm.TFOOT,nm.TH,nm.THEAD,nm.TITLE,nm.TR,nm.TRACK,nm.UL,nm.WBR,nm.XMP]),[$p.MATHML]:new Set([nm.MI,nm.MO,nm.MN,nm.MS,nm.MTEXT,nm.ANNOTATION_XML]),[$p.SVG]:new Set([nm.TITLE,nm.FOREIGN_OBJECT,nm.DESC]),[$p.XLINK]:new Set,[$p.XML]:new Set,[$p.XMLNS]:new Set},rm=new Set([nm.H1,nm.H2,nm.H3,nm.H4,nm.H5,nm.H6]),new Set([q.STYLE,q.SCRIPT,q.XMP,q.IFRAME,q.NOEMBED,q.NOFRAMES,q.PLAINTEXT])}));function Ybe(e){return e>=K.DIGIT_0&&e<=K.DIGIT_9}function am(e){return e>=K.LATIN_CAPITAL_A&&e<=K.LATIN_CAPITAL_Z}function Xbe(e){return e>=K.LATIN_SMALL_A&&e<=K.LATIN_SMALL_Z}function om(e){return Xbe(e)||am(e)}function Zbe(e){return om(e)||Ybe(e)}function sm(e){return e+32}function Qbe(e){return e===K.SPACE||e===K.LINE_FEED||e===K.TABULATION||e===K.FORM_FEED}function $be(e){return Qbe(e)||e===K.SOLIDUS||e===K.GREATER_THAN_SIGN}function exe(e){return e===K.NULL?Up.nullCharacterReference:e>1114111?Up.characterReferenceOutsideUnicodeRange:Tbe(e)?Up.surrogateCharacterReference:kbe(e)?Up.noncharacterCharacterReference:Obe(e)||e===K.CARRIAGE_RETURN?Up.controlCharacterReference:null}var Y,cm,txe,nxe=s((()=>{Nbe(),Hp(),Kp(),Kbe(),Wp(),im(),(function(e){e[e.DATA=0]=`DATA`,e[e.RCDATA=1]=`RCDATA`,e[e.RAWTEXT=2]=`RAWTEXT`,e[e.SCRIPT_DATA=3]=`SCRIPT_DATA`,e[e.PLAINTEXT=4]=`PLAINTEXT`,e[e.TAG_OPEN=5]=`TAG_OPEN`,e[e.END_TAG_OPEN=6]=`END_TAG_OPEN`,e[e.TAG_NAME=7]=`TAG_NAME`,e[e.RCDATA_LESS_THAN_SIGN=8]=`RCDATA_LESS_THAN_SIGN`,e[e.RCDATA_END_TAG_OPEN=9]=`RCDATA_END_TAG_OPEN`,e[e.RCDATA_END_TAG_NAME=10]=`RCDATA_END_TAG_NAME`,e[e.RAWTEXT_LESS_THAN_SIGN=11]=`RAWTEXT_LESS_THAN_SIGN`,e[e.RAWTEXT_END_TAG_OPEN=12]=`RAWTEXT_END_TAG_OPEN`,e[e.RAWTEXT_END_TAG_NAME=13]=`RAWTEXT_END_TAG_NAME`,e[e.SCRIPT_DATA_LESS_THAN_SIGN=14]=`SCRIPT_DATA_LESS_THAN_SIGN`,e[e.SCRIPT_DATA_END_TAG_OPEN=15]=`SCRIPT_DATA_END_TAG_OPEN`,e[e.SCRIPT_DATA_END_TAG_NAME=16]=`SCRIPT_DATA_END_TAG_NAME`,e[e.SCRIPT_DATA_ESCAPE_START=17]=`SCRIPT_DATA_ESCAPE_START`,e[e.SCRIPT_DATA_ESCAPE_START_DASH=18]=`SCRIPT_DATA_ESCAPE_START_DASH`,e[e.SCRIPT_DATA_ESCAPED=19]=`SCRIPT_DATA_ESCAPED`,e[e.SCRIPT_DATA_ESCAPED_DASH=20]=`SCRIPT_DATA_ESCAPED_DASH`,e[e.SCRIPT_DATA_ESCAPED_DASH_DASH=21]=`SCRIPT_DATA_ESCAPED_DASH_DASH`,e[e.SCRIPT_DATA_ESCAPED_LESS_THAN_SIGN=22]=`SCRIPT_DATA_ESCAPED_LESS_THAN_SIGN`,e[e.SCRIPT_DATA_ESCAPED_END_TAG_OPEN=23]=`SCRIPT_DATA_ESCAPED_END_TAG_OPEN`,e[e.SCRIPT_DATA_ESCAPED_END_TAG_NAME=24]=`SCRIPT_DATA_ESCAPED_END_TAG_NAME`,e[e.SCRIPT_DATA_DOUBLE_ESCAPE_START=25]=`SCRIPT_DATA_DOUBLE_ESCAPE_START`,e[e.SCRIPT_DATA_DOUBLE_ESCAPED=26]=`SCRIPT_DATA_DOUBLE_ESCAPED`,e[e.SCRIPT_DATA_DOUBLE_ESCAPED_DASH=27]=`SCRIPT_DATA_DOUBLE_ESCAPED_DASH`,e[e.SCRIPT_DATA_DOUBLE_ESCAPED_DASH_DASH=28]=`SCRIPT_DATA_DOUBLE_ESCAPED_DASH_DASH`,e[e.SCRIPT_DATA_DOUBLE_ESCAPED_LESS_THAN_SIGN=29]=`SCRIPT_DATA_DOUBLE_ESCAPED_LESS_THAN_SIGN`,e[e.SCRIPT_DATA_DOUBLE_ESCAPE_END=30]=`SCRIPT_DATA_DOUBLE_ESCAPE_END`,e[e.BEFORE_ATTRIBUTE_NAME=31]=`BEFORE_ATTRIBUTE_NAME`,e[e.ATTRIBUTE_NAME=32]=`ATTRIBUTE_NAME`,e[e.AFTER_ATTRIBUTE_NAME=33]=`AFTER_ATTRIBUTE_NAME`,e[e.BEFORE_ATTRIBUTE_VALUE=34]=`BEFORE_ATTRIBUTE_VALUE`,e[e.ATTRIBUTE_VALUE_DOUBLE_QUOTED=35]=`ATTRIBUTE_VALUE_DOUBLE_QUOTED`,e[e.ATTRIBUTE_VALUE_SINGLE_QUOTED=36]=`ATTRIBUTE_VALUE_SINGLE_QUOTED`,e[e.ATTRIBUTE_VALUE_UNQUOTED=37]=`ATTRIBUTE_VALUE_UNQUOTED`,e[e.AFTER_ATTRIBUTE_VALUE_QUOTED=38]=`AFTER_ATTRIBUTE_VALUE_QUOTED`,e[e.SELF_CLOSING_START_TAG=39]=`SELF_CLOSING_START_TAG`,e[e.BOGUS_COMMENT=40]=`BOGUS_COMMENT`,e[e.MARKUP_DECLARATION_OPEN=41]=`MARKUP_DECLARATION_OPEN`,e[e.COMMENT_START=42]=`COMMENT_START`,e[e.COMMENT_START_DASH=43]=`COMMENT_START_DASH`,e[e.COMMENT=44]=`COMMENT`,e[e.COMMENT_LESS_THAN_SIGN=45]=`COMMENT_LESS_THAN_SIGN`,e[e.COMMENT_LESS_THAN_SIGN_BANG=46]=`COMMENT_LESS_THAN_SIGN_BANG`,e[e.COMMENT_LESS_THAN_SIGN_BANG_DASH=47]=`COMMENT_LESS_THAN_SIGN_BANG_DASH`,e[e.COMMENT_LESS_THAN_SIGN_BANG_DASH_DASH=48]=`COMMENT_LESS_THAN_SIGN_BANG_DASH_DASH`,e[e.COMMENT_END_DASH=49]=`COMMENT_END_DASH`,e[e.COMMENT_END=50]=`COMMENT_END`,e[e.COMMENT_END_BANG=51]=`COMMENT_END_BANG`,e[e.DOCTYPE=52]=`DOCTYPE`,e[e.BEFORE_DOCTYPE_NAME=53]=`BEFORE_DOCTYPE_NAME`,e[e.DOCTYPE_NAME=54]=`DOCTYPE_NAME`,e[e.AFTER_DOCTYPE_NAME=55]=`AFTER_DOCTYPE_NAME`,e[e.AFTER_DOCTYPE_PUBLIC_KEYWORD=56]=`AFTER_DOCTYPE_PUBLIC_KEYWORD`,e[e.BEFORE_DOCTYPE_PUBLIC_IDENTIFIER=57]=`BEFORE_DOCTYPE_PUBLIC_IDENTIFIER`,e[e.DOCTYPE_PUBLIC_IDENTIFIER_DOUBLE_QUOTED=58]=`DOCTYPE_PUBLIC_IDENTIFIER_DOUBLE_QUOTED`,e[e.DOCTYPE_PUBLIC_IDENTIFIER_SINGLE_QUOTED=59]=`DOCTYPE_PUBLIC_IDENTIFIER_SINGLE_QUOTED`,e[e.AFTER_DOCTYPE_PUBLIC_IDENTIFIER=60]=`AFTER_DOCTYPE_PUBLIC_IDENTIFIER`,e[e.BETWEEN_DOCTYPE_PUBLIC_AND_SYSTEM_IDENTIFIERS=61]=`BETWEEN_DOCTYPE_PUBLIC_AND_SYSTEM_IDENTIFIERS`,e[e.AFTER_DOCTYPE_SYSTEM_KEYWORD=62]=`AFTER_DOCTYPE_SYSTEM_KEYWORD`,e[e.BEFORE_DOCTYPE_SYSTEM_IDENTIFIER=63]=`BEFORE_DOCTYPE_SYSTEM_IDENTIFIER`,e[e.DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED=64]=`DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED`,e[e.DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED=65]=`DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED`,e[e.AFTER_DOCTYPE_SYSTEM_IDENTIFIER=66]=`AFTER_DOCTYPE_SYSTEM_IDENTIFIER`,e[e.BOGUS_DOCTYPE=67]=`BOGUS_DOCTYPE`,e[e.CDATA_SECTION=68]=`CDATA_SECTION`,e[e.CDATA_SECTION_BRACKET=69]=`CDATA_SECTION_BRACKET`,e[e.CDATA_SECTION_END=70]=`CDATA_SECTION_END`,e[e.CHARACTER_REFERENCE=71]=`CHARACTER_REFERENCE`,e[e.AMBIGUOUS_AMPERSAND=72]=`AMBIGUOUS_AMPERSAND`})(Y||={}),cm={DATA:Y.DATA,RCDATA:Y.RCDATA,RAWTEXT:Y.RAWTEXT,SCRIPT_DATA:Y.SCRIPT_DATA,PLAINTEXT:Y.PLAINTEXT,CDATA_SECTION:Y.CDATA_SECTION},txe=class{constructor(e,t){this.options=e,this.handler=t,this.paused=!1,this.inLoop=!1,this.inForeignNode=!1,this.lastStartTagName=``,this.active=!1,this.state=Y.DATA,this.returnState=Y.DATA,this.entityStartPos=0,this.consumedAfterSnapshot=-1,this.currentCharacterToken=null,this.currentToken=null,this.currentAttr={name:``,value:``},this.preprocessor=new Mbe(t),this.currentLocation=this.getCurrentLocation(-1),this.entityDecoder=new Gbe(Fbe,(e,t)=>{this.preprocessor.pos=this.entityStartPos+t-1,this._flushCodePointConsumedAsCharacterReference(e)},t.onParseError?{missingSemicolonAfterCharacterReference:()=>{this._err(Up.missingSemicolonAfterCharacterReference,1)},absenceOfDigitsInNumericCharacterReference:e=>{this._err(Up.absenceOfDigitsInNumericCharacterReference,this.entityStartPos-this.preprocessor.pos+e)},validateNumericCharacterReference:e=>{let t=exe(e);t&&this._err(t,1)}}:void 0)}_err(e,t=0){var n,r;(r=(n=this.handler).onParseError)==null||r.call(n,this.preprocessor.getError(e,t))}getCurrentLocation(e){return this.options.sourceCodeLocationInfo?{startLine:this.preprocessor.line,startCol:this.preprocessor.col-e,startOffset:this.preprocessor.offset-e,endLine:-1,endCol:-1,endOffset:-1}:null}_runParsingLoop(){if(!this.inLoop){for(this.inLoop=!0;this.active&&!this.paused;){this.consumedAfterSnapshot=0;let e=this._consume();this._ensureHibernation()||this._callState(e)}this.inLoop=!1}}pause(){this.paused=!0}resume(e){if(!this.paused)throw Error(`Parser was already resumed`);this.paused=!1,!this.inLoop&&(this._runParsingLoop(),this.paused||e?.())}write(e,t,n){this.active=!0,this.preprocessor.write(e,t),this._runParsingLoop(),this.paused||n?.()}insertHtmlAtCurrentPos(e){this.active=!0,this.preprocessor.insertHtmlAtCurrentPos(e),this._runParsingLoop()}_ensureHibernation(){return this.preprocessor.endOfChunkHit?(this.preprocessor.retreat(this.consumedAfterSnapshot),this.consumedAfterSnapshot=0,this.active=!1,!0):!1}_consume(){return this.consumedAfterSnapshot++,this.preprocessor.advance()}_advanceBy(e){this.consumedAfterSnapshot+=e;for(let t=0;t<e;t++)this.preprocessor.advance()}_consumeSequenceIfMatch(e,t){return this.preprocessor.startsWith(e,t)?(this._advanceBy(e.length-1),!0):!1}_createStartTagToken(){this.currentToken={type:Gp.START_TAG,tagName:``,tagID:J.UNKNOWN,selfClosing:!1,ackSelfClosing:!1,attrs:[],location:this.getCurrentLocation(1)}}_createEndTagToken(){this.currentToken={type:Gp.END_TAG,tagName:``,tagID:J.UNKNOWN,selfClosing:!1,ackSelfClosing:!1,attrs:[],location:this.getCurrentLocation(2)}}_createCommentToken(e){this.currentToken={type:Gp.COMMENT,data:``,location:this.getCurrentLocation(e)}}_createDoctypeToken(e){this.currentToken={type:Gp.DOCTYPE,name:e,forceQuirks:!1,publicId:null,systemId:null,location:this.currentLocation}}_createCharacterToken(e,t){this.currentCharacterToken={type:e,chars:t,location:this.currentLocation}}_createAttr(e){this.currentAttr={name:e,value:``},this.currentLocation=this.getCurrentLocation(0)}_leaveAttrName(){var e;let t=this.currentToken;if(Pbe(t,this.currentAttr.name)===null){if(t.attrs.push(this.currentAttr),t.location&&this.currentLocation){let n=(e=t.location).attrs??(e.attrs=Object.create(null));n[this.currentAttr.name]=this.currentLocation,this._leaveAttrValue()}}else this._err(Up.duplicateAttribute)}_leaveAttrValue(){this.currentLocation&&(this.currentLocation.endLine=this.preprocessor.line,this.currentLocation.endCol=this.preprocessor.col,this.currentLocation.endOffset=this.preprocessor.offset)}prepareToken(e){this._emitCurrentCharacterToken(e.location),this.currentToken=null,e.location&&(e.location.endLine=this.preprocessor.line,e.location.endCol=this.preprocessor.col+1,e.location.endOffset=this.preprocessor.offset+1),this.currentLocation=this.getCurrentLocation(-1)}emitCurrentTagToken(){let e=this.currentToken;this.prepareToken(e),e.tagID=Qp(e.tagName),e.type===Gp.START_TAG?(this.lastStartTagName=e.tagName,this.handler.onStartTag(e)):(e.attrs.length>0&&this._err(Up.endTagWithAttributes),e.selfClosing&&this._err(Up.endTagWithTrailingSolidus),this.handler.onEndTag(e)),this.preprocessor.dropParsedChunk()}emitCurrentComment(e){this.prepareToken(e),this.handler.onComment(e),this.preprocessor.dropParsedChunk()}emitCurrentDoctype(e){this.prepareToken(e),this.handler.onDoctype(e),this.preprocessor.dropParsedChunk()}_emitCurrentCharacterToken(e){if(this.currentCharacterToken){switch(e&&this.currentCharacterToken.location&&(this.currentCharacterToken.location.endLine=e.startLine,this.currentCharacterToken.location.endCol=e.startCol,this.currentCharacterToken.location.endOffset=e.startOffset),this.currentCharacterToken.type){case Gp.CHARACTER:this.handler.onCharacter(this.currentCharacterToken);break;case Gp.NULL_CHARACTER:this.handler.onNullCharacter(this.currentCharacterToken);break;case Gp.WHITESPACE_CHARACTER:this.handler.onWhitespaceCharacter(this.currentCharacterToken);break}this.currentCharacterToken=null}}_emitEOFToken(){let e=this.getCurrentLocation(0);e&&(e.endLine=e.startLine,e.endCol=e.startCol,e.endOffset=e.startOffset),this._emitCurrentCharacterToken(e),this.handler.onEof({type:Gp.EOF,location:e}),this.active=!1}_appendCharToCurrentCharacterToken(e,t){if(this.currentCharacterToken)if(this.currentCharacterToken.type===e){this.currentCharacterToken.chars+=t;return}else this.currentLocation=this.getCurrentLocation(0),this._emitCurrentCharacterToken(this.currentLocation),this.preprocessor.dropParsedChunk();this._createCharacterToken(e,t)}_emitCodePoint(e){let t=Qbe(e)?Gp.WHITESPACE_CHARACTER:e===K.NULL?Gp.NULL_CHARACTER:Gp.CHARACTER;this._appendCharToCurrentCharacterToken(t,String.fromCodePoint(e))}_emitChars(e){this._appendCharToCurrentCharacterToken(Gp.CHARACTER,e)}_startCharacterReference(){this.returnState=this.state,this.state=Y.CHARACTER_REFERENCE,this.entityStartPos=this.preprocessor.pos,this.entityDecoder.startEntity(this._isCharacterReferenceInAttribute()?Zp.Attribute:Zp.Legacy)}_isCharacterReferenceInAttribute(){return this.returnState===Y.ATTRIBUTE_VALUE_DOUBLE_QUOTED||this.returnState===Y.ATTRIBUTE_VALUE_SINGLE_QUOTED||this.returnState===Y.ATTRIBUTE_VALUE_UNQUOTED}_flushCodePointConsumedAsCharacterReference(e){this._isCharacterReferenceInAttribute()?this.currentAttr.value+=String.fromCodePoint(e):this._emitCodePoint(e)}_callState(e){switch(this.state){case Y.DATA:this._stateData(e);break;case Y.RCDATA:this._stateRcdata(e);break;case Y.RAWTEXT:this._stateRawtext(e);break;case Y.SCRIPT_DATA:this._stateScriptData(e);break;case Y.PLAINTEXT:this._statePlaintext(e);break;case Y.TAG_OPEN:this._stateTagOpen(e);break;case Y.END_TAG_OPEN:this._stateEndTagOpen(e);break;case Y.TAG_NAME:this._stateTagName(e);break;case Y.RCDATA_LESS_THAN_SIGN:this._stateRcdataLessThanSign(e);break;case Y.RCDATA_END_TAG_OPEN:this._stateRcdataEndTagOpen(e);break;case Y.RCDATA_END_TAG_NAME:this._stateRcdataEndTagName(e);break;case Y.RAWTEXT_LESS_THAN_SIGN:this._stateRawtextLessThanSign(e);break;case Y.RAWTEXT_END_TAG_OPEN:this._stateRawtextEndTagOpen(e);break;case Y.RAWTEXT_END_TAG_NAME:this._stateRawtextEndTagName(e);break;case Y.SCRIPT_DATA_LESS_THAN_SIGN:this._stateScriptDataLessThanSign(e);break;case Y.SCRIPT_DATA_END_TAG_OPEN:this._stateScriptDataEndTagOpen(e);break;case Y.SCRIPT_DATA_END_TAG_NAME:this._stateScriptDataEndTagName(e);break;case Y.SCRIPT_DATA_ESCAPE_START:this._stateScriptDataEscapeStart(e);break;case Y.SCRIPT_DATA_ESCAPE_START_DASH:this._stateScriptDataEscapeStartDash(e);break;case Y.SCRIPT_DATA_ESCAPED:this._stateScriptDataEscaped(e);break;case Y.SCRIPT_DATA_ESCAPED_DASH:this._stateScriptDataEscapedDash(e);break;case Y.SCRIPT_DATA_ESCAPED_DASH_DASH:this._stateScriptDataEscapedDashDash(e);break;case Y.SCRIPT_DATA_ESCAPED_LESS_THAN_SIGN:this._stateScriptDataEscapedLessThanSign(e);break;case Y.SCRIPT_DATA_ESCAPED_END_TAG_OPEN:this._stateScriptDataEscapedEndTagOpen(e);break;case Y.SCRIPT_DATA_ESCAPED_END_TAG_NAME:this._stateScriptDataEscapedEndTagName(e);break;case Y.SCRIPT_DATA_DOUBLE_ESCAPE_START:this._stateScriptDataDoubleEscapeStart(e);break;case Y.SCRIPT_DATA_DOUBLE_ESCAPED:this._stateScriptDataDoubleEscaped(e);break;case Y.SCRIPT_DATA_DOUBLE_ESCAPED_DASH:this._stateScriptDataDoubleEscapedDash(e);break;case Y.SCRIPT_DATA_DOUBLE_ESCAPED_DASH_DASH:this._stateScriptDataDoubleEscapedDashDash(e);break;case Y.SCRIPT_DATA_DOUBLE_ESCAPED_LESS_THAN_SIGN:this._stateScriptDataDoubleEscapedLessThanSign(e);break;case Y.SCRIPT_DATA_DOUBLE_ESCAPE_END:this._stateScriptDataDoubleEscapeEnd(e);break;case Y.BEFORE_ATTRIBUTE_NAME:this._stateBeforeAttributeName(e);break;case Y.ATTRIBUTE_NAME:this._stateAttributeName(e);break;case Y.AFTER_ATTRIBUTE_NAME:this._stateAfterAttributeName(e);break;case Y.BEFORE_ATTRIBUTE_VALUE:this._stateBeforeAttributeValue(e);break;case Y.ATTRIBUTE_VALUE_DOUBLE_QUOTED:this._stateAttributeValueDoubleQuoted(e);break;case Y.ATTRIBUTE_VALUE_SINGLE_QUOTED:this._stateAttributeValueSingleQuoted(e);break;case Y.ATTRIBUTE_VALUE_UNQUOTED:this._stateAttributeValueUnquoted(e);break;case Y.AFTER_ATTRIBUTE_VALUE_QUOTED:this._stateAfterAttributeValueQuoted(e);break;case Y.SELF_CLOSING_START_TAG:this._stateSelfClosingStartTag(e);break;case Y.BOGUS_COMMENT:this._stateBogusComment(e);break;case Y.MARKUP_DECLARATION_OPEN:this._stateMarkupDeclarationOpen(e);break;case Y.COMMENT_START:this._stateCommentStart(e);break;case Y.COMMENT_START_DASH:this._stateCommentStartDash(e);break;case Y.COMMENT:this._stateComment(e);break;case Y.COMMENT_LESS_THAN_SIGN:this._stateCommentLessThanSign(e);break;case Y.COMMENT_LESS_THAN_SIGN_BANG:this._stateCommentLessThanSignBang(e);break;case Y.COMMENT_LESS_THAN_SIGN_BANG_DASH:this._stateCommentLessThanSignBangDash(e);break;case Y.COMMENT_LESS_THAN_SIGN_BANG_DASH_DASH:this._stateCommentLessThanSignBangDashDash(e);break;case Y.COMMENT_END_DASH:this._stateCommentEndDash(e);break;case Y.COMMENT_END:this._stateCommentEnd(e);break;case Y.COMMENT_END_BANG:this._stateCommentEndBang(e);break;case Y.DOCTYPE:this._stateDoctype(e);break;case Y.BEFORE_DOCTYPE_NAME:this._stateBeforeDoctypeName(e);break;case Y.DOCTYPE_NAME:this._stateDoctypeName(e);break;case Y.AFTER_DOCTYPE_NAME:this._stateAfterDoctypeName(e);break;case Y.AFTER_DOCTYPE_PUBLIC_KEYWORD:this._stateAfterDoctypePublicKeyword(e);break;case Y.BEFORE_DOCTYPE_PUBLIC_IDENTIFIER:this._stateBeforeDoctypePublicIdentifier(e);break;case Y.DOCTYPE_PUBLIC_IDENTIFIER_DOUBLE_QUOTED:this._stateDoctypePublicIdentifierDoubleQuoted(e);break;case Y.DOCTYPE_PUBLIC_IDENTIFIER_SINGLE_QUOTED:this._stateDoctypePublicIdentifierSingleQuoted(e);break;case Y.AFTER_DOCTYPE_PUBLIC_IDENTIFIER:this._stateAfterDoctypePublicIdentifier(e);break;case Y.BETWEEN_DOCTYPE_PUBLIC_AND_SYSTEM_IDENTIFIERS:this._stateBetweenDoctypePublicAndSystemIdentifiers(e);break;case Y.AFTER_DOCTYPE_SYSTEM_KEYWORD:this._stateAfterDoctypeSystemKeyword(e);break;case Y.BEFORE_DOCTYPE_SYSTEM_IDENTIFIER:this._stateBeforeDoctypeSystemIdentifier(e);break;case Y.DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED:this._stateDoctypeSystemIdentifierDoubleQuoted(e);break;case Y.DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED:this._stateDoctypeSystemIdentifierSingleQuoted(e);break;case Y.AFTER_DOCTYPE_SYSTEM_IDENTIFIER:this._stateAfterDoctypeSystemIdentifier(e);break;case Y.BOGUS_DOCTYPE:this._stateBogusDoctype(e);break;case Y.CDATA_SECTION:this._stateCdataSection(e);break;case Y.CDATA_SECTION_BRACKET:this._stateCdataSectionBracket(e);break;case Y.CDATA_SECTION_END:this._stateCdataSectionEnd(e);break;case Y.CHARACTER_REFERENCE:this._stateCharacterReference();break;case Y.AMBIGUOUS_AMPERSAND:this._stateAmbiguousAmpersand(e);break;default:throw Error(`Unknown state`)}}_stateData(e){switch(e){case K.LESS_THAN_SIGN:this.state=Y.TAG_OPEN;break;case K.AMPERSAND:this._startCharacterReference();break;case K.NULL:this._err(Up.unexpectedNullCharacter),this._emitCodePoint(e);break;case K.EOF:this._emitEOFToken();break;default:this._emitCodePoint(e)}}_stateRcdata(e){switch(e){case K.AMPERSAND:this._startCharacterReference();break;case K.LESS_THAN_SIGN:this.state=Y.RCDATA_LESS_THAN_SIGN;break;case K.NULL:this._err(Up.unexpectedNullCharacter),this._emitChars(`�`);break;case K.EOF:this._emitEOFToken();break;default:this._emitCodePoint(e)}}_stateRawtext(e){switch(e){case K.LESS_THAN_SIGN:this.state=Y.RAWTEXT_LESS_THAN_SIGN;break;case K.NULL:this._err(Up.unexpectedNullCharacter),this._emitChars(`�`);break;case K.EOF:this._emitEOFToken();break;default:this._emitCodePoint(e)}}_stateScriptData(e){switch(e){case K.LESS_THAN_SIGN:this.state=Y.SCRIPT_DATA_LESS_THAN_SIGN;break;case K.NULL:this._err(Up.unexpectedNullCharacter),this._emitChars(`�`);break;case K.EOF:this._emitEOFToken();break;default:this._emitCodePoint(e)}}_statePlaintext(e){switch(e){case K.NULL:this._err(Up.unexpectedNullCharacter),this._emitChars(`�`);break;case K.EOF:this._emitEOFToken();break;default:this._emitCodePoint(e)}}_stateTagOpen(e){if(om(e))this._createStartTagToken(),this.state=Y.TAG_NAME,this._stateTagName(e);else switch(e){case K.EXCLAMATION_MARK:this.state=Y.MARKUP_DECLARATION_OPEN;break;case K.SOLIDUS:this.state=Y.END_TAG_OPEN;break;case K.QUESTION_MARK:this._err(Up.unexpectedQuestionMarkInsteadOfTagName),this._createCommentToken(1),this.state=Y.BOGUS_COMMENT,this._stateBogusComment(e);break;case K.EOF:this._err(Up.eofBeforeTagName),this._emitChars(`<`),this._emitEOFToken();break;default:this._err(Up.invalidFirstCharacterOfTagName),this._emitChars(`<`),this.state=Y.DATA,this._stateData(e)}}_stateEndTagOpen(e){if(om(e))this._createEndTagToken(),this.state=Y.TAG_NAME,this._stateTagName(e);else switch(e){case K.GREATER_THAN_SIGN:this._err(Up.missingEndTagName),this.state=Y.DATA;break;case K.EOF:this._err(Up.eofBeforeTagName),this._emitChars(`</`),this._emitEOFToken();break;default:this._err(Up.invalidFirstCharacterOfTagName),this._createCommentToken(2),this.state=Y.BOGUS_COMMENT,this._stateBogusComment(e)}}_stateTagName(e){let t=this.currentToken;switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:this.state=Y.BEFORE_ATTRIBUTE_NAME;break;case K.SOLIDUS:this.state=Y.SELF_CLOSING_START_TAG;break;case K.GREATER_THAN_SIGN:this.state=Y.DATA,this.emitCurrentTagToken();break;case K.NULL:this._err(Up.unexpectedNullCharacter),t.tagName+=`�`;break;case K.EOF:this._err(Up.eofInTag),this._emitEOFToken();break;default:t.tagName+=String.fromCodePoint(am(e)?sm(e):e)}}_stateRcdataLessThanSign(e){e===K.SOLIDUS?this.state=Y.RCDATA_END_TAG_OPEN:(this._emitChars(`<`),this.state=Y.RCDATA,this._stateRcdata(e))}_stateRcdataEndTagOpen(e){om(e)?(this.state=Y.RCDATA_END_TAG_NAME,this._stateRcdataEndTagName(e)):(this._emitChars(`</`),this.state=Y.RCDATA,this._stateRcdata(e))}handleSpecialEndTag(e){if(!this.preprocessor.startsWith(this.lastStartTagName,!1))return!this._ensureHibernation();this._createEndTagToken();let t=this.currentToken;switch(t.tagName=this.lastStartTagName,this.preprocessor.peek(this.lastStartTagName.length)){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:return this._advanceBy(this.lastStartTagName.length),this.state=Y.BEFORE_ATTRIBUTE_NAME,!1;case K.SOLIDUS:return this._advanceBy(this.lastStartTagName.length),this.state=Y.SELF_CLOSING_START_TAG,!1;case K.GREATER_THAN_SIGN:return this._advanceBy(this.lastStartTagName.length),this.emitCurrentTagToken(),this.state=Y.DATA,!1;default:return!this._ensureHibernation()}}_stateRcdataEndTagName(e){this.handleSpecialEndTag(e)&&(this._emitChars(`</`),this.state=Y.RCDATA,this._stateRcdata(e))}_stateRawtextLessThanSign(e){e===K.SOLIDUS?this.state=Y.RAWTEXT_END_TAG_OPEN:(this._emitChars(`<`),this.state=Y.RAWTEXT,this._stateRawtext(e))}_stateRawtextEndTagOpen(e){om(e)?(this.state=Y.RAWTEXT_END_TAG_NAME,this._stateRawtextEndTagName(e)):(this._emitChars(`</`),this.state=Y.RAWTEXT,this._stateRawtext(e))}_stateRawtextEndTagName(e){this.handleSpecialEndTag(e)&&(this._emitChars(`</`),this.state=Y.RAWTEXT,this._stateRawtext(e))}_stateScriptDataLessThanSign(e){switch(e){case K.SOLIDUS:this.state=Y.SCRIPT_DATA_END_TAG_OPEN;break;case K.EXCLAMATION_MARK:this.state=Y.SCRIPT_DATA_ESCAPE_START,this._emitChars(`<!`);break;default:this._emitChars(`<`),this.state=Y.SCRIPT_DATA,this._stateScriptData(e)}}_stateScriptDataEndTagOpen(e){om(e)?(this.state=Y.SCRIPT_DATA_END_TAG_NAME,this._stateScriptDataEndTagName(e)):(this._emitChars(`</`),this.state=Y.SCRIPT_DATA,this._stateScriptData(e))}_stateScriptDataEndTagName(e){this.handleSpecialEndTag(e)&&(this._emitChars(`</`),this.state=Y.SCRIPT_DATA,this._stateScriptData(e))}_stateScriptDataEscapeStart(e){e===K.HYPHEN_MINUS?(this.state=Y.SCRIPT_DATA_ESCAPE_START_DASH,this._emitChars(`-`)):(this.state=Y.SCRIPT_DATA,this._stateScriptData(e))}_stateScriptDataEscapeStartDash(e){e===K.HYPHEN_MINUS?(this.state=Y.SCRIPT_DATA_ESCAPED_DASH_DASH,this._emitChars(`-`)):(this.state=Y.SCRIPT_DATA,this._stateScriptData(e))}_stateScriptDataEscaped(e){switch(e){case K.HYPHEN_MINUS:this.state=Y.SCRIPT_DATA_ESCAPED_DASH,this._emitChars(`-`);break;case K.LESS_THAN_SIGN:this.state=Y.SCRIPT_DATA_ESCAPED_LESS_THAN_SIGN;break;case K.NULL:this._err(Up.unexpectedNullCharacter),this._emitChars(`�`);break;case K.EOF:this._err(Up.eofInScriptHtmlCommentLikeText),this._emitEOFToken();break;default:this._emitCodePoint(e)}}_stateScriptDataEscapedDash(e){switch(e){case K.HYPHEN_MINUS:this.state=Y.SCRIPT_DATA_ESCAPED_DASH_DASH,this._emitChars(`-`);break;case K.LESS_THAN_SIGN:this.state=Y.SCRIPT_DATA_ESCAPED_LESS_THAN_SIGN;break;case K.NULL:this._err(Up.unexpectedNullCharacter),this.state=Y.SCRIPT_DATA_ESCAPED,this._emitChars(`�`);break;case K.EOF:this._err(Up.eofInScriptHtmlCommentLikeText),this._emitEOFToken();break;default:this.state=Y.SCRIPT_DATA_ESCAPED,this._emitCodePoint(e)}}_stateScriptDataEscapedDashDash(e){switch(e){case K.HYPHEN_MINUS:this._emitChars(`-`);break;case K.LESS_THAN_SIGN:this.state=Y.SCRIPT_DATA_ESCAPED_LESS_THAN_SIGN;break;case K.GREATER_THAN_SIGN:this.state=Y.SCRIPT_DATA,this._emitChars(`>`);break;case K.NULL:this._err(Up.unexpectedNullCharacter),this.state=Y.SCRIPT_DATA_ESCAPED,this._emitChars(`�`);break;case K.EOF:this._err(Up.eofInScriptHtmlCommentLikeText),this._emitEOFToken();break;default:this.state=Y.SCRIPT_DATA_ESCAPED,this._emitCodePoint(e)}}_stateScriptDataEscapedLessThanSign(e){e===K.SOLIDUS?this.state=Y.SCRIPT_DATA_ESCAPED_END_TAG_OPEN:om(e)?(this._emitChars(`<`),this.state=Y.SCRIPT_DATA_DOUBLE_ESCAPE_START,this._stateScriptDataDoubleEscapeStart(e)):(this._emitChars(`<`),this.state=Y.SCRIPT_DATA_ESCAPED,this._stateScriptDataEscaped(e))}_stateScriptDataEscapedEndTagOpen(e){om(e)?(this.state=Y.SCRIPT_DATA_ESCAPED_END_TAG_NAME,this._stateScriptDataEscapedEndTagName(e)):(this._emitChars(`</`),this.state=Y.SCRIPT_DATA_ESCAPED,this._stateScriptDataEscaped(e))}_stateScriptDataEscapedEndTagName(e){this.handleSpecialEndTag(e)&&(this._emitChars(`</`),this.state=Y.SCRIPT_DATA_ESCAPED,this._stateScriptDataEscaped(e))}_stateScriptDataDoubleEscapeStart(e){if(this.preprocessor.startsWith(Vp.SCRIPT,!1)&&$be(this.preprocessor.peek(Vp.SCRIPT.length))){this._emitCodePoint(e);for(let e=0;e<Vp.SCRIPT.length;e++)this._emitCodePoint(this._consume());this.state=Y.SCRIPT_DATA_DOUBLE_ESCAPED}else this._ensureHibernation()||(this.state=Y.SCRIPT_DATA_ESCAPED,this._stateScriptDataEscaped(e))}_stateScriptDataDoubleEscaped(e){switch(e){case K.HYPHEN_MINUS:this.state=Y.SCRIPT_DATA_DOUBLE_ESCAPED_DASH,this._emitChars(`-`);break;case K.LESS_THAN_SIGN:this.state=Y.SCRIPT_DATA_DOUBLE_ESCAPED_LESS_THAN_SIGN,this._emitChars(`<`);break;case K.NULL:this._err(Up.unexpectedNullCharacter),this._emitChars(`�`);break;case K.EOF:this._err(Up.eofInScriptHtmlCommentLikeText),this._emitEOFToken();break;default:this._emitCodePoint(e)}}_stateScriptDataDoubleEscapedDash(e){switch(e){case K.HYPHEN_MINUS:this.state=Y.SCRIPT_DATA_DOUBLE_ESCAPED_DASH_DASH,this._emitChars(`-`);break;case K.LESS_THAN_SIGN:this.state=Y.SCRIPT_DATA_DOUBLE_ESCAPED_LESS_THAN_SIGN,this._emitChars(`<`);break;case K.NULL:this._err(Up.unexpectedNullCharacter),this.state=Y.SCRIPT_DATA_DOUBLE_ESCAPED,this._emitChars(`�`);break;case K.EOF:this._err(Up.eofInScriptHtmlCommentLikeText),this._emitEOFToken();break;default:this.state=Y.SCRIPT_DATA_DOUBLE_ESCAPED,this._emitCodePoint(e)}}_stateScriptDataDoubleEscapedDashDash(e){switch(e){case K.HYPHEN_MINUS:this._emitChars(`-`);break;case K.LESS_THAN_SIGN:this.state=Y.SCRIPT_DATA_DOUBLE_ESCAPED_LESS_THAN_SIGN,this._emitChars(`<`);break;case K.GREATER_THAN_SIGN:this.state=Y.SCRIPT_DATA,this._emitChars(`>`);break;case K.NULL:this._err(Up.unexpectedNullCharacter),this.state=Y.SCRIPT_DATA_DOUBLE_ESCAPED,this._emitChars(`�`);break;case K.EOF:this._err(Up.eofInScriptHtmlCommentLikeText),this._emitEOFToken();break;default:this.state=Y.SCRIPT_DATA_DOUBLE_ESCAPED,this._emitCodePoint(e)}}_stateScriptDataDoubleEscapedLessThanSign(e){e===K.SOLIDUS?(this.state=Y.SCRIPT_DATA_DOUBLE_ESCAPE_END,this._emitChars(`/`)):(this.state=Y.SCRIPT_DATA_DOUBLE_ESCAPED,this._stateScriptDataDoubleEscaped(e))}_stateScriptDataDoubleEscapeEnd(e){if(this.preprocessor.startsWith(Vp.SCRIPT,!1)&&$be(this.preprocessor.peek(Vp.SCRIPT.length))){this._emitCodePoint(e);for(let e=0;e<Vp.SCRIPT.length;e++)this._emitCodePoint(this._consume());this.state=Y.SCRIPT_DATA_ESCAPED}else this._ensureHibernation()||(this.state=Y.SCRIPT_DATA_DOUBLE_ESCAPED,this._stateScriptDataDoubleEscaped(e))}_stateBeforeAttributeName(e){switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:break;case K.SOLIDUS:case K.GREATER_THAN_SIGN:case K.EOF:this.state=Y.AFTER_ATTRIBUTE_NAME,this._stateAfterAttributeName(e);break;case K.EQUALS_SIGN:this._err(Up.unexpectedEqualsSignBeforeAttributeName),this._createAttr(`=`),this.state=Y.ATTRIBUTE_NAME;break;default:this._createAttr(``),this.state=Y.ATTRIBUTE_NAME,this._stateAttributeName(e)}}_stateAttributeName(e){switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:case K.SOLIDUS:case K.GREATER_THAN_SIGN:case K.EOF:this._leaveAttrName(),this.state=Y.AFTER_ATTRIBUTE_NAME,this._stateAfterAttributeName(e);break;case K.EQUALS_SIGN:this._leaveAttrName(),this.state=Y.BEFORE_ATTRIBUTE_VALUE;break;case K.QUOTATION_MARK:case K.APOSTROPHE:case K.LESS_THAN_SIGN:this._err(Up.unexpectedCharacterInAttributeName),this.currentAttr.name+=String.fromCodePoint(e);break;case K.NULL:this._err(Up.unexpectedNullCharacter),this.currentAttr.name+=`�`;break;default:this.currentAttr.name+=String.fromCodePoint(am(e)?sm(e):e)}}_stateAfterAttributeName(e){switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:break;case K.SOLIDUS:this.state=Y.SELF_CLOSING_START_TAG;break;case K.EQUALS_SIGN:this.state=Y.BEFORE_ATTRIBUTE_VALUE;break;case K.GREATER_THAN_SIGN:this.state=Y.DATA,this.emitCurrentTagToken();break;case K.EOF:this._err(Up.eofInTag),this._emitEOFToken();break;default:this._createAttr(``),this.state=Y.ATTRIBUTE_NAME,this._stateAttributeName(e)}}_stateBeforeAttributeValue(e){switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:break;case K.QUOTATION_MARK:this.state=Y.ATTRIBUTE_VALUE_DOUBLE_QUOTED;break;case K.APOSTROPHE:this.state=Y.ATTRIBUTE_VALUE_SINGLE_QUOTED;break;case K.GREATER_THAN_SIGN:this._err(Up.missingAttributeValue),this.state=Y.DATA,this.emitCurrentTagToken();break;default:this.state=Y.ATTRIBUTE_VALUE_UNQUOTED,this._stateAttributeValueUnquoted(e)}}_stateAttributeValueDoubleQuoted(e){switch(e){case K.QUOTATION_MARK:this.state=Y.AFTER_ATTRIBUTE_VALUE_QUOTED;break;case K.AMPERSAND:this._startCharacterReference();break;case K.NULL:this._err(Up.unexpectedNullCharacter),this.currentAttr.value+=`�`;break;case K.EOF:this._err(Up.eofInTag),this._emitEOFToken();break;default:this.currentAttr.value+=String.fromCodePoint(e)}}_stateAttributeValueSingleQuoted(e){switch(e){case K.APOSTROPHE:this.state=Y.AFTER_ATTRIBUTE_VALUE_QUOTED;break;case K.AMPERSAND:this._startCharacterReference();break;case K.NULL:this._err(Up.unexpectedNullCharacter),this.currentAttr.value+=`�`;break;case K.EOF:this._err(Up.eofInTag),this._emitEOFToken();break;default:this.currentAttr.value+=String.fromCodePoint(e)}}_stateAttributeValueUnquoted(e){switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:this._leaveAttrValue(),this.state=Y.BEFORE_ATTRIBUTE_NAME;break;case K.AMPERSAND:this._startCharacterReference();break;case K.GREATER_THAN_SIGN:this._leaveAttrValue(),this.state=Y.DATA,this.emitCurrentTagToken();break;case K.NULL:this._err(Up.unexpectedNullCharacter),this.currentAttr.value+=`�`;break;case K.QUOTATION_MARK:case K.APOSTROPHE:case K.LESS_THAN_SIGN:case K.EQUALS_SIGN:case K.GRAVE_ACCENT:this._err(Up.unexpectedCharacterInUnquotedAttributeValue),this.currentAttr.value+=String.fromCodePoint(e);break;case K.EOF:this._err(Up.eofInTag),this._emitEOFToken();break;default:this.currentAttr.value+=String.fromCodePoint(e)}}_stateAfterAttributeValueQuoted(e){switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:this._leaveAttrValue(),this.state=Y.BEFORE_ATTRIBUTE_NAME;break;case K.SOLIDUS:this._leaveAttrValue(),this.state=Y.SELF_CLOSING_START_TAG;break;case K.GREATER_THAN_SIGN:this._leaveAttrValue(),this.state=Y.DATA,this.emitCurrentTagToken();break;case K.EOF:this._err(Up.eofInTag),this._emitEOFToken();break;default:this._err(Up.missingWhitespaceBetweenAttributes),this.state=Y.BEFORE_ATTRIBUTE_NAME,this._stateBeforeAttributeName(e)}}_stateSelfClosingStartTag(e){switch(e){case K.GREATER_THAN_SIGN:{let e=this.currentToken;e.selfClosing=!0,this.state=Y.DATA,this.emitCurrentTagToken();break}case K.EOF:this._err(Up.eofInTag),this._emitEOFToken();break;default:this._err(Up.unexpectedSolidusInTag),this.state=Y.BEFORE_ATTRIBUTE_NAME,this._stateBeforeAttributeName(e)}}_stateBogusComment(e){let t=this.currentToken;switch(e){case K.GREATER_THAN_SIGN:this.state=Y.DATA,this.emitCurrentComment(t);break;case K.EOF:this.emitCurrentComment(t),this._emitEOFToken();break;case K.NULL:this._err(Up.unexpectedNullCharacter),t.data+=`�`;break;default:t.data+=String.fromCodePoint(e)}}_stateMarkupDeclarationOpen(e){this._consumeSequenceIfMatch(Vp.DASH_DASH,!0)?(this._createCommentToken(Vp.DASH_DASH.length+1),this.state=Y.COMMENT_START):this._consumeSequenceIfMatch(Vp.DOCTYPE,!1)?(this.currentLocation=this.getCurrentLocation(Vp.DOCTYPE.length+1),this.state=Y.DOCTYPE):this._consumeSequenceIfMatch(Vp.CDATA_START,!0)?this.inForeignNode?this.state=Y.CDATA_SECTION:(this._err(Up.cdataInHtmlContent),this._createCommentToken(Vp.CDATA_START.length+1),this.currentToken.data=`[CDATA[`,this.state=Y.BOGUS_COMMENT):this._ensureHibernation()||(this._err(Up.incorrectlyOpenedComment),this._createCommentToken(2),this.state=Y.BOGUS_COMMENT,this._stateBogusComment(e))}_stateCommentStart(e){switch(e){case K.HYPHEN_MINUS:this.state=Y.COMMENT_START_DASH;break;case K.GREATER_THAN_SIGN:{this._err(Up.abruptClosingOfEmptyComment),this.state=Y.DATA;let e=this.currentToken;this.emitCurrentComment(e);break}default:this.state=Y.COMMENT,this._stateComment(e)}}_stateCommentStartDash(e){let t=this.currentToken;switch(e){case K.HYPHEN_MINUS:this.state=Y.COMMENT_END;break;case K.GREATER_THAN_SIGN:this._err(Up.abruptClosingOfEmptyComment),this.state=Y.DATA,this.emitCurrentComment(t);break;case K.EOF:this._err(Up.eofInComment),this.emitCurrentComment(t),this._emitEOFToken();break;default:t.data+=`-`,this.state=Y.COMMENT,this._stateComment(e)}}_stateComment(e){let t=this.currentToken;switch(e){case K.HYPHEN_MINUS:this.state=Y.COMMENT_END_DASH;break;case K.LESS_THAN_SIGN:t.data+=`<`,this.state=Y.COMMENT_LESS_THAN_SIGN;break;case K.NULL:this._err(Up.unexpectedNullCharacter),t.data+=`�`;break;case K.EOF:this._err(Up.eofInComment),this.emitCurrentComment(t),this._emitEOFToken();break;default:t.data+=String.fromCodePoint(e)}}_stateCommentLessThanSign(e){let t=this.currentToken;switch(e){case K.EXCLAMATION_MARK:t.data+=`!`,this.state=Y.COMMENT_LESS_THAN_SIGN_BANG;break;case K.LESS_THAN_SIGN:t.data+=`<`;break;default:this.state=Y.COMMENT,this._stateComment(e)}}_stateCommentLessThanSignBang(e){e===K.HYPHEN_MINUS?this.state=Y.COMMENT_LESS_THAN_SIGN_BANG_DASH:(this.state=Y.COMMENT,this._stateComment(e))}_stateCommentLessThanSignBangDash(e){e===K.HYPHEN_MINUS?this.state=Y.COMMENT_LESS_THAN_SIGN_BANG_DASH_DASH:(this.state=Y.COMMENT_END_DASH,this._stateCommentEndDash(e))}_stateCommentLessThanSignBangDashDash(e){e!==K.GREATER_THAN_SIGN&&e!==K.EOF&&this._err(Up.nestedComment),this.state=Y.COMMENT_END,this._stateCommentEnd(e)}_stateCommentEndDash(e){let t=this.currentToken;switch(e){case K.HYPHEN_MINUS:this.state=Y.COMMENT_END;break;case K.EOF:this._err(Up.eofInComment),this.emitCurrentComment(t),this._emitEOFToken();break;default:t.data+=`-`,this.state=Y.COMMENT,this._stateComment(e)}}_stateCommentEnd(e){let t=this.currentToken;switch(e){case K.GREATER_THAN_SIGN:this.state=Y.DATA,this.emitCurrentComment(t);break;case K.EXCLAMATION_MARK:this.state=Y.COMMENT_END_BANG;break;case K.HYPHEN_MINUS:t.data+=`-`;break;case K.EOF:this._err(Up.eofInComment),this.emitCurrentComment(t),this._emitEOFToken();break;default:t.data+=`--`,this.state=Y.COMMENT,this._stateComment(e)}}_stateCommentEndBang(e){let t=this.currentToken;switch(e){case K.HYPHEN_MINUS:t.data+=`--!`,this.state=Y.COMMENT_END_DASH;break;case K.GREATER_THAN_SIGN:this._err(Up.incorrectlyClosedComment),this.state=Y.DATA,this.emitCurrentComment(t);break;case K.EOF:this._err(Up.eofInComment),this.emitCurrentComment(t),this._emitEOFToken();break;default:t.data+=`--!`,this.state=Y.COMMENT,this._stateComment(e)}}_stateDoctype(e){switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:this.state=Y.BEFORE_DOCTYPE_NAME;break;case K.GREATER_THAN_SIGN:this.state=Y.BEFORE_DOCTYPE_NAME,this._stateBeforeDoctypeName(e);break;case K.EOF:{this._err(Up.eofInDoctype),this._createDoctypeToken(null);let e=this.currentToken;e.forceQuirks=!0,this.emitCurrentDoctype(e),this._emitEOFToken();break}default:this._err(Up.missingWhitespaceBeforeDoctypeName),this.state=Y.BEFORE_DOCTYPE_NAME,this._stateBeforeDoctypeName(e)}}_stateBeforeDoctypeName(e){if(am(e))this._createDoctypeToken(String.fromCharCode(sm(e))),this.state=Y.DOCTYPE_NAME;else switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:break;case K.NULL:this._err(Up.unexpectedNullCharacter),this._createDoctypeToken(`�`),this.state=Y.DOCTYPE_NAME;break;case K.GREATER_THAN_SIGN:{this._err(Up.missingDoctypeName),this._createDoctypeToken(null);let e=this.currentToken;e.forceQuirks=!0,this.emitCurrentDoctype(e),this.state=Y.DATA;break}case K.EOF:{this._err(Up.eofInDoctype),this._createDoctypeToken(null);let e=this.currentToken;e.forceQuirks=!0,this.emitCurrentDoctype(e),this._emitEOFToken();break}default:this._createDoctypeToken(String.fromCodePoint(e)),this.state=Y.DOCTYPE_NAME}}_stateDoctypeName(e){let t=this.currentToken;switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:this.state=Y.AFTER_DOCTYPE_NAME;break;case K.GREATER_THAN_SIGN:this.state=Y.DATA,this.emitCurrentDoctype(t);break;case K.NULL:this._err(Up.unexpectedNullCharacter),t.name+=`�`;break;case K.EOF:this._err(Up.eofInDoctype),t.forceQuirks=!0,this.emitCurrentDoctype(t),this._emitEOFToken();break;default:t.name+=String.fromCodePoint(am(e)?sm(e):e)}}_stateAfterDoctypeName(e){let t=this.currentToken;switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:break;case K.GREATER_THAN_SIGN:this.state=Y.DATA,this.emitCurrentDoctype(t);break;case K.EOF:this._err(Up.eofInDoctype),t.forceQuirks=!0,this.emitCurrentDoctype(t),this._emitEOFToken();break;default:this._consumeSequenceIfMatch(Vp.PUBLIC,!1)?this.state=Y.AFTER_DOCTYPE_PUBLIC_KEYWORD:this._consumeSequenceIfMatch(Vp.SYSTEM,!1)?this.state=Y.AFTER_DOCTYPE_SYSTEM_KEYWORD:this._ensureHibernation()||(this._err(Up.invalidCharacterSequenceAfterDoctypeName),t.forceQuirks=!0,this.state=Y.BOGUS_DOCTYPE,this._stateBogusDoctype(e))}}_stateAfterDoctypePublicKeyword(e){let t=this.currentToken;switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:this.state=Y.BEFORE_DOCTYPE_PUBLIC_IDENTIFIER;break;case K.QUOTATION_MARK:this._err(Up.missingWhitespaceAfterDoctypePublicKeyword),t.publicId=``,this.state=Y.DOCTYPE_PUBLIC_IDENTIFIER_DOUBLE_QUOTED;break;case K.APOSTROPHE:this._err(Up.missingWhitespaceAfterDoctypePublicKeyword),t.publicId=``,this.state=Y.DOCTYPE_PUBLIC_IDENTIFIER_SINGLE_QUOTED;break;case K.GREATER_THAN_SIGN:this._err(Up.missingDoctypePublicIdentifier),t.forceQuirks=!0,this.state=Y.DATA,this.emitCurrentDoctype(t);break;case K.EOF:this._err(Up.eofInDoctype),t.forceQuirks=!0,this.emitCurrentDoctype(t),this._emitEOFToken();break;default:this._err(Up.missingQuoteBeforeDoctypePublicIdentifier),t.forceQuirks=!0,this.state=Y.BOGUS_DOCTYPE,this._stateBogusDoctype(e)}}_stateBeforeDoctypePublicIdentifier(e){let t=this.currentToken;switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:break;case K.QUOTATION_MARK:t.publicId=``,this.state=Y.DOCTYPE_PUBLIC_IDENTIFIER_DOUBLE_QUOTED;break;case K.APOSTROPHE:t.publicId=``,this.state=Y.DOCTYPE_PUBLIC_IDENTIFIER_SINGLE_QUOTED;break;case K.GREATER_THAN_SIGN:this._err(Up.missingDoctypePublicIdentifier),t.forceQuirks=!0,this.state=Y.DATA,this.emitCurrentDoctype(t);break;case K.EOF:this._err(Up.eofInDoctype),t.forceQuirks=!0,this.emitCurrentDoctype(t),this._emitEOFToken();break;default:this._err(Up.missingQuoteBeforeDoctypePublicIdentifier),t.forceQuirks=!0,this.state=Y.BOGUS_DOCTYPE,this._stateBogusDoctype(e)}}_stateDoctypePublicIdentifierDoubleQuoted(e){let t=this.currentToken;switch(e){case K.QUOTATION_MARK:this.state=Y.AFTER_DOCTYPE_PUBLIC_IDENTIFIER;break;case K.NULL:this._err(Up.unexpectedNullCharacter),t.publicId+=`�`;break;case K.GREATER_THAN_SIGN:this._err(Up.abruptDoctypePublicIdentifier),t.forceQuirks=!0,this.emitCurrentDoctype(t),this.state=Y.DATA;break;case K.EOF:this._err(Up.eofInDoctype),t.forceQuirks=!0,this.emitCurrentDoctype(t),this._emitEOFToken();break;default:t.publicId+=String.fromCodePoint(e)}}_stateDoctypePublicIdentifierSingleQuoted(e){let t=this.currentToken;switch(e){case K.APOSTROPHE:this.state=Y.AFTER_DOCTYPE_PUBLIC_IDENTIFIER;break;case K.NULL:this._err(Up.unexpectedNullCharacter),t.publicId+=`�`;break;case K.GREATER_THAN_SIGN:this._err(Up.abruptDoctypePublicIdentifier),t.forceQuirks=!0,this.emitCurrentDoctype(t),this.state=Y.DATA;break;case K.EOF:this._err(Up.eofInDoctype),t.forceQuirks=!0,this.emitCurrentDoctype(t),this._emitEOFToken();break;default:t.publicId+=String.fromCodePoint(e)}}_stateAfterDoctypePublicIdentifier(e){let t=this.currentToken;switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:this.state=Y.BETWEEN_DOCTYPE_PUBLIC_AND_SYSTEM_IDENTIFIERS;break;case K.GREATER_THAN_SIGN:this.state=Y.DATA,this.emitCurrentDoctype(t);break;case K.QUOTATION_MARK:this._err(Up.missingWhitespaceBetweenDoctypePublicAndSystemIdentifiers),t.systemId=``,this.state=Y.DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED;break;case K.APOSTROPHE:this._err(Up.missingWhitespaceBetweenDoctypePublicAndSystemIdentifiers),t.systemId=``,this.state=Y.DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED;break;case K.EOF:this._err(Up.eofInDoctype),t.forceQuirks=!0,this.emitCurrentDoctype(t),this._emitEOFToken();break;default:this._err(Up.missingQuoteBeforeDoctypeSystemIdentifier),t.forceQuirks=!0,this.state=Y.BOGUS_DOCTYPE,this._stateBogusDoctype(e)}}_stateBetweenDoctypePublicAndSystemIdentifiers(e){let t=this.currentToken;switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:break;case K.GREATER_THAN_SIGN:this.emitCurrentDoctype(t),this.state=Y.DATA;break;case K.QUOTATION_MARK:t.systemId=``,this.state=Y.DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED;break;case K.APOSTROPHE:t.systemId=``,this.state=Y.DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED;break;case K.EOF:this._err(Up.eofInDoctype),t.forceQuirks=!0,this.emitCurrentDoctype(t),this._emitEOFToken();break;default:this._err(Up.missingQuoteBeforeDoctypeSystemIdentifier),t.forceQuirks=!0,this.state=Y.BOGUS_DOCTYPE,this._stateBogusDoctype(e)}}_stateAfterDoctypeSystemKeyword(e){let t=this.currentToken;switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:this.state=Y.BEFORE_DOCTYPE_SYSTEM_IDENTIFIER;break;case K.QUOTATION_MARK:this._err(Up.missingWhitespaceAfterDoctypeSystemKeyword),t.systemId=``,this.state=Y.DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED;break;case K.APOSTROPHE:this._err(Up.missingWhitespaceAfterDoctypeSystemKeyword),t.systemId=``,this.state=Y.DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED;break;case K.GREATER_THAN_SIGN:this._err(Up.missingDoctypeSystemIdentifier),t.forceQuirks=!0,this.state=Y.DATA,this.emitCurrentDoctype(t);break;case K.EOF:this._err(Up.eofInDoctype),t.forceQuirks=!0,this.emitCurrentDoctype(t),this._emitEOFToken();break;default:this._err(Up.missingQuoteBeforeDoctypeSystemIdentifier),t.forceQuirks=!0,this.state=Y.BOGUS_DOCTYPE,this._stateBogusDoctype(e)}}_stateBeforeDoctypeSystemIdentifier(e){let t=this.currentToken;switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:break;case K.QUOTATION_MARK:t.systemId=``,this.state=Y.DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED;break;case K.APOSTROPHE:t.systemId=``,this.state=Y.DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED;break;case K.GREATER_THAN_SIGN:this._err(Up.missingDoctypeSystemIdentifier),t.forceQuirks=!0,this.state=Y.DATA,this.emitCurrentDoctype(t);break;case K.EOF:this._err(Up.eofInDoctype),t.forceQuirks=!0,this.emitCurrentDoctype(t),this._emitEOFToken();break;default:this._err(Up.missingQuoteBeforeDoctypeSystemIdentifier),t.forceQuirks=!0,this.state=Y.BOGUS_DOCTYPE,this._stateBogusDoctype(e)}}_stateDoctypeSystemIdentifierDoubleQuoted(e){let t=this.currentToken;switch(e){case K.QUOTATION_MARK:this.state=Y.AFTER_DOCTYPE_SYSTEM_IDENTIFIER;break;case K.NULL:this._err(Up.unexpectedNullCharacter),t.systemId+=`�`;break;case K.GREATER_THAN_SIGN:this._err(Up.abruptDoctypeSystemIdentifier),t.forceQuirks=!0,this.emitCurrentDoctype(t),this.state=Y.DATA;break;case K.EOF:this._err(Up.eofInDoctype),t.forceQuirks=!0,this.emitCurrentDoctype(t),this._emitEOFToken();break;default:t.systemId+=String.fromCodePoint(e)}}_stateDoctypeSystemIdentifierSingleQuoted(e){let t=this.currentToken;switch(e){case K.APOSTROPHE:this.state=Y.AFTER_DOCTYPE_SYSTEM_IDENTIFIER;break;case K.NULL:this._err(Up.unexpectedNullCharacter),t.systemId+=`�`;break;case K.GREATER_THAN_SIGN:this._err(Up.abruptDoctypeSystemIdentifier),t.forceQuirks=!0,this.emitCurrentDoctype(t),this.state=Y.DATA;break;case K.EOF:this._err(Up.eofInDoctype),t.forceQuirks=!0,this.emitCurrentDoctype(t),this._emitEOFToken();break;default:t.systemId+=String.fromCodePoint(e)}}_stateAfterDoctypeSystemIdentifier(e){let t=this.currentToken;switch(e){case K.SPACE:case K.LINE_FEED:case K.TABULATION:case K.FORM_FEED:break;case K.GREATER_THAN_SIGN:this.emitCurrentDoctype(t),this.state=Y.DATA;break;case K.EOF:this._err(Up.eofInDoctype),t.forceQuirks=!0,this.emitCurrentDoctype(t),this._emitEOFToken();break;default:this._err(Up.unexpectedCharacterAfterDoctypeSystemIdentifier),this.state=Y.BOGUS_DOCTYPE,this._stateBogusDoctype(e)}}_stateBogusDoctype(e){let t=this.currentToken;switch(e){case K.GREATER_THAN_SIGN:this.emitCurrentDoctype(t),this.state=Y.DATA;break;case K.NULL:this._err(Up.unexpectedNullCharacter);break;case K.EOF:this.emitCurrentDoctype(t),this._emitEOFToken();break;default:}}_stateCdataSection(e){switch(e){case K.RIGHT_SQUARE_BRACKET:this.state=Y.CDATA_SECTION_BRACKET;break;case K.EOF:this._err(Up.eofInCdata),this._emitEOFToken();break;default:this._emitCodePoint(e)}}_stateCdataSectionBracket(e){e===K.RIGHT_SQUARE_BRACKET?this.state=Y.CDATA_SECTION_END:(this._emitChars(`]`),this.state=Y.CDATA_SECTION,this._stateCdataSection(e))}_stateCdataSectionEnd(e){switch(e){case K.GREATER_THAN_SIGN:this.state=Y.DATA;break;case K.RIGHT_SQUARE_BRACKET:this._emitChars(`]`);break;default:this._emitChars(`]]`),this.state=Y.CDATA_SECTION,this._stateCdataSection(e)}}_stateCharacterReference(){let e=this.entityDecoder.write(this.preprocessor.html,this.preprocessor.pos);if(e<0)if(this.preprocessor.lastChunkWritten)e=this.entityDecoder.end();else{this.active=!1,this.preprocessor.pos=this.preprocessor.html.length-1,this.consumedAfterSnapshot=0,this.preprocessor.endOfChunkHit=!0;return}e===0?(this.preprocessor.pos=this.entityStartPos,this._flushCodePointConsumedAsCharacterReference(K.AMPERSAND),this.state=!this._isCharacterReferenceInAttribute()&&Zbe(this.preprocessor.peek(1))?Y.AMBIGUOUS_AMPERSAND:this.returnState):this.state=this.returnState}_stateAmbiguousAmpersand(e){Zbe(e)?this._flushCodePointConsumedAsCharacterReference(e):(e===K.SEMICOLON&&this._err(Up.unknownNamedCharacterReference),this.state=this.returnState,this._callState(e))}}})),lm,um,dm,rxe,ixe,fm,pm,axe,oxe,sxe,cxe,lxe,uxe=s((()=>{im(),lm=new Set([J.DD,J.DT,J.LI,J.OPTGROUP,J.OPTION,J.P,J.RB,J.RP,J.RT,J.RTC]),um=new Set([...lm,J.CAPTION,J.COLGROUP,J.TBODY,J.TD,J.TFOOT,J.TH,J.THEAD,J.TR]),dm=new Set([J.APPLET,J.CAPTION,J.HTML,J.MARQUEE,J.OBJECT,J.TABLE,J.TD,J.TEMPLATE,J.TH]),rxe=new Set([...dm,J.OL,J.UL]),ixe=new Set([...dm,J.BUTTON]),fm=new Set([J.ANNOTATION_XML,J.MI,J.MN,J.MO,J.MS,J.MTEXT]),pm=new Set([J.DESC,J.FOREIGN_OBJECT,J.TITLE]),axe=new Set([J.TR,J.TEMPLATE,J.HTML]),oxe=new Set([J.TBODY,J.TFOOT,J.THEAD,J.TEMPLATE,J.HTML]),sxe=new Set([J.TABLE,J.TEMPLATE,J.HTML]),cxe=new Set([J.TD,J.TH]),lxe=class{get currentTmplContentOrNode(){return this._isInTemplate()?this.treeAdapter.getTemplateContent(this.current):this.current}constructor(e,t,n){this.treeAdapter=t,this.handler=n,this.items=[],this.tagIDs=[],this.stackTop=-1,this.tmplCount=0,this.currentTagId=J.UNKNOWN,this.current=e}_indexOf(e){return this.items.lastIndexOf(e,this.stackTop)}_isInTemplate(){return this.currentTagId===J.TEMPLATE&&this.treeAdapter.getNamespaceURI(this.current)===$p.HTML}_updateCurrentElement(){this.current=this.items[this.stackTop],this.currentTagId=this.tagIDs[this.stackTop]}push(e,t){this.stackTop++,this.items[this.stackTop]=e,this.current=e,this.tagIDs[this.stackTop]=t,this.currentTagId=t,this._isInTemplate()&&this.tmplCount++,this.handler.onItemPush(e,t,!0)}pop(){let e=this.current;this.tmplCount>0&&this._isInTemplate()&&this.tmplCount--,this.stackTop--,this._updateCurrentElement(),this.handler.onItemPop(e,!0)}replace(e,t){let n=this._indexOf(e);this.items[n]=t,n===this.stackTop&&(this.current=t)}insertAfter(e,t,n){let r=this._indexOf(e)+1;this.items.splice(r,0,t),this.tagIDs.splice(r,0,n),this.stackTop++,r===this.stackTop&&this._updateCurrentElement(),this.current&&this.currentTagId!==void 0&&this.handler.onItemPush(this.current,this.currentTagId,r===this.stackTop)}popUntilTagNamePopped(e){let t=this.stackTop+1;do t=this.tagIDs.lastIndexOf(e,t-1);while(t>0&&this.treeAdapter.getNamespaceURI(this.items[t])!==$p.HTML);this.shortenToLength(Math.max(t,0))}shortenToLength(e){for(;this.stackTop>=e;){let t=this.current;this.tmplCount>0&&this._isInTemplate()&&--this.tmplCount,this.stackTop--,this._updateCurrentElement(),this.handler.onItemPop(t,this.stackTop<e)}}popUntilElementPopped(e){let t=this._indexOf(e);this.shortenToLength(Math.max(t,0))}popUntilPopped(e,t){let n=this._indexOfTagNames(e,t);this.shortenToLength(Math.max(n,0))}popUntilNumberedHeaderPopped(){this.popUntilPopped(rm,$p.HTML)}popUntilTableCellPopped(){this.popUntilPopped(cxe,$p.HTML)}popAllUpToHtmlElement(){this.tmplCount=0,this.shortenToLength(1)}_indexOfTagNames(e,t){for(let n=this.stackTop;n>=0;n--)if(e.has(this.tagIDs[n])&&this.treeAdapter.getNamespaceURI(this.items[n])===t)return n;return-1}clearBackTo(e,t){let n=this._indexOfTagNames(e,t);this.shortenToLength(n+1)}clearBackToTableContext(){this.clearBackTo(sxe,$p.HTML)}clearBackToTableBodyContext(){this.clearBackTo(oxe,$p.HTML)}clearBackToTableRowContext(){this.clearBackTo(axe,$p.HTML)}remove(e){let t=this._indexOf(e);t>=0&&(t===this.stackTop?this.pop():(this.items.splice(t,1),this.tagIDs.splice(t,1),this.stackTop--,this._updateCurrentElement(),this.handler.onItemPop(e,!1)))}tryPeekProperlyNestedBodyElement(){return this.stackTop>=1&&this.tagIDs[1]===J.BODY?this.items[1]:null}contains(e){return this._indexOf(e)>-1}getCommonAncestor(e){let t=this._indexOf(e)-1;return t>=0?this.items[t]:null}isRootHtmlElementCurrent(){return this.stackTop===0&&this.tagIDs[0]===J.HTML}hasInDynamicScope(e,t){for(let n=this.stackTop;n>=0;n--){let r=this.tagIDs[n];switch(this.treeAdapter.getNamespaceURI(this.items[n])){case $p.HTML:if(r===e)return!0;if(t.has(r))return!1;break;case $p.SVG:if(pm.has(r))return!1;break;case $p.MATHML:if(fm.has(r))return!1;break}}return!0}hasInScope(e){return this.hasInDynamicScope(e,dm)}hasInListItemScope(e){return this.hasInDynamicScope(e,rxe)}hasInButtonScope(e){return this.hasInDynamicScope(e,ixe)}hasNumberedHeaderInScope(){for(let e=this.stackTop;e>=0;e--){let t=this.tagIDs[e];switch(this.treeAdapter.getNamespaceURI(this.items[e])){case $p.HTML:if(rm.has(t))return!0;if(dm.has(t))return!1;break;case $p.SVG:if(pm.has(t))return!1;break;case $p.MATHML:if(fm.has(t))return!1;break}}return!0}hasInTableScope(e){for(let t=this.stackTop;t>=0;t--)if(this.treeAdapter.getNamespaceURI(this.items[t])===$p.HTML)switch(this.tagIDs[t]){case e:return!0;case J.TABLE:case J.HTML:return!1}return!0}hasTableBodyContextInTableScope(){for(let e=this.stackTop;e>=0;e--)if(this.treeAdapter.getNamespaceURI(this.items[e])===$p.HTML)switch(this.tagIDs[e]){case J.TBODY:case J.THEAD:case J.TFOOT:return!0;case J.TABLE:case J.HTML:return!1}return!0}hasInSelectScope(e){for(let t=this.stackTop;t>=0;t--)if(this.treeAdapter.getNamespaceURI(this.items[t])===$p.HTML)switch(this.tagIDs[t]){case e:return!0;case J.OPTION:case J.OPTGROUP:break;default:return!1}return!0}generateImpliedEndTags(){for(;this.currentTagId!==void 0&&lm.has(this.currentTagId);)this.pop()}generateImpliedEndTagsThoroughly(){for(;this.currentTagId!==void 0&&um.has(this.currentTagId);)this.pop()}generateImpliedEndTagsWithExclusion(e){for(;this.currentTagId!==void 0&&this.currentTagId!==e&&um.has(this.currentTagId);)this.pop()}}})),mm,hm,gm,dxe,fxe=s((()=>{mm=3,(function(e){e[e.Marker=0]=`Marker`,e[e.Element=1]=`Element`})(hm||={}),gm={type:hm.Marker},dxe=class{constructor(e){this.treeAdapter=e,this.entries=[],this.bookmark=null}_getNoahArkConditionCandidates(e,t){let n=[],r=t.length,i=this.treeAdapter.getTagName(e),a=this.treeAdapter.getNamespaceURI(e);for(let e=0;e<this.entries.length;e++){let t=this.entries[e];if(t.type===hm.Marker)break;let{element:o}=t;if(this.treeAdapter.getTagName(o)===i&&this.treeAdapter.getNamespaceURI(o)===a){let t=this.treeAdapter.getAttrList(o);t.length===r&&n.push({idx:e,attrs:t})}}return n}_ensureNoahArkCondition(e){if(this.entries.length<mm)return;let t=this.treeAdapter.getAttrList(e),n=this._getNoahArkConditionCandidates(e,t);if(n.length<mm)return;let r=new Map(t.map(e=>[e.name,e.value])),i=0;for(let e=0;e<n.length;e++){let t=n[e];t.attrs.every(e=>r.get(e.name)===e.value)&&(i+=1,i>=mm&&this.entries.splice(t.idx,1))}}insertMarker(){this.entries.unshift(gm)}pushElement(e,t){this._ensureNoahArkCondition(e),this.entries.unshift({type:hm.Element,element:e,token:t})}insertElementAfterBookmark(e,t){let n=this.entries.indexOf(this.bookmark);this.entries.splice(n,0,{type:hm.Element,element:e,token:t})}removeEntry(e){let t=this.entries.indexOf(e);t!==-1&&this.entries.splice(t,1)}clearToLastMarker(){let e=this.entries.indexOf(gm);e===-1?this.entries.length=0:this.entries.splice(0,e+1)}getElementEntryInScopeWithTagName(e){let t=this.entries.find(t=>t.type===hm.Marker||this.treeAdapter.getTagName(t.element)===e);return t&&t.type===hm.Element?t:null}getElementEntry(e){return this.entries.find(t=>t.type===hm.Element&&t.element===e)}}})),_m,vm=s((()=>{im(),_m={createDocument(){return{nodeName:`#document`,mode:tm.NO_QUIRKS,childNodes:[]}},createDocumentFragment(){return{nodeName:`#document-fragment`,childNodes:[]}},createElement(e,t,n){return{nodeName:e,tagName:e,attrs:n,namespaceURI:t,childNodes:[],parentNode:null}},createCommentNode(e){return{nodeName:`#comment`,data:e,parentNode:null}},createTextNode(e){return{nodeName:`#text`,value:e,parentNode:null}},appendChild(e,t){e.childNodes.push(t),t.parentNode=e},insertBefore(e,t,n){let r=e.childNodes.indexOf(n);e.childNodes.splice(r,0,t),t.parentNode=e},setTemplateContent(e,t){e.content=t},getTemplateContent(e){return e.content},setDocumentType(e,t,n,r){let i=e.childNodes.find(e=>e.nodeName===`#documentType`);if(i)i.name=t,i.publicId=n,i.systemId=r;else{let i={nodeName:`#documentType`,name:t,publicId:n,systemId:r,parentNode:null};_m.appendChild(e,i)}},setDocumentMode(e,t){e.mode=t},getDocumentMode(e){return e.mode},detachNode(e){if(e.parentNode){let t=e.parentNode.childNodes.indexOf(e);e.parentNode.childNodes.splice(t,1),e.parentNode=null}},insertText(e,t){if(e.childNodes.length>0){let n=e.childNodes[e.childNodes.length-1];if(_m.isTextNode(n)){n.value+=t;return}}_m.appendChild(e,_m.createTextNode(t))},insertTextBefore(e,t,n){let r=e.childNodes[e.childNodes.indexOf(n)-1];r&&_m.isTextNode(r)?r.value+=t:_m.insertBefore(e,_m.createTextNode(t),n)},adoptAttributes(e,t){let n=new Set(e.attrs.map(e=>e.name));for(let r=0;r<t.length;r++)n.has(t[r].name)||e.attrs.push(t[r])},getFirstChild(e){return e.childNodes[0]},getChildNodes(e){return e.childNodes},getParentNode(e){return e.parentNode},getAttrList(e){return e.attrs},getTagName(e){return e.tagName},getNamespaceURI(e){return e.namespaceURI},getTextNodeContent(e){return e.value},getCommentNodeContent(e){return e.data},getDocumentTypeNodeName(e){return e.name},getDocumentTypeNodePublicId(e){return e.publicId},getDocumentTypeNodeSystemId(e){return e.systemId},isTextNode(e){return e.nodeName===`#text`},isCommentNode(e){return e.nodeName===`#comment`},isDocumentTypeNode(e){return e.nodeName===`#documentType`},isElementNode(e){return Object.prototype.hasOwnProperty.call(e,`tagName`)},setNodeSourceCodeLocation(e,t){e.sourceCodeLocation=t},getNodeSourceCodeLocation(e){return e.sourceCodeLocation},updateNodeSourceCodeLocation(e,t){e.sourceCodeLocation={...e.sourceCodeLocation,...t}}}}));function pxe(e,t){return t.some(t=>e.startsWith(t))}function mxe(e){return e.name===ym&&e.publicId===null&&(e.systemId===null||e.systemId===gxe)}function hxe(e){if(e.name!==ym)return tm.QUIRKS;let{systemId:t}=e;if(t&&t.toLowerCase()===_xe)return tm.QUIRKS;let{publicId:n}=e;if(n!==null){if(n=n.toLowerCase(),yxe.has(n))return tm.QUIRKS;let e=t===null?vxe:bm;if(pxe(n,e))return tm.QUIRKS;if(e=t===null?xm:bxe,pxe(n,e))return tm.LIMITED_QUIRKS}return tm.NO_QUIRKS}var ym,gxe,_xe,bm,vxe,yxe,xm,bxe,xxe=s((()=>{im(),ym=`html`,gxe=`about:legacy-compat`,_xe=`http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd`,bm=`+//silmaril//dtd html pro v0r11 19970101//,-//as//dtd html 3.0 aswedit + extensions//,-//advasoft ltd//dtd html 3.0 aswedit + extensions//,-//ietf//dtd html 2.0 level 1//,-//ietf//dtd html 2.0 level 2//,-//ietf//dtd html 2.0 strict level 1//,-//ietf//dtd html 2.0 strict level 2//,-//ietf//dtd html 2.0 strict//,-//ietf//dtd html 2.0//,-//ietf//dtd html 2.1e//,-//ietf//dtd html 3.0//,-//ietf//dtd html 3.2 final//,-//ietf//dtd html 3.2//,-//ietf//dtd html 3//,-//ietf//dtd html level 0//,-//ietf//dtd html level 1//,-//ietf//dtd html level 2//,-//ietf//dtd html level 3//,-//ietf//dtd html strict level 0//,-//ietf//dtd html strict level 1//,-//ietf//dtd html strict level 2//,-//ietf//dtd html strict level 3//,-//ietf//dtd html strict//,-//ietf//dtd html//,-//metrius//dtd metrius presentational//,-//microsoft//dtd internet explorer 2.0 html strict//,-//microsoft//dtd internet explorer 2.0 html//,-//microsoft//dtd internet explorer 2.0 tables//,-//microsoft//dtd internet explorer 3.0 html strict//,-//microsoft//dtd internet explorer 3.0 html//,-//microsoft//dtd internet explorer 3.0 tables//,-//netscape comm. corp.//dtd html//,-//netscape comm. corp.//dtd strict html//,-//o'reilly and associates//dtd html 2.0//,-//o'reilly and associates//dtd html extended 1.0//,-//o'reilly and associates//dtd html extended relaxed 1.0//,-//sq//dtd html 2.0 hotmetal + extensions//,-//softquad software//dtd hotmetal pro 6.0::19990601::extensions to html 4.0//,-//softquad//dtd hotmetal pro 4.0::19971010::extensions to html 4.0//,-//spyglass//dtd html 2.0 extended//,-//sun microsystems corp.//dtd hotjava html//,-//sun microsystems corp.//dtd hotjava strict html//,-//w3c//dtd html 3 1995-03-24//,-//w3c//dtd html 3.2 draft//,-//w3c//dtd html 3.2 final//,-//w3c//dtd html 3.2//,-//w3c//dtd html 3.2s draft//,-//w3c//dtd html 4.0 frameset//,-//w3c//dtd html 4.0 transitional//,-//w3c//dtd html experimental 19960712//,-//w3c//dtd html experimental 970421//,-//w3c//dtd w3 html//,-//w3o//dtd w3 html 3.0//,-//webtechs//dtd mozilla html 2.0//,-//webtechs//dtd mozilla html//`.split(`,`),vxe=[...bm,`-//w3c//dtd html 4.01 frameset//`,`-//w3c//dtd html 4.01 transitional//`],yxe=new Set([`-//w3o//dtd w3 html strict 3.0//en//`,`-/w3c/dtd html 4.0 transitional/en`,`html`]),xm=[`-//w3c//dtd xhtml 1.0 frameset//`,`-//w3c//dtd xhtml 1.0 transitional//`],bxe=[...xm,`-//w3c//dtd html 4.01 frameset//`,`-//w3c//dtd html 4.01 transitional//`]}));function Sxe(e){let t=e.tagID;return t===J.FONT&&e.attrs.some(({name:e})=>e===em.COLOR||e===em.SIZE||e===em.FACE)||Pxe.has(t)}function Cxe(e){for(let t=0;t<e.attrs.length;t++)if(e.attrs[t].name===kxe){e.attrs[t].name=Axe;break}}function wxe(e){for(let t=0;t<e.attrs.length;t++){let n=jxe.get(e.attrs[t].name);n!=null&&(e.attrs[t].name=n)}}function Sm(e){for(let t=0;t<e.attrs.length;t++){let n=Mxe.get(e.attrs[t].name);n&&(e.attrs[t].prefix=n.prefix,e.attrs[t].name=n.name,e.attrs[t].namespace=n.namespace)}}function Txe(e){let t=Nxe.get(e.tagName);t!=null&&(e.tagName=t,e.tagID=Qp(e.tagName))}function Exe(e,t){return t===$p.MATHML&&(e===J.MI||e===J.MO||e===J.MN||e===J.MS||e===J.MTEXT)}function Dxe(e,t,n){if(t===$p.MATHML&&e===J.ANNOTATION_XML){for(let e=0;e<n.length;e++)if(n[e].name===em.ENCODING){let t=n[e].value.toLowerCase();return t===Cm.TEXT_HTML||t===Cm.APPLICATION_XML}}return t===$p.SVG&&(e===J.FOREIGN_OBJECT||e===J.DESC||e===J.TITLE)}function Oxe(e,t,n,r){return(!r||r===$p.HTML)&&Dxe(e,t,n)||(!r||r===$p.MATHML)&&Exe(e,t)}var Cm,kxe,Axe,jxe,Mxe,Nxe,Pxe,Fxe=s((()=>{im(),Cm={TEXT_HTML:`text/html`,APPLICATION_XML:`application/xhtml+xml`},kxe=`definitionurl`,Axe=`definitionURL`,jxe=new Map(`attributeName.attributeType.baseFrequency.baseProfile.calcMode.clipPathUnits.diffuseConstant.edgeMode.filterUnits.glyphRef.gradientTransform.gradientUnits.kernelMatrix.kernelUnitLength.keyPoints.keySplines.keyTimes.lengthAdjust.limitingConeAngle.markerHeight.markerUnits.markerWidth.maskContentUnits.maskUnits.numOctaves.pathLength.patternContentUnits.patternTransform.patternUnits.pointsAtX.pointsAtY.pointsAtZ.preserveAlpha.preserveAspectRatio.primitiveUnits.refX.refY.repeatCount.repeatDur.requiredExtensions.requiredFeatures.specularConstant.specularExponent.spreadMethod.startOffset.stdDeviation.stitchTiles.surfaceScale.systemLanguage.tableValues.targetX.targetY.textLength.viewBox.viewTarget.xChannelSelector.yChannelSelector.zoomAndPan`.split(`.`).map(e=>[e.toLowerCase(),e])),Mxe=new Map([[`xlink:actuate`,{prefix:`xlink`,name:`actuate`,namespace:$p.XLINK}],[`xlink:arcrole`,{prefix:`xlink`,name:`arcrole`,namespace:$p.XLINK}],[`xlink:href`,{prefix:`xlink`,name:`href`,namespace:$p.XLINK}],[`xlink:role`,{prefix:`xlink`,name:`role`,namespace:$p.XLINK}],[`xlink:show`,{prefix:`xlink`,name:`show`,namespace:$p.XLINK}],[`xlink:title`,{prefix:`xlink`,name:`title`,namespace:$p.XLINK}],[`xlink:type`,{prefix:`xlink`,name:`type`,namespace:$p.XLINK}],[`xml:lang`,{prefix:`xml`,name:`lang`,namespace:$p.XML}],[`xml:space`,{prefix:`xml`,name:`space`,namespace:$p.XML}],[`xmlns`,{prefix:``,name:`xmlns`,namespace:$p.XMLNS}],[`xmlns:xlink`,{prefix:`xmlns`,name:`xlink`,namespace:$p.XMLNS}]]),Nxe=new Map(`altGlyph.altGlyphDef.altGlyphItem.animateColor.animateMotion.animateTransform.clipPath.feBlend.feColorMatrix.feComponentTransfer.feComposite.feConvolveMatrix.feDiffuseLighting.feDisplacementMap.feDistantLight.feFlood.feFuncA.feFuncB.feFuncG.feFuncR.feGaussianBlur.feImage.feMerge.feMergeNode.feMorphology.feOffset.fePointLight.feSpecularLighting.feSpotLight.feTile.feTurbulence.foreignObject.glyphRef.linearGradient.radialGradient.textPath`.split(`.`).map(e=>[e.toLowerCase(),e])),Pxe=new Set([J.B,J.BIG,J.BLOCKQUOTE,J.BODY,J.BR,J.CENTER,J.CODE,J.DD,J.DIV,J.DL,J.DT,J.EM,J.EMBED,J.H1,J.H2,J.H3,J.H4,J.H5,J.H6,J.HEAD,J.HR,J.I,J.IMG,J.LI,J.LISTING,J.MENU,J.META,J.NOBR,J.OL,J.P,J.PRE,J.RUBY,J.S,J.SMALL,J.SPAN,J.STRONG,J.STRIKE,J.SUB,J.SUP,J.TABLE,J.TT,J.U,J.UL,J.VAR])}));function Ixe(e,t){let n=e.activeFormattingElements.getElementEntryInScopeWithTagName(t.tagName);return n?e.openElements.contains(n.element)?e.openElements.hasInScope(t.tagID)||(n=null):(e.activeFormattingElements.removeEntry(n),n=null):WSe(e,t),n}function Lxe(e,t){let n=null,r=e.openElements.stackTop;for(;r>=0;r--){let i=e.openElements.items[r];if(i===t.element)break;e._isSpecialElement(i,e.openElements.tagIDs[r])&&(n=i)}return n||(e.openElements.shortenToLength(Math.max(r,0)),e.activeFormattingElements.removeEntry(t)),n}function Rxe(e,t,n){let r=t,i=e.openElements.getCommonAncestor(t);for(let a=0,o=i;o!==n;a++,o=i){i=e.openElements.getCommonAncestor(o);let n=e.activeFormattingElements.getElementEntry(o),s=n&&a>=MCe;!n||s?(s&&e.activeFormattingElements.removeEntry(n),e.openElements.remove(o)):(o=zxe(e,n),r===t&&(e.activeFormattingElements.bookmark=n),e.treeAdapter.detachNode(r),e.treeAdapter.appendChild(o,r),r=o)}return r}function zxe(e,t){let n=e.treeAdapter.getNamespaceURI(t.element),r=e.treeAdapter.createElement(t.token.tagName,n,t.token.attrs);return e.openElements.replace(t.element,r),t.element=r,r}function Bxe(e,t,n){let r=Qp(e.treeAdapter.getTagName(t));if(e._isElementCausesFosterParenting(r))e._fosterParentElement(n);else{let i=e.treeAdapter.getNamespaceURI(t);r===J.TEMPLATE&&i===$p.HTML&&(t=e.treeAdapter.getTemplateContent(t)),e.treeAdapter.appendChild(t,n)}}function Vxe(e,t,n){let r=e.treeAdapter.getNamespaceURI(n.element),{token:i}=n,a=e.treeAdapter.createElement(i.tagName,r,i.attrs);e._adoptNodes(t,a),e.treeAdapter.appendChild(t,a),e.activeFormattingElements.insertElementAfterBookmark(a,i),e.activeFormattingElements.removeEntry(n),e.openElements.remove(n.element),e.openElements.insertAfter(t,a,i.tagID)}function wm(e,t){for(let n=0;n<jCe;n++){let n=Ixe(e,t);if(!n)break;let r=Lxe(e,n);if(!r)break;e.activeFormattingElements.bookmark=n;let i=Rxe(e,r,n.element),a=e.openElements.getCommonAncestor(n.element);e.treeAdapter.detachNode(i),a&&Bxe(e,a,i),Vxe(e,r,n)}}function Tm(e,t){e._appendCommentNode(t,e.openElements.currentTmplContentOrNode)}function Hxe(e,t){e._appendCommentNode(t,e.openElements.items[0])}function Uxe(e,t){e._appendCommentNode(t,e.document)}function Em(e,t){if(e.stopped=!0,t.location){let n=e.fragmentContext?0:2;for(let r=e.openElements.stackTop;r>=n;r--)e._setEndLocation(e.openElements.items[r],t);if(!e.fragmentContext&&e.openElements.stackTop>=0){let n=e.openElements.items[0],r=e.treeAdapter.getNodeSourceCodeLocation(n);if(r&&!r.endTag&&(e._setEndLocation(n,t),e.openElements.stackTop>=1)){let n=e.openElements.items[1],r=e.treeAdapter.getNodeSourceCodeLocation(n);r&&!r.endTag&&e._setEndLocation(n,t)}}}}function Wxe(e,t){e._setDocumentType(t);let n=t.forceQuirks?tm.QUIRKS:hxe(t);mxe(t)||e._err(t,Up.nonConformingDoctype),e.treeAdapter.setDocumentMode(e.document,n),e.insertionMode=X.BEFORE_HTML}function Dm(e,t){e._err(t,Up.missingDoctype,!0),e.treeAdapter.setDocumentMode(e.document,tm.QUIRKS),e.insertionMode=X.BEFORE_HTML,e._processToken(t)}function Gxe(e,t){t.tagID===J.HTML?(e._insertElement(t,$p.HTML),e.insertionMode=X.BEFORE_HEAD):Om(e,t)}function Kxe(e,t){let n=t.tagID;(n===J.HTML||n===J.HEAD||n===J.BODY||n===J.BR)&&Om(e,t)}function Om(e,t){e._insertFakeRootElement(),e.insertionMode=X.BEFORE_HEAD,e._processToken(t)}function qxe(e,t){switch(t.tagID){case J.HTML:Im(e,t);break;case J.HEAD:e._insertElement(t,$p.HTML),e.headElement=e.openElements.current,e.insertionMode=X.IN_HEAD;break;default:km(e,t)}}function Jxe(e,t){let n=t.tagID;n===J.HEAD||n===J.BODY||n===J.HTML||n===J.BR?km(e,t):e._err(t,Up.endTagWithoutMatchingOpenElement)}function km(e,t){e._insertFakeElement(q.HEAD,J.HEAD),e.headElement=e.openElements.current,e.insertionMode=X.IN_HEAD,e._processToken(t)}function Am(e,t){switch(t.tagID){case J.HTML:Im(e,t);break;case J.BASE:case J.BASEFONT:case J.BGSOUND:case J.LINK:case J.META:e._appendElement(t,$p.HTML),t.ackSelfClosing=!0;break;case J.TITLE:e._switchToTextParsing(t,cm.RCDATA);break;case J.NOSCRIPT:e.options.scriptingEnabled?e._switchToTextParsing(t,cm.RAWTEXT):(e._insertElement(t,$p.HTML),e.insertionMode=X.IN_HEAD_NO_SCRIPT);break;case J.NOFRAMES:case J.STYLE:e._switchToTextParsing(t,cm.RAWTEXT);break;case J.SCRIPT:e._switchToTextParsing(t,cm.SCRIPT_DATA);break;case J.TEMPLATE:e._insertTemplate(t),e.activeFormattingElements.insertMarker(),e.framesetOk=!1,e.insertionMode=X.IN_TEMPLATE,e.tmplInsertionModeStack.unshift(X.IN_TEMPLATE);break;case J.HEAD:e._err(t,Up.misplacedStartTagForHeadElement);break;default:Mm(e,t)}}function Yxe(e,t){switch(t.tagID){case J.HEAD:e.openElements.pop(),e.insertionMode=X.AFTER_HEAD;break;case J.BODY:case J.BR:case J.HTML:Mm(e,t);break;case J.TEMPLATE:jm(e,t);break;default:e._err(t,Up.endTagWithoutMatchingOpenElement)}}function jm(e,t){e.openElements.tmplCount>0?(e.openElements.generateImpliedEndTagsThoroughly(),e.openElements.currentTagId!==J.TEMPLATE&&e._err(t,Up.closingOfElementWithOpenChildElements),e.openElements.popUntilTagNamePopped(J.TEMPLATE),e.activeFormattingElements.clearToLastMarker(),e.tmplInsertionModeStack.shift(),e._resetInsertionMode()):e._err(t,Up.endTagWithoutMatchingOpenElement)}function Mm(e,t){e.openElements.pop(),e.insertionMode=X.AFTER_HEAD,e._processToken(t)}function Xxe(e,t){switch(t.tagID){case J.HTML:Im(e,t);break;case J.BASEFONT:case J.BGSOUND:case J.HEAD:case J.LINK:case J.META:case J.NOFRAMES:case J.STYLE:Am(e,t);break;case J.NOSCRIPT:e._err(t,Up.nestedNoscriptInHead);break;default:Nm(e,t)}}function Zxe(e,t){switch(t.tagID){case J.NOSCRIPT:e.openElements.pop(),e.insertionMode=X.IN_HEAD;break;case J.BR:Nm(e,t);break;default:e._err(t,Up.endTagWithoutMatchingOpenElement)}}function Nm(e,t){let n=t.type===Gp.EOF?Up.openElementsLeftAfterEof:Up.disallowedContentInNoscriptInHead;e._err(t,n),e.openElements.pop(),e.insertionMode=X.IN_HEAD,e._processToken(t)}function Qxe(e,t){switch(t.tagID){case J.HTML:Im(e,t);break;case J.BODY:e._insertElement(t,$p.HTML),e.framesetOk=!1,e.insertionMode=X.IN_BODY;break;case J.FRAMESET:e._insertElement(t,$p.HTML),e.insertionMode=X.IN_FRAMESET;break;case J.BASE:case J.BASEFONT:case J.BGSOUND:case J.LINK:case J.META:case J.NOFRAMES:case J.SCRIPT:case J.STYLE:case J.TEMPLATE:case J.TITLE:e._err(t,Up.abandonedHeadElementChild),e.openElements.push(e.headElement,J.HEAD),Am(e,t),e.openElements.remove(e.headElement);break;case J.HEAD:e._err(t,Up.misplacedStartTagForHeadElement);break;default:Pm(e,t)}}function $xe(e,t){switch(t.tagID){case J.BODY:case J.HTML:case J.BR:Pm(e,t);break;case J.TEMPLATE:jm(e,t);break;default:e._err(t,Up.endTagWithoutMatchingOpenElement)}}function Pm(e,t){e._insertFakeElement(q.BODY,J.BODY),e.insertionMode=X.IN_BODY,Fm(e,t)}function Fm(e,t){switch(t.type){case Gp.CHARACTER:tSe(e,t);break;case Gp.WHITESPACE_CHARACTER:eSe(e,t);break;case Gp.COMMENT:Tm(e,t);break;case Gp.START_TAG:Im(e,t);break;case Gp.END_TAG:Lm(e,t);break;case Gp.EOF:GSe(e,t);break;default:}}function eSe(e,t){e._reconstructActiveFormattingElements(),e._insertCharacters(t)}function tSe(e,t){e._reconstructActiveFormattingElements(),e._insertCharacters(t),e.framesetOk=!1}function nSe(e,t){e.openElements.tmplCount===0&&e.treeAdapter.adoptAttributes(e.openElements.items[0],t.attrs)}function rSe(e,t){let n=e.openElements.tryPeekProperlyNestedBodyElement();n&&e.openElements.tmplCount===0&&(e.framesetOk=!1,e.treeAdapter.adoptAttributes(n,t.attrs))}function iSe(e,t){let n=e.openElements.tryPeekProperlyNestedBodyElement();e.framesetOk&&n&&(e.treeAdapter.detachNode(n),e.openElements.popAllUpToHtmlElement(),e._insertElement(t,$p.HTML),e.insertionMode=X.IN_FRAMESET)}function aSe(e,t){e.openElements.hasInButtonScope(J.P)&&e._closePElement(),e._insertElement(t,$p.HTML)}function oSe(e,t){e.openElements.hasInButtonScope(J.P)&&e._closePElement(),e.openElements.currentTagId!==void 0&&rm.has(e.openElements.currentTagId)&&e.openElements.pop(),e._insertElement(t,$p.HTML)}function sSe(e,t){e.openElements.hasInButtonScope(J.P)&&e._closePElement(),e._insertElement(t,$p.HTML),e.skipNextNewLine=!0,e.framesetOk=!1}function cSe(e,t){let n=e.openElements.tmplCount>0;(!e.formElement||n)&&(e.openElements.hasInButtonScope(J.P)&&e._closePElement(),e._insertElement(t,$p.HTML),n||(e.formElement=e.openElements.current))}function lSe(e,t){e.framesetOk=!1;let n=t.tagID;for(let t=e.openElements.stackTop;t>=0;t--){let r=e.openElements.tagIDs[t];if(n===J.LI&&r===J.LI||(n===J.DD||n===J.DT)&&(r===J.DD||r===J.DT)){e.openElements.generateImpliedEndTagsWithExclusion(r),e.openElements.popUntilTagNamePopped(r);break}if(r!==J.ADDRESS&&r!==J.DIV&&r!==J.P&&e._isSpecialElement(e.openElements.items[t],r))break}e.openElements.hasInButtonScope(J.P)&&e._closePElement(),e._insertElement(t,$p.HTML)}function uSe(e,t){e.openElements.hasInButtonScope(J.P)&&e._closePElement(),e._insertElement(t,$p.HTML),e.tokenizer.state=cm.PLAINTEXT}function dSe(e,t){e.openElements.hasInScope(J.BUTTON)&&(e.openElements.generateImpliedEndTags(),e.openElements.popUntilTagNamePopped(J.BUTTON)),e._reconstructActiveFormattingElements(),e._insertElement(t,$p.HTML),e.framesetOk=!1}function fSe(e,t){let n=e.activeFormattingElements.getElementEntryInScopeWithTagName(q.A);n&&(wm(e,t),e.openElements.remove(n.element),e.activeFormattingElements.removeEntry(n)),e._reconstructActiveFormattingElements(),e._insertElement(t,$p.HTML),e.activeFormattingElements.pushElement(e.openElements.current,t)}function pSe(e,t){e._reconstructActiveFormattingElements(),e._insertElement(t,$p.HTML),e.activeFormattingElements.pushElement(e.openElements.current,t)}function mSe(e,t){e._reconstructActiveFormattingElements(),e.openElements.hasInScope(J.NOBR)&&(wm(e,t),e._reconstructActiveFormattingElements()),e._insertElement(t,$p.HTML),e.activeFormattingElements.pushElement(e.openElements.current,t)}function hSe(e,t){e._reconstructActiveFormattingElements(),e._insertElement(t,$p.HTML),e.activeFormattingElements.insertMarker(),e.framesetOk=!1}function gSe(e,t){e.treeAdapter.getDocumentMode(e.document)!==tm.QUIRKS&&e.openElements.hasInButtonScope(J.P)&&e._closePElement(),e._insertElement(t,$p.HTML),e.framesetOk=!1,e.insertionMode=X.IN_TABLE}function _Se(e,t){e._reconstructActiveFormattingElements(),e._appendElement(t,$p.HTML),e.framesetOk=!1,t.ackSelfClosing=!0}function vSe(e){let t=Pbe(e,em.TYPE);return t!=null&&t.toLowerCase()===ACe}function ySe(e,t){e._reconstructActiveFormattingElements(),e._appendElement(t,$p.HTML),vSe(t)||(e.framesetOk=!1),t.ackSelfClosing=!0}function bSe(e,t){e._appendElement(t,$p.HTML),t.ackSelfClosing=!0}function xSe(e,t){e.openElements.hasInButtonScope(J.P)&&e._closePElement(),e._appendElement(t,$p.HTML),e.framesetOk=!1,t.ackSelfClosing=!0}function SSe(e,t){t.tagName=q.IMG,t.tagID=J.IMG,_Se(e,t)}function CSe(e,t){e._insertElement(t,$p.HTML),e.skipNextNewLine=!0,e.tokenizer.state=cm.RCDATA,e.originalInsertionMode=e.insertionMode,e.framesetOk=!1,e.insertionMode=X.TEXT}function wSe(e,t){e.openElements.hasInButtonScope(J.P)&&e._closePElement(),e._reconstructActiveFormattingElements(),e.framesetOk=!1,e._switchToTextParsing(t,cm.RAWTEXT)}function TSe(e,t){e.framesetOk=!1,e._switchToTextParsing(t,cm.RAWTEXT)}function ESe(e,t){e._switchToTextParsing(t,cm.RAWTEXT)}function DSe(e,t){e._reconstructActiveFormattingElements(),e._insertElement(t,$p.HTML),e.framesetOk=!1,e.insertionMode=e.insertionMode===X.IN_TABLE||e.insertionMode===X.IN_CAPTION||e.insertionMode===X.IN_TABLE_BODY||e.insertionMode===X.IN_ROW||e.insertionMode===X.IN_CELL?X.IN_SELECT_IN_TABLE:X.IN_SELECT}function OSe(e,t){e.openElements.currentTagId===J.OPTION&&e.openElements.pop(),e._reconstructActiveFormattingElements(),e._insertElement(t,$p.HTML)}function kSe(e,t){e.openElements.hasInScope(J.RUBY)&&e.openElements.generateImpliedEndTags(),e._insertElement(t,$p.HTML)}function ASe(e,t){e.openElements.hasInScope(J.RUBY)&&e.openElements.generateImpliedEndTagsWithExclusion(J.RTC),e._insertElement(t,$p.HTML)}function jSe(e,t){e._reconstructActiveFormattingElements(),Cxe(t),Sm(t),t.selfClosing?e._appendElement(t,$p.MATHML):e._insertElement(t,$p.MATHML),t.ackSelfClosing=!0}function MSe(e,t){e._reconstructActiveFormattingElements(),wxe(t),Sm(t),t.selfClosing?e._appendElement(t,$p.SVG):e._insertElement(t,$p.SVG),t.ackSelfClosing=!0}function NSe(e,t){e._reconstructActiveFormattingElements(),e._insertElement(t,$p.HTML)}function Im(e,t){switch(t.tagID){case J.I:case J.S:case J.B:case J.U:case J.EM:case J.TT:case J.BIG:case J.CODE:case J.FONT:case J.SMALL:case J.STRIKE:case J.STRONG:pSe(e,t);break;case J.A:fSe(e,t);break;case J.H1:case J.H2:case J.H3:case J.H4:case J.H5:case J.H6:oSe(e,t);break;case J.P:case J.DL:case J.OL:case J.UL:case J.DIV:case J.DIR:case J.NAV:case J.MAIN:case J.MENU:case J.ASIDE:case J.CENTER:case J.FIGURE:case J.FOOTER:case J.HEADER:case J.HGROUP:case J.DIALOG:case J.DETAILS:case J.ADDRESS:case J.ARTICLE:case J.SEARCH:case J.SECTION:case J.SUMMARY:case J.FIELDSET:case J.BLOCKQUOTE:case J.FIGCAPTION:aSe(e,t);break;case J.LI:case J.DD:case J.DT:lSe(e,t);break;case J.BR:case J.IMG:case J.WBR:case J.AREA:case J.EMBED:case J.KEYGEN:_Se(e,t);break;case J.HR:xSe(e,t);break;case J.RB:case J.RTC:kSe(e,t);break;case J.RT:case J.RP:ASe(e,t);break;case J.PRE:case J.LISTING:sSe(e,t);break;case J.XMP:wSe(e,t);break;case J.SVG:MSe(e,t);break;case J.HTML:nSe(e,t);break;case J.BASE:case J.LINK:case J.META:case J.STYLE:case J.TITLE:case J.SCRIPT:case J.BGSOUND:case J.BASEFONT:case J.TEMPLATE:Am(e,t);break;case J.BODY:rSe(e,t);break;case J.FORM:cSe(e,t);break;case J.NOBR:mSe(e,t);break;case J.MATH:jSe(e,t);break;case J.TABLE:gSe(e,t);break;case J.INPUT:ySe(e,t);break;case J.PARAM:case J.TRACK:case J.SOURCE:bSe(e,t);break;case J.IMAGE:SSe(e,t);break;case J.BUTTON:dSe(e,t);break;case J.APPLET:case J.OBJECT:case J.MARQUEE:hSe(e,t);break;case J.IFRAME:TSe(e,t);break;case J.SELECT:DSe(e,t);break;case J.OPTION:case J.OPTGROUP:OSe(e,t);break;case J.NOEMBED:case J.NOFRAMES:ESe(e,t);break;case J.FRAMESET:iSe(e,t);break;case J.TEXTAREA:CSe(e,t);break;case J.NOSCRIPT:e.options.scriptingEnabled?ESe(e,t):NSe(e,t);break;case J.PLAINTEXT:uSe(e,t);break;case J.COL:case J.TH:case J.TD:case J.TR:case J.HEAD:case J.FRAME:case J.TBODY:case J.TFOOT:case J.THEAD:case J.CAPTION:case J.COLGROUP:break;default:NSe(e,t)}}function PSe(e,t){if(e.openElements.hasInScope(J.BODY)&&(e.insertionMode=X.AFTER_BODY,e.options.sourceCodeLocationInfo)){let n=e.openElements.tryPeekProperlyNestedBodyElement();n&&e._setEndLocation(n,t)}}function FSe(e,t){e.openElements.hasInScope(J.BODY)&&(e.insertionMode=X.AFTER_BODY,vCe(e,t))}function ISe(e,t){let n=t.tagID;e.openElements.hasInScope(n)&&(e.openElements.generateImpliedEndTags(),e.openElements.popUntilTagNamePopped(n))}function LSe(e){let t=e.openElements.tmplCount>0,{formElement:n}=e;t||(e.formElement=null),(n||t)&&e.openElements.hasInScope(J.FORM)&&(e.openElements.generateImpliedEndTags(),t?e.openElements.popUntilTagNamePopped(J.FORM):n&&e.openElements.remove(n))}function RSe(e){e.openElements.hasInButtonScope(J.P)||e._insertFakeElement(q.P,J.P),e._closePElement()}function zSe(e){e.openElements.hasInListItemScope(J.LI)&&(e.openElements.generateImpliedEndTagsWithExclusion(J.LI),e.openElements.popUntilTagNamePopped(J.LI))}function BSe(e,t){let n=t.tagID;e.openElements.hasInScope(n)&&(e.openElements.generateImpliedEndTagsWithExclusion(n),e.openElements.popUntilTagNamePopped(n))}function VSe(e){e.openElements.hasNumberedHeaderInScope()&&(e.openElements.generateImpliedEndTags(),e.openElements.popUntilNumberedHeaderPopped())}function HSe(e,t){let n=t.tagID;e.openElements.hasInScope(n)&&(e.openElements.generateImpliedEndTags(),e.openElements.popUntilTagNamePopped(n),e.activeFormattingElements.clearToLastMarker())}function USe(e){e._reconstructActiveFormattingElements(),e._insertFakeElement(q.BR,J.BR),e.openElements.pop(),e.framesetOk=!1}function WSe(e,t){let n=t.tagName,r=t.tagID;for(let t=e.openElements.stackTop;t>0;t--){let i=e.openElements.items[t],a=e.openElements.tagIDs[t];if(r===a&&(r!==J.UNKNOWN||e.treeAdapter.getTagName(i)===n)){e.openElements.generateImpliedEndTagsWithExclusion(r),e.openElements.stackTop>=t&&e.openElements.shortenToLength(t);break}if(e._isSpecialElement(i,a))break}}function Lm(e,t){switch(t.tagID){case J.A:case J.B:case J.I:case J.S:case J.U:case J.EM:case J.TT:case J.BIG:case J.CODE:case J.FONT:case J.NOBR:case J.SMALL:case J.STRIKE:case J.STRONG:wm(e,t);break;case J.P:RSe(e);break;case J.DL:case J.UL:case J.OL:case J.DIR:case J.DIV:case J.NAV:case J.PRE:case J.MAIN:case J.MENU:case J.ASIDE:case J.BUTTON:case J.CENTER:case J.FIGURE:case J.FOOTER:case J.HEADER:case J.HGROUP:case J.DIALOG:case J.ADDRESS:case J.ARTICLE:case J.DETAILS:case J.SEARCH:case J.SECTION:case J.SUMMARY:case J.LISTING:case J.FIELDSET:case J.BLOCKQUOTE:case J.FIGCAPTION:ISe(e,t);break;case J.LI:zSe(e);break;case J.DD:case J.DT:BSe(e,t);break;case J.H1:case J.H2:case J.H3:case J.H4:case J.H5:case J.H6:VSe(e);break;case J.BR:USe(e);break;case J.BODY:PSe(e,t);break;case J.HTML:FSe(e,t);break;case J.FORM:LSe(e);break;case J.APPLET:case J.OBJECT:case J.MARQUEE:HSe(e,t);break;case J.TEMPLATE:jm(e,t);break;default:WSe(e,t)}}function GSe(e,t){e.tmplInsertionModeStack.length>0?gCe(e,t):Em(e,t)}function KSe(e,t){var n;t.tagID===J.SCRIPT&&((n=e.scriptHandler)==null||n.call(e,e.openElements.current)),e.openElements.pop(),e.insertionMode=e.originalInsertionMode}function qSe(e,t){e._err(t,Up.eofInElementThatCanContainOnlyText),e.openElements.pop(),e.insertionMode=e.originalInsertionMode,e.onEof(t)}function Rm(e,t){if(e.openElements.currentTagId!==void 0&&Xm.has(e.openElements.currentTagId))switch(e.pendingCharacterTokens.length=0,e.hasNonWhitespacePendingCharacterToken=!1,e.originalInsertionMode=e.insertionMode,e.insertionMode=X.IN_TABLE_TEXT,t.type){case Gp.CHARACTER:rCe(e,t);break;case Gp.WHITESPACE_CHARACTER:nCe(e,t);break}else Vm(e,t)}function JSe(e,t){e.openElements.clearBackToTableContext(),e.activeFormattingElements.insertMarker(),e._insertElement(t,$p.HTML),e.insertionMode=X.IN_CAPTION}function YSe(e,t){e.openElements.clearBackToTableContext(),e._insertElement(t,$p.HTML),e.insertionMode=X.IN_COLUMN_GROUP}function XSe(e,t){e.openElements.clearBackToTableContext(),e._insertFakeElement(q.COLGROUP,J.COLGROUP),e.insertionMode=X.IN_COLUMN_GROUP,Um(e,t)}function ZSe(e,t){e.openElements.clearBackToTableContext(),e._insertElement(t,$p.HTML),e.insertionMode=X.IN_TABLE_BODY}function QSe(e,t){e.openElements.clearBackToTableContext(),e._insertFakeElement(q.TBODY,J.TBODY),e.insertionMode=X.IN_TABLE_BODY,Gm(e,t)}function $Se(e,t){e.openElements.hasInTableScope(J.TABLE)&&(e.openElements.popUntilTagNamePopped(J.TABLE),e._resetInsertionMode(),e._processStartTag(t))}function eCe(e,t){vSe(t)?e._appendElement(t,$p.HTML):Vm(e,t),t.ackSelfClosing=!0}function tCe(e,t){!e.formElement&&e.openElements.tmplCount===0&&(e._insertElement(t,$p.HTML),e.formElement=e.openElements.current,e.openElements.pop())}function zm(e,t){switch(t.tagID){case J.TD:case J.TH:case J.TR:QSe(e,t);break;case J.STYLE:case J.SCRIPT:case J.TEMPLATE:Am(e,t);break;case J.COL:XSe(e,t);break;case J.FORM:tCe(e,t);break;case J.TABLE:$Se(e,t);break;case J.TBODY:case J.TFOOT:case J.THEAD:ZSe(e,t);break;case J.INPUT:eCe(e,t);break;case J.CAPTION:JSe(e,t);break;case J.COLGROUP:YSe(e,t);break;default:Vm(e,t)}}function Bm(e,t){switch(t.tagID){case J.TABLE:e.openElements.hasInTableScope(J.TABLE)&&(e.openElements.popUntilTagNamePopped(J.TABLE),e._resetInsertionMode());break;case J.TEMPLATE:jm(e,t);break;case J.BODY:case J.CAPTION:case J.COL:case J.COLGROUP:case J.HTML:case J.TBODY:case J.TD:case J.TFOOT:case J.TH:case J.THEAD:case J.TR:break;default:Vm(e,t)}}function Vm(e,t){let n=e.fosterParentingEnabled;e.fosterParentingEnabled=!0,Fm(e,t),e.fosterParentingEnabled=n}function nCe(e,t){e.pendingCharacterTokens.push(t)}function rCe(e,t){e.pendingCharacterTokens.push(t),e.hasNonWhitespacePendingCharacterToken=!0}function Hm(e,t){let n=0;if(e.hasNonWhitespacePendingCharacterToken)for(;n<e.pendingCharacterTokens.length;n++)Vm(e,e.pendingCharacterTokens[n]);else for(;n<e.pendingCharacterTokens.length;n++)e._insertCharacters(e.pendingCharacterTokens[n]);e.insertionMode=e.originalInsertionMode,e._processToken(t)}function iCe(e,t){let n=t.tagID;$m.has(n)?e.openElements.hasInTableScope(J.CAPTION)&&(e.openElements.generateImpliedEndTags(),e.openElements.popUntilTagNamePopped(J.CAPTION),e.activeFormattingElements.clearToLastMarker(),e.insertionMode=X.IN_TABLE,zm(e,t)):Im(e,t)}function aCe(e,t){let n=t.tagID;switch(n){case J.CAPTION:case J.TABLE:e.openElements.hasInTableScope(J.CAPTION)&&(e.openElements.generateImpliedEndTags(),e.openElements.popUntilTagNamePopped(J.CAPTION),e.activeFormattingElements.clearToLastMarker(),e.insertionMode=X.IN_TABLE,n===J.TABLE&&Bm(e,t));break;case J.BODY:case J.COL:case J.COLGROUP:case J.HTML:case J.TBODY:case J.TD:case J.TFOOT:case J.TH:case J.THEAD:case J.TR:break;default:Lm(e,t)}}function Um(e,t){switch(t.tagID){case J.HTML:Im(e,t);break;case J.COL:e._appendElement(t,$p.HTML),t.ackSelfClosing=!0;break;case J.TEMPLATE:Am(e,t);break;default:Wm(e,t)}}function oCe(e,t){switch(t.tagID){case J.COLGROUP:e.openElements.currentTagId===J.COLGROUP&&(e.openElements.pop(),e.insertionMode=X.IN_TABLE);break;case J.TEMPLATE:jm(e,t);break;case J.COL:break;default:Wm(e,t)}}function Wm(e,t){e.openElements.currentTagId===J.COLGROUP&&(e.openElements.pop(),e.insertionMode=X.IN_TABLE,e._processToken(t))}function Gm(e,t){switch(t.tagID){case J.TR:e.openElements.clearBackToTableBodyContext(),e._insertElement(t,$p.HTML),e.insertionMode=X.IN_ROW;break;case J.TH:case J.TD:e.openElements.clearBackToTableBodyContext(),e._insertFakeElement(q.TR,J.TR),e.insertionMode=X.IN_ROW,qm(e,t);break;case J.CAPTION:case J.COL:case J.COLGROUP:case J.TBODY:case J.TFOOT:case J.THEAD:e.openElements.hasTableBodyContextInTableScope()&&(e.openElements.clearBackToTableBodyContext(),e.openElements.pop(),e.insertionMode=X.IN_TABLE,zm(e,t));break;default:zm(e,t)}}function Km(e,t){let n=t.tagID;switch(t.tagID){case J.TBODY:case J.TFOOT:case J.THEAD:e.openElements.hasInTableScope(n)&&(e.openElements.clearBackToTableBodyContext(),e.openElements.pop(),e.insertionMode=X.IN_TABLE);break;case J.TABLE:e.openElements.hasTableBodyContextInTableScope()&&(e.openElements.clearBackToTableBodyContext(),e.openElements.pop(),e.insertionMode=X.IN_TABLE,Bm(e,t));break;case J.BODY:case J.CAPTION:case J.COL:case J.COLGROUP:case J.HTML:case J.TD:case J.TH:case J.TR:break;default:Bm(e,t)}}function qm(e,t){switch(t.tagID){case J.TH:case J.TD:e.openElements.clearBackToTableRowContext(),e._insertElement(t,$p.HTML),e.insertionMode=X.IN_CELL,e.activeFormattingElements.insertMarker();break;case J.CAPTION:case J.COL:case J.COLGROUP:case J.TBODY:case J.TFOOT:case J.THEAD:case J.TR:e.openElements.hasInTableScope(J.TR)&&(e.openElements.clearBackToTableRowContext(),e.openElements.pop(),e.insertionMode=X.IN_TABLE_BODY,Gm(e,t));break;default:zm(e,t)}}function sCe(e,t){switch(t.tagID){case J.TR:e.openElements.hasInTableScope(J.TR)&&(e.openElements.clearBackToTableRowContext(),e.openElements.pop(),e.insertionMode=X.IN_TABLE_BODY);break;case J.TABLE:e.openElements.hasInTableScope(J.TR)&&(e.openElements.clearBackToTableRowContext(),e.openElements.pop(),e.insertionMode=X.IN_TABLE_BODY,Km(e,t));break;case J.TBODY:case J.TFOOT:case J.THEAD:(e.openElements.hasInTableScope(t.tagID)||e.openElements.hasInTableScope(J.TR))&&(e.openElements.clearBackToTableRowContext(),e.openElements.pop(),e.insertionMode=X.IN_TABLE_BODY,Km(e,t));break;case J.BODY:case J.CAPTION:case J.COL:case J.COLGROUP:case J.HTML:case J.TD:case J.TH:break;default:Bm(e,t)}}function cCe(e,t){let n=t.tagID;$m.has(n)?(e.openElements.hasInTableScope(J.TD)||e.openElements.hasInTableScope(J.TH))&&(e._closeTableCell(),qm(e,t)):Im(e,t)}function lCe(e,t){let n=t.tagID;switch(n){case J.TD:case J.TH:e.openElements.hasInTableScope(n)&&(e.openElements.generateImpliedEndTags(),e.openElements.popUntilTagNamePopped(n),e.activeFormattingElements.clearToLastMarker(),e.insertionMode=X.IN_ROW);break;case J.TABLE:case J.TBODY:case J.TFOOT:case J.THEAD:case J.TR:e.openElements.hasInTableScope(n)&&(e._closeTableCell(),sCe(e,t));break;case J.BODY:case J.CAPTION:case J.COL:case J.COLGROUP:case J.HTML:break;default:Lm(e,t)}}function uCe(e,t){switch(t.tagID){case J.HTML:Im(e,t);break;case J.OPTION:e.openElements.currentTagId===J.OPTION&&e.openElements.pop(),e._insertElement(t,$p.HTML);break;case J.OPTGROUP:e.openElements.currentTagId===J.OPTION&&e.openElements.pop(),e.openElements.currentTagId===J.OPTGROUP&&e.openElements.pop(),e._insertElement(t,$p.HTML);break;case J.HR:e.openElements.currentTagId===J.OPTION&&e.openElements.pop(),e.openElements.currentTagId===J.OPTGROUP&&e.openElements.pop(),e._appendElement(t,$p.HTML),t.ackSelfClosing=!0;break;case J.INPUT:case J.KEYGEN:case J.TEXTAREA:case J.SELECT:e.openElements.hasInSelectScope(J.SELECT)&&(e.openElements.popUntilTagNamePopped(J.SELECT),e._resetInsertionMode(),t.tagID!==J.SELECT&&e._processStartTag(t));break;case J.SCRIPT:case J.TEMPLATE:Am(e,t);break;default:}}function dCe(e,t){switch(t.tagID){case J.OPTGROUP:e.openElements.stackTop>0&&e.openElements.currentTagId===J.OPTION&&e.openElements.tagIDs[e.openElements.stackTop-1]===J.OPTGROUP&&e.openElements.pop(),e.openElements.currentTagId===J.OPTGROUP&&e.openElements.pop();break;case J.OPTION:e.openElements.currentTagId===J.OPTION&&e.openElements.pop();break;case J.SELECT:e.openElements.hasInSelectScope(J.SELECT)&&(e.openElements.popUntilTagNamePopped(J.SELECT),e._resetInsertionMode());break;case J.TEMPLATE:jm(e,t);break;default:}}function fCe(e,t){let n=t.tagID;n===J.CAPTION||n===J.TABLE||n===J.TBODY||n===J.TFOOT||n===J.THEAD||n===J.TR||n===J.TD||n===J.TH?(e.openElements.popUntilTagNamePopped(J.SELECT),e._resetInsertionMode(),e._processStartTag(t)):uCe(e,t)}function pCe(e,t){let n=t.tagID;n===J.CAPTION||n===J.TABLE||n===J.TBODY||n===J.TFOOT||n===J.THEAD||n===J.TR||n===J.TD||n===J.TH?e.openElements.hasInTableScope(n)&&(e.openElements.popUntilTagNamePopped(J.SELECT),e._resetInsertionMode(),e.onEndTag(t)):dCe(e,t)}function mCe(e,t){switch(t.tagID){case J.BASE:case J.BASEFONT:case J.BGSOUND:case J.LINK:case J.META:case J.NOFRAMES:case J.SCRIPT:case J.STYLE:case J.TEMPLATE:case J.TITLE:Am(e,t);break;case J.CAPTION:case J.COLGROUP:case J.TBODY:case J.TFOOT:case J.THEAD:e.tmplInsertionModeStack[0]=X.IN_TABLE,e.insertionMode=X.IN_TABLE,zm(e,t);break;case J.COL:e.tmplInsertionModeStack[0]=X.IN_COLUMN_GROUP,e.insertionMode=X.IN_COLUMN_GROUP,Um(e,t);break;case J.TR:e.tmplInsertionModeStack[0]=X.IN_TABLE_BODY,e.insertionMode=X.IN_TABLE_BODY,Gm(e,t);break;case J.TD:case J.TH:e.tmplInsertionModeStack[0]=X.IN_ROW,e.insertionMode=X.IN_ROW,qm(e,t);break;default:e.tmplInsertionModeStack[0]=X.IN_BODY,e.insertionMode=X.IN_BODY,Im(e,t)}}function hCe(e,t){t.tagID===J.TEMPLATE&&jm(e,t)}function gCe(e,t){e.openElements.tmplCount>0?(e.openElements.popUntilTagNamePopped(J.TEMPLATE),e.activeFormattingElements.clearToLastMarker(),e.tmplInsertionModeStack.shift(),e._resetInsertionMode(),e.onEof(t)):Em(e,t)}function _Ce(e,t){t.tagID===J.HTML?Im(e,t):Jm(e,t)}function vCe(e,t){if(t.tagID===J.HTML){if(e.fragmentContext||(e.insertionMode=X.AFTER_AFTER_BODY),e.options.sourceCodeLocationInfo&&e.openElements.tagIDs[0]===J.HTML){e._setEndLocation(e.openElements.items[0],t);let n=e.openElements.items[1];n&&!e.treeAdapter.getNodeSourceCodeLocation(n)?.endTag&&e._setEndLocation(n,t)}}else Jm(e,t)}function Jm(e,t){e.insertionMode=X.IN_BODY,Fm(e,t)}function yCe(e,t){switch(t.tagID){case J.HTML:Im(e,t);break;case J.FRAMESET:e._insertElement(t,$p.HTML);break;case J.FRAME:e._appendElement(t,$p.HTML),t.ackSelfClosing=!0;break;case J.NOFRAMES:Am(e,t);break;default:}}function bCe(e,t){t.tagID===J.FRAMESET&&!e.openElements.isRootHtmlElementCurrent()&&(e.openElements.pop(),!e.fragmentContext&&e.openElements.currentTagId!==J.FRAMESET&&(e.insertionMode=X.AFTER_FRAMESET))}function xCe(e,t){switch(t.tagID){case J.HTML:Im(e,t);break;case J.NOFRAMES:Am(e,t);break;default:}}function SCe(e,t){t.tagID===J.HTML&&(e.insertionMode=X.AFTER_AFTER_FRAMESET)}function CCe(e,t){t.tagID===J.HTML?Im(e,t):Ym(e,t)}function Ym(e,t){e.insertionMode=X.IN_BODY,Fm(e,t)}function wCe(e,t){switch(t.tagID){case J.HTML:Im(e,t);break;case J.NOFRAMES:Am(e,t);break;default:}}function TCe(e,t){t.chars=`�`,e._insertCharacters(t)}function ECe(e,t){e._insertCharacters(t),e.framesetOk=!1}function DCe(e){for(;e.treeAdapter.getNamespaceURI(e.openElements.current)!==$p.HTML&&e.openElements.currentTagId!==void 0&&!e._isIntegrationPoint(e.openElements.currentTagId,e.openElements.current);)e.openElements.pop()}function OCe(e,t){if(Sxe(t))DCe(e),e._startTagOutsideForeignContent(t);else{let n=e._getAdjustedCurrentElement(),r=e.treeAdapter.getNamespaceURI(n);r===$p.MATHML?Cxe(t):r===$p.SVG&&(Txe(t),wxe(t)),Sm(t),t.selfClosing?e._appendElement(t,r):e._insertElement(t,r),t.ackSelfClosing=!0}}function kCe(e,t){if(t.tagID===J.P||t.tagID===J.BR){DCe(e),e._endTagOutsideForeignContent(t);return}for(let n=e.openElements.stackTop;n>0;n--){let r=e.openElements.items[n];if(e.treeAdapter.getNamespaceURI(r)===$p.HTML){e._endTagOutsideForeignContent(t);break}let i=e.treeAdapter.getTagName(r);if(i.toLowerCase()===t.tagName){t.tagName=i,e.openElements.shortenToLength(n);break}}}var ACe,jCe,MCe,X,NCe,Xm,Zm,Qm,$m,PCe=s((()=>{nxe(),uxe(),fxe(),vm(),xxe(),Fxe(),Wp(),Hp(),im(),Kp(),ACe=`hidden`,jCe=8,MCe=3,(function(e){e[e.INITIAL=0]=`INITIAL`,e[e.BEFORE_HTML=1]=`BEFORE_HTML`,e[e.BEFORE_HEAD=2]=`BEFORE_HEAD`,e[e.IN_HEAD=3]=`IN_HEAD`,e[e.IN_HEAD_NO_SCRIPT=4]=`IN_HEAD_NO_SCRIPT`,e[e.AFTER_HEAD=5]=`AFTER_HEAD`,e[e.IN_BODY=6]=`IN_BODY`,e[e.TEXT=7]=`TEXT`,e[e.IN_TABLE=8]=`IN_TABLE`,e[e.IN_TABLE_TEXT=9]=`IN_TABLE_TEXT`,e[e.IN_CAPTION=10]=`IN_CAPTION`,e[e.IN_COLUMN_GROUP=11]=`IN_COLUMN_GROUP`,e[e.IN_TABLE_BODY=12]=`IN_TABLE_BODY`,e[e.IN_ROW=13]=`IN_ROW`,e[e.IN_CELL=14]=`IN_CELL`,e[e.IN_SELECT=15]=`IN_SELECT`,e[e.IN_SELECT_IN_TABLE=16]=`IN_SELECT_IN_TABLE`,e[e.IN_TEMPLATE=17]=`IN_TEMPLATE`,e[e.AFTER_BODY=18]=`AFTER_BODY`,e[e.IN_FRAMESET=19]=`IN_FRAMESET`,e[e.AFTER_FRAMESET=20]=`AFTER_FRAMESET`,e[e.AFTER_AFTER_BODY=21]=`AFTER_AFTER_BODY`,e[e.AFTER_AFTER_FRAMESET=22]=`AFTER_AFTER_FRAMESET`})(X||={}),NCe={startLine:-1,startCol:-1,startOffset:-1,endLine:-1,endCol:-1,endOffset:-1},Xm=new Set([J.TABLE,J.TBODY,J.TFOOT,J.THEAD,J.TR]),Zm={scriptingEnabled:!0,sourceCodeLocationInfo:!1,treeAdapter:_m,onParseError:null},Qm=class{constructor(e,t,n=null,r=null){this.fragmentContext=n,this.scriptHandler=r,this.currentToken=null,this.stopped=!1,this.insertionMode=X.INITIAL,this.originalInsertionMode=X.INITIAL,this.headElement=null,this.formElement=null,this.currentNotInHTML=!1,this.tmplInsertionModeStack=[],this.pendingCharacterTokens=[],this.hasNonWhitespacePendingCharacterToken=!1,this.framesetOk=!0,this.skipNextNewLine=!1,this.fosterParentingEnabled=!1,this.options={...Zm,...e},this.treeAdapter=this.options.treeAdapter,this.onParseError=this.options.onParseError,this.onParseError&&(this.options.sourceCodeLocationInfo=!0),this.document=t??this.treeAdapter.createDocument(),this.tokenizer=new txe(this.options,this),this.activeFormattingElements=new dxe(this.treeAdapter),this.fragmentContextID=n?Qp(this.treeAdapter.getTagName(n)):J.UNKNOWN,this._setContextModes(n??this.document,this.fragmentContextID),this.openElements=new lxe(this.document,this.treeAdapter,this)}static parse(e,t){let n=new this(t);return n.tokenizer.write(e,!0),n.document}static getFragmentParser(e,t){let n={...Zm,...t};e??=n.treeAdapter.createElement(q.TEMPLATE,$p.HTML,[]);let r=n.treeAdapter.createElement(`documentmock`,$p.HTML,[]),i=new this(n,r,e);return i.fragmentContextID===J.TEMPLATE&&i.tmplInsertionModeStack.unshift(X.IN_TEMPLATE),i._initTokenizerForFragmentParsing(),i._insertFakeRootElement(),i._resetInsertionMode(),i._findFormInFragmentContext(),i}getFragment(){let e=this.treeAdapter.getFirstChild(this.document),t=this.treeAdapter.createDocumentFragment();return this._adoptNodes(e,t),t}_err(e,t,n){if(!this.onParseError)return;let r=e.location??NCe,i={code:t,startLine:r.startLine,startCol:r.startCol,startOffset:r.startOffset,endLine:n?r.startLine:r.endLine,endCol:n?r.startCol:r.endCol,endOffset:n?r.startOffset:r.endOffset};this.onParseError(i)}onItemPush(e,t,n){var r,i;(i=(r=this.treeAdapter).onItemPush)==null||i.call(r,e),n&&this.openElements.stackTop>0&&this._setContextModes(e,t)}onItemPop(e,t){var n,r;if(this.options.sourceCodeLocationInfo&&this._setEndLocation(e,this.currentToken),(r=(n=this.treeAdapter).onItemPop)==null||r.call(n,e,this.openElements.current),t){let e,t;this.openElements.stackTop===0&&this.fragmentContext?(e=this.fragmentContext,t=this.fragmentContextID):{current:e,currentTagId:t}=this.openElements,this._setContextModes(e,t)}}_setContextModes(e,t){let n=e===this.document||e&&this.treeAdapter.getNamespaceURI(e)===$p.HTML;this.currentNotInHTML=!n,this.tokenizer.inForeignNode=!n&&e!==void 0&&t!==void 0&&!this._isIntegrationPoint(t,e)}_switchToTextParsing(e,t){this._insertElement(e,$p.HTML),this.tokenizer.state=t,this.originalInsertionMode=this.insertionMode,this.insertionMode=X.TEXT}switchToPlaintextParsing(){this.insertionMode=X.TEXT,this.originalInsertionMode=X.IN_BODY,this.tokenizer.state=cm.PLAINTEXT}_getAdjustedCurrentElement(){return this.openElements.stackTop===0&&this.fragmentContext?this.fragmentContext:this.openElements.current}_findFormInFragmentContext(){let e=this.fragmentContext;for(;e;){if(this.treeAdapter.getTagName(e)===q.FORM){this.formElement=e;break}e=this.treeAdapter.getParentNode(e)}}_initTokenizerForFragmentParsing(){if(!(!this.fragmentContext||this.treeAdapter.getNamespaceURI(this.fragmentContext)!==$p.HTML))switch(this.fragmentContextID){case J.TITLE:case J.TEXTAREA:this.tokenizer.state=cm.RCDATA;break;case J.STYLE:case J.XMP:case J.IFRAME:case J.NOEMBED:case J.NOFRAMES:case J.NOSCRIPT:this.tokenizer.state=cm.RAWTEXT;break;case J.SCRIPT:this.tokenizer.state=cm.SCRIPT_DATA;break;case J.PLAINTEXT:this.tokenizer.state=cm.PLAINTEXT;break;default:}}_setDocumentType(e){let t=e.name||``,n=e.publicId||``,r=e.systemId||``;if(this.treeAdapter.setDocumentType(this.document,t,n,r),e.location){let t=this.treeAdapter.getChildNodes(this.document).find(e=>this.treeAdapter.isDocumentTypeNode(e));t&&this.treeAdapter.setNodeSourceCodeLocation(t,e.location)}}_attachElementToTree(e,t){if(this.options.sourceCodeLocationInfo){let n=t&&{...t,startTag:t};this.treeAdapter.setNodeSourceCodeLocation(e,n)}if(this._shouldFosterParentOnInsertion())this._fosterParentElement(e);else{let t=this.openElements.currentTmplContentOrNode;this.treeAdapter.appendChild(t??this.document,e)}}_appendElement(e,t){let n=this.treeAdapter.createElement(e.tagName,t,e.attrs);this._attachElementToTree(n,e.location)}_insertElement(e,t){let n=this.treeAdapter.createElement(e.tagName,t,e.attrs);this._attachElementToTree(n,e.location),this.openElements.push(n,e.tagID)}_insertFakeElement(e,t){let n=this.treeAdapter.createElement(e,$p.HTML,[]);this._attachElementToTree(n,null),this.openElements.push(n,t)}_insertTemplate(e){let t=this.treeAdapter.createElement(e.tagName,$p.HTML,e.attrs),n=this.treeAdapter.createDocumentFragment();this.treeAdapter.setTemplateContent(t,n),this._attachElementToTree(t,e.location),this.openElements.push(t,e.tagID),this.options.sourceCodeLocationInfo&&this.treeAdapter.setNodeSourceCodeLocation(n,null)}_insertFakeRootElement(){let e=this.treeAdapter.createElement(q.HTML,$p.HTML,[]);this.options.sourceCodeLocationInfo&&this.treeAdapter.setNodeSourceCodeLocation(e,null),this.treeAdapter.appendChild(this.openElements.current,e),this.openElements.push(e,J.HTML)}_appendCommentNode(e,t){let n=this.treeAdapter.createCommentNode(e.data);this.treeAdapter.appendChild(t,n),this.options.sourceCodeLocationInfo&&this.treeAdapter.setNodeSourceCodeLocation(n,e.location)}_insertCharacters(e){let t,n;if(this._shouldFosterParentOnInsertion()?({parent:t,beforeElement:n}=this._findFosterParentingLocation(),n?this.treeAdapter.insertTextBefore(t,e.chars,n):this.treeAdapter.insertText(t,e.chars)):(t=this.openElements.currentTmplContentOrNode,this.treeAdapter.insertText(t,e.chars)),!e.location)return;let r=this.treeAdapter.getChildNodes(t),i=r[(n?r.lastIndexOf(n):r.length)-1];if(this.treeAdapter.getNodeSourceCodeLocation(i)){let{endLine:t,endCol:n,endOffset:r}=e.location;this.treeAdapter.updateNodeSourceCodeLocation(i,{endLine:t,endCol:n,endOffset:r})}else this.options.sourceCodeLocationInfo&&this.treeAdapter.setNodeSourceCodeLocation(i,e.location)}_adoptNodes(e,t){for(let n=this.treeAdapter.getFirstChild(e);n;n=this.treeAdapter.getFirstChild(e))this.treeAdapter.detachNode(n),this.treeAdapter.appendChild(t,n)}_setEndLocation(e,t){if(this.treeAdapter.getNodeSourceCodeLocation(e)&&t.location){let n=t.location,r=this.treeAdapter.getTagName(e),i=t.type===Gp.END_TAG&&r===t.tagName?{endTag:{...n},endLine:n.endLine,endCol:n.endCol,endOffset:n.endOffset}:{endLine:n.startLine,endCol:n.startCol,endOffset:n.startOffset};this.treeAdapter.updateNodeSourceCodeLocation(e,i)}}shouldProcessStartTagTokenInForeignContent(e){if(!this.currentNotInHTML)return!1;let t,n;return this.openElements.stackTop===0&&this.fragmentContext?(t=this.fragmentContext,n=this.fragmentContextID):{current:t,currentTagId:n}=this.openElements,e.tagID===J.SVG&&this.treeAdapter.getTagName(t)===q.ANNOTATION_XML&&this.treeAdapter.getNamespaceURI(t)===$p.MATHML?!1:this.tokenizer.inForeignNode||(e.tagID===J.MGLYPH||e.tagID===J.MALIGNMARK)&&n!==void 0&&!this._isIntegrationPoint(n,t,$p.HTML)}_processToken(e){switch(e.type){case Gp.CHARACTER:this.onCharacter(e);break;case Gp.NULL_CHARACTER:this.onNullCharacter(e);break;case Gp.COMMENT:this.onComment(e);break;case Gp.DOCTYPE:this.onDoctype(e);break;case Gp.START_TAG:this._processStartTag(e);break;case Gp.END_TAG:this.onEndTag(e);break;case Gp.EOF:this.onEof(e);break;case Gp.WHITESPACE_CHARACTER:this.onWhitespaceCharacter(e);break}}_isIntegrationPoint(e,t,n){return Oxe(e,this.treeAdapter.getNamespaceURI(t),this.treeAdapter.getAttrList(t),n)}_reconstructActiveFormattingElements(){let e=this.activeFormattingElements.entries.length;if(e){let t=this.activeFormattingElements.entries.findIndex(e=>e.type===hm.Marker||this.openElements.contains(e.element)),n=t===-1?e-1:t-1;for(let e=n;e>=0;e--){let t=this.activeFormattingElements.entries[e];this._insertElement(t.token,this.treeAdapter.getNamespaceURI(t.element)),t.element=this.openElements.current}}}_closeTableCell(){this.openElements.generateImpliedEndTags(),this.openElements.popUntilTableCellPopped(),this.activeFormattingElements.clearToLastMarker(),this.insertionMode=X.IN_ROW}_closePElement(){this.openElements.generateImpliedEndTagsWithExclusion(J.P),this.openElements.popUntilTagNamePopped(J.P)}_resetInsertionMode(){for(let e=this.openElements.stackTop;e>=0;e--)switch(e===0&&this.fragmentContext?this.fragmentContextID:this.openElements.tagIDs[e]){case J.TR:this.insertionMode=X.IN_ROW;return;case J.TBODY:case J.THEAD:case J.TFOOT:this.insertionMode=X.IN_TABLE_BODY;return;case J.CAPTION:this.insertionMode=X.IN_CAPTION;return;case J.COLGROUP:this.insertionMode=X.IN_COLUMN_GROUP;return;case J.TABLE:this.insertionMode=X.IN_TABLE;return;case J.BODY:this.insertionMode=X.IN_BODY;return;case J.FRAMESET:this.insertionMode=X.IN_FRAMESET;return;case J.SELECT:this._resetInsertionModeForSelect(e);return;case J.TEMPLATE:this.insertionMode=this.tmplInsertionModeStack[0];return;case J.HTML:this.insertionMode=this.headElement?X.AFTER_HEAD:X.BEFORE_HEAD;return;case J.TD:case J.TH:if(e>0){this.insertionMode=X.IN_CELL;return}break;case J.HEAD:if(e>0){this.insertionMode=X.IN_HEAD;return}break}this.insertionMode=X.IN_BODY}_resetInsertionModeForSelect(e){if(e>0)for(let t=e-1;t>0;t--){let e=this.openElements.tagIDs[t];if(e===J.TEMPLATE)break;if(e===J.TABLE){this.insertionMode=X.IN_SELECT_IN_TABLE;return}}this.insertionMode=X.IN_SELECT}_isElementCausesFosterParenting(e){return Xm.has(e)}_shouldFosterParentOnInsertion(){return this.fosterParentingEnabled&&this.openElements.currentTagId!==void 0&&this._isElementCausesFosterParenting(this.openElements.currentTagId)}_findFosterParentingLocation(){for(let e=this.openElements.stackTop;e>=0;e--){let t=this.openElements.items[e];switch(this.openElements.tagIDs[e]){case J.TEMPLATE:if(this.treeAdapter.getNamespaceURI(t)===$p.HTML)return{parent:this.treeAdapter.getTemplateContent(t),beforeElement:null};break;case J.TABLE:{let n=this.treeAdapter.getParentNode(t);return n?{parent:n,beforeElement:t}:{parent:this.openElements.items[e-1],beforeElement:null}}default:}}return{parent:this.openElements.items[0],beforeElement:null}}_fosterParentElement(e){let t=this._findFosterParentingLocation();t.beforeElement?this.treeAdapter.insertBefore(t.parent,e,t.beforeElement):this.treeAdapter.appendChild(t.parent,e)}_isSpecialElement(e,t){return Jbe[this.treeAdapter.getNamespaceURI(e)].has(t)}onCharacter(e){if(this.skipNextNewLine=!1,this.tokenizer.inForeignNode){ECe(this,e);return}switch(this.insertionMode){case X.INITIAL:Dm(this,e);break;case X.BEFORE_HTML:Om(this,e);break;case X.BEFORE_HEAD:km(this,e);break;case X.IN_HEAD:Mm(this,e);break;case X.IN_HEAD_NO_SCRIPT:Nm(this,e);break;case X.AFTER_HEAD:Pm(this,e);break;case X.IN_BODY:case X.IN_CAPTION:case X.IN_CELL:case X.IN_TEMPLATE:tSe(this,e);break;case X.TEXT:case X.IN_SELECT:case X.IN_SELECT_IN_TABLE:this._insertCharacters(e);break;case X.IN_TABLE:case X.IN_TABLE_BODY:case X.IN_ROW:Rm(this,e);break;case X.IN_TABLE_TEXT:rCe(this,e);break;case X.IN_COLUMN_GROUP:Wm(this,e);break;case X.AFTER_BODY:Jm(this,e);break;case X.AFTER_AFTER_BODY:Ym(this,e);break;default:}}onNullCharacter(e){if(this.skipNextNewLine=!1,this.tokenizer.inForeignNode){TCe(this,e);return}switch(this.insertionMode){case X.INITIAL:Dm(this,e);break;case X.BEFORE_HTML:Om(this,e);break;case X.BEFORE_HEAD:km(this,e);break;case X.IN_HEAD:Mm(this,e);break;case X.IN_HEAD_NO_SCRIPT:Nm(this,e);break;case X.AFTER_HEAD:Pm(this,e);break;case X.TEXT:this._insertCharacters(e);break;case X.IN_TABLE:case X.IN_TABLE_BODY:case X.IN_ROW:Rm(this,e);break;case X.IN_COLUMN_GROUP:Wm(this,e);break;case X.AFTER_BODY:Jm(this,e);break;case X.AFTER_AFTER_BODY:Ym(this,e);break;default:}}onComment(e){if(this.skipNextNewLine=!1,this.currentNotInHTML){Tm(this,e);return}switch(this.insertionMode){case X.INITIAL:case X.BEFORE_HTML:case X.BEFORE_HEAD:case X.IN_HEAD:case X.IN_HEAD_NO_SCRIPT:case X.AFTER_HEAD:case X.IN_BODY:case X.IN_TABLE:case X.IN_CAPTION:case X.IN_COLUMN_GROUP:case X.IN_TABLE_BODY:case X.IN_ROW:case X.IN_CELL:case X.IN_SELECT:case X.IN_SELECT_IN_TABLE:case X.IN_TEMPLATE:case X.IN_FRAMESET:case X.AFTER_FRAMESET:Tm(this,e);break;case X.IN_TABLE_TEXT:Hm(this,e);break;case X.AFTER_BODY:Hxe(this,e);break;case X.AFTER_AFTER_BODY:case X.AFTER_AFTER_FRAMESET:Uxe(this,e);break;default:}}onDoctype(e){switch(this.skipNextNewLine=!1,this.insertionMode){case X.INITIAL:Wxe(this,e);break;case X.BEFORE_HEAD:case X.IN_HEAD:case X.IN_HEAD_NO_SCRIPT:case X.AFTER_HEAD:this._err(e,Up.misplacedDoctype);break;case X.IN_TABLE_TEXT:Hm(this,e);break;default:}}onStartTag(e){this.skipNextNewLine=!1,this.currentToken=e,this._processStartTag(e),e.selfClosing&&!e.ackSelfClosing&&this._err(e,Up.nonVoidHtmlElementStartTagWithTrailingSolidus)}_processStartTag(e){this.shouldProcessStartTagTokenInForeignContent(e)?OCe(this,e):this._startTagOutsideForeignContent(e)}_startTagOutsideForeignContent(e){switch(this.insertionMode){case X.INITIAL:Dm(this,e);break;case X.BEFORE_HTML:Gxe(this,e);break;case X.BEFORE_HEAD:qxe(this,e);break;case X.IN_HEAD:Am(this,e);break;case X.IN_HEAD_NO_SCRIPT:Xxe(this,e);break;case X.AFTER_HEAD:Qxe(this,e);break;case X.IN_BODY:Im(this,e);break;case X.IN_TABLE:zm(this,e);break;case X.IN_TABLE_TEXT:Hm(this,e);break;case X.IN_CAPTION:iCe(this,e);break;case X.IN_COLUMN_GROUP:Um(this,e);break;case X.IN_TABLE_BODY:Gm(this,e);break;case X.IN_ROW:qm(this,e);break;case X.IN_CELL:cCe(this,e);break;case X.IN_SELECT:uCe(this,e);break;case X.IN_SELECT_IN_TABLE:fCe(this,e);break;case X.IN_TEMPLATE:mCe(this,e);break;case X.AFTER_BODY:_Ce(this,e);break;case X.IN_FRAMESET:yCe(this,e);break;case X.AFTER_FRAMESET:xCe(this,e);break;case X.AFTER_AFTER_BODY:CCe(this,e);break;case X.AFTER_AFTER_FRAMESET:wCe(this,e);break;default:}}onEndTag(e){this.skipNextNewLine=!1,this.currentToken=e,this.currentNotInHTML?kCe(this,e):this._endTagOutsideForeignContent(e)}_endTagOutsideForeignContent(e){switch(this.insertionMode){case X.INITIAL:Dm(this,e);break;case X.BEFORE_HTML:Kxe(this,e);break;case X.BEFORE_HEAD:Jxe(this,e);break;case X.IN_HEAD:Yxe(this,e);break;case X.IN_HEAD_NO_SCRIPT:Zxe(this,e);break;case X.AFTER_HEAD:$xe(this,e);break;case X.IN_BODY:Lm(this,e);break;case X.TEXT:KSe(this,e);break;case X.IN_TABLE:Bm(this,e);break;case X.IN_TABLE_TEXT:Hm(this,e);break;case X.IN_CAPTION:aCe(this,e);break;case X.IN_COLUMN_GROUP:oCe(this,e);break;case X.IN_TABLE_BODY:Km(this,e);break;case X.IN_ROW:sCe(this,e);break;case X.IN_CELL:lCe(this,e);break;case X.IN_SELECT:dCe(this,e);break;case X.IN_SELECT_IN_TABLE:pCe(this,e);break;case X.IN_TEMPLATE:hCe(this,e);break;case X.AFTER_BODY:vCe(this,e);break;case X.IN_FRAMESET:bCe(this,e);break;case X.AFTER_FRAMESET:SCe(this,e);break;case X.AFTER_AFTER_BODY:Ym(this,e);break;default:}}onEof(e){switch(this.insertionMode){case X.INITIAL:Dm(this,e);break;case X.BEFORE_HTML:Om(this,e);break;case X.BEFORE_HEAD:km(this,e);break;case X.IN_HEAD:Mm(this,e);break;case X.IN_HEAD_NO_SCRIPT:Nm(this,e);break;case X.AFTER_HEAD:Pm(this,e);break;case X.IN_BODY:case X.IN_TABLE:case X.IN_CAPTION:case X.IN_COLUMN_GROUP:case X.IN_TABLE_BODY:case X.IN_ROW:case X.IN_CELL:case X.IN_SELECT:case X.IN_SELECT_IN_TABLE:GSe(this,e);break;case X.TEXT:qSe(this,e);break;case X.IN_TABLE_TEXT:Hm(this,e);break;case X.IN_TEMPLATE:gCe(this,e);break;case X.AFTER_BODY:case X.IN_FRAMESET:case X.AFTER_FRAMESET:case X.AFTER_AFTER_BODY:case X.AFTER_AFTER_FRAMESET:Em(this,e);break;default:}}onWhitespaceCharacter(e){if(this.skipNextNewLine&&(this.skipNextNewLine=!1,e.chars.charCodeAt(0)===K.LINE_FEED)){if(e.chars.length===1)return;e.chars=e.chars.substr(1)}if(this.tokenizer.inForeignNode){this._insertCharacters(e);return}switch(this.insertionMode){case X.IN_HEAD:case X.IN_HEAD_NO_SCRIPT:case X.AFTER_HEAD:case X.TEXT:case X.IN_COLUMN_GROUP:case X.IN_SELECT:case X.IN_SELECT_IN_TABLE:case X.IN_FRAMESET:case X.AFTER_FRAMESET:this._insertCharacters(e);break;case X.IN_BODY:case X.IN_CAPTION:case X.IN_CELL:case X.IN_TEMPLATE:case X.AFTER_BODY:case X.AFTER_AFTER_BODY:case X.AFTER_AFTER_FRAMESET:eSe(this,e);break;case X.IN_TABLE:case X.IN_TABLE_BODY:case X.IN_ROW:Rm(this,e);break;case X.IN_TABLE_TEXT:nCe(this,e);break;default:}}},$m=new Set([J.CAPTION,J.COL,J.COLGROUP,J.TBODY,J.TD,J.TFOOT,J.TH,J.THEAD,J.TR])})),FCe=s((()=>{im(),vm(),new Set([q.AREA,q.BASE,q.BASEFONT,q.BGSOUND,q.BR,q.COL,q.EMBED,q.FRAME,q.HR,q.IMG,q.INPUT,q.KEYGEN,q.LINK,q.META,q.PARAM,q.SOURCE,q.TRACK,q.WBR])}));function ICe(e,t){return Qm.parse(e,t)}function LCe(e,t,n){typeof e==`string`&&(n=t,t=e,e=null);let r=Qm.getFragmentParser(e,n);return r.tokenizer.write(t,!0),r.getFragment()}var RCe=s((()=>{PCe(),vm(),FCe(),Wp(),Fxe(),im(),Kp(),nxe()}));function eh(e){return!e||typeof e!=`object`?``:`position`in e||`type`in e?zCe(e.position):`start`in e||`end`in e?zCe(e):`line`in e||`column`in e?th(e):``}function th(e){return BCe(e&&e.line)+`:`+BCe(e&&e.column)}function zCe(e){return th(e&&e.start)+`-`+th(e&&e.end)}function BCe(e){return e&&typeof e==`number`?e:1}var VCe=s((()=>{})),HCe=s((()=>{VCe()})),nh,UCe=s((()=>{HCe(),nh=class extends Error{constructor(e,t,n){super(),typeof t==`string`&&(n=t,t=void 0);let r=``,i={},a=!1;if(t&&(i=`line`in t&&`column`in t||`start`in t&&`end`in t?{place:t}:`type`in t?{ancestors:[t],place:t.position}:{...t}),typeof e==`string`?r=e:!i.cause&&e&&(a=!0,r=e.message,i.cause=e),!i.ruleId&&!i.source&&typeof n==`string`){let e=n.indexOf(`:`);e===-1?i.ruleId=n:(i.source=n.slice(0,e),i.ruleId=n.slice(e+1))}if(!i.place&&i.ancestors&&i.ancestors){let e=i.ancestors[i.ancestors.length-1];e&&(i.place=e.position)}let o=i.place&&`start`in i.place?i.place.start:i.place;this.ancestors=i.ancestors||void 0,this.cause=i.cause||void 0,this.column=o?o.column:void 0,this.fatal=void 0,this.file,this.message=r,this.line=o?o.line:void 0,this.name=eh(i.place)||`1:1`,this.place=i.place||void 0,this.reason=this.message,this.ruleId=i.ruleId||void 0,this.source=i.source||void 0,this.stack=a&&i.cause&&typeof i.cause.stack==`string`?i.cause.stack:``,this.actual,this.expected,this.note,this.url}},nh.prototype.file=``,nh.prototype.name=``,nh.prototype.reason=``,nh.prototype.message=``,nh.prototype.stack=``,nh.prototype.column=void 0,nh.prototype.line=void 0,nh.prototype.ancestors=void 0,nh.prototype.cause=void 0,nh.prototype.fatal=void 0,nh.prototype.place=void 0,nh.prototype.ruleId=void 0,nh.prototype.source=void 0})),WCe=s((()=>{UCe()}));function GCe(e,t){if(t!==void 0&&typeof t!=`string`)throw TypeError(`"ext" argument must be a string`);rh(e);let n=0,r=-1,i=e.length,a;if(t===void 0||t.length===0||t.length>e.length){for(;i--;)if(e.codePointAt(i)===47){if(a){n=i+1;break}}else r<0&&(a=!0,r=i+1);return r<0?``:e.slice(n,r)}if(t===e)return``;let o=-1,s=t.length-1;for(;i--;)if(e.codePointAt(i)===47){if(a){n=i+1;break}}else o<0&&(a=!0,o=i+1),s>-1&&(e.codePointAt(i)===t.codePointAt(s--)?s<0&&(r=i):(s=-1,r=o));return n===r?r=o:r<0&&(r=e.length),e.slice(n,r)}function KCe(e){if(rh(e),e.length===0)return`.`;let t=-1,n=e.length,r;for(;--n;)if(e.codePointAt(n)===47){if(r){t=n;break}}else r||=!0;return t<0?e.codePointAt(0)===47?`/`:`.`:t===1&&e.codePointAt(0)===47?`//`:e.slice(0,t)}function qCe(e){rh(e);let t=e.length,n=-1,r=0,i=-1,a=0,o;for(;t--;){let s=e.codePointAt(t);if(s===47){if(o){r=t+1;break}continue}n<0&&(o=!0,n=t+1),s===46?i<0?i=t:a!==1&&(a=1):i>-1&&(a=-1)}return i<0||n<0||a===0||a===1&&i===n-1&&i===r+1?``:e.slice(i,n)}function JCe(...e){let t=-1,n;for(;++t<e.length;)rh(e[t]),e[t]&&(n=n===void 0?e[t]:n+`/`+e[t]);return n===void 0?`.`:YCe(n)}function YCe(e){rh(e);let t=e.codePointAt(0)===47,n=XCe(e,!t);return n.length===0&&!t&&(n=`.`),n.length>0&&e.codePointAt(e.length-1)===47&&(n+=`/`),t?`/`+n:n}function XCe(e,t){let n=``,r=0,i=-1,a=0,o=-1,s,c;for(;++o<=e.length;){if(o<e.length)s=e.codePointAt(o);else if(s===47)break;else s=47;if(s===47){if(!(i===o-1||a===1))if(i!==o-1&&a===2){if(n.length<2||r!==2||n.codePointAt(n.length-1)!==46||n.codePointAt(n.length-2)!==46){if(n.length>2){if(c=n.lastIndexOf(`/`),c!==n.length-1){c<0?(n=``,r=0):(n=n.slice(0,c),r=n.length-1-n.lastIndexOf(`/`)),i=o,a=0;continue}}else if(n.length>0){n=``,r=0,i=o,a=0;continue}}t&&(n=n.length>0?n+`/..`:`..`,r=2)}else n.length>0?n+=`/`+e.slice(i+1,o):n=e.slice(i+1,o),r=o-i-1;i=o,a=0}else s===46&&a>-1?a++:a=-1}return n}function rh(e){if(typeof e!=`string`)throw TypeError(`Path must be a string. Received `+JSON.stringify(e))}var ih,ZCe=s((()=>{ih={basename:GCe,dirname:KCe,extname:qCe,join:JCe,sep:`/`}}));function QCe(){return`/`}var $Ce,ewe=s((()=>{$Ce={cwd:QCe}}));function ah(e){return!!(typeof e==`object`&&e&&`href`in e&&e.href&&`protocol`in e&&e.protocol&&e.auth===void 0)}var twe=s((()=>{}));function nwe(e){if(typeof e==`string`)e=new URL(e);else if(!ah(e)){let t=TypeError('The "path" argument must be of type string or an instance of URL. Received `'+e+"`");throw t.code=`ERR_INVALID_ARG_TYPE`,t}if(e.protocol!==`file:`){let e=TypeError(`The URL must be of scheme file`);throw e.code=`ERR_INVALID_URL_SCHEME`,e}return rwe(e)}function rwe(e){if(e.hostname!==``){let e=TypeError(`File URL host must be "localhost" or empty on darwin`);throw e.code=`ERR_INVALID_FILE_URL_HOST`,e}let t=e.pathname,n=-1;for(;++n<t.length;)if(t.codePointAt(n)===37&&t.codePointAt(n+1)===50){let e=t.codePointAt(n+2);if(e===70||e===102){let e=TypeError(`File URL path must not include encoded / characters`);throw e.code=`ERR_INVALID_FILE_URL_PATH`,e}}return decodeURIComponent(t)}var iwe=s((()=>{twe()}));function oh(e,t){if(e&&e.includes(ih.sep))throw Error("`"+t+"` cannot be a path: did not expect `"+ih.sep+"`")}function sh(e,t){if(!e)throw Error("`"+t+"` cannot be empty")}function awe(e,t){if(!e)throw Error("Setting `"+t+"` requires `path` to be set too")}function owe(e){return!!(e&&typeof e==`object`&&`byteLength`in e&&`byteOffset`in e)}var ch,lh,swe=s((()=>{WCe(),ZCe(),ewe(),iwe(),ch=[`history`,`path`,`basename`,`stem`,`extname`,`dirname`],lh=class{constructor(e){let t;t=e?ah(e)?{path:e}:typeof e==`string`||owe(e)?{value:e}:e:{},this.cwd=`cwd`in t?``:$Ce.cwd(),this.data={},this.history=[],this.messages=[],this.value,this.map,this.result,this.stored;let n=-1;for(;++n<ch.length;){let e=ch[n];e in t&&t[e]!==void 0&&t[e]!==null&&(this[e]=e===`history`?[...t[e]]:t[e])}let r;for(r in t)ch.includes(r)||(this[r]=t[r])}get basename(){return typeof this.path==`string`?ih.basename(this.path):void 0}set basename(e){sh(e,`basename`),oh(e,`basename`),this.path=ih.join(this.dirname||``,e)}get dirname(){return typeof this.path==`string`?ih.dirname(this.path):void 0}set dirname(e){awe(this.basename,`dirname`),this.path=ih.join(e||``,this.basename)}get extname(){return typeof this.path==`string`?ih.extname(this.path):void 0}set extname(e){if(oh(e,`extname`),awe(this.dirname,`extname`),e){if(e.codePointAt(0)!==46)throw Error("`extname` must start with `.`");if(e.includes(`.`,1))throw Error("`extname` cannot contain multiple dots")}this.path=ih.join(this.dirname,this.stem+(e||``))}get path(){return this.history[this.history.length-1]}set path(e){ah(e)&&(e=nwe(e)),sh(e,`path`),this.path!==e&&this.history.push(e)}get stem(){return typeof this.path==`string`?ih.basename(this.path,this.extname):void 0}set stem(e){sh(e,`stem`),oh(e,`stem`),this.path=ih.join(this.dirname||``,e+(this.extname||``))}fail(e,t,n){let r=this.message(e,t,n);throw r.fatal=!0,r}info(e,t,n){let r=this.message(e,t,n);return r.fatal=void 0,r}message(e,t,n){let r=new nh(e,t,n);return this.path&&(r.name=this.path+`:`+r.name,r.file=this.path),r.fatal=!1,this.messages.push(r),r}toString(e){return this.value===void 0?``:typeof this.value==`string`?this.value:new TextDecoder(e||void 0).decode(this.value)}}})),cwe=s((()=>{swe()})),lwe,uwe=s((()=>{lwe={abandonedHeadElementChild:{reason:`Unexpected metadata element after head`,description:"Unexpected element after head. Expected the element before `</head>`",url:!1},abruptClosingOfEmptyComment:{reason:`Unexpected abruptly closed empty comment`,description:"Unexpected `>` or `->`. Expected `-->` to close comments"},abruptDoctypePublicIdentifier:{reason:`Unexpected abruptly closed public identifier`,description:"Unexpected `>`. Expected a closing `\"` or `'` after the public identifier"},abruptDoctypeSystemIdentifier:{reason:`Unexpected abruptly closed system identifier`,description:"Unexpected `>`. Expected a closing `\"` or `'` after the identifier identifier"},absenceOfDigitsInNumericCharacterReference:{reason:`Unexpected non-digit at start of numeric character reference`,description:"Unexpected `%c`. Expected `[0-9]` for decimal references or `[0-9a-fA-F]` for hexadecimal references"},cdataInHtmlContent:{reason:`Unexpected CDATA section in HTML`,description:"Unexpected `<![CDATA[` in HTML. Remove it, use a comment, or encode special characters instead"},characterReferenceOutsideUnicodeRange:{reason:`Unexpected too big numeric character reference`,description:`Unexpectedly high character reference. Expected character references to be at most hexadecimal 10ffff (or decimal 1114111)`},closingOfElementWithOpenChildElements:{reason:`Unexpected closing tag with open child elements`,description:`Unexpectedly closing tag. Expected other tags to be closed first`,url:!1},controlCharacterInInputStream:{reason:`Unexpected control character`,description:"Unexpected control character `%x`. Expected a non-control code point, 0x00, or ASCII whitespace"},controlCharacterReference:{reason:`Unexpected control character reference`,description:`Unexpectedly control character in reference. Expected a non-control code point, 0x00, or ASCII whitespace`},disallowedContentInNoscriptInHead:{reason:"Disallowed content inside `<noscript>` in `<head>`",description:"Unexpected text character `%c`. Only use text in `<noscript>`s in `<body>`",url:!1},duplicateAttribute:{reason:`Unexpected duplicate attribute`,description:`Unexpectedly double attribute. Expected attributes to occur only once`},endTagWithAttributes:{reason:`Unexpected attribute on closing tag`,description:"Unexpected attribute. Expected `>` instead"},endTagWithTrailingSolidus:{reason:`Unexpected slash at end of closing tag`,description:"Unexpected `%c-1`. Expected `>` instead"},endTagWithoutMatchingOpenElement:{reason:`Unexpected unopened end tag`,description:`Unexpected end tag. Expected no end tag or another end tag`,url:!1},eofBeforeTagName:{reason:`Unexpected end of file`,description:`Unexpected end of file. Expected tag name instead`},eofInCdata:{reason:`Unexpected end of file in CDATA`,description:"Unexpected end of file. Expected `]]>` to close the CDATA"},eofInComment:{reason:`Unexpected end of file in comment`,description:"Unexpected end of file. Expected `-->` to close the comment"},eofInDoctype:{reason:`Unexpected end of file in doctype`,description:"Unexpected end of file. Expected a valid doctype (such as `<!doctype html>`)"},eofInElementThatCanContainOnlyText:{reason:`Unexpected end of file in element that can only contain text`,description:`Unexpected end of file. Expected text or a closing tag`,url:!1},eofInScriptHtmlCommentLikeText:{reason:`Unexpected end of file in comment inside script`,description:"Unexpected end of file. Expected `-->` to close the comment"},eofInTag:{reason:`Unexpected end of file in tag`,description:"Unexpected end of file. Expected `>` to close the tag"},incorrectlyClosedComment:{reason:`Incorrectly closed comment`,description:"Unexpected `%c-1`. Expected `-->` to close the comment"},incorrectlyOpenedComment:{reason:`Incorrectly opened comment`,description:"Unexpected `%c`. Expected `<!--` to open the comment"},invalidCharacterSequenceAfterDoctypeName:{reason:`Invalid sequence after doctype name`,description:"Unexpected sequence at `%c`. Expected `public` or `system`"},invalidFirstCharacterOfTagName:{reason:`Invalid first character in tag name`,description:"Unexpected `%c`. Expected an ASCII letter instead"},misplacedDoctype:{reason:`Misplaced doctype`,description:`Unexpected doctype. Expected doctype before head`,url:!1},misplacedStartTagForHeadElement:{reason:"Misplaced `<head>` start tag",description:"Unexpected start tag `<head>`. Expected `<head>` directly after doctype",url:!1},missingAttributeValue:{reason:`Missing attribute value`,description:"Unexpected `%c-1`. Expected an attribute value or no `%c-1` instead"},missingDoctype:{reason:`Missing doctype before other content`,description:"Expected a `<!doctype html>` before anything else",url:!1},missingDoctypeName:{reason:`Missing doctype name`,description:"Unexpected doctype end at `%c`. Expected `html` instead"},missingDoctypePublicIdentifier:{reason:`Missing public identifier in doctype`,description:"Unexpected `%c`. Expected identifier for `public` instead"},missingDoctypeSystemIdentifier:{reason:`Missing system identifier in doctype`,description:'Unexpected `%c`. Expected identifier for `system` instead (suggested: `"about:legacy-compat"`)'},missingEndTagName:{reason:`Missing name in end tag`,description:"Unexpected `%c`. Expected an ASCII letter instead"},missingQuoteBeforeDoctypePublicIdentifier:{reason:`Missing quote before public identifier in doctype`,description:"Unexpected `%c`. Expected `\"` or `'` instead"},missingQuoteBeforeDoctypeSystemIdentifier:{reason:`Missing quote before system identifier in doctype`,description:"Unexpected `%c`. Expected `\"` or `'` instead"},missingSemicolonAfterCharacterReference:{reason:`Missing semicolon after character reference`,description:"Unexpected `%c`. Expected `;` instead"},missingWhitespaceAfterDoctypePublicKeyword:{reason:`Missing whitespace after public identifier in doctype`,description:"Unexpected `%c`. Expected ASCII whitespace instead"},missingWhitespaceAfterDoctypeSystemKeyword:{reason:`Missing whitespace after system identifier in doctype`,description:"Unexpected `%c`. Expected ASCII whitespace instead"},missingWhitespaceBeforeDoctypeName:{reason:`Missing whitespace before doctype name`,description:"Unexpected `%c`. Expected ASCII whitespace instead"},missingWhitespaceBetweenAttributes:{reason:`Missing whitespace between attributes`,description:"Unexpected `%c`. Expected ASCII whitespace instead"},missingWhitespaceBetweenDoctypePublicAndSystemIdentifiers:{reason:`Missing whitespace between public and system identifiers in doctype`,description:"Unexpected `%c`. Expected ASCII whitespace instead"},nestedComment:{reason:`Unexpected nested comment`,description:"Unexpected `<!--`. Expected `-->`"},nestedNoscriptInHead:{reason:"Unexpected nested `<noscript>` in `<head>`",description:"Unexpected `<noscript>`. Expected a closing tag or a meta element",url:!1},nonConformingDoctype:{reason:`Unexpected non-conforming doctype declaration`,description:'Expected `<!doctype html>` or `<!doctype html system "about:legacy-compat">`',url:!1},nonVoidHtmlElementStartTagWithTrailingSolidus:{reason:`Unexpected trailing slash on start tag of non-void element`,description:"Unexpected `/`. Expected `>` instead"},noncharacterCharacterReference:{reason:`Unexpected noncharacter code point referenced by character reference`,description:`Unexpected code point. Do not use noncharacters in HTML`},noncharacterInInputStream:{reason:`Unexpected noncharacter character`,description:"Unexpected code point `%x`. Do not use noncharacters in HTML"},nullCharacterReference:{reason:`Unexpected NULL character referenced by character reference`,description:`Unexpected code point. Do not use NULL characters in HTML`},openElementsLeftAfterEof:{reason:`Unexpected end of file`,description:`Unexpected end of file. Expected closing tag instead`,url:!1},surrogateCharacterReference:{reason:`Unexpected surrogate character referenced by character reference`,description:`Unexpected code point. Do not use lone surrogate characters in HTML`},surrogateInInputStream:{reason:`Unexpected surrogate character`,description:"Unexpected code point `%x`. Do not use lone surrogate characters in HTML"},unexpectedCharacterAfterDoctypeSystemIdentifier:{reason:`Invalid character after system identifier in doctype`,description:"Unexpected character at `%c`. Expected `>`"},unexpectedCharacterInAttributeName:{reason:`Unexpected character in attribute name`,description:"Unexpected `%c`. Expected whitespace, `/`, `>`, `=`, or probably an ASCII letter"},unexpectedCharacterInUnquotedAttributeValue:{reason:`Unexpected character in unquoted attribute value`,description:"Unexpected `%c`. Quote the attribute value to include it"},unexpectedEqualsSignBeforeAttributeName:{reason:`Unexpected equals sign before attribute name`,description:"Unexpected `%c`. Add an attribute name before it"},unexpectedNullCharacter:{reason:`Unexpected NULL character`,description:"Unexpected code point `%x`. Do not use NULL characters in HTML"},unexpectedQuestionMarkInsteadOfTagName:{reason:`Unexpected question mark instead of tag name`,description:"Unexpected `%c`. Expected an ASCII letter instead"},unexpectedSolidusInTag:{reason:`Unexpected slash in tag`,description:"Unexpected `%c-1`. Expected it followed by `>` or in a quoted attribute value"},unknownNamedCharacterReference:{reason:`Unexpected unknown named character reference`,description:`Unexpected character reference. Expected known named character references`}}}));function dwe(e,t){let n=t||xwe,r=n.onerror,i=e instanceof lh?e:new lh(e),a=n.fragment?LCe:ICe,o=String(i);return _be(a(o,{sourceCodeLocationInfo:!0,onParseError:n.onerror?s:null,scriptingEnabled:!1}),{file:i,space:n.space,verbose:n.verbose});function s(e){let t=e.code,a=fwe(t),s=n[a]??!0,c=typeof s==`number`?s:s?1:0;if(c){let n=lwe[a],o=new nh(l(n.reason),{place:{start:{line:e.startLine,column:e.startCol,offset:e.startOffset},end:{line:e.endLine,column:e.endCol,offset:e.endOffset}},ruleId:t,source:`hast-util-from-html`});i.path&&(o.file=i.path,o.name=i.path+`:`+o.name),o.fatal=bwe[c],o.note=l(n.description),o.url=n.url===!1?void 0:gwe+t,r(o)}function l(t){return t.replace(vwe,n).replace(ywe,r);function n(t,n,r){let i=(r?Number.parseInt(r,10):0)*(n===`-`?-1:1);return mwe(o.charAt(e.startOffset+i))}function r(){return hwe(o.charCodeAt(e.startOffset))}}}}function fwe(e){return e.replace(_we,pwe)}function pwe(e){return e.charAt(1).toUpperCase()}function mwe(e){return e==="`"?"` ` `":e}function hwe(e){return`0x`+e.toString(16).toUpperCase()}var gwe,_we,vwe,ywe,bwe,xwe,Swe=s((()=>{ep(),wbe(),RCe(),cwe(),WCe(),uwe(),gwe=`https://html.spec.whatwg.org/multipage/parsing.html#parse-error-`,_we=/-[a-z]/g,vwe=/%c(?:([-+])(\d+))?/g,ywe=/%x/g,bwe={2:!0,1:!1,0:null},xwe={}})),Cwe=s((()=>{Swe()}));function wwe(e){let t=this,{emitParseErrors:n,...r}={...t.data(`settings`),...e};t.parser=i;function i(e,t){return dwe(e,{...r,onerror:n?function(e){t.path&&(e.name=t.path+`:`+e.name,e.file=t.path),t.messages.push(e)}:void 0})}}var Twe=s((()=>{Cwe()})),Ewe=s((()=>{Twe()})),uh,Dwe=s((()=>{uh=[`area`,`base`,`basefont`,`bgsound`,`br`,`col`,`command`,`embed`,`frame`,`hr`,`image`,`img`,`input`,`keygen`,`link`,`meta`,`param`,`source`,`track`,`wbr`]}));function dh(e,t){let n=t||{};function r(t,...n){let i=r.invalid,a=r.handlers;if(t&&fh.call(t,e)){let n=String(t[e]);i=fh.call(a,n)?a[n]:r.unknown}if(i)return i.call(this,t,...n)}return r.handlers=n.handlers||{},r.invalid=n.invalid,r.unknown=n.unknown,r}var fh,ph=s((()=>{fh={}.hasOwnProperty}));function Owe(e,t){if(e=e.replace(t.subset?kwe(t.subset):jwe,r),t.subset||t.escapeOnly)return e;return e.replace(Mwe,n).replace(Nwe,r);function n(e,n,r){return t.format((e.charCodeAt(0)-55296)*1024+e.charCodeAt(1)-56320+65536,r.charCodeAt(n+2),t)}function r(e,n,r){return t.format(e.charCodeAt(0),r.charCodeAt(n+1),t)}}function kwe(e){let t=mh.get(e);return t||(t=Awe(e),mh.set(e,t)),t}function Awe(e){let t=[],n=-1;for(;++n<e.length;)t.push(e[n].replace(Pwe,`\\$&`));return RegExp(`(?:`+t.join(`|`)+`)`,`g`)}var jwe,Mwe,Nwe,Pwe,mh,Fwe=s((()=>{jwe=/["&'<>`]/g,Mwe=/[\uD800-\uDBFF][\uDC00-\uDFFF]/g,Nwe=/[\x01-\t\v\f\x0E-\x1F\x7F\x81\x8D\x8F\x90\x9D\xA0-\uFFFF]/g,Pwe=/[|\\{}()[\]^$+*?.]/g,mh=new WeakMap}));function Iwe(e,t,n){let r=`&#x`+e.toString(16).toUpperCase();return n&&t&&!Lwe.test(String.fromCharCode(t))?r:r+`;`}var Lwe,Rwe=s((()=>{Lwe=/[\dA-Fa-f]/}));function zwe(e,t,n){let r=`&#`+String(e);return n&&t&&!Bwe.test(String.fromCharCode(t))?r:r+`;`}var Bwe,Vwe=s((()=>{Bwe=/\d/})),Hwe,Uwe=s((()=>{Hwe=`AElig.AMP.Aacute.Acirc.Agrave.Aring.Atilde.Auml.COPY.Ccedil.ETH.Eacute.Ecirc.Egrave.Euml.GT.Iacute.Icirc.Igrave.Iuml.LT.Ntilde.Oacute.Ocirc.Ograve.Oslash.Otilde.Ouml.QUOT.REG.THORN.Uacute.Ucirc.Ugrave.Uuml.Yacute.aacute.acirc.acute.aelig.agrave.amp.aring.atilde.auml.brvbar.ccedil.cedil.cent.copy.curren.deg.divide.eacute.ecirc.egrave.eth.euml.frac12.frac14.frac34.gt.iacute.icirc.iexcl.igrave.iquest.iuml.laquo.lt.macr.micro.middot.nbsp.not.ntilde.oacute.ocirc.ograve.ordf.ordm.oslash.otilde.ouml.para.plusmn.pound.quot.raquo.reg.sect.shy.sup1.sup2.sup3.szlig.thorn.times.uacute.ucirc.ugrave.uml.uuml.yacute.yen.yuml`.split(`.`)})),hh,Wwe=s((()=>{hh={nbsp:`\xA0`,iexcl:`¡`,cent:`¢`,pound:`£`,curren:`¤`,yen:`¥`,brvbar:`¦`,sect:`§`,uml:`¨`,copy:`©`,ordf:`ª`,laquo:`«`,not:`¬`,shy:`­`,reg:`®`,macr:`¯`,deg:`°`,plusmn:`±`,sup2:`²`,sup3:`³`,acute:`´`,micro:`µ`,para:`¶`,middot:`·`,cedil:`¸`,sup1:`¹`,ordm:`º`,raquo:`»`,frac14:`¼`,frac12:`½`,frac34:`¾`,iquest:`¿`,Agrave:`À`,Aacute:`Á`,Acirc:`Â`,Atilde:`Ã`,Auml:`Ä`,Aring:`Å`,AElig:`Æ`,Ccedil:`Ç`,Egrave:`È`,Eacute:`É`,Ecirc:`Ê`,Euml:`Ë`,Igrave:`Ì`,Iacute:`Í`,Icirc:`Î`,Iuml:`Ï`,ETH:`Ð`,Ntilde:`Ñ`,Ograve:`Ò`,Oacute:`Ó`,Ocirc:`Ô`,Otilde:`Õ`,Ouml:`Ö`,times:`×`,Oslash:`Ø`,Ugrave:`Ù`,Uacute:`Ú`,Ucirc:`Û`,Uuml:`Ü`,Yacute:`Ý`,THORN:`Þ`,szlig:`ß`,agrave:`à`,aacute:`á`,acirc:`â`,atilde:`ã`,auml:`ä`,aring:`å`,aelig:`æ`,ccedil:`ç`,egrave:`è`,eacute:`é`,ecirc:`ê`,euml:`ë`,igrave:`ì`,iacute:`í`,icirc:`î`,iuml:`ï`,eth:`ð`,ntilde:`ñ`,ograve:`ò`,oacute:`ó`,ocirc:`ô`,otilde:`õ`,ouml:`ö`,divide:`÷`,oslash:`ø`,ugrave:`ù`,uacute:`ú`,ucirc:`û`,uuml:`ü`,yacute:`ý`,thorn:`þ`,yuml:`ÿ`,fnof:`ƒ`,Alpha:`Α`,Beta:`Β`,Gamma:`Γ`,Delta:`Δ`,Epsilon:`Ε`,Zeta:`Ζ`,Eta:`Η`,Theta:`Θ`,Iota:`Ι`,Kappa:`Κ`,Lambda:`Λ`,Mu:`Μ`,Nu:`Ν`,Xi:`Ξ`,Omicron:`Ο`,Pi:`Π`,Rho:`Ρ`,Sigma:`Σ`,Tau:`Τ`,Upsilon:`Υ`,Phi:`Φ`,Chi:`Χ`,Psi:`Ψ`,Omega:`Ω`,alpha:`α`,beta:`β`,gamma:`γ`,delta:`δ`,epsilon:`ε`,zeta:`ζ`,eta:`η`,theta:`θ`,iota:`ι`,kappa:`κ`,lambda:`λ`,mu:`μ`,nu:`ν`,xi:`ξ`,omicron:`ο`,pi:`π`,rho:`ρ`,sigmaf:`ς`,sigma:`σ`,tau:`τ`,upsilon:`υ`,phi:`φ`,chi:`χ`,psi:`ψ`,omega:`ω`,thetasym:`ϑ`,upsih:`ϒ`,piv:`ϖ`,bull:`•`,hellip:`…`,prime:`′`,Prime:`″`,oline:`‾`,frasl:`⁄`,weierp:`℘`,image:`ℑ`,real:`ℜ`,trade:`™`,alefsym:`ℵ`,larr:`←`,uarr:`↑`,rarr:`→`,darr:`↓`,harr:`↔`,crarr:`↵`,lArr:`⇐`,uArr:`⇑`,rArr:`⇒`,dArr:`⇓`,hArr:`⇔`,forall:`∀`,part:`∂`,exist:`∃`,empty:`∅`,nabla:`∇`,isin:`∈`,notin:`∉`,ni:`∋`,prod:`∏`,sum:`∑`,minus:`−`,lowast:`∗`,radic:`√`,prop:`∝`,infin:`∞`,ang:`∠`,and:`∧`,or:`∨`,cap:`∩`,cup:`∪`,int:`∫`,there4:`∴`,sim:`∼`,cong:`≅`,asymp:`≈`,ne:`≠`,equiv:`≡`,le:`≤`,ge:`≥`,sub:`⊂`,sup:`⊃`,nsub:`⊄`,sube:`⊆`,supe:`⊇`,oplus:`⊕`,otimes:`⊗`,perp:`⊥`,sdot:`⋅`,lceil:`⌈`,rceil:`⌉`,lfloor:`⌊`,rfloor:`⌋`,lang:`〈`,rang:`〉`,loz:`◊`,spades:`♠`,clubs:`♣`,hearts:`♥`,diams:`♦`,quot:`"`,amp:`&`,lt:`<`,gt:`>`,OElig:`Œ`,oelig:`œ`,Scaron:`Š`,scaron:`š`,Yuml:`Ÿ`,circ:`ˆ`,tilde:`˜`,ensp:` `,emsp:` `,thinsp:` `,zwnj:`‌`,zwj:`‍`,lrm:`‎`,rlm:`‏`,ndash:`–`,mdash:`—`,lsquo:`‘`,rsquo:`’`,sbquo:`‚`,ldquo:`“`,rdquo:`”`,bdquo:`„`,dagger:`†`,Dagger:`‡`,permil:`‰`,lsaquo:`‹`,rsaquo:`›`,euro:`€`}})),Gwe,Kwe=s((()=>{Gwe=[`cent`,`copy`,`divide`,`gt`,`lt`,`not`,`para`,`times`]}));function qwe(e,t,n,r){let i=String.fromCharCode(e);if(gh.call(_h,i)){let e=_h[i],a=`&`+e;return n&&Hwe.includes(e)&&!Gwe.includes(e)&&(!r||t&&t!==61&&Jwe.test(String.fromCharCode(t)))?a:a+`;`}return``}var gh,_h,vh,Jwe,Ywe=s((()=>{for(vh in Uwe(),Wwe(),Kwe(),gh={}.hasOwnProperty,_h={},hh)gh.call(hh,vh)&&(_h[hh[vh]]=vh);Jwe=/[^\dA-Za-z]/}));function Xwe(e,t,n){let r=Iwe(e,t,n.omitOptionalSemicolons),i;if((n.useNamedReferences||n.useShortestReferences)&&(i=qwe(e,t,n.omitOptionalSemicolons,n.attribute)),(n.useShortestReferences||!i)&&n.useShortestReferences){let i=zwe(e,t,n.omitOptionalSemicolons);i.length<r.length&&(r=i)}return i&&(!n.useShortestReferences||i.length<r.length)?i:r}var Zwe=s((()=>{Rwe(),Vwe(),Ywe()}));function yh(e,t){return Owe(e,Object.assign({format:Xwe},t))}var Qwe=s((()=>{Fwe(),Zwe()})),bh=s((()=>{Qwe()}));function $we(e,t,n,r){return r.settings.bogusComments?`<?`+yh(e.value,Object.assign({},r.settings.characterReferences,{subset:tTe}))+`>`:`<!--`+e.value.replace(eTe,i)+`-->`;function i(e){return yh(e,Object.assign({},r.settings.characterReferences,{subset:nTe}))}}var eTe,tTe,nTe,rTe=s((()=>{bh(),eTe=/^>|^->|<!--|-->|--!>|<!-$/g,tTe=[`>`],nTe=[`<`,`>`]}));function iTe(e,t,n,r){return`<!`+(r.settings.upperDoctype?`DOCTYPE`:`doctype`)+(r.settings.tightDoctype?``:` `)+`html>`}var aTe=s((()=>{}));function xh(e,t){let n=String(e);if(typeof t!=`string`)throw TypeError(`Expected character`);let r=0,i=n.indexOf(t);for(;i!==-1;)r++,i=n.indexOf(t,i+t.length);return r}var oTe=s((()=>{}));function Sh(e){return typeof e==`object`?e.type===`text`?sTe(e.value):!1:sTe(e)}function sTe(e){return e.replace(cTe,``)===``}var cTe,lTe=s((()=>{cTe=/[ \t\n\f\r]/g})),Ch=s((()=>{lTe()}));function uTe(e){return t;function t(t,n,r){let i=t?t.children:dTe,a=(n||0)+e,o=i[a];if(!r)for(;o&&Sh(o);)a+=e,o=i[a];return o}}var wh,Th,dTe,fTe=s((()=>{Ch(),wh=uTe(1),Th=uTe(-1),dTe=[]}));function pTe(e){return t;function t(t,n,r){return mTe.call(e,t.tagName)&&e[t.tagName](t,n,r)}}var mTe,hTe=s((()=>{mTe={}.hasOwnProperty}));function Eh(e,t,n){let r=wh(n,t,!0);return!r||r.type!==`comment`&&!(r.type===`text`&&Sh(r.value.charAt(0)))}function gTe(e,t,n){let r=wh(n,t);return!r||r.type!==`comment`}function _Te(e,t,n){let r=wh(n,t);return!r||r.type!==`comment`}function vTe(e,t,n){let r=wh(n,t);return r?r.type===`element`&&(r.tagName===`address`||r.tagName===`article`||r.tagName===`aside`||r.tagName===`blockquote`||r.tagName===`details`||r.tagName===`div`||r.tagName===`dl`||r.tagName===`fieldset`||r.tagName===`figcaption`||r.tagName===`figure`||r.tagName===`footer`||r.tagName===`form`||r.tagName===`h1`||r.tagName===`h2`||r.tagName===`h3`||r.tagName===`h4`||r.tagName===`h5`||r.tagName===`h6`||r.tagName===`header`||r.tagName===`hgroup`||r.tagName===`hr`||r.tagName===`main`||r.tagName===`menu`||r.tagName===`nav`||r.tagName===`ol`||r.tagName===`p`||r.tagName===`pre`||r.tagName===`section`||r.tagName===`table`||r.tagName===`ul`):!n||!(n.type===`element`&&(n.tagName===`a`||n.tagName===`audio`||n.tagName===`del`||n.tagName===`ins`||n.tagName===`map`||n.tagName===`noscript`||n.tagName===`video`))}function yTe(e,t,n){let r=wh(n,t);return!r||r.type===`element`&&r.tagName===`li`}function bTe(e,t,n){let r=wh(n,t);return!!(r&&r.type===`element`&&(r.tagName===`dt`||r.tagName===`dd`))}function xTe(e,t,n){let r=wh(n,t);return!r||r.type===`element`&&(r.tagName===`dt`||r.tagName===`dd`)}function STe(e,t,n){let r=wh(n,t);return!r||r.type===`element`&&(r.tagName===`rp`||r.tagName===`rt`)}function CTe(e,t,n){let r=wh(n,t);return!r||r.type===`element`&&r.tagName===`optgroup`}function wTe(e,t,n){let r=wh(n,t);return!r||r.type===`element`&&(r.tagName===`option`||r.tagName===`optgroup`)}function TTe(e,t,n){let r=wh(n,t);return!!(r&&r.type===`element`&&(r.tagName===`tbody`||r.tagName===`tfoot`))}function ETe(e,t,n){let r=wh(n,t);return!r||r.type===`element`&&(r.tagName===`tbody`||r.tagName===`tfoot`)}function DTe(e,t,n){return!wh(n,t)}function OTe(e,t,n){let r=wh(n,t);return!r||r.type===`element`&&r.tagName===`tr`}function kTe(e,t,n){let r=wh(n,t);return!r||r.type===`element`&&(r.tagName===`td`||r.tagName===`th`)}var Dh,ATe=s((()=>{Ch(),fTe(),hTe(),Dh=pTe({body:_Te,caption:Eh,colgroup:Eh,dd:xTe,dt:bTe,head:Eh,html:gTe,li:yTe,optgroup:CTe,option:wTe,p:vTe,rp:STe,rt:STe,tbody:ETe,td:kTe,tfoot:DTe,th:kTe,thead:TTe,tr:OTe})}));function jTe(e){let t=wh(e,-1);return!t||t.type!==`comment`}function MTe(e){let t=new Set;for(let n of e.children)if(n.type===`element`&&(n.tagName===`base`||n.tagName===`title`)){if(t.has(n.tagName))return!1;t.add(n.tagName)}let n=e.children[0];return!n||n.type===`element`}function NTe(e){let t=wh(e,-1,!0);return!t||t.type!==`comment`&&!(t.type===`text`&&Sh(t.value.charAt(0)))&&!(t.type===`element`&&(t.tagName===`meta`||t.tagName===`link`||t.tagName===`script`||t.tagName===`style`||t.tagName===`template`))}function PTe(e,t,n){let r=Th(n,t),i=wh(e,-1,!0);return n&&r&&r.type===`element`&&r.tagName===`colgroup`&&Dh(r,n.children.indexOf(r),n)?!1:!!(i&&i.type===`element`&&i.tagName===`col`)}function FTe(e,t,n){let r=Th(n,t),i=wh(e,-1);return n&&r&&r.type===`element`&&(r.tagName===`thead`||r.tagName===`tbody`)&&Dh(r,n.children.indexOf(r),n)?!1:!!(i&&i.type===`element`&&i.tagName===`tr`)}var ITe,LTe=s((()=>{Ch(),fTe(),ATe(),hTe(),ITe=pTe({body:NTe,colgroup:PTe,head:MTe,html:jTe,tbody:FTe})}));function RTe(e,t,n,r){let i=r.schema,a=i.space===`svg`?!1:r.settings.omitOptionalTags,o=i.space===`svg`?r.settings.closeEmptyElements:r.settings.voids.includes(e.tagName.toLowerCase()),s=[],c;i.space===`html`&&e.tagName===`svg`&&(r.schema=Ep);let l=zTe(r,e.properties),u=r.all(i.space===`html`&&e.tagName===`template`?e.content:e);return r.schema=i,u&&(o=!1),(l||!a||!ITe(e,t,n))&&(s.push(`<`,e.tagName,l?` `+l:``),o&&(i.space===`svg`||r.settings.closeSelfClosing)&&(c=l.charAt(l.length-1),(!r.settings.tightSelfClosing||c===`/`||c&&c!==`"`&&c!==`'`)&&s.push(` `),s.push(`/`)),s.push(`>`)),s.push(u),!o&&(!a||!Dh(e,t,n))&&s.push(`</`+e.tagName+`>`),s.join(``)}function zTe(e,t){let n=[],r=-1,i;if(t){for(i in t)if(t[i]!==null&&t[i]!==void 0){let r=BTe(e,i,t[i]);r&&n.push(r)}}for(;++r<n.length;){let t=e.settings.tightAttributes?n[r].charAt(n[r].length-1):void 0;r!==n.length-1&&t!==`"`&&t!==`'`&&(n[r]+=` `)}return n.join(``)}function BTe(e,t,n){let r=Cp(e.schema,t),i=e.settings.allowParseErrors&&e.schema.space===`html`?0:1,a=e.settings.allowDangerousCharacters?0:1,o=e.quote,s;if(r.overloadedBoolean&&(n===r.attribute||n===``)?n=!0:(r.boolean||r.overloadedBoolean)&&(typeof n!=`string`||n===r.attribute||n===``)&&(n=!!n),n==null||n===!1||typeof n==`number`&&Number.isNaN(n))return``;let c=yh(r.attribute,Object.assign({},e.settings.characterReferences,{subset:Oh.name[i][a]}));return n===!0||(n=Array.isArray(n)?(r.commaSeparated?Yye:$ye)(n,{padLeft:!e.settings.tightCommaSeparatedLists}):String(n),e.settings.collapseEmptyAttributes&&!n)?c:(e.settings.preferUnquoted&&(s=yh(n,Object.assign({},e.settings.characterReferences,{attribute:!0,subset:Oh.unquoted[i][a]}))),s!==n&&(e.settings.quoteSmart&&xh(n,o)>xh(n,e.alternative)&&(o=e.alternative),s=o+yh(n,Object.assign({},e.settings.characterReferences,{subset:(o===`'`?Oh.single:Oh.double)[i][a],attribute:!0}))+o),c+(s&&`=`+s))}var Oh,VTe=s((()=>{oTe(),Op(),Dp(),jp(),bh(),ATe(),LTe(),Oh={name:[[`	
-\f\r &/=>`.split(``),`	
-\f\r "&'/=>\``.split(``)],[`\0	
-\f\r "&'/<=>`.split(``),`\0	
-\f\r "&'/<=>\``.split(``)]],unquoted:[[`	
-\f\r &>`.split(``),`\0	
-\f\r "&'<=>\``.split(``)],[`\0	
-\f\r "&'<=>\``.split(``),`\0	
-\f\r "&'<=>\``.split(``)]],single:[[`&'`.split(``),`"&'\``.split(``)],[`\0&'`.split(``),`\0"&'\``.split(``)]],double:[[`"&`.split(``),`"&'\``.split(``)],[`\0"&`.split(``),`\0"&'\``.split(``)]]}}));function HTe(e,t,n,r){return n&&n.type===`element`&&(n.tagName===`script`||n.tagName===`style`)?e.value:yh(e.value,Object.assign({},r.settings.characterReferences,{subset:UTe}))}var UTe,WTe=s((()=>{bh(),UTe=[`<`,`&`]}));function GTe(e,t,n,r){return r.settings.allowDangerousHtml?e.value:HTe(e,t,n,r)}var KTe=s((()=>{WTe()}));function qTe(e,t,n,r){return r.all(e)}var JTe=s((()=>{}));function YTe(e){throw Error("Expected node, not `"+e+"`")}function XTe(e){let t=e;throw Error("Cannot compile unknown node `"+t.type+"`")}var ZTe,QTe=s((()=>{ph(),rTe(),aTe(),VTe(),KTe(),JTe(),WTe(),ZTe=dh(`type`,{invalid:YTe,unknown:XTe,handlers:{comment:$we,doctype:iTe,element:RTe,raw:GTe,root:qTe,text:HTe}})}));function $Te(e,t){let n=t||nEe,r=n.quote||`"`,i=r===`"`?`'`:`"`;if(r!==`"`&&r!==`'`)throw Error("Invalid quote `"+r+"`, expected `'` or `\"`");return{one:eEe,all:tEe,settings:{omitOptionalTags:n.omitOptionalTags||!1,allowParseErrors:n.allowParseErrors||!1,allowDangerousCharacters:n.allowDangerousCharacters||!1,quoteSmart:n.quoteSmart||!1,preferUnquoted:n.preferUnquoted||!1,tightAttributes:n.tightAttributes||!1,upperDoctype:n.upperDoctype||!1,tightDoctype:n.tightDoctype||!1,bogusComments:n.bogusComments||!1,tightCommaSeparatedLists:n.tightCommaSeparatedLists||!1,tightSelfClosing:n.tightSelfClosing||!1,collapseEmptyAttributes:n.collapseEmptyAttributes||!1,allowDangerousHtml:n.allowDangerousHtml||!1,voids:n.voids||uh,characterReferences:n.characterReferences||rEe,closeSelfClosing:n.closeSelfClosing||!1,closeEmptyElements:n.closeEmptyElements||!1},schema:n.space===`svg`?Ep:Tp,quote:r,alternative:i}.one(Array.isArray(e)?{type:`root`,children:e}:e,void 0,void 0)}function eEe(e,t,n){return ZTe(e,t,n,this)}function tEe(e){let t=[],n=e&&e.children||iEe,r=-1;for(;++r<n.length;)t[r]=this.one(n[r],r,e);return t.join(``)}var nEe,rEe,iEe,aEe=s((()=>{Dwe(),Dp(),QTe(),nEe={},rEe={},iEe=[]})),oEe=s((()=>{aEe()}));function kh(e){let t=this,n={...t.data(`settings`),...e};t.compiler=r;function r(e){return $Te(e,n)}}var sEe=s((()=>{oEe()})),cEe=s((()=>{sEe()}));function lEe(e){if(e)throw e}var uEe=s((()=>{})),dEe=c(((e,t)=>{var n=Object.prototype.hasOwnProperty,r=Object.prototype.toString,i=Object.defineProperty,a=Object.getOwnPropertyDescriptor,o=function(e){return typeof Array.isArray==`function`?Array.isArray(e):r.call(e)===`[object Array]`},s=function(e){if(!e||r.call(e)!==`[object Object]`)return!1;var t=n.call(e,`constructor`),i=e.constructor&&e.constructor.prototype&&n.call(e.constructor.prototype,`isPrototypeOf`);if(e.constructor&&!t&&!i)return!1;for(var a in e);return a===void 0||n.call(e,a)},c=function(e,t){i&&t.name===`__proto__`?i(e,t.name,{enumerable:!0,configurable:!0,value:t.newValue,writable:!0}):e[t.name]=t.newValue},l=function(e,t){if(t===`__proto__`){if(!n.call(e,t))return;if(a)return a(e,t).value}return e[t]};t.exports=function e(){var t,n,r,i,a,u,d=arguments[0],f=1,p=arguments.length,m=!1;for(typeof d==`boolean`&&(m=d,d=arguments[1]||{},f=2),(d==null||typeof d!=`object`&&typeof d!=`function`)&&(d={});f<p;++f)if(t=arguments[f],t!=null)for(n in t)r=l(d,n),i=l(t,n),d!==i&&(m&&i&&(s(i)||(a=o(i)))?(a?(a=!1,u=r&&o(r)?r:[]):u=r&&s(r)?r:{},c(d,{name:n,newValue:e(m,u,i)})):i!==void 0&&c(d,{name:n,newValue:i}));return d}}));function Ah(e){if(typeof e!=`object`||!e)return!1;let t=Object.getPrototypeOf(e);return(t===null||t===Object.prototype||Object.getPrototypeOf(t)===null)&&!(Symbol.toStringTag in e)&&!(Symbol.iterator in e)}var fEe=s((()=>{}));function pEe(){let e=[],t={run:n,use:r};return t;function n(...t){let n=-1,r=t.pop();if(typeof r!=`function`)throw TypeError(`Expected function as last argument, not `+r);i(null,...t);function i(a,...o){let s=e[++n],c=-1;if(a){r(a);return}for(;++c<t.length;)(o[c]===null||o[c]===void 0)&&(o[c]=t[c]);t=o,s?mEe(s,i)(...o):r(null,...o)}}function r(n){if(typeof n!=`function`)throw TypeError("Expected `middelware` to be a function, not "+n);return e.push(n),t}}function mEe(e,t){let n;return r;function r(...t){let r=e.length>t.length,o;r&&t.push(i);try{o=e.apply(this,t)}catch(e){let t=e;if(r&&n)throw t;return i(t)}r||(o&&o.then&&typeof o.then==`function`?o.then(a,i):o instanceof Error?i(o):a(o))}function i(e,...r){n||(n=!0,t(e,...r))}function a(e){i(null,e)}}var hEe=s((()=>{})),gEe=s((()=>{hEe()})),_Ee,vEe=s((()=>{_Ee=(function(e){let t=this.constructor.prototype,n=t[e],r=function(){return n.apply(r,arguments)};return Object.setPrototypeOf(r,t),r})}));function jh(e,t){if(typeof t!=`function`)throw TypeError("Cannot `"+e+"` without `parser`")}function Mh(e,t){if(typeof t!=`function`)throw TypeError("Cannot `"+e+"` without `compiler`")}function Nh(e,t){if(t)throw Error("Cannot call `"+e+"` on a frozen processor.\nCreate a new processor first, by calling it: use `processor()` instead of `processor`.")}function yEe(e){if(!Ah(e)||typeof e.type!=`string`)throw TypeError("Expected node, got `"+e+"`")}function bEe(e,t,n){if(!n)throw Error("`"+e+"` finished async. Use `"+t+"` instead")}function Ph(e){return xEe(e)?e:new lh(e)}function xEe(e){return!!(e&&typeof e==`object`&&`message`in e&&`messages`in e)}function SEe(e){return typeof e==`string`||CEe(e)}function CEe(e){return!!(e&&typeof e==`object`&&`byteLength`in e&&`byteOffset`in e)}var Fh,wEe,TEe,Ih,EEe=s((()=>{uEe(),Fh=d(dEe(),1),ep(),fEe(),gEe(),cwe(),vEe(),wEe={}.hasOwnProperty,TEe=class e extends _Ee{constructor(){super(`copy`),this.Compiler=void 0,this.Parser=void 0,this.attachers=[],this.compiler=void 0,this.freezeIndex=-1,this.frozen=void 0,this.namespace={},this.parser=void 0,this.transformers=pEe()}copy(){let t=new e,n=-1;for(;++n<this.attachers.length;){let e=this.attachers[n];t.use(...e)}return t.data((0,Fh.default)(!0,{},this.namespace)),t}data(e,t){return typeof e==`string`?arguments.length===2?(Nh(`data`,this.frozen),this.namespace[e]=t,this):wEe.call(this.namespace,e)&&this.namespace[e]||void 0:e?(Nh(`data`,this.frozen),this.namespace=e,this):this.namespace}freeze(){if(this.frozen)return this;let e=this;for(;++this.freezeIndex<this.attachers.length;){let[t,...n]=this.attachers[this.freezeIndex];if(n[0]===!1)continue;n[0]===!0&&(n[0]=void 0);let r=t.call(e,...n);typeof r==`function`&&this.transformers.use(r)}return this.frozen=!0,this.freezeIndex=1/0,this}parse(e){this.freeze();let t=Ph(e),n=this.parser||this.Parser;return jh(`parse`,n),n(String(t),t)}process(e,t){let n=this;return this.freeze(),jh(`process`,this.parser||this.Parser),Mh(`process`,this.compiler||this.Compiler),t?r(void 0,t):new Promise(r);function r(r,i){let a=Ph(e),o=n.parse(a);n.run(o,a,function(e,t,r){if(e||!t||!r)return s(e);let i=t,a=n.stringify(i,r);SEe(a)?r.value=a:r.result=a,s(e,r)});function s(e,n){e||!n?i(e):r?r(n):t(void 0,n)}}}processSync(e){let t=!1,n;return this.freeze(),jh(`processSync`,this.parser||this.Parser),Mh(`processSync`,this.compiler||this.Compiler),this.process(e,r),bEe(`processSync`,`process`,t),n;function r(e,r){t=!0,lEe(e),n=r}}run(e,t,n){yEe(e),this.freeze();let r=this.transformers;return!n&&typeof t==`function`&&(n=t,t=void 0),n?i(void 0,n):new Promise(i);function i(i,a){let o=Ph(t);r.run(e,o,s);function s(t,r,o){let s=r||e;t?a(t):i?i(s):n(void 0,s,o)}}}runSync(e,t){let n=!1,r;return this.run(e,t,i),bEe(`runSync`,`run`,n),r;function i(e,t){lEe(e),r=t,n=!0}}stringify(e,t){this.freeze();let n=Ph(t),r=this.compiler||this.Compiler;return Mh(`stringify`,r),yEe(e),r(e,n)}use(e,...t){let n=this.attachers,r=this.namespace;if(Nh(`use`,this.frozen),e!=null)if(typeof e==`function`)s(e,t);else if(typeof e==`object`)Array.isArray(e)?o(e):a(e);else throw TypeError("Expected usable value, not `"+e+"`");return this;function i(e){if(typeof e==`function`)s(e,[]);else if(typeof e==`object`)if(Array.isArray(e)){let[t,...n]=e;s(t,n)}else a(e);else throw TypeError("Expected usable value, not `"+e+"`")}function a(e){if(!(`plugins`in e)&&!(`settings`in e))throw Error("Expected usable value but received an empty preset, which is probably a mistake: presets typically come with `plugins` and sometimes with `settings`, but this has neither");o(e.plugins),e.settings&&(r.settings=(0,Fh.default)(!0,r.settings,e.settings))}function o(e){let t=-1;if(e!=null)if(Array.isArray(e))for(;++t<e.length;){let n=e[t];i(n)}else throw TypeError("Expected a list of plugins, not `"+e+"`")}function s(e,t){let r=-1,i=-1;for(;++r<n.length;)if(n[r][0]===e){i=r;break}if(i===-1)n.push([e,...t]);else if(t.length>0){let[r,...a]=t,o=n[i][1];Ah(o)&&Ah(r)&&(r=(0,Fh.default)(!0,o,r)),n[i]=[e,r,...a]}}}},Ih=new TEe().freeze()})),DEe=s((()=>{EEe()}));function OEe(e){let t=[],n=-1;for(;++n<e.length;)t[n]=Rh(e[n]);return Lh(r);function r(...e){let n=-1;for(;++n<t.length;)if(t[n].apply(this,e))return!0;return!1}}function kEe(e){let t=e;return Lh(n);function n(n){let r=n,i;for(i in e)if(r[i]!==t[i])return!1;return!0}}function AEe(e){return Lh(t);function t(t){return t&&t.type===e}}function Lh(e){return t;function t(t,n,r){return!!(MEe(t)&&e.call(this,t,typeof n==`number`?n:void 0,r||void 0))}}function jEe(){return!0}function MEe(e){return typeof e==`object`&&!!e&&`type`in e}var Rh,NEe=s((()=>{Rh=(function(e){if(e==null)return jEe;if(typeof e==`function`)return Lh(e);if(typeof e==`object`)return Array.isArray(e)?OEe(e):kEe(e);if(typeof e==`string`)return AEe(e);throw Error(`Expected function, string, or object as test`)})})),zh=s((()=>{NEe()}));function PEe(e){return e}var FEe=s((()=>{}));function Bh(e,t,n,r){let i;typeof t==`function`&&typeof n!=`function`?(r=n,n=t):i=t;let a=Rh(i),o=r?-1:1;s(e,void 0,[])();function s(e,i,c){let l=e&&typeof e==`object`?e:{};if(typeof l.type==`string`){let t=typeof l.tagName==`string`?l.tagName:typeof l.name==`string`?l.name:void 0;Object.defineProperty(u,`name`,{value:`node (`+PEe(e.type+(t?`<`+t+`>`:``))+`)`})}return u;function u(){let l=Vh,u,d,f;if((!t||a(e,i,c[c.length-1]||void 0))&&(l=IEe(n(e,c)),l[0]===!1))return l;if(`children`in e&&e.children){let t=e;if(t.children&&l[0]!==`skip`)for(d=(r?t.children.length:-1)+o,f=c.concat(t);d>-1&&d<t.children.length;){let e=t.children[d];if(u=s(e,d,f)(),u[0]===!1)return u;d=typeof u[1]==`number`?u[1]:d+o}}return l}}}function IEe(e){return Array.isArray(e)?e:typeof e==`number`?[!0,e]:e==null?Vh:[e]}var Vh,Hh,LEe=s((()=>{zh(),FEe(),Vh=[],Hh=`skip`})),Uh=s((()=>{LEe()}));function Wh(e,t,n,r){let i,a,o;typeof t==`function`&&typeof n!=`function`?(a=void 0,o=t,i=n):(a=t,o=n,i=r),Bh(e,a,s,i);function s(e,t){let n=t[t.length-1],r=n?n.children.indexOf(e):void 0;return o(e,r,n)}}var REe=s((()=>{Uh()})),Gh=s((()=>{REe()})),Kh,zEe=s((()=>{Kh={ts:`typescript`,js:`javascript`,py:`python`,py3:`python`,"c#":`csharp`,"c++":`cpp`,node:`javascript`}})),qh,BEe=s((()=>{zh(),qh=(function(e,t,n){let r=Rh(n);if(!e||!e.type||!e.children)throw Error(`Expected parent node`);if(typeof t==`number`){if(t<0||t===1/0)throw Error(`Expected positive finite number as index`)}else if(t=e.children.indexOf(t),t<0)throw Error(`Expected child node or index`);for(;++t<e.children.length;)if(r(e.children[t],t,e))return e.children[t]})})),VEe=s((()=>{BEe()}));function HEe(e){let t=[],n=-1;for(;++n<e.length;)t[n]=Xh(e[n]);return Jh(r);function r(...e){let n=-1;for(;++n<t.length;)if(t[n].apply(this,e))return!0;return!1}}function UEe(e){return Jh(t);function t(t){return t.tagName===e}}function Jh(e){return t;function t(t,n,r){return!!(GEe(t)&&e.call(this,t,typeof n==`number`?n:void 0,r||void 0))}}function WEe(e){return!!(e&&typeof e==`object`&&`type`in e&&e.type===`element`&&`tagName`in e&&typeof e.tagName==`string`)}function GEe(e){return typeof e==`object`&&!!e&&`type`in e&&`tagName`in e}var Yh,Xh,KEe=s((()=>{Yh=(function(e,t,n,r,i){let a=Xh(t);if(n!=null&&(typeof n!=`number`||n<0||n===1/0))throw Error("Expected positive finite `index`");if(r!=null&&(!r.type||!r.children))throw Error("Expected valid `parent`");if(n==null!=(r==null))throw Error("Expected both `index` and `parent`");return GEe(e)?a.call(i,e,n,r):!1}),Xh=(function(e){if(e==null)return WEe;if(typeof e==`string`)return UEe(e);if(typeof e==`object`)return HEe(e);if(typeof e==`function`)return Jh(e);throw Error("Expected function, string, or array as `test`")})})),Zh=s((()=>{KEe()}));function qEe(e,t){let n=t||{},r=`children`in e?e.children:[],i=rg(e),a=$Ee(e,{whitespace:n.whitespace||`normal`,breakBefore:!1,breakAfter:!1}),o=[];(e.type===`text`||e.type===`comment`)&&o.push(...XEe(e,{whitespace:a,breakBefore:!0,breakAfter:!0}));let s=-1;for(;++s<r.length;)o.push(...JEe(r[s],e,{whitespace:a,breakBefore:s?void 0:i,breakAfter:s<r.length-1?eg(r[s+1]):i}));let c=[],l;for(s=-1;++s<o.length;){let e=o[s];typeof e==`number`?l!==void 0&&e>l&&(l=e):e&&(l!==void 0&&l>-1&&c.push(`
-`.repeat(l)||` `),l=-1,c.push(e))}return c.join(``)}function JEe(e,t,n){return e.type===`element`?YEe(e,t,n):e.type===`text`?n.whitespace===`normal`?XEe(e,n):ZEe(e):[]}function YEe(e,t,n){let r=$Ee(e,n),i=e.children||[],a=-1,o=[];if(iDe(e))return o;let s,c;for(eg(e)||ng(e)&&qh(t,e,ng)?c=`
-`:rDe(e)?(s=2,c=2):rg(e)&&(s=1,c=1);++a<i.length;)o=o.concat(JEe(i[a],e,{whitespace:r,breakBefore:a?void 0:s,breakAfter:a<i.length-1?eg(i[a+1]):c}));return tg(e)&&qh(t,e,tg)&&o.push(`	`),s&&o.unshift(s),c&&o.push(c),o}function XEe(e,t){let n=String(e.value),r=[],i=[],a=0;for(;a<=n.length;){Qh.lastIndex=a;let e=Qh.exec(n),i=e&&`index`in e?e.index:n.length;r.push(QEe(n.slice(a,i).replace(/[\u061C\u200E\u200F\u202A-\u202E\u2066-\u2069]/g,``),a===0?t.breakBefore:!0,i===n.length?t.breakAfter:!0)),a=i+1}let o=-1,s;for(;++o<r.length;)r[o].charCodeAt(r[o].length-1)===8203||o<r.length-1&&r[o+1].charCodeAt(0)===8203?(i.push(r[o]),s=void 0):r[o]?(typeof s==`number`&&i.push(s),i.push(r[o]),s=0):(o===0||o===r.length-1)&&i.push(0);return i}function ZEe(e){return[String(e.value)]}function QEe(e,t,n){let r=[],i=0,a;for(;i<e.length;){$h.lastIndex=i;let n=$h.exec(e);a=n?n.index:e.length,!i&&!a&&n&&!t&&r.push(``),i!==a&&r.push(e.slice(i,a)),i=n?a+n[0].length:a}return i!==a&&!n&&r.push(``),r.join(` `)}function $Ee(e,t){if(e.type===`element`){let n=e.properties||{};switch(e.tagName){case`listing`:case`plaintext`:case`xmp`:return`pre`;case`nobr`:return`nowrap`;case`pre`:return n.wrap?`pre-wrap`:`pre`;case`td`:case`th`:return n.noWrap?`nowrap`:t.whitespace;case`textarea`:return`pre-wrap`;default:}}return t.whitespace}function eDe(e){return!!(e.properties||{}).hidden}function tDe(e){return e.tagName===`td`||e.tagName===`th`}function nDe(e){return e.tagName===`dialog`&&!(e.properties||{}).open}var Qh,$h,eg,tg,rDe,ng,iDe,rg,aDe=s((()=>{VEe(),Zh(),Qh=/\n/g,$h=/[\t ]+/g,eg=Xh(`br`),tg=Xh(tDe),rDe=Xh(`p`),ng=Xh(`tr`),iDe=Xh([`datalist`,`head`,`noembed`,`noframes`,`noscript`,`rp`,`script`,`style`,`template`,`title`,eDe,nDe]),rg=Xh(`address.article.aside.blockquote.body.caption.center.dd.dialog.dir.dl.dt.div.figure.figcaption.footer.form,.h1.h2.h3.h4.h5.h6.header.hgroup.hr.html.legend.li.listing.main.menu.nav.ol.p.plaintext.pre.section.ul.xmp`.split(`.`))})),oDe=s((()=>{aDe()}));function sDe(e){let t=`[#]?[a-zA-Z_\\-!.?+*=<>&'][a-zA-Z_\\-!.?+*=<>&'0-9/;:$#]*`,n=`def defonce defprotocol defstruct defmulti defmethod defn- defn defmacro deftype defrecord`,r={$pattern:t,built_in:n+` cond apply if-not if-let if not not= =|0 <|0 >|0 <=|0 >=|0 ==|0 +|0 /|0 *|0 -|0 rem quot neg? pos? delay? symbol? keyword? true? false? integer? empty? coll? list? set? ifn? fn? associative? sequential? sorted? counted? reversible? number? decimal? class? distinct? isa? float? rational? reduced? ratio? odd? even? char? seq? vector? string? map? nil? contains? zero? instance? not-every? not-any? libspec? -> ->> .. . inc compare do dotimes mapcat take remove take-while drop letfn drop-last take-last drop-while while intern condp case reduced cycle split-at split-with repeat replicate iterate range merge zipmap declare line-seq sort comparator sort-by dorun doall nthnext nthrest partition eval doseq await await-for let agent atom send send-off release-pending-sends add-watch mapv filterv remove-watch agent-error restart-agent set-error-handler error-handler set-error-mode! error-mode shutdown-agents quote var fn loop recur throw try monitor-enter monitor-exit macroexpand macroexpand-1 for dosync and or when when-not when-let comp juxt partial sequence memoize constantly complement identity assert peek pop doto proxy first rest cons cast coll last butlast sigs reify second ffirst fnext nfirst nnext meta with-meta ns in-ns create-ns import refer keys select-keys vals key val rseq name namespace promise into transient persistent! conj! assoc! dissoc! pop! disj! use class type num float double short byte boolean bigint biginteger bigdec print-method print-dup throw-if printf format load compile get-in update-in pr pr-on newline flush read slurp read-line subvec with-open memfn time re-find re-groups rand-int rand mod locking assert-valid-fdecl alias resolve ref deref refset swap! reset! set-validator! compare-and-set! alter-meta! reset-meta! commute get-validator alter ref-set ref-history-count ref-min-history ref-max-history ensure sync io! new next conj set! to-array future future-call into-array aset gen-class reduce map filter find empty hash-map hash-set sorted-map sorted-map-by sorted-set sorted-set-by vec vector seq flatten reverse assoc dissoc list disj get union difference intersection extend extend-type extend-protocol int nth delay count concat chunk chunk-buffer chunk-append chunk-first chunk-rest max min dec unchecked-inc-int unchecked-inc unchecked-dec-inc unchecked-dec unchecked-negate unchecked-add-int unchecked-add unchecked-subtract-int unchecked-subtract chunk-next chunk-cons chunked-seq? prn vary-meta lazy-seq spread list* str find-keyword keyword symbol gensym force rationalize`},i={begin:t,relevance:0},a={scope:`number`,relevance:0,variants:[{match:/[-+]?0[xX][0-9a-fA-F]+N?/},{match:/[-+]?0[0-7]+N?/},{match:/[-+]?[1-9][0-9]?[rR][0-9a-zA-Z]+N?/},{match:/[-+]?[0-9]+\/[0-9]+N?/},{match:/[-+]?[0-9]+((\.[0-9]*([eE][+-]?[0-9]+)?M?)|([eE][+-]?[0-9]+M?|M))/},{match:/[-+]?([1-9][0-9]*|0)N?/}]},o={scope:`character`,variants:[{match:/\\o[0-3]?[0-7]{1,2}/},{match:/\\u[0-9a-fA-F]{4}/},{match:/\\(newline|space|tab|formfeed|backspace|return)/},{match:/\\\S/,relevance:0}]},s={scope:`regex`,begin:/#"/,end:/"/,contains:[e.BACKSLASH_ESCAPE]},c=e.inherit(e.QUOTE_STRING_MODE,{illegal:null}),l={scope:`punctuation`,match:/,/,relevance:0},u=e.COMMENT(`;`,`$`,{relevance:0}),d={className:`literal`,begin:/\b(true|false|nil)\b/},f={begin:`\\[|(#::?`+t+`)?\\{`,end:`[\\]\\}]`,relevance:0},p={className:`symbol`,begin:`[:]{1,2}`+t},m={begin:`\\(`,end:`\\)`},h={endsWithParent:!0,relevance:0},g={keywords:r,className:`name`,begin:t,relevance:0,starts:h},_=[l,m,o,s,c,u,p,f,a,d,i];return m.contains=[{beginKeywords:n,keywords:{$pattern:t,keyword:n},end:`(\\[|#|\\d|"|:|\\{|\\)|\\(|$)`,contains:[{className:`title`,begin:t,relevance:0,excludeEnd:!0,endsParent:!0}].concat(_)},g,h],h.contains=_,f.contains=_,{name:`Clojure`,aliases:[`clj`,`edn`],illegal:/\S/,contains:[l,m,o,s,c,u,p,f,a,d]}}var cDe=s((()=>{}));function lDe(e){let t={className:`subst`,variants:[{begin:`\\$[A-Za-z0-9_]+`}]},n={className:`subst`,variants:[{begin:/\$\{/,end:/\}/}],keywords:`true false null this is new super`},r={className:`number`,relevance:0,variants:[{match:/\b[0-9][0-9_]*(\.[0-9][0-9_]*)?([eE][+-]?[0-9][0-9_]*)?\b/},{match:/\b0[xX][0-9A-Fa-f][0-9A-Fa-f_]*\b/}]},i={className:`string`,variants:[{begin:`r'''`,end:`'''`},{begin:`r"""`,end:`"""`},{begin:`r'`,end:`'`,illegal:`\\n`},{begin:`r"`,end:`"`,illegal:`\\n`},{begin:`'''`,end:`'''`,contains:[e.BACKSLASH_ESCAPE,t,n]},{begin:`"""`,end:`"""`,contains:[e.BACKSLASH_ESCAPE,t,n]},{begin:`'`,end:`'`,illegal:`\\n`,contains:[e.BACKSLASH_ESCAPE,t,n]},{begin:`"`,end:`"`,illegal:`\\n`,contains:[e.BACKSLASH_ESCAPE,t,n]}]};n.contains=[r,i];let a=`Comparable.DateTime.Duration.Function.Iterable.Iterator.List.Map.Match.Object.Pattern.RegExp.Set.Stopwatch.String.StringBuffer.StringSink.Symbol.Type.Uri.bool.double.int.num.Element.ElementList`.split(`.`),o=a.map(e=>`${e}?`);return{name:`Dart`,keywords:{keyword:`abstract.as.assert.async.await.base.break.case.catch.class.const.continue.covariant.default.deferred.do.dynamic.else.enum.export.extends.extension.external.factory.false.final.finally.for.Function.get.hide.if.implements.import.in.interface.is.late.library.mixin.new.null.on.operator.part.required.rethrow.return.sealed.set.show.static.super.switch.sync.this.throw.true.try.typedef.var.void.when.while.with.yield`.split(`.`),built_in:a.concat(o).concat([`Never`,`Null`,`dynamic`,`print`,`document`,`querySelector`,`querySelectorAll`,`window`]),$pattern:/[A-Za-z][A-Za-z0-9_]*\??/},contains:[i,e.COMMENT(/\/\*\*(?!\/)/,/\*\//,{subLanguage:`markdown`,relevance:0}),e.COMMENT(/\/{3,} ?/,/$/,{contains:[{subLanguage:`markdown`,begin:`.`,end:`$`,relevance:0}]}),e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE,{className:`class`,beginKeywords:`class interface`,end:/\{/,excludeEnd:!0,contains:[{beginKeywords:`extends implements`},e.UNDERSCORE_TITLE_MODE]},r,{className:`meta`,begin:`@[A-Za-z]+`},{begin:`=>`}]}}var uDe=s((()=>{}));function dDe(e){return{name:`Dockerfile`,aliases:[`docker`],case_insensitive:!0,keywords:[`from`,`maintainer`,`expose`,`env`,`arg`,`user`,`onbuild`,`stopsignal`],contains:[e.HASH_COMMENT_MODE,e.APOS_STRING_MODE,e.QUOTE_STRING_MODE,e.NUMBER_MODE,{beginKeywords:`run cmd entrypoint volume add copy workdir label healthcheck shell`,starts:{end:/[^\\]$/,subLanguage:`bash`}}],illegal:`</`}}var fDe=s((()=>{}));function pDe(e){let t=e.regex,n=`[a-zA-Z_][a-zA-Z0-9_.]*(!|\\?)?`,r={$pattern:n,keyword:`after.alias.and.case.catch.cond.defstruct.defguard.do.else.end.fn.for.if.import.in.not.or.quote.raise.receive.require.reraise.rescue.try.unless.unquote.unquote_splicing.use.when.with|0`.split(`.`),literal:[`false`,`nil`,`true`]},i={className:`subst`,begin:/#\{/,end:/\}/,keywords:r},a={className:`number`,begin:`(\\b0o[0-7_]+)|(\\b0b[01_]+)|(\\b0x[0-9a-fA-F_]+)|(-?\\b[0-9][0-9_]*(\\.[0-9_]+([eE][-+]?[0-9]+)?)?)`,relevance:0},o={match:/\\[\s\S]/,scope:`char.escape`,relevance:0},s=`[/|([{<"']`,c=[{begin:/"/,end:/"/},{begin:/'/,end:/'/},{begin:/\//,end:/\//},{begin:/\|/,end:/\|/},{begin:/\(/,end:/\)/},{begin:/\[/,end:/\]/},{begin:/\{/,end:/\}/},{begin:/</,end:/>/}],l=e=>({scope:`char.escape`,begin:t.concat(/\\/,e),relevance:0}),u={className:`string`,begin:`~[a-z](?=`+s+`)`,contains:c.map(t=>e.inherit(t,{contains:[l(t.end),o,i]}))},d={className:`string`,begin:`~[A-Z](?=`+s+`)`,contains:c.map(t=>e.inherit(t,{contains:[l(t.end)]}))},f={className:`regex`,variants:[{begin:`~r(?=`+s+`)`,contains:c.map(n=>e.inherit(n,{end:t.concat(n.end,/[uismxfU]{0,7}/),contains:[l(n.end),o,i]}))},{begin:`~R(?=`+s+`)`,contains:c.map(n=>e.inherit(n,{end:t.concat(n.end,/[uismxfU]{0,7}/),contains:[l(n.end)]}))}]},p={className:`string`,contains:[e.BACKSLASH_ESCAPE,i],variants:[{begin:/"""/,end:/"""/},{begin:/'''/,end:/'''/},{begin:/~S"""/,end:/"""/,contains:[]},{begin:/~S"/,end:/"/,contains:[]},{begin:/~S'''/,end:/'''/,contains:[]},{begin:/~S'/,end:/'/,contains:[]},{begin:/'/,end:/'/},{begin:/"/,end:/"/}]},m={className:`function`,beginKeywords:`def defp defmacro defmacrop`,end:/\B\b/,contains:[e.inherit(e.TITLE_MODE,{begin:n,endsParent:!0})]},h=e.inherit(m,{className:`class`,beginKeywords:`defimpl defmodule defprotocol defrecord`,end:/\bdo\b|$|;/}),g=[p,f,d,u,e.HASH_COMMENT_MODE,h,m,{begin:`::`},{className:`symbol`,begin:`:(?![\\s:])`,contains:[p,{begin:"[a-zA-Z_]\\w*[!?=]?|[-+~]@|<<|>>|=~|===?|<=>|[<>]=?|\\*\\*|[-/+%^&*~`|]|\\[\\]=?"}],relevance:0},{className:`symbol`,begin:n+`:(?!:)`,relevance:0},{className:`title.class`,begin:/(\b[A-Z][a-zA-Z0-9_]+)/,relevance:0},a,{className:`variable`,begin:`(\\$\\W)|((\\$|@@?)(\\w+))`}];return i.contains=g,{name:`Elixir`,aliases:[`ex`,`exs`],keywords:r,contains:g}}var mDe=s((()=>{}));function hDe(e){return new RegExp(e.replace(/[-/\\^$*+?.()|[\]{}]/g,`\\$&`),`m`)}function gDe(e){return e?typeof e==`string`?e:e.source:null}function ig(e){return ag(`(?=`,e,`)`)}function ag(...e){return e.map(e=>gDe(e)).join(``)}function _De(e){let t=e[e.length-1];return typeof t==`object`&&t.constructor===Object?(e.splice(e.length-1,1),t):{}}function og(...e){return`(`+(_De(e).capture?``:`?:`)+e.map(e=>gDe(e)).join(`|`)+`)`}function vDe(e){let t=`abstract.and.as.assert.base.begin.class.default.delegate.do.done.downcast.downto.elif.else.end.exception.extern.finally.fixed.for.fun.function.global.if.in.inherit.inline.interface.internal.lazy.let.match.member.module.mutable.namespace.new.of.open.or.override.private.public.rec.return.static.struct.then.to.try.type.upcast.use.val.void.when.while.with.yield`.split(`.`),n={scope:`keyword`,match:/\b(yield|return|let|do|match|use)!/},r=[`if`,`else`,`endif`,`line`,`nowarn`,`light`,`r`,`i`,`I`,`load`,`time`,`help`,`quit`],i=[`true`,`false`,`null`,`Some`,`None`,`Ok`,`Error`,`infinity`,`infinityf`,`nan`,`nanf`],a=[`__LINE__`,`__SOURCE_DIRECTORY__`,`__SOURCE_FILE__`],o=`bool.byte.sbyte.int8.int16.int32.uint8.uint16.uint32.int.uint.int64.uint64.nativeint.unativeint.decimal.float.double.float32.single.char.string.unit.bigint.option.voption.list.array.seq.byref.exn.inref.nativeptr.obj.outref.voidptr.Result`.split(`.`),s={keyword:t,literal:i,built_in:`not.ref.raise.reraise.dict.readOnlyDict.set.get.enum.sizeof.typeof.typedefof.nameof.nullArg.invalidArg.invalidOp.id.fst.snd.ignore.lock.using.box.unbox.tryUnbox.printf.printfn.sprintf.eprintf.eprintfn.fprintf.fprintfn.failwith.failwithf`.split(`.`),"variable.constant":a},c={variants:[e.COMMENT(/\(\*(?!\))/,/\*\)/,{contains:[`self`]}),e.C_LINE_COMMENT_MODE]},l=/[a-zA-Z_](\w|')*/,u={scope:`variable`,begin:/``/,end:/``/},d=/\B('|\^)/,f={scope:`symbol`,variants:[{match:ag(d,/``.*?``/)},{match:ag(d,e.UNDERSCORE_IDENT_RE)}],relevance:0},p=function({includeEqual:e}){let t;t=e?`!%&*+-/<=>@^|~?`:`!%&*+-/<>@^|~?`;let n=ag(`[`,...Array.from(t).map(hDe),`]`),r=og(n,/\./);return{scope:`operator`,match:og(og(ag(ag(r,ig(r)),r,`*`),ag(n,`+`)),/:\?>/,/:\?/,/:>/,/:=/,/::?/,/\$/),relevance:0}},m=p({includeEqual:!0}),h=p({includeEqual:!1}),g=function(t,n){return{begin:ag(t,ig(ag(/\s*/,og(/\w/,/'/,/\^/,/#/,/``/,/\(/,/{\|/)))),beginScope:n,end:ig(og(/\n/,/=/)),relevance:0,keywords:e.inherit(s,{type:o}),contains:[c,f,e.inherit(u,{scope:null}),h]}},_=g(/:/,`operator`),v=g(/\bof\b/,`keyword`),y={begin:[/(^|\s+)/,/type/,/\s+/,l],beginScope:{2:`keyword`,4:`title.class`},end:ig(/\(|=|$/),keywords:s,contains:[c,e.inherit(u,{scope:null}),f,{scope:`operator`,match:/<|>/},_]},b={scope:`computation-expression`,match:/\b[_a-z]\w*(?=\s*\{)/},x={begin:[/^\s*/,ag(/#/,og(...r)),/\b/],beginScope:{2:`meta`},end:ig(/\s|$/)},S={variants:[e.BINARY_NUMBER_MODE,e.C_NUMBER_MODE]},C={scope:`string`,begin:/"/,end:/"/,contains:[e.BACKSLASH_ESCAPE]},w={scope:`string`,begin:/@"/,end:/"/,contains:[{match:/""/},e.BACKSLASH_ESCAPE]},ee={scope:`string`,begin:/"""/,end:/"""/,relevance:2},te={scope:`subst`,begin:/\{/,end:/\}/,keywords:s},ne={scope:`string`,begin:/\$"/,end:/"/,contains:[{match:/\{\{/},{match:/\}\}/},e.BACKSLASH_ESCAPE,te]},re={scope:`string`,begin:/(\$@|@\$)"/,end:/"/,contains:[{match:/\{\{/},{match:/\}\}/},{match:/""/},e.BACKSLASH_ESCAPE,te]},T={scope:`string`,begin:/\$"""/,end:/"""/,contains:[{match:/\{\{/},{match:/\}\}/},te],relevance:2},ie={scope:`string`,match:ag(/'/,og(/[^\\']/,/\\(?:.|\d{3}|x[a-fA-F\d]{2}|u[a-fA-F\d]{4}|U[a-fA-F\d]{8})/),/'/)};te.contains=[re,ne,w,C,ie,n,c,u,_,b,x,S,f,m];let ae={variants:[T,re,ne,ee,w,C,ie]};return{name:`F#`,aliases:[`fs`,`f#`],keywords:s,illegal:/\/\*/,classNameAliases:{"computation-expression":`keyword`},contains:[n,ae,c,u,y,{scope:`meta`,begin:/\[</,end:/>\]/,relevance:2,contains:[u,ee,w,C,ie,S]},v,_,b,x,S,f,m]}}var yDe=s((()=>{}));function bDe(e){let t=`([0-9]_*)+`,n=`([0-9a-fA-F]_*)+`,r=`([!#$%&*+.\\/<=>?@\\\\^~-]|(?!([(),;\\[\\]\`|{}]|[_:"']))(\\p{S}|\\p{P}))`,i={variants:[e.COMMENT(`--+`,`$`),e.COMMENT(/\{-/,/-\}/,{contains:[`self`]})]},a={className:`meta`,begin:/\{-#/,end:/#-\}/},o={className:`meta`,begin:`^#`,end:`$`},s={className:`type`,begin:`\\b[A-Z][\\w']*`,relevance:0},c={begin:`\\(`,end:`\\)`,illegal:`"`,contains:[a,o,{className:`type`,begin:`\\b[A-Z][\\w]*(\\((\\.\\.|,|\\w+)\\))?`},e.inherit(e.TITLE_MODE,{begin:`[_a-z][\\w']*`}),i]},l={begin:/\{/,end:/\}/,contains:c.contains},u={className:`number`,relevance:0,variants:[{match:`\\b(${t})(\\.(${t}))?([eE][+-]?(${t}))?\\b`},{match:`\\b0[xX]_*(${n})(\\.(${n}))?([pP][+-]?(${t}))?\\b`},{match:`\\b0[oO](([0-7]_*)+)\\b`},{match:`\\b0[bB](([01]_*)+)\\b`}]};return{name:`Haskell`,aliases:[`hs`],keywords:`let in if then else case of where do module import hiding qualified type data newtype deriving class instance as default infix infixl infixr foreign export ccall stdcall cplusplus jvm dotnet safe unsafe family forall mdo proc rec`,unicodeRegex:!0,contains:[{beginKeywords:`module`,end:`where`,keywords:`module where`,contains:[c,i],illegal:`\\W\\.|;`},{begin:`\\bimport\\b`,end:`$`,keywords:`import qualified as hiding`,contains:[c,i],illegal:`\\W\\.|;`},{className:`class`,begin:`^(\\s*)?(class|instance)\\b`,end:`where`,keywords:`class family instance where`,contains:[s,c,i]},{className:`class`,begin:`\\b(data|(new)?type)\\b`,end:`$`,keywords:`data family type newtype deriving`,contains:[a,s,c,l,i]},{beginKeywords:`default`,end:`$`,contains:[s,c,i]},{beginKeywords:`infix infixl infixr`,end:`$`,contains:[e.C_NUMBER_MODE,i]},{begin:`\\bforeign\\b`,end:`$`,keywords:`foreign import export ccall stdcall cplusplus jvm dotnet safe unsafe`,contains:[s,e.QUOTE_STRING_MODE,i]},{className:`meta`,begin:`#!\\/usr\\/bin\\/env runhaskell`,end:`$`},a,o,{scope:`string`,begin:/'(?=\\?.')/,end:/'/,contains:[{scope:`char.escape`,match:/\\./}]},e.QUOTE_STRING_MODE,u,s,e.inherit(e.TITLE_MODE,{begin:`^[_a-z][\\w']*`}),{begin:`(?!-)${r}--+|--+(?!-)${r}`},i,{begin:`->|<-`}]}}var xDe=s((()=>{}));function SDe(e){let t=e.regex,n=`HTTP/([32]|1\\.[01])`,r={className:`attribute`,begin:t.concat(`^`,/[A-Za-z][A-Za-z0-9-]*/,`(?=\\:\\s)`),starts:{contains:[{className:`punctuation`,begin:/: /,relevance:0,starts:{end:`$`,relevance:0}}]}},i=[r,{begin:`\\n\\n`,starts:{subLanguage:[],endsWithParent:!0}}];return{name:`HTTP`,aliases:[`https`],illegal:/\S/,contains:[{begin:`^(?=`+n+` \\d{3})`,end:/$/,contains:[{className:`meta`,begin:n},{className:`number`,begin:`\\b\\d{3}\\b`}],starts:{end:/\b\B/,illegal:/\S/,contains:i}},{begin:`(?=^[A-Z]+ (.*?) `+n+`$)`,end:/$/,contains:[{className:`string`,begin:` `,end:` `,excludeBegin:!0,excludeEnd:!0},{className:`meta`,begin:n},{className:`keyword`,begin:`[A-Z]+`}],starts:{end:/\b\B/,illegal:/\S/,contains:i}},e.inherit(r,{relevance:0})]}}var CDe=s((()=>{}));function wDe(e){let t=`('|\\.')+`,n={relevance:0,contains:[{begin:t}]};return{name:`Matlab`,keywords:{keyword:`arguments break case catch classdef continue else elseif end enumeration events for function global if methods otherwise parfor persistent properties return spmd switch try while`,built_in:`sin sind sinh asin asind asinh cos cosd cosh acos acosd acosh tan tand tanh atan atand atan2 atanh sec secd sech asec asecd asech csc cscd csch acsc acscd acsch cot cotd coth acot acotd acoth hypot exp expm1 log log1p log10 log2 pow2 realpow reallog realsqrt sqrt nthroot nextpow2 abs angle complex conj imag real unwrap isreal cplxpair fix floor ceil round mod rem sign airy besselj bessely besselh besseli besselk beta betainc betaln ellipj ellipke erf erfc erfcx erfinv expint gamma gammainc gammaln psi legendre cross dot factor isprime primes gcd lcm rat rats perms nchoosek factorial cart2sph cart2pol pol2cart sph2cart hsv2rgb rgb2hsv zeros ones eye repmat rand randn linspace logspace freqspace meshgrid accumarray size length ndims numel disp isempty isequal isequalwithequalnans cat reshape diag blkdiag tril triu fliplr flipud flipdim rot90 find sub2ind ind2sub bsxfun ndgrid permute ipermute shiftdim circshift squeeze isscalar isvector ans eps realmax realmin pi i|0 inf nan isnan isinf isfinite j|0 why compan gallery hadamard hankel hilb invhilb magic pascal rosser toeplitz vander wilkinson max min nanmax nanmin mean nanmean type table readtable writetable sortrows sort figure plot plot3 scatter scatter3 cellfun legend intersect ismember procrustes hold num2cell `},illegal:`(//|"|#|/\\*|\\s+/\\w+)`,contains:[{className:`function`,beginKeywords:`function`,end:`$`,contains:[e.UNDERSCORE_TITLE_MODE,{className:`params`,variants:[{begin:`\\(`,end:`\\)`},{begin:`\\[`,end:`\\]`}]}]},{className:`built_in`,begin:/true|false/,relevance:0,starts:n},{begin:`[a-zA-Z][a-zA-Z_0-9]*`+t,relevance:0},{className:`number`,begin:e.C_NUMBER_RE,relevance:0,starts:n},{className:`string`,begin:`'`,end:`'`,contains:[{begin:`''`}]},{begin:/\]|\}|\)/,relevance:0,starts:n},{className:`string`,begin:`"`,end:`"`,contains:[{begin:`""`}],starts:n},e.COMMENT(`^\\s*%\\{\\s*$`,`^\\s*%\\}\\s*$`),e.COMMENT(`%`,`$`)]}}var TDe=s((()=>{}));function EDe(e){let t=e.regex,n={className:`variable`,variants:[{begin:/\$\d+/},{begin:/\$\{\w+\}/},{begin:t.concat(/[$@]/,e.UNDERSCORE_IDENT_RE)}]},r={endsWithParent:!0,keywords:{$pattern:/[a-z_]{2,}|\/dev\/poll/,literal:[`on`,`off`,`yes`,`no`,`true`,`false`,`none`,`blocked`,`debug`,`info`,`notice`,`warn`,`error`,`crit`,`select`,`break`,`last`,`permanent`,`redirect`,`kqueue`,`rtsig`,`epoll`,`poll`,`/dev/poll`]},relevance:0,illegal:`=>`,contains:[e.HASH_COMMENT_MODE,{className:`string`,contains:[e.BACKSLASH_ESCAPE,n],variants:[{begin:/"/,end:/"/},{begin:/'/,end:/'/}]},{begin:`([a-z]+):/`,end:`\\s`,endsWithParent:!0,excludeEnd:!0,contains:[n]},{className:`regexp`,contains:[e.BACKSLASH_ESCAPE,n],variants:[{begin:`\\s\\^`,end:`\\s|\\{|;`,returnEnd:!0},{begin:`~\\*?\\s+`,end:`\\s|\\{|;`,returnEnd:!0},{begin:`\\*(\\.[a-z\\-]+)+`},{begin:`([a-z\\-]+\\.)+\\*`}]},{className:`number`,begin:`\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}(:\\d{1,5})?\\b`},{className:`number`,begin:`\\b\\d+[kKmMgGdshdwy]?\\b`,relevance:0},n]};return{name:`Nginx config`,aliases:[`nginxconf`],contains:[e.HASH_COMMENT_MODE,{beginKeywords:`upstream location`,end:/;|\{/,contains:r.contains,keywords:{section:`upstream location`}},{className:`section`,begin:t.concat(e.UNDERSCORE_IDENT_RE+t.lookahead(/\s+\{/)),relevance:0},{begin:t.lookahead(e.UNDERSCORE_IDENT_RE+`\\s`),end:`;|\\{`,contains:[{className:`attribute`,begin:e.UNDERSCORE_IDENT_RE,starts:r}],relevance:0}],illegal:`[^\\s\\}\\{]`}}var DDe=s((()=>{}));function ODe(e){return{name:`OCaml`,aliases:[`ml`],keywords:{$pattern:`[a-z_]\\w*!?`,keyword:`and as assert asr begin class constraint do done downto else end exception external for fun function functor if in include inherit! inherit initializer land lazy let lor lsl lsr lxor match method!|10 method mod module mutable new object of open! open or private rec sig struct then to try type val! val virtual when while with parser value`,built_in:`array bool bytes char exn|5 float int int32 int64 list lazy_t|5 nativeint|5 string unit in_channel out_channel ref`,literal:`true false`},illegal:/\/\/|>>/,contains:[{className:`literal`,begin:`\\[(\\|\\|)?\\]|\\(\\)`,relevance:0},e.COMMENT(`\\(\\*`,`\\*\\)`,{contains:[`self`]}),{className:`symbol`,begin:`'[A-Za-z_](?!')[\\w']*`},{className:`type`,begin:"`[A-Z][\\w']*"},{className:`type`,begin:`\\b[A-Z][\\w']*`,relevance:0},{begin:`[a-z_]\\w*'[\\w']*`,relevance:0},e.inherit(e.APOS_STRING_MODE,{className:`string`,relevance:0}),e.inherit(e.QUOTE_STRING_MODE,{illegal:null}),{className:`number`,begin:`\\b(0[xX][a-fA-F0-9_]+[Lln]?|0[oO][0-7_]+[Lln]?|0[bB][01_]+[Lln]?|[0-9][0-9_]*([Lln]|(\\.[0-9_]*)?([eE][-+]?[0-9_]+)?)?)`,relevance:0},{begin:/->/}]}}var kDe=s((()=>{}));function ADe(e){let t=[`string`,`char`,`byte`,`int`,`long`,`bool`,`decimal`,`single`,`double`,`DateTime`,`xml`,`array`,`hashtable`,`void`],n={$pattern:/-?[A-z\.\-]+\b/,keyword:`if else foreach return do while until elseif begin for trap data dynamicparam end break throw param continue finally in switch exit filter try process catch hidden static parameter`,built_in:`ac asnp cat cd CFS chdir clc clear clhy cli clp cls clv cnsn compare copy cp cpi cpp curl cvpa dbp del diff dir dnsn ebp echo|0 epal epcsv epsn erase etsn exsn fc fhx fl ft fw gal gbp gc gcb gci gcm gcs gdr gerr ghy gi gin gjb gl gm gmo gp gps gpv group gsn gsnp gsv gtz gu gv gwmi h history icm iex ihy ii ipal ipcsv ipmo ipsn irm ise iwmi iwr kill lp ls man md measure mi mount move mp mv nal ndr ni nmo npssc nsn nv ogv oh popd ps pushd pwd r rbp rcjb rcsn rd rdr ren ri rjb rm rmdir rmo rni rnp rp rsn rsnp rujb rv rvpa rwmi sajb sal saps sasv sbp sc scb select set shcm si sl sleep sls sort sp spjb spps spsv start stz sujb sv swmi tee trcm type wget where wjb write`},r=/\w[\w\d]*((-)[\w\d]+)*/,i={begin:"`[\\s\\S]",relevance:0},a={className:`variable`,variants:[{begin:/\$\B/},{className:`keyword`,begin:/\$this/},{begin:/\$[\w\d][\w\d_:]*/}]},o={className:`literal`,begin:/\$(null|true|false)\b/},s={className:`string`,variants:[{begin:/"/,end:/"/},{begin:/@"/,end:/^"@/}],contains:[i,a,{className:`variable`,begin:/\$[A-z]/,end:/[^A-z]/}]},c={className:`string`,variants:[{begin:/'/,end:/'/},{begin:/@'/,end:/^'@/}]},l=e.inherit(e.COMMENT(null,null),{variants:[{begin:/#/,end:/$/},{begin:/<#/,end:/#>/}],contains:[{className:`doctag`,variants:[{begin:/\.(synopsis|description|example|inputs|outputs|notes|link|component|role|functionality)/},{begin:/\.(parameter|forwardhelptargetname|forwardhelpcategory|remotehelprunspace|externalhelp)\s+\S+/}]}]}),u={className:`built_in`,variants:[{begin:`(Add|Clear|Close|Copy|Enter|Exit|Find|Format|Get|Hide|Join|Lock|Move|New|Open|Optimize|Pop|Push|Redo|Remove|Rename|Reset|Resize|Search|Select|Set|Show|Skip|Split|Step|Switch|Undo|Unlock|Watch|Backup|Checkpoint|Compare|Compress|Convert|ConvertFrom|ConvertTo|Dismount|Edit|Expand|Export|Group|Import|Initialize|Limit|Merge|Mount|Out|Publish|Restore|Save|Sync|Unpublish|Update|Approve|Assert|Build|Complete|Confirm|Deny|Deploy|Disable|Enable|Install|Invoke|Register|Request|Restart|Resume|Start|Stop|Submit|Suspend|Uninstall|Unregister|Wait|Debug|Measure|Ping|Repair|Resolve|Test|Trace|Connect|Disconnect|Read|Receive|Send|Write|Block|Grant|Protect|Revoke|Unblock|Unprotect|Use|ForEach|Sort|Tee|Where)+(-)[\\w\\d]+`}]},d={className:`class`,beginKeywords:`class enum`,end:/\s*[{]/,excludeEnd:!0,relevance:0,contains:[e.TITLE_MODE]},f={className:`function`,begin:/function\s+/,end:/\s*\{|$/,excludeEnd:!0,returnBegin:!0,relevance:0,contains:[{begin:`function`,relevance:0,className:`keyword`},{className:`title`,begin:r,relevance:0},{begin:/\(/,end:/\)/,className:`params`,relevance:0,contains:[a]}]},p={begin:/using\s/,end:/$/,returnBegin:!0,contains:[s,c,{className:`keyword`,begin:/(using|assembly|command|module|namespace|type)/}]},m={variants:[{className:`operator`,begin:`(-and|-as|-band|-bnot|-bor|-bxor|-casesensitive|-ccontains|-ceq|-cge|-cgt|-cle|-clike|-clt|-cmatch|-cne|-cnotcontains|-cnotlike|-cnotmatch|-contains|-creplace|-csplit|-eq|-exact|-f|-file|-ge|-gt|-icontains|-ieq|-ige|-igt|-ile|-ilike|-ilt|-imatch|-in|-ine|-inotcontains|-inotlike|-inotmatch|-ireplace|-is|-isnot|-isplit|-join|-le|-like|-lt|-match|-ne|-not|-notcontains|-notin|-notlike|-notmatch|-or|-regex|-replace|-shl|-shr|-split|-wildcard|-xor)\\b`},{className:`literal`,begin:/(-){1,2}[\w\d-]+/,relevance:0}]},h={className:`selector-tag`,begin:/@\B/,relevance:0},g={className:`function`,begin:/\[.*\]\s*[\w]+[ ]??\(/,end:/$/,returnBegin:!0,relevance:0,contains:[{className:`keyword`,begin:`(${n.keyword.toString().replace(/\s/g,`|`)})\\b`,endsParent:!0,relevance:0},e.inherit(e.TITLE_MODE,{endsParent:!0})]},_=[g,l,i,e.NUMBER_MODE,s,c,u,a,o,h],v={begin:/\[/,end:/\]/,excludeBegin:!0,excludeEnd:!0,relevance:0,contains:[`self`].concat(_,{begin:`(`+t.join(`|`)+`)`,className:`built_in`,relevance:0},{className:`type`,begin:/[\.\w\d]+/,relevance:0})};return g.contains.unshift(v),{name:`PowerShell`,aliases:[`pwsh`,`ps`,`ps1`],case_insensitive:!0,keywords:n,contains:_.concat(d,f,p,m,v)}}var jDe=s((()=>{}));function MDe(e){let t=`[ \\t\\f]*`,n=t+`[:=][ \\t\\f]*`;``+n;let r=`([^\\\\:= \\t\\f\\n]|\\\\.)+`;return{name:`.properties`,disableAutodetect:!0,case_insensitive:!0,illegal:/\S/,contains:[e.COMMENT(`^\\s*[!#]`,`$`),{returnBegin:!0,variants:[{begin:r+n},{begin:r+`[ \\t\\f]+`}],contains:[{className:`attr`,begin:r,endsParent:!0}],starts:{end:`([ \\t\\f]*[:=][ \\t\\f]*|[ \\t\\f]+)`,relevance:0,starts:{className:`string`,end:/$/,relevance:0,contains:[{begin:`\\\\\\\\`},{begin:`\\\\\\n`}]}}},{className:`attr`,begin:r+t+`$`}]}}var NDe=s((()=>{}));function PDe(e){let t=e.regex,n={className:`meta`,begin:`@[A-Za-z]+`},r={className:`subst`,variants:[{begin:`\\$[A-Za-z0-9_]+`},{begin:/\$\{/,end:/\}/}]},i={className:`string`,variants:[{begin:`"""`,end:`"""`},{begin:`"`,end:`"`,illegal:`\\n`,contains:[e.BACKSLASH_ESCAPE]},{begin:`[a-z]+"`,end:`"`,illegal:`\\n`,contains:[e.BACKSLASH_ESCAPE,r]},{className:`string`,begin:`[a-z]+"""`,end:`"""`,contains:[r],relevance:10}]},a={className:`type`,begin:`\\b[A-Z][A-Za-z0-9_]*`,relevance:0},o={className:`title`,begin:/[^0-9\n\t "'(),.`{}\[\]:;][^\n\t "'(),.`{}\[\]:;]+|[^0-9\n\t "'(),.`{}\[\]:;=]/,relevance:0},s={className:`class`,beginKeywords:`class object trait type`,end:/[:={\[\n;]/,excludeEnd:!0,contains:[e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE,{beginKeywords:`extends with`,relevance:10},{begin:/\[/,end:/\]/,excludeBegin:!0,excludeEnd:!0,relevance:0,contains:[a,e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE]},{className:`params`,begin:/\(/,end:/\)/,excludeBegin:!0,excludeEnd:!0,relevance:0,contains:[a,e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE]},o]},c={className:`function`,beginKeywords:`def`,end:t.lookahead(/[:={\[(\n;]/),contains:[o]},l={begin:[/^\s*/,`extension`,/\s+(?=[[(])/],beginScope:{2:`keyword`}},u={begin:[/^\s*/,/end/,/\s+/,/(extension\b)?/],beginScope:{2:`keyword`,4:`keyword`}},d=[{match:/\.inline\b/},{begin:/\binline(?=\s)/,keywords:`inline`}],f={begin:[/\(\s*/,/using/,/\s+(?!\))/],beginScope:{2:`keyword`}},p={className:`string`,begin:/\S+/};return{name:`Scala`,keywords:{literal:`true false null`,keyword:`type yield lazy override def with val var sealed abstract private trait object if then forSome for while do throw finally protected extends import final return else break new catch super class case package default try this match continue throws implicit export enum given transparent`},contains:[{begin:[`//>`,/\s+/,/using/,/\s+/,/\S+/],beginScope:{1:`comment`,3:`keyword`,5:`type`},end:/$/,contains:[p]},e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE,i,a,c,s,e.C_NUMBER_MODE,l,u,...d,f,n]}}var FDe=s((()=>{}));function IDe(e){let t=e.regex,n={},r={begin:/\$\{/,end:/\}/,contains:[`self`,{begin:/:-/,contains:[n]}]};Object.assign(n,{className:`variable`,variants:[{begin:t.concat(/\$[\w\d#@][\w\d_]*/,`(?![\\w\\d])(?![$])`)},r]});let i={className:`subst`,begin:/\$\(/,end:/\)/,contains:[e.BACKSLASH_ESCAPE]},a=e.inherit(e.COMMENT(),{match:[/(^|\s)/,/#.*$/],scope:{2:`comment`}}),o={begin:/<<-?\s*(?=\w+)/,starts:{contains:[e.END_SAME_AS_BEGIN({begin:/(\w+)/,end:/(\w+)/,className:`string`})]}},s={className:`string`,begin:/"/,end:/"/,contains:[e.BACKSLASH_ESCAPE,n,i]};i.contains.push(s);let c={match:/\\"/},l={className:`string`,begin:/'/,end:/'/},u={match:/\\'/},d={begin:/\$?\(\(/,end:/\)\)/,contains:[{begin:/\d+#[0-9a-f]+/,className:`number`},e.NUMBER_MODE,n]},f=e.SHEBANG({binary:`(${[`fish`,`bash`,`zsh`,`sh`,`csh`,`ksh`,`tcsh`,`dash`,`scsh`].join(`|`)})`,relevance:10}),p={className:`function`,begin:/\w[\w\d_]*\s*\(\s*\)\s*\{/,returnBegin:!0,contains:[e.inherit(e.TITLE_MODE,{begin:/\w[\w\d_]*/})],relevance:0},m=[`if`,`then`,`else`,`elif`,`fi`,`time`,`for`,`while`,`until`,`in`,`do`,`done`,`case`,`esac`,`coproc`,`function`,`select`],h=[`true`,`false`],g={match:/(\/[a-z._-]+)+/},_=[`break`,`cd`,`continue`,`eval`,`exec`,`exit`,`export`,`getopts`,`hash`,`pwd`,`readonly`,`return`,`shift`,`test`,`times`,`trap`,`umask`,`unset`],v=[`alias`,`bind`,`builtin`,`caller`,`command`,`declare`,`echo`,`enable`,`help`,`let`,`local`,`logout`,`mapfile`,`printf`,`read`,`readarray`,`source`,`sudo`,`type`,`typeset`,`ulimit`,`unalias`],y=`autoload.bg.bindkey.bye.cap.chdir.clone.comparguments.compcall.compctl.compdescribe.compfiles.compgroups.compquote.comptags.comptry.compvalues.dirs.disable.disown.echotc.echoti.emulate.fc.fg.float.functions.getcap.getln.history.integer.jobs.kill.limit.log.noglob.popd.print.pushd.pushln.rehash.sched.setcap.setopt.stat.suspend.ttyctl.unfunction.unhash.unlimit.unsetopt.vared.wait.whence.where.which.zcompile.zformat.zftp.zle.zmodload.zparseopts.zprof.zpty.zregexparse.zsocket.zstyle.ztcp`.split(`.`),b=`chcon.chgrp.chown.chmod.cp.dd.df.dir.dircolors.ln.ls.mkdir.mkfifo.mknod.mktemp.mv.realpath.rm.rmdir.shred.sync.touch.truncate.vdir.b2sum.base32.base64.cat.cksum.comm.csplit.cut.expand.fmt.fold.head.join.md5sum.nl.numfmt.od.paste.ptx.pr.sha1sum.sha224sum.sha256sum.sha384sum.sha512sum.shuf.sort.split.sum.tac.tail.tr.tsort.unexpand.uniq.wc.arch.basename.chroot.date.dirname.du.echo.env.expr.factor.groups.hostid.id.link.logname.nice.nohup.nproc.pathchk.pinky.printenv.printf.pwd.readlink.runcon.seq.sleep.stat.stdbuf.stty.tee.test.timeout.tty.uname.unlink.uptime.users.who.whoami.yes`.split(`.`);return{name:`Bash`,aliases:[`sh`,`zsh`],keywords:{$pattern:/\b[a-z][a-z0-9._-]+\b/,keyword:m,literal:h,built_in:[..._,...v,`set`,`shopt`,...y,...b]},contains:[f,e.SHEBANG(),p,d,a,o,g,s,c,l,u,n]}}var LDe=s((()=>{}));function RDe(e){let t=e.regex,n=e.COMMENT(`//`,`$`,{contains:[{begin:/\\\n/}]}),r=`decltype\\(auto\\)`,i=`[a-zA-Z_]\\w*::`,a=`(`+r+`|`+t.optional(i)+`[a-zA-Z_]\\w*`+t.optional(`<[^<>]+>`)+`)`,o={className:`type`,variants:[{begin:`\\b[a-z\\d_]*_t\\b`},{match:/\batomic_[a-z]{3,6}\b/}]},s={className:`string`,variants:[{begin:`(u8?|U|L)?"`,end:`"`,illegal:`\\n`,contains:[e.BACKSLASH_ESCAPE]},{begin:`(u8?|U|L)?'(\\\\(x[0-9A-Fa-f]{2}|u[0-9A-Fa-f]{4,8}|[0-7]{3}|\\S)|.)`,end:`'`,illegal:`.`},e.END_SAME_AS_BEGIN({begin:/(?:u8?|U|L)?R"([^()\\ ]{0,16})\(/,end:/\)([^()\\ ]{0,16})"/})]},c={className:`number`,variants:[{match:/\b(0b[01']+)/},{match:/(-?)\b([\d']+(\.[\d']*)?|\.[\d']+)((ll|LL|l|L)(u|U)?|(u|U)(ll|LL|l|L)?|f|F|b|B)/},{match:/(-?)\b(0[xX][a-fA-F0-9]+(?:'[a-fA-F0-9]+)*(?:\.[a-fA-F0-9]*(?:'[a-fA-F0-9]*)*)?(?:[pP][-+]?[0-9]+)?(l|L)?(u|U)?)/},{match:/(-?)\b\d+(?:'\d+)*(?:\.\d*(?:'\d*)*)?(?:[eE][-+]?\d+)?/}],relevance:0},l={className:`meta`,begin:/#\s*[a-z]+\b/,end:/$/,keywords:{keyword:`if else elif endif define undef warning error line pragma _Pragma ifdef ifndef elifdef elifndef include`},contains:[{begin:/\\\n/,relevance:0},e.inherit(s,{className:`string`}),{className:`string`,begin:/<.*?>/},n,e.C_BLOCK_COMMENT_MODE]},u={className:`title`,begin:t.optional(i)+e.IDENT_RE,relevance:0},d=t.optional(i)+e.IDENT_RE+`\\s*\\(`,f={keyword:`asm.auto.break.case.continue.default.do.else.enum.extern.for.fortran.goto.if.inline.register.restrict.return.sizeof.typeof.typeof_unqual.struct.switch.typedef.union.volatile.while._Alignas._Alignof._Atomic._Generic._Noreturn._Static_assert._Thread_local.alignas.alignof.noreturn.static_assert.thread_local._Pragma`.split(`.`),type:`float.double.signed.unsigned.int.short.long.char.void._Bool._BitInt._Complex._Imaginary._Decimal32._Decimal64._Decimal96._Decimal128._Decimal64x._Decimal128x._Float16._Float32._Float64._Float128._Float32x._Float64x._Float128x.const.static.constexpr.complex.bool.imaginary`.split(`.`),literal:`true false NULL`,built_in:`std string wstring cin cout cerr clog stdin stdout stderr stringstream istringstream ostringstream auto_ptr deque list queue stack vector map set pair bitset multiset multimap unordered_set unordered_map unordered_multiset unordered_multimap priority_queue make_pair array shared_ptr abort terminate abs acos asin atan2 atan calloc ceil cosh cos exit exp fabs floor fmod fprintf fputs free frexp fscanf future isalnum isalpha iscntrl isdigit isgraph islower isprint ispunct isspace isupper isxdigit tolower toupper labs ldexp log10 log malloc realloc memchr memcmp memcpy memset modf pow printf putchar puts scanf sinh sin snprintf sprintf sqrt sscanf strcat strchr strcmp strcpy strcspn strlen strncat strncmp strncpy strpbrk strrchr strspn strstr tanh tan vfprintf vprintf vsprintf endl initializer_list unique_ptr`},p=[l,o,n,e.C_BLOCK_COMMENT_MODE,c,s],m={variants:[{begin:/=/,end:/;/},{begin:/\(/,end:/\)/},{beginKeywords:`new throw return else`,end:/;/}],keywords:f,contains:p.concat([{begin:/\(/,end:/\)/,keywords:f,contains:p.concat([`self`]),relevance:0}]),relevance:0},h={begin:`(`+a+`[\\*&\\s]+)+`+d,returnBegin:!0,end:/[{;=]/,excludeEnd:!0,keywords:f,illegal:/[^\w\s\*&:<>.]/,contains:[{begin:r,keywords:f,relevance:0},{begin:d,returnBegin:!0,contains:[e.inherit(u,{className:`title.function`})],relevance:0},{relevance:0,match:/,/},{className:`params`,begin:/\(/,end:/\)/,keywords:f,relevance:0,contains:[n,e.C_BLOCK_COMMENT_MODE,s,c,o,{begin:/\(/,end:/\)/,keywords:f,relevance:0,contains:[`self`,n,e.C_BLOCK_COMMENT_MODE,s,c,o]}]},o,n,e.C_BLOCK_COMMENT_MODE,l]};return{name:`C`,aliases:[`h`],keywords:f,disableAutodetect:!0,illegal:`</`,contains:[].concat(m,h,p,[l,{begin:e.IDENT_RE+`::`,keywords:f},{className:`class`,beginKeywords:`enum class struct union`,end:/[{;:<>=]/,contains:[{beginKeywords:`final class struct`},e.TITLE_MODE]}]),exports:{preprocessor:l,strings:s,keywords:f}}}var zDe=s((()=>{}));function BDe(e){let t=e.regex,n=e.COMMENT(`//`,`$`,{contains:[{begin:/\\\n/}]}),r=`decltype\\(auto\\)`,i=`[a-zA-Z_]\\w*::`,a=`(?!struct)(`+r+`|`+t.optional(i)+`[a-zA-Z_]\\w*`+t.optional(`<[^<>]+>`)+`)`,o={className:`type`,begin:`\\b[a-z\\d_]*_t\\b`},s={className:`string`,variants:[{begin:`(u8?|U|L)?"`,end:`"`,illegal:`\\n`,contains:[e.BACKSLASH_ESCAPE]},{begin:`(u8?|U|L)?'(\\\\(x[0-9A-Fa-f]{2}|u[0-9A-Fa-f]{4,8}|[0-7]{3}|\\S)|.)`,end:`'`,illegal:`.`},e.END_SAME_AS_BEGIN({begin:/(?:u8?|U|L)?R"([^()\\ ]{0,16})\(/,end:/\)([^()\\ ]{0,16})"/})]},c={className:`number`,variants:[{begin:`[+-]?(?:(?:[0-9](?:'?[0-9])*\\.(?:[0-9](?:'?[0-9])*)?|\\.[0-9](?:'?[0-9])*)(?:[Ee][+-]?[0-9](?:'?[0-9])*)?|[0-9](?:'?[0-9])*[Ee][+-]?[0-9](?:'?[0-9])*|0[Xx](?:[0-9A-Fa-f](?:'?[0-9A-Fa-f])*(?:\\.(?:[0-9A-Fa-f](?:'?[0-9A-Fa-f])*)?)?|\\.[0-9A-Fa-f](?:'?[0-9A-Fa-f])*)[Pp][+-]?[0-9](?:'?[0-9])*)(?:[Ff](?:16|32|64|128)?|(BF|bf)16|[Ll]|)`},{begin:`[+-]?\\b(?:0[Bb][01](?:'?[01])*|0[Xx][0-9A-Fa-f](?:'?[0-9A-Fa-f])*|0(?:'?[0-7])*|[1-9](?:'?[0-9])*)(?:[Uu](?:LL?|ll?)|[Uu][Zz]?|(?:LL?|ll?)[Uu]?|[Zz][Uu]|)`}],relevance:0},l={className:`meta`,begin:/#\s*[a-z]+\b/,end:/$/,keywords:{keyword:`if else elif endif define undef warning error line pragma _Pragma ifdef ifndef include`},contains:[{begin:/\\\n/,relevance:0},e.inherit(s,{className:`string`}),{className:`string`,begin:/<.*?>/},n,e.C_BLOCK_COMMENT_MODE]},u={className:`title`,begin:t.optional(i)+e.IDENT_RE,relevance:0},d=t.optional(i)+e.IDENT_RE+`\\s*\\(`,f=`alignas.alignof.and.and_eq.asm.atomic_cancel.atomic_commit.atomic_noexcept.auto.bitand.bitor.break.case.catch.class.co_await.co_return.co_yield.compl.concept.const_cast|10.consteval.constexpr.constinit.continue.decltype.default.delete.do.dynamic_cast|10.else.enum.explicit.export.extern.false.final.for.friend.goto.if.import.inline.module.mutable.namespace.new.noexcept.not.not_eq.nullptr.operator.or.or_eq.override.private.protected.public.reflexpr.register.reinterpret_cast|10.requires.return.sizeof.static_assert.static_cast|10.struct.switch.synchronized.template.this.thread_local.throw.transaction_safe.transaction_safe_dynamic.true.try.typedef.typeid.typename.union.using.virtual.volatile.while.xor.xor_eq`.split(`.`),p=[`bool`,`char`,`char16_t`,`char32_t`,`char8_t`,`double`,`float`,`int`,`long`,`short`,`void`,`wchar_t`,`unsigned`,`signed`,`const`,`static`],m=`any.auto_ptr.barrier.binary_semaphore.bitset.complex.condition_variable.condition_variable_any.counting_semaphore.deque.false_type.flat_map.flat_set.future.imaginary.initializer_list.istringstream.jthread.latch.lock_guard.multimap.multiset.mutex.optional.ostringstream.packaged_task.pair.promise.priority_queue.queue.recursive_mutex.recursive_timed_mutex.scoped_lock.set.shared_future.shared_lock.shared_mutex.shared_timed_mutex.shared_ptr.stack.string_view.stringstream.timed_mutex.thread.true_type.tuple.unique_lock.unique_ptr.unordered_map.unordered_multimap.unordered_multiset.unordered_set.variant.vector.weak_ptr.wstring.wstring_view`.split(`.`),h=`abort.abs.acos.apply.as_const.asin.atan.atan2.calloc.ceil.cerr.cin.clog.cos.cosh.cout.declval.endl.exchange.exit.exp.fabs.floor.fmod.forward.fprintf.fputs.free.frexp.fscanf.future.invoke.isalnum.isalpha.iscntrl.isdigit.isgraph.islower.isprint.ispunct.isspace.isupper.isxdigit.labs.launder.ldexp.log.log10.make_pair.make_shared.make_shared_for_overwrite.make_tuple.make_unique.malloc.memchr.memcmp.memcpy.memset.modf.move.pow.printf.putchar.puts.realloc.scanf.sin.sinh.snprintf.sprintf.sqrt.sscanf.std.stderr.stdin.stdout.strcat.strchr.strcmp.strcpy.strcspn.strlen.strncat.strncmp.strncpy.strpbrk.strrchr.strspn.strstr.swap.tan.tanh.terminate.to_underlying.tolower.toupper.vfprintf.visit.vprintf.vsprintf`.split(`.`),g={type:p,keyword:f,literal:[`NULL`,`false`,`nullopt`,`nullptr`,`true`],built_in:[`_Pragma`],_type_hints:m},_={className:`function.dispatch`,relevance:0,keywords:{_hint:h},begin:t.concat(/\b/,/(?!decltype)/,/(?!if)/,/(?!for)/,/(?!switch)/,/(?!while)/,e.IDENT_RE,t.lookahead(/(<[^<>]+>|)\s*\(/))},v=[_,l,o,n,e.C_BLOCK_COMMENT_MODE,c,s],y={variants:[{begin:/=/,end:/;/},{begin:/\(/,end:/\)/},{beginKeywords:`new throw return else`,end:/;/}],keywords:g,contains:v.concat([{begin:/\(/,end:/\)/,keywords:g,contains:v.concat([`self`]),relevance:0}]),relevance:0},b={className:`function`,begin:`(`+a+`[\\*&\\s]+)+`+d,returnBegin:!0,end:/[{;=]/,excludeEnd:!0,keywords:g,illegal:/[^\w\s\*&:<>.]/,contains:[{begin:r,keywords:g,relevance:0},{begin:d,returnBegin:!0,contains:[u],relevance:0},{begin:/::/,relevance:0},{begin:/:/,endsWithParent:!0,contains:[s,c]},{relevance:0,match:/,/},{className:`params`,begin:/\(/,end:/\)/,keywords:g,relevance:0,contains:[n,e.C_BLOCK_COMMENT_MODE,s,c,o,{begin:/\(/,end:/\)/,keywords:g,relevance:0,contains:[`self`,n,e.C_BLOCK_COMMENT_MODE,s,c,o]}]},o,n,e.C_BLOCK_COMMENT_MODE,l]};return{name:`C++`,aliases:[`cc`,`c++`,`h++`,`hpp`,`hh`,`hxx`,`cxx`],keywords:g,illegal:`</`,classNameAliases:{"function.dispatch":`built_in`},contains:[].concat(y,b,_,v,[l,{begin:`\\b(deque|list|queue|priority_queue|pair|stack|vector|map|set|bitset|multiset|multimap|unordered_map|unordered_set|unordered_multiset|unordered_multimap|array|tuple|optional|variant|function|flat_map|flat_set)\\s*<(?!<)`,end:`>`,keywords:g,contains:[`self`,o]},{begin:e.IDENT_RE+`::`,keywords:g},{match:[/\b(?:enum(?:\s+(?:class|struct))?|class|struct|union)/,/\s+/,/\w+/],className:{1:`keyword`,3:`title.class`}}])}}var VDe=s((()=>{}));function HDe(e){let t=[`bool`,`byte`,`char`,`decimal`,`delegate`,`double`,`dynamic`,`enum`,`float`,`int`,`long`,`nint`,`nuint`,`object`,`sbyte`,`short`,`string`,`ulong`,`uint`,`ushort`],n=[`public`,`private`,`protected`,`static`,`internal`,`protected`,`abstract`,`async`,`extern`,`override`,`unsafe`,`virtual`,`new`,`sealed`,`partial`],r={keyword:`abstract.as.base.break.case.catch.class.const.continue.do.else.event.explicit.extern.finally.fixed.for.foreach.goto.if.implicit.in.interface.internal.is.lock.namespace.new.operator.out.override.params.private.protected.public.readonly.record.ref.return.scoped.sealed.sizeof.stackalloc.static.struct.switch.this.throw.try.typeof.unchecked.unsafe.using.virtual.void.volatile.while`.split(`.`).concat(`add.alias.and.ascending.args.async.await.by.descending.dynamic.equals.file.from.get.global.group.init.into.join.let.nameof.not.notnull.on.or.orderby.partial.record.remove.required.scoped.select.set.unmanaged.value|0.var.when.where.with.yield`.split(`.`)),built_in:t,literal:[`default`,`false`,`null`,`true`]},i=e.inherit(e.TITLE_MODE,{begin:`[a-zA-Z](\\.?\\w)*`}),a={className:`number`,variants:[{begin:`\\b(0b[01']+)`},{begin:`(-?)\\b([\\d']+(\\.[\\d']*)?|\\.[\\d']+)(u|U|l|L|ul|UL|f|F|b|B)`},{begin:`(-?)(\\b0[xX][a-fA-F0-9']+|(\\b[\\d']+(\\.[\\d']*)?|\\.[\\d']+)([eE][-+]?[\\d']+)?)`}],relevance:0},o={className:`string`,begin:/"""("*)(?!")(.|\n)*?"""\1/,relevance:1},s={className:`string`,begin:`@"`,end:`"`,contains:[{begin:`""`}]},c=e.inherit(s,{illegal:/\n/}),l={className:`subst`,begin:/\{/,end:/\}/,keywords:r},u=e.inherit(l,{illegal:/\n/}),d={className:`string`,begin:/\$"/,end:`"`,illegal:/\n/,contains:[{begin:/\{\{/},{begin:/\}\}/},e.BACKSLASH_ESCAPE,u]},f={className:`string`,begin:/\$@"/,end:`"`,contains:[{begin:/\{\{/},{begin:/\}\}/},{begin:`""`},l]},p=e.inherit(f,{illegal:/\n/,contains:[{begin:/\{\{/},{begin:/\}\}/},{begin:`""`},u]});l.contains=[f,d,s,e.APOS_STRING_MODE,e.QUOTE_STRING_MODE,a,e.C_BLOCK_COMMENT_MODE],u.contains=[p,d,c,e.APOS_STRING_MODE,e.QUOTE_STRING_MODE,a,e.inherit(e.C_BLOCK_COMMENT_MODE,{illegal:/\n/})];let m={variants:[o,f,d,s,e.APOS_STRING_MODE,e.QUOTE_STRING_MODE]},h={begin:`<`,end:`>`,contains:[{beginKeywords:`in out`},i]},g=e.IDENT_RE+`(<`+e.IDENT_RE+`(\\s*,\\s*`+e.IDENT_RE+`)*>)?(\\[\\])?`,_={begin:`@`+e.IDENT_RE,relevance:0};return{name:`C#`,aliases:[`cs`,`c#`],keywords:r,illegal:/::/,contains:[e.COMMENT(`///`,`$`,{returnBegin:!0,contains:[{className:`doctag`,variants:[{begin:`///`,relevance:0},{begin:`<!--|-->`},{begin:`</?`,end:`>`}]}]}),e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE,{className:`meta`,begin:`#`,end:`$`,keywords:{keyword:`if else elif endif define undef warning error line region endregion pragma checksum`}},m,a,{beginKeywords:`class interface`,relevance:0,end:/[{;=]/,illegal:/[^\s:,]/,contains:[{beginKeywords:`where class`},i,h,e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE]},{beginKeywords:`namespace`,relevance:0,end:/[{;=]/,illegal:/[^\s:]/,contains:[i,e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE]},{beginKeywords:`record`,relevance:0,end:/[{;=]/,illegal:/[^\s:]/,contains:[i,h,e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE]},{className:`meta`,begin:`^\\s*\\[(?=[\\w])`,excludeBegin:!0,end:`\\]`,excludeEnd:!0,contains:[{className:`string`,begin:/"/,end:/"/}]},{beginKeywords:`new return throw await else`,relevance:0},{className:`function`,begin:`(`+g+`\\s+)+`+e.IDENT_RE+`\\s*(<[^=]+>\\s*)?\\(`,returnBegin:!0,end:/\s*[{;=]/,excludeEnd:!0,keywords:r,contains:[{beginKeywords:n.join(` `),relevance:0},{begin:e.IDENT_RE+`\\s*(<[^=]+>\\s*)?\\(`,returnBegin:!0,contains:[e.TITLE_MODE,h],relevance:0},{match:/\(\)/},{className:`params`,begin:/\(/,end:/\)/,excludeBegin:!0,excludeEnd:!0,keywords:r,relevance:0,contains:[m,a,e.C_BLOCK_COMMENT_MODE]},e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE]},_]}}var UDe=s((()=>{}));function WDe(e){let t=e.regex,n=GDe(e),r={begin:/-(webkit|moz|ms|o)-(?=[a-z])/},i=/@-?\w[\w]*(-\w+)*/,a=[e.APOS_STRING_MODE,e.QUOTE_STRING_MODE];return{name:`CSS`,case_insensitive:!0,illegal:/[=|'\$]/,keywords:{keyframePosition:`from to`},classNameAliases:{keyframePosition:`selector-tag`},contains:[n.BLOCK_COMMENT,r,n.CSS_NUMBER_MODE,{className:`selector-id`,begin:/#[A-Za-z0-9_-]+/,relevance:0},{className:`selector-class`,begin:`\\.[a-zA-Z-][a-zA-Z0-9_-]*`,relevance:0},n.ATTRIBUTE_SELECTOR_MODE,{className:`selector-pseudo`,variants:[{begin:`:(`+XDe.join(`|`)+`)`},{begin:`:(:)?(`+ZDe.join(`|`)+`)`}]},n.CSS_VARIABLE,{className:`attribute`,begin:`\\b(`+QDe.join(`|`)+`)\\b`},{begin:/:/,end:/[;}{]/,contains:[n.BLOCK_COMMENT,n.HEXCOLOR,n.IMPORTANT,n.CSS_NUMBER_MODE,...a,{begin:/(url|data-uri)\(/,end:/\)/,relevance:0,keywords:{built_in:`url data-uri`},contains:[...a,{className:`string`,begin:/[^)]/,endsWithParent:!0,excludeEnd:!0}]},n.FUNCTION_DISPATCH]},{begin:t.lookahead(/@/),end:`[{;]`,relevance:0,illegal:/:/,contains:[{className:`keyword`,begin:i},{begin:/\s/,endsWithParent:!0,excludeEnd:!0,relevance:0,keywords:{$pattern:/[a-z-]+/,keyword:`and or not only`,attribute:YDe.join(` `)},contains:[{begin:/[a-z-]+(?=:)/,className:`attribute`},...a,n.CSS_NUMBER_MODE]}]},{className:`selector-tag`,begin:`\\b(`+JDe.join(`|`)+`)\\b`}]}}var GDe,KDe,qDe,JDe,YDe,XDe,ZDe,QDe,$De=s((()=>{GDe=e=>({IMPORTANT:{scope:`meta`,begin:`!important`},BLOCK_COMMENT:e.C_BLOCK_COMMENT_MODE,HEXCOLOR:{scope:`number`,begin:/#(([0-9a-fA-F]{3,4})|(([0-9a-fA-F]{2}){3,4}))\b/},FUNCTION_DISPATCH:{className:`built_in`,begin:/[\w-]+(?=\()/},ATTRIBUTE_SELECTOR_MODE:{scope:`selector-attr`,begin:/\[/,end:/\]/,illegal:`$`,contains:[e.APOS_STRING_MODE,e.QUOTE_STRING_MODE]},CSS_NUMBER_MODE:{scope:`number`,begin:e.NUMBER_RE+`(%|em|ex|ch|rem|vw|vh|vmin|vmax|cm|mm|in|pt|pc|px|deg|grad|rad|turn|s|ms|Hz|kHz|dpi|dpcm|dppx)?`,relevance:0},CSS_VARIABLE:{className:`attr`,begin:/--[A-Za-z_][A-Za-z0-9_-]*/}}),KDe=`a.abbr.address.article.aside.audio.b.blockquote.body.button.canvas.caption.cite.code.dd.del.details.dfn.div.dl.dt.em.fieldset.figcaption.figure.footer.form.h1.h2.h3.h4.h5.h6.header.hgroup.html.i.iframe.img.input.ins.kbd.label.legend.li.main.mark.menu.nav.object.ol.optgroup.option.p.picture.q.quote.samp.section.select.source.span.strong.summary.sup.table.tbody.td.textarea.tfoot.th.thead.time.tr.ul.var.video`.split(`.`),qDe=`defs.g.marker.mask.pattern.svg.switch.symbol.feBlend.feColorMatrix.feComponentTransfer.feComposite.feConvolveMatrix.feDiffuseLighting.feDisplacementMap.feFlood.feGaussianBlur.feImage.feMerge.feMorphology.feOffset.feSpecularLighting.feTile.feTurbulence.linearGradient.radialGradient.stop.circle.ellipse.image.line.path.polygon.polyline.rect.text.use.textPath.tspan.foreignObject.clipPath`.split(`.`),JDe=[...KDe,...qDe],YDe=`any-hover.any-pointer.aspect-ratio.color.color-gamut.color-index.device-aspect-ratio.device-height.device-width.display-mode.forced-colors.grid.height.hover.inverted-colors.monochrome.orientation.overflow-block.overflow-inline.pointer.prefers-color-scheme.prefers-contrast.prefers-reduced-motion.prefers-reduced-transparency.resolution.scan.scripting.update.width.min-width.max-width.min-height.max-height`.split(`.`).sort().reverse(),XDe=`active.any-link.blank.checked.current.default.defined.dir.disabled.drop.empty.enabled.first.first-child.first-of-type.fullscreen.future.focus.focus-visible.focus-within.has.host.host-context.hover.indeterminate.in-range.invalid.is.lang.last-child.last-of-type.left.link.local-link.not.nth-child.nth-col.nth-last-child.nth-last-col.nth-last-of-type.nth-of-type.only-child.only-of-type.optional.out-of-range.past.placeholder-shown.read-only.read-write.required.right.root.scope.target.target-within.user-invalid.valid.visited.where`.split(`.`).sort().reverse(),ZDe=[`after`,`backdrop`,`before`,`cue`,`cue-region`,`first-letter`,`first-line`,`grammar-error`,`marker`,`part`,`placeholder`,`selection`,`slotted`,`spelling-error`].sort().reverse(),QDe=`accent-color.align-content.align-items.align-self.alignment-baseline.all.anchor-name.animation.animation-composition.animation-delay.animation-direction.animation-duration.animation-fill-mode.animation-iteration-count.animation-name.animation-play-state.animation-range.animation-range-end.animation-range-start.animation-timeline.animation-timing-function.appearance.aspect-ratio.backdrop-filter.backface-visibility.background.background-attachment.background-blend-mode.background-clip.background-color.background-image.background-origin.background-position.background-position-x.background-position-y.background-repeat.background-size.baseline-shift.block-size.border.border-block.border-block-color.border-block-end.border-block-end-color.border-block-end-style.border-block-end-width.border-block-start.border-block-start-color.border-block-start-style.border-block-start-width.border-block-style.border-block-width.border-bottom.border-bottom-color.border-bottom-left-radius.border-bottom-right-radius.border-bottom-style.border-bottom-width.border-collapse.border-color.border-end-end-radius.border-end-start-radius.border-image.border-image-outset.border-image-repeat.border-image-slice.border-image-source.border-image-width.border-inline.border-inline-color.border-inline-end.border-inline-end-color.border-inline-end-style.border-inline-end-width.border-inline-start.border-inline-start-color.border-inline-start-style.border-inline-start-width.border-inline-style.border-inline-width.border-left.border-left-color.border-left-style.border-left-width.border-radius.border-right.border-right-color.border-right-style.border-right-width.border-spacing.border-start-end-radius.border-start-start-radius.border-style.border-top.border-top-color.border-top-left-radius.border-top-right-radius.border-top-style.border-top-width.border-width.bottom.box-align.box-decoration-break.box-direction.box-flex.box-flex-group.box-lines.box-ordinal-group.box-orient.box-pack.box-shadow.box-sizing.break-after.break-before.break-inside.caption-side.caret-color.clear.clip.clip-path.clip-rule.color.color-interpolation.color-interpolation-filters.color-profile.color-rendering.color-scheme.column-count.column-fill.column-gap.column-rule.column-rule-color.column-rule-style.column-rule-width.column-span.column-width.columns.contain.contain-intrinsic-block-size.contain-intrinsic-height.contain-intrinsic-inline-size.contain-intrinsic-size.contain-intrinsic-width.container.container-name.container-type.content.content-visibility.counter-increment.counter-reset.counter-set.cue.cue-after.cue-before.cursor.cx.cy.direction.display.dominant-baseline.empty-cells.enable-background.field-sizing.fill.fill-opacity.fill-rule.filter.flex.flex-basis.flex-direction.flex-flow.flex-grow.flex-shrink.flex-wrap.float.flood-color.flood-opacity.flow.font.font-display.font-family.font-feature-settings.font-kerning.font-language-override.font-optical-sizing.font-palette.font-size.font-size-adjust.font-smooth.font-smoothing.font-stretch.font-style.font-synthesis.font-synthesis-position.font-synthesis-small-caps.font-synthesis-style.font-synthesis-weight.font-variant.font-variant-alternates.font-variant-caps.font-variant-east-asian.font-variant-emoji.font-variant-ligatures.font-variant-numeric.font-variant-position.font-variation-settings.font-weight.forced-color-adjust.gap.glyph-orientation-horizontal.glyph-orientation-vertical.grid.grid-area.grid-auto-columns.grid-auto-flow.grid-auto-rows.grid-column.grid-column-end.grid-column-start.grid-gap.grid-row.grid-row-end.grid-row-start.grid-template.grid-template-areas.grid-template-columns.grid-template-rows.hanging-punctuation.height.hyphenate-character.hyphenate-limit-chars.hyphens.icon.image-orientation.image-rendering.image-resolution.ime-mode.initial-letter.initial-letter-align.inline-size.inset.inset-area.inset-block.inset-block-end.inset-block-start.inset-inline.inset-inline-end.inset-inline-start.isolation.justify-content.justify-items.justify-self.kerning.left.letter-spacing.lighting-color.line-break.line-height.line-height-step.list-style.list-style-image.list-style-position.list-style-type.margin.margin-block.margin-block-end.margin-block-start.margin-bottom.margin-inline.margin-inline-end.margin-inline-start.margin-left.margin-right.margin-top.margin-trim.marker.marker-end.marker-mid.marker-start.marks.mask.mask-border.mask-border-mode.mask-border-outset.mask-border-repeat.mask-border-slice.mask-border-source.mask-border-width.mask-clip.mask-composite.mask-image.mask-mode.mask-origin.mask-position.mask-repeat.mask-size.mask-type.masonry-auto-flow.math-depth.math-shift.math-style.max-block-size.max-height.max-inline-size.max-width.min-block-size.min-height.min-inline-size.min-width.mix-blend-mode.nav-down.nav-index.nav-left.nav-right.nav-up.none.normal.object-fit.object-position.offset.offset-anchor.offset-distance.offset-path.offset-position.offset-rotate.opacity.order.orphans.outline.outline-color.outline-offset.outline-style.outline-width.overflow.overflow-anchor.overflow-block.overflow-clip-margin.overflow-inline.overflow-wrap.overflow-x.overflow-y.overlay.overscroll-behavior.overscroll-behavior-block.overscroll-behavior-inline.overscroll-behavior-x.overscroll-behavior-y.padding.padding-block.padding-block-end.padding-block-start.padding-bottom.padding-inline.padding-inline-end.padding-inline-start.padding-left.padding-right.padding-top.page.page-break-after.page-break-before.page-break-inside.paint-order.pause.pause-after.pause-before.perspective.perspective-origin.place-content.place-items.place-self.pointer-events.position.position-anchor.position-visibility.print-color-adjust.quotes.r.resize.rest.rest-after.rest-before.right.rotate.row-gap.ruby-align.ruby-position.scale.scroll-behavior.scroll-margin.scroll-margin-block.scroll-margin-block-end.scroll-margin-block-start.scroll-margin-bottom.scroll-margin-inline.scroll-margin-inline-end.scroll-margin-inline-start.scroll-margin-left.scroll-margin-right.scroll-margin-top.scroll-padding.scroll-padding-block.scroll-padding-block-end.scroll-padding-block-start.scroll-padding-bottom.scroll-padding-inline.scroll-padding-inline-end.scroll-padding-inline-start.scroll-padding-left.scroll-padding-right.scroll-padding-top.scroll-snap-align.scroll-snap-stop.scroll-snap-type.scroll-timeline.scroll-timeline-axis.scroll-timeline-name.scrollbar-color.scrollbar-gutter.scrollbar-width.shape-image-threshold.shape-margin.shape-outside.shape-rendering.speak.speak-as.src.stop-color.stop-opacity.stroke.stroke-dasharray.stroke-dashoffset.stroke-linecap.stroke-linejoin.stroke-miterlimit.stroke-opacity.stroke-width.tab-size.table-layout.text-align.text-align-all.text-align-last.text-anchor.text-combine-upright.text-decoration.text-decoration-color.text-decoration-line.text-decoration-skip.text-decoration-skip-ink.text-decoration-style.text-decoration-thickness.text-emphasis.text-emphasis-color.text-emphasis-position.text-emphasis-style.text-indent.text-justify.text-orientation.text-overflow.text-rendering.text-shadow.text-size-adjust.text-transform.text-underline-offset.text-underline-position.text-wrap.text-wrap-mode.text-wrap-style.timeline-scope.top.touch-action.transform.transform-box.transform-origin.transform-style.transition.transition-behavior.transition-delay.transition-duration.transition-property.transition-timing-function.translate.unicode-bidi.user-modify.user-select.vector-effect.vertical-align.view-timeline.view-timeline-axis.view-timeline-inset.view-timeline-name.view-transition-name.visibility.voice-balance.voice-duration.voice-family.voice-pitch.voice-range.voice-rate.voice-stress.voice-volume.white-space.white-space-collapse.widows.width.will-change.word-break.word-spacing.word-wrap.writing-mode.x.y.z-index.zoom`.split(`.`).sort().reverse()}));function eOe(e){let t=e.regex;return{name:`Diff`,aliases:[`patch`],contains:[{className:`meta`,relevance:10,match:t.either(/^@@ +-\d+,\d+ +\+\d+,\d+ +@@/,/^\*\*\* +\d+,\d+ +\*\*\*\*$/,/^--- +\d+,\d+ +----$/)},{className:`comment`,variants:[{begin:t.either(/Index: /,/^index/,/={3,}/,/^-{3}/,/^\*{3} /,/^\+{3}/,/^diff --git/),end:/$/},{match:/^\*{15}$/}]},{className:`addition`,begin:/^\+/,end:/$/},{className:`deletion`,begin:/^-/,end:/$/},{className:`addition`,begin:/^!/,end:/$/}]}}var tOe=s((()=>{}));function nOe(e){let t={keyword:[`break`,`case`,`chan`,`const`,`continue`,`default`,`defer`,`else`,`fallthrough`,`for`,`func`,`go`,`goto`,`if`,`import`,`interface`,`map`,`package`,`range`,`return`,`select`,`struct`,`switch`,`type`,`var`],type:[`bool`,`byte`,`complex64`,`complex128`,`error`,`float32`,`float64`,`int8`,`int16`,`int32`,`int64`,`string`,`uint8`,`uint16`,`uint32`,`uint64`,`int`,`uint`,`uintptr`,`rune`],literal:[`true`,`false`,`iota`,`nil`],built_in:[`append`,`cap`,`close`,`complex`,`copy`,`imag`,`len`,`make`,`new`,`panic`,`print`,`println`,`real`,`recover`,`delete`]};return{name:`Go`,aliases:[`golang`],keywords:t,illegal:`</`,contains:[e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE,{className:`string`,variants:[e.QUOTE_STRING_MODE,e.APOS_STRING_MODE,{begin:"`",end:"`"}]},{className:`number`,variants:[{match:/-?\b0[xX]\.[a-fA-F0-9](_?[a-fA-F0-9])*[pP][+-]?\d(_?\d)*i?/,relevance:0},{match:/-?\b0[xX](_?[a-fA-F0-9])+((\.([a-fA-F0-9](_?[a-fA-F0-9])*)?)?[pP][+-]?\d(_?\d)*)?i?/,relevance:0},{match:/-?\b0[oO](_?[0-7])*i?/,relevance:0},{match:/-?\.\d(_?\d)*([eE][+-]?\d(_?\d)*)?i?/,relevance:0},{match:/-?\b\d(_?\d)*(\.(\d(_?\d)*)?)?([eE][+-]?\d(_?\d)*)?i?/,relevance:0}]},{begin:/:=/},{className:`function`,beginKeywords:`func`,end:`\\s*(\\{|$)`,excludeEnd:!0,contains:[e.TITLE_MODE,{className:`params`,begin:/\(/,end:/\)/,endsParent:!0,keywords:t,illegal:/["']/}]}]}}var rOe=s((()=>{}));function iOe(e){let t=e.regex;return{name:`GraphQL`,aliases:[`gql`],case_insensitive:!0,disableAutodetect:!1,keywords:{keyword:[`query`,`mutation`,`subscription`,`type`,`input`,`schema`,`directive`,`interface`,`union`,`scalar`,`fragment`,`enum`,`on`],literal:[`true`,`false`,`null`]},contains:[e.HASH_COMMENT_MODE,e.QUOTE_STRING_MODE,e.NUMBER_MODE,{scope:`punctuation`,match:/[.]{3}/,relevance:0},{scope:`punctuation`,begin:/[\!\(\)\:\=\[\]\{\|\}]{1}/,relevance:0},{scope:`variable`,begin:/\$/,end:/\W/,excludeEnd:!0,relevance:0},{scope:`meta`,match:/@\w+/,excludeEnd:!0},{scope:`symbol`,begin:t.concat(/[_A-Za-z][_0-9A-Za-z]*/,t.lookahead(/\s*:/)),relevance:0}],illegal:[/[;<']/,/BEGIN/]}}var aOe=s((()=>{}));function oOe(e){let t=e.regex,n={className:`number`,relevance:0,variants:[{begin:/([+-]+)?[\d]+_[\d_]+/},{begin:e.NUMBER_RE}]},r=e.COMMENT();r.variants=[{begin:/;/,end:/$/},{begin:/#/,end:/$/}];let i={className:`variable`,variants:[{begin:/\$[\w\d"][\w\d_]*/},{begin:/\$\{(.*?)\}/}]},a={className:`literal`,begin:/\bon|off|true|false|yes|no\b/},o={className:`string`,contains:[e.BACKSLASH_ESCAPE],variants:[{begin:`'''`,end:`'''`,relevance:10},{begin:`"""`,end:`"""`,relevance:10},{begin:`"`,end:`"`},{begin:`'`,end:`'`}]},s={begin:/\[/,end:/\]/,contains:[r,a,i,o,n,`self`],relevance:0},c=t.either(/[A-Za-z0-9_-]+/,/"(\\"|[^"])*"/,/'[^']*'/);return{name:`TOML, also INI`,aliases:[`toml`],case_insensitive:!0,illegal:/\S/,contains:[r,{className:`section`,begin:/\[+/,end:/\]+/},{begin:t.concat(c,`(\\s*\\.\\s*`,c,`)*`,t.lookahead(/\s*=\s*[^#\s]/)),className:`attr`,starts:{end:/$/,contains:[r,s,a,i,o,n]}}]}}var sOe=s((()=>{}));function cOe(e,t,n){return n===-1?``:e.replace(t,r=>cOe(e,t,n-1))}function lOe(e){let t=e.regex,n=`[À-ʸa-zA-Z_$][À-ʸa-zA-Z_$0-9]*`,r=n+cOe(`(?:<`+n+`~~~(?:\\s*,\\s*[À-ʸa-zA-Z_$][À-ʸa-zA-Z_$0-9]*~~~)*>)?`,/~~~/g,2),i={keyword:`synchronized.abstract.private.var.static.if.const .for.while.strictfp.finally.protected.import.native.final.void.enum.else.break.transient.catch.instanceof.volatile.case.assert.package.default.public.try.switch.continue.throws.protected.public.private.module.requires.exports.do.sealed.yield.permits.goto.when`.split(`.`),literal:[`false`,`true`,`null`],type:[`char`,`boolean`,`long`,`float`,`int`,`byte`,`short`,`double`],built_in:[`super`,`this`]},a={className:`meta`,begin:`@`+n,contains:[{begin:/\(/,end:/\)/,contains:[`self`]}]},o={className:`params`,begin:/\(/,end:/\)/,keywords:i,relevance:0,contains:[e.C_BLOCK_COMMENT_MODE],endsParent:!0};return{name:`Java`,aliases:[`jsp`],keywords:i,illegal:/<\/|#/,contains:[e.COMMENT(`/\\*\\*`,`\\*/`,{relevance:0,contains:[{begin:/\w+@/,relevance:0},{className:`doctag`,begin:`@[A-Za-z]+`}]}),{begin:/import java\.[a-z]+\./,keywords:`import`,relevance:2},e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE,{begin:/"""/,end:/"""/,className:`string`,contains:[e.BACKSLASH_ESCAPE]},e.APOS_STRING_MODE,e.QUOTE_STRING_MODE,{match:[/\b(?:class|interface|enum|extends|implements|new)/,/\s+/,n],className:{1:`keyword`,3:`title.class`}},{match:/non-sealed/,scope:`keyword`},{begin:[t.concat(/(?!else)/,n),/\s+/,n,/\s+/,/=(?!=)/],className:{1:`type`,3:`variable`,5:`operator`}},{begin:[/record/,/\s+/,n],className:{1:`keyword`,3:`title.class`},contains:[o,e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE]},{beginKeywords:`new throw return else`,relevance:0},{begin:[`(?:`+r+`\\s+)`,e.UNDERSCORE_IDENT_RE,/\s*(?=\()/],className:{2:`title.function`},keywords:i,contains:[{className:`params`,begin:/\(/,end:/\)/,keywords:i,relevance:0,contains:[a,e.APOS_STRING_MODE,e.QUOTE_STRING_MODE,ug,e.C_BLOCK_COMMENT_MODE]},e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE]},ug,a]}}var sg,cg,lg,ug,uOe=s((()=>{sg=`[0-9](_*[0-9])*`,cg=`\\.(${sg})`,lg=`[0-9a-fA-F](_*[0-9a-fA-F])*`,ug={className:`number`,variants:[{begin:`(\\b(${sg})((${cg})|\\.)?|(${cg}))[eE][+-]?(${sg})[fFdD]?\\b`},{begin:`\\b(${sg})((${cg})[fFdD]?\\b|\\.([fFdD]\\b)?)`},{begin:`(${cg})[fFdD]?\\b`},{begin:`\\b(${sg})[fFdD]\\b`},{begin:`\\b0[xX]((${lg})\\.?|(${lg})?\\.(${lg}))[pP][+-]?(${sg})[fFdD]?\\b`},{begin:`\\b(0|[1-9](_*[0-9])*)[lL]?\\b`},{begin:`\\b0[xX](${lg})[lL]?\\b`},{begin:`\\b0(_*[0-7])*[lL]?\\b`},{begin:`\\b0[bB][01](_*[01])*[lL]?\\b`}],relevance:0}}));function dOe(e){let t=e.regex,n=(e,{after:t})=>{let n=`</`+e[0].slice(1);return e.input.indexOf(n,t)!==-1},r=dg,i={begin:`<>`,end:`</>`},a=/<[A-Za-z0-9\\._:-]+\s*\/>/,o={begin:/<[A-Za-z0-9\\._:-]+/,end:/\/[A-Za-z0-9\\._:-]+>|\/>/,isTrulyOpeningTag:(e,t)=>{let r=e[0].length+e.index,i=e.input[r];if(i===`<`||i===`,`){t.ignoreMatch();return}i===`>`&&(n(e,{after:r})||t.ignoreMatch());let a,o=e.input.substring(r);if(a=o.match(/^\s*=/)){t.ignoreMatch();return}if((a=o.match(/^\s+extends\s+/))&&a.index===0){t.ignoreMatch();return}}},s={$pattern:dg,keyword:fOe,literal:pOe,built_in:hOe,"variable.language":mOe},c=`[0-9](_?[0-9])*`,l=`\\.(${c})`,u=`0|[1-9](_?[0-9])*|0[0-7]*[89][0-9]*`,d={className:`number`,variants:[{begin:`(\\b(${u})((${l})|\\.)?|(${l}))[eE][+-]?(${c})\\b`},{begin:`\\b(${u})\\b((${l})\\b|\\.)?|(${l})\\b`},{begin:`\\b(0|[1-9](_?[0-9])*)n\\b`},{begin:`\\b0[xX][0-9a-fA-F](_?[0-9a-fA-F])*n?\\b`},{begin:`\\b0[bB][0-1](_?[0-1])*n?\\b`},{begin:`\\b0[oO][0-7](_?[0-7])*n?\\b`},{begin:`\\b0[0-7]+n?\\b`}],relevance:0},f={className:`subst`,begin:`\\$\\{`,end:`\\}`,keywords:s,contains:[]},p={begin:".?html`",end:``,starts:{end:"`",returnEnd:!1,contains:[e.BACKSLASH_ESCAPE,f],subLanguage:`xml`}},m={begin:".?css`",end:``,starts:{end:"`",returnEnd:!1,contains:[e.BACKSLASH_ESCAPE,f],subLanguage:`css`}},h={begin:".?gql`",end:``,starts:{end:"`",returnEnd:!1,contains:[e.BACKSLASH_ESCAPE,f],subLanguage:`graphql`}},g={className:`string`,begin:"`",end:"`",contains:[e.BACKSLASH_ESCAPE,f]},_={className:`comment`,variants:[e.COMMENT(/\/\*\*(?!\/)/,`\\*/`,{relevance:0,contains:[{begin:`(?=@[A-Za-z]+)`,relevance:0,contains:[{className:`doctag`,begin:`@[A-Za-z]+`},{className:`type`,begin:`\\{`,end:`\\}`,excludeEnd:!0,excludeBegin:!0,relevance:0},{className:`variable`,begin:r+`(?=\\s*(-)|$)`,endsParent:!0,relevance:0},{begin:/(?=[^\n])\s/,relevance:0}]}]}),e.C_BLOCK_COMMENT_MODE,e.C_LINE_COMMENT_MODE]},v=[e.APOS_STRING_MODE,e.QUOTE_STRING_MODE,p,m,h,g,{match:/\$\d+/},d];f.contains=v.concat({begin:/\{/,end:/\}/,keywords:s,contains:[`self`].concat(v)});let y=[].concat(_,f.contains),b=y.concat([{begin:/(\s*)\(/,end:/\)/,keywords:s,contains:[`self`].concat(y)}]),x={className:`params`,begin:/(\s*)\(/,end:/\)/,excludeBegin:!0,excludeEnd:!0,keywords:s,contains:b},S={variants:[{match:[/class/,/\s+/,r,/\s+/,/extends/,/\s+/,t.concat(r,`(`,t.concat(/\./,r),`)*`)],scope:{1:`keyword`,3:`title.class`,5:`keyword`,7:`title.class.inherited`}},{match:[/class/,/\s+/,r],scope:{1:`keyword`,3:`title.class`}}]},C={relevance:0,match:t.either(/\bJSON/,/\b[A-Z][a-z]+([A-Z][a-z]*|\d)*/,/\b[A-Z]{2,}([A-Z][a-z]+|\d)+([A-Z][a-z]*)*/,/\b[A-Z]{2,}[a-z]+([A-Z][a-z]+|\d)*([A-Z][a-z]*)*/),className:`title.class`,keywords:{_:[...fg,...pg]}},w={label:`use_strict`,className:`meta`,relevance:10,begin:/^\s*['"]use (strict|asm)['"]/},ee={variants:[{match:[/function/,/\s+/,r,/(?=\s*\()/]},{match:[/function/,/\s*(?=\()/]}],className:{1:`keyword`,3:`title.function`},label:`func.def`,contains:[x],illegal:/%/},te={relevance:0,match:/\b[A-Z][A-Z_0-9]+\b/,className:`variable.constant`};function ne(e){return t.concat(`(?!`,e.join(`|`),`)`)}let re={match:t.concat(/\b/,ne([...mg,`super`,`import`].map(e=>`${e}\\s*\\(`)),r,t.lookahead(/\s*\(/)),className:`title.function`,relevance:0},T={begin:t.concat(/\./,t.lookahead(t.concat(r,/(?![0-9A-Za-z$_(])/))),end:r,excludeBegin:!0,keywords:`prototype`,className:`property`,relevance:0},ie={match:[/get|set/,/\s+/,r,/(?=\()/],className:{1:`keyword`,3:`title.function`},contains:[{begin:/\(\)/},x]},ae=`(\\([^()]*(\\([^()]*(\\([^()]*\\)[^()]*)*\\)[^()]*)*\\)|`+e.UNDERSCORE_IDENT_RE+`)\\s*=>`,E={match:[/const|var|let/,/\s+/,r,/\s*/,/=\s*/,/(async\s*)?/,t.lookahead(ae)],keywords:`async`,className:{1:`keyword`,3:`title.function`},contains:[x]};return{name:`JavaScript`,aliases:[`js`,`jsx`,`mjs`,`cjs`],keywords:s,exports:{PARAMS_CONTAINS:b,CLASS_REFERENCE:C},illegal:/#(?![$_A-z])/,contains:[e.SHEBANG({label:`shebang`,binary:`node`,relevance:5}),w,e.APOS_STRING_MODE,e.QUOTE_STRING_MODE,p,m,h,g,_,{match:/\$\d+/},d,C,{scope:`attr`,match:r+t.lookahead(`:`),relevance:0},E,{begin:`(`+e.RE_STARTERS_RE+`|\\b(case|return|throw)\\b)\\s*`,keywords:`return throw case`,relevance:0,contains:[_,e.REGEXP_MODE,{className:`function`,begin:ae,returnBegin:!0,end:`\\s*=>`,contains:[{className:`params`,variants:[{begin:e.UNDERSCORE_IDENT_RE,relevance:0},{className:null,begin:/\(\s*\)/,skip:!0},{begin:/(\s*)\(/,end:/\)/,excludeBegin:!0,excludeEnd:!0,keywords:s,contains:b}]}]},{begin:/,/,relevance:0},{match:/\s+/,relevance:0},{variants:[{begin:i.begin,end:i.end},{match:a},{begin:o.begin,"on:begin":o.isTrulyOpeningTag,end:o.end}],subLanguage:`xml`,contains:[{begin:o.begin,end:o.end,skip:!0,contains:[`self`]}]}]},ee,{beginKeywords:`while if switch catch for`},{begin:`\\b(?!function)`+e.UNDERSCORE_IDENT_RE+`\\([^()]*(\\([^()]*(\\([^()]*\\)[^()]*)*\\)[^()]*)*\\)\\s*\\{`,returnBegin:!0,label:`func.def`,contains:[x,e.inherit(e.TITLE_MODE,{begin:r,className:`title.function`})]},{match:/\.\.\./,relevance:0},T,{match:`\\$`+r,relevance:0},{match:[/\bconstructor(?=\s*\()/],className:{1:`title.function`},contains:[x]},re,te,S,ie,{match:/\$[(.]/}]}}var dg,fOe,pOe,fg,pg,mg,mOe,hOe,gOe=s((()=>{dg=`[A-Za-z$_][0-9A-Za-z$_]*`,fOe=`as.in.of.if.for.while.finally.var.new.function.do.return.void.else.break.catch.instanceof.with.throw.case.default.try.switch.continue.typeof.delete.let.yield.const.class.debugger.async.await.static.import.from.export.extends.using`.split(`.`),pOe=[`true`,`false`,`null`,`undefined`,`NaN`,`Infinity`],fg=`Object.Function.Boolean.Symbol.Math.Date.Number.BigInt.String.RegExp.Array.Float32Array.Float64Array.Int8Array.Uint8Array.Uint8ClampedArray.Int16Array.Int32Array.Uint16Array.Uint32Array.BigInt64Array.BigUint64Array.Set.Map.WeakSet.WeakMap.ArrayBuffer.SharedArrayBuffer.Atomics.DataView.JSON.Promise.Generator.GeneratorFunction.AsyncFunction.Reflect.Proxy.Intl.WebAssembly`.split(`.`),pg=[`Error`,`EvalError`,`InternalError`,`RangeError`,`ReferenceError`,`SyntaxError`,`TypeError`,`URIError`],mg=[`setInterval`,`setTimeout`,`clearInterval`,`clearTimeout`,`require`,`exports`,`eval`,`isFinite`,`isNaN`,`parseFloat`,`parseInt`,`decodeURI`,`decodeURIComponent`,`encodeURI`,`encodeURIComponent`,`escape`,`unescape`],mOe=[`arguments`,`this`,`super`,`console`,`window`,`document`,`localStorage`,`sessionStorage`,`module`,`global`],hOe=[].concat(mg,fg,pg)}));function _Oe(e){let t={className:`attr`,begin:/"(\\.|[^\\"\r\n])*"(?=\s*:)/,relevance:1.01},n={match:/[{}[\],:]/,className:`punctuation`,relevance:0},r=[`true`,`false`,`null`],i={scope:`literal`,beginKeywords:r.join(` `)};return{name:`JSON`,aliases:[`jsonc`],keywords:{literal:r},contains:[t,n,e.QUOTE_STRING_MODE,i,e.C_NUMBER_MODE,e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE],illegal:`\\S`}}var vOe=s((()=>{}));function yOe(e){let t={keyword:`abstract as val var vararg get set class object open private protected public noinline crossinline dynamic final enum if else do while for when throw try catch finally import package is in fun override companion reified inline lateinit init interface annotation data sealed internal infix operator out by constructor super tailrec where const inner suspend typealias external expect actual`,built_in:`Byte Short Char Int Long Boolean Float Double Void Unit Nothing`,literal:`true false null`},n={className:`keyword`,begin:/\b(break|continue|return|this)\b/,starts:{contains:[{className:`symbol`,begin:/@\w+/}]}},r={className:`symbol`,begin:e.UNDERSCORE_IDENT_RE+`@`},i={className:`subst`,begin:/\$\{/,end:/\}/,contains:[e.C_NUMBER_MODE]},a={className:`variable`,begin:`\\$`+e.UNDERSCORE_IDENT_RE},o={className:`string`,variants:[{begin:`"""`,end:`"""(?=[^"])`,contains:[a,i]},{begin:`'`,end:`'`,illegal:/\n/,contains:[e.BACKSLASH_ESCAPE]},{begin:`"`,end:`"`,illegal:/\n/,contains:[e.BACKSLASH_ESCAPE,a,i]}]};i.contains.push(o);let s={className:`meta`,begin:`@(?:file|property|field|get|set|receiver|param|setparam|delegate)\\s*:(?:\\s*`+e.UNDERSCORE_IDENT_RE+`)?`},c={className:`meta`,begin:`@`+e.UNDERSCORE_IDENT_RE,contains:[{begin:/\(/,end:/\)/,contains:[e.inherit(o,{className:`string`}),`self`]}]},l=bOe,u=e.COMMENT(`/\\*`,`\\*/`,{contains:[e.C_BLOCK_COMMENT_MODE]}),d={variants:[{className:`type`,begin:e.UNDERSCORE_IDENT_RE},{begin:/\(/,end:/\)/,contains:[]}]},f=d;return f.variants[1].contains=[d],d.variants[1].contains=[f],{name:`Kotlin`,aliases:[`kt`,`kts`],keywords:t,contains:[e.COMMENT(`/\\*\\*`,`\\*/`,{relevance:0,contains:[{className:`doctag`,begin:`@[A-Za-z]+`}]}),e.C_LINE_COMMENT_MODE,u,n,r,s,c,{className:`function`,beginKeywords:`fun`,end:`[(]|$`,returnBegin:!0,excludeEnd:!0,keywords:t,relevance:5,contains:[{begin:e.UNDERSCORE_IDENT_RE+`\\s*\\(`,returnBegin:!0,relevance:0,contains:[e.UNDERSCORE_TITLE_MODE]},{className:`type`,begin:/</,end:/>/,keywords:`reified`,relevance:0},{className:`params`,begin:/\(/,end:/\)/,endsParent:!0,keywords:t,relevance:0,contains:[{begin:/:/,end:/[=,\/]/,endsWithParent:!0,contains:[d,e.C_LINE_COMMENT_MODE,u],relevance:0},e.C_LINE_COMMENT_MODE,u,s,c,o,e.C_NUMBER_MODE]},u]},{begin:[/class|interface|trait/,/\s+/,e.UNDERSCORE_IDENT_RE],beginScope:{3:`title.class`},keywords:`class interface trait`,end:/[:\{(]|$/,excludeEnd:!0,illegal:`extends implements`,contains:[{beginKeywords:`public protected internal private constructor`},e.UNDERSCORE_TITLE_MODE,{className:`type`,begin:/</,end:/>/,excludeBegin:!0,excludeEnd:!0,relevance:0},{className:`type`,begin:/[,:]\s*/,end:/[<\(,){\s]|$/,excludeBegin:!0,returnEnd:!0},s,c]},o,{className:`meta`,begin:`^#!/usr/bin/env`,end:`$`,illegal:`
-`},l]}}var hg,gg,_g,bOe,xOe=s((()=>{hg=`[0-9](_*[0-9])*`,gg=`\\.(${hg})`,_g=`[0-9a-fA-F](_*[0-9a-fA-F])*`,bOe={className:`number`,variants:[{begin:`(\\b(${hg})((${gg})|\\.)?|(${gg}))[eE][+-]?(${hg})[fFdD]?\\b`},{begin:`\\b(${hg})((${gg})[fFdD]?\\b|\\.([fFdD]\\b)?)`},{begin:`(${gg})[fFdD]?\\b`},{begin:`\\b(${hg})[fFdD]\\b`},{begin:`\\b0[xX]((${_g})\\.?|(${_g})?\\.(${_g}))[pP][+-]?(${hg})[fFdD]?\\b`},{begin:`\\b(0|[1-9](_*[0-9])*)[lL]?\\b`},{begin:`\\b0[xX](${_g})[lL]?\\b`},{begin:`\\b0(_*[0-7])*[lL]?\\b`},{begin:`\\b0[bB][01](_*[01])*[lL]?\\b`}],relevance:0}}));function SOe(e){let t=COe(e),n=kOe,r=`[\\w-]+`,i=`(`+r+`|@\\{[\\w-]+\\})`,a=[],o=[],s=function(e){return{className:`string`,begin:`~?`+e+`.*?`+e}},c=function(e,t,n){return{className:e,begin:t,relevance:n}},l={$pattern:/[a-z-]+/,keyword:`and or not only`,attribute:DOe.join(` `)},u={begin:`\\(`,end:`\\)`,contains:o,keywords:l,relevance:0};o.push(e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE,s(`'`),s(`"`),t.CSS_NUMBER_MODE,{begin:`(url|data-uri)\\(`,starts:{className:`string`,end:`[\\)\\n]`,excludeEnd:!0}},t.HEXCOLOR,u,c(`variable`,`@@?`+r,10),c(`variable`,`@\\{`+r+`\\}`),c(`built_in`,"~?`[^`]*?`"),{className:`attribute`,begin:r+`\\s*:`,end:`:`,returnBegin:!0,excludeEnd:!0},t.IMPORTANT,{beginKeywords:`and not`},t.FUNCTION_DISPATCH);let d=o.concat({begin:/\{/,end:/\}/,contains:a}),f={beginKeywords:`when`,endsWithParent:!0,contains:[{beginKeywords:`and not`}].concat(o)},p={begin:i+`\\s*:`,returnBegin:!0,end:/[;}]/,relevance:0,contains:[{begin:/-(webkit|moz|ms|o)-/},t.CSS_VARIABLE,{className:`attribute`,begin:`\\b(`+OOe.join(`|`)+`)\\b`,end:/(?=:)/,starts:{endsWithParent:!0,illegal:`[<=$]`,relevance:0,contains:o}}]},m={className:`keyword`,begin:`@(import|media|charset|font-face|(-[a-z]+-)?keyframes|supports|document|namespace|page|viewport|host)\\b`,starts:{end:`[;{}]`,keywords:l,returnEnd:!0,contains:o,relevance:0}},h={className:`variable`,variants:[{begin:`@`+r+`\\s*:`,relevance:15},{begin:`@`+r}],starts:{end:`[;}]`,returnEnd:!0,contains:d}},g={variants:[{begin:`[\\.#:&\\[>]`,end:`[;{}]`},{begin:i,end:/\{/}],returnBegin:!0,returnEnd:!0,illegal:`[<='$"]`,relevance:0,contains:[e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE,f,c(`keyword`,`all\\b`),c(`variable`,`@\\{`+r+`\\}`),{begin:`\\b(`+EOe.join(`|`)+`)\\b`,className:`selector-tag`},t.CSS_NUMBER_MODE,c(`selector-tag`,i,0),c(`selector-id`,`#`+i),c(`selector-class`,`\\.`+i,0),c(`selector-tag`,`&`,0),t.ATTRIBUTE_SELECTOR_MODE,{className:`selector-pseudo`,begin:`:(`+vg.join(`|`)+`)`},{className:`selector-pseudo`,begin:`:(:)?(`+yg.join(`|`)+`)`},{begin:/\(/,end:/\)/,relevance:0,contains:d},{begin:`!important`},t.FUNCTION_DISPATCH]},_={begin:`[\\w-]+:(:)?(${n.join(`|`)})`,returnBegin:!0,contains:[g]};return a.push(e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE,m,h,_,p,g,f,t.FUNCTION_DISPATCH),{name:`Less`,case_insensitive:!0,illegal:`[=>'/<($"]`,contains:a}}var COe,wOe,TOe,EOe,DOe,vg,yg,OOe,kOe,AOe=s((()=>{COe=e=>({IMPORTANT:{scope:`meta`,begin:`!important`},BLOCK_COMMENT:e.C_BLOCK_COMMENT_MODE,HEXCOLOR:{scope:`number`,begin:/#(([0-9a-fA-F]{3,4})|(([0-9a-fA-F]{2}){3,4}))\b/},FUNCTION_DISPATCH:{className:`built_in`,begin:/[\w-]+(?=\()/},ATTRIBUTE_SELECTOR_MODE:{scope:`selector-attr`,begin:/\[/,end:/\]/,illegal:`$`,contains:[e.APOS_STRING_MODE,e.QUOTE_STRING_MODE]},CSS_NUMBER_MODE:{scope:`number`,begin:e.NUMBER_RE+`(%|em|ex|ch|rem|vw|vh|vmin|vmax|cm|mm|in|pt|pc|px|deg|grad|rad|turn|s|ms|Hz|kHz|dpi|dpcm|dppx)?`,relevance:0},CSS_VARIABLE:{className:`attr`,begin:/--[A-Za-z_][A-Za-z0-9_-]*/}}),wOe=`a.abbr.address.article.aside.audio.b.blockquote.body.button.canvas.caption.cite.code.dd.del.details.dfn.div.dl.dt.em.fieldset.figcaption.figure.footer.form.h1.h2.h3.h4.h5.h6.header.hgroup.html.i.iframe.img.input.ins.kbd.label.legend.li.main.mark.menu.nav.object.ol.optgroup.option.p.picture.q.quote.samp.section.select.source.span.strong.summary.sup.table.tbody.td.textarea.tfoot.th.thead.time.tr.ul.var.video`.split(`.`),TOe=`defs.g.marker.mask.pattern.svg.switch.symbol.feBlend.feColorMatrix.feComponentTransfer.feComposite.feConvolveMatrix.feDiffuseLighting.feDisplacementMap.feFlood.feGaussianBlur.feImage.feMerge.feMorphology.feOffset.feSpecularLighting.feTile.feTurbulence.linearGradient.radialGradient.stop.circle.ellipse.image.line.path.polygon.polyline.rect.text.use.textPath.tspan.foreignObject.clipPath`.split(`.`),EOe=[...wOe,...TOe],DOe=`any-hover.any-pointer.aspect-ratio.color.color-gamut.color-index.device-aspect-ratio.device-height.device-width.display-mode.forced-colors.grid.height.hover.inverted-colors.monochrome.orientation.overflow-block.overflow-inline.pointer.prefers-color-scheme.prefers-contrast.prefers-reduced-motion.prefers-reduced-transparency.resolution.scan.scripting.update.width.min-width.max-width.min-height.max-height`.split(`.`).sort().reverse(),vg=`active.any-link.blank.checked.current.default.defined.dir.disabled.drop.empty.enabled.first.first-child.first-of-type.fullscreen.future.focus.focus-visible.focus-within.has.host.host-context.hover.indeterminate.in-range.invalid.is.lang.last-child.last-of-type.left.link.local-link.not.nth-child.nth-col.nth-last-child.nth-last-col.nth-last-of-type.nth-of-type.only-child.only-of-type.optional.out-of-range.past.placeholder-shown.read-only.read-write.required.right.root.scope.target.target-within.user-invalid.valid.visited.where`.split(`.`).sort().reverse(),yg=[`after`,`backdrop`,`before`,`cue`,`cue-region`,`first-letter`,`first-line`,`grammar-error`,`marker`,`part`,`placeholder`,`selection`,`slotted`,`spelling-error`].sort().reverse(),OOe=`accent-color.align-content.align-items.align-self.alignment-baseline.all.anchor-name.animation.animation-composition.animation-delay.animation-direction.animation-duration.animation-fill-mode.animation-iteration-count.animation-name.animation-play-state.animation-range.animation-range-end.animation-range-start.animation-timeline.animation-timing-function.appearance.aspect-ratio.backdrop-filter.backface-visibility.background.background-attachment.background-blend-mode.background-clip.background-color.background-image.background-origin.background-position.background-position-x.background-position-y.background-repeat.background-size.baseline-shift.block-size.border.border-block.border-block-color.border-block-end.border-block-end-color.border-block-end-style.border-block-end-width.border-block-start.border-block-start-color.border-block-start-style.border-block-start-width.border-block-style.border-block-width.border-bottom.border-bottom-color.border-bottom-left-radius.border-bottom-right-radius.border-bottom-style.border-bottom-width.border-collapse.border-color.border-end-end-radius.border-end-start-radius.border-image.border-image-outset.border-image-repeat.border-image-slice.border-image-source.border-image-width.border-inline.border-inline-color.border-inline-end.border-inline-end-color.border-inline-end-style.border-inline-end-width.border-inline-start.border-inline-start-color.border-inline-start-style.border-inline-start-width.border-inline-style.border-inline-width.border-left.border-left-color.border-left-style.border-left-width.border-radius.border-right.border-right-color.border-right-style.border-right-width.border-spacing.border-start-end-radius.border-start-start-radius.border-style.border-top.border-top-color.border-top-left-radius.border-top-right-radius.border-top-style.border-top-width.border-width.bottom.box-align.box-decoration-break.box-direction.box-flex.box-flex-group.box-lines.box-ordinal-group.box-orient.box-pack.box-shadow.box-sizing.break-after.break-before.break-inside.caption-side.caret-color.clear.clip.clip-path.clip-rule.color.color-interpolation.color-interpolation-filters.color-profile.color-rendering.color-scheme.column-count.column-fill.column-gap.column-rule.column-rule-color.column-rule-style.column-rule-width.column-span.column-width.columns.contain.contain-intrinsic-block-size.contain-intrinsic-height.contain-intrinsic-inline-size.contain-intrinsic-size.contain-intrinsic-width.container.container-name.container-type.content.content-visibility.counter-increment.counter-reset.counter-set.cue.cue-after.cue-before.cursor.cx.cy.direction.display.dominant-baseline.empty-cells.enable-background.field-sizing.fill.fill-opacity.fill-rule.filter.flex.flex-basis.flex-direction.flex-flow.flex-grow.flex-shrink.flex-wrap.float.flood-color.flood-opacity.flow.font.font-display.font-family.font-feature-settings.font-kerning.font-language-override.font-optical-sizing.font-palette.font-size.font-size-adjust.font-smooth.font-smoothing.font-stretch.font-style.font-synthesis.font-synthesis-position.font-synthesis-small-caps.font-synthesis-style.font-synthesis-weight.font-variant.font-variant-alternates.font-variant-caps.font-variant-east-asian.font-variant-emoji.font-variant-ligatures.font-variant-numeric.font-variant-position.font-variation-settings.font-weight.forced-color-adjust.gap.glyph-orientation-horizontal.glyph-orientation-vertical.grid.grid-area.grid-auto-columns.grid-auto-flow.grid-auto-rows.grid-column.grid-column-end.grid-column-start.grid-gap.grid-row.grid-row-end.grid-row-start.grid-template.grid-template-areas.grid-template-columns.grid-template-rows.hanging-punctuation.height.hyphenate-character.hyphenate-limit-chars.hyphens.icon.image-orientation.image-rendering.image-resolution.ime-mode.initial-letter.initial-letter-align.inline-size.inset.inset-area.inset-block.inset-block-end.inset-block-start.inset-inline.inset-inline-end.inset-inline-start.isolation.justify-content.justify-items.justify-self.kerning.left.letter-spacing.lighting-color.line-break.line-height.line-height-step.list-style.list-style-image.list-style-position.list-style-type.margin.margin-block.margin-block-end.margin-block-start.margin-bottom.margin-inline.margin-inline-end.margin-inline-start.margin-left.margin-right.margin-top.margin-trim.marker.marker-end.marker-mid.marker-start.marks.mask.mask-border.mask-border-mode.mask-border-outset.mask-border-repeat.mask-border-slice.mask-border-source.mask-border-width.mask-clip.mask-composite.mask-image.mask-mode.mask-origin.mask-position.mask-repeat.mask-size.mask-type.masonry-auto-flow.math-depth.math-shift.math-style.max-block-size.max-height.max-inline-size.max-width.min-block-size.min-height.min-inline-size.min-width.mix-blend-mode.nav-down.nav-index.nav-left.nav-right.nav-up.none.normal.object-fit.object-position.offset.offset-anchor.offset-distance.offset-path.offset-position.offset-rotate.opacity.order.orphans.outline.outline-color.outline-offset.outline-style.outline-width.overflow.overflow-anchor.overflow-block.overflow-clip-margin.overflow-inline.overflow-wrap.overflow-x.overflow-y.overlay.overscroll-behavior.overscroll-behavior-block.overscroll-behavior-inline.overscroll-behavior-x.overscroll-behavior-y.padding.padding-block.padding-block-end.padding-block-start.padding-bottom.padding-inline.padding-inline-end.padding-inline-start.padding-left.padding-right.padding-top.page.page-break-after.page-break-before.page-break-inside.paint-order.pause.pause-after.pause-before.perspective.perspective-origin.place-content.place-items.place-self.pointer-events.position.position-anchor.position-visibility.print-color-adjust.quotes.r.resize.rest.rest-after.rest-before.right.rotate.row-gap.ruby-align.ruby-position.scale.scroll-behavior.scroll-margin.scroll-margin-block.scroll-margin-block-end.scroll-margin-block-start.scroll-margin-bottom.scroll-margin-inline.scroll-margin-inline-end.scroll-margin-inline-start.scroll-margin-left.scroll-margin-right.scroll-margin-top.scroll-padding.scroll-padding-block.scroll-padding-block-end.scroll-padding-block-start.scroll-padding-bottom.scroll-padding-inline.scroll-padding-inline-end.scroll-padding-inline-start.scroll-padding-left.scroll-padding-right.scroll-padding-top.scroll-snap-align.scroll-snap-stop.scroll-snap-type.scroll-timeline.scroll-timeline-axis.scroll-timeline-name.scrollbar-color.scrollbar-gutter.scrollbar-width.shape-image-threshold.shape-margin.shape-outside.shape-rendering.speak.speak-as.src.stop-color.stop-opacity.stroke.stroke-dasharray.stroke-dashoffset.stroke-linecap.stroke-linejoin.stroke-miterlimit.stroke-opacity.stroke-width.tab-size.table-layout.text-align.text-align-all.text-align-last.text-anchor.text-combine-upright.text-decoration.text-decoration-color.text-decoration-line.text-decoration-skip.text-decoration-skip-ink.text-decoration-style.text-decoration-thickness.text-emphasis.text-emphasis-color.text-emphasis-position.text-emphasis-style.text-indent.text-justify.text-orientation.text-overflow.text-rendering.text-shadow.text-size-adjust.text-transform.text-underline-offset.text-underline-position.text-wrap.text-wrap-mode.text-wrap-style.timeline-scope.top.touch-action.transform.transform-box.transform-origin.transform-style.transition.transition-behavior.transition-delay.transition-duration.transition-property.transition-timing-function.translate.unicode-bidi.user-modify.user-select.vector-effect.vertical-align.view-timeline.view-timeline-axis.view-timeline-inset.view-timeline-name.view-transition-name.visibility.voice-balance.voice-duration.voice-family.voice-pitch.voice-range.voice-rate.voice-stress.voice-volume.white-space.white-space-collapse.widows.width.will-change.word-break.word-spacing.word-wrap.writing-mode.x.y.z-index.zoom`.split(`.`).sort().reverse(),kOe=vg.concat(yg).sort().reverse()}));function jOe(e){let t=`\\[=*\\[`,n=`\\]=*\\]`,r={begin:t,end:n,contains:[`self`]},i=[e.COMMENT(`--(?!`+t+`)`,`$`),e.COMMENT(`--`+t,n,{contains:[r],relevance:10})];return{name:`Lua`,aliases:[`pluto`],keywords:{$pattern:e.UNDERSCORE_IDENT_RE,literal:`true false nil`,keyword:`and break do else elseif end for goto if in local not or repeat return then until while`,built_in:`_G _ENV _VERSION __index __newindex __mode __call __metatable __tostring __len __gc __add __sub __mul __div __mod __pow __concat __unm __eq __lt __le assert collectgarbage dofile error getfenv getmetatable ipairs load loadfile loadstring module next pairs pcall print rawequal rawget rawset require select setfenv setmetatable tonumber tostring type unpack xpcall arg self coroutine resume yield status wrap create running debug getupvalue debug sethook getmetatable gethook setmetatable setlocal traceback setfenv getinfo setupvalue getlocal getregistry getfenv io lines write close flush open output type read stderr stdin input stdout popen tmpfile math log max acos huge ldexp pi cos tanh pow deg tan cosh sinh random randomseed frexp ceil floor rad abs sqrt modf asin min mod fmod log10 atan2 exp sin atan os exit setlocale date getenv difftime remove time clock tmpname rename execute package preload loadlib loaded loaders cpath config path seeall string sub upper len gfind rep find match char dump gmatch reverse byte format gsub lower table setn insert getn foreachi maxn foreach concat sort remove`},contains:i.concat([{className:`function`,beginKeywords:`function`,end:`\\)`,contains:[e.inherit(e.TITLE_MODE,{begin:`([_a-zA-Z]\\w*\\.)*([_a-zA-Z]\\w*:)?[_a-zA-Z]\\w*`}),{className:`params`,begin:`\\(`,endsWithParent:!0,contains:i}].concat(i)},e.C_NUMBER_MODE,e.APOS_STRING_MODE,e.QUOTE_STRING_MODE,{className:`string`,begin:t,end:n,contains:[r],relevance:5}])}}var MOe=s((()=>{}));function NOe(e){let t={className:`variable`,variants:[{begin:`\\$\\(`+e.UNDERSCORE_IDENT_RE+`\\)`,contains:[e.BACKSLASH_ESCAPE]},{begin:/\$[@%<?\^\+\*]/}]},n={className:`string`,begin:/"/,end:/"/,contains:[e.BACKSLASH_ESCAPE,t]},r={className:`variable`,begin:/\$\([\w-]+\s/,end:/\)/,keywords:{built_in:`subst patsubst strip findstring filter filter-out sort word wordlist firstword lastword dir notdir suffix basename addsuffix addprefix join wildcard realpath abspath error warning shell origin flavor foreach if or and call eval file value`},contains:[t,n]},i={begin:`^`+e.UNDERSCORE_IDENT_RE+`\\s*(?=[:+?]?=)`},a={className:`meta`,begin:/^\.PHONY:/,end:/$/,keywords:{$pattern:/[\.\w]+/,keyword:`.PHONY`}},o={className:`section`,begin:/^[^\s]+:/,end:/$/,contains:[t]};return{name:`Makefile`,aliases:[`mk`,`mak`,`make`],keywords:{$pattern:/[\w-]+/,keyword:`define endef undefine ifdef ifndef ifeq ifneq else endif include -include sinclude override export unexport private vpath`},contains:[e.HASH_COMMENT_MODE,t,n,r,i,a,o]}}var POe=s((()=>{}));function FOe(e){let t=e.regex,n={begin:/<\/?[A-Za-z_]/,end:`>`,subLanguage:`xml`,relevance:0},r={begin:`^[-\\*]{3,}`,end:`$`},i={className:`code`,variants:[{begin:"(`{3,})[^`](.|\\n)*?\\1`*[ ]*"},{begin:`(~{3,})[^~](.|\\n)*?\\1~*[ ]*`},{begin:"```",end:"```+[ ]*$"},{begin:`~~~`,end:`~~~+[ ]*$`},{begin:"`.+?`"},{begin:`(?=^( {4}|\\t))`,contains:[{begin:`^( {4}|\\t)`,end:`(\\n)$`}],relevance:0}]},a={className:`bullet`,begin:`^[ 	]*([*+-]|(\\d+\\.))(?=\\s+)`,end:`\\s+`,excludeEnd:!0},o={begin:/^\[[^\n]+\]:/,returnBegin:!0,contains:[{className:`symbol`,begin:/\[/,end:/\]/,excludeBegin:!0,excludeEnd:!0},{className:`link`,begin:/:\s*/,end:/$/,excludeBegin:!0}]},s={variants:[{begin:/\[.+?\]\[.*?\]/,relevance:0},{begin:/\[.+?\]\(((data|javascript|mailto):|(?:http|ftp)s?:\/\/).*?\)/,relevance:2},{begin:t.concat(/\[.+?\]\(/,/[A-Za-z][A-Za-z0-9+.-]*/,/:\/\/.*?\)/),relevance:2},{begin:/\[.+?\]\([./?&#].*?\)/,relevance:1},{begin:/\[.*?\]\(.*?\)/,relevance:0}],returnBegin:!0,contains:[{match:/\[(?=\])/},{className:`string`,relevance:0,begin:`\\[`,end:`\\]`,excludeBegin:!0,returnEnd:!0},{className:`link`,relevance:0,begin:`\\]\\(`,end:`\\)`,excludeBegin:!0,excludeEnd:!0},{className:`symbol`,relevance:0,begin:`\\]\\[`,end:`\\]`,excludeBegin:!0,excludeEnd:!0}]},c={className:`strong`,contains:[],variants:[{begin:/_{2}(?!\s)/,end:/_{2}/},{begin:/\*{2}(?!\s)/,end:/\*{2}/}]},l={className:`emphasis`,contains:[],variants:[{begin:/\*(?![*\s])/,end:/\*/},{begin:/_(?![_\s])/,end:/_/,relevance:0}]},u=e.inherit(c,{contains:[]}),d=e.inherit(l,{contains:[]});c.contains.push(d),l.contains.push(u);let f=[n,s];return[c,l,u,d].forEach(e=>{e.contains=e.contains.concat(f)}),f=f.concat(c,l),{name:`Markdown`,aliases:[`md`,`mkdown`,`mkd`],contains:[{className:`section`,variants:[{begin:`^#{1,6}`,end:`$`,contains:f},{begin:`(?=^.+?\\n[=-]{2,}$)`,contains:[{begin:`^[=-]*$`},{begin:`^`,end:`\\n`,contains:f}]}]},n,a,c,l,{className:`quote`,begin:`^>\\s+`,contains:f,end:`$`},i,r,s,o,{scope:`literal`,match:/&([a-zA-Z0-9]+|#[0-9]{1,7}|#[Xx][0-9a-fA-F]{1,6});/}]}}var IOe=s((()=>{}));function LOe(e){let t={className:`built_in`,begin:`\\b(AV|CA|CF|CG|CI|CL|CM|CN|CT|MK|MP|MTK|MTL|NS|SCN|SK|UI|WK|XC)\\w+`},n=/[a-zA-Z@][a-zA-Z0-9_]*/,r=[`int`,`float`,`char`,`unsigned`,`signed`,`short`,`long`,`double`,`wchar_t`,`unichar`,`void`,`bool`,`BOOL`,`id|0`,`_Bool`],i=`while.export.sizeof.typedef.const.struct.for.union.volatile.static.mutable.if.do.return.goto.enum.else.break.extern.asm.case.default.register.explicit.typename.switch.continue.inline.readonly.assign.readwrite.self.@synchronized.id.typeof.nonatomic.IBOutlet.IBAction.strong.weak.copy.in.out.inout.bycopy.byref.oneway.__strong.__weak.__block.__autoreleasing.@private.@protected.@public.@try.@property.@end.@throw.@catch.@finally.@autoreleasepool.@synthesize.@dynamic.@selector.@optional.@required.@encode.@package.@import.@defs.@compatibility_alias.__bridge.__bridge_transfer.__bridge_retained.__bridge_retain.__covariant.__contravariant.__kindof._Nonnull._Nullable._Null_unspecified.__FUNCTION__.__PRETTY_FUNCTION__.__attribute__.getter.setter.retain.unsafe_unretained.nonnull.nullable.null_unspecified.null_resettable.class.instancetype.NS_DESIGNATED_INITIALIZER.NS_UNAVAILABLE.NS_REQUIRES_SUPER.NS_RETURNS_INNER_POINTER.NS_INLINE.NS_AVAILABLE.NS_DEPRECATED.NS_ENUM.NS_OPTIONS.NS_SWIFT_UNAVAILABLE.NS_ASSUME_NONNULL_BEGIN.NS_ASSUME_NONNULL_END.NS_REFINED_FOR_SWIFT.NS_SWIFT_NAME.NS_SWIFT_NOTHROW.NS_DURING.NS_HANDLER.NS_ENDHANDLER.NS_VALUERETURN.NS_VOIDRETURN`.split(`.`),a=[`false`,`true`,`FALSE`,`TRUE`,`nil`,`YES`,`NO`,`NULL`],o=[`dispatch_once_t`,`dispatch_queue_t`,`dispatch_sync`,`dispatch_async`,`dispatch_once`],s={"variable.language":[`this`,`super`],$pattern:n,keyword:i,literal:a,built_in:o,type:r},c={$pattern:n,keyword:[`@interface`,`@class`,`@protocol`,`@implementation`]};return{name:`Objective-C`,aliases:[`mm`,`objc`,`obj-c`,`obj-c++`,`objective-c++`],keywords:s,illegal:`</`,contains:[t,e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE,e.C_NUMBER_MODE,e.QUOTE_STRING_MODE,e.APOS_STRING_MODE,{className:`string`,variants:[{begin:`@"`,end:`"`,illegal:`\\n`,contains:[e.BACKSLASH_ESCAPE]}]},{className:`meta`,begin:/#\s*[a-z]+\b/,end:/$/,keywords:{keyword:`if else elif endif define undef warning error line pragma ifdef ifndef include`},contains:[{begin:/\\\n/,relevance:0},e.inherit(e.QUOTE_STRING_MODE,{className:`string`}),{className:`string`,begin:/<.*?>/,end:/$/,illegal:`\\n`},e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE]},{className:`class`,begin:`(`+c.keyword.join(`|`)+`)\\b`,end:/(\{|$)/,excludeEnd:!0,keywords:c,contains:[e.UNDERSCORE_TITLE_MODE]},{begin:`\\.`+e.UNDERSCORE_IDENT_RE,relevance:0}]}}var ROe=s((()=>{}));function zOe(e){let t=e.regex,n=`abs.accept.alarm.and.atan2.bind.binmode.bless.break.caller.chdir.chmod.chomp.chop.chown.chr.chroot.class.close.closedir.connect.continue.cos.crypt.dbmclose.dbmopen.defined.delete.die.do.dump.each.else.elsif.endgrent.endhostent.endnetent.endprotoent.endpwent.endservent.eof.eval.exec.exists.exit.exp.fcntl.field.fileno.flock.for.foreach.fork.format.formline.getc.getgrent.getgrgid.getgrnam.gethostbyaddr.gethostbyname.gethostent.getlogin.getnetbyaddr.getnetbyname.getnetent.getpeername.getpgrp.getpriority.getprotobyname.getprotobynumber.getprotoent.getpwent.getpwnam.getpwuid.getservbyname.getservbyport.getservent.getsockname.getsockopt.given.glob.gmtime.goto.grep.gt.hex.if.index.int.ioctl.join.keys.kill.last.lc.lcfirst.length.link.listen.local.localtime.log.lstat.lt.ma.map.method.mkdir.msgctl.msgget.msgrcv.msgsnd.my.ne.next.no.not.oct.open.opendir.or.ord.our.pack.package.pipe.pop.pos.print.printf.prototype.push.q|0.qq.quotemeta.qw.qx.rand.read.readdir.readline.readlink.readpipe.recv.redo.ref.rename.require.reset.return.reverse.rewinddir.rindex.rmdir.say.scalar.seek.seekdir.select.semctl.semget.semop.send.setgrent.sethostent.setnetent.setpgrp.setpriority.setprotoent.setpwent.setservent.setsockopt.shift.shmctl.shmget.shmread.shmwrite.shutdown.sin.sleep.socket.socketpair.sort.splice.split.sprintf.sqrt.srand.stat.state.study.sub.substr.symlink.syscall.sysopen.sysread.sysseek.system.syswrite.tell.telldir.tie.tied.time.times.tr.truncate.uc.ucfirst.umask.undef.unless.unlink.unpack.unshift.untie.until.use.utime.values.vec.wait.waitpid.wantarray.warn.when.while.write.x|0.xor.y|0`.split(`.`),r=/[dualxmsipngr]{0,12}/,i={$pattern:/[\w.]+/,keyword:n.join(` `)},a={className:`subst`,begin:`[$@]\\{`,end:`\\}`,keywords:i},o={begin:/->\{/,end:/\}/},s={scope:`attr`,match:/\s+:\s*\w+(\s*\(.*?\))?/},c={scope:`variable`,variants:[{begin:/\$\d/},{begin:t.concat(/[$%@](?!")(\^\w\b|#\w+(::\w+)*|\{\w+\}|\w+(::\w*)*)/,`(?![A-Za-z])(?![@$%])`)},{begin:/[$%@](?!")[^\s\w{=]|\$=/,relevance:0}],contains:[s]},l={className:`number`,variants:[{match:/0?\.[0-9][0-9_]+\b/},{match:/\bv?(0|[1-9][0-9_]*(\.[0-9_]+)?|[1-9][0-9_]*)\b/},{match:/\b0[0-7][0-7_]*\b/},{match:/\b0x[0-9a-fA-F][0-9a-fA-F_]*\b/},{match:/\b0b[0-1][0-1_]*\b/}],relevance:0},u=[e.BACKSLASH_ESCAPE,a,c],d=[/!/,/\//,/\|/,/\?/,/'/,/"/,/#/],f=(e,n,i=`\\1`)=>{let a=i===`\\1`?i:t.concat(i,n);return t.concat(t.concat(`(?:`,e,`)`),n,/(?:\\.|[^\\\/])*?/,a,/(?:\\.|[^\\\/])*?/,i,r)},p=(e,n,i)=>t.concat(t.concat(`(?:`,e,`)`),n,/(?:\\.|[^\\\/])*?/,i,r),m=[c,e.HASH_COMMENT_MODE,e.COMMENT(/^=\w/,/=cut/,{endsWithParent:!0}),o,{className:`string`,contains:u,variants:[{begin:`q[qwxr]?\\s*\\(`,end:`\\)`,relevance:5},{begin:`q[qwxr]?\\s*\\[`,end:`\\]`,relevance:5},{begin:`q[qwxr]?\\s*\\{`,end:`\\}`,relevance:5},{begin:`q[qwxr]?\\s*\\|`,end:`\\|`,relevance:5},{begin:`q[qwxr]?\\s*<`,end:`>`,relevance:5},{begin:`qw\\s+q`,end:`q`,relevance:5},{begin:`'`,end:`'`,contains:[e.BACKSLASH_ESCAPE]},{begin:`"`,end:`"`},{begin:"`",end:"`",contains:[e.BACKSLASH_ESCAPE]},{begin:/\{\w+\}/,relevance:0},{begin:`-?\\w+\\s*=>`,relevance:0}]},l,{begin:`(\\/\\/|`+e.RE_STARTERS_RE+`|\\b(split|return|print|reverse|grep)\\b)\\s*`,keywords:`split return print reverse grep`,relevance:0,contains:[e.HASH_COMMENT_MODE,{className:`regexp`,variants:[{begin:f(`s|tr|y`,t.either(...d,{capture:!0}))},{begin:f(`s|tr|y`,`\\(`,`\\)`)},{begin:f(`s|tr|y`,`\\[`,`\\]`)},{begin:f(`s|tr|y`,`\\{`,`\\}`)}],relevance:2},{className:`regexp`,variants:[{begin:/(m|qr)\/\//,relevance:0},{begin:p(`(?:m|qr)?`,/\//,/\//)},{begin:p(`m|qr`,t.either(...d,{capture:!0}),/\1/)},{begin:p(`m|qr`,/\(/,/\)/)},{begin:p(`m|qr`,/\[/,/\]/)},{begin:p(`m|qr`,/\{/,/\}/)}]}]},{className:`function`,beginKeywords:`sub method`,end:`(\\s*\\(.*?\\))?[;{]`,excludeEnd:!0,relevance:5,contains:[e.TITLE_MODE,s]},{className:`class`,beginKeywords:`class`,end:`[;{]`,excludeEnd:!0,relevance:5,contains:[e.TITLE_MODE,s,l]},{begin:`-\\w\\b`,relevance:0},{begin:`^__DATA__$`,end:`^__END__$`,subLanguage:`mojolicious`,contains:[{begin:`^@@.*`,end:`$`,className:`comment`}]}];return a.contains=m,o.contains=m,{name:`Perl`,aliases:[`pl`,`pm`],keywords:i,contains:m}}var BOe=s((()=>{}));function VOe(e){let t=e.regex,n=/(?![A-Za-z0-9])(?![$])/,r=t.concat(/[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*/,n),i=t.concat(/(\\?[A-Z][a-z0-9_\x7f-\xff]+|\\?[A-Z]+(?=[A-Z][a-z0-9_\x7f-\xff])){1,}/,n),a=t.concat(/[A-Z]+/,n),o={scope:`variable`,match:`\\$+`+r},s={scope:`meta`,variants:[{begin:/<\?php/,relevance:10},{begin:/<\?=/},{begin:/<\?/,relevance:.1},{begin:/\?>/}]},c={scope:`subst`,variants:[{begin:/\$\w+/},{begin:/\{\$/,end:/\}/}]},l=e.inherit(e.APOS_STRING_MODE,{illegal:null}),u=e.inherit(e.QUOTE_STRING_MODE,{illegal:null,contains:e.QUOTE_STRING_MODE.contains.concat(c)}),d={begin:/<<<[ \t]*(?:(\w+)|"(\w+)")\n/,end:/[ \t]*(\w+)\b/,contains:e.QUOTE_STRING_MODE.contains.concat(c),"on:begin":(e,t)=>{t.data._beginMatch=e[1]||e[2]},"on:end":(e,t)=>{t.data._beginMatch!==e[1]&&t.ignoreMatch()}},f=e.END_SAME_AS_BEGIN({begin:/<<<[ \t]*'(\w+)'\n/,end:/[ \t]*(\w+)\b/}),p=`[ 	
-]`,m={scope:`string`,variants:[u,l,d,f]},h={scope:`number`,variants:[{begin:`\\b0[bB][01]+(?:_[01]+)*\\b`},{begin:`\\b0[oO][0-7]+(?:_[0-7]+)*\\b`},{begin:`\\b0[xX][\\da-fA-F]+(?:_[\\da-fA-F]+)*\\b`},{begin:`(?:\\b\\d+(?:_\\d+)*(\\.(?:\\d+(?:_\\d+)*))?|\\B\\.\\d+)(?:[eE][+-]?\\d+)?`}],relevance:0},g=[`false`,`null`,`true`],_=`__CLASS__.__DIR__.__FILE__.__FUNCTION__.__COMPILER_HALT_OFFSET__.__LINE__.__METHOD__.__NAMESPACE__.__TRAIT__.die.echo.exit.include.include_once.print.require.require_once.array.abstract.and.as.binary.bool.boolean.break.callable.case.catch.class.clone.const.continue.declare.default.do.double.else.elseif.empty.enddeclare.endfor.endforeach.endif.endswitch.endwhile.enum.eval.extends.final.finally.float.for.foreach.from.global.goto.if.implements.instanceof.insteadof.int.integer.interface.isset.iterable.list.match|0.mixed.new.never.object.or.private.protected.public.readonly.real.return.string.switch.throw.trait.try.unset.use.var.void.while.xor.yield`.split(`.`),v=`Error|0.AppendIterator.ArgumentCountError.ArithmeticError.ArrayIterator.ArrayObject.AssertionError.BadFunctionCallException.BadMethodCallException.CachingIterator.CallbackFilterIterator.CompileError.Countable.DirectoryIterator.DivisionByZeroError.DomainException.EmptyIterator.ErrorException.Exception.FilesystemIterator.FilterIterator.GlobIterator.InfiniteIterator.InvalidArgumentException.IteratorIterator.LengthException.LimitIterator.LogicException.MultipleIterator.NoRewindIterator.OutOfBoundsException.OutOfRangeException.OuterIterator.OverflowException.ParentIterator.ParseError.RangeException.RecursiveArrayIterator.RecursiveCachingIterator.RecursiveCallbackFilterIterator.RecursiveDirectoryIterator.RecursiveFilterIterator.RecursiveIterator.RecursiveIteratorIterator.RecursiveRegexIterator.RecursiveTreeIterator.RegexIterator.RuntimeException.SeekableIterator.SplDoublyLinkedList.SplFileInfo.SplFileObject.SplFixedArray.SplHeap.SplMaxHeap.SplMinHeap.SplObjectStorage.SplObserver.SplPriorityQueue.SplQueue.SplStack.SplSubject.SplTempFileObject.TypeError.UnderflowException.UnexpectedValueException.UnhandledMatchError.ArrayAccess.BackedEnum.Closure.Fiber.Generator.Iterator.IteratorAggregate.Serializable.Stringable.Throwable.Traversable.UnitEnum.WeakReference.WeakMap.Directory.__PHP_Incomplete_Class.parent.php_user_filter.self.static.stdClass`.split(`.`),y={keyword:_,literal:(e=>{let t=[];return e.forEach(e=>{t.push(e),e.toLowerCase()===e?t.push(e.toUpperCase()):t.push(e.toLowerCase())}),t})(g),built_in:v},b=e=>e.map(e=>e.replace(/\|\d+$/,``)),x={variants:[{match:[/new/,t.concat(p,`+`),t.concat(`(?!`,b(v).join(`\\b|`),`\\b)`),i],scope:{1:`keyword`,4:`title.class`}}]},S=t.concat(r,`\\b(?!\\()`),C={variants:[{match:[t.concat(/::/,t.lookahead(/(?!class\b)/)),S],scope:{2:`variable.constant`}},{match:[/::/,/class/],scope:{2:`variable.language`}},{match:[i,t.concat(/::/,t.lookahead(/(?!class\b)/)),S],scope:{1:`title.class`,3:`variable.constant`}},{match:[i,t.concat(`::`,t.lookahead(/(?!class\b)/))],scope:{1:`title.class`}},{match:[i,/::/,/class/],scope:{1:`title.class`,3:`variable.language`}}]},w={scope:`attr`,match:t.concat(r,t.lookahead(`:`),t.lookahead(/(?!::)/))},ee={relevance:0,begin:/\(/,end:/\)/,keywords:y,contains:[w,o,C,e.C_BLOCK_COMMENT_MODE,m,h,x]},te={relevance:0,match:[/\b/,t.concat(`(?!fn\\b|function\\b|`,b(_).join(`\\b|`),`|`,b(v).join(`\\b|`),`\\b)`),r,t.concat(p,`*`),t.lookahead(/(?=\()/)],scope:{3:`title.function.invoke`},contains:[ee]};ee.contains.push(te);let ne=[w,C,e.C_BLOCK_COMMENT_MODE,m,h,x],re={begin:t.concat(/#\[\s*\\?/,t.either(i,a)),beginScope:`meta`,end:/]/,endScope:`meta`,keywords:{literal:g,keyword:[`new`,`array`]},contains:[{begin:/\[/,end:/]/,keywords:{literal:g,keyword:[`new`,`array`]},contains:[`self`,...ne]},...ne,{scope:`meta`,variants:[{match:i},{match:a}]}]};return{case_insensitive:!1,keywords:y,contains:[re,e.HASH_COMMENT_MODE,e.COMMENT(`//`,`$`),e.COMMENT(`/\\*`,`\\*/`,{contains:[{scope:`doctag`,match:`@[A-Za-z]+`}]}),{match:/__halt_compiler\(\);/,keywords:`__halt_compiler`,starts:{scope:`comment`,end:e.MATCH_NOTHING_RE,contains:[{match:/\?>/,scope:`meta`,endsParent:!0}]}},s,{scope:`variable.language`,match:/\$this\b/},o,te,C,{match:[/const/,/\s/,r],scope:{1:`keyword`,3:`variable.constant`}},x,{scope:`function`,relevance:0,beginKeywords:`fn function`,end:/[;{]/,excludeEnd:!0,illegal:`[$%\\[]`,contains:[{beginKeywords:`use`},e.UNDERSCORE_TITLE_MODE,{begin:`=>`,endsParent:!0},{scope:`params`,begin:`\\(`,end:`\\)`,excludeBegin:!0,excludeEnd:!0,keywords:y,contains:[`self`,re,o,C,e.C_BLOCK_COMMENT_MODE,m,h]}]},{scope:`class`,variants:[{beginKeywords:`enum`,illegal:/[($"]/},{beginKeywords:`class interface trait`,illegal:/[:($"]/}],relevance:0,end:/\{/,excludeEnd:!0,contains:[{beginKeywords:`extends implements`},e.UNDERSCORE_TITLE_MODE]},{beginKeywords:`namespace`,relevance:0,end:`;`,illegal:/[.']/,contains:[e.inherit(e.UNDERSCORE_TITLE_MODE,{scope:`title.class`})]},{beginKeywords:`use`,relevance:0,end:`;`,contains:[{match:/\b(as|const|function)\b/,scope:`keyword`},e.UNDERSCORE_TITLE_MODE]},m,h]}}var HOe=s((()=>{}));function UOe(e){return{name:`Plain text`,aliases:[`text`,`txt`],disableAutodetect:!0}}var WOe=s((()=>{}));function GOe(e){let t=e.regex,n=/[\p{XID_Start}_]\p{XID_Continue}*/u,r=`and.as.assert.async.await.break.case.class.continue.def.del.elif.else.except.finally.for.from.global.if.import.in.is.lambda.match.nonlocal|10.not.or.pass.raise.return.try.while.with.yield`.split(`.`),i={$pattern:/[A-Za-z]\w+|__\w+__/,keyword:r,built_in:`__import__.abs.all.any.ascii.bin.bool.breakpoint.bytearray.bytes.callable.chr.classmethod.compile.complex.delattr.dict.dir.divmod.enumerate.eval.exec.filter.float.format.frozenset.getattr.globals.hasattr.hash.help.hex.id.input.int.isinstance.issubclass.iter.len.list.locals.map.max.memoryview.min.next.object.oct.open.ord.pow.print.property.range.repr.reversed.round.set.setattr.slice.sorted.staticmethod.str.sum.super.tuple.type.vars.zip`.split(`.`),literal:[`__debug__`,`Ellipsis`,`False`,`None`,`NotImplemented`,`True`],type:[`Any`,`Callable`,`Coroutine`,`Dict`,`List`,`Literal`,`Generic`,`Optional`,`Sequence`,`Set`,`Tuple`,`Type`,`Union`]},a={className:`meta`,begin:/^(>>>|\.\.\.) /},o={className:`subst`,begin:/\{/,end:/\}/,keywords:i,illegal:/#/},s={begin:/\{\{/,relevance:0},c={className:`string`,contains:[e.BACKSLASH_ESCAPE],variants:[{begin:/([uU]|[bB]|[rR]|[bB][rR]|[rR][bB])?'''/,end:/'''/,contains:[e.BACKSLASH_ESCAPE,a],relevance:10},{begin:/([uU]|[bB]|[rR]|[bB][rR]|[rR][bB])?"""/,end:/"""/,contains:[e.BACKSLASH_ESCAPE,a],relevance:10},{begin:/([fF][rR]|[rR][fF]|[fF])'''/,end:/'''/,contains:[e.BACKSLASH_ESCAPE,a,s,o]},{begin:/([fF][rR]|[rR][fF]|[fF])"""/,end:/"""/,contains:[e.BACKSLASH_ESCAPE,a,s,o]},{begin:/([uU]|[rR])'/,end:/'/,relevance:10},{begin:/([uU]|[rR])"/,end:/"/,relevance:10},{begin:/([bB]|[bB][rR]|[rR][bB])'/,end:/'/},{begin:/([bB]|[bB][rR]|[rR][bB])"/,end:/"/},{begin:/([fF][rR]|[rR][fF]|[fF])'/,end:/'/,contains:[e.BACKSLASH_ESCAPE,s,o]},{begin:/([fF][rR]|[rR][fF]|[fF])"/,end:/"/,contains:[e.BACKSLASH_ESCAPE,s,o]},e.APOS_STRING_MODE,e.QUOTE_STRING_MODE]},l=`[0-9](_?[0-9])*`,u=`(\\b(${l}))?\\.(${l})|\\b(${l})\\.`,d=`\\b|${r.join(`|`)}`,f={className:`number`,relevance:0,variants:[{begin:`(\\b(${l})|(${u}))[eE][+-]?(${l})[jJ]?(?=${d})`},{begin:`(${u})[jJ]?`},{begin:`\\b([1-9](_?[0-9])*|0+(_?0)*)[lLjJ]?(?=${d})`},{begin:`\\b0[bB](_?[01])+[lL]?(?=${d})`},{begin:`\\b0[oO](_?[0-7])+[lL]?(?=${d})`},{begin:`\\b0[xX](_?[0-9a-fA-F])+[lL]?(?=${d})`},{begin:`\\b(${l})[jJ](?=${d})`}]},p={className:`comment`,begin:t.lookahead(/# type:/),end:/$/,keywords:i,contains:[{begin:/# type:/},{begin:/#/,end:/\b\B/,endsWithParent:!0}]},m={className:`params`,variants:[{className:``,begin:/\(\s*\)/,skip:!0},{begin:/\(/,end:/\)/,excludeBegin:!0,excludeEnd:!0,keywords:i,contains:[`self`,a,f,c,e.HASH_COMMENT_MODE]}]};return o.contains=[c,f,a],{name:`Python`,aliases:[`py`,`gyp`,`ipython`],unicodeRegex:!0,keywords:i,illegal:/(<\/|\?)|=>/,contains:[a,f,{scope:`variable.language`,match:/\bself\b/},{beginKeywords:`if`,relevance:0},{match:/\bor\b/,scope:`keyword`},c,p,e.HASH_COMMENT_MODE,{match:[/\bdef/,/\s+/,n],scope:{1:`keyword`,3:`title.function`},contains:[m]},{variants:[{match:[/\bclass/,/\s+/,n,/\s*/,/\(\s*/,n,/\s*\)/]},{match:[/\bclass/,/\s+/,n]}],scope:{1:`keyword`,3:`title.class`,6:`title.class.inherited`}},{className:`meta`,begin:/^[\t ]*@/,end:/(?=#)|$/,contains:[f,m,c]}]}}var KOe=s((()=>{}));function qOe(e){let t=e.regex,n=/(?:(?:[a-zA-Z]|\.[._a-zA-Z])[._a-zA-Z0-9]*)|\.(?!\d)/,r=t.either(/0[xX][0-9a-fA-F]+\.[0-9a-fA-F]*[pP][+-]?\d+i?/,/0[xX][0-9a-fA-F]+(?:[pP][+-]?\d+)?[Li]?/,/(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?[Li]?/),i=/[=!<>:]=|\|\||&&|:::?|<-|<<-|->>|->|\|>|[-+*\/?!$&|:<=>@^~]|\*\*/,a=t.either(/[()]/,/[{}]/,/\[\[/,/[[\]]/,/\\/,/,/);return{name:`R`,keywords:{$pattern:n,keyword:`function if in break next repeat else for while`,literal:`NULL NA TRUE FALSE Inf NaN NA_integer_|10 NA_real_|10 NA_character_|10 NA_complex_|10`,built_in:`LETTERS letters month.abb month.name pi T F abs acos acosh all any anyNA Arg as.call as.character as.complex as.double as.environment as.integer as.logical as.null.default as.numeric as.raw asin asinh atan atanh attr attributes baseenv browser c call ceiling class Conj cos cosh cospi cummax cummin cumprod cumsum digamma dim dimnames emptyenv exp expression floor forceAndCall gamma gc.time globalenv Im interactive invisible is.array is.atomic is.call is.character is.complex is.double is.environment is.expression is.finite is.function is.infinite is.integer is.language is.list is.logical is.matrix is.na is.name is.nan is.null is.numeric is.object is.pairlist is.raw is.recursive is.single is.symbol lazyLoadDBfetch length lgamma list log max min missing Mod names nargs nzchar oldClass on.exit pos.to.env proc.time prod quote range Re rep retracemem return round seq_along seq_len seq.int sign signif sin sinh sinpi sqrt standardGeneric substitute sum switch tan tanh tanpi tracemem trigamma trunc unclass untracemem UseMethod xtfrm`},contains:[e.COMMENT(/#'/,/$/,{contains:[{scope:`doctag`,match:/@examples/,starts:{end:t.lookahead(t.either(/\n^#'\s*(?=@[a-zA-Z]+)/,/\n^(?!#')/)),endsParent:!0}},{scope:`doctag`,begin:`@param`,end:/$/,contains:[{scope:`variable`,variants:[{match:n},{match:/`(?:\\.|[^`\\])+`/}],endsParent:!0}]},{scope:`doctag`,match:/@[a-zA-Z]+/},{scope:`keyword`,match:/\\[a-zA-Z]+/}]}),e.HASH_COMMENT_MODE,{scope:`string`,contains:[e.BACKSLASH_ESCAPE],variants:[e.END_SAME_AS_BEGIN({begin:/[rR]"(-*)\(/,end:/\)(-*)"/}),e.END_SAME_AS_BEGIN({begin:/[rR]"(-*)\{/,end:/\}(-*)"/}),e.END_SAME_AS_BEGIN({begin:/[rR]"(-*)\[/,end:/\](-*)"/}),e.END_SAME_AS_BEGIN({begin:/[rR]'(-*)\(/,end:/\)(-*)'/}),e.END_SAME_AS_BEGIN({begin:/[rR]'(-*)\{/,end:/\}(-*)'/}),e.END_SAME_AS_BEGIN({begin:/[rR]'(-*)\[/,end:/\](-*)'/}),{begin:`"`,end:`"`,relevance:0},{begin:`'`,end:`'`,relevance:0}]},{relevance:0,variants:[{scope:{1:`operator`,2:`number`},match:[i,r]},{scope:{1:`operator`,2:`number`},match:[/%[^%]*%/,r]},{scope:{1:`punctuation`,2:`number`},match:[a,r]},{scope:{2:`number`},match:[/[^a-zA-Z0-9._]|^/,r]}]},{scope:{3:`operator`},match:[n,/\s+/,/<-/,/\s+/]},{scope:`operator`,relevance:0,variants:[{match:i},{match:/%[^%]*%/}]},{scope:`punctuation`,relevance:0,match:a},{begin:"`",end:"`",contains:[{begin:/\\./}]}]}}var JOe=s((()=>{}));function YOe(e){let t=e.regex,n="([a-zA-Z_]\\w*[!?=]?|[-+~]@|<<|>>|=~|===?|<=>|[<>]=?|\\*\\*|[-/+%^&*~`|]|\\[\\]=?)",r=t.either(/\b([A-Z]+[a-z0-9]+)+/,/\b([A-Z]+[a-z0-9]+)+[A-Z]+/),i=t.concat(r,/(::\w+)*/),a=[`include`,`extend`,`prepend`,`public`,`private`,`protected`,`raise`,`throw`],o={"variable.constant":[`__FILE__`,`__LINE__`,`__ENCODING__`],"variable.language":[`self`,`super`],keyword:[`alias`,`and`,`begin`,`BEGIN`,`break`,`case`,`class`,`defined`,`do`,`else`,`elsif`,`end`,`END`,`ensure`,`for`,`if`,`in`,`module`,`next`,`not`,`or`,`redo`,`require`,`rescue`,`retry`,`return`,`then`,`undef`,`unless`,`until`,`when`,`while`,`yield`,...a],built_in:[`proc`,`lambda`,`attr_accessor`,`attr_reader`,`attr_writer`,`define_method`,`private_constant`,`module_function`],literal:[`true`,`false`,`nil`]},s={className:`doctag`,begin:`@[A-Za-z]+`},c={begin:`#<`,end:`>`},l=[e.COMMENT(`#`,`$`,{contains:[s]}),e.COMMENT(`^=begin`,`^=end`,{contains:[s],relevance:10}),e.COMMENT(`^__END__`,e.MATCH_NOTHING_RE)],u={className:`subst`,begin:/#\{/,end:/\}/,keywords:o},d={className:`string`,contains:[e.BACKSLASH_ESCAPE,u],variants:[{begin:/'/,end:/'/},{begin:/"/,end:/"/},{begin:/`/,end:/`/},{begin:/%[qQwWx]?\(/,end:/\)/},{begin:/%[qQwWx]?\[/,end:/\]/},{begin:/%[qQwWx]?\{/,end:/\}/},{begin:/%[qQwWx]?</,end:/>/},{begin:/%[qQwWx]?\//,end:/\//},{begin:/%[qQwWx]?%/,end:/%/},{begin:/%[qQwWx]?-/,end:/-/},{begin:/%[qQwWx]?\|/,end:/\|/},{begin:/\B\?(\\\d{1,3})/},{begin:/\B\?(\\x[A-Fa-f0-9]{1,2})/},{begin:/\B\?(\\u\{?[A-Fa-f0-9]{1,6}\}?)/},{begin:/\B\?(\\M-\\C-|\\M-\\c|\\c\\M-|\\M-|\\C-\\M-)[\x20-\x7e]/},{begin:/\B\?\\(c|C-)[\x20-\x7e]/},{begin:/\B\?\\?\S/},{begin:t.concat(/<<[-~]?'?/,t.lookahead(/(\w+)(?=\W)[^\n]*\n(?:[^\n]*\n)*?\s*\1\b/)),contains:[e.END_SAME_AS_BEGIN({begin:/(\w+)/,end:/(\w+)/,contains:[e.BACKSLASH_ESCAPE,u]})]}]},f=`[0-9](_?[0-9])*`,p={className:`number`,relevance:0,variants:[{begin:`\\b([1-9](_?[0-9])*|0)(\\.(${f}))?([eE][+-]?(${f})|r)?i?\\b`},{begin:`\\b0[dD][0-9](_?[0-9])*r?i?\\b`},{begin:`\\b0[bB][0-1](_?[0-1])*r?i?\\b`},{begin:`\\b0[oO][0-7](_?[0-7])*r?i?\\b`},{begin:`\\b0[xX][0-9a-fA-F](_?[0-9a-fA-F])*r?i?\\b`},{begin:`\\b0(_?[0-7])+r?i?\\b`}]},m={variants:[{match:/\(\)/},{className:`params`,begin:/\(/,end:/(?=\))/,excludeBegin:!0,endsParent:!0,keywords:o}]},h={match:[/(include|extend)\s+/,i],scope:{2:`title.class`},keywords:o},g={variants:[{match:[/class\s+/,i,/\s+<\s+/,i]},{match:[/\b(class|module)\s+/,i]}],scope:{2:`title.class`,4:`title.class.inherited`},keywords:o},_={relevance:0,match:/\b[A-Z][A-Z_0-9]+\b/,className:`variable.constant`},v={match:[/def/,/\s+/,n],scope:{1:`keyword`,3:`title.function`},contains:[m]},y=[d,g,h,{relevance:0,match:[i,/\.new[. (]/],scope:{1:`title.class`}},_,{relevance:0,match:r,scope:`title.class`},v,{begin:e.IDENT_RE+`::`},{className:`symbol`,begin:e.UNDERSCORE_IDENT_RE+`(!|\\?)?:`,relevance:0},{className:`symbol`,begin:`:(?!\\s)`,contains:[d,{begin:n}],relevance:0},p,{className:`variable`,begin:`(\\$\\W)|((\\$|@@?)(\\w+))(?=[^@$?])(?![A-Za-z])(?![@$?'])`},{className:`params`,begin:/\|(?!=)/,end:/\|/,excludeBegin:!0,excludeEnd:!0,relevance:0,keywords:o},{begin:`(`+e.RE_STARTERS_RE+`|unless)\\s*`,keywords:`unless`,contains:[{className:`regexp`,contains:[e.BACKSLASH_ESCAPE,u],illegal:/\n/,variants:[{begin:`/`,end:`/[a-z]*`},{begin:/%r\{/,end:/\}[a-z]*/},{begin:`%r\\(`,end:`\\)[a-z]*`},{begin:`%r!`,end:`![a-z]*`},{begin:`%r\\[`,end:`\\][a-z]*`}]}].concat(c,l),relevance:0}].concat(c,l);u.contains=y,m.contains=y;let b=[{begin:/^\s*=>/,starts:{end:`$`,contains:y}},{className:`meta.prompt`,begin:`^([>?]>|[\\w#]+\\(\\w+\\):\\d+:\\d+[>*]|(\\w+-)?\\d+\\.\\d+\\.\\d+(p\\d+)?[^\\d][^>]+>)(?=[ ])`,starts:{end:`$`,keywords:o,contains:y}}];return l.unshift(c),{name:`Ruby`,aliases:[`rb`,`gemspec`,`podspec`,`thor`,`irb`],keywords:o,illegal:/\/\*/,contains:[e.SHEBANG({binary:`ruby`})].concat(b,l,y)}}var XOe=s((()=>{}));function ZOe(e){let t=e.regex,n=/(r#)?/,r=t.concat(n,e.UNDERSCORE_IDENT_RE),i=t.concat(n,e.IDENT_RE),a={className:`title.function.invoke`,relevance:0,begin:t.concat(/\b/,/(?!let|for|while|if|else|match\b)/,i,t.lookahead(/\s*\(/))},o=`([ui](8|16|32|64|128|size)|f(32|64))?`,s=`abstract.as.async.await.become.box.break.const.continue.crate.do.dyn.else.enum.extern.false.final.fn.for.if.impl.in.let.loop.macro.match.mod.move.mut.override.priv.pub.ref.return.self.Self.static.struct.super.trait.true.try.type.typeof.union.unsafe.unsized.use.virtual.where.while.yield`.split(`.`),c=[`true`,`false`,`Some`,`None`,`Ok`,`Err`],l=`drop .Copy.Send.Sized.Sync.Drop.Fn.FnMut.FnOnce.ToOwned.Clone.Debug.PartialEq.PartialOrd.Eq.Ord.AsRef.AsMut.Into.From.Default.Iterator.Extend.IntoIterator.DoubleEndedIterator.ExactSizeIterator.SliceConcatExt.ToString.assert!.assert_eq!.bitflags!.bytes!.cfg!.col!.concat!.concat_idents!.debug_assert!.debug_assert_eq!.env!.eprintln!.panic!.file!.format!.format_args!.include_bytes!.include_str!.line!.local_data_key!.module_path!.option_env!.print!.println!.select!.stringify!.try!.unimplemented!.unreachable!.vec!.write!.writeln!.macro_rules!.assert_ne!.debug_assert_ne!`.split(`.`),u=[`i8`,`i16`,`i32`,`i64`,`i128`,`isize`,`u8`,`u16`,`u32`,`u64`,`u128`,`usize`,`f32`,`f64`,`str`,`char`,`bool`,`Box`,`Option`,`Result`,`String`,`Vec`];return{name:`Rust`,aliases:[`rs`],keywords:{$pattern:e.IDENT_RE+`!?`,type:u,keyword:s,literal:c,built_in:l},illegal:`</`,contains:[e.C_LINE_COMMENT_MODE,e.COMMENT(`/\\*`,`\\*/`,{contains:[`self`]}),e.inherit(e.QUOTE_STRING_MODE,{begin:/b?"/,illegal:null}),{className:`symbol`,begin:/'[a-zA-Z_][a-zA-Z0-9_]*(?!')/},{scope:`string`,variants:[{begin:/b?r(#*)"(.|\n)*?"\1(?!#)/},{begin:/b?'/,end:/'/,contains:[{scope:`char.escape`,match:/\\('|\w|x\w{2}|u\w{4}|U\w{8})/}]}]},{className:`number`,variants:[{begin:`\\b0b([01_]+)`+o},{begin:`\\b0o([0-7_]+)`+o},{begin:`\\b0x([A-Fa-f0-9_]+)`+o},{begin:`\\b(\\d[\\d_]*(\\.[0-9_]+)?([eE][+-]?[0-9_]+)?)`+o}],relevance:0},{begin:[/fn/,/\s+/,r],className:{1:`keyword`,3:`title.function`}},{className:`meta`,begin:`#!?\\[`,end:`\\]`,contains:[{className:`string`,begin:/"/,end:/"/,contains:[e.BACKSLASH_ESCAPE]}]},{begin:[/let/,/\s+/,/(?:mut\s+)?/,r],className:{1:`keyword`,3:`keyword`,4:`variable`}},{begin:[/for/,/\s+/,r,/\s+/,/in/],className:{1:`keyword`,3:`variable`,5:`keyword`}},{begin:[/type/,/\s+/,r],className:{1:`keyword`,3:`title.class`}},{begin:[/(?:trait|enum|struct|union|impl|for)/,/\s+/,r],className:{1:`keyword`,3:`title.class`}},{begin:e.IDENT_RE+`::`,keywords:{keyword:`Self`,built_in:l,type:u}},{className:`punctuation`,begin:`->`},a]}}var QOe=s((()=>{}));function $Oe(e){let t=eke(e),n=oke,r=ake,i=`@[a-z-]+`,a={className:`variable`,begin:`(\\$[a-zA-Z-][a-zA-Z0-9_-]*)\\b`,relevance:0};return{name:`SCSS`,case_insensitive:!0,illegal:`[=/|']`,contains:[e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE,t.CSS_NUMBER_MODE,{className:`selector-id`,begin:`#[A-Za-z0-9_-]+`,relevance:0},{className:`selector-class`,begin:`\\.[A-Za-z0-9_-]+`,relevance:0},t.ATTRIBUTE_SELECTOR_MODE,{className:`selector-tag`,begin:`\\b(`+rke.join(`|`)+`)\\b`,relevance:0},{className:`selector-pseudo`,begin:`:(`+r.join(`|`)+`)`},{className:`selector-pseudo`,begin:`:(:)?(`+n.join(`|`)+`)`},a,{begin:/\(/,end:/\)/,contains:[t.CSS_NUMBER_MODE]},t.CSS_VARIABLE,{className:`attribute`,begin:`\\b(`+ske.join(`|`)+`)\\b`},{begin:`\\b(whitespace|wait|w-resize|visible|vertical-text|vertical-ideographic|uppercase|upper-roman|upper-alpha|underline|transparent|top|thin|thick|text|text-top|text-bottom|tb-rl|table-header-group|table-footer-group|sw-resize|super|strict|static|square|solid|small-caps|separate|se-resize|scroll|s-resize|rtl|row-resize|ridge|right|repeat|repeat-y|repeat-x|relative|progress|pointer|overline|outside|outset|oblique|nowrap|not-allowed|normal|none|nw-resize|no-repeat|no-drop|newspaper|ne-resize|n-resize|move|middle|medium|ltr|lr-tb|lowercase|lower-roman|lower-alpha|loose|list-item|line|line-through|line-edge|lighter|left|keep-all|justify|italic|inter-word|inter-ideograph|inside|inset|inline|inline-block|inherit|inactive|ideograph-space|ideograph-parenthesis|ideograph-numeric|ideograph-alpha|horizontal|hidden|help|hand|groove|fixed|ellipsis|e-resize|double|dotted|distribute|distribute-space|distribute-letter|distribute-all-lines|disc|disabled|default|decimal|dashed|crosshair|collapse|col-resize|circle|char|center|capitalize|break-word|break-all|bottom|both|bolder|bold|block|bidi-override|below|baseline|auto|always|all-scroll|absolute|table|table-cell)\\b`},{begin:/:/,end:/[;}{]/,relevance:0,contains:[t.BLOCK_COMMENT,a,t.HEXCOLOR,t.CSS_NUMBER_MODE,e.QUOTE_STRING_MODE,e.APOS_STRING_MODE,t.IMPORTANT,t.FUNCTION_DISPATCH]},{begin:`@(page|font-face)`,keywords:{$pattern:i,keyword:`@page @font-face`}},{begin:`@`,end:`[{;]`,returnBegin:!0,keywords:{$pattern:/[a-z-]+/,keyword:`and or not only`,attribute:ike.join(` `)},contains:[{begin:i,className:`keyword`},{begin:/[a-z-]+(?=:)/,className:`attribute`},a,e.QUOTE_STRING_MODE,e.APOS_STRING_MODE,t.HEXCOLOR,t.CSS_NUMBER_MODE]},t.FUNCTION_DISPATCH]}}var eke,tke,nke,rke,ike,ake,oke,ske,cke=s((()=>{eke=e=>({IMPORTANT:{scope:`meta`,begin:`!important`},BLOCK_COMMENT:e.C_BLOCK_COMMENT_MODE,HEXCOLOR:{scope:`number`,begin:/#(([0-9a-fA-F]{3,4})|(([0-9a-fA-F]{2}){3,4}))\b/},FUNCTION_DISPATCH:{className:`built_in`,begin:/[\w-]+(?=\()/},ATTRIBUTE_SELECTOR_MODE:{scope:`selector-attr`,begin:/\[/,end:/\]/,illegal:`$`,contains:[e.APOS_STRING_MODE,e.QUOTE_STRING_MODE]},CSS_NUMBER_MODE:{scope:`number`,begin:e.NUMBER_RE+`(%|em|ex|ch|rem|vw|vh|vmin|vmax|cm|mm|in|pt|pc|px|deg|grad|rad|turn|s|ms|Hz|kHz|dpi|dpcm|dppx)?`,relevance:0},CSS_VARIABLE:{className:`attr`,begin:/--[A-Za-z_][A-Za-z0-9_-]*/}}),tke=`a.abbr.address.article.aside.audio.b.blockquote.body.button.canvas.caption.cite.code.dd.del.details.dfn.div.dl.dt.em.fieldset.figcaption.figure.footer.form.h1.h2.h3.h4.h5.h6.header.hgroup.html.i.iframe.img.input.ins.kbd.label.legend.li.main.mark.menu.nav.object.ol.optgroup.option.p.picture.q.quote.samp.section.select.source.span.strong.summary.sup.table.tbody.td.textarea.tfoot.th.thead.time.tr.ul.var.video`.split(`.`),nke=`defs.g.marker.mask.pattern.svg.switch.symbol.feBlend.feColorMatrix.feComponentTransfer.feComposite.feConvolveMatrix.feDiffuseLighting.feDisplacementMap.feFlood.feGaussianBlur.feImage.feMerge.feMorphology.feOffset.feSpecularLighting.feTile.feTurbulence.linearGradient.radialGradient.stop.circle.ellipse.image.line.path.polygon.polyline.rect.text.use.textPath.tspan.foreignObject.clipPath`.split(`.`),rke=[...tke,...nke],ike=`any-hover.any-pointer.aspect-ratio.color.color-gamut.color-index.device-aspect-ratio.device-height.device-width.display-mode.forced-colors.grid.height.hover.inverted-colors.monochrome.orientation.overflow-block.overflow-inline.pointer.prefers-color-scheme.prefers-contrast.prefers-reduced-motion.prefers-reduced-transparency.resolution.scan.scripting.update.width.min-width.max-width.min-height.max-height`.split(`.`).sort().reverse(),ake=`active.any-link.blank.checked.current.default.defined.dir.disabled.drop.empty.enabled.first.first-child.first-of-type.fullscreen.future.focus.focus-visible.focus-within.has.host.host-context.hover.indeterminate.in-range.invalid.is.lang.last-child.last-of-type.left.link.local-link.not.nth-child.nth-col.nth-last-child.nth-last-col.nth-last-of-type.nth-of-type.only-child.only-of-type.optional.out-of-range.past.placeholder-shown.read-only.read-write.required.right.root.scope.target.target-within.user-invalid.valid.visited.where`.split(`.`).sort().reverse(),oke=[`after`,`backdrop`,`before`,`cue`,`cue-region`,`first-letter`,`first-line`,`grammar-error`,`marker`,`part`,`placeholder`,`selection`,`slotted`,`spelling-error`].sort().reverse(),ske=`accent-color.align-content.align-items.align-self.alignment-baseline.all.anchor-name.animation.animation-composition.animation-delay.animation-direction.animation-duration.animation-fill-mode.animation-iteration-count.animation-name.animation-play-state.animation-range.animation-range-end.animation-range-start.animation-timeline.animation-timing-function.appearance.aspect-ratio.backdrop-filter.backface-visibility.background.background-attachment.background-blend-mode.background-clip.background-color.background-image.background-origin.background-position.background-position-x.background-position-y.background-repeat.background-size.baseline-shift.block-size.border.border-block.border-block-color.border-block-end.border-block-end-color.border-block-end-style.border-block-end-width.border-block-start.border-block-start-color.border-block-start-style.border-block-start-width.border-block-style.border-block-width.border-bottom.border-bottom-color.border-bottom-left-radius.border-bottom-right-radius.border-bottom-style.border-bottom-width.border-collapse.border-color.border-end-end-radius.border-end-start-radius.border-image.border-image-outset.border-image-repeat.border-image-slice.border-image-source.border-image-width.border-inline.border-inline-color.border-inline-end.border-inline-end-color.border-inline-end-style.border-inline-end-width.border-inline-start.border-inline-start-color.border-inline-start-style.border-inline-start-width.border-inline-style.border-inline-width.border-left.border-left-color.border-left-style.border-left-width.border-radius.border-right.border-right-color.border-right-style.border-right-width.border-spacing.border-start-end-radius.border-start-start-radius.border-style.border-top.border-top-color.border-top-left-radius.border-top-right-radius.border-top-style.border-top-width.border-width.bottom.box-align.box-decoration-break.box-direction.box-flex.box-flex-group.box-lines.box-ordinal-group.box-orient.box-pack.box-shadow.box-sizing.break-after.break-before.break-inside.caption-side.caret-color.clear.clip.clip-path.clip-rule.color.color-interpolation.color-interpolation-filters.color-profile.color-rendering.color-scheme.column-count.column-fill.column-gap.column-rule.column-rule-color.column-rule-style.column-rule-width.column-span.column-width.columns.contain.contain-intrinsic-block-size.contain-intrinsic-height.contain-intrinsic-inline-size.contain-intrinsic-size.contain-intrinsic-width.container.container-name.container-type.content.content-visibility.counter-increment.counter-reset.counter-set.cue.cue-after.cue-before.cursor.cx.cy.direction.display.dominant-baseline.empty-cells.enable-background.field-sizing.fill.fill-opacity.fill-rule.filter.flex.flex-basis.flex-direction.flex-flow.flex-grow.flex-shrink.flex-wrap.float.flood-color.flood-opacity.flow.font.font-display.font-family.font-feature-settings.font-kerning.font-language-override.font-optical-sizing.font-palette.font-size.font-size-adjust.font-smooth.font-smoothing.font-stretch.font-style.font-synthesis.font-synthesis-position.font-synthesis-small-caps.font-synthesis-style.font-synthesis-weight.font-variant.font-variant-alternates.font-variant-caps.font-variant-east-asian.font-variant-emoji.font-variant-ligatures.font-variant-numeric.font-variant-position.font-variation-settings.font-weight.forced-color-adjust.gap.glyph-orientation-horizontal.glyph-orientation-vertical.grid.grid-area.grid-auto-columns.grid-auto-flow.grid-auto-rows.grid-column.grid-column-end.grid-column-start.grid-gap.grid-row.grid-row-end.grid-row-start.grid-template.grid-template-areas.grid-template-columns.grid-template-rows.hanging-punctuation.height.hyphenate-character.hyphenate-limit-chars.hyphens.icon.image-orientation.image-rendering.image-resolution.ime-mode.initial-letter.initial-letter-align.inline-size.inset.inset-area.inset-block.inset-block-end.inset-block-start.inset-inline.inset-inline-end.inset-inline-start.isolation.justify-content.justify-items.justify-self.kerning.left.letter-spacing.lighting-color.line-break.line-height.line-height-step.list-style.list-style-image.list-style-position.list-style-type.margin.margin-block.margin-block-end.margin-block-start.margin-bottom.margin-inline.margin-inline-end.margin-inline-start.margin-left.margin-right.margin-top.margin-trim.marker.marker-end.marker-mid.marker-start.marks.mask.mask-border.mask-border-mode.mask-border-outset.mask-border-repeat.mask-border-slice.mask-border-source.mask-border-width.mask-clip.mask-composite.mask-image.mask-mode.mask-origin.mask-position.mask-repeat.mask-size.mask-type.masonry-auto-flow.math-depth.math-shift.math-style.max-block-size.max-height.max-inline-size.max-width.min-block-size.min-height.min-inline-size.min-width.mix-blend-mode.nav-down.nav-index.nav-left.nav-right.nav-up.none.normal.object-fit.object-position.offset.offset-anchor.offset-distance.offset-path.offset-position.offset-rotate.opacity.order.orphans.outline.outline-color.outline-offset.outline-style.outline-width.overflow.overflow-anchor.overflow-block.overflow-clip-margin.overflow-inline.overflow-wrap.overflow-x.overflow-y.overlay.overscroll-behavior.overscroll-behavior-block.overscroll-behavior-inline.overscroll-behavior-x.overscroll-behavior-y.padding.padding-block.padding-block-end.padding-block-start.padding-bottom.padding-inline.padding-inline-end.padding-inline-start.padding-left.padding-right.padding-top.page.page-break-after.page-break-before.page-break-inside.paint-order.pause.pause-after.pause-before.perspective.perspective-origin.place-content.place-items.place-self.pointer-events.position.position-anchor.position-visibility.print-color-adjust.quotes.r.resize.rest.rest-after.rest-before.right.rotate.row-gap.ruby-align.ruby-position.scale.scroll-behavior.scroll-margin.scroll-margin-block.scroll-margin-block-end.scroll-margin-block-start.scroll-margin-bottom.scroll-margin-inline.scroll-margin-inline-end.scroll-margin-inline-start.scroll-margin-left.scroll-margin-right.scroll-margin-top.scroll-padding.scroll-padding-block.scroll-padding-block-end.scroll-padding-block-start.scroll-padding-bottom.scroll-padding-inline.scroll-padding-inline-end.scroll-padding-inline-start.scroll-padding-left.scroll-padding-right.scroll-padding-top.scroll-snap-align.scroll-snap-stop.scroll-snap-type.scroll-timeline.scroll-timeline-axis.scroll-timeline-name.scrollbar-color.scrollbar-gutter.scrollbar-width.shape-image-threshold.shape-margin.shape-outside.shape-rendering.speak.speak-as.src.stop-color.stop-opacity.stroke.stroke-dasharray.stroke-dashoffset.stroke-linecap.stroke-linejoin.stroke-miterlimit.stroke-opacity.stroke-width.tab-size.table-layout.text-align.text-align-all.text-align-last.text-anchor.text-combine-upright.text-decoration.text-decoration-color.text-decoration-line.text-decoration-skip.text-decoration-skip-ink.text-decoration-style.text-decoration-thickness.text-emphasis.text-emphasis-color.text-emphasis-position.text-emphasis-style.text-indent.text-justify.text-orientation.text-overflow.text-rendering.text-shadow.text-size-adjust.text-transform.text-underline-offset.text-underline-position.text-wrap.text-wrap-mode.text-wrap-style.timeline-scope.top.touch-action.transform.transform-box.transform-origin.transform-style.transition.transition-behavior.transition-delay.transition-duration.transition-property.transition-timing-function.translate.unicode-bidi.user-modify.user-select.vector-effect.vertical-align.view-timeline.view-timeline-axis.view-timeline-inset.view-timeline-name.view-transition-name.visibility.voice-balance.voice-duration.voice-family.voice-pitch.voice-range.voice-rate.voice-stress.voice-volume.white-space.white-space-collapse.widows.width.will-change.word-break.word-spacing.word-wrap.writing-mode.x.y.z-index.zoom`.split(`.`).sort().reverse()}));function lke(e){return{name:`Shell Session`,aliases:[`console`,`shellsession`],contains:[{className:`meta.prompt`,begin:/^\s{0,3}[/~\w\d[\]()@-]*[>%$#][ ]?/,starts:{end:/[^\\](?=\s*$)/,subLanguage:`bash`}}]}}var uke=s((()=>{}));function dke(e){let t=e.regex,n=e.COMMENT(`--`,`$`),r={scope:`string`,variants:[{begin:/'/,end:/'/,contains:[{match:/''/}]}]},i={begin:/"/,end:/"/,contains:[{match:/""/}]},a=[`true`,`false`,`unknown`],o=[`double precision`,`large object`,`with timezone`,`without timezone`],s=`bigint.binary.blob.boolean.char.character.clob.date.dec.decfloat.decimal.float.int.integer.interval.nchar.nclob.national.numeric.real.row.smallint.time.timestamp.varchar.varying.varbinary`.split(`.`),c=[`add`,`asc`,`collation`,`desc`,`final`,`first`,`last`,`view`],l=`abs.acos.all.allocate.alter.and.any.are.array.array_agg.array_max_cardinality.as.asensitive.asin.asymmetric.at.atan.atomic.authorization.avg.begin.begin_frame.begin_partition.between.bigint.binary.blob.boolean.both.by.call.called.cardinality.cascaded.case.cast.ceil.ceiling.char.char_length.character.character_length.check.classifier.clob.close.coalesce.collate.collect.column.commit.condition.connect.constraint.contains.convert.copy.corr.corresponding.cos.cosh.count.covar_pop.covar_samp.create.cross.cube.cume_dist.current.current_catalog.current_date.current_default_transform_group.current_path.current_role.current_row.current_schema.current_time.current_timestamp.current_path.current_role.current_transform_group_for_type.current_user.cursor.cycle.date.day.deallocate.dec.decimal.decfloat.declare.default.define.delete.dense_rank.deref.describe.deterministic.disconnect.distinct.double.drop.dynamic.each.element.else.empty.end.end_frame.end_partition.end-exec.equals.escape.every.except.exec.execute.exists.exp.external.extract.false.fetch.filter.first_value.float.floor.for.foreign.frame_row.free.from.full.function.fusion.get.global.grant.group.grouping.groups.having.hold.hour.identity.in.indicator.initial.inner.inout.insensitive.insert.int.integer.intersect.intersection.interval.into.is.join.json_array.json_arrayagg.json_exists.json_object.json_objectagg.json_query.json_table.json_table_primitive.json_value.lag.language.large.last_value.lateral.lead.leading.left.like.like_regex.listagg.ln.local.localtime.localtimestamp.log.log10.lower.match.match_number.match_recognize.matches.max.member.merge.method.min.minute.mod.modifies.module.month.multiset.national.natural.nchar.nclob.new.no.none.normalize.not.nth_value.ntile.null.nullif.numeric.octet_length.occurrences_regex.of.offset.old.omit.on.one.only.open.or.order.out.outer.over.overlaps.overlay.parameter.partition.pattern.per.percent.percent_rank.percentile_cont.percentile_disc.period.portion.position.position_regex.power.precedes.precision.prepare.primary.procedure.ptf.range.rank.reads.real.recursive.ref.references.referencing.regr_avgx.regr_avgy.regr_count.regr_intercept.regr_r2.regr_slope.regr_sxx.regr_sxy.regr_syy.release.result.return.returns.revoke.right.rollback.rollup.row.row_number.rows.running.savepoint.scope.scroll.search.second.seek.select.sensitive.session_user.set.show.similar.sin.sinh.skip.smallint.some.specific.specifictype.sql.sqlexception.sqlstate.sqlwarning.sqrt.start.static.stddev_pop.stddev_samp.submultiset.subset.substring.substring_regex.succeeds.sum.symmetric.system.system_time.system_user.table.tablesample.tan.tanh.then.time.timestamp.timezone_hour.timezone_minute.to.trailing.translate.translate_regex.translation.treat.trigger.trim.trim_array.true.truncate.uescape.union.unique.unknown.unnest.update.upper.user.using.value.values.value_of.var_pop.var_samp.varbinary.varchar.varying.versioning.when.whenever.where.width_bucket.window.with.within.without.year`.split(`.`),u=`abs.acos.array_agg.asin.atan.avg.cast.ceil.ceiling.coalesce.corr.cos.cosh.count.covar_pop.covar_samp.cume_dist.dense_rank.deref.element.exp.extract.first_value.floor.json_array.json_arrayagg.json_exists.json_object.json_objectagg.json_query.json_table.json_table_primitive.json_value.lag.last_value.lead.listagg.ln.log.log10.lower.max.min.mod.nth_value.ntile.nullif.percent_rank.percentile_cont.percentile_disc.position.position_regex.power.rank.regr_avgx.regr_avgy.regr_count.regr_intercept.regr_r2.regr_slope.regr_sxx.regr_sxy.regr_syy.row_number.sin.sinh.sqrt.stddev_pop.stddev_samp.substring.substring_regex.sum.tan.tanh.translate.translate_regex.treat.trim.trim_array.unnest.upper.value_of.var_pop.var_samp.width_bucket`.split(`.`),d=[`current_catalog`,`current_date`,`current_default_transform_group`,`current_path`,`current_role`,`current_schema`,`current_transform_group_for_type`,`current_user`,`session_user`,`system_time`,`system_user`,`current_time`,`localtime`,`current_timestamp`,`localtimestamp`],f=[`create table`,`insert into`,`primary key`,`foreign key`,`not null`,`alter table`,`add constraint`,`grouping sets`,`on overflow`,`character set`,`respect nulls`,`ignore nulls`,`nulls first`,`nulls last`,`depth first`,`breadth first`],p=u,m=[...l,...c].filter(e=>!u.includes(e)),h={scope:`variable`,match:/@[a-z0-9][a-z0-9_]*/},g={scope:`operator`,match:/[-+*/=%^~]|&&?|\|\|?|!=?|<(?:=>?|<|>)?|>[>=]?/,relevance:0},_={match:t.concat(/\b/,t.either(...p),/\s*\(/),relevance:0,keywords:{built_in:p}};function v(e){return t.concat(/\b/,t.either(...e.map(e=>e.replace(/\s+/,`\\s+`))),/\b/)}let y={scope:`keyword`,match:v(f),relevance:0};function b(e,{exceptions:t,when:n}={}){let r=n;return t||=[],e.map(e=>e.match(/\|\d+$/)||t.includes(e)?e:r(e)?`${e}|0`:e)}return{name:`SQL`,case_insensitive:!0,illegal:/[{}]|<\//,keywords:{$pattern:/\b[\w\.]+/,keyword:b(m,{when:e=>e.length<3}),literal:a,type:s,built_in:d},contains:[{scope:`type`,match:v(o)},y,_,h,r,i,e.C_NUMBER_MODE,e.C_BLOCK_COMMENT_MODE,n,g]}}var fke=s((()=>{}));function pke(e){return e?typeof e==`string`?e:e.source:null}function bg(e){return xg(`(?=`,e,`)`)}function xg(...e){return e.map(e=>pke(e)).join(``)}function mke(e){let t=e[e.length-1];return typeof t==`object`&&t.constructor===Object?(e.splice(e.length-1,1),t):{}}function Sg(...e){return`(`+(mke(e).capture?``:`?:`)+e.map(e=>pke(e)).join(`|`)+`)`}function hke(e){let t={match:/\s+/,relevance:0},n=e.COMMENT(`/\\*`,`\\*/`,{contains:[`self`]}),r=[e.C_LINE_COMMENT_MODE,n],i={match:[/\./,Sg(...gke,...wg)],className:{2:`keyword`}},a={match:xg(/\./,Sg(...Tg)),relevance:0},o=Tg.filter(e=>typeof e==`string`).concat([`_|0`]),s={variants:[{className:`keyword`,match:Sg(...Tg.filter(e=>typeof e!=`string`).concat(_ke).map(Cg),...wg)}]},c={$pattern:Sg(/\b\w+/,/#\w+/),keyword:o.concat(yke),literal:Eg},l=[i,a,s],u=[{match:xg(/\./,Sg(...Dg)),relevance:0},{className:`built_in`,match:xg(/\b/,Sg(...Dg),/(?=\()/)}],d={match:/->/,relevance:0},f=[d,{className:`operator`,relevance:0,variants:[{match:Ag},{match:`\\.(\\.|${kg})+`}]}],p=`([0-9]_*)+`,m=`([0-9a-fA-F]_*)+`,h={className:`number`,relevance:0,variants:[{match:`\\b(${p})(\\.(${p}))?([eE][+-]?(${p}))?\\b`},{match:`\\b0x(${m})(\\.(${m}))?([pP][+-]?(${p}))?\\b`},{match:/\b0o([0-7]_*)+\b/},{match:/\b0b([01]_*)+\b/}]},g=(e=``)=>({className:`subst`,variants:[{match:xg(/\\/,e,/[0\\tnr"']/)},{match:xg(/\\/,e,/u\{[0-9a-fA-F]{1,8}\}/)}]}),_=(e=``)=>({className:`subst`,match:xg(/\\/,e,/[\t ]*(?:[\r\n]|\r\n)/)}),v=(e=``)=>({className:`subst`,label:`interpol`,begin:xg(/\\/,e,/\(/),end:/\)/}),y=(e=``)=>({begin:xg(e,/"""/),end:xg(/"""/,e),contains:[g(e),_(e),v(e)]}),b=(e=``)=>({begin:xg(e,/"/),end:xg(/"/,e),contains:[g(e),v(e)]}),x={className:`string`,variants:[y(),y(`#`),y(`##`),y(`###`),b(),b(`#`),b(`##`),b(`###`)]},S=[e.BACKSLASH_ESCAPE,{begin:/\[/,end:/\]/,relevance:0,contains:[e.BACKSLASH_ESCAPE]}],C={begin:/\/[^\s](?=[^/\n]*\/)/,end:/\//,contains:S},w=e=>{let t=xg(e,/\//),n=xg(/\//,e);return{begin:t,end:n,contains:[...S,{scope:`comment`,begin:`#(?!.*${n})`,end:/$/}]}},ee={scope:`regexp`,variants:[w(`###`),w(`##`),w(`#`),C]},te={match:xg(/`/,Ng,/`/)},ne=[te,{className:`variable`,match:/\$\d+/},{className:`variable`,match:`\\$${Mg}+`}],re=[{match:/(@|#(un)?)available/,scope:`keyword`,starts:{contains:[{begin:/\(/,end:/\)/,keywords:xke,contains:[...f,h,x]}]}},{scope:`keyword`,match:xg(/@/,Sg(...bke),bg(Sg(/\(/,/\s+/)))},{scope:`meta`,match:xg(/@/,Ng)}],T={match:bg(/\b[A-Z]/),relevance:0,contains:[{className:`type`,match:xg(/(AV|CA|CF|CG|CI|CL|CM|CN|CT|MK|MP|MTK|MTL|NS|SCN|SK|UI|WK|XC)/,Mg,`+`)},{className:`type`,match:Pg,relevance:0},{match:/[?!]+/,relevance:0},{match:/\.\.\./,relevance:0},{match:xg(/\s+&\s+/,bg(Pg)),relevance:0}]},ie={begin:/</,end:/>/,keywords:c,contains:[...r,...l,...re,d,T]};T.contains.push(ie);let ae={begin:/\(/,end:/\)/,relevance:0,keywords:c,contains:[`self`,{match:xg(Ng,/\s*:/),keywords:`_|0`,relevance:0},...r,ee,...l,...u,...f,h,x,...ne,...re,T]},E={begin:/</,end:/>/,keywords:`repeat each`,contains:[...r,T]},D={begin:/\(/,end:/\)/,keywords:c,contains:[{begin:Sg(bg(xg(Ng,/\s*:/)),bg(xg(Ng,/\s+/,Ng,/\s*:/))),end:/:/,relevance:0,contains:[{className:`keyword`,match:/\b_\b/},{className:`params`,match:Ng}]},...r,...l,...f,h,x,...re,T,ae],endsParent:!0,illegal:/["']/},oe={match:[/(func|macro)/,/\s+/,Sg(te.match,Ng,Ag)],className:{1:`keyword`,3:`title.function`},contains:[E,D,t],illegal:[/\[/,/%/]},se={match:[/\b(?:subscript|init[?!]?)/,/\s*(?=[<(])/],className:{1:`keyword`},contains:[E,D,t],illegal:/\[|%/},ce={match:[/operator/,/\s+/,Ag],className:{1:`keyword`,3:`title`}},le={begin:[/precedencegroup/,/\s+/,Pg],className:{1:`keyword`,3:`title`},contains:[T],keywords:[...vke,...Eg],end:/}/},ue={match:[/class\b/,/\s+/,/func\b/,/\s+/,/\b[A-Za-z_][A-Za-z0-9_]*\b/],scope:{1:`keyword`,3:`keyword`,5:`title.function`}},de={match:[/class\b/,/\s+/,/var\b/],scope:{1:`keyword`,3:`keyword`}},fe={begin:[/(struct|protocol|class|extension|enum|actor)/,/\s+/,Ng,/\s*/],beginScope:{1:`keyword`,3:`title.class`},keywords:c,contains:[E,...l,{begin:/:/,end:/\{/,keywords:c,contains:[{scope:`title.class.inherited`,match:Pg},...l],relevance:0}]};for(let e of x.variants){let t=e.contains.find(e=>e.label===`interpol`);t.keywords=c;let n=[...l,...u,...f,h,x,...ne];t.contains=[...n,{begin:/\(/,end:/\)/,contains:[`self`,...n]}]}return{name:`Swift`,keywords:c,contains:[...r,oe,se,ue,de,fe,ce,le,{beginKeywords:`import`,end:/$/,contains:[...r],relevance:0},ee,...l,...u,...f,h,x,...ne,...re,T,ae]}}var Cg,gke,wg,_ke,Tg,Eg,vke,yke,Dg,Og,kg,Ag,jg,Mg,Ng,Pg,bke,xke,Ske=s((()=>{Cg=e=>xg(/\b/,e,/\w$/.test(e)?/\b/:/\B/),gke=[`Protocol`,`Type`].map(Cg),wg=[`init`,`self`].map(Cg),_ke=[`Any`,`Self`],Tg=[`actor`,`any`,`associatedtype`,`async`,`await`,/as\?/,/as!/,`as`,`borrowing`,`break`,`case`,`catch`,`class`,`consume`,`consuming`,`continue`,`convenience`,`copy`,`default`,`defer`,`deinit`,`didSet`,`distributed`,`do`,`dynamic`,`each`,`else`,`enum`,`extension`,`fallthrough`,/fileprivate\(set\)/,`fileprivate`,`final`,`for`,`func`,`get`,`guard`,`if`,`import`,`indirect`,`infix`,/init\?/,/init!/,`inout`,/internal\(set\)/,`internal`,`in`,`is`,`isolated`,`nonisolated`,`lazy`,`let`,`macro`,`mutating`,`nonmutating`,/open\(set\)/,`open`,`operator`,`optional`,`override`,`package`,`postfix`,`precedencegroup`,`prefix`,/private\(set\)/,`private`,`protocol`,/public\(set\)/,`public`,`repeat`,`required`,`rethrows`,`return`,`set`,`some`,`static`,`struct`,`subscript`,`super`,`switch`,`throws`,`throw`,/try\?/,/try!/,`try`,`typealias`,/unowned\(safe\)/,/unowned\(unsafe\)/,`unowned`,`var`,`weak`,`where`,`while`,`willSet`],Eg=[`false`,`nil`,`true`],vke=[`assignment`,`associativity`,`higherThan`,`left`,`lowerThan`,`none`,`right`],yke=[`#colorLiteral`,`#column`,`#dsohandle`,`#else`,`#elseif`,`#endif`,`#error`,`#file`,`#fileID`,`#fileLiteral`,`#filePath`,`#function`,`#if`,`#imageLiteral`,`#keyPath`,`#line`,`#selector`,`#sourceLocation`,`#warning`],Dg=`abs.all.any.assert.assertionFailure.debugPrint.dump.fatalError.getVaList.isKnownUniquelyReferenced.max.min.numericCast.pointwiseMax.pointwiseMin.precondition.preconditionFailure.print.readLine.repeatElement.sequence.stride.swap.swift_unboxFromSwiftValueWithType.transcode.type.unsafeBitCast.unsafeDowncast.withExtendedLifetime.withUnsafeMutablePointer.withUnsafePointer.withVaList.withoutActuallyEscaping.zip`.split(`.`),Og=Sg(/[/=\-+!*%<>&|^~?]/,/[\u00A1-\u00A7]/,/[\u00A9\u00AB]/,/[\u00AC\u00AE]/,/[\u00B0\u00B1]/,/[\u00B6\u00BB\u00BF\u00D7\u00F7]/,/[\u2016-\u2017]/,/[\u2020-\u2027]/,/[\u2030-\u203E]/,/[\u2041-\u2053]/,/[\u2055-\u205E]/,/[\u2190-\u23FF]/,/[\u2500-\u2775]/,/[\u2794-\u2BFF]/,/[\u2E00-\u2E7F]/,/[\u3001-\u3003]/,/[\u3008-\u3020]/,/[\u3030]/),kg=Sg(Og,/[\u0300-\u036F]/,/[\u1DC0-\u1DFF]/,/[\u20D0-\u20FF]/,/[\uFE00-\uFE0F]/,/[\uFE20-\uFE2F]/),Ag=xg(Og,kg,`*`),jg=Sg(/[a-zA-Z_]/,/[\u00A8\u00AA\u00AD\u00AF\u00B2-\u00B5\u00B7-\u00BA]/,/[\u00BC-\u00BE\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u00FF]/,/[\u0100-\u02FF\u0370-\u167F\u1681-\u180D\u180F-\u1DBF]/,/[\u1E00-\u1FFF]/,/[\u200B-\u200D\u202A-\u202E\u203F-\u2040\u2054\u2060-\u206F]/,/[\u2070-\u20CF\u2100-\u218F\u2460-\u24FF\u2776-\u2793]/,/[\u2C00-\u2DFF\u2E80-\u2FFF]/,/[\u3004-\u3007\u3021-\u302F\u3031-\u303F\u3040-\uD7FF]/,/[\uF900-\uFD3D\uFD40-\uFDCF\uFDF0-\uFE1F\uFE30-\uFE44]/,/[\uFE47-\uFEFE\uFF00-\uFFFD]/),Mg=Sg(jg,/\d/,/[\u0300-\u036F\u1DC0-\u1DFF\u20D0-\u20FF\uFE20-\uFE2F]/),Ng=xg(jg,Mg,`*`),Pg=xg(/[A-Z]/,Mg,`*`),bke=[`attached`,`autoclosure`,xg(/convention\(/,Sg(`swift`,`block`,`c`),/\)/),`discardableResult`,`dynamicCallable`,`dynamicMemberLookup`,`escaping`,`freestanding`,`frozen`,`GKInspectable`,`IBAction`,`IBDesignable`,`IBInspectable`,`IBOutlet`,`IBSegueAction`,`inlinable`,`main`,`nonobjc`,`NSApplicationMain`,`NSCopying`,`NSManaged`,xg(/objc\(/,Ng,/\)/),`objc`,`objcMembers`,`propertyWrapper`,`requires_stored_property_inits`,`resultBuilder`,`Sendable`,`testable`,`UIApplicationMain`,`unchecked`,`unknown`,`usableFromInline`,`warn_unqualified_access`],xke=[`iOS`,`iOSApplicationExtension`,`macOS`,`macOSApplicationExtension`,`macCatalyst`,`macCatalystApplicationExtension`,`watchOS`,`watchOSApplicationExtension`,`tvOS`,`tvOSApplicationExtension`,`swift`]}));function Cke(e){let t=e.regex,n=(e,{after:t})=>{let n=`</`+e[0].slice(1);return e.input.indexOf(n,t)!==-1},r=Fg,i={begin:`<>`,end:`</>`},a=/<[A-Za-z0-9\\._:-]+\s*\/>/,o={begin:/<[A-Za-z0-9\\._:-]+/,end:/\/[A-Za-z0-9\\._:-]+>|\/>/,isTrulyOpeningTag:(e,t)=>{let r=e[0].length+e.index,i=e.input[r];if(i===`<`||i===`,`){t.ignoreMatch();return}i===`>`&&(n(e,{after:r})||t.ignoreMatch());let a,o=e.input.substring(r);if(a=o.match(/^\s*=/)){t.ignoreMatch();return}if((a=o.match(/^\s+extends\s+/))&&a.index===0){t.ignoreMatch();return}}},s={$pattern:Fg,keyword:Ig,literal:Lg,built_in:Hg,"variable.language":Vg},c=`[0-9](_?[0-9])*`,l=`\\.(${c})`,u=`0|[1-9](_?[0-9])*|0[0-7]*[89][0-9]*`,d={className:`number`,variants:[{begin:`(\\b(${u})((${l})|\\.)?|(${l}))[eE][+-]?(${c})\\b`},{begin:`\\b(${u})\\b((${l})\\b|\\.)?|(${l})\\b`},{begin:`\\b(0|[1-9](_?[0-9])*)n\\b`},{begin:`\\b0[xX][0-9a-fA-F](_?[0-9a-fA-F])*n?\\b`},{begin:`\\b0[bB][0-1](_?[0-1])*n?\\b`},{begin:`\\b0[oO][0-7](_?[0-7])*n?\\b`},{begin:`\\b0[0-7]+n?\\b`}],relevance:0},f={className:`subst`,begin:`\\$\\{`,end:`\\}`,keywords:s,contains:[]},p={begin:".?html`",end:``,starts:{end:"`",returnEnd:!1,contains:[e.BACKSLASH_ESCAPE,f],subLanguage:`xml`}},m={begin:".?css`",end:``,starts:{end:"`",returnEnd:!1,contains:[e.BACKSLASH_ESCAPE,f],subLanguage:`css`}},h={begin:".?gql`",end:``,starts:{end:"`",returnEnd:!1,contains:[e.BACKSLASH_ESCAPE,f],subLanguage:`graphql`}},g={className:`string`,begin:"`",end:"`",contains:[e.BACKSLASH_ESCAPE,f]},_={className:`comment`,variants:[e.COMMENT(/\/\*\*(?!\/)/,`\\*/`,{relevance:0,contains:[{begin:`(?=@[A-Za-z]+)`,relevance:0,contains:[{className:`doctag`,begin:`@[A-Za-z]+`},{className:`type`,begin:`\\{`,end:`\\}`,excludeEnd:!0,excludeBegin:!0,relevance:0},{className:`variable`,begin:r+`(?=\\s*(-)|$)`,endsParent:!0,relevance:0},{begin:/(?=[^\n])\s/,relevance:0}]}]}),e.C_BLOCK_COMMENT_MODE,e.C_LINE_COMMENT_MODE]},v=[e.APOS_STRING_MODE,e.QUOTE_STRING_MODE,p,m,h,g,{match:/\$\d+/},d];f.contains=v.concat({begin:/\{/,end:/\}/,keywords:s,contains:[`self`].concat(v)});let y=[].concat(_,f.contains),b=y.concat([{begin:/(\s*)\(/,end:/\)/,keywords:s,contains:[`self`].concat(y)}]),x={className:`params`,begin:/(\s*)\(/,end:/\)/,excludeBegin:!0,excludeEnd:!0,keywords:s,contains:b},S={variants:[{match:[/class/,/\s+/,r,/\s+/,/extends/,/\s+/,t.concat(r,`(`,t.concat(/\./,r),`)*`)],scope:{1:`keyword`,3:`title.class`,5:`keyword`,7:`title.class.inherited`}},{match:[/class/,/\s+/,r],scope:{1:`keyword`,3:`title.class`}}]},C={relevance:0,match:t.either(/\bJSON/,/\b[A-Z][a-z]+([A-Z][a-z]*|\d)*/,/\b[A-Z]{2,}([A-Z][a-z]+|\d)+([A-Z][a-z]*)*/,/\b[A-Z]{2,}[a-z]+([A-Z][a-z]+|\d)*([A-Z][a-z]*)*/),className:`title.class`,keywords:{_:[...Rg,...zg]}},w={label:`use_strict`,className:`meta`,relevance:10,begin:/^\s*['"]use (strict|asm)['"]/},ee={variants:[{match:[/function/,/\s+/,r,/(?=\s*\()/]},{match:[/function/,/\s*(?=\()/]}],className:{1:`keyword`,3:`title.function`},label:`func.def`,contains:[x],illegal:/%/},te={relevance:0,match:/\b[A-Z][A-Z_0-9]+\b/,className:`variable.constant`};function ne(e){return t.concat(`(?!`,e.join(`|`),`)`)}let re={match:t.concat(/\b/,ne([...Bg,`super`,`import`].map(e=>`${e}\\s*\\(`)),r,t.lookahead(/\s*\(/)),className:`title.function`,relevance:0},T={begin:t.concat(/\./,t.lookahead(t.concat(r,/(?![0-9A-Za-z$_(])/))),end:r,excludeBegin:!0,keywords:`prototype`,className:`property`,relevance:0},ie={match:[/get|set/,/\s+/,r,/(?=\()/],className:{1:`keyword`,3:`title.function`},contains:[{begin:/\(\)/},x]},ae=`(\\([^()]*(\\([^()]*(\\([^()]*\\)[^()]*)*\\)[^()]*)*\\)|`+e.UNDERSCORE_IDENT_RE+`)\\s*=>`,E={match:[/const|var|let/,/\s+/,r,/\s*/,/=\s*/,/(async\s*)?/,t.lookahead(ae)],keywords:`async`,className:{1:`keyword`,3:`title.function`},contains:[x]};return{name:`JavaScript`,aliases:[`js`,`jsx`,`mjs`,`cjs`],keywords:s,exports:{PARAMS_CONTAINS:b,CLASS_REFERENCE:C},illegal:/#(?![$_A-z])/,contains:[e.SHEBANG({label:`shebang`,binary:`node`,relevance:5}),w,e.APOS_STRING_MODE,e.QUOTE_STRING_MODE,p,m,h,g,_,{match:/\$\d+/},d,C,{scope:`attr`,match:r+t.lookahead(`:`),relevance:0},E,{begin:`(`+e.RE_STARTERS_RE+`|\\b(case|return|throw)\\b)\\s*`,keywords:`return throw case`,relevance:0,contains:[_,e.REGEXP_MODE,{className:`function`,begin:ae,returnBegin:!0,end:`\\s*=>`,contains:[{className:`params`,variants:[{begin:e.UNDERSCORE_IDENT_RE,relevance:0},{className:null,begin:/\(\s*\)/,skip:!0},{begin:/(\s*)\(/,end:/\)/,excludeBegin:!0,excludeEnd:!0,keywords:s,contains:b}]}]},{begin:/,/,relevance:0},{match:/\s+/,relevance:0},{variants:[{begin:i.begin,end:i.end},{match:a},{begin:o.begin,"on:begin":o.isTrulyOpeningTag,end:o.end}],subLanguage:`xml`,contains:[{begin:o.begin,end:o.end,skip:!0,contains:[`self`]}]}]},ee,{beginKeywords:`while if switch catch for`},{begin:`\\b(?!function)`+e.UNDERSCORE_IDENT_RE+`\\([^()]*(\\([^()]*(\\([^()]*\\)[^()]*)*\\)[^()]*)*\\)\\s*\\{`,returnBegin:!0,label:`func.def`,contains:[x,e.inherit(e.TITLE_MODE,{begin:r,className:`title.function`})]},{match:/\.\.\./,relevance:0},T,{match:`\\$`+r,relevance:0},{match:[/\bconstructor(?=\s*\()/],className:{1:`title.function`},contains:[x]},re,te,S,ie,{match:/\$[(.]/}]}}function wke(e){let t=e.regex,n=Cke(e),r=Fg,i=[`any`,`void`,`number`,`boolean`,`string`,`object`,`never`,`symbol`,`bigint`,`unknown`],a={begin:[/namespace/,/\s+/,e.IDENT_RE],beginScope:{1:`keyword`,3:`title.class`}},o={beginKeywords:`interface`,end:/\{/,excludeEnd:!0,keywords:{keyword:`interface extends`,built_in:i},contains:[n.exports.CLASS_REFERENCE]},s={className:`meta`,relevance:10,begin:/^\s*['"]use strict['"]/},c={$pattern:Fg,keyword:Ig.concat([`type`,`interface`,`public`,`private`,`protected`,`implements`,`declare`,`abstract`,`readonly`,`enum`,`override`,`satisfies`]),literal:Lg,built_in:Hg.concat(i),"variable.language":Vg},l={className:`meta`,begin:`@`+r},u=(e,t,n)=>{let r=e.contains.findIndex(e=>e.label===t);if(r===-1)throw Error(`can not find mode to replace`);e.contains.splice(r,1,n)};Object.assign(n.keywords,c),n.exports.PARAMS_CONTAINS.push(l);let d=n.contains.find(e=>e.scope===`attr`),f=Object.assign({},d,{match:t.concat(r,t.lookahead(/\s*\?:/))});n.exports.PARAMS_CONTAINS.push([n.exports.CLASS_REFERENCE,d,f]),n.contains=n.contains.concat([l,a,o,f]),u(n,`shebang`,e.SHEBANG()),u(n,`use_strict`,s);let p=n.contains.find(e=>e.label===`func.def`);return p.relevance=0,Object.assign(n,{name:`TypeScript`,aliases:[`ts`,`tsx`,`mts`,`cts`]}),n}var Fg,Ig,Lg,Rg,zg,Bg,Vg,Hg,Tke=s((()=>{Fg=`[A-Za-z$_][0-9A-Za-z$_]*`,Ig=`as.in.of.if.for.while.finally.var.new.function.do.return.void.else.break.catch.instanceof.with.throw.case.default.try.switch.continue.typeof.delete.let.yield.const.class.debugger.async.await.static.import.from.export.extends.using`.split(`.`),Lg=[`true`,`false`,`null`,`undefined`,`NaN`,`Infinity`],Rg=`Object.Function.Boolean.Symbol.Math.Date.Number.BigInt.String.RegExp.Array.Float32Array.Float64Array.Int8Array.Uint8Array.Uint8ClampedArray.Int16Array.Int32Array.Uint16Array.Uint32Array.BigInt64Array.BigUint64Array.Set.Map.WeakSet.WeakMap.ArrayBuffer.SharedArrayBuffer.Atomics.DataView.JSON.Promise.Generator.GeneratorFunction.AsyncFunction.Reflect.Proxy.Intl.WebAssembly`.split(`.`),zg=[`Error`,`EvalError`,`InternalError`,`RangeError`,`ReferenceError`,`SyntaxError`,`TypeError`,`URIError`],Bg=[`setInterval`,`setTimeout`,`clearInterval`,`clearTimeout`,`require`,`exports`,`eval`,`isFinite`,`isNaN`,`parseFloat`,`parseInt`,`decodeURI`,`decodeURIComponent`,`encodeURI`,`encodeURIComponent`,`escape`,`unescape`],Vg=[`arguments`,`this`,`super`,`console`,`window`,`document`,`localStorage`,`sessionStorage`,`module`,`global`],Hg=[].concat(Bg,Rg,zg)}));function Eke(e){let t=e.regex,n=t.concat(/[\p{L}_]/u,t.optional(/[\p{L}0-9_.-]*:/u),/[\p{L}0-9_.-]*/u),r=/[\p{L}0-9._:-]+/u,i={className:`symbol`,begin:/&[a-z]+;|&#[0-9]+;|&#x[a-f0-9]+;/},a={begin:/\s/,contains:[{className:`keyword`,begin:/#?[a-z_][a-z1-9_-]+/,illegal:/\n/}]},o=e.inherit(a,{begin:/\(/,end:/\)/}),s=e.inherit(e.APOS_STRING_MODE,{className:`string`}),c=e.inherit(e.QUOTE_STRING_MODE,{className:`string`}),l={endsWithParent:!0,illegal:/</,relevance:0,contains:[{className:`attr`,begin:r,relevance:0},{begin:/=\s*/,relevance:0,contains:[{className:`string`,endsParent:!0,variants:[{begin:/"/,end:/"/,contains:[i]},{begin:/'/,end:/'/,contains:[i]},{begin:/[^\s"'=<>`]+/}]}]}]};return{name:`HTML, XML`,aliases:[`html`,`xhtml`,`rss`,`atom`,`xjb`,`xsd`,`xsl`,`plist`,`wsf`,`svg`],case_insensitive:!0,unicodeRegex:!0,contains:[{className:`meta`,begin:/<![a-z]/,end:/>/,relevance:10,contains:[a,c,s,o,{begin:/\[/,end:/\]/,contains:[{className:`meta`,begin:/<![a-z]/,end:/>/,contains:[a,o,c,s]}]}]},e.COMMENT(/<!--/,/-->/,{relevance:10}),{begin:/<!\[CDATA\[/,end:/\]\]>/,relevance:10},i,{className:`meta`,end:/\?>/,variants:[{begin:/<\?xml/,relevance:10,contains:[c]},{begin:/<\?[a-z][a-z0-9]+/}]},{className:`tag`,begin:/<style(?=\s|>)/,end:/>/,keywords:{name:`style`},contains:[l],starts:{end:/<\/style>/,returnEnd:!0,subLanguage:[`css`,`xml`]}},{className:`tag`,begin:/<script(?=\s|>)/,end:/>/,keywords:{name:`script`},contains:[l],starts:{end:/<\/script>/,returnEnd:!0,subLanguage:[`javascript`,`handlebars`,`xml`]}},{className:`tag`,begin:/<>|<\/>/},{className:`tag`,begin:t.concat(/</,t.lookahead(t.concat(n,t.either(/\/>/,/>/,/\s/)))),end:/\/?>/,contains:[{className:`name`,begin:n,relevance:0,starts:l}]},{className:`tag`,begin:t.concat(/<\//,t.lookahead(t.concat(n,/>/))),contains:[{className:`name`,begin:n,relevance:0},{begin:/>/,relevance:0,endsParent:!0}]}]}}var Dke=s((()=>{}));function Oke(e){let t=`true false yes no null`,n=`[\\w#;/?:@&=+$,.~*'()[\\]]+`,r={className:`attr`,variants:[{begin:/[\w*@][\w*@ :()\./-]*:(?=[ \t]|$)/},{begin:/"[\w*@][\w*@ :()\./-]*":(?=[ \t]|$)/},{begin:/'[\w*@][\w*@ :()\./-]*':(?=[ \t]|$)/}]},i={className:`template-variable`,variants:[{begin:/\{\{/,end:/\}\}/},{begin:/%\{/,end:/\}/}]},a={className:`string`,relevance:0,begin:/'/,end:/'/,contains:[{match:/''/,scope:`char.escape`,relevance:0}]},o={className:`string`,relevance:0,variants:[{begin:/"/,end:/"/},{begin:/\S+/}],contains:[e.BACKSLASH_ESCAPE,i]},s=e.inherit(o,{variants:[{begin:/'/,end:/'/,contains:[{begin:/''/,relevance:0}]},{begin:/"/,end:/"/},{begin:/[^\s,{}[\]]+/}]}),c={className:`number`,begin:`\\b[0-9]{4}(-[0-9][0-9]){0,2}([Tt \\t][0-9][0-9]?(:[0-9][0-9]){2})?(\\.[0-9]*)?([ \\t])*(Z|[-+][0-9][0-9]?(:[0-9][0-9])?)?\\b`},l={end:`,`,endsWithParent:!0,excludeEnd:!0,keywords:t,relevance:0},u={begin:/\{/,end:/\}/,contains:[l],illegal:`\\n`,relevance:0},d={begin:`\\[`,end:`\\]`,contains:[l],illegal:`\\n`,relevance:0},f=[r,{className:`meta`,begin:`^---\\s*$`,relevance:10},{className:`string`,begin:`[\\|>]([1-9]?[+-])?[ ]*\\n( +)[^ ][^\\n]*\\n(\\2[^\\n]+\\n?)*`},{begin:`<%[%=-]?`,end:`[%-]?%>`,subLanguage:`ruby`,excludeBegin:!0,excludeEnd:!0,relevance:0},{className:`type`,begin:`!\\w+!`+n},{className:`type`,begin:`!<`+n+`>`},{className:`type`,begin:`!`+n},{className:`type`,begin:`!!`+n},{className:`meta`,begin:`&`+e.UNDERSCORE_IDENT_RE+`$`},{className:`meta`,begin:`\\*`+e.UNDERSCORE_IDENT_RE+`$`},{className:`bullet`,begin:`-(?=[ ]|$)`,relevance:0},e.HASH_COMMENT_MODE,{beginKeywords:t,keywords:{literal:t}},c,{className:`number`,begin:e.C_NUMBER_RE+`\\b`,relevance:0},u,d,a,o],p=[...f];return p.pop(),p.push(s),l.contains=p,{name:`YAML`,case_insensitive:!0,aliases:[`yml`],contains:f}}var kke=s((()=>{})),Ake=c(((e,t)=>{function n(e){return e instanceof Map?e.clear=e.delete=e.set=function(){throw Error(`map is read-only`)}:e instanceof Set&&(e.add=e.clear=e.delete=function(){throw Error(`set is read-only`)}),Object.freeze(e),Object.getOwnPropertyNames(e).forEach(t=>{let r=e[t],i=typeof r;(i===`object`||i===`function`)&&!Object.isFrozen(r)&&n(r)}),e}var r=class{constructor(e){e.data===void 0&&(e.data={}),this.data=e.data,this.isMatchIgnored=!1}ignoreMatch(){this.isMatchIgnored=!0}};function i(e){return e.replace(/&/g,`&amp;`).replace(/</g,`&lt;`).replace(/>/g,`&gt;`).replace(/"/g,`&quot;`).replace(/'/g,`&#x27;`)}function a(e,...t){let n=Object.create(null);for(let t in e)n[t]=e[t];return t.forEach(function(e){for(let t in e)n[t]=e[t]}),n}var o=`</span>`,s=e=>!!e.scope,c=(e,{prefix:t})=>{if(e.startsWith(`language:`))return e.replace(`language:`,`language-`);if(e.includes(`.`)){let n=e.split(`.`);return[`${t}${n.shift()}`,...n.map((e,t)=>`${e}${`_`.repeat(t+1)}`)].join(` `)}return`${t}${e}`},l=class{constructor(e,t){this.buffer=``,this.classPrefix=t.classPrefix,e.walk(this)}addText(e){this.buffer+=i(e)}openNode(e){if(!s(e))return;let t=c(e.scope,{prefix:this.classPrefix});this.span(t)}closeNode(e){s(e)&&(this.buffer+=o)}value(){return this.buffer}span(e){this.buffer+=`<span class="${e}">`}},u=(e={})=>{let t={children:[]};return Object.assign(t,e),t},d=class e{constructor(){this.rootNode=u(),this.stack=[this.rootNode]}get top(){return this.stack[this.stack.length-1]}get root(){return this.rootNode}add(e){this.top.children.push(e)}openNode(e){let t=u({scope:e});this.add(t),this.stack.push(t)}closeNode(){if(this.stack.length>1)return this.stack.pop()}closeAllNodes(){for(;this.closeNode(););}toJSON(){return JSON.stringify(this.rootNode,null,4)}walk(e){return this.constructor._walk(e,this.rootNode)}static _walk(e,t){return typeof t==`string`?e.addText(t):t.children&&(e.openNode(t),t.children.forEach(t=>this._walk(e,t)),e.closeNode(t)),e}static _collapse(t){typeof t!=`string`&&t.children&&(t.children.every(e=>typeof e==`string`)?t.children=[t.children.join(``)]:t.children.forEach(t=>{e._collapse(t)}))}},f=class extends d{constructor(e){super(),this.options=e}addText(e){e!==``&&this.add(e)}startScope(e){this.openNode(e)}endScope(){this.closeNode()}__addSublanguage(e,t){let n=e.root;t&&(n.scope=`language:${t}`),this.add(n)}toHTML(){return new l(this,this.options).value()}finalize(){return this.closeAllNodes(),!0}};function p(e){return e?typeof e==`string`?e:e.source:null}function m(e){return _(`(?=`,e,`)`)}function h(e){return _(`(?:`,e,`)*`)}function g(e){return _(`(?:`,e,`)?`)}function _(...e){return e.map(e=>p(e)).join(``)}function v(e){let t=e[e.length-1];return typeof t==`object`&&t.constructor===Object?(e.splice(e.length-1,1),t):{}}function y(...e){return`(`+(v(e).capture?``:`?:`)+e.map(e=>p(e)).join(`|`)+`)`}function b(e){return RegExp(e.toString()+`|`).exec(``).length-1}function x(e,t){let n=e&&e.exec(t);return n&&n.index===0}var S=/\[(?:[^\\\]]|\\.)*\]|\(\??|\\([1-9][0-9]*)|\\./;function C(e,{joinWith:t}){let n=0;return e.map(e=>{n+=1;let t=n,r=p(e),i=``;for(;r.length>0;){let e=S.exec(r);if(!e){i+=r;break}i+=r.substring(0,e.index),r=r.substring(e.index+e[0].length),e[0][0]===`\\`&&e[1]?i+=`\\`+String(Number(e[1])+t):(i+=e[0],e[0]===`(`&&n++)}return i}).map(e=>`(${e})`).join(t)}var w=/\b\B/,ee=`[a-zA-Z]\\w*`,te=`[a-zA-Z_]\\w*`,ne=`\\b\\d+(\\.\\d+)?`,re=`(-?)(\\b0[xX][a-fA-F0-9]+|(\\b\\d+(\\.\\d*)?|\\.\\d+)([eE][-+]?\\d+)?)`,T=`\\b(0b[01]+)`,ie=`!|!=|!==|%|%=|&|&&|&=|\\*|\\*=|\\+|\\+=|,|-|-=|/=|/|:|;|<<|<<=|<=|<|===|==|=|>>>=|>>=|>=|>>>|>>|>|\\?|\\[|\\{|\\(|\\^|\\^=|\\||\\|=|\\|\\||~`,ae=(e={})=>{let t=/^#![ ]*\//;return e.binary&&(e.begin=_(t,/.*\b/,e.binary,/\b.*/)),a({scope:`meta`,begin:t,end:/$/,relevance:0,"on:begin":(e,t)=>{e.index!==0&&t.ignoreMatch()}},e)},E={begin:`\\\\[\\s\\S]`,relevance:0},D={scope:`string`,begin:`'`,end:`'`,illegal:`\\n`,contains:[E]},oe={scope:`string`,begin:`"`,end:`"`,illegal:`\\n`,contains:[E]},se={begin:/\b(a|an|the|are|I'm|isn't|don't|doesn't|won't|but|just|should|pretty|simply|enough|gonna|going|wtf|so|such|will|you|your|they|like|more)\b/},ce=function(e,t,n={}){let r=a({scope:`comment`,begin:e,end:t,contains:[]},n);r.contains.push({scope:`doctag`,begin:`[ ]*(?=(TODO|FIXME|NOTE|BUG|OPTIMIZE|HACK|XXX):)`,end:/(TODO|FIXME|NOTE|BUG|OPTIMIZE|HACK|XXX):/,excludeBegin:!0,relevance:0});let i=y(`I`,`a`,`is`,`so`,`us`,`to`,`at`,`if`,`in`,`it`,`on`,/[A-Za-z]+['](d|ve|re|ll|t|s|n)/,/[A-Za-z]+[-][a-z]+/,/[A-Za-z][a-z]{2,}/);return r.contains.push({begin:_(/[ ]+/,`(`,i,/[.]?[:]?([.][ ]|[ ])/,`){3}`)}),r},le=ce(`//`,`$`),ue=ce(`/\\*`,`\\*/`),de=ce(`#`,`$`),fe={scope:`number`,begin:ne,relevance:0},pe={scope:`number`,begin:re,relevance:0},me={scope:`number`,begin:T,relevance:0},he={scope:`regexp`,begin:/\/(?=[^/\n]*\/)/,end:/\/[gimuy]*/,contains:[E,{begin:/\[/,end:/\]/,relevance:0,contains:[E]}]},ge={scope:`title`,begin:ee,relevance:0},_e={scope:`title`,begin:te,relevance:0},ve={begin:`\\.\\s*`+te,relevance:0},ye=Object.freeze({__proto__:null,APOS_STRING_MODE:D,BACKSLASH_ESCAPE:E,BINARY_NUMBER_MODE:me,BINARY_NUMBER_RE:T,COMMENT:ce,C_BLOCK_COMMENT_MODE:ue,C_LINE_COMMENT_MODE:le,C_NUMBER_MODE:pe,C_NUMBER_RE:re,END_SAME_AS_BEGIN:function(e){return Object.assign(e,{"on:begin":(e,t)=>{t.data._beginMatch=e[1]},"on:end":(e,t)=>{t.data._beginMatch!==e[1]&&t.ignoreMatch()}})},HASH_COMMENT_MODE:de,IDENT_RE:ee,MATCH_NOTHING_RE:w,METHOD_GUARD:ve,NUMBER_MODE:fe,NUMBER_RE:ne,PHRASAL_WORDS_MODE:se,QUOTE_STRING_MODE:oe,REGEXP_MODE:he,RE_STARTERS_RE:ie,SHEBANG:ae,TITLE_MODE:ge,UNDERSCORE_IDENT_RE:te,UNDERSCORE_TITLE_MODE:_e});function be(e,t){e.input[e.index-1]===`.`&&t.ignoreMatch()}function xe(e,t){e.className!==void 0&&(e.scope=e.className,delete e.className)}function Se(e,t){t&&e.beginKeywords&&(e.begin=`\\b(`+e.beginKeywords.split(` `).join(`|`)+`)(?!\\.)(?=\\b|\\s)`,e.__beforeBegin=be,e.keywords=e.keywords||e.beginKeywords,delete e.beginKeywords,e.relevance===void 0&&(e.relevance=0))}function Ce(e,t){Array.isArray(e.illegal)&&(e.illegal=y(...e.illegal))}function we(e,t){if(e.match){if(e.begin||e.end)throw Error(`begin & end are not supported with match`);e.begin=e.match,delete e.match}}function Te(e,t){e.relevance===void 0&&(e.relevance=1)}var Ee=(e,t)=>{if(!e.beforeMatch)return;if(e.starts)throw Error(`beforeMatch cannot be used with starts`);let n=Object.assign({},e);Object.keys(e).forEach(t=>{delete e[t]}),e.keywords=n.keywords,e.begin=_(n.beforeMatch,m(n.begin)),e.starts={relevance:0,contains:[Object.assign(n,{endsParent:!0})]},e.relevance=0,delete n.beforeMatch},De=[`of`,`and`,`for`,`in`,`not`,`or`,`if`,`then`,`parent`,`list`,`value`],Oe=`keyword`;function ke(e,t,n=Oe){let r=Object.create(null);return typeof e==`string`?i(n,e.split(` `)):Array.isArray(e)?i(n,e):Object.keys(e).forEach(function(n){Object.assign(r,ke(e[n],t,n))}),r;function i(e,n){t&&(n=n.map(e=>e.toLowerCase())),n.forEach(function(t){let n=t.split(`|`);r[n[0]]=[e,Ae(n[0],n[1])]})}}function Ae(e,t){return t?Number(t):je(e)?0:1}function je(e){return De.includes(e.toLowerCase())}var Me={},Ne=e=>{console.error(e)},Pe=(e,...t)=>{console.log(`WARN: ${e}`,...t)},Fe=(e,t)=>{Me[`${e}/${t}`]||(console.log(`Deprecated as of ${e}. ${t}`),Me[`${e}/${t}`]=!0)},Ie=Error();function Le(e,t,{key:n}){let r=0,i=e[n],a={},o={};for(let e=1;e<=t.length;e++)o[e+r]=i[e],a[e+r]=!0,r+=b(t[e-1]);e[n]=o,e[n]._emit=a,e[n]._multi=!0}function Re(e){if(Array.isArray(e.begin)){if(e.skip||e.excludeBegin||e.returnBegin)throw Ne(`skip, excludeBegin, returnBegin not compatible with beginScope: {}`),Ie;if(typeof e.beginScope!=`object`||e.beginScope===null)throw Ne(`beginScope must be object`),Ie;Le(e,e.begin,{key:`beginScope`}),e.begin=C(e.begin,{joinWith:``})}}function ze(e){if(Array.isArray(e.end)){if(e.skip||e.excludeEnd||e.returnEnd)throw Ne(`skip, excludeEnd, returnEnd not compatible with endScope: {}`),Ie;if(typeof e.endScope!=`object`||e.endScope===null)throw Ne(`endScope must be object`),Ie;Le(e,e.end,{key:`endScope`}),e.end=C(e.end,{joinWith:``})}}function Be(e){e.scope&&typeof e.scope==`object`&&e.scope!==null&&(e.beginScope=e.scope,delete e.scope)}function Ve(e){Be(e),typeof e.beginScope==`string`&&(e.beginScope={_wrap:e.beginScope}),typeof e.endScope==`string`&&(e.endScope={_wrap:e.endScope}),Re(e),ze(e)}function He(e){function t(t,n){return new RegExp(p(t),`m`+(e.case_insensitive?`i`:``)+(e.unicodeRegex?`u`:``)+(n?`g`:``))}class n{constructor(){this.matchIndexes={},this.regexes=[],this.matchAt=1,this.position=0}addRule(e,t){t.position=this.position++,this.matchIndexes[this.matchAt]=t,this.regexes.push([t,e]),this.matchAt+=b(e)+1}compile(){this.regexes.length===0&&(this.exec=()=>null),this.matcherRe=t(C(this.regexes.map(e=>e[1]),{joinWith:`|`}),!0),this.lastIndex=0}exec(e){this.matcherRe.lastIndex=this.lastIndex;let t=this.matcherRe.exec(e);if(!t)return null;let n=t.findIndex((e,t)=>t>0&&e!==void 0),r=this.matchIndexes[n];return t.splice(0,n),Object.assign(t,r)}}class r{constructor(){this.rules=[],this.multiRegexes=[],this.count=0,this.lastIndex=0,this.regexIndex=0}getMatcher(e){if(this.multiRegexes[e])return this.multiRegexes[e];let t=new n;return this.rules.slice(e).forEach(([e,n])=>t.addRule(e,n)),t.compile(),this.multiRegexes[e]=t,t}resumingScanAtSamePosition(){return this.regexIndex!==0}considerAll(){this.regexIndex=0}addRule(e,t){this.rules.push([e,t]),t.type===`begin`&&this.count++}exec(e){let t=this.getMatcher(this.regexIndex);t.lastIndex=this.lastIndex;let n=t.exec(e);if(this.resumingScanAtSamePosition()&&!(n&&n.index===this.lastIndex)){let t=this.getMatcher(0);t.lastIndex=this.lastIndex+1,n=t.exec(e)}return n&&(this.regexIndex+=n.position+1,this.regexIndex===this.count&&this.considerAll()),n}}function i(e){let t=new r;return e.contains.forEach(e=>t.addRule(e.begin,{rule:e,type:`begin`})),e.terminatorEnd&&t.addRule(e.terminatorEnd,{type:`end`}),e.illegal&&t.addRule(e.illegal,{type:`illegal`}),t}function o(n,r){let a=n;if(n.isCompiled)return a;[xe,we,Ve,Ee].forEach(e=>e(n,r)),e.compilerExtensions.forEach(e=>e(n,r)),n.__beforeBegin=null,[Se,Ce,Te].forEach(e=>e(n,r)),n.isCompiled=!0;let s=null;return typeof n.keywords==`object`&&n.keywords.$pattern&&(n.keywords=Object.assign({},n.keywords),s=n.keywords.$pattern,delete n.keywords.$pattern),s||=/\w+/,n.keywords&&=ke(n.keywords,e.case_insensitive),a.keywordPatternRe=t(s,!0),r&&(n.begin||=/\B|\b/,a.beginRe=t(a.begin),!n.end&&!n.endsWithParent&&(n.end=/\B|\b/),n.end&&(a.endRe=t(a.end)),a.terminatorEnd=p(a.end)||``,n.endsWithParent&&r.terminatorEnd&&(a.terminatorEnd+=(n.end?`|`:``)+r.terminatorEnd)),n.illegal&&(a.illegalRe=t(n.illegal)),n.contains||=[],n.contains=[].concat(...n.contains.map(function(e){return We(e===`self`?n:e)})),n.contains.forEach(function(e){o(e,a)}),n.starts&&o(n.starts,r),a.matcher=i(a),a}if(e.compilerExtensions||=[],e.contains&&e.contains.includes(`self`))throw Error("ERR: contains `self` is not supported at the top-level of a language.  See documentation.");return e.classNameAliases=a(e.classNameAliases||{}),o(e)}function Ue(e){return e?e.endsWithParent||Ue(e.starts):!1}function We(e){return e.variants&&!e.cachedVariants&&(e.cachedVariants=e.variants.map(function(t){return a(e,{variants:null},t)})),e.cachedVariants?e.cachedVariants:Ue(e)?a(e,{starts:e.starts?a(e.starts):null}):Object.isFrozen(e)?a(e):e}var Ge=`11.11.1`,Ke=class extends Error{constructor(e,t){super(e),this.name=`HTMLInjectionError`,this.html=t}},qe=i,Je=a,Ye=Symbol(`nomatch`),eee=7,Xe=function(e){let t=Object.create(null),i=Object.create(null),a=[],o=!0,s=`Could not find the language '{}', did you forget to load/include a language module?`,c={disableAutodetect:!0,name:`Plain text`,contains:[]},l={ignoreUnescapedHTML:!1,throwUnescapedHTML:!1,noHighlightRe:/^(no-?highlight)$/i,languageDetectRe:/\blang(?:uage)?-([\w-]+)\b/i,classPrefix:`hljs-`,cssSelector:`pre code`,languages:null,__emitter:f};function u(e){return l.noHighlightRe.test(e)}function d(e){let t=e.className+` `;t+=e.parentNode?e.parentNode.className:``;let n=l.languageDetectRe.exec(t);if(n){let t=D(n[1]);return t||(Pe(s.replace(`{}`,n[1])),Pe(`Falling back to no-highlight mode for this block.`,e)),t?n[1]:`no-highlight`}return t.split(/\s+/).find(e=>u(e)||D(e))}function p(e,t,n){let r=``,i=``;typeof t==`object`?(r=e,n=t.ignoreIllegals,i=t.language):(Fe(`10.7.0`,`highlight(lang, code, ...args) has been deprecated.`),Fe(`10.7.0`,`Please use highlight(code, options) instead.
-https://github.com/highlightjs/highlight.js/issues/2277`),i=e,r=t),n===void 0&&(n=!0);let a={code:r,language:i};de(`before:highlight`,a);let o=a.result?a.result:v(a.language,a.code,n);return o.code=a.code,de(`after:highlight`,o),o}function v(e,n,i,a){let c=Object.create(null);function u(e,t){return e.keywords[t]}function d(){if(!ie.keywords){E.addText(oe);return}let e=0;ie.keywordPatternRe.lastIndex=0;let t=ie.keywordPatternRe.exec(oe),n=``;for(;t;){n+=oe.substring(e,t.index);let r=ne.case_insensitive?t[0].toLowerCase():t[0],i=u(ie,r);if(i){let[e,a]=i;if(E.addText(n),n=``,c[r]=(c[r]||0)+1,c[r]<=eee&&(se+=a),e.startsWith(`_`))n+=t[0];else{let n=ne.classNameAliases[e]||e;m(t[0],n)}}else n+=t[0];e=ie.keywordPatternRe.lastIndex,t=ie.keywordPatternRe.exec(oe)}n+=oe.substring(e),E.addText(n)}function f(){if(oe===``)return;let e=null;if(typeof ie.subLanguage==`string`){if(!t[ie.subLanguage]){E.addText(oe);return}e=v(ie.subLanguage,oe,!0,ae[ie.subLanguage]),ae[ie.subLanguage]=e._top}else e=S(oe,ie.subLanguage.length?ie.subLanguage:null);ie.relevance>0&&(se+=e.relevance),E.__addSublanguage(e._emitter,e.language)}function p(){ie.subLanguage==null?d():f(),oe=``}function m(e,t){e!==``&&(E.startScope(t),E.addText(e),E.endScope())}function h(e,t){let n=1,r=t.length-1;for(;n<=r;){if(!e._emit[n]){n++;continue}let r=ne.classNameAliases[e[n]]||e[n],i=t[n];r?m(i,r):(oe=i,d(),oe=``),n++}}function g(e,t){return e.scope&&typeof e.scope==`string`&&E.openNode(ne.classNameAliases[e.scope]||e.scope),e.beginScope&&(e.beginScope._wrap?(m(oe,ne.classNameAliases[e.beginScope._wrap]||e.beginScope._wrap),oe=``):e.beginScope._multi&&(h(e.beginScope,t),oe=``)),ie=Object.create(e,{parent:{value:ie}}),ie}function _(e,t,n){let i=x(e.endRe,n);if(i){if(e[`on:end`]){let n=new r(e);e[`on:end`](t,n),n.isMatchIgnored&&(i=!1)}if(i){for(;e.endsParent&&e.parent;)e=e.parent;return e}}if(e.endsWithParent)return _(e.parent,t,n)}function y(e){return ie.matcher.regexIndex===0?(oe+=e[0],1):(ue=!0,0)}function b(e){let t=e[0],n=e.rule,i=new r(n),a=[n.__beforeBegin,n[`on:begin`]];for(let n of a)if(n&&(n(e,i),i.isMatchIgnored))return y(t);return n.skip?oe+=t:(n.excludeBegin&&(oe+=t),p(),!n.returnBegin&&!n.excludeBegin&&(oe=t)),g(n,e),n.returnBegin?0:t.length}function C(e){let t=e[0],r=n.substring(e.index),i=_(ie,e,r);if(!i)return Ye;let a=ie;ie.endScope&&ie.endScope._wrap?(p(),m(t,ie.endScope._wrap)):ie.endScope&&ie.endScope._multi?(p(),h(ie.endScope,e)):a.skip?oe+=t:(a.returnEnd||a.excludeEnd||(oe+=t),p(),a.excludeEnd&&(oe=t));do ie.scope&&E.closeNode(),!ie.skip&&!ie.subLanguage&&(se+=ie.relevance),ie=ie.parent;while(ie!==i.parent);return i.starts&&g(i.starts,e),a.returnEnd?0:t.length}function w(){let e=[];for(let t=ie;t!==ne;t=t.parent)t.scope&&e.unshift(t.scope);e.forEach(e=>E.openNode(e))}let ee={};function te(t,r){let a=r&&r[0];if(oe+=t,a==null)return p(),0;if(ee.type===`begin`&&r.type===`end`&&ee.index===r.index&&a===``){if(oe+=n.slice(r.index,r.index+1),!o){let t=Error(`0 width match regex (${e})`);throw t.languageName=e,t.badRule=ee.rule,t}return 1}if(ee=r,r.type===`begin`)return b(r);if(r.type===`illegal`&&!i){let e=Error(`Illegal lexeme "`+a+`" for mode "`+(ie.scope||`<unnamed>`)+`"`);throw e.mode=ie,e}else if(r.type===`end`){let e=C(r);if(e!==Ye)return e}if(r.type===`illegal`&&a===``)return oe+=`
-`,1;if(le>1e5&&le>r.index*3)throw Error(`potential infinite loop, way more iterations than matches`);return oe+=a,a.length}let ne=D(e);if(!ne)throw Ne(s.replace(`{}`,e)),Error(`Unknown language: "`+e+`"`);let re=He(ne),T=``,ie=a||re,ae={},E=new l.__emitter(l);w();let oe=``,se=0,ce=0,le=0,ue=!1;try{if(ne.__emitTokens)ne.__emitTokens(n,E);else{for(ie.matcher.considerAll();;){le++,ue?ue=!1:ie.matcher.considerAll(),ie.matcher.lastIndex=ce;let e=ie.matcher.exec(n);if(!e)break;let t=te(n.substring(ce,e.index),e);ce=e.index+t}te(n.substring(ce))}return E.finalize(),T=E.toHTML(),{language:e,value:T,relevance:se,illegal:!1,_emitter:E,_top:ie}}catch(t){if(t.message&&t.message.includes(`Illegal`))return{language:e,value:qe(n),illegal:!0,relevance:0,_illegalBy:{message:t.message,index:ce,context:n.slice(ce-100,ce+100),mode:t.mode,resultSoFar:T},_emitter:E};if(o)return{language:e,value:qe(n),illegal:!1,relevance:0,errorRaised:t,_emitter:E,_top:ie};throw t}}function b(e){let t={value:qe(e),illegal:!1,relevance:0,_top:c,_emitter:new l.__emitter(l)};return t._emitter.addText(e),t}function S(e,n){n=n||l.languages||Object.keys(t);let r=b(e),i=n.filter(D).filter(se).map(t=>v(t,e,!1));i.unshift(r);let[a,o]=i.sort((e,t)=>{if(e.relevance!==t.relevance)return t.relevance-e.relevance;if(e.language&&t.language){if(D(e.language).supersetOf===t.language)return 1;if(D(t.language).supersetOf===e.language)return-1}return 0}),s=a;return s.secondBest=o,s}function C(e,t,n){let r=t&&i[t]||n;e.classList.add(`hljs`),e.classList.add(`language-${r}`)}function w(e){let t=null,n=d(e);if(u(n))return;if(de(`before:highlightElement`,{el:e,language:n}),e.dataset.highlighted){console.log("Element previously highlighted. To highlight again, first unset `dataset.highlighted`.",e);return}if(e.children.length>0&&(l.ignoreUnescapedHTML||(console.warn(`One of your code blocks includes unescaped HTML. This is a potentially serious security risk.`),console.warn(`https://github.com/highlightjs/highlight.js/wiki/security`),console.warn(`The element with unescaped HTML:`),console.warn(e)),l.throwUnescapedHTML))throw new Ke(`One of your code blocks includes unescaped HTML.`,e.innerHTML);t=e;let r=t.textContent,i=n?p(r,{language:n,ignoreIllegals:!0}):S(r);e.innerHTML=i.value,e.dataset.highlighted=`yes`,C(e,n,i.language),e.result={language:i.language,re:i.relevance,relevance:i.relevance},i.secondBest&&(e.secondBest={language:i.secondBest.language,relevance:i.secondBest.relevance}),de(`after:highlightElement`,{el:e,result:i,text:r})}function ee(e){l=Je(l,e)}let te=()=>{T(),Fe(`10.6.0`,`initHighlighting() deprecated.  Use highlightAll() now.`)};function ne(){T(),Fe(`10.6.0`,`initHighlightingOnLoad() deprecated.  Use highlightAll() now.`)}let re=!1;function T(){function e(){T()}if(document.readyState===`loading`){re||window.addEventListener(`DOMContentLoaded`,e,!1),re=!0;return}document.querySelectorAll(l.cssSelector).forEach(w)}function ie(n,r){let i=null;try{i=r(e)}catch(e){if(Ne(`Language definition for '{}' could not be registered.`.replace(`{}`,n)),o)Ne(e);else throw e;i=c}i.name||=n,t[n]=i,i.rawDefinition=r.bind(null,e),i.aliases&&oe(i.aliases,{languageName:n})}function ae(e){delete t[e];for(let t of Object.keys(i))i[t]===e&&delete i[t]}function E(){return Object.keys(t)}function D(e){return e=(e||``).toLowerCase(),t[e]||t[i[e]]}function oe(e,{languageName:t}){typeof e==`string`&&(e=[e]),e.forEach(e=>{i[e.toLowerCase()]=t})}function se(e){let t=D(e);return t&&!t.disableAutodetect}function ce(e){e[`before:highlightBlock`]&&!e[`before:highlightElement`]&&(e[`before:highlightElement`]=t=>{e[`before:highlightBlock`](Object.assign({block:t.el},t))}),e[`after:highlightBlock`]&&!e[`after:highlightElement`]&&(e[`after:highlightElement`]=t=>{e[`after:highlightBlock`](Object.assign({block:t.el},t))})}function le(e){ce(e),a.push(e)}function ue(e){let t=a.indexOf(e);t!==-1&&a.splice(t,1)}function de(e,t){let n=e;a.forEach(function(e){e[n]&&e[n](t)})}function fe(e){return Fe(`10.7.0`,`highlightBlock will be removed entirely in v12.0`),Fe(`10.7.0`,`Please use highlightElement now.`),w(e)}Object.assign(e,{highlight:p,highlightAuto:S,highlightAll:T,highlightElement:w,highlightBlock:fe,configure:ee,initHighlighting:te,initHighlightingOnLoad:ne,registerLanguage:ie,unregisterLanguage:ae,listLanguages:E,getLanguage:D,registerAliases:oe,autoDetection:se,inherit:Je,addPlugin:le,removePlugin:ue}),e.debugMode=function(){o=!1},e.safeMode=function(){o=!0},e.versionString=Ge,e.regex={concat:_,lookahead:m,either:y,optional:g,anyNumberOfTimes:h};for(let e in ye)typeof ye[e]==`object`&&n(ye[e]);return Object.assign(e,ye),e},Ze=Xe({});Ze.newInstance=()=>Xe({}),t.exports=Ze,Ze.HighlightJS=Ze,Ze.default=Ze})),jke,Mke,Nke=s((()=>{jke=d(Ake()),Mke=jke.default}));function Pke(e){let t=Mke.newInstance();return e&&a(e),{highlight:n,highlightAuto:r,listLanguages:i,register:a,registerAlias:o,registered:s};function n(e,n,r){let i=r||Ug,a=typeof i.prefix==`string`?i.prefix:Fke;if(!t.getLanguage(e))throw Error("Unknown language: `"+e+"` is not registered");t.configure({__emitter:Ike,classPrefix:a});let o=t.highlight(n,{ignoreIllegals:!0,language:e});if(o.errorRaised)throw Error("Could not highlight with `Highlight.js`",{cause:o.errorRaised});let s=o._emitter.root,c=s.data;return c.language=o.language,c.relevance=o.relevance,s}function r(e,r){let a=(r||Ug).subset||i(),o=-1,s=0,c;for(;++o<a.length;){let i=a[o];if(!t.getLanguage(i))continue;let l=n(i,e,r);l.data&&l.data.relevance!==void 0&&l.data.relevance>s&&(s=l.data.relevance,c=l)}return c||{type:`root`,children:[],data:{language:void 0,relevance:s}}}function i(){return t.listLanguages()}function a(e,n){if(typeof e==`string`)t.registerLanguage(e,n);else{let n;for(n in e)Object.hasOwn(e,n)&&t.registerLanguage(n,e[n])}}function o(e,n){if(typeof e==`string`)t.registerAliases(typeof n==`string`?n:[...n],{languageName:e});else{let n;for(n in e)if(Object.hasOwn(e,n)){let r=e[n];t.registerAliases(typeof r==`string`?r:[...r],{languageName:n})}}}function s(e){return!!t.getLanguage(e)}}var Ug,Fke,Ike,Lke=s((()=>{ep(),Nke(),Ug={},Fke=`hljs-`,Ike=class{constructor(e){this.options=e,this.root={type:`root`,children:[],data:{language:void 0,relevance:0}},this.stack=[this.root]}addText(e){if(e===``)return;let t=this.stack[this.stack.length-1],n=t.children[t.children.length-1];n&&n.type===`text`?n.value+=e:t.children.push({type:`text`,value:e})}startScope(e){this.openNode(String(e))}endScope(){this.closeNode()}__addSublanguage(e,t){let n=this.stack[this.stack.length-1],r=e.root.children;t?n.children.push({type:`element`,tagName:`span`,properties:{className:[t]},children:r}):n.children.push(...r)}openNode(e){let t=this,n=e.split(`.`).map(function(e,n){return n?e+`_`.repeat(n):t.options.classPrefix+e}),r=this.stack[this.stack.length-1],i={type:`element`,tagName:`span`,properties:{className:n},children:[]};r.children.push(i),this.stack.push(i)}closeNode(){this.stack.pop()}finalize(){}toHTML(){return``}}})),Rke=s((()=>{Lke()}));function zke(e){let t=e||Vke,n=t.aliases,r=e?.detect??!1,i=t.languages,a=t.plainText,o=t.prefix,s=t.subset,c=`hljs`,l=e?.lowlight??Pke(i);if(n&&l.registerAlias(n),o){let e=o.indexOf(`-`);c=e>-1?o.slice(0,e):o}return(e,t)=>{Wh(e,`element`,(e,n,i)=>{if(e.tagName!==`code`||!i||i.type!==`element`||i.tagName!==`pre`)return;let u=Bke(e);if(u===`no-highlight`||!u&&!r||u&&a?.includes(u))return;Array.isArray(e.properties.className)||(e.properties.className=[]),e.properties.className.includes(c)||e.properties.className.unshift(c);let d;try{d=u?l.highlight(u,qEe(i),{prefix:o}):l.highlightAuto(qEe(i),{prefix:o,subset:s})}catch(n){let r=n;if(u&&/Unknown language/.test(r.message)){t.message(`Cannot highlight as \`${u}\`, it's not registered`,{ancestors:[i,e],cause:r,place:e.position,ruleId:`missing-language`,source:`rehype-highlight`});return}throw r}!u&&d.data?.language&&e.properties.className.push(`language-`+d.data.language),d.children.length>0&&(e.children=d.children)})}}function Bke(e){let t=e.properties.className;if(!Array.isArray(t))return``;let n=t.reduce((e,t)=>{if(e)return e;let n=String(t);return n===`no-highlight`||n===`nohighlight`?`no-highlight`:n.slice(0,5)===`lang-`?n.slice(5):n.slice(0,9)===`language-`?n.slice(9):e},``);return Kh[n||``]||n}var Vke,Hke=s((()=>{oDe(),Rke(),Gh(),zEe(),Vke={}})),Uke=s((()=>{Hke()}));function Wg(e){return e?.type===`text`}function Wke(e){return e?.type===`element`}function Gke(e){return{type:`text`,value:e}}function Kke(){return{type:`text`,value:`
-`}}function qke(){return e=>{Wh(e,`element`,(e,t,n)=>{if(n?.type===`element`&&n.tagName===`pre`&&e.tagName===`code`){let t=0;e.children=Jke(e),e.children.forEach(e=>{if(e.type===`element`&&e.tagName===`span`){let n=e.children[e.children.length-1];n&&(!Wg(n)||Wg(n)&&!Gg(n))&&(e.children.push(Kke()),t++)}}),e.properties.style=[`--line-count: ${t};`,`--line-digits: ${t.toString().length};`]}})}}function Jke(e,t=[],n){let r=()=>t[t.length-1]??(t.push(Yke())&&t[t.length-1]||void 0);return e.children.forEach(i=>{if(Wg(i)&&Gg(i)){let a=i.value.split(/\n/);a.forEach((i,o)=>{n?r()?.children.push({...e,children:[Gke(i)]}):r()?.children.push(Gke(i)),o!==a.length-1&&t.push(Yke())})}else Wke(i)&&i.children.some(Gg)?Jke(i,t,!0):r()?.children.push(i)}),t}function Yke(...e){return{type:`element`,tagName:`span`,properties:{class:[`line`]},children:e}}function Gg(e){return Wg(e)&&/\r?\n/.test(e.value)||Wke(e)&&e.children.some(Gg)}var Xke=s((()=>{Gh()}));function Zke(e,t){let n=(typeof t?.maskCredentials==`string`?[t.maskCredentials]:t?.maskCredentials??[]).filter(e=>!(e.length<3)),r=`language-${Kh[t.lang]??t.lang}`,i=Ih().use(wwe,{fragment:!0}).use(Qke(e)).use(zke,{languages:t.languages}).use(t?.lineNumbers?qke:(()=>{})).use(kh).processSync(`<pre><code class="${r}"></code></pre>`).toString();return n.length?n.reduce((e,t)=>e.split(t).join(`<span class="credential"><span class="credential-value">${t}</span></span>`),i):i}function Qke(e){return()=>t=>{Wh(t,`element`,t=>{t.tagName===`code`&&t.children.push({type:`text`,value:e})})}}var $ke=s((()=>{Ewe(),cEe(),DEe(),Gh(),zEe(),Uke(),Xke()})),eAe=s((()=>{$ke()})),tAe,nAe=s((()=>{tAe=e=>{let t={className:`string`,begin:/"/,end:/"/,contains:[e.BACKSLASH_ESCAPE,{className:`variable`,begin:/\$\(/,end:/\)/,contains:[e.BACKSLASH_ESCAPE]}],relevance:0},n={className:`literal`,begin:/(--request|-X)\s/,contains:[{className:`symbol`,begin:/(get|post|delete|options|head|put|patch|trace|connect)/,end:/\s/,returnEnd:!0}],returnEnd:!0,relevance:10},r={className:`literal`,begin:/--/,end:/[\s"]/,returnEnd:!0,relevance:0},i={className:`literal`,begin:/-\w/,end:/[\s"]/,returnEnd:!0,relevance:0},a={className:`string`,begin:/\\"/,relevance:0},o={className:`string`,begin:/'/,end:/'/,relevance:0},s={className:`number`,variants:[{begin:e.C_NUMBER_RE}],relevance:0};return{name:`curl`,aliases:[`curl`],keywords:`curl`,case_insensitive:!0,contains:[n,r,i,t,a,o,e.APOS_STRING_MODE,e.QUOTE_STRING_MODE,s,{match:/(\/[a-z._-]+)+/}]}}})),Kg,rAe=s((()=>{LDe(),zDe(),cDe(),VDe(),UDe(),$De(),uDe(),tOe(),fDe(),mDe(),yDe(),rOe(),aOe(),xDe(),CDe(),sOe(),uOe(),gOe(),vOe(),xOe(),AOe(),MOe(),POe(),IOe(),TDe(),DDe(),ROe(),kDe(),BOe(),HOe(),WOe(),jDe(),NDe(),KOe(),JOe(),XOe(),QOe(),FDe(),cke(),uke(),fke(),Ske(),Tke(),Dke(),kke(),nAe(),Kg={bash:IDe,c:RDe,clojure:sDe,cpp:BDe,csharp:HDe,css:WDe,curl:tAe,dart:lDe,diff:eOe,docker:dDe,dockerfile:dDe,elixir:pDe,fsharp:vDe,go:nOe,graphql:iOe,haskell:bDe,html:Eke,http:SDe,ini:oOe,java:lOe,javascript:dOe,json:_Oe,kotlin:yOe,less:SOe,lua:jOe,makefile:NOe,markdown:FOe,matlab:wDe,nginx:EDe,objectivec:LOe,ocaml:ODe,perl:zOe,php:VOe,plaintext:UOe,powershell:ADe,properties:MDe,python:GOe,r:qOe,ruby:YOe,rust:ZOe,scala:PDe,scss:$Oe,shell:lke,sql:dke,swift:hke,toml:oOe,typescript:wke,xml:Eke,yaml:Oke}})),iAe=s((()=>{rAe()})),aAe=s((()=>{})),qg,oAe,Jg,sAe=s((()=>{aAe(),qg=typeof self==`object`?self:globalThis,oAe=(e,t)=>{let n=(t,n)=>(e.set(n,t),t),r=i=>{if(e.has(i))return e.get(i);let[a,o]=t[i];switch(a){case 0:case-1:return n(o,i);case 1:{let e=n([],i);for(let t of o)e.push(r(t));return e}case 2:{let e=n({},i);for(let[t,n]of o)e[r(t)]=r(n);return e}case 3:return n(new Date(o),i);case 4:{let{source:e,flags:t}=o;return n(new RegExp(e,t),i)}case 5:{let e=n(new Map,i);for(let[t,n]of o)e.set(r(t),r(n));return e}case 6:{let e=n(new Set,i);for(let t of o)e.add(r(t));return e}case 7:{let{name:e,message:t}=o;return n(new qg[e](t),i)}case 8:return n(BigInt(o),i);case`BigInt`:return n(Object(BigInt(o)),i)}return n(new qg[a](o),i)};return r},Jg=e=>oAe(new Map,e)(0)})),Yg,cAe,lAe,Xg,Zg,uAe,Qg,dAe=s((()=>{aAe(),Yg=``,{toString:cAe}={},{keys:lAe}=Object,Xg=e=>{let t=typeof e;if(t!==`object`||!e)return[0,t];let n=cAe.call(e).slice(8,-1);switch(n){case`Array`:return[1,Yg];case`Object`:return[2,Yg];case`Date`:return[3,Yg];case`RegExp`:return[4,Yg];case`Map`:return[5,Yg];case`Set`:return[6,Yg]}return n.includes(`Array`)?[1,n]:n.includes(`Error`)?[7,n]:[2,n]},Zg=([e,t])=>e===0&&(t===`function`||t===`symbol`),uAe=(e,t,n,r)=>{let i=(e,t)=>{let i=r.push(e)-1;return n.set(t,i),i},a=r=>{if(n.has(r))return n.get(r);let[o,s]=Xg(r);switch(o){case 0:{let t=r;switch(s){case`bigint`:o=8,t=r.toString();break;case`function`:case`symbol`:if(e)throw TypeError(`unable to serialize `+s);t=null;break;case`undefined`:return i([-1],r)}return i([o,t],r)}case 1:{if(s)return i([s,[...r]],r);let e=[],t=i([o,e],r);for(let t of r)e.push(a(t));return t}case 2:{if(s)switch(s){case`BigInt`:return i([s,r.toString()],r);case`Boolean`:case`Number`:case`String`:return i([s,r.valueOf()],r)}if(t&&`toJSON`in r)return a(r.toJSON());let n=[],c=i([o,n],r);for(let t of lAe(r))(e||!Zg(Xg(r[t])))&&n.push([a(t),a(r[t])]);return c}case 3:return i([o,r.toISOString()],r);case 4:{let{source:e,flags:t}=r;return i([o,{source:e,flags:t}],r)}case 5:{let t=[],n=i([o,t],r);for(let[n,i]of r)(e||!(Zg(Xg(n))||Zg(Xg(i))))&&t.push([a(n),a(i)]);return n}case 6:{let t=[],n=i([o,t],r);for(let n of r)(e||!Zg(Xg(n)))&&t.push(a(n));return n}}let{message:c}=r;return i([o,{name:s,message:c}],r)};return a},Qg=(e,{json:t,lossy:n}={})=>{let r=[];return uAe(!(t||n),!!t,new Map,r)(e),r}})),$g,e_=s((()=>{sAe(),dAe(),$g=typeof structuredClone==`function`?(e,t)=>t&&(`json`in t||`lossy`in t)?Jg(Qg(e,t)):structuredClone(e):(e,t)=>Jg(Qg(e,t))}));function fAe(e){if(typeof e!=`string`)throw TypeError(`Expected a \`string\`, got \`${typeof e}\``);return mAe.test(e)?!1:pAe.test(e)}var pAe,mAe,hAe=s((()=>{pAe=/^[a-zA-Z][a-zA-Z\d+\-.]*?:/,mAe=/^[a-zA-Z]:\\/}));function gAe(e){let t=e||yAe,n=t.protocols||_Ae,r=Xh(t.test);return function(e){Wh(e,`element`,function(e,i,a){if(e.tagName===`a`&&typeof e.properties.href==`string`&&r(e,i,a)){let r=e.properties.href;if(fAe(r)?n.includes(r.slice(0,r.indexOf(`:`))):r.startsWith(`//`)){let n=t_(t.content,e),r=n&&!Array.isArray(n)?[n]:n,i=t_(t.rel,e)||vAe,a=typeof i==`string`?Ap(i):i,o=t_(t.target,e),s=t_(t.properties,e);if(s&&Object.assign(e.properties,$g(s)),a.length>0&&(e.properties.rel=[...a]),o&&(e.properties.target=o),r){let n=t_(t.contentProperties,e)||{};e.children.push({type:`element`,tagName:`span`,properties:$g(n),children:$g(r)})}}}})}}function t_(e,t){return typeof e==`function`?e(t):e}var _Ae,vAe,yAe,bAe=s((()=>{e_(),Zh(),hAe(),jp(),Gh(),_Ae=[`http`,`https`],vAe=[`nofollow`],yAe={}})),xAe=s((()=>{bAe()})),n_,SAe=s((()=>{Zh(),n_=Xh(function(e){return e.tagName===`audio`||e.tagName===`canvas`||e.tagName===`embed`||e.tagName===`iframe`||e.tagName===`img`||e.tagName===`math`||e.tagName===`object`||e.tagName===`picture`||e.tagName===`svg`||e.tagName===`video`})})),r_=s((()=>{SAe()})),CAe,wAe=s((()=>{CAe=`address.article.aside.blockquote.body.br.caption.center.col.colgroup.dd.dialog.dir.div.dl.dt.figcaption.figure.footer.form.h1.h2.h3.h4.h5.h6.head.header.hgroup.hr.html.legend.li.li.listing.main.menu.nav.ol.optgroup.option.p.plaintext.pre.section.summary.table.tbody.td.td.tfoot.th.th.thead.tr.ul.wbr.xmp`.split(`.`)})),TAe,EAe=s((()=>{TAe=[`button`,`input`,`select`,`textarea`]})),DAe,OAe=s((()=>{DAe=[`area`,`base`,`basefont`,`dialog`,`datalist`,`head`,`link`,`meta`,`noembed`,`noframes`,`param`,`rp`,`script`,`source`,`style`,`template`,`track`,`title`]}));function kAe(e,t){AAe(e,{collapse:VAe((t||UAe).newlines?zAe:BAe),whitespace:`normal`})}function AAe(e,t){if(`children`in e){let n={...t};return(e.type===`root`||IAe(e))&&(n.before=!0,n.after=!0),n.whitespace=HAe(e,t),MAe(e,n)}if(e.type===`text`){if(t.whitespace===`normal`)return jAe(e,t);t.whitespace===`nowrap`&&(e.value=t.collapse(e.value))}return{ignore:i_(e),stripAtStart:!1,remove:!1}}function jAe(e,t){let n=t.collapse(e.value),r={ignore:!1,stripAtStart:!1,remove:!1},i=0,a=n.length;return t.before&&RAe(n.charAt(0))&&i++,i!==a&&RAe(n.charAt(a-1))&&(t.after?a--:r.stripAtStart=!0),i===a?r.remove=!0:e.value=n.slice(i,a),r}function MAe(e,t){let n=t.before,r=t.after,i=e.children,a=i.length,o=-1;for(;++o<a;){let e=AAe(i[o],{...t,after:NAe(i,o,r),before:n});e.remove?(i.splice(o,1),o--,a--):e.ignore||(n=e.stripAtStart),FAe(i[o])&&(n=!1)}return{ignore:!1,stripAtStart:!!(n||r),remove:!1}}function NAe(e,t,n){for(;++t<e.length;){let n=e[t],r=PAe(n);if(r===void 0&&`children`in n&&!LAe(n)&&(r=NAe(n.children,-1)),typeof r==`boolean`)return r}return n}function PAe(e){if(e.type===`element`){if(FAe(e))return!1;if(IAe(e))return!0}else if(e.type===`text`){if(!Sh(e))return!1}else if(!i_(e))return!1}function FAe(e){return n_(e)||Yh(e,TAe)}function IAe(e){return Yh(e,CAe)}function LAe(e){return!!(e.type===`element`&&e.properties.hidden)||i_(e)||Yh(e,DAe)}function RAe(e){return e===` `||e===`
-`}function zAe(e){let t=/\r?\n|\r/.exec(e);return t?t[0]:` `}function BAe(){return` `}function VAe(e){return t;function t(t){return String(t).replace(/[\t\n\v\f\r ]+/g,e)}}function HAe(e,t){if(`tagName`in e&&e.properties)switch(e.tagName){case`listing`:case`plaintext`:case`script`:case`style`:case`xmp`:return`pre`;case`nobr`:return`nowrap`;case`pre`:return e.properties.wrap?`pre-wrap`:`pre`;case`td`:case`th`:return e.properties.noWrap?`nowrap`:t.whitespace;case`textarea`:return`pre-wrap`;default:}return t.whitespace}var UAe,i_,WAe=s((()=>{r_(),Zh(),Ch(),zh(),wAe(),EAe(),OAe(),UAe={},i_=Rh([`comment`,`doctype`])})),GAe=s((()=>{WAe()}));function KAe(e,t){let n=e.type===`element`&&qAe.call(e.properties,t)&&e.properties[t];return n!=null&&n!==!1}var qAe,JAe=s((()=>{qAe={}.hasOwnProperty})),YAe=s((()=>{JAe()}));function XAe(e){if(e.type!==`element`||e.tagName!==`link`)return!1;if(e.properties.itemProp)return!0;let t=e.properties.rel,n=-1;if(!Array.isArray(t)||t.length===0)return!1;for(;++n<t.length;)if(!ZAe.has(String(t[n])))return!1;return!0}var ZAe,QAe=s((()=>{ZAe=new Set([`pingback`,`prefetch`,`stylesheet`])})),$Ae=s((()=>{QAe()}));function eje(e){return!!(e.type===`text`||tje(e)||n_(e)||XAe(e)||nje(e)&&KAe(e,`itemProp`))}var tje,nje,rje=s((()=>{r_(),YAe(),$Ae(),Zh(),tje=Xh(`a.abbr.area.b.bdi.bdo.br.button.cite.code.data.datalist.del.dfn.em.i.input.ins.kbd.keygen.label.map.mark.meter.noscript.output.progress.q.ruby.s.samp.script.select.small.span.strong.sub.sup.template.textarea.time.u.var.wbr`.split(`.`)),nje=Xh(`meta`)})),ije=s((()=>{rje()})),aje,oje=s((()=>{aje=[`pre`,`script`,`style`,`textarea`]})),sje=s((()=>{oje()}));function cje(e,t){let n=t||uje,r={blanks:n.blanks||[],head:!1,indentInitial:n.indentInitial!==!1,indent:typeof n.indent==`number`?` `.repeat(n.indent):typeof n.indent==`string`?n.indent:`  `};kAe(e,{newlines:!0}),Bh(e,i);function i(e,t){if(!(`children`in e))return;if(e.type===`element`&&e.tagName===`head`&&(r.head=!0),r.head&&e.type===`element`&&e.tagName===`body`&&(r.head=!1),e.type===`element`&&aje.includes(e.tagName))return Hh;if(e.children.length===0||!a_(r,e))return;let n=t.length;r.indentInitial||n--;let i=!1;for(let t of e.children)(t.type===`comment`||t.type===`text`)&&(t.value.includes(`
-`)&&(i=!0),t.value=t.value.replace(/ *\n/g,`$&`+r.indent.repeat(n)));let o=[],s;for(let t of e.children)(a_(r,t)||i&&!s)&&(a(o,n,t),i=!0),s=t,o.push(t);s&&(i||a_(r,s))&&(Sh(s)&&(o.pop(),s=o[o.length-1]),a(o,n-1)),e.children=o}function a(e,t,n){let i=e[e.length-1],a=(lje(r,i&&Sh(i)?e[e.length-2]:i)&&lje(r,n)?`
-
-`:`
-`)+r.indent.repeat(Math.max(t,0));i&&i.type===`text`?i.value=Sh(i)?a:i.value+a:e.push({type:`text`,value:a})}}function lje(e,t){return!!(t&&t.type===`element`&&e.blanks.length>0&&e.blanks.includes(t.tagName))}function a_(e,t){return t.type===`root`||(t.type===`element`?e.head||t.tagName===`script`||n_(t)||!eje(t):!1)}var uje,dje=s((()=>{r_(),GAe(),ije(),Ch(),sje(),Uh(),uje={}})),fje=s((()=>{dje()}));function pje(e){return function(t){cje(t,e)}}var mje=s((()=>{fje()})),hje=s((()=>{mje()}));function gje(e,t){let n=(t||wje).space;return c_(e,n===`svg`?Ep:Tp)}function _je(e,t){let n={nodeName:`#document`,mode:(e.data||{}).quirksMode?`quirks`:`no-quirks`,childNodes:[]};return n.childNodes=o_(e.children,n,t),s_(e,n),n}function vje(e,t){let n={nodeName:`#document-fragment`,childNodes:[]};return n.childNodes=o_(e.children,n,t),s_(e,n),n}function yje(e){let t={nodeName:`#documentType`,name:`html`,publicId:``,systemId:``,parentNode:null};return s_(e,t),t}function bje(e){let t={nodeName:`#text`,value:e.value,parentNode:null};return s_(e,t),t}function xje(e){let t={nodeName:`#comment`,data:e.value,parentNode:null};return s_(e,t),t}function Sje(e,t){let n=t,r=n;e.type===`element`&&e.tagName.toLowerCase()===`svg`&&n.space===`html`&&(r=Ep);let i=[],a;if(e.properties){for(a in e.properties)if(a!==`children`&&Tje.call(e.properties,a)){let t=Cje(r,a,e.properties[a]);t&&i.push(t)}}let o=r.space,s={nodeName:e.tagName,tagName:e.tagName,attrs:i,namespaceURI:Fp[o],childNodes:[],parentNode:null};return s.childNodes=o_(e.children,s,r),s_(e,s),e.tagName===`template`&&e.content&&(s.content=vje(e.content,r)),s}function Cje(e,t,n){let r=Cp(e,t);if(n===!1||n==null||typeof n==`number`&&Number.isNaN(n)||!n&&r.boolean)return;Array.isArray(n)&&(n=r.commaSeparated?Yye(n):$ye(n));let i={name:r.attribute,value:n===!0?``:String(n)};if(r.space&&r.space!==`html`&&r.space!==`svg`){let e=i.name.indexOf(`:`);e<0?i.prefix=``:(i.name=i.name.slice(e+1),i.prefix=r.attribute.slice(0,e)),i.namespace=Fp[r.space]}return i}function o_(e,t,n){let r=-1,i=[];if(e)for(;++r<e.length;){let a=c_(e[r],n);a.parentNode=t,i.push(a)}return i}function s_(e,t){let n=e.position;n&&n.start&&n.end&&(n.start.offset,n.end.offset,t.sourceCodeLocation={startLine:n.start.line,startCol:n.start.column,startOffset:n.start.offset,endLine:n.end.line,endCol:n.end.column,endOffset:n.end.offset})}var wje,Tje,c_,Eje=s((()=>{Op(),ep(),Dp(),jp(),Ip(),ph(),wje={},Tje={}.hasOwnProperty,c_=dh(`type`,{handlers:{root:_je,element:Sje,text:bje,comment:xje,doctype:yje}})})),Dje=s((()=>{Eje()}));function Oje(e){return t;function t(t){let n=t&&t.position&&t.position[e]||{};if(typeof n.line==`number`&&n.line>0&&typeof n.column==`number`&&n.column>0)return{line:n.line,column:n.column,offset:typeof n.offset==`number`&&n.offset>-1?n.offset:void 0}}}function kje(e){let t=u_(e),n=l_(e);if(t&&n)return{start:t,end:n}}var l_,u_,Aje=s((()=>{l_=Oje(`end`),u_=Oje(`start`)})),d_=s((()=>{Aje()}));function jje(e,t){let n=Wje(e),r=dh(`type`,{handlers:{root:Nje,element:Pje,text:Fje,comment:Rje,doctype:Ije,raw:zje},unknown:Bje}),i={parser:n?new Qm(m_):Qm.getFragmentParser(void 0,m_),handle(e){r(e,i)},stitches:!1,options:t||{}};r(e,i),f_(i,u_());let a=_be(n?i.parser.document:i.parser.getFragment(),{file:i.options.file});return i.stitches&&Wh(a,`comment`,function(e,t,n){let r=e;if(r.value.stitch&&n&&t!==void 0){let e=n.children;return e[t]=r.value.stitch,t}}),a.type===`root`&&a.children.length===1&&a.children[0].type===e.type?a.children[0]:a}function Mje(e,t){let n=-1;if(e)for(;++n<e.length;)t.handle(e[n])}function Nje(e,t){Mje(e.children,t)}function Pje(e,t){Hje(e,t),Mje(e.children,t),Uje(e,t)}function Fje(e,t){let n={type:Gp.CHARACTER,chars:e.value,location:p_(e)};f_(t,u_(e)),t.parser.currentToken=n,t.parser._processToken(t.parser.currentToken)}function Ije(e,t){let n={type:Gp.DOCTYPE,name:`html`,forceQuirks:!1,publicId:``,systemId:``,location:p_(e)};f_(t,u_(e)),t.parser.currentToken=n,t.parser._processToken(t.parser.currentToken)}function Lje(e,t){t.stitches=!0;let n=Gje(e);`children`in e&&`children`in n&&(n.children=jje({type:`root`,children:e.children},t.options).children),Rje({type:`comment`,value:{stitch:n}},t)}function Rje(e,t){let n=e.value,r={type:Gp.COMMENT,data:n,location:p_(e)};f_(t,u_(e)),t.parser.currentToken=r,t.parser._processToken(t.parser.currentToken)}function zje(e,t){if(t.parser.tokenizer.preprocessor.html=``,t.parser.tokenizer.preprocessor.pos=-1,t.parser.tokenizer.preprocessor.lastGapPos=-2,t.parser.tokenizer.preprocessor.gapStack=[],t.parser.tokenizer.preprocessor.skipNextNewLine=!1,t.parser.tokenizer.preprocessor.lastChunkWritten=!1,t.parser.tokenizer.preprocessor.endOfChunkHit=!1,t.parser.tokenizer.preprocessor.isEol=!1,Vje(t,u_(e)),t.parser.tokenizer.write(e.value,!1),t.parser.tokenizer._runParsingLoop(),t.parser.tokenizer.state===72||t.parser.tokenizer.state===78){t.parser.tokenizer.preprocessor.lastChunkWritten=!0;let e=t.parser.tokenizer._consume();t.parser.tokenizer._callState(e)}}function Bje(e,t){let n=e;if(t.options.passThrough&&t.options.passThrough.includes(n.type))Lje(n,t);else{let e=``;throw Kje.has(n.type)&&(e=". It looks like you are using MDX nodes with `hast-util-raw` (or `rehype-raw`). If you use this because you are using remark or rehype plugins that inject `'html'` nodes, then please raise an issue with that plugin, as its a bad and slow idea. If you use this because you are using markdown syntax, then you have to configure this utility (or plugin) to pass through these nodes (see `passThrough` in docs), but you can also migrate to use the MDX syntax"),Error("Cannot compile `"+n.type+"` node"+e)}}function f_(e,t){Vje(e,t);let n=e.parser.tokenizer.currentCharacterToken;n&&n.location&&(n.location.endLine=e.parser.tokenizer.preprocessor.line,n.location.endCol=e.parser.tokenizer.preprocessor.col+1,n.location.endOffset=e.parser.tokenizer.preprocessor.offset+1,e.parser.currentToken=n,e.parser._processToken(e.parser.currentToken)),e.parser.tokenizer.paused=!1,e.parser.tokenizer.inLoop=!1,e.parser.tokenizer.active=!1,e.parser.tokenizer.returnState=cm.DATA,e.parser.tokenizer.charRefCode=-1,e.parser.tokenizer.consumedAfterSnapshot=-1,e.parser.tokenizer.currentLocation=null,e.parser.tokenizer.currentCharacterToken=null,e.parser.tokenizer.currentToken=null,e.parser.tokenizer.currentAttr={name:``,value:``}}function Vje(e,t){if(t&&t.offset!==void 0){let n={startLine:t.line,startCol:t.column,startOffset:t.offset,endLine:-1,endCol:-1,endOffset:-1};e.parser.tokenizer.preprocessor.lineStartPos=-t.column+1,e.parser.tokenizer.preprocessor.droppedBufferSize=t.offset,e.parser.tokenizer.preprocessor.line=t.line,e.parser.tokenizer.currentLocation=n}}function Hje(e,t){let n=e.tagName.toLowerCase();if(t.parser.tokenizer.state===cm.PLAINTEXT)return;f_(t,u_(e));let r=t.parser.openElements.current,i=`namespaceURI`in r?r.namespaceURI:Fp.html;i===Fp.html&&n===`svg`&&(i=Fp.svg);let a=gje({...e,children:[]},{space:i===Fp.svg?`svg`:`html`}),o={type:Gp.START_TAG,tagName:n,tagID:Qp(n),selfClosing:!1,ackSelfClosing:!1,attrs:`attrs`in a?a.attrs:[],location:p_(e)};t.parser.currentToken=o,t.parser._processToken(t.parser.currentToken),t.parser.tokenizer.lastStartTagName=n}function Uje(e,t){let n=e.tagName.toLowerCase();if(!t.parser.tokenizer.inForeignNode&&uh.includes(n)||t.parser.tokenizer.state===cm.PLAINTEXT)return;f_(t,l_(e));let r={type:Gp.END_TAG,tagName:n,tagID:Qp(n),selfClosing:!1,ackSelfClosing:!1,attrs:[],location:p_(e)};t.parser.currentToken=r,t.parser._processToken(t.parser.currentToken),n===t.parser.tokenizer.lastStartTagName&&(t.parser.tokenizer.state===cm.RCDATA||t.parser.tokenizer.state===cm.RAWTEXT||t.parser.tokenizer.state===cm.SCRIPT_DATA)&&(t.parser.tokenizer.state=cm.DATA)}function Wje(e){let t=e.type===`root`?e.children[0]:e;return!!(t&&(t.type===`doctype`||t.type===`element`&&t.tagName.toLowerCase()===`html`))}function p_(e){let t=u_(e)||{line:void 0,column:void 0,offset:void 0},n=l_(e)||{line:void 0,column:void 0,offset:void 0};return{startLine:t.line,startCol:t.column,startOffset:t.offset,endLine:n.line,endCol:n.column,endOffset:n.offset}}function Gje(e){return`children`in e?$g({...e,children:[]}):$g(e)}var Kje,m_,qje=s((()=>{e_(),wbe(),Dje(),Dwe(),RCe(),d_(),Gh(),Ip(),ph(),Kje=new Set([`mdxFlowExpression`,`mdxJsxFlowElement`,`mdxJsxTextElement`,`mdxTextExpression`,`mdxjsEsm`]),m_={sourceCodeLocationInfo:!0,scriptingEnabled:!1}})),Jje=s((()=>{qje()}));function Yje(e){return function(t,n){return jje(t,{...e,file:n})}}var Xje=s((()=>{Jje()})),Zje=s((()=>{Xje()})),h_,g_,Qje=s((()=>{h_=[`ariaDescribedBy`,`ariaLabel`,`ariaLabelledBy`],g_={ancestors:{tbody:[`table`],td:[`table`],th:[`table`],thead:[`table`],tfoot:[`table`],tr:[`table`]},attributes:{a:[...h_,`dataFootnoteBackref`,`dataFootnoteRef`,[`className`,`data-footnote-backref`],`href`],blockquote:[`cite`],code:[[`className`,/^language-./]],del:[`cite`],div:[`itemScope`,`itemType`],dl:[...h_],h2:[[`className`,`sr-only`]],img:[...h_,`longDesc`,`src`],input:[[`disabled`,!0],[`type`,`checkbox`]],ins:[`cite`],li:[[`className`,`task-list-item`]],ol:[...h_,[`className`,`contains-task-list`]],q:[`cite`],section:[`dataFootnotes`,[`className`,`footnotes`]],source:[`srcSet`],summary:[...h_],table:[...h_],ul:[...h_,[`className`,`contains-task-list`]],"*":`abbr.accept.acceptCharset.accessKey.action.align.alt.axis.border.cellPadding.cellSpacing.char.charOff.charSet.checked.clear.colSpan.color.cols.compact.coords.dateTime.dir.encType.frame.hSpace.headers.height.hrefLang.htmlFor.id.isMap.itemProp.label.lang.maxLength.media.method.multiple.name.noHref.noShade.noWrap.open.prompt.readOnly.rev.rowSpan.rows.rules.scope.selected.shape.size.span.start.summary.tabIndex.title.useMap.vAlign.value.width`.split(`.`)},clobber:[`ariaDescribedBy`,`ariaLabelledBy`,`id`,`name`],clobberPrefix:`user-content-`,protocols:{cite:[`http`,`https`],href:[`http`,`https`,`irc`,`ircs`,`mailto`,`xmpp`],longDesc:[`http`,`https`],src:[`http`,`https`]},required:{input:{disabled:!0,type:`checkbox`}},strip:[`script`],tagNames:`a.b.blockquote.br.code.dd.del.details.div.dl.dt.em.h1.h2.h3.h4.h5.h6.hr.i.img.input.ins.kbd.li.ol.p.picture.pre.q.rp.rt.ruby.s.samp.section.source.span.strike.strong.sub.summary.sup.table.tbody.td.tfoot.th.thead.tr.tt.ul.var`.split(`.`)}}));function $je(e,t){let n={type:`root`,children:[]},r=eMe({schema:t?{...g_,...t}:g_,stack:[]},e);return r&&(Array.isArray(r)?r.length===1?n=r[0]:n.children=r:n=r),n}function eMe(e,t){if(t&&typeof t==`object`){let n=t;switch(typeof n.type==`string`?n.type:``){case`comment`:return tMe(e,n);case`doctype`:return nMe(e,n);case`element`:return rMe(e,n);case`root`:return iMe(e,n);case`text`:return aMe(e,n);default:}}}function tMe(e,t){if(e.schema.allowComments){let e=typeof t.value==`string`?t.value:``,n=e.indexOf(`-->`),r={type:`comment`,value:n<0?e:e.slice(0,n)};return __(r,t),r}}function nMe(e,t){if(e.schema.allowDoctypes){let e={type:`doctype`};return __(e,t),e}}function rMe(e,t){let n=typeof t.tagName==`string`?t.tagName:``;e.stack.push(n);let r=oMe(e,t.children),i=sMe(e,t.properties);e.stack.pop();let a=!1;if(n&&n!==`*`&&(!e.schema.tagNames||e.schema.tagNames.includes(n))&&(a=!0,e.schema.ancestors&&v_.call(e.schema.ancestors,n))){let t=e.schema.ancestors[n],r=-1;for(a=!1;++r<t.length;)e.stack.includes(t[r])&&(a=!0)}if(!a)return e.schema.strip&&!e.schema.strip.includes(n)?r:void 0;let o={type:`element`,tagName:n,properties:i,children:r};return __(o,t),o}function iMe(e,t){let n={type:`root`,children:oMe(e,t.children)};return __(n,t),n}function aMe(e,t){let n={type:`text`,value:typeof t.value==`string`?t.value:``};return __(n,t),n}function oMe(e,t){let n=[];if(Array.isArray(t)){let r=t,i=-1;for(;++i<r.length;){let t=eMe(e,r[i]);t&&(Array.isArray(t)?n.push(...t):n.push(t))}}return n}function sMe(e,t){let n=e.stack[e.stack.length-1],r=e.schema.attributes,i=e.schema.required,a=r&&v_.call(r,n)?r[n]:void 0,o=r&&v_.call(r,`*`)?r[`*`]:void 0,s=t&&typeof t==`object`?t:{},c={},l;for(l in s)if(v_.call(s,l)){let t=s[l],n=cMe(e,fMe(a,l),l,t);n??=cMe(e,fMe(o,l),l,t),n!=null&&(c[l]=n)}if(i&&v_.call(i,n)){let e=i[n];for(l in e)v_.call(e,l)&&!v_.call(c,l)&&(c[l]=e[l])}return c}function cMe(e,t,n,r){return t?Array.isArray(r)?lMe(e,t,n,r):uMe(e,t,n,r):void 0}function lMe(e,t,n,r){let i=-1,a=[];for(;++i<r.length;){let o=uMe(e,t,n,r[i]);(typeof o==`number`||typeof o==`string`)&&a.push(o)}return a}function uMe(e,t,n,r){if(!(typeof r!=`boolean`&&typeof r!=`number`&&typeof r!=`string`)&&dMe(e,n,r)){if(typeof t==`object`&&t.length>1){let e=!1,n=0;for(;++n<t.length;){let i=t[n];if(i&&typeof i==`object`&&`flags`in i){if(i.test(String(r))){e=!0;break}}else if(i===r){e=!0;break}}if(!e)return}return e.schema.clobber&&e.schema.clobberPrefix&&e.schema.clobber.includes(n)?e.schema.clobberPrefix+r:r}}function dMe(e,t,n){let r=e.schema.protocols&&v_.call(e.schema.protocols,t)?e.schema.protocols[t]:void 0;if(!r||r.length===0)return!0;let i=String(n),a=i.indexOf(`:`),o=i.indexOf(`?`),s=i.indexOf(`#`),c=i.indexOf(`/`);if(a<0||c>-1&&a>c||o>-1&&a>o||s>-1&&a>s)return!0;let l=-1;for(;++l<r.length;){let e=r[l];if(a===e.length&&i.slice(0,e.length)===e)return!0}return!1}function __(e,t){let n=kje(t);t.data&&(e.data=$g(t.data)),n&&(e.position=n)}function fMe(e,t){let n,r=-1;if(e)for(;++r<e.length;){let i=e[r],a=typeof i==`string`?i:i[0];if(a===t)return i;a===`data*`&&(n=i)}if(t.length>4&&t.slice(0,4).toLowerCase()===`data`)return n}var v_,pMe=s((()=>{e_(),d_(),Qje(),v_={}.hasOwnProperty})),mMe=s((()=>{pMe(),Qje()}));function hMe(e){return function(t){return $je(t,e)}}var gMe=s((()=>{mMe()})),_Me=s((()=>{mMe(),gMe()}));function y_(e){return e!==null&&(e<32||e===127)}function b_(e){return e!==null&&e<-2}function x_(e){return e!==null&&(e<0||e===32)}function S_(e){return e===-2||e===-1||e===32}function C_(e){return t;function t(t){return t!==null&&t>-1&&e.test(String.fromCharCode(t))}}var w_,T_,vMe,E_,yMe,bMe,D_,O_,k_=s((()=>{w_=C_(/[A-Za-z]/),T_=C_(/[\dA-Za-z]/),vMe=C_(/[#-'*+\--9=?A-Z^-~]/),E_=C_(/\d/),yMe=C_(/[\dA-Fa-f]/),bMe=C_(/[!-/:-@[-`{-~]/),D_=C_(/\p{P}|\p{S}/u),O_=C_(/\s/)}));function xMe(e){if(typeof e!=`string`)throw TypeError(`Expected a string`);return e.replace(/[|\\{}()[\]^$+*?.]/g,`\\$&`).replace(/-/g,`\\x2d`)}var SMe=s((()=>{}));function CMe(e,t,n){let r=Rh((n||{}).ignore||[]),i=wMe(t),a=-1;for(;++a<i.length;)Bh(e,`text`,o);function o(e,t){let n=-1,i;for(;++n<t.length;){let e=t[n],a=i?i.children:void 0;if(r(e,a?a.indexOf(e):void 0,i))return;i=e}if(i)return s(e,t)}function s(e,t){let n=t[t.length-1],r=i[a][0],o=i[a][1],s=0,c=n.children.indexOf(e),l=!1,u=[];r.lastIndex=0;let d=r.exec(e.value);for(;d;){let n=d.index,i={index:d.index,input:d.input,stack:[...t,e]},a=o(...d,i);if(typeof a==`string`&&(a=a.length>0?{type:`text`,value:a}:void 0),a===!1?r.lastIndex=n+1:(s!==n&&u.push({type:`text`,value:e.value.slice(s,n)}),Array.isArray(a)?u.push(...a):a&&u.push(a),s=n+d[0].length,l=!0),!r.global)break;d=r.exec(e.value)}return l?(s<e.value.length&&u.push({type:`text`,value:e.value.slice(s)}),n.children.splice(c,1,...u)):u=[e],c+u.length}}function wMe(e){let t=[];if(!Array.isArray(e))throw TypeError(`Expected find and replace tuple or list of tuples`);let n=!e[0]||Array.isArray(e[0])?e:[e],r=-1;for(;++r<n.length;){let e=n[r];t.push([TMe(e[0]),EMe(e[1])])}return t}function TMe(e){return typeof e==`string`?new RegExp(xMe(e),`g`):e}function EMe(e){return typeof e==`function`?e:function(){return e}}var DMe=s((()=>{SMe(),Uh(),zh()})),OMe=s((()=>{DMe()}));function kMe(){return{transforms:[IMe],enter:{literalAutolink:jMe,literalAutolinkEmail:A_,literalAutolinkHttp:A_,literalAutolinkWww:A_},exit:{literalAutolink:FMe,literalAutolinkEmail:PMe,literalAutolinkHttp:MMe,literalAutolinkWww:NMe}}}function AMe(){return{unsafe:[{character:`@`,before:`[+\\-.\\w]`,after:`[\\-.\\w]`,inConstruct:j_,notInConstruct:M_},{character:`.`,before:`[Ww]`,after:`[\\-.\\w]`,inConstruct:j_,notInConstruct:M_},{character:`:`,before:`[ps]`,after:`\\/`,inConstruct:j_,notInConstruct:M_}]}}function jMe(e){this.enter({type:`link`,title:null,url:``,children:[]},e)}function A_(e){this.config.enter.autolinkProtocol.call(this,e)}function MMe(e){this.config.exit.autolinkProtocol.call(this,e)}function NMe(e){this.config.exit.data.call(this,e);let t=this.stack[this.stack.length-1];t.type,t.url=`http://`+this.sliceSerialize(e)}function PMe(e){this.config.exit.autolinkEmail.call(this,e)}function FMe(e){this.exit(e)}function IMe(e){CMe(e,[[/(https?:\/\/|www(?=\.))([-.\w]+)([^ \t\r\n]*)/gi,LMe],[/([-.\w+]+)@([-\w]+(?:\.[-\w]+)+)/g,RMe]],{ignore:[`link`,`linkReference`]})}function LMe(e,t,n,r,i){let a=``;if(!VMe(i)||(/^w/i.test(t)&&(n=t+n,t=``,a=`http://`),!zMe(n)))return!1;let o=BMe(n+r);if(!o[0])return!1;let s={type:`link`,title:null,url:a+t+o[0],children:[{type:`text`,value:t+o[0]}]};return o[1]?[s,{type:`text`,value:o[1]}]:s}function RMe(e,t,n,r){return!VMe(r,!0)||/[-\d_]$/.test(n)?!1:{type:`link`,title:null,url:`mailto:`+t+`@`+n,children:[{type:`text`,value:t+`@`+n}]}}function zMe(e){let t=e.split(`.`);return!(t.length<2||t[t.length-1]&&(/_/.test(t[t.length-1])||!/[a-zA-Z\d]/.test(t[t.length-1]))||t[t.length-2]&&(/_/.test(t[t.length-2])||!/[a-zA-Z\d]/.test(t[t.length-2])))}function BMe(e){let t=/[!"&'),.:;<>?\]}]+$/.exec(e);if(!t)return[e,void 0];e=e.slice(0,t.index);let n=t[0],r=n.indexOf(`)`),i=xh(e,`(`),a=xh(e,`)`);for(;r!==-1&&i>a;)e+=n.slice(0,r+1),n=n.slice(r+1),r=n.indexOf(`)`),a++;return[e,n]}function VMe(e,t){let n=e.input.charCodeAt(e.index-1);return(e.index===0||O_(n)||D_(n))&&(!t||n!==47)}var j_,M_,HMe=s((()=>{oTe(),ep(),k_(),OMe(),j_=`phrasing`,M_=[`autolink`,`link`,`image`,`label`]})),UMe=s((()=>{HMe()}));function N_(e){return e.replace(/[\t\n\r ]+/g,` `).replace(/^ | $/g,``).toLowerCase().toUpperCase()}var P_=s((()=>{}));function WMe(){return{enter:{gfmFootnoteDefinition:KMe,gfmFootnoteDefinitionLabelString:qMe,gfmFootnoteCall:XMe,gfmFootnoteCallString:ZMe},exit:{gfmFootnoteDefinition:YMe,gfmFootnoteDefinitionLabelString:JMe,gfmFootnoteCall:$Me,gfmFootnoteCallString:QMe}}}function GMe(){return{unsafe:[{character:`[`,inConstruct:[`phrasing`,`label`,`reference`]}],handlers:{footnoteDefinition:nNe,footnoteReference:eNe}}}function KMe(e){this.enter({type:`footnoteDefinition`,identifier:``,label:``,children:[]},e)}function qMe(){this.buffer()}function JMe(e){let t=this.resume(),n=this.stack[this.stack.length-1];n.type,n.label=t,n.identifier=N_(this.sliceSerialize(e)).toLowerCase()}function YMe(e){this.exit(e)}function XMe(e){this.enter({type:`footnoteReference`,identifier:``,label:``},e)}function ZMe(){this.buffer()}function QMe(e){let t=this.resume(),n=this.stack[this.stack.length-1];n.type,n.label=t,n.identifier=N_(this.sliceSerialize(e)).toLowerCase()}function $Me(e){this.exit(e)}function eNe(e,t,n,r){let i=n.createTracker(r),a=i.move(`[^`),o=n.enter(`footnoteReference`),s=n.enter(`reference`);return a+=i.move(n.safe(n.associationId(e),{...i.current(),before:a,after:`]`})),s(),o(),a+=i.move(`]`),a}function tNe(){return`[`}function nNe(e,t,n,r){let i=n.createTracker(r),a=i.move(`[^`),o=n.enter(`footnoteDefinition`),s=n.enter(`label`);return a+=i.move(n.safe(n.associationId(e),{...i.current(),before:a,after:`]`})),s(),a+=i.move(`]:`+(e.children&&e.children.length>0?` `:``)),i.shift(4),a+=i.move(n.indentLines(n.containerFlow(e,i.current()),rNe)),o(),a}function rNe(e,t,n){return t===0?e:(n?``:`    `)+e}var iNe=s((()=>{ep(),P_(),eNe.peek=tNe})),aNe=s((()=>{iNe()}));function oNe(){return{canContainEols:[`delete`],enter:{strikethrough:cNe},exit:{strikethrough:lNe}}}function sNe(){return{unsafe:[{character:`~`,inConstruct:`phrasing`,notInConstruct:fNe}],handlers:{delete:uNe}}}function cNe(e){this.enter({type:`delete`,children:[]},e)}function lNe(e){this.exit(e)}function uNe(e,t,n,r){let i=n.createTracker(r),a=n.enter(`strikethrough`),o=i.move(`~~`);return o+=n.containerPhrasing(e,{...i.current(),before:o,after:`~`}),o+=i.move(`~~`),a(),o}function dNe(){return`~`}var fNe,pNe=s((()=>{fNe=[`autolink`,`destinationLiteral`,`destinationRaw`,`reference`,`titleQuote`,`titleApostrophe`],uNe.peek=dNe})),mNe=s((()=>{pNe()}));function hNe(e,t={}){let n=(t.align||[]).concat(),r=t.stringLength||_Ne,i=[],a=[],o=[],s=[],c=0,l=-1;for(;++l<e.length;){let n=[],i=[],u=-1;for(e[l].length>c&&(c=e[l].length);++u<e[l].length;){let a=gNe(e[l][u]);if(t.alignDelimiters!==!1){let e=r(a);i[u]=e,(s[u]===void 0||e>s[u])&&(s[u]=e)}n.push(a)}a[l]=n,o[l]=i}let u=-1;if(typeof n==`object`&&`length`in n)for(;++u<c;)i[u]=vNe(n[u]);else{let e=vNe(n);for(;++u<c;)i[u]=e}u=-1;let d=[],f=[];for(;++u<c;){let e=i[u],n=``,r=``;e===99?(n=`:`,r=`:`):e===108?n=`:`:e===114&&(r=`:`);let a=t.alignDelimiters===!1?1:Math.max(1,s[u]-n.length-r.length),o=n+`-`.repeat(a)+r;t.alignDelimiters!==!1&&(a=n.length+a+r.length,a>s[u]&&(s[u]=a),f[u]=a),d[u]=o}a.splice(1,0,d),o.splice(1,0,f),l=-1;let p=[];for(;++l<a.length;){let e=a[l],n=o[l];u=-1;let r=[];for(;++u<c;){let a=e[u]||``,o=``,l=``;if(t.alignDelimiters!==!1){let e=s[u]-(n[u]||0),t=i[u];t===114?o=` `.repeat(e):t===99?e%2?(o=` `.repeat(e/2+.5),l=` `.repeat(e/2-.5)):(o=` `.repeat(e/2),l=o):l=` `.repeat(e)}t.delimiterStart!==!1&&!u&&r.push(`|`),t.padding!==!1&&!(t.alignDelimiters===!1&&a===``)&&(t.delimiterStart!==!1||u)&&r.push(` `),t.alignDelimiters!==!1&&r.push(o),r.push(a),t.alignDelimiters!==!1&&r.push(l),t.padding!==!1&&r.push(` `),(t.delimiterEnd!==!1||u!==c-1)&&r.push(`|`)}p.push(t.delimiterEnd===!1?r.join(``).replace(/ +$/,``):r.join(``))}return p.join(`
-`)}function gNe(e){return e==null?``:String(e)}function _Ne(e){return e.length}function vNe(e){let t=typeof e==`string`?e.codePointAt(0):0;return t===67||t===99?99:t===76||t===108?108:t===82||t===114?114:0}var yNe=s((()=>{}));function bNe(e,t){let n=-1,r;if(t.extensions)for(;++n<t.extensions.length;)bNe(e,t.extensions[n]);for(r in t)if(CNe.call(t,r))switch(r){case`extensions`:break;case`unsafe`:xNe(e[r],t[r]);break;case`join`:xNe(e[r],t[r]);break;case`handlers`:SNe(e[r],t[r]);break;default:e.options[r]=t[r]}return e}function xNe(e,t){t&&e.push(...t)}function SNe(e,t){t&&Object.assign(e,t)}var CNe,wNe=s((()=>{CNe={}.hasOwnProperty}));function TNe(e,t,n,r){let i=n.enter(`blockquote`),a=n.createTracker(r);a.move(`> `),a.shift(2);let o=n.indentLines(n.containerFlow(e,a.current()),ENe);return i(),o}function ENe(e,t,n){return`>`+(n?``:` `)+e}var DNe=s((()=>{}));function ONe(e,t){return kNe(e,t.inConstruct,!0)&&!kNe(e,t.notInConstruct,!1)}function kNe(e,t,n){if(typeof t==`string`&&(t=[t]),!t||t.length===0)return n;let r=-1;for(;++r<t.length;)if(e.includes(t[r]))return!0;return!1}var ANe=s((()=>{}));function jNe(e,t,n,r){let i=-1;for(;++i<n.unsafe.length;)if(n.unsafe[i].character===`
-`&&ONe(n.stack,n.unsafe[i]))return/[ \t]/.test(r.before)?``:` `;return`\\
-`}var MNe=s((()=>{ANe()}));function NNe(e,t){let n=String(e),r=n.indexOf(t),i=r,a=0,o=0;if(typeof t!=`string`)throw TypeError(`Expected substring`);for(;r!==-1;)r===i?++a>o&&(o=a):a=1,i=r+t.length,r=n.indexOf(t,i);return o}var PNe=s((()=>{}));function F_(e,t){return!!(t.options.fences===!1&&e.value&&!e.lang&&/[^ \r\n]/.test(e.value)&&!/^[\t ]*(?:[\r\n]|$)|(?:^|[\r\n])[\t ]*$/.test(e.value))}var FNe=s((()=>{}));function INe(e){let t=e.options.fence||"`";if(t!=="`"&&t!==`~`)throw Error("Cannot serialize code with `"+t+"` for `options.fence`, expected `` ` `` or `~`");return t}var LNe=s((()=>{}));function RNe(e,t,n,r){let i=INe(n),a=e.value||``,o=i==="`"?`GraveAccent`:`Tilde`;if(F_(e,n)){let e=n.enter(`codeIndented`),t=n.indentLines(a,zNe);return e(),t}let s=n.createTracker(r),c=i.repeat(Math.max(NNe(a,i)+1,3)),l=n.enter(`codeFenced`),u=s.move(c);if(e.lang){let t=n.enter(`codeFencedLang${o}`);u+=s.move(n.safe(e.lang,{before:u,after:` `,encode:["`"],...s.current()})),t()}if(e.lang&&e.meta){let t=n.enter(`codeFencedMeta${o}`);u+=s.move(` `),u+=s.move(n.safe(e.meta,{before:u,after:`
-`,encode:["`"],...s.current()})),t()}return u+=s.move(`
-`),a&&(u+=s.move(a+`
-`)),u+=s.move(c),l(),u}function zNe(e,t,n){return(n?``:`    `)+e}var BNe=s((()=>{PNe(),FNe(),LNe()}));function I_(e){let t=e.options.quote||`"`;if(t!==`"`&&t!==`'`)throw Error("Cannot serialize title with `"+t+"` for `options.quote`, expected `\"`, or `'`");return t}var L_=s((()=>{}));function VNe(e,t,n,r){let i=I_(n),a=i===`"`?`Quote`:`Apostrophe`,o=n.enter(`definition`),s=n.enter(`label`),c=n.createTracker(r),l=c.move(`[`);return l+=c.move(n.safe(n.associationId(e),{before:l,after:`]`,...c.current()})),l+=c.move(`]: `),s(),!e.url||/[\0- \u007F]/.test(e.url)?(s=n.enter(`destinationLiteral`),l+=c.move(`<`),l+=c.move(n.safe(e.url,{before:l,after:`>`,...c.current()})),l+=c.move(`>`)):(s=n.enter(`destinationRaw`),l+=c.move(n.safe(e.url,{before:l,after:e.title?` `:`
-`,...c.current()}))),s(),e.title&&(s=n.enter(`title${a}`),l+=c.move(` `+i),l+=c.move(n.safe(e.title,{before:l,after:i,...c.current()})),l+=c.move(i),s()),o(),l}var HNe=s((()=>{L_()}));function UNe(e){let t=e.options.emphasis||`*`;if(t!==`*`&&t!==`_`)throw Error("Cannot serialize emphasis with `"+t+"` for `options.emphasis`, expected `*`, or `_`");return t}var WNe=s((()=>{}));function GNe(e,t,n,r){let i=UNe(n),a=n.enter(`emphasis`),o=n.createTracker(r),s=o.move(i);return s+=o.move(n.containerPhrasing(e,{before:s,after:i,...o.current()})),s+=o.move(i),a(),s}function KNe(e,t,n){return n.options.emphasis||`*`}var qNe=s((()=>{WNe(),GNe.peek=KNe}));function R_(e,t){let n=t||ZNe;return JNe(e,typeof n.includeImageAlt==`boolean`?n.includeImageAlt:!0,typeof n.includeHtml==`boolean`?n.includeHtml:!0)}function JNe(e,t,n){if(XNe(e)){if(`value`in e)return e.type===`html`&&!n?``:e.value;if(t&&`alt`in e&&e.alt)return e.alt;if(`children`in e)return YNe(e.children,t,n)}return Array.isArray(e)?YNe(e,t,n):``}function YNe(e,t,n){let r=[],i=-1;for(;++i<e.length;)r[i]=JNe(e[i],t,n);return r.join(``)}function XNe(e){return!!(e&&typeof e==`object`)}var ZNe,QNe=s((()=>{ZNe={}})),z_=s((()=>{QNe()}));function $Ne(e,t){let n=!1;return Wh(e,function(e){if(`value`in e&&/\r?\n|\r/.test(e.value)||e.type===`break`)return n=!0,!1}),!!((!e.depth||e.depth<3)&&R_(e)&&(t.options.setext||n))}var ePe=s((()=>{Gh(),z_()}));function tPe(e,t,n,r){let i=Math.max(Math.min(6,e.depth||1),1),a=n.createTracker(r);if($Ne(e,n)){let t=n.enter(`headingSetext`),r=n.enter(`phrasing`),o=n.containerPhrasing(e,{...a.current(),before:`
-`,after:`
-`});return r(),t(),o+`
-`+(i===1?`=`:`-`).repeat(o.length-(Math.max(o.lastIndexOf(`\r`),o.lastIndexOf(`
-`))+1))}let o=`#`.repeat(i),s=n.enter(`headingAtx`),c=n.enter(`phrasing`);a.move(o+` `);let l=n.containerPhrasing(e,{before:`# `,after:`
-`,...a.current()});return/^[\t ]/.test(l)&&(l=`&#x`+l.charCodeAt(0).toString(16).toUpperCase()+`;`+l.slice(1)),l=l?o+` `+l:o,n.options.closeAtx&&(l+=` `+o),c(),s(),l}var nPe=s((()=>{ePe()}));function rPe(e){return e.value||``}function iPe(){return`<`}var aPe=s((()=>{rPe.peek=iPe}));function oPe(e,t,n,r){let i=I_(n),a=i===`"`?`Quote`:`Apostrophe`,o=n.enter(`image`),s=n.enter(`label`),c=n.createTracker(r),l=c.move(`![`);return l+=c.move(n.safe(e.alt,{before:l,after:`]`,...c.current()})),l+=c.move(`](`),s(),!e.url&&e.title||/[\0- \u007F]/.test(e.url)?(s=n.enter(`destinationLiteral`),l+=c.move(`<`),l+=c.move(n.safe(e.url,{before:l,after:`>`,...c.current()})),l+=c.move(`>`)):(s=n.enter(`destinationRaw`),l+=c.move(n.safe(e.url,{before:l,after:e.title?` `:`)`,...c.current()}))),s(),e.title&&(s=n.enter(`title${a}`),l+=c.move(` `+i),l+=c.move(n.safe(e.title,{before:l,after:i,...c.current()})),l+=c.move(i),s()),l+=c.move(`)`),o(),l}function sPe(){return`!`}var cPe=s((()=>{L_(),oPe.peek=sPe}));function lPe(e,t,n,r){let i=e.referenceType,a=n.enter(`imageReference`),o=n.enter(`label`),s=n.createTracker(r),c=s.move(`![`),l=n.safe(e.alt,{before:c,after:`]`,...s.current()});c+=s.move(l+`][`),o();let u=n.stack;n.stack=[],o=n.enter(`reference`);let d=n.safe(n.associationId(e),{before:c,after:`]`,...s.current()});return o(),n.stack=u,a(),i===`full`||!l||l!==d?c+=s.move(d+`]`):i===`shortcut`?c=c.slice(0,-1):c+=s.move(`]`),c}function uPe(){return`!`}var dPe=s((()=>{lPe.peek=uPe}));function fPe(e,t,n){let r=e.value||``,i="`",a=-1;for(;RegExp("(^|[^`])"+i+"([^`]|$)").test(r);)i+="`";for(/[^ \r\n]/.test(r)&&(/^[ \r\n]/.test(r)&&/[ \r\n]$/.test(r)||/^`|`$/.test(r))&&(r=` `+r+` `);++a<n.unsafe.length;){let e=n.unsafe[a],t=n.compilePattern(e),i;if(e.atBreak)for(;i=t.exec(r);){let e=i.index;r.charCodeAt(e)===10&&r.charCodeAt(e-1)===13&&e--,r=r.slice(0,e)+` `+r.slice(i.index+1)}}return i+r+i}function pPe(){return"`"}var mPe=s((()=>{fPe.peek=pPe}));function hPe(e,t){let n=R_(e);return!!(!t.options.resourceLink&&e.url&&!e.title&&e.children&&e.children.length===1&&e.children[0].type===`text`&&(n===e.url||`mailto:`+n===e.url)&&/^[a-z][a-z+.-]+:/i.test(e.url)&&!/[\0- <>\u007F]/.test(e.url))}var gPe=s((()=>{z_()}));function _Pe(e,t,n,r){let i=I_(n),a=i===`"`?`Quote`:`Apostrophe`,o=n.createTracker(r),s,c;if(hPe(e,n)){let t=n.stack;n.stack=[],s=n.enter(`autolink`);let r=o.move(`<`);return r+=o.move(n.containerPhrasing(e,{before:r,after:`>`,...o.current()})),r+=o.move(`>`),s(),n.stack=t,r}s=n.enter(`link`),c=n.enter(`label`);let l=o.move(`[`);return l+=o.move(n.containerPhrasing(e,{before:l,after:`](`,...o.current()})),l+=o.move(`](`),c(),!e.url&&e.title||/[\0- \u007F]/.test(e.url)?(c=n.enter(`destinationLiteral`),l+=o.move(`<`),l+=o.move(n.safe(e.url,{before:l,after:`>`,...o.current()})),l+=o.move(`>`)):(c=n.enter(`destinationRaw`),l+=o.move(n.safe(e.url,{before:l,after:e.title?` `:`)`,...o.current()}))),c(),e.title&&(c=n.enter(`title${a}`),l+=o.move(` `+i),l+=o.move(n.safe(e.title,{before:l,after:i,...o.current()})),l+=o.move(i),c()),l+=o.move(`)`),s(),l}function vPe(e,t,n){return hPe(e,n)?`<`:`[`}var yPe=s((()=>{L_(),gPe(),_Pe.peek=vPe}));function bPe(e,t,n,r){let i=e.referenceType,a=n.enter(`linkReference`),o=n.enter(`label`),s=n.createTracker(r),c=s.move(`[`),l=n.containerPhrasing(e,{before:c,after:`]`,...s.current()});c+=s.move(l+`][`),o();let u=n.stack;n.stack=[],o=n.enter(`reference`);let d=n.safe(n.associationId(e),{before:c,after:`]`,...s.current()});return o(),n.stack=u,a(),i===`full`||!l||l!==d?c+=s.move(d+`]`):i===`shortcut`?c=c.slice(0,-1):c+=s.move(`]`),c}function xPe(){return`[`}var SPe=s((()=>{bPe.peek=xPe}));function B_(e){let t=e.options.bullet||`*`;if(t!==`*`&&t!==`+`&&t!==`-`)throw Error("Cannot serialize items with `"+t+"` for `options.bullet`, expected `*`, `+`, or `-`");return t}var V_=s((()=>{}));function CPe(e){let t=B_(e),n=e.options.bulletOther;if(!n)return t===`*`?`-`:`*`;if(n!==`*`&&n!==`+`&&n!==`-`)throw Error("Cannot serialize items with `"+n+"` for `options.bulletOther`, expected `*`, `+`, or `-`");if(n===t)throw Error("Expected `bullet` (`"+t+"`) and `bulletOther` (`"+n+"`) to be different");return n}var wPe=s((()=>{V_()}));function TPe(e){let t=e.options.bulletOrdered||`.`;if(t!==`.`&&t!==`)`)throw Error("Cannot serialize items with `"+t+"` for `options.bulletOrdered`, expected `.` or `)`");return t}var EPe=s((()=>{}));function DPe(e){let t=e.options.rule||`*`;if(t!==`*`&&t!==`-`&&t!==`_`)throw Error("Cannot serialize rules with `"+t+"` for `options.rule`, expected `*`, `-`, or `_`");return t}var OPe=s((()=>{}));function kPe(e,t,n,r){let i=n.enter(`list`),a=n.bulletCurrent,o=e.ordered?TPe(n):B_(n),s=e.ordered?o===`.`?`)`:`.`:CPe(n),c=t&&n.bulletLastUsed?o===n.bulletLastUsed:!1;if(!e.ordered){let t=e.children?e.children[0]:void 0;if((o===`*`||o===`-`)&&t&&(!t.children||!t.children[0])&&n.stack[n.stack.length-1]===`list`&&n.stack[n.stack.length-2]===`listItem`&&n.stack[n.stack.length-3]===`list`&&n.stack[n.stack.length-4]===`listItem`&&n.indexStack[n.indexStack.length-1]===0&&n.indexStack[n.indexStack.length-2]===0&&n.indexStack[n.indexStack.length-3]===0&&(c=!0),DPe(n)===o&&t){let t=-1;for(;++t<e.children.length;){let n=e.children[t];if(n&&n.type===`listItem`&&n.children&&n.children[0]&&n.children[0].type===`thematicBreak`){c=!0;break}}}}c&&(o=s),n.bulletCurrent=o;let l=n.containerFlow(e,r);return n.bulletLastUsed=o,n.bulletCurrent=a,i(),l}var APe=s((()=>{V_(),wPe(),EPe(),OPe()}));function jPe(e){let t=e.options.listItemIndent||`one`;if(t!==`tab`&&t!==`one`&&t!==`mixed`)throw Error("Cannot serialize items with `"+t+"` for `options.listItemIndent`, expected `tab`, `one`, or `mixed`");return t}var MPe=s((()=>{}));function NPe(e,t,n,r){let i=jPe(n),a=n.bulletCurrent||B_(n);t&&t.type===`list`&&t.ordered&&(a=(typeof t.start==`number`&&t.start>-1?t.start:1)+(n.options.incrementListMarker===!1?0:t.children.indexOf(e))+a);let o=a.length+1;(i===`tab`||i===`mixed`&&(t&&t.type===`list`&&t.spread||e.spread))&&(o=Math.ceil(o/4)*4);let s=n.createTracker(r);s.move(a+` `.repeat(o-a.length)),s.shift(o);let c=n.enter(`listItem`),l=n.indentLines(n.containerFlow(e,s.current()),u);return c(),l;function u(e,t,n){return t?(n?``:` `.repeat(o))+e:(n?a:a+` `.repeat(o-a.length))+e}}var PPe=s((()=>{V_(),MPe()}));function FPe(e,t,n,r){let i=n.enter(`paragraph`),a=n.enter(`phrasing`),o=n.containerPhrasing(e,r);return a(),i(),o}var IPe=s((()=>{})),LPe,RPe=s((()=>{zh(),LPe=Rh([`break`,`delete`,`emphasis`,`footnote`,`footnoteReference`,`image`,`imageReference`,`inlineCode`,`inlineMath`,`link`,`linkReference`,`mdxJsxTextElement`,`mdxTextExpression`,`strong`,`text`,`textDirective`])})),zPe=s((()=>{RPe()}));function BPe(e,t,n,r){return(e.children.some(function(e){return LPe(e)})?n.containerPhrasing:n.containerFlow).call(n,e,r)}var VPe=s((()=>{zPe()}));function HPe(e){let t=e.options.strong||`*`;if(t!==`*`&&t!==`_`)throw Error("Cannot serialize strong with `"+t+"` for `options.strong`, expected `*`, or `_`");return t}var UPe=s((()=>{}));function WPe(e,t,n,r){let i=HPe(n),a=n.enter(`strong`),o=n.createTracker(r),s=o.move(i+i);return s+=o.move(n.containerPhrasing(e,{before:s,after:i,...o.current()})),s+=o.move(i+i),a(),s}function GPe(e,t,n){return n.options.strong||`*`}var KPe=s((()=>{UPe(),WPe.peek=GPe}));function qPe(e,t,n,r){return n.safe(e.value,r)}var JPe=s((()=>{}));function YPe(e){let t=e.options.ruleRepetition||3;if(t<3)throw Error("Cannot serialize rules with repetition `"+t+"` for `options.ruleRepetition`, expected `3` or more");return t}var XPe=s((()=>{}));function ZPe(e,t,n){let r=(DPe(n)+(n.options.ruleSpaces?` `:``)).repeat(YPe(n));return n.options.ruleSpaces?r.slice(0,-1):r}var QPe=s((()=>{XPe(),OPe()})),H_,$Pe=s((()=>{DNe(),MNe(),BNe(),HNe(),qNe(),nPe(),aPe(),cPe(),dPe(),mPe(),yPe(),SPe(),APe(),PPe(),IPe(),VPe(),KPe(),JPe(),QPe(),H_={blockquote:TNe,break:jNe,code:RNe,definition:VNe,emphasis:GNe,hardBreak:jNe,heading:tPe,html:rPe,image:oPe,imageReference:lPe,inlineCode:fPe,link:_Pe,linkReference:bPe,list:kPe,listItem:NPe,paragraph:FPe,root:BPe,strong:WPe,text:qPe,thematicBreak:ZPe}}));function eFe(e,t,n,r){if(t.type===`code`&&F_(t,r)&&(e.type===`list`||e.type===t.type&&F_(e,r)))return!1;if(`spread`in n&&typeof n.spread==`boolean`)return e.type===`paragraph`&&(e.type===t.type||t.type===`definition`||t.type===`heading`&&$Ne(t,r))?void 0:n.spread?1:0}var tFe,nFe=s((()=>{FNe(),ePe(),tFe=[eFe]})),U_,rFe,iFe=s((()=>{U_=[`autolink`,`destinationLiteral`,`destinationRaw`,`reference`,`titleQuote`,`titleApostrophe`],rFe=[{character:`	`,after:`[\\r\\n]`,inConstruct:`phrasing`},{character:`	`,before:`[\\r\\n]`,inConstruct:`phrasing`},{character:`	`,inConstruct:[`codeFencedLangGraveAccent`,`codeFencedLangTilde`]},{character:`\r`,inConstruct:[`codeFencedLangGraveAccent`,`codeFencedLangTilde`,`codeFencedMetaGraveAccent`,`codeFencedMetaTilde`,`destinationLiteral`,`headingAtx`]},{character:`
-`,inConstruct:[`codeFencedLangGraveAccent`,`codeFencedLangTilde`,`codeFencedMetaGraveAccent`,`codeFencedMetaTilde`,`destinationLiteral`,`headingAtx`]},{character:` `,after:`[\\r\\n]`,inConstruct:`phrasing`},{character:` `,before:`[\\r\\n]`,inConstruct:`phrasing`},{character:` `,inConstruct:[`codeFencedLangGraveAccent`,`codeFencedLangTilde`]},{character:`!`,after:`\\[`,inConstruct:`phrasing`,notInConstruct:U_},{character:`"`,inConstruct:`titleQuote`},{atBreak:!0,character:`#`},{character:`#`,inConstruct:`headingAtx`,after:`(?:[\r
-]|$)`},{character:`&`,after:`[#A-Za-z]`,inConstruct:`phrasing`},{character:`'`,inConstruct:`titleApostrophe`},{character:`(`,inConstruct:`destinationRaw`},{before:`\\]`,character:`(`,inConstruct:`phrasing`,notInConstruct:U_},{atBreak:!0,before:`\\d+`,character:`)`},{character:`)`,inConstruct:`destinationRaw`},{atBreak:!0,character:`*`,after:`(?:[ 	\r
-*])`},{character:`*`,inConstruct:`phrasing`,notInConstruct:U_},{atBreak:!0,character:`+`,after:`(?:[ 	\r
-])`},{atBreak:!0,character:`-`,after:`(?:[ 	\r
--])`},{atBreak:!0,before:`\\d+`,character:`.`,after:`(?:[ 	\r
-]|$)`},{atBreak:!0,character:`<`,after:`[!/?A-Za-z]`},{character:`<`,after:`[!/?A-Za-z]`,inConstruct:`phrasing`,notInConstruct:U_},{character:`<`,inConstruct:`destinationLiteral`},{atBreak:!0,character:`=`},{atBreak:!0,character:`>`},{character:`>`,inConstruct:`destinationLiteral`},{atBreak:!0,character:`[`},{character:`[`,inConstruct:`phrasing`,notInConstruct:U_},{character:`[`,inConstruct:[`label`,`reference`]},{character:`\\`,after:`[\\r\\n]`,inConstruct:`phrasing`},{character:`]`,inConstruct:[`label`,`reference`]},{atBreak:!0,character:`_`},{character:`_`,inConstruct:`phrasing`,notInConstruct:U_},{atBreak:!0,character:"`"},{character:"`",inConstruct:[`codeFencedLangGraveAccent`,`codeFencedMetaGraveAccent`]},{character:"`",inConstruct:`phrasing`,notInConstruct:U_},{atBreak:!0,character:`~`}]}));function W_(e){let t=`&`+e+`;`;G_.innerHTML=t;let n=G_.textContent;return n.charCodeAt(n.length-1)===59&&e!==`semi`||n===t?!1:n}var G_,K_=s((()=>{G_=document.createElement(`i`)}));function aFe(e,t){let n=Number.parseInt(e,t);return n<9||n===11||n>13&&n<32||n>126&&n<160||n>55295&&n<57344||n>64975&&n<65008||(n&65535)==65535||(n&65535)==65534||n>1114111?`�`:String.fromCodePoint(n)}var oFe=s((()=>{}));function sFe(e){return e.replace(lFe,cFe)}function cFe(e,t,n){if(t)return t;if(n.charCodeAt(0)===35){let e=n.charCodeAt(1),t=e===120||e===88;return aFe(n.slice(t?2:1),t?16:10)}return W_(n)||e}var lFe,uFe=s((()=>{K_(),oFe(),lFe=/\\([!-/:-@[-`{-~])|&(#(?:\d{1,7}|x[\da-f]{1,6})|[\da-z]{1,31});/gi}));function dFe(e){return e.label||!e.identifier?e.label||``:sFe(e.identifier)}var fFe=s((()=>{uFe()}));function pFe(e){if(!e._compiled){let t=(e.atBreak?`[\\r\\n][\\t ]*`:``)+(e.before?`(?:`+e.before+`)`:``);e._compiled=RegExp((t?`(`+t+`)`:``)+(/[|\\{}()[\]^$+*?.-]/.test(e.character)?`\\`:``)+e.character+(e.after?`(?:`+e.after+`)`:``),`g`)}return e._compiled}var mFe=s((()=>{}));function hFe(e,t,n){let r=t.indexStack,i=e.children||[],a=[],o=-1,s=n.before;r.push(-1);let c=t.createTracker(n);for(;++o<i.length;){let l=i[o],u;if(r[r.length-1]=o,o+1<i.length){let n=t.handle.handlers[i[o+1].type];n&&n.peek&&(n=n.peek),u=n?n(i[o+1],e,t,{before:``,after:``,...c.current()}).charAt(0):``}else u=n.after;a.length>0&&(s===`\r`||s===`
-`)&&l.type===`html`&&(a[a.length-1]=a[a.length-1].replace(/(\r?\n|\r)$/,` `),s=` `,c=t.createTracker(n),c.move(a.join(``))),a.push(c.move(t.handle(l,e,t,{...c.current(),before:s,after:u}))),s=a[a.length-1].slice(-1)}return r.pop(),a.join(``)}var gFe=s((()=>{}));function _Fe(e,t,n){let r=t.indexStack,i=e.children||[],a=t.createTracker(n),o=[],s=-1;for(r.push(-1);++s<i.length;){let n=i[s];r[r.length-1]=s,o.push(a.move(t.handle(n,e,t,{before:`
-`,after:`
-`,...a.current()}))),n.type!==`list`&&(t.bulletLastUsed=void 0),s<i.length-1&&o.push(a.move(vFe(n,i[s+1],e,t)))}return r.pop(),o.join(``)}function vFe(e,t,n,r){let i=r.join.length;for(;i--;){let a=r.join[i](e,t,n,r);if(a===!0||a===1)break;if(typeof a==`number`)return`
-`.repeat(1+a);if(a===!1)return`
-
-<!---->
-
-`}return`
-
-`}var yFe=s((()=>{}));function bFe(e,t){let n=[],r=0,i=0,a;for(;a=xFe.exec(e);)o(e.slice(r,a.index)),n.push(a[0]),r=a.index+a[0].length,i++;return o(e.slice(r)),n.join(``);function o(e){n.push(t(e,i,!e))}}var xFe,SFe=s((()=>{xFe=/\r?\n|\r/g}));function CFe(e,t,n){let r=(n.before||``)+(t||``)+(n.after||``),i=[],a=[],o={},s=-1;for(;++s<e.unsafe.length;){let t=e.unsafe[s];if(!ONe(e.stack,t))continue;let n=e.compilePattern(t),a;for(;a=n.exec(r);){let e=`before`in t||!!t.atBreak,n=`after`in t,r=a.index+(e?a[1].length:0);i.includes(r)?(o[r].before&&!e&&(o[r].before=!1),o[r].after&&!n&&(o[r].after=!1)):(i.push(r),o[r]={before:e,after:n})}}i.sort(wFe);let c=n.before?n.before.length:0,l=r.length-(n.after?n.after.length:0);for(s=-1;++s<i.length;){let e=i[s];e<c||e>=l||e+1<l&&i[s+1]===e+1&&o[e].after&&!o[e+1].before&&!o[e+1].after||i[s-1]===e-1&&o[e].before&&!o[e-1].before&&!o[e-1].after||(c!==e&&a.push(TFe(r.slice(c,e),`\\`)),c=e,/[!-/:-@[-`{-~]/.test(r.charAt(e))&&(!n.encode||!n.encode.includes(r.charAt(e)))?a.push(`\\`):(a.push(`&#x`+r.charCodeAt(e).toString(16).toUpperCase()+`;`),c++))}return a.push(TFe(r.slice(c,l),n.after)),a.join(``)}function wFe(e,t){return e-t}function TFe(e,t){let n=/\\(?=[!-/:-@[-`{-~])/g,r=[],i=[],a=e+t,o=-1,s=0,c;for(;c=n.exec(a);)r.push(c.index);for(;++o<r.length;)s!==r[o]&&i.push(e.slice(s,r[o])),i.push(`\\`),s=r[o];return i.push(e.slice(s)),i.join(``)}var EFe=s((()=>{ANe()}));function DFe(e){let t=e||{},n=t.now||{},r=t.lineShift||0,i=n.line||1,a=n.column||1;return{move:c,current:o,shift:s};function o(){return{now:{line:i,column:a},lineShift:r}}function s(e){r+=e}function c(e){let t=e||``,n=t.split(/\r?\n|\r/g),o=n[n.length-1];return i+=n.length-1,a=n.length===1?a+o.length:1+o.length+r,t}}var OFe=s((()=>{}));function kFe(e,t={}){let n={enter:i,indentLines:bFe,associationId:dFe,containerPhrasing:NFe,containerFlow:PFe,createTracker:DFe,compilePattern:pFe,safe:FFe,stack:[],unsafe:[...rFe],join:[...tFe],handlers:{...H_},options:{},indexStack:[],handle:void 0};bNe(n,t),n.options.tightDefinitions&&n.join.push(MFe),n.handle=dh(`type`,{invalid:AFe,unknown:jFe,handlers:n.handlers});let r=n.handle(e,void 0,n,{before:`
-`,after:`
-`,now:{line:1,column:1},lineShift:0});return r&&r.charCodeAt(r.length-1)!==10&&r.charCodeAt(r.length-1)!==13&&(r+=`
-`),r;function i(e){return n.stack.push(e),t;function t(){n.stack.pop()}}}function AFe(e){throw Error("Cannot handle value `"+e+"`, expected node")}function jFe(e){let t=e;throw Error("Cannot handle unknown node `"+t.type+"`")}function MFe(e,t){if(e.type===`definition`&&e.type===t.type)return 0}function NFe(e,t){return hFe(e,this,t)}function PFe(e,t){return _Fe(e,this,t)}function FFe(e,t){return CFe(this,e,t)}var IFe=s((()=>{ph(),wNe(),$Pe(),nFe(),iFe(),fFe(),mFe(),gFe(),yFe(),SFe(),EFe(),OFe()})),q_=s((()=>{IFe(),$Pe()}));function LFe(){return{enter:{table:RFe,tableData:VFe,tableHeader:VFe,tableRow:BFe},exit:{codeText:HFe,table:zFe,tableData:J_,tableHeader:J_,tableRow:J_}}}function RFe(e){let t=e._align;this.enter({type:`table`,align:t.map(function(e){return e===`none`?null:e}),children:[]},e),this.data.inTable=!0}function zFe(e){this.exit(e),this.data.inTable=void 0}function BFe(e){this.enter({type:`tableRow`,children:[]},e)}function J_(e){this.exit(e)}function VFe(e){this.enter({type:`tableCell`,children:[]},e)}function HFe(e){let t=this.resume();this.data.inTable&&(t=t.replace(/\\([\\|])/g,UFe));let n=this.stack[this.stack.length-1];n.type,n.value=t,this.exit(e)}function UFe(e,t){return t===`|`?t:e}function WFe(e){let t=e||{},n=t.tableCellPadding,r=t.tablePipeAlign,i=t.stringLength,a=n?` `:`|`;return{unsafe:[{character:`\r`,inConstruct:`tableCell`},{character:`
-`,inConstruct:`tableCell`},{atBreak:!0,character:`|`,after:`[	 :-]`},{character:`|`,inConstruct:`tableCell`},{atBreak:!0,character:`:`,after:`-`},{atBreak:!0,character:`-`,after:`[:|-]`}],handlers:{inlineCode:f,table:o,tableCell:c,tableRow:s}};function o(e,t,n,r){return l(u(e,n,r),e.align)}function s(e,t,n,r){let i=l([d(e,n,r)]);return i.slice(0,i.indexOf(`
-`))}function c(e,t,n,r){let i=n.enter(`tableCell`),o=n.enter(`phrasing`),s=n.containerPhrasing(e,{...r,before:a,after:a});return o(),i(),s}function l(e,t){return hNe(e,{align:t,alignDelimiters:r,padding:n,stringLength:i})}function u(e,t,n){let r=e.children,i=-1,a=[],o=t.enter(`table`);for(;++i<r.length;)a[i]=d(r[i],t,n);return o(),a}function d(e,t,n){let r=e.children,i=-1,a=[],o=t.enter(`tableRow`);for(;++i<r.length;)a[i]=c(r[i],e,t,n);return o(),a}function f(e,t,n){let r=H_.inlineCode(e,t,n);return n.stack.includes(`tableCell`)&&(r=r.replace(/\|/g,`\\$&`)),r}}var GFe=s((()=>{ep(),yNe(),q_()})),KFe=s((()=>{GFe()}));function qFe(){return{exit:{taskListCheckValueChecked:YFe,taskListCheckValueUnchecked:YFe,paragraph:XFe}}}function JFe(){return{unsafe:[{atBreak:!0,character:`-`,after:`[:|-]`}],handlers:{listItem:ZFe}}}function YFe(e){let t=this.stack[this.stack.length-2];t.type,t.checked=e.type===`taskListCheckValueChecked`}function XFe(e){let t=this.stack[this.stack.length-2];if(t&&t.type===`listItem`&&typeof t.checked==`boolean`){let e=this.stack[this.stack.length-1];e.type;let n=e.children[0];if(n&&n.type===`text`){let r=t.children,i=-1,a;for(;++i<r.length;){let e=r[i];if(e.type===`paragraph`){a=e;break}}a===e&&(n.value=n.value.slice(1),n.value.length===0?e.children.shift():e.position&&n.position&&typeof n.position.start.offset==`number`&&(n.position.start.column++,n.position.start.offset++,e.position.start=Object.assign({},n.position.start)))}}this.exit(e)}function ZFe(e,t,n,r){let i=e.children[0],a=typeof e.checked==`boolean`&&i&&i.type===`paragraph`,o=`[`+(e.checked?`x`:` `)+`] `,s=n.createTracker(r);a&&s.move(o);let c=H_.listItem(e,t,n,{...r,...s.current()});return a&&(c=c.replace(/^(?:[*+-]|\d+\.)([\r\n]| {1,3})/,l)),c;function l(e){return e+o}}var QFe=s((()=>{ep(),q_()})),$Fe=s((()=>{QFe()}));function eIe(){return[kMe(),WMe(),oNe(),LFe(),qFe()]}function tIe(e){return{extensions:[AMe(),GMe(),sNe(),WFe(e),JFe()]}}var nIe=s((()=>{UMe(),aNe(),mNe(),KFe(),$Fe()})),rIe=s((()=>{nIe()}));function Y_(e,t,n,r){let i=e.length,a=0,o;if(t=t<0?-t>i?0:i+t:t>i?i:t,n=n>0?n:0,r.length<1e4)o=Array.from(r),o.unshift(t,n),e.splice(...o);else for(n&&e.splice(t,n);a<r.length;)o=r.slice(a,a+1e4),o.unshift(t,0),e.splice(...o),a+=1e4,t+=1e4}function X_(e,t){return e.length>0?(Y_(e,e.length,0,t),e):t}var Z_=s((()=>{}));function iIe(e){let t={},n=-1;for(;++n<e.length;)aIe(t,e[n]);return t}function aIe(e,t){let n;for(n in t){let r=(Q_.call(e,n)?e[n]:void 0)||(e[n]={}),i=t[n],a;if(i)for(a in i){Q_.call(r,a)||(r[a]=[]);let e=i[a];oIe(r[a],Array.isArray(e)?e:e?[e]:[])}}}function oIe(e,t){let n=-1,r=[];for(;++n<t.length;)(t[n].add===`after`?e:r).push(t[n]);Y_(e,0,0,r)}var Q_,sIe=s((()=>{Z_(),Q_={}.hasOwnProperty}));function cIe(){return{text:sv}}function lIe(e,t,n){let r=this,i,a;return o;function o(t){return!$_(t)||!yIe.call(r,r.previous)||ev(r.events)?n(t):(e.enter(`literalAutolink`),e.enter(`literalAutolinkEmail`),s(t))}function s(t){return $_(t)?(e.consume(t),s):t===64?(e.consume(t),c):n(t)}function c(t){return t===46?e.check(xIe,u,l)(t):t===45||t===95||T_(t)?(a=!0,e.consume(t),c):u(t)}function l(t){return e.consume(t),i=!0,c}function u(o){return a&&i&&w_(r.previous)?(e.exit(`literalAutolinkEmail`),e.exit(`literalAutolink`),t(o)):n(o)}}function uIe(e,t,n){let r=this;return i;function i(t){return t!==87&&t!==119||!_Ie.call(r,r.previous)||ev(r.events)?n(t):(e.enter(`literalAutolink`),e.enter(`literalAutolinkWww`),e.check(bIe,e.attempt(tv,e.attempt(nv,a),n),n)(t))}function a(n){return e.exit(`literalAutolinkWww`),e.exit(`literalAutolink`),t(n)}}function dIe(e,t,n){let r=this,i=``,a=!1;return o;function o(t){return(t===72||t===104)&&vIe.call(r,r.previous)&&!ev(r.events)?(e.enter(`literalAutolink`),e.enter(`literalAutolinkHttp`),i+=String.fromCodePoint(t),e.consume(t),s):n(t)}function s(t){if(w_(t)&&i.length<5)return i+=String.fromCodePoint(t),e.consume(t),s;if(t===58){let n=i.toLowerCase();if(n===`http`||n===`https`)return e.consume(t),c}return n(t)}function c(t){return t===47?(e.consume(t),a?l:(a=!0,c)):n(t)}function l(t){return t===null||y_(t)||x_(t)||O_(t)||D_(t)?n(t):e.attempt(tv,e.attempt(nv,u),n)(t)}function u(n){return e.exit(`literalAutolinkHttp`),e.exit(`literalAutolink`),t(n)}}function fIe(e,t,n){let r=0;return i;function i(t){return(t===87||t===119)&&r<3?(r++,e.consume(t),i):t===46&&r===3?(e.consume(t),a):n(t)}function a(e){return e===null?n(e):t(e)}}function pIe(e,t,n){let r,i,a;return o;function o(t){return t===46||t===95?e.check(rv,c,s)(t):t===null||x_(t)||O_(t)||t!==45&&D_(t)?c(t):(a=!0,e.consume(t),o)}function s(t){return t===95?r=!0:(i=r,r=void 0),e.consume(t),o}function c(e){return i||r||!a?n(e):t(e)}}function mIe(e,t){let n=0,r=0;return i;function i(o){return o===40?(n++,e.consume(o),i):o===41&&r<n?a(o):o===33||o===34||o===38||o===39||o===41||o===42||o===44||o===46||o===58||o===59||o===60||o===63||o===93||o===95||o===126?e.check(rv,t,a)(o):o===null||x_(o)||O_(o)?t(o):(e.consume(o),i)}function a(t){return t===41&&r++,e.consume(t),i}}function hIe(e,t,n){return r;function r(o){return o===33||o===34||o===39||o===41||o===42||o===44||o===46||o===58||o===59||o===63||o===95||o===126?(e.consume(o),r):o===38?(e.consume(o),a):o===93?(e.consume(o),i):o===60||o===null||x_(o)||O_(o)?t(o):n(o)}function i(e){return e===null||e===40||e===91||x_(e)||O_(e)?t(e):r(e)}function a(e){return w_(e)?o(e):n(e)}function o(t){return t===59?(e.consume(t),r):w_(t)?(e.consume(t),o):n(t)}}function gIe(e,t,n){return r;function r(t){return e.consume(t),i}function i(e){return T_(e)?n(e):t(e)}}function _Ie(e){return e===null||e===40||e===42||e===95||e===91||e===93||e===126||x_(e)}function vIe(e){return!w_(e)}function yIe(e){return!(e===47||$_(e))}function $_(e){return e===43||e===45||e===46||e===95||T_(e)}function ev(e){let t=e.length,n=!1;for(;t--;){let r=e[t][1];if((r.type===`labelLink`||r.type===`labelImage`)&&!r._balanced){n=!0;break}if(r._gfmAutolinkLiteralWalkedInto){n=!1;break}}return e.length>0&&!n&&(e[e.length-1][1]._gfmAutolinkLiteralWalkedInto=!0),n}var bIe,tv,nv,rv,xIe,iv,av,ov,sv,cv,SIe=s((()=>{for(k_(),bIe={tokenize:fIe,partial:!0},tv={tokenize:pIe,partial:!0},nv={tokenize:mIe,partial:!0},rv={tokenize:hIe,partial:!0},xIe={tokenize:gIe,partial:!0},iv={tokenize:uIe,previous:_Ie},av={tokenize:dIe,previous:vIe},ov={tokenize:lIe,previous:yIe},sv={},cv=48;cv<123;)sv[cv]=ov,cv++,cv===58?cv=65:cv===91&&(cv=97);sv[43]=ov,sv[45]=ov,sv[46]=ov,sv[95]=ov,sv[72]=[ov,av],sv[104]=[ov,av],sv[87]=[ov,iv],sv[119]=[ov,iv]}));function lv(e){let t=[],n=-1,r=0,i=0;for(;++n<e.length;){let a=e.charCodeAt(n),o=``;if(a===37&&T_(e.charCodeAt(n+1))&&T_(e.charCodeAt(n+2)))i=2;else if(a<128)/[!#$&-;=?-Z_a-z~]/.test(String.fromCharCode(a))||(o=String.fromCharCode(a));else if(a>55295&&a<57344){let t=e.charCodeAt(n+1);a<56320&&t>56319&&t<57344?(o=String.fromCharCode(a,t),i=1):o=`�`}else o=String.fromCharCode(a);o&&=(t.push(e.slice(r,n),encodeURIComponent(o)),r=n+i+1,``),i&&=(n+=i,0)}return t.join(``)+e.slice(r)}var uv=s((()=>{k_()})),CIe=s((()=>{SIe()}));function dv(e){if(e===null||x_(e)||O_(e))return 1;if(D_(e))return 2}var wIe=s((()=>{k_()}));function fv(e,t,n){let r=[],i=-1;for(;++i<e.length;){let a=e[i].resolveAll;a&&!r.includes(a)&&(t=a(t,n),r.push(a))}return t}var pv=s((()=>{}));function TIe(e,t){let n=-1,r,i,a,o,s,c,l,u;for(;++n<e.length;)if(e[n][0]===`enter`&&e[n][1].type===`attentionSequence`&&e[n][1]._close){for(r=n;r--;)if(e[r][0]===`exit`&&e[r][1].type===`attentionSequence`&&e[r][1]._open&&t.sliceSerialize(e[r][1]).charCodeAt(0)===t.sliceSerialize(e[n][1]).charCodeAt(0)){if((e[r][1]._close||e[n][1]._open)&&(e[n][1].end.offset-e[n][1].start.offset)%3&&!((e[r][1].end.offset-e[r][1].start.offset+e[n][1].end.offset-e[n][1].start.offset)%3))continue;c=e[r][1].end.offset-e[r][1].start.offset>1&&e[n][1].end.offset-e[n][1].start.offset>1?2:1;let d=Object.assign({},e[r][1].end),f=Object.assign({},e[n][1].start);DIe(d,-c),DIe(f,c),o={type:c>1?`strongSequence`:`emphasisSequence`,start:d,end:Object.assign({},e[r][1].end)},s={type:c>1?`strongSequence`:`emphasisSequence`,start:Object.assign({},e[n][1].start),end:f},a={type:c>1?`strongText`:`emphasisText`,start:Object.assign({},e[r][1].end),end:Object.assign({},e[n][1].start)},i={type:c>1?`strong`:`emphasis`,start:Object.assign({},o.start),end:Object.assign({},s.end)},e[r][1].end=Object.assign({},o.start),e[n][1].start=Object.assign({},s.end),l=[],e[r][1].end.offset-e[r][1].start.offset&&(l=X_(l,[[`enter`,e[r][1],t],[`exit`,e[r][1],t]])),l=X_(l,[[`enter`,i,t],[`enter`,o,t],[`exit`,o,t],[`enter`,a,t]]),l=X_(l,fv(t.parser.constructs.insideSpan.null,e.slice(r+1,n),t)),l=X_(l,[[`exit`,a,t],[`enter`,s,t],[`exit`,s,t],[`exit`,i,t]]),e[n][1].end.offset-e[n][1].start.offset?(u=2,l=X_(l,[[`enter`,e[n][1],t],[`exit`,e[n][1],t]])):u=0,Y_(e,r-1,n-r+3,l),n=r+l.length-u-2;break}}for(n=-1;++n<e.length;)e[n][1].type===`attentionSequence`&&(e[n][1].type=`data`);return e}function EIe(e,t){let n=this.parser.constructs.attentionMarkers.null,r=this.previous,i=dv(r),a;return o;function o(t){return a=t,e.enter(`attentionSequence`),s(t)}function s(o){if(o===a)return e.consume(o),s;let c=e.exit(`attentionSequence`),l=dv(o),u=!l||l===2&&i||n.includes(o),d=!i||i===2&&l||n.includes(r);return c._open=!!(a===42?u:u&&(i||!d)),c._close=!!(a===42?d:d&&(l||!u)),t(o)}}function DIe(e,t){e.column+=t,e.offset+=t,e._bufferIndex+=t}var mv,OIe=s((()=>{Z_(),wIe(),pv(),mv={name:`attention`,tokenize:EIe,resolveAll:TIe}}));function kIe(e,t,n){let r=0;return i;function i(t){return e.enter(`autolink`),e.enter(`autolinkMarker`),e.consume(t),e.exit(`autolinkMarker`),e.enter(`autolinkProtocol`),a}function a(t){return w_(t)?(e.consume(t),o):t===64?n(t):l(t)}function o(e){return e===43||e===45||e===46||T_(e)?(r=1,s(e)):l(e)}function s(t){return t===58?(e.consume(t),r=0,c):(t===43||t===45||t===46||T_(t))&&r++<32?(e.consume(t),s):(r=0,l(t))}function c(r){return r===62?(e.exit(`autolinkProtocol`),e.enter(`autolinkMarker`),e.consume(r),e.exit(`autolinkMarker`),e.exit(`autolink`),t):r===null||r===32||r===60||y_(r)?n(r):(e.consume(r),c)}function l(t){return t===64?(e.consume(t),u):vMe(t)?(e.consume(t),l):n(t)}function u(e){return T_(e)?d(e):n(e)}function d(n){return n===46?(e.consume(n),r=0,u):n===62?(e.exit(`autolinkProtocol`).type=`autolinkEmail`,e.enter(`autolinkMarker`),e.consume(n),e.exit(`autolinkMarker`),e.exit(`autolink`),t):f(n)}function f(t){if((t===45||T_(t))&&r++<63){let n=t===45?f:d;return e.consume(t),n}return n(t)}}var AIe,jIe=s((()=>{k_(),AIe={name:`autolink`,tokenize:kIe}}));function hv(e,t,n,r){let i=r?r-1:1/0,a=0;return o;function o(r){return S_(r)?(e.enter(n),s(r)):t(r)}function s(r){return S_(r)&&a++<i?(e.consume(r),s):(e.exit(n),t(r))}}var gv=s((()=>{k_()}));function MIe(e,t,n){return r;function r(t){return S_(t)?hv(e,i,`linePrefix`)(t):i(t)}function i(e){return e===null||b_(e)?t(e):n(e)}}var _v,vv=s((()=>{gv(),k_(),_v={tokenize:MIe,partial:!0}}));function NIe(e,t,n){let r=this;return i;function i(t){if(t===62){let n=r.containerState;return n.open||=(e.enter(`blockQuote`,{_container:!0}),!0),e.enter(`blockQuotePrefix`),e.enter(`blockQuoteMarker`),e.consume(t),e.exit(`blockQuoteMarker`),a}return n(t)}function a(n){return S_(n)?(e.enter(`blockQuotePrefixWhitespace`),e.consume(n),e.exit(`blockQuotePrefixWhitespace`),e.exit(`blockQuotePrefix`),t):(e.exit(`blockQuotePrefix`),t(n))}}function PIe(e,t,n){let r=this;return i;function i(t){return S_(t)?hv(e,a,`linePrefix`,r.parser.constructs.disable.null.includes(`codeIndented`)?void 0:4)(t):a(t)}function a(r){return e.attempt(yv,t,n)(r)}}function FIe(e){e.exit(`blockQuote`)}var yv,IIe=s((()=>{gv(),k_(),yv={name:`blockQuote`,tokenize:NIe,continuation:{tokenize:PIe},exit:FIe}}));function LIe(e,t,n){return r;function r(t){return e.enter(`characterEscape`),e.enter(`escapeMarker`),e.consume(t),e.exit(`escapeMarker`),i}function i(r){return bMe(r)?(e.enter(`characterEscapeValue`),e.consume(r),e.exit(`characterEscapeValue`),e.exit(`characterEscape`),t):n(r)}}var bv,RIe=s((()=>{k_(),bv={name:`characterEscape`,tokenize:LIe}}));function zIe(e,t,n){let r=this,i=0,a,o;return s;function s(t){return e.enter(`characterReference`),e.enter(`characterReferenceMarker`),e.consume(t),e.exit(`characterReferenceMarker`),c}function c(t){return t===35?(e.enter(`characterReferenceMarkerNumeric`),e.consume(t),e.exit(`characterReferenceMarkerNumeric`),l):(e.enter(`characterReferenceValue`),a=31,o=T_,u(t))}function l(t){return t===88||t===120?(e.enter(`characterReferenceMarkerHexadecimal`),e.consume(t),e.exit(`characterReferenceMarkerHexadecimal`),e.enter(`characterReferenceValue`),a=6,o=yMe,u):(e.enter(`characterReferenceValue`),a=7,o=E_,u(t))}function u(s){if(s===59&&i){let i=e.exit(`characterReferenceValue`);return o===T_&&!W_(r.sliceSerialize(i))?n(s):(e.enter(`characterReferenceMarker`),e.consume(s),e.exit(`characterReferenceMarker`),e.exit(`characterReference`),t)}return o(s)&&i++<a?(e.consume(s),u):n(s)}}var xv,BIe=s((()=>{K_(),k_(),xv={name:`characterReference`,tokenize:zIe}}));function VIe(e,t,n){let r=this,i={tokenize:x,partial:!0},a=0,o=0,s;return c;function c(e){return l(e)}function l(t){let n=r.events[r.events.length-1];return a=n&&n[1].type===`linePrefix`?n[2].sliceSerialize(n[1],!0).length:0,s=t,e.enter(`codeFenced`),e.enter(`codeFencedFence`),e.enter(`codeFencedFenceSequence`),u(t)}function u(t){return t===s?(o++,e.consume(t),u):o<3?n(t):(e.exit(`codeFencedFenceSequence`),S_(t)?hv(e,d,`whitespace`)(t):d(t))}function d(n){return n===null||b_(n)?(e.exit(`codeFencedFence`),r.interrupt?t(n):e.check(Sv,h,b)(n)):(e.enter(`codeFencedFenceInfo`),e.enter(`chunkString`,{contentType:`string`}),f(n))}function f(t){return t===null||b_(t)?(e.exit(`chunkString`),e.exit(`codeFencedFenceInfo`),d(t)):S_(t)?(e.exit(`chunkString`),e.exit(`codeFencedFenceInfo`),hv(e,p,`whitespace`)(t)):t===96&&t===s?n(t):(e.consume(t),f)}function p(t){return t===null||b_(t)?d(t):(e.enter(`codeFencedFenceMeta`),e.enter(`chunkString`,{contentType:`string`}),m(t))}function m(t){return t===null||b_(t)?(e.exit(`chunkString`),e.exit(`codeFencedFenceMeta`),d(t)):t===96&&t===s?n(t):(e.consume(t),m)}function h(t){return e.attempt(i,b,g)(t)}function g(t){return e.enter(`lineEnding`),e.consume(t),e.exit(`lineEnding`),_}function _(t){return a>0&&S_(t)?hv(e,v,`linePrefix`,a+1)(t):v(t)}function v(t){return t===null||b_(t)?e.check(Sv,h,b)(t):(e.enter(`codeFlowValue`),y(t))}function y(t){return t===null||b_(t)?(e.exit(`codeFlowValue`),v(t)):(e.consume(t),y)}function b(n){return e.exit(`codeFenced`),t(n)}function x(e,t,n){let i=0;return a;function a(t){return e.enter(`lineEnding`),e.consume(t),e.exit(`lineEnding`),c}function c(t){return e.enter(`codeFencedFence`),S_(t)?hv(e,l,`linePrefix`,r.parser.constructs.disable.null.includes(`codeIndented`)?void 0:4)(t):l(t)}function l(t){return t===s?(e.enter(`codeFencedFenceSequence`),u(t)):n(t)}function u(t){return t===s?(i++,e.consume(t),u):i>=o?(e.exit(`codeFencedFenceSequence`),S_(t)?hv(e,d,`whitespace`)(t):d(t)):n(t)}function d(r){return r===null||b_(r)?(e.exit(`codeFencedFence`),t(r)):n(r)}}}function HIe(e,t,n){let r=this;return i;function i(t){return t===null?n(t):(e.enter(`lineEnding`),e.consume(t),e.exit(`lineEnding`),a)}function a(e){return r.parser.lazy[r.now().line]?n(e):t(e)}}var Sv,Cv,UIe=s((()=>{gv(),k_(),Sv={tokenize:HIe,partial:!0},Cv={name:`codeFenced`,tokenize:VIe,concrete:!0}}));function WIe(e,t,n){let r=this;return i;function i(t){return e.enter(`codeIndented`),hv(e,a,`linePrefix`,5)(t)}function a(e){let t=r.events[r.events.length-1];return t&&t[1].type===`linePrefix`&&t[2].sliceSerialize(t[1],!0).length>=4?o(e):n(e)}function o(t){return t===null?c(t):b_(t)?e.attempt(KIe,o,c)(t):(e.enter(`codeFlowValue`),s(t))}function s(t){return t===null||b_(t)?(e.exit(`codeFlowValue`),o(t)):(e.consume(t),s)}function c(n){return e.exit(`codeIndented`),t(n)}}function GIe(e,t,n){let r=this;return i;function i(t){return r.parser.lazy[r.now().line]?n(t):b_(t)?(e.enter(`lineEnding`),e.consume(t),e.exit(`lineEnding`),i):hv(e,a,`linePrefix`,5)(t)}function a(e){let a=r.events[r.events.length-1];return a&&a[1].type===`linePrefix`&&a[2].sliceSerialize(a[1],!0).length>=4?t(e):b_(e)?i(e):n(e)}}var wv,KIe,qIe=s((()=>{gv(),k_(),wv={name:`codeIndented`,tokenize:WIe},KIe={tokenize:GIe,partial:!0}}));function JIe(e){let t=e.length-4,n=3,r,i;if((e[n][1].type===`lineEnding`||e[n][1].type===`space`)&&(e[t][1].type===`lineEnding`||e[t][1].type===`space`)){for(r=n;++r<t;)if(e[r][1].type===`codeTextData`){e[n][1].type=`codeTextPadding`,e[t][1].type=`codeTextPadding`,n+=2,t-=2;break}}for(r=n-1,t++;++r<=t;)i===void 0?r!==t&&e[r][1].type!==`lineEnding`&&(i=r):(r===t||e[r][1].type===`lineEnding`)&&(e[i][1].type=`codeTextData`,r!==i+2&&(e[i][1].end=e[r-1][1].end,e.splice(i+2,r-i-2),t-=r-i-2,r=i+2),i=void 0);return e}function YIe(e){return e!==96||this.events[this.events.length-1][1].type===`characterEscape`}function XIe(e,t,n){let r=0,i,a;return o;function o(t){return e.enter(`codeText`),e.enter(`codeTextSequence`),s(t)}function s(t){return t===96?(e.consume(t),r++,s):(e.exit(`codeTextSequence`),c(t))}function c(t){return t===null?n(t):t===32?(e.enter(`space`),e.consume(t),e.exit(`space`),c):t===96?(a=e.enter(`codeTextSequence`),i=0,u(t)):b_(t)?(e.enter(`lineEnding`),e.consume(t),e.exit(`lineEnding`),c):(e.enter(`codeTextData`),l(t))}function l(t){return t===null||t===32||t===96||b_(t)?(e.exit(`codeTextData`),c(t)):(e.consume(t),l)}function u(n){return n===96?(e.consume(n),i++,u):i===r?(e.exit(`codeTextSequence`),e.exit(`codeText`),t(n)):(a.type=`codeTextData`,l(n))}}var ZIe,QIe=s((()=>{k_(),ZIe={name:`codeText`,tokenize:XIe,resolve:JIe,previous:YIe}}));function Tv(e,t){let n=0;if(t.length<1e4)e.push(...t);else for(;n<t.length;)e.push(...t.slice(n,n+1e4)),n+=1e4}var $Ie,eLe=s((()=>{$Ie=class{constructor(e){this.left=e?[...e]:[],this.right=[]}get(e){if(e<0||e>=this.left.length+this.right.length)throw RangeError("Cannot access index `"+e+"` in a splice buffer of size `"+(this.left.length+this.right.length)+"`");return e<this.left.length?this.left[e]:this.right[this.right.length-e+this.left.length-1]}get length(){return this.left.length+this.right.length}shift(){return this.setCursor(0),this.right.pop()}slice(e,t){let n=t??1/0;return n<this.left.length?this.left.slice(e,n):e>this.left.length?this.right.slice(this.right.length-n+this.left.length,this.right.length-e+this.left.length).reverse():this.left.slice(e).concat(this.right.slice(this.right.length-n+this.left.length).reverse())}splice(e,t,n){let r=t||0;this.setCursor(Math.trunc(e));let i=this.right.splice(this.right.length-r,1/0);return n&&Tv(this.left,n),i.reverse()}pop(){return this.setCursor(1/0),this.left.pop()}push(e){this.setCursor(1/0),this.left.push(e)}pushMany(e){this.setCursor(1/0),Tv(this.left,e)}unshift(e){this.setCursor(0),this.right.push(e)}unshiftMany(e){this.setCursor(0),Tv(this.right,e.reverse())}setCursor(e){if(!(e===this.left.length||e>this.left.length&&this.right.length===0||e<0&&this.left.length===0))if(e<this.left.length){let t=this.left.splice(e,1/0);Tv(this.right,t.reverse())}else{let t=this.right.splice(this.left.length+this.right.length-e,1/0);Tv(this.left,t.reverse())}}}}));function tLe(e){let t={},n=-1,r,i,a,o,s,c,l,u=new $Ie(e);for(;++n<u.length;){for(;n in t;)n=t[n];if(r=u.get(n),n&&r[1].type===`chunkFlow`&&u.get(n-1)[1].type===`listItemPrefix`&&(c=r[1]._tokenizer.events,a=0,a<c.length&&c[a][1].type===`lineEndingBlank`&&(a+=2),a<c.length&&c[a][1].type===`content`))for(;++a<c.length&&c[a][1].type!==`content`;)c[a][1].type===`chunkText`&&(c[a][1]._isInFirstContentOfListItem=!0,a++);if(r[0]===`enter`)r[1].contentType&&(Object.assign(t,nLe(u,n)),n=t[n],l=!0);else if(r[1]._container){for(a=n,i=void 0;a--&&(o=u.get(a),o[1].type===`lineEnding`||o[1].type===`lineEndingBlank`);)o[0]===`enter`&&(i&&(u.get(i)[1].type=`lineEndingBlank`),o[1].type=`lineEnding`,i=a);i&&(r[1].end=Object.assign({},u.get(i)[1].start),s=u.slice(i,n),s.unshift(r),u.splice(i,n-i+1,s))}}return Y_(e,0,1/0,u.slice(0)),!l}function nLe(e,t){let n=e.get(t)[1],r=e.get(t)[2],i=t-1,a=[],o=n._tokenizer||r.parser[n.contentType](n.start),s=o.events,c=[],l={},u,d,f=-1,p=n,m=0,h=0,g=[h];for(;p;){for(;e.get(++i)[1]!==p;);a.push(i),p._tokenizer||(u=r.sliceStream(p),p.next||u.push(null),d&&o.defineSkip(p.start),p._isInFirstContentOfListItem&&(o._gfmTasklistFirstContentOfListItem=!0),o.write(u),p._isInFirstContentOfListItem&&(o._gfmTasklistFirstContentOfListItem=void 0)),d=p,p=p.next}for(p=n;++f<s.length;)s[f][0]===`exit`&&s[f-1][0]===`enter`&&s[f][1].type===s[f-1][1].type&&s[f][1].start.line!==s[f][1].end.line&&(h=f+1,g.push(h),p._tokenizer=void 0,p.previous=void 0,p=p.next);for(o.events=[],p?(p._tokenizer=void 0,p.previous=void 0):g.pop(),f=g.length;f--;){let t=s.slice(g[f],g[f+1]),n=a.pop();c.push([n,n+t.length-1]),e.splice(n,2,t)}for(c.reverse(),f=-1;++f<c.length;)l[m+c[f][0]]=m+c[f][1],m+=c[f][1]-c[f][0]-1;return l}var rLe=s((()=>{Z_(),eLe()}));function iLe(e){return tLe(e),e}function aLe(e,t){let n;return r;function r(t){return e.enter(`content`),n=e.enter(`chunkContent`,{contentType:`content`}),i(t)}function i(t){return t===null?a(t):b_(t)?e.check(cLe,o,a)(t):(e.consume(t),i)}function a(n){return e.exit(`chunkContent`),e.exit(`content`),t(n)}function o(t){return e.consume(t),e.exit(`chunkContent`),n.next=e.enter(`chunkContent`,{contentType:`content`,previous:n}),n=n.next,i}}function oLe(e,t,n){let r=this;return i;function i(t){return e.exit(`chunkContent`),e.enter(`lineEnding`),e.consume(t),e.exit(`lineEnding`),hv(e,a,`linePrefix`)}function a(i){if(i===null||b_(i))return n(i);let a=r.events[r.events.length-1];return!r.parser.constructs.disable.null.includes(`codeIndented`)&&a&&a[1].type===`linePrefix`&&a[2].sliceSerialize(a[1],!0).length>=4?t(i):e.interrupt(r.parser.constructs.flow,n,t)(i)}}var sLe,cLe,lLe=s((()=>{gv(),k_(),rLe(),sLe={tokenize:aLe,resolve:iLe},cLe={tokenize:oLe,partial:!0}}));function uLe(e,t,n,r,i,a,o,s,c){let l=c||1/0,u=0;return d;function d(t){return t===60?(e.enter(r),e.enter(i),e.enter(a),e.consume(t),e.exit(a),f):t===null||t===32||t===41||y_(t)?n(t):(e.enter(r),e.enter(o),e.enter(s),e.enter(`chunkString`,{contentType:`string`}),h(t))}function f(n){return n===62?(e.enter(a),e.consume(n),e.exit(a),e.exit(i),e.exit(r),t):(e.enter(s),e.enter(`chunkString`,{contentType:`string`}),p(n))}function p(t){return t===62?(e.exit(`chunkString`),e.exit(s),f(t)):t===null||t===60||b_(t)?n(t):(e.consume(t),t===92?m:p)}function m(t){return t===60||t===62||t===92?(e.consume(t),p):p(t)}function h(i){return!u&&(i===null||i===41||x_(i))?(e.exit(`chunkString`),e.exit(s),e.exit(o),e.exit(r),t(i)):u<l&&i===40?(e.consume(i),u++,h):i===41?(e.consume(i),u--,h):i===null||i===32||i===40||y_(i)?n(i):(e.consume(i),i===92?g:h)}function g(t){return t===40||t===41||t===92?(e.consume(t),h):h(t)}}var dLe=s((()=>{k_()}));function fLe(e,t,n,r,i,a){let o=this,s=0,c;return l;function l(t){return e.enter(r),e.enter(i),e.consume(t),e.exit(i),e.enter(a),u}function u(l){return s>999||l===null||l===91||l===93&&!c||l===94&&!s&&`_hiddenFootnoteSupport`in o.parser.constructs?n(l):l===93?(e.exit(a),e.enter(i),e.consume(l),e.exit(i),e.exit(r),t):b_(l)?(e.enter(`lineEnding`),e.consume(l),e.exit(`lineEnding`),u):(e.enter(`chunkString`,{contentType:`string`}),d(l))}function d(t){return t===null||t===91||t===93||b_(t)||s++>999?(e.exit(`chunkString`),u(t)):(e.consume(t),c||=!S_(t),t===92?f:d)}function f(t){return t===91||t===92||t===93?(e.consume(t),s++,d):d(t)}}var pLe=s((()=>{k_()}));function mLe(e,t,n,r,i,a){let o;return s;function s(t){return t===34||t===39||t===40?(e.enter(r),e.enter(i),e.consume(t),e.exit(i),o=t===40?41:t,c):n(t)}function c(n){return n===o?(e.enter(i),e.consume(n),e.exit(i),e.exit(r),t):(e.enter(a),l(n))}function l(t){return t===o?(e.exit(a),c(o)):t===null?n(t):b_(t)?(e.enter(`lineEnding`),e.consume(t),e.exit(`lineEnding`),hv(e,l,`linePrefix`)):(e.enter(`chunkString`,{contentType:`string`}),u(t))}function u(t){return t===o||t===null||b_(t)?(e.exit(`chunkString`),l(t)):(e.consume(t),t===92?d:u)}function d(t){return t===o||t===92?(e.consume(t),u):u(t)}}var hLe=s((()=>{gv(),k_()}));function Ev(e,t){let n;return r;function r(i){return b_(i)?(e.enter(`lineEnding`),e.consume(i),e.exit(`lineEnding`),n=!0,r):S_(i)?hv(e,r,n?`linePrefix`:`lineSuffix`)(i):t(i)}}var gLe=s((()=>{gv(),k_()}));function _Le(e,t,n){let r=this,i;return a;function a(t){return e.enter(`definition`),o(t)}function o(t){return fLe.call(r,e,s,n,`definitionLabel`,`definitionLabelMarker`,`definitionLabelString`)(t)}function s(t){return i=N_(r.sliceSerialize(r.events[r.events.length-1][1]).slice(1,-1)),t===58?(e.enter(`definitionMarker`),e.consume(t),e.exit(`definitionMarker`),c):n(t)}function c(t){return x_(t)?Ev(e,l)(t):l(t)}function l(t){return uLe(e,u,n,`definitionDestination`,`definitionDestinationLiteral`,`definitionDestinationLiteralMarker`,`definitionDestinationRaw`,`definitionDestinationString`)(t)}function u(t){return e.attempt(bLe,d,d)(t)}function d(t){return S_(t)?hv(e,f,`whitespace`)(t):f(t)}function f(a){return a===null||b_(a)?(e.exit(`definition`),r.parser.defined.push(i),t(a)):n(a)}}function vLe(e,t,n){return r;function r(t){return x_(t)?Ev(e,i)(t):n(t)}function i(t){return mLe(e,a,n,`definitionTitle`,`definitionTitleMarker`,`definitionTitleString`)(t)}function a(t){return S_(t)?hv(e,o,`whitespace`)(t):o(t)}function o(e){return e===null||b_(e)?t(e):n(e)}}var yLe,bLe,xLe=s((()=>{dLe(),pLe(),gv(),hLe(),gLe(),k_(),P_(),yLe={name:`definition`,tokenize:_Le},bLe={tokenize:vLe,partial:!0}}));function SLe(e,t,n){return r;function r(t){return e.enter(`hardBreakEscape`),e.consume(t),i}function i(r){return b_(r)?(e.exit(`hardBreakEscape`),t(r)):n(r)}}var CLe,wLe=s((()=>{k_(),CLe={name:`hardBreakEscape`,tokenize:SLe}}));function TLe(e,t){let n=e.length-2,r=3,i,a;return e[r][1].type===`whitespace`&&(r+=2),n-2>r&&e[n][1].type===`whitespace`&&(n-=2),e[n][1].type===`atxHeadingSequence`&&(r===n-1||n-4>r&&e[n-2][1].type===`whitespace`)&&(n-=r+1===n?2:4),n>r&&(i={type:`atxHeadingText`,start:e[r][1].start,end:e[n][1].end},a={type:`chunkText`,start:e[r][1].start,end:e[n][1].end,contentType:`text`},Y_(e,r,n-r+1,[[`enter`,i,t],[`enter`,a,t],[`exit`,a,t],[`exit`,i,t]])),e}function ELe(e,t,n){let r=0;return i;function i(t){return e.enter(`atxHeading`),a(t)}function a(t){return e.enter(`atxHeadingSequence`),o(t)}function o(t){return t===35&&r++<6?(e.consume(t),o):t===null||x_(t)?(e.exit(`atxHeadingSequence`),s(t)):n(t)}function s(n){return n===35?(e.enter(`atxHeadingSequence`),c(n)):n===null||b_(n)?(e.exit(`atxHeading`),t(n)):S_(n)?hv(e,s,`whitespace`)(n):(e.enter(`atxHeadingText`),l(n))}function c(t){return t===35?(e.consume(t),c):(e.exit(`atxHeadingSequence`),s(t))}function l(t){return t===null||t===35||x_(t)?(e.exit(`atxHeadingText`),s(t)):(e.consume(t),l)}}var DLe,OLe=s((()=>{gv(),k_(),Z_(),DLe={name:`headingAtx`,tokenize:ELe,resolve:TLe}})),kLe,Dv,ALe=s((()=>{kLe=`address.article.aside.base.basefont.blockquote.body.caption.center.col.colgroup.dd.details.dialog.dir.div.dl.dt.fieldset.figcaption.figure.footer.form.frame.frameset.h1.h2.h3.h4.h5.h6.head.header.hr.html.iframe.legend.li.link.main.menu.menuitem.nav.noframes.ol.optgroup.option.p.param.search.section.summary.table.tbody.td.tfoot.th.thead.title.tr.track.ul`.split(`.`),Dv=[`pre`,`script`,`style`,`textarea`]}));function jLe(e){let t=e.length;for(;t--&&!(e[t][0]===`enter`&&e[t][1].type===`htmlFlow`););return t>1&&e[t-2][1].type===`linePrefix`&&(e[t][1].start=e[t-2][1].start,e[t+1][1].start=e[t-2][1].start,e.splice(t-2,2)),e}function MLe(e,t,n){let r=this,i,a,o,s,c;return l;function l(e){return u(e)}function u(t){return e.enter(`htmlFlow`),e.enter(`htmlFlowData`),e.consume(t),d}function d(s){return s===33?(e.consume(s),f):s===47?(e.consume(s),a=!0,h):s===63?(e.consume(s),i=3,r.interrupt?t:ce):w_(s)?(e.consume(s),o=String.fromCharCode(s),g):n(s)}function f(a){return a===45?(e.consume(a),i=2,p):a===91?(e.consume(a),i=5,s=0,m):w_(a)?(e.consume(a),i=4,r.interrupt?t:ce):n(a)}function p(i){return i===45?(e.consume(i),r.interrupt?t:ce):n(i)}function m(i){return i===`CDATA[`.charCodeAt(s++)?(e.consume(i),s===6?r.interrupt?t:re:m):n(i)}function h(t){return w_(t)?(e.consume(t),o=String.fromCharCode(t),g):n(t)}function g(s){if(s===null||s===47||s===62||x_(s)){let c=s===47,l=o.toLowerCase();return!c&&!a&&Dv.includes(l)?(i=1,r.interrupt?t(s):re(s)):kLe.includes(o.toLowerCase())?(i=6,c?(e.consume(s),_):r.interrupt?t(s):re(s)):(i=7,r.interrupt&&!r.parser.lazy[r.now().line]?n(s):a?v(s):y(s))}return s===45||T_(s)?(e.consume(s),o+=String.fromCharCode(s),g):n(s)}function _(i){return i===62?(e.consume(i),r.interrupt?t:re):n(i)}function v(t){return S_(t)?(e.consume(t),v):te(t)}function y(t){return t===47?(e.consume(t),te):t===58||t===95||w_(t)?(e.consume(t),b):S_(t)?(e.consume(t),y):te(t)}function b(t){return t===45||t===46||t===58||t===95||T_(t)?(e.consume(t),b):x(t)}function x(t){return t===61?(e.consume(t),S):S_(t)?(e.consume(t),x):y(t)}function S(t){return t===null||t===60||t===61||t===62||t===96?n(t):t===34||t===39?(e.consume(t),c=t,C):S_(t)?(e.consume(t),S):w(t)}function C(t){return t===c?(e.consume(t),c=null,ee):t===null||b_(t)?n(t):(e.consume(t),C)}function w(t){return t===null||t===34||t===39||t===47||t===60||t===61||t===62||t===96||x_(t)?x(t):(e.consume(t),w)}function ee(e){return e===47||e===62||S_(e)?y(e):n(e)}function te(t){return t===62?(e.consume(t),ne):n(t)}function ne(t){return t===null||b_(t)?re(t):S_(t)?(e.consume(t),ne):n(t)}function re(t){return t===45&&i===2?(e.consume(t),E):t===60&&i===1?(e.consume(t),D):t===62&&i===4?(e.consume(t),le):t===63&&i===3?(e.consume(t),ce):t===93&&i===5?(e.consume(t),se):b_(t)&&(i===6||i===7)?(e.exit(`htmlFlowData`),e.check(ILe,ue,T)(t)):t===null||b_(t)?(e.exit(`htmlFlowData`),T(t)):(e.consume(t),re)}function T(t){return e.check(LLe,ie,ue)(t)}function ie(t){return e.enter(`lineEnding`),e.consume(t),e.exit(`lineEnding`),ae}function ae(t){return t===null||b_(t)?T(t):(e.enter(`htmlFlowData`),re(t))}function E(t){return t===45?(e.consume(t),ce):re(t)}function D(t){return t===47?(e.consume(t),o=``,oe):re(t)}function oe(t){if(t===62){let n=o.toLowerCase();return Dv.includes(n)?(e.consume(t),le):re(t)}return w_(t)&&o.length<8?(e.consume(t),o+=String.fromCharCode(t),oe):re(t)}function se(t){return t===93?(e.consume(t),ce):re(t)}function ce(t){return t===62?(e.consume(t),le):t===45&&i===2?(e.consume(t),ce):re(t)}function le(t){return t===null||b_(t)?(e.exit(`htmlFlowData`),ue(t)):(e.consume(t),le)}function ue(n){return e.exit(`htmlFlow`),t(n)}}function NLe(e,t,n){let r=this;return i;function i(t){return b_(t)?(e.enter(`lineEnding`),e.consume(t),e.exit(`lineEnding`),a):n(t)}function a(e){return r.parser.lazy[r.now().line]?n(e):t(e)}}function PLe(e,t,n){return r;function r(r){return e.enter(`lineEnding`),e.consume(r),e.exit(`lineEnding`),e.attempt(_v,t,n)}}var FLe,ILe,LLe,RLe=s((()=>{k_(),ALe(),vv(),FLe={name:`htmlFlow`,tokenize:MLe,resolveTo:jLe,concrete:!0},ILe={tokenize:PLe,partial:!0},LLe={tokenize:NLe,partial:!0}}));function zLe(e,t,n){let r=this,i,a,o;return s;function s(t){return e.enter(`htmlText`),e.enter(`htmlTextData`),e.consume(t),c}function c(t){return t===33?(e.consume(t),l):t===47?(e.consume(t),x):t===63?(e.consume(t),y):w_(t)?(e.consume(t),w):n(t)}function l(t){return t===45?(e.consume(t),u):t===91?(e.consume(t),a=0,m):w_(t)?(e.consume(t),v):n(t)}function u(t){return t===45?(e.consume(t),p):n(t)}function d(t){return t===null?n(t):t===45?(e.consume(t),f):b_(t)?(o=d,D(t)):(e.consume(t),d)}function f(t){return t===45?(e.consume(t),p):d(t)}function p(e){return e===62?E(e):e===45?f(e):d(e)}function m(t){return t===`CDATA[`.charCodeAt(a++)?(e.consume(t),a===6?h:m):n(t)}function h(t){return t===null?n(t):t===93?(e.consume(t),g):b_(t)?(o=h,D(t)):(e.consume(t),h)}function g(t){return t===93?(e.consume(t),_):h(t)}function _(t){return t===62?E(t):t===93?(e.consume(t),_):h(t)}function v(t){return t===null||t===62?E(t):b_(t)?(o=v,D(t)):(e.consume(t),v)}function y(t){return t===null?n(t):t===63?(e.consume(t),b):b_(t)?(o=y,D(t)):(e.consume(t),y)}function b(e){return e===62?E(e):y(e)}function x(t){return w_(t)?(e.consume(t),S):n(t)}function S(t){return t===45||T_(t)?(e.consume(t),S):C(t)}function C(t){return b_(t)?(o=C,D(t)):S_(t)?(e.consume(t),C):E(t)}function w(t){return t===45||T_(t)?(e.consume(t),w):t===47||t===62||x_(t)?ee(t):n(t)}function ee(t){return t===47?(e.consume(t),E):t===58||t===95||w_(t)?(e.consume(t),te):b_(t)?(o=ee,D(t)):S_(t)?(e.consume(t),ee):E(t)}function te(t){return t===45||t===46||t===58||t===95||T_(t)?(e.consume(t),te):ne(t)}function ne(t){return t===61?(e.consume(t),re):b_(t)?(o=ne,D(t)):S_(t)?(e.consume(t),ne):ee(t)}function re(t){return t===null||t===60||t===61||t===62||t===96?n(t):t===34||t===39?(e.consume(t),i=t,T):b_(t)?(o=re,D(t)):S_(t)?(e.consume(t),re):(e.consume(t),ie)}function T(t){return t===i?(e.consume(t),i=void 0,ae):t===null?n(t):b_(t)?(o=T,D(t)):(e.consume(t),T)}function ie(t){return t===null||t===34||t===39||t===60||t===61||t===96?n(t):t===47||t===62||x_(t)?ee(t):(e.consume(t),ie)}function ae(e){return e===47||e===62||x_(e)?ee(e):n(e)}function E(r){return r===62?(e.consume(r),e.exit(`htmlTextData`),e.exit(`htmlText`),t):n(r)}function D(t){return e.exit(`htmlTextData`),e.enter(`lineEnding`),e.consume(t),e.exit(`lineEnding`),oe}function oe(t){return S_(t)?hv(e,se,`linePrefix`,r.parser.constructs.disable.null.includes(`codeIndented`)?void 0:4)(t):se(t)}function se(t){return e.enter(`htmlTextData`),o(t)}}var BLe,VLe=s((()=>{gv(),k_(),BLe={name:`htmlText`,tokenize:zLe}}));function HLe(e){let t=-1;for(;++t<e.length;){let n=e[t][1];(n.type===`labelImage`||n.type===`labelLink`||n.type===`labelEnd`)&&(e.splice(t+1,n.type===`labelImage`?4:2),n.type=`data`,t++)}return e}function ULe(e,t){let n=e.length,r=0,i,a,o,s;for(;n--;)if(i=e[n][1],a){if(i.type===`link`||i.type===`labelLink`&&i._inactive)break;e[n][0]===`enter`&&i.type===`labelLink`&&(i._inactive=!0)}else if(o){if(e[n][0]===`enter`&&(i.type===`labelImage`||i.type===`labelLink`)&&!i._balanced&&(a=n,i.type!==`labelLink`)){r=2;break}}else i.type===`labelEnd`&&(o=n);let c={type:e[a][1].type===`labelLink`?`link`:`image`,start:Object.assign({},e[a][1].start),end:Object.assign({},e[e.length-1][1].end)},l={type:`label`,start:Object.assign({},e[a][1].start),end:Object.assign({},e[o][1].end)},u={type:`labelText`,start:Object.assign({},e[a+r+2][1].end),end:Object.assign({},e[o-2][1].start)};return s=[[`enter`,c,t],[`enter`,l,t]],s=X_(s,e.slice(a+1,a+r+3)),s=X_(s,[[`enter`,u,t]]),s=X_(s,fv(t.parser.constructs.insideSpan.null,e.slice(a+r+4,o-3),t)),s=X_(s,[[`exit`,u,t],e[o-2],e[o-1],[`exit`,l,t]]),s=X_(s,e.slice(o+1)),s=X_(s,[[`exit`,c,t]]),Y_(e,a,e.length,s),e}function WLe(e,t,n){let r=this,i=r.events.length,a,o;for(;i--;)if((r.events[i][1].type===`labelImage`||r.events[i][1].type===`labelLink`)&&!r.events[i][1]._balanced){a=r.events[i][1];break}return s;function s(t){return a?a._inactive?d(t):(o=r.parser.defined.includes(N_(r.sliceSerialize({start:a.end,end:r.now()}))),e.enter(`labelEnd`),e.enter(`labelMarker`),e.consume(t),e.exit(`labelMarker`),e.exit(`labelEnd`),c):n(t)}function c(t){return t===40?e.attempt(JLe,u,o?u:d)(t):t===91?e.attempt(YLe,u,o?l:d)(t):o?u(t):d(t)}function l(t){return e.attempt(XLe,u,d)(t)}function u(e){return t(e)}function d(e){return a._balanced=!0,n(e)}}function GLe(e,t,n){return r;function r(t){return e.enter(`resource`),e.enter(`resourceMarker`),e.consume(t),e.exit(`resourceMarker`),i}function i(t){return x_(t)?Ev(e,a)(t):a(t)}function a(t){return t===41?u(t):uLe(e,o,s,`resourceDestination`,`resourceDestinationLiteral`,`resourceDestinationLiteralMarker`,`resourceDestinationRaw`,`resourceDestinationString`,32)(t)}function o(t){return x_(t)?Ev(e,c)(t):u(t)}function s(e){return n(e)}function c(t){return t===34||t===39||t===40?mLe(e,l,n,`resourceTitle`,`resourceTitleMarker`,`resourceTitleString`)(t):u(t)}function l(t){return x_(t)?Ev(e,u)(t):u(t)}function u(r){return r===41?(e.enter(`resourceMarker`),e.consume(r),e.exit(`resourceMarker`),e.exit(`resource`),t):n(r)}}function KLe(e,t,n){let r=this;return i;function i(t){return fLe.call(r,e,a,o,`reference`,`referenceMarker`,`referenceString`)(t)}function a(e){return r.parser.defined.includes(N_(r.sliceSerialize(r.events[r.events.length-1][1]).slice(1,-1)))?t(e):n(e)}function o(e){return n(e)}}function qLe(e,t,n){return r;function r(t){return e.enter(`reference`),e.enter(`referenceMarker`),e.consume(t),e.exit(`referenceMarker`),i}function i(r){return r===93?(e.enter(`referenceMarker`),e.consume(r),e.exit(`referenceMarker`),e.exit(`reference`),t):n(r)}}var Ov,JLe,YLe,XLe,kv=s((()=>{dLe(),pLe(),hLe(),gLe(),k_(),Z_(),P_(),pv(),Ov={name:`labelEnd`,tokenize:WLe,resolveTo:ULe,resolveAll:HLe},JLe={tokenize:GLe},YLe={tokenize:KLe},XLe={tokenize:qLe}}));function ZLe(e,t,n){let r=this;return i;function i(t){return e.enter(`labelImage`),e.enter(`labelImageMarker`),e.consume(t),e.exit(`labelImageMarker`),a}function a(t){return t===91?(e.enter(`labelMarker`),e.consume(t),e.exit(`labelMarker`),e.exit(`labelImage`),o):n(t)}function o(e){return e===94&&`_hiddenFootnoteSupport`in r.parser.constructs?n(e):t(e)}}var QLe,$Le=s((()=>{kv(),QLe={name:`labelStartImage`,tokenize:ZLe,resolveAll:Ov.resolveAll}}));function eRe(e,t,n){let r=this;return i;function i(t){return e.enter(`labelLink`),e.enter(`labelMarker`),e.consume(t),e.exit(`labelMarker`),e.exit(`labelLink`),a}function a(e){return e===94&&`_hiddenFootnoteSupport`in r.parser.constructs?n(e):t(e)}}var tRe,nRe=s((()=>{kv(),tRe={name:`labelStartLink`,tokenize:eRe,resolveAll:Ov.resolveAll}}));function rRe(e,t){return n;function n(n){return e.enter(`lineEnding`),e.consume(n),e.exit(`lineEnding`),hv(e,t,`linePrefix`)}}var Av,iRe=s((()=>{gv(),Av={name:`lineEnding`,tokenize:rRe}}));function aRe(e,t,n){let r=0,i;return a;function a(t){return e.enter(`thematicBreak`),o(t)}function o(e){return i=e,s(e)}function s(a){return a===i?(e.enter(`thematicBreakSequence`),c(a)):r>=3&&(a===null||b_(a))?(e.exit(`thematicBreak`),t(a)):n(a)}function c(t){return t===i?(e.consume(t),r++,c):(e.exit(`thematicBreakSequence`),S_(t)?hv(e,s,`whitespace`)(t):s(t))}}var jv,oRe=s((()=>{gv(),k_(),jv={name:`thematicBreak`,tokenize:aRe}}));function sRe(e,t,n){let r=this,i=r.events[r.events.length-1],a=i&&i[1].type===`linePrefix`?i[2].sliceSerialize(i[1],!0).length:0,o=0;return s;function s(t){let i=r.containerState.type||(t===42||t===43||t===45?`listUnordered`:`listOrdered`);if(i===`listUnordered`?!r.containerState.marker||t===r.containerState.marker:E_(t)){if(r.containerState.type||(r.containerState.type=i,e.enter(i,{_container:!0})),i===`listUnordered`)return e.enter(`listItemPrefix`),t===42||t===45?e.check(jv,n,l)(t):l(t);if(!r.interrupt||t===49)return e.enter(`listItemPrefix`),e.enter(`listItemValue`),c(t)}return n(t)}function c(t){return E_(t)&&++o<10?(e.consume(t),c):(!r.interrupt||o<2)&&(r.containerState.marker?t===r.containerState.marker:t===41||t===46)?(e.exit(`listItemValue`),l(t)):n(t)}function l(t){return e.enter(`listItemMarker`),e.consume(t),e.exit(`listItemMarker`),r.containerState.marker=r.containerState.marker||t,e.check(_v,r.interrupt?n:u,e.attempt(fRe,f,d))}function u(e){return r.containerState.initialBlankLine=!0,a++,f(e)}function d(t){return S_(t)?(e.enter(`listItemPrefixWhitespace`),e.consume(t),e.exit(`listItemPrefixWhitespace`),f):n(t)}function f(n){return r.containerState.size=a+r.sliceSerialize(e.exit(`listItemPrefix`),!0).length,t(n)}}function cRe(e,t,n){let r=this;return r.containerState._closeFlow=void 0,e.check(_v,i,a);function i(n){return r.containerState.furtherBlankLines=r.containerState.furtherBlankLines||r.containerState.initialBlankLine,hv(e,t,`listItemIndent`,r.containerState.size+1)(n)}function a(n){return r.containerState.furtherBlankLines||!S_(n)?(r.containerState.furtherBlankLines=void 0,r.containerState.initialBlankLine=void 0,o(n)):(r.containerState.furtherBlankLines=void 0,r.containerState.initialBlankLine=void 0,e.attempt(pRe,t,o)(n))}function o(i){return r.containerState._closeFlow=!0,r.interrupt=void 0,hv(e,e.attempt(Mv,t,n),`linePrefix`,r.parser.constructs.disable.null.includes(`codeIndented`)?void 0:4)(i)}}function lRe(e,t,n){let r=this;return hv(e,i,`listItemIndent`,r.containerState.size+1);function i(e){let i=r.events[r.events.length-1];return i&&i[1].type===`listItemIndent`&&i[2].sliceSerialize(i[1],!0).length===r.containerState.size?t(e):n(e)}}function uRe(e){e.exit(this.containerState.type)}function dRe(e,t,n){let r=this;return hv(e,i,`listItemPrefixWhitespace`,r.parser.constructs.disable.null.includes(`codeIndented`)?void 0:5);function i(e){let i=r.events[r.events.length-1];return!S_(e)&&i&&i[1].type===`listItemPrefixWhitespace`?t(e):n(e)}}var Mv,fRe,pRe,mRe=s((()=>{gv(),k_(),vv(),oRe(),Mv={name:`list`,tokenize:sRe,continuation:{tokenize:cRe},exit:uRe},fRe={tokenize:dRe,partial:!0},pRe={tokenize:lRe,partial:!0}}));function hRe(e,t){let n=e.length,r,i,a;for(;n--;)if(e[n][0]===`enter`){if(e[n][1].type===`content`){r=n;break}e[n][1].type===`paragraph`&&(i=n)}else e[n][1].type===`content`&&e.splice(n,1),!a&&e[n][1].type===`definition`&&(a=n);let o={type:`setextHeading`,start:Object.assign({},e[i][1].start),end:Object.assign({},e[e.length-1][1].end)};return e[i][1].type=`setextHeadingText`,a?(e.splice(i,0,[`enter`,o,t]),e.splice(a+1,0,[`exit`,e[r][1],t]),e[r][1].end=Object.assign({},e[a][1].end)):e[r][1]=o,e.push([`exit`,o,t]),e}function gRe(e,t,n){let r=this,i;return a;function a(t){let a=r.events.length,s;for(;a--;)if(r.events[a][1].type!==`lineEnding`&&r.events[a][1].type!==`linePrefix`&&r.events[a][1].type!==`content`){s=r.events[a][1].type===`paragraph`;break}return!r.parser.lazy[r.now().line]&&(r.interrupt||s)?(e.enter(`setextHeadingLine`),i=t,o(t)):n(t)}function o(t){return e.enter(`setextHeadingLineSequence`),s(t)}function s(t){return t===i?(e.consume(t),s):(e.exit(`setextHeadingLineSequence`),S_(t)?hv(e,c,`lineSuffix`)(t):c(t))}function c(r){return r===null||b_(r)?(e.exit(`setextHeadingLine`),t(r)):n(r)}}var Nv,_Re=s((()=>{gv(),k_(),Nv={name:`setextUnderline`,tokenize:gRe,resolveTo:hRe}})),Pv=s((()=>{OIe(),jIe(),vv(),IIe(),RIe(),BIe(),UIe(),qIe(),QIe(),lLe(),xLe(),wLe(),OLe(),RLe(),VLe(),kv(),$Le(),nRe(),iRe(),mRe(),_Re(),oRe()}));function vRe(){return{document:{91:{tokenize:SRe,continuation:{tokenize:CRe},exit:wRe}},text:{91:{tokenize:xRe},93:{add:`after`,tokenize:yRe,resolveTo:bRe}}}}function yRe(e,t,n){let r=this,i=r.events.length,a=r.parser.gfmFootnotes||(r.parser.gfmFootnotes=[]),o;for(;i--;){let e=r.events[i][1];if(e.type===`labelImage`){o=e;break}if(e.type===`gfmFootnoteCall`||e.type===`labelLink`||e.type===`label`||e.type===`image`||e.type===`link`)break}return s;function s(i){if(!o||!o._balanced)return n(i);let s=N_(r.sliceSerialize({start:o.end,end:r.now()}));return s.codePointAt(0)!==94||!a.includes(s.slice(1))?n(i):(e.enter(`gfmFootnoteCallLabelMarker`),e.consume(i),e.exit(`gfmFootnoteCallLabelMarker`),t(i))}}function bRe(e,t){let n=e.length;for(;n--;)if(e[n][1].type===`labelImage`&&e[n][0]===`enter`){e[n][1];break}e[n+1][1].type=`data`,e[n+3][1].type=`gfmFootnoteCallLabelMarker`;let r={type:`gfmFootnoteCall`,start:Object.assign({},e[n+3][1].start),end:Object.assign({},e[e.length-1][1].end)},i={type:`gfmFootnoteCallMarker`,start:Object.assign({},e[n+3][1].end),end:Object.assign({},e[n+3][1].end)};i.end.column++,i.end.offset++,i.end._bufferIndex++;let a={type:`gfmFootnoteCallString`,start:Object.assign({},i.end),end:Object.assign({},e[e.length-1][1].start)},o={type:`chunkString`,contentType:`string`,start:Object.assign({},a.start),end:Object.assign({},a.end)},s=[e[n+1],e[n+2],[`enter`,r,t],e[n+3],e[n+4],[`enter`,i,t],[`exit`,i,t],[`enter`,a,t],[`enter`,o,t],[`exit`,o,t],[`exit`,a,t],e[e.length-2],e[e.length-1],[`exit`,r,t]];return e.splice(n,e.length-n+1,...s),e}function xRe(e,t,n){let r=this,i=r.parser.gfmFootnotes||(r.parser.gfmFootnotes=[]),a=0,o;return s;function s(t){return e.enter(`gfmFootnoteCall`),e.enter(`gfmFootnoteCallLabelMarker`),e.consume(t),e.exit(`gfmFootnoteCallLabelMarker`),c}function c(t){return t===94?(e.enter(`gfmFootnoteCallMarker`),e.consume(t),e.exit(`gfmFootnoteCallMarker`),e.enter(`gfmFootnoteCallString`),e.enter(`chunkString`).contentType=`string`,l):n(t)}function l(s){if(a>999||s===93&&!o||s===null||s===91||x_(s))return n(s);if(s===93){e.exit(`chunkString`);let a=e.exit(`gfmFootnoteCallString`);return i.includes(N_(r.sliceSerialize(a)))?(e.enter(`gfmFootnoteCallLabelMarker`),e.consume(s),e.exit(`gfmFootnoteCallLabelMarker`),e.exit(`gfmFootnoteCall`),t):n(s)}return x_(s)||(o=!0),a++,e.consume(s),s===92?u:l}function u(t){return t===91||t===92||t===93?(e.consume(t),a++,l):l(t)}}function SRe(e,t,n){let r=this,i=r.parser.gfmFootnotes||(r.parser.gfmFootnotes=[]),a,o=0,s;return c;function c(t){return e.enter(`gfmFootnoteDefinition`)._container=!0,e.enter(`gfmFootnoteDefinitionLabel`),e.enter(`gfmFootnoteDefinitionLabelMarker`),e.consume(t),e.exit(`gfmFootnoteDefinitionLabelMarker`),l}function l(t){return t===94?(e.enter(`gfmFootnoteDefinitionMarker`),e.consume(t),e.exit(`gfmFootnoteDefinitionMarker`),e.enter(`gfmFootnoteDefinitionLabelString`),e.enter(`chunkString`).contentType=`string`,u):n(t)}function u(t){if(o>999||t===93&&!s||t===null||t===91||x_(t))return n(t);if(t===93){e.exit(`chunkString`);let n=e.exit(`gfmFootnoteDefinitionLabelString`);return a=N_(r.sliceSerialize(n)),e.enter(`gfmFootnoteDefinitionLabelMarker`),e.consume(t),e.exit(`gfmFootnoteDefinitionLabelMarker`),e.exit(`gfmFootnoteDefinitionLabel`),f}return x_(t)||(s=!0),o++,e.consume(t),t===92?d:u}function d(t){return t===91||t===92||t===93?(e.consume(t),o++,u):u(t)}function f(t){return t===58?(e.enter(`definitionMarker`),e.consume(t),e.exit(`definitionMarker`),i.includes(a)||i.push(a),hv(e,p,`gfmFootnoteDefinitionWhitespace`)):n(t)}function p(e){return t(e)}}function CRe(e,t,n){return e.check(_v,t,e.attempt(ERe,t,n))}function wRe(e){e.exit(`gfmFootnoteDefinition`)}function TRe(e,t,n){let r=this;return hv(e,i,`gfmFootnoteDefinitionIndent`,5);function i(e){let i=r.events[r.events.length-1];return i&&i[1].type===`gfmFootnoteDefinitionIndent`&&i[2].sliceSerialize(i[1],!0).length===4?t(e):n(e)}}var ERe,DRe=s((()=>{Pv(),gv(),k_(),P_(),ERe={tokenize:TRe,partial:!0}})),ORe=s((()=>{DRe()}));function kRe(e){let t=(e||{}).singleTilde,n={tokenize:i,resolveAll:r};return t??=!0,{text:{126:n},insideSpan:{null:[n]},attentionMarkers:{null:[126]}};function r(e,t){let n=-1;for(;++n<e.length;)if(e[n][0]===`enter`&&e[n][1].type===`strikethroughSequenceTemporary`&&e[n][1]._close){let r=n;for(;r--;)if(e[r][0]===`exit`&&e[r][1].type===`strikethroughSequenceTemporary`&&e[r][1]._open&&e[n][1].end.offset-e[n][1].start.offset===e[r][1].end.offset-e[r][1].start.offset){e[n][1].type=`strikethroughSequence`,e[r][1].type=`strikethroughSequence`;let i={type:`strikethrough`,start:Object.assign({},e[r][1].start),end:Object.assign({},e[n][1].end)},a={type:`strikethroughText`,start:Object.assign({},e[r][1].end),end:Object.assign({},e[n][1].start)},o=[[`enter`,i,t],[`enter`,e[r][1],t],[`exit`,e[r][1],t],[`enter`,a,t]],s=t.parser.constructs.insideSpan.null;s&&Y_(o,o.length,0,fv(s,e.slice(r+1,n),t)),Y_(o,o.length,0,[[`exit`,a,t],[`enter`,e[n][1],t],[`exit`,e[n][1],t],[`exit`,i,t]]),Y_(e,r-1,n-r+3,o),n=r+o.length-2;break}}for(n=-1;++n<e.length;)e[n][1].type===`strikethroughSequenceTemporary`&&(e[n][1].type=`data`);return e}function i(e,n,r){let i=this.previous,a=this.events,o=0;return s;function s(t){return i===126&&a[a.length-1][1].type!==`characterEscape`?r(t):(e.enter(`strikethroughSequenceTemporary`),c(t))}function c(a){let s=dv(i);if(a===126)return o>1?r(a):(e.consume(a),o++,c);if(o<2&&!t)return r(a);let l=e.exit(`strikethroughSequenceTemporary`),u=dv(a);return l._open=!u||u===2&&!!s,l._close=!s||s===2&&!!u,n(a)}}}var ARe=s((()=>{Z_(),wIe(),pv()})),jRe=s((()=>{ARe()}));function MRe(e,t,n,r){let i=0;if(!(n===0&&r.length===0)){for(;i<e.map.length;){if(e.map[i][0]===t){e.map[i][1]+=n,e.map[i][2].push(...r);return}i+=1}e.map.push([t,n,r])}}var NRe,PRe=s((()=>{NRe=class{constructor(){this.map=[]}add(e,t,n){MRe(this,e,t,n)}consume(e){if(this.map.sort(function(e,t){return e[0]-t[0]}),this.map.length===0)return;let t=this.map.length,n=[];for(;t>0;)--t,n.push(e.slice(this.map[t][0]+this.map[t][1]),this.map[t][2]),e.length=this.map[t][0];n.push([...e]),e.length=0;let r=n.pop();for(;r;)e.push(...r),r=n.pop();this.map.length=0}}}));function FRe(e,t){let n=!1,r=[];for(;t<e.length;){let i=e[t];if(n){if(i[0]===`enter`)i[1].type===`tableContent`&&r.push(e[t+1][1].type===`tableDelimiterMarker`?`left`:`none`);else if(i[1].type===`tableContent`){if(e[t-1][1].type===`tableDelimiterMarker`){let e=r.length-1;r[e]=r[e]===`left`?`center`:`right`}}else if(i[1].type===`tableDelimiterRow`)break}else i[0]===`enter`&&i[1].type===`tableDelimiterRow`&&(n=!0);t+=1}return r}var IRe=s((()=>{}));function LRe(){return{flow:{null:{tokenize:RRe,resolveAll:zRe}}}}function RRe(e,t,n){let r=this,i=0,a=0,o;return s;function s(e){let t=r.events.length-1;for(;t>-1;){let e=r.events[t][1].type;if(e===`lineEnding`||e===`linePrefix`)t--;else break}let i=t>-1?r.events[t][1].type:null,a=i===`tableHead`||i===`tableRow`?S:c;return a===S&&r.parser.lazy[r.now().line]?n(e):a(e)}function c(t){return e.enter(`tableHead`),e.enter(`tableRow`),l(t)}function l(e){return e===124?u(e):(o=!0,a+=1,u(e))}function u(t){return t===null?n(t):b_(t)?a>1?(a=0,r.interrupt=!0,e.exit(`tableRow`),e.enter(`lineEnding`),e.consume(t),e.exit(`lineEnding`),p):n(t):S_(t)?hv(e,u,`whitespace`)(t):(a+=1,o&&(o=!1,i+=1),t===124?(e.enter(`tableCellDivider`),e.consume(t),e.exit(`tableCellDivider`),o=!0,u):(e.enter(`data`),d(t)))}function d(t){return t===null||t===124||x_(t)?(e.exit(`data`),u(t)):(e.consume(t),t===92?f:d)}function f(t){return t===92||t===124?(e.consume(t),d):d(t)}function p(t){return r.interrupt=!1,r.parser.lazy[r.now().line]?n(t):(e.enter(`tableDelimiterRow`),o=!1,S_(t)?hv(e,m,`linePrefix`,r.parser.constructs.disable.null.includes(`codeIndented`)?void 0:4)(t):m(t))}function m(t){return t===45||t===58?g(t):t===124?(o=!0,e.enter(`tableCellDivider`),e.consume(t),e.exit(`tableCellDivider`),h):x(t)}function h(t){return S_(t)?hv(e,g,`whitespace`)(t):g(t)}function g(t){return t===58?(a+=1,o=!0,e.enter(`tableDelimiterMarker`),e.consume(t),e.exit(`tableDelimiterMarker`),_):t===45?(a+=1,_(t)):t===null||b_(t)?b(t):x(t)}function _(t){return t===45?(e.enter(`tableDelimiterFiller`),v(t)):x(t)}function v(t){return t===45?(e.consume(t),v):t===58?(o=!0,e.exit(`tableDelimiterFiller`),e.enter(`tableDelimiterMarker`),e.consume(t),e.exit(`tableDelimiterMarker`),y):(e.exit(`tableDelimiterFiller`),y(t))}function y(t){return S_(t)?hv(e,b,`whitespace`)(t):b(t)}function b(n){return n===124?m(n):n===null||b_(n)?!o||i!==a?x(n):(e.exit(`tableDelimiterRow`),e.exit(`tableHead`),t(n)):x(n)}function x(e){return n(e)}function S(t){return e.enter(`tableRow`),C(t)}function C(n){return n===124?(e.enter(`tableCellDivider`),e.consume(n),e.exit(`tableCellDivider`),C):n===null||b_(n)?(e.exit(`tableRow`),t(n)):S_(n)?hv(e,C,`whitespace`)(n):(e.enter(`data`),w(n))}function w(t){return t===null||t===124||x_(t)?(e.exit(`data`),C(t)):(e.consume(t),t===92?ee:w)}function ee(t){return t===92||t===124?(e.consume(t),w):w(t)}}function zRe(e,t){let n=-1,r=!0,i=0,a=[0,0,0,0],o=[0,0,0,0],s=!1,c=0,l,u,d,f=new NRe;for(;++n<e.length;){let p=e[n],m=p[1];p[0]===`enter`?m.type===`tableHead`?(s=!1,c!==0&&(BRe(f,t,c,l,u),u=void 0,c=0),l={type:`table`,start:Object.assign({},m.start),end:Object.assign({},m.end)},f.add(n,0,[[`enter`,l,t]])):m.type===`tableRow`||m.type===`tableDelimiterRow`?(r=!0,d=void 0,a=[0,0,0,0],o=[0,n+1,0,0],s&&(s=!1,u={type:`tableBody`,start:Object.assign({},m.start),end:Object.assign({},m.end)},f.add(n,0,[[`enter`,u,t]])),i=m.type===`tableDelimiterRow`?2:u?3:1):i&&(m.type===`data`||m.type===`tableDelimiterMarker`||m.type===`tableDelimiterFiller`)?(r=!1,o[2]===0&&(a[1]!==0&&(o[0]=o[1],d=Fv(f,t,a,i,void 0,d),a=[0,0,0,0]),o[2]=n)):m.type===`tableCellDivider`&&(r?r=!1:(a[1]!==0&&(o[0]=o[1],d=Fv(f,t,a,i,void 0,d)),a=o,o=[a[1],n,0,0])):m.type===`tableHead`?(s=!0,c=n):m.type===`tableRow`||m.type===`tableDelimiterRow`?(c=n,a[1]===0?o[1]!==0&&(d=Fv(f,t,o,i,n,d)):(o[0]=o[1],d=Fv(f,t,a,i,n,d)),i=0):i&&(m.type===`data`||m.type===`tableDelimiterMarker`||m.type===`tableDelimiterFiller`)&&(o[3]=n)}for(c!==0&&BRe(f,t,c,l,u),f.consume(t.events),n=-1;++n<t.events.length;){let e=t.events[n];e[0]===`enter`&&e[1].type===`table`&&(e[1]._align=FRe(t.events,n))}return e}function Fv(e,t,n,r,i,a){let o=r===1?`tableHeader`:r===2?`tableDelimiter`:`tableData`;n[0]!==0&&(a.end=Object.assign({},Iv(t.events,n[0])),e.add(n[0],0,[[`exit`,a,t]]));let s=Iv(t.events,n[1]);if(a={type:o,start:Object.assign({},s),end:Object.assign({},s)},e.add(n[1],0,[[`enter`,a,t]]),n[2]!==0){let i=Iv(t.events,n[2]),a=Iv(t.events,n[3]),o={type:`tableContent`,start:Object.assign({},i),end:Object.assign({},a)};if(e.add(n[2],0,[[`enter`,o,t]]),r!==2){let r=t.events[n[2]],i=t.events[n[3]];if(r[1].end=Object.assign({},i[1].end),r[1].type=`chunkText`,r[1].contentType=`text`,n[3]>n[2]+1){let t=n[2]+1,r=n[3]-n[2]-1;e.add(t,r,[])}}e.add(n[3]+1,0,[[`exit`,o,t]])}return i!==void 0&&(a.end=Object.assign({},Iv(t.events,i)),e.add(i,0,[[`exit`,a,t]]),a=void 0),a}function BRe(e,t,n,r,i){let a=[],o=Iv(t.events,n);i&&(i.end=Object.assign({},o),a.push([`exit`,i,t])),r.end=Object.assign({},o),a.push([`exit`,r,t]),e.add(n+1,0,a)}function Iv(e,t){let n=e[t],r=n[0]===`enter`?`start`:`end`;return n[1][r]}var VRe=s((()=>{gv(),k_(),PRe(),IRe()})),HRe=s((()=>{VRe()}));function URe(){return{text:{91:KRe}}}function WRe(e,t,n){let r=this;return i;function i(t){return r.previous!==null||!r._gfmTasklistFirstContentOfListItem?n(t):(e.enter(`taskListCheck`),e.enter(`taskListCheckMarker`),e.consume(t),e.exit(`taskListCheckMarker`),a)}function a(t){return x_(t)?(e.enter(`taskListCheckValueUnchecked`),e.consume(t),e.exit(`taskListCheckValueUnchecked`),o):t===88||t===120?(e.enter(`taskListCheckValueChecked`),e.consume(t),e.exit(`taskListCheckValueChecked`),o):n(t)}function o(t){return t===93?(e.enter(`taskListCheckMarker`),e.consume(t),e.exit(`taskListCheckMarker`),e.exit(`taskListCheck`),s):n(t)}function s(r){return b_(r)?t(r):S_(r)?e.check({tokenize:GRe},t,n)(r):n(r)}}function GRe(e,t,n){return hv(e,r,`whitespace`);function r(e){return e===null?n(e):t(e)}}var KRe,qRe=s((()=>{gv(),k_(),KRe={tokenize:WRe}})),JRe=s((()=>{qRe()}));function YRe(e){return iIe([cIe(),vRe(),kRe(e),LRe(),URe()])}var XRe=s((()=>{sIe(),CIe(),ORe(),jRe(),HRe(),JRe()}));function Lv(e){let t=this,n=e||ZRe,r=t.data(),i=r.micromarkExtensions||=[],a=r.fromMarkdownExtensions||=[],o=r.toMarkdownExtensions||=[];i.push(YRe(n)),a.push(eIe()),o.push(tIe(n))}var ZRe,QRe=s((()=>{rIe(),XRe(),ZRe={}})),$Re=s((()=>{QRe()}));function eze(e){let t=e.attempt(this.parser.constructs.contentInitial,r,i),n;return t;function r(n){if(n===null){e.consume(n);return}return e.enter(`lineEnding`),e.consume(n),e.exit(`lineEnding`),hv(e,t,`linePrefix`)}function i(t){return e.enter(`paragraph`),a(t)}function a(t){let r=e.enter(`chunkText`,{contentType:`text`,previous:n});return n&&(n.next=r),n=r,o(t)}function o(t){if(t===null){e.exit(`chunkText`),e.exit(`paragraph`),e.consume(t);return}return b_(t)?(e.consume(t),e.exit(`chunkText`),a):(e.consume(t),o)}}var Rv,tze=s((()=>{gv(),k_(),Rv={tokenize:eze}}));function nze(e){let t=this,n=[],r=0,i,a,o;return s;function s(i){if(r<n.length){let a=n[r];return t.containerState=a[1],e.attempt(a[0].continuation,c,l)(i)}return l(i)}function c(e){if(r++,t.containerState._closeFlow){t.containerState._closeFlow=void 0,i&&v();let n=t.events.length,a=n,o;for(;a--;)if(t.events[a][0]===`exit`&&t.events[a][1].type===`chunkFlow`){o=t.events[a][1].end;break}_(r);let s=n;for(;s<t.events.length;)t.events[s][1].end=Object.assign({},o),s++;return Y_(t.events,a+1,0,t.events.slice(n)),t.events.length=s,l(e)}return s(e)}function l(a){if(r===n.length){if(!i)return f(a);if(i.currentConstruct&&i.currentConstruct.concrete)return m(a);t.interrupt=!!(i.currentConstruct&&!i._gfmTableDynamicInterruptHack)}return t.containerState={},e.check(Bv,u,d)(a)}function u(e){return i&&v(),_(r),f(e)}function d(e){return t.parser.lazy[t.now().line]=r!==n.length,o=t.now().offset,m(e)}function f(n){return t.containerState={},e.attempt(Bv,p,m)(n)}function p(e){return r++,n.push([t.currentConstruct,t.containerState]),f(e)}function m(n){if(n===null){i&&v(),_(0),e.consume(n);return}return i||=t.parser.flow(t.now()),e.enter(`chunkFlow`,{contentType:`flow`,previous:a,_tokenizer:i}),h(n)}function h(n){if(n===null){g(e.exit(`chunkFlow`),!0),_(0),e.consume(n);return}return b_(n)?(e.consume(n),g(e.exit(`chunkFlow`)),r=0,t.interrupt=void 0,s):(e.consume(n),h)}function g(e,n){let s=t.sliceStream(e);if(n&&s.push(null),e.previous=a,a&&(a.next=e),a=e,i.defineSkip(e.start),i.write(s),t.parser.lazy[e.start.line]){let e=i.events.length;for(;e--;)if(i.events[e][1].start.offset<o&&(!i.events[e][1].end||i.events[e][1].end.offset>o))return;let n=t.events.length,a=n,s,c;for(;a--;)if(t.events[a][0]===`exit`&&t.events[a][1].type===`chunkFlow`){if(s){c=t.events[a][1].end;break}s=!0}for(_(r),e=n;e<t.events.length;)t.events[e][1].end=Object.assign({},c),e++;Y_(t.events,a+1,0,t.events.slice(n)),t.events.length=e}}function _(r){let i=n.length;for(;i-- >r;){let r=n[i];t.containerState=r[1],r[0].exit.call(t,e)}n.length=r}function v(){i.write([null]),a=void 0,i=void 0,t.containerState._closeFlow=void 0}}function rze(e,t,n){return hv(e,e.attempt(this.parser.constructs.document,t,n),`linePrefix`,this.parser.constructs.disable.null.includes(`codeIndented`)?void 0:4)}var zv,Bv,ize=s((()=>{gv(),k_(),Z_(),zv={tokenize:nze},Bv={tokenize:rze}}));function aze(e){let t=this,n=e.attempt(_v,r,e.attempt(this.parser.constructs.flowInitial,i,hv(e,e.attempt(this.parser.constructs.flow,i,e.attempt(sLe,i)),`linePrefix`)));return n;function r(r){if(r===null){e.consume(r);return}return e.enter(`lineEndingBlank`),e.consume(r),e.exit(`lineEndingBlank`),t.currentConstruct=void 0,n}function i(r){if(r===null){e.consume(r);return}return e.enter(`lineEnding`),e.consume(r),e.exit(`lineEnding`),t.currentConstruct=void 0,n}}var Vv,oze=s((()=>{Pv(),gv(),Vv={tokenize:aze}}));function Hv(e){return{tokenize:t,resolveAll:Uv(e===`text`?sze:void 0)};function t(t){let n=this,r=this.parser.constructs[e],i=t.attempt(r,a,o);return a;function a(e){return c(e)?i(e):o(e)}function o(e){if(e===null){t.consume(e);return}return t.enter(`data`),t.consume(e),s}function s(e){return c(e)?(t.exit(`data`),i(e)):(t.consume(e),s)}function c(e){if(e===null)return!0;let t=r[e],i=-1;if(t)for(;++i<t.length;){let e=t[i];if(!e.previous||e.previous.call(n,n.previous))return!0}return!1}}}function Uv(e){return t;function t(t,n){let r=-1,i;for(;++r<=t.length;)i===void 0?t[r]&&t[r][1].type===`data`&&(i=r,r++):(!t[r]||t[r][1].type!==`data`)&&(r!==i+2&&(t[i][1].end=t[r-1][1].end,t.splice(i+2,r-i-2),r=i+2),i=void 0);return e?e(t,n):t}}function sze(e,t){let n=0;for(;++n<=e.length;)if((n===e.length||e[n][1].type===`lineEnding`)&&e[n-1][1].type===`data`){let r=e[n-1][1],i=t.sliceStream(r),a=i.length,o=-1,s=0,c;for(;a--;){let e=i[a];if(typeof e==`string`){for(o=e.length;e.charCodeAt(o-1)===32;)s++,o--;if(o)break;o=-1}else if(e===-2)c=!0,s++;else if(e!==-1){a++;break}}if(s){let i={type:n===e.length||c||s<2?`lineSuffix`:`hardBreakTrailing`,start:{line:r.end.line,column:r.end.column-s,offset:r.end.offset-s,_index:r.start._index+a,_bufferIndex:a?o:r.start._bufferIndex+o},end:Object.assign({},r.end)};r.end=Object.assign({},i.start),r.start.offset===r.end.offset?Object.assign(r,i):(e.splice(n,0,[`enter`,i,t],[`exit`,i,t]),n+=2)}n++}return e}var Wv,Gv,Kv,qv=s((()=>{Wv={resolveAll:Uv()},Gv=Hv(`string`),Kv=Hv(`text`)}));function cze(e,t,n){let r=Object.assign(n?Object.assign({},n):{line:1,column:1,offset:0},{_index:0,_bufferIndex:-1}),i={},a=[],o=[],s=[],c={consume:v,enter:y,exit:b,attempt:C(x),check:C(S),interrupt:C(S,{interrupt:!0})},l={previous:null,code:null,containerState:{},events:[],parser:e,sliceStream:p,sliceSerialize:f,now:m,defineSkip:h,write:d},u=t.tokenize.call(l,c);return t.resolveAll&&a.push(t),l;function d(e){return o=X_(o,e),g(),o[o.length-1]===null?(w(t,0),l.events=fv(a,l.events,l),l.events):[]}function f(e,t){return uze(p(e),t)}function p(e){return lze(o,e)}function m(){let{line:e,column:t,offset:n,_index:i,_bufferIndex:a}=r;return{line:e,column:t,offset:n,_index:i,_bufferIndex:a}}function h(e){i[e.line]=e.column,te()}function g(){let e;for(;r._index<o.length;){let t=o[r._index];if(typeof t==`string`)for(e=r._index,r._bufferIndex<0&&(r._bufferIndex=0);r._index===e&&r._bufferIndex<t.length;)_(t.charCodeAt(r._bufferIndex));else _(t)}}function _(e){u=u(e)}function v(e){b_(e)?(r.line++,r.column=1,r.offset+=e===-3?2:1,te()):e!==-1&&(r.column++,r.offset++),r._bufferIndex<0?r._index++:(r._bufferIndex++,r._bufferIndex===o[r._index].length&&(r._bufferIndex=-1,r._index++)),l.previous=e}function y(e,t){let n=t||{};return n.type=e,n.start=m(),l.events.push([`enter`,n,l]),s.push(n),n}function b(e){let t=s.pop();return t.end=m(),l.events.push([`exit`,t,l]),t}function x(e,t){w(e,t.from)}function S(e,t){t.restore()}function C(e,t){return n;function n(n,r,i){let a,o,s,u;return Array.isArray(n)?f(n):`tokenize`in n?f([n]):d(n);function d(e){return t;function t(t){let n=t!==null&&e[t],r=t!==null&&e.null;return f([...Array.isArray(n)?n:n?[n]:[],...Array.isArray(r)?r:r?[r]:[]])(t)}}function f(e){return a=e,o=0,e.length===0?i:p(e[o])}function p(e){return n;function n(n){return u=ee(),s=e,e.partial||(l.currentConstruct=e),e.name&&l.parser.constructs.disable.null.includes(e.name)?h(n):e.tokenize.call(t?Object.assign(Object.create(l),t):l,c,m,h)(n)}}function m(t){return e(s,u),r}function h(e){return u.restore(),++o<a.length?p(a[o]):i}}}function w(e,t){e.resolveAll&&!a.includes(e)&&a.push(e),e.resolve&&Y_(l.events,t,l.events.length-t,e.resolve(l.events.slice(t),l)),e.resolveTo&&(l.events=e.resolveTo(l.events,l))}function ee(){let e=m(),t=l.previous,n=l.currentConstruct,i=l.events.length,a=Array.from(s);return{restore:o,from:i};function o(){r=e,l.previous=t,l.currentConstruct=n,l.events.length=i,s=a,te()}}function te(){r.line in i&&r.column<2&&(r.column=i[r.line],r.offset+=i[r.line]-1)}}function lze(e,t){let n=t.start._index,r=t.start._bufferIndex,i=t.end._index,a=t.end._bufferIndex,o;if(n===i)o=[e[n].slice(r,a)];else{if(o=e.slice(n,i),r>-1){let e=o[0];typeof e==`string`?o[0]=e.slice(r):o.shift()}a>0&&o.push(e[i].slice(0,a))}return o}function uze(e,t){let n=-1,r=[],i;for(;++n<e.length;){let a=e[n],o;if(typeof a==`string`)o=a;else switch(a){case-5:o=`\r`;break;case-4:o=`
-`;break;case-3:o=`\r
-`;break;case-2:o=t?` `:`	`;break;case-1:if(!t&&i)continue;o=` `;break;default:o=String.fromCharCode(a)}i=a===-2,r.push(o)}return r.join(``)}var dze=s((()=>{k_(),Z_(),pv()})),fze=l({attentionMarkers:()=>ty,contentInitial:()=>Yv,disable:()=>ny,document:()=>Jv,flow:()=>Zv,flowInitial:()=>Xv,insideSpan:()=>ey,string:()=>Qv,text:()=>$v}),Jv,Yv,Xv,Zv,Qv,$v,ey,ty,ny,pze=s((()=>{Pv(),qv(),Jv={42:Mv,43:Mv,45:Mv,48:Mv,49:Mv,50:Mv,51:Mv,52:Mv,53:Mv,54:Mv,55:Mv,56:Mv,57:Mv,62:yv},Yv={91:yLe},Xv={[-2]:wv,[-1]:wv,32:wv},Zv={35:DLe,42:jv,45:[Nv,jv],60:FLe,61:Nv,95:jv,96:Cv,126:Cv},Qv={38:xv,92:bv},$v={[-5]:Av,[-4]:Av,[-3]:Av,33:QLe,38:xv,42:mv,60:[AIe,BLe],91:tRe,92:[CLe,bv],93:Ov,95:mv,96:ZIe},ey={null:[mv,Wv]},ty={null:[42,95]},ny={null:[]}}));function mze(e){let t={defined:[],lazy:{},constructs:iIe([fze,...(e||{}).extensions||[]]),content:n(Rv),document:n(zv),flow:n(Vv),string:n(Gv),text:n(Kv)};return t;function n(e){return n;function n(n){return cze(t,e,n)}}}var hze=s((()=>{sIe(),tze(),ize(),oze(),qv(),dze(),pze()}));function gze(e){for(;!tLe(e););return e}var _ze=s((()=>{rLe()}));function vze(){let e=1,t=``,n=!0,r;return i;function i(i,a,o){let s=[],c,l,u,d,f;for(i=t+(typeof i==`string`?i.toString():new TextDecoder(a||void 0).decode(i)),u=0,t=``,n&&=(i.charCodeAt(0)===65279&&u++,void 0);u<i.length;){if(ry.lastIndex=u,c=ry.exec(i),d=c&&c.index!==void 0?c.index:i.length,f=i.charCodeAt(d),!c){t=i.slice(u);break}if(f===10&&u===d&&r)s.push(-3),r=void 0;else switch(r&&=(s.push(-5),void 0),u<d&&(s.push(i.slice(u,d)),e+=d-u),f){case 0:s.push(65533),e++;break;case 9:for(l=Math.ceil(e/4)*4,s.push(-2);e++<l;)s.push(-1);break;case 10:s.push(-4),e=1;break;default:r=!0,e=1}u=d+1}return o&&(r&&s.push(-5),t&&s.push(t),s.push(null)),s}}var ry,yze=s((()=>{ry=/[\0\t\n\r]/g})),bze=s((()=>{hze(),_ze(),yze()}));function xze(e,t,n){return typeof t!=`string`&&(n=t,t=void 0),Sze(n)(gze(mze(n).document().write(vze()(e,t,!0))))}function Sze(e){let t={transforms:[],canContainEols:[`emphasis`,`fragment`,`heading`,`paragraph`,`strong`],enter:{autolink:a(De),autolinkProtocol:ee,autolinkEmail:ee,atxHeading:a(Ce),blockQuote:a(ve),characterEscape:ee,characterReference:ee,codeFenced:a(ye),codeFencedFenceInfo:o,codeFencedFenceMeta:o,codeIndented:a(ye,o),codeText:a(be,o),codeTextData:ee,data:ee,codeFlowValue:ee,definition:a(xe),definitionDestinationString:o,definitionLabelString:o,definitionTitleString:o,emphasis:a(Se),hardBreakEscape:a(we),hardBreakTrailing:a(we),htmlFlow:a(Te,o),htmlFlowData:ee,htmlText:a(Te,o),htmlTextData:ee,image:a(Ee),label:o,link:a(De),listItem:a(ke),listItemValue:f,listOrdered:a(Oe,d),listUnordered:a(Oe),paragraph:a(Ae),reference:de,referenceString:o,resourceDestinationString:o,resourceTitleString:o,setextHeading:a(Ce),strong:a(je),thematicBreak:a(Ne)},exit:{atxHeading:c(),atxHeadingSequence:x,autolink:c(),autolinkEmail:_e,autolinkProtocol:ge,blockQuote:c(),characterEscapeValue:te,characterReferenceMarkerHexadecimal:pe,characterReferenceMarkerNumeric:pe,characterReferenceValue:me,characterReference:he,codeFenced:c(g),codeFencedFence:h,codeFencedFenceInfo:p,codeFencedFenceMeta:m,codeFlowValue:te,codeIndented:c(_),codeText:c(ae),codeTextData:te,data:te,definition:c(),definitionDestinationString:b,definitionLabelString:v,definitionTitleString:y,emphasis:c(),hardBreakEscape:c(re),hardBreakTrailing:c(re),htmlFlow:c(T),htmlFlowData:te,htmlText:c(ie),htmlTextData:te,image:c(D),label:se,labelText:oe,lineEnding:ne,link:c(E),listItem:c(),listOrdered:c(),listUnordered:c(),paragraph:c(),referenceString:fe,resourceDestinationString:ce,resourceTitleString:le,resource:ue,setextHeading:c(w),setextHeadingLineSequence:C,setextHeadingText:S,strong:c(),thematicBreak:c()}};ay(t,(e||{}).mdastExtensions||[]);let n={};return r;function r(e){let r={type:`root`,children:[]},a={stack:[r],tokenStack:[],config:t,enter:s,exit:l,buffer:o,resume:u,data:n},c=[],d=-1;for(;++d<e.length;)(e[d][1].type===`listOrdered`||e[d][1].type===`listUnordered`)&&(e[d][0]===`enter`?c.push(d):d=i(e,c.pop(),d));for(d=-1;++d<e.length;){let n=t[e[d][0]];sy.call(n,e[d][1].type)&&n[e[d][1].type].call(Object.assign({sliceSerialize:e[d][2].sliceSerialize},a),e[d][1])}if(a.tokenStack.length>0){let e=a.tokenStack[a.tokenStack.length-1];(e[1]||oy).call(a,void 0,e[0])}for(r.position={start:iy(e.length>0?e[0][1].start:{line:1,column:1,offset:0}),end:iy(e.length>0?e[e.length-2][1].end:{line:1,column:1,offset:0})},d=-1;++d<t.transforms.length;)r=t.transforms[d](r)||r;return r}function i(e,t,n){let r=t-1,i=-1,a=!1,o,s,c,l;for(;++r<=n;){let t=e[r];switch(t[1].type){case`listUnordered`:case`listOrdered`:case`blockQuote`:t[0]===`enter`?i++:i--,l=void 0;break;case`lineEndingBlank`:t[0]===`enter`&&(o&&!l&&!i&&!c&&(c=r),l=void 0);break;case`linePrefix`:case`listItemValue`:case`listItemMarker`:case`listItemPrefix`:case`listItemPrefixWhitespace`:break;default:l=void 0}if(!i&&t[0]===`enter`&&t[1].type===`listItemPrefix`||i===-1&&t[0]===`exit`&&(t[1].type===`listUnordered`||t[1].type===`listOrdered`)){if(o){let i=r;for(s=void 0;i--;){let t=e[i];if(t[1].type===`lineEnding`||t[1].type===`lineEndingBlank`){if(t[0]===`exit`)continue;s&&(e[s][1].type=`lineEndingBlank`,a=!0),t[1].type=`lineEnding`,s=i}else if(!(t[1].type===`linePrefix`||t[1].type===`blockQuotePrefix`||t[1].type===`blockQuotePrefixWhitespace`||t[1].type===`blockQuoteMarker`||t[1].type===`listItemIndent`))break}c&&(!s||c<s)&&(o._spread=!0),o.end=Object.assign({},s?e[s][1].start:t[1].end),e.splice(s||r,0,[`exit`,o,t[2]]),r++,n++}if(t[1].type===`listItemPrefix`){let i={type:`listItem`,_spread:!1,start:Object.assign({},t[1].start),end:void 0};o=i,e.splice(r,0,[`enter`,i,t[2]]),r++,n++,c=void 0,l=!0}}}return e[t][1]._spread=a,n}function a(e,t){return n;function n(n){s.call(this,e(n),n),t&&t.call(this,n)}}function o(){this.stack.push({type:`fragment`,children:[]})}function s(e,t,n){this.stack[this.stack.length-1].children.push(e),this.stack.push(e),this.tokenStack.push([t,n]),e.position={start:iy(t.start),end:void 0}}function c(e){return t;function t(t){e&&e.call(this,t),l.call(this,t)}}function l(e,t){let n=this.stack.pop(),r=this.tokenStack.pop();if(r)r[0].type!==e.type&&(t?t.call(this,e,r[0]):(r[1]||oy).call(this,e,r[0]));else throw Error("Cannot close `"+e.type+"` ("+eh({start:e.start,end:e.end})+`): it’s not open`);n.position.end=iy(e.end)}function u(){return R_(this.stack.pop())}function d(){this.data.expectingFirstListItemValue=!0}function f(e){if(this.data.expectingFirstListItemValue){let t=this.stack[this.stack.length-2];t.start=Number.parseInt(this.sliceSerialize(e),10),this.data.expectingFirstListItemValue=void 0}}function p(){let e=this.resume(),t=this.stack[this.stack.length-1];t.lang=e}function m(){let e=this.resume(),t=this.stack[this.stack.length-1];t.meta=e}function h(){this.data.flowCodeInside||(this.buffer(),this.data.flowCodeInside=!0)}function g(){let e=this.resume(),t=this.stack[this.stack.length-1];t.value=e.replace(/^(\r?\n|\r)|(\r?\n|\r)$/g,``),this.data.flowCodeInside=void 0}function _(){let e=this.resume(),t=this.stack[this.stack.length-1];t.value=e.replace(/(\r?\n|\r)$/g,``)}function v(e){let t=this.resume(),n=this.stack[this.stack.length-1];n.label=t,n.identifier=N_(this.sliceSerialize(e)).toLowerCase()}function y(){let e=this.resume(),t=this.stack[this.stack.length-1];t.title=e}function b(){let e=this.resume(),t=this.stack[this.stack.length-1];t.url=e}function x(e){let t=this.stack[this.stack.length-1];t.depth||=this.sliceSerialize(e).length}function S(){this.data.setextHeadingSlurpLineEnding=!0}function C(e){let t=this.stack[this.stack.length-1];t.depth=this.sliceSerialize(e).codePointAt(0)===61?1:2}function w(){this.data.setextHeadingSlurpLineEnding=void 0}function ee(e){let t=this.stack[this.stack.length-1].children,n=t[t.length-1];(!n||n.type!==`text`)&&(n=Me(),n.position={start:iy(e.start),end:void 0},t.push(n)),this.stack.push(n)}function te(e){let t=this.stack.pop();t.value+=this.sliceSerialize(e),t.position.end=iy(e.end)}function ne(e){let n=this.stack[this.stack.length-1];if(this.data.atHardBreak){let t=n.children[n.children.length-1];t.position.end=iy(e.end),this.data.atHardBreak=void 0;return}!this.data.setextHeadingSlurpLineEnding&&t.canContainEols.includes(n.type)&&(ee.call(this,e),te.call(this,e))}function re(){this.data.atHardBreak=!0}function T(){let e=this.resume(),t=this.stack[this.stack.length-1];t.value=e}function ie(){let e=this.resume(),t=this.stack[this.stack.length-1];t.value=e}function ae(){let e=this.resume(),t=this.stack[this.stack.length-1];t.value=e}function E(){let e=this.stack[this.stack.length-1];if(this.data.inReference){let t=this.data.referenceType||`shortcut`;e.type+=`Reference`,e.referenceType=t,delete e.url,delete e.title}else delete e.identifier,delete e.label;this.data.referenceType=void 0}function D(){let e=this.stack[this.stack.length-1];if(this.data.inReference){let t=this.data.referenceType||`shortcut`;e.type+=`Reference`,e.referenceType=t,delete e.url,delete e.title}else delete e.identifier,delete e.label;this.data.referenceType=void 0}function oe(e){let t=this.sliceSerialize(e),n=this.stack[this.stack.length-2];n.label=sFe(t),n.identifier=N_(t).toLowerCase()}function se(){let e=this.stack[this.stack.length-1],t=this.resume(),n=this.stack[this.stack.length-1];this.data.inReference=!0,n.type===`link`?n.children=e.children:n.alt=t}function ce(){let e=this.resume(),t=this.stack[this.stack.length-1];t.url=e}function le(){let e=this.resume(),t=this.stack[this.stack.length-1];t.title=e}function ue(){this.data.inReference=void 0}function de(){this.data.referenceType=`collapsed`}function fe(e){let t=this.resume(),n=this.stack[this.stack.length-1];n.label=t,n.identifier=N_(this.sliceSerialize(e)).toLowerCase(),this.data.referenceType=`full`}function pe(e){this.data.characterReferenceType=e.type}function me(e){let t=this.sliceSerialize(e),n=this.data.characterReferenceType,r;n?(r=aFe(t,n===`characterReferenceMarkerNumeric`?10:16),this.data.characterReferenceType=void 0):r=W_(t);let i=this.stack[this.stack.length-1];i.value+=r}function he(e){let t=this.stack.pop();t.position.end=iy(e.end)}function ge(e){te.call(this,e);let t=this.stack[this.stack.length-1];t.url=this.sliceSerialize(e)}function _e(e){te.call(this,e);let t=this.stack[this.stack.length-1];t.url=`mailto:`+this.sliceSerialize(e)}function ve(){return{type:`blockquote`,children:[]}}function ye(){return{type:`code`,lang:null,meta:null,value:``}}function be(){return{type:`inlineCode`,value:``}}function xe(){return{type:`definition`,identifier:``,label:null,title:null,url:``}}function Se(){return{type:`emphasis`,children:[]}}function Ce(){return{type:`heading`,depth:0,children:[]}}function we(){return{type:`break`}}function Te(){return{type:`html`,value:``}}function Ee(){return{type:`image`,title:null,url:``,alt:null}}function De(){return{type:`link`,title:null,url:``,children:[]}}function Oe(e){return{type:`list`,ordered:e.type===`listOrdered`,start:null,spread:e._spread,children:[]}}function ke(e){return{type:`listItem`,spread:e._spread,checked:null,children:[]}}function Ae(){return{type:`paragraph`,children:[]}}function je(){return{type:`strong`,children:[]}}function Me(){return{type:`text`,value:``}}function Ne(){return{type:`thematicBreak`}}}function iy(e){return{line:e.line,column:e.column,offset:e.offset}}function ay(e,t){let n=-1;for(;++n<t.length;){let r=t[n];Array.isArray(r)?ay(e,r):Cze(e,r)}}function Cze(e,t){let n;for(n in t)if(sy.call(t,n))switch(n){case`canContainEols`:{let r=t[n];r&&e[n].push(...r);break}case`transforms`:{let r=t[n];r&&e[n].push(...r);break}case`enter`:case`exit`:{let r=t[n];r&&Object.assign(e[n],r);break}}}function oy(e,t){throw e?Error("Cannot close `"+e.type+"` ("+eh({start:e.start,end:e.end})+"): a different token (`"+t.type+"`, "+eh({start:t.start,end:t.end})+`) is open`):Error("Cannot close document, a token (`"+t.type+"`, "+eh({start:t.start,end:t.end})+`) is still open`)}var sy,wze=s((()=>{z_(),bze(),oFe(),uFe(),P_(),K_(),HCe(),sy={}.hasOwnProperty})),Tze=s((()=>{wze()}));function cy(e){let t=this;t.parser=n;function n(n){return xze(n,{...t.data(`settings`),...e,extensions:t.data(`micromarkExtensions`)||[],mdastExtensions:t.data(`fromMarkdownExtensions`)||[]})}}var Eze=s((()=>{Tze()})),Dze=s((()=>{Eze()}));function Oze(e,t){let n={type:`element`,tagName:`blockquote`,properties:{},children:e.wrap(e.all(t),!0)};return e.patch(t,n),e.applyData(t,n)}var kze=s((()=>{}));function Aze(e,t){let n={type:`element`,tagName:`br`,properties:{},children:[]};return e.patch(t,n),[e.applyData(t,n),{type:`text`,value:`
-`}]}var jze=s((()=>{}));function Mze(e,t){let n=t.value?t.value+`
-`:``,r={};t.lang&&(r.className=[`language-`+t.lang]);let i={type:`element`,tagName:`code`,properties:r,children:[{type:`text`,value:n}]};return t.meta&&(i.data={meta:t.meta}),e.patch(t,i),i=e.applyData(t,i),i={type:`element`,tagName:`pre`,properties:{},children:[i]},e.patch(t,i),i}var Nze=s((()=>{}));function Pze(e,t){let n={type:`element`,tagName:`del`,properties:{},children:e.all(t)};return e.patch(t,n),e.applyData(t,n)}var Fze=s((()=>{}));function Ize(e,t){let n={type:`element`,tagName:`em`,properties:{},children:e.all(t)};return e.patch(t,n),e.applyData(t,n)}var Lze=s((()=>{}));function Rze(e,t){let n=typeof e.options.clobberPrefix==`string`?e.options.clobberPrefix:`user-content-`,r=String(t.identifier).toUpperCase(),i=lv(r.toLowerCase()),a=e.footnoteOrder.indexOf(r),o,s=e.footnoteCounts.get(r);s===void 0?(s=0,e.footnoteOrder.push(r),o=e.footnoteOrder.length):o=a+1,s+=1,e.footnoteCounts.set(r,s);let c={type:`element`,tagName:`a`,properties:{href:`#`+n+`fn-`+i,id:n+`fnref-`+i+(s>1?`-`+s:``),dataFootnoteRef:!0,ariaDescribedBy:[`footnote-label`]},children:[{type:`text`,value:String(o)}]};e.patch(t,c);let l={type:`element`,tagName:`sup`,properties:{},children:[c]};return e.patch(t,l),e.applyData(t,l)}var zze=s((()=>{uv()}));function Bze(e,t){let n={type:`element`,tagName:`h`+t.depth,properties:{},children:e.all(t)};return e.patch(t,n),e.applyData(t,n)}var Vze=s((()=>{}));function Hze(e,t){if(e.options.allowDangerousHtml){let n={type:`raw`,value:t.value};return e.patch(t,n),e.applyData(t,n)}}var Uze=s((()=>{}));function ly(e,t){let n=t.referenceType,r=`]`;if(n===`collapsed`?r+=`[]`:n===`full`&&(r+=`[`+(t.label||t.identifier)+`]`),t.type===`imageReference`)return[{type:`text`,value:`![`+t.alt+r}];let i=e.all(t),a=i[0];a&&a.type===`text`?a.value=`[`+a.value:i.unshift({type:`text`,value:`[`});let o=i[i.length-1];return o&&o.type===`text`?o.value+=r:i.push({type:`text`,value:r}),i}var uy=s((()=>{}));function Wze(e,t){let n=String(t.identifier).toUpperCase(),r=e.definitionById.get(n);if(!r)return ly(e,t);let i={src:lv(r.url||``),alt:t.alt};r.title!==null&&r.title!==void 0&&(i.title=r.title);let a={type:`element`,tagName:`img`,properties:i,children:[]};return e.patch(t,a),e.applyData(t,a)}var Gze=s((()=>{uv(),uy()}));function Kze(e,t){let n={src:lv(t.url)};t.alt!==null&&t.alt!==void 0&&(n.alt=t.alt),t.title!==null&&t.title!==void 0&&(n.title=t.title);let r={type:`element`,tagName:`img`,properties:n,children:[]};return e.patch(t,r),e.applyData(t,r)}var qze=s((()=>{uv()}));function Jze(e,t){let n={type:`text`,value:t.value.replace(/\r?\n|\r/g,` `)};e.patch(t,n);let r={type:`element`,tagName:`code`,properties:{},children:[n]};return e.patch(t,r),e.applyData(t,r)}var Yze=s((()=>{}));function Xze(e,t){let n=String(t.identifier).toUpperCase(),r=e.definitionById.get(n);if(!r)return ly(e,t);let i={href:lv(r.url||``)};r.title!==null&&r.title!==void 0&&(i.title=r.title);let a={type:`element`,tagName:`a`,properties:i,children:e.all(t)};return e.patch(t,a),e.applyData(t,a)}var Zze=s((()=>{uv(),uy()}));function Qze(e,t){let n={href:lv(t.url)};t.title!==null&&t.title!==void 0&&(n.title=t.title);let r={type:`element`,tagName:`a`,properties:n,children:e.all(t)};return e.patch(t,r),e.applyData(t,r)}var $ze=s((()=>{uv()}));function eBe(e,t,n){let r=e.all(t),i=n?tBe(n):dy(t),a={},o=[];if(typeof t.checked==`boolean`){let e=r[0],n;e&&e.type===`element`&&e.tagName===`p`?n=e:(n={type:`element`,tagName:`p`,properties:{},children:[]},r.unshift(n)),n.children.length>0&&n.children.unshift({type:`text`,value:` `}),n.children.unshift({type:`element`,tagName:`input`,properties:{type:`checkbox`,checked:t.checked,disabled:!0},children:[]}),a.className=[`task-list-item`]}let s=-1;for(;++s<r.length;){let e=r[s];(i||s!==0||e.type!==`element`||e.tagName!==`p`)&&o.push({type:`text`,value:`
-`}),e.type===`element`&&e.tagName===`p`&&!i?o.push(...e.children):o.push(e)}let c=r[r.length-1];c&&(i||c.type!==`element`||c.tagName!==`p`)&&o.push({type:`text`,value:`
-`});let l={type:`element`,tagName:`li`,properties:a,children:o};return e.patch(t,l),e.applyData(t,l)}function tBe(e){let t=!1;if(e.type===`list`){t=e.spread||!1;let n=e.children,r=-1;for(;!t&&++r<n.length;)t=dy(n[r])}return t}function dy(e){return e.spread??e.children.length>1}var nBe=s((()=>{}));function rBe(e,t){let n={},r=e.all(t),i=-1;for(typeof t.start==`number`&&t.start!==1&&(n.start=t.start);++i<r.length;){let e=r[i];if(e.type===`element`&&e.tagName===`li`&&e.properties&&Array.isArray(e.properties.className)&&e.properties.className.includes(`task-list-item`)){n.className=[`contains-task-list`];break}}let a={type:`element`,tagName:t.ordered?`ol`:`ul`,properties:n,children:e.wrap(r,!0)};return e.patch(t,a),e.applyData(t,a)}var iBe=s((()=>{}));function aBe(e,t){let n={type:`element`,tagName:`p`,properties:{},children:e.all(t)};return e.patch(t,n),e.applyData(t,n)}var oBe=s((()=>{}));function sBe(e,t){let n={type:`root`,children:e.wrap(e.all(t))};return e.patch(t,n),e.applyData(t,n)}var cBe=s((()=>{}));function lBe(e,t){let n={type:`element`,tagName:`strong`,properties:{},children:e.all(t)};return e.patch(t,n),e.applyData(t,n)}var uBe=s((()=>{}));function dBe(e,t){let n=e.all(t),r=n.shift(),i=[];if(r){let n={type:`element`,tagName:`thead`,properties:{},children:e.wrap([r],!0)};e.patch(t.children[0],n),i.push(n)}if(n.length>0){let r={type:`element`,tagName:`tbody`,properties:{},children:e.wrap(n,!0)},a=u_(t.children[1]),o=l_(t.children[t.children.length-1]);a&&o&&(r.position={start:a,end:o}),i.push(r)}let a={type:`element`,tagName:`table`,properties:{},children:e.wrap(i,!0)};return e.patch(t,a),e.applyData(t,a)}var fBe=s((()=>{d_()}));function pBe(e,t,n){let r=n?n.children:void 0,i=(r?r.indexOf(t):1)===0?`th`:`td`,a=n&&n.type===`table`?n.align:void 0,o=a?a.length:t.children.length,s=-1,c=[];for(;++s<o;){let n=t.children[s],r={},o=a?a[s]:void 0;o&&(r.align=o);let l={type:`element`,tagName:i,properties:r,children:[]};n&&(l.children=e.all(n),e.patch(n,l),l=e.applyData(n,l)),c.push(l)}let l={type:`element`,tagName:`tr`,properties:{},children:e.wrap(c,!0)};return e.patch(t,l),e.applyData(t,l)}var mBe=s((()=>{}));function hBe(e,t){let n={type:`element`,tagName:`td`,properties:{},children:e.all(t)};return e.patch(t,n),e.applyData(t,n)}var gBe=s((()=>{}));function _Be(e){let t=String(e),n=/\r?\n|\r/g,r=n.exec(t),i=0,a=[];for(;r;)a.push(fy(t.slice(i,r.index),i>0,!0),r[0]),i=r.index+r[0].length,r=n.exec(t);return a.push(fy(t.slice(i),i>0,!1)),a.join(``)}function fy(e,t,n){let r=0,i=e.length;if(t){let t=e.codePointAt(r);for(;t===py||t===my;)r++,t=e.codePointAt(r)}if(n){let t=e.codePointAt(i-1);for(;t===py||t===my;)i--,t=e.codePointAt(i-1)}return i>r?e.slice(r,i):``}var py,my,vBe=s((()=>{py=9,my=32}));function yBe(e,t){let n={type:`text`,value:_Be(String(t.value))};return e.patch(t,n),e.applyData(t,n)}var bBe=s((()=>{vBe()}));function xBe(e,t){let n={type:`element`,tagName:`hr`,properties:{},children:[]};return e.patch(t,n),e.applyData(t,n)}var SBe=s((()=>{}));function hy(){}var gy,CBe=s((()=>{kze(),jze(),Nze(),Fze(),Lze(),zze(),Vze(),Uze(),Gze(),qze(),Yze(),Zze(),$ze(),nBe(),iBe(),oBe(),cBe(),uBe(),fBe(),mBe(),gBe(),bBe(),SBe(),gy={blockquote:Oze,break:Aze,code:Mze,delete:Pze,emphasis:Ize,footnoteReference:Rze,heading:Bze,html:Hze,imageReference:Wze,image:Kze,inlineCode:Jze,linkReference:Xze,link:Qze,listItem:eBe,list:rBe,paragraph:aBe,root:sBe,strong:lBe,table:dBe,tableCell:hBe,tableRow:pBe,text:yBe,thematicBreak:xBe,toml:hy,yaml:hy,definition:hy,footnoteDefinition:hy}}));function wBe(e,t){let n=[{type:`text`,value:`↩`}];return t>1&&n.push({type:`element`,tagName:`sup`,properties:{},children:[{type:`text`,value:String(t)}]}),n}function TBe(e,t){return`Back to reference `+(e+1)+(t>1?`-`+t:``)}function EBe(e){let t=typeof e.options.clobberPrefix==`string`?e.options.clobberPrefix:`user-content-`,n=e.options.footnoteBackContent||wBe,r=e.options.footnoteBackLabel||TBe,i=e.options.footnoteLabel||`Footnotes`,a=e.options.footnoteLabelTagName||`h2`,o=e.options.footnoteLabelProperties||{className:[`sr-only`]},s=[],c=-1;for(;++c<e.footnoteOrder.length;){let i=e.footnoteById.get(e.footnoteOrder[c]);if(!i)continue;let a=e.all(i),o=String(i.identifier).toUpperCase(),l=lv(o.toLowerCase()),u=0,d=[],f=e.footnoteCounts.get(o);for(;f!==void 0&&++u<=f;){d.length>0&&d.push({type:`text`,value:` `});let e=typeof n==`string`?n:n(c,u);typeof e==`string`&&(e={type:`text`,value:e}),d.push({type:`element`,tagName:`a`,properties:{href:`#`+t+`fnref-`+l+(u>1?`-`+u:``),dataFootnoteBackref:``,ariaLabel:typeof r==`string`?r:r(c,u),className:[`data-footnote-backref`]},children:Array.isArray(e)?e:[e]})}let p=a[a.length-1];if(p&&p.type===`element`&&p.tagName===`p`){let e=p.children[p.children.length-1];e&&e.type===`text`?e.value+=` `:p.children.push({type:`text`,value:` `}),p.children.push(...d)}else a.push(...d);let m={type:`element`,tagName:`li`,properties:{id:t+`fn-`+l},children:e.wrap(a,!0)};e.patch(i,m),s.push(m)}if(s.length!==0)return{type:`element`,tagName:`section`,properties:{dataFootnotes:!0,className:[`footnotes`]},children:[{type:`element`,tagName:a,properties:{...$g(o),id:`footnote-label`},children:[{type:`text`,value:i}]},{type:`text`,value:`
-`},{type:`element`,tagName:`ol`,properties:{},children:e.wrap(s,!0)},{type:`text`,value:`
-`}]}}var DBe=s((()=>{e_(),uv()}));function OBe(e,t){let n=t||yy,r=new Map,i=new Map,a={all:s,applyData:ABe,definitionById:r,footnoteById:i,footnoteCounts:new Map,footnoteOrder:[],handlers:{...gy,...n.handlers},one:o,options:n,patch:kBe,wrap:MBe};return Wh(e,function(e){if(e.type===`definition`||e.type===`footnoteDefinition`){let t=e.type===`definition`?r:i,n=String(e.identifier).toUpperCase();t.has(n)||t.set(n,e)}}),a;function o(e,t){let n=e.type,r=a.handlers[n];if(vy.call(a.handlers,n)&&r)return r(a,e,t);if(a.options.passThrough&&a.options.passThrough.includes(n)){if(`children`in e){let{children:t,...n}=e,r=$g(n);return r.children=a.all(e),r}return $g(e)}return(a.options.unknownHandler||jBe)(a,e,t)}function s(e){let t=[];if(`children`in e){let n=e.children,r=-1;for(;++r<n.length;){let i=a.one(n[r],e);if(i){if(r&&n[r-1].type===`break`&&(!Array.isArray(i)&&i.type===`text`&&(i.value=_y(i.value)),!Array.isArray(i)&&i.type===`element`)){let e=i.children[0];e&&e.type===`text`&&(e.value=_y(e.value))}Array.isArray(i)?t.push(...i):t.push(i)}}}return t}}function kBe(e,t){e.position&&(t.position=kje(e))}function ABe(e,t){let n=t;if(e&&e.data){let t=e.data.hName,r=e.data.hChildren,i=e.data.hProperties;typeof t==`string`&&(n.type===`element`?n.tagName=t:n={type:`element`,tagName:t,properties:{},children:`children`in n?n.children:[n]}),n.type===`element`&&i&&Object.assign(n.properties,$g(i)),`children`in n&&n.children&&r!=null&&(n.children=r)}return n}function jBe(e,t){let n=t.data||{},r=`value`in t&&!(vy.call(n,`hProperties`)||vy.call(n,`hChildren`))?{type:`text`,value:t.value}:{type:`element`,tagName:`div`,properties:{},children:e.all(t)};return e.patch(t,r),e.applyData(t,r)}function MBe(e,t){let n=[],r=-1;for(t&&n.push({type:`text`,value:`
-`});++r<e.length;)r&&n.push({type:`text`,value:`
-`}),n.push(e[r]);return t&&e.length>0&&n.push({type:`text`,value:`
-`}),n}function _y(e){let t=0,n=e.charCodeAt(t);for(;n===9||n===32;)t++,n=e.charCodeAt(t);return e.slice(t)}var vy,yy,NBe=s((()=>{e_(),Gh(),d_(),CBe(),vy={}.hasOwnProperty,yy={}}));function by(e,t){let n=OBe(e,t),r=n.one(e,void 0),i=EBe(n),a=Array.isArray(r)?{type:`root`,children:r}:r||{type:`root`,children:[]};return i&&(`children`in a,a.children.push({type:`text`,value:`
-`},i)),a}var PBe=s((()=>{ep(),DBe(),NBe()})),FBe=s((()=>{PBe()}));function xy(e,t){return e&&`run`in e?async function(n,r){let i=by(n,{file:r,...t});await e.run(i,r)}:function(n,r){return by(n,{file:r,...e||t})}}var IBe=s((()=>{FBe()})),LBe=s((()=>{IBe()}));function RBe(e){let t=this;t.compiler=n;function n(n){return kFe(n,{...t.data(`settings`),...e,extensions:t.data(`toMarkdownExtensions`)||[]})}}var zBe=s((()=>{q_()})),BBe=s((()=>{zBe()}));function Sy(e){return e.type===`text`&&typeof e.value==`string`&&/^\s*$/.test(e.value)}function VBe(){return e=>{Wh(e,`element`,(e,t,n)=>{if(e.tagName!==`blockquote`||typeof t!=`number`||!n||n.type!==`root`)return;let r=e.children.findIndex(e=>!Sy(e));if(r===-1)return;let i=e.children[r];if(!i||i.type!==`element`||i.tagName!==`p`)return;let a=i.children[0];if(!a||a.type!==`text`||!a.value.startsWith(`[!`))return;let o=a.value.indexOf(`]`);if(o===-1)return;let s=a.value.slice(2,o).toLowerCase();if(!Cy.includes(s))return;if(o+1===a.value.length){let t=i.children[1];if(t){if(t.type!==`element`||t.tagName!==`br`||!i.children[2])return;i.children=i.children.slice(2);let e=i.children[0];e&&e.type===`text`&&e.value.charAt(0)===`
-`&&(e.value=e.value.slice(1))}else{let t=r+1<e.children.length&&Sy(e.children[r+1])?r+2:r+1;if(t>=e.children.length||e.children[t]?.type!==`element`)return;e.children=e.children.slice(t)}}else a.value.charAt(o+1)===`
-`&&(o+2===a.value.length||!/^\s*$/.test(a.value.slice(o+2)))?a.value=a.value.slice(o+2):a.value=a.value.replace(/^\s*\[!.*?\]\s*/,``);let c=[];for(let t=r;t<e.children.length;t++){let n=e.children[t];n?.type===`element`&&n.tagName===`p`&&n.children?c.push(...n.children):c.push(n)}n.children[t]={type:`element`,tagName:`div`,properties:{className:[`markdown-alert`,`markdown-alert-${s}`]},children:[{type:`element`,tagName:`div`,properties:{className:[`markdown-alert-icon`]},children:[]},{type:`element`,tagName:`div`,properties:{className:[`markdown-alert-content`]},children:[{type:`text`,value:` `},...c]}]}})}}var Cy,HBe=s((()=>{Gh(),Cy=[`note`,`tip`,`important`,`warning`,`caution`,`success`]})),UBe=s((()=>{HBe()}));function WBe(e,t){let n=t?.removeTags??[],r=[...g_.tagNames??[],...t?.allowTags??[]].filter(e=>!n.includes(e));return Ih().use(cy).use(Lv).use(Dy,{transform:t?.transform,type:t?.transformType}).use(xy,{allowDangerousHtml:!0}).use(VBe).use(Iy).use(Yje).use(hMe,{...g_,clobberPrefix:``,tagNames:r,attributes:{...g_.attributes,abbr:[`title`],"*":[...g_.attributes?.[`*`]??[],`className`]},strip:[`script`,`style`,`object`,`embed`,`form`]}).use(zke,{languages:Kg,detect:!0}).use(gAe,{target:`_blank`}).use(pje).use(kh).processSync(e).toString()}function wy(e){return Ih().use(cy).use(Lv).parse(e)}function GBe(e,t=1){let n=wy(e),r=[];return Wh(n,`heading`,e=>{let n=Ty(e);n&&r.push({depth:e.depth??t,value:n})}),r}function Ty(e){return e.type===`text`?e.value??``:`children`in e&&Array.isArray(e.children)?e.children.map(e=>Ty(e)).join(``):``}function KBe(e){let t=wy(e),n=[],r=[];return t.children?.forEach(e=>{e.type===`heading`?(r.length&&n.push(r),n.push([e]),r=[]):r.push(e)}),r.length&&n.push(r),n.map(e=>qBe(e))}function qBe(e){return Ih().use(RBe).use(Lv).stringify({type:`root`,children:e}).trim()}var Ey,Dy,Oy,ky,Ay,jy,My,Ny,Py,Fy,Iy,JBe=s((()=>{xAe(),hje(),Ewe(),Zje(),_Me(),cEe(),$Re(),Dze(),LBe(),BBe(),DEe(),Gh(),iAe(),UBe(),Uke(),Ey=e=>e.type===`heading`&&`depth`in e&&`children`in e,Dy=(e,...t)=>t=>{!e?.transform||!e?.type||Wh(t,e?.type,t=>(e?.transform&&e?.transform(t),Hh))},Oy=new Set([`dd`,`dt`,`li`,`p`,`summary`,`td`,`th`]),ky=/[`*_\[~]/,Ay=()=>e=>{Wh(e,`html`,(e,t,n)=>{typeof t!=`number`||!n||!(`children`in n)||!Array.isArray(n.children)||(n.children[t]={type:`text`,value:e.value??``})})},jy=Ih().use(cy).use(Lv).use(Ay).use(xy),My=Ih().use(wwe,{fragment:!0}),Ny=Ih().use(kh),Py=e=>{let t=jy.runSync(jy.parse(e));if(t.children.length!==1)return[];let n=t.children.at(0);return!n||n.type!==`element`||n.tagName!==`p`?[]:n.children},Fy=()=>e=>{Wh(e,`element`,e=>{Oy.has(e.tagName)&&(e.children=e.children.flatMap(e=>{if(e.type!==`text`||!ky.test(e.value))return[e];let t=Py(e.value);return t.length?t:[e]}))})},Iy=()=>e=>{Wh(e,`raw`,e=>{if(typeof e.value!=`string`||!ky.test(e.value))return;let t=My.parse(e.value);Fy()(t),e.value=Ny.stringify(t)})}})),Ly=s((()=>{JBe()})),Ry=s((()=>{eAe(),iAe(),Ly()}));function YBe(e){let t=new Set;return JSON.stringify(e,(e,n)=>{if(typeof n==`object`&&n){if(t.has(n))return`[Circular]`;t.add(n)}return n},2)}var zy,By=s((()=>{zy=e=>{if(typeof e==`string`)try{let t=JSON.parse(e);return typeof t==`object`&&t?JSON.stringify(t,null,2):e}catch{return e}if(typeof e==`object`)try{return JSON.stringify(e,null,2)}catch{return YBe(e)}return e?.toString()??``}})),Vy,Hy,Uy,XBe=s((()=>{Nf(),Cye(),lf(),W(),Ry(),By(),Vy={tabindex:`0`,class:`custom-scroll overflow-x-auto p-2 -outline-offset-2 min-h-0 min-w-0 flex-1`},Hy=[`id`,`innerHTML`],Uy=N({inheritAttrs:!1,__name:`ScalarCodeBlock`,props:{content:{},prettyPrintedContent:{},lang:{default:`plaintext`},lineNumbers:{type:Boolean,default:!1},hideCredentials:{},copy:{type:[String,Boolean],default:`hover`}},setup(e){let t=Sr(),n=U(()=>e.prettyPrintedContent||zy(e.content??``)),r=U(()=>Zke(n.value,{lang:e.lang.trim(),languages:Kg,lineNumbers:e.lineNumbers,maskCredentials:e.hideCredentials}).slice(5,-6)),i=U(()=>!n.value.includes(`
-`)),a=U(()=>n.value!==null&&n.value!==`null`&&n.value!==`404 Not Found`),{cx:o}=cf();return(s,c)=>(F(),I(`div`,at($r(j(o)(`scalar-code-block group/code-block flex flex-col`,`relative bg-b-1 min-h-0 min-w-0 focus-visible:outline`))),[R(`div`,Vy,[R(`pre`,{id:j(t),class:`m-0 bg-transparent text-nowrap whitespace-pre w-fit`,innerHTML:r.value},null,8,Hy)]),e.copy&&a.value?(F(),L(j($f),{key:0,class:O([`scalar-code-copy absolute`,[i.value?`top-[calc(10px+0.5lh)] -translate-y-1/2 m-0 right-1`:`top-2.5 right-2.5`,{"opacity-100":e.copy===`always`}]]),content:n.value,showLang:!i.value,lang:e.lang,"aria-controls":j(t)},{backdrop:M(()=>[H(Mf,{class:O([`scalar-code-copy-backdrop`,[i.value?`-inset-y-0.75 -right-1 group-hocus-within/code-block:-left-0.5 left-3`:`-right-1.5 -top-1`]])},null,8,[`class`])]),_:1},8,[`class`,`content`,`showLang`,`lang`,`aria-controls`])):B(``,!0)],16))}})})),Wy,ZBe=s((()=>{XBe(),Wy=Uy})),Gy,QBe=s((()=>{lf(),W(),Gy=N({inheritAttrs:!1,__name:`ScalarColorModeToggleIcon`,props:{is:{default:`button`},mode:{default:`light`}},setup(e){let{cx:t}=cf(),n=U(()=>e.mode===`dark`?`Set light mode`:`Set dark mode`);return(r,i)=>(F(),L(kr(e.is),ai({"aria-label":n.value,class:`toggle-icon-${e.mode}`,type:e.is===`button`?`button`:void 0},j(t)(`size-3 flex items-center justify-center text-c-1`)),{default:M(()=>[...i[0]||=[R(`span`,{class:`toggle-icon-sun-ray`},null,-1),R(`span`,{class:`toggle-icon-sun-ray`},null,-1),R(`span`,{class:`toggle-icon-sun-ray`},null,-1),R(`span`,{class:`toggle-icon-sun-ray`},null,-1),R(`span`,{class:`toggle-icon-ellipse`},[R(`span`,{class:`toggle-icon-moon-mask`})],-1)]]),_:1},16,[`aria-label`,`class`,`type`]))}})})),Ky,qy=s((()=>{df(),QBe(),Ky=uf(Gy,[[`__scopeId`,`data-v-60be8692`]])})),Jy,Yy,$Be=s((()=>{qy(),lf(),W(),Jy=[`aria-pressed`],Yy=N({inheritAttrs:!1,__name:`ScalarColorModeToggleButton`,props:{modelValue:{type:Boolean},modelModifiers:{}},emits:[`update:modelValue`],setup(e){let{cx:t}=cf(),n=Ur(e,`modelValue`);return(e,r)=>(F(),I(`button`,ai({"aria-pressed":n.value,type:`button`},j(t)(`group/toggle flex h-6 w-[38px] brightness-lifted -mx-px items-center py-1.5 -my-1.5 relative outline-none`),{onClick:r[0]||=e=>n.value=!n.value}),[r[1]||=R(`div`,{class:`h-3 w-full bg-border mx-px rounded-xl group-focus-visible/toggle:outline -outline-offset-1`},null,-1),R(`div`,{class:O([`size-[23px] left-border absolute border rounded-full flex items-center justify-center bg-b-1 group-focus-visible/toggle:outline -outline-offset-1 transition-transform duration-300 ease-in-out`,{"translate-x-[14px]":n.value}])},[H(Ky,{is:`div`,mode:n.value?`dark`:`light`},null,8,[`mode`])],2)],16,Jy))}})})),Xy,Zy=s((()=>{$Be(),Xy=Yy}));function Qy(e={}){let{initialColorMode:t=`system`,overrideColorMode:n}=e;function r(){$y.value=o.value===`dark`?`light`:`dark`,!(typeof window>`u`)&&window?.localStorage?.setItem(`colorMode`,$y.value)}function i(e){$y.value=e,!(typeof window>`u`)&&window?.localStorage?.setItem(`colorMode`,$y.value)}function a(){return typeof window>`u`?`light`:typeof window?.matchMedia==`function`?window?.matchMedia(`(prefers-color-scheme: dark)`)?.matches?`dark`:`light`:`dark`}let o=U({get:()=>$y.value===`system`?a():$y.value,set:i}),s=U({get:()=>o.value===`dark`,set:e=>i(e?`dark`:`light`)});function c(e){typeof document>`u`||typeof window>`u`||((n??(e===`system`?a():e))===`dark`?(document.body.classList.add(`dark-mode`),document.body.classList.remove(`light-mode`)):(document.body.classList.add(`light-mode`),document.body.classList.remove(`dark-mode`)))}let l=typeof window>`u`?`system`:window?.localStorage?.getItem(`colorMode`),u=m(eb,l)?l:null;$y.value=n??u??t,mr($y,c,{immediate:!0});let d=()=>$y.value===`system`&&c(`system`),f=A(null);return Hi(()=>{typeof window<`u`&&typeof window?.matchMedia==`function`&&(f.value=window.matchMedia(`(prefers-color-scheme: dark)`),f.value?.addEventListener(`change`,d))}),Gi(()=>{f.value?.removeEventListener(`change`,d)}),{colorMode:U({get:()=>$y.value,set:i}),darkLightMode:o,isDarkMode:s,toggleColorMode:r,setColorMode:i,getSystemModePreference:a}}var $y,eb,eVe=s((()=>{le(),W(),$y=A(`dark`),eb=ie([D(`system`),D(`dark`),D(`light`)])})),tb=s((()=>{eVe()})),nb,tVe=s((()=>{qy(),Zy(),W(),tb(),nb=N({__name:`ScalarColorModeToggle`,props:{variant:{default:`switch`}},setup(e){let{isDarkMode:t,toggleColorMode:n,darkLightMode:r}=Qy(),i=U(()=>t.value?`Set light mode`:`Set dark mode`);return(a,o)=>e.variant===`switch`?(F(),L(Xy,{key:0,modelValue:j(t),"onUpdate:modelValue":o[0]||=e=>xn(t)?t.value=e:null,"aria-label":i.value},null,8,[`modelValue`,`aria-label`])):(F(),L(Ky,{key:1,"aria-label":i.value,mode:j(r),onClick:j(n)},null,8,[`aria-label`,`mode`,`onClick`]))}})})),rb,ib=s((()=>{tVe(),rb=nb})),ab,nVe=s((()=>{ab=`useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict`})),ob,sb=s((()=>{nVe(),ob=(e=21)=>{let t=``,n=crypto.getRandomValues(new Uint8Array(e|=0));for(;e--;)t+=ab[n[e]&63];return t}})),cb,lb,ub,db=s((()=>{W(),sb(),cb=Symbol(),lb=()=>fr(cb,`body`),ub=e=>{let t=e??`scalar-teleport-${ob()}`;return dr(cb,`#${t}`),t}})),fb,rVe=s((()=>{db(),W(),fb=N({inheritAttrs:!1,__name:`ScalarTeleport`,props:{to:{},immediate:{type:Boolean},disabled:{type:Boolean}},setup(e){let t=lb();return(n,r)=>(F(),L(Di,{defer:!e.immediate,disabled:e.disabled,to:e.to||j(t)},[R(`div`,ai({class:`scalar-app`,style:{display:`contents`}},n.$attrs),[P(n.$slots,`default`)],16)],8,[`defer`,`disabled`,`to`]))}})})),pb,mb=s((()=>{rVe(),pb=fb})),hb,gb,iVe=s((()=>{db(),W(),hb=[`id`],gb=N({inheritAttrs:!1,__name:`ScalarTeleportRoot`,props:{id:{}},setup(e){let t=ub(e.id);return(e,n)=>(F(),I(V,null,[P(e.$slots,`default`),R(`div`,{id:j(t),class:`scalar-teleport-root contents`},null,8,hb)],64))}})})),_b,aVe=s((()=>{iVe(),_b=gb}));function oVe(e,t={enabled:A(!0)}){let n=A(0),r=A(0),i=A();return typeof ResizeObserver<`u`&&(i.value=new ResizeObserver(([e])=>{e&&(n.value=e.borderBoxSize[0]?.inlineSize??0,r.value=e.borderBoxSize[0]?.blockSize??0)})),mr([()=>Cn(t.enabled),()=>Cn(e)],([e,t])=>{!t||!i.value||(e?i.value.observe(t):i.value.disconnect())},{immediate:!0}),{width:U(()=>Cn(t.enabled)?`${n.value}px`:void 0),height:U(()=>Cn(t.enabled)?`${r.value}px`:void 0)}}var sVe=s((()=>{W()}));function vb(e,t,n){return Ab(e,kb(t,n))}function yb(e,t){return typeof e==`function`?e(t):e}function bb(e){return e.split(`-`)[0]}function xb(e){return e.split(`-`)[1]}function Sb(e){return e===`x`?`y`:`x`}function Cb(e){return e===`y`?`height`:`width`}function wb(e){return Ib.has(bb(e))?`y`:`x`}function Tb(e){return Sb(wb(e))}function cVe(e,t,n){n===void 0&&(n=!1);let r=xb(e),i=Tb(e),a=Cb(i),o=i===`x`?r===(n?`end`:`start`)?`right`:`left`:r===`start`?`bottom`:`top`;return t.reference[a]>t.floating[a]&&(o=Db(o)),[o,Db(o)]}function lVe(e){let t=Db(e);return[Eb(e),t,Eb(t)]}function Eb(e){return e.replace(/start|end/g,e=>Fb[e])}function uVe(e,t,n){switch(e){case`top`:case`bottom`:return n?t?Rb:Lb:t?Lb:Rb;case`left`:case`right`:return t?zb:Bb;default:return[]}}function dVe(e,t,n,r){let i=xb(e),a=uVe(bb(e),n===`start`,r);return i&&(a=a.map(e=>e+`-`+i),t&&(a=a.concat(a.map(Eb)))),a}function Db(e){return e.replace(/left|right|bottom|top/g,e=>Pb[e])}function fVe(e){return{top:0,right:0,bottom:0,left:0,...e}}function pVe(e){return typeof e==`number`?{top:e,right:e,bottom:e,left:e}:fVe(e)}function Ob(e){let{x:t,y:n,width:r,height:i}=e;return{width:r,height:i,top:n,left:t,right:t+r,bottom:n+i,x:t,y:n}}var kb,Ab,jb,Mb,Nb,Pb,Fb,Ib,Lb,Rb,zb,Bb,Vb=s((()=>{kb=Math.min,Ab=Math.max,jb=Math.round,Mb=Math.floor,Nb=e=>({x:e,y:e}),Pb={left:`right`,right:`left`,bottom:`top`,top:`bottom`},Fb={start:`end`,end:`start`},Ib=new Set([`top`,`bottom`]),Lb=[`left`,`right`],Rb=[`right`,`left`],zb=[`top`,`bottom`],Bb=[`bottom`,`top`]}));function Hb(e,t,n){let{reference:r,floating:i}=e,a=wb(t),o=Tb(t),s=Cb(o),c=bb(t),l=a===`y`,u=r.x+r.width/2-i.width/2,d=r.y+r.height/2-i.height/2,f=r[s]/2-i[s]/2,p;switch(c){case`top`:p={x:u,y:r.y-i.height};break;case`bottom`:p={x:u,y:r.y+r.height};break;case`right`:p={x:r.x+r.width,y:d};break;case`left`:p={x:r.x-i.width,y:d};break;default:p={x:r.x,y:r.y}}switch(xb(t)){case`start`:p[o]-=f*(n&&l?-1:1);break;case`end`:p[o]+=f*(n&&l?-1:1);break}return p}async function Ub(e,t){t===void 0&&(t={});let{x:n,y:r,platform:i,rects:a,elements:o,strategy:s}=e,{boundary:c=`clippingAncestors`,rootBoundary:l=`viewport`,elementContext:u=`floating`,altBoundary:d=!1,padding:f=0}=yb(t,e),p=pVe(f),m=o[d?u===`floating`?`reference`:`floating`:u],h=Ob(await i.getClippingRect({element:await(i.isElement==null?void 0:i.isElement(m))??!0?m:m.contextElement||await(i.getDocumentElement==null?void 0:i.getDocumentElement(o.floating)),boundary:c,rootBoundary:l,strategy:s})),g=u===`floating`?{x:n,y:r,width:a.floating.width,height:a.floating.height}:a.reference,_=await(i.getOffsetParent==null?void 0:i.getOffsetParent(o.floating)),v=await(i.isElement==null?void 0:i.isElement(_))&&await(i.getScale==null?void 0:i.getScale(_))||{x:1,y:1},y=Ob(i.convertOffsetParentRelativeRectToViewportRelativeRect?await i.convertOffsetParentRelativeRectToViewportRelativeRect({elements:o,rect:g,offsetParent:_,strategy:s}):g);return{top:(h.top-y.top+p.top)/v.y,bottom:(y.bottom-h.bottom+p.bottom)/v.y,left:(h.left-y.left+p.left)/v.x,right:(y.right-h.right+p.right)/v.x}}async function mVe(e,t){let{placement:n,platform:r,elements:i}=e,a=await(r.isRTL==null?void 0:r.isRTL(i.floating)),o=bb(n),s=xb(n),c=wb(n)===`y`,l=Kb.has(o)?-1:1,u=a&&c?-1:1,d=yb(t,e),{mainAxis:f,crossAxis:p,alignmentAxis:m}=typeof d==`number`?{mainAxis:d,crossAxis:0,alignmentAxis:null}:{mainAxis:d.mainAxis||0,crossAxis:d.crossAxis||0,alignmentAxis:d.alignmentAxis};return s&&typeof m==`number`&&(p=s===`end`?m*-1:m),c?{x:p*u,y:f*l}:{x:f*l,y:p*u}}var Wb,Gb,Kb,qb,Jb,Yb,hVe=s((()=>{Vb(),Wb=async(e,t,n)=>{let{placement:r=`bottom`,strategy:i=`absolute`,middleware:a=[],platform:o}=n,s=a.filter(Boolean),c=await(o.isRTL==null?void 0:o.isRTL(t)),l=await o.getElementRects({reference:e,floating:t,strategy:i}),{x:u,y:d}=Hb(l,r,c),f=r,p={},m=0;for(let n=0;n<s.length;n++){let{name:a,fn:h}=s[n],{x:g,y:_,data:v,reset:y}=await h({x:u,y:d,initialPlacement:r,placement:f,strategy:i,middlewareData:p,rects:l,platform:o,elements:{reference:e,floating:t}});u=g??u,d=_??d,p={...p,[a]:{...p[a],...v}},y&&m<=50&&(m++,typeof y==`object`&&(y.placement&&(f=y.placement),y.rects&&(l=y.rects===!0?await o.getElementRects({reference:e,floating:t,strategy:i}):y.rects),{x:u,y:d}=Hb(l,f,c)),n=-1)}return{x:u,y:d,placement:f,strategy:i,middlewareData:p}},Gb=function(e){return e===void 0&&(e={}),{name:`flip`,options:e,async fn(t){var n;let{placement:r,middlewareData:i,rects:a,initialPlacement:o,platform:s,elements:c}=t,{mainAxis:l=!0,crossAxis:u=!0,fallbackPlacements:d,fallbackStrategy:f=`bestFit`,fallbackAxisSideDirection:p=`none`,flipAlignment:m=!0,...h}=yb(e,t);if((n=i.arrow)!=null&&n.alignmentOffset)return{};let g=bb(r),_=wb(o),v=bb(o)===o,y=await(s.isRTL==null?void 0:s.isRTL(c.floating)),b=d||(v||!m?[Db(o)]:lVe(o)),x=p!==`none`;!d&&x&&b.push(...dVe(o,m,p,y));let S=[o,...b],C=await Ub(t,h),w=[],ee=i.flip?.overflows||[];if(l&&w.push(C[g]),u){let e=cVe(r,a,y);w.push(C[e[0]],C[e[1]])}if(ee=[...ee,{placement:r,overflows:w}],!w.every(e=>e<=0)){let e=(i.flip?.index||0)+1,t=S[e];if(t&&(!(u===`alignment`&&_!==wb(t))||ee.every(e=>wb(e.placement)===_?e.overflows[0]>0:!0)))return{data:{index:e,overflows:ee},reset:{placement:t}};let n=ee.filter(e=>e.overflows[0]<=0).sort((e,t)=>e.overflows[1]-t.overflows[1])[0]?.placement;if(!n)switch(f){case`bestFit`:{let e=ee.filter(e=>{if(x){let t=wb(e.placement);return t===_||t===`y`}return!0}).map(e=>[e.placement,e.overflows.filter(e=>e>0).reduce((e,t)=>e+t,0)]).sort((e,t)=>e[1]-t[1])[0]?.[0];e&&(n=e);break}case`initialPlacement`:n=o;break}if(r!==n)return{reset:{placement:n}}}return{}}}},Kb=new Set([`left`,`top`]),qb=function(e){return e===void 0&&(e=0),{name:`offset`,options:e,async fn(t){var n;let{x:r,y:i,placement:a,middlewareData:o}=t,s=await mVe(t,e);return a===o.offset?.placement&&(n=o.arrow)!=null&&n.alignmentOffset?{}:{x:r+s.x,y:i+s.y,data:{...s,placement:a}}}}},Jb=function(e){return e===void 0&&(e={}),{name:`shift`,options:e,async fn(t){let{x:n,y:r,placement:i}=t,{mainAxis:a=!0,crossAxis:o=!1,limiter:s={fn:e=>{let{x:t,y:n}=e;return{x:t,y:n}}},...c}=yb(e,t),l={x:n,y:r},u=await Ub(t,c),d=wb(bb(i)),f=Sb(d),p=l[f],m=l[d];if(a){let e=f===`y`?`top`:`left`,t=f===`y`?`bottom`:`right`,n=p+u[e],r=p-u[t];p=vb(n,p,r)}if(o){let e=d===`y`?`top`:`left`,t=d===`y`?`bottom`:`right`,n=m+u[e],r=m-u[t];m=vb(n,m,r)}let h=s.fn({...t,[f]:p,[d]:m});return{...h,data:{x:h.x-n,y:h.y-r,enabled:{[f]:a,[d]:o}}}}}},Yb=function(e){return e===void 0&&(e={}),{name:`size`,options:e,async fn(t){var n,r;let{placement:i,rects:a,platform:o,elements:s}=t,{apply:c=()=>{},...l}=yb(e,t),u=await Ub(t,l),d=bb(i),f=xb(i),p=wb(i)===`y`,{width:m,height:h}=a.floating,g,_;d===`top`||d===`bottom`?(g=d,_=f===(await(o.isRTL==null?void 0:o.isRTL(s.floating))?`start`:`end`)?`left`:`right`):(_=d,g=f===`end`?`top`:`bottom`);let v=h-u.top-u.bottom,y=m-u.left-u.right,b=kb(h-u[g],v),x=kb(m-u[_],y),S=!t.middlewareData.shift,C=b,w=x;if((n=t.middlewareData.shift)!=null&&n.enabled.x&&(w=y),(r=t.middlewareData.shift)!=null&&r.enabled.y&&(C=v),S&&!f){let e=Ab(u.left,0),t=Ab(u.right,0),n=Ab(u.top,0),r=Ab(u.bottom,0);p?w=m-2*(e!==0||t!==0?e+t:Ab(u.left,u.right)):C=h-2*(n!==0||r!==0?n+r:Ab(u.top,u.bottom))}await c({...t,availableWidth:w,availableHeight:C});let ee=await o.getDimensions(s.floating);return m!==ee.width||h!==ee.height?{reset:{rects:!0}}:{}}}}}));function Xb(){return typeof window<`u`}function Zb(e){return ex(e)?(e.nodeName||``).toLowerCase():`#document`}function Qb(e){var t;return(e==null||(t=e.ownerDocument)==null?void 0:t.defaultView)||window}function $b(e){return((ex(e)?e.ownerDocument:e.document)||window.document)?.documentElement}function ex(e){return Xb()?e instanceof Node||e instanceof Qb(e).Node:!1}function tx(e){return Xb()?e instanceof Element||e instanceof Qb(e).Element:!1}function nx(e){return Xb()?e instanceof HTMLElement||e instanceof Qb(e).HTMLElement:!1}function rx(e){return!Xb()||typeof ShadowRoot>`u`?!1:e instanceof ShadowRoot||e instanceof Qb(e).ShadowRoot}function ix(e){let{overflow:t,overflowX:n,overflowY:r,display:i}=lx(e);return/auto|scroll|overlay|hidden|clip/.test(t+r+n)&&!hx.has(i)}function gVe(e){return gx.has(Zb(e))}function ax(e){return _x.some(t=>{try{return e.matches(t)}catch{return!1}})}function ox(e){let t=sx(),n=tx(e)?lx(e):e;return vx.some(e=>n[e]?n[e]!==`none`:!1)||(n.containerType?n.containerType!==`normal`:!1)||!t&&(n.backdropFilter?n.backdropFilter!==`none`:!1)||!t&&(n.filter?n.filter!==`none`:!1)||yx.some(e=>(n.willChange||``).includes(e))||bx.some(e=>(n.contain||``).includes(e))}function _Ve(e){let t=dx(e);for(;nx(t)&&!cx(t);){if(ox(t))return t;if(ax(t))return null;t=dx(t)}return null}function sx(){return typeof CSS>`u`||!CSS.supports?!1:CSS.supports(`-webkit-backdrop-filter`,`none`)}function cx(e){return xx.has(Zb(e))}function lx(e){return Qb(e).getComputedStyle(e)}function ux(e){return tx(e)?{scrollLeft:e.scrollLeft,scrollTop:e.scrollTop}:{scrollLeft:e.scrollX,scrollTop:e.scrollY}}function dx(e){if(Zb(e)===`html`)return e;let t=e.assignedSlot||e.parentNode||rx(e)&&e.host||$b(e);return rx(t)?t.host:t}function fx(e){let t=dx(e);return cx(t)?e.ownerDocument?e.ownerDocument.body:e.body:nx(t)&&ix(t)?t:fx(t)}function px(e,t,n){t===void 0&&(t=[]),n===void 0&&(n=!0);let r=fx(e),i=r===e.ownerDocument?.body,a=Qb(r);if(i){let e=mx(a);return t.concat(a,a.visualViewport||[],ix(r)?r:[],e&&n?px(e):[])}return t.concat(r,px(r,[],n))}function mx(e){return e.parent&&Object.getPrototypeOf(e.parent)?e.frameElement:null}var hx,gx,_x,vx,yx,bx,xx,Sx=s((()=>{hx=new Set([`inline`,`contents`]),gx=new Set([`table`,`td`,`th`]),_x=[`:popover-open`,`:modal`],vx=[`transform`,`translate`,`scale`,`rotate`,`perspective`],yx=[`transform`,`translate`,`scale`,`rotate`,`perspective`,`filter`],bx=[`paint`,`layout`,`strict`,`content`],xx=new Set([`html`,`body`,`#document`])}));function Cx(e){let t=lx(e),n=parseFloat(t.width)||0,r=parseFloat(t.height)||0,i=nx(e),a=i?e.offsetWidth:n,o=i?e.offsetHeight:r,s=jb(n)!==a||jb(r)!==o;return s&&(n=a,r=o),{width:n,height:r,$:s}}function wx(e){return tx(e)?e:e.contextElement}function Tx(e){let t=wx(e);if(!nx(t))return Nb(1);let n=t.getBoundingClientRect(),{width:r,height:i,$:a}=Cx(t),o=(a?jb(n.width):n.width)/r,s=(a?jb(n.height):n.height)/i;return(!o||!Number.isFinite(o))&&(o=1),(!s||!Number.isFinite(s))&&(s=1),{x:o,y:s}}function Ex(e){let t=Qb(e);return!sx()||!t.visualViewport?Lx:{x:t.visualViewport.offsetLeft,y:t.visualViewport.offsetTop}}function vVe(e,t,n){return t===void 0&&(t=!1),!n||t&&n!==Qb(e)?!1:t}function Dx(e,t,n,r){t===void 0&&(t=!1),n===void 0&&(n=!1);let i=e.getBoundingClientRect(),a=wx(e),o=Nb(1);t&&(r?tx(r)&&(o=Tx(r)):o=Tx(e));let s=vVe(a,n,r)?Ex(a):Nb(0),c=(i.left+s.x)/o.x,l=(i.top+s.y)/o.y,u=i.width/o.x,d=i.height/o.y;if(a){let e=Qb(a),t=r&&tx(r)?Qb(r):r,n=e,i=mx(n);for(;i&&r&&t!==n;){let e=Tx(i),t=i.getBoundingClientRect(),r=lx(i),a=t.left+(i.clientLeft+parseFloat(r.paddingLeft))*e.x,o=t.top+(i.clientTop+parseFloat(r.paddingTop))*e.y;c*=e.x,l*=e.y,u*=e.x,d*=e.y,c+=a,l+=o,n=Qb(i),i=mx(n)}}return Ob({width:u,height:d,x:c,y:l})}function Ox(e,t){let n=ux(e).scrollLeft;return t?t.left+n:Dx($b(e)).left+n}function kx(e,t){let n=e.getBoundingClientRect();return{x:n.left+t.scrollLeft-Ox(e,n),y:n.top+t.scrollTop}}function yVe(e){let{elements:t,rect:n,offsetParent:r,strategy:i}=e,a=i===`fixed`,o=$b(r),s=t?ax(t.floating):!1;if(r===o||s&&a)return n;let c={scrollLeft:0,scrollTop:0},l=Nb(1),u=Nb(0),d=nx(r);if((d||!d&&!a)&&((Zb(r)!==`body`||ix(o))&&(c=ux(r)),nx(r))){let e=Dx(r);l=Tx(r),u.x=e.x+r.clientLeft,u.y=e.y+r.clientTop}let f=o&&!d&&!a?kx(o,c):Nb(0);return{width:n.width*l.x,height:n.height*l.y,x:n.x*l.x-c.scrollLeft*l.x+u.x+f.x,y:n.y*l.y-c.scrollTop*l.y+u.y+f.y}}function bVe(e){return Array.from(e.getClientRects())}function xVe(e){let t=$b(e),n=ux(e),r=e.ownerDocument.body,i=Ab(t.scrollWidth,t.clientWidth,r.scrollWidth,r.clientWidth),a=Ab(t.scrollHeight,t.clientHeight,r.scrollHeight,r.clientHeight),o=-n.scrollLeft+Ox(e),s=-n.scrollTop;return lx(r).direction===`rtl`&&(o+=Ab(t.clientWidth,r.clientWidth)-i),{width:i,height:a,x:o,y:s}}function SVe(e,t){let n=Qb(e),r=$b(e),i=n.visualViewport,a=r.clientWidth,o=r.clientHeight,s=0,c=0;if(i){a=i.width,o=i.height;let e=sx();(!e||e&&t===`fixed`)&&(s=i.offsetLeft,c=i.offsetTop)}let l=Ox(r);if(l<=0){let e=r.ownerDocument,t=e.body,n=getComputedStyle(t),i=e.compatMode===`CSS1Compat`&&parseFloat(n.marginLeft)+parseFloat(n.marginRight)||0,o=Math.abs(r.clientWidth-t.clientWidth-i);o<=Rx&&(a-=o)}else l<=Rx&&(a+=l);return{width:a,height:o,x:s,y:c}}function CVe(e,t){let n=Dx(e,!0,t===`fixed`),r=n.top+e.clientTop,i=n.left+e.clientLeft,a=nx(e)?Tx(e):Nb(1);return{width:e.clientWidth*a.x,height:e.clientHeight*a.y,x:i*a.x,y:r*a.y}}function Ax(e,t,n){let r;if(t===`viewport`)r=SVe(e,n);else if(t===`document`)r=xVe($b(e));else if(tx(t))r=CVe(t,n);else{let n=Ex(e);r={x:t.x-n.x,y:t.y-n.y,width:t.width,height:t.height}}return Ob(r)}function jx(e,t){let n=dx(e);return n===t||!tx(n)||cx(n)?!1:lx(n).position===`fixed`||jx(n,t)}function wVe(e,t){let n=t.get(e);if(n)return n;let r=px(e,[],!1).filter(e=>tx(e)&&Zb(e)!==`body`),i=null,a=lx(e).position===`fixed`,o=a?dx(e):e;for(;tx(o)&&!cx(o);){let t=lx(o),n=ox(o);!n&&t.position===`fixed`&&(i=null),(a?!n&&!i:!n&&t.position===`static`&&i&&zx.has(i.position)||ix(o)&&!n&&jx(e,o))?r=r.filter(e=>e!==o):i=t,o=dx(o)}return t.set(e,r),r}function TVe(e){let{element:t,boundary:n,rootBoundary:r,strategy:i}=e,a=[...n===`clippingAncestors`?ax(t)?[]:wVe(t,this._c):[].concat(n),r],o=a[0],s=a.reduce((e,n)=>{let r=Ax(t,n,i);return e.top=Ab(r.top,e.top),e.right=kb(r.right,e.right),e.bottom=kb(r.bottom,e.bottom),e.left=Ab(r.left,e.left),e},Ax(t,o,i));return{width:s.right-s.left,height:s.bottom-s.top,x:s.left,y:s.top}}function EVe(e){let{width:t,height:n}=Cx(e);return{width:t,height:n}}function DVe(e,t,n){let r=nx(t),i=$b(t),a=n===`fixed`,o=Dx(e,!0,a,t),s={scrollLeft:0,scrollTop:0},c=Nb(0);function l(){c.x=Ox(i)}if(r||!r&&!a)if((Zb(t)!==`body`||ix(i))&&(s=ux(t)),r){let e=Dx(t,!0,a,t);c.x=e.x+t.clientLeft,c.y=e.y+t.clientTop}else i&&l();a&&!r&&i&&l();let u=i&&!r&&!a?kx(i,s):Nb(0);return{x:o.left+s.scrollLeft-c.x-u.x,y:o.top+s.scrollTop-c.y-u.y,width:o.width,height:o.height}}function Mx(e){return lx(e).position===`static`}function Nx(e,t){if(!nx(e)||lx(e).position===`fixed`)return null;if(t)return t(e);let n=e.offsetParent;return $b(e)===n&&(n=n.ownerDocument.body),n}function Px(e,t){let n=Qb(e);if(ax(e))return n;if(!nx(e)){let t=dx(e);for(;t&&!cx(t);){if(tx(t)&&!Mx(t))return t;t=dx(t)}return n}let r=Nx(e,t);for(;r&&gVe(r)&&Mx(r);)r=Nx(r,t);return r&&cx(r)&&Mx(r)&&!ox(r)?n:r||_Ve(e)||n}function OVe(e){return lx(e).direction===`rtl`}function Fx(e,t){return e.x===t.x&&e.y===t.y&&e.width===t.width&&e.height===t.height}function kVe(e,t){let n=null,r,i=$b(e);function a(){var e;clearTimeout(r),(e=n)==null||e.disconnect(),n=null}function o(s,c){s===void 0&&(s=!1),c===void 0&&(c=1),a();let l=e.getBoundingClientRect(),{left:u,top:d,width:f,height:p}=l;if(s||t(),!f||!p)return;let m=Mb(d),h=Mb(i.clientWidth-(u+f)),g=Mb(i.clientHeight-(d+p)),_=Mb(u),v={rootMargin:-m+`px `+-h+`px `+-g+`px `+-_+`px`,threshold:Ab(0,kb(1,c))||1},y=!0;function b(t){let n=t[0].intersectionRatio;if(n!==c){if(!y)return o();n?o(!1,n):r=setTimeout(()=>{o(!1,1e-7)},1e3)}n===1&&!Fx(l,e.getBoundingClientRect())&&o(),y=!1}try{n=new IntersectionObserver(b,{...v,root:i.ownerDocument})}catch{n=new IntersectionObserver(b,v)}n.observe(e)}return o(!0),a}function Ix(e,t,n,r){r===void 0&&(r={});let{ancestorScroll:i=!0,ancestorResize:a=!0,elementResize:o=typeof ResizeObserver==`function`,layoutShift:s=typeof IntersectionObserver==`function`,animationFrame:c=!1}=r,l=wx(e),u=i||a?[...l?px(l):[],...px(t)]:[];u.forEach(e=>{i&&e.addEventListener(`scroll`,n,{passive:!0}),a&&e.addEventListener(`resize`,n)});let d=l&&s?kVe(l,n):null,f=-1,p=null;o&&(p=new ResizeObserver(e=>{let[r]=e;r&&r.target===l&&p&&(p.unobserve(t),cancelAnimationFrame(f),f=requestAnimationFrame(()=>{var e;(e=p)==null||e.observe(t)})),n()}),l&&!c&&p.observe(l),p.observe(t));let m,h=c?Dx(e):null;c&&g();function g(){let t=Dx(e);h&&!Fx(h,t)&&n(),h=t,m=requestAnimationFrame(g)}return n(),()=>{var e;u.forEach(e=>{i&&e.removeEventListener(`scroll`,n),a&&e.removeEventListener(`resize`,n)}),d?.(),(e=p)==null||e.disconnect(),p=null,c&&cancelAnimationFrame(m)}}var Lx,Rx,zx,Bx,Vx,Hx,Ux,Wx,Gx,Kx,AVe=s((()=>{hVe(),Vb(),Sx(),Lx=Nb(0),Rx=25,zx=new Set([`absolute`,`fixed`]),Bx=async function(e){let t=this.getOffsetParent||Px,n=this.getDimensions,r=await n(e.floating);return{reference:DVe(e.reference,await t(e.floating),e.strategy),floating:{x:0,y:0,width:r.width,height:r.height}}},Vx={convertOffsetParentRelativeRectToViewportRelativeRect:yVe,getDocumentElement:$b,getClippingRect:TVe,getOffsetParent:Px,getElementRects:Bx,getClientRects:bVe,getDimensions:EVe,getScale:Tx,isElement:tx,isRTL:OVe},Hx=qb,Ux=Jb,Wx=Gb,Gx=Yb,Kx=(e,t,n)=>{let r=new Map,i={platform:Vx,...n},a={...i.platform,_c:r};return Wb(e,t,{...i,platform:a})}})),jVe=s((()=>{W(),W()}));function MVe(e){return typeof e==`object`&&!!e&&`$el`in e}function qx(e){if(MVe(e)){let t=e.$el;return ex(t)&&Zb(t)===`#comment`?null:t}return e}function Jx(e){return typeof e==`function`?e():j(e)}function Yx(e){return typeof window>`u`?1:(e.ownerDocument.defaultView||window).devicePixelRatio||1}function Xx(e,t){let n=Yx(e);return Math.round(t*n)/n}function Zx(e,t,n){n===void 0&&(n={});let r=n.whileElementsMounted,i=U(()=>Jx(n.open)??!0),a=U(()=>Jx(n.middleware)),o=U(()=>Jx(n.placement)??`bottom`),s=U(()=>Jx(n.strategy)??`absolute`),c=U(()=>Jx(n.transform)??!0),l=U(()=>qx(e.value)),u=U(()=>qx(t.value)),d=A(0),f=A(0),p=A(s.value),m=A(o.value),h=Sn({}),g=A(!1),_=U(()=>{let e={position:p.value,left:`0`,top:`0`};if(!u.value)return e;let t=Xx(u.value,d.value),n=Xx(u.value,f.value);return c.value?{...e,transform:`translate(`+t+`px, `+n+`px)`,...Yx(u.value)>=1.5&&{willChange:`transform`}}:{position:p.value,left:t+`px`,top:n+`px`}}),v;function y(){if(l.value==null||u.value==null)return;let e=i.value;Kx(l.value,u.value,{middleware:a.value,placement:o.value,strategy:s.value}).then(t=>{d.value=t.x,f.value=t.y,p.value=t.strategy,m.value=t.placement,h.value=t.middlewareData,g.value=e!==!1})}function b(){typeof v==`function`&&(v(),v=void 0)}function x(){if(b(),r===void 0){y();return}if(l.value!=null&&u.value!=null){v=r(l.value,u.value,y);return}}function S(){i.value||(g.value=!1)}return mr([a,o,s,i],y,{flush:`sync`}),mr([l,u],x,{flush:`sync`}),mr(i,S,{flush:`sync`}),Kt()&&qt(b),{x:mn(d),y:mn(f),strategy:mn(p),placement:mn(m),middlewareData:mn(h),isPositioned:mn(g),floatingStyles:_,update:y}}var Qx=s((()=>{AVe(),Sx(),jVe()})),$x,NVe=s((()=>{mb(),sVe(),W(),Vb(),Qx(),$x=N({inheritAttrs:!1,__name:`ScalarFloating`,props:{placement:{},offset:{type:[Number,Object,Function],default:5},resize:{type:Boolean,default:!1},target:{},middleware:{default:()=>[]},teleport:{type:[Boolean,String]}},setup(e,{expose:t}){let n=A(null),r=A(null),i=U(()=>{if(typeof window<`u`&&r.value){if(typeof e.target==`string`){let t=document.getElementById(e.target);if(t)return t;console.warn(`ScalarFloating: Target with id="${e.target}" not found`)}else if(e.target instanceof HTMLElement)return e.target;let t=r.value.children?.[0];return t instanceof HTMLElement?t:r.value}}),a=oVe(i,{enabled:U(()=>e.resize)}),o=U(()=>wb(e.placement??`bottom`)===`y`?a.width.value:void 0),s=U(()=>wb(e.placement??`bottom`)===`x`?a.height.value:void 0),{floatingStyles:c,middlewareData:l}=Zx(i,n,{placement:U(()=>e.placement??`bottom`),whileElementsMounted:Ix,middleware:U(()=>[Hx(e.offset),Wx({padding:48}),Ux({padding:8}),Gx({apply({availableWidth:e,availableHeight:t,elements:n}){Object.assign(n.floating.style,{maxWidth:`${Math.max(0,e)-16}px`,maxHeight:`${Math.max(0,t)-16}px`})}}),...e.middleware])});return t({targetRef:i}),(t,i)=>(F(),I(V,null,[R(`div`,{ref_key:`wrapperRef`,ref:r,class:O({contents:!!t.$slots.default})},[P(t.$slots,`default`)],2),t.$slots.floating?(F(),L(j(pb),{key:0,disabled:!e.teleport,to:typeof e.teleport==`string`?e.teleport:void 0},{default:M(()=>[R(`div`,{ref_key:`floatingRef`,ref:n,class:`relative z-context`,style:it(j(c))},[P(t.$slots,`floating`,{data:j(l),height:s.value,width:o.value})],4)]),_:3},8,[`disabled`,`to`])):B(``,!0)],64))}})})),eS,tS=s((()=>{NVe(),eS=$x})),nS,PVe=s((()=>{lf(),W(),nS=N({inheritAttrs:!1,__name:`ScalarFloatingBackdrop`,setup(e){let{cx:t}=cf();return(e,n)=>(F(),I(`div`,at($r(j(t)(`absolute inset-0 -z-1 rounded bg-b-1 shadow-lg brightness-lifted`))),[P(e.$slots,`default`)],16))}})})),rS,iS=s((()=>{PVe(),rS=nS})),aS,FVe=s((()=>{W(),Ou(),aS=N({__name:`ScalarListboxCheckbox`,props:{selected:{type:Boolean},multiselect:{type:Boolean}},setup(e){return(t,n)=>(F(),I(`div`,{class:O([`flex size-4 items-center justify-center p-0.75`,[e.selected?`bg-c-accent text-b-1`:`text-transparent shadow-border`,e.multiselect?`rounded`:`rounded-full`]])},[e.selected?(F(),L(j(Tl),{key:0,class:`size-3`,weight:`bold`})):B(``,!0)],2))}})})),oS,sS=s((()=>{FVe(),oS=aS})),cS,IVe=s((()=>{sS(),lf(),W(),Rc(),cS=N({__name:`ScalarListboxItem`,props:{option:{},multiselect:{type:Boolean}},setup(e){let t=of({base:[`group/item`,`flex min-w-0 items-center gap-1.5 rounded px-2 py-1.5 text-left`,`truncate bg-transparent text-c-1`,`cursor-pointer hover:bg-b-2`],variants:{selected:{true:`text-c-1`},active:{true:`bg-b-2`},disabled:{true:`pointer-events-none opacity-50`}}});return(n,r)=>(F(),L(j(Noe),{as:`template`,disabled:e.option.disabled,value:e.option},{default:M(({active:n,selected:r})=>[R(`li`,{class:O(j(sf)(j(t)({active:n,selected:r,disabled:e.option.disabled})))},[H(oS,{multiselect:e.multiselect,selected:r},null,8,[`multiselect`,`selected`]),R(`span`,{class:O([`inline-block min-w-0 flex-1 truncate`,e.option.color?e.option.color:`text-c-1`])},k(e.option.label),3)],2)]),_:1},8,[`disabled`,`value`]))}})})),lS,uS=s((()=>{IVe(),lS=cS})),dS,fS,LVe=s((()=>{tS(),iS(),uS(),lf(),W(),Rc(),dS={class:`custom-scroll min-h-0 flex-1`},fS=N({inheritAttrs:!1,__name:`ScalarListbox`,props:{options:{},id:{},label:{},multiple:{type:Boolean},modelValue:{},placement:{},offset:{type:[Number,Object,Function]},resize:{type:Boolean},target:{},middleware:{},teleport:{type:[Boolean,String]}},emits:[`update:modelValue`],setup(e){let{cx:t}=cf();return(n,r)=>(F(),L(j(koe),{modelValue:e.modelValue,multiple:e.multiple,"onUpdate:modelValue":r[0]||=e=>n.$emit(`update:modelValue`,e)},{default:M(({open:r})=>[e.label?(F(),L(j(Aoe),{key:0,class:`sr-only`},{default:M(()=>[z(k(e.label),1)]),_:1})):B(``,!0),H(j(eS),ai(n.$props,{placement:e.placement??`bottom-start`}),{floating:M(({width:n})=>[r?(F(),I(`div`,ai({key:0,style:{width:n}},j(t)(`relative flex max-h-[inherit] w-40 max-w-[inherit] rounded text-sm`)),[R(`div`,dS,[H(j(Moe),{class:`flex flex-col gap-0.75 p-0.75 -outline-offset-1`},{default:M(()=>[(F(!0),I(V,null,Ar(e.options,t=>(F(),L(lS,{key:t.id,multiselect:e.multiple,option:t},null,8,[`multiselect`,`option`]))),128))]),_:1})]),H(j(rS))],16)):B(``,!0)]),default:M(()=>[H(j(joe),{id:e.id,as:`template`},{default:M(()=>[P(n.$slots,`default`,{open:r})]),_:2},1032,[`id`])]),_:2},1040,[`placement`])]),_:3},8,[`modelValue`,`multiple`]))}})})),pS,RVe=s((()=>{LVe(),pS=fS})),zVe=s((()=>{Df(),W()})),BVe=s((()=>{zVe()}));function VVe(e){return e?.options!==void 0}function mS(e){return e[0]?VVe(e[0]):!1}var HVe=s((()=>{})),hS,UVe=s((()=>{hS=((e,t)=>e===``?t:t.filter(t=>t.label.toLowerCase().includes(e.toLowerCase())))})),gS,_S,WVe=s((()=>{lf(),W(),gS=[`aria-selected`],_S=N({__name:`ScalarComboboxOption`,props:{active:{type:Boolean},selected:{type:Boolean}},setup(e){let t=of({base:[`group/item`,`flex min-w-0 items-center gap-1.5 rounded px-2 py-1.5 text-left`,`truncate bg-transparent text-c-1`,`cursor-pointer hover:bg-b-2`],variants:{selected:{true:`text-c-1`},active:{true:`bg-b-2`}}});return(n,r)=>(F(),I(`li`,{"aria-selected":e.selected,class:O(j(sf)(j(t)({active:e.active,selected:e.selected}))),role:`option`,tabindex:`-1`},[P(n.$slots,`default`,{active:e.active,selected:e.selected})],10,gS))}})})),vS,GVe=s((()=>{WVe(),vS=_S})),yS,bS,xS,KVe=s((()=>{W(),yS=[`id`,`aria-labelledby`,`role`],bS=[`id`],xS=N({__name:`ScalarComboboxOptionGroup`,props:{id:{default:()=>Sr()},hidden:{type:Boolean,default:!1}},setup(e){return(t,n)=>(F(),I(`div`,{id:e.id,"aria-labelledby":e.id?`${e.id}-label`:void 0,class:`contents`,role:e.hidden?void 0:`group`},[e.hidden?B(``,!0):(F(),I(`div`,{key:0,id:`${e.id}-label`,class:`min-w-0 truncate px-2.5 py-1.5 text-c-2`},[P(t.$slots,`label`)],8,bS)),P(t.$slots,`default`)],8,yS))}})})),SS,qVe=s((()=>{KVe(),SS=xS})),CS,wS,TS,ES,DS,JVe=s((()=>{UVe(),sS(),GVe(),qVe(),HVe(),W(),Ou(),CS={class:`relative flex`},wS=[`aria-activedescendant`,`placeholder`],TS=[`aria-multiselectable`],ES={class:`inline-block min-w-0 flex-1 truncate text-c-1`},DS=N({inheritAttrs:!1,__name:`ScalarComboboxOptions`,props:Lr({options:{},placeholder:{},filterFn:{type:Function,default:hS},multiselect:{type:Boolean}},{modelValue:{default:[]},modelModifiers:{}}),emits:Lr([`add`],[`update:modelValue`]),setup(e,{emit:t}){let n=t,r=Ur(e,`modelValue`),i=Pr(),a=`scalar-combobox-items-${Sr()}`,o={id:`${Sr()}-add`,label:`Add a new option`};function s(e){return`${a}-${e.id}`}let c=U(()=>mS(e.options)?e.options.flatMap(e=>e.options):e.options),l=U(()=>mS(e.options)?e.options:[{label:``,options:e.options}]),u=A(``),d=A(r.value?.[0]??c.value[0]);Hi(()=>{u.value=``,d.value=r.value?.[0]??c.value[0],r.value[0]&&setTimeout(()=>{let e=r.value[0];e&&document?.getElementById(s(e))?.scrollIntoView({block:`nearest`})},10)}),mr(()=>u.value,()=>d.value=p.value[0]);let f=U(()=>e.filterFn(u.value,c.value,l.value)),p=U(()=>i.add?[...f.value,o]:f.value);function m(t){if(t){if(t.id===o.id){g();return}e.multiselect?r.value.some(e=>e.id===t.id)?r.value=r.value.filter(e=>e.id!==t.id):r.value=[...r.value,c.value.find(e=>e.id===t.id)]:r.value=[c.value.find(e=>e.id===t.id)]}}function h(e){let t=p.value,n=t.findIndex(e=>e.id===d.value?.id)+e;n<0||n>t.length-1||(d.value=t[n],d.value&&document?.getElementById(s(d.value))?.scrollIntoView({behavior:`smooth`,block:`nearest`}))}function g(){n(`add`),u.value=``}let _=A(null);return Hi(()=>setTimeout(()=>_.value?.focus(),0)),(t,n)=>(F(),I(V,null,[R(`div`,CS,[H(j(vu),{class:`pointer-events-none absolute left-2.5 top-1/2 -translate-y-1/2 text-c-3 size-4`}),lr(R(`input`,{ref_key:`input`,ref:_,"onUpdate:modelValue":n[0]||=e=>u.value=e,"aria-activedescendant":d.value?s(d.value):void 0,"aria-autocomplete":`list`,"aria-controls":a,class:`min-w-0 flex-1 rounded border-0 py-2.5 pl-8 pr-3 leading-none text-c-1 -outline-offset-1`,"data-1p-ignore":``,placeholder:e.placeholder,role:`combobox`,tabindex:`0`,type:`text`,onKeydown:[n[1]||=mo(po(e=>h(1),[`prevent`]),[`down`]),n[2]||=mo(po(e=>d.value&&m(d.value),[`prevent`]),[`enter`]),n[3]||=mo(po(e=>h(-1),[`prevent`]),[`up`])]},null,40,wS),[[lo,u.value]])]),lr(R(`ul`,{id:a,"aria-multiselectable":e.multiselect,class:`border-t p-0.75 custom-scroll overscroll-contain flex-1 min-h-0`,role:`listbox`,tabindex:`-1`},[(F(!0),I(V,null,Ar(l.value,(i,o)=>(F(),L(SS,{id:`${a}-group-${o}`,key:o,hidden:!i.options.some(e=>f.value.some(t=>t.id===e.id))||!i.label},{label:M(()=>[t.$slots.group?P(t.$slots,`group`,{key:0,group:i}):(F(),I(V,{key:1},[z(k(i.label),1)],64))]),default:M(()=>[(F(!0),I(V,null,Ar(f.value,a=>(F(),I(V,{key:a.id},[i.options.some(e=>e.id===a.id)?(F(),L(vS,{key:0,id:s(a),active:d.value?.id===a.id,selected:r.value.some(e=>e.id===a.id),onClick:e=>m(a),onMousedown:n[4]||=po(()=>{},[`prevent`]),onMouseenter:e=>d.value=a},{default:M(({active:n,selected:i})=>[t.$slots.option?P(t.$slots,`option`,{key:0,active:n,option:a,selected:i}):(F(),I(V,{key:1},[H(j(oS),{multiselect:e.multiselect,selected:r.value.some(e=>e.id===a.id)},null,8,[`multiselect`,`selected`]),R(`span`,ES,k(a.label),1)],64))]),_:2},1032,[`id`,`active`,`selected`,`onClick`,`onMouseenter`])):B(``,!0)],64))),128))]),_:2},1032,[`id`,`hidden`]))),128)),i.add?(F(),L(vS,{key:0,id:s(o),active:d.value?.id===o.id,onClick:g,onMousedown:n[5]||=po(()=>{},[`prevent`]),onMouseenter:n[6]||=e=>d.value=o},{default:M(({active:e})=>[H(j(xu),{class:`size-4 p-px`}),P(t.$slots,`add`,{active:e})]),_:3},8,[`id`,`active`])):B(``,!0)],8,TS),[[Za,f.value.length||i.add]])],64))}})})),OS,kS=s((()=>{JVe(),OS=DS})),AS,YVe=s((()=>{tS(),iS(),lf(),W(),Rc(),AS=N({inheritAttrs:!1,__name:`ScalarComboboxPopover`,props:{placement:{},offset:{type:[Number,Object,Function]},resize:{type:Boolean},target:{},middleware:{},teleport:{type:[Boolean,String]}},setup(e,{expose:t}){let{cx:n}=cf(),r=A(null),i=e=>{[`ArrowUp`,`ArrowDown`].includes(e.key)&&(e.preventDefault(),e.target?.dispatchEvent(new KeyboardEvent(`keydown`,{key:`Enter`})))};return t({popoverButtonRef:r}),(e,t)=>(F(),L(j(_c),{as:`template`},{default:M(({open:t})=>[H(j(eS),at($r(e.$props)),jr({default:M(()=>[H(j(vc),{ref_key:`popoverButtonRef`,ref:r,as:`template`,onKeydown:i},{default:M(()=>[P(e.$slots,`default`,{open:t})]),_:2},1536)]),_:2},[t?{name:`floating`,fn:M(({width:r})=>[H(j(yc),ai({style:{width:r}},j(n)(`relative flex flex-col max-h-[inherit] w-40 rounded text-sm`)),{default:M(({close:n})=>[P(e.$slots,`popover`,{close:n,open:t}),H(j(rS))]),_:2},1040,[`style`])]),key:`0`}:void 0]),1040)]),_:3}))}})})),jS,MS=s((()=>{YVe(),jS=AS})),NS,XVe=s((()=>{kS(),MS(),W(),NS=N({__name:`ScalarCombobox`,props:Lr({options:{},placeholder:{},filterFn:{type:Function},placement:{},offset:{type:[Number,Object,Function]},resize:{type:Boolean},target:{},middleware:{},teleport:{type:[Boolean,String]}},{modelValue:{},modelModifiers:{}}),emits:Lr([`add`],[`update:modelValue`]),setup(e,{emit:t}){let n=t,r=Ur(e,`modelValue`);return(t,i)=>(F(),L(jS,{middleware:e.middleware,offset:e.offset,placement:e.placement??`bottom-start`,resize:e.resize,target:e.target,teleport:e.teleport},{default:M(({open:e})=>[P(t.$slots,`default`,{open:e})]),popover:M(({open:i,close:a})=>[H(OS,{filterFn:e.filterFn,modelValue:r.value?[r.value]:[],open:i,options:e.options,placeholder:e.placeholder,onAdd:()=>(a(),n(`add`)),"onUpdate:modelValue":e=>(a(),r.value=e[0])},jr({_:2},[t.$slots.option?{name:`option`,fn:M(e=>[P(t.$slots,`option`,at($r(e)))]),key:`0`}:void 0,t.$slots.group?{name:`group`,fn:M(e=>[P(t.$slots,`group`,at($r(e)))]),key:`1`}:void 0,t.$slots.add?{name:`add`,fn:M(e=>[P(t.$slots,`add`,at($r(e)))]),key:`2`}:void 0]),1032,[`filterFn`,`modelValue`,`open`,`options`,`placeholder`,`onAdd`,`onUpdate:modelValue`])]),_:3},8,[`middleware`,`offset`,`placement`,`resize`,`target`,`teleport`]))}})})),PS,ZVe=s((()=>{XVe(),PS=NS})),FS,QVe=s((()=>{kS(),MS(),W(),FS=N({__name:`ScalarComboboxMultiselect`,props:Lr({options:{},placeholder:{},filterFn:{type:Function},placement:{},offset:{type:[Number,Object,Function]},resize:{type:Boolean},target:{},middleware:{},teleport:{type:[Boolean,String]}},{modelValue:{default:[]},modelModifiers:{}}),emits:Lr([`add`],[`update:modelValue`]),setup(e,{expose:t,emit:n}){let r=n,i=Ur(e,`modelValue`),a=A(null);return t({comboboxPopoverRef:a}),(t,n)=>(F(),L(jS,{ref_key:`comboboxPopoverRef`,ref:a,middleware:e.middleware,offset:e.offset,placement:e.placement??`bottom-start`,resize:e.resize,target:e.target,teleport:e.teleport},{default:M(({open:e})=>[P(t.$slots,`default`,{open:e})]),popover:M(({open:a})=>[e.options?.length?(F(),L(OS,{key:0,modelValue:i.value,"onUpdate:modelValue":n[0]||=e=>i.value=e,filterFn:e.filterFn,multiselect:``,open:a,options:e.options,placeholder:e.placeholder,onAdd:n[1]||=e=>r(`add`)},jr({_:2},[t.$slots.option?{name:`option`,fn:M(e=>[P(t.$slots,`option`,at($r(e)))]),key:`0`}:void 0,t.$slots.group?{name:`group`,fn:M(e=>[P(t.$slots,`group`,at($r(e)))]),key:`1`}:void 0,t.$slots.add?{name:`add`,fn:M(e=>[P(t.$slots,`add`,at($r(e)))]),key:`2`}:void 0]),1032,[`modelValue`,`filterFn`,`open`,`options`,`placeholder`])):B(``,!0)]),_:3},8,[`middleware`,`offset`,`placement`,`resize`,`target`,`teleport`]))}})})),IS,$Ve=s((()=>{QVe(),IS=FS})),LS,RS,zS,eHe=s((()=>{iS(),lf(),W(),LS={class:`custom-scroll min-h-0 flex-1`},RS={class:`flex flex-col p-0.75`},zS=N({inheritAttrs:!1,__name:`ScalarDropdownMenu`,props:{is:{}},setup(e){let{cx:t}=cf();return(n,r)=>(F(),L(kr(e.is??`div`),at($r(j(t)(`relative flex w-56`))),{default:M(()=>[R(`div`,LS,[P(n.$slots,`menu`,{},()=>[R(`div`,RS,[P(n.$slots,`default`)])]),P(n.$slots,`backdrop`,{},()=>[H(j(rS))])])]),_:3},16))}})})),BS,VS=s((()=>{eHe(),BS=zS}));function tHe(){let e=A();return dr(HS,e),{active:e}}function nHe(){let e=fr(HS);return e||console.warn(`useDropdownItem must be used within a ScalarDropdown`),{active:e}}var HS,US=s((()=>{W(),HS=Symbol()})),WS,GS,rHe=s((()=>{tS(),VS(),US(),lf(),W(),Zf(),WS=[`id`,`aria-activedescendant`,`aria-labelledby`,`onKeydown`],GS=N({inheritAttrs:!1,__name:`ScalarDropdown`,props:Lr({placement:{},offset:{type:[Number,Object,Function]},resize:{type:Boolean},target:{},middleware:{},teleport:{type:[Boolean,String]}},{open:{type:Boolean,default:!1},openModifiers:{}}),emits:[`update:open`],setup(e){let t=A(),n=A(),r=Ur(e,`open`),{active:i}=tHe(),a=Sr(),o=A(a),s=Sr();async function c(){r.value=!r.value,await ar(),r.value&&n.value?.focus()}async function l(e){if([`ArrowDown`,`ArrowUp`,` `,`Enter`].includes(e.key))e.preventDefault();else return;r.value||=!0,await ar(),n.value?.focus(),[`ArrowDown`,` `,`Enter`].includes(e.key)?f(1):e.key===`ArrowUp`&&f(-1)}mr(()=>t.value?.targetRef,(e,t)=>{e&&(e.id?o.value=e.id:(o.value=a,e.setAttribute(`id`,o.value)),e.setAttribute(`aria-haspopup`,`menu`),e.setAttribute(`aria-expanded`,`${r.value}`),r.value&&e.setAttribute(`aria-controls`,s),e.addEventListener(`click`,c),e.addEventListener(`keydown`,l)),t&&t!==e&&(t.id===a&&t.removeAttribute(`id`),t.removeAttribute(`aria-controls`),t.removeAttribute(`aria-haspopup`),t.removeAttribute(`aria-expanded`),t.removeEventListener(`click`,c),t.removeEventListener(`keydown`,l))},{immediate:!0}),mr(r,e=>{let n=t.value?.targetRef;n&&(n.setAttribute(`aria-expanded`,`${e}`),e?n.setAttribute(`aria-controls`,s):n.removeAttribute(`aria-controls`))},{immediate:!0});async function u(){t.value?.targetRef?.focus(),r.value=!1}function d(){if(!i.value||!n.value)return;let e=n.value.querySelector(`#${i.value}[role="menuitem"]:not([aria-disabled="true"])`);e&&(e.click(),u())}function f(e){if(!r.value||!n.value)return;let t=Array.from(n.value.querySelectorAll(`[role="menuitem"]:not([aria-disabled="true"])`));if(t.length===0)return;let a=t.findIndex(e=>e.id===i.value);if(a===-1){let n=t[e>0?0:t.length-1];n?.id&&(i.value=n.id);return}let o=a+e;if(o<0||o>t.length-1)return;let s=t[o];s?.id&&(i.value=s.id)}Xve(n,u,{ignore:[U(()=>t.value?.targetRef)]});let{cx:p}=cf();return(a,c)=>(F(),L(j(eS),ai({ref_key:`floatingRef`,ref:t},a.$props,{placement:e.placement??`bottom-start`}),jr({default:M(()=>[P(a.$slots,`default`,{open:r.value})]),_:2},[r.value?{name:`floating`,fn:M(({width:e})=>[H(BS,ai({style:{width:e}},j(p)(`max-h-[inherit] max-w-[inherit]`)),{menu:M(()=>[R(`div`,{id:j(s),ref_key:`menuRef`,ref:n,"aria-activedescendant":j(i),"aria-labelledby":o.value,class:`flex flex-col p-0.75 outline-none`,role:`menu`,tabindex:`-1`,onClick:po(u,[`stop`]),onKeydown:[c[0]||=mo(po(e=>f(1),[`prevent`,`stop`]),[`down`]),mo(po(d,[`prevent`,`stop`]),[`enter`]),mo(po(u,[`prevent`,`stop`]),[`escape`]),mo(po(d,[`prevent`,`stop`]),[`space`]),mo(po(u,[`prevent`,`stop`]),[`tab`]),c[1]||=mo(po(e=>f(-1),[`prevent`,`stop`]),[`up`])]},[P(a.$slots,`items`,{open:r.value})],40,WS)]),_:3},16,[`style`])]),key:`0`}:void 0]),1040,[`placement`]))}})})),KS,iHe=s((()=>{rHe(),KS=GS})),qS,aHe=s((()=>{lf(),W(),qS=N({__name:`ScalarDropdownButton`,props:{is:{default:`button`},active:{type:Boolean},disabled:{type:Boolean}},setup(e){let t=of({base:[`block h-8 min-w-0 gap-1.5 rounded px-2.5 py-1.5 text-left`,`truncate  no-underline text-sm text-c-1`,`cursor-pointer hover:bg-b-2 highlighted:bg-b-2`],variants:{disabled:{true:`pointer-events-none text-c-3`},active:{true:``}},compoundVariants:[{disabled:!1,active:!0,class:`bg-b-2`}]});return(n,r)=>(F(),L(kr(e.is),{"aria-disabled":e.disabled,class:O([`item`,j(sf)(`scalar-dropdown-item`,j(t)({active:e.active,disabled:e.disabled}))]),type:e.is===`button`?`button`:void 0},{default:M(()=>[P(n.$slots,`default`,{},void 0,!0)]),_:3},8,[`aria-disabled`,`class`,`type`]))}})})),JS,YS=s((()=>{df(),aHe(),JS=uf(qS,[[`__scopeId`,`data-v-f5e0d3d8`]])})),XS,oHe=s((()=>{XS={}}));function sHe(e,t,n,r,i,a){return F(),I(`div`,ZS)}var ZS,QS,$S=s((()=>{df(),oHe(),W(),ZS={class:`-mx-0.75 my-0.75 h-border bg-border`},QS=uf(XS,[[`render`,sHe]])})),eC,cHe=s((()=>{US(),YS(),W(),eC=N({__name:`ScalarDropdownItem`,props:{id:{default:()=>Sr()},disabled:{type:Boolean}},emits:[`click`],setup(e){let{active:t}=nHe();return(n,r)=>(F(),L(JS,{id:e.id,active:j(t)===e.id,disabled:e.disabled,role:`menuitem`,tabindex:`-1`,onClick:r[0]||=e=>n.$emit(`click`,e),onMouseenter:r[1]||=n=>t.value=e.id},{default:M(()=>[P(n.$slots,`default`,{},void 0,!0)]),_:3},8,[`id`,`active`,`disabled`]))}})})),tC,lHe=s((()=>{df(),cHe(),tC=uf(eC,[[`__scopeId`,`data-v-3402682d`]])})),nC,rC,iC,uHe=s((()=>{W(),nC={key:1,class:`rounded border bg-b-2 p-3 text-sm`},rC={key:0,class:`mt-2 rounded border bg-b-1 p-2 font-code text-c-2`},iC=N({__name:`ScalarErrorBoundary`,setup(e){let t=A(!1),n=A();return Qte((e,r,i)=>(console.error(`[ERROR]`,e,i),t.value=!0,n.value=e,!1)),(e,r)=>t.value?(F(),I(`div`,nC,[r[0]||=R(`div`,{class:`p-2`},`Oops, something went wrong here.`,-1),n.value?(F(),I(`div`,rC,k(n.value?.name)+`: `+k(n.value?.message),1)):B(``,!0)])):P(e.$slots,`default`,{key:0})}})})),aC,dHe=s((()=>{uHe(),aC=iC})),fHe=s((()=>{lf(),W()})),oC=s((()=>{fHe()})),pHe=s((()=>{lf(),W()})),sC=s((()=>{pHe()})),mHe=s((()=>{_f(),lf(),W()})),cC=s((()=>{mHe()})),hHe=s((()=>{lf(),W()})),lC=s((()=>{hHe()})),gHe=s((()=>{pf(),lf(),W()})),uC=s((()=>{gHe()})),_He=s((()=>{oC(),sC(),cC(),lC(),uC(),lf(),W()})),vHe=s((()=>{_He()})),dC,fC,yHe=s((()=>{dC=[`B`,`kB`,`MB`,`GB`,`TB`,`PB`,`EB`,`ZB`,`YB`],fC=(e,t=3)=>{if(!Number.isFinite(e)||e<=0)return`0 B`;let n=Math.max(0,Math.min(Math.floor(Math.log10(e)/3),dC.length-1));return Number((e/1e3**n).toPrecision(t))>=1e3&&n<dC.length-1&&(n+=1),`${Number((e/1e3**n).toPrecision(t))} ${dC[n]}`}})),bHe=s((()=>{_f(),lf(),W()})),xHe=s((()=>{bHe()})),SHe=s((()=>{lf(),W()})),CHe=s((()=>{SHe()})),pC,wHe=s((()=>{lf(),W(),pC=N({inheritAttrs:!1,__name:`ScalarHeaderButton`,props:{is:{default:`button`},cta:{type:Boolean}},setup(e){let t=of({base:`group/button flex items-center rounded px-3 py-2 text-base/4 no-underline`,variants:{cta:{true:`font-bold bg-b-header-cta text-sm/4 text-c-header-cta hover:bg-h-header-cta`,false:`text-c-header-2 hover:text-c-header-1`}}}),{cx:n}=cf();return(r,i)=>(F(),L(kr(e.is),ai({type:e.is===`button`?`button`:void 0},j(n)(j(t)({cta:e.cta}))),{default:M(()=>[P(r.$slots,`default`)]),_:3},16,[`type`]))}})})),mC,hC=s((()=>{wHe(),mC=pC})),gC,_C,vC,THe=s((()=>{gC={"⌘":`Command`,"^":`Control`,ctrl:`Control`,"⌥":`Option`,alt:`Alt`,"⇧":`Shift`,"⇪":`Caps Lock`,"↵":`Enter`,"←":`Left Arrow`,"→":`Right Arrow`,"↑":`Up Arrow`,"↓":`Down Arrow`},_C={Meta:`⌘`,Shift:`⇧`,Alt:`⌥`,Control:`^`},vC={Meta:`ctrl`,Shift:`⇧`,Alt:`alt`,Control:`ctrl`}})),yC,bC,xC=s((()=>{yC=e=>{let t=Reflect.get(e,`userAgentData`);if(!(!t||typeof t!=`object`)&&!(!(`platform`in t)||typeof t.platform!=`string`))return t.platform},bC=()=>{if(typeof navigator>`u`)return!1;let e=yC(navigator);return e?e.toLowerCase().includes(`mac`):/Mac/.test(navigator.userAgent)}}));function EHe(e){return e===`default`}function DHe(e){let t=EHe(e)?`Meta`:e;return CC()?_C[t]:vC[t]}function OHe(e,t){return[...t.map(e=>DHe(e)),e]}function kHe(e){return e in gC?gC[e]:e}var SC,CC,AHe=s((()=>{THe(),xC(),SC=()=>{},CC=()=>{let e=SC();return e===`mac`?!0:e===`non-mac`?!1:bC()}})),wC,TC,EC,jHe=s((()=>{AHe(),lf(),W(),wC={"aria-hidden":`true`,class:`contents`},TC={class:`sr-only`},EC=N({inheritAttrs:!1,__name:`ScalarHotkey`,props:{hotkey:{},modifier:{default:()=>[`Meta`]}},setup(e){let{cx:t}=cf(),n=U(()=>OHe(e.hotkey,e.modifier));return(e,r)=>(F(),I(`div`,at($r(j(t)(`border-(--scalar-background-3) inline-flex gap-0.5 overflow-hidden rounded border text-xxs rounded-b p-1 font-medium uppercase leading-none`))),[(F(!0),I(V,null,Ar(n.value,(e,t)=>(F(),I(`div`,{key:t},[R(`span`,wC,k(e),1),R(`span`,TC,k(j(kHe)(e)),1)]))),128))],16))}})})),DC,OC=s((()=>{jHe(),DC=EC})),kC,AC,jC=s((()=>{kC=Object.defineProperty,AC=(e,t)=>{let n={};for(var r in e)kC(n,r,{get:e[r],enumerable:!0});return t||kC(n,Symbol.toStringTag,{value:`Module`}),n}}));function MC(e,t){return F(),I(`svg`,PC,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M5 11.988h14M12.006 5v14`},null,-1)]])}var NC,PC,FC,MHe=s((()=>{jC(),W(),NC=AC({default:()=>FC,render:()=>MC}),PC={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},FC={render:MC}}));function IC(e,t){return F(),I(`svg`,RC,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M8.143 12h7.714M12 8.143v7.714M5.571 3H18.43A2.57 2.57 0 0 1 21 5.571V18.43A2.57 2.57 0 0 1 18.429 21H5.57A2.57 2.57 0 0 1 3 18.429V5.57A2.57 2.57 0 0 1 5.571 3`},null,-1)]])}var LC,RC,zC,NHe=s((()=>{jC(),W(),LC=AC({default:()=>zC,render:()=>IC}),RC={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},zC={render:IC}}));function BC(e,t){return F(),I(`svg`,HC,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M12 8v4m0 4h.01M22 12c0 5.523-4.477 10-10 10S2 17.523 2 12 6.477 2 12 2s10 4.477 10 10`},null,-1)]])}var VC,HC,UC,PHe=s((()=>{jC(),W(),VC=AC({default:()=>UC,render:()=>BC}),HC={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},UC={render:BC}}));function WC(e,t){return F(),I(`svg`,KC,[...t[0]||=[R(`path`,{fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M22 12H2m9.3-9.3L2 12l9.3 9.3`},null,-1)]])}var GC,KC,qC,FHe=s((()=>{jC(),W(),GC=AC({default:()=>qC,render:()=>WC}),KC={xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 24 24`},qC={render:WC}}));function JC(e,t){return F(),I(`svg`,XC,[...t[0]||=[R(`path`,{fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M2 12h20m-9.3 9.3L22 12l-9.3-9.3`},null,-1)]])}var YC,XC,ZC,IHe=s((()=>{jC(),W(),YC=AC({default:()=>ZC,render:()=>JC}),XC={xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 24 24`},ZC={render:JC}}));function QC(e,t){return F(),I(`svg`,ew,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M8 3H7a2 2 0 0 0-2 2v5a2 2 0 0 1-2 2 2 2 0 0 1 2 2v5c0 1.1.9 2 2 2h1m8 0h1a2 2 0 0 0 2-2v-5c0-1.1.9-2 2-2a2 2 0 0 1-2-2V5a2 2 0 0 0-2-2h-1`},null,-1)]])}var $C,ew,tw,LHe=s((()=>{jC(),W(),$C=AC({default:()=>tw,render:()=>QC}),ew={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},tw={render:QC}}));function nw(e,t){return F(),I(`svg`,iw,[...t[0]||=[R(`path`,{d:`M16.4 6.8v5.6H7.6m0-5.6v10.4`},null,-1),R(`circle`,{cx:`7.6`,cy:`4.4`,r:`2.4`},null,-1),R(`circle`,{cx:`7.6`,cy:`19.6`,r:`2.4`},null,-1),R(`circle`,{cx:`16.4`,cy:`4.4`,r:`2.4`},null,-1)]])}var rw,iw,aw,RHe=s((()=>{jC(),W(),rw=AC({default:()=>aw,render:()=>nw}),iw={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},aw={render:nw}}));function ow(e,t){return F(),I(`svg`,cw,[...t[0]||=[R(`path`,{d:`M12 22.125V4.712S9.545 1.985 1.268 1.875a.5.5 0 0 0-.366.15.52.52 0 0 0-.152.369v16.375a.515.515 0 0 0 .5.519C9.543 19.4 12 22.125 12 22.125`},null,-1),R(`path`,{d:`M9 11.18a21.3 21.3 0 0 0-5.26-1.055M9 15.375a21.3 21.3 0 0 0-5.26-1.055M15 11.18a21.3 21.3 0 0 1 5.26-1.055M15 15.375a21.3 21.3 0 0 1 5.26-1.055`},null,-1),R(`path`,{d:`M12 22.125V4.712s2.455-2.727 10.732-2.837a.5.5 0 0 1 .366.15.52.52 0 0 1 .152.369v16.375a.515.515 0 0 1-.5.519C14.457 19.4 12 22.125 12 22.125`},null,-1)]])}var sw,cw,lw,zHe=s((()=>{jC(),W(),sw=AC({default:()=>lw,render:()=>ow}),cw={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},lw={render:ow}}));function uw(e,t){return F(),I(`svg`,fw,[...t[0]||=[R(`path`,{fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M21.4 4.6 10.6 19.4l-8-6.4`},null,-1)]])}var dw,fw,pw,BHe=s((()=>{jC(),W(),dw=AC({default:()=>pw,render:()=>uw}),fw={xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 24 24`},pw={render:uw}}));function mw(e,t){return F(),I(`svg`,gw,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`m18 10-6 6-6-6`},null,-1)]])}var hw,gw,_w,VHe=s((()=>{jC(),W(),hw=AC({default:()=>_w,render:()=>mw}),gw={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},_w={render:mw}}));function vw(e,t){return F(),I(`svg`,bw,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`m14 18-6-6 6-6`},null,-1)]])}var yw,bw,xw,HHe=s((()=>{jC(),W(),yw=AC({default:()=>xw,render:()=>vw}),bw={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},xw={render:vw}}));function Sw(e,t){return F(),I(`svg`,ww,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`m9 18 6-6-6-6`},null,-1)]])}var Cw,ww,Tw,UHe=s((()=>{jC(),W(),Cw=AC({default:()=>Tw,render:()=>Sw}),ww={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},Tw={render:Sw}}));function Ew(e,t){return F(),I(`svg`,Ow,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`m18 15-6-6-6 6`},null,-1)]])}var Dw,Ow,kw,WHe=s((()=>{jC(),W(),Dw=AC({default:()=>kw,render:()=>Ew}),Ow={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},kw={render:Ew}}));function Aw(e,t){return F(),I(`svg`,Mw,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2m-6 4h10a2 2 0 0 1 2 2v10a2 2 0 0 1-2 2H10a2 2 0 0 1-2-2V10a2 2 0 0 1 2-2`},null,-1)]])}var jw,Mw,Nw,GHe=s((()=>{jC(),W(),jw=AC({default:()=>Nw,render:()=>Aw}),Mw={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},Nw={render:Aw}}));function Pw(e,t){return F(),I(`svg`,Iw,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M18 6 6 18M6 6l12 12`},null,-1)]])}var Fw,Iw,Lw,KHe=s((()=>{jC(),W(),Fw=AC({default:()=>Lw,render:()=>Pw}),Iw={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},Lw={render:Pw}}));function Rw(e,t){return F(),I(`svg`,Bw,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`m9.273 9.273 5.454 5.454m0-5.454-5.454 5.454M5.57 3h12.86A2.57 2.57 0 0 1 21 5.571V18.43A2.57 2.57 0 0 1 18.429 21H5.57A2.57 2.57 0 0 1 3 18.429V5.57A2.57 2.57 0 0 1 5.571 3Z`},null,-1)]])}var zw,Bw,Vw,qHe=s((()=>{jC(),W(),zw=AC({default:()=>Vw,render:()=>Rw}),Bw={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},Vw={render:Rw}}));function Hw(e,t){return F(),I(`svg`,Ww,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2m-3.121 8.879 4.242 4.242m0-4.242L12.88 17.12M10 8h10a2 2 0 0 1 2 2v10a2 2 0 0 1-2 2H10a2 2 0 0 1-2-2V10a2 2 0 0 1 2-2`},null,-1)]])}var Uw,Ww,Gw,JHe=s((()=>{jC(),W(),Uw=AC({default:()=>Gw,render:()=>Hw}),Ww={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},Gw={render:Hw}}));function Kw(e,t){return F(),I(`svg`,Jw,[...t[0]||=[R(`path`,{d:`M18.375 19.5a4.875 4.875 0 1 0-2.764-8.885A7.5 7.5 0 1 0 8.25 19.5z`},null,-1)]])}var qw,Jw,Yw,YHe=s((()=>{jC(),W(),qw=AC({default:()=>Yw,render:()=>Kw}),Jw={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},Yw={render:Kw}}));function Xw(e,t){return F(),I(`svg`,Qw,[...t[0]||=[R(`path`,{fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M21.75 9V6a1.5 1.5 0 0 0-1.5-1.5h-12V3a1.5 1.5 0 0 0-1.5-1.5h-4.5A1.5 1.5 0 0 0 .75 3v17.8a1.7 1.7 0 0 0 3.336.438l2.352-11.154A1.5 1.5 0 0 1 7.879 9za1.5 1.5 0 0 1 1.45 1.886l-2.2 10.5a1.5 1.5 0 0 1-1.45 1.114H2.447`},null,-1),R(`path`,{fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`m12 13.5-2.25 2.25L12 18m4.5-4.5 2.25 2.25L16.5 18`},null,-1)]])}var Zw,Qw,$w,XHe=s((()=>{jC(),W(),Zw=AC({default:()=>$w,render:()=>Xw}),Qw={xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 24 24`},$w={render:Xw}}));function eT(e,t){return F(),I(`svg`,nT,[...t[0]||=[R(`path`,{d:`M10.546 2.438a1.957 1.957 0 0 0 2.908 0L14.4 1.4a1.959 1.959 0 0 1 3.41 1.413l-.071 1.4a1.96 1.96 0 0 0 2.051 2.054l1.4-.071a1.959 1.959 0 0 1 1.41 3.41l-1.042.94a1.96 1.96 0 0 0 0 2.909l1.042.94a1.959 1.959 0 0 1-1.413 3.41l-1.4-.071a1.96 1.96 0 0 0-2.056 2.056l.071 1.4A1.959 1.959 0 0 1 14.4 22.6l-.941-1.041a1.96 1.96 0 0 0-2.908 0L9.606 22.6A1.959 1.959 0 0 1 6.2 21.192l.072-1.4a1.96 1.96 0 0 0-2.056-2.056l-1.4.071A1.958 1.958 0 0 1 1.4 14.4l1.041-.94a1.96 1.96 0 0 0 0-2.909L1.4 9.606A1.958 1.958 0 0 1 2.809 6.2l1.4.071a1.96 1.96 0 0 0 2.058-2.06L6.2 2.81A1.959 1.959 0 0 1 9.606 1.4z`},null,-1),R(`path`,{d:`M7.5 12.001a4.5 4.5 0 1 0 9 0 4.5 4.5 0 1 0-9 0`},null,-1)]])}var tT,nT,rT,ZHe=s((()=>{jC(),W(),tT=AC({default:()=>rT,render:()=>eT}),nT={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},rT={render:eT}}));function iT(e,t){return F(),I(`svg`,oT,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M20.86 16.6c0 .32-.16.64-.47.72l-6.3 2.83a.93.93 0 0 1-.8-.08c-.23-.16-.38-.4-.38-.63V4.56c0-.24.15-.55.39-.63.24-.16.47-.16.79-.08l6.3 2.83c.31.16.47.4.47.71v9.22zM10.7 19.52a.77.77 0 0 1-.7-.08.72.72 0 0 1-.32-.63V5.35c0-.24.15-.56.4-.63.23-.16.46-.16.78-.08M7.43 18.73a.77.77 0 0 1-.7-.08.72.72 0 0 1-.32-.63V6.05c0-.23.16-.55.4-.63.23-.15.47-.15.78-.07m-3.43 12.6a.77.77 0 0 1-.7-.08.72.72 0 0 1-.32-.63V6.84c0-.23.16-.55.4-.63.23-.16.47-.16.78-.08`},null,-1)]])}var aT,oT,sT,QHe=s((()=>{jC(),W(),aT=AC({default:()=>sT,render:()=>iT}),oT={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},sT={render:iT}}));function cT(e,t){return F(),I(`svg`,uT,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M15.739 8.061c-2.02.404-4.041-1.01-4.445-3.03-.202-1.01 0-2.223.606-3.031C6.445 2 2 6.445 2 11.9s4.445 9.9 9.9 9.9 9.9-4.445 9.9-9.9v-.808c-1.616 1.212-4.04.808-5.253-.808-.606-.606-.808-1.415-.808-2.223`},null,-1),R(`path`,{fill:`currentColor`,d:`M8.667 15.133a1.212 1.212 0 1 0 0-2.425 1.212 1.212 0 0 0 0 2.425m4.243 1.212a1.212 1.212 0 1 0 0-2.424 1.212 1.212 0 0 0 0 2.424M9.88 9.88a1.212 1.212 0 1 0 0-2.425 1.212 1.212 0 0 0 0 2.425`},null,-1)]])}var lT,uT,dT,$He=s((()=>{jC(),W(),lT=AC({default:()=>dT,render:()=>cT}),uT={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},dT={render:cT}}));function fT(e,t){return F(),I(`svg`,mT,[...t[0]||=[R(`path`,{d:`M17.673 16.462C10.59 16.46 5.52 9.612 7.59 2.837.22 6.233-.71 16.333 5.917 21.016c5.864 4.144 14.064 1.34 16.163-5.526-1.38.64-2.884.972-4.407.972M11.996 3.484h4.866m-2.433-2.433v4.867m4.867 2.433h3.244m-1.622-1.622v3.244`},null,-1)]])}var pT,mT,hT,eUe=s((()=>{jC(),W(),pT=AC({default:()=>hT,render:()=>fT}),mT={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},hT={render:fT}}));function gT(e,t){return F(),I(`svg`,vT,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M3 6h18m-2 0v14c0 1-1 2-2 2H7c-1 0-2-1-2-2V6m3 0V4c0-1 1-2 2-2h4c1 0 2 1 2 2v2m-6 5v6m4-6v6`},null,-1)]])}var _T,vT,yT,tUe=s((()=>{jC(),W(),_T=AC({default:()=>yT,render:()=>gT}),vT={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},yT={render:gT}}));function bT(e,t){return F(),I(`svg`,ST,[...t[0]||=[R(`path`,{d:`M10.145 5.108a.584.584 0 0 1-.657-.37l-.24-.705a.51.51 0 0 0-.496-.35c-1.835.065-3.434.577-4.13.834a1.2 1.2 0 0 0-.6.474c-.75 1.142-3.085 5.242-3.02 11.944.003.4.169.78.485 1.025.716.556 2.259 1.576 4.702 2.314.358.108.75.004.962-.304.316-.462.597-1.04.796-1.494a.56.56 0 0 1 .669-.31c.87.248 1.993.439 3.39.439 1.393 0 2.512-.19 3.379-.437a.56.56 0 0 1 .669.31c.199.454.48 1.03.795 1.492.211.308.604.412.962.304 2.443-.738 3.986-1.758 4.703-2.314.315-.245.48-.626.485-1.025.063-6.652-2.236-10.74-3.003-11.917a1.25 1.25 0 0 0-.654-.5c-.75-.256-2.428-.763-4.094-.833a.505.505 0 0 0-.496.348l-.239.703a.586.586 0 0 1-.66.37 10.5 10.5 0 0 0-1.846-.15c-.827 0-1.461.08-1.862.152`},null,-1),R(`path`,{d:`M10 12.553c0 1.38-1.008 2.5-2.25 2.5-1.243 0-2.25-1.12-2.25-2.5 0-1.381 1.007-2.5 2.25-2.5 1.242 0 2.25 1.119 2.25 2.5m4 0c0 1.38 1.007 2.5 2.25 2.5 1.242 0 2.25-1.12 2.25-2.5 0-1.381-1.008-2.5-2.25-2.5-1.243 0-2.25 1.119-2.25 2.5`},null,-1)]])}var xT,ST,CT,nUe=s((()=>{jC(),W(),xT=AC({default:()=>CT,render:()=>bT}),ST={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},CT={render:bT}}));function wT(e,t){return F(),I(`svg`,ET,[...t[0]||=[R(`path`,{fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M5.4 22.2h13c1.1 0 2-.9 2-2V3.6c0-1.1-.9-2-2-2h-9l-6 6v12.6c0 1.1.9 2 2 2`},null,-1),R(`path`,{fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M3.6 7.6h4c1.1 0 2-.9 2-2v-4zm9.4 0h4m-10 5h10M7 17.4h10`},null,-1)]])}var TT,ET,DT,rUe=s((()=>{jC(),W(),TT=AC({default:()=>DT,render:()=>wT}),ET={xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 24 24`},DT={render:wT}}));function iUe(e,t){return F(),I(`svg`,oUe,[...t[0]||=[R(`path`,{d:`M12.001 3.75v12m-4.5-4.5 4.5 4.5 4.5-4.5m6.75 4.5v1.5a3 3 0 0 1-3 3h-16.5a3 3 0 0 1-3-3v-1.5`},null,-1)]])}var aUe,oUe,sUe,cUe=s((()=>{jC(),W(),aUe=AC({default:()=>sUe,render:()=>iUe}),oUe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},sUe={render:iUe}}));function lUe(e,t){return F(),I(`svg`,dUe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M7.42 16.58H3.25a.83.83 0 0 1-.83-.83V3.25a.83.83 0 0 1 .83-.83h12.5a.83.83 0 0 1 .83.83v4.17`},null,-1),R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M8.25 7.42h12.5s.83 0 .83.83v12.5s0 .83-.83.83H8.25s-.83 0-.83-.83V8.25s0-.83.83-.83`},null,-1)]])}var uUe,dUe,fUe,pUe=s((()=>{jC(),W(),uUe=AC({default:()=>fUe,render:()=>lUe}),dUe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},fUe={render:lUe}}));function mUe(e,t){return F(),I(`svg`,gUe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M14 3H5.571A2.57 2.57 0 0 0 3 5.571V18.43A2.57 2.57 0 0 0 5.571 21H18.43A2.57 2.57 0 0 0 21 18.429V10m.96-5.35a1.845 1.845 0 0 0-2.61-2.61l-6.644 6.647a1.3 1.3 0 0 0-.328.543l-.864 2.849a.327.327 0 0 0 .408.407l2.849-.864c.205-.062.391-.174.543-.325l6.645-6.647Z`},null,-1)]])}var hUe,gUe,_Ue,vUe=s((()=>{jC(),W(),hUe=AC({default:()=>_Ue,render:()=>mUe}),gUe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},_Ue={render:mUe}}));function yUe(e,t){return F(),I(`svg`,xUe,[...t[0]||=[R(`path`,{d:`M6 11c-.5 0-1 .4-1 1s.5 1 1 1 1-.4 1-1-.5-1-1-1m12 0c-.6 0-1 .4-1 1s.4 1 1 1 1-.4 1-1-.4-1-1-1m-6 0c-.6 0-1 .4-1 1s.4 1 1 1 1-.4 1-1-.4-1-1-1`},null,-1)]])}var bUe,xUe,SUe,CUe=s((()=>{jC(),W(),bUe=AC({default:()=>SUe,render:()=>yUe}),xUe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},SUe={render:yUe}}));function wUe(e,t){return F(),I(`svg`,EUe,[...t[0]||=[R(`path`,{d:`M2.25 4.5h19.5s1.5 0 1.5 1.5v12s0 1.5-1.5 1.5H2.25s-1.5 0-1.5-1.5V6s0-1.5 1.5-1.5m13.437 5.475L19.5 13.5M8.313 9.975 4.5 13.5`},null,-1),R(`path`,{d:`m22.88 5.014-9.513 6.56a2.41 2.41 0 0 1-2.734 0L1.12 5.014`},null,-1)]])}var TUe,EUe,DUe,OUe=s((()=>{jC(),W(),TUe=AC({default:()=>DUe,render:()=>wUe}),EUe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},DUe={render:wUe}}));function kUe(e,t){return F(),I(`svg`,jUe,[...t[0]||=[R(`path`,{d:`M12 17.6c-.2 0-.4-.2-.4-.4s.2-.4.4-.4m0 .8c.2 0 .4-.2.4-.4s-.2-.4-.4-.4m0-3V5.6`},null,-1),R(`path`,{d:`M12 22c5.5 0 10-4.5 10-10S17.5 2 12 2 2 6.5 2 12s4.5 10 10 10`},null,-1)]])}var AUe,jUe,MUe,NUe=s((()=>{jC(),W(),AUe=AC({default:()=>MUe,render:()=>kUe}),jUe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},MUe={render:kUe}}));function PUe(e,t){return F(),I(`svg`,IUe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`m18.59 15.3 2.9-2.91a1.32 1.32 0 0 0 0-1.87l-1.85-1.85a3.3 3.3 0 1 1-4.31-4.31L13.48 2.5a1.32 1.32 0 0 0-1.87 0l-2.9 2.91a3.3 3.3 0 1 0-3.3 3.3l-2.9 2.9a1.32 1.32 0 0 0 0 1.87l1.85 1.85a3.3 3.3 0 1 1 4.31 4.31l1.85 1.85a1.32 1.32 0 0 0 1.87 0l2.9-2.9a3.3 3.3 0 1 0 3.3-3.3Z`},null,-1)]])}var FUe,IUe,LUe,RUe=s((()=>{jC(),W(),FUe=AC({default:()=>LUe,render:()=>PUe}),IUe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},LUe={render:PUe}}));function zUe(e,t){return F(),I(`svg`,VUe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M6.4 4H20v13.59M4 20 20 4`},null,-1)]])}var BUe,VUe,HUe,UUe=s((()=>{jC(),W(),BUe=AC({default:()=>HUe,render:()=>zUe}),VUe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},HUe={render:zUe}}));function WUe(e,t){return F(),I(`svg`,KUe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M4 6h16M7.556 12h8.888m-6.222 6h3.556`},null,-1)]])}var GUe,KUe,qUe,JUe=s((()=>{jC(),W(),GUe=AC({default:()=>qUe,render:()=>WUe}),KUe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},qUe={render:WUe}}));function YUe(e,t){return F(),I(`svg`,ZUe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M20 20a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.9a2 2 0 0 1-1.69-.9L9.6 3.9A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13a2 2 0 0 0 2 2z`},null,-1)]])}var XUe,ZUe,QUe,$Ue=s((()=>{jC(),W(),XUe=AC({default:()=>QUe,render:()=>YUe}),ZUe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},QUe={render:YUe}}));function eWe(e,t){return F(),I(`svg`,nWe,[...t[0]||=[R(`path`,{d:`M512 0a512 512 0 0 0-162 998c26 4 35-11 35-25l-1-95c-128 23-161-32-172-60-6-15-31-61-52-73-18-10-44-33-1-33 40-1 69 37 78 52 46 78 120 56 149 43 5-33 18-56 33-69-114-13-234-56-234-253 0-56 20-101 53-137-5-13-23-65 5-136 0 0 43-13 141 53a487 487 0 0 1 256 0c98-66 141-53 141-53 28 71 10 123 5 136 33 36 53 81 53 137 0 197-120 240-234 253 18 16 35 47 35 95l-1 140c0 14 9 30 35 25A512 512 0 0 0 512 0`},null,-1)]])}var tWe,nWe,rWe,iWe=s((()=>{jC(),W(),tWe=AC({default:()=>rWe,render:()=>eWe}),nWe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 1024 1024`},rWe={render:eWe}}));function aWe(e,t){return F(),I(`svg`,sWe,[...t[0]||=[R(`path`,{d:`M16.643 22.94v-3.135a3.68 3.68 0 0 0-1.026-2.852c3.43-.382 7.036-1.682 7.036-7.648a5.94 5.94 0 0 0-1.64-4.097 5.54 5.54 0 0 0-.097-4.12s-1.29-.382-4.272 1.618a14.6 14.6 0 0 0-7.649 0c-2.982-2-4.272-1.617-4.272-1.617a5.54 5.54 0 0 0-.098 4.119 5.94 5.94 0 0 0-1.639 4.13c0 5.922 3.606 7.222 7.036 7.648a3.68 3.68 0 0 0-1.027 2.819v3.136m0-2.186c-3.277 1.064-6.009 0-7.648-3.278`},null,-1)]])}var oWe,sWe,cWe,lWe=s((()=>{jC(),W(),oWe=AC({default:()=>cWe,render:()=>aWe}),sWe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},cWe={render:aWe}}));function uWe(e,t){return F(),I(`svg`,fWe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M22 12c0 5.523-4.477 10-10 10m10-10c0-5.523-4.477-10-10-10m10 10H2m10 10C6.477 22 2 17.523 2 12m10 10a14.5 14.5 0 0 1 0-20m0 20a14.5 14.5 0 0 0 0-20M2 12C2 6.477 6.477 2 12 2`},null,-1)]])}var dWe,fWe,pWe,mWe=s((()=>{jC(),W(),dWe=AC({default:()=>pWe,render:()=>uWe}),fWe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},pWe={render:uWe}}));function hWe(e,t){return F(),I(`svg`,_We,[...t[0]||=[R(`path`,{d:`M23.93 10.67a.76.76 0 0 0-.75-.67H12.75a.76.76 0 0 0-.75.75v3.5a.76.76 0 0 0 .75.75h5.58A7 7 0 1 1 12 5a7 7 0 0 1 4.23 1.42.74.74 0 0 0 1-.07l2.47-2.49a.75.75 0 0 0 .22-.57.77.77 0 0 0-.27-.54A12 12 0 1 0 24 12a12 12 0 0 0-.07-1.33`},null,-1)]])}var gWe,_We,vWe,yWe=s((()=>{jC(),W(),gWe=AC({default:()=>vWe,render:()=>hWe}),_We={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},vWe={render:hWe}}));function bWe(e,t){return F(),I(`svg`,SWe,[...t[0]||=[R(`path`,{d:`M9.2 9.2c0-.5.1-1 .4-1.5s.6-.8 1.1-1q.75-.3 1.5-.3c.75 0 1 .2 1.4.5s.7.7 1 1.2c.2.5.3 1 .2 1.5s-.3 1-.6 1.4-.8.7-1.2.9c-.255.128-.5.3-.7.5s-.3.5-.3.8v.9m0 3.5c-.2 0-.4-.2-.4-.4s.2-.4.4-.4.4.2.4.4-.2.4-.4.4`},null,-1),R(`path`,{d:`M12 22c5.524 0 10-4.476 10-10S17.524 2 12 2 2 6.476 2 12s4.476 10 10 10`},null,-1)]])}var xWe,SWe,CWe,wWe=s((()=>{jC(),W(),xWe=AC({default:()=>CWe,render:()=>bWe}),SWe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},CWe={render:bWe}}));function TWe(e,t){return F(),I(`svg`,DWe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M9.88 14.12a3 3 0 1 1 4.24-4.24m-3.39 9.04q.632.079 1.27.08c7 0 10-7 10-7a13.2 13.2 0 0 0-1.67-2.68M6.61 17.39A13.5 13.5 0 0 1 2 12s3-7 10-7a9.74 9.74 0 0 1 5.39 1.61M2 22 22 2`},null,-1)]])}var EWe,DWe,OWe,kWe=s((()=>{jC(),W(),EWe=AC({default:()=>OWe,render:()=>TWe}),DWe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},OWe={render:TWe}}));function AWe(e,t){return F(),I(`svg`,MWe,[...t[0]||=[R(`path`,{d:`M12.9 6.8v6.1h4.7`},null,-1),R(`path`,{d:`M6.1 17.2c1.6 2.2 4.2 3.6 7.1 3.6 4.8 0 8.8-3.9 8.8-8.8s-3.9-8.8-8.8-8.8-8.8 4-8.8 8.8v1.7M2 11.3l2.4 2.4 2.4-2.4`},null,-1)]])}var jWe,MWe,NWe,PWe=s((()=>{jC(),W(),jWe=AC({default:()=>NWe,render:()=>AWe}),MWe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},NWe={render:AWe}}));function FWe(e,t){return F(),I(`svg`,LWe,[...t[0]||=[R(`path`,{d:`M22.1 9.2 12 1.5 1.8 9.2c-.2.2-.3.5-.4.7v11.7c0 .5.4.9.9.9h6.1v-4.9c0-1.9 1.6-3.5 3.5-3.5s3.5 1.6 3.5 3.5v4.9h6.1c.5 0 .9-.4.9-.9V9.9c0-.3-.1-.6-.4-.7z`},null,-1)]])}var IWe,LWe,RWe,zWe=s((()=>{jC(),W(),IWe=AC({default:()=>RWe,render:()=>FWe}),LWe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},RWe={render:FWe}}));function BWe(e,t){return F(),I(`svg`,HWe,[...t[0]||=[R(`path`,{d:`M12 10.67v7.98M14.66 16 12 18.64 9.34 16`},null,-1),R(`path`,{d:`M3.35 7.34h17.3s1.33 0 1.33 1.33v11.98s0 1.33-1.33 1.33H3.35s-1.33 0-1.33-1.33V8.67s0-1.33 1.33-1.33`},null,-1),R(`path`,{d:`m2.2 8 2.13-5.19a1.33 1.33 0 0 1 1.22-.79h12.9a1.33 1.33 0 0 1 1.22.8l2.08 5.1M12 7.34V2.02`},null,-1)]])}var VWe,HWe,UWe,WWe=s((()=>{jC(),W(),VWe=AC({default:()=>UWe,render:()=>BWe}),HWe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},UWe={render:BWe}}));function GWe(e,t){return F(),I(`svg`,qWe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M12 22c5.523 0 10-4.477 10-10S17.523 2 12 2 2 6.477 2 12s4.477 10 10 10`},null,-1),R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M12 17v-6 0a.5.5 0 0 0-.5-.5l-.5.001h-1M12 17h-2m2 0h2`},null,-1),R(`path`,{fill:`currentColor`,"fill-rule":`evenodd`,d:`M10.75 7.5a1 1 0 1 1 2 0 1 1 0 0 1-2 0`,"clip-rule":`evenodd`},null,-1)]])}var KWe,qWe,JWe,YWe=s((()=>{jC(),W(),KWe=AC({default:()=>JWe,render:()=>GWe}),qWe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},JWe={render:GWe}}));function XWe(e,t){return F(),I(`svg`,QWe,[...t[0]||=[R(`path`,{d:`M12.82 14.51 15.36 12l1.76.47a1.56 1.56 0 0 0 1.51-.47 1.58 1.58 0 0 0 .37-1.49l-.47-1.75.82-.76 1.76.47A1.56 1.56 0 0 0 22.62 8 1.58 1.58 0 0 0 23 6.52l-.47-1.75a2.35 2.35 0 0 0-3.33-3.33l-9.71 9.74a6.29 6.29 0 1 0 3.33 3.33`},null,-1),R(`path`,{d:`M4.26 17.84a1.9 1.9 0 1 0 3.8 0 1.9 1.9 0 1 0-3.8 0`},null,-1)]])}var ZWe,QWe,$We,eGe=s((()=>{jC(),W(),ZWe=AC({default:()=>$We,render:()=>XWe}),QWe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},$We={render:XWe}}));function tGe(e,t){return F(),I(`svg`,rGe,[...t[0]||=[R(`path`,{d:`M16.35 16.5v1c0 1.1-.9 2-2 2H2.75c-1.1 0-2-.9-2-2v-11c0-1.1.9-2 2-2h11.6c1.1 0 2 .9 2 2v1M5.25 12h18m0 0-3 3.1m3-3.1-3-2.9`},null,-1)]])}var nGe,rGe,iGe,aGe=s((()=>{jC(),W(),nGe=AC({default:()=>iGe,render:()=>tGe}),rGe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},iGe={render:tGe}}));function oGe(e,t){return F(),I(`svg`,cGe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M6.55 12a5.46 5.46 0 1 0 10.91.481A5.46 5.46 0 0 0 6.55 12m0 0H2m4.55 0H4.73m12.31 2.1a5.46 5.46 0 0 1-6.614-6.887M12 2v4.55m7.08-1.62-3.22 3.22M22 12h-4.54m1.62 7.08L16 16.01M12 22v-4m-7.07 1.08L8 16.01M4.93 4.93l3.22 3.22`},null,-1)]])}var sGe,cGe,lGe,uGe=s((()=>{jC(),W(),sGe=AC({default:()=>lGe,render:()=>oGe}),cGe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},lGe={render:oGe}}));function dGe(e,t){return F(),I(`svg`,pGe,[...t[0]||=[R(`path`,{fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M7.501 12a4.5 4.5 0 1 0 9 0 4.5 4.5 0 1 0-9 0m4.5-10.5v3m0 15v3m10.5-10.5h-3m-15 0h-3m17.924-7.424-2.121 2.121M6.697 17.304l-2.121 2.121m14.849 0-2.121-2.121M6.697 6.697 4.576 4.576`},null,-1)]])}var fGe,pGe,mGe,hGe=s((()=>{jC(),W(),fGe=AC({default:()=>mGe,render:()=>dGe}),pGe={xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 24 24`},mGe={render:dGe}}));function gGe(e,t){return F(),I(`svg`,vGe,[...t[0]||=[R(`path`,{d:`M13.5 18 12 19.5c-1 1-2.3 1.5-3.7 1.5s-2.7-.6-3.7-1.5c-1-1-1.5-2.3-1.5-3.7s.6-2.7 1.5-3.7l1.5-1.5M10.5 6 12 4.5c1-1 2.3-1.5 3.7-1.5s2.7.6 3.7 1.5c1 1 1.5 2.3 1.5 3.7s-.6 2.7-1.5 3.7l-1.5 1.5M9 15l6-6`},null,-1)]])}var _Ge,vGe,yGe,bGe=s((()=>{jC(),W(),_Ge=AC({default:()=>yGe,render:()=>gGe}),vGe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},yGe={render:gGe}}));function xGe(e,t){return F(),I(`svg`,CGe,[...t[0]||=[R(`path`,{d:`M12 17a1 1 0 1 0 0-2 1 1 0 0 0 0 2`},null,-1),R(`path`,{d:`M5.778 10h12.444c.982 0 1.778.895 1.778 2v8c0 1.105-.796 2-1.778 2H5.778C4.796 22 4 21.105 4 20v-8c0-1.105.796-2 1.778-2M7 10V7a5 5 0 1 1 10 0v3`},null,-1)]])}var SGe,CGe,wGe,TGe=s((()=>{jC(),W(),SGe=AC({default:()=>wGe,render:()=>xGe}),CGe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},wGe={render:xGe}}));function EGe(e,t){return F(),I(`svg`,OGe,[...t[0]||=[R(`path`,{"fill-rule":`evenodd`,d:`M347 0c6 0 12 5 12 12v134l94-95c5-5 13-5 17 0l72 72c4 4 5 12 0 16v1l-95 94h134c7 0 12 5 12 12v101c0 7-5 12-12 12H447l95 94c4 5 5 13 0 17l-72 72c-4 4-12 5-16 0h-1l-94-95v134c0 7-5 12-12 12H246c-7 0-12-5-12-12v-70c0-22 9-43 24-59l130-130c14-14 14-37 0-51L259 142a84 84 0 0 1-25-59V12c0-7 5-12 12-12zM138 52h1l219 219c14 14 14 37 0 51L139 542c-4 5-12 5-17 0l-71-70c-4-5-5-12 0-17l95-96H12c-7 0-12-5-12-12V246c0-7 5-12 12-12h134l-95-94c-4-5-4-12 0-17l71-71c4-5 12-5 16 0`},null,-1)]])}var DGe,OGe,kGe,AGe=s((()=>{jC(),W(),DGe=AC({default:()=>kGe,render:()=>EGe}),OGe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 593 593`},kGe={render:EGe}}));function jGe(e,t){return F(),I(`svg`,NGe,[...t[0]||=[R(`path`,{fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`m.75 23.25 15-15m-5.25 0H8.25m15 0H21M21 3l-1.591 1.591M15.75 3V.75m0 15V13.5m-3.659-8.909L10.5 3M21 13.5l-1.591-1.591`},null,-1)]])}var MGe,NGe,PGe,FGe=s((()=>{jC(),W(),MGe=AC({default:()=>PGe,render:()=>jGe}),NGe={xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 24 24`},PGe={render:jGe}}));function IGe(e,t){return F(),I(`svg`,RGe,[...t[0]||=[R(`path`,{fill:`currentColor`,d:`M3 16.142V8.245h2.323l2.322 2.903 2.323-2.903h2.322v7.897H9.968v-4.53l-2.323 2.904-2.322-2.903v4.529zm14.516 0-3.484-3.832h2.323V8.245h2.322v4.065H21z`},null,-1)]])}var LGe,RGe,zGe,BGe=s((()=>{jC(),W(),LGe=AC({default:()=>zGe,render:()=>IGe}),RGe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},zGe={render:IGe}}));function VGe(e,t){return F(),I(`svg`,UGe,[...t[0]||=[R(`path`,{fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M22 6.8H2m20 10.4H2`},null,-1)]])}var HGe,UGe,WGe,GGe=s((()=>{jC(),W(),HGe=AC({default:()=>WGe,render:()=>VGe}),UGe={xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 24 24`},WGe={render:VGe}}));function KGe(e,t){return F(),I(`svg`,JGe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`m4.9 4.9 14.2 14.2M22 12c0 5.523-4.477 10-10 10S2 17.523 2 12 6.477 2 12 2s10 4.477 10 10`},null,-1)]])}var qGe,JGe,YGe,XGe=s((()=>{jC(),W(),qGe=AC({default:()=>YGe,render:()=>KGe}),JGe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},YGe={render:KGe}}));function ZGe(e,t){return F(),I(`svg`,$Ge,[...t[0]||=[R(`path`,{d:`M17.333 5.34c1.39-.22 2.796-.334 4.205-.34.121 0 .238.043.329.122a.44.44 0 0 1 .133.314v13.73a.44.44 0 0 1-.133.306.46.46 0 0 1-.311.13C14.186 19.708 12 22 12 22m0 0V7.38S9.822 5.096 2.462 5a.5.5 0 0 0-.329.122.44.44 0 0 0-.133.314v13.73a.44.44 0 0 0 .133.306.46.46 0 0 0 .311.13C9.814 19.708 12 22 12 22`},null,-1),R(`path`,{d:`M12 22a5.67 5.67 0 0 1 1.367-3.135c.967-1.141 2.237-1.923 3.633-2.236V2.443a.45.45 0 0 0-.051-.21.4.4 0 0 0-.14-.154.47.47 0 0 0-.409-.054 6.44 6.44 0 0 0-3.033 2.063A5.86 5.86 0 0 0 12 7.205`},null,-1)]])}var QGe,$Ge,eKe,tKe=s((()=>{jC(),W(),QGe=AC({default:()=>eKe,render:()=>ZGe}),$Ge={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},eKe={render:ZGe}}));function nKe(e,t){return F(),I(`svg`,iKe,[...t[0]||=[R(`path`,{d:`M17 3a2.85 2.85 0 0 1 2.064-1.007 2.87 2.87 0 0 1 2.14.834 2.83 2.83 0 0 1 .825 2.131A2.8 2.8 0 0 1 21 7L7.5 20.5 2 22l1.5-5.5z`},null,-1)]])}var rKe,iKe,aKe,oKe=s((()=>{jC(),W(),rKe=AC({default:()=>aKe,render:()=>nKe}),iKe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},aKe={render:nKe}}));function sKe(e,t){return F(),I(`svg`,lKe,[...t[0]||=[R(`path`,{d:`M6 6.663c0-1.582 1.75-2.538 3.082-1.682l8.301 5.337a2 2 0 0 1 0 3.364L9.082 19.02C7.75 19.875 6 18.919 6 17.337z`},null,-1)]])}var cKe,lKe,uKe,dKe=s((()=>{jC(),W(),cKe=AC({default:()=>uKe,render:()=>sKe}),lKe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},uKe={render:sKe}}));function fKe(e,t){return F(),I(`svg`,mKe,[...t[0]||=[R(`path`,{fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M5.25 14.248v4.5H.75m18-9v-4.5h4.5m-4.218-.003A9.752 9.752 0 0 1 8.246 21m-3.279-2.249A9.753 9.753 0 0 1 15.754 3`},null,-1)]])}var pKe,mKe,hKe,gKe=s((()=>{jC(),W(),pKe=AC({default:()=>hKe,render:()=>fKe}),mKe={xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 24 24`},hKe={render:fKe}}));function _Ke(e,t){return F(),I(`svg`,yKe,[...t[0]||=[R(`path`,{d:`M16.22 2.663a1.47 1.47 0 0 0-1.09 0L8.87 5.167c-.35.14-.74.14-1.09 0L1.982 2.848a.735.735 0 0 0-1.008.686V17.62c0 .601.366 1.142.924 1.365l5.88 2.352c.35.14.742.14 1.092 0l6.258-2.504c.35-.14.741-.14 1.092 0l5.796 2.315a.735.735 0 0 0 1.008-.686V6.38a1.47 1.47 0 0 0-.924-1.365ZM8.325 5.272v16.17m7.35-18.884v16.17`},null,-1)]])}var vKe,yKe,bKe,xKe=s((()=>{jC(),W(),vKe=AC({default:()=>bKe,render:()=>_Ke}),yKe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},bKe={render:_Ke}}));function SKe(e,t){return F(),I(`svg`,wKe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M3 15c1.895 3 3.79 4 6.632 4s6.631-3 6.631-7-2.842-7-5.684-7-4.737 1.5-4.737 4 1.895 5 5.684 5S19.492 11.547 21 9`},null,-1)]])}var CKe,wKe,TKe,EKe=s((()=>{jC(),W(),CKe=AC({default:()=>TKe,render:()=>SKe}),wKe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},TKe={render:SKe}}));function DKe(e,t){return F(),I(`svg`,kKe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M11 19a8 8 0 1 0 0-16 8 8 0 0 0 0 16m10 2-4.35-4.35`},null,-1)]])}var OKe,kKe,AKe,jKe=s((()=>{jC(),W(),OKe=AC({default:()=>AKe,render:()=>DKe}),kKe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},AKe={render:DKe}}));function MKe(e,t){return F(),I(`svg`,PKe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M20 12a2 2 0 0 0 2-2V6a2 2 0 0 0-2-2H4a2 2 0 0 0-2 2v4a2 2 0 0 0 2 2m16 0H4m16 0a2 2 0 0 1 2 2v4a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2v-4a2 2 0 0 1 2-2`},null,-1),R(`path`,{fill:`currentColor`,d:`M18 9a1 1 0 1 0 0-2 1 1 0 0 0 0 2m0 8a1 1 0 1 0 0-2 1 1 0 0 0 0 2`},null,-1),R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M6 8h4m-4 8h4`},null,-1)]])}var NKe,PKe,FKe,IKe=s((()=>{jC(),W(),NKe=AC({default:()=>FKe,render:()=>MKe}),PKe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},FKe={render:MKe}}));function LKe(e,t){return F(),I(`svg`,zKe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M20 7H9m0 0a2 2 0 1 1-4 0 2 2 0 0 1 4 0m7 10H5m11 0a2 2 0 1 0 4 0 2 2 0 0 0-4 0`},null,-1)]])}var RKe,zKe,BKe,VKe=s((()=>{jC(),W(),RKe=AC({default:()=>BKe,render:()=>LKe}),zKe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},BKe={render:LKe}}));function HKe(e,t){return F(),I(`svg`,WKe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M2 12s3-7 10-7 10 7 10 7-3 7-10 7-10-7-10-7`},null,-1),R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M12 15a3 3 0 1 0 0-6 3 3 0 0 0 0 6`},null,-1)]])}var UKe,WKe,GKe,KKe=s((()=>{jC(),W(),UKe=AC({default:()=>GKe,render:()=>HKe}),WKe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},GKe={render:HKe}}));function qKe(e,t){return F(),I(`svg`,YKe,[...t[0]||=[R(`path`,{fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M2 5.4h20M2 12h20M2 18.6h13.3`},null,-1)]])}var JKe,YKe,XKe,ZKe=s((()=>{jC(),W(),JKe=AC({default:()=>XKe,render:()=>qKe}),YKe={xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 24 24`},XKe={render:qKe}}));function QKe(e,t){return F(),I(`svg`,eqe,[...t[0]||=[R(`path`,{fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M13 15h5M6 9l4 3-4 3`},null,-1),R(`path`,{fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M21 2.8H3.1c-.7 0-1.4.6-1.4 1.4v15.6c0 .7.6 1.4 1.4 1.4H21c.7 0 1.4-.6 1.4-1.4V4.2c0-.8-.5-1.4-1.3-1.4z`},null,-1)]])}var $Ke,eqe,tqe,nqe=s((()=>{jC(),W(),$Ke=AC({default:()=>tqe,render:()=>QKe}),eqe={xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 24 24`},tqe={render:QKe}}));function rqe(e,t){return F(),I(`svg`,aqe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`m19.5 5.75-1.51 14.34a1.67 1.67 0 0 1-1.66 1.5H7.67A1.67 1.67 0 0 1 6 20.08L4.5 5.75m-2.08 0h19.16m-13.33 0v-2.5a.83.83 0 0 1 .83-.83h5.84a.83.83 0 0 1 .83.83v2.5M12 9.5v8.75m3.75-8.75-.42 8.75M8.25 9.5l.42 8.75`},null,-1)]])}var iqe,aqe,oqe,sqe=s((()=>{jC(),W(),iqe=AC({default:()=>oqe,render:()=>rqe}),aqe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},oqe={render:rqe}}));function cqe(e,t){return F(),I(`svg`,uqe,[...t[0]||=[R(`path`,{d:`M12 17a1 1 0 1 0 0-2 1 1 0 0 0 0 2`},null,-1),R(`path`,{d:`M5.778 10h12.444c.982 0 1.778.895 1.778 2v8c0 1.105-.796 2-1.778 2H5.778C4.796 22 4 21.105 4 20v-8c0-1.105.796-2 1.778-2M17 10V7a5 5 0 0 0-9.33-2.5`},null,-1)]])}var lqe,uqe,dqe,fqe=s((()=>{jC(),W(),lqe=AC({default:()=>dqe,render:()=>cqe}),uqe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},dqe={render:cqe}}));function pqe(e,t){return F(),I(`svg`,hqe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M4.9 19.1c-3.038-3.038-3.71-7.592-2.015-11.3M7.8 16.2c-1.397-1.397-1.945-3.346-1.646-5.2M16.2 7.8c2.3 2.3 2.3 6.1 0 8.5m2.9-11.4C23 8.8 23 15.1 19.1 19m-8.423-8.5a2 2 0 0 1 2.75 2.901M22 22 2 2`},null,-1)]])}var mqe,hqe,gqe,_qe=s((()=>{jC(),W(),mqe=AC({default:()=>gqe,render:()=>pqe}),hqe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},gqe={render:pqe}}));function vqe(e,t){return F(),I(`svg`,bqe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M12 4.33v15.32m5.37-9.95L12 4.33 6.63 9.7`},null,-1)]])}var yqe,bqe,xqe,Sqe=s((()=>{jC(),W(),yqe=AC({default:()=>xqe,render:()=>vqe}),bqe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},xqe={render:vqe}}));function Cqe(e,t){return F(),I(`svg`,Tqe,[...t[0]||=[R(`path`,{d:`M3.5 22.2c.3-4.5 4-8 8.5-8s8.2 3.5 8.5 8z`},null,-1),R(`circle`,{cx:`12`,cy:`6.2`,r:`4.5`},null,-1)]])}var wqe,Tqe,Eqe,Dqe=s((()=>{jC(),W(),wqe=AC({default:()=>Eqe,render:()=>Cqe}),Tqe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},Eqe={render:Cqe}}));function Oqe(e,t){return F(),I(`svg`,Aqe,[...t[0]||=[R(`path`,{d:`M11.101 1.488H4.83a1 1 0 0 0-1 1v6.614m9.069 13.41h6.272a1 1 0 0 0 1-1v-6.614`},null,-1),R(`path`,{d:`m1.23 6.5 2.6 2.6 2.601-2.6m16.339 11-2.6-2.6-2.601 2.6M5.505 18.546a2.551 2.551 0 1 0 0-5.103 2.551 2.551 0 0 0 0 5.103m4.277 3.965c-.559-1.83-2.29-3.202-4.276-3.202-1.988 0-3.718 1.372-4.277 3.202m17.264-15.92a2.551 2.551 0 1 0 0-5.103 2.551 2.551 0 0 0 0 5.103m4.277 3.965c-.559-1.83-2.289-3.202-4.276-3.202s-3.718 1.372-4.276 3.202`},null,-1)]])}var kqe,Aqe,jqe,Mqe=s((()=>{jC(),W(),kqe=AC({default:()=>jqe,render:()=>Oqe}),Aqe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},jqe={render:Oqe}}));function Nqe(e,t){return F(),I(`svg`,Fqe,[...t[0]||=[R(`path`,{d:`M3.375 7.875a4.125 4.125 0 1 0 8.25 0 4.125 4.125 0 1 0-8.25 0M.75 20.25a6.75 6.75 0 0 1 13.5 0m.001-15.834a4.125 4.125 0 1 1-.006 6.914M15 13.667a6.757 6.757 0 0 1 8.25 6.583`},null,-1)]])}var Pqe,Fqe,Iqe,Lqe=s((()=>{jC(),W(),Pqe=AC({default:()=>Iqe,render:()=>Nqe}),Fqe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},Iqe={render:Nqe}}));function Rqe(e,t){return F(),I(`svg`,Bqe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`m5.246 12.069-2.74 1.569a1 1 0 0 0 .001 1.74l8.5 4.87a2 2 0 0 0 2 0l8.5-4.87a.999.999 0 0 0 0-1.74l-2.702-1.548m-5.798 3.158a2 2 0 0 1-2 0l-8.5-4.87a1 1 0 0 1 0-1.74l8.5-4.87a2 2 0 0 1 2 0l8.5 4.87a1 1 0 0 1 0 1.74z`},null,-1)]])}var zqe,Bqe,Vqe,Hqe=s((()=>{jC(),W(),zqe=AC({default:()=>Vqe,render:()=>Rqe}),Bqe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},Vqe={render:Rqe}}));function Uqe(e,t){return F(),I(`svg`,Gqe,[...t[0]||=[R(`path`,{d:`M2.97 2.771 13.908 5.88a3.77 3.77 0 0 1 2.592 3.5v10.51a2.052 2.052 0 0 1-2.6 2.167l-9.048-2.46a3.7 3.7 0 0 1-2.6-3.457V4.688a2.75 2.75 0 0 1 2.67-2.813H18.75a3 3 0 0 1 3 3v8.953a3.073 3.073 0 0 1-3.11 3.047H16.5`},null,-1),R(`path`,{d:`M12.375 13.875a.375.375 0 0 1 0-.75m0 .75a.375.375 0 0 0 0-.75m9.375-3.75H16.5`},null,-1)]])}var Wqe,Gqe,Kqe,qqe=s((()=>{jC(),W(),Wqe=AC({default:()=>Kqe,render:()=>Uqe}),Gqe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},Kqe={render:Uqe}}));function Jqe(e,t){return F(),I(`svg`,Xqe,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M4.9 19.1C1 15.2 1 8.8 4.9 4.9m2.9 11.3c-2.3-2.3-2.3-6.1 0-8.5m8.4.1c2.3 2.3 2.3 6.1 0 8.5m2.9-11.4C23 8.8 23 15.1 19.1 19M14 12a2 2 0 1 1-4 0 2 2 0 0 1 4 0`},null,-1)]])}var Yqe,Xqe,Zqe,Qqe=s((()=>{jC(),W(),Yqe=AC({default:()=>Zqe,render:()=>Jqe}),Xqe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},Zqe={render:Jqe}}));function $qe(e,t){return F(),I(`svg`,tJe,[...t[0]||=[R(`path`,{d:`M20.25 3.75v19.5M3.75 3.75h16.5m-16.5 19.5V3.75m16.5 19.5H3.75m16.5-19.5H3.75l1.5-3h13.5zM.75 23.25h22.5m-9-2.25a2.25 2.25 0 0 0-4.5 0v2.25h4.5zM7.5 7.13a.37.37 0 1 1 0-.75m0 .75a.37.37 0 1 0 0-.75m4.5.75a.38.38 0 0 1 0-.75m0 .75a.38.38 0 0 0 0-.75m4.5.75a.38.38 0 0 1 0-.75m0 .75a.38.38 0 0 0 0-.75m-9 5.25a.38.38 0 0 1 0-.76m0 .76a.38.38 0 0 0 0-.76m4.5.76a.38.38 0 0 1 0-.76m0 .76a.38.38 0 0 0 0-.76m4.5.76a.38.38 0 0 1 0-.76m0 .76a.38.38 0 0 0 0-.76m-9 5.26a.38.38 0 0 1 0-.75m0 .75a.38.38 0 0 0 0-.75m4.5.75a.38.38 0 0 1 0-.75m0 .75a.38.38 0 0 0 0-.75m4.5.75a.38.38 0 0 1 0-.75m0 .75a.38.38 0 0 0 0-.75`},null,-1)]])}var eJe,tJe,nJe,rJe=s((()=>{jC(),W(),eJe=AC({default:()=>nJe,render:()=>$qe}),tJe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,viewBox:`0 0 24 24`},nJe={render:$qe}}));function iJe(e,t){return F(),I(`svg`,oJe,[...t[0]||=[R(`path`,{d:`M9.931 12.645h4.138l-2.07-4.908m0-7.737L.68 3.982l1.726 14.771L12 24l9.596-5.242L23.32 3.984zm7.064 18.31h-2.638l-1.422-3.503H8.996l-1.422 3.504h-2.64L12 2.65z`},null,-1)]])}var aJe,oJe,sJe,cJe=s((()=>{jC(),W(),aJe=AC({default:()=>sJe,render:()=>iJe}),oJe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},sJe={render:iJe}}));function lJe(e,t){return F(),I(`svg`,dJe,[...t[0]||=[R(`path`,{d:`M16.074 16.86c-.72.616-2.157 1.035-3.812 1.035-2.032 0-3.735-.632-4.187-1.483-.161.488-.198 1.046-.198 1.402 0 0-.106 1.75 1.111 2.968 0-.632.513-1.145 1.145-1.145 1.083 0 1.082.945 1.081 1.712v.069c0 1.164.711 2.161 1.723 2.582a2.35 2.35 0 0 1-.236-1.029c0-1.11.652-1.523 1.41-2.003.602-.383 1.272-.807 1.733-1.66a3.1 3.1 0 0 0 .378-1.494 3.1 3.1 0 0 0-.148-.954M15.551.6c.196.244.296.572.496 1.229l4.368 14.347a18.2 18.2 0 0 0-5.222-1.768L12.35 4.8a.37.37 0 0 0-.71.002l-2.81 9.603a18.2 18.2 0 0 0-5.245 1.771L7.974 1.827c.2-.656.3-.984.497-1.227a1.6 1.6 0 0 1 .654-.484C9.415 0 9.757 0 10.443 0h3.135c.686 0 1.03 0 1.32.117A1.6 1.6 0 0 1 15.55.6z`},null,-1)]])}var uJe,dJe,fJe,pJe=s((()=>{jC(),W(),uJe=AC({default:()=>fJe,render:()=>lJe}),dJe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},fJe={render:lJe}}));function mJe(e,t){return F(),I(`svg`,gJe,[...t[0]||=[R(`path`,{fill:`currentColor`,"fill-rule":`evenodd`,d:`M6.335.83a.75.75 0 0 0-.67 0L1.667 2.827a.75.75 0 0 0-.417.672V18c0 .271.146.52.382.654l7.989 4.493a.75.75 0 0 0 .747.007l8-4.5A.75.75 0 0 0 18.75 18v-4.537l3.585-1.792A.75.75 0 0 0 22.75 11V6a.75.75 0 0 0-.417-.672l-3.998-1.999a.75.75 0 0 0-.67 0l-3.997 1.999a.7.7 0 0 0-.246.194.75.75 0 0 0-.172.478v4.561l-2.5 1.407V3.5a.75.75 0 0 0-.43-.678L6.336.829Zm7.686 11.019 2.38 1.19-6.422 3.612-2.38-1.19zm3.229-.063-2.5-1.25V7.215l2.5 1.25zm1.5 0 2.5-1.25V7.215l-2.5 1.25zm-9.5 1.025V4.714l-2.5 1.25v8.254zm-1.005 4.65.743.372c.17.091.262.153.262.183v3.202l-6.5-3.657V4.714l2.5 1.25V15.5a.75.75 0 0 0 .415.67s1.122.591 2.108 1.064zm2.505.478 6.5-3.657v3.28l-6.5 3.656v-3.28ZM6 4.66 3.677 3.5 6 2.339 8.323 3.5zM20.323 6 18 4.839 15.677 6 18 7.161z`,"clip-rule":`evenodd`},null,-1)]])}var hJe,gJe,_Je,vJe=s((()=>{jC(),W(),hJe=AC({default:()=>_Je,render:()=>mJe}),gJe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},_Je={render:mJe}}));function yJe(e,t){return F(),I(`svg`,xJe,[...t[0]||=[R(`path`,{d:`M11.573 0a5 5 0 0 0-.359.007L10.85.04c-3.407.307-6.6 2.146-8.622 4.972a11.9 11.9 0 0 0-2.119 5.243c-.096.659-.108.854-.108 1.747s.012 1.089.108 1.748c.652 4.506 3.86 8.292 8.209 9.695.779.25 1.6.422 2.534.525.363.04 1.935.04 2.299 0 1.611-.178 2.977-.577 4.323-1.264.207-.106.247-.134.219-.158-.02-.013-.9-1.193-1.955-2.62l-1.919-2.592-2.404-3.558a339 339 0 0 0-2.422-3.556c-.009-.002-.018 1.579-.023 3.51-.007 3.38-.01 3.515-.052 3.595a.43.43 0 0 1-.206.214c-.075.037-.14.044-.495.044H7.81l-.108-.068a.44.44 0 0 1-.157-.171l-.05-.106.006-4.703.007-4.705.072-.092a.7.7 0 0 1 .174-.143c.096-.047.134-.051.54-.051.478 0 .558.018.682.154a467 467 0 0 1 2.895 4.361l4.735 7.17 1.9 2.879.096-.063a12.3 12.3 0 0 0 2.466-2.163 11.94 11.94 0 0 0 2.824-6.134c.096-.66.108-.854.108-1.748 0-.893-.012-1.088-.108-1.747-.652-4.506-3.859-8.292-8.208-9.695a12.6 12.6 0 0 0-2.499-.523A33 33 0 0 0 11.573 0m4.068 7.217c.347 0 .408.005.486.047a.47.47 0 0 1 .237.277c.018.06.023 1.365.018 4.304l-.006 4.218-.744-1.14-.746-1.14v-3.066c0-1.982.01-3.097.023-3.15a.48.48 0 0 1 .233-.296c.096-.05.13-.054.5-.054z`},null,-1)]])}var bJe,xJe,SJe,CJe=s((()=>{jC(),W(),bJe=AC({default:()=>SJe,render:()=>yJe}),xJe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},SJe={render:yJe}}));function wJe(e,t){return F(),I(`svg`,EJe,[...t[0]||=[R(`path`,{d:`M14.23 12.004a2.236 2.236 0 0 1-2.235 2.236 2.236 2.236 0 0 1-2.236-2.236 2.236 2.236 0 0 1 2.235-2.236 2.236 2.236 0 0 1 2.236 2.236m2.648-10.69c-1.346 0-3.107.96-4.888 2.622-1.78-1.653-3.542-2.602-4.887-2.602-.41 0-.783.093-1.106.278-1.375.793-1.683 3.264-.973 6.365C1.98 8.917 0 10.42 0 12.004c0 1.59 1.99 3.097 5.043 4.03-.704 3.113-.39 5.588.988 6.38.32.187.69.275 1.102.275 1.345 0 3.107-.96 4.888-2.624 1.78 1.654 3.542 2.603 4.887 2.603.41 0 .783-.09 1.106-.275 1.374-.792 1.683-3.263.973-6.365C22.02 15.096 24 13.59 24 12.004c0-1.59-1.99-3.097-5.043-4.032.704-3.11.39-5.587-.988-6.38a2.17 2.17 0 0 0-1.092-.278zm-.005 1.09v.006c.225 0 .406.044.558.127.666.382.955 1.835.73 3.704-.054.46-.142.945-.25 1.44a23.5 23.5 0 0 0-3.107-.534A24 24 0 0 0 12.769 4.7c1.592-1.48 3.087-2.292 4.105-2.295zm-9.77.02c1.012 0 2.514.808 4.11 2.28-.686.72-1.37 1.537-2.02 2.442a23 23 0 0 0-3.113.538 15 15 0 0 1-.254-1.42c-.23-1.868.054-3.32.714-3.707.19-.09.4-.127.563-.132zm4.882 3.05q.684.704 1.36 1.564c-.44-.02-.89-.034-1.345-.034q-.691-.001-1.36.034c.44-.572.895-1.096 1.345-1.565zM12 8.1c.74 0 1.477.034 2.202.093q.61.874 1.183 1.86.557.961 1.018 1.946c-.308.655-.646 1.31-1.013 1.95-.38.66-.773 1.288-1.18 1.87a25.6 25.6 0 0 1-4.412.005 27 27 0 0 1-1.183-1.86q-.557-.961-1.018-1.946a25 25 0 0 1 1.013-1.954c.38-.66.773-1.286 1.18-1.868A25 25 0 0 1 12 8.098zm-3.635.254c-.24.377-.48.763-.704 1.16q-.336.585-.635 1.174c-.265-.656-.49-1.31-.676-1.947.64-.15 1.315-.283 2.015-.386zm7.26 0q1.044.153 2.006.387c-.18.632-.405 1.282-.66 1.933a26 26 0 0 0-1.345-2.32zm3.063.675q.727.226 1.375.498c1.732.74 2.852 1.708 2.852 2.476-.005.768-1.125 1.74-2.857 2.475-.42.18-.88.342-1.355.493a24 24 0 0 0-1.1-2.98c.45-1.017.81-2.01 1.085-2.964zm-13.395.004c.278.96.645 1.957 1.1 2.98a23 23 0 0 0-1.086 2.964c-.484-.15-.944-.318-1.37-.5-1.732-.737-2.852-1.706-2.852-2.474s1.12-1.742 2.852-2.476c.42-.18.88-.342 1.356-.494m11.678 4.28c.265.657.49 1.312.676 1.948-.64.157-1.316.29-2.016.39a26 26 0 0 0 1.341-2.338zm-9.945.02c.2.392.41.783.64 1.175q.345.586.705 1.143a22 22 0 0 1-2.006-.386c.18-.63.406-1.282.66-1.933zM17.92 16.32c.112.493.2.968.254 1.423.23 1.868-.054 3.32-.714 3.708-.147.09-.338.128-.563.128-1.012 0-2.514-.807-4.11-2.28.686-.72 1.37-1.536 2.02-2.44 1.107-.118 2.154-.3 3.113-.54zm-11.83.01c.96.234 2.006.415 3.107.532.66.905 1.345 1.727 2.035 2.446-1.595 1.483-3.092 2.295-4.11 2.295a1.2 1.2 0 0 1-.553-.132c-.666-.38-.955-1.834-.73-3.703.054-.46.142-.944.25-1.438zm4.56.64q.661.032 1.345.034.691.001 1.36-.034c-.44.572-.895 1.095-1.345 1.565q-.684-.706-1.36-1.565`},null,-1)]])}var TJe,EJe,DJe,OJe=s((()=>{jC(),W(),TJe=AC({default:()=>DJe,render:()=>wJe}),EJe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},DJe={render:wJe}}));function kJe(e,t){return F(),I(`svg`,jJe,[...t[0]||=[R(`path`,{d:`M23.94 3a.5.5 0 0 0-.44-.25h-2.31l-8.55 13.91a.75.75 0 0 1-1.28 0L2.81 2.77H.5A.5.5 0 0 0 .06 3a.54.54 0 0 0 0 .51l11.5 19a.51.51 0 0 0 .86 0l11.5-19a.54.54 0 0 0 .02-.51`},null,-1),R(`path`,{d:`m12 14.84 7.43-12.07H16a.47.47 0 0 0-.43.25L12 9.26 8.43 3A.47.47 0 0 0 8 2.77H4.57Z`},null,-1)]])}var AJe,jJe,MJe,NJe=s((()=>{jC(),W(),AJe=AC({default:()=>MJe,render:()=>kJe}),jJe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},MJe={render:kJe}}));function PJe(e,t){return F(),I(`svg`,IJe,[...t[0]||=[R(`path`,{d:`m117.5 33.5.3-.2c-.6-1.1-1.5-2.1-2.4-2.6L67.1 2.9c-.8-.5-1.9-.7-3.1-.7s-2.3.3-3.1.7l-48 27.9c-1.7 1-2.9 3.5-2.9 5.4v55.7c0 1.1.2 2.3.9 3.4l-.2.1c.5.8 1.2 1.5 1.9 1.9l48.2 27.9c.8.5 1.9.7 3.1.7s2.3-.3 3.1-.7l48-27.9c1.7-1 2.9-3.5 2.9-5.4V36.1c.1-.8 0-1.7-.4-2.6M64 88.5c9.1 0 17.1-5 21.3-12.4l12.9 7.6c-6.8 11.8-19.6 19.8-34.2 19.8-21.8 0-39.5-17.7-39.5-39.5S42.2 24.5 64 24.5c14.7 0 27.5 8.1 34.3 20l-13 7.5C81.1 44.5 73.1 39.5 64 39.5c-13.5 0-24.5 11-24.5 24.5s11 24.5 24.5 24.5`},null,-1)]])}var FJe,IJe,LJe,RJe=s((()=>{jC(),W(),FJe=AC({default:()=>LJe,render:()=>PJe}),IJe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 128 128`},LJe={render:PJe}}));function zJe(e,t){return F(),I(`svg`,VJe,[...t[0]||=[R(`path`,{d:`M60.952.266C27.377.266.065 28.77.065 63.806s27.318 63.54 60.887 63.54c33.576 0 60.893-28.505 60.893-63.54S94.528.266 60.952.266m0 6.117c30.39 0 55.025 25.712 55.025 57.423 0 2.482-.167 4.924-.46 7.321-1.495 6.214-4.194 10.358-7.412 13.19-4.941 4.336-11.524 5.738-17.62 5.733a41 41 0 0 1-4.973-.289C97.506 77.4 99.336 57.866 89.864 43.315 80.39 28.763 62.315 23.338 46.882 30.416a24 24 0 0 0-1.68-1.114c-2.41-1.413-7.439-3.482-13.837-3.505-5.361-.022-10.615 1.568-15.133 4.58C26.554 15.317 43.21 6.386 60.952 6.394zM51.341 84.6c.894-4.07 3.343-10.431 5.548-15.655.623-1.481 1.23-2.872 1.777-4.104 3.451 12.822 5.635 20.449 9.546 25.65a18 18 0 0 0 1.913 2.114 28 28 0 0 1-9.173 1.56 28.2 28.2 0 0 1-10.023-1.86q-.098-1.227-.103-2.459a24.5 24.5 0 0 1 .515-5.24zm-7.444 3.77c-7.555-5.703-12.031-14.84-12.04-24.57.008-9.88 4.625-19.138 12.375-24.813 1.637.984 3.121 2.143 4.34 3.477 2.395 2.56 5.077 8.214 6.94 13.082.51 1.312.965 2.567 1.36 3.709C50.16 73.502 45.685 80.608 43.898 88.37zm21.802-18.226c-1.501-4.037-2.374-7.079-2.379-7.084l-.005-.012c-2.747-10.984-5.592-21.025-11.497-28.052a28 28 0 0 1 9.134-1.55c16.06.022 29.074 13.602 29.095 30.36-.007 9.673-4.432 18.764-11.914 24.474a15 15 0 0 1-2.184-.78c-1.137-.514-2.812-2.267-4.329-4.698-2.313-3.635-4.437-8.622-5.927-12.653zm-4.747 51.08c-30.39 0-55.025-25.707-55.025-57.424 0-2.086.114-4.144.32-6.173 4.508-16 15.338-21.92 25.595-22.02 2.08-.007 4.117.282 6.068.774-13.182 12.081-15.74 32.487-5.979 47.7 9.762 15.213 28.817 20.518 44.544 12.403 2.78 1.023 5.96 1.633 9.812 2.137 1.447.186 3.007.277 4.665.277a61.6 61.6 0 0 0 14.997-2.087c-10.29 15.308-27.088 24.417-45.007 24.407z`},null,-1)]])}var BJe,VJe,HJe,UJe=s((()=>{jC(),W(),BJe=AC({default:()=>HJe,render:()=>zJe}),VJe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 128 128`},HJe={render:zJe}}));function WJe(e,t){return F(),I(`svg`,KJe,[...t[0]||=[R(`path`,{d:`m117.5 33.5.3-.2c-.6-1.1-1.5-2.1-2.4-2.6L67.1 2.9c-.8-.5-1.9-.7-3.1-.7s-2.3.3-3.1.7l-48 27.9c-1.7 1-2.9 3.5-2.9 5.4v55.7c0 1.1.2 2.3.9 3.4l-.2.1c.5.8 1.2 1.5 1.9 1.9l48.2 27.9c.8.5 1.9.7 3.1.7s2.3-.3 3.1-.7l48-27.9c1.7-1 2.9-3.5 2.9-5.4V36.1c.1-.8 0-1.7-.4-2.6m-53.5 70c-21.8 0-39.5-17.7-39.5-39.5S42.2 24.5 64 24.5c14.7 0 27.5 8.1 34.3 20l-13 7.5C81.1 44.5 73.1 39.5 64 39.5c-13.5 0-24.5 11-24.5 24.5s11 24.5 24.5 24.5c9.1 0 17.1-5 21.3-12.4l12.9 7.6c-6.8 11.8-19.6 19.8-34.2 19.8M115 62h-3.2l-.9 4h4.1v5h-5l-1.2 6h-4.9l1.2-6h-3.8l-1.2 6h-4.8l1.2-6H94v-5h3.5l.9-4H94v-5h5.3l1.2-6h4.9l-1.2 6h3.8l1.2-6h4.8l-1.2 6h2.2zm-12.7 4h3.8l.9-4h-3.8z`},null,-1)]])}var GJe,KJe,qJe,JJe=s((()=>{jC(),W(),GJe=AC({default:()=>qJe,render:()=>WJe}),KJe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 128 128`},qJe={render:WJe}}));function YJe(e,t){return F(),I(`svg`,ZJe,[...t[0]||=[R(`path`,{d:`M1.5 0h21l-1.91 21.563L11.977 24l-8.565-2.438zm17.09 4.413L5.41 4.41l.213 2.622 10.125.002-.255 2.716h-6.64l.24 2.573h6.182l-.366 3.523-2.91.804-2.956-.81-.188-2.11h-2.61l.29 3.855L12 19.288l5.373-1.53z`},null,-1)]])}var XJe,ZJe,QJe,$Je=s((()=>{jC(),W(),XJe=AC({default:()=>QJe,render:()=>YJe}),ZJe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},QJe={render:YJe}}));function eYe(e,t){return F(),I(`svg`,nYe,[...t[0]||=[R(`path`,{d:`m7.91 9.32.09.09V35.3l-5.09-5.09a6.22 6.22 0 0 1-1.27-6.92zM35.3 8H9.41l-.09-.09 13.97-6.27a6.22 6.22 0 0 1 6.92 1.27zm2.29 31H11.71l-.54-.54A4 4 0 0 1 10 35.63V11.41zm-23.88 2H39v6c0 .55-.45 1-1 1H21.1c-.27 0-.52-.11-.71-.29l-4.7-4.7.02-.02zM48 21.1V38c0 .55-.45 1-1 1h-6.58L11.41 10h24.22c1.07 0 2.07.42 2.83 1.17l4.53 4.54.02-.02 4.7 4.7c.18.19.29.44.29.71`},null,-1)]])}var tYe,nYe,rYe,iYe=s((()=>{jC(),W(),tYe=AC({default:()=>rYe,render:()=>eYe}),nYe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 50 50`},rYe={render:eYe}}));function aYe(e,t){return F(),I(`svg`,sYe,[...t[0]||=[R(`path`,{d:`M0 64.5 60.7 3.8v30.4L30.4 64.5l30.4 30.4v30.4zm39.1 0 21.7-21.7v43.4zm88.9 0L65.1 3.8v30.4l30.4 30.4-30.4 30.3v30.4z`},null,-1)]])}var oYe,sYe,cYe,lYe=s((()=>{jC(),W(),oYe=AC({default:()=>cYe,render:()=>aYe}),sYe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 128 128`},cYe={render:aYe}}));function uYe(e,t){return F(),I(`svg`,fYe,[...t[0]||=[R(`path`,{d:`M108.2 64.8c-.1-.1-.2-.2-.4-.2l-.1-.1c-.1-.1-.2-.1-.2-.2l-.1-.1c-.1 0-.2-.1-.2-.1l-.2-.1c-.1 0-.2-.1-.2-.1l-.2-.1c-.1 0-.2-.1-.2-.1-.1 0-.1 0-.2-.1l-.3-.1c-.1 0-.1 0-.2-.1l-.3-.1h-.1l-.4-.1h-.2c-.1 0-.2 0-.3-.1h-2.3c-.6-13.3.6-26.8-2.8-39.6 12.9-4.6 2.8-22.3-8.4-14.4-7.4-6.4-17.6-7.8-28.3-7.8-10.5.7-20.4 2.9-27.4 8.4-2.8-1.4-5.5-1.8-7.9-1.1v.1c-.1 0-.3.1-.4.2-.1 0-.3.1-.4.2h-.1c-.1 0-.2.1-.4.2h-.1l-.3.2h-.1l-.3.2h-.1l-.3.2s-.1 0-.1.1l-.3.2s-.1 0-.1.1l-.3.2s-.1 0-.1.1l-.3.2-.1.1c-.1.1-.2.1-.2.2l-.1.1-.2.2-.1.1c-.1.1-.1.2-.2.2l-.1.1c-.1.1-.1.2-.2.2l-.1.1c-.1.1-.1.2-.2.2l-.1.1c-.1.1-.1.2-.2.2l-.1.1c-.1.1-.1.2-.2.2l-.1.1-.1.3s0 .1-.1.1l-.1.3s0 .1-.1.1l-.1.3s0 .1-.1.1l-.1.3s0 .1-.1.1c.4.3.4.4.4.4v.1l-.1.3v.1c0 .1 0 .2-.1.3v3.1c0 .1 0 .2.1.3v.1l.1.3v.1l.1.3s0 .1.1.1l.1.3s0 .1.1.1l.1.3s0 .1.1.1l.2.3s0 .1.1.1l.2.3s0 .1.1.1l.2.3.1.1.3.3.3.3h.1c1 .9 2 1.6 4 2.2v-.2C23 37.3 26.5 50 26.7 63c-.6 0-.7.4-1.7.5h-.5c-.1 0-.3 0-.5.1-.1 0-.3 0-.4.1l-.4.1h-.1l-.4.1h-.1l-.3.1h-.1l-.3.1s-.1 0-.1.1l-.3.1-.2.1c-.1 0-.2.1-.2.1l-.2.1-.2.1c-.1 0-.2.1-.2.1l-.2.1-.4.3c-.1.1-.2.2-.3.2l-.4.4-.1.1c-.1.2-.3.4-.4.5l-.2.3-.3.6-.1.3v.3c0 .5.2.9.9 1.2.2 3.7 3.9 2 5.6.8l.1-.1c.2-.2.5-.3.6-.3h.1l.2-.1c.1 0 .1 0 .2-.1.2-.1.4-.1.5-.2.1 0 .1-.1.1-.2l.1-.1c.1-.2.2-.6.2-1.2l.1-1.3v1.8c-.5 13.1-4 30.7 3.3 42.5 1.3 2.1 2.9 3.9 4.7 5.4h-.5c-.2.2-.5.4-.8.6l-.9.6-.3.2-.6.4-.9.7-1.1 1c-.2.2-.3.4-.4.5l-.4.6-.2.3c-.1.2-.2.4-.2.6l-.1.3q-.3 1.2.6 2.7l.4.4h.2c.1 0 .2 0 .4.1.2.4 1.2 2.5 3.9.9 2.8-1.5 4.7-4.6 8.1-5.1l-.5-.6c5.9 2.8 12.8 4 19 4.2 8.7.3 18.6-.9 26.5-5.2 2.2.7 3.9 3.9 5.8 5.4l.1.1.1.1.1.1.1.1s.1 0 .1.1c0 0 .1 0 .1.1 0 0 .1 0 .1.1h2.1s.1 0 .1-.1h.1s.1 0 .1-.1h.1s.1 0 .1-.1c0 0 .1 0 .1-.1l.1-.1s.1 0 .1-.1l.1-.1h.1l.2-.2.2-.1h.1l.1-.1h.1l.1-.1.1-.1.1-.1.1-.1.1-.1.1-.1.1-.1v-.1s0-.1.1-.1v-.1s0-.1.1-.1v-.1s0-.1.1-.1v-1.4s-.3 0-.3-.1l-.3-.1v-.1l.3-.1s.2 0 .2-.1l.1-.1v-2.1s0-.1-.1-.1v-.1s0-.1-.1-.1v-.1s0-.1-.1-.1c0 0 0-.1-.1-.1 0 0 0-.1-.1-.1 0 0 0-.1-.1-.1 0 0 0-.1-.1-.1 0 0 0-.1-.1-.1 0 0 0-.1-.1-.1 0 0 0-.1-.1-.1 0 0 0-.1-.1-.1 0 0 0-.1-.1-.1 0 0 0-.1-.1-.1 0 0 0-.1-.1-.1 0 0 0-.1-.1-.1 0 0 0-.1-.1-.1l-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1v-.1l-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1-.1c2-1.9 3.8-4.2 5.1-6.9 5.9-11.8 4.9-26.2 4.1-39.2h.1c.1 0 .2.1.2.1h.3s.1 0 .1.1h.1s.1 0 .1.1l.2.1c1.7 1.2 5.4 2.9 5.6-.8 1.6.6-.3-1.8-1.3-2.5M36 23C32.8 7 58.4 4 59.3 19.6c.8 13-20 16.3-23.3 3.4m36.1 15c-1.3 1.4-2.7 1.2-4.1.7 0 1.9.4 3.9.1 5.9-.5.9-1.5 1-2.3 1.4-1.2-.2-2.1-.9-2.6-2l-.2-.1c-3.9 5.2-6.3-1.1-5.2-5-1.2.1-2.2-.2-3-1.5-1.4-2.6.7-5.8 3.4-6.3.7 3 8.7 2.6 10.1-.2 3.1 1.5 6.5 4.3 3.8 7.1m-7-17.5c-.9-13.8 20.3-17.5 23.4-4 3.5 15-20.8 18.9-23.4 4M41.7 17c-1.9 0-3.5 1.7-3.5 3.8s1.6 3.8 3.5 3.8 3.5-1.7 3.5-3.8-1.5-3.8-3.5-3.8m1.6 5.7c-.5 0-.8-.4-.8-1 0-.5.4-1 .8-1 .5 0 .8.4.8 1 0 .5-.3 1-.8 1m27.8-6.6c-1.9 0-3.4 1.7-3.4 3.8s1.5 3.8 3.4 3.8 3.4-1.7 3.4-3.8-1.5-3.8-3.4-3.8m1.6 5.6c-.4 0-.8-.4-.8-1 0-.5.4-1 .8-1s.8.4.8 1-.4 1-.8 1`},null,-1)]])}var dYe,fYe,pYe,mYe=s((()=>{jC(),W(),dYe=AC({default:()=>pYe,render:()=>uYe}),fYe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 128 128`},pYe={render:uYe}}));function hYe(e,t){return F(),I(`svg`,_Ye,[...t[0]||=[R(`path`,{d:`M1.5 0h21l-1.91 21.563L11.977 24l-8.564-2.438zm7.031 9.75-.232-2.718 10.059.003.23-2.622L5.412 4.41l.698 8.01h9.126l-.326 3.426-2.91.804-2.955-.81-.188-2.11H6.248l.33 4.171L12 19.351l5.379-1.443.744-8.157z`},null,-1)]])}var gYe,_Ye,vYe,yYe=s((()=>{jC(),W(),gYe=AC({default:()=>vYe,render:()=>hYe}),_Ye={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},vYe={render:hYe}}));function bYe(e,t){return F(),I(`svg`,SYe,[...t[0]||=[R(`path`,{d:`M111.7 29.7 128 64l-16.3 34.3H16.3L0 64l16.3-34.3zm-5.5 5.7H20L6.3 64l13.6 28.6h86.3L119.8 64zm-76.3 19v8h9.2v-8.1h4.8v20.4h-4.7v-8.4H30v8.4h-4.8V54.4zm34.3 0v3.8h-6.5v16.5H53V58.2h-6.5v-3.8zm18.3 0v3.8H76v16.5h-4.7V58.2h-6.5v-3.8zm16.1.9c1.2.5 2.3 1.4 3.1 2.6.7 1.2 1.1 2.5 1 3.9.1 1.4-.3 2.7-1 3.9-.7 1.1-1.8 2-3.1 2.6-1.5.6-3.1.9-4.7.9h-4.1v5.6H85V54.4h8.9c1.6 0 3.2.3 4.7.9m-5.1 2.9h-3.8v7.1h3.8q2.1 0 3.3-.9c.8-.6 1.2-1.6 1.1-2.6 0-1.1-.3-2.1-1.1-2.6-.8-.7-1.9-1-3.3-1`},null,-1)]])}var xYe,SYe,CYe,wYe=s((()=>{jC(),W(),xYe=AC({default:()=>CYe,render:()=>bYe}),SYe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 128 128`},CYe={render:bYe}}));function TYe(e,t){return F(),I(`svg`,DYe,[...t[0]||=[R(`path`,{d:`M11.26 15.27c3.37-.15 7.15-1.09 7-2.21a26 26 0 0 1-4.76.59c-3.62.16-6.58-.24-6.61-.9 0-.2.24-.4.69-.58-2.39-.64-3.67.53-3.69 1.22-.1 1.45 3.22 2.06 7.37 1.88m5.91 1.64a23 23 0 0 1-4.07.5c-3.09.14-5.61-.21-5.64-.77 0-.17.21-.34.59-.49-2-.55-3.13.45-3.15 1-.05 1.24 2.78 1.77 6.33 1.61 2.87-.1 6.25-1 5.94-1.85M3.61 20.8a.93.93 0 0 1 .29-.65c-2.09.1-2.54 1.13-2.51 1.76.07 1.39 4.67 2.31 10 2.05 4.44-.22 9.16-1 9.16-2.34a26.3 26.3 0 0 1-7.2 1.23c-5.35.26-9.67-.66-9.74-2.05`},null,-1),R(`path`,{d:`M22.4 12.65c-.55-1.48-2.67-2.34-4.74-1.57a2.47 2.47 0 0 0-1 .81c1.94-.56 3.83 0 4.34 1.41.45 1.21-.3 2.64-1.72 3.54a1.37 1.37 0 0 0 .92-.13c2.25-1.05 2.8-2.58 2.2-4.06m-9.88-1.38s-3.1-2.19-1.92-4.35S14.37 2.43 13.38 0c0 0 .12 1-3.12 3.91s-2.14 6.33 2.26 7.36`},null,-1),R(`path`,{d:`M15.17 4.83s-4.24 1.51-2.83 3.53c1 1.43 2.13 2 1.42 4 0 0 2.83-1.51.71-3.53s.7-4 .7-4M8.69 19.26c-1.6-.43-2.46.35-2.47.81 0 1 2.18 1.39 5 1.27 2.26-.11 4.73-.95 4.67-1.49a16.6 16.6 0 0 1-3.2.4c-2.43.11-4.41-.16-4.43-.61-.04-.13.13-.26.43-.38`},null,-1)]])}var EYe,DYe,OYe,kYe=s((()=>{jC(),W(),EYe=AC({default:()=>OYe,render:()=>TYe}),DYe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},OYe={render:TYe}}));function AYe(e,t){return F(),I(`svg`,MYe,[...t[0]||=[R(`path`,{d:`M0 0h24v24H0zm22.034 18.276c-.175-1.095-.888-2.015-3.003-2.873-.736-.345-1.554-.585-1.797-1.14-.091-.33-.105-.51-.046-.705.15-.646.915-.84 1.515-.66.39.12.75.42.976.9 1.034-.676 1.034-.676 1.755-1.125-.27-.42-.404-.601-.586-.78-.63-.705-1.469-1.065-2.834-1.034l-.705.089c-.676.165-1.32.525-1.71 1.005-1.14 1.291-.811 3.541.569 4.471 1.365 1.02 3.361 1.244 3.616 2.205.24 1.17-.87 1.545-1.966 1.41-.811-.18-1.26-.586-1.755-1.336l-1.83 1.051c.21.48.45.689.81 1.109 1.74 1.756 6.09 1.666 6.871-1.004.029-.09.24-.705.074-1.65zm-8.983-7.245h-2.248c0 1.938-.009 3.864-.009 5.805 0 1.232.063 2.363-.138 2.711-.33.689-1.18.601-1.566.48-.396-.196-.597-.466-.83-.855-.063-.105-.11-.196-.127-.196l-1.825 1.125c.305.63.75 1.172 1.324 1.517.855.51 2.004.675 3.207.405.783-.226 1.458-.691 1.811-1.411.51-.93.402-2.07.397-3.346.012-2.054 0-4.109 0-6.179z`},null,-1)]])}var jYe,MYe,NYe,PYe=s((()=>{jC(),W(),jYe=AC({default:()=>NYe,render:()=>AYe}),MYe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},NYe={render:AYe}}));function FYe(e,t){return F(),I(`svg`,LYe,[...t[0]||=[R(`path`,{d:`M4.56 18.71c-1.41-4-.65-8.94 1.77-11.48A5.47 5.47 0 0 1 12 5.71h.15a.8.8 0 0 1 .22.12c4 1.65 4.28 8.57 1.28 11.41a4.15 4.15 0 0 0 3.08-1.35c2.12-2.23 2.76-6.62 1.49-10.22A7.75 7.75 0 0 0 12.81.54H12a11.5 11.5 0 0 0-5.42 21.6 10 10 0 0 1-2.02-3.43`},null,-1),R(`path`,{d:`M23.5 12a11.49 11.49 0 0 0-6.09-10.14 9.9 9.9 0 0 1 2 3.43c1.41 4 .65 9-1.77 11.5a5.42 5.42 0 0 1-4 1.75A6.5 6.5 0 0 1 12 18.3h-.15a.8.8 0 0 1-.22-.12c-4-1.65-4.29-8.57-1.29-11.41a4.14 4.14 0 0 0-3.11 1.32c-2.12 2.22-2.76 6.61-1.49 10.2a7.77 7.77 0 0 0 5.45 5.17H12A11.5 11.5 0 0 0 23.5 12`},null,-1)]])}var IYe,LYe,RYe,zYe=s((()=>{jC(),W(),IYe=AC({default:()=>RYe,render:()=>FYe}),LYe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},RYe={render:FYe}}));function BYe(e,t){return F(),I(`svg`,HYe,[...t[0]||=[R(`path`,{d:`M0 0h61.4L0 60.4zm0 128L128 0H64.6L0 63.7zm128 0L64.6 66.6 3.3 128z`},null,-1)]])}var VYe,HYe,UYe,WYe=s((()=>{jC(),W(),VYe=AC({default:()=>UYe,render:()=>BYe}),HYe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 128 128`},UYe={render:BYe}}));function GYe(e,t){return F(),I(`svg`,qYe,[...t[0]||=[R(`path`,{d:`M21.75 5.52 13 .28a2 2 0 0 0-2 0L2.25 5.52a2 2 0 0 0-1 1.69v9.58a2 2 0 0 0 1 1.69l2.62 1.57a3.12 3.12 0 0 0 4.73-2.68V8.12a1 1 0 0 0-2 0v9.25a1.13 1.13 0 0 1-.57 1 1.14 1.14 0 0 1-1.13 0l-2.61-1.58V7.24L12 2l8.73 5.21v9.55L12 22l-1.7-1a1 1 0 1 0-1 1.71l1.72 1a2 2 0 0 0 2 0l8.74-5.24a2 2 0 0 0 1-1.69V7.21a2 2 0 0 0-1.01-1.69`},null,-1),R(`path`,{d:`M15.51 14.76a9.3 9.3 0 0 1-2.24 0 .85.85 0 0 1-.75-.85 1 1 0 0 0-2 0A2.87 2.87 0 0 0 13 16.75a12 12 0 0 0 1.36.08 12 12 0 0 0 1.37-.08 2.87 2.87 0 0 0 2.5-2.84A2.68 2.68 0 0 0 16 11.26l-2.91-.49a.69.69 0 0 1-.58-.68.85.85 0 0 1 .75-.85 9.3 9.3 0 0 1 2.24 0 .85.85 0 0 1 .75.85 1 1 0 0 0 2 0 2.87 2.87 0 0 0-2.5-2.84 12.5 12.5 0 0 0-2.73 0 2.87 2.87 0 0 0-2.51 2.84 2.68 2.68 0 0 0 2.25 2.65l2.91.49a.68.68 0 0 1 .58.68.85.85 0 0 1-.74.85`},null,-1)]])}var KYe,qYe,JYe,YYe=s((()=>{jC(),W(),KYe=AC({default:()=>JYe,render:()=>GYe}),qYe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},JYe={render:GYe}}));function XYe(e,t){return F(),I(`svg`,QYe,[...t[0]||=[R(`path`,{d:`M63.877 125.392c-32.671 0-60.37-27.594-60.627-60.469a59.94 59.94 0 0 1 17.506-42.759 60.94 60.94 0 0 1 43.279-18.36 60.08 60.08 0 0 1 42.647 17.71 60.15 60.15 0 0 1 18.157 42.522c.151 33.604-26.864 61.021-60.469 61.363h-.493zm.19-118.406a57.77 57.77 0 0 0-41.01 17.427 56.78 56.78 0 0 0-16.63 40.484c.236 31.159 26.495 57.286 57.43 57.286h.414c31.863-.29 57.504-26.266 57.385-58.128a56.97 56.97 0 0 0-17.217-40.273A56.7 56.7 0 0 0 64.068 6.986z`},null,-1),R(`path`,{d:`M16.89 82.383V46.865h8.64v3.183h-4.583v29.218h4.584v3.183zm29.323-18.111c0 6.478-3.933 10.167-9.26 10.167s-8.877-4.156-8.877-9.831c0-5.939 3.722-10.121 9.167-10.121s8.97 4.36 8.97 9.785m-14.415.29c0 3.932 1.973 7.05 5.36 7.05s5.333-3.183 5.333-7.195c0-3.643-1.796-7.083-5.334-7.083s-5.392 3.328-5.392 7.307zm17.407-9.404c1.69-.29 3.407-.434 5.123-.428a9.17 9.17 0 0 1 5.537 1.223 4.06 4.06 0 0 1 2.006 3.61 4.48 4.48 0 0 1-3.183 4.183c2.269.46 3.9 2.46 3.9 4.775a5.02 5.02 0 0 1-1.861 3.978c-1.368 1.21-3.643 1.796-7.162 1.796a34 34 0 0 1-4.327-.257zm3.499 7.622h1.795c2.433 0 3.801-1.145 3.801-2.782s-1.368-2.644-3.61-2.644a9.8 9.8 0 0 0-2.006.145zm0 8.878c.618.065 1.243.092 1.86.078 2.263 0 4.262-.861 4.262-3.182s-1.94-3.183-4.373-3.183h-1.75zM69.54 54.901h3.517v12.554c0 5.334-2.577 7.116-6.365 7.116a9.3 9.3 0 0 1-2.973-.507l.428-2.834c.703.224 1.44.335 2.183.349 2.006 0 3.183-.921 3.183-4.262l.026-12.416zm13.527 10.456v2.434h-7.32v-2.434zm17.091 8.273a12.3 12.3 0 0 1-4.978.862c-6.129 0-9.851-3.834-9.851-9.707-.283-5.353 3.827-9.923 9.18-10.206.375-.02.757-.02 1.131.006a11.1 11.1 0 0 1 4.775.862l-.783 2.801a9.5 9.5 0 0 0-3.788-.75c-3.932 0-6.76 2.467-6.76 7.116 0 4.235 2.499 6.971 6.734 6.971a9.8 9.8 0 0 0 3.834-.717zM111.2 46.766v35.61h-8.641v-3.182h4.583V49.949h-4.583v-3.183h8.64z`},null,-1)]])}var ZYe,QYe,$Ye,eXe=s((()=>{jC(),W(),ZYe=AC({default:()=>$Ye,render:()=>XYe}),QYe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 128 128`},$Ye={render:XYe}}));function tXe(e,t){return F(),I(`svg`,rXe,[...t[0]||=[R(`path`,{d:`M65.004 115.355c-.461-.894-1.004-2.796-1.356-3.601-.378-.711-1.46-2.692-1.984-3.332-1.164-1.332-1.437-1.438-1.809-3.23-.628-3.067-2.148-8.462-4.042-12.227-1.004-2-2.626-3.606-4.067-5.07-1.246-1.247-4.121-3.31-4.668-3.227-4.766.894-6.226 5.586-8.457 9.27-1.27 2.062-2.516 3.769-3.52 5.937-.898 1.98-.812 4.23-2.331 5.938a15.4 15.4 0 0 0-3.333 5.855c-.195.453-.546 4.957-1.003 6.016l7.02-.438c6.585.461 4.687 2.961 14.858 2.438l16.098-.54a25 25 0 0 0-1.433-3.792zM111.793 8.254H16.207C7.312 8.23.086 15.457.086 24.352v35.105c2.352-.812 5.578-5.75 6.668-6.934 1.789-2.062 2.16-4.77 3.059-6.378 2.062-3.793 2.433-6.477 7.101-6.477 2.164 0 3.063.516 4.5 2.516.996 1.332 2.79 3.957 3.602 5.668 1.004 1.98 2.523 4.582 3.254 5.125.515.351.972.722 1.433.894.707.27 1.356-.27 1.902-.629.622-.539.895-1.52 1.52-2.953.895-2.086 1.813-4.418 2.332-5.312.914-1.461 1.273-3.254 2.25-4.067 1.461-1.246 3.441-1.355 3.957-1.437 2.98-.625 4.336 1.437 5.777 2.707.973.894 2.243 2.605 3.246 4.851.708 1.793 1.606 3.52 2.067 4.5.351.98 1.266 2.606 1.789 4.582.543 1.711 1.809 3.067 2.352 3.961 0 0 .812 2.164 5.476 4.145a35 35 0 0 0 4.336 1.52c2.066.734 4.047.644 6.563.374 1.789 0 2.793-2.625 3.601-4.683.438-1.254.98-4.774 1.25-5.758.27-.996-.437-1.707.192-2.625.722-.977 1.164-1.082 1.519-2.332.914-2.793 5.957-2.875 8.832-2.875 2.414 0 2.063 2.332 6.125 1.52 2.336-.434 4.586.273 7.023.995 2.063.543 4.043 1.168 5.204 2.524.73.898 2.629 5.312.73 5.476.164.188.36.645.625.817-.46 1.707-2.25.46-3.332.27-1.355-.27-2.332 0-3.684.624-2.335.996-5.668.918-7.726 2.625-1.715 1.438-1.715 4.582-2.543 6.371 0 0-2.254 5.696-6.996 9.192-1.278.914-3.715 3.058-8.918 3.871-2.356.355-4.586.355-7.024.27-1.164-.079-2.332-.079-3.52-.079-.706 0-3.062-.109-2.96.164l-.27.645c.024.29.063.602.164.895.102.515.102.976.192 1.437 0 .98-.086 2.063 0 3.066.082 2.063.894 3.957 1.004 6.102.078 2.355 1.246 4.875 2.414 6.77.46.707 1.086.789 1.355 1.71.352.98 0 2.141.188 3.227.625 4.227 1.875 8.73 3.773 12.61v.078c2.332-.352 4.77-1.247 7.836-1.684 5.664-.832 13.5-.461 18.54-.914 12.796-1.168 19.706 5.226 31.148 2.601V24.336c-.063-8.895-7.293-16.102-16.207-16.102zM64.086 83.855q0-.28 0 0m-34.457 14.75c.894-1.98 1.433-4.125 2.144-6.101.73-1.899 1.813-4.61 3.684-5.582-.246-.274-3.957-.375-4.934-.461-1.082-.086-2.171-.273-3.25-.438a135 135 0 0 1-6.125-1.265c-1.168-.274-5.21-1.715-6.02-2.067-2.085-.894-3.421-3.52-4.96-3.246-.977.188-1.98.54-2.605 1.54-.543.812-.731 2.242-1.083 3.226-.437 1.086-1.168 2.164-1.707 3.25-1.277 1.875-3.332 3.582-4.23 5.484-.191.457-.27.895-.457 1.356v21.683c1.082.188 2.16.371 3.328.73 8.996 2.438 11.164 2.606 19.98 1.63l.813-.11c.625-1.437 1.188-6.207 1.629-7.644.352-1.164.812-2.063.996-3.14.164-1.09 0-2.173-.102-3.15-.171-2.628 1.895-3.519 2.899-5.69zm0 0`},null,-1)]])}var nXe,rXe,iXe,aXe=s((()=>{jC(),W(),nXe=AC({default:()=>iXe,render:()=>tXe}),rXe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 128 128`},iXe={render:tXe}}));function oXe(e,t){return F(),I(`svg`,cXe,[...t[0]||=[R(`path`,{d:`M7.01 10.207h-.944l-.515 2.648h.838q.834 0 1.242-.314.408-.315.55-1.049.137-.705-.124-.995-.262-.29-1.047-.29M12 5.688C5.373 5.688 0 8.514 0 12s5.373 6.313 12 6.313S24 15.486 24 12s-5.373-6.312-12-6.312m-3.26 7.451c-.261.25-.575.438-.917.551q-.505.163-1.285.164H5.357l-.327 1.681H3.652l1.23-6.326h2.65q1.195 0 1.744.628.549.627.33 1.752a2.8 2.8 0 0 1-.305.847q-.215.383-.561.703m4.024.715.543-2.799q.094-.478-.068-.651-.16-.174-.687-.174H11.46l-.704 3.625H9.388l1.23-6.327h1.367l-.327 1.682h1.218q1.15 0 1.586.401c.436.401.378.7.263 1.299l-.572 2.944zm7.597-2.265a2.8 2.8 0 0 1-.305.847q-.214.383-.561.703a2.44 2.44 0 0 1-.917.551q-.504.163-1.286.164h-1.18l-.327 1.682h-1.378l1.23-6.326h2.649q1.195 0 1.744.628.55.626.331 1.751m-2.595-1.382h-.943l-.516 2.648h.838q.835 0 1.242-.314.407-.315.551-1.049.137-.705-.125-.995c-.262-.29-.524-.29-1.047-.29`},null,-1)]])}var sXe,cXe,lXe,uXe=s((()=>{jC(),W(),sXe=AC({default:()=>lXe,render:()=>oXe}),cXe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},lXe={render:oXe}}));function dXe(e,t){return F(),I(`svg`,pXe,[...t[0]||=[R(`path`,{"fill-rule":`evenodd`,d:`M73.7 58.9c-1.5-1.8-3.2-3.9-5-5.9C58.5 41.7 48.4 30.3 38 19.2c-4.7-5.1-6.2-10-.6-15.1C43-.9 48.5-.4 53.7 5.3 68.1 21.2 82.4 37.2 97 52.9c5.5 5.9 4.2 9.9-1.8 14.2-23 16.7-46 33.5-68.9 50.4-5.1 3.8-10.1 4.8-14.2-.9-4.6-6.2-.3-9.9 4.4-13.3 17-12.4 34-24.8 50.9-37.4 2.5-1.7 5.9-2.8 6.3-7m7.3 59.8c-6.2 0-12.4.2-18.6-.1-4.9-.2-7.9-3-7.8-8.2.1-4.9 2.5-8.6 7.5-8.7 13.5-.4 27.1-.3 40.7 0 4.3.1 7.5 2.9 7.5 7.4 0 5.1-2.7 9.1-8.2 9.5-7.2.4-14.2.1-21.1.1`,"clip-rule":`evenodd`},null,-1)]])}var fXe,pXe,mXe,hXe=s((()=>{jC(),W(),fXe=AC({default:()=>mXe,render:()=>dXe}),pXe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 121 121`},mXe={render:dXe}}));function gXe(e,t){return F(),I(`svg`,vXe,[...t[0]||=[R(`path`,{d:`m14.25.18.9.2.73.26.59.3.45.32.34.34.25.34.16.33.1.3.04.26.02.2-.01.13V8.5l-.05.63-.13.55-.21.46-.26.38-.3.31-.33.25-.35.19-.35.14-.33.1-.3.07-.26.04-.21.02H8.77l-.69.05-.59.14-.5.22-.41.27-.33.32-.27.35-.2.36-.15.37-.1.35-.07.32-.04.27-.02.21v3.06H3.17l-.21-.03-.28-.07-.32-.12-.35-.18-.36-.26-.36-.36-.35-.46-.32-.59-.28-.73-.21-.88-.14-1.05-.05-1.23.06-1.22.16-1.04.24-.87.32-.71.36-.57.4-.44.42-.33.42-.24.4-.16.36-.1.32-.05.24-.01h.16l.06.01h8.16v-.83H6.18l-.01-2.75-.02-.37.05-.34.11-.31.17-.28.25-.26.31-.23.38-.2.44-.18.51-.15.58-.12.64-.1.71-.06.77-.04.84-.02 1.27.05zm-6.3 1.98-.23.33-.08.41.08.41.23.34.33.22.41.09.41-.09.33-.22.23-.34.08-.41-.08-.41-.23-.33-.33-.22-.41-.09-.41.09zm13.09 3.95.28.06.32.12.35.18.36.27.36.35.35.47.32.59.28.73.21.88.14 1.04.05 1.23-.06 1.23-.16 1.04-.24.86-.32.71-.36.57-.4.45-.42.33-.42.24-.4.16-.36.09-.32.05-.24.02-.16-.01h-8.22v.82h5.84l.01 2.76.02.36-.05.34-.11.31-.17.29-.25.25-.31.24-.38.2-.44.17-.51.15-.58.13-.64.09-.71.07-.77.04-.84.01-1.27-.04-1.07-.14-.9-.2-.73-.25-.59-.3-.45-.33-.34-.34-.25-.34-.16-.33-.1-.3-.04-.25-.02-.2.01-.13v-5.34l.05-.64.13-.54.21-.46.26-.38.3-.32.33-.24.35-.2.35-.14.33-.1.3-.06.26-.04.21-.02.13-.01h5.84l.69-.05.59-.14.5-.21.41-.28.33-.32.27-.35.2-.36.15-.36.1-.35.07-.32.04-.28.02-.21V6.07h2.09l.14.01zm-6.47 14.25-.23.33-.08.41.08.41.23.33.33.23.41.08.41-.08.33-.23.23-.33.08-.41-.08-.41-.23-.33-.33-.23-.41-.08-.41.08z`},null,-1)]])}var _Xe,vXe,yXe,bXe=s((()=>{jC(),W(),_Xe=AC({default:()=>yXe,render:()=>gXe}),vXe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},yXe={render:gXe}}));function xXe(e,t){return F(),I(`svg`,CXe,[...t[0]||=[R(`path`,{d:`M64 14.648c-35.346 0-64 19.19-64 42.863C0 78.275 22.046 95.589 51.316 99.53V86.699c-15.55-4.89-26.166-14.693-26.166-25.991 0-16.183 21.779-29.303 48.646-29.303 26.866 0 46.693 8.975 46.693 29.303 0 10.486-5.273 17.95-14.066 22.72 1.204.908 2.22 2.072 2.904 3.419l.388.655C121.025 79.772 128 69.189 128 57.51c0-23.672-28.654-42.863-64-42.863zm20.1 74.88c-2.612.257-5.322.41-8.114.462l.002 9.63a88 88 0 0 0 12.474-2.492l-.501-.941c-.68-1.268-1.347-2.543-2.033-3.807a41 41 0 0 0-1.828-2.851z`},null,-1),R(`path`,{"fill-rule":`evenodd`,d:`M97.469 81.036s3.874 1.169 6.124 2.307c.78.396 2.132 1.184 3.106 2.22a8.4 8.4 0 0 1 1.42 2.04l15.266 25.74-24.674.01-11.537-21.666s-2.363-4.06-3.817-5.237c-1.213-.982-1.73-1.331-2.929-1.331h-5.862l.004 28.219-21.834.009V41.263h43.845s19.97.36 19.97 19.359S97.47 81.035 97.47 81.035zm-9.497-24.137-13.218-.009-.006 12.257 13.224-.004s6.124-.019 6.124-6.235c0-6.34-6.124-6.01-6.124-6.01z`},null,-1)]])}var SXe,CXe,wXe,TXe=s((()=>{jC(),W(),SXe=AC({default:()=>wXe,render:()=>xXe}),CXe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 128 128`},wXe={render:xXe}}));function EXe(e,t){return F(),I(`svg`,OXe,[...t[0]||=[R(`path`,{d:`M20.156.083c3.033.525 3.893 2.598 3.829 4.77L24 4.822 22.635 22.71 4.89 23.926h.016C3.433 23.864.15 23.729 0 19.139l1.645-3 2.819 6.586.503 1.172 2.805-9.144-.03.007.016-.03 9.255 2.956-1.396-5.431-.99-3.9 8.82-.569-.615-.51L16.5 2.114 20.159.073zM5.13 5.073c3.561-3.533 8.157-5.621 9.922-3.84 1.762 1.777-.105 6.105-3.673 9.636-3.563 3.532-8.103 5.734-9.864 3.957-1.766-1.777.045-6.217 3.612-9.75z`},null,-1)]])}var DXe,OXe,kXe,AXe=s((()=>{jC(),W(),DXe=AC({default:()=>kXe,render:()=>EXe}),OXe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},kXe={render:EXe}}));function jXe(e,t){return F(),I(`svg`,NXe,[...t[0]||=[R(`path`,{fill:`currentColor`,d:`m21.863 11.755-.839-.52-.024-.244.722-.673a.288.288 0 0 0-.096-.482l-.923-.345-.072-.239.575-.799a.288.288 0 0 0-.187-.455l-.973-.158-.117-.218.409-.897a.286.286 0 0 0-.273-.409l-.987.034-.157-.188.228-.962a.287.287 0 0 0-.348-.348l-.96.227-.19-.157.034-.986a.287.287 0 0 0-.409-.273l-.897.409-.218-.118-.158-.972a.288.288 0 0 0-.454-.189l-.8.575-.238-.071-.345-.923a.288.288 0 0 0-.482-.096L13.01 3l-.245-.023-.52-.84a.29.29 0 0 0-.49 0l-.52.84q-.123.01-.245.023l-.673-.722a.29.29 0 0 0-.482.096l-.345.923q-.12.034-.237.072l-.8-.576a.288.288 0 0 0-.455.188l-.158.973q-.11.057-.22.118l-.895-.41a.287.287 0 0 0-.409.273l.034.988-.19.156-.96-.227a.29.29 0 0 0-.348.348l.227.962-.157.188-.987-.034a.288.288 0 0 0-.273.409l.409.897a7 7 0 0 0-.117.22l-.972.156a.288.288 0 0 0-.189.455l.575.8-.071.237-.923.346a.29.29 0 0 0-.096.482L3 10.99l-.024.244-.84.52a.29.29 0 0 0 0 .492l.84.519q.01.123.025.245l-.723.673a.29.29 0 0 0 .096.482l.922.345q.035.12.073.237l-.576.8a.29.29 0 0 0 .188.454l.973.158q.056.11.117.22l-.41.896a.288.288 0 0 0 .274.409l.987-.035q.076.096.156.19l-.227.961a.287.287 0 0 0 .348.347l.961-.226.19.156-.035.987a.288.288 0 0 0 .41.273l.896-.41q.108.06.219.119l.158.971a.288.288 0 0 0 .455.19l.799-.577q.118.038.237.072l.345.923a.287.287 0 0 0 .482.096L10.99 21q.121.014.244.025l.52.839a.29.29 0 0 0 .492 0l.519-.84q.123-.01.245-.024l.674.722a.287.287 0 0 0 .48-.096l.346-.923q.12-.034.238-.072l.8.576a.29.29 0 0 0 .454-.189l.158-.972.219-.117.896.409a.288.288 0 0 0 .41-.273l-.035-.988a7 7 0 0 0 .19-.155l.96.226a.287.287 0 0 0 .348-.347l-.226-.961.155-.19.988.035a.29.29 0 0 0 .272-.41l-.409-.896q.06-.108.117-.219l.973-.158a.287.287 0 0 0 .188-.454l-.575-.8.072-.237.922-.345a.286.286 0 0 0 .096-.482L21 13.011l.025-.245.839-.52a.29.29 0 0 0 0-.49Zm-5.619 6.965a.595.595 0 0 1 .25-1.163.595.595 0 0 1-.25 1.163m-.286-1.93a.54.54 0 0 0-.642.417l-.299 1.391a7.3 7.3 0 0 1-3.017.65c-1.1 0-2.144-.243-3.08-.679l-.299-1.39a.54.54 0 0 0-.643-.417l-1.228.263a7 7 0 0 1-.635-.748h5.976c.068 0 .113-.012.113-.074V14.09c0-.062-.046-.074-.113-.074h-1.747v-1.34h1.89c.172 0 .922.049 1.162 1.007.075.295.24 1.254.352 1.561.113.344.57 1.032 1.059 1.032h2.977a1 1 0 0 0 .108-.01q-.31.421-.677.794l-1.256-.27Zm-8.265 1.9a.594.594 0 1 1-.014-1.17.594.594 0 0 1 .014 1.171ZM5.427 9.5a.594.594 0 1 1-1.086.481.594.594 0 0 1 1.086-.481m-.697 1.65 1.28-.569a.543.543 0 0 0 .274-.715l-.263-.597h1.036v4.672h-2.09a7.3 7.3 0 0 1-.237-2.792Zm5.614-.454V9.32h2.468c.128 0 .9.148.9.725 0 .48-.592.652-1.08.652zm8.969 1.24q0 .273-.02.542h-.75c-.076 0-.106.05-.106.123v.345c0 .81-.457.987-.858 1.032-.381.043-.805-.16-.857-.394-.225-1.265-.6-1.536-1.192-2.003.735-.467 1.5-1.155 1.5-2.077 0-.996-.683-1.623-1.148-1.93-.652-.43-1.375-.517-1.57-.517h-7.76a7.3 7.3 0 0 1 4.091-2.308l.915.959a.54.54 0 0 0 .765.018l1.024-.98a7.32 7.32 0 0 1 5.006 3.566l-.7 1.583a.543.543 0 0 0 .275.715l1.35.6q.034.357.035.726m-7.754-8.004a.595.595 0 1 1 .82.86.595.595 0 0 1-.82-.86m6.951 5.595a.594.594 0 1 1 1.086.481.594.594 0 0 1-1.086-.481`},null,-1)]])}var MXe,NXe,PXe,FXe=s((()=>{jC(),W(),MXe=AC({default:()=>PXe,render:()=>jXe}),NXe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},PXe={render:jXe}}));function IXe(e,t){return F(),I(`svg`,RXe,[...t[0]||=[R(`path`,{d:`M4.589 24c4.537 0 13.81-1.516 14.821-3v-5.729c-.957 1.408-10.284 2.912-14.821 2.912zm0-7.635c4.537 0 13.81-1.516 14.821-3V7.636c-.957 1.408-10.284 2.912-14.821 2.912zm0-7.636c4.537 0 13.81-1.516 14.821-3V0C18.453 1.408 9.126 2.912 4.589 2.912z`},null,-1)]])}var LXe,RXe,zXe,BXe=s((()=>{jC(),W(),LXe=AC({default:()=>zXe,render:()=>IXe}),RXe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},zXe={render:IXe}}));function VXe(e,t){return F(),I(`svg`,UXe,[...t[0]||=[R(`path`,{d:`m2.4 11.4 5.1-4.6-5.1-4.7L.7 3.7l3.4 3v.1l-3.4 3zm14.2 3.3v-2.2h-8v2.2z`},null,-1)]])}var HXe,UXe,WXe,GXe=s((()=>{jC(),W(),HXe=AC({default:()=>WXe,render:()=>VXe}),UXe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 17 17`},WXe={render:VXe}}));function KXe(e,t){return F(),I(`svg`,JXe,[...t[0]||=[R(`path`,{d:`M117.3 87.3c.2-.6.4-1.3.5-1.9 7-28-10.1-61.2-39.2-78.6C91.4 24 97 44.9 92 63.2c-.4 1.6-1 3.2-1.6 4.7-.6-.4-1.5-.9-2.5-1.5 0 0-28.9-17.9-60.2-49.4-.9-.8 16.7 25 36.6 46.1-9.4-5.3-35.5-24.3-52-39.4 2 3.4 4.4 6.7 7.1 9.8C33.1 51 51.2 72.6 72.7 89.2c-15.2 9.3-36.6 10-57.9 0C9.5 86.7 4.6 83.7 0 80.3c9 14.4 22.9 26.9 39.9 34.2 20.2 8.7 40.3 8.1 55.2.1.1 0 .1-.1.2-.1.7-.4 1.3-.7 2-1.1 7.2-3.7 21.3-7.4 28.9 7.4 1.7 3.6 5.7-15.6-8.9-33.5`},null,-1)]])}var qXe,JXe,YXe,XXe=s((()=>{jC(),W(),qXe=AC({default:()=>YXe,render:()=>KXe}),JXe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 128 128`},YXe={render:KXe}}));function ZXe(e,t){return F(),I(`svg`,$Xe,[...t[0]||=[R(`path`,{d:`M1.125 0C.502 0 0 .502 0 1.125v21.75C0 23.498.502 24 1.125 24h21.75c.623 0 1.125-.502 1.125-1.125V1.125C24 .502 23.498 0 22.875 0zm17.363 9.75q.918 0 1.627.111a6.4 6.4 0 0 1 1.306.34v2.458a4 4 0 0 0-.643-.361 5 5 0 0 0-.717-.26 5.5 5.5 0 0 0-1.426-.2q-.45 0-.819.086a2.1 2.1 0 0 0-.623.242q-.254.156-.393.374a.9.9 0 0 0-.14.49q0 .294.156.529.156.234.443.444c.287.21.423.276.696.41q.41.203.926.416.705.296 1.266.628.561.333.963.753.402.418.614.957.213.538.214 1.253 0 .986-.373 1.656a3 3 0 0 1-1.012 1.085 4.4 4.4 0 0 1-1.487.596q-.85.18-1.79.18a10 10 0 0 1-1.84-.164 5.5 5.5 0 0 1-1.512-.493v-2.63a5.03 5.03 0 0 0 3.237 1.2q.5 0 .872-.09.373-.09.623-.25.249-.162.373-.38a1.02 1.02 0 0 0-.074-1.089 2.1 2.1 0 0 0-.537-.5 5.6 5.6 0 0 0-.807-.444 28 28 0 0 0-1.007-.436q-1.377-.575-2.053-1.405t-.676-2.005q0-.92.369-1.582.368-.662 1.004-1.089a4.5 4.5 0 0 1 1.47-.629 7.5 7.5 0 0 1 1.77-.201m-15.113.188h9.563v2.166H9.506v9.646H6.789v-9.646H3.375z`},null,-1)]])}var QXe,$Xe,eZe,tZe=s((()=>{jC(),W(),QXe=AC({default:()=>eZe,render:()=>ZXe}),$Xe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},eZe={render:ZXe}}));function nZe(e,t){return F(),I(`svg`,iZe,[...t[0]||=[R(`path`,{fill:`none`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M7.8 4.6 1.4 11c-.6.6-.6 1.6 0 2l6.2 6.2m8.6-14.6 6.2 6.2c.6.6.6 1.6 0 2l-6.2 6.6`},null,-1)]])}var rZe,iZe,aZe,oZe=s((()=>{jC(),W(),rZe=AC({default:()=>aZe,render:()=>nZe}),iZe={xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 24 24`},aZe={render:nZe}}));function sZe(e,t){return F(),I(`svg`,lZe,[...t[0]||=[R(`path`,{d:`M23.55 10.91 13.09.45a1.55 1.55 0 0 0-2.18 0L8.46 2.9 11 5.48a2.06 2.06 0 0 1 1-.23 2.25 2.25 0 0 1 2.25 2.25 2.2 2.2 0 0 1-.22 1l2.19 2.2a2 2 0 1 1-1.06 1.06L13 9.52a1 1 0 0 1-.21.09v5.54a2 2 0 1 1-1.5 0V9.61A2.24 2.24 0 0 1 9.75 7.5a2.2 2.2 0 0 1 .22-1L7.4 4 .45 11a1.55 1.55 0 0 0 0 2.18l10.46 10.37a1.55 1.55 0 0 0 2.18 0l10.46-10.46a1.55 1.55 0 0 0 0-2.18`},null,-1)]])}var cZe,lZe,uZe,dZe=s((()=>{jC(),W(),cZe=AC({default:()=>uZe,render:()=>sZe}),lZe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},uZe={render:sZe}}));function fZe(e,t){return F(),I(`svg`,mZe,[...t[0]||=[R(`path`,{d:`M12.001 4.8q-4.8 0-6 4.8 1.8-2.4 4.2-1.8c.913.228 1.565.89 2.288 1.624C13.666 10.618 15.027 12 18.001 12q4.8 0 6-4.8-1.8 2.4-4.2 1.8c-.913-.228-1.565-.89-2.288-1.624C16.337 6.182 14.976 4.8 12.001 4.8m-6 7.2q-4.8 0-6 4.8 1.8-2.4 4.2-1.8c.913.228 1.565.89 2.288 1.624 1.177 1.194 2.538 2.576 5.512 2.576q4.8 0 6-4.8-1.8 2.4-4.2 1.8c-.913-.228-1.565-.89-2.288-1.624C10.337 13.382 8.976 12 6.001 12`},null,-1)]])}var pZe,mZe,hZe,gZe=s((()=>{jC(),W(),pZe=AC({default:()=>hZe,render:()=>fZe}),mZe={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 24 24`},hZe={render:fZe}}));function _Ze(e,t){return F(),I(`svg`,yZe,[...t[0]||=[R(`path`,{fill:`currentColor`,"fill-rule":`evenodd`,d:`M2 11.997C2 20.066 3.934 22 11.997 22 20.066 22 22 20.066 22 11.997 22 3.934 20.06 2 11.997 2S2 3.934 2 11.997m4.034 2.081 3.129-7.132a2.96 2.96 0 0 1 2.828-1.848c1.285 0 2.302.649 2.834 1.848l3.135 7.132c.14.343.263.796.263 1.182 0 1.77-1.243 3.012-3.012 3.012-.606 0-1.084-.153-1.567-.306a5.1 5.1 0 0 0-1.653-.325c-.643 0-1.157.16-1.665.325-.49.153-.968.306-1.55.306A2.89 2.89 0 0 1 5.76 15.26c0-.392.122-.839.27-1.182zm5.963-5.889L8.905 15.2c.919-.429 1.972-.637 3.092-.637 1.084 0 2.18.208 3.06.637z`,"clip-rule":`evenodd`},null,-1)]])}var vZe,yZe,bZe,xZe=s((()=>{jC(),W(),vZe=AC({default:()=>bZe,render:()=>_Ze}),yZe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},bZe={render:_Ze}}));function SZe(e,t){return F(),I(`svg`,wZe)}var CZe,wZe,TZe,EZe=s((()=>{jC(),W(),CZe=AC({default:()=>TZe,render:()=>SZe}),wZe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},TZe={render:SZe}}));function DZe(e,t){return F(),I(`svg`,kZe,[...t[0]||=[ti(`<path fill="#fff" fill-rule="evenodd" d="M11.9 7.2h8.4v3.4h-8.4z" clip-rule="evenodd"></path><path fill="#3ECC5F" fill-rule="evenodd" d="M4.3 18.3c-.74 0-1.384-.403-1.73-1a2 2 0 0 0 1.73 3h2v-2z" clip-rule="evenodd"></path><path fill="#3ECC5F" fill-rule="evenodd" d="M13.298 7.738 20.3 7.3v-1a2 2 0 0 0-2-2h-9l-.25-.433a.29.29 0 0 0-.5 0L8.3 4.3l-.25-.433a.29.29 0 0 0-.5 0L7.3 4.3l-.25-.433a.29.29 0 0 0-.5 0L6.3 4.3h-.006l-.415-.414a.29.29 0 0 0-.482.13l-.137.51-.52-.14a.29.29 0 0 0-.353.354l.139.52-.51.136a.29.29 0 0 0-.13.483l.414.415V6.3l-.433.25a.29.29 0 0 0 0 .5l.433.25-.433.25a.29.29 0 0 0 0 .5l.433.25-.433.25a.29.29 0 0 0 0 .5l.433.25-.433.25a.29.29 0 0 0 0 .5l.433.25-.433.25a.29.29 0 0 0 0 .5l.433.25-.433.25a.29.29 0 0 0 0 .5l.433.25-.433.25a.29.29 0 0 0 0 .5l.433.25-.433.25a.29.29 0 0 0 0 .5l.433.25-.433.25a.29.29 0 0 0 0 .5l.433.25-.433.25a.29.29 0 0 0 0 .5l.433.25-.433.25a.29.29 0 0 0 0 .5l.433.25-.433.25a.29.29 0 0 0 0 .5l.433.25a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2v-8l-7.002-.438a1.065 1.065 0 0 1 0-2.124" clip-rule="evenodd"></path><path fill="#3ECC5F" fill-rule="evenodd" d="M16.3 20.3h3v-4h-3z" clip-rule="evenodd"></path><path fill="#44D860" fill-rule="evenodd" d="M21.3 17.8q-.033.002-.064.006l-.012-.045a.5.5 0 1 0-.494-.857l-.033-.034a.496.496 0 0 0-.299-.788.5.5 0 0 0-.56.293l-.044-.011q.005-.031.006-.064a.5.5 0 0 0-1 0q.002.033.006.064l-.044.011a.5.5 0 1 0-.859.495 2 2 0 1 0 3.333 1.924q.031.005.064.006a.5.5 0 1 0 0-1" clip-rule="evenodd"></path><path fill="#3ECC5F" fill-rule="evenodd" d="M17.3 14.3h3v-2h-3z" clip-rule="evenodd"></path><path fill="#44D860" fill-rule="evenodd" d="M21.3 13.55a.25.25 0 1 0 0-.5l-.032.003-.006-.022a.25.25 0 0 0-.096-.481.25.25 0 0 0-.15.052l-.018-.017a.25.25 0 0 0-.005-.308.25.25 0 0 0-.424.06 1 1 0 1 0 0 1.925.25.25 0 0 0 .48-.098.25.25 0 0 0-.05-.149l.016-.017a.25.25 0 0 0 .31-.005.25.25 0 0 0-.063-.424l.006-.022z" clip-rule="evenodd"></path><path fill="#000" fill-rule="evenodd" d="M8.3 7.55a.25.25 0 0 1-.25-.25.75.75 0 0 0-1.5 0 .25.25 0 0 1-.5 0 1.25 1.25 0 0 1 2.5 0 .25.25 0 0 1-.25.25" clip-rule="evenodd"></path><path fill="#FFFF50" fill-rule="evenodd" d="M12.3 20.3h6a2 2 0 0 0 2-2v-7h-6a2 2 0 0 0-2 2z" clip-rule="evenodd"></path><path fill="#000" fill-rule="evenodd" d="M18.802 14.4h-5.004a.1.1 0 0 1 0-.2h5.004a.1.1 0 1 1 0 .2m0 2h-5.004a.1.1 0 0 1 0-.2h5.004a.1.1 0 1 1 0 .2m0 2h-5.004a.1.1 0 0 1 0-.2h5.004a.1.1 0 1 1 0 .2m0-4.981h-5.004a.1.1 0 0 1 0-.2h5.004a.1.1 0 1 1 0 .2m0 1.981h-5.004a.1.1 0 0 1 0-.2h5.004a.1.1 0 1 1 0 .2m0 2h-5.004a.1.1 0 0 1 0-.2h5.004a.1.1 0 1 1 0 .2M20.3 8.161h-.003c-.31.01-.456.32-.585.592-.134.285-.238.47-.409.465-.189-.007-.297-.22-.411-.446-.132-.26-.282-.554-.596-.543-.305.01-.452.28-.581.517-.138.253-.232.406-.412.4-.193-.008-.295-.181-.414-.382-.132-.224-.285-.475-.593-.467-.3.01-.447.239-.577.44-.137.213-.233.343-.416.336-.198-.007-.3-.151-.417-.318-.133-.187-.282-.4-.59-.39-.293.01-.44.198-.57.363-.123.156-.219.28-.422.272a.1.1 0 0 0-.008.2c.302.01.455-.18.588-.349.117-.15.219-.278.419-.285.192-.008.283.111.42.304.13.184.276.392.572.402.31.01.46-.221.592-.426.119-.184.22-.342.415-.349.18-.006.277.135.415.368.13.22.276.47.579.48.312.01.463-.262.594-.503.114-.21.222-.406.412-.413.18-.004.273.16.411.433.13.255.276.544.583.556h.017c.306 0 .452-.308.58-.58.114-.24.222-.468.407-.477z" clip-rule="evenodd"></path><path fill="#3ECC5F" fill-rule="evenodd" d="M10.3 20.3h4v-4h-4z" clip-rule="evenodd"></path><path fill="#D8D8D8" d="m20.276 9.922-7.778 2.084a.2.2 0 0 0-.141.245l.76 2.837a.2.2 0 0 0 .245.141l7.777-2.084a.2.2 0 0 0 .142-.245l-.76-2.836a.2.2 0 0 0-.245-.142"></path><path fill="#4A4A4A" d="m14.845 13.56-.278.074a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .122.07l.279-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.123-.07m.559-.15-.278.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .122.07l.279-.074a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.123-.07m.559-.15-.278.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .122.07l.279-.074a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.123-.07m.559-.15-.278.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .122.071l.279-.075a.1.1 0 0 0 .07-.122l-.074-.278a.1.1 0 0 0-.123-.071m.559-.15-.278.075a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .122.07l.279-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.123-.071m.559-.15-.278.075a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .122.07l.279-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.123-.07Zm.56-.15-.28.075a.1.1 0 0 0-.07.123l.075.278a.1.1 0 0 0 .122.07l.279-.074a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.123-.07Zm.558-.15-.278.075a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .122.071l.279-.075a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.123-.07Zm.559-.15-.278.075a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .122.071l.279-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.123-.071Z"></path><path fill="#4A4A4A" fill-rule="evenodd" d="m13.082 14.032 1.187-.318a.1.1 0 0 1 .122.07l.075.279a.1.1 0 0 1-.07.122l-1.187.318a.1.1 0 0 1-.123-.07l-.075-.279a.1.1 0 0 1 .071-.122m6.533-1.75 1.187-.319a.1.1 0 0 1 .122.07l.075.28a.1.1 0 0 1-.07.122l-1.188.318a.1.1 0 0 1-.122-.07l-.075-.28a.1.1 0 0 1 .071-.122Zm-6.835.621.453-.121a.1.1 0 0 1 .122.07l.075.279a.1.1 0 0 1-.07.122l-.454.121a.1.1 0 0 1-.122-.07l-.075-.279a.1.1 0 0 1 .07-.122Z" clip-rule="evenodd"></path><path fill="#4A4A4A" d="m13.792 12.632-.279.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .123.071l.278-.075a.1.1 0 0 0 .07-.122l-.074-.278a.1.1 0 0 0-.122-.071m.558-.15-.278.075a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07l.278-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.071Zm.56-.15-.279.075a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07l.278-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.07Zm.559-.15-.279.075a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .123.07l.278-.074a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.122-.07Zm.559-.149-.279.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .123.071l.278-.075a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.122-.07m.559-.15-.279.075a.1.1 0 0 0-.07.122l.074.278a.1.1 0 0 0 .123.071l.278-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.071m.559-.15-.279.075a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07l.278-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.07Zm.559-.15-.279.075a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07l.278-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.07Zm.559-.149-.279.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .122.07l.279-.074a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.122-.07m.559-.15-.279.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .123.071l.278-.075a.1.1 0 0 0 .07-.122l-.074-.278a.1.1 0 0 0-.122-.071m.559-.15-.279.075a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07l.278-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.071m.558-.15-.278.075a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .122.07l.279-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.07Zm.56-.15-.279.075a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .122.07l.279-.074a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.122-.07Z"></path><path fill="#4A4A4A" fill-rule="evenodd" d="m20.483 10.771-.454.122a.1.1 0 0 1-.122-.071l-.075-.278a.1.1 0 0 1 .071-.123l.453-.121a.1.1 0 0 1 .123.07l.074.279a.1.1 0 0 1-.07.122" clip-rule="evenodd"></path><path fill="#4A4A4A" d="m19.47 11.042.279-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.07l-.279.074a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07Zm-.558.15.278-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.071l-.279.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .122.071Zm-.56.15.279-.075a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.122-.07l-.279.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .122.071m-.558.15.278-.075a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.122-.07l-.279.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .123.07Zm-.559.15.278-.075a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.07l-.279.074a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07Zm-.559.149.278-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.071l-.279.075a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07m-.559.15.278-.075a.1.1 0 0 0 .07-.122l-.074-.278a.1.1 0 0 0-.122-.071l-.279.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .123.071m-.559.149.278-.074a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.122-.07l-.279.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .123.07m-.559.15.278-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.07l-.279.074a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07m-.559.15.278-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.07l-.279.074a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07m-.56.15.28-.074a.1.1 0 0 0 .07-.123l-.075-.278a.1.1 0 0 0-.122-.071l-.279.075a.1.1 0 0 0-.07.122l.074.278a.1.1 0 0 0 .123.071Zm-.558.15.278-.075a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.122-.07l-.279.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .123.071m-.559.15.278-.075a.1.1 0 0 0 .071-.122l-.075-.279a.1.1 0 0 0-.122-.07l-.278.074a.1.1 0 0 0-.071.123l.074.278a.1.1 0 0 0 .123.07Z"></path><path fill="#4A4A4A" d="m19.47 11.042.279-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.07l-.279.074a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07Zm-.558.15.278-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.071l-.279.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .122.071Zm-.56.15.279-.075a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.122-.07l-.279.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .122.071m-.558.15.278-.075a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.122-.07l-.279.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .123.07Zm-.559.15.278-.075a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.07l-.279.074a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07Zm-.559.149.278-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.071l-.279.075a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07m-.559.15.278-.075a.1.1 0 0 0 .07-.122l-.074-.278a.1.1 0 0 0-.122-.071l-.279.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .123.071m-.559.149.278-.074a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.122-.07l-.279.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .123.07m-.559.15.278-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.07l-.279.074a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07m-.559.15.278-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.122-.07l-.279.074a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07m-.56.15.28-.074a.1.1 0 0 0 .07-.123l-.075-.278a.1.1 0 0 0-.122-.071l-.279.075a.1.1 0 0 0-.07.122l.074.278a.1.1 0 0 0 .123.071Zm-.558.15.278-.075a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.122-.07l-.279.074a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .123.071m-.559.15.278-.075a.1.1 0 0 0 .071-.122l-.075-.279a.1.1 0 0 0-.122-.07l-.278.074a.1.1 0 0 0-.071.123l.074.278a.1.1 0 0 0 .123.07Z"></path><path fill="#4A4A4A" fill-rule="evenodd" d="m12.93 13.462.645-.173a.1.1 0 0 1 .122.07l.075.28a.1.1 0 0 1-.07.122l-.646.173a.1.1 0 0 1-.123-.071l-.074-.278a.1.1 0 0 1 .07-.123Z" clip-rule="evenodd"></path><path fill="#4A4A4A" d="m14.151 13.135-.278.074a.1.1 0 0 0-.071.123l.075.278a.1.1 0 0 0 .122.07l.279-.074a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.123-.07m.559-.15-.278.074a.1.1 0 0 0-.071.123l.075.278a.1.1 0 0 0 .122.071l.279-.075a.1.1 0 0 0 .07-.122l-.074-.278a.1.1 0 0 0-.123-.071m.56-.15-.28.075a.1.1 0 0 0-.07.122l.075.279a.1.1 0 0 0 .122.07l.279-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.123-.071Zm.558-.15-.278.075a.1.1 0 0 0-.071.122l.075.279a.1.1 0 0 0 .122.07l.278-.074a.1.1 0 0 0 .071-.123l-.074-.278a.1.1 0 0 0-.123-.07Zm.559-.149-.278.074a.1.1 0 0 0-.071.123l.075.278a.1.1 0 0 0 .122.07l.279-.074a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.123-.07m.559-.15-.278.074a.1.1 0 0 0-.071.123l.075.278a.1.1 0 0 0 .122.071l.279-.075a.1.1 0 0 0 .07-.122l-.074-.279a.1.1 0 0 0-.123-.07m.559-.15-.278.074a.1.1 0 0 0-.071.123l.075.278a.1.1 0 0 0 .122.071l.278-.074a.1.1 0 0 0 .071-.123l-.074-.278a.1.1 0 0 0-.123-.071m.559-.15-.279.075a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07l.278-.074a.1.1 0 0 0 .071-.123l-.075-.278a.1.1 0 0 0-.122-.07Zm.559-.15-.279.075a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .123.07l.278-.074a.1.1 0 0 0 .071-.122l-.075-.279a.1.1 0 0 0-.122-.07Zm.559-.149-.278.074a.1.1 0 0 0-.071.123l.074.278a.1.1 0 0 0 .123.07l.278-.074a.1.1 0 0 0 .071-.122l-.075-.279a.1.1 0 0 0-.122-.07m.558-.15-.277.074a.1.1 0 0 0-.071.123l.074.278a.1.1 0 0 0 .123.071l.278-.075a.1.1 0 0 0 .071-.122l-.075-.279a.1.1 0 0 0-.122-.07Z"></path><path fill="#4A4A4A" fill-rule="evenodd" d="m20.039 11.557.61-.164a.1.1 0 0 1 .123.071l.074.279a.1.1 0 0 1-.07.122l-.61.164a.1.1 0 0 1-.123-.071l-.075-.278a.1.1 0 0 1 .07-.123z" clip-rule="evenodd"></path><path fill="#4A4A4A" d="m13.517 14.54-.279.075a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07l.278-.074a.1.1 0 0 0 .071-.123l-.075-.278a.1.1 0 0 0-.122-.07Zm.559-.15-.279.075a.1.1 0 0 0-.07.122l.074.279a.1.1 0 0 0 .123.07l.278-.074a.1.1 0 0 0 .071-.123l-.075-.278a.1.1 0 0 0-.122-.07Zm.559-.15-.279.075a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .123.07l.278-.074a.1.1 0 0 0 .071-.122l-.075-.279a.1.1 0 0 0-.122-.07Zm.559-.15-.279.075a.1.1 0 0 0-.07.123l.074.278a.1.1 0 0 0 .123.071l.278-.075a.1.1 0 0 0 .07-.122l-.074-.278a.1.1 0 0 0-.122-.071Z"></path><path fill="#4A4A4A" fill-rule="evenodd" d="m15.474 14.016 2.69-.72a.1.1 0 0 1 .122.07l.074.278a.1.1 0 0 1-.07.123l-2.69.72a.1.1 0 0 1-.122-.07l-.074-.279a.1.1 0 0 1 .07-.122m2.97-.796.348-.093a.1.1 0 0 1 .123.07l.074.279a.1.1 0 0 1-.07.122l-.349.094a.1.1 0 0 1-.122-.071l-.075-.279a.1.1 0 0 1 .07-.122Z" clip-rule="evenodd"></path><path fill="#4A4A4A" d="m19.351 12.977-.278.075a.1.1 0 0 0-.071.122l.075.279a.1.1 0 0 0 .122.07l.279-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.123-.071m.559-.15-.278.075a.1.1 0 0 0-.071.122l.075.279a.1.1 0 0 0 .122.07l.279-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.123-.07Zm1.048-.281-.278.075a.1.1 0 0 0-.071.122l.075.279a.1.1 0 0 0 .122.07l.279-.074a.1.1 0 0 0 .07-.123l-.074-.278a.1.1 0 0 0-.123-.07Zm-.845.442-.028-.104a.1.1 0 0 1 .07-.123l.28-.074a.1.1 0 0 1 .122.07l.027.105zm.49-.057.028.105a.1.1 0 0 1-.07.122l-.279.075a.1.1 0 0 1-.122-.07l-.028-.105zm-.344-2.893-7.652 2.05a.108.108 0 1 0 .057.21l7.65-2.05a.108.108 0 1 0-.055-.21"></path><path fill="#D8D8D8" d="m13.075 12-.3.08a.072.072 0 1 0 .037.14l.3-.08a.072.072 0 1 0-.037-.14m.603-.162-.3.081a.072.072 0 1 0 .037.14l.3-.08a.072.072 0 1 0-.037-.14Zm.464-.124-.3.08a.072.072 0 1 0 .037.14l.3-.08a.072.072 0 1 0-.037-.14m.464-.124-.3.08a.072.072 0 0 0 .038.14l.3-.08a.072.072 0 0 0-.038-.14m.464-.125-.3.081a.072.072 0 0 0 .037.14l.3-.08a.072.072 0 0 0-.037-.14Zm.58-.155-.3.08a.072.072 0 0 0 .037.14l.3-.08a.072.072 0 1 0-.037-.14m.464-.124-.3.08a.072.072 0 0 0 .037.14l.3-.08a.072.072 0 1 0-.038-.14Zm.464-.125-.3.081a.072.072 0 1 0 .037.14l.3-.08a.072.072 0 1 0-.037-.14Zm.464-.124-.3.08a.072.072 0 0 0 .038.14l.3-.08a.072.072 0 1 0-.037-.14Zm.58-.155-.3.08a.072.072 0 0 0 .037.14l.3-.08a.072.072 0 0 0-.038-.14Zm.464-.125-.3.081a.072.072 0 0 0 .037.14l.3-.08a.072.072 0 0 0-.037-.14Zm.464-.124-.3.08a.072.072 0 0 0 .038.14l.3-.08a.072.072 0 1 0-.037-.14Zm.58-.155-.3.08a.072.072 0 1 0 .037.14l.3-.08a.072.072 0 1 0-.038-.14Zm.464-.125-.301.08a.072.072 0 1 0 .037.14l.301-.08a.072.072 0 1 0-.037-.14m.464-.124-.301.08a.072.072 0 0 0 .037.14l.302-.08a.072.072 0 0 0-.038-.14" opacity=".136"></path><path fill="#44D860" fill-rule="evenodd" d="M16.3 17.8q-.033.002-.064.006l-.012-.045a.5.5 0 1 0-.494-.857l-.033-.034a.496.496 0 0 0-.299-.788.5.5 0 0 0-.56.293l-.044-.011q.005-.031.006-.064a.5.5 0 0 0-1 0q.002.033.006.064l-.044.011a.5.5 0 1 0-.859.495 2 2 0 1 0 3.333 1.924q.031.005.064.006a.5.5 0 1 0 0-1" clip-rule="evenodd"></path><path fill="#3ECC5F" fill-rule="evenodd" d="M10.3 14.3h4v-2h-4z" clip-rule="evenodd"></path><path fill="#44D860" fill-rule="evenodd" d="M15.3 13.55a.25.25 0 1 0 0-.5l-.032.003-.006-.022a.25.25 0 0 0-.096-.481.25.25 0 0 0-.15.052l-.018-.017a.25.25 0 0 0-.005-.308.25.25 0 0 0-.424.06 1 1 0 1 0 0 1.925.25.25 0 0 0 .48-.098.25.25 0 0 0-.05-.149l.016-.017a.25.25 0 0 0 .31-.005.25.25 0 0 0-.063-.424l.006-.022z" clip-rule="evenodd"></path><path fill="#000" fill-rule="evenodd" d="M16.3 6.175a.3.3 0 0 1-.096-.019.3.3 0 0 1-.081-.054.3.3 0 0 1-.054-.081.26.26 0 0 1 0-.192.26.26 0 0 1 .092-.112.3.3 0 0 1 .09-.037.26.26 0 0 1 .188.037l.038.031a.26.26 0 0 1 .073.177.25.25 0 0 1-.154.231.3.3 0 0 1-.096.02Zm2-.125a.26.26 0 0 1-.208-.11.26.26 0 0 1-.042-.139.26.26 0 0 1 .11-.209.3.3 0 0 1 .091-.037.26.26 0 0 1 .188.037l.038.031a.26.26 0 0 1 .054.273l-.023.043-.031.038a.26.26 0 0 1-.177.073" clip-rule="evenodd"></path>`,29)]])}var OZe,kZe,AZe,jZe=s((()=>{jC(),W(),OZe=AC({default:()=>AZe,render:()=>DZe}),kZe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},AZe={render:DZe}}));function MZe(e,t){return F(),I(`svg`,PZe,[...t[0]||=[R(`path`,{fill:`#512BD4`,d:`M22 2H2v20h20z`},null,-1),R(`path`,{fill:`#fff`,d:`M5.565 14.778a.5.5 0 0 1-.361-.142.47.47 0 0 1-.148-.344.47.47 0 0 1 .148-.348.5.5 0 0 1 .36-.145q.216 0 .365.145a.46.46 0 0 1 .152.348.46.46 0 0 1-.152.344.5.5 0 0 1-.364.142m5.653-.08h-.92l-2.421-3.82a1.7 1.7 0 0 1-.152-.301h-.021q.028.166.028.714v3.407h-.813V9.5h.98l2.34 3.73q.148.232.19.319h.015a5 5 0 0 1-.036-.7V9.5h.81zm3.96 0h-2.846V9.5h2.732v.732h-1.89v1.472h1.742v.728h-1.743v1.537h2.005zm4.044-4.466h-1.456v4.466h-.842v-4.466h-1.453V9.5h3.751z`},null,-1)]])}var NZe,PZe,FZe,IZe=s((()=>{jC(),W(),NZe=AC({default:()=>FZe,render:()=>MZe}),PZe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},FZe={render:MZe}}));function LZe(e,t){return F(),I(`svg`,zZe,[...t[0]||=[ti(`<path fill="#333" fill-rule="evenodd" d="M18.578 20.398A9.98 9.98 0 0 0 22 12.866c0-5.523-4.477-10-10-10s-10 4.477-10 10a9.97 9.97 0 0 0 3.24 7.369l.01-.064 13.123-4.297z" clip-rule="evenodd"></path><path fill="#CCC" d="m9.419 4.067-1.774-.264.265-.081q.242-.076.444-.228l.042-.032a1.22 1.22 0 0 0 .466-.778l.02-.124q.032-.202-.003-.403a.073.073 0 0 1 .1-.08l.072.03q.136.056.263.132l.302.182c.4.242.752.558 1.036.931l.2.264a1.33 1.33 0 0 0 .618.45l.14.05-.732.03a8 8 0 0 1-1.46-.08Z"></path><path fill="#CCC" d="m8.966 5.64.526-.962a.03.03 0 0 0 0-.03l-.179-.378a.68.68 0 0 0-.614-.388l-.05-.002a4.7 4.7 0 0 1-1.017-.148l-.065-.017a4 4 0 0 1-.79-.297l-.111-.055a3 3 0 0 1-.474-.3l-.147-.115a.1.1 0 0 0-.14.02 1 1 0 0 0-.185.47l-.027.235a2 2 0 0 0-.004.379l.065.734c.049.547.237 1.071.548 1.524l.066.097q.144.209.331.38a.1.1 0 0 0 .064.027A2.28 2.28 0 0 0 8.966 5.64"></path><path fill="#EDEDED" d="m6.976 6.832.625-.27a.45.45 0 1 0-.458-.769l-.148.117a1 1 0 0 0-.097.094l-.356.428a.15.15 0 0 0 .009.203l.11.126a.275.275 0 0 0 .315.071"></path><path fill="#B2B2B2" d="m7.78 3.758-.018.006.057.018c.247.08.504.125.763.138a.1.1 0 0 0 .038-.005l.118-.034.059-.02-.374-.08a.3.3 0 0 1-.134-.066.063.063 0 0 1 0-.096l.056-.046a.6.6 0 0 0 .157-.2c-.216.171-.46.301-.721.385Z"></path><path fill="#fff" d="M9.92 10.578 4.825 19.69a.078.078 0 0 1-.124.017l-.102-.103-.43-.488-.274-.354a8 8 0 0 1-.693-1.067l-.04-.072a8 8 0 0 1-.536-1.24l-.137-.412a5.55 5.55 0 0 1-.139-2.295l.005-.032a5.7 5.7 0 0 1 .24-.988l.226-.669.17-.356a5 5 0 0 1 1.067-1.473l.215-.204a3.8 3.8 0 0 1 1.576-.897 3 3 0 0 1-.422.084l-.281.033-.215.02-.235.04-.234.021-.156.017-.113.007c-.036.002-.053-.044-.024-.065l.157-.076a2.65 2.65 0 0 0 1.19-1.135l.174-.271a2.6 2.6 0 0 1 .808-.802l.067-.043q.182-.115.385-.187l.615-.217a.43.43 0 0 0 .253-.236l.009-.022a.34.34 0 0 0-.083-.38l-.108-.099-.018-.02-.696-.926-.555-.764a.97.97 0 0 1-.184-.517.04.04 0 0 1 .056-.038l.6.288a2.38 2.38 0 0 0 1.666.148q.195-.053.394-.075l.276-.028a5.7 5.7 0 0 1 2.064.17l.058.016.656.236a3 3 0 0 1 1.785 1.756l.138.536a2.17 2.17 0 0 0 .863 1.246l.35.244q.232.162.483.287l.775.388a.062.062 0 0 1 .022.093 2.1 2.1 0 0 1-.82.644l-.449.195a4 4 0 0 1-.55.193l-.33.088a5.5 5.5 0 0 1-1.417.188h-.79a1.3 1.3 0 0 1-.477-.091 1.3 1.3 0 0 0-1.615.576Z"></path><path fill="#666" d="m12.593 7.292.344.004c.047 0 .057-.065.013-.079a1.4 1.4 0 0 1-.212-.087l-.269-.139a2.8 2.8 0 0 1-.51-.338l-.053-.044q-.18-.15-.323-.334l-.06-.078a.034.034 0 0 0-.062.023c.04.598.533 1.065 1.132 1.072"></path><path fill="#CCC" d="m5.212 19.834 5.824-5.195a7.8 7.8 0 0 0 1.417-1.677l.035-.057a2.3 2.3 0 0 0 .237-1.239l-.052-.587a1.66 1.66 0 0 0-.424-.97.1.1 0 0 0-.036-.02l-.936-.192a4.2 4.2 0 0 0-2.092-.086l-.037.008-.544.127a6.74 6.74 0 0 0-3.94 2.63l-.023.034a6.4 6.4 0 0 0-.665 1.168l-.032.074a6.07 6.07 0 0 0-.441 3.31l.054.367a3.7 3.7 0 0 0 .932 1.96l.297.324a.304.304 0 0 0 .426.021"></path><path fill="#5E5E5E" d="m10.31 12.9-.018.01c-.492.281-.756.811-.73 1.377.007.16.168.308.323.264l.285-.081a2.6 2.6 0 0 0 1.001-.539l.829-.713.246-.182a6.6 6.6 0 0 1 4.979-1.209c.054.009.056.086.002.097l-.207.043-.095.033a1 1 0 0 0-.48.359.04.04 0 0 0 .044.062l.068-.021a3.2 3.2 0 0 1 1.184-.132l.157.012a2.86 2.86 0 0 1 2.159 1.137l.192.256c.57.758.812 1.714.67 2.652l-.074.49a4.7 4.7 0 0 1-.713 1.87l-.027.04-.41.547-.449.508-.411.395q-.566.542-1.227.962l-.14.088-.266.127c-.069.033-.126-.061-.065-.107l.37-.352.077-.08c.206-.216.355-.482.431-.77l.035-.134a.715.715 0 0 0-.549-.886.7.7 0 0 0-.583.146l-.367.299-.649.53a8 8 0 0 1-1.376.902l-.67.345-1.133.43-.238.064a8 8 0 0 1-1.263.235l-.316.032H9.891l-1.348-.146-.73-.158a4.55 4.55 0 0 1-1.91-.917l-.563-.458a3.02 3.02 0 0 1-1.177-2.168l-.034-.45.04-.631a4.6 4.6 0 0 1 1.956-3.483l.12-.084a5.2 5.2 0 0 1 1.646-.763l.396-.105a3.4 3.4 0 0 1 1.577-.042l.413.086c.104.022.126.16.034.212Z"></path>`,9)]])}var RZe,zZe,BZe,VZe=s((()=>{jC(),W(),RZe=AC({default:()=>BZe,render:()=>LZe}),zZe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},BZe={render:LZe}}));function HZe(e,t){return F(),I(`svg`,WZe,[...t[0]||=[R(`path`,{fill:`currentColor`,d:`m16.378 12.034-4.148-5.53h.507c.369 0 .738.185.968.461l3.272 4.286 3.226-4.24c.322-.322.691-.507 1.06-.507h.553l-4.194 5.53L22 17.841h-.553c-.369 0-.737-.185-.968-.507l-3.456-4.516-3.456 4.516c-.23.322-.6.46-.968.46h-.553zm-13.456.461v.369c0 1.935 1.29 3.686 3.18 4.147a4.15 4.15 0 0 0 4.654-2.258c.138-.23.368-.415.645-.415h.46a5.07 5.07 0 0 1-4.792 3.687C4.212 18.025 2 15.583 2 12.541v-1.29c0-2.489 1.751-4.747 4.24-5.207a5.07 5.07 0 0 1 5.898 5.069v1.382zm0-.921h8.295v-.461a4.148 4.148 0 0 0-5.07-4.056c-1.935.461-3.225 2.212-3.225 4.378z`},null,-1)]])}var UZe,WZe,GZe,KZe=s((()=>{jC(),W(),UZe=AC({default:()=>GZe,render:()=>HZe}),WZe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},GZe={render:HZe}}));function qZe(e,t){return F(),I(`svg`,YZe,[...t[0]||=[R(`path`,{fill:`currentColor`,d:`M12 2a10 10 0 1 0 0 20 10 10 0 0 0 0-20m-.7 4.5h6.3L11.3 11h4.3l-9.2 6.4 2-4.4 1-2 2-4.5z`},null,-1)]])}var JZe,YZe,XZe,ZZe=s((()=>{jC(),W(),JZe=AC({default:()=>XZe,render:()=>qZe}),YZe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},XZe={render:qZe}}));function QZe(e,t){return F(),I(`svg`,eQe,[...t[0]||=[R(`path`,{fill:`currentColor`,d:`M23.241 7.492 24 5.536l-.031-.125-7.479 1.971c.798-1.158.524-2.08.524-2.08s-2.386 1.525-4.193 1.486c-1.807-.04-2.386-.525-5.155.36-2.769.883-3.551 3.59-4.357 4.177-.798.579-3.309 2.51-3.309 2.51l2.269-.727s-.642.61-1.964 2.386v.008c.211.297 1.142 1.525 2.065 1.26.102-.032.22-.087.352-.15.415.236.97.462 1.573.525 0 0-.407-.47-.751-1.017l.281-.18-.047.031.869.313-.094-.813h.008l.844.313-.101-.744.32-.156.884-3.348 3.661-2.503-.289.735c-.743 1.823-2.136 2.253-2.136 2.253l-.578.227c-.438.508-.618.634-.767 2.354.352-.093.68-.11.986-.03 1.564.422 2.104 2.307 1.681 2.831-.101.125-.352.352-.672.61H7.76l-.008.516-.062.055h-.65l-.007.5-.173.126c-.602.016-1.376-.516-1.376-.516.008.485.406 1.228.406 1.228l.07-.04-.062.048s1.627 1.08 2.652.68c.908-.36 3.262-2.214 5.296-3.09l6.149-1.627.813-2.096-4.685 1.236V13.14l5.499-1.448.814-2.104-6.313 1.666V9.37zm-11.163 3.997 1.463-.383.016.07-.454 1.181-1.51.4zm.5 2.527-1.509.399.493-1.268 1.455-.383.023.07zm1.972-.423-1.51.4.493-1.268 1.455-.383.024.07z`},null,-1)]])}var $Ze,eQe,tQe,nQe=s((()=>{jC(),W(),$Ze=AC({default:()=>tQe,render:()=>QZe}),eQe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},tQe={render:QZe}}));function rQe(e,t){return F(),I(`svg`,aQe,[...t[0]||=[R(`path`,{fill:`currentColor`,d:`M1.81 10.714c-.046 0-.058-.023-.034-.058l.245-.316c.023-.035.082-.058.128-.058h4.17c.047 0 .059.035.035.07l-.198.304c-.024.035-.082.07-.117.07zM.048 11.789c-.047 0-.059-.024-.035-.059l.245-.315c.023-.035.082-.059.128-.059h5.327c.047 0 .07.036.058.07l-.093.28c-.012.048-.058.07-.105.07zm2.826 1.074c-.046 0-.058-.035-.035-.07l.164-.292c.023-.035.07-.07.117-.07h2.336c.047 0 .07.035.07.082l-.023.28c0 .047-.047.082-.082.082l-2.546-.012Zm12.125-2.36-1.962.515c-.175.046-.187.058-.339-.117a1.6 1.6 0 0 0-.549-.444 2.03 2.03 0 0 0-2.114.175 2.49 2.49 0 0 0-1.192 2.22c.012.934.655 1.705 1.577 1.833.795.106 1.46-.175 1.986-.77l.316-.433h-2.255c-.245 0-.304-.151-.222-.35.152-.362.432-.97.596-1.273a.32.32 0 0 1 .292-.187h4.252c-.024.315-.024.63-.07.946a5 5 0 0 1-.958 2.29 4.87 4.87 0 0 1-3.33 1.985 4.14 4.14 0 0 1-3.141-.77A3.67 3.67 0 0 1 6.4 13.528a4.58 4.58 0 0 1 .993-3.422 5.2 5.2 0 0 1 3.27-2.021c1.099-.199 2.15-.07 3.096.572.62.409 1.063.97 1.355 1.647.07.105.024.164-.117.199Z`},null,-1),R(`path`,{fill:`currentColor`,d:`M18.865 16.963a4.38 4.38 0 0 1-2.85-1.028 3.67 3.67 0 0 1-1.262-2.254 4.46 4.46 0 0 1 .946-3.528 4.9 4.9 0 0 1 3.27-1.95 4.32 4.32 0 0 1 3.33.595 3.63 3.63 0 0 1 1.647 2.605 4.51 4.51 0 0 1-1.343 3.96 5.35 5.35 0 0 1-2.804 1.495c-.315.058-.63.07-.934.105m2.78-4.719c-.012-.152-.012-.268-.035-.385a1.93 1.93 0 0 0-2.383-1.554c-1.087.245-1.787.935-2.044 2.033-.21.91.233 1.834 1.074 2.207.643.28 1.285.246 1.904-.07a2.56 2.56 0 0 0 1.484-2.23Z`},null,-1)]])}var iQe,aQe,oQe,sQe=s((()=>{jC(),W(),iQe=AC({default:()=>oQe,render:()=>rQe}),aQe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},oQe={render:rQe}}));function cQe(e,t){return F(),I(`svg`,uQe,[...t[0]||=[R(`path`,{fill:`#FF5B11`,d:`M12.371 1.736q.08-.01.141.04a76 76 0 0 1 4.217 5.662 28 28 0 0 1 2.49 4.659q1.64 4.374-1.707 7.61-2.928 2.475-6.747 1.928-4.564-.93-6.205-5.281a7.4 7.4 0 0 1-.28-2.891 17.3 17.3 0 0 1 1.204-4.9 7.3 7.3 0 0 1 1.044-1.767q.525.625 1.004 1.285.222.232.462.442a38 38 0 0 1 4.377-6.787`,opacity:`.993`},null,-1),R(`path`,{fill:`#FF9758`,d:`M12.09 5.962a42.5 42.5 0 0 1 3.996 5.462q.56.959.924 2.008.758 2.982-1.627 4.92-2.306 1.622-5.06.963-2.97-.921-3.433-3.996a4.25 4.25 0 0 1 .2-1.887c.297-.754.66-1.48 1.085-2.168L9.38 9.495q1.367-1.758 2.71-3.534Z`},null,-1)]])}var lQe,uQe,dQe,fQe=s((()=>{jC(),W(),lQe=AC({default:()=>dQe,render:()=>cQe}),uQe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},dQe={render:cQe}}));function pQe(e,t){return F(),I(`svg`,hQe,[...t[0]||=[R(`path`,{fill:`#FF2D20`,d:`M21.217 6.8a.3.3 0 0 1 .012.076v4.078a.3.3 0 0 1-.15.26l-3.424 1.969v3.907a.3.3 0 0 1-.147.259l-7.15 4.111q-.023.014-.05.024l-.021.007a.3.3 0 0 1-.152 0l-.024-.01c-.017-.007-.033-.011-.048-.02l-7.142-4.112a.3.3 0 0 1-.15-.26V4.857q0-.043.012-.079c0-.01.007-.016.01-.023a.2.2 0 0 1 .019-.048l.021-.026.024-.036.03-.024.034-.023L6.492 2.54a.29.29 0 0 1 .298 0l3.573 2.053.033.024.029.024.026.036.022.023.019.048c0 .01.007.017.01.024a.4.4 0 0 1 .009.08v7.643l2.978-1.713v-3.91c0-.023.003-.052.01-.076l.01-.026.018-.047.022-.024.026-.036.029-.024.033-.023L17.21 4.56a.3.3 0 0 1 .298 0l3.57 2.058.034.024c.01.01.022.014.029.024q.017.015.026.035l.021.024c.01.017.015.03.02.048l.009.023zm-.58 3.98V7.392l-1.252.719-1.727.994v3.393l2.978-1.713zm-3.576 6.138v-3.395l-1.7.971-4.85 2.77v3.425l6.55-3.77ZM3.366 5.37v11.548l6.55 3.769V17.26l-3.421-1.934h-.003l-.03-.024c-.01-.01-.022-.014-.03-.024-.011-.01-.018-.024-.025-.03l-.024-.032-.014-.038q-.009-.015-.015-.033l-.007-.043-.002-.033V7.08l-1.728-.994-1.253-.716zm3.276-2.23L3.666 4.857 6.64 6.569l2.976-1.713-2.974-1.713zM8.19 13.833l1.727-.992V5.37l-1.247.718-1.727.995v7.47l1.249-.72zm9.169-8.667-2.974 1.713 2.974 1.713 2.974-1.713zm-.297 3.943-1.728-.995-1.249-.718v3.385l1.727.995 1.25.72v-3.39zm-6.845 7.639 4.365-2.491 2.182-1.244L13.79 11.3l-3.426 1.972-3.117 1.796z`},null,-1)]])}var mQe,hQe,gQe,_Qe=s((()=>{jC(),W(),mQe=AC({default:()=>gQe,render:()=>pQe}),hQe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},gQe={render:pQe}}));function vQe(e,t){return F(),I(`svg`,bQe,[...t[0]||=[ti(`<g fill="#EDB641" clip-path="url(#a)"><path d="m5.33 10.983.419 1.29H7.11l-1.1.796.42 1.29-1.101-.797-1.09.791.419-1.29-1.1-.796H4.92l.42-1.289-.011.005Zm1.954-4.245.362 1.111h1.169l-.944.687.362 1.111-.949-.681-.943.681.351-1.111-.943-.687h1.169l.361-1.11h.005ZM1.31 13.504l.21.65h.68l-.55.409.21.65-.55-.404-.556.404.21-.65-.551-.404h.681l.21-.65.005-.005Z"></path><path d="M9.197 15.684a19 19 0 0 0 2.505-1.378 22.6 22.6 0 0 0 3.092-2.6l-.613-.408-.534-.362 1.692-.063.545-.02.147-.525.461-1.635.587 1.588.189.514.545-.027 1.693-.062-1.332 1.048-.43.335.19.514.586 1.588-1.41-.944-.45-.298-.43.335-1.331 1.048.23-.812.231-.818.026-.105a21 21 0 0 1-5.24 2.815c-.315.104-.63.188-.944.267zm-3.186 1.242a16.1 16.1 0 0 0 8.081-2.494l-.535 1.923 3.145-2.479 3.328 2.222-1.384-3.752 3.144-2.474-4.003.158-1.384-3.758-1.09 3.852-3.999.157 2.317 1.546c-1.52 1.384-5.346 4.34-10.413 4.538A14 14 0 0 1 0 16.11s2.52.953 6.016.817h-.005Z"></path><path d="M16.408 4.412a7.588 7.588 0 0 0-7.242 9.862q.495-.25.943-.508a6.53 6.53 0 0 1 6.3-8.306 6.54 6.54 0 1 1-4.916 10.848c-.351.136-.703.262-1.059.367a7.588 7.588 0 1 0 5.974-12.263"></path></g><defs><clipPath id="a"><path fill="#fff" d="M0 0h24v24H0z"></path></clipPath></defs>`,2)]])}var yQe,bQe,xQe,SQe=s((()=>{jC(),W(),yQe=AC({default:()=>xQe,render:()=>vQe}),bQe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},xQe={render:vQe}}));function CQe(e,t){return F(),I(`svg`,TQe,[...t[0]||=[R(`path`,{fill:`#E0234E`,"fill-rule":`evenodd`,d:`M13.776 2.04c-.144 0-.279.03-.403.071.264.176.409.409.48.672.006.036.016.062.021.098q.009.046.01.093c.021.455-.118.511-.216.78-.15.346-.109.718.072 1.017a.6.6 0 0 0 .062.114c-.196-1.307.894-1.503 1.095-1.91.016-.357-.279-.595-.511-.76a1.14 1.14 0 0 0-.61-.176Zm1.643.294c-.021.118-.005.087-.01.15-.006.04-.006.092-.01.134q-.016.063-.037.124a1 1 0 0 1-.042.124c-.02.041-.035.077-.056.118-.016.021-.026.042-.042.062l-.03.047a2 2 0 0 1-.078.103c-.03.031-.057.067-.093.093v.005c-.031.026-.062.057-.098.083-.108.082-.233.145-.346.222-.036.026-.073.046-.103.078a1 1 0 0 0-.099.082c-.036.031-.062.062-.093.098-.025.031-.056.067-.077.104q-.039.052-.072.108c-.021.041-.036.077-.057.119-.016.041-.031.077-.042.119a2 2 0 0 0-.036.129c-.005.02-.005.046-.01.067-.005.02-.005.041-.01.062 0 .041-.005.088-.005.129q-.001.046.005.093 0 .06.015.13.01.06.026.123l.041.124c.01.026.026.052.037.072l-1.188-.46a13 13 0 0 0-.6-.154l-.325-.078a10 10 0 0 0-.94-.14c-.01 0-.016-.004-.026-.004a9 9 0 0 0-1.601-.021c-.315.02-.63.062-.945.114q-.116.017-.233.04-.232.048-.465.104l-.232.062c-.077.031-.15.067-.222.098l-.17.078c-.01.005-.021.005-.026.01-.052.026-.098.047-.145.073a2 2 0 0 0-.196.098c-.036.015-.072.036-.104.051a3 3 0 0 0-.305.18c-.035.027-.071.048-.103.073-.005.005-.01.005-.015.01a1 1 0 0 0-.098.073l-.01.01-.078.062c-.01.005-.02.016-.03.02l-.078.068c-.006.01-.016.016-.021.02-.031.032-.062.058-.093.088-.005 0-.005.006-.01.011a2 2 0 0 0-.094.088c-.005.005-.005.01-.01.01a1 1 0 0 0-.077.083c-.01.01-.026.02-.036.03q-.04.047-.088.094c-.005.01-.016.015-.02.025-.042.042-.078.083-.12.124l-.015.016q-.123.134-.264.253-.14.125-.289.227a3.2 3.2 0 0 1-.635.351 4 4 0 0 1-.336.124c-.217.047-.439.135-.63.15-.041 0-.088.01-.129.016l-.129.03-.124.047a1 1 0 0 0-.124.057c-.036.026-.077.046-.114.072a1 1 0 0 0-.103.088 1 1 0 0 0-.103.093c-.031.036-.062.067-.088.103-.026.042-.057.078-.078.12a1 1 0 0 0-.072.118q-.032.067-.057.134l-.046.134a1 1 0 0 0-.026.124c0 .006-.005.011-.005.016-.01.047-.01.108-.016.14q-.009.05-.01.103a.5.5 0 0 0 .026.165q.014.046.036.093v.005a1 1 0 0 0 .057.093 1 1 0 0 0 .067.093q.042.044.088.083.045.045.098.082c.124.109.155.145.315.228q.038.02.083.041c.005 0 .01.005.015.005q-.001.013.005.026.01.062.026.124a1 1 0 0 0 .041.124c.016.03.026.062.042.093q.007.016.015.026l.062.113.078.109q.042.051.088.098.045.043.098.088s.005.005.01.005a1 1 0 0 0 .207.14 1 1 0 0 0 .118.056.6.6 0 0 0 .104.036c.005.005.01.005.02.01.021.006.047.011.068.016-.016.279-.021.543.02.635.047.104.274-.211.501-.573-.03.357-.051.775 0 .899.057.129.367-.274.636-.718 3.662-.847 7.003 1.684 7.354 5.258-.067-.558-.754-.868-1.069-.79-.155.382-.418.873-.841 1.177.037-.345.02-.693-.052-1.033a3.3 3.3 0 0 1-.64 1.302c-.491.036-.982-.202-1.24-.558-.02-.015-.026-.046-.042-.067a1 1 0 0 1-.04-.108.4.4 0 0 1-.032-.109q-.006-.052-.005-.114v-.077a1 1 0 0 1 .026-.109 1 1 0 0 1 .036-.108c.02-.036.036-.072.062-.108.088-.248.088-.45-.072-.569a.6.6 0 0 0-.099-.051c-.02-.006-.046-.016-.067-.021l-.041-.015a1 1 0 0 0-.109-.026.4.4 0 0 0-.108-.016 1 1 0 0 0-.114-.01c-.025 0-.051.005-.077.005a.4.4 0 0 0-.114.015q-.054.007-.108.021a1 1 0 0 0-.109.036l-.103.047c-.03.015-.062.036-.098.052-1.203.784-.486 2.623.336 3.155-.31.057-.625.124-.713.191l-.01.01q.334.202.697.347.415.134.837.248v.005a5 5 0 0 0 1.301.093c2.288-.16 4.163-1.9 4.504-4.194l.031.134c.015.093.036.191.046.29v.005q.014.07.021.134v.02q.009.072.01.135.01.085.01.17v.083c0 .026.006.057.006.083 0 .03-.005.062-.005.093v.072c0 .036-.005.067-.005.103q.001.029-.006.067c0 .036-.005.073-.005.114q-.006.022-.005.046l-.015.12q.001.022-.005.046c-.006.051-.016.098-.021.15v.01c-.01.046-.02.098-.031.144v.016l-.031.14c0 .005-.005.015-.005.02a1 1 0 0 1-.036.14v.015q-.025.076-.042.145-.006.009-.005.01l-.046.155c-.021.052-.037.098-.057.15s-.036.103-.057.15l-.062.15h-.005c-.021.046-.041.097-.067.144l-.016.036c-.005.005-.005.01-.01.015a4.9 4.9 0 0 1-1.451 1.736q-.063.04-.125.088c-.01.01-.026.015-.036.026q-.053.038-.113.077l.015.031h.005l.217-.03h.005q.202-.033.403-.073a1 1 0 0 0 .114-.026l.072-.015c.036-.006.072-.016.109-.021.03-.01.062-.016.093-.026a10 10 0 0 0 1.497-.496 8.3 8.3 0 0 1-3.207 2.619 8.5 8.5 0 0 0 1.761-.305 8.25 8.25 0 0 0 4.881-3.9 8.2 8.2 0 0 1-1.39 3.321c.501-.33.964-.714 1.38-1.146a8.2 8.2 0 0 0 2.174-4.39c.177.817.227 1.657.15 2.49 3.73-5.202.31-10.594-1.12-12.015-.006-.01-.01-.015-.01-.026-.006.006-.006.006-.006.011 0-.005 0-.005-.005-.01q-.002.092-.01.186a7 7 0 0 1-.052.345 8 8 0 0 1-.088.341 4 4 0 0 1-.124.33q-.072.162-.155.316a4 4 0 0 1-.398.573c-.077.093-.16.176-.242.259a3 3 0 0 1-.15.129l-.12.103c-.092.072-.185.14-.288.201a4 4 0 0 1-.305.176 9 9 0 0 1-.325.145 3.6 3.6 0 0 1-.682.186c-.12.02-.238.03-.351.04a4 4 0 0 1-.248.011c-.12 0-.238-.01-.351-.02a3 3 0 0 1-.352-.052 3 3 0 0 1-.346-.088h-.005c.114-.01.227-.02.341-.041a3.7 3.7 0 0 0 1.317-.501q.148-.099.29-.207.138-.108.263-.232c.087-.078.165-.165.242-.253q.117-.14.217-.28c.01-.015.02-.035.031-.05q.08-.125.15-.249a3.6 3.6 0 0 0 .367-.981c.02-.119.041-.233.052-.346.01-.119.02-.238.02-.351q-.001-.125-.01-.248-.017-.178-.041-.346a4 4 0 0 0-.078-.346c-.036-.109-.072-.222-.114-.331a3.5 3.5 0 0 0-.527-.91 11 11 0 0 0-.237-.262 3 3 0 0 0-.134-.13 9 9 0 0 0-.718-.506 1 1 0 0 0-.104-.051 2 2 0 0 0-.49-.217`,"clip-rule":`evenodd`},null,-1)]])}var wQe,TQe,EQe,DQe=s((()=>{jC(),W(),wQe=AC({default:()=>EQe,render:()=>CQe}),TQe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},EQe={render:CQe}}));function OQe(e,t){return F(),I(`svg`,AQe,[...t[0]||=[R(`path`,{fill:`currentColor`,d:`M11.345 2.005c-.043.004-.18.018-.303.028-2.84.256-5.501 1.788-7.187 4.144a9.9 9.9 0 0 0-1.765 4.369c-.08.549-.09.711-.09 1.456s.01.907.09 1.456c.543 3.755 3.216 6.91 6.84 8.08.65.208 1.334.351 2.112.437.303.033 1.613.033 1.916 0 1.343-.149 2.48-.48 3.603-1.053.172-.088.205-.112.182-.131a191 191 0 0 1-1.629-2.184l-1.599-2.16-2.004-2.965a284 284 0 0 0-2.017-2.964 161 161 0 0 0-.02 2.925c-.006 2.816-.008 2.93-.043 2.996a.36.36 0 0 1-.172.178c-.063.031-.117.037-.412.037h-.339l-.09-.056a.4.4 0 0 1-.13-.143l-.042-.088.004-3.92.006-3.92.06-.077a.5.5 0 0 1 .145-.12c.08-.038.112-.042.45-.042.399 0 .465.016.569.129.03.031 1.114 1.665 2.412 3.634l3.946 5.975 1.583 2.399.08-.053a10.3 10.3 0 0 0 2.055-1.802 9.95 9.95 0 0 0 2.354-5.112c.08-.549.09-.711.09-1.456s-.01-.907-.09-1.456c-.543-3.755-3.216-6.91-6.84-8.08a10.5 10.5 0 0 0-2.083-.435c-.187-.02-1.48-.041-1.642-.026m4.094 6.048c.094.047.17.137.197.231.016.05.02 1.138.016 3.587l-.006 3.515-.62-.95-.621-.95V10.93c0-1.652.008-2.58.02-2.625a.4.4 0 0 1 .193-.247c.08-.04.11-.045.416-.045.29 0 .34.004.405.04`},null,-1)]])}var kQe,AQe,jQe,MQe=s((()=>{jC(),W(),kQe=AC({default:()=>jQe,render:()=>OQe}),AQe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},jQe={render:OQe}}));function NQe(e,t){return F(),I(`svg`,FQe,[...t[0]||=[ti(`<path fill="url(#a)" fill-rule="evenodd" d="M19.608 5.51C16.023 1.308 9.712.808 5.51 4.392 1.308 7.977.808 14.288 4.392 18.49c3.585 4.202 9.896 4.702 14.098 1.118 4.202-3.585 4.702-9.896 1.118-14.098m-4.982 5.249c.385 0 .631.417.438.75l-.056.096-3.774 6.21a.39.39 0 0 1-.33.185h-.36a.378.378 0 0 1-.366-.472l1.024-3.959a.5.5 0 0 0-.484-.625H9.145a.5.5 0 0 1-.484-.625l1.545-5.978a.46.46 0 0 1 .448-.34l.067.001h1.584a.5.5 0 0 1 .496.568l-.01.071-.604 3.533a.5.5 0 0 0 .493.585z" clip-rule="evenodd"></path><defs><radialGradient id="a" cx="0" cy="0" r="1" gradientTransform="matrix(19.5 0 0 198.851 4 12)" gradientUnits="userSpaceOnUse"><stop stop-color="#31B2F3"></stop><stop offset=".474" stop-color="#F27CEC"></stop><stop offset="1" stop-color="#FD6641"></stop></radialGradient></defs>`,2)]])}var PQe,FQe,IQe,LQe=s((()=>{jC(),W(),PQe=AC({default:()=>IQe,render:()=>NQe}),FQe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},IQe={render:NQe}}));function RQe(e,t){return F(),I(`svg`,BQe,[...t[0]||=[R(`path`,{fill:`#00DC82`,d:`M13.32 19.333h8.14c.26 0 .508-.09.733-.22.226-.129.457-.29.587-.513s.22-.476.22-.733c0-.258-.09-.51-.22-.734l-5.5-9.46a1.34 1.34 0 0 0-.513-.513 1.8 1.8 0 0 0-.807-.22c-.26 0-.508.09-.733.22-.216.12-.393.298-.514.513l-1.393 2.42L10.533 5.4c-.13-.223-.288-.458-.513-.587s-.474-.146-.733-.146c-.26 0-.509.018-.734.146-.24.146-.441.347-.586.587l-6.82 11.733c-.13.223-.147.476-.147.734 0 .257.017.51.147.733s.361.384.586.513c.225.13.474.22.734.22H7.6c2.034 0 3.515-.912 4.547-2.64l2.493-4.326 1.32-2.274 4.033 6.894H14.64zm-5.793-2.346H3.933l5.354-9.24L12 12.367l-1.797 3.132c-.687 1.122-1.468 1.488-2.676 1.488`},null,-1)]])}var zQe,BQe,VQe,HQe=s((()=>{jC(),W(),zQe=AC({default:()=>VQe,render:()=>RQe}),BQe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},VQe={render:RQe}}));function UQe(e,t){return F(),I(`svg`,GQe,[...t[0]||=[ti(`<path fill="#93D500" d="M7.285 13.5H2.007l.003.077.009.15.004.063.014.171.004.039a8.8 8.8 0 0 0 .387 1.871q0 .005.003.011l.058.173.016.044.08.216.048.124a5 5 0 0 0 .078.189l.052.117.031.07.066.14.022.046.079.16.012.024q.045.088.093.175l.004.008.02.036 4.508-2.715.017-.01a3.6 3.6 0 0 1-.33-1.179"></path><path fill="#4D5A31" d="m8.582 15.923-.013.013-3.717 3.717.057.053.105.094.055.048.127.107.034.029a8 8 0 0 0 .324.254l.006.004q.336.252.695.47l.025.016.137.08.084.048.08.045q.072.04.145.078a8 8 0 0 0 .431.21l.132-.32 1.87-4.54.007-.017a3.6 3.6 0 0 1-.584-.389"></path><path fill="#6BA43A" d="M8.195 15.553a3 3 0 0 1-.212-.262 4 4 0 0 1-.2-.296L3.27 17.713q.104.174.215.338l.007.012.003.005.007.01v.002l.019.026.001.002q.119.174.242.342l.006.007.005.007.11.142.015.019q.057.073.117.145l.028.034.155.181.094.105.053.058.024.026.07.075.028.03.125.127 3.723-3.723a3 3 0 0 1-.122-.13"></path><path fill="#4D5A31" d="m13.13 15.921-.124.096.009.016 2.714 4.506a8 8 0 0 0 1.134-.886l-3.718-3.717z"></path><path fill="#93D500" d="m15.335 20.576-.092-.153-2.534-4.206a4 4 0 0 1-.316.167 3.6 3.6 0 0 1-2.567.2c-.057-.017-.113-.04-.169-.06s-.113-.037-.168-.06L7.62 21.003l-.073.178-.063.152.014.006.016.006.004.002.133.05.167.065.085.032a9 9 0 0 0 1.88.442l.075.008.142.016.036.003.174.014.06.004.153.01.094.003.122.004.217.003a9 9 0 0 0 1.495-.126l.154-.028.088-.017.09-.02.15-.032.028-.007a9 9 0 0 0 2.124-.791l.13-.074.157-.088.107-.06.001-.001.002-.001h.001l.001-.001.002-.001.006-.004.034-.02zm-6.75-10.21.123-.097-.009-.015-2.714-4.506q-.189.123-.372.256a9 9 0 0 0-.762.629L8.57 10.35z"></path><path fill="#4D5A31" d="M4.594 6.88q-.064.065-.124.13l-.123.128a9 9 0 0 0-.753.933l-.032.046-.076.112-.104.16a8.83 8.83 0 0 0-1.375 4.397l-.005.178-.003.179h5.266q.002-.09.008-.179c.006-.089.004-.119.01-.178a3.57 3.57 0 0 1 .794-1.917q.059-.069.12-.133c.04-.044.077-.09.12-.133L4.594 6.881Zm10.864-1.306q-.01-.008-.021-.013l-.14-.083-.082-.047-.082-.046-.143-.077-.023-.012a9 9 0 0 0-.95-.426l-.024-.01a9 9 0 0 0-1.987-.498l-.074-.01-.075-.008-.143-.016-.04-.004-.17-.014-.066-.004-.146-.009-.078-.003v5.278c.27.028.54.086.8.174l3.884-3.884a9 9 0 0 0-.44-.288"></path><path fill="#6BA43A" d="M10.679 4.29q-.09 0-.179.003a9 9 0 0 0-1.113.115l-.024.004-.155.029-.087.016a6 6 0 0 0-.24.052l-.028.006a9 9 0 0 0-2.125.792l-.13.074-.156.087-.115.066h-.002l-.008.005-.03.017v.001l.093.153 2.625 4.359a4 4 0 0 1 .316-.167 3.6 3.6 0 0 1 1.536-.35V4.285q-.09.001-.178.004Z"></path><path fill="#4D5A31" d="M19.704 12.708a10 10 0 0 0-.05-.61l-.002-.014-.001-.007-.027-.201v-.006a9 9 0 0 0-.273-1.245l-.002-.008-.059-.19-.008-.025-.057-.17-.016-.046-.054-.147-.027-.07a5 5 0 0 0-.086-.216l-.04-.094-.052-.12-.03-.068-.066-.142-.021-.043-.08-.162-.012-.022-.093-.177-.003-.006a9 9 0 0 0-.504-.818l-3.886 3.886q.132.392.174.8h5.278q0-.04-.003-.08Z"></path><path fill="#6BA43A" d="M14.45 13.143q-.002.09-.01.179-.001.09-.01.178a3.57 3.57 0 0 1-.793 1.918c-.037.046-.08.088-.12.133-.04.044-.077.09-.12.132l3.723 3.723q.063-.064.124-.13l.123-.128q.415-.448.754-.935l.027-.039.082-.12.07-.108.034-.052a8.83 8.83 0 0 0 1.377-4.573l.003-.178z"></path><path fill="#424143" d="M21.279 2.722a2.467 2.467 0 0 0-3.953 2.84l-5.374 5.373a2.467 2.467 0 1 0 1.114 1.113l5.373-5.373a2.466 2.466 0 0 0 2.84-3.953"></path>`,10)]])}var WQe,GQe,KQe,qQe=s((()=>{jC(),W(),WQe=AC({default:()=>KQe,render:()=>UQe}),GQe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},KQe={render:UQe}}));function JQe(e,t){return F(),I(`svg`,XQe,[...t[0]||=[R(`path`,{stroke:`#21FA90`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M5.038 13.757v3.814m1.496-4.566 3.04 1.761 4.534-2.627V6.885L9.574 4.258 5.038 6.885v4.56m1.496 1.56v1.668m0-1.668 1.49-.91`},null,-1),R(`path`,{stroke:`#00050B`,"stroke-linecap":`round`,"stroke-linejoin":`round`,"stroke-width":`.885`,d:`m21.719 10.719 1.839 1.09v1.09l-1.84 1.091M2.834 8.13.774 9.322v5.326l2.016 1.167m3.744 1.07v1.183l3.021 1.674 2.32-1.358-.02-2.471m2.282-1.387v1.3L16.31 17.1l3.175-1.9v-5.186L16.36 8.217`},null,-1)]])}var YQe,XQe,ZQe,QQe=s((()=>{jC(),W(),YQe=AC({default:()=>ZQe,render:()=>JQe}),XQe={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},ZQe={render:JQe}}));function $Qe(e,t){return F(),I(`svg`,t$e,[...t[0]||=[R(`path`,{fill:`#61DAFB`,d:`M12.5 14.014a1.783 1.783 0 1 0 0-3.565 1.783 1.783 0 0 0 0 3.565`},null,-1),R(`path`,{stroke:`#61DAFB`,"stroke-width":`.87`,d:`M12.5 15.884c5.283 0 9.565-1.635 9.565-3.652S17.783 8.58 12.5 8.58s-9.565 1.635-9.565 3.652 4.282 3.652 9.565 3.652Z`},null,-1),R(`path`,{stroke:`#61DAFB`,"stroke-width":`.87`,d:`M9.337 14.058c2.642 4.575 6.199 7.466 7.946 6.457 1.746-1.008 1.021-5.534-1.62-10.11C13.02 5.832 9.464 2.94 7.717 3.949s-1.021 5.535 1.62 10.11Z`},null,-1),R(`path`,{stroke:`#61DAFB`,"stroke-width":`.87`,d:`M9.337 10.406c-2.641 4.575-3.366 9.1-1.62 10.11 1.747 1.008 5.304-1.883 7.946-6.458s3.366-9.101 1.62-10.11c-1.747-1.009-5.305 1.883-7.946 6.458Z`},null,-1)]])}var e$e,t$e,n$e,r$e=s((()=>{jC(),W(),e$e=AC({default:()=>n$e,render:()=>$Qe}),t$e={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},n$e={render:$Qe}}));function i$e(e,t){return F(),I(`svg`,o$e,[...t[0]||=[R(`path`,{fill:`currentColor`,d:`m21.863 11.755-.839-.52-.024-.244.722-.673a.288.288 0 0 0-.096-.482l-.923-.345-.072-.239.575-.799a.288.288 0 0 0-.187-.455l-.973-.158-.117-.218.409-.897a.286.286 0 0 0-.273-.409l-.987.034-.157-.188.228-.962a.287.287 0 0 0-.348-.348l-.96.227-.19-.157.034-.986a.287.287 0 0 0-.409-.273l-.897.409-.218-.118-.158-.972a.288.288 0 0 0-.454-.189l-.8.575-.238-.071-.345-.923a.288.288 0 0 0-.482-.096L13.01 3l-.245-.023-.52-.84a.29.29 0 0 0-.49 0l-.52.84q-.123.01-.245.023l-.673-.722a.29.29 0 0 0-.482.096l-.345.923q-.12.034-.237.072l-.8-.576a.288.288 0 0 0-.455.188l-.158.973q-.11.057-.22.118l-.895-.41a.287.287 0 0 0-.409.273l.034.988-.19.156-.96-.227a.29.29 0 0 0-.348.348l.227.962-.157.188-.987-.034a.288.288 0 0 0-.273.409l.409.897a7 7 0 0 0-.117.22l-.972.156a.288.288 0 0 0-.189.455l.575.8-.071.237-.923.346a.29.29 0 0 0-.096.482L3 10.99l-.024.244-.84.52a.29.29 0 0 0 0 .492l.84.519q.01.123.025.245l-.723.673a.29.29 0 0 0 .096.482l.922.345q.035.12.073.237l-.576.8a.29.29 0 0 0 .188.454l.973.158q.056.11.117.22l-.41.896a.288.288 0 0 0 .274.409l.987-.035q.076.096.156.19l-.227.961a.287.287 0 0 0 .348.347l.961-.226.19.156-.035.987a.288.288 0 0 0 .41.273l.896-.41q.108.06.219.119l.158.971a.288.288 0 0 0 .455.19l.799-.577q.118.038.237.072l.345.923a.287.287 0 0 0 .482.096L10.99 21q.121.014.244.025l.52.839a.29.29 0 0 0 .492 0l.519-.84q.123-.01.245-.024l.674.722a.287.287 0 0 0 .48-.096l.346-.923q.12-.034.238-.072l.8.576a.29.29 0 0 0 .454-.189l.158-.972.219-.117.896.409a.288.288 0 0 0 .41-.273l-.035-.988a7 7 0 0 0 .19-.155l.96.226a.287.287 0 0 0 .348-.347l-.226-.961.155-.19.988.035a.29.29 0 0 0 .272-.41l-.409-.896q.06-.108.117-.219l.973-.158a.287.287 0 0 0 .188-.454l-.575-.8.072-.237.922-.345a.286.286 0 0 0 .096-.482L21 13.011l.025-.245.839-.52a.29.29 0 0 0 0-.49Zm-5.619 6.965a.595.595 0 0 1 .25-1.163.595.595 0 0 1-.25 1.163m-.286-1.93a.54.54 0 0 0-.642.417l-.299 1.391a7.3 7.3 0 0 1-3.017.65c-1.1 0-2.144-.243-3.08-.679l-.299-1.39a.54.54 0 0 0-.643-.417l-1.228.263a7 7 0 0 1-.635-.748h5.976c.068 0 .113-.012.113-.074V14.09c0-.062-.046-.074-.113-.074h-1.747v-1.34h1.89c.172 0 .922.049 1.162 1.007.075.295.24 1.254.352 1.561.113.344.57 1.032 1.059 1.032h2.977a1 1 0 0 0 .108-.01q-.31.421-.677.794l-1.256-.27Zm-8.265 1.9a.594.594 0 1 1-.014-1.17.594.594 0 0 1 .014 1.171ZM5.427 9.5a.594.594 0 1 1-1.086.481.594.594 0 0 1 1.086-.481m-.697 1.65 1.28-.569a.543.543 0 0 0 .274-.715l-.263-.597h1.036v4.672h-2.09a7.3 7.3 0 0 1-.237-2.792Zm5.614-.454V9.32h2.468c.128 0 .9.148.9.725 0 .48-.592.652-1.08.652zm8.969 1.24q0 .273-.02.542h-.75c-.076 0-.106.05-.106.123v.345c0 .81-.457.987-.858 1.032-.381.043-.805-.16-.857-.394-.225-1.265-.6-1.536-1.192-2.003.735-.467 1.5-1.155 1.5-2.077 0-.996-.683-1.623-1.148-1.93-.652-.43-1.375-.517-1.57-.517h-7.76a7.3 7.3 0 0 1 4.091-2.308l.915.959a.54.54 0 0 0 .765.018l1.024-.98a7.32 7.32 0 0 1 5.006 3.566l-.7 1.583a.543.543 0 0 0 .275.715l1.35.6q.034.357.035.726m-7.754-8.004a.595.595 0 1 1 .82.86.595.595 0 0 1-.82-.86m6.951 5.595a.594.594 0 1 1 1.086.481.594.594 0 0 1-1.086-.481`},null,-1)]])}var a$e,o$e,s$e,c$e=s((()=>{jC(),W(),a$e=AC({default:()=>s$e,render:()=>i$e}),o$e={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},s$e={render:i$e}}));function l$e(e,t){return F(),I(`svg`,d$e,[...t[0]||=[R(`path`,{fill:`#FF3E00`,d:`M18.664 3.171c-2.219-3.185-6.61-4.13-9.788-2.104L3.29 4.625A6.42 6.42 0 0 0 .398 8.917a6.74 6.74 0 0 0 .666 4.332 6.4 6.4 0 0 0-.959 2.369 6.85 6.85 0 0 0 1.166 5.175c2.219 3.194 6.61 4.137 9.782 2.11l5.586-3.557a6.42 6.42 0 0 0 2.892-4.292 6.74 6.74 0 0 0-.666-4.332 6.4 6.4 0 0 0 .959-2.369 6.94 6.94 0 0 0-1.16-5.182`},null,-1),R(`path`,{fill:`#fff`,d:`M8.327 21.099a4.435 4.435 0 0 1-4.76-1.75 4.16 4.16 0 0 1-.7-3.122q.05-.261.133-.517l.105-.318.286.182a7.1 7.1 0 0 0 2.186 1.095l.208.063-.02.201c-.025.293.055.585.223.83a1.305 1.305 0 0 0 1.779.379l5.581-3.521a1.18 1.18 0 0 0 .524-.783 1.23 1.23 0 0 0-.211-.923 1.305 1.305 0 0 0-1.78-.379l-2.12 1.35q-.53.321-1.135.488a4.435 4.435 0 0 1-4.76-1.75 4.16 4.16 0 0 1-.7-3.122 3.84 3.84 0 0 1 1.736-2.573l5.581-3.559a4.3 4.3 0 0 1 1.134-.485 4.435 4.435 0 0 1 4.76 1.751c.641.908.893 2.03.7 3.122a4 4 0 0 1-.132.517l-.105.318-.287-.182a7.1 7.1 0 0 0-2.186-1.095l-.207-.063.019-.202a1.27 1.27 0 0 0-.223-.83 1.305 1.305 0 0 0-1.779-.378L6.6 9.363a1.18 1.18 0 0 0-.523.783c-.056.323.019.655.21.923a1.305 1.305 0 0 0 1.78.38l2.121-1.35c.352-.214.732-.38 1.134-.485a4.435 4.435 0 0 1 4.76 1.75 4.16 4.16 0 0 1 .7 3.122 3.8 3.8 0 0 1-1.736 2.563l-5.58 3.559c-.353.214-.732.38-1.135.489`},null,-1)]])}var u$e,d$e,f$e,p$e=s((()=>{jC(),W(),u$e=AC({default:()=>f$e,render:()=>l$e}),d$e={xmlns:`http://www.w3.org/2000/svg`,fill:`green`,viewBox:`-2 0 24 24`},f$e={render:l$e}}));function m$e(e,t){return F(),I(`svg`,g$e,[...t[0]||=[R(`path`,{fill:`#41B883`,d:`m14.31 4.34-2.31 4-2.31-4H2l10 17.32L22 4.34z`},null,-1),R(`path`,{fill:`#34495E`,d:`m14.31 4.34-2.31 4-2.31-4H6l6 10.392L18 4.34z`},null,-1)]])}var h$e,g$e,_$e,v$e=s((()=>{jC(),W(),h$e=AC({default:()=>_$e,render:()=>m$e}),g$e={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},_$e={render:m$e}})),OT,kT,y$e,b$e,x$e=s((()=>{MHe(),NHe(),PHe(),FHe(),IHe(),LHe(),RHe(),zHe(),BHe(),VHe(),HHe(),UHe(),WHe(),GHe(),KHe(),qHe(),JHe(),YHe(),XHe(),ZHe(),QHe(),$He(),eUe(),tUe(),nUe(),rUe(),cUe(),pUe(),vUe(),CUe(),OUe(),NUe(),RUe(),UUe(),JUe(),$Ue(),iWe(),lWe(),mWe(),yWe(),wWe(),kWe(),PWe(),zWe(),WWe(),YWe(),eGe(),aGe(),uGe(),hGe(),bGe(),TGe(),AGe(),FGe(),BGe(),GGe(),XGe(),tKe(),oKe(),dKe(),gKe(),xKe(),EKe(),jKe(),IKe(),VKe(),KKe(),ZKe(),nqe(),sqe(),fqe(),_qe(),Sqe(),Dqe(),Mqe(),Lqe(),Hqe(),qqe(),Qqe(),rJe(),cJe(),pJe(),vJe(),CJe(),OJe(),NJe(),RJe(),UJe(),JJe(),$Je(),iYe(),lYe(),mYe(),yYe(),wYe(),kYe(),PYe(),zYe(),WYe(),YYe(),eXe(),aXe(),uXe(),hXe(),bXe(),TXe(),AXe(),FXe(),BXe(),GXe(),XXe(),tZe(),oZe(),dZe(),gZe(),xZe(),EZe(),jZe(),IZe(),VZe(),KZe(),ZZe(),nQe(),sQe(),fQe(),_Qe(),SQe(),DQe(),MQe(),LQe(),HQe(),qQe(),QQe(),r$e(),c$e(),p$e(),v$e(),OT=Object.assign({"../icons/Add.svg":NC,"../icons/AddTab.svg":LC,"../icons/Alert.svg":VC,"../icons/ArrowLeft.svg":GC,"../icons/ArrowRight.svg":YC,"../icons/Brackets.svg":$C,"../icons/Branch.svg":rw,"../icons/Changelog.svg":sw,"../icons/Checkmark.svg":dw,"../icons/ChevronDown.svg":hw,"../icons/ChevronLeft.svg":yw,"../icons/ChevronRight.svg":Cw,"../icons/ChevronUp.svg":Dw,"../icons/Clipboard.svg":jw,"../icons/Close.svg":Fw,"../icons/CloseTab.svg":zw,"../icons/CloseTabs.svg":Uw,"../icons/Cloud.svg":qw,"../icons/CodeFolder.svg":Zw,"../icons/Cog.svg":tT,"../icons/Collection.svg":aT,"../icons/Cookie.svg":lT,"../icons/DarkMode.svg":pT,"../icons/Delete.svg":_T,"../icons/Discord.svg":xT,"../icons/DocsPage.svg":TT,"../icons/Download.svg":aUe,"../icons/Duplicate.svg":uUe,"../icons/Edit.svg":hUe,"../icons/Ellipses.svg":bUe,"../icons/Email.svg":TUe,"../icons/Error.svg":AUe,"../icons/Example.svg":FUe,"../icons/ExternalLink.svg":BUe,"../icons/FilterList.svg":GUe,"../icons/Folder.svg":XUe,"../icons/GitHub.svg":tWe,"../icons/GitHubLine.svg":oWe,"../icons/Globe.svg":dWe,"../icons/Google.svg":gWe,"../icons/Help.svg":xWe,"../icons/Hide.svg":EWe,"../icons/History.svg":jWe,"../icons/House.svg":IWe,"../icons/Import.svg":VWe,"../icons/Info.svg":KWe,"../icons/Key.svg":ZWe,"../icons/Leave.svg":nGe,"../icons/LightDarkModeToggle.svg":sGe,"../icons/LightMode.svg":fGe,"../icons/Link.svg":_Ge,"../icons/Lock.svg":SGe,"../icons/Logo.svg":DGe,"../icons/Magic.svg":MGe,"../icons/Markdown.svg":LGe,"../icons/Menu.svg":HGe,"../icons/NotAllowed.svg":qGe,"../icons/Page.svg":QGe,"../icons/Pencil.svg":rKe,"../icons/Play.svg":cKe,"../icons/Refresh.svg":pKe,"../icons/Roadmap.svg":vKe,"../icons/Scribble.svg":CKe,"../icons/Search.svg":OKe,"../icons/Server.svg":NKe,"../icons/Settings.svg":RKe,"../icons/Show.svg":UKe,"../icons/Sort.svg":JKe,"../icons/Terminal.svg":$Ke,"../icons/Trash.svg":iqe,"../icons/Unlock.svg":lqe,"../icons/Unwatch.svg":mqe,"../icons/Upload.svg":yqe,"../icons/User.svg":wqe,"../icons/UserSwitch.svg":kqe,"../icons/Users.svg":Pqe,"../icons/Versions.svg":zqe,"../icons/Wallet.svg":Wqe,"../icons/Watch.svg":Yqe,"../icons/Workspace.svg":eJe,"../icons/programming-framework-angular.svg":aJe,"../icons/programming-framework-astro.svg":uJe,"../icons/programming-framework-laravel.svg":hJe,"../icons/programming-framework-nextdotjs.svg":bJe,"../icons/programming-framework-react.svg":TJe,"../icons/programming-framework-vuedotjs.svg":AJe,"../icons/programming-language-c.svg":FJe,"../icons/programming-language-clojure.svg":BJe,"../icons/programming-language-csharp.svg":GJe,"../icons/programming-language-css3.svg":XJe,"../icons/programming-language-dart.svg":tYe,"../icons/programming-language-fsharp.svg":oYe,"../icons/programming-language-go.svg":dYe,"../icons/programming-language-html5.svg":gYe,"../icons/programming-language-http.svg":xYe,"../icons/programming-language-java.svg":EYe,"../icons/programming-language-javascript.svg":jYe,"../icons/programming-language-json.svg":IYe,"../icons/programming-language-kotlin.svg":VYe,"../icons/programming-language-node.svg":KYe,"../icons/programming-language-objc.svg":ZYe,"../icons/programming-language-ocaml.svg":nXe,"../icons/programming-language-php.svg":sXe,"../icons/programming-language-powershell.svg":fXe,"../icons/programming-language-python.svg":_Xe,"../icons/programming-language-r.svg":SXe,"../icons/programming-language-ruby.svg":DXe,"../icons/programming-language-rust.svg":MXe,"../icons/programming-language-scala.svg":LXe,"../icons/programming-language-shell.svg":HXe,"../icons/programming-language-swift.svg":qXe,"../icons/programming-language-typescript.svg":QXe,"../icons/programming-script-code.svg":rZe,"../icons/programming-tool-git.svg":cZe,"../icons/programming-tool-tailwindcss.svg":pZe}),kT=Object.assign({"../logos/Adonisjs.svg":vZe,"../logos/Astro.svg":CZe,"../logos/Docusaurus.svg":OZe,"../logos/Dotnet.svg":NZe,"../logos/Elysiajs.svg":RZe,"../logos/Express.svg":UZe,"../logos/Fastapi.svg":JZe,"../logos/Fastify.svg":$Ze,"../logos/Go.svg":iQe,"../logos/Hono.svg":lQe,"../logos/Laravel.svg":mQe,"../logos/Litestar.svg":yQe,"../logos/Nestjs.svg":wQe,"../logos/Nextjs.svg":kQe,"../logos/Nitro.svg":PQe,"../logos/Nuxt.svg":zQe,"../logos/Openapi.svg":WQe,"../logos/Platformatic.svg":YQe,"../logos/React.svg":e$e,"../logos/Rust.svg":a$e,"../logos/Svelte.svg":u$e,"../logos/Vue.svg":h$e}),y$e=e=>{let t=`../icons/${e}.svg`;return OT[t]?OT[t]:(console.warn(`Could not find icon: ${e}`),null)},b$e=e=>{let t=`../logos/${e}.svg`;return kT[t]?kT[t]:(console.warn(`Could not find icon: ${e}`),null)}})),AT,S$e=s((()=>{lf(),AT=of({variants:{size:{xs:`size-3`,sm:`size-3.5`,md:`size-4`,lg:`size-5`,xl:`size-6`,"2xl":`size-8`,"3xl":`size-10`,full:`size-full`}},defaultVariants:{size:`full`}})})),C$e,w$e=s((()=>{x$e(),S$e(),lf(),W(),C$e=N({inheritAttrs:!1,__name:`ScalarIcon`,props:{icon:{},logo:{},size:{},thickness:{},label:{}},setup(e){Ore(e=>({c07589c2:r.value}));let t=e,{cx:n}=cf(),r=U(()=>t.thickness??`2`),i=U(()=>t.label?{"aria-label":t.label}:{"aria-hidden":!0,role:`presentation`}),a=U(()=>{if(t.icon)return y$e(t.icon);if(t.logo)return b$e(t.logo)});return(t,r)=>(F(),L(kr(a.value),at($r({...j(n)(`scalar-icon`,j(AT)({size:e.size})),...i.value})),null,16))}})})),jT,MT=s((()=>{df(),w$e(),jT=uf(C$e,[[`__scopeId`,`data-v-b651bb23`]])})),T$e,E$e=s((()=>{S$e(),MT(),lf(),W(),T$e=N({inheritAttrs:!1,__name:`ScalarIconLegacyAdapter`,props:{icon:{type:[Object,Function]},label:{},weight:{},logo:{},size:{},thickness:{}},setup(e){let{cx:t}=cf();return(n,r)=>typeof e.icon==`string`?(F(),L(jT,ai({key:0},{...n.$props,...n.$attrs},{icon:e.icon}),null,16,[`icon`])):(F(),L(kr(e.icon),ai({key:1,label:e.label,weight:e.weight},j(t)(j(AT)({size:e.size}))),null,16,[`label`,`weight`]))}})})),NT,PT=s((()=>{E$e(),NT=T$e})),FT,D$e,O$e=s((()=>{FT=`scalar-tooltip`,D$e=`scalar-tooltip`}));function k$e(){if(typeof document>`u`||typeof window>`u`||BT.value)return;let e=document.getElementById(FT);e?BT.value=e:(BT.value=document.createElement(`div`),BT.value.role=`tooltip`,BT.value.id=FT,BT.value.classList.add(D$e),BT.value.classList.add(`scalar-app`),BT.value.style.setProperty(`display`,`none`),BT.value.addEventListener(`mouseleave`,IT),document.body.appendChild(BT.value))}function IT(e){M$e(e)&&(LT(),VT.value=void 0)}function A$e(e){e.key===`Escape`&&(e.stopPropagation(),IT(e))}function LT(){zT.value&&(clearTimeout(zT.value),zT.value=void 0)}function j$e(e){let t=[],n=e.parentElement;for(;n;)t.push(n),n=n.parentElement;return t}function M$e(e){let t=j(VT.value?.targetRef);if(e instanceof MouseEvent&&e.relatedTarget instanceof Element&&t){let n=j$e(e.relatedTarget);return e.relatedTarget.id!==`scalar-tooltip`&&!n.some(e=>e.id===`scalar-tooltip`)&&e.relatedTarget!==t}return!0}function RT(e){k$e();function t(t){let r=j(e.delay)??300;LT(),r>0?zT.value=setTimeout(()=>n(t),r):n(t)}function n(t){LT(),document.addEventListener(`keydown`,A$e,{once:!0,capture:!0}),VT.value=e}mr(()=>j(e.targetRef),(e,r)=>{r&&(r.removeEventListener(`mouseenter`,t),r.removeEventListener(`mouseleave`,IT),r.removeEventListener(`focus`,n),r.removeEventListener(`blur`,IT),r.removeAttribute(`aria-describedby`)),e&&(e.addEventListener(`mouseenter`,t),e.addEventListener(`mouseleave`,IT),e.addEventListener(`focus`,n),e.addEventListener(`blur`,IT),e.setAttribute(`aria-describedby`,FT))},{immediate:!0}),qt(()=>{LT();let r=j(e.targetRef);r&&(r.removeEventListener(`mouseenter`,t),r.removeEventListener(`mouseleave`,IT),r.removeEventListener(`focus`,n),r.removeEventListener(`blur`,IT),r.removeAttribute(`aria-describedby`)),j(VT.value?.targetRef)===j(e.targetRef)&&(VT.value=void 0)})}var zT,BT,VT,HT,UT=s((()=>{O$e(),W(),Qx(),zT=A(),BT=A(),VT=A(),{floatingStyles:HT}=Zx(U(()=>j(VT.value?.targetRef)),BT,{placement:U(()=>j(VT.value?.placement)),whileElementsMounted:Ix,middleware:U(()=>[Wx(),Ux()])}),mr(HT,()=>{BT.value&&(BT.value.style.position=HT.value.position,BT.value.style.top=HT.value.top,BT.value.style.left=HT.value.left,BT.value.style.transform=HT.value.transform??``,BT.value.style.willChange=HT.value.willChange??``)}),mr(VT,e=>{if(BT.value)if(e){let t=j(e?.contentTarget)??`textContent`;BT.value[t]=j(e?.content)??``;let n=j(e?.offset)??4;BT.value.style.setProperty(`--scalar-tooltip-offset`,`${n}px`),BT.value.style.setProperty(`display`,`block`)}else BT.value.innerHTML=``,BT.value.style.removeProperty(`--scalar-tooltip-offset`),BT.value.style.setProperty(`display`,`none`)},{deep:!0})})),N$e=s((()=>{OC(),UT(),W()})),P$e=s((()=>{N$e()})),F$e,I$e=s((()=>{UT(),W(),F$e=N({__name:`ScalarTooltip`,props:{content:{default:``},delay:{default:()=>300},placement:{default:`top`},offset:{default:()=>4}},setup(e){let t=A(null);return RT({content:U(()=>e.content),delay:U(()=>e.delay),placement:U(()=>e.placement),offset:U(()=>e.offset),targetRef:U(()=>t.value?.children?.[0]||t.value||void 0)}),(e,n)=>(F(),I(`div`,{ref_key:`wrapperRef`,ref:t,class:O({contents:!!e.$slots.default})},[P(e.$slots,`default`)],2))}})})),WT,L$e=s((()=>{I$e(),WT=F$e})),R$e,z$e,B$e,V$e=s((()=>{E_e(),PT(),UT(),lf(),W(),R$e=[`aria-disabled`],z$e={key:0,class:`sr-only`},B$e=N({inheritAttrs:!1,__name:`ScalarIconButton`,props:{label:{},icon:{type:[Object,Function]},disabled:{type:Boolean},variant:{default:`ghost`},size:{default:`md`},thickness:{},weight:{},tooltip:{type:[Boolean,String,Object]}},setup(e){let t=of({base:`scalar-icon-button grid aspect-square cursor-pointer rounded`,variants:{size:{xxs:`size-3.5 p-0.5`,xs:`size-5 p-1`,sm:`size-6 p-1`,md:`size-10 p-3`,full:`size-full`},disabled:{true:`cursor-not-allowed shadow-none`},variant:hf},compoundVariants:[{size:`md`,variant:`ghost`,class:`size-8 p-2 m-1 -outline-offset-2 rounded-lg`}]}),{cx:n}=cf(),r=wr(`ref`);return RT({content:U(()=>e.label),offset:U(()=>e.variant===`ghost`?0:4),placement:U(()=>typeof e.tooltip==`boolean`?void 0:e.tooltip),targetRef:U(()=>e.tooltip?r.value:void 0)}),(r,i)=>(F(),I(`button`,ai({ref:`ref`,"aria-disabled":e.disabled,type:`button`},j(n)(j(t)({size:e.size,variant:e.variant,disabled:e.disabled}))),[H(j(NT),{icon:e.icon,thickness:e.thickness,weight:e.weight},null,8,[`icon`,`thickness`,`weight`]),e.tooltip?B(``,!0):(F(),I(`span`,z$e,k(e.label),1))],16,R$e))}})})),GT,KT=s((()=>{V$e(),GT=B$e})),H$e,U$e,W$e=s((()=>{lf(),W(),Ry(),H$e=[`innerHTML`],U$e=N({inheritAttrs:!1,__name:`ScalarMarkdown`,props:{value:{},withImages:{type:Boolean,default:!1},withAnchors:{type:Boolean,default:!1},transform:{type:Function},transformType:{},clamp:{},anchorPrefix:{}},setup(e,{expose:t}){let{cx:n}=cf();t({el:wr(`div`)});let r=t=>{if(!e.withAnchors)return e.transform?.(t)||t;if(!Ey(t))return t;let n=Ty(t).toLowerCase().replace(/\s+/g,`-`);return t.data={hProperties:{id:e.anchorPrefix?`${e.anchorPrefix}/description/${n}`:n}},e.transform?e.transform(t):t},i=U(()=>WBe(e.value??``,{removeTags:e.withImages?[]:[`img`,`picture`],transform:e.withAnchors&&e.transformType===`heading`?r:e.transform,transformType:e.transformType}));return(t,r)=>(F(),I(`div`,ai({ref:`div`},j(n)(`markdown`,{"line-clamp-(--markdown-clamp)":!!e.clamp}),{style:{"--markdown-clamp":e.clamp},innerHTML:i.value}),null,16,H$e))}})})),qT,G$e=s((()=>{W$e(),qT=U$e})),K$e,q$e,J$e=s((()=>{G$e(),lf(),W(),Zf(),K$e=[`aria-controls`,`aria-expanded`],q$e=N({inheritAttrs:!1,__name:`ScalarMarkdownSummary`,props:Lr({value:{},withImages:{type:Boolean},withAnchors:{type:Boolean},transform:{type:Function},transformType:{},clamp:{default:1},anchorPrefix:{},controlled:{type:Boolean}},{modelValue:{type:Boolean,default:!1},modelModifiers:{},truncated:{type:Boolean,default:!1},truncatedModifiers:{}}),emits:[`update:modelValue`,`update:truncated`],setup(e){let t=rne(e,[`clamp`]),n=Sr(),r=Ur(e,`modelValue`),i=Ur(e,`truncated`),a=wr(`scalar-markdown`);rye(()=>a.value?.el,o);function o(){let e=a.value?.el;e&&(i.value=e.scrollHeight>e.clientHeight||e.scrollWidth>e.clientWidth)}Hi(o);let{cx:s}=cf();return(a,o)=>(F(),I(`div`,at($r(j(s)(`group/summary flex gap-0.5`,r.value?`flex-col`:`flex-row items-baseline`))),[H(qT,ai(t,{id:j(n),ref:`scalar-markdown`,clamp:r.value?void 0:e.clamp,class:{"markdown-summary truncate":!r.value}}),null,16,[`id`,`clamp`,`class`]),!e.controlled&&(i.value||r.value)?(F(),I(`button`,{key:0,"aria-controls":j(n),"aria-expanded":r.value,class:O([`whitespace-nowrap font-medium hover:underline`,{"self-end":r.value}]),type:`button`,onClick:o[0]||=e=>r.value=!r.value},[P(a.$slots,`button`,{open:r.value},()=>[z(k(r.value?` Show Less`:`More`),1)])],10,K$e)):B(``,!0)],16))}})})),JT,Y$e=s((()=>{J$e(),JT=q$e})),X$e,Z$e,Q$e,$$e,e1e=s((()=>{hC(),MT(),W(),Ou(),X$e={class:`h-5 w-auto`},Z$e={key:0,class:`ml-1 truncate text-sm font-medium`},Q$e={class:`sr-only`},$$e=N({__name:`ScalarMenuButton`,props:{open:{type:Boolean}},setup(e){return(t,n)=>(F(),L(j(mC),{class:`gap-0.75 px-2 py-1.5 text-c-header-1 hover:bg-b-header-2`},{default:M(()=>[R(`div`,X$e,[P(t.$slots,`logo`,{},()=>[H(j(jT),{icon:`Logo`})])]),t.$slots.title?(F(),I(`span`,Z$e,[P(t.$slots,`title`)])):B(``,!0),R(`span`,Q$e,[P(t.$slots,`label`,{},()=>[z(k(e.open?`Close Menu`:`Open Menu`),1)])]),H(j(tl),{class:O([`shrink-0 text-c-header-2 group-hover/button:text-c-header-1 size-3.5`,e.open?`rotate-180`:``]),weight:`bold`},null,8,[`class`])]),_:3}))}})})),t1e,n1e=s((()=>{e1e(),t1e=$$e})),r1e,i1e,a1e=s((()=>{YS(),PT(),lf(),W(),r1e={key:1,class:`size-3`},i1e=N({inheritAttrs:!1,__name:`ScalarMenuLink`,props:{is:{default:`a`},icon:{type:[Object,Function]},strong:{type:Boolean},submenu:{type:Boolean}},setup(t){let{cx:n}=cf();return(r,i)=>(F(),L(j(JS),ai(j(n)(`flex items-center`),{is:t.submenu?j(e.DropdownMenu).SubTrigger:j(e.DropdownMenu).Item,as:t.is}),{default:M(()=>[t.icon?(F(),L(j(NT),{key:0,class:O([t.strong?`text-c-1`:`text-c-2`,typeof t.icon==`string`?`size-3`:`size-3.5 -mx-px`]),icon:t.icon,thickness:t.strong?`2.5`:`2`,weight:t.strong?`bold`:`regular`},null,8,[`class`,`icon`,`thickness`,`weight`])):(F(),I(`div`,r1e)),R(`div`,{class:O([`flex items-center flex-1 min-w-0 truncate`,t.strong?`font-medium`:`font-normal`])},[P(r.$slots,`default`)],2)]),_:3},16,[`is`,`as`]))}})})),YT,XT=s((()=>{a1e(),YT=i1e})),o1e,s1e=s((()=>{XT(),lf(),W(),o1e=N({inheritAttrs:!1,__name:`ScalarMenuProduct`,props:{is:{default:`a`},selected:{type:Boolean},icon:{type:[Object,Function]}},setup(e){let{cx:t}=cf(),n=of({base:`gap-1.5`,variants:{selected:{true:`pointer-events-none bg-b-2 dark:bg-b-3`,false:`cursor-pointer hover:bg-b-2 dark:hover:bg-b-3`}}});return(r,i)=>(F(),L(j(YT),ai({is:e.is,icon:e.icon,strong:``,target:`_blank`},j(t)(j(n)({selected:e.selected}))),{default:M(()=>[P(r.$slots,`default`)]),_:3},16,[`is`,`icon`]))}})})),ZT,c1e=s((()=>{s1e(),ZT=o1e})),l1e,u1e=s((()=>{c1e(),lf(),W(),Ou(),l1e=N({inheritAttrs:!1,__name:`ScalarMenuProducts`,props:{selected:{},showDocs:{type:Boolean},hrefs:{}},emits:[`open`],setup(e){let{cx:t}=cf();return(n,r)=>(F(),I(`div`,at($r(j(t)(`flex flex-col`))),[H(ZT,{href:e.hrefs?.dashboard??`https://dashboard.scalar.com`,icon:j(pde),selected:e.selected===`dashboard`,onClick:r[0]||=e=>n.$emit(`open`,e,`dashboard`)},{default:M(()=>[...r[4]||=[z(` Dashboard `,-1)]]),_:1},8,[`href`,`icon`,`selected`]),e.showDocs||e.selected===`docs`?(F(),L(ZT,{key:0,href:e.hrefs?.docs??`https://docs.scalar.com`,icon:j(Gc),selected:e.selected===`docs`,onClick:r[1]||=e=>n.$emit(`open`,e,`docs`)},{default:M(()=>[...r[5]||=[z(` Docs `,-1)]]),_:1},8,[`href`,`icon`,`selected`])):B(``,!0),H(ZT,{href:e.hrefs?.editor??`https://editor.scalar.com`,icon:j(Ife),selected:e.selected===`editor`,onClick:r[2]||=e=>n.$emit(`open`,e,`editor`)},{default:M(()=>[...r[6]||=[z(` Editor `,-1)]]),_:1},8,[`href`,`icon`,`selected`]),H(ZT,{href:e.hrefs?.client??`https://client.scalar.com`,icon:j(Wc),selected:e.selected===`client`,onClick:r[3]||=e=>n.$emit(`open`,e,`client`)},{default:M(()=>[...r[7]||=[z(` Client `,-1)]]),_:1},8,[`href`,`icon`,`selected`])],16))}})})),QT,d1e=s((()=>{u1e(),QT=l1e})),f1e,p1e=s((()=>{$S(),W(),f1e=N({inheritAttrs:!1,__name:`ScalarMenuSection`,setup(e){return(e,t)=>(F(),I(V,null,[H(j(QS)),P(e.$slots,`default`)],64))}})})),$T,eE=s((()=>{p1e(),$T=f1e})),m1e,h1e=s((()=>{XT(),eE(),W(),Ou(),m1e=N({__name:`ScalarMenuResources`,setup(e){return(e,t)=>(F(),L($T,null,{title:M(()=>[...t[0]||=[z(`Resources`,-1)]]),default:M(()=>[H(YT,{href:`mailto:support@scalar.com`,icon:j(ru),target:`_blank`},{default:M(()=>[...t[1]||=[z(` Sales & Support `,-1)]]),_:1},8,[`icon`]),H(YT,{href:`https://scalar.com/terms-and-conditions`,icon:j(Mle),target:`_blank`},{default:M(()=>[...t[2]||=[z(` Terms & Conditions `,-1)]]),_:1},8,[`icon`]),H(YT,{href:`https://scalar.com/privacy-policy`,icon:j(Cce),target:`_blank`},{default:M(()=>[...t[3]||=[z(` Privacy Policy `,-1)]]),_:1},8,[`icon`])]),_:1}))}})})),tE,g1e=s((()=>{h1e(),tE=m1e})),_1e,v1e=s((()=>{VS(),n1e(),d1e(),g1e(),W(),_1e=N({inheritAttrs:!1,__name:`ScalarMenu`,setup(t){let n=A(!1);function r(){n.value=!1}return(t,i)=>(F(),L(j(e.DropdownMenu).Root,{open:n.value,"onUpdate:open":i[0]||=e=>n.value=e},{default:M(()=>[H(j(e.DropdownMenu).Trigger,{asChild:``},{default:M(()=>[P(t.$slots,`button`,{open:n.value},()=>[H(t1e,{class:`min-w-0`,open:n.value},jr({_:2},[t.$slots.logo?{name:`logo`,fn:M(()=>[P(t.$slots,`logo`)]),key:`0`}:void 0,t.$slots.title?{name:`title`,fn:M(()=>[P(t.$slots,`title`)]),key:`1`}:void 0,t.$slots.label?{name:`label`,fn:M(()=>[P(t.$slots,`label`)]),key:`2`}:void 0]),1032,[`open`])])]),_:3}),H(j(e.DropdownMenu).Content,ai({align:`start`,as:j(BS),class:`max-h-radix-popper z-context`,sideOffset:5},t.$attrs),{default:M(()=>[P(t.$slots,`products`,{close:r},()=>[H(QT)]),P(t.$slots,`profile`,{close:r}),P(t.$slots,`sections`,{close:r},()=>[H(tE)])]),_:3},16,[`as`])]),_:3},8,[`open`]))}})})),y1e,b1e=s((()=>{v1e(),y1e=_1e})),x1e,S1e=s((()=>{XT(),eE(),W(),Ou(),x1e=N({__name:`ScalarMenuSupport`,setup(e){return(e,t)=>(F(),L($T,null,{title:M(()=>[...t[0]||=[z(`Resources`,-1)]]),default:M(()=>[H(YT,{href:`https://discord.gg/scalar`,icon:j(Yl),target:`_blank`},{default:M(()=>[...t[1]||=[z(` Discord `,-1)]]),_:1},8,[`icon`]),H(YT,{href:`https://github.com/scalar/scalar`,icon:j(Due),target:`_blank`},{default:M(()=>[...t[2]||=[z(` GitHub `,-1)]]),_:1},8,[`icon`])]),_:1}))}})})),C1e,w1e=s((()=>{S1e(),C1e=x1e})),T1e=s((()=>{lf(),W()})),E1e=s((()=>{T1e()})),D1e=s((()=>{sS(),VS(),YS(),XT(),E1e(),W()})),O1e=s((()=>{D1e()})),k1e,A1e,j1e=s((()=>{sS(),VS(),YS(),XT(),W(),Ou(),k1e={class:`flex h-full items-center gap-1 flex-1 truncate`},A1e=N({inheritAttrs:!1,__name:`ScalarMenuWorkspacePicker`,props:Lr({workspaceOptions:{}},{modelValue:{},modelModifiers:{}}),emits:Lr([`createWorkspace`],[`update:modelValue`]),setup(t,{emit:n}){let r=n,i=Ur(t,`modelValue`);return(n,a)=>(F(),L(j(e.DropdownMenu).Sub,null,{default:M(()=>[H(YT,ai({icon:j(Rpe),submenu:``},n.$attrs),{default:M(()=>[a[2]||=R(`div`,null,`Change workspace`,-1),H(j(ll),{class:`ml-auto text-c-2 -mr-px size-3`,weight:`bold`})]),_:1},16,[`icon`]),H(j(e.DropdownMenu).Portal,null,{default:M(()=>[H(j(e.DropdownMenu).SubContent,{as:j(BS),class:`max-h-radix-popper z-context-plus`,sideOffset:3},{default:M(()=>[H(j(e.DropdownMenu).RadioGroup,{modelValue:i.value,"onUpdate:modelValue":a[0]||=e=>i.value=e,class:`contents`},{default:M(()=>[(F(!0),I(V,null,Ar(t.workspaceOptions,(n,r)=>(F(),I(V,{key:r},[n.label?(F(),L(j(e.DropdownMenu).Label,{key:0,class:`px-3 py-1.5 text-xs font-medium text-c-3 select-none`},{default:M(()=>[z(k(n.label),1)]),_:2},1024)):B(``,!0),(F(!0),I(V,null,Ar(n.options,t=>(F(),L(j(e.DropdownMenu).RadioItem,{key:t.id,as:j(JS),class:`group/item flex items-center`,value:t.id},{default:M(()=>[R(`div`,k1e,k(t.label),1),H(j(oS),{class:`ml-auto`,selected:t.id===i.value},null,8,[`selected`])]),_:2},1032,[`as`,`value`]))),128)),r<t.workspaceOptions.length-1?(F(),L(j(e.DropdownMenu).Separator,{key:1,class:`h-px bg-b-3 my-1.5`})):B(``,!0)],64))),128))]),_:1},8,[`modelValue`]),H(j(e.DropdownMenu).Item,{as:j(JS),class:`flex items-center`,onClick:a[1]||=e=>r(`createWorkspace`)},{default:M(()=>[H(j(xu),{class:`bg-b-3 -ml-0.75 rounded p-1 size-5 text-c-3`,weight:`bold`}),a[3]||=z(` Create workspace `,-1)]),_:1},8,[`as`])]),_:1},8,[`as`])]),_:1})]),_:1}))}})})),M1e,N1e=s((()=>{j1e(),M1e=A1e}));function nE(){return fn({open:!1,show(){this.open=!0},hide(){this.open=!1}})}var P1e,F1e,I1e,L1e=s((()=>{KT(),lf(),W(),Ou(),Rc(),P1e={key:0,class:`close-button z-10 fixed right-2 top-2`},F1e={},I1e=N({...F1e,__name:`ScalarModal`,props:{state:{},title:{},bodyClass:{},maxWidth:{},size:{default:`md`},variant:{}},emits:[`close`],setup(e,{emit:t}){let n=t,r=of({base:[`scalar-modal`,`flex flex-col relative mb-0 rounded-lg bg-b-1 p-0 text-left leading-snug text-c-1 opacity-0 w-[calc(100vw-12px)] md:w-[calc(100vw-16px)] lg:w-[calc(100vw-32px)]`].join(` `),variants:{size:{xxs:`mt-[20svh] max-h-[60svh] max-w-[360px]`,xs:`mt-[20svh] max-h-[60svh] max-w-[480px]`,sm:`mt-[20svh] max-h-[60svh] max-w-[540px]`,md:`mt-[20svh] max-h-[60svh] max-w-[640px]`,lg:`m-auto max-h-[80svh] max-w-[800px]`,xl:`m-auto max-h-[90svh] max-w-[1000px]`,full:`full-size-styles max-h-dvh mt-0 lg:w-full`},variant:{form:`scalar-modal-form`,search:`scalar-modal-search mt-[15svh] max-h-[60svh] max-w-[540px]`,error:`scalar-modal-error`}}}),i=of({base:[`scalar-modal-body`,`relative flex-1 min-h-0 p-3`].join(` `),variants:{variant:{form:`overflow-visible`,search:`flex flex-col !m-0 overflow-hidden p-0`,error:`overflow-y-scroll`},size:{xxs:``,xs:``,sm:``,md:``,lg:``,xl:`m-0 p-0`,full:` rounded-none`}}});return(t,a)=>(F(),L(j(foe),{open:e.state.open,onClose:a[1]||=()=>{e.state.hide(),n(`close`)}},{default:M(()=>[R(`div`,{class:O(j(sf)(e.size===`full`?`scalar-modal-layout-full`:`scalar-modal-layout`,`fixed left-0 top-0 flex items-start justify-center`,`z-overlay h-dvh w-dvw`,`bg-backdrop opacity-0 dark:bg-backdrop-dark`,e.size===`full`&&`flex`))},[H(j(poe),{class:O(j(r)({size:e.size,variant:e.variant})),style:it({maxWidth:e.maxWidth})},{default:M(()=>[e.title?(F(),L(j(moe),{key:0,class:`scalar-modal-header m-0 -mb-1 rounded-lg pt-3 px-3 text-left text-sm font-medium text-c-1`},{default:M(()=>[z(k(e.title),1)]),_:1})):B(``,!0),e.size===`full`?(F(),I(`div`,{key:1,class:O(e.bodyClass)},[P(t.$slots,`default`,{},void 0,!0)],2)):(F(),I(`div`,{key:2,class:O(j(sf)(j(i)({size:e.size,variant:e.variant}),e.bodyClass))},[P(t.$slots,`default`,{},void 0,!0)],2))]),_:3},8,[`class`,`style`]),e.size===`full`?(F(),I(`div`,P1e,[H(j(GT),{class:`hover:bg-b-3 focus:outline-none`,icon:j(Du),label:`Close modal`,onClick:a[0]||=t=>e.state.hide()},null,8,[`icon`])])):B(``,!0)],2)]),_:3},8,[`open`]))}})})),rE,R1e=s((()=>{df(),L1e(),rE=uf(I1e,[[`__scopeId`,`data-v-5bb1dcc2`]])})),z1e,B1e=s((()=>{tS(),iS(),lf(),W(),Rc(),z1e=N({inheritAttrs:!1,__name:`ScalarPopover`,props:{focus:{type:Boolean},placement:{},offset:{type:[Number,Object,Function]},resize:{type:Boolean},target:{},middleware:{},teleport:{type:[Boolean,String]}},setup(e){let{cx:t}=cf();return(n,r)=>(F(),L(j(_c),{as:`template`},{default:M(({open:r})=>[H(j(eS),at($r(n.$props)),{floating:M(({width:i,height:a})=>[H(j(yc),ai({focus:e.focus,style:{width:i,height:a}},j(t)(`relative flex flex-col p-0.75`)),{default:M(({close:e})=>[P(n.$slots,`popover`,{close:()=>e(),open:r}),P(n.$slots,`backdrop`,{open:r},()=>[H(j(rS))])]),_:2},1040,[`focus`,`style`])]),default:M(()=>[H(j(vc),{as:`template`},{default:M(()=>[P(n.$slots,`default`,{open:r})]),_:2},1024)]),_:2},1040)]),_:3}))}})})),iE,V1e=s((()=>{B1e(),iE=z1e})),H1e=s((()=>{_f(),lf(),W()})),U1e=s((()=>{H1e()})),W1e,G1e,K1e=s((()=>{pf(),KT(),lf(),W(),Ou(),W1e=[`aria-label`],G1e=N({inheritAttrs:!1,__name:`ScalarSearchInput`,props:Lr({loader:{},label:{}},{modelValue:{},modelModifiers:{}}),emits:[`update:modelValue`],setup(e){let t=Ur(e,`modelValue`),n=A(null);function r(){t.value=``,n.value&&n.value.focus()}let{stylingAttrsCx:i,otherAttrs:a}=cf();return(o,s)=>(F(),I(`label`,at($r(j(i)(`flex items-center text-lg font-medium h-10 pl-3 pr-1.5 py-2 gap-2.25`))),[H(j(vu),{class:`text-sidebar-c-search size-4`}),lr(R(`input`,ai({ref_key:`inputRef`,ref:n},j(a),{"onUpdate:modelValue":s[0]||=e=>t.value=e,"aria-label":e.label??`Enter search query`,autocapitalize:`off`,autocomplete:`off`,autocorrect:`off`,class:`flex-1 appearance-none rounded border-none bg-transparent outline-none`,placeholder:`Search...`,spellcheck:`false`,type:`search`}),null,16,W1e),[[lo,t.value]]),e.loader&&e.loader.isActive?(F(),L(j(ff),{key:0,class:`mr-1`,loader:e.loader,size:`lg`},null,8,[`loader`])):t.value?(F(),L(j(GT),{key:1,class:`-my-1`,icon:j(Du),label:`Clear Search`,size:`sm`,weight:`bold`,onClick:po(r,[`stop`,`prevent`])},null,8,[`icon`])):B(``,!0)],16))}})})),aE,q1e=s((()=>{K1e(),aE=G1e})),J1e,Y1e,X1e,Z1e,Q1e,$1e,e0e,t0e,n0e=s((()=>{PT(),lf(),W(),J1e=[`aria-selected`],Y1e={key:0,class:`flex h-fit items-center text-sm font-medium text-c-3 group-hover:text-c-1`},X1e={class:`flex min-w-0 flex-1 flex-col gap-0.5`},Z1e={class:`flex items-center gap-1`},Q1e={class:`flex-1 truncate zoomed:whitespace-normal! wrap-break-word font-medium`},$1e={key:0,class:`text-base text-c-2`},e0e={key:0,class:`truncate zoomed:whitespace-normal! wrap-break-word text-c-2`},t0e=N({inheritAttrs:!1,__name:`ScalarSearchResultItem`,props:{icon:{type:[Object,Function]},selected:{type:Boolean}},setup(e){let{cx:t}=cf();return(n,r)=>(F(),I(`a`,ai({"aria-selected":e.selected,role:`option`,tabindex:`-1`},j(t)(`group flex cursor-pointer gap-2 rounded px-2 py-1.5 no-underline hover:bg-b-2 text-base/5`,{"bg-b-2":e.selected})),[e.icon?(F(),I(`div`,Y1e,[P(n.$slots,`icon`,{},()=>[e.icon?(F(),L(j(NT),{key:0,class:`size-4`,icon:e.icon},null,8,[`icon`])):B(``,!0)]),r[0]||=R(`span`,null,` `,-1)])):B(``,!0),R(`div`,X1e,[R(`div`,Z1e,[R(`div`,Q1e,[P(n.$slots,`default`)]),n.$slots.addon?(F(),I(`div`,$1e,[P(n.$slots,`addon`)])):B(``,!0)]),n.$slots.description?(F(),I(`div`,e0e,[P(n.$slots,`description`)])):B(``,!0)])],16,J1e))}})})),r0e,i0e=s((()=>{n0e(),r0e=t0e})),a0e,o0e=s((()=>{lf(),W(),a0e=N({inheritAttrs:!1,__name:`ScalarSearchResultList`,props:{noResults:{type:Boolean}},setup(e){let{cx:t}=cf();return(n,r)=>(F(),I(`div`,ai({role:`listbox`},j(t)(`flex flex-col`)),[e.noResults?P(n.$slots,`noResults`,{key:0},()=>[r[0]||=R(`div`,{class:`flex flex-col items-center gap-2 px-3 py-4`},[R(`div`,{class:`text-base font-medium text-c-2`,role:`alert`},` No results found `)],-1)]):B(``,!0),P(n.$slots,`default`)],16))}})})),s0e,c0e=s((()=>{o0e(),s0e=a0e})),l0e,u0e=s((()=>{lf(),W(),l0e=N({inheritAttrs:!1,__name:`ScalarSidebar`,setup(e){let{cx:t}=cf();return(e,n)=>(F(),I(`aside`,at($r(j(t)(`flex flex-col border-r bg-sidebar-b-1 border-sidebar-border w-72`))),[P(e.$slots,`default`)],16))}})})),d0e,f0e=s((()=>{u0e(),d0e=l0e})),p0e,m0e=s((()=>{lf(),W(),p0e=N({inheritAttrs:!1,__name:`ScalarSidebarIndent`,props:{indent:{default:0},selected:{type:Boolean,default:!1},disabled:{type:Boolean}},setup(e){let t=U(()=>Array.from({length:e.indent},(e,t)=>t)),{cx:n}=cf();return(r,i)=>(F(),I(`div`,at($r(j(n)(`scalar-sidebar-indent flex justify-center`,{"mr-[calc(20px-var(--scalar-sidebar-indent))]":e.indent>0,"scalar-sidebar-indent-selected":e.selected}))),[(F(!0),I(V,null,Ar(t.value,(n,r)=>(F(),I(`div`,{key:n,class:`relative w-[var(--scalar-sidebar-indent)]`},[i[0]||=R(`div`,{class:`scalar-sidebar-indent-border absolute left-2 inset-y-0 w-border bg-sidebar-indent-border`},null,-1),r===t.value.length-1?(F(),I(`div`,{key:0,class:O([`absolute left-2 inset-y-0 w-border`,e.disabled?``:e.selected?`bg-sidebar-indent-border-active`:`group-hover/button:bg-sidebar-indent-border-hover`])},null,2)):B(``,!0)]))),128))],16))}})})),oE,sE=s((()=>{df(),m0e(),oE=uf(p0e,[[`__scopeId`,`data-v-3e080c68`]])})),h0e,g0e,_0e,v0e=s((()=>{PT(),sE(),lf(),W(),h0e={key:0,class:`h-lh *:size-4 mr-1 flex items-center`},g0e={class:`group/button-label flex-1 min-w-0`},_0e=N({inheritAttrs:!1,__name:`ScalarSidebarButton`,props:{is:{default:`a`},icon:{type:[Object,Function]},active:{type:Boolean},selected:{type:Boolean},disabled:{type:Boolean},indent:{default:0}},setup(e){let t=of({base:[`group/button peer/button flex items-stretch rounded p-2`,`font-sidebar text-base/4  text-sidebar-c-2 no-underline wrap-break-word`],variants:{active:{true:`text-sidebar-c-active font-sidebar-active`},disabled:{true:`cursor-auto`},selected:{true:`cursor-auto bg-sidebar-b-active text-sidebar-c-active font-sidebar-active`}},compoundVariants:[{selected:!1,disabled:!1,active:!1,class:`hover:bg-sidebar-b-hover hover:text-sidebar-c-hover`},{selected:!1,disabled:!1,active:!0,class:`hover:bg-sidebar-b-hover`}],defaultVariants:{selected:!1,disabled:!1,active:!1}}),{cx:n}=cf();return(r,i)=>(F(),L(kr(e.is),ai({"aria-selected":e.selected,type:e.is===`button`?`button`:void 0},j(n)(j(t)({selected:e.selected,disabled:e.disabled,active:e.active}))),{default:M(()=>[P(r.$slots,`indent`,{},()=>[H(oE,{class:`-my-2`,disabled:e.disabled,indent:e.indent,selected:e.selected},null,8,[`disabled`,`indent`,`selected`])]),e.icon||r.$slots.icon?(F(),I(`div`,h0e,[P(r.$slots,`icon`,{},()=>[e.icon?(F(),L(j(NT),{key:0,icon:e.icon},null,8,[`icon`])):B(``,!0)])])):B(``,!0),R(`div`,g0e,[P(r.$slots,`default`)]),P(r.$slots,`aside`)]),_:3},16,[`aria-selected`,`type`]))}})})),cE,lE=s((()=>{v0e(),cE=_0e})),y0e,b0e,x0e,S0e=s((()=>{ib(),lf(),W(),y0e={class:`flex items-center`},b0e={class:`flex-1 min-w-0 flex items-center text-sm text-sidebar-c-2`},x0e=N({inheritAttrs:!1,__name:`ScalarSidebarFooter`,setup(e){let{cx:t}=cf();return(e,n)=>(F(),I(`div`,at($r(j(t)(`flex flex-col gap-3 px-3 pb-3 border-sidebar-border`))),[P(e.$slots,`default`),R(`div`,y0e,[R(`div`,b0e,[P(e.$slots,`description`,{},()=>[n[0]||=R(`a`,{class:`no-underline hover:underline`,href:`https://www.scalar.com`,target:`_blank`},` Powered by Scalar `,-1)])]),P(e.$slots,`toggle`,{},()=>[H(j(rb))])])],16))}})})),C0e,w0e=s((()=>{S0e(),C0e=x0e})),T0e,E0e,D0e=s((()=>{PT(),lf(),W(),Ou(),T0e={class:`sr-only`},E0e=N({inheritAttrs:!1,__name:`ScalarSidebarGroupToggle`,props:{is:{default:`div`},open:{type:Boolean,default:!1},icon:{type:[Object,Function]}},setup(e){let t=of({base:`size-4 flex items-center justify-center transition-transform duration-100`,variants:{open:{true:`rotate-90`}},defaultVariants:{open:!1}}),{cx:n}=cf();return(r,i)=>(F(),L(kr(e.is),ai({type:e.is===`button`?`button`:void 0},j(n)(j(t)({open:e.open}))),{default:M(()=>[P(r.$slots,`default`,{open:e.open},()=>[e.icon?(F(),L(j(NT),{key:0,icon:e.icon},null,8,[`icon`])):(F(),L(j(ll),{key:1,class:`size-3`,weight:`bold`}))]),R(`span`,T0e,[P(r.$slots,`label`,{open:e.open},()=>[z(k(e.open?`Close`:`Open`)+` Group `,1)])])]),_:3},16,[`type`]))}})})),uE,O0e=s((()=>{D0e(),uE=E0e})),dE,fE,pE=s((()=>{W(),dE=Symbol(),fE=(e={})=>{let{increment:t=!1,reset:n=!1}=e,r=fr(dE,0);return n?dr(dE,0):t&&r<6?dr(dE,r+1):dr(dE,r),{level:r}}})),k0e,A0e=s((()=>{lE(),pE(),lf(),W(),k0e=N({inheritAttrs:!1,__name:`ScalarSidebarItem`,props:{is:{},icon:{type:[Object,Function]},active:{type:Boolean},selected:{type:Boolean},disabled:{type:Boolean},indent:{}},setup(e){let t=e,{level:n}=fE(),{cx:r}=cf();return(i,a)=>(F(),I(`li`,at($r(j(r)(`group/item flex flex-col text-base`))),[P(i.$slots,`before`),P(i.$slots,`button`,{level:j(n)},()=>[H(cE,ai(t,{indent:e.indent??j(n)}),jr({_:2},[i.$slots.default?{name:`default`,fn:M(()=>[P(i.$slots,`default`)]),key:`0`}:void 0,i.$slots.icon?{name:`icon`,fn:M(()=>[P(i.$slots,`icon`)]),key:`1`}:void 0,i.$slots.aside?{name:`aside`,fn:M(()=>[P(i.$slots,`aside`)]),key:`2`}:void 0]),1040,[`indent`])]),P(i.$slots,`after`)],16))}})})),mE,j0e=s((()=>{A0e(),mE=k0e})),M0e,N0e=s((()=>{j0e(),W(),M0e=N({__name:`ScalarSidebarLoading`,props:{items:{default:4}},setup(e){return(t,n)=>(F(!0),I(V,null,Ar(e.items,e=>(F(),L(mE,{key:e,class:`pointer-events-none`},{default:M(()=>[...n[0]||=[R(`div`,{class:`group/button-loading bg-sidebar-c-2/15 rounded-lg animate-pulse h-lh w-full box-content py-px -my-px`},null,-1)]]),_:1}))),128))}})})),hE,gE=s((()=>{N0e(),hE=M0e})),P0e,F0e,I0e,L0e,R0e,z0e=s((()=>{sE(),lE(),O0e(),pE(),gE(),lf(),W(),P0e={class:`group/group-button relative flex flex-col text-base`},F0e={key:0,class:`size-4`},I0e=[`aria-expanded`],L0e={key:0,class:`group/items flex flex-col gap-px`},R0e=N({inheritAttrs:!1,__name:`ScalarSidebarGroup`,props:Lr({is:{default:`li`},icon:{type:[Object,Function]},active:{type:Boolean},selected:{type:Boolean},disabled:{type:Boolean},indent:{},controlled:{type:Boolean},discrete:{type:Boolean},loading:{type:Boolean}},{open:{type:Boolean,default:!1},openModifiers:{}}),emits:Lr([`click`,`toggle`],[`update:open`]),setup(e,{emit:t}){let n=t,r=Ur(e,`open`),{level:i}=fE({increment:!0}),{cx:a}=cf(),o=t=>{n(`click`,t),!e.controlled&&!e.discrete&&(r.value=!r.value)},s=t=>{n(`toggle`,t),!e.controlled&&e.discrete&&(r.value=!r.value)};return(t,n)=>(F(),L(kr(e.is),at($r(j(a)(`group/item flex flex-col gap-px`))),{default:M(()=>[R(`div`,P0e,[P(t.$slots,`before`,{open:r.value}),P(t.$slots,`button`,{level:j(i),open:r.value},()=>[H(cE,{is:`button`,active:e.active,"aria-expanded":r.value,disabled:e.disabled,icon:e.icon,indent:j(i),selected:e.selected,onClick:o},jr({indent:M(()=>[H(oE,{class:`mr-0 -my-2`,indent:j(i),selected:e.selected},null,8,[`indent`,`selected`])]),aside:M(()=>[P(t.$slots,`aside`,{open:r.value}),e.discrete?(F(),I(`div`,F0e)):P(t.$slots,`toggle`,{key:1,open:r.value},()=>[H(uE,{class:`text-sidebar-c-2`,open:r.value},null,8,[`open`])])]),default:M(()=>[P(t.$slots,`default`,{open:r.value})]),_:2},[t.$slots.icon?{name:`icon`,fn:M(()=>[P(t.$slots,`icon`,{open:r.value})]),key:`0`}:void 0]),1032,[`active`,`aria-expanded`,`disabled`,`icon`,`indent`,`selected`]),e.discrete?(F(),I(`button`,{key:0,"aria-expanded":r.value,class:O([`absolute top-[1lh] -translate-y-1/2 p-0.75 rounded right-1.25 text-sidebar-c-2`,e.selected?`hover:bg-sidebar-b-1 hover:text-sidebar-c-1`:`hover:bg-sidebar-b-hover hover:text-sidebar-c-hover`]),type:`button`,onClick:s},[P(t.$slots,`toggle`,{open:r.value},()=>[H(uE,{open:r.value},{label:M(()=>[z(k(r.value?`Close`:`Open`)+` `,1),P(t.$slots,`default`,{open:r.value})]),_:3},8,[`open`])])],10,I0e)):B(``,!0)]),P(t.$slots,`after`,{open:r.value})]),r.value?(F(),I(`ul`,L0e,[e.loading?(F(),L(hE,{key:0})):P(t.$slots,`items`,{key:1,open:r.value})])):B(``,!0)]),_:3},16))}})})),B0e,V0e=s((()=>{z0e(),B0e=R0e})),H0e,U0e,W0e=s((()=>{W(),H0e=Symbol(),U0e=()=>{let e=Xee(new Set),t=U(()=>{for(let t of e)if(t())return!0;return!1});return dr(H0e,e),{open:t}}})),G0e,K0e=s((()=>{W0e(),lf(),W(),G0e=N({inheritAttrs:!1,__name:`ScalarSidebarItems`,props:{is:{default:`ul`}},setup(e){let{open:t}=U0e(),{cx:n}=cf();return(r,i)=>(F(),L(kr(e.is),at($r(j(n)(`group/items relative flex flex-col p-(--scalar-sidebar-padding) gap-px transition-transform duration-300`,j(t)?`-translate-x-full`:`translate-x-0`))),{default:M(()=>[P(r.$slots,`default`)]),_:3},16))}})})),q0e,J0e=s((()=>{K0e(),q0e=G0e})),Y0e,X0e=s((()=>{sE(),lf(),W(),Y0e=N({inheritAttrs:!1,__name:`ScalarSidebarSpacer`,props:{indent:{default:0}},setup(e){let{cx:t}=cf();return(n,r)=>(F(),I(`div`,at($r(j(t)(`flex px-2 h-1`))),[H(oE,{indent:e.indent},null,8,[`indent`])],16))}})})),_E,vE=s((()=>{X0e(),_E=Y0e})),Z0e=s((()=>{lE(),pE(),gE(),W0e(),J0e(),vE(),W()})),Q0e=s((()=>{Z0e()})),$0e,e2e,t2e,n2e=s((()=>{lf(),W(),Ou(),$0e={class:`flex-1 text-left leading-none`},e2e={key:0,class:`uppercase text-sidebar-c-2 leading-none py-1 px-1.25 rounded text-xs font-medium border`},t2e=N({inheritAttrs:!1,__name:`ScalarSidebarSearchButton`,setup(e){let{cx:t}=cf();return(e,n)=>(F(),I(`button`,ai({role:`search`,type:`button`},j(t)(`flex items-center rounded border text-base h-8 gap-1 pl-2 pr-1`,`bg-sidebar-b-search border-sidebar-border-search text-sidebar-c-search`)),[H(j(vu),{class:`size-4`}),R(`span`,$0e,[P(e.$slots,`default`,{},()=>[n[0]||=z(`Search...`,-1)])]),e.$slots.shortcut?(F(),I(`span`,e2e,[n[1]||=R(`span`,{class:`sr-only`},`Keyboard Shortcut:`,-1),R(`kbd`,null,[P(e.$slots,`shortcut`)])])):B(``,!0)],16))}})})),r2e,i2e=s((()=>{n2e(),r2e=t2e})),a2e,o2e,s2e=s((()=>{pf(),KT(),lf(),W(),Ou(),a2e=[`aria-label`],o2e=N({inheritAttrs:!1,__name:`ScalarSidebarSearchInput`,props:Lr({autofocus:{type:Boolean},loader:{},label:{}},{modelValue:{},modelModifiers:{}}),emits:[`update:modelValue`],setup(e){let t=A(null),n=Ur(e,`modelValue`);function r(){n.value=``,t.value&&t.value.focus()}let{stylingAttrsCx:i,otherAttrs:a}=cf();return Hi(()=>e.autofocus&&t.value?.focus()),(o,s)=>(F(),I(`label`,at($r(j(i)(`flex items-center rounded border text-base has-[:focus-visible]:bg-sidebar-b-1 has-[:focus-visible]:outline h-8 gap-1 pl-2 pr-1.5`,`bg-sidebar-b-search border-sidebar-border-search`,n.value?`text-sidebar-c-1`:`text-sidebar-c-search`))),[H(j(vu),{class:`text-sidebar-c-search size-4`}),lr(R(`input`,ai({ref_key:`inputRef`,ref:t},j(a),{"onUpdate:modelValue":s[0]||=e=>n.value=e,"aria-label":e.label??`Enter search query`,autocapitalize:`off`,autocomplete:`off`,autocorrect:`off`,class:`flex-1 appearance-none rounded border-none bg-transparent outline-none`,placeholder:`Search...`,spellcheck:`false`,type:`search`}),null,16,a2e),[[lo,n.value]]),e.loader&&e.loader.isActive?(F(),L(j(ff),{key:0,class:`mr-3 self-center`,loader:e.loader,size:`md`},null,8,[`loader`])):n.value?(F(),L(j(GT),{key:1,class:`p-px size-4`,icon:j(Du),label:`Clear Search`,weight:`bold`,onClick:po(r,[`stop`,`prevent`])},null,8,[`icon`])):B(``,!0)],16))}})})),c2e,l2e=s((()=>{s2e(),c2e=o2e})),u2e,d2e,f2e=s((()=>{lE(),pE(),gE(),vE(),lf(),W(),u2e={class:`flex flex-col gap-px`},d2e=N({inheritAttrs:!1,__name:`ScalarSidebarSection`,props:{is:{default:`li`},icon:{type:[Object,Function]},active:{type:Boolean},selected:{type:Boolean},disabled:{type:Boolean},indent:{},loading:{type:Boolean}},setup(e){let{level:t}=fE({increment:!1}),{cx:n}=cf();return(r,i)=>(F(),L(kr(e.is),at($r(j(n)(`group/item group/sidebar-section contents`))),{default:M(()=>[H(_E,{class:`group/spacer-before h-3`,indent:j(t)},null,8,[`indent`]),r.$slots.default?(F(),L(cE,{key:0,is:`div`,class:`text-sm/4 py-1.75 font-bold`,disabled:``,icon:e.icon,indent:j(t)},{default:M(()=>[P(r.$slots,`default`)]),_:3},8,[`icon`,`indent`])):B(``,!0),R(`ul`,u2e,[e.loading?(F(),L(hE,{key:0})):P(r.$slots,`items`,{key:1})]),H(_E,{class:`group/spacer-after h-3`,indent:j(t)},null,8,[`indent`])]),_:3},16))}})})),p2e,m2e=s((()=>{f2e(),p2e=d2e})),h2e=s((()=>{Df(),lf(),W()})),g2e=s((()=>{h2e()})),_2e,v2e,y2e,b2e,x2e,S2e,C2e,w2e,T2e=s((()=>{Df(),lf(),W(),_2e={class:`flex items-center flex-1 relative`},v2e={key:0,class:`select-none whitespace-nowrap text-transparent`},y2e=[`aria-readonly`,`readonly`],b2e={key:1,class:`absolute flex items-center inset-0 select-none overflow-hidden whitespace-nowrap`},x2e={key:0,class:`text-c-2`},S2e={class:`text-transparent`},C2e={key:1,class:`text-c-2`},w2e=N({inheritAttrs:!1,__name:`ScalarTextInput`,props:Lr({readonly:{type:Boolean}},{modelValue:{},modelModifiers:{}}),emits:Lr([`click`],[`update:modelValue`]),setup(e,{emit:t}){let n=t,r=Ur(e,`modelValue`),i=A(),{stylingAttrsCx:a,otherAttrs:o}=cf();Hi(()=>{`autofocus`in o.value&&i.value?.focus()});function s(t){n(`click`,t),e.readonly?i.value?.select():i.value?.focus()}return(t,n)=>(F(),L(j(Ef),ai({is:`div`},j(a)(`cursor-text text-c-1`,e.readonly?``:`focus-within:bg-b-1`),{onClick:s}),{default:M(()=>[R(`div`,_2e,[t.$slots.prefix?(F(),I(`div`,v2e,[P(t.$slots,`prefix`)])):B(``,!0),lr(R(`input`,ai({ref_key:`input`,ref:i,"onUpdate:modelValue":n[0]||=e=>r.value=e,"aria-readonly":e.readonly||void 0,class:`z-1 min-w-0 flex-1 rounded-none border-none bg-transparent placeholder:font-[inherit] focus-within:outline-none`,readonly:e.readonly},j(o)),null,16,y2e),[[fo,r.value]]),t.$slots.prefix||t.$slots.suffix?(F(),I(`div`,b2e,[t.$slots.prefix?(F(),I(`span`,x2e,[P(t.$slots,`prefix`)])):B(``,!0),R(`span`,S2e,k(r.value||t.$attrs.placeholder),1),t.$slots.suffix?(F(),I(`span`,C2e,[P(t.$slots,`suffix`)])):B(``,!0)])):B(``,!0)]),P(t.$slots,`aside`)]),_:3},16))}})})),yE,E2e=s((()=>{T2e(),yE=w2e})),D2e,O2e=s((()=>{Nf(),Ff(),E2e(),W(),Zf(),D2e=N({__name:`ScalarTextInputCopy`,props:Lr({duration:{default:1500},editable:{type:Boolean},immediate:{type:Boolean}},{modelValue:{},modelModifiers:{},copied:{type:Boolean,default:!1},copiedModifiers:{}}),emits:[`update:modelValue`,`update:copied`],setup(e){Hi(()=>{e.immediate&&t.value&&r(t.value)});let t=Ur(e,`modelValue`),n=Ur(e,`copied`),{copy:r,copied:i}=nye({legacy:!0,copiedDuring:e.duration});return mr(i,e=>n.value=e),(a,o)=>(F(),L(yE,{modelValue:t.value,"onUpdate:modelValue":o[1]||=e=>t.value=e,readonly:!e.editable,onClick:o[2]||=e=>t.value&&j(r)(t.value)},{aside:M(()=>[H(j(Pf),{class:`z-1`,copied:n.value||j(i),placement:`left`,onClick:o[0]||=po(e=>t.value&&j(r)(t.value),[`stop`])},jr({backdrop:M(()=>[H(j(Mf),{class:`bg-b-1.5`})]),_:2},[a.$slots.copy?{name:`copy`,fn:M(()=>[P(a.$slots,`copy`)]),key:`0`}:void 0,a.$slots.copied?{name:`copied`,fn:M(()=>[P(a.$slots,`copied`)]),key:`1`}:void 0]),1032,[`copied`])]),_:3},8,[`modelValue`,`readonly`]))}})})),k2e,A2e=s((()=>{O2e(),k2e=D2e}));function bE(e,t){let n=[...t.matchAll(RegExp(`(${e}): ([^;]+);`,`gm`))];return n.length===0?{}:Object.fromEntries(n.map(e=>[e[1],e[2]]))}function j2e(e){return e?{...bE(`--scalar-color-[1-3]`,e),...bE(`--scalar-background-[1-3]`,e),...bE(`--scalar-color-accent`,e)}:{}}function M2e(e){return{colors:U(()=>({light:j2e(Cn(e).match(/\.light-mode[^{]*{[^}]*}/m)?.[0]),dark:j2e(Cn(e).match(/\.dark-mode[^{]*{[^}]*}/m)?.[0])}))}}var N2e,P2e=s((()=>{W(),N2e=[`--scalar-color-1`,`--scalar-color-2`,`--scalar-color-3`,`--scalar-background-1`,`--scalar-background-2`,`--scalar-background-3`,`--scalar-color-accent`]})),F2e,I2e=s((()=>{P2e(),lf(),W(),F2e=N({inheritAttrs:!1,__name:`ScalarThemeSwatches`,props:{css:{}},setup(e){let{colors:t}=M2e(()=>e.css),{cx:n}=cf();return(e,r)=>(F(),I(`div`,ai({style:{"--bg-light":j(t).light[`--scalar-background-1`],"--bg-dark":j(t).dark[`--scalar-background-1`]}},j(n)(`flex *:size-3 overflow-hidden rounded`,`bg-(--bg-light) dark:bg-(--bg-dark)`)),[(F(!0),I(V,null,Ar(j(N2e),e=>(F(),I(`div`,{key:e,class:`bg-(--bg-light) dark:bg-(--bg-dark)`,style:it({"--bg-light":j(t).light[e],"--bg-dark":j(t).dark[e]})},null,4))),128))],16))}})})),xE,L2e=s((()=>{I2e(),xE=F2e})),R2e,z2e,B2e,V2e=s((()=>{lf(),W(),R2e=[`aria-checked`,`aria-disabled`],z2e={key:0,class:`sr-only`},B2e=N({__name:`ScalarToggle`,props:Lr({disabled:{type:Boolean},label:{}},{modelValue:{type:Boolean,default:!1},modelModifiers:{}}),emits:[`update:modelValue`],setup(e){let t=e,n=Ur(e,`modelValue`);function r(){t.disabled||(n.value=!n.value)}let i=of({base:`relative h-3.5 min-w-6 w-6 cursor-pointer rounded-full bg-b-3 transition-colors duration-300`,variants:{checked:{true:`bg-c-accent`},disabled:{true:`cursor-not-allowed opacity-40`}}});return(t,a)=>(F(),I(`button`,{"aria-checked":n.value,"aria-disabled":e.disabled,class:O(j(sf)(j(i)({checked:n.value,disabled:e.disabled}))),role:`switch`,type:`button`,onClick:r},[R(`div`,{class:O([`absolute left-px top-px flex h-3 w-3 items-center justify-center rounded-full bg-b-1 text-c-accent transition-transform duration-300`,{"translate-x-2.5":n.value}])},null,2),e.label?(F(),I(`span`,z2e,k(e.label),1)):B(``,!0)],10,R2e))}})})),H2e,U2e=s((()=>{V2e(),H2e=B2e})),W2e,G2e,K2e=s((()=>{Df(),U2e(),lf(),W(),W2e={class:`flex-1 text-left min-w-0 truncate`},G2e=N({inheritAttrs:!1,__name:`ScalarToggleInput`,props:{modelValue:{type:Boolean},modelModifiers:{}},emits:[`update:modelValue`],setup(e){let t=Ur(e,`modelValue`),{stylingAttrsCx:n,otherAttrs:r}=cf();return(e,i)=>(F(),L(j(Ef),ai({is:`label`},j(n)(`cursor-pointer gap-2 hover:bg-b-2`,{"text-c-1":t.value})),{default:M(()=>[R(`div`,W2e,[P(e.$slots,`default`)]),H(H2e,ai({modelValue:t.value,"onUpdate:modelValue":i[0]||=e=>t.value=e,class:`shrink-0`},j(r)),null,16,[`modelValue`])]),_:3},16))}})})),SE,q2e=s((()=>{K2e(),SE=G2e})),J2e=s((()=>{kf(),q2e(),W()})),Y2e=s((()=>{J2e()})),X2e,Z2e,Q2e,$2e,e4e=s((()=>{W(),Ou(),X2e={key:0,class:`shrink-0 whitespace-nowrap text-xs tabular-nums text-c-3`},Z2e=[`disabled`],Q2e=[`disabled`],$2e=N({__name:`ScalarVirtualTextSearch`,props:{query:{},matchCount:{},activeMatchIndex:{}},emits:[`update:query`,`next`,`prev`,`close`],setup(e,{expose:t,emit:n}){let r=e,i=n,a=A(null),o=A(r.query);mr(()=>r.query,e=>{o.value=e}),mr(o,e=>{i(`update:query`,e)});let s=()=>{ar(()=>a.value?.focus())},c=e=>{e.key===`Enter`&&(e.preventDefault(),e.shiftKey?i(`prev`):i(`next`)),e.key===`Escape`&&(e.preventDefault(),i(`close`))};return t({focus:s}),(t,n)=>(F(),I(`div`,{class:`scalar-virtual-text-search ml-auto mr-2 mt-2 flex h-fit w-fit items-center gap-1 overflow-visible rounded-lg bg-b-2 px-2 py-1 shadow-md`,onClick:n[4]||=po(()=>{},[`stop`])},[H(j(vu),{class:`pointer-events-none size-3.5 shrink-0 text-c-3`}),lr(R(`input`,{ref_key:`searchInputRef`,ref:a,"onUpdate:modelValue":n[0]||=e=>o.value=e,"aria-label":`Search in text`,autocomplete:`off`,class:`scalar-virtual-text-search-input min-w-0 w-36 appearance-none border-none bg-transparent px-1 py-0.5 text-xs text-c-1 outline-none`,placeholder:`Find...`,spellcheck:`false`,type:`search`,onKeydown:c},null,544),[[lo,o.value]]),o.value?(F(),I(`span`,X2e,k(e.matchCount>0?`${e.activeMatchIndex+1} of ${e.matchCount}`:`No results`),1)):B(``,!0),n[5]||=R(`span`,{class:`mx-0.5 h-3.5 w-px bg-b-3`},null,-1),R(`button`,{"aria-label":`Previous match`,class:`flex size-5 items-center justify-center rounded text-c-3 hover:bg-b-3 hover:text-c-1 disabled:pointer-events-none disabled:opacity-30`,disabled:e.matchCount===0,title:`Previous match (Shift+Enter)`,type:`button`,onClick:n[1]||=e=>i(`prev`)},[H(j(_l),{class:`size-3`})],8,Z2e),R(`button`,{"aria-label":`Next match`,class:`flex size-5 items-center justify-center rounded text-c-3 hover:bg-b-3 hover:text-c-1 disabled:pointer-events-none disabled:opacity-30`,disabled:e.matchCount===0,title:`Next match (Enter)`,type:`button`,onClick:n[2]||=e=>i(`next`)},[H(j(tl),{class:`size-3`})],8,Q2e),R(`button`,{"aria-label":`Close search`,class:`flex size-5 items-center justify-center rounded text-c-3 hover:bg-b-3 hover:text-c-1`,title:`Close (Escape)`,type:`button`,onClick:n[3]||=e=>i(`close`)},[H(j(Du),{class:`size-3`})])]))}})})),t4e,n4e=s((()=>{df(),e4e(),t4e=uf($2e,[[`__scopeId`,`data-v-95edadbb`]])})),r4e,i4e,a4e=s((()=>{n4e(),W(),r4e={key:0,class:`sticky top-0 z-10 flex h-0 w-full justify-end overflow-visible`},i4e=N({__name:`ScalarVirtualText`,props:{text:{},lineHeight:{default:20},containerClass:{default:``},contentClass:{default:``},lineClass:{default:``},searchable:{type:Boolean,default:!1}},setup(e){let t=e,n=A(null),r=A(null),i=A(0),a=A(0),o=A(``),s=A(!1),c=A(0),l=U(()=>t.text.split(`
-`)),u=U(()=>l.value.length*t.lineHeight),d=U(()=>Math.floor(i.value/t.lineHeight)),f=U(()=>Math.min(Math.ceil((i.value+a.value)/t.lineHeight),l.value.length)),p=U(()=>Math.max(0,d.value-10)),m=U(()=>{let e=Math.min(l.value.length,f.value+10);return l.value.slice(p.value,e)}),h=U(()=>p.value*t.lineHeight),g=U(()=>{let e=o.value;if(!e)return[];let t=e.toLowerCase(),n=[];for(let r=0;r<l.value.length;r++){let i=l.value[r];if(!i)continue;let a=i.toLowerCase(),o=0;for(;o<a.length;){let i=a.indexOf(t,o);if(i===-1)break;n.push({line:r,start:i,end:i+e.length}),o=i+t.length}}return n}),_=U(()=>{let e=new Set;for(let t of g.value)e.add(t.line);return e});mr(()=>g.value.length,e=>{e===0?c.value=0:c.value>=e&&(c.value=e-1)});let v=e=>{if(!n.value)return;let r=e.line*t.lineHeight,i=n.value.scrollTop,a=i+n.value.clientHeight;(r<i||r+t.lineHeight>a)&&(n.value.scrollTop=r-n.value.clientHeight/2)},y=e=>{let t=g.value[e];t&&(c.value=e,v(t))},b=()=>{g.value.length!==0&&y((c.value+1)%g.value.length)},x=()=>{g.value.length!==0&&y((c.value-1+g.value.length)%g.value.length)},S=()=>{s.value=!0,ar(()=>r.value?.focus())},C=()=>{s.value=!1,o.value=``,c.value=0},w=e=>{t.searchable&&((e.metaKey||e.ctrlKey)&&e.key===`f`&&(e.preventDefault(),e.stopPropagation(),S()),e.key===`Escape`&&s.value&&(e.preventDefault(),C()))};mr(o,()=>{c.value=0;let e=g.value[0];e&&v(e)});let ee=()=>n.value&&(i.value=n.value.scrollTop),te=()=>n.value&&(a.value=n.value.clientHeight);Hi(()=>{te(),window.addEventListener(`resize`,te)}),Wi(()=>{window.removeEventListener(`resize`,te)});let ne=e=>{let t=l.value[e]??``;if(!o.value||!_.value.has(e))return[{text:t,highlight:!1,active:!1}];let n=g.value.filter(t=>t.line===e),r=[],i=0;for(let e of n){e.start>i&&r.push({text:t.slice(i,e.start),highlight:!1,active:!1});let n=g.value.indexOf(e)===c.value;r.push({text:t.slice(e.start,e.end),highlight:!0,active:n}),i=e.end}return i<t.length&&r.push({text:t.slice(i),highlight:!1,active:!1}),r},re=e=>p.value+e;return(i,a)=>(F(),I(`div`,{ref_key:`containerRef`,ref:n,class:O([`scalar-virtual-text relative overflow-auto`,e.containerClass]),tabindex:`0`,onKeydown:w,onScroll:ee},[e.searchable&&s.value?(F(),I(`div`,r4e,[H(t4e,{ref_key:`searchRef`,ref:r,query:o.value,"onUpdate:query":a[0]||=e=>o.value=e,activeMatchIndex:c.value,matchCount:g.value.length,onClose:C,onNext:b,onPrev:x},null,8,[`query`,`activeMatchIndex`,`matchCount`])])):B(``,!0),R(`div`,{style:it({height:`${u.value}px`})},null,4),R(`code`,{class:O([`scalar-virtual-text-content absolute left-0 right-0 top-0`,e.contentClass]),style:it({transform:`translateY(${h.value}px)`})},[(F(!0),I(V,null,Ar(m.value,(n,r)=>(F(),I(`div`,{key:p.value+r,class:O([`scalar-virtual-text-line`,e.lineClass]),style:it({height:`${t.lineHeight}px`,lineHeight:`${t.lineHeight}px`})},[o.value&&_.value.has(re(r))?(F(!0),I(V,{key:0},Ar(ne(re(r)),(e,t)=>(F(),I(V,{key:t},[e.highlight?(F(),I(`mark`,{key:0,class:O([`scalar-virtual-text-highlight`,e.active?`scalar-virtual-text-highlight-active`:``])},k(e.text),3)):(F(),I(V,{key:1},[z(k(e.text),1)],64))],64))),128)):(F(),I(V,{key:1},[z(k(n),1)],64))],6))),128))],6)],34))}})})),CE,o4e=s((()=>{df(),a4e(),CE=uf(i4e,[[`__scopeId`,`data-v-b50a85e1`]])})),s4e,c4e=s((()=>{s4e={path:/[\/\.-]/,property:/[A-Z\_\.-]/}})),l4e,u4e,d4e=s((()=>{c4e(),W(),l4e={key:0},u4e=N({inheritAttrs:!1,__name:`ScalarWrappingText`,props:{text:{default:``},preset:{default:`path`},regex:{}},setup(e){let t=U(()=>{let t=new RegExp(e.regex??s4e[e.preset],`g`);return e.text.replace(t,`⁠$&`).split(`⁠`).filter(Boolean)});return(e,n)=>(F(!0),I(V,null,Ar(t.value,(e,t)=>(F(),I(V,{key:t},[t===0?B(``,!0):(F(),I(`wbr`,l4e)),z(k(e),1)],64))),128))}})})),wE,f4e=s((()=>{d4e(),wE=u4e})),TE,EE,p4e,DE,OE,m4e=s((()=>{TE=`scalar-app`,EE=`headlessui-portal-root`,p4e=e=>e!==null&&e instanceof HTMLElement,DE=e=>{!e||e.classList.contains(TE)||e.classList.add(TE)},OE=()=>{DE(document.getElementById(EE));let e=new MutationObserver(e=>e.forEach(({addedNodes:e})=>e.forEach(e=>{p4e(e)&&e.id===EE&&DE(e)})));return e.observe(document.body,{childList:!0}),e}})),kE=s((()=>{pf(),T_e(),_f(),F_e(),xf(),B_e(),G_e(),Y_e(),Z_e(),$_e(),rve(),Df(),kf(),_ve(),jf(),wve(),Ove(),Nf(),ZBe(),Ff(),vye(),Cye(),qy(),Zy(),ib(),db(),mb(),aVe(),tS(),iS(),sS(),uS(),RVe(),BVe(),ZVe(),$Ve(),VS(),iHe(),YS(),$S(),lHe(),dHe(),oC(),sC(),cC(),lC(),uC(),vHe(),xHe(),CHe(),hC(),OC(),MT(),PT(),UT(),P$e(),L$e(),KT(),G$e(),Y$e(),n1e(),c1e(),d1e(),XT(),eE(),g1e(),b1e(),w1e(),E1e(),O1e(),N1e(),L1e(),R1e(),V1e(),U1e(),q1e(),i0e(),c0e(),f0e(),sE(),lE(),w0e(),O0e(),j0e(),V0e(),J0e(),vE(),Q0e(),i2e(),l2e(),m2e(),g2e(),E2e(),A2e(),P2e(),L2e(),U2e(),q2e(),Y2e(),o4e(),f4e(),m4e(),lf()})),h4e,g4e=s((()=>{W(),kE(),h4e=N({__name:`ViewLayout`,setup(e){let{cx:t}=cf();return(e,n)=>(F(),I(`div`,at($r(j(t)(`flex flex-col min-h-0 flex-1 *:border-t first:*:border-t-0 md:*:border-t-0 xl:overflow-hidden md:flex-row leading-5`))),[P(e.$slots,`default`)],16))}})})),_4e,v4e=s((()=>{g4e(),_4e=h4e}));function y4e(e,t){return F(),I(`div`,x4e,[P(e.$slots,`default`)])}var b4e,x4e,S4e,C4e=s((()=>{Bc(),W(),b4e={},x4e={class:`custom-scroll flex flex-col pr-0 *:border-t *:first:border-t-0 xl:flex-row *:xl:border-t-0 *:xl:border-l *:first:xl:border-l-0`},S4e=zc(b4e,[[`render`,y4e]])})),w4e,T4e,E4e,D4e=s((()=>{w4e=({harRequest:e})=>{let t=T4e(e),n=E4e(e.postData);return[e.url,{method:e.method,headers:t,body:n}]},T4e=e=>{let t=new Headers;if(e.headers.forEach(({name:e,value:n})=>{t.append(e,n)}),e.cookies?.length){let n=e.cookies.map(({name:e,value:t})=>`${e}=${t}`).join(`; `);t.append(`Cookie`,n)}return t},E4e=e=>{if(!e)return null;let{params:t,text:n,mimeType:r}=e;if(t?.length){let e=r?.includes(`multipart/form-data`)?new FormData:new URLSearchParams;return t.forEach(({name:t,value:n})=>{e.append(t,n||``)}),e}return n?new TextEncoder().encode(n):null}})),AE,O4e,k4e,A4e=s((()=>{Whe(),AE=({harResponse:e,url:t=``,method:n,path:r,duration:i=0})=>{let a=O4e(e),{body:o,data:s,size:c}=k4e(e),l=zu(a);return{...new Response(o,{status:e.status,statusText:e.statusText,headers:a}),headers:Object.fromEntries(a.entries()),cookieHeaderKeys:l,duration:i,status:e.status,statusText:e.statusText,method:n,path:r,data:s,size:c,url:t}},O4e=e=>{let t=new Headers;return e.headers.forEach(({name:e,value:n})=>{t.append(e,n)}),t},k4e=e=>{if(!e.content.text)return{body:null,data:``,size:0};let{text:t,encoding:n}=e.content;if(n)return{body:null,data:t,size:t.length};let r=new TextEncoder().encode(t).buffer;return{body:r,data:t,size:r.byteLength}}})),jE,ME=s((()=>{jE=e=>e!=null}));function NE(e,t,n,r){return[r,e,t,n].filter(jE).join(`|`)}function j4e(e){return`reader`in e}var PE,M4e=s((()=>{ME(),PE=new Map})),FE,IE=s((()=>{FE=(e,t,n=!0)=>{let r=t?.[`x-disabled`];return typeof r==`boolean`?r:n?!e.required&&e.in!==`path`:!1}})),N4e,LE,RE,zE=s((()=>{N4e=e=>e[`$ref-value`],LE=e=>{let{"$ref-value":t,...n}=e;return{...t,...n}},RE=(e,t=N4e)=>typeof e==`object`&&e&&`$ref`in e?t(e):e})),BE,VE,HE=s((()=>{BE=e=>{if(typeof e!=`object`||!e)return!1;let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null},VE=e=>typeof e==`object`&&!!e})),P4e,F4e=s((()=>{P4e=e=>decodeURI(e.replace(/~1/g,`/`).replace(/~0/g,`~`))})),UE,I4e=s((()=>{F4e(),UE=e=>e.split(`/`).slice(1).map(P4e)})),WE,L4e=s((()=>{WE=(e,t,n)=>{let[r,i]=e.split(`#`,2);if(r)return n.has(r)?i?i.startsWith(`/`)?`${n.get(r)}${i}`:n.get(`${r}#${i}`):n.get(r):void 0;if(i)return i.startsWith(`/`)?i.slice(1):n.get(`${t}#${i}`)}})),GE,KE,qE,JE=s((()=>{GE=e=>{if(e&&typeof e==`object`&&e.$id&&typeof e.$id==`string`)return e.$id},KE=e=>e.join(`/`),qE=(e,t=``,n=[],r=new Map,i=new WeakSet)=>{if(typeof e!=`object`||!e||i.has(e))return r;i.add(e);let a=GE(e);a&&r.set(a,KE(n));let o=a??t;e.$anchor&&typeof e.$anchor==`string`&&r.set(`${o}#${e.$anchor}`,KE(n));for(let t in e)typeof e[t]==`object`&&e[t]!==null&&qE(e[t],o,[...n,t],r,i);return r}}));function YE(e,t){return t.reduce((e,t)=>e.value===void 0||typeof e.value!=`object`||e.value===null?{context:``,value:void 0}:{context:GE(e.value)??e.context,value:e.value?.[t]},{context:``,value:e})}var R4e=s((()=>{JE()}));function z4e(e,t){return t.reduce((e,t)=>(e[t]===void 0&&(isNaN(Number(t))?e[t]={}:e[t]=[]),e[t]),e)}var B4e=s((()=>{}));function XE(e){return typeof e!=`object`||!e?e:e[ZE]?e[QE]:e}var ZE,QE,$E,eD,tD,nD,V4e=s((()=>{I4e(),HE(),L4e(),JE(),R4e(),B4e(),ZE=Symbol(`isMagicProxy`),QE=Symbol(`magicProxyTarget`),$E=`$ref-value`,eD=`$ref`,tD=(e,t,n={root:e,proxyCache:new WeakMap,cache:new Map,schemas:qE(e),currentContext:``})=>{if(!BE(e)&&!Array.isArray(e))return e;if(n.proxyCache.has(e))return n.proxyCache.get(e);let r=new Proxy(e,{get(e,r,i){if(r===ZE)return!0;if(r===QE)return e;if(typeof r==`string`&&r.startsWith(`__scalar_`)&&!t?.showInternal)return;let a=Reflect.get(e,eD,i),o=GE(e);if(r===$E&&typeof a==`string`){if(n.cache.has(a))return n.cache.get(a);let e=WE(a,o??n.currentContext,n.schemas);if(e===void 0)return;let r=YE(n.root,UE(`/${e}`));if(nD(r.value))return r.value;let i=tD(r.value,t,{...n,currentContext:r.context});return n.cache.set(a,i),i}let s=Reflect.get(e,r,i);return nD(s)?s:tD(s,t,{...n,currentContext:o??n.currentContext})},set(e,r,i,a){let o=Reflect.get(e,eD,a);if(typeof r==`string`&&r.startsWith(`__scalar_`)&&!t?.showInternal)return!0;if(r===$E&&typeof o==`string`){let t=WE(o,GE(e)??n.currentContext,n.schemas);if(t===void 0)return;let r=UE(`/${t}`);if(r.length===0)return!1;let a=()=>YE(n.root,r.slice(0,-1)).value;return a()===void 0&&(z4e(n.root,r.slice(0,-1)),console.warn(`Trying to set $ref-value for invalid reference: ${o}\n\nPlease fix your input file to fix this issue.`)),a()[r.at(-1)]=i,!0}return Reflect.set(e,r,i,a)},deleteProperty(e,t){return Reflect.deleteProperty(e,t)},has(e,n){return typeof n==`string`&&n.startsWith(`__scalar_`)&&!t?.showInternal?!1:n===$E&&eD in e?!0:Reflect.has(e,n)},ownKeys(e){let n=Reflect.ownKeys(e).filter(e=>typeof e!=`string`||!(e.startsWith(`__scalar_`)&&!t?.showInternal));return eD in e&&!n.includes($E)&&n.push($E),n},getOwnPropertyDescriptor(e,n){if(typeof n==`string`&&n.startsWith(`__scalar_`)&&!t?.showInternal)return;let r=Reflect.get(e,eD);return n===$E&&typeof r==`string`?{configurable:!0,enumerable:!0,value:void 0,writable:!1}:Reflect.getOwnPropertyDescriptor(e,n)}});return n.proxyCache.set(e,r),r},nD=e=>typeof e==`object`&&!!e&&e[ZE]===!0})),rD=s((()=>{V4e()})),iD,aD,oD,H4e,U4e,W4e=s((()=>{HE(),iD=Symbol(`isDetectChangesProxy`),aD=Symbol(`detectChangesProxyTarget`),oD=(e,t,n={proxyCache:new WeakMap,path:[]})=>{if(!BE(e)&&!Array.isArray(e))return e;if(n.proxyCache.has(e))return n.proxyCache.get(e);let r=new Proxy(e,{get(e,r,i){if(r===iD)return!0;if(r===aD)return e;let a=Reflect.get(e,r,i);return H4e(a)?a:oD(a,t,{...n,path:[...n.path,String(r)]})},set(e,r,i,a){let o=[...n.path,String(r)];t?.hooks?.onBeforeChange?.(o,i);let s=Reflect.set(e,r,i,a);return t?.hooks?.onAfterChange?.(o,i),s},deleteProperty(e,r){let i=[...n.path,String(r)];t?.hooks?.onBeforeChange?.(i);let a=Reflect.deleteProperty(e,r);return t?.hooks?.onAfterChange?.(i),a}});return n.proxyCache.set(e,r),r},H4e=e=>typeof e==`object`&&!!e&&e[iD]===!0,U4e=e=>typeof e!=`object`||!e?e:e[iD]?e[aD]:e}));function G4e(e){return typeof e==`object`&&e&&e[sD]?e[cD]:e}var sD,cD,lD,K4e,q4e=s((()=>{HE(),sD=Symbol(`isOverridesProxy`),cD=Symbol(`getOverridesTarget`),lD=(e,t,n={cache:new WeakMap})=>{if(!e||typeof e!=`object`)return e;if(n.cache.has(e))return n.cache.get(e);let{overrides:r}=t??{},i=new Proxy(e,{get(e,t,i){if(t===sD)return!0;if(t===cD)return e;let a=Reflect.get(e,t,i);return K4e(a)?a:BE(a)?lD(a,{overrides:Reflect.get(r??{},t)},n):Reflect.get(r??{},t)??a},set(e,t,n,i){return t===sD||t===cD?!1:r&&Reflect.has(r,t)&&r&&typeof r==`object`?(r[t]=n,!0):Reflect.set(e,t,n,i)}});return n.cache.set(e,i),i},K4e=e=>typeof e==`object`&&!!e&&e[sD]===!0})),uD,dD=s((()=>{rD(),W(),W4e(),q4e(),uD=(e,{depth:t=0}={})=>{let n=(r,i=0)=>{if(typeof r!=`object`||!r)return r;let a=U4e(bn(XE(G4e(r))));return t!==null&&i>=t?a:(i!==0&&a!==r&&(console.warn(`%c⚠ Warning:%c You tried to assign a proxied object (depth: %d).
-%c💡 Tip:%c Pass a plain object instead — wrapping a proxy inside another proxy may cause weird bugs.
-%c🔍 Debug Info:%c The problematic value is shown below:`,`background: #fdd835; color: #000; font-weight: bold; padding: 2px 4px; border-radius: 3px;`,`color: inherit;`,i,`color: #00bfa5; font-weight: bold;`,`color: inherit;`,`color: #03a9f4; font-weight: bold;`,`color: inherit;`,r,e),console.groupCollapsed(`%c📜 Proxy assignment trace`,`color: #9c27b0; font-weight: bold;`),console.trace({value:r,raw:a}),console.groupEnd()),Object.entries(a).forEach(([e,t])=>{let r=n(t,i+1);Reflect.set(a,e,r)||console.warn(`%c🚫 Readonly Property Error:%c Failed to set property "%s" on object.
-%c💡 Tip:%c This property is readonly or non-configurable. You cannot unpack a readonly property — the value was not updated.
-%c🔍 Debug Info:%c Property: %s | Value: %o | Object: %o`,`background: #f44336; color: #fff; font-weight: bold; padding: 2px 4px; border-radius: 3px;`,`color: inherit;`,e,`color: #00bfa5; font-weight: bold;`,`color: inherit;`,`color: #03a9f4; font-weight: bold;`,`color: inherit;`,e,r,a)}),a)};return n(e)}})),J4e,Y4e=s((()=>{HE(),zE(),dD(),J4e=e=>{let t=new WeakSet,n=new WeakMap,r=e=>{if(!BE(e)&&!Array.isArray(e))return e;let i=uD(e,{depth:1});if(n.has(i))return n.get(i);if(t.has(i))return`[circular]`;if(t.add(i),`$ref`in e){let t=r(RE(e));return n.set(i,t),t}if(Array.isArray(e)){let t=e.map(r);return n.set(i,t),t}let a=Object.fromEntries(Object.entries(e).map(([e,t])=>[e,r(t)]));return n.set(i,a),a};return r(e)}})),fD,pD,mD=s((()=>{zE(),fD=(e,t,n)=>{if(!e&&!t)return;let r=!!e&&Object.keys(e).length>0,i=n||Object.keys(e??{})[0]||``,a=RE(e?.[i]);if(a!==void 0)return a;if((!r||!n)&&t!==void 0)return{value:RE(t)}},pD=(e,t,n)=>{if(`content`in e){let r=e.content?.[n??Object.keys(e.content)[0]??``],i=fD(r?.examples,r?.example,t);if(i!==void 0)return i}if(`examples`in e||`example`in e){let n=fD(e.examples,e.example,t);if(n!==void 0)return n}let r=RE(e);if(`schema`in r&&r.schema){let e=r.schema;if(`default`in e&&e.default!==void 0)return{value:e.default};if(`enum`in e&&e.enum?.[0]!==void 0)return{value:e.enum[0]};if(`examples`in e&&e.examples?.[0]!==void 0)return{value:e.examples[0]};if(`example`in e&&e.example!==void 0)return{value:e.example}}}}));function X4e(e){return yD(e)&&!hD(e)&&!xD(e)&&Symbol.asyncIterator in e}function hD(e){return Array.isArray(e)}function Z4e(e){return typeof e==`bigint`}function gD(e){return typeof e==`boolean`}function _D(e){return e instanceof globalThis.Date}function Q4e(e){return typeof e==`function`}function $4e(e){return yD(e)&&!hD(e)&&!xD(e)&&Symbol.iterator in e}function e3e(e){return e===null}function vD(e){return typeof e==`number`}function yD(e){return typeof e==`object`&&!!e}function t3e(e){return e instanceof globalThis.RegExp}function bD(e){return typeof e==`string`}function n3e(e){return typeof e==`symbol`}function xD(e){return e instanceof globalThis.Uint8Array}function SD(e){return e===void 0}var CD=s((()=>{}));function r3e(e){return e.map(e=>wD(e))}function i3e(e){return new Date(e.getTime())}function a3e(e){return new Uint8Array(e)}function o3e(e){return new RegExp(e.source,e.flags)}function s3e(e){let t={};for(let n of Object.getOwnPropertyNames(e))t[n]=wD(e[n]);for(let n of Object.getOwnPropertySymbols(e))t[n]=wD(e[n]);return t}function wD(e){return hD(e)?r3e(e):_D(e)?i3e(e):xD(e)?a3e(e):t3e(e)?o3e(e):yD(e)?s3e(e):e}function TD(e){return wD(e)}var ED=s((()=>{CD()}));function DD(e,t){return TD(t===void 0?e:{...t,...e})}var OD=s((()=>{ED()})),c3e=s((()=>{OD(),ED()}));function l3e(e){return MD(e)&&globalThis.Symbol.asyncIterator in e}function u3e(e){return MD(e)&&globalThis.Symbol.iterator in e}function d3e(e){return e instanceof globalThis.Promise}function kD(e){return e instanceof Date&&globalThis.Number.isFinite(e.getTime())}function f3e(e){return e instanceof globalThis.Map}function p3e(e){return e instanceof globalThis.Set}function m3e(e){return globalThis.ArrayBuffer.isView(e)}function AD(e){return e instanceof globalThis.Uint8Array}function jD(e,t){return t in e}function MD(e){return typeof e==`object`&&!!e}function ND(e){return globalThis.Array.isArray(e)&&!globalThis.ArrayBuffer.isView(e)}function PD(e){return e===void 0}function FD(e){return e===null}function ID(e){return typeof e==`boolean`}function LD(e){return typeof e==`number`}function h3e(e){return globalThis.Number.isInteger(e)}function RD(e){return typeof e==`bigint`}function zD(e){return typeof e==`string`}function BD(e){return typeof e==`function`}function VD(e){return typeof e==`symbol`}function HD(e){return RD(e)||ID(e)||FD(e)||LD(e)||zD(e)||VD(e)||PD(e)}var UD=s((()=>{})),WD=s((()=>{UD()})),GD,KD=s((()=>{WD(),(function(e){e.InstanceMode=`default`,e.ExactOptionalPropertyTypes=!1,e.AllowArrayObject=!1,e.AllowNaN=!1,e.AllowNullVoid=!1;function t(t,n){return e.ExactOptionalPropertyTypes?n in t:t[n]!==void 0}e.IsExactOptionalProperty=t;function n(t){let n=MD(t);return e.AllowArrayObject?n:n&&!ND(t)}e.IsObjectLike=n;function r(e){return n(e)&&!(e instanceof Date)&&!(e instanceof Uint8Array)}e.IsRecordLike=r;function i(t){return e.AllowNaN?LD(t):Number.isFinite(t)}e.IsNumberLike=i;function a(t){let n=PD(t);return e.AllowNullVoid?n||t===null:n}e.IsVoidLike=a})(GD||={})}));function g3e(e){return globalThis.Object.freeze(e).map(e=>qD(e))}function _3e(e){return e}function v3e(e){return e}function y3e(e){return e}function b3e(e){let t={};for(let n of Object.getOwnPropertyNames(e))t[n]=qD(e[n]);for(let n of Object.getOwnPropertySymbols(e))t[n]=qD(e[n]);return globalThis.Object.freeze(t)}function qD(e){return hD(e)?g3e(e):_D(e)?_3e(e):xD(e)?v3e(e):t3e(e)?y3e(e):yD(e)?b3e(e):e}var x3e=s((()=>{CD()}));function JD(e,t){let n=t===void 0?e:{...t,...e};switch(GD.InstanceMode){case`freeze`:return qD(n);case`clone`:return TD(n);default:return n}}var YD=s((()=>{KD(),x3e(),ED()})),XD=s((()=>{YD()})),ZD,S3e=s((()=>{ZD=class extends Error{constructor(e){super(e)}}})),QD=s((()=>{S3e()})),$D,eO,tO,nO,rO,iO=s((()=>{$D=Symbol.for(`TypeBox.Transform`),eO=Symbol.for(`TypeBox.Readonly`),tO=Symbol.for(`TypeBox.Optional`),nO=Symbol.for(`TypeBox.Hint`),rO=Symbol.for(`TypeBox.Kind`)})),aO=s((()=>{iO()}));function oO(e){return yD(e)&&e[eO]===`Readonly`}function sO(e){return yD(e)&&e[tO]===`Optional`}function C3e(e){return vO(e,`Any`)}function w3e(e){return vO(e,`Argument`)}function cO(e){return vO(e,`Array`)}function lO(e){return vO(e,`AsyncIterator`)}function uO(e){return vO(e,`BigInt`)}function dO(e){return vO(e,`Boolean`)}function fO(e){return vO(e,`Computed`)}function pO(e){return vO(e,`Constructor`)}function T3e(e){return vO(e,`Date`)}function mO(e){return vO(e,`Function`)}function hO(e){return vO(e,`Integer`)}function gO(e){return vO(e,`Intersect`)}function _O(e){return vO(e,`Iterator`)}function vO(e,t){return yD(e)&&rO in e&&e[rO]===t}function E3e(e){return gD(e)||vD(e)||bD(e)}function yO(e){return vO(e,`Literal`)}function bO(e){return vO(e,`MappedKey`)}function xO(e){return vO(e,`MappedResult`)}function SO(e){return vO(e,`Never`)}function D3e(e){return vO(e,`Not`)}function CO(e){return vO(e,`Null`)}function wO(e){return vO(e,`Number`)}function TO(e){return vO(e,`Object`)}function EO(e){return vO(e,`Promise`)}function DO(e){return vO(e,`Record`)}function OO(e){return vO(e,`Ref`)}function O3e(e){return vO(e,`RegExp`)}function kO(e){return vO(e,`String`)}function AO(e){return vO(e,`Symbol`)}function jO(e){return vO(e,`TemplateLiteral`)}function k3e(e){return vO(e,`This`)}function MO(e){return yD(e)&&$D in e}function NO(e){return vO(e,`Tuple`)}function PO(e){return vO(e,`Undefined`)}function FO(e){return vO(e,`Union`)}function A3e(e){return vO(e,`Uint8Array`)}function j3e(e){return vO(e,`Unknown`)}function M3e(e){return vO(e,`Unsafe`)}function N3e(e){return vO(e,`Void`)}function IO(e){return yD(e)&&rO in e&&bD(e[rO])}function LO(e){return C3e(e)||w3e(e)||cO(e)||dO(e)||uO(e)||lO(e)||fO(e)||pO(e)||T3e(e)||mO(e)||hO(e)||gO(e)||_O(e)||yO(e)||bO(e)||xO(e)||SO(e)||D3e(e)||CO(e)||wO(e)||TO(e)||EO(e)||DO(e)||OO(e)||O3e(e)||kO(e)||AO(e)||jO(e)||k3e(e)||NO(e)||PO(e)||FO(e)||A3e(e)||j3e(e)||M3e(e)||N3e(e)||IO(e)}var RO=s((()=>{CD(),aO()}));function P3e(e){try{return new RegExp(e),!0}catch{return!1}}function zO(e){if(!bD(e))return!1;for(let t=0;t<e.length;t++){let n=e.charCodeAt(t);if(n>=7&&n<=13||n===27||n===127)return!1}return!0}function F3e(e){return HO(e)||xk(e)}function BO(e){return SD(e)||Z4e(e)}function VO(e){return SD(e)||vD(e)}function HO(e){return SD(e)||gD(e)}function UO(e){return SD(e)||bD(e)}function I3e(e){return SD(e)||bD(e)&&zO(e)&&P3e(e)}function L3e(e){return SD(e)||bD(e)&&zO(e)}function R3e(e){return SD(e)||xk(e)}function WO(e){return yD(e)&&e[tO]===`Optional`}function GO(e){return nk(e,`Any`)&&UO(e.$id)}function z3e(e){return nk(e,`Argument`)&&vD(e.index)}function KO(e){return nk(e,`Array`)&&e.type===`array`&&UO(e.$id)&&xk(e.items)&&VO(e.minItems)&&VO(e.maxItems)&&HO(e.uniqueItems)&&R3e(e.contains)&&VO(e.minContains)&&VO(e.maxContains)}function qO(e){return nk(e,`AsyncIterator`)&&e.type===`AsyncIterator`&&UO(e.$id)&&xk(e.items)}function JO(e){return nk(e,`BigInt`)&&e.type===`bigint`&&UO(e.$id)&&BO(e.exclusiveMaximum)&&BO(e.exclusiveMinimum)&&BO(e.maximum)&&BO(e.minimum)&&BO(e.multipleOf)}function YO(e){return nk(e,`Boolean`)&&e.type===`boolean`&&UO(e.$id)}function B3e(e){return nk(e,`Computed`)&&bD(e.target)&&hD(e.parameters)&&e.parameters.every(e=>xk(e))}function XO(e){return nk(e,`Constructor`)&&e.type===`Constructor`&&UO(e.$id)&&hD(e.parameters)&&e.parameters.every(e=>xk(e))&&xk(e.returns)}function ZO(e){return nk(e,`Date`)&&e.type===`Date`&&UO(e.$id)&&VO(e.exclusiveMaximumTimestamp)&&VO(e.exclusiveMinimumTimestamp)&&VO(e.maximumTimestamp)&&VO(e.minimumTimestamp)&&VO(e.multipleOfTimestamp)}function QO(e){return nk(e,`Function`)&&e.type===`Function`&&UO(e.$id)&&hD(e.parameters)&&e.parameters.every(e=>xk(e))&&xk(e.returns)}function $O(e){return nk(e,`Integer`)&&e.type===`integer`&&UO(e.$id)&&VO(e.exclusiveMaximum)&&VO(e.exclusiveMinimum)&&VO(e.maximum)&&VO(e.minimum)&&VO(e.multipleOf)}function V3e(e){return yD(e)&&Object.entries(e).every(([e,t])=>zO(e)&&xk(t))}function ek(e){return nk(e,`Intersect`)&&!(bD(e.type)&&e.type!==`object`)&&hD(e.allOf)&&e.allOf.every(e=>xk(e)&&!X3e(e))&&UO(e.type)&&(HO(e.unevaluatedProperties)||R3e(e.unevaluatedProperties))&&UO(e.$id)}function tk(e){return nk(e,`Iterator`)&&e.type===`Iterator`&&UO(e.$id)&&xk(e.items)}function nk(e,t){return yD(e)&&rO in e&&e[rO]===t}function H3e(e){return rk(e)&&bD(e.const)}function U3e(e){return rk(e)&&vD(e.const)}function W3e(e){return rk(e)&&gD(e.const)}function rk(e){return nk(e,`Literal`)&&UO(e.$id)&&G3e(e.const)}function G3e(e){return gD(e)||vD(e)||bD(e)}function K3e(e){return nk(e,`MappedKey`)&&hD(e.keys)&&e.keys.every(e=>vD(e)||bD(e))}function q3e(e){return nk(e,`MappedResult`)&&V3e(e.properties)}function ik(e){return nk(e,`Never`)&&yD(e.not)&&Object.getOwnPropertyNames(e.not).length===0}function ak(e){return nk(e,`Not`)&&xk(e.not)}function ok(e){return nk(e,`Null`)&&e.type===`null`&&UO(e.$id)}function sk(e){return nk(e,`Number`)&&e.type===`number`&&UO(e.$id)&&VO(e.exclusiveMaximum)&&VO(e.exclusiveMinimum)&&VO(e.maximum)&&VO(e.minimum)&&VO(e.multipleOf)}function ck(e){return nk(e,`Object`)&&e.type===`object`&&UO(e.$id)&&V3e(e.properties)&&F3e(e.additionalProperties)&&VO(e.minProperties)&&VO(e.maxProperties)}function lk(e){return nk(e,`Promise`)&&e.type===`Promise`&&UO(e.$id)&&xk(e.item)}function uk(e){return nk(e,`Record`)&&e.type===`object`&&UO(e.$id)&&F3e(e.additionalProperties)&&yD(e.patternProperties)&&(e=>{let t=Object.getOwnPropertyNames(e.patternProperties);return t.length===1&&P3e(t[0])&&yD(e.patternProperties)&&xk(e.patternProperties[t[0]])})(e)}function J3e(e){return nk(e,`Ref`)&&UO(e.$id)&&bD(e.$ref)}function dk(e){return nk(e,`RegExp`)&&UO(e.$id)&&bD(e.source)&&bD(e.flags)&&VO(e.maxLength)&&VO(e.minLength)}function fk(e){return nk(e,`String`)&&e.type===`string`&&UO(e.$id)&&VO(e.minLength)&&VO(e.maxLength)&&I3e(e.pattern)&&L3e(e.format)}function pk(e){return nk(e,`Symbol`)&&e.type===`symbol`&&UO(e.$id)}function mk(e){return nk(e,`TemplateLiteral`)&&e.type===`string`&&bD(e.pattern)&&e.pattern[0]===`^`&&e.pattern[e.pattern.length-1]===`$`}function Y3e(e){return nk(e,`This`)&&UO(e.$id)&&bD(e.$ref)}function X3e(e){return yD(e)&&$D in e}function hk(e){return nk(e,`Tuple`)&&e.type===`array`&&UO(e.$id)&&vD(e.minItems)&&vD(e.maxItems)&&e.minItems===e.maxItems&&(SD(e.items)&&SD(e.additionalItems)&&e.minItems===0||hD(e.items)&&e.items.every(e=>xk(e)))}function gk(e){return nk(e,`Undefined`)&&e.type===`undefined`&&UO(e.$id)}function _k(e){return nk(e,`Union`)&&UO(e.$id)&&yD(e)&&hD(e.anyOf)&&e.anyOf.every(e=>xk(e))}function vk(e){return nk(e,`Uint8Array`)&&e.type===`Uint8Array`&&UO(e.$id)&&VO(e.minByteLength)&&VO(e.maxByteLength)}function yk(e){return nk(e,`Unknown`)&&UO(e.$id)}function Z3e(e){return nk(e,`Unsafe`)}function bk(e){return nk(e,`Void`)&&e.type===`void`&&UO(e.$id)}function Q3e(e){return yD(e)&&rO in e&&bD(e[rO])&&!$3e.includes(e[rO])}function xk(e){return yD(e)&&(GO(e)||z3e(e)||KO(e)||YO(e)||JO(e)||qO(e)||B3e(e)||XO(e)||ZO(e)||QO(e)||$O(e)||ek(e)||tk(e)||rk(e)||K3e(e)||q3e(e)||ik(e)||ak(e)||ok(e)||sk(e)||ck(e)||lk(e)||uk(e)||J3e(e)||dk(e)||fk(e)||pk(e)||mk(e)||Y3e(e)||hk(e)||gk(e)||_k(e)||vk(e)||yk(e)||Z3e(e)||bk(e)||Q3e(e))}var $3e,e6e=s((()=>{CD(),aO(),$3e=`Argument.Any.Array.AsyncIterator.BigInt.Boolean.Computed.Constructor.Date.Enum.Function.Integer.Intersect.Iterator.Literal.MappedKey.MappedResult.Not.Null.Number.Object.Promise.Record.Ref.RegExp.String.Symbol.TemplateLiteral.This.Tuple.Undefined.Union.Uint8Array.Unknown.Void`.split(`.`)})),t6e=s((()=>{e6e(),CD()})),n6e=s((()=>{})),r6e=s((()=>{n6e()})),Sk,Ck,wk,i6e,Tk,Ek,a6e,o6e=s((()=>{Sk=`(true|false)`,Ck=`(0|[1-9][0-9]*)`,wk=`(.*)`,i6e=`(?!.*)`,`${Sk}`,Tk=`^${Ck}$`,Ek=`^${wk}$`,a6e=`^${i6e}$`})),Dk=s((()=>{o6e()}));function Ok(e){return kk.has(e)}function s6e(e,t){kk.set(e,t)}function c6e(e){return kk.get(e)}var kk,l6e=s((()=>{kk=new Map}));function Ak(e){return jk.has(e)}function u6e(e,t){jk.set(e,t)}function d6e(e){return jk.get(e)}var jk,f6e=s((()=>{jk=new Map})),Mk=s((()=>{l6e(),f6e()}));function p6e(e,t){return e.includes(t)}function m6e(e){return[...new Set(e)]}function h6e(e,t){return e.filter(e=>t.includes(e))}function g6e(e,t){return e.reduce((e,t)=>h6e(e,t),t)}function _6e(e){return e.length===1?e[0]:e.length>1?g6e(e.slice(1),e[0]):[]}function v6e(e){let t=[];for(let n of e)t.push(...n);return t}var y6e=s((()=>{})),Nk=s((()=>{y6e()}));function Pk(e){return JD({[rO]:`Any`},e)}var b6e=s((()=>{XD(),aO()})),Fk=s((()=>{b6e()}));function Ik(e,t){return JD({[rO]:`Array`,type:`array`,items:e},t)}var x6e=s((()=>{YD(),aO()})),Lk=s((()=>{x6e()}));function S6e(e){return JD({[rO]:`Argument`,index:e})}var C6e=s((()=>{YD(),aO()})),w6e=s((()=>{C6e()}));function Rk(e,t){return JD({[rO]:`AsyncIterator`,type:`AsyncIterator`,items:e},t)}var T6e=s((()=>{aO(),YD()})),zk=s((()=>{T6e()}));function Bk(e,t,n){return JD({[rO]:`Computed`,target:e,parameters:t},n)}var E6e=s((()=>{XD(),iO()})),Vk=s((()=>{E6e()}));function D6e(e,t){let{[t]:n,...r}=e;return r}function Hk(e,t){return t.reduce((e,t)=>D6e(e,t),e)}var Uk=s((()=>{})),Wk=s((()=>{Uk()}));function Gk(e){return JD({[rO]:`Never`,not:{}},e)}var O6e=s((()=>{YD(),aO()})),Kk=s((()=>{O6e()})),k6e=s((()=>{}));function qk(e){return JD({[rO]:`MappedResult`,properties:e})}var A6e=s((()=>{YD(),aO()}));function Jk(e,t,n){return JD({[rO]:`Constructor`,type:`Constructor`,parameters:e,returns:t},n)}var j6e=s((()=>{YD(),aO()})),Yk=s((()=>{j6e()}));function Xk(e,t,n){return JD({[rO]:`Function`,type:`Function`,parameters:e,returns:t},n)}var M6e=s((()=>{YD(),aO()})),Zk=s((()=>{M6e()}));function Qk(e,t){return JD({[rO]:`Union`,anyOf:e},t)}var N6e=s((()=>{YD(),aO()}));function P6e(e){return e.some(e=>sO(e))}function F6e(e){return e.map(e=>sO(e)?I6e(e):e)}function I6e(e){return Hk(e,[tO])}function L6e(e,t){return P6e(e)?HA(Qk(F6e(e),t)):Qk(F6e(e),t)}function $k(e,t){return e.length===1?JD(e[0],t):e.length===0?Gk(t):L6e(e,t)}var R6e=s((()=>{YD(),aO(),Wk(),Kk(),UA(),N6e(),RO()})),z6e=s((()=>{}));function eA(e,t){return e.length===0?Gk(t):e.length===1?JD(e[0],t):Qk(e,t)}var B6e=s((()=>{Kk(),YD(),N6e()})),tA=s((()=>{R6e(),z6e(),B6e()}));function V6e(e){return e.replace(/\\\$/g,`$`).replace(/\\\*/g,`*`).replace(/\\\^/g,`^`).replace(/\\\|/g,`|`).replace(/\\\(/g,`(`).replace(/\\\)/g,`)`)}function nA(e,t,n){return e[t]===n&&e.charCodeAt(t-1)!==92}function rA(e,t){return nA(e,t,`(`)}function iA(e,t){return nA(e,t,`)`)}function H6e(e,t){return nA(e,t,`|`)}function U6e(e){if(!(rA(e,0)&&iA(e,e.length-1)))return!1;let t=0;for(let n=0;n<e.length;n++)if(rA(e,n)&&(t+=1),iA(e,n)&&--t,t===0&&n!==e.length-1)return!1;return!0}function W6e(e){return e.slice(1,e.length-1)}function G6e(e){let t=0;for(let n=0;n<e.length;n++)if(rA(e,n)&&(t+=1),iA(e,n)&&--t,H6e(e,n)&&t===0)return!0;return!1}function K6e(e){for(let t=0;t<e.length;t++)if(rA(e,t))return!0;return!1}function q6e(e){let[t,n]=[0,0],r=[];for(let i=0;i<e.length;i++)if(rA(e,i)&&(t+=1),iA(e,i)&&--t,H6e(e,i)&&t===0){let t=e.slice(n,i);t.length>0&&r.push(aA(t)),n=i+1}let i=e.slice(n);return i.length>0&&r.push(aA(i)),r.length===0?{type:`const`,const:``}:r.length===1?r[0]:{type:`or`,expr:r}}function J6e(e){function t(e,t){if(!rA(e,t))throw new sA(`TemplateLiteralParser: Index must point to open parens`);let n=0;for(let r=t;r<e.length;r++)if(rA(e,r)&&(n+=1),iA(e,r)&&--n,n===0)return[t,r];throw new sA(`TemplateLiteralParser: Unclosed group parens in expression`)}function n(e,t){for(let n=t;n<e.length;n++)if(rA(e,n))return[t,n];return[t,e.length]}let r=[];for(let i=0;i<e.length;i++)if(rA(e,i)){let[n,a]=t(e,i),o=e.slice(n,a+1);r.push(aA(o)),i=a}else{let[t,a]=n(e,i),o=e.slice(t,a);o.length>0&&r.push(aA(o)),i=a-1}return r.length===0?{type:`const`,const:``}:r.length===1?r[0]:{type:`and`,expr:r}}function aA(e){return U6e(e)?aA(W6e(e)):G6e(e)?q6e(e):K6e(e)?J6e(e):{type:`const`,const:V6e(e)}}function oA(e){return aA(e.slice(1,e.length-1))}var sA,cA=s((()=>{QD(),sA=class extends ZD{}}));function Y6e(e){return e.type===`or`&&e.expr.length===2&&e.expr[0].type===`const`&&e.expr[0].const===`0`&&e.expr[1].type===`const`&&e.expr[1].const===`[1-9][0-9]*`}function X6e(e){return e.type===`or`&&e.expr.length===2&&e.expr[0].type===`const`&&e.expr[0].const===`true`&&e.expr[1].type===`const`&&e.expr[1].const===`false`}function Z6e(e){return e.type===`const`&&e.const===`.*`}function lA(e){return Y6e(e)||Z6e(e)?!1:X6e(e)?!0:e.type===`and`||e.type===`or`?e.expr.every(e=>lA(e)):e.type===`const`?!0:(()=>{throw new $6e(`Unknown expression type`)})()}function Q6e(e){return lA(oA(e.pattern))}var $6e,e8e=s((()=>{cA(),QD(),$6e=class extends ZD{}}));function*t8e(e){if(e.length===1)return yield*e[0];for(let t of e[0])for(let n of t8e(e.slice(1)))yield`${t}${n}`}function*n8e(e){return yield*t8e(e.expr.map(e=>[...uA(e)]))}function*r8e(e){for(let t of e.expr)yield*uA(t)}function*i8e(e){return yield e.const}function*uA(e){return e.type===`and`?yield*n8e(e):e.type===`or`?yield*r8e(e):e.type===`const`?yield*i8e(e):(()=>{throw new a8e(`Unknown expression`)})()}function dA(e){let t=oA(e.pattern);return lA(t)?[...uA(t)]:[]}var a8e,o8e=s((()=>{e8e(),cA(),QD(),a8e=class extends ZD{}}));function fA(e,t){return JD({[rO]:`Literal`,const:e,type:typeof e},t)}var s8e=s((()=>{YD(),aO()})),pA=s((()=>{s8e()}));function c8e(e){return JD({[rO]:`Boolean`,type:`boolean`},e)}var l8e=s((()=>{aO(),XD()})),mA=s((()=>{l8e()}));function hA(e){return JD({[rO]:`BigInt`,type:`bigint`},e)}var u8e=s((()=>{aO(),XD()})),gA=s((()=>{u8e()}));function _A(e){return JD({[rO]:`Number`,type:`number`},e)}var d8e=s((()=>{YD(),aO()})),vA=s((()=>{d8e()}));function yA(e){return JD({[rO]:`String`,type:`string`},e)}var f8e=s((()=>{YD(),aO()})),bA=s((()=>{f8e()}));function*p8e(e){let t=e.trim().replace(/"|'/g,``);return t===`boolean`?yield c8e():t===`number`?yield _A():t===`bigint`?yield hA():t===`string`?yield yA():yield(()=>{let e=t.split(`|`).map(e=>fA(e.trim()));return e.length===0?Gk():e.length===1?e[0]:$k(e)})()}function*m8e(e){if(e[1]!==`{`)return yield*[fA(`$`),...xA(e.slice(1))];for(let t=2;t<e.length;t++)if(e[t]===`}`){let n=p8e(e.slice(2,t)),r=xA(e.slice(t+1));return yield*[...n,...r]}yield fA(e)}function*xA(e){for(let t=0;t<e.length;t++)if(e[t]===`$`)return yield*[fA(e.slice(0,t)),...m8e(e.slice(t))];yield fA(e)}function h8e(e){return[...xA(e)]}var g8e=s((()=>{pA(),mA(),gA(),vA(),bA(),tA(),Kk()}));function _8e(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}function v8e(e,t){return jO(e)?e.pattern.slice(1,e.pattern.length-1):FO(e)?`(${e.anyOf.map(e=>v8e(e,t)).join(`|`)})`:wO(e)||hO(e)||uO(e)?`${t}${Ck}`:kO(e)?`${t}${wk}`:yO(e)?`${t}${_8e(e.const.toString())}`:dO(e)?`${t}${Sk}`:(()=>{throw new b8e(`Unexpected Kind '${e[rO]}'`)})()}function y8e(e){return`^${e.map(e=>v8e(e,``)).join(``)}\$`}var b8e,x8e=s((()=>{Dk(),aO(),QD(),RO(),b8e=class extends ZD{}}));function SA(e){return $k(dA(e).map(e=>fA(e)))}var S8e=s((()=>{tA(),pA(),o8e()}));function C8e(e,t){let n=bD(e)?y8e(h8e(e)):y8e(e);return JD({[rO]:`TemplateLiteral`,type:`string`,pattern:n},t)}var w8e=s((()=>{YD(),g8e(),x8e(),CD(),aO()})),CA=s((()=>{e8e(),o8e(),g8e(),cA(),x8e(),S8e(),w8e()}));function T8e(e){return dA(e).map(e=>e.toString())}function E8e(e){let t=[];for(let n of e)t.push(...wA(n));return t}function D8e(e){return[e.toString()]}function wA(e){return[...new Set(jO(e)?T8e(e):FO(e)?E8e(e.anyOf):yO(e)?D8e(e.const):wO(e)||hO(e)?[`[number]`]:[])]}var TA=s((()=>{CA(),RO()}));function O8e(e,t,n){let r={};for(let i of Object.getOwnPropertyNames(t))r[i]=DA(e,wA(t[i]),n);return r}function k8e(e,t,n){return O8e(e,t.properties,n)}function A8e(e,t,n){return qk(k8e(e,t,n))}var j8e=s((()=>{VA(),TA(),kA()}));function M8e(e,t){return e.map(e=>B8e(e,t))}function N8e(e){return e.filter(e=>!SO(e))}function P8e(e,t){return A5e(N8e(M8e(e,t)))}function F8e(e){return e.some(e=>SO(e))?[]:e}function I8e(e,t){return $k(F8e(M8e(e,t)))}function L8e(e,t){return t in e?e[t]:t===`[number]`?$k(e):Gk()}function R8e(e,t){return t===`[number]`?e:Gk()}function z8e(e,t){return t in e?e[t]:Gk()}function B8e(e,t){return gO(e)?P8e(e.allOf,t):FO(e)?I8e(e.anyOf,t):NO(e)?L8e(e.items??[],t):cO(e)?R8e(e.items,t):TO(e)?z8e(e.properties,t):Gk()}function EA(e,t){return t.map(t=>B8e(e,t))}function V8e(e,t){return $k(EA(e,t))}function DA(e,t,n){if(OO(e)||OO(t)){if(!LO(e)||!LO(t))throw new ZD(`Index types using Ref parameters require both Type and Key to be of TSchema`);return Bk(`Index`,[e,t])}return xO(t)?A8e(e,t,n):bO(t)?G8e(e,t,n):JD(LO(t)?V8e(e,wA(t)):V8e(e,t),n)}var OA=s((()=>{YD(),QD(),Vk(),Kk(),KA(),tA(),TA(),K8e(),j8e(),RO()}));function H8e(e,t,n){return{[t]:DA(e,[t],TD(n))}}function U8e(e,t,n){return t.reduce((t,r)=>({...t,...H8e(e,r,n)}),{})}function W8e(e,t,n){return U8e(e,t.keys,n)}function G8e(e,t,n){return qk(W8e(e,t,n))}var K8e=s((()=>{OA(),VA(),ED()})),kA=s((()=>{K8e(),j8e(),TA(),OA()}));function AA(e,t){return JD({[rO]:`Iterator`,type:`Iterator`,items:e},t)}var q8e=s((()=>{YD(),aO()})),jA=s((()=>{q8e()}));function J8e(e){let t=[];for(let n in e)sO(e[n])||t.push(n);return t}function Y8e(e,t){let n=J8e(e);return JD(n.length>0?{[rO]:`Object`,type:`object`,properties:e,required:n}:{[rO]:`Object`,type:`object`,properties:e},t)}var MA,X8e=s((()=>{YD(),aO(),RO(),MA=Y8e})),NA=s((()=>{X8e()}));function Z8e(e,t){return JD({[rO]:`Promise`,type:`Promise`,item:e},t)}var Q8e=s((()=>{YD(),aO()})),PA=s((()=>{Q8e()}));function $8e(e){return JD(Hk(e,[eO]))}function e5e(e){return JD({...e,[eO]:`Readonly`})}function t5e(e,t){return t===!1?$8e(e):e5e(e)}function FA(e,t){let n=t??!0;return xO(e)?a5e(e,n):t5e(e,n)}var n5e=s((()=>{YD(),aO(),Wk(),o5e(),RO()}));function r5e(e,t){let n={};for(let r of globalThis.Object.getOwnPropertyNames(e))n[r]=FA(e[r],t);return n}function i5e(e,t){return r5e(e.properties,t)}function a5e(e,t){return qk(i5e(e,t))}var o5e=s((()=>{VA(),n5e()})),IA=s((()=>{o5e(),n5e()}));function LA(e,t){return JD(e.length>0?{[rO]:`Tuple`,type:`array`,items:e,additionalItems:!1,minItems:e.length,maxItems:e.length}:{[rO]:`Tuple`,type:`array`,minItems:e.length,maxItems:e.length},t)}var s5e=s((()=>{YD(),aO()})),RA=s((()=>{s5e()}));function c5e(e,t){return e in t?BA(e,t[e]):qk(t)}function l5e(e){return{[e]:fA(e)}}function u5e(e){let t={};for(let n of e)t[n]=fA(n);return t}function d5e(e,t){return p6e(t,e)?l5e(e):u5e(t)}function f5e(e,t){return c5e(e,d5e(e,t))}function zA(e,t){return t.map(t=>BA(e,t))}function p5e(e,t){let n={};for(let r of globalThis.Object.getOwnPropertyNames(t))n[r]=BA(e,t[r]);return n}function BA(e,t){let n={...t};return sO(t)?HA(BA(e,Hk(t,[tO]))):oO(t)?FA(BA(e,Hk(t,[eO]))):xO(t)?c5e(e,t.properties):bO(t)?f5e(e,t.keys):pO(t)?Jk(zA(e,t.parameters),BA(e,t.returns),n):mO(t)?Xk(zA(e,t.parameters),BA(e,t.returns),n):lO(t)?Rk(BA(e,t.items),n):_O(t)?AA(BA(e,t.items),n):gO(t)?GA(zA(e,t.allOf),n):FO(t)?eA(zA(e,t.anyOf),n):NO(t)?LA(zA(e,t.items??[]),n):TO(t)?MA(p5e(e,t.properties),n):cO(t)?Ik(BA(e,t.items),n):EO(t)?Z8e(BA(e,t.item),n):t}function m5e(e,t){let n={};for(let r of e)n[r]=BA(r,t);return n}function h5e(e,t,n){let r=LO(e)?wA(e):e;return MA(m5e(r,t({[rO]:`MappedKey`,keys:r})),n)}var g5e=s((()=>{aO(),Wk(),Lk(),zk(),Yk(),Zk(),kA(),KA(),jA(),pA(),NA(),UA(),PA(),IA(),RA(),tA(),Nk(),A6e(),RO()})),VA=s((()=>{k6e(),A6e(),g5e()}));function _5e(e){return JD(Hk(e,[tO]))}function v5e(e){return JD({...e,[tO]:`Optional`})}function y5e(e,t){return t===!1?_5e(e):v5e(e)}function HA(e,t){let n=t??!0;return xO(e)?C5e(e,n):y5e(e,n)}var b5e=s((()=>{YD(),aO(),Wk(),w5e(),RO()}));function x5e(e,t){let n={};for(let r of globalThis.Object.getOwnPropertyNames(e))n[r]=HA(e[r],t);return n}function S5e(e,t){return x5e(e.properties,t)}function C5e(e,t){return qk(S5e(e,t))}var w5e=s((()=>{VA(),b5e()})),UA=s((()=>{w5e(),b5e()}));function WA(e,t={}){let n=e.every(e=>TO(e)),r=LO(t.unevaluatedProperties)?{unevaluatedProperties:t.unevaluatedProperties}:{};return JD(t.unevaluatedProperties===!1||LO(t.unevaluatedProperties)||n?{...r,[rO]:`Intersect`,type:`object`,allOf:e}:{...r,[rO]:`Intersect`,allOf:e},t)}var T5e=s((()=>{YD(),aO(),RO()}));function E5e(e){return e.every(e=>sO(e))}function D5e(e){return Hk(e,[tO])}function O5e(e){return e.map(e=>sO(e)?D5e(e):e)}function k5e(e,t){return E5e(e)?HA(WA(O5e(e),t)):WA(O5e(e),t)}function A5e(e,t={}){if(e.length===1)return JD(e[0],t);if(e.length===0)return Gk(t);if(e.some(e=>MO(e)))throw Error(`Cannot intersect transform types`);return k5e(e,t)}var j5e=s((()=>{aO(),YD(),Wk(),Kk(),UA(),T5e(),RO()})),M5e=s((()=>{}));function GA(e,t){if(e.length===1)return JD(e[0],t);if(e.length===0)return Gk(t);if(e.some(e=>MO(e)))throw Error(`Cannot intersect transform types`);return WA(e,t)}var N5e=s((()=>{YD(),Kk(),T5e(),RO()})),KA=s((()=>{j5e(),M5e(),N5e()}));function qA(...e){let[t,n]=typeof e[0]==`string`?[e[0],e[1]]:[e[0].$id,e[1]];if(typeof t!=`string`)throw new ZD(`Ref: $ref must be a string`);return JD({[rO]:`Ref`,$ref:t},n)}var P5e=s((()=>{QD(),YD(),aO()})),JA=s((()=>{P5e()}));function F5e(e,t){return Bk(`Awaited`,[Bk(e,t)])}function I5e(e){return Bk(`Awaited`,[qA(e)])}function L5e(e){return GA(B5e(e))}function R5e(e){return eA(B5e(e))}function z5e(e){return YA(e)}function B5e(e){return e.map(e=>YA(e))}function YA(e,t){return JD(fO(e)?F5e(e.target,e.parameters):gO(e)?L5e(e.allOf):FO(e)?R5e(e.anyOf):EO(e)?z5e(e.item):OO(e)?I5e(e.$ref):e,t)}var V5e=s((()=>{YD(),Vk(),KA(),tA(),JA(),RO()})),XA=s((()=>{V5e()}));function H5e(e){let t=[];for(let n of e)t.push(ZA(n));return t}function U5e(e){return v6e(H5e(e))}function W5e(e){return _6e(H5e(e))}function G5e(e){return e.map((e,t)=>t.toString())}function K5e(e){return[`[number]`]}function q5e(e){return globalThis.Object.getOwnPropertyNames(e)}function J5e(e){return $A?globalThis.Object.getOwnPropertyNames(e).map(e=>e[0]===`^`&&e[e.length-1]===`$`?e.slice(1,e.length-1):e):[]}function ZA(e){return gO(e)?U5e(e.allOf):FO(e)?W5e(e.anyOf):NO(e)?G5e(e.items??[]):cO(e)?K5e(e.items):TO(e)?q5e(e.properties):DO(e)?J5e(e.patternProperties):[]}function QA(e){$A=!0;let t=ZA(e);return $A=!1,`^(${t.map(e=>`(${e})`).join(`|`)})$`}var $A,ej=s((()=>{Nk(),RO(),$A=!1}));function Y5e(e,t){return Bk(`KeyOf`,[Bk(e,t)])}function X5e(e){return Bk(`KeyOf`,[qA(e)])}function Z5e(e,t){return JD($k(Q5e(ZA(e))),t)}function Q5e(e){return e.map(e=>e===`[number]`?_A():fA(e))}function tj(e,t){return fO(e)?Y5e(e.target,e.parameters):OO(e)?X5e(e.$ref):xO(e)?n7e(e,t):Z5e(e,t)}var $5e=s((()=>{YD(),pA(),vA(),Vk(),JA(),ej(),tA(),r7e(),RO()}));function e7e(e,t){let n={};for(let r of globalThis.Object.getOwnPropertyNames(e))n[r]=tj(e[r],TD(t));return n}function t7e(e,t){return e7e(e.properties,t)}function n7e(e,t){return qk(t7e(e,t))}var r7e=s((()=>{VA(),$5e(),ED()}));function i7e(e){let t=ZA(e),n=EA(e,t);return t.map((e,r)=>[t[r],n[r]])}var a7e=s((()=>{OA(),ej()})),nj=s((()=>{r7e(),a7e(),ej(),$5e()}));function o7e(e){let t=[];for(let n of e)t.push(...ZA(n));return m6e(t)}function s7e(e){return e.filter(e=>!SO(e))}function c7e(e,t){let n=[];for(let r of e)n.push(...EA(r,[t]));return s7e(n)}function l7e(e,t){let n={};for(let r of t)n[r]=A5e(c7e(e,r));return n}function u7e(e,t){return MA(l7e(e,o7e(e)),t)}var d7e=s((()=>{KA(),kA(),nj(),NA(),Nk(),RO()})),f7e=s((()=>{d7e()}));function p7e(e){return JD({[rO]:`Date`,type:`Date`},e)}var m7e=s((()=>{aO(),YD()})),rj=s((()=>{m7e()}));function h7e(e){return JD({[rO]:`Null`,type:`null`},e)}var g7e=s((()=>{YD(),aO()})),ij=s((()=>{g7e()}));function _7e(e){return JD({[rO]:`Symbol`,type:`symbol`},e)}var v7e=s((()=>{YD(),aO()})),aj=s((()=>{v7e()}));function y7e(e){return JD({[rO]:`Undefined`,type:`undefined`},e)}var b7e=s((()=>{YD(),aO()})),oj=s((()=>{b7e()}));function x7e(e){return JD({[rO]:`Uint8Array`,type:`Uint8Array`},e)}var S7e=s((()=>{YD(),aO()})),sj=s((()=>{S7e()}));function cj(e){return JD({[rO]:`Unknown`},e)}var C7e=s((()=>{YD(),aO()})),lj=s((()=>{C7e()}));function w7e(e){return e.map(e=>dj(e,!1))}function T7e(e){let t={};for(let n of globalThis.Object.getOwnPropertyNames(e))t[n]=FA(dj(e[n],!1));return t}function uj(e,t){return t===!0?e:FA(e)}function dj(e,t){return X4e(e)||$4e(e)?uj(Pk(),t):hD(e)?FA(LA(w7e(e))):xD(e)?x7e():_D(e)?p7e():yD(e)?uj(MA(T7e(e)),t):Q4e(e)?uj(Xk([],cj()),t):SD(e)?y7e():e3e(e)?h7e():n3e(e)?_7e():Z4e(e)?hA():vD(e)||gD(e)||bD(e)?fA(e):MA({})}function E7e(e,t){return JD(dj(e,!0),t)}var D7e=s((()=>{Fk(),gA(),rj(),Zk(),pA(),ij(),NA(),aj(),RA(),IA(),oj(),sj(),lj(),XD(),CD()})),O7e=s((()=>{D7e()}));function k7e(e,t){return pO(e)?LA(e.parameters,t):Gk(t)}var A7e=s((()=>{RA(),Kk(),RO()})),j7e=s((()=>{A7e()}));function M7e(e,t){if(SD(e))throw Error(`Enum undefined or empty`);let n=globalThis.Object.getOwnPropertyNames(e).filter(e=>isNaN(e)).map(t=>e[t]);return eA([...new Set(n)].map(e=>fA(e)),{...t,[nO]:`Enum`})}var N7e=s((()=>{pA(),aO(),tA(),CD()})),P7e=s((()=>{N7e()}));function fj(e){return e===Oj.False?e:Oj.True}function pj(e){throw new j9e(e)}function mj(e){return ik(e)||ek(e)||_k(e)||yk(e)||GO(e)}function hj(e,t){return ik(t)?X7e(e,t):ek(t)?_j(e,t):_k(t)?Tj(e,t):yk(t)?D9e(e,t):GO(t)?gj(e,t):pj(`StructuralRight`)}function gj(e,t){return Oj.True}function F7e(e,t){return ek(t)?_j(e,t):_k(t)&&t.anyOf.some(e=>GO(e)||yk(e))?Oj.True:_k(t)?Oj.Union:yk(t)||GO(t)?Oj.True:Oj.Union}function I7e(e,t){return yk(e)?Oj.False:GO(e)?Oj.Union:ik(e)?Oj.True:Oj.False}function L7e(e,t){return ck(t)&&bj(t)?Oj.True:mj(t)?hj(e,t):KO(t)?fj(Ej(e.items,t.items)):Oj.False}function R7e(e,t){return mj(t)?hj(e,t):qO(t)?fj(Ej(e.items,t.items)):Oj.False}function z7e(e,t){return mj(t)?hj(e,t):ck(t)?xj(e,t):uk(t)?wj(e,t):JO(t)?Oj.True:Oj.False}function B7e(e,t){return W3e(e)||YO(e)?Oj.True:Oj.False}function V7e(e,t){return mj(t)?hj(e,t):ck(t)?xj(e,t):uk(t)?wj(e,t):YO(t)?Oj.True:Oj.False}function H7e(e,t){return mj(t)?hj(e,t):ck(t)?xj(e,t):XO(t)?e.parameters.length>t.parameters.length?Oj.False:e.parameters.every((e,n)=>fj(Ej(t.parameters[n],e))===Oj.True)?fj(Ej(e.returns,t.returns)):Oj.False:Oj.False}function U7e(e,t){return mj(t)?hj(e,t):ck(t)?xj(e,t):uk(t)?wj(e,t):ZO(t)?Oj.True:Oj.False}function W7e(e,t){return mj(t)?hj(e,t):ck(t)?xj(e,t):QO(t)?e.parameters.length>t.parameters.length?Oj.False:e.parameters.every((e,n)=>fj(Ej(t.parameters[n],e))===Oj.True)?fj(Ej(e.returns,t.returns)):Oj.False:Oj.False}function G7e(e,t){return rk(e)&&vD(e.const)||sk(e)||$O(e)?Oj.True:Oj.False}function K7e(e,t){return $O(t)||sk(t)?Oj.True:mj(t)?hj(e,t):ck(t)?xj(e,t):uk(t)?wj(e,t):Oj.False}function _j(e,t){return t.allOf.every(t=>Ej(e,t)===Oj.True)?Oj.True:Oj.False}function q7e(e,t){return e.allOf.some(e=>Ej(e,t)===Oj.True)?Oj.True:Oj.False}function J7e(e,t){return mj(t)?hj(e,t):tk(t)?fj(Ej(e.items,t.items)):Oj.False}function Y7e(e,t){return rk(t)&&t.const===e.const?Oj.True:mj(t)?hj(e,t):ck(t)?xj(e,t):uk(t)?wj(e,t):fk(t)?_9e(e,t):sk(t)?t9e(e,t):$O(t)?G7e(e,t):YO(t)?B7e(e,t):Oj.False}function X7e(e,t){return Oj.False}function Z7e(e,t){return Oj.True}function Q7e(e){let[t,n]=[e,0];for(;ak(t);)t=t.not,n+=1;return n%2==0?t:cj()}function $7e(e,t){return ak(e)?Ej(Q7e(e),t):ak(t)?Ej(e,Q7e(t)):pj(`Invalid fallthrough for Not`)}function e9e(e,t){return mj(t)?hj(e,t):ck(t)?xj(e,t):uk(t)?wj(e,t):ok(t)?Oj.True:Oj.False}function t9e(e,t){return U3e(e)||sk(e)||$O(e)?Oj.True:Oj.False}function n9e(e,t){return mj(t)?hj(e,t):ck(t)?xj(e,t):uk(t)?wj(e,t):$O(t)||sk(t)?Oj.True:Oj.False}function vj(e,t){return Object.getOwnPropertyNames(e.properties).length===t}function r9e(e){return bj(e)}function i9e(e){return vj(e,0)||vj(e,1)&&`description`in e.properties&&_k(e.properties.description)&&e.properties.description.anyOf.length===2&&(fk(e.properties.description.anyOf[0])&&gk(e.properties.description.anyOf[1])||fk(e.properties.description.anyOf[1])&&gk(e.properties.description.anyOf[0]))}function yj(e){return vj(e,0)}function a9e(e){return vj(e,0)}function o9e(e){return vj(e,0)}function s9e(e){return vj(e,0)}function c9e(e){return bj(e)}function l9e(e){let t=_A();return vj(e,0)||vj(e,1)&&`length`in e.properties&&fj(Ej(e.properties.length,t))===Oj.True}function u9e(e){return vj(e,0)}function bj(e){let t=_A();return vj(e,0)||vj(e,1)&&`length`in e.properties&&fj(Ej(e.properties.length,t))===Oj.True}function d9e(e){let t=Xk([Pk()],Pk());return vj(e,0)||vj(e,1)&&`then`in e.properties&&fj(Ej(e.properties.then,t))===Oj.True}function f9e(e,t){return Ej(e,t)===Oj.False||WO(e)&&!WO(t)?Oj.False:Oj.True}function xj(e,t){return yk(e)?Oj.False:GO(e)?Oj.Union:ik(e)||H3e(e)&&r9e(t)||U3e(e)&&yj(t)||W3e(e)&&a9e(t)||pk(e)&&i9e(t)||JO(e)&&o9e(t)||fk(e)&&r9e(t)||pk(e)&&i9e(t)||sk(e)&&yj(t)||$O(e)&&yj(t)||YO(e)&&a9e(t)||vk(e)&&c9e(t)||ZO(e)&&s9e(t)||XO(e)&&u9e(t)||QO(e)&&l9e(t)?Oj.True:uk(e)&&fk(Sj(e))?t[nO]===`Record`?Oj.True:Oj.False:uk(e)&&sk(Sj(e))&&vj(t,0)?Oj.True:Oj.False}function p9e(e,t){return mj(t)?hj(e,t):uk(t)?wj(e,t):ck(t)?(()=>{for(let n of Object.getOwnPropertyNames(t.properties)){if(!(n in e.properties)&&!WO(t.properties[n]))return Oj.False;if(WO(t.properties[n]))return Oj.True;if(f9e(e.properties[n],t.properties[n])===Oj.False)return Oj.False}return Oj.True})():Oj.False}function m9e(e,t){return mj(t)?hj(e,t):ck(t)&&d9e(t)?Oj.True:lk(t)?fj(Ej(e.item,t.item)):Oj.False}function Sj(e){return Tk in e.patternProperties?_A():Ek in e.patternProperties?yA():pj(`Unknown record key pattern`)}function Cj(e){return Tk in e.patternProperties?e.patternProperties[Tk]:Ek in e.patternProperties?e.patternProperties[Ek]:pj(`Unable to get record value schema`)}function wj(e,t){let[n,r]=[Sj(t),Cj(t)];return H3e(e)&&sk(n)&&fj(Ej(e,r))===Oj.True?Oj.True:vk(e)&&sk(n)||fk(e)&&sk(n)||KO(e)&&sk(n)?Ej(e,r):ck(e)?(()=>{for(let t of Object.getOwnPropertyNames(e.properties))if(f9e(r,e.properties[t])===Oj.False)return Oj.False;return Oj.True})():Oj.False}function h9e(e,t){return mj(t)?hj(e,t):ck(t)?xj(e,t):uk(t)?Ej(Cj(e),Cj(t)):Oj.False}function g9e(e,t){return Ej(dk(e)?yA():e,dk(t)?yA():t)}function _9e(e,t){return rk(e)&&bD(e.const)||fk(e)?Oj.True:Oj.False}function v9e(e,t){return mj(t)?hj(e,t):ck(t)?xj(e,t):uk(t)?wj(e,t):fk(t)?Oj.True:Oj.False}function y9e(e,t){return mj(t)?hj(e,t):ck(t)?xj(e,t):uk(t)?wj(e,t):pk(t)?Oj.True:Oj.False}function b9e(e,t){return mk(e)?Ej(SA(e),t):mk(t)?Ej(e,SA(t)):pj(`Invalid fallthrough for TemplateLiteral`)}function x9e(e,t){return KO(t)&&e.items!==void 0&&e.items.every(e=>Ej(e,t.items)===Oj.True)}function S9e(e,t){return ik(e)?Oj.True:yk(e)?Oj.False:GO(e)?Oj.Union:Oj.False}function C9e(e,t){return mj(t)?hj(e,t):ck(t)&&bj(t)||KO(t)&&x9e(e,t)?Oj.True:hk(t)?SD(e.items)&&!SD(t.items)||!SD(e.items)&&SD(t.items)?Oj.False:SD(e.items)&&!SD(t.items)||e.items.every((e,n)=>Ej(e,t.items[n])===Oj.True)?Oj.True:Oj.False:Oj.False}function w9e(e,t){return mj(t)?hj(e,t):ck(t)?xj(e,t):uk(t)?wj(e,t):vk(t)?Oj.True:Oj.False}function T9e(e,t){return mj(t)?hj(e,t):ck(t)?xj(e,t):uk(t)?wj(e,t):bk(t)?k9e(e,t):gk(t)?Oj.True:Oj.False}function Tj(e,t){return t.anyOf.some(t=>Ej(e,t)===Oj.True)?Oj.True:Oj.False}function E9e(e,t){return e.anyOf.every(e=>Ej(e,t)===Oj.True)?Oj.True:Oj.False}function D9e(e,t){return Oj.True}function O9e(e,t){return ik(t)?X7e(e,t):ek(t)?_j(e,t):_k(t)?Tj(e,t):GO(t)?gj(e,t):fk(t)?_9e(e,t):sk(t)?t9e(e,t):$O(t)?G7e(e,t):YO(t)?B7e(e,t):KO(t)?I7e(e,t):hk(t)?S9e(e,t):ck(t)?xj(e,t):yk(t)?Oj.True:Oj.False}function k9e(e,t){return gk(e)||gk(e)?Oj.True:Oj.False}function A9e(e,t){return ek(t)?_j(e,t):_k(t)?Tj(e,t):yk(t)?D9e(e,t):GO(t)?gj(e,t):ck(t)?xj(e,t):bk(t)?Oj.True:Oj.False}function Ej(e,t){return mk(e)||mk(t)?b9e(e,t):dk(e)||dk(t)?g9e(e,t):ak(e)||ak(t)?$7e(e,t):GO(e)?F7e(e,t):KO(e)?L7e(e,t):JO(e)?z7e(e,t):YO(e)?V7e(e,t):qO(e)?R7e(e,t):XO(e)?H7e(e,t):ZO(e)?U7e(e,t):QO(e)?W7e(e,t):$O(e)?K7e(e,t):ek(e)?q7e(e,t):tk(e)?J7e(e,t):rk(e)?Y7e(e,t):ik(e)?Z7e(e,t):ok(e)?e9e(e,t):sk(e)?n9e(e,t):ck(e)?p9e(e,t):uk(e)?h9e(e,t):fk(e)?v9e(e,t):pk(e)?y9e(e,t):hk(e)?C9e(e,t):lk(e)?m9e(e,t):vk(e)?w9e(e,t):gk(e)?T9e(e,t):_k(e)?E9e(e,t):yk(e)?O9e(e,t):bk(e)?A9e(e,t):pj(`Unknown left type operand '${e[rO]}'`)}function Dj(e,t){return Ej(e,t)}var j9e,Oj,M9e=s((()=>{Fk(),Zk(),vA(),bA(),lj(),CA(),Dk(),aO(),QD(),t6e(),j9e=class extends ZD{},(function(e){e[e.Union=0]=`Union`,e[e.True=1]=`True`,e[e.False=2]=`False`})(Oj||={})}));function N9e(e,t,n,r,i){let a={};for(let o of globalThis.Object.getOwnPropertyNames(e))a[o]=kj(e[o],t,n,r,TD(i));return a}function P9e(e,t,n,r,i){return N9e(e.properties,t,n,r,i)}function F9e(e,t,n,r,i){return qk(P9e(e,t,n,r,i))}var I9e=s((()=>{VA(),Aj(),ED()}));function L9e(e,t,n,r){let i=Dj(e,t);return i===Oj.Union?eA([n,r]):i===Oj.True?n:r}function kj(e,t,n,r,i){return xO(e)?F9e(e,t,n,r,i):bO(e)?JD(V9e(e,t,n,r,i)):JD(L9e(e,t,n,r),i)}var Aj=s((()=>{YD(),tA(),M9e(),H9e(),I9e(),RO()}));function R9e(e,t,n,r,i){return{[e]:kj(fA(e),t,n,r,TD(i))}}function z9e(e,t,n,r,i){return e.reduce((e,a)=>({...e,...R9e(a,t,n,r,i)}),{})}function B9e(e,t,n,r,i){return z9e(e.keys,t,n,r,i)}function V9e(e,t,n,r,i){return qk(B9e(e,t,n,r,i))}var H9e=s((()=>{VA(),pA(),Aj(),ED()}));function U9e(e){return e.allOf.every(e=>jj(e))}function W9e(e){return e.anyOf.some(e=>jj(e))}function G9e(e){return!jj(e.not)}function jj(e){return e[rO]===`Intersect`?U9e(e):e[rO]===`Union`?W9e(e):e[rO]===`Not`?G9e(e):e[rO]===`Undefined`}var K9e=s((()=>{aO()})),Mj=s((()=>{M9e(),H9e(),I9e(),K9e(),Aj()}));function q9e(e,t){return Nj(SA(e),t)}var J9e=s((()=>{Pj(),CA()}));function Y9e(e,t){let n=e.filter(e=>Dj(e,t)===Oj.False);return n.length===1?n[0]:eA(n)}function Nj(e,t,n={}){return jO(e)?JD(q9e(e,t),n):xO(e)?JD(Q9e(e,t),n):JD(FO(e)?Y9e(e.anyOf,t):Dj(e,t)===Oj.False?e:Gk(),n)}var Pj=s((()=>{YD(),tA(),Kk(),Mj(),$9e(),J9e(),RO()}));function X9e(e,t){let n={};for(let r of globalThis.Object.getOwnPropertyNames(e))n[r]=Nj(e[r],t);return n}function Z9e(e,t){return X9e(e.properties,t)}function Q9e(e,t){return qk(Z9e(e,t))}var $9e=s((()=>{VA(),Pj()})),eet=s((()=>{$9e(),J9e(),Pj()}));function tet(e,t){return Fj(SA(e),t)}var net=s((()=>{Ij(),CA()}));function ret(e,t){let n=e.filter(e=>Dj(e,t)!==Oj.False);return n.length===1?n[0]:eA(n)}function Fj(e,t,n){return jO(e)?JD(tet(e,t),n):xO(e)?JD(oet(e,t),n):JD(FO(e)?ret(e.anyOf,t):Dj(e,t)===Oj.False?Gk():e,n)}var Ij=s((()=>{YD(),tA(),Kk(),Mj(),set(),net(),RO()}));function iet(e,t){let n={};for(let r of globalThis.Object.getOwnPropertyNames(e))n[r]=Fj(e[r],t);return n}function aet(e,t){return iet(e.properties,t)}function oet(e,t){return qk(aet(e,t))}var set=s((()=>{VA(),Ij()})),cet=s((()=>{set(),net(),Ij()}));function uet(e,t){return pO(e)?JD(e.returns,t):Gk(t)}var det=s((()=>{YD(),Kk(),RO()})),fet=s((()=>{det()}));function pet(e){return FA(HA(e))}var met=s((()=>{IA(),UA()})),Lj=s((()=>{met()}));function Rj(e,t,n){return JD({[rO]:`Record`,type:`object`,patternProperties:{[e]:t}},n)}function zj(e,t,n){let r={};for(let n of e)r[n]=t;return MA(r,{...n,[nO]:`Record`})}function het(e,t,n){return Q6e(e)?zj(wA(e),t,n):Rj(e.pattern,t,n)}function get(e,t,n){return zj(wA(eA(e)),t,n)}function _et(e,t,n){return zj([e.toString()],t,n)}function vet(e,t,n){return Rj(e.source,t,n)}function yet(e,t,n){return Rj(SD(e.pattern)?Ek:e.pattern,t,n)}function bet(e,t,n){return Rj(Ek,t,n)}function xet(e,t,n){return Rj(a6e,t,n)}function Cet(e,t,n){return MA({true:t,false:t},n)}function wet(e,t,n){return Rj(Tk,t,n)}function Tet(e,t,n){return Rj(Tk,t,n)}function Eet(e,t,n={}){return FO(e)?get(e.anyOf,t,n):jO(e)?het(e,t,n):yO(e)?_et(e.const,t,n):dO(e)?Cet(e,t,n):hO(e)?wet(e,t,n):wO(e)?Tet(e,t,n):O3e(e)?vet(e,t,n):kO(e)?yet(e,t,n):C3e(e)?bet(e,t,n):SO(e)?xet(e,t,n):Gk(n)}function Bj(e){return globalThis.Object.getOwnPropertyNames(e.patternProperties)[0]}function Det(e){let t=Bj(e);return t===Ek?yA():t===Tk?_A():yA({pattern:t})}function Oet(e){return e.patternProperties[Bj(e)]}var ket=s((()=>{YD(),aO(),Kk(),vA(),NA(),bA(),tA(),CA(),Dk(),kA(),CD(),RO()})),Vj=s((()=>{ket()}));function Aet(e,t){return t.parameters=Hj(e,t.parameters),t.returns=Uj(e,t.returns),t}function jet(e,t){return t.parameters=Hj(e,t.parameters),t.returns=Uj(e,t.returns),t}function Met(e,t){return t.allOf=Hj(e,t.allOf),t}function Net(e,t){return t.anyOf=Hj(e,t.anyOf),t}function Pet(e,t){return SD(t.items)||(t.items=Hj(e,t.items)),t}function Fet(e,t){return t.items=Uj(e,t.items),t}function Iet(e,t){return t.items=Uj(e,t.items),t}function Let(e,t){return t.items=Uj(e,t.items),t}function Ret(e,t){return t.item=Uj(e,t.item),t}function zet(e,t){let n=Uet(e,t.properties);return{...t,...MA(n)}}function Bet(e,t){let n=Eet(Uj(e,Det(t)),Uj(e,Oet(t)));return{...t,...n}}function Vet(e,t){return t.index in e?e[t.index]:cj()}function Het(e,t){let n=oO(t),r=sO(t),i=Uj(e,t);return n&&r?pet(i):n&&!r?FA(i):!n&&r?HA(i):i}function Uet(e,t){return globalThis.Object.getOwnPropertyNames(t).reduce((n,r)=>({...n,[r]:Het(e,t[r])}),{})}function Hj(e,t){return t.map(t=>Uj(e,t))}function Uj(e,t){return pO(t)?Aet(e,t):mO(t)?jet(e,t):gO(t)?Met(e,t):FO(t)?Net(e,t):NO(t)?Pet(e,t):cO(t)?Fet(e,t):lO(t)?Iet(e,t):_O(t)?Let(e,t):EO(t)?Ret(e,t):TO(t)?zet(e,t):DO(t)?Bet(e,t):w3e(t)?Vet(e,t):t}function Wet(e,t){return Uj(t,DD(e))}var Get=s((()=>{OD(),lj(),Lj(),IA(),UA(),NA(),Vj(),CD(),RO()})),Ket=s((()=>{Get()}));function qet(e){return JD({[rO]:`Integer`,type:`integer`},e)}var Jet=s((()=>{YD(),aO()})),Yet=s((()=>{Jet()}));function Xet(e,t,n){return{[e]:Wj(fA(e),t,TD(n))}}function Zet(e,t,n){return e.reduce((e,r)=>({...e,...Xet(r,t,n)}),{})}function Qet(e,t,n){return Zet(e.keys,t,n)}function $et(e,t,n){return qk(Qet(e,t,n))}var ett=s((()=>{VA(),Gj(),pA(),ED()}));function ttt(e){let[t,n]=[e.slice(0,1),e.slice(1)];return[t.toLowerCase(),n].join(``)}function ntt(e){let[t,n]=[e.slice(0,1),e.slice(1)];return[t.toUpperCase(),n].join(``)}function rtt(e){return e.toUpperCase()}function itt(e){return e.toLowerCase()}function att(e,t,n){let r=oA(e.pattern);return lA(r)?C8e([eA(stt([...uA(r)].map(e=>fA(e)),t))],n):{...e,pattern:ott(e.pattern,t)}}function ott(e,t){return typeof e==`string`?t===`Uncapitalize`?ttt(e):t===`Capitalize`?ntt(e):t===`Uppercase`?rtt(e):t===`Lowercase`?itt(e):e:e.toString()}function stt(e,t){return e.map(e=>Wj(e,t))}function Wj(e,t,n={}){return bO(e)?$et(e,t,n):jO(e)?att(e,t,n):FO(e)?eA(stt(e.anyOf,t),n):yO(e)?fA(ott(e.const,t),n):JD(e,n)}var Gj=s((()=>{YD(),CA(),ett(),pA(),tA(),RO()}));function ctt(e,t={}){return Wj(e,`Capitalize`,t)}var ltt=s((()=>{Gj()}));function utt(e,t={}){return Wj(e,`Lowercase`,t)}var dtt=s((()=>{Gj()}));function ftt(e,t={}){return Wj(e,`Uncapitalize`,t)}var ptt=s((()=>{Gj()}));function mtt(e,t={}){return Wj(e,`Uppercase`,t)}var htt=s((()=>{Gj()})),gtt=s((()=>{ltt(),ett(),Gj(),dtt(),ptt(),htt()}));function _tt(e,t,n){let r={};for(let i of globalThis.Object.getOwnPropertyNames(e))r[i]=qj(e[i],t,TD(n));return r}function vtt(e,t,n){return _tt(e.properties,t,n)}function ytt(e,t,n){return qk(vtt(e,t,n))}var btt=s((()=>{VA(),Jj(),ED()}));function xtt(e,t){return e.map(e=>Kj(e,t))}function Stt(e,t){return e.map(e=>Kj(e,t))}function Ctt(e,t){let{[t]:n,...r}=e;return r}function wtt(e,t){return t.reduce((e,t)=>Ctt(e,t),e)}function Ttt(e,t){let n=Hk(e,[$D,`$id`,`required`,`properties`]);return MA(wtt(e.properties,t),n)}function Ett(e){return eA(e.reduce((e,t)=>E3e(t)?[...e,fA(t)]:e,[]))}function Kj(e,t){return gO(e)?GA(xtt(e.allOf,t)):FO(e)?eA(Stt(e.anyOf,t)):TO(e)?Ttt(e,t):MA({})}function qj(e,t,n){let r=hD(t)?Ett(t):t,i=LO(t)?wA(t):t,a=OO(e),o=OO(t);return xO(e)?ytt(e,i,n):bO(t)?Att(e,t,n):a&&o||!a&&o||a&&!o?Bk(`Omit`,[e,r],n):JD({...Kj(e,i),...n})}var Jj=s((()=>{YD(),Uk(),iO(),Vk(),pA(),kA(),KA(),tA(),NA(),jtt(),btt(),RO(),CD()}));function Dtt(e,t,n){return{[t]:qj(e,[t],TD(n))}}function Ott(e,t,n){return t.reduce((t,r)=>({...t,...Dtt(e,r,n)}),{})}function ktt(e,t,n){return Ott(e,t.keys,n)}function Att(e,t,n){return qk(ktt(e,t,n))}var jtt=s((()=>{VA(),Jj(),ED()})),Yj=s((()=>{jtt(),btt(),Jj()}));function Mtt(e,t,n){let r={};for(let i of globalThis.Object.getOwnPropertyNames(e))r[i]=Zj(e[i],t,TD(n));return r}function Ntt(e,t,n){return Mtt(e.properties,t,n)}function Ptt(e,t,n){return qk(Ntt(e,t,n))}var Ftt=s((()=>{VA(),Qj(),ED()}));function Itt(e,t){return e.map(e=>Xj(e,t))}function Ltt(e,t){return e.map(e=>Xj(e,t))}function Rtt(e,t){let n={};for(let r of t)r in e&&(n[r]=e[r]);return n}function ztt(e,t){let n=Hk(e,[$D,`$id`,`required`,`properties`]);return MA(Rtt(e.properties,t),n)}function Btt(e){return eA(e.reduce((e,t)=>E3e(t)?[...e,fA(t)]:e,[]))}function Xj(e,t){return gO(e)?GA(Itt(e.allOf,t)):FO(e)?eA(Ltt(e.anyOf,t)):TO(e)?ztt(e,t):MA({})}function Zj(e,t,n){let r=hD(t)?Btt(t):t,i=LO(t)?wA(t):t,a=OO(e),o=OO(t);return xO(e)?Ptt(e,i,n):bO(t)?Wtt(e,t,n):a&&o||!a&&o||a&&!o?Bk(`Pick`,[e,r],n):JD({...Xj(e,i),...n})}var Qj=s((()=>{YD(),Uk(),Vk(),KA(),pA(),NA(),tA(),kA(),iO(),RO(),CD(),Gtt(),Ftt()}));function Vtt(e,t,n){return{[t]:Zj(e,[t],TD(n))}}function Htt(e,t,n){return t.reduce((t,r)=>({...t,...Vtt(e,r,n)}),{})}function Utt(e,t,n){return Htt(e,t.keys,n)}function Wtt(e,t,n){return qk(Utt(e,t,n))}var Gtt=s((()=>{VA(),Qj(),ED()})),$j=s((()=>{Gtt(),Ftt(),Qj()}));function Ktt(e,t){return Bk(`Partial`,[Bk(e,t)])}function qtt(e){return Bk(`Partial`,[qA(e)])}function Jtt(e){let t={};for(let n of globalThis.Object.getOwnPropertyNames(e))t[n]=HA(e[n]);return t}function Ytt(e){let t=Hk(e,[$D,`$id`,`required`,`properties`]);return MA(Jtt(e.properties),t)}function Xtt(e){return e.map(e=>Ztt(e))}function Ztt(e){return fO(e)?Ktt(e.target,e.parameters):OO(e)?qtt(e.$ref):gO(e)?GA(Xtt(e.allOf)):FO(e)?eA(Xtt(e.anyOf)):TO(e)?Ytt(e):uO(e)||dO(e)||hO(e)||yO(e)||CO(e)||wO(e)||kO(e)||AO(e)||PO(e)?e:MA({})}function eM(e,t){return xO(e)?tnt(e,t):JD({...Ztt(e),...t})}var Qtt=s((()=>{YD(),Vk(),UA(),NA(),KA(),tA(),JA(),Wk(),aO(),nnt(),RO()}));function $tt(e,t){let n={};for(let r of globalThis.Object.getOwnPropertyNames(e))n[r]=eM(e[r],TD(t));return n}function ent(e,t){return $tt(e.properties,t)}function tnt(e,t){return qk(ent(e,t))}var nnt=s((()=>{VA(),Qtt(),ED()})),tM=s((()=>{nnt(),Qtt()}));function rnt(e,t){return Bk(`Required`,[Bk(e,t)])}function int(e){return Bk(`Required`,[qA(e)])}function ant(e){let t={};for(let n of globalThis.Object.getOwnPropertyNames(e))t[n]=Hk(e[n],[tO]);return t}function ont(e){let t=Hk(e,[$D,`$id`,`required`,`properties`]);return MA(ant(e.properties),t)}function snt(e){return e.map(e=>cnt(e))}function cnt(e){return fO(e)?rnt(e.target,e.parameters):OO(e)?int(e.$ref):gO(e)?GA(snt(e.allOf)):FO(e)?eA(snt(e.anyOf)):TO(e)?ont(e):uO(e)||dO(e)||hO(e)||yO(e)||CO(e)||wO(e)||kO(e)||AO(e)||PO(e)?e:MA({})}function nM(e,t){return xO(e)?fnt(e,t):JD({...cnt(e),...t})}var lnt=s((()=>{YD(),Vk(),NA(),KA(),tA(),JA(),aO(),Wk(),pnt(),RO()}));function unt(e,t){let n={};for(let r of globalThis.Object.getOwnPropertyNames(e))n[r]=nM(e[r],t);return n}function dnt(e,t){return unt(e.properties,t)}function fnt(e,t){return qk(dnt(e,t))}var pnt=s((()=>{VA(),lnt()})),rM=s((()=>{pnt(),lnt()}));function mnt(e,t){return t.map(t=>OO(t)?iM(e,t.$ref):oM(e,t))}function iM(e,t){return t in e?OO(e[t])?iM(e,e[t].$ref):oM(e,e[t]):Gk()}function hnt(e){return YA(e[0])}function gnt(e){return DA(e[0],e[1])}function _nt(e){return tj(e[0])}function vnt(e){return eM(e[0])}function ynt(e){return qj(e[0],e[1])}function bnt(e){return Zj(e[0],e[1])}function xnt(e){return nM(e[0])}function Snt(e,t,n){let r=mnt(e,n);return t===`Awaited`?hnt(r):t===`Index`?gnt(r):t===`KeyOf`?_nt(r):t===`Partial`?vnt(r):t===`Omit`?ynt(r):t===`Pick`?bnt(r):t===`Required`?xnt(r):Gk()}function Cnt(e,t){return Ik(oM(e,t))}function wnt(e,t){return Rk(oM(e,t))}function Tnt(e,t,n){return Jk(aM(e,t),oM(e,n))}function Ent(e,t,n){return Xk(aM(e,t),oM(e,n))}function Dnt(e,t){return GA(aM(e,t))}function Ont(e,t){return AA(oM(e,t))}function knt(e,t){return MA(globalThis.Object.keys(t).reduce((n,r)=>({...n,[r]:oM(e,t[r])}),{}))}function Ant(e,t){let[n,r]=[oM(e,Oet(t)),Bj(t)],i=DD(t);return i.patternProperties[r]=n,i}function jnt(e,t){return OO(t)?{...iM(e,t.$ref),[$D]:t[$D]}:t}function Mnt(e,t){return LA(aM(e,t))}function Nnt(e,t){return eA(aM(e,t))}function aM(e,t){return t.map(t=>oM(e,t))}function oM(e,t){return sO(t)?JD(oM(e,Hk(t,[tO])),t):oO(t)?JD(oM(e,Hk(t,[eO])),t):MO(t)?JD(jnt(e,t),t):cO(t)?JD(Cnt(e,t.items),t):lO(t)?JD(wnt(e,t.items),t):fO(t)?JD(Snt(e,t.target,t.parameters)):pO(t)?JD(Tnt(e,t.parameters,t.returns),t):mO(t)?JD(Ent(e,t.parameters,t.returns),t):gO(t)?JD(Dnt(e,t.allOf),t):_O(t)?JD(Ont(e,t.items),t):TO(t)?JD(knt(e,t.properties),t):DO(t)?JD(Ant(e,t)):NO(t)?JD(Mnt(e,t.items||[]),t):FO(t)?JD(Nnt(e,t.anyOf),t):t}function Pnt(e,t){return t in e?oM(e,e[t]):Gk()}function Fnt(e){return globalThis.Object.getOwnPropertyNames(e).reduce((t,n)=>({...t,[n]:Pnt(e,n)}),{})}var Int=s((()=>{XD(),c3e(),Wk(),Lk(),XA(),zk(),Yk(),kA(),Zk(),KA(),jA(),nj(),NA(),Yj(),$j(),Kk(),tM(),Vj(),rM(),RA(),tA(),aO(),RO()}));function Lnt(e){return new Rnt(e)}var Rnt,znt=s((()=>{XD(),aO(),Int(),Rnt=class{constructor(e){let t=Fnt(e);this.$defs=this.WithIdentifiers(t)}Import(e,t){let n={...this.$defs,[e]:JD(this.$defs[e],t)};return JD({[rO]:`Import`,$defs:n,$ref:e})}WithIdentifiers(e){return globalThis.Object.getOwnPropertyNames(e).reduce((t,n)=>({...t,[n]:{...e[n],$id:n}}),{})}}})),Bnt=s((()=>{znt()}));function Vnt(e,t){return JD({[rO]:`Not`,not:e},t)}var Hnt=s((()=>{YD(),aO()})),Unt=s((()=>{Hnt()}));function Wnt(e,t){return mO(e)?LA(e.parameters,t):Gk()}var Gnt=s((()=>{RA(),Kk(),RO()})),Knt=s((()=>{Gnt()}));function qnt(e,t={}){SD(t.$id)&&(t.$id=`T${Jnt++}`);let n=DD(e({[rO]:`This`,$ref:`${t.$id}`}));return n.$id=t.$id,JD({[nO]:`Recursive`,...n},t)}var Jnt,Ynt=s((()=>{OD(),YD(),CD(),aO(),Jnt=0})),Xnt=s((()=>{Ynt()}));function Znt(e,t){let n=bD(e)?new globalThis.RegExp(e):e;return JD({[rO]:`RegExp`,type:`RegExp`,source:n.source,flags:n.flags},t)}var Qnt=s((()=>{YD(),CD(),aO()})),$nt=s((()=>{Qnt()}));function ert(e){return gO(e)?e.allOf:FO(e)?e.anyOf:NO(e)?e.items??[]:[]}function trt(e){return ert(e)}var nrt=s((()=>{RO()})),rrt=s((()=>{nrt()}));function irt(e,t){return mO(e)?JD(e.returns,t):Gk(t)}var art=s((()=>{YD(),Kk(),RO()})),ort=s((()=>{art()})),srt=s((()=>{})),crt=s((()=>{})),lrt=s((()=>{srt(),crt()})),urt=s((()=>{})),drt=s((()=>{urt()}));function frt(e){return new prt(e)}var prt,mrt,hrt=s((()=>{aO(),RO(),prt=class{constructor(e){this.schema=e}Decode(e){return new mrt(this.schema,e)}},mrt=class{constructor(e,t){this.schema=e,this.decode=t}EncodeTransform(e,t){let n={Encode:n=>t[$D].Encode(e(n)),Decode:e=>this.decode(t[$D].Decode(e))};return{...t,[$D]:n}}EncodeSchema(e,t){let n={Decode:this.decode,Encode:e};return{...t,[$D]:n}}Encode(e){return MO(this.schema)?this.EncodeTransform(e,this.schema):this.EncodeSchema(e,this.schema)}}})),grt=s((()=>{hrt()}));function _rt(e={}){return JD({[rO]:e[rO]??`Unsafe`},e)}var vrt=s((()=>{YD(),aO()})),sM=s((()=>{vrt()}));function yrt(e){return JD({[rO]:`Void`,type:`void`},e)}var brt=s((()=>{YD(),aO()})),xrt=s((()=>{brt()})),Srt=l({Any:()=>Pk,Argument:()=>S6e,Array:()=>Ik,AsyncIterator:()=>Rk,Awaited:()=>YA,BigInt:()=>hA,Boolean:()=>c8e,Capitalize:()=>ctt,Composite:()=>u7e,Const:()=>E7e,Constructor:()=>Jk,ConstructorParameters:()=>k7e,Date:()=>p7e,Enum:()=>M7e,Exclude:()=>Nj,Extends:()=>kj,Extract:()=>Fj,Function:()=>Xk,Index:()=>DA,InstanceType:()=>uet,Instantiate:()=>Wet,Integer:()=>qet,Intersect:()=>GA,Iterator:()=>AA,KeyOf:()=>tj,Literal:()=>fA,Lowercase:()=>utt,Mapped:()=>h5e,Module:()=>Lnt,Never:()=>Gk,Not:()=>Vnt,Null:()=>h7e,Number:()=>_A,Object:()=>MA,Omit:()=>qj,Optional:()=>HA,Parameters:()=>Wnt,Partial:()=>eM,Pick:()=>Zj,Promise:()=>Z8e,Readonly:()=>FA,ReadonlyOptional:()=>pet,Record:()=>Eet,Recursive:()=>qnt,Ref:()=>qA,RegExp:()=>Znt,Required:()=>nM,Rest:()=>trt,ReturnType:()=>irt,String:()=>yA,Symbol:()=>_7e,TemplateLiteral:()=>C8e,Transform:()=>frt,Tuple:()=>LA,Uint8Array:()=>x7e,Uncapitalize:()=>ftt,Undefined:()=>y7e,Union:()=>eA,Unknown:()=>cj,Unsafe:()=>_rt,Uppercase:()=>mtt,Void:()=>yrt}),Crt=s((()=>{Fk(),w6e(),Lk(),zk(),XA(),gA(),mA(),f7e(),O7e(),Yk(),j7e(),rj(),P7e(),eet(),Mj(),cet(),Zk(),kA(),fet(),Ket(),Yet(),KA(),gtt(),jA(),nj(),pA(),VA(),Bnt(),Kk(),Unt(),ij(),vA(),NA(),Yj(),UA(),Knt(),tM(),$j(),PA(),IA(),Lj(),Vj(),Xnt(),JA(),$nt(),rM(),rrt(),ort(),bA(),aj(),CA(),grt(),RA(),sj(),oj(),tA(),lj(),sM(),xrt()})),Z,wrt=s((()=>{Crt(),Z=Srt})),cM=s((()=>{c3e(),XD(),QD(),t6e(),r6e(),Dk(),Mk(),Nk(),aO(),Fk(),Lk(),w6e(),zk(),XA(),gA(),mA(),f7e(),O7e(),Yk(),j7e(),rj(),P7e(),eet(),Mj(),cet(),Zk(),kA(),fet(),Ket(),Yet(),KA(),jA(),gtt(),nj(),pA(),Bnt(),VA(),Kk(),Unt(),ij(),vA(),NA(),Yj(),UA(),Knt(),tM(),$j(),PA(),IA(),Lj(),Vj(),Xnt(),JA(),$nt(),rM(),rrt(),ort(),lrt(),drt(),bA(),aj(),CA(),grt(),RA(),sj(),oj(),tA(),lj(),sM(),xrt(),wrt()})),lM,uM=s((()=>{cM(),lM=(...e)=>Z.Composite(e)})),Trt,Ert,Drt,Ort=s((()=>{Mk(),sM(),aO(),QD(),Trt=class extends ZD{constructor(e){super(`Duplicate type kind '${e}' detected`)}},Ert=class extends ZD{constructor(e){super(`Duplicate string format '${e}' detected`)}},(function(e){function t(e,t){if(Ak(e))throw new Trt(e);return u6e(e,t),(t={})=>_rt({...t,[rO]:e})}e.Type=t;function n(e,t){if(Ok(e))throw new Ert(e);return s6e(e,t),e}e.Format=n})(Drt||={})})),krt=s((()=>{KD(),Ort()}));function Art(e){switch(e.errorType){case Q.ArrayContains:return`Expected array to contain at least one matching value`;case Q.ArrayMaxContains:return`Expected array to contain no more than ${e.schema.maxContains} matching values`;case Q.ArrayMinContains:return`Expected array to contain at least ${e.schema.minContains} matching values`;case Q.ArrayMaxItems:return`Expected array length to be less or equal to ${e.schema.maxItems}`;case Q.ArrayMinItems:return`Expected array length to be greater or equal to ${e.schema.minItems}`;case Q.ArrayUniqueItems:return`Expected array elements to be unique`;case Q.Array:return`Expected array`;case Q.AsyncIterator:return`Expected AsyncIterator`;case Q.BigIntExclusiveMaximum:return`Expected bigint to be less than ${e.schema.exclusiveMaximum}`;case Q.BigIntExclusiveMinimum:return`Expected bigint to be greater than ${e.schema.exclusiveMinimum}`;case Q.BigIntMaximum:return`Expected bigint to be less or equal to ${e.schema.maximum}`;case Q.BigIntMinimum:return`Expected bigint to be greater or equal to ${e.schema.minimum}`;case Q.BigIntMultipleOf:return`Expected bigint to be a multiple of ${e.schema.multipleOf}`;case Q.BigInt:return`Expected bigint`;case Q.Boolean:return`Expected boolean`;case Q.DateExclusiveMinimumTimestamp:return`Expected Date timestamp to be greater than ${e.schema.exclusiveMinimumTimestamp}`;case Q.DateExclusiveMaximumTimestamp:return`Expected Date timestamp to be less than ${e.schema.exclusiveMaximumTimestamp}`;case Q.DateMinimumTimestamp:return`Expected Date timestamp to be greater or equal to ${e.schema.minimumTimestamp}`;case Q.DateMaximumTimestamp:return`Expected Date timestamp to be less or equal to ${e.schema.maximumTimestamp}`;case Q.DateMultipleOfTimestamp:return`Expected Date timestamp to be a multiple of ${e.schema.multipleOfTimestamp}`;case Q.Date:return`Expected Date`;case Q.Function:return`Expected function`;case Q.IntegerExclusiveMaximum:return`Expected integer to be less than ${e.schema.exclusiveMaximum}`;case Q.IntegerExclusiveMinimum:return`Expected integer to be greater than ${e.schema.exclusiveMinimum}`;case Q.IntegerMaximum:return`Expected integer to be less or equal to ${e.schema.maximum}`;case Q.IntegerMinimum:return`Expected integer to be greater or equal to ${e.schema.minimum}`;case Q.IntegerMultipleOf:return`Expected integer to be a multiple of ${e.schema.multipleOf}`;case Q.Integer:return`Expected integer`;case Q.IntersectUnevaluatedProperties:return`Unexpected property`;case Q.Intersect:return`Expected all values to match`;case Q.Iterator:return`Expected Iterator`;case Q.Literal:return`Expected ${typeof e.schema.const==`string`?`'${e.schema.const}'`:e.schema.const}`;case Q.Never:return`Never`;case Q.Not:return`Value should not match`;case Q.Null:return`Expected null`;case Q.NumberExclusiveMaximum:return`Expected number to be less than ${e.schema.exclusiveMaximum}`;case Q.NumberExclusiveMinimum:return`Expected number to be greater than ${e.schema.exclusiveMinimum}`;case Q.NumberMaximum:return`Expected number to be less or equal to ${e.schema.maximum}`;case Q.NumberMinimum:return`Expected number to be greater or equal to ${e.schema.minimum}`;case Q.NumberMultipleOf:return`Expected number to be a multiple of ${e.schema.multipleOf}`;case Q.Number:return`Expected number`;case Q.Object:return`Expected object`;case Q.ObjectAdditionalProperties:return`Unexpected property`;case Q.ObjectMaxProperties:return`Expected object to have no more than ${e.schema.maxProperties} properties`;case Q.ObjectMinProperties:return`Expected object to have at least ${e.schema.minProperties} properties`;case Q.ObjectRequiredProperty:return`Expected required property`;case Q.Promise:return`Expected Promise`;case Q.RegExp:return`Expected string to match regular expression`;case Q.StringFormatUnknown:return`Unknown format '${e.schema.format}'`;case Q.StringFormat:return`Expected string to match '${e.schema.format}' format`;case Q.StringMaxLength:return`Expected string length less or equal to ${e.schema.maxLength}`;case Q.StringMinLength:return`Expected string length greater or equal to ${e.schema.minLength}`;case Q.StringPattern:return`Expected string to match '${e.schema.pattern}'`;case Q.String:return`Expected string`;case Q.Symbol:return`Expected symbol`;case Q.TupleLength:return`Expected tuple to have ${e.schema.maxItems||0} elements`;case Q.Tuple:return`Expected tuple`;case Q.Uint8ArrayMaxByteLength:return`Expected byte length less or equal to ${e.schema.maxByteLength}`;case Q.Uint8ArrayMinByteLength:return`Expected byte length greater or equal to ${e.schema.minByteLength}`;case Q.Uint8Array:return`Expected Uint8Array`;case Q.Undefined:return`Expected undefined`;case Q.Union:return`Expected union value`;case Q.Void:return`Expected void`;case Q.Kind:return`Expected kind '${e.schema[rO]}'`;default:return`Unknown error type`}}function jrt(){return Mrt}var Mrt,Nrt=s((()=>{aO(),xat(),Mrt=Art}));function Prt(e,t){let n=t.find(t=>t.$id===e.$ref);if(n===void 0)throw new Frt(e);return fM(n,t)}function dM(e,t){return!zD(e.$id)||t.some(t=>t.$id===e.$id)||t.push(e),t}function fM(e,t){return e[rO]===`This`||e[rO]===`Ref`?Prt(e,t):e}var Frt,Irt=s((()=>{QD(),aO(),UD(),Frt=class extends ZD{constructor(e){super(`Unable to dereference schema with $id '${e.$ref}'`),this.schema=e}}})),pM=s((()=>{Irt()}));function*Lrt(e){let t=e===0?1:Math.ceil(Math.floor(Math.log2(e)+1)/8);for(let n=0;n<t;n++)yield e>>8*(t-1-n)&255}function Rrt(e){hM(gM.Array);for(let t of e)mM(t)}function zrt(e){hM(gM.Boolean),hM(e?1:0)}function Brt(e){hM(gM.BigInt),yM.setBigInt64(0,e);for(let e of bM)hM(e)}function Vrt(e){hM(gM.Date),mM(e.getTime())}function Hrt(e){hM(gM.Null)}function Urt(e){hM(gM.Number),yM.setFloat64(0,e);for(let e of bM)hM(e)}function Wrt(e){hM(gM.Object);for(let t of globalThis.Object.getOwnPropertyNames(e).sort())mM(t),mM(e[t])}function Grt(e){hM(gM.String);for(let t=0;t<e.length;t++)for(let n of Lrt(e.charCodeAt(t)))hM(n)}function Krt(e){hM(gM.Symbol),mM(e.description)}function qrt(e){hM(gM.Uint8Array);for(let t=0;t<e.length;t++)hM(e[t])}function Jrt(e){return hM(gM.Undefined)}function mM(e){if(ND(e))return Rrt(e);if(ID(e))return zrt(e);if(RD(e))return Brt(e);if(kD(e))return Vrt(e);if(FD(e))return Hrt(e);if(LD(e))return Urt(e);if(MD(e))return Wrt(e);if(zD(e))return Grt(e);if(VD(e))return Krt(e);if(AD(e))return qrt(e);if(PD(e))return Jrt(e);throw new Xrt(e)}function hM(e){_M^=$rt[e],_M=_M*Zrt%Qrt}function Yrt(e){return _M=BigInt(`14695981039346656037`),mM(e),_M}var Xrt,gM,_M,Zrt,Qrt,$rt,vM,yM,bM,eit=s((()=>{WD(),QD(),Xrt=class extends ZD{constructor(e){super(`Unable to hash value`),this.value=e}},(function(e){e[e.Undefined=0]=`Undefined`,e[e.Null=1]=`Null`,e[e.Boolean=2]=`Boolean`,e[e.Number=3]=`Number`,e[e.String=4]=`String`,e[e.Object=5]=`Object`,e[e.Array=6]=`Array`,e[e.Date=7]=`Date`,e[e.Uint8Array=8]=`Uint8Array`,e[e.Symbol=9]=`Symbol`,e[e.BigInt=10]=`BigInt`})(gM||={}),_M=BigInt(`14695981039346656037`),[Zrt,Qrt]=[BigInt(`1099511628211`),BigInt(`18446744073709551616`)],$rt=Array.from({length:256}).map((e,t)=>BigInt(t)),vM=new Float64Array(1),yM=new DataView(vM.buffer),bM=new Uint8Array(vM.buffer)})),xM=s((()=>{eit()}));function tit(e,t,n){let r=e.get(t);if(r&&r.has(n))return!1;if(r)return r.add(n),!0;e.set(t,new WeakSet([n]))}function nit(e){return e[rO]===`Any`||e[rO]===`Unknown`}function SM(e){return e!==void 0}function rit(e,t,n){return!0}function iit(e,t,n){return!0}function ait(e,t,n,r){if(!ND(n)||SM(e.minItems)&&!(n.length>=e.minItems)||SM(e.maxItems)&&!(n.length<=e.maxItems))return!1;if(tit(r,n,e)===!1)return!0;if(!n.every(n=>CM(e.items,t,n,r))||e.uniqueItems===!0&&!(function(){let e=new Set;for(let t of n){let n=Yrt(t);if(e.has(n))return!1;e.add(n)}return!0})())return!1;if(!(SM(e.contains)||LD(e.minContains)||LD(e.maxContains)))return!0;let i=SM(e.contains)?e.contains:Gk(),a=n.reduce((e,n)=>CM(i,t,n,r)?e+1:e,0);return!(a===0||LD(e.minContains)&&a<e.minContains||LD(e.maxContains)&&a>e.maxContains)}function oit(e,t,n){return l3e(n)}function sit(e,t,n){return!(!RD(n)||SM(e.exclusiveMaximum)&&!(n<e.exclusiveMaximum)||SM(e.exclusiveMinimum)&&!(n>e.exclusiveMinimum)||SM(e.maximum)&&!(n<=e.maximum)||SM(e.minimum)&&!(n>=e.minimum)||SM(e.multipleOf)&&n%e.multipleOf!==BigInt(0))}function cit(e,t,n){return ID(n)}function lit(e,t,n,r){return CM(e.returns,t,n.prototype,r)}function uit(e,t,n){return!(!kD(n)||SM(e.exclusiveMaximumTimestamp)&&!(n.getTime()<e.exclusiveMaximumTimestamp)||SM(e.exclusiveMinimumTimestamp)&&!(n.getTime()>e.exclusiveMinimumTimestamp)||SM(e.maximumTimestamp)&&!(n.getTime()<=e.maximumTimestamp)||SM(e.minimumTimestamp)&&!(n.getTime()>=e.minimumTimestamp)||SM(e.multipleOfTimestamp)&&n.getTime()%e.multipleOfTimestamp!==0)}function dit(e,t,n){return BD(n)}function fit(e,t,n,r){let i=globalThis.Object.values(e.$defs),a=e.$defs[e.$ref];return CM(a,[...t,...i],n,r)}function pit(e,t,n){return!(!h3e(n)||SM(e.exclusiveMaximum)&&!(n<e.exclusiveMaximum)||SM(e.exclusiveMinimum)&&!(n>e.exclusiveMinimum)||SM(e.maximum)&&!(n<=e.maximum)||SM(e.minimum)&&!(n>=e.minimum)||SM(e.multipleOf)&&n%e.multipleOf!==0)}function mit(e,t,n,r){let i=e.allOf.every(e=>CM(e,t,n,r));if(e.unevaluatedProperties===!1){let t=new RegExp(QA(e)),r=Object.getOwnPropertyNames(n).every(e=>t.test(e));return i&&r}else if(LO(e.unevaluatedProperties)){let a=new RegExp(QA(e)),o=Object.getOwnPropertyNames(n).every(i=>a.test(i)||CM(e.unevaluatedProperties,t,n[i],r));return i&&o}else return i}function hit(e,t,n){return u3e(n)}function git(e,t,n){return n===e.const}function _it(e,t,n){return!1}function vit(e,t,n,r){return!CM(e.not,t,n,r)}function yit(e,t,n){return FD(n)}function bit(e,t,n){return!(!GD.IsNumberLike(n)||SM(e.exclusiveMaximum)&&!(n<e.exclusiveMaximum)||SM(e.exclusiveMinimum)&&!(n>e.exclusiveMinimum)||SM(e.minimum)&&!(n>=e.minimum)||SM(e.maximum)&&!(n<=e.maximum)||SM(e.multipleOf)&&n%e.multipleOf!==0)}function xit(e,t,n,r){if(!GD.IsObjectLike(n)||SM(e.minProperties)&&!(Object.getOwnPropertyNames(n).length>=e.minProperties)||SM(e.maxProperties)&&!(Object.getOwnPropertyNames(n).length<=e.maxProperties))return!1;if(tit(r,n,e)===!1)return!0;let i=Object.getOwnPropertyNames(e.properties);for(let a of i){let i=e.properties[a];if(e.required&&e.required.includes(a)){if(!CM(i,t,n[a],r)||(jj(i)||nit(i))&&!(a in n))return!1}else if(GD.IsExactOptionalProperty(n,a)&&!CM(i,t,n[a],r))return!1}if(e.additionalProperties===!1){let t=Object.getOwnPropertyNames(n);return e.required&&e.required.length===i.length&&t.length===i.length?!0:t.every(e=>i.includes(e))}else if(typeof e.additionalProperties==`object`)return Object.getOwnPropertyNames(n).every(a=>i.includes(a)||CM(e.additionalProperties,t,n[a],r));else return!0}function Sit(e,t,n){return d3e(n)}function Cit(e,t,n,r){if(!GD.IsRecordLike(n)||SM(e.minProperties)&&!(Object.getOwnPropertyNames(n).length>=e.minProperties)||SM(e.maxProperties)&&!(Object.getOwnPropertyNames(n).length<=e.maxProperties))return!1;let[i,a]=Object.entries(e.patternProperties)[0],o=new RegExp(i),s=Object.entries(n).every(([e,n])=>o.test(e)?CM(a,t,n,r):!0),c=typeof e.additionalProperties==`object`?Object.entries(n).every(([n,i])=>o.test(n)?!0:CM(e.additionalProperties,t,i,r)):!0,l=e.additionalProperties===!1?Object.getOwnPropertyNames(n).every(e=>o.test(e)):!0;return s&&c&&l}function wit(e,t,n,r){return CM(fM(e,t),t,n,r)}function Tit(e,t,n){let r=new RegExp(e.source,e.flags);return SM(e.minLength)&&!(n.length>=e.minLength)||SM(e.maxLength)&&!(n.length<=e.maxLength)?!1:r.test(n)}function Eit(e,t,n){return!zD(n)||SM(e.minLength)&&!(n.length>=e.minLength)||SM(e.maxLength)&&!(n.length<=e.maxLength)||SM(e.pattern)&&!new RegExp(e.pattern).test(n)?!1:SM(e.format)?Ok(e.format)?c6e(e.format)(n):!1:!0}function Dit(e,t,n){return VD(n)}function Oit(e,t,n){return zD(n)&&new RegExp(e.pattern).test(n)}function kit(e,t,n,r){return CM(fM(e,t),t,n,r)}function Ait(e,t,n,r){if(!ND(n)||e.items===void 0&&n.length!==0||n.length!==e.maxItems)return!1;if(!e.items)return!0;for(let i=0;i<e.items.length;i++)if(!CM(e.items[i],t,n[i],r))return!1;return!0}function jit(e,t,n){return PD(n)}function Mit(e,t,n,r){return e.anyOf.some(e=>CM(e,t,n,r))}function Nit(e,t,n){return!(!AD(n)||SM(e.maxByteLength)&&!(n.length<=e.maxByteLength)||SM(e.minByteLength)&&!(n.length>=e.minByteLength))}function Pit(e,t,n){return!0}function Fit(e,t,n){return GD.IsVoidLike(n)}function Iit(e,t,n){return Ak(e[rO])?d6e(e[rO])(e,n):!1}function CM(e,t,n,r){let i=SM(e.$id)?dM(e,t):t,a=e;switch(a[rO]){case`Any`:return rit(a,i,n);case`Argument`:return iit(a,i,n);case`Array`:return ait(a,i,n,r);case`AsyncIterator`:return oit(a,i,n);case`BigInt`:return sit(a,i,n);case`Boolean`:return cit(a,i,n);case`Constructor`:return lit(a,i,n,r);case`Date`:return uit(a,i,n);case`Function`:return dit(a,i,n);case`Import`:return fit(a,i,n,r);case`Integer`:return pit(a,i,n);case`Intersect`:return mit(a,i,n,r);case`Iterator`:return hit(a,i,n);case`Literal`:return git(a,i,n);case`Never`:return _it(a,i,n);case`Not`:return vit(a,i,n,r);case`Null`:return yit(a,i,n);case`Number`:return bit(a,i,n);case`Object`:return xit(a,i,n,r);case`Promise`:return Sit(a,i,n);case`Record`:return Cit(a,i,n,r);case`Ref`:return wit(a,i,n,r);case`RegExp`:return Tit(a,i,n);case`String`:return Eit(a,i,n);case`Symbol`:return Dit(a,i,n);case`TemplateLiteral`:return Oit(a,i,n);case`This`:return kit(a,i,n,r);case`Tuple`:return Ait(a,i,n,r);case`Undefined`:return jit(a,i,n);case`Union`:return Mit(a,i,n,r);case`Uint8Array`:return Nit(a,i,n);case`Unknown`:return Pit(a,i,n);case`Void`:return Fit(a,i,n);default:if(!Ak(a[rO]))throw new Lit(a);return Iit(a,i,n)}}function wM(...e){return e.length===2||e.length===3&&e[2]instanceof WeakMap?CM(e[0],[],e[1],e[2]??new WeakMap):CM(e[0],e[1],e[2],e[3]??new WeakMap)}var Lit,Rit=s((()=>{krt(),pM(),xM(),aO(),nj(),Mj(),Mk(),QD(),Kk(),WD(),RO(),Lit=class extends ZD{constructor(e){super(`Unknown type`),this.schema=e}}})),TM=s((()=>{Rit()}));function EM(e){return e.replace(/~/g,`~0`).replace(/\//g,`~1`)}function DM(e){return e!==void 0}function OM(e,t,n,r,i=[]){return{type:e,schema:t,path:n,value:r,message:jrt()({errorType:e,path:n,schema:t,value:r,errors:i}),errors:i}}function*zit(e,t,n,r){}function*Bit(e,t,n,r){}function*Vit(e,t,n,r){if(!ND(r))return yield OM(Q.Array,e,n,r);DM(e.minItems)&&!(r.length>=e.minItems)&&(yield OM(Q.ArrayMinItems,e,n,r)),DM(e.maxItems)&&!(r.length<=e.maxItems)&&(yield OM(Q.ArrayMaxItems,e,n,r));for(let i=0;i<r.length;i++)yield*kM(e.items,t,`${n}/${i}`,r[i]);if(e.uniqueItems===!0&&!(function(){let e=new Set;for(let t of r){let n=Yrt(t);if(e.has(n))return!1;e.add(n)}return!0})()&&(yield OM(Q.ArrayUniqueItems,e,n,r)),!(DM(e.contains)||DM(e.minContains)||DM(e.maxContains)))return;let i=DM(e.contains)?e.contains:Gk(),a=r.reduce((e,r,a)=>kM(i,t,`${n}${a}`,r).next().done===!0?e+1:e,0);a===0&&(yield OM(Q.ArrayContains,e,n,r)),LD(e.minContains)&&a<e.minContains&&(yield OM(Q.ArrayMinContains,e,n,r)),LD(e.maxContains)&&a>e.maxContains&&(yield OM(Q.ArrayMaxContains,e,n,r))}function*Hit(e,t,n,r){l3e(r)||(yield OM(Q.AsyncIterator,e,n,r))}function*Uit(e,t,n,r){if(!RD(r))return yield OM(Q.BigInt,e,n,r);DM(e.exclusiveMaximum)&&!(r<e.exclusiveMaximum)&&(yield OM(Q.BigIntExclusiveMaximum,e,n,r)),DM(e.exclusiveMinimum)&&!(r>e.exclusiveMinimum)&&(yield OM(Q.BigIntExclusiveMinimum,e,n,r)),DM(e.maximum)&&!(r<=e.maximum)&&(yield OM(Q.BigIntMaximum,e,n,r)),DM(e.minimum)&&!(r>=e.minimum)&&(yield OM(Q.BigIntMinimum,e,n,r)),DM(e.multipleOf)&&r%e.multipleOf!==BigInt(0)&&(yield OM(Q.BigIntMultipleOf,e,n,r))}function*Wit(e,t,n,r){ID(r)||(yield OM(Q.Boolean,e,n,r))}function*Git(e,t,n,r){yield*kM(e.returns,t,n,r.prototype)}function*Kit(e,t,n,r){if(!kD(r))return yield OM(Q.Date,e,n,r);DM(e.exclusiveMaximumTimestamp)&&!(r.getTime()<e.exclusiveMaximumTimestamp)&&(yield OM(Q.DateExclusiveMaximumTimestamp,e,n,r)),DM(e.exclusiveMinimumTimestamp)&&!(r.getTime()>e.exclusiveMinimumTimestamp)&&(yield OM(Q.DateExclusiveMinimumTimestamp,e,n,r)),DM(e.maximumTimestamp)&&!(r.getTime()<=e.maximumTimestamp)&&(yield OM(Q.DateMaximumTimestamp,e,n,r)),DM(e.minimumTimestamp)&&!(r.getTime()>=e.minimumTimestamp)&&(yield OM(Q.DateMinimumTimestamp,e,n,r)),DM(e.multipleOfTimestamp)&&r.getTime()%e.multipleOfTimestamp!==0&&(yield OM(Q.DateMultipleOfTimestamp,e,n,r))}function*qit(e,t,n,r){BD(r)||(yield OM(Q.Function,e,n,r))}function*Jit(e,t,n,r){let i=globalThis.Object.values(e.$defs),a=e.$defs[e.$ref];yield*kM(a,[...t,...i],n,r)}function*Yit(e,t,n,r){if(!h3e(r))return yield OM(Q.Integer,e,n,r);DM(e.exclusiveMaximum)&&!(r<e.exclusiveMaximum)&&(yield OM(Q.IntegerExclusiveMaximum,e,n,r)),DM(e.exclusiveMinimum)&&!(r>e.exclusiveMinimum)&&(yield OM(Q.IntegerExclusiveMinimum,e,n,r)),DM(e.maximum)&&!(r<=e.maximum)&&(yield OM(Q.IntegerMaximum,e,n,r)),DM(e.minimum)&&!(r>=e.minimum)&&(yield OM(Q.IntegerMinimum,e,n,r)),DM(e.multipleOf)&&r%e.multipleOf!==0&&(yield OM(Q.IntegerMultipleOf,e,n,r))}function*Xit(e,t,n,r){let i=!1;for(let a of e.allOf)for(let e of kM(a,t,n,r))i=!0,yield e;if(i)return yield OM(Q.Intersect,e,n,r);if(e.unevaluatedProperties===!1){let t=new RegExp(QA(e));for(let i of Object.getOwnPropertyNames(r))t.test(i)||(yield OM(Q.IntersectUnevaluatedProperties,e,`${n}/${i}`,r))}if(typeof e.unevaluatedProperties==`object`){let i=new RegExp(QA(e));for(let a of Object.getOwnPropertyNames(r))if(!i.test(a)){let i=kM(e.unevaluatedProperties,t,`${n}/${a}`,r[a]).next();i.done||(yield i.value)}}}function*Zit(e,t,n,r){u3e(r)||(yield OM(Q.Iterator,e,n,r))}function*Qit(e,t,n,r){r!==e.const&&(yield OM(Q.Literal,e,n,r))}function*$it(e,t,n,r){yield OM(Q.Never,e,n,r)}function*eat(e,t,n,r){kM(e.not,t,n,r).next().done===!0&&(yield OM(Q.Not,e,n,r))}function*tat(e,t,n,r){FD(r)||(yield OM(Q.Null,e,n,r))}function*nat(e,t,n,r){if(!GD.IsNumberLike(r))return yield OM(Q.Number,e,n,r);DM(e.exclusiveMaximum)&&!(r<e.exclusiveMaximum)&&(yield OM(Q.NumberExclusiveMaximum,e,n,r)),DM(e.exclusiveMinimum)&&!(r>e.exclusiveMinimum)&&(yield OM(Q.NumberExclusiveMinimum,e,n,r)),DM(e.maximum)&&!(r<=e.maximum)&&(yield OM(Q.NumberMaximum,e,n,r)),DM(e.minimum)&&!(r>=e.minimum)&&(yield OM(Q.NumberMinimum,e,n,r)),DM(e.multipleOf)&&r%e.multipleOf!==0&&(yield OM(Q.NumberMultipleOf,e,n,r))}function*rat(e,t,n,r){if(!GD.IsObjectLike(r))return yield OM(Q.Object,e,n,r);DM(e.minProperties)&&!(Object.getOwnPropertyNames(r).length>=e.minProperties)&&(yield OM(Q.ObjectMinProperties,e,n,r)),DM(e.maxProperties)&&!(Object.getOwnPropertyNames(r).length<=e.maxProperties)&&(yield OM(Q.ObjectMaxProperties,e,n,r));let i=Array.isArray(e.required)?e.required:[],a=Object.getOwnPropertyNames(e.properties),o=Object.getOwnPropertyNames(r);for(let t of i)o.includes(t)||(yield OM(Q.ObjectRequiredProperty,e.properties[t],`${n}/${EM(t)}`,void 0));if(e.additionalProperties===!1)for(let t of o)a.includes(t)||(yield OM(Q.ObjectAdditionalProperties,e,`${n}/${EM(t)}`,r[t]));if(typeof e.additionalProperties==`object`)for(let i of o)a.includes(i)||(yield*kM(e.additionalProperties,t,`${n}/${EM(i)}`,r[i]));for(let i of a){let a=e.properties[i];e.required&&e.required.includes(i)?(yield*kM(a,t,`${n}/${EM(i)}`,r[i]),jj(e)&&!(i in r)&&(yield OM(Q.ObjectRequiredProperty,a,`${n}/${EM(i)}`,void 0))):GD.IsExactOptionalProperty(r,i)&&(yield*kM(a,t,`${n}/${EM(i)}`,r[i]))}}function*iat(e,t,n,r){d3e(r)||(yield OM(Q.Promise,e,n,r))}function*aat(e,t,n,r){if(!GD.IsRecordLike(r))return yield OM(Q.Object,e,n,r);DM(e.minProperties)&&!(Object.getOwnPropertyNames(r).length>=e.minProperties)&&(yield OM(Q.ObjectMinProperties,e,n,r)),DM(e.maxProperties)&&!(Object.getOwnPropertyNames(r).length<=e.maxProperties)&&(yield OM(Q.ObjectMaxProperties,e,n,r));let[i,a]=Object.entries(e.patternProperties)[0],o=new RegExp(i);for(let[e,i]of Object.entries(r))o.test(e)&&(yield*kM(a,t,`${n}/${EM(e)}`,i));if(typeof e.additionalProperties==`object`)for(let[i,a]of Object.entries(r))o.test(i)||(yield*kM(e.additionalProperties,t,`${n}/${EM(i)}`,a));if(e.additionalProperties===!1){for(let[t,i]of Object.entries(r))if(!o.test(t))return yield OM(Q.ObjectAdditionalProperties,e,`${n}/${EM(t)}`,i)}}function*oat(e,t,n,r){yield*kM(fM(e,t),t,n,r)}function*sat(e,t,n,r){if(!zD(r))return yield OM(Q.String,e,n,r);if(DM(e.minLength)&&!(r.length>=e.minLength)&&(yield OM(Q.StringMinLength,e,n,r)),DM(e.maxLength)&&!(r.length<=e.maxLength)&&(yield OM(Q.StringMaxLength,e,n,r)),!new RegExp(e.source,e.flags).test(r))return yield OM(Q.RegExp,e,n,r)}function*cat(e,t,n,r){if(!zD(r))return yield OM(Q.String,e,n,r);DM(e.minLength)&&!(r.length>=e.minLength)&&(yield OM(Q.StringMinLength,e,n,r)),DM(e.maxLength)&&!(r.length<=e.maxLength)&&(yield OM(Q.StringMaxLength,e,n,r)),zD(e.pattern)&&(new RegExp(e.pattern).test(r)||(yield OM(Q.StringPattern,e,n,r))),zD(e.format)&&(Ok(e.format)?c6e(e.format)(r)||(yield OM(Q.StringFormat,e,n,r)):yield OM(Q.StringFormatUnknown,e,n,r))}function*lat(e,t,n,r){VD(r)||(yield OM(Q.Symbol,e,n,r))}function*uat(e,t,n,r){if(!zD(r))return yield OM(Q.String,e,n,r);new RegExp(e.pattern).test(r)||(yield OM(Q.StringPattern,e,n,r))}function*dat(e,t,n,r){yield*kM(fM(e,t),t,n,r)}function*fat(e,t,n,r){if(!ND(r))return yield OM(Q.Tuple,e,n,r);if(e.items===void 0&&r.length!==0||r.length!==e.maxItems)return yield OM(Q.TupleLength,e,n,r);if(e.items)for(let i=0;i<e.items.length;i++)yield*kM(e.items[i],t,`${n}/${i}`,r[i])}function*pat(e,t,n,r){PD(r)||(yield OM(Q.Undefined,e,n,r))}function*mat(e,t,n,r){if(wM(e,t,r))return;let i=e.anyOf.map(e=>new AM(kM(e,t,n,r)));yield OM(Q.Union,e,n,r,i)}function*hat(e,t,n,r){if(!AD(r))return yield OM(Q.Uint8Array,e,n,r);DM(e.maxByteLength)&&!(r.length<=e.maxByteLength)&&(yield OM(Q.Uint8ArrayMaxByteLength,e,n,r)),DM(e.minByteLength)&&!(r.length>=e.minByteLength)&&(yield OM(Q.Uint8ArrayMinByteLength,e,n,r))}function*gat(e,t,n,r){}function*_at(e,t,n,r){GD.IsVoidLike(r)||(yield OM(Q.Void,e,n,r))}function*vat(e,t,n,r){d6e(e[rO])(e,r)||(yield OM(Q.Kind,e,n,r))}function*kM(e,t,n,r){let i=DM(e.$id)?[...t,e]:t,a=e;switch(a[rO]){case`Any`:return yield*zit(a,i,n,r);case`Argument`:return yield*Bit(a,i,n,r);case`Array`:return yield*Vit(a,i,n,r);case`AsyncIterator`:return yield*Hit(a,i,n,r);case`BigInt`:return yield*Uit(a,i,n,r);case`Boolean`:return yield*Wit(a,i,n,r);case`Constructor`:return yield*Git(a,i,n,r);case`Date`:return yield*Kit(a,i,n,r);case`Function`:return yield*qit(a,i,n,r);case`Import`:return yield*Jit(a,i,n,r);case`Integer`:return yield*Yit(a,i,n,r);case`Intersect`:return yield*Xit(a,i,n,r);case`Iterator`:return yield*Zit(a,i,n,r);case`Literal`:return yield*Qit(a,i,n,r);case`Never`:return yield*$it(a,i,n,r);case`Not`:return yield*eat(a,i,n,r);case`Null`:return yield*tat(a,i,n,r);case`Number`:return yield*nat(a,i,n,r);case`Object`:return yield*rat(a,i,n,r);case`Promise`:return yield*iat(a,i,n,r);case`Record`:return yield*aat(a,i,n,r);case`Ref`:return yield*oat(a,i,n,r);case`RegExp`:return yield*sat(a,i,n,r);case`String`:return yield*cat(a,i,n,r);case`Symbol`:return yield*lat(a,i,n,r);case`TemplateLiteral`:return yield*uat(a,i,n,r);case`This`:return yield*dat(a,i,n,r);case`Tuple`:return yield*fat(a,i,n,r);case`Undefined`:return yield*pat(a,i,n,r);case`Union`:return yield*mat(a,i,n,r);case`Uint8Array`:return yield*hat(a,i,n,r);case`Unknown`:return yield*gat(a,i,n,r);case`Void`:return yield*_at(a,i,n,r);default:if(!Ak(a[rO]))throw new bat(e);return yield*vat(a,i,n,r)}}function yat(...e){return new AM(e.length===3?kM(e[0],e[1],``,e[2]):kM(e[0],[],``,e[1]))}var Q,bat,AM,xat=s((()=>{krt(),nj(),Mk(),K9e(),Nrt(),QD(),pM(),xM(),TM(),aO(),Kk(),WD(),(function(e){e[e.ArrayContains=0]=`ArrayContains`,e[e.ArrayMaxContains=1]=`ArrayMaxContains`,e[e.ArrayMaxItems=2]=`ArrayMaxItems`,e[e.ArrayMinContains=3]=`ArrayMinContains`,e[e.ArrayMinItems=4]=`ArrayMinItems`,e[e.ArrayUniqueItems=5]=`ArrayUniqueItems`,e[e.Array=6]=`Array`,e[e.AsyncIterator=7]=`AsyncIterator`,e[e.BigIntExclusiveMaximum=8]=`BigIntExclusiveMaximum`,e[e.BigIntExclusiveMinimum=9]=`BigIntExclusiveMinimum`,e[e.BigIntMaximum=10]=`BigIntMaximum`,e[e.BigIntMinimum=11]=`BigIntMinimum`,e[e.BigIntMultipleOf=12]=`BigIntMultipleOf`,e[e.BigInt=13]=`BigInt`,e[e.Boolean=14]=`Boolean`,e[e.DateExclusiveMaximumTimestamp=15]=`DateExclusiveMaximumTimestamp`,e[e.DateExclusiveMinimumTimestamp=16]=`DateExclusiveMinimumTimestamp`,e[e.DateMaximumTimestamp=17]=`DateMaximumTimestamp`,e[e.DateMinimumTimestamp=18]=`DateMinimumTimestamp`,e[e.DateMultipleOfTimestamp=19]=`DateMultipleOfTimestamp`,e[e.Date=20]=`Date`,e[e.Function=21]=`Function`,e[e.IntegerExclusiveMaximum=22]=`IntegerExclusiveMaximum`,e[e.IntegerExclusiveMinimum=23]=`IntegerExclusiveMinimum`,e[e.IntegerMaximum=24]=`IntegerMaximum`,e[e.IntegerMinimum=25]=`IntegerMinimum`,e[e.IntegerMultipleOf=26]=`IntegerMultipleOf`,e[e.Integer=27]=`Integer`,e[e.IntersectUnevaluatedProperties=28]=`IntersectUnevaluatedProperties`,e[e.Intersect=29]=`Intersect`,e[e.Iterator=30]=`Iterator`,e[e.Kind=31]=`Kind`,e[e.Literal=32]=`Literal`,e[e.Never=33]=`Never`,e[e.Not=34]=`Not`,e[e.Null=35]=`Null`,e[e.NumberExclusiveMaximum=36]=`NumberExclusiveMaximum`,e[e.NumberExclusiveMinimum=37]=`NumberExclusiveMinimum`,e[e.NumberMaximum=38]=`NumberMaximum`,e[e.NumberMinimum=39]=`NumberMinimum`,e[e.NumberMultipleOf=40]=`NumberMultipleOf`,e[e.Number=41]=`Number`,e[e.ObjectAdditionalProperties=42]=`ObjectAdditionalProperties`,e[e.ObjectMaxProperties=43]=`ObjectMaxProperties`,e[e.ObjectMinProperties=44]=`ObjectMinProperties`,e[e.ObjectRequiredProperty=45]=`ObjectRequiredProperty`,e[e.Object=46]=`Object`,e[e.Promise=47]=`Promise`,e[e.RegExp=48]=`RegExp`,e[e.StringFormatUnknown=49]=`StringFormatUnknown`,e[e.StringFormat=50]=`StringFormat`,e[e.StringMaxLength=51]=`StringMaxLength`,e[e.StringMinLength=52]=`StringMinLength`,e[e.StringPattern=53]=`StringPattern`,e[e.String=54]=`String`,e[e.Symbol=55]=`Symbol`,e[e.TupleLength=56]=`TupleLength`,e[e.Tuple=57]=`Tuple`,e[e.Uint8ArrayMaxByteLength=58]=`Uint8ArrayMaxByteLength`,e[e.Uint8ArrayMinByteLength=59]=`Uint8ArrayMinByteLength`,e[e.Uint8Array=60]=`Uint8Array`,e[e.Undefined=61]=`Undefined`,e[e.Union=62]=`Union`,e[e.Void=63]=`Void`})(Q||={}),bat=class extends ZD{constructor(e){super(`Unknown type`),this.schema=e}},AM=class{constructor(e){this.iterator=e}[Symbol.iterator](){return this.iterator}First(){let e=this.iterator.next();return e.done?void 0:e.value}}})),Sat=s((()=>{xat(),Nrt()}));function Cat(e,t,n){if(!wM(e,t,n))throw new Dat(yat(e,t,n))}function wat(...e){return e.length===3?Cat(e[0],e[1],e[2]):Cat(e[0],[],e[1])}var Tat,jM,MM,NM,Eat,Dat,Oat=s((()=>{Sat(),S3e(),Rit(),Tat=function(e,t,n,r,i){if(r===`m`)throw TypeError(`Private method is not writable`);if(r===`a`&&!i)throw TypeError(`Private accessor was defined without a setter`);if(typeof t==`function`?e!==t||!i:!t.has(e))throw TypeError(`Cannot write private member to an object whose class did not declare it`);return r===`a`?i.call(e,n):i?i.value=n:t.set(e,n),n},jM=function(e,t,n,r){if(n===`a`&&!r)throw TypeError(`Private accessor was defined without a getter`);if(typeof t==`function`?e!==t||!r:!t.has(e))throw TypeError(`Cannot read private member from an object whose class did not declare it`);return n===`m`?r:n===`a`?r.call(e):r?r.value:t.get(e)},Dat=class extends ZD{constructor(e){let t=e.First();super(t===void 0?`Invalid Value`:t.message),MM.add(this),NM.set(this,void 0),Tat(this,NM,e,`f`),this.error=t}Errors(){return new AM(jM(this,MM,`m`,Eat).call(this))}},NM=new WeakMap,MM=new WeakSet,Eat=function*(){this.error&&(yield this.error),yield*jM(this,NM,`f`)}})),kat=s((()=>{Oat()}));function Aat(e,t){if(t.has(e))return t.get(e);let n={};t.set(e,n);for(let r of Object.getOwnPropertyNames(e))n[r]=PM(e[r],t);for(let r of Object.getOwnPropertySymbols(e))n[r]=PM(e[r],t);return n}function jat(e,t){if(t.has(e))return t.get(e);let n=[];t.set(e,n);for(let r=0;r<e.length;r++)n.push(PM(e[r],t));return n}function Mat(e){return e.slice()}function Nat(e){return new Map(PM([...e.entries()]))}function Pat(e){return new Set(PM([...e.entries()]))}function Fat(e){return new Date(e.toISOString())}function Iat(e){return e}function PM(e,t=new WeakMap){if(ND(e))return jat(e,t);if(kD(e))return Fat(e);if(m3e(e))return Mat(e);if(f3e(e))return Nat(e);if(p3e(e))return Pat(e);if(MD(e))return Aat(e,t);if(HD(e))return Iat(e);throw Error(`ValueClone: Unable to clone value`)}var Lat=s((()=>{WD()})),FM=s((()=>{Lat()}));function IM(e){return BD(e)?e():PM(e)}function Rat(e,t){return jD(e,`default`)?IM(e.default):{}}function zat(e,t){return{}}function Bat(e,t){if(e.uniqueItems===!0&&!jD(e,`default`))throw new zM(e,`Array with the uniqueItems constraint requires a default value`);if(`contains`in e&&!jD(e,`default`))throw new zM(e,`Array with the contains constraint requires a default value`);return`default`in e?IM(e.default):e.minItems===void 0?[]:Array.from({length:e.minItems}).map(n=>LM(e.items,t))}function Vat(e,t){return jD(e,`default`)?IM(e.default):(async function*(){})()}function Hat(e,t){return jD(e,`default`)?IM(e.default):BigInt(0)}function Uat(e,t){return jD(e,`default`)?IM(e.default):!1}function Wat(e,t){if(jD(e,`default`))return IM(e.default);{let n=LM(e.returns,t);return typeof n==`object`&&!Array.isArray(n)?class{constructor(){for(let[e,t]of Object.entries(n)){let n=this;n[e]=t}}}:class{}}}function Gat(e,t){return jD(e,`default`)?IM(e.default):e.minimumTimestamp===void 0?new Date:new Date(e.minimumTimestamp)}function Kat(e,t){return jD(e,`default`)?IM(e.default):()=>LM(e.returns,t)}function qat(e,t){let n=globalThis.Object.values(e.$defs),r=e.$defs[e.$ref];return LM(r,[...t,...n])}function Jat(e,t){return jD(e,`default`)?IM(e.default):e.minimum===void 0?0:e.minimum}function Yat(e,t){if(jD(e,`default`))return IM(e.default);{let n=e.allOf.reduce((e,n)=>{let r=LM(n,t);return typeof r==`object`?{...e,...r}:r},{});if(!wM(e,t,n))throw new zM(e,`Intersect produced invalid value. Consider using a default value.`);return n}}function Xat(e,t){return jD(e,`default`)?IM(e.default):(function*(){})()}function Zat(e,t){return jD(e,`default`)?IM(e.default):e.const}function Qat(e,t){if(jD(e,`default`))return IM(e.default);throw new zM(e,`Never types cannot be created. Consider using a default value.`)}function $at(e,t){if(jD(e,`default`))return IM(e.default);throw new zM(e,`Not types must have a default value`)}function eot(e,t){return jD(e,`default`)?IM(e.default):null}function tot(e,t){return jD(e,`default`)?IM(e.default):e.minimum===void 0?0:e.minimum}function not(e,t){if(jD(e,`default`))return IM(e.default);{let n=new Set(e.required),r={};for(let[i,a]of Object.entries(e.properties))n.has(i)&&(r[i]=LM(a,t));return r}}function rot(e,t){return jD(e,`default`)?IM(e.default):Promise.resolve(LM(e.item,t))}function iot(e,t){return jD(e,`default`)?IM(e.default):{}}function aot(e,t){return jD(e,`default`)?IM(e.default):LM(fM(e,t),t)}function oot(e,t){if(jD(e,`default`))return IM(e.default);throw new zM(e,`RegExp types cannot be created. Consider using a default value.`)}function sot(e,t){if(e.pattern!==void 0){if(jD(e,`default`))return IM(e.default);throw new zM(e,`String types with patterns must specify a default value`)}else if(e.format!==void 0){if(jD(e,`default`))return IM(e.default);throw new zM(e,`String types with formats must specify a default value`)}else if(jD(e,`default`))return IM(e.default);else if(e.minLength!==void 0)return Array.from({length:e.minLength}).map(()=>` `).join(``);else return``}function cot(e,t){return jD(e,`default`)?IM(e.default):`value`in e?Symbol.for(e.value):Symbol()}function lot(e,t){if(jD(e,`default`))return IM(e.default);if(!Q6e(e))throw new zM(e,`Can only create template literals that produce a finite variants. Consider using a default value.`);return dA(e)[0]}function uot(e,t){if(BM++>vot)throw new zM(e,`Cannot create recursive type as it appears possibly infinite. Consider using a default.`);return jD(e,`default`)?IM(e.default):LM(fM(e,t),t)}function dot(e,t){return jD(e,`default`)?IM(e.default):e.items===void 0?[]:Array.from({length:e.minItems}).map((n,r)=>LM(e.items[r],t))}function fot(e,t){if(jD(e,`default`))return IM(e.default)}function pot(e,t){if(jD(e,`default`))return IM(e.default);if(e.anyOf.length===0)throw Error(`ValueCreate.Union: Cannot create Union with zero variants`);return LM(e.anyOf[0],t)}function mot(e,t){return jD(e,`default`)?IM(e.default):e.minByteLength===void 0?new Uint8Array:new Uint8Array(e.minByteLength)}function hot(e,t){return jD(e,`default`)?IM(e.default):{}}function got(e,t){if(jD(e,`default`))return IM(e.default)}function _ot(e,t){if(jD(e,`default`))return IM(e.default);throw Error(`User defined types must specify a default value`)}function LM(e,t){let n=dM(e,t),r=e;switch(r[rO]){case`Any`:return Rat(r,n);case`Argument`:return zat(r,n);case`Array`:return Bat(r,n);case`AsyncIterator`:return Vat(r,n);case`BigInt`:return Hat(r,n);case`Boolean`:return Uat(r,n);case`Constructor`:return Wat(r,n);case`Date`:return Gat(r,n);case`Function`:return Kat(r,n);case`Import`:return qat(r,n);case`Integer`:return Jat(r,n);case`Intersect`:return Yat(r,n);case`Iterator`:return Xat(r,n);case`Literal`:return Zat(r,n);case`Never`:return Qat(r,n);case`Not`:return $at(r,n);case`Null`:return eot(r,n);case`Number`:return tot(r,n);case`Object`:return not(r,n);case`Promise`:return rot(r,n);case`Record`:return iot(r,n);case`Ref`:return aot(r,n);case`RegExp`:return oot(r,n);case`String`:return sot(r,n);case`Symbol`:return cot(r,n);case`TemplateLiteral`:return lot(r,n);case`This`:return uot(r,n);case`Tuple`:return dot(r,n);case`Undefined`:return fot(r,n);case`Union`:return pot(r,n);case`Uint8Array`:return mot(r,n);case`Unknown`:return hot(r,n);case`Void`:return got(r,n);default:if(!Ak(r[rO]))throw new zM(r,`Unknown type`);return _ot(r,n)}}function RM(...e){return BM=0,e.length===2?LM(e[0],e[1]):LM(e[0],[])}var zM,vot,BM,yot=s((()=>{WD(),TM(),FM(),pM(),CA(),Mk(),aO(),QD(),UD(),zM=class extends ZD{constructor(e,t){super(t),this.schema=e}},vot=512,BM=0})),bot=s((()=>{yot()}));function xot(e,t,n){if(e[rO]===`Object`&&typeof n==`object`&&!FD(n)){let r=e,i=Object.getOwnPropertyNames(n);return Object.entries(r.properties).reduce((e,[r,a])=>{let o=a[rO]===`Literal`&&a.const===n[r]?100:0,s=wM(a,t,n[r])?10:0,c=i.includes(r)?1:0;return e+(o+s+c)},0)}else if(e[rO]===`Union`){let r=e.anyOf.map(e=>fM(e,t)).map(e=>xot(e,t,n));return Math.max(...r)}else return wM(e,t,n)?1:0}function Sot(e,t,n){let r=e.anyOf.map(e=>fM(e,t)),[i,a]=[r[0],0];for(let e of r){let r=xot(e,t,n);r>a&&(i=e,a=r)}return i}function Cot(e,t,n,r){return`default`in e?typeof n==`function`?e.default:PM(e.default):HM(Sot(e,t,n),t,n,r)}function wot(e,t,n){return wM(e,t,n)?PM(n):RM(e,t)}function Tot(e,t,n){return wM(e,t,n)?n:RM(e,t)}function Eot(e,t,n,r){if(wM(e,t,n))return PM(n);let i=ND(n)?n:RM(e,t),a=LD(e.minItems)&&i.length<e.minItems?[...i,...Array.from({length:e.minItems-i.length},()=>null)]:i,o=(LD(e.maxItems)&&a.length>e.maxItems?a.slice(0,e.maxItems):a).map(n=>VM(e.items,t,n,r));if(e.uniqueItems!==!0)return o;let s=[...new Set(o)];if(!wM(e,t,s))throw new UM(e,`Array cast produced invalid data due to uniqueItems constraint`);return s}function Dot(e,t,n,r){if(wM(e,t,n))return RM(e,t);let i=new Set(e.returns.required||[]),a=function(){};for(let[o,s]of Object.entries(e.returns.properties))!i.has(o)&&n.prototype[o]===void 0||(a.prototype[o]=VM(s,t,n.prototype[o],r));return a}function Oot(e,t,n,r){let i=globalThis.Object.values(e.$defs),a=e.$defs[e.$ref];return VM(a,[...t,...i],n,r)}function kot(e,t){return MD(e)&&!MD(t)||!MD(e)&&MD(t)?e:!MD(e)||!MD(t)?t:globalThis.Object.getOwnPropertyNames(e).reduce((n,r)=>{let i=r in t?kot(e[r],t[r]):e[r];return{...n,[r]:i}},{})}function Aot(e,t,n){if(wM(e,t,n))return n;let r=RM(e,t),i=kot(r,n);return wM(e,t,i)?i:r}function jot(e,t,n){throw new UM(e,`Never types cannot be cast`)}function Mot(e,t,n,r){if(r.has(n))return r.get(n);if(wM(e,t,n))return n;if(typeof n!=`object`||!n)return RM(e,t);let i=new Set(e.required||[]),a={};r.set(n,a);for(let[o,s]of Object.entries(e.properties))!i.has(o)&&n[o]===void 0||(a[o]=VM(s,t,n[o],r));if(typeof e.additionalProperties==`object`){let i=Object.getOwnPropertyNames(e.properties);for(let o of Object.getOwnPropertyNames(n))i.includes(o)||(a[o]=VM(e.additionalProperties,t,n[o],r))}return a}function Not(e,t,n,r){if(wM(e,t,n))return PM(n);if(typeof n!=`object`||!n||Array.isArray(n)||n instanceof Date)return RM(e,t);let i=Object.getOwnPropertyNames(e.patternProperties)[0],a=e.patternProperties[i],o={};for(let[e,i]of Object.entries(n))o[e]=VM(a,t,i,r);return o}function Pot(e,t,n,r){return VM(fM(e,t),t,n,r)}function Fot(e,t,n,r){return VM(fM(e,t),t,n,r)}function Iot(e,t,n,r){return wM(e,t,n)?PM(n):ND(n)?e.items===void 0?[]:e.items.map((e,i)=>VM(e,t,n[i],r)):RM(e,t)}function Lot(e,t,n,r){return wM(e,t,n)?PM(n):Cot(e,t,n,r)}function VM(e,t,n,r){let i=zD(e.$id)?dM(e,t):t,a=e;switch(e[rO]){case`Array`:return Eot(a,i,n,r);case`Constructor`:return Dot(a,i,n,r);case`Import`:return Oot(a,i,n,r);case`Intersect`:return Aot(a,i,n);case`Never`:return jot(a,i,n);case`Object`:return Mot(a,i,n,r);case`Record`:return Not(a,i,n,r);case`Ref`:return Pot(a,i,n,r);case`This`:return Fot(a,i,n,r);case`Tuple`:return Iot(a,i,n,r);case`Union`:return Lot(a,i,n,r);case`Date`:case`Symbol`:case`Uint8Array`:return wot(e,t,n);default:return Tot(a,i,n)}}function HM(...e){return e.length===2||e.length===3&&e[2]instanceof WeakMap?VM(e[0],[],e[1],e[2]??new WeakMap):VM(e[0],e[1],e[2],e[3]??new WeakMap)}var UM,Rot=s((()=>{WD(),QD(),aO(),bot(),TM(),FM(),pM(),UM=class extends ZD{constructor(e,t){super(t),this.schema=e}}})),WM=s((()=>{Rot()}));function zot(e){return IO(e)&&e[rO]!==`Unsafe`}function Bot(e,t,n){return ND(n)?n.map(n=>GM(e.items,t,n)):n}function Vot(e,t,n){let r=globalThis.Object.values(e.$defs),i=e.$defs[e.$ref];return GM(i,[...t,...r],n)}function Hot(e,t,n){let r=e.unevaluatedProperties,i=e.allOf.map(e=>GM(e,t,PM(n))).reduce((e,t)=>MD(t)?{...e,...t}:t,{});if(!MD(n)||!MD(i)||!IO(r))return i;let a=ZA(e);for(let e of Object.getOwnPropertyNames(n))a.includes(e)||wM(r,t,n[e])&&(i[e]=GM(r,t,n[e]));return i}function Uot(e,t,n){if(!MD(n)||ND(n))return n;let r=e.additionalProperties;for(let i of Object.getOwnPropertyNames(n)){if(jD(e.properties,i)){n[i]=GM(e.properties[i],t,n[i]);continue}if(IO(r)&&wM(r,t,n[i])){n[i]=GM(r,t,n[i]);continue}delete n[i]}return n}function Wot(e,t,n){if(!MD(n))return n;let r=e.additionalProperties,i=Object.getOwnPropertyNames(n),[a,o]=Object.entries(e.patternProperties)[0],s=new RegExp(a);for(let e of i){if(s.test(e)){n[e]=GM(o,t,n[e]);continue}if(IO(r)&&wM(r,t,n[e])){n[e]=GM(r,t,n[e]);continue}delete n[e]}return n}function Got(e,t,n){return GM(fM(e,t),t,n)}function Kot(e,t,n){return GM(fM(e,t),t,n)}function qot(e,t,n){if(!ND(n))return n;if(PD(e.items))return[];let r=Math.min(n.length,e.items.length);for(let i=0;i<r;i++)n[i]=GM(e.items[i],t,n[i]);return n.length>r?n.slice(0,r):n}function Jot(e,t,n){for(let r of e.anyOf)if(zot(r)&&wM(r,t,n))return GM(r,t,n);return n}function GM(e,t,n){let r=zD(e.$id)?dM(e,t):t,i=e;switch(i[rO]){case`Array`:return Bot(i,r,n);case`Import`:return Vot(i,r,n);case`Intersect`:return Hot(i,r,n);case`Object`:return Uot(i,r,n);case`Record`:return Wot(i,r,n);case`Ref`:return Got(i,r,n);case`This`:return Kot(i,r,n);case`Tuple`:return qot(i,r,n);case`Union`:return Jot(i,r,n);default:return n}}function Yot(...e){return e.length===3?GM(e[0],e[1],e[2]):GM(e[0],[],e[1])}var Xot=s((()=>{nj(),TM(),FM(),pM(),aO(),WD(),RO()})),Zot=s((()=>{Xot()}));function KM(e){return zD(e)&&!isNaN(e)&&!isNaN(parseFloat(e))}function Qot(e){return RD(e)||ID(e)||LD(e)}function qM(e){return e===!0||LD(e)&&e===1||RD(e)&&e===BigInt(`1`)||zD(e)&&(e.toLowerCase()===`true`||e===`1`)}function JM(e){return e===!1||LD(e)&&(e===0||Object.is(e,-0))||RD(e)&&e===BigInt(`0`)||zD(e)&&(e.toLowerCase()===`false`||e===`0`||e===`-0`)}function $ot(e){return zD(e)&&/^(?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:z|[+-]\d\d(?::?\d\d)?)$/i.test(e)}function est(e){return zD(e)&&/^(?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)?$/i.test(e)}function tst(e){return zD(e)&&/^\d\d\d\d-[0-1]\d-[0-3]\dt(?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:z|[+-]\d\d(?::?\d\d)?)$/i.test(e)}function nst(e){return zD(e)&&/^\d\d\d\d-[0-1]\d-[0-3]\dt(?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)?$/i.test(e)}function rst(e){return zD(e)&&/^\d\d\d\d-[0-1]\d-[0-3]\d$/i.test(e)}function ist(e,t){let n=ust(e);return n===t?n:e}function ast(e,t){let n=dst(e);return n===t?n:e}function ost(e,t){let n=cst(e);return n===t?n:e}function sst(e,t){return zD(e.const)?ist(t,e.const):LD(e.const)?ast(t,e.const):ID(e.const)?ost(t,e.const):t}function cst(e){return qM(e)?!0:JM(e)?!1:e}function lst(e){return KM(e)?BigInt((e=>e.split(`.`)[0])(e)):LD(e)?BigInt(Math.trunc(e)):JM(e)?BigInt(0):qM(e)?BigInt(1):e}function ust(e){return VD(e)&&e.description!==void 0?e.description.toString():Qot(e)?e.toString():e}function dst(e){return KM(e)?parseFloat(e):qM(e)?1:JM(e)?0:e}function fst(e){return KM(e)?parseInt(e):LD(e)?Math.trunc(e):qM(e)?1:JM(e)?0:e}function pst(e){return zD(e)&&e.toLowerCase()===`null`?null:e}function mst(e){return zD(e)&&e===`undefined`?void 0:e}function hst(e){return kD(e)?e:LD(e)?new Date(e):qM(e)?new Date(1):JM(e)?new Date(0):KM(e)?new Date(parseInt(e)):est(e)?new Date(`1970-01-01T${e}.000Z`):$ot(e)?new Date(`1970-01-01T${e}`):nst(e)?new Date(`${e}.000Z`):tst(e)?new Date(e):rst(e)?new Date(`${e}T00:00:00.000Z`):e}function gst(e){return e}function _st(e,t,n){return(ND(n)?n:[n]).map(n=>YM(e.items,t,n))}function vst(e,t,n){return lst(n)}function yst(e,t,n){return cst(n)}function bst(e,t,n){return hst(n)}function xst(e,t,n){let r=globalThis.Object.values(e.$defs),i=e.$defs[e.$ref];return YM(i,[...t,...r],n)}function Sst(e,t,n){return fst(n)}function Cst(e,t,n){return e.allOf.reduce((e,n)=>YM(n,t,e),n)}function wst(e,t,n){return sst(e,n)}function Tst(e,t,n){return pst(n)}function Est(e,t,n){return dst(n)}function Dst(e,t,n){if(!MD(n)||ND(n))return n;for(let r of Object.getOwnPropertyNames(e.properties))jD(n,r)&&(n[r]=YM(e.properties[r],t,n[r]));return n}function Ost(e,t,n){if(!(MD(n)&&!ND(n)))return n;let r=Object.getOwnPropertyNames(e.patternProperties)[0],i=e.patternProperties[r];for(let[e,r]of Object.entries(n))n[e]=YM(i,t,r);return n}function kst(e,t,n){return YM(fM(e,t),t,n)}function Ast(e,t,n){return ust(n)}function jst(e,t,n){return zD(n)||LD(n)?Symbol(n):n}function Mst(e,t,n){return YM(fM(e,t),t,n)}function Nst(e,t,n){return ND(n)&&!PD(e.items)?n.map((n,r)=>r<e.items.length?YM(e.items[r],t,n):n):n}function Pst(e,t,n){return mst(n)}function Fst(e,t,n){for(let r of e.anyOf)if(wM(r,t,n))return n;for(let r of e.anyOf){let e=YM(r,t,PM(n));if(wM(r,t,e))return e}return n}function YM(e,t,n){let r=dM(e,t),i=e;switch(e[rO]){case`Array`:return _st(i,r,n);case`BigInt`:return vst(i,r,n);case`Boolean`:return yst(i,r,n);case`Date`:return bst(i,r,n);case`Import`:return xst(i,r,n);case`Integer`:return Sst(i,r,n);case`Intersect`:return Cst(i,r,n);case`Literal`:return wst(i,r,n);case`Null`:return Tst(i,r,n);case`Number`:return Est(i,r,n);case`Object`:return Dst(i,r,n);case`Record`:return Ost(i,r,n);case`Ref`:return kst(i,r,n);case`String`:return Ast(i,r,n);case`Symbol`:return jst(i,r,n);case`This`:return Mst(i,r,n);case`Tuple`:return Nst(i,r,n);case`Undefined`:return Pst(i,r,n);case`Union`:return Fst(i,r,n);default:return gst(n)}}function Ist(...e){return e.length===3?YM(e[0],e[1],e[2]):YM(e[0],[],e[1])}var Lst=s((()=>{FM(),TM(),pM(),aO(),WD()})),Rst=s((()=>{Lst()}));function XM(e,t,n){try{return MO(e)?e[$D].Decode(n):n}catch(r){throw new Xst(e,t,n,r)}}function zst(e,t,n,r){return ND(r)?XM(e,n,r.map((r,i)=>ZM(e.items,t,`${n}/${i}`,r))):XM(e,n,r)}function Bst(e,t,n,r){if(!MD(r)||HD(r))return XM(e,n,r);let i=i7e(e),a=i.map(e=>e[0]),o={...r};for(let[e,r]of i)e in o&&(o[e]=ZM(r,t,`${n}/${e}`,o[e]));if(!MO(e.unevaluatedProperties))return XM(e,n,o);let s=Object.getOwnPropertyNames(o),c=e.unevaluatedProperties,l={...o};for(let e of s)a.includes(e)||(l[e]=XM(c,`${n}/${e}`,l[e]));return XM(e,n,l)}function Vst(e,t,n,r){let i=globalThis.Object.values(e.$defs),a=e.$defs[e.$ref];return XM(e,n,ZM(a,[...t,...i],n,r))}function Hst(e,t,n,r){return XM(e,n,ZM(e.not,t,n,r))}function Ust(e,t,n,r){if(!MD(r))return XM(e,n,r);let i=ZA(e),a={...r};for(let r of i)jD(a,r)&&(PD(a[r])&&(!PO(e.properties[r])||GD.IsExactOptionalProperty(a,r))||(a[r]=ZM(e.properties[r],t,`${n}/${r}`,a[r])));if(!LO(e.additionalProperties))return XM(e,n,a);let o=Object.getOwnPropertyNames(a),s=e.additionalProperties,c={...a};for(let e of o)i.includes(e)||(c[e]=XM(s,`${n}/${e}`,c[e]));return XM(e,n,c)}function Wst(e,t,n,r){if(!MD(r))return XM(e,n,r);let i=Object.getOwnPropertyNames(e.patternProperties)[0],a=new RegExp(i),o={...r};for(let s of Object.getOwnPropertyNames(r))a.test(s)&&(o[s]=ZM(e.patternProperties[i],t,`${n}/${s}`,o[s]));if(!LO(e.additionalProperties))return XM(e,n,o);let s=Object.getOwnPropertyNames(o),c=e.additionalProperties,l={...o};for(let e of s)a.test(e)||(l[e]=XM(c,`${n}/${e}`,l[e]));return XM(e,n,l)}function Gst(e,t,n,r){return XM(e,n,ZM(fM(e,t),t,n,r))}function Kst(e,t,n,r){return XM(e,n,ZM(fM(e,t),t,n,r))}function qst(e,t,n,r){return ND(r)&&ND(e.items)?XM(e,n,e.items.map((e,i)=>ZM(e,t,`${n}/${i}`,r[i]))):XM(e,n,r)}function Jst(e,t,n,r){for(let i of e.anyOf)if(wM(i,t,r))return XM(e,n,ZM(i,t,n,r));return XM(e,n,r)}function ZM(e,t,n,r){let i=dM(e,t),a=e;switch(e[rO]){case`Array`:return zst(a,i,n,r);case`Import`:return Vst(a,i,n,r);case`Intersect`:return Bst(a,i,n,r);case`Not`:return Hst(a,i,n,r);case`Object`:return Ust(a,i,n,r);case`Record`:return Wst(a,i,n,r);case`Ref`:return Gst(a,i,n,r);case`Symbol`:return XM(a,n,r);case`This`:return Kst(a,i,n,r);case`Tuple`:return qst(a,i,n,r);case`Union`:return Jst(a,i,n,r);default:return XM(a,n,r)}}function Yst(e,t,n){return ZM(e,t,``,n)}var Xst,Zst=s((()=>{KD(),aO(),QD(),nj(),pM(),TM(),WD(),RO(),Xst=class extends ZD{constructor(e,t,n,r){super(r instanceof Error?r.message:`Unknown error`),this.schema=e,this.path=t,this.value=n,this.error=r}}}));function QM(e,t,n){try{return MO(e)?e[$D].Encode(n):n}catch(r){throw new lct(e,t,n,r)}}function Qst(e,t,n,r){let i=QM(e,n,r);return ND(i)?i.map((r,i)=>$M(e.items,t,`${n}/${i}`,r)):i}function $st(e,t,n,r){let i=globalThis.Object.values(e.$defs),a=e.$defs[e.$ref],o=QM(e,n,r);return $M(a,[...t,...i],n,o)}function ect(e,t,n,r){let i=QM(e,n,r);if(!MD(r)||HD(r))return i;let a=i7e(e),o=a.map(e=>e[0]),s={...i};for(let[e,r]of a)e in s&&(s[e]=$M(r,t,`${n}/${e}`,s[e]));if(!MO(e.unevaluatedProperties))return s;let c=Object.getOwnPropertyNames(s),l=e.unevaluatedProperties,u={...s};for(let e of c)o.includes(e)||(u[e]=QM(l,`${n}/${e}`,u[e]));return u}function tct(e,t,n,r){return QM(e.not,n,QM(e,n,r))}function nct(e,t,n,r){let i=QM(e,n,r);if(!MD(i))return i;let a=ZA(e),o={...i};for(let r of a)jD(o,r)&&(PD(o[r])&&(!PO(e.properties[r])||GD.IsExactOptionalProperty(o,r))||(o[r]=$M(e.properties[r],t,`${n}/${r}`,o[r])));if(!LO(e.additionalProperties))return o;let s=Object.getOwnPropertyNames(o),c=e.additionalProperties,l={...o};for(let e of s)a.includes(e)||(l[e]=QM(c,`${n}/${e}`,l[e]));return l}function rct(e,t,n,r){let i=QM(e,n,r);if(!MD(r))return i;let a=Object.getOwnPropertyNames(e.patternProperties)[0],o=new RegExp(a),s={...i};for(let i of Object.getOwnPropertyNames(r))o.test(i)&&(s[i]=$M(e.patternProperties[a],t,`${n}/${i}`,s[i]));if(!LO(e.additionalProperties))return s;let c=Object.getOwnPropertyNames(s),l=e.additionalProperties,u={...s};for(let e of c)o.test(e)||(u[e]=QM(l,`${n}/${e}`,u[e]));return u}function ict(e,t,n,r){return QM(e,n,$M(fM(e,t),t,n,r))}function act(e,t,n,r){return QM(e,n,$M(fM(e,t),t,n,r))}function oct(e,t,n,r){let i=QM(e,n,r);return ND(e.items)?e.items.map((e,r)=>$M(e,t,`${n}/${r}`,i[r])):[]}function sct(e,t,n,r){for(let i of e.anyOf)if(wM(i,t,r))return QM(e,n,$M(i,t,n,r));for(let i of e.anyOf){let a=$M(i,t,n,r);if(wM(e,t,a))return QM(e,n,a)}return QM(e,n,r)}function $M(e,t,n,r){let i=dM(e,t),a=e;switch(e[rO]){case`Array`:return Qst(a,i,n,r);case`Import`:return $st(a,i,n,r);case`Intersect`:return ect(a,i,n,r);case`Not`:return tct(a,i,n,r);case`Object`:return nct(a,i,n,r);case`Record`:return rct(a,i,n,r);case`Ref`:return ict(a,i,n,r);case`This`:return act(a,i,n,r);case`Tuple`:return oct(a,i,n,r);case`Union`:return sct(a,i,n,r);default:return QM(a,n,r)}}function cct(e,t,n){return $M(e,t,``,n)}var lct,uct=s((()=>{KD(),aO(),QD(),nj(),pM(),TM(),WD(),RO(),lct=class extends ZD{constructor(e,t,n,r){super(`${r instanceof Error?r.message:`Unknown error`}`),this.schema=e,this.path=t,this.value=n,this.error=r}}}));function dct(e,t){return MO(e)||eN(e.items,t)}function fct(e,t){return MO(e)||eN(e.items,t)}function pct(e,t){return MO(e)||eN(e.returns,t)||e.parameters.some(e=>eN(e,t))}function mct(e,t){return MO(e)||eN(e.returns,t)||e.parameters.some(e=>eN(e,t))}function hct(e,t){return MO(e)||MO(e.unevaluatedProperties)||e.allOf.some(e=>eN(e,t))}function gct(e,t){let n=globalThis.Object.getOwnPropertyNames(e.$defs).reduce((t,n)=>[...t,e.$defs[n]],[]),r=e.$defs[e.$ref];return MO(e)||eN(r,[...n,...t])}function _ct(e,t){return MO(e)||eN(e.items,t)}function vct(e,t){return MO(e)||eN(e.not,t)}function yct(e,t){return MO(e)||Object.values(e.properties).some(e=>eN(e,t))||LO(e.additionalProperties)&&eN(e.additionalProperties,t)}function bct(e,t){return MO(e)||eN(e.item,t)}function xct(e,t){let n=Object.getOwnPropertyNames(e.patternProperties)[0],r=e.patternProperties[n];return MO(e)||eN(r,t)||LO(e.additionalProperties)&&MO(e.additionalProperties)}function Sct(e,t){return MO(e)?!0:eN(fM(e,t),t)}function Cct(e,t){return MO(e)?!0:eN(fM(e,t),t)}function wct(e,t){return MO(e)||!PD(e.items)&&e.items.some(e=>eN(e,t))}function Tct(e,t){return MO(e)||e.anyOf.some(e=>eN(e,t))}function eN(e,t){let n=dM(e,t),r=e;if(e.$id&&tN.has(e.$id))return!1;switch(e.$id&&tN.add(e.$id),e[rO]){case`Array`:return dct(r,n);case`AsyncIterator`:return fct(r,n);case`Constructor`:return pct(r,n);case`Function`:return mct(r,n);case`Import`:return gct(r,n);case`Intersect`:return hct(r,n);case`Iterator`:return _ct(r,n);case`Not`:return vct(r,n);case`Object`:return yct(r,n);case`Promise`:return bct(r,n);case`Record`:return xct(r,n);case`Ref`:return Sct(r,n);case`This`:return Cct(r,n);case`Tuple`:return wct(r,n);case`Union`:return Tct(r,n);default:return MO(e)}}function Ect(e,t){return tN.clear(),eN(e,t)}var tN,Dct=s((()=>{pM(),aO(),RO(),WD(),tN=new Set})),Oct=s((()=>{Zst(),uct(),Dct()})),kct=s((()=>{})),Act=s((()=>{kct()}));function nN(e,t){let n=jD(e,`default`)?e.default:void 0,r=BD(n)?n():PM(n);return PD(t)?r:MD(t)&&MD(r)?Object.assign(r,t):t}function rN(e){return IO(e)&&`default`in e}function jct(e,t,n){if(ND(n)){for(let r=0;r<n.length;r++)n[r]=iN(e.items,t,n[r]);return n}let r=nN(e,n);if(!ND(r))return r;for(let n=0;n<r.length;n++)r[n]=iN(e.items,t,r[n]);return r}function Mct(e,t,n){return kD(n)?n:nN(e,n)}function Nct(e,t,n){let r=globalThis.Object.values(e.$defs),i=e.$defs[e.$ref];return iN(i,[...t,...r],n)}function Pct(e,t,n){let r=nN(e,n);return e.allOf.reduce((e,n)=>{let i=iN(n,t,r);return MD(i)?{...e,...i}:i},{})}function Fct(e,t,n){let r=nN(e,n);if(!MD(r))return r;let i=Object.getOwnPropertyNames(e.properties);for(let n of i)PD(iN(e.properties[n],t,r[n]))||(r[n]=iN(e.properties[n],t,r[n]));if(!rN(e.additionalProperties))return r;for(let n of Object.getOwnPropertyNames(r))i.includes(n)||(r[n]=iN(e.additionalProperties,t,r[n]));return r}function Ict(e,t,n){let r=nN(e,n);if(!MD(r))return r;let i=e.additionalProperties,[a,o]=Object.entries(e.patternProperties)[0],s=new RegExp(a);for(let e of Object.getOwnPropertyNames(r))s.test(e)&&rN(o)&&(r[e]=iN(o,t,r[e]));if(!rN(i))return r;for(let e of Object.getOwnPropertyNames(r))s.test(e)||(r[e]=iN(i,t,r[e]));return r}function Lct(e,t,n){return iN(fM(e,t),t,nN(e,n))}function Rct(e,t,n){return iN(fM(e,t),t,n)}function zct(e,t,n){let r=nN(e,n);if(!ND(r)||PD(e.items))return r;let[i,a]=[e.items,Math.max(e.items.length,r.length)];for(let e=0;e<a;e++)e<i.length&&(r[e]=iN(i[e],t,r[e]));return r}function Bct(e,t,n){let r=nN(e,n);for(let n of e.anyOf){let e=iN(n,t,PM(r));if(wM(n,t,e))return e}return r}function iN(e,t,n){let r=dM(e,t),i=e;switch(i[rO]){case`Array`:return jct(i,r,n);case`Date`:return Mct(i,r,n);case`Import`:return Nct(i,r,n);case`Intersect`:return Pct(i,r,n);case`Object`:return Fct(i,r,n);case`Record`:return Ict(i,r,n);case`Ref`:return Lct(i,r,n);case`This`:return Rct(i,r,n);case`Tuple`:return zct(i,r,n);case`Union`:return Bct(i,r,n);default:return nN(i,n)}}function Vct(...e){return e.length===3?iN(e[0],e[1],e[2]):iN(e[0],[],e[1])}var Hct=s((()=>{TM(),FM(),pM(),aO(),WD(),RO()})),Uct=s((()=>{Hct()})),Wct=s((()=>{})),Gct=s((()=>{})),Kct,qct,Jct,Yct=s((()=>{pA(),NA(),bA(),lj(),tA(),Kct=MA({type:fA(`insert`),path:yA(),value:cj()}),qct=MA({type:fA(`update`),path:yA(),value:cj()}),Jct=MA({type:fA(`delete`),path:yA()}),eA([Kct,qct,Jct])})),Xct=s((()=>{Yct()})),Zct=s((()=>{})),Qct=s((()=>{Zct()})),$ct=s((()=>{Gct()})),elt=s((()=>{})),tlt=s((()=>{elt()})),nlt,rlt=s((()=>{Oct(),kat(),WM(),Zot(),FM(),Rst(),Uct(),(function(e){let t=new Map([[`Assert`,(e,t,n)=>(wat(e,t,n),n)],[`Cast`,(e,t,n)=>HM(e,t,n)],[`Clean`,(e,t,n)=>Yot(e,t,n)],[`Clone`,(e,t,n)=>PM(n)],[`Convert`,(e,t,n)=>Ist(e,t,n)],[`Decode`,(e,t,n)=>Ect(e,t)?Yst(e,t,n):n],[`Default`,(e,t,n)=>Vct(e,t,n)],[`Encode`,(e,t,n)=>Ect(e,t)?cct(e,t,n):n]]);function n(e){t.delete(e)}e.Delete=n;function r(e,n){t.set(e,n)}e.Set=r;function i(e){return t.get(e)}e.Get=i})(nlt||={})})),ilt=s((()=>{rlt()})),alt=s((()=>{Sat(),WM(),TM()})),olt=s((()=>{alt()})),slt=s((()=>{WD(),kat(),WM(),TM(),Zot(),FM(),Rst(),bot(),Act(),Uct(),Xct(),Qct(),$ct(),xM(),tlt(),ilt(),Wct(),Oct(),olt()})),aN,oN=s((()=>{slt(),aN=(e,t)=>HM(e,t)})),sN,cN=s((()=>{sN={document:{navigation:`x-scalar-navigation`},workspace:{colorMode:`x-scalar-color-mode`,sidebarWidth:`x-scalar-sidebar-width`,defaultClient:`x-scalar-default-client`,activeDocument:`x-scalar-active-document`,theme:`x-scalar-theme`}}})),clt,llt,ult=s((()=>{cM(),le(),clt=Z.Partial(Z.Object({"x-scalar-original-source-url":Z.String()})),llt=T({"x-scalar-original-source-url":E(x({typeComment:`Original document source url — when loaded from an external source.`}))},{typeName:`WorkspaceManagedExtensions`,typeComment:`Workspace-store-managed metadata extensions shared by OpenAPI and AsyncAPI documents.`})})),lN,dlt,uN,flt,plt,mlt,dN=s((()=>{cM(),le(),lN=Z.Object({name:Z.String(),value:Z.Union([Z.Object({description:Z.Optional(Z.String()),default:Z.String({default:``})}),Z.String()])}),dlt=T({name:x(),value:ie([T({description:E(x()),default:x()}),x()])},{typeName:`XScalarEnvVar`}),uN=Z.Object({description:Z.Optional(Z.String()),color:Z.String({default:`#FFFFFF`}),variables:Z.Array(lN)}),flt=T({description:E(x()),color:x({typeComment:`Color for the environment`}),variables:ne(dlt,{typeComment:`An array of variables`})},{typeName:`XScalarEnvironment`,typeComment:`A map of environments by name`}),plt=Z.Object({"x-scalar-environments":Z.Optional(Z.Record(Z.String(),uN))}),mlt=T({"x-scalar-environments":E(re(x(),flt))},{typeName:`XScalarEnvironments`,typeComment:`A record of environments by name`})})),hlt,glt,_lt=s((()=>{cM(),le(),hlt=Z.Object({"x-scalar-icon":Z.Optional(Z.String())}),glt=T({"x-scalar-icon":E(x())},{typeName:`XScalarIcon`,typeComment:`A custom icon representing the collection`})})),vlt,ylt,blt=s((()=>{cM(),le(),vlt=Z.Object({"x-scalar-is-dirty":Z.Optional(Z.Boolean())}),ylt=T({"x-scalar-is-dirty":E(S({typeComment:`Whether the document state is dirty, this is used to track if the document has been modified since it was last saved`}))},{typeName:`XScalarIsDirty`,typeComment:`Tracks whether the document has been modified since it was last saved`})})),xlt,Slt,Clt=s((()=>{cM(),le(),xlt=Z.Object({"x-scalar-original-document-hash":Z.String()}),Slt=T({"x-scalar-original-document-hash":x({typeComment:`Original input document hash`})},{typeName:`XScalarOriginalDocumentHash`,typeComment:`Original input document hash`})})),wlt,Tlt,Elt,Dlt,Olt=s((()=>{cM(),le(),wlt=Z.Object({namespace:Z.String(),slug:Z.String(),version:Z.String(),commitHash:Z.Optional(Z.String()),conflictCheckedAgainstHash:Z.Optional(Z.String()),hasConflict:Z.Optional(Z.Boolean())}),Tlt=Z.Object({"x-scalar-registry-meta":Z.Optional(wlt)}),Elt=T({namespace:x({typeComment:`The namespace under which this registry meta is scoped.`}),slug:x({typeComment:`A unique slug identifier for this registry meta within the namespace.`}),version:x({typeComment:`The version of the registry meta.`}),commitHash:E(x({typeComment:`Last known commit hash of this document. Is going to be used to track if the document has been modified since it was last saved.`})),conflictCheckedAgainstHash:E(x({typeComment:`Registry commit hash that the cached hasConflict flag was computed against. The cache is invalid when this no longer matches the registry hash.`})),hasConflict:E(S({typeComment:`Cached outcome of the last conflict check, valid only while conflictCheckedAgainstHash matches the registry hash.`}))},{typeName:`XScalarRegistryMetaInner`,typeComment:`Registry meta namespace and slug`}),Dlt=T({"x-scalar-registry-meta":E(Elt)},{typeName:`XScalarRegistryMeta`,typeComment:`The registry meta for the document`})})),klt,Alt,jlt=s((()=>{cM(),le(),klt=Z.Object({"x-scalar-watch-mode":Z.Optional(Z.Boolean())}),Alt=T({"x-scalar-watch-mode":E(S({typeComment:`Whether the document is in watch mode`}))},{typeName:`XScalarWatchMode`,typeComment:`Whether the document is in watch mode`})})),fN,pN,mN=s((()=>{cM(),le(),fN=Z.Object({"x-post-response":Z.Optional(Z.String())}),pN=T({"x-post-response":E(x({typeComment:`Script to run after a response is received`}))},{typeName:`XPostResponse`,typeComment:`Post-response script for an operation`})})),hN,gN,_N=s((()=>{cM(),le(),hN=Z.Object({"x-pre-request":Z.Optional(Z.String())}),gN=T({"x-pre-request":E(x())},{typeName:`XPreRequest`,typeComment:`Pre-request script to run before the request is sent.`})})),Mlt,Nlt,Plt=s((()=>{cM(),le(),Mlt=Z.Object({"x-scalar-active-environment":Z.Optional(Z.String())}),Nlt=T({"x-scalar-active-environment":E(x({typeComment:`The currently selected environment`}))},{typeName:`XScalarActiveEnvironment`,typeComment:`The currently selected environment`})})),vN,Flt,Ilt,Llt,yN=s((()=>{cM(),le(),vN=Z.Object({name:Z.String(),value:Z.String(),domain:Z.Optional(Z.String()),path:Z.Optional(Z.String()),isDisabled:Z.Optional(Z.Boolean())}),Flt=T({name:x({typeComment:`Defines the cookie name and its value.`}),value:x({typeComment:`Defines the cookie value.`}),domain:E(x({typeComment:`Allows this domain and all subdomains.`})),path:E(x({typeComment:`Restricts this cookie to requests that contain this path.`})),isDisabled:E(S({typeComment:`Indicates if the cookie is disabled.`}))},{typeName:`XScalarCookie`,typeComment:`A persisted cookie definition for the workspace`}),Ilt=Z.Object({"x-scalar-cookies":Z.Optional(Z.Array(vN))}),Llt=T({"x-scalar-cookies":E(ne(Flt,{typeComment:`Cookies persisted for the workspace`}))},{typeName:`XScalarCookies`,typeComment:`Persisted workspace cookies`})})),bN,xN,SN=s((()=>{cM(),le(),bN=Z.Object({"x-scalar-order":Z.Optional(Z.Array(Z.String()))}),xN=T({"x-scalar-order":E(ne(x()))},{typeName:`XScalarOrder`,typeComment:`Custom order for elements in the Scalar UI`})})),CN,wN,TN=s((()=>{cM(),le(),CN=Z.Object({"x-scalar-selected-server":Z.Optional(Z.String())}),wN=T({"x-scalar-selected-server":E(x({typeComment:`The URL of the currently selected server`}))},{typeName:`XScalarSelectedServer`,typeComment:`The URL of the currently selected server`})})),Rlt,zlt,Blt,Vlt,Hlt=s((()=>{cM(),le(),uM(),SN(),Rlt=lM(Z.Object({name:Z.String(),tags:Z.Array(Z.String())}),bN),zlt=ae([T({name:x({typeComment:`The group name.`}),tags:ne(x(),{typeComment:`List of tags to include in this group.`})},{typeName:`XTagGroupBase`}),xN],{typeName:`XTagGroup`,typeComment:`A tag group with optional custom ordering`}),Blt=Z.Object({"x-tagGroups":Z.Optional(Z.Array(Rlt))}),Vlt=T({"x-tagGroups":E(ne(zlt,{typeComment:`Tag groups for organizing tags in the UI`}))},{typeName:`XTagGroups`,typeComment:`Groups of tags for the OpenAPI document`})})),EN,Ult,DN=s((()=>{EN=[`delete`,`get`,`head`,`options`,`patch`,`post`,`put`,`trace`],Ult=Object.freeze(new Set(EN))})),ON,Wlt,kN,Glt,AN,jN,Klt,MN,NN,qlt,PN,FN,IN,LN,Jlt,Ylt,Xlt,RN,Zlt,zN,BN,VN,HN,UN,Qlt,$lt,eut,tut,WN,nut,GN=s((()=>{cM(),ON={ComponentsObject:`ComponentsObject`,SecurityRequirementObject:`SecurityRequirementObject`,TagObject:`TagObject`,CallbackObject:`CallbackObject`,PathsObject:`PathsObject`,PathItemObject:`PathItemObject`,OperationObject:`OperationObject`,SchemaObject:`SchemaObject`,EncodingObject:`EncodingObject`,HeaderObject:`HeaderObject`,MediaTypeObject:`MediaTypeObject`,ServerObject:`ServerObject`,ExternalDocumentationObject:`ExternalDocumentationObject`,InfoObject:`InfoObject`,ContactObject:`ContactObject`,LicenseObject:`LicenseObject`,ResponseObject:`ResponseObject`,ResponsesObject:`ResponsesObject`,ParameterObject:`ParameterObject`,ExampleObject:`ExampleObject`,RequestBodyObject:`RequestBodyObject`,SecuritySchemeObject:`SecuritySchemeObject`,SecuritySchemes:`SecuritySchemes`,LinkObject:`LinkObject`,XMLObject:`XMLObject`,DiscriminatorObject:`DiscriminatorObject`,OAuthFlowsObject:`OAuthFlowsObject`,ServerVariableObject:`ServerVariableObject`,TraversedDescriptionObject:`TraversedDescriptionObject`,TraversedOperationObject:`TraversedOperationObject`,TraversedSchemaObject:`TraversedSchemaObject`,TraversedWebhookObject:`TraversedWebhookObject`,TraversedTagObject:`TraversedTagObject`,TraversedEntryObject:`TraversedEntryObject`,TraversedDocumentObject:`TraversedDocumentObject`},Wlt=Z.Ref(ON.ComponentsObject),kN=Z.Ref(ON.SecurityRequirementObject),Glt=Z.Ref(ON.TagObject),AN=Z.Ref(ON.CallbackObject),jN=Z.Ref(ON.PathItemObject),Klt=Z.Ref(ON.PathsObject),MN=Z.Ref(ON.OperationObject),NN=Z.Ref(ON.SchemaObject),qlt=Z.Ref(ON.EncodingObject),PN=Z.Ref(ON.HeaderObject),FN=Z.Ref(ON.MediaTypeObject),IN=Z.Ref(ON.ServerObject),LN=Z.Ref(ON.ExternalDocumentationObject),Jlt=Z.Ref(ON.InfoObject),Ylt=Z.Ref(ON.ContactObject),Xlt=Z.Ref(ON.LicenseObject),RN=Z.Ref(ON.ResponseObject),Zlt=Z.Ref(ON.ResponsesObject),zN=Z.Ref(ON.ParameterObject),BN=Z.Ref(ON.ExampleObject),VN=Z.Ref(ON.RequestBodyObject),HN=Z.Ref(ON.SecuritySchemeObject),UN=Z.Ref(ON.LinkObject),Qlt=Z.Ref(ON.XMLObject),$lt=Z.Ref(ON.DiscriminatorObject),eut=Z.Ref(ON.OAuthFlowsObject),tut=Z.Ref(ON.ServerVariableObject),WN=Z.Ref(ON.TraversedEntryObject),nut=Z.Ref(ON.TraversedDocumentObject)})),KN,qN,JN,rut,YN,XN,ZN,QN,iut,aut,out=s((()=>{DN(),cM(),uM(),GN(),KN=Z.Object({id:Z.String(),title:Z.String()}),qN=lM(KN,Z.Object({type:Z.Literal(`document`),name:Z.String(),children:Z.Optional(Z.Array(WN)),icon:Z.Optional(Z.String())})),JN=lM(KN,Z.Object({type:Z.Literal(`text`),children:Z.Optional(Z.Array(WN))})),rut=lM(KN,Z.Object({type:Z.Literal(`example`),name:Z.String()})),YN=lM(KN,Z.Object({type:Z.Literal(`operation`),ref:Z.String(),method:Z.Union(EN.map(e=>Z.Literal(e))),path:Z.String(),isDeprecated:Z.Optional(Z.Boolean()),children:Z.Optional(Z.Array(WN))})),XN=lM(KN,Z.Object({type:Z.Literal(`model`),ref:Z.String(),name:Z.String()})),ZN=lM(KN,Z.Object({type:Z.Literal(`webhook`),ref:Z.String(),method:Z.Union(EN.map(e=>Z.Literal(e))),name:Z.String(),isDeprecated:Z.Optional(Z.Boolean())})),QN=lM(KN,Z.Object({type:Z.Literal(`tag`),name:Z.String(),description:Z.Optional(Z.String()),children:Z.Optional(Z.Array(WN)),isGroup:Z.Boolean(),isWebhooks:Z.Optional(Z.Boolean()),xKeys:Z.Optional(Z.Record(Z.String(),Z.Unknown()))})),iut=lM(KN,Z.Object({type:Z.Literal(`models`),name:Z.String(),children:Z.Optional(Z.Array(WN))})),aut=Z.Union([JN,YN,XN,QN,ZN,rut,qN,iut])})),sut,$N,eP,tP=s((()=>{cM(),uM(),sut=Z.Object({$status:Z.Optional(Z.Union([Z.Literal(`loading`),Z.Literal(`error`)])),$global:Z.Optional(Z.Boolean())}),$N=lM(Z.Object({$ref:Z.String(),summary:Z.Optional(Z.String()),description:Z.Optional(Z.String())}),sut),eP=e=>lM($N,Z.Object({"$ref-value":e}))})),cut,lut=s((()=>{cM(),GN(),tP(),cut=Z.Record(Z.String(),Z.Union([jN,eP(jN)]))})),nP,uut,dut=s((()=>{cM(),GN(),tP(),nP=Z.Record(Z.String(),Z.Union([HN,eP(HN)])),uut=Z.Object({schemas:Z.Optional(Z.Record(Z.String(),Z.Union([NN,eP(NN)]))),responses:Z.Optional(Z.Record(Z.String(),Z.Union([RN,eP(RN)]))),parameters:Z.Optional(Z.Record(Z.String(),Z.Union([zN,eP(zN)]))),examples:Z.Optional(Z.Record(Z.String(),Z.Union([BN,eP(BN)]))),requestBodies:Z.Optional(Z.Record(Z.String(),Z.Union([VN,eP(VN)]))),headers:Z.Optional(Z.Record(Z.String(),Z.Union([PN,eP(PN)]))),securitySchemes:Z.Optional(nP),links:Z.Optional(Z.Record(Z.String(),Z.Union([UN,eP(UN)]))),callbacks:Z.Optional(Z.Record(Z.String(),Z.Union([AN,eP(AN)]))),pathItems:Z.Optional(Z.Record(Z.String(),jN))})})),fut,put=s((()=>{cM(),fut=Z.Object({name:Z.Optional(Z.String()),url:Z.Optional(Z.String()),email:Z.Optional(Z.String())})})),mut,hut=s((()=>{cM(),mut=Z.Object({propertyName:Z.String(),mapping:Z.Optional(Z.Record(Z.String(),Z.String()))})})),gut,_ut=s((()=>{cM(),GN(),tP(),gut=Z.Object({contentType:Z.Optional(Z.String()),headers:Z.Optional(Z.Record(Z.String(),Z.Union([PN,eP(PN)])))})})),vut,yut,but=s((()=>{cM(),le(),vut=Z.Object({"x-disabled":Z.Optional(Z.Boolean())}),yut=T({"x-disabled":E(S())},{typeName:`XDisabled`,typeComment:`Whether a parameter example is disabled in the API client`})})),xut,Sut=s((()=>{cM(),uM(),but(),xut=lM(Z.Object({summary:Z.Optional(Z.String()),description:Z.Optional(Z.String()),value:Z.Optional(Z.Any()),externalValue:Z.Optional(Z.String())}),vut)})),Cut,wut=s((()=>{cM(),Cut=Z.Object({url:Z.String(),description:Z.Optional(Z.String())})})),rP,Tut,Eut,Dut=s((()=>{cM(),uM(),GN(),tP(),rP=Z.Object({description:Z.Optional(Z.String()),required:Z.Optional(Z.Boolean()),deprecated:Z.Optional(Z.Boolean())}),Tut=lM(rP,Z.Object({style:Z.Optional(Z.String()),explode:Z.Optional(Z.Boolean()),schema:Z.Optional(Z.Union([NN,eP(NN)])),example:Z.Optional(Z.Any()),examples:Z.Optional(Z.Record(Z.String(),Z.Union([BN,eP(BN)])))})),Eut=Z.Union([Tut,lM(rP,Z.Object({content:Z.Optional(Z.Record(Z.String(),FN))}))])})),Out,kut,Aut,jut,Mut=s((()=>{cM(),le(),Out=Z.Object({lang:Z.String(),source:Z.Optional(Z.String()),description:Z.Optional(Z.String())}),kut=Z.Object({"x-scalar-sdk-installation":Z.Optional(Z.Array(Out))}),Aut=T({lang:x(),source:E(x()),description:E(x())},{typeName:`XScalarSdkInstallationItem`,typeComment:`Scalar SDK installation entry`}),jut=T({"x-scalar-sdk-installation":E(ne(Aut,{typeComment:`Scalar SDK installation information`}))},{typeName:`XScalarSdkInstallation`,typeComment:`Scalar SDK installation information`})})),Nut,Put=s((()=>{cM(),uM(),Mut(),GN(),Nut=lM(Z.Object({title:Z.String(),version:Z.String(),summary:Z.Optional(Z.String()),description:Z.Optional(Z.String()),termsOfService:Z.Optional(Z.String()),contact:Z.Optional(Ylt),license:Z.Optional(Xlt)}),kut)})),Fut,Iut=s((()=>{cM(),Fut=Z.Object({name:Z.Optional(Z.String()),identifier:Z.Optional(Z.String()),url:Z.Optional(Z.String())})})),Lut,Rut=s((()=>{cM(),GN(),Lut=Z.Object({operationRef:Z.Optional(Z.String()),operationId:Z.Optional(Z.String()),parameters:Z.Optional(Z.Record(Z.String(),Z.Any())),requestBody:Z.Optional(Z.Any()),description:Z.Optional(Z.String()),server:Z.Optional(IN)})})),zut,But=s((()=>{cM(),GN(),tP(),zut=Z.Object({schema:Z.Optional(Z.Union([NN,eP(NN)])),example:Z.Optional(Z.Any()),examples:Z.Optional(Z.Record(Z.String(),Z.Union([BN,eP(BN)]))),encoding:Z.Optional(Z.Record(Z.String(),qlt))})})),iP,aP,oP=s((()=>{cM(),le(),iP=Z.Object({"x-scalar-credentials-location":Z.Optional(Z.Union([Z.Literal(`header`),Z.Literal(`body`)]))}),aP=T({"x-scalar-credentials-location":E(ie([D(`header`),D(`body`)]))},{typeName:`XScalarCredentialsLocation`,typeComment:`Where OAuth2 credentials are sent`})})),Vut,Hut,Uut=s((()=>{cM(),le(),Vut=Z.Object({"x-scalar-security-body":Z.Optional(Z.Record(Z.String(),Z.String()))}),Hut=T({"x-scalar-security-body":E(re(x(),x()))},{typeName:`XScalarSecurityBody`,typeComment:`Additional OAuth token request body parameters`})})),Wut,Gut,Kut=s((()=>{cM(),le(),Wut=Z.Object({"x-scalar-security-query":Z.Optional(Z.Record(Z.String(),Z.String()))}),Gut=T({"x-scalar-security-query":E(re(x(),x()))},{typeName:`XScalarSecurityQuery`,typeComment:`Additional OAuth authorize query parameters`})})),sP,qut,Jut,Yut,Xut,Zut,cP,lP,Qut,uP,dP=s((()=>{cM(),le(),sP=Z.Object({"x-scalar-secret-token":Z.String()}),T({"x-scalar-secret-token":x()},{typeName:`XScalarSecretToken`,typeComment:`Persisted OAuth access token (sensitive)`}),qut=Z.Object({"x-scalar-secret-refresh-token":Z.Optional(Z.String())}),T({"x-scalar-secret-refresh-token":E(x())},{typeName:`XScalarSecretRefreshToken`,typeComment:`Persisted OAuth refresh token (sensitive)`}),Jut=Z.Object({"x-scalar-secret-auth-url":Z.Optional(Z.String())}),Yut=T({"x-scalar-secret-auth-url":E(x())},{typeName:`XScalarAuthUrl`,typeComment:`Persisted OAuth authorization URL override`}),Xut=Z.Object({"x-scalar-secret-token-url":Z.Optional(Z.String())}),Zut=T({"x-scalar-secret-token-url":E(x())},{typeName:`XScalarTokenUrl`,typeComment:`Persisted OAuth token URL override`}),cP=Z.Object({"x-scalar-secret-username":Z.String(),"x-scalar-secret-password":Z.String()}),T({"x-scalar-secret-username":x(),"x-scalar-secret-password":x()},{typeName:`XScalarSecretHTTP`,typeComment:`Persisted HTTP basic credentials (sensitive)`}),lP=Z.Object({"x-scalar-secret-client-secret":Z.String()}),T({"x-scalar-secret-client-secret":x()},{typeName:`XScalarSecretClientSecret`,typeComment:`Persisted OAuth client secret (sensitive)`}),Qut=Z.Object({"x-scalar-secret-client-id":Z.String()}),T({"x-scalar-secret-client-id":x()},{typeName:`XScalarSecretClientId`,typeComment:`Persisted OAuth client ID`}),uP=Z.Object({"x-scalar-secret-redirect-uri":Z.String()}),T({"x-scalar-secret-redirect-uri":x()},{typeName:`XScalarSecretRedirectUri`,typeComment:`Persisted OAuth redirect URI`})})),$ut,edt,tdt=s((()=>{cM(),le(),$ut=Z.Object({"x-tokenName":Z.Optional(Z.String())}),edt=T({"x-tokenName":E(x())},{typeName:`XTokenName`,typeComment:`Custom OAuth2 access token field name`})})),ndt,rdt,idt=s((()=>{cM(),le(),ndt=Z.Object({"x-usePkce":Z.Union([Z.Literal(`SHA-256`),Z.Literal(`plain`),Z.Literal(`no`)],{default:`no`})}),rdt=T({"x-usePkce":ie([D(`SHA-256`),D(`plain`),D(`no`)],{typeComment:`PKCE mode for the OAuth2 authorization code flow`})},{typeName:`XusePkce`,typeComment:`PKCE setting for OAuth2`})})),fP,pP,mP,hP,gP,adt=s((()=>{cM(),uM(),oP(),Uut(),Kut(),dP(),tdt(),idt(),fP=lM(Z.Object({refreshUrl:Z.String(),scopes:Z.Record(Z.String(),Z.String())}),Wut,Vut,$ut,Jut,Xut),pP=lM(fP,Z.Object({authorizationUrl:Z.String()})),mP=lM(fP,Z.Object({tokenUrl:Z.String()}),iP),hP=lM(fP,Z.Object({tokenUrl:Z.String()}),iP),gP=lM(fP,Z.Object({authorizationUrl:Z.String(),tokenUrl:Z.String()}),ndt,iP)})),odt,sdt=s((()=>{cM(),adt(),odt=Z.Object({implicit:Z.Optional(pP),password:Z.Optional(mP),clientCredentials:Z.Optional(hP),authorizationCode:Z.Optional(gP)})})),_P,vP,yP=s((()=>{cM(),le(),_P=Z.Object({"x-internal":Z.Optional(Z.Boolean())}),vP=T({"x-internal":E(S({typeComment:`Extension to mark an entity as internal`}))},{typeName:`XInternal`,typeComment:`Extension to mark an entity as internal`})})),bP,xP,SP=s((()=>{cM(),le(),bP=Z.Object({"x-scalar-ignore":Z.Optional(Z.Boolean())}),xP=T({"x-scalar-ignore":E(S())},{typeName:`XScalarIgnore`,typeComment:`Internal extension to mark an entity as ignored`})})),cdt,ldt,udt,ddt,CP=s((()=>{cM(),le(),cdt=Z.Object({name:Z.String({description:`The text that displays in the badge`,minLength:1}),position:Z.Optional(Z.Union([Z.Literal(`before`),Z.Literal(`after`)],{description:`The position of the badge in relation to the header`,default:`after`})),color:Z.Optional(Z.String({description:`The color of the badge in various formats (keywords, RGB, RGBA, HSL, HSLA, Hexadecimal)`,pattern:`^(#([0-9A-Fa-f]{3}){1,2}|rgb\\(\\s*\\d+\\s*,\\s*\\d+\\s*,\\s*\\d+\\s*\\)|rgba\\(\\s*\\d+\\s*,\\s*\\d+\\s*,\\s*\\d+\\s*,\\s*[0-9.]*\\s*\\)|hsl\\(\\s*\\d+\\s*,\\s*\\d+%\\s*,\\s*\\d+%\\s*\\)|hsla\\(\\s*\\d+\\s*,\\s*\\d+%\\s*,\\s*\\d+%\\s*,\\s*[0-9.]*\\s*\\)|[a-zA-Z]+)$`}))},{description:`Configuration for a single badge in the x-badges extension`}),ldt=T({name:x({typeComment:`The text that displays in the badge. This is required for all badges.`}),position:E(ie([D(`before`),D(`after`)],{typeComment:`The position of the badge in relation to the header`})),color:E(x({typeComment:`The color of the badge in various formats (keywords, RGB, RGBA, HSL, HSLA, Hexadecimal)`}))},{typeName:`XBadge`,typeComment:`Configuration for a single badge in the x-badges extension`}),udt=Z.Object({"x-badges":Z.Optional(Z.Array(cdt))}),ddt=T({"x-badges":E(ne(ldt,{typeComment:`Badges displayed for this operation in documentation`}))},{typeName:`XBadges`,typeComment:`Badges for an operation in the Scalar UI`})})),wP,fdt,TP,pdt,EP=s((()=>{cM(),le(),wP=Z.Object({lang:Z.Optional(Z.String()),label:Z.Optional(Z.String()),source:Z.String()}),fdt=Z.Object({"x-codeSamples":Z.Optional(Z.Array(wP)),"x-code-samples":Z.Optional(Z.Array(wP)),"x-custom-examples":Z.Optional(Z.Array(wP))}),TP=T({lang:E(x()),label:E(x()),source:x()},{typeName:`XCodeSample`,typeComment:`A single code sample for documentation or examples`}),pdt=T({"x-codeSamples":E(ne(TP)),"x-code-samples":E(ne(TP)),"x-custom-examples":E(ne(TP))},{typeName:`XCodeSamples`,typeComment:`Code samples attached to an operation`})})),mdt,hdt,gdt=s((()=>{cM(),le(),mdt=Z.Object({"x-draft-examples":Z.Optional(Z.Array(Z.String()))}),hdt=T({"x-draft-examples":E(ne(x()))},{typeName:`XDraftExamples`,typeComment:`Draft example identifiers for an operation`})})),_dt,DP,vdt,ydt,OP,bdt,xdt,Sdt=s((()=>{cM(),le(),_dt=Z.Record(Z.String(),Z.Boolean()),DP=Z.Record(Z.String(),_dt),vdt=Z.Object({"x-scalar-disable-parameters":Z.Optional(Z.Object({"global-cookies":Z.Optional(DP),"global-headers":Z.Optional(DP),"default-headers":Z.Optional(DP)}))}),ydt=re(x(),S()),OP=re(x(),ydt),bdt=T({"global-cookies":E(OP),"global-headers":E(OP),"default-headers":E(OP)},{typeName:`DisableParametersConfig`,typeComment:`Disabled parameter state by category and example`}),xdt=T({"x-scalar-disable-parameters":E(bdt)},{typeName:`XScalarDisableParameters`,typeComment:`Tracks which parameters are disabled across examples`})})),Cdt,wdt,Tdt,kP=s((()=>{cM(),le(),Cdt={Deprecated:`deprecated`,Experimental:`experimental`,Stable:`stable`},wdt=Z.Object({"x-scalar-stability":Z.Optional(Z.Union([Z.Literal(`deprecated`),Z.Literal(`experimental`),Z.Literal(`stable`)]))}),Tdt=T({"x-scalar-stability":E(ie([D(`deprecated`),D(`experimental`),D(`stable`)],{typeComment:`Stability level of the operation`}))},{typeName:`XScalarStability`,typeComment:`Stability of the operation in the Scalar UI`})})),Edt,Ddt=s((()=>{cM(),uM(),yP(),SP(),mN(),_N(),CP(),EP(),gdt(),Sdt(),kP(),TN(),GN(),tP(),Edt=lM(Z.Object({tags:Z.Optional(Z.Array(Z.String())),summary:Z.Optional(Z.String()),description:Z.Optional(Z.String()),externalDocs:Z.Optional(LN),operationId:Z.Optional(Z.String()),parameters:Z.Optional(Z.Array(Z.Union([zN,eP(zN)]))),requestBody:Z.Optional(Z.Union([VN,eP(VN)])),responses:Z.Optional(Zlt),deprecated:Z.Optional(Z.Boolean()),security:Z.Optional(Z.Array(kN)),servers:Z.Optional(Z.Array(IN)),callbacks:Z.Optional(Z.Record(Z.String(),Z.Union([AN,eP(AN)])))}),udt,_P,bP,fdt,wdt,vdt,fN,hN,mdt,CN)})),Odt,AP,kdt=s((()=>{cM(),le(),Odt=Z.Object({"x-global":Z.Optional(Z.Boolean())}),AP=T({"x-global":E(S())},{typeName:`XGlobal`,typeComment:`When true, the parameter is injected into every request for the workspace`})})),jP,Adt,jdt,Mdt,Ndt=s((()=>{cM(),uM(),yP(),SP(),kdt(),GN(),tP(),jP=lM(Z.Object({name:Z.String(),in:Z.Union([Z.Literal(`query`),Z.Literal(`header`),Z.Literal(`path`),Z.Literal(`cookie`)]),description:Z.Optional(Z.String()),required:Z.Optional(Z.Boolean()),deprecated:Z.Optional(Z.Boolean()),allowEmptyValue:Z.Optional(Z.Boolean()),allowReserved:Z.Optional(Z.Boolean())}),Odt,_P,bP),Adt=lM(jP,Z.Object({style:Z.Optional(Z.String()),explode:Z.Optional(Z.Boolean()),schema:Z.Optional(Z.Union([NN,eP(NN)])),example:Z.Optional(Z.Any()),examples:Z.Optional(Z.Record(Z.String(),Z.Union([BN,eP(BN)])))})),jdt=lM(jP,Z.Object({content:Z.Optional(Z.Record(Z.String(),FN))})),Mdt=Z.Union([Adt,jdt])})),Pdt,Fdt=s((()=>{cM(),GN(),tP(),Pdt=Z.Object({$ref:Z.Optional(Z.String()),summary:Z.Optional(Z.String()),description:Z.Optional(Z.String()),get:Z.Optional(Z.Union([MN,eP(MN)])),put:Z.Optional(Z.Union([MN,eP(MN)])),post:Z.Optional(Z.Union([MN,eP(MN)])),delete:Z.Optional(Z.Union([MN,eP(MN)])),patch:Z.Optional(Z.Union([MN,eP(MN)])),connect:Z.Optional(Z.Union([MN,eP(MN)])),options:Z.Optional(Z.Union([MN,eP(MN)])),head:Z.Optional(Z.Union([MN,eP(MN)])),trace:Z.Optional(Z.Union([MN,eP(MN)])),servers:Z.Optional(Z.Array(IN)),parameters:Z.Optional(Z.Array(Z.Union([zN,eP(zN)])))})})),Idt,Ldt=s((()=>{cM(),GN(),Idt=Z.Record(Z.String(),jN)})),Rdt,zdt,MP=s((()=>{cM(),le(),Rdt=Z.Object({"x-scalar-selected-content-type":Z.Optional(Z.Record(Z.String(),Z.String()))}),zdt=T({"x-scalar-selected-content-type":E(re(x(),x(),{typeComment:`Selected content type per example name`}))},{typeName:`XScalarSelectedContentType`,typeComment:`Selected content type per example for request or response bodies`})})),Bdt,Vdt=s((()=>{cM(),uM(),MP(),GN(),Bdt=lM(Z.Object({description:Z.Optional(Z.String()),content:Z.Record(Z.String(),FN),required:Z.Optional(Z.Boolean())}),Rdt)})),Hdt,Udt=s((()=>{cM(),GN(),tP(),Hdt=Z.Object({description:Z.String(),headers:Z.Optional(Z.Record(Z.String(),Z.Union([PN,eP(PN)]))),content:Z.Optional(Z.Record(Z.String(),FN)),links:Z.Optional(Z.Record(Z.String(),Z.Union([UN,eP(UN)])))})})),Wdt,Gdt=s((()=>{cM(),GN(),tP(),Wdt=Z.Record(Z.String(),Z.Union([RN,eP(RN)]))})),Kdt,qdt,Jdt=s((()=>{cM(),le(),Kdt=Z.Object({"x-tags":Z.Optional(Z.Array(Z.String()))}),qdt=T({"x-tags":E(ne(x()))},{typeName:`XTags`,typeComment:`Custom tag ordering or grouping hints for schema objects`})})),Ydt,Xdt,Zdt=s((()=>{cM(),le(),Ydt=Z.Object({"x-additionalPropertiesName":Z.Optional(Z.String())}),Xdt=T({"x-additionalPropertiesName":E(x())},{typeName:`XAdditionalPropertiesName`,typeComment:`Display name for additional properties on a schema`})})),Qdt,NP,$dt,eft=s((()=>{cM(),le(),Qdt=Z.Object({"x-enumDescriptions":Z.Optional(Z.Union([Z.Record(Z.String(),Z.String()),Z.Array(Z.String())])),"x-enum-descriptions":Z.Optional(Z.Union([Z.Record(Z.String(),Z.String()),Z.Array(Z.String())]))}),NP=ie([re(x(),x()),ne(x())]),$dt=T({"x-enumDescriptions":E(NP),"x-enum-descriptions":E(NP)},{typeName:`XEnumDescriptions`,typeComment:`Descriptions for enum values`})})),tft,nft,rft=s((()=>{cM(),le(),tft=Z.Object({"x-enum-varnames":Z.Optional(Z.Array(Z.String())),"x-enumNames":Z.Optional(Z.Array(Z.String()))}),nft=T({"x-enum-varnames":E(ne(x())),"x-enumNames":E(ne(x()))},{typeName:`XEnumVarNames`,typeComment:`Display names for enum values`})})),ift,aft,oft=s((()=>{cM(),le(),ift=Z.Object({"x-examples":Z.Optional(Z.Record(Z.String(),Z.Unknown()))}),aft=T({"x-examples":E(re(x(),w()))},{typeName:`XExamples`,typeComment:`Named examples attached to a schema`})})),sft,cft,lft=s((()=>{cM(),le(),sft=Z.Object({"x-variable":Z.Optional(Z.String())}),cft=T({"x-variable":E(x())},{typeName:`XVariable`,typeComment:`Variable reference for a schema property`})})),PP,uft,FP,IP,dft,fft,pft,mft,hft,gft=s((()=>{cM(),uM(),yP(),SP(),Jdt(),Zdt(),eft(),rft(),oft(),lft(),GN(),tP(),PP=Z.Union([NN,lM($N,Z.Object({"$ref-value":Z.Unknown()}))]),uft=Z.Object({type:Z.Union([Z.Literal(`null`),Z.Literal(`boolean`),Z.Array(Z.Union([Z.Literal(`null`),Z.Literal(`boolean`),Z.Literal(`string`),Z.Literal(`number`),Z.Literal(`integer`),Z.Literal(`object`),Z.Literal(`array`)]))])}),FP=lM(bP,_P,sft,ift,Qdt,tft,Ydt,Kdt),IP=Z.Object({name:Z.Optional(Z.String()),title:Z.Optional(Z.String()),description:Z.Optional(Z.String()),default:Z.Optional(Z.Unknown()),enum:Z.Optional(Z.Array(Z.Unknown())),const:Z.Optional(Z.Unknown()),contentMediaType:Z.Optional(Z.String()),contentEncoding:Z.Optional(Z.String()),contentSchema:Z.Optional(PP),deprecated:Z.Optional(Z.Boolean()),discriminator:Z.Optional($lt),readOnly:Z.Optional(Z.Boolean()),writeOnly:Z.Optional(Z.Boolean()),xml:Z.Optional(Qlt),externalDocs:Z.Optional(LN),example:Z.Optional(Z.Unknown()),examples:Z.Optional(Z.Array(Z.Unknown())),allOf:Z.Optional(Z.Array(PP)),oneOf:Z.Optional(Z.Array(PP)),anyOf:Z.Optional(Z.Array(PP)),not:Z.Optional(PP)}),dft=Z.Object({type:Z.Union([Z.Literal(`number`),Z.Literal(`integer`)]),format:Z.Optional(Z.String()),multipleOf:Z.Optional(Z.Number()),maximum:Z.Optional(Z.Number()),exclusiveMaximum:Z.Optional(Z.Number({minimum:0})),minimum:Z.Optional(Z.Number()),exclusiveMinimum:Z.Optional(Z.Number({minimum:0}))}),fft=Z.Object({type:Z.Literal(`string`),format:Z.Optional(Z.String()),maxLength:Z.Optional(Z.Integer({minimum:0})),minLength:Z.Optional(Z.Integer({minimum:0})),pattern:Z.Optional(Z.String())}),pft=Z.Object({type:Z.Literal(`array`),maxItems:Z.Optional(Z.Integer({minimum:0})),minItems:Z.Optional(Z.Integer({minimum:0})),uniqueItems:Z.Optional(Z.Boolean()),items:Z.Optional(PP),prefixItems:Z.Optional(Z.Array(PP))}),mft=Z.Object({type:Z.Literal(`object`),maxProperties:Z.Optional(Z.Integer({minimum:0})),minProperties:Z.Optional(Z.Integer({minimum:0})),required:Z.Optional(Z.Array(Z.String())),properties:Z.Optional(Z.Record(Z.String(),PP)),additionalProperties:Z.Optional(Z.Union([Z.Boolean(),PP])),patternProperties:Z.Optional(Z.Record(Z.String(),PP)),propertyNames:Z.Optional(PP)}),hft=Z.Union([lM(Z.Object({__scalar_:Z.String()}),IP,FP),lM(uft,IP,FP),lM(dft,IP,FP),lM(fft,IP,FP),lM(mft,IP,FP),lM(pft,IP,FP)])})),_ft,vft=s((()=>{cM(),_ft=Z.Partial(Z.Record(Z.String(),Z.Array(Z.String())))})),yft,bft,xft=s((()=>{cM(),le(),yft=Z.Object({"x-default-scopes":Z.Optional(Z.Array(Z.String()))}),bft=T({"x-default-scopes":E(ne(x()))},{typeName:`XDefaultScopes`,typeComment:`Default selected OAuth scopes`})})),LP,Sft,Cft,wft,Tft,Eft,Dft=s((()=>{cM(),uM(),xft(),GN(),LP=Z.Object({description:Z.Optional(Z.String())}),Sft=lM(LP,Z.Object({type:Z.Literal(`apiKey`),name:Z.String(),in:Z.Union([Z.Literal(`query`),Z.Literal(`header`),Z.Literal(`cookie`)])})),Cft=lM(LP,Z.Object({type:Z.Literal(`http`),scheme:Z.Union([Z.Literal(`basic`),Z.Literal(`bearer`)]),bearerFormat:Z.Optional(Z.String())})),wft=lM(LP,Z.Object({type:Z.Literal(`oauth2`),flows:eut}),yft),Tft=lM(LP,Z.Object({type:Z.Literal(`openIdConnect`),openIdConnectUrl:Z.String()})),Eft=Z.Union([Sft,Cft,wft,Tft])})),Oft,kft=s((()=>{cM(),GN(),Oft=Z.Object({url:Z.String(),description:Z.Optional(Z.String()),variables:Z.Optional(Z.Record(Z.String(),tut))})})),Aft,jft=s((()=>{cM(),Aft=Z.Object({enum:Z.Optional(Z.Array(Z.String())),default:Z.Optional(Z.String()),description:Z.Optional(Z.String())})})),Mft,Nft,Pft=s((()=>{cM(),le(),Mft=Z.Object({"x-displayName":Z.Optional(Z.String())}),Nft=T({"x-displayName":E(x())},{typeName:`XDisplayName`,typeComment:`Display-friendly name for a tag`})})),Fft,Ift=s((()=>{cM(),uM(),yP(),SP(),SN(),Pft(),GN(),Fft=lM(Z.Object({name:Z.String(),description:Z.Optional(Z.String()),externalDocs:Z.Optional(LN)}),Mft,_P,bP,bN)})),Lft,Rft=s((()=>{cM(),Lft=Z.Object({name:Z.Optional(Z.String()),namespace:Z.Optional(Z.String()),prefix:Z.Optional(Z.String()),attribute:Z.Optional(Z.Boolean()),wrapped:Z.Optional(Z.Boolean())})})),zft,Bft,RP,zP,Vft,Hft,BP,Uft,VP=s((()=>{cM(),uM(),cN(),ult(),dN(),_lt(),blt(),Clt(),Olt(),jlt(),mN(),_N(),Plt(),yN(),SN(),TN(),Hlt(),out(),lut(),dut(),put(),hut(),_ut(),Sut(),wut(),Dut(),Put(),Iut(),Rut(),But(),sdt(),Ddt(),Ndt(),Fdt(),Ldt(),GN(),Vdt(),Udt(),Gdt(),gft(),vft(),Dft(),kft(),jft(),Ift(),Rft(),zft=lM(Z.Partial(Z.Object({"x-original-oas-version":Z.String(),[sN.document.navigation]:nut})),clt,Blt,plt,CN,hlt,bN,Ilt,xlt,vlt,Mlt,klt,Tlt,hN,fN),Bft=lM(Z.Object({openapi:Z.String(),info:Jlt,jsonSchemaDialect:Z.Optional(Z.String()),servers:Z.Optional(Z.Array(IN)),paths:Z.Optional(Klt),webhooks:Z.Optional(Z.Record(Z.String(),jN)),components:Z.Optional(Wlt),security:Z.Optional(Z.Array(kN)),tags:Z.Optional(Z.Array(Glt)),externalDocs:Z.Optional(LN)}),zft),RP=Z.Module({[ON.ComponentsObject]:uut,[ON.SecurityRequirementObject]:_ft,[ON.TagObject]:Fft,[ON.CallbackObject]:cut,[ON.PathItemObject]:Pdt,[ON.PathsObject]:Idt,[ON.OperationObject]:Edt,[ON.SchemaObject]:hft,[ON.EncodingObject]:gut,[ON.MediaTypeObject]:zut,[ON.HeaderObject]:Eut,[ON.ServerObject]:Oft,[ON.ExternalDocumentationObject]:Cut,[ON.InfoObject]:Nut,[ON.ContactObject]:fut,[ON.LicenseObject]:Fut,[ON.ResponseObject]:Hdt,[ON.ResponsesObject]:Wdt,[ON.ParameterObject]:Mdt,[ON.ExampleObject]:xut,[ON.RequestBodyObject]:Bdt,[ON.SecuritySchemes]:nP,[ON.SecuritySchemeObject]:Eft,[ON.LinkObject]:Lut,[ON.XMLObject]:Lft,[ON.DiscriminatorObject]:mut,[ON.OAuthFlowsObject]:odt,[ON.ServerVariableObject]:Aft,OpenApiDocument:Bft,[ON.TraversedDescriptionObject]:JN,[ON.TraversedOperationObject]:YN,[ON.TraversedSchemaObject]:XN,[ON.TraversedWebhookObject]:ZN,[ON.TraversedTagObject]:QN,[ON.TraversedEntryObject]:aut,[ON.TraversedDocumentObject]:qN}),zP=RP.Import(`OpenApiDocument`),RP.Import(`ComponentsObject`),Vft=RP.Import(`SecurityRequirementObject`),RP.Import(`TagObject`),RP.Import(`CallbackObject`),RP.Import(`PathItemObject`),RP.Import(`PathsObject`),RP.Import(`OperationObject`),Hft=RP.Import(`SchemaObject`),RP.Import(`EncodingObject`),RP.Import(`MediaTypeObject`),RP.Import(`HeaderObject`),BP=RP.Import(`ServerObject`),RP.Import(`ExternalDocumentationObject`),RP.Import(`InfoObject`),RP.Import(`ContactObject`),RP.Import(`LicenseObject`),RP.Import(`ResponseObject`),RP.Import(`ResponsesObject`),RP.Import(`ParameterObject`),RP.Import(`ExampleObject`),RP.Import(`RequestBodyObject`),RP.Import(`SecuritySchemes`),Uft=RP.Import(`SecuritySchemeObject`),RP.Import(`LinkObject`),RP.Import(`XMLObject`),RP.Import(`DiscriminatorObject`),RP.Import(`OAuthFlowsObject`),RP.Import(`ServerVariableObject`),RP.Import(`TraversedDescriptionObject`),RP.Import(`TraversedEntryObject`),RP.Import(`TraversedTagObject`),RP.Import(`TraversedOperationObject`),RP.Import(`TraversedSchemaObject`),RP.Import(`TraversedWebhookObject`)})),HP,UP=s((()=>{cM(),zE(),uM(),oN(),VP(),HP={schema:e=>{if(e===void 0)return;let t=RE(e,LE);return aN(lM(Hft,Z.Object({$ref:Z.Optional(Z.String())})),t)}}})),WP,Wft,GP,Gft,Kft,qft,Jft,KP,qP,JP,YP,Yft,XP,Xft,Zft,ZP,Qft,QP,$P,eF,tF,nF,$ft,ept,rF,tpt,npt,rpt,ipt,apt,iF,opt=s((()=>{ME(),dD(),UP(),WP=10,Wft=`additionalProperty`,GP=new Date().toISOString(),Gft=GP.split(`T`)[0],Kft=GP.split(`T`)[1].split(`.`)[0],qft={"date-time":GP,date:Gft,email:`hello@example.com`,hostname:`example.com`,"idn-email":`jane.doe@example.com`,"idn-hostname":`example.com`,ipv4:`127.0.0.1`,ipv6:`51d4:7fab:bfbf:b7d7:b2cb:d4b4:3dad:d998`,"iri-reference":`/entitiy/1`,iri:`https://example.com/entity/123`,"json-pointer":`/nested/objects`,password:`super-secret`,regex:`/[a-z]/`,"relative-json-pointer":`1/nested/objects`,time:Kft,"uri-reference":`../folder`,"uri-template":`https://example.com/{id}`,uri:`https://example.com`,uuid:`123e4567-e89b-12d3-a456-426614174000`,"object-id":`6592008029c8c3e4dc76256c`},Jft=e=>{if(!(`propertyNames`in e)||!e.propertyNames)return;let t=HP.schema(e.propertyNames);if(t&&`enum`in t&&Array.isArray(t.enum)&&t.enum.length>0)return t.enum},KP=(e,t=!1,n=``)=>`type`in e&&e.type===`string`&&`format`in e&&e.format===`binary`?`@filename`:t&&`format`in e&&e.format?qft[e.format]??n:n,qP=new WeakMap,JP=new WeakMap,YP=e=>uD(e,{depth:1}),Yft=e=>{if(!e)return;let t=JP.get(e);if(t)return t;if(`required`in e){let t=e.required;if(Array.isArray(t)&&t.length>0){let n=new Set(t);return JP.set(e,n),n}}},XP=(e,t,n)=>{if(typeof t!=`object`||!t)return t;let r=YP(e),i=qP.get(r)??new Map;return i&&i.set(n,t),qP.set(r,i),t},Xft=e=>!!(e.allOf||e.oneOf||e.anyOf),Zft=(e,t,n,r)=>{if(e.deprecated||r?.mode===`write`&&e.readOnly||r?.mode===`read`&&e.writeOnly)return!0;if(r?.omitEmptyAndOptionalProperties!==!0||`type`in e&&(e.type===`object`||e.type===`array`)||Xft(e)||`examples`in e&&Array.isArray(e.examples)&&e.examples.length>0||`example`in e&&e.example!==void 0||`default`in e&&e.default!==void 0||`const`in e&&e.const!==void 0||`enum`in e&&Array.isArray(e.enum)&&e.enum.length>0)return!1;let i=n??e.title??``,a=Yft(t);return!(a&&a.has(i))},ZP=(e,t)=>Array.isArray(e)&&Array.isArray(t)?[...e,...t]:e&&typeof e==`object`&&t&&typeof t==`object`?{...e,...t}:t,Qft=WP*5,QP=new WeakMap,$P=(e,t)=>{switch(t){case`string`:return typeof e==`string`;case`number`:return typeof e==`number`&&!Number.isNaN(e);case`integer`:return typeof e==`number`&&Number.isInteger(e);case`boolean`:return typeof e==`boolean`;case`object`:return typeof e==`object`&&!!e&&!Array.isArray(e);case`array`:return Array.isArray(e);case`null`:return e===null;default:return!1}},eF=e=>{let t=YP(e);if(QP.has(t))return QP.get(t);let n=`$ref`in e?HP.schema(e):e;return QP.set(t,n),n},tF=(e,t,n=new Set,r=0)=>{if(r>Qft)return!0;let i=YP(e);if(n.has(i))return!0;if(n.add(i),`type`in e&&e.type&&!(Array.isArray(e.type)?e.type:[e.type]).some(e=>e===`number`&&$P(t,`integer`)?!0:$P(t,e)))return n.delete(i),!1;let a=e.anyOf;if(Array.isArray(a)&&a.length>0&&!a.some(e=>{let i=eF(e);return!!i&&tF(i,t,n,r+1)}))return n.delete(i),!1;let o=e.oneOf;if(Array.isArray(o)&&o.length>0&&!o.some(e=>{let i=eF(e);return!!i&&tF(i,t,n,r+1)}))return n.delete(i),!1;let s=e.allOf;return Array.isArray(s)&&s.length>0&&!s.every(e=>{let i=eF(e);return!i||tF(i,t,n,r+1)})?(n.delete(i),!1):(n.delete(i),!0)},nF=Symbol(`INVALID_DEFAULT`),$ft=e=>{let t=e.default;return tF(e,t)?t:nF},ept=(e,t)=>[...e,t].join(`.`),rF=(e,t,n,r)=>{let i=n?.compositionSelection?.[ept(e,t)];if(!(typeof i!=`number`||Number.isNaN(i)))return Math.max(0,Math.min(i,r-1))},tpt=(e,t,n,r,i,a)=>{let o={};if(`properties`in e&&e.properties){let i=Object.keys(e.properties),s=i.length;for(let c=0;c<s;c++){let s=i[c],l=HP.schema(e.properties[s]);if(!l)continue;let u=t?.xml&&`xml`in l?l.xml?.name:void 0,d=iF(l,t,{level:n+1,parentSchema:e,name:s,schemaPath:[...a,s],seen:r});d!==void 0&&(o[u??s]=d)}}if(`patternProperties`in e&&e.patternProperties)for(let i of Object.keys(e.patternProperties)){let s=HP.schema(e.patternProperties[i]);s&&(o[i]=iF(s,t,{level:n+1,parentSchema:e,name:i,schemaPath:[...a,i],seen:r}))}if(`additionalProperties`in e&&e.additionalProperties){let i=typeof e.additionalProperties==`boolean`?e.additionalProperties:HP.schema(e.additionalProperties),s=e.additionalProperties===!0||typeof e.additionalProperties==`object`&&Object.keys(e.additionalProperties).length===0,c=typeof i==`object`&&`x-additionalPropertiesName`in i&&typeof i[`x-additionalPropertiesName`]==`string`&&i[`x-additionalPropertiesName`].trim().length>0,l=c?void 0:Jft(e),u=c?i[`x-additionalPropertiesName`].trim():Wft,d=s?`anything`:typeof i==`object`?iF(i,t,{level:n+1,schemaPath:[...a,u],seen:r}):`anything`;l&&l.length>0?o[String(l[0])]=d:o[u]=d}let s=e.oneOf?`oneOf`:e.anyOf?`anyOf`:void 0,c=s?e[s]:void 0;if(s&&c?.length){let e=rF(a,s,t,c.length)??0,i=HP.schema(c[e]);i&&Object.assign(o,iF(i,t,{level:n+1,schemaPath:a,seen:r}))}else if(Array.isArray(e.allOf)&&e.allOf.length>0){let i=o;for(let a of e.allOf){let o=iF(HP.schema(a),t,{level:n+1,parentSchema:e,seen:r});i=ZP(i,o)}i&&typeof i==`object`&&Object.assign(o,i)}if(t?.xml&&`xml`in e&&e.xml?.name&&n===0){let t={};return t[e.xml.name]=o,XP(e,t,i)}return XP(e,o,i)},npt=(e,t,n,r,i,a)=>{let o=`items`in e?HP.schema(e.items):void 0,s=[...a,`items`],c=o&&typeof o==`object`&&`xml`in o?o.xml?.name:void 0,l=!!(t?.xml&&`xml`in e&&e.xml?.wrapped&&c);if(e.example!==void 0)return XP(e,l?{[c]:e.example}:e.example,i);if(o&&typeof o==`object`){if(Array.isArray(o.allOf)&&o.allOf.length>0){let a=o.allOf.filter(jE),u=HP.schema(a[0]);if(u&&typeof u==`object`&&`type`in u&&u.type===`object`){let o=iF({type:`object`,allOf:a},t,{level:n+1,parentSchema:e,schemaPath:s,seen:r});return XP(e,l?[{[c]:o}]:[o],i)}let d=a.map(i=>iF(HP.schema(i),t,{level:n+1,parentSchema:e,schemaPath:s,seen:r})).filter(jE);return XP(e,l?d.map(e=>({[c]:e})):d,i)}let a=o.oneOf?`oneOf`:o.anyOf?`anyOf`:void 0,u=a?o[a]:void 0;if(a&&u&&u.length>0){let o=u[rF(s,a,t,u.length)??0],d=iF(HP.schema(o),t,{level:n+1,parentSchema:e,schemaPath:s,seen:r});return XP(e,l?[{[c]:d}]:[d],i)}}let u=o&&typeof o==`object`&&(`type`in o&&o.type===`object`||`properties`in o),d=o&&typeof o==`object`&&(`type`in o&&o.type===`array`||`items`in o);if(o&&typeof o==`object`&&(`type`in o&&o.type||u||d)){let a=iF(o,t,{level:n+1,schemaPath:s,seen:r});return XP(e,l?[{[c]:a}]:[a],i)}return XP(e,[],i)},rpt=(e,t,n)=>{if(`type`in e&&e.type&&!Array.isArray(e.type))switch(e.type){case`string`:return KP(e,t,n??``);case`boolean`:return!0;case`integer`:return`minimum`in e&&typeof e.minimum==`number`?e.minimum:1;case`number`:return`minimum`in e&&typeof e.minimum==`number`?e.minimum:1;case`array`:return[];default:return}},ipt=(e,t,n)=>{if(`type`in e&&Array.isArray(e.type)){if(e.type.includes(`null`))return null;let r=e.type[0];if(r)switch(r){case`string`:return KP(e,t,n??``);case`boolean`:return!0;case`integer`:return`minimum`in e&&typeof e.minimum==`number`?e.minimum:1;case`number`:return`minimum`in e&&typeof e.minimum==`number`?e.minimum:1;case`null`:return null;default:return}}},apt=e=>JSON.stringify({emptyString:e?.emptyString,xml:e?.xml,mode:e?.mode,variables:e?.variables,omitEmptyAndOptionalProperties:e?.omitEmptyAndOptionalProperties,compositionSelection:e?.compositionSelection?Object.entries(e.compositionSelection).sort(([e],[t])=>e.localeCompare(t)):void 0}),iF=(e,t,{level:n=0,parentSchema:r,name:i,seen:a=new WeakSet,schemaPath:o=[]}={})=>{let s=HP.schema(e);if(!jE(s))return;let c=YP(s);if(a.has(c))return;a.add(c);let l=apt(t)+(o.length>0?`:path:${o.join(`.`)}`:``),u=qP.get(c)?.get(l);if(u!==void 0)return a.delete(c),u;if(n>WP)return a.delete(c),`[Max Depth Exceeded]`;let d=!!t?.emptyString;if(Zft(s,r,i,t)){a.delete(c);return}if(`x-variable`in s&&s[`x-variable`]){let e=t?.variables?.[s[`x-variable`]];if(e!==void 0)return`type`in s&&(s.type===`number`||s.type===`integer`)?(a.delete(c),XP(s,Number(e),l)):(a.delete(c),XP(s,e,l))}if(Array.isArray(s.examples)&&s.examples.length>0)return a.delete(c),XP(s,s.examples[0],l);if(s.example!==void 0)return a.delete(c),XP(s,s.example,l);if(s.default!==void 0){let e=$ft(s);if(e!==nF)return a.delete(c),XP(s,e,l)}if(s.const!==void 0)return a.delete(c),XP(s,s.const,l);if(Array.isArray(s.enum)&&s.enum.length>0)return a.delete(c),XP(s,s.enum[0],l);if(`properties`in s||`type`in s&&s.type===`object`){let e=tpt(s,t,n,a,l,o);return a.delete(c),e}if(`type`in s&&s.type===`array`||`items`in s){let e=npt(s,t,n,a,l,o);return a.delete(c),e}let f=rpt(s,d,t?.emptyString);if(f!==void 0)return a.delete(c),XP(s,f,l);let p=s.oneOf?`oneOf`:s.anyOf?`anyOf`:void 0,m=p?s[p]:void 0;if(p&&Array.isArray(m)&&m.length>0){let e=rF(o,p,t,m.length),r=e===void 0?m.find(e=>{let t=HP.schema(e);return t&&(!(`type`in t)||t.type!==`null`)}):m[e];if(r){let e=HP.schema(r);if(e)return a.delete(c),XP(s,iF(e,t,{level:n+1,schemaPath:o,seen:a}),l)}return a.delete(c),XP(s,null,l)}if(Array.isArray(s.allOf)&&s.allOf.length>0){let e,r=s.allOf;for(let i of r){let r=iF(i,t,{level:n+1,parentSchema:s,schemaPath:o,seen:a});e===void 0?e=r:e&&typeof e==`object`&&r&&typeof r==`object`?e=ZP(e,r):r!==void 0&&(e=r)}return a.delete(c),XP(s,e??null,l)}let h=ipt(s,d,t?.emptyString);return h===void 0?(a.delete(c),XP(s,null,l)):(a.delete(c),XP(s,h,l))}})),aF,spt=s((()=>{zE(),Y4e(),mD(),opt(),aF=(e,t,n,r)=>{let i=e.content?.[t],a=pD(e,n,t);if(a)return a;let o=RE(i?.schema);if(!o)return null;let s=iF(J4e(o),{mode:`write`,compositionSelection:r},{schemaPath:[`requestBody`]});return s?{value:s}:null}})),oF,cpt=s((()=>{oF=(e,t=`default`)=>e?.[`x-scalar-selected-content-type`]?.[t]??Object.keys(e?.content??{})[0]??null}));function lpt(e,t){let n=/{{\s*([\w.-]+)\s*}}/g,r=/{\s*([\w.-]+)\s*}/g,i=(e,n)=>typeof t==`function`?t(n):t[n]?.toString()||`{${n}}`;return e.replace(n,i).replace(r,i)}var sF,cF,lF=s((()=>{Au(),sF=(e,t={})=>e.replace(ku.PATH,(e,n)=>t[n]??e),cF=(e,t={})=>e.replace(ku.VARIABLES,(e,n)=>typeof t==`function`?t(n)??e:t[n]??e)})),uF,dF,fF=s((()=>{uF=e=>({ok:!0,data:e}),dF=(e,t)=>({ok:!1,error:e,message:t})}));function pF(e){try{let t=e();return t instanceof Promise?t.then(e=>uF(e),e=>(console.error(e),dF(mF(e)))):uF(t)}catch(e){return console.error(e),dF(mF(e))}}var mF,upt=s((()=>{fF(),mF=e=>e instanceof Error?e.message:String(e)}));function hF(e){try{let{hostname:t}=new URL(e);if(dpt.includes(t))return!0;let n=t.split(`.`).pop();return!!(n&&fpt.includes(n))}catch{return!0}}var dpt,fpt,gF=s((()=>{dpt=[`localhost`,`127.0.0.1`,`[::1]`,`0.0.0.0`],fpt=[`test`,`example`,`invalid`,`localhost`]})),_F,vF,yF=s((()=>{gF(),Mu(),_F=(e,t)=>{try{if(!vF(e,t))return t??``;let n=new URL(t);return n.href=ju(e)?`http://localhost${e}`:e,n.searchParams.append(`scalar_url`,t),ju(e)?n.toString().replace(/^http:\/\/localhost/,``):n.toString()}catch{return t??``}},vF=(e,t)=>{try{return!e||!t||ju(t)?!1:ju(e)||hF(e)?!0:!hF(t)}catch{return!1}}})),bF,xF,SF,CF,wF,ppt,TF,EF,DF,mpt,hpt,gpt,OF,kF,AF=s((()=>{bF=typeof Buffer==`function`,typeof TextDecoder==`function`&&new TextDecoder,xF=typeof TextEncoder==`function`?new TextEncoder:void 0,SF=Array.prototype.slice.call(`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=`),(e=>{let t={};return e.forEach((e,n)=>t[e]=n),t})(SF),CF=String.fromCharCode.bind(String),typeof Uint8Array.from==`function`&&Uint8Array.from.bind(Uint8Array),wF=e=>e.replace(/=/g,``).replace(/[+\/]/g,e=>e==`+`?`-`:`_`),ppt=e=>{let t,n,r,i,a=``,o=e.length%3;for(let o=0;o<e.length;){if((n=e.charCodeAt(o++))>255||(r=e.charCodeAt(o++))>255||(i=e.charCodeAt(o++))>255)throw TypeError(`invalid character found`);t=n<<16|r<<8|i,a+=SF[t>>18&63]+SF[t>>12&63]+SF[t>>6&63]+SF[t&63]}return o?a.slice(0,o-3)+`===`.substring(o):a},TF=typeof btoa==`function`?e=>btoa(e):bF?e=>Buffer.from(e,`binary`).toString(`base64`):ppt,EF=bF?e=>Buffer.from(e).toString(`base64`):e=>{let t=4096,n=[];for(let r=0,i=e.length;r<i;r+=t)n.push(CF.apply(null,e.subarray(r,r+t)));return TF(n.join(``))},DF=(e,t=!1)=>t?wF(EF(e)):EF(e),mpt=e=>{if(e.length<2){var t=e.charCodeAt(0);return t<128?e:t<2048?CF(192|t>>>6)+CF(128|t&63):CF(224|t>>>12&15)+CF(128|t>>>6&63)+CF(128|t&63)}else{var t=65536+(e.charCodeAt(0)-55296)*1024+(e.charCodeAt(1)-56320);return CF(240|t>>>18&7)+CF(128|t>>>12&63)+CF(128|t>>>6&63)+CF(128|t&63)}},hpt=/[\uD800-\uDBFF][\uDC00-\uDFFFF]|[^\x00-\x7F]/g,gpt=e=>e.replace(hpt,mpt),OF=bF?e=>Buffer.from(e,`utf8`).toString(`base64`):xF?e=>EF(xF.encode(e)):e=>TF(gpt(e)),kF=(e,t=!1)=>t?wF(OF(e)):OF(e)})),_pt,vpt=s((()=>{_pt=(e,t)=>{if(!e||!t)return!0;try{let n=e.startsWith(`http`)?e:`http://${e}`,r=new URL(n).hostname,i=!t,a=t===r,o=t.startsWith(`.`)&&t===`.${r}`,s=t.startsWith(`.`)&&r?.endsWith(t);return i||a||s||o}catch{return!1}}})),jF,ypt=s((()=>{vpt(),jF=({cookie:e,url:t,disabledGlobalCookies:n})=>{if(e.isDisabled||n[e.name.toLowerCase()]===!0||!e.name)return!1;let r=new URL(t,`https://example.com`);return!(e.domain&&!_pt(t,e.domain)||e.path&&!r.pathname.startsWith(e.path))}})),bpt,xpt,Spt,Cpt,wpt=s((()=>{ad(),ypt(),bpt="We're using a `X-Scalar-Cookie` custom header to the request. The proxy will forward this as a `Cookie` header. We do this to avoid the browser omitting the `Cookie` header for cross-origin requests for security reasons.",xpt=`We're trying to add a Cookie header, but browsers often omit them for cross-origin requests for various security reasons. If it's not working, that's probably why. Here are the requirements for it to work:
-
-        - The browser URL must be on the same domain as the server URL.
-        - The connection must be made over HTTPS.
-        `,Spt=(e,t)=>{let n=e.map(e=>`${e.name}=${e.value}`).join(`; `);return t&&n?`${t}; ${n}`:t||n||``},Cpt=({cookies:e,originalCookieHeader:t,url:n,useCustomCookieHeader:r})=>{let i=Spt(e.filter(e=>jF({url:n,cookie:e,disabledGlobalCookies:{}})),t??void 0);return i?r?(console.warn(bpt),{name:rge,value:i}):(console.warn(xpt),{name:`Cookie`,value:i}):null}})),Tpt,Ept,Dpt,MF,Opt=s((()=>{Tpt={21:`!`,24:`$`,27:`'`,28:`(`,29:`)`,"2A":`*`,"2C":`,`,"2F":`/`,"3A":`:`,"3B":`;`,40:`@`},Ept=e=>e.replace(/%([0-9A-Fa-f]{2})/g,(e,t)=>Tpt[t.toUpperCase()]??e),Dpt=e=>{try{return decodeURIComponent(e.replaceAll(`+`,`%20`))}catch{return e}},MF=(e,t)=>{if(t.size===0)return e;let n=e.indexOf(`?`);if(n===-1)return e;let r=e.indexOf(`#`,n),i=e.slice(0,n+1),a=r===-1?e.slice(n+1):e.slice(n+1,r),o=r===-1?``:e.slice(r);return a?`${i}${a.split(`&`).map(e=>{if(!e)return e;let n=e.indexOf(`=`),r=n===-1?e:e.slice(0,n),i=Dpt(r);return!t.has(i)||n===-1?e:`${r}=${Ept(e.slice(n+1))}`}).join(`&`)}${o}`:e}})),kpt,NF,Apt,PF,jpt=s((()=>{lF(),fF(),upt(),Mu(),Iu(),kpt=`MISSING_REQUEST_SERVER_BASE`,NF=`INVALID_REQUEST_FACTORY_URL`,Apt=`No server URL is configured for this request. Add a servers entry to your OpenAPI document (or set a server in the client) before sending.`,PF=(e,t)=>{let n=t.envVariables,r=pF(()=>Object.fromEntries(Object.entries(e.path.variables).map(([e,t])=>[e,encodeURIComponent(cF(t,n))])));if(!r.ok)return dF(NF,`The request URL contains invalid characters in path parameters.`);let i=r.data,a=Fu(cF(e.baseUrl,n),sF(cF(e.path.raw,n),i));if(!t.allowMissingRequestServerBase&&ju(a))return dF(kpt,Apt);let o=globalThis.window?.location?.origin,s=o&&o!==`null`?o:`http://localhost:3000`,c=pF(()=>new URL(a,s));if(!c.ok)return dF(NF,`The request URL could not be parsed. Check the server URL and path for invalid characters.`);let l=c.data,u=new URLSearchParams;for(let[t,r]of e.query.entries())u.append(cF(t,n),cF(r,n));let d=new URLSearchParams;for(let[e,n]of t.securityQueryParams.entries())d.append(e,n);return l.search=Nu(l.searchParams,u,d).toString(),uF(l.toString())}})),FF,IF,LF,Mpt,Npt,Ppt,Fpt,Ipt,Lpt,Rpt,zpt,RF,zF,Bpt,Vpt,Hpt,Upt,Wpt,Gpt,BF,Kpt,qpt,Jpt,Ypt,Xpt,Zpt,Qpt,$pt,emt,VF,tmt,nmt,rmt,imt,amt,omt,smt,cmt,lmt,umt,dmt,fmt,pmt,mmt,hmt,gmt,_mt,vmt,ymt,bmt,xmt,Smt,Cmt,wmt,HF,Tmt,Emt,Dmt,Omt,kmt,Amt,jmt,Mmt,Nmt,Pmt,Fmt,Imt,Lmt,Rmt,zmt,Bmt,Vmt,Hmt,Umt,Wmt,Gmt,Kmt,qmt,Jmt,Ymt,Xmt,Zmt,Qmt,$mt,eht,tht,nht,rht,iht,aht,oht,sht,cht,UF,WF,GF,KF,lht,uht=s((()=>{FF=[`9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d`,`f47ac10b-58cc-4372-a567-0e02b2c3d479`,`1b9d6bcd-bbfd-4b2d-9b5d-ab8dfbbd4bed`,`6ba7b810-9dad-11d1-80b4-00c04fd430c8`,`a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11`,`3fa85f64-5717-4562-b3fc-2c963f66afa6`,`550e8400-e29b-41d4-a716-446655440000`,`c56a4180-65aa-42ec-a945-5fd21dec0538`,`7c9e6679-7425-40de-944b-e07fc1f90ae7`,`e4eaaaf2-d142-11e1-b3e4-080027620cdd`,`aab5d5fd-70c1-11e5-a4fb-b026b977eb28`,`2c5ea4c0-4067-11e9-8bad-9b1deb4d3b7d`,`d9428888-122b-11e1-b85c-61cd3cbed5a2`,`fb1a38e6-4be3-4e38-b8ec-c0c2c2d9e2a7`,`01234567-89ab-cdef-0123-456789abcdef`],IF=`abcdefghijklmnopqrstuvwxyz0123456789`,LF=[`#e34f26`,`#3498db`,`#2ecc71`,`#9b59b6`,`#f1c40f`,`#1abc9c`,`#e74c3c`,`#2c3e50`,`#d35400`,`#8e44ad`,`#27ae60`,`#c0392b`,`#16a085`,`#f39c12`,`#7f8c8d`],Mpt=[`HTTP`,`SQL`,`TCP`,`JSON`,`XML`,`API`,`SSL`,`CSS`,`HTML`,`RAM`,`FTP`,`SSH`,`DNS`,`URL`,`USB`],Npt=[`192.168.1.42`,`10.0.0.134`,`172.16.254.1`,`203.0.113.50`,`198.51.100.23`,`100.24.56.78`,`54.239.28.85`,`13.107.42.14`,`151.101.1.140`,`216.58.214.206`,`93.184.216.34`,`104.16.249.249`,`172.217.14.206`,`185.199.108.153`,`140.82.121.4`],Ppt=[`2001:0db8:85a3:0000:0000:8a2e:0370:7334`,`fe80:0000:0000:0000:0202:b3ff:fe1e:8329`,`2607:f8b0:4004:0800:0000:0000:0000:200e`,`2001:4860:4860:0000:0000:0000:0000:8888`,`2a03:2880:f10c:0083:face:b00c:0000:25de`,`fd12:3456:789a:1000:0000:0000:0000:0001`,`2600:1f18:2489:8200:a953:2c7b:e7e0:d12f`,`2001:0db8:0000:0042:0000:8a2e:0370:7334`,`fe80:0000:0000:0000:4c5a:e8ff:fe7c:3d92`,`2001:0db8:aaaa:bbbb:cccc:dddd:eeee:0001`],Fpt=[`00:1A:2B:3C:4D:5E`,`A4:83:E7:2D:6B:9F`,`48:2C:6A:1E:59:3D`,`00:50:56:C0:00:08`,`D4:BE:D9:19:6F:F2`,`3C:22:FB:4A:88:C1`,`08:00:27:5B:8E:A4`,`F0:18:98:43:65:DA`,`5C:CF:7F:2B:1D:E3`,`00:0C:29:3E:71:BC`,`1C:6F:65:A2:8D:49`,`B8:27:EB:63:4F:78`],Ipt=[`en`,`es`,`fr`,`de`,`it`,`pt`,`ja`,`zh`,`ko`,`ar`,`ru`,`nl`,`sv`,`pl`,`da`,`fi`,`nb`,`tr`,`hi`,`th`],Lpt=[`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36`,`Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15`,`Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0`,`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0`,`Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1`,`Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.43 Mobile Safari/537.36`,`Mozilla/5.0 (iPad; CPU OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1`,`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0`,`Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36`,`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0`],Rpt=[`http`,`https`],zpt=[`1.0.0`,`2.3.1`,`0.9.4`,`3.12.0`,`1.5.7`,`4.0.0-beta.1`,`0.1.0`,`2.0.3`,`1.2.0`,`5.4.2`,`3.1.0`,`0.8.12`,`2.7.5`,`1.14.0`,`6.0.0`],RF=[`Emma`,`Liam`,`Olivia`,`Noah`,`Ava`,`James`,`Sophia`,`Oliver`,`Isabella`,`Lucas`,`Mia`,`Ethan`,`Charlotte`,`Mason`,`Amelia`],zF=[`Smith`,`Johnson`,`Williams`,`Brown`,`Jones`,`Garcia`,`Miller`,`Davis`,`Rodriguez`,`Martinez`,`Hernandez`,`Lopez`,`Gonzalez`,`Wilson`,`Anderson`],Bpt=[`Mr.`,`Mrs.`,`Ms.`,`Dr.`,`Prof.`,`Rev.`,`Sir`,`Mx.`],Vpt=[`Jr.`,`Sr.`,`II`,`III`,`IV`,`PhD`,`MD`,`DDS`,`Esq.`],Hpt=[`Marketing`,`Engineering`,`Finance`,`Operations`,`Human Resources`,`Sales`,`Research`,`Design`,`Legal`,`Product`,`Data`,`Support`,`Quality`,`Security`,`Communications`],Upt=[`Senior`,`Lead`,`Junior`,`Principal`,`Chief`,`Associate`,`Global`,`Regional`,`Internal`,`Dynamic`,`Staff`,`Executive`,`National`,`Strategic`,`Corporate`],Wpt=[`Software Engineer`,`Product Manager`,`Data Analyst`,`UX Designer`,`DevOps Engineer`,`Marketing Director`,`Sales Representative`,`Financial Analyst`,`Project Manager`,`QA Engineer`,`Technical Writer`,`System Administrator`,`Business Analyst`,`Account Executive`,`Operations Manager`],Gpt=[`Full-time`,`Part-time`,`Contract`,`Freelance`,`Internship`,`Temporary`,`Remote`,`Hybrid`,`Consultant`,`Seasonal`],BF=[`(555) 123-4567`,`(555) 987-6543`,`(555) 246-8135`,`(555) 369-2580`,`(555) 741-8520`,`(555) 852-9631`,`(555) 147-2583`,`(555) 963-8520`,`(555) 321-6540`,`(555) 654-9870`,`(555) 789-0123`,`(555) 234-5678`,`(555) 876-5432`,`(555) 468-1357`,`(555) 531-2468`],Kpt=[`New York`,`London`,`Tokyo`,`Paris`,`Sydney`,`Toronto`,`Berlin`,`Singapore`,`Mumbai`,`São Paulo`,`Amsterdam`,`Seoul`,`Dublin`,`Barcelona`,`Melbourne`],qpt=[`Main Street`,`Oak Avenue`,`Park Boulevard`,`Cedar Lane`,`Elm Drive`,`Maple Court`,`Pine Road`,`Walnut Street`,`Birch Avenue`,`Cherry Lane`,`Willow Way`,`Spruce Circle`,`Aspen Drive`,`Hickory Place`,`Chestnut Road`],Jpt=[`123 Main Street`,`456 Oak Avenue`,`789 Park Boulevard`,`321 Cedar Lane`,`654 Elm Drive`,`987 Maple Court`,`147 Pine Road`,`258 Walnut Street`,`369 Birch Avenue`,`741 Cherry Lane`,`852 Willow Way`,`963 Spruce Circle`,`159 Aspen Drive`,`357 Hickory Place`,`486 Chestnut Road`],Ypt=[`United States`,`United Kingdom`,`Canada`,`Australia`,`Germany`,`France`,`Japan`,`Brazil`,`India`,`Netherlands`,`South Korea`,`Singapore`,`Ireland`,`Spain`,`Sweden`],Xpt=[`US`,`GB`,`CA`,`AU`,`DE`,`FR`,`JP`,`BR`,`IN`,`NL`,`KR`,`SG`,`IE`,`ES`,`SE`,`IT`,`NO`,`DK`,`FI`,`CH`],Zpt=[`40.7128`,`-33.8688`,`51.5074`,`35.6762`,`48.8566`,`-23.5505`,`19.4326`,`55.7558`,`1.3521`,`37.7749`,`52.3676`,`34.0522`,`41.9028`,`39.9042`,`25.2048`],Qpt=[`-74.0060`,`151.2093`,`-0.1278`,`139.6503`,`2.3522`,`-46.6333`,`-99.1332`,`37.6173`,`103.8198`,`-122.4194`,`4.9041`,`-118.2437`,`12.4964`,`116.4074`,`55.2708`],$pt=[`https://avatars.githubusercontent.com/u/12345678`,`https://avatars.githubusercontent.com/u/23456789`,`https://avatars.githubusercontent.com/u/34567890`,`https://avatars.githubusercontent.com/u/45678901`,`https://avatars.githubusercontent.com/u/56789012`,`https://avatars.githubusercontent.com/u/67890123`,`https://avatars.githubusercontent.com/u/78901234`,`https://avatars.githubusercontent.com/u/89012345`,`https://avatars.githubusercontent.com/u/90123456`,`https://avatars.githubusercontent.com/u/10234567`],emt=[`https://picsum.photos/seed/scalar1/640/480`,`https://picsum.photos/seed/scalar2/640/480`,`https://picsum.photos/seed/scalar3/640/480`,`https://picsum.photos/seed/scalar4/640/480`,`https://picsum.photos/seed/scalar5/640/480`,`https://picsum.photos/seed/scalar6/640/480`,`https://picsum.photos/seed/scalar7/640/480`,`https://picsum.photos/seed/scalar8/640/480`,`https://picsum.photos/seed/scalar9/640/480`,`https://picsum.photos/seed/scalar10/640/480`],VF=`https://loremflickr.com/640/480`,tmt=Array.from({length:10},(e,t)=>`${VF}/abstract?lock=${t+1}`),nmt=Array.from({length:10},(e,t)=>`${VF}/animals?lock=${t+1}`),rmt=Array.from({length:10},(e,t)=>`${VF}/business?lock=${t+1}`),imt=Array.from({length:10},(e,t)=>`${VF}/cat?lock=${t+1}`),amt=Array.from({length:10},(e,t)=>`${VF}/city?lock=${t+1}`),omt=Array.from({length:10},(e,t)=>`${VF}/food?lock=${t+1}`),smt=Array.from({length:10},(e,t)=>`${VF}/nightlife?lock=${t+1}`),cmt=Array.from({length:10},(e,t)=>`${VF}/fashion?lock=${t+1}`),lmt=Array.from({length:10},(e,t)=>`${VF}/people?lock=${t+1}`),umt=Array.from({length:10},(e,t)=>`${VF}/nature?lock=${t+1}`),dmt=Array.from({length:10},(e,t)=>`${VF}/sports?lock=${t+1}`),fmt=Array.from({length:10},(e,t)=>`${VF}/transport?lock=${t+1}`),pmt=[`data:image/svg+xml;charset=UTF-8,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20width%3D%2264%22%20height%3D%2264%22%3E%3Crect%20fill%3D%22%233498db%22%20width%3D%2264%22%20height%3D%2264%22%2F%3E%3C%2Fsvg%3E`,`data:image/svg+xml;charset=UTF-8,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20width%3D%2264%22%20height%3D%2264%22%3E%3Crect%20fill%3D%22%23e74c3c%22%20width%3D%2264%22%20height%3D%2264%22%2F%3E%3C%2Fsvg%3E`,`data:image/svg+xml;charset=UTF-8,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20width%3D%2264%22%20height%3D%2264%22%3E%3Crect%20fill%3D%22%232ecc71%22%20width%3D%2264%22%20height%3D%2264%22%2F%3E%3C%2Fsvg%3E`,`data:image/svg+xml;charset=UTF-8,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20width%3D%2264%22%20height%3D%2264%22%3E%3Crect%20fill%3D%22%239b59b6%22%20width%3D%2264%22%20height%3D%2264%22%2F%3E%3C%2Fsvg%3E`,`data:image/svg+xml;charset=UTF-8,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20width%3D%2264%22%20height%3D%2264%22%3E%3Crect%20fill%3D%22%23f1c40f%22%20width%3D%2264%22%20height%3D%2264%22%2F%3E%3C%2Fsvg%3E`],mmt=[`34042448`,`34102758`,`02997566`,`52631809`,`75412296`,`37762776`,`44117882`,`13865687`,`44377086`,`74440091`],hmt=[`Personal Checking`,`Savings Account`,`Money Market`,`Home Loan`,`Auto Loan`,`Investment Account`,`Business Checking`,`Credit Card`,`Retirement Fund`,`College Savings`],gmt=[`DEUTDEFF`,`BNPAFRPP`,`CHASUS33`,`HSBCGB2L`,`COBADEFF`,`SCBLSGSG`,`ANZBAU3M`,`CITIUS33`,`BOFAUS3N`,`NWBKGB2L`],_mt=[`GB29NWBK60161331926819`,`DE89370400440532013000`,`FR7630006000011234567890189`,`ES9121000418450200051332`,`IT60X0542811101000000123456`,`NL91ABNA0417164300`,`CH9300762011623852957`,`BE68539007547034`,`AT611904300234573201`,`FI2112345600000785`],vmt=[`deposit`,`withdrawal`,`payment`,`invoice`,`transfer`],ymt=[`USD`,`EUR`,`GBP`,`JPY`,`AUD`,`CAD`,`CHF`,`CNY`,`INR`,`BRL`,`SEK`,`NOK`,`DKK`,`SGD`,`HKD`],bmt=[`US Dollar`,`Euro`,`British Pound`,`Japanese Yen`,`Australian Dollar`,`Canadian Dollar`,`Swiss Franc`,`Chinese Yuan`,`Indian Rupee`,`Brazilian Real`,`Swedish Krona`,`Norwegian Krone`,`Danish Krone`,`Singapore Dollar`,`Hong Kong Dollar`],xmt=[`$`,`€`,`£`,`¥`,`A$`,`C$`,`CHF`,`¥`,`₹`,`R$`],Smt=[`1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa`,`3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy`,`bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4`,`1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2`,`3Kzh9qAqVWQhEsfQz7zEQL1EuSx5tyNLNS`,`1FeexV6bAHb8ybZjqQMjJrcCrHGW9sb6uF`,`bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh`,`3FZbgi29cpjq2GjdwV8eyHuJJnkLtktZc5`,`1P5ZEDWTKTFGxQjZphgWPQUpe554WKDfHQ`,`bc1q42lja79elem0anu8q860g3milve2ycq5t8g3ux`],Cmt=[`Acme Corp`,`Globex`,`Initech`,`Umbrella Industries`,`Stark Enterprises`,`Wayne Corp`,`Cyberdyne Systems`,`Tyrell Corp`,`Soylent Corp`,`Aperture Science`,`Massive Dynamic`,`Oscorp`,`Abstergo`,`Weyland-Yutani`,`Hooli`],wmt=[`Inc`,`LLC`,`Group`,`Ltd`,`PLC`,`Corp`],HF=[`leverage agile frameworks`,`iterate revolutionary convergence`,`drive seamless solutions`,`enable viral e-services`,`synergize scalable supply-chains`,`harness real-time channels`,`orchestrate integrated experiences`,`deliver frictionless partnerships`,`transform dynamic mindshare`,`cultivate open-source communities`],Tmt=[`innovative`,`scalable`,`seamless`,`cutting-edge`,`robust`,`synergistic`,`dynamic`,`holistic`,`strategic`,`disruptive`,`frictionless`,`proactive`,`world-class`,`collaborative`,`granular`],Emt=[`leverage`,`iterate`,`synergize`,`monetize`,`orchestrate`,`disintermediate`,`harness`,`incentivize`,`optimize`,`streamline`,`revolutionize`,`cultivate`,`empower`,`facilitate`,`aggregate`],Dmt=[`frameworks`,`paradigms`,`synergies`,`platforms`,`infrastructures`,`bandwidth`,`channels`,`communities`,`convergence`,`deliverables`,`e-markets`,`experiences`,`initiatives`,`interfaces`,`methodologies`],Omt=[`Adaptive zero defect data-warehouse`,`Automated scalable protocol`,`Business-focused zero defect hub`,`Cloned responsive flexibility`,`Cross-group background collaboration`,`De-engineered stable conglomeration`,`Distributed actuating throughput`,`Enhanced client-server capability`,`Face to face explicit superstructure`,`Front-line multimedia interface`],kmt=[`Adaptive`,`Advanced`,`Automated`,`Balanced`,`Business-focused`,`Centralized`,`Cloned`,`Configurable`,`Cross-group`,`Customizable`,`De-engineered`,`Decentralized`,`Digitized`,`Distributed`,`Enhanced`],Amt=[`24 hour`,`actuating`,`analyzing`,`asymmetric`,`asynchronous`,`background`,`bandwidth-monitored`,`bi-directional`,`bifurcated`,`bottom-line`,`clear-thinking`,`client-driven`,`client-server`,`coherent`,`cohesive`],jmt=[`ability`,`access`,`algorithm`,`alliance`,`analyzer`,`application`,`approach`,`architecture`,`array`,`attitude`,`benchmark`,`budgetary management`,`capability`,`capacity`,`challenge`],Mmt=[`id`,`name`,`email`,`status`,`created_at`,`updated_at`,`description`,`amount`,`category`,`token`,`avatar`,`phone`,`address`,`comment`,`title`],Nmt=[`int`,`varchar`,`text`,`boolean`,`date`,`timestamp`,`float`,`bigint`,`json`,`uuid`,`decimal`,`enum`,`blob`,`char`,`smallint`],Pmt=[`utf8_general_ci`,`utf8mb4_unicode_ci`,`ascii_general_ci`,`latin1_swedish_ci`,`utf8_unicode_ci`,`utf8mb4_general_ci`,`utf8_bin`,`latin1_general_ci`,`utf8mb4_bin`,`ascii_bin`],Fmt=[`InnoDB`,`MyISAM`,`MEMORY`,`CSV`,`ARCHIVE`,`FEDERATED`,`NDB`,`MERGE`,`BLACKHOLE`,`EXAMPLE`],Imt=[`Monday`,`Tuesday`,`Wednesday`,`Thursday`,`Friday`,`Saturday`,`Sunday`],Lmt=[`January`,`February`,`March`,`April`,`May`,`June`,`July`,`August`,`September`,`October`,`November`,`December`],Rmt=[`example.com`,`test-site.org`,`my-app.io`,`dev-portal.net`,`api-hub.com`,`code-base.dev`,`data-flow.co`,`web-pulse.io`,`cloud-nest.org`,`tech-wave.net`,`open-source.dev`,`byte-craft.io`,`pixel-lab.co`,`node-spark.com`,`vue-forge.dev`],zmt=[`com`,`org`,`net`,`io`,`dev`,`co`,`info`,`app`,`me`,`xyz`],Bmt=[`example`,`test-site`,`my-app`,`dev-portal`,`api-hub`,`code-base`,`data-flow`,`web-pulse`,`cloud-nest`,`tech-wave`,`open-source`,`byte-craft`,`pixel-lab`,`node-spark`,`vue-forge`],Vmt=[`emma.smith@example.com`,`liam.johnson@test.org`,`olivia.williams@demo.io`,`noah.brown@sample.net`,`ava.jones@mail.com`,`james.garcia@inbox.dev`,`sophia.miller@webmail.co`,`oliver.davis@post.io`,`isabella.rodriguez@email.org`,`lucas.martinez@connect.net`,`mia.hernandez@hub.com`,`ethan.lopez@office.dev`,`charlotte.gonzalez@corp.io`,`mason.wilson@biz.co`,`amelia.anderson@pro.net`],Hmt=[`emma@example.com`,`liam@example.org`,`olivia@example.net`,`noah@example.com`,`ava@example.org`,`james@example.net`,`sophia@example.com`,`oliver@example.org`,`isabella@example.net`,`lucas@example.com`,`mia@example.org`,`ethan@example.net`],Umt=[`emma_dev42`,`liam.codes`,`olivia_tech`,`noah_builds`,`ava.hacks`,`james_ops`,`sophia_data`,`oliver.api`,`isa_design`,`lucas_vue`,`mia_cloud`,`ethan.stack`,`char_pixel`,`mason_byte`,`amelia_net`],Wmt=[`https://example.com`,`https://test-site.org`,`https://my-app.io`,`https://dev-portal.net`,`https://api-hub.com`,`https://code-base.dev`,`https://data-flow.co`,`https://web-pulse.io`,`https://cloud-nest.org`,`https://tech-wave.net`,`https://open-source.dev`,`https://byte-craft.io`],Gmt=[`report.pdf`,`data.csv`,`image.png`,`backup.tar.gz`,`readme.md`,`config.yml`,`schema.json`,`styles.css`,`app.tsx`,`index.html`,`notes.txt`,`archive.zip`,`log.xml`,`script.sh`,`database.sql`],Kmt=[`application`,`text`,`image`,`audio`,`video`,`font`,`model`,`multipart`,`message`,`chemical`],qmt=[`pdf`,`csv`,`png`,`json`,`md`,`yml`,`html`,`txt`,`xml`,`sql`,`tar`,`gz`,`wasm`,`webp`],Jmt=[`report.pdf`,`photo.jpg`,`document.docx`,`spreadsheet.xlsx`,`presentation.pptx`,`image.png`,`video.mp4`,`audio.mp3`,`archive.zip`,`readme.txt`],Ymt=[`text`,`application`,`image`,`audio`,`video`],Xmt=[`pdf`,`jpg`,`png`,`gif`,`mp3`,`mp4`,`doc`,`xls`,`ppt`,`txt`,`zip`,`html`,`css`,`js`,`json`],Zmt=[`/home/user/documents/report.pdf`,`/var/log/app/server.log`,`/tmp/upload/image.png`,`/opt/data/backup.tar.gz`,`/home/user/projects/app/src/index.ts`,`/etc/config/settings.yml`,`/usr/local/bin/script.sh`,`/home/user/downloads/archive.zip`,`/var/www/html/index.html`,`/home/user/.config/app.json`],Qmt=[`/home/user/documents`,`/var/log/app`,`/tmp/uploads`,`/opt/data`,`/home/user/projects/app/src`,`/etc/config`,`/usr/local/bin`,`/home/user/downloads`,`/var/www/html`,`/home/user/.config`],$mt=[`application/json`,`text/html`,`image/png`,`application/pdf`,`text/plain`,`image/jpeg`,`application/xml`,`text/css`,`application/javascript`,`image/svg+xml`,`application/zip`,`audio/mpeg`,`video/mp4`,`font/woff2`,`application/octet-stream`],eht=[`Chair`,`Computer`,`Keyboard`,`Mouse`,`Table`,`Phone`,`Shoes`,`Shirt`,`Pants`,`Hat`,`Bike`,`Towels`,`Gloves`,`Soap`,`Tuna`],tht=[`Refined`,`Elegant`,`Rustic`,`Gorgeous`,`Practical`,`Fantastic`,`Handcrafted`,`Incredible`,`Licensed`,`Sleek`,`Intelligent`,`Recycled`,`Modern`,`Bespoke`,`Ergonomic`],nht=[`Cotton`,`Steel`,`Wooden`,`Concrete`,`Rubber`,`Granite`,`Plastic`,`Frozen`,`Soft`,`Metal`,`Bronze`,`Silk`,`Leather`,`Ceramic`,`Bamboo`],rht=[`Refined Cotton Chair`,`Sleek Steel Computer`,`Elegant Wooden Table`,`Practical Rubber Keyboard`,`Gorgeous Granite Mouse`,`Rustic Metal Bike`,`Handcrafted Silk Shirt`,`Incredible Bamboo Towels`,`Modern Leather Shoes`,`Ergonomic Plastic Phone`,`Fantastic Ceramic Soap`,`Licensed Bronze Hat`,`Intelligent Soft Gloves`,`Bespoke Cotton Pants`,`Recycled Steel Tuna`],iht=[`Electronics`,`Clothing`,`Books`,`Home`,`Garden`,`Sports`,`Toys`,`Automotive`,`Grocery`,`Health`,`Beauty`,`Music`,`Movies`,`Games`,`Outdoors`],aht=[`server`,`database`,`network`,`protocol`,`system`,`algorithm`,`interface`,`module`,`component`,`function`,`framework`,`library`,`instance`,`variable`,`endpoint`],oht=[`run`,`build`,`deploy`,`parse`,`fetch`,`render`,`compile`,`stream`,`cache`,`merge`,`sync`,`push`,`pull`,`test`,`debug`],sht=[`running`,`building`,`deploying`,`parsing`,`fetching`,`rendering`,`compiling`,`streaming`,`caching`,`merging`,`syncing`,`pushing`,`pulling`,`testing`,`debugging`],cht=[`fast`,`secure`,`scalable`,`robust`,`dynamic`,`modular`,`stable`,`lightweight`,`portable`,`resilient`,`efficient`,`responsive`,`concurrent`,`stateless`,`distributed`],UF=[`pixel`,`quantum`,`cipher`,`matrix`,`vector`,`nexus`,`pulse`,`flux`,`forge`,`prism`,`vortex`,`helix`,`orbit`,`spark`,`nebula`],WF=[`lorem`,`ipsum`,`dolor`,`sit`,`amet`,`consectetur`,`adipiscing`,`elit`,`sed`,`do`,`eiusmod`,`tempor`,`incididunt`,`ut`,`labore`,`et`,`dolore`,`magna`,`aliqua`,`enim`],GF=[`Lorem ipsum dolor sit amet, consectetur adipiscing elit.`,`Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.`,`Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris.`,`Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore.`,`Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia.`,`Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit.`,`Neque porro quisquam est, qui dolorem ipsum quia dolor sit amet.`,`Ut enim ad minima veniam, quis nostrum exercitationem ullam corporis suscipit.`,`Quis autem vel eum iure reprehenderit qui in ea voluptate velit esse.`,`At vero eos et accusamus et iusto odio dignissimos ducimus qui blanditiis.`],KF=[`Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.`,`Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.`,`Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo.`,`Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt.`,`Neque porro quisquam est, qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit, sed quia non numquam eius modi tempora incidunt ut labore et dolore magnam aliquam quaerat voluptatem.`],lht=[`lorem-ipsum-dolor`,`sed-tempor-incididunt`,`amet-consectetur-adipiscing`,`eiusmod-labore-dolore`,`veniam-nostrud-exercitation`,`voluptate-velit-cillum`,`occaecat-cupidatat-proident`,`perspiciatis-omnis-natus`,`aspernatur-odit-fugit`,`dolorem-ipsum-amet`]})),qF,JF,dht,fht,pht,mht,hht,YF,XF,ght,ZF,QF,_ht,vht,$F,yht=s((()=>{uht(),qF=e=>e[Math.floor(Math.random()*e.length)],JF=(e,t)=>Math.floor(Math.random()*(t-e+1))+e,dht=e=>Array.from({length:e},()=>Math.floor(Math.random()*10)).join(``),fht=e=>Array.from({length:e},()=>IF[Math.floor(Math.random()*IF.length)]).join(``),pht=()=>{let e=Date.now()+JF(1,365)*864e5;return new Date(e).toISOString()},mht=()=>{let e=Date.now()-JF(1,365)*864e5;return new Date(e).toISOString()},hht=()=>{let e=Date.now()-JF(1,3)*864e5;return new Date(e).toISOString()},YF=(e,t,n)=>{let r=JF(t,n);return Array.from({length:r},()=>qF(e)).join(` `)},XF=(e,t,n)=>{let r=JF(t,n);return Array.from({length:r},()=>qF(e)).join(` `)},ght=(e,t,n)=>{let r=JF(t,n);return Array.from({length:r},()=>qF(e)).join(`
-`)},ZF={$guid:{fn:()=>qF(FF),comment:`A uuid-v4 style guid`},$timestamp:{fn:()=>Math.floor(Date.now()/1e3).toString(),comment:`The current UNIX timestamp in seconds`},$isoTimestamp:{fn:()=>new Date().toISOString(),comment:`The current ISO timestamp at zero UTC`},$randomUUID:{fn:()=>qF(FF),comment:`A random 36-character UUID`},$randomAlphaNumeric:{fn:()=>`abcdefghijklmnopqrstuvwxyz0123456789`[Math.floor(Math.random()*36)]??`a`,comment:`A random alpha-numeric character`},$randomBoolean:{fn:()=>Math.random()<.5?`true`:`false`,comment:`A random boolean value`},$randomInt:{fn:()=>JF(0,1e3).toString(),comment:`A random integer between 0 and 1000`},$randomColor:{fn:()=>qF(LF),comment:`A random color in hex format`},$randomHexColor:{fn:()=>qF(LF),comment:`A random hex value`},$randomAbbreviation:{fn:()=>qF(Mpt),comment:`A random abbreviation`},$randomIP:{fn:()=>qF(Npt),comment:`A random IPv4 address`},$randomIPV6:{fn:()=>qF(Ppt),comment:`A random IPv6 address`},$randomMACAddress:{fn:()=>qF(Fpt),comment:`A random MAC address`},$randomPassword:{fn:()=>fht(15),comment:`A random 15-character alpha-numeric password`},$randomLocale:{fn:()=>qF(Ipt),comment:`A random two-letter language code (ISO 639-1)`},$randomUserAgent:{fn:()=>qF(Lpt),comment:`A random user agent`},$randomProtocol:{fn:()=>qF(Rpt),comment:`A random internet protocol`},$randomSemver:{fn:()=>qF(zpt),comment:`A random semantic version number`},$randomFirstName:{fn:()=>qF(RF),comment:`A random first name`},$randomLastName:{fn:()=>qF(zF),comment:`A random last name`},$randomFullName:{fn:()=>`${qF(RF)} ${qF(zF)}`,comment:`A random first and last name`},$randomNamePrefix:{fn:()=>qF(Bpt),comment:`A random name prefix`},$randomNameSuffix:{fn:()=>qF(Vpt),comment:`A random name suffix`},$randomJobArea:{fn:()=>qF(Hpt),comment:`A random job area`},$randomJobDescriptor:{fn:()=>qF(Upt),comment:`A random job descriptor`},$randomJobTitle:{fn:()=>qF(Wpt),comment:`A random job title`},$randomJobType:{fn:()=>qF(Gpt),comment:`A random job type`},$randomPhoneNumber:{fn:()=>qF(BF),comment:`A random ten-digit phone number`},$randomPhoneNumberExt:{fn:()=>`${JF(10,99)}-${qF(BF)}`,comment:`A random phone number prefixed with a two-digit extension (10–99)`},$randomCity:{fn:()=>qF(Kpt),comment:`A random city name`},$randomStreetName:{fn:()=>qF(qpt),comment:`A random street name`},$randomStreetAddress:{fn:()=>qF(Jpt),comment:`A random street address`},$randomCountry:{fn:()=>qF(Ypt),comment:`A random country`},$randomCountryCode:{fn:()=>qF(Xpt),comment:`A random two-letter country code (ISO 3166-1 alpha-2)`},$randomLatitude:{fn:()=>qF(Zpt),comment:`A random latitude coordinate`},$randomLongitude:{fn:()=>qF(Qpt),comment:`A random longitude coordinate`},$randomAvatarImage:{fn:()=>qF($pt),comment:`A random avatar image`},$randomImageUrl:{fn:()=>qF(emt),comment:`A URL of a random image`},$randomAbstractImage:{fn:()=>qF(tmt),comment:`A URL of a random abstract image`},$randomAnimalsImage:{fn:()=>qF(nmt),comment:`A URL of a random animal image`},$randomBusinessImage:{fn:()=>qF(rmt),comment:`A URL of a random stock business image`},$randomCatsImage:{fn:()=>qF(imt),comment:`A URL of a random cat image`},$randomCityImage:{fn:()=>qF(amt),comment:`A URL of a random city image`},$randomFoodImage:{fn:()=>qF(omt),comment:`A URL of a random food image`},$randomNightlifeImage:{fn:()=>qF(smt),comment:`A URL of a random nightlife image`},$randomFashionImage:{fn:()=>qF(cmt),comment:`A URL of a random fashion image`},$randomPeopleImage:{fn:()=>qF(lmt),comment:`A URL of a random image of a person`},$randomNatureImage:{fn:()=>qF(umt),comment:`A URL of a random nature image`},$randomSportsImage:{fn:()=>qF(dmt),comment:`A URL of a random sports image`},$randomTransportImage:{fn:()=>qF(fmt),comment:`A URL of a random transportation image`},$randomImageDataUri:{fn:()=>qF(pmt),comment:`A random image data URI`},$randomBankAccount:{fn:()=>qF(mmt),comment:`A random 8-digit bank account number`},$randomBankAccountName:{fn:()=>qF(hmt),comment:`A random bank account name`},$randomCreditCardMask:{fn:()=>`**** **** **** ${dht(4)}`,comment:`A random masked credit card number`},$randomBankAccountBic:{fn:()=>qF(gmt),comment:`A random BIC (Bank Identifier Code)`},$randomBankAccountIban:{fn:()=>qF(_mt),comment:`A random 15-31 character IBAN (International Bank Account Number)`},$randomTransactionType:{fn:()=>qF(vmt),comment:`A random transaction type`},$randomCurrencyCode:{fn:()=>qF(ymt),comment:`A random 3-letter currency code (ISO-4217)`},$randomCurrencyName:{fn:()=>qF(bmt),comment:`A random currency name`},$randomCurrencySymbol:{fn:()=>qF(xmt),comment:`A random currency symbol`},$randomBitcoin:{fn:()=>qF(Smt),comment:`A random bitcoin address`},$randomCompanyName:{fn:()=>qF(Cmt),comment:`A random company name`},$randomCompanySuffix:{fn:()=>qF(wmt),comment:`A random company suffix`},$randomBs:{fn:()=>qF(HF),comment:`A random phrase of business-speak`},$randomBsAdjective:{fn:()=>qF(Tmt),comment:`A random business-speak adjective`},$randomBsBuzz:{fn:()=>qF(Emt),comment:`A random business-speak buzzword`},$randomBsNoun:{fn:()=>qF(Dmt),comment:`A random business-speak noun`},$randomCatchPhrase:{fn:()=>qF(Omt),comment:`A random catchphrase`},$randomCatchPhraseAdjective:{fn:()=>qF(kmt),comment:`A random catchphrase adjective`},$randomCatchPhraseDescriptor:{fn:()=>qF(Amt),comment:`A random catchphrase descriptor`},$randomCatchPhraseNoun:{fn:()=>qF(jmt),comment:`Randomly generates a catchphrase noun`},$randomDatabaseColumn:{fn:()=>qF(Mmt),comment:`A random database column name`},$randomDatabaseType:{fn:()=>qF(Nmt),comment:`A random database type`},$randomDatabaseCollation:{fn:()=>qF(Pmt),comment:`A random database collation`},$randomDatabaseEngine:{fn:()=>qF(Fmt),comment:`A random database engine`},$randomDateFuture:{fn:pht,comment:`A random future datetime`},$randomDatePast:{fn:mht,comment:`A random past datetime`},$randomDateRecent:{fn:hht,comment:`A random recent datetime`},$randomWeekday:{fn:()=>qF(Imt),comment:`A random weekday`},$randomMonth:{fn:()=>qF(Lmt),comment:`A random month`},$randomDomainName:{fn:()=>qF(Rmt),comment:`A random domain name`},$randomDomainSuffix:{fn:()=>qF(zmt),comment:`A random domain suffix`},$randomDomainWord:{fn:()=>qF(Bmt),comment:`A random unqualified domain name`},$randomEmail:{fn:()=>qF(Vmt),comment:`A random email address`},$randomExampleEmail:{fn:()=>qF(Hmt),comment:`A random email address from an example domain`},$randomUserName:{fn:()=>qF(Umt),comment:`A random username`},$randomUrl:{fn:()=>qF(Wmt),comment:`A random URL`},$randomFileName:{fn:()=>qF(Gmt),comment:`A random file name (includes uncommon extensions)`},$randomFileType:{fn:()=>qF(Kmt),comment:`A random file type (includes uncommon file types)`},$randomFileExt:{fn:()=>qF(qmt),comment:`A random file extension (includes uncommon extensions)`},$randomCommonFileName:{fn:()=>qF(Jmt),comment:`A random file name`},$randomCommonFileType:{fn:()=>qF(Ymt),comment:`A random, common file type`},$randomCommonFileExt:{fn:()=>qF(Xmt),comment:`A random, common file extension`},$randomFilePath:{fn:()=>qF(Zmt),comment:`A random file path`},$randomDirectoryPath:{fn:()=>qF(Qmt),comment:`A random directory path`},$randomMimeType:{fn:()=>qF($mt),comment:`A random MIME type`},$randomPrice:{fn:()=>(Math.random()*1e3).toFixed(2),comment:`A random price between 0.00 and 1000.00`},$randomProduct:{fn:()=>qF(eht),comment:`A random product`},$randomProductAdjective:{fn:()=>qF(tht),comment:`A random product adjective`},$randomProductMaterial:{fn:()=>qF(nht),comment:`A random product material`},$randomProductName:{fn:()=>qF(rht),comment:`A random product name`},$randomDepartment:{fn:()=>qF(iht),comment:`A random commerce department`},$randomNoun:{fn:()=>qF(aht),comment:`A random noun`},$randomVerb:{fn:()=>qF(oht),comment:`A random verb`},$randomIngverb:{fn:()=>qF(sht),comment:"A random verb ending in `-ing`"},$randomAdjective:{fn:()=>qF(cht),comment:`A random adjective`},$randomWord:{fn:()=>qF(UF),comment:`A random word`},$randomWords:{fn:()=>YF(UF,2,5),comment:`Some random words`},$randomPhrase:{fn:()=>qF(HF),comment:`A random phrase`},$randomLoremWord:{fn:()=>qF(WF),comment:`A random word of lorem ipsum text`},$randomLoremWords:{fn:()=>YF(WF,3,3),comment:`Some random words of lorem ipsum text`},$randomLoremSentence:{fn:()=>qF(GF),comment:`A random sentence of lorem ipsum text`},$randomLoremSentences:{fn:()=>XF(GF,2,6),comment:`A random 2 to 6 sentences of lorem ipsum text`},$randomLoremParagraph:{fn:()=>qF(KF),comment:`A random paragraph of lorem ipsum text`},$randomLoremParagraphs:{fn:()=>XF(KF,3,3),comment:`3 random paragraphs of lorem ipsum text`},$randomLoremText:{fn:()=>XF(KF,1,3),comment:`A random amount of lorem ipsum text`},$randomLoremSlug:{fn:()=>qF(lht),comment:`A random lorem ipsum URL slug`},$randomLoremLines:{fn:()=>ght(GF,1,5),comment:`1 to 5 random lines of lorem ipsum`}},QF=e=>ZF[e].comment,_ht=[`$guid`,`$timestamp`,`$isoTimestamp`,`$randomUUID`,`$randomEmail`,`$randomInt`,`$randomFirstName`,`$randomLastName`],vht=Object.keys(ZF),$F=e=>Object.hasOwn(ZF,e)})),bht,eI,tI,xht,Sht,nI,Cht,wht=s((()=>{ad(),lF(),fF(),upt(),yF(),AF(),wpt(),Opt(),jpt(),yht(),bht=[{header:`date`,scalarHeader:oge},{header:`dnt`,scalarHeader:sge},{header:`referer`,scalarHeader:cge},{header:`user-agent`,scalarHeader:age}],eI=(e,t)=>{let n=cF(e.value,t);return e.format===`basic`?`Basic ${kF(n)}`:e.format===`bearer`?`Bearer ${n}`:n},tI=e=>t=>$F(t)?ZF[t].fn()??null:e[t]??null,xht=(e,t,n)=>{let r=tI(t),i=new URLSearchParams;e.options?.disableSecurity||e.security.forEach(e=>{if(e.in!==`query`)return;let t=cF(e.name,r);i.append(t,eI(e,r))});let a=PF(e,{envVariables:r,securityQueryParams:i,allowMissingRequestServerBase:n?.allowMissingRequestServerBase??!0});if(!a.ok)throw Error(a.message??a.error);return MF(a.data,e.allowedReservedQueryParameters??new Set)},Sht=`BUILD_REQUEST_FAILED`,nI=(e,t)=>{let n=pF(()=>Cht(e,t));return n.ok?n.data:dF(Sht,n.error)},Cht=(e,t)=>{let n=tI(t.envVariables),r=new AbortController,i=(()=>{let t=new Headers;return e.headers.forEach((e,r)=>{t.set(cF(r,n),cF(e,n))}),t})(),a=(()=>{if(e.body?.mode===`raw`)return typeof e.body.value==`string`?cF(e.body.value,n):e.body.value;if(e.body?.mode===`formdata`){let t=new FormData;return e.body.value.forEach(e=>{if(e.type===`text`){t.append(cF(e.key,n),cF(e.value,n));return}t.append(cF(e.key,n),e.value)}),t}return e.body?.mode===`urlencoded`?new URLSearchParams(e.body.value.map(e=>[cF(e.key,n),cF(e.value,n)])):null})(),o=new URLSearchParams,s=[];e.options?.disableSecurity||e.security.forEach(e=>{let t=cF(e.name,n),r=eI(e,n);if(e.in===`header`){i.append(t,r);return}if(e.in===`query`){o.append(t,r);return}e.in===`cookie`&&s.push({name:t,value:r,isDisabled:!1})});let c=PF(e,{envVariables:n,securityQueryParams:o,allowMissingRequestServerBase:t.allowMissingRequestServerBase});if(!c.ok)return dF(c.error,c.message);let l=c.data,u=vF(e.proxyUrl,l),d=Cpt({cookies:[...e.cookies,...s].map(e=>({...e,name:cF(e.name,n),value:cF(e.value,n)})),originalCookieHeader:i.get(`cookie`),url:l,useCustomCookieHeader:(u||e.options?.isElectron)??!1});d&&i.set(d.name,d.value),(u||e.options?.isElectron)&&bht.forEach(({header:e,scalarHeader:t})=>{let n=i.get(e);n&&(i.set(t,n),i.delete(e))});let f=MF(l,e.allowedReservedQueryParameters??new Set);return uF({requestPayload:[u?_F(e.proxyUrl,f):f,{method:e.method.toUpperCase(),headers:i,body:a,cache:e.cache,signal:r.signal}],controller:r,isUsingProxy:u})}})),rI,Tht,Eht,Dht,Oht=s((()=>{zE(),rI=(e,t)=>`content`in t?Tht(e,Object.keys(t.content??{})[0]??``):`schema`in t?Dht(e,t.schema):e,Tht=(e,t)=>{if(typeof e==`string`&&t.includes(`json`))try{return JSON.parse(e)}catch{}return e},Eht=new Set([`array`,`object`,`boolean`,`number`,`integer`,`null`]),Dht=(e,t)=>{let n=RE(t);if(typeof e==`string`&&n&&`type`in n){let t=Array.isArray(n.type)?n.type[0]:n.type;if(t&&Eht.has(t))try{return JSON.parse(e)}catch{if(t===`array`)return e.split(/,\s?/).filter(e=>e!==``)}}return e}})),iI,aI,oI,sI,cI,lI,uI,kht=s((()=>{iI=(e,t)=>typeof e==`string`?e:t.includes(`json`)||typeof e==`object`&&e&&!Array.isArray(e)?JSON.stringify(e):String(e),aI=(e,t)=>{if(Array.isArray(e))return e.join(`,`);if(typeof e==`object`&&e){let n=Object.entries(e);return t?n.map(([e,t])=>`${e}=${t}`).join(`,`):n.map(([e,t])=>`${e},${t}`).join(`,`)}return e},oI=(e,t)=>Array.isArray(e)&&t?e.map(e=>({key:``,value:e})):Array.isArray(e)?e.join(`,`):typeof e==`object`&&e&&t?Object.entries(e).map(([e,t])=>({key:e,value:t})):typeof e==`object`&&e?Object.entries(e).map(([e,t])=>`${e},${t}`).join(`,`):e,sI=(e,t)=>{if(Array.isArray(e)&&t)return e.map(e=>({key:``,value:e}));if(Array.isArray(e))return e.map(e=>e===null?`null`:String(e)).join(`,`);if(typeof e==`object`&&e&&t)return Object.entries(e).map(([e,t])=>({key:e,value:t}));if(typeof e==`object`&&e){let t=e=>{let n=[];for(let[r,i]of Object.entries(e))typeof i==`object`&&i&&!Array.isArray(i)?n.push(r,...t(i)):n.push(r,i===null?`null`:String(i));return n};return t(e).join(`,`)}return e},cI=e=>Array.isArray(e)?e.join(` `):typeof e==`object`&&e?Object.entries(e).map(([e,t])=>`${e} ${t}`).join(` `):String(e),lI=e=>Array.isArray(e)?e.join(`|`):typeof e==`object`&&e?Object.entries(e).flat().join(`|`):String(e),uI=(e,t)=>{let n=[],r=(e,t)=>{for(let[i,a]of Object.entries(e)){let e=`${t}[${i}]`;typeof a==`object`&&a&&!Array.isArray(a)?r(a,e):n.push({key:e,value:String(a)})}};return typeof t==`object`&&t&&!Array.isArray(t)&&r(t,e),n}})),dI,Aht=s((()=>{dI=e=>e.variables.reduce((e,t)=>(e[t.name]=typeof t.value==`string`?t.value:t.value.default,e),{})})),fI,pI=s((()=>{fI=e=>Object.entries(e)})),mI,hI=s((()=>{pI(),mI=e=>e?fI(e?.variables??{}).reduce((e,[t,n])=>(n.default&&(e[t]=n.default),e),{}):{}})),gI,jht=s((()=>{lF(),Iu(),hI(),gI=({server:e,path:t,urlParams:n})=>{let r=mI(e);return Fu(lpt(e?.url??``,r),t,n)}})),_I,Mht=s((()=>{ME(),_I=(e,t=``)=>{let n=[];return e.forEach(e=>{if(e.type===`apiKey`){let r=e.name,i=e[`x-scalar-secret-token`]||t;if(e.in===`header`)return n.push({in:e.in,name:r,value:i});if(e.in===`query`)return n.push({in:`query`,name:r,value:i});if(e.in===`cookie`)return n.push({in:`cookie`,name:r,value:i})}if(e.type===`http`){if(e.scheme===`basic`){let t=`${e[`x-scalar-secret-username`]}:${e[`x-scalar-secret-password`]}`;return n.push({in:`header`,name:`Authorization`,value:t===`:`?`username:password`:t,format:`basic`})}let r=e[`x-scalar-secret-token`];return n.push({in:`header`,name:`Authorization`,value:r||t,format:`bearer`})}if(e.type===`oauth2`){let r=Object.values(e?.flows??{}).filter(jE).find(e=>e[`x-scalar-secret-token`])?.[`x-scalar-secret-token`]??``;return n.push({in:`header`,name:`Authorization`,value:r||t,format:`bearer`})}if(e.type===`openIdConnect`){let r=Object.values(e?.flows??{}).filter(jE).find(e=>e[`x-scalar-secret-token`])?.[`x-scalar-secret-token`]??``;return n.push({in:`header`,name:`Authorization`,value:r||t,format:`bearer`})}return null}),n}})),vI,Nht=s((()=>{vI=(e,t)=>{let n=t?.[`x-disabled`];return typeof n==`boolean`?n:!e.required&&e.in!==`path`}})),Pht,Fht,Iht,Lht,Rht,yI,zht,bI,xI=s((()=>{nd(),zE(),Nht(),Pht=`*/*`,Fht={accept:`Accept`,"content-type":`Content-Type`,"user-agent":`User-Agent`},Iht=e=>Fht[e.toLowerCase()]??e,Lht=e=>Object.fromEntries(Object.entries(e).map(([e,t])=>[Iht(e),t])),Rht=(e,t)=>{let n=new Set;for(let r of e.parameters??[]){let e=RE(r);if(e.in!==`header`)continue;let i=`examples`in e&&e.examples?.[t]?e.examples[t]:void 0;vI(e,i?RE(i):void 0)||n.add(e.name.toLowerCase())}return n},yI=(e,t,n,r)=>{let i=r.hideOverriddenHeaders?Rht(e,t):null,a=r.hideDisabledHeaders?e[`x-scalar-disable-parameters`]?.[`default-headers`]?.[t]??{}:null;return Object.fromEntries(Object.entries(n).filter(([e])=>{let t=e.toLowerCase();return!(i?.has(t)||a&&a[t]===!0)}))},zht=(e,t,n)=>yI(e,t,n,{hideOverriddenHeaders:!1,hideDisabledHeaders:!0}),bI=({method:e,operation:t,exampleName:n,hideDisabledHeaders:r=!1,hideOverriddenHeaders:i=!1,options:a={isElectron:!1,appVersion:`0.0.0`}})=>{let o=new Headers,s=RE(t.requestBody);if(ed(e)&&s){let e=s[`x-scalar-selected-content-type`]?.[n]??Object.keys(s.content??{})[0];e&&e!==`none`&&e!==`other`&&o.set(`Content-Type`,e)}let c=Object.keys(t.responses??{}).find(e=>e.startsWith(`2`)),l=c?RE(t.responses[c]):null,u=Object.keys(l?.content??{}).join(`, `)||Pht;o.set(`Accept`,u),a.isElectron&&a.appVersion&&o.set(`User-Agent`,`Scalar/${a.appVersion}`);let d=Object.fromEntries(o.entries());return i||r?yI(t,n,d,{hideOverriddenHeaders:i,hideDisabledHeaders:r}):d}})),SI,Bht,Vht=s((()=>{HE(),dD(),spt(),cpt(),SI=(e,t,n)=>e.content[t]?.encoding?.[n]?.contentType,Bht=(e,t=`default`,n)=>{if(!e)return null;let r=oF(e,t);if(!r)return null;let i=aF(e,r,t,n);if(!i)return null;if((r===`multipart/form-data`||r===`application/x-www-form-urlencoded`)&&Array.isArray(i.value)){let t=(Array.isArray(i.value)?i.value:[]).filter(e=>!e.isDisabled),n=r===`multipart/form-data`?{mode:`formdata`,value:[]}:{mode:`urlencoded`,value:[]};return t.forEach(({name:t,value:i})=>{if(!t)return;let a=n.mode===`formdata`?SI(e,r,t):void 0;if(i instanceof File&&n.mode===`formdata`){let e=uD(i),r=a&&a!==e.type?new File([e],e.name,{type:a,lastModified:e.lastModified}):e;return n.value.push({type:`file`,key:t,value:r,contentType:a})}if(i!=null){let e=typeof i==`object`&&i?JSON.stringify(uD(i)):String(i);return n.mode===`formdata`&&a?n.value.push({type:`blob`,key:t,value:new Blob([e],{type:a}),contentType:a}):n.value.push({type:`text`,key:t,value:e})}}),n}if(r===`application/x-www-form-urlencoded`&&BE(i.value)){let e={mode:`urlencoded`,value:[]};for(let[t,n]of Object.entries(i.value))if(t&&n!=null){let r=typeof n==`object`&&n?JSON.stringify(uD(n)):String(n);e.value.push({key:t,value:r})}return e}if(r===`multipart/form-data`&&BE(i.value)){let t={mode:`formdata`,value:[]};for(let[n,a]of Object.entries(i.value)){if(!n||a==null)continue;let i=SI(e,r,n);if(a instanceof File){let e=uD(a),r=i&&i!==e.type?new File([e],e.name,{type:i,lastModified:e.lastModified}):e;t.value.push({type:`file`,key:n,value:r,contentType:i});continue}let o=typeof a==`object`&&a?JSON.stringify(uD(a)):String(a);if(i){t.value.push({type:`blob`,key:n,value:new Blob([o],{type:i}),contentType:i});continue}t.value.push({type:`text`,key:n,value:o})}return t}let a=i.value!==null&&typeof i.value==`object`?uD(i.value):i.value;return a instanceof File?{mode:`raw`,value:a,contentType:a.type}:typeof a==`object`?{mode:`raw`,value:JSON.stringify(a),contentType:`application/json`}:{mode:`raw`,value:a}}})),CI,Hht,Uht,Wht,wI,Ght,Kht,qht=s((()=>{ME(),HE(),zE(),yN(),oN(),Oht(),mD(),Nht(),kht(),CI=(e,t)=>`explode`in e&&e.explode!==void 0?e.explode:t,Hht=(e=[],t=`default`)=>{let n={cookies:[],headers:{},pathVariables:{},allowReservedQueryParameters:new Set,urlParams:new URLSearchParams};if(e.length===0)return n;for(let r of e){let e=RE(r),i=pD(e,t,void 0);if(!i||vI(e,i))continue;let a=i.value,o=rI(a,e),s=e.name;switch(e.in){case`header`:{if(s.toLowerCase()===`content-type`&&o===`multipart/form-data`)break;let t=aI(o,CI(e,!1));if(!jE(t))break;let r=String(t);n.headers[s]?n.headers[s]=`${n.headers[s]},${r}`:n.headers[s]=r;break}case`path`:{let t=aI(o,CI(e,!1));n.pathVariables[s]=String(t);break}case`query`:Ght(e,s,o,n.urlParams,n.allowReservedQueryParameters);break;case`cookie`:Kht(s,o,CI(e,!0),n.cookies);break}}return n},Uht=(e,t)=>!(`style`in e)||!e.style?`form`:e.style===`deepObject`?BE(t)?`deepObject`:`form`:e.style,Wht=e=>`allowReserved`in e&&e.allowReserved!==void 0?e.allowReserved:`schema`in e&&e.schema&&typeof e.schema==`object`&&`allowReserved`in e.schema?e.schema.allowReserved===!0:!1,wI=(e,t,...n)=>{if(t)for(let t of n)e.add(t)},Ght=(e,t,n,r,i)=>{let a=`explode`in e&&e.explode!==void 0?e.explode:!0,o=Wht(e),s=Uht(e,n);if(`content`in e&&e.content){let a=iI(n,Object.keys(e.content)[0]??`application/json`);r.set(t,a),wI(i,o,t);return}if(s===`deepObject`&&a){let e=uI(t,n);for(let n of e)r.append(n.key,n.value),wI(i,o,t);return}if(s===`spaceDelimited`){let e=cI(n),a=r.get(t);r.set(t,a?`${a} ${e}`:e),wI(i,o,t);return}if(s===`pipeDelimited`){let e=lI(n),a=r.get(t);r.set(t,a?`${a}|${e}`:e),wI(i,o,t);return}let c=oI(n,a);if(Array.isArray(c))for(let e of c){let n=e.key||t;r.append(n,String(e.value)),wI(i,o,t)}else r.append(t,String(c)),wI(i,o,t)},Kht=(e,t,n,r)=>{let i=sI(t,n);if(Array.isArray(i))for(let t of i){let n=t.key||e;r.push(aN(vN,{name:n,value:String(t.value),path:`/`}))}else r.push(aN(vN,{name:e,value:String(i),path:`/`}))}})),TI,Jht=s((()=>{nd(),lF(),zE(),hI(),Mht(),xI(),Vht(),qht(),TI=({exampleName:e,globalCookies:t,method:n,operation:r,path:i,proxyUrl:a,server:o,defaultHeaders:s,isElectron:c,selectedSecuritySchemes:l,requestBodyCompositionSelection:u})=>{let d=RE(r.requestBody),f=Hht(r.parameters??[],e),p=_I(l),m=new Headers({...zht(r,e,s),...f.headers}),h=ed(n)?Bht(d,e,u):null;(h?.mode===`formdata`||h?.mode===`urlencoded`)&&m.delete(`Content-Type`);let g=mI(o),_=sF(o?.url??``,g),v=r[`x-scalar-disable-parameters`]?.[`global-cookies`]?.[e]??{},y=[...t.map(e=>({...e,isDisabled:(e.isDisabled||v[e.name.toLowerCase()])??!1})),...f.cookies],b=m.get(`Accept`)?.toLowerCase().includes(`text/event-stream`)??!1,x=b?`no-store`:`default`;return b&&(m.set(`Cache-Control`,`no-cache`),m.set(`Pragma`,`no-cache`)),{request:{baseUrl:_,proxyUrl:a,path:{variables:f.pathVariables,raw:i},query:f.urlParams,method:n.toUpperCase(),headers:m,body:h,cookies:y,cache:x,security:p,options:{isElectron:c},allowedReservedQueryParameters:f.allowReservedQueryParameters}}}})),Yht=s((()=>{spt(),cpt(),wht(),Oht(),ypt(),kht(),Aht(),mD(),opt(),jht(),hI(),Jht(),Mht()})),EI,DI,Xht,OI=s((()=>{EI=e=>typeof e==`object`&&!!e&&`openapi`in e&&typeof e.openapi==`string`,DI=e=>typeof e==`object`&&!!e&&`asyncapi`in e&&typeof e.asyncapi==`string`,Xht=e=>{if(EI(e))return`openapi`;if(DI(e))return`asyncapi`}})),kI,Zht=s((()=>{dN(),OI(),oN(),kI=(e,t)=>{if(e===null)return{name:null,environment:aN(uN,{})};let n=e.workspace[`x-scalar-active-environment`];if(!n)return{name:null,environment:aN(uN,{})};let r=e.workspace[`x-scalar-environments`]?.[n]??{variables:[]},i=(EI(t)?t[`x-scalar-environments`]?.[n]:void 0)??{variables:[]};return{name:n,environment:aN(uN,{...r,...i,variables:[...r.variables,...i.variables]})}}})),AI,Qht=s((()=>{zE(),AI=(e=[],t=[])=>{let n=t.flatMap(e=>{let t=RE(e);return t?`${t.in}:${t.name}`:[]}),r=new Set(n);return[...e.filter(e=>{let t=RE(e);return t?!r.has(`${t.in}:${t.name}`):!1}),...t]}})),$ht,jI,egt=s((()=>{$ht=e=>e===`web`?`https://proxy.scalar.com`:null,jI=(e,t)=>e===void 0?$ht(t):e})),MI,tgt=s((()=>{MI=(e,t)=>JSON.stringify(t)===`[{}]`&&e?.length?e.find(e=>JSON.stringify(e)===`{}`)?e:[...e,{}]:t??e??[]})),NI,PI=s((()=>{NI=e=>Object.keys(e)})),FI,ngt=s((()=>{PI(),zE(),FI=(e,t)=>NI(t).flatMap(t=>RE(e?.[t])||[])})),II,rgt=s((()=>{II=e=>{let t=e.some(e=>Object.keys(e).length>1);return e.some(e=>Object.keys(e).length===0)&&!t}})),LI,igt,agt,RI,zI=s((()=>{zE(),rgt(),LI=e=>!e||e.type!==`oauth2`?[]:e[`x-default-scopes`]??[],igt=(e,t)=>Object.fromEntries(Object.entries(e).map(([e,n])=>{if(Array.isArray(n)&&n.length>0)return[e,[...n]];let r=RE(t[e]),i=r?.type===`oauth2`?r[`x-default-scopes`]:void 0;return Array.isArray(i)&&i.length>0?[e,[...i]]:[e,Array.isArray(n)?[...n]:n]})),agt=(e,t)=>{if(!Array.isArray(e)){let n=RE(t[e]);return{[e]:LI(n)}}let n={};for(let r of e)if(Array.isArray(r))for(let e of r)n[e]=LI(RE(t[e]));else n[r]=LI(RE(t[r]));return n},RI=(e,t,n=[],r={},i)=>{if(t)return t;if(e)return e;if(II(n)&&!i)return{selectedIndex:-1,selectedSchemes:[]};if(i)return{selectedIndex:0,selectedSchemes:[agt(i,r)]};let a=n[0];return a?{selectedIndex:0,selectedSchemes:[igt(a,r)]}:{selectedIndex:-1,selectedSchemes:[]}}})),BI,VI=s((()=>{BI=(e,t=new WeakMap)=>{if(typeof e!=`object`||!e)return e;if(t.has(e))return t.get(e);let n=Array.isArray(e)?[]:{};return t.set(e,n),Object.keys(e).forEach(r=>{n[r]=BI(e[r],t)}),n}})),HI,UI=s((()=>{rD(),HI=(e,t,n=!1,r=new Set)=>{for(let i in t)if(!(i in e))e[i]=t[i];else{let a=e[i],o=t[i];if(typeof a==`object`&&a&&typeof o==`object`&&o&&!(n&&(Array.isArray(a)||Array.isArray(o)))){let e=XE(a),t=XE(o);if(r.has(e)||r.has(t))continue;r.add(e),r.add(t),HI(a,o,n,r)}else try{e[i]=o}catch(e){console.warn(`Issue setting ${i} on object`),console.warn(e)}}return e}})),WI,GI,KI,qI,JI,ogt,sgt=s((()=>{HE(),pI(),WI={"x-scalar-secret-client-id":`x-scalar-client-id`,"x-scalar-secret-client-secret":`clientSecret`,"x-scalar-secret-password":`password`,"x-scalar-secret-redirect-uri":`x-scalar-redirect-uri`,"x-scalar-secret-token":`token`,"x-scalar-secret-username":`username`,"x-scalar-secret-auth-url":`authorizationUrl`,"x-scalar-secret-token-url":`tokenUrl`},GI=(e,t,n={})=>Object.fromEntries(e.map(e=>{let r=typeof n[e]==`string`?n[e]:void 0,i=typeof t[e]==`string`?t[e]:void 0,a=typeof t[WI[e]]==`string`?t[WI[e]]:void 0;return[e,e===`x-scalar-secret-redirect-uri`?r??i??a??``:r||i||a||``]})),KI=(e={})=>{let t=e[`x-scalar-secret-refresh-token`];return typeof t==`string`?{"x-scalar-secret-refresh-token":t}:{}},qI=(e,t={})=>{let n=t[`x-scalar-credentials-location`]??e[`x-scalar-credentials-location`];return n?{"x-scalar-credentials-location":n}:{}},JI=(e,t)=>{let n=new Set;return{flows:fI(e??{}).reduce((e,[r,i])=>{if(!BE(i))return e;let a=i.selectedScopes;return Array.isArray(a)&&a.forEach(e=>typeof e==`string`&&n.add(e)),r===`implicit`&&(e.implicit={...i,...GI([`x-scalar-secret-client-id`,`x-scalar-secret-redirect-uri`,`x-scalar-secret-token`,`x-scalar-secret-auth-url`],i,t?.implicit),...KI(t?.implicit)}),r===`password`&&(e[r]={...i,...GI([`x-scalar-secret-client-id`,`x-scalar-secret-client-secret`,`x-scalar-secret-username`,`x-scalar-secret-password`,`x-scalar-secret-token`,`x-scalar-secret-token-url`],i,t?.password),...qI(i,t?.password),...KI(t?.password)}),r===`clientCredentials`&&(e[r]={...i,...GI([`x-scalar-secret-client-id`,`x-scalar-secret-client-secret`,`x-scalar-secret-token`,`x-scalar-secret-token-url`],i,t?.clientCredentials),...qI(i,t?.clientCredentials),...KI(t?.clientCredentials)}),r===`authorizationCode`&&(e[r]={...i,...GI([`x-scalar-secret-client-id`,`x-scalar-secret-client-secret`,`x-scalar-secret-redirect-uri`,`x-scalar-secret-token`,`x-scalar-secret-auth-url`,`x-scalar-secret-token-url`],i,t?.authorizationCode),...qI(i,t?.authorizationCode),...KI(t?.authorizationCode)}),e},{}),selectedScopes:Array.from(n)}},ogt=(e,t,n,r)=>{let i=t.getAuthSecrets(r,n);if(e.type===`apiKey`){let t=i?.type===`apiKey`?i:void 0;return{...e,"x-scalar-secret-token":t?.[`x-scalar-secret-token`]||e.value||``}}if(e.type===`http`){let t=i?.type===`http`?i:void 0;return{...e,"x-scalar-secret-token":t?.[`x-scalar-secret-token`]||e.token||``,"x-scalar-secret-username":t?.[`x-scalar-secret-username`]||e.username||``,"x-scalar-secret-password":t?.[`x-scalar-secret-password`]||e.password||``}}if(e.type===`oauth2`){let t=i?.type===`oauth2`?i:void 0,n=JI(e.flows,t),r=Array.isArray(e[`x-default-scopes`])?e[`x-default-scopes`].filter(e=>typeof e==`string`):[],a=Array.from(new Set([...r,...n.selectedScopes]));return{...e,flows:n.flows,"x-default-scopes":a}}if(e.type===`openIdConnect`){let t=i?.type===`openIdConnect`?i:void 0,n=JI({implicit:t?.implicit,password:t?.password,clientCredentials:t?.clientCredentials,authorizationCode:t?.authorizationCode},t);return{...e,...fI(n.flows).length?{flows:n.flows}:{}}}return e}})),YI,cgt=s((()=>{pI(),VI(),zE(),UI(),oN(),VP(),sgt(),YI=(e={},t={},n,r)=>fI(HI(fI(e).reduce((e,[t,n])=>{let r=BI(RE(n));return r&&(e[t]=r),e},{}),t)??{}).reduce((e,[t,i])=>(e[t]=ogt({...aN(Uft,i),...i},n,t,r),e),{})}));function XI(e,t={}){return Array.isArray(e)?e.map(e=>fgt(e,t)):[]}function lgt(e){try{let t=new URL(e),n=t.port?`:${t.port}`:``;return`${t.protocol}//${t.hostname}${n}`}catch{return}}function ugt(){if(!(typeof window>`u`||typeof window?.location?.origin!=`string`))return window.location.origin}function dgt(e,t){let{baseServerUrl:n,documentUrl:r}=t;if(n)return Pu(n,e);if(r){let t=lgt(r);if(t)return Pu(t,e)}let i=ugt();return i?Pu(i,e):e}function fgt(e,t){return e.url?.startsWith(`/`)&&(e.url=dgt(e.url,t)),e}var ZI,pgt=s((()=>{Iu(),OI(),ZI=(e,t,n,r)=>{let i=EI(e)?e[`x-scalar-selected-server`]:void 0,a=n==null?t?.[`x-scalar-selected-server`]??i:i;return a==null?r[0]??null:r.find(({url:e})=>e===a)??null}})),mgt,hgt=s((()=>{zE(),Zht(),xI(),Qht(),egt(),tgt(),ngt(),zI(),cgt(),pgt(),OI(),mgt=(e,t,n,r={})=>{let{path:i,method:a,exampleName:o}=n,s=e.workspace.documents[t]??r.fallbackDocument??void 0;if(!s)return{ok:!1,error:`Document ${t} not found`};if(!EI(s))return{ok:!1,error:`Document ${t} is not an OpenAPI document`};let c=RE(s.paths?.[i]);if(!c)return{ok:!1,error:`Path ${i} not found`};let l=RE(c[a]);if(!l)return{ok:!1,error:`Method ${a} not found on path ${i}`};let u={...l,parameters:AI(c.parameters,l.parameters??[])},d=kI(e,s),f=XI(r.servers??u.servers??s.servers,{baseServerUrl:r.baseServerUrl,documentUrl:s[`x-scalar-original-source-url`]}),p=ZI(s,u,r.servers??null,f),m=e.auth.getAuthSelectedSchemas({type:`document`,documentName:t}),h=e.auth.getAuthSelectedSchemas({type:`operation`,documentName:t,path:i??``,method:a??`get`}),g=YI(s.components?.securitySchemes??{},r.authentication?.securitySchemes??{},e.auth,t),_=MI(s.security,u.security),v=RI(m,h,_,g,r.authentication?.preferredSecurityScheme),y=FI(g,v.selectedSchemes[v.selectedIndex]??{}),b=u.servers==null?{type:`document`}:{type:`operation`,path:i??``,method:a??`get`},x=h===void 0?{type:`document`}:{type:`operation`,path:i??``,method:a??`get`},S=jI(e.workspace[`x-scalar-active-proxy`],r.layout??`other`),C=bI({method:a,operation:u,exampleName:o,options:{appVersion:r.appVersion??`0.0.0`,isElectron:r.isElectron??!1}});return{ok:!0,data:{operation:u,environment:d,cookies:{workspace:e.workspace[`x-scalar-cookies`]??[],document:s[`x-scalar-cookies`]??[]},headers:{default:C},servers:{list:f,selected:p,meta:b},proxy:{url:S},security:{schemes:g,requirements:_,selected:v,selectedSchemes:y,meta:x}}}}})),ggt=s((()=>{Zht(),hgt(),xI(),Qht(),egt(),tgt(),ngt(),zI(),rgt(),cgt(),pgt()}));function _gt(){let e=[],t=[],n=[],r=[];return{getEnvironment:()=>e,getGlobals:()=>n,getCollectionVariables:()=>t,getData:()=>({}),getLocalVariables:()=>r,setLocalVariables:e=>{r.length=0,r.push(...e)},setCollectionVariables:e=>{t.length=0,t.push(...e)},setEnvironment:t=>{e.length=0,e.push(...t)},setGlobals:e=>{n.length=0,n.push(...e)},getVariables:()=>Object.fromEntries([...n,...t,...e,...r].map(e=>[e.key,e.value]))}}var vgt=s((()=>{})),QI=s((()=>{Yht(),ggt(),yht(),vgt()})),ygt,bgt,xgt=s((()=>{IE(),QI(),zE(),ygt=e=>e==null?!0:typeof e==`string`?e.trim()===``:!1,bgt=(e=[],t=`default`)=>{let n=[];for(let r of e){let e=RE(r);if(e.in!==`path`)continue;let i=pD(e,t,void 0);FE(e,i)||ygt(i?.value)&&n.push(e.name)}return n.length>0?{ok:!1,invalidParams:n}:{ok:!0}}})),$I,eL,Sgt=s((()=>{pI(),$I={c:[`libcurl`],clojure:[`clj_http`],csharp:[`httpclient`,`restsharp`],dart:[`http`],fsharp:[`httpclient`],go:[`native`],http:[`http1.1`],java:[`asynchttp`,`nethttp`,`okhttp`,`unirest`],js:[`axios`,`fetch`,`jquery`,`ofetch`,`xhr`],kotlin:[`okhttp`],node:[`axios`,`fetch`,`ofetch`,`undici`],objc:[`nsurlsession`],ocaml:[`cohttp`],php:[`curl`,`guzzle`,`laravel`],powershell:[`restmethod`,`webrequest`],python:[`python3`,`requests`,`aiohttp`,`httpx_sync`,`httpx_async`],r:[`httr2`],ruby:[`native`],rust:[`reqwest`],shell:[`curl`,`httpie`,`wget`],swift:[`nsurlsession`]},eL=fI($I).flatMap(([e,t])=>t.map(t=>`${e}/${t}`))})),tL=s((()=>{Sgt()})),Cgt,nL,wgt,Tgt,Egt,Dgt,rL,Ogt,kgt=s((()=>{Cgt=e=>(e||`GET`).toUpperCase(),nL=e=>e.replaceAll(`\\`,`\\\\`).replaceAll(`"`,`\\"`).replaceAll(`
-`,`\\n`).replaceAll(`\r`,`\\r`).replaceAll(`	`,`\\t`),wgt=e=>{if(!e)return``;try{let t=new URL(e),n=t.pathname===`/`&&!e.endsWith(`/`)&&!e.includes(`?`)&&!e.includes(`#`)?``:t.pathname;return`${t.protocol}//${t.host}${n}${t.search}${t.hash}`}catch{return e}},Tgt=(e,t)=>{let n=t?.length?t.map(e=>`${e.name}=${e.value}`).join(`&`):``;return n?e?`${e}${e.includes(`?`)?`&`:`?`}${n}`:`?${n}`:e},Egt=e=>e?.length?e.map(e=>`${encodeURIComponent(e.name)}=${encodeURIComponent(e.value)}`).join(`; `):null,Dgt=e=>e?.length?e.map(e=>new URLSearchParams([[e.name,e.value??``]]).toString()).join(`&`):null,rL=e=>{if(e===void 0)return``;try{return JSON.stringify(JSON.parse(e),null,2)}catch{return e}},Ogt={target:`c`,client:`libcurl`,title:`Libcurl`,generate(e,t){if(!e)return``;let n=Cgt(e.method),r=Tgt(wgt(e.url??``),e.queryString),i=!!e.headers?.length,a=!!e.cookies?.length,o=e.postData,s=o?.mimeType===`multipart/form-data`&&!!o.params?.length,c=e.headers??[],l=c.some(e=>e.name.toLowerCase()===`accept-encoding`&&/gzip|deflate/.test(e.value)),u=[`#include <curl/curl.h>`,``,`int main(void) {`,`  curl_global_init(CURL_GLOBAL_DEFAULT);`,`  CURL *curl = curl_easy_init();`,`  if (!curl) {`,`    curl_global_cleanup();`,`    return 1;`,`  }`,``,`  curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "${nL(n)}");`,`  curl_easy_setopt(curl, CURLOPT_URL, "${nL(r)}");`];if(t?.auth?.username&&t.auth.password&&u.push(`  curl_easy_setopt(curl, CURLOPT_USERPWD, "${nL(`${t.auth.username}:${t.auth.password}`)}");`),i&&(u.push(``,`  struct curl_slist *headers = NULL;`),c.forEach(e=>{u.push(`  headers = curl_slist_append(headers, "${nL(`${e.name}: ${e.value}`)}");`)}),u.push(`  curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);`)),a){let t=Egt(e.cookies);t&&u.push(``,`  curl_easy_setopt(curl, CURLOPT_COOKIE, "${nL(t)}");`)}if(l&&u.push(``,`  curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, "");`),o){if(s&&o.params)u.push(``,`  curl_mime *mime = curl_mime_init(curl);`),o.params.forEach(e=>{u.push(``,`  {`,`    curl_mimepart *part = curl_mime_addpart(mime);`),e.name&&u.push(`    curl_mime_name(part, "${nL(e.name)}");`),e.fileName===void 0?u.push(`    curl_mime_data(part, "${nL(e.value??``)}", CURL_ZERO_TERMINATED);`):u.push(`    curl_mime_filedata(part, "${nL(e.fileName)}");`),e.contentType&&u.push(`    curl_mime_type(part, "${nL(e.contentType)}");`),u.push(`  }`)}),u.push(``,`  curl_easy_setopt(curl, CURLOPT_MIMEPOST, mime);`);else if(o.mimeType===`application/x-www-form-urlencoded`&&o.params?.length){let e=Dgt(o.params);e!==null&&u.push(``,`  curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "${nL(e)}");`)}else if(o.mimeType===`application/json`&&o.text!==void 0)u.push(``,`  curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "${nL(rL(o.text))}");`);else if(o.text!==void 0){let e=o.mimeType===`application/octet-stream`?o.text:rL(o.text);u.push(``,`  curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "${nL(e)}");`)}}return u.push(``,`  CURLcode res = curl_easy_perform(curl);`),u.push(`  curl_easy_cleanup(curl);`),s&&u.push(`  curl_mime_free(mime);`),i&&u.push(`  curl_slist_free_all(headers);`),u.push(`  curl_global_cleanup();`,``,`  return (int)res;`,`}`),u.join(`
-`)}}})),Agt=s((()=>{kgt()})),iL,aL,oL,sL=s((()=>{iL=``,aL=`
-`,oL=class{postProcessors;code;indentationCharacter;lineJoin;indentLine;unshift;push;blank;join;addPostProcessor;constructor({indent:e,join:t}={}){this.postProcessors=[],this.code=[],this.indentationCharacter=iL,this.lineJoin=aL,this.indentLine=(e,t=0)=>`${this.indentationCharacter.repeat(t)}${e}`,this.unshift=(e,t)=>{let n=this.indentLine(e,t);this.code.unshift(n)},this.push=(e,t)=>{let n=this.indentLine(e,t);this.code.push(n)},this.blank=()=>{this.code.push(``)},this.join=()=>{let e=this.code.join(this.lineJoin);return this.postProcessors.reduce((e,t)=>t(e),e)},this.addPostProcessor=e=>{this.postProcessors=[...this.postProcessors,e]},this.indentationCharacter=e||iL,this.lineJoin=t??aL}}})),cL,lL,uL,dL=s((()=>{cL=(e,t)=>Object.keys(e).find(e=>e.toLowerCase()===t.toLowerCase()),lL=(e,t)=>{let n=cL(e,t);if(n)return e[n]},uL=(e,t)=>!!cL(e,t)})),fL,jgt,pL,mL,hL,gL,_L,Mgt,Ngt=s((()=>{sL(),dL(),fL=class{name;toString;constructor(e){this.name=``,this.toString=()=>`:${this.name}`,this.name=e}},jgt=class{path;toString;constructor(e){this.path=``,this.toString=()=>`(clojure.java.io/file "${this.path}")`,this.path=e}},pL=e=>e===void 0?null:e===null?`null`:e.constructor.name.toLowerCase(),mL=e=>pL(e)===`object`?Object.keys(e).length===0:!1,hL=e=>(Object.keys(e).filter(t=>mL(e[t])).forEach(t=>{delete e[t]}),e),gL=(e,t)=>{let n=` `.repeat(e);return t.replace(/\n/g,`\n${n}`)},_L=e=>{switch(pL(e)){case`string`:return`"${e.replace(/"/g,`\\"`)}"`;case`file`:return e.toString();case`keyword`:return e.toString();case`null`:return`nil`;case`regexp`:return`#"${e.source}"`;case`object`:return`{${gL(1,Object.keys(e).reduce((t,n)=>`${t}:${n} ${gL(n.length+2,_L(e[n]))}\n `,``).trim())}}`;case`array`:return`[${gL(1,e.reduce((e,t)=>`${e} ${_L(t)}`,``).trim())}]`;default:return e.toString()}},Mgt={info:{key:`clj_http`,title:`clj-http`,link:`https://github.com/dakrone/clj-http`,description:`An idiomatic clojure http client wrapping the apache client.`},convert:({queryObj:e,method:t,postData:n,url:r,allHeaders:i},a)=>{let{push:o,join:s}=new oL({indent:a?.indent});if(t=t.toLowerCase(),![`get`,`post`,`put`,`delete`,`patch`,`head`,`options`].includes(t))return o(`Method not supported`),s();let c={headers:i,"query-params":e};switch(e&&Object.keys(e).length>0&&(r=r.split(`?`)[0]),n?.mimeType){case`application/json`:{c[`content-type`]=new fL(`json`),c[`form-params`]=n.jsonObj;let e=cL(c.headers,`content-type`);e&&delete c.headers[e]}break;case`application/x-www-form-urlencoded`:{c[`form-params`]=n.paramsObj;let e=cL(c.headers,`content-type`);e&&delete c.headers[e]}break;case`text/plain`:{c.body=n.text;let e=cL(c.headers,`content-type`);e&&delete c.headers[e]}break;case`multipart/form-data`:if(n?.params){c.multipart=n.params.map(e=>e.fileName&&!e.value?{name:e.name,content:new jgt(e.fileName)}:{name:e.name,content:e.value});let e=cL(c.headers,`content-type`);e&&delete c.headers[e]}break}switch(lL(c.headers,`accept`)){case`application/json`:{c.accept=new fL(`json`);let e=cL(c.headers,`accept`);e&&delete c.headers[e]}break}if(o(`(require '[clj-http.client :as client])
-`),mL(hL(c)))o(`(client/${t} "${r}")`);else{let e=gL(11+t.length+r.length,_L(hL(c)));o(`(client/${t} "${r}" ${e})`)}return s()}}}));function Pgt(e){return{...e,method:(e.method||`GET`).toUpperCase()}}function vL(e){return e?.length?`?${e.map(e=>`${e.name}=${e.value}`).join(`&`)}`:``}function yL(e=[]){return e.reduce((e,{name:t,value:n})=>(wL(e,t,n),e),{})}function Fgt(e,t){return`${e}${t}`}function Igt(e){let t={};if(e.headers)for(let n of e.headers)n.value&&!/[; ]/.test(n.name)&&(t[n.name]=n.value);return e.cookies&&e.cookies.length>0&&(t.Cookie=e.cookies.map(e=>`${encodeURIComponent(e.name)}=${encodeURIComponent(e.value)}`).join(`; `)),t}var bL,xL,SL,CL,wL,TL=s((()=>{bL=e=>(e||`GET`).toUpperCase(),xL=e=>{if(!e)return``;try{let t=new URL(e);return t.pathname===`/`?`${t.origin}${t.search}${t.hash}`:t.toString()}catch{return e}},SL=(e,t)=>{let n=vL(t);return n?e?`${e}${e.includes(`?`)?`&`:`?`}${n.slice(1)}`:n:e},CL=(e,t)=>{let n=new Map;if(e?.forEach(e=>{e.name&&n.set(e.name,e.value??``)}),t?.length){let e=t.map(e=>`${encodeURIComponent(e.name)}=${encodeURIComponent(e.value)}`).join(`; `);n.set(`Cookie`,e)}return Array.from(n.entries()).map(([e,t])=>({name:e,value:t}))},wL=(e,t,n)=>{let r=e[t];r===void 0?e[t]=n:Array.isArray(r)?r.push(n):e[t]=[r,n]}}));function EL(e,t){let n=new URL(t?.url??``),r=n.pathname===`/`?n.origin:n.toString(),i={method:t?.method??`GET`,url:r,httpVersion:`HTTP/1.1`,cookies:[],headers:t?.headers??[],headersSize:-1,bodySize:-1,queryString:Array.from(n.searchParams.entries()).map(([e,t])=>({name:e,value:t})),postData:t?.postData},a=(i?.headers??[]).reduce((e,t)=>({...e,[t.name]:t.value}),{}),o=yL(i.queryString),s=(i.cookies??[]).reduce((e,t)=>({...e,[t.name]:t.value}),{}),c=new URL(i.url),l={protocol:c.protocol,hostname:c.hostname,host:c.hostname,port:c.port,pathname:c.pathname.split(`/`).map(e=>encodeURIComponent(decodeURIComponent(e))).join(`/`)+c.search,path:c.pathname.split(`/`).map(e=>encodeURIComponent(decodeURIComponent(e))).join(`/`)+c.search,search:c.search,hash:c.hash,href:c.href,origin:c.origin,password:c.password,searchParams:c.searchParams,username:c.username,toString:c.toString,toJSON:()=>c.toJSON()},u={url:i.url,uriObj:l,method:i.method?.toLocaleUpperCase()??`GET`,httpVersion:i.httpVersion,cookies:i.cookies??[],headers:i.headers??[],headersSize:i.headersSize??0,headersObj:a??{},bodySize:i.bodySize??0,queryString:i.queryString??[],postData:i.postData?{mimeType:i.postData.mimeType??`application/json`,text:i.postData.text??``,params:i.postData.params??[],paramsObj:i.postData.params?.reduce((e,t)=>(t.name&&t.value!==void 0&&(e[t.name]=t.value),e),{})??{}}:void 0,allHeaders:a??{},fullUrl:i.url,queryObj:o??{},cookiesObj:s??{}};if(u.postData?.mimeType===`application/json`&&u.postData.text)try{u.postData.jsonObj=JSON.parse(u.postData.text)}catch(e){console.error(`Error parsing JSON:`,e)}return typeof e.convert==`function`?e.convert(u):``}var DL=s((()=>{TL()})),Lgt,Rgt=s((()=>{Ngt(),DL(),Lgt={target:`clojure`,client:`clj_http`,title:`clj-http`,generate(e){return EL(Mgt,e)}}})),zgt=s((()=>{Rgt()}));function Bgt(e){switch(e){case`GET`:return`HttpMethod.Get`;case`POST`:return`HttpMethod.Post`;case`PUT`:return`HttpMethod.Put`;case`DELETE`:return`HttpMethod.Delete`;case`PATCH`:return`HttpMethod.Patch`;case`HEAD`:return`HttpMethod.Head`;case`OPTIONS`:return`HttpMethod.Options`;default:return`new HttpMethod("${e}")`}}function Vgt(e,t,n){let r=t.headers||[],i=t.cookies||[],a=r.find(e=>e.name.toLowerCase()===`authorization`);if(a){let[t,n]=a.value.split(` `,2);t&&n&&e.push(`request.Headers.Authorization = new AuthenticationHeaderValue("${t}", "${n}");`)}else if(n?.auth?.username&&n?.auth?.password){let t=kF(`${n.auth.username}:${n.auth.password}`);e.push(`request.Headers.Authorization = new AuthenticationHeaderValue("Basic", "${t}");`)}let o=new Map;for(let e of r){let t=e.name,n=e.value;t.toLowerCase()!==`authorization`&&o.set(t,n)}for(let[n,r]of o)if(n.toLowerCase()===`accept`&&Ugt(r))e.push(`request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("${r}"));`);else if(n.toLowerCase()===`content-type`&&t.postData)continue;else e.push(`request.Headers.TryAddWithoutValidation("${n}", "${r}");`);if(i.length>0){let t=i.map(e=>`${e.name}=${e.value}`).join(`; `);e.push(`request.Headers.TryAddWithoutValidation("Cookie", "${t}");`)}}function Hgt(e,t){if(!t.postData)return;let{mimeType:n,text:r,params:i}=t.postData;if(n===`application/json`&&r)try{let t=JSON.parse(r),n=OL(JSON.stringify(t,null,2));e.push(`request.Content = new StringContent(`),e.push(`${n},`),e.push(`System.Text.Encoding.UTF8, "application/json");`)}catch{let t=OL(r);e.push(`request.Content = new StringContent(`),e.push(`${t},`),e.push(`System.Text.Encoding.UTF8, "application/json");`)}else if(n===`application/x-www-form-urlencoded`&&i){let t=i.map(e=>e.name);if(t.length!==new Set(t).size){e.push(`var formParams = new List<KeyValuePair<string, string>>`),e.push(`{`);for(let t of i)e.push(`  new("${t.name}", "${t.value}"),`);e.push(`};`),e.push(`request.Content = new FormUrlEncodedContent(formParams);`)}else{e.push(`var formParams = new Dictionary<string, string>`),e.push(`{`);for(let t of i)e.push(`  ["${t.name}"] = "${t.value}",`);e.push(`};`),e.push(`request.Content = new FormUrlEncodedContent(formParams);`)}}else if(n===`multipart/form-data`&&i){e.push(`var content = new MultipartFormDataContent();`);let t=0;for(let n of i)if(n.fileName!==void 0)if(n.contentType){let r=`fileContent${t++}`;e.push(`var ${r} = new StreamContent(File.OpenRead("${kL(n.fileName)}"));`),e.push(`${r}.Headers.ContentType = new MediaTypeHeaderValue("${n.contentType}");`),e.push(`content.Add(${r}, "${kL(n.name)}", "${kL(n.fileName)}");`)}else e.push(`content.Add(new StreamContent(File.OpenRead("${kL(n.fileName)}")), "${kL(n.name)}", "${kL(n.fileName)}");`);else if(n.contentType){let r=`stringContent${t++}`;e.push(`var ${r} = new StringContent("${kL(n.value??``)}");`),e.push(`${r}.Headers.ContentType = new MediaTypeHeaderValue("${n.contentType}");`),e.push(`content.Add(${r}, "${kL(n.name)}");`)}else e.push(`content.Add(new StringContent("${kL(n.value??``)}"), "${kL(n.name)}");`);e.push(`request.Content = content;`)}else if(n===`application/octet-stream`&&r)e.push(`var content = new ByteArrayContent(System.Text.Encoding.UTF8.GetBytes("`+r.replace(/"/g,`\\"`)+`"));`),e.push(`content.Headers.ContentType = new MediaTypeHeaderValue("application/octet-stream");`),e.push(`request.Content = content;`);else if(r){let t=OL(r);e.push(`request.Content = new StringContent(`),e.push(`${t},`),e.push(`System.Text.Encoding.UTF8, "${n}");`)}}function OL(e){let t=3;for(;e.includes(`"`.repeat(t));)t++;let n=`"`.repeat(t);return`${n}\n${e}\n${n}`}function kL(e){return e.replace(/\\/g,`\\\\`).replace(/"/g,`\\"`)}function Ugt(e){return/^[a-zA-Z0-9][a-zA-Z0-9!#$&\-\^_]*\/[a-zA-Z0-9][a-zA-Z0-9!#$&\-\^_]*(\s*;\s*[a-zA-Z0-9][a-zA-Z0-9!#$&\-\^_]*=.*)?$/.test(e)}var Wgt,Ggt=s((()=>{AF(),TL(),Wgt={target:`csharp`,client:`httpclient`,title:`HttpClient`,generate(e,t){let n={method:`GET`,url:``,...e};n.method=n.method.toUpperCase();let r=vL(n.queryString),i=`${n.url}${r}`,a=[];a.push(`using var client = new HttpClient();`),a.push(``);let o=Bgt(n.method);return a.push(`var request = new HttpRequestMessage(${o}, "${i}");`),Vgt(a,n,t),Hgt(a,n),a.push(``),a.push(`using var response = await client.SendAsync(request);`),a.join(`
-`)}}})),Kgt=s((()=>{Ggt()}));function AL(e,t={}){let{delimiter:n=`"`,escapeChar:r=`\\`,escapeNewlines:i=!0}=t;return[...e.toString()].map(e=>e===`\b`?`${r}b`:e===`	`?`${r}t`:e===`
-`?i?`${r}n`:e:e===`\f`?`${r}f`:e===`\r`?i?`${r}r`:e:e===r?r+r:e===n?r+n:e<` `||e>`~`?JSON.stringify(e).slice(1,-1):e).join(``)}var qgt,jL,ML=s((()=>{qgt=e=>AL(e,{delimiter:`'`}),jL=e=>AL(e,{delimiter:`"`})})),Jgt,Ygt=s((()=>{sL(),ML(),dL(),Jgt={info:{key:`restsharp`,title:`RestSharp`,link:`http://restsharp.org/`,description:`Simple REST and HTTP API Client for .NET`},convert:({allHeaders:e,method:t,fullUrl:n,headersObj:r,cookies:i,postData:a})=>{let{push:o,join:s}=new oL;return[`GET`,`POST`,`PUT`,`DELETE`,`PATCH`,`HEAD`,`OPTIONS`].includes(t.toUpperCase())?(o(`var client = new RestClient("${n}");`),o(`var request = new RestRequest(Method.${t.toUpperCase()});`),Object.keys(r).forEach(e=>{o(`request.AddHeader("${e}", "${jL(r[e])}");`)}),i?.forEach(({name:e,value:t})=>{o(`request.AddCookie("${e}", "${t}");`)}),a?.text&&o(`request.AddParameter("${lL(e,`content-type`)}", ${JSON.stringify(a.text)}, ParameterType.RequestBody);`),o(`IRestResponse response = client.Execute(request);`),s()):`Method not supported`}}})),Xgt,Zgt=s((()=>{Ygt(),DL(),Xgt={target:`csharp`,client:`restsharp`,title:`RestSharp`,generate(e){return EL(Jgt,e)}}})),Qgt=s((()=>{Zgt()})),$gt,e_t=s((()=>{$gt={target:`dart`,client:`http`,title:`Http`,generate(e,t){let n={method:`GET`,...e};n.method=n.method.toUpperCase();let r=`import 'package:http/http.dart' as http;
-
-void main() async {
-`,i=``,a=``;n.cookies&&n.cookies.length>0&&(a=n.cookies.map(e=>`${encodeURIComponent(e.name)}=${encodeURIComponent(e.value)}`).join(`; `),i=`  "Cookie": "${a}",\n`);let o=n.headers?.reduce((e,t)=>(t.value&&!/[; ]/.test(t.name)&&(e[t.name]=t.value),e),{})||{};if(t?.auth){let{username:e,password:n}=t.auth;e&&n&&(o.Authorization=`'Basic ' + base64Encode(utf8.encode('${`${e}:${n}`}'))`)}if(i&&(o.Cookie=a),Object.keys(o).length>0){r+=`  final headers = <String,String>{
-`;for(let[e,t]of Object.entries(o))t.includes(`utf8.encode`)?r+=`    '${e}': ${t},\n`:r+=`    '${e}': '${t}',\n`;r+=`  };
-
-`}let s=n.queryString?.length?`?`+n.queryString.map(e=>`${e.name}=${e.value}`).join(`&`):``,c=`${n.url}${s}`,l=``;if(n.postData)if(n.postData.mimeType===`application/json`)l=`  final body = r'${n.postData.text}';\n\n`;else if(n.postData.mimeType===`application/x-www-form-urlencoded`)l=`  final body = '${n.postData.params?.map(e=>`${encodeURIComponent(e.name)}=${encodeURIComponent(e.value??``)}`).join(`&`)||``}';\n\n`;else if(n.postData.mimeType===`multipart/form-data`){l=`  final body = <String,String>{
-`;for(let e of n.postData.params||[]){let t=e.value||``,n=e.fileName||``;l+=`    '${e.name}': '${n||t}',\n`}l+=`  };
-
-`}else n.postData.mimeType===`application/octet-stream`&&(l=`  final body = '${n.postData.text}';\n\n`);l&&(r+=l);let u=n.method.toLowerCase(),d=Object.keys(o).length>0?`, headers: headers`:``;return r+=`  final response = await http.${u}(Uri.parse('${c}')${d}${l?`, body: body`:``});\n`,r+=`  print(response.body);
-`,r+=`}`,r}}})),t_t=s((()=>{e_t()}));function n_t(e){return!e||e.length===0?``:`?`+e.map(e=>`${e.name}=${e.value}`).join(`&`)}function r_t(e,t){return e?!t||t.length===0?e:e+n_t(t):``}function i_t(e,t){return`let httpRequestMessage = new HttpRequestMessage(
-  HttpMethod("${e}"),
-  new Uri("${NL(t)}")
-)\n\n`}function a_t(e){let t=``;for(let n of e)t+=`httpRequestMessage.Headers.Add("${NL(n.name??``)}", "${NL(n.value??``)}")\n`;return t+=`
-`,t}function o_t(e,t){let n=`let cookieContainer = CookieContainer()
-`;for(let r of e)n+=`cookieContainer.Add(Uri("${NL(t)}"), Cookie("${NL(r.name??``)}", "${NL(r.value??``)}"))\n`;return n+=`use handler = new HttpClientHandler()
-`,n+=`handler.CookieContainer <- cookieContainer
-
-`,n}function s_t(e){if(!e)return``;let t=``;switch(e.mimeType){case`multipart/form-data`:t+=l_t(e);break;case`application/x-www-form-urlencoded`:t+=d_t(e);break;case`application/json`:t+=u_t(e);break;default:t+=c_t(e,e.mimeType);break}return t+=`httpRequestMessage.Content <- content
-
-`,t}function c_t(e,t){let n=`let content = new StringContent("${NL(e.text??``)}", Encoding.UTF8, "${NL(t??``)}")\n`;return n+=`content.Headers.ContentType <- MediaTypeHeaderValue("${NL(t??``)}")\n`,n}function l_t(e){let t=`let content = new MultipartFormDataContent()
-`,n=0,r=0;for(let i of e.params)if(i.value===`BINARY`){let e=NL(i.fileName??``);t+=`let fileStreamContent_${n} = new StreamContent(File.OpenRead("${e}"))\n`,i.contentType&&(t+=`fileStreamContent_${n}.Headers.ContentType <- MediaTypeHeaderValue("${NL(i.contentType)}")\n`),t+=`content.Add(fileStreamContent_${n}, "${e}", "${e}")\n`,n++}else{let e=NL(i.name??``),n=NL(i.value??``);i.contentType?(t+=`let stringContent_${r} = new StringContent("${n}")\n`,t+=`stringContent_${r}.Headers.ContentType <- MediaTypeHeaderValue("${NL(i.contentType)}")\n`,t+=`content.Add(stringContent_${r}, "${e}")\n`,r++):t+=`content.Add(new StringContent("${n}"), "${e}")\n`}return t}function u_t(e){let t;try{t=JSON.stringify(JSON.parse(e.text??`{}`),null,2)}catch{t=e.text??`{}`}return`let content = new StringContent("""${t}""", Encoding.UTF8, "application/json")\n`}function d_t(e){let t=`let formUrlEncodedContentDictionary = new Dictionary<string, string>()
-`;for(let n of e.params)t+=`formUrlEncodedContentDictionary.Add("${NL(n.name??``)}", "${NL(n.value??``)}")\n`;return t+=`let content = new FormUrlEncodedContent(formUrlEncodedContentDictionary)
-`,t}function NL(e){return e==null?``:e.replace(/\\/g,`\\\\`).replace(/"/g,`\\"`).replace(/\n/g,`\\n`).replace(/\r/g,`\\r`).replace(/\t/g,`\\t`)}var f_t,p_t=s((()=>{f_t={target:`fsharp`,client:`httpclient`,title:`HttpClient`,generate:(e,t)=>{if(!e)return``;let n=r_t(e.url,e.queryString),r=``;return r+=i_t(e.method,n),e.headers&&e.headers.length>0&&(r+=a_t(e.headers)),e.postData&&(r+=s_t(e.postData)),e.cookies&&e.cookies.length>0&&e.url?(r+=o_t(e.cookies,e.url),r+=`let client = new HttpClient(handler)
-`):r+=`let client = new HttpClient()
-`,r+=`let! result = client.SendAsync(httpRequestMessage)
-`,r}}})),m_t=s((()=>{p_t()})),h_t,PL,g_t,__t,v_t,y_t,b_t,x_t,S_t=s((()=>{TL(),h_t=e=>e.includes(` `)?e:PL(e),PL=e=>JSON.stringify(e),g_t=e=>{if(e===void 0)return``;try{return JSON.stringify(JSON.parse(e),null,2)}catch{return e}},__t=e=>!e.includes("`"),v_t=(e,t=!1)=>t&&__t(e)?`\`${e}\``:PL(e),y_t=e=>{let t=new Set;if(!e)return{imports:t,setupLines:[],requestBody:`nil`,needsMultipartContentTypeHeader:!1};if(e.mimeType===`application/x-www-form-urlencoded`&&e.params?.length)return t.add(`neturl "net/url"`),t.add(`strings`),{imports:t,setupLines:[`postData := neturl.Values{}`,...e.params.map(e=>`postData.Set(${PL(e.name)}, ${PL(e.value??``)})`)],requestBody:`strings.NewReader(postData.Encode())`,needsMultipartContentTypeHeader:!1};if(e.mimeType===`multipart/form-data`&&e.params?.length){t.add(`bytes`),t.add(`mime/multipart`);let n=[`payload := &bytes.Buffer{}`,`writer := multipart.NewWriter(payload)`],r=e.params.some(e=>e.fileName!==void 0),i=!1,a=!1;return r&&(t.add(`os`),t.add(`io`)),e.params.forEach(e=>{n.push(``),e.fileName===void 0?n.push(`_ = writer.WriteField(${PL(e.name)}, ${PL(e.value??``)})`):(n.push(`part, _ ${i?`=`:`:=`} writer.CreateFormFile(${PL(e.name)}, ${PL(e.fileName)})`),n.push(``),n.push(`f, _ ${a?`=`:`:=`} os.Open(${PL(e.fileName)})`),n.push(`defer f.Close()`),n.push(``),n.push(`_, _ = io.Copy(part, f)`),i=!0,a=!0)}),n.push(`writer.Close()`),{imports:t,setupLines:n,requestBody:`payload`,needsMultipartContentTypeHeader:!0}}return t.add(`strings`),{imports:t,setupLines:[`payload := strings.NewReader(${v_t(e.mimeType===`application/json`?g_t(e.text):e.text??``,e.mimeType===`application/json`)})`],requestBody:`payload`,needsMultipartContentTypeHeader:!1}},b_t=e=>Array.from(new Set([`fmt`,`io`,`net/http`,...e])).sort(),x_t={target:`go`,client:`native`,title:`NewRequest`,generate(e,t){if(!e)return``;let n=bL(e.method),r=xL(SL(e.url??``,e.queryString)),i=CL(e.headers,e.cookies),a=y_t(e.postData),o=[`package main`,``,`import (`,...b_t(a.imports).map(e=>`\t${h_t(e)}`),`)`,``,`func main() {`,`\trequestUrl := ${PL(r)}`,``,...a.setupLines.map(e=>e?`\t${e}`:``)];return a.setupLines.length&&o.push(``),o.push(`\treq, _ := http.NewRequest(${PL(n)}, requestUrl, ${a.requestBody})`),o.push(``),a.needsMultipartContentTypeHeader&&o.push(`	req.Header.Set("Content-Type", writer.FormDataContentType())`),t?.auth?.username&&t?.auth?.password&&o.push(`\treq.SetBasicAuth(${PL(t.auth.username)}, ${PL(t.auth.password)})`),i.forEach(e=>{o.push(`\treq.Header.Add(${PL(e.name)}, ${PL(e.value)})`)}),(a.needsMultipartContentTypeHeader||i.length||t?.auth?.username&&t.auth.password)&&o.push(``),o.push(`	res, _ := http.DefaultClient.Do(req)`),o.push(``),o.push(`	defer res.Body.Close()`),o.push(`	body, _ := io.ReadAll(res.Body)`),o.push(``),o.push(`	fmt.Println(res)`),o.push(`	fmt.Println(string(body))`),o.push(``),o.push(`}`),o.join(`
-`)}}})),C_t=s((()=>{S_t()})),w_t,T_t=s((()=>{w_t={target:`http`,client:`http1.1`,title:`HTTP/1.1`,generate(e){let t={method:`GET`,headers:[],queryString:[],...e};t.method=t.method.toUpperCase();let n,r;try{n=new URL(t.url||`http://`),r=n.pathname+(n.search||``)}catch{r=t.url||`/`}let i=n?.hostname||`UNKNOWN_HOSTNAME`,a=`${t.method} ${r} HTTP/1.1\r\n`;if(t.queryString.length){let e=t.queryString.map(e=>`${e.name}=${e.value}`).join(`&`);a=`${t.method} ${r}?${e} HTTP/1.1\r\n`}let o=new Map;if(o.set(`Host`,i),t.headers.forEach(e=>{o.has(e.name)?o.set(e.name,`${o.get(e.name)}, ${e.value}`):o.set(e.name,e.value)}),t.queryString.length){let e=t.queryString.map(e=>`${e.name}=${e.value}`).join(`&`);a=`${t.method} ${r}?${e} HTTP/1.1\r\n`}let s=``;if(t.postData){if(t.postData.mimeType===`application/json`&&t.postData.text)o.set(`Content-Type`,`application/json`),s=t.postData.text;else if(t.postData.mimeType===`application/octet-stream`&&t.postData.text)o.set(`Content-Type`,`application/octet-stream`),s=t.postData.text;else if(t.postData.mimeType===`application/x-www-form-urlencoded`&&t.postData.params){let e=t.postData.params.map(e=>`${encodeURIComponent(e.name)}=${encodeURIComponent(e.value??``)}`).join(`&`);o.set(`Content-Type`,`application/x-www-form-urlencoded`),s=e}else if(t.postData.mimeType===`multipart/form-data`&&t.postData.params){let e=`----WebKitFormBoundary7MA4YWxkTrZu0gW`;o.set(`Content-Type`,`multipart/form-data; boundary=${e}`),s=t.postData.params.map(t=>{let n=t.contentType?`Content-Type: ${t.contentType}\r\n`:``;return t.fileName?`--${e}\r\nContent-Disposition: form-data; name="${t.name}"; filename="${t.fileName}"\r\n${n}\r\n`:`--${e}\r\nContent-Disposition: form-data; name="${t.name}"\r\n${n}\r\n${t.value??``}\r\n`}).join(``)+`--${e}--\r\n`}}return o.forEach((e,t)=>{a+=`${t}: ${e}\r\n`}),a+=`\r\n${s}`,a}}})),E_t=s((()=>{T_t()})),D_t,O_t=s((()=>{sL(),ML(),D_t={info:{key:`asynchttp`,title:`AsyncHttp`,link:`https://github.com/AsyncHttpClient/async-http-client`,description:`Asynchronous Http and WebSocket Client library for Java`},convert:({method:e,allHeaders:t,postData:n,fullUrl:r},i)=>{let{blank:a,push:o,join:s}=new oL({indent:{indent:`  `,...i}.indent});return o(`AsyncHttpClient client = new DefaultAsyncHttpClient();`),o(`client.prepare("${e.toUpperCase()}", "${r}")`),Object.keys(t).forEach(e=>{o(`.setHeader("${e}", "${jL(t[e])}")`,1)}),n?.text&&o(`.setBody(${JSON.stringify(n.text)})`,1),o(`.execute()`,1),o(`.toCompletableFuture()`,1),o(`.thenAccept(System.out::println)`,1),o(`.join();`,1),a(),o(`client.close();`),s()}}})),k_t,A_t=s((()=>{O_t(),DL(),k_t={target:`java`,client:`asynchttp`,title:`AsyncHttp`,generate(e){return EL(D_t,e)}}})),j_t=s((()=>{A_t()})),M_t,N_t=s((()=>{sL(),ML(),M_t={info:{key:`nethttp`,title:`java.net.http`,link:`https://openjdk.java.net/groups/net/httpclient/intro.html`,description:`Java Standardized HTTP Client API`},convert:({allHeaders:e,fullUrl:t,method:n,postData:r},i)=>{let{push:a,join:o}=new oL({indent:{indent:`  `,...i}.indent});return a(`HttpRequest request = HttpRequest.newBuilder()`),a(`.uri(URI.create("${t}"))`,2),Object.keys(e).forEach(t=>{a(`.header("${t}", "${jL(e[t])}")`,2)}),r?.text?a(`.method("${n.toUpperCase()}", HttpRequest.BodyPublishers.ofString(${JSON.stringify(r.text)}))`,2):a(`.method("${n.toUpperCase()}", HttpRequest.BodyPublishers.noBody())`,2),a(`.build();`,2),a(`HttpResponse<String> response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());`),a(`System.out.println(response.body());`),o()}}})),P_t,F_t=s((()=>{N_t(),DL(),P_t={target:`java`,client:`nethttp`,title:`java.net.http`,generate(e){return EL(M_t,e)}}})),I_t=s((()=>{F_t()})),L_t,R_t=s((()=>{sL(),ML(),L_t={info:{key:`okhttp`,title:`OkHttp`,link:`http://square.github.io/okhttp/`,description:`An HTTP Request Client Library`},convert:({postData:e,method:t,fullUrl:n,allHeaders:r},i)=>{let{push:a,blank:o,join:s}=new oL({indent:{indent:`  `,...i}.indent});return a(`OkHttpClient client = new OkHttpClient();`),o(),e!=null&&(e.mimeType===`application/x-www-form-urlencoded`&&e.params?(a(`FormBody formBody = new FormBody.Builder()`),e.params.forEach(e=>{a(`.addEncoded("${e.name}", "${e.value}")`,1)}),a(`.build();`,1),o()):e.mimeType===`multipart/form-data`&&e.params?(a(`MultipartBody body = new MultipartBody.Builder()`),a(`.setType(MultipartBody.FORM)`,1),e.params.forEach(e=>{e.fileName===void 0?e.value!==void 0&&a(`.addFormDataPart("${e.name}", "${e.value}")`,1):a(`.addFormDataPart("${e.name}", "${e.fileName}", RequestBody.create(MediaType.parse("application/octet-stream"), new File("${e.fileName}")))`,1)}),a(`.build();`,1),o()):(a(`MediaType mediaType = MediaType.parse("${e.mimeType}");`),a(`RequestBody body = RequestBody.create(mediaType, ${JSON.stringify(e.text)});`))),a(`Request request = new Request.Builder()`),a(`.url("${n}")`,1),[`GET`,`POST`,`PUT`,`DELETE`,`PATCH`,`HEAD`].includes(t.toUpperCase())?[`POST`,`PUT`,`DELETE`,`PATCH`].includes(t.toUpperCase())?e!=null&&(e.text||e.params)?a(`.${t.toLowerCase()}(body)`,1):a(`.${t.toLowerCase()}(null)`,1):a(`.${t.toLowerCase()}()`,1):e?.text?a(`.method("${t.toUpperCase()}", body)`,1):a(`.method("${t.toUpperCase()}", null)`,1),Object.keys(r).forEach(e=>{a(`.addHeader("${e}", "${jL(r[e])}")`,1)}),a(`.build();`,1),o(),a(`Response response = client.newCall(request).execute();`),s()}}})),z_t,B_t=s((()=>{R_t(),DL(),z_t={target:`java`,client:`okhttp`,title:`OkHttp`,generate(e){return EL(L_t,e)}}})),V_t=s((()=>{B_t()})),H_t,U_t=s((()=>{sL(),ML(),H_t={info:{key:`unirest`,title:`Unirest`,link:`http://unirest.io/java.html`,description:`Lightweight HTTP Request Client Library`},convert:({method:e,allHeaders:t,postData:n,fullUrl:r},i)=>{let{join:a,push:o}=new oL({indent:{indent:`  `,...i}.indent});return[`GET`,`POST`,`PUT`,`DELETE`,`PATCH`,`HEAD`,`OPTIONS`].includes(e.toUpperCase())?o(`HttpResponse<String> response = Unirest.${e.toLowerCase()}("${r}")`):o(`HttpResponse<String> response = Unirest.customMethod("${e.toUpperCase()}","${r}")`),Object.keys(t).forEach(e=>{o(`.header("${e}", "${jL(t[e])}")`,1)}),n?.text&&o(`.body(${JSON.stringify(n.text)})`,1),o(`.asString();`,1),a()}}})),W_t,G_t=s((()=>{U_t(),DL(),W_t={target:`java`,client:`unirest`,title:`Unirest`,generate(e){return EL(H_t,e)}}})),K_t=s((()=>{G_t()}));function q_t(e){return!/^[$A-Z_][0-9A-Z_$]*$/i.test(e)}function J_t(e){return e.replaceAll(`\\`,`\\\\`).replaceAll(`
-`,`\\n`).replaceAll(`\r`,`\\r`).replaceAll(`'`,`\\'`)}function FL(e,t=0){let n=[],r=` `.repeat(t),i=` `.repeat(t+2);if(Object.keys(e).length===0)return`{}`;for(let[r,a]of Object.entries(e)){let e=q_t(r)?`'${J_t(r)}'`:r;if(a instanceof IL){let t=a.value.split(`
-`),r=`${a.value}`;t.length>1&&(r=t.map((e,t)=>t===0?e:`${i}${e}`).join(`
-`)),n.push(`${i}${e}: ${r}`)}else if(Array.isArray(a)){let r=a.map(e=>typeof e==`string`?`'${e}'`:e&&typeof e==`object`?FL(e):JSON.stringify(e));if(r.some(e=>e.includes(`
-`))){let a=r.map(e=>Y_t(e,t+4)).join(`,
-`);n.push(`${i}${e}: [\n${a}\n${i}]`)}else n.push(`${i}${e}: [${r.join(`, `)}]`)}else if(a&&typeof a==`object`)n.push(`${i}${e}: ${FL(a,t+2)}`);else if(typeof a==`string`){let t=`'${a}'`;n.push(`${i}${e}: ${t}`)}else n.push(`${i}${e}: ${a}`)}return`{\n${n.join(`,
-`)}\n${r}}`}function Y_t(e,t){let n=` `.repeat(t);return e.split(`
-`).map(e=>`${n}${e}`).join(`
-`)}var IL,LL=s((()=>{IL=class{value;constructor(e){this.value=e}}})),RL,zL,BL,X_t,Z_t,VL,Q_t=s((()=>{TL(),LL(),RL=e=>e.replaceAll(`\\`,`\\\\`).replaceAll(`
-`,`\\n`).replaceAll(`\r`,`\\r`).replaceAll(`'`,`\\'`),zL=e=>typeof e==`string`?RL(e):Array.isArray(e)?e.map(e=>zL(e)):e&&typeof e==`object`&&!(e instanceof IL)?Object.entries(e).reduce((e,[t,n])=>(e[t]=zL(n),e),{}):e,BL=(e,t,n)=>{if(n===``){e[t]=n;return}wL(e,t,n)},X_t=e=>{let t={};return e?.headers?.forEach(e=>{BL(t,e.name,e.value)}),e?.cookies?.length&&BL(t,`Cookie`,e.cookies.map(e=>`${e.name}=${e.value}`).join(`; `)),Object.keys(t).length?t:void 0},Z_t=e=>{let t=[],n=e?.postData;if(!n)return{setup:t};if(n.mimeType===`application/json`){if(!n.text)return{setup:t};try{return{setup:t,data:JSON.parse(n.text)}}catch{return{setup:t,data:n.text}}}return n.mimeType===`application/x-www-form-urlencoded`&&n.params?.length?(t.push(`const encodedParams = new URLSearchParams()`),n.params.forEach(e=>{let n=RL(e.name),r=RL(e.value??``);t.push(`encodedParams.append('${n}', '${r}')`)}),{setup:t,data:new IL(`encodedParams`)}):n.mimeType===`multipart/form-data`&&n.params?.length?(t.push(`const formData = new FormData()`),n.params.forEach(e=>{let n=RL(e.name);if(e.fileName!==void 0){let r=RL(e.fileName),i=e.contentType?`, { type: '${RL(e.contentType)}' }`:``;t.push(`formData.append('${n}', new Blob([]${i}), '${r}')`);return}if(e.contentType){let r=RL(e.contentType),i=RL(e.value??``);t.push(`formData.append('${n}', new Blob(['${i}'], { type: '${r}' }))`);return}let r=RL(e.value??``);t.push(`formData.append('${n}', '${r}')`)}),{setup:t,data:new IL(`formData`)}):n.text?{setup:t,data:n.text}:{setup:t}},VL=e=>({target:e,client:`axios`,title:`Axios`,generate(e,t){let n={method:`GET`,...e};n.method=n.method.toUpperCase();let r={method:n.method,url:RL(n.url??``)},i=yL(n.queryString);Object.keys(i).length&&(r.params=zL(i));let a=X_t(n);a&&(r.headers=zL(a)),t?.auth?.username&&t?.auth?.password&&(r.auth={username:RL(t.auth.username),password:RL(t.auth.password)});let{setup:o,data:s}=Z_t(n);return s!==void 0&&(r.data=s instanceof IL?s:zL(s)),`import axios from 'axios'
-
-${o.length?`${o.join(`
-`)}\n\n`:``}const options = ${FL(r)}
-
-try {
-  const { data } = await axios.request(options)
-  console.log(data)
-} catch (error) {
-  console.error(error)
-}`}})})),$_t,evt=s((()=>{Q_t(),$_t=VL(`js`)})),tvt=s((()=>{evt()})),nvt,rvt=s((()=>{TL(),LL(),nvt={target:`js`,client:`fetch`,title:`Fetch`,generate(e){let t={method:`GET`,...e},n=``;t.method=t.method.toUpperCase();let r={method:t.method===`GET`?void 0:t.method},i=vL(t.queryString);if(t.headers?.length&&(r.headers={},t.headers.forEach(e=>{r.headers[e.name]=e.value})),t.cookies?.length&&(r.headers=r.headers||{},t.cookies.forEach(e=>{r.headers[`Set-Cookie`]=r.headers[`Set-Cookie`]?`${r.headers[`Set-Cookie`]}; ${e.name}=${e.value}`:`${e.name}=${e.value}`})),Object.keys(r).forEach(e=>{r[e]===void 0&&delete r[e]}),t.postData){let{mimeType:e,text:i,params:a}=t.postData;if(e===`application/json`&&i)try{r.body=new IL(`JSON.stringify(${FL(JSON.parse(i))})`)}catch{r.body=i}else e===`multipart/form-data`&&a?(n=`const formData = new FormData()
-`,a.forEach(e=>{e.fileName===void 0?e.value!==void 0&&(n+=`formData.append('${e.name}', '${e.value}')\n`):n+=`formData.append('${e.name}', new Blob([]), '${e.fileName}')\n`}),n+=`
-`,r.body=new IL(`formData`)):e===`application/x-www-form-urlencoded`&&a?r.body=new IL(`new URLSearchParams(${FL(Object.fromEntries(a.map(e=>[e.name,e.value])))})`):r.body=t.postData.text}let a=Object.keys(r).length?`, ${FL(r)}`:``;return`${n}fetch('${t.url}${i}'${a})`}}})),ivt=s((()=>{rvt()}));function avt(e){return ovt.call(e)===`[object RegExp]`}var ovt,svt=s((()=>{({toString:ovt}=Object.prototype)}));function cvt(e){let t=typeof e;return e!==null&&(t===`object`||t===`function`)}var lvt=s((()=>{}));function uvt(e){return[...Object.keys(e),...Object.getOwnPropertySymbols(e).filter(t=>dvt.call(e,t))]}var dvt,fvt=s((()=>{({propertyIsEnumerable:dvt}=Object.prototype)}));function pvt({includeGlobalProperties:e=!1}={}){return new Set([...mvt,...e?hvt:[]])}var mvt,hvt,gvt=s((()=>{mvt=`await.break.case.catch.class.const.continue.debugger.default.delete.do.else.enum.export.extends.false.finally.for.function.if.import.in.instanceof.new.null.return.super.switch.this.throw.true.try.typeof.var.void.while.with.yield.implements.interface.let.package.private.protected.public.static.arguments.eval`.split(`.`),hvt=[`globalThis`,`Infinity`,`NaN`,`undefined`]}));function _vt({exact:e=!0}={}){return e?bvt:yvt}var vvt,HL,yvt,bvt,xvt=s((()=>{gvt(),vvt=/[$_\p{ID_Start}][$_\u200C\u200D\p{ID_Continue}]*/u,HL=`(?<![@#$_\\p{ID_Continue}\\p{ID_Start}])(?!(?:${[...pvt({includeGlobalProperties:!0})].join(`|`)})(?![$_\\p{ID_Continue}]))${vvt.source}`,yvt=new RegExp(HL,`u`),bvt=RegExp(`^${HL}$`,`u`)}));function Svt(e){let t=(...t)=>e(...t);return Object.defineProperty(t,`name`,{value:`functionTimeout(${e.name||`<anonymous>`})`,configurable:!0}),t}function Cvt(){return!1}var wvt=s((()=>{})),Tvt=c(((e,t)=>{t.exports=Worker}));function Evt(e,t){let{milliseconds:n,fallback:r,message:i,customTimers:a={setTimeout,clearTimeout}}=t,o,s,c=new Promise((c,l)=>{if(typeof n!=`number`||Math.sign(n)!==1)throw TypeError(`Expected \`milliseconds\` to be a positive number, got \`${n}\``);if(t.signal){let{signal:e}=t;e.aborted&&l(WL(e)),s=()=>{l(WL(e))},e.addEventListener(`abort`,s,{once:!0})}if(n===1/0){e.then(c,l);return}let u=new Dvt;o=a.setTimeout.call(void 0,()=>{if(r){try{c(r())}catch(e){l(e)}return}typeof e.cancel==`function`&&e.cancel(),i===!1?c():i instanceof Error?l(i):(u.message=i??`Promise timed out after ${n} milliseconds`,l(u))},n),(async()=>{try{c(await e)}catch(e){l(e)}})()}).finally(()=>{c.clear(),s&&t.signal&&t.signal.removeEventListener(`abort`,s)});return c.clear=()=>{a.clearTimeout.call(void 0,o),o=void 0},c}var Dvt,Ovt,UL,WL,kvt=s((()=>{Dvt=class extends Error{constructor(e){super(e),this.name=`TimeoutError`}},Ovt=class extends Error{constructor(e){super(),this.name=`AbortError`,this.message=e}},UL=e=>globalThis.DOMException===void 0?new Ovt(e):new DOMException(e),WL=e=>{let t=e.reason===void 0?UL(`This operation was aborted.`):e.reason;return t instanceof Error?t:UL(t)}}));function Avt(e,t,n){let r,i=new Promise((i,a)=>{if(n={rejectionEvents:[`error`],multiArgs:!1,resolveImmediately:!1,...n},!(n.count>=0&&(n.count===1/0||Number.isInteger(n.count))))throw TypeError("The `count` option should be at least 0 or more");n.signal?.throwIfAborted();let o=[t].flat(),s=[],{addListener:c,removeListener:l}=jvt(e),u=(...e)=>{let t=n.multiArgs?e:e[0];n.filter&&!n.filter(t)||(s.push(t),n.count===s.length&&(r(),i(s)))},d=e=>{r(),a(e)};r=()=>{for(let e of o)l(e,u);for(let e of n.rejectionEvents)l(e,d)};for(let e of o)c(e,u);for(let e of n.rejectionEvents)c(e,d);n.signal&&n.signal.addEventListener(`abort`,()=>{d(n.signal.reason)},{once:!0}),n.resolveImmediately&&i(s)});if(i.cancel=r,typeof n.timeout==`number`){let e=Evt(i,{milliseconds:n.timeout});return e.cancel=r,e}return i}function GL(e,t,n){typeof n==`function`&&(n={filter:n}),n={...n,count:1,resolveImmediately:!1};let r=Avt(e,t,n),i=r.then(e=>e[0]);return i.cancel=r.cancel,i}var jvt,Mvt=s((()=>{kvt(),jvt=e=>{let t=e.addEventListener||e.on||e.addListener,n=e.removeEventListener||e.off||e.removeListener;if(!t||!n)throw TypeError(`Emitter is not compatible`);return{addListener:t.bind(e),removeListener:n.bind(e)}}}));function Nvt(e){let t,n;return Ivt?n=new KL.default(Rvt(e),{type:`module`}):(t=URL.createObjectURL(Lvt(e)),n=new KL.default(t,{type:`module`})),{worker:n,cleanup:()=>{t&&URL.revokeObjectURL(t),n?.terminate()}}}function Pvt(e){let t=zvt(e),n=()=>Nvt(t);async function r({worker:e,arguments_:t}){let n=GL(e,`message`,{rejectionEvents:[`error`,`messageerror`]});e.postMessage(t);let{data:{output:r,error:i}}=await n;if(i)throw i;return r}let i=async(...e)=>{let{worker:t,cleanup:i}=n();try{return await r({arguments_:e,worker:t})}finally{i()}};return i.withSignal=e=>async(...t)=>{e.throwIfAborted();let{worker:i,cleanup:a}=n(),o=GL(e,[],{rejectionEvents:[`abort`]});try{return await Promise.race([r({arguments_:t,worker:i}),o])}catch(t){throw e.throwIfAborted(),t}finally{o.cancel(),a()}},i}function Fvt(e){let t=Bvt(e),n=()=>Nvt(t),r=(...e)=>({async*[Symbol.asyncIterator](){let{worker:t,cleanup:r}=n();try{let n=!0;for(;;){let r=GL(t,`message`,{rejectionEvents:[`error`,`messageerror`]});t.postMessage(n?e:void 0),n=!1;let{data:{output:i,error:a}}=await r;if(a)throw a;let{value:o,done:s}=i;if(s)break;yield o}}finally{r()}}});return r.withSignal=e=>(...t)=>({async*[Symbol.asyncIterator](){e.throwIfAborted();let{worker:r,cleanup:i}=n(),a=GL(e,[],{rejectionEvents:[`abort`]});try{let e=!0;for(;;){let n=Promise.race([GL(r,`message`,{rejectionEvents:[`error`,`messageerror`]}),a]);r.postMessage(e?t:void 0),e=!1;let{data:{output:i,error:o}}=await n;if(o)throw o;let{value:s,done:c}=i;if(c)break;yield s}}catch(t){throw e.throwIfAborted(),t}finally{a.cancel(),i()}}}),r}var KL,Ivt,Lvt,Rvt,zvt,Bvt,Vvt=s((()=>{KL=d(Tvt(),1),Mvt(),Ivt=!!globalThis.process?.versions?.node,Lvt=e=>new globalThis.Blob([e],{type:`text/javascript`}),Rvt=e=>`data:text/javascript;base64,${globalThis.Buffer.from(e).toString(`base64`)}`,zvt=e=>`
-	globalThis.onmessage = async ({data: arguments_}) => {
-		try {
-			const output = await (${e.toString()})(...arguments_);
-			globalThis.postMessage({output});
-		} catch (error) {
-			globalThis.postMessage({error});
-		}
-	};
-	`,Bvt=e=>`
-	const nothing = Symbol('nothing');
-	let iterator = nothing;
-
-	globalThis.onmessage = async ({data: arguments_}) => {
-		try {
-			if (iterator === nothing) {
-				iterator = await (${e.toString()})(...arguments_);
-			}
-
-			const output = await iterator.next();
-			globalThis.postMessage({output});
-		} catch (error) {
-			globalThis.postMessage({error});
-		}
-	};
-	`}));function Hvt(e,t,{timeout:n,throwOnTimeout:r}={}){try{return Svt(()=>structuredClone(e).test(t),{timeout:Wvt(n),context:Uvt})()}catch(e){if(Cvt(e)&&!r)return!1;throw e}}var Uvt,Wvt,Gvt=s((()=>{wvt(),Vvt(),Uvt={},Wvt=e=>{if(e===void 0||Number.isNaN(e))return;let t=Math.max(1,Math.trunc(Math.abs(e)));if(Number.isFinite(t))return t},Pvt((e,t,n)=>new RegExp(e,t).test(n)),Pvt((e,t,n)=>{let r=new RegExp(e,t).exec(n);if(r!==null)return{match:r[0],index:r.index,groups:r.slice(1),namedGroups:r.groups??{},input:r.input}}),Fvt(function*(e,t,n){let r=new RegExp(e,t),i=n.matchAll(r);for(let e of i)yield{match:e[0],index:e.index,groups:e.slice(1),namedGroups:e.groups??{},input:e.input}})}));function Kvt(e){if(typeof e!=`string`)throw TypeError(`Expected a string, got \`${typeof e}\`.`);return e.length>1e5?!1:Hvt(qvt,e,{timeout:1e3})}var qvt,Jvt=s((()=>{xvt(),Gvt(),qvt=_vt()}));function Yvt(e,t,n){let r=[];return(function e(t,n={},i=``){let a=n.indent||`	`,o;o=n.inlineCharacterLimit===void 0?{newline:`
-`,newlineOrSpace:`
-`,pad:i,indent:i+a}:{newline:`@@__STRINGIFY_OBJECT_NEW_LINE__@@`,newlineOrSpace:`@@__STRINGIFY_OBJECT_NEW_LINE_OR_SPACE__@@`,pad:`@@__STRINGIFY_OBJECT_PAD__@@`,indent:`@@__STRINGIFY_OBJECT_INDENT__@@`};let s=e=>{if(n.inlineCharacterLimit===void 0)return e;let t=e.replaceAll(o.newline,``).replaceAll(o.newlineOrSpace,` `).replaceAll(o.pad,``).replaceAll(o.indent,``);return t.length<=n.inlineCharacterLimit?t:e.replaceAll(o.newline,`
-`).replaceAll(o.newlineOrSpace,`
-`).replaceAll(o.pad,i).replaceAll(o.indent,i+a)};if(r.includes(t))return`"[Circular]"`;let c=typeof t;if(t==null||c===`number`||c===`boolean`||c===`function`||avt(t))return String(t);if(c===`bigint`)return String(t)+`n`;if(c===`symbol`){let{description:r}=t;if(r===void 0)return`Symbol()`;if(r?.startsWith(`Symbol.`)&&Symbol[r.slice(7)]===t)return r;let i=Symbol.keyFor(t);return i===void 0?`Symbol(${e(r,n)})`:`Symbol.for(${e(i,n)})`}if(t instanceof Date)return Number.isNaN(t.getTime())?`new Date('Invalid Date')`:`new Date('${t.toISOString()}')`;if(t instanceof Map||t instanceof Set){let c=t instanceof Map,l=c?`Map`:`Set`;if(t.size===0)return`new ${l}()`;r.push(t);let u=[...t].map(t=>{if(c){let[r,s]=t;return o.indent+`[${e(r,n,i+a)}, ${e(s,n,i+a)}]`}return o.indent+e(t,n,i+a)}).join(`,`+o.newlineOrSpace);return r.pop(),s(`new ${l}([${o.newline}${u}${o.newline}${o.pad}])`)}if(Array.isArray(t)){if(t.length===0)return`[]`;r.push(t);let c=t.map((r,s)=>{let c=e(r,n,i+a);return n.transform&&(c=n.transform(t,s,c)),o.indent+c}).join(`,`+o.newlineOrSpace);return r.pop(),s(`[${o.newline}${c}${o.newline}${o.pad}]`)}if(cvt(t)){let c=uvt(t);if(n.filter&&(c=c.filter(e=>n.filter(t,e))),c.length===0)return`{}`;r.push(t);let l=c.map(r=>{let s=typeof r==`symbol`,c;c=s?`[${e(r,n)}]`:Kvt(r)?r:e(r,n);let l=e(t[r],n,i+a);return n.transform&&(l=n.transform(t,r,l)),o.indent+c+`: `+l}).join(`,`+o.newlineOrSpace);return r.pop(),s(`{${o.newline}${l}${o.newline}${o.pad}}`)}let l=String(t).replaceAll(`\\`,`\\\\`).replaceAll(/[\u0000-\u001F\u007F]/g,e=>Xvt[e]??`\\u${e.codePointAt(0).toString(16).padStart(4,`0`)}`);return n.singleQuotes===!1?`"${l.replaceAll(`"`,String.raw`\"`)}"`:`'${l.replaceAll(`'`,String.raw`\'`)}'`})(e,t,n)}var Xvt,Zvt=s((()=>{svt(),lvt(),fvt(),Jvt(),Xvt={"\n":String.raw`\n`,"\r":String.raw`\r`,"	":String.raw`\t`,"\b":String.raw`\b`,"\f":String.raw`\f`,"\v":String.raw`\v`,"\0":String.raw`\0`}})),Qvt,$vt=s((()=>{Zvt(),sL(),dL(),Qvt={info:{key:`jquery`,title:`jQuery`,link:`http://api.jquery.com/jquery.ajax/`,description:`Perform an asynchronous HTTP (Ajax) requests with jQuery`},convert:({fullUrl:e,method:t,allHeaders:n,postData:r},i)=>{let a={indent:`  `,...i},{blank:o,push:s,join:c}=new oL({indent:a.indent}),l={async:!0,crossDomain:!0,url:e,method:t,headers:n};switch(r?.mimeType){case`application/x-www-form-urlencoded`:l.data=r?.paramsObj?r.paramsObj:r.text;break;case`application/json`:l.processData=!1,l.data=r.text;break;case`multipart/form-data`:if(!r?.params)break;if(s(`const form = new FormData();`),r.params.forEach(e=>{s(`form.append('${e.name}', '${e.value||e.fileName||``}');`)}),l.processData=!1,l.contentType=!1,l.mimeType=`multipart/form-data`,l.data=`[form]`,uL(n,`content-type`)&&lL(n,`content-type`)?.includes(`boundary`)){let e=cL(n,`content-type`);e&&delete l.headers[e]}o();break;default:r?.text&&(l.data=r.text)}return s(`const settings = ${Yvt(l,{indent:a.indent}).replace(`'[form]'`,`form`)};`),o(),s(`$.ajax(settings).done(function (response) {`),s(`console.log(response);`,1),s(`});`),c()}}})),eyt,tyt=s((()=>{$vt(),DL(),eyt={target:`js`,client:`jquery`,title:`jQuery`,generate(e){return EL(Qvt,e)}}})),nyt=s((()=>{tyt()})),ryt,iyt=s((()=>{TL(),LL(),ryt={target:`js`,client:`ofetch`,title:`ofetch`,generate(e){let t={method:`GET`,...e};t.method=t.method.toUpperCase();let n={method:t.method===`GET`?void 0:t.method};t.queryString?.length&&(n.query=yL(t.queryString)),t.headers?.length&&(n.headers={},t.headers.forEach(e=>{n.headers[e.name]=e.value})),t.cookies?.length&&(n.headers=n.headers||{},t.cookies.forEach(e=>{n.headers[`Set-Cookie`]=n.headers[`Set-Cookie`]?`${n.headers[`Set-Cookie`]}; ${e.name}=${e.value}`:`${e.name}=${e.value}`})),Object.keys(n).forEach(e=>{n[e]===void 0&&delete n[e]}),t.postData&&(n.body=t.postData.text,t.postData.mimeType===`application/json`&&(n.body=JSON.parse(n.body)));let r=Object.keys(n).length?`, ${FL(n)}`:``;return`import { ofetch } from 'ofetch'
-
-ofetch('${t.url}'${r})`}}})),ayt=s((()=>{iyt()})),oyt,syt=s((()=>{Zvt(),sL(),ML(),dL(),oyt={info:{key:`xhr`,title:`XMLHttpRequest`,link:`https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest`,description:`W3C Standard API that provides scripted client functionality`},convert:({postData:e,allHeaders:t,method:n,fullUrl:r},i)=>{let a={indent:`  `,cors:!0,...i},{blank:o,push:s,join:c}=new oL({indent:a.indent});switch(e?.mimeType){case`application/json`:s(`const data = JSON.stringify(${Yvt(e?.jsonObj,{indent:a.indent})});`),o();break;case`multipart/form-data`:if(!e?.params)break;if(s(`const data = new FormData();`),e.params.forEach(e=>{s(`data.append('${e.name}', '${e.value||e.fileName||``}');`)}),uL(t,`content-type`)&&lL(t,`content-type`)?.includes(`boundary`)){let e=cL(t,`content-type`);e&&delete t[e]}o();break;default:s(`const data = ${e?.text?`'${e.text}'`:`null`};`),o()}return s(`const xhr = new XMLHttpRequest();`),a.cors&&s(`xhr.withCredentials = true;`),o(),s(`xhr.addEventListener('readystatechange', function () {`),s(`if (this.readyState === this.DONE) {`,1),s(`console.log(this.responseText);`,2),s(`}`,1),s(`});`),o(),s(`xhr.open('${n}', '${r}');`),Object.keys(t).forEach(e=>{s(`xhr.setRequestHeader('${e}', '${qgt(t[e])}');`)}),o(),s(`xhr.send(data);`),c()}}})),cyt,lyt=s((()=>{syt(),DL(),cyt={target:`js`,client:`xhr`,title:`XHR`,generate(e){return EL(oyt,e)}}})),uyt=s((()=>{lyt()})),dyt,fyt=s((()=>{sL(),ML(),dyt={info:{key:`okhttp`,title:`OkHttp`,link:`http://square.github.io/okhttp/`,description:`An HTTP Request Client Library`},convert:({postData:e,fullUrl:t,method:n,allHeaders:r},i)=>{let{blank:a,join:o,push:s}=new oL({indent:{indent:`  `,...i}.indent});return s(`val client = OkHttpClient()`),a(),e!=null&&(e.mimeType===`application/x-www-form-urlencoded`&&e.params?(s(`val formBody = FormBody.Builder()`),e.params.forEach(e=>{s(`.addEncoded("${e.name}", "${e.value}")`,1)}),s(`.build()`,1),a()):e.mimeType===`multipart/form-data`&&e.params?(s(`val body = MultipartBody.Builder()`),s(`.setType(MultipartBody.FORM)`,1),e.params.forEach(e=>{e.fileName===void 0?e.value!==void 0&&s(`.addFormDataPart("${e.name}", "${e.value}")`,1):s(`.addFormDataPart("${e.name}", "${e.fileName}", RequestBody.create(MediaType.parse("application/octet-stream"), File("${e.fileName}")))`,1)}),s(`.build()`,1),a()):(s(`val mediaType = MediaType.parse("${e.mimeType}")`),s(`val body = RequestBody.create(mediaType, ${JSON.stringify(e.text)})`))),s(`val request = Request.Builder()`),s(`.url("${t}")`,1),[`GET`,`POST`,`PUT`,`DELETE`,`PATCH`,`HEAD`].includes(n.toUpperCase())?[`POST`,`PUT`,`DELETE`,`PATCH`].includes(n.toUpperCase())?e!=null&&(e.text||e.params)?s(`.${n.toLowerCase()}(body)`,1):s(`.${n.toLowerCase()}(null)`,1):s(`.${n.toLowerCase()}()`,1):e?.text?s(`.method("${n.toUpperCase()}", body)`,1):s(`.method("${n.toUpperCase()}", null)`,1),Object.keys(r).forEach(e=>{s(`.addHeader("${e}", "${jL(r[e])}")`,1)}),s(`.build()`,1),a(),s(`val response = client.newCall(request).execute()`),o()}}})),pyt,myt=s((()=>{fyt(),DL(),pyt={target:`kotlin`,client:`okhttp`,title:`OkHttp`,generate(e){return EL(dyt,e)}}})),hyt=s((()=>{myt()})),gyt,_yt=s((()=>{Q_t(),gyt=VL(`node`)})),vyt=s((()=>{_yt()})),yyt,byt=s((()=>{TL(),LL(),yyt={target:`node`,client:`fetch`,title:`Fetch`,generate(e){let t={method:`GET`,...e},n=``;t.method=t.method.toUpperCase();let r={method:t.method===`GET`?void 0:t.method},i=vL(t.queryString);if(t.headers?.length&&(r.headers={},t.headers.forEach(e=>{r.headers[e.name]=e.value})),t.cookies?.length&&(r.headers=r.headers||{},t.cookies.forEach(e=>{r.headers[`Set-Cookie`]=r.headers[`Set-Cookie`]?`${r.headers[`Set-Cookie`]}; ${e.name}=${e.value}`:`${e.name}=${e.value}`})),Object.keys(r).forEach(e=>{r[e]===void 0&&delete r[e]}),t.postData){let{mimeType:e,text:i,params:a}=t.postData,o=!1;if(e===`application/json`&&i)try{r.body=new IL(`JSON.stringify(${FL(JSON.parse(i))})`)}catch{r.body=i}else e===`multipart/form-data`&&a?(n=`const formData = new FormData()
-`,a.forEach(e=>{e.fileName===void 0?e.value!==void 0&&(n+=`formData.append('${e.name}', '${e.value}')\n`):(o||=(n=`import fs from 'node:fs'\n\n${n}`,!0),n+=`formData.append('${e.name}', new Blob([fs.readFileSync('${e.fileName}')]), '${e.fileName}')\n`)}),n+=`
-`,r.body=new IL(`formData`)):e===`application/x-www-form-urlencoded`&&a?r.body=new IL(`new URLSearchParams(${FL(Object.fromEntries(a.map(e=>[e.name,e.value])))})`):r.body=t.postData.text}let a=Object.keys(r).length?`, ${FL(r)}`:``;return`${n}fetch('${t.url}${i}'${a})`}}})),xyt=s((()=>{byt()})),Syt,Cyt=s((()=>{TL(),LL(),Syt={target:`node`,client:`ofetch`,title:`ofetch`,generate(e){let t={method:`GET`,...e};t.method=t.method.toUpperCase();let n={method:t.method===`GET`?void 0:t.method};t.queryString?.length&&(n.query=yL(t.queryString)),t.headers?.length&&(n.headers={},t.headers.forEach(e=>{n.headers[e.name]=e.value})),t.cookies?.length&&(n.headers=n.headers||{},t.cookies.forEach(e=>{n.headers[`Set-Cookie`]=n.headers[`Set-Cookie`]?`${n.headers[`Set-Cookie`]}; ${e.name}=${e.value}`:`${e.name}=${e.value}`})),Object.keys(n).forEach(e=>{n[e]===void 0&&delete n[e]}),t.postData&&(n.body=t.postData.text,t.postData.mimeType===`application/json`&&(n.body=JSON.parse(n.body)));let r=Object.keys(n).length?`, ${FL(n)}`:``;return`import { ofetch } from 'ofetch'
-
-ofetch('${t.url}'${r})`}}})),wyt=s((()=>{Cyt()})),Tyt,Eyt=s((()=>{TL(),LL(),Tyt={target:`node`,client:`undici`,title:`undici`,generate(e){let t={method:`GET`,...e};t.method=t.method.toUpperCase();let n={method:t.method===`GET`?void 0:t.method},r=vL(t.queryString);t.headers?.length&&(n.headers={},t.headers.forEach(e=>{n.headers[e.name]=e.value})),t.cookies?.length&&(n.headers=n.headers||{},t.cookies.forEach(e=>{n.headers[`Set-Cookie`]=n.headers[`Set-Cookie`]?`${n.headers[`Set-Cookie`]}; ${e.name}=${e.value}`:`${e.name}=${e.value}`})),Object.keys(n).forEach(e=>{n[e]===void 0&&delete n[e]}),t.postData&&(n.body=t.postData.text,t.postData.mimeType===`application/json`&&(n.body=new IL(`JSON.stringify(${FL(JSON.parse(n.body))})`)));let i=Object.keys(n).length?`, ${FL(n)}`:``;return`import { request } from 'undici'
-
-const { statusCode, body } = await request('${t.url}${r}'${i})`}}})),Dyt=s((()=>{Eyt()})),qL,JL,Oyt=s((()=>{qL=(e,t,n,r)=>{let i=`${e} *${t} = `;return`${i}${JL(n,r?i.length:void 0)};`},JL=(e,t)=>{let n=t===void 0?`, `:`,\n   ${` `.repeat(t)}`;switch(Object.prototype.toString.call(e)){case`[object Number]`:return`@${e}`;case`[object Array]`:return`@[ ${e.map(e=>JL(e)).join(n)} ]`;case`[object Object]`:{let t=[],r=e;for(let e in r)Object.hasOwn(r,e)&&t.push(`@"${e}": ${JL(r[e])}`);return`@{ ${t.join(n)} }`}case`[object Boolean]`:return e?`@YES`:`@NO`;default:return e==null?``:`@"${e.toString().replace(/"/g,`\\"`)}"`}}})),kyt,Ayt=s((()=>{sL(),Oyt(),kyt={info:{key:`nsurlsession`,title:`NSURLSession`,link:`https://developer.apple.com/library/mac/documentation/Foundation/Reference/NSURLSession_class/index.html`,description:`Foundation's NSURLSession request`},convert:({allHeaders:e,postData:t,method:n,fullUrl:r},i)=>{let a={indent:`    `,pretty:!0,timeout:10,...i},{push:o,join:s,blank:c}=new oL({indent:a.indent}),l={hasHeaders:!1,hasBody:!1};if(o(`#import <Foundation/Foundation.h>`),Object.keys(e).length&&(l.hasHeaders=!0,c(),o(qL(`NSDictionary`,`headers`,e,a.pretty))),t&&(t.text||t.jsonObj||t.params))switch(l.hasBody=!0,t.mimeType){case`application/x-www-form-urlencoded`:if(t.params?.length){c();let[e,...n]=t.params;o(`NSMutableData *postData = [[NSMutableData alloc] initWithData:[@"${e.name}=${e.value}" dataUsingEncoding:NSUTF8StringEncoding]];`),n.forEach(({name:e,value:t})=>{o(`[postData appendData:[@"&${e}=${t}" dataUsingEncoding:NSUTF8StringEncoding]];`)})}else l.hasBody=!1;break;case`application/json`:t.jsonObj&&(o(qL(`NSDictionary`,`parameters`,t.jsonObj,a.pretty)),c(),o(`NSData *postData = [NSJSONSerialization dataWithJSONObject:parameters options:0 error:nil];`));break;case`multipart/form-data`:o(qL(`NSArray`,`parameters`,t.params||[],a.pretty)),o(`NSString *boundary = @"${t.boundary}";`),c(),o(`NSError *error;`),o(`NSMutableString *body = [NSMutableString string];`),o(`for (NSDictionary *param in parameters) {`),o(`[body appendFormat:@"--%@\\r\\n", boundary];`,1),o(`if (param[@"fileName"]) {`,1),o(`[body appendFormat:@"Content-Disposition:form-data; name=\\"%@\\"; filename=\\"%@\\"\\r\\n", param[@"name"], param[@"fileName"]];`,2),o(`[body appendFormat:@"Content-Type: %@\\r\\n\\r\\n", param[@"contentType"]];`,2),o(`[body appendFormat:@"%@", [NSString stringWithContentsOfFile:param[@"fileName"] encoding:NSUTF8StringEncoding error:&error]];`,2),o(`if (error) {`,2),o(`NSLog(@"%@", error);`,3),o(`}`,2),o(`} else {`,1),o(`[body appendFormat:@"Content-Disposition:form-data; name=\\"%@\\"\\r\\n\\r\\n", param[@"name"]];`,2),o(`[body appendFormat:@"%@", param[@"value"]];`,2),o(`}`,1),o(`}`),o(`[body appendFormat:@"\\r\\n--%@--\\r\\n", boundary];`),o(`NSData *postData = [body dataUsingEncoding:NSUTF8StringEncoding];`);break;default:c(),o(`NSData *postData = [[NSData alloc] initWithData:[@"${t.text}" dataUsingEncoding:NSUTF8StringEncoding]];`)}return c(),o(`NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"${r}"]`),o(`                                                       cachePolicy:NSURLRequestUseProtocolCachePolicy`),o(`                                                   timeoutInterval:${a.timeout.toFixed(1)}];`),o(`[request setHTTPMethod:@"${n}"];`),l.hasHeaders&&o(`[request setAllHTTPHeaderFields:headers];`),l.hasBody&&o(`[request setHTTPBody:postData];`),c(),o(`NSURLSession *session = [NSURLSession sharedSession];`),o(`NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request`),o(`                                            completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {`),o(`                                            if (error) {`,1),o(`                                            NSLog(@"%@", error);`,2),o(`                                            } else {`,1),o(`                                            NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response;`,2),o(`                                            NSLog(@"%@", httpResponse);`,2),o(`                                            }`,1),o(`                                            }];`),o(`[dataTask resume];`),s()}}})),jyt,Myt=s((()=>{Ayt(),DL(),jyt={target:`objc`,client:`nsurlsession`,title:`NSURLSession`,generate(e){return EL(kyt,e)}}})),Nyt=s((()=>{Myt()})),Pyt,Fyt=s((()=>{sL(),ML(),Pyt={info:{key:`cohttp`,title:`CoHTTP`,link:`https://github.com/mirage/ocaml-cohttp`,description:`Cohttp is a very lightweight HTTP server using Lwt or Async for OCaml`},convert:({fullUrl:e,allHeaders:t,postData:n,method:r},i)=>{let a={indent:`  `,...i},o=[`get`,`post`,`head`,`delete`,`patch`,`put`,`options`],{push:s,blank:c,join:l}=new oL({indent:a.indent});s(`open Cohttp_lwt_unix`),s(`open Cohttp`),s(`open Lwt`),c(),s(`let uri = Uri.of_string "${e}" in`);let u=Object.keys(t);return u.length===1?s(`let headers = Header.add (Header.init ()) "${u[0]}" "${jL(t[u[0]])}" in`):u.length>1&&(s(`let headers = Header.add_list (Header.init ()) [`),u.forEach(e=>{s(`("${e}", "${jL(t[e])}");`,1)}),s(`] in`)),n?.text&&s(`let body = Cohttp_lwt_body.of_string ${JSON.stringify(n.text)} in`),c(),s(`Client.call ${u.length?`~headers `:``}${n?.text?`~body `:``}${o.includes(r.toLowerCase())?`\`${r.toUpperCase()}`:`(Code.method_of_string "${r}")`} uri`),s(`>>= fun (res, body_stream) ->`),s(`(* Do stuff with the result *)`,1),l()}}})),Iyt,Lyt=s((()=>{Fyt(),DL(),Iyt={target:`ocaml`,client:`cohttp`,title:`Cohttp`,generate(e){return EL(Pyt,e)}}})),Ryt=s((()=>{Lyt()}));function YL(e){return` `.repeat(e*2)}function XL(e,t=0){if(e==null)return`null`;if(e instanceof ZL){let n=e.value.split(`
-`);if(n.length>1){let e=YL(t+1);return n.map((t,n)=>n===0?t:`${e}${t}`).join(`
-`)}return e.value}if(typeof e==`string`)return`'${e.replace(/\\/g,`\\\\`).replace(/'/g,`\\'`)}'`;if(typeof e==`number`||typeof e==`boolean`)return String(e);if(Array.isArray(e)){if(e.length===0)return`[]`;let n=e.map(e=>XL(e,t+1)).join(`,
-`+YL(t+1));return`[\n${YL(t+1)}${n}\n${YL(t)}]`}if(typeof e==`object`){let n=Object.entries(e);if(n.length===0)return`[]`;let r=n.map(([e,n])=>`'${e}' => ${XL(n,t+1)}`).join(`,
-`+YL(t+1));return`[\n${YL(t+1)}${r}\n${YL(t)}]`}return`null`}var ZL,QL=s((()=>{ZL=class{value;constructor(e){this.value=e}}})),zyt,Byt=s((()=>{QL(),zyt={target:`php`,client:`curl`,title:`cURL`,generate(e,t){let n={method:`GET`,...e};n.method=n.method.toUpperCase();let r=[],i=!1,a=n.queryString?.length?`?`+n.queryString.map(e=>`${e.name}=${e.value}`).join(`&`):``,o=`${n.url}${a}`;r.push(`$ch = curl_init("${o}");`),r.push(``),n.method===`POST`?r.push(`curl_setopt($ch, CURLOPT_POST, true);`):n.method!==`GET`&&r.push(`curl_setopt($ch, CURLOPT_CUSTOMREQUEST, '${n.method}');`),t?.auth?.username&&t?.auth?.password&&r.push(`curl_setopt($ch, CURLOPT_USERPWD, '${t.auth.username}:${t.auth.password}');`);let s=[...n.headers||[]],c=()=>s.some(e=>e.name.toLowerCase()===`content-type`);if(n.postData&&(n.postData.mimeType===`application/x-www-form-urlencoded`&&n.postData.params&&!c()?s.push({name:`Content-Type`,value:`application/x-www-form-urlencoded`}):n.postData.mimeType===`application/octet-stream`&&!c()&&s.push({name:`Content-Type`,value:`application/octet-stream`})),s.length){let e=s.map(e=>`'${e.name}: ${e.value}'`);r.push(`curl_setopt($ch, CURLOPT_HTTPHEADER, [${e.join(`, `)}]);`);let t=s.find(e=>e.name.toLowerCase()===`accept-encoding`);t&&/gzip|deflate/.test(t.value)&&r.push(`curl_setopt($ch, CURLOPT_ENCODING, '');`)}if(n.cookies?.length){let e=n.cookies.map(e=>`${encodeURIComponent(e.name)}=${encodeURIComponent(e.value)}`).join(`; `);r.push(`curl_setopt($ch, CURLOPT_COOKIE, '${e}');`)}if(n.postData){if(n.postData.mimeType===`application/json`){if(n.postData.text)try{let e=XL(JSON.parse(n.postData.text));r.push(`curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(${e}));`)}catch{r.push(`curl_setopt($ch, CURLOPT_POSTFIELDS, '${n.postData.text}');`)}}else if(n.postData.mimeType===`multipart/form-data`&&n.postData.params)i=!0,r.push(`$mime = curl_mime_init($ch);`),n.postData.params.forEach((e,t)=>{let n=`$part${t}`;r.push(`${n} = curl_mime_addpart($mime);`),r.push(`curl_mime_name(${n}, '${e.name}');`),e.fileName===void 0?e.value!==void 0&&r.push(`curl_mime_data(${n}, '${e.value}');`):r.push(`curl_mime_filedata(${n}, '${e.fileName}');`),e.contentType&&r.push(`curl_mime_type(${n}, '${e.contentType}');`)}),r.push(`curl_setopt($ch, CURLOPT_MIMEPOST, $mime);`);else if(n.postData.mimeType===`application/x-www-form-urlencoded`&&n.postData.params){let e=n.postData.params.map(e=>`${encodeURIComponent(e.name)}=${e.value?encodeURIComponent(e.value):``}`).join(`&`);r.push(`curl_setopt($ch, CURLOPT_POSTFIELDS, '${e}');`)}else if(n.postData.mimeType===`application/octet-stream`)r.push(`curl_setopt($ch, CURLOPT_POSTFIELDS, '${n.postData.text||``}');`);else if(n.postData.text)try{let e=XL(JSON.parse(n.postData.text));r.push(`curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(${e}));`)}catch{r.push(`curl_setopt($ch, CURLOPT_POSTFIELDS, '${n.postData.text}');`)}}return r.push(``),r.push(`curl_exec($ch);`),i&&r.push(`curl_mime_free($mime);`),r.push(``),r.push(`curl_close($ch);`),r.join(`
-`).replace(/\n\n\n/g,`
-
-`)}}})),Vyt=s((()=>{Byt()})),Hyt,Uyt=s((()=>{TL(),QL(),Hyt={target:`php`,client:`guzzle`,title:`Guzzle`,generate(e,t){if(!e)return``;let n={},r=(e.method||`GET`).toUpperCase(),i=e.url||``;if(e.headers&&Array.isArray(e.headers)&&e.headers.length>0){let t={};e.headers.forEach(e=>{t[e.name]===void 0?t[e.name]=e.value:Array.isArray(t[e.name])?t[e.name].push(e.value):t[e.name]=[t[e.name],e.value]}),n.headers=t}if(e.queryString&&e.queryString.length>0&&(n.query=yL(e.queryString)),e.cookies&&e.cookies.length>0){let t={};e.cookies.forEach(e=>{t[e.name]=e.value}),n.cookies=t}if(t?.auth?.username&&t.auth.password&&(n.auth=[t.auth.username,t.auth.password]),e.postData)if(e.postData.mimeType===`application/json`)try{n.json=JSON.parse(e.postData.text||`{}`)}catch{n.body=e.postData.text}else if(e.postData.mimeType===`multipart/form-data`){if(e.postData.params)n.multipart=e.postData.params.map(e=>{let t={name:e.name,contents:e.fileName?new ZL(`fopen('${e.fileName}', 'r')`):e.value||``};return e.contentType&&(t.headers={"Content-Type":e.contentType}),t});else if(e.postData.text)try{n.form_params=JSON.parse(e.postData.text)}catch{n.body=e.postData.text}}else if(e.postData.mimeType===`application/x-www-form-urlencoded`){if(e.postData.params){let t={};e.postData.params.forEach(e=>{t[e.name]=e.value||``}),n.form_params=t}}else n.body=e.postData.text;e.headers&&Array.isArray(e.headers)&&e.headers.some(e=>e.name===`Accept-Encoding`&&e.value.includes(`gzip`))&&(n.decode_content=!0);let a=`$client = new GuzzleHttp\\Client();
-
-`;if(Object.keys(n).length>0){let e=XL(n);a+=`$response = $client->request('${r}', '${i}', ${e});`}else a+=`$response = $client->request('${r}', '${i}');`;return a}}})),Wyt=s((()=>{Uyt()})),$L,eR,Gyt,tR,Kyt,qyt,Jyt=s((()=>{TL(),QL(),$L=e=>e.replace(/\\/g,`\\\\`).replace(/'/g,`\\'`),eR=e=>`'${$L(e)}'`,Gyt=$L,tR=e=>Array.isArray(e)?e.map(e=>tR(e)):e&&typeof e==`object`?Object.entries(e).reduce((e,[t,n])=>(e[Gyt(t)]=tR(n),e),{}):e,Kyt=e=>{if(!e)return`localhost`;try{return new URL(e).hostname||`localhost`}catch{return`localhost`}},qyt={target:`php`,client:`laravel`,title:`Laravel HTTP Client`,generate(e,t){let n={method:`GET`,...e};n.method=n.method.toUpperCase();let r=vL(n.queryString),i=`${n.url??``}${r}`,a=[];if(t?.auth?.username&&t.auth.password&&a.push(`withBasicAuth(${eR(t.auth.username)}, ${eR(t.auth.password)})`),n.headers?.length){let e={};n.headers.forEach(t=>{wL(e,t.name,t.value)}),a.push(`withHeaders(${XL(tR(e))})`)}if(n.cookies?.length){let e={};n.cookies.forEach(t=>{wL(e,t.name,t.value)}),a.push(`withCookies(${XL(tR(e))}, ${eR(Kyt(n.url??``))})`)}let o;if(n.postData){if(n.postData.mimeType===`application/json`){if(n.postData.text)try{o=JSON.parse(n.postData.text)}catch{a.push(`withBody(${eR(n.postData.text)}, 'application/json')`)}}else if(n.postData.mimeType===`application/x-www-form-urlencoded`&&n.postData.params){let e={};n.postData.params.forEach(t=>{wL(e,t.name,t.value??``)}),a.push(`asForm()`),o=e}else if(n.postData.mimeType===`multipart/form-data`&&n.postData.params){let e={};n.postData.params.forEach(t=>{if(t.fileName!==void 0){let e=[eR(t.name),`file_get_contents(${eR(t.fileName)})`,eR(t.fileName)];t.contentType&&e.push(XL(tR({"Content-Type":t.contentType}))),a.push(`attach(${e.join(`, `)})`)}else t.contentType?a.push(`attach(${eR(t.name)}, ${eR(t.value??``)}, null, ${XL(tR({"Content-Type":t.contentType}))})`):wL(e,t.name,t.value??``)}),Object.keys(e).length>0&&(o=e)}else if(n.postData.mimeType===`application/octet-stream`)a.push(`withBody(${eR(n.postData.text??``)}, 'application/octet-stream')`);else if(n.postData.text)try{o=JSON.parse(n.postData.text)}catch{a.push(`withBody(${eR(n.postData.text)}, ${eR(n.postData.mimeType||`text/plain`)})`)}}let s=n.method.toLowerCase(),c=[`delete`,`get`,`head`,`patch`,`post`,`put`].includes(s)?o!==void 0&&s!==`head`?`${s}(${eR(i)}, ${XL(tR(o),1)})`:`${s}(${eR(i)})`:o===void 0?`send(${eR(n.method)}, ${eR(i)})`:`send(${eR(n.method)}, ${eR(i)}, ${XL(tR(o),1)})`;return`use Illuminate\\Support\\Facades\\Http;\n\n$response = ${a.length>0?[`Http::${a[0]}`,...a.slice(1).map(e=>`  ->${e}`),`  ->${c}`].join(`
-`):`Http::${c}`};`}}})),Yyt=s((()=>{Jyt()})),nR,Xyt=s((()=>{sL(),ML(),dL(),nR=e=>({method:t,headersObj:n,cookies:r,uriObj:i,fullUrl:a,postData:o,allHeaders:s})=>{let{push:c,join:l}=new oL;if(![`GET`,`POST`,`PUT`,`DELETE`,`PATCH`,`HEAD`,`OPTIONS`].includes(t.toUpperCase()))return`Method not supported`;let u=[],d=Object.keys(n);return d.length&&(c(`$headers=@{}`),d.forEach(e=>{e!==`connection`&&c(`$headers.Add("${e}", "${AL(n[e],{escapeChar:"`"})}")`)}),u.push(`-Headers $headers`)),r.length&&(c(`$session = New-Object Microsoft.PowerShell.Commands.WebRequestSession`),r.forEach(e=>{c(`$cookie = New-Object System.Net.Cookie`),c(`$cookie.Name = '${e.name}'`),c(`$cookie.Value = '${e.value}'`),c(`$cookie.Domain = '${i.host}'`),c(`$session.Cookies.Add($cookie)`)}),u.push(`-WebSession $session`)),o?.text&&(u.push(`-ContentType '${AL(lL(s,`content-type`),{delimiter:`'`,escapeChar:"`"})}'`),u.push(`-Body '${o.text}'`)),c(`$response = ${e} -Uri '${a}' -Method ${t} ${u.join(` `)}`),l()}})),Zyt,Qyt=s((()=>{Xyt(),Zyt={info:{key:`restmethod`,title:`Invoke-RestMethod`,link:`https://docs.microsoft.com/en-us/powershell/module/Microsoft.PowerShell.Utility/Invoke-RestMethod`,description:`Powershell Invoke-RestMethod client`},convert:nR(`Invoke-RestMethod`)}})),$yt,ebt=s((()=>{Qyt(),DL(),$yt={target:`powershell`,client:`restmethod`,title:`Invoke-RestMethod`,generate(e){return EL(Zyt,e)}}})),tbt=s((()=>{ebt()})),nbt,rbt=s((()=>{Xyt(),nbt={info:{key:`webrequest`,title:`Invoke-WebRequest`,link:`https://docs.microsoft.com/en-us/powershell/module/Microsoft.PowerShell.Utility/Invoke-WebRequest`,description:`Powershell Invoke-WebRequest client`},convert:nR(`Invoke-WebRequest`)}})),ibt,abt=s((()=>{rbt(),DL(),ibt={target:`powershell`,client:`webrequest`,title:`Invoke-WebRequest`,generate(e){return EL(nbt,e)}}})),obt=s((()=>{abt()}));function rR(e){let t=[[`true`,`True`],[`false`,`False`],[`null`,`None`]],n=e;for(let[e,r]of t){let t=[`(: )${e}(?=,|\\n)`,`^( +)${e}(?=,|\\n)`];for(let e of t)n=n.replace(new RegExp(e,`gm`),`$1${r}`)}return n}function iR(e,t=4){return rR(JSON.stringify(e,null,2).split(`
-`).map((e,n)=>n===0?e:` `.repeat(t)+e).join(`
-`))}function aR(e,t,n){let r={url:`https://example.com`,method:`get`,...t},i=r.method.toLowerCase(),a={};if(r.headers?.length&&(a.headers=r.headers.reduce((e,t)=>(t.name in e||(e[t.name]=t.value),e),{})),r.queryString?.length&&(a.params=yL(r.queryString)),r.cookies?.length&&(a.cookies=Object.fromEntries(r.cookies.map(e=>[e.name,e.value]))),n?.auth?.username&&n?.auth?.password&&(a.auth=[n.auth.username,n.auth.password]),r.postData){let{mimeType:e,text:t,params:n}=r.postData;if(e===`application/json`&&t)try{a.json=JSON.parse(t)}catch{a.data=t}else if(e===`application/octet-stream`&&t)a.data=t;else if(e===`multipart/form-data`&&n){let e=[],t={};n.forEach(n=>{if(n.fileName!==void 0){let t=JSON.stringify(n.name),r=JSON.stringify(n.fileName),i=`open(${r}, "rb")`;if(n.contentType){let a=JSON.stringify(n.contentType);e.push(`(${t}, (${r}, ${i}, ${a}))`)}else e.push(`(${t}, ${i})`)}else if(n.value!==void 0)if(n.contentType){let t=JSON.stringify(n.name),r=JSON.stringify(n.value),i=JSON.stringify(n.contentType);e.push(`(${t}, (None, ${r}, ${i}))`)}else wL(t,n.name,n.value)}),e.length&&(a.files=e),Object.keys(t).length&&(a.data=t)}else if(e===`application/x-www-form-urlencoded`&&n){let e={};n.forEach(t=>{wL(e,t.name,t.value??``)}),a.data=e}}let o=[],s=`"${r.url}"`;r.url.length>40?o.push(s):o.push(``);for(let[e,t]of Object.entries(a))if(e===`auth`)o.push(`${e}=(${rR(JSON.stringify(t[0]))}, ${rR(JSON.stringify(t[1]))})`);else if(e===`files`){let n=`[
-`+t.map(e=>`      ${e}`).join(`,
-`)+`
-    ]`;o.push(`${e}=${n}`)}else if(e===`json`){let n=iR(t);o.push(`${e}=${n}`)}else if(e===`data`&&r.postData?.mimeType===`application/octet-stream`)o.push(`${e}=b"${t}"`);else{let n=iR(t);o.push(`${e}=${n}`)}return r.url.length>40?`${e}.${i}(\n    ${o.join(`,
-    `)}\n)`:o.length<=1?`${e}.${i}(${s})`:`${e}.${i}(${s}${o.length>1?`,`:``}\n    ${o.slice(1).join(`,
-    `)}\n)`}var oR=s((()=>{TL()})),sbt,cbt,lbt,ubt=s((()=>{TL(),oR(),sbt=(e,t=`    `)=>e.split(`
-`).map(e=>e.trim()===``?e:`${t}${e}`).join(`
-`),cbt=(e,t,n,r)=>{let i=JSON.stringify(n);return n.length>40?`${e}.${t}(\n    ${[i,...r].join(`,
-    `)}\n)`:r.length===0?`${e}.${t}(${i})`:`${e}.${t}(${i},\n    ${r.join(`,
-    `)}\n)`},lbt={target:`python`,client:`aiohttp`,title:`aiohttp`,generate(e,t){let n={url:`https://example.com`,method:`get`,...e},r=n.method?.toLowerCase()??`get`,i=[],a=[],o=[];if(n.headers?.length){let e=n.headers.reduce((e,t)=>(t.name in e||(e[t.name]=t.value),e),{});i.push(`headers=${iR(e)}`)}if(n.queryString?.length&&i.push(`params=${iR(yL(n.queryString))}`),n.cookies?.length){let e=Object.fromEntries(n.cookies.map(e=>[e.name,e.value]));a.push(`cookies=${iR(e)}`)}if(t?.auth?.username&&t?.auth?.password&&a.push(`auth=aiohttp.BasicAuth(${JSON.stringify(t.auth.username)}, ${JSON.stringify(t.auth.password)})`),n.postData){let{mimeType:e,text:t,params:r}=n.postData;if(e===`application/json`&&t)try{i.push(`json=${iR(JSON.parse(t))}`)}catch{i.push(`data=${JSON.stringify(t)}`)}else if(e===`application/octet-stream`&&t)i.push(`data=b"${t}"`);else if(e===`multipart/form-data`&&r)o.push(`data = aiohttp.FormData()`),r.forEach(e=>{if(e.fileName!==void 0){let t=[JSON.stringify(e.name),`open(${JSON.stringify(e.fileName)}, "rb")`,`filename=${JSON.stringify(e.fileName)}`];e.contentType&&t.push(`content_type=${JSON.stringify(e.contentType)}`),o.push(`data.add_field(${t.join(`, `)})`);return}if(e.contentType){o.push(`data.add_field(${JSON.stringify(e.name)}, ${JSON.stringify(e.value??``)}, content_type=${JSON.stringify(e.contentType)})`);return}o.push(`data.add_field(${JSON.stringify(e.name)}, ${JSON.stringify(e.value??``)})`)}),i.push(`data=data`);else if(e===`application/x-www-form-urlencoded`&&r){let e={};r.forEach(t=>{wL(e,t.name,t.value??``)}),i.push(`data=${iR(e)}`)}else t&&i.push(`data=${JSON.stringify(t)}`)}let s=a.length===0?`async with aiohttp.ClientSession() as session:`:`async with aiohttp.ClientSession(\n    ${a.join(`,
-    `)}\n) as session:`,c=cbt(`await session`,r,n.url??``,i);return`${s}\n${sbt([...o,c].join(`
-`))}`}}})),dbt=s((()=>{ubt()})),fbt,pbt=s((()=>{oR(),fbt={target:`python`,client:`httpx_async`,title:`HTTPX (Async)`,generate(e,t){let n=aR(`await client`,e,t);return n=n.split(`
-`).map(e=>e.trim()===``?e:`    `+e).join(`
-`),`async with httpx.AsyncClient() as client:\n${n}`}}})),mbt,hbt=s((()=>{oR(),mbt={target:`python`,client:`httpx_sync`,title:`HTTPX (Sync)`,generate(e,t){return aR(`httpx`,e,t)}}})),gbt=s((()=>{pbt(),hbt()})),_bt,vbt,ybt,bbt,xbt,Sbt,Cbt=s((()=>{TL(),oR(),_bt=e=>{if(typeof globalThis.btoa==`function`)return globalThis.btoa(e);if(typeof Buffer<`u`)return Buffer.from(e,`utf-8`).toString(`base64`);throw Error(`Could not encode basic auth credentials`)},vbt=e=>{if(!e)return new URL(`https://example.com`);try{return new URL(e)}catch{return new URL(e,`https://example.com`)}},ybt=(e,t=[])=>{if(!t.length)return e.search;let n=vL(t);return e.search?`${e.search}&${n.slice(1)}`:n},bbt=e=>`b"${JSON.stringify(e).slice(1,-1)}"`,xbt=(e,t,n)=>{let r=e.postData;if(!r)return{payloadLines:[]};let{mimeType:i,text:a,params:o}=r;if(i===`application/json`&&a)try{let e=JSON.parse(a);return n.add(`import json`),{payloadLines:[`payload = json.dumps(${iR(e,0)})`],payloadVariable:`payload`}}catch{return{payloadLines:[`payload = ${JSON.stringify(a)}`],payloadVariable:`payload`}}if(i===`application/octet-stream`&&a)return{payloadLines:[`payload = ${bbt(a)}`],payloadVariable:`payload`};if(i===`application/x-www-form-urlencoded`&&o){n.add(`import urllib.parse`);let e={};return o.forEach(t=>{wL(e,t.name,t.value??``)}),t[`Content-Type`]||=`application/x-www-form-urlencoded`,{payloadLines:[`payload = urllib.parse.urlencode(${iR(e,0)}, doseq=True)`],payloadVariable:`payload`}}if(i===`multipart/form-data`&&o){let e=[`boundary = "----ScalarSnippetzBoundary"`,`data_list = []`];return o.forEach(t=>{e.push(`data_list.append("--" + boundary)`),t.fileName===void 0?e.push(`data_list.append(${JSON.stringify(`Content-Disposition: form-data; name="${t.name}"`)})`):e.push(`data_list.append(${JSON.stringify(`Content-Disposition: form-data; name="${t.name}"; filename="${t.fileName}"`)})`),t.contentType&&e.push(`data_list.append(${JSON.stringify(`Content-Type: ${t.contentType}`)})`),e.push(`data_list.append("")`),t.fileName===void 0?e.push(`data_list.append(${JSON.stringify(t.value??``)})`):e.push(`data_list.append(open(${JSON.stringify(t.fileName)}, "rb").read().decode("latin-1"))`)}),e.push(`data_list.append("--" + boundary + "--")`),e.push(`data_list.append("")`),e.push(`payload = "\\r\\n".join(data_list)`),t[`Content-Type`]=`multipart/form-data; boundary=----ScalarSnippetzBoundary`,{payloadLines:e,payloadVariable:`payload`}}if(a)try{let e=JSON.parse(a);return n.add(`import json`),{payloadLines:[`payload = json.dumps(${iR(e,0)})`],payloadVariable:`payload`}}catch{return{payloadLines:[`payload = ${JSON.stringify(a)}`],payloadVariable:`payload`}}return{payloadLines:[]}},Sbt={target:`python`,client:`python3`,title:`http.client`,generate(e,t){let n=Pgt({url:`https://example.com`,...e}),r=vbt(n.url??`https://example.com`),i=ybt(r,n.queryString),a=`${r.pathname||`/`}${i}`,o=n.headers?.reduce((e,t)=>(t.name in e||(e[t.name]=t.value),e),{})??{};if(n.cookies?.length){let e=n.cookies.map(e=>`${encodeURIComponent(e.name)}=${encodeURIComponent(e.value)}`).join(`; `);o.Cookie?o.Cookie=`${o.Cookie}; ${e}`:o.Cookie=e}t?.auth?.username&&t.auth.password&&(o.Authorization=`Basic ${_bt(`${t.auth.username}:${t.auth.password}`)}`);let s=new Set([`import http.client`]),c=[],l=xbt(n,o,s);c.push(...l.payloadLines),Object.keys(o).length&&c.push(`headers = ${iR(o,0)}`);let u=[JSON.stringify(n.method),JSON.stringify(a)];l.payloadVariable&&u.push(`body=${l.payloadVariable}`),Object.keys(o).length&&u.push(`headers=headers`);let d=u.length<=2?`conn.request(${u.join(`, `)})`:`conn.request(\n    ${u.join(`,
-    `)},\n)`;return[...s,``,`conn = http.client.${r.protocol===`https:`?`HTTPSConnection`:`HTTPConnection`}(${JSON.stringify(r.host)})`,...c.length?[``,...c]:[],``,d,``,`response = conn.getresponse()`,`print(response.read().decode())`,``,`conn.close()`].join(`
-`)}}})),wbt=s((()=>{Cbt()})),Tbt,Ebt=s((()=>{oR(),Tbt={target:`python`,client:`requests`,title:`Requests`,generate(e,t){return aR(`requests`,e,t)}}})),Dbt=s((()=>{Ebt()})),Obt,sR,kbt,Abt=s((()=>{TL(),Obt=(e,t)=>{try{return sR(JSON.parse(e),t)}catch{return`"${e}"`}},sR=(e,t)=>{if(e==null)return`NULL`;if(typeof e==`boolean`)return e?`TRUE`:`FALSE`;if(typeof e==`number`)return String(e);if(typeof e==`string`)return`"${e.replace(/\\/g,`\\\\`).replace(/"/g,`\\"`)}"`;if(Array.isArray(e))return e.length===0?`list()`:`list(\n${e.map(e=>`${t}  ${sR(e,t+`  `)}`).join(`,
-`)}\n${t})`;if(typeof e==`object`){let n=Object.entries(e);return n.length===0?`list()`:`list(\n${n.map(([e,n])=>`${t}  ${e} = ${sR(n,t+`  `)}`).join(`,
-`)}\n${t})`}return String(e)},kbt={target:`r`,client:`httr2`,title:`httr2`,generate(e,t){let n={url:`https://example.com`,method:`GET`,...e},r=n.method.toUpperCase(),i=[`library(httr2)`,``];i.push(`response <- request("${n.url}") |>`);let a=[];r!==`GET`&&a.push(`  req_method("${r}")`);let o={};if(n.headers?.length)for(let e of n.headers)o[e.name]=e.value;if(n.cookies?.length&&(o.Cookie=n.cookies.map(e=>`${e.name}=${e.value}`).join(`; `)),t?.auth?.username&&t?.auth?.password&&a.push(`  req_auth_basic("${t.auth.username}", "${t.auth.password}")`),Object.keys(o).length){let e=Object.entries(o);if(e.length===1){let[t,n]=e[0];a.push(`  req_headers("${t}" = "${n}")`)}else{let t=e.map(([e,t])=>`    "${e}" = "${t}"`).join(`,
-`);a.push(`  req_headers(\n${t}\n  )`)}}if(n.queryString?.length){let e=yL(n.queryString),t=Object.entries(e);if(t.length===1){let[e,n]=t[0];if(Array.isArray(n)){let t=n.map(e=>`"${e}"`).join(`, `);a.push(`  req_url_query("${e}" = c(${t}))`)}else a.push(`  req_url_query("${e}" = "${n}")`)}else{let e=t.map(([e,t])=>Array.isArray(t)?`    "${e}" = c(${t.map(e=>`"${e}"`).join(`, `)})`:`    "${e}" = "${t}"`).join(`,
-`);a.push(`  req_url_query(\n${e}\n  )`)}}if(n.postData){let{mimeType:e,text:t,params:r}=n.postData;if(e===`application/json`&&t){let e=Obt(t,`  `);a.push(`  req_body_json(${e})`)}else if(e===`multipart/form-data`&&r){let e=r.map(e=>e.fileName===void 0?`    ${e.name} = "${e.value??``}"`:`    ${e.name} = curl::form_file("${e.fileName}")`).join(`,
-`);a.push(`  req_body_multipart(\n${e}\n  )`)}else if(e===`application/x-www-form-urlencoded`&&r){let e=r.map(e=>`    "${e.name}" = "${e.value??``}"`).join(`,
-`);a.push(`  req_body_form(\n${e}\n  )`)}else t&&a.push(`  req_body_raw("${t}", type = "${e??`application/octet-stream`}")`)}return a.push(`  req_perform()`),i[i.length-1]=`response <- request("${n.url}") |>`,i.push(a.join(` |>
-`)),i.push(``),i.push(`resp_body_string(response)`),i.join(`
-`)}}})),jbt=s((()=>{Abt()})),cR,lR,uR,Mbt,dR,Nbt,Pbt,Fbt,Ibt=s((()=>{TL(),cR=e=>e.replace(/\\/g,`\\\\`).replace(/"/g,`\\"`),lR=e=>e.replace(/\\/g,`\\\\`).replace(/'/g,`\\'`),uR=e=>encodeURIComponent(e).replace(/'/g,`%27`),Mbt=new Set([`GET`,`POST`,`HEAD`,`DELETE`,`PATCH`,`PUT`,`OPTIONS`,`COPY`,`LOCK`,`UNLOCK`,`MOVE`,`TRACE`]),dR=e=>e.charAt(0)+e.slice(1).toLowerCase(),Nbt=(e,t,n)=>{if(Mbt.has(t))return;let r=dR(t);e.push(`class Net::HTTP::${r} < Net::HTTPRequest`),e.push(`  METHOD = '${t}'`),e.push(`  REQUEST_HAS_BODY = '${n?`true`:`false`}'`),e.push(`  RESPONSE_HAS_BODY = true`),e.push(`end`),e.push(``)},Pbt=e=>{try{let t=new URL(e),n=t.pathname.split(`/`).map(e=>encodeURIComponent(decodeURIComponent(e)).replace(/%5B/g,`[`).replace(/%5D/g,`]`).replace(/%24/g,`$`)).join(`/`);return t.pathname===`/`?`${t.origin}${t.search}${t.hash}`:`${t.origin}${n}${t.search}${t.hash}`}catch{return e}},Fbt={target:`ruby`,client:`native`,title:`net::http`,generate(e,t){let n={method:`GET`,...e};n.method=n.method.toUpperCase();let r=vL(n.queryString),i=Pbt(`${n.url??``}${r}`),a=[`require 'uri'`,`require 'net/http'`,``];Nbt(a,n.method,!!n.postData?.text),a.push(`url = URI("${cR(i)}")`,``),a.push(`http = Net::HTTP.new(url.host, url.port)`),i.startsWith(`https://`)&&a.push(`http.use_ssl = true`),a.push(``);let o=dR(n.method);if(a.push(`request = Net::HTTP::${o}.new(url)`),t?.auth?.username&&t?.auth?.password){let e=cR(t.auth.username),n=cR(t.auth.password);a.push(`request.basic_auth("${e}", "${n}")`)}if(n.headers?.length&&n.headers.forEach(e=>{a.push(`request["${cR(e.name)}"] = '${lR(e.value)}'`)}),n.cookies?.length){let e=n.cookies.map(e=>`${uR(e.name)}=${uR(e.value)}`).join(`; `);a.push(`request["Cookie"] = '${lR(e)}'`)}if(n.postData){let{mimeType:e,text:t,params:r}=n.postData;if(e===`application/json`&&t!==void 0)try{let e=JSON.parse(t),n=JSON.stringify(e,null,2);a.push(`request.body = <<~JSON`),a.push(n),a.push(`JSON`)}catch{a.push(`request.body = ${JSON.stringify(t)}`)}else if(e===`application/x-www-form-urlencoded`&&r){let e=r.map(e=>`${uR(e.name)}=${uR(e.value??``)}`).join(`&`);a.push(`request.body = '${lR(e)}'`)}else e===`multipart/form-data`&&r?(a.push(`form_data = []`),r.forEach(e=>{let t=lR(e.name);if(e.fileName!==void 0){let n=lR(e.fileName);if(e.contentType){let r=lR(e.contentType);a.push(`form_data << ['${t}', File.open('${n}'), { filename: '${n}', content_type: '${r}' }]`)}else a.push(`form_data << ['${t}', File.open('${n}')]`)}else if(e.contentType){let n=lR(e.value??``),r=lR(e.contentType);a.push(`form_data << ['${t}', '${n}', { content_type: '${r}' }]`)}else{let n=lR(e.value??``);a.push(`form_data << ['${t}', '${n}']`)}}),a.push(`request.set_form(form_data, 'multipart/form-data')`)):e===`application/octet-stream`?a.push(`request.body = ${JSON.stringify(t??``)}`):t!==void 0&&a.push(`request.body = ${JSON.stringify(t)}`)}return a.push(``,`response = http.request(request)`,`puts response.read_body`),a.join(`
-`)}}})),Lbt=s((()=>{Ibt()}));function Rbt(e){return e.replace(/\\/g,`\\\\`).replace(/"/g,`\\"`).replace(/\n/g,`\\n`).replace(/\r/g,`\\r`).replace(/\t/g,`\\t`).replace(/\0/g,`\\0`)}function fR(e){return`"${Rbt(e)}"`}function pR(e,t){return`${` `.repeat(e*4)}${t}`}function mR(e,...t){return pR(1,`.${e}(${t.join(`, `)})`)}function zbt(e){try{let t=JSON.parse(e),n=JSON.stringify(t,null,4).split(`
-`);return n.map((e,t)=>t===0?e:(n.length-1,pR(1,e))).join(`
-`)}catch{return e}}var Bbt=s((()=>{})),Vbt,Hbt,Ubt,Wbt,Gbt,Kbt,qbt=s((()=>{TL(),Bbt(),Vbt={target:`rust`,client:`reqwest`,title:`reqwest`,generate(e,t){if(!e)return``;let n=Pgt(e),r=vL(n.queryString),i=Fgt(n.url||``,r),a=Igt(n),o=[],s=Ubt(t?.auth);s&&o.push(s),o.push(...Wbt(a));let c=Gbt(n.postData);return c&&o.push(c),Kbt(i,n.method,o)}},Hbt=e=>{if(e.fileName){let t=[pR(2,`let part = reqwest::multipart::Part::text(${fR(e.value||``)})`),pR(3,`.file_name(${fR(e.fileName)})`)];return e.contentType?(t.push(pR(3,`.mime_str(${fR(e.contentType)})`)),t.push(pR(3,`.unwrap();`))):t[t.length-1]+=`;`,t.push(pR(2,`form = form.part(${fR(e.name)}, part);`)),t.join(`
-`)}return e.contentType?[pR(2,`let part = reqwest::multipart::Part::text(${fR(e.value||``)})`),pR(3,`.mime_str(${fR(e.contentType)})`),pR(3,`.unwrap();`),pR(2,`form = form.part(${fR(e.name)}, part);`)].join(`
-`):pR(2,`form = form.text(${fR(e.name)}, ${fR(e.value||``)});`)},Ubt=e=>!e?.username||!e?.password?null:mR(`basic_auth`,fR(e.username),fR(e.password)),Wbt=e=>Object.entries(e).map(([e,t])=>mR(`header`,fR(e),fR(t))),Gbt=e=>{if(!e)return null;let{mimeType:t,text:n,params:r}=e;switch(t){case`application/json`:return mR(`json`,`&serde_json::json!(${zbt(n)})`);case`application/x-www-form-urlencoded`:return mR(`form`,`&[${r?.map(e=>`(${fR(e.name)}, ${fR(e.value||``)})`).join(`, `)||``}]`);case`multipart/form-data`:{let e=r?.map(Hbt).join(`
-`)||``;return pR(1,[`.multipart({`,pR(2,`let mut form = reqwest::multipart::Form::new();`),e,pR(3,`form`),pR(2,`})`)].join(`
-`))}default:return mR(`body`,fR(n||``))}},Kbt=(e,t,n)=>{let r=[`let client = reqwest::Client::new();`,``];n.length>0?(r.push(`let request = client`),r.push(pR(1,`.${t.toLowerCase()}(${fR(e)})`)),r.push(...n)):r.push(`let request = client.${t.toLowerCase()}(${fR(e)})`);let i=r[r.length-1];return r[r.length-1]=i+`;`,r.push(``),r.push(`let response = request.send().await?;`),r.join(`
-`)}})),Jbt=s((()=>{qbt()})),hR,Ybt=s((()=>{hR=e=>e.replace(/'/g,`'\\''`)})),Xbt,Zbt=s((()=>{Ybt(),Xbt={target:`shell`,client:`curl`,title:`Curl`,generate(e,t){let n={method:`GET`,...e};n.method=n.method.toUpperCase();let r=[`curl`],i=n.queryString?.length?`?`+n.queryString.map(e=>`${e.name}=${e.value}`).join(`&`):``,a=`${n.url}${i}`,o=/[\s<>[\]{}|\\^%$]/.test(a);if(r[0]=`curl ${i||o?`'${a}'`:a}`,n.method!==`GET`&&r.push(`--request ${n.method}`),t?.auth?.username&&t?.auth?.password){let e=hR(`${t.auth.username}:${t.auth.password}`);r.push(`--user '${e}'`)}if(n.headers?.length){n.headers.forEach(e=>{let t=hR(`${e.name}: ${e.value}`);r.push(`--header '${t}'`)});let e=n.headers.find(e=>e.name.toLowerCase()===`accept-encoding`);e&&/gzip|deflate/.test(e.value)&&r.push(`--compressed`)}if(n.cookies?.length){let e=hR(n.cookies.map(e=>`${encodeURIComponent(e.name)}=${encodeURIComponent(e.value)}`).join(`; `));r.push(`--cookie '${e}'`)}if(n.postData)if(n.postData.mimeType===`application/json`){if(n.postData.text)try{let e=JSON.parse(n.postData.text),t=hR(JSON.stringify(e,null,2));r.push(`--data '${t}'`)}catch{let e=hR(n.postData.text??``);r.push(`--data '${e}'`)}}else if(n.postData.mimeType===`application/octet-stream`){let e=hR(n.postData.text??``);r.push(`--data-binary '${e}'`)}else if(n.postData.mimeType===`application/x-www-form-urlencoded`&&n.postData.params)n.postData.params.forEach(e=>{let t=hR(e.value??``),n=hR(encodeURIComponent(e.name));r.push(`--data-urlencode '${n}=${t}'`)});else if(n.postData.mimeType===`multipart/form-data`&&n.postData.params)n.postData.params.forEach(e=>{let t=hR(e.name),n=e.contentType?`;type=${e.contentType}`:``;if(e.fileName!==void 0){let i=hR(`${e.fileName}${n}`);r.push(`--form '${t}=@${i}'`)}else{let i=hR(`${e.value??``}${n}`);r.push(`--form '${t}=${i}'`)}});else try{let e=JSON.parse(n.postData.text??``),t=hR(JSON.stringify(e,null,2));r.push(`--data '${t}'`)}catch{let e=hR(n.postData.text??``);r.push(`--data '${e}'`)}return r.join(` \\
-  `)}}})),Qbt=s((()=>{Zbt()})),gR,$bt,ext=s((()=>{gR=(e=``)=>/^[a-z0-9-_/.@%^=:]+$/i.test(e)?e:`'${e.replace(/'/g,`'\\''`)}'`,$bt=e=>e.replace(/\r/g,`\\r`).replace(/\n/g,`\\n`)})),txt,nxt=s((()=>{sL(),ext(),txt={info:{key:`httpie`,title:`HTTPie`,link:`http://httpie.org/`,description:`a CLI, cURL-like tool for humans`},convert:({allHeaders:e,postData:t,queryObj:n,fullUrl:r,method:i,url:a},o)=>{let s={body:!1,cert:!1,headers:!1,indent:`  `,pretty:!1,print:!1,queryParams:!1,short:!1,style:!1,timeout:!1,verbose:!1,verify:!1,...o},{push:c,join:l,unshift:u}=new oL({indent:s.indent,join:s.indent===!1?` `:` \\\n${s.indent}`}),d=!1,f=[];s.headers&&f.push(s.short?`-h`:`--headers`),s.body&&f.push(s.short?`-b`:`--body`),s.verbose&&f.push(s.short?`-v`:`--verbose`),s.print&&f.push(`${s.short?`-p`:`--print`}=${s.print}`),s.verify&&f.push(`--verify=${s.verify}`),s.cert&&f.push(`--cert=${s.cert}`),s.pretty&&f.push(`--pretty=${s.pretty}`),s.style&&f.push(`--style=${s.style}`),s.timeout&&f.push(`--timeout=${s.timeout}`),s.queryParams&&Object.keys(n).forEach(e=>{let t=n[e];Array.isArray(t)?t.forEach(t=>{c(`${e}==${gR(t)}`)}):c(`${e}==${gR(t)}`)}),Object.keys(e).sort().forEach(t=>{c(`${t}:${gR(e[t])}`)}),t?.mimeType===`application/x-www-form-urlencoded`?t.params?.length&&(f.push(s.short?`-f`:`--form`),t.params.forEach(e=>{c(`${e.name}=${gR(e.value)}`)})):t?.mimeType===`multipart/form-data`?t?.params?.length&&(f.push(`--multipart`),t.params.forEach(e=>{e.fileName?c(`${e.name}@${gR(e.fileName)}`):c(`${e.name}='${gR(e.value)}'`)})):d=!0;let p=f.length?`${f.join(` `)} `:``;return a=gR(s.queryParams?a:r),u(`http ${p}${i} ${a}`),d&&t?.text&&u(`echo ${gR(t.text)} | `),l()}}})),rxt,ixt=s((()=>{nxt(),DL(),rxt={target:`shell`,client:`httpie`,title:`HTTPie`,generate(e){return EL(txt,e)}}})),axt=s((()=>{ixt()})),oxt,sxt=s((()=>{sL(),ext(),oxt={info:{key:`wget`,title:`Wget`,link:`https://www.gnu.org/software/wget/`,description:`a free software package for retrieving files using HTTP, HTTPS`},convert:({method:e,postData:t,allHeaders:n,fullUrl:r},i)=>{let a={indent:`  `,short:!1,verbose:!1,...i},{push:o,join:s}=new oL({indent:a.indent,join:a.indent===!1?` `:` \\\n${a.indent}`});return a.verbose?o(`wget ${a.short?`-v`:`--verbose`}`):o(`wget ${a.short?`-q`:`--quiet`}`),o(`--method ${gR(e)}`),Object.keys(n).forEach(e=>{o(`--header ${gR(`${e}: ${n[e]}`)}`)}),t?.text&&o(`--body-data ${$bt(gR(t.text))}`),o(a.short?`-O`:`--output-document`),o(`- ${gR(r)}`),s()}}})),cxt,lxt=s((()=>{sxt(),DL(),cxt={target:`shell`,client:`wget`,title:`Wget`,generate(e){return EL(oxt,e)}}})),uxt=s((()=>{lxt()})),_R,dxt,fxt,vR,yR,pxt,mxt,hxt=s((()=>{TL(),_R=e=>JSON.stringify(e),dxt=e=>{let t=1;for(;e.includes(`"""${`#`.repeat(t)}`);)t+=1;return`#`.repeat(t)},fxt=e=>{try{return JSON.stringify(JSON.parse(e),null,2)}catch{return e}},vR=e=>encodeURIComponent(e),yR=e=>e.replace(/\\/g,`\\\\`).replace(/"/g,`\\"`),pxt=e=>{let t=[`let boundary = UUID().uuidString`,`var body = Data()`,``,`func appendToBody(_ value: String) {`,`  body.append(value.data(using: .utf8)!)`,`}`,``];return e.forEach(e=>{let n=yR(e.name),r=yR(e.fileName??``),i=e.contentType?yR(e.contentType):void 0;t.push(`appendToBody("--\\(boundary)\\r\\n")`),e.fileName===void 0?(t.push(`appendToBody(${_R(`Content-Disposition: form-data; name="${n}"\r\n`)})`),i&&t.push(`appendToBody(${_R(`Content-Type: ${i}\r\n`)})`),t.push(`appendToBody("\\r\\n")`),t.push(`appendToBody(${_R(e.value??``)})`),t.push(`appendToBody("\\r\\n")`)):(t.push(`appendToBody(${_R(`Content-Disposition: form-data; name="${n}"; filename="${r}"\r\n`)})`),i&&t.push(`appendToBody(${_R(`Content-Type: ${i}\r\n`)})`),t.push(`appendToBody("\\r\\n")`),t.push(`appendToBody(${_R(`<# File data for ${e.fileName||`file`} #>\r\n`)})`)),t.push(``)}),t.push(`appendToBody("--\\(boundary)--\\r\\n")`),t},mxt={target:`swift`,client:`nsurlsession`,title:`NSURLSession`,generate(e,t){if(!e)return``;let n=bL(e.method),r=xL(SL(e.url??``,e.queryString)),i=CL(e.headers,e.cookies),a=[`import Foundation`,``,`var request = URLRequest(url: URL(string: ${_R(r)})!)`];if(a.push(`request.httpMethod = ${_R(n)}`),i.forEach(e=>{a.push(`request.setValue(${_R(e.value)}, forHTTPHeaderField: ${_R(e.name)})`)}),t?.auth?.username&&t?.auth?.password&&(a.push(`let credentials = ${_R(`${t.auth.username}:${t.auth.password}`)}`),a.push(`let encodedCredentials = Data(credentials.utf8).base64EncodedString()`),a.push(`request.setValue("Basic \\(encodedCredentials)", forHTTPHeaderField: "Authorization")`)),e.postData){let{mimeType:t,text:n,params:r}=e.postData;if(t===`application/json`&&n!==void 0){let e=fxt(n),t=dxt(e);a.push(`let jsonBody = ${t}"""`),a.push(e),a.push(`"""${t}`),a.push(`request.httpBody = jsonBody.data(using: .utf8)`)}else if(t===`application/x-www-form-urlencoded`&&r?.length){let e=r.map(e=>`${vR(e.name)}=${vR(e.value??``)}`).join(`&`);a.push(`let formBody = ${_R(e)}`),a.push(`request.httpBody = formBody.data(using: .utf8)`)}else t===`multipart/form-data`&&r?.length?(a.push(...pxt(r)),a.push(`request.setValue("multipart/form-data; boundary=\\(boundary)", forHTTPHeaderField: "Content-Type")`),a.push(`request.httpBody = body`)):t===`application/octet-stream`?(a.push(`let binaryBody = Data(${_R(n??``)}.utf8)`),a.push(`request.httpBody = binaryBody`)):n!==void 0&&(a.push(`let rawBody = ${_R(n)}`),a.push(`request.httpBody = rawBody.data(using: .utf8)`))}return a.push(``),a.push(`let (data, response) = try await URLSession.shared.data(for: request)`),a.push(``),a.push(`guard let httpResponse = response as? HTTPURLResponse,`),a.push(`      200..<300 ~= httpResponse.statusCode else {`),a.push(`  throw URLError(.badServerResponse)`),a.push(`}`),a.push(``),a.push(`print(String(data: data, encoding: .utf8) ?? "")`),a.join(`
-`)}}})),gxt=s((()=>{hxt()})),bR,_xt=s((()=>{Agt(),zgt(),Kgt(),Qgt(),t_t(),m_t(),C_t(),E_t(),j_t(),I_t(),V_t(),K_t(),tvt(),ivt(),nyt(),ayt(),uyt(),hyt(),vyt(),xyt(),wyt(),Dyt(),Nyt(),Ryt(),Vyt(),Wyt(),Yyt(),tbt(),obt(),dbt(),gbt(),wbt(),Dbt(),jbt(),Lbt(),Jbt(),Qbt(),axt(),uxt(),gxt(),bR=[{key:`c`,title:`C`,default:`libcurl`,clients:[Ogt]},{key:`csharp`,title:`C#`,default:`restsharp`,clients:[Wgt,Xgt]},{key:`clojure`,title:`Clojure`,default:`clj_http`,clients:[Lgt]},{key:`dart`,title:`Dart`,default:`http`,clients:[$gt]},{key:`fsharp`,title:`F#`,default:`httpclient`,clients:[f_t]},{key:`go`,title:`Go`,default:`native`,clients:[x_t]},{key:`http`,title:`HTTP`,default:`http1.1`,clients:[w_t]},{key:`java`,title:`Java`,default:`unirest`,clients:[k_t,P_t,z_t,W_t]},{key:`js`,title:`JavaScript`,default:`fetch`,clients:[nvt,$_t,ryt,eyt,cyt]},{key:`kotlin`,title:`Kotlin`,default:`okhttp`,clients:[pyt]},{key:`node`,title:`Node.js`,default:`fetch`,clients:[yyt,gyt,Syt,Tyt]},{key:`objc`,title:`Objective-C`,default:`nsurlsession`,clients:[jyt]},{key:`ocaml`,title:`OCaml`,default:`cohttp`,clients:[Iyt]},{key:`php`,title:`PHP`,default:`curl`,clients:[zyt,Hyt,qyt]},{key:`powershell`,title:`PowerShell`,default:`webrequest`,clients:[ibt,$yt]},{key:`python`,title:`Python`,default:`python3`,clients:[Sbt,Tbt,lbt,mbt,fbt]},{key:`r`,title:`R`,default:`httr2`,clients:[kbt]},{key:`ruby`,title:`Ruby`,default:`native`,clients:[Fbt]},{key:`rust`,title:`Rust`,default:`reqwest`,clients:[Vbt]},{key:`shell`,title:`Shell`,default:`curl`,clients:[Xbt,cxt,rxt]},{key:`swift`,title:`Swift`,default:`nsurlsession`,clients:[mxt]}]}));function xR(){function e(e,t){return bR.find(({key:t})=>t===e)?.clients.find(e=>e.client===t)}return{print(t,n,r){return e(t,n)?.generate(r)},clients(){return bR},plugins(){return bR.flatMap(({key:e,clients:t})=>t.map(t=>({target:e,client:t.client})))},findPlugin:e,hasPlugin(t,n){return!!e(t,n)}}}var vxt=s((()=>{_xt()})),SR=s((()=>{tL(),vxt()})),CR,wR,TR=s((()=>{W(),SR(),CR=e=>`custom/${e.lang}`,wR=(e=eL)=>{let t=new Set(e);return xR().clients().flatMap(e=>{let n=e.clients.flatMap(n=>{let r=`${e.key}/${n.client}`;return t.has(r)?{id:r,lang:n.client===`curl`?`curl`:e.key,title:`${Pt(e.title)} ${n.title}`,label:n.title,targetKey:e.key,targetTitle:e.title,clientKey:n.client}:[]});return n.length===0?[]:{label:e.title,key:e.key,options:n}})}})),yxt,bxt,xxt=s((()=>{W(),kE(),yxt={key:0,class:`request-response-header bg-b-1 -mb-1/2 sticky top-0 z-1 flex min-h-11 items-center border-b px-2.5 text-base font-medium xl:rounded-none`},bxt=N({inheritAttrs:!1,__name:`ViewLayoutSection`,setup(e){let{cx:t}=cf();return(e,n)=>(F(),I(`section`,at($r(j(t)(`xl:custom-scroll bg-b-1 flex flex-1 flex-col xl:h-full xl:min-w-0`))),[e.$slots.title?(F(),I(`div`,yxt,[P(e.$slots,`title`)])):B(``,!0),P(e.$slots,`default`)],16))}})})),ER,Sxt=s((()=>{xxt(),ER=bxt})),Cxt,wxt,Txt=s((()=>{W(),Cxt=[`aria-controls`,`aria-selected`,`tabindex`],wxt=N({__name:`SectionFilterButton`,props:{selected:{type:Boolean},controls:{}},setup(e){return(t,n)=>(F(),I(`button`,{"aria-controls":e.controls??``,"aria-selected":!!e.selected,class:O([`hover:bg-b-2 flex w-fit cursor-pointer items-center rounded p-1 px-2 text-center font-medium whitespace-nowrap has-[:focus-visible]:outline`,{"text-c-1 pointer-events-none":e.selected}]),role:`tab`,tabindex:e.selected?0:-1,type:`button`},[P(t.$slots,`default`)],10,Cxt))}})})),Ext,Dxt=s((()=>{Txt(),Ext=wxt})),Oxt,kxt,Axt,jxt,Mxt=s((()=>{Dxt(),W(),kE(),Oxt={class:`request-section-content request-section-content-filter fade-request-section-content text-c-3 pointer-events-auto relative hidden w-full justify-end gap-[1.5px] rounded py-1.75 text-xs xl:flex`},kxt={class:`filter-button context-bar-group-hover:text-c-1 absolute -right-[30px] flex items-center`},Axt={class:`context-bar-group-hover:hidden mr-1.5`},jxt=N({__name:`SectionFilter`,props:Lr({filters:{default:()=>[]},filterIds:{}},{modelValue:{},modelModifiers:{}}),emits:[`update:modelValue`],setup(e){let t=Ur(e,`modelValue`),n=A(),r=r=>{let i=r===`prev`?-1:1,a=t.value?e.filters.indexOf(t.value):0,o=e.filters.length,s=(a+i+o)%o;t.value=e.filters[s],ar(()=>{if(n.value){let e=n.value.querySelector(`button[aria-selected="true"]`);e&&e.focus()}})};return(i,a)=>(F(),I(`div`,{ref_key:`tablist`,ref:n,class:`filter-hover context-bar-group ml-auto hidden lg:flex`,role:`tablist`,onKeydown:[a[0]||=mo(e=>r(`prev`),[`left`]),a[1]||=mo(e=>r(`next`),[`right`])]},[R(`div`,Oxt,[(F(!0),I(V,null,Ar(e.filters,n=>(F(),L(Ext,{key:n,class:`filter-hover-item`,controls:e.filterIds?.[n],role:`tab`,selected:t.value===n,onClick:e=>t.value=n},{default:M(()=>[z(k(n),1)]),_:2},1032,[`controls`,`selected`,`onClick`]))),128)),R(`div`,kxt,[R(`span`,Axt,k(t.value),1),H(j(jT),{icon:`FilterList`,size:`md`,thickness:`2`})])])],544))}})})),DR,Nxt=s((()=>{Bc(),Mxt(),DR=zc(jxt,[[`__scopeId`,`data-v-f97cc68c`]])}));function Pxt({multiple:e,accept:t,onChange:n,onError:r}={}){let i=A(null),a;return typeof document<`u`&&(a=document.createElement(`input`),a.type=`file`,a.onchange=e=>{i.value=e.target.files,n?.(i.value)},a.onerror=()=>r?.(),a.multiple=e,a.accept=t),{files:pn(i),open:()=>{if(!a)return r?.();a.click()}}}var Fxt=s((()=>{W()})),Ixt,Lxt,Rxt,zxt,Bxt,Vxt,Hxt=s((()=>{W(),kE(),Ixt={class:`group-[.alert]:outline-orange group-[.error]:outline-red w-full pr-10 -outline-offset-1 has-[:focus-visible]:rounded-[4px] has-[:focus-visible]:outline`},Lxt={class:`text-c-1 whitespace-nowrap`},Rxt={class:`text-c-1 overflow-hidden text-ellipsis`},zxt={class:`overflow-hidden text-ellipsis`},Bxt={class:`flex h-4 w-4 items-center justify-center`},Vxt=N({__name:`DataTableInputSelect`,props:{modelValue:{type:[String,Number,Boolean,Array,Object]},value:{},default:{type:[String,Number,Boolean,Array,Object]},canAddCustomValue:{type:Boolean,default:!0},type:{}},emits:[`update:modelValue`],setup(e,{emit:t}){let n=e,r=t,i=U(()=>n.value??[]),a=A(!1),o=A(``),s=A(null);mr(o,e=>{r(`update:modelValue`,e)});let c=e=>{r(`update:modelValue`,e),a.value=!1},l=()=>{o.value.trim()&&c(o.value)},u=()=>{o.value.trim()||r(`update:modelValue`,``),a.value=!1},d=e=>n.modelValue.toString()===e;mr(a,e=>{e&&ar(()=>{s.value?.focus()})});let f=U(()=>n.modelValue===void 0?n.default:n.modelValue),p=U(()=>i.value.map(e=>{let t=e.toString();return{id:t,label:t,value:t}})),m=U(()=>{let e=new Set(n.modelValue.toString().split(`,`));return p.value.filter(t=>e.has(t.id))}),h=e=>{r(`update:modelValue`,e.map(e=>e.value).join(`,`))};return(t,n)=>(F(),I(`div`,Ixt,[e.type===`array`?(F(),L(j(IS),{key:0,modelValue:m.value,options:p.value,"onUpdate:modelValue":h},{default:M(()=>[H(j(gf),{class:`custom-scroll h-full justify-start gap-1.5 px-2 py-1.5 pr-6 font-normal outline-none`,fullWidth:``,variant:`ghost`},{default:M(()=>[R(`span`,Lxt,k(m.value.length>0?m.value.map(e=>e.label).join(`, `):`Select a value`),1),H(j(jT),{class:`min-w-4`,icon:`ChevronDown`,size:`md`})]),_:1})]),_:1},8,[`modelValue`,`options`])):a.value?lr((F(),I(`input`,{key:1,ref_key:`inputRef`,ref:s,"onUpdate:modelValue":n[0]||=e=>o.value=e,class:`text-c-1 w-full min-w-0 border-none px-2 py-1.5 outline-none`,placeholder:`Value`,type:`text`,onBlur:u,onKeyup:mo(l,[`enter`])},null,544)),[[lo,o.value]]):(F(),L(j(KS),{key:2,resize:``,value:f.value},{items:M(()=>[(F(!0),I(V,null,Ar(i.value,e=>(F(),L(j(tC),{key:e,class:`group/item flex items-center gap-1.5 overflow-hidden text-ellipsis whitespace-nowrap`,value:e,onClick:t=>c(e)},{default:M(()=>[R(`div`,{class:O([`flex h-4 w-4 items-center justify-center rounded-full p-[3px]`,d(e)?`bg-c-accent text-b-1`:`shadow-border text-transparent`])},[H(j(jT),{class:`size-2.5`,icon:`Checkmark`,thickness:`3`})],2),R(`span`,zxt,k(e),1)]),_:2},1032,[`value`,`onClick`]))),128)),e.canAddCustomValue?(F(),I(V,{key:0},[i.value.length?(F(),L(j(QS),{key:0})):B(``,!0),H(j(tC),{class:`flex items-center gap-1.5`,onClick:n[1]||=e=>a.value=!0},{default:M(()=>[R(`div`,Bxt,[H(j(jT),{icon:`Add`,size:`sm`})]),n[2]||=R(`span`,null,`Add value`,-1)]),_:1})],64)):B(``,!0)]),default:M(()=>[H(j(gf),{class:`size-full justify-start gap-1.5 overflow-auto px-2 py-1.5 font-normal whitespace-nowrap outline-none`,variant:`ghost`},{default:M(()=>[R(`span`,Rxt,k(f.value??`Select a value`),1),H(j(jT),{icon:`ChevronDown`,size:`md`})]),_:1})]),_:1},8,[`value`]))]))}})})),OR,Uxt=s((()=>{Hxt(),OR=Vxt}));function kR(e){return Array.isArray?Array.isArray(e):Xxt(e)===`[object Array]`}function Wxt(e){if(typeof e==`string`)return e;let t=e+``;return t==`0`&&1/e==-mSt?`-0`:t}function Gxt(e){return e==null?``:Wxt(e)}function AR(e){return typeof e==`string`}function Kxt(e){return typeof e==`number`}function qxt(e){return e===!0||e===!1||Yxt(e)&&Xxt(e)==`[object Boolean]`}function Jxt(e){return typeof e==`object`}function Yxt(e){return Jxt(e)&&e!==null}function jR(e){return e!=null}function MR(e){return!e.trim().length}function Xxt(e){return e==null?e===void 0?`[object Undefined]`:`[object Null]`:Object.prototype.toString.call(e)}function Zxt(e){let t=null,n=null,r=null,i=1,a=null;if(AR(e)||kR(e))r=e,t=Qxt(e),n=NR(e);else{if(!IR.call(e,`name`))throw Error(vSt(`name`));let o=e.name;if(r=o,IR.call(e,`weight`)&&(i=e.weight,i<=0))throw Error(ySt(o));t=Qxt(o),n=NR(o),a=e.getFn}return{path:t,id:n,weight:i,src:r,getFn:a}}function Qxt(e){return kR(e)?e:e.split(`.`)}function NR(e){return kR(e)?e.join(`.`):e}function $xt(e,t){let n=[],r=!1,i=(e,t,a)=>{if(jR(e))if(!t[a])n.push(e);else{let o=e[t[a]];if(!jR(o))return;if(a===t.length-1&&(AR(o)||Kxt(o)||qxt(o)))n.push(Gxt(o));else if(kR(o)){r=!0;for(let e=0,n=o.length;e<n;e+=1)i(o[e],t,a+1)}else t.length&&i(o,t,a+1)}};return i(e,AR(t)?t.split(`.`):t,0),r?n:n[0]}function eSt(e=1,t=3){let n=new Map,r=10**t;return{get(t){let i=t.match(TSt).length;if(n.has(i))return n.get(i);let a=1/i**(.5*e),o=parseFloat(Math.round(a*r)/r);return n.set(i,o),o},clear(){n.clear()}}}function tSt(e,t,{getFn:n=LR.getFn,fieldNormWeight:r=LR.fieldNormWeight}={}){let i=new RR({getFn:n,fieldNormWeight:r});return i.setKeys(e.map(Zxt)),i.setSources(t),i.create(),i}function nSt(e,{getFn:t=LR.getFn,fieldNormWeight:n=LR.fieldNormWeight}={}){let{keys:r,records:i}=e,a=new RR({getFn:t,fieldNormWeight:n});return a.setKeys(r),a.setIndexRecords(i),a}function PR(e,{errors:t=0,currentLocation:n=0,expectedLocation:r=0,distance:i=LR.distance,ignoreLocation:a=LR.ignoreLocation}={}){let o=t/e.length;if(a)return o;let s=Math.abs(r-n);return i?o+s/i:s?1:o}function rSt(e=[],t=LR.minMatchCharLength){let n=[],r=-1,i=-1,a=0;for(let o=e.length;a<o;a+=1){let o=e[a];o&&r===-1?r=a:!o&&r!==-1&&(i=a-1,i-r+1>=t&&n.push([r,i]),r=-1)}return e[a-1]&&a-r>=t&&n.push([r,a-1]),n}function iSt(e,t,n,{location:r=LR.location,distance:i=LR.distance,threshold:a=LR.threshold,findAllMatches:o=LR.findAllMatches,minMatchCharLength:s=LR.minMatchCharLength,includeMatches:c=LR.includeMatches,ignoreLocation:l=LR.ignoreLocation}={}){if(t.length>zR)throw Error(_St(zR));let u=t.length,d=e.length,f=Math.max(0,Math.min(r,d)),p=a,m=f,h=s>1||c,g=h?Array(d):[],_;for(;(_=e.indexOf(t,m))>-1;){let e=PR(t,{currentLocation:_,expectedLocation:f,distance:i,ignoreLocation:l});if(p=Math.min(e,p),m=_+u,h){let e=0;for(;e<u;)g[_+e]=1,e+=1}}m=-1;let v=[],y=1,b=u+d,x=1<<u-1;for(let r=0;r<u;r+=1){let a=0,s=b;for(;a<s;)PR(t,{errors:r,currentLocation:f+s,expectedLocation:f,distance:i,ignoreLocation:l})<=p?a=s:b=s,s=Math.floor((b-a)/2+a);b=s;let c=Math.max(1,f-s+1),_=o?d:Math.min(f+s,d)+u,S=Array(_+2);S[_+1]=(1<<r)-1;for(let a=_;a>=c;--a){let o=a-1,s=n[e.charAt(o)];if(h&&(g[o]=+!!s),S[a]=(S[a+1]<<1|1)&s,r&&(S[a]|=(v[a+1]|v[a])<<1|1|v[a+1]),S[a]&x&&(y=PR(t,{errors:r,currentLocation:o,expectedLocation:f,distance:i,ignoreLocation:l}),y<=p)){if(p=y,m=o,m<=f)break;c=Math.max(1,2*f-m)}}if(PR(t,{errors:r+1,currentLocation:f,expectedLocation:f,distance:i,ignoreLocation:l})>p)break;v=S}let S={isMatch:m>=0,score:Math.max(.001,y)};if(h){let e=rSt(g,s);e.length?c&&(S.indices=e):S.isMatch=!1}return S}function aSt(e){let t={};for(let n=0,r=e.length;n<r;n+=1){let i=e.charAt(n);t[i]=(t[i]||0)|1<<r-n-1}return t}function oSt(e,t){let n=e.match(t);return n?n[1]:null}function sSt(e,t={}){return e.split(NSt).map(e=>{let n=e.trim().split(MSt).filter(e=>e&&!!e.trim()),r=[];for(let e=0,i=n.length;e<i;e+=1){let i=n[e],a=!1,o=-1;for(;!a&&++o<KR;){let e=GR[o],n=e.isMultiMatch(i);n&&(r.push(new e(n,t)),a=!0)}if(!a)for(o=-1;++o<KR;){let e=GR[o],n=e.isSingleMatch(i);if(n){r.push(new e(n,t));break}}}return r})}function cSt(...e){qR.push(...e)}function FR(e,t){for(let n=0,r=qR.length;n<r;n+=1){let r=qR[n];if(r.condition(e,t))return new r(e,t)}return new VR(e,t)}function lSt(e,t,{auto:n=!0}={}){let r=e=>{let i=Object.keys(e),a=ISt(e);if(!a&&i.length>1&&!XR(e))return r(ZR(e));if(LSt(e)){let r=a?e[YR.PATH]:i[0],o=a?e[YR.PATTERN]:e[r];if(!AR(o))throw Error(gSt(r));let s={keyId:NR(r),pattern:o};return n&&(s.searcher=FR(o,t)),s}let o={children:[],operator:i[0]};return i.forEach(t=>{let n=e[t];kR(n)&&n.forEach(e=>{o.children.push(r(e))})}),o};return XR(e)||(e=ZR(e)),r(e)}function uSt(e,{ignoreFieldNorm:t=LR.ignoreFieldNorm}){e.forEach(e=>{let n=1;e.matches.forEach(({key:e,norm:r,score:i})=>{let a=e?e.weight:null;n*=(i===0&&a?2**-52:i)**+((a||1)*(t?1:r))}),e.score=n})}function dSt(e,t){let n=e.matches;t.matches=[],jR(n)&&n.forEach(e=>{if(!jR(e.indices)||!e.indices.length)return;let{indices:n,value:r}=e,i={indices:n,value:r};e.key&&(i.key=e.key.src),e.idx>-1&&(i.refIndex=e.idx),t.matches.push(i)})}function fSt(e,t){t.score=e.score}function pSt(e,t,{includeMatches:n=LR.includeMatches,includeScore:r=LR.includeScore}={}){let i=[];return n&&i.push(dSt),r&&i.push(fSt),e.map(e=>{let{idx:n}=e,r={item:t[n],refIndex:n};return i.length&&i.forEach(t=>{t(e,r)}),r})}var mSt,hSt,gSt,_St,vSt,ySt,IR,bSt,xSt,SSt,CSt,wSt,LR,TSt,RR,zR,BR,VR,HR,ESt,DSt,OSt,kSt,ASt,jSt,UR,WR,GR,KR,MSt,NSt,PSt,FSt,qR,JR,YR,XR,ISt,LSt,ZR,QR,$R=s((()=>{mSt=1/0,hSt=`Incorrect 'index' type`,gSt=e=>`Invalid value for key ${e}`,_St=e=>`Pattern length exceeds max of ${e}.`,vSt=e=>`Missing ${e} property in key`,ySt=e=>`Property 'weight' in key '${e}' must be a positive integer`,IR=Object.prototype.hasOwnProperty,bSt=class{constructor(e){this._keys=[],this._keyMap={};let t=0;e.forEach(e=>{let n=Zxt(e);this._keys.push(n),this._keyMap[n.id]=n,t+=n.weight}),this._keys.forEach(e=>{e.weight/=t})}get(e){return this._keyMap[e]}keys(){return this._keys}toJSON(){return JSON.stringify(this._keys)}},xSt={includeMatches:!1,findAllMatches:!1,minMatchCharLength:1},SSt={isCaseSensitive:!1,ignoreDiacritics:!1,includeScore:!1,keys:[],shouldSort:!0,sortFn:(e,t)=>e.score===t.score?e.idx<t.idx?-1:1:e.score<t.score?-1:1},CSt={location:0,threshold:.6,distance:100},wSt={useExtendedSearch:!1,getFn:$xt,ignoreLocation:!1,ignoreFieldNorm:!1,fieldNormWeight:1},LR={...SSt,...xSt,...CSt,...wSt},TSt=/[^ ]+/g,RR=class{constructor({getFn:e=LR.getFn,fieldNormWeight:t=LR.fieldNormWeight}={}){this.norm=eSt(t,3),this.getFn=e,this.isCreated=!1,this.setIndexRecords()}setSources(e=[]){this.docs=e}setIndexRecords(e=[]){this.records=e}setKeys(e=[]){this.keys=e,this._keysMap={},e.forEach((e,t)=>{this._keysMap[e.id]=t})}create(){this.isCreated||!this.docs.length||(this.isCreated=!0,AR(this.docs[0])?this.docs.forEach((e,t)=>{this._addString(e,t)}):this.docs.forEach((e,t)=>{this._addObject(e,t)}),this.norm.clear())}add(e){let t=this.size();AR(e)?this._addString(e,t):this._addObject(e,t)}removeAt(e){this.records.splice(e,1);for(let t=e,n=this.size();t<n;t+=1)--this.records[t].i}getValueForItemAtKeyId(e,t){return e[this._keysMap[t]]}size(){return this.records.length}_addString(e,t){if(!jR(e)||MR(e))return;let n={v:e,i:t,n:this.norm.get(e)};this.records.push(n)}_addObject(e,t){let n={i:t,$:{}};this.keys.forEach((t,r)=>{let i=t.getFn?t.getFn(e):this.getFn(e,t.path);if(jR(i)){if(kR(i)){let e=[],t=[{nestedArrIndex:-1,value:i}];for(;t.length;){let{nestedArrIndex:n,value:r}=t.pop();if(jR(r))if(AR(r)&&!MR(r)){let t={v:r,i:n,n:this.norm.get(r)};e.push(t)}else kR(r)&&r.forEach((e,n)=>{t.push({nestedArrIndex:n,value:e})})}n.$[r]=e}else if(AR(i)&&!MR(i)){let e={v:i,n:this.norm.get(i)};n.$[r]=e}}}),this.records.push(n)}toJSON(){return{keys:this.keys,records:this.records}}},zR=32,BR=String.prototype.normalize?(e=>e.normalize(`NFD`).replace(/[\u0300-\u036F\u0483-\u0489\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u05C5\u05C7\u0610-\u061A\u064B-\u065F\u0670\u06D6-\u06DC\u06DF-\u06E4\u06E7\u06E8\u06EA-\u06ED\u0711\u0730-\u074A\u07A6-\u07B0\u07EB-\u07F3\u07FD\u0816-\u0819\u081B-\u0823\u0825-\u0827\u0829-\u082D\u0859-\u085B\u08D3-\u08E1\u08E3-\u0903\u093A-\u093C\u093E-\u094F\u0951-\u0957\u0962\u0963\u0981-\u0983\u09BC\u09BE-\u09C4\u09C7\u09C8\u09CB-\u09CD\u09D7\u09E2\u09E3\u09FE\u0A01-\u0A03\u0A3C\u0A3E-\u0A42\u0A47\u0A48\u0A4B-\u0A4D\u0A51\u0A70\u0A71\u0A75\u0A81-\u0A83\u0ABC\u0ABE-\u0AC5\u0AC7-\u0AC9\u0ACB-\u0ACD\u0AE2\u0AE3\u0AFA-\u0AFF\u0B01-\u0B03\u0B3C\u0B3E-\u0B44\u0B47\u0B48\u0B4B-\u0B4D\u0B56\u0B57\u0B62\u0B63\u0B82\u0BBE-\u0BC2\u0BC6-\u0BC8\u0BCA-\u0BCD\u0BD7\u0C00-\u0C04\u0C3E-\u0C44\u0C46-\u0C48\u0C4A-\u0C4D\u0C55\u0C56\u0C62\u0C63\u0C81-\u0C83\u0CBC\u0CBE-\u0CC4\u0CC6-\u0CC8\u0CCA-\u0CCD\u0CD5\u0CD6\u0CE2\u0CE3\u0D00-\u0D03\u0D3B\u0D3C\u0D3E-\u0D44\u0D46-\u0D48\u0D4A-\u0D4D\u0D57\u0D62\u0D63\u0D82\u0D83\u0DCA\u0DCF-\u0DD4\u0DD6\u0DD8-\u0DDF\u0DF2\u0DF3\u0E31\u0E34-\u0E3A\u0E47-\u0E4E\u0EB1\u0EB4-\u0EB9\u0EBB\u0EBC\u0EC8-\u0ECD\u0F18\u0F19\u0F35\u0F37\u0F39\u0F3E\u0F3F\u0F71-\u0F84\u0F86\u0F87\u0F8D-\u0F97\u0F99-\u0FBC\u0FC6\u102B-\u103E\u1056-\u1059\u105E-\u1060\u1062-\u1064\u1067-\u106D\u1071-\u1074\u1082-\u108D\u108F\u109A-\u109D\u135D-\u135F\u1712-\u1714\u1732-\u1734\u1752\u1753\u1772\u1773\u17B4-\u17D3\u17DD\u180B-\u180D\u1885\u1886\u18A9\u1920-\u192B\u1930-\u193B\u1A17-\u1A1B\u1A55-\u1A5E\u1A60-\u1A7C\u1A7F\u1AB0-\u1ABE\u1B00-\u1B04\u1B34-\u1B44\u1B6B-\u1B73\u1B80-\u1B82\u1BA1-\u1BAD\u1BE6-\u1BF3\u1C24-\u1C37\u1CD0-\u1CD2\u1CD4-\u1CE8\u1CED\u1CF2-\u1CF4\u1CF7-\u1CF9\u1DC0-\u1DF9\u1DFB-\u1DFF\u20D0-\u20F0\u2CEF-\u2CF1\u2D7F\u2DE0-\u2DFF\u302A-\u302F\u3099\u309A\uA66F-\uA672\uA674-\uA67D\uA69E\uA69F\uA6F0\uA6F1\uA802\uA806\uA80B\uA823-\uA827\uA880\uA881\uA8B4-\uA8C5\uA8E0-\uA8F1\uA8FF\uA926-\uA92D\uA947-\uA953\uA980-\uA983\uA9B3-\uA9C0\uA9E5\uAA29-\uAA36\uAA43\uAA4C\uAA4D\uAA7B-\uAA7D\uAAB0\uAAB2-\uAAB4\uAAB7\uAAB8\uAABE\uAABF\uAAC1\uAAEB-\uAAEF\uAAF5\uAAF6\uABE3-\uABEA\uABEC\uABED\uFB1E\uFE00-\uFE0F\uFE20-\uFE2F]/g,``)):(e=>e),VR=class{constructor(e,{location:t=LR.location,threshold:n=LR.threshold,distance:r=LR.distance,includeMatches:i=LR.includeMatches,findAllMatches:a=LR.findAllMatches,minMatchCharLength:o=LR.minMatchCharLength,isCaseSensitive:s=LR.isCaseSensitive,ignoreDiacritics:c=LR.ignoreDiacritics,ignoreLocation:l=LR.ignoreLocation}={}){if(this.options={location:t,threshold:n,distance:r,includeMatches:i,findAllMatches:a,minMatchCharLength:o,isCaseSensitive:s,ignoreDiacritics:c,ignoreLocation:l},e=s?e:e.toLowerCase(),e=c?BR(e):e,this.pattern=e,this.chunks=[],!this.pattern.length)return;let u=(e,t)=>{this.chunks.push({pattern:e,alphabet:aSt(e),startIndex:t})},d=this.pattern.length;if(d>zR){let e=0,t=d%zR,n=d-t;for(;e<n;)u(this.pattern.substr(e,zR),e),e+=zR;if(t){let e=d-zR;u(this.pattern.substr(e),e)}}else u(this.pattern,0)}searchIn(e){let{isCaseSensitive:t,ignoreDiacritics:n,includeMatches:r}=this.options;if(e=t?e:e.toLowerCase(),e=n?BR(e):e,this.pattern===e){let t={isMatch:!0,score:0};return r&&(t.indices=[[0,e.length-1]]),t}let{location:i,distance:a,threshold:o,findAllMatches:s,minMatchCharLength:c,ignoreLocation:l}=this.options,u=[],d=0,f=!1;this.chunks.forEach(({pattern:t,alphabet:n,startIndex:p})=>{let{isMatch:m,score:h,indices:g}=iSt(e,t,n,{location:i+p,distance:a,threshold:o,findAllMatches:s,minMatchCharLength:c,includeMatches:r,ignoreLocation:l});m&&(f=!0),d+=h,m&&g&&(u=[...u,...g])});let p={isMatch:f,score:f?d/this.chunks.length:1};return f&&r&&(p.indices=u),p}},HR=class{constructor(e){this.pattern=e}static isMultiMatch(e){return oSt(e,this.multiRegex)}static isSingleMatch(e){return oSt(e,this.singleRegex)}search(){}},ESt=class extends HR{constructor(e){super(e)}static get type(){return`exact`}static get multiRegex(){return/^="(.*)"$/}static get singleRegex(){return/^=(.*)$/}search(e){let t=e===this.pattern;return{isMatch:t,score:t?0:1,indices:[0,this.pattern.length-1]}}},DSt=class extends HR{constructor(e){super(e)}static get type(){return`inverse-exact`}static get multiRegex(){return/^!"(.*)"$/}static get singleRegex(){return/^!(.*)$/}search(e){let t=e.indexOf(this.pattern)===-1;return{isMatch:t,score:t?0:1,indices:[0,e.length-1]}}},OSt=class extends HR{constructor(e){super(e)}static get type(){return`prefix-exact`}static get multiRegex(){return/^\^"(.*)"$/}static get singleRegex(){return/^\^(.*)$/}search(e){let t=e.startsWith(this.pattern);return{isMatch:t,score:t?0:1,indices:[0,this.pattern.length-1]}}},kSt=class extends HR{constructor(e){super(e)}static get type(){return`inverse-prefix-exact`}static get multiRegex(){return/^!\^"(.*)"$/}static get singleRegex(){return/^!\^(.*)$/}search(e){let t=!e.startsWith(this.pattern);return{isMatch:t,score:t?0:1,indices:[0,e.length-1]}}},ASt=class extends HR{constructor(e){super(e)}static get type(){return`suffix-exact`}static get multiRegex(){return/^"(.*)"\$$/}static get singleRegex(){return/^(.*)\$$/}search(e){let t=e.endsWith(this.pattern);return{isMatch:t,score:t?0:1,indices:[e.length-this.pattern.length,e.length-1]}}},jSt=class extends HR{constructor(e){super(e)}static get type(){return`inverse-suffix-exact`}static get multiRegex(){return/^!"(.*)"\$$/}static get singleRegex(){return/^!(.*)\$$/}search(e){let t=!e.endsWith(this.pattern);return{isMatch:t,score:t?0:1,indices:[0,e.length-1]}}},UR=class extends HR{constructor(e,{location:t=LR.location,threshold:n=LR.threshold,distance:r=LR.distance,includeMatches:i=LR.includeMatches,findAllMatches:a=LR.findAllMatches,minMatchCharLength:o=LR.minMatchCharLength,isCaseSensitive:s=LR.isCaseSensitive,ignoreDiacritics:c=LR.ignoreDiacritics,ignoreLocation:l=LR.ignoreLocation}={}){super(e),this._bitapSearch=new VR(e,{location:t,threshold:n,distance:r,includeMatches:i,findAllMatches:a,minMatchCharLength:o,isCaseSensitive:s,ignoreDiacritics:c,ignoreLocation:l})}static get type(){return`fuzzy`}static get multiRegex(){return/^"(.*)"$/}static get singleRegex(){return/^(.*)$/}search(e){return this._bitapSearch.searchIn(e)}},WR=class extends HR{constructor(e){super(e)}static get type(){return`include`}static get multiRegex(){return/^'"(.*)"$/}static get singleRegex(){return/^'(.*)$/}search(e){let t=0,n,r=[],i=this.pattern.length;for(;(n=e.indexOf(this.pattern,t))>-1;)t=n+i,r.push([n,t-1]);let a=!!r.length;return{isMatch:a,score:a?0:1,indices:r}}},GR=[ESt,WR,OSt,kSt,jSt,ASt,DSt,UR],KR=GR.length,MSt=/ +(?=(?:[^\"]*\"[^\"]*\")*[^\"]*$)/,NSt=`|`,PSt=new Set([UR.type,WR.type]),FSt=class{constructor(e,{isCaseSensitive:t=LR.isCaseSensitive,ignoreDiacritics:n=LR.ignoreDiacritics,includeMatches:r=LR.includeMatches,minMatchCharLength:i=LR.minMatchCharLength,ignoreLocation:a=LR.ignoreLocation,findAllMatches:o=LR.findAllMatches,location:s=LR.location,threshold:c=LR.threshold,distance:l=LR.distance}={}){this.query=null,this.options={isCaseSensitive:t,ignoreDiacritics:n,includeMatches:r,minMatchCharLength:i,findAllMatches:o,ignoreLocation:a,location:s,threshold:c,distance:l},e=t?e:e.toLowerCase(),e=n?BR(e):e,this.pattern=e,this.query=sSt(this.pattern,this.options)}static condition(e,t){return t.useExtendedSearch}searchIn(e){let t=this.query;if(!t)return{isMatch:!1,score:1};let{includeMatches:n,isCaseSensitive:r,ignoreDiacritics:i}=this.options;e=r?e:e.toLowerCase(),e=i?BR(e):e;let a=0,o=[],s=0;for(let r=0,i=t.length;r<i;r+=1){let i=t[r];o.length=0,a=0;for(let t=0,r=i.length;t<r;t+=1){let r=i[t],{isMatch:c,indices:l,score:u}=r.search(e);if(c){if(a+=1,s+=u,n){let e=r.constructor.type;PSt.has(e)?o=[...o,...l]:o.push(l)}}else{s=0,a=0,o.length=0;break}}if(a){let e={isMatch:!0,score:s/a};return n&&(e.indices=o),e}}return{isMatch:!1,score:1}}},qR=[],JR={AND:`$and`,OR:`$or`},YR={PATH:`$path`,PATTERN:`$val`},XR=e=>!!(e[JR.AND]||e[JR.OR]),ISt=e=>!!e[YR.PATH],LSt=e=>!kR(e)&&Jxt(e)&&!XR(e),ZR=e=>({[JR.AND]:Object.keys(e).map(t=>({[t]:e[t]}))}),QR=class{constructor(e,t={},n){this.options={...LR,...t},this.options.useExtendedSearch,this._keyStore=new bSt(this.options.keys),this.setCollection(e,n)}setCollection(e,t){if(this._docs=e,t&&!(t instanceof RR))throw Error(hSt);this._myIndex=t||tSt(this.options.keys,this._docs,{getFn:this.options.getFn,fieldNormWeight:this.options.fieldNormWeight})}add(e){jR(e)&&(this._docs.push(e),this._myIndex.add(e))}remove(e=()=>!1){let t=[];for(let n=0,r=this._docs.length;n<r;n+=1){let i=this._docs[n];e(i,n)&&(this.removeAt(n),--n,--r,t.push(i))}return t}removeAt(e){this._docs.splice(e,1),this._myIndex.removeAt(e)}getIndex(){return this._myIndex}search(e,{limit:t=-1}={}){let{includeMatches:n,includeScore:r,shouldSort:i,sortFn:a,ignoreFieldNorm:o}=this.options,s=AR(e)?AR(this._docs[0])?this._searchStringList(e):this._searchObjectList(e):this._searchLogical(e);return uSt(s,{ignoreFieldNorm:o}),i&&s.sort(a),Kxt(t)&&t>-1&&(s=s.slice(0,t)),pSt(s,this._docs,{includeMatches:n,includeScore:r})}_searchStringList(e){let t=FR(e,this.options),{records:n}=this._myIndex,r=[];return n.forEach(({v:e,i:n,n:i})=>{if(!jR(e))return;let{isMatch:a,score:o,indices:s}=t.searchIn(e);a&&r.push({item:e,idx:n,matches:[{score:o,value:e,norm:i,indices:s}]})}),r}_searchLogical(e){let t=lSt(e,this.options),n=(e,t,r)=>{if(!e.children){let{keyId:n,searcher:i}=e,a=this._findMatches({key:this._keyStore.get(n),value:this._myIndex.getValueForItemAtKeyId(t,n),searcher:i});return a&&a.length?[{idx:r,item:t,matches:a}]:[]}let i=[];for(let a=0,o=e.children.length;a<o;a+=1){let o=e.children[a],s=n(o,t,r);if(s.length)i.push(...s);else if(e.operator===JR.AND)return[]}return i},r=this._myIndex.records,i={},a=[];return r.forEach(({$:e,i:r})=>{if(jR(e)){let o=n(t,e,r);o.length&&(i[r]||(i[r]={idx:r,item:e,matches:[]},a.push(i[r])),o.forEach(({matches:e})=>{i[r].matches.push(...e)}))}}),a}_searchObjectList(e){let t=FR(e,this.options),{keys:n,records:r}=this._myIndex,i=[];return r.forEach(({$:e,i:r})=>{if(!jR(e))return;let a=[];n.forEach((n,r)=>{a.push(...this._findMatches({key:n,value:e[r],searcher:t}))}),a.length&&i.push({idx:r,item:e,matches:a})}),i}_findMatches({key:e,value:t,searcher:n}){if(!jR(t))return[];let r=[];if(kR(t))t.forEach(({v:t,i,n:a})=>{if(!jR(t))return;let{isMatch:o,score:s,indices:c}=n.searchIn(t);o&&r.push({score:s,key:e,value:t,idx:i,norm:a,indices:c})});else{let{v:i,n:a}=t,{isMatch:o,score:s,indices:c}=n.searchIn(i);o&&r.push({score:s,key:e,value:i,norm:a,indices:c})}return r}},QR.version=`7.1.0`,QR.createIndex=tSt,QR.parseIndex=nSt,QR.config=LR,QR.parseQuery=lSt,cSt(FSt)})),RSt,zSt,BSt,VSt,HSt,ez,USt,WSt=s((()=>{W(),kE(),Ou(),QI(),Zf(),$R(),RSt={key:0,class:`gap-1/2 flex flex-col`},zSt=[`onClick`],BSt={class:`flex items-center gap-2 whitespace-nowrap`},VSt={key:1,class:`text-c-3 bg-b-3 flex h-4.5 min-w-4.5 items-center justify-center rounded px-0.5 font-sans text-[9px] font-semibold`},HSt={class:`max-w-[9rem] overflow-hidden text-right text-ellipsis whitespace-nowrap`},ez=12,USt=N({__name:`EnvironmentVariablesDropdown`,props:{query:{},environment:{},dropdownPosition:{},contextFunctionItems:{default:()=>[]}},emits:[`select`,`redirect`],setup(e,{expose:t,emit:n}){let r=n,i=A(!0),a=A(null),o=A(0),s=()=>{r(`redirect`),i.value=!1},c=U(()=>(e.environment?.variables??[]).map(e=>({key:e.name,value:typeof e.value==`string`?e.value:e.value.default}))),l=U(()=>e.contextFunctionItems.map(e=>({kind:`context`,key:e.key,secondary:e.description}))),u=U(()=>c.value.filter(({key:e,value:t})=>e!==``||t!==``).map(({key:e,value:t})=>({kind:`env`,key:e,secondary:t}))),d=U(()=>u.value.map(e=>({...e,fuseText:`${e.key} ${e.secondary}`}))),f=U(()=>l.value.map(e=>({...e,fuseText:`${e.key} ${e.secondary}`}))),p=U(()=>new QR(d.value,{keys:[`fuseText`],threshold:.35})),m=U(()=>new QR(f.value,{keys:[`fuseText`],threshold:.35})),h=U(()=>{let t=new Map(e.contextFunctionItems.map(e=>[e.key,e]));return _ht.flatMap(e=>{let n=t.get(e);return n?[{kind:`context`,key:n.key,secondary:n.description}]:[]})}),g=U(()=>{if(!e.query.trim())return[...u.value.slice(-4),...h.value];let t=e.query.trim(),n=p.value.search(t,{limit:ez}).map(e=>{let{kind:t,key:n,secondary:r}=e.item;return{kind:t,key:n,secondary:r}}),r=ez-n.length,i=r>0?m.value.search(t,{limit:r}).map(e=>{let{kind:t,key:n,secondary:r}=e.item;return{kind:t,key:n,secondary:r}}):[];return[...n,...i]}),_=e=>{r(`select`,e)};t({handleArrowKey:e=>{let t=e===`up`?-1:1,n=g.value.length;n!==0&&(o.value=(o.value+t+n)%n)},handleSelect:()=>{if(o.value>=0){let e=g.value[o.value];e&&_(e.key)}}}),Hi(()=>{o.value=0});let v=U(()=>({left:(e.dropdownPosition?.left??0)+`px`,top:(e.dropdownPosition?.top??0)+5+`px`}));return Xve(a,()=>{i.value=!1},{ignore:[a]}),(t,n)=>i.value?(F(),L(j(pb),{key:0,class:`scalar-client`},{default:M(()=>[R(`div`,{ref_key:`dropdownRef`,ref:a,class:`custom-scroll z-context fixed top-0 left-0 flex max-h-[60svh] w-56 flex-col rounded border p-0.75`,style:it(v.value)},[g.value.length?(F(),I(`ul`,RSt,[(F(!0),I(V,null,Ar(g.value,(t,n)=>(F(),I(`li`,{key:`${t.kind}-${t.key}`,class:O([`font-code text-xxs hover:bg-b-2 flex h-8 cursor-pointer items-center justify-between gap-1.5 rounded p-1.5 transition-colors duration-150`,{"bg-b-2":n===o.value}]),onClick:e=>_(t.key)},[R(`div`,BSt,[t.kind===`env`?(F(),I(`span`,{key:0,class:`h-2.25 w-2.25 min-w-2.25 rounded-full`,style:it({backgroundColor:e.environment?.color})},null,4)):(F(),I(`span`,VSt,` fn `)),z(` `+k(t.key),1)]),R(`span`,HSt,k(t.secondary),1)],10,zSt))),128))])):(F(),L(j(gf),{key:1,class:`font-code text-xxs bg-b-inherit hover:bg-b-2 flex h-8 w-full justify-start gap-2 px-1.5 transition-colors duration-150`,variant:`outlined`,onClick:s},{default:M(()=>[H(j(xu),{class:`size-3`}),n[0]||=z(` Add Variable `,-1)]),_:1})),n[1]||=R(`div`,{class:`bg-b-1 brightness-lifted absolute inset-0 -z-1 rounded shadow-lg`},null,-1)],4)]),_:1})):B(``,!0)}})})),GSt,KSt=s((()=>{WSt(),GSt=USt})),qSt,JSt,YSt=s((()=>{W(),kE(),qSt={class:`flex items-center gap-1 whitespace-nowrap`},JSt=N({name:`PillTooltipHost`,__name:`PillTooltipHost`,props:{context:{}},setup(e){let t=e,n=A(null),r=t.context.type===`contextFunction`,i=U(()=>{if(!r||typeof document>`u`)return``;let e=document.createElement(`div`);return fie(ci(`div`,{class:`flex flex-col gap-1.5 text-left`},[ci(`span`,{},t.context.details),ci(`div`,{class:`text-[color:var(--scalar-color-3)] text-[10px] font-normal`},`Computed at request execution`)]),e),e.innerHTML}),a=U(()=>t.context.type===`environment`?t.context.value:``);return RT({content:r?i:a,contentTarget:r?`innerHTML`:`textContent`,delay:0,placement:`bottom-start`,offset:6,targetRef:U(()=>n.value?.children?.[0]||n.value||void 0)}),(e,r)=>(F(),I(`div`,{ref_key:`wrapperRef`,ref:n,class:`contents`},[R(`div`,qSt,[R(`span`,null,k(t.context.type===`environment`?t.context.name:t.context.identifier),1)])],512))}})})),XSt,ZSt=s((()=>{YSt(),XSt=JSt}));function QSt(e){if(e<768)return!1;for(let t=0,n=nz.length;;){let r=t+n>>1;if(e<nz[r])n=r;else if(e>=rz[r])t=r+1;else return!0;if(t==n)return!1}}function $St(e){return e>=127462&&e<=127487}function eCt(e,t,n=!0,r=!0){return(n?tCt:nCt)(e,t,r)}function tCt(e,t,n){if(t==e.length)return t;t&&rCt(e.charCodeAt(t))&&iCt(e.charCodeAt(t-1))&&t--;let r=tz(e,t);for(t+=aCt(r);t<e.length;){let i=tz(e,t);if(r==iz||i==iz||n&&QSt(i))t+=aCt(i),r=i;else if($St(i)){let n=0,r=t-2;for(;r>=0&&$St(tz(e,r));)n++,r-=2;if(n%2==0)break;t+=2}else break}return t}function nCt(e,t,n){for(;t>0;){let r=tCt(e,t-2,n);if(r<t)return r;t--}return 0}function tz(e,t){let n=e.charCodeAt(t);if(!iCt(n)||t+1==e.length)return n;let r=e.charCodeAt(t+1);return rCt(r)?(n-55296<<10)+(r-56320)+65536:n}function rCt(e){return e>=56320&&e<57344}function iCt(e){return e>=55296&&e<56320}function aCt(e){return e<65536?1:2}var nz,rz,iz,oCt=s((()=>{nz=[],rz=[],(()=>{let e=`lc,34,7n,7,7b,19,,,,2,,2,,,20,b,1c,l,g,,2t,7,2,6,2,2,,4,z,,u,r,2j,b,1m,9,9,,o,4,,9,,3,,5,17,3,3b,f,,w,1j,,,,4,8,4,,3,7,a,2,t,,1m,,,,2,4,8,,9,,a,2,q,,2,2,1l,,4,2,4,2,2,3,3,,u,2,3,,b,2,1l,,4,5,,2,4,,k,2,m,6,,,1m,,,2,,4,8,,7,3,a,2,u,,1n,,,,c,,9,,14,,3,,1l,3,5,3,,4,7,2,b,2,t,,1m,,2,,2,,3,,5,2,7,2,b,2,s,2,1l,2,,,2,4,8,,9,,a,2,t,,20,,4,,2,3,,,8,,29,,2,7,c,8,2q,,2,9,b,6,22,2,r,,,,,,1j,e,,5,,2,5,b,,10,9,,2u,4,,6,,2,2,2,p,2,4,3,g,4,d,,2,2,6,,f,,jj,3,qa,3,t,3,t,2,u,2,1s,2,,7,8,,2,b,9,,19,3,3b,2,y,,3a,3,4,2,9,,6,3,63,2,2,,1m,,,7,,,,,2,8,6,a,2,,1c,h,1r,4,1c,7,,,5,,14,9,c,2,w,4,2,2,,3,1k,,,2,3,,,3,1m,8,2,2,48,3,,d,,7,4,,6,,3,2,5i,1m,,5,ek,,5f,x,2da,3,3x,,2o,w,fe,6,2x,2,n9w,4,,a,w,2,28,2,7k,,3,,4,,p,2,5,,47,2,q,i,d,,12,8,p,b,1a,3,1c,,2,4,2,2,13,,1v,6,2,2,2,2,c,,8,,1b,,1f,,,3,2,2,5,2,,,16,2,8,,6m,,2,,4,,fn4,,kh,g,g,g,a6,2,gt,,6a,,45,5,1ae,3,,2,5,4,14,3,4,,4l,2,fx,4,ar,2,49,b,4w,,1i,f,1k,3,1d,4,2,2,1x,3,10,5,,8,1q,,c,2,1g,9,a,4,2,,2n,3,2,,,2,6,,4g,,3,8,l,2,1l,2,,,,,m,,e,7,3,5,5f,8,2,3,,,n,,29,,2,6,,,2,,,2,,2,6j,,2,4,6,2,,2,r,2,2d,8,2,,,2,2y,,,,2,6,,,2t,3,2,4,,5,77,9,,2,6t,,a,2,,,4,,40,4,2,2,4,,w,a,14,6,2,4,8,,9,6,2,3,1a,d,,2,ba,7,,6,,,2a,m,2,7,,2,,2,3e,6,3,,,2,,7,,,20,2,3,,,,9n,2,f0b,5,1n,7,t4,,1r,4,29,,f5k,2,43q,,,3,4,5,8,8,2,7,u,4,44,3,1iz,1j,4,1e,8,,e,,m,5,,f,11s,7,,h,2,7,,2,,5,79,7,c5,4,15s,7,31,7,240,5,gx7k,2o,3k,6o`.split(`,`).map(e=>e?parseInt(e,36):1);for(let t=0,n=0;t<e.length;t++)(t%2?rz:nz).push(n+=e[t])})(),iz=8205}));function sCt(e){let t=-1;for(let n of e)t+=n.length+1;return t}function az(e,t,n=0,r=1e9){for(let i=0,a=0,o=!0;a<e.length&&i<=r;a++){let s=e[a],c=i+s.length;c>=n&&(c>r&&(s=s.slice(0,r-i)),i<n&&(s=s.slice(n-i)),o?(t[t.length-1]+=s,o=!1):t.push(s)),i=c+1}return t}function cCt(e,t,n){return az(e,[``],t,n)}function oz(e,t,n){return t=Math.max(0,Math.min(e.length,t)),[t,Math.max(t,Math.min(e.length,n))]}function sz(e,t,n=!0,r=!0){return eCt(e,t,n,r)}function lCt(e){return e>=56320&&e<57344}function uCt(e){return e>=55296&&e<56320}function cz(e,t){let n=e.charCodeAt(t);if(!uCt(n)||t+1==e.length)return n;let r=e.charCodeAt(t+1);return lCt(r)?(n-55296<<10)+(r-56320)+65536:n}function dCt(e){return e<=65535?String.fromCharCode(e):(e-=65536,String.fromCharCode((e>>10)+55296,(e&1023)+56320))}function lz(e){return e<65536?1:2}function uz(e,t,n,r=!1){if(t==0&&n<=0)return;let i=e.length-2;i>=0&&n<=0&&n==e[i+1]?e[i]+=t:i>=0&&t==0&&e[i]==0?e[i+1]+=n:r?(e[i]+=t,e[i+1]+=n):e.push(t,n)}function dz(e,t,n){if(n.length==0)return;let r=t.length-2>>1;if(r<e.length)e[e.length-1]=e[e.length-1].append(n);else{for(;e.length<r;)e.push(Oz.empty);e.push(n)}}function fz(e,t,n){let r=e.inserted;for(let i=0,a=0,o=0;o<e.sections.length;){let s=e.sections[o++],c=e.sections[o++];if(c<0)i+=s,a+=s;else{let l=i,u=a,d=Oz.empty;for(;l+=s,u+=c,c&&r&&(d=d.append(r[o-2>>1])),!(n||o==e.sections.length||e.sections[o+1]<0);)s=e.sections[o++],c=e.sections[o++];t(i,l,a,u,d),i=l,a=u}}}function pz(e,t,n,r=!1){let i=[],a=r?[]:null,o=new Rz(e),s=new Rz(t);for(let e=-1;;)if(o.done&&s.len||s.done&&o.len)throw Error(`Mismatched change set lengths`);else if(o.ins==-1&&s.ins==-1){let e=Math.min(o.len,s.len);uz(i,e,-1),o.forward(e),s.forward(e)}else if(s.ins>=0&&(o.ins<0||e==o.i||o.off==0&&(s.len<o.len||s.len==o.len&&!n))){let t=s.len;for(uz(i,s.ins,-1);t;){let n=Math.min(o.len,t);o.ins>=0&&e<o.i&&o.len<=n&&(uz(i,0,o.ins),a&&dz(a,i,o.text),e=o.i),o.forward(n),t-=n}s.next()}else if(o.ins>=0){let t=0,n=o.len;for(;n;)if(s.ins==-1){let e=Math.min(n,s.len);t+=e,n-=e,s.forward(e)}else if(s.ins==0&&s.len<n)n-=s.len,s.next();else break;uz(i,t,e<o.i?o.ins:0),a&&e<o.i&&dz(a,i,o.text),e=o.i,o.forward(o.len-n)}else if(o.done&&s.done)return a?Lz.createSet(i,a):Iz.create(i);else throw Error(`Mismatched change set lengths`)}function fCt(e,t,n=!1){let r=[],i=n?[]:null,a=new Rz(e),o=new Rz(t);for(let e=!1;;)if(a.done&&o.done)return i?Lz.createSet(r,i):Iz.create(r);else if(a.ins==0)uz(r,a.len,0,e),a.next();else if(o.len==0&&!o.done)uz(r,0,o.ins,e),i&&dz(i,r,o.text),o.next();else if(a.done||o.done)throw Error(`Mismatched change set lengths`);else{let t=Math.min(a.len2,o.len),n=r.length;if(a.ins==-1){let n=o.ins==-1?-1:o.off?0:o.ins;uz(r,t,n,e),i&&n&&dz(i,r,o.text)}else o.ins==-1?(uz(r,a.off?0:a.len,t,e),i&&dz(i,r,a.textBit(t))):(uz(r,a.off?0:a.len,o.off?0:o.ins,e),i&&!o.off&&dz(i,r,o.text));e=(a.ins>t||o.ins>=0&&o.len>t)&&(e||r.length>n),a.forward2(t),o.forward(t)}}function pCt(e,t){for(let n of e.ranges)if(n.to>t)throw RangeError(`Selection points outside of document`)}function mz(e,t){return e==t||e.length==t.length&&e.every((e,n)=>e===t[n])}function mCt(e,t,n){if(e.length!=t.length)return!1;for(let r=0;r<e.length;r++)if(!n(e[r],t[r]))return!1;return!0}function hz(e,t){let n=!1;for(let r of t)_z(e,r)&1&&(n=!0);return n}function hCt(e,t,n){let r=n.map(t=>e[t.id]),i=n.map(e=>e.type),a=r.filter(e=>!(e&1)),o=e[t.id]>>1;function s(e){let n=[];for(let t=0;t<r.length;t++){let a=vz(e,r[t]);if(i[t]==2)for(let e of a)n.push(e);else n.push(a)}return t.combine(n)}return{create(e){for(let t of r)_z(e,t);return e.values[o]=s(e),1},update(e,n){if(!hz(e,a))return 0;let r=s(e);return t.compare(r,e.values[o])?0:(e.values[o]=r,1)},reconfigure(e,i){let a=hz(e,r),c=i.config.facets[t.id],l=i.facet(t);if(c&&!a&&mz(n,c))return e.values[o]=l,0;let u=s(e);return t.compare(u,l)?(e.values[o]=l,0):(e.values[o]=u,1)}}}function gz(e){return t=>new Jz(t,e)}function gCt(e,t,n){let r=[[],[],[],[],[]],i=new Map;function a(e,o){let s=i.get(e);if(s!=null){if(s<=o)return;let t=r[s].indexOf(e);t>-1&&r[s].splice(t,1),e instanceof Xz&&n.delete(e.compartment)}if(i.set(e,o),Array.isArray(e))for(let t of e)a(t,o);else if(e instanceof Xz){if(n.has(e.compartment))throw RangeError(`Duplicate use of compartment in extensions`);let r=t.get(e.compartment)||e.inner;n.set(e.compartment,r),a(r,o)}else if(e instanceof Jz)a(e.inner,e.prec);else if(e instanceof Gz)r[o].push(e),e.provides&&a(e.provides,o);else if(e instanceof Uz)r[o].push(e),e.facet.extensions&&a(e.facet.extensions,Kz.default);else{let t=e.extension;if(!t)throw Error(`Unrecognized extension value in extension set (${e}). This sometimes happens because multiple instances of @codemirror/state are loaded, breaking instanceof checks.`);a(t,o)}}return a(e,Kz.default),r.reduce((e,t)=>e.concat(t))}function _z(e,t){if(t&1)return 2;let n=t>>1,r=e.status[n];if(r==4)throw Error(`Cyclic dependency between fields and/or facets`);if(r&2)return r;e.status[n]=4;let i=e.computeSlot(e,e.config.dynamicSlots[n]);return e.status[n]=2|i}function vz(e,t){return t&1?e.config.staticValues[t>>1]:e.values[t>>1]}function _Ct(e,t){let n=[];for(let r=0,i=0;;){let a,o;if(r<e.length&&(i==t.length||t[i]>=e[r]))a=e[r++],o=e[r++];else if(i<t.length)a=t[i++],o=t[i++];else return n;!n.length||n[n.length-1]<a?n.push(a,o):n[n.length-1]<o&&(n[n.length-1]=o)}}function vCt(e,t,n){let r,i,a;return n?(r=t.changes,i=Lz.empty(t.changes.length),a=e.changes.compose(t.changes)):(r=t.changes.map(e.changes),i=e.changes.mapDesc(t.changes,!0),a=e.changes.compose(r)),{changes:a,selection:t.selection?t.selection.map(i):e.selection?.map(r),effects:oB.mapEffects(e.effects,r).concat(oB.mapEffects(t.effects,i)),annotations:e.annotations.length?e.annotations.concat(t.annotations):t.annotations,scrollIntoView:e.scrollIntoView||t.scrollIntoView}}function yz(e,t,n){let r=t.selection,i=bz(t.annotations);return t.userEvent&&(i=i.concat(sB.userEvent.of(t.userEvent))),{changes:t.changes instanceof Lz?t.changes:Lz.of(t.changes||[],n,e.facet(eB)),selection:r&&(r instanceof Bz?r:Bz.single(r.anchor,r.head)),effects:bz(t.effects),annotations:i,scrollIntoView:!!t.scrollIntoView}}function yCt(e,t,n){let r=yz(e,t.length?t[0]:{},e.doc.length);t.length&&t[0].filter===!1&&(n=!1);for(let i=1;i<t.length;i++){t[i].filter===!1&&(n=!1);let a=!!t[i].sequential;r=vCt(r,yz(e,t[i],a?r.changes.newLength:e.doc.length),a)}let i=sB.create(e,r.changes,r.selection,r.effects,r.annotations,r.scrollIntoView);return xCt(n?bCt(i):i)}function bCt(e){let t=e.startState,n=!0;for(let r of t.facet(tB)){let t=r(e);if(t===!1){n=!1;break}Array.isArray(t)&&(n=n===!0?t:_Ct(n,t))}if(n!==!0){let r,i;if(n===!1)i=e.changes.invertedDesc,r=Lz.empty(t.doc.length);else{let t=e.changes.filter(n);r=t.changes,i=t.filtered.mapDesc(t.changes).invertedDesc}e=sB.create(t,r,e.selection&&e.selection.map(i),oB.mapEffects(e.effects,i),e.annotations,e.scrollIntoView)}let r=t.facet(nB);for(let n=r.length-1;n>=0;n--){let i=r[n](e);e=i instanceof sB?i:Array.isArray(i)&&i.length==1&&i[0]instanceof sB?i[0]:yCt(t,bz(i),!1)}return e}function xCt(e){let t=e.startState,n=t.facet(rB),r=e;for(let i=n.length-1;i>=0;i--){let a=n[i](e);a&&Object.keys(a).length&&(r=vCt(r,yz(t,a,e.changes.newLength),!0))}return r==e?e:sB.create(t,e.changes,e.selection,r.effects,r.annotations,r.scrollIntoView)}function bz(e){return e==null?MCt:Array.isArray(e)?e:[e]}function SCt(e){if(lB)return lB.test(e);for(let t=0;t<e.length;t++){let n=e[t];if(/\w/.test(n)||n>`€`&&(n.toUpperCase()!=n.toLowerCase()||NCt.test(n)))return!0}return!1}function CCt(e){return t=>{if(!/\S/.test(t))return cB.Space;if(SCt(t))return cB.Word;for(let n=0;n<e.length;n++)if(t.indexOf(e[n])>-1)return cB.Word;return cB.Other}}function xz(e,t,n={}){let r={};for(let t of e)for(let e of Object.keys(t)){let i=t[e],a=r[e];if(a===void 0)r[e]=i;else if(!(a===i||i===void 0))if(Object.hasOwnProperty.call(n,e))r[e]=n[e](a,i);else throw Error(`Config merge conflict for field `+e)}for(let e in t)r[e]===void 0&&(r[e]=t[e]);return r}function Sz(e,t){return e.from-t.from||e.value.startSide-t.value.startSide}function wCt(e){if(e.length>1)for(let t=e[0],n=1;n<e.length;n++){let r=e[n];if(Sz(t,r)>0)return e.slice().sort(Sz);t=r}return e}function TCt(e,t,n){let r=new Map;for(let t of e)for(let e=0;e<t.chunk.length;e++)t.chunk[e].maxPoint<=0&&r.set(t.chunk[e],t.chunkPos[e]);let i=new Set;for(let e of t)for(let t=0;t<e.chunk.length;t++){let a=r.get(e.chunk[t]);a!=null&&(n?n.mapPos(a):a)==e.chunkPos[t]&&!n?.touchesRange(a,a+e.chunk[t].length)&&i.add(e.chunk[t])}return i}function Cz(e,t){for(let n=e[t];;){let r=(t<<1)+1;if(r>=e.length)break;let i=e[r];if(r+1<e.length&&i.compare(e[r+1])>=0&&(i=e[r+1],r++),n.compare(i)<0)break;e[r]=n,e[t]=i,t=r}}function ECt(e,t,n,r,i,a){e.goto(t),n.goto(r);let o=r+i,s=r,c=r-t;for(;;){let t=e.to+c-n.to,r=t||e.endSide-n.endSide,i=r<0?e.to+c:n.to,l=Math.min(i,o);if(e.point||n.point?e.point&&n.point&&(e.point==n.point||e.point.eq(n.point))&&wz(e.activeForPoint(e.to),n.activeForPoint(n.to))||a.comparePoint(s,l,e.point,n.point):l>s&&!wz(e.active,n.active)&&a.compareRange(s,l,e.active,n.active),i>o)break;(t||e.openEnd!=n.openEnd)&&a.boundChange&&a.boundChange(i),s=i,r<=0&&e.next(),r>=0&&n.next()}}function wz(e,t){if(e.length!=t.length)return!1;for(let n=0;n<e.length;n++)if(e[n]!=t[n]&&!e[n].eq(t[n]))return!1;return!0}function Tz(e,t){for(let n=t,r=e.length-1;n<r;n++)e[n]=e[n+1];e.pop()}function Ez(e,t,n){for(let n=e.length-1;n>=t;n--)e[n+1]=e[n];e[t]=n}function DCt(e,t){let n=-1,r=1e9;for(let i=0;i<t.length;i++)(t[i]-r||e[i].endSide-e[n].endSide)<0&&(n=i,r=t[i]);return n}function Dz(e,t,n=e.length){let r=0;for(let i=0;i<n;)e.charCodeAt(i)==9?(r+=t-r%t,i++):(r++,i=sz(e,i));return r}function OCt(e,t,n,r){for(let r=0,i=0;;){if(i>=t)return r;if(r==e.length)break;i+=e.charCodeAt(r)==9?n-i%n:1,r=sz(e,r)}return r===!0?-1:e.length}var Oz,kz,Az,jz,Mz,Nz,kCt,Pz,Fz,Iz,Lz,Rz,zz,Bz,Vz,Hz,Uz,Wz,Gz,Kz,qz,Jz,Yz,Xz,Zz,Qz,$z,eB,tB,nB,rB,iB,aB,ACt,jCt,oB,sB,MCt,cB,NCt,lB,uB,dB,fB,PCt,pB,mB,hB,gB,_B,vB=s((()=>{oCt(),Oz=class e{lineAt(e){if(e<0||e>this.length)throw RangeError(`Invalid position ${e} in document of length ${this.length}`);return this.lineInner(e,!1,1,0)}line(e){if(e<1||e>this.lines)throw RangeError(`Invalid line number ${e} in ${this.lines}-line document`);return this.lineInner(e,!0,1,0)}replace(e,t,n){[e,t]=oz(this,e,t);let r=[];return this.decompose(0,e,r,2),n.length&&n.decompose(0,n.length,r,3),this.decompose(t,this.length,r,1),Az.from(r,this.length-(t-e)+n.length)}append(e){return this.replace(this.length,this.length,e)}slice(e,t=this.length){[e,t]=oz(this,e,t);let n=[];return this.decompose(e,t,n,0),Az.from(n,t-e)}eq(e){if(e==this)return!0;if(e.length!=this.length||e.lines!=this.lines)return!1;let t=this.scanIdentical(e,1),n=this.length-this.scanIdentical(e,-1),r=new jz(this),i=new jz(e);for(let e=t,a=t;;){if(r.next(e),i.next(e),e=0,r.lineBreak!=i.lineBreak||r.done!=i.done||r.value!=i.value)return!1;if(a+=r.value.length,r.done||a>=n)return!0}}iter(e=1){return new jz(this,e)}iterRange(e,t=this.length){return new Mz(this,e,t)}iterLines(e,t){let n;if(e==null)n=this.iter();else{t??=this.lines+1;let r=this.line(e).from;n=this.iterRange(r,Math.max(r,t==this.lines+1?this.length:t<=1?0:this.line(t-1).to))}return new Nz(n)}toString(){return this.sliceString(0)}toJSON(){let e=[];return this.flatten(e),e}constructor(){}static of(t){if(t.length==0)throw RangeError(`A document must have at least one line`);return t.length==1&&!t[0]?e.empty:t.length<=32?new kz(t):Az.from(kz.split(t,[]))}},kz=class e extends Oz{constructor(e,t=sCt(e)){super(),this.text=e,this.length=t}get lines(){return this.text.length}get children(){return null}lineInner(e,t,n,r){for(let i=0;;i++){let a=this.text[i],o=r+a.length;if((t?n:o)>=e)return new kCt(r,o,n,a);r=o+1,n++}}decompose(t,n,r,i){let a=t<=0&&n>=this.length?this:new e(cCt(this.text,t,n),Math.min(n,this.length)-Math.max(0,t));if(i&1){let t=r.pop(),n=az(a.text,t.text.slice(),0,a.length);if(n.length<=32)r.push(new e(n,t.length+a.length));else{let t=n.length>>1;r.push(new e(n.slice(0,t)),new e(n.slice(t)))}}else r.push(a)}replace(t,n,r){if(!(r instanceof e))return super.replace(t,n,r);[t,n]=oz(this,t,n);let i=az(this.text,az(r.text,cCt(this.text,0,t)),n),a=this.length+r.length-(n-t);return i.length<=32?new e(i,a):Az.from(e.split(i,[]),a)}sliceString(e,t=this.length,n=`
-`){[e,t]=oz(this,e,t);let r=``;for(let i=0,a=0;i<=t&&a<this.text.length;a++){let o=this.text[a],s=i+o.length;i>e&&a&&(r+=n),e<s&&t>i&&(r+=o.slice(Math.max(0,e-i),t-i)),i=s+1}return r}flatten(e){for(let t of this.text)e.push(t)}scanIdentical(){return 0}static split(t,n){let r=[],i=-1;for(let a of t)r.push(a),i+=a.length+1,r.length==32&&(n.push(new e(r,i)),r=[],i=-1);return i>-1&&n.push(new e(r,i)),n}},Az=class e extends Oz{constructor(e,t){super(),this.children=e,this.length=t,this.lines=0;for(let t of e)this.lines+=t.lines}lineInner(e,t,n,r){for(let i=0;;i++){let a=this.children[i],o=r+a.length,s=n+a.lines-1;if((t?s:o)>=e)return a.lineInner(e,t,n,r);r=o+1,n=s+1}}decompose(e,t,n,r){for(let i=0,a=0;a<=t&&i<this.children.length;i++){let o=this.children[i],s=a+o.length;if(e<=s&&t>=a){let i=r&((a<=e?1:0)|(s>=t?2:0));a>=e&&s<=t&&!i?n.push(o):o.decompose(e-a,t-a,n,i)}a=s+1}}replace(t,n,r){if([t,n]=oz(this,t,n),r.lines<this.lines)for(let i=0,a=0;i<this.children.length;i++){let o=this.children[i],s=a+o.length;if(t>=a&&n<=s){let c=o.replace(t-a,n-a,r),l=this.lines-o.lines+c.lines;if(c.lines<l>>4&&c.lines>l>>6){let a=this.children.slice();return a[i]=c,new e(a,this.length-(n-t)+r.length)}return super.replace(a,s,c)}a=s+1}return super.replace(t,n,r)}sliceString(e,t=this.length,n=`
-`){[e,t]=oz(this,e,t);let r=``;for(let i=0,a=0;i<this.children.length&&a<=t;i++){let o=this.children[i],s=a+o.length;a>e&&i&&(r+=n),e<s&&t>a&&(r+=o.sliceString(e-a,t-a,n)),a=s+1}return r}flatten(e){for(let t of this.children)t.flatten(e)}scanIdentical(t,n){if(!(t instanceof e))return 0;let r=0,[i,a,o,s]=n>0?[0,0,this.children.length,t.children.length]:[this.children.length-1,t.children.length-1,-1,-1];for(;;i+=n,a+=n){if(i==o||a==s)return r;let e=this.children[i],c=t.children[a];if(e!=c)return r+e.scanIdentical(c,n);r+=e.length+1}}static from(t,n=t.reduce((e,t)=>e+t.length+1,-1)){let r=0;for(let e of t)r+=e.lines;if(r<32){let e=[];for(let n of t)n.flatten(e);return new kz(e,n)}let i=Math.max(32,r>>5),a=i<<1,o=i>>1,s=[],c=0,l=-1,u=[];function d(t){let n;if(t.lines>a&&t instanceof e)for(let e of t.children)d(e);else t.lines>o&&(c>o||!c)?(f(),s.push(t)):t instanceof kz&&c&&(n=u[u.length-1])instanceof kz&&t.lines+n.lines<=32?(c+=t.lines,l+=t.length+1,u[u.length-1]=new kz(n.text.concat(t.text),n.length+1+t.length)):(c+t.lines>i&&f(),c+=t.lines,l+=t.length+1,u.push(t))}function f(){c!=0&&(s.push(u.length==1?u[0]:e.from(u,l)),l=-1,c=u.length=0)}for(let e of t)d(e);return f(),s.length==1?s[0]:new e(s,n)}},Oz.empty=new kz([``],0),jz=class{constructor(e,t=1){this.dir=t,this.done=!1,this.lineBreak=!1,this.value=``,this.nodes=[e],this.offsets=[t>0?1:(e instanceof kz?e.text.length:e.children.length)<<1]}nextInner(e,t){for(this.done=this.lineBreak=!1;;){let n=this.nodes.length-1,r=this.nodes[n],i=this.offsets[n],a=i>>1,o=r instanceof kz?r.text.length:r.children.length;if(a==(t>0?o:0)){if(n==0)return this.done=!0,this.value=``,this;t>0&&this.offsets[n-1]++,this.nodes.pop(),this.offsets.pop()}else if((i&1)==(t>0?0:1)){if(this.offsets[n]+=t,e==0)return this.lineBreak=!0,this.value=`
-`,this;e--}else if(r instanceof kz){let i=r.text[a+(t<0?-1:0)];if(this.offsets[n]+=t,i.length>Math.max(0,e))return this.value=e==0?i:t>0?i.slice(e):i.slice(0,i.length-e),this;e-=i.length}else{let i=r.children[a+(t<0?-1:0)];e>i.length?(e-=i.length,this.offsets[n]+=t):(t<0&&this.offsets[n]--,this.nodes.push(i),this.offsets.push(t>0?1:(i instanceof kz?i.text.length:i.children.length)<<1))}}}next(e=0){return e<0&&(this.nextInner(-e,-this.dir),e=this.value.length),this.nextInner(e,this.dir)}},Mz=class{constructor(e,t,n){this.value=``,this.done=!1,this.cursor=new jz(e,t>n?-1:1),this.pos=t>n?e.length:0,this.from=Math.min(t,n),this.to=Math.max(t,n)}nextInner(e,t){if(t<0?this.pos<=this.from:this.pos>=this.to)return this.value=``,this.done=!0,this;e+=Math.max(0,t<0?this.pos-this.to:this.from-this.pos);let n=t<0?this.pos-this.from:this.to-this.pos;e>n&&(e=n),n-=e;let{value:r}=this.cursor.next(e);return this.pos+=(r.length+e)*t,this.value=r.length<=n?r:t<0?r.slice(r.length-n):r.slice(0,n),this.done=!this.value,this}next(e=0){return e<0?e=Math.max(e,this.from-this.pos):e>0&&(e=Math.min(e,this.to-this.pos)),this.nextInner(e,this.cursor.dir)}get lineBreak(){return this.cursor.lineBreak&&this.value!=``}},Nz=class{constructor(e){this.inner=e,this.afterBreak=!0,this.value=``,this.done=!1}next(e=0){let{done:t,lineBreak:n,value:r}=this.inner.next(e);return t&&this.afterBreak?(this.value=``,this.afterBreak=!1):t?(this.done=!0,this.value=``):n?this.afterBreak?this.value=``:(this.afterBreak=!0,this.next()):(this.value=r,this.afterBreak=!1),this}get lineBreak(){return!1}},typeof Symbol<`u`&&(Oz.prototype[Symbol.iterator]=function(){return this.iter()},jz.prototype[Symbol.iterator]=Mz.prototype[Symbol.iterator]=Nz.prototype[Symbol.iterator]=function(){return this}),kCt=class{constructor(e,t,n,r){this.from=e,this.to=t,this.number=n,this.text=r}get length(){return this.to-this.from}},Pz=/\r\n?|\n/,Fz=(function(e){return e[e.Simple=0]=`Simple`,e[e.TrackDel=1]=`TrackDel`,e[e.TrackBefore=2]=`TrackBefore`,e[e.TrackAfter=3]=`TrackAfter`,e})(Fz||={}),Iz=class e{constructor(e){this.sections=e}get length(){let e=0;for(let t=0;t<this.sections.length;t+=2)e+=this.sections[t];return e}get newLength(){let e=0;for(let t=0;t<this.sections.length;t+=2){let n=this.sections[t+1];e+=n<0?this.sections[t]:n}return e}get empty(){return this.sections.length==0||this.sections.length==2&&this.sections[1]<0}iterGaps(e){for(let t=0,n=0,r=0;t<this.sections.length;){let i=this.sections[t++],a=this.sections[t++];a<0?(e(n,r,i),r+=i):r+=a,n+=i}}iterChangedRanges(e,t=!1){fz(this,e,t)}get invertedDesc(){let t=[];for(let e=0;e<this.sections.length;){let n=this.sections[e++],r=this.sections[e++];r<0?t.push(n,r):t.push(r,n)}return new e(t)}composeDesc(e){return this.empty?e:e.empty?this:fCt(this,e)}mapDesc(e,t=!1){return e.empty?this:pz(this,e,t)}mapPos(e,t=-1,n=Fz.Simple){let r=0,i=0;for(let a=0;a<this.sections.length;){let o=this.sections[a++],s=this.sections[a++],c=r+o;if(s<0){if(c>e)return i+(e-r);i+=o}else{if(n!=Fz.Simple&&c>=e&&(n==Fz.TrackDel&&r<e&&c>e||n==Fz.TrackBefore&&r<e||n==Fz.TrackAfter&&c>e))return null;if(c>e||c==e&&t<0&&!o)return e==r||t<0?i:i+s;i+=s}r=c}if(e>r)throw RangeError(`Position ${e} is out of range for changeset of length ${r}`);return i}touchesRange(e,t=e){for(let n=0,r=0;n<this.sections.length&&r<=t;){let i=this.sections[n++],a=this.sections[n++],o=r+i;if(a>=0&&r<=t&&o>=e)return r<e&&o>t?`cover`:!0;r=o}return!1}toString(){let e=``;for(let t=0;t<this.sections.length;){let n=this.sections[t++],r=this.sections[t++];e+=(e?` `:``)+n+(r>=0?`:`+r:``)}return e}toJSON(){return this.sections}static fromJSON(t){if(!Array.isArray(t)||t.length%2||t.some(e=>typeof e!=`number`))throw RangeError(`Invalid JSON representation of ChangeDesc`);return new e(t)}static create(t){return new e(t)}},Lz=class e extends Iz{constructor(e,t){super(e),this.inserted=t}apply(e){if(this.length!=e.length)throw RangeError(`Applying change set to a document with the wrong length`);return fz(this,(t,n,r,i,a)=>e=e.replace(r,r+(n-t),a),!1),e}mapDesc(e,t=!1){return pz(this,e,t,!0)}invert(t){let n=this.sections.slice(),r=[];for(let e=0,i=0;e<n.length;e+=2){let a=n[e],o=n[e+1];if(o>=0){n[e]=o,n[e+1]=a;let s=e>>1;for(;r.length<s;)r.push(Oz.empty);r.push(a?t.slice(i,i+a):Oz.empty)}i+=a}return new e(n,r)}compose(e){return this.empty?e:e.empty?this:fCt(this,e,!0)}map(e,t=!1){return e.empty?this:pz(this,e,t,!0)}iterChanges(e,t=!1){fz(this,e,t)}get desc(){return Iz.create(this.sections)}filter(t){let n=[],r=[],i=[],a=new Rz(this);done:for(let e=0,o=0;;){let s=e==t.length?1e9:t[e++];for(;o<s||o==s&&a.len==0;){if(a.done)break done;let e=Math.min(a.len,s-o);uz(i,e,-1);let t=a.ins==-1?-1:a.off==0?a.ins:0;uz(n,e,t),t>0&&dz(r,n,a.text),a.forward(e),o+=e}let c=t[e++];for(;o<c;){if(a.done)break done;let e=Math.min(a.len,c-o);uz(n,e,-1),uz(i,e,a.ins==-1?-1:a.off==0?a.ins:0),a.forward(e),o+=e}}return{changes:new e(n,r),filtered:Iz.create(i)}}toJSON(){let e=[];for(let t=0;t<this.sections.length;t+=2){let n=this.sections[t],r=this.sections[t+1];r<0?e.push(n):r==0?e.push([n]):e.push([n].concat(this.inserted[t>>1].toJSON()))}return e}static of(t,n,r){let i=[],a=[],o=0,s=null;function c(t=!1){if(!t&&!i.length)return;o<n&&uz(i,n-o,-1);let r=new e(i,a);s=s?s.compose(r.map(s)):r,i=[],a=[],o=0}function l(t){if(Array.isArray(t))for(let e of t)l(e);else if(t instanceof e){if(t.length!=n)throw RangeError(`Mismatched change set length (got ${t.length}, expected ${n})`);c(),s=s?s.compose(t.map(s)):t}else{let{from:e,to:s=e,insert:l}=t;if(e>s||e<0||s>n)throw RangeError(`Invalid change range ${e} to ${s} (in doc of length ${n})`);let u=l?typeof l==`string`?Oz.of(l.split(r||Pz)):l:Oz.empty,d=u.length;if(e==s&&d==0)return;e<o&&c(),e>o&&uz(i,e-o,-1),uz(i,s-e,d),dz(a,i,u),o=s}}return l(t),c(!s),s}static empty(t){return new e(t?[t,-1]:[],[])}static fromJSON(t){if(!Array.isArray(t))throw RangeError(`Invalid JSON representation of ChangeSet`);let n=[],r=[];for(let e=0;e<t.length;e++){let i=t[e];if(typeof i==`number`)n.push(i,-1);else if(!Array.isArray(i)||typeof i[0]!=`number`||i.some((e,t)=>t&&typeof e!=`string`))throw RangeError(`Invalid JSON representation of ChangeSet`);else if(i.length==1)n.push(i[0],0);else{for(;r.length<e;)r.push(Oz.empty);r[e]=Oz.of(i.slice(1)),n.push(i[0],r[e].length)}}return new e(n,r)}static createSet(t,n){return new e(t,n)}},Rz=class{constructor(e){this.set=e,this.i=0,this.next()}next(){let{sections:e}=this.set;this.i<e.length?(this.len=e[this.i++],this.ins=e[this.i++]):(this.len=0,this.ins=-2),this.off=0}get done(){return this.ins==-2}get len2(){return this.ins<0?this.len:this.ins}get text(){let{inserted:e}=this.set,t=this.i-2>>1;return t>=e.length?Oz.empty:e[t]}textBit(e){let{inserted:t}=this.set,n=this.i-2>>1;return n>=t.length&&!e?Oz.empty:t[n].slice(this.off,e==null?void 0:this.off+e)}forward(e){e==this.len?this.next():(this.len-=e,this.off+=e)}forward2(e){this.ins==-1?this.forward(e):e==this.ins?this.next():(this.ins-=e,this.off+=e)}},zz=class e{constructor(e,t,n){this.from=e,this.to=t,this.flags=n}get anchor(){return this.flags&32?this.to:this.from}get head(){return this.flags&32?this.from:this.to}get empty(){return this.from==this.to}get assoc(){return this.flags&8?-1:this.flags&16?1:0}get bidiLevel(){let e=this.flags&7;return e==7?null:e}get goalColumn(){let e=this.flags>>6;return e==16777215?void 0:e}map(t,n=-1){let r,i;return this.empty?r=i=t.mapPos(this.from,n):(r=t.mapPos(this.from,1),i=t.mapPos(this.to,-1)),r==this.from&&i==this.to?this:new e(r,i,this.flags)}extend(e,t=e){if(e<=this.anchor&&t>=this.anchor)return Bz.range(e,t);let n=Math.abs(e-this.anchor)>Math.abs(t-this.anchor)?e:t;return Bz.range(this.anchor,n)}eq(e,t=!1){return this.anchor==e.anchor&&this.head==e.head&&(!t||!this.empty||this.assoc==e.assoc)}toJSON(){return{anchor:this.anchor,head:this.head}}static fromJSON(e){if(!e||typeof e.anchor!=`number`||typeof e.head!=`number`)throw RangeError(`Invalid JSON representation for SelectionRange`);return Bz.range(e.anchor,e.head)}static create(t,n,r){return new e(t,n,r)}},Bz=class e{constructor(e,t){this.ranges=e,this.mainIndex=t}map(t,n=-1){return t.empty?this:e.create(this.ranges.map(e=>e.map(t,n)),this.mainIndex)}eq(e,t=!1){if(this.ranges.length!=e.ranges.length||this.mainIndex!=e.mainIndex)return!1;for(let n=0;n<this.ranges.length;n++)if(!this.ranges[n].eq(e.ranges[n],t))return!1;return!0}get main(){return this.ranges[this.mainIndex]}asSingle(){return this.ranges.length==1?this:new e([this.main],0)}addRange(t,n=!0){return e.create([t].concat(this.ranges),n?0:this.mainIndex+1)}replaceRange(t,n=this.mainIndex){let r=this.ranges.slice();return r[n]=t,e.create(r,this.mainIndex)}toJSON(){return{ranges:this.ranges.map(e=>e.toJSON()),main:this.mainIndex}}static fromJSON(t){if(!t||!Array.isArray(t.ranges)||typeof t.main!=`number`||t.main>=t.ranges.length)throw RangeError(`Invalid JSON representation for EditorSelection`);return new e(t.ranges.map(e=>zz.fromJSON(e)),t.main)}static single(t,n=t){return new e([e.range(t,n)],0)}static create(t,n=0){if(t.length==0)throw RangeError(`A selection needs at least one range`);for(let r=0,i=0;i<t.length;i++){let a=t[i];if(a.empty?a.from<=r:a.from<r)return e.normalized(t.slice(),n);r=a.to}return new e(t,n)}static cursor(e,t=0,n,r){return zz.create(e,e,(t==0?0:t<0?8:16)|(n==null?7:Math.min(6,n))|(r??16777215)<<6)}static range(e,t,n,r){let i=(n??16777215)<<6|(r==null?7:Math.min(6,r));return t<e?zz.create(t,e,48|i):zz.create(e,t,(t>e?8:0)|i)}static normalized(t,n=0){let r=t[n];t.sort((e,t)=>e.from-t.from),n=t.indexOf(r);for(let r=1;r<t.length;r++){let i=t[r],a=t[r-1];if(i.empty?i.from<=a.to:i.from<a.to){let o=a.from,s=Math.max(i.to,a.to);r<=n&&n--,t.splice(--r,2,i.anchor>i.head?e.range(s,o):e.range(o,s))}}return new e(t,n)}},Vz=0,Hz=class e{constructor(e,t,n,r,i){this.combine=e,this.compareInput=t,this.compare=n,this.isStatic=r,this.id=Vz++,this.default=e([]),this.extensions=typeof i==`function`?i(this):i}get reader(){return this}static define(t={}){return new e(t.combine||(e=>e),t.compareInput||((e,t)=>e===t),t.compare||(t.combine?(e,t)=>e===t:mz),!!t.static,t.enables)}of(e){return new Uz([],this,0,e)}compute(e,t){if(this.isStatic)throw Error(`Can't compute a static facet`);return new Uz(e,this,1,t)}computeN(e,t){if(this.isStatic)throw Error(`Can't compute a static facet`);return new Uz(e,this,2,t)}from(e,t){return t||=e=>e,this.compute([e],n=>t(n.field(e)))}},Uz=class{constructor(e,t,n,r){this.dependencies=e,this.facet=t,this.type=n,this.value=r,this.id=Vz++}dynamicSlot(e){let t=this.value,n=this.facet.compareInput,r=this.id,i=e[r]>>1,a=this.type==2,o=!1,s=!1,c=[];for(let t of this.dependencies)t==`doc`?o=!0:t==`selection`?s=!0:(e[t.id]??1)&1||c.push(e[t.id]);return{create(e){return e.values[i]=t(e),1},update(e,r){if(o&&r.docChanged||s&&(r.docChanged||r.selection)||hz(e,c)){let r=t(e);if(a?!mCt(r,e.values[i],n):!n(r,e.values[i]))return e.values[i]=r,1}return 0},reconfigure:(e,o)=>{let s,c=o.config.address[r];if(c!=null){let r=vz(o,c);if(this.dependencies.every(t=>t instanceof Hz?o.facet(t)===e.facet(t):t instanceof Gz?o.field(t,!1)==e.field(t,!1):!0)||(a?mCt(s=t(e),r,n):n(s=t(e),r)))return e.values[i]=r,0}else s=t(e);return e.values[i]=s,1}}}},Wz=Hz.define({static:!0}),Gz=class e{constructor(e,t,n,r,i){this.id=e,this.createF=t,this.updateF=n,this.compareF=r,this.spec=i,this.provides=void 0}static define(t){let n=new e(Vz++,t.create,t.update,t.compare||((e,t)=>e===t),t);return t.provide&&(n.provides=t.provide(n)),n}create(e){return(e.facet(Wz).find(e=>e.field==this)?.create||this.createF)(e)}slot(e){let t=e[this.id]>>1;return{create:e=>(e.values[t]=this.create(e),1),update:(e,n)=>{let r=e.values[t],i=this.updateF(r,n);return this.compareF(r,i)?0:(e.values[t]=i,1)},reconfigure:(e,n)=>n.config.address[this.id]==null?(e.values[t]=this.create(e),1):(e.values[t]=n.field(this),0)}}init(e){return[this,Wz.of({field:this,create:e})]}get extension(){return this}},Kz={lowest:4,low:3,default:2,high:1,highest:0},qz={highest:gz(Kz.highest),high:gz(Kz.high),default:gz(Kz.default),low:gz(Kz.low),lowest:gz(Kz.lowest)},Jz=class{constructor(e,t){this.inner=e,this.prec=t}},Yz=class e{of(e){return new Xz(this,e)}reconfigure(t){return e.reconfigure.of({compartment:this,extension:t})}get(e){return e.config.compartments.get(this)}},Xz=class{constructor(e,t){this.compartment=e,this.inner=t}},Zz=class e{constructor(e,t,n,r,i,a){for(this.base=e,this.compartments=t,this.dynamicSlots=n,this.address=r,this.staticValues=i,this.facets=a,this.statusTemplate=[];this.statusTemplate.length<n.length;)this.statusTemplate.push(0)}staticFacet(e){let t=this.address[e.id];return t==null?e.default:this.staticValues[t>>1]}static resolve(t,n,r){let i=[],a=Object.create(null),o=new Map;for(let e of gCt(t,n,o))e instanceof Gz?i.push(e):(a[e.facet.id]||(a[e.facet.id]=[])).push(e);let s=Object.create(null),c=[],l=[];for(let e of i)s[e.id]=l.length<<1,l.push(t=>e.slot(t));let u=r?.config.facets;for(let e in a){let t=a[e],n=t[0].facet,i=u&&u[e]||[];if(t.every(e=>e.type==0))if(s[n.id]=c.length<<1|1,mz(i,t))c.push(r.facet(n));else{let e=n.combine(t.map(e=>e.value));c.push(r&&n.compare(e,r.facet(n))?r.facet(n):e)}else{for(let e of t)e.type==0?(s[e.id]=c.length<<1|1,c.push(e.value)):(s[e.id]=l.length<<1,l.push(t=>e.dynamicSlot(t)));s[n.id]=l.length<<1,l.push(e=>hCt(e,n,t))}}return new e(t,o,l.map(e=>e(s)),s,c,a)}},Qz=Hz.define(),$z=Hz.define({combine:e=>e.some(e=>e),static:!0}),eB=Hz.define({combine:e=>e.length?e[0]:void 0,static:!0}),tB=Hz.define(),nB=Hz.define(),rB=Hz.define(),iB=Hz.define({combine:e=>e.length?e[0]:!1}),aB=class{constructor(e,t){this.type=e,this.value=t}static define(){return new ACt}},ACt=class{of(e){return new aB(this,e)}},jCt=class{constructor(e){this.map=e}of(e){return new oB(this,e)}},oB=class e{constructor(e,t){this.type=e,this.value=t}map(t){let n=this.type.map(this.value,t);return n===void 0?void 0:n==this.value?this:new e(this.type,n)}is(e){return this.type==e}static define(e={}){return new jCt(e.map||(e=>e))}static mapEffects(e,t){if(!e.length)return e;let n=[];for(let r of e){let e=r.map(t);e&&n.push(e)}return n}},oB.reconfigure=oB.define(),oB.appendConfig=oB.define(),sB=class e{constructor(t,n,r,i,a,o){this.startState=t,this.changes=n,this.selection=r,this.effects=i,this.annotations=a,this.scrollIntoView=o,this._doc=null,this._state=null,r&&pCt(r,n.newLength),a.some(t=>t.type==e.time)||(this.annotations=a.concat(e.time.of(Date.now())))}static create(t,n,r,i,a,o){return new e(t,n,r,i,a,o)}get newDoc(){return this._doc||=this.changes.apply(this.startState.doc)}get newSelection(){return this.selection||this.startState.selection.map(this.changes)}get state(){return this._state||this.startState.applyTransaction(this),this._state}annotation(e){for(let t of this.annotations)if(t.type==e)return t.value}get docChanged(){return!this.changes.empty}get reconfigured(){return this.startState.config!=this.state.config}isUserEvent(t){let n=this.annotation(e.userEvent);return!!(n&&(n==t||n.length>t.length&&n.slice(0,t.length)==t&&n[t.length]==`.`))}},sB.time=aB.define(),sB.userEvent=aB.define(),sB.addToHistory=aB.define(),sB.remote=aB.define(),MCt=[],cB=(function(e){return e[e.Word=0]=`Word`,e[e.Space=1]=`Space`,e[e.Other=2]=`Other`,e})(cB||={}),NCt=/[\u00df\u0587\u0590-\u05f4\u0600-\u06ff\u3040-\u309f\u30a0-\u30ff\u3400-\u4db5\u4e00-\u9fcc\uac00-\ud7af]/;try{lB=RegExp(`[\\p{Alphabetic}\\p{Number}_]`,`u`)}catch{}uB=class e{constructor(e,t,n,r,i,a){this.config=e,this.doc=t,this.selection=n,this.values=r,this.status=e.statusTemplate.slice(),this.computeSlot=i,a&&(a._state=this);for(let e=0;e<this.config.dynamicSlots.length;e++)_z(this,e<<1);this.computeSlot=null}field(e,t=!0){let n=this.config.address[e.id];if(n==null){if(t)throw RangeError(`Field is not present in this state`);return}return _z(this,n),vz(this,n)}update(...e){return yCt(this,e,!0)}applyTransaction(t){let n=this.config,{base:r,compartments:i}=n;for(let e of t.effects)e.is(Yz.reconfigure)?(n&&=(i=new Map,n.compartments.forEach((e,t)=>i.set(t,e)),null),i.set(e.value.compartment,e.value.extension)):e.is(oB.reconfigure)?(n=null,r=e.value):e.is(oB.appendConfig)&&(n=null,r=bz(r).concat(e.value));let a;n?a=t.startState.values.slice():(n=Zz.resolve(r,i,this),a=new e(n,this.doc,this.selection,n.dynamicSlots.map(()=>null),(e,t)=>t.reconfigure(e,this),null).values);let o=t.startState.facet($z)?t.newSelection:t.newSelection.asSingle();new e(n,t.newDoc,o,a,(e,n)=>n.update(e,t),t)}replaceSelection(e){return typeof e==`string`&&(e=this.toText(e)),this.changeByRange(t=>({changes:{from:t.from,to:t.to,insert:e},range:Bz.cursor(t.from+e.length)}))}changeByRange(e){let t=this.selection,n=e(t.ranges[0]),r=this.changes(n.changes),i=[n.range],a=bz(n.effects);for(let n=1;n<t.ranges.length;n++){let o=e(t.ranges[n]),s=this.changes(o.changes),c=s.map(r);for(let e=0;e<n;e++)i[e]=i[e].map(c);let l=r.mapDesc(s,!0);i.push(o.range.map(l)),r=r.compose(c),a=oB.mapEffects(a,c).concat(oB.mapEffects(bz(o.effects),l))}return{changes:r,selection:Bz.create(i,t.mainIndex),effects:a}}changes(t=[]){return t instanceof Lz?t:Lz.of(t,this.doc.length,this.facet(e.lineSeparator))}toText(t){return Oz.of(t.split(this.facet(e.lineSeparator)||Pz))}sliceDoc(e=0,t=this.doc.length){return this.doc.sliceString(e,t,this.lineBreak)}facet(e){let t=this.config.address[e.id];return t==null?e.default:(_z(this,t),vz(this,t))}toJSON(e){let t={doc:this.sliceDoc(),selection:this.selection.toJSON()};if(e)for(let n in e){let r=e[n];r instanceof Gz&&this.config.address[r.id]!=null&&(t[n]=r.spec.toJSON(this.field(e[n]),this))}return t}static fromJSON(t,n={},r){if(!t||typeof t.doc!=`string`)throw RangeError(`Invalid JSON representation for EditorState`);let i=[];if(r){for(let e in r)if(Object.prototype.hasOwnProperty.call(t,e)){let n=r[e],a=t[e];i.push(n.init(e=>n.spec.fromJSON(a,e)))}}return e.create({doc:t.doc,selection:Bz.fromJSON(t.selection),extensions:n.extensions?i.concat([n.extensions]):i})}static create(t={}){let n=Zz.resolve(t.extensions||[],new Map),r=t.doc instanceof Oz?t.doc:Oz.of((t.doc||``).split(n.staticFacet(e.lineSeparator)||Pz)),i=t.selection?t.selection instanceof Bz?t.selection:Bz.single(t.selection.anchor,t.selection.head):Bz.single(0);return pCt(i,r.length),n.staticFacet($z)||(i=i.asSingle()),new e(n,r,i,n.dynamicSlots.map(()=>null),(e,t)=>t.create(e),null)}get tabSize(){return this.facet(e.tabSize)}get lineBreak(){return this.facet(e.lineSeparator)||`
-`}get readOnly(){return this.facet(iB)}phrase(t,...n){for(let n of this.facet(e.phrases))if(Object.prototype.hasOwnProperty.call(n,t)){t=n[t];break}return n.length&&(t=t.replace(/\$(\$|\d*)/g,(e,t)=>{if(t==`$`)return`$`;let r=+(t||1);return!r||r>n.length?e:n[r-1]})),t}languageDataAt(e,t,n=-1){let r=[];for(let i of this.facet(Qz))for(let a of i(this,t,n))Object.prototype.hasOwnProperty.call(a,e)&&r.push(a[e]);return r}charCategorizer(e){return CCt(this.languageDataAt(`wordChars`,e).join(``))}wordAt(e){let{text:t,from:n,length:r}=this.doc.lineAt(e),i=this.charCategorizer(e),a=e-n,o=e-n;for(;a>0;){let e=sz(t,a,!1);if(i(t.slice(e,a))!=cB.Word)break;a=e}for(;o<r;){let e=sz(t,o);if(i(t.slice(o,e))!=cB.Word)break;o=e}return a==o?null:Bz.range(a+n,o+n)}},uB.allowMultipleSelections=$z,uB.tabSize=Hz.define({combine:e=>e.length?e[0]:4}),uB.lineSeparator=eB,uB.readOnly=iB,uB.phrases=Hz.define({compare(e,t){let n=Object.keys(e),r=Object.keys(t);return n.length==r.length&&n.every(n=>e[n]==t[n])}}),uB.languageData=Qz,uB.changeFilter=tB,uB.transactionFilter=nB,uB.transactionExtender=rB,Yz.reconfigure=oB.define(),dB=class{eq(e){return this==e}range(e,t=e){return fB.create(e,t,this)}},dB.prototype.startSide=dB.prototype.endSide=0,dB.prototype.point=!1,dB.prototype.mapMode=Fz.TrackDel,fB=class e{constructor(e,t,n){this.from=e,this.to=t,this.value=n}static create(t,n,r){return new e(t,n,r)}},PCt=class e{constructor(e,t,n,r){this.from=e,this.to=t,this.value=n,this.maxPoint=r}get length(){return this.to[this.to.length-1]}findIndex(e,t,n,r=0){let i=n?this.to:this.from;for(let a=r,o=i.length;;){if(a==o)return a;let r=a+o>>1,s=i[r]-e||(n?this.value[r].endSide:this.value[r].startSide)-t;if(r==a)return s>=0?a:o;s>=0?o=r:a=r+1}}between(e,t,n,r){for(let i=this.findIndex(t,-1e9,!0),a=this.findIndex(n,1e9,!1,i);i<a;i++)if(r(this.from[i]+e,this.to[i]+e,this.value[i])===!1)return!1}map(t,n){let r=[],i=[],a=[],o=-1,s=-1;for(let e=0;e<this.value.length;e++){let c=this.value[e],l=this.from[e]+t,u=this.to[e]+t,d,f;if(l==u){let e=n.mapPos(l,c.startSide,c.mapMode);if(e==null||(d=f=e,c.startSide!=c.endSide&&(f=n.mapPos(l,c.endSide),f<d)))continue}else if(d=n.mapPos(l,c.startSide),f=n.mapPos(u,c.endSide),d>f||d==f&&c.startSide>0&&c.endSide<=0)continue;(f-d||c.endSide-c.startSide)<0||(o<0&&(o=d),c.point&&(s=Math.max(s,f-d)),r.push(c),i.push(d-o),a.push(f-o))}return{mapped:r.length?new e(i,a,r,s):null,pos:o}}},pB=class e{constructor(e,t,n,r){this.chunkPos=e,this.chunk=t,this.nextLayer=n,this.maxPoint=r}static create(t,n,r,i){return new e(t,n,r,i)}get length(){let e=this.chunk.length-1;return e<0?0:Math.max(this.chunkEnd(e),this.nextLayer.length)}get size(){if(this.isEmpty)return 0;let e=this.nextLayer.size;for(let t of this.chunk)e+=t.value.length;return e}chunkEnd(e){return this.chunkPos[e]+this.chunk[e].length}update(t){let{add:n=[],sort:r=!1,filterFrom:i=0,filterTo:a=this.length}=t,o=t.filter;if(n.length==0&&!o)return this;if(r&&(n=n.slice().sort(Sz)),this.isEmpty)return n.length?e.of(n):this;let s=new hB(this,null,-1).goto(0),c=0,l=[],u=new mB;for(;s.value||c<n.length;)if(c<n.length&&(s.from-n[c].from||s.startSide-n[c].value.startSide)>=0){let e=n[c++];u.addInner(e.from,e.to,e.value)||l.push(e)}else s.rangeIndex==1&&s.chunkIndex<this.chunk.length&&(c==n.length||this.chunkEnd(s.chunkIndex)<n[c].from)&&(!o||i>this.chunkEnd(s.chunkIndex)||a<this.chunkPos[s.chunkIndex])&&u.addChunk(this.chunkPos[s.chunkIndex],this.chunk[s.chunkIndex])?s.nextChunk():((!o||i>s.to||a<s.from||o(s.from,s.to,s.value))&&(u.addInner(s.from,s.to,s.value)||l.push(fB.create(s.from,s.to,s.value))),s.next());return u.finishInner(this.nextLayer.isEmpty&&!l.length?e.empty:this.nextLayer.update({add:l,filter:o,filterFrom:i,filterTo:a}))}map(t){if(t.empty||this.isEmpty)return this;let n=[],r=[],i=-1;for(let e=0;e<this.chunk.length;e++){let a=this.chunkPos[e],o=this.chunk[e],s=t.touchesRange(a,a+o.length);if(s===!1)i=Math.max(i,o.maxPoint),n.push(o),r.push(t.mapPos(a));else if(s===!0){let{mapped:e,pos:s}=o.map(a,t);e&&(i=Math.max(i,e.maxPoint),n.push(e),r.push(s))}}let a=this.nextLayer.map(t);return n.length==0?a:new e(r,n,a||e.empty,i)}between(e,t,n){if(!this.isEmpty){for(let r=0;r<this.chunk.length;r++){let i=this.chunkPos[r],a=this.chunk[r];if(t>=i&&e<=i+a.length&&a.between(i,e-i,t-i,n)===!1)return}this.nextLayer.between(e,t,n)}}iter(e=0){return gB.from([this]).goto(e)}get isEmpty(){return this.nextLayer==this}static iter(e,t=0){return gB.from(e).goto(t)}static compare(e,t,n,r,i=-1){let a=e.filter(e=>e.maxPoint>0||!e.isEmpty&&e.maxPoint>=i),o=t.filter(e=>e.maxPoint>0||!e.isEmpty&&e.maxPoint>=i),s=TCt(a,o,n),c=new _B(a,s,i),l=new _B(o,s,i);n.iterGaps((e,t,n)=>ECt(c,e,l,t,n,r)),n.empty&&n.length==0&&ECt(c,0,l,0,0,r)}static eq(e,t,n=0,r){r??=999999999;let i=e.filter(e=>!e.isEmpty&&t.indexOf(e)<0),a=t.filter(t=>!t.isEmpty&&e.indexOf(t)<0);if(i.length!=a.length)return!1;if(!i.length)return!0;let o=TCt(i,a),s=new _B(i,o,0).goto(n),c=new _B(a,o,0).goto(n);for(;;){if(s.to!=c.to||!wz(s.active,c.active)||s.point&&(!c.point||!s.point.eq(c.point)))return!1;if(s.to>r)return!0;s.next(),c.next()}}static spans(e,t,n,r,i=-1){let a=new _B(e,null,i).goto(t),o=t,s=a.openStart;for(;;){let e=Math.min(a.to,n);if(a.point){let n=a.activeForPoint(a.to),i=a.pointFrom<t?n.length+1:a.point.startSide<0?n.length:Math.min(n.length,s);r.point(o,e,a.point,n,i,a.pointRank),s=Math.min(a.openEnd(e),n.length)}else e>o&&(r.span(o,e,a.active,s),s=a.openEnd(e));if(a.to>n)return s+(a.point&&a.to>n?1:0);o=a.to,a.next()}}static of(e,t=!1){let n=new mB;for(let r of e instanceof fB?[e]:t?wCt(e):e)n.add(r.from,r.to,r.value);return n.finish()}static join(t){if(!t.length)return e.empty;let n=t[t.length-1];for(let r=t.length-2;r>=0;r--)for(let i=t[r];i!=e.empty;i=i.nextLayer)n=new e(i.chunkPos,i.chunk,n,Math.max(i.maxPoint,n.maxPoint));return n}},pB.empty=new pB([],[],null,-1),pB.empty.nextLayer=pB.empty,mB=class e{finishChunk(e){this.chunks.push(new PCt(this.from,this.to,this.value,this.maxPoint)),this.chunkPos.push(this.chunkStart),this.chunkStart=-1,this.setMaxPoint=Math.max(this.setMaxPoint,this.maxPoint),this.maxPoint=-1,e&&(this.from=[],this.to=[],this.value=[])}constructor(){this.chunks=[],this.chunkPos=[],this.chunkStart=-1,this.last=null,this.lastFrom=-1e9,this.lastTo=-1e9,this.from=[],this.to=[],this.value=[],this.maxPoint=-1,this.setMaxPoint=-1,this.nextLayer=null}add(t,n,r){this.addInner(t,n,r)||(this.nextLayer||=new e).add(t,n,r)}addInner(e,t,n){let r=e-this.lastTo||n.startSide-this.last.endSide;if(r<=0&&(e-this.lastFrom||n.startSide-this.last.startSide)<0)throw Error("Ranges must be added sorted by `from` position and `startSide`");return r<0?!1:(this.from.length==250&&this.finishChunk(!0),this.chunkStart<0&&(this.chunkStart=e),this.from.push(e-this.chunkStart),this.to.push(t-this.chunkStart),this.last=n,this.lastFrom=e,this.lastTo=t,this.value.push(n),n.point&&(this.maxPoint=Math.max(this.maxPoint,t-e)),!0)}addChunk(e,t){if((e-this.lastTo||t.value[0].startSide-this.last.endSide)<0)return!1;this.from.length&&this.finishChunk(!0),this.setMaxPoint=Math.max(this.setMaxPoint,t.maxPoint),this.chunks.push(t),this.chunkPos.push(e);let n=t.value.length-1;return this.last=t.value[n],this.lastFrom=t.from[n]+e,this.lastTo=t.to[n]+e,!0}finish(){return this.finishInner(pB.empty)}finishInner(e){if(this.from.length&&this.finishChunk(!1),this.chunks.length==0)return e;let t=pB.create(this.chunkPos,this.chunks,this.nextLayer?this.nextLayer.finishInner(e):e,this.setMaxPoint);return this.from=null,t}},hB=class{constructor(e,t,n,r=0){this.layer=e,this.skip=t,this.minPoint=n,this.rank=r}get startSide(){return this.value?this.value.startSide:0}get endSide(){return this.value?this.value.endSide:0}goto(e,t=-1e9){return this.chunkIndex=this.rangeIndex=0,this.gotoInner(e,t,!1),this}gotoInner(e,t,n){for(;this.chunkIndex<this.layer.chunk.length;){let t=this.layer.chunk[this.chunkIndex];if(!(this.skip&&this.skip.has(t)||this.layer.chunkEnd(this.chunkIndex)<e||t.maxPoint<this.minPoint))break;this.chunkIndex++,n=!1}if(this.chunkIndex<this.layer.chunk.length){let r=this.layer.chunk[this.chunkIndex].findIndex(e-this.layer.chunkPos[this.chunkIndex],t,!0);(!n||this.rangeIndex<r)&&this.setRangeIndex(r)}this.next()}forward(e,t){(this.to-e||this.endSide-t)<0&&this.gotoInner(e,t,!0)}next(){for(;;)if(this.chunkIndex==this.layer.chunk.length){this.from=this.to=1e9,this.value=null;break}else{let e=this.layer.chunkPos[this.chunkIndex],t=this.layer.chunk[this.chunkIndex];if(this.from=e+t.from[this.rangeIndex],this.to=e+t.to[this.rangeIndex],this.value=t.value[this.rangeIndex],this.setRangeIndex(this.rangeIndex+1),this.minPoint<0||this.value.point&&this.to-this.from>=this.minPoint)break}}setRangeIndex(e){if(e==this.layer.chunk[this.chunkIndex].value.length){if(this.chunkIndex++,this.skip)for(;this.chunkIndex<this.layer.chunk.length&&this.skip.has(this.layer.chunk[this.chunkIndex]);)this.chunkIndex++;this.rangeIndex=0}else this.rangeIndex=e}nextChunk(){this.chunkIndex++,this.rangeIndex=0,this.next()}compare(e){return this.from-e.from||this.startSide-e.startSide||this.rank-e.rank||this.to-e.to||this.endSide-e.endSide}},gB=class e{constructor(e){this.heap=e}static from(t,n=null,r=-1){let i=[];for(let e=0;e<t.length;e++)for(let a=t[e];!a.isEmpty;a=a.nextLayer)a.maxPoint>=r&&i.push(new hB(a,n,r,e));return i.length==1?i[0]:new e(i)}get startSide(){return this.value?this.value.startSide:0}goto(e,t=-1e9){for(let n of this.heap)n.goto(e,t);for(let e=this.heap.length>>1;e>=0;e--)Cz(this.heap,e);return this.next(),this}forward(e,t){for(let n of this.heap)n.forward(e,t);for(let e=this.heap.length>>1;e>=0;e--)Cz(this.heap,e);(this.to-e||this.value.endSide-t)<0&&this.next()}next(){if(this.heap.length==0)this.from=this.to=1e9,this.value=null,this.rank=-1;else{let e=this.heap[0];this.from=e.from,this.to=e.to,this.value=e.value,this.rank=e.rank,e.value&&e.next(),Cz(this.heap,0)}}},_B=class{constructor(e,t,n){this.minPoint=n,this.active=[],this.activeTo=[],this.activeRank=[],this.minActive=-1,this.point=null,this.pointFrom=0,this.pointRank=0,this.to=-1e9,this.endSide=0,this.openStart=-1,this.cursor=gB.from(e,t,n)}goto(e,t=-1e9){return this.cursor.goto(e,t),this.active.length=this.activeTo.length=this.activeRank.length=0,this.minActive=-1,this.to=e,this.endSide=t,this.openStart=-1,this.next(),this}forward(e,t){for(;this.minActive>-1&&(this.activeTo[this.minActive]-e||this.active[this.minActive].endSide-t)<0;)this.removeActive(this.minActive);this.cursor.forward(e,t)}removeActive(e){Tz(this.active,e),Tz(this.activeTo,e),Tz(this.activeRank,e),this.minActive=DCt(this.active,this.activeTo)}addActive(e){let t=0,{value:n,to:r,rank:i}=this.cursor;for(;t<this.activeRank.length&&(i-this.activeRank[t]||r-this.activeTo[t])>0;)t++;Ez(this.active,t,n),Ez(this.activeTo,t,r),Ez(this.activeRank,t,i),e&&Ez(e,t,this.cursor.from),this.minActive=DCt(this.active,this.activeTo)}next(){let e=this.to,t=this.point;this.point=null;let n=this.openStart<0?[]:null;for(;;){let r=this.minActive;if(r>-1&&(this.activeTo[r]-this.cursor.from||this.active[r].endSide-this.cursor.startSide)<0){if(this.activeTo[r]>e){this.to=this.activeTo[r],this.endSide=this.active[r].endSide;break}this.removeActive(r),n&&Tz(n,r)}else if(!this.cursor.value){this.to=this.endSide=1e9;break}else if(this.cursor.from>e){this.to=this.cursor.from,this.endSide=this.cursor.startSide;break}else{let e=this.cursor.value;if(!e.point)this.addActive(n),this.cursor.next();else if(t&&this.cursor.to==this.to&&this.cursor.from<this.cursor.to)this.cursor.next();else{this.point=e,this.pointFrom=this.cursor.from,this.pointRank=this.cursor.rank,this.to=this.cursor.to,this.endSide=e.endSide,this.cursor.next(),this.forward(this.to,this.endSide);break}}}if(n){this.openStart=0;for(let t=n.length-1;t>=0&&n[t]<e;t--)this.openStart++}}activeForPoint(e){if(!this.active.length)return this.active;let t=[];for(let n=this.active.length-1;n>=0&&!(this.activeRank[n]<this.pointRank);n--)(this.activeTo[n]>e||this.activeTo[n]==e&&this.active[n].endSide>=this.point.endSide)&&t.push(this.active[n]);return t.reverse()}openEnd(e){let t=0;for(let n=this.activeTo.length-1;n>=0&&this.activeTo[n]>e;n--)t++;return t}}})),yB,bB,xB,SB,CB,wB,FCt,ICt=s((()=>{yB=`ͼ`,bB=typeof Symbol>`u`?`__`+yB:Symbol.for(yB),xB=typeof Symbol>`u`?`__styleSet`+Math.floor(Math.random()*1e8):Symbol(`styleSet`),SB=typeof globalThis<`u`?globalThis:typeof window<`u`?window:{},CB=class{constructor(e,t){this.rules=[];let{finish:n}=t||{};function r(e){return/^@/.test(e)?[e]:e.split(/,\s*/)}function i(e,t,a,o){let s=[],c=/^@(\w+)\b/.exec(e[0]),l=c&&c[1]==`keyframes`;if(c&&t==null)return a.push(e[0]+`;`);for(let n in t){let o=t[n];if(/&/.test(n))i(n.split(/,\s*/).map(t=>e.map(e=>t.replace(/&/,e))).reduce((e,t)=>e.concat(t)),o,a);else if(o&&typeof o==`object`){if(!c)throw RangeError(`The value of a property (`+n+`) should be a primitive value.`);i(r(n),o,s,l)}else o!=null&&s.push(n.replace(/_.*/,``).replace(/[A-Z]/g,e=>`-`+e.toLowerCase())+`: `+o+`;`)}(s.length||l)&&a.push((n&&!c&&!o?e.map(n):e).join(`, `)+` {`+s.join(` `)+`}`)}for(let t in e)i(r(t),e[t],this.rules)}getRules(){return this.rules.join(`
-`)}static newName(){let e=SB[bB]||1;return SB[bB]=e+1,yB+e.toString(36)}static mount(e,t,n){let r=e[xB],i=n&&n.nonce;r?i&&r.setNonce(i):r=new FCt(e,i),r.mount(Array.isArray(t)?t:[t],e)}},wB=new Map,FCt=class{constructor(e,t){let n=e.ownerDocument||e,r=n.defaultView;if(!e.head&&e.adoptedStyleSheets&&r.CSSStyleSheet){let t=wB.get(n);if(t)return e[xB]=t;this.sheet=new r.CSSStyleSheet,wB.set(n,this)}else this.styleTag=n.createElement(`style`),t&&this.styleTag.setAttribute(`nonce`,t);this.modules=[],e[xB]=this}mount(e,t){let n=this.sheet,r=0,i=0;for(let t=0;t<e.length;t++){let a=e[t],o=this.modules.indexOf(a);if(o<i&&o>-1&&(this.modules.splice(o,1),i--,o=-1),o==-1){if(this.modules.splice(i++,0,a),n)for(let e=0;e<a.rules.length;e++)n.insertRule(a.rules[e],r++)}else{for(;i<o;)r+=this.modules[i++].rules.length;r+=a.rules.length,i++}}if(n)t.adoptedStyleSheets.indexOf(this.sheet)<0&&(t.adoptedStyleSheets=[this.sheet,...t.adoptedStyleSheets]);else{let e=``;for(let t=0;t<this.modules.length;t++)e+=this.modules[t].getRules()+`
-`;this.styleTag.textContent=e;let n=t.head||t;this.styleTag.parentNode!=n&&n.insertBefore(this.styleTag,n.firstChild)}}setNonce(e){this.styleTag&&this.styleTag.getAttribute(`nonce`)!=e&&this.styleTag.setAttribute(`nonce`,e)}}}));function LCt(e){var t=!(RCt&&e.metaKey&&e.shiftKey&&!e.ctrlKey&&!e.altKey||zCt&&e.shiftKey&&e.key&&e.key.length==1||e.key==`Unidentified`)&&e.key||(e.shiftKey?EB:TB)[e.keyCode]||e.key||`Unidentified`;return t==`Esc`&&(t=`Escape`),t==`Del`&&(t=`Delete`),t==`Left`&&(t=`ArrowLeft`),t==`Up`&&(t=`ArrowUp`),t==`Right`&&(t=`ArrowRight`),t==`Down`&&(t=`ArrowDown`),t}var TB,EB,RCt,zCt,DB,BCt=s((()=>{for(TB={8:`Backspace`,9:`Tab`,10:`Enter`,12:`NumLock`,13:`Enter`,16:`Shift`,17:`Control`,18:`Alt`,20:`CapsLock`,27:`Escape`,32:` `,33:`PageUp`,34:`PageDown`,35:`End`,36:`Home`,37:`ArrowLeft`,38:`ArrowUp`,39:`ArrowRight`,40:`ArrowDown`,44:`PrintScreen`,45:`Insert`,46:`Delete`,59:`;`,61:`=`,91:`Meta`,92:`Meta`,106:`*`,107:`+`,108:`,`,109:`-`,110:`.`,111:`/`,144:`NumLock`,145:`ScrollLock`,160:`Shift`,161:`Shift`,162:`Control`,163:`Control`,164:`Alt`,165:`Alt`,173:`-`,186:`;`,187:`=`,188:`,`,189:`-`,190:`.`,191:`/`,192:"`",219:`[`,220:`\\`,221:`]`,222:`'`},EB={48:`)`,49:`!`,50:`@`,51:`#`,52:`$`,53:`%`,54:`^`,55:`&`,56:`*`,57:`(`,59:`:`,61:`+`,173:`_`,186:`:`,187:`+`,188:`<`,189:`_`,190:`>`,191:`?`,192:`~`,219:`{`,220:`|`,221:`}`,222:`"`},RCt=typeof navigator<`u`&&/Mac/.test(navigator.platform),zCt=typeof navigator<`u`&&/MSIE \d|Trident\/(?:[7-9]|\d{2,})\..*rv:(\d+)/.exec(navigator.userAgent),DB=0;DB<10;DB++)TB[48+DB]=TB[96+DB]=String(DB);for(DB=1;DB<=24;DB++)TB[DB+111]=`F`+DB;for(DB=65;DB<=90;DB++)TB[DB]=String.fromCharCode(DB+32),EB[DB]=String.fromCharCode(DB);for(var e in TB)EB.hasOwnProperty(e)||(EB[e]=TB[e])}));function OB(e){let t;return t=e.nodeType==11?e.getSelection?e:e.ownerDocument:e,t.getSelection()}function kB(e,t){return t?e==t||e.contains(t.nodeType==1?t:t.parentNode):!1}function AB(e,t){if(!t.anchorNode)return!1;try{return kB(e,t.anchorNode)}catch{return!1}}function jB(e){return e.nodeType==3?LB(e,0,e.nodeValue.length).getClientRects():e.nodeType==1?e.getClientRects():[]}function MB(e,t,n,r){return n?VCt(e,t,n,r,-1)||VCt(e,t,n,r,1):!1}function NB(e){for(var t=0;;t++)if(e=e.previousSibling,!e)return t}function PB(e){return e.nodeType==1&&/^(DIV|P|LI|UL|OL|BLOCKQUOTE|DD|DT|H\d|SECTION|PRE)$/.test(e.nodeName)}function VCt(e,t,n,r,i){for(;;){if(e==n&&t==r)return!0;if(t==(i<0?0:FB(e))){if(e.nodeName==`DIV`)return!1;let n=e.parentNode;if(!n||n.nodeType!=1)return!1;t=NB(e)+(i<0?0:1),e=n}else if(e.nodeType==1){if(e=e.childNodes[t+(i<0?-1:0)],e.nodeType==1&&e.contentEditable==`false`)return!1;t=i<0?FB(e):0}else return!1}}function FB(e){return e.nodeType==3?e.nodeValue.length:e.childNodes.length}function IB(e,t){let n=t?e.left:e.right;return{left:n,right:n,top:e.top,bottom:e.bottom}}function HCt(e){let t=e.visualViewport;return t?{left:0,right:t.width,top:0,bottom:t.height}:{left:0,right:e.innerWidth,top:0,bottom:e.innerHeight}}function UCt(e,t){let n=t.width/e.offsetWidth,r=t.height/e.offsetHeight;return(n>.995&&n<1.005||!isFinite(n)||Math.abs(t.width-e.offsetWidth)<1)&&(n=1),(r>.995&&r<1.005||!isFinite(r)||Math.abs(t.height-e.offsetHeight)<1)&&(r=1),{scaleX:n,scaleY:r}}function WCt(e,t,n,r,i,a,o,s){let c=e.ownerDocument,l=c.defaultView||window;for(let u=e,d=!1;u&&!d;)if(u.nodeType==1){let e,f=u==c.body,p=1,m=1;if(f)e=HCt(l);else{if(/^(fixed|sticky)$/.test(getComputedStyle(u).position)&&(d=!0),u.scrollHeight<=u.clientHeight&&u.scrollWidth<=u.clientWidth){u=u.assignedSlot||u.parentNode;continue}let t=u.getBoundingClientRect();({scaleX:p,scaleY:m}=UCt(u,t)),e={left:t.left,right:t.left+u.clientWidth*p,top:t.top,bottom:t.top+u.clientHeight*m}}let h=0,g=0;if(i==`nearest`)t.top<e.top?(g=-(e.top-t.top+o),n>0&&t.bottom>e.bottom+g&&(g=t.bottom-e.bottom+g+o)):t.bottom>e.bottom&&(g=t.bottom-e.bottom+o,n<0&&t.top-g<e.top&&(g=-(e.top+g-t.top+o)));else{let r=t.bottom-t.top,a=e.bottom-e.top;g=(i==`center`&&r<=a?t.top+r/2-a/2:i==`start`||i==`center`&&n<0?t.top-o:t.bottom-a+o)-e.top}if(r==`nearest`?t.left<e.left?(h=-(e.left-t.left+a),n>0&&t.right>e.right+h&&(h=t.right-e.right+h+a)):t.right>e.right&&(h=t.right-e.right+a,n<0&&t.left<e.left+h&&(h=-(e.left+h-t.left+a))):h=(r==`center`?t.left+(t.right-t.left)/2-(e.right-e.left)/2:r==`start`==s?t.left-a:t.right-(e.right-e.left)+a)-e.left,h||g)if(f)l.scrollBy(h,g);else{let e=0,n=0;if(g){let e=u.scrollTop;u.scrollTop+=g/m,n=(u.scrollTop-e)*m}if(h){let t=u.scrollLeft;u.scrollLeft+=h/p,e=(u.scrollLeft-t)*p}t={left:t.left-e,top:t.top-n,right:t.right-e,bottom:t.bottom-n},e&&Math.abs(e-h)<1&&(r=`nearest`),n&&Math.abs(n-g)<1&&(i=`nearest`)}if(f)break;u=u.assignedSlot||u.parentNode}else if(u.nodeType==11)u=u.host;else break}function GCt(e){let t=e.ownerDocument,n,r;for(let i=e.parentNode;i&&!(i==t.body||n&&r);)if(i.nodeType==1)!r&&i.scrollHeight>i.clientHeight&&(r=i),!n&&i.scrollWidth>i.clientWidth&&(n=i),i=i.assignedSlot||i.parentNode;else if(i.nodeType==11)i=i.host;else break;return{x:n,y:r}}function KCt(e){if(e.setActive)return e.setActive();if(lV)return e.focus(lV);let t=[];for(let n=e;n&&(t.push(n,n.scrollTop,n.scrollLeft),n!=n.ownerDocument);n=n.parentNode);if(e.focus(lV==null?{get preventScroll(){return lV={preventScroll:!0},!0}}:void 0),!lV){lV=!1;for(let e=0;e<t.length;){let n=t[e++],r=t[e++],i=t[e++];n.scrollTop!=r&&(n.scrollTop=r),n.scrollLeft!=i&&(n.scrollLeft=i)}}}function LB(e,t,n=t){let r=QTt||=document.createRange();return r.setEnd(e,n),r.setStart(e,t),r}function RB(e,t,n,r){let i={key:t,code:t,keyCode:n,which:n,cancelable:!0};r&&({altKey:i.altKey,ctrlKey:i.ctrlKey,shiftKey:i.shiftKey,metaKey:i.metaKey}=r);let a=new KeyboardEvent(`keydown`,i);a.synthetic=!0,e.dispatchEvent(a);let o=new KeyboardEvent(`keyup`,i);return o.synthetic=!0,e.dispatchEvent(o),a.defaultPrevented||o.defaultPrevented}function qCt(e){for(;e;){if(e&&(e.nodeType==9||e.nodeType==11&&e.host))return e;e=e.assignedSlot||e.parentNode}return null}function JCt(e){for(;e.attributes.length;)e.removeAttributeNode(e.attributes[0])}function YCt(e,t){let n=t.focusNode,r=t.focusOffset;if(!n||t.anchorNode!=n||t.anchorOffset!=r)return!1;for(r=Math.min(r,FB(n));;)if(r){if(n.nodeType!=1)return!1;let e=n.childNodes[r-1];e.contentEditable==`false`?r--:(n=e,r=FB(n))}else if(n==e)return!0;else r=NB(n),n=n.parentNode}function XCt(e){return e.scrollTop>Math.max(1,e.scrollHeight-e.clientHeight-4)}function ZCt(e,t){for(let n=e,r=t;;)if(n.nodeType==3&&r>0)return{node:n,offset:r};else if(n.nodeType==1&&r>0){if(n.contentEditable==`false`)return null;n=n.childNodes[r-1],r=FB(n)}else if(n.parentNode&&!PB(n))r=NB(n),n=n.parentNode;else return null}function QCt(e,t){for(let n=e,r=t;;)if(n.nodeType==3&&r<n.nodeValue.length)return{node:n,offset:r};else if(n.nodeType==1&&r<n.childNodes.length){if(n.contentEditable==`false`)return null;n=n.childNodes[r],r=0}else if(n.parentNode&&!PB(n))r=NB(n)+1,n=n.parentNode;else return null}function $Ct(e){let t=e.nextSibling;return e.parentNode.removeChild(e),t}function ewt(e,t,n,r,i,a,o,s,c){let{children:l}=e,u=l.length?l[t]:null,d=a.length?a[a.length-1]:null,f=d?d.breakAfter:o;if(!(t==r&&u&&!o&&!f&&a.length<2&&u.merge(n,i,a.length?d:null,n==0,s,c))){if(r<l.length){let e=l[r];e&&(i<e.length||e.breakAfter&&d?.breakAfter)?(t==r&&(e=e.split(i),i=0),!f&&d&&e.merge(0,i,d,!0,0,c)?a[a.length-1]=e:((i||e.children.length&&!e.children[0].length)&&e.merge(0,i,null,!1,0,c),a.push(e))):e?.breakAfter&&(d?d.breakAfter=1:o=1),r++}for(u&&(u.breakAfter=o,n>0&&(!o&&a.length&&u.merge(n,u.length,a[0],!1,s,0)?u.breakAfter=a.shift().breakAfter:(n<u.length||u.children.length&&u.children[u.children.length-1].length==0)&&u.merge(n,u.length,null,!1,s,0),t++));t<r&&a.length;)if(l[r-1].become(a[a.length-1]))r--,a.pop(),c=a.length?0:s;else if(l[t].become(a[0]))t++,a.shift(),s=a.length?0:c;else break;!a.length&&t&&r<l.length&&!l[t-1].breakAfter&&l[r].merge(0,0,l[t-1],!1,s,c)&&t--,(t<r||a.length)&&e.replaceChildren(t,r,a)}}function twt(e,t,n,r,i,a){let o=e.childCursor(),{i:s,off:c}=o.findPos(n,1),{i:l,off:u}=o.findPos(t,-1),d=t-n;for(let e of r)d+=e.length;e.length+=d,ewt(e,l,u,s,c,r,0,i,a)}function nwt(e,t,n){let r=e.nodeValue.length;t>r&&(t=r);let i=t,a=t,o=0;t==0&&n<0||t==r&&n>=0?TV.chrome||TV.gecko||(t?(i--,o=1):a<r&&(a++,o=-1)):n<0?i--:a<r&&a++;let s=LB(e,i,a).getClientRects();if(!s.length)return null;let c=s[(o?o<0:n>=0)?0:s.length-1];return TV.safari&&!o&&c.width==0&&(c=Array.prototype.find.call(s,e=>e.width)||c),o?IB(c,o<0):c||null}function rwt(e,t){let n=e.dom,{children:r}=e,i=0;for(let e=0;i<r.length;i++){let a=r[i],o=e+a.length;if(!(o==e&&a.getSide()<=0)){if(t>e&&t<o&&a.dom.parentNode==n)return a.domAtPos(t-e);if(t<=e)break;e=o}}for(let e=i;e>0;e--){let t=r[e-1];if(t.dom.parentNode==n)return t.domAtPos(t.length)}for(let e=i;e<r.length;e++){let t=r[e];if(t.dom.parentNode==n)return t.domAtPos(0)}return new uV(n,0)}function iwt(e,t,n){let r,{children:i}=e;n>0&&t instanceof DV&&i.length&&(r=i[i.length-1])instanceof DV&&r.mark.eq(t.mark)?iwt(r,t.children[0],n-1):(i.push(t),t.setParent(e)),e.length+=t.length}function awt(e,t,n){let r=null,i=-1,a=null,o=-1;function s(e,t){for(let c=0,l=0;c<e.children.length&&l<=t;c++){let u=e.children[c],d=l+u.length;d>=t&&(u.children.length?s(u,t-l):(!a||a.isHidden&&n>0)&&(d>t||l==d&&u.getSide()>0)?(a=u,o=t-l):(l<t||l==d&&u.getSide()<0&&!u.isHidden)&&(r=u,i=t-l)),l=d}}s(e,t);let c=(n<0?r:a)||r||a;return c?c.coordsAt(Math.max(0,c==r?i:o),n):owt(e)}function owt(e){let t=e.dom.lastChild;if(!t)return e.dom.getBoundingClientRect();let n=jB(t);return n[n.length-1]||null}function zB(e,t){for(let n in e)n==`class`&&t.class?t.class+=` `+e.class:n==`style`&&t.style?t.style+=`;`+e.style:t[n]=e[n];return t}function BB(e,t,n){if(e==t)return!0;e||=AV,t||=AV;let r=Object.keys(e),i=Object.keys(t);if(r.length-(n&&r.indexOf(n)>-1?1:0)!=i.length-(n&&i.indexOf(n)>-1?1:0))return!1;for(let a of r)if(a!=n&&(i.indexOf(a)==-1||e[a]!==t[a]))return!1;return!0}function VB(e,t,n){let r=!1;if(t)for(let i in t)n&&i in n||(r=!0,i==`style`?e.style.cssText=``:e.removeAttribute(i));if(n)for(let i in n)t&&t[i]==n[i]||(r=!0,i==`style`?e.style.cssText=n[i]:e.setAttribute(i,n[i]));return r}function swt(e){let t=Object.create(null);for(let n=0;n<e.attributes.length;n++){let r=e.attributes[n];t[r.name]=r.value}return t}function cwt(e,t=!1){let{inclusiveStart:n,inclusiveEnd:r}=e;return n??=e.inclusive,r??=e.inclusive,{start:n??t,end:r??t}}function lwt(e,t){return e==t||!!(e&&t&&e.compare(t))}function HB(e,t,n,r=0){let i=n.length-1;i>=0&&n[i]+r>=e?n[i]=Math.max(n[i],t):n.push(e,t)}function UB(e,t){for(let n of t)e=new DV(n,[e],e.length);return e}function uwt(e){let t=[];for(let n=0;n<e.length;n++)t.push(1<<e[n]);return t}function dwt(e){return e<=247?eEt[e]:1424<=e&&e<=1524?2:1536<=e&&e<=1785?tEt[e-1536]:1774<=e&&e<=2220?4:8192<=e&&e<=8204?256:64336<=e&&e<=65023?4:1}function fwt(e,t){if(e.length!=t.length)return!1;for(let n=0;n<e.length;n++){let r=e[n],i=t[n];if(r.from!=i.from||r.to!=i.to||r.direction!=i.direction||!fwt(r.inner,i.inner))return!1}return!0}function pwt(e,t,n,r,i){for(let a=0;a<=r.length;a++){let o=a?r[a-1].to:t,s=a<r.length?r[a].from:n,c=a?256:i;for(let t=o,n=c,r=c;t<s;t++){let i=dwt(e.charCodeAt(t));i==512?i=n:i==8&&r==4&&(i=16),JV[t]=i==4?2:i,i&7&&(r=i),n=i}for(let e=o,t=c,r=c;e<s;e++){let i=JV[e];if(i==128)e<s-1&&t==JV[e+1]&&t&24?i=JV[e]=t:JV[e]=256;else if(i==64){let i=e+1;for(;i<s&&JV[i]==64;)i++;let a=e&&t==8||i<n&&JV[i]==8?r==1?1:8:256;for(let t=e;t<i;t++)JV[t]=a;e=i-1}else i==8&&r==1&&(JV[e]=1);t=i,i&7&&(r=i)}}}function mwt(e,t,n,r,i){let a=i==1?2:1;for(let o=0,s=0,c=0;o<=r.length;o++){let l=o?r[o-1].to:t,u=o<r.length?r[o].from:n;for(let t=l,n,r,o;t<u;t++)if(r=GV[n=e.charCodeAt(t)])if(r<0){for(let e=s-3;e>=0;e-=3)if(KV[e+1]==-r){let n=KV[e+2],r=n&2?i:n&4?n&1?a:i:0;r&&(JV[t]=JV[KV[e]]=r),s=e;break}}else if(KV.length==189)break;else KV[s++]=t,KV[s++]=n,KV[s++]=c;else if((o=JV[t])==2||o==1){let e=o==i;c=e?0:1;for(let t=s-3;t>=0;t-=3){let n=KV[t+2];if(n&2)break;if(e)KV[t+2]|=2;else{if(n&4)break;KV[t+2]|=4}}}}}function hwt(e,t,n,r){for(let i=0,a=r;i<=n.length;i++){let o=i?n[i-1].to:e,s=i<n.length?n[i].from:t;for(let c=o;c<s;){let o=JV[c];if(o==256){let o=c+1;for(;;)if(o==s){if(i==n.length)break;o=n[i++].to,s=i<n.length?n[i].from:t}else if(JV[o]==256)o++;else break;let l=a==1,u=l==((o<t?JV[o]:r)==1)?l?1:2:r;for(let t=o,r=i,a=r?n[r-1].to:e;t>c;)t==a&&(t=n[--r].from,a=r?n[r-1].to:e),JV[--t]=u;c=o}else a=o,c++}}}function WB(e,t,n,r,i,a,o){let s=r%2?2:1;if(r%2==i%2)for(let c=t,l=0;c<n;){let t=!0,u=!1;if(l==a.length||c<a[l].from){let e=JV[c];e!=s&&(t=!1,u=e==16)}let d=!t&&s==1?[]:null,f=t?r:r+1,p=c;run:for(;;)if(l<a.length&&p==a[l].from){if(u)break run;let m=a[l];if(!t)for(let e=m.to,t=l+1;;){if(e==n)break run;if(t<a.length&&a[t].from==e)e=a[t++].to;else if(JV[e]==s)break run;else break}l++,d?d.push(m):(m.from>c&&o.push(new qV(c,m.from,f)),GB(e,m.direction==UV==!(f%2)?r:r+1,i,m.inner,m.from,m.to,o),c=m.to),p=m.to}else if(p==n||(t?JV[p]!=s:JV[p]==s))break;else p++;d?WB(e,c,p,r+1,i,d,o):c<p&&o.push(new qV(c,p,f)),c=p}else for(let c=n,l=a.length;c>t;){let n=!0,u=!1;if(!l||c>a[l-1].to){let e=JV[c-1];e!=s&&(n=!1,u=e==16)}let d=!n&&s==1?[]:null,f=n?r:r+1,p=c;run:for(;;)if(l&&p==a[l-1].to){if(u)break run;let m=a[--l];if(!n)for(let e=m.from,n=l;;){if(e==t)break run;if(n&&a[n-1].to==e)e=a[--n].from;else if(JV[e-1]==s)break run;else break}d?d.push(m):(m.to<c&&o.push(new qV(m.to,c,f)),GB(e,m.direction==UV==!(f%2)?r:r+1,i,m.inner,m.from,m.to,o),c=m.from),p=m.from}else if(p==t||(n?JV[p-1]!=s:JV[p-1]==s))break;else p--;d?WB(e,p,c,r+1,i,d,o):p<c&&o.push(new qV(p,c,f)),c=p}}function GB(e,t,n,r,i,a,o){let s=t%2?2:1;pwt(e,i,a,r,s),mwt(e,i,a,r,s),hwt(i,a,r,s),WB(e,i,a,t,n,r,o)}function gwt(e,t,n){if(!e)return[new qV(0,0,t==WV?1:0)];if(t==UV&&!n.length&&!nEt.test(e))return _wt(e.length);if(n.length)for(;e.length>JV.length;)JV[JV.length]=256;let r=[],i=t==UV?0:1;return GB(e,i,i,n,0,e.length,r),r}function _wt(e){return[new qV(0,e,0)]}function vwt(e,t,n,r,i){let a=r.head-e.from,o=qV.find(t,a,r.bidiLevel??-1,r.assoc),s=t[o],c=s.side(i,n);if(a==c){let e=o+=i?1:-1;if(e<0||e>=t.length)return null;s=t[o=e],a=s.side(!i,n),c=s.side(i,n)}let l=sz(e.text,a,s.forward(i,n));(l<s.from||l>s.to)&&(l=c),YV=e.text.slice(Math.min(a,l),Math.max(a,l));let u=o==(i?t.length-1:0)?null:t[o+(i?1:-1)];return u&&l==c&&u.level+(i?0:1)<s.level?Bz.cursor(u.side(!i,n)+e.from,u.forward(i,n)?1:-1,u.level):Bz.cursor(l+e.from,s.forward(i,n)?-1:1,s.level)}function ywt(e,t,n){for(let r=t;r<n;r++){let t=dwt(e.charCodeAt(r));if(t==1)return UV;if(t==2||t==4)return WV}return UV}function KB(e,t,n){let r=e.facet($V);r.length?r[0](t):window.onerror?window.onerror(String(t),n,void 0,void 0,t):n?console.error(n+`:`,t):console.error(t)}function bwt(e,t){let n=e.state.facet(yH);if(!n.length)return n;let r=n.map(t=>t instanceof Function?t(e):t),i=[];return pB.spans(r,t.from,t.to,{point(){},span(e,n,r,a){let o=e-t.from,s=n-t.from,c=i;for(let e=r.length-1;e>=0;e--,a--){let n=r[e].spec.bidiIsolate,i;if(n??=ywt(t.text,o,s),a>0&&c.length&&(i=c[c.length-1]).to==o&&i.direction==n)i.to=s,c=i.inner;else{let e={from:o,to:s,direction:n,inner:[]};c.push(e),c=e.inner}}}}),i}function qB(e){let t=0,n=0,r=0,i=0;for(let a of e.state.facet(bH)){let o=a(e);o&&(o.left!=null&&(t=Math.max(t,o.left)),o.right!=null&&(n=Math.max(n,o.right)),o.top!=null&&(r=Math.max(r,o.top)),o.bottom!=null&&(i=Math.max(i,o.bottom)))}return{left:t,right:n,top:r,bottom:i}}function xwt(e){return e.node.nodeType==1&&e.node.firstChild&&(e.offset==0||e.node.childNodes[e.offset-1].contentEditable==`false`)&&(e.offset==e.node.childNodes.length||e.node.childNodes[e.offset].contentEditable==`false`)}function Swt(e,t){let n=e.observer.selectionRange;if(!n.focusNode)return null;let r=ZCt(n.focusNode,n.focusOffset),i=QCt(n.focusNode,n.focusOffset),a=r||i;if(i&&r&&i.node!=r.node){let t=fV.get(i.node);if(!t||t instanceof EV&&t.text!=i.node.nodeValue)a=i;else if(e.docView.lastCompositionAfterCursor){let e=fV.get(r.node);!e||e instanceof EV&&e.text!=r.node.nodeValue||(a=i)}}if(e.docView.lastCompositionAfterCursor=a!=r,!a)return null;let o=t-a.offset;return{from:o,to:o+a.node.nodeValue.length,node:a.node}}function Cwt(e,t,n){let r=Swt(e,n);if(!r)return null;let{node:i,from:a,to:o}=r,s=i.nodeValue;if(/[\n\r]/.test(s)||e.state.doc.sliceString(r.from,r.to)!=s)return null;let c=t.invertedDesc,l=new SH(c.mapPos(a),c.mapPos(o),a,o),u=[];for(let t=i.parentNode;;t=t.parentNode){let n=fV.get(t);if(n instanceof DV)u.push({node:t,deco:n.mark});else if(n instanceof LV||t.nodeName==`DIV`&&t.parentNode==e.contentDOM)return{range:l,text:i,marks:u,line:t};else if(t!=e.contentDOM)u.push({node:t,deco:new PV({inclusive:!0,attributes:swt(t),tagName:t.tagName.toLowerCase()})});else return null}}function wwt(e,t){return e.nodeType==1?(t&&e.childNodes[t-1].contentEditable==`false`?1:0)|(t<e.childNodes.length&&e.childNodes[t].contentEditable==`false`?2:0):0}function Twt(e,t,n){let r=new aEt;return pB.compare(e,t,n,r),r.changes}function Ewt(e,t){for(let n=e;n&&n!=t;n=n.assignedSlot||n.parentNode)if(n.nodeType==1&&n.contentEditable==`false`)return!0;return!1}function Dwt(e,t){let n=!1;return t&&e.iterChangedRanges((e,r)=>{e<t.to&&r>t.from&&(n=!0)}),n}function Owt(e,t,n=1){let r=e.charCategorizer(t),i=e.doc.lineAt(t),a=t-i.from;if(i.length==0)return Bz.cursor(t);a==0?n=1:a==i.length&&(n=-1);let o=a,s=a;n<0?o=sz(i.text,a,!1):s=sz(i.text,a);let c=r(i.text.slice(o,s));for(;o>0;){let e=sz(i.text,o,!1);if(r(i.text.slice(e,o))!=c)break;o=e}for(;s<i.length;){let e=sz(i.text,s);if(r(i.text.slice(s,e))!=c)break;s=e}return Bz.range(o+i.from,s+i.from)}function kwt(e,t){return t.left>e?t.left-e:Math.max(0,e-t.right)}function Awt(e,t){return t.top>e?t.top-e:Math.max(0,e-t.bottom)}function JB(e,t){return e.top<t.bottom-1&&e.bottom>t.top+1}function jwt(e,t){return t<e.top?{top:t,left:e.left,right:e.right,bottom:e.bottom}:e}function Mwt(e,t){return t>e.bottom?{top:e.top,left:e.left,right:e.right,bottom:t}:e}function YB(e,t,n){let r,i,a,o,s=!1,c,l,u,d;for(let f=e.firstChild;f;f=f.nextSibling){let e=jB(f);for(let p=0;p<e.length;p++){let m=e[p];i&&JB(i,m)&&(m=jwt(Mwt(m,i.bottom),i.top));let h=kwt(t,m),g=Awt(n,m);if(h==0&&g==0)return f.nodeType==3?Nwt(f,t,n):YB(f,t,n);if(!r||o>g||o==g&&a>h){r=f,i=m,a=h,o=g;let c=g?n<m.top?-1:1:h?t<m.left?-1:1:0;s=!c||(c>0?p<e.length-1:p>0)}h==0?n>m.bottom&&(!u||u.bottom<m.bottom)?(c=f,u=m):n<m.top&&(!d||d.top>m.top)&&(l=f,d=m):u&&JB(u,m)?u=Mwt(u,m.bottom):d&&JB(d,m)&&(d=jwt(d,m.top))}}if(u&&u.bottom>=n?(r=c,i=u):d&&d.top<=n&&(r=l,i=d),!r)return{node:e,offset:0};let f=Math.max(i.left,Math.min(i.right,t));return r.nodeType==3?Nwt(r,f,n):s&&r.contentEditable!=`false`?YB(r,f,n):{node:e,offset:Array.prototype.indexOf.call(e.childNodes,r)+(t>=(i.left+i.right)/2?1:0)}}function Nwt(e,t,n){let r=e.nodeValue.length,i=-1,a=1e9,o=0;for(let s=0;s<r;s++){let r=LB(e,s,s+1).getClientRects();for(let c=0;c<r.length;c++){let l=r[c];if(l.top==l.bottom)continue;o||=t-l.left;let u=(l.top>n?l.top-n:n-l.bottom)-1;if(l.left-1<=t&&l.right+1>=t&&u<a){let n=t>=(l.left+l.right)/2,r=n;if((TV.chrome||TV.gecko)&&LB(e,s).getBoundingClientRect().left==l.right&&(r=!n),u<=0)return{node:e,offset:s+(r?1:0)};i=s+(r?1:0),a=u}}}return{node:e,offset:i>-1?i:o>0?e.nodeValue.length:0}}function Pwt(e,t,n,r=-1){let i=e.contentDOM.getBoundingClientRect(),a=i.top+e.viewState.paddingTop,o,{docHeight:s}=e.viewState,{x:c,y:l}=t,u=l-a;if(u<0)return 0;if(u>s)return e.state.doc.length;for(let t=e.viewState.heightOracle.textHeight/2,i=!1;o=e.elementAtHeight(u),o.type!=MV.Text;)for(;u=r>0?o.bottom+t:o.top-t,!(u>=0&&u<=s);){if(i)return n?null:0;i=!0,r=-r}l=a+u;let d=o.from;if(d<e.viewport.from)return e.viewport.from==0?0:n?null:Fwt(e,i,o,c,l);if(d>e.viewport.to)return e.viewport.to==e.state.doc.length?e.state.doc.length:n?null:Fwt(e,i,o,c,l);let f=e.dom.ownerDocument,p=e.root.elementFromPoint?e.root:f,m=p.elementFromPoint(c,l);m&&!e.contentDOM.contains(m)&&(m=null),m||(c=Math.max(i.left+1,Math.min(i.right-1,c)),m=p.elementFromPoint(c,l),m&&!e.contentDOM.contains(m)&&(m=null));let h,g=-1;if(m&&e.docView.nearest(m)?.isEditable!=0){if(f.caretPositionFromPoint){let e=f.caretPositionFromPoint(c,l);e&&({offsetNode:h,offset:g}=e)}else if(f.caretRangeFromPoint){let t=f.caretRangeFromPoint(c,l);t&&({startContainer:h,startOffset:g}=t,(!e.contentDOM.contains(h)||TV.safari&&Iwt(h,g,c)||TV.chrome&&Lwt(h,g,c))&&(h=void 0))}h&&(g=Math.min(FB(h),g))}if(!h||!e.docView.dom.contains(h)){let t=LV.find(e.docView,d);if(!t)return u>o.top+o.height/2?o.to:o.from;({node:h,offset:g}=YB(t.dom,c,l))}let _=e.docView.nearest(h);if(!_)return null;if(_.isWidget&&_.dom?.nodeType==1){let e=_.dom.getBoundingClientRect();return t.y<e.top||t.y<=e.bottom&&t.x<=(e.left+e.right)/2?_.posAtStart:_.posAtEnd}else return _.localPosFromDOM(h,g)+_.posAtStart}function Fwt(e,t,n,r,i){let a=Math.round((r-t.left)*e.defaultCharacterWidth);if(e.lineWrapping&&n.height>e.defaultLineHeight*1.5){let t=e.viewState.heightOracle.textHeight,r=Math.floor((i-n.top-(e.defaultLineHeight-t)*.5)/t);a+=r*e.viewState.heightOracle.lineLength}let o=e.state.sliceDoc(n.from,n.to);return n.from+OCt(o,a,e.state.tabSize)}function Iwt(e,t,n){let r;if(e.nodeType!=3||t!=(r=e.nodeValue.length))return!1;for(let t=e.nextSibling;t;t=t.nextSibling)if(t.nodeType!=1||t.nodeName!=`BR`)return!1;return LB(e,r-1,r).getBoundingClientRect().left>n}function Lwt(e,t,n){if(t!=0)return!1;for(let t=e;;){let e=t.parentNode;if(!e||e.nodeType!=1||e.firstChild!=t)return!1;if(e.classList.contains(`cm-line`))break;t=e}return n-(e.nodeType==1?e.getBoundingClientRect():LB(e,0,Math.max(e.nodeValue.length,1)).getBoundingClientRect()).left>5}function Rwt(e,t){let n=e.lineBlockAt(t);if(Array.isArray(n.type)){for(let e of n.type)if(e.to>t||e.to==t&&(e.to==n.to||e.type==MV.Text))return e}return n}function zwt(e,t,n,r){let i=Rwt(e,t.head),a=!r||i.type!=MV.Text||!(e.lineWrapping||i.widgetLineBreaks)?null:e.coordsAtPos(t.assoc<0&&t.head>i.from?t.head-1:t.head);if(a){let t=e.dom.getBoundingClientRect(),r=e.textDirectionAt(i.from),o=e.posAtCoords({x:n==(r==HV.LTR)?t.right-1:t.left+1,y:(a.top+a.bottom)/2});if(o!=null)return Bz.cursor(o,n?-1:1)}return Bz.cursor(n?i.to:i.from,n?-1:1)}function Bwt(e,t,n,r){let i=e.state.doc.lineAt(t.head),a=e.bidiSpans(i),o=e.textDirectionAt(i.from);for(let s=t,c=null;;){let t=vwt(i,a,o,s,n),l=YV;if(!t){if(i.number==(n?e.state.doc.lines:1))return s;l=`
-`,i=e.state.doc.line(i.number+(n?1:-1)),a=e.bidiSpans(i),t=e.visualLineSide(i,!n)}if(!c){if(!r)return t;c=r(l)}else if(!c(l))return s;s=t}}function Vwt(e,t,n){let r=e.state.charCategorizer(t),i=r(n);return e=>{let t=r(e);return i==cB.Space&&(i=t),i==t}}function Hwt(e,t,n,r){let i=t.head,a=n?1:-1;if(i==(n?e.state.doc.length:0))return Bz.cursor(i,t.assoc);let o=t.goalColumn,s,c=e.contentDOM.getBoundingClientRect(),l=e.coordsAtPos(i,t.assoc||-1),u=e.documentTop;if(l)o??=l.left-c.left,s=a<0?l.top:l.bottom;else{let t=e.viewState.lineBlockAt(i);o??=Math.min(c.right-c.left,e.defaultCharacterWidth*(i-t.from)),s=(a<0?t.top:t.bottom)+u}let d=c.left+o,f=r??e.viewState.heightOracle.textHeight>>1;for(let t=0;;t+=10){let n=s+(f+t)*a,r=Pwt(e,{x:d,y:n},!1,a);if(n<c.top||n>c.bottom||(a<0?r<i:r>i)){let t=e.docView.coordsForChar(r),i=!t||n<t.top?-1:1;return Bz.cursor(r,i,void 0,o)}}}function XB(e,t,n){for(;;){let r=0;for(let i of e)i.between(t-1,t+1,(e,i,a)=>{if(t>e&&t<i){let a=r||n||(t-e<i-t?-1:1);t=a<0?e:i,r=a}});if(!r)return t}}function ZB(e,t,n){let r=XB(e.state.facet(vH).map(t=>t(e)),n.from,t.head>n.from?-1:1);return r==n.from?n:Bz.cursor(r,r<n.from?1:-1)}function Uwt(e,t,n){for(;;){if(!t||n<FB(t))return!1;if(t==e)return!0;n=NB(t)+1,t=t.parentNode}}function Wwt(e,t){let n,{newSel:r}=t,i=e.state.selection.main,a=e.inputState.lastKeyTime>Date.now()-100?e.inputState.lastKeyCode:-1;if(t.bounds){let{from:r,to:o}=t.bounds,s=i.from,c=null;(a===8||TV.android&&t.text.length<o-r)&&(s=i.to,c=`end`);let l=Kwt(e.state.doc.sliceString(r,o,TH),t.text,s-r,c);l&&(TV.chrome&&a==13&&l.toB==l.from+2&&t.text.slice(l.from,l.toB)==TH+TH&&l.toB--,n={from:r+l.from,to:r+l.toA,insert:Oz.of(t.text.slice(l.from,l.toB).split(TH))})}else r&&(!e.hasFocus&&e.state.facet(uH)||r.main.eq(i))&&(r=null);if(!n&&!r)return!1;if(!n&&t.typeOver&&!i.empty&&r&&r.main.empty?n={from:i.from,to:i.to,insert:e.state.doc.slice(i.from,i.to)}:n&&n.from>=i.from&&n.to<=i.to&&(n.from!=i.from||n.to!=i.to)&&i.to-i.from-(n.to-n.from)<=4?n={from:i.from,to:i.to,insert:e.state.doc.slice(i.from,n.from).append(n.insert).append(e.state.doc.slice(n.to,i.to))}:(TV.mac||TV.android)&&n&&n.from==n.to&&n.from==i.head-1&&/^\. ?$/.test(n.insert.toString())&&e.contentDOM.getAttribute(`autocorrect`)==`off`?(r&&n.insert.length==2&&(r=Bz.single(r.main.anchor-1,r.main.head-1)),n={from:i.from,to:i.to,insert:Oz.of([` `])}):TV.chrome&&n&&n.from==n.to&&n.from==i.head&&n.insert.toString()==`
- `&&e.lineWrapping&&(r&&=Bz.single(r.main.anchor-1,r.main.head-1),n={from:i.from,to:i.to,insert:Oz.of([` `])}),n)return QB(e,n,r,a);if(r&&!r.main.eq(i)){let t=!1,n=`select`;return e.inputState.lastSelectionTime>Date.now()-50&&(e.inputState.lastSelectionOrigin==`select`&&(t=!0),n=e.inputState.lastSelectionOrigin),e.dispatch({selection:r,scrollIntoView:t,userEvent:n}),!0}else return!1}function QB(e,t,n,r=-1){if(TV.ios&&e.inputState.flushIOSKey(t))return!0;let i=e.state.selection.main;if(TV.android&&(t.to==i.to&&(t.from==i.from||t.from==i.from-1&&e.state.sliceDoc(t.from,i.from)==` `)&&t.insert.length==1&&t.insert.lines==2&&RB(e.contentDOM,`Enter`,13)||(t.from==i.from-1&&t.to==i.to&&t.insert.length==0||r==8&&t.insert.length<t.to-t.from&&t.to>i.head)&&RB(e.contentDOM,`Backspace`,8)||t.from==i.from&&t.to==i.to+1&&t.insert.length==0&&RB(e.contentDOM,`Delete`,46)))return!0;let a=t.insert.toString();e.inputState.composing>=0&&e.inputState.composing++;let o,s=()=>o||=Gwt(e,t,n);return e.state.facet(tH).some(n=>n(e,t.from,t.to,a,s))||e.dispatch(s()),!0}function Gwt(e,t,n){let r,i=e.state,a=i.selection.main;if(t.from>=a.from&&t.to<=a.to&&t.to-t.from>=(a.to-a.from)/3&&(!n||n.main.empty&&n.main.from==t.from+t.insert.length)&&e.inputState.composing<0){let n=a.from<t.from?i.sliceDoc(a.from,t.from):``,o=a.to>t.to?i.sliceDoc(t.to,a.to):``;r=i.replaceSelection(e.state.toText(n+t.insert.sliceString(0,void 0,e.state.lineBreak)+o))}else{let o=i.changes(t),s=n&&n.main.to<=o.newLength?n.main:void 0;if(i.selection.ranges.length>1&&e.inputState.composing>=0&&t.to<=a.to&&t.to>=a.to-10){let c=e.state.sliceDoc(t.from,t.to),l,u=n&&Swt(e,n.main.head);if(u){let e=t.insert.length-(t.to-t.from);l={from:u.from,to:u.to-e}}else l=e.state.doc.lineAt(a.head);let d=a.to-t.to,f=a.to-a.from;r=i.changeByRange(n=>{if(n.from==a.from&&n.to==a.to)return{changes:o,range:s||n.map(o)};let r=n.to-d,u=r-c.length;if(n.to-n.from!=f||e.state.sliceDoc(u,r)!=c||n.to>=l.from&&n.from<=l.to)return{range:n};let p=i.changes({from:u,to:r,insert:t.insert}),m=n.to-a.to;return{changes:p,range:s?Bz.range(Math.max(0,s.anchor+m),Math.max(0,s.head+m)):n.map(p)}})}else r={changes:o,selection:s&&i.selection.replaceRange(s)}}let o=`input.type`;return(e.composing||e.inputState.compositionPendingChange&&e.inputState.compositionEndedAt>Date.now()-50)&&(e.inputState.compositionPendingChange=!1,o+=`.compose`,e.inputState.compositionFirstChange&&(o+=`.start`,e.inputState.compositionFirstChange=!1)),i.update(r,{userEvent:o,scrollIntoView:!0})}function Kwt(e,t,n,r){let i=Math.min(e.length,t.length),a=0;for(;a<i&&e.charCodeAt(a)==t.charCodeAt(a);)a++;if(a==i&&e.length==t.length)return null;let o=e.length,s=t.length;for(;o>0&&s>0&&e.charCodeAt(o-1)==t.charCodeAt(s-1);)o--,s--;if(r==`end`){let e=Math.max(0,a-Math.min(o,s));n-=o+e-a}if(o<a&&e.length<t.length){let e=n<=a&&n>=o?a-n:0;a-=e,s=a+(s-o),o=a}else if(s<a){let e=n<=a&&n>=s?a-n:0;a-=e,o=a+(o-s),s=a}return{from:a,toA:o,toB:s}}function qwt(e){let t=[];if(e.root.activeElement!=e.contentDOM)return t;let{anchorNode:n,anchorOffset:r,focusNode:i,focusOffset:a}=e.observer.selectionRange;return n&&(t.push(new EH(n,r)),(i!=n||a!=r)&&t.push(new EH(i,a))),t}function Jwt(e,t){if(e.length==0)return null;let n=e[0].pos,r=e.length==2?e[1].pos:n;return n>-1&&r>-1?Bz.single(n+t,r+t):null}function Ywt(e,t){return(n,r)=>{try{return t.call(e,r,n)}catch(e){KB(n.state,e)}}}function Xwt(e){let t=Object.create(null);function n(e){return t[e]||(t[e]={observers:[],handlers:[]})}for(let t of e){let e=t.spec;if(e&&e.domEventHandlers)for(let r in e.domEventHandlers){let i=e.domEventHandlers[r];i&&n(r).handlers.push(Ywt(t.value,i))}if(e&&e.domEventObservers)for(let r in e.domEventObservers){let i=e.domEventObservers[r];i&&n(r).observers.push(Ywt(t.value,i))}}for(let e in AH)n(e).handlers.push(AH[e]);for(let e in jH)n(e).observers.push(jH[e]);return t}function $B(e){return Math.max(0,e)*.7+8}function Zwt(e,t){return Math.max(Math.abs(e.clientX-t.clientX),Math.abs(e.clientY-t.clientY))}function Qwt(e,t){let n=e.state.facet(XV);return n.length?n[0](t):TV.mac?t.metaKey:t.ctrlKey}function $wt(e,t){let n=e.state.facet(ZV);return n.length?n[0](t):TV.mac?!t.altKey:!t.ctrlKey}function eTt(e,t){let{main:n}=e.state.selection;if(n.empty)return!1;let r=OB(e.root);if(!r||r.rangeCount==0)return!0;let i=r.getRangeAt(0).getClientRects();for(let e=0;e<i.length;e++){let n=i[e];if(n.left<=t.clientX&&n.right>=t.clientX&&n.top<=t.clientY&&n.bottom>=t.clientY)return!0}return!1}function tTt(e,t){if(!t.bubbles)return!0;if(t.defaultPrevented)return!1;for(let n=t.target,r;n!=e.contentDOM;n=n.parentNode)if(!n||n.nodeType==11||(r=fV.get(n))&&r.ignoreEvent(t))return!1;return!0}function nTt(e){let t=e.dom.parentNode;if(!t)return;let n=t.appendChild(document.createElement(`textarea`));n.style.cssText=`position: fixed; left: -10000px; top: 10px`,n.focus(),setTimeout(()=>{e.focus(),n.remove(),rTt(e,n.value)},50)}function eV(e,t,n){for(let r of e.facet(t))n=r(n,e);return n}function rTt(e,t){t=eV(e.state,rH,t);let{state:n}=e,r,i=1,a=n.toText(t),o=a.lines==n.selection.ranges.length;if(LH!=null&&n.selection.ranges.every(e=>e.empty)&&LH==a.toString()){let e=-1;r=n.changeByRange(r=>{let s=n.doc.lineAt(r.from);if(s.from==e)return{range:r};e=s.from;let c=n.toText((o?a.line(i++).text:t)+n.lineBreak);return{changes:{from:s.from,insert:c},range:Bz.cursor(r.from+c.length)}})}else r=o?n.changeByRange(e=>{let t=a.line(i++);return{changes:{from:e.from,to:e.to,insert:t.text},range:Bz.cursor(e.from+t.length)}}):n.replaceSelection(a);e.dispatch(r,{userEvent:`input.paste`,scrollIntoView:!0})}function iTt(e,t,n,r){if(r==1)return Bz.cursor(t,n);if(r==2)return Owt(e.state,t,n);{let n=LV.find(e.docView,t),r=e.state.doc.lineAt(n?n.posAtEnd:t),i=n?n.posAtStart:r.from,a=n?n.posAtEnd:r.to;return a<e.state.doc.length&&a==r.to&&a++,Bz.range(i,a)}}function aTt(e,t,n,r){let i=LV.find(e.docView,t);if(!i)return 1;let a=t-i.posAtStart;if(a==0)return 1;if(a==i.length)return-1;let o=i.coordsAt(a,-1);if(o&&NH(n,r,o))return-1;let s=i.coordsAt(a,1);return s&&NH(n,r,s)?1:o&&o.bottom>=r?-1:1}function oTt(e,t){let n=e.posAtCoords({x:t.clientX,y:t.clientY},!1);return{pos:n,bias:aTt(e,n,t.clientX,t.clientY)}}function sTt(e){if(!dEt)return e.detail;let t=PH,n=IH;return PH=e,IH=Date.now(),FH=!t||n>Date.now()-400&&Math.abs(t.clientX-e.clientX)<2&&Math.abs(t.clientY-e.clientY)<2?(FH+1)%3:1}function cTt(e,t){let n=oTt(e,t),r=sTt(t),i=e.state.selection;return{update(e){e.docChanged&&(n.pos=e.changes.mapPos(n.pos),i=i.map(e.changes))},get(t,a,o){let s=oTt(e,t),c,l=iTt(e,s.pos,s.bias,r);if(n.pos!=s.pos&&!a){let t=iTt(e,n.pos,n.bias,r),i=Math.min(t.from,l.from),a=Math.max(t.to,l.to);l=i<l.from?Bz.range(i,a):Bz.range(a,i)}return a?i.replaceRange(i.main.extend(l.from,l.to)):o&&r==1&&i.ranges.length>1&&(c=lTt(i,s.pos))?c:o?i.addRange(l):Bz.create([l])}}}function lTt(e,t){for(let n=0;n<e.ranges.length;n++){let{from:r,to:i}=e.ranges[n];if(r<=t&&i>=t)return Bz.create(e.ranges.slice(0,n).concat(e.ranges.slice(n+1)),e.mainIndex==n?0:e.mainIndex-(e.mainIndex>n?1:0))}return null}function uTt(e,t,n,r){if(n=eV(e.state,rH,n),!n)return;let i=e.posAtCoords({x:t.clientX,y:t.clientY},!1),{draggedContent:a}=e.inputState,o=r&&a&&$wt(e,t)?{from:a.from,to:a.to}:null,s={from:i,insert:n},c=e.state.changes(o?[o,s]:s);e.focus(),e.dispatch({changes:c,selection:{anchor:c.mapPos(i,-1),head:c.mapPos(i,1)},userEvent:o?`move.drop`:`input.drop`}),e.inputState.draggedContent=null}function dTt(e,t){let n=e.dom.parentNode;if(!n)return;let r=n.appendChild(document.createElement(`textarea`));r.style.cssText=`position: fixed; left: -10000px; top: 10px`,r.value=t,r.focus(),r.selectionEnd=t.length,r.selectionStart=0,setTimeout(()=>{r.remove(),e.focus()},50)}function fTt(e){let t=[],n=[],r=!1;for(let r of e.selection.ranges)r.empty||(t.push(e.sliceDoc(r.from,r.to)),n.push(r));if(!t.length){let i=-1;for(let{from:r}of e.selection.ranges){let a=e.doc.lineAt(r);a.number>i&&(t.push(a.text),n.push({from:a.from,to:Math.min(e.doc.length,a.to+1)})),i=a.number}r=!0}return{text:eV(e,iH,t.join(e.lineBreak)),ranges:n,linewise:r}}function pTt(e,t){let n=[];for(let r of e.facet(nH)){let i=r(e,t);i&&n.push(i)}return n?e.update({effects:n,annotations:RH.of(!0)}):null}function mTt(e){setTimeout(()=>{let t=e.hasFocus;if(t!=e.inputState.notifiedFocused){let n=pTt(e.state,t);n?e.dispatch(n):e.update([])}},10)}function hTt(e){zH.has(e)||(zH.add(e),e.addEventListener(`copy`,()=>{}),e.addEventListener(`cut`,()=>{}))}function gTt(){VH=!1}function tV(e,t){return e==t?e:(e.constructor!=t.constructor&&(VH=!0),t)}function _Tt(e,t){let n,r;e[t]==null&&(n=e[t-1])instanceof JH&&(r=e[t+1])instanceof JH&&e.splice(t-1,3,new JH(n.length+1+r.length))}function vTt(e,t,n){let r=new _Et;return pB.compare(e,t,n,r,0),r.changes}function yTt(e,t){let n=e.getBoundingClientRect(),r=e.ownerDocument,i=r.defaultView||window,a=Math.max(0,n.left),o=Math.min(i.innerWidth,n.right),s=Math.max(0,n.top),c=Math.min(i.innerHeight,n.bottom);for(let t=e.parentNode;t&&t!=r.body;)if(t.nodeType==1){let n=t,r=window.getComputedStyle(n);if((n.scrollHeight>n.clientHeight||n.scrollWidth>n.clientWidth)&&r.overflow!=`visible`){let r=n.getBoundingClientRect();a=Math.max(a,r.left),o=Math.min(o,r.right),s=Math.max(s,r.top),c=Math.min(t==e.parentNode?i.innerHeight:c,r.bottom)}t=r.position==`absolute`||r.position==`fixed`?n.offsetParent:n.parentNode}else if(t.nodeType==11)t=t.host;else break;return{left:a-n.left,right:Math.max(a,o)-n.left,top:s-(n.top+t),bottom:Math.max(s,c)-(n.top+t)}}function bTt(e,t){let n=e.getBoundingClientRect();return{left:0,right:n.right-n.left,top:t,bottom:n.bottom-(n.top+t)}}function xTt(e,t,n){let r=[],i=e,a=0;return pB.spans(n,e,t,{span(){},point(e,t){e>i&&(r.push({from:i,to:e}),a+=e-i),i=t}},20),i<t&&(r.push({from:i,to:t}),a+=t-i),{total:a,ranges:r}}function nV({total:e,ranges:t},n){if(n<=0)return t[0].from;if(n>=1)return t[t.length-1].to;let r=Math.floor(e*n);for(let e=0;;e++){let{from:n,to:i}=t[e],a=i-n;if(r<=a)return n+r;r-=a}}function rV(e,t){let n=0;for(let{from:r,to:i}of e.ranges){if(t<=i){n+=t-r;break}n+=i-r}return n/e.total}function STt(e,t){for(let n of e)if(t(n))return n}function iV(e,t){if(t.scale==1)return e;let n=t.toDOM(e.top),r=t.toDOM(e.bottom);return new HH(e.from,e.length,n,r-n,Array.isArray(e._content)?e._content.map(e=>iV(e,t)):e._content)}function aV(e,t,n){return new CB(t,{finish(t){return/&/.test(t)?t.replace(/&\w*/,t=>{if(t==`&`)return e;if(!n||!n[t])throw RangeError(`Unsupported selector: ${t}`);return n[t]}):e+` `+t}})}function CTt(e,t,n){for(;t;){let r=fV.get(t);if(r&&r.parent==e)return r;let i=t.parentNode;t=i==e.dom?n>0?t.nextSibling:t.previousSibling:i}return null}function wTt(e,t){let n=t.startContainer,r=t.startOffset,i=t.endContainer,a=t.endOffset,o=e.docView.domAtPos(e.state.selection.main.anchor);return MB(o.node,o.offset,i,a)&&([n,r,i,a]=[i,a,n,r]),{anchorNode:n,anchorOffset:r,focusNode:i,focusOffset:a}}function TTt(e,t){if(t.getComposedRanges){let n=t.getComposedRanges(e.root)[0];if(n)return wTt(e,n)}let n=null;function r(e){e.preventDefault(),e.stopImmediatePropagation(),n=e.getTargetRanges()[0]}return e.contentDOM.addEventListener(`beforeinput`,r,!0),e.dom.ownerDocument.execCommand(`indent`),e.contentDOM.removeEventListener(`beforeinput`,r,!0),n?wTt(e,n):null}function ETt(e,t,n){for(let r=e.state.facet(t),i=r.length-1;i>=0;i--){let t=r[i],a=typeof t==`function`?t(e):t;a&&zB(a,n)}return n}function DTt(e,t){let n=e.split(/-(?!$)/),r=n[n.length-1];r==`Space`&&(r=` `);let i,a,o,s;for(let e=0;e<n.length-1;++e){let r=n[e];if(/^(cmd|meta|m)$/i.test(r))s=!0;else if(/^a(lt)?$/i.test(r))i=!0;else if(/^(c|ctrl|control)$/i.test(r))a=!0;else if(/^s(hift)?$/i.test(r))o=!0;else if(/^mod$/i.test(r))t==`mac`?s=!0:a=!0;else throw Error(`Unrecognized modifier name: `+r)}return i&&(r=`Alt-`+r),a&&(r=`Ctrl-`+r),s&&(r=`Meta-`+r),o&&(r=`Shift-`+r),r}function oV(e,t,n){return t.altKey&&(e=`Alt-`+e),t.ctrlKey&&(e=`Ctrl-`+e),t.metaKey&&(e=`Meta-`+e),n!==!1&&t.shiftKey&&(e=`Shift-`+e),e}function OTt(e){let t=e.facet(lU),n=uU.get(t);return n||uU.set(t,n=kTt(t.reduce((e,t)=>e.concat(t),[]))),n}function kTt(e,t=TEt){let n=Object.create(null),r=Object.create(null),i=(e,t)=>{let n=r[e];if(n==null)r[e]=t;else if(n!=t)throw Error(`Key binding `+e+` is used both as a regular binding and as a multi-stroke prefix`)},a=(e,r,a,o,s)=>{let c=n[e]||(n[e]=Object.create(null)),l=r.split(/ (?!$)/).map(e=>DTt(e,t));for(let t=1;t<l.length;t++){let n=l.slice(0,t).join(` `);i(n,!0),c[n]||(c[n]={preventDefault:!0,stopPropagation:!1,run:[t=>{let r=dU={view:t,prefix:n,scope:e};return setTimeout(()=>{dU==r&&(dU=null)},DEt),!0}]})}let u=l.join(` `);i(u,!1);let d=c[u]||(c[u]={preventDefault:!1,stopPropagation:!1,run:(c._any?.run)?.slice()||[]});a&&d.run.push(a),o&&(d.preventDefault=!0),s&&(d.stopPropagation=!0)};for(let r of e){let e=r.scope?r.scope.split(` `):[`editor`];if(r.any)for(let t of e){let e=n[t]||(n[t]=Object.create(null));e._any||={preventDefault:!1,stopPropagation:!1,run:[]};let{any:i}=r;for(let t in e)e[t].run.push(e=>i(e,fU))}let i=r[t]||r.key;if(i)for(let t of e)a(t,i,r.run,r.preventDefault,r.stopPropagation),r.shift&&a(t,`Shift-`+i,r.shift,r.preventDefault,r.stopPropagation)}return n}function ATt(e,t,n,r){fU=t;let i=LCt(t),a=lz(cz(i,0))==i.length&&i!=` `,o=``,s=!1,c=!1,l=!1;dU&&dU.view==n&&dU.scope==r&&(o=dU.prefix+` `,OH.indexOf(t.keyCode)<0&&(c=!0,dU=null));let u=new Set,d=e=>{if(e){for(let t of e.run)if(!u.has(t)&&(u.add(t),t(n)))return e.stopPropagation&&(l=!0),!0;e.preventDefault&&(e.stopPropagation&&(l=!0),c=!0)}return!1},f=e[r],p,m;return f&&(d(f[o+oV(i,t,!a)])?s=!0:a&&(t.altKey||t.metaKey||t.ctrlKey)&&!(TV.windows&&t.ctrlKey&&t.altKey)&&(p=TB[t.keyCode])&&p!=i?(d(f[o+oV(p,t,!0)])||t.shiftKey&&(m=EB[t.keyCode])!=i&&m!=p&&d(f[o+oV(m,t,!1)]))&&(s=!0):a&&t.shiftKey&&d(f[o+oV(i,t,!0)])&&(s=!0),!s&&d(f._any)&&(s=!0)),c&&(s=!0),s&&l&&t.stopPropagation(),fU=null,s}function jTt(e,t,n,r,i){t.lastIndex=0;for(let a=e.iterRange(n,r),o=n,s;!a.next().done;o+=a.value.length)if(!a.lineBreak)for(;s=t.exec(a.value);)i(o+s.index,s)}function MTt(e,t){let n=e.visibleRanges;if(n.length==1&&n[0].from==e.viewport.from&&n[0].to==e.viewport.to)return n;let r=[];for(let{from:i,to:a}of n)i=Math.max(e.state.doc.lineAt(i).from,i-t),a=Math.min(e.state.doc.lineAt(a).to,a+t),r.length&&r[r.length-1].to>=i?r[r.length-1].to=a:r.push({from:i,to:a});return r}function NTt(){if(gU==null&&typeof document<`u`&&document.body){let e=document.body.style;gU=(e.tabSize??e.MozTabSize)!=null}return gU||!1}function PTt(e={}){return[_U.of(e),FTt()]}function FTt(){return jEt||=fH.fromClass(class{constructor(e){this.view=e,this.decorations=NV.none,this.decorationCache=Object.create(null),this.decorator=this.makeDecorator(e.state.facet(_U)),this.decorations=this.decorator.createDeco(e)}makeDecorator(e){return new mU({regexp:e.specialChars,decoration:(t,n,r)=>{let{doc:i}=n.state,a=cz(t[0],0);if(a==9){let e=i.lineAt(r),t=n.state.tabSize,a=Dz(e.text,t,r-e.from);return NV.replace({widget:new PEt((t-a%t)*this.view.defaultCharacterWidth/this.view.scaleX)})}return this.decorationCache[a]||(this.decorationCache[a]=NV.replace({widget:new NEt(e,a)}))},boundary:e.replaceTabs?void 0:/[^]/})}update(e){let t=e.state.facet(_U);e.startState.facet(_U)==t?this.decorations=this.decorator.updateDeco(e,this.decorations):(this.decorator=this.makeDecorator(t),this.decorations=this.decorator.createDeco(e.view))}},{decorations:e=>e.decorations})}function ITt(e){return e>=32?MEt:e==10?`␤`:String.fromCharCode(9216+e)}function LTt(e){return fH.fromClass(class{constructor(t){this.view=t,this.placeholder=e?NV.set([NV.widget({widget:new FEt(e),side:1}).range(0)]):NV.none}get decorations(){return this.view.state.doc.length?NV.none:this.placeholder}},{decorations:e=>e.decorations})}function RTt(e){let{win:t}=e;return{top:0,left:0,bottom:t.innerHeight,right:t.innerWidth}}function zTt(e,t){let n=parseInt(e.style.left,10);(isNaN(n)||Math.abs(t-n)>1)&&(e.style.left=t+`px`)}function BTt(e,t){let{left:n,right:r,top:i,bottom:a}=e.getBoundingClientRect(),o;if(o=e.querySelector(`.cm-tooltip-arrow`)){let e=o.getBoundingClientRect();i=Math.min(e.top,i),a=Math.max(e.bottom,a)}return t.clientX>=n-EU&&t.clientX<=r+EU&&t.clientY>=i-EU&&t.clientY<=a+EU}function VTt(e,t,n,r,i,a){let o=e.scrollDOM.getBoundingClientRect(),s=e.documentTop+e.documentPadding.top+e.contentHeight;if(o.left>r||o.right<r||o.top>i||Math.min(o.bottom,s)<i)return!1;let c=e.posAtCoords({x:r,y:i},!1);return c>=t&&c<=n}function HTt(e,t={}){let n=oB.define(),r=Gz.define({create(){return[]},update(e,r){if(e.length&&(t.hideOnChange&&(r.docChanged||r.selection)?e=[]:t.hideOn&&(e=e.filter(e=>!t.hideOn(r,e))),r.docChanged)){let t=[];for(let n of e){let e=r.changes.mapPos(n.pos,-1,Fz.TrackDel);if(e!=null){let i=Object.assign(Object.create(null),n);i.pos=e,i.end!=null&&(i.end=r.changes.mapPos(i.end)),t.push(i)}}e=t}for(let t of r.effects)t.is(n)&&(e=t.value),t.is(BEt)&&(e=[]);return e},provide:e=>wU.from(e)});return{active:r,extension:[r,fH.define(i=>new zEt(i,e,r,n,t.hoverTime||300)),REt]}}function UTt(e,t){let n=e.plugin(SU);if(!n)return null;let r=n.manager.tooltips.indexOf(t);return r<0?null:n.manager.tooltipViews[r]}function WTt(e){let t=e.nextSibling;return e.remove(),t}function GTt(e){return[KTt(),MU.of(Object.assign(Object.assign({},UEt),e))]}function KTt(e){let t=[WEt];return e&&e.fixed===!1&&t.push(NU.of(!0)),t}function qTt(e){return Array.isArray(e)?e:[e]}function sV(e,t,n){for(;e.value&&e.from<=n;)e.from==n&&t.push(e.value),e.next()}function JTt(e,t){if(e.length!=t.length)return!1;for(let n=0;n<e.length;n++)if(!e[n].compare(t[n]))return!1;return!0}function cV(e,t){return e.state.facet(IU).formatNumber(t,e.state)}function YTt(e={}){return[IU.of(e),KTt(),JEt]}function XTt(e){let t=9;for(;t<e;)t=t*10+9;return t}var ZTt,lV,QTt,uV,dV,fV,pV,mV,hV,gV,_V,vV,yV,bV,xV,SV,CV,wV,TV,$Tt,EV,DV,OV,kV,AV,jV,MV,NV,PV,FV,IV,LV,RV,zV,BV,VV,HV,UV,WV,eEt,tEt,GV,KV,nEt,qV,JV,YV,XV,ZV,QV,$V,eH,tH,nH,rH,iH,aH,rEt,oH,sH,cH,lH,uH,iEt,dH,fH,pH,mH,hH,gH,_H,vH,yH,bH,xH,SH,CH,wH,aEt,TH,oEt,EH,sEt,cEt,DH,lEt,OH,kH,uEt,AH,jH,MH,NH,dEt,PH,FH,IH,LH,RH,zH,BH,VH,fEt,pEt,HH,UH,WH,GH,KH,qH,JH,mEt,hEt,gEt,_Et,YH,vEt,XH,ZH,QH,yEt,$H,eU,tU,nU,rU,iU,bEt,xEt,aU,SEt,CEt,oU,wEt,sU,cU,TEt,EEt,lU,uU,dU,DEt,fU,OEt,pU,mU,hU,kEt,AEt,gU,_U,jEt,MEt,NEt,PEt,FEt,vU,yU,bU,xU,SU,IEt,LEt,CU,wU,TU,REt,zEt,EU,BEt,DU,VEt,OU,kU,AU,jU,HEt,UEt,MU,NU,WEt,GEt,PU,FU,KEt,qEt,IU,LU,JEt,RU=s((()=>{vB(),ICt(),BCt(),ZTt=class{constructor(){this.anchorNode=null,this.anchorOffset=0,this.focusNode=null,this.focusOffset=0}eq(e){return this.anchorNode==e.anchorNode&&this.anchorOffset==e.anchorOffset&&this.focusNode==e.focusNode&&this.focusOffset==e.focusOffset}setRange(e){let{anchorNode:t,focusNode:n}=e;this.set(t,Math.min(e.anchorOffset,t?FB(t):0),n,Math.min(e.focusOffset,n?FB(n):0))}set(e,t,n,r){this.anchorNode=e,this.anchorOffset=t,this.focusNode=n,this.focusOffset=r}},lV=null,uV=class e{constructor(e,t,n=!0){this.node=e,this.offset=t,this.precise=n}static before(t,n){return new e(t.parentNode,NB(t),n)}static after(t,n){return new e(t.parentNode,NB(t)+1,n)}},dV=[],fV=class e{constructor(){this.parent=null,this.dom=null,this.flags=2}get overrideDOMText(){return null}get posAtStart(){return this.parent?this.parent.posBefore(this):0}get posAtEnd(){return this.posAtStart+this.length}posBefore(e){let t=this.posAtStart;for(let n of this.children){if(n==e)return t;t+=n.length+n.breakAfter}throw RangeError(`Invalid child in posBefore`)}posAfter(e){return this.posBefore(e)+e.length}sync(t,n){if(this.flags&2){let r=this.dom,i=null,a;for(let o of this.children){if(o.flags&7){if(!o.dom&&(a=i?i.nextSibling:r.firstChild)){let t=e.get(a);(!t||!t.parent&&t.canReuseDOM(o))&&o.reuseDOM(a)}o.sync(t,n),o.flags&=-8}if(a=i?i.nextSibling:r.firstChild,n&&!n.written&&n.node==r&&a!=o.dom&&(n.written=!0),o.dom.parentNode==r)for(;a&&a!=o.dom;)a=$Ct(a);else r.insertBefore(o.dom,a);i=o.dom}for(a=i?i.nextSibling:r.firstChild,a&&n&&n.node==r&&(n.written=!0);a;)a=$Ct(a)}else if(this.flags&1)for(let e of this.children)e.flags&7&&(e.sync(t,n),e.flags&=-8)}reuseDOM(e){}localPosFromDOM(t,n){let r;if(t==this.dom)r=this.dom.childNodes[n];else{let e=FB(t)==0?0:n==0?-1:1;for(;;){let n=t.parentNode;if(n==this.dom)break;e==0&&n.firstChild!=n.lastChild&&(e=t==n.firstChild?-1:1),t=n}r=e<0?t:t.nextSibling}if(r==this.dom.firstChild)return 0;for(;r&&!e.get(r);)r=r.nextSibling;if(!r)return this.length;for(let e=0,t=0;;e++){let n=this.children[e];if(n.dom==r)return t;t+=n.length+n.breakAfter}}domBoundsAround(e,t,n=0){let r=-1,i=-1,a=-1,o=-1;for(let s=0,c=n,l=n;s<this.children.length;s++){let n=this.children[s],u=c+n.length;if(c<e&&u>t)return n.domBoundsAround(e,t,c);if(u>=e&&r==-1&&(r=s,i=c),c>t&&n.dom.parentNode==this.dom){a=s,o=l;break}l=u,c=u+n.breakAfter}return{from:i,to:o<0?n+this.length:o,startDOM:(r?this.children[r-1].dom.nextSibling:null)||this.dom.firstChild,endDOM:a<this.children.length&&a>=0?this.children[a].dom:null}}markDirty(e=!1){this.flags|=2,this.markParentsDirty(e)}markParentsDirty(e){for(let t=this.parent;t;t=t.parent){if(e&&(t.flags|=2),t.flags&1)return;t.flags|=1,e=!1}}setParent(e){this.parent!=e&&(this.parent=e,this.flags&7&&this.markParentsDirty(!0))}setDOM(e){this.dom!=e&&(this.dom&&(this.dom.cmView=null),this.dom=e,e.cmView=this)}get rootView(){for(let e=this;;){let t=e.parent;if(!t)return e;e=t}}replaceChildren(e,t,n=dV){this.markDirty();for(let r=e;r<t;r++){let e=this.children[r];e.parent==this&&n.indexOf(e)<0&&e.destroy()}n.length<250?this.children.splice(e,t-e,...n):this.children=[].concat(this.children.slice(0,e),n,this.children.slice(t));for(let e=0;e<n.length;e++)n[e].setParent(this)}ignoreMutation(e){return!1}ignoreEvent(e){return!1}childCursor(e=this.length){return new pV(this.children,e,this.children.length)}childPos(e,t=1){return this.childCursor().findPos(e,t)}toString(){let e=this.constructor.name.replace(`View`,``);return e+(this.children.length?`(`+this.children.join()+`)`:this.length?`[`+(e==`Text`?this.text:this.length)+`]`:``)+(this.breakAfter?`#`:``)}static get(e){return e.cmView}get isEditable(){return!0}get isWidget(){return!1}get isHidden(){return!1}merge(e,t,n,r,i,a){return!1}become(e){return!1}canReuseDOM(e){return e.constructor==this.constructor&&!((this.flags|e.flags)&8)}getSide(){return 0}destroy(){for(let e of this.children)e.parent==this&&e.destroy();this.parent=null}},fV.prototype.breakAfter=0,pV=class{constructor(e,t,n){this.children=e,this.pos=t,this.i=n,this.off=0}findPos(e,t=1){for(;;){if(e>this.pos||e==this.pos&&(t>0||this.i==0||this.children[this.i-1].breakAfter))return this.off=e-this.pos,this;let n=this.children[--this.i];this.pos-=n.length+n.breakAfter}}},mV=typeof navigator<`u`?navigator:{userAgent:``,vendor:``,platform:``},hV=typeof document<`u`?document:{documentElement:{style:{}}},gV=/Edge\/(\d+)/.exec(mV.userAgent),_V=/MSIE \d/.test(mV.userAgent),vV=/Trident\/(?:[7-9]|\d{2,})\..*rv:(\d+)/.exec(mV.userAgent),yV=!!(_V||vV||gV),bV=!yV&&/gecko\/(\d+)/i.test(mV.userAgent),xV=!yV&&/Chrome\/(\d+)/.exec(mV.userAgent),SV=`webkitFontSmoothing`in hV.documentElement.style,CV=!yV&&/Apple Computer/.test(mV.vendor),wV=CV&&(/Mobile\/\w+/.test(mV.userAgent)||mV.maxTouchPoints>2),TV={mac:wV||/Mac/.test(mV.platform),windows:/Win/.test(mV.platform),linux:/Linux|X11/.test(mV.platform),ie:yV,ie_version:_V?hV.documentMode||6:vV?+vV[1]:gV?+gV[1]:0,gecko:bV,gecko_version:bV?+(/Firefox\/(\d+)/.exec(mV.userAgent)||[0,0])[1]:0,chrome:!!xV,chrome_version:xV?+xV[1]:0,ios:wV,android:/Android\b/.test(mV.userAgent),webkit:SV,safari:CV,webkit_version:SV?+(/\bAppleWebKit\/(\d+)/.exec(mV.userAgent)||[0,0])[1]:0,tabSize:hV.documentElement.style.tabSize==null?`-moz-tab-size`:`tab-size`},$Tt=256,EV=class e extends fV{constructor(e){super(),this.text=e}get length(){return this.text.length}createDOM(e){this.setDOM(e||document.createTextNode(this.text))}sync(e,t){this.dom||this.createDOM(),this.dom.nodeValue!=this.text&&(t&&t.node==this.dom&&(t.written=!0),this.dom.nodeValue=this.text)}reuseDOM(e){e.nodeType==3&&this.createDOM(e)}merge(t,n,r){return this.flags&8||r&&(!(r instanceof e)||this.length-(n-t)+r.length>$Tt||r.flags&8)?!1:(this.text=this.text.slice(0,t)+(r?r.text:``)+this.text.slice(n),this.markDirty(),!0)}split(t){let n=new e(this.text.slice(t));return this.text=this.text.slice(0,t),this.markDirty(),n.flags|=this.flags&8,n}localPosFromDOM(e,t){return e==this.dom?t:t?this.text.length:0}domAtPos(e){return new uV(this.dom,e)}domBoundsAround(e,t,n){return{from:n,to:n+this.length,startDOM:this.dom,endDOM:this.dom.nextSibling}}coordsAt(e,t){return nwt(this.dom,e,t)}},DV=class e extends fV{constructor(e,t=[],n=0){super(),this.mark=e,this.children=t,this.length=n;for(let e of t)e.setParent(this)}setAttrs(e){if(JCt(e),this.mark.class&&(e.className=this.mark.class),this.mark.attrs)for(let t in this.mark.attrs)e.setAttribute(t,this.mark.attrs[t]);return e}canReuseDOM(e){return super.canReuseDOM(e)&&!((this.flags|e.flags)&8)}reuseDOM(e){e.nodeName==this.mark.tagName.toUpperCase()&&(this.setDOM(e),this.flags|=6)}sync(e,t){this.dom?this.flags&4&&this.setAttrs(this.dom):this.setDOM(this.setAttrs(document.createElement(this.mark.tagName))),super.sync(e,t)}merge(t,n,r,i,a,o){return r&&(!(r instanceof e&&r.mark.eq(this.mark))||t&&a<=0||n<this.length&&o<=0)?!1:(twt(this,t,n,r?r.children.slice():[],a-1,o-1),this.markDirty(),!0)}split(t){let n=[],r=0,i=-1,a=0;for(let e of this.children){let o=r+e.length;o>t&&n.push(r<t?e.split(t-r):e),i<0&&r>=t&&(i=a),r=o,a++}let o=this.length-t;return this.length=t,i>-1&&(this.children.length=i,this.markDirty()),new e(this.mark,n,o)}domAtPos(e){return rwt(this,e)}coordsAt(e,t){return awt(this,e,t)}},OV=class e extends fV{static create(t,n,r){return new e(t,n,r)}constructor(e,t,n){super(),this.widget=e,this.length=t,this.side=n,this.prevWidget=null}split(t){let n=e.create(this.widget,this.length-t,this.side);return this.length-=t,n}sync(e){(!this.dom||!this.widget.updateDOM(this.dom,e))&&(this.dom&&this.prevWidget&&this.prevWidget.destroy(this.dom),this.prevWidget=null,this.setDOM(this.widget.toDOM(e)),this.widget.editable||(this.dom.contentEditable=`false`))}getSide(){return this.side}merge(t,n,r,i,a,o){return r&&(!(r instanceof e)||!this.widget.compare(r.widget)||t>0&&a<=0||n<this.length&&o<=0)?!1:(this.length=t+(r?r.length:0)+(this.length-n),!0)}become(t){return t instanceof e&&t.side==this.side&&this.widget.constructor==t.widget.constructor?(this.widget.compare(t.widget)||this.markDirty(!0),this.dom&&!this.prevWidget&&(this.prevWidget=this.widget),this.widget=t.widget,this.length=t.length,!0):!1}ignoreMutation(){return!0}ignoreEvent(e){return this.widget.ignoreEvent(e)}get overrideDOMText(){if(this.length==0)return Oz.empty;let e=this;for(;e.parent;)e=e.parent;let{view:t}=e,n=t&&t.state.doc,r=this.posAtStart;return n?n.slice(r,r+this.length):Oz.empty}domAtPos(e){return(this.length?e==0:this.side>0)?uV.before(this.dom):uV.after(this.dom,e==this.length)}domBoundsAround(){return null}coordsAt(e,t){let n=this.widget.coordsAt(this.dom,e,t);if(n)return n;let r=this.dom.getClientRects(),i=null;if(!r.length)return null;let a=this.side?this.side<0:e>0;for(let t=a?r.length-1:0;i=r[t],!(e>0?t==0:t==r.length-1||i.top<i.bottom);t+=a?-1:1);return IB(i,!a)}get isEditable(){return!1}get isWidget(){return!0}get isHidden(){return this.widget.isHidden}destroy(){super.destroy(),this.dom&&this.widget.destroy(this.dom)}},kV=class e extends fV{constructor(e){super(),this.side=e}get length(){return 0}merge(){return!1}become(t){return t instanceof e&&t.side==this.side}split(){return new e(this.side)}sync(){if(!this.dom){let e=document.createElement(`img`);e.className=`cm-widgetBuffer`,e.setAttribute(`aria-hidden`,`true`),this.setDOM(e)}}getSide(){return this.side}domAtPos(e){return this.side>0?uV.before(this.dom):uV.after(this.dom)}localPosFromDOM(){return 0}domBoundsAround(){return null}coordsAt(e){return this.dom.getBoundingClientRect()}get overrideDOMText(){return Oz.empty}get isHidden(){return!0}},EV.prototype.children=OV.prototype.children=kV.prototype.children=dV,AV=Object.create(null),jV=class{eq(e){return!1}updateDOM(e,t){return!1}compare(e){return this==e||this.constructor==e.constructor&&this.eq(e)}get estimatedHeight(){return-1}get lineBreaks(){return 0}ignoreEvent(e){return!0}coordsAt(e,t,n){return null}get isHidden(){return!1}get editable(){return!1}destroy(e){}},MV=(function(e){return e[e.Text=0]=`Text`,e[e.WidgetBefore=1]=`WidgetBefore`,e[e.WidgetAfter=2]=`WidgetAfter`,e[e.WidgetRange=3]=`WidgetRange`,e})(MV||={}),NV=class extends dB{constructor(e,t,n,r){super(),this.startSide=e,this.endSide=t,this.widget=n,this.spec=r}get heightRelevant(){return!1}static mark(e){return new PV(e)}static widget(e){let t=Math.max(-1e4,Math.min(1e4,e.side||0)),n=!!e.block;return t+=n&&!e.inlineOrder?t>0?3e8:-4e8:t>0?1e8:-1e8,new IV(e,t,t,n,e.widget||null,!1)}static replace(e){let t=!!e.block,n,r;if(e.isBlockGap)n=-5e8,r=4e8;else{let{start:i,end:a}=cwt(e,t);n=(i?t?-3e8:-1:5e8)-1,r=(a?t?2e8:1:-6e8)+1}return new IV(e,n,r,t,e.widget||null,!0)}static line(e){return new FV(e)}static set(e,t=!1){return pB.of(e,t)}hasHeight(){return this.widget?this.widget.estimatedHeight>-1:!1}},NV.none=pB.empty,PV=class e extends NV{constructor(e){let{start:t,end:n}=cwt(e);super(t?-1:5e8,n?1:-6e8,null,e),this.tagName=e.tagName||`span`,this.class=e.class||``,this.attrs=e.attributes||null}eq(t){return this==t||t instanceof e&&this.tagName==t.tagName&&(this.class||this.attrs?.class)==(t.class||t.attrs?.class)&&BB(this.attrs,t.attrs,`class`)}range(e,t=e){if(e>=t)throw RangeError(`Mark decorations may not be empty`);return super.range(e,t)}},PV.prototype.point=!1,FV=class e extends NV{constructor(e){super(-2e8,-2e8,null,e)}eq(t){return t instanceof e&&this.spec.class==t.spec.class&&BB(this.spec.attributes,t.spec.attributes)}range(e,t=e){if(t!=e)throw RangeError(`Line decoration ranges must be zero-length`);return super.range(e,t)}},FV.prototype.mapMode=Fz.TrackBefore,FV.prototype.point=!0,IV=class e extends NV{constructor(e,t,n,r,i,a){super(t,n,i,e),this.block=r,this.isReplace=a,this.mapMode=r?t<=0?Fz.TrackBefore:Fz.TrackAfter:Fz.TrackDel}get type(){return this.startSide==this.endSide?this.startSide<=0?MV.WidgetBefore:MV.WidgetAfter:MV.WidgetRange}get heightRelevant(){return this.block||!!this.widget&&(this.widget.estimatedHeight>=5||this.widget.lineBreaks>0)}eq(t){return t instanceof e&&lwt(this.widget,t.widget)&&this.block==t.block&&this.startSide==t.startSide&&this.endSide==t.endSide}range(e,t=e){if(this.isReplace&&(e>t||e==t&&this.startSide>0&&this.endSide<=0))throw RangeError(`Invalid range for replacement decoration`);if(!this.isReplace&&t!=e)throw RangeError(`Widget decorations can only have zero-length ranges`);return super.range(e,t)}},IV.prototype.point=!0,LV=class e extends fV{constructor(){super(...arguments),this.children=[],this.length=0,this.prevAttrs=void 0,this.attrs=null,this.breakAfter=0}merge(t,n,r,i,a,o){if(r){if(!(r instanceof e))return!1;this.dom||r.transferDOM(this)}return i&&this.setDeco(r?r.attrs:null),twt(this,t,n,r?r.children.slice():[],a,o),!0}split(t){let n=new e;if(n.breakAfter=this.breakAfter,this.length==0)return n;let{i:r,off:i}=this.childPos(t);i&&(n.append(this.children[r].split(i),0),this.children[r].merge(i,this.children[r].length,null,!1,0,0),r++);for(let e=r;e<this.children.length;e++)n.append(this.children[e],0);for(;r>0&&this.children[r-1].length==0;)this.children[--r].destroy();return this.children.length=r,this.markDirty(),this.length=t,n}transferDOM(e){this.dom&&=(this.markDirty(),e.setDOM(this.dom),e.prevAttrs=this.prevAttrs===void 0?this.attrs:this.prevAttrs,this.prevAttrs=void 0,null)}setDeco(e){BB(this.attrs,e)||(this.dom&&(this.prevAttrs=this.attrs,this.markDirty()),this.attrs=e)}append(e,t){iwt(this,e,t)}addLineDeco(e){let t=e.spec.attributes,n=e.spec.class;t&&(this.attrs=zB(t,this.attrs||{})),n&&(this.attrs=zB({class:n},this.attrs||{}))}domAtPos(e){return rwt(this,e)}reuseDOM(e){e.nodeName==`DIV`&&(this.setDOM(e),this.flags|=6)}sync(e,t){this.dom?this.flags&4&&(JCt(this.dom),this.dom.className=`cm-line`,this.prevAttrs=this.attrs?null:void 0):(this.setDOM(document.createElement(`div`)),this.dom.className=`cm-line`,this.prevAttrs=this.attrs?null:void 0),this.prevAttrs!==void 0&&(VB(this.dom,this.prevAttrs,this.attrs),this.dom.classList.add(`cm-line`),this.prevAttrs=void 0),super.sync(e,t);let n=this.dom.lastChild;for(;n&&fV.get(n)instanceof DV;)n=n.lastChild;if(!n||!this.length||n.nodeName!=`BR`&&fV.get(n)?.isEditable==0&&(!TV.ios||!this.children.some(e=>e instanceof EV))){let e=document.createElement(`BR`);e.cmIgnore=!0,this.dom.appendChild(e)}}measureTextSize(){if(this.children.length==0||this.length>20)return null;let e=0,t;for(let n of this.children){if(!(n instanceof EV)||/[^ -~]/.test(n.text))return null;let r=jB(n.dom);if(r.length!=1)return null;e+=r[0].width,t=r[0].height}return e?{lineHeight:this.dom.getBoundingClientRect().height,charWidth:e/this.length,textHeight:t}:null}coordsAt(e,t){let n=awt(this,e,t);if(!this.children.length&&n&&this.parent){let{heightOracle:e}=this.parent.view.viewState,t=n.bottom-n.top;if(Math.abs(t-e.lineHeight)<2&&e.textHeight<t){let r=(t-e.textHeight)/2;return{top:n.top+r,bottom:n.bottom-r,left:n.left,right:n.left}}}return n}become(t){return t instanceof e&&this.children.length==0&&t.children.length==0&&BB(this.attrs,t.attrs)&&this.breakAfter==t.breakAfter}covers(){return!0}static find(t,n){for(let r=0,i=0;r<t.children.length;r++){let a=t.children[r],o=i+a.length;if(o>=n){if(a instanceof e)return a;if(o>n)break}i=o+a.breakAfter}return null}},RV=class e extends fV{constructor(e,t,n){super(),this.widget=e,this.length=t,this.deco=n,this.breakAfter=0,this.prevWidget=null}merge(t,n,r,i,a,o){return r&&(!(r instanceof e)||!this.widget.compare(r.widget)||t>0&&a<=0||n<this.length&&o<=0)?!1:(this.length=t+(r?r.length:0)+(this.length-n),!0)}domAtPos(e){return e==0?uV.before(this.dom):uV.after(this.dom,e==this.length)}split(t){let n=this.length-t;this.length=t;let r=new e(this.widget,n,this.deco);return r.breakAfter=this.breakAfter,r}get children(){return dV}sync(e){(!this.dom||!this.widget.updateDOM(this.dom,e))&&(this.dom&&this.prevWidget&&this.prevWidget.destroy(this.dom),this.prevWidget=null,this.setDOM(this.widget.toDOM(e)),this.widget.editable||(this.dom.contentEditable=`false`))}get overrideDOMText(){return this.parent?this.parent.view.state.doc.slice(this.posAtStart,this.posAtEnd):Oz.empty}domBoundsAround(){return null}become(t){return t instanceof e&&t.widget.constructor==this.widget.constructor?(t.widget.compare(this.widget)||this.markDirty(!0),this.dom&&!this.prevWidget&&(this.prevWidget=this.widget),this.widget=t.widget,this.length=t.length,this.deco=t.deco,this.breakAfter=t.breakAfter,!0):!1}ignoreMutation(){return!0}ignoreEvent(e){return this.widget.ignoreEvent(e)}get isEditable(){return!1}get isWidget(){return!0}coordsAt(e,t){return this.widget.coordsAt(this.dom,e,t)||(this.widget instanceof zV?null:IB(this.dom.getBoundingClientRect(),this.length?e==0:t<=0))}destroy(){super.destroy(),this.dom&&this.widget.destroy(this.dom)}covers(e){let{startSide:t,endSide:n}=this.deco;return t==n?!1:e<0?t<0:n>0}},zV=class extends jV{constructor(e){super(),this.height=e}toDOM(){let e=document.createElement(`div`);return e.className=`cm-gap`,this.updateDOM(e),e}eq(e){return e.height==this.height}updateDOM(e){return e.style.height=this.height+`px`,!0}get editable(){return!0}get estimatedHeight(){return this.height}ignoreEvent(){return!1}},BV=class e{constructor(e,t,n,r){this.doc=e,this.pos=t,this.end=n,this.disallowBlockEffectsFor=r,this.content=[],this.curLine=null,this.breakAtStart=0,this.pendingBuffer=0,this.bufferMarks=[],this.atCursorPos=!0,this.openStart=-1,this.openEnd=-1,this.text=``,this.textOff=0,this.cursor=e.iter(),this.skip=t}posCovered(){if(this.content.length==0)return!this.breakAtStart&&this.doc.lineAt(this.pos).from!=this.pos;let e=this.content[this.content.length-1];return!(e.breakAfter||e instanceof RV&&e.deco.endSide<0)}getLine(){return this.curLine||(this.content.push(this.curLine=new LV),this.atCursorPos=!0),this.curLine}flushBuffer(e=this.bufferMarks){this.pendingBuffer&&=(this.curLine.append(UB(new kV(-1),e),e.length),0)}addBlockWidget(e){this.flushBuffer(),this.curLine=null,this.content.push(e)}finish(e){this.pendingBuffer&&e<=this.bufferMarks.length?this.flushBuffer():this.pendingBuffer=0,!this.posCovered()&&!(e&&this.content.length&&this.content[this.content.length-1]instanceof RV)&&this.getLine()}buildText(e,t,n){for(;e>0;){if(this.textOff==this.text.length){let{value:t,lineBreak:n,done:r}=this.cursor.next(this.skip);if(this.skip=0,r)throw Error(`Ran out of text content when drawing inline views`);if(n){this.posCovered()||this.getLine(),this.content.length?this.content[this.content.length-1].breakAfter=1:this.breakAtStart=1,this.flushBuffer(),this.curLine=null,this.atCursorPos=!0,e--;continue}else this.text=t,this.textOff=0}let r=Math.min(this.text.length-this.textOff,e,512);this.flushBuffer(t.slice(t.length-n)),this.getLine().append(UB(new EV(this.text.slice(this.textOff,this.textOff+r)),t),n),this.atCursorPos=!0,this.textOff+=r,e-=r,n=0}}span(e,t,n,r){this.buildText(t-e,n,r),this.pos=t,this.openStart<0&&(this.openStart=r)}point(e,t,n,r,i,a){if(this.disallowBlockEffectsFor[a]&&n instanceof IV){if(n.block)throw RangeError(`Block decorations may not be specified via plugins`);if(t>this.doc.lineAt(this.pos).to)throw RangeError(`Decorations that replace line breaks may not be specified via plugins`)}let o=t-e;if(n instanceof IV)if(n.block)n.startSide>0&&!this.posCovered()&&this.getLine(),this.addBlockWidget(new RV(n.widget||VV.block,o,n));else{let a=OV.create(n.widget||VV.inline,o,o?0:n.startSide),s=this.atCursorPos&&!a.isEditable&&i<=r.length&&(e<t||n.startSide>0),c=!a.isEditable&&(e<t||i>r.length||n.startSide<=0),l=this.getLine();this.pendingBuffer==2&&!s&&!a.isEditable&&(this.pendingBuffer=0),this.flushBuffer(r),s&&(l.append(UB(new kV(1),r),i),i=r.length+Math.max(0,i-r.length)),l.append(UB(a,r),i),this.atCursorPos=c,this.pendingBuffer=c?e<t||i>r.length?1:2:0,this.pendingBuffer&&(this.bufferMarks=r.slice())}else this.doc.lineAt(this.pos).from==this.pos&&this.getLine().addLineDeco(n);o&&(this.textOff+o<=this.text.length?this.textOff+=o:(this.skip+=o-(this.text.length-this.textOff),this.text=``,this.textOff=0),this.pos=t),this.openStart<0&&(this.openStart=i)}static build(t,n,r,i,a){let o=new e(t,n,r,a);return o.openEnd=pB.spans(i,n,r,o),o.openStart<0&&(o.openStart=o.openEnd),o.finish(o.openEnd),o}},VV=class extends jV{constructor(e){super(),this.tag=e}eq(e){return e.tag==this.tag}toDOM(){return document.createElement(this.tag)}updateDOM(e){return e.nodeName.toLowerCase()==this.tag}get isHidden(){return!0}},VV.inline=new VV(`span`),VV.block=new VV(`div`),HV=(function(e){return e[e.LTR=0]=`LTR`,e[e.RTL=1]=`RTL`,e})(HV||={}),UV=HV.LTR,WV=HV.RTL,eEt=uwt(`88888888888888888888888888888888888666888888787833333333337888888000000000000000000000000008888880000000000000000000000000088888888888888888888888888888888888887866668888088888663380888308888800000000000000000000000800000000000000000000000000000008`),tEt=uwt(`4444448826627288999999999992222222222222222222222222222222222222222222222229999999999999999999994444444444644222822222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222999999949999999229989999223333333333`),GV=Object.create(null),KV=[];for(let e of[`()`,`[]`,`{}`]){let t=e.charCodeAt(0),n=e.charCodeAt(1);GV[t]=n,GV[n]=-t}nEt=/[\u0590-\u05f4\u0600-\u06ff\u0700-\u08ac\ufb50-\ufdff]/,qV=class{get dir(){return this.level%2?WV:UV}constructor(e,t,n){this.from=e,this.to=t,this.level=n}side(e,t){return this.dir==t==e?this.to:this.from}forward(e,t){return e==(this.dir==t)}static find(e,t,n,r){let i=-1;for(let a=0;a<e.length;a++){let o=e[a];if(o.from<=t&&o.to>=t){if(o.level==n)return a;(i<0||(r==0?e[i].level>o.level:r<0?o.from<t:o.to>t))&&(i=a)}}if(i<0)throw RangeError(`Index out of range`);return i}},JV=[],YV=``,XV=Hz.define(),ZV=Hz.define(),QV=Hz.define(),$V=Hz.define(),eH=Hz.define(),tH=Hz.define(),nH=Hz.define(),rH=Hz.define(),iH=Hz.define(),aH=Hz.define({combine:e=>e.some(e=>e)}),rEt=Hz.define({combine:e=>e.some(e=>e)}),oH=Hz.define(),sH=class e{constructor(e,t=`nearest`,n=`nearest`,r=5,i=5,a=!1){this.range=e,this.y=t,this.x=n,this.yMargin=r,this.xMargin=i,this.isSnapshot=a}map(t){return t.empty?this:new e(this.range.map(t),this.y,this.x,this.yMargin,this.xMargin,this.isSnapshot)}clip(t){return this.range.to<=t.doc.length?this:new e(Bz.cursor(t.doc.length),this.y,this.x,this.yMargin,this.xMargin,this.isSnapshot)}},cH=oB.define({map:(e,t)=>e.map(t)}),lH=oB.define(),uH=Hz.define({combine:e=>e.length?e[0]:!0}),iEt=0,dH=Hz.define(),fH=class e{constructor(e,t,n,r,i){this.id=e,this.create=t,this.domEventHandlers=n,this.domEventObservers=r,this.extension=i(this)}static define(t,n){let{eventHandlers:r,eventObservers:i,provide:a,decorations:o}=n||{};return new e(iEt++,t,r,i,e=>{let t=[dH.of(e)];return o&&t.push(gH.of(t=>{let n=t.plugin(e);return n?o(n):NV.none})),a&&t.push(a(e)),t})}static fromClass(t,n){return e.define(e=>new t(e),n)}},pH=class{constructor(e){this.spec=e,this.mustUpdate=null,this.value=null}update(e){if(!this.value){if(this.spec)try{this.value=this.spec.create(e)}catch(t){KB(e.state,t,`CodeMirror plugin crashed`),this.deactivate()}}else if(this.mustUpdate){let e=this.mustUpdate;if(this.mustUpdate=null,this.value.update)try{this.value.update(e)}catch(t){if(KB(e.state,t,`CodeMirror plugin crashed`),this.value.destroy)try{this.value.destroy()}catch{}this.deactivate()}}return this}destroy(e){if(this.value?.destroy)try{this.value.destroy()}catch(t){KB(e.state,t,`CodeMirror plugin crashed`)}}deactivate(){this.spec=this.value=null}},mH=Hz.define(),hH=Hz.define(),gH=Hz.define(),_H=Hz.define(),vH=Hz.define(),yH=Hz.define(),bH=Hz.define(),xH=Hz.define(),SH=class e{constructor(e,t,n,r){this.fromA=e,this.toA=t,this.fromB=n,this.toB=r}join(t){return new e(Math.min(this.fromA,t.fromA),Math.max(this.toA,t.toA),Math.min(this.fromB,t.fromB),Math.max(this.toB,t.toB))}addToSet(e){let t=e.length,n=this;for(;t>0;t--){let r=e[t-1];if(!(r.fromA>n.toA)){if(r.toA<n.fromA)break;n=n.join(r),e.splice(t-1,1)}}return e.splice(t,0,n),e}static extendWithRanges(t,n){if(n.length==0)return t;let r=[];for(let i=0,a=0,o=0,s=0;;i++){let c=i==t.length?null:t[i],l=o-s,u=c?c.fromB:1e9;for(;a<n.length&&n[a]<u;){let t=n[a],i=n[a+1],o=Math.max(s,t),c=Math.min(u,i);if(o<=c&&new e(o+l,c+l,o,c).addToSet(r),i>u)break;a+=2}if(!c)return r;new e(c.fromA,c.toA,c.fromB,c.toB).addToSet(r),o=c.toA,s=c.toB}}},CH=class e{constructor(e,t,n){this.view=e,this.state=t,this.transactions=n,this.flags=0,this.startState=e.state,this.changes=Lz.empty(this.startState.doc.length);for(let e of n)this.changes=this.changes.compose(e.changes);let r=[];this.changes.iterChangedRanges((e,t,n,i)=>r.push(new SH(e,t,n,i))),this.changedRanges=r}static create(t,n,r){return new e(t,n,r)}get viewportChanged(){return(this.flags&4)>0}get heightChanged(){return(this.flags&2)>0}get geometryChanged(){return this.docChanged||(this.flags&10)>0}get focusChanged(){return(this.flags&1)>0}get docChanged(){return!this.changes.empty}get selectionSet(){return this.transactions.some(e=>e.selection)}get empty(){return this.flags==0&&this.transactions.length==0}},wH=class extends fV{get length(){return this.view.state.doc.length}constructor(e){super(),this.view=e,this.decorations=[],this.dynamicDecorationMap=[!1],this.domChanged=null,this.hasComposition=null,this.markedForComposition=new Set,this.editContextFormatting=NV.none,this.lastCompositionAfterCursor=!1,this.minWidth=0,this.minWidthFrom=0,this.minWidthTo=0,this.impreciseAnchor=null,this.impreciseHead=null,this.forceSelection=!1,this.lastUpdate=Date.now(),this.setDOM(e.contentDOM),this.children=[new LV],this.children[0].setParent(this),this.updateDeco(),this.updateInner([new SH(0,0,0,e.state.doc.length)],0,null)}update(e){let t=e.changedRanges;this.minWidth>0&&t.length&&(t.every(({fromA:e,toA:t})=>t<this.minWidthFrom||e>this.minWidthTo)?(this.minWidthFrom=e.changes.mapPos(this.minWidthFrom,1),this.minWidthTo=e.changes.mapPos(this.minWidthTo,1)):this.minWidth=this.minWidthFrom=this.minWidthTo=0),this.updateEditContextFormatting(e);let n=-1;this.view.inputState.composing>=0&&!this.view.observer.editContext&&(this.domChanged?.newSel?n=this.domChanged.newSel.head:!Dwt(e.changes,this.hasComposition)&&!e.selectionSet&&(n=e.state.selection.main.head));let r=n>-1?Cwt(this.view,e.changes,n):null;if(this.domChanged=null,this.hasComposition){this.markedForComposition.clear();let{from:n,to:r}=this.hasComposition;t=new SH(n,r,e.changes.mapPos(n,-1),e.changes.mapPos(r,1)).addToSet(t.slice())}this.hasComposition=r?{from:r.range.fromB,to:r.range.toB}:null,(TV.ie||TV.chrome)&&!r&&e&&e.state.doc.lines!=e.startState.doc.lines&&(this.forceSelection=!0);let i=this.decorations,a=Twt(i,this.updateDeco(),e.changes);return t=SH.extendWithRanges(t,a),!(this.flags&7)&&t.length==0?!1:(this.updateInner(t,e.startState.doc.length,r),e.transactions.length&&(this.lastUpdate=Date.now()),!0)}updateInner(e,t,n){this.view.viewState.mustMeasureContent=!0,this.updateChildren(e,t,n);let{observer:r}=this.view;r.ignore(()=>{this.dom.style.height=this.view.viewState.contentHeight/this.view.scaleY+`px`,this.dom.style.flexBasis=this.minWidth?this.minWidth+`px`:``;let e=TV.chrome||TV.ios?{node:r.selectionRange.focusNode,written:!1}:void 0;this.sync(this.view,e),this.flags&=-8,e&&(e.written||r.selectionRange.focusNode!=e.node)&&(this.forceSelection=!0),this.dom.style.height=``}),this.markedForComposition.forEach(e=>e.flags&=-9);let i=[];if(this.view.viewport.from||this.view.viewport.to<this.view.state.doc.length)for(let e of this.children)e instanceof RV&&e.widget instanceof zV&&i.push(e.dom);r.updateGaps(i)}updateChildren(e,t,n){let r=n?n.range.addToSet(e.slice()):e,i=this.childCursor(t);for(let e=r.length-1;;e--){let t=e>=0?r[e]:null;if(!t)break;let{fromA:a,toA:o,fromB:s,toB:c}=t,l,u,d,f;if(n&&n.range.fromB<c&&n.range.toB>s){let e=BV.build(this.view.state.doc,s,n.range.fromB,this.decorations,this.dynamicDecorationMap),t=BV.build(this.view.state.doc,n.range.toB,c,this.decorations,this.dynamicDecorationMap);u=e.breakAtStart,d=e.openStart,f=t.openEnd;let r=this.compositionView(n);t.breakAtStart?r.breakAfter=1:t.content.length&&r.merge(r.length,r.length,t.content[0],!1,t.openStart,0)&&(r.breakAfter=t.content[0].breakAfter,t.content.shift()),e.content.length&&r.merge(0,0,e.content[e.content.length-1],!0,0,e.openEnd)&&e.content.pop(),l=e.content.concat(r).concat(t.content)}else ({content:l,breakAtStart:u,openStart:d,openEnd:f}=BV.build(this.view.state.doc,s,c,this.decorations,this.dynamicDecorationMap));let{i:p,off:m}=i.findPos(o,1),{i:h,off:g}=i.findPos(a,-1);ewt(this,h,g,p,m,l,u,d,f)}n&&this.fixCompositionDOM(n)}updateEditContextFormatting(e){this.editContextFormatting=this.editContextFormatting.map(e.changes);for(let t of e.transactions)for(let e of t.effects)e.is(lH)&&(this.editContextFormatting=e.value)}compositionView(e){let t=new EV(e.text.nodeValue);t.flags|=8;for(let{deco:n}of e.marks)t=new DV(n,[t],t.length);let n=new LV;return n.append(t,0),n}fixCompositionDOM(e){let t=(e,t)=>{t.flags|=8|(t.children.some(e=>e.flags&7)?1:0),this.markedForComposition.add(t);let n=fV.get(e);n&&n!=t&&(n.dom=null),t.setDOM(e)},n=this.childPos(e.range.fromB,1),r=this.children[n.i];t(e.line,r);for(let i=e.marks.length-1;i>=-1;i--)n=r.childPos(n.off,1),r=r.children[n.i],t(i>=0?e.marks[i].node:e.text,r)}updateSelection(e=!1,t=!1){(e||!this.view.observer.selectionRange.focusNode)&&this.view.observer.readSelectionRange();let n=this.view.root.activeElement,r=n==this.dom,i=!r&&!(this.view.state.facet(uH)||this.dom.tabIndex>-1)&&AB(this.dom,this.view.observer.selectionRange)&&!(n&&this.dom.contains(n));if(!(r||t||i))return;let a=this.forceSelection;this.forceSelection=!1;let o=this.view.state.selection.main,s=this.moveToLine(this.domAtPos(o.anchor)),c=o.empty?s:this.moveToLine(this.domAtPos(o.head));if(TV.gecko&&o.empty&&!this.hasComposition&&xwt(s)){let e=document.createTextNode(``);this.view.observer.ignore(()=>s.node.insertBefore(e,s.node.childNodes[s.offset]||null)),s=c=new uV(e,0),a=!0}let l=this.view.observer.selectionRange;(a||!l.focusNode||(!MB(s.node,s.offset,l.anchorNode,l.anchorOffset)||!MB(c.node,c.offset,l.focusNode,l.focusOffset))&&!this.suppressWidgetCursorChange(l,o))&&(this.view.observer.ignore(()=>{TV.android&&TV.chrome&&this.dom.contains(l.focusNode)&&Ewt(l.focusNode,this.dom)&&(this.dom.blur(),this.dom.focus({preventScroll:!0}));let e=OB(this.view.root);if(e)if(o.empty){if(TV.gecko){let e=wwt(s.node,s.offset);if(e&&e!=3){let t=(e==1?ZCt:QCt)(s.node,s.offset);t&&(s=new uV(t.node,t.offset))}}e.collapse(s.node,s.offset),o.bidiLevel!=null&&e.caretBidiLevel!==void 0&&(e.caretBidiLevel=o.bidiLevel)}else if(e.extend){e.collapse(s.node,s.offset);try{e.extend(c.node,c.offset)}catch{}}else{let t=document.createRange();o.anchor>o.head&&([s,c]=[c,s]),t.setEnd(c.node,c.offset),t.setStart(s.node,s.offset),e.removeAllRanges(),e.addRange(t)}i&&this.view.root.activeElement==this.dom&&(this.dom.blur(),n&&n.focus())}),this.view.observer.setSelectionRange(s,c)),this.impreciseAnchor=s.precise?null:new uV(l.anchorNode,l.anchorOffset),this.impreciseHead=c.precise?null:new uV(l.focusNode,l.focusOffset)}suppressWidgetCursorChange(e,t){return this.hasComposition&&t.empty&&MB(e.focusNode,e.focusOffset,e.anchorNode,e.anchorOffset)&&this.posFromDOM(e.focusNode,e.focusOffset)==t.head}enforceCursorAssoc(){if(this.hasComposition)return;let{view:e}=this,t=e.state.selection.main,n=OB(e.root),{anchorNode:r,anchorOffset:i}=e.observer.selectionRange;if(!n||!t.empty||!t.assoc||!n.modify)return;let a=LV.find(this,t.head);if(!a)return;let o=a.posAtStart;if(t.head==o||t.head==o+a.length)return;let s=this.coordsAt(t.head,-1),c=this.coordsAt(t.head,1);if(!s||!c||s.bottom>c.top)return;let l=this.domAtPos(t.head+t.assoc);n.collapse(l.node,l.offset),n.modify(`move`,t.assoc<0?`forward`:`backward`,`lineboundary`),e.observer.readSelectionRange();let u=e.observer.selectionRange;e.docView.posFromDOM(u.anchorNode,u.anchorOffset)!=t.from&&n.collapse(r,i)}moveToLine(e){let t=this.dom,n;if(e.node!=t)return e;for(let r=e.offset;!n&&r<t.childNodes.length;r++){let e=fV.get(t.childNodes[r]);e instanceof LV&&(n=e.domAtPos(0))}for(let r=e.offset-1;!n&&r>=0;r--){let e=fV.get(t.childNodes[r]);e instanceof LV&&(n=e.domAtPos(e.length))}return n?new uV(n.node,n.offset,!0):e}nearest(e){for(let t=e;t;){let e=fV.get(t);if(e&&e.rootView==this)return e;t=t.parentNode}return null}posFromDOM(e,t){let n=this.nearest(e);if(!n)throw RangeError(`Trying to find position for a DOM position outside of the document`);return n.localPosFromDOM(e,t)+n.posAtStart}domAtPos(e){let{i:t,off:n}=this.childCursor().findPos(e,-1);for(;t<this.children.length-1;){let e=this.children[t];if(n<e.length||e instanceof LV)break;t++,n=0}return this.children[t].domAtPos(n)}coordsAt(e,t){let n=null,r=0;for(let i=this.length,a=this.children.length-1;a>=0;a--){let o=this.children[a],s=i-o.breakAfter,c=s-o.length;if(s<e)break;if(c<=e&&(c<e||o.covers(-1))&&(s>e||o.covers(1))&&(!n||o instanceof LV&&!(n instanceof LV&&t>=0)))n=o,r=c;else if(n&&c==e&&s==e&&o instanceof RV&&Math.abs(t)<2){if(o.deco.startSide<0)break;a&&(n=null)}i=c}return n?n.coordsAt(e-r,t):null}coordsForChar(e){let{i:t,off:n}=this.childPos(e,1),r=this.children[t];if(!(r instanceof LV))return null;for(;r.children.length;){let{i:e,off:t}=r.childPos(n,1);for(;;e++){if(e==r.children.length)return null;if((r=r.children[e]).length)break}n=t}if(!(r instanceof EV))return null;let i=sz(r.text,n);if(i==n)return null;let a=LB(r.dom,n,i).getClientRects();for(let e=0;e<a.length;e++){let t=a[e];if(e==a.length-1||t.top<t.bottom&&t.left<t.right)return t}return null}measureVisibleLineHeights(e){let t=[],{from:n,to:r}=e,i=this.view.contentDOM.clientWidth,a=i>Math.max(this.view.scrollDOM.clientWidth,this.minWidth)+1,o=-1,s=this.view.textDirection==HV.LTR;for(let e=0,c=0;c<this.children.length;c++){let l=this.children[c],u=e+l.length;if(u>r)break;if(e>=n){let n=l.dom.getBoundingClientRect();if(t.push(n.height),a){let t=l.dom.lastChild,r=t?jB(t):[];if(r.length){let t=r[r.length-1],a=s?t.right-n.left:n.right-t.left;a>o&&(o=a,this.minWidth=i,this.minWidthFrom=e,this.minWidthTo=u)}}}e=u+l.breakAfter}return t}textDirectionAt(e){let{i:t}=this.childPos(e,1);return getComputedStyle(this.children[t].dom).direction==`rtl`?HV.RTL:HV.LTR}measureTextSize(){for(let e of this.children)if(e instanceof LV){let t=e.measureTextSize();if(t)return t}let e=document.createElement(`div`),t,n,r;return e.className=`cm-line`,e.style.width=`99999px`,e.style.position=`absolute`,e.textContent=`abc def ghi jkl mno pqr stu`,this.view.observer.ignore(()=>{this.dom.appendChild(e);let i=jB(e.firstChild)[0];t=e.getBoundingClientRect().height,n=i?i.width/27:7,r=i?i.height:t,e.remove()}),{lineHeight:t,charWidth:n,textHeight:r}}childCursor(e=this.length){let t=this.children.length;return t&&(e-=this.children[--t].length),new pV(this.children,e,t)}computeBlockGapDeco(){let e=[],t=this.view.viewState;for(let n=0,r=0;;r++){let i=r==t.viewports.length?null:t.viewports[r],a=i?i.from-1:this.length;if(a>n){let r=(t.lineBlockAt(a).bottom-t.lineBlockAt(n).top)/this.view.scaleY;e.push(NV.replace({widget:new zV(r),block:!0,inclusive:!0,isBlockGap:!0}).range(n,a))}if(!i)break;n=i.to+1}return NV.set(e)}updateDeco(){let e=1,t=this.view.state.facet(gH).map(t=>(this.dynamicDecorationMap[e++]=typeof t==`function`)?t(this.view):t),n=!1,r=this.view.state.facet(_H).map((e,t)=>{let r=typeof e==`function`;return r&&(n=!0),r?e(this.view):e});for(r.length&&(this.dynamicDecorationMap[e++]=n,t.push(pB.join(r))),this.decorations=[this.editContextFormatting,...t,this.computeBlockGapDeco(),this.view.viewState.lineGapDeco];e<this.decorations.length;)this.dynamicDecorationMap[e++]=!1;return this.decorations}scrollIntoView(e){if(e.isSnapshot){let t=this.view.viewState.lineBlockAt(e.range.head);this.view.scrollDOM.scrollTop=t.top-e.yMargin,this.view.scrollDOM.scrollLeft=e.xMargin;return}for(let t of this.view.state.facet(oH))try{if(t(this.view,e.range,e))return!0}catch(e){KB(this.view.state,e,`scroll handler`)}let{range:t}=e,n=this.coordsAt(t.head,t.empty?t.assoc:t.head>t.anchor?-1:1),r;if(!n)return;!t.empty&&(r=this.coordsAt(t.anchor,t.anchor>t.head?-1:1))&&(n={left:Math.min(n.left,r.left),top:Math.min(n.top,r.top),right:Math.max(n.right,r.right),bottom:Math.max(n.bottom,r.bottom)});let i=qB(this.view),a={left:n.left-i.left,top:n.top-i.top,right:n.right+i.right,bottom:n.bottom+i.bottom},{offsetWidth:o,offsetHeight:s}=this.view.scrollDOM;WCt(this.view.scrollDOM,a,t.head<t.anchor?-1:1,e.x,e.y,Math.max(Math.min(e.xMargin,o),-o),Math.max(Math.min(e.yMargin,s),-s),this.view.textDirection==HV.LTR)}},aEt=class{constructor(){this.changes=[]}compareRange(e,t){HB(e,t,this.changes)}comparePoint(e,t){HB(e,t,this.changes)}boundChange(e){HB(e,e,this.changes)}},TH=`￿`,oEt=class{constructor(e,t){this.points=e,this.text=``,this.lineSeparator=t.facet(uB.lineSeparator)}append(e){this.text+=e}lineBreak(){this.text+=TH}readRange(e,t){if(!e)return this;let n=e.parentNode;for(let r=e;;){this.findPointBefore(n,r);let e=this.text.length;this.readNode(r);let i=r.nextSibling;if(i==t)break;let a=fV.get(r),o=fV.get(i);(a&&o?a.breakAfter:(a?a.breakAfter:PB(r))||PB(i)&&(r.nodeName!=`BR`||r.cmIgnore)&&this.text.length>e)&&this.lineBreak(),r=i}return this.findPointBefore(n,t),this}readTextNode(e){let t=e.nodeValue;for(let n of this.points)n.node==e&&(n.pos=this.text.length+Math.min(n.offset,t.length));for(let n=0,r=this.lineSeparator?null:/\r\n?|\n/g;;){let i=-1,a=1,o;if(this.lineSeparator?(i=t.indexOf(this.lineSeparator,n),a=this.lineSeparator.length):(o=r.exec(t))&&(i=o.index,a=o[0].length),this.append(t.slice(n,i<0?t.length:i)),i<0)break;if(this.lineBreak(),a>1)for(let t of this.points)t.node==e&&t.pos>this.text.length&&(t.pos-=a-1);n=i+a}}readNode(e){if(e.cmIgnore)return;let t=fV.get(e),n=t&&t.overrideDOMText;if(n!=null){this.findPointInside(e,n.length);for(let e=n.iter();!e.next().done;)e.lineBreak?this.lineBreak():this.append(e.value)}else e.nodeType==3?this.readTextNode(e):e.nodeName==`BR`?e.nextSibling&&this.lineBreak():e.nodeType==1&&this.readRange(e.firstChild,null)}findPointBefore(e,t){for(let n of this.points)n.node==e&&e.childNodes[n.offset]==t&&(n.pos=this.text.length)}findPointInside(e,t){for(let n of this.points)(e.nodeType==3?n.node==e:e.contains(n.node))&&(n.pos=this.text.length+(Uwt(e,n.node,n.offset)?t:0))}},EH=class{constructor(e,t){this.node=e,this.offset=t,this.pos=-1}},sEt=class{constructor(e,t,n,r){this.typeOver=r,this.bounds=null,this.text=``,this.domChanged=t>-1;let{impreciseHead:i,impreciseAnchor:a}=e.docView;if(e.state.readOnly&&t>-1)this.newSel=null;else if(t>-1&&(this.bounds=e.docView.domBoundsAround(t,n,0))){let t=i||a?[]:qwt(e),n=new oEt(t,e.state);n.readRange(this.bounds.startDOM,this.bounds.endDOM),this.text=n.text,this.newSel=Jwt(t,this.bounds.from)}else{let t=e.observer.selectionRange,n=i&&i.node==t.focusNode&&i.offset==t.focusOffset||!kB(e.contentDOM,t.focusNode)?e.state.selection.main.head:e.docView.posFromDOM(t.focusNode,t.focusOffset),r=a&&a.node==t.anchorNode&&a.offset==t.anchorOffset||!kB(e.contentDOM,t.anchorNode)?e.state.selection.main.anchor:e.docView.posFromDOM(t.anchorNode,t.anchorOffset),o=e.viewport;if((TV.ios||TV.chrome)&&e.state.selection.main.empty&&n!=r&&(o.from>0||o.to<e.state.doc.length)){let t=Math.min(n,r),i=Math.max(n,r),a=o.from-t,s=o.to-i;(a==0||a==1||t==0)&&(s==0||s==-1||i==e.state.doc.length)&&(n=0,r=e.state.doc.length)}this.newSel=Bz.single(r,n)}}},cEt=class{setSelectionOrigin(e){this.lastSelectionOrigin=e,this.lastSelectionTime=Date.now()}constructor(e){this.view=e,this.lastKeyCode=0,this.lastKeyTime=0,this.lastTouchTime=0,this.lastFocusTime=0,this.lastScrollTop=0,this.lastScrollLeft=0,this.pendingIOSKey=void 0,this.tabFocusMode=-1,this.lastSelectionOrigin=null,this.lastSelectionTime=0,this.lastContextMenu=0,this.scrollHandlers=[],this.handlers=Object.create(null),this.composing=-1,this.compositionFirstChange=null,this.compositionEndedAt=0,this.compositionPendingKey=!1,this.compositionPendingChange=!1,this.mouseSelection=null,this.draggedContent=null,this.handleEvent=this.handleEvent.bind(this),this.notifiedFocused=e.hasFocus,TV.safari&&e.contentDOM.addEventListener(`input`,()=>null),TV.gecko&&hTt(e.contentDOM.ownerDocument)}handleEvent(e){!tTt(this.view,e)||this.ignoreDuringComposition(e)||e.type==`keydown`&&this.keydown(e)||this.runHandlers(e.type,e)}runHandlers(e,t){let n=this.handlers[e];if(n){for(let e of n.observers)e(this.view,t);for(let e of n.handlers){if(t.defaultPrevented)break;if(e(this.view,t)){t.preventDefault();break}}}}ensureHandlers(e){let t=Xwt(e),n=this.handlers,r=this.view.contentDOM;for(let e in t)if(e!=`scroll`){let i=!t[e].handlers.length,a=n[e];a&&i!=!a.handlers.length&&(r.removeEventListener(e,this.handleEvent),a=null),a||r.addEventListener(e,this.handleEvent,{passive:i})}for(let e in n)e!=`scroll`&&!t[e]&&r.removeEventListener(e,this.handleEvent);this.handlers=t}keydown(e){if(this.lastKeyCode=e.keyCode,this.lastKeyTime=Date.now(),e.keyCode==9&&this.tabFocusMode>-1&&(!this.tabFocusMode||Date.now()<=this.tabFocusMode))return!0;if(this.tabFocusMode>0&&e.keyCode!=27&&OH.indexOf(e.keyCode)<0&&(this.tabFocusMode=-1),TV.android&&TV.chrome&&!e.synthetic&&(e.keyCode==13||e.keyCode==8))return this.view.observer.delayAndroidKey(e.key,e.keyCode),!0;let t;return TV.ios&&!e.synthetic&&!e.altKey&&!e.metaKey&&((t=DH.find(t=>t.keyCode==e.keyCode))&&!e.ctrlKey||lEt.indexOf(e.key)>-1&&e.ctrlKey&&!e.shiftKey)?(this.pendingIOSKey=t||e,setTimeout(()=>this.flushIOSKey(),250),!0):(e.keyCode!=229&&this.view.observer.forceFlush(),!1)}flushIOSKey(e){let t=this.pendingIOSKey;return!t||t.key==`Enter`&&e&&e.from<e.to&&/^\S+$/.test(e.insert.toString())?!1:(this.pendingIOSKey=void 0,RB(this.view.contentDOM,t.key,t.keyCode,t instanceof KeyboardEvent?t:void 0))}ignoreDuringComposition(e){return/^key/.test(e.type)?this.composing>0?!0:TV.safari&&!TV.ios&&this.compositionPendingKey&&Date.now()-this.compositionEndedAt<100?(this.compositionPendingKey=!1,!0):!1:!1}startMouseSelection(e){this.mouseSelection&&this.mouseSelection.destroy(),this.mouseSelection=e}update(e){this.view.observer.update(e),this.mouseSelection&&this.mouseSelection.update(e),this.draggedContent&&e.docChanged&&(this.draggedContent=this.draggedContent.map(e.changes)),e.transactions.length&&(this.lastKeyCode=this.lastSelectionTime=0)}destroy(){this.mouseSelection&&this.mouseSelection.destroy()}},DH=[{key:`Backspace`,keyCode:8,inputType:`deleteContentBackward`},{key:`Enter`,keyCode:13,inputType:`insertParagraph`},{key:`Enter`,keyCode:13,inputType:`insertLineBreak`},{key:`Delete`,keyCode:46,inputType:`deleteContentForward`}],lEt=`dthko`,OH=[16,17,18,20,91,92,224,225],kH=6,uEt=class{constructor(e,t,n,r){this.view=e,this.startEvent=t,this.style=n,this.mustSelect=r,this.scrollSpeed={x:0,y:0},this.scrolling=-1,this.lastEvent=t,this.scrollParents=GCt(e.contentDOM),this.atoms=e.state.facet(vH).map(t=>t(e));let i=e.contentDOM.ownerDocument;i.addEventListener(`mousemove`,this.move=this.move.bind(this)),i.addEventListener(`mouseup`,this.up=this.up.bind(this)),this.extend=t.shiftKey,this.multiple=e.state.facet(uB.allowMultipleSelections)&&Qwt(e,t),this.dragging=eTt(e,t)&&sTt(t)==1?null:!1}start(e){this.dragging===!1&&this.select(e)}move(e){if(e.buttons==0)return this.destroy();if(this.dragging||this.dragging==null&&Zwt(this.startEvent,e)<10)return;this.select(this.lastEvent=e);let t=0,n=0,r=0,i=0,a=this.view.win.innerWidth,o=this.view.win.innerHeight;this.scrollParents.x&&({left:r,right:a}=this.scrollParents.x.getBoundingClientRect()),this.scrollParents.y&&({top:i,bottom:o}=this.scrollParents.y.getBoundingClientRect());let s=qB(this.view);e.clientX-s.left<=r+kH?t=-$B(r-e.clientX):e.clientX+s.right>=a-kH&&(t=$B(e.clientX-a)),e.clientY-s.top<=i+kH?n=-$B(i-e.clientY):e.clientY+s.bottom>=o-kH&&(n=$B(e.clientY-o)),this.setScrollSpeed(t,n)}up(e){this.dragging??this.select(this.lastEvent),this.dragging||e.preventDefault(),this.destroy()}destroy(){this.setScrollSpeed(0,0);let e=this.view.contentDOM.ownerDocument;e.removeEventListener(`mousemove`,this.move),e.removeEventListener(`mouseup`,this.up),this.view.inputState.mouseSelection=this.view.inputState.draggedContent=null}setScrollSpeed(e,t){this.scrollSpeed={x:e,y:t},e||t?this.scrolling<0&&(this.scrolling=setInterval(()=>this.scroll(),50)):this.scrolling>-1&&(clearInterval(this.scrolling),this.scrolling=-1)}scroll(){let{x:e,y:t}=this.scrollSpeed;e&&this.scrollParents.x&&(this.scrollParents.x.scrollLeft+=e,e=0),t&&this.scrollParents.y&&(this.scrollParents.y.scrollTop+=t,t=0),(e||t)&&this.view.win.scrollBy(e,t),this.dragging===!1&&this.select(this.lastEvent)}skipAtoms(e){let t=null;for(let n=0;n<e.ranges.length;n++){let r=e.ranges[n],i=null;if(r.empty){let e=XB(this.atoms,r.from,0);e!=r.from&&(i=Bz.cursor(e,-1))}else{let e=XB(this.atoms,r.from,-1),t=XB(this.atoms,r.to,1);(e!=r.from||t!=r.to)&&(i=Bz.range(r.from==r.anchor?e:t,r.from==r.head?e:t))}i&&(t||=e.ranges.slice(),t[n]=i)}return t?Bz.create(t,e.mainIndex):e}select(e){let{view:t}=this,n=this.skipAtoms(this.style.get(e,this.extend,this.multiple));(this.mustSelect||!n.eq(t.state.selection,this.dragging===!1))&&this.view.dispatch({selection:n,userEvent:`select.pointer`}),this.mustSelect=!1}update(e){e.transactions.some(e=>e.isUserEvent(`input.type`))?this.destroy():this.style.update(e)&&setTimeout(()=>this.select(this.lastEvent),20)}},AH=Object.create(null),jH=Object.create(null),MH=TV.ie&&TV.ie_version<15||TV.ios&&TV.webkit_version<604,jH.scroll=e=>{e.inputState.lastScrollTop=e.scrollDOM.scrollTop,e.inputState.lastScrollLeft=e.scrollDOM.scrollLeft},AH.keydown=(e,t)=>(e.inputState.setSelectionOrigin(`select`),t.keyCode==27&&e.inputState.tabFocusMode!=0&&(e.inputState.tabFocusMode=Date.now()+2e3),!1),jH.touchstart=(e,t)=>{e.inputState.lastTouchTime=Date.now(),e.inputState.setSelectionOrigin(`select.pointer`)},jH.touchmove=e=>{e.inputState.setSelectionOrigin(`select.pointer`)},AH.mousedown=(e,t)=>{if(e.observer.flush(),e.inputState.lastTouchTime>Date.now()-2e3)return!1;let n=null;for(let r of e.state.facet(QV))if(n=r(e,t),n)break;if(!n&&t.button==0&&(n=cTt(e,t)),n){let r=!e.hasFocus;e.inputState.startMouseSelection(new uEt(e,t,n,r)),r&&e.observer.ignore(()=>{KCt(e.contentDOM);let t=e.root.activeElement;t&&!t.contains(e.contentDOM)&&t.blur()});let i=e.inputState.mouseSelection;if(i)return i.start(t),i.dragging===!1}return!1},NH=(e,t,n)=>t>=n.top&&t<=n.bottom&&e>=n.left&&e<=n.right,dEt=TV.ie&&TV.ie_version<=11,PH=null,FH=0,IH=0,AH.dragstart=(e,t)=>{let{selection:{main:n}}=e.state;if(t.target.draggable){let r=e.docView.nearest(t.target);if(r&&r.isWidget){let e=r.posAtStart,t=e+r.length;(e>=n.to||t<=n.from)&&(n=Bz.range(e,t))}}let{inputState:r}=e;return r.mouseSelection&&(r.mouseSelection.dragging=!0),r.draggedContent=n,t.dataTransfer&&(t.dataTransfer.setData(`Text`,eV(e.state,iH,e.state.sliceDoc(n.from,n.to))),t.dataTransfer.effectAllowed=`copyMove`),!1},AH.dragend=e=>(e.inputState.draggedContent=null,!1),AH.drop=(e,t)=>{if(!t.dataTransfer)return!1;if(e.state.readOnly)return!0;let n=t.dataTransfer.files;if(n&&n.length){let r=Array(n.length),i=0,a=()=>{++i==n.length&&uTt(e,t,r.filter(e=>e!=null).join(e.state.lineBreak),!1)};for(let e=0;e<n.length;e++){let t=new FileReader;t.onerror=a,t.onload=()=>{/[\x00-\x08\x0e-\x1f]{2}/.test(t.result)||(r[e]=t.result),a()},t.readAsText(n[e])}return!0}else{let n=t.dataTransfer.getData(`Text`);if(n)return uTt(e,t,n,!0),!0}return!1},AH.paste=(e,t)=>{if(e.state.readOnly)return!0;e.observer.flush();let n=MH?null:t.clipboardData;return n?(rTt(e,n.getData(`text/plain`)||n.getData(`text/uri-list`)),!0):(nTt(e),!1)},LH=null,AH.copy=AH.cut=(e,t)=>{let{text:n,ranges:r,linewise:i}=fTt(e.state);if(!n&&!i)return!1;LH=i?n:null,t.type==`cut`&&!e.state.readOnly&&e.dispatch({changes:r,scrollIntoView:!0,userEvent:`delete.cut`});let a=MH?null:t.clipboardData;return a?(a.clearData(),a.setData(`text/plain`,n),!0):(dTt(e,n),!1)},RH=aB.define(),jH.focus=e=>{e.inputState.lastFocusTime=Date.now(),!e.scrollDOM.scrollTop&&(e.inputState.lastScrollTop||e.inputState.lastScrollLeft)&&(e.scrollDOM.scrollTop=e.inputState.lastScrollTop,e.scrollDOM.scrollLeft=e.inputState.lastScrollLeft),mTt(e)},jH.blur=e=>{e.observer.clearSelectionRange(),mTt(e)},jH.compositionstart=jH.compositionupdate=e=>{e.observer.editContext||(e.inputState.compositionFirstChange??(e.inputState.compositionFirstChange=!0),e.inputState.composing<0&&(e.inputState.composing=0))},jH.compositionend=e=>{e.observer.editContext||(e.inputState.composing=-1,e.inputState.compositionEndedAt=Date.now(),e.inputState.compositionPendingKey=!0,e.inputState.compositionPendingChange=e.observer.pendingRecords().length>0,e.inputState.compositionFirstChange=null,TV.chrome&&TV.android?e.observer.flushSoon():e.inputState.compositionPendingChange?Promise.resolve().then(()=>e.observer.flush()):setTimeout(()=>{e.inputState.composing<0&&e.docView.hasComposition&&e.update([])},50))},jH.contextmenu=e=>{e.inputState.lastContextMenu=Date.now()},AH.beforeinput=(e,t)=>{if(t.inputType==`insertReplacementText`&&e.observer.editContext){let n=t.dataTransfer?.getData(`text/plain`),r=t.getTargetRanges();if(n&&r.length){let t=r[0];return QB(e,{from:e.posAtDOM(t.startContainer,t.startOffset),to:e.posAtDOM(t.endContainer,t.endOffset),insert:e.state.toText(n)},null),!0}}let n;if(TV.chrome&&TV.android&&(n=DH.find(e=>e.inputType==t.inputType))&&(e.observer.delayAndroidKey(n.key,n.keyCode),n.key==`Backspace`||n.key==`Delete`)){let t=window.visualViewport?.height||0;setTimeout(()=>{(window.visualViewport?.height||0)>t+10&&e.hasFocus&&(e.contentDOM.blur(),e.focus())},100)}return TV.ios&&t.inputType==`deleteContentForward`&&e.observer.flushSoon(),TV.safari&&t.inputType==`insertText`&&e.inputState.composing>=0&&setTimeout(()=>jH.compositionend(e,t),20),!1},zH=new Set,BH=[`pre-wrap`,`normal`,`pre-line`,`break-spaces`],VH=!1,fEt=class{constructor(e){this.lineWrapping=e,this.doc=Oz.empty,this.heightSamples={},this.lineHeight=14,this.charWidth=7,this.textHeight=14,this.lineLength=30}heightForGap(e,t){let n=this.doc.lineAt(t).number-this.doc.lineAt(e).number+1;return this.lineWrapping&&(n+=Math.max(0,Math.ceil((t-e-n*this.lineLength*.5)/this.lineLength))),this.lineHeight*n}heightForLine(e){return this.lineWrapping?(1+Math.max(0,Math.ceil((e-this.lineLength)/(this.lineLength-5))))*this.lineHeight:this.lineHeight}setDoc(e){return this.doc=e,this}mustRefreshForWrapping(e){return BH.indexOf(e)>-1!=this.lineWrapping}mustRefreshForHeights(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];r<0?n++:this.heightSamples[Math.floor(r*10)]||(t=!0,this.heightSamples[Math.floor(r*10)]=!0)}return t}refresh(e,t,n,r,i,a){let o=BH.indexOf(e)>-1,s=Math.round(t)!=Math.round(this.lineHeight)||this.lineWrapping!=o;if(this.lineWrapping=o,this.lineHeight=t,this.charWidth=n,this.textHeight=r,this.lineLength=i,s){this.heightSamples={};for(let e=0;e<a.length;e++){let t=a[e];t<0?e++:this.heightSamples[Math.floor(t*10)]=!0}}return s}},pEt=class{constructor(e,t){this.from=e,this.heights=t,this.index=0}get more(){return this.index<this.heights.length}},HH=class e{constructor(e,t,n,r,i){this.from=e,this.length=t,this.top=n,this.height=r,this._content=i}get type(){return typeof this._content==`number`?MV.Text:Array.isArray(this._content)?this._content:this._content.type}get to(){return this.from+this.length}get bottom(){return this.top+this.height}get widget(){return this._content instanceof IV?this._content.widget:null}get widgetLineBreaks(){return typeof this._content==`number`?this._content:0}join(t){let n=(Array.isArray(this._content)?this._content:[this]).concat(Array.isArray(t._content)?t._content:[t]);return new e(this.from,this.length+t.length,this.top,this.height+t.height,n)}},UH=(function(e){return e[e.ByPos=0]=`ByPos`,e[e.ByHeight=1]=`ByHeight`,e[e.ByPosNoHeight=2]=`ByPosNoHeight`,e})(UH||={}),WH=.001,GH=class e{constructor(e,t,n=2){this.length=e,this.height=t,this.flags=n}get outdated(){return(this.flags&2)>0}set outdated(e){this.flags=(e?2:0)|this.flags&-3}setHeight(e){this.height!=e&&(Math.abs(this.height-e)>WH&&(VH=!0),this.height=e)}replace(t,n,r){return e.of(r)}decomposeLeft(e,t){t.push(this)}decomposeRight(e,t){t.push(this)}applyChanges(e,t,n,r){let i=this,a=n.doc;for(let o=r.length-1;o>=0;o--){let{fromA:s,toA:c,fromB:l,toB:u}=r[o],d=i.lineAt(s,UH.ByPosNoHeight,n.setDoc(t),0,0),f=d.to>=c?d:i.lineAt(c,UH.ByPosNoHeight,n,0,0);for(u+=f.to-c,c=f.to;o>0&&d.from<=r[o-1].toA;)s=r[o-1].fromA,l=r[o-1].fromB,o--,s<d.from&&(d=i.lineAt(s,UH.ByPosNoHeight,n,0,0));l+=d.from-s,s=d.from;let p=gEt.build(n.setDoc(a),e,l,u);i=tV(i,i.replace(s,c,p))}return i.updateHeight(n,0)}static empty(){return new qH(0,0)}static of(t){if(t.length==1)return t[0];let n=0,r=t.length,i=0,a=0;for(;;)if(n==r)if(i>a*2){let e=t[n-1];e.break?t.splice(--n,1,e.left,null,e.right):t.splice(--n,1,e.left,e.right),r+=1+e.break,i-=e.size}else if(a>i*2){let e=t[r];e.break?t.splice(r,1,e.left,null,e.right):t.splice(r,1,e.left,e.right),r+=2+e.break,a-=e.size}else break;else if(i<a){let e=t[n++];e&&(i+=e.size)}else{let e=t[--r];e&&(a+=e.size)}let o=0;return t[n-1]==null?(o=1,n--):t[n]??(o=1,r++),new mEt(e.of(t.slice(0,n)),o,e.of(t.slice(r)))}},GH.prototype.size=1,KH=class extends GH{constructor(e,t,n){super(e,t),this.deco=n}blockAt(e,t,n,r){return new HH(r,this.length,n,this.height,this.deco||0)}lineAt(e,t,n,r,i){return this.blockAt(0,n,r,i)}forEachLine(e,t,n,r,i,a){e<=i+this.length&&t>=i&&a(this.blockAt(0,n,r,i))}updateHeight(e,t=0,n=!1,r){return r&&r.from<=t&&r.more&&this.setHeight(r.heights[r.index++]),this.outdated=!1,this}toString(){return`block(${this.length})`}},qH=class e extends KH{constructor(e,t){super(e,t,null),this.collapsed=0,this.widgetHeight=0,this.breaks=0}blockAt(e,t,n,r){return new HH(r,this.length,n,this.height,this.breaks)}replace(t,n,r){let i=r[0];return r.length==1&&(i instanceof e||i instanceof JH&&i.flags&4)&&Math.abs(this.length-i.length)<10?(i instanceof JH?i=new e(i.length,this.height):i.height=this.height,this.outdated||(i.outdated=!1),i):GH.of(r)}updateHeight(e,t=0,n=!1,r){return r&&r.from<=t&&r.more?this.setHeight(r.heights[r.index++]):(n||this.outdated)&&this.setHeight(Math.max(this.widgetHeight,e.heightForLine(this.length-this.collapsed))+this.breaks*e.lineHeight),this.outdated=!1,this}toString(){return`line(${this.length}${this.collapsed?-this.collapsed:``}${this.widgetHeight?`:`+this.widgetHeight:``})`}},JH=class e extends GH{constructor(e){super(e,0)}heightMetrics(e,t){let n=e.doc.lineAt(t).number,r=e.doc.lineAt(t+this.length).number,i=r-n+1,a,o=0;if(e.lineWrapping){let t=Math.min(this.height,e.lineHeight*i);a=t/i,this.length>i+1&&(o=(this.height-t)/(this.length-i-1))}else a=this.height/i;return{firstLine:n,lastLine:r,perLine:a,perChar:o}}blockAt(e,t,n,r){let{firstLine:i,lastLine:a,perLine:o,perChar:s}=this.heightMetrics(t,r);if(t.lineWrapping){let i=r+(e<t.lineHeight?0:Math.round(Math.max(0,Math.min(1,(e-n)/this.height))*this.length)),a=t.doc.lineAt(i),c=o+a.length*s,l=Math.max(n,e-c/2);return new HH(a.from,a.length,l,c,0)}else{let r=Math.max(0,Math.min(a-i,Math.floor((e-n)/o))),{from:s,length:c}=t.doc.line(i+r);return new HH(s,c,n+o*r,o,0)}}lineAt(e,t,n,r,i){if(t==UH.ByHeight)return this.blockAt(e,n,r,i);if(t==UH.ByPosNoHeight){let{from:t,to:r}=n.doc.lineAt(e);return new HH(t,r-t,0,0,0)}let{firstLine:a,perLine:o,perChar:s}=this.heightMetrics(n,i),c=n.doc.lineAt(e),l=o+c.length*s,u=c.number-a,d=r+o*u+s*(c.from-i-u);return new HH(c.from,c.length,Math.max(r,Math.min(d,r+this.height-l)),l,0)}forEachLine(e,t,n,r,i,a){e=Math.max(e,i),t=Math.min(t,i+this.length);let{firstLine:o,perLine:s,perChar:c}=this.heightMetrics(n,i);for(let l=e,u=r;l<=t;){let t=n.doc.lineAt(l);if(l==e){let n=t.number-o;u+=s*n+c*(e-i-n)}let r=s+c*t.length;a(new HH(t.from,t.length,u,r,0)),u+=r,l=t.to+1}}replace(t,n,r){let i=this.length-n;if(i>0){let t=r[r.length-1];t instanceof e?r[r.length-1]=new e(t.length+i):r.push(null,new e(i-1))}if(t>0){let n=r[0];n instanceof e?r[0]=new e(t+n.length):r.unshift(new e(t-1),null)}return GH.of(r)}decomposeLeft(t,n){n.push(new e(t-1),null)}decomposeRight(t,n){n.push(null,new e(this.length-t-1))}updateHeight(t,n=0,r=!1,i){let a=n+this.length;if(i&&i.from<=n+this.length&&i.more){let r=[],o=Math.max(n,i.from),s=-1;for(i.from>n&&r.push(new e(i.from-n-1).updateHeight(t,n));o<=a&&i.more;){let e=t.doc.lineAt(o).length;r.length&&r.push(null);let n=i.heights[i.index++];s==-1?s=n:Math.abs(n-s)>=WH&&(s=-2);let a=new qH(e,n);a.outdated=!1,r.push(a),o+=e+1}o<=a&&r.push(null,new e(a-o).updateHeight(t,o));let c=GH.of(r);return(s<0||Math.abs(c.height-this.height)>=WH||Math.abs(s-this.heightMetrics(t,n).perLine)>=WH)&&(VH=!0),tV(this,c)}else (r||this.outdated)&&(this.setHeight(t.heightForGap(n,n+this.length)),this.outdated=!1);return this}toString(){return`gap(${this.length})`}},mEt=class extends GH{constructor(e,t,n){super(e.length+t+n.length,e.height+n.height,t|(e.outdated||n.outdated?2:0)),this.left=e,this.right=n,this.size=e.size+n.size}get break(){return this.flags&1}blockAt(e,t,n,r){let i=n+this.left.height;return e<i?this.left.blockAt(e,t,n,r):this.right.blockAt(e,t,i,r+this.left.length+this.break)}lineAt(e,t,n,r,i){let a=r+this.left.height,o=i+this.left.length+this.break,s=t==UH.ByHeight?e<a:e<o,c=s?this.left.lineAt(e,t,n,r,i):this.right.lineAt(e,t,n,a,o);if(this.break||(s?c.to<o:c.from>o))return c;let l=t==UH.ByPosNoHeight?UH.ByPosNoHeight:UH.ByPos;return s?c.join(this.right.lineAt(o,l,n,a,o)):this.left.lineAt(o,l,n,r,i).join(c)}forEachLine(e,t,n,r,i,a){let o=r+this.left.height,s=i+this.left.length+this.break;if(this.break)e<s&&this.left.forEachLine(e,t,n,r,i,a),t>=s&&this.right.forEachLine(e,t,n,o,s,a);else{let c=this.lineAt(s,UH.ByPos,n,r,i);e<c.from&&this.left.forEachLine(e,c.from-1,n,r,i,a),c.to>=e&&c.from<=t&&a(c),t>c.to&&this.right.forEachLine(c.to+1,t,n,o,s,a)}}replace(e,t,n){let r=this.left.length+this.break;if(t<r)return this.balanced(this.left.replace(e,t,n),this.right);if(e>this.left.length)return this.balanced(this.left,this.right.replace(e-r,t-r,n));let i=[];e>0&&this.decomposeLeft(e,i);let a=i.length;for(let e of n)i.push(e);if(e>0&&_Tt(i,a-1),t<this.length){let e=i.length;this.decomposeRight(t,i),_Tt(i,e)}return GH.of(i)}decomposeLeft(e,t){let n=this.left.length;if(e<=n)return this.left.decomposeLeft(e,t);t.push(this.left),this.break&&(n++,e>=n&&t.push(null)),e>n&&this.right.decomposeLeft(e-n,t)}decomposeRight(e,t){let n=this.left.length,r=n+this.break;if(e>=r)return this.right.decomposeRight(e-r,t);e<n&&this.left.decomposeRight(e,t),this.break&&e<r&&t.push(null),t.push(this.right)}balanced(e,t){return e.size>2*t.size||t.size>2*e.size?GH.of(this.break?[e,null,t]:[e,t]):(this.left=tV(this.left,e),this.right=tV(this.right,t),this.setHeight(e.height+t.height),this.outdated=e.outdated||t.outdated,this.size=e.size+t.size,this.length=e.length+this.break+t.length,this)}updateHeight(e,t=0,n=!1,r){let{left:i,right:a}=this,o=t+i.length+this.break,s=null;return r&&r.from<=t+i.length&&r.more?s=i=i.updateHeight(e,t,n,r):i.updateHeight(e,t,n),r&&r.from<=o+a.length&&r.more?s=a=a.updateHeight(e,o,n,r):a.updateHeight(e,o,n),s?this.balanced(i,a):(this.height=this.left.height+this.right.height,this.outdated=!1,this)}toString(){return this.left+(this.break?` `:`-`)+this.right}},hEt=5,gEt=class e{constructor(e,t){this.pos=e,this.oracle=t,this.nodes=[],this.lineStart=-1,this.lineEnd=-1,this.covering=null,this.writtenTo=e}get isCovered(){return this.covering&&this.nodes[this.nodes.length-1]==this.covering}span(e,t){if(this.lineStart>-1){let e=Math.min(t,this.lineEnd),n=this.nodes[this.nodes.length-1];n instanceof qH?n.length+=e-this.pos:(e>this.pos||!this.isCovered)&&this.nodes.push(new qH(e-this.pos,-1)),this.writtenTo=e,t>e&&(this.nodes.push(null),this.writtenTo++,this.lineStart=-1)}this.pos=t}point(e,t,n){if(e<t||n.heightRelevant){let r=n.widget?n.widget.estimatedHeight:0,i=n.widget?n.widget.lineBreaks:0;r<0&&(r=this.oracle.lineHeight);let a=t-e;n.block?this.addBlock(new KH(a,r,n)):(a||i||r>=hEt)&&this.addLineDeco(r,i,a)}else t>e&&this.span(e,t);this.lineEnd>-1&&this.lineEnd<this.pos&&(this.lineEnd=this.oracle.doc.lineAt(this.pos).to)}enterLine(){if(this.lineStart>-1)return;let{from:e,to:t}=this.oracle.doc.lineAt(this.pos);this.lineStart=e,this.lineEnd=t,this.writtenTo<e&&((this.writtenTo<e-1||this.nodes[this.nodes.length-1]==null)&&this.nodes.push(this.blankContent(this.writtenTo,e-1)),this.nodes.push(null)),this.pos>e&&this.nodes.push(new qH(this.pos-e,-1)),this.writtenTo=this.pos}blankContent(e,t){let n=new JH(t-e);return this.oracle.doc.lineAt(e).to==t&&(n.flags|=4),n}ensureLine(){this.enterLine();let e=this.nodes.length?this.nodes[this.nodes.length-1]:null;if(e instanceof qH)return e;let t=new qH(0,-1);return this.nodes.push(t),t}addBlock(e){this.enterLine();let t=e.deco;t&&t.startSide>0&&!this.isCovered&&this.ensureLine(),this.nodes.push(e),this.writtenTo=this.pos+=e.length,t&&t.endSide>0&&(this.covering=e)}addLineDeco(e,t,n){let r=this.ensureLine();r.length+=n,r.collapsed+=n,r.widgetHeight=Math.max(r.widgetHeight,e),r.breaks+=t,this.writtenTo=this.pos+=n}finish(e){let t=this.nodes.length==0?null:this.nodes[this.nodes.length-1];this.lineStart>-1&&!(t instanceof qH)&&!this.isCovered?this.nodes.push(new qH(0,-1)):(this.writtenTo<this.pos||t==null)&&this.nodes.push(this.blankContent(this.writtenTo,this.pos));let n=e;for(let e of this.nodes)e instanceof qH&&e.updateHeight(this.oracle,n),n+=e?e.length:1;return this.nodes}static build(t,n,r,i){let a=new e(r,t);return pB.spans(n,r,i,a,0),a.finish(r)}},_Et=class{constructor(){this.changes=[]}compareRange(){}comparePoint(e,t,n,r){(e<t||n&&n.heightRelevant||r&&r.heightRelevant)&&HB(e,t,this.changes,5)}},YH=class{constructor(e,t,n,r){this.from=e,this.to=t,this.size=n,this.displaySize=r}static same(e,t){if(e.length!=t.length)return!1;for(let n=0;n<e.length;n++){let r=e[n],i=t[n];if(r.from!=i.from||r.to!=i.to||r.size!=i.size)return!1}return!0}draw(e,t){return NV.replace({widget:new vEt(this.displaySize*(t?e.scaleY:e.scaleX),t)}).range(this.from,this.to)}},vEt=class extends jV{constructor(e,t){super(),this.size=e,this.vertical=t}eq(e){return e.size==this.size&&e.vertical==this.vertical}toDOM(){let e=document.createElement(`div`);return this.vertical?e.style.height=this.size+`px`:(e.style.width=this.size+`px`,e.style.height=`2px`,e.style.display=`inline-block`),e}get estimatedHeight(){return this.vertical?this.size:-1}},XH=class{constructor(e){this.state=e,this.pixelViewport={left:0,right:window.innerWidth,top:0,bottom:0},this.inView=!0,this.paddingTop=0,this.paddingBottom=0,this.contentDOMWidth=0,this.contentDOMHeight=0,this.editorHeight=0,this.editorWidth=0,this.scrollTop=0,this.scrolledToBottom=!1,this.scaleX=1,this.scaleY=1,this.scrollAnchorPos=0,this.scrollAnchorHeight=-1,this.scaler=QH,this.scrollTarget=null,this.printing=!1,this.mustMeasureContent=!0,this.defaultTextDirection=HV.LTR,this.visibleRanges=[],this.mustEnforceCursorAssoc=!1,this.heightOracle=new fEt(e.facet(hH).some(e=>typeof e!=`function`&&e.class==`cm-lineWrapping`)),this.stateDeco=e.facet(gH).filter(e=>typeof e!=`function`),this.heightMap=GH.empty().applyChanges(this.stateDeco,Oz.empty,this.heightOracle.setDoc(e.doc),[new SH(0,0,0,e.doc.length)]);for(let e=0;e<2&&(this.viewport=this.getViewport(0,null),this.updateForViewport());e++);this.updateViewportLines(),this.lineGaps=this.ensureLineGaps([]),this.lineGapDeco=NV.set(this.lineGaps.map(e=>e.draw(this,!1))),this.computeVisibleRanges()}updateForViewport(){let e=[this.viewport],{main:t}=this.state.selection;for(let n=0;n<=1;n++){let r=n?t.head:t.anchor;if(!e.some(({from:e,to:t})=>r>=e&&r<=t)){let{from:t,to:n}=this.lineBlockAt(r);e.push(new ZH(t,n))}}return this.viewports=e.sort((e,t)=>e.from-t.from),this.updateScaler()}updateScaler(){let e=this.scaler;return this.scaler=this.heightMap.height<=7e6?QH:new yEt(this.heightOracle,this.heightMap,this.viewports),e.eq(this.scaler)?0:2}updateViewportLines(){this.viewportLines=[],this.heightMap.forEachLine(this.viewport.from,this.viewport.to,this.heightOracle.setDoc(this.state.doc),0,0,e=>{this.viewportLines.push(iV(e,this.scaler))})}update(e,t=null){this.state=e.state;let n=this.stateDeco;this.stateDeco=this.state.facet(gH).filter(e=>typeof e!=`function`);let r=e.changedRanges,i=SH.extendWithRanges(r,vTt(n,this.stateDeco,e?e.changes:Lz.empty(this.state.doc.length))),a=this.heightMap.height,o=this.scrolledToBottom?null:this.scrollAnchorAt(this.scrollTop);gTt(),this.heightMap=this.heightMap.applyChanges(this.stateDeco,e.startState.doc,this.heightOracle.setDoc(this.state.doc),i),(this.heightMap.height!=a||VH)&&(e.flags|=2),o?(this.scrollAnchorPos=e.changes.mapPos(o.from,-1),this.scrollAnchorHeight=o.top):(this.scrollAnchorPos=-1,this.scrollAnchorHeight=this.heightMap.height);let s=i.length?this.mapViewport(this.viewport,e.changes):this.viewport;(t&&(t.range.head<s.from||t.range.head>s.to)||!this.viewportIsAppropriate(s))&&(s=this.getViewport(0,t));let c=s.from!=this.viewport.from||s.to!=this.viewport.to;this.viewport=s,e.flags|=this.updateForViewport(),(c||!e.changes.empty||e.flags&2)&&this.updateViewportLines(),(this.lineGaps.length||this.viewport.to-this.viewport.from>4e3)&&this.updateLineGaps(this.ensureLineGaps(this.mapLineGaps(this.lineGaps,e.changes))),e.flags|=this.computeVisibleRanges(),t&&(this.scrollTarget=t),!this.mustEnforceCursorAssoc&&e.selectionSet&&e.view.lineWrapping&&e.state.selection.main.empty&&e.state.selection.main.assoc&&!e.state.facet(rEt)&&(this.mustEnforceCursorAssoc=!0)}measure(e){let t=e.contentDOM,n=window.getComputedStyle(t),r=this.heightOracle,i=n.whiteSpace;this.defaultTextDirection=n.direction==`rtl`?HV.RTL:HV.LTR;let a=this.heightOracle.mustRefreshForWrapping(i),o=t.getBoundingClientRect(),s=a||this.mustMeasureContent||this.contentDOMHeight!=o.height;this.contentDOMHeight=o.height,this.mustMeasureContent=!1;let c=0,l=0;if(o.width&&o.height){let{scaleX:e,scaleY:n}=UCt(t,o);(e>.005&&Math.abs(this.scaleX-e)>.005||n>.005&&Math.abs(this.scaleY-n)>.005)&&(this.scaleX=e,this.scaleY=n,c|=8,a=s=!0)}let u=(parseInt(n.paddingTop)||0)*this.scaleY,d=(parseInt(n.paddingBottom)||0)*this.scaleY;(this.paddingTop!=u||this.paddingBottom!=d)&&(this.paddingTop=u,this.paddingBottom=d,c|=10),this.editorWidth!=e.scrollDOM.clientWidth&&(r.lineWrapping&&(s=!0),this.editorWidth=e.scrollDOM.clientWidth,c|=8);let f=e.scrollDOM.scrollTop*this.scaleY;this.scrollTop!=f&&(this.scrollAnchorHeight=-1,this.scrollTop=f),this.scrolledToBottom=XCt(e.scrollDOM);let p=(this.printing?bTt:yTt)(t,this.paddingTop),m=p.top-this.pixelViewport.top,h=p.bottom-this.pixelViewport.bottom;this.pixelViewport=p;let g=this.pixelViewport.bottom>this.pixelViewport.top&&this.pixelViewport.right>this.pixelViewport.left;if(g!=this.inView&&(this.inView=g,g&&(s=!0)),!this.inView&&!this.scrollTarget)return 0;let _=o.width;if((this.contentDOMWidth!=_||this.editorHeight!=e.scrollDOM.clientHeight)&&(this.contentDOMWidth=o.width,this.editorHeight=e.scrollDOM.clientHeight,c|=8),s){let t=e.docView.measureVisibleLineHeights(this.viewport);if(r.mustRefreshForHeights(t)&&(a=!0),a||r.lineWrapping&&Math.abs(_-this.contentDOMWidth)>r.charWidth){let{lineHeight:n,charWidth:o,textHeight:s}=e.docView.measureTextSize();a=n>0&&r.refresh(i,n,o,s,_/o,t),a&&(e.docView.minWidth=0,c|=8)}m>0&&h>0?l=Math.max(m,h):m<0&&h<0&&(l=Math.min(m,h)),gTt();for(let n of this.viewports){let i=n.from==this.viewport.from?t:e.docView.measureVisibleLineHeights(n);this.heightMap=(a?GH.empty().applyChanges(this.stateDeco,Oz.empty,this.heightOracle,[new SH(0,0,0,e.state.doc.length)]):this.heightMap).updateHeight(r,0,a,new pEt(n.from,i))}VH&&(c|=2)}let v=!this.viewportIsAppropriate(this.viewport,l)||this.scrollTarget&&(this.scrollTarget.range.head<this.viewport.from||this.scrollTarget.range.head>this.viewport.to);return v&&(c&2&&(c|=this.updateScaler()),this.viewport=this.getViewport(l,this.scrollTarget),c|=this.updateForViewport()),(c&2||v)&&this.updateViewportLines(),(this.lineGaps.length||this.viewport.to-this.viewport.from>4e3)&&this.updateLineGaps(this.ensureLineGaps(a?[]:this.lineGaps,e)),c|=this.computeVisibleRanges(),this.mustEnforceCursorAssoc&&(this.mustEnforceCursorAssoc=!1,e.docView.enforceCursorAssoc()),c}get visibleTop(){return this.scaler.fromDOM(this.pixelViewport.top)}get visibleBottom(){return this.scaler.fromDOM(this.pixelViewport.bottom)}getViewport(e,t){let n=.5-Math.max(-.5,Math.min(.5,e/1e3/2)),r=this.heightMap,i=this.heightOracle,{visibleTop:a,visibleBottom:o}=this,s=new ZH(r.lineAt(a-n*1e3,UH.ByHeight,i,0,0).from,r.lineAt(o+(1-n)*1e3,UH.ByHeight,i,0,0).to);if(t){let{head:e}=t.range;if(e<s.from||e>s.to){let n=Math.min(this.editorHeight,this.pixelViewport.bottom-this.pixelViewport.top),a=r.lineAt(e,UH.ByPos,i,0,0),o;o=t.y==`center`?(a.top+a.bottom)/2-n/2:t.y==`start`||t.y==`nearest`&&e<s.from?a.top:a.bottom-n,s=new ZH(r.lineAt(o-1e3/2,UH.ByHeight,i,0,0).from,r.lineAt(o+n+1e3/2,UH.ByHeight,i,0,0).to)}}return s}mapViewport(e,t){let n=t.mapPos(e.from,-1),r=t.mapPos(e.to,1);return new ZH(this.heightMap.lineAt(n,UH.ByPos,this.heightOracle,0,0).from,this.heightMap.lineAt(r,UH.ByPos,this.heightOracle,0,0).to)}viewportIsAppropriate({from:e,to:t},n=0){if(!this.inView)return!0;let{top:r}=this.heightMap.lineAt(e,UH.ByPos,this.heightOracle,0,0),{bottom:i}=this.heightMap.lineAt(t,UH.ByPos,this.heightOracle,0,0),{visibleTop:a,visibleBottom:o}=this;return(e==0||r<=a-Math.max(10,Math.min(-n,250)))&&(t==this.state.doc.length||i>=o+Math.max(10,Math.min(n,250)))&&r>a-2*1e3&&i<o+2*1e3}mapLineGaps(e,t){if(!e.length||t.empty)return e;let n=[];for(let r of e)t.touchesRange(r.from,r.to)||n.push(new YH(t.mapPos(r.from),t.mapPos(r.to),r.size,r.displaySize));return n}ensureLineGaps(e,t){let n=this.heightOracle.lineWrapping,r=n?1e4:2e3,i=r>>1,a=r<<1;if(this.defaultTextDirection!=HV.LTR&&!n)return[];let o=[],s=(r,a,c,l)=>{if(a-r<i)return;let u=this.state.selection.main,d=[u.from];u.empty||d.push(u.to);for(let e of d)if(e>r&&e<a){s(r,e-10,c,l),s(e+10,a,c,l);return}let f=STt(e,e=>e.from>=c.from&&e.to<=c.to&&Math.abs(e.from-r)<i&&Math.abs(e.to-a)<i&&!d.some(t=>e.from<t&&e.to>t));if(!f){if(a<c.to&&t&&n&&t.visibleRanges.some(e=>e.from<=a&&e.to>=a)){let e=t.moveToLineBoundary(Bz.cursor(a),!1,!0).head;e>r&&(a=e)}let e=this.gapSize(c,r,a,l);f=new YH(r,a,e,n||e<2e6?e:2e6)}o.push(f)},c=t=>{if(t.length<a||t.type!=MV.Text)return;let i=xTt(t.from,t.to,this.stateDeco);if(i.total<a)return;let o=this.scrollTarget?this.scrollTarget.range.head:null,c,l;if(n){let e=r/this.heightOracle.lineLength*this.heightOracle.lineHeight,n,a;if(o!=null){let r=rV(i,o),s=((this.visibleBottom-this.visibleTop)/2+e)/t.height;n=r-s,a=r+s}else n=(this.visibleTop-t.top-e)/t.height,a=(this.visibleBottom-t.top+e)/t.height;c=nV(i,n),l=nV(i,a)}else{let n=i.total*this.heightOracle.charWidth,a=r*this.heightOracle.charWidth,s=0;if(n>2e6)for(let n of e)n.from>=t.from&&n.from<t.to&&n.size!=n.displaySize&&n.from*this.heightOracle.charWidth+s<this.pixelViewport.left&&(s=n.size-n.displaySize);let u=this.pixelViewport.left+s,d=this.pixelViewport.right+s,f,p;if(o!=null){let e=rV(i,o),t=((d-u)/2+a)/n;f=e-t,p=e+t}else f=(u-a)/n,p=(d+a)/n;c=nV(i,f),l=nV(i,p)}c>t.from&&s(t.from,c,t,i),l<t.to&&s(l,t.to,t,i)};for(let e of this.viewportLines)Array.isArray(e.type)?e.type.forEach(c):c(e);return o}gapSize(e,t,n,r){let i=rV(r,n)-rV(r,t);return this.heightOracle.lineWrapping?e.height*i:r.total*this.heightOracle.charWidth*i}updateLineGaps(e){YH.same(e,this.lineGaps)||(this.lineGaps=e,this.lineGapDeco=NV.set(e.map(e=>e.draw(this,this.heightOracle.lineWrapping))))}computeVisibleRanges(){let e=this.stateDeco;this.lineGaps.length&&(e=e.concat(this.lineGapDeco));let t=[];pB.spans(e,this.viewport.from,this.viewport.to,{span(e,n){t.push({from:e,to:n})},point(){}},20);let n=t.length!=this.visibleRanges.length||this.visibleRanges.some((e,n)=>e.from!=t[n].from||e.to!=t[n].to);return this.visibleRanges=t,n?4:0}lineBlockAt(e){return e>=this.viewport.from&&e<=this.viewport.to&&this.viewportLines.find(t=>t.from<=e&&t.to>=e)||iV(this.heightMap.lineAt(e,UH.ByPos,this.heightOracle,0,0),this.scaler)}lineBlockAtHeight(e){return e>=this.viewportLines[0].top&&e<=this.viewportLines[this.viewportLines.length-1].bottom&&this.viewportLines.find(t=>t.top<=e&&t.bottom>=e)||iV(this.heightMap.lineAt(this.scaler.fromDOM(e),UH.ByHeight,this.heightOracle,0,0),this.scaler)}scrollAnchorAt(e){let t=this.lineBlockAtHeight(e+8);return t.from>=this.viewport.from||this.viewportLines[0].top-e>200?t:this.viewportLines[0]}elementAtHeight(e){return iV(this.heightMap.blockAt(this.scaler.fromDOM(e),this.heightOracle,0,0),this.scaler)}get docHeight(){return this.scaler.toDOM(this.heightMap.height)}get contentHeight(){return this.docHeight+this.paddingTop+this.paddingBottom}},ZH=class{constructor(e,t){this.from=e,this.to=t}},QH={toDOM(e){return e},fromDOM(e){return e},scale:1,eq(e){return e==this}},yEt=class e{constructor(e,t,n){let r=0,i=0,a=0;this.viewports=n.map(({from:n,to:i})=>{let a=t.lineAt(n,UH.ByPos,e,0,0).top,o=t.lineAt(i,UH.ByPos,e,0,0).bottom;return r+=o-a,{from:n,to:i,top:a,bottom:o,domTop:0,domBottom:0}}),this.scale=(7e6-r)/(t.height-r);for(let e of this.viewports)e.domTop=a+(e.top-i)*this.scale,a=e.domBottom=e.domTop+(e.bottom-e.top),i=e.bottom}toDOM(e){for(let t=0,n=0,r=0;;t++){let i=t<this.viewports.length?this.viewports[t]:null;if(!i||e<i.top)return r+(e-n)*this.scale;if(e<=i.bottom)return i.domTop+(e-i.top);n=i.bottom,r=i.domBottom}}fromDOM(e){for(let t=0,n=0,r=0;;t++){let i=t<this.viewports.length?this.viewports[t]:null;if(!i||e<i.domTop)return n+(e-r)/this.scale;if(e<=i.domBottom)return i.top+(e-i.domTop);n=i.bottom,r=i.domBottom}}eq(t){return t instanceof e?this.scale==t.scale&&this.viewports.length==t.viewports.length&&this.viewports.every((e,n)=>e.from==t.viewports[n].from&&e.to==t.viewports[n].to):!1}},$H=Hz.define({combine:e=>e.join(` `)}),eU=Hz.define({combine:e=>e.indexOf(!0)>-1}),tU=CB.newName(),nU=CB.newName(),rU=CB.newName(),iU={"&light":`.`+nU,"&dark":`.`+rU},bEt=aV(`.`+tU,{"&":{position:`relative !important`,boxSizing:`border-box`,"&.cm-focused":{outline:`1px dotted #212121`},display:`flex !important`,flexDirection:`column`},".cm-scroller":{display:`flex !important`,alignItems:`flex-start !important`,fontFamily:`monospace`,lineHeight:1.4,height:`100%`,overflowX:`auto`,position:`relative`,zIndex:0,overflowAnchor:`none`},".cm-content":{margin:0,flexGrow:2,flexShrink:0,display:`block`,whiteSpace:`pre`,wordWrap:`normal`,boxSizing:`border-box`,minHeight:`100%`,padding:`4px 0`,outline:`none`,"&[contenteditable=true]":{WebkitUserModify:`read-write-plaintext-only`}},".cm-lineWrapping":{whiteSpace_fallback:`pre-wrap`,whiteSpace:`break-spaces`,wordBreak:`break-word`,overflowWrap:`anywhere`,flexShrink:1},"&light .cm-content":{caretColor:`black`},"&dark .cm-content":{caretColor:`white`},".cm-line":{display:`block`,padding:`0 2px 0 6px`},".cm-layer":{position:`absolute`,left:0,top:0,contain:`size style`,"& > *":{position:`absolute`}},"&light .cm-selectionBackground":{background:`#d9d9d9`},"&dark .cm-selectionBackground":{background:`#222`},"&light.cm-focused > .cm-scroller > .cm-selectionLayer .cm-selectionBackground":{background:`#d7d4f0`},"&dark.cm-focused > .cm-scroller > .cm-selectionLayer .cm-selectionBackground":{background:`#233`},".cm-cursorLayer":{pointerEvents:`none`},"&.cm-focused > .cm-scroller > .cm-cursorLayer":{animation:`steps(1) cm-blink 1.2s infinite`},"@keyframes cm-blink":{"0%":{},"50%":{opacity:0},"100%":{}},"@keyframes cm-blink2":{"0%":{},"50%":{opacity:0},"100%":{}},".cm-cursor, .cm-dropCursor":{borderLeft:`1.2px solid black`,marginLeft:`-0.6px`,pointerEvents:`none`},".cm-cursor":{display:`none`},"&dark .cm-cursor":{borderLeftColor:`#ddd`},".cm-dropCursor":{position:`absolute`},"&.cm-focused > .cm-scroller > .cm-cursorLayer .cm-cursor":{display:`block`},".cm-iso":{unicodeBidi:`isolate`},".cm-announced":{position:`fixed`,top:`-10000px`},"@media print":{".cm-announced":{display:`none`}},"&light .cm-activeLine":{backgroundColor:`#cceeff44`},"&dark .cm-activeLine":{backgroundColor:`#99eeff33`},"&light .cm-specialChar":{color:`red`},"&dark .cm-specialChar":{color:`#f78`},".cm-gutters":{flexShrink:0,display:`flex`,height:`100%`,boxSizing:`border-box`,insetInlineStart:0,zIndex:200},"&light .cm-gutters":{backgroundColor:`#f5f5f5`,color:`#6c6c6c`,borderRight:`1px solid #ddd`},"&dark .cm-gutters":{backgroundColor:`#333338`,color:`#ccc`},".cm-gutter":{display:`flex !important`,flexDirection:`column`,flexShrink:0,boxSizing:`border-box`,minHeight:`100%`,overflow:`hidden`},".cm-gutterElement":{boxSizing:`border-box`},".cm-lineNumbers .cm-gutterElement":{padding:`0 3px 0 5px`,minWidth:`20px`,textAlign:`right`,whiteSpace:`nowrap`},"&light .cm-activeLineGutter":{backgroundColor:`#e2f2ff`},"&dark .cm-activeLineGutter":{backgroundColor:`#222227`},".cm-panels":{boxSizing:`border-box`,position:`sticky`,left:0,right:0,zIndex:300},"&light .cm-panels":{backgroundColor:`#f5f5f5`,color:`black`},"&light .cm-panels-top":{borderBottom:`1px solid #ddd`},"&light .cm-panels-bottom":{borderTop:`1px solid #ddd`},"&dark .cm-panels":{backgroundColor:`#333338`,color:`white`},".cm-tab":{display:`inline-block`,overflow:`hidden`,verticalAlign:`bottom`},".cm-widgetBuffer":{verticalAlign:`text-top`,height:`1em`,width:0,display:`inline`},".cm-placeholder":{color:`#888`,display:`inline-block`,verticalAlign:`top`},".cm-highlightSpace":{backgroundImage:`radial-gradient(circle at 50% 55%, #aaa 20%, transparent 5%)`,backgroundPosition:`center`},".cm-highlightTab":{backgroundImage:`url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="200" height="20"><path stroke="%23888" stroke-width="1" fill="none" d="M1 10H196L190 5M190 15L196 10M197 4L197 16"/></svg>')`,backgroundSize:`auto 100%`,backgroundPosition:`right 90%`,backgroundRepeat:`no-repeat`},".cm-trailingSpace":{backgroundColor:`#ff332255`},".cm-button":{verticalAlign:`middle`,color:`inherit`,fontSize:`70%`,padding:`.2em 1em`,borderRadius:`1px`},"&light .cm-button":{backgroundImage:`linear-gradient(#eff1f5, #d9d9df)`,border:`1px solid #888`,"&:active":{backgroundImage:`linear-gradient(#b4b4b4, #d0d3d6)`}},"&dark .cm-button":{backgroundImage:`linear-gradient(#393939, #111)`,border:`1px solid #888`,"&:active":{backgroundImage:`linear-gradient(#111, #333)`}},".cm-textfield":{verticalAlign:`middle`,color:`inherit`,fontSize:`70%`,border:`1px solid silver`,padding:`.2em .5em`},"&light .cm-textfield":{backgroundColor:`white`},"&dark .cm-textfield":{border:`1px solid #555`,backgroundColor:`inherit`}},iU),xEt={childList:!0,characterData:!0,subtree:!0,attributes:!0,characterDataOldValue:!0},aU=TV.ie&&TV.ie_version<=11,SEt=class{constructor(e){this.view=e,this.active=!1,this.editContext=null,this.selectionRange=new ZTt,this.selectionChanged=!1,this.delayedFlush=-1,this.resizeTimeout=-1,this.queue=[],this.delayedAndroidKey=null,this.flushingAndroidKey=-1,this.lastChange=0,this.scrollTargets=[],this.intersection=null,this.resizeScroll=null,this.intersecting=!1,this.gapIntersection=null,this.gaps=[],this.printQuery=null,this.parentCheck=-1,this.dom=e.contentDOM,this.observer=new MutationObserver(t=>{for(let e of t)this.queue.push(e);(TV.ie&&TV.ie_version<=11||TV.ios&&e.composing)&&t.some(e=>e.type==`childList`&&e.removedNodes.length||e.type==`characterData`&&e.oldValue.length>e.target.nodeValue.length)?this.flushSoon():this.flush()}),window.EditContext&&e.constructor.EDIT_CONTEXT!==!1&&!(TV.chrome&&TV.chrome_version<126)&&(this.editContext=new CEt(e),e.state.facet(uH)&&(e.contentDOM.editContext=this.editContext.editContext)),aU&&(this.onCharData=e=>{this.queue.push({target:e.target,type:`characterData`,oldValue:e.prevValue}),this.flushSoon()}),this.onSelectionChange=this.onSelectionChange.bind(this),this.onResize=this.onResize.bind(this),this.onPrint=this.onPrint.bind(this),this.onScroll=this.onScroll.bind(this),window.matchMedia&&(this.printQuery=window.matchMedia(`print`)),typeof ResizeObserver==`function`&&(this.resizeScroll=new ResizeObserver(()=>{this.view.docView?.lastUpdate<Date.now()-75&&this.onResize()}),this.resizeScroll.observe(e.scrollDOM)),this.addWindowListeners(this.win=e.win),this.start(),typeof IntersectionObserver==`function`&&(this.intersection=new IntersectionObserver(e=>{this.parentCheck<0&&(this.parentCheck=setTimeout(this.listenForScroll.bind(this),1e3)),e.length>0&&e[e.length-1].intersectionRatio>0!=this.intersecting&&(this.intersecting=!this.intersecting,this.intersecting!=this.view.inView&&this.onScrollChanged(document.createEvent(`Event`)))},{threshold:[0,.001]}),this.intersection.observe(this.dom),this.gapIntersection=new IntersectionObserver(e=>{e.length>0&&e[e.length-1].intersectionRatio>0&&this.onScrollChanged(document.createEvent(`Event`))},{})),this.listenForScroll(),this.readSelectionRange()}onScrollChanged(e){this.view.inputState.runHandlers(`scroll`,e),this.intersecting&&this.view.measure()}onScroll(e){this.intersecting&&this.flush(!1),this.editContext&&this.view.requestMeasure(this.editContext.measureReq),this.onScrollChanged(e)}onResize(){this.resizeTimeout<0&&(this.resizeTimeout=setTimeout(()=>{this.resizeTimeout=-1,this.view.requestMeasure()},50))}onPrint(e){(e.type==`change`||!e.type)&&!e.matches||(this.view.viewState.printing=!0,this.view.measure(),setTimeout(()=>{this.view.viewState.printing=!1,this.view.requestMeasure()},500))}updateGaps(e){if(this.gapIntersection&&(e.length!=this.gaps.length||this.gaps.some((t,n)=>t!=e[n]))){this.gapIntersection.disconnect();for(let t of e)this.gapIntersection.observe(t);this.gaps=e}}onSelectionChange(e){let t=this.selectionChanged;if(!this.readSelectionRange()||this.delayedAndroidKey)return;let{view:n}=this,r=this.selectionRange;if(n.state.facet(uH)?n.root.activeElement!=this.dom:!AB(this.dom,r))return;let i=r.anchorNode&&n.docView.nearest(r.anchorNode);if(i&&i.ignoreEvent(e)){t||(this.selectionChanged=!1);return}(TV.ie&&TV.ie_version<=11||TV.android&&TV.chrome)&&!n.state.selection.main.empty&&r.focusNode&&MB(r.focusNode,r.focusOffset,r.anchorNode,r.anchorOffset)?this.flushSoon():this.flush(!1)}readSelectionRange(){let{view:e}=this,t=OB(e.root);if(!t)return!1;let n=TV.safari&&e.root.nodeType==11&&e.root.activeElement==this.dom&&TTt(this.view,t)||t;if(!n||this.selectionRange.eq(n))return!1;let r=AB(this.dom,n);return r&&!this.selectionChanged&&e.inputState.lastFocusTime>Date.now()-200&&e.inputState.lastTouchTime<Date.now()-300&&YCt(this.dom,n)?(this.view.inputState.lastFocusTime=0,e.docView.updateSelection(),!1):(this.selectionRange.setRange(n),r&&(this.selectionChanged=!0),!0)}setSelectionRange(e,t){this.selectionRange.set(e.node,e.offset,t.node,t.offset),this.selectionChanged=!1}clearSelectionRange(){this.selectionRange.set(null,0,null,0)}listenForScroll(){this.parentCheck=-1;let e=0,t=null;for(let n=this.dom;n;)if(n.nodeType==1)!t&&e<this.scrollTargets.length&&this.scrollTargets[e]==n?e++:t||=this.scrollTargets.slice(0,e),t&&t.push(n),n=n.assignedSlot||n.parentNode;else if(n.nodeType==11)n=n.host;else break;if(e<this.scrollTargets.length&&!t&&(t=this.scrollTargets.slice(0,e)),t){for(let e of this.scrollTargets)e.removeEventListener(`scroll`,this.onScroll);for(let e of this.scrollTargets=t)e.addEventListener(`scroll`,this.onScroll)}}ignore(e){if(!this.active)return e();try{return this.stop(),e()}finally{this.start(),this.clear()}}start(){this.active||=(this.observer.observe(this.dom,xEt),aU&&this.dom.addEventListener(`DOMCharacterDataModified`,this.onCharData),!0)}stop(){this.active&&(this.active=!1,this.observer.disconnect(),aU&&this.dom.removeEventListener(`DOMCharacterDataModified`,this.onCharData))}clear(){this.processRecords(),this.queue.length=0,this.selectionChanged=!1}delayAndroidKey(e,t){this.delayedAndroidKey||(this.flushingAndroidKey=this.view.win.requestAnimationFrame(()=>{let e=this.delayedAndroidKey;e&&(this.clearDelayedAndroidKey(),this.view.inputState.lastKeyCode=e.keyCode,this.view.inputState.lastKeyTime=Date.now(),!this.flush()&&e.force&&RB(this.dom,e.key,e.keyCode))})),(!this.delayedAndroidKey||e==`Enter`)&&(this.delayedAndroidKey={key:e,keyCode:t,force:this.lastChange<Date.now()-50||!!this.delayedAndroidKey?.force})}clearDelayedAndroidKey(){this.win.cancelAnimationFrame(this.flushingAndroidKey),this.delayedAndroidKey=null,this.flushingAndroidKey=-1}flushSoon(){this.delayedFlush<0&&(this.delayedFlush=this.view.win.requestAnimationFrame(()=>{this.delayedFlush=-1,this.flush()}))}forceFlush(){this.delayedFlush>=0&&(this.view.win.cancelAnimationFrame(this.delayedFlush),this.delayedFlush=-1),this.flush()}pendingRecords(){for(let e of this.observer.takeRecords())this.queue.push(e);return this.queue}processRecords(){let e=this.pendingRecords();e.length&&(this.queue=[]);let t=-1,n=-1,r=!1;for(let i of e){let e=this.readMutation(i);e&&(e.typeOver&&(r=!0),t==-1?{from:t,to:n}=e:(t=Math.min(e.from,t),n=Math.max(e.to,n)))}return{from:t,to:n,typeOver:r}}readChange(){let{from:e,to:t,typeOver:n}=this.processRecords(),r=this.selectionChanged&&AB(this.dom,this.selectionRange);if(e<0&&!r)return null;e>-1&&(this.lastChange=Date.now()),this.view.inputState.lastFocusTime=0,this.selectionChanged=!1;let i=new sEt(this.view,e,t,n);return this.view.docView.domChanged={newSel:i.newSel?i.newSel.main:null},i}flush(e=!0){if(this.delayedFlush>=0||this.delayedAndroidKey)return!1;e&&this.readSelectionRange();let t=this.readChange();if(!t)return this.view.requestMeasure(),!1;let n=this.view.state,r=Wwt(this.view,t);return this.view.state==n&&(t.domChanged||t.newSel&&!t.newSel.main.eq(this.view.state.selection.main))&&this.view.update([]),r}readMutation(e){let t=this.view.docView.nearest(e.target);if(!t||t.ignoreMutation(e))return null;if(t.markDirty(e.type==`attributes`),e.type==`attributes`&&(t.flags|=4),e.type==`childList`){let n=CTt(t,e.previousSibling||e.target.previousSibling,-1),r=CTt(t,e.nextSibling||e.target.nextSibling,1);return{from:n?t.posAfter(n):t.posAtStart,to:r?t.posBefore(r):t.posAtEnd,typeOver:!1}}else if(e.type==`characterData`)return{from:t.posAtStart,to:t.posAtEnd,typeOver:e.target.nodeValue==e.oldValue};else return null}setWindow(e){e!=this.win&&(this.removeWindowListeners(this.win),this.win=e,this.addWindowListeners(this.win))}addWindowListeners(e){e.addEventListener(`resize`,this.onResize),this.printQuery?this.printQuery.addEventListener?this.printQuery.addEventListener(`change`,this.onPrint):this.printQuery.addListener(this.onPrint):e.addEventListener(`beforeprint`,this.onPrint),e.addEventListener(`scroll`,this.onScroll),e.document.addEventListener(`selectionchange`,this.onSelectionChange)}removeWindowListeners(e){e.removeEventListener(`scroll`,this.onScroll),e.removeEventListener(`resize`,this.onResize),this.printQuery?this.printQuery.removeEventListener?this.printQuery.removeEventListener(`change`,this.onPrint):this.printQuery.removeListener(this.onPrint):e.removeEventListener(`beforeprint`,this.onPrint),e.document.removeEventListener(`selectionchange`,this.onSelectionChange)}update(e){this.editContext&&(this.editContext.update(e),e.startState.facet(uH)!=e.state.facet(uH)&&(e.view.contentDOM.editContext=e.state.facet(uH)?this.editContext.editContext:null))}destroy(){var e,t,n;this.stop(),(e=this.intersection)==null||e.disconnect(),(t=this.gapIntersection)==null||t.disconnect(),(n=this.resizeScroll)==null||n.disconnect();for(let e of this.scrollTargets)e.removeEventListener(`scroll`,this.onScroll);this.removeWindowListeners(this.win),clearTimeout(this.parentCheck),clearTimeout(this.resizeTimeout),this.win.cancelAnimationFrame(this.delayedFlush),this.win.cancelAnimationFrame(this.flushingAndroidKey),this.editContext&&(this.view.contentDOM.editContext=null,this.editContext.destroy())}},CEt=class{constructor(e){this.from=0,this.to=0,this.pendingContextChange=null,this.handlers=Object.create(null),this.composing=null,this.resetRange(e.state);let t=this.editContext=new window.EditContext({text:e.state.doc.sliceString(this.from,this.to),selectionStart:this.toContextPos(Math.max(this.from,Math.min(this.to,e.state.selection.main.anchor))),selectionEnd:this.toContextPos(e.state.selection.main.head)});this.handlers.textupdate=t=>{let{anchor:n}=e.state.selection.main,r=this.toEditorPos(t.updateRangeStart),i=this.toEditorPos(t.updateRangeEnd);e.inputState.composing>=0&&!this.composing&&(this.composing={contextBase:t.updateRangeStart,editorBase:r,drifted:!1});let a={from:r,to:i,insert:Oz.of(t.text.split(`
-`))};if(a.from==this.from&&n<this.from?a.from=n:a.to==this.to&&n>this.to&&(a.to=n),!(a.from==a.to&&!a.insert.length)){if(this.pendingContextChange=a,!e.state.readOnly){let n=this.to-this.from+(a.to-a.from+a.insert.length);QB(e,a,Bz.single(this.toEditorPos(t.selectionStart,n),this.toEditorPos(t.selectionEnd,n)))}this.pendingContextChange&&(this.revertPending(e.state),this.setSelection(e.state))}},this.handlers.characterboundsupdate=n=>{let r=[],i=null;for(let t=this.toEditorPos(n.rangeStart),a=this.toEditorPos(n.rangeEnd);t<a;t++){let n=e.coordsForChar(t);i=n&&new DOMRect(n.left,n.top,n.right-n.left,n.bottom-n.top)||i||new DOMRect,r.push(i)}t.updateCharacterBounds(n.rangeStart,r)},this.handlers.textformatupdate=t=>{let n=[];for(let e of t.getTextFormats()){let t=e.underlineStyle,r=e.underlineThickness;if(t!=`None`&&r!=`None`){let i=this.toEditorPos(e.rangeStart),a=this.toEditorPos(e.rangeEnd);if(i<a){let e=`text-decoration: underline ${t==`Dashed`?`dashed `:t==`Squiggle`?`wavy `:``}${r==`Thin`?1:2}px`;n.push(NV.mark({attributes:{style:e}}).range(i,a))}}}e.dispatch({effects:lH.of(NV.set(n))})},this.handlers.compositionstart=()=>{e.inputState.composing<0&&(e.inputState.composing=0,e.inputState.compositionFirstChange=!0)},this.handlers.compositionend=()=>{if(e.inputState.composing=-1,e.inputState.compositionFirstChange=null,this.composing){let{drifted:t}=this.composing;this.composing=null,t&&this.reset(e.state)}};for(let e in this.handlers)t.addEventListener(e,this.handlers[e]);this.measureReq={read:e=>{this.editContext.updateControlBounds(e.contentDOM.getBoundingClientRect());let t=OB(e.root);t&&t.rangeCount&&this.editContext.updateSelectionBounds(t.getRangeAt(0).getBoundingClientRect())}}}applyEdits(e){let t=0,n=!1,r=this.pendingContextChange;return e.changes.iterChanges((i,a,o,s,c)=>{if(n)return;let l=c.length-(a-i);if(r&&a>=r.to)if(r.from==i&&r.to==a&&r.insert.eq(c)){r=this.pendingContextChange=null,t+=l,this.to+=l;return}else r=null,this.revertPending(e.state);if(i+=t,a+=t,a<=this.from)this.from+=l,this.to+=l;else if(i<this.to){if(i<this.from||a>this.to||this.to-this.from+c.length>3e4){n=!0;return}this.editContext.updateText(this.toContextPos(i),this.toContextPos(a),c.toString()),this.to+=l}t+=l}),r&&!n&&this.revertPending(e.state),!n}update(e){let t=this.pendingContextChange;this.composing&&(this.composing.drifted||e.transactions.some(e=>!e.isUserEvent(`input.type`)&&e.changes.touchesRange(this.from,this.to)))?(this.composing.drifted=!0,this.composing.editorBase=e.changes.mapPos(this.composing.editorBase)):!this.applyEdits(e)||!this.rangeIsValid(e.state)?(this.pendingContextChange=null,this.reset(e.state)):(e.docChanged||e.selectionSet||t)&&this.setSelection(e.state),(e.geometryChanged||e.docChanged||e.selectionSet)&&e.view.requestMeasure(this.measureReq)}resetRange(e){let{head:t}=e.selection.main;this.from=Math.max(0,t-1e4),this.to=Math.min(e.doc.length,t+1e4)}reset(e){this.resetRange(e),this.editContext.updateText(0,this.editContext.text.length,e.doc.sliceString(this.from,this.to)),this.setSelection(e)}revertPending(e){let t=this.pendingContextChange;this.pendingContextChange=null,this.editContext.updateText(this.toContextPos(t.from),this.toContextPos(t.from+t.insert.length),e.doc.sliceString(t.from,t.to))}setSelection(e){let{main:t}=e.selection,n=this.toContextPos(Math.max(this.from,Math.min(this.to,t.anchor))),r=this.toContextPos(t.head);(this.editContext.selectionStart!=n||this.editContext.selectionEnd!=r)&&this.editContext.updateSelection(n,r)}rangeIsValid(e){let{head:t}=e.selection.main;return!(this.from>0&&t-this.from<500||this.to<e.doc.length&&this.to-t<500||this.to-this.from>1e4*3)}toEditorPos(e,t=this.to-this.from){e=Math.min(e,t);let n=this.composing;return n&&n.drifted?n.editorBase+(e-n.contextBase):e+this.from}toContextPos(e){let t=this.composing;return t&&t.drifted?t.contextBase+(e-t.editorBase):e-this.from}destroy(){for(let e in this.handlers)this.editContext.removeEventListener(e,this.handlers[e])}},oU=class e{get state(){return this.viewState.state}get viewport(){return this.viewState.viewport}get visibleRanges(){return this.viewState.visibleRanges}get inView(){return this.viewState.inView}get composing(){return this.inputState.composing>0}get compositionStarted(){return this.inputState.composing>=0}get root(){return this._root}get win(){return this.dom.ownerDocument.defaultView||window}constructor(e={}){this.plugins=[],this.pluginMap=new Map,this.editorAttrs={},this.contentAttrs={},this.bidiCache=[],this.destroyed=!1,this.updateState=2,this.measureScheduled=-1,this.measureRequests=[],this.contentDOM=document.createElement(`div`),this.scrollDOM=document.createElement(`div`),this.scrollDOM.tabIndex=-1,this.scrollDOM.className=`cm-scroller`,this.scrollDOM.appendChild(this.contentDOM),this.announceDOM=document.createElement(`div`),this.announceDOM.className=`cm-announced`,this.announceDOM.setAttribute(`aria-live`,`polite`),this.dom=document.createElement(`div`),this.dom.appendChild(this.announceDOM),this.dom.appendChild(this.scrollDOM),e.parent&&e.parent.appendChild(this.dom);let{dispatch:t}=e;this.dispatchTransactions=e.dispatchTransactions||t&&(e=>e.forEach(e=>t(e,this)))||(e=>this.update(e)),this.dispatch=this.dispatch.bind(this),this._root=e.root||qCt(e.parent)||document,this.viewState=new XH(e.state||uB.create(e)),e.scrollTo&&e.scrollTo.is(cH)&&(this.viewState.scrollTarget=e.scrollTo.value.clip(this.viewState.state)),this.plugins=this.state.facet(dH).map(e=>new pH(e));for(let e of this.plugins)e.update(this);this.observer=new SEt(this),this.inputState=new cEt(this),this.inputState.ensureHandlers(this.plugins),this.docView=new wH(this),this.mountStyles(),this.updateAttrs(),this.updateState=0,this.requestMeasure(),document.fonts?.ready&&document.fonts.ready.then(()=>this.requestMeasure())}dispatch(...e){let t=e.length==1&&e[0]instanceof sB?e:e.length==1&&Array.isArray(e[0])?e[0]:[this.state.update(...e)];this.dispatchTransactions(t,this)}update(e){if(this.updateState!=0)throw Error(`Calls to EditorView.update are not allowed while an update is in progress`);let t=!1,n=!1,r,i=this.state;for(let t of e){if(t.startState!=i)throw RangeError(`Trying to update state with a transaction that doesn't start from the previous state.`);i=t.state}if(this.destroyed){this.viewState.state=i;return}let a=this.hasFocus,o=0,s=null;e.some(e=>e.annotation(RH))?(this.inputState.notifiedFocused=a,o=1):a!=this.inputState.notifiedFocused&&(this.inputState.notifiedFocused=a,s=pTt(i,a),s||(o=1));let c=this.observer.delayedAndroidKey,l=null;if(c?(this.observer.clearDelayedAndroidKey(),l=this.observer.readChange(),(l&&!this.state.doc.eq(i.doc)||!this.state.selection.eq(i.selection))&&(l=null)):this.observer.clear(),i.facet(uB.phrases)!=this.state.facet(uB.phrases))return this.setState(i);r=CH.create(this,i,e),r.flags|=o;let u=this.viewState.scrollTarget;try{this.updateState=2;for(let t of e){if(u&&=u.map(t.changes),t.scrollIntoView){let{main:e}=t.state.selection;u=new sH(e.empty?e:Bz.cursor(e.head,e.head>e.anchor?-1:1))}for(let e of t.effects)e.is(cH)&&(u=e.value.clip(this.state))}this.viewState.update(r,u),this.bidiCache=cU.update(this.bidiCache,r.changes),r.empty||(this.updatePlugins(r),this.inputState.update(r)),t=this.docView.update(r),this.state.facet(xH)!=this.styleModules&&this.mountStyles(),n=this.updateAttrs(),this.showAnnouncements(e),this.docView.updateSelection(t,e.some(e=>e.isUserEvent(`select.pointer`)))}finally{this.updateState=0}if(r.startState.facet($H)!=r.state.facet($H)&&(this.viewState.mustMeasureContent=!0),(t||n||u||this.viewState.mustEnforceCursorAssoc||this.viewState.mustMeasureContent)&&this.requestMeasure(),t&&this.docViewUpdate(),!r.empty)for(let e of this.state.facet(eH))try{e(r)}catch(e){KB(this.state,e,`update listener`)}(s||l)&&Promise.resolve().then(()=>{s&&this.state==s.startState&&this.dispatch(s),l&&!Wwt(this,l)&&c.force&&RB(this.contentDOM,c.key,c.keyCode)})}setState(e){if(this.updateState!=0)throw Error(`Calls to EditorView.setState are not allowed while an update is in progress`);if(this.destroyed){this.viewState.state=e;return}this.updateState=2;let t=this.hasFocus;try{for(let e of this.plugins)e.destroy(this);this.viewState=new XH(e),this.plugins=e.facet(dH).map(e=>new pH(e)),this.pluginMap.clear();for(let e of this.plugins)e.update(this);this.docView.destroy(),this.docView=new wH(this),this.inputState.ensureHandlers(this.plugins),this.mountStyles(),this.updateAttrs(),this.bidiCache=[]}finally{this.updateState=0}t&&this.focus(),this.requestMeasure()}updatePlugins(e){let t=e.startState.facet(dH),n=e.state.facet(dH);if(t!=n){let r=[];for(let i of n){let n=t.indexOf(i);if(n<0)r.push(new pH(i));else{let t=this.plugins[n];t.mustUpdate=e,r.push(t)}}for(let t of this.plugins)t.mustUpdate!=e&&t.destroy(this);this.plugins=r,this.pluginMap.clear()}else for(let t of this.plugins)t.mustUpdate=e;for(let e=0;e<this.plugins.length;e++)this.plugins[e].update(this);t!=n&&this.inputState.ensureHandlers(this.plugins)}docViewUpdate(){for(let e of this.plugins){let t=e.value;if(t&&t.docViewUpdate)try{t.docViewUpdate(this)}catch(e){KB(this.state,e,`doc view update listener`)}}}measure(e=!0){if(this.destroyed)return;if(this.measureScheduled>-1&&this.win.cancelAnimationFrame(this.measureScheduled),this.observer.delayedAndroidKey){this.measureScheduled=-1,this.requestMeasure();return}this.measureScheduled=0,e&&this.observer.forceFlush();let t=null,n=this.scrollDOM,r=n.scrollTop*this.scaleY,{scrollAnchorPos:i,scrollAnchorHeight:a}=this.viewState;Math.abs(r-this.viewState.scrollTop)>1&&(a=-1),this.viewState.scrollAnchorHeight=-1;try{for(let e=0;;e++){if(a<0)if(XCt(n))i=-1,a=this.viewState.heightMap.height;else{let e=this.viewState.scrollAnchorAt(r);i=e.from,a=e.top}this.updateState=1;let o=this.viewState.measure(this);if(!o&&!this.measureRequests.length&&this.viewState.scrollTarget==null)break;if(e>5){console.warn(this.measureRequests.length?`Measure loop restarted more than 5 times`:`Viewport failed to stabilize`);break}let s=[];o&4||([this.measureRequests,s]=[s,this.measureRequests]);let c=s.map(e=>{try{return e.read(this)}catch(e){return KB(this.state,e),sU}}),l=CH.create(this,this.state,[]),u=!1;l.flags|=o,t?t.flags|=o:t=l,this.updateState=2,l.empty||(this.updatePlugins(l),this.inputState.update(l),this.updateAttrs(),u=this.docView.update(l),u&&this.docViewUpdate());for(let e=0;e<s.length;e++)if(c[e]!=sU)try{let t=s[e];t.write&&t.write(c[e],this)}catch(e){KB(this.state,e)}if(u&&this.docView.updateSelection(!0),!l.viewportChanged&&this.measureRequests.length==0){if(this.viewState.editorHeight)if(this.viewState.scrollTarget){this.docView.scrollIntoView(this.viewState.scrollTarget),this.viewState.scrollTarget=null,a=-1;continue}else{let e=(i<0?this.viewState.heightMap.height:this.viewState.lineBlockAt(i).top)-a;if(e>1||e<-1){r+=e,n.scrollTop=r/this.scaleY,a=-1;continue}}break}}}finally{this.updateState=0,this.measureScheduled=-1}if(t&&!t.empty)for(let e of this.state.facet(eH))e(t)}get themeClasses(){return tU+` `+(this.state.facet(eU)?rU:nU)+` `+this.state.facet($H)}updateAttrs(){let e=ETt(this,mH,{class:`cm-editor`+(this.hasFocus?` cm-focused `:` `)+this.themeClasses}),t={spellcheck:`false`,autocorrect:`off`,autocapitalize:`off`,writingsuggestions:`false`,translate:`no`,contenteditable:this.state.facet(uH)?`true`:`false`,class:`cm-content`,style:`${TV.tabSize}: ${this.state.tabSize}`,role:`textbox`,"aria-multiline":`true`};this.state.readOnly&&(t[`aria-readonly`]=`true`),ETt(this,hH,t);let n=this.observer.ignore(()=>{let n=VB(this.contentDOM,this.contentAttrs,t),r=VB(this.dom,this.editorAttrs,e);return n||r});return this.editorAttrs=e,this.contentAttrs=t,n}showAnnouncements(t){let n=!0;for(let r of t)for(let t of r.effects)if(t.is(e.announce)){n&&(this.announceDOM.textContent=``),n=!1;let e=this.announceDOM.appendChild(document.createElement(`div`));e.textContent=t.value}}mountStyles(){this.styleModules=this.state.facet(xH);let t=this.state.facet(e.cspNonce);CB.mount(this.root,this.styleModules.concat(bEt).reverse(),t?{nonce:t}:void 0)}readMeasured(){if(this.updateState==2)throw Error(`Reading the editor layout isn't allowed during an update`);this.updateState==0&&this.measureScheduled>-1&&this.measure(!1)}requestMeasure(e){if(this.measureScheduled<0&&(this.measureScheduled=this.win.requestAnimationFrame(()=>this.measure())),e){if(this.measureRequests.indexOf(e)>-1)return;if(e.key!=null){for(let t=0;t<this.measureRequests.length;t++)if(this.measureRequests[t].key===e.key){this.measureRequests[t]=e;return}}this.measureRequests.push(e)}}plugin(e){let t=this.pluginMap.get(e);return(t===void 0||t&&t.spec!=e)&&this.pluginMap.set(e,t=this.plugins.find(t=>t.spec==e)||null),t&&t.update(this).value}get documentTop(){return this.contentDOM.getBoundingClientRect().top+this.viewState.paddingTop}get documentPadding(){return{top:this.viewState.paddingTop,bottom:this.viewState.paddingBottom}}get scaleX(){return this.viewState.scaleX}get scaleY(){return this.viewState.scaleY}elementAtHeight(e){return this.readMeasured(),this.viewState.elementAtHeight(e)}lineBlockAtHeight(e){return this.readMeasured(),this.viewState.lineBlockAtHeight(e)}get viewportLineBlocks(){return this.viewState.viewportLines}lineBlockAt(e){return this.viewState.lineBlockAt(e)}get contentHeight(){return this.viewState.contentHeight}moveByChar(e,t,n){return ZB(this,e,Bwt(this,e,t,n))}moveByGroup(e,t){return ZB(this,e,Bwt(this,e,t,t=>Vwt(this,e.head,t)))}visualLineSide(e,t){let n=this.bidiSpans(e),r=this.textDirectionAt(e.from),i=n[t?n.length-1:0];return Bz.cursor(i.side(t,r)+e.from,i.forward(!t,r)?1:-1)}moveToLineBoundary(e,t,n=!0){return zwt(this,e,t,n)}moveVertically(e,t,n){return ZB(this,e,Hwt(this,e,t,n))}domAtPos(e){return this.docView.domAtPos(e)}posAtDOM(e,t=0){return this.docView.posFromDOM(e,t)}posAtCoords(e,t=!0){return this.readMeasured(),Pwt(this,e,t)}coordsAtPos(e,t=1){this.readMeasured();let n=this.docView.coordsAt(e,t);if(!n||n.left==n.right)return n;let r=this.state.doc.lineAt(e),i=this.bidiSpans(r),a=i[qV.find(i,e-r.from,-1,t)];return IB(n,a.dir==HV.LTR==t>0)}coordsForChar(e){return this.readMeasured(),this.docView.coordsForChar(e)}get defaultCharacterWidth(){return this.viewState.heightOracle.charWidth}get defaultLineHeight(){return this.viewState.heightOracle.lineHeight}get textDirection(){return this.viewState.defaultTextDirection}textDirectionAt(e){return!this.state.facet(aH)||e<this.viewport.from||e>this.viewport.to?this.textDirection:(this.readMeasured(),this.docView.textDirectionAt(e))}get lineWrapping(){return this.viewState.heightOracle.lineWrapping}bidiSpans(e){if(e.length>wEt)return _wt(e.length);let t=this.textDirectionAt(e.from),n;for(let r of this.bidiCache)if(r.from==e.from&&r.dir==t&&(r.fresh||fwt(r.isolates,n=bwt(this,e))))return r.order;n||=bwt(this,e);let r=gwt(e.text,t,n);return this.bidiCache.push(new cU(e.from,e.to,t,n,!0,r)),r}get hasFocus(){return(this.dom.ownerDocument.hasFocus()||TV.safari&&this.inputState?.lastContextMenu>Date.now()-3e4)&&this.root.activeElement==this.contentDOM}focus(){this.observer.ignore(()=>{KCt(this.contentDOM),this.docView.updateSelection()})}setRoot(e){this._root!=e&&(this._root=e,this.observer.setWindow((e.nodeType==9?e:e.ownerDocument).defaultView||window),this.mountStyles())}destroy(){this.root.activeElement==this.contentDOM&&this.contentDOM.blur();for(let e of this.plugins)e.destroy(this);this.plugins=[],this.inputState.destroy(),this.docView.destroy(),this.dom.remove(),this.observer.destroy(),this.measureScheduled>-1&&this.win.cancelAnimationFrame(this.measureScheduled),this.destroyed=!0}static scrollIntoView(e,t={}){return cH.of(new sH(typeof e==`number`?Bz.cursor(e):e,t.y,t.x,t.yMargin,t.xMargin))}scrollSnapshot(){let{scrollTop:e,scrollLeft:t}=this.scrollDOM,n=this.viewState.scrollAnchorAt(e);return cH.of(new sH(Bz.cursor(n.from),`start`,`start`,n.top-e,t,!0))}setTabFocusMode(e){e==null?this.inputState.tabFocusMode=this.inputState.tabFocusMode<0?0:-1:typeof e==`boolean`?this.inputState.tabFocusMode=e?0:-1:this.inputState.tabFocusMode!=0&&(this.inputState.tabFocusMode=Date.now()+e)}static domEventHandlers(e){return fH.define(()=>({}),{eventHandlers:e})}static domEventObservers(e){return fH.define(()=>({}),{eventObservers:e})}static theme(e,t){let n=CB.newName(),r=[$H.of(n),xH.of(aV(`.${n}`,e))];return t&&t.dark&&r.push(eU.of(!0)),r}static baseTheme(e){return qz.lowest(xH.of(aV(`.`+tU,e,iU)))}static findFromDOM(e){let t=e.querySelector(`.cm-content`);return(t&&fV.get(t)||fV.get(e))?.rootView?.view||null}},oU.styleModule=xH,oU.inputHandler=tH,oU.clipboardInputFilter=rH,oU.clipboardOutputFilter=iH,oU.scrollHandler=oH,oU.focusChangeEffect=nH,oU.perLineTextDirection=aH,oU.exceptionSink=$V,oU.updateListener=eH,oU.editable=uH,oU.mouseSelectionStyle=QV,oU.dragMovesSelection=ZV,oU.clickAddsSelectionRange=XV,oU.decorations=gH,oU.outerDecorations=_H,oU.atomicRanges=vH,oU.bidiIsolatedRanges=yH,oU.scrollMargins=bH,oU.darkTheme=eU,oU.cspNonce=Hz.define({combine:e=>e.length?e[0]:``}),oU.contentAttributes=hH,oU.editorAttributes=mH,oU.lineWrapping=oU.contentAttributes.of({class:`cm-lineWrapping`}),oU.announce=oB.define(),wEt=4096,sU={},cU=class e{constructor(e,t,n,r,i,a){this.from=e,this.to=t,this.dir=n,this.isolates=r,this.fresh=i,this.order=a}static update(t,n){if(n.empty&&!t.some(e=>e.fresh))return t;let r=[],i=t.length?t[t.length-1].dir:HV.LTR;for(let a=Math.max(0,t.length-10);a<t.length;a++){let o=t[a];o.dir==i&&!n.touchesRange(o.from,o.to)&&r.push(new e(n.mapPos(o.from,1),n.mapPos(o.to,-1),o.dir,o.isolates,!1,o.order))}return r}},TEt=TV.mac?`mac`:TV.windows?`win`:TV.linux?`linux`:`key`,EEt=qz.default(oU.domEventHandlers({keydown(e,t){return ATt(OTt(t.state),e,t,`editor`)}})),lU=Hz.define({enables:EEt}),uU=new WeakMap,dU=null,DEt=4e3,fU=null,OEt=!(TV.ios&&TV.webkit&&TV.webkit_version<534),pU={".cm-line":{"& ::selection, &::selection":{backgroundColor:`transparent !important`}},".cm-content":{"& :focus":{caretColor:`initial !important`,"&::selection, & ::selection":{backgroundColor:`Highlight !important`}}}},OEt&&(pU[`.cm-line`].caretColor=pU[`.cm-content`].caretColor=`transparent !important`),mU=class{constructor(e){let{regexp:t,decoration:n,decorate:r,boundary:i,maxLength:a=1e3}=e;if(!t.global)throw RangeError(`The regular expression given to MatchDecorator should have its 'g' flag set`);if(this.regexp=t,r)this.addMatch=(e,t,n,i)=>r(i,n,n+e[0].length,e,t);else if(typeof n==`function`)this.addMatch=(e,t,r,i)=>{let a=n(e,t,r);a&&i(r,r+e[0].length,a)};else if(n)this.addMatch=(e,t,r,i)=>i(r,r+e[0].length,n);else throw RangeError(`Either 'decorate' or 'decoration' should be provided to MatchDecorator`);this.boundary=i,this.maxLength=a}createDeco(e){let t=new mB,n=t.add.bind(t);for(let{from:t,to:r}of MTt(e,this.maxLength))jTt(e.state.doc,this.regexp,t,r,(t,r)=>this.addMatch(r,e,t,n));return t.finish()}updateDeco(e,t){let n=1e9,r=-1;return e.docChanged&&e.changes.iterChanges((t,i,a,o)=>{o>e.view.viewport.from&&a<e.view.viewport.to&&(n=Math.min(a,n),r=Math.max(o,r))}),e.viewportChanged||r-n>1e3?this.createDeco(e.view):r>-1?this.updateRange(e.view,t.map(e.changes),n,r):t}updateRange(e,t,n,r){for(let i of e.visibleRanges){let a=Math.max(i.from,n),o=Math.min(i.to,r);if(o>a){let n=e.state.doc.lineAt(a),r=n.to<o?e.state.doc.lineAt(o):n,s=Math.max(i.from,n.from),c=Math.min(i.to,r.to);if(this.boundary){for(;a>n.from;a--)if(this.boundary.test(n.text[a-1-n.from])){s=a;break}for(;o<r.to;o++)if(this.boundary.test(r.text[o-r.from])){c=o;break}}let l=[],u,d=(e,t,n)=>l.push(n.range(e,t));if(n==r)for(this.regexp.lastIndex=s-n.from;(u=this.regexp.exec(n.text))&&u.index<c-n.from;)this.addMatch(u,e,u.index+n.from,d);else jTt(e.state.doc,this.regexp,s,c,(t,n)=>this.addMatch(n,e,t,d));t=t.update({filterFrom:s,filterTo:c,filter:(e,t)=>e<s||t>c,add:l})}}return t}},hU=/x/.unicode==null?`g`:`gu`,kEt=RegExp(`[\0-\b
---Ÿ­؜​‎‏\u2028\u2029‭‮⁦⁧⁩-]`,hU),AEt={0:`null`,7:`bell`,8:`backspace`,10:`newline`,11:`vertical tab`,13:`carriage return`,27:`escape`,8203:`zero width space`,8204:`zero width non-joiner`,8205:`zero width joiner`,8206:`left-to-right mark`,8207:`right-to-left mark`,8232:`line separator`,8237:`left-to-right override`,8238:`right-to-left override`,8294:`left-to-right isolate`,8295:`right-to-left isolate`,8297:`pop directional isolate`,8233:`paragraph separator`,65279:`zero width no-break space`,65532:`object replacement`},gU=null,_U=Hz.define({combine(e){let t=xz(e,{render:null,specialChars:kEt,addSpecialChars:null});return(t.replaceTabs=!NTt())&&(t.specialChars=RegExp(`	|`+t.specialChars.source,hU)),t.addSpecialChars&&(t.specialChars=RegExp(t.specialChars.source+`|`+t.addSpecialChars.source,hU)),t}}),jEt=null,MEt=`•`,NEt=class extends jV{constructor(e,t){super(),this.options=e,this.code=t}eq(e){return e.code==this.code}toDOM(e){let t=ITt(this.code),n=e.state.phrase(`Control character`)+` `+(AEt[this.code]||`0x`+this.code.toString(16)),r=this.options.render&&this.options.render(this.code,n,t);if(r)return r;let i=document.createElement(`span`);return i.textContent=t,i.title=n,i.setAttribute(`aria-label`,n),i.className=`cm-specialChar`,i}ignoreEvent(){return!1}},PEt=class extends jV{constructor(e){super(),this.width=e}eq(e){return e.width==this.width}toDOM(){let e=document.createElement(`span`);return e.textContent=`	`,e.className=`cm-tab`,e.style.width=this.width+`px`,e}ignoreEvent(){return!1}},FEt=class extends jV{constructor(e){super(),this.content=e}toDOM(e){let t=document.createElement(`span`);return t.className=`cm-placeholder`,t.style.pointerEvents=`none`,t.appendChild(typeof this.content==`string`?document.createTextNode(this.content):typeof this.content==`function`?this.content(e):this.content.cloneNode(!0)),typeof this.content==`string`?t.setAttribute(`aria-label`,`placeholder `+this.content):t.setAttribute(`aria-hidden`,`true`),t}coordsAt(e){let t=e.firstChild?jB(e.firstChild):[];if(!t.length)return null;let n=window.getComputedStyle(e.parentNode),r=IB(t[0],n.direction!=`rtl`),i=parseInt(n.lineHeight);return r.bottom-r.top>i*1.5?{left:r.left,right:r.right,top:r.top,bottom:r.top+i}:r}ignoreEvent(){return!1}},vU=`-10000px`,yU=class{constructor(e,t,n,r){this.facet=t,this.createTooltipView=n,this.removeTooltipView=r,this.input=e.state.facet(t),this.tooltips=this.input.filter(e=>e);let i=null;this.tooltipViews=this.tooltips.map(e=>i=n(e,i))}update(e,t){var n;let r=e.state.facet(this.facet),i=r.filter(e=>e);if(r===this.input){for(let t of this.tooltipViews)t.update&&t.update(e);return!1}let a=[],o=t?[]:null;for(let n=0;n<i.length;n++){let r=i[n],s=-1;if(r){for(let e=0;e<this.tooltips.length;e++){let t=this.tooltips[e];t&&t.create==r.create&&(s=e)}if(s<0)a[n]=this.createTooltipView(r,n?a[n-1]:null),o&&(o[n]=!!r.above);else{let r=a[n]=this.tooltipViews[s];o&&(o[n]=t[s]),r.update&&r.update(e)}}}for(let e of this.tooltipViews)a.indexOf(e)<0&&(this.removeTooltipView(e),(n=e.destroy)==null||n.call(e));return t&&(o.forEach((e,n)=>t[n]=e),t.length=o.length),this.input=r,this.tooltips=i,this.tooltipViews=a,!0}},bU=Hz.define({combine:e=>({position:TV.ios?`absolute`:e.find(e=>e.position)?.position||`fixed`,parent:e.find(e=>e.parent)?.parent||null,tooltipSpace:e.find(e=>e.tooltipSpace)?.tooltipSpace||RTt})}),xU=new WeakMap,SU=fH.fromClass(class{constructor(e){this.view=e,this.above=[],this.inView=!0,this.madeAbsolute=!1,this.lastTransaction=0,this.measureTimeout=-1;let t=e.state.facet(bU);this.position=t.position,this.parent=t.parent,this.classes=e.themeClasses,this.createContainer(),this.measureReq={read:this.readMeasure.bind(this),write:this.writeMeasure.bind(this),key:this},this.resizeObserver=typeof ResizeObserver==`function`?new ResizeObserver(()=>this.measureSoon()):null,this.manager=new yU(e,CU,(e,t)=>this.createTooltip(e,t),e=>{this.resizeObserver&&this.resizeObserver.unobserve(e.dom),e.dom.remove()}),this.above=this.manager.tooltips.map(e=>!!e.above),this.intersectionObserver=typeof IntersectionObserver==`function`?new IntersectionObserver(e=>{Date.now()>this.lastTransaction-50&&e.length>0&&e[e.length-1].intersectionRatio<1&&this.measureSoon()},{threshold:[1]}):null,this.observeIntersection(),e.win.addEventListener(`resize`,this.measureSoon=this.measureSoon.bind(this)),this.maybeMeasure()}createContainer(){this.parent?(this.container=document.createElement(`div`),this.container.style.position=`relative`,this.container.className=this.view.themeClasses,this.parent.appendChild(this.container)):this.container=this.view.dom}observeIntersection(){if(this.intersectionObserver){this.intersectionObserver.disconnect();for(let e of this.manager.tooltipViews)this.intersectionObserver.observe(e.dom)}}measureSoon(){this.measureTimeout<0&&(this.measureTimeout=setTimeout(()=>{this.measureTimeout=-1,this.maybeMeasure()},50))}update(e){e.transactions.length&&(this.lastTransaction=Date.now());let t=this.manager.update(e,this.above);t&&this.observeIntersection();let n=t||e.geometryChanged,r=e.state.facet(bU);if(r.position!=this.position&&!this.madeAbsolute){this.position=r.position;for(let e of this.manager.tooltipViews)e.dom.style.position=this.position;n=!0}if(r.parent!=this.parent){this.parent&&this.container.remove(),this.parent=r.parent,this.createContainer();for(let e of this.manager.tooltipViews)this.container.appendChild(e.dom);n=!0}else this.parent&&this.view.themeClasses!=this.classes&&(this.classes=this.container.className=this.view.themeClasses);n&&this.maybeMeasure()}createTooltip(e,t){let n=e.create(this.view),r=t?t.dom:null;if(n.dom.classList.add(`cm-tooltip`),e.arrow&&!n.dom.querySelector(`.cm-tooltip > .cm-tooltip-arrow`)){let e=document.createElement(`div`);e.className=`cm-tooltip-arrow`,n.dom.appendChild(e)}return n.dom.style.position=this.position,n.dom.style.top=vU,n.dom.style.left=`0px`,this.container.insertBefore(n.dom,r),n.mount&&n.mount(this.view),this.resizeObserver&&this.resizeObserver.observe(n.dom),n}destroy(){var e,t,n;this.view.win.removeEventListener(`resize`,this.measureSoon);for(let t of this.manager.tooltipViews)t.dom.remove(),(e=t.destroy)==null||e.call(t);this.parent&&this.container.remove(),(t=this.resizeObserver)==null||t.disconnect(),(n=this.intersectionObserver)==null||n.disconnect(),clearTimeout(this.measureTimeout)}readMeasure(){let e=1,t=1,n=!1;if(this.position==`fixed`&&this.manager.tooltipViews.length){let{dom:e}=this.manager.tooltipViews[0];if(TV.gecko)n=e.offsetParent!=this.container.ownerDocument.body;else if(e.style.top==vU&&e.style.left==`0px`){let t=e.getBoundingClientRect();n=Math.abs(t.top+1e4)>1||Math.abs(t.left)>1}}if(n||this.position==`absolute`)if(this.parent){let n=this.parent.getBoundingClientRect();n.width&&n.height&&(e=n.width/this.parent.offsetWidth,t=n.height/this.parent.offsetHeight)}else ({scaleX:e,scaleY:t}=this.view.viewState);let r=this.view.scrollDOM.getBoundingClientRect(),i=qB(this.view);return{visible:{left:r.left+i.left,top:r.top+i.top,right:r.right-i.right,bottom:r.bottom-i.bottom},parent:this.parent?this.container.getBoundingClientRect():this.view.dom.getBoundingClientRect(),pos:this.manager.tooltips.map((e,t)=>{let n=this.manager.tooltipViews[t];return n.getCoords?n.getCoords(e.pos):this.view.coordsAtPos(e.pos)}),size:this.manager.tooltipViews.map(({dom:e})=>e.getBoundingClientRect()),space:this.view.state.facet(bU).tooltipSpace(this.view),scaleX:e,scaleY:t,makeAbsolute:n}}writeMeasure(e){if(e.makeAbsolute){this.madeAbsolute=!0,this.position=`absolute`;for(let e of this.manager.tooltipViews)e.dom.style.position=`absolute`}let{visible:t,space:n,scaleX:r,scaleY:i}=e,a=[];for(let o=0;o<this.manager.tooltips.length;o++){let s=this.manager.tooltips[o],c=this.manager.tooltipViews[o],{dom:l}=c,u=e.pos[o],d=e.size[o];if(!u||s.clip!==!1&&(u.bottom<=Math.max(t.top,n.top)||u.top>=Math.min(t.bottom,n.bottom)||u.right<Math.max(t.left,n.left)-.1||u.left>Math.min(t.right,n.right)+.1)){l.style.top=vU;continue}let f=s.arrow?c.dom.querySelector(`.cm-tooltip-arrow`):null,p=f?7:0,m=d.right-d.left,h=xU.get(c)??d.bottom-d.top,g=c.offset||LEt,_=this.view.textDirection==HV.LTR,v=d.width>n.right-n.left?_?n.left:n.right-d.width:_?Math.max(n.left,Math.min(u.left-(f?14:0)+g.x,n.right-m)):Math.min(Math.max(n.left,u.left-m+(f?14:0)-g.x),n.right-m),y=this.above[o];!s.strictSide&&(y?u.top-h-p-g.y<n.top:u.bottom+h+p+g.y>n.bottom)&&y==n.bottom-u.bottom>u.top-n.top&&(y=this.above[o]=!y);let b=(y?u.top-n.top:n.bottom-u.bottom)-p;if(b<h&&c.resize!==!1){if(b<this.view.defaultLineHeight){l.style.top=vU;continue}xU.set(c,h),l.style.height=(h=b)/i+`px`}else l.style.height&&(l.style.height=``);let x=y?u.top-h-p-g.y:u.bottom+p+g.y,S=v+m;if(c.overlap!==!0)for(let e of a)e.left<S&&e.right>v&&e.top<x+h&&e.bottom>x&&(x=y?e.top-h-2-p:e.bottom+p+2);if(this.position==`absolute`?(l.style.top=(x-e.parent.top)/i+`px`,zTt(l,(v-e.parent.left)/r)):(l.style.top=x/i+`px`,zTt(l,v/r)),f){let e=u.left+(_?g.x:-g.x)-(v+14-7);f.style.left=e/r+`px`}c.overlap!==!0&&a.push({left:v,top:x,right:S,bottom:x+h}),l.classList.toggle(`cm-tooltip-above`,y),l.classList.toggle(`cm-tooltip-below`,!y),c.positioned&&c.positioned(e.space)}}maybeMeasure(){if(this.manager.tooltips.length&&(this.view.inView&&this.view.requestMeasure(this.measureReq),this.inView!=this.view.inView&&(this.inView=this.view.inView,!this.inView)))for(let e of this.manager.tooltipViews)e.dom.style.top=vU}},{eventObservers:{scroll(){this.maybeMeasure()}}}),IEt=oU.baseTheme({".cm-tooltip":{zIndex:500,boxSizing:`border-box`},"&light .cm-tooltip":{border:`1px solid #bbb`,backgroundColor:`#f5f5f5`},"&light .cm-tooltip-section:not(:first-child)":{borderTop:`1px solid #bbb`},"&dark .cm-tooltip":{backgroundColor:`#333338`,color:`white`},".cm-tooltip-arrow":{height:`7px`,width:`14px`,position:`absolute`,zIndex:-1,overflow:`hidden`,"&:before, &:after":{content:`''`,position:`absolute`,width:0,height:0,borderLeft:`7px solid transparent`,borderRight:`7px solid transparent`},".cm-tooltip-above &":{bottom:`-7px`,"&:before":{borderTop:`7px solid #bbb`},"&:after":{borderTop:`7px solid #f5f5f5`,bottom:`1px`}},".cm-tooltip-below &":{top:`-7px`,"&:before":{borderBottom:`7px solid #bbb`},"&:after":{borderBottom:`7px solid #f5f5f5`,top:`1px`}}},"&dark .cm-tooltip .cm-tooltip-arrow":{"&:before":{borderTopColor:`#333338`,borderBottomColor:`#333338`},"&:after":{borderTopColor:`transparent`,borderBottomColor:`transparent`}}}),LEt={x:0,y:0},CU=Hz.define({enables:[SU,IEt]}),wU=Hz.define({combine:e=>e.reduce((e,t)=>e.concat(t),[])}),TU=class e{static create(t){return new e(t)}constructor(e){this.view=e,this.mounted=!1,this.dom=document.createElement(`div`),this.dom.classList.add(`cm-tooltip-hover`),this.manager=new yU(e,wU,(e,t)=>this.createHostedView(e,t),e=>e.dom.remove())}createHostedView(e,t){let n=e.create(this.view);return n.dom.classList.add(`cm-tooltip-section`),this.dom.insertBefore(n.dom,t?t.dom.nextSibling:this.dom.firstChild),this.mounted&&n.mount&&n.mount(this.view),n}mount(e){for(let t of this.manager.tooltipViews)t.mount&&t.mount(e);this.mounted=!0}positioned(e){for(let t of this.manager.tooltipViews)t.positioned&&t.positioned(e)}update(e){this.manager.update(e)}destroy(){var e;for(let t of this.manager.tooltipViews)(e=t.destroy)==null||e.call(t)}passProp(e){let t;for(let n of this.manager.tooltipViews){let r=n[e];if(r!==void 0){if(t===void 0)t=r;else if(t!==r)return}}return t}get offset(){return this.passProp(`offset`)}get getCoords(){return this.passProp(`getCoords`)}get overlap(){return this.passProp(`overlap`)}get resize(){return this.passProp(`resize`)}},REt=CU.compute([wU],e=>{let t=e.facet(wU);return t.length===0?null:{pos:Math.min(...t.map(e=>e.pos)),end:Math.max(...t.map(e=>e.end??e.pos)),create:TU.create,above:t[0].above,arrow:t.some(e=>e.arrow)}}),zEt=class{constructor(e,t,n,r,i){this.view=e,this.source=t,this.field=n,this.setHover=r,this.hoverTime=i,this.hoverTimeout=-1,this.restartTimeout=-1,this.pending=null,this.lastMove={x:0,y:0,target:e.dom,time:0},this.checkHover=this.checkHover.bind(this),e.dom.addEventListener(`mouseleave`,this.mouseleave=this.mouseleave.bind(this)),e.dom.addEventListener(`mousemove`,this.mousemove=this.mousemove.bind(this))}update(){this.pending&&(this.pending=null,clearTimeout(this.restartTimeout),this.restartTimeout=setTimeout(()=>this.startHover(),20))}get active(){return this.view.state.field(this.field)}checkHover(){if(this.hoverTimeout=-1,this.active.length)return;let e=Date.now()-this.lastMove.time;e<this.hoverTime?this.hoverTimeout=setTimeout(this.checkHover,this.hoverTime-e):this.startHover()}startHover(){clearTimeout(this.restartTimeout);let{view:e,lastMove:t}=this,n=e.docView.nearest(t.target);if(!n)return;let r,i=1;if(n instanceof OV)r=n.posAtStart;else{if(r=e.posAtCoords(t),r==null)return;let n=e.coordsAtPos(r);if(!n||t.y<n.top||t.y>n.bottom||t.x<n.left-e.defaultCharacterWidth||t.x>n.right+e.defaultCharacterWidth)return;let a=e.bidiSpans(e.state.doc.lineAt(r)).find(e=>e.from<=r&&e.to>=r),o=a&&a.dir==HV.RTL?-1:1;i=t.x<n.left?-o:o}let a=this.source(e,r,i);if(a?.then){let t=this.pending={pos:r};a.then(n=>{this.pending==t&&(this.pending=null,n&&!(Array.isArray(n)&&!n.length)&&e.dispatch({effects:this.setHover.of(Array.isArray(n)?n:[n])}))},t=>KB(e.state,t,`hover tooltip`))}else a&&!(Array.isArray(a)&&!a.length)&&e.dispatch({effects:this.setHover.of(Array.isArray(a)?a:[a])})}get tooltip(){let e=this.view.plugin(SU),t=e?e.manager.tooltips.findIndex(e=>e.create==TU.create):-1;return t>-1?e.manager.tooltipViews[t]:null}mousemove(e){this.lastMove={x:e.clientX,y:e.clientY,target:e.target,time:Date.now()},this.hoverTimeout<0&&(this.hoverTimeout=setTimeout(this.checkHover,this.hoverTime));let{active:t,tooltip:n}=this;if(t.length&&n&&!BTt(n.dom,e)||this.pending){let{pos:n}=t[0]||this.pending,r=t[0]?.end??n;(n==r?this.view.posAtCoords(this.lastMove)!=n:!VTt(this.view,n,r,e.clientX,e.clientY))&&(this.view.dispatch({effects:this.setHover.of([])}),this.pending=null)}}mouseleave(e){clearTimeout(this.hoverTimeout),this.hoverTimeout=-1;let{active:t}=this;if(t.length){let{tooltip:t}=this;t&&t.dom.contains(e.relatedTarget)?this.watchTooltipLeave(t.dom):this.view.dispatch({effects:this.setHover.of([])})}}watchTooltipLeave(e){let t=n=>{e.removeEventListener(`mouseleave`,t),this.active.length&&!this.view.dom.contains(n.relatedTarget)&&this.view.dispatch({effects:this.setHover.of([])})};e.addEventListener(`mouseleave`,t)}destroy(){clearTimeout(this.hoverTimeout),this.view.dom.removeEventListener(`mouseleave`,this.mouseleave),this.view.dom.removeEventListener(`mousemove`,this.mousemove)}},EU=4,BEt=oB.define(),DU=Hz.define({combine(e){let t,n;for(let r of e)t||=r.topContainer,n||=r.bottomContainer;return{topContainer:t,bottomContainer:n}}}),VEt=fH.fromClass(class{constructor(e){this.input=e.state.facet(kU),this.specs=this.input.filter(e=>e),this.panels=this.specs.map(t=>t(e));let t=e.state.facet(DU);this.top=new OU(e,!0,t.topContainer),this.bottom=new OU(e,!1,t.bottomContainer),this.top.sync(this.panels.filter(e=>e.top)),this.bottom.sync(this.panels.filter(e=>!e.top));for(let e of this.panels)e.dom.classList.add(`cm-panel`),e.mount&&e.mount()}update(e){let t=e.state.facet(DU);this.top.container!=t.topContainer&&(this.top.sync([]),this.top=new OU(e.view,!0,t.topContainer)),this.bottom.container!=t.bottomContainer&&(this.bottom.sync([]),this.bottom=new OU(e.view,!1,t.bottomContainer)),this.top.syncClasses(),this.bottom.syncClasses();let n=e.state.facet(kU);if(n!=this.input){let t=n.filter(e=>e),r=[],i=[],a=[],o=[];for(let n of t){let t=this.specs.indexOf(n),s;t<0?(s=n(e.view),o.push(s)):(s=this.panels[t],s.update&&s.update(e)),r.push(s),(s.top?i:a).push(s)}this.specs=t,this.panels=r,this.top.sync(i),this.bottom.sync(a);for(let e of o)e.dom.classList.add(`cm-panel`),e.mount&&e.mount()}else for(let t of this.panels)t.update&&t.update(e)}destroy(){this.top.sync([]),this.bottom.sync([])}},{provide:e=>oU.scrollMargins.of(t=>{let n=t.plugin(e);return n&&{top:n.top.scrollMargin(),bottom:n.bottom.scrollMargin()}})}),OU=class{constructor(e,t,n){this.view=e,this.top=t,this.container=n,this.dom=void 0,this.classes=``,this.panels=[],this.syncClasses()}sync(e){for(let t of this.panels)t.destroy&&e.indexOf(t)<0&&t.destroy();this.panels=e,this.syncDOM()}syncDOM(){if(this.panels.length==0){this.dom&&=(this.dom.remove(),void 0);return}if(!this.dom){this.dom=document.createElement(`div`),this.dom.className=this.top?`cm-panels cm-panels-top`:`cm-panels cm-panels-bottom`,this.dom.style[this.top?`top`:`bottom`]=`0`;let e=this.container||this.view.dom;e.insertBefore(this.dom,this.top?e.firstChild:null)}let e=this.dom.firstChild;for(let t of this.panels)if(t.dom.parentNode==this.dom){for(;e!=t.dom;)e=WTt(e);e=e.nextSibling}else this.dom.insertBefore(t.dom,e);for(;e;)e=WTt(e)}scrollMargin(){return!this.dom||this.container?0:Math.max(0,this.top?this.dom.getBoundingClientRect().bottom-Math.max(0,this.view.scrollDOM.getBoundingClientRect().top):Math.min(innerHeight,this.view.scrollDOM.getBoundingClientRect().bottom)-this.dom.getBoundingClientRect().top)}syncClasses(){if(!(!this.container||this.classes==this.view.themeClasses)){for(let e of this.classes.split(` `))e&&this.container.classList.remove(e);for(let e of(this.classes=this.view.themeClasses).split(` `))e&&this.container.classList.add(e)}}},kU=Hz.define({enables:VEt}),AU=class extends dB{compare(e){return this==e||this.constructor==e.constructor&&this.eq(e)}eq(e){return!1}destroy(e){}},AU.prototype.elementClass=``,AU.prototype.toDOM=void 0,AU.prototype.mapMode=Fz.TrackBefore,AU.prototype.startSide=AU.prototype.endSide=-1,AU.prototype.point=!0,jU=Hz.define(),HEt=Hz.define(),UEt={class:``,renderEmptyElements:!1,elementStyle:``,markers:()=>pB.empty,lineMarker:()=>null,widgetMarker:()=>null,lineMarkerChange:null,initialSpacer:null,updateSpacer:null,domEventHandlers:{}},MU=Hz.define(),NU=Hz.define({combine:e=>e.some(e=>e)}),WEt=fH.fromClass(class{constructor(e){this.view=e,this.prevViewport=e.viewport,this.dom=document.createElement(`div`),this.dom.className=`cm-gutters`,this.dom.setAttribute(`aria-hidden`,`true`),this.dom.style.minHeight=this.view.contentHeight/this.view.scaleY+`px`,this.gutters=e.state.facet(MU).map(t=>new PU(e,t));for(let e of this.gutters)this.dom.appendChild(e.dom);this.fixed=!e.state.facet(NU),this.fixed&&(this.dom.style.position=`sticky`),this.syncGutters(!1),e.scrollDOM.insertBefore(this.dom,e.contentDOM)}update(e){if(this.updateGutters(e)){let t=this.prevViewport,n=e.view.viewport,r=Math.min(t.to,n.to)-Math.max(t.from,n.from);this.syncGutters(r<(n.to-n.from)*.8)}e.geometryChanged&&(this.dom.style.minHeight=this.view.contentHeight/this.view.scaleY+`px`),this.view.state.facet(NU)!=!this.fixed&&(this.fixed=!this.fixed,this.dom.style.position=this.fixed?`sticky`:``),this.prevViewport=e.view.viewport}syncGutters(e){let t=this.dom.nextSibling;e&&this.dom.remove();let n=pB.iter(this.view.state.facet(jU),this.view.viewport.from),r=[],i=this.gutters.map(e=>new GEt(e,this.view.viewport,-this.view.documentPadding.top));for(let e of this.view.viewportLineBlocks)if(r.length&&(r=[]),Array.isArray(e.type)){let t=!0;for(let a of e.type)if(a.type==MV.Text&&t){sV(n,r,a.from);for(let e of i)e.line(this.view,a,r);t=!1}else if(a.widget)for(let e of i)e.widget(this.view,a)}else if(e.type==MV.Text){sV(n,r,e.from);for(let t of i)t.line(this.view,e,r)}else if(e.widget)for(let t of i)t.widget(this.view,e);for(let e of i)e.finish();e&&this.view.scrollDOM.insertBefore(this.dom,t)}updateGutters(e){let t=e.startState.facet(MU),n=e.state.facet(MU),r=e.docChanged||e.heightChanged||e.viewportChanged||!pB.eq(e.startState.facet(jU),e.state.facet(jU),e.view.viewport.from,e.view.viewport.to);if(t==n)for(let t of this.gutters)t.update(e)&&(r=!0);else{r=!0;let i=[];for(let r of n){let n=t.indexOf(r);n<0?i.push(new PU(this.view,r)):(this.gutters[n].update(e),i.push(this.gutters[n]))}for(let e of this.gutters)e.dom.remove(),i.indexOf(e)<0&&e.destroy();for(let e of i)this.dom.appendChild(e.dom);this.gutters=i}return r}destroy(){for(let e of this.gutters)e.destroy();this.dom.remove()}},{provide:e=>oU.scrollMargins.of(t=>{let n=t.plugin(e);return!n||n.gutters.length==0||!n.fixed?null:t.textDirection==HV.LTR?{left:n.dom.offsetWidth*t.scaleX}:{right:n.dom.offsetWidth*t.scaleX}})}),GEt=class{constructor(e,t,n){this.gutter=e,this.height=n,this.i=0,this.cursor=pB.iter(e.markers,t.from)}addElement(e,t,n){let{gutter:r}=this,i=(t.top-this.height)/e.scaleY,a=t.height/e.scaleY;if(this.i==r.elements.length){let t=new FU(e,a,i,n);r.elements.push(t),r.dom.appendChild(t.dom)}else r.elements[this.i].update(e,a,i,n);this.height=t.bottom,this.i++}line(e,t,n){let r=[];sV(this.cursor,r,t.from),n.length&&(r=r.concat(n));let i=this.gutter.config.lineMarker(e,t,r);i&&r.unshift(i);let a=this.gutter;r.length==0&&!a.config.renderEmptyElements||this.addElement(e,t,r)}widget(e,t){let n=this.gutter.config.widgetMarker(e,t.widget,t),r=n?[n]:null;for(let n of e.state.facet(HEt)){let i=n(e,t.widget,t);i&&(r||=[]).push(i)}r&&this.addElement(e,t,r)}finish(){let e=this.gutter;for(;e.elements.length>this.i;){let t=e.elements.pop();e.dom.removeChild(t.dom),t.destroy()}}},PU=class{constructor(e,t){this.view=e,this.config=t,this.elements=[],this.spacer=null,this.dom=document.createElement(`div`),this.dom.className=`cm-gutter`+(this.config.class?` `+this.config.class:``);for(let n in t.domEventHandlers)this.dom.addEventListener(n,r=>{let i=r.target,a;if(i!=this.dom&&this.dom.contains(i)){for(;i.parentNode!=this.dom;)i=i.parentNode;let e=i.getBoundingClientRect();a=(e.top+e.bottom)/2}else a=r.clientY;let o=e.lineBlockAtHeight(a-e.documentTop);t.domEventHandlers[n](e,o,r)&&r.preventDefault()});this.markers=qTt(t.markers(e)),t.initialSpacer&&(this.spacer=new FU(e,0,0,[t.initialSpacer(e)]),this.dom.appendChild(this.spacer.dom),this.spacer.dom.style.cssText+=`visibility: hidden; pointer-events: none`)}update(e){let t=this.markers;if(this.markers=qTt(this.config.markers(e.view)),this.spacer&&this.config.updateSpacer){let t=this.config.updateSpacer(this.spacer.markers[0],e);t!=this.spacer.markers[0]&&this.spacer.update(e.view,0,0,[t])}let n=e.view.viewport;return!pB.eq(this.markers,t,n.from,n.to)||(this.config.lineMarkerChange?this.config.lineMarkerChange(e):!1)}destroy(){for(let e of this.elements)e.destroy()}},FU=class{constructor(e,t,n,r){this.height=-1,this.above=0,this.markers=[],this.dom=document.createElement(`div`),this.dom.className=`cm-gutterElement`,this.update(e,t,n,r)}update(e,t,n,r){this.height!=t&&(this.height=t,this.dom.style.height=t+`px`),this.above!=n&&(this.dom.style.marginTop=(this.above=n)?n+`px`:``),JTt(this.markers,r)||this.setMarkers(e,r)}setMarkers(e,t){let n=`cm-gutterElement`,r=this.dom.firstChild;for(let i=0,a=0;;){let o=a,s=i<t.length?t[i++]:null,c=!1;if(s){let e=s.elementClass;e&&(n+=` `+e);for(let e=a;e<this.markers.length;e++)if(this.markers[e].compare(s)){o=e,c=!0;break}}else o=this.markers.length;for(;a<o;){let e=this.markers[a++];if(e.toDOM){e.destroy(r);let t=r.nextSibling;r.remove(),r=t}}if(!s)break;s.toDOM&&(c?r=r.nextSibling:this.dom.insertBefore(s.toDOM(e),r)),c&&a++}this.dom.className=n,this.markers=t}destroy(){this.setMarkers(null,[])}},KEt=Hz.define(),qEt=Hz.define(),IU=Hz.define({combine(e){return xz(e,{formatNumber:String,domEventHandlers:{}},{domEventHandlers(e,t){let n=Object.assign({},e);for(let e in t){let r=n[e],i=t[e];n[e]=r?(e,t,n)=>r(e,t,n)||i(e,t,n):i}return n}})}}),LU=class extends AU{constructor(e){super(),this.number=e}eq(e){return this.number==e.number}toDOM(){return document.createTextNode(this.number)}},JEt=MU.compute([IU],e=>({class:`cm-lineNumbers`,renderEmptyElements:!1,markers(e){return e.state.facet(KEt)},lineMarker(e,t,n){return n.some(e=>e.toDOM)?null:new LU(cV(e,e.state.doc.lineAt(t.from).number))},widgetMarker:(e,t,n)=>{for(let r of e.state.facet(qEt)){let i=r(e,t,n);if(i)return i}return null},lineMarkerChange:e=>e.startState.facet(IU)!=e.state.facet(IU),initialSpacer(e){return new LU(cV(e,XTt(e.state.doc.lines)))},updateSpacer(e,t){let n=cV(t.view,XTt(t.view.state.doc.lines));return n==e.number?e:new LU(n)},domEventHandlers:e.facet(IU).domEventHandlers}))}));function YEt(e,t,n,r){switch(e){case-2:return n<t;case-1:return r>=t&&n<t;case 0:return n<t&&r>t;case 1:return n<=t&&r>t;case 2:return r>t;case 4:return!0}}function zU(e,t,n,r){for(;e.from==e.to||(n<1?e.from>=t:e.from>t)||(n>-1?e.to<=t:e.to<t);){let t=!r&&e instanceof tW&&e.index<0?null:e.parent;if(!t)return e;e=t}let i=r?0:ZU.IgnoreOverlays;if(r)for(let r=e,a=r.parent;a;r=a,a=r.parent)r instanceof tW&&r.index<0&&a.enter(t,n,i)?.from!=r.from&&(e=a);for(;;){let r=e.enter(t,n,i);if(!r)return e;e=r}}function XEt(e,t,n,r){let i=e.cursor(),a=[];if(!i.firstChild())return a;if(n!=null){for(let e=!1;!e;)if(e=i.type.is(n),!i.nextSibling())return a}for(;;){if(r!=null&&i.type.is(r))return a;if(i.type.is(t)&&a.push(i.node),!i.nextSibling())return r==null?a:[]}}function BU(e,t,n=t.length-1){for(let r=e;n>=0;r=r.parent){if(!r)return!1;if(!r.type.isAnonymous){if(t[n]&&t[n]!=r.name)return!1;n--}}return!0}function ZEt(e){if(!e.length)return null;let t=0,n=e[0];for(let r=1;r<e.length;r++){let i=e[r];(i.from>n.from||i.to<n.to)&&(n=i,t=r)}let r=n instanceof tW&&n.index<0?null:n.parent,i=e.slice();return r?i[t]=r:i.splice(t,1),new pDt(i,n)}function QEt(e,t,n){let r=e.resolveInner(t,n),i=null;for(let e=r instanceof tW?r:r.context.parent;e;e=e.parent)if(e.index<0){let a=e.parent;(i||=[r]).push(a.resolve(t,n)),e=a}else{let a=qU.get(e.tree);if(a&&a.overlay&&a.overlay[0].from<=t&&a.overlay[a.overlay.length-1].to>=t){let o=new tW(a.tree,a.overlay[0].from+e.from,-1,e);(i||=[r]).push(zU(o,t,n,!1))}}return i?ZEt(i):r}function VU(e){return e.children.some(e=>e instanceof $U||!e.type.isAnonymous||VU(e))}function $Et(e){let{buffer:t,nodeSet:n,maxBufferLength:r=WU,reused:i=[],minRepeatType:a=n.types.length}=e,o=Array.isArray(t)?new dDt(t,t.length):t,s=n.types,c=0,l=0;function u(e,t,_,v,y,b){let{id:x,start:S,end:C,size:w}=o,ee=l,te=c;for(;w<0;)if(o.next(),w==-1){let t=i[x];_.push(t),v.push(S-e);return}else if(w==-3){c=x;return}else if(w==-4){l=x;return}else throw RangeError(`Unrecognized record size: ${w}`);let ne=s[x],re,T,ie=S-e;if(C-S<=r&&(T=h(o.pos-t,y))){let t=new Uint16Array(T.size-T.skip),r=o.pos-T.size,i=t.length;for(;o.pos>r;)i=g(T.start,t,i);re=new $U(t,C-T.start,n),ie=T.start-e}else{let e=o.pos-w;o.next();let t=[],n=[],i=x>=a?x:-1,s=0,c=C;for(;o.pos>e;)i>=0&&o.id==i&&o.size>=0?(o.end<=c-r&&(p(t,n,S,s,o.end,c,i,ee,te),s=t.length,c=o.end),o.next()):b>2500?d(S,e,t,n):u(S,e,t,n,i,b+1);if(i>=0&&s>0&&s<t.length&&p(t,n,S,s,S,c,i,ee,te),t.reverse(),n.reverse(),i>-1&&s>0){let e=f(ne,te);re=UU(ne,t,n,0,t.length,0,C-S,e,e)}else re=m(ne,t,n,C-S,ee-C,te)}_.push(re),v.push(ie)}function d(e,t,i,a){let s=[],c=0,l=-1;for(;o.pos>t;){let{id:e,start:t,end:n,size:i}=o;if(i>4)o.next();else if(l>-1&&t<l)break;else l<0&&(l=n-r),s.push(e,t,n),c++,o.next()}if(c){let t=new Uint16Array(c*4),r=s[s.length-2];for(let e=s.length-3,n=0;e>=0;e-=3)t[n++]=s[e],t[n++]=s[e+1]-r,t[n++]=s[e+2]-r,t[n++]=n;i.push(new $U(t,s[2]-r,n)),a.push(r-e)}}function f(e,t){return(n,r,i)=>{let a=0,o=n.length-1,s,c;if(o>=0&&(s=n[o])instanceof QU){if(!o&&s.type==e&&s.length==i)return s;(c=s.prop(KU.lookAhead))&&(a=r[o]+s.length+c)}return m(e,n,r,i,a,t)}}function p(e,t,r,i,a,o,s,c,l){let u=[],d=[];for(;e.length>i;)u.push(e.pop()),d.push(t.pop()+r-a);e.push(m(n.types[s],u,d,o-a,c-o,l)),t.push(a-r)}function m(e,t,n,r,i,a,o){if(a){let e=[KU.contextHash,a];o=o?[e].concat(o):[e]}if(i>25){let e=[KU.lookAhead,i];o=o?[e].concat(o):[e]}return new QU(e,t,n,r,o)}function h(e,t){let n=o.fork(),i=0,s=0,c=0,l=n.end-r,u={size:0,start:0,skip:0};scan:for(let r=n.pos-e;n.pos>r;){let e=n.size;if(n.id==t&&e>=0){u.size=i,u.start=s,u.skip=c,c+=4,i+=4,n.next();continue}let o=n.pos-e;if(e<0||o<r||n.start<l)break;let d=n.id>=a?4:0,f=n.start;for(n.next();n.pos>o;){if(n.size<0)if(n.size==-3)d+=4;else break scan;else n.id>=a&&(d+=4);n.next()}s=f,i+=e,c+=d}return(t<0||i==e)&&(u.size=i,u.start=s,u.skip=c),u.size>4?u:void 0}function g(e,t,n){let{id:r,start:i,end:s,size:u}=o;if(o.next(),u>=0&&r<a){let a=n;if(u>4){let r=o.pos-(u-4);for(;o.pos>r;)n=g(e,t,n)}t[--n]=a,t[--n]=s-e,t[--n]=i-e,t[--n]=r}else u==-3?c=r:u==-4&&(l=r);return n}let _=[],v=[];for(;o.pos>0;)u(e.start||0,e.bufferStart||0,_,v,-1,0);let y=e.length??(_.length?v[0]+_[0].length:0);return new QU(s[e.topID],_.reverse(),v.reverse(),y)}function HU(e,t){if(!e.isAnonymous||t instanceof $U||t.type!=e)return 1;let n=iW.get(t);if(n==null){n=1;for(let r of t.children){if(r.type!=e||!(r instanceof QU)){n=1;break}n+=HU(e,r)}iW.set(t,n)}return n}function UU(e,t,n,r,i,a,o,s,c){let l=0;for(let n=r;n<i;n++)l+=HU(e,t[n]);let u=Math.ceil(l*1.5/8),d=[],f=[];function p(t,n,r,i,o){for(let s=r;s<i;){let r=s,l=n[s],m=HU(e,t[s]);for(s++;s<i;s++){let n=HU(e,t[s]);if(m+n>=u)break;m+=n}if(s==r+1){if(m>u){let e=t[r];p(e.children,e.positions,0,e.children.length,n[r]+o);continue}d.push(t[r])}else{let i=n[s-1]+t[s-1].length-l;d.push(UU(e,t,n,r,s,l,i,null,c))}f.push(l+o-a)}}return p(t,n,r,i,0),(s||c)(d,f,o)}function eDt(e){return(t,n,r,i)=>new gDt(t,e,n,r,i)}function tDt(e){if(!e.length||e.some(e=>e.from>=e.to))throw RangeError(`Invalid inner parse ranges given: `+JSON.stringify(e))}function nDt(e,t,n){for(let r of e){if(r.from>=n)break;if(r.to>t)return r.from<=t&&r.to>=n?2:1}return 0}function rDt(e,t,n,r,i,a){if(t<n){let o=e.buffer[t+1];r.push(e.slice(t,n,o)),i.push(o-a)}}function iDt(e){let{node:t}=e,n=[],r=t.context.buffer;do n.push(e.index),e.parent();while(!e.tree);let i=e.tree,a=i.children.indexOf(r),o=i.children[a],s=o.buffer,c=[a];function l(e,r,i,a,u,d){let f=n[d],p=[],m=[];rDt(o,e,f,p,m,a);let h=s[f+1],g=s[f+2];c.push(p.length);let _=d?l(f+4,s[f+3],o.set.types[s[f]],h,g-h,d-1):t.toTree();return p.push(_),m.push(h-a),rDt(o,s[f+3],r,p,m,a),new QU(i,p,m,u)}i.children[a]=l(0,s.length,JU.none,0,o.length,n.length-1);for(let t of c){let n=e.tree.children[t],r=e.tree.positions[t];e.yield(new tW(n,r+e.from,t,e._tree))}}function aDt(e,t){let n=null,r=t;for(let i=1,a=0;i<e.length;i++){let o=e[i-1].to,s=e[i].from;for(;a<r.length;a++){let e=r[a];if(e.from>=s)break;e.to<=o||(n||(r=n=t.slice()),e.from<o?(n[a]=new GU(e.from,o),e.to>s&&n.splice(a+1,0,new GU(s,e.to))):e.to>s?n[a--]=new GU(s,e.to):n.splice(a--,1))}}return r}function oDt(e,t,n,r){let i=0,a=0,o=!1,s=!1,c=-1e9,l=[];for(;;){let u=i==e.length?1e9:o?e[i].to:e[i].from,d=a==t.length?1e9:s?t[a].to:t[a].from;if(o!=s){let e=Math.max(c,n),t=Math.min(u,d,r);e<t&&l.push(new GU(e,t))}if(c=Math.min(u,d),c==1e9)break;u==c&&(o?(o=!1,i++):o=!0),d==c&&(s?(s=!1,a++):s=!0)}return l}function sDt(e,t){let n=[];for(let{pos:r,mount:i,frag:a}of e){let e=r+(i.overlay?i.overlay[0].from:0),o=e+i.tree.length,s=Math.max(a.from,e),c=Math.min(a.to,o);if(i.overlay){let o=oDt(t,i.overlay.map(e=>new GU(e.from+r,e.to+r)),s,c);for(let t=0,r=s;;t++){let s=t==o.length,l=s?c:o[t].from;if(l>r&&n.push(new oW(r,l,i.tree,-e,a.from>=r||a.openStart,a.to<=l||a.openEnd)),s)break;r=o[t].to}}else n.push(new oW(s,c,i.tree,-e,a.from>=e||a.openStart,a.to<=o||a.openEnd))}return n}var WU,cDt,GU,KU,qU,lDt,JU,uDt,YU,XU,ZU,QU,dDt,$U,eW,tW,fDt,nW,pDt,rW,iW,aW,oW,sW,mDt,cW,hDt,lW,gDt,uW,_Dt,dW=s((()=>{WU=1024,cDt=0,GU=class{constructor(e,t){this.from=e,this.to=t}},KU=class{constructor(e={}){this.id=cDt++,this.perNode=!!e.perNode,this.deserialize=e.deserialize||(()=>{throw Error(`This node type doesn't define a deserialize function`)})}add(e){if(this.perNode)throw RangeError(`Can't add per-node props to node types`);return typeof e!=`function`&&(e=JU.match(e)),t=>{let n=e(t);return n===void 0?null:[this,n]}}},KU.closedBy=new KU({deserialize:e=>e.split(` `)}),KU.openedBy=new KU({deserialize:e=>e.split(` `)}),KU.group=new KU({deserialize:e=>e.split(` `)}),KU.isolate=new KU({deserialize:e=>{if(e&&e!=`rtl`&&e!=`ltr`&&e!=`auto`)throw RangeError(`Invalid value for isolate: `+e);return e||`auto`}}),KU.contextHash=new KU({perNode:!0}),KU.lookAhead=new KU({perNode:!0}),KU.mounted=new KU({perNode:!0}),qU=class{constructor(e,t,n){this.tree=e,this.overlay=t,this.parser=n}static get(e){return e&&e.props&&e.props[KU.mounted.id]}},lDt=Object.create(null),JU=class e{constructor(e,t,n,r=0){this.name=e,this.props=t,this.id=n,this.flags=r}static define(t){let n=t.props&&t.props.length?Object.create(null):lDt,r=(t.top?1:0)|(t.skipped?2:0)|(t.error?4:0)|(t.name==null?8:0),i=new e(t.name||``,n,t.id,r);if(t.props){for(let e of t.props)if(Array.isArray(e)||(e=e(i)),e){if(e[0].perNode)throw RangeError(`Can't store a per-node prop on a node type`);n[e[0].id]=e[1]}}return i}prop(e){return this.props[e.id]}get isTop(){return(this.flags&1)>0}get isSkipped(){return(this.flags&2)>0}get isError(){return(this.flags&4)>0}get isAnonymous(){return(this.flags&8)>0}is(e){if(typeof e==`string`){if(this.name==e)return!0;let t=this.prop(KU.group);return t?t.indexOf(e)>-1:!1}return this.id==e}static match(e){let t=Object.create(null);for(let n in e)for(let r of n.split(` `))t[r]=e[n];return e=>{for(let n=e.prop(KU.group),r=-1;r<(n?n.length:0);r++){let i=t[r<0?e.name:n[r]];if(i)return i}}}},JU.none=new JU(``,Object.create(null),0,8),uDt=class e{constructor(e){this.types=e;for(let t=0;t<e.length;t++)if(e[t].id!=t)throw RangeError(`Node type ids should correspond to array positions when creating a node set`)}extend(...t){let n=[];for(let e of this.types){let r=null;for(let n of t){let t=n(e);t&&(r||=Object.assign({},e.props),r[t[0].id]=t[1])}n.push(r?new JU(e.name,r,e.id,e.flags):e)}return new e(n)}},YU=new WeakMap,XU=new WeakMap,(function(e){e[e.ExcludeBuffers=1]=`ExcludeBuffers`,e[e.IncludeAnonymous=2]=`IncludeAnonymous`,e[e.IgnoreMounts=4]=`IgnoreMounts`,e[e.IgnoreOverlays=8]=`IgnoreOverlays`})(ZU||={}),QU=class e{constructor(e,t,n,r,i){if(this.type=e,this.children=t,this.positions=n,this.length=r,this.props=null,i&&i.length){this.props=Object.create(null);for(let[e,t]of i)this.props[typeof e==`number`?e:e.id]=t}}toString(){let e=qU.get(this);if(e&&!e.overlay)return e.tree.toString();let t=``;for(let e of this.children){let n=e.toString();n&&(t&&(t+=`,`),t+=n)}return this.type.name?(/\W/.test(this.type.name)&&!this.type.isError?JSON.stringify(this.type.name):this.type.name)+(t.length?`(`+t+`)`:``):t}cursor(e=0){return new rW(this.topNode,e)}cursorAt(e,t=0,n=0){let r=new rW(YU.get(this)||this.topNode);return r.moveTo(e,t),YU.set(this,r._tree),r}get topNode(){return new tW(this,0,0,null)}resolve(e,t=0){let n=zU(YU.get(this)||this.topNode,e,t,!1);return YU.set(this,n),n}resolveInner(e,t=0){let n=zU(XU.get(this)||this.topNode,e,t,!0);return XU.set(this,n),n}resolveStack(e,t=0){return QEt(this,e,t)}iterate(e){let{enter:t,leave:n,from:r=0,to:i=this.length}=e,a=e.mode||0,o=(a&ZU.IncludeAnonymous)>0;for(let e=this.cursor(a|ZU.IncludeAnonymous);;){let a=!1;if(e.from<=i&&e.to>=r&&(!o&&e.type.isAnonymous||t(e)!==!1)){if(e.firstChild())continue;a=!0}for(;a&&n&&(o||!e.type.isAnonymous)&&n(e),!e.nextSibling();){if(!e.parent())return;a=!0}}}prop(e){return e.perNode?this.props?this.props[e.id]:void 0:this.type.prop(e)}get propValues(){let e=[];if(this.props)for(let t in this.props)e.push([+t,this.props[t]]);return e}balance(t={}){return this.children.length<=8?this:UU(JU.none,this.children,this.positions,0,this.children.length,0,this.length,(t,n,r)=>new e(this.type,t,n,r,this.propValues),t.makeTree||((t,n,r)=>new e(JU.none,t,n,r)))}static build(e){return $Et(e)}},QU.empty=new QU(JU.none,[],[],0),dDt=class e{constructor(e,t){this.buffer=e,this.index=t}get id(){return this.buffer[this.index-4]}get start(){return this.buffer[this.index-3]}get end(){return this.buffer[this.index-2]}get size(){return this.buffer[this.index-1]}get pos(){return this.index}next(){this.index-=4}fork(){return new e(this.buffer,this.index)}},$U=class e{constructor(e,t,n){this.buffer=e,this.length=t,this.set=n}get type(){return JU.none}toString(){let e=[];for(let t=0;t<this.buffer.length;)e.push(this.childString(t)),t=this.buffer[t+3];return e.join(`,`)}childString(e){let t=this.buffer[e],n=this.buffer[e+3],r=this.set.types[t],i=r.name;if(/\W/.test(i)&&!r.isError&&(i=JSON.stringify(i)),e+=4,n==e)return i;let a=[];for(;e<n;)a.push(this.childString(e)),e=this.buffer[e+3];return i+`(`+a.join(`,`)+`)`}findChild(e,t,n,r,i){let{buffer:a}=this,o=-1;for(let s=e;s!=t&&!(YEt(i,r,a[s+1],a[s+2])&&(o=s,n>0));s=a[s+3]);return o}slice(t,n,r){let i=this.buffer,a=new Uint16Array(n-t),o=0;for(let e=t,s=0;e<n;){a[s++]=i[e++],a[s++]=i[e++]-r;let n=a[s++]=i[e++]-r;a[s++]=i[e++]-t,o=Math.max(o,n)}return new e(a,o,this.set)}},eW=class{cursor(e=0){return new rW(this,e)}getChild(e,t=null,n=null){let r=XEt(this,e,t,n);return r.length?r[0]:null}getChildren(e,t=null,n=null){return XEt(this,e,t,n)}resolve(e,t=0){return zU(this,e,t,!1)}resolveInner(e,t=0){return zU(this,e,t,!0)}matchContext(e){return BU(this.parent,e)}enterUnfinishedNodesBefore(e){let t=this.childBefore(e),n=this;for(;t;){let e=t.lastChild;if(!e||e.to!=t.to)break;e.type.isError&&e.from==e.to?(n=t,t=e.prevSibling):t=e}return n}get node(){return this}get next(){return this.parent}},tW=class e extends eW{constructor(e,t,n,r){super(),this._tree=e,this.from=t,this.index=n,this._parent=r}get type(){return this._tree.type}get name(){return this._tree.type.name}get to(){return this.from+this._tree.length}nextChild(t,n,r,i,a=0){for(let o=this;;){for(let{children:s,positions:c}=o._tree,l=n>0?s.length:-1;t!=l;t+=n){let l=s[t],u=c[t]+o.from;if(YEt(i,r,u,u+l.length)){if(l instanceof $U){if(a&ZU.ExcludeBuffers)continue;let e=l.findChild(0,l.buffer.length,n,r-u,i);if(e>-1)return new nW(new fDt(o,l,t,u),null,e)}else if(a&ZU.IncludeAnonymous||!l.type.isAnonymous||VU(l)){let s;if(!(a&ZU.IgnoreMounts)&&(s=qU.get(l))&&!s.overlay)return new e(s.tree,u,t,o);let c=new e(l,u,t,o);return a&ZU.IncludeAnonymous||!c.type.isAnonymous?c:c.nextChild(n<0?l.children.length-1:0,n,r,i)}}}if(a&ZU.IncludeAnonymous||!o.type.isAnonymous||(t=o.index>=0?o.index+n:n<0?-1:o._parent._tree.children.length,o=o._parent,!o))return null}}get firstChild(){return this.nextChild(0,1,0,4)}get lastChild(){return this.nextChild(this._tree.children.length-1,-1,0,4)}childAfter(e){return this.nextChild(0,1,e,2)}childBefore(e){return this.nextChild(this._tree.children.length-1,-1,e,-2)}enter(t,n,r=0){let i;if(!(r&ZU.IgnoreOverlays)&&(i=qU.get(this._tree))&&i.overlay){let r=t-this.from;for(let{from:t,to:a}of i.overlay)if((n>0?t<=r:t<r)&&(n<0?a>=r:a>r))return new e(i.tree,i.overlay[0].from+this.from,-1,this)}return this.nextChild(0,1,t,n,r)}nextSignificantParent(){let e=this;for(;e.type.isAnonymous&&e._parent;)e=e._parent;return e}get parent(){return this._parent?this._parent.nextSignificantParent():null}get nextSibling(){return this._parent&&this.index>=0?this._parent.nextChild(this.index+1,1,0,4):null}get prevSibling(){return this._parent&&this.index>=0?this._parent.nextChild(this.index-1,-1,0,4):null}get tree(){return this._tree}toTree(){return this._tree}toString(){return this._tree.toString()}},fDt=class{constructor(e,t,n,r){this.parent=e,this.buffer=t,this.index=n,this.start=r}},nW=class e extends eW{get name(){return this.type.name}get from(){return this.context.start+this.context.buffer.buffer[this.index+1]}get to(){return this.context.start+this.context.buffer.buffer[this.index+2]}constructor(e,t,n){super(),this.context=e,this._parent=t,this.index=n,this.type=e.buffer.set.types[e.buffer.buffer[n]]}child(t,n,r){let{buffer:i}=this.context,a=i.findChild(this.index+4,i.buffer[this.index+3],t,n-this.context.start,r);return a<0?null:new e(this.context,this,a)}get firstChild(){return this.child(1,0,4)}get lastChild(){return this.child(-1,0,4)}childAfter(e){return this.child(1,e,2)}childBefore(e){return this.child(-1,e,-2)}enter(t,n,r=0){if(r&ZU.ExcludeBuffers)return null;let{buffer:i}=this.context,a=i.findChild(this.index+4,i.buffer[this.index+3],n>0?1:-1,t-this.context.start,n);return a<0?null:new e(this.context,this,a)}get parent(){return this._parent||this.context.parent.nextSignificantParent()}externalSibling(e){return this._parent?null:this.context.parent.nextChild(this.context.index+e,e,0,4)}get nextSibling(){let{buffer:t}=this.context,n=t.buffer[this.index+3];return n<(this._parent?t.buffer[this._parent.index+3]:t.buffer.length)?new e(this.context,this._parent,n):this.externalSibling(1)}get prevSibling(){let{buffer:t}=this.context,n=this._parent?this._parent.index+4:0;return this.index==n?this.externalSibling(-1):new e(this.context,this._parent,t.findChild(n,this.index,-1,0,4))}get tree(){return null}toTree(){let e=[],t=[],{buffer:n}=this.context,r=this.index+4,i=n.buffer[this.index+3];if(i>r){let a=n.buffer[this.index+1];e.push(n.slice(r,i,a)),t.push(0)}return new QU(this.type,e,t,this.to-this.from)}toString(){return this.context.buffer.childString(this.index)}},pDt=class{constructor(e,t){this.heads=e,this.node=t}get next(){return ZEt(this.heads)}},rW=class{get name(){return this.type.name}constructor(e,t=0){if(this.mode=t,this.buffer=null,this.stack=[],this.index=0,this.bufferNode=null,e instanceof tW)this.yieldNode(e);else{this._tree=e.context.parent,this.buffer=e.context;for(let t=e._parent;t;t=t._parent)this.stack.unshift(t.index);this.bufferNode=e,this.yieldBuf(e.index)}}yieldNode(e){return e?(this._tree=e,this.type=e.type,this.from=e.from,this.to=e.to,!0):!1}yieldBuf(e,t){this.index=e;let{start:n,buffer:r}=this.buffer;return this.type=t||r.set.types[r.buffer[e]],this.from=n+r.buffer[e+1],this.to=n+r.buffer[e+2],!0}yield(e){return e?e instanceof tW?(this.buffer=null,this.yieldNode(e)):(this.buffer=e.context,this.yieldBuf(e.index,e.type)):!1}toString(){return this.buffer?this.buffer.buffer.childString(this.index):this._tree.toString()}enterChild(e,t,n){if(!this.buffer)return this.yield(this._tree.nextChild(e<0?this._tree._tree.children.length-1:0,e,t,n,this.mode));let{buffer:r}=this.buffer,i=r.findChild(this.index+4,r.buffer[this.index+3],e,t-this.buffer.start,n);return i<0?!1:(this.stack.push(this.index),this.yieldBuf(i))}firstChild(){return this.enterChild(1,0,4)}lastChild(){return this.enterChild(-1,0,4)}childAfter(e){return this.enterChild(1,e,2)}childBefore(e){return this.enterChild(-1,e,-2)}enter(e,t,n=this.mode){return this.buffer?n&ZU.ExcludeBuffers?!1:this.enterChild(1,e,t):this.yield(this._tree.enter(e,t,n))}parent(){if(!this.buffer)return this.yieldNode(this.mode&ZU.IncludeAnonymous?this._tree._parent:this._tree.parent);if(this.stack.length)return this.yieldBuf(this.stack.pop());let e=this.mode&ZU.IncludeAnonymous?this.buffer.parent:this.buffer.parent.nextSignificantParent();return this.buffer=null,this.yieldNode(e)}sibling(e){if(!this.buffer)return this._tree._parent?this.yield(this._tree.index<0?null:this._tree._parent.nextChild(this._tree.index+e,e,0,4,this.mode)):!1;let{buffer:t}=this.buffer,n=this.stack.length-1;if(e<0){let e=n<0?0:this.stack[n]+4;if(this.index!=e)return this.yieldBuf(t.findChild(e,this.index,-1,0,4))}else{let e=t.buffer[this.index+3];if(e<(n<0?t.buffer.length:t.buffer[this.stack[n]+3]))return this.yieldBuf(e)}return n<0?this.yield(this.buffer.parent.nextChild(this.buffer.index+e,e,0,4,this.mode)):!1}nextSibling(){return this.sibling(1)}prevSibling(){return this.sibling(-1)}atLastNode(e){let t,n,{buffer:r}=this;if(r){if(e>0){if(this.index<r.buffer.buffer.length)return!1}else for(let e=0;e<this.index;e++)if(r.buffer.buffer[e+3]<this.index)return!1;({index:t,parent:n}=r)}else ({index:t,_parent:n}=this._tree);for(;n;{index:t,_parent:n}=n)if(t>-1)for(let r=t+e,i=e<0?-1:n._tree.children.length;r!=i;r+=e){let e=n._tree.children[r];if(this.mode&ZU.IncludeAnonymous||e instanceof $U||!e.type.isAnonymous||VU(e))return!1}return!0}move(e,t){if(t&&this.enterChild(e,0,4))return!0;for(;;){if(this.sibling(e))return!0;if(this.atLastNode(e)||!this.parent())return!1}}next(e=!0){return this.move(1,e)}prev(e=!0){return this.move(-1,e)}moveTo(e,t=0){for(;(this.from==this.to||(t<1?this.from>=e:this.from>e)||(t>-1?this.to<=e:this.to<e))&&this.parent(););for(;this.enterChild(1,e,t););return this}get node(){if(!this.buffer)return this._tree;let e=this.bufferNode,t=null,n=0;if(e&&e.context==this.buffer)scan:for(let r=this.index,i=this.stack.length;i>=0;){for(let a=e;a;a=a._parent)if(a.index==r){if(r==this.index)return a;t=a,n=i+1;break scan}r=this.stack[--i]}for(let e=n;e<this.stack.length;e++)t=new nW(this.buffer,t,this.stack[e]);return this.bufferNode=new nW(this.buffer,t,this.index)}get tree(){return this.buffer?null:this._tree._tree}iterate(e,t){for(let n=0;;){let r=!1;if(this.type.isAnonymous||e(this)!==!1){if(this.firstChild()){n++;continue}this.type.isAnonymous||(r=!0)}for(;;){if(r&&t&&t(this),r=this.type.isAnonymous,!n)return;if(this.nextSibling())break;this.parent(),n--,r=!0}}}matchContext(e){if(!this.buffer)return BU(this.node.parent,e);let{buffer:t}=this.buffer,{types:n}=t.set;for(let r=e.length-1,i=this.stack.length-1;r>=0;i--){if(i<0)return BU(this._tree,e,r);let a=n[t.buffer[this.stack[i]]];if(!a.isAnonymous){if(e[r]&&e[r]!=a.name)return!1;r--}}return!0}},iW=new WeakMap,aW=class{constructor(){this.map=new WeakMap}setBuffer(e,t,n){let r=this.map.get(e);r||this.map.set(e,r=new Map),r.set(t,n)}getBuffer(e,t){let n=this.map.get(e);return n&&n.get(t)}set(e,t){e instanceof nW?this.setBuffer(e.context.buffer,e.index,t):e instanceof tW&&this.map.set(e.tree,t)}get(e){return e instanceof nW?this.getBuffer(e.context.buffer,e.index):e instanceof tW?this.map.get(e.tree):void 0}cursorSet(e,t){e.buffer?this.setBuffer(e.buffer.buffer,e.index,t):this.map.set(e.tree,t)}cursorGet(e){return e.buffer?this.getBuffer(e.buffer.buffer,e.index):this.map.get(e.tree)}},oW=class e{constructor(e,t,n,r,i=!1,a=!1){this.from=e,this.to=t,this.tree=n,this.offset=r,this.open=(i?1:0)|(a?2:0)}get openStart(){return(this.open&1)>0}get openEnd(){return(this.open&2)>0}static addTree(t,n=[],r=!1){let i=[new e(0,t.length,t,0,!1,r)];for(let e of n)e.to>t.length&&i.push(e);return i}static applyChanges(t,n,r=128){if(!n.length)return t;let i=[],a=1,o=t.length?t[0]:null;for(let s=0,c=0,l=0;;s++){let u=s<n.length?n[s]:null,d=u?u.fromA:1e9;if(d-c>=r)for(;o&&o.from<d;){let n=o;if(c>=n.from||d<=n.to||l){let t=Math.max(n.from,c)-l,r=Math.min(n.to,d)-l;n=t>=r?null:new e(t,r,n.tree,n.offset+l,s>0,!!u)}if(n&&i.push(n),o.to>d)break;o=a<t.length?t[a++]:null}if(!u)break;c=u.toA,l=u.toA-u.toB}return i}},sW=class{startParse(e,t,n){return typeof e==`string`&&(e=new mDt(e)),n=n?n.length?n.map(e=>new GU(e.from,e.to)):[new GU(0,0)]:[new GU(0,e.length)],this.createParse(e,t||[],n)}parse(e,t,n){let r=this.startParse(e,t,n);for(;;){let e=r.advance();if(e)return e}}},mDt=class{constructor(e){this.string=e}get length(){return this.string.length}chunk(e){return this.string.slice(e)}get lineChunks(){return!1}read(e,t){return this.string.slice(e,t)}},cW=class{constructor(e,t,n,r,i){this.parser=e,this.parse=t,this.overlay=n,this.target=r,this.from=i}},hDt=class{constructor(e,t,n,r,i,a,o){this.parser=e,this.predicate=t,this.mounts=n,this.index=r,this.start=i,this.target=a,this.prev=o,this.depth=0,this.ranges=[]}},lW=new KU({perNode:!0}),gDt=class{constructor(e,t,n,r,i){this.nest=t,this.input=n,this.fragments=r,this.ranges=i,this.inner=[],this.innerDone=0,this.baseTree=null,this.stoppedAt=null,this.baseParse=e}advance(){if(this.baseParse){let e=this.baseParse.advance();if(!e)return null;if(this.baseParse=null,this.baseTree=e,this.startInner(),this.stoppedAt!=null)for(let e of this.inner)e.parse.stopAt(this.stoppedAt)}if(this.innerDone==this.inner.length){let e=this.baseTree;return this.stoppedAt!=null&&(e=new QU(e.type,e.children,e.positions,e.length,e.propValues.concat([[lW,this.stoppedAt]]))),e}let e=this.inner[this.innerDone],t=e.parse.advance();if(t){this.innerDone++;let n=Object.assign(Object.create(null),e.target.props);n[KU.mounted.id]=new qU(t,e.overlay,e.parser),e.target.props=n}return null}get parsedPos(){if(this.baseParse)return 0;let e=this.input.length;for(let t=this.innerDone;t<this.inner.length;t++)this.inner[t].from<e&&(e=Math.min(e,this.inner[t].parse.parsedPos));return e}stopAt(e){if(this.stoppedAt=e,this.baseParse)this.baseParse.stopAt(e);else for(let t=this.innerDone;t<this.inner.length;t++)this.inner[t].parse.stopAt(e)}startInner(){let e=new _Dt(this.fragments),t=null,n=null,r=new rW(new tW(this.baseTree,this.ranges[0].from,0,null),ZU.IncludeAnonymous|ZU.IgnoreMounts);scan:for(let i,a;;){let o=!0,s;if(this.stoppedAt!=null&&r.from>=this.stoppedAt)o=!1;else if(e.hasNode(r)){if(t){let e=t.mounts.find(e=>e.frag.from<=r.from&&e.frag.to>=r.to&&e.mount.overlay);if(e)for(let n of e.mount.overlay){let i=n.from+e.pos,a=n.to+e.pos;i>=r.from&&a<=r.to&&!t.ranges.some(e=>e.from<a&&e.to>i)&&t.ranges.push({from:i,to:a})}}o=!1}else if(n&&(a=nDt(n.ranges,r.from,r.to)))o=a!=2;else if(!r.type.isAnonymous&&(i=this.nest(r,this.input))&&(r.from<r.to||!i.overlay)){r.tree||iDt(r);let a=e.findMounts(r.from,i.parser);if(typeof i.overlay==`function`)t=new hDt(i.parser,i.overlay,a,this.inner.length,r.from,r.tree,t);else{let e=aDt(this.ranges,i.overlay||(r.from<r.to?[new GU(r.from,r.to)]:[]));e.length&&tDt(e),(e.length||!i.overlay)&&this.inner.push(new cW(i.parser,e.length?i.parser.startParse(this.input,sDt(a,e),e):i.parser.startParse(``),i.overlay?i.overlay.map(e=>new GU(e.from-r.from,e.to-r.from)):null,r.tree,e.length?e[0].from:r.from)),i.overlay?e.length&&(n={ranges:e,depth:0,prev:n}):o=!1}}else if(t&&(s=t.predicate(r))&&(s===!0&&(s=new GU(r.from,r.to)),s.from<s.to)){let e=t.ranges.length-1;e>=0&&t.ranges[e].to==s.from?t.ranges[e]={from:t.ranges[e].from,to:s.to}:t.ranges.push(s)}if(o&&r.firstChild())t&&t.depth++,n&&n.depth++;else for(;!r.nextSibling();){if(!r.parent())break scan;if(t&&!--t.depth){let e=aDt(this.ranges,t.ranges);e.length&&(tDt(e),this.inner.splice(t.index,0,new cW(t.parser,t.parser.startParse(this.input,sDt(t.mounts,e),e),t.ranges.map(e=>new GU(e.from-t.start,e.to-t.start)),t.target,e[0].from))),t=t.prev}n&&!--n.depth&&(n=n.prev)}}}},uW=class{constructor(e,t){this.offset=t,this.done=!1,this.cursor=e.cursor(ZU.IncludeAnonymous|ZU.IgnoreMounts)}moveTo(e){let{cursor:t}=this,n=e-this.offset;for(;!this.done&&t.from<n;)t.to>=e&&t.enter(n,1,ZU.IgnoreOverlays|ZU.ExcludeBuffers)||t.next(!1)||(this.done=!0)}hasNode(e){if(this.moveTo(e.from),!this.done&&this.cursor.from+this.offset==e.from&&this.cursor.tree)for(let t=this.cursor.tree;;){if(t==e.tree)return!0;if(t.children.length&&t.positions[0]==0&&t.children[0]instanceof QU)t=t.children[0];else break}return!1}},_Dt=class{constructor(e){if(this.fragments=e,this.curTo=0,this.fragI=0,e.length){let t=this.curFrag=e[0];this.curTo=t.tree.prop(lW)??t.to,this.inner=new uW(t.tree,-t.offset)}else this.curFrag=this.inner=null}hasNode(e){for(;this.curFrag&&e.from>=this.curTo;)this.nextFrag();return this.curFrag&&this.curFrag.from<=e.from&&this.curTo>=e.to&&this.inner.hasNode(e)}nextFrag(){if(this.fragI++,this.fragI==this.fragments.length)this.curFrag=this.inner=null;else{let e=this.curFrag=this.fragments[this.fragI];this.curTo=e.tree.prop(lW)??e.to,this.inner=new uW(e.tree,-e.offset)}}findMounts(e,t){let n=[];if(this.inner){this.inner.cursor.moveTo(e,1);for(let e=this.inner.cursor.node;e;e=e.parent){let r=e.tree?.prop(KU.mounted);if(r&&r.parser==t)for(let t=this.fragI;t<this.fragments.length;t++){let i=this.fragments[t];if(i.from>=e.to)break;i.tree==this.curFrag.tree&&n.push({frag:i,pos:e.from-i.offset,mount:r})}}}return n}}}));function vDt(e,t){return e.length==t.length&&e.every((e,n)=>e==t[n])}function yDt(e){let t=[[]];for(let n=0;n<e.length;n++)for(let r=0,i=t.length;r<i;r++)t.push(t[r].concat(e[n]));return t.sort((e,t)=>t.length-e.length)}function fW(e){let t=Object.create(null);for(let n in e){let r=e[n];Array.isArray(r)||(r=[r]);for(let e of n.split(` `))if(e){let n=[],i=2,a=e;for(let t=0;;){if(a==`...`&&t>0&&t+3==e.length){i=1;break}let r=/^"(?:[^"\\]|\\.)*?"|[^\/!]+/.exec(a);if(!r)throw RangeError(`Invalid path: `+e);if(n.push(r[0]==`*`?``:r[0][0]==`"`?JSON.parse(r[0]):r[0]),t+=r[0].length,t==e.length)break;let o=e[t++];if(t==e.length&&o==`!`){i=0;break}if(o!=`/`)throw RangeError(`Invalid path: `+e);a=e.slice(t)}let o=n.length-1,s=n[o];if(!s)throw RangeError(`Invalid path: `+e);t[s]=new gW(r,i,o>0?n.slice(0,o):null).sort(t[s])}}return hW.add(t)}function bDt(e,t){let n=Object.create(null);for(let t of e)if(!Array.isArray(t.tag))n[t.tag.id]=t.class;else for(let e of t.tag)n[e.id]=t.class;let{scope:r,all:i=null}=t||{};return{style:e=>{let t=i;for(let r of e)for(let e of r.set){let r=n[e.id];if(r){t=t?t+` `+r:r;break}}return t},scope:r}}function xDt(e,t){let n=null;for(let r of e){let e=r.style(t);e&&(n=n?n+` `+e:e)}return n}function SDt(e,t,n,r=0,i=e.length){let a=new EDt(r,Array.isArray(t)?t:[t],n);a.highlightRange(e.cursor(),r,i,``,a.highlighters),a.flush(i)}function CDt(e){let t=e.type.prop(hW);for(;t&&t.context&&!e.matchContext(t.context);)t=t.next;return t||null}var wDt,pW,TDt,mW,hW,gW,EDt,_W,vW,yW,bW,xW,SW,CW,wW,TW,EW,DW,OW,kW,AW,jW,$,MW=s((()=>{dW(),wDt=0,pW=class e{constructor(e,t,n,r){this.name=e,this.set=t,this.base=n,this.modified=r,this.id=wDt++}toString(){let{name:e}=this;for(let t of this.modified)t.name&&(e=`${t.name}(${e})`);return e}static define(t,n){let r=typeof t==`string`?t:`?`;if(t instanceof e&&(n=t),n?.base)throw Error(`Can not derive from a modified tag`);let i=new e(r,[],null,[]);if(i.set.push(i),n)for(let e of n.set)i.set.push(e);return i}static defineModifier(e){let t=new mW(e);return e=>e.modified.indexOf(t)>-1?e:mW.get(e.base||e,e.modified.concat(t).sort((e,t)=>e.id-t.id))}},TDt=0,mW=class e{constructor(e){this.name=e,this.instances=[],this.id=TDt++}static get(t,n){if(!n.length)return t;let r=n[0].instances.find(e=>e.base==t&&vDt(n,e.modified));if(r)return r;let i=[],a=new pW(t.name,i,t,n);for(let e of n)e.instances.push(a);let o=yDt(n);for(let n of t.set)if(!n.modified.length)for(let t of o)i.push(e.get(n,t));return a}},hW=new KU,gW=class{constructor(e,t,n,r){this.tags=e,this.mode=t,this.context=n,this.next=r}get opaque(){return this.mode==0}get inherit(){return this.mode==1}sort(e){return!e||e.depth<this.depth?(this.next=e,this):(e.next=this.sort(e.next),e)}get depth(){return this.context?this.context.length:0}},gW.empty=new gW([],2,null),EDt=class{constructor(e,t,n){this.at=e,this.highlighters=t,this.span=n,this.class=``}startSpan(e,t){t!=this.class&&(this.flush(e),e>this.at&&(this.at=e),this.class=t)}flush(e){e>this.at&&this.class&&this.span(this.at,e,this.class)}highlightRange(e,t,n,r,i){let{type:a,from:o,to:s}=e;if(o>=n||s<=t)return;a.isTop&&(i=this.highlighters.filter(e=>!e.scope||e.scope(a)));let c=r,l=CDt(e)||gW.empty,u=xDt(i,l.tags);if(u&&(c&&(c+=` `),c+=u,l.mode==1&&(r+=(r?` `:``)+u)),this.startSpan(Math.max(t,o),c),l.opaque)return;let d=e.tree&&e.tree.prop(KU.mounted);if(d&&d.overlay){let a=e.node.enter(d.overlay[0].from+o,1),l=this.highlighters.filter(e=>!e.scope||e.scope(d.tree.type)),u=e.firstChild();for(let f=0,p=o;;f++){let m=f<d.overlay.length?d.overlay[f]:null,h=m?m.from+o:s,g=Math.max(t,p),_=Math.min(n,h);if(g<_&&u)for(;e.from<_&&(this.highlightRange(e,g,_,r,i),this.startSpan(Math.min(_,e.to),c),!(e.to>=h||!e.nextSibling())););if(!m||h>n)break;p=m.to+o,p>t&&(this.highlightRange(a.cursor(),Math.max(t,m.from+o),Math.min(n,p),``,l),this.startSpan(Math.min(n,p),c))}u&&e.parent()}else if(e.firstChild()){d&&(r=``);do{if(e.to<=t)continue;if(e.from>=n)break;this.highlightRange(e,t,n,r,i),this.startSpan(Math.min(n,e.to),c)}while(e.nextSibling());e.parent()}}},_W=pW.define,vW=_W(),yW=_W(),bW=_W(yW),xW=_W(yW),SW=_W(),CW=_W(SW),wW=_W(SW),TW=_W(),EW=_W(TW),DW=_W(),OW=_W(),kW=_W(),AW=_W(kW),jW=_W(),$={comment:vW,lineComment:_W(vW),blockComment:_W(vW),docComment:_W(vW),name:yW,variableName:_W(yW),typeName:bW,tagName:_W(bW),propertyName:xW,attributeName:_W(xW),className:_W(yW),labelName:_W(yW),namespace:_W(yW),macroName:_W(yW),literal:SW,string:CW,docString:_W(CW),character:_W(CW),attributeValue:_W(CW),number:wW,integer:_W(wW),float:_W(wW),bool:_W(SW),regexp:_W(SW),escape:_W(SW),color:_W(SW),url:_W(SW),keyword:DW,self:_W(DW),null:_W(DW),atom:_W(DW),unit:_W(DW),modifier:_W(DW),operatorKeyword:_W(DW),controlKeyword:_W(DW),definitionKeyword:_W(DW),moduleKeyword:_W(DW),operator:OW,derefOperator:_W(OW),arithmeticOperator:_W(OW),logicOperator:_W(OW),bitwiseOperator:_W(OW),compareOperator:_W(OW),updateOperator:_W(OW),definitionOperator:_W(OW),typeOperator:_W(OW),controlOperator:_W(OW),punctuation:kW,separator:_W(kW),bracket:AW,angleBracket:_W(AW),squareBracket:_W(AW),paren:_W(AW),brace:_W(AW),content:TW,heading:EW,heading1:_W(EW),heading2:_W(EW),heading3:_W(EW),heading4:_W(EW),heading5:_W(EW),heading6:_W(EW),contentSeparator:_W(TW),list:_W(TW),quote:_W(TW),emphasis:_W(TW),strong:_W(TW),link:_W(TW),monospace:_W(TW),strikethrough:_W(TW),inserted:_W(),deleted:_W(),changed:_W(),invalid:_W(),meta:jW,documentMeta:_W(jW),annotation:_W(jW),processingInstruction:_W(jW),definition:pW.defineModifier(`definition`),constant:pW.defineModifier(`constant`),function:pW.defineModifier(`function`),standard:pW.defineModifier(`standard`),local:pW.defineModifier(`local`),special:pW.defineModifier(`special`)};for(let e in $){let t=$[e];t instanceof pW&&(t.name=e)}bDt([{tag:$.link,class:`tok-link`},{tag:$.heading,class:`tok-heading`},{tag:$.emphasis,class:`tok-emphasis`},{tag:$.strong,class:`tok-strong`},{tag:$.keyword,class:`tok-keyword`},{tag:$.atom,class:`tok-atom`},{tag:$.bool,class:`tok-bool`},{tag:$.url,class:`tok-url`},{tag:$.labelName,class:`tok-labelName`},{tag:$.inserted,class:`tok-inserted`},{tag:$.deleted,class:`tok-deleted`},{tag:$.literal,class:`tok-literal`},{tag:$.string,class:`tok-string`},{tag:$.number,class:`tok-number`},{tag:[$.regexp,$.escape,$.special($.string)],class:`tok-string2`},{tag:$.variableName,class:`tok-variableName`},{tag:$.local($.variableName),class:`tok-variableName tok-local`},{tag:$.definition($.variableName),class:`tok-variableName tok-definition`},{tag:$.special($.variableName),class:`tok-variableName2`},{tag:$.definition($.propertyName),class:`tok-propertyName tok-definition`},{tag:$.typeName,class:`tok-typeName`},{tag:$.namespace,class:`tok-namespace`},{tag:$.className,class:`tok-className`},{tag:$.macroName,class:`tok-macroName`},{tag:$.propertyName,class:`tok-propertyName`},{tag:$.operator,class:`tok-operator`},{tag:$.comment,class:`tok-comment`},{tag:$.meta,class:`tok-meta`},{tag:$.invalid,class:`tok-invalid`},{tag:$.punctuation,class:`tok-punctuation`}])}));function DDt(e){return Hz.define({combine:e?t=>t.concat(e):void 0})}function ODt(e,t,n){let r=e.facet(ZW),i=NW(e).topNode;if(!r||r.allowsNesting)for(let e=i;e;e=e.enter(t,n,ZU.ExcludeBuffers))e.type.isTop&&(i=e);return i}function NW(e){let t=e.field(GW.state,!1);return t?t.tree:QU.empty}function kDt(e,t,n){return oW.applyChanges(e,[{fromA:t,toA:n,fromB:t,toB:n}])}function ADt(e){let t=e.facet($W);return t.charCodeAt(0)==9?e.tabSize*t.length:t.length}function jDt(e,t){let n=``,r=e.tabSize,i=e.facet($W)[0];if(i==`	`){for(;t>=r;)n+=`	`,t-=r;i=` `}for(let e=0;e<t;e++)n+=i;return n}function MDt(e,t){e instanceof uB&&(e=new eG(e));for(let n of e.state.facet(aOt)){let r=n(e,t);if(r!==void 0)return r}let n=NW(e.state);return n.length>=t?NDt(e,n,t):null}function NDt(e,t,n){let r=t.resolveStack(n),i=t.resolveInner(n,-1).resolve(n,0).enterUnfinishedNodesBefore(n);if(i!=r.node){let e=[];for(let t=i;t!=r.node;t=t.parent)e.push(t);for(let t=e.length-1;t>=0;t--)r={node:e[t],next:r}}return PDt(r,e,n)}function PDt(e,t,n){for(let r=e;r;r=r.next){let e=IDt(r.node);if(e)return e(oOt.create(t,n,r))}return 0}function FDt(e){return e.pos==e.options.simulateBreak&&e.options.simulateDoubleBreak}function IDt(e){let t=e.type.prop(tG);if(t)return t;let n=e.firstChild,r;if(n&&(r=n.type.prop(KU.closedBy))){let t=e.lastChild,n=t&&r.indexOf(t.name)>-1;return e=>BDt(e,!0,1,void 0,n&&!FDt(e)?t.from:void 0)}return e.parent==null?LDt:null}function LDt(){return 0}function RDt(e,t){for(let n=t;n;n=n.parent)if(e==n)return!0;return!1}function zDt(e){let t=e.node,n=t.childAfter(t.from),r=t.lastChild;if(!n)return null;let i=e.options.simulateBreak,a=e.state.doc.lineAt(n.from),o=i==null||i<=a.from?a.to:Math.min(a.to,i);for(let e=n.to;;){let i=t.childAfter(e);if(!i||i==r)return null;if(!i.type.isSkipped){if(i.from>=o)return null;let e=/^ */.exec(a.text.slice(n.to-a.from))[0].length;return{from:n.from,to:n.to+e}}e=i.to}}function PW({closing:e,align:t=!0,units:n=1}){return r=>BDt(r,t,n,e)}function BDt(e,t,n,r,i){let a=e.textAfter,o=a.match(/^\s*/)[0].length,s=r&&a.slice(o,o+r.length)==r||i==e.pos+o,c=t?zDt(e):null;return c?s?e.column(c.from):e.column(c.to):e.baseIndent+(s?0:e.unit*n)}function FW({except:e,units:t=1}={}){return n=>{let r=e&&e.test(n.textAfter);return n.baseIndent+(r?0:t*n.unit)}}function VDt(){return uB.transactionFilter.of(e=>{if(!e.docChanged||!e.isUserEvent(`input.type`)&&!e.isUserEvent(`input.complete`))return e;let t=e.startState.languageDataAt(`indentOnInput`,e.startState.selection.main.head);if(!t.length)return e;let n=e.newDoc,{head:r}=e.newSelection.main,i=n.lineAt(r);if(r>i.from+cOt)return e;let a=n.sliceString(i.from,r);if(!t.some(e=>e.test(a)))return e;let{state:o}=e,s=-1,c=[];for(let{head:e}of o.selection.ranges){let t=o.doc.lineAt(e);if(t.from==s)continue;s=t.from;let n=MDt(o,t.from);if(n==null)continue;let r=/^\s*/.exec(t.text)[0],i=jDt(o,n);r!=i&&c.push({from:t.from,to:t.from+r.length,insert:i})}return c.length?[e,{changes:c,sequential:!0}]:e})}function IW(e){let t=e.firstChild,n=e.lastChild;return t&&t.to<n.from?{from:t.to,to:n.type.isError?e.to:n.from}:null}function HDt(e,t,n){let r=NW(e);if(r.length<n)return null;let i=r.resolveStack(n,1),a=null;for(let o=i;o;o=o.next){let i=o.node;if(i.to<=n||i.from>n)continue;if(a&&i.from<t)break;let s=i.type.prop(nG);if(s&&(i.to<r.length-50||r.length==e.doc.length||!UDt(i))){let r=s(i,e);r&&r.from<=n&&r.from>=t&&r.to>n&&(a=r)}}return a}function UDt(e){let t=e.lastChild;return t&&t.to==e.to&&t.type.isError}function WDt(e,t,n){for(let r of e.facet(lOt)){let i=r(e,t,n);if(i)return i}return HDt(e,t,n)}function GDt(e,t){let n=t.mapPos(e.from,1),r=t.mapPos(e.to,-1);return n>=r?void 0:{from:n,to:r}}function LW(e,t,n){var r;let i=null;return(r=e.field(aG,!1))==null||r.between(t,n,(e,t)=>{(!i||i.from>e)&&(i={from:e,to:t})}),i}function KDt(e,t,n){let r=!1;return e.between(t,t,(e,i)=>{e==t&&i==n&&(r=!0)}),r}function qDt(e){let t=[aG,pOt];return e&&t.push(oG.of(e)),t}function JDt(e,t){let{state:n}=e,r=n.facet(oG),i=t=>{let n=e.lineBlockAt(e.posAtDOM(t.target)),r=LW(e.state,n.from,n.to);r&&e.dispatch({effects:iG.of(r)}),t.preventDefault()};if(r.placeholderDOM)return r.placeholderDOM(e,i,t);let a=document.createElement(`span`);return a.textContent=r.placeholderText,a.setAttribute(`aria-label`,n.phrase(`folded code`)),a.title=n.phrase(`unfold`),a.className=`cm-foldPlaceholder`,a.onclick=i,a}function YDt(e={}){let t=Object.assign(Object.assign({},fOt),e),n=new cG(t,!0),r=new cG(t,!1),i=fH.fromClass(class{constructor(e){this.from=e.viewport.from,this.markers=this.buildMarkers(e)}update(e){(e.docChanged||e.viewportChanged||e.startState.facet(ZW)!=e.state.facet(ZW)||e.startState.field(aG,!1)!=e.state.field(aG,!1)||NW(e.startState)!=NW(e.state)||t.foldingChanged(e))&&(this.markers=this.buildMarkers(e.view))}buildMarkers(e){let t=new mB;for(let i of e.viewportLineBlocks){let a=LW(e.state,i.from,i.to)?r:WDt(e.state,i.from,i.to)?n:null;a&&t.add(i.from,i.from,a)}return t.finish()}}),{domEventHandlers:a}=t;return[i,GTt({class:`cm-foldGutter`,markers(e){return e.plugin(i)?.markers||pB.empty},initialSpacer(){return new cG(t,!1)},domEventHandlers:Object.assign(Object.assign({},a),{click:(e,t,n)=>{if(a.click&&a.click(e,t,n))return!0;let r=LW(e.state,t.from,t.to);if(r)return e.dispatch({effects:iG.of(r)}),!0;let i=WDt(e.state,t.from,t.to);return i?(e.dispatch({effects:rG.of(i)}),!0):!1}})}),qDt()]}function RW(e){let t=e.facet(uG);return t.length?t:e.facet(dG)}function XDt(e,t){let n=[hOt],r;return e instanceof lG&&(e.module&&n.push(oU.styleModule.of(e.module)),r=e.themeType),t?.fallback?n.push(dG.of(e)):r?n.push(uG.computeN([oU.darkTheme],t=>t.facet(oU.darkTheme)==(r==`dark`)?[e]:[])):n.push(uG.of(e)),n}function ZDt(e){let t=[],n=e.matched?vOt:yOt;return t.push(n.range(e.start.from,e.start.to)),e.end&&t.push(n.range(e.end.from,e.end.to)),t}function QDt(e={}){return[mG.of(e),bOt]}function zW(e,t,n){let r=e.prop(t<0?KU.openedBy:KU.closedBy);if(r)return r;if(e.name.length==1){let r=n.indexOf(e.name);if(r>-1&&r%2==(t<0?1:0))return[n[r+t]]}return null}function BW(e){let t=e.type.prop(hG);return t?t(e.node):e}function VW(e,t,n,r={}){let i=r.maxScanDistance||fG,a=r.brackets||pG,o=NW(e),s=o.resolveInner(t,n);for(let r=s;r;r=r.parent){let i=zW(r.type,n,a);if(i&&r.from<r.to){let o=BW(r);if(o&&(n>0?t>=o.from&&t<o.to:t>o.from&&t<=o.to))return $Dt(e,t,n,r,o,i,a)}}return eOt(e,t,n,o,s.type,i,a)}function $Dt(e,t,n,r,i,a,o){let s=r.parent,c={from:i.from,to:i.to},l=0,u=s?.cursor();if(u&&(n<0?u.childBefore(r.from):u.childAfter(r.to)))do if(n<0?u.to<=r.from:u.from>=r.to){if(l==0&&a.indexOf(u.type.name)>-1&&u.from<u.to){let e=BW(u);return{start:c,end:e?{from:e.from,to:e.to}:void 0,matched:!0}}else if(zW(u.type,n,o))l++;else if(zW(u.type,-n,o)){if(l==0){let e=BW(u);return{start:c,end:e&&e.from<e.to?{from:e.from,to:e.to}:void 0,matched:!1}}l--}}while(n<0?u.prevSibling():u.nextSibling());return{start:c,matched:!1}}function eOt(e,t,n,r,i,a,o){let s=n<0?e.sliceDoc(t-1,t):e.sliceDoc(t,t+1),c=o.indexOf(s);if(c<0||c%2==0!=n>0)return null;let l={from:n<0?t-1:t,to:n>0?t+1:t},u=e.doc.iterRange(t,n>0?e.doc.length:0),d=0;for(let e=0;!u.next().done&&e<=a;){let a=u.value;n<0&&(e+=a.length);let s=t+e*n;for(let e=n>0?0:a.length-1,t=n>0?a.length:-1;e!=t;e+=n){let t=o.indexOf(a[e]);if(!(t<0||r.resolveInner(s+e,1).type!=i))if(t%2==0==n>0)d++;else if(d==1)return{start:l,end:{from:s+e,to:s+e+1},matched:t>>1==c>>1};else d--}n>0&&(e+=a.length)}return u.done?{start:l,matched:!1}:null}function HW(e,t){_G.indexOf(e)>-1||(_G.push(e),console.warn(t))}function tOt(e,t){let n=[];for(let r of t.split(` `)){let t=[];for(let n of r.split(`.`)){let r=e[n]||$[n];r?typeof r==`function`?t.length?t=t.map(r):HW(n,`Modifier ${n} used at start of tag`):t.length?HW(n,`Tag ${n} used as modifier`):t=Array.isArray(r)?r:[r]:HW(n,`Unknown highlighting tag ${n}`)}for(let e of t)n.push(e)}if(!n.length)return 0;let r=t.replace(/ /g,`_`),i=r+` `+n.map(e=>e.id),a=vG[i];if(a)return a.id;let o=vG[i]=JU.define({id:gG.length,name:r,props:[fW({[r]:n})]});return gG.push(o),o.id}var UW,WW,GW,KW,nOt,qW,rOt,JW,YW,XW,iOt,ZW,QW,aOt,$W,eG,tG,oOt,sOt,cOt,lOt,nG,rG,iG,aG,uOt,oG,sG,dOt,fOt,cG,pOt,lG,uG,dG,mOt,hOt,gOt,_Ot,fG,pG,mG,vOt,yOt,bOt,hG,xOt,gG,_G,vG,SOt,yG=s((()=>{dW(),vB(),RU(),MW(),ICt(),UW=new KU,WW=new KU,GW=class{constructor(e,t,n=[],r=``){this.data=e,this.name=r,uB.prototype.hasOwnProperty(`tree`)||Object.defineProperty(uB.prototype,`tree`,{get(){return NW(this)}}),this.parser=t,this.extension=[ZW.of(this),uB.languageData.of((e,t,n)=>{let r=ODt(e,t,n),i=r.type.prop(UW);if(!i)return[];let a=e.facet(i),o=r.type.prop(WW);if(o){let i=r.resolve(t-r.from,n);for(let t of o)if(t.test(i,e)){let n=e.facet(t.facet);return t.type==`replace`?n:n.concat(a)}}return a})].concat(n)}isActiveAt(e,t,n=-1){return ODt(e,t,n).type.prop(UW)==this.data}findRegions(e){let t=e.facet(ZW);if(t?.data==this.data)return[{from:0,to:e.doc.length}];if(!t||!t.allowsNesting)return[];let n=[],r=(e,t)=>{if(e.prop(UW)==this.data){n.push({from:t,to:t+e.length});return}let i=e.prop(KU.mounted);if(i){if(i.tree.prop(UW)==this.data){if(i.overlay)for(let e of i.overlay)n.push({from:e.from+t,to:e.to+t});else n.push({from:t,to:t+e.length});return}else if(i.overlay){let e=n.length;if(r(i.tree,i.overlay[0].from+t),n.length>e)return}}for(let n=0;n<e.children.length;n++){let i=e.children[n];i instanceof QU&&r(i,e.positions[n]+t)}};return r(NW(e),0),n}get allowsNesting(){return!0}},GW.setState=oB.define(),KW=class e extends GW{constructor(e,t,n){super(e,t,[],n),this.parser=t}static define(t){let n=DDt(t.languageData);return new e(n,t.parser.configure({props:[UW.add(e=>e.isTop?n:void 0)]}),t.name)}configure(t,n){return new e(this.data,this.parser.configure(t),n||this.name)}get allowsNesting(){return this.parser.hasWrappers()}},nOt=class{constructor(e){this.doc=e,this.cursorPos=0,this.string=``,this.cursor=e.iter()}get length(){return this.doc.length}syncTo(e){return this.string=this.cursor.next(e-this.cursorPos).value,this.cursorPos=e+this.string.length,this.cursorPos-this.string.length}chunk(e){return this.syncTo(e),this.string}get lineChunks(){return!0}read(e,t){let n=this.cursorPos-this.string.length;return e<n||t>=this.cursorPos?this.doc.sliceString(e,t):this.string.slice(e-n,t-n)}},qW=null,rOt=class e{constructor(e,t,n=[],r,i,a,o,s){this.parser=e,this.state=t,this.fragments=n,this.tree=r,this.treeLen=i,this.viewport=a,this.skipped=o,this.scheduleOn=s,this.parse=null,this.tempSkipped=[]}static create(t,n,r){return new e(t,n,[],QU.empty,0,r,[],null)}startParse(){return this.parser.startParse(new nOt(this.state.doc),this.fragments)}work(e,t){return t!=null&&t>=this.state.doc.length&&(t=void 0),this.tree!=QU.empty&&this.isDone(t??this.state.doc.length)?(this.takeTree(),!0):this.withContext(()=>{if(typeof e==`number`){let t=Date.now()+e;e=()=>Date.now()>t}for(this.parse||=this.startParse(),t!=null&&(this.parse.stoppedAt==null||this.parse.stoppedAt>t)&&t<this.state.doc.length&&this.parse.stopAt(t);;){let n=this.parse.advance();if(n)if(this.fragments=this.withoutTempSkipped(oW.addTree(n,this.fragments,this.parse.stoppedAt!=null)),this.treeLen=this.parse.stoppedAt??this.state.doc.length,this.tree=n,this.parse=null,this.treeLen<(t??this.state.doc.length))this.parse=this.startParse();else return!0;if(e())return!1}})}takeTree(){let e,t;this.parse&&(e=this.parse.parsedPos)>=this.treeLen&&((this.parse.stoppedAt==null||this.parse.stoppedAt>e)&&this.parse.stopAt(e),this.withContext(()=>{for(;!(t=this.parse.advance()););}),this.treeLen=e,this.tree=t,this.fragments=this.withoutTempSkipped(oW.addTree(this.tree,this.fragments,!0)),this.parse=null)}withContext(e){let t=qW;qW=this;try{return e()}finally{qW=t}}withoutTempSkipped(e){for(let t;t=this.tempSkipped.pop();)e=kDt(e,t.from,t.to);return e}changes(t,n){let{fragments:r,tree:i,treeLen:a,viewport:o,skipped:s}=this;if(this.takeTree(),!t.empty){let e=[];if(t.iterChangedRanges((t,n,r,i)=>e.push({fromA:t,toA:n,fromB:r,toB:i})),r=oW.applyChanges(r,e),i=QU.empty,a=0,o={from:t.mapPos(o.from,-1),to:t.mapPos(o.to,1)},this.skipped.length){s=[];for(let e of this.skipped){let n=t.mapPos(e.from,1),r=t.mapPos(e.to,-1);n<r&&s.push({from:n,to:r})}}}return new e(this.parser,n,r,i,a,o,s,this.scheduleOn)}updateViewport(e){if(this.viewport.from==e.from&&this.viewport.to==e.to)return!1;this.viewport=e;let t=this.skipped.length;for(let t=0;t<this.skipped.length;t++){let{from:n,to:r}=this.skipped[t];n<e.to&&r>e.from&&(this.fragments=kDt(this.fragments,n,r),this.skipped.splice(t--,1))}return this.skipped.length>=t?!1:(this.reset(),!0)}reset(){this.parse&&=(this.takeTree(),null)}skipUntilInView(e,t){this.skipped.push({from:e,to:t})}static getSkippingParser(e){return new class extends sW{createParse(t,n,r){let i=r[0].from,a=r[r.length-1].to;return{parsedPos:i,advance(){let t=qW;if(t){for(let e of r)t.tempSkipped.push(e);e&&(t.scheduleOn=t.scheduleOn?Promise.all([t.scheduleOn,e]):e)}return this.parsedPos=a,new QU(JU.none,[],[],a-i)},stoppedAt:null,stopAt(){}}}}}isDone(e){e=Math.min(e,this.state.doc.length);let t=this.fragments;return this.treeLen>=e&&t.length&&t[0].from==0&&t[0].to>=e}static get(){return qW}},JW=class e{constructor(e){this.context=e,this.tree=e.tree}apply(t){if(!t.docChanged&&this.tree==this.context.tree)return this;let n=this.context.changes(t.changes,t.state),r=this.context.treeLen==t.startState.doc.length?void 0:Math.max(t.changes.mapPos(this.context.treeLen),n.viewport.to);return n.work(20,r)||n.takeTree(),new e(n)}static init(t){let n=Math.min(3e3,t.doc.length),r=rOt.create(t.facet(ZW).parser,t,{from:0,to:n});return r.work(20,n)||r.takeTree(),new e(r)}},GW.state=Gz.define({create:JW.init,update(e,t){for(let e of t.effects)if(e.is(GW.setState))return e.value;return t.startState.facet(ZW)==t.state.facet(ZW)?e.apply(t):JW.init(t.state)}}),YW=e=>{let t=setTimeout(()=>e(),500);return()=>clearTimeout(t)},typeof requestIdleCallback<`u`&&(YW=e=>{let t=-1,n=setTimeout(()=>{t=requestIdleCallback(e,{timeout:400})},100);return()=>t<0?clearTimeout(n):cancelIdleCallback(t)}),XW=typeof navigator<`u`&&navigator.scheduling?.isInputPending?()=>navigator.scheduling.isInputPending():null,iOt=fH.fromClass(class{constructor(e){this.view=e,this.working=null,this.workScheduled=0,this.chunkEnd=-1,this.chunkBudget=-1,this.work=this.work.bind(this),this.scheduleWork()}update(e){let t=this.view.state.field(GW.state).context;(t.updateViewport(e.view.viewport)||this.view.viewport.to>t.treeLen)&&this.scheduleWork(),(e.docChanged||e.selectionSet)&&(this.view.hasFocus&&(this.chunkBudget+=50),this.scheduleWork()),this.checkAsyncSchedule(t)}scheduleWork(){if(this.working)return;let{state:e}=this.view,t=e.field(GW.state);(t.tree!=t.context.tree||!t.context.isDone(e.doc.length))&&(this.working=YW(this.work))}work(e){this.working=null;let t=Date.now();if(this.chunkEnd<t&&(this.chunkEnd<0||this.view.hasFocus)&&(this.chunkEnd=t+3e4,this.chunkBudget=3e3),this.chunkBudget<=0)return;let{state:n,viewport:{to:r}}=this.view,i=n.field(GW.state);if(i.tree==i.context.tree&&i.context.isDone(r+1e5))return;let a=Date.now()+Math.min(this.chunkBudget,100,e&&!XW?Math.max(25,e.timeRemaining()-5):1e9),o=i.context.treeLen<r&&n.doc.length>r+1e3,s=i.context.work(()=>XW&&XW()||Date.now()>a,r+(o?0:1e5));this.chunkBudget-=Date.now()-t,(s||this.chunkBudget<=0)&&(i.context.takeTree(),this.view.dispatch({effects:GW.setState.of(new JW(i.context))})),this.chunkBudget>0&&!(s&&!o)&&this.scheduleWork(),this.checkAsyncSchedule(i.context)}checkAsyncSchedule(e){e.scheduleOn&&=(this.workScheduled++,e.scheduleOn.then(()=>this.scheduleWork()).catch(e=>KB(this.view.state,e)).then(()=>this.workScheduled--),null)}destroy(){this.working&&this.working()}isWorking(){return!!(this.working||this.workScheduled>0)}},{eventHandlers:{focus(){this.scheduleWork()}}}),ZW=Hz.define({combine(e){return e.length?e[0]:null},enables:e=>[GW.state,iOt,oU.contentAttributes.compute([e],t=>{let n=t.facet(e);return n&&n.name?{"data-language":n.name}:{}})]}),QW=class{constructor(e,t=[]){this.language=e,this.support=t,this.extension=[e,t]}},aOt=Hz.define(),$W=Hz.define({combine:e=>{if(!e.length)return`  `;let t=e[0];if(!t||/\S/.test(t)||Array.from(t).some(e=>e!=t[0]))throw Error(`Invalid indent unit: `+JSON.stringify(e[0]));return t}}),eG=class{constructor(e,t={}){this.state=e,this.options=t,this.unit=ADt(e)}lineAt(e,t=1){let n=this.state.doc.lineAt(e),{simulateBreak:r,simulateDoubleBreak:i}=this.options;return r!=null&&r>=n.from&&r<=n.to?i&&r==e?{text:``,from:e}:(t<0?r<e:r<=e)?{text:n.text.slice(r-n.from),from:r}:{text:n.text.slice(0,r-n.from),from:n.from}:n}textAfterPos(e,t=1){if(this.options.simulateDoubleBreak&&e==this.options.simulateBreak)return``;let{text:n,from:r}=this.lineAt(e,t);return n.slice(e-r,Math.min(n.length,e+100-r))}column(e,t=1){let{text:n,from:r}=this.lineAt(e,t),i=this.countColumn(n,e-r),a=this.options.overrideIndentation?this.options.overrideIndentation(r):-1;return a>-1&&(i+=a-this.countColumn(n,n.search(/\S|$/))),i}countColumn(e,t=e.length){return Dz(e,this.state.tabSize,t)}lineIndent(e,t=1){let{text:n,from:r}=this.lineAt(e,t),i=this.options.overrideIndentation;if(i){let e=i(r);if(e>-1)return e}return this.countColumn(n,n.search(/\S|$/))}get simulatedBreak(){return this.options.simulateBreak||null}},tG=new KU,oOt=class e extends eG{constructor(e,t,n){super(e.state,e.options),this.base=e,this.pos=t,this.context=n}get node(){return this.context.node}static create(t,n,r){return new e(t,n,r)}get textAfter(){return this.textAfterPos(this.pos)}get baseIndent(){return this.baseIndentFor(this.node)}baseIndentFor(e){let t=this.state.doc.lineAt(e.from);for(;;){let n=e.resolve(t.from);for(;n.parent&&n.parent.from==n.from;)n=n.parent;if(RDt(n,e))break;t=this.state.doc.lineAt(n.from)}return this.lineIndent(t.from)}continue(){return PDt(this.context.next,this.base,this.pos)}},sOt=e=>e.baseIndent,cOt=200,lOt=Hz.define(),nG=new KU,rG=oB.define({map:GDt}),iG=oB.define({map:GDt}),aG=Gz.define({create(){return NV.none},update(e,t){e=e.map(t.changes);for(let n of t.effects)if(n.is(rG)&&!KDt(e,n.value.from,n.value.to)){let{preparePlaceholder:r}=t.state.facet(oG),i=r?NV.replace({widget:new dOt(r(t.state,n.value))}):sG;e=e.update({add:[i.range(n.value.from,n.value.to)]})}else n.is(iG)&&(e=e.update({filter:(e,t)=>n.value.from!=e||n.value.to!=t,filterFrom:n.value.from,filterTo:n.value.to}));if(t.selection){let n=!1,{head:r}=t.selection.main;e.between(r,r,(e,t)=>{e<r&&t>r&&(n=!0)}),n&&(e=e.update({filterFrom:r,filterTo:r,filter:(e,t)=>t<=r||e>=r}))}return e},provide:e=>oU.decorations.from(e),toJSON(e,t){let n=[];return e.between(0,t.doc.length,(e,t)=>{n.push(e,t)}),n},fromJSON(e){if(!Array.isArray(e)||e.length%2)throw RangeError(`Invalid JSON for fold state`);let t=[];for(let n=0;n<e.length;){let r=e[n++],i=e[n++];if(typeof r!=`number`||typeof i!=`number`)throw RangeError(`Invalid JSON for fold state`);t.push(sG.range(r,i))}return NV.set(t,!0)}}),uOt={placeholderDOM:null,preparePlaceholder:null,placeholderText:`…`},oG=Hz.define({combine(e){return xz(e,uOt)}}),sG=NV.replace({widget:new class extends jV{toDOM(e){return JDt(e,null)}}}),dOt=class extends jV{constructor(e){super(),this.value=e}eq(e){return this.value==e.value}toDOM(e){return JDt(e,this.value)}},fOt={openText:`⌄`,closedText:`›`,markerDOM:null,domEventHandlers:{},foldingChanged:()=>!1},cG=class extends AU{constructor(e,t){super(),this.config=e,this.open=t}eq(e){return this.config==e.config&&this.open==e.open}toDOM(e){if(this.config.markerDOM)return this.config.markerDOM(this.open);let t=document.createElement(`span`);return t.textContent=this.open?this.config.openText:this.config.closedText,t.title=e.state.phrase(this.open?`Fold line`:`Unfold line`),t}},pOt=oU.baseTheme({".cm-foldPlaceholder":{backgroundColor:`#eee`,border:`1px solid #ddd`,color:`#888`,borderRadius:`.2em`,margin:`0 1px`,padding:`0 1px`,cursor:`pointer`},".cm-foldGutter span":{padding:`0 1px`,cursor:`pointer`}}),lG=class e{constructor(e,t){this.specs=e;let n;function r(e){let t=CB.newName();return(n||=Object.create(null))[`.`+t]=e,t}let i=typeof t.all==`string`?t.all:t.all?r(t.all):void 0,a=t.scope;this.scope=a instanceof GW?e=>e.prop(UW)==a.data:a?e=>e==a:void 0,this.style=bDt(e.map(e=>({tag:e.tag,class:e.class||r(Object.assign({},e,{tag:null}))})),{all:i}).style,this.module=n?new CB(n):null,this.themeType=t.themeType}static define(t,n){return new e(t,n||{})}},uG=Hz.define(),dG=Hz.define({combine(e){return e.length?[e[0]]:null}}),mOt=class{constructor(e){this.markCache=Object.create(null),this.tree=NW(e.state),this.decorations=this.buildDeco(e,RW(e.state)),this.decoratedTo=e.viewport.to}update(e){let t=NW(e.state),n=RW(e.state),r=n!=RW(e.startState),{viewport:i}=e.view,a=e.changes.mapPos(this.decoratedTo,1);t.length<i.to&&!r&&t.type==this.tree.type&&a>=i.to?(this.decorations=this.decorations.map(e.changes),this.decoratedTo=a):(t!=this.tree||e.viewportChanged||r)&&(this.tree=t,this.decorations=this.buildDeco(e.view,n),this.decoratedTo=i.to)}buildDeco(e,t){if(!t||!this.tree.length)return NV.none;let n=new mB;for(let{from:r,to:i}of e.visibleRanges)SDt(this.tree,t,(e,t,r)=>{n.add(e,t,this.markCache[r]||(this.markCache[r]=NV.mark({class:r})))},r,i);return n.finish()}},hOt=qz.high(fH.fromClass(mOt,{decorations:e=>e.decorations})),gOt=lG.define([{tag:$.meta,color:`#404740`},{tag:$.link,textDecoration:`underline`},{tag:$.heading,textDecoration:`underline`,fontWeight:`bold`},{tag:$.emphasis,fontStyle:`italic`},{tag:$.strong,fontWeight:`bold`},{tag:$.strikethrough,textDecoration:`line-through`},{tag:$.keyword,color:`#708`},{tag:[$.atom,$.bool,$.url,$.contentSeparator,$.labelName],color:`#219`},{tag:[$.literal,$.inserted],color:`#164`},{tag:[$.string,$.deleted],color:`#a11`},{tag:[$.regexp,$.escape,$.special($.string)],color:`#e40`},{tag:$.definition($.variableName),color:`#00f`},{tag:$.local($.variableName),color:`#30a`},{tag:[$.typeName,$.namespace],color:`#085`},{tag:$.className,color:`#167`},{tag:[$.special($.variableName),$.macroName],color:`#256`},{tag:$.definition($.propertyName),color:`#00c`},{tag:$.comment,color:`#940`},{tag:$.invalid,color:`#f00`}]),_Ot=oU.baseTheme({"&.cm-focused .cm-matchingBracket":{backgroundColor:`#328c8252`},"&.cm-focused .cm-nonmatchingBracket":{backgroundColor:`#bb555544`}}),fG=1e4,pG=`()[]{}`,mG=Hz.define({combine(e){return xz(e,{afterCursor:!0,brackets:pG,maxScanDistance:fG,renderMatch:ZDt})}}),vOt=NV.mark({class:`cm-matchingBracket`}),yOt=NV.mark({class:`cm-nonmatchingBracket`}),bOt=[Gz.define({create(){return NV.none},update(e,t){if(!t.docChanged&&!t.selection)return e;let n=[],r=t.state.facet(mG);for(let e of t.state.selection.ranges){if(!e.empty)continue;let i=VW(t.state,e.head,-1,r)||e.head>0&&VW(t.state,e.head-1,1,r)||r.afterCursor&&(VW(t.state,e.head,1,r)||e.head<t.state.doc.length&&VW(t.state,e.head+1,-1,r));i&&(n=n.concat(r.renderMatch(i,t.state)))}return NV.set(n,!0)},provide:e=>oU.decorations.from(e)}),_Ot],hG=new KU,xOt=Object.create(null),gG=[JU.none],_G=[],vG=Object.create(null),SOt=Object.create(null);for(let[e,t]of[[`variable`,`variableName`],[`variable-2`,`variableName.special`],[`string-2`,`string.special`],[`def`,`variableName.definition`],[`tag`,`tagName`],[`attribute`,`attributeName`],[`type`,`typeName`],[`builtin`,`variableName.standard`],[`qualifier`,`modifier`],[`error`,`invalid`],[`header`,`heading`],[`property`,`propertyName`]])SOt[e]=tOt(xOt,t);NV.mark({class:`cm-iso`,inclusive:!0,attributes:{dir:`rtl`},bidiIsolate:HV.RTL}),NV.mark({class:`cm-iso`,inclusive:!0,attributes:{dir:`ltr`},bidiIsolate:HV.LTR}),NV.mark({class:`cm-iso`,inclusive:!0,attributes:{dir:`auto`},bidiIsolate:null})}));function COt(e,t,n,r,i,a){switch(r){case`AttributeValue`:{let n=e.resolveInner(t,0).tree;if(!n)return null;let r=n.prop(KU.mounted)?.tree;if(r?.type.name!==`Styles`)return null;let a=[];return r.iterate({from:0,to:r.length,enter:({type:n,from:r,to:o})=>{let s=COt(e,t+1+r,t+1+o,n.name,i);if(s){if(Array.isArray(s))throw Error(`Unexpected nested overlays`);a.push(s)}}}),a}case`CallExpression`:{let e=wOt(i.sliceString(t,n));return e?Object.assign(Object.assign({},e),{from:t,to:n}):null}case`ColorLiteral`:{let e=TOt(i.sliceString(t,n));return e?Object.assign(Object.assign({},e),{from:t,to:n}):null}case`ValueName`:{let e=EOt(i.sliceString(t,n));return e?Object.assign(Object.assign({},e),{from:t,to:n}):null}default:return null}}function wOt(e){switch(e.slice(0,3)){case`rgb`:{let t=IOt.exec(e);if(!t)return null;let[n,r,i,a,o]=t,s=AOt(r,i,a);return{colorType:TG.rgb,color:s,alpha:o||``}}case`hsl`:{let t=LOt.exec(e);if(!t)return null;let[n,r,i,a,o]=t,s=jOt(r,i,a);return{colorType:TG.hsl,color:s,alpha:o||``}}default:return null}}function TOt(e){if(!ROt.exec(e))return null;let[t,n]=OOt(e);return{colorType:TG.hex,color:t,alpha:n}}function EOt(e){let t=CG.get(e);return t?{colorType:TG.named,color:t,alpha:``}:null}function DOt(e,t){let n=[],r=NW(e.state);for(let i of e.visibleRanges)r.iterate({from:i.from,to:i.to,enter:({type:i,from:a,to:o})=>{let s=t(r,a,o,i.name,e.state.doc,e.state.facet(ZW)?.name);if(s){if(!Array.isArray(s)){n.push(NV.widget({widget:new DG(s),side:1}).range(s.from));return}for(let e of s)n.push(NV.widget({widget:new DG(e),side:1}).range(e.from))}}});return NV.set(n)}function OOt(e){return e.length===4?[`#${e[1].repeat(2)}${e[2].repeat(2)}${e[3].repeat(2)}`,``]:e.length===5?[`#${e[1].repeat(2)}${e[2].repeat(2)}${e[3].repeat(2)}`,e[4].repeat(2)]:e.length===9?[`#${e.slice(1,-2)}`,e.slice(-2)]:[e,``]}function bG(e){let t;if(e.endsWith(`%`)){let n=Number(e.slice(0,-1));t=Math.round(n/100*255)}else t=Number(e);return xG(t)}function xG(e){let t=e.toString(16);return t.length===1?`0`+t:t}function kOt(e){let t=e.slice(1,3),n=e.slice(3,5),r=e.slice(5,7);return[parseInt(t,16),parseInt(n,16),parseInt(r,16)]}function AOt(e,t,n){return`#${bG(e)}${bG(t)}${bG(n)}`}function jOt(e,t,n){let r=Number(t)/100,i=Number(n)/100,[a,o,s]=MOt(Number(e),r,i);return`#${xG(a)}${xG(o)}${xG(s)}`}function MOt(e,t,n){if(t===0){let e=Math.round(n*255);return[e,e,e]}let r;r=n<.5?n*(1+t):n+t-n*t;let i=2*n-r;e/=360;let a=NOt(e+.333),o=e,s=NOt(e-.333),c=SG(r,i,a),l=SG(r,i,o),u=SG(r,i,s);return[Math.round(c*255),Math.round(l*255),Math.round(u*255)]}function NOt(e){return e<0?e+1:e>1?e-1:e}function SG(e,t,n){return 6*n<1?t+(e-t)*6*n:2*n<1?e:3*n<2?t+(e-t)*(.666-n)*6:t}function POt(e,t,n){let r=e/255,i=t/255,a=n/255,o=Math.min(r,i,a),s=Math.max(r,i,a),c=(s+o)/2;if(s===o)return[0,0,c];let l;l=c<=.5?(s-o)/(s+o):(s-o)/(2-s-o);let u;for(u=s===r?(i-a)/(s-o):i===s?2+(a-r)/(s-o):4+(r-i)/(s-o),u=Math.round(u*60);u<0;)u+=360;return[u,l,c]}var CG,FOt,wG,TG,IOt,LOt,ROt,EG,DG,zOt,BOt,VOt,HOt=s((()=>{RU(),dW(),yG(),CG=new Map([[`aliceblue`,`#f0f8ff`],[`antiquewhite`,`#faebd7`],[`aqua`,`#00ffff`],[`aquamarine`,`#7fffd4`],[`azure`,`#f0ffff`],[`beige`,`#f5f5dc`],[`bisque`,`#ffe4c4`],[`black`,`#000000`],[`blanchedalmond`,`#ffebcd`],[`blue`,`#0000ff`],[`blueviolet`,`#8a2be2`],[`brown`,`#a52a2a`],[`burlywood`,`#deb887`],[`cadetblue`,`#5f9ea0`],[`chartreuse`,`#7fff00`],[`chocolate`,`#d2691e`],[`coral`,`#ff7f50`],[`cornflowerblue`,`#6495ed`],[`cornsilk`,`#fff8dc`],[`crimson`,`#dc143c`],[`cyan`,`#00ffff`],[`darkblue`,`#00008b`],[`darkcyan`,`#008b8b`],[`darkgoldenrod`,`#b8860b`],[`darkgray`,`#a9a9a9`],[`darkgreen`,`#006400`],[`darkgrey`,`#a9a9a9`],[`darkkhaki`,`#bdb76b`],[`darkmagenta`,`#8b008b`],[`darkolivegreen`,`#556b2f`],[`darkorange`,`#ff8c00`],[`darkorchid`,`#9932cc`],[`darkred`,`#8b0000`],[`darksalmon`,`#e9967a`],[`darkseagreen`,`#8fbc8f`],[`darkslateblue`,`#483d8b`],[`darkslategray`,`#2f4f4f`],[`darkslategrey`,`#2f4f4f`],[`darkturquoise`,`#00ced1`],[`darkviolet`,`#9400d3`],[`deeppink`,`#ff1493`],[`deepskyblue`,`#00bfff`],[`dimgray`,`#696969`],[`dimgrey`,`#696969`],[`dodgerblue`,`#1e90ff`],[`firebrick`,`#b22222`],[`floralwhite`,`#fffaf0`],[`forestgreen`,`#228b22`],[`fuchsia`,`#ff00ff`],[`gainsboro`,`#dcdcdc`],[`ghostwhite`,`#f8f8ff`],[`goldenrod`,`#daa520`],[`gold`,`#ffd700`],[`gray`,`#808080`],[`green`,`#008000`],[`greenyellow`,`#adff2f`],[`grey`,`#808080`],[`honeydew`,`#f0fff0`],[`hotpink`,`#ff69b4`],[`indianred`,`#cd5c5c`],[`indigo`,`#4b0082`],[`ivory`,`#fffff0`],[`khaki`,`#f0e68c`],[`lavenderblush`,`#fff0f5`],[`lavender`,`#e6e6fa`],[`lawngreen`,`#7cfc00`],[`lemonchiffon`,`#fffacd`],[`lightblue`,`#add8e6`],[`lightcoral`,`#f08080`],[`lightcyan`,`#e0ffff`],[`lightgoldenrodyellow`,`#fafad2`],[`lightgray`,`#d3d3d3`],[`lightgreen`,`#90ee90`],[`lightgrey`,`#d3d3d3`],[`lightpink`,`#ffb6c1`],[`lightsalmon`,`#ffa07a`],[`lightseagreen`,`#20b2aa`],[`lightskyblue`,`#87cefa`],[`lightslategray`,`#778899`],[`lightslategrey`,`#778899`],[`lightsteelblue`,`#b0c4de`],[`lightyellow`,`#ffffe0`],[`lime`,`#00ff00`],[`limegreen`,`#32cd32`],[`linen`,`#faf0e6`],[`magenta`,`#ff00ff`],[`maroon`,`#800000`],[`mediumaquamarine`,`#66cdaa`],[`mediumblue`,`#0000cd`],[`mediumorchid`,`#ba55d3`],[`mediumpurple`,`#9370db`],[`mediumseagreen`,`#3cb371`],[`mediumslateblue`,`#7b68ee`],[`mediumspringgreen`,`#00fa9a`],[`mediumturquoise`,`#48d1cc`],[`mediumvioletred`,`#c71585`],[`midnightblue`,`#191970`],[`mintcream`,`#f5fffa`],[`mistyrose`,`#ffe4e1`],[`moccasin`,`#ffe4b5`],[`navajowhite`,`#ffdead`],[`navy`,`#000080`],[`oldlace`,`#fdf5e6`],[`olive`,`#808000`],[`olivedrab`,`#6b8e23`],[`orange`,`#ffa500`],[`orangered`,`#ff4500`],[`orchid`,`#da70d6`],[`palegoldenrod`,`#eee8aa`],[`palegreen`,`#98fb98`],[`paleturquoise`,`#afeeee`],[`palevioletred`,`#db7093`],[`papayawhip`,`#ffefd5`],[`peachpuff`,`#ffdab9`],[`peru`,`#cd853f`],[`pink`,`#ffc0cb`],[`plum`,`#dda0dd`],[`powderblue`,`#b0e0e6`],[`purple`,`#800080`],[`rebeccapurple`,`#663399`],[`red`,`#ff0000`],[`rosybrown`,`#bc8f8f`],[`royalblue`,`#4169e1`],[`saddlebrown`,`#8b4513`],[`salmon`,`#fa8072`],[`sandybrown`,`#f4a460`],[`seagreen`,`#2e8b57`],[`seashell`,`#fff5ee`],[`sienna`,`#a0522d`],[`silver`,`#c0c0c0`],[`skyblue`,`#87ceeb`],[`slateblue`,`#6a5acd`],[`slategray`,`#708090`],[`slategrey`,`#708090`],[`snow`,`#fffafa`],[`springgreen`,`#00ff7f`],[`steelblue`,`#4682b4`],[`tan`,`#d2b48c`],[`teal`,`#008080`],[`thistle`,`#d8bfd8`],[`tomato`,`#ff6347`],[`turquoise`,`#40e0d0`],[`violet`,`#ee82ee`],[`wheat`,`#f5deb3`],[`white`,`#ffffff`],[`whitesmoke`,`#f5f5f5`],[`yellow`,`#ffff00`],[`yellowgreen`,`#9acd32`]]),FOt=function(e,t){var n={};for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&t.indexOf(r)<0&&(n[r]=e[r]);if(e!=null&&typeof Object.getOwnPropertySymbols==`function`)for(var i=0,r=Object.getOwnPropertySymbols(e);i<r.length;i++)t.indexOf(r[i])<0&&Object.prototype.propertyIsEnumerable.call(e,r[i])&&(n[r[i]]=e[r[i]]);return n},wG=new WeakMap,TG=(function(e){return e.rgb=`RGB`,e.hex=`HEX`,e.named=`NAMED`,e.hsl=`HSL`,e})(TG||={}),IOt=/rgb(?:a)?\(\s*(\d{1,3}%?)\s*,?\s*(\d{1,3}%?)\s*,?\s*(\d{1,3}%?)\s*([,/]\s*0?\.?\d+%?)?\)/,LOt=/hsl\(\s*(\d{1,3})\s*,\s*(\d{1,3})%\s*,\s*(\d{1,3})%\s*(,\s*0?\.\d+)?\)/,ROt=/(^|\b)(#[0-9a-f]{3,9})(\b|$)/i,EG=`cm-css-color-picker-wrapper`,DG=class extends jV{constructor(e){var{color:t}=e,n=FOt(e,[`color`]);super(),this.state=n,this.color=t}eq(e){return e.state.colorType===this.state.colorType&&e.color===this.color&&e.state.from===this.state.from&&e.state.to===this.state.to&&e.state.alpha===this.state.alpha}toDOM(){let e=document.createElement(`input`);wG.set(e,this.state),e.type=`color`,e.value=this.color;let t=document.createElement(`span`);return t.appendChild(e),t.className=EG,t}ignoreEvent(){return!1}},zOt=oU.baseTheme({[`.${EG}`]:{display:`inline-block`,outline:`1px solid #eee`,marginRight:`0.6ch`,height:`1em`,width:`1em`,transform:`translateY(1px)`},[`.${EG} input[type="color"]`]:{cursor:`pointer`,height:`100%`,width:`100%`,padding:0,border:`none`,"&::-webkit-color-swatch-wrapper":{padding:0},"&::-webkit-color-swatch":{border:`none`},"&::-moz-color-swatch":{border:`none`}}}),BOt=e=>fH.fromClass(class{constructor(t){this.decorations=DOt(t,e.discoverColors)}update(t){(t.docChanged||t.viewportChanged)&&(this.decorations=DOt(t.view,e.discoverColors))}},{decorations:e=>e.decorations,eventHandlers:{change:(e,t)=>{let n=e.target;if(n.nodeName!==`INPUT`||!n.parentElement||!n.parentElement.classList.contains(`cm-css-color-picker-wrapper`))return!1;let r=wG.get(n),i=n.value+r.alpha;if(r.colorType===TG.rgb)i=`rgb(${kOt(n.value).join(`, `)}${r.alpha})`;else if(r.colorType===TG.named)for(let[e,t]of CG.entries())t===n.value&&(i=e);else if(r.colorType===TG.hsl){let[e,t,a]=kOt(n.value),[o,s,c]=POt(e,t,a);i=`hsl(${o}, ${Math.round(s*100)}%, ${Math.round(c*100)}%${r.alpha})`}return t.dispatch({changes:{from:r.from,to:r.to,insert:i}}),!0}}}),VOt=[BOt({discoverColors:COt}),zOt]}));function UOt(e){let t=Object.keys(e).join(``),n=/\w/.test(t);return n&&(t=t.replace(/\w/g,``)),`[${n?`\\w`:``}${t.replace(/[^\w\s]/g,`\\$&`)}]`}function WOt(e){let t=Object.create(null),n=Object.create(null);for(let{label:r}of e){t[r[0]]=!0;for(let e=1;e<r.length;e++)n[r[e]]=!0}let r=UOt(t)+UOt(n)+`*$`;return[RegExp(`^`+r),new RegExp(r)]}function GOt(e){let t=e.map(e=>typeof e==`string`?{label:e}:e),[n,r]=t.every(e=>/^\w+$/.test(e.label))?[/\w*$/,/\w+$/]:WOt(t);return e=>{let i=e.matchBefore(r);return i||e.explicit?{from:i?i.from:e.pos,options:t,validFor:n}:null}}function KOt(e,t){return n=>{for(let t=NW(n.state).resolveInner(n.pos,-1);t;t=t.parent){if(e.indexOf(t.name)>-1)return null;if(t.type.isTop)break}return t(n)}}function OG(e){return e.selection.main.from}function qOt(e,t){let{source:n}=e,r=t&&n[0]!=`^`,i=n[n.length-1]!=`$`;return!r&&!i?e:RegExp(`${r?`^`:``}(?:${n})${i?`$`:``}`,e.flags??(e.ignoreCase?`i`:``))}function JOt(e,t,n,r){let{main:i}=e.selection,a=n-i.from,o=r-i.from;return Object.assign(Object.assign({},e.changeByRange(s=>{if(s!=i&&n!=r&&e.sliceDoc(s.from+a,s.from+o)!=e.sliceDoc(n,r))return{range:s};let c=e.toText(t);return{changes:{from:s.from+a,to:r==i.from?s.to:s.from+o,insert:c},range:Bz.cursor(s.from+a+c.length)}})),{scrollIntoView:!0,userEvent:`input.complete`})}function YOt(e){if(!Array.isArray(e))return e;let t=RG.get(e);return t||RG.set(e,t=GOt(e)),t}function XOt(e,t){return e?t?e+` `+t:e:t}function ZOt(e,t,n,r,i,a){let o=e.textDirection==HV.RTL,s=o,c=!1,l=`top`,u,d,f=t.left-i.left,p=i.right-t.right,m=r.right-r.left,h=r.bottom-r.top;if(s&&f<Math.min(m,p)?s=!1:!s&&p<Math.min(m,f)&&(s=!0),m<=(s?f:p))u=Math.max(i.top,Math.min(n.top,i.bottom-h))-t.top,d=Math.min(400,s?f:p);else{c=!0,d=Math.min(400,(o?t.right:i.right-t.left)-30);let e=i.bottom-t.bottom;e>=h||e>t.top?u=n.bottom-t.top:(l=`bottom`,u=t.bottom-n.top)}let g=(t.bottom-t.top)/a.offsetHeight,_=(t.right-t.left)/a.offsetWidth;return{style:`${l}: ${u/g}px; max-width: ${d/_}px`,class:`cm-completionInfo-`+(c?o?`left-narrow`:`right-narrow`:s?`left`:`right`)}}function QOt(e){let t=e.addToOptions.slice();return e.icons&&t.push({render(e){let t=document.createElement(`div`);return t.classList.add(`cm-completionIcon`),e.type&&t.classList.add(...e.type.split(/\s+/g).map(e=>`cm-completionIcon-`+e)),t.setAttribute(`aria-hidden`,`true`),t},position:20}),t.push({render(e,t,n,r){let i=document.createElement(`span`);i.className=`cm-completionLabel`;let a=e.displayLabel||e.label,o=0;for(let e=0;e<r.length;){let t=r[e++],n=r[e++];t>o&&i.appendChild(document.createTextNode(a.slice(o,t)));let s=i.appendChild(document.createElement(`span`));s.appendChild(document.createTextNode(a.slice(t,n))),s.className=`cm-completionMatchedText`,o=n}return o<a.length&&i.appendChild(document.createTextNode(a.slice(o))),i},position:50},{render(e){if(!e.detail)return null;let t=document.createElement(`span`);return t.className=`cm-completionDetail`,t.textContent=e.detail,t},position:80}),t.sort((e,t)=>e.position-t.position).map(e=>e.render)}function kG(e,t,n){if(e<=n)return{from:0,to:e};if(t<0&&(t=0),t<=e>>1){let e=Math.floor(t/n);return{from:e*n,to:(e+1)*n}}let r=Math.floor((e-t)/n);return{from:e-(r+1)*n,to:e-r*n}}function $Ot(e,t){return n=>new wkt(n,e,t)}function ekt(e,t){let n=e.getBoundingClientRect(),r=t.getBoundingClientRect(),i=n.height/e.offsetHeight;r.top<n.top?e.scrollTop-=(n.top-r.top)/i:r.bottom>n.bottom&&(e.scrollTop+=(r.bottom-n.bottom)/i)}function tkt(e){return(e.boost||0)*100+(e.apply?10:0)+(e.info?5:0)+(e.type?1:0)}function nkt(e,t){let n=[],r=null,i=e=>{n.push(e);let{section:t}=e.completion;if(t){r||=[];let e=typeof t==`string`?t:t.name;r.some(t=>t.name==e)||r.push(typeof t==`string`?{name:e}:t)}},a=t.facet(VG);for(let r of e)if(r.hasResult()){let e=r.result.getMatch;if(r.result.filter===!1)for(let t of r.result.options)i(new IG(t,r.source,e?e(t):[],1e9-n.length));else{let n=t.sliceDoc(r.from,r.to),o,s=a.filterStrict?new Ckt(n):new Skt(n);for(let t of r.result.options)if(o=s.match(t.label)){let n=t.displayLabel?e?e(t,o.matched):[]:o.matched;i(new IG(t,r.source,n,o.score+(t.boost||0)))}}}if(r){let e=Object.create(null),t=0,i=(e,t)=>(e.rank??1e9)-(t.rank??1e9)||(e.name<t.name?-1:1);for(let n of r.sort(i))t-=1e5,e[n.name]=t;for(let t of n){let{section:n}=t.completion;n&&(t.score+=e[typeof n==`string`?n:n.name])}}let o=[],s=null,c=a.compareCompletions;for(let e of n.sort((e,t)=>t.score-e.score||c(e.completion,t.completion))){let t=e.completion;!s||s.label!=t.label||s.detail!=t.detail||s.type!=null&&t.type!=null&&s.type!=t.type||s.apply!=t.apply||s.boost!=t.boost?o.push(e):tkt(e.completion)>tkt(s)&&(o[o.length-1]=e),s=e.completion}return o}function rkt(e,t){if(e==t)return!0;for(let n=0,r=0;;){for(;n<e.length&&!e[n].hasResult();)n++;for(;r<t.length&&!t[r].hasResult();)r++;let i=n==e.length,a=r==t.length;if(i||a)return i==a;if(e[n++].result!=t[r++].result)return!1}}function ikt(e,t){let n={"aria-autocomplete":`list`,"aria-haspopup":`listbox`,"aria-controls":e};return t>-1&&(n[`aria-activedescendant`]=e+`-`+t),n}function akt(e,t){if(e.isUserEvent(`input.complete`)){let n=e.annotation(LG);if(n&&t.activateOnCompletion(n))return 12}let n=e.isUserEvent(`input.type`);return n&&t.activateOnTyping?5:n?1:e.isUserEvent(`delete.backward`)?2:e.selection?8:e.docChanged?16:0}function okt(e,t,n,r){if(!e)return!1;let i=t.sliceDoc(n,r);return typeof e==`function`?e(i,n,r,t):qOt(e,!0).test(i)}function AG(e,t){let n=t.completion.apply||t.completion.label,r=e.state.field(KG).active.find(e=>e.source==t.source);return r instanceof UG?(typeof n==`string`?e.dispatch(Object.assign(Object.assign({},JOt(e.state,n,r.from,r.to)),{annotations:LG.of(t.completion)})):n(e,t.completion,r.from,r.to),!0):!1}function jG(e,t=`option`){return n=>{let r=n.state.field(KG,!1);if(!r||!r.open||r.open.disabled||Date.now()-r.open.timestamp<n.state.facet(VG).interactionDelay)return!1;let i=1,a;t==`page`&&(a=UTt(n,r.open.tooltip))&&(i=Math.max(2,Math.floor(a.dom.offsetHeight/a.dom.querySelector(`li`).offsetHeight)-1));let{length:o}=r.open.options,s=r.open.selected>-1?r.open.selected+i*(e?1:-1):e?0:o-1;return s<0?s=t==`page`?0:o-1:s>=o&&(s=t==`page`?o-1:0),n.dispatch({effects:GG.of(s)}),!0}}function MG(e,t){return Bz.create(e.filter(e=>e.field==t).map(e=>Bz.range(e.from,e.to)))}function skt(e){let t=Vkt.parse(e);return(e,n,r,i)=>{let{text:a,ranges:o}=t.instantiate(e.state,r),s={changes:{from:r,to:i,insert:Oz.of(a)},scrollIntoView:!0,annotations:n?[LG.of(n),sB.userEvent.of(`input.complete`)]:void 0};if(o.length&&(s.selection=MG(o,0)),o.some(e=>e.field>0)){let t=new YG(o,0),n=s.effects=[XG.of(t)];e.state.field(ZG,!1)===void 0&&n.push(oB.appendConfig.of([ZG,Ykt,Xkt,JG]))}e.dispatch(e.state.update(s))}}function ckt(e){return({state:t,dispatch:n})=>{let r=t.field(ZG,!1);if(!r||e<0&&r.active==0)return!1;let i=r.active+e,a=e>0&&!r.ranges.some(t=>t.field==i+e);return n(t.update({selection:MG(r.ranges,i),effects:XG.of(a?null:new YG(r.ranges,i)),scrollIntoView:!0})),!0}}function NG(e,t){return Object.assign(Object.assign({},t),{apply:skt(e)})}function lkt(){return[Qkt,nK]}function ukt(e){for(let t=0;t<8;t+=2)if(rK.charCodeAt(t)==e)return rK.charAt(t+1);return dCt(e<128?e:e+1)}function dkt(e,t){return e.languageDataAt(`closeBrackets`,t)[0]||$G}function fkt(e,t){let n=dkt(e,e.selection.main.head),r=n.brackets||$G.brackets;for(let i of r){let a=ukt(cz(i,0));if(t==i)return a==i?_kt(e,i,r.indexOf(i+i+i)>-1,n):hkt(e,i,a,n.before||$G.before);if(t==a&&pkt(e,e.selection.main.from))return gkt(e,i,a)}return null}function pkt(e,t){let n=!1;return e.field(nK).between(0,e.doc.length,e=>{e==t&&(n=!0)}),n}function PG(e,t){let n=e.sliceString(t,t+2);return n.slice(0,lz(cz(n,0)))}function mkt(e,t){let n=e.sliceString(t-2,t);return lz(cz(n,0))==n.length?n:n.slice(1)}function hkt(e,t,n,r){let i=null,a=e.changeByRange(a=>{if(!a.empty)return{changes:[{insert:t,from:a.from},{insert:n,from:a.to}],effects:eK.of(a.to+t.length),range:Bz.range(a.anchor+t.length,a.head+t.length)};let o=PG(e.doc,a.head);return!o||/\s/.test(o)||r.indexOf(o)>-1?{changes:{insert:t+n,from:a.head},effects:eK.of(a.head+t.length),range:Bz.cursor(a.head+t.length)}:{range:i=a}});return i?null:e.update(a,{scrollIntoView:!0,userEvent:`input.type`})}function gkt(e,t,n){let r=null,i=e.changeByRange(t=>t.empty&&PG(e.doc,t.head)==n?{changes:{from:t.head,to:t.head+n.length,insert:n},range:Bz.cursor(t.head+n.length)}:r={range:t});return r?null:e.update(i,{scrollIntoView:!0,userEvent:`input.type`})}function _kt(e,t,n,r){let i=r.stringPrefixes||$G.stringPrefixes,a=null,o=e.changeByRange(r=>{if(!r.empty)return{changes:[{insert:t,from:r.from},{insert:t,from:r.to}],effects:eK.of(r.to+t.length),range:Bz.range(r.anchor+t.length,r.head+t.length)};let o=r.head,s=PG(e.doc,o),c;if(s==t){if(vkt(e,o))return{changes:{insert:t+t,from:o},effects:eK.of(o+t.length),range:Bz.cursor(o+t.length)};if(pkt(e,o)){let r=n&&e.sliceDoc(o,o+t.length*3)==t+t+t?t+t+t:t;return{changes:{from:o,to:o+r.length,insert:r},range:Bz.cursor(o+r.length)}}}else if(n&&e.sliceDoc(o-2*t.length,o)==t+t&&(c=bkt(e,o-2*t.length,i))>-1&&vkt(e,c))return{changes:{insert:t+t+t+t,from:o},effects:eK.of(o+t.length),range:Bz.cursor(o+t.length)};else if(e.charCategorizer(o)(s)!=cB.Word&&bkt(e,o,i)>-1&&!ykt(e,o,t,i))return{changes:{insert:t+t,from:o},effects:eK.of(o+t.length),range:Bz.cursor(o+t.length)};return{range:a=r}});return a?null:e.update(o,{scrollIntoView:!0,userEvent:`input.type`})}function vkt(e,t){let n=NW(e).resolveInner(t+1);return n.parent&&n.from==t}function ykt(e,t,n,r){let i=NW(e).resolveInner(t,-1),a=r.reduce((e,t)=>Math.max(e,t.length),0);for(let o=0;o<5;o++){let o=e.sliceDoc(i.from,Math.min(i.to,i.from+n.length+a)),s=o.indexOf(n);if(!s||s>-1&&r.indexOf(o.slice(0,s))>-1){let t=i.firstChild;for(;t&&t.from==i.from&&t.to-t.from>n.length+s;){if(e.sliceDoc(t.to-n.length,t.to)==n)return!1;t=t.firstChild}return!0}let c=i.to==t&&i.parent;if(!c)break;i=c}return!1}function bkt(e,t,n){let r=e.charCategorizer(t);if(r(e.sliceDoc(t-1,t))!=cB.Word)return t;for(let i of n){let n=t-i.length;if(e.sliceDoc(n,t)==i&&r(e.sliceDoc(n-1,n))!=cB.Word)return n}return-1}function xkt(e={}){return[Rkt,KG,VG.of(e),Ikt,tAt,JG]}var FG,IG,LG,RG,zG,BG,Skt,Ckt,VG,wkt,Tkt,Ekt,Dkt,Okt,kkt,HG,UG,WG,GG,KG,Akt,jkt,qG,Mkt,Nkt,Pkt,Fkt,Ikt,Lkt,Rkt,JG,zkt,Bkt,Vkt,Hkt,Ukt,YG,XG,Wkt,ZG,Gkt,Kkt,qkt,Jkt,QG,Ykt,Xkt,$G,eK,tK,nK,rK,Zkt,Qkt,$kt,eAt,iK,tAt,nAt=s((()=>{vB(),RU(),yG(),FG=class{constructor(e,t,n,r){this.state=e,this.pos=t,this.explicit=n,this.view=r,this.abortListeners=[],this.abortOnDocChange=!1}tokenBefore(e){let t=NW(this.state).resolveInner(this.pos,-1);for(;t&&e.indexOf(t.name)<0;)t=t.parent;return t?{from:t.from,to:this.pos,text:this.state.sliceDoc(t.from,this.pos),type:t.type}:null}matchBefore(e){let t=this.state.doc.lineAt(this.pos),n=Math.max(t.from,this.pos-250),r=t.text.slice(n-t.from,this.pos-t.from),i=r.search(qOt(e,!1));return i<0?null:{from:n+i,to:this.pos,text:r.slice(i)}}get aborted(){return this.abortListeners==null}addEventListener(e,t,n){e==`abort`&&this.abortListeners&&(this.abortListeners.push(t),n&&n.onDocChange&&(this.abortOnDocChange=!0))}},IG=class{constructor(e,t,n,r){this.completion=e,this.source=t,this.match=n,this.score=r}},LG=aB.define(),RG=new WeakMap,zG=oB.define(),BG=oB.define(),Skt=class{constructor(e){this.pattern=e,this.chars=[],this.folded=[],this.any=[],this.precise=[],this.byWord=[],this.score=0,this.matched=[];for(let t=0;t<e.length;){let n=cz(e,t),r=lz(n);this.chars.push(n);let i=e.slice(t,t+r),a=i.toUpperCase();this.folded.push(cz(a==i?i.toLowerCase():a,0)),t+=r}this.astral=e.length!=this.chars.length}ret(e,t){return this.score=e,this.matched=t,this}match(e){if(this.pattern.length==0)return this.ret(-100,[]);if(e.length<this.pattern.length)return null;let{chars:t,folded:n,any:r,precise:i,byWord:a}=this;if(t.length==1){let r=cz(e,0),i=lz(r),a=i==e.length?0:-100;if(r!=t[0])if(r==n[0])a+=-200;else return null;return this.ret(a,[0,i])}let o=e.indexOf(this.pattern);if(o==0)return this.ret(e.length==this.pattern.length?0:-100,[0,this.pattern.length]);let s=t.length,c=0;if(o<0){for(let i=0,a=Math.min(e.length,200);i<a&&c<s;){let a=cz(e,i);(a==t[c]||a==n[c])&&(r[c++]=i),i+=lz(a)}if(c<s)return null}let l=0,u=0,d=!1,f=0,p=-1,m=-1,h=/[a-z]/.test(e),g=!0;for(let r=0,c=Math.min(e.length,200),_=0;r<c&&u<s;){let c=cz(e,r);o<0&&(l<s&&c==t[l]&&(i[l++]=r),f<s&&(c==t[f]||c==n[f]?(f==0&&(p=r),m=r+1,f++):f=0));let v,y=c<255?c>=48&&c<=57||c>=97&&c<=122?2:c>=65&&c<=90?1:0:(v=dCt(c))==v.toLowerCase()?v==v.toUpperCase()?0:2:1;(!r||y==1&&h||_==0&&y!=0)&&(t[u]==c||n[u]==c&&(d=!0)?a[u++]=r:a.length&&(g=!1)),_=y,r+=lz(c)}return u==s&&a[0]==0&&g?this.result(-100+(d?-200:0),a,e):f==s&&p==0?this.ret(-200-e.length+(m==e.length?0:-100),[0,m]):o>-1?this.ret(-700-e.length,[o,o+this.pattern.length]):f==s?this.ret(-900-e.length,[p,m]):u==s?this.result(-100+(d?-200:0)+-700+(g?0:-1100),a,e):t.length==2?null:this.result((r[0]?-700:0)+-200+-1100,r,e)}result(e,t,n){let r=[],i=0;for(let e of t){let t=e+(this.astral?lz(cz(n,e)):1);i&&r[i-1]==e?r[i-1]=t:(r[i++]=e,r[i++]=t)}return this.ret(e-n.length,r)}},Ckt=class{constructor(e){this.pattern=e,this.matched=[],this.score=0,this.folded=e.toLowerCase()}match(e){if(e.length<this.pattern.length)return null;let t=e.slice(0,this.pattern.length),n=t==this.pattern?0:t.toLowerCase()==this.folded?-200:null;return n==null?null:(this.matched=[0,t.length],this.score=n+(e.length==this.pattern.length?0:-100),this)}},VG=Hz.define({combine(e){return xz(e,{activateOnTyping:!0,activateOnCompletion:()=>!1,activateOnTypingDelay:100,selectOnOpen:!0,override:null,closeOnBlur:!0,maxRenderedOptions:100,defaultKeymap:!0,tooltipClass:()=>``,optionClass:()=>``,aboveCursor:!1,icons:!0,addToOptions:[],positionInfo:ZOt,filterStrict:!1,compareCompletions:(e,t)=>e.label.localeCompare(t.label),interactionDelay:75,updateSyncTime:100},{defaultKeymap:(e,t)=>e&&t,closeOnBlur:(e,t)=>e&&t,icons:(e,t)=>e&&t,tooltipClass:(e,t)=>n=>XOt(e(n),t(n)),optionClass:(e,t)=>n=>XOt(e(n),t(n)),addToOptions:(e,t)=>e.concat(t),filterStrict:(e,t)=>e||t})}}),wkt=class{constructor(e,t,n){this.view=e,this.stateField=t,this.applyCompletion=n,this.info=null,this.infoDestroy=null,this.placeInfoReq={read:()=>this.measureInfo(),write:e=>this.placeInfo(e),key:this},this.space=null,this.currentClass=``;let r=e.state.field(t),{options:i,selected:a}=r.open,o=e.state.facet(VG);this.optionContent=QOt(o),this.optionClass=o.optionClass,this.tooltipClass=o.tooltipClass,this.range=kG(i.length,a,o.maxRenderedOptions),this.dom=document.createElement(`div`),this.dom.className=`cm-tooltip-autocomplete`,this.updateTooltipClass(e.state),this.dom.addEventListener(`mousedown`,n=>{let{options:r}=e.state.field(t).open;for(let t=n.target,i;t&&t!=this.dom;t=t.parentNode)if(t.nodeName==`LI`&&(i=/-(\d+)$/.exec(t.id))&&+i[1]<r.length){this.applyCompletion(e,r[+i[1]]),n.preventDefault();return}}),this.dom.addEventListener(`focusout`,t=>{let n=e.state.field(this.stateField,!1);n&&n.tooltip&&e.state.facet(VG).closeOnBlur&&t.relatedTarget!=e.contentDOM&&e.dispatch({effects:BG.of(null)})}),this.showOptions(i,r.id)}mount(){this.updateSel()}showOptions(e,t){this.list&&this.list.remove(),this.list=this.dom.appendChild(this.createListBox(e,t,this.range)),this.list.addEventListener(`scroll`,()=>{this.info&&this.view.requestMeasure(this.placeInfoReq)})}update(e){let t=e.state.field(this.stateField),n=e.startState.field(this.stateField);if(this.updateTooltipClass(e.state),t!=n){let{options:r,selected:i,disabled:a}=t.open;(!n.open||n.open.options!=r)&&(this.range=kG(r.length,i,e.state.facet(VG).maxRenderedOptions),this.showOptions(r,t.id)),this.updateSel(),a!=n.open?.disabled&&this.dom.classList.toggle(`cm-tooltip-autocomplete-disabled`,!!a)}}updateTooltipClass(e){let t=this.tooltipClass(e);if(t!=this.currentClass){for(let e of this.currentClass.split(` `))e&&this.dom.classList.remove(e);for(let e of t.split(` `))e&&this.dom.classList.add(e);this.currentClass=t}}positioned(e){this.space=e,this.info&&this.view.requestMeasure(this.placeInfoReq)}updateSel(){let e=this.view.state.field(this.stateField),t=e.open;if((t.selected>-1&&t.selected<this.range.from||t.selected>=this.range.to)&&(this.range=kG(t.options.length,t.selected,this.view.state.facet(VG).maxRenderedOptions),this.showOptions(t.options,e.id)),this.updateSelectedOption(t.selected)){this.destroyInfo();let{completion:n}=t.options[t.selected],{info:r}=n;if(!r)return;let i=typeof r==`string`?document.createTextNode(r):r(n);if(!i)return;`then`in i?i.then(t=>{t&&this.view.state.field(this.stateField,!1)==e&&this.addInfoPane(t,n)}).catch(e=>KB(this.view.state,e,`completion info`)):this.addInfoPane(i,n)}}addInfoPane(e,t){this.destroyInfo();let n=this.info=document.createElement(`div`);if(n.className=`cm-tooltip cm-completionInfo`,e.nodeType!=null)n.appendChild(e),this.infoDestroy=null;else{let{dom:t,destroy:r}=e;n.appendChild(t),this.infoDestroy=r||null}this.dom.appendChild(n),this.view.requestMeasure(this.placeInfoReq)}updateSelectedOption(e){let t=null;for(let n=this.list.firstChild,r=this.range.from;n;n=n.nextSibling,r++)n.nodeName!=`LI`||!n.id?r--:r==e?n.hasAttribute(`aria-selected`)||(n.setAttribute(`aria-selected`,`true`),t=n):n.hasAttribute(`aria-selected`)&&n.removeAttribute(`aria-selected`);return t&&ekt(this.list,t),t}measureInfo(){let e=this.dom.querySelector(`[aria-selected]`);if(!e||!this.info)return null;let t=this.dom.getBoundingClientRect(),n=this.info.getBoundingClientRect(),r=e.getBoundingClientRect(),i=this.space;if(!i){let e=this.dom.ownerDocument.defaultView||window;i={left:0,top:0,right:e.innerWidth,bottom:e.innerHeight}}return r.top>Math.min(i.bottom,t.bottom)-10||r.bottom<Math.max(i.top,t.top)+10?null:this.view.state.facet(VG).positionInfo(this.view,t,r,n,i,this.dom)}placeInfo(e){this.info&&(e?(e.style&&(this.info.style.cssText=e.style),this.info.className=`cm-tooltip cm-completionInfo `+(e.class||``)):this.info.style.cssText=`top: -1e6px`)}createListBox(e,t,n){let r=document.createElement(`ul`);r.id=t,r.setAttribute(`role`,`listbox`),r.setAttribute(`aria-expanded`,`true`),r.setAttribute(`aria-label`,this.view.state.phrase(`Completions`));let i=null;for(let a=n.from;a<n.to;a++){let{completion:o,match:s}=e[a],{section:c}=o;if(c){let e=typeof c==`string`?c:c.name;if(e!=i&&(a>n.from||n.from==0))if(i=e,typeof c!=`string`&&c.header)r.appendChild(c.header(c));else{let t=r.appendChild(document.createElement(`completion-section`));t.textContent=e}}let l=r.appendChild(document.createElement(`li`));l.id=t+`-`+a,l.setAttribute(`role`,`option`);let u=this.optionClass(o);u&&(l.className=u);for(let e of this.optionContent){let t=e(o,this.view.state,this.view,s);t&&l.appendChild(t)}}return n.from&&r.classList.add(`cm-completionListIncompleteTop`),n.to<e.length&&r.classList.add(`cm-completionListIncompleteBottom`),r}destroyInfo(){this.info&&=(this.infoDestroy&&this.infoDestroy(),this.info.remove(),null)}destroy(){this.destroyInfo()}},Tkt=class e{constructor(e,t,n,r,i,a){this.options=e,this.attrs=t,this.tooltip=n,this.timestamp=r,this.selected=i,this.disabled=a}setSelected(t,n){return t==this.selected||t>=this.options.length?this:new e(this.options,ikt(n,t),this.tooltip,this.timestamp,t,this.disabled)}static build(t,n,r,i,a,o){if(i&&!o&&t.some(e=>e.isPending))return i.setDisabled();let s=nkt(t,n);if(!s.length)return i&&t.some(e=>e.isPending)?i.setDisabled():null;let c=n.facet(VG).selectOnOpen?0:-1;if(i&&i.selected!=c&&i.selected!=-1){let e=i.options[i.selected].completion;for(let t=0;t<s.length;t++)if(s[t].completion==e){c=t;break}}return new e(s,ikt(r,c),{pos:t.reduce((e,t)=>t.hasResult()?Math.min(e,t.from):e,1e8),create:Akt,above:a.aboveCursor},i?i.timestamp:Date.now(),c,!1)}map(t){return new e(this.options,this.attrs,Object.assign(Object.assign({},this.tooltip),{pos:t.mapPos(this.tooltip.pos)}),this.timestamp,this.selected,this.disabled)}setDisabled(){return new e(this.options,this.attrs,this.tooltip,this.timestamp,this.selected,!0)}},Ekt=class e{constructor(e,t,n){this.active=e,this.id=t,this.open=n}static start(){return new e(kkt,`cm-ac-`+Math.floor(Math.random()*2e6).toString(36),null)}update(t){let{state:n}=t,r=n.facet(VG),i=(r.override||n.languageDataAt(`autocomplete`,OG(n)).map(YOt)).map(e=>(this.active.find(t=>t.source==e)||new HG(e,this.active.some(e=>e.state!=0)?1:0)).update(t,r));i.length==this.active.length&&i.every((e,t)=>e==this.active[t])&&(i=this.active);let a=this.open,o=t.effects.some(e=>e.is(WG));a&&t.docChanged&&(a=a.map(t.changes)),t.selection||i.some(e=>e.hasResult()&&t.changes.touchesRange(e.from,e.to))||!rkt(i,this.active)||o?a=Tkt.build(i,n,this.id,a,r,o):a&&a.disabled&&!i.some(e=>e.isPending)&&(a=null),!a&&i.every(e=>!e.isPending)&&i.some(e=>e.hasResult())&&(i=i.map(e=>e.hasResult()?new HG(e.source,0):e));for(let e of t.effects)e.is(GG)&&(a&&=a.setSelected(e.value,this.id));return i==this.active&&a==this.open?this:new e(i,this.id,a)}get tooltip(){return this.open?this.open.tooltip:null}get attrs(){return this.open?this.open.attrs:this.active.length?Dkt:Okt}},Dkt={"aria-autocomplete":`list`},Okt={},kkt=[],HG=class e{constructor(e,t,n=!1){this.source=e,this.state=t,this.explicit=n}hasResult(){return!1}get isPending(){return this.state==1}update(t,n){let r=akt(t,n),i=this;(r&8||r&16&&this.touches(t))&&(i=new e(i.source,0)),r&4&&i.state==0&&(i=new e(this.source,1)),i=i.updateFor(t,r);for(let n of t.effects)if(n.is(zG))i=new e(i.source,1,n.value);else if(n.is(BG))i=new e(i.source,0);else if(n.is(WG))for(let e of n.value)e.source==i.source&&(i=e);return i}updateFor(e,t){return this.map(e.changes)}map(e){return this}touches(e){return e.changes.touchesRange(OG(e.state))}},UG=class e extends HG{constructor(e,t,n,r,i,a){super(e,3,t),this.limit=n,this.result=r,this.from=i,this.to=a}hasResult(){return!0}updateFor(t,n){if(!(n&3))return this.map(t.changes);let r=this.result;r.map&&!t.changes.empty&&(r=r.map(r,t.changes));let i=t.changes.mapPos(this.from),a=t.changes.mapPos(this.to,1),o=OG(t.state);if(o>a||!r||n&2&&(OG(t.startState)==this.from||o<this.limit))return new HG(this.source,n&4?1:0);let s=t.changes.mapPos(this.limit);return okt(r.validFor,t.state,i,a)?new e(this.source,this.explicit,s,r,i,a):r.update&&(r=r.update(r,i,a,new FG(t.state,o,!1)))?new e(this.source,this.explicit,s,r,r.from,r.to??OG(t.state)):new HG(this.source,1,this.explicit)}map(t){return t.empty?this:(this.result.map?this.result.map(this.result,t):this.result)?new e(this.source,this.explicit,t.mapPos(this.limit),this.result,t.mapPos(this.from),t.mapPos(this.to,1)):new HG(this.source,0)}touches(e){return e.changes.touchesRange(this.from,this.to)}},WG=oB.define({map(e,t){return e.map(e=>e.map(t))}}),GG=oB.define(),KG=Gz.define({create(){return Ekt.start()},update(e,t){return e.update(t)},provide:e=>[CU.from(e,e=>e.tooltip),oU.contentAttributes.from(e,e=>e.attrs)]}),Akt=$Ot(KG,AG),jkt=e=>{let t=e.state.field(KG,!1);return e.state.readOnly||!t||!t.open||t.open.selected<0||t.open.disabled||Date.now()-t.open.timestamp<e.state.facet(VG).interactionDelay?!1:AG(e,t.open.options[t.open.selected])},qG=e=>e.state.field(KG,!1)?(e.dispatch({effects:zG.of(!0)}),!0):!1,Mkt=e=>{let t=e.state.field(KG,!1);return!t||!t.active.some(e=>e.state!=0)?!1:(e.dispatch({effects:BG.of(null)}),!0)},Nkt=class{constructor(e,t){this.active=e,this.context=t,this.time=Date.now(),this.updates=[],this.done=void 0}},Pkt=50,Fkt=1e3,Ikt=fH.fromClass(class{constructor(e){this.view=e,this.debounceUpdate=-1,this.running=[],this.debounceAccept=-1,this.pendingStart=!1,this.composing=0;for(let t of e.state.field(KG).active)t.isPending&&this.startQuery(t)}update(e){let t=e.state.field(KG),n=e.state.facet(VG);if(!e.selectionSet&&!e.docChanged&&e.startState.field(KG)==t)return;let r=e.transactions.some(e=>{let t=akt(e,n);return t&8||(e.selection||e.docChanged)&&!(t&3)});for(let t=0;t<this.running.length;t++){let n=this.running[t];if(r||n.context.abortOnDocChange&&e.docChanged||n.updates.length+e.transactions.length>Pkt&&Date.now()-n.time>Fkt){for(let e of n.context.abortListeners)try{e()}catch(e){KB(this.view.state,e)}n.context.abortListeners=null,this.running.splice(t--,1)}else n.updates.push(...e.transactions)}this.debounceUpdate>-1&&clearTimeout(this.debounceUpdate),e.transactions.some(e=>e.effects.some(e=>e.is(zG)))&&(this.pendingStart=!0);let i=this.pendingStart?50:n.activateOnTypingDelay;if(this.debounceUpdate=t.active.some(e=>e.isPending&&!this.running.some(t=>t.active.source==e.source))?setTimeout(()=>this.startUpdate(),i):-1,this.composing!=0)for(let t of e.transactions)t.isUserEvent(`input.type`)?this.composing=2:this.composing==2&&t.selection&&(this.composing=3)}startUpdate(){this.debounceUpdate=-1,this.pendingStart=!1;let{state:e}=this.view,t=e.field(KG);for(let e of t.active)e.isPending&&!this.running.some(t=>t.active.source==e.source)&&this.startQuery(e);this.running.length&&t.open&&t.open.disabled&&(this.debounceAccept=setTimeout(()=>this.accept(),this.view.state.facet(VG).updateSyncTime))}startQuery(e){let{state:t}=this.view,n=new FG(t,OG(t),e.explicit,this.view),r=new Nkt(e,n);this.running.push(r),Promise.resolve(e.source(n)).then(e=>{r.context.aborted||(r.done=e||null,this.scheduleAccept())},e=>{this.view.dispatch({effects:BG.of(null)}),KB(this.view.state,e)})}scheduleAccept(){this.running.every(e=>e.done!==void 0)?this.accept():this.debounceAccept<0&&(this.debounceAccept=setTimeout(()=>this.accept(),this.view.state.facet(VG).updateSyncTime))}accept(){this.debounceAccept>-1&&clearTimeout(this.debounceAccept),this.debounceAccept=-1;let e=[],t=this.view.state.facet(VG),n=this.view.state.field(KG);for(let r=0;r<this.running.length;r++){let i=this.running[r];if(i.done===void 0)continue;if(this.running.splice(r--,1),i.done){let n=OG(i.updates.length?i.updates[0].startState:this.view.state),r=Math.min(n,i.done.from+(i.active.explicit?0:1)),a=new UG(i.active.source,i.active.explicit,r,i.done,i.done.from,i.done.to??n);for(let e of i.updates)a=a.update(e,t);if(a.hasResult()){e.push(a);continue}}let a=n.active.find(e=>e.source==i.active.source);if(a&&a.isPending)if(i.done==null){let n=new HG(i.active.source,0);for(let e of i.updates)n=n.update(e,t);n.isPending||e.push(n)}else this.startQuery(a)}(e.length||n.open&&n.open.disabled)&&this.view.dispatch({effects:WG.of(e)})}},{eventHandlers:{blur(e){let t=this.view.state.field(KG,!1);if(t&&t.tooltip&&this.view.state.facet(VG).closeOnBlur){let n=t.open&&UTt(this.view,t.open.tooltip);(!n||!n.dom.contains(e.relatedTarget))&&setTimeout(()=>this.view.dispatch({effects:BG.of(null)}),10)}},compositionstart(){this.composing=1},compositionend(){this.composing==3&&setTimeout(()=>this.view.dispatch({effects:zG.of(!1)}),20),this.composing=0}}}),Lkt=typeof navigator==`object`&&/Win/.test(navigator.platform),Rkt=qz.highest(oU.domEventHandlers({keydown(e,t){let n=t.state.field(KG,!1);if(!n||!n.open||n.open.disabled||n.open.selected<0||e.key.length>1||e.ctrlKey&&!(Lkt&&e.altKey)||e.metaKey)return!1;let r=n.open.options[n.open.selected],i=n.active.find(e=>e.source==r.source),a=r.completion.commitCharacters||i.result.commitCharacters;return a&&a.indexOf(e.key)>-1&&AG(t,r),!1}})),JG=oU.baseTheme({".cm-tooltip.cm-tooltip-autocomplete":{"& > ul":{fontFamily:`monospace`,whiteSpace:`nowrap`,overflow:`hidden auto`,maxWidth_fallback:`700px`,maxWidth:`min(700px, 95vw)`,minWidth:`250px`,maxHeight:`10em`,height:`100%`,listStyle:`none`,margin:0,padding:0,"& > li, & > completion-section":{padding:`1px 3px`,lineHeight:1.2},"& > li":{overflowX:`hidden`,textOverflow:`ellipsis`,cursor:`pointer`},"& > completion-section":{display:`list-item`,borderBottom:`1px solid silver`,paddingLeft:`0.5em`,opacity:.7}}},"&light .cm-tooltip-autocomplete ul li[aria-selected]":{background:`#17c`,color:`white`},"&light .cm-tooltip-autocomplete-disabled ul li[aria-selected]":{background:`#777`},"&dark .cm-tooltip-autocomplete ul li[aria-selected]":{background:`#347`,color:`white`},"&dark .cm-tooltip-autocomplete-disabled ul li[aria-selected]":{background:`#444`},".cm-completionListIncompleteTop:before, .cm-completionListIncompleteBottom:after":{content:`"···"`,opacity:.5,display:`block`,textAlign:`center`},".cm-tooltip.cm-completionInfo":{position:`absolute`,padding:`3px 9px`,width:`max-content`,maxWidth:`400px`,boxSizing:`border-box`,whiteSpace:`pre-line`},".cm-completionInfo.cm-completionInfo-left":{right:`100%`},".cm-completionInfo.cm-completionInfo-right":{left:`100%`},".cm-completionInfo.cm-completionInfo-left-narrow":{right:`30px`},".cm-completionInfo.cm-completionInfo-right-narrow":{left:`30px`},"&light .cm-snippetField":{backgroundColor:`#00000022`},"&dark .cm-snippetField":{backgroundColor:`#ffffff22`},".cm-snippetFieldPosition":{verticalAlign:`text-top`,width:0,height:`1.15em`,display:`inline-block`,margin:`0 -0.7px -.7em`,borderLeft:`1.4px dotted #888`},".cm-completionMatchedText":{textDecoration:`underline`},".cm-completionDetail":{marginLeft:`0.5em`,fontStyle:`italic`},".cm-completionIcon":{fontSize:`90%`,width:`.8em`,display:`inline-block`,textAlign:`center`,paddingRight:`.6em`,opacity:`0.6`,boxSizing:`content-box`},".cm-completionIcon-function, .cm-completionIcon-method":{"&:after":{content:`'ƒ'`}},".cm-completionIcon-class":{"&:after":{content:`'○'`}},".cm-completionIcon-interface":{"&:after":{content:`'◌'`}},".cm-completionIcon-variable":{"&:after":{content:`'𝑥'`}},".cm-completionIcon-constant":{"&:after":{content:`'𝐶'`}},".cm-completionIcon-type":{"&:after":{content:`'𝑡'`}},".cm-completionIcon-enum":{"&:after":{content:`'∪'`}},".cm-completionIcon-property":{"&:after":{content:`'□'`}},".cm-completionIcon-keyword":{"&:after":{content:`'🔑︎'`}},".cm-completionIcon-namespace":{"&:after":{content:`'▢'`}},".cm-completionIcon-text":{"&:after":{content:`'abc'`,fontSize:`50%`,verticalAlign:`middle`}}}),zkt=class{constructor(e,t,n,r){this.field=e,this.line=t,this.from=n,this.to=r}},Bkt=class e{constructor(e,t,n){this.field=e,this.from=t,this.to=n}map(t){let n=t.mapPos(this.from,-1,Fz.TrackDel),r=t.mapPos(this.to,1,Fz.TrackDel);return n==null||r==null?null:new e(this.field,n,r)}},Vkt=class e{constructor(e,t){this.lines=e,this.fieldPositions=t}instantiate(e,t){let n=[],r=[t],i=e.doc.lineAt(t),a=/^\s*/.exec(i.text)[0];for(let i of this.lines){if(n.length){let n=a,o=/^\t*/.exec(i)[0].length;for(let t=0;t<o;t++)n+=e.facet($W);r.push(t+n.length-o),i=n+i.slice(o)}n.push(i),t+=i.length+1}return{text:n,ranges:this.fieldPositions.map(e=>new Bkt(e.field,r[e.line]+e.from,r[e.line]+e.to))}}static parse(t){let n=[],r=[],i=[],a;for(let e of t.split(/\r\n?|\n/)){for(;a=/[#$]\{(?:(\d+)(?::([^}]*))?|((?:\\[{}]|[^}])*))\}/.exec(e);){let t=a[1]?+a[1]:null,o=a[2]||a[3]||``,s=-1,c=o.replace(/\\[{}]/g,e=>e[1]);for(let e=0;e<n.length;e++)(t==null?c&&n[e].name==c:n[e].seq==t)&&(s=e);if(s<0){let e=0;for(;e<n.length&&(t==null||n[e].seq!=null&&n[e].seq<t);)e++;n.splice(e,0,{seq:t,name:c}),s=e;for(let e of i)e.field>=s&&e.field++}i.push(new zkt(s,r.length,a.index,a.index+c.length)),e=e.slice(0,a.index)+o+e.slice(a.index+a[0].length)}e=e.replace(/\\([{}])/g,(e,t,n)=>{for(let e of i)e.line==r.length&&e.from>n&&(e.from--,e.to--);return t}),r.push(e)}return new e(r,i)}},Hkt=NV.widget({widget:new class extends jV{toDOM(){let e=document.createElement(`span`);return e.className=`cm-snippetFieldPosition`,e}ignoreEvent(){return!1}}}),Ukt=NV.mark({class:`cm-snippetField`}),YG=class e{constructor(e,t){this.ranges=e,this.active=t,this.deco=NV.set(e.map(e=>(e.from==e.to?Hkt:Ukt).range(e.from,e.to)))}map(t){let n=[];for(let e of this.ranges){let r=e.map(t);if(!r)return null;n.push(r)}return new e(n,this.active)}selectionInsideField(e){return e.ranges.every(e=>this.ranges.some(t=>t.field==this.active&&t.from<=e.from&&t.to>=e.to))}},XG=oB.define({map(e,t){return e&&e.map(t)}}),Wkt=oB.define(),ZG=Gz.define({create(){return null},update(e,t){for(let n of t.effects){if(n.is(XG))return n.value;if(n.is(Wkt)&&e)return new YG(e.ranges,n.value)}return e&&t.docChanged&&(e=e.map(t.changes)),e&&t.selection&&!e.selectionInsideField(t.selection)&&(e=null),e},provide:e=>oU.decorations.from(e,e=>e?e.deco:NV.none)}),Gkt=({state:e,dispatch:t})=>e.field(ZG,!1)?(t(e.update({effects:XG.of(null)})),!0):!1,Kkt=ckt(1),qkt=ckt(-1),Jkt=[{key:`Tab`,run:Kkt,shift:qkt},{key:`Escape`,run:Gkt}],QG=Hz.define({combine(e){return e.length?e[0]:Jkt}}),Ykt=qz.highest(lU.compute([QG],e=>e.facet(QG))),Xkt=oU.domEventHandlers({mousedown(e,t){let n=t.state.field(ZG,!1),r;if(!n||(r=t.posAtCoords({x:e.clientX,y:e.clientY}))==null)return!1;let i=n.ranges.find(e=>e.from<=r&&e.to>=r);return!i||i.field==n.active?!1:(t.dispatch({selection:MG(n.ranges,i.field),effects:XG.of(n.ranges.some(e=>e.field>i.field)?new YG(n.ranges,i.field):null),scrollIntoView:!0}),!0)}}),$G={brackets:[`(`,`[`,`{`,`'`,`"`],before:`)]}:;>`,stringPrefixes:[]},eK=oB.define({map(e,t){return t.mapPos(e,-1,Fz.TrackAfter)??void 0}}),tK=new class extends dB{},tK.startSide=1,tK.endSide=-1,nK=Gz.define({create(){return pB.empty},update(e,t){if(e=e.map(t.changes),t.selection){let n=t.state.doc.lineAt(t.selection.main.head);e=e.update({filter:e=>e>=n.from&&e<=n.to})}for(let n of t.effects)n.is(eK)&&(e=e.update({add:[tK.range(n.value,n.value+1)]}));return e}}),rK=`()[]{}<>`,Zkt=typeof navigator==`object`&&/Android\b/.test(navigator.userAgent),Qkt=oU.inputHandler.of((e,t,n,r)=>{if((Zkt?e.composing:e.compositionStarted)||e.state.readOnly)return!1;let i=e.state.selection.main;if(r.length>2||r.length==2&&lz(cz(r,0))==1||t!=i.from||n!=i.to)return!1;let a=fkt(e.state,r);return a?(e.dispatch(a),!0):!1}),$kt=({state:e,dispatch:t})=>{if(e.readOnly)return!1;let n=dkt(e,e.selection.main.head).brackets||$G.brackets,r=null,i=e.changeByRange(t=>{if(t.empty){let r=mkt(e.doc,t.head);for(let i of n)if(i==r&&PG(e.doc,t.head)==ukt(cz(i,0)))return{changes:{from:t.head-i.length,to:t.head+i.length},range:Bz.cursor(t.head-i.length)}}return{range:r=t}});return r||t(e.update(i,{scrollIntoView:!0,userEvent:`delete.backward`})),!r},eAt=[{key:`Backspace`,run:$kt}],iK=[{key:`Ctrl-Space`,run:qG},{mac:"Alt-`",run:qG},{key:`Escape`,run:Mkt},{key:`ArrowDown`,run:jG(!0)},{key:`ArrowUp`,run:jG(!1)},{key:`PageDown`,run:jG(!0,`page`)},{key:`PageUp`,run:jG(!1,`page`)},{key:`Enter`,run:jkt}],tAt=qz.highest(lU.computeN([VG],e=>e.facet(VG).defaultKeymap?[iK]:[]))}));function rAt(e={}){return[uK,lK.of(e),oU.domEventHandlers({beforeinput(e,t){let n=e.inputType==`historyUndo`?dK:e.inputType==`historyRedo`?fK:null;return n?(e.preventDefault(),n(t)):!1}})]}function aK(e,t){return function({state:n,dispatch:r}){if(!t&&n.readOnly)return!1;let i=n.field(uK,!1);if(!i)return!1;let a=i.pop(e,n,t);return a?(r(a),!0):!1}}function oK(e,t,n,r){let i=t+1>n+20?t-n-1:0,a=e.slice(i,t);return a.push(r),a}function iAt(e,t){let n=[],r=!1;return e.iterChangedRanges((e,t)=>n.push(e,t)),t.iterChangedRanges((e,t,i,a)=>{for(let e=0;e<n.length;){let t=n[e++],o=n[e++];a>=t&&i<=o&&(r=!0)}}),r}function aAt(e,t){return e.ranges.length==t.ranges.length&&e.ranges.filter((e,n)=>e.empty!=t.ranges[n].empty).length===0}function oAt(e,t){return e.length?t.length?e.concat(t):e:t}function sAt(e,t){if(e.length){let n=e[e.length-1],r=n.selectionsAfter.slice(Math.max(0,n.selectionsAfter.length-hAt));return r.length&&r[r.length-1].eq(t)?e:(r.push(t),oK(e,e.length-1,1e9,n.setSelAfter(r)))}else return[pK.selection([t])]}function cAt(e){let t=e[e.length-1],n=e.slice();return n[e.length-1]=t.setSelAfter(t.selectionsAfter.slice(0,t.selectionsAfter.length-1)),n}function sK(e,t){if(!e.length)return e;let n=e.length,r=mK;for(;n;){let i=lAt(e[n-1],t,r);if(i.changes&&!i.changes.empty||i.effects.length){let t=e.slice(0,n);return t[n-1]=i,t}else t=i.mapped,n--,r=i.selectionsAfter}return r.length?[pK.selection(r)]:mK}function lAt(e,t,n){let r=oAt(e.selectionsAfter.length?e.selectionsAfter.map(e=>e.map(t)):mK,n);if(!e.changes)return pK.selection(r);let i=e.changes.map(t),a=t.mapDesc(e.changes,!0),o=e.mapped?e.mapped.composeDesc(a):a;return new pK(i,oB.mapEffects(e.effects,t),o,e.startSelection.map(a),r)}function uAt(e,t){let n=-1;return e.changeByRange(r=>{let i=[];for(let a=r.from;a<=r.to;){let o=e.doc.lineAt(a);o.number>n&&(r.empty||r.to>o.from)&&(t(o,i,r),n=o.number),a=o.to+1}let a=e.changes(i);return{changes:i,range:Bz.range(a.mapPos(r.anchor,1),a.mapPos(r.head,1))}})}var cK,dAt,fAt,lK,uK,dK,fK,pAt,mAt,pK,mK,hAt,gAt,hK,_At,vAt,yAt,bAt,xAt,SAt=s((()=>{vB(),RU(),yG(),dW(),cK=aB.define(),dAt=aB.define(),fAt=Hz.define(),lK=Hz.define({combine(e){return xz(e,{minDepth:100,newGroupDelay:500,joinToEvent:(e,t)=>t},{minDepth:Math.max,newGroupDelay:Math.min,joinToEvent:(e,t)=>(n,r)=>e(n,r)||t(n,r)})}}),uK=Gz.define({create(){return hK.empty},update(e,t){let n=t.state.facet(lK),r=t.annotation(cK);if(r){let i=pK.fromTransaction(t,r.selection),a=r.side,o=a==0?e.undone:e.done;return o=i?oK(o,o.length,n.minDepth,i):sAt(o,t.startState.selection),new hK(a==0?r.rest:o,a==0?o:r.rest)}let i=t.annotation(dAt);if((i==`full`||i==`before`)&&(e=e.isolate()),t.annotation(sB.addToHistory)===!1)return t.changes.empty?e:e.addMapping(t.changes.desc);let a=pK.fromTransaction(t),o=t.annotation(sB.time),s=t.annotation(sB.userEvent);return a?e=e.addChanges(a,o,s,n,t):t.selection&&(e=e.addSelection(t.startState.selection,o,s,n.newGroupDelay)),(i==`full`||i==`after`)&&(e=e.isolate()),e},toJSON(e){return{done:e.done.map(e=>e.toJSON()),undone:e.undone.map(e=>e.toJSON())}},fromJSON(e){return new hK(e.done.map(pK.fromJSON),e.undone.map(pK.fromJSON))}}),dK=aK(0,!1),fK=aK(1,!1),pAt=aK(0,!0),mAt=aK(1,!0),pK=class e{constructor(e,t,n,r,i){this.changes=e,this.effects=t,this.mapped=n,this.startSelection=r,this.selectionsAfter=i}setSelAfter(t){return new e(this.changes,this.effects,this.mapped,this.startSelection,t)}toJSON(){return{changes:this.changes?.toJSON(),mapped:this.mapped?.toJSON(),startSelection:this.startSelection?.toJSON(),selectionsAfter:this.selectionsAfter.map(e=>e.toJSON())}}static fromJSON(t){return new e(t.changes&&Lz.fromJSON(t.changes),[],t.mapped&&Iz.fromJSON(t.mapped),t.startSelection&&Bz.fromJSON(t.startSelection),t.selectionsAfter.map(Bz.fromJSON))}static fromTransaction(t,n){let r=mK;for(let e of t.startState.facet(fAt)){let n=e(t);n.length&&(r=r.concat(n))}return!r.length&&t.changes.empty?null:new e(t.changes.invert(t.startState.doc),r,void 0,n||t.startState.selection,mK)}static selection(t){return new e(void 0,mK,void 0,void 0,t)}},mK=[],hAt=200,gAt=/^(input\.type|delete)($|\.)/,hK=class e{constructor(e,t,n=0,r=void 0){this.done=e,this.undone=t,this.prevTime=n,this.prevUserEvent=r}isolate(){return this.prevTime?new e(this.done,this.undone):this}addChanges(t,n,r,i,a){let o=this.done,s=o[o.length-1];return o=s&&s.changes&&!s.changes.empty&&t.changes&&(!r||gAt.test(r))&&(!s.selectionsAfter.length&&n-this.prevTime<i.newGroupDelay&&i.joinToEvent(a,iAt(s.changes,t.changes))||r==`input.type.compose`)?oK(o,o.length-1,i.minDepth,new pK(t.changes.compose(s.changes),oAt(oB.mapEffects(t.effects,s.changes),s.effects),s.mapped,s.startSelection,mK)):oK(o,o.length,i.minDepth,t),new e(o,mK,n,r)}addSelection(t,n,r,i){let a=this.done.length?this.done[this.done.length-1].selectionsAfter:mK;return a.length>0&&n-this.prevTime<i&&r==this.prevUserEvent&&r&&/^select($|\.)/.test(r)&&aAt(a[a.length-1],t)?this:new e(sAt(this.done,t),this.undone,n,r)}addMapping(t){return new e(sK(this.done,t),sK(this.undone,t),this.prevTime,this.prevUserEvent)}pop(e,t,n){let r=e==0?this.done:this.undone;if(r.length==0)return null;let i=r[r.length-1],a=i.selectionsAfter[0]||t.selection;if(n&&i.selectionsAfter.length)return t.update({selection:i.selectionsAfter[i.selectionsAfter.length-1],annotations:cK.of({side:e,rest:cAt(r),selection:a}),userEvent:e==0?`select.undo`:`select.redo`,scrollIntoView:!0});if(i.changes){let n=r.length==1?mK:r.slice(0,r.length-1);return i.mapped&&(n=sK(n,i.mapped)),t.update({changes:i.changes,selection:i.startSelection,effects:i.effects,annotations:cK.of({side:e,rest:n,selection:a}),filter:!1,userEvent:e==0?`undo`:`redo`,scrollIntoView:!0})}else return null}},hK.empty=new hK(mK,mK),_At=[{key:`Mod-z`,run:dK,preventDefault:!0},{key:`Mod-y`,mac:`Mod-Shift-z`,run:fK,preventDefault:!0},{linux:`Ctrl-Shift-z`,run:fK,preventDefault:!0},{key:`Mod-u`,run:pAt,preventDefault:!0},{key:`Alt-u`,mac:`Mod-Shift-u`,run:mAt,preventDefault:!0}],typeof Intl<`u`&&Intl.Segmenter&&new Intl.Segmenter(void 0,{granularity:`word`}),vAt=({state:e,dispatch:t})=>(t(e.update(e.replaceSelection(e.lineBreak),{scrollIntoView:!0,userEvent:`input`})),!0),yAt=({state:e,dispatch:t})=>e.readOnly?!1:(t(e.update(uAt(e,(t,n)=>{n.push({from:t.from,insert:e.facet($W)})}),{userEvent:`input.indent`})),!0),bAt=({state:e,dispatch:t})=>e.readOnly?!1:(t(e.update(uAt(e,(t,n)=>{let r=/^\s*/.exec(t.text)[0];if(!r)return;let i=Dz(r,e.tabSize),a=0,o=jDt(e,Math.max(0,i-ADt(e)));for(;a<r.length&&a<o.length&&r.charCodeAt(a)==o.charCodeAt(a);)a++;n.push({from:t.from+a,to:t.from+r.length,insert:o.slice(a)})}),{userEvent:`delete.dedent`})),!0),xAt={key:`Tab`,run:yAt,shift:bAt}}));function gK(e,t=Uint16Array){if(typeof e!=`string`)return e;let n=null;for(let r=0,i=0;r<e.length;){let a=0;for(;;){let t=e.charCodeAt(r++),n=!1;if(t==126){a=65535;break}t>=92&&t--,t>=34&&t--;let i=t-32;if(i>=46&&(i-=46,n=!0),a+=i,n)break;a*=46}n?n[i++]=a:n=new t(a)}return n}function CAt(e,t,n,r,i,a){let o=0,s=1<<r,{dialect:c}=n.p.parser;scan:for(;(s&e[o])!=0;){let n=e[o+1];for(let r=o+3;r<n;r+=2)if((e[r+1]&s)>0){let n=e[r];if(c.allows(n)&&(t.token.value==-1||t.token.value==n||TAt(n,t.token.value,i,a))){t.acceptToken(n);break}}let r=t.next,l=0,u=e[o+2];if(t.next<0&&u>l&&e[n+u*3-3]==65535){o=e[n+u*3-1];continue scan}for(;l<u;){let i=l+u>>1,a=n+i+(i<<1),s=e[a],c=e[a+1]||65536;if(r<s)u=i;else if(r>=c)l=i+1;else{o=e[a+2],t.advance();continue scan}}break}}function wAt(e,t,n){for(let r=t,i;(i=e[r])!=65535;r++)if(i==n)return r-t;return-1}function TAt(e,t,n,r){let i=wAt(n,r,t);return i<0||wAt(n,r,e)<i}function EAt(e,t,n){let r=e.cursor(ZU.IncludeAnonymous);for(r.moveTo(t);;)if(!(n<0?r.childBefore(t):r.childAfter(t)))for(;;){if((n<0?r.to<t:r.from>t)&&!r.type.isError)return n<0?Math.max(0,Math.min(r.to-1,t-25)):Math.min(e.length,Math.max(r.from+1,t+25));if(n<0?r.prevSibling():r.nextSibling())break;if(!r.parent())return n<0?0:e.length}}function DAt(e,t){for(let n=0;n<t.length;n++){let r=t[n];if(r.pos==e.pos&&r.sameState(e)){t[n].score<e.score&&(t[n]=e);return}}t.push(e)}function _K(e,t){return e[t]|e[t+1]<<16}function OAt(e){let t=null;for(let n of e){let e=n.p.stoppedAt;(n.pos==n.p.stream.end||e!=null&&n.pos>e)&&n.p.parser.stateFlag(n.state,2)&&(!t||t.score<n.score)&&(t=n)}return t}function kAt(e){if(e.external){let t=e.extend?1:0;return(n,r)=>e.external(n,r)<<1|t}return e.get}var AAt,vK,jAt,MAt,yK,bK,NAt,xK,SK,CK,wK,TK,PAt,FAt,IAt,LAt,EK,DK,OK,kK=s((()=>{dW(),AAt=class e{constructor(e,t,n,r,i,a,o,s,c,l=0,u){this.p=e,this.stack=t,this.state=n,this.reducePos=r,this.pos=i,this.score=a,this.buffer=o,this.bufferBase=s,this.curContext=c,this.lookAhead=l,this.parent=u}toString(){return`[${this.stack.filter((e,t)=>t%3==0).concat(this.state)}]@${this.pos}${this.score?`!`+this.score:``}`}static start(t,n,r=0){let i=t.parser.context;return new e(t,[],n,r,r,0,[],0,i?new vK(i,i.start):null,0,null)}get context(){return this.curContext?this.curContext.context:null}pushState(e,t){this.stack.push(this.state,t,this.bufferBase+this.buffer.length),this.state=e}reduce(e){let t=e>>19,n=e&65535,{parser:r}=this.p,i=this.reducePos<this.pos-25;i&&this.setLookAhead(this.pos);let a=r.dynamicPrecedence(n);if(a&&(this.score+=a),t==0){this.pushState(r.getGoto(this.state,n,!0),this.reducePos),n<r.minRepeatTerm&&this.storeNode(n,this.reducePos,this.reducePos,i?8:4,!0),this.reduceContext(n,this.reducePos);return}let o=this.stack.length-(t-1)*3-(e&262144?6:0),s=o?this.stack[o-2]:this.p.ranges[0].from,c=this.reducePos-s;c>=2e3&&!this.p.parser.nodeSet.types[n]?.isAnonymous&&(s==this.p.lastBigReductionStart?(this.p.bigReductionCount++,this.p.lastBigReductionSize=c):this.p.lastBigReductionSize<c&&(this.p.bigReductionCount=1,this.p.lastBigReductionStart=s,this.p.lastBigReductionSize=c));let l=o?this.stack[o-1]:0,u=this.bufferBase+this.buffer.length-l;if(n<r.minRepeatTerm||e&131072){let e=r.stateFlag(this.state,1)?this.pos:this.reducePos;this.storeNode(n,s,e,u+4,!0)}if(e&262144)this.state=this.stack[o];else{let e=this.stack[o-3];this.state=r.getGoto(e,n,!0)}for(;this.stack.length>o;)this.stack.pop();this.reduceContext(n,s)}storeNode(e,t,n,r=4,i=!1){if(e==0&&(!this.stack.length||this.stack[this.stack.length-1]<this.buffer.length+this.bufferBase)){let e=this,r=this.buffer.length;if(r==0&&e.parent&&(r=e.bufferBase-e.parent.bufferBase,e=e.parent),r>0&&e.buffer[r-4]==0&&e.buffer[r-1]>-1){if(t==n)return;if(e.buffer[r-2]>=t){e.buffer[r-2]=n;return}}}if(!i||this.pos==n)this.buffer.push(e,t,n,r);else{let i=this.buffer.length;if(i>0&&this.buffer[i-4]!=0){let e=!1;for(let t=i;t>0&&this.buffer[t-2]>n;t-=4)if(this.buffer[t-1]>=0){e=!0;break}if(e)for(;i>0&&this.buffer[i-2]>n;)this.buffer[i]=this.buffer[i-4],this.buffer[i+1]=this.buffer[i-3],this.buffer[i+2]=this.buffer[i-2],this.buffer[i+3]=this.buffer[i-1],i-=4,r>4&&(r-=4)}this.buffer[i]=e,this.buffer[i+1]=t,this.buffer[i+2]=n,this.buffer[i+3]=r}}shift(e,t,n,r){if(e&131072)this.pushState(e&65535,this.pos);else if(e&262144)this.pos=r,this.shiftContext(t,n),t<=this.p.parser.maxNode&&this.buffer.push(t,n,r,4);else{let i=e,{parser:a}=this.p;(r>this.pos||t<=a.maxNode)&&(this.pos=r,a.stateFlag(i,1)||(this.reducePos=r)),this.pushState(i,n),this.shiftContext(t,n),t<=a.maxNode&&this.buffer.push(t,n,r,4)}}apply(e,t,n,r){e&65536?this.reduce(e):this.shift(e,t,n,r)}useNode(e,t){let n=this.p.reused.length-1;(n<0||this.p.reused[n]!=e)&&(this.p.reused.push(e),n++);let r=this.pos;this.reducePos=this.pos=r+e.length,this.pushState(t,r),this.buffer.push(n,r,this.reducePos,-1),this.curContext&&this.updateContext(this.curContext.tracker.reuse(this.curContext.context,e,this,this.p.stream.reset(this.pos-e.length)))}split(){let t=this,n=t.buffer.length;for(;n>0&&t.buffer[n-2]>t.reducePos;)n-=4;let r=t.buffer.slice(n),i=t.bufferBase+n;for(;t&&i==t.bufferBase;)t=t.parent;return new e(this.p,this.stack.slice(),this.state,this.reducePos,this.pos,this.score,r,i,this.curContext,this.lookAhead,t)}recoverByDelete(e,t){let n=e<=this.p.parser.maxNode;n&&this.storeNode(e,this.pos,t,4),this.storeNode(0,this.pos,t,n?8:4),this.pos=this.reducePos=t,this.score-=190}canShift(e){for(let t=new jAt(this);;){let n=this.p.parser.stateSlot(t.state,4)||this.p.parser.hasAction(t.state,e);if(n==0)return!1;if(!(n&65536))return!0;t.reduce(n)}}recoverByInsert(e){if(this.stack.length>=300)return[];let t=this.p.parser.nextStates(this.state);if(t.length>8||this.stack.length>=120){let n=[];for(let r=0,i;r<t.length;r+=2)(i=t[r+1])!=this.state&&this.p.parser.hasAction(i,e)&&n.push(t[r],i);if(this.stack.length<120)for(let e=0;n.length<8&&e<t.length;e+=2){let r=t[e+1];n.some((e,t)=>t&1&&e==r)||n.push(t[e],r)}t=n}let n=[];for(let e=0;e<t.length&&n.length<4;e+=2){let r=t[e+1];if(r==this.state)continue;let i=this.split();i.pushState(r,this.pos),i.storeNode(0,i.pos,i.pos,4,!0),i.shiftContext(t[e],this.pos),i.reducePos=this.pos,i.score-=200,n.push(i)}return n}forceReduce(){let{parser:e}=this.p,t=e.stateSlot(this.state,5);if(!(t&65536))return!1;if(!e.validAction(this.state,t)){let n=t>>19,r=t&65535,i=this.stack.length-n*3;if(i<0||e.getGoto(this.stack[i],r,!1)<0){let e=this.findForcedReduction();if(e==null)return!1;t=e}this.storeNode(0,this.pos,this.pos,4,!0),this.score-=100}return this.reducePos=this.pos,this.reduce(t),!0}findForcedReduction(){let{parser:e}=this.p,t=[],n=(r,i)=>{if(!t.includes(r))return t.push(r),e.allActions(r,t=>{if(!(t&393216))if(t&65536){let n=(t>>19)-i;if(n>1){let r=t&65535,i=this.stack.length-n*3;if(i>=0&&e.getGoto(this.stack[i],r,!1)>=0)return n<<19|65536|r}}else{let e=n(t,i+1);if(e!=null)return e}})};return n(this.state,0)}forceAll(){for(;!this.p.parser.stateFlag(this.state,2);)if(!this.forceReduce()){this.storeNode(0,this.pos,this.pos,4,!0);break}return this}get deadEnd(){if(this.stack.length!=3)return!1;let{parser:e}=this.p;return e.data[e.stateSlot(this.state,1)]==65535&&!e.stateSlot(this.state,4)}restart(){this.storeNode(0,this.pos,this.pos,4,!0),this.state=this.stack[0],this.stack.length=0}sameState(e){if(this.state!=e.state||this.stack.length!=e.stack.length)return!1;for(let t=0;t<this.stack.length;t+=3)if(this.stack[t]!=e.stack[t])return!1;return!0}get parser(){return this.p.parser}dialectEnabled(e){return this.p.parser.dialect.flags[e]}shiftContext(e,t){this.curContext&&this.updateContext(this.curContext.tracker.shift(this.curContext.context,e,this,this.p.stream.reset(t)))}reduceContext(e,t){this.curContext&&this.updateContext(this.curContext.tracker.reduce(this.curContext.context,e,this,this.p.stream.reset(t)))}emitContext(){let e=this.buffer.length-1;(e<0||this.buffer[e]!=-3)&&this.buffer.push(this.curContext.hash,this.pos,this.pos,-3)}emitLookAhead(){let e=this.buffer.length-1;(e<0||this.buffer[e]!=-4)&&this.buffer.push(this.lookAhead,this.pos,this.pos,-4)}updateContext(e){if(e!=this.curContext.context){let t=new vK(this.curContext.tracker,e);t.hash!=this.curContext.hash&&this.emitContext(),this.curContext=t}}setLookAhead(e){e>this.lookAhead&&(this.emitLookAhead(),this.lookAhead=e)}close(){this.curContext&&this.curContext.tracker.strict&&this.emitContext(),this.lookAhead>0&&this.emitLookAhead()}},vK=class{constructor(e,t){this.tracker=e,this.context=t,this.hash=e.strict?e.hash(t):0}},jAt=class{constructor(e){this.start=e,this.state=e.state,this.stack=e.stack,this.base=this.stack.length}reduce(e){let t=e&65535,n=e>>19;n==0?(this.stack==this.start.stack&&(this.stack=this.stack.slice()),this.stack.push(this.state,0,0),this.base+=3):this.base-=(n-1)*3,this.state=this.start.p.parser.getGoto(this.stack[this.base-3],t,!0)}},MAt=class e{constructor(e,t,n){this.stack=e,this.pos=t,this.index=n,this.buffer=e.buffer,this.index==0&&this.maybeNext()}static create(t,n=t.bufferBase+t.buffer.length){return new e(t,n,n-t.bufferBase)}maybeNext(){let e=this.stack.parent;e!=null&&(this.index=this.stack.bufferBase-e.bufferBase,this.stack=e,this.buffer=e.buffer)}get id(){return this.buffer[this.index-4]}get start(){return this.buffer[this.index-3]}get end(){return this.buffer[this.index-2]}get size(){return this.buffer[this.index-1]}next(){this.index-=4,this.pos-=4,this.index==0&&this.maybeNext()}fork(){return new e(this.stack,this.pos,this.index)}},yK=class{constructor(){this.start=-1,this.value=-1,this.end=-1,this.extended=-1,this.lookAhead=0,this.mask=0,this.context=0}},bK=new yK,NAt=class{constructor(e,t){this.input=e,this.ranges=t,this.chunk=``,this.chunkOff=0,this.chunk2=``,this.chunk2Pos=0,this.next=-1,this.token=bK,this.rangeIndex=0,this.pos=this.chunkPos=t[0].from,this.range=t[0],this.end=t[t.length-1].to,this.readNext()}resolveOffset(e,t){let n=this.range,r=this.rangeIndex,i=this.pos+e;for(;i<n.from;){if(!r)return null;let e=this.ranges[--r];i-=n.from-e.to,n=e}for(;t<0?i>n.to:i>=n.to;){if(r==this.ranges.length-1)return null;let e=this.ranges[++r];i+=e.from-n.to,n=e}return i}clipPos(e){if(e>=this.range.from&&e<this.range.to)return e;for(let t of this.ranges)if(t.to>e)return Math.max(e,t.from);return this.end}peek(e){let t=this.chunkOff+e,n,r;if(t>=0&&t<this.chunk.length)n=this.pos+e,r=this.chunk.charCodeAt(t);else{let t=this.resolveOffset(e,1);if(t==null)return-1;if(n=t,n>=this.chunk2Pos&&n<this.chunk2Pos+this.chunk2.length)r=this.chunk2.charCodeAt(n-this.chunk2Pos);else{let e=this.rangeIndex,t=this.range;for(;t.to<=n;)t=this.ranges[++e];this.chunk2=this.input.chunk(this.chunk2Pos=n),n+this.chunk2.length>t.to&&(this.chunk2=this.chunk2.slice(0,t.to-n)),r=this.chunk2.charCodeAt(0)}}return n>=this.token.lookAhead&&(this.token.lookAhead=n+1),r}acceptToken(e,t=0){let n=t?this.resolveOffset(t,-1):this.pos;if(n==null||n<this.token.start)throw RangeError(`Token end out of bounds`);this.token.value=e,this.token.end=n}acceptTokenTo(e,t){this.token.value=e,this.token.end=t}getChunk(){if(this.pos>=this.chunk2Pos&&this.pos<this.chunk2Pos+this.chunk2.length){let{chunk:e,chunkPos:t}=this;this.chunk=this.chunk2,this.chunkPos=this.chunk2Pos,this.chunk2=e,this.chunk2Pos=t,this.chunkOff=this.pos-this.chunkPos}else{this.chunk2=this.chunk,this.chunk2Pos=this.chunkPos;let e=this.input.chunk(this.pos);this.chunk=this.pos+e.length>this.range.to?e.slice(0,this.range.to-this.pos):e,this.chunkPos=this.pos,this.chunkOff=0}}readNext(){return this.chunkOff>=this.chunk.length&&(this.getChunk(),this.chunkOff==this.chunk.length)?this.next=-1:this.next=this.chunk.charCodeAt(this.chunkOff)}advance(e=1){for(this.chunkOff+=e;this.pos+e>=this.range.to;){if(this.rangeIndex==this.ranges.length-1)return this.setDone();e-=this.range.to-this.pos,this.range=this.ranges[++this.rangeIndex],this.pos=this.range.from}return this.pos+=e,this.pos>=this.token.lookAhead&&(this.token.lookAhead=this.pos+1),this.readNext()}setDone(){return this.pos=this.chunkPos=this.end,this.range=this.ranges[this.rangeIndex=this.ranges.length-1],this.chunk=``,this.next=-1}reset(e,t){if(t?(this.token=t,t.start=e,t.lookAhead=e+1,t.value=t.extended=-1):this.token=bK,this.pos!=e){if(this.pos=e,e==this.end)return this.setDone(),this;for(;e<this.range.from;)this.range=this.ranges[--this.rangeIndex];for(;e>=this.range.to;)this.range=this.ranges[++this.rangeIndex];e>=this.chunkPos&&e<this.chunkPos+this.chunk.length?this.chunkOff=e-this.chunkPos:(this.chunk=``,this.chunkOff=0),this.readNext()}return this}read(e,t){if(e>=this.chunkPos&&t<=this.chunkPos+this.chunk.length)return this.chunk.slice(e-this.chunkPos,t-this.chunkPos);if(e>=this.chunk2Pos&&t<=this.chunk2Pos+this.chunk2.length)return this.chunk2.slice(e-this.chunk2Pos,t-this.chunk2Pos);if(e>=this.range.from&&t<=this.range.to)return this.input.read(e,t);let n=``;for(let r of this.ranges){if(r.from>=t)break;r.to>e&&(n+=this.input.read(Math.max(r.from,e),Math.min(r.to,t)))}return n}},xK=class{constructor(e,t){this.data=e,this.id=t}token(e,t){let{parser:n}=t.p;CAt(this.data,e,t,this.id,n.data,n.tokenPrecTable)}},xK.prototype.contextual=xK.prototype.fallback=xK.prototype.extend=!1,SK=class{constructor(e,t,n){this.precTable=t,this.elseToken=n,this.data=typeof e==`string`?gK(e):e}token(e,t){let n=e.pos,r=0;for(;;){let n=e.next<0,i=e.resolveOffset(1,1);if(CAt(this.data,e,t,0,this.data,this.precTable),e.token.value>-1)break;if(this.elseToken==null)return;if(n||r++,i==null)break;e.reset(i,e.token)}r&&(e.reset(n,e.token),e.acceptToken(this.elseToken,r))}},SK.prototype.contextual=xK.prototype.fallback=xK.prototype.extend=!1,CK=class{constructor(e,t={}){this.token=e,this.contextual=!!t.contextual,this.fallback=!!t.fallback,this.extend=!!t.extend}},wK=typeof process<`u`&&process.env&&/\bparse\b/.test(process.env.LOG),TK=null,PAt=class{constructor(e,t){this.fragments=e,this.nodeSet=t,this.i=0,this.fragment=null,this.safeFrom=-1,this.safeTo=-1,this.trees=[],this.start=[],this.index=[],this.nextFragment()}nextFragment(){let e=this.fragment=this.i==this.fragments.length?null:this.fragments[this.i++];if(e){for(this.safeFrom=e.openStart?EAt(e.tree,e.from+e.offset,1)-e.offset:e.from,this.safeTo=e.openEnd?EAt(e.tree,e.to+e.offset,-1)-e.offset:e.to;this.trees.length;)this.trees.pop(),this.start.pop(),this.index.pop();this.trees.push(e.tree),this.start.push(-e.offset),this.index.push(0),this.nextStart=this.safeFrom}else this.nextStart=1e9}nodeAt(e){if(e<this.nextStart)return null;for(;this.fragment&&this.safeTo<=e;)this.nextFragment();if(!this.fragment)return null;for(;;){let t=this.trees.length-1;if(t<0)return this.nextFragment(),null;let n=this.trees[t],r=this.index[t];if(r==n.children.length){this.trees.pop(),this.start.pop(),this.index.pop();continue}let i=n.children[r],a=this.start[t]+n.positions[r];if(a>e)return this.nextStart=a,null;if(i instanceof QU){if(a==e){if(a<this.safeFrom)return null;let e=a+i.length;if(e<=this.safeTo){let t=i.prop(KU.lookAhead);if(!t||e+t<this.fragment.to)return i}}this.index[t]++,a+i.length>=Math.max(this.safeFrom,e)&&(this.trees.push(i),this.start.push(a),this.index.push(0))}else this.index[t]++,this.nextStart=a+i.length}}},FAt=class{constructor(e,t){this.stream=t,this.tokens=[],this.mainToken=null,this.actions=[],this.tokens=e.tokenizers.map(e=>new yK)}getActions(e){let t=0,n=null,{parser:r}=e.p,{tokenizers:i}=r,a=r.stateSlot(e.state,3),o=e.curContext?e.curContext.hash:0,s=0;for(let r=0;r<i.length;r++){if(!(1<<r&a))continue;let c=i[r],l=this.tokens[r];if(!(n&&!c.fallback)&&((c.contextual||l.start!=e.pos||l.mask!=a||l.context!=o)&&(this.updateCachedToken(l,c,e),l.mask=a,l.context=o),l.lookAhead>l.end+25&&(s=Math.max(l.lookAhead,s)),l.value!=0)){let r=t;if(l.extended>-1&&(t=this.addActions(e,l.extended,l.end,t)),t=this.addActions(e,l.value,l.end,t),!c.extend&&(n=l,t>r))break}}for(;this.actions.length>t;)this.actions.pop();return s&&e.setLookAhead(s),!n&&e.pos==this.stream.end&&(n=new yK,n.value=e.p.parser.eofTerm,n.start=n.end=e.pos,t=this.addActions(e,n.value,n.end,t)),this.mainToken=n,this.actions}getMainToken(e){if(this.mainToken)return this.mainToken;let t=new yK,{pos:n,p:r}=e;return t.start=n,t.end=Math.min(n+1,r.stream.end),t.value=n==r.stream.end?r.parser.eofTerm:0,t}updateCachedToken(e,t,n){let r=this.stream.clipPos(n.pos);if(t.token(this.stream.reset(r,e),n),e.value>-1){let{parser:t}=n.p;for(let r=0;r<t.specialized.length;r++)if(t.specialized[r]==e.value){let i=t.specializers[r](this.stream.read(e.start,e.end),n);if(i>=0&&n.p.parser.dialect.allows(i>>1)){i&1?e.extended=i>>1:e.value=i>>1;break}}}else e.value=0,e.end=this.stream.clipPos(r+1)}putAction(e,t,n,r){for(let t=0;t<r;t+=3)if(this.actions[t]==e)return r;return this.actions[r++]=e,this.actions[r++]=t,this.actions[r++]=n,r}addActions(e,t,n,r){let{state:i}=e,{parser:a}=e.p,{data:o}=a;for(let e=0;e<2;e++)for(let s=a.stateSlot(i,e?2:1);;s+=3){if(o[s]==65535)if(o[s+1]==1)s=_K(o,s+2);else{r==0&&o[s+1]==2&&(r=this.putAction(_K(o,s+2),t,n,r));break}o[s]==t&&(r=this.putAction(_K(o,s+1),t,n,r))}return r}},IAt=class{constructor(e,t,n,r){this.parser=e,this.input=t,this.ranges=r,this.recovering=0,this.nextStackID=9812,this.minStackPos=0,this.reused=[],this.stoppedAt=null,this.lastBigReductionStart=-1,this.lastBigReductionSize=0,this.bigReductionCount=0,this.stream=new NAt(t,r),this.tokens=new FAt(e,this.stream),this.topTerm=e.top[1];let{from:i}=r[0];this.stacks=[AAt.start(this,e.top[0],i)],this.fragments=n.length&&this.stream.end-i>e.bufferLength*4?new PAt(n,e.nodeSet):null}get parsedPos(){return this.minStackPos}advance(){let e=this.stacks,t=this.minStackPos,n=this.stacks=[],r,i;if(this.bigReductionCount>300&&e.length==1){let[t]=e;for(;t.forceReduce()&&t.stack.length&&t.stack[t.stack.length-2]>=this.lastBigReductionStart;);this.bigReductionCount=this.lastBigReductionSize=0}for(let a=0;a<e.length;a++){let o=e[a];for(;;){if(this.tokens.mainToken=null,o.pos>t)n.push(o);else if(this.advanceStack(o,n,e))continue;else{r||(r=[],i=[]),r.push(o);let e=this.tokens.getMainToken(o);i.push(e.value,e.end)}break}}if(!n.length){let e=r&&OAt(r);if(e)return wK&&console.log(`Finish with `+this.stackID(e)),this.stackToTree(e);if(this.parser.strict)throw wK&&r&&console.log(`Stuck with token `+(this.tokens.mainToken?this.parser.getName(this.tokens.mainToken.value):`none`)),SyntaxError(`No parse at `+t);this.recovering||=5}if(this.recovering&&r){let e=this.stoppedAt!=null&&r[0].pos>this.stoppedAt?r[0]:this.runRecovery(r,i,n);if(e)return wK&&console.log(`Force-finish `+this.stackID(e)),this.stackToTree(e.forceAll())}if(this.recovering){let e=this.recovering==1?1:this.recovering*3;if(n.length>e)for(n.sort((e,t)=>t.score-e.score);n.length>e;)n.pop();n.some(e=>e.reducePos>t)&&this.recovering--}else if(n.length>1){outer:for(let e=0;e<n.length-1;e++){let t=n[e];for(let r=e+1;r<n.length;r++){let i=n[r];if(t.sameState(i)||t.buffer.length>500&&i.buffer.length>500)if((t.score-i.score||t.buffer.length-i.buffer.length)>0)n.splice(r--,1);else{n.splice(e--,1);continue outer}}}n.length>12&&n.splice(12,n.length-12)}this.minStackPos=n[0].pos;for(let e=1;e<n.length;e++)n[e].pos<this.minStackPos&&(this.minStackPos=n[e].pos);return null}stopAt(e){if(this.stoppedAt!=null&&this.stoppedAt<e)throw RangeError(`Can't move stoppedAt forward`);this.stoppedAt=e}advanceStack(e,t,n){let r=e.pos,{parser:i}=this,a=wK?this.stackID(e)+` -> `:``;if(this.stoppedAt!=null&&r>this.stoppedAt)return e.forceReduce()?e:null;if(this.fragments){let t=e.curContext&&e.curContext.tracker.strict,n=t?e.curContext.hash:0;for(let o=this.fragments.nodeAt(r);o;){let r=this.parser.nodeSet.types[o.type.id]==o.type?i.getGoto(e.state,o.type.id):-1;if(r>-1&&o.length&&(!t||(o.prop(KU.contextHash)||0)==n))return e.useNode(o,r),wK&&console.log(a+this.stackID(e)+` (via reuse of ${i.getName(o.type.id)})`),!0;if(!(o instanceof QU)||o.children.length==0||o.positions[0]>0)break;let s=o.children[0];if(s instanceof QU&&o.positions[0]==0)o=s;else break}}let o=i.stateSlot(e.state,4);if(o>0)return e.reduce(o),wK&&console.log(a+this.stackID(e)+` (via always-reduce ${i.getName(o&65535)})`),!0;if(e.stack.length>=8400)for(;e.stack.length>6e3&&e.forceReduce(););let s=this.tokens.getActions(e);for(let o=0;o<s.length;){let c=s[o++],l=s[o++],u=s[o++],d=o==s.length||!n,f=d?e:e.split(),p=this.tokens.mainToken;if(f.apply(c,l,p?p.start:f.pos,u),wK&&console.log(a+this.stackID(f)+` (via ${c&65536?`reduce of ${i.getName(c&65535)}`:`shift`} for ${i.getName(l)} @ ${r}${f==e?``:`, split`})`),d)return!0;f.pos>r?t.push(f):n.push(f)}return!1}advanceFully(e,t){let n=e.pos;for(;;){if(!this.advanceStack(e,null,null))return!1;if(e.pos>n)return DAt(e,t),!0}}runRecovery(e,t,n){let r=null,i=!1;for(let a=0;a<e.length;a++){let o=e[a],s=t[a<<1],c=t[(a<<1)+1],l=wK?this.stackID(o)+` -> `:``;if(o.deadEnd&&(i||(i=!0,o.restart(),wK&&console.log(l+this.stackID(o)+` (restarted)`),this.advanceFully(o,n))))continue;let u=o.split(),d=l;for(let e=0;u.forceReduce()&&e<10&&(wK&&console.log(d+this.stackID(u)+` (via force-reduce)`),!this.advanceFully(u,n));e++)wK&&(d=this.stackID(u)+` -> `);for(let e of o.recoverByInsert(s))wK&&console.log(l+this.stackID(e)+` (via recover-insert)`),this.advanceFully(e,n);this.stream.end>o.pos?(c==o.pos&&(c++,s=0),o.recoverByDelete(s,c),wK&&console.log(l+this.stackID(o)+` (via recover-delete ${this.parser.getName(s)})`),DAt(o,n)):(!r||r.score<o.score)&&(r=o)}return r}stackToTree(e){return e.close(),QU.build({buffer:MAt.create(e),nodeSet:this.parser.nodeSet,topID:this.topTerm,maxBufferLength:this.parser.bufferLength,reused:this.reused,start:this.ranges[0].from,length:e.pos-this.ranges[0].from,minRepeatType:this.parser.minRepeatTerm})}stackID(e){let t=(TK||=new WeakMap).get(e);return t||TK.set(e,t=String.fromCodePoint(this.nextStackID++)),t+e}},LAt=class{constructor(e,t,n){this.source=e,this.flags=t,this.disabled=n}allows(e){return!this.disabled||this.disabled[e]==0}},EK=e=>e,DK=class{constructor(e){this.start=e.start,this.shift=e.shift||EK,this.reduce=e.reduce||EK,this.reuse=e.reuse||EK,this.hash=e.hash||(()=>0),this.strict=e.strict!==!1}},OK=class e extends sW{constructor(e){if(super(),this.wrappers=[],e.version!=14)throw RangeError(`Parser version (${e.version}) doesn't match runtime version (14)`);let t=e.nodeNames.split(` `);this.minRepeatTerm=t.length;for(let n=0;n<e.repeatNodeCount;n++)t.push(``);let n=Object.keys(e.topRules).map(t=>e.topRules[t][1]),r=[];for(let e=0;e<t.length;e++)r.push([]);function i(e,t,n){r[e].push([t,t.deserialize(String(n))])}if(e.nodeProps)for(let t of e.nodeProps){let e=t[0];typeof e==`string`&&(e=KU[e]);for(let n=1;n<t.length;){let r=t[n++];if(r>=0)i(r,e,t[n++]);else{let a=t[n+-r];for(let o=-r;o>0;o--)i(t[n++],e,a);n++}}}this.nodeSet=new uDt(t.map((t,i)=>JU.define({name:i>=this.minRepeatTerm?void 0:t,id:i,props:r[i],top:n.indexOf(i)>-1,error:i==0,skipped:e.skippedNodes&&e.skippedNodes.indexOf(i)>-1}))),e.propSources&&(this.nodeSet=this.nodeSet.extend(...e.propSources)),this.strict=!1,this.bufferLength=WU;let a=gK(e.tokenData);this.context=e.context,this.specializerSpecs=e.specialized||[],this.specialized=new Uint16Array(this.specializerSpecs.length);for(let e=0;e<this.specializerSpecs.length;e++)this.specialized[e]=this.specializerSpecs[e].term;this.specializers=this.specializerSpecs.map(kAt),this.states=gK(e.states,Uint32Array),this.data=gK(e.stateData),this.goto=gK(e.goto),this.maxTerm=e.maxTerm,this.tokenizers=e.tokenizers.map(e=>typeof e==`number`?new xK(a,e):e),this.topRules=e.topRules,this.dialects=e.dialects||{},this.dynamicPrecedences=e.dynamicPrecedences||null,this.tokenPrecTable=e.tokenPrec,this.termNames=e.termNames||null,this.maxNode=this.nodeSet.types.length-1,this.dialect=this.parseDialect(),this.top=this.topRules[Object.keys(this.topRules)[0]]}createParse(e,t,n){let r=new IAt(this,e,t,n);for(let i of this.wrappers)r=i(r,e,t,n);return r}getGoto(e,t,n=!1){let r=this.goto;if(t>=r[0])return-1;for(let i=r[t+1];;){let t=r[i++],a=t&1,o=r[i++];if(a&&n)return o;for(let n=i+(t>>1);i<n;i++)if(r[i]==e)return o;if(a)return-1}}hasAction(e,t){let n=this.data;for(let r=0;r<2;r++)for(let i=this.stateSlot(e,r?2:1),a;;i+=3){if((a=n[i])==65535)if(n[i+1]==1)a=n[i=_K(n,i+2)];else if(n[i+1]==2)return _K(n,i+2);else break;if(a==t||a==0)return _K(n,i+1)}return 0}stateSlot(e,t){return this.states[e*6+t]}stateFlag(e,t){return(this.stateSlot(e,0)&t)>0}validAction(e,t){return!!this.allActions(e,e=>e==t?!0:null)}allActions(e,t){let n=this.stateSlot(e,4),r=n?t(n):void 0;for(let n=this.stateSlot(e,1);r==null;n+=3){if(this.data[n]==65535)if(this.data[n+1]==1)n=_K(this.data,n+2);else break;r=t(_K(this.data,n+1))}return r}nextStates(e){let t=[];for(let n=this.stateSlot(e,1);;n+=3){if(this.data[n]==65535)if(this.data[n+1]==1)n=_K(this.data,n+2);else break;if(!(this.data[n+2]&1)){let e=this.data[n+1];t.some((t,n)=>n&1&&t==e)||t.push(this.data[n],e)}}return t}configure(t){let n=Object.assign(Object.create(e.prototype),this);if(t.props&&(n.nodeSet=this.nodeSet.extend(...t.props)),t.top){let e=this.topRules[t.top];if(!e)throw RangeError(`Invalid top rule name ${t.top}`);n.top=e}return t.tokenizers&&(n.tokenizers=this.tokenizers.map(e=>{let n=t.tokenizers.find(t=>t.from==e);return n?n.to:e})),t.specializers&&(n.specializers=this.specializers.slice(),n.specializerSpecs=this.specializerSpecs.map((e,r)=>{let i=t.specializers.find(t=>t.from==e.external);if(!i)return e;let a=Object.assign(Object.assign({},e),{external:i.to});return n.specializers[r]=kAt(a),a})),t.contextTracker&&(n.context=t.contextTracker),t.dialect&&(n.dialect=this.parseDialect(t.dialect)),t.strict!=null&&(n.strict=t.strict),t.wrap&&(n.wrappers=n.wrappers.concat(t.wrap)),t.bufferLength!=null&&(n.bufferLength=t.bufferLength),n}hasWrappers(){return this.wrappers.length>0}getName(e){return this.termNames?this.termNames[e]:String(e<=this.maxNode&&this.nodeSet.types[e].name||e)}get eofTerm(){return this.maxNode+1}get topNode(){return this.nodeSet.types[this.top[1]]}dynamicPrecedence(e){let t=this.dynamicPrecedences;return t==null?0:t[e]||0}parseDialect(e){let t=Object.keys(this.dialects),n=t.map(()=>!1);if(e)for(let r of e.split(` `)){let e=t.indexOf(r);e>=0&&(n[e]=!0)}let r=null;for(let e=0;e<t.length;e++)if(!n[e])for(let n=this.dialects[t[e]],i;(i=this.data[n++])!=65535;)(r||=new Uint8Array(this.maxTerm+1))[i]=1;return new LAt(e,n,r)}static deserialize(t){return new e(t)}}}));function AK(e){return e>=65&&e<=90||e>=97&&e<=122||e>=161}function RAt(e){return e>=48&&e<=57}var zAt,jK,BAt,VAt,MK,NK,HAt,UAt,PK,WAt,FK,GAt,KAt,qAt,JAt,YAt,XAt,ZAt,QAt,$At,ejt,tjt,njt,rjt,ijt,ajt=s((()=>{kK(),MW(),zAt=99,jK=1,BAt=100,VAt=101,MK=2,NK=[9,10,11,12,13,32,133,160,5760,8192,8193,8194,8195,8196,8197,8198,8199,8200,8201,8202,8232,8233,8239,8287,12288],HAt=58,UAt=40,PK=95,WAt=91,FK=45,GAt=46,KAt=35,qAt=37,JAt=38,YAt=92,XAt=10,ZAt=new CK((e,t)=>{for(let n=!1,r=0,i=0;;i++){let{next:a}=e;if(AK(a)||a==FK||a==PK||n&&RAt(a))!n&&(a!=FK||i>0)&&(n=!0),r===i&&a==FK&&r++,e.advance();else if(a==YAt&&e.peek(1)!=XAt)e.advance(),e.next>-1&&e.advance(),n=!0;else{n&&e.acceptToken(a==UAt?BAt:r==2&&t.canShift(MK)?MK:VAt);break}}}),QAt=new CK(e=>{if(NK.includes(e.peek(-1))){let{next:t}=e;(AK(t)||t==PK||t==KAt||t==GAt||t==WAt||t==HAt&&AK(e.peek(1))||t==FK||t==JAt)&&e.acceptToken(zAt)}}),$At=new CK(e=>{if(!NK.includes(e.peek(-1))){let{next:t}=e;if(t==qAt&&(e.advance(),e.acceptToken(jK)),AK(t)){do e.advance();while(AK(e.next)||RAt(e.next));e.acceptToken(jK)}}}),ejt=fW({"AtKeyword import charset namespace keyframes media supports":$.definitionKeyword,"from to selector":$.keyword,NamespaceName:$.namespace,KeyframeName:$.labelName,KeyframeRangeName:$.operatorKeyword,TagName:$.tagName,ClassName:$.className,PseudoClassName:$.constant($.className),IdName:$.labelName,"FeatureName PropertyName":$.propertyName,AttributeName:$.attributeName,NumberLiteral:$.number,KeywordQuery:$.keyword,UnaryQueryOp:$.operatorKeyword,"CallTag ValueName":$.atom,VariableName:$.variableName,Callee:$.operatorKeyword,Unit:$.unit,"UniversalSelector NestingSelector":$.definitionOperator,MatchOp:$.compareOperator,"ChildOp SiblingOp, LogicOp":$.logicOperator,BinOp:$.arithmeticOperator,Important:$.modifier,Comment:$.blockComment,ColorLiteral:$.color,"ParenthesizedContent StringLiteral":$.string,":":$.punctuation,"PseudoOp #":$.derefOperator,"; ,":$.separator,"( )":$.paren,"[ ]":$.squareBracket,"{ }":$.brace}),tjt={__proto__:null,lang:32,"nth-child":32,"nth-last-child":32,"nth-of-type":32,"nth-last-of-type":32,dir:32,"host-context":32,url:60,"url-prefix":60,domain:60,regexp:60,selector:138},njt={__proto__:null,"@import":118,"@media":142,"@charset":146,"@namespace":150,"@keyframes":156,"@supports":168},rjt={__proto__:null,not:132,only:132},ijt=OK.deserialize({version:14,states:":^QYQ[OOO#_Q[OOP#fOWOOOOQP'#Cd'#CdOOQP'#Cc'#CcO#kQ[O'#CfO$_QXO'#CaO$fQ[O'#ChO$qQ[O'#DTO$vQ[O'#DWOOQP'#Em'#EmO${QdO'#DgO%jQ[O'#DtO${QdO'#DvO%{Q[O'#DxO&WQ[O'#D{O&`Q[O'#ERO&nQ[O'#ETOOQS'#El'#ElOOQS'#EW'#EWQYQ[OOO&uQXO'#CdO'jQWO'#DcO'oQWO'#EsO'zQ[O'#EsQOQWOOP(UO#tO'#C_POOO)C@[)C@[OOQP'#Cg'#CgOOQP,59Q,59QO#kQ[O,59QO(aQ[O'#E[O({QWO,58{O)TQ[O,59SO$qQ[O,59oO$vQ[O,59rO(aQ[O,59uO(aQ[O,59wO(aQ[O,59xO)`Q[O'#DbOOQS,58{,58{OOQP'#Ck'#CkOOQO'#DR'#DROOQP,59S,59SO)gQWO,59SO)lQWO,59SOOQP'#DV'#DVOOQP,59o,59oOOQO'#DX'#DXO)qQ`O,59rOOQS'#Cp'#CpO${QdO'#CqO)yQvO'#CsO+ZQtO,5:ROOQO'#Cx'#CxO)lQWO'#CwO+oQWO'#CyO+tQ[O'#DOOOQS'#Ep'#EpOOQO'#Dj'#DjO+|Q[O'#DqO,[QWO'#EtO&`Q[O'#DoO,jQWO'#DrOOQO'#Eu'#EuO)OQWO,5:`O,oQpO,5:bOOQS'#Dz'#DzO,wQWO,5:dO,|Q[O,5:dOOQO'#D}'#D}O-UQWO,5:gO-ZQWO,5:mO-cQWO,5:oOOQS-E8U-E8UO${QdO,59}O-kQ[O'#E^O-xQWO,5;_O-xQWO,5;_POOO'#EV'#EVP.TO#tO,58yPOOO,58y,58yOOQP1G.l1G.lO.zQXO,5:vOOQO-E8Y-E8YOOQS1G.g1G.gOOQP1G.n1G.nO)gQWO1G.nO)lQWO1G.nOOQP1G/Z1G/ZO/XQ`O1G/^O/rQXO1G/aO0YQXO1G/cO0pQXO1G/dO1WQWO,59|O1]Q[O'#DSO1dQdO'#CoOOQP1G/^1G/^O${QdO1G/^O1kQpO,59]OOQS,59_,59_O${QdO,59aO1sQWO1G/mOOQS,59c,59cO1xQ!bO,59eOOQS'#DP'#DPOOQS'#EY'#EYO2QQ[O,59jOOQS,59j,59jO2YQWO'#DjO2eQWO,5:VO2jQWO,5:]O&`Q[O,5:XO&`Q[O'#E_O2rQWO,5;`O2}QWO,5:ZO(aQ[O,5:^OOQS1G/z1G/zOOQS1G/|1G/|OOQS1G0O1G0OO3`QWO1G0OO3eQdO'#EOOOQS1G0R1G0ROOQS1G0X1G0XOOQS1G0Z1G0ZO3pQtO1G/iOOQO,5:x,5:xO4WQ[O,5:xOOQO-E8[-E8[O4eQWO1G0yPOOO-E8T-E8TPOOO1G.e1G.eOOQP7+$Y7+$YOOQP7+$x7+$xO${QdO7+$xOOQS1G/h1G/hO4pQXO'#ErO4wQWO,59nO4|QtO'#EXO5tQdO'#EoO6OQWO,59ZO6TQpO7+$xOOQS1G.w1G.wOOQS1G.{1G.{OOQS7+%X7+%XO6]QWO1G/POOQS-E8W-E8WOOQS1G/U1G/UO${QdO1G/qOOQO1G/w1G/wOOQO1G/s1G/sO6bQWO,5:yOOQO-E8]-E8]O6pQXO1G/xOOQS7+%j7+%jO6wQYO'#CsOOQO'#EQ'#EQO7SQ`O'#EPOOQO'#EP'#EPO7_QWO'#E`O7gQdO,5:jOOQS,5:j,5:jO7rQtO'#E]O${QdO'#E]O8sQdO7+%TOOQO7+%T7+%TOOQO1G0d1G0dO9WQpO<<HdO9`QWO,5;^OOQP1G/Y1G/YOOQS-E8V-E8VO${QdO'#EZO9hQWO,5;ZOOQT1G.u1G.uOOQP<<Hd<<HdOOQS7+$k7+$kO9pQdO7+%]OOQO7+%d7+%dOOQO,5:k,5:kO3hQdO'#EaO7_QWO,5:zOOQS,5:z,5:zOOQS-E8^-E8^OOQS1G0U1G0UO9wQtO,5:wOOQS-E8Z-E8ZOOQO<<Ho<<HoOOQPAN>OAN>OO:xQdO,5:uOOQO-E8X-E8XOOQO<<Hw<<HwOOQO,5:{,5:{OOQO-E8_-E8_OOQS1G0f1G0f",stateData:";[~O#ZOS#[QQ~OUYOXYO]VO^VOqXOxWO![aO!]ZO!i[O!k]O!m^O!p_O!v`O#XRO#bTO~OQfOUYOXYO]VO^VOqXOxWO![aO!]ZO!i[O!k]O!m^O!p_O!v`O#XeO#bTO~O#U#gP~P!ZO#[jO~O#XlO~O]qO^qOqsOtoOxrO!OtO!RvO#VuO#bnO~O!TwO~P#pO`}O#WzO#XyO~O#X!OO~O#X!QO~OQ![Ob!TOf![Oh![On!YOq!ZO#W!WO#X!SO#e!UO~Ob!^O!d!`O!g!aO#X!]O!T#hP~Oh!fOn!YO#X!eO~Oh!hO#X!hO~Ob!^O!d!`O!g!aO#X!]O~O!Y#hP~P%jO]WX]!WX^WXqWXtWXxWX!OWX!RWX!TWX#VWX#bWX~O]!mO~O!Y!nO#U#gX!S#gX~O#U#gX!S#gX~P!ZO#]!qO#^!qO#_!sO~OUYOXYO]VO^VOqXOxWO#XRO#bTO~OtoO!TwO~O`!zO#WzO#XyO~O!S#gP~P!ZOb#RO~Ob#SO~Op#TO|#UO~OP#WObgXjgX!YgX!dgX!ggX#XgXagXQgXfgXhgXngXqgXtgX!XgX#UgX#WgX#egXpgX!SgX~Ob!^Oj#XO!d!`O!g!aO#X!]O!Y#hP~Ob#[O~Op#`O#X#]O~Ob!^O!d!`O!g!aO#X#aO~Ot#eO!b#dO!T#hX!Y#hX~Ob#hO~Oj#XO!Y#jO~O!Y#kO~Oh#lOn!YO~O!T#mO~O!TwO!b#dO~O!TwO!Y#pO~O!Y#QX#U#QX!S#QX~P!ZO!Y!nO#U#ga!S#ga~O#]!qO#^!qO#_#wO~O]qO^qOqsOxrO!OtO!RvO#VuO#bnO~Ot#Oa!T#Oaa#Oa~P.`Op#yO|#zO~O]qO^qOqsOxrO#bnO~Ot}i!O}i!R}i!T}i#V}ia}i~P/aOt!Pi!O!Pi!R!Pi!T!Pi#V!Pia!Pi~P/aOt!Qi!O!Qi!R!Qi!T!Qi#V!Qia!Qi~P/aO!S#{O~Oa#fP~P(aOa#cP~P${Oa$SOj#XO~O!Y$UO~Oh$VOo$VO~Op$XO#X#]O~O]!`Xa!^X!b!^X~O]$YO~Oa$ZO!b#dO~Ot#eO!T#ha!Y#ha~O!b#dOt!ca!T!ca!Y!caa!ca~O!Y$`O~O!S$gO#X$bO#e$aO~Oj#XOt$iO!X$kO!Y!Vi#U!Vi!S!Vi~P${O!Y#Qa#U#Qa!S#Qa~P!ZO!Y!nO#U#gi!S#gi~Oa#fX~P#pOa$oO~Oj#XOQ!{Xa!{Xb!{Xf!{Xh!{Xn!{Xq!{Xt!{X#W!{X#X!{X#e!{X~Ot$qOa#cX~P${Oa$sO~Oj#XOp$tO~Oa$uO~O!b#dOt#Ra!T#Ra!Y#Ra~Oa$wO~P.`OP#WOtgX!TgX~O#e$aOt!sX!T!sX~Ot$yO!TwO~O!S$}O#X$bO#e$aO~Oj#XOQ#PXb#PXf#PXh#PXn#PXq#PXt#PX!X#PX!Y#PX#U#PX#W#PX#X#PX#e#PX!S#PX~Ot$iO!X%QO!Y!Vq#U!Vq!S!Vq~P${Oj#XOp%RO~OtoOa#fa~Ot$qOa#ca~Oa%UO~P${Oj#XOQ#Pab#Paf#Pah#Pan#Paq#Pat#Pa!X#Pa!Y#Pa#U#Pa#W#Pa#X#Pa#e#Pa!S#Pa~Oa!}at!}a~P${O#Zo#[#ej!R#e~",goto:"-g#jPPP#kP#nP#w$WP#w$g#wPP$mPPP$s$|$|P%`P$|P$|%z&^PPPP$|&vP&z'Q#wP'W#w'^P#wP#w#wPPP'd'y(WPP#nPP(_(_(i(_P(_P(_(_P#nP#nP#nP(l#nP(o(r(u(|#nP#nP)R)X)h)v)|*S*^*d*n*t*zPPPPPPPPPP+Q+ZP+v+yP,o,r,x-RRkQ_bOPdhw!n#skYOPdhotuvw!n#R#h#skSOPdhotuvw!n#R#h#sQmTR!tnQ{VR!xqQ!x}Q#Z!XR#x!zq![Z]!T!m#S#U#X#q#z$P$Y$i$j$q$v%Sp![Z]!T!m#S#U#X#q#z$P$Y$i$j$q$v%SU$d#m$f$yR$x$cq!XZ]!T!m#S#U#X#q#z$P$Y$i$j$q$v%Sp![Z]!T!m#S#U#X#q#z$P$Y$i$j$q$v%SQ!f^R#l!gT#^!Z#_Q|VR!yqQ!x|R#x!yQ!PWR!{rQ!RXR!|sQxUQ!wpQ#i!cQ#o!jQ#p!kQ${$eR%X$zSgPwQ!phQ#r!nR$l#sZfPhw!n#sa!b[`a!V!^!`#d#eR#b!^R!g^R!i_R#n!iS$e#m$fR%V$yV$c#m$f$yQ!rjR#v!rQdOShPwU!ldh#sR#s!nQ$P#SU$p$P$v%SQ$v$YR%S$qQ#_!ZR$W#_Q$r$PR%T$rQpUS!vp$nR$n#|Q$j#qR%P$jQ!ogS#t!o#uR#u!pQ#f!_R$^#fQ$f#mR$|$fQ$z$eR%W$z_cOPdhw!n#s^UOPdhw!n#sQ!uoQ!}tQ#OuQ#PvQ#|#RR$_#hR$Q#SQ!VZQ!d]Q#V!TQ#q!m[$O#S$P$Y$q$v%SQ$R#UQ$T#XS$h#q$jQ$m#zR%O$iR#}#RQiPR#QwQ!c[Q!kaR#Y!VU!_[a!VQ!j`Q#c!^Q#g!`Q$[#dR$]#e",nodeNames:`⚠ Unit VariableName Comment StyleSheet RuleSet UniversalSelector TagSelector TagName NestingSelector ClassSelector ClassName PseudoClassSelector : :: PseudoClassName PseudoClassName ) ( ArgList ValueName ParenthesizedValue ColorLiteral NumberLiteral StringLiteral BinaryExpression BinOp CallExpression Callee CallLiteral CallTag ParenthesizedContent ] [ LineNames LineName , PseudoClassName ArgList IdSelector # IdName AttributeSelector AttributeName MatchOp ChildSelector ChildOp DescendantSelector SiblingSelector SiblingOp } { Block Declaration PropertyName Important ; ImportStatement AtKeyword import KeywordQuery FeatureQuery FeatureName BinaryQuery LogicOp UnaryQuery UnaryQueryOp ParenthesizedQuery SelectorQuery selector MediaStatement media CharsetStatement charset NamespaceStatement namespace NamespaceName KeyframesStatement keyframes KeyframeName KeyframeList KeyframeSelector KeyframeRangeName SupportsStatement supports AtRule Styles`,maxTerm:117,nodeProps:[[`isolate`,-2,3,24,``],[`openedBy`,17,`(`,32,`[`,50,`{`],[`closedBy`,18,`)`,33,`]`,51,`}`]],propSources:[ejt],skippedNodes:[0,3,87],repeatNodeCount:11,tokenData:"J^~R!^OX$}X^%u^p$}pq%uqr)Xrs.Rst/utu6duv$}vw7^wx7oxy9^yz9oz{9t{|:_|}?Q}!O?c!O!P@Q!P!Q@i!Q![Ab![!]B]!]!^CX!^!_$}!_!`Cj!`!aC{!a!b$}!b!cDw!c!}$}!}#OFa#O#P$}#P#QFr#Q#R6d#R#T$}#T#UGT#U#c$}#c#dHf#d#o$}#o#pH{#p#q6d#q#rI^#r#sIo#s#y$}#y#z%u#z$f$}$f$g%u$g#BY$}#BY#BZ%u#BZ$IS$}$IS$I_%u$I_$I|$}$I|$JO%u$JO$JT$}$JT$JU%u$JU$KV$}$KV$KW%u$KW&FU$}&FU&FV%u&FV;'S$};'S;=`JW<%lO$}`%QSOy%^z;'S%^;'S;=`%o<%lO%^`%cSo`Oy%^z;'S%^;'S;=`%o<%lO%^`%rP;=`<%l%^~%zh#Z~OX%^X^'f^p%^pq'fqy%^z#y%^#y#z'f#z$f%^$f$g'f$g#BY%^#BY#BZ'f#BZ$IS%^$IS$I_'f$I_$I|%^$I|$JO'f$JO$JT%^$JT$JU'f$JU$KV%^$KV$KW'f$KW&FU%^&FU&FV'f&FV;'S%^;'S;=`%o<%lO%^~'mh#Z~o`OX%^X^'f^p%^pq'fqy%^z#y%^#y#z'f#z$f%^$f$g'f$g#BY%^#BY#BZ'f#BZ$IS%^$IS$I_'f$I_$I|%^$I|$JO'f$JO$JT%^$JT$JU'f$JU$KV%^$KV$KW'f$KW&FU%^&FU&FV'f&FV;'S%^;'S;=`%o<%lO%^l)[UOy%^z#]%^#]#^)n#^;'S%^;'S;=`%o<%lO%^l)sUo`Oy%^z#a%^#a#b*V#b;'S%^;'S;=`%o<%lO%^l*[Uo`Oy%^z#d%^#d#e*n#e;'S%^;'S;=`%o<%lO%^l*sUo`Oy%^z#c%^#c#d+V#d;'S%^;'S;=`%o<%lO%^l+[Uo`Oy%^z#f%^#f#g+n#g;'S%^;'S;=`%o<%lO%^l+sUo`Oy%^z#h%^#h#i,V#i;'S%^;'S;=`%o<%lO%^l,[Uo`Oy%^z#T%^#T#U,n#U;'S%^;'S;=`%o<%lO%^l,sUo`Oy%^z#b%^#b#c-V#c;'S%^;'S;=`%o<%lO%^l-[Uo`Oy%^z#h%^#h#i-n#i;'S%^;'S;=`%o<%lO%^l-uS!X[o`Oy%^z;'S%^;'S;=`%o<%lO%^~.UWOY.RZr.Rrs.ns#O.R#O#P.s#P;'S.R;'S;=`/o<%lO.R~.sOh~~.vRO;'S.R;'S;=`/P;=`O.R~/SXOY.RZr.Rrs.ns#O.R#O#P.s#P;'S.R;'S;=`/o;=`<%l.R<%lO.R~/rP;=`<%l.Rn/zYxQOy%^z!Q%^!Q![0j![!c%^!c!i0j!i#T%^#T#Z0j#Z;'S%^;'S;=`%o<%lO%^l0oYo`Oy%^z!Q%^!Q![1_![!c%^!c!i1_!i#T%^#T#Z1_#Z;'S%^;'S;=`%o<%lO%^l1dYo`Oy%^z!Q%^!Q![2S![!c%^!c!i2S!i#T%^#T#Z2S#Z;'S%^;'S;=`%o<%lO%^l2ZYf[o`Oy%^z!Q%^!Q![2y![!c%^!c!i2y!i#T%^#T#Z2y#Z;'S%^;'S;=`%o<%lO%^l3QYf[o`Oy%^z!Q%^!Q![3p![!c%^!c!i3p!i#T%^#T#Z3p#Z;'S%^;'S;=`%o<%lO%^l3uYo`Oy%^z!Q%^!Q![4e![!c%^!c!i4e!i#T%^#T#Z4e#Z;'S%^;'S;=`%o<%lO%^l4lYf[o`Oy%^z!Q%^!Q![5[![!c%^!c!i5[!i#T%^#T#Z5[#Z;'S%^;'S;=`%o<%lO%^l5aYo`Oy%^z!Q%^!Q![6P![!c%^!c!i6P!i#T%^#T#Z6P#Z;'S%^;'S;=`%o<%lO%^l6WSf[o`Oy%^z;'S%^;'S;=`%o<%lO%^d6gUOy%^z!_%^!_!`6y!`;'S%^;'S;=`%o<%lO%^d7QS|So`Oy%^z;'S%^;'S;=`%o<%lO%^b7cSXQOy%^z;'S%^;'S;=`%o<%lO%^~7rWOY7oZw7owx.nx#O7o#O#P8[#P;'S7o;'S;=`9W<%lO7o~8_RO;'S7o;'S;=`8h;=`O7o~8kXOY7oZw7owx.nx#O7o#O#P8[#P;'S7o;'S;=`9W;=`<%l7o<%lO7o~9ZP;=`<%l7on9cSb^Oy%^z;'S%^;'S;=`%o<%lO%^~9tOa~n9{UUQjWOy%^z!_%^!_!`6y!`;'S%^;'S;=`%o<%lO%^n:fWjW!RQOy%^z!O%^!O!P;O!P!Q%^!Q![>T![;'S%^;'S;=`%o<%lO%^l;TUo`Oy%^z!Q%^!Q![;g![;'S%^;'S;=`%o<%lO%^l;nYo`#e[Oy%^z!Q%^!Q![;g![!g%^!g!h<^!h#X%^#X#Y<^#Y;'S%^;'S;=`%o<%lO%^l<cYo`Oy%^z{%^{|=R|}%^}!O=R!O!Q%^!Q![=j![;'S%^;'S;=`%o<%lO%^l=WUo`Oy%^z!Q%^!Q![=j![;'S%^;'S;=`%o<%lO%^l=qUo`#e[Oy%^z!Q%^!Q![=j![;'S%^;'S;=`%o<%lO%^l>[[o`#e[Oy%^z!O%^!O!P;g!P!Q%^!Q![>T![!g%^!g!h<^!h#X%^#X#Y<^#Y;'S%^;'S;=`%o<%lO%^n?VSt^Oy%^z;'S%^;'S;=`%o<%lO%^l?hWjWOy%^z!O%^!O!P;O!P!Q%^!Q![>T![;'S%^;'S;=`%o<%lO%^n@VU#bQOy%^z!Q%^!Q![;g![;'S%^;'S;=`%o<%lO%^~@nTjWOy%^z{@}{;'S%^;'S;=`%o<%lO%^~AUSo`#[~Oy%^z;'S%^;'S;=`%o<%lO%^lAg[#e[Oy%^z!O%^!O!P;g!P!Q%^!Q![>T![!g%^!g!h<^!h#X%^#X#Y<^#Y;'S%^;'S;=`%o<%lO%^bBbU]QOy%^z![%^![!]Bt!];'S%^;'S;=`%o<%lO%^bB{S^Qo`Oy%^z;'S%^;'S;=`%o<%lO%^nC^S!Y^Oy%^z;'S%^;'S;=`%o<%lO%^dCoS|SOy%^z;'S%^;'S;=`%o<%lO%^bDQU!OQOy%^z!`%^!`!aDd!a;'S%^;'S;=`%o<%lO%^bDkS!OQo`Oy%^z;'S%^;'S;=`%o<%lO%^bDzWOy%^z!c%^!c!}Ed!}#T%^#T#oEd#o;'S%^;'S;=`%o<%lO%^bEk[![Qo`Oy%^z}%^}!OEd!O!Q%^!Q![Ed![!c%^!c!}Ed!}#T%^#T#oEd#o;'S%^;'S;=`%o<%lO%^nFfSq^Oy%^z;'S%^;'S;=`%o<%lO%^nFwSp^Oy%^z;'S%^;'S;=`%o<%lO%^bGWUOy%^z#b%^#b#cGj#c;'S%^;'S;=`%o<%lO%^bGoUo`Oy%^z#W%^#W#XHR#X;'S%^;'S;=`%o<%lO%^bHYS!bQo`Oy%^z;'S%^;'S;=`%o<%lO%^bHiUOy%^z#f%^#f#gHR#g;'S%^;'S;=`%o<%lO%^fIQS!TUOy%^z;'S%^;'S;=`%o<%lO%^nIcS!S^Oy%^z;'S%^;'S;=`%o<%lO%^fItU!RQOy%^z!_%^!_!`6y!`;'S%^;'S;=`%o<%lO%^`JZP;=`<%l$}",tokenizers:[QAt,$At,ZAt,1,2,3,4,new SK(`m~RRYZ[z{a~~g~aO#^~~dP!P!Qg~lO#_~~`,28,105)],topRules:{StyleSheet:[0,4],Styles:[1,86]},specialized:[{term:100,get:e=>tjt[e]||-1},{term:58,get:e=>njt[e]||-1},{term:101,get:e=>rjt[e]||-1}],tokenPrec:1200})}));function IK(){if(!LK&&typeof document==`object`&&document.body){let{style:e}=document.body,t=[],n=new Set;for(let r in e)r!=`cssText`&&r!=`cssFloat`&&typeof e[r]==`string`&&(/[A-Z]/.test(r)&&(r=r.replace(/[A-Z]/g,e=>`-`+e.toLowerCase())),n.has(r)||(t.push(r),n.add(r)));LK=t.sort().map(e=>({type:`property`,label:e,apply:e+`: `}))}return LK||[]}function ojt(e,t){if((e.name==`(`||e.type.isError)&&(e=e.parent||e),e.name!=`ArgList`)return!1;let n=e.parent?.firstChild;return n?.name==`Callee`?t.sliceString(n.from,n.to)==`var`:!1}function sjt(e){for(let t=e;;){if(t.type.isTop)return t;if(!(t=t.parent))return e}}function cjt(e,t,n){if(t.to-t.from>4096){let r=VK.get(t);if(r)return r;let i=[],a=new Set,o=t.cursor(ZU.IncludeAnonymous);if(o.firstChild())do for(let t of cjt(e,o.node,n))a.has(t.label)||(a.add(t.label),i.push(t));while(o.nextSibling());return VK.set(t,i),i}else{let r=[],i=new Set;return t.cursor().iterate(t=>{if(n(t)&&t.matchContext(pjt)&&t.node.nextSibling?.name==`:`){let n=e.sliceString(t.from,t.to);i.has(n)||(i.add(n),r.push({label:n,type:`variable`}))}}),r}}function ljt(){return new QW(HK,HK.data.of({autocomplete:hjt}))}var LK,RK,zK,ujt,djt,BK,fjt,VK,pjt,mjt,hjt,HK,gjt=s((()=>{ajt(),yG(),dW(),LK=null,RK=`active.after.any-link.autofill.backdrop.before.checked.cue.default.defined.disabled.empty.enabled.file-selector-button.first.first-child.first-letter.first-line.first-of-type.focus.focus-visible.focus-within.fullscreen.has.host.host-context.hover.in-range.indeterminate.invalid.is.lang.last-child.last-of-type.left.link.marker.modal.not.nth-child.nth-last-child.nth-last-of-type.nth-of-type.only-child.only-of-type.optional.out-of-range.part.placeholder.placeholder-shown.read-only.read-write.required.right.root.scope.selection.slotted.target.target-text.valid.visited.where`.split(`.`).map(e=>({type:`class`,label:e})),zK=`above.absolute.activeborder.additive.activecaption.after-white-space.ahead.alias.all.all-scroll.alphabetic.alternate.always.antialiased.appworkspace.asterisks.attr.auto.auto-flow.avoid.avoid-column.avoid-page.avoid-region.axis-pan.background.backwards.baseline.below.bidi-override.blink.block.block-axis.bold.bolder.border.border-box.both.bottom.break.break-all.break-word.bullets.button.button-bevel.buttonface.buttonhighlight.buttonshadow.buttontext.calc.capitalize.caps-lock-indicator.caption.captiontext.caret.cell.center.checkbox.circle.cjk-decimal.clear.clip.close-quote.col-resize.collapse.color.color-burn.color-dodge.column.column-reverse.compact.condensed.contain.content.contents.content-box.context-menu.continuous.copy.counter.counters.cover.crop.cross.crosshair.currentcolor.cursive.cyclic.darken.dashed.decimal.decimal-leading-zero.default.default-button.dense.destination-atop.destination-in.destination-out.destination-over.difference.disc.discard.disclosure-closed.disclosure-open.document.dot-dash.dot-dot-dash.dotted.double.down.e-resize.ease.ease-in.ease-in-out.ease-out.element.ellipse.ellipsis.embed.end.ethiopic-abegede-gez.ethiopic-halehame-aa-er.ethiopic-halehame-gez.ew-resize.exclusion.expanded.extends.extra-condensed.extra-expanded.fantasy.fast.fill.fill-box.fixed.flat.flex.flex-end.flex-start.footnotes.forwards.from.geometricPrecision.graytext.grid.groove.hand.hard-light.help.hidden.hide.higher.highlight.highlighttext.horizontal.hsl.hsla.hue.icon.ignore.inactiveborder.inactivecaption.inactivecaptiontext.infinite.infobackground.infotext.inherit.initial.inline.inline-axis.inline-block.inline-flex.inline-grid.inline-table.inset.inside.intrinsic.invert.italic.justify.keep-all.landscape.large.larger.left.level.lighter.lighten.line-through.linear.linear-gradient.lines.list-item.listbox.listitem.local.logical.loud.lower.lower-hexadecimal.lower-latin.lower-norwegian.lowercase.ltr.luminosity.manipulation.match.matrix.matrix3d.medium.menu.menutext.message-box.middle.min-intrinsic.mix.monospace.move.multiple.multiple_mask_images.multiply.n-resize.narrower.ne-resize.nesw-resize.no-close-quote.no-drop.no-open-quote.no-repeat.none.normal.not-allowed.nowrap.ns-resize.numbers.numeric.nw-resize.nwse-resize.oblique.opacity.open-quote.optimizeLegibility.optimizeSpeed.outset.outside.outside-shape.overlay.overline.padding.padding-box.painted.page.paused.perspective.pinch-zoom.plus-darker.plus-lighter.pointer.polygon.portrait.pre.pre-line.pre-wrap.preserve-3d.progress.push-button.radial-gradient.radio.read-only.read-write.read-write-plaintext-only.rectangle.region.relative.repeat.repeating-linear-gradient.repeating-radial-gradient.repeat-x.repeat-y.reset.reverse.rgb.rgba.ridge.right.rotate.rotate3d.rotateX.rotateY.rotateZ.round.row.row-resize.row-reverse.rtl.run-in.running.s-resize.sans-serif.saturation.scale.scale3d.scaleX.scaleY.scaleZ.screen.scroll.scrollbar.scroll-position.se-resize.self-start.self-end.semi-condensed.semi-expanded.separate.serif.show.single.skew.skewX.skewY.skip-white-space.slide.slider-horizontal.slider-vertical.sliderthumb-horizontal.sliderthumb-vertical.slow.small.small-caps.small-caption.smaller.soft-light.solid.source-atop.source-in.source-out.source-over.space.space-around.space-between.space-evenly.spell-out.square.start.static.status-bar.stretch.stroke.stroke-box.sub.subpixel-antialiased.svg_masks.super.sw-resize.symbolic.symbols.system-ui.table.table-caption.table-cell.table-column.table-column-group.table-footer-group.table-header-group.table-row.table-row-group.text.text-bottom.text-top.textarea.textfield.thick.thin.threeddarkshadow.threedface.threedhighlight.threedlightshadow.threedshadow.to.top.transform.translate.translate3d.translateX.translateY.translateZ.transparent.ultra-condensed.ultra-expanded.underline.unidirectional-pan.unset.up.upper-latin.uppercase.url.var.vertical.vertical-text.view-box.visible.visibleFill.visiblePainted.visibleStroke.visual.w-resize.wait.wave.wider.window.windowframe.windowtext.words.wrap.wrap-reverse.x-large.x-small.xor.xx-large.xx-small`.split(`.`).map(e=>({type:`keyword`,label:e})).concat(`aliceblue.antiquewhite.aqua.aquamarine.azure.beige.bisque.black.blanchedalmond.blue.blueviolet.brown.burlywood.cadetblue.chartreuse.chocolate.coral.cornflowerblue.cornsilk.crimson.cyan.darkblue.darkcyan.darkgoldenrod.darkgray.darkgreen.darkkhaki.darkmagenta.darkolivegreen.darkorange.darkorchid.darkred.darksalmon.darkseagreen.darkslateblue.darkslategray.darkturquoise.darkviolet.deeppink.deepskyblue.dimgray.dodgerblue.firebrick.floralwhite.forestgreen.fuchsia.gainsboro.ghostwhite.gold.goldenrod.gray.grey.green.greenyellow.honeydew.hotpink.indianred.indigo.ivory.khaki.lavender.lavenderblush.lawngreen.lemonchiffon.lightblue.lightcoral.lightcyan.lightgoldenrodyellow.lightgray.lightgreen.lightpink.lightsalmon.lightseagreen.lightskyblue.lightslategray.lightsteelblue.lightyellow.lime.limegreen.linen.magenta.maroon.mediumaquamarine.mediumblue.mediumorchid.mediumpurple.mediumseagreen.mediumslateblue.mediumspringgreen.mediumturquoise.mediumvioletred.midnightblue.mintcream.mistyrose.moccasin.navajowhite.navy.oldlace.olive.olivedrab.orange.orangered.orchid.palegoldenrod.palegreen.paleturquoise.palevioletred.papayawhip.peachpuff.peru.pink.plum.powderblue.purple.rebeccapurple.red.rosybrown.royalblue.saddlebrown.salmon.sandybrown.seagreen.seashell.sienna.silver.skyblue.slateblue.slategray.snow.springgreen.steelblue.tan.teal.thistle.tomato.turquoise.violet.wheat.white.whitesmoke.yellow.yellowgreen`.split(`.`).map(e=>({type:`constant`,label:e}))),ujt=`a.abbr.address.article.aside.b.bdi.bdo.blockquote.body.br.button.canvas.caption.cite.code.col.colgroup.dd.del.details.dfn.dialog.div.dl.dt.em.figcaption.figure.footer.form.header.hgroup.h1.h2.h3.h4.h5.h6.hr.html.i.iframe.img.input.ins.kbd.label.legend.li.main.meter.nav.ol.output.p.pre.ruby.section.select.small.source.span.strong.sub.summary.sup.table.tbody.td.template.textarea.tfoot.th.thead.tr.u.ul`.split(`.`).map(e=>({type:`type`,label:e})),djt=[`@charset`,`@color-profile`,`@container`,`@counter-style`,`@font-face`,`@font-feature-values`,`@font-palette-values`,`@import`,`@keyframes`,`@layer`,`@media`,`@namespace`,`@page`,`@position-try`,`@property`,`@scope`,`@starting-style`,`@supports`,`@view-transition`].map(e=>({type:`keyword`,label:e})),BK=/^(\w[\w-]*|-\w[\w-]*|)$/,fjt=/^-(-[\w-]*)?$/,VK=new aW,pjt=[`Declaration`],mjt=e=>t=>{let{state:n,pos:r}=t,i=NW(n).resolveInner(r,-1),a=i.type.isError&&i.from==i.to-1&&n.doc.sliceString(i.from,i.to)==`-`;if(i.name==`PropertyName`||(a||i.name==`TagName`)&&/^(Block|Styles)$/.test(i.resolve(i.to).name))return{from:i.from,options:IK(),validFor:BK};if(i.name==`ValueName`)return{from:i.from,options:zK,validFor:BK};if(i.name==`PseudoClassName`)return{from:i.from,options:RK,validFor:BK};if(e(i)||(t.explicit||a)&&ojt(i,n.doc))return{from:e(i)||a?i.from:r,options:cjt(n.doc,sjt(i),e),validFor:fjt};if(i.name==`TagName`){for(let{parent:e}=i;e;e=e.parent)if(e.name==`Block`)return{from:i.from,options:IK(),validFor:BK};return{from:i.from,options:ujt,validFor:BK}}if(i.name==`AtKeyword`)return{from:i.from,options:djt,validFor:BK};if(!t.explicit)return null;let o=i.resolve(r),s=o.childBefore(r);return s&&s.name==`:`&&o.name==`PseudoClassSelector`?{from:r,options:RK,validFor:BK}:s&&s.name==`:`&&o.name==`Declaration`||o.name==`ArgList`?{from:r,options:zK,validFor:BK}:o.name==`Block`||o.name==`Styles`?{from:r,options:IK(),validFor:BK}:null},hjt=mjt(e=>e.name==`VariableName`),HK=KW.define({name:`css`,parser:ijt.configure({props:[tG.add({Declaration:FW()}),nG.add({"Block KeyframeList":IW})]}),languageData:{commentTokens:{block:{open:`/*`,close:`*/`}},indentOnInput:/^\s*\}$/,wordChars:`-`}})}));function _jt(e){return e==45||e==46||e==58||e>=65&&e<=90||e==95||e>=97&&e<=122||e>=161}function vjt(e){return e==9||e==10||e==13||e==32}function UK(e,t){let n=e.pos+t;if(sq==n&&oq==e)return aq;let r=e.peek(t);for(;vjt(r);)r=e.peek(++t);let i=``;for(;_jt(r);)i+=String.fromCharCode(r),r=e.peek(++t);return oq=e,sq=n,aq=i?i.toLowerCase():r==Kjt||r==qjt?void 0:null}function yjt(e,t){this.name=e,this.parent=t}function bjt(e){for(;e;e=e.parent)if(e.name==`svg`||e.name==`math`)return!0;return!1}function WK(e,t,n){let r=2+e.length;return new CK(i=>{for(let a=0,o=0,s=0;;s++){if(i.next<0){s&&i.acceptToken(t);break}if(a==0&&i.next==cq||a==1&&i.next==uq||a>=2&&a<r&&i.next==e.charCodeAt(a-2))a++,o++;else if((a==2||a==r)&&vjt(i.next))o++;else if(a==r&&i.next==lq){s>o?i.acceptToken(t,-o):i.acceptToken(n,-(o-2));break}else if((i.next==10||i.next==13)&&s){i.acceptToken(t,1);break}else a=o=0;i.advance()}})}function xjt(e,t){let n=Object.create(null);for(let r of e.getChildren(tq)){let e=r.getChild(Ijt),i=r.getChild(nq)||r.getChild(rq);e&&(n[t.read(e.from,e.to)]=i?i.type.id==nq?t.read(i.from+1,i.to-1):t.read(i.from,i.to):``)}return n}function Sjt(e,t){let n=e.getChild(Fjt);return n?t.read(n.from,n.to):` `}function GK(e,t,n){let r;for(let i of n)if(!i.attrs||i.attrs(r||=xjt(e.node.parent.firstChild,t)))return{parser:i.parser};return null}function Cjt(e=[],t=[]){let n=[],r=[],i=[],a=[];for(let t of e)(t.tag==`script`?n:t.tag==`style`?r:t.tag==`textarea`?i:a).push(t);let o=t.length?Object.create(null):null;for(let e of t)(o[e.name]||(o[e.name]=[])).push(e);return eDt((e,t)=>{let s=e.type.id;if(s==Ljt)return GK(e,t,n);if(s==Rjt)return GK(e,t,r);if(s==zjt)return GK(e,t,i);if(s==eq&&a.length){let n=e.node,r=n.firstChild,i=r&&Sjt(r,t),o;if(i){for(let e of a)if(e.tag==i&&(!e.attrs||e.attrs(o||=xjt(r,t)))){let t=n.lastChild,i=t.type.id==Vjt?t.from:n.to;if(i>r.to)return{parser:e.parser,overlay:[{from:r.to,to:i}]}}}}if(o&&s==tq){let n=e.node,r;if(r=n.firstChild){let e=o[t.read(r.from,r.to)];if(e)for(let r of e){if(r.tagName&&r.tagName!=Sjt(n.parent,t))continue;let e=n.lastChild;if(e.type.id==nq){let t=e.from+1,n=e.lastChild,i=e.to-(n&&n.isError?0:1);if(i>t)return{parser:r.parser,overlay:[{from:t,to:i}]}}else if(e.type.id==rq)return{parser:r.parser,overlay:[{from:e.from,to:e.to}]}}}}return null})}var wjt,Tjt,Ejt,Djt,Ojt,kjt,KK,Ajt,qK,JK,YK,XK,ZK,jjt,Mjt,Njt,QK,Pjt,$K,eq,Fjt,tq,Ijt,nq,rq,Ljt,Rjt,zjt,Bjt,Vjt,Hjt,Ujt,Wjt,Gjt,iq,aq,oq,sq,cq,lq,uq,Kjt,qjt,Jjt,Yjt,Xjt,Zjt,Qjt,$jt,eMt,tMt,nMt,rMt,iMt,aMt=s((()=>{kK(),MW(),dW(),wjt=54,Tjt=1,Ejt=55,Djt=2,Ojt=56,kjt=3,KK=4,Ajt=5,qK=6,JK=7,YK=8,XK=9,ZK=10,jjt=11,Mjt=12,Njt=13,QK=57,Pjt=14,$K=58,eq=20,Fjt=22,tq=23,Ijt=24,nq=26,rq=27,Ljt=28,Rjt=31,zjt=34,Bjt=36,Vjt=37,Hjt=0,Ujt=1,Wjt={area:!0,base:!0,br:!0,col:!0,command:!0,embed:!0,frame:!0,hr:!0,img:!0,input:!0,keygen:!0,link:!0,meta:!0,param:!0,source:!0,track:!0,wbr:!0,menuitem:!0},Gjt={dd:!0,li:!0,optgroup:!0,option:!0,p:!0,rp:!0,rt:!0,tbody:!0,td:!0,tfoot:!0,th:!0,tr:!0},iq={dd:{dd:!0,dt:!0},dt:{dd:!0,dt:!0},li:{li:!0},option:{option:!0,optgroup:!0},optgroup:{optgroup:!0},p:{address:!0,article:!0,aside:!0,blockquote:!0,dir:!0,div:!0,dl:!0,fieldset:!0,footer:!0,form:!0,h1:!0,h2:!0,h3:!0,h4:!0,h5:!0,h6:!0,header:!0,hgroup:!0,hr:!0,menu:!0,nav:!0,ol:!0,p:!0,pre:!0,section:!0,table:!0,ul:!0},rp:{rp:!0,rt:!0},rt:{rp:!0,rt:!0},tbody:{tbody:!0,tfoot:!0},td:{td:!0,th:!0},tfoot:{tbody:!0},th:{td:!0,th:!0},thead:{tbody:!0,tfoot:!0},tr:{tr:!0}},aq=null,oq=null,sq=0,cq=60,lq=62,uq=47,Kjt=63,qjt=33,Jjt=45,Yjt=[qK,ZK,JK,YK,XK],Xjt=new DK({start:null,shift(e,t,n,r){return Yjt.indexOf(t)>-1?new yjt(UK(r,1)||``,e):e},reduce(e,t){return t==eq&&e?e.parent:e},reuse(e,t,n,r){let i=t.type.id;return i==qK||i==Bjt?new yjt(UK(r,1)||``,e):e},strict:!1}),Zjt=new CK((e,t)=>{if(e.next!=cq){e.next<0&&t.context&&e.acceptToken(QK);return}e.advance();let n=e.next==uq;n&&e.advance();let r=UK(e,0);if(r===void 0)return;if(!r)return e.acceptToken(n?Pjt:qK);let i=t.context?t.context.name:null;if(n){if(r==i)return e.acceptToken(jjt);if(i&&Gjt[i])return e.acceptToken(QK,-2);if(t.dialectEnabled(Hjt))return e.acceptToken(Mjt);for(let e=t.context;e;e=e.parent)if(e.name==r)return;e.acceptToken(Njt)}else{if(r==`script`)return e.acceptToken(JK);if(r==`style`)return e.acceptToken(YK);if(r==`textarea`)return e.acceptToken(XK);if(Wjt.hasOwnProperty(r))return e.acceptToken(ZK);i&&iq[i]&&iq[i][r]?e.acceptToken(QK,-1):e.acceptToken(qK)}},{contextual:!0}),Qjt=new CK(e=>{for(let t=0,n=0;;n++){if(e.next<0){n&&e.acceptToken($K);break}if(e.next==Jjt)t++;else if(e.next==lq&&t>=2){n>=3&&e.acceptToken($K,-2);break}else t=0;e.advance()}}),$jt=new CK((e,t)=>{if(e.next==uq&&e.peek(1)==lq){let n=t.dialectEnabled(Ujt)||bjt(t.context);e.acceptToken(n?Ajt:KK,2)}else e.next==lq&&e.acceptToken(KK,1)}),eMt=WK(`script`,wjt,Tjt),tMt=WK(`style`,Ejt,Djt),nMt=WK(`textarea`,Ojt,kjt),rMt=fW({"Text RawText":$.content,"StartTag StartCloseTag SelfClosingEndTag EndTag":$.angleBracket,TagName:$.tagName,"MismatchedCloseTag/TagName":[$.tagName,$.invalid],AttributeName:$.attributeName,"AttributeValue UnquotedAttributeValue":$.attributeValue,Is:$.definitionOperator,"EntityReference CharacterReference":$.character,Comment:$.blockComment,ProcessingInst:$.processingInstruction,DoctypeDecl:$.documentMeta}),iMt=OK.deserialize({version:14,states:",xOVO!rOOO!WQ#tO'#CqO!]Q#tO'#CzO!bQ#tO'#C}O!gQ#tO'#DQO!lQ#tO'#DSO!qOaO'#CpO!|ObO'#CpO#XOdO'#CpO$eO!rO'#CpOOO`'#Cp'#CpO$lO$fO'#DTO$tQ#tO'#DVO$yQ#tO'#DWOOO`'#Dk'#DkOOO`'#DY'#DYQVO!rOOO%OQ&rO,59]O%ZQ&rO,59fO%fQ&rO,59iO%qQ&rO,59lO%|Q&rO,59nOOOa'#D^'#D^O&XOaO'#CxO&dOaO,59[OOOb'#D_'#D_O&lObO'#C{O&wObO,59[OOOd'#D`'#D`O'POdO'#DOO'[OdO,59[OOO`'#Da'#DaO'dO!rO,59[O'kQ#tO'#DROOO`,59[,59[OOOp'#Db'#DbO'pO$fO,59oOOO`,59o,59oO'xQ#|O,59qO'}Q#|O,59rOOO`-E7W-E7WO(SQ&rO'#CsOOQW'#DZ'#DZO(bQ&rO1G.wOOOa1G.w1G.wOOO`1G/Y1G/YO(mQ&rO1G/QOOOb1G/Q1G/QO(xQ&rO1G/TOOOd1G/T1G/TO)TQ&rO1G/WOOO`1G/W1G/WO)`Q&rO1G/YOOOa-E7[-E7[O)kQ#tO'#CyOOO`1G.v1G.vOOOb-E7]-E7]O)pQ#tO'#C|OOOd-E7^-E7^O)uQ#tO'#DPOOO`-E7_-E7_O)zQ#|O,59mOOOp-E7`-E7`OOO`1G/Z1G/ZOOO`1G/]1G/]OOO`1G/^1G/^O*PQ,UO,59_OOQW-E7X-E7XOOOa7+$c7+$cOOO`7+$t7+$tOOOb7+$l7+$lOOOd7+$o7+$oOOO`7+$r7+$rO*[Q#|O,59eO*aQ#|O,59hO*fQ#|O,59kOOO`1G/X1G/XO*kO7[O'#CvO*|OMhO'#CvOOQW1G.y1G.yOOO`1G/P1G/POOO`1G/S1G/SOOO`1G/V1G/VOOOO'#D['#D[O+_O7[O,59bOOQW,59b,59bOOOO'#D]'#D]O+pOMhO,59bOOOO-E7Y-E7YOOQW1G.|1G.|OOOO-E7Z-E7Z",stateData:",]~O!^OS~OUSOVPOWQOXROYTO[]O][O^^O`^Oa^Ob^Oc^Ox^O{_O!dZO~OfaO~OfbO~OfcO~OfdO~OfeO~O!WfOPlP!ZlP~O!XiOQoP!ZoP~O!YlORrP!ZrP~OUSOVPOWQOXROYTOZqO[]O][O^^O`^Oa^Ob^Oc^Ox^O!dZO~O!ZrO~P#dO![sO!euO~OfvO~OfwO~OS|OT}OhyO~OS!POT}OhyO~OS!ROT}OhyO~OS!TOT}OhyO~OS}OT}OhyO~O!WfOPlX!ZlX~OP!WO!Z!XO~O!XiOQoX!ZoX~OQ!ZO!Z!XO~O!YlORrX!ZrX~OR!]O!Z!XO~O!Z!XO~P#dOf!_O~O![sO!e!aO~OS!bO~OS!cO~Oi!dOSgXTgXhgX~OS!fOT!gOhyO~OS!hOT!gOhyO~OS!iOT!gOhyO~OS!jOT!gOhyO~OS!gOT!gOhyO~Of!kO~Of!lO~Of!mO~OS!nO~Ok!qO!`!oO!b!pO~OS!rO~OS!sO~OS!tO~Oa!uOb!uOc!uO!`!wO!a!uO~Oa!xOb!xOc!xO!b!wO!c!xO~Oa!uOb!uOc!uO!`!{O!a!uO~Oa!xOb!xOc!xO!b!{O!c!xO~OT~bac!dx{!d~",goto:"%p!`PPPPPPPPPPPPPPPPPPPP!a!gP!mPP!yP!|#P#S#Y#]#`#f#i#l#r#x!aP!a!aP$O$U$l$r$x%O%U%[%bPPPPPPPP%hX^OX`pXUOX`pezabcde{!O!Q!S!UR!q!dRhUR!XhXVOX`pRkVR!XkXWOX`pRnWR!XnXXOX`pQrXR!XpXYOX`pQ`ORx`Q{aQ!ObQ!QcQ!SdQ!UeZ!e{!O!Q!S!UQ!v!oR!z!vQ!y!pR!|!yQgUR!VgQjVR!YjQmWR![mQpXR!^pQtZR!`tS_O`ToXp",nodeNames:`⚠ StartCloseTag StartCloseTag StartCloseTag EndTag SelfClosingEndTag StartTag StartTag StartTag StartTag StartTag StartCloseTag StartCloseTag StartCloseTag IncompleteCloseTag Document Text EntityReference CharacterReference InvalidEntity Element OpenTag TagName Attribute AttributeName Is AttributeValue UnquotedAttributeValue ScriptText CloseTag OpenTag StyleText CloseTag OpenTag TextareaText CloseTag OpenTag CloseTag SelfClosingTag Comment ProcessingInst MismatchedCloseTag CloseTag DoctypeDecl`,maxTerm:67,context:Xjt,nodeProps:[[`closedBy`,-10,1,2,3,7,8,9,10,11,12,13,`EndTag`,6,`EndTag SelfClosingEndTag`,-4,21,30,33,36,`CloseTag`],[`openedBy`,4,`StartTag StartCloseTag`,5,`StartTag`,-4,29,32,35,37,`OpenTag`],[`group`,-9,14,17,18,19,20,39,40,41,42,`Entity`,16,`Entity TextContent`,-3,28,31,34,`TextContent Entity`],[`isolate`,-11,21,29,30,32,33,35,36,37,38,41,42,`ltr`,-3,26,27,39,``]],propSources:[rMt],skippedNodes:[0],repeatNodeCount:9,tokenData:"!<p!aR!YOX$qXY,QYZ,QZ[$q[]&X]^,Q^p$qpq,Qqr-_rs3_sv-_vw3}wxHYx}-_}!OH{!O!P-_!P!Q$q!Q![-_![!]Mz!]!^-_!^!_!$S!_!`!;x!`!a&X!a!c-_!c!}Mz!}#R-_#R#SMz#S#T1k#T#oMz#o#s-_#s$f$q$f%W-_%W%oMz%o%p-_%p&aMz&a&b-_&b1pMz1p4U-_4U4dMz4d4e-_4e$ISMz$IS$I`-_$I`$IbMz$Ib$Kh-_$Kh%#tMz%#t&/x-_&/x&EtMz&Et&FV-_&FV;'SMz;'S;:j!#|;:j;=`3X<%l?&r-_?&r?AhMz?Ah?BY$q?BY?MnMz?MnO$q!Z$|c`PkW!a`!cpOX$qXZ&XZ[$q[^&X^p$qpq&Xqr$qrs&}sv$qvw+Pwx(tx!^$q!^!_*V!_!a&X!a#S$q#S#T&X#T;'S$q;'S;=`+z<%lO$q!R&bX`P!a`!cpOr&Xrs&}sv&Xwx(tx!^&X!^!_*V!_;'S&X;'S;=`*y<%lO&Xq'UV`P!cpOv&}wx'kx!^&}!^!_(V!_;'S&};'S;=`(n<%lO&}P'pT`POv'kw!^'k!_;'S'k;'S;=`(P<%lO'kP(SP;=`<%l'kp([S!cpOv(Vx;'S(V;'S;=`(h<%lO(Vp(kP;=`<%l(Vq(qP;=`<%l&}a({W`P!a`Or(trs'ksv(tw!^(t!^!_)e!_;'S(t;'S;=`*P<%lO(t`)jT!a`Or)esv)ew;'S)e;'S;=`)y<%lO)e`)|P;=`<%l)ea*SP;=`<%l(t!Q*^V!a`!cpOr*Vrs(Vsv*Vwx)ex;'S*V;'S;=`*s<%lO*V!Q*vP;=`<%l*V!R*|P;=`<%l&XW+UYkWOX+PZ[+P^p+Pqr+Psw+Px!^+P!a#S+P#T;'S+P;'S;=`+t<%lO+PW+wP;=`<%l+P!Z+}P;=`<%l$q!a,]``P!a`!cp!^^OX&XXY,QYZ,QZ]&X]^,Q^p&Xpq,Qqr&Xrs&}sv&Xwx(tx!^&X!^!_*V!_;'S&X;'S;=`*y<%lO&X!_-ljhS`PkW!a`!cpOX$qXZ&XZ[$q[^&X^p$qpq&Xqr-_rs&}sv-_vw/^wx(tx!P-_!P!Q$q!Q!^-_!^!_*V!_!a&X!a#S-_#S#T1k#T#s-_#s$f$q$f;'S-_;'S;=`3X<%l?Ah-_?Ah?BY$q?BY?Mn-_?MnO$q[/ebhSkWOX+PZ[+P^p+Pqr/^sw/^x!P/^!P!Q+P!Q!^/^!a#S/^#S#T0m#T#s/^#s$f+P$f;'S/^;'S;=`1e<%l?Ah/^?Ah?BY+P?BY?Mn/^?MnO+PS0rXhSqr0msw0mx!P0m!Q!^0m!a#s0m$f;'S0m;'S;=`1_<%l?Ah0m?BY?Mn0mS1bP;=`<%l0m[1hP;=`<%l/^!V1vchS`P!a`!cpOq&Xqr1krs&}sv1kvw0mwx(tx!P1k!P!Q&X!Q!^1k!^!_*V!_!a&X!a#s1k#s$f&X$f;'S1k;'S;=`3R<%l?Ah1k?Ah?BY&X?BY?Mn1k?MnO&X!V3UP;=`<%l1k!_3[P;=`<%l-_!Z3hV!`h`P!cpOv&}wx'kx!^&}!^!_(V!_;'S&};'S;=`(n<%lO&}!_4WihSkWc!ROX5uXZ7SZ[5u[^7S^p5uqr8trs7Sst>]tw8twx7Sx!P8t!P!Q5u!Q!]8t!]!^/^!^!a7S!a#S8t#S#T;{#T#s8t#s$f5u$f;'S8t;'S;=`>V<%l?Ah8t?Ah?BY5u?BY?Mn8t?MnO5u!Z5zbkWOX5uXZ7SZ[5u[^7S^p5uqr5urs7Sst+Ptw5uwx7Sx!]5u!]!^7w!^!a7S!a#S5u#S#T7S#T;'S5u;'S;=`8n<%lO5u!R7VVOp7Sqs7St!]7S!]!^7l!^;'S7S;'S;=`7q<%lO7S!R7qOa!R!R7tP;=`<%l7S!Z8OYkWa!ROX+PZ[+P^p+Pqr+Psw+Px!^+P!a#S+P#T;'S+P;'S;=`+t<%lO+P!Z8qP;=`<%l5u!_8{ihSkWOX5uXZ7SZ[5u[^7S^p5uqr8trs7Sst/^tw8twx7Sx!P8t!P!Q5u!Q!]8t!]!^:j!^!a7S!a#S8t#S#T;{#T#s8t#s$f5u$f;'S8t;'S;=`>V<%l?Ah8t?Ah?BY5u?BY?Mn8t?MnO5u!_:sbhSkWa!ROX+PZ[+P^p+Pqr/^sw/^x!P/^!P!Q+P!Q!^/^!a#S/^#S#T0m#T#s/^#s$f+P$f;'S/^;'S;=`1e<%l?Ah/^?Ah?BY+P?BY?Mn/^?MnO+P!V<QchSOp7Sqr;{rs7Sst0mtw;{wx7Sx!P;{!P!Q7S!Q!];{!]!^=]!^!a7S!a#s;{#s$f7S$f;'S;{;'S;=`>P<%l?Ah;{?Ah?BY7S?BY?Mn;{?MnO7S!V=dXhSa!Rqr0msw0mx!P0m!Q!^0m!a#s0m$f;'S0m;'S;=`1_<%l?Ah0m?BY?Mn0m!V>SP;=`<%l;{!_>YP;=`<%l8t!_>dhhSkWOX@OXZAYZ[@O[^AY^p@OqrBwrsAYswBwwxAYx!PBw!P!Q@O!Q!]Bw!]!^/^!^!aAY!a#SBw#S#TE{#T#sBw#s$f@O$f;'SBw;'S;=`HS<%l?AhBw?Ah?BY@O?BY?MnBw?MnO@O!Z@TakWOX@OXZAYZ[@O[^AY^p@Oqr@OrsAYsw@OwxAYx!]@O!]!^Az!^!aAY!a#S@O#S#TAY#T;'S@O;'S;=`Bq<%lO@O!RA]UOpAYq!]AY!]!^Ao!^;'SAY;'S;=`At<%lOAY!RAtOb!R!RAwP;=`<%lAY!ZBRYkWb!ROX+PZ[+P^p+Pqr+Psw+Px!^+P!a#S+P#T;'S+P;'S;=`+t<%lO+P!ZBtP;=`<%l@O!_COhhSkWOX@OXZAYZ[@O[^AY^p@OqrBwrsAYswBwwxAYx!PBw!P!Q@O!Q!]Bw!]!^Dj!^!aAY!a#SBw#S#TE{#T#sBw#s$f@O$f;'SBw;'S;=`HS<%l?AhBw?Ah?BY@O?BY?MnBw?MnO@O!_DsbhSkWb!ROX+PZ[+P^p+Pqr/^sw/^x!P/^!P!Q+P!Q!^/^!a#S/^#S#T0m#T#s/^#s$f+P$f;'S/^;'S;=`1e<%l?Ah/^?Ah?BY+P?BY?Mn/^?MnO+P!VFQbhSOpAYqrE{rsAYswE{wxAYx!PE{!P!QAY!Q!]E{!]!^GY!^!aAY!a#sE{#s$fAY$f;'SE{;'S;=`G|<%l?AhE{?Ah?BYAY?BY?MnE{?MnOAY!VGaXhSb!Rqr0msw0mx!P0m!Q!^0m!a#s0m$f;'S0m;'S;=`1_<%l?Ah0m?BY?Mn0m!VHPP;=`<%lE{!_HVP;=`<%lBw!ZHcW!bx`P!a`Or(trs'ksv(tw!^(t!^!_)e!_;'S(t;'S;=`*P<%lO(t!aIYlhS`PkW!a`!cpOX$qXZ&XZ[$q[^&X^p$qpq&Xqr-_rs&}sv-_vw/^wx(tx}-_}!OKQ!O!P-_!P!Q$q!Q!^-_!^!_*V!_!a&X!a#S-_#S#T1k#T#s-_#s$f$q$f;'S-_;'S;=`3X<%l?Ah-_?Ah?BY$q?BY?Mn-_?MnO$q!aK_khS`PkW!a`!cpOX$qXZ&XZ[$q[^&X^p$qpq&Xqr-_rs&}sv-_vw/^wx(tx!P-_!P!Q$q!Q!^-_!^!_*V!_!`&X!`!aMS!a#S-_#S#T1k#T#s-_#s$f$q$f;'S-_;'S;=`3X<%l?Ah-_?Ah?BY$q?BY?Mn-_?MnO$q!TM_X`P!a`!cp!eQOr&Xrs&}sv&Xwx(tx!^&X!^!_*V!_;'S&X;'S;=`*y<%lO&X!aNZ!ZhSfQ`PkW!a`!cpOX$qXZ&XZ[$q[^&X^p$qpq&Xqr-_rs&}sv-_vw/^wx(tx}-_}!OMz!O!PMz!P!Q$q!Q![Mz![!]Mz!]!^-_!^!_*V!_!a&X!a!c-_!c!}Mz!}#R-_#R#SMz#S#T1k#T#oMz#o#s-_#s$f$q$f$}-_$}%OMz%O%W-_%W%oMz%o%p-_%p&aMz&a&b-_&b1pMz1p4UMz4U4dMz4d4e-_4e$ISMz$IS$I`-_$I`$IbMz$Ib$Je-_$Je$JgMz$Jg$Kh-_$Kh%#tMz%#t&/x-_&/x&EtMz&Et&FV-_&FV;'SMz;'S;:j!#|;:j;=`3X<%l?&r-_?&r?AhMz?Ah?BY$q?BY?MnMz?MnO$q!a!$PP;=`<%lMz!R!$ZY!a`!cpOq*Vqr!$yrs(Vsv*Vwx)ex!a*V!a!b!4t!b;'S*V;'S;=`*s<%lO*V!R!%Q]!a`!cpOr*Vrs(Vsv*Vwx)ex}*V}!O!%y!O!f*V!f!g!']!g#W*V#W#X!0`#X;'S*V;'S;=`*s<%lO*V!R!&QX!a`!cpOr*Vrs(Vsv*Vwx)ex}*V}!O!&m!O;'S*V;'S;=`*s<%lO*V!R!&vV!a`!cp!dPOr*Vrs(Vsv*Vwx)ex;'S*V;'S;=`*s<%lO*V!R!'dX!a`!cpOr*Vrs(Vsv*Vwx)ex!q*V!q!r!(P!r;'S*V;'S;=`*s<%lO*V!R!(WX!a`!cpOr*Vrs(Vsv*Vwx)ex!e*V!e!f!(s!f;'S*V;'S;=`*s<%lO*V!R!(zX!a`!cpOr*Vrs(Vsv*Vwx)ex!v*V!v!w!)g!w;'S*V;'S;=`*s<%lO*V!R!)nX!a`!cpOr*Vrs(Vsv*Vwx)ex!{*V!{!|!*Z!|;'S*V;'S;=`*s<%lO*V!R!*bX!a`!cpOr*Vrs(Vsv*Vwx)ex!r*V!r!s!*}!s;'S*V;'S;=`*s<%lO*V!R!+UX!a`!cpOr*Vrs(Vsv*Vwx)ex!g*V!g!h!+q!h;'S*V;'S;=`*s<%lO*V!R!+xY!a`!cpOr!+qrs!,hsv!+qvw!-Swx!.[x!`!+q!`!a!/j!a;'S!+q;'S;=`!0Y<%lO!+qq!,mV!cpOv!,hvx!-Sx!`!,h!`!a!-q!a;'S!,h;'S;=`!.U<%lO!,hP!-VTO!`!-S!`!a!-f!a;'S!-S;'S;=`!-k<%lO!-SP!-kO{PP!-nP;=`<%l!-Sq!-xS!cp{POv(Vx;'S(V;'S;=`(h<%lO(Vq!.XP;=`<%l!,ha!.aX!a`Or!.[rs!-Ssv!.[vw!-Sw!`!.[!`!a!.|!a;'S!.[;'S;=`!/d<%lO!.[a!/TT!a`{POr)esv)ew;'S)e;'S;=`)y<%lO)ea!/gP;=`<%l!.[!R!/sV!a`!cp{POr*Vrs(Vsv*Vwx)ex;'S*V;'S;=`*s<%lO*V!R!0]P;=`<%l!+q!R!0gX!a`!cpOr*Vrs(Vsv*Vwx)ex#c*V#c#d!1S#d;'S*V;'S;=`*s<%lO*V!R!1ZX!a`!cpOr*Vrs(Vsv*Vwx)ex#V*V#V#W!1v#W;'S*V;'S;=`*s<%lO*V!R!1}X!a`!cpOr*Vrs(Vsv*Vwx)ex#h*V#h#i!2j#i;'S*V;'S;=`*s<%lO*V!R!2qX!a`!cpOr*Vrs(Vsv*Vwx)ex#m*V#m#n!3^#n;'S*V;'S;=`*s<%lO*V!R!3eX!a`!cpOr*Vrs(Vsv*Vwx)ex#d*V#d#e!4Q#e;'S*V;'S;=`*s<%lO*V!R!4XX!a`!cpOr*Vrs(Vsv*Vwx)ex#X*V#X#Y!+q#Y;'S*V;'S;=`*s<%lO*V!R!4{Y!a`!cpOr!4trs!5ksv!4tvw!6Vwx!8]x!a!4t!a!b!:]!b;'S!4t;'S;=`!;r<%lO!4tq!5pV!cpOv!5kvx!6Vx!a!5k!a!b!7W!b;'S!5k;'S;=`!8V<%lO!5kP!6YTO!a!6V!a!b!6i!b;'S!6V;'S;=`!7Q<%lO!6VP!6lTO!`!6V!`!a!6{!a;'S!6V;'S;=`!7Q<%lO!6VP!7QOxPP!7TP;=`<%l!6Vq!7]V!cpOv!5kvx!6Vx!`!5k!`!a!7r!a;'S!5k;'S;=`!8V<%lO!5kq!7yS!cpxPOv(Vx;'S(V;'S;=`(h<%lO(Vq!8YP;=`<%l!5ka!8bX!a`Or!8]rs!6Vsv!8]vw!6Vw!a!8]!a!b!8}!b;'S!8];'S;=`!:V<%lO!8]a!9SX!a`Or!8]rs!6Vsv!8]vw!6Vw!`!8]!`!a!9o!a;'S!8];'S;=`!:V<%lO!8]a!9vT!a`xPOr)esv)ew;'S)e;'S;=`)y<%lO)ea!:YP;=`<%l!8]!R!:dY!a`!cpOr!4trs!5ksv!4tvw!6Vwx!8]x!`!4t!`!a!;S!a;'S!4t;'S;=`!;r<%lO!4t!R!;]V!a`!cpxPOr*Vrs(Vsv*Vwx)ex;'S*V;'S;=`*s<%lO*V!R!;uP;=`<%l!4t!V!<TXiS`P!a`!cpOr&Xrs&}sv&Xwx(tx!^&X!^!_*V!_;'S&X;'S;=`*y<%lO&X",tokenizers:[eMt,tMt,nMt,$jt,Zjt,Qjt,0,1,2,3,4,5],topRules:{Document:[0,15]},dialects:{noMatch:0,selfClosing:509},tokenPrec:511})}));function dq(e,t){return e>=65&&e<=90||e>=97&&e<=122||e==95||e>=192||!t&&e>=48&&e<=57}var oMt,fq,sMt,cMt,lMt,uMt,dMt,fMt,pMt,mMt,hMt,pq,mq,gMt,hq,_Mt,vMt,yMt,bMt,xMt,SMt,CMt,wMt,TMt,EMt,DMt,OMt,kMt,AMt,jMt,MMt,NMt,PMt=s((()=>{kK(),MW(),oMt=312,fq=1,sMt=2,cMt=3,lMt=4,uMt=313,dMt=315,fMt=316,pMt=5,mMt=6,hMt=0,pq=[9,10,11,12,13,32,133,160,5760,8192,8193,8194,8195,8196,8197,8198,8199,8200,8201,8202,8232,8233,8239,8287,12288],mq=125,gMt=59,hq=47,_Mt=42,vMt=43,yMt=45,bMt=60,xMt=44,SMt=63,CMt=46,wMt=new DK({start:!1,shift(e,t){return t==pMt||t==mMt||t==dMt?e:t==fMt},strict:!1}),TMt=new CK((e,t)=>{let{next:n}=e;(n==mq||n==-1||t.context)&&e.acceptToken(uMt)},{contextual:!0,fallback:!0}),EMt=new CK((e,t)=>{let{next:n}=e,r;pq.indexOf(n)>-1||n==hq&&((r=e.peek(1))==hq||r==_Mt)||n!=mq&&n!=gMt&&n!=-1&&!t.context&&e.acceptToken(oMt)},{contextual:!0}),DMt=new CK((e,t)=>{let{next:n}=e;if(n==vMt||n==yMt){if(e.advance(),n==e.next){e.advance();let n=!t.context&&t.canShift(fq);e.acceptToken(n?fq:sMt)}}else n==SMt&&e.peek(1)==CMt&&(e.advance(),e.advance(),(e.next<48||e.next>57)&&e.acceptToken(cMt))},{contextual:!0}),OMt=new CK((e,t)=>{if(e.next!=bMt||!t.dialectEnabled(hMt)||(e.advance(),e.next==hq))return;let n=0;for(;pq.indexOf(e.next)>-1;)e.advance(),n++;if(dq(e.next,!0)){for(e.advance(),n++;dq(e.next,!1);)e.advance(),n++;for(;pq.indexOf(e.next)>-1;)e.advance(),n++;if(e.next==xMt)return;for(let t=0;;t++){if(t==7){if(!dq(e.next,!0))return;break}if(e.next!=`extends`.charCodeAt(t))break;e.advance(),n++}}e.acceptToken(lMt,-n)}),kMt=fW({"get set async static":$.modifier,"for while do if else switch try catch finally return throw break continue default case":$.controlKeyword,"in of await yield void typeof delete instanceof":$.operatorKeyword,"let var const using function class extends":$.definitionKeyword,"import export from":$.moduleKeyword,"with debugger as new":$.keyword,TemplateString:$.special($.string),super:$.atom,BooleanLiteral:$.bool,this:$.self,null:$.null,Star:$.modifier,VariableName:$.variableName,"CallExpression/VariableName TaggedTemplateExpression/VariableName":$.function($.variableName),VariableDefinition:$.definition($.variableName),Label:$.labelName,PropertyName:$.propertyName,PrivatePropertyName:$.special($.propertyName),"CallExpression/MemberExpression/PropertyName":$.function($.propertyName),"FunctionDeclaration/VariableDefinition":$.function($.definition($.variableName)),"ClassDeclaration/VariableDefinition":$.definition($.className),PropertyDefinition:$.definition($.propertyName),PrivatePropertyDefinition:$.definition($.special($.propertyName)),UpdateOp:$.updateOperator,"LineComment Hashbang":$.lineComment,BlockComment:$.blockComment,Number:$.number,String:$.string,Escape:$.escape,ArithOp:$.arithmeticOperator,LogicOp:$.logicOperator,BitOp:$.bitwiseOperator,CompareOp:$.compareOperator,RegExp:$.regexp,Equals:$.definitionOperator,Arrow:$.function($.punctuation),": Spread":$.punctuation,"( )":$.paren,"[ ]":$.squareBracket,"{ }":$.brace,"InterpolationStart InterpolationEnd":$.special($.brace),".":$.derefOperator,", ;":$.separator,"@":$.meta,TypeName:$.typeName,TypeDefinition:$.definition($.typeName),"type enum interface implements namespace module declare":$.definitionKeyword,"abstract global Privacy readonly override":$.modifier,"is keyof unique infer":$.operatorKeyword,JSXAttributeValue:$.attributeValue,JSXText:$.content,"JSXStartTag JSXStartCloseTag JSXSelfCloseEndTag JSXEndTag":$.angleBracket,"JSXIdentifier JSXNameSpacedName":$.tagName,"JSXAttribute/JSXIdentifier JSXAttribute/JSXNameSpacedName":$.attributeName,"JSXBuiltin/JSXIdentifier":$.standard($.tagName)}),AMt={__proto__:null,export:20,as:25,from:33,default:36,async:41,function:42,extends:54,this:58,true:66,false:66,null:78,void:82,typeof:86,super:102,new:136,delete:148,yield:157,await:161,class:166,public:229,private:229,protected:229,readonly:231,instanceof:250,satisfies:253,in:254,const:256,import:290,keyof:345,unique:349,infer:355,is:391,abstract:411,implements:413,type:415,let:418,var:420,using:423,interface:429,enum:433,namespace:439,module:441,declare:445,global:449,for:468,of:477,while:480,with:484,do:488,if:492,else:494,switch:498,case:504,try:510,catch:514,finally:518,return:522,throw:526,break:530,continue:534,debugger:538},jMt={__proto__:null,async:123,get:125,set:127,declare:189,public:191,private:191,protected:191,static:193,abstract:195,override:197,readonly:203,accessor:205,new:395},MMt={__proto__:null,"<":187},NMt=OK.deserialize({version:14,states:"$@QO%TQ^OOO%[Q^OOO'_Q`OOP(lOWOOO*zQ?NdO'#CiO+RO!bO'#CjO+aO#tO'#CjO+oO!0LbO'#D^O.QQ^O'#DdO.bQ^O'#DoO%[Q^O'#DwO0fQ^O'#EPOOQ?Mr'#EX'#EXO1PQWO'#EUOOQO'#Em'#EmOOQO'#Ih'#IhO1XQWO'#GpO1dQWO'#ElO1iQWO'#ElO3hQ?NdO'#JmO6[Q?NdO'#JnO6uQWO'#F[O6zQ&jO'#FsOOQ?Mr'#Fe'#FeO7VO,YO'#FeO7eQ7[O'#FzO9RQWO'#FyOOQ?Mr'#Jn'#JnOOQ?Mp'#Jm'#JmO9WQWO'#GtOOQU'#KZ'#KZO9cQWO'#IUO9hQ?MxO'#IVOOQU'#JZ'#JZOOQU'#IZ'#IZQ`Q^OOO`Q^OOO9pQMnO'#DsO9wQ^O'#D{O:OQ^O'#D}O9^QWO'#GpO:VQ7[O'#CoO:eQWO'#EkO:pQWO'#EvO:uQ7[O'#FdO;dQWO'#GpOOQO'#K['#K[O;iQWO'#K[O;wQWO'#GxO;wQWO'#GyO;wQWO'#G{O9^QWO'#HOO<nQWO'#HRO>VQWO'#CeO>gQWO'#H_O>oQWO'#HeO>oQWO'#HgO`Q^O'#HiO>oQWO'#HkO>oQWO'#HnO>tQWO'#HtO>yQ?MyO'#HzO%[Q^O'#H|O?UQ?MyO'#IOO?aQ?MyO'#IQO9hQ?MxO'#ISO?lQ?NdO'#CiO@nQ`O'#DiQOQWOOO%[Q^O'#D}OAUQWO'#EQO:VQ7[O'#EkOAaQWO'#EkOAlQpO'#FdOOQU'#Cg'#CgOOQ?Mp'#Dn'#DnOOQ?Mp'#Jq'#JqO%[Q^O'#JqOOQO'#Jt'#JtOOQO'#Id'#IdOBlQ`O'#EdOOQ?Mp'#Ec'#EcOOQ?Mp'#Jx'#JxOChQ?NQO'#EdOCrQ`O'#ETOOQO'#Js'#JsODWQ`O'#JtOEeQ`O'#ETOCrQ`O'#EdPErO#@ItO'#CbPOOO)CDx)CDxOOOO'#I['#I[OE}O!bO,59UOOQ?Mr,59U,59UOOOO'#I]'#I]OF]O#tO,59UO%[Q^O'#D`OOOO'#I_'#I_OFkO!0LbO,59xOOQ?Mr,59x,59xOFyQ^O'#I`OG^QWO'#JoOI]QrO'#JoO+}Q^O'#JoOIdQWO,5:OOIzQWO'#EmOJXQWO'#KOOJdQWO'#J}OJdQWO'#J}OJlQWO,5;ZOJqQWO'#J|OOQ?Mv,5:Z,5:ZOJxQ^O,5:ZOLvQ?NdO,5:cOMgQWO,5:kONQQ?MxO'#J{ONXQWO'#JzO9WQWO'#JzONmQWO'#JzONuQWO,5;YONzQWO'#JzO!#PQrO'#JnOOQ?Mr'#Ci'#CiO%[Q^O'#EPO!#oQrO,5:pOOQQ'#Ju'#JuOOQO-E<f-E<fO9^QWO,5=[O!$VQWO,5=[O!$[Q^O,5;WO!&_Q7[O'#EhO!'xQWO,5;WO!'}Q^O'#DvO!(XQ`O,5;aO!(aQ`O,5;aO%[Q^O,5;aOOQU'#FS'#FSOOQU'#FU'#FUO%[Q^O,5;bO%[Q^O,5;bO%[Q^O,5;bO%[Q^O,5;bO%[Q^O,5;bO%[Q^O,5;bO%[Q^O,5;bO%[Q^O,5;bO%[Q^O,5;bO%[Q^O,5;bOOQU'#FY'#FYO!(oQ^O,5;sOOQ?Mr,5;x,5;xOOQ?Mr,5;y,5;yOOQ?Mr,5;{,5;{O%[Q^O'#IlO!*rQ?MxO,5<gO%[Q^O,5;bO!&_Q7[O,5;bO!+aQ7[O,5;bO!-RQ7[O'#EZO%[Q^O,5;vOOQ?Mr,5;z,5;zO!-YQ&jO'#FiO!.VQ&jO'#KSO!-qQ&jO'#KSO!.^Q&jO'#KSOOQO'#KS'#KSO!.rQ&jO,5<ROOOS,5<_,5<_O!/TQ^O'#FuOOOS'#Ik'#IkO7VO,YO,5<PO!/[Q&jO'#FwOOQ?Mr,5<P,5<PO!/{Q!LQO'#CvOOQ?Mr'#Cz'#CzO!0`O!0LbO'#DOO!0|Q7[O,5<dO!1TQWO,5<fO!2pQ$ISO'#GVO!2}QWO'#GWO!3SQWO'#GWO!4rQ$ISO'#G[O!5nQ`O'#G`OOQO'#Gk'#GkO!+hQ7[O'#GjOOQO'#Gm'#GmO!+hQ7[O'#GlO!6aQ!LQO'#JgOOQ?Mr'#Jg'#JgO!6kQWO'#JfO!6yQWO'#JeO!7RQWO'#CuOOQ?Mr'#Cx'#CxO!7ZQWO'#CzOOQ?Mr'#DS'#DSOOQ?Mr'#DU'#DUO1SQWO'#DWO!+hQ7[O'#F}O!+hQ7[O'#GPO!7`QWO'#GRO!7eQWO'#GSO!3SQWO'#GYO!+hQ7[O'#G_O!7jQWO'#EnO!8XQWO,5<eOOQ?Mp'#Cr'#CrO!8aQWO'#EoO!9ZQ`O'#EpOOQ?Mp'#J|'#J|O!9bQ?MxO'#K]O9hQ?MxO,5=`O`Q^O,5>pOOQU'#Jc'#JcOOQU,5>q,5>qOOQU-E<X-E<XO!;aQ?NdO,5:_O!9UQ`O,5:]O!=zQ?NdO,5:gO%[Q^O,5:gO!@bQ?NdO,5:iOOQO,5@v,5@vO!ARQ7[O,5=[O!AaQ?MxO'#JdO9RQWO'#JdO!ArQ?MxO,59ZO!A}Q`O,59ZO!BVQ7[O,59ZO:VQ7[O,59ZO!BbQWO,5;WO!BjQWO'#H^O!COQWO'#K`O%[Q^O,5;|O!9UQ`O,5<OO!CWQWO,5=wO!C]QWO,5=wO!CbQWO,5=wO9hQ?MxO,5=wO;wQWO,5=gOOQO'#Cv'#CvO!CpQ`O,5=dO!CxQ7[O,5=eO!DTQWO,5=gO!DYQpO,5=jO!DbQWO'#K[O>tQWO'#HTO9^QWO'#HVO!DgQWO'#HVO:VQ7[O'#HXO!DlQWO'#HXOOQU,5=m,5=mO!DqQWO'#HYO!ESQWO'#CoO!EXQWO,59PO!EcQWO,59PO!GhQ^O,59POOQU,59P,59PO!GxQ?MxO,59PO%[Q^O,59PO!JTQ^O'#HaOOQU'#Hb'#HbOOQU'#Hc'#HcO`Q^O,5=yO!JkQWO,5=yO`Q^O,5>PO`Q^O,5>RO!JpQWO,5>TO`Q^O,5>VO!JuQWO,5>YO!JzQ^O,5>`OOQU,5>f,5>fO%[Q^O,5>fO9hQ?MxO,5>hOOQU,5>j,5>jO# UQWO,5>jOOQU,5>l,5>lO# UQWO,5>lOOQU,5>n,5>nO# rQ`O'#D[O%[Q^O'#JqO# |Q`O'#JqO#!kQ`O'#DjO#!|Q`O'#DjO#%_Q^O'#DjO#%fQWO'#JpO#%nQWO,5:TO#%sQWO'#EqO#&RQWO'#KPO#&ZQWO,5;[O#&`Q`O'#DjO#&mQ`O'#ESOOQ?Mr,5:l,5:lO%[Q^O,5:lO#&tQWO,5:lO>tQWO,5;VO!A}Q`O,5;VO!BVQ7[O,5;VO:VQ7[O,5;VO#&|QWO,5@]O#'RQ(CYO,5:pOOQO-E<b-E<bO#(XQ?NQO,5;OOCrQ`O,5:oO#(cQ`O,5:oOCrQ`O,5;OO!ArQ?MxO,5:oOOQ?Mp'#Eg'#EgOOQO,5;O,5;OO%[Q^O,5;OO#(pQ?MxO,5;OO#({Q?MxO,5;OO!A}Q`O,5:oOOQO,5;U,5;UO#)ZQ?MxO,5;OPOOO'#IY'#IYP#)oO#@ItO,58|POOO,58|,58|OOOO-E<Y-E<YOOQ?Mr1G.p1G.pOOOO-E<Z-E<ZO#)zQpO,59zOOOO-E<]-E<]OOQ?Mr1G/d1G/dO#*PQrO,5>zO+}Q^O,5>zOOQO,5?Q,5?QO#*ZQ^O'#I`OOQO-E<^-E<^O#*hQWO,5@ZO#*pQrO,5@ZO#*wQWO,5@iOOQ?Mr1G/j1G/jO%[Q^O,5@jO#+PQWO'#IfOOQO-E<d-E<dO#*wQWO,5@iOOQ?Mp1G0u1G0uOOQ?Mv1G/u1G/uOOQ?Mv1G0V1G0VO%[Q^O,5@gO#+eQ?MxO,5@gO#+vQ?MxO,5@gO#+}QWO,5@fO9WQWO,5@fO#,VQWO,5@fO#,eQWO'#IiO#+}QWO,5@fOOQ?Mp1G0t1G0tO!(XQ`O,5:rO!(dQ`O,5:rOOQQ,5:t,5:tO#-VQYO,5:tO#-_Q7[O1G2vO9^QWO1G2vOOQ?Mr1G0r1G0rO#-mQ?NdO1G0rO#.rQ?NbO,5;SOOQ?Mr'#GU'#GUO#/`Q?NdO'#JgO!$[Q^O1G0rO#1hQrO'#JrO%[Q^O'#JrO#1rQWO,5:bOOQ?Mr'#D['#D[OOQ?Mr1G0{1G0{O%[Q^O1G0{OOQ?Mr1G1e1G1eO#1wQWO1G0{O#4]Q?NdO1G0|O#4dQ?NdO1G0|O#6zQ?NdO1G0|O#7RQ?NdO1G0|O#9iQ?NdO1G0|O#<PQ?NdO1G0|O#<WQ?NdO1G0|O#<_Q?NdO1G0|O#>uQ?NdO1G0|O#>|Q?NdO1G0|O#AZQ07bO'#CiO#CUQ07bO1G1_O#C]Q07bO'#JnO#CpQ?NdO,5?WOOQ?Mp-E<j-E<jO#E}Q?NdO1G0|O#FzQ?NdO1G0|OOQ?Mr1G0|1G0|O#GzQ7[O'#JwO#HUQWO,5:uO#HZQ?NdO1G1bO#H}Q&jO,5<VO#IVQ&jO,5<WO#I_Q&jO'#FnO#IvQWO'#FmOOQO'#KT'#KTOOQO'#Ij'#IjO#I{Q&jO1G1mOOQ?Mr1G1m1G1mOOOS1G1x1G1xO#J^Q07bO'#JmO#JhQWO,5<aO!(oQ^O,5<aOOOS-E<i-E<iOOQ?Mr1G1k1G1kO#JmQ`O'#KSOOQ?Mr,5<c,5<cO#JuQ`O,5<cO!&_Q7[O'#DQOOOO'#I^'#I^O#JzO!0LbO,59jOOQ?Mr,59j,59jO%[Q^O1G2OO!7eQWO'#InO#KVQ7[O,5<xOOQ?Mr,5<u,5<uO!+hQ7[O'#IqO#KuQ7[O,5=UO!+hQ7[O'#IsO#LhQ7[O,5=WO!&_Q7[O,5=YOOQO1G2Q1G2QO#LrQpO'#CrO#MVQ$ISO'#EoO#NUQ`O'#G`O#NrQpO,5<qO#NyQWO'#KWO9WQWO'#KWO$ XQWO,5<sO!+hQ7[O,5<rO$ ^QWO'#GXO$ oQWO,5<rO$ tQpO'#GUO$!RQpO'#KXO$!]QWO'#KXO!&_Q7[O'#KXO$!bQWO,5<vO$!gQ`O'#GaO!5iQ`O'#GaO$!xQWO'#GcO$!}QWO'#GeO!3SQWO'#GhO$#SQ?MxO'#IpO$#_Q`O,5<zOOQ?Mv,5<z,5<zO$#fQ`O'#GaO$#tQ`O'#GbO$#|Q`O'#GbO$$RQ7[O,5=UO$$cQ7[O,5=WOOQ?Mr,5=Z,5=ZO!+hQ7[O,5@QO!+hQ7[O,5@QO$$sQWO'#IuO$%OQWO,5@PO$%WQWO,59aOOQ?Mr,59f,59fO$%zQ!LSO,59rOOQ?Mr'#Jk'#JkO$&mQ7[O,5<iO$'`Q7[O,5<kO@fQWO,5<mOOQ?Mr,5<n,5<nO$'jQWO,5<tO$'oQ7[O,5<yO$(PQWO'#JzO!$[Q^O1G2PO$(UQWO1G2PO9WQWO'#J}O9WQWO'#EqO%[Q^O'#EqO9WQWO'#IwO$(ZQ?MxO,5@wOOQU1G2z1G2zOOQU1G4[1G4[OOQ?Mr1G/y1G/yOOQ?Mr1G/w1G/wO$*]Q?NdO1G0ROOQU1G2v1G2vO!&_Q7[O1G2vO%[Q^O1G2vO#-bQWO1G2vO$,aQ7[O'#EhOOQ?Mp,5@O,5@OO$,kQ?MxO,5@OOOQU1G.u1G.uO!ArQ?MxO1G.uO!A}Q`O1G.uO!BVQ7[O1G.uO$,|QWO1G0rO$-RQWO'#CiO$-^QWO'#KaO$-fQWO,5=xO$-kQWO'#KaO$-pQWO'#KaO$.OQWO'#I}O$.^QWO,5@zO$.fQrO1G1hOOQ?Mr1G1j1G1jO9^QWO1G3cO@fQWO1G3cO$.mQWO1G3cO$.rQWO1G3cOOQU1G3c1G3cO!DTQWO1G3RO!&_Q7[O1G3OO$.wQWO1G3OOOQU1G3P1G3PO!&_Q7[O1G3PO$.|QWO1G3PO$/UQ`O'#G}OOQU1G3R1G3RO!5iQ`O'#IyO!DYQpO1G3UOOQU1G3U1G3UOOQU,5=o,5=oO$/^Q7[O,5=qO9^QWO,5=qO$!}QWO,5=sO9RQWO,5=sO!A}Q`O,5=sO!BVQ7[O,5=sO:VQ7[O,5=sO$/lQWO'#K_O$/wQWO,5=tOOQU1G.k1G.kO$/|Q?MxO1G.kO@fQWO1G.kO$0XQWO1G.kO9hQ?MxO1G.kO$2aQrO,5@|O$2nQWO,5@|O9WQWO,5@|O$2yQ^O,5={O$3QQWO,5={OOQU1G3e1G3eO`Q^O1G3eOOQU1G3k1G3kOOQU1G3m1G3mO>oQWO1G3oO$3VQ^O1G3qO$7ZQ^O'#HpOOQU1G3t1G3tO$7hQWO'#HvO>tQWO'#HxOOQU1G3z1G3zO$7pQ^O1G3zO9hQ?MxO1G4QOOQU1G4S1G4SOOQ?Mp'#G]'#G]O9hQ?MxO1G4UO9hQ?MxO1G4WO$;wQWO,5@]O!(oQ^O,5;]O9WQWO,5;]O>tQWO,5:UO!(oQ^O,5:UO!A}Q`O,5:UO$;|Q07bO,5:UOOQO,5;],5;]O$<WQ`O'#IaO$<nQWO,5@[OOQ?Mr1G/o1G/oO$<vQ`O'#IgO$=QQWO,5@kOOQ?Mp1G0v1G0vO#!|Q`O,5:UOOQO'#Ic'#IcO$=YQ`O,5:nOOQ?Mv,5:n,5:nO#&wQWO1G0WOOQ?Mr1G0W1G0WO%[Q^O1G0WOOQ?Mr1G0q1G0qO>tQWO1G0qO!A}Q`O1G0qO!BVQ7[O1G0qOOQ?Mp1G5w1G5wO!ArQ?MxO1G0ZOOQO1G0j1G0jO%[Q^O1G0jO$=aQ?MxO1G0jO$=lQ?MxO1G0jO!A}Q`O1G0ZOCrQ`O1G0ZO$=zQ?MxO1G0jOOQO1G0Z1G0ZO$>`Q?NdO1G0jPOOO-E<W-E<WPOOO1G.h1G.hOOOO1G/f1G/fO$>jQpO,5<gO$>rQrO1G4fOOQO1G4l1G4lO%[Q^O,5>zO$>|QWO1G5uO$?UQWO1G6TO$?^QrO1G6UO9WQWO,5?QO$?hQ?NdO1G6RO%[Q^O1G6RO$?xQ?MxO1G6RO$@ZQWO1G6QO$@ZQWO1G6QO9WQWO1G6QO$@cQWO,5?TO9WQWO,5?TOOQO,5?T,5?TO$@wQWO,5?TO$(PQWO,5?TOOQO-E<g-E<gOOQQ1G0^1G0^OOQQ1G0`1G0`O#-YQWO1G0`OOQU7+(b7+(bO!&_Q7[O7+(bO%[Q^O7+(bO$AVQWO7+(bO$AbQ7[O7+(bO$ApQ?NdO,5=UO$CxQ?NdO,5=WO$FQQ?NdO,5=UO$H`Q?NdO,5=WO$JnQ?NdO,59rO$LsQ?NdO,5<iO$N{Q?NdO,5<kO%#TQ?NdO,5<yOOQ?Mr7+&^7+&^O%%cQ?NdO7+&^O%&VQ^O'#IbO%&dQWO,5@^O%&lQrO,5@^OOQ?Mr1G/|1G/|O%&vQWO7+&gOOQ?Mr7+&g7+&gO%&{Q07bO,5:cO%[Q^O7+&yO%'VQ07bO,5:_O%'dQ07bO,5:gO%'nQ07bO,5:iO%'xQ7[O'#IeO%(SQWO,5@cOOQ?Mr1G0a1G0aOOQO1G1q1G1qOOQO1G1r1G1rO%([QtO,5<YO!(oQ^O,5<XOOQO-E<h-E<hOOQ?Mr7+'X7+'XOOOS7+'d7+'dOOOS1G1{1G1{O%(gQWO1G1{OOQ?Mr1G1}1G1}O%(lQpO,59lOOOO-E<[-E<[OOQ?Mr1G/U1G/UO%(sQ?NdO7+'jOOQ?Mr,5?Y,5?YO%)gQpO,5?YOOQ?Mr1G2d1G2dP!&_Q7[O'#InPOQ?Mr-E<l-E<lO%*VQ7[O,5?]OOQ?Mr-E<o-E<oO%*xQ7[O,5?_OOQ?Mr-E<q-E<qO%+SQpO1G2tO%+ZQpO'#CrO%+qQ7[O'#J}O%+xQ^O'#EqOOQ?Mr1G2]1G2]O%,SQWO'#ImO%,hQWO,5@rO%,hQWO,5@rO%,pQWO,5@rO%,{QWO,5@rOOQO1G2_1G2_O%-ZQ7[O1G2^O!+hQ7[O1G2^O%-kQ$ISO'#IoO%-xQWO,5@sO!&_Q7[O,5@sO%.QQpO,5@sOOQ?Mr1G2b1G2bOOQ?Mp,5<{,5<{OOQ?Mp,5<|,5<|O$(PQWO,5<|OCcQWO,5<|O!A}Q`O,5<{OOQO'#Gd'#GdO%.[QWO,5<}OOQ?Mp,5=P,5=PO$(PQWO,5=SOOQO,5?[,5?[OOQO-E<n-E<nOOQ?Mv1G2f1G2fO!5iQ`O,5<{O%.dQWO,5<|O$!xQWO,5<}O%.oQ`O,5<|O!+hQ7[O'#IqO%/`Q7[O1G2pO!+hQ7[O'#IsO%0RQ7[O1G2rO%0]Q7[O1G5lO%0gQ7[O1G5lOOQO,5?a,5?aOOQO-E<s-E<sOOQO1G.{1G.{O!9UQ`O,59tO%[Q^O,59tOOQ?Mr,5<h,5<hO%0tQWO1G2XO!+hQ7[O1G2`O%0yQ?NdO7+'kOOQ?Mr7+'k7+'kO!$[Q^O7+'kO%1mQWO,5;]OOQ?Mp,5?c,5?cOOQ?Mp-E<u-E<uO%1rQpO'#KYO#&wQWO7+(bO4UQrO7+(bO$AYQWO7+(bO%1|Q?NbO'#CiO%2aQ?NbO,5=QO%3RQWO,5=QOOQ?Mp1G5j1G5jOOQU7+$a7+$aO!ArQ?MxO7+$aO!A}Q`O7+$aO!$[Q^O7+&^O%3WQWO'#I|O%3oQWO,5@{OOQO1G3d1G3dO9^QWO,5@{O%3oQWO,5@{O%3wQWO,5@{OOQO,5?i,5?iOOQO-E<{-E<{OOQ?Mr7+'S7+'SO%3|QWO7+(}O9hQ?MxO7+(}O9^QWO7+(}O@fQWO7+(}OOQU7+(m7+(mO%4RQ?NbO7+(jO!&_Q7[O7+(jO%4]QpO7+(kOOQU7+(k7+(kO!&_Q7[O7+(kO%4dQWO'#K^O%4oQWO,5=iOOQO,5?e,5?eOOQO-E<w-E<wOOQU7+(p7+(pO%6RQ`O'#HWOOQU1G3]1G3]O!&_Q7[O1G3]O%[Q^O1G3]O%6YQWO1G3]O%6eQ7[O1G3]O9hQ?MxO1G3_O$!}QWO1G3_O9RQWO1G3_O!A}Q`O1G3_O!BVQ7[O1G3_O%6sQWO'#I{O%7XQWO,5@yO%7aQ`O,5@yOOQ?Mp1G3`1G3`OOQU7+$V7+$VO@fQWO7+$VO9hQ?MxO7+$VO%7lQWO7+$VO%[Q^O1G6hO%[Q^O1G6iO%7qQ?MxO1G6hO%7{Q^O1G3gO%8SQWO1G3gO%8XQ^O1G3gOOQU7+)P7+)PO9hQ?MxO7+)ZO`Q^O7+)]OOQU'#Kd'#KdOOQU'#JO'#JOO%8`Q^O,5>[OOQU,5>[,5>[O%[Q^O'#HqO%8mQWO'#HsOOQU,5>b,5>bO9WQWO,5>bOOQU,5>d,5>dOOQU7+)f7+)fOOQU7+)l7+)lOOQU7+)p7+)pOOQU7+)r7+)rO%8rQ`O1G5wO%9WQ07bO1G0wO%9bQWO1G0wOOQO1G/p1G/pO%9mQ07bO1G/pO>tQWO1G/pO!(oQ^O'#DjOOQO,5>{,5>{OOQO-E<_-E<_OOQO,5?R,5?ROOQO-E<e-E<eO!A}Q`O1G/pOOQO-E<a-E<aOOQ?Mv1G0Y1G0YOOQ?Mr7+%r7+%rO#&wQWO7+%rOOQ?Mr7+&]7+&]O>tQWO7+&]O!A}Q`O7+&]OOQO7+%u7+%uO$>`Q?NdO7+&UOOQO7+&U7+&UO%[Q^O7+&UO%9wQ?MxO7+&UO!ArQ?MxO7+%uO!A}Q`O7+%uO%:SQ?MxO7+&UO%:bQ?NdO7++mO%[Q^O7++mO%:rQWO7++lO%:rQWO7++lOOQO1G4o1G4oO9WQWO1G4oO%:zQWO1G4oOOQQ7+%z7+%zO#&wQWO<<K|O4UQrO<<K|O%;YQWO<<K|OOQU<<K|<<K|O!&_Q7[O<<K|O%[Q^O<<K|O%;bQWO<<K|O%;mQ?NdO,5?]O%=uQ?NdO,5?_O%?}Q?NdO1G2^O%B]Q?NdO1G2pO%DeQ?NdO1G2rO%FmQrO,5>|O%[Q^O,5>|OOQO-E<`-E<`O%FwQWO1G5xOOQ?Mr<<JR<<JRO%GPQ07bO1G0rO%IWQ07bO1G0|O%I_Q07bO1G0|O%K`Q07bO1G0|O%KgQ07bO1G0|O%MhQ07bO1G0|O& iQ07bO1G0|O& pQ07bO1G0|O& wQ07bO1G0|O&#xQ07bO1G0|O&$PQ07bO1G0|O&$WQ?NdO<<JeO&&OQ07bO1G0|O&&{Q07bO1G0|O&'{Q07bO'#JgO&*OQ07bO1G1bO&*]Q07bO1G0RO&*gQ7[O,5?POOQO-E<c-E<cO!(oQ^O'#FpOOQO'#KU'#KUOOQO1G1t1G1tO&*qQWO1G1sO&*vQ07bO,5?WOOOS7+'g7+'gOOOO1G/W1G/WOOQ?Mr1G4t1G4tO!+hQ7[O7+(`O&-WQrO'#CiO&-bQWO,5?XO9WQWO,5?XOOQO-E<k-E<kO&-pQWO1G6^O&-pQWO1G6^O&-xQWO1G6^O&.TQ7[O7+'xO&.eQpO,5?ZO&.oQWO,5?ZO!&_Q7[O,5?ZOOQO-E<m-E<mO&.tQpO1G6_O&/OQWO1G6_OOQ?Mp1G2h1G2hO$(PQWO1G2hOOQ?Mp1G2g1G2gO&/WQWO1G2iO!&_Q7[O1G2iOOQ?Mp1G2n1G2nO!A}Q`O1G2gOCcQWO1G2hO&/]QWO1G2iO&/eQWO1G2hO$!xQWO1G2iO&0XQ7[O,5?]OOQ?Mr-E<p-E<pO&0zQ7[O,5?_OOQ?Mr-E<r-E<rO!+hQ7[O7++WOOQ?Mr1G/`1G/`O&1UQWO1G/`OOQ?Mr7+'s7+'sO&1ZQ7[O7+'zO&1kQ?NdO<<KVOOQ?Mr<<KV<<KVO&2_QWO1G0wO!&_Q7[O'#IvO&2dQWO,5@tO&4fQrO<<K|O!&_Q7[O1G2lOOQU<<G{<<G{O!ArQ?MxO<<G{O&4mQ?NdO<<IxOOQ?Mr<<Ix<<IxOOQO,5?h,5?hO&5aQWO,5?hO&5fQWO,5?hOOQO-E<z-E<zO&5tQWO1G6gO&5tQWO1G6gO9^QWO1G6gO@fQWO<<LiOOQU<<Li<<LiO&5|QWO<<LiO9hQ?MxO<<LiOOQU<<LU<<LUO%4RQ?NbO<<LUOOQU<<LV<<LVO%4]QpO<<LVO&6RQ`O'#IxO&6^QWO,5@xO!(oQ^O,5@xOOQU1G3T1G3TO%+xQ^O'#JqOOQO'#Iz'#IzO9hQ?MxO'#IzO&6fQ`O,5=rOOQU,5=r,5=rO&6mQ`O'#EdO&7RQ`O'#GcO&7WQWO7+(wO&7]QWO7+(wOOQU7+(w7+(wO!&_Q7[O7+(wO%[Q^O7+(wO&7eQWO7+(wOOQU7+(y7+(yO9hQ?MxO7+(yO$!}QWO7+(yO9RQWO7+(yO!A}Q`O7+(yO&7pQWO,5?gOOQO-E<y-E<yOOQO'#HZ'#HZO&7{QWO1G6eO9hQ?MxO<<GqOOQU<<Gq<<GqO@fQWO<<GqO&8TQWO7+,SO&8YQWO7+,TO%[Q^O7+,SO%[Q^O7+,TOOQU7+)R7+)RO&8_QWO7+)RO&8dQ^O7+)RO&8kQWO7+)ROOQU<<Lu<<LuOOQU<<Lw<<LwOOQU-E<|-E<|OOQU1G3v1G3vO&8pQWO,5>]OOQU,5>_,5>_O&8uQWO1G3|O9WQWO7+&cO!(oQ^O7+&cOOQO7+%[7+%[O&8zQ07bO1G6UO>tQWO7+%[OOQ?Mr<<I^<<I^OOQ?Mr<<Iw<<IwO>tQWO<<IwOOQO<<Ip<<IpO$>`Q?NdO<<IpO%[Q^O<<IpOOQO<<Ia<<IaO!ArQ?MxO<<IaO&9UQ?MxO<<IpO&9aQ?NdO<= XO&9qQWO<= WOOQO7+*Z7+*ZO9WQWO7+*ZOOQUANAhANAhO&9yQrOANAhO!&_Q7[OANAhO#&wQWOANAhO4UQrOANAhO&:QQWOANAhO%[Q^OANAhO&:YQ?NdO7+'xO&<hQ?NdO,5?]O&>pQ?NdO,5?_O&@xQ?NdO7+'zO&CWQrO1G4hO&CbQ07bO7+&^O&EcQ07bO,5=UO&GgQ07bO,5=WO&GwQ07bO,5=UO&HXQ07bO,5=WO&HiQ07bO,59rO&JlQ07bO,5<iO&LlQ07bO,5<kO&N}Q07bO,5<yO'!pQ07bO7+'jO'!}Q07bO7+'kO'#[QWO,5<[OOQO7+'_7+'_O'#aQ7[O<<KzOOQO1G4s1G4sO'#hQWO1G4sO'#sQWO1G4sO'$RQWO7++xO'$RQWO7++xO!&_Q7[O1G4uO'$ZQpO1G4uO'$eQWO7++yOOQ?Mp7+(S7+(SO'$mQWO7+(TO'$xQpO7+(TOOQ?Mp7+(R7+(RO$(PQWO7+(SO'%PQWO7+(TO!&_Q7[O7+(TOCcQWO7+(SO'%UQWO7+(TO'%^Q7[O<<NrOOQ?Mr7+$z7+$zO'%hQpO,5?bOOQO-E<t-E<tO'%rQ?NbO7+(WOOQUAN=gAN=gO9^QWO1G5SOOQO1G5S1G5SO'&SQWO1G5SO'&XQWO7+,RO'&XQWO7+,RO9hQ?MxOANBTO@fQWOANBTOOQUANBTANBTOOQUANApANApOOQUANAqANAqO'&aQWO,5?dOOQO-E<v-E<vO'&lQ07bO1G6dOOQO,5?f,5?fOOQO-E<x-E<xOOQU1G3^1G3^O%+xQ^O,5<}O'&vQWO,5<}OOQU<<Lc<<LcO!&_Q7[O<<LcO&7WQWO<<LcO'&{QWO<<LcO%[Q^O<<LcOOQU<<Le<<LeO9hQ?MxO<<LeO$!}QWO<<LeO9RQWO<<LeO''TQ`O1G5RO''`QWO7+,POOQUAN=]AN=]O9hQ?MxOAN=]OOQU<= n<= nOOQU<= o<= oO''hQWO<= nO''mQWO<= oOOQU<<Lm<<LmO''rQWO<<LmO''wQ^O<<LmOOQU1G3w1G3wO>tQWO7+)hO'(OQWO<<I}O'(ZQ07bO<<I}OOQO<<Hv<<HvOOQ?MrAN?cAN?cOOQOAN?[AN?[O$>`Q?NdOAN?[OOQOAN>{AN>{O%[Q^OAN?[OOQO<<Mu<<MuOOQUG27SG27SO!&_Q7[OG27SO#&wQWOG27SO'(eQrOG27SO4UQrOG27SO'(lQWOG27SO'(tQ07bO<<JeO')RQ07bO1G2^O'*tQ07bO,5?]O',tQ07bO,5?_O'.tQ07bO1G2pO'0tQ07bO1G2rO'2tQ07bO<<KVO'3RQ07bO<<IxOOQO1G1v1G1vO!+hQ7[OANAfOOQO7+*_7+*_O'3`QWO7+*_O'3kQWO<= dO'3sQpO7+*aOOQ?Mp<<Ko<<KoO$(PQWO<<KoOCcQWO<<KoO'3}QWO<<KoOOQ?Mp<<Kn<<KnO'4YQpO<<KoO$(PQWO<<KnO'4aQWO<<KoO!&_Q7[O<<KoOOQO7+*n7+*nO9^QWO7+*nO'4fQWO<= mOOQUG27oG27oO9hQ?MxOG27oO!(oQ^O1G5OO'4nQWO7+,OO&7WQWOANA}OOQUANA}ANA}O!&_Q7[OANA}O'4vQWOANA}OOQUANBPANBPO9hQ?MxOANBPO$!}QWOANBPOOQO'#H['#H[OOQO7+*m7+*mOOQUG22wG22wOOQUANEYANEYOOQUANEZANEZOOQUANBXANBXO'5OQWOANBXOOQU<<MS<<MSO!(oQ^OAN?iOOQOG24vG24vO$>`Q?NdOG24vO#&wQWOLD,nOOQULD,nLD,nO!&_Q7[OLD,nO'5TQrOLD,nO'5[Q07bO7+'xO'6}Q07bO,5?]O'8}Q07bO,5?_O':}Q07bO7+'zO'<pQ7[OG27QOOQO<<My<<MyOOQ?MpANAZANAZO$(PQWOANAZOCcQWOANAZO'=QQWOANAZOOQ?MpANAYANAYO'=]QpOANAZOOQO<<NY<<NYOOQULD-ZLD-ZO'=dQ07bO7+*jOOQUG27iG27iO&7WQWOG27iO!&_Q7[OG27iOOQUG27kG27kO9hQ?MxOG27kOOQUG27sG27sO'=nQ07bOG25TOOQOLD*bLD*bOOQU!$(!Y!$(!YO#&wQWO!$(!YO!&_Q7[O!$(!YO'=xQ?NdOG27QOOQ?MpG26uG26uO$(PQWOG26uOCcQWOG26uO'@WQWOG26uOOQULD-TLD-TO&7WQWOLD-TOOQULD-VLD-VOOQU!)9Et!)9EtO#&wQWO!)9EtOOQ?MpLD,aLD,aO$(PQWOLD,aOCcQWOLD,aOOQU!$(!o!$(!oOOQU!.K;`!.K;`O'@cQ07bOG27QOOQ?Mp!$( {!$( {O$(PQWO!$( {OOQ?Mp!)9Eg!)9EgO!(oQ^O'#DwO1PQWO'#EUO'BUQrO'#JmO'B]QMnO'#DsO'BdQ^O'#D{O'BkQrO'#CiO'ERQrO'#CiO!(oQ^O'#D}O'EcQ^O,5;WO!(oQ^O,5;bO!(oQ^O,5;bO!(oQ^O,5;bO!(oQ^O,5;bO!(oQ^O,5;bO!(oQ^O,5;bO!(oQ^O,5;bO!(oQ^O,5;bO!(oQ^O,5;bO!(oQ^O,5;bO!(oQ^O'#IlO'GfQWO,5<gO!(oQ^O,5;bO'GnQ7[O,5;bO'IXQ7[O,5;bO!(oQ^O,5;vO!&_Q7[O'#GjO'GnQ7[O'#GjO!&_Q7[O'#GlO'GnQ7[O'#GlO1SQWO'#DWO1SQWO'#DWO!&_Q7[O'#F}O'GnQ7[O'#F}O!&_Q7[O'#GPO'GnQ7[O'#GPO!&_Q7[O'#G_O'GnQ7[O'#G_O!(oQ^O,5:gO'I`Q`O'#D[O!(oQ^O,5@jO'EcQ^O1G0rO'IjQ07bO'#CiO!(oQ^O1G2OO!&_Q7[O'#IqO'GnQ7[O'#IqO!&_Q7[O'#IsO'GnQ7[O'#IsO'ItQpO'#CrO!&_Q7[O,5<rO'GnQ7[O,5<rO'EcQ^O1G2PO!(oQ^O7+&yO!&_Q7[O1G2^O'GnQ7[O1G2^O!&_Q7[O'#IqO'GnQ7[O'#IqO!&_Q7[O'#IsO'GnQ7[O'#IsO!&_Q7[O1G2`O'GnQ7[O1G2`O'EcQ^O7+'kO'EcQ^O7+&^O!&_Q7[OANAfO'GnQ7[OANAfO'JXQWO'#ElO'J^QWO'#ElO'JfQWO'#F[O'JkQWO'#EvO'JpQWO'#KOO'J{QWO'#J|O'KWQWO,5;WO'K]Q7[O,5<dO'KdQWO'#GWO'KiQWO'#GWO'KnQWO,5<eO'KvQWO,5;WO'LOQ07bO1G1_O'LVQWO,5<rO'L[QWO,5<rO'LaQWO,5<tO'LfQWO,5<tO'LkQWO1G2PO'LpQWO1G0rO'LuQ7[O<<KzO'L|Q7[O<<KzO7eQ7[O'#FzO9RQWO'#FyOAaQWO'#EkO!(oQ^O,5;sO!3SQWO'#GWO!3SQWO'#GWO!3SQWO'#GYO!3SQWO'#GYO!+hQ7[O7+(`O!+hQ7[O7+(`O%+SQpO1G2tO%+SQpO1G2tO!&_Q7[O,5=YO!&_Q7[O,5=Y",stateData:"'NQ~O'wOS'xOSTOS'yRQ~OPYOQYOSfOY!VOaqOdzOeyOmkOoYOpkOqkOwkOyYO{YO!PWO!TkO!UkO![XO!fuO!iZO!lYO!mYO!nYO!pvO!rwO!uxO!y]O#t!PO$V|O%e}O%g!QO%i!OO%j!OO%k!OO%n!RO%p!SO%s!TO%t!TO%v!UO&S!WO&Y!XO&[!YO&^!ZO&`![O&c!]O&i!^O&o!_O&q!`O&s!aO&u!bO&w!cO(OSO(QTO(TUO([VO(j[O(yiO~OWtO~P`OPYOQYOSfOd!jOe!iOmkOoYOpkOqkOwkOyYO{YO!PWO!TkO!UkO![!eO!fuO!iZO!lYO!mYO!nYO!pvO!r!gO!u!hO$V!kO(O!dO(QTO(TUO([VO(j[O(yiO~Oa!wOp!nO!P!oO!_!yO!`!vO!a!vO!y;QO#Q!pO#R!pO#S!xO#T!pO#U!pO#X!zO#Y!zO(P!lO(QTO(TUO(`!mO(j!sO~O'y!{O~OP]XR]X[]Xa]Xo]X}]X!P]X!Y]X!i]X!m]X#O]X#P]X#]]X#hfX#k]X#l]X#m]X#n]X#o]X#p]X#q]X#r]X#s]X#u]X#w]X#y]X#z]X$P]X'u]X([]X(m]X(t]X(u]X~O!d%PX~P(qO_!}O(Q#PO(R!}O(S#PO~O_#QO(S#PO(T#PO(U#QO~Ou#SO!R#TO(]#TO(^#VO~OPYOQYOSfOd!jOe!iOmkOoYOpkOqkOwkOyYO{YO!PWO!TkO!UkO![!eO!fuO!iZO!lYO!mYO!nYO!pvO!r!gO!u!hO$V!kO(O;UO(QTO(TUO([VO(j[O(yiO~O!X#ZO!Y#WO!V(cP!V(qP~P+}O!Z#cO~P`OPYOQYOSfOd!jOe!iOoYOpkOqkOwkOyYO{YO!PWO!TkO!UkO![!eO!fuO!iZO!lYO!mYO!nYO!pvO!r!gO!u!hO$V!kO(QTO(TUO([VO(j[O(yiO~Om#mO!X#iO!y]O#f#lO#g#iO(O;VO!h(nP~P.iO!i#oO(O#nO~O!u#sO!y]O%e#tO~O#h#uO~O!d#vO#h#uO~OP$[OR#zO[$cOo$aO}#yO!P#{O!Y$_O!i#xO!m$[O#O$RO#k$OO#l$PO#m$PO#n$PO#o$QO#p$RO#q$RO#r$bO#s$RO#u$SO#w$UO#y$WO#z$XO([VO(m$YO(t#|O(u#}O~Oa(aX'u(aX's(aX!h(aX!V(aX![(aX%f(aX!d(aX~P1qO#P$dO#]$eO$P$eOP(bXR(bX[(bXo(bX}(bX!P(bX!Y(bX!i(bX!m(bX#O(bX#k(bX#l(bX#m(bX#n(bX#o(bX#p(bX#q(bX#r(bX#s(bX#u(bX#w(bX#y(bX#z(bX([(bX(m(bX(t(bX(u(bX![(bX%f(bX~Oa(bX'u(bX's(bX!V(bX!h(bXs(bX!d(bX~P4UO#]$eO~O$[$hO$^$gO$e$mO~OSfO![$nO$h$oO$j$qO~Oh%VOm%WOo%XOp$tOq$tOw%YOy%ZO{%[O!P${O![$|O!f%aO!i$xO#g%bO$V%_O$r%]O$t%^O$w%`O(O$sO(QTO(TUO([$uO(t$}O(u%POg(XP~O!i%cO~O!P%fO![%gO(O%eO~O!d%kO~Oa%lO'u%lO~O}%pO~P%[O(P!lO~P%[O%k%tO~P%[Oh%VO!i%cO(O%eO(P!lO~Oe%{O!i%cO(O%eO~O#s$RO~O}&QO![%}O!i&PO%g&TO(O%eO(P!lO(QTO(TUO`)SP~O!u#sO~O%p&VO!P)OX![)OX(O)OX~O(O&WO~O!r&]O#t!PO%g!QO%i!OO%j!OO%k!OO%n!RO%p!SO%s!TO%t!TO~Od&bOe&aO!u&_O%e&`O%x&^O~P;|Od&eOeyO![&dO!r&]O!uxO!y]O#t!PO%e}O%i!OO%j!OO%k!OO%n!RO%p!SO%s!TO%t!TO%v!UO~Ob&hO#]&kO%g&fO(P!lO~P=RO!i&lO!r&pO~O!i#oO~O![XO~Oa%lO't&xO'u%lO~Oa%lO't&{O'u%lO~Oa%lO't&}O'u%lO~O's]X!V]Xs]X!h]X&W]X![]X%f]X!d]X~P(qO!_'[O!`'TO!a'TO(P!lO(QTO(TUO~Op'RO!P'QO!X'UO(`'PO!Z(dP!Z(sP~P@YOk'_O![']O(O%eO~Oe'dO!i%cO(O%eO~O}&QO!i&PO~Op!nO!P!oO!y;QO#Q!pO#R!pO#T!pO#U!pO(P!lO(QTO(TUO(`!mO(j!sO~O!_'jO!`'iO!a'iO#S!pO#X'kO#Y'kO~PAtOa%lOh%VO!d#vO!i%cO'u%lO(m'mO~O!m'qO#]'oO~PCSOp!nO!P!oO(QTO(TUO(`!mO(j!sO~O![XOp(hX!P(hX!_(hX!`(hX!a(hX!y(hX#Q(hX#R(hX#S(hX#T(hX#U(hX#X(hX#Y(hX(P(hX(Q(hX(T(hX(`(hX(j(hX~O!`'iO!a'iO(P!lO~PCrO'z'uO'{'uO'|'wO~O_!}O(Q'yO(R!}O(S'yO~O_#QO(S'yO(T'yO(U#QO~Ou#SO!R#TO(]#TO(^'}O~O!X(PO!V'SX!V'YX!Y'SX!Y'YX~P+}O!Y(RO!V(cX~OP$[OR#zO[$cOo$aO}#yO!P#{O!Y(RO!i#xO!m$[O#O$RO#k$OO#l$PO#m$PO#n$PO#o$QO#p$RO#q$RO#r$bO#s$RO#u$SO#w$UO#y$WO#z$XO([VO(m$YO(t#|O(u#}O~O!V(cX~PGfO!V(WO~O!V(pX!Y(pX!d(pX!h(pX(m(pX~O#](pX#h#aX!Z(pX~PIiO#](XO!V(rX!Y(rX~O!Y(YO!V(qX~O!V(]O~O#]$eO~PIiO!Z(^O~P`OR#zO}#yO!P#{O!i#xO([VOP!ka[!kao!ka!Y!ka!m!ka#O!ka#k!ka#l!ka#m!ka#n!ka#o!ka#p!ka#q!ka#r!ka#s!ka#u!ka#w!ka#y!ka#z!ka(m!ka(t!ka(u!ka~Oa!ka'u!ka's!ka!V!ka!h!kas!ka![!ka%f!ka!d!ka~PKPO!h(_O~O!d#vO#](`O(m'mO!Y(oXa(oX'u(oX~O!h(oX~PMlO!P%fO![%gO!y]O#f(eO#g(dO(O%eO~O!Y(fO!h(nX~O!h(hO~O!P%fO![%gO#g(dO(O%eO~OP(bXR(bX[(bXo(bX}(bX!P(bX!Y(bX!i(bX!m(bX#O(bX#k(bX#l(bX#m(bX#n(bX#o(bX#p(bX#q(bX#r(bX#s(bX#u(bX#w(bX#y(bX#z(bX([(bX(m(bX(t(bX(u(bX~O!d#vO!h(bX~P! YOR(jO}(iO!i#xO#P$dO!y!xa!P!xa~O!u!xa%e!xa![!xa#f!xa#g!xa(O!xa~P!#ZO!u(nO~OPYOQYOSfOd!jOe!iOmkOoYOpkOqkOwkOyYO{YO!PWO!TkO!UkO![XO!fuO!iZO!lYO!mYO!nYO!pvO!r!gO!u!hO$V!kO(O!dO(QTO(TUO([VO(j[O(yiO~Oh%VOm%WOo%XOp$tOq$tOw%YOy%ZO{;nO!P${O![$|O!f=OO!i$xO#g;tO$V%_O$r;pO$t;rO$w%`O(O(rO(QTO(TUO([$uO(t$}O(u%PO~O#h(tO~O!X(vO!h(fP~P%[O(`(xO(j[O~O!P(zO!i#xO(`(xO(j[O~OP;POQ;POSfOd<zOe!iOmkOo;POpkOqkOwkOy;PO{;PO!PWO!TkO!UkO![!eO!f;SO!iZO!l;PO!m;PO!n;PO!p;TO!r;WO!u!hO$V!kO(O)XO(QTO(TUO([VO(j[O(y<xO~O!Y$_Oa$oa'u$oa's$oa!h$oa!V$oa![$oa%f$oa!d$oa~O#t)`O~P!&_Oh%VOm%WOo%XOp$tOq$tOw%YOy%ZO{%[O!P${O![$|O!f%aO!i$xO#g%bO$V%_O$r%]O$t%^O$w%`O(O(rO(QTO(TUO([$uO(t$}O(u%PO~Og(kP~P!+hO})eO!d)dO![$]X$Y$]X$[$]X$^$]X$e$]X~O!d)dO![(vX$Y(vX$[(vX$^(vX$e(vX~O})eO~P!-qO})eO![(vX$Y(vX$[(vX$^(vX$e(vX~O![)gO$Y)kO$[)fO$^)fO$e)lO~O!X)oO~P!(oO$[$hO$^$gO$e)sO~Ok$xX}$xX!P$xX#P$xX(t$xX(u$xX~OgjXg$xXkjX!YjX#]jX~P!/gOu)uO(])vO(^)xO~Ok*RO})zO!P){O(t$}O(u%PO~Og)yO~P!0kOg*SO~Oh%VOm%WOo%XOp$tOq$tOw%YOy%ZO{;nO!P*UO![*VO!f=OO!i$xO#g;tO$V%_O$r;pO$t;rO$w%`O(QTO(TUO([$uO(t$}O(u%PO~O!X*YO(O*TO!h(zP~P!1YO#h*[O~O!i*]O~Oh%VOm%WOo%XOp$tOq$tOw%YOy%ZO{;nO!P${O![$|O!f=OO!i$xO#g;tO$V%_O$r;pO$t;rO$w%`O(O*_O(QTO(TUO([$uO(t$}O(u%PO~O!X*bO!V({P~P!3XOo*nO!P*fO!_*lO!`*eO!a*eO!i*]O#X*mO%]*hO(P!lO(`!mO~O!Z*kO~P!4|O#P$dOk(ZX}(ZX!P(ZX(t(ZX(u(ZX!Y(ZX#](ZX~Og(ZX#}(ZX~P!5uOk*sO#]*rOg(YX!Y(YX~O!Y*tOg(XX~O(O&WOg(XP~Op*wO~O!i*|O~O(O(rO~Om+QO!P%fO!X#iO![%gO!y]O#f#lO#g#iO(O%eO!h(nP~O!d#vO#h+RO~O!P%fO!X+TO!Y(YO![%gO(O%eO!V(qP~Op'XO!P+VO!X+UO(QTO(TUO(`(xO~O!Z(sP~P!8uO!Y+WOa)PX'u)PX~OP$[OR#zO[$cOo$aO}#yO!P#{O!i#xO!m$[O#O$RO#k$OO#l$PO#m$PO#n$PO#o$QO#p$RO#q$RO#r$bO#s$RO#u$SO#w$UO#y$WO#z$XO([VO(m$YO(t#|O(u#}O~Oa!ga!Y!ga'u!ga's!ga!V!ga!h!gas!ga![!ga%f!ga!d!ga~P!9mOR#zO}#yO!P#{O!i#xO([VOP!oa[!oao!oa!Y!oa!m!oa#O!oa#k!oa#l!oa#m!oa#n!oa#o!oa#p!oa#q!oa#r!oa#s!oa#u!oa#w!oa#y!oa#z!oa(m!oa(t!oa(u!oa~Oa!oa'u!oa's!oa!V!oa!h!oas!oa![!oa%f!oa!d!oa~P!<TOR#zO}#yO!P#{O!i#xO([VOP!qa[!qao!qa!Y!qa!m!qa#O!qa#k!qa#l!qa#m!qa#n!qa#o!qa#p!qa#q!qa#r!qa#s!qa#u!qa#w!qa#y!qa#z!qa(m!qa(t!qa(u!qa~Oa!qa'u!qa's!qa!V!qa!h!qas!qa![!qa%f!qa!d!qa~P!>kOh%VOk+aO![']O%f+`O~O!d+cOa(WX![(WX'u(WX!Y(WX~Oa%lO![XO'u%lO~Oh%VO!i%cO~Oh%VO!i%cO(O%eO~O!d#vO#h(tO~Ob+nO%g+oO(O+kO(QTO(TUO!Z)TP~O!Y+pO`)SX~O[+tO~O`+uO~O![%}O(O%eO(P!lO`)SP~Oh%VO#]+zO~Oh%VOk+}O![$|O~O![,PO~O},RO![XO~O%k%tO~O!u,WO~Oe,]O~Ob,^O(O#nO(QTO(TUO!Z)RP~Oe%{O~O%g!QO(O&WO~P=RO[,cO`,bO~OPYOQYOSfOdzOeyOmkOoYOpkOqkOwkOyYO{YO!PWO!TkO!UkO!fuO!iZO!lYO!mYO!nYO!pvO!uxO!y]O%e}O(QTO(TUO([VO(j[O(yiO~O![!eO!r!gO$V!kO(O!dO~P!EkO`,bOa%lO'u%lO~OPYOQYOSfOd!jOe!iOmkOoYOpkOqkOwkOyYO{YO!PWO!TkO!UkO![!eO!fuO!iZO!lYO!mYO!nYO!pvO!u!hO$V!kO(O!dO(QTO(TUO([VO(j[O(yiO~Oa,hO!rwO#t!OO%i!OO%j!OO%k!OO~P!HTO!i&lO~O&Y,nO~O![,pO~O&k,rO&m,sOP&haQ&haS&haY&haa&had&hae&ham&hao&hap&haq&haw&hay&ha{&ha!P&ha!T&ha!U&ha![&ha!f&ha!i&ha!l&ha!m&ha!n&ha!p&ha!r&ha!u&ha!y&ha#t&ha$V&ha%e&ha%g&ha%i&ha%j&ha%k&ha%n&ha%p&ha%s&ha%t&ha%v&ha&S&ha&Y&ha&[&ha&^&ha&`&ha&c&ha&i&ha&o&ha&q&ha&s&ha&u&ha&w&ha's&ha(O&ha(Q&ha(T&ha([&ha(j&ha(y&ha!Z&ha&a&hab&ha&f&ha~O(O,xO~Oh!bX!Y!OX!Z!OX!d!OX!d!bX!i!bX#]!OX~O!Y!bX!Z!bX~P# ZO!d,}O#],|Oh(eX!Y#eX!Y(eX!Z#eX!Z(eX!d(eX!i(eX~Oh%VO!d-PO!i%cO!Y!^X!Z!^X~Op!nO!P!oO(QTO(TUO(`!mO~OP;POQ;POSfOd<zOe!iOmkOo;POpkOqkOwkOy;PO{;PO!PWO!TkO!UkO![!eO!f;SO!iZO!l;PO!m;PO!n;PO!p;TO!r;WO!u!hO$V!kO(QTO(TUO([VO(j[O(y<xO~O(O;zO~P##_O!Y-TO!Z(dX~O!Z-VO~O!d,}O#],|O!Y#eX!Z#eX~O!Y-WO!Z(sX~O!Z-YO~O!`-ZO!a-ZO(P!lO~P#!|O!Z-^O~P'_Ok-aO![']O~O!V-fO~Op!xa!_!xa!`!xa!a!xa#Q!xa#R!xa#S!xa#T!xa#U!xa#X!xa#Y!xa(P!xa(Q!xa(T!xa(`!xa(j!xa~P!#ZO!m-kO#]-iO~PCSO!`-mO!a-mO(P!lO~PCrOa%lO#]-iO'u%lO~Oa%lO!d#vO#]-iO'u%lO~Oa%lO!d#vO!m-kO#]-iO'u%lO(m'mO~O'z'uO'{'uO'|-rO~Os-sO~O!V'Sa!Y'Sa~P!9mO!X-wO!V'SX!Y'SX~P%[O!Y(RO!V(ca~O!V(ca~PGfO!Y(YO!V(qa~O!P%fO!X-{O![%gO(O%eO!V'YX!Y'YX~O#]-}O!Y(oa!h(oaa(oa'u(oa~O!d#vO~P#+eO!Y(fO!h(na~O!P%fO![%gO#g.RO(O%eO~Om.WO!P%fO!X.TO![%gO!y]O#f.VO#g.TO(O%eO!Y']X!h']X~OR.[O!i#xO~Oh%VOk._O![']O%f.^O~Oa#`i!Y#`i'u#`i's#`i!V#`i!h#`is#`i![#`i%f#`i!d#`i~P!9mOk=UO})zO!P){O(t$}O(u%PO~O#h#[aa#[a#]#[a'u#[a!Y#[a!h#[a![#[a!V#[a~P#.aO#h(ZXP(ZXR(ZX[(ZXa(ZXo(ZX!i(ZX!m(ZX#O(ZX#k(ZX#l(ZX#m(ZX#n(ZX#o(ZX#p(ZX#q(ZX#r(ZX#s(ZX#u(ZX#w(ZX#y(ZX#z(ZX'u(ZX([(ZX(m(ZX!h(ZX!V(ZX's(ZXs(ZX![(ZX%f(ZX!d(ZX~P!5uO!Y.lO!h(fX~P!9mO!h.oO~O!V.qO~OP$[OR#zO}#yO!P#{O!i#xO!m$[O([VO[#jia#jio#ji!Y#ji#O#ji#l#ji#m#ji#n#ji#o#ji#p#ji#q#ji#r#ji#s#ji#u#ji#w#ji#y#ji#z#ji'u#ji(m#ji(t#ji(u#ji's#ji!V#ji!h#jis#ji![#ji%f#ji!d#ji~O#k#ji~P#1|O#k$OO~P#1|OP$[OR#zOo$aO}#yO!P#{O!i#xO!m$[O#k$OO#l$PO#m$PO#n$PO([VO[#jia#ji!Y#ji#O#ji#p#ji#q#ji#r#ji#s#ji#u#ji#w#ji#y#ji#z#ji'u#ji(m#ji(t#ji(u#ji's#ji!V#ji!h#jis#ji![#ji%f#ji!d#ji~O#o#ji~P#4kO#o$QO~P#4kOP$[OR#zO[$cOo$aO}#yO!P#{O!i#xO!m$[O#O$RO#k$OO#l$PO#m$PO#n$PO#o$QO#p$RO#q$RO#r$bO#s$RO([VOa#ji!Y#ji#w#ji#y#ji#z#ji'u#ji(m#ji(t#ji(u#ji's#ji!V#ji!h#jis#ji![#ji%f#ji!d#ji~O#u#ji~P#7YOP$[OR#zO[$cOo$aO}#yO!P#{O!i#xO!m$[O#O$RO#k$OO#l$PO#m$PO#n$PO#o$QO#p$RO#q$RO#r$bO#s$RO#u$SO([VO(u#}Oa#ji!Y#ji#y#ji#z#ji'u#ji(m#ji(t#ji's#ji!V#ji!h#jis#ji![#ji%f#ji!d#ji~O#w$UO~P#9pO#w#ji~P#9pO#u$SO~P#7YOP$[OR#zO[$cOo$aO}#yO!P#{O!i#xO!m$[O#O$RO#k$OO#l$PO#m$PO#n$PO#o$QO#p$RO#q$RO#r$bO#s$RO#u$SO#w$UO([VO(t#|O(u#}Oa#ji!Y#ji#z#ji'u#ji(m#ji's#ji!V#ji!h#jis#ji![#ji%f#ji!d#ji~O#y#ji~P#<fO#y$WO~P#<fOP]XR]X[]Xo]X}]X!P]X!i]X!m]X#O]X#P]X#]]X#hfX#k]X#l]X#m]X#n]X#o]X#p]X#q]X#r]X#s]X#u]X#w]X#y]X#z]X$P]X([]X(m]X(t]X(u]X!Y]X!Z]X~O#}]X~P#?TOP$[OR#zO[;hOo;fO}#yO!P#{O!i#xO!m$[O#O;]O#k;YO#l;ZO#m;ZO#n;ZO#o;[O#p;]O#q;]O#r;gO#s;]O#u;^O#w;`O#y;bO#z;cO([VO(m$YO(t#|O(u#}O~O#}.sO~P#AbO#P$dO#];iO$P;iO#}(bX!Z(bX~P! YOa'`a!Y'`a'u'`a's'`a!h'`a!V'`as'`a!['`a%f'`a!d'`a~P!9mO[#jia#jio#ji!Y#ji#O#ji#o#ji#p#ji#q#ji#r#ji#s#ji#u#ji#w#ji#y#ji#z#ji'u#ji(m#ji's#ji!V#ji!h#jis#ji![#ji%f#ji!d#ji~OP$[OR#zO}#yO!P#{O!i#xO!m$[O#k$OO#l$PO#m$PO#n$PO([VO(t#ji(u#ji~P#DdOk=UO})zO!P){O(t$}O(u%POP#jiR#ji!i#ji!m#ji#k#ji#l#ji#m#ji#n#ji([#ji~P#DdO!Y.wOg(kX~P!0kOg.yO~Oa$Oi!Y$Oi'u$Oi's$Oi!V$Oi!h$Ois$Oi![$Oi%f$Oi!d$Oi~P!9mO$[.zO$^.zO~O$[.{O$^.{O~O!d)dO#].|O![$bX$Y$bX$[$bX$^$bX$e$bX~O!X.}O~O![)gO$Y/PO$[)fO$^)fO$e/QO~O!Y;dO!Z(aX~P#AbO!Z/RO~O!d)dO$e(vX~O$e/TO~Ou)uO(])vO(^/WO~O!V/[O~P!&_O(t$}Ok%^a}%^a!P%^a(u%^a!Y%^a#]%^a~Og%^a#}%^a~P#K^O(u%POk%`a}%`a!P%`a(t%`a!Y%`a#]%`a~Og%`a#}%`a~P#LPO!YfX!dfX!hfX!h$xX(mfX~P!/gO!X/eO!Y(YO(O/dO!V(qP!V({P~P!1YOo*nO!_*lO!`*eO!a*eO!i*]O#X*mO%]*hO(P!lO~Op'XO!P/fO!X+UO!Z*kO(QTO(TUO(`;wO!Z(sP~P#MjO!h/gO~P#.aO!Y/hO!d#vO(m'mO!h(zX~O!h/mO~O!P%fO!X*YO![%gO(O%eO!h(zP~O#h/oO~O!V$xX!Y$xX!d%PX~P!/gO!Y/pO!V({X~P#.aO!d/rO~O!V/tO~Oh%VOo/xO!d#vO!i%cO(m'mO~O(O/zO~O!d+cO~Oa%lO!Y0OO'u%lO~O!Z0QO~P!4|O!`0RO!a0RO(P!lO(`!mO~O!P0TO(`!mO~O#X0UO~Og%^a!Y%^a#]%^a#}%^a~P!0kOg%`a!Y%`a#]%`a#}%`a~P!0kO(O&WOg'iX!Y'iX~O!Y*tOg(Xa~Og0_O~OR0`O}0`O!P0aO#P$dOkza(tza(uza!Yza#]za~Ogza#}za~P$%]O})zO!P){Ok$qa(t$qa(u$qa!Y$qa#]$qa~Og$qa#}$qa~P$&UO})zO!P){Ok$sa(t$sa(u$sa!Y$sa#]$sa~Og$sa#}$sa~P$&wO#h0dO~Og%Ra!Y%Ra#]%Ra#}%Ra~P!0kO!d#vO~O#h0gO~O!Y+WOa)Pa'u)Pa~OR#zO}#yO!P#{O!i#xO([VOP!oi[!oio!oi!Y!oi!m!oi#O!oi#k!oi#l!oi#m!oi#n!oi#o!oi#p!oi#q!oi#r!oi#s!oi#u!oi#w!oi#y!oi#z!oi(m!oi(t!oi(u!oi~Oa!oi'u!oi's!oi!V!oi!h!ois!oi![!oi%f!oi!d!oi~P$(fOh%VOo%XOp$tOq$tOw%YOy%ZO{;nO!P${O![$|O!f=OO!i$xO#g;tO$V%_O$r;pO$t;rO$w%`O(QTO(TUO([$uO(t$}O(u%PO~Om0pO(O0oO~P$*|O!d+cOa(Wa![(Wa'u(Wa!Y(Wa~O#h0vO~O[]X!YfX!ZfX~O!Y0wO!Z)TX~O!Z0yO~O[0zO~Ob0|O(O+kO(QTO(TUO~O![%}O(O%eO`'qX!Y'qX~O!Y+pO`)Sa~O!h1PO~P!9mO[1SO~O`1TO~O#]1WO~Ok1ZO![$|O~O(`(xO!Z)QP~Oh%VOk1dO![1aO%f1cO~O[1nO!Y1lO!Z)RX~O!Z1oO~O`1qOa%lO'u%lO~O(O#nO(QTO(TUO~O#P$dO#]$eO$P$eOP(bXR(bX[(bXo(bX}(bX!P(bX!Y(bX!i(bX!m(bX#O(bX#k(bX#l(bX#m(bX#n(bX#o(bX#p(bX#q(bX#r(bX#u(bX#w(bX#y(bX#z(bX([(bX(m(bX(t(bX(u(bX~O#s1tO&W1uOa(bX~P$0dO#]$eO#s1tO&W1uO~Oa1wO~P%[Oa1yO~O&a1|OP&_iQ&_iS&_iY&_ia&_id&_ie&_im&_io&_ip&_iq&_iw&_iy&_i{&_i!P&_i!T&_i!U&_i![&_i!f&_i!i&_i!l&_i!m&_i!n&_i!p&_i!r&_i!u&_i!y&_i#t&_i$V&_i%e&_i%g&_i%i&_i%j&_i%k&_i%n&_i%p&_i%s&_i%t&_i%v&_i&S&_i&Y&_i&[&_i&^&_i&`&_i&c&_i&i&_i&o&_i&q&_i&s&_i&u&_i&w&_i's&_i(O&_i(Q&_i(T&_i([&_i(j&_i(y&_i!Z&_ib&_i&f&_i~Ob2SO!Z2QO&f2RO~P`O![XO!i2UO~O&m,sOP&hiQ&hiS&hiY&hia&hid&hie&him&hio&hip&hiq&hiw&hiy&hi{&hi!P&hi!T&hi!U&hi![&hi!f&hi!i&hi!l&hi!m&hi!n&hi!p&hi!r&hi!u&hi!y&hi#t&hi$V&hi%e&hi%g&hi%i&hi%j&hi%k&hi%n&hi%p&hi%s&hi%t&hi%v&hi&S&hi&Y&hi&[&hi&^&hi&`&hi&c&hi&i&hi&o&hi&q&hi&s&hi&u&hi&w&hi's&hi(O&hi(Q&hi(T&hi([&hi(j&hi(y&hi!Z&hi&a&hib&hi&f&hi~O!V2[O~O!Y!^a!Z!^a~P#AbOp!nO!P!oO!X2bO(`!mO!Y'TX!Z'TX~P@YO!Y-TO!Z(da~O!Y'ZX!Z'ZX~P!8uO!Y-WO!Z(sa~O!Z2iO~P'_Oa%lO#]2rO'u%lO~Oa%lO!d#vO#]2rO'u%lO~Oa%lO!d#vO!m2vO#]2rO'u%lO(m'mO~Oa%lO'u%lO~P!9mO!Y$_Os$oa~O!V'Si!Y'Si~P!9mO!Y(RO!V(ci~O!Y(YO!V(qi~O!V(ri!Y(ri~P!9mO!Y(oi!h(oia(oi'u(oi~P!9mO#]2xO!Y(oi!h(oia(oi'u(oi~O!Y(fO!h(ni~O!P%fO![%gO!y]O#f2}O#g2|O(O%eO~O!P%fO![%gO#g2|O(O%eO~Ok3UO![']O%f3TO~Oh%VOk3UO![']O%f3TO~O#h%^aP%^aR%^a[%^aa%^ao%^a!i%^a!m%^a#O%^a#k%^a#l%^a#m%^a#n%^a#o%^a#p%^a#q%^a#r%^a#s%^a#u%^a#w%^a#y%^a#z%^a'u%^a([%^a(m%^a!h%^a!V%^a's%^as%^a![%^a%f%^a!d%^a~P#K^O#h%`aP%`aR%`a[%`aa%`ao%`a!i%`a!m%`a#O%`a#k%`a#l%`a#m%`a#n%`a#o%`a#p%`a#q%`a#r%`a#s%`a#u%`a#w%`a#y%`a#z%`a'u%`a([%`a(m%`a!h%`a!V%`a's%`as%`a![%`a%f%`a!d%`a~P#LPO#h%^aP%^aR%^a[%^aa%^ao%^a!Y%^a!i%^a!m%^a#O%^a#k%^a#l%^a#m%^a#n%^a#o%^a#p%^a#q%^a#r%^a#s%^a#u%^a#w%^a#y%^a#z%^a'u%^a([%^a(m%^a!h%^a!V%^a's%^a#]%^as%^a![%^a%f%^a!d%^a~P#.aO#h%`aP%`aR%`a[%`aa%`ao%`a!Y%`a!i%`a!m%`a#O%`a#k%`a#l%`a#m%`a#n%`a#o%`a#p%`a#q%`a#r%`a#s%`a#u%`a#w%`a#y%`a#z%`a'u%`a([%`a(m%`a!h%`a!V%`a's%`a#]%`as%`a![%`a%f%`a!d%`a~P#.aO#hzaPza[zaazaoza!iza!mza#Oza#kza#lza#mza#nza#oza#pza#qza#rza#sza#uza#wza#yza#zza'uza([za(mza!hza!Vza'szasza![za%fza!dza~P$%]O#h$qaP$qaR$qa[$qaa$qao$qa!i$qa!m$qa#O$qa#k$qa#l$qa#m$qa#n$qa#o$qa#p$qa#q$qa#r$qa#s$qa#u$qa#w$qa#y$qa#z$qa'u$qa([$qa(m$qa!h$qa!V$qa's$qas$qa![$qa%f$qa!d$qa~P$&UO#h$saP$saR$sa[$saa$sao$sa!i$sa!m$sa#O$sa#k$sa#l$sa#m$sa#n$sa#o$sa#p$sa#q$sa#r$sa#s$sa#u$sa#w$sa#y$sa#z$sa'u$sa([$sa(m$sa!h$sa!V$sa's$sas$sa![$sa%f$sa!d$sa~P$&wO#h%RaP%RaR%Ra[%Raa%Rao%Ra!Y%Ra!i%Ra!m%Ra#O%Ra#k%Ra#l%Ra#m%Ra#n%Ra#o%Ra#p%Ra#q%Ra#r%Ra#s%Ra#u%Ra#w%Ra#y%Ra#z%Ra'u%Ra([%Ra(m%Ra!h%Ra!V%Ra's%Ra#]%Ras%Ra![%Ra%f%Ra!d%Ra~P#.aOa#`q!Y#`q'u#`q's#`q!V#`q!h#`qs#`q![#`q%f#`q!d#`q~P!9mO!X3^O!Y'UX!h'UX~P%[O!Y.lO!h(fa~O!Y.lO!h(fa~P!9mO!V3aO~O#}!ka!Z!ka~PKPO#}!ga!Y!ga!Z!ga~P#AbO#}!oa!Z!oa~P!<TO#}!qa!Z!qa~P!>kOg'XX!Y'XX~P!+hO!Y.wOg(ka~OSfO![3uO$c3vO~O!Z3zO~Os3{O~P#.aOa$lq!Y$lq'u$lq's$lq!V$lq!h$lqs$lq![$lq%f$lq!d$lq~P!9mO!V3|O~P#.aO})zO!P){O(u%POk'ea(t'ea!Y'ea#]'ea~Og'ea#}'ea~P%)nO})zO!P){Ok'ga(t'ga(u'ga!Y'ga#]'ga~Og'ga#}'ga~P%*aO(m$YO~P#.aO!VfX!V$xX!YfX!Y$xX!d%PX#]fX~P!/gO(O<QO~P!1YOmkO(O4OO~P.iO!P%fO!X4QO![%gO(O%eO!Y'aX!h'aX~O!Y/hO!h(za~O!Y/hO!d#vO!h(za~O!Y/hO!d#vO(m'mO!h(za~Og$zi!Y$zi#]$zi#}$zi~P!0kO!X4YO!V'cX!Y'cX~P!3XO!Y/pO!V({a~O!Y/pO!V({a~P#.aO!d#vO#s4bO~Oo4eO!d#vO(m'mO~O!P4hO(`!mO~O(t$}Ok%^i}%^i!P%^i(u%^i!Y%^i#]%^i~Og%^i#}%^i~P%.wO(u%POk%`i}%`i!P%`i(t%`i!Y%`i#]%`i~Og%`i#}%`i~P%/jOg(Yi!Y(Yi~P!0kO#]4mOg(Yi!Y(Yi~P!0kO!h4pO~Oa$mq!Y$mq'u$mq's$mq!V$mq!h$mqs$mq![$mq%f$mq!d$mq~P!9mO!V4tO~O!Y4uO![(|X~P#.aOa$xX![$xX%Z]X'u$xX!Y$xX~P!/gO%Z4xOalXklX}lX!PlX![lX'ulX(tlX(ulX!YlX~O%Z4xO~Ob5OO%g5PO(O+kO(QTO(TUO!Y'pX!Z'pX~O!Y0wO!Z)Ta~O[5TO~O`5UO~Oa%lO'u%lO~P#.aO![$|O~P#.aO!Y5^O#]5`O!Z)QX~O!Z5aO~Oo5hOp!nO!P5bO!_!yO!`!vO!a!vO!y;QO#Q!pO#R!pO#S!pO#T!pO#U!pO#X5gO#Y!zO(P!lO(QTO(TUO(`!mO(j!sO~O!Z5fO~P%4tOk5mO![1aO%f5lO~Oh%VOk5mO![1aO%f5lO~Ob5tO(O#nO(QTO(TUO!Y'oX!Z'oX~O!Y1lO!Z)Ra~O(QTO(TUO(`5vO~O`5zO~O#s5}O&W6OO~PMlO!h6PO~P%[Oa6RO~Oa6RO~P%[Ob2SO!Z6WO&f2RO~P`O!d6YO~O!d6[Oh(ei!Y(ei!Z(ei!d(ei!i(ei~O!Y#ei!Z#ei~P#AbO#]6]O!Y#ei!Z#ei~O!Y!^i!Z!^i~P#AbOa%lO#]6fO'u%lO~Oa%lO!d#vO#]6fO'u%lO~O!Y(oq!h(oqa(oq'u(oq~P!9mO!Y(fO!h(nq~O!P%fO![%gO#g6mO(O%eO~O![']O%f6pO~Ok6tO![']O%f6pO~O#h'eaP'eaR'ea['eaa'eao'ea!i'ea!m'ea#O'ea#k'ea#l'ea#m'ea#n'ea#o'ea#p'ea#q'ea#r'ea#s'ea#u'ea#w'ea#y'ea#z'ea'u'ea(['ea(m'ea!h'ea!V'ea's'eas'ea!['ea%f'ea!d'ea~P%)nO#h'gaP'gaR'ga['gaa'gao'ga!i'ga!m'ga#O'ga#k'ga#l'ga#m'ga#n'ga#o'ga#p'ga#q'ga#r'ga#s'ga#u'ga#w'ga#y'ga#z'ga'u'ga(['ga(m'ga!h'ga!V'ga's'gas'ga!['ga%f'ga!d'ga~P%*aO#h$ziP$ziR$zi[$zia$zio$zi!Y$zi!i$zi!m$zi#O$zi#k$zi#l$zi#m$zi#n$zi#o$zi#p$zi#q$zi#r$zi#s$zi#u$zi#w$zi#y$zi#z$zi'u$zi([$zi(m$zi!h$zi!V$zi's$zi#]$zis$zi![$zi%f$zi!d$zi~P#.aO#h%^iP%^iR%^i[%^ia%^io%^i!i%^i!m%^i#O%^i#k%^i#l%^i#m%^i#n%^i#o%^i#p%^i#q%^i#r%^i#s%^i#u%^i#w%^i#y%^i#z%^i'u%^i([%^i(m%^i!h%^i!V%^i's%^is%^i![%^i%f%^i!d%^i~P%.wO#h%`iP%`iR%`i[%`ia%`io%`i!i%`i!m%`i#O%`i#k%`i#l%`i#m%`i#n%`i#o%`i#p%`i#q%`i#r%`i#s%`i#u%`i#w%`i#y%`i#z%`i'u%`i([%`i(m%`i!h%`i!V%`i's%`is%`i![%`i%f%`i!d%`i~P%/jO!Y'Ua!h'Ua~P!9mO!Y.lO!h(fi~O#}#`i!Y#`i!Z#`i~P#AbOP$[OR#zO}#yO!P#{O!i#xO!m$[O([VO[#jio#ji#O#ji#l#ji#m#ji#n#ji#o#ji#p#ji#q#ji#r#ji#s#ji#u#ji#w#ji#y#ji#z#ji#}#ji(m#ji(t#ji(u#ji!Y#ji!Z#ji~O#k#ji~P%G^O#k;YO~P%G^OP$[OR#zOo;fO}#yO!P#{O!i#xO!m$[O#k;YO#l;ZO#m;ZO#n;ZO([VO[#ji#O#ji#p#ji#q#ji#r#ji#s#ji#u#ji#w#ji#y#ji#z#ji#}#ji(m#ji(t#ji(u#ji!Y#ji!Z#ji~O#o#ji~P%IfO#o;[O~P%IfOP$[OR#zO[;hOo;fO}#yO!P#{O!i#xO!m$[O#O;]O#k;YO#l;ZO#m;ZO#n;ZO#o;[O#p;]O#q;]O#r;gO#s;]O([VO#w#ji#y#ji#z#ji#}#ji(m#ji(t#ji(u#ji!Y#ji!Z#ji~O#u#ji~P%KnOP$[OR#zO[;hOo;fO}#yO!P#{O!i#xO!m$[O#O;]O#k;YO#l;ZO#m;ZO#n;ZO#o;[O#p;]O#q;]O#r;gO#s;]O#u;^O([VO(u#}O#y#ji#z#ji#}#ji(m#ji(t#ji!Y#ji!Z#ji~O#w;`O~P%MoO#w#ji~P%MoO#u;^O~P%KnOP$[OR#zO[;hOo;fO}#yO!P#{O!i#xO!m$[O#O;]O#k;YO#l;ZO#m;ZO#n;ZO#o;[O#p;]O#q;]O#r;gO#s;]O#u;^O#w;`O([VO(t#|O(u#}O#z#ji#}#ji(m#ji!Y#ji!Z#ji~O#y#ji~P&!OO#y;bO~P&!OOa#{y!Y#{y'u#{y's#{y!V#{y!h#{ys#{y![#{y%f#{y!d#{y~P!9mO[#jio#ji#O#ji#o#ji#p#ji#q#ji#r#ji#s#ji#u#ji#w#ji#y#ji#z#ji#}#ji(m#ji!Y#ji!Z#ji~OP$[OR#zO}#yO!P#{O!i#xO!m$[O#k;YO#l;ZO#m;ZO#n;ZO([VO(t#ji(u#ji~P&$zOk=VO})zO!P){O(t$}O(u%POP#jiR#ji!i#ji!m#ji#k#ji#l#ji#m#ji#n#ji([#ji~P&$zO#P$dOP(ZXR(ZX[(ZXk(ZXo(ZX}(ZX!P(ZX!i(ZX!m(ZX#O(ZX#k(ZX#l(ZX#m(ZX#n(ZX#o(ZX#p(ZX#q(ZX#r(ZX#s(ZX#u(ZX#w(ZX#y(ZX#z(ZX#}(ZX([(ZX(m(ZX(t(ZX(u(ZX!Y(ZX!Z(ZX~O#}$Oi!Y$Oi!Z$Oi~P#AbO#}!oi!Z!oi~P$(fOg'Xa!Y'Xa~P!0kO!Z7WO~O!Y'`a!Z'`a~P#AbOP]XR]X[]Xo]X}]X!P]X!V]X!Y]X!i]X!m]X#O]X#P]X#]]X#hfX#k]X#l]X#m]X#n]X#o]X#p]X#q]X#r]X#s]X#u]X#w]X#y]X#z]X$P]X([]X(m]X(t]X(u]X~O!d%WX#s%WX~P&+QO!d#vO(m'mO!Y'aa!h'aa~O!Y/hO!h(zi~O!Y/hO!d#vO!h(zi~Og$zq!Y$zq#]$zq#}$zq~P!0kO!V'ca!Y'ca~P#.aO!d7_O~O!Y/pO!V({i~P#.aO!Y/pO!V({i~O!V7cO~O!d#vO#s7hO~Oo7iO!d#vO(m'mO~O})zO!P){O(u%POk'fa(t'fa!Y'fa#]'fa~Og'fa#}'fa~P&/pO})zO!P){Ok'ha(t'ha(u'ha!Y'ha#]'ha~Og'ha#}'ha~P&0cO!V7lO~Og$|q!Y$|q#]$|q#}$|q~P!0kOa$my!Y$my'u$my's$my!V$my!h$mys$my![$my%f$my!d$my~P!9mO!d6[O~O!Y4uO![(|a~O![']OP$SaR$Sa[$Sao$Sa}$Sa!P$Sa!Y$Sa!i$Sa!m$Sa#O$Sa#k$Sa#l$Sa#m$Sa#n$Sa#o$Sa#p$Sa#q$Sa#r$Sa#s$Sa#u$Sa#w$Sa#y$Sa#z$Sa([$Sa(m$Sa(t$Sa(u$Sa~O%f6pO~P&2lOa#`y!Y#`y'u#`y's#`y!V#`y!h#`ys#`y![#`y%f#`y!d#`y~P!9mO[7qO~Ob7sO(O+kO(QTO(TUO~O!Y0wO!Z)Ti~O`7wO~O(`(xO!Y'lX!Z'lX~O!Y5^O!Z)Qa~O!Z8QO~P%4tOp!nO!P8RO(QTO(TUO(`!mO(j!sO~O#X8SO~O![1aO~O![1aO%f8UO~Ok8XO![1aO%f8UO~O[8^O!Y'oa!Z'oa~O!Y1lO!Z)Ri~O!h8bO~O!h8cO~O!h8fO~O!h8fO~P%[Oa8hO~O!d8iO~O!h8jO~O!Y(ri!Z(ri~P#AbOa%lO#]8rO'u%lO~O!Y(oy!h(oya(oy'u(oy~P!9mO!Y(fO!h(ny~O%f8uO~P&2lO![']O%f8uO~O#h$zqP$zqR$zq[$zqa$zqo$zq!Y$zq!i$zq!m$zq#O$zq#k$zq#l$zq#m$zq#n$zq#o$zq#p$zq#q$zq#r$zq#s$zq#u$zq#w$zq#y$zq#z$zq'u$zq([$zq(m$zq!h$zq!V$zq's$zq#]$zqs$zq![$zq%f$zq!d$zq~P#.aO#h'faP'faR'fa['faa'fao'fa!i'fa!m'fa#O'fa#k'fa#l'fa#m'fa#n'fa#o'fa#p'fa#q'fa#r'fa#s'fa#u'fa#w'fa#y'fa#z'fa'u'fa(['fa(m'fa!h'fa!V'fa's'fas'fa!['fa%f'fa!d'fa~P&/pO#h'haP'haR'ha['haa'hao'ha!i'ha!m'ha#O'ha#k'ha#l'ha#m'ha#n'ha#o'ha#p'ha#q'ha#r'ha#s'ha#u'ha#w'ha#y'ha#z'ha'u'ha(['ha(m'ha!h'ha!V'ha's'has'ha!['ha%f'ha!d'ha~P&0cO#h$|qP$|qR$|q[$|qa$|qo$|q!Y$|q!i$|q!m$|q#O$|q#k$|q#l$|q#m$|q#n$|q#o$|q#p$|q#q$|q#r$|q#s$|q#u$|q#w$|q#y$|q#z$|q'u$|q([$|q(m$|q!h$|q!V$|q's$|q#]$|qs$|q![$|q%f$|q!d$|q~P#.aO!Y'Ui!h'Ui~P!9mO#}#`q!Y#`q!Z#`q~P#AbO(t$}OP%^aR%^a[%^ao%^a!i%^a!m%^a#O%^a#k%^a#l%^a#m%^a#n%^a#o%^a#p%^a#q%^a#r%^a#s%^a#u%^a#w%^a#y%^a#z%^a#}%^a([%^a(m%^a!Y%^a!Z%^a~Ok%^a}%^a!P%^a(u%^a~P&CoO(u%POP%`aR%`a[%`ao%`a!i%`a!m%`a#O%`a#k%`a#l%`a#m%`a#n%`a#o%`a#p%`a#q%`a#r%`a#s%`a#u%`a#w%`a#y%`a#z%`a#}%`a([%`a(m%`a!Y%`a!Z%`a~Ok%`a}%`a!P%`a(t%`a~P&EsOk=VO})zO!P){O(u%PO~P&CoOk=VO})zO!P){O(t$}O~P&EsOR0`O}0`O!P0aO#P$dOPza[zakzaoza!iza!mza#Oza#kza#lza#mza#nza#oza#pza#qza#rza#sza#uza#wza#yza#zza#}za([za(mza(tza(uza!Yza!Zza~O})zO!P){OP$qaR$qa[$qak$qao$qa!i$qa!m$qa#O$qa#k$qa#l$qa#m$qa#n$qa#o$qa#p$qa#q$qa#r$qa#s$qa#u$qa#w$qa#y$qa#z$qa#}$qa([$qa(m$qa(t$qa(u$qa!Y$qa!Z$qa~O})zO!P){OP$saR$sa[$sak$sao$sa!i$sa!m$sa#O$sa#k$sa#l$sa#m$sa#n$sa#o$sa#p$sa#q$sa#r$sa#s$sa#u$sa#w$sa#y$sa#z$sa#}$sa([$sa(m$sa(t$sa(u$sa!Y$sa!Z$sa~Ok=VO})zO!P){O(t$}O(u%PO~OP%RaR%Ra[%Rao%Ra!i%Ra!m%Ra#O%Ra#k%Ra#l%Ra#m%Ra#n%Ra#o%Ra#p%Ra#q%Ra#r%Ra#s%Ra#u%Ra#w%Ra#y%Ra#z%Ra#}%Ra([%Ra(m%Ra!Y%Ra!Z%Ra~P&NlO#}$lq!Y$lq!Z$lq~P#AbO#}$mq!Y$mq!Z$mq~P#AbO!Z9SO~O#}9TO~P!0kO!d#vO!Y'ai!h'ai~O!d#vO(m'mO!Y'ai!h'ai~O!Y/hO!h(zq~O!V'ci!Y'ci~P#.aO!Y/pO!V({q~Oo9[O!d#vO(m'mO~O!V9]O~P#.aO!V9]O~O!d#vO#s9bO~Og(Yy!Y(Yy~P!0kO!Y'ja!['ja~P#.aOa%Yq![%Yq'u%Yq!Y%Yq~P#.aO[9dO~O!Y0wO!Z)Tq~O#]9hO!Y'la!Z'la~O!Y5^O!Z)Qi~P#AbO!P4hO~O![1aO%f9lO~O(QTO(TUO(`9qO~O!Y1lO!Z)Rq~O!h9tO~O!h9uO~O!h9vO~O!h9vO~P%[O#]9yO!Y#ey!Z#ey~O!Y#ey!Z#ey~P#AbO%f:OO~P&2lO![']O%f:OO~O#}#{y!Y#{y!Z#{y~P#AbOP$ziR$zi[$zio$zi!i$zi!m$zi#O$zi#k$zi#l$zi#m$zi#n$zi#o$zi#p$zi#q$zi#r$zi#s$zi#u$zi#w$zi#y$zi#z$zi#}$zi([$zi(m$zi!Y$zi!Z$zi~P&NlO})zO!P){O(u%POP'eaR'ea['eak'eao'ea!i'ea!m'ea#O'ea#k'ea#l'ea#m'ea#n'ea#o'ea#p'ea#q'ea#r'ea#s'ea#u'ea#w'ea#y'ea#z'ea#}'ea(['ea(m'ea(t'ea!Y'ea!Z'ea~O})zO!P){OP'gaR'ga['gak'gao'ga!i'ga!m'ga#O'ga#k'ga#l'ga#m'ga#n'ga#o'ga#p'ga#q'ga#r'ga#s'ga#u'ga#w'ga#y'ga#z'ga#}'ga(['ga(m'ga(t'ga(u'ga!Y'ga!Z'ga~O(t$}OP%^iR%^i[%^ik%^io%^i}%^i!P%^i!i%^i!m%^i#O%^i#k%^i#l%^i#m%^i#n%^i#o%^i#p%^i#q%^i#r%^i#s%^i#u%^i#w%^i#y%^i#z%^i#}%^i([%^i(m%^i(u%^i!Y%^i!Z%^i~O(u%POP%`iR%`i[%`ik%`io%`i}%`i!P%`i!i%`i!m%`i#O%`i#k%`i#l%`i#m%`i#n%`i#o%`i#p%`i#q%`i#r%`i#s%`i#u%`i#w%`i#y%`i#z%`i#}%`i([%`i(m%`i(t%`i!Y%`i!Z%`i~O#}$my!Y$my!Z$my~P#AbO#}#`y!Y#`y!Z#`y~P#AbO!d#vO!Y'aq!h'aq~O!Y/hO!h(zy~O!V'cq!Y'cq~P#.aOo:YO!d#vO(m'mO~O!V:ZO~P#.aO!V:ZO~O!Y0wO!Z)Ty~O!Y5^O!Z)Qq~O![1aO%f:cO~O!h:fO~O%f:kO~P&2lOP$zqR$zq[$zqo$zq!i$zq!m$zq#O$zq#k$zq#l$zq#m$zq#n$zq#o$zq#p$zq#q$zq#r$zq#s$zq#u$zq#w$zq#y$zq#z$zq#}$zq([$zq(m$zq!Y$zq!Z$zq~P&NlO})zO!P){O(u%POP'faR'fa['fak'fao'fa!i'fa!m'fa#O'fa#k'fa#l'fa#m'fa#n'fa#o'fa#p'fa#q'fa#r'fa#s'fa#u'fa#w'fa#y'fa#z'fa#}'fa(['fa(m'fa(t'fa!Y'fa!Z'fa~O})zO!P){OP'haR'ha['hak'hao'ha!i'ha!m'ha#O'ha#k'ha#l'ha#m'ha#n'ha#o'ha#p'ha#q'ha#r'ha#s'ha#u'ha#w'ha#y'ha#z'ha#}'ha(['ha(m'ha(t'ha(u'ha!Y'ha!Z'ha~OP$|qR$|q[$|qo$|q!i$|q!m$|q#O$|q#k$|q#l$|q#m$|q#n$|q#o$|q#p$|q#q$|q#r$|q#s$|q#u$|q#w$|q#y$|q#z$|q#}$|q([$|q(m$|q!Y$|q!Z$|q~P&NlOg%b!Z!Y%b!Z#]%b!Z#}%b!Z~P!0kOo:oO!d#vO(m'mO~O!V:pO~P#.aO!Y'lq!Z'lq~P#AbO!Y#e!Z!Z#e!Z~P#AbO#h%b!ZP%b!ZR%b!Z[%b!Za%b!Zo%b!Z!Y%b!Z!i%b!Z!m%b!Z#O%b!Z#k%b!Z#l%b!Z#m%b!Z#n%b!Z#o%b!Z#p%b!Z#q%b!Z#r%b!Z#s%b!Z#u%b!Z#w%b!Z#y%b!Z#z%b!Z'u%b!Z([%b!Z(m%b!Z!h%b!Z!V%b!Z's%b!Z#]%b!Zs%b!Z![%b!Z%f%b!Z!d%b!Z~P#.aOo:xO!d#vO(m'mO~OP%b!ZR%b!Z[%b!Zo%b!Z!i%b!Z!m%b!Z#O%b!Z#k%b!Z#l%b!Z#m%b!Z#n%b!Z#o%b!Z#p%b!Z#q%b!Z#r%b!Z#s%b!Z#u%b!Z#w%b!Z#y%b!Z#z%b!Z#}%b!Z([%b!Z(m%b!Z!Y%b!Z!Z%b!Z~P&NlOs(aX~P1qO}%pO~P!(oO(P!lO~P!(oO!VfX!YfX#]fX~P&+QOP]XR]X[]Xo]X}]X!P]X!Y]X!YfX!i]X!m]X#O]X#P]X#]]X#]fX#hfX#k]X#l]X#m]X#n]X#o]X#p]X#q]X#r]X#s]X#u]X#w]X#y]X#z]X$P]X([]X(m]X(t]X(u]X~O!dfX!h]X!hfX(mfX~P'BxOP;POQ;POSfOd<zOe!iOmkOo;POpkOqkOwkOy;PO{;PO!PWO!TkO!UkO![XO!f;SO!iZO!l;PO!m;PO!n;PO!p;TO!r;WO!u!hO$V!kO(O)XO(QTO(TUO([VO(j[O(y<xO~O!Y;dO!Z$oa~Oh%VOm%WOo%XOp$tOq$tOw%YOy%ZO{;oO!P${O![$|O!f=PO!i$xO#g;uO$V%_O$r;qO$t;sO$w%`O(O(rO(QTO(TUO([$uO(t$}O(u%PO~O#t)`O~P'GnOo!bX(m!bX~P# ZO!Z]X!ZfX~P'BxO!VfX!V$xX!YfX!Y$xX#]fX~P!/gO#h;XO~O!d#vO#h;XO~O#];iO~O#s;]O~O#];xO!Y(rX!Z(rX~O#];iO!Y(pX!Z(pX~O#h;yO~Og;{O~P!0kO#h<RO~O#h<SO~O!d#vO#h<TO~O!d#vO#h;yO~O#}<UO~P#AbO#h<VO~O#h<WO~O#h<]O~O#h<^O~O#h<_O~O#h<`O~O#}<aO~P!0kO#}<bO~P!0kO#P#Q#R#T#U#X#f#g#r(y$r$t$w%Z%e%f%g%n%p%s%t%v%x~'yT#l!U'w(P#mp#k#no}'x$['x(O$^(`~",goto:"$4Q)XPPPPPP)YPP)]P)nP+O/PPPPP5xPP6`PP<V?mP@QP@QPPP@QPBRP@QP@QP@QPBVPB[PByPGrPPPGvPPPPGvJxPPPKOKzPGvPGvPPNYGvPPPGvPGvP!!aGvP!%v!&{!'UP!'x!'|!'x!+YPPPPPPP!+y!&{PP!,Z!-gP!0jGvGv!0o!3z!8b!8b!<`PPP!<hGvPPPPPPPPPPP!?vP!ATPPGv!BfPGvPGvGvGvGvGvPGv!CxP!GRP!JWP!J[!Jf!Jj!JjP!GOP!Jn!JnP!MsP!MwGvGv!M}##RBV@QP@QP@Q@QP#$_@Q@Q#&j@Q#)Z@Q#+`@Q@Q#,O#.]#.]#.b#.k#.]#.wP#.]P@Q#/a@Q#3S@Q@Q5xPPP#6{PPP#7f#7fP#7fP#7|#7fPP#8SP#7yP#7y#8g#7y#9R#9X5u)]#9[)]P#9c#9c#9cP)]P)]P)]P)]PP)]P#9i#9lP#9l)]P#9pP#9sP)]P)]P)]P)]P)]P)])]PP#9y#:P#:[#:b#:h#:n#:t#;S#;Y#;d#;j#;t#;z#<[#<b#=S#=f#=l#=r#>Q#>g#@V#@e#@l#BR#Ba#C|#D[#Db#Dh#Dn#Dx#EO#EU#E`#Er#ExPPPPPPPPPP#FOPPPPPPP#Fs#Iz#KZ#Kb#KjPPP$!sP$!|$%t$,^$,a$,d$-P$-S$-Z$-cP$-i$-lP$.Y$.^$/U$0d$0i$1PPP$1U$1[$1`P$1c$1g$1k$2a$2x$3a$3e$3h$3k$3q$3t$3x$3|R!|RoqOXst!Z#d%k&o&q&r&t,k,p1|2PY!vQ']-]1a5eQ%rvQ%zyQ&R|Q&g!VS'T!e-TQ'c!iS'i!r!yU*e$|*V*jQ+i%{Q+v&TQ,[&aQ-Z'[Q-e'dQ-m'jQ0R*lQ1k,]R;v;T%QdOPWXYZstuvw!Z!`!g!o#S#W#Z#d#o#u#x#{$O$P$Q$R$S$T$U$V$W$X$_$a$e%k%r&P&h&k&o&q&r&t&x'Q'_'o(P(R(X(`(t(v(z)y+R+V,h,k,p-a-i-w-}.l.s/f0a0g0v1d1t1u1w1y1|2P2R2r2x3^5b5m5}6O6R6f8R8X8h8rS#q];Q!r)Z$Z$n'U)o,|-P.}2b3u5`6]9h9y;P;S;T;W;X;Y;Z;[;];^;_;`;a;b;c;d;f;i;v;x;y;{<T<U<_<`<{U*y%[;n;oQ+n%}Q,^&dQ,e&lQ0m+aQ0q+cQ0|+oQ1s,cQ3Q._Q5O0wQ5t1lQ6r3UQ7s5PR8x6t'OkOPWXYZstuvw!Z!`!g!o#S#W#Z#d#o#u#x#{$O$P$Q$R$S$T$U$V$W$X$Z$_$a$e$n%k%r&P&h&k&l&o&q&r&t&x'Q'U'_'o(P(R(X(`(t(v(z)o)y+R+V+a,h,k,p,|-P-a-i-w-}._.l.s.}/f0a0g0v1d1t1u1w1y1|2P2R2b2r2x3U3^3u5`5b5m5}6O6R6]6f6t8R8X8h8r9h9y;P;S;T;W;X;Y;Z;[;];^;_;`;a;b;c;d;f;i;v;x;y;{<T<U<_<`<{t!nQ!r!v!y!z'T'[']'i'j'k-T-Z-]-m1a5e5g$|$ti#v$b$c$d$x${%O%Q%]%^%b)u){)}*P*R*U*[*b*r*s+`+c+z+}.^.w/]/e/o/p/r0V0X0d1W1Z1c3T3}4Y4b4m4u4x5l6p7_7h8U8u9T9b9l:O:c:k;g;h;j;k;l;m;p;q;r;s;t;u;|;}<O<P<R<S<V<W<X<Y<Z<[<]<^<a<b<x=Q=R=U=VQ&U|Q'R!eU'X%g*V-WQ+n%}Q,^&dQ0c*|Q0|+oQ1R+uQ1r,bQ1s,cQ5O0wQ5X1TQ5t1lQ5w1nQ5x1qQ7s5PQ7v5UQ8a5zQ9g7wR9r8^rnOXst!V!Z#d%k&f&o&q&r&t,k,p1|2PR,`&h&x^OPXYstuvwz!Z!`!g!j!o#S#d#o#u#x#{$O$P$Q$R$S$T$U$V$W$X$Z$_$a$e$n%k%r&P&h&k&l&o&q&r&t&x'Q'_'o(R(X(`(t(v(z)o)y+R+V+a,h,k,p,|-P-a-i-w-}._.l.s.}/f0a0g0v1d1t1u1w1y1|2P2R2b2r2x3U3^3u5`5b5m5}6O6R6]6f6t8R8X8h8r9h9y;P;S;T;W;X;Y;Z;[;];^;_;`;a;b;c;d;f;i;v;x;y;{<T<U<_<`<z<{[#]WZ#W#Z'U(P!b%hm#h#i#l$x%c%f(Y(d(e(f*U*Y*]+T+U+W,g,}-{.R.S.T.V/e/h2U2|2}4Q6[6mQ%uxQ%yyS&O|&TQ&[!TQ'`!hQ'b!iQ(m#sS+h%z%{Q+l%}Q,V&_Q,Z&aS-d'c'dQ.a(nQ0u+iQ0{+oQ0}+pQ1Q+tQ1f,WS1j,[,]Q2n-eQ4}0wQ5R0zQ5W1SQ5s1kQ7r5PQ7u5TQ9c7qR:^9d!O$zi$d%O%Q%]%^%b)}*P*[*r*s.w/o0V0X0d3}4m9T<x=Q=R!S%wy!i!u%y%z%{'S'b'c'd'h'r*d+h+i-Q-d-e-l/y0u2g2n2u4dQ+b%uQ+{&XQ,O&YQ,Y&aQ.`(mQ1e,VU1i,Z,[,]Q3V.aQ5n1fS5r1j1kQ8]5s#^<|#v$b$c$x${)u){*R*U*b+`+c+z+}.^/]/e/p/r1W1Z1c3T4Y4b4u4x5l6p7_7h8U8u9b9l:O:c:k;j;l;p;r;t;|<O<R<V<X<Z<]<a=U=Vo<};g;h;k;m;q;s;u;}<P<S<W<Y<[<^<bW%Ti%V*t<xS&X!Q&fQ&Y!RQ&Z!SR+y&V$}%Si#v$b$c$d$x${%O%Q%]%^%b)u){)}*P*R*U*[*b*r*s+`+c+z+}.^.w/]/e/o/p/r0V0X0d1W1Z1c3T3}4Y4b4m4u4x5l6p7_7h8U8u9T9b9l:O:c:k;g;h;j;k;l;m;p;q;r;s;t;u;|;}<O<P<R<S<V<W<X<Y<Z<[<]<^<a<b<x=Q=R=U=VT)v$u)wV*y%[;n;oW'X!e%g*V-WS(y#y#zQ+]%pQ+s&QS.Y(i(jQ1[,PQ4n0`R7{5^'OkOPWXYZstuvw!Z!`!g!o#S#W#Z#d#o#u#x#{$O$P$Q$R$S$T$U$V$W$X$Z$_$a$e$n%k%r&P&h&k&l&o&q&r&t&x'Q'U'_'o(P(R(X(`(t(v(z)o)y+R+V+a,h,k,p,|-P-a-i-w-}._.l.s.}/f0a0g0v1d1t1u1w1y1|2P2R2b2r2x3U3^3u5`5b5m5}6O6R6]6f6t8R8X8h8r9h9y;P;S;T;W;X;Y;Z;[;];^;_;`;a;b;c;d;f;i;v;x;y;{<T<U<_<`<{$i$^c#Y#e%o%q%s(O(U(p(u(})O)P)Q)R)S)T)U)V)W)Y)[)^)c)m+^+r-R-p-u-z-|.k.n.r.t.u.v/X0e2]2`2p2w3]3b3c3d3e3f3g3h3i3j3k3l3m3n3q3r3y4r4{6_6e6j6y6z7T7U7}8l8p8z9Q9R9{:`:g;R<oT#TV#U'PkOPWXYZstuvw!Z!`!g!o#S#W#Z#d#o#u#x#{$O$P$Q$R$S$T$U$V$W$X$Z$_$a$e$n%k%r&P&h&k&l&o&q&r&t&x'Q'U'_'o(P(R(X(`(t(v(z)o)y+R+V+a,h,k,p,|-P-a-i-w-}._.l.s.}/f0a0g0v1d1t1u1w1y1|2P2R2b2r2x3U3^3u5`5b5m5}6O6R6]6f6t8R8X8h8r9h9y;P;S;T;W;X;Y;Z;[;];^;_;`;a;b;c;d;f;i;v;x;y;{<T<U<_<`<{Q'V!eR2c-Tv!nQ!e!r!v!y!z'T'[']'i'j'k-T-Z-]-m1a5e5gU*d$|*V*jS/y*e*lQ0S*mQ1^,RQ4d0RR4g0UnqOXst!Z#d%k&o&q&r&t,k,p1|2PQ&v!^Q's!xS(o#u;XQ+f%xQ,T&[Q,U&^Q-b'aQ-o'lS.j(t;yS0f+R<TQ0s+gQ1`,SQ2T,rQ2V,sQ2_-OQ2l-cQ2o-gS4s0g<_Q4y0tS4|0v<`Q6^2aQ6b2mQ6g2tQ7p4zQ8m6`Q8n6cQ8q6hR9x8j$d$]c#Y#e%q%s(O(U(p(u(})O)P)Q)R)S)T)U)V)W)Y)[)^)c)m+^+r-R-p-u-z-|.k.n.r.u.v/X0e2]2`2p2w3]3b3c3d3e3f3g3h3i3j3k3l3m3n3q3r3y4r4{6_6e6j6y6z7T7U7}8l8p8z9Q9R9{:`:g;R<oS(k#p'fQ({#zS+[%o.tS.Z(j(lR3O.['OkOPWXYZstuvw!Z!`!g!o#S#W#Z#d#o#u#x#{$O$P$Q$R$S$T$U$V$W$X$Z$_$a$e$n%k%r&P&h&k&l&o&q&r&t&x'Q'U'_'o(P(R(X(`(t(v(z)o)y+R+V+a,h,k,p,|-P-a-i-w-}._.l.s.}/f0a0g0v1d1t1u1w1y1|2P2R2b2r2x3U3^3u5`5b5m5}6O6R6]6f6t8R8X8h8r9h9y;P;S;T;W;X;Y;Z;[;];^;_;`;a;b;c;d;f;i;v;x;y;{<T<U<_<`<{S#q];QQ&q!XQ&r!YQ&t![Q&u!]R1{,nQ'^!hQ+_%uQ-`'`S.](m+bQ2j-_W3S.`.a0l0nQ6a2kW6n3P3R3V4wU8t6o6q6sU9}8v8w8yS:i9|:PQ:t:jR:z:uU!wQ']-]T5c1a5e!Q_OXZ`st!V!Z#d#h%c%k&f&h&o&q&r&t(f,k,p.S1|2P]!pQ!r']-]1a5eT#q];Q%[{OPWXYZstuvw!Z!`!g!o#S#W#Z#d#o#u#x#{$O$P$Q$R$S$T$U$V$W$X$_$a$e%k%r&P&h&k&l&o&q&r&t&x'Q'_'o(P(R(X(`(t(v(z)y+R+V+a,h,k,p-a-i-w-}._.l.s/f0a0g0v1d1t1u1w1y1|2P2R2r2x3U3^5b5m5}6O6R6f6t8R8X8h8rS(y#y#zS.Y(i(j!s<f$Z$n'U)o,|-P.}2b3u5`6]9h9y;P;S;T;W;X;Y;Z;[;];^;_;`;a;b;c;d;f;i;v;x;y;{<T<U<_<`<{U$fd)Z,eS(l#p'fU*q%R(s3pU0b*x.f7PQ4w0mQ6o3QQ8w6rR:P8xm!tQ!r!v!y!z']'i'j'k-]-m1a5e5gQ'q!uS(b#g1vS-k'h'tQ/k*XQ/w*dQ2v-nQ4U/lS4_/x0SQ7Z4PS7f4e4gQ9V7[Q9Z7cQ9`7iS:X9[9]S:n:Y:ZS:w:o:pR:}:xQ#wbQ'p!uS(a#g1vS(c#m+QQ+S%dQ+d%vQ+j%|U-j'h'q'tQ.O(bQ/j*XQ/v*dQ/|*gQ0r+eQ1g,XS2s-k-nQ2{.WS4T/k/lS4^/w0SQ4a/{Q4c/}Q5p1hQ6i2vQ7Y4PQ7^4US7b4_4gQ7g4fQ8Z5qS9U7Z7[Q9Y7cQ9^7fQ9a7jQ9o8[Q:V9VS:W9Z9]Q:[9`Q:e9pS:m:X:ZS:v:n:pQ:|:wQ;O:}Q<i<dQ<t<mR<u<nV!wQ']-]%[aOPWXYZstuvw!Z!`!g!o#S#W#Z#d#o#u#x#{$O$P$Q$R$S$T$U$V$W$X$_$a$e%k%r&P&h&k&l&o&q&r&t&x'Q'_'o(P(R(X(`(t(v(z)y+R+V+a,h,k,p-a-i-w-}._.l.s/f0a0g0v1d1t1u1w1y1|2P2R2r2x3U3^5b5m5}6O6R6f6t8R8X8h8rS#wz!j!r<c$Z$n'U)o,|-P.}2b3u5`6]9h9y;P;S;T;W;X;Y;Z;[;];^;_;`;a;b;c;d;f;i;v;x;y;{<T<U<_<`<{R<i<z%[bOPWXYZstuvw!Z!`!g!o#S#W#Z#d#o#u#x#{$O$P$Q$R$S$T$U$V$W$X$_$a$e%k%r&P&h&k&l&o&q&r&t&x'Q'_'o(P(R(X(`(t(v(z)y+R+V+a,h,k,p-a-i-w-}._.l.s/f0a0g0v1d1t1u1w1y1|2P2R2r2x3U3^5b5m5}6O6R6f6t8R8X8h8rQ%dj!S%vy!i!u%y%z%{'S'b'c'd'h'r*d+h+i-Q-d-e-l/y0u2g2n2u4dS%|z!jQ+e%wQ,X&aW1h,Y,Z,[,]U5q1i1j1kS8[5r5sQ9p8]!r<d$Z$n'U)o,|-P.}2b3u5`6]9h9y;P;S;T;W;X;Y;Z;[;];^;_;`;a;b;c;d;f;i;v;x;y;{<T<U<_<`<{Q<m<yR<n<z%OeOPXYstuvw!Z!`!g!o#S#d#o#u#x#{$O$P$Q$R$S$T$U$V$W$X$_$a$e%k%r&P&h&k&o&q&r&t&x'Q'_'o(R(X(`(t(v(z)y+R+V+a,h,k,p-a-i-w-}._.l.s/f0a0g0v1d1t1u1w1y1|2P2R2r2x3U3^5b5m5}6O6R6f6t8R8X8h8rY#bWZ#W#Z(P!b%hm#h#i#l$x%c%f(Y(d(e(f*U*Y*]+T+U+W,g,}-{.R.S.T.V/e/h2U2|2}4Q6[6mQ,f&l!p<e$Z$n)o,|-P.}2b3u5`6]9h9y;P;S;T;W;X;Y;Z;[;];^;_;`;a;b;c;d;f;i;v;x;y;{<T<U<_<`<{R<h'UU'Y!e%g*VR2e-W%QdOPWXYZstuvw!Z!`!g!o#S#W#Z#d#o#u#x#{$O$P$Q$R$S$T$U$V$W$X$_$a$e%k%r&P&h&k&o&q&r&t&x'Q'_'o(P(R(X(`(t(v(z)y+R+V,h,k,p-a-i-w-}.l.s/f0a0g0v1d1t1u1w1y1|2P2R2r2x3^5b5m5}6O6R6f8R8X8h8r!r)Z$Z$n'U)o,|-P.}2b3u5`6]9h9y;P;S;T;W;X;Y;Z;[;];^;_;`;a;b;c;d;f;i;v;x;y;{<T<U<_<`<{Q,e&lQ0m+aQ3Q._Q6r3UR8x6t!b$Tc#Y%o(O(U(p(u)V)W)[)c+r-p-u-z-|.k.n/X0e2p2w3]3m4r4{6e6j6y8p9{;R!P;_)Y)m-R.t2]2`3b3k3l3q3y6_6z7T7U7}8l8z9Q9R:`:g<o!f$Vc#Y%o(O(U(p(u)S)T)V)W)[)c+r-p-u-z-|.k.n/X0e2p2w3]3m4r4{6e6j6y8p9{;R!T;a)Y)m-R.t2]2`3b3h3i3k3l3q3y6_6z7T7U7}8l8z9Q9R:`:g<o!^$Zc#Y%o(O(U(p(u)[)c+r-p-u-z-|.k.n/X0e2p2w3]3m4r4{6e6j6y8p9{;RQ3}/cz<{)Y)m-R.t2]2`3b3q3y6_6z7T7U7}8l8z9Q9R:`:g<oQ=Q=SR=R=T'OkOPWXYZstuvw!Z!`!g!o#S#W#Z#d#o#u#x#{$O$P$Q$R$S$T$U$V$W$X$Z$_$a$e$n%k%r&P&h&k&l&o&q&r&t&x'Q'U'_'o(P(R(X(`(t(v(z)o)y+R+V+a,h,k,p,|-P-a-i-w-}._.l.s.}/f0a0g0v1d1t1u1w1y1|2P2R2b2r2x3U3^3u5`5b5m5}6O6R6]6f6t8R8X8h8r9h9y;P;S;T;W;X;Y;Z;[;];^;_;`;a;b;c;d;f;i;v;x;y;{<T<U<_<`<{S$oh$pR3v.|'VgOPWXYZhstuvw!Z!`!g!o#S#W#Z#d#o#u#x#{$O$P$Q$R$S$T$U$V$W$X$Z$_$a$e$n$p%k%r&P&h&k&l&o&q&r&t&x'Q'U'_'o(P(R(X(`(t(v(z)o)y+R+V+a,h,k,p,|-P-a-i-w-}._.l.s.|.}/f0a0g0v1d1t1u1w1y1|2P2R2b2r2x3U3^3u5`5b5m5}6O6R6]6f6t8R8X8h8r9h9y;P;S;T;W;X;Y;Z;[;];^;_;`;a;b;c;d;f;i;v;x;y;{<T<U<_<`<{T$kf$qQ$ifS)f$l)jR)r$qT$jf$qT)h$l)j'VhOPWXYZhstuvw!Z!`!g!o#S#W#Z#d#o#u#x#{$O$P$Q$R$S$T$U$V$W$X$Z$_$a$e$n$p%k%r&P&h&k&l&o&q&r&t&x'Q'U'_'o(P(R(X(`(t(v(z)o)y+R+V+a,h,k,p,|-P-a-i-w-}._.l.s.|.}/f0a0g0v1d1t1u1w1y1|2P2R2b2r2x3U3^3u5`5b5m5}6O6R6]6f6t8R8X8h8r9h9y;P;S;T;W;X;Y;Z;[;];^;_;`;a;b;c;d;f;i;v;x;y;{<T<U<_<`<{T$oh$pQ$rhR)q$p%[jOPWXYZstuvw!Z!`!g!o#S#W#Z#d#o#u#x#{$O$P$Q$R$S$T$U$V$W$X$_$a$e%k%r&P&h&k&l&o&q&r&t&x'Q'_'o(P(R(X(`(t(v(z)y+R+V+a,h,k,p-a-i-w-}._.l.s/f0a0g0v1d1t1u1w1y1|2P2R2r2x3U3^5b5m5}6O6R6f6t8R8X8h8r!s<y$Z$n'U)o,|-P.}2b3u5`6]9h9y;P;S;T;W;X;Y;Z;[;];^;_;`;a;b;c;d;f;i;v;x;y;{<T<U<_<`<{#elOPXZst!Z!`!o#S#d#o#{$n%k&h&k&l&o&q&r&t&x'Q'_(z)o+V+a,h,k,p-a._.}/f0a1d1t1u1w1y1|2P2R3U3u5b5m5}6O6R6t8R8X8h!O%Ri$d%O%Q%]%^%b)}*P*[*r*s.w/o0V0X0d3}4m9T<x=Q=R#^(s#v$b$c$x${)u){*R*U*b+`+c+z+}.^/]/e/p/r1W1Z1c3T4Y4b4u4x5l6p7_7h8U8u9b9l:O:c:k;j;l;p;r;t;|<O<R<V<X<Z<]<a=U=VQ*}%`Q/Y)zo3p;g;h;k;m;q;s;u;}<P<S<W<Y<[<^<b!O$yi$d%O%Q%]%^%b)}*P*[*r*s.w/o0V0X0d3}4m9T<x=Q=RQ*^$zU*g$|*V*jQ+O%aQ/}*h#^<k#v$b$c$x${)u){*R*U*b+`+c+z+}.^/]/e/p/r1W1Z1c3T4Y4b4u4x5l6p7_7h8U8u9b9l:O:c:k;j;l;p;r;t;|<O<R<V<X<Z<]<a=U=Vn<l;g;h;k;m;q;s;u;}<P<S<W<Y<[<^<bQ<p<|Q<q<}Q<r=OR<s=P!O%Ri$d%O%Q%]%^%b)}*P*[*r*s.w/o0V0X0d3}4m9T<x=Q=R#^(s#v$b$c$x${)u){*R*U*b+`+c+z+}.^/]/e/p/r1W1Z1c3T4Y4b4u4x5l6p7_7h8U8u9b9l:O:c:k;j;l;p;r;t;|<O<R<V<X<Z<]<a=U=Vo3p;g;h;k;m;q;s;u;}<P<S<W<Y<[<^<bnoOXst!Z#d%k&o&q&r&t,k,p1|2PS*a${*UQ,y&{Q,z&}R4X/p$|%Si#v$b$c$d$x${%O%Q%]%^%b)u){)}*P*R*U*[*b*r*s+`+c+z+}.^.w/]/e/o/p/r0V0X0d1W1Z1c3T3}4Y4b4m4u4x5l6p7_7h8U8u9T9b9l:O:c:k;g;h;j;k;l;m;p;q;r;s;t;u;|;}<O<P<R<S<V<W<X<Y<Z<[<]<^<a<b<x=Q=R=U=VQ+|&YQ1Y,OQ5[1XR7z5]V*i$|*V*jU*i$|*V*jT5d1a5eU/{*f/f5bS4f0T8RR7j4hQ+d%vQ/|*gQ0r+eQ1g,XQ5p1hQ8Z5qQ9o8[R:e9p!O%Oi$d%O%Q%]%^%b)}*P*[*r*s.w/o0V0X0d3}4m9T<x=Q=Rr)}$v)a*O*p+P/n0Z0[3s4V4q7X7k:U<j<v<wS0V*o0W#^;j#v$b$c$x${)u){*R*U*b+`+c+z+}.^/]/e/p/r1W1Z1c3T4Y4b4u4x5l6p7_7h8U8u9b9l:O:c:k;j;l;p;r;t;|<O<R<V<X<Z<]<a=U=Vn;k;g;h;k;m;q;s;u;}<P<S<W<Y<[<^<b!`;|(q)_*W*`.b.e.i/U/Z/c/s0k1V1X3Y4W4[5Z5]6u6x7`7d7m7o9X9_:]:l=S=T`;}3o6{7O7S8{:Q:T:{S<X.d3ZT<Y6}9O!O%Qi$d%O%Q%]%^%b)}*P*[*r*s.w/o0V0X0d3}4m9T<x=Q=Rv*P$v)a*Q*o+P/_/n0Z0[3s4V4i4q7X7k:U<j<v<wS0X*p0Y#^;l#v$b$c$x${)u){*R*U*b+`+c+z+}.^/]/e/p/r1W1Z1c3T4Y4b4u4x5l6p7_7h8U8u9b9l:O:c:k;j;l;p;r;t;|<O<R<V<X<Z<]<a=U=Vn;m;g;h;k;m;q;s;u;}<P<S<W<Y<[<^<b!d<O(q)_*W*`.c.d.i/U/Z/c/s0k1V1X3W3Y4W4[5Z5]6u6v6x7`7d7m7o9X9_:]:l=S=Td<P3o6|6}7S8{8|:Q:R:T:{S<Z.e3[T<[7O9PrnOXst!V!Z#d%k&f&o&q&r&t,k,p1|2PQ&c!UR,h&lrnOXst!V!Z#d%k&f&o&q&r&t,k,p1|2PR&c!UQ,Q&ZR1U+ysnOXst!V!Z#d%k&f&o&q&r&t,k,p1|2PQ1b,VS5k1e1fU8T5i5j5nS9k8V8WS:a9j9mQ:q:bR:y:rQ&j!VR,a&fR5w1nS&O|&TR0}+pQ&o!WR,k&pR,q&uT1},p2PR,u&vQ,t&vR2W,uQ'v!{R-q'vSsOtQ#dXT%ns#dQ#OTR'x#OQ#RUR'z#RQ)w$uR/V)wQ#UVR'|#UQ#XWU(S#X(T-xQ(T#YR-x(UQ-U'VR2d-UQ.m(uS3_.m3`R3`.nQ-]']R2h-]Y!rQ']-]1a5eR'g!rQ.x)aR3t.xU#_W%f*UU(Z#_([-yQ([#`R-y(VQ-X'YR2f-Xt`OXst!V!Z#d%k&f&h&o&q&r&t,k,p1|2PS#hZ%cU#r`#h.SR.S(fQ(g#jQ.P(cW.X(g.P2y6kQ2y.QR6k2zQ)j$lR/O)jQ$phR)p$pQ$`cU)]$`-t;eQ-t;RR;e)mQ/i*XW4R/i4S7]9WU4S/j/k/lS7]4T4UR9W7^$Z)|$v(q)_)a*W*`*o*p*z*{+P.d.e.g.h.i/U/Z/_/a/c/n/s0Z0[0k1V1X3W3X3Y3o3s4V4W4[4i4k4q5Z5]6u6v6w6x6}7O7Q7R7S7X7`7d7k7m7o8{8|8}9X9_:Q:R:S:T:U:]:l:{<j<v<w=S=TQ/q*`U4Z/q4]7aQ4]/sR7a4[S*j$|*VR0P*jr*O$v)a*o*p+P/n0Z0[3s4V4q7X7k:U<j<v<w!`.b(q)_*W*`.d.e.i/U/Z/c/s0k1V1X3Y4W4[5Z5]6u6x7`7d7m7o9X9_:]:l=S=TU/`*O.b6{a6{3o6}7O7S8{:Q:T:{Q0W*oQ3Z.dU4j0W3Z9OR9O6}v*Q$v)a*o*p+P/_/n0Z0[3s4V4i4q7X7k:U<j<v<w!d.c(q)_*W*`.d.e.i/U/Z/c/s0k1V1X3W3Y4W4[5Z5]6u6v6x7`7d7m7o9X9_:]:l=S=TU/b*Q.c6|e6|3o6}7O7S8{8|:Q:R:T:{Q0Y*pQ3[.eU4l0Y3[9PR9P7OQ*u%UR0^*uQ4v0kR7n4vQ+X%iR0j+XQ5_1[S7|5_9iR9i7}Q,S&[R1_,SQ5e1aR8P5eQ1m,^S5u1m8_R8_5wQ0x+lW5Q0x5S7t9eQ5S0{Q7t5RR9e7uQ+q&OR1O+qQ2P,pR6V2PYrOXst#dQ&s!ZQ+Z%kQ,j&oQ,l&qQ,m&rQ,o&tQ1z,kS1},p2PR6U1|Q%mpQ&w!_Q&z!aQ&|!bQ'O!cQ'n!uQ+Y%jQ+f%xQ+x&UQ,`&jQ,w&yW-h'h'p'q'tQ-o'lQ0O*iQ0s+gS1p,a,dQ2X,vQ2Y,yQ2Z,zQ2o-gW2q-j-k-n-pQ4y0tQ5V1RQ5Y1VQ5o1gQ5y1rQ6T1{U6d2p2s2vQ6g2tQ7p4zQ7x5XQ7y5ZQ8O5dQ8Y5pQ8`5xS8o6e6iQ8q6hQ9f7vQ9n8ZQ9s8aQ9z8pQ:_9gQ:d9oQ:h9{R:s:eQ%xyQ'a!iQ'l!uU+g%y%z%{Q-O'SU-c'b'c'dS-g'h'rQ/u*dS0t+h+iQ2a-QS2m-d-eQ2t-lQ4`/yQ4z0uQ6`2gQ6c2nQ6h2uR7e4dS$wi<xR*v%VU%Ui%V<xR0]*tQ$viS(q#v+cS)_$b$cQ)a$dQ*W$xS*`${*UQ*o%OQ*p%QQ*z%]Q*{%^Q+P%bQ.d;jQ.e;lQ.g;pQ.h;rQ.i;tQ/U)uS/Z){/]Q/_)}Q/a*PQ/c*RQ/n*[S/s*b/eQ0Z*rQ0[*sh0k+`.^1c3T5l6p8U8u9l:O:c:kQ1V+zQ1X+}Q3W;|Q3X<OQ3Y<RS3o;g;hQ3s.wQ4V/oQ4W/pQ4[/rQ4i0VQ4k0XQ4q0dQ5Z1WQ5]1ZQ6u<VQ6v<XQ6w<ZQ6x<]Q6};kQ7O;mQ7Q;qQ7R;sQ7S;uQ7X3}Q7`4YQ7d4bQ7k4mQ7m4uQ7o4xQ8{<SQ8|;}Q8}<PQ9X7_Q9_7hQ:Q<WQ:R<YQ:S<[Q:T<^Q:U9TQ:]9bQ:l<aQ:{<bQ<j<xQ<v=QQ<w=RQ=S=UR=T=VQ*x%[Q.f;nR7P;onpOXst!Z#d%k&o&q&r&t,k,p1|2PQ!fPS#fZ#oQ&y!`U'e!o5b8RQ'{#SQ(|#{Q)n$nS,d&h&kQ,i&lQ,v&xQ,{'QQ-_'_Q.p(zQ/S)oS0h+V/fQ0n+aQ1x,hQ2k-aQ3R._Q3x.}Q4o0aQ5j1dQ5{1tQ5|1uQ6Q1wQ6S1yQ6X2RQ6s3UQ7V3uQ8W5mQ8d5}Q8e6OQ8g6RQ8y6tQ9m8XR9w8h#YcOPXZst!Z!`!o#d#o#{%k&h&k&l&o&q&r&t&x'Q'_(z+V+a,h,k,p-a._/f0a1d1t1u1w1y1|2P2R3U5b5m5}6O6R6t8R8X8hQ#YWQ#eYQ%ouQ%qvS%sw!gS(O#W(RQ(U#ZQ(p#uQ(u#xQ(}$OQ)O$PQ)P$QQ)Q$RQ)R$SQ)S$TQ)T$UQ)U$VQ)V$WQ)W$XQ)Y$ZQ)[$_Q)^$aQ)c$eW)m$n)o.}3uQ+^%rQ+r&PS-R'U2bQ-p'oS-u(P-wQ-z(XQ-|(`Q.k(tQ.n(vQ.r;PQ.t;SQ.u;TQ.v;WQ/X)yQ0e+RQ2],|Q2`-PQ2p-iQ2w-}Q3].lQ3b;XQ3c;YQ3d;ZQ3e;[Q3f;]Q3g;^Q3h;_Q3i;`Q3j;aQ3k;bQ3l;cQ3m.sQ3n;fQ3q;iQ3r;vQ3y;dQ4r0gQ4{0vQ6_;xQ6e2rQ6j2xQ6y3^Q6z;yQ7T;{Q7U<TQ7}5`Q8l6]Q8p6fQ8z<UQ9Q<_Q9R<`Q9{8rQ:`9hQ:g9yQ;R#SR<o<{R#[WR'W!el!tQ!r!v!y!z']'i'j'k-]-m1a5e5gS'S!e-TS-Q'T'[R2g-ZR(w#xQ!fQT-[']-]]!qQ!r']-]1a5eQ#p]R'f;QR)b$dY!uQ']-]1a5eQ'h!rS'r!v!yS't!z5gS-l'i'jQ-n'kR2u-mT#kZ%cS#jZ%cS%im,gU(c#h#i#lS.Q(d(eQ.U(fQ0i+WQ2z.RU2{.S.T.VS6l2|2}R8s6md#^W#W#Z%f(P(Y*U+T-{/er#gZm#h#i#l%c(d(e(f+W.R.S.T.V2|2}6mS*X$x*]Q/l*YQ1v,gQ2^,}Q4P/hQ6Z2UQ7[4QQ8k6[T<g'U+UV#aW%f*UU#`W%f*US(Q#W(YU(V#Z+T/eS-S'U+UT-v(P-{V'Z!e%g*VQ$lfR)t$qT)i$l)jR3w.|T*Z$x*]T*c${*UQ0l+`Q3P.^Q5i1cQ6q3TQ8V5lQ8v6pQ9j8UQ9|8uQ:b9lQ:j:OQ:r:cR:u:knqOXst!Z#d%k&o&q&r&t,k,p1|2PQ&i!VR,`&ftmOXst!U!V!Z#d%k&f&o&q&r&t,k,p1|2PR,g&lT%jm,gR1],PR,_&dQ&S|R+w&TR+m%}T&m!W&pT&n!W&pT2O,p2P",nodeNames:`⚠ ArithOp ArithOp ?. JSXStartTag LineComment BlockComment Script Hashbang ExportDeclaration export Star as VariableName String Escape from ; default FunctionDeclaration async function VariableDefinition > < TypeParamList TypeDefinition extends ThisType this LiteralType ArithOp Number BooleanLiteral TemplateType InterpolationEnd Interpolation InterpolationStart NullType null VoidType void TypeofType typeof MemberExpression . PropertyName [ TemplateString Escape Interpolation super RegExp ] ArrayExpression Spread , } { ObjectExpression Property async get set PropertyDefinition Block : NewTarget new NewExpression ) ( ArgList UnaryExpression delete LogicOp BitOp YieldExpression yield AwaitExpression await ParenthesizedExpression ClassExpression class ClassBody MethodDeclaration Decorator @ MemberExpression PrivatePropertyName CallExpression TypeArgList CompareOp < declare Privacy static abstract override PrivatePropertyDefinition PropertyDeclaration readonly accessor Optional TypeAnnotation Equals StaticBlock FunctionExpression ArrowFunction ParamList ParamList ArrayPattern ObjectPattern PatternProperty Privacy readonly Arrow MemberExpression BinaryExpression ArithOp ArithOp ArithOp ArithOp BitOp CompareOp instanceof satisfies in const CompareOp BitOp BitOp BitOp LogicOp LogicOp ConditionalExpression LogicOp LogicOp AssignmentExpression UpdateOp PostfixExpression CallExpression InstantiationExpression TaggedTemplateExpression DynamicImport import ImportMeta JSXElement JSXSelfCloseEndTag JSXSelfClosingTag JSXIdentifier JSXBuiltin JSXIdentifier JSXNamespacedName JSXMemberExpression JSXSpreadAttribute JSXAttribute JSXAttributeValue JSXEscape JSXEndTag JSXOpenTag JSXFragmentTag JSXText JSXEscape JSXStartCloseTag JSXCloseTag PrefixCast ArrowFunction TypeParamList SequenceExpression InstantiationExpression KeyofType keyof UniqueType unique ImportType InferredType infer TypeName ParenthesizedType FunctionSignature ParamList NewSignature IndexedType TupleType Label ArrayType ReadonlyType ObjectType MethodType PropertyType IndexSignature PropertyDefinition CallSignature TypePredicate is NewSignature new UnionType LogicOp IntersectionType LogicOp ConditionalType ParameterizedType ClassDeclaration abstract implements type VariableDeclaration let var using TypeAliasDeclaration InterfaceDeclaration interface EnumDeclaration enum EnumBody NamespaceDeclaration namespace module AmbientDeclaration declare GlobalDeclaration global ClassDeclaration ClassBody AmbientFunctionDeclaration ExportGroup VariableName VariableName ImportDeclaration ImportGroup ForStatement for ForSpec ForInSpec ForOfSpec of WhileStatement while WithStatement with DoStatement do IfStatement if else SwitchStatement switch SwitchBody CaseLabel case DefaultLabel TryStatement try CatchClause catch FinallyClause finally ReturnStatement return ThrowStatement throw BreakStatement break ContinueStatement continue DebuggerStatement debugger LabeledStatement ExpressionStatement SingleExpression SingleClassItem`,maxTerm:376,context:wMt,nodeProps:[[`isolate`,-8,5,6,14,34,36,48,50,52,``],[`group`,-26,9,17,19,65,204,208,212,213,215,218,221,231,233,239,241,243,245,248,254,260,262,264,266,268,270,271,`Statement`,-34,13,14,29,32,33,39,48,51,52,54,59,67,69,73,77,79,81,82,107,108,117,118,135,138,140,141,142,143,144,146,147,166,167,169,`Expression`,-23,28,30,34,38,40,42,171,173,175,176,178,179,180,182,183,184,186,187,188,198,200,202,203,`Type`,-3,85,100,106,`ClassItem`],[`openedBy`,23,`<`,35,`InterpolationStart`,53,`[`,57,`{`,70,`(`,159,`JSXStartCloseTag`],[`closedBy`,24,`>`,37,`InterpolationEnd`,47,`]`,58,`}`,71,`)`,164,`JSXEndTag`]],propSources:[kMt],skippedNodes:[0,5,6,274],repeatNodeCount:37,tokenData:"$Fq07[R!bOX%ZXY+gYZ-yZ[+g[]%Z]^.c^p%Zpq+gqr/mrs3cst:_tuEruvJSvwLkwx! Yxy!'iyz!(sz{!)}{|!,q|}!.O}!O!,q!O!P!/Y!P!Q!9j!Q!R#:O!R![#<_![!]#I_!]!^#Jk!^!_#Ku!_!`$![!`!a$$v!a!b$*T!b!c$,r!c!}Er!}#O$-|#O#P$/W#P#Q$4o#Q#R$5y#R#SEr#S#T$7W#T#o$8b#o#p$<r#p#q$=h#q#r$>x#r#s$@U#s$f%Z$f$g+g$g#BYEr#BY#BZ$A`#BZ$ISEr$IS$I_$A`$I_$I|Er$I|$I}$Dk$I}$JO$Dk$JO$JTEr$JT$JU$A`$JU$KVEr$KV$KW$A`$KW&FUEr&FU&FV$A`&FV;'SEr;'S;=`I|<%l?HTEr?HT?HU$A`?HUOEr(n%d_$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z&j&hT$h&jO!^&c!_#o&c#p;'S&c;'S;=`&w<%lO&c&j&zP;=`<%l&c'|'U]$h&j(U!bOY&}YZ&cZw&}wx&cx!^&}!^!_'}!_#O&}#O#P&c#P#o&}#o#p'}#p;'S&};'S;=`(l<%lO&}!b(SU(U!bOY'}Zw'}x#O'}#P;'S'};'S;=`(f<%lO'}!b(iP;=`<%l'}'|(oP;=`<%l&}'[(y]$h&j(RpOY(rYZ&cZr(rrs&cs!^(r!^!_)r!_#O(r#O#P&c#P#o(r#o#p)r#p;'S(r;'S;=`*a<%lO(rp)wU(RpOY)rZr)rs#O)r#P;'S)r;'S;=`*Z<%lO)rp*^P;=`<%l)r'[*dP;=`<%l(r#S*nX(Rp(U!bOY*gZr*grs'}sw*gwx)rx#O*g#P;'S*g;'S;=`+Z<%lO*g#S+^P;=`<%l*g(n+dP;=`<%l%Z07[+rq$h&j(Rp(U!b'w0/lOX%ZXY+gYZ&cZ[+g[p%Zpq+gqr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p$f%Z$f$g+g$g#BY%Z#BY#BZ+g#BZ$IS%Z$IS$I_+g$I_$JT%Z$JT$JU+g$JU$KV%Z$KV$KW+g$KW&FU%Z&FU&FV+g&FV;'S%Z;'S;=`+a<%l?HT%Z?HT?HU+g?HUO%Z07[.ST(S#S$h&j'x0/lO!^&c!_#o&c#p;'S&c;'S;=`&w<%lO&c07[.n_$h&j(Rp(U!b'x0/lOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z)3p/x`$h&j!m),Q(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_!`0z!`#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z(KW1V`#u(Ch$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_!`2X!`#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z(KW2d_#u(Ch$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z'At3l_(Q':f$h&j(U!bOY4kYZ5qZr4krs7nsw4kwx5qx!^4k!^!_8p!_#O4k#O#P5q#P#o4k#o#p8p#p;'S4k;'S;=`:X<%lO4k(^4r_$h&j(U!bOY4kYZ5qZr4krs7nsw4kwx5qx!^4k!^!_8p!_#O4k#O#P5q#P#o4k#o#p8p#p;'S4k;'S;=`:X<%lO4k&z5vX$h&jOr5qrs6cs!^5q!^!_6y!_#o5q#o#p6y#p;'S5q;'S;=`7h<%lO5q&z6jT$c`$h&jO!^&c!_#o&c#p;'S&c;'S;=`&w<%lO&c`6|TOr6yrs7]s;'S6y;'S;=`7b<%lO6y`7bO$c``7eP;=`<%l6y&z7kP;=`<%l5q(^7w]$c`$h&j(U!bOY&}YZ&cZw&}wx&cx!^&}!^!_'}!_#O&}#O#P&c#P#o&}#o#p'}#p;'S&};'S;=`(l<%lO&}!r8uZ(U!bOY8pYZ6yZr8prs9hsw8pwx6yx#O8p#O#P6y#P;'S8p;'S;=`:R<%lO8p!r9oU$c`(U!bOY'}Zw'}x#O'}#P;'S'};'S;=`(f<%lO'}!r:UP;=`<%l8p(^:[P;=`<%l4k%9[:hh$h&j(Rp(U!bOY%ZYZ&cZq%Zqr<Srs&}st%ZtuCruw%Zwx(rx!^%Z!^!_*g!_!c%Z!c!}Cr!}#O%Z#O#P&c#P#R%Z#R#SCr#S#T%Z#T#oCr#o#p*g#p$g%Z$g;'SCr;'S;=`El<%lOCr(r<__WS$h&j(Rp(U!bOY<SYZ&cZr<Srs=^sw<Swx@nx!^<S!^!_Bm!_#O<S#O#P>`#P#o<S#o#pBm#p;'S<S;'S;=`Cl<%lO<S(Q=g]WS$h&j(U!bOY=^YZ&cZw=^wx>`x!^=^!^!_?q!_#O=^#O#P>`#P#o=^#o#p?q#p;'S=^;'S;=`@h<%lO=^&n>gXWS$h&jOY>`YZ&cZ!^>`!^!_?S!_#o>`#o#p?S#p;'S>`;'S;=`?k<%lO>`S?XSWSOY?SZ;'S?S;'S;=`?e<%lO?SS?hP;=`<%l?S&n?nP;=`<%l>`!f?xWWS(U!bOY?qZw?qwx?Sx#O?q#O#P?S#P;'S?q;'S;=`@b<%lO?q!f@eP;=`<%l?q(Q@kP;=`<%l=^'`@w]WS$h&j(RpOY@nYZ&cZr@nrs>`s!^@n!^!_Ap!_#O@n#O#P>`#P#o@n#o#pAp#p;'S@n;'S;=`Bg<%lO@ntAwWWS(RpOYApZrAprs?Ss#OAp#O#P?S#P;'SAp;'S;=`Ba<%lOAptBdP;=`<%lAp'`BjP;=`<%l@n#WBvYWS(Rp(U!bOYBmZrBmrs?qswBmwxApx#OBm#O#P?S#P;'SBm;'S;=`Cf<%lOBm#WCiP;=`<%lBm(rCoP;=`<%l<S%9[C}i$h&j(j%1l(Rp(U!bOY%ZYZ&cZr%Zrs&}st%ZtuCruw%Zwx(rx!Q%Z!Q![Cr![!^%Z!^!_*g!_!c%Z!c!}Cr!}#O%Z#O#P&c#P#R%Z#R#SCr#S#T%Z#T#oCr#o#p*g#p$g%Z$g;'SCr;'S;=`El<%lOCr%9[EoP;=`<%lCr07[FRk$h&j(Rp(U!b$[#t(O,2j(`$I[OY%ZYZ&cZr%Zrs&}st%ZtuEruw%Zwx(rx}%Z}!OGv!O!Q%Z!Q![Er![!^%Z!^!_*g!_!c%Z!c!}Er!}#O%Z#O#P&c#P#R%Z#R#SEr#S#T%Z#T#oEr#o#p*g#p$g%Z$g;'SEr;'S;=`I|<%lOEr+dHRk$h&j(Rp(U!b$[#tOY%ZYZ&cZr%Zrs&}st%ZtuGvuw%Zwx(rx}%Z}!OGv!O!Q%Z!Q![Gv![!^%Z!^!_*g!_!c%Z!c!}Gv!}#O%Z#O#P&c#P#R%Z#R#SGv#S#T%Z#T#oGv#o#p*g#p$g%Z$g;'SGv;'S;=`Iv<%lOGv+dIyP;=`<%lGv07[JPP;=`<%lEr(KWJ_`$h&j(Rp(U!b#m(ChOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_!`Ka!`#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z(KWKl_$h&j$P(Ch(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z,#xLva(u+JY$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sv%ZvwM{wx(rx!^%Z!^!_*g!_!`Ka!`#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z(KWNW`$h&j#y(Ch(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_!`Ka!`#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z'At! c_(T';W$h&j(RpOY!!bYZ!#hZr!!brs!#hsw!!bwx!$xx!^!!b!^!_!%z!_#O!!b#O#P!#h#P#o!!b#o#p!%z#p;'S!!b;'S;=`!'c<%lO!!b'l!!i_$h&j(RpOY!!bYZ!#hZr!!brs!#hsw!!bwx!$xx!^!!b!^!_!%z!_#O!!b#O#P!#h#P#o!!b#o#p!%z#p;'S!!b;'S;=`!'c<%lO!!b&z!#mX$h&jOw!#hwx6cx!^!#h!^!_!$Y!_#o!#h#o#p!$Y#p;'S!#h;'S;=`!$r<%lO!#h`!$]TOw!$Ywx7]x;'S!$Y;'S;=`!$l<%lO!$Y`!$oP;=`<%l!$Y&z!$uP;=`<%l!#h'l!%R]$c`$h&j(RpOY(rYZ&cZr(rrs&cs!^(r!^!_)r!_#O(r#O#P&c#P#o(r#o#p)r#p;'S(r;'S;=`*a<%lO(r!Q!&PZ(RpOY!%zYZ!$YZr!%zrs!$Ysw!%zwx!&rx#O!%z#O#P!$Y#P;'S!%z;'S;=`!']<%lO!%z!Q!&yU$c`(RpOY)rZr)rs#O)r#P;'S)r;'S;=`*Z<%lO)r!Q!'`P;=`<%l!%z'l!'fP;=`<%l!!b/5|!'t_!i/.^$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z#&U!)O_!h!Lf$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z-!n!*[b$h&j(Rp(U!b(P%&f#n(ChOY%ZYZ&cZr%Zrs&}sw%Zwx(rxz%Zz{!+d{!^%Z!^!_*g!_!`Ka!`#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z(KW!+o`$h&j(Rp(U!b#k(ChOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_!`Ka!`#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z+;x!,|`$h&j(Rp(U!bo+4YOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_!`Ka!`#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z,$U!.Z_!Y+Jf$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z07[!/ec$h&j(Rp(U!b}.2^OY%ZYZ&cZr%Zrs&}sw%Zwx(rx!O%Z!O!P!0p!P!Q%Z!Q![!3Y![!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z#%|!0ya$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!O%Z!O!P!2O!P!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z#%|!2Z_!X!L^$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z'Ad!3eg$h&j(Rp(U!bp'9tOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!Q%Z!Q![!3Y![!^%Z!^!_*g!_!g%Z!g!h!4|!h#O%Z#O#P&c#P#R%Z#R#S!3Y#S#X%Z#X#Y!4|#Y#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z'Ad!5Vg$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx{%Z{|!6n|}%Z}!O!6n!O!Q%Z!Q![!8S![!^%Z!^!_*g!_#O%Z#O#P&c#P#R%Z#R#S!8S#S#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z'Ad!6wc$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!Q%Z!Q![!8S![!^%Z!^!_*g!_#O%Z#O#P&c#P#R%Z#R#S!8S#S#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z'Ad!8_c$h&j(Rp(U!bp'9tOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!Q%Z!Q![!8S![!^%Z!^!_*g!_#O%Z#O#P&c#P#R%Z#R#S!8S#S#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z07[!9uf$h&j(Rp(U!b#l(ChOY!;ZYZ&cZr!;Zrs!<nsw!;Zwx!Lcxz!;Zz{#-}{!P!;Z!P!Q#/d!Q!^!;Z!^!_#(i!_!`#7S!`!a#8i!a!}!;Z!}#O#,f#O#P!Dy#P#o!;Z#o#p#(i#p;'S!;Z;'S;=`#-w<%lO!;Z?O!;fb$h&j(Rp(U!b!U7`OY!;ZYZ&cZr!;Zrs!<nsw!;Zwx!Lcx!P!;Z!P!Q#&`!Q!^!;Z!^!_#(i!_!}!;Z!}#O#,f#O#P!Dy#P#o!;Z#o#p#(i#p;'S!;Z;'S;=`#-w<%lO!;Z>^!<w`$h&j(U!b!U7`OY!<nYZ&cZw!<nwx!=yx!P!<n!P!Q!Eq!Q!^!<n!^!_!Gr!_!}!<n!}#O!KS#O#P!Dy#P#o!<n#o#p!Gr#p;'S!<n;'S;=`!L]<%lO!<n<z!>Q^$h&j!U7`OY!=yYZ&cZ!P!=y!P!Q!>|!Q!^!=y!^!_!@c!_!}!=y!}#O!CW#O#P!Dy#P#o!=y#o#p!@c#p;'S!=y;'S;=`!Ek<%lO!=y<z!?Td$h&j!U7`O!^&c!_#W&c#W#X!>|#X#Z&c#Z#[!>|#[#]&c#]#^!>|#^#a&c#a#b!>|#b#g&c#g#h!>|#h#i&c#i#j!>|#j#k!>|#k#m&c#m#n!>|#n#o&c#p;'S&c;'S;=`&w<%lO&c7`!@hX!U7`OY!@cZ!P!@c!P!Q!AT!Q!}!@c!}#O!Ar#O#P!Bq#P;'S!@c;'S;=`!CQ<%lO!@c7`!AYW!U7`#W#X!AT#Z#[!AT#]#^!AT#a#b!AT#g#h!AT#i#j!AT#j#k!AT#m#n!AT7`!AuVOY!ArZ#O!Ar#O#P!B[#P#Q!@c#Q;'S!Ar;'S;=`!Bk<%lO!Ar7`!B_SOY!ArZ;'S!Ar;'S;=`!Bk<%lO!Ar7`!BnP;=`<%l!Ar7`!BtSOY!@cZ;'S!@c;'S;=`!CQ<%lO!@c7`!CTP;=`<%l!@c<z!C][$h&jOY!CWYZ&cZ!^!CW!^!_!Ar!_#O!CW#O#P!DR#P#Q!=y#Q#o!CW#o#p!Ar#p;'S!CW;'S;=`!Ds<%lO!CW<z!DWX$h&jOY!CWYZ&cZ!^!CW!^!_!Ar!_#o!CW#o#p!Ar#p;'S!CW;'S;=`!Ds<%lO!CW<z!DvP;=`<%l!CW<z!EOX$h&jOY!=yYZ&cZ!^!=y!^!_!@c!_#o!=y#o#p!@c#p;'S!=y;'S;=`!Ek<%lO!=y<z!EnP;=`<%l!=y>^!Ezl$h&j(U!b!U7`OY&}YZ&cZw&}wx&cx!^&}!^!_'}!_#O&}#O#P&c#P#W&}#W#X!Eq#X#Z&}#Z#[!Eq#[#]&}#]#^!Eq#^#a&}#a#b!Eq#b#g&}#g#h!Eq#h#i&}#i#j!Eq#j#k!Eq#k#m&}#m#n!Eq#n#o&}#o#p'}#p;'S&};'S;=`(l<%lO&}8r!GyZ(U!b!U7`OY!GrZw!Grwx!@cx!P!Gr!P!Q!Hl!Q!}!Gr!}#O!JU#O#P!Bq#P;'S!Gr;'S;=`!J|<%lO!Gr8r!Hse(U!b!U7`OY'}Zw'}x#O'}#P#W'}#W#X!Hl#X#Z'}#Z#[!Hl#[#]'}#]#^!Hl#^#a'}#a#b!Hl#b#g'}#g#h!Hl#h#i'}#i#j!Hl#j#k!Hl#k#m'}#m#n!Hl#n;'S'};'S;=`(f<%lO'}8r!JZX(U!bOY!JUZw!JUwx!Arx#O!JU#O#P!B[#P#Q!Gr#Q;'S!JU;'S;=`!Jv<%lO!JU8r!JyP;=`<%l!JU8r!KPP;=`<%l!Gr>^!KZ^$h&j(U!bOY!KSYZ&cZw!KSwx!CWx!^!KS!^!_!JU!_#O!KS#O#P!DR#P#Q!<n#Q#o!KS#o#p!JU#p;'S!KS;'S;=`!LV<%lO!KS>^!LYP;=`<%l!KS>^!L`P;=`<%l!<n=l!Ll`$h&j(Rp!U7`OY!LcYZ&cZr!Lcrs!=ys!P!Lc!P!Q!Mn!Q!^!Lc!^!_# o!_!}!Lc!}#O#%P#O#P!Dy#P#o!Lc#o#p# o#p;'S!Lc;'S;=`#&Y<%lO!Lc=l!Mwl$h&j(Rp!U7`OY(rYZ&cZr(rrs&cs!^(r!^!_)r!_#O(r#O#P&c#P#W(r#W#X!Mn#X#Z(r#Z#[!Mn#[#](r#]#^!Mn#^#a(r#a#b!Mn#b#g(r#g#h!Mn#h#i(r#i#j!Mn#j#k!Mn#k#m(r#m#n!Mn#n#o(r#o#p)r#p;'S(r;'S;=`*a<%lO(r8Q# vZ(Rp!U7`OY# oZr# ors!@cs!P# o!P!Q#!i!Q!}# o!}#O#$R#O#P!Bq#P;'S# o;'S;=`#$y<%lO# o8Q#!pe(Rp!U7`OY)rZr)rs#O)r#P#W)r#W#X#!i#X#Z)r#Z#[#!i#[#])r#]#^#!i#^#a)r#a#b#!i#b#g)r#g#h#!i#h#i)r#i#j#!i#j#k#!i#k#m)r#m#n#!i#n;'S)r;'S;=`*Z<%lO)r8Q#$WX(RpOY#$RZr#$Rrs!Ars#O#$R#O#P!B[#P#Q# o#Q;'S#$R;'S;=`#$s<%lO#$R8Q#$vP;=`<%l#$R8Q#$|P;=`<%l# o=l#%W^$h&j(RpOY#%PYZ&cZr#%Prs!CWs!^#%P!^!_#$R!_#O#%P#O#P!DR#P#Q!Lc#Q#o#%P#o#p#$R#p;'S#%P;'S;=`#&S<%lO#%P=l#&VP;=`<%l#%P=l#&]P;=`<%l!Lc?O#&kn$h&j(Rp(U!b!U7`OY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#W%Z#W#X#&`#X#Z%Z#Z#[#&`#[#]%Z#]#^#&`#^#a%Z#a#b#&`#b#g%Z#g#h#&`#h#i%Z#i#j#&`#j#k#&`#k#m%Z#m#n#&`#n#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z9d#(r](Rp(U!b!U7`OY#(iZr#(irs!Grsw#(iwx# ox!P#(i!P!Q#)k!Q!}#(i!}#O#+`#O#P!Bq#P;'S#(i;'S;=`#,`<%lO#(i9d#)th(Rp(U!b!U7`OY*gZr*grs'}sw*gwx)rx#O*g#P#W*g#W#X#)k#X#Z*g#Z#[#)k#[#]*g#]#^#)k#^#a*g#a#b#)k#b#g*g#g#h#)k#h#i*g#i#j#)k#j#k#)k#k#m*g#m#n#)k#n;'S*g;'S;=`+Z<%lO*g9d#+gZ(Rp(U!bOY#+`Zr#+`rs!JUsw#+`wx#$Rx#O#+`#O#P!B[#P#Q#(i#Q;'S#+`;'S;=`#,Y<%lO#+`9d#,]P;=`<%l#+`9d#,cP;=`<%l#(i?O#,o`$h&j(Rp(U!bOY#,fYZ&cZr#,frs!KSsw#,fwx#%Px!^#,f!^!_#+`!_#O#,f#O#P!DR#P#Q!;Z#Q#o#,f#o#p#+`#p;'S#,f;'S;=`#-q<%lO#,f?O#-tP;=`<%l#,f?O#-zP;=`<%l!;Z07[#.[b$h&j(Rp(U!b'y0/l!U7`OY!;ZYZ&cZr!;Zrs!<nsw!;Zwx!Lcx!P!;Z!P!Q#&`!Q!^!;Z!^!_#(i!_!}!;Z!}#O#,f#O#P!Dy#P#o!;Z#o#p#(i#p;'S!;Z;'S;=`#-w<%lO!;Z07[#/o_$h&j(Rp(U!bT0/lOY#/dYZ&cZr#/drs#0nsw#/dwx#4Ox!^#/d!^!_#5}!_#O#/d#O#P#1p#P#o#/d#o#p#5}#p;'S#/d;'S;=`#6|<%lO#/d06j#0w]$h&j(U!bT0/lOY#0nYZ&cZw#0nwx#1px!^#0n!^!_#3R!_#O#0n#O#P#1p#P#o#0n#o#p#3R#p;'S#0n;'S;=`#3x<%lO#0n05W#1wX$h&jT0/lOY#1pYZ&cZ!^#1p!^!_#2d!_#o#1p#o#p#2d#p;'S#1p;'S;=`#2{<%lO#1p0/l#2iST0/lOY#2dZ;'S#2d;'S;=`#2u<%lO#2d0/l#2xP;=`<%l#2d05W#3OP;=`<%l#1p01O#3YW(U!bT0/lOY#3RZw#3Rwx#2dx#O#3R#O#P#2d#P;'S#3R;'S;=`#3r<%lO#3R01O#3uP;=`<%l#3R06j#3{P;=`<%l#0n05x#4X]$h&j(RpT0/lOY#4OYZ&cZr#4Ors#1ps!^#4O!^!_#5Q!_#O#4O#O#P#1p#P#o#4O#o#p#5Q#p;'S#4O;'S;=`#5w<%lO#4O00^#5XW(RpT0/lOY#5QZr#5Qrs#2ds#O#5Q#O#P#2d#P;'S#5Q;'S;=`#5q<%lO#5Q00^#5tP;=`<%l#5Q05x#5zP;=`<%l#4O01p#6WY(Rp(U!bT0/lOY#5}Zr#5}rs#3Rsw#5}wx#5Qx#O#5}#O#P#2d#P;'S#5};'S;=`#6v<%lO#5}01p#6yP;=`<%l#5}07[#7PP;=`<%l#/d)3h#7ab$h&j$P(Ch(Rp(U!b!U7`OY!;ZYZ&cZr!;Zrs!<nsw!;Zwx!Lcx!P!;Z!P!Q#&`!Q!^!;Z!^!_#(i!_!}!;Z!}#O#,f#O#P!Dy#P#o!;Z#o#p#(i#p;'S!;Z;'S;=`#-w<%lO!;ZAt#8vb$Y#t$h&j(Rp(U!b!U7`OY!;ZYZ&cZr!;Zrs!<nsw!;Zwx!Lcx!P!;Z!P!Q#&`!Q!^!;Z!^!_#(i!_!}!;Z!}#O#,f#O#P!Dy#P#o!;Z#o#p#(i#p;'S!;Z;'S;=`#-w<%lO!;Z'Ad#:Zp$h&j(Rp(U!bp'9tOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!O%Z!O!P!3Y!P!Q%Z!Q![#<_![!^%Z!^!_*g!_!g%Z!g!h!4|!h#O%Z#O#P&c#P#R%Z#R#S#<_#S#U%Z#U#V#?i#V#X%Z#X#Y!4|#Y#b%Z#b#c#>_#c#d#Bq#d#l%Z#l#m#Es#m#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z'Ad#<jk$h&j(Rp(U!bp'9tOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!O%Z!O!P!3Y!P!Q%Z!Q![#<_![!^%Z!^!_*g!_!g%Z!g!h!4|!h#O%Z#O#P&c#P#R%Z#R#S#<_#S#X%Z#X#Y!4|#Y#b%Z#b#c#>_#c#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z'Ad#>j_$h&j(Rp(U!bp'9tOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z'Ad#?rd$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!Q%Z!Q!R#AQ!R!S#AQ!S!^%Z!^!_*g!_#O%Z#O#P&c#P#R%Z#R#S#AQ#S#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z'Ad#A]f$h&j(Rp(U!bp'9tOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!Q%Z!Q!R#AQ!R!S#AQ!S!^%Z!^!_*g!_#O%Z#O#P&c#P#R%Z#R#S#AQ#S#b%Z#b#c#>_#c#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z'Ad#Bzc$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!Q%Z!Q!Y#DV!Y!^%Z!^!_*g!_#O%Z#O#P&c#P#R%Z#R#S#DV#S#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z'Ad#Dbe$h&j(Rp(U!bp'9tOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!Q%Z!Q!Y#DV!Y!^%Z!^!_*g!_#O%Z#O#P&c#P#R%Z#R#S#DV#S#b%Z#b#c#>_#c#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z'Ad#E|g$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!Q%Z!Q![#Ge![!^%Z!^!_*g!_!c%Z!c!i#Ge!i#O%Z#O#P&c#P#R%Z#R#S#Ge#S#T%Z#T#Z#Ge#Z#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z'Ad#Gpi$h&j(Rp(U!bp'9tOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!Q%Z!Q![#Ge![!^%Z!^!_*g!_!c%Z!c!i#Ge!i#O%Z#O#P&c#P#R%Z#R#S#Ge#S#T%Z#T#Z#Ge#Z#b%Z#b#c#>_#c#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z*)x#Il_!d$b$h&j#})Lv(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z)[#Jv_al$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z04f#LS^h#)`#O-<U(Rp(U!b(y7`OY*gZr*grs'}sw*gwx)rx!P*g!P!Q#MO!Q!^*g!^!_#Mt!_!`$ f!`#O*g#P;'S*g;'S;=`+Z<%lO*g(n#MXX$j&j(Rp(U!bOY*gZr*grs'}sw*gwx)rx#O*g#P;'S*g;'S;=`+Z<%lO*g(El#M}Z#o(Ch(Rp(U!bOY*gZr*grs'}sw*gwx)rx!_*g!_!`#Np!`#O*g#P;'S*g;'S;=`+Z<%lO*g(El#NyX$P(Ch(Rp(U!bOY*gZr*grs'}sw*gwx)rx#O*g#P;'S*g;'S;=`+Z<%lO*g(El$ oX#p(Ch(Rp(U!bOY*gZr*grs'}sw*gwx)rx#O*g#P;'S*g;'S;=`+Z<%lO*g*)x$!ga#]*!Y$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_!`0z!`!a$#l!a#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z(K[$#w_#h(Cl$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z*)x$%Vag!*r#p(Ch$e#|$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_!`$&[!`!a$'f!a#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z(KW$&g_#p(Ch$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z(KW$'qa#o(Ch$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_!`Ka!`!a$(v!a#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z(KW$)R`#o(Ch$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_!`Ka!`#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z(Kd$*`a(m(Ct$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_!a%Z!a!b$+e!b#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z(KW$+p`$h&j#z(Ch(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_!`Ka!`#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z%#`$,}_!y$Ip$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z04f$.X_!P0,v$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z(n$/]Z$h&jO!^$0O!^!_$0f!_#i$0O#i#j$0k#j#l$0O#l#m$2^#m#o$0O#o#p$0f#p;'S$0O;'S;=`$4i<%lO$0O(n$0VT_#S$h&jO!^&c!_#o&c#p;'S&c;'S;=`&w<%lO&c#S$0kO_#S(n$0p[$h&jO!Q&c!Q![$1f![!^&c!_!c&c!c!i$1f!i#T&c#T#Z$1f#Z#o&c#o#p$3|#p;'S&c;'S;=`&w<%lO&c(n$1kZ$h&jO!Q&c!Q![$2^![!^&c!_!c&c!c!i$2^!i#T&c#T#Z$2^#Z#o&c#p;'S&c;'S;=`&w<%lO&c(n$2cZ$h&jO!Q&c!Q![$3U![!^&c!_!c&c!c!i$3U!i#T&c#T#Z$3U#Z#o&c#p;'S&c;'S;=`&w<%lO&c(n$3ZZ$h&jO!Q&c!Q![$0O![!^&c!_!c&c!c!i$0O!i#T&c#T#Z$0O#Z#o&c#p;'S&c;'S;=`&w<%lO&c#S$4PR!Q![$4Y!c!i$4Y#T#Z$4Y#S$4]S!Q![$4Y!c!i$4Y#T#Z$4Y#q#r$0f(n$4lP;=`<%l$0O#1[$4z_!V#)l$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z(KW$6U`#w(Ch$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_!`Ka!`#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z+;p$7c_$h&j(Rp(U!b([+4QOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z07[$8qk$h&j(Rp(U!b(O,2j$^#t(`$I[OY%ZYZ&cZr%Zrs&}st%Ztu$8buw%Zwx(rx}%Z}!O$:f!O!Q%Z!Q![$8b![!^%Z!^!_*g!_!c%Z!c!}$8b!}#O%Z#O#P&c#P#R%Z#R#S$8b#S#T%Z#T#o$8b#o#p*g#p$g%Z$g;'S$8b;'S;=`$<l<%lO$8b+d$:qk$h&j(Rp(U!b$^#tOY%ZYZ&cZr%Zrs&}st%Ztu$:fuw%Zwx(rx}%Z}!O$:f!O!Q%Z!Q![$:f![!^%Z!^!_*g!_!c%Z!c!}$:f!}#O%Z#O#P&c#P#R%Z#R#S$:f#S#T%Z#T#o$:f#o#p*g#p$g%Z$g;'S$:f;'S;=`$<f<%lO$:f+d$<iP;=`<%l$:f07[$<oP;=`<%l$8b#Jf$<{X![#Hb(Rp(U!bOY*gZr*grs'}sw*gwx)rx#O*g#P;'S*g;'S;=`+Z<%lO*g,#x$=sa(t+JY$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_!`Ka!`#O%Z#O#P&c#P#o%Z#o#p*g#p#q$+e#q;'S%Z;'S;=`+a<%lO%Z(Kd$?V_!Z(Cds`$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z?O$@a_!n7`$h&j(Rp(U!bOY%ZYZ&cZr%Zrs&}sw%Zwx(rx!^%Z!^!_*g!_#O%Z#O#P&c#P#o%Z#o#p*g#p;'S%Z;'S;=`+a<%lO%Z07[$Aq|$h&j(Rp(U!b'w0/l$[#t(O,2j(`$I[OX%ZXY+gYZ&cZ[+g[p%Zpq+gqr%Zrs&}st%ZtuEruw%Zwx(rx}%Z}!OGv!O!Q%Z!Q![Er![!^%Z!^!_*g!_!c%Z!c!}Er!}#O%Z#O#P&c#P#R%Z#R#SEr#S#T%Z#T#oEr#o#p*g#p$f%Z$f$g+g$g#BYEr#BY#BZ$A`#BZ$ISEr$IS$I_$A`$I_$JTEr$JT$JU$A`$JU$KVEr$KV$KW$A`$KW&FUEr&FU&FV$A`&FV;'SEr;'S;=`I|<%l?HTEr?HT?HU$A`?HUOEr07[$D|k$h&j(Rp(U!b'x0/l$[#t(O,2j(`$I[OY%ZYZ&cZr%Zrs&}st%ZtuEruw%Zwx(rx}%Z}!OGv!O!Q%Z!Q![Er![!^%Z!^!_*g!_!c%Z!c!}Er!}#O%Z#O#P&c#P#R%Z#R#SEr#S#T%Z#T#oEr#o#p*g#p$g%Z$g;'SEr;'S;=`I|<%lOEr",tokenizers:[EMt,DMt,OMt,2,3,4,5,6,7,8,9,10,11,12,13,14,TMt,new SK("$S~RRtu[#O#Pg#S#T#|~_P#o#pb~gOu~~jVO#i!P#i#j!U#j#l!P#l#m!q#m;'S!P;'S;=`#v<%lO!P~!UO!R~~!XS!Q![!e!c!i!e#T#Z!e#o#p#Z~!hR!Q![!q!c!i!q#T#Z!q~!tR!Q![!}!c!i!}#T#Z!}~#QR!Q![!P!c!i!P#T#Z!P~#^R!Q![#g!c!i#g#T#Z#g~#jS!Q![#g!c!i#g#T#Z#g#q#r!P~#yP;=`<%l!P~$RO(^~~",141,335),new SK(`j~RQYZXz{^~^O'{~~aP!P!Qd~iO'|~~`,25,318)],topRules:{Script:[0,7],SingleExpression:[1,272],SingleClassItem:[2,273]},dialects:{jsx:0,ts:14725},dynamicPrecedences:{77:1,79:1,91:1,167:1,196:1},specialized:[{term:322,get:e=>AMt[e]||-1},{term:338,get:e=>jMt[e]||-1},{term:92,get:e=>MMt[e]||-1}],tokenPrec:14749})}));function gq(e){return(t,n)=>{let r=t.node.getChild(`VariableDefinition`);return r&&n(r,e),!0}}function FMt(e,t){let n=vq.get(t);if(n)return n;let r=[],i=!0;function a(t,n){let i=e.sliceString(t.from,t.to);r.push({label:i,type:n})}return t.cursor(ZU.IncludeAnonymous).iterate(t=>{if(i)i=!1;else if(t.name){let e=HMt[t.name];if(e&&e(t,a)||yq.has(t.name))return!1}else if(t.to-t.from>8192){for(let n of FMt(e,t.node))r.push(n);return!1}}),vq.set(t,r),r}function IMt(e){let t=NW(e.state).resolveInner(e.pos,-1);if(xq.indexOf(t.name)>-1)return null;let n=t.name==`VariableName`||t.to-t.from<20&&bq.test(e.state.sliceDoc(t.from,t.to));if(!n&&!e.explicit)return null;let r=[];for(let n=t;n;n=n.parent)yq.has(n.name)&&(r=r.concat(FMt(e.state.doc,n)));return{options:r,from:n?t.from:e.pos,validFor:bq}}function LMt(e={}){let t=e.jsx?e.typescript?Eq:Tq:e.typescript?wq:Sq,n=e.typescript?BMt.concat(UMt):_q.concat(Oq);return new QW(t,[Sq.data.of({autocomplete:KOt(xq,GOt(n))}),Sq.data.of({autocomplete:IMt}),e.jsx?GMt:[]])}function RMt(e){for(;;){if(e.name==`JSXOpenTag`||e.name==`JSXSelfClosingTag`||e.name==`JSXFragmentTag`)return e;if(e.name==`JSXEscape`||!e.parent)return null;e=e.parent}}function zMt(e,t,n=e.length){for(let r=t?.firstChild;r;r=r.nextSibling)if(r.name==`JSXIdentifier`||r.name==`JSXBuiltin`||r.name==`JSXNamespacedName`||r.name==`JSXMemberExpression`)return e.sliceString(r.from,Math.min(r.to,n));return``}var _q,BMt,vq,yq,VMt,HMt,bq,xq,Sq,Cq,wq,Tq,Eq,Dq,Oq,UMt,WMt,GMt,KMt=s((()=>{PMt(),yG(),vB(),RU(),nAt(),dW(),_q=[NG("function ${name}(${params}) {\n	${}\n}",{label:`function`,detail:`definition`,type:`keyword`}),NG("for (let ${index} = 0; ${index} < ${bound}; ${index}++) {\n	${}\n}",{label:`for`,detail:`loop`,type:`keyword`}),NG("for (let ${name} of ${collection}) {\n	${}\n}",{label:`for`,detail:`of loop`,type:`keyword`}),NG(`do {
-	\${}
-} while (\${})`,{label:`do`,detail:`loop`,type:`keyword`}),NG(`while (\${}) {
-	\${}
-}`,{label:`while`,detail:`loop`,type:`keyword`}),NG(`try {
-	\${}
-} catch (\${error}) {
-	\${}
-}`,{label:`try`,detail:`/ catch block`,type:`keyword`}),NG(`if (\${}) {
-	\${}
-}`,{label:`if`,detail:`block`,type:`keyword`}),NG(`if (\${}) {
-	\${}
-} else {
-	\${}
-}`,{label:`if`,detail:`/ else block`,type:`keyword`}),NG(`class \${name} {
-	constructor(\${params}) {
-		\${}
-	}
-}`,{label:`class`,detail:`definition`,type:`keyword`}),NG('import {${names}} from "${module}"\n${}',{label:`import`,detail:`named`,type:`keyword`}),NG('import ${name} from "${module}"\n${}',{label:`import`,detail:`default`,type:`keyword`})],BMt=_q.concat([NG(`interface \${name} {
-	\${}
-}`,{label:`interface`,detail:`definition`,type:`keyword`}),NG("type ${name} = ${type}",{label:`type`,detail:`definition`,type:`keyword`}),NG(`enum \${name} {
-	\${}
-}`,{label:`enum`,detail:`definition`,type:`keyword`})]),vq=new aW,yq=new Set([`Script`,`Block`,`FunctionExpression`,`FunctionDeclaration`,`ArrowFunction`,`MethodDeclaration`,`ForStatement`]),VMt=[`FunctionDeclaration`],HMt={FunctionDeclaration:gq(`function`),ClassDeclaration:gq(`class`),ClassExpression:()=>!0,EnumDeclaration:gq(`constant`),TypeAliasDeclaration:gq(`type`),NamespaceDeclaration:gq(`namespace`),VariableDefinition(e,t){e.matchContext(VMt)||t(e,`variable`)},TypeDefinition(e,t){t(e,`type`)},__proto__:null},bq=/^[\w$\xa1-\uffff][\w$\d\xa1-\uffff]*$/,xq=[`TemplateString`,`String`,`RegExp`,`LineComment`,`BlockComment`,`VariableDefinition`,`TypeDefinition`,`Label`,`PropertyDefinition`,`PropertyName`,`PrivatePropertyDefinition`,`PrivatePropertyName`,`JSXText`,`JSXAttributeValue`,`JSXOpenTag`,`JSXCloseTag`,`JSXSelfClosingTag`,`.`,`?.`],Sq=KW.define({name:`javascript`,parser:NMt.configure({props:[tG.add({IfStatement:FW({except:/^\s*({|else\b)/}),TryStatement:FW({except:/^\s*({|catch\b|finally\b)/}),LabeledStatement:sOt,SwitchBody:e=>{let t=e.textAfter,n=/^\s*\}/.test(t),r=/^\s*(case|default)\b/.test(t);return e.baseIndent+(n?0:r?1:2)*e.unit},Block:PW({closing:`}`}),ArrowFunction:e=>e.baseIndent+e.unit,"TemplateString BlockComment":()=>null,"Statement Property":FW({except:/^\s*{/}),JSXElement(e){let t=/^\s*<\//.test(e.textAfter);return e.lineIndent(e.node.from)+(t?0:e.unit)},JSXEscape(e){let t=/\s*\}/.test(e.textAfter);return e.lineIndent(e.node.from)+(t?0:e.unit)},"JSXOpenTag JSXSelfClosingTag"(e){return e.column(e.node.from)+e.unit}}),nG.add({"Block ClassBody SwitchBody EnumBody ObjectExpression ArrayExpression ObjectType":IW,BlockComment(e){return{from:e.from+2,to:e.to-2}},JSXElement(e){let t=e.firstChild;if(!t||t.name==`JSXSelfClosingTag`)return null;let n=e.lastChild;return{from:t.to,to:n.type.isError?e.to:n.from}},"JSXSelfClosingTag JSXOpenTag"(e){let t=e.firstChild?.nextSibling,n=e.lastChild;return!t||t.type.isError?null:{from:t.to,to:n.type.isError?e.to:n.from}}})]}),languageData:{closeBrackets:{brackets:[`(`,`[`,`{`,`'`,`"`,"`"]},commentTokens:{line:`//`,block:{open:`/*`,close:`*/`}},indentOnInput:/^\s*(?:case |default:|\{|\}|<\/)$/,wordChars:`$`}}),Cq={test:e=>/^JSX/.test(e.name),facet:DDt({commentTokens:{block:{open:`{/*`,close:`*/}`}}})},wq=Sq.configure({dialect:`ts`},`typescript`),Tq=Sq.configure({dialect:`jsx`,props:[WW.add(e=>e.isTop?[Cq]:void 0)]}),Eq=Sq.configure({dialect:`jsx ts`,props:[WW.add(e=>e.isTop?[Cq]:void 0)]},`typescript`),Dq=e=>({label:e,type:`keyword`}),Oq=`break case const continue default delete export extends false finally in instanceof let new return static super switch this throw true typeof var yield`.split(` `).map(Dq),UMt=Oq.concat([`declare`,`implements`,`private`,`protected`,`public`].map(Dq)),WMt=typeof navigator==`object`&&/Android\b/.test(navigator.userAgent),GMt=oU.inputHandler.of((e,t,n,r,i)=>{if((WMt?e.composing:e.compositionStarted)||e.state.readOnly||t!=n||r!=`>`&&r!=`/`||!Sq.isActiveAt(e.state,t,-1))return!1;let a=i(),{state:o}=a,s=o.changeByRange(e=>{let{head:t}=e,n=NW(o).resolveInner(t-1,-1),i;if(n.name==`JSXStartTag`&&(n=n.parent),!(o.doc.sliceString(t-1,t)!=r||n.name==`JSXAttributeValue`&&n.to>t)){if(r==`>`&&n.name==`JSXFragmentTag`)return{range:e,changes:{from:t,insert:`</>`}};if(r==`/`&&n.name==`JSXStartCloseTag`){let e=n.parent,r=e.parent;if(r&&e.from==t-2&&((i=zMt(o.doc,r.firstChild,t))||r.firstChild?.name==`JSXFragmentTag`)){let e=`${i}>`;return{range:Bz.cursor(t+e.length,-1),changes:{from:t,insert:e}}}}else if(r==`>`){let r=RMt(n);if(r&&r.name==`JSXOpenTag`&&!/^\/?>|^<\//.test(o.doc.sliceString(t,t+2))&&(i=zMt(o.doc,r,t)))return{range:e,changes:{from:t,insert:`</${i}>`}}}}return{range:e}});return s.changes.empty?!1:(e.dispatch([a,o.update(s,{userEvent:`input.complete`,scrollIntoView:!0})]),!0)})}));function kq(e,t,n=e.length){if(!t)return``;let r=t.firstChild,i=r&&r.getChild(`TagName`);return i?e.sliceString(i.from,Math.min(i.to,n)):``}function Aq(e,t=!1){for(;e;e=e.parent)if(e.name==`Element`)if(t)t=!1;else return e;return null}function qMt(e,t,n){return n.tags[kq(e,Aq(t))]?.children||n.allTags}function jq(e,t){let n=[];for(let r=Aq(t);r&&!r.type.isTop;r=Aq(r.parent)){let i=kq(e,r);if(i&&r.lastChild.name==`CloseTag`)break;i&&n.indexOf(i)<0&&(t.name==`EndTag`||t.from>=r.firstChild.to)&&n.push(i)}return n}function JMt(e,t,n,r,i){let a=/\s*>/.test(e.sliceDoc(i,i+5))?``:`>`,o=Aq(n,!0);return{from:r,to:i,options:qMt(e.doc,o,t).map(e=>({label:e,type:`type`})).concat(jq(e.doc,n).map((e,t)=>({label:`/`+e,apply:`/`+e+a,type:`type`,boost:99-t}))),validFor:/^\/?[:\-\.\w\u00b7-\uffff]*$/}}function YMt(e,t,n,r){let i=/\s*>/.test(e.sliceDoc(r,r+5))?``:`>`;return{from:n,to:r,options:jq(e.doc,t).map((e,t)=>({label:e,apply:e+i,type:`type`,boost:99-t})),validFor:Vq}}function XMt(e,t,n,r){let i=[],a=0;for(let r of qMt(e.doc,n,t))i.push({label:`<`+r,type:`type`});for(let t of jq(e.doc,n))i.push({label:`</`+t+`>`,type:`type`,boost:99-a++});return{from:r,to:r,options:i,validFor:/^<\/?[:\-\.\w\u00b7-\uffff]*$/}}function ZMt(e,t,n,r,i){let a=Aq(n),o=a?t.tags[kq(e.doc,a)]:null,s=o&&o.attrs?Object.keys(o.attrs):[];return{from:r,to:i,options:(o&&o.globalAttrs===!1?s:s.length?s.concat(t.globalAttrNames):t.globalAttrNames).map(e=>({label:e,type:`property`})),validFor:Vq}}function QMt(e,t,n,r,i){let a=n.parent?.getChild(`AttributeName`),o=[],s;if(a){let c=e.sliceDoc(a.from,a.to),l=t.globalAttrs[c];if(!l){let r=Aq(n),i=r?t.tags[kq(e.doc,r)]:null;l=i?.attrs&&i.attrs[c]}if(l){let t=e.sliceDoc(r,i).toLowerCase(),n=`"`,a=`"`;/^['"]/.test(t)?(s=t[0]==`"`?/^[^"]*$/:/^[^']*$/,n=``,a=e.sliceDoc(i,i+1)==t[0]?``:t[0],t=t.slice(1),r++):s=/^[^\s<>='"]*$/;for(let e of l)o.push({label:e,apply:n+e+a,type:`constant`})}}return{from:r,to:i,options:o,validFor:s}}function $Mt(e,t){let{state:n,pos:r}=t,i=NW(n).resolveInner(r,-1),a=i.resolve(r);for(let e=r,t;a==i&&(t=i.childBefore(e));){let n=t.lastChild;if(!n||!n.type.isError||n.from<n.to)break;a=i=t,e=n.from}return i.name==`TagName`?i.parent&&/CloseTag$/.test(i.parent.name)?YMt(n,i,i.from,r):JMt(n,e,i,i.from,r):i.name==`StartTag`?JMt(n,e,i,r,r):i.name==`StartCloseTag`||i.name==`IncompleteCloseTag`?YMt(n,i,r,r):i.name==`OpenTag`||i.name==`SelfClosingTag`||i.name==`AttributeName`?ZMt(n,e,i,i.name==`AttributeName`?i.from:r,r):i.name==`Is`||i.name==`AttributeValue`||i.name==`UnquotedAttributeValue`?QMt(n,e,i,i.name==`Is`?r:i.from,r):t.explicit&&(a.name==`Element`||a.name==`Text`||a.name==`Document`)?XMt(n,e,i,r):null}function eNt(e){let{extraTags:t,extraGlobalAttributes:n}=e,r=n||t?new Bq(t,n):Bq.default;return e=>$Mt(r,e)}function tNt(e={}){let t=``,n;return e.matchClosingTags===!1&&(t=`noMatch`),e.selfClosingTags===!0&&(t=(t?t+` `:``)+`selfClosing`),(e.nestedLanguages&&e.nestedLanguages.length||e.nestedAttributes&&e.nestedAttributes.length)&&(n=Cjt((e.nestedLanguages||[]).concat(Hq),(e.nestedAttributes||[]).concat(Uq))),new QW(n?Wq.configure({wrap:n,dialect:t}):t?Gq.configure({dialect:t}):Gq,[Gq.data.of({autocomplete:eNt(e)}),e.autoCloseTags===!1?[]:iNt,LMt().support,ljt().support])}var Mq,Nq,Pq,Fq,Iq,Lq,nNt,Rq,zq,Bq,Vq,rNt,Hq,Uq,Wq,Gq,Kq,iNt,aNt=s((()=>{aMt(),gjt(),KMt(),RU(),vB(),yG(),Mq=[`_blank`,`_self`,`_top`,`_parent`],Nq=[`ascii`,`utf-8`,`utf-16`,`latin1`,`latin1`],Pq=[`get`,`post`,`put`,`delete`],Fq=[`application/x-www-form-urlencoded`,`multipart/form-data`,`text/plain`],Iq=[`true`,`false`],Lq={},nNt={a:{attrs:{href:null,ping:null,type:null,media:null,target:Mq,hreflang:null}},abbr:Lq,address:Lq,area:{attrs:{alt:null,coords:null,href:null,target:null,ping:null,media:null,hreflang:null,type:null,shape:[`default`,`rect`,`circle`,`poly`]}},article:Lq,aside:Lq,audio:{attrs:{src:null,mediagroup:null,crossorigin:[`anonymous`,`use-credentials`],preload:[`none`,`metadata`,`auto`],autoplay:[`autoplay`],loop:[`loop`],controls:[`controls`]}},b:Lq,base:{attrs:{href:null,target:Mq}},bdi:Lq,bdo:Lq,blockquote:{attrs:{cite:null}},body:Lq,br:Lq,button:{attrs:{form:null,formaction:null,name:null,value:null,autofocus:[`autofocus`],disabled:[`autofocus`],formenctype:Fq,formmethod:Pq,formnovalidate:[`novalidate`],formtarget:Mq,type:[`submit`,`reset`,`button`]}},canvas:{attrs:{width:null,height:null}},caption:Lq,center:Lq,cite:Lq,code:Lq,col:{attrs:{span:null}},colgroup:{attrs:{span:null}},command:{attrs:{type:[`command`,`checkbox`,`radio`],label:null,icon:null,radiogroup:null,command:null,title:null,disabled:[`disabled`],checked:[`checked`]}},data:{attrs:{value:null}},datagrid:{attrs:{disabled:[`disabled`],multiple:[`multiple`]}},datalist:{attrs:{data:null}},dd:Lq,del:{attrs:{cite:null,datetime:null}},details:{attrs:{open:[`open`]}},dfn:Lq,div:Lq,dl:Lq,dt:Lq,em:Lq,embed:{attrs:{src:null,type:null,width:null,height:null}},eventsource:{attrs:{src:null}},fieldset:{attrs:{disabled:[`disabled`],form:null,name:null}},figcaption:Lq,figure:Lq,footer:Lq,form:{attrs:{action:null,name:null,"accept-charset":Nq,autocomplete:[`on`,`off`],enctype:Fq,method:Pq,novalidate:[`novalidate`],target:Mq}},h1:Lq,h2:Lq,h3:Lq,h4:Lq,h5:Lq,h6:Lq,head:{children:[`title`,`base`,`link`,`style`,`meta`,`script`,`noscript`,`command`]},header:Lq,hgroup:Lq,hr:Lq,html:{attrs:{manifest:null}},i:Lq,iframe:{attrs:{src:null,srcdoc:null,name:null,width:null,height:null,sandbox:[`allow-top-navigation`,`allow-same-origin`,`allow-forms`,`allow-scripts`],seamless:[`seamless`]}},img:{attrs:{alt:null,src:null,ismap:null,usemap:null,width:null,height:null,crossorigin:[`anonymous`,`use-credentials`]}},input:{attrs:{alt:null,dirname:null,form:null,formaction:null,height:null,list:null,max:null,maxlength:null,min:null,name:null,pattern:null,placeholder:null,size:null,src:null,step:null,value:null,width:null,accept:[`audio/*`,`video/*`,`image/*`],autocomplete:[`on`,`off`],autofocus:[`autofocus`],checked:[`checked`],disabled:[`disabled`],formenctype:Fq,formmethod:Pq,formnovalidate:[`novalidate`],formtarget:Mq,multiple:[`multiple`],readonly:[`readonly`],required:[`required`],type:[`hidden`,`text`,`search`,`tel`,`url`,`email`,`password`,`datetime`,`date`,`month`,`week`,`time`,`datetime-local`,`number`,`range`,`color`,`checkbox`,`radio`,`file`,`submit`,`image`,`reset`,`button`]}},ins:{attrs:{cite:null,datetime:null}},kbd:Lq,keygen:{attrs:{challenge:null,form:null,name:null,autofocus:[`autofocus`],disabled:[`disabled`],keytype:[`RSA`]}},label:{attrs:{for:null,form:null}},legend:Lq,li:{attrs:{value:null}},link:{attrs:{href:null,type:null,hreflang:null,media:null,sizes:[`all`,`16x16`,`16x16 32x32`,`16x16 32x32 64x64`]}},map:{attrs:{name:null}},mark:Lq,menu:{attrs:{label:null,type:[`list`,`context`,`toolbar`]}},meta:{attrs:{content:null,charset:Nq,name:[`viewport`,`application-name`,`author`,`description`,`generator`,`keywords`],"http-equiv":[`content-language`,`content-type`,`default-style`,`refresh`]}},meter:{attrs:{value:null,min:null,low:null,high:null,max:null,optimum:null}},nav:Lq,noscript:Lq,object:{attrs:{data:null,type:null,name:null,usemap:null,form:null,width:null,height:null,typemustmatch:[`typemustmatch`]}},ol:{attrs:{reversed:[`reversed`],start:null,type:[`1`,`a`,`A`,`i`,`I`]},children:[`li`,`script`,`template`,`ul`,`ol`]},optgroup:{attrs:{disabled:[`disabled`],label:null}},option:{attrs:{disabled:[`disabled`],label:null,selected:[`selected`],value:null}},output:{attrs:{for:null,form:null,name:null}},p:Lq,param:{attrs:{name:null,value:null}},pre:Lq,progress:{attrs:{value:null,max:null}},q:{attrs:{cite:null}},rp:Lq,rt:Lq,ruby:Lq,samp:Lq,script:{attrs:{type:[`text/javascript`],src:null,async:[`async`],defer:[`defer`],charset:Nq}},section:Lq,select:{attrs:{form:null,name:null,size:null,autofocus:[`autofocus`],disabled:[`disabled`],multiple:[`multiple`]}},slot:{attrs:{name:null}},small:Lq,source:{attrs:{src:null,type:null,media:null}},span:Lq,strong:Lq,style:{attrs:{type:[`text/css`],media:null,scoped:null}},sub:Lq,summary:Lq,sup:Lq,table:Lq,tbody:Lq,td:{attrs:{colspan:null,rowspan:null,headers:null}},template:Lq,textarea:{attrs:{dirname:null,form:null,maxlength:null,name:null,placeholder:null,rows:null,cols:null,autofocus:[`autofocus`],disabled:[`disabled`],readonly:[`readonly`],required:[`required`],wrap:[`soft`,`hard`]}},tfoot:Lq,th:{attrs:{colspan:null,rowspan:null,headers:null,scope:[`row`,`col`,`rowgroup`,`colgroup`]}},thead:Lq,time:{attrs:{datetime:null}},title:Lq,tr:Lq,track:{attrs:{src:null,label:null,default:null,kind:[`subtitles`,`captions`,`descriptions`,`chapters`,`metadata`],srclang:null}},ul:{children:[`li`,`script`,`template`,`ul`,`ol`]},var:Lq,video:{attrs:{src:null,poster:null,width:null,height:null,crossorigin:[`anonymous`,`use-credentials`],preload:[`auto`,`metadata`,`none`],autoplay:[`autoplay`],mediagroup:[`movie`],muted:[`muted`],controls:[`controls`]}},wbr:Lq},Rq={accesskey:null,class:null,contenteditable:Iq,contextmenu:null,dir:[`ltr`,`rtl`,`auto`],draggable:[`true`,`false`,`auto`],dropzone:[`copy`,`move`,`link`,`string:`,`file:`],hidden:[`hidden`],id:null,inert:[`inert`],itemid:null,itemprop:null,itemref:null,itemscope:[`itemscope`],itemtype:null,lang:[`ar`,`bn`,`de`,`en-GB`,`en-US`,`es`,`fr`,`hi`,`id`,`ja`,`pa`,`pt`,`ru`,`tr`,`zh`],spellcheck:Iq,autocorrect:Iq,autocapitalize:Iq,style:null,tabindex:null,title:null,translate:[`yes`,`no`],rel:[`stylesheet`,`alternate`,`author`,`bookmark`,`help`,`license`,`next`,`nofollow`,`noreferrer`,`prefetch`,`prev`,`search`,`tag`],role:`alert application article banner button cell checkbox complementary contentinfo dialog document feed figure form grid gridcell heading img list listbox listitem main navigation region row rowgroup search switch tab table tabpanel textbox timer`.split(` `),"aria-activedescendant":null,"aria-atomic":Iq,"aria-autocomplete":[`inline`,`list`,`both`,`none`],"aria-busy":Iq,"aria-checked":[`true`,`false`,`mixed`,`undefined`],"aria-controls":null,"aria-describedby":null,"aria-disabled":Iq,"aria-dropeffect":null,"aria-expanded":[`true`,`false`,`undefined`],"aria-flowto":null,"aria-grabbed":[`true`,`false`,`undefined`],"aria-haspopup":Iq,"aria-hidden":Iq,"aria-invalid":[`true`,`false`,`grammar`,`spelling`],"aria-label":null,"aria-labelledby":null,"aria-level":null,"aria-live":[`off`,`polite`,`assertive`],"aria-multiline":Iq,"aria-multiselectable":Iq,"aria-owns":null,"aria-posinset":null,"aria-pressed":[`true`,`false`,`mixed`,`undefined`],"aria-readonly":Iq,"aria-relevant":null,"aria-required":Iq,"aria-selected":[`true`,`false`,`undefined`],"aria-setsize":null,"aria-sort":[`ascending`,`descending`,`none`,`other`],"aria-valuemax":null,"aria-valuemin":null,"aria-valuenow":null,"aria-valuetext":null},zq=`beforeunload copy cut dragstart dragover dragleave dragenter dragend drag paste focus blur change click load mousedown mouseenter mouseleave mouseup keydown keyup resize scroll unload`.split(` `).map(e=>`on`+e);for(let e of zq)Rq[e]=null;Bq=class{constructor(e,t){this.tags=Object.assign(Object.assign({},nNt),e),this.globalAttrs=Object.assign(Object.assign({},Rq),t),this.allTags=Object.keys(this.tags),this.globalAttrNames=Object.keys(this.globalAttrs)}},Bq.default=new Bq,Vq=/^[:\-\.\w\u00b7-\uffff]*$/,rNt=Sq.parser.configure({top:`SingleExpression`}),Hq=[{tag:`script`,attrs:e=>e.type==`text/typescript`||e.lang==`ts`,parser:wq.parser},{tag:`script`,attrs:e=>e.type==`text/babel`||e.type==`text/jsx`,parser:Tq.parser},{tag:`script`,attrs:e=>e.type==`text/typescript-jsx`,parser:Eq.parser},{tag:`script`,attrs(e){return/^(importmap|speculationrules|application\/(.+\+)?json)$/i.test(e.type)},parser:rNt},{tag:`script`,attrs(e){return!e.type||/^(?:text|application)\/(?:x-)?(?:java|ecma)script$|^module$|^$/i.test(e.type)},parser:Sq.parser},{tag:`style`,attrs(e){return(!e.lang||e.lang==`css`)&&(!e.type||/^(text\/)?(x-)?(stylesheet|css)$/i.test(e.type))},parser:HK.parser}],Uq=[{name:`style`,parser:HK.parser.configure({top:`Styles`})}].concat(zq.map(e=>({name:e,parser:Sq.parser}))),Wq=KW.define({name:`html`,parser:iMt.configure({props:[tG.add({Element(e){let t=/^(\s*)(<\/)?/.exec(e.textAfter);return e.node.to<=e.pos+t[0].length?e.continue():e.lineIndent(e.node.from)+(t[2]?0:e.unit)},"OpenTag CloseTag SelfClosingTag"(e){return e.column(e.node.from)+e.unit},Document(e){if(e.pos+/\s*/.exec(e.textAfter)[0].length<e.node.to)return e.continue();let t=null,n;for(let n=e.node;;){let e=n.lastChild;if(!e||e.name!=`Element`||e.to!=n.to)break;t=n=e}return t&&!((n=t.lastChild)&&(n.name==`CloseTag`||n.name==`SelfClosingTag`))?e.lineIndent(t.from)+e.unit:null}}),nG.add({Element(e){let t=e.firstChild,n=e.lastChild;return!t||t.name!=`OpenTag`?null:{from:t.to,to:n.name==`CloseTag`?n.from:e.to}}}),hG.add({"OpenTag CloseTag":e=>e.getChild(`TagName`)})]}),languageData:{commentTokens:{block:{open:`<!--`,close:`-->`}},indentOnInput:/^\s*<\/\w+\W$/,wordChars:`-._`}}),Gq=Wq.configure({wrap:Cjt(Hq,Uq)}),Kq=new Set(`area base br col command embed frame hr img input keygen link meta param source track wbr menuitem`.split(` `)),iNt=oU.inputHandler.of((e,t,n,r,i)=>{if(e.composing||e.state.readOnly||t!=n||r!=`>`&&r!=`/`||!Gq.isActiveAt(e.state,t,-1))return!1;let a=i(),{state:o}=a,s=o.changeByRange(e=>{let t=o.doc.sliceString(e.from-1,e.to)==r,{head:n}=e,i=NW(o).resolveInner(n,-1),a;if(t&&r==`>`&&i.name==`EndTag`){let t=i.parent;if(t.parent?.lastChild?.name!=`CloseTag`&&(a=kq(o.doc,t.parent,n))&&!Kq.has(a))return{range:e,changes:{from:n,to:n+(o.doc.sliceString(n,n+1)===`>`?1:0),insert:`</${a}>`}}}else if(t&&r==`/`&&i.name==`IncompleteCloseTag`){let e=i.parent;if(i.from==n-2&&e.lastChild?.name!=`CloseTag`&&(a=kq(o.doc,e,n))&&!Kq.has(a)){let e=n+(o.doc.sliceString(n,n+1)===`>`?1:0),t=`${a}>`;return{range:Bz.cursor(n+t.length,-1),changes:{from:n,to:e,insert:t}}}}return{range:e}});return s.changes.empty?!1:(e.dispatch([a,o.update(s,{userEvent:`input.complete`,scrollIntoView:!0})]),!0)})})),oNt,sNt,cNt=s((()=>{kK(),MW(),oNt=fW({String:$.string,Number:$.number,"True False":$.bool,PropertyName:$.propertyName,Null:$.null,",":$.separator,"[ ]":$.squareBracket,"{ }":$.brace}),sNt=OK.deserialize({version:14,states:`$bOVQPOOOOQO'#Cb'#CbOnQPO'#CeOvQPO'#CjOOQO'#Cp'#CpQOQPOOOOQO'#Cg'#CgO}QPO'#CfO!SQPO'#CrOOQO,59P,59PO![QPO,59PO!aQPO'#CuOOQO,59U,59UO!iQPO,59UOVQPO,59QOqQPO'#CkO!nQPO,59^OOQO1G.k1G.kOVQPO'#ClO!vQPO,59aOOQO1G.p1G.pOOQO1G.l1G.lOOQO,59V,59VOOQO-E6i-E6iOOQO,59W,59WOOQO-E6j-E6j`,stateData:`#O~OcOS~OQSORSOSSOTSOWQO]ROePO~OVXOeUO~O[[O~PVOg^O~Oh_OVfX~OVaO~OhbO[iX~O[dO~Oh_OVfa~OhbO[ia~O`,goto:"!kjPPPPPPkPPkqwPPk{!RPPP!XP!ePP!hXSOR^bQWQRf_TVQ_Q`WRg`QcZRicQTOQZRQe^RhbRYQR]R",nodeNames:`⚠ JsonText True False Null Number String } { Object Property PropertyName ] [ Array`,maxTerm:25,nodeProps:[[`isolate`,-2,6,11,``],[`openedBy`,7,`{`,12,`[`],[`closedBy`,8,`}`,13,`]`]],propSources:[oNt],skippedNodes:[0],repeatNodeCount:2,tokenData:"(|~RaXY!WYZ!W]^!Wpq!Wrs!]|}$u}!O$z!Q!R%T!R![&c![!]&t!}#O&y#P#Q'O#Y#Z'T#b#c'r#h#i(Z#o#p(r#q#r(w~!]Oc~~!`Wpq!]qr!]rs!xs#O!]#O#P!}#P;'S!];'S;=`$o<%lO!]~!}Oe~~#QXrs!]!P!Q!]#O#P!]#U#V!]#Y#Z!]#b#c!]#f#g!]#h#i!]#i#j#m~#pR!Q![#y!c!i#y#T#Z#y~#|R!Q![$V!c!i$V#T#Z$V~$YR!Q![$c!c!i$c#T#Z$c~$fR!Q![!]!c!i!]#T#Z!]~$rP;=`<%l!]~$zOh~~$}Q!Q!R%T!R![&c~%YRT~!O!P%c!g!h%w#X#Y%w~%fP!Q![%i~%nRT~!Q![%i!g!h%w#X#Y%w~%zR{|&T}!O&T!Q![&Z~&WP!Q![&Z~&`PT~!Q![&Z~&hST~!O!P%c!Q![&c!g!h%w#X#Y%w~&yOg~~'OO]~~'TO[~~'WP#T#U'Z~'^P#`#a'a~'dP#g#h'g~'jP#X#Y'm~'rOR~~'uP#i#j'x~'{P#`#a(O~(RP#`#a(U~(ZOS~~(^P#f#g(a~(dP#i#j(g~(jP#X#Y(m~(rOQ~~(wOW~~(|OV~",tokenizers:[0],topRules:{JsonText:[0,1]},tokenPrec:0})}));function lNt(){return new QW(uNt)}var uNt,dNt=s((()=>{cNt(),yG(),uNt=KW.define({name:`json`,parser:sNt.configure({props:[tG.add({Object:FW({except:/^\s*\}/}),Array:FW({except:/^\s*\]/})}),nG.add({"Object Array":IW})]}),languageData:{closeBrackets:{brackets:[`[`,`{`,`"`]},indentOnInput:/^\s*[\}\]]$/}})}));function fNt(e){return e==45||e==46||e==58||e>=65&&e<=90||e==95||e>=97&&e<=122||e>=161}function pNt(e){return e==9||e==10||e==13||e==32}function qq(e,t){let n=e.pos+t;if(Zq==e&&Qq==n)return Xq;for(;pNt(e.peek(t));)t++;let r=``;for(;;){let n=e.peek(t);if(!fNt(n))break;r+=String.fromCharCode(n),t++}return Zq=e,Qq=n,Xq=r||null}function mNt(e,t){this.name=e,this.parent=t,this.hash=t?t.hash:0;for(let t=0;t<e.length;t++)this.hash+=(this.hash<<4)+e.charCodeAt(t)+(e.charCodeAt(t)<<8)}function Jq(e,t){return new CK(n=>{let r=0,i=t.charCodeAt(0);scan:for(;!(n.next<0);n.advance(),r++)if(n.next==i){for(let e=1;e<t.length;e++)if(n.peek(e)!=t.charCodeAt(e))continue scan;break}r&&n.acceptToken(e)})}var Yq,hNt,gNt,_Nt,vNt,yNt,bNt,xNt,SNt,CNt,Xq,Zq,Qq,wNt,TNt,ENt,DNt,ONt,kNt,ANt,jNt=s((()=>{kK(),MW(),Yq=1,hNt=2,gNt=3,_Nt=4,vNt=5,yNt=35,bNt=36,xNt=37,SNt=11,CNt=13,Xq=null,Zq=null,Qq=0,wNt=new DK({start:null,shift(e,t,n,r){return t==Yq?new mNt(qq(r,1)||``,e):e},reduce(e,t){return t==SNt&&e?e.parent:e},reuse(e,t,n,r){let i=t.type.id;return i==Yq||i==CNt?new mNt(qq(r,1)||``,e):e},hash(e){return e?e.hash:0},strict:!1}),TNt=new CK((e,t)=>{if(e.next==60){if(e.advance(),e.next==47){e.advance();let n=qq(e,0);if(!n)return e.acceptToken(vNt);if(t.context&&n==t.context.name)return e.acceptToken(hNt);for(let r=t.context;r;r=r.parent)if(r.name==n)return e.acceptToken(gNt,-2);e.acceptToken(_Nt)}else if(e.next!=33&&e.next!=63)return e.acceptToken(Yq)}},{contextual:!0}),ENt=Jq(yNt,`-->`),DNt=Jq(bNt,`?>`),ONt=Jq(xNt,`]]>`),kNt=fW({Text:$.content,"StartTag StartCloseTag EndTag SelfCloseEndTag":$.angleBracket,TagName:$.tagName,"MismatchedCloseTag/TagName":[$.tagName,$.invalid],AttributeName:$.attributeName,AttributeValue:$.attributeValue,Is:$.definitionOperator,"EntityReference CharacterReference":$.character,Comment:$.blockComment,ProcessingInst:$.processingInstruction,DoctypeDecl:$.documentMeta,Cdata:$.special($.string)}),ANt=OK.deserialize({version:14,states:",SOQOaOOOrOxO'#CfOzOpO'#CiO!tOaO'#CgOOOP'#Cg'#CgO!{OrO'#CrO#TOtO'#CsO#]OpO'#CtOOOP'#DS'#DSOOOP'#Cv'#CvQQOaOOOOOW'#Cw'#CwO#eOxO,59QOOOP,59Q,59QOOOO'#Cx'#CxO#mOpO,59TO#uO!bO,59TOOOP'#C{'#C{O$TOaO,59RO$[OpO'#CoOOOP,59R,59ROOOQ'#C|'#C|O$dOrO,59^OOOP,59^,59^OOOS'#C}'#C}O$lOtO,59_OOOP,59_,59_O$tOpO,59`O$|OpO,59`OOOP-E6t-E6tOOOW-E6u-E6uOOOP1G.l1G.lOOOO-E6v-E6vO%UO!bO1G.oO%UO!bO1G.oO%dOpO'#CkO%lO!bO'#CyO%zO!bO1G.oOOOP1G.o1G.oOOOP1G.w1G.wOOOP-E6y-E6yOOOP1G.m1G.mO&VOpO,59ZO&_OpO,59ZOOOQ-E6z-E6zOOOP1G.x1G.xOOOS-E6{-E6{OOOP1G.y1G.yO&gOpO1G.zO&gOpO1G.zOOOP1G.z1G.zO&oO!bO7+$ZO&}O!bO7+$ZOOOP7+$Z7+$ZOOOP7+$c7+$cO'YOpO,59VO'bOpO,59VO'jO!bO,59eOOOO-E6w-E6wO'xOpO1G.uO'xOpO1G.uOOOP1G.u1G.uO(QOpO7+$fOOOP7+$f7+$fO(YO!bO<<GuOOOP<<Gu<<GuOOOP<<G}<<G}O'bOpO1G.qO'bOpO1G.qO(eO#tO'#CnOOOO1G.q1G.qO(sOpO7+$aOOOP7+$a7+$aOOOP<<HQ<<HQOOOPAN=aAN=aOOOPAN=iAN=iO'bOpO7+$]OOOO7+$]7+$]OOOO'#Cz'#CzO({O#tO,59YOOOO,59Y,59YOOOP<<G{<<G{OOOO<<Gw<<GwOOOO-E6x-E6xOOOO1G.t1G.t",stateData:")Z~OPQOSVOTWOVWOWWOXWOiXOxPO}TO!PUO~OuZOw]O~O^`Oy^O~OPQOQcOSVOTWOVWOWWOXWOxPO}TO!PUO~ORdO~P!SOseO|gO~OthO!OjO~O^lOy^O~OuZOwoO~O^qOy^O~O[vO`sOdwOy^O~ORyO~P!SO^{Oy^O~OseO|}O~OthO!O!PO~O^!QOy^O~O[!SOy^O~O[!VO`sOd!WOy^O~Oa!YOy^O~Oy^O[mX`mXdmX~O[!VO`sOd!WO~O^!]Oy^O~O[!_Oy^O~O[!aOy^O~O[!cO`sOd!dOy^O~O[!cO`sOd!dO~Oa!eOy^O~Oy^Oz!gO~Oy^O[ma`madma~O[!jOy^O~O[!kOy^O~O[!lO`sOd!mO~OW!pOX!pOz!rO{!pO~O[!sOy^O~OW!pOX!pOz!vO{!pO~O",goto:"%[wPPPPPPPPPPxxP!OP!UPP!_!iP!oxxxP!u!{#R$Z$j$p$v$|PPPP%SXWORYbXRORYb_t`qru!T!U!bQ!h!YS!o!e!fR!t!nQdRRybXSORYbQYORmYQ[PRn[Q_QQkVjp_krz!R!T!X!Z!^!`!f!i!nQr`QzcQ!RlQ!TqQ!XsQ!ZtQ!^{Q!`!QQ!f!YQ!i!]R!n!eQu`S!UqrU![u!U!bR!b!TQ!q!gR!u!qQbRRxbQfTR|fQiUR!OiSXOYTaRb",nodeNames:`⚠ StartTag StartCloseTag MissingCloseTag StartCloseTag StartCloseTag Document Text EntityReference CharacterReference Cdata Element EndTag OpenTag TagName Attribute AttributeName Is AttributeValue CloseTag SelfCloseEndTag SelfClosingTag Comment ProcessingInst MismatchedCloseTag DoctypeDecl`,maxTerm:47,context:wNt,nodeProps:[[`closedBy`,1,`SelfCloseEndTag EndTag`,13,`CloseTag MissingCloseTag`],[`openedBy`,12,`StartTag StartCloseTag`,19,`OpenTag`,20,`StartTag`],[`isolate`,-6,13,18,19,21,22,24,``]],propSources:[kNt],skippedNodes:[0],repeatNodeCount:8,tokenData:"Jy~R!XOX$nXY&kYZ&kZ]$n]^&k^p$npq&kqr$nrs'ssv$nvw(Zw}$n}!O,^!O!P$n!P!Q.m!Q![$n![!]0V!]!^$n!^!_3h!_!`El!`!aF_!a!bGQ!b!c$n!c!}0V!}#P$n#P#QHj#Q#R$n#R#S0V#S#T$n#T#o0V#o%W$n%W%o0V%o%p$n%p&a0V&a&b$n&b1p0V1p4U$n4U4d0V4d4e$n4e$IS0V$IS$I`$n$I`$Ib0V$Ib$Kh$n$Kh%#t0V%#t&/x$n&/x&Et0V&Et&FV$n&FV;'S0V;'S;:j3b;:j;=`&e<%l?&r$n?&r?Ah0V?Ah?BY$n?BY?Mn0V?MnO$nX$uWVP{WOr$nrs%_sv$nw!^$n!^!_%y!_;'S$n;'S;=`&e<%lO$nP%dTVPOv%_w!^%_!_;'S%_;'S;=`%s<%lO%_P%vP;=`<%l%_W&OT{WOr%ysv%yw;'S%y;'S;=`&_<%lO%yW&bP;=`<%l%yX&hP;=`<%l$n_&t_VP{WyUOX$nXY&kYZ&kZ]$n]^&k^p$npq&kqr$nrs%_sv$nw!^$n!^!_%y!_;'S$n;'S;=`&e<%lO$nZ'zTzYVPOv%_w!^%_!_;'S%_;'S;=`%s<%lO%_~(^ast)c![!]*g!c!}*g#R#S*g#T#o*g%W%o*g%p&a*g&b1p*g4U4d*g4e$IS*g$I`$Ib*g$Kh%#t*g&/x&Et*g&FV;'S*g;'S;:j,W?&r?Ah*g?BY?Mn*g~)fQ!Q![)l#l#m)z~)oQ!Q![)l!]!^)u~)zOX~~)}R!Q![*W!c!i*W#T#Z*W~*ZS!Q![*W!]!^)u!c!i*W#T#Z*W~*jg}!O*g!O!P*g!Q![*g![!]*g!]!^,R!c!}*g#R#S*g#T#o*g$}%O*g%W%o*g%p&a*g&b1p*g1p4U*g4U4d*g4e$IS*g$I`$Ib*g$Je$Jg*g$Kh%#t*g&/x&Et*g&FV;'S*g;'S;:j,W?&r?Ah*g?BY?Mn*g~,WOW~~,ZP;=`<%l*gZ,eYVP{WOr$nrs%_sv$nw}$n}!O-T!O!^$n!^!_%y!_;'S$n;'S;=`&e<%lO$nZ-[YVP{WOr$nrs%_sv$nw!^$n!^!_%y!_!`$n!`!a-z!a;'S$n;'S;=`&e<%lO$nZ.TW|QVP{WOr$nrs%_sv$nw!^$n!^!_%y!_;'S$n;'S;=`&e<%lO$n].tYVP{WOr$nrs%_sv$nw!^$n!^!_%y!_!`$n!`!a/d!a;'S$n;'S;=`&e<%lO$n]/mWdSVP{WOr$nrs%_sv$nw!^$n!^!_%y!_;'S$n;'S;=`&e<%lO$n_0b!O`S^QVP{WOr$nrs%_sv$nw}$n}!O0V!O!P0V!P!Q$n!Q![0V![!]0V!]!^$n!^!_%y!_!c$n!c!}0V!}#R$n#R#S0V#S#T$n#T#o0V#o$}$n$}%O0V%O%W$n%W%o0V%o%p$n%p&a0V&a&b$n&b1p0V1p4U0V4U4d0V4d4e$n4e$IS0V$IS$I`$n$I`$Ib0V$Ib$Je$n$Je$Jg0V$Jg$Kh$n$Kh%#t0V%#t&/x$n&/x&Et0V&Et&FV$n&FV;'S0V;'S;:j3b;:j;=`&e<%l?&r$n?&r?Ah0V?Ah?BY$n?BY?Mn0V?MnO$n_3eP;=`<%l0VX3mW{WOq%yqr4Vsv%yw!a%y!a!bEU!b;'S%y;'S;=`&_<%lO%yX4[]{WOr%ysv%yw}%y}!O5T!O!f%y!f!g6V!g!}%y!}#O;f#O#W%y#W#XAr#X;'S%y;'S;=`&_<%lO%yX5YV{WOr%ysv%yw}%y}!O5o!O;'S%y;'S;=`&_<%lO%yX5vT}P{WOr%ysv%yw;'S%y;'S;=`&_<%lO%yX6[V{WOr%ysv%yw!q%y!q!r6q!r;'S%y;'S;=`&_<%lO%yX6vV{WOr%ysv%yw!e%y!e!f7]!f;'S%y;'S;=`&_<%lO%yX7bV{WOr%ysv%yw!v%y!v!w7w!w;'S%y;'S;=`&_<%lO%yX7|V{WOr%ysv%yw!{%y!{!|8c!|;'S%y;'S;=`&_<%lO%yX8hV{WOr%ysv%yw!r%y!r!s8}!s;'S%y;'S;=`&_<%lO%yX9SV{WOr%ysv%yw!g%y!g!h9i!h;'S%y;'S;=`&_<%lO%yX9nX{WOr9irs:Zsv9ivw:Zw!`9i!`!a:x!a;'S9i;'S;=`;`<%lO9iP:^TO!`:Z!`!a:m!a;'S:Z;'S;=`:r<%lO:ZP:rOiPP:uP;=`<%l:ZX;PTiP{WOr%ysv%yw;'S%y;'S;=`&_<%lO%yX;cP;=`<%l9iX;kX{WOr%ysv%yw!e%y!e!f<W!f#V%y#V#W?f#W;'S%y;'S;=`&_<%lO%yX<]V{WOr%ysv%yw!f%y!f!g<r!g;'S%y;'S;=`&_<%lO%yX<wV{WOr%ysv%yw!c%y!c!d=^!d;'S%y;'S;=`&_<%lO%yX=cV{WOr%ysv%yw!v%y!v!w=x!w;'S%y;'S;=`&_<%lO%yX=}V{WOr%ysv%yw!c%y!c!d>d!d;'S%y;'S;=`&_<%lO%yX>iV{WOr%ysv%yw!}%y!}#O?O#O;'S%y;'S;=`&_<%lO%yX?VT{WxPOr%ysv%yw;'S%y;'S;=`&_<%lO%yX?kV{WOr%ysv%yw#W%y#W#X@Q#X;'S%y;'S;=`&_<%lO%yX@VV{WOr%ysv%yw#T%y#T#U@l#U;'S%y;'S;=`&_<%lO%yX@qV{WOr%ysv%yw#h%y#h#iAW#i;'S%y;'S;=`&_<%lO%yXA]V{WOr%ysv%yw#T%y#T#U>d#U;'S%y;'S;=`&_<%lO%yXAwV{WOr%ysv%yw#c%y#c#dB^#d;'S%y;'S;=`&_<%lO%yXBcV{WOr%ysv%yw#V%y#V#WBx#W;'S%y;'S;=`&_<%lO%yXB}V{WOr%ysv%yw#h%y#h#iCd#i;'S%y;'S;=`&_<%lO%yXCiV{WOr%ysv%yw#m%y#m#nDO#n;'S%y;'S;=`&_<%lO%yXDTV{WOr%ysv%yw#d%y#d#eDj#e;'S%y;'S;=`&_<%lO%yXDoV{WOr%ysv%yw#X%y#X#Y9i#Y;'S%y;'S;=`&_<%lO%yXE]T!PP{WOr%ysv%yw;'S%y;'S;=`&_<%lO%yZEuWaQVP{WOr$nrs%_sv$nw!^$n!^!_%y!_;'S$n;'S;=`&e<%lO$n_FhW[UVP{WOr$nrs%_sv$nw!^$n!^!_%y!_;'S$n;'S;=`&e<%lO$nZGXYVP{WOr$nrs%_sv$nw!^$n!^!_%y!_!`$n!`!aGw!a;'S$n;'S;=`&e<%lO$nZHQW!OQVP{WOr$nrs%_sv$nw!^$n!^!_%y!_;'S$n;'S;=`&e<%lO$nZHqYVP{WOr$nrs%_sv$nw!^$n!^!_%y!_#P$n#P#QIa#Q;'S$n;'S;=`&e<%lO$nZIhYVP{WOr$nrs%_sv$nw!^$n!^!_%y!_!`$n!`!aJW!a;'S$n;'S;=`&e<%lO$nZJaWwQVP{WOr$nrs%_sv$nw!^$n!^!_%y!_;'S$n;'S;=`&e<%lO$n",tokenizers:[TNt,ENt,DNt,ONt,0,1,2,3],topRules:{Document:[0,6]},tokenPrec:0})}));function $q(e,t){let n=t&&t.getChild(`TagName`);return n?e.sliceString(n.from,n.to):``}function eJ(e,t){let n=t&&t.firstChild;return!n||n.name!=`OpenTag`?``:$q(e,n)}function MNt(e,t,n){let r=t&&t.getChildren(`Attribute`).find(e=>e.from<=n&&e.to>=n),i=r&&r.getChild(`AttributeName`);return i?e.sliceString(i.from,i.to):``}function tJ(e){for(let t=e&&e.parent;t;t=t.parent)if(t.name==`Element`)return t;return null}function NNt(e,t){let n=NW(e).resolveInner(t,-1),r=null;for(let e=n;!r&&e.parent;e=e.parent)(e.name==`OpenTag`||e.name==`CloseTag`||e.name==`SelfClosingTag`||e.name==`MismatchedCloseTag`)&&(r=e);if(r&&(r.to>t||r.lastChild.type.isError)){let e=r.parent;if(n.name==`TagName`)return r.name==`CloseTag`||r.name==`MismatchedCloseTag`?{type:`closeTag`,from:n.from,context:e}:{type:`openTag`,from:n.from,context:tJ(e)};if(n.name==`AttributeName`)return{type:`attrName`,from:n.from,context:r};if(n.name==`AttributeValue`)return{type:`attrValue`,from:n.from,context:r};let i=n==r||n.name==`Attribute`?n.childBefore(t):n;return i?.name==`StartTag`?{type:`openTag`,from:t,context:tJ(e)}:i?.name==`StartCloseTag`&&i.to<=t?{type:`closeTag`,from:t,context:e}:i?.name==`Is`?{type:`attrValue`,from:t,context:r}:i?{type:`attrName`,from:t,context:r}:null}else if(n.name==`StartCloseTag`)return{type:`closeTag`,from:t,context:n.parent};for(;n.parent&&n.to==t&&!n.lastChild?.type.isError;)n=n.parent;return n.name==`Element`||n.name==`Text`||n.name==`Document`?{type:`tag`,from:t,context:n.name==`Element`?n:tJ(n)}:null}function PNt(e){return Object.assign(Object.assign({type:`property`},e.completion||{}),{label:e.name})}function FNt(e){return typeof e==`string`?{label:`"${e}"`,type:`constant`}:/^"/.test(e.label)?e:Object.assign(Object.assign({},e),{label:`"${e.label}"`})}function INt(e,t){let n=[],r=[],i=Object.create(null);for(let e of t){let t=PNt(e);n.push(t),e.global&&r.push(t),e.values&&(i[e.name]=e.values.map(FNt))}let a=[],o=[],s=Object.create(null);for(let t of e){let e=r,c=i;t.attributes&&(e=e.concat(t.attributes.map(e=>typeof e==`string`?n.find(t=>t.label==e)||{label:e,type:`property`}:(e.values&&(c==i&&(c=Object.create(c)),c[e.name]=e.values.map(FNt)),PNt(e)))));let l=new zNt(t,e,c);s[l.name]=l,a.push(l),t.top&&o.push(l)}o.length||(o=a);for(let t=0;t<a.length;t++){let n=e[t],r=a[t];if(n.children)for(let e of n.children)s[e]&&r.children.push(s[e]);else r.children=a}return e=>{let{doc:t}=e.state,n=NNt(e.state,e.pos);if(!n||n.type==`tag`&&!e.explicit)return null;let{type:c,from:l,context:u}=n;if(c==`openTag`){let e=o,n=eJ(t,u);return n&&(e=s[n]?.children||a),{from:l,options:e.map(e=>e.completion),validFor:nJ}}else if(c==`closeTag`){let n=eJ(t,u);return n?{from:l,to:e.pos+(t.sliceString(e.pos,e.pos+1)==`>`?1:0),options:[s[n]?.closeNameCompletion||{label:n+`>`,type:`type`}],validFor:nJ}:null}else if(c==`attrName`)return{from:l,options:s[$q(t,u)]?.attrs||r,validFor:nJ};else if(c==`attrValue`){let n=MNt(t,u,l);if(!n)return null;let r=(s[$q(t,u)]?.attrValues||i)[n];return!r||!r.length?null:{from:l,to:e.pos+(t.sliceString(e.pos,e.pos+1)==`"`?1:0),options:r,validFor:/^"[^"]*"?$/}}else if(c==`tag`){let n=eJ(t,u),r=s[n],i=[],c=u&&u.lastChild;n&&(!c||c.name!=`CloseTag`||$q(t,c)!=n)&&i.push(r?r.closeCompletion:{label:`</`+n+`>`,type:`type`,boost:2});let d=i.concat((r?.children||(u?a:o)).map(e=>e.openCompletion));if(u&&r?.text.length){let t=u.firstChild;t.to>e.pos-20&&!/\S/.test(e.state.sliceDoc(t.to,e.pos))&&(d=d.concat(r.text))}return{from:l,options:d,validFor:/^<\/?[:\-\.\w\u00b7-\uffff]*$/}}else return null}}function LNt(e={}){let t=[rJ.data.of({autocomplete:INt(e.elements||[],e.attributes||[])})];return e.autoCloseTags!==!1&&t.push(BNt),new QW(rJ,t)}function RNt(e,t,n=e.length){if(!t)return``;let r=t.firstChild,i=r&&r.getChild(`TagName`);return i?e.sliceString(i.from,Math.min(i.to,n)):``}var zNt,nJ,rJ,BNt,VNt=s((()=>{jNt(),yG(),vB(),RU(),zNt=class{constructor(e,t,n){this.attrs=t,this.attrValues=n,this.children=[],this.name=e.name,this.completion=Object.assign(Object.assign({type:`type`},e.completion||{}),{label:this.name}),this.openCompletion=Object.assign(Object.assign({},this.completion),{label:`<`+this.name}),this.closeCompletion=Object.assign(Object.assign({},this.completion),{label:`</`+this.name+`>`,boost:2}),this.closeNameCompletion=Object.assign(Object.assign({},this.completion),{label:this.name+`>`}),this.text=e.textContent?e.textContent.map(e=>({label:e,type:`text`})):[]}},nJ=/^[:\-\.\w\u00b7-\uffff]*$/,rJ=KW.define({name:`xml`,parser:ANt.configure({props:[tG.add({Element(e){let t=/^\s*<\//.test(e.textAfter);return e.lineIndent(e.node.from)+(t?0:e.unit)},"OpenTag CloseTag SelfClosingTag"(e){return e.column(e.node.from)+e.unit}}),nG.add({Element(e){let t=e.firstChild,n=e.lastChild;return!t||t.name!=`OpenTag`?null:{from:t.to,to:n.name==`CloseTag`?n.from:e.to}}}),hG.add({"OpenTag CloseTag":e=>e.getChild(`TagName`)})]}),languageData:{commentTokens:{block:{open:`<!--`,close:`-->`}},indentOnInput:/^\s*<\/$/}}),BNt=oU.inputHandler.of((e,t,n,r,i)=>{if(e.composing||e.state.readOnly||t!=n||r!=`>`&&r!=`/`||!rJ.isActiveAt(e.state,t,-1))return!1;let a=i(),{state:o}=a,s=o.changeByRange(e=>{let{head:t}=e,n=o.doc.sliceString(t-1,t)==r,i=NW(o).resolveInner(t,-1),a;if(n&&r==`>`&&i.name==`EndTag`){let n=i.parent;if(n.parent?.lastChild?.name!=`CloseTag`&&(a=RNt(o.doc,n.parent,t)))return{range:e,changes:{from:t,to:t+(o.doc.sliceString(t,t+1)===`>`?1:0),insert:`</${a}>`}}}else if(n&&r==`/`&&i.name==`StartCloseTag`){let e=i.parent;if(i.from==t-2&&e.lastChild?.name!=`CloseTag`&&(a=RNt(o.doc,e,t))){let e=t+(o.doc.sliceString(t,t+1)===`>`?1:0),n=`${a}>`;return{range:Bz.cursor(t+n.length,-1),changes:{from:t,to:e,insert:n}}}}return{range:e}});return s.changes.empty?!1:(e.dispatch([a,o.update(s,{userEvent:`input.complete`,scrollIntoView:!0})]),!0)})}));function iJ(e,t){for(let n=0,r=t-e.pos-1;;r--,n++){let t=e.peek(r);if(oJ(t)||t==-1)return n}}function aJ(e){return e==32||e==9}function oJ(e){return e==10||e==13}function HNt(e){return aJ(e)||oJ(e)}function sJ(e){return e<0||HNt(e)}function cJ(e,t,n=0){return e.peek(n)==t&&e.peek(n+1)==t&&e.peek(n+2)==t&&sJ(e.peek(n+3))}function UNt(e){return e>32&&e<127&&e!=34&&e!=37&&e!=44&&e!=60&&e!=62&&e!=92&&e!=94&&e!=96&&e!=123&&e!=124&&e!=125}function WNt(e){return e>=48&&e<=57||e>=97&&e<=102||e>=65&&e<=70}function GNt(e,t){return e.next==37?(e.advance(),WNt(e.next)&&e.advance(),WNt(e.next)&&e.advance(),!0):UNt(e.next)||t&&e.next==44?(e.advance(),!0):!1}function KNt(e){if(e.advance(),e.next==60){for(e.advance();;)if(!GNt(e,!0)){e.next==62&&e.advance();break}}else for(;GNt(e,!1););}function lJ(e){for(e.advance();!sJ(e.next)&&dJ(e.tag)!=`f`;)e.advance()}function uJ(e,t){let n=e.next,r=!1,i=e.pos;for(e.advance();;){let a=e.next;if(a<0)break;if(e.advance(),a==n)if(a==39)if(e.next==39)e.advance();else break;else break;else if(a==92&&n==34)e.next>=0&&e.advance();else if(oJ(a)){if(t)return!1;r=!0}else if(t&&e.pos>=i+1024)return!1}return!r}function qNt(e){for(let t=[],n=e.pos+1024;;)if(e.next==91||e.next==123)t.push(e.next),e.advance();else if(e.next==39||e.next==34){if(!uJ(e,!0))return!1}else if(e.next==93||e.next==125){if(t[t.length-1]!=e.next-2)return!1;if(t.pop(),e.advance(),!t.length)return!0}else if(e.next<0||e.pos>n||oJ(e.next))return!1;else e.advance()}function dJ(e){return e<33?`u`:e>125?`s`:gPt[e-33]}function fJ(e,t){let n=dJ(e);return n!=`u`&&!(t&&n==`f`)}function JNt(e,t,n,r){if(dJ(e.next)==`s`||(e.next==63||e.next==58||e.next==45)&&fJ(e.peek(1),n))e.advance();else return!1;let i=e.pos;for(;;){let a=e.next,o=0,s=r+1;for(;HNt(a);){if(oJ(a)){if(t)return!1;s=0}else s++;a=e.peek(++o)}if(!(a>=0&&(a==58?fJ(e.peek(o+1),n):a==35?e.peek(o-1)!=32:fJ(a,n)))||!n&&s<=r||s==0&&!n&&(cJ(e,45,o)||cJ(e,46,o)))break;if(t&&dJ(a)==`f`)return!1;for(let t=o;t>=0;t--)e.advance();if(t&&e.pos>i+1024)return!1}return!0}var pJ,mJ,YNt,XNt,hJ,ZNt,gJ,QNt,$Nt,_J,ePt,tPt,nPt,rPt,iPt,aPt,vJ,oPt,sPt,cPt,lPt,uPt,dPt,fPt,yJ,bJ,xJ,SJ,CJ,pPt,mPt,hPt,gPt,_Pt,vPt,yPt,bPt,xPt=s((()=>{kK(),MW(),pJ=63,mJ=64,YNt=1,XNt=2,hJ=3,ZNt=4,gJ=5,QNt=6,$Nt=7,_J=65,ePt=66,tPt=8,nPt=9,rPt=10,iPt=11,aPt=12,vJ=13,oPt=19,sPt=20,cPt=29,lPt=33,uPt=34,dPt=47,fPt=0,yJ=1,bJ=2,xJ=3,SJ=4,CJ=class{constructor(e,t,n){this.parent=e,this.depth=t,this.type=n,this.hash=(e?e.hash+e.hash<<8:0)+t+(t<<4)+n}},CJ.top=new CJ(null,-1,fPt),pPt=new DK({start:CJ.top,reduce(e,t){return e.type==xJ&&(t==sPt||t==uPt)?e.parent:e},shift(e,t,n,r){if(t==hJ)return new CJ(e,iJ(r,r.pos),yJ);if(t==_J||t==gJ)return new CJ(e,iJ(r,r.pos),bJ);if(t==pJ)return e.parent;if(t==oPt||t==lPt)return new CJ(e,0,xJ);if(t==vJ&&e.type==SJ)return e.parent;if(t==dPt){let t=/[1-9]/.exec(r.read(r.pos,n.pos));if(t)return new CJ(e,e.depth+ +t[0],SJ)}return e},hash(e){return e.hash}}),mPt=new CK((e,t)=>{if(e.next==-1&&t.canShift(mJ))return e.acceptToken(mJ);let n=e.peek(-1);if((oJ(n)||n<0)&&t.context.type!=xJ){if(cJ(e,45))if(t.canShift(pJ))e.acceptToken(pJ);else return e.acceptToken(YNt,3);if(cJ(e,46))if(t.canShift(pJ))e.acceptToken(pJ);else return e.acceptToken(XNt,3);let n=0;for(;e.next==32;)n++,e.advance();(n<t.context.depth||n==t.context.depth&&t.context.type==yJ&&(e.next!=45||!sJ(e.peek(1))))&&e.next!=-1&&!oJ(e.next)&&e.next!=35&&e.acceptToken(pJ,-n)}},{contextual:!0}),hPt=new CK((e,t)=>{if(t.context.type==xJ){e.next==63&&(e.advance(),sJ(e.next)&&e.acceptToken($Nt));return}if(e.next==45)e.advance(),sJ(e.next)&&e.acceptToken(t.context.type==yJ&&t.context.depth==iJ(e,e.pos-1)?ZNt:hJ);else if(e.next==63)e.advance(),sJ(e.next)&&e.acceptToken(t.context.type==bJ&&t.context.depth==iJ(e,e.pos-1)?QNt:gJ);else{let n=e.pos;for(;;)if(aJ(e.next)){if(e.pos==n)return;e.advance()}else if(e.next==33)KNt(e);else if(e.next==38)lJ(e);else if(e.next==42){lJ(e);break}else if(e.next==39||e.next==34){if(uJ(e,!0))break;return}else if(e.next==91||e.next==123){if(!qNt(e))return;break}else{JNt(e,!0,!1,0);break}for(;aJ(e.next);)e.advance();if(e.next==58){if(e.pos==n&&t.canShift(cPt))return;sJ(e.peek(1))&&e.acceptTokenTo(t.context.type==bJ&&t.context.depth==iJ(e,n)?ePt:_J,n)}}},{contextual:!0}),gPt=`iiisiiissisfissssssssssssisssiiissssssssssssssssssssssssssfsfssissssssssssssssssssssssssssfif`,_Pt=new CK((e,t)=>{if(e.next==33)KNt(e),e.acceptToken(aPt);else if(e.next==38||e.next==42){let t=e.next==38?rPt:iPt;lJ(e),e.acceptToken(t)}else e.next==39||e.next==34?(uJ(e,!1),e.acceptToken(nPt)):JNt(e,!1,t.context.type==xJ,t.context.depth)&&e.acceptToken(tPt)}),vPt=new CK((e,t)=>{let n=t.context.type==SJ?t.context.depth:-1,r=e.pos;scan:for(;;){let i=0,a=e.next;for(;a==32;)a=e.peek(++i);if(!i&&(cJ(e,45,i)||cJ(e,46,i))||!oJ(a)&&(n<0&&(n=Math.max(t.context.depth+1,i)),i<n))break;for(;;){if(e.next<0)break scan;let t=oJ(e.next);if(e.advance(),t)continue scan;r=e.pos}}e.acceptTokenTo(vJ,r)}),yPt=fW({DirectiveName:$.keyword,DirectiveContent:$.attributeValue,"DirectiveEnd DocEnd":$.meta,QuotedLiteral:$.string,BlockLiteralHeader:$.special($.string),BlockLiteralContent:$.content,Literal:$.content,"Key/Literal Key/QuotedLiteral":$.definition($.propertyName),"Anchor Alias":$.labelName,Tag:$.typeName,Comment:$.lineComment,": , -":$.separator,"?":$.punctuation,"[ ]":$.squareBracket,"{ }":$.brace}),bPt=OK.deserialize({version:14,states:"5lQ!ZQgOOO#PQfO'#CpO#uQfO'#DOOOQR'#Dv'#DvO$qQgO'#DRO%gQdO'#DUO%nQgO'#DUO&ROaO'#D[OOQR'#Du'#DuO&{QgO'#D^O'rQgO'#D`OOQR'#Dt'#DtO(iOqO'#DbOOQP'#Dj'#DjO(zQaO'#CmO)YQgO'#CmOOQP'#Cm'#CmQ)jQaOOQ)uQgOOQ]QgOOO*PQdO'#CrO*nQdO'#CtOOQO'#Dw'#DwO+]Q`O'#CxO+hQdO'#CwO+rQ`O'#CwOOQO'#Cv'#CvO+wQdO'#CvOOQO'#Cq'#CqO,UQ`O,59[O,^QfO,59[OOQR,59[,59[OOQO'#Cx'#CxO,eQ`O'#DPO,pQdO'#DPOOQO'#Dx'#DxO,zQdO'#DxO-XQ`O,59jO-aQfO,59jOOQR,59j,59jOOQR'#DS'#DSO-hQcO,59mO-sQgO'#DVO.TQ`O'#DVO.YQcO,59pOOQR'#DX'#DXO#|QfO'#DWO.hQcO'#DWOOQR,59v,59vO.yOWO,59vO/OOaO,59vO/WOaO,59vO/cQgO'#D_OOQR,59x,59xO0VQgO'#DaOOQR,59z,59zOOQP,59|,59|O0yOaO,59|O1ROaO,59|O1aOqO,59|OOQP-E7h-E7hO1oQgO,59XOOQP,59X,59XO2PQaO'#DeO2_QgO'#DeO2oQgO'#DkOOQP'#Dk'#DkQ)jQaOOO3PQdO'#CsOOQO,59^,59^O3kQdO'#CuOOQO,59`,59`OOQO,59c,59cO4VQdO,59cO4aQdO'#CzO4kQ`O'#CzOOQO,59b,59bOOQU,5:Q,5:QOOQR1G.v1G.vO4pQ`O1G.vOOQU-E7d-E7dO4xQdO,59kOOQO,59k,59kO5SQdO'#DQO5^Q`O'#DQOOQO,5:d,5:dOOQU,5:R,5:ROOQR1G/U1G/UO5cQ`O1G/UOOQU-E7e-E7eO5kQgO'#DhO5xQcO1G/XOOQR1G/X1G/XOOQR,59q,59qO6TQgO,59qO6eQdO'#DiO6lQgO'#DiO7PQcO1G/[OOQR1G/[1G/[OOQR,59r,59rO#|QfO,59rOOQR1G/b1G/bO7_OWO1G/bO7dOaO1G/bOOQR,59y,59yOOQR,59{,59{OOQP1G/h1G/hO7lOaO1G/hO7tOaO1G/hO8POaO1G/hOOQP1G.s1G.sO8_QgO,5:POOQP,5:P,5:POOQP,5:V,5:VOOQP-E7i-E7iOOQO,59_,59_OOQO,59a,59aOOQO1G.}1G.}OOQO,59f,59fO8oQdO,59fOOQR7+$b7+$bP,XQ`O'#DfOOQO1G/V1G/VOOQO,59l,59lO8yQdO,59lOOQR7+$p7+$pP9TQ`O'#DgOOQR'#DT'#DTOOQR,5:S,5:SOOQR-E7f-E7fOOQR7+$s7+$sOOQR1G/]1G/]O9YQgO'#DYO9jQ`O'#DYOOQR,5:T,5:TO#|QfO'#DZO9oQcO'#DZOOQR-E7g-E7gOOQR7+$v7+$vOOQR1G/^1G/^OOQR7+$|7+$|O:QOWO7+$|OOQP7+%S7+%SO:VOaO7+%SO:_OaO7+%SOOQP1G/k1G/kOOQO1G/Q1G/QOOQO1G/W1G/WOOQR,59t,59tO:jQgO,59tOOQR,59u,59uO#|QfO,59uOOQR<<Hh<<HhOOQP<<Hn<<HnO:zOaO<<HnOOQR1G/`1G/`OOQR1G/a1G/aOOQPAN>YAN>Y",stateData:";S~O!fOS!gOS^OS~OP_OQbORSOTUOWROXROYYOZZO[XOcPOqQO!PVO!V[O!cTO~O`cO~P]OVkOWROXROYeOZfO[dOcPOmhOqQO~OboO~P!bOVtOWROXROYeOZfO[dOcPOmrOqQO~OpwO~P#WORSOTUOWROXROYYOZZO[XOcPOqQO!PVO!cTO~OSvP!avP!bvP~P#|OWROXROYeOZfO[dOcPOqQO~OmzO~P%OOm!OOUzP!azP!bzP!dzP~P#|O^!SO!b!QO!f!TO!g!RO~ORSOTUOWROXROcPOqQO!PVO!cTO~OY!UOP!QXQ!QX!V!QX!`!QXS!QX!a!QX!b!QXU!QXm!QX!d!QX~P&aO[!WOP!SXQ!SX!V!SX!`!SXS!SX!a!SX!b!SXU!SXm!SX!d!SX~P&aO^!ZO!W![O!b!YO!f!]O!g!YO~OP!_O!V[OQaX!`aX~OPaXQaX!VaX!`aX~P#|OP!bOQ!cO!V[O~OP_O!V[O~P#|OWROXROY!fOcPOqQObfXmfXofXpfX~OWROXRO[!hOcPOqQObhXmhXohXphX~ObeXmlXoeX~ObkXokX~P%OOm!kO~Om!lObnPonP~P%OOb!pOo!oO~Ob!pO~P!bOm!sOosXpsX~OosXpsX~P%OOm!uOotPptP~P%OOo!xOp!yO~Op!yO~P#WOS!|O!a#OO!b#OO~OUyX!ayX!byX!dyX~P#|Om#QO~OU#SO!a#UO!b#UO!d#RO~Om#WOUzX!azX!bzX!dzX~O]#XO~O!b#XO!g#YO~O^#ZO!b#XO!g#YO~OP!RXQ!RX!V!RX!`!RXS!RX!a!RX!b!RXU!RXm!RX!d!RX~P&aOP!TXQ!TX!V!TX!`!TXS!TX!a!TX!b!TXU!TXm!TX!d!TX~P&aO!b#^O!g#^O~O^#_O!b#^O!f#`O!g#^O~O^#_O!W#aO!b#^O!g#^O~OPaaQaa!Vaa!`aa~P#|OP#cO!V[OQ!XX!`!XX~OP!XXQ!XX!V!XX!`!XX~P#|OP_O!V[OQ!_X!`!_X~P#|OWROXROcPOqQObgXmgXogXpgX~OWROXROcPOqQObiXmiXoiXpiX~Obkaoka~P%OObnXonX~P%OOm#kO~Ob#lOo!oO~Oosapsa~P%OOotXptX~P%OOm#pO~Oo!xOp#qO~OSwP!awP!bwP~P#|OS!|O!a#vO!b#vO~OUya!aya!bya!dya~P#|Om#xO~P%OOm#{OU}P!a}P!b}P!d}P~P#|OU#SO!a$OO!b$OO!d#RO~O]$QO~O!b$QO!g$RO~O!b$SO!g$SO~O^$TO!b$SO!g$SO~O^$TO!b$SO!f$UO!g$SO~OP!XaQ!Xa!V!Xa!`!Xa~P#|Obnaona~P%OOotapta~P%OOo!xO~OU|X!a|X!b|X!d|X~P#|Om$ZO~Om$]OU}X!a}X!b}X!d}X~O]$^O~O!b$_O!g$_O~O^$`O!b$_O!g$_O~OU|a!a|a!b|a!d|a~P#|O!b$cO!g$cO~O",goto:",]!mPPPPPPPPPPPPPPPPP!nPP!v#v#|$`#|$c$f$j$nP%VPPP!v%Y%^%a%{&O%a&R&U&X&_&b%aP&e&{&e'O'RPP']'a'g'm's'y(XPPPPPPPP(_)e*X+c,VUaObcR#e!c!{ROPQSTUXY_bcdehknrtvz!O!U!W!_!b!c!f!h!k!l!s!u!|#Q#R#S#W#c#k#p#x#{$Z$]QmPR!qnqfPQThknrtv!k!l!s!u#R#k#pR!gdR!ieTlPnTjPnSiPnSqQvQ{TQ!mkQ!trQ!vtR#y#RR!nkTsQvR!wt!RWOSUXY_bcz!O!U!W!_!b!c!|#Q#S#W#c#x#{$Z$]RySR#t!|R|TR|UQ!PUR#|#SR#z#RR#z#SyZOSU_bcz!O!_!b!c!|#Q#S#W#c#x#{$Z$]R!VXR!XYa]O^abc!a!c!eT!da!eQnPR!rnQvQR!{vQ!}yR#u!}Q#T|R#}#TW^Obc!cS!^^!aT!aa!eQ!eaR#f!eW`Obc!cQxSS}U#SQ!`_Q#PzQ#V!OQ#b!_Q#d!bQ#s!|Q#w#QQ$P#WQ$V#cQ$Y#xQ$[#{Q$a$ZR$b$]xZOSU_bcz!O!_!b!c!|#Q#S#W#c#x#{$Z$]Q!VXQ!XYQ#[!UR#]!W!QWOSUXY_bcz!O!U!W!_!b!c!|#Q#S#W#c#x#{$Z$]pfPQThknrtv!k!l!s!u#R#k#pQ!gdQ!ieQ#g!fR#h!hSgPn^pQTkrtv#RQ!jhQ#i!kQ#j!lQ#n!sQ#o!uQ$W#kR$X#pQuQR!zv",nodeNames:`⚠ DirectiveEnd DocEnd - - ? ? ? Literal QuotedLiteral Anchor Alias Tag BlockLiteralContent Comment Stream BOM Document ] [ FlowSequence Item Tagged Anchored Anchored Tagged FlowMapping Pair Key : Pair , } { FlowMapping Pair Pair BlockSequence Item Item BlockMapping Pair Pair Key Pair Pair BlockLiteral BlockLiteralHeader Tagged Anchored Anchored Tagged Directive DirectiveName DirectiveContent Document`,maxTerm:74,context:pPt,nodeProps:[[`isolate`,-3,8,9,14,``],[`openedBy`,18,`[`,32,`{`],[`closedBy`,19,`]`,33,`}`]],propSources:[yPt],skippedNodes:[0],repeatNodeCount:6,tokenData:"-Y~RnOX#PXY$QYZ$]Z]#P]^$]^p#Ppq$Qqs#Pst$btu#Puv$yv|#P|}&e}![#P![!]'O!]!`#P!`!a'i!a!}#P!}#O*g#O#P#P#P#Q+Q#Q#o#P#o#p+k#p#q'i#q#r,U#r;'S#P;'S;=`#z<%l?HT#P?HT?HU,o?HUO#PQ#UU!WQOY#PZp#Ppq#hq;'S#P;'S;=`#z<%lO#PQ#kTOY#PZs#Pt;'S#P;'S;=`#z<%lO#PQ#}P;=`<%l#P~$VQ!f~XY$Qpq$Q~$bO!g~~$gS^~OY$bZ;'S$b;'S;=`$s<%lO$b~$vP;=`<%l$bR%OX!WQOX%kXY#PZ]%k]^#P^p%kpq#hq;'S%k;'S;=`&_<%lO%kR%rX!WQ!VPOX%kXY#PZ]%k]^#P^p%kpq#hq;'S%k;'S;=`&_<%lO%kR&bP;=`<%l%kR&lUoP!WQOY#PZp#Ppq#hq;'S#P;'S;=`#z<%lO#PR'VUmP!WQOY#PZp#Ppq#hq;'S#P;'S;=`#z<%lO#PR'p[!PP!WQOY#PZp#Ppq#hq{#P{|(f|}#P}!O(f!O!R#P!R![)p![;'S#P;'S;=`#z<%lO#PR(mW!PP!WQOY#PZp#Ppq#hq!R#P!R![)V![;'S#P;'S;=`#z<%lO#PR)^U!PP!WQOY#PZp#Ppq#hq;'S#P;'S;=`#z<%lO#PR)wY!PP!WQOY#PZp#Ppq#hq{#P{|)V|}#P}!O)V!O;'S#P;'S;=`#z<%lO#PR*nUcP!WQOY#PZp#Ppq#hq;'S#P;'S;=`#z<%lO#PR+XUbP!WQOY#PZp#Ppq#hq;'S#P;'S;=`#z<%lO#PR+rUqP!WQOY#PZp#Ppq#hq;'S#P;'S;=`#z<%lO#PR,]UpP!WQOY#PZp#Ppq#hq;'S#P;'S;=`#z<%lO#PR,vU`P!WQOY#PZp#Ppq#hq;'S#P;'S;=`#z<%lO#P",tokenizers:[mPt,hPt,_Pt,vPt,0,1],topRules:{Stream:[0,15]},tokenPrec:0})}));function SPt(){return new QW(wPt)}var CPt,wPt,TPt=s((()=>{xPt(),yG(),dW(),MW(),kK(),CPt=OK.deserialize({version:14,states:"!vOQOPOOO]OPO'#C_OhOPO'#C^OOOO'#Cc'#CcOpOPO'#CaQOOOOOO{OPOOOOOO'#Cb'#CbO!WOPO'#C`O!`OPO,58xOOOO-E6a-E6aOOOO-E6`-E6`OOOO'#C_'#C_OOOO1G.d1G.d",stateData:`!h~OXPOYROWTP~OWVXXRXYRX~OYVOXSP~OXROYROWTX~OXROYROWTP~OYVOXSX~OX[O~OXY~`,goto:`vWPPX[beioRUOQQOR]XRXQTTOUQWQRZWSSOURYS`,nodeNames:`⚠ Document Frontmatter DashLine FrontmatterContent Body`,maxTerm:10,skippedNodes:[0],repeatNodeCount:2,tokenData:"$z~RXOYnYZ!^Z]n]^!^^}n}!O!i!O;'Sn;'S;=`!c<%lOn~qXOYnYZ!^Z]n]^!^^;'Sn;'S;=`!c<%l~n~On~~!^~!cOY~~!fP;=`<%ln~!lZOYnYZ!^Z]n]^!^^}n}!O#_!O;'Sn;'S;=`!c<%l~n~On~~!^~#bZOYnYZ!^Z]n]^!^^}n}!O$T!O;'Sn;'S;=`!c<%l~n~On~~!^~$WXOYnYZ$sZ]n]^$s^;'Sn;'S;=`!c<%l~n~On~~$s~$zOX~Y~",tokenizers:[0],topRules:{Document:[0,1]},tokenPrec:67}),wPt=KW.define({name:`yaml`,parser:bPt.configure({props:[tG.add({Stream:e=>{for(let t=e.node.resolve(e.pos,-1);t&&t.to>=e.pos;t=t.parent){if(t.name==`BlockLiteralContent`&&t.from<t.to)return e.baseIndentFor(t);if(t.name==`BlockLiteral`)return e.baseIndentFor(t)+e.unit;if(t.name==`BlockSequence`||t.name==`BlockMapping`)return e.column(t.from,1);if(t.name==`QuotedLiteral`)return null;if(t.name==`Literal`){let n=e.column(t.from,1);if(n==e.lineIndent(t.from,1))return n;if(t.to>e.pos)return null}}return null},FlowMapping:PW({closing:`}`}),FlowSequence:PW({closing:`]`})}),nG.add({"FlowMapping FlowSequence":IW,"Item Pair BlockLiteral":(e,t)=>({from:t.doc.lineAt(e.from).to,to:e.to})})]}),languageData:{commentTokens:{line:`#`},indentOnInput:/^\s*[\]\}]$/}}),KW.define({name:`yaml-frontmatter`,parser:CPt.configure({props:[fW({DashLine:$.meta})]})})}));function wJ(){var e=arguments[0];typeof e==`string`&&(e=document.createElement(e));var t=1,n=arguments[1];if(n&&typeof n==`object`&&n.nodeType==null&&!Array.isArray(n)){for(var r in n)if(Object.prototype.hasOwnProperty.call(n,r)){var i=n[r];typeof i==`string`?e.setAttribute(r,i):i!=null&&(e[r]=i)}t++}for(;t<arguments.length;t++)EPt(e,arguments[t]);return e}function EPt(e,t){if(typeof t==`string`)e.appendChild(document.createTextNode(t));else if(t!=null)if(t.nodeType!=null)e.appendChild(t);else if(Array.isArray(t))for(var n=0;n<t.length;n++)EPt(e,t[n]);else throw RangeError(`Unsupported child node: `+t)}var DPt=s((()=>{}));function TJ(e,t=null,n=0){let r=null;return e.between(n,1e9,(e,n,{spec:i})=>{if(!(t&&i.diagnostics.indexOf(t)<0))if(!r)r=new DJ(e,n,t||i.diagnostics[0]);else if(i.diagnostics.indexOf(r.diagnostic)<0)return!1;else r=new DJ(r.from,n,r.diagnostic)}),r}function OPt(e,t){let n=t.pos,r=t.end||n,i=e.state.facet(PJ).hideOn(e,n,r);if(i!=null)return i;let a=e.startState.doc.lineAt(t.pos);return!!(e.effects.some(e=>e.is(kJ))||e.changes.touchesRange(a.from,Math.max(a.to,r)))}function kPt(e,t){return e.field(MJ,!1)?t:t.concat(oB.appendConfig.of(LJ))}function APt(e,t){return{effects:kPt(e,[kJ.of(t)])}}function jPt(e,t,n){let{diagnostics:r}=e.state.field(MJ),i,a=-1,o=-1;r.between(t-(n<0?1:0),t+(n>0?1:0),(e,r,{spec:s})=>{if(t>=e&&t<=r&&(e==r||(t>e||n>0)&&(t<r||n<0)))return i=s.diagnostics,a=e,o=r,!1});let s=e.state.facet(PJ).tooltipFilter;return i&&s&&(i=s(i,e.state)),i?{pos:a,end:o,above:e.state.doc.lineAt(a).to<o,create(){return{dom:MPt(e,i)}}}:null}function MPt(e,t){return wJ(`ul`,{class:`cm-tooltip-lint`},t.map(t=>IPt(e,t,!1)))}function NPt(e,t,n){let r=[],i=-1;for(let a of e)a.then(n=>{r.push(n),clearTimeout(i),r.length==e.length?t(r):i=setTimeout(()=>t(r),200)},n)}function PPt(e,t={}){return[PJ.of({source:e,config:t}),VPt,LJ]}function FPt(e){let t=[];if(e)actions:for(let{name:n}of e){for(let e=0;e<n.length;e++){let r=n[e];if(/[a-zA-Z]/.test(r)&&!t.some(e=>e.toLowerCase()==r.toLowerCase())){t.push(r);continue actions}}t.push(``)}return t}function IPt(e,t,n){let r=n?FPt(t.actions):[];return wJ(`li`,{class:`cm-diagnostic cm-diagnostic-`+t.severity},wJ(`span`,{class:`cm-diagnosticText`},t.renderMessage?t.renderMessage(e):t.message),t.actions?.map((n,i)=>{let a=!1,o=r=>{if(r.preventDefault(),a)return;a=!0;let i=TJ(e.state.field(MJ).diagnostics,t);i&&n.apply(e,i.from,i.to)},{name:s}=n,c=r[i]?s.indexOf(r[i]):-1,l=c<0?s:[s.slice(0,c),wJ(`u`,s.slice(c,c+1)),s.slice(c+1)];return wJ(`button`,{type:`button`,class:`cm-diagnosticAction`,onclick:o,onmousedown:o,"aria-label":` Action: ${s}${c<0?``:` (access key "${r[i]})"`}.`},l)}),t.source&&wJ(`div`,{class:`cm-diagnosticSource`},t.source))}function LPt(e,t=`viewBox="0 0 40 40"`){return`url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" ${t}>${encodeURIComponent(e)}</svg>')`}function EJ(e){return LPt(`<path d="m0 2.5 l2 -1.5 l1 0 l2 1.5 l1 0" stroke="${e}" fill="none" stroke-width=".7"/>`,`width="6" height="3"`)}function RPt(e){return e==`error`?4:e==`warning`?3:e==`info`?2:1}function zPt(e){let t=`hint`,n=1;for(let r of e){let e=RPt(r.severity);e>n&&(n=e,t=r.severity)}return t}var DJ,OJ,kJ,AJ,jJ,MJ,BPt,NJ,VPt,PJ,HPt,FJ,IJ,UPt,LJ,WPt=s((()=>{RU(),vB(),DPt(),DJ=class{constructor(e,t,n){this.from=e,this.to=t,this.diagnostic=n}},OJ=class e{constructor(e,t,n){this.diagnostics=e,this.panel=t,this.selected=n}static init(t,n,r){let i=t,a=r.facet(PJ).markerFilter;a&&(i=a(i,r));let o=t.slice().sort((e,t)=>e.from-t.from||e.to-t.to),s=new mB,c=[],l=0;for(let e=0;;){let t=e==o.length?null:o[e];if(!t&&!c.length)break;let n,i;for(c.length?(n=l,i=c.reduce((e,t)=>Math.min(e,t.to),t&&t.from>n?t.from:1e8)):(n=t.from,i=t.to,c.push(t),e++);e<o.length;){let t=o[e];if(t.from==n&&(t.to>t.from||t.to==n))c.push(t),e++,i=Math.min(t.to,i);else{i=Math.min(t.from,i);break}}let a=zPt(c);if(c.some(e=>e.from==e.to||e.from==e.to-1&&r.doc.lineAt(e.from).to==e.from))s.add(n,n,NV.widget({widget:new HPt(a),diagnostics:c.slice()}));else{let e=c.reduce((e,t)=>t.markClass?e+` `+t.markClass:e,``);s.add(n,i,NV.mark({class:`cm-lintRange cm-lintRange-`+a+e,diagnostics:c.slice(),inclusiveEnd:c.some(e=>e.to>i)}))}l=i;for(let e=0;e<c.length;e++)c[e].to<=l&&c.splice(e--,1)}let u=s.finish();return new e(u,n,TJ(u))}},kJ=oB.define(),AJ=oB.define(),jJ=oB.define(),MJ=Gz.define({create(){return new OJ(NV.none,null,null)},update(e,t){if(t.docChanged&&e.diagnostics.size){let n=e.diagnostics.map(t.changes),r=null,i=e.panel;if(e.selected){let i=t.changes.mapPos(e.selected.from,1);r=TJ(n,e.selected.diagnostic,i)||TJ(n,null,i)}!n.size&&i&&t.state.facet(PJ).autoPanel&&(i=null),e=new OJ(n,i,r)}for(let n of t.effects)if(n.is(kJ)){let r=t.state.facet(PJ).autoPanel?n.value.length?IJ.open:null:e.panel;e=OJ.init(n.value,r,t.state)}else n.is(AJ)?e=new OJ(e.diagnostics,n.value?IJ.open:null,e.selected):n.is(jJ)&&(e=new OJ(e.diagnostics,e.panel,n.value));return e},provide:e=>[kU.from(e,e=>e.panel),oU.decorations.from(e,e=>e.diagnostics)]}),BPt=NV.mark({class:`cm-lintRange cm-lintRange-active`}),NJ=e=>{let t=e.state.field(MJ,!1);return!t||!t.panel?!1:(e.dispatch({effects:AJ.of(!1)}),!0)},VPt=fH.fromClass(class{constructor(e){this.view=e,this.timeout=-1,this.set=!0;let{delay:t}=e.state.facet(PJ);this.lintTime=Date.now()+t,this.run=this.run.bind(this),this.timeout=setTimeout(this.run,t)}run(){clearTimeout(this.timeout);let e=Date.now();if(e<this.lintTime-10)this.timeout=setTimeout(this.run,this.lintTime-e);else{this.set=!1;let{state:e}=this.view,{sources:t}=e.facet(PJ);t.length&&NPt(t.map(e=>Promise.resolve(e(this.view))),t=>{this.view.state.doc==e.doc&&this.view.dispatch(APt(this.view.state,t.reduce((e,t)=>e.concat(t))))},e=>{KB(this.view.state,e)})}}update(e){let t=e.state.facet(PJ);(e.docChanged||t!=e.startState.facet(PJ)||t.needsRefresh&&t.needsRefresh(e))&&(this.lintTime=Date.now()+t.delay,this.set||(this.set=!0,this.timeout=setTimeout(this.run,t.delay)))}force(){this.set&&(this.lintTime=Date.now(),this.run())}destroy(){clearTimeout(this.timeout)}}),PJ=Hz.define({combine(e){return Object.assign({sources:e.map(e=>e.source).filter(e=>e!=null)},xz(e.map(e=>e.config),{delay:750,markerFilter:null,tooltipFilter:null,needsRefresh:null,hideOn:()=>null},{needsRefresh:(e,t)=>e?t?n=>e(n)||t(n):e:t}))}}),HPt=class extends jV{constructor(e){super(),this.sev=e}eq(e){return e.sev==this.sev}toDOM(){return wJ(`span`,{class:`cm-lintPoint cm-lintPoint-`+this.sev})}},FJ=class{constructor(e,t){this.diagnostic=t,this.id=`item_`+Math.floor(Math.random()*4294967295).toString(16),this.dom=IPt(e,t,!0),this.dom.id=this.id,this.dom.setAttribute(`role`,`option`)}},IJ=class e{constructor(e){this.view=e,this.items=[];let t=t=>{if(t.keyCode==27)NJ(this.view),this.view.focus();else if(t.keyCode==38||t.keyCode==33)this.moveSelection((this.selectedIndex-1+this.items.length)%this.items.length);else if(t.keyCode==40||t.keyCode==34)this.moveSelection((this.selectedIndex+1)%this.items.length);else if(t.keyCode==36)this.moveSelection(0);else if(t.keyCode==35)this.moveSelection(this.items.length-1);else if(t.keyCode==13)this.view.focus();else if(t.keyCode>=65&&t.keyCode<=90&&this.selectedIndex>=0){let{diagnostic:n}=this.items[this.selectedIndex],r=FPt(n.actions);for(let i=0;i<r.length;i++)if(r[i].toUpperCase().charCodeAt(0)==t.keyCode){let t=TJ(this.view.state.field(MJ).diagnostics,n);t&&n.actions[i].apply(e,t.from,t.to)}}else return;t.preventDefault()},n=e=>{for(let t=0;t<this.items.length;t++)this.items[t].dom.contains(e.target)&&this.moveSelection(t)};this.list=wJ(`ul`,{tabIndex:0,role:`listbox`,"aria-label":this.view.state.phrase(`Diagnostics`),onkeydown:t,onclick:n}),this.dom=wJ(`div`,{class:`cm-panel-lint`},this.list,wJ(`button`,{type:`button`,name:`close`,"aria-label":this.view.state.phrase(`close`),onclick:()=>NJ(this.view)},`×`)),this.update()}get selectedIndex(){let e=this.view.state.field(MJ).selected;if(!e)return-1;for(let t=0;t<this.items.length;t++)if(this.items[t].diagnostic==e.diagnostic)return t;return-1}update(){let{diagnostics:e,selected:t}=this.view.state.field(MJ),n=0,r=!1,i=null,a=new Set;for(e.between(0,this.view.state.doc.length,(e,o,{spec:s})=>{for(let e of s.diagnostics){if(a.has(e))continue;a.add(e);let o=-1,s;for(let t=n;t<this.items.length;t++)if(this.items[t].diagnostic==e){o=t;break}o<0?(s=new FJ(this.view,e),this.items.splice(n,0,s),r=!0):(s=this.items[o],o>n&&(this.items.splice(n,o-n),r=!0)),t&&s.diagnostic==t.diagnostic?s.dom.hasAttribute(`aria-selected`)||(s.dom.setAttribute(`aria-selected`,`true`),i=s):s.dom.hasAttribute(`aria-selected`)&&s.dom.removeAttribute(`aria-selected`),n++}});n<this.items.length&&!(this.items.length==1&&this.items[0].diagnostic.from<0);)r=!0,this.items.pop();this.items.length==0&&(this.items.push(new FJ(this.view,{from:-1,to:-1,severity:`info`,message:this.view.state.phrase(`No diagnostics`)})),r=!0),i?(this.list.setAttribute(`aria-activedescendant`,i.id),this.view.requestMeasure({key:this,read:()=>({sel:i.dom.getBoundingClientRect(),panel:this.list.getBoundingClientRect()}),write:({sel:e,panel:t})=>{let n=t.height/this.list.offsetHeight;e.top<t.top?this.list.scrollTop-=(t.top-e.top)/n:e.bottom>t.bottom&&(this.list.scrollTop+=(e.bottom-t.bottom)/n)}})):this.selectedIndex<0&&this.list.removeAttribute(`aria-activedescendant`),r&&this.sync()}sync(){let e=this.list.firstChild;function t(){let t=e;e=t.nextSibling,t.remove()}for(let n of this.items)if(n.dom.parentNode==this.list){for(;e!=n.dom;)t();e=n.dom.nextSibling}else this.list.insertBefore(n.dom,e);for(;e;)t()}moveSelection(e){if(this.selectedIndex<0)return;let t=TJ(this.view.state.field(MJ).diagnostics,this.items[e].diagnostic);t&&this.view.dispatch({selection:{anchor:t.from,head:t.to},scrollIntoView:!0,effects:jJ.of(t)})}static open(t){return new e(t)}},UPt=oU.baseTheme({".cm-diagnostic":{padding:`3px 6px 3px 8px`,marginLeft:`-1px`,display:`block`,whiteSpace:`pre-wrap`},".cm-diagnostic-error":{borderLeft:`5px solid #d11`},".cm-diagnostic-warning":{borderLeft:`5px solid orange`},".cm-diagnostic-info":{borderLeft:`5px solid #999`},".cm-diagnostic-hint":{borderLeft:`5px solid #66d`},".cm-diagnosticAction":{font:`inherit`,border:`none`,padding:`2px 4px`,backgroundColor:`#444`,color:`white`,borderRadius:`3px`,marginLeft:`8px`,cursor:`pointer`},".cm-diagnosticSource":{fontSize:`70%`,opacity:.7},".cm-lintRange":{backgroundPosition:`left bottom`,backgroundRepeat:`repeat-x`,paddingBottom:`0.7px`},".cm-lintRange-error":{backgroundImage:EJ(`#d11`)},".cm-lintRange-warning":{backgroundImage:EJ(`orange`)},".cm-lintRange-info":{backgroundImage:EJ(`#999`)},".cm-lintRange-hint":{backgroundImage:EJ(`#66d`)},".cm-lintRange-active":{backgroundColor:`#ffdd9980`},".cm-tooltip-lint":{padding:0,margin:0},".cm-lintPoint":{position:`relative`,"&:after":{content:`""`,position:`absolute`,bottom:0,left:`-2px`,borderLeft:`3px solid transparent`,borderRight:`3px solid transparent`,borderBottom:`4px solid #d11`}},".cm-lintPoint-warning":{"&:after":{borderBottomColor:`orange`}},".cm-lintPoint-info":{"&:after":{borderBottomColor:`#999`}},".cm-lintPoint-hint":{"&:after":{borderBottomColor:`#66d`}},".cm-panel.cm-panel-lint":{position:`relative`,"& ul":{maxHeight:`100px`,overflowY:`auto`,"& [aria-selected]":{backgroundColor:`#ddd`,"& u":{textDecoration:`underline`}},"&:focus [aria-selected]":{background_fallback:`#bdf`,backgroundColor:`Highlight`,color_fallback:`white`,color:`HighlightText`},"& u":{textDecoration:`none`},padding:0,margin:0},"& [name=close]":{position:`absolute`,top:`0`,right:`2px`,background:`inherit`,border:`none`,font:`inherit`,padding:0,margin:0}}}),LJ=[MJ,oU.decorations.compute([MJ],e=>{let{selected:t,panel:n}=e.field(MJ);return!t||!n||t.from==t.to?NV.none:NV.set([BPt.range(t.from,t.to)])}),HTt(jPt,{hideOn:OPt}),UPt]})),GPt,KPt=s((()=>{yG(),RU(),GPt=({theme:e,settings:t={},styles:n=[]})=>{let r={".cm-gutters":{}},i={};t.background&&(i.backgroundColor=t.background),t.backgroundImage&&(i.backgroundImage=t.backgroundImage),t.foreground&&(i.color=t.foreground),t.fontSize&&(i.fontSize=t.fontSize),(t.background||t.foreground)&&(r[`&`]=i),t.fontFamily&&(r[`&.cm-editor .cm-scroller`]={fontFamily:t.fontFamily}),t.gutterBackground&&r[`.cm-gutters`]&&(r[`.cm-gutters`].backgroundColor=t.gutterBackground),t.gutterForeground&&r[`.cm-gutters`]&&(r[`.cm-gutters`].color=t.gutterForeground),t.gutterBorder&&r[`.cm-gutters`]&&(r[`.cm-gutters`].borderRightColor=t.gutterBorder),t.caret&&(r[`.cm-content`]={caretColor:t.caret},r[`.cm-cursor, .cm-dropCursor`]={borderLeftColor:t.caret});let a={};return t.gutterActiveForeground&&(a.color=t.gutterActiveForeground),t.lineHighlight&&(r[`.cm-activeLine`]={backgroundColor:t.lineHighlight},a.backgroundColor=t.lineHighlight),r[`.cm-activeLineGutter`]=a,t.selection&&(r[`&.cm-focused .cm-selectionBackground, & .cm-line::selection, & .cm-selectionLayer .cm-selectionBackground, .cm-content ::selection`]={background:t.selection+` !important`}),t.selectionMatch&&(r[`& .cm-selectionMatch`]={backgroundColor:t.selectionMatch}),[oU.theme(r,{dark:e===`dark`}),XDt(lG.define(n))]}})),qPt,JPt=s((()=>{MW(),KPt(),qPt=GPt({theme:`light`,settings:{background:`var(--scalar-background-2)`,foreground:`var(--scalar-color-1)`,caret:`var(--scalar-color-1)`,selectionMatch:`#e3dcce`,gutterBackground:`var(--scalar-background-2)`,gutterForeground:`var(--scalar-color-3)`,gutterBorder:`transparent`,lineHighlight:`var(--scalar-background-3)`,fontFamily:`var(--scalar-font-code)`},styles:[{tag:[$.standard($.tagName),$.tagName],color:`var(--scalar-color-purple)`},{tag:[$.comment],color:`var(--scalar-color-3)`},{tag:[$.className],color:`var(--scalar-color-orange)`},{tag:[$.variableName,$.propertyName,$.attributeName],color:`var(--scalar-color-1)`},{tag:[$.operator],color:`var(--scalar-color-2)`},{tag:[$.keyword,$.typeName,$.typeOperator],color:`var(--scalar-color-green)`},{tag:[$.string],color:`var(--scalar-color-blue)`},{tag:[$.bracket,$.regexp,$.meta],color:`var(--scalar-color-3)`},{tag:[$.number],color:`var(--scalar-color-orange)`},{tag:[$.name,$.quote],color:`var(--scalar-color-3)`},{tag:[$.heading],color:`var(--scalar-color-3)`,fontWeight:`bold`},{tag:[$.emphasis],color:`var(--scalar-color-3)`,fontStyle:`italic`},{tag:[$.deleted],color:`var(--scalar-color-3)`,backgroundColor:`transparent`},{tag:[$.atom,$.bool,$.special($.variableName)],color:`var(--scalar-color-3)`},{tag:[$.url,$.escape,$.regexp,$.link],color:`var(--scalar-color-1)`},{tag:$.link,textDecoration:`underline`},{tag:$.strikethrough,textDecoration:`line-through`},{tag:$.invalid,color:`var(--scalar-color-3)`}]})})),RJ,YPt,XPt=s((()=>{RU(),RJ=new mU({regexp:/(\{[^}]+\})/g,decoration:()=>NV.mark({attributes:{class:`api-client-url-variable`}})}),YPt=()=>fH.fromClass(class{variables;constructor(e){this.variables=RJ.createDeco(e)}update(e){this.variables=RJ.updateDeco(e,this.variables)}},{decorations:e=>e.variables,provide:e=>oU.atomicRanges.of(t=>t.plugin(e)?.variables||NV.none)})}));function ZPt({onChange:e,onBlur:t,onFocus:n,provider:r,language:i,classes:a=[],readOnly:o=!1,lineNumbers:s=!1,withVariables:c=!1,forceFoldGutter:l=!1,disableEnter:u=!1,disableCloseBrackets:d=!1,disableTabIndent:f=!1,withoutTheme:p=!1,lint:m=!1,additionalExtensions:h=[],placeholder:g}){let _=[PTt(),rAt(),lU.of(_At),XDt(gOt,{fallback:!0}),oU.theme({".cm-line":{lineHeight:`22px`,padding:`0 2px 0 4px`},".cm-gutterElement":{lineHeight:`22px`},".cm-tooltip":{background:`var(--scalar-background-1)`,border:`1px solid var(--scalar-border-color)`,borderRadius:`var(--scalar-radius)`,boxShadow:`var(--scalar-shadow-2)`,fontSize:`12px`,overflow:`hidden`},".cm-tooltip-autocomplete ul":{padding:`6px`},".cm-tooltip-autocomplete ul li":{padding:`3px 6px`,color:`var(--scalar-color-1)`,borderRadius:`3px`},".cm-tooltip-autocomplete ul li[aria-selected]":{background:`var(--scalar-background-2)`,color:`var(--scalar-color-1)`},".cm-tooltip-autocomplete ul li:hover":{background:`var(--scalar-background-3)`,color:`var(--scalar-color-1)`},".cm-completionLabel":{color:`var(--scalar-color-1)`},".cm-completionDetail":{color:`var(--scalar-color-3)`},".cm-tooltip-lint":{backgroundColor:`var(--scalar-background-1)`},".cm-diagnostic-error":{borderLeft:`0`,color:`#dc1b19`},".cm-foldPlaceholder":{background:`var(--scalar-background-1)`,border:`none`,fontFamily:`var(--scalar-font)`}}),oU.updateListener.of(t=>{t.docChanged&&e?.(t.state.doc.toString())}),oU.domEventHandlers({blur:(e,n)=>{t?.(n.state.doc.toString(),e)},focus:(e,t)=>{n?.(t.state.doc.toString(),e)}}),oU.editorAttributes.of({class:a.join(` `)}),...h];if(r&&_.push(r),p||_.push(qPt),o?_.push(oU.editable.of(!1)):(_.push(VDt(),QDt(),xkt(),lU.of([...iK,QPt]),QDt()),d||_.push(lkt(),lU.of([...eAt])),f?_.push(lU.of([{key:`Tab`,run:()=>!1,shift:()=>!1}])):_.push(lU.of([xAt]))),g&&_.push(LTt(g)),s&&_.push(YTt()),l&&_.push(YDt({markerDOM:e=>{let t=document.createElement(`div`);return t.classList.add(`cm-foldMarker`),t.innerHTML=e?zJ:BJ,t}})),i&&UJ[i]&&(_.push(UJ[i]()),l||_.push(YDt({markerDOM:e=>{let t=document.createElement(`div`);return t.classList.add(`cm-foldMarker`),t.innerHTML=e?zJ:BJ,t}}))),m&&i===`json`){let e=PPt(e=>{let t=[],n=e.state.doc.toString();if(n.trim())try{JSON.parse(n)}catch(n){n instanceof Error&&t.push({from:0,to:e.state.doc.length,severity:`error`,message:n.message})}return t});_.push(e)}return c&&_.push(YPt()),u?_.push(lU.of([{key:`Enter`,run:()=>!0},{key:`Ctrl-Enter`,mac:`Cmd-Enter`,run:()=>!0},{key:`Shift-Enter`,run:()=>!0}])):_.push(lU.of([{key:`Enter`,run:vAt}])),_}var zJ,BJ,VJ,QPt,HJ,UJ,$Pt=s((()=>{nAt(),SAt(),gjt(),aNt(),dNt(),VNt(),TPt(),yG(),WPt(),vB(),RU(),W(),JPt(),XPt(),zJ=`<svg viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="m18 10-6 6-6-6" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"/></svg>`,BJ=`<svg viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="m9 18 6-6-6-6" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"/></svg>`,oU.EDIT_CONTEXT=!1,VJ=e=>`provider`in e&&!!Cn(e.provider),QPt={key:`Mod-a`,run:e=>(e.dispatch({selection:{anchor:0,head:e.state.doc.length},scrollIntoView:!1}),!0)},HJ=e=>{let t=A(null),n=(e=``)=>{t.value&&t.value.state.doc.toString()!==e&&t.value.dispatch({changes:{from:0,to:t.value.state.doc.length,insert:e},selection:{anchor:Math.min(t.value.state.selection.main.anchor,e.length)}})},r=U(()=>({onChange:e.onChange,onBlur:e.onBlur,onFocus:e.onFocus,disableTabIndent:Cn(e.disableTabIndent),language:Cn(e.language),classes:Cn(e.classes),readOnly:Cn(e.readOnly),lineNumbers:Cn(e.lineNumbers),withVariables:Cn(e.withVariables),forceFoldGutter:Cn(e.forceFoldGutter),disableEnter:Cn(e.disableEnter),disableCloseBrackets:Cn(e.disableCloseBrackets),withoutTheme:Cn(e.withoutTheme),lint:Cn(e.lint),additionalExtensions:Cn(e.extensions),placeholder:Cn(e.placeholder)}));mr(e.codeMirrorRef,()=>{t.value?.destroy(),i()},{immediate:!0}),Wi(()=>t.value?.destroy());function i(){if(e.codeMirrorRef.value){let i=VJ(e)?Cn(e.provider):null,a=ZPt({...r.value,provider:i});t.value=new oU({parent:e.codeMirrorRef.value,extensions:a}),VJ(e)||n(Cn(e.content))}}return mr(()=>VJ(e)?Cn(e.provider):null,()=>{VJ(e)&&(t.value?.destroy(),i())}),mr(r,()=>{if(!t.value)return;let n=VJ(e)?Cn(e.provider):null,i=ZPt({...r.value,provider:n});requestAnimationFrame(()=>{t.value?.dispatch({effects:oB.reconfigure.of(i)})})},{immediate:!0}),mr(()=>Cn(e.content),()=>{VJ(e)||n(Cn(e.content))},{immediate:!0}),{setCodeMirrorContent:n,codeMirror:t}},UJ={html:tNt,json:lNt,yaml:SPt,css:ljt,xml:LNt}}));function eFt(e){let{codeMirror:t,query:n,showDropdown:r,dropdownPosition:i}=e;function a(){return t.value?.state.selection.main.head||0}function o(e){return t.value?.coordsAtPos(e)}function s(){let e=a();requestAnimationFrame(()=>{let t=o(e-n.value.length-2);t&&(i.value={left:t.left,top:Math.max(t.bottom)})})}mr(n,s);function c(e){let i=`{{${e}}}`,o=a(),s=Math.max(0,o-n.value.length-2),c=o;t.value?.dispatch({changes:{from:s,to:c,insert:i}}),r.value=!1}function l(){let e=a(),c=t.value?.state.doc.sliceString(0,e)||``,l=c.lastIndexOf(`{{`);l>c.lastIndexOf(`}}`)?(n.value=c.slice(l+2),r.value=!0,i.value=o(e)||{left:0,top:0},n.value===``&&s()):r.value=!1}return mr(()=>t.value?.state.doc.toString(),l),{handleDropdownSelect:c,updateDropdownVisibility:l}}var tFt=s((()=>{W()})),WJ=s((()=>{vB(),RU(),HOt(),$Pt(),tFt()})),nFt,rFt,iFt,aFt=s((()=>{ZSt(),W(),WJ(),QI(),Au(),nFt=class e extends jV{app;pillColor;variableInfo;constructor(e,t,n){if(super(),this.variableName=e,n===`contextFunction`){this.pillColor=`var(--scalar-color-3)`,this.variableInfo={type:`contextFunction`,identifier:e,details:QF(e)};return}this.pillColor=t?.color||`var(--scalar-color-1)`;let r=t?.variables?.find(t=>t.name===e),i=r?typeof r.value==`string`?r.value:r.value?.default:void 0;this.variableInfo={type:`environment`,name:e,value:i||`No value`,isDefined:!!i}}toDOM(){let e=document.createElement(`span`);return e.className=this.variableInfo.type===`contextFunction`?`cm-pill cm-pill--context-fn`:`cm-pill`,e.textContent=this.variableName,e.style.setProperty(`--tw-bg-base`,this.pillColor),this.variableInfo.type===`environment`&&(e.style.opacity=this.variableInfo.isDefined?`1`:`0.5`),this.app=vo(XSt,{context:this.variableInfo}),this.app.mount(e),e}destroy(){this.app&&=(this.app.unmount(),null)}eq(t){if(!(t instanceof e)||t.variableName!==this.variableName||t.pillColor!==this.pillColor||t.variableInfo.type!==this.variableInfo.type)return!1;let n=t.variableInfo,r=this.variableInfo;return n.type===r.type?n.type===`environment`&&r.type===`environment`?n.name===r.name&&n.value===r.value&&n.isDefined===r.isDefined:n.type===`contextFunction`&&r.type===`contextFunction`?n.identifier===r.identifier&&n.details===r.details:!1:!1}ignoreEvent(){return!1}},rFt=e=>fH.fromClass(class{decorations;lastEnvironment;constructor(t){this.lastEnvironment=e.environment,this.decorations=this.buildDecorations(t)}update(t){if(e.environment!==this.lastEnvironment){this.lastEnvironment=e.environment,this.decorations=this.buildDecorations(t.view);return}(t.docChanged||t.viewportChanged)&&(this.decorations=this.buildDecorations(t.view))}buildDecorations(t){let n=new mB,r=e.isContextFunctionName??(()=>!1);for(let{from:i,to:a}of t.visibleRanges){let o=t.state.doc.sliceString(i,a),s=new RegExp(ku.VARIABLES.source,ku.VARIABLES.flags),c;for(;(c=s.exec(o))!==null;){let a=i+c.index,o=a+c[0].length,s=c[1]??``;if(t.state.doc.sliceString(a,o).includes(`
-`))continue;let l=r(s)?`contextFunction`:`environment`;n.add(a,o,NV.widget({widget:new nFt(s,e.environment,l),side:1}))}}return n.finish()}},{decorations:e=>e.decorations}),iFt=oU.domEventHandlers({keydown(e,t){if(e.key!==`Backspace`)return!1;let{state:n}=t,{from:r,to:i}=n.selection.main;return r===0&&i===n.doc.length?(t.dispatch({changes:{from:0,to:n.doc.length},selection:{anchor:0}}),e.preventDefault(),!0):r===i&&r>=2&&n.doc.sliceString(r-2,r)===`}}`?(t.dispatch({changes:{from:r-2,to:r},selection:{anchor:r-2}}),e.preventDefault(),!0):!1}})})),oFt,sFt,cFt,lFt,uFt,dFt,fFt,pFt=s((()=>{Uxt(),KSt(),aFt(),W(),ME(),WJ(),QI(),sb(),oFt={class:`whitespace-nowrap`},sFt=[`id`],cFt={key:0,class:`z-context text-c-2 absolute right-1.5 bottom-1 hidden font-sans group-has-[:focus-visible]/input:block`,role:`alert`},lFt={key:5,class:`centered-y text-orange absolute right-7 text-xs`},uFt={key:6,class:`centered-y absolute right-0 flex h-full items-center p-1.5 group-has-[.cm-focused]:z-1`},dFt={key:7,class:`required centered-y text-xxs text-c-3 group-[.error]:text-red bg-b-1 pointer-events-none absolute right-0 mr-0.5 pt-px pr-2 opacity-100 shadow-[-8px_0_4px_var(--scalar-background-1)] transition-opacity duration-150 group-[.alert]:bg-transparent group-[.alert]:shadow-none group-[.error]:bg-transparent group-[.error]:shadow-none peer-has-[.cm-focused]:opacity-0`},fFt=N({inheritAttrs:!1,__name:`CodeInput`,props:{modelValue:{type:[String,Number,Boolean,Array,Object]},environment:{},type:{},disabled:{type:Boolean,default:!1},error:{type:Boolean,default:!1},layout:{default:`desktop`},enum:{},examples:{},default:{type:[String,Number,Boolean,Array,Object]},nullable:{type:Boolean,default:!1},placeholder:{},required:{type:Boolean},colorPicker:{type:Boolean,default:!1},lineNumbers:{type:Boolean,default:!1},lint:{type:Boolean,default:!1},lineWrapping:{type:Boolean,default:!1},language:{},extensions:{default:()=>[]},disableTabIndent:{type:Boolean,default:!1},disableEnter:{type:Boolean,default:!1},disableCloseBrackets:{type:Boolean,default:!1},emitOnBlur:{type:Boolean,default:!0},withVariables:{type:Boolean,default:!0},withFakeData:{type:Boolean,default:!1},alwaysEmitChange:{type:Boolean,default:!1},handleFieldChange:{type:Function},handleFieldSubmit:{type:Function},linethrough:{type:Boolean}},emits:[`update:modelValue`,`submit`,`navigate`,`blur`],setup(e,{expose:t,emit:n}){let r=n,i=Fr(),a=i.id||`id-${ob()}`,o=A(!1),s=U(()=>e.enum?.length?!1:e.type===`boolean`||Array.isArray(e.type)&&e.type.includes(`boolean`)),c=U(()=>e.nullable?[`true`,`false`,`null`]:[`true`,`false`]),l=U(()=>Array.isArray(e.type)?e.type.find(e=>e!==`null`)??`string`:e.type),u=t=>{!e.alwaysEmitChange&&t===y(e.modelValue)||(e.handleFieldChange?e.handleFieldChange(t):r(`update:modelValue`,t))},d=(t,n)=>{e.handleFieldSubmit?e.handleFieldSubmit(t):r(`submit`,t,n)},f=(t,n)=>{o.value=!1,e.emitOnBlur&&e.modelValue&&d(t,n),r(`blur`,t,n)},p=e=>r(`update:modelValue`,e),m=()=>{let t=[...e.extensions];return e.colorPicker&&t.push(VOt),t},h=U(()=>e.withFakeData?vht.map(e=>({key:e,description:QF(e)})):[]),g=U(()=>rFt({environment:e.environment,isContextFunctionName:$F,isReadOnly:e.layout===`modal`})),_=U(()=>[...m(),g.value,iFt]),v=A(null),y=e=>typeof e==`string`?e:JSON.stringify(e),{codeMirror:b,setCodeMirrorContent:x}=HJ({content:wn(()=>y(e.modelValue)),onChange:e=>{u(e),ne()},onFocus:()=>{o.value=!0},onBlur:f,codeMirrorRef:v,disableTabIndent:wn(()=>e.disableTabIndent),disableEnter:wn(()=>e.disableEnter),disableCloseBrackets:wn(()=>e.disableCloseBrackets),lineNumbers:wn(()=>e.lineNumbers),language:wn(()=>e.language),lint:wn(()=>e.lint),extensions:_,placeholder:wn(()=>e.placeholder)});mr(b,()=>{b.value&&Object.hasOwn(i,`autofocus`)&&b.value.focus()});let S=A(!1),C=A(``),w=A({left:0,top:0}),ee=A(null),{handleDropdownSelect:te,updateDropdownVisibility:ne}=eFt({codeMirror:b,query:C,showDropdown:S,dropdownPosition:w}),re=U(()=>S.value&&e.withVariables&&e.layout!==`modal`&&(!!e.environment||e.withFakeData)),T=(t,n)=>{if(S.value){t===`down`||t===`up`?(n.preventDefault(),ee.value?.handleArrowKey(t)):t===`enter`&&(n.preventDefault(),ee.value?.handleSelect());return}t===`escape`&&!e.disableTabIndent&&n.stopPropagation(),t===`enter`&&n.target instanceof HTMLDivElement&&d(b.value?.state.doc.toString()??``,n)};return t({focus:e=>{if(!b.value||(b.value.focus(),!jE(e)))return;let t=e===`start`?0:e===`end`?b.value.state.doc.length:e;b.value.dispatch({selection:{anchor:t},scrollIntoView:!0})},isFocused:o,handleChange:u,handleSubmit:d,handleBlur:f,booleanOptions:c,codeMirror:b,codeMirrorRef:v,modelValue:e.modelValue,setCodeMirrorContent:x,cursorPosition:()=>b.value?.state.selection.main.head,serializeValue:y}),(t,n)=>(F(),I(V,null,[e.disabled?(F(),I(`div`,{key:0,class:O([`text-c-2 flex cursor-default items-center justify-center`,{"font-code pr-2 pl-1 text-base":e.layout===`modal`,"px-2":e.layout!==`modal`,"line-through":e.linethrough}]),"data-testid":`code-input-disabled`},[R(`span`,oFt,k(e.modelValue),1)],2)):e.enum?.length?(F(),L(OR,{key:1,default:e.default,modelValue:e.modelValue,type:l.value,value:e.enum,"onUpdate:modelValue":p},null,8,[`default`,`modelValue`,`type`,`value`])):s.value?(F(),L(OR,{key:2,default:e.default,modelValue:e.modelValue,value:c.value,"onUpdate:modelValue":p},null,8,[`default`,`modelValue`,`value`])):e.examples?.length?(F(),L(OR,{key:3,default:e.default,modelValue:e.modelValue,value:e.examples,"onUpdate:modelValue":p},null,8,[`default`,`modelValue`,`value`])):(F(),I(`div`,ai({key:4,id:j(a)},t.$attrs,{ref_key:`codeMirrorRef`,ref:v,class:[`group/input group-[.alert]:outline-orange group-[.error]:outline-red font-code peer relative w-full overflow-hidden text-xs leading-[1.44] whitespace-nowrap -outline-offset-1 has-[:focus-visible]:rounded-[4px] has-[:focus-visible]:outline`,{"line-wrapping has-[:focus-visible]:bg-b-1 has-[:focus-visible]:absolute has-[:focus-visible]:z-1":e.lineWrapping,"flow-code-input--error":e.error,"line-through":e.linethrough}],onKeydown:[n[0]||=mo(po(e=>T(`down`,e),[`stop`]),[`down`]),n[1]||=mo(e=>T(`enter`,e),[`enter`]),n[2]||=mo(e=>T(`escape`,e),[`escape`]),n[3]||=mo(po(e=>T(`up`,e),[`stop`]),[`up`])]}),[e.disableTabIndent?B(``,!0):(F(),I(`div`,cFt,[...n[5]||=[z(` Press `,-1),R(`kbd`,{class:`-mx-0.25 rounded border px-0.5 font-mono`},`Esc`,-1),z(` then `,-1),R(`kbd`,{class:`-mx-0.25 rounded border px-0.5 font-mono`},`Tab`,-1),z(` to exit `,-1)]]))],16,sFt)),t.$slots.warning?(F(),I(`div`,lFt,[P(t.$slots,`warning`,{},void 0,!0)])):B(``,!0),t.$slots.icon?(F(),I(`div`,uFt,[P(t.$slots,`icon`,{},void 0,!0)])):B(``,!0),e.required?(F(),I(`div`,dFt,` Required `)):B(``,!0),re.value?(F(),L(GSt,{key:8,ref_key:`dropdownRef`,ref:ee,contextFunctionItems:h.value,dropdownPosition:w.value,environment:e.environment,query:C.value,onRedirect:n[4]||=e=>r(`navigate`,{page:`document`,path:`environment`}),onSelect:j(te)},null,8,[`contextFunctionItems`,`dropdownPosition`,`environment`,`query`,`onSelect`])):B(``,!0)],64))}})})),GJ,KJ=s((()=>{Bc(),pFt(),GJ=zc(fFt,[[`__scopeId`,`data-v-3118bf46`]])})),mFt,hFt,gFt,_Ft=s((()=>{W(),kE(),mFt=[`role`],hFt={key:0,class:`sr-only`},gFt=N({__name:`DataTable`,props:{columns:{},scroll:{type:Boolean},presentational:{type:Boolean}},setup(e){let{cx:t}=cf();return(n,r)=>(F(),I(`div`,at($r(j(t)(e.scroll?`overflow-x-auto custom-scroll`:`overflow-visible`,`scalar-data-table`))),[R(`table`,{class:O([`mb-0 grid min-h-8 auto-rows-auto`,{"w-max min-w-full":e.scroll}]),role:e.presentational?`presentation`:`table`,style:it({gridTemplateColumns:e.columns.map(e=>e||`1fr`).join(` `)})},[n.$slots.caption?(F(),I(`caption`,hFt,[P(n.$slots,`caption`)])):B(``,!0),P(n.$slots,`default`)],14,mFt)],16))}})})),qJ,JJ=s((()=>{_Ft(),qJ=gFt})),vFt,yFt=s((()=>{W(),kE(),vFt=N({inheritAttrs:!1,__name:`DataTableCell`,props:{is:{default:`td`}},setup(e){let{cx:t}=cf();return(n,r)=>(F(),L(kr(e.is),ai(j(t)(`box-content max-h-8 min-h-8 min-w-8 border-l-0 border-t border-b-0 border-r flex text-base/5 last:border-r-0 group-last:border-b-transparent p-0 m-0 relative`),{class:`group-[.alert]:bg-b-alert group-[.error]:bg-b-danger`}),{default:M(()=>[P(n.$slots,`default`)]),_:3},16))}})})),YJ,XJ=s((()=>{yFt(),YJ=vFt})),bFt,xFt=s((()=>{XJ(),W(),kE(),bFt=N({__name:`DataTableHeader`,setup(e){let{cx:t}=cf();return(e,n)=>(F(),L(YJ,ai({is:`th`},j(t)(`items-center font-medium px-2 min-w-0 -outline-offset-1`)),{default:M(()=>[P(e.$slots,`default`)]),_:3},16))}})})),ZJ,QJ=s((()=>{xFt(),ZJ=bFt}));function SFt(e,t){return F(),I(`tr`,wFt,[P(e.$slots,`default`)])}var CFt,wFt,$J,eY=s((()=>{Bc(),W(),CFt={},wFt={class:`group contents`},$J=zc(CFt,[[`render`,SFt]])})),tY,TFt=s((()=>{tY=e=>{if(e instanceof File)return e.name}})),EFt,DFt,OFt=s((()=>{XJ(),W(),kE(),EFt=[`checked`,`disabled`],DFt=N({__name:`DataTableCheckbox`,props:{modelValue:{type:Boolean},disabled:{type:Boolean},align:{default:`center`}},emits:[`update:modelValue`],setup(e){let t=of({base:`w-8 h-8 flex items-center justify-center text-b-2 peer-checked:text-c-1 pointer-events-none absolute`,variants:{align:{left:`left-0`,center:`centered`}}});return(n,r)=>(F(),L(YJ,{class:`group/cell relative flex min-w-8`},{default:M(()=>[R(`input`,{checked:e.modelValue,class:`peer absolute inset-0 size-full cursor-pointer opacity-0 disabled:cursor-default`,disabled:!!e.disabled,type:`checkbox`,onChange:r[0]||=e=>n.$emit(`update:modelValue`,e.target.checked)},null,40,EFt),R(`div`,{class:O(j(t)({align:e.align}))},[R(`div`,{class:O([`absolute m-auto size-3/4 rounded border-[1px] opacity-0`,!e.disabled&&`group-has-[:focus-visible]/cell:border-c-accent group-hover:opacity-100 group-has-[:focus-visible]/cell:opacity-100`])},null,2),H(j(jT),{icon:`Checkmark`,size:`xs`,thickness:`2.5`})],2)]),_:1}))}})})),nY,kFt=s((()=>{OFt(),nY=DFt})),rY,AFt=s((()=>{rY=(e,t)=>{if(!e||!(`type`in e)||typeof t!=`string`)return{ok:!0};if(e.type===`integer`||e.type===`number`){let n=Number(t);if(isNaN(n))return{ok:!1,message:`Value must be a number (e.g., 42.5)`};if(e.type===`integer`&&!Number.isInteger(n))return{ok:!1,message:`Value must be a whole number (e.g., 42)`};if(e.minimum!==void 0&&n<e.minimum)return{ok:!1,message:`Value must be ${e.minimum} or greater`};if(e.maximum!==void 0&&n>e.maximum)return{ok:!1,message:`Value must be ${e.maximum} or less`}}if(e.type===`string`&&e.format){if(e.format===`date`&&!/^\d{4}-\d{2}-\d{2}$/.test(t??``))return{ok:!1,message:`Please enter a valid date in YYYY-MM-DD format (e.g., 2024-03-20)`};if(e.format===`date-time`&&!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/.test(t??``))return{ok:!1,message:`Please enter a valid date and time in RFC 3339 format (e.g., 2024-03-20T13:45:30Z)`};if(e.format===`email`&&!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t??``))return{ok:!1,message:`Please enter a valid email address (e.g., user@example.com)`};if(e.format===`uri`&&!/^[a-zA-Z][a-zA-Z0-9+.-]*:.+$/.test(t??``))return{ok:!1,message:`Please enter a valid URI (e.g., https://example.com)`}}return{ok:!0}}})),jFt,MFt,NFt,PFt,FFt,IFt,LFt,RFt,zFt,BFt,VFt=s((()=>{AFt(),W(),kE(),Ou(),jFt=[`aria-label`,`role`],MFt={class:`text-xxs text-c-1 grid w-fit max-w-xs min-w-0 gap-1.5 rounded px-1.5 pt-2 pb-1.5 leading-none break-words`,"data-testid":`request-table-tooltip-content`},NFt={key:0,class:`text-error-1`},PFt={key:1,class:`schema text-c-2 truncate *:not-first:before:content-['_·_']`},FFt={key:0},IFt={key:1},LFt={key:2},RFt={key:3},zFt={key:4},BFt=N({__name:`RequestTableTooltip`,props:{schema:{},value:{},description:{}},setup(e){let t=U(()=>rY(e.schema,e.value)),n=U(()=>t.value.ok===!1);return(r,i)=>(F(),L(j(iE),{offset:4,placement:`left`,teleport:``},{popover:M(()=>[R(`div`,MFt,[t.value.ok===!1?(F(),I(`div`,NFt,k(t.value.message),1)):e.schema&&(`type`in e.schema||`format`in e.schema||`minimum`in e.schema||`maximum`in e.schema||`default`in e.schema)?(F(),I(`div`,PFt,[`type`in e.schema?(F(),I(`span`,FFt,k(e.schema.type),1)):B(``,!0),`format`in e.schema?(F(),I(`span`,IFt,k(e.schema.format),1)):B(``,!0),`minimum`in e.schema?(F(),I(`span`,LFt,`min: `+k(e.schema.minimum),1)):B(``,!0),`maximum`in e.schema?(F(),I(`span`,RFt,`max: `+k(e.schema.maximum),1)):B(``,!0),`default`in e.schema?(F(),I(`span`,zFt,`default: `+k(e.schema.default),1)):B(``,!0)])):B(``,!0),e.description&&!n.value?(F(),L(j(qT),{key:2,value:e.description},null,8,[`value`])):B(``,!0)])]),default:M(()=>[R(`button`,{"aria-label":n.value?`Input is invalid`:`More Information`,class:`text-c-2 hover:text-c-1 hover:bg-b-2 rounded p-1`,role:n.value?`alert`:`none`,type:`button`},[n.value?(F(),L(j(Vme),{key:0,class:`text-orange size-3.5 brightness-90 hover:brightness-75`})):(F(),L(j(gu),{key:1,class:`text-c-2 hover:text-c-1 size-3.5`}))],8,jFt)]),_:1}))}})})),iY,HFt=s((()=>{VFt(),iY=BFt})),UFt,WFt,GFt,KFt=s((()=>{KJ(),XJ(),kFt(),eY(),TFt(),AFt(),HFt(),W(),kE(),Ou(),dD(),UP(),UFt={class:`text-c-2 filemask flex w-full max-w-[100%] items-center justify-center overflow-hidden p-1`},WFt={key:1,class:`p-0.5`},GFt=N({__name:`RequestTableRow`,props:{data:{},hasCheckboxDisabled:{type:Boolean},invalidParams:{},label:{},environment:{},showUploadButton:{type:Boolean}},emits:[`upsertRow`,`deleteRow`,`uploadFile`,`removeFile`,`navigate`],setup(e,{emit:t}){let n=t,r=A(e.data.name??``),i=A(uD(e.data.value)??``),a=A(e.data.isDisabled??!1);mr(()=>e.data.name,e=>r.value=e??``),mr(()=>e.data.value,e=>i.value=uD(e)??``),mr(()=>e.data.isDisabled,e=>a.value=e??!1);let o=U(()=>i.value instanceof File),s=U(()=>(o.value?tY(i.value):i.value)??``),c=U(()=>e.data.schema?.default),l=U(()=>{if(!e.data.schema)return[];if(e.data.schema.enum)return e.data.schema.enum.map(e=>String(e));if(`items`in e.data.schema){let t=HP.schema(e.data.schema.items);if(t?.enum)return t.enum.map(e=>String(e))}return[]}),u=U(()=>e.data.schema&&`minimum`in e.data.schema?e.data.schema.minimum:void 0),d=U(()=>e.data.schema&&`maximum`in e.data.schema?e.data.schema.maximum:void 0),f=U(()=>e.data.schema&&`type`in e.data.schema?e.data.schema.type:void 0),p=U(()=>rY(e.data.schema,i.value)),m=e=>{e.name!==void 0&&(r.value=e.name),e.value!==void 0&&(i.value=e.value),a.value=e.isDisabled??!1,n(`upsertRow`,{name:r.value,value:i.value,isDisabled:a.value})};return(t,h)=>(F(),L(j($J),{id:e.data.name,class:O({alert:p.value.ok===!1,error:p.value.ok===!1&&e.invalidParams?.has(e.data.name)})},{default:M(()=>[H(j(nY),{class:`!border-r`,disabled:e.hasCheckboxDisabled??!1,modelValue:!a.value,"onUpdate:modelValue":h[0]||=e=>m({isDisabled:!e})},null,8,[`disabled`,`modelValue`]),H(j(YJ),null,{default:M(()=>[H(j(GJ),{"aria-label":`${e.label} Key`,disableCloseBrackets:``,disabled:e.data.isReadonly,disableEnter:``,disableTabIndent:``,environment:e.environment,lineWrapping:``,modelValue:r.value,placeholder:`Key`,required:!!e.data.isRequired,onNavigate:h[1]||=e=>n(`navigate`,e),onSelectVariable:h[2]||=e=>m({name:e}),"onUpdate:modelValue":h[3]||=e=>m({name:e})},null,8,[`aria-label`,`disabled`,`environment`,`modelValue`,`required`])]),_:1}),H(j(YJ),null,{default:M(()=>[H(j(GJ),{"aria-label":`${e.label} Value`,class:`pr-6 group-hover:pr-10 group-has-[.cm-focused]:pr-10`,default:c.value,disableCloseBrackets:``,disabled:e.data.isReadonly,disableEnter:``,disableTabIndent:``,enum:l.value,environment:e.environment,examples:e.data.schema?.examples?.map(e=>String(e))??[],linethrough:e.data.isOverridden,lineWrapping:``,max:d.value,min:u.value,modelValue:s.value,placeholder:`Value`,type:f.value,withFakeData:``,onNavigate:h[6]||=e=>n(`navigate`,e),"onUpdate:modelValue":h[7]||=e=>m({value:e})},{icon:M(()=>[(e.data.name||i.value)&&!e.data.isRequired&&e.data.isReadonly!==!0?(F(),L(j(gf),{key:0,class:`text-c-2 hover:text-c-1 hover:bg-b-2 z-context -mr-0.5 hidden h-fit rounded p-1 group-hover:flex group-has-[.cm-focused]:flex`,size:`sm`,variant:`ghost`,onClick:h[4]||=e=>n(`deleteRow`)},{default:M(()=>[H(j(Tu),{class:`size-3.5`})]),_:1})):B(``,!0),e.data.globalRoute===void 0?B(``,!0):(F(),L(j(GT),{key:1,class:`text-c-2 hover:text-c-1 hover:bg-b-2 z-context -mr-0.5 h-fit`,icon:j(Lue),label:`Global cookies are shared across the whole workspace. Click to navigate.`,size:`xs`,tooltip:`top`,variant:`ghost`,onClick:h[5]||=t=>n(`navigate`,e.data.globalRoute)},null,8,[`icon`])),e.data.isReadonly?(F(),L(iY,{key:2,description:`This is a readonly property and you can not modify it! If you want to change it you have to override it or disable it using the checkbox`,value:null})):e.data.schema?(F(),L(iY,{key:3,description:e.data.description,schema:e.data.schema,value:i.value},null,8,[`description`,`schema`,`value`])):B(``,!0)]),_:1},8,[`aria-label`,`default`,`disabled`,`enum`,`environment`,`examples`,`linethrough`,`max`,`min`,`modelValue`,`type`])]),_:1}),e.showUploadButton?(F(),L(j(YJ),{key:0,class:`group/upload flex items-center justify-center whitespace-nowrap`},{default:M(()=>[o.value?(F(),I(V,{key:0},[R(`div`,UFt,[R(`span`,null,k(s.value),1)]),R(`button`,{class:`bg-b-2 mt-1 block rounded p-0.5 text-center text-xs font-medium md:pointer-events-none md:absolute md:inset-x-1 md:top-1/2 md:mt-0 md:-translate-y-1/2 md:opacity-0 md:group-hover/upload:pointer-events-auto md:group-hover/upload:opacity-100`,type:`button`,onClick:h[8]||=e=>n(`removeFile`)},` Delete `)],64)):(F(),I(`div`,WFt,[H(j(gf),{class:`bg-b-2 hover:bg-b-3 text-c-2 h-fit border-0 py-px shadow-none`,size:`sm`,variant:`outlined`,onClick:h[9]||=e=>n(`uploadFile`)},{default:M(()=>[h[10]||=R(`span`,null,`Select File`,-1),H(j(jT),{class:`ml-1`,icon:`Upload`,size:`xs`,thickness:`2.5`})]),_:1})]))]),_:1})):B(``,!0)]),_:1},8,[`id`,`class`]))}})})),qFt,JFt=s((()=>{KFt(),qFt=GFt})),YFt,XFt=s((()=>{JJ(),QJ(),eY(),JFt(),W(),YFt=N({__name:`RequestTable`,props:{data:{},hasCheckboxDisabled:{type:Boolean},invalidParams:{},label:{},showUploadButton:{type:Boolean},showAddRowPlaceholder:{type:Boolean,default:!0},environment:{}},emits:[`upsertRow`,`deleteRow`,`uploadFile`,`removeFile`,`navigate`],setup(e,{emit:t}){let n=t,r=U(()=>e.showUploadButton?[`36px`,``,``,`auto`]:[`36px`,``,``]),i=U(()=>{if(!e.showAddRowPlaceholder)return e.data;let t=e.data.at(-1);return!t||t.name!==``||t.value!==``?[...e.data,{name:``,value:``,isDisabled:!0}]:e.data});return(t,a)=>(F(),L(j(qJ),{class:`group/table flex-1`,columns:r.value},{default:M(()=>[H(j($J),{class:`sr-only !block`},{default:M(()=>[H(j(ZJ),null,{default:M(()=>[z(k(e.label)+` Enabled`,1)]),_:1}),H(j(ZJ),null,{default:M(()=>[z(k(e.label)+` Key`,1)]),_:1}),H(j(ZJ),null,{default:M(()=>[z(k(e.label)+` Value`,1)]),_:1})]),_:1}),(F(!0),I(V,null,Ar(i.value,(t,r)=>(F(),L(qFt,{key:r,data:t,environment:e.environment,hasCheckboxDisabled:e.hasCheckboxDisabled,invalidParams:e.invalidParams,label:e.label,showUploadButton:e.showUploadButton,onDeleteRow:e=>n(`deleteRow`,r),onNavigate:a[0]||=e=>n(`navigate`,e),onRemoveFile:e=>n(`removeFile`,r),onUploadFile:e=>n(`uploadFile`,r),onUpsertRow:e=>n(`upsertRow`,r,e)},null,8,[`data`,`environment`,`hasCheckboxDisabled`,`invalidParams`,`label`,`showUploadButton`,`onDeleteRow`,`onRemoveFile`,`onUploadFile`,`onUpsertRow`]))),128))]),_:1},8,[`columns`]))}})})),aY,ZFt=s((()=>{Bc(),XFt(),aY=zc(YFt,[[`__scopeId`,`data-v-36811e28`]])})),oY,sY,cY,lY,QFt,uY,dY=s((()=>{oY=e=>`type`in e&&(e.type===`object`||Array.isArray(e.type)&&e.type.includes(`object`)),sY=e=>`type`in e&&(e.type===`array`||Array.isArray(e.type)&&e.type.includes(`array`)),cY=e=>`type`in e&&(e.type===`string`||Array.isArray(e.type)&&e.type.includes(`string`)),lY=e=>`type`in e&&(e.type===`number`||e.type===`integer`||Array.isArray(e.type)&&e.type.includes(`number`)||Array.isArray(e.type)&&e.type.includes(`integer`)),QFt=e=>e!==void 0&&`type`in e,uY=e=>`content`in e&&e.content!==void 0})),$Ft,eIt,tIt=s((()=>{pI(),HE(),UP(),dY(),$Ft=e=>e instanceof File?e.name:typeof e==`object`&&e?JSON.stringify(e):String(e),eIt=(e,t,n)=>{if(!e?.value||t!==`multipart/form-data`&&t!==`application/x-www-form-urlencoded`)return[];let r=n&&oY(n)?n:void 0,i=r?new Set(r.required??[]):void 0,a=({name:e,value:t,isDisabled:n=!1})=>{let a={name:e,value:t,isDisabled:n};if(!r||!e)return a;let o=HP.schema(r.properties?.[e]);return a.schema=o,a.description=o?.description,a.isRequired=i?.has(e),a.isDisabled=n,a};return Array.isArray(e.value)?e.value.map(e=>BE(e)?a({name:String(e.name),value:e.value instanceof File?e.value:String(e.value),isDisabled:!!e.isDisabled}):{name:``,value:e,isDisabled:!1}):typeof e.value==`object`&&e.value?fI(e.value).map(([e,t])=>a({name:String(e),value:$Ft(t)})):[]}})),nIt,rIt=s((()=>{Fxt(),ZFt(),tIt(),W(),nIt=N({__name:`RequestBodyForm`,props:{example:{},bodySchema:{},selectedContentType:{},environment:{}},emits:[`update:formValue`],setup(e,{emit:t}){let n=t,r=A([]);mr(()=>[e.example,e.bodySchema,e.selectedContentType],([e,t,n])=>{r.value=eIt(e,n,t)},{immediate:!0});let i=e=>{n(`update:formValue`,e.map(e=>({name:e.name,value:e.value,isDisabled:e.isDisabled??!1})))},a=(e,t)=>{if(e>=r.value.length){r.value=[...r.value,{name:``,value:``,...t,isDisabled:!1}],i(r.value);return}r.value=r.value.map((n,r)=>r===e?{...n,...t}:n),i(r.value)},o=e=>{r.value=r.value.filter((t,n)=>n!==e),i(r.value)},s=e=>{let{open:t}=Pxt({onChange:t=>{let n=t?.[0];if(n){let t=r.value[e];a(e,{name:t?.name||n.name,value:n})}},multiple:!1,accept:`*/*`});t()};return(t,n)=>e.selectedContentType===`multipart/form-data`?(F(),L(aY,{key:0,data:r.value,environment:e.environment,showUploadButton:``,onDeleteRow:o,onRemoveFile:n[0]||=e=>a(e,{value:void 0}),onUploadFile:s,onUpsertRow:a},null,8,[`data`,`environment`])):(F(),L(aY,{key:1,data:r.value,environment:e.environment,onDeleteRow:o,onUpsertRow:a},null,8,[`data`,`environment`]))}})})),iIt,aIt=s((()=>{rIt(),iIt=nIt})),oIt,sIt=s((()=>{W(),oIt=N({name:`ValueEmitter`,props:{value:{}},emits:[`change`,`unmount`],setup(e,{emit:t}){let n=t;return mr(()=>e.value,e=>n(`change`,e),{immediate:!0}),Wi(()=>n(`unmount`)),(e,t)=>null}})})),fY,pY=s((()=>{sIt(),fY=oIt})),cIt,lIt,uIt,dIt,fIt,pIt,mIt,hIt,gIt=s((()=>{pY(),W(),kE(),Rc(),cIt=[`aria-labelledby`],lIt={class:`text-c-1 m-0 flex flex-1 items-center gap-1.5 leading-[20px]`},uIt=[`id`],dIt={key:0,class:`sr-only`},fIt={key:0,class:`bg-b-2 text-c-2 inline-flex h-5 w-5 items-center justify-center rounded-full border text-xs font-semibold`},pIt={class:`sr-only`},mIt={key:0,class:`ui-not-open:hidden flex items-center gap-2 pr-0.75`},hIt=N({name:`CollapsibleSection`,props:{defaultOpen:{type:Boolean,default:!0},itemCount:{default:0},isStatic:{type:Boolean}},emits:[`update:modelValue`],setup(e,{emit:t}){let n=t,r=Sr();return(t,i)=>(F(),L(j(ac),{as:`div`,class:O([`group/collapse text-c-2 focus-within:text-c-1 last:ui-open:border-b-0`,{"last-of-type:first-of-type:border-b-0":e.isStatic,"border-b":!e.isStatic}]),defaultOpen:e.defaultOpen,static:e.isStatic},{default:M(({open:a})=>[H(fY,{value:a,onChange:i[0]||=e=>n(`update:modelValue`,e)},null,8,[`value`]),R(`section`,{"aria-labelledby":j(r),class:`contents`},[R(`div`,{class:O([`bg-b-2 flex items-center`,e.isStatic&&`rounded-t-xl border-x border-t`])},[H(j(oc),{class:O([`hover:text-c-1 group box-content flex max-h-8 flex-1 items-center gap-2.5 overflow-hidden px-1 py-1.5 text-base font-medium outline-none md:px-1.5 xl:pr-0.5 xl:pl-2`,e.isStatic&&`!pl-3`]),disabled:e.isStatic},{default:M(()=>[e.isStatic?B(``,!0):(F(),L(j(jT),{key:0,class:`text-c-3 group-hover:text-c-1 rounded-px ui-open:rotate-90 ui-not-open:rotate-0 outline-offset-2 group-focus-visible:outline`,icon:`ChevronRight`,size:`md`})),R(`h2`,lIt,[R(`span`,{id:j(r),class:`contents`},[P(t.$slots,`title`,{open:a}),a?B(``,!0):(F(),I(`span`,dIt,` (Collapsed) `))],8,uIt),!a&&e.itemCount?(F(),I(`span`,fIt,[z(k(e.itemCount)+` `,1),R(`span`,pIt,`Item`+k(e.itemCount===1?``:`s`),1)])):B(``,!0)])]),_:2},1032,[`class`,`disabled`]),t.$slots.actions?(F(),I(`div`,mIt,[P(t.$slots,`actions`,{open:a})])):B(``,!0)],2),H(j(sc),ai(t.$attrs,{class:`diclosure-panel h-full max-h-fit rounded-b`}),{default:M(()=>[P(t.$slots,`default`,{open:a})]),_:2},1040)],8,cIt)]),_:3},8,[`class`,`defaultOpen`,`static`]))}})})),mY,hY=s((()=>{gIt(),mY=hIt})),gY,_It=s((()=>{gY={"multipart/form-data":`Multipart Form`,"application/x-www-form-urlencoded":`Form URL Encoded`,"application/octet-stream":`Binary File`,"application/json":`JSON`,"application/xml":`XML`,"application/yaml":`YAML`,"application/edn":`EDN`,other:`Other`,none:`None`}})),vIt,yIt,bIt,xIt,SIt=s((()=>{Fxt(),KJ(),JJ(),QJ(),eY(),TFt(),aIt(),hY(),W(),kE(),pI(),QI(),Wu(),dD(),_It(),UP(),vIt={key:0,class:`text-c-3 flex min-h-10 w-full items-center justify-center border-t p-2 text-sm`},yIt={key:1,class:`flex items-center justify-center overflow-hidden border-t p-1.5`},bIt={class:`text-c-2 w-full max-w-full overflow-hidden rounded border px-1.5 py-1 text-xs whitespace-nowrap`},xIt=N({__name:`RequestBody`,props:{requestBody:{},exampleKey:{},title:{},environment:{},requestBodyCompositionSelection:{}},emits:[`update:contentType`,`update:value`,`update:formValue`],setup(e,{emit:t}){let n=t,r={"application/json":`json`,"application/xml":`xml`,"application/yaml":`yaml`},i=U(()=>oF(e.requestBody,e.exampleKey)??`none`),a=e=>Uu(e).essence,o=U(()=>{let t=fI(gY).map(([e,t])=>({id:e,label:t})),n=Object.keys(e.requestBody?.content??{}).filter(e=>e in gY?!1:!(a(e)in gY)).map(e=>({id:e,label:a(e)}));return[...t,...n]}),s=U({get:()=>{let e=o.value.find(e=>e.id===i.value);if(e)return e;let t=a(i.value),n=gY[t]??t;return{id:i.value,label:n}},set:e=>{n(`update:contentType`,{value:e.id})}});function c(e){let{open:t}=Pxt({onChange:t=>{let n=t?.[0];n&&e(n)},multiple:!1,accept:`*/*`});t()}let l=U(()=>e.requestBody&&aF(e.requestBody,i.value,e.exampleKey,e.requestBodyCompositionSelection)),u=U(()=>{if(!l.value)return``;let e=l.value.value;return typeof e==`string`?e:JSON.stringify(e,null,2)}),d=U(()=>HP.schema(e.requestBody?.content?.[i.value]?.schema));return(t,a)=>(F(),L(j(mY),null,{title:M(()=>[z(k(e.title),1)]),default:M(()=>[H(j(qJ),{columns:[``],presentational:``},{default:M(()=>[H(j(ZJ),{class:`relative col-span-full flex h-8 cursor-pointer items-center justify-between border-r-0 !p-0`},{default:M(()=>[H(j(pS),{modelValue:s.value,"onUpdate:modelValue":a[0]||=e=>s.value=e,options:o.value,teleport:``},{default:M(()=>[H(j(gf),{class:`text-c-2 hover:text-c-1 flex h-full w-fit gap-1.5 px-3 font-normal`,fullWidth:``,variant:`ghost`},{default:M(()=>[R(`span`,null,k(s.value.label),1),H(j(jT),{icon:`ChevronDown`,size:`md`})]),_:1})]),_:1},8,[`modelValue`,`options`])]),_:1}),H(j($J),null,{default:M(()=>[i.value===`none`?(F(),I(`div`,vIt,[...a[5]||=[R(`span`,null,`No Body`,-1)]])):i.value===`application/octet-stream`?(F(),I(`div`,yIt,[j(tY)(j(uD)(l.value?.value))===void 0?(F(),L(j(gf),{key:1,class:`bg-b-2 hover:bg-b-3 text-c-2 border-0 shadow-none`,size:`sm`,variant:`outlined`,onClick:a[2]||=()=>c(e=>n(`update:value`,{payload:e,contentType:i.value}))},{default:M(()=>[a[7]||=R(`span`,null,`Select File`,-1),H(j(jT),{class:`ml-1`,icon:`Upload`,size:`xs`,thickness:`2.5`})]),_:1})):(F(),I(V,{key:0},[R(`span`,bIt,k(j(tY)(j(uD)(l.value?.value))),1),H(j(gf),{class:`bg-b-2 hover:bg-b-3 text-c-2 ml-1 border-0 shadow-none`,size:`sm`,variant:`outlined`,onClick:a[1]||=e=>n(`update:value`,{payload:void 0,contentType:i.value})},{default:M(()=>[...a[6]||=[z(` Delete `,-1)]]),_:1})],64))])):i.value===`multipart/form-data`||i.value===`application/x-www-form-urlencoded`?(F(),L(iIt,{key:2,bodySchema:d.value,environment:e.environment,example:l.value,selectedContentType:i.value,"onUpdate:formValue":a[3]||=e=>n(`update:formValue`,{payload:e,contentType:i.value})},null,8,[`bodySchema`,`environment`,`example`,`selectedContentType`])):(F(),L(j(GJ),{key:3,class:`border-t px-3`,content:``,environment:e.environment,language:r[i.value]??`plaintext`,lineNumbers:``,lint:``,modelValue:u.value,withFakeData:``,"onUpdate:modelValue":a[4]||=e=>n(`update:value`,{payload:e,contentType:i.value})},null,8,[`environment`,`language`,`modelValue`]))]),_:1})]),_:1})]),_:1}))}})})),CIt,wIt=s((()=>{Bc(),SIt(),CIt=zc(xIt,[[`__scopeId`,`data-v-0362e671`]])})),_Y,vY,yY,bY=s((()=>{SR(),_Y=`shell/curl`,vY=e=>eL.includes(e),yY=(e,t)=>{let n=e[0]?.options[0];if(t)for(let n of e){let e=n.options.find(e=>e.id===t);if(e)return e}if(!n?.id.startsWith(`custom`))for(let t of e){let e=t.options.find(e=>e.id===_Y);if(e)return e}return n}})),xY,TIt=s((()=>{TR(),xY=(e,t)=>e.length?[{label:`Code Examples`,key:`custom`,options:e.map(e=>{let t=CR(e),n=e.label||e.lang||t;return{id:t,lang:e.lang||`plaintext`,title:n,label:n,clientKey:`custom`}})},...t]:t})),SY,EIt=s((()=>{SY=e=>[`x-custom-examples`,`x-codeSamples`,`x-code-samples`].flatMap(t=>e[t]??[])})),CY,DIt=s((()=>{AF(),CY=e=>e.flatMap(e=>e.type===`apiKey`?e[`x-scalar-secret-token`]:e?.type===`http`?[e[`x-scalar-secret-token`],e[`x-scalar-secret-username`],e[`x-scalar-secret-password`],kF(`${e[`x-scalar-secret-username`]}:${e[`x-scalar-secret-password`]}`)]:e.type===`oauth2`?Object.values(e.flows).map(e=>e[`x-scalar-secret-token`]):[]).filter(Boolean)})),wY,OIt=s((()=>{wY=typeof OVERRIDE_PACKAGE_VERSION<`u`?OVERRIDE_PACKAGE_VERSION:`3.8.1`})),TY,kIt=s((()=>{zE(),dD(),HE(),TY=e=>{let t=new WeakSet,n=new WeakMap,r=e=>{if(!BE(e)&&!Array.isArray(e))return e;let i=uD(e,{depth:1});if(n.has(i))return n.get(i);if(t.has(i))return`[circular]`;if(t.add(i),`$ref`in e){let t=r(RE(e));return n.set(i,t),t}if(Array.isArray(e)){let t=e.map(r);return n.set(i,t),t}let a=Object.fromEntries(Object.entries(e).map(([e,t])=>[e,r(t)]));return n.set(i,a),a};return r(e)}}));function EY(e){return e.replace(/[&<>"']/g,e=>jIt[e]??e)}function AIt(e,t={}){let{indent:n=`  `,format:r=!0,xmlDeclaration:i=!0}=t,a=(e,t,r)=>{let i=``;if(Array.isArray(e))for(let n=0,o=e.length;n<o;n++)i+=a(e[n],t,r);else if(typeof e==`object`&&e){let o=!1,s=``,c=``;for(let t in e)t.charAt(0)===`@`&&(s+=` `+t.substr(1)+`="`+EY(e[t].toString())+`"`);for(let t in e)if(t===`#text`)c+=EY(e[t]?.toString()??``);else if(t===`#cdata`){let n=e[t]?.toString()??``;c+=`<![CDATA[`+n.replace(/]]>/g,`]]]]><![CDATA[>`)+`]]>`}else t.charAt(0)!==`@`&&(o=!0,c+=a(e[t],t,r+n));o||c?(i+=r+`<`+t+s+`>
-`,i+=c,i+=r+`</`+t+`>
-`):i+=r+`<`+t+s+`/>
-`}else i+=r+`<`+t+`>`+EY(e?.toString()||``)+`</`+t+`>
-`;return i},o=``;i&&(o+=`<?xml version="1.0" encoding="UTF-8"?>`,r&&(o+=`
-`));for(let t in e)Object.hasOwn(e,t)&&(o+=a(e[t],t,``));return r?o.trim():o.replace(/\n/g,``).replace(/>\s+</g,`><`).trim()}var jIt,MIt=s((()=>{jIt={"&":`&amp;`,"<":`&lt;`,">":`&gt;`,'"':`&quot;`,"'":`&apos;`}})),DY,NIt,PIt=s((()=>{kIt(),QI(),zE(),MIt(),dD(),DY=(e,t,n)=>{let r=[],i=Array.isArray(e)?e.filter(e=>!e.isDisabled).map(e=>[e.name,e.value]):Object.entries(e);for(let[e,a]of i){if(a==null)continue;let i=n?void 0:t?.[e]?.contentType;if(a instanceof File){let t=uD(a);r.push({name:e,value:`@${t.name}`,...i?{contentType:i}:{}})}else if(i&&typeof a==`object`)r.push({name:e,value:JSON.stringify(uD(a)),contentType:i});else if(Array.isArray(a))for(let t of a)if(t instanceof File){let n=uD(t);r.push({name:e,value:`@${n.name}`})}else r.push({name:e,value:String(t)});else if(typeof a==`object`){let t=DY(a,void 0,e);for(let n of t)r.push({name:`${e}.${n.name}`,value:n.value})}else r.push({name:e,value:String(a),...i?{contentType:i}:{}})}return r},NIt=({requestBody:e,contentType:t,example:n,requestBodyCompositionSelection:r})=>{let i=t||Object.keys(e.content)[0]||``,a=i===`other`?``:i,o=e=>`@${uD(e).name||`filename`}`,s=e.content[i]?.encoding,c=i===`multipart/form-data`||i===`application/x-www-form-urlencoded`,l=i===`application/xml`,u=pD(e,n,t)?.value;if(u!==void 0){let e=typeof u==`object`&&u?uD(u):u;return c&&typeof e==`object`&&e?{mimeType:a,params:DY(e,i===`multipart/form-data`?s:void 0)}:l&&typeof e==`object`&&e?{mimeType:a,text:AIt(e)}:e instanceof File?{mimeType:a,text:o(e)}:{mimeType:a,text:typeof e==`string`?e:JSON.stringify(e)}}let d=RE(e.content[i]?.schema);if(d!==void 0){let e=iF(TY(d),{compositionSelection:r,mode:`write`,xml:l},{schemaPath:[`requestBody`]});if(e!==void 0)return c&&typeof e==`object`&&e?{mimeType:a,params:DY(e,i===`multipart/form-data`?s:void 0)}:l&&typeof e==`object`&&e?{mimeType:a,text:AIt(e)}:{mimeType:a,text:typeof e==`string`?e:JSON.stringify(e)}}}})),FIt,IIt,OY,LIt,RIt,zIt,BIt,VIt=s((()=>{IE(),QI(),zE(),FIt=e=>(e??[]).map(e=>RE(e)),IIt=e=>`allowReserved`in e&&e.allowReserved!==void 0?e.allowReserved:`schema`in e&&e.schema&&typeof e.schema==`object`&&`allowReserved`in e.schema?e.schema.allowReserved===!0:!1,OY=(e,t)=>IIt(t)?e:encodeURIComponent(e),LIt=e=>{if(e.in===`header`)return{style:`simple`,explode:`explode`in e&&e.explode!==void 0?e.explode:!1};if(e.in===`cookie`)return{style:`form`,explode:`explode`in e&&e.explode!==void 0?e.explode:!0};let t={path:`simple`,query:`form`,header:`simple`,cookie:`form`}[e.in],n=`style`in e&&e.style?e.style:t;return{style:n,explode:`explode`in e&&e.explode!==void 0?e.explode:n===`form`}},RIt=(e,t,n,r)=>{let i=pD(e,t,n);if(FE(e,i,r))return;if(i?.value!==void 0)return rI(i.value,e);if(!(`schema`in e)||!e.schema)return;let a=e.in===`path`?{emptyString:`{${e.name}}`}:{};return iF(RE(e.schema),a)},zIt=({harRequest:e,parameters:t,example:n,defaultDisabled:r})=>{let i=[...e.headers],a=[...e.queryString],o=e.url,s=FIt(t);for(let t of s){if(!t.in||!t.name)continue;let s=RIt(t,n,void 0,r);if(s===void 0)continue;let{style:c,explode:l}=LIt(t);switch(t.in){case`path`:o=BIt(o,t,s,c,l);break;case`query`:if(`content`in t&&t.content){let e=iI(s,Object.keys(t.content)[0]??`application/json`);a.push({name:t.name,value:OY(e,t)});break}switch(c){case`form`:{let e=oI(s,l);if(Array.isArray(e))for(let n of e){let e=n.key||t.name;a.push({name:e,value:OY(String(n.value),t)})}else a.push({name:t.name,value:OY(String(e),t)});break}case`spaceDelimited`:{let e=cI(s);a.push({name:t.name,value:OY(e,t)});break}case`pipeDelimited`:{let e=lI(s);a.push({name:t.name,value:OY(e,t)});break}case`deepObject`:if(l){let e=uI(t.name,s);for(let n of e)a.push({name:n.key,value:OY(n.value,t)})}break;default:a.push({name:t.name,value:OY(String(s),t)})}break;case`header`:{let e=aI(s,l);i.push({name:t.name,value:String(e)});break}case`cookie`:{let n=sI(s,l);if(Array.isArray(n))for(let r of n){let n=r.key||t.name,i=r.value===null?`null`:String(r.value);e.cookies.push({name:n,value:i})}else{let r=n===null?`null`:String(n);e.cookies.push({name:t.name,value:r})}break}}}return{url:o,headers:i,queryString:a,cookies:e.cookies}},BIt=(e,t,n,r,i)=>{switch(r){case`matrix`:if(i){if(Array.isArray(n)){let r=n.map(e=>`${t.name}=${e}`).join(`;`);return e.replace(`{;${t.name}}`,`;${r}`)}if(typeof n==`object`&&n){let r=Object.entries(n).map(([e,t])=>`${e}=${t}`).join(`;`);return e.replace(`{;${t.name}}`,`;${r}`)}return e.replace(`{;${t.name}}`,`;${t.name}=${n}`)}if(Array.isArray(n))return e.replace(`{;${t.name}}`,`;${t.name}=${n.join(`,`)}`);if(typeof n==`object`&&n){let r=Object.entries(n).map(([e,t])=>`${e},${t}`).join(`,`);return e.replace(`{;${t.name}}`,`;${t.name}=${r}`)}return e.replace(`{;${t.name}}`,`;${t.name}=${n}`);case`label`:if(i){if(Array.isArray(n))return e.replace(`{.${t.name}}`,`.${n.join(`.`)}`);if(typeof n==`object`&&n){let r=Object.entries(n).map(([e,t])=>`${e}=${t}`).join(`.`);return e.replace(`{.${t.name}}`,`.${r}`)}return e.replace(`{.${t.name}}`,`.${n}`)}if(Array.isArray(n))return e.replace(`{.${t.name}}`,`.${n.join(`,`)}`);if(typeof n==`object`&&n){let r=Object.entries(n).map(([e,t])=>`${e},${t}`).join(`,`);return e.replace(`{.${t.name}}`,`.${r}`)}return e.replace(`{.${t.name}}`,`.${n}`);case`simple`:{let r=aI(n,i);return e.replace(`{${t.name}}`,String(r))}default:return e.replace(`{${t.name}}`,String(n))}}})),HIt,UIt=s((()=>{AF(),HIt=e=>{let t={headers:[],queryString:[],cookies:[]};for(let n of e){if(n.type===`apiKey`){let e=n[`x-scalar-secret-token`]||`YOUR_SECRET_TOKEN`;if(!n.name)continue;let r={name:n.name,value:e};switch(n.in){case`header`:t.headers.push(r);break;case`query`:t.queryString.push(r);break;case`cookie`:t.cookies.push(r);break}continue}if(n.type===`http`){if(n.scheme===`basic`){let e=`${n[`x-scalar-secret-username`]||``}:${n[`x-scalar-secret-password`]||``}`,r=e===`:`?`username:password`:kF(e);t.headers.push({name:`Authorization`,value:`Basic ${r}`})}else if(n.scheme===`bearer`){let e=n[`x-scalar-secret-token`]||`YOUR_SECRET_TOKEN`;t.headers.push({name:`Authorization`,value:`Bearer ${e}`})}continue}if(n.type===`oauth2`&&n.flows){let e=Object.values(n.flows).find(e=>e[`x-scalar-secret-token`])?.[`x-scalar-secret-token`]||`YOUR_SECRET_TOKEN`;t.headers.push({name:`Authorization`,value:`Bearer ${e}`})}}return t}})),WIt,GIt=s((()=>{lF(),Iu(),WIt=(e,t)=>{if(!e?.url)return t;let n=e.url;return e.variables?Fu(lpt(n,Object.entries(e.variables).reduce((e,[t,n])=>(n.default!==void 0&&(e[t]=n.default),e),{})),t):Fu(n,t)}})),kY,KIt=s((()=>{OIt(),PIt(),VIt(),UIt(),GIt(),QI(),$u(),zE(),kY=({includeDefaultHeaders:e=!1,operation:t,contentType:n,method:r,path:i,server:a=null,example:o,securitySchemes:s,globalCookies:c,requestBodyCompositionSelection:l,defaultDisabledParameters:u=!1})=>{let d=Lht(e?bI({method:r,operation:t,exampleName:o??`default`,hideDisabledHeaders:!0,hideOverriddenHeaders:!0,options:{isElectron:Qu(),appVersion:wY}}):{}),f=t[`x-scalar-disable-parameters`]?.[`global-cookies`]?.[o??`default`]??{},p={method:r,url:WIt(a,i),headers:Object.entries(d).map(([e,t])=>({name:e,value:t})),queryString:[],postData:void 0,httpVersion:`HTTP/1.1`,cookies:[],headersSize:-1,bodySize:-1};if(t.parameters){let{url:e,headers:n,queryString:r,cookies:i}=zIt({harRequest:p,parameters:t.parameters,example:o,defaultDisabled:u}),a=c?.filter(t=>jF({cookie:t,url:e,disabledGlobalCookies:f}))?.map(e=>({name:e.name,value:e.value}))??[];p.url=e,p.headers=n,p.queryString=r,p.cookies=[...a,...i]}let m=RE(t.requestBody);if(m?.content){let e=NIt({requestBody:m,contentType:n,example:o,requestBodyCompositionSelection:l});if(e&&(p.postData=e,p.bodySize=e.text?.length??-1,e.mimeType)){let t=p.headers.find(e=>e.name.toLowerCase()===`content-type`);t&&!t.value?t.value=e.mimeType:t||p.headers.push({name:`Content-Type`,value:e.mimeType})}}if(s){let{headers:e,queryString:t,cookies:n}=HIt(s);p.headers.push(...e),p.queryString.push(...t),p.cookies.push(...n)}let h=0;for(let e of p.headers)h+=(e.name?.length??0)+2+(e.value?.length??0)+2;return p.headersSize=h,p}})),AY,qIt,JIt=s((()=>{SR(),AY=`ws://replace.me`,qIt=(e,t,n)=>{try{if(!n.url)return[Error(`Please enter a URL to see a code snippet`),null];let r=n.url.startsWith(`/`)?``:`/`;try{new URL(n.url)}catch{n.url=`${AY}${r}${n.url}`}if(n.postData?.mimeType===`application/json`)try{JSON.parse(n.postData.text||`{}`)}catch(e){return console.error(`[getSnippet] Invalid JSON body`,e),[Error(`Invalid JSON body`),null]}let i=e.replace(`javascript`,`js`);if(xR().hasPlugin(i,t)){let e=xR().print(i,t,n);return e?[null,e.replace(`${AY}${r}`,``)]:[Error(`Error generating snippet`),null]}}catch(e){return console.error(`[getSnippet] Error generating snippet`,e),[Error(`Error generating snippet`),null]}return[Error(`No snippet found`),null]}})),jY,YIt=s((()=>{KIt(),TR(),JIt(),jY=({clientId:e,customCodeSamples:t,includeDefaultHeaders:n=!1,operation:r,method:i,path:a,example:o,contentType:s,server:c,securitySchemes:l,globalCookies:u,requestBodyCompositionSelection:d,defaultDisabledParameters:f})=>{try{if(!e)return``;if(e.startsWith(`custom`))return t.find(t=>CR(t)===e)?.source??`Custom example not found`;let p=kY({operation:r,contentType:s,method:i,path:a,server:c,securitySchemes:l,example:o,globalCookies:u,includeDefaultHeaders:n,requestBodyCompositionSelection:d,defaultDisabledParameters:f}),[m,h]=e.split(`/`),[g,_]=qIt(m,h,p);return g?(console.error(`[generateCodeSnippet]`,g),g.message??`Error generating code snippet`):_}catch(e){return console.error(`[generateCodeSnippet]`,e),`Error generating code snippet`}}})),XIt,ZIt,QIt,$It=s((()=>{JJ(),eY(),bY(),TIt(),EIt(),DIt(),YIt(),hY(),W(),kE(),Ou(),XIt={class:`flex flex-1`},ZIt={class:`overflow-hidden`},QIt=N({__name:`RequestCodeSnippet`,props:{integration:{},clientOptions:{},selectedClient:{},selectedServer:{default:null},selectedContentType:{},selectedExample:{},eventBus:{},securitySchemes:{},method:{},path:{},operation:{},fallback:{type:Boolean},generateLabel:{type:Function},isWebhook:{type:Boolean},globalCookies:{},requestBodyCompositionSelection:{}},setup(e){let t=U(()=>SY(e.operation)),n=U(()=>xY(t.value,e.clientOptions)),r=A(yY(n.value,e.selectedClient));mr(()=>e.selectedClient,e=>{let t=yY(n.value,e);t&&(r.value=t)});let i=U(()=>CY(e.securitySchemes??[])),a=t=>{r.value=t,t&&!t.id.startsWith(`custom`)&&e.eventBus.emit(`workspace:update:selected-client`,t.id)},o=U(()=>jY({defaultDisabledParameters:!0,clientId:r.value?.id,customCodeSamples:t.value,operation:e.operation,method:e.method,path:e.path,contentType:e.selectedContentType,server:e.selectedServer,securitySchemes:e.securitySchemes,example:e.selectedExample,globalCookies:e.globalCookies,includeDefaultHeaders:e.integration===`client`})),s=U(()=>n.value.some(e=>e.options.length>0));return(e,t)=>lr((F(),L(j(mY),{class:`group/preview w-full border-t`,defaultOpen:!1},{title:M(()=>[...t[1]||=[z(`Code Snippet`,-1)]]),actions:M(()=>[R(`div`,XIt,[H(j(PS),{modelValue:r.value,options:n.value,placement:`bottom-end`,"onUpdate:modelValue":t[0]||=e=>a(e)},{default:M(({open:e})=>[H(j(gf),{class:`text-c-2 hover:text-c-1 flex h-full w-fit gap-1.5 px-0.5 py-0 text-base font-normal`,"data-testid":`client-picker`,variant:`ghost`},{default:M(()=>[z(k(r.value?.title)+` `,1),H(j(tl),{class:O([`mt-0.25 size-3 transition-transform duration-100`,e&&`rotate-180`]),weight:`bold`},null,8,[`class`])]),_:2},1024)]),_:1},8,[`modelValue`,`options`])])]),default:M(()=>[H(j(aC),null,{default:M(()=>[H(j(qJ),{columns:[``],presentational:``},{default:M(()=>[H(j($J),null,{default:M(()=>[R(`div`,ZIt,[H(j(Wy),{class:`text-base`,content:o.value,hideCredentials:i.value,lang:r.value?.lang??`plaintext`,lineNumbers:``},null,8,[`content`,`hideCredentials`,`lang`])])]),_:1})]),_:1})]),_:1})]),_:1},512)),[[Za,s.value]])}})})),eLt,tLt=s((()=>{$It(),eLt=QIt})),nLt,rLt,iLt,aLt=s((()=>{ZFt(),hY(),W(),kE(),nLt={class:`text-c-2 request-meta-buttons flex whitespace-nowrap opacity-0 group-hover/params:opacity-100 has-[:focus-visible]:opacity-100`},rLt={class:`sr-only`},iLt=N({__name:`RequestParams`,props:{rows:{},exampleKey:{},title:{},label:{},invalidParams:{},globalRoute:{},showAddRowPlaceholder:{type:Boolean,default:!0},environment:{},eventBus:{}},emits:[`upsert`,`delete`,`deleteAll`],setup(e,{emit:t}){let n=t,r=U(()=>e.rows.length>1),i=(e,t)=>{let{value:r,...i}=t;r instanceof File||n(`upsert`,e,{...i,value:r??``})};return(t,a)=>(F(),L(j(mY),{class:`group/params`,itemCount:e.rows.length},{title:M(()=>[z(k(e.title),1)]),actions:M(()=>[R(`div`,nLt,[r.value?(F(),L(j(WT),{key:0,content:`Clear optional parameters`,placement:`left`},{default:M(()=>[H(j(gf),{class:`pr-0.75 pl-1 transition-none`,size:`sm`,variant:`ghost`,onClick:a[0]||=po(e=>n(`deleteAll`),[`stop`])},{default:M(()=>[a[3]||=z(` Clear `,-1),R(`span`,rLt,`All `+k(e.title),1)]),_:1})]),_:1})):B(``,!0)])]),default:M(()=>[H(aY,{class:`flex-1`,columns:[`32px`,``,``],data:e.rows,environment:e.environment,exampleKey:e.exampleKey,globalRoute:e.globalRoute,invalidParams:e.invalidParams,label:e.label,showAddRowPlaceholder:e.showAddRowPlaceholder,onDeleteRow:a[1]||=e=>n(`delete`,{index:e}),onNavigate:a[2]||=t=>e.eventBus.emit(`ui:navigate`,t),onUpsertRow:i},null,8,[`data`,`environment`,`exampleKey`,`globalRoute`,`invalidParams`,`label`,`showAddRowPlaceholder`])]),_:1},8,[`itemCount`]))}})})),MY,oLt=s((()=>{aLt(),MY=iLt})),sLt,NY,PY=s((()=>{sLt=new Set([`__proto__`,`prototype`,`constructor`]),NY=(e,t)=>{if(sLt.has(e)){let n=t?`Prototype pollution key detected: "${e}" in ${t}`:`Prototype pollution key detected: "${e}"`;throw Error(n)}}})),FY,cLt=s((()=>{HE(),PY(),FY=(e,t,n)=>{let[r,...i]=t;if(!r)return;if(NY(r),!i.length){e[r]=n;return}let a=BE(e[r])?e[r]:{};e[r]=a,FY(a,i,n)}})),lLt,IY,LY,uLt=s((()=>{cLt(),lLt=e=>e==null||e===``,IY=(e,t,n)=>{let r={};for(let i of t){if(i.originalParameter!==e.originalParameter||!i.sourceParameterValuePath||i===e&&!n)continue;let t=i===e?n?.value:i.value;lLt(t)||FY(r,i.sourceParameterValuePath,t)}return{name:e.originalParameter?.name??n?.name??e.name,value:r,isDisabled:n?.isDisabled??e.isDisabled??!1}},LY=(e,t,n,{context:r,defaultParameters:i=0,globalParameters:a=0,onDeleteExpandedRow:o})=>{let s=i+a;return{delete:i=>{let a=r[i.index];if(a?.originalParameter){if(a.sourceParameterValuePath)return o?.(a),t.emit(`operation:upsert:parameter`,{type:e,payload:IY(a,r),originalParameter:a.originalParameter,meta:n},{skipUnpackProxy:!0});t.emit(`operation:delete:parameter`,{originalParameter:a.originalParameter,meta:n},{skipUnpackProxy:!0})}},deleteAll:()=>t.emit(`operation:delete-all:parameters`,{type:e,meta:n}),upsert:(o,c)=>{let l=r[o];if(o<i+a){let r=o<i?`default`:`global`;return t.emit(`operation:update:extra-parameters`,{type:r,in:e,meta:{...n,name:l?.name?.toLowerCase?.()??`NON_VALID`},payload:{isDisabled:c.isDisabled??!1}})}if(o>=s){let i=l?.sourceParameterValuePath&&l.originalParameter?IY(l,r,c):c;return t.emit(`operation:upsert:parameter`,{type:e,payload:i,originalParameter:l?.originalParameter??null,meta:n},{skipUnpackProxy:!0,debounceKey:`update:parameter-${e}-${o-s}`})}}}}})),dLt,fLt=s((()=>{dLt=e=>{if(`content`in e&&e.content){let t=Object.keys(e.content);return t.length===1?e.content[t[0]]:void 0}}})),pLt,mLt=s((()=>{fLt(),zE(),pLt=e=>`schema`in e&&e.schema?RE(e.schema):RE(dLt(e)?.schema)}));function RY(e,t){return t.reduce((e,t)=>{if(e!=null)return e[t]},e)}var zY=s((()=>{})),hLt,gLt,_Lt,vLt,yLt,BY,VY,HY,UY,bLt,xLt=s((()=>{IE(),mLt(),zY(),QI(),zE(),dY(),hLt=e=>`schema`in e&&e.schema!==void 0,gLt=e=>RE(e),_Lt=e=>{let t=`style`in e&&e.style?e.style:`form`;return{style:t,explode:`explode`in e&&e.explode!==void 0?e.explode:t===`form`}},vLt=(e,t)=>{if(e.in!==`query`||!hLt(e)||!t||!oY(t))return null;let{style:n,explode:r}=_Lt(e);return r?n===`form`?`form`:n===`deepObject`?`deepObject`:null:null},yLt=e=>e==null?``:Array.isArray(e)?e.join(`,`):typeof e==`object`?JSON.stringify(e):String(e),BY=e=>e.join(`\0`),VY=({parameter:e,name:t,value:n,description:r,schema:i,isRequired:a,isDisabled:o,sourceParameterValuePath:s})=>({name:t,value:yLt(n),description:r,schema:i,isRequired:a,isDisabled:o,originalParameter:e,sourceParameterValuePath:s}),HY=(e,t,n,r)=>VY({parameter:e,name:e.name,value:n,description:e.description,schema:t,isRequired:e.required,isDisabled:r}),UY=({parameter:e,schema:t,value:n,pathPrefix:r,namePrefix:i,mode:a,isDisabled:o,hiddenValuePaths:s})=>{if(!t.properties)return[];let c=new Set(t.required??[]);return Object.entries(t.properties).flatMap(([t,l])=>{let u=gLt(l);if(!u)return[];let d=[...r,t],f=i?`${i}[${t}]`:t;return s.has(BY(d))?[]:a===`deepObject`&&oY(u)&&u.properties?UY({parameter:e,schema:u,value:n,pathPrefix:d,namePrefix:f,mode:a,isDisabled:o,hiddenValuePaths:s}):[VY({parameter:e,name:f,value:RY(n,d),description:u.description??e.description,schema:u,isRequired:c.has(t),isDisabled:o,sourceParameterValuePath:d})]})},bLt=(e,t,n={})=>{let r=pD(e,t,void 0),i=FE(e,r),a=pLt(e),o=vLt(e,a);if(o===null||!a||!oY(a))return[HY(e,a,r?.value,i)];let s=r?.value===void 0?void 0:rI(r.value,e);if(!a.properties)return[HY(e,a,r?.value,i)];let c=new Set(n.hiddenValuePaths?.map(BY)??[]);return UY({parameter:e,schema:a,value:s,pathPrefix:[],namePrefix:o===`deepObject`?e.name:``,mode:o,isDisabled:i,hiddenValuePaths:c})}})),WY,SLt=s((()=>{WY=(e,t,n)=>e.reduce((e,r)=>{let i=n?n(r):r;return(e[r[t]]??=[]).push(i),e},{})})),CLt,wLt,TLt,ELt=s((()=>{W(),kE(),CLt={class:`text-c-2 mb-4 text-sm leading-normal`},wLt={class:`flex justify-between gap-2`},TLt=N({__name:`DeleteRequestAuthModal`,props:{state:{},label:{}},emits:[`close`,`delete`],setup(e,{emit:t}){let n=t,r=()=>{n(`delete`)};return(t,i)=>(F(),L(j(rE),{size:`xxs`,state:e.state,title:`Delete Security Scheme`},{default:M(()=>[R(`p`,CLt,` This cannot be undone. You're about to delete the `+k(e.label)+` security scheme from the collection. `,1),R(`div`,wLt,[H(j(gf),{class:`flex h-8 cursor-pointer items-center gap-1.5 px-3 shadow-none focus:outline-none`,type:`button`,variant:`outlined`,onClick:i[0]||=e=>n(`close`)},{default:M(()=>[...i[1]||=[z(` Cancel `,-1)]]),_:1}),H(j(gf),{class:`flex h-8 cursor-pointer items-center gap-1.5 px-3 shadow-none focus:outline-none`,type:`submit`,onClick:r},{default:M(()=>[z(` Delete `+k(e.label),1)]),_:1})])]),_:1},8,[`state`]))}})})),DLt,OLt=s((()=>{ELt(),DLt=TLt})),kLt,ALt=s((()=>{kLt={apiKeyCookie:{label:`API Key in Cookies`,payload:{type:`apiKey`,in:`cookie`,name:`apiKeyCookie`}},apiKeyHeader:{label:`API Key in Headers`,payload:{type:`apiKey`,in:`header`,name:`apiKeyHeader`}},apiKeyQuery:{label:`API Key in Query Params`,payload:{type:`apiKey`,in:`query`,name:`apiKeyQuery`}},httpBasic:{label:`HTTP Basic`,payload:{type:`http`,scheme:`basic`}},httpBearer:{label:`HTTP Bearer`,payload:{type:`http`,scheme:`bearer`}},oauth2Implicit:{label:`Oauth2 Implicit Flow`,payload:{type:`oauth2`,flows:{implicit:{authorizationUrl:``,refreshUrl:``,scopes:{}}}}},oauth2Password:{label:`Oauth2 Password Flow`,payload:{type:`oauth2`,flows:{password:{tokenUrl:``,refreshUrl:``,scopes:{}}}}},oauth2ClientCredentials:{label:`Oauth2 Client Credentials`,payload:{type:`oauth2`,flows:{clientCredentials:{tokenUrl:``,refreshUrl:``,scopes:{}}}}},oauth2AuthorizationFlow:{label:`Oauth2 Authorization Code`,payload:{type:`oauth2`,flows:{authorizationCode:{authorizationUrl:``,tokenUrl:``,refreshUrl:``,"x-usePkce":`no`,scopes:{}}}}}}})),GY,KY=s((()=>{GY=e=>{let t=0,n=0,r=e.length,i=r&15,a=r-i,o=2277735313,s=1291169091,c=1390208809,l=944331445;for(let r=0;r<a;r+=16){let i=e.charCodeAt(r)&255|(e.charCodeAt(r+1)&255)<<8|(e.charCodeAt(r+2)&255)<<16|(e.charCodeAt(r+3)&255)<<24,a=e.charCodeAt(r+4)&255|(e.charCodeAt(r+5)&255)<<8|(e.charCodeAt(r+6)&255)<<16|(e.charCodeAt(r+7)&255)<<24,u=e.charCodeAt(r+8)&255|(e.charCodeAt(r+9)&255)<<8|(e.charCodeAt(r+10)&255)<<16|(e.charCodeAt(r+11)&255)<<24,d=e.charCodeAt(r+12)&255|(e.charCodeAt(r+13)&255)<<8|(e.charCodeAt(r+14)&255)<<16|(e.charCodeAt(r+15)&255)<<24;i=Math.imul(i,o),i=i<<15|i>>>17,i=Math.imul(i,s),t^=i,t=t<<13|t>>>19,t=Math.imul(t,5)+3864292196,a=Math.imul(a,s),a=a<<16|a>>>16,a=Math.imul(a,c),n^=a,n=n<<17|n>>>15,n=Math.imul(n,5)+461845907,u=Math.imul(u,c),u=u<<17|u>>>15,u=Math.imul(u,l),t^=u,t=t<<15|t>>>17,t=Math.imul(t,5)+1390208809,d=Math.imul(d,l),d=d<<18|d>>>14,d=Math.imul(d,o),n^=d,n=n<<13|n>>>19,n=Math.imul(n,5)+944331445}if(i>0){let r=0,u=0,d=0,f=0;i>=15&&(f^=(e.charCodeAt(a+14)&255)<<16),i>=14&&(f^=(e.charCodeAt(a+13)&255)<<8),i>=13&&(f^=e.charCodeAt(a+12)&255,f=Math.imul(f,l),f=f<<18|f>>>14,f=Math.imul(f,o),n^=f),i>=12&&(d^=(e.charCodeAt(a+11)&255)<<24),i>=11&&(d^=(e.charCodeAt(a+10)&255)<<16),i>=10&&(d^=(e.charCodeAt(a+9)&255)<<8),i>=9&&(d^=e.charCodeAt(a+8)&255,d=Math.imul(d,c),d=d<<17|d>>>15,d=Math.imul(d,l),t^=d),i>=8&&(u^=(e.charCodeAt(a+7)&255)<<24),i>=7&&(u^=(e.charCodeAt(a+6)&255)<<16),i>=6&&(u^=(e.charCodeAt(a+5)&255)<<8),i>=5&&(u^=e.charCodeAt(a+4)&255,u=Math.imul(u,s),u=u<<16|u>>>16,u=Math.imul(u,c),n^=u),i>=4&&(r^=(e.charCodeAt(a+3)&255)<<24),i>=3&&(r^=(e.charCodeAt(a+2)&255)<<16),i>=2&&(r^=(e.charCodeAt(a+1)&255)<<8),i>=1&&(r^=e.charCodeAt(a)&255,r=Math.imul(r,o),r=r<<15|r>>>17,r=Math.imul(r,s),t^=r)}return t^=r,n^=r,t+=n,n+=t,t^=t>>>16,t=Math.imul(t,2246822507),t^=t>>>13,t=Math.imul(t,3266489909),t^=t>>>16,n^=n>>>16,n=Math.imul(n,2246822507),n^=n>>>13,n=Math.imul(n,3266489909),n^=n>>>16,t+=n,n+=t,(t>>>0).toString(16).padStart(8,`0`)+(n>>>0).toString(16).padStart(8,`0`)}})),qY,JY,YY,XY,jLt,MLt=s((()=>{ALt(),zE(),KY(),qY=e=>JSON.stringify(Object.keys(e)),JY=({name:e,value:t})=>({id:GY(JSON.stringify(t)),label:e,value:t,isDeletable:!0}),YY=e=>JY({name:Object.keys(e).join(` & `),value:e}),XY=(e,t)=>{let n=Object.keys(e);if(n.length>1)return YY(e);if(n[0])return RE(t[n[0]])?JY({name:n[0],value:e}):void 0},jLt=(e,t,n,r=!1)=>{let i=new Map(n.map(e=>[qY(e),e])),{requiredFormatted:a,requiredSchemeNames:o,existingIds:s}=e.reduce((e,n)=>{let r=XY(i.get(qY(n))??n,t);r&&(e.requiredFormatted.push(r),e.existingIds.add(r.id));for(let t of Object.keys(n))e.requiredSchemeNames.add(t);return e},{requiredFormatted:[],requiredSchemeNames:new Set,existingIds:new Set}),c=[];for(let[e,n]of Object.entries(t))if(!o.has(e)&&RE(n)){let t=JY({name:e,value:{[e]:[]}});c.push(t),s.add(t.id)}for(let e of n){let n=XY(e,t);n&&!s.has(n.id)&&(c.push(n),s.add(n.id))}let l=[{label:`Required authentication`,options:a},{label:`Available authentication`,options:c}];return r?(l.push({label:`Add new authentication`,options:Object.entries(kLt).map(([e,t])=>({id:e,label:t.label,value:{[e]:[]},payload:t.payload,isDeletable:!1}))}),l):a.length?l:c}})),NLt,PLt,FLt,ILt,LLt,RLt=s((()=>{Uxt(),KJ(),XJ(),W(),kE(),Ou(),NLt=[`for`],PLt={class:`relative flex min-w-0 flex-1`},FLt=[`readOnly`,`type`,`value`],ILt={key:1,class:`centered-y text-orange absolute right-7 text-xs`},LLt=N({inheritAttrs:!1,__name:`DataTableInput`,props:{id:{},type:{},containerClass:{},required:{type:Boolean,default:!1},modelValue:{},canAddCustomEnumValue:{type:Boolean,default:!0},readOnly:{type:Boolean,default:!1},enum:{},min:{},max:{},environment:{},description:{},lineWrapping:{type:Boolean,default:!1},withFakeData:{type:Boolean,default:!0}},emits:[`update:modelValue`,`inputFocus`,`inputBlur`,`selectVariable`],setup(e,{emit:t}){let n=e,r=t,i=A(!0),a=A(!1),o=wr(`codeInput`),s=()=>!a.value&&r(`inputBlur`),c=U(()=>n.type===`password`?`text`:n.type??`text`),l=()=>{!n.enum?.length&&!n.readOnly&&o.value?.focus()};return(t,a)=>(F(),L(YJ,{class:O([`relative flex`,e.containerClass])},{default:M(()=>[t.$slots.default?(F(),I(`div`,{key:0,class:`text-c-1 flex items-center pr-0 pl-3`,for:e.id??``,onClick:l},[P(t.$slots,`default`,{},void 0,!0),a[6]||=z(`: `,-1)],8,NLt)):B(``,!0),R(`div`,PLt,[n.enum&&n.enum.length?(F(),L(OR,{key:0,canAddCustomValue:n.canAddCustomEnumValue,modelValue:n.modelValue,value:n.enum,"onUpdate:modelValue":a[0]||=e=>r(`update:modelValue`,e)},null,8,[`canAddCustomValue`,`modelValue`,`value`])):(F(),I(V,{key:1},[i.value&&e.type===`password`?(F(),I(`input`,ai({key:0},e.id?{...t.$attrs,id:e.id}:t.$attrs,{autocomplete:`off`,class:[`text-c-1 disabled:text-c-2 peer w-full min-w-0 border-none px-2 py-1.25 -outline-offset-1`,{"scalar-password-input":e.type===`password`}],"data-1p-ignore":``,readOnly:e.readOnly,spellcheck:`false`,type:c.value,value:e.modelValue,onInput:a[1]||=e=>r(`update:modelValue`,e.target.value??``)}),null,16,FLt)):(F(),L(j(GJ),ai({key:1},t.$attrs,{id:e.id,ref_key:`codeInput`,ref:o,class:[`text-c-1 disabled:text-c-2 peer w-full min-w-0 border-none -outline-offset-1`,[e.type===`password`&&e.description&&`pr-12`,e.description&&`pr-8`,e.type===`password`&&`scalar-password-input`]],description:e.description,disableCloseBrackets:``,disableTabIndent:``,environment:e.environment,lineWrapping:!!e.lineWrapping,max:e.max,min:e.min,modelValue:e.modelValue??``,readOnly:e.readOnly,required:!!e.required,spellcheck:`false`,type:c.value,withFakeData:e.withFakeData,onBlur:s,onFocus:a[2]||=e=>r(`inputFocus`),"onUpdate:modelValue":a[3]||=e=>r(`update:modelValue`,e)}),null,16,[`id`,`class`,`description`,`environment`,`lineWrapping`,`max`,`min`,`modelValue`,`readOnly`,`required`,`type`,`withFakeData`]))],64))]),t.$slots.warning?(F(),I(`div`,ILt,[P(t.$slots,`warning`,{},void 0,!0)])):B(``,!0),P(t.$slots,`icon`,{},void 0,!0),e.modelValue?(F(),L(j(GT),{key:2,class:`-ml-.25 h-6 w-6 self-center p-1.25`,icon:j(Du),label:`Clear Value`,onClick:a[4]||=e=>r(`update:modelValue`,``)},null,8,[`icon`])):B(``,!0),e.type===`password`?(F(),L(j(GT),{key:3,class:`-ml-.5 mr-1.25 h-6 w-6 self-center p-1.25`,"data-testid":`data-table-password-toggle`,icon:i.value?j(du):j(nle),label:i.value?`Show Password`:`Hide Password`,onClick:a[5]||=e=>i.value=!i.value},null,8,[`icon`,`label`])):B(``,!0)]),_:3},8,[`class`]))}})})),zLt,BLt=s((()=>{Bc(),RLt(),zLt=zc(LLt,[[`__scopeId`,`data-v-819cea32`]])})),VLt,HLt,ULt=s((()=>{BLt(),W(),VLt=[`for`],HLt=N({__name:`RequestAuthDataTableInput`,props:Lr({containerClass:{},environment:{},readOnly:{type:Boolean,default:!1},required:{type:Boolean,default:!1},type:{}},{modelValue:{default:``,required:!0},modelModifiers:{}}),emits:Lr([`inputFocus`,`inputBlur`,`selectVariable`],[`update:modelValue`]),setup(e,{emit:t}){let n=t,r=Ur(e,`modelValue`),i=Sr();return(t,a)=>(F(),L(j(zLt),ai({id:j(i)},t.$attrs,{modelValue:r.value,"onUpdate:modelValue":a[0]||=e=>r.value=e,canAddCustomEnumValue:!e.readOnly,containerClass:e.containerClass,environment:e.environment,lineWrapping:``,readOnly:e.readOnly,required:e.required,type:e.type,onInputBlur:a[1]||=e=>n(`inputBlur`),onInputFocus:a[2]||=e=>n(`inputFocus`),onSelectVariable:a[3]||=e=>n(`selectVariable`,e)}),{default:M(()=>[R(`label`,{for:j(i)},[P(t.$slots,`default`)],8,VLt)]),icon:M(()=>[P(t.$slots,`icon`)]),_:3},16,[`id`,`modelValue`,`canAddCustomEnumValue`,`containerClass`,`environment`,`readOnly`,`required`,`type`]))}})})),ZY,QY=s((()=>{ULt(),ZY=HLt})),WLt,GLt,KLt,qLt=s((()=>{W(),kE(),WLt={class:`flex gap-2`},GLt={class:`flex max-h-8 flex-1`},KLt=N({name:`CommandActionForm`,props:{loader:{},disabled:{type:Boolean,default:!1}},emits:[`submit`,`cancel`,`back`],setup(e,{emit:t}){let n=t,{cx:r}=cf(),i=()=>{e.disabled||n(`submit`)};return(t,n)=>(F(),I(`form`,{class:`flex w-full flex-col gap-3`,onKeydown:n[0]||=mo(po(()=>{},[`stop`]),[`enter`]),onSubmit:po(i,[`prevent`,`stop`])},[R(`div`,at($r(j(r)(`relative flex min-h-20 flex-col rounded`))),[P(t.$slots,`default`)],16),R(`div`,WLt,[R(`div`,GLt,[P(t.$slots,`options`)]),H(j(gf),{class:`max-h-8 px-3 text-xs`,disabled:e.disabled,loader:e.loader,type:`submit`},{default:M(()=>[P(t.$slots,`submit`,{},()=>[n[1]||=z(`Continue`,-1)])]),_:3},8,[`disabled`,`loader`])])],32))}})})),JLt,YLt=s((()=>{qLt(),JLt=KLt})),XLt,ZLt,QLt=s((()=>{W(),XLt=[`placeholder`],ZLt=N({name:`CommandActionInput`,inheritAttrs:!1,props:{modelValue:{},placeholder:{},autofocus:{type:Boolean,default:!0}},emits:[`update:modelValue`,`delete`],setup(e,{emit:t}){let n=t,r=A(null),i=U({get:()=>e.modelValue??``,set:e=>n(`update:modelValue`,e)});Hi(()=>{ar(()=>{e.autofocus&&r.value?.focus()})});let a=e=>{if(e.shiftKey||!e.target)return;e.preventDefault();let t=e.target,n=new Event(`submit`,{cancelable:!0});t.form?.dispatchEvent(n)},o=e=>{i.value===``&&(e.preventDefault(),e.stopPropagation(),n(`delete`,e))};return(t,n)=>lr((F(),I(`textarea`,ai({id:`command-action-input`,ref_key:`input`,ref:r,"onUpdate:modelValue":n[0]||=e=>i.value=e,class:`min-h-8 w-full flex-1 resize-none border border-transparent py-1.5 pl-8.5 text-sm outline-none focus:border-b-1`,placeholder:e.placeholder??``,wrap:`hard`},t.$attrs,{onKeydown:[mo(o,[`delete`]),mo(a,[`enter`])]}),null,16,XLt)),[[lo,i.value]])}})})),$Y,$Lt=s((()=>{QLt(),$Y=ZLt})),eRt,tRt,nRt,rRt,iRt=s((()=>{YLt(),$Lt(),W(),kE(),eRt={class:`flex min-h-8 items-start gap-2 text-sm`},tRt={class:`flex min-h-8 items-start gap-2 text-sm`},nRt={key:0,class:`text-red text-xs`,role:`alert`},rRt=N({__name:`OAuthScopesAddModal`,props:{state:{},scopes:{},scope:{default:null}},emits:[`cancel`,`submit`],setup(e,{emit:t}){let n=t,r=U(()=>e.scope!==null),i=U(()=>r.value?`Edit Scope`:`Add Scope`),a=U(()=>r.value?`Save`:`Add Scope`),o=A({name:``,description:``}),s=A(!1);mr(()=>o.value.name,()=>{s.value=!0});let c=U(()=>o.value.name.trim()),l=U(()=>!c.value||r.value&&c.value===e.scope?.name?!1:e.scopes.includes(c.value)),u=U(()=>l.value?`A scope named "${c.value}" already exists.`:s.value&&!c.value?`Scope name is required.`:null),d=U(()=>!c.value||l.value),f=()=>{d.value||(n(`submit`,{name:c.value,description:o.value.description,...r.value&&e.scope?{oldName:e.scope.name}:{}}),e.state.hide())};return mr(()=>e.state.open,t=>{t&&(o.value=e.scope?{name:e.scope.name,description:e.scope.description}:{name:``,description:``},ar(()=>{s.value=!1}))}),(t,r)=>(F(),L(j(rE),{bodyClass:`overflow-y-auto`,size:`xs`,state:e.state,title:i.value},{default:M(()=>[H(j(JLt),{disabled:d.value,onCancel:r[2]||=e=>n(`cancel`),onSubmit:f},{submit:M(()=>[z(k(a.value),1)]),default:M(()=>[R(`div`,eRt,[r[3]||=z(` Name: `,-1),H(j($Y),{modelValue:o.value.name,"onUpdate:modelValue":r[0]||=e=>o.value.name=e,autofocus:``,class:`field-sizing-content !p-0`,placeholder:`read:user`},null,8,[`modelValue`])]),R(`div`,tRt,[r[4]||=z(` Description: `,-1),H(j($Y),{modelValue:o.value.description,"onUpdate:modelValue":r[1]||=e=>o.value.description=e,autofocus:!1,class:`field-sizing-content !p-0`,placeholder:`Read user data`},null,8,[`modelValue`])]),u.value?(F(),I(`div`,nRt,k(u.value),1)):B(``,!0)]),_:1},8,[`disabled`])]),_:1},8,[`state`,`title`]))}})})),aRt,oRt=s((()=>{iRt(),aRt=rRt})),sRt,cRt,lRt,uRt,dRt,fRt,pRt,mRt,hRt=s((()=>{XJ(),kFt(),eY(),oRt(),W(),kE(),Ou(),Rc(),sRt={class:`flex h-fit w-full`},cRt={class:`group/scopes-accordion flex h-auto min-h-8 items-center gap-1.5 pr-2.25 pl-3 text-left`},lRt={class:`flex shrink-0 items-center gap-1.75`},uRt={class:`grid max-h-40 auto-rows-auto overflow-x-hidden overflow-y-auto`,style:{gridTemplateColumns:`1fr auto`}},dRt={class:`no-scrollbar text-c-2 group-hover/scope-row:text-c-1 flex min-h-8 min-w-0 flex-1 items-center gap-1 overflow-x-auto px-3 py-1.5 pr-20 text-xs text-nowrap`},fRt={class:`font-code shrink-0 text-xs`},pRt={class:`whitespace-nowrap`},mRt=N({__name:`OAuthScopesInput`,props:{flowType:{},flow:{},selectedScopes:{}},emits:[`update:selectedScopes`,`upsert:scope`,`delete:scope`],setup(e,{emit:t}){let n=t,r=A(``),i=A(null),a=U(()=>Object.entries(e.flow?.scopes??{}).map(([e,t])=>({id:e,label:e,description:t}))),o=U(()=>Object.keys(e.flow?.scopes??{}).length),s=U(()=>o.value>=10),c=U(()=>{let e=s.value?r.value:``;if(!e)return a.value;let t=new RegExp(e.split(``).map(e=>e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)).join(`.*`),`i`);return a.value.filter(({label:e,description:n})=>t.test(`${e} ${n}`))}),l=U(()=>Object.keys(e.flow?.scopes??{}).length>0),u=U(()=>e.selectedScopes.length===Object.keys(e.flow?.scopes??{}).length),d=(t,r)=>{if(r)return n(`update:selectedScopes`,{scopes:Array.from(new Set([...e.selectedScopes,t]))});n(`update:selectedScopes`,{scopes:e.selectedScopes.filter(e=>e!==t)})},f=()=>n(`update:selectedScopes`,{scopes:Object.keys(e.flow?.scopes??{})}),p=()=>n(`update:selectedScopes`,{scopes:[]}),m=nE(),h=A(0),g=A(!1);mr(l,(e,t)=>{t&&!e&&(g.value=!1,h.value+=1)});let _=()=>{i.value=null,m.show()},v=e=>{i.value={name:e.id,description:e.description??``},m.show()},y=async t=>{let r=!t.oldName;n(`upsert:scope`,{scope:t.name,description:t.description,flowType:e.flowType,...t.oldName?{oldScope:t.oldName}:{},...r?{enable:!0}:{}}),r&&(g.value=!0,h.value+=1,await ar(),g.value=!1)},b=t=>{n(`delete:scope`,{scope:t,flowType:e.flowType})};return(t,n)=>(F(),L(j(YJ),{class:`h-auto !max-h-[initial] min-h-8 items-center`},{default:M(()=>[R(`div`,sRt,[n[6]||=R(`div`,{class:`text-c-1 h-full items-center`},null,-1),(F(),L(j(ac),{key:h.value,as:`div`,class:`bl flex w-full flex-col`,defaultOpen:g.value},{default:M(()=>[R(`div`,cRt,[H(j(oc),{class:O([`min-w-0 flex-1 text-left`,l.value?`hover:text-c-1 cursor-pointer`:`cursor-default`,(e.selectedScopes.length||0)>0?`text-c-1`:`text-c-3`]),disabled:!l.value},{default:M(()=>[l.value?(F(),I(V,{key:0},[z(` Scopes Selected `+k(e.selectedScopes.length||0)+` / `+k(Object.keys(e.flow?.scopes??{}).length||0),1)],64)):(F(),I(V,{key:1},[z(` No Scopes Defined `)],64))]),_:1},8,[`class`,`disabled`]),R(`div`,lRt,[H(j(gf),{class:`pr-0.75 pl-1 transition-none`,size:`sm`,variant:`ghost`,onClick:po(_,[`stop`])},{default:M(()=>[...n[2]||=[z(` Add Scope `,-1)]]),_:1}),l.value&&u.value?(F(),L(j(gf),{key:0,class:`pr-0.75 pl-1 transition-none`,size:`sm`,variant:`ghost`,onClick:po(p,[`stop`])},{default:M(()=>[...n[3]||=[z(` Deselect All `,-1)]]),_:1})):B(``,!0),l.value&&!u.value?(F(),L(j(gf),{key:1,class:`pr-0.75 pl-1 transition-none`,size:`sm`,variant:`ghost`,onClick:po(f,[`stop`])},{default:M(()=>[...n[4]||=[z(` Select All `,-1)]]),_:1})):B(``,!0),l.value?(F(),L(j(oc),{key:2,class:`text-c-3 hover:text-c-2 -m-0.5 flex shrink-0 items-center justify-center rounded p-0.5 focus-visible:outline-offset-2`},{default:M(({open:e})=>[H(j(jT),{class:`group-hover/scopes-accordion:text-c-2`,icon:e?`ChevronDown`:`ChevronRight`,size:`md`},null,8,[`icon`])]),_:1})):B(``,!0)])]),H(j(sc),{as:`template`},{default:M(()=>[R(`div`,null,[s.value?(F(),L(j(aE),{key:0,modelValue:r.value,"onUpdate:modelValue":n[0]||=e=>r.value=e,class:`flex items-center text-xs`},null,8,[`modelValue`])):B(``,!0),R(`table`,uRt,[(F(!0),I(V,null,Ar(c.value,({id:t,label:r,description:i})=>(F(),L(j($J),{key:t,class:`text-c-2 group/scope-row`,onClick:n=>d(t,!e.selectedScopes.includes(t))},{default:M(()=>[H(j(YJ),{class:`box-border flex !max-h-[initial] w-full min-w-0 cursor-pointer items-stretch overflow-hidden px-0 py-0`},{default:M(()=>[R(`div`,dRt,[R(`span`,fRt,k(r),1),String(i??``).trim()?(F(),I(V,{key:0},[n[5]||=R(`span`,{class:`shrink-0`},`–`,-1),R(`span`,pRt,k(i),1)],64)):B(``,!0)]),R(`div`,{class:`oauth-scope-row-action-rail absolute top-0 right-0 z-[1] flex h-full min-w-[4.5rem] items-center justify-end gap-0.5 py-1 pr-2 pl-4 opacity-0 transition-opacity group-focus-within/scope-row:opacity-100 group-hover/scope-row:opacity-100`,onClick:n[1]||=po(()=>{},[`stop`])},[H(j(GT),{icon:j(yu),label:`Edit ${r}`,size:`sm`,onClick:po(e=>v({id:t,description:i??``}),[`stop`])},null,8,[`icon`,`label`,`onClick`]),H(j(GT),{icon:j(Tu),label:`Delete ${r}`,size:`sm`,onClick:po(e=>b(t),[`stop`])},null,8,[`icon`,`label`,`onClick`])])]),_:2},1024),H(j(nY),{modelValue:e.selectedScopes.includes(t),"onUpdate:modelValue":e=>d(t,e)},null,8,[`modelValue`,`onUpdate:modelValue`])]),_:2},1032,[`onClick`]))),128))])])]),_:1})]),_:1},8,[`defaultOpen`]))]),H(aRt,{scope:i.value,scopes:Object.keys(e.flow.scopes??{}),state:j(m),onSubmit:y},null,8,[`scope`,`scopes`,`state`])]),_:1}))}})})),gRt,_Rt=s((()=>{hRt(),gRt=mRt})),vRt,eX,yRt,bRt=s((()=>{vRt=e=>{let t=new URL(e);return{searchParams:t.searchParams,hashParams:new URLSearchParams(t.hash.slice(1))}},eX=(e,t,n)=>{let r=e.get(n);if(r!==null)return{params:e,value:r};let i=t.get(n);return i===null?{params:null,value:null}:{params:t,value:i}},yRt=(e,t=`access_token`)=>{try{let{searchParams:n,hashParams:r}=vRt(e()),i=eX(n,r,t),a=eX(n,r,`code`);return{accessToken:i.value,accessTokenParams:i.params,code:a.value,codeParams:a.params,error:n.get(`error`)??r.get(`error`),errorDescription:n.get(`error_description`)??r.get(`error_description`),refreshToken:n.get(`refresh_token`)??r.get(`refresh_token`)}}catch{return{accessToken:null,accessTokenParams:null,code:null,codeParams:null,error:null,errorDescription:null,refreshToken:null}}}})),tX,nX,rX,xRt,SRt,CRt,iX,wRt,TRt=s((()=>{bRt(),QI(),zhe(),AF(),lF(),Mu(),yF(),tX=(e,t)=>{if(e!==`authorizationCode`)return!1;let n=t;if(!n)return!1;let r=n[`x-usePkce`];return r===`SHA-256`||r===`plain`},nX=(e,t={})=>cF(sF(e?.url??``,mI(e)),t),rX=(e,t={})=>{let n=nX(e,t);return n?ju(n)?typeof window>`u`?{}:{basePath:n}:{baseUrl:n}:{}},xRt=()=>{let e=new Uint8Array(32);return crypto.getRandomValues(e),DF(e,!0)},SRt=async(e,t)=>{if(t===`plain`)return e;if(typeof crypto?.subtle?.digest!=`function`)return console.warn(`SHA-256 is only supported when using https, using a plain text code challenge instead.`),e;let n=new TextEncoder().encode(e),r=await crypto.subtle.digest(`SHA-256`,n);return DF(new Uint8Array(r),!0)},CRt=async(e,t,n,r,i,a={})=>{let o=e[t];try{if(!o)return[Error(`Flow not found`),null];let s=n.join(` `);if(t===`clientCredentials`||t===`password`)return iX(e,t,s,{proxyUrl:i},r,a);let c=(Math.random()+1).toString(36).substring(2,10),l=Lu(e[t][`x-scalar-secret-auth-url`]??e[t].authorizationUrl,rX(r,a)),u=new URL(l),d=null;if(t===`implicit`)u.searchParams.set(`response_type`,`token`);else if(t===`authorizationCode`){let n=e[t];if(u.searchParams.set(`response_type`,`code`),n[`x-usePkce`]!==`no`){let e=xRt(),t=await SRt(e,n[`x-usePkce`]);d={codeVerifier:e,codeChallenge:t,codeChallengeMethod:n[`x-usePkce`]===`SHA-256`?`S256`:`plain`},u.searchParams.set(`code_challenge`,t),u.searchParams.set(`code_challenge_method`,d.codeChallengeMethod)}}let f=e[t];if(f[`x-scalar-secret-redirect-uri`].startsWith(`/`)){let e=nX(r,a)||window.location.origin+window.location.pathname,t=new URL(f[`x-scalar-secret-redirect-uri`],e).toString();u.searchParams.set(`redirect_uri`,t)}else u.searchParams.set(`redirect_uri`,f[`x-scalar-secret-redirect-uri`]);o[`x-scalar-security-query`]&&Object.keys(o[`x-scalar-security-query`]).forEach(e=>{let t=o[`x-scalar-security-query`]?.[e];t&&u.searchParams.set(e,t)}),u.searchParams.set(`client_id`,o[`x-scalar-secret-client-id`]),u.searchParams.set(`state`,c),s&&u.searchParams.set(`scope`,s);let p=window.open(u,`openAuth2Window`,`left=100,top=100,width=800,height=600`);return p?new Promise(n=>{let l=setInterval(()=>{let{accessToken:u,accessTokenParams:f,code:m,codeParams:h,error:g,errorDescription:_,refreshToken:v}=yRt(()=>p.location.href,o[`x-tokenName`]||`access_token`);if(p.closed||u||m||g){if(clearInterval(l),p.close(),g){n([Error(`OAuth error: ${g}${_?` (${_})`:``}`),null]);return}if(u){(f?.get(`state`)??null)===c?n([null,{accessToken:u,...v?{refreshToken:v}:{}}]):n([Error(`State mismatch`),null]);return}if(m&&t===`authorizationCode`){(h?.get(`state`)??null)===c?iX(e,t,s,{code:m,pkce:d,proxyUrl:i},r,a).then(n).catch(e=>{n([e instanceof Error?e:Error(`Failed to get an access token`,{cause:e}),null])}):n([Error(`State mismatch`),null]);return}n([Error(`Window was closed without granting authorization`),null])}},200)}):[Error(`Failed to open auth window`),null]}catch(e){return[e instanceof Error?e:Error(`Failed to authorize oauth2 flow`,{cause:e}),null]}},iX=async(e,t,n,{code:r,pkce:i,proxyUrl:a}={},o,s={})=>{let c=e[t];if(!c)return[Error(`OAuth2 flow was not defined`),null];let l=new URLSearchParams;n&&(t===`clientCredentials`||t===`password`)&&l.set(`scope`,n);let u=c[`x-scalar-credentials-location`]===`body`,d=tX(t,c),f=!!c[`x-scalar-secret-client-secret`]&&!d;if((u||t===`authorizationCode`&&!f)&&l.set(`client_id`,c[`x-scalar-secret-client-id`]),u&&f&&l.set(`client_secret`,c[`x-scalar-secret-client-secret`]),`x-scalar-secret-redirect-uri`in c&&c[`x-scalar-secret-redirect-uri`]&&l.set(`redirect_uri`,c[`x-scalar-secret-redirect-uri`]),r)l.set(`code`,r),l.set(`grant_type`,`authorization_code`),i&&l.set(`code_verifier`,i.codeVerifier);else if(t===`password`){let n=e[t];l.set(`grant_type`,`password`),l.set(`username`,n[`x-scalar-secret-username`]),l.set(`password`,n[`x-scalar-secret-password`])}else l.set(`grant_type`,`client_credentials`);c[`x-scalar-security-body`]&&Object.entries(c[`x-scalar-security-body`]).forEach(([e,t])=>{t!=null&&l.set(e,String(t))});try{let e={"Content-Type":`application/x-www-form-urlencoded`};!u&&f&&(e.Authorization=`Basic ${kF(`${c[`x-scalar-secret-client-id`]}:${c[`x-scalar-secret-client-secret`]}`)}`);let t=Lu(c[`x-scalar-secret-token-url`]??c.tokenUrl,rX(o,s)),n=vF(a,t)?`${a}?${new URLSearchParams([[`scalar_url`,t]]).toString()}`:t,r=await(await fetch(n,{method:`POST`,headers:e,body:l})).json(),i=r[c[`x-tokenName`]||`access_token`],d=r.refresh_token;return i?[null,{accessToken:i,...typeof d==`string`?{refreshToken:d}:{}}]:[Error(r.error_description??r.error??`Failed to get an access token`),null]}catch(e){return[e instanceof Error?e:Error(`Failed to get an access token. Please check your credentials.`,{cause:e}),null]}},wRt=async(e,t,n,r,i={})=>{let a=e[t];if(!a)return[Error(`OAuth2 flow was not defined`),null];let o=a[`x-scalar-secret-refresh-token`];if(!o)return[Error(`No refresh token available`),null];let s=new URLSearchParams;s.set(`grant_type`,`refresh_token`),s.set(`refresh_token`,o);let c=a[`x-scalar-credentials-location`]===`body`,l=tX(t,a),u=!!a[`x-scalar-secret-client-secret`]&&!l;(c||t===`authorizationCode`&&!u)&&s.set(`client_id`,a[`x-scalar-secret-client-id`]),c&&u&&s.set(`client_secret`,a[`x-scalar-secret-client-secret`]),a[`x-scalar-security-body`]&&Object.entries(a[`x-scalar-security-body`]).forEach(([e,t])=>{t!=null&&s.set(e,String(t))});try{let e={"Content-Type":`application/x-www-form-urlencoded`};!c&&u&&(e.Authorization=`Basic ${kF(`${a[`x-scalar-secret-client-id`]}:${a[`x-scalar-secret-client-secret`]}`)}`);let t=Lu(a.refreshUrl||a[`x-scalar-secret-token-url`]||a.tokenUrl,rX(r,i)),l=vF(n,t)?`${n}?${new URLSearchParams([[`scalar_url`,t]]).toString()}`:t,d=await(await fetch(l,{method:`POST`,headers:e,body:s})).json(),f=d[a[`x-tokenName`]||`access_token`],p=d.refresh_token;return f?[null,{accessToken:f,...typeof p==`string`?{refreshToken:p}:{refreshToken:o}}]:[Error(d.error_description??d.error??`Token refresh failed`),null]}catch(e){return[e instanceof Error?e:Error(`Failed to refresh the access token. Please re-authorize.`,{cause:e}),null]}}})),ERt,DRt=s((()=>{ERt=e=>e.oauth2RedirectUri?e.oauth2RedirectUri:typeof window>`u`||window.location.protocol===`file:`?``:window.location.origin+window.location.pathname}));function ORt(e){if(!e||typeof document>`u`)return;function t(){let t=document.head||document.getElementsByTagName(`head`)[0];if(!t)return;let n=document.createElement(`style`);n.type=`text/css`,t.appendChild(n),n.styleSheet?n.styleSheet.cssText=e:n.appendChild(document.createTextNode(e))}document.readyState===`loading`?document.addEventListener(`DOMContentLoaded`,t):t()}function kRt(e,t){let n=t?.id||sX++;return cX.create({message:e,id:n,type:`default`,...t}),n}function aX(e){return e.label!==void 0}function ARt(){let e=A(!1);return pr(()=>{let t=()=>{e.value=document.hidden};return document.addEventListener(`visibilitychange`,t),()=>window.removeEventListener(`visibilitychange`,t)}),{isDocumentHidden:e}}function jRt(e,t){return F(),I(`svg`,YRt,t[0]||=[R(`line`,{x1:`18`,y1:`6`,x2:`6`,y2:`18`},null,-1),R(`line`,{x1:`6`,y1:`6`,x2:`18`,y2:`18`},null,-1)])}function MRt(e,t){return F(),I(`svg`,tzt,t[0]||=[R(`path`,{"fill-rule":`evenodd`,d:`M10 18a8 8 0 100-16 8 8 0 000 16zm3.857-9.809a.75.75 0 00-1.214-.882l-3.483 4.79-1.88-1.88a.75.75 0 10-1.06 1.061l2.5 2.5a.75.75 0 001.137-.089l4-5.5z`,"clip-rule":`evenodd`},null,-1)])}function NRt(e,t){return F(),I(`svg`,izt,t[0]||=[R(`path`,{"fill-rule":`evenodd`,d:`M18 10a8 8 0 11-16 0 8 8 0 0116 0zm-7-4a1 1 0 11-2 0 1 1 0 012 0zM9 9a.75.75 0 000 1.5h.253a.25.25 0 01.244.304l-.459 2.066A1.75 1.75 0 0010.747 15H11a.75.75 0 000-1.5h-.253a.25.25 0 01-.244-.304l.459-2.066A1.75 1.75 0 009.253 9H9z`,"clip-rule":`evenodd`},null,-1)])}function PRt(e,t){return F(),I(`svg`,szt,t[0]||=[R(`path`,{"fill-rule":`evenodd`,d:`M9.401 3.003c1.155-2 4.043-2 5.197 0l7.355 12.748c1.154 2-.29 4.5-2.599 4.5H4.645c-2.309 0-3.752-2.5-2.598-4.5L9.4 3.003zM12 8.25a.75.75 0 01.75.75v3.75a.75.75 0 01-1.5 0V9a.75.75 0 01.75-.75zm0 8.25a.75.75 0 100-1.5.75.75 0 000 1.5z`,"clip-rule":`evenodd`},null,-1)])}function FRt(e,t){return F(),I(`svg`,uzt,t[0]||=[R(`path`,{"fill-rule":`evenodd`,d:`M18 10a8 8 0 11-16 0 8 8 0 0116 0zm-8-5a.75.75 0 01.75.75v4.5a.75.75 0 01-1.5 0v-4.5A.75.75 0 0110 5zm0 10a1 1 0 100-2 1 1 0 000 2z`,"clip-rule":`evenodd`},null,-1)])}function IRt(...e){return e.filter(Boolean).join(` `)}var LRt,RRt,oX,sX,zRt,cX,BRt,VRt,HRt,lX,URt,WRt,uX,GRt,KRt,qRt,dX,JRt,YRt,XRt,ZRt,QRt,$Rt,ezt,tzt,nzt,rzt,izt,azt,ozt,szt,czt,lzt,uzt,dzt,fzt,pzt,mzt,fX,hzt,gzt,_zt,vzt,yzt=s((()=>{W(),LRt=Object.defineProperty,RRt=(e,t,n)=>t in e?LRt(e,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[t]=n,oX=(e,t,n)=>RRt(e,typeof t==`symbol`?t:t+``,n),ORt(`:where([data-sonner-toaster][dir=ltr]),:where(html[dir=ltr]){--toast-icon-margin-start:-3px;--toast-icon-margin-end:4px;--toast-svg-margin-start:-1px;--toast-svg-margin-end:0px;--toast-button-margin-start:auto;--toast-button-margin-end:0;--toast-close-button-start:0;--toast-close-button-end:unset;--toast-close-button-transform:translate(-35%, -35%)}:where([data-sonner-toaster][dir=rtl]),:where(html[dir=rtl]){--toast-icon-margin-start:4px;--toast-icon-margin-end:-3px;--toast-svg-margin-start:0px;--toast-svg-margin-end:-1px;--toast-button-margin-start:0;--toast-button-margin-end:auto;--toast-close-button-start:unset;--toast-close-button-end:0;--toast-close-button-transform:translate(35%, -35%)}:where([data-sonner-toaster]){position:fixed;width:var(--width);font-family:ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji;--gray1:hsl(0, 0%, 99%);--gray2:hsl(0, 0%, 97.3%);--gray3:hsl(0, 0%, 95.1%);--gray4:hsl(0, 0%, 93%);--gray5:hsl(0, 0%, 90.9%);--gray6:hsl(0, 0%, 88.7%);--gray7:hsl(0, 0%, 85.8%);--gray8:hsl(0, 0%, 78%);--gray9:hsl(0, 0%, 56.1%);--gray10:hsl(0, 0%, 52.3%);--gray11:hsl(0, 0%, 43.5%);--gray12:hsl(0, 0%, 9%);--border-radius:8px;box-sizing:border-box;padding:0;margin:0;list-style:none;outline:0;z-index:999999999;transition:transform .4s ease}:where([data-sonner-toaster][data-lifted=true]){transform:translateY(-10px)}@media (hover:none) and (pointer:coarse){:where([data-sonner-toaster][data-lifted=true]){transform:none}}:where([data-sonner-toaster][data-x-position=right]){right:max(var(--offset),env(safe-area-inset-right))}:where([data-sonner-toaster][data-x-position=left]){left:max(var(--offset),env(safe-area-inset-left))}:where([data-sonner-toaster][data-x-position=center]){left:50%;transform:translateX(-50%)}:where([data-sonner-toaster][data-y-position=top]){top:max(var(--offset),env(safe-area-inset-top))}:where([data-sonner-toaster][data-y-position=bottom]){bottom:max(var(--offset),env(safe-area-inset-bottom))}:where([data-sonner-toast]){--y:translateY(100%);--lift-amount:calc(var(--lift) * var(--gap));z-index:var(--z-index);position:absolute;opacity:0;transform:var(--y);filter:blur(0);touch-action:none;transition:transform .4s,opacity .4s,height .4s,box-shadow .2s;box-sizing:border-box;outline:0;overflow-wrap:anywhere}:where([data-sonner-toast][data-styled=true]){padding:16px;background:var(--normal-bg);border:1px solid var(--normal-border);color:var(--normal-text);border-radius:var(--border-radius);box-shadow:0 4px 12px rgba(0,0,0,.1);width:var(--width);font-size:13px;display:flex;align-items:center;gap:6px}:where([data-sonner-toast]:focus-visible){box-shadow:0 4px 12px rgba(0,0,0,.1),0 0 0 2px rgba(0,0,0,.2)}:where([data-sonner-toast][data-y-position=top]){top:0;--y:translateY(-100%);--lift:1;--lift-amount:calc(1 * var(--gap))}:where([data-sonner-toast][data-y-position=bottom]){bottom:0;--y:translateY(100%);--lift:-1;--lift-amount:calc(var(--lift) * var(--gap))}:where([data-sonner-toast]) :where([data-description]){font-weight:400;line-height:1.4;color:inherit}:where([data-sonner-toast]) :where([data-title]){font-weight:500;line-height:1.5;color:inherit}:where([data-sonner-toast]) :where([data-icon]){display:flex;height:16px;width:16px;position:relative;justify-content:flex-start;align-items:center;flex-shrink:0;margin-left:var(--toast-icon-margin-start);margin-right:var(--toast-icon-margin-end)}:where([data-sonner-toast][data-promise=true]) :where([data-icon])>svg{opacity:0;transform:scale(.8);transform-origin:center;animation:sonner-fade-in .3s ease forwards}:where([data-sonner-toast]) :where([data-icon])>*{flex-shrink:0}:where([data-sonner-toast]) :where([data-icon]) svg{margin-left:var(--toast-svg-margin-start);margin-right:var(--toast-svg-margin-end)}:where([data-sonner-toast]) :where([data-content]){display:flex;flex-direction:column;gap:2px}[data-sonner-toast][data-styled=true] [data-button]{border-radius:4px;padding-left:8px;padding-right:8px;height:24px;font-size:12px;color:var(--normal-bg);background:var(--normal-text);margin-left:var(--toast-button-margin-start);margin-right:var(--toast-button-margin-end);border:none;cursor:pointer;outline:0;display:flex;align-items:center;flex-shrink:0;transition:opacity .4s,box-shadow .2s}:where([data-sonner-toast]) :where([data-button]):focus-visible{box-shadow:0 0 0 2px rgba(0,0,0,.4)}:where([data-sonner-toast]) :where([data-button]):first-of-type{margin-left:var(--toast-button-margin-start);margin-right:var(--toast-button-margin-end)}:where([data-sonner-toast]) :where([data-cancel]){color:var(--normal-text);background:rgba(0,0,0,.08)}:where([data-sonner-toast][data-theme=dark]) :where([data-cancel]){background:rgba(255,255,255,.3)}[data-sonner-toast] [data-close-button]{position:absolute;left:var(--toast-close-button-start);right:var(--toast-close-button-end);top:0;height:20px;width:20px;display:flex;justify-content:center;align-items:center;padding:0;color:var(--gray12);border:1px solid var(--gray4);transform:var(--toast-close-button-transform);border-radius:50%;cursor:pointer;z-index:1;transition:opacity .1s,background .2s,border-color .2s}[data-sonner-toast] [data-close-button]{background:var(--gray1)}:where([data-sonner-toast]) :where([data-close-button]):focus-visible{box-shadow:0 4px 12px rgba(0,0,0,.1),0 0 0 2px rgba(0,0,0,.2)}:where([data-sonner-toast]) :where([data-disabled=true]){cursor:not-allowed}[data-sonner-toast]:hover [data-close-button]:hover{background:var(--gray2);border-color:var(--gray5)}:where([data-sonner-toast][data-swiping=true])::before{content:'';position:absolute;left:0;right:0;height:100%;z-index:-1}:where([data-sonner-toast][data-y-position=top][data-swiping=true])::before{bottom:50%;transform:scaleY(3) translateY(50%)}:where([data-sonner-toast][data-y-position=bottom][data-swiping=true])::before{top:50%;transform:scaleY(3) translateY(-50%)}:where([data-sonner-toast][data-swiping=false][data-removed=true])::before{content:'';position:absolute;inset:0;transform:scaleY(2)}:where([data-sonner-toast])::after{content:'';position:absolute;left:0;height:calc(var(--gap) + 1px);bottom:100%;width:100%}:where([data-sonner-toast][data-mounted=true]){--y:translateY(0);opacity:1}:where([data-sonner-toast][data-expanded=false][data-front=false]){--scale:var(--toasts-before) * 0.05 + 1;--y:translateY(calc(var(--lift-amount) * var(--toasts-before))) scale(calc(-1 * var(--scale)));height:var(--front-toast-height)}:where([data-sonner-toast])>*{transition:opacity .4s}:where([data-sonner-toast][data-expanded=false][data-front=false][data-styled=true])>*{opacity:0}:where([data-sonner-toast][data-visible=false]){opacity:0;pointer-events:none}:where([data-sonner-toast][data-mounted=true][data-expanded=true]){--y:translateY(calc(var(--lift) * var(--offset)));height:var(--initial-height)}:where([data-sonner-toast][data-removed=true][data-front=true][data-swipe-out=false]){--y:translateY(calc(var(--lift) * -100%));opacity:0}:where([data-sonner-toast][data-removed=true][data-front=false][data-swipe-out=false][data-expanded=true]){--y:translateY(calc(var(--lift) * var(--offset) + var(--lift) * -100%));opacity:0}:where([data-sonner-toast][data-removed=true][data-front=false][data-swipe-out=false][data-expanded=false]){--y:translateY(40%);opacity:0;transition:transform .5s,opacity .2s}:where([data-sonner-toast][data-removed=true][data-front=false])::before{height:calc(var(--initial-height) + 20%)}[data-sonner-toast][data-swiping=true]{transform:var(--y) translateY(var(--swipe-amount,0));transition:none}[data-sonner-toast][data-swiped=true]{user-select:none}[data-sonner-toast][data-swipe-out=true][data-y-position=bottom],[data-sonner-toast][data-swipe-out=true][data-y-position=top]{animation:swipe-out .2s ease-out forwards}@keyframes swipe-out{from{transform:translateY(calc(var(--lift) * var(--offset) + var(--swipe-amount)));opacity:1}to{transform:translateY(calc(var(--lift) * var(--offset) + var(--swipe-amount) + var(--lift) * -100%));opacity:0}}@media (max-width:600px){[data-sonner-toaster]{position:fixed;--mobile-offset:16px;right:var(--mobile-offset);left:var(--mobile-offset);width:100%}[data-sonner-toaster][dir=rtl]{left:calc(var(--mobile-offset) * -1)}[data-sonner-toaster] [data-sonner-toast]{left:0;right:0;width:calc(100% - var(--mobile-offset) * 2)}[data-sonner-toaster][data-x-position=left]{left:var(--mobile-offset)}[data-sonner-toaster][data-y-position=bottom]{bottom:20px}[data-sonner-toaster][data-y-position=top]{top:20px}[data-sonner-toaster][data-x-position=center]{left:var(--mobile-offset);right:var(--mobile-offset);transform:none}}[data-sonner-toaster][data-theme=light]{--normal-bg:#fff;--normal-border:var(--gray4);--normal-text:var(--gray12);--success-bg:hsl(143, 85%, 96%);--success-border:hsl(145, 92%, 91%);--success-text:hsl(140, 100%, 27%);--info-bg:hsl(208, 100%, 97%);--info-border:hsl(221, 91%, 91%);--info-text:hsl(210, 92%, 45%);--warning-bg:hsl(49, 100%, 97%);--warning-border:hsl(49, 91%, 91%);--warning-text:hsl(31, 92%, 45%);--error-bg:hsl(359, 100%, 97%);--error-border:hsl(359, 100%, 94%);--error-text:hsl(360, 100%, 45%)}[data-sonner-toaster][data-theme=light] [data-sonner-toast][data-invert=true]{--normal-bg:#000;--normal-border:hsl(0, 0%, 20%);--normal-text:var(--gray1)}[data-sonner-toaster][data-theme=dark] [data-sonner-toast][data-invert=true]{--normal-bg:#fff;--normal-border:var(--gray3);--normal-text:var(--gray12)}[data-sonner-toaster][data-theme=dark]{--normal-bg:#000;--normal-border:hsl(0, 0%, 20%);--normal-text:var(--gray1);--success-bg:hsl(150, 100%, 6%);--success-border:hsl(147, 100%, 12%);--success-text:hsl(150, 86%, 65%);--info-bg:hsl(215, 100%, 6%);--info-border:hsl(223, 100%, 12%);--info-text:hsl(216, 87%, 65%);--warning-bg:hsl(64, 100%, 6%);--warning-border:hsl(60, 100%, 12%);--warning-text:hsl(46, 87%, 65%);--error-bg:hsl(358, 76%, 10%);--error-border:hsl(357, 89%, 16%);--error-text:hsl(358, 100%, 81%)}[data-rich-colors=true][data-sonner-toast][data-type=success]{background:var(--success-bg);border-color:var(--success-border);color:var(--success-text)}[data-rich-colors=true][data-sonner-toast][data-type=success] [data-close-button]{background:var(--success-bg);border-color:var(--success-border);color:var(--success-text)}[data-rich-colors=true][data-sonner-toast][data-type=info]{background:var(--info-bg);border-color:var(--info-border);color:var(--info-text)}[data-rich-colors=true][data-sonner-toast][data-type=info] [data-close-button]{background:var(--info-bg);border-color:var(--info-border);color:var(--info-text)}[data-rich-colors=true][data-sonner-toast][data-type=warning]{background:var(--warning-bg);border-color:var(--warning-border);color:var(--warning-text)}[data-rich-colors=true][data-sonner-toast][data-type=warning] [data-close-button]{background:var(--warning-bg);border-color:var(--warning-border);color:var(--warning-text)}[data-rich-colors=true][data-sonner-toast][data-type=error]{background:var(--error-bg);border-color:var(--error-border);color:var(--error-text)}[data-rich-colors=true][data-sonner-toast][data-type=error] [data-close-button]{background:var(--error-bg);border-color:var(--error-border);color:var(--error-text)}.sonner-loading-wrapper{--size:16px;height:var(--size);width:var(--size);position:absolute;inset:0;z-index:10}.sonner-loading-wrapper[data-visible=false]{transform-origin:center;animation:sonner-fade-out .2s ease forwards}.sonner-spinner{position:relative;top:50%;left:50%;height:var(--size);width:var(--size)}.sonner-loading-bar{animation:sonner-spin 1.2s linear infinite;background:var(--gray11);border-radius:6px;height:8%;left:-10%;position:absolute;top:-3.9%;width:24%}.sonner-loading-bar:first-child{animation-delay:-1.2s;transform:rotate(.0001deg) translate(146%)}.sonner-loading-bar:nth-child(2){animation-delay:-1.1s;transform:rotate(30deg) translate(146%)}.sonner-loading-bar:nth-child(3){animation-delay:-1s;transform:rotate(60deg) translate(146%)}.sonner-loading-bar:nth-child(4){animation-delay:-.9s;transform:rotate(90deg) translate(146%)}.sonner-loading-bar:nth-child(5){animation-delay:-.8s;transform:rotate(120deg) translate(146%)}.sonner-loading-bar:nth-child(6){animation-delay:-.7s;transform:rotate(150deg) translate(146%)}.sonner-loading-bar:nth-child(7){animation-delay:-.6s;transform:rotate(180deg) translate(146%)}.sonner-loading-bar:nth-child(8){animation-delay:-.5s;transform:rotate(210deg) translate(146%)}.sonner-loading-bar:nth-child(9){animation-delay:-.4s;transform:rotate(240deg) translate(146%)}.sonner-loading-bar:nth-child(10){animation-delay:-.3s;transform:rotate(270deg) translate(146%)}.sonner-loading-bar:nth-child(11){animation-delay:-.2s;transform:rotate(300deg) translate(146%)}.sonner-loading-bar:nth-child(12){animation-delay:-.1s;transform:rotate(330deg) translate(146%)}@keyframes sonner-fade-in{0%{opacity:0;transform:scale(.8)}100%{opacity:1;transform:scale(1)}}@keyframes sonner-fade-out{0%{opacity:1;transform:scale(1)}100%{opacity:0;transform:scale(.8)}}@keyframes sonner-spin{0%{opacity:1}100%{opacity:.15}}@media (prefers-reduced-motion){.sonner-loading-bar,[data-sonner-toast],[data-sonner-toast]>*{transition:none!important;animation:none!important}}.sonner-loader{position:absolute;top:50%;left:50%;transform:translate(-50%,-50%);transform-origin:center;transition:opacity .2s,transform .2s}.sonner-loader[data-visible=false]{opacity:0;transform:scale(.8) translate(-50%,-50%)}`),sX=0,zRt=class{constructor(){oX(this,`subscribers`),oX(this,`toasts`),oX(this,`subscribe`,e=>(this.subscribers.push(e),()=>{let t=this.subscribers.indexOf(e);this.subscribers.splice(t,1)})),oX(this,`publish`,e=>{this.subscribers.forEach(t=>t(e))}),oX(this,`addToast`,e=>{this.publish(e),this.toasts=[...this.toasts,e]}),oX(this,`create`,e=>{let{message:t,...n}=e,r=typeof e.id==`number`||e.id&&e.id?.length>0?e.id:sX++,i=this.toasts.find(e=>e.id===r),a=e.dismissible===void 0?!0:e.dismissible;return i?this.toasts=this.toasts.map(n=>n.id===r?(this.publish({...n,...e,id:r,title:t}),{...n,...e,id:r,dismissible:a,title:t}):n):this.addToast({title:t,...n,dismissible:a,id:r}),r}),oX(this,`dismiss`,e=>(e||this.toasts.forEach(e=>{this.subscribers.forEach(t=>t({id:e.id,dismiss:!0}))}),this.subscribers.forEach(t=>t({id:e,dismiss:!0})),e)),oX(this,`message`,(e,t)=>this.create({...t,message:e,type:`default`})),oX(this,`error`,(e,t)=>this.create({...t,type:`error`,message:e})),oX(this,`success`,(e,t)=>this.create({...t,type:`success`,message:e})),oX(this,`info`,(e,t)=>this.create({...t,type:`info`,message:e})),oX(this,`warning`,(e,t)=>this.create({...t,type:`warning`,message:e})),oX(this,`loading`,(e,t)=>this.create({...t,type:`loading`,message:e})),oX(this,`promise`,(e,t)=>{if(!t)return;let n;t.loading!==void 0&&(n=this.create({...t,promise:e,type:`loading`,message:t.loading,description:typeof t.description==`function`?void 0:t.description}));let r=e instanceof Promise?e:e(),i=n!==void 0,a,o=r.then(async e=>{if(a=[`resolve`,e],BRt(e)&&!e.ok){i=!1;let r=typeof t.error==`function`?await t.error(`HTTP error! status: ${e.status}`):t.error,a=typeof t.description==`function`?await t.description(`HTTP error! status: ${e.status}`):t.description;this.create({id:n,type:`error`,message:r,description:a})}else if(t.success!==void 0){i=!1;let r=typeof t.success==`function`?await t.success(e):t.success,a=typeof t.description==`function`?await t.description(e):t.description;this.create({id:n,type:`success`,message:r,description:a})}}).catch(async e=>{if(a=[`reject`,e],t.error!==void 0){i=!1;let r=typeof t.error==`function`?await t.error(e):t.error,a=typeof t.description==`function`?await t.description(e):t.description;this.create({id:n,type:`error`,message:r,description:a})}}).finally(()=>{var e;i&&(this.dismiss(n),n=void 0),(e=t.finally)==null||e.call(t)}),s=()=>new Promise((e,t)=>o.then(()=>a[0]===`reject`?t(a[1]):e(a[1])).catch(t));return typeof n!=`string`&&typeof n!=`number`?{unwrap:s}:Object.assign(n,{unwrap:s})}),oX(this,`custom`,(e,t)=>{let n=t?.id||sX++;return this.publish({component:e,id:n,...t}),n}),this.subscribers=[],this.toasts=[]}},cX=new zRt,BRt=e=>e&&typeof e==`object`&&`ok`in e&&typeof e.ok==`boolean`&&`status`in e&&typeof e.status==`number`,VRt=kRt,HRt=()=>cX.toasts,lX=Object.assign(VRt,{success:cX.success,info:cX.info,warning:cX.warning,error:cX.error,custom:cX.custom,message:cX.message,promise:cX.promise,dismiss:cX.dismiss,loading:cX.loading},{getHistory:HRt}),URt=[`aria-live`,`data-rich-colors`,`data-styled`,`data-mounted`,`data-promise`,`data-removed`,`data-visible`,`data-y-position`,`data-x-position`,`data-index`,`data-front`,`data-swiping`,`data-dismissible`,`data-type`,`data-invert`,`data-swipe-out`,`data-expanded`],WRt=[`aria-label`,`data-disabled`],uX=4e3,GRt=20,KRt=200,qRt=N({__name:`Toast`,props:{toast:{},toasts:{},index:{},expanded:{type:Boolean},invert:{type:Boolean},heights:{},gap:{},position:{},visibleToasts:{},expandByDefault:{type:Boolean},closeButton:{type:Boolean},interacting:{type:Boolean},style:{},cancelButtonStyle:{},actionButtonStyle:{},duration:{},class:{},unstyled:{type:Boolean},descriptionClass:{},loadingIcon:{},classes:{},icons:{},closeButtonAriaLabel:{},pauseWhenPageIsHidden:{type:Boolean},cn:{type:Function},defaultRichColors:{type:Boolean}},emits:[`update:heights`,`removeToast`],setup(e,{emit:t}){let n=e,r=t,i=A(!1),a=A(!1),o=A(!1),s=A(!1),c=A(!1),l=A(0),u=A(0),d=A(n.toast.duration||n.duration||uX),f=A(null),p=A(null),m=U(()=>n.index===0),h=U(()=>n.index+1<=n.visibleToasts),g=U(()=>n.toast.type),_=U(()=>n.toast.dismissible!==!1),v=U(()=>n.toast.class||``),y=U(()=>n.descriptionClass||``),b=n.toast.style||{},x=U(()=>n.heights.findIndex(e=>e.toastId===n.toast.id)||0),S=U(()=>n.toast.closeButton??n.closeButton);U(()=>n.toast.duration||n.duration||uX);let C=A(0),w=A(0),ee=A(null),te=U(()=>n.position.split(`-`)),ne=U(()=>te.value[0]),re=U(()=>te.value[1]),T=U(()=>typeof n.toast.title!=`string`),ie=U(()=>typeof n.toast.description!=`string`),ae=U(()=>n.heights.reduce((e,t,n)=>n>=x.value?e:e+t.height,0)),E=ARt(),D=U(()=>n.toast.invert||n.invert),oe=U(()=>g.value===`loading`),se=U(()=>x.value*n.gap+ae.value||0);Hi(()=>{if(!i.value)return;let e=p.value,t=e?.style.height;e.style.height=`auto`;let a=e.getBoundingClientRect().height;e.style.height=t,u.value=a;let o;o=n.heights.find(e=>e.toastId===n.toast.id)?n.heights.map(e=>e.toastId===n.toast.id?{...e,height:a}:e):[{toastId:n.toast.id,height:a,position:n.toast.position},...n.heights],r(`update:heights`,o)});function ce(){a.value=!0,l.value=se.value,r(`update:heights`,n.heights.filter(e=>e.toastId!==n.toast.id)),setTimeout(()=>{r(`removeToast`,n.toast)},KRt)}function le(){var e,t;if(oe.value||!_.value)return{};ce(),(t=(e=n.toast).onDismiss)==null||t.call(e,n.toast)}function ue(e){oe.value||!_.value||(f.value=new Date,l.value=se.value,e.target.setPointerCapture(e.pointerId),e.target.tagName!==`BUTTON`&&(o.value=!0,ee.value={x:e.clientX,y:e.clientY}))}function de(){var e,t,r;if(s.value||!_)return;ee.value=null;let i=Number(p.value?.style.getPropertyValue(`--swipe-amount`).replace(`px`,``)||0),a=new Date().getTime()-f.value?.getTime(),u=Math.abs(i)/a;if(Math.abs(i)>=GRt||u>.11){l.value=se.value,(t=(e=n.toast).onDismiss)==null||t.call(e,n.toast),ce(),s.value=!0,c.value=!1;return}(r=p.value)==null||r.style.setProperty(`--swipe-amount`,`0px`),o.value=!1}function fe(e){var t;if(!ee.value||!_.value)return;let n=e.clientY-ee.value.y,r=window.getSelection()?.toString().length>0,i=ne.value===`top`?Math.min(0,n):Math.max(0,n);Math.abs(i)>0&&(c.value=!0),!r&&((t=p.value)==null||t.style.setProperty(`--swipe-amount`,`${i}px`))}return pr(e=>{if(n.toast.promise&&g.value===`loading`||n.toast.duration===1/0||n.toast.type===`loading`)return;let t;n.expanded||n.interacting||n.pauseWhenPageIsHidden&&E?(()=>{if(w.value<C.value){let e=new Date().getTime()-C.value;d.value-=e}w.value=new Date().getTime()})():d.value!==1/0&&(C.value=new Date().getTime(),t=setTimeout(()=>{var e,t;(t=(e=n.toast).onAutoClose)==null||t.call(e,n.toast),ce()},d.value)),e(()=>{clearTimeout(t)})}),mr(()=>n.toast.delete,()=>{n.toast.delete&&ce()},{deep:!0}),Hi(()=>{if(i.value=!0,p.value){let e=p.value.getBoundingClientRect().height;u.value=e,r(`update:heights`,[{toastId:n.toast.id,height:e,position:n.toast.position},...n.heights])}}),Wi(()=>{p.value&&r(`update:heights`,n.heights.filter(e=>e.toastId!==n.toast.id))}),(e,t)=>{var r,c;return F(),I(`li`,{ref_key:`toastRef`,ref:p,"aria-live":e.toast.important?`assertive`:`polite`,"aria-atomic":`true`,role:`status`,tabindex:`0`,"data-sonner-toast":`true`,class:O(e.cn(n.class,v.value,e.classes?.toast,e.toast.classes?.toast,e.classes?.[g.value],e.toast?.classes?.[g.value])),"data-rich-colors":e.toast.richColors??e.defaultRichColors,"data-styled":!(e.toast.component||(r=e.toast)!=null&&r.unstyled||e.unstyled),"data-mounted":i.value,"data-promise":!!e.toast.promise,"data-removed":a.value,"data-visible":h.value,"data-y-position":ne.value,"data-x-position":re.value,"data-index":e.index,"data-front":m.value,"data-swiping":o.value,"data-dismissible":_.value,"data-type":g.value,"data-invert":D.value,"data-swipe-out":s.value,"data-expanded":!!(e.expanded||e.expandByDefault&&i.value),style:it({"--index":e.index,"--toasts-before":e.index,"--z-index":e.toasts.length-e.index,"--offset":`${a.value?l.value:se.value}px`,"--initial-height":e.expandByDefault?`auto`:`${u.value}px`,...e.style,...j(b)}),onPointerdown:ue,onPointerup:de,onPointermove:fe},[S.value&&!e.toast.component?(F(),I(`button`,{key:0,"aria-label":e.closeButtonAriaLabel||`Close toast`,"data-disabled":oe.value,"data-close-button":`true`,class:O(e.cn(e.classes?.closeButton,e.toast?.classes?.closeButton)),onClick:le},[(c=e.icons)!=null&&c.close?(F(),L(kr(e.icons?.close),{key:0})):P(e.$slots,`close-icon`,{key:1})],10,WRt)):B(``,!0),e.toast.component?(F(),L(kr(e.toast.component),ai({key:1},e.toast.componentProps,{onCloseToast:le}),null,16)):(F(),I(V,{key:2},[g.value!==`default`||e.toast.icon||e.toast.promise?(F(),I(`div`,{key:0,"data-icon":``,class:O(e.cn(e.classes?.icon,e.toast?.classes?.icon))},[e.toast.icon?(F(),L(kr(e.toast.icon),{key:0})):(F(),I(V,{key:1},[g.value===`loading`?P(e.$slots,`loading-icon`,{key:0}):g.value===`success`?P(e.$slots,`success-icon`,{key:1}):g.value===`error`?P(e.$slots,`error-icon`,{key:2}):g.value===`warning`?P(e.$slots,`warning-icon`,{key:3}):g.value===`info`?P(e.$slots,`info-icon`,{key:4}):B(``,!0)],64))],2)):B(``,!0),R(`div`,{"data-content":``,class:O(e.cn(e.classes?.content,e.toast?.classes?.content))},[R(`div`,{"data-title":``,class:O(e.cn(e.classes?.title,e.toast.classes?.title))},[T.value?(F(),L(kr(e.toast.title),at(ai({key:0},e.toast.componentProps)),null,16)):(F(),I(V,{key:1},[z(k(e.toast.title),1)],64))],2),e.toast.description?(F(),I(`div`,{key:0,"data-description":``,class:O(e.cn(e.descriptionClass,y.value,e.classes?.description,e.toast.classes?.description))},[ie.value?(F(),L(kr(e.toast.description),at(ai({key:0},e.toast.componentProps)),null,16)):(F(),I(V,{key:1},[z(k(e.toast.description),1)],64))],2)):B(``,!0)],2),e.toast.cancel?(F(),I(`button`,{key:1,style:it(e.toast.cancelButtonStyle||e.cancelButtonStyle),class:O(e.cn(e.classes?.cancelButton,e.toast.classes?.cancelButton)),"data-button":``,"data-cancel":``,onClick:t[0]||=t=>{var n,r;j(aX)(e.toast.cancel)&&_.value&&((r=(n=e.toast.cancel).onClick)==null||r.call(n,t),ce())}},k(j(aX)(e.toast.cancel)?e.toast.cancel?.label:e.toast.cancel),7)):B(``,!0),e.toast.action?(F(),I(`button`,{key:2,style:it(e.toast.actionButtonStyle||e.actionButtonStyle),class:O(e.cn(e.classes?.actionButton,e.toast.classes?.actionButton)),"data-button":``,"data-action":``,onClick:t[1]||=t=>{var n,r;j(aX)(e.toast.action)&&(t.defaultPrevented||((r=(n=e.toast.action).onClick)==null||r.call(n,t),!t.defaultPrevented&&ce()))}},k(j(aX)(e.toast.action)?e.toast.action?.label:e.toast.action),7)):B(``,!0)],64))],46,URt)}}}),dX=(e,t)=>{let n=e.__vccOpts||e;for(let[e,r]of t)n[e]=r;return n},JRt={},YRt={xmlns:`http://www.w3.org/2000/svg`,width:`12`,height:`12`,viewBox:`0 0 24 24`,fill:`none`,stroke:`currentColor`,"stoke-width":`1.5`,"stroke-linecap":`round`,"stroke-linejoin":`round`},XRt=dX(JRt,[[`render`,jRt]]),ZRt=[`data-visible`],QRt={class:`sonner-spinner`},$Rt=N({__name:`Loader`,props:{visible:{type:Boolean}},setup(e){let t=Array(12).fill(0);return(e,n)=>(F(),I(`div`,{class:`sonner-loading-wrapper`,"data-visible":e.visible},[R(`div`,QRt,[(F(!0),I(V,null,Ar(j(t),e=>(F(),I(`div`,{key:`spinner-bar-${e}`,class:`sonner-loading-bar`}))),128))])],8,ZRt))}}),ezt={},tzt={xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 20 20`,fill:`currentColor`,height:`20`,width:`20`},nzt=dX(ezt,[[`render`,MRt]]),rzt={},izt={xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 20 20`,fill:`currentColor`,height:`20`,width:`20`},azt=dX(rzt,[[`render`,NRt]]),ozt={},szt={xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 24 24`,fill:`currentColor`,height:`20`,width:`20`},czt=dX(ozt,[[`render`,PRt]]),lzt={},uzt={xmlns:`http://www.w3.org/2000/svg`,viewBox:`0 0 20 20`,fill:`currentColor`,height:`20`,width:`20`},dzt=dX(lzt,[[`render`,FRt]]),fzt=[`aria-label`],pzt=[`dir`,`data-theme`,`data-rich-colors`,`data-y-position`,`data-x-position`,`data-lifted`],mzt=3,fX=`32px`,hzt=356,gzt=14,_zt=typeof window<`u`&&typeof document<`u`,vzt=N({name:`Toaster`,inheritAttrs:!1,__name:`Toaster`,props:{invert:{type:Boolean,default:!1},theme:{default:`light`},position:{default:`bottom-right`},hotkey:{default:()=>[`altKey`,`KeyT`]},richColors:{type:Boolean,default:!1},expand:{type:Boolean,default:!1},duration:{},gap:{default:gzt},visibleToasts:{default:mzt},closeButton:{type:Boolean,default:!1},toastOptions:{default:()=>({})},class:{default:``},style:{default:()=>({})},offset:{default:fX},dir:{default:`auto`},icons:{},containerAriaLabel:{default:`Notifications`},pauseWhenPageIsHidden:{type:Boolean,default:!1},cn:{type:Function,default:IRt}},setup(e){let t=e;function n(){if(typeof window>`u`||typeof document>`u`)return`ltr`;let e=document.documentElement.getAttribute(`dir`);return e===`auto`||!e?window.getComputedStyle(document.documentElement).direction:e}let r=Fr(),i=A([]),a=U(()=>(e,t)=>i.value.filter(n=>!n.position&&t===0||n.position===e)),o=U(()=>{let e=i.value.filter(e=>e.position).map(e=>e.position);return e.length>0?Array.from(new Set([t.position].concat(e))):[t.position]}),s=A([]),c=A(!1),l=A(!1),u=A(t.theme===`system`?typeof window<`u`&&window.matchMedia&&window.matchMedia(`(prefers-color-scheme: dark)`).matches?`dark`:`light`:t.theme),d=A(null),f=A(null),p=A(!1),m=t.hotkey.join(`+`).replace(/Key/g,``).replace(/Digit/g,``);function h(e){var t;(t=i.value.find(t=>t.id===e.id))!=null&&t.delete||cX.dismiss(e.id),i.value=i.value.filter(({id:t})=>t!==e.id)}function g(e){var t,n;p.value&&!((n=(t=e.currentTarget)?.contains)!=null&&n.call(t,e.relatedTarget))&&(p.value=!1,f.value&&=(f.value.focus({preventScroll:!0}),null))}function _(e){e.target instanceof HTMLElement&&e.target.dataset.dismissible===`false`||p.value||(p.value=!0,f.value=e.relatedTarget)}function v(e){e.target&&e.target instanceof HTMLElement&&e.target.dataset.dismissible===`false`||(l.value=!0)}return pr(e=>{e(cX.subscribe(e=>{if(e.dismiss){i.value=i.value.map(t=>t.id===e.id?{...t,delete:!0}:t);return}ar(()=>{let t=i.value.findIndex(t=>t.id===e.id);t===-1?i.value=[e,...i.value]:i.value=[...i.value.slice(0,t),{...i.value[t],...e},...i.value.slice(t+1)]})}))}),mr(()=>t.theme,e=>{if(e!==`system`){u.value=e;return}if(e===`system`&&(window.matchMedia&&window.matchMedia(`(prefers-color-scheme: dark)`).matches?u.value=`dark`:u.value=`light`),typeof window>`u`)return;let t=window.matchMedia(`(prefers-color-scheme: dark)`);try{t.addEventListener(`change`,({matches:e})=>{e?u.value=`dark`:u.value=`light`})}catch{t.addListener(({matches:e})=>{try{e?u.value=`dark`:u.value=`light`}catch(e){console.error(e)}})}}),pr(()=>{d.value&&f.value&&(f.value.focus({preventScroll:!0}),f.value=null,p.value=!1)}),pr(()=>{i.value.length<=1&&(c.value=!1)}),pr(e=>{function n(e){let n=t.hotkey.every(t=>e[t]||e.code===t),r=Array.isArray(d.value)?d.value[0]:d.value;n&&(c.value=!0,r?.focus());let i=document.activeElement===d.value||r?.contains(document.activeElement);e.code===`Escape`&&i&&(c.value=!1)}_zt&&(document.addEventListener(`keydown`,n),e(()=>{document.removeEventListener(`keydown`,n)}))}),(e,u)=>(F(),I(`section`,{"aria-label":`${e.containerAriaLabel} ${j(m)}`,tabIndex:-1,"aria-live":`polite`,"aria-relevant":`additions text`,"aria-atomic":`false`},[(F(!0),I(V,null,Ar(o.value,(o,f)=>(F(),I(`ol`,ai({key:o,ref_for:!0,ref_key:`listRef`,ref:d,"data-sonner-toaster":``,class:t.class,dir:e.dir===`auto`?n():e.dir,tabIndex:-1,"data-theme":e.theme,"data-rich-colors":e.richColors,"data-y-position":o.split(`-`)[0],"data-x-position":o.split(`-`)[1],"data-lifted":c.value&&i.value.length>1&&!e.expand,style:{"--front-toast-height":`${s.value[0]?.height}px`,"--offset":typeof e.offset==`number`?`${e.offset}px`:e.offset||fX,"--width":`${hzt}px`,"--gap":`${e.gap}px`,...e.style,...j(r).style}},e.$attrs,{onBlur:g,onFocus:_,onMouseenter:u[1]||=()=>c.value=!0,onMousemove:u[2]||=()=>c.value=!0,onMouseleave:u[3]||=()=>{l.value||(c.value=!1)},onPointerdown:v,onPointerup:u[4]||=()=>l.value=!1}),[(F(!0),I(V,null,Ar(a.value(o,f),(t,n)=>(F(),L(qRt,{key:t.id,heights:s.value.filter(e=>e.position===t.position),icons:e.icons,index:n,toast:t,defaultRichColors:e.richColors,duration:e.toastOptions?.duration??e.duration,class:O(e.toastOptions?.class??``),descriptionClass:e.toastOptions?.descriptionClass,invert:e.invert,visibleToasts:e.visibleToasts,closeButton:e.toastOptions?.closeButton??e.closeButton,interacting:l.value,position:o,style:it(e.toastOptions?.style),unstyled:e.toastOptions?.unstyled,classes:e.toastOptions?.classes,cancelButtonStyle:e.toastOptions?.cancelButtonStyle,actionButtonStyle:e.toastOptions?.actionButtonStyle,toasts:i.value.filter(e=>e.position===t.position),expandByDefault:e.expand,gap:e.gap,expanded:c.value,pauseWhenPageIsHidden:e.pauseWhenPageIsHidden,cn:e.cn,"onUpdate:heights":u[0]||=e=>{s.value=e},onRemoveToast:h},{"close-icon":M(()=>[P(e.$slots,`close-icon`,{},()=>[H(XRt)])]),"loading-icon":M(()=>[P(e.$slots,`loading-icon`,{},()=>[H($Rt,{visible:t.type===`loading`},null,8,[`visible`])])]),"success-icon":M(()=>[P(e.$slots,`success-icon`,{},()=>[H(nzt)])]),"error-icon":M(()=>[P(e.$slots,`error-icon`,{},()=>[H(dzt)])]),"warning-icon":M(()=>[P(e.$slots,`warning-icon`,{},()=>[H(czt)])]),"info-icon":M(()=>[P(e.$slots,`info-icon`,{},()=>[H(azt)])]),_:2},1032,[`heights`,`icons`,`index`,`toast`,`defaultRichColors`,`duration`,`class`,`descriptionClass`,`invert`,`visibleToasts`,`closeButton`,`interacting`,`position`,`style`,`unstyled`,`classes`,`cancelButtonStyle`,`actionButtonStyle`,`toasts`,`expandByDefault`,`gap`,`expanded`,`pauseWhenPageIsHidden`,`cn`]))),128))],16,pzt))),128))],8,fzt))}})}));function bzt(e){mX.toast=e}function pX(){return{initializeToasts:bzt,toast:(e,t=`info`,n={timeout:3e3})=>{mX.toast(e,t,n)}}}var mX,hX,gX=s((()=>{W(),yzt(),(function(){try{if(typeof document<`u`){var e=document.createElement(`style`);e.appendChild(document.createTextNode(`/**
-* We need to be explicit to avoid !important. :)
-*
-* Original: https://github.com/xiaoluoboding/vue-sonner/blob/311ecc8d9a51b619f968e20f4b44992ad8412850/packages/styles.css#L91-L103
-*/
-.scalar-toaster [data-sonner-toast][data-styled='true'] {
-  background: var(--scalar-background-1);
-  color: var(--scalar-color-1);
-  padding: 18px;
-  border: none;
-  border-radius: var(--scalar-radius-lg);
-  font-size: var(--scalar-font-size-3);
-  font-weight: var(--scalar-font-medium);
-  box-shadow: var(--scalar-shadow-2);
-}
-.scalar-toaster [data-sonner-toast] [data-icon] {
-  align-self: flex-start;
-  position: relative;
-  top: 2px;
-}
-.scalar-toaster [data-sonner-toast][data-styled='true'][data-expanded='true'] {
-  height: auto;
-}
-.scalar-toaster [data-sonner-toast][data-type='error'] {
-  background: var(--scalar-background-1);
-}
-.scalar-toaster [data-sonner-toast][data-type='error'] [data-icon] {
-  color: color-mix(in srgb, var(--scalar-color-red) 75%, var(--scalar-color-1));
-}
-.scalar-toaster [data-sonner-toast][data-type='warning'] {
-  background: var(--scalar-background-1);
-}
-.scalar-toaster [data-sonner-toast][data-type='warning'] [data-icon] {
-  color: color-mix(
-    in srgb,
-    var(--scalar-color-orange) 90%,
-    var(--scalar-color-1)
-  );
-}
-/*$vite$:1*/`)),document.head.appendChild(e)}}catch(e){console.error(`vite-plugin-css-injected-by-js`,e)}})(),mX={toast:()=>null},hX=N({__name:`ScalarToasts`,setup(e){let t=A(!1);Hi(()=>t.value=!0);let n={success:lX.success,error:lX.error,warn:lX.warning,info:lX},{initializeToasts:r}=pX();return r((e,t=`info`,r={})=>{(n[t]||n.info)(e,{duration:r.timeout||3e3,description:r.description})}),(e,n)=>t.value?(F(),L(j(vzt),{key:0,class:`scalar-toaster`})):B(``,!0)}})}));function _X(e,t,n){function r(n,r){if(n._zod||Object.defineProperty(n,`_zod`,{value:{def:r,constr:o,traits:new Set},enumerable:!1}),n._zod.traits.has(e))return;n._zod.traits.add(e),t(n,r);let i=o.prototype,a=Object.keys(i);for(let e=0;e<a.length;e++){let t=a[e];t in n||(n[t]=i[t].bind(n))}}let i=n?.Parent??Object;class a extends i{}Object.defineProperty(a,`name`,{value:e});function o(e){var t;let i=n?.Parent?new a:this;r(i,e),(t=i._zod).deferred??(t.deferred=[]);for(let e of i._zod.deferred)e();return i}return Object.defineProperty(o,`init`,{value:r}),Object.defineProperty(o,Symbol.hasInstance,{value:t=>n?.Parent&&t instanceof n.Parent?!0:t?._zod?.traits?.has(e)}),Object.defineProperty(o,`name`,{value:e}),o}function vX(e){return e&&Object.assign(xX,e),xX}var yX,bX,xX,SX=s((()=>{Object.freeze({status:`aborted`}),yX=class extends Error{constructor(){super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`)}},bX=class extends Error{constructor(e){super(`Encountered unidirectional transform during encode: ${e}`),this.name=`ZodEncodeError`}},xX={}}));function xzt(e){let t=Object.values(e).filter(e=>typeof e==`number`);return Object.entries(e).filter(([e,n])=>t.indexOf(+e)===-1).map(([e,t])=>t)}function Szt(e,t=`|`){return e.map(e=>Dzt(e)).join(t)}function CX(e,t){return typeof t==`bigint`?t.toString():t}function wX(e){return{get value(){{let t=e();return Object.defineProperty(this,`value`,{value:t}),t}throw Error(`cached value already set`)}}}function TX(e){return e==null}function EX(e){let t=e.startsWith(`^`)?1:0,n=e.endsWith(`$`)?e.length-1:e.length;return e.slice(t,n)}function Czt(e,t){let n=(e.toString().split(`.`)[1]||``).length,r=t.toString(),i=(r.split(`.`)[1]||``).length;if(i===0&&/\d?e-\d?/.test(r)){let e=r.match(/\d?e-(\d?)/);e?.[1]&&(i=Number.parseInt(e[1]))}let a=n>i?n:i;return Number.parseInt(e.toFixed(a).replace(`.`,``))%Number.parseInt(t.toFixed(a).replace(`.`,``))/10**a}function DX(e,t,n){let r;Object.defineProperty(e,t,{get(){if(r!==VX)return r===void 0&&(r=VX,r=n()),r},set(n){Object.defineProperty(e,t,{value:n})},configurable:!0})}function OX(e,t,n){Object.defineProperty(e,t,{value:n,writable:!0,enumerable:!0,configurable:!0})}function kX(...e){let t={};for(let n of e){let e=Object.getOwnPropertyDescriptors(n);Object.assign(t,e)}return Object.defineProperties({},t)}function wzt(e){return JSON.stringify(e)}function Tzt(e){return e.toLowerCase().trim().replace(/[^\w\s-]/g,``).replace(/[\s_-]+/g,`-`).replace(/^-+|-+$/g,``)}function AX(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function jX(e){if(AX(e)===!1)return!1;let t=e.constructor;if(t===void 0||typeof t!=`function`)return!0;let n=t.prototype;return!(AX(n)===!1||Object.prototype.hasOwnProperty.call(n,`isPrototypeOf`)===!1)}function Ezt(e){return jX(e)?{...e}:Array.isArray(e)?[...e]:e}function MX(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}function NX(e,t,n){let r=new e._zod.constr(t??e._zod.def);return(!t||n?.parent)&&(r._zod.parent=e),r}function PX(e){let t=e;if(!t)return{};if(typeof t==`string`)return{error:()=>t};if(t?.message!==void 0){if(t?.error!==void 0)throw Error("Cannot specify both `message` and `error` params");t.error=t.message}return delete t.message,typeof t.error==`string`?{...t,error:()=>t.error}:t}function Dzt(e){return typeof e==`bigint`?e.toString()+`n`:typeof e==`string`?`"${e}"`:`${e}`}function Ozt(e){return Object.keys(e).filter(t=>e[t]._zod.optin===`optional`&&e[t]._zod.optout===`optional`)}function kzt(e,t){let n=e._zod.def,r=n.checks;if(r&&r.length>0)throw Error(`.pick() cannot be used on object schemas containing refinements`);return NX(e,kX(e._zod.def,{get shape(){let e={};for(let r in t){if(!(r in n.shape))throw Error(`Unrecognized key: "${r}"`);t[r]&&(e[r]=n.shape[r])}return OX(this,`shape`,e),e},checks:[]}))}function Azt(e,t){let n=e._zod.def,r=n.checks;if(r&&r.length>0)throw Error(`.omit() cannot be used on object schemas containing refinements`);return NX(e,kX(e._zod.def,{get shape(){let r={...e._zod.def.shape};for(let e in t){if(!(e in n.shape))throw Error(`Unrecognized key: "${e}"`);t[e]&&delete r[e]}return OX(this,`shape`,r),r},checks:[]}))}function jzt(e,t){if(!jX(t))throw Error(`Invalid input to extend: expected a plain object`);let n=e._zod.def.checks;if(n&&n.length>0){let n=e._zod.def.shape;for(let e in t)if(Object.getOwnPropertyDescriptor(n,e)!==void 0)throw Error("Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.")}return NX(e,kX(e._zod.def,{get shape(){let n={...e._zod.def.shape,...t};return OX(this,`shape`,n),n}}))}function Mzt(e,t){if(!jX(t))throw Error(`Invalid input to safeExtend: expected a plain object`);return NX(e,kX(e._zod.def,{get shape(){let n={...e._zod.def.shape,...t};return OX(this,`shape`,n),n}}))}function Nzt(e,t){return NX(e,kX(e._zod.def,{get shape(){let n={...e._zod.def.shape,...t._zod.def.shape};return OX(this,`shape`,n),n},get catchall(){return t._zod.def.catchall},checks:[]}))}function Pzt(e,t,n){let r=t._zod.def.checks;if(r&&r.length>0)throw Error(`.partial() cannot be used on object schemas containing refinements`);return NX(t,kX(t._zod.def,{get shape(){let r=t._zod.def.shape,i={...r};if(n)for(let t in n){if(!(t in r))throw Error(`Unrecognized key: "${t}"`);n[t]&&(i[t]=e?new e({type:`optional`,innerType:r[t]}):r[t])}else for(let t in r)i[t]=e?new e({type:`optional`,innerType:r[t]}):r[t];return OX(this,`shape`,i),i},checks:[]}))}function Fzt(e,t,n){return NX(t,kX(t._zod.def,{get shape(){let r=t._zod.def.shape,i={...r};if(n)for(let t in n){if(!(t in i))throw Error(`Unrecognized key: "${t}"`);n[t]&&(i[t]=new e({type:`nonoptional`,innerType:r[t]}))}else for(let t in r)i[t]=new e({type:`nonoptional`,innerType:r[t]});return OX(this,`shape`,i),i}}))}function FX(e,t=0){if(e.aborted===!0)return!0;for(let n=t;n<e.issues.length;n++)if(e.issues[n]?.continue!==!0)return!0;return!1}function IX(e,t){return t.map(t=>{var n;return(n=t).path??(n.path=[]),t.path.unshift(e),t})}function LX(e){return typeof e==`string`?e:e?.message}function RX(e,t,n){let r={...e,path:e.path??[]};return e.message||(r.message=LX(e.inst?._zod.def?.error?.(e))??LX(t?.error?.(e))??LX(n.customError?.(e))??LX(n.localeError?.(e))??`Invalid input`),delete r.inst,delete r.continue,t?.reportInput||delete r.input,r}function zX(e){return Array.isArray(e)?`array`:typeof e==`string`?`string`:`unknown`}function Izt(e){let t=typeof e;switch(t){case`number`:return Number.isNaN(e)?`nan`:`number`;case`object`:{if(e===null)return`null`;if(Array.isArray(e))return`array`;let t=e;if(t&&Object.getPrototypeOf(t)!==Object.prototype&&`constructor`in t&&t.constructor)return t.constructor.name}}return t}function BX(...e){let[t,n,r]=e;return typeof t==`string`?{message:t,code:`custom`,input:n,inst:r}:{...t}}var VX,HX,Lzt,Rzt,zzt,UX=s((()=>{VX=Symbol(`evaluating`),HX=`captureStackTrace`in Error?Error.captureStackTrace:(...e)=>{},Lzt=wX(()=>{if(typeof navigator<`u`&&navigator?.userAgent?.includes(`Cloudflare`))return!1;try{return Function(``),!0}catch{return!1}}),Rzt=new Set([`string`,`number`,`symbol`]),zzt={safeint:[-(2**53-1),2**53-1],int32:[-2147483648,2147483647],uint32:[0,4294967295],float32:[-34028234663852886e22,34028234663852886e22],float64:[-Number.MAX_VALUE,Number.MAX_VALUE]}}));function Bzt(e,t=e=>e.message){let n={},r=[];for(let i of e.issues)i.path.length>0?(n[i.path[0]]=n[i.path[0]]||[],n[i.path[0]].push(t(i))):r.push(t(i));return{formErrors:r,fieldErrors:n}}function Vzt(e,t=e=>e.message){let n={_errors:[]},r=e=>{for(let i of e.issues)if(i.code===`invalid_union`&&i.errors.length)i.errors.map(e=>r({issues:e}));else if(i.code===`invalid_key`)r({issues:i.issues});else if(i.code===`invalid_element`)r({issues:i.issues});else if(i.path.length===0)n._errors.push(t(i));else{let e=n,r=0;for(;r<i.path.length;){let n=i.path[r];r===i.path.length-1?(e[n]=e[n]||{_errors:[]},e[n]._errors.push(t(i))):e[n]=e[n]||{_errors:[]},e=e[n],r++}}};return r(e),n}var WX,GX,KX,Hzt=s((()=>{SX(),UX(),WX=(e,t)=>{e.name=`$ZodError`,Object.defineProperty(e,`_zod`,{value:e._zod,enumerable:!1}),Object.defineProperty(e,`issues`,{value:t,enumerable:!1}),e.message=JSON.stringify(t,CX,2),Object.defineProperty(e,`toString`,{value:()=>e.message,enumerable:!1})},GX=_X(`$ZodError`,WX),KX=_X(`$ZodError`,WX,{Parent:Error})})),qX,JX,YX,Uzt,XX,Wzt,ZX,QX,$X,eZ,tZ,nZ,rZ,iZ,Gzt=s((()=>{SX(),Hzt(),UX(),qX=e=>(t,n,r,i)=>{let a=r?Object.assign(r,{async:!1}):{async:!1},o=t._zod.run({value:n,issues:[]},a);if(o instanceof Promise)throw new yX;if(o.issues.length){let t=new(i?.Err??e)(o.issues.map(e=>RX(e,a,vX())));throw HX(t,i?.callee),t}return o.value},qX(KX),JX=e=>async(t,n,r,i)=>{let a=r?Object.assign(r,{async:!0}):{async:!0},o=t._zod.run({value:n,issues:[]},a);if(o instanceof Promise&&(o=await o),o.issues.length){let t=new(i?.Err??e)(o.issues.map(e=>RX(e,a,vX())));throw HX(t,i?.callee),t}return o.value},JX(KX),YX=e=>(t,n,r)=>{let i=r?{...r,async:!1}:{async:!1},a=t._zod.run({value:n,issues:[]},i);if(a instanceof Promise)throw new yX;return a.issues.length?{success:!1,error:new(e??GX)(a.issues.map(e=>RX(e,i,vX())))}:{success:!0,data:a.value}},Uzt=YX(KX),XX=e=>async(t,n,r)=>{let i=r?Object.assign(r,{async:!0}):{async:!0},a=t._zod.run({value:n,issues:[]},i);return a instanceof Promise&&(a=await a),a.issues.length?{success:!1,error:new e(a.issues.map(e=>RX(e,i,vX())))}:{success:!0,data:a.value}},Wzt=XX(KX),ZX=e=>(t,n,r)=>{let i=r?Object.assign(r,{direction:`backward`}):{direction:`backward`};return qX(e)(t,n,i)},ZX(KX),QX=e=>(t,n,r)=>qX(e)(t,n,r),QX(KX),$X=e=>async(t,n,r)=>{let i=r?Object.assign(r,{direction:`backward`}):{direction:`backward`};return JX(e)(t,n,i)},$X(KX),eZ=e=>async(t,n,r)=>JX(e)(t,n,r),eZ(KX),tZ=e=>(t,n,r)=>{let i=r?Object.assign(r,{direction:`backward`}):{direction:`backward`};return YX(e)(t,n,i)},tZ(KX),nZ=e=>(t,n,r)=>YX(e)(t,n,r),nZ(KX),rZ=e=>async(t,n,r)=>{let i=r?Object.assign(r,{direction:`backward`}):{direction:`backward`};return XX(e)(t,n,i)},rZ(KX),iZ=e=>async(t,n,r)=>XX(e)(t,n,r),iZ(KX)}));function Kzt(){return new RegExp(aBt,`u`)}function qzt(e){let t=`(?:[01]\\d|2[0-3]):[0-5]\\d`;return typeof e.precision==`number`?e.precision===-1?`${t}`:e.precision===0?`${t}:[0-5]\\d`:`${t}:[0-5]\\d\\.\\d{${e.precision}}`:`${t}(?::[0-5]\\d(?:\\.\\d+)?)?`}function Jzt(e){return RegExp(`^${qzt(e)}$`)}function Yzt(e){let t=qzt({precision:e.precision}),n=[`Z`];e.local&&n.push(``),e.offset&&n.push(`([+-](?:[01]\\d|2[0-3]):[0-5]\\d)`);let r=`${t}(?:${n.join(`|`)})`;return RegExp(`^${sZ}T(?:${r})$`)}var Xzt,Zzt,Qzt,$zt,eBt,tBt,nBt,rBt,aZ,iBt,aBt,oBt,sBt,cBt,lBt,uBt,oZ,dBt,sZ,fBt,pBt,mBt,cZ,hBt,gBt,_Bt,vBt,yBt=s((()=>{Xzt=/^[cC][^\s-]{8,}$/,Zzt=/^[0-9a-z]+$/,Qzt=/^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/,$zt=/^[0-9a-vA-V]{20}$/,eBt=/^[A-Za-z0-9]{27}$/,tBt=/^[a-zA-Z0-9_-]{21}$/,nBt=/^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/,rBt=/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/,aZ=e=>e?RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${e}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`):/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/,iBt=/^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/,aBt=`^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`,oBt=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,sBt=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/,cBt=/^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/,lBt=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,uBt=/^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/,oZ=/^[A-Za-z0-9_-]*$/,dBt=/^\+[1-9]\d{6,14}$/,sZ=`(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`,fBt=RegExp(`^${sZ}$`),pBt=e=>{let t=e?`[\\s\\S]{${e?.minimum??0},${e?.maximum??``}}`:`[\\s\\S]*`;return RegExp(`^${t}$`)},mBt=/^-?\d+$/,cZ=/^-?\d+(?:\.\d+)?$/,hBt=/^(?:true|false)$/i,gBt=/^null$/i,_Bt=/^[^A-Z]*$/,vBt=/^[^a-z]*$/})),lZ,uZ,dZ,fZ,bBt,xBt,SBt,CBt,wBt,pZ,TBt,EBt,DBt,OBt,kBt,ABt,jBt,mZ=s((()=>{SX(),yBt(),UX(),lZ=_X(`$ZodCheck`,(e,t)=>{var n;e._zod??={},e._zod.def=t,(n=e._zod).onattach??(n.onattach=[])}),uZ={number:`number`,bigint:`bigint`,object:`date`},dZ=_X(`$ZodCheckLessThan`,(e,t)=>{lZ.init(e,t);let n=uZ[typeof t.value];e._zod.onattach.push(e=>{let n=e._zod.bag,r=(t.inclusive?n.maximum:n.exclusiveMaximum)??1/0;t.value<r&&(t.inclusive?n.maximum=t.value:n.exclusiveMaximum=t.value)}),e._zod.check=r=>{(t.inclusive?r.value<=t.value:r.value<t.value)||r.issues.push({origin:n,code:`too_big`,maximum:typeof t.value==`object`?t.value.getTime():t.value,input:r.value,inclusive:t.inclusive,inst:e,continue:!t.abort})}}),fZ=_X(`$ZodCheckGreaterThan`,(e,t)=>{lZ.init(e,t);let n=uZ[typeof t.value];e._zod.onattach.push(e=>{let n=e._zod.bag,r=(t.inclusive?n.minimum:n.exclusiveMinimum)??-1/0;t.value>r&&(t.inclusive?n.minimum=t.value:n.exclusiveMinimum=t.value)}),e._zod.check=r=>{(t.inclusive?r.value>=t.value:r.value>t.value)||r.issues.push({origin:n,code:`too_small`,minimum:typeof t.value==`object`?t.value.getTime():t.value,input:r.value,inclusive:t.inclusive,inst:e,continue:!t.abort})}}),bBt=_X(`$ZodCheckMultipleOf`,(e,t)=>{lZ.init(e,t),e._zod.onattach.push(e=>{var n;(n=e._zod.bag).multipleOf??(n.multipleOf=t.value)}),e._zod.check=n=>{if(typeof n.value!=typeof t.value)throw Error(`Cannot mix number and bigint in multiple_of check.`);(typeof n.value==`bigint`?n.value%t.value===BigInt(0):Czt(n.value,t.value)===0)||n.issues.push({origin:typeof n.value,code:`not_multiple_of`,divisor:t.value,input:n.value,inst:e,continue:!t.abort})}}),xBt=_X(`$ZodCheckNumberFormat`,(e,t)=>{lZ.init(e,t),t.format=t.format||`float64`;let n=t.format?.includes(`int`),r=n?`int`:`number`,[i,a]=zzt[t.format];e._zod.onattach.push(e=>{let r=e._zod.bag;r.format=t.format,r.minimum=i,r.maximum=a,n&&(r.pattern=mBt)}),e._zod.check=o=>{let s=o.value;if(n){if(!Number.isInteger(s)){o.issues.push({expected:r,format:t.format,code:`invalid_type`,continue:!1,input:s,inst:e});return}if(!Number.isSafeInteger(s)){s>0?o.issues.push({input:s,code:`too_big`,maximum:2**53-1,note:`Integers must be within the safe integer range.`,inst:e,origin:r,inclusive:!0,continue:!t.abort}):o.issues.push({input:s,code:`too_small`,minimum:-(2**53-1),note:`Integers must be within the safe integer range.`,inst:e,origin:r,inclusive:!0,continue:!t.abort});return}}s<i&&o.issues.push({origin:`number`,input:s,code:`too_small`,minimum:i,inclusive:!0,inst:e,continue:!t.abort}),s>a&&o.issues.push({origin:`number`,input:s,code:`too_big`,maximum:a,inclusive:!0,inst:e,continue:!t.abort})}}),SBt=_X(`$ZodCheckMaxLength`,(e,t)=>{var n;lZ.init(e,t),(n=e._zod.def).when??(n.when=e=>{let t=e.value;return!TX(t)&&t.length!==void 0}),e._zod.onattach.push(e=>{let n=e._zod.bag.maximum??1/0;t.maximum<n&&(e._zod.bag.maximum=t.maximum)}),e._zod.check=n=>{let r=n.value;if(r.length<=t.maximum)return;let i=zX(r);n.issues.push({origin:i,code:`too_big`,maximum:t.maximum,inclusive:!0,input:r,inst:e,continue:!t.abort})}}),CBt=_X(`$ZodCheckMinLength`,(e,t)=>{var n;lZ.init(e,t),(n=e._zod.def).when??(n.when=e=>{let t=e.value;return!TX(t)&&t.length!==void 0}),e._zod.onattach.push(e=>{let n=e._zod.bag.minimum??-1/0;t.minimum>n&&(e._zod.bag.minimum=t.minimum)}),e._zod.check=n=>{let r=n.value;if(r.length>=t.minimum)return;let i=zX(r);n.issues.push({origin:i,code:`too_small`,minimum:t.minimum,inclusive:!0,input:r,inst:e,continue:!t.abort})}}),wBt=_X(`$ZodCheckLengthEquals`,(e,t)=>{var n;lZ.init(e,t),(n=e._zod.def).when??(n.when=e=>{let t=e.value;return!TX(t)&&t.length!==void 0}),e._zod.onattach.push(e=>{let n=e._zod.bag;n.minimum=t.length,n.maximum=t.length,n.length=t.length}),e._zod.check=n=>{let r=n.value,i=r.length;if(i===t.length)return;let a=zX(r),o=i>t.length;n.issues.push({origin:a,...o?{code:`too_big`,maximum:t.length}:{code:`too_small`,minimum:t.length},inclusive:!0,exact:!0,input:n.value,inst:e,continue:!t.abort})}}),pZ=_X(`$ZodCheckStringFormat`,(e,t)=>{var n,r;lZ.init(e,t),e._zod.onattach.push(e=>{let n=e._zod.bag;n.format=t.format,t.pattern&&(n.patterns??=new Set,n.patterns.add(t.pattern))}),t.pattern?(n=e._zod).check??(n.check=n=>{t.pattern.lastIndex=0,!t.pattern.test(n.value)&&n.issues.push({origin:`string`,code:`invalid_format`,format:t.format,input:n.value,...t.pattern?{pattern:t.pattern.toString()}:{},inst:e,continue:!t.abort})}):(r=e._zod).check??(r.check=()=>{})}),TBt=_X(`$ZodCheckRegex`,(e,t)=>{pZ.init(e,t),e._zod.check=n=>{t.pattern.lastIndex=0,!t.pattern.test(n.value)&&n.issues.push({origin:`string`,code:`invalid_format`,format:`regex`,input:n.value,pattern:t.pattern.toString(),inst:e,continue:!t.abort})}}),EBt=_X(`$ZodCheckLowerCase`,(e,t)=>{t.pattern??=_Bt,pZ.init(e,t)}),DBt=_X(`$ZodCheckUpperCase`,(e,t)=>{t.pattern??=vBt,pZ.init(e,t)}),OBt=_X(`$ZodCheckIncludes`,(e,t)=>{lZ.init(e,t);let n=MX(t.includes),r=new RegExp(typeof t.position==`number`?`^.{${t.position}}${n}`:n);t.pattern=r,e._zod.onattach.push(e=>{let t=e._zod.bag;t.patterns??=new Set,t.patterns.add(r)}),e._zod.check=n=>{n.value.includes(t.includes,t.position)||n.issues.push({origin:`string`,code:`invalid_format`,format:`includes`,includes:t.includes,input:n.value,inst:e,continue:!t.abort})}}),kBt=_X(`$ZodCheckStartsWith`,(e,t)=>{lZ.init(e,t);let n=RegExp(`^${MX(t.prefix)}.*`);t.pattern??=n,e._zod.onattach.push(e=>{let t=e._zod.bag;t.patterns??=new Set,t.patterns.add(n)}),e._zod.check=n=>{n.value.startsWith(t.prefix)||n.issues.push({origin:`string`,code:`invalid_format`,format:`starts_with`,prefix:t.prefix,input:n.value,inst:e,continue:!t.abort})}}),ABt=_X(`$ZodCheckEndsWith`,(e,t)=>{lZ.init(e,t);let n=RegExp(`.*${MX(t.suffix)}$`);t.pattern??=n,e._zod.onattach.push(e=>{let t=e._zod.bag;t.patterns??=new Set,t.patterns.add(n)}),e._zod.check=n=>{n.value.endsWith(t.suffix)||n.issues.push({origin:`string`,code:`invalid_format`,format:`ends_with`,suffix:t.suffix,input:n.value,inst:e,continue:!t.abort})}}),jBt=_X(`$ZodCheckOverwrite`,(e,t)=>{lZ.init(e,t),e._zod.check=e=>{e.value=t.tx(e.value)}})})),MBt,NBt=s((()=>{MBt=class{constructor(e=[]){this.content=[],this.indent=0,this&&(this.args=e)}indented(e){this.indent+=1,e(this),--this.indent}write(e){if(typeof e==`function`){e(this,{execution:`sync`}),e(this,{execution:`async`});return}let t=e.split(`
-`).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let e=Function,t=this?.args,n=[...(this?.content??[``]).map(e=>`  ${e}`)];return new e(...t,n.join(`
-`))}}})),PBt,FBt=s((()=>{PBt={major:4,minor:3,patch:5}}));function IBt(e){if(e===``)return!0;if(e.length%4!=0)return!1;try{return atob(e),!0}catch{return!1}}function LBt(e){if(!oZ.test(e))return!1;let t=e.replace(/[-_]/g,e=>e===`-`?`+`:`/`);return IBt(t.padEnd(Math.ceil(t.length/4)*4,`=`))}function RBt(e,t=null){try{let n=e.split(`.`);if(n.length!==3)return!1;let[r]=n;if(!r)return!1;let i=JSON.parse(atob(r));return!(`typ`in i&&i?.typ!==`JWT`||!i.alg||t&&(!(`alg`in i)||i.alg!==t))}catch{return!1}}function zBt(e,t,n){e.issues.length&&t.issues.push(...IX(n,e.issues)),t.value[n]=e.value}function hZ(e,t,n,r,i){if(e.issues.length){if(i&&!(n in r))return;t.issues.push(...IX(n,e.issues))}e.value===void 0?n in r&&(t.value[n]=void 0):t.value[n]=e.value}function BBt(e){let t=Object.keys(e.shape);for(let n of t)if(!e.shape?.[n]?._zod?.traits?.has(`$ZodType`))throw Error(`Invalid element at key "${n}": expected a Zod schema`);let n=Ozt(e.shape);return{...e,keys:t,keySet:new Set(t),numKeys:t.length,optionalKeys:new Set(n)}}function VBt(e,t,n,r,i,a){let o=[],s=i.keySet,c=i.catchall._zod,l=c.def.type,u=c.optout===`optional`;for(let i in t){if(s.has(i))continue;if(l===`never`){o.push(i);continue}let a=c.run({value:t[i],issues:[]},r);a instanceof Promise?e.push(a.then(e=>hZ(e,n,i,t,u))):hZ(a,n,i,t,u)}return o.length&&n.issues.push({code:`unrecognized_keys`,keys:o,input:t,inst:a}),e.length?Promise.all(e).then(()=>n):n}function HBt(e,t,n,r){for(let n of e)if(n.issues.length===0)return t.value=n.value,t;let i=e.filter(e=>!FX(e));return i.length===1?(t.value=i[0].value,i[0]):(t.issues.push({code:`invalid_union`,input:t.value,inst:n,errors:e.map(e=>e.issues.map(e=>RX(e,r,vX())))}),t)}function gZ(e,t){if(e===t||e instanceof Date&&t instanceof Date&&+e==+t)return{valid:!0,data:e};if(jX(e)&&jX(t)){let n=Object.keys(t),r=Object.keys(e).filter(e=>n.indexOf(e)!==-1),i={...e,...t};for(let n of r){let r=gZ(e[n],t[n]);if(!r.valid)return{valid:!1,mergeErrorPath:[n,...r.mergeErrorPath]};i[n]=r.data}return{valid:!0,data:i}}if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return{valid:!1,mergeErrorPath:[]};let n=[];for(let r=0;r<e.length;r++){let i=e[r],a=t[r],o=gZ(i,a);if(!o.valid)return{valid:!1,mergeErrorPath:[r,...o.mergeErrorPath]};n.push(o.data)}return{valid:!0,data:n}}return{valid:!1,mergeErrorPath:[]}}function UBt(e,t,n){let r=new Map,i;for(let n of t.issues)if(n.code===`unrecognized_keys`){i??=n;for(let e of n.keys)r.has(e)||r.set(e,{}),r.get(e).l=!0}else e.issues.push(n);for(let t of n.issues)if(t.code===`unrecognized_keys`)for(let e of t.keys)r.has(e)||r.set(e,{}),r.get(e).r=!0;else e.issues.push(t);let a=[...r].filter(([,e])=>e.l&&e.r).map(([e])=>e);if(a.length&&i&&e.issues.push({...i,keys:a}),FX(e))return e;let o=gZ(t.value,n.value);if(!o.valid)throw Error(`Unmergable intersection. Error path: ${JSON.stringify(o.mergeErrorPath)}`);return e.value=o.data,e}function WBt(e,t){return e.issues.length&&t===void 0?{issues:[],value:void 0}:e}function GBt(e,t){return e.value===void 0&&(e.value=t.defaultValue),e}function KBt(e,t){return!e.issues.length&&e.value===void 0&&e.issues.push({code:`invalid_type`,expected:`nonoptional`,input:e.value,inst:t}),e}function _Z(e,t,n){return e.issues.length?(e.aborted=!0,e):t._zod.run({value:e.value,issues:e.issues},n)}function qBt(e){return e.value=Object.freeze(e.value),e}function JBt(e,t,n,r){if(!e){let e={code:`custom`,input:n,inst:r,path:[...r._zod.def.path??[]],continue:!r._zod.def.abort};r._zod.def.params&&(e.params=r._zod.def.params),t.issues.push(BX(e))}}var vZ,yZ,bZ,YBt,XBt,ZBt,QBt,$Bt,eVt,tVt,nVt,rVt,iVt,aVt,oVt,sVt,cVt,lVt,uVt,dVt,fVt,pVt,mVt,hVt,gVt,_Vt,xZ,vVt,yVt,bVt,xVt,SVt,CVt,wVt,TVt,SZ,EVt,DVt,OVt,kVt,AVt,jVt,CZ,MVt,NVt,PVt,FVt,IVt,LVt,RVt,zVt,BVt,VVt,HVt=s((()=>{mZ(),SX(),NBt(),Gzt(),yBt(),UX(),FBt(),vZ=_X(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=PBt;let r=[...e._zod.def.checks??[]];e._zod.traits.has(`$ZodCheck`)&&r.unshift(e);for(let t of r)for(let n of t._zod.onattach)n(e);if(r.length===0)(n=e._zod).deferred??(n.deferred=[]),e._zod.deferred?.push(()=>{e._zod.run=e._zod.parse});else{let t=(e,t,n)=>{let r=FX(e),i;for(let a of t){if(a._zod.def.when){if(!a._zod.def.when(e))continue}else if(r)continue;let t=e.issues.length,o=a._zod.check(e);if(o instanceof Promise&&n?.async===!1)throw new yX;if(i||o instanceof Promise)i=(i??Promise.resolve()).then(async()=>{await o,e.issues.length!==t&&(r||=FX(e,t))});else{if(e.issues.length===t)continue;r||=FX(e,t)}}return i?i.then(()=>e):e},n=(n,i,a)=>{if(FX(n))return n.aborted=!0,n;let o=t(i,r,a);if(o instanceof Promise){if(a.async===!1)throw new yX;return o.then(t=>e._zod.parse(t,a))}return e._zod.parse(o,a)};e._zod.run=(i,a)=>{if(a.skipChecks)return e._zod.parse(i,a);if(a.direction===`backward`){let t=e._zod.parse({value:i.value,issues:[]},{...a,skipChecks:!0});return t instanceof Promise?t.then(e=>n(e,i,a)):n(t,i,a)}let o=e._zod.parse(i,a);if(o instanceof Promise){if(a.async===!1)throw new yX;return o.then(e=>t(e,r,a))}return t(o,r,a)}}DX(e,`~standard`,()=>({validate:t=>{try{let n=Uzt(e,t);return n.success?{value:n.data}:{issues:n.error?.issues}}catch{return Wzt(e,t).then(e=>e.success?{value:e.data}:{issues:e.error?.issues})}},vendor:`zod`,version:1}))}),yZ=_X(`$ZodString`,(e,t)=>{vZ.init(e,t),e._zod.pattern=[...e?._zod.bag?.patterns??[]].pop()??pBt(e._zod.bag),e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=String(n.value)}catch{}return typeof n.value==`string`||n.issues.push({expected:`string`,code:`invalid_type`,input:n.value,inst:e}),n}}),bZ=_X(`$ZodStringFormat`,(e,t)=>{pZ.init(e,t),yZ.init(e,t)}),YBt=_X(`$ZodGUID`,(e,t)=>{t.pattern??=rBt,bZ.init(e,t)}),XBt=_X(`$ZodUUID`,(e,t)=>{if(t.version){let e={v1:1,v2:2,v3:3,v4:4,v5:5,v6:6,v7:7,v8:8}[t.version];if(e===void 0)throw Error(`Invalid UUID version: "${t.version}"`);t.pattern??=aZ(e)}else t.pattern??=aZ();bZ.init(e,t)}),ZBt=_X(`$ZodEmail`,(e,t)=>{t.pattern??=iBt,bZ.init(e,t)}),QBt=_X(`$ZodURL`,(e,t)=>{bZ.init(e,t),e._zod.check=n=>{try{let r=n.value.trim(),i=new URL(r);t.hostname&&(t.hostname.lastIndex=0,t.hostname.test(i.hostname)||n.issues.push({code:`invalid_format`,format:`url`,note:`Invalid hostname`,pattern:t.hostname.source,input:n.value,inst:e,continue:!t.abort})),t.protocol&&(t.protocol.lastIndex=0,t.protocol.test(i.protocol.endsWith(`:`)?i.protocol.slice(0,-1):i.protocol)||n.issues.push({code:`invalid_format`,format:`url`,note:`Invalid protocol`,pattern:t.protocol.source,input:n.value,inst:e,continue:!t.abort})),t.normalize?n.value=i.href:n.value=r;return}catch{n.issues.push({code:`invalid_format`,format:`url`,input:n.value,inst:e,continue:!t.abort})}}}),$Bt=_X(`$ZodEmoji`,(e,t)=>{t.pattern??=Kzt(),bZ.init(e,t)}),eVt=_X(`$ZodNanoID`,(e,t)=>{t.pattern??=tBt,bZ.init(e,t)}),tVt=_X(`$ZodCUID`,(e,t)=>{t.pattern??=Xzt,bZ.init(e,t)}),nVt=_X(`$ZodCUID2`,(e,t)=>{t.pattern??=Zzt,bZ.init(e,t)}),rVt=_X(`$ZodULID`,(e,t)=>{t.pattern??=Qzt,bZ.init(e,t)}),iVt=_X(`$ZodXID`,(e,t)=>{t.pattern??=$zt,bZ.init(e,t)}),aVt=_X(`$ZodKSUID`,(e,t)=>{t.pattern??=eBt,bZ.init(e,t)}),oVt=_X(`$ZodISODateTime`,(e,t)=>{t.pattern??=Yzt(t),bZ.init(e,t)}),sVt=_X(`$ZodISODate`,(e,t)=>{t.pattern??=fBt,bZ.init(e,t)}),cVt=_X(`$ZodISOTime`,(e,t)=>{t.pattern??=Jzt(t),bZ.init(e,t)}),lVt=_X(`$ZodISODuration`,(e,t)=>{t.pattern??=nBt,bZ.init(e,t)}),uVt=_X(`$ZodIPv4`,(e,t)=>{t.pattern??=oBt,bZ.init(e,t),e._zod.bag.format=`ipv4`}),dVt=_X(`$ZodIPv6`,(e,t)=>{t.pattern??=sBt,bZ.init(e,t),e._zod.bag.format=`ipv6`,e._zod.check=n=>{try{new URL(`http://[${n.value}]`)}catch{n.issues.push({code:`invalid_format`,format:`ipv6`,input:n.value,inst:e,continue:!t.abort})}}}),fVt=_X(`$ZodCIDRv4`,(e,t)=>{t.pattern??=cBt,bZ.init(e,t)}),pVt=_X(`$ZodCIDRv6`,(e,t)=>{t.pattern??=lBt,bZ.init(e,t),e._zod.check=n=>{let r=n.value.split(`/`);try{if(r.length!==2)throw Error();let[e,t]=r;if(!t)throw Error();let n=Number(t);if(`${n}`!==t||n<0||n>128)throw Error();new URL(`http://[${e}]`)}catch{n.issues.push({code:`invalid_format`,format:`cidrv6`,input:n.value,inst:e,continue:!t.abort})}}}),mVt=_X(`$ZodBase64`,(e,t)=>{t.pattern??=uBt,bZ.init(e,t),e._zod.bag.contentEncoding=`base64`,e._zod.check=n=>{IBt(n.value)||n.issues.push({code:`invalid_format`,format:`base64`,input:n.value,inst:e,continue:!t.abort})}}),hVt=_X(`$ZodBase64URL`,(e,t)=>{t.pattern??=oZ,bZ.init(e,t),e._zod.bag.contentEncoding=`base64url`,e._zod.check=n=>{LBt(n.value)||n.issues.push({code:`invalid_format`,format:`base64url`,input:n.value,inst:e,continue:!t.abort})}}),gVt=_X(`$ZodE164`,(e,t)=>{t.pattern??=dBt,bZ.init(e,t)}),_Vt=_X(`$ZodJWT`,(e,t)=>{bZ.init(e,t),e._zod.check=n=>{RBt(n.value,t.alg)||n.issues.push({code:`invalid_format`,format:`jwt`,input:n.value,inst:e,continue:!t.abort})}}),xZ=_X(`$ZodNumber`,(e,t)=>{vZ.init(e,t),e._zod.pattern=e._zod.bag.pattern??cZ,e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=Number(n.value)}catch{}let i=n.value;if(typeof i==`number`&&!Number.isNaN(i)&&Number.isFinite(i))return n;let a=typeof i==`number`?Number.isNaN(i)?`NaN`:Number.isFinite(i)?void 0:`Infinity`:void 0;return n.issues.push({expected:`number`,code:`invalid_type`,input:i,inst:e,...a?{received:a}:{}}),n}}),vVt=_X(`$ZodNumberFormat`,(e,t)=>{xBt.init(e,t),xZ.init(e,t)}),yVt=_X(`$ZodBoolean`,(e,t)=>{vZ.init(e,t),e._zod.pattern=hBt,e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=!!n.value}catch{}let i=n.value;return typeof i==`boolean`||n.issues.push({expected:`boolean`,code:`invalid_type`,input:i,inst:e}),n}}),bVt=_X(`$ZodNull`,(e,t)=>{vZ.init(e,t),e._zod.pattern=gBt,e._zod.values=new Set([null]),e._zod.parse=(t,n)=>{let r=t.value;return r===null||t.issues.push({expected:`null`,code:`invalid_type`,input:r,inst:e}),t}}),xVt=_X(`$ZodUnknown`,(e,t)=>{vZ.init(e,t),e._zod.parse=e=>e}),SVt=_X(`$ZodNever`,(e,t)=>{vZ.init(e,t),e._zod.parse=(t,n)=>(t.issues.push({expected:`never`,code:`invalid_type`,input:t.value,inst:e}),t)}),CVt=_X(`$ZodArray`,(e,t)=>{vZ.init(e,t),e._zod.parse=(n,r)=>{let i=n.value;if(!Array.isArray(i))return n.issues.push({expected:`array`,code:`invalid_type`,input:i,inst:e}),n;n.value=Array(i.length);let a=[];for(let e=0;e<i.length;e++){let o=i[e],s=t.element._zod.run({value:o,issues:[]},r);s instanceof Promise?a.push(s.then(t=>zBt(t,n,e))):zBt(s,n,e)}return a.length?Promise.all(a).then(()=>n):n}}),wVt=_X(`$ZodObject`,(e,t)=>{if(vZ.init(e,t),!Object.getOwnPropertyDescriptor(t,`shape`)?.get){let e=t.shape;Object.defineProperty(t,`shape`,{get:()=>{let n={...e};return Object.defineProperty(t,`shape`,{value:n}),n}})}let n=wX(()=>BBt(t));DX(e._zod,`propValues`,()=>{let e=t.shape,n={};for(let t in e){let r=e[t]._zod;if(r.values){n[t]??(n[t]=new Set);for(let e of r.values)n[t].add(e)}}return n});let r=AX,i=t.catchall,a;e._zod.parse=(t,o)=>{a??=n.value;let s=t.value;if(!r(s))return t.issues.push({expected:`object`,code:`invalid_type`,input:s,inst:e}),t;t.value={};let c=[],l=a.shape;for(let e of a.keys){let n=l[e],r=n._zod.optout===`optional`,i=n._zod.run({value:s[e],issues:[]},o);i instanceof Promise?c.push(i.then(n=>hZ(n,t,e,s,r))):hZ(i,t,e,s,r)}return i?VBt(c,s,t,o,n.value,e):c.length?Promise.all(c).then(()=>t):t}}),TVt=_X(`$ZodObjectJIT`,(e,t)=>{wVt.init(e,t);let n=e._zod.parse,r=wX(()=>BBt(t)),i=e=>{let t=new MBt([`shape`,`payload`,`ctx`]),n=r.value,i=e=>{let t=wzt(e);return`shape[${t}]._zod.run({ value: input[${t}], issues: [] }, ctx)`};t.write(`const input = payload.value;`);let a=Object.create(null),o=0;for(let e of n.keys)a[e]=`key_${o++}`;t.write(`const newResult = {};`);for(let r of n.keys){let n=a[r],o=wzt(r),s=e[r]?._zod?.optout===`optional`;t.write(`const ${n} = ${i(r)};`),s?t.write(`
-        if (${n}.issues.length) {
-          if (${o} in input) {
-            payload.issues = payload.issues.concat(${n}.issues.map(iss => ({
-              ...iss,
-              path: iss.path ? [${o}, ...iss.path] : [${o}]
-            })));
-          }
-        }
-        
-        if (${n}.value === undefined) {
-          if (${o} in input) {
-            newResult[${o}] = undefined;
-          }
-        } else {
-          newResult[${o}] = ${n}.value;
-        }
-        
-      `):t.write(`
-        if (${n}.issues.length) {
-          payload.issues = payload.issues.concat(${n}.issues.map(iss => ({
-            ...iss,
-            path: iss.path ? [${o}, ...iss.path] : [${o}]
-          })));
-        }
-        
-        if (${n}.value === undefined) {
-          if (${o} in input) {
-            newResult[${o}] = undefined;
-          }
-        } else {
-          newResult[${o}] = ${n}.value;
-        }
-        
-      `)}t.write(`payload.value = newResult;`),t.write(`return payload;`);let s=t.compile();return(t,n)=>s(e,t,n)},a,o=AX,s=!xX.jitless,c=s&&Lzt.value,l=t.catchall,u;e._zod.parse=(d,f)=>{u??=r.value;let p=d.value;return o(p)?s&&c&&f?.async===!1&&f.jitless!==!0?(a||=i(t.shape),d=a(d,f),l?VBt([],p,d,f,u,e):d):n(d,f):(d.issues.push({expected:`object`,code:`invalid_type`,input:p,inst:e}),d)}}),SZ=_X(`$ZodUnion`,(e,t)=>{vZ.init(e,t),DX(e._zod,`optin`,()=>t.options.some(e=>e._zod.optin===`optional`)?`optional`:void 0),DX(e._zod,`optout`,()=>t.options.some(e=>e._zod.optout===`optional`)?`optional`:void 0),DX(e._zod,`values`,()=>{if(t.options.every(e=>e._zod.values))return new Set(t.options.flatMap(e=>Array.from(e._zod.values)))}),DX(e._zod,`pattern`,()=>{if(t.options.every(e=>e._zod.pattern)){let e=t.options.map(e=>e._zod.pattern);return RegExp(`^(${e.map(e=>EX(e.source)).join(`|`)})$`)}});let n=t.options.length===1,r=t.options[0]._zod.run;e._zod.parse=(i,a)=>{if(n)return r(i,a);let o=!1,s=[];for(let e of t.options){let t=e._zod.run({value:i.value,issues:[]},a);if(t instanceof Promise)s.push(t),o=!0;else{if(t.issues.length===0)return t;s.push(t)}}return o?Promise.all(s).then(t=>HBt(t,i,e,a)):HBt(s,i,e,a)}}),EVt=_X(`$ZodDiscriminatedUnion`,(e,t)=>{t.inclusive=!1,SZ.init(e,t);let n=e._zod.parse;DX(e._zod,`propValues`,()=>{let e={};for(let n of t.options){let r=n._zod.propValues;if(!r||Object.keys(r).length===0)throw Error(`Invalid discriminated union option at index "${t.options.indexOf(n)}"`);for(let[t,n]of Object.entries(r)){e[t]||(e[t]=new Set);for(let r of n)e[t].add(r)}}return e});let r=wX(()=>{let e=t.options,n=new Map;for(let r of e){let e=r._zod.propValues?.[t.discriminator];if(!e||e.size===0)throw Error(`Invalid discriminated union option at index "${t.options.indexOf(r)}"`);for(let t of e){if(n.has(t))throw Error(`Duplicate discriminator value "${String(t)}"`);n.set(t,r)}}return n});e._zod.parse=(i,a)=>{let o=i.value;if(!AX(o))return i.issues.push({code:`invalid_type`,expected:`object`,input:o,inst:e}),i;let s=r.value.get(o?.[t.discriminator]);return s?s._zod.run(i,a):t.unionFallback?n(i,a):(i.issues.push({code:`invalid_union`,errors:[],note:`No matching discriminator`,discriminator:t.discriminator,input:o,path:[t.discriminator],inst:e}),i)}}),DVt=_X(`$ZodIntersection`,(e,t)=>{vZ.init(e,t),e._zod.parse=(e,n)=>{let r=e.value,i=t.left._zod.run({value:r,issues:[]},n),a=t.right._zod.run({value:r,issues:[]},n);return i instanceof Promise||a instanceof Promise?Promise.all([i,a]).then(([t,n])=>UBt(e,t,n)):UBt(e,i,a)}}),OVt=_X(`$ZodRecord`,(e,t)=>{vZ.init(e,t),e._zod.parse=(n,r)=>{let i=n.value;if(!jX(i))return n.issues.push({expected:`record`,code:`invalid_type`,input:i,inst:e}),n;let a=[],o=t.keyType._zod.values;if(o){n.value={};let s=new Set;for(let e of o)if(typeof e==`string`||typeof e==`number`||typeof e==`symbol`){s.add(typeof e==`number`?e.toString():e);let o=t.valueType._zod.run({value:i[e],issues:[]},r);o instanceof Promise?a.push(o.then(t=>{t.issues.length&&n.issues.push(...IX(e,t.issues)),n.value[e]=t.value})):(o.issues.length&&n.issues.push(...IX(e,o.issues)),n.value[e]=o.value)}let c;for(let e in i)s.has(e)||(c??=[],c.push(e));c&&c.length>0&&n.issues.push({code:`unrecognized_keys`,input:i,inst:e,keys:c})}else{n.value={};for(let o of Reflect.ownKeys(i)){if(o===`__proto__`)continue;let s=t.keyType._zod.run({value:o,issues:[]},r);if(s instanceof Promise)throw Error(`Async schemas not supported in object keys currently`);if(typeof o==`string`&&cZ.test(o)&&s.issues.length&&s.issues.some(e=>e.code===`invalid_type`&&e.expected===`number`)){let e=t.keyType._zod.run({value:Number(o),issues:[]},r);if(e instanceof Promise)throw Error(`Async schemas not supported in object keys currently`);e.issues.length===0&&(s=e)}if(s.issues.length){t.mode===`loose`?n.value[o]=i[o]:n.issues.push({code:`invalid_key`,origin:`record`,issues:s.issues.map(e=>RX(e,r,vX())),input:o,path:[o],inst:e});continue}let c=t.valueType._zod.run({value:i[o],issues:[]},r);c instanceof Promise?a.push(c.then(e=>{e.issues.length&&n.issues.push(...IX(o,e.issues)),n.value[s.value]=e.value})):(c.issues.length&&n.issues.push(...IX(o,c.issues)),n.value[s.value]=c.value)}}return a.length?Promise.all(a).then(()=>n):n}}),kVt=_X(`$ZodEnum`,(e,t)=>{vZ.init(e,t);let n=xzt(t.entries),r=new Set(n);e._zod.values=r,e._zod.pattern=RegExp(`^(${n.filter(e=>Rzt.has(typeof e)).map(e=>typeof e==`string`?MX(e):e.toString()).join(`|`)})$`),e._zod.parse=(t,i)=>{let a=t.value;return r.has(a)||t.issues.push({code:`invalid_value`,values:n,input:a,inst:e}),t}}),AVt=_X(`$ZodLiteral`,(e,t)=>{if(vZ.init(e,t),t.values.length===0)throw Error(`Cannot create literal schema with no valid values`);let n=new Set(t.values);e._zod.values=n,e._zod.pattern=RegExp(`^(${t.values.map(e=>typeof e==`string`?MX(e):e?MX(e.toString()):String(e)).join(`|`)})$`),e._zod.parse=(r,i)=>{let a=r.value;return n.has(a)||r.issues.push({code:`invalid_value`,values:t.values,input:a,inst:e}),r}}),jVt=_X(`$ZodTransform`,(e,t)=>{vZ.init(e,t),e._zod.parse=(n,r)=>{if(r.direction===`backward`)throw new bX(e.constructor.name);let i=t.transform(n.value,n);if(r.async)return(i instanceof Promise?i:Promise.resolve(i)).then(e=>(n.value=e,n));if(i instanceof Promise)throw new yX;return n.value=i,n}}),CZ=_X(`$ZodOptional`,(e,t)=>{vZ.init(e,t),e._zod.optin=`optional`,e._zod.optout=`optional`,DX(e._zod,`values`,()=>t.innerType._zod.values?new Set([...t.innerType._zod.values,void 0]):void 0),DX(e._zod,`pattern`,()=>{let e=t.innerType._zod.pattern;return e?RegExp(`^(${EX(e.source)})?$`):void 0}),e._zod.parse=(e,n)=>{if(t.innerType._zod.optin===`optional`){let r=t.innerType._zod.run(e,n);return r instanceof Promise?r.then(t=>WBt(t,e.value)):WBt(r,e.value)}return e.value===void 0?e:t.innerType._zod.run(e,n)}}),MVt=_X(`$ZodExactOptional`,(e,t)=>{CZ.init(e,t),DX(e._zod,`values`,()=>t.innerType._zod.values),DX(e._zod,`pattern`,()=>t.innerType._zod.pattern),e._zod.parse=(e,n)=>t.innerType._zod.run(e,n)}),NVt=_X(`$ZodNullable`,(e,t)=>{vZ.init(e,t),DX(e._zod,`optin`,()=>t.innerType._zod.optin),DX(e._zod,`optout`,()=>t.innerType._zod.optout),DX(e._zod,`pattern`,()=>{let e=t.innerType._zod.pattern;return e?RegExp(`^(${EX(e.source)}|null)$`):void 0}),DX(e._zod,`values`,()=>t.innerType._zod.values?new Set([...t.innerType._zod.values,null]):void 0),e._zod.parse=(e,n)=>e.value===null?e:t.innerType._zod.run(e,n)}),PVt=_X(`$ZodDefault`,(e,t)=>{vZ.init(e,t),e._zod.optin=`optional`,DX(e._zod,`values`,()=>t.innerType._zod.values),e._zod.parse=(e,n)=>{if(n.direction===`backward`)return t.innerType._zod.run(e,n);if(e.value===void 0)return e.value=t.defaultValue,e;let r=t.innerType._zod.run(e,n);return r instanceof Promise?r.then(e=>GBt(e,t)):GBt(r,t)}}),FVt=_X(`$ZodPrefault`,(e,t)=>{vZ.init(e,t),e._zod.optin=`optional`,DX(e._zod,`values`,()=>t.innerType._zod.values),e._zod.parse=(e,n)=>(n.direction===`backward`||e.value===void 0&&(e.value=t.defaultValue),t.innerType._zod.run(e,n))}),IVt=_X(`$ZodNonOptional`,(e,t)=>{vZ.init(e,t),DX(e._zod,`values`,()=>{let e=t.innerType._zod.values;return e?new Set([...e].filter(e=>e!==void 0)):void 0}),e._zod.parse=(n,r)=>{let i=t.innerType._zod.run(n,r);return i instanceof Promise?i.then(t=>KBt(t,e)):KBt(i,e)}}),LVt=_X(`$ZodCatch`,(e,t)=>{vZ.init(e,t),DX(e._zod,`optin`,()=>t.innerType._zod.optin),DX(e._zod,`optout`,()=>t.innerType._zod.optout),DX(e._zod,`values`,()=>t.innerType._zod.values),e._zod.parse=(e,n)=>{if(n.direction===`backward`)return t.innerType._zod.run(e,n);let r=t.innerType._zod.run(e,n);return r instanceof Promise?r.then(r=>(e.value=r.value,r.issues.length&&(e.value=t.catchValue({...e,error:{issues:r.issues.map(e=>RX(e,n,vX()))},input:e.value}),e.issues=[]),e)):(e.value=r.value,r.issues.length&&(e.value=t.catchValue({...e,error:{issues:r.issues.map(e=>RX(e,n,vX()))},input:e.value}),e.issues=[]),e)}}),RVt=_X(`$ZodPipe`,(e,t)=>{vZ.init(e,t),DX(e._zod,`values`,()=>t.in._zod.values),DX(e._zod,`optin`,()=>t.in._zod.optin),DX(e._zod,`optout`,()=>t.out._zod.optout),DX(e._zod,`propValues`,()=>t.in._zod.propValues),e._zod.parse=(e,n)=>{if(n.direction===`backward`){let r=t.out._zod.run(e,n);return r instanceof Promise?r.then(e=>_Z(e,t.in,n)):_Z(r,t.in,n)}let r=t.in._zod.run(e,n);return r instanceof Promise?r.then(e=>_Z(e,t.out,n)):_Z(r,t.out,n)}}),zVt=_X(`$ZodReadonly`,(e,t)=>{vZ.init(e,t),DX(e._zod,`propValues`,()=>t.innerType._zod.propValues),DX(e._zod,`values`,()=>t.innerType._zod.values),DX(e._zod,`optin`,()=>t.innerType?._zod?.optin),DX(e._zod,`optout`,()=>t.innerType?._zod?.optout),e._zod.parse=(e,n)=>{if(n.direction===`backward`)return t.innerType._zod.run(e,n);let r=t.innerType._zod.run(e,n);return r instanceof Promise?r.then(qBt):qBt(r)}}),BVt=_X(`$ZodLazy`,(e,t)=>{vZ.init(e,t),DX(e._zod,`innerType`,()=>t.getter()),DX(e._zod,`pattern`,()=>e._zod.innerType?._zod?.pattern),DX(e._zod,`propValues`,()=>e._zod.innerType?._zod?.propValues),DX(e._zod,`optin`,()=>e._zod.innerType?._zod?.optin??void 0),DX(e._zod,`optout`,()=>e._zod.innerType?._zod?.optout??void 0),e._zod.parse=(t,n)=>e._zod.innerType._zod.run(t,n)}),VVt=_X(`$ZodCustom`,(e,t)=>{lZ.init(e,t),vZ.init(e,t),e._zod.parse=(e,t)=>e,e._zod.check=n=>{let r=n.value,i=t.fn(r);if(i instanceof Promise)return i.then(t=>JBt(t,n,r,e));JBt(i,n,r,e)}})}));function UVt(){return{localeError:WVt()}}var WVt,GVt=s((()=>{UX(),WVt=()=>{let e={string:{unit:`characters`,verb:`to have`},file:{unit:`bytes`,verb:`to have`},array:{unit:`items`,verb:`to have`},set:{unit:`items`,verb:`to have`},map:{unit:`entries`,verb:`to have`}};function t(t){return e[t]??null}let n={regex:`input`,email:`email address`,url:`URL`,emoji:`emoji`,uuid:`UUID`,uuidv4:`UUIDv4`,uuidv6:`UUIDv6`,nanoid:`nanoid`,guid:`GUID`,cuid:`cuid`,cuid2:`cuid2`,ulid:`ULID`,xid:`XID`,ksuid:`KSUID`,datetime:`ISO datetime`,date:`ISO date`,time:`ISO time`,duration:`ISO duration`,ipv4:`IPv4 address`,ipv6:`IPv6 address`,mac:`MAC address`,cidrv4:`IPv4 range`,cidrv6:`IPv6 range`,base64:`base64-encoded string`,base64url:`base64url-encoded string`,json_string:`JSON string`,e164:`E.164 number`,jwt:`JWT`,template_literal:`input`},r={nan:`NaN`};return e=>{switch(e.code){case`invalid_type`:{let t=r[e.expected]??e.expected,n=Izt(e.input);return`Invalid input: expected ${t}, received ${r[n]??n}`}case`invalid_value`:return e.values.length===1?`Invalid input: expected ${Dzt(e.values[0])}`:`Invalid option: expected one of ${Szt(e.values,`|`)}`;case`too_big`:{let n=e.inclusive?`<=`:`<`,r=t(e.origin);return r?`Too big: expected ${e.origin??`value`} to have ${n}${e.maximum.toString()} ${r.unit??`elements`}`:`Too big: expected ${e.origin??`value`} to be ${n}${e.maximum.toString()}`}case`too_small`:{let n=e.inclusive?`>=`:`>`,r=t(e.origin);return r?`Too small: expected ${e.origin} to have ${n}${e.minimum.toString()} ${r.unit}`:`Too small: expected ${e.origin} to be ${n}${e.minimum.toString()}`}case`invalid_format`:{let t=e;return t.format===`starts_with`?`Invalid string: must start with "${t.prefix}"`:t.format===`ends_with`?`Invalid string: must end with "${t.suffix}"`:t.format===`includes`?`Invalid string: must include "${t.includes}"`:t.format===`regex`?`Invalid string: must match pattern ${t.pattern}`:`Invalid ${n[t.format]??e.format}`}case`not_multiple_of`:return`Invalid number: must be a multiple of ${e.divisor}`;case`unrecognized_keys`:return`Unrecognized key${e.keys.length>1?`s`:``}: ${Szt(e.keys,`, `)}`;case`invalid_key`:return`Invalid key in ${e.origin}`;case`invalid_union`:return`Invalid input`;case`invalid_element`:return`Invalid value in ${e.origin}`;default:return`Invalid input`}}}}));function KVt(){return new JVt}var qVt,JVt,wZ,TZ=s((()=>{JVt=class{constructor(){this._map=new WeakMap,this._idmap=new Map}add(e,...t){let n=t[0];return this._map.set(e,n),n&&typeof n==`object`&&`id`in n&&this._idmap.set(n.id,e),this}clear(){return this._map=new WeakMap,this._idmap=new Map,this}remove(e){let t=this._map.get(e);return t&&typeof t==`object`&&`id`in t&&this._idmap.delete(t.id),this._map.delete(e),this}get(e){let t=e._zod.parent;if(t){let n={...this.get(t)??{}};delete n.id;let r={...n,...this._map.get(e)};return Object.keys(r).length?r:void 0}return this._map.get(e)}has(e){return this._map.has(e)}},(qVt=globalThis).__zod_globalRegistry??(qVt.__zod_globalRegistry=KVt()),wZ=globalThis.__zod_globalRegistry}));function YVt(e,t){return new e({type:`string`,...PX(t)})}function XVt(e,t){return new e({type:`string`,format:`email`,check:`string_format`,abort:!1,...PX(t)})}function ZVt(e,t){return new e({type:`string`,format:`guid`,check:`string_format`,abort:!1,...PX(t)})}function QVt(e,t){return new e({type:`string`,format:`uuid`,check:`string_format`,abort:!1,...PX(t)})}function $Vt(e,t){return new e({type:`string`,format:`uuid`,check:`string_format`,abort:!1,version:`v4`,...PX(t)})}function eHt(e,t){return new e({type:`string`,format:`uuid`,check:`string_format`,abort:!1,version:`v6`,...PX(t)})}function tHt(e,t){return new e({type:`string`,format:`uuid`,check:`string_format`,abort:!1,version:`v7`,...PX(t)})}function nHt(e,t){return new e({type:`string`,format:`url`,check:`string_format`,abort:!1,...PX(t)})}function rHt(e,t){return new e({type:`string`,format:`emoji`,check:`string_format`,abort:!1,...PX(t)})}function iHt(e,t){return new e({type:`string`,format:`nanoid`,check:`string_format`,abort:!1,...PX(t)})}function aHt(e,t){return new e({type:`string`,format:`cuid`,check:`string_format`,abort:!1,...PX(t)})}function oHt(e,t){return new e({type:`string`,format:`cuid2`,check:`string_format`,abort:!1,...PX(t)})}function sHt(e,t){return new e({type:`string`,format:`ulid`,check:`string_format`,abort:!1,...PX(t)})}function cHt(e,t){return new e({type:`string`,format:`xid`,check:`string_format`,abort:!1,...PX(t)})}function lHt(e,t){return new e({type:`string`,format:`ksuid`,check:`string_format`,abort:!1,...PX(t)})}function uHt(e,t){return new e({type:`string`,format:`ipv4`,check:`string_format`,abort:!1,...PX(t)})}function dHt(e,t){return new e({type:`string`,format:`ipv6`,check:`string_format`,abort:!1,...PX(t)})}function fHt(e,t){return new e({type:`string`,format:`cidrv4`,check:`string_format`,abort:!1,...PX(t)})}function pHt(e,t){return new e({type:`string`,format:`cidrv6`,check:`string_format`,abort:!1,...PX(t)})}function mHt(e,t){return new e({type:`string`,format:`base64`,check:`string_format`,abort:!1,...PX(t)})}function hHt(e,t){return new e({type:`string`,format:`base64url`,check:`string_format`,abort:!1,...PX(t)})}function gHt(e,t){return new e({type:`string`,format:`e164`,check:`string_format`,abort:!1,...PX(t)})}function _Ht(e,t){return new e({type:`string`,format:`jwt`,check:`string_format`,abort:!1,...PX(t)})}function vHt(e,t){return new e({type:`string`,format:`datetime`,check:`string_format`,offset:!1,local:!1,precision:null,...PX(t)})}function yHt(e,t){return new e({type:`string`,format:`date`,check:`string_format`,...PX(t)})}function bHt(e,t){return new e({type:`string`,format:`time`,check:`string_format`,precision:null,...PX(t)})}function xHt(e,t){return new e({type:`string`,format:`duration`,check:`string_format`,...PX(t)})}function SHt(e,t){return new e({type:`number`,checks:[],...PX(t)})}function CHt(e,t){return new e({type:`number`,check:`number_format`,abort:!1,format:`safeint`,...PX(t)})}function wHt(e,t){return new e({type:`boolean`,...PX(t)})}function THt(e,t){return new e({type:`null`,...PX(t)})}function EHt(e){return new e({type:`unknown`})}function DHt(e,t){return new e({type:`never`,...PX(t)})}function OHt(e,t){return new dZ({check:`less_than`,...PX(t),value:e,inclusive:!1})}function EZ(e,t){return new dZ({check:`less_than`,...PX(t),value:e,inclusive:!0})}function kHt(e,t){return new fZ({check:`greater_than`,...PX(t),value:e,inclusive:!1})}function DZ(e,t){return new fZ({check:`greater_than`,...PX(t),value:e,inclusive:!0})}function AHt(e,t){return new bBt({check:`multiple_of`,...PX(t),value:e})}function jHt(e,t){return new SBt({check:`max_length`,...PX(t),maximum:e})}function OZ(e,t){return new CBt({check:`min_length`,...PX(t),minimum:e})}function MHt(e,t){return new wBt({check:`length_equals`,...PX(t),length:e})}function NHt(e,t){return new TBt({check:`string_format`,format:`regex`,...PX(t),pattern:e})}function PHt(e){return new EBt({check:`string_format`,format:`lowercase`,...PX(e)})}function FHt(e){return new DBt({check:`string_format`,format:`uppercase`,...PX(e)})}function IHt(e,t){return new OBt({check:`string_format`,format:`includes`,...PX(t),includes:e})}function LHt(e,t){return new kBt({check:`string_format`,format:`starts_with`,...PX(t),prefix:e})}function RHt(e,t){return new ABt({check:`string_format`,format:`ends_with`,...PX(t),suffix:e})}function kZ(e){return new jBt({check:`overwrite`,tx:e})}function zHt(e){return kZ(t=>t.normalize(e))}function BHt(){return kZ(e=>e.trim())}function VHt(){return kZ(e=>e.toLowerCase())}function HHt(){return kZ(e=>e.toUpperCase())}function UHt(){return kZ(e=>Tzt(e))}function WHt(e,t,n){return new e({type:`array`,element:t,...PX(n)})}function GHt(e,t,n){let r=PX(n);return r.abort??=!0,new e({type:`custom`,check:`custom`,fn:t,...r})}function KHt(e,t,n){return new e({type:`custom`,check:`custom`,fn:t,...PX(n)})}function qHt(e){let t=JHt(n=>(n.addIssue=e=>{if(typeof e==`string`)n.issues.push(BX(e,n.value,t._zod.def));else{let r=e;r.fatal&&(r.continue=!1),r.code??=`custom`,r.input??=n.value,r.inst??=t,r.continue??=!t._zod.def.abort,n.issues.push(BX(r))}},e(n.value,n)));return t}function JHt(e,t){let n=new lZ({check:`custom`,...PX(t)});return n._zod.check=e,n}var YHt=s((()=>{mZ(),TZ(),UX()}));function AZ(e){let t=e?.target??`draft-2020-12`;return t===`draft-4`&&(t=`draft-04`),t===`draft-7`&&(t=`draft-07`),{processors:e.processors??{},metadataRegistry:e?.metadata??wZ,target:t,unrepresentable:e?.unrepresentable??`throw`,override:e?.override??(()=>{}),io:e?.io??`output`,counter:0,seen:new Map,cycles:e?.cycles??`ref`,reused:e?.reused??`inline`,external:e?.external??void 0}}function jZ(e,t,n={path:[],schemaPath:[]}){var r;let i=e._zod.def,a=t.seen.get(e);if(a)return a.count++,n.schemaPath.includes(e)&&(a.cycle=n.path),a.schema;let o={schema:{},count:1,cycle:void 0,path:n.path};t.seen.set(e,o);let s=e._zod.toJSONSchema?.();if(s)o.schema=s;else{let r={...n,schemaPath:[...n.schemaPath,e],path:n.path};if(e._zod.processJSONSchema)e._zod.processJSONSchema(t,o.schema,r);else{let n=o.schema,a=t.processors[i.type];if(!a)throw Error(`[toJSONSchema]: Non-representable type encountered: ${i.type}`);a(e,t,n,r)}let a=e._zod.parent;a&&(o.ref||=a,jZ(a,t,r),t.seen.get(a).isParent=!0)}let c=t.metadataRegistry.get(e);return c&&Object.assign(o.schema,c),t.io===`input`&&PZ(e)&&(delete o.schema.examples,delete o.schema.default),t.io===`input`&&o.schema._prefault&&((r=o.schema).default??(r.default=o.schema._prefault)),delete o.schema._prefault,t.seen.get(e).schema}function MZ(e,t){let n=e.seen.get(t);if(!n)throw Error(`Unprocessed schema. This is a bug in Zod.`);let r=new Map;for(let t of e.seen.entries()){let n=e.metadataRegistry.get(t[0])?.id;if(n){let e=r.get(n);if(e&&e!==t[0])throw Error(`Duplicate schema id "${n}" detected during JSON Schema conversion. Two different schemas cannot share the same id when converted together.`);r.set(n,t[0])}}let i=t=>{let r=e.target===`draft-2020-12`?`$defs`:`definitions`;if(e.external){let n=e.external.registry.get(t[0])?.id,i=e.external.uri??(e=>e);if(n)return{ref:i(n)};let a=t[1].defId??t[1].schema.id??`schema${e.counter++}`;return t[1].defId=a,{defId:a,ref:`${i(`__shared`)}#/${r}/${a}`}}if(t[1]===n)return{ref:`#`};let i=`#/${r}/`,a=t[1].schema.id??`__schema${e.counter++}`;return{defId:a,ref:i+a}},a=e=>{if(e[1].schema.$ref)return;let t=e[1],{ref:n,defId:r}=i(e);t.def={...t.schema},r&&(t.defId=r);let a=t.schema;for(let e in a)delete a[e];a.$ref=n};if(e.cycles===`throw`)for(let t of e.seen.entries()){let e=t[1];if(e.cycle)throw Error(`Cycle detected: #/${e.cycle?.join(`/`)}/<root>
-
-Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let n of e.seen.entries()){let r=n[1];if(t===n[0]){a(n);continue}if(e.external){let r=e.external.registry.get(n[0])?.id;if(t!==n[0]&&r){a(n);continue}}if(e.metadataRegistry.get(n[0])?.id){a(n);continue}if(r.cycle){a(n);continue}if(r.count>1&&e.reused===`ref`){a(n);continue}}}function NZ(e,t){let n=e.seen.get(t);if(!n)throw Error(`Unprocessed schema. This is a bug in Zod.`);let r=t=>{let n=e.seen.get(t);if(n.ref===null)return;let i=n.def??n.schema,a={...i},o=n.ref;if(n.ref=null,o){r(o);let n=e.seen.get(o),s=n.schema;if(s.$ref&&(e.target===`draft-07`||e.target===`draft-04`||e.target===`openapi-3.0`)?(i.allOf=i.allOf??[],i.allOf.push(s)):Object.assign(i,s),Object.assign(i,a),t._zod.parent===o)for(let e in i)e===`$ref`||e===`allOf`||e in a||delete i[e];if(s.$ref)for(let e in i)e===`$ref`||e===`allOf`||e in n.def&&JSON.stringify(i[e])===JSON.stringify(n.def[e])&&delete i[e]}let s=t._zod.parent;if(s&&s!==o){r(s);let t=e.seen.get(s);if(t?.schema.$ref&&(i.$ref=t.schema.$ref,t.def))for(let e in i)e===`$ref`||e===`allOf`||e in t.def&&JSON.stringify(i[e])===JSON.stringify(t.def[e])&&delete i[e]}e.override({zodSchema:t,jsonSchema:i,path:n.path??[]})};for(let t of[...e.seen.entries()].reverse())r(t[0]);let i={};if(e.target===`draft-2020-12`?i.$schema=`https://json-schema.org/draft/2020-12/schema`:e.target===`draft-07`?i.$schema=`http://json-schema.org/draft-07/schema#`:e.target===`draft-04`?i.$schema=`http://json-schema.org/draft-04/schema#`:e.target,e.external?.uri){let n=e.external.registry.get(t)?.id;if(!n)throw Error("Schema is missing an `id` property");i.$id=e.external.uri(n)}Object.assign(i,n.def??n.schema);let a=e.external?.defs??{};for(let t of e.seen.entries()){let e=t[1];e.def&&e.defId&&(a[e.defId]=e.def)}e.external||Object.keys(a).length>0&&(e.target===`draft-2020-12`?i.$defs=a:i.definitions=a);try{let n=JSON.parse(JSON.stringify(i));return Object.defineProperty(n,`~standard`,{value:{...t[`~standard`],jsonSchema:{input:FZ(t,`input`,e.processors),output:FZ(t,`output`,e.processors)}},enumerable:!1,writable:!1}),n}catch{throw Error(`Error converting schema to JSON.`)}}function PZ(e,t){let n=t??{seen:new Set};if(n.seen.has(e))return!1;n.seen.add(e);let r=e._zod.def;if(r.type===`transform`)return!0;if(r.type===`array`)return PZ(r.element,n);if(r.type===`set`)return PZ(r.valueType,n);if(r.type===`lazy`)return PZ(r.getter(),n);if(r.type===`promise`||r.type===`optional`||r.type===`nonoptional`||r.type===`nullable`||r.type===`readonly`||r.type===`default`||r.type===`prefault`)return PZ(r.innerType,n);if(r.type===`intersection`)return PZ(r.left,n)||PZ(r.right,n);if(r.type===`record`||r.type===`map`)return PZ(r.keyType,n)||PZ(r.valueType,n);if(r.type===`pipe`)return PZ(r.in,n)||PZ(r.out,n);if(r.type===`object`){for(let e in r.shape)if(PZ(r.shape[e],n))return!0;return!1}if(r.type===`union`){for(let e of r.options)if(PZ(e,n))return!0;return!1}if(r.type===`tuple`){for(let e of r.items)if(PZ(e,n))return!0;return!!(r.rest&&PZ(r.rest,n))}return!1}var XHt,FZ,IZ=s((()=>{TZ(),XHt=(e,t={})=>n=>{let r=AZ({...n,processors:t});return jZ(e,r),MZ(r,e),NZ(r,e)},FZ=(e,t,n={})=>r=>{let{libraryOptions:i,target:a}=r??{},o=AZ({...i??{},target:a,io:t,processors:n});return jZ(e,o),MZ(o,e),NZ(o,e)}}));function ZHt(e,t){if(`_idmap`in e){let n=e,r=AZ({...t,processors:sQ}),i={};for(let e of n._idmap.entries()){let[t,n]=e;jZ(n,r)}let a={};r.external={registry:n,uri:t?.uri,defs:i};for(let e of n._idmap.entries()){let[t,n]=e;MZ(r,n),a[t]=NZ(r,n)}return Object.keys(i).length>0&&(a.__shared={[r.target===`draft-2020-12`?`$defs`:`definitions`]:i}),{schemas:a}}let n=AZ({...t,processors:sQ});return jZ(e,n),MZ(n,e),NZ(n,e)}var QHt,LZ,RZ,zZ,$Ht,eUt,BZ,tUt,nUt,VZ,rUt,HZ,iUt,UZ,WZ,aUt,oUt,sUt,cUt,GZ,lUt,KZ,uUt,dUt,qZ,JZ,YZ,XZ,fUt,ZZ,QZ,$Z,eQ,tQ,nQ,rQ,iQ,pUt,aQ,oQ,sQ,mUt=s((()=>{IZ(),UX(),QHt={guid:`uuid`,url:`uri`,datetime:`date-time`,json_string:`json-string`,regex:``},LZ=(e,t,n,r)=>{let i=n;i.type=`string`;let{minimum:a,maximum:o,format:s,patterns:c,contentEncoding:l}=e._zod.bag;if(typeof a==`number`&&(i.minLength=a),typeof o==`number`&&(i.maxLength=o),s&&(i.format=QHt[s]??s,i.format===``&&delete i.format,s===`time`&&delete i.format),l&&(i.contentEncoding=l),c&&c.size>0){let e=[...c];e.length===1?i.pattern=e[0].source:e.length>1&&(i.allOf=[...e.map(e=>({...t.target===`draft-07`||t.target===`draft-04`||t.target===`openapi-3.0`?{type:`string`}:{},pattern:e.source}))])}},RZ=(e,t,n,r)=>{let i=n,{minimum:a,maximum:o,format:s,multipleOf:c,exclusiveMaximum:l,exclusiveMinimum:u}=e._zod.bag;typeof s==`string`&&s.includes(`int`)?i.type=`integer`:i.type=`number`,typeof u==`number`&&(t.target===`draft-04`||t.target===`openapi-3.0`?(i.minimum=u,i.exclusiveMinimum=!0):i.exclusiveMinimum=u),typeof a==`number`&&(i.minimum=a,typeof u==`number`&&t.target!==`draft-04`&&(u>=a?delete i.minimum:delete i.exclusiveMinimum)),typeof l==`number`&&(t.target===`draft-04`||t.target===`openapi-3.0`?(i.maximum=l,i.exclusiveMaximum=!0):i.exclusiveMaximum=l),typeof o==`number`&&(i.maximum=o,typeof l==`number`&&t.target!==`draft-04`&&(l<=o?delete i.maximum:delete i.exclusiveMaximum)),typeof c==`number`&&(i.multipleOf=c)},zZ=(e,t,n,r)=>{n.type=`boolean`},$Ht=(e,t,n,r)=>{if(t.unrepresentable===`throw`)throw Error(`BigInt cannot be represented in JSON Schema`)},eUt=(e,t,n,r)=>{if(t.unrepresentable===`throw`)throw Error(`Symbols cannot be represented in JSON Schema`)},BZ=(e,t,n,r)=>{t.target===`openapi-3.0`?(n.type=`string`,n.nullable=!0,n.enum=[null]):n.type=`null`},tUt=(e,t,n,r)=>{if(t.unrepresentable===`throw`)throw Error(`Undefined cannot be represented in JSON Schema`)},nUt=(e,t,n,r)=>{if(t.unrepresentable===`throw`)throw Error(`Void cannot be represented in JSON Schema`)},VZ=(e,t,n,r)=>{n.not={}},rUt=(e,t,n,r)=>{},HZ=(e,t,n,r)=>{},iUt=(e,t,n,r)=>{if(t.unrepresentable===`throw`)throw Error(`Date cannot be represented in JSON Schema`)},UZ=(e,t,n,r)=>{let i=e._zod.def,a=xzt(i.entries);a.every(e=>typeof e==`number`)&&(n.type=`number`),a.every(e=>typeof e==`string`)&&(n.type=`string`),n.enum=a},WZ=(e,t,n,r)=>{let i=e._zod.def,a=[];for(let e of i.values)if(e===void 0){if(t.unrepresentable===`throw`)throw Error("Literal `undefined` cannot be represented in JSON Schema")}else if(typeof e==`bigint`){if(t.unrepresentable===`throw`)throw Error(`BigInt literals cannot be represented in JSON Schema`);a.push(Number(e))}else a.push(e);if(a.length!==0)if(a.length===1){let e=a[0];n.type=e===null?`null`:typeof e,t.target===`draft-04`||t.target===`openapi-3.0`?n.enum=[e]:n.const=e}else a.every(e=>typeof e==`number`)&&(n.type=`number`),a.every(e=>typeof e==`string`)&&(n.type=`string`),a.every(e=>typeof e==`boolean`)&&(n.type=`boolean`),a.every(e=>e===null)&&(n.type=`null`),n.enum=a},aUt=(e,t,n,r)=>{if(t.unrepresentable===`throw`)throw Error(`NaN cannot be represented in JSON Schema`)},oUt=(e,t,n,r)=>{let i=n,a=e._zod.pattern;if(!a)throw Error(`Pattern not found in template literal`);i.type=`string`,i.pattern=a.source},sUt=(e,t,n,r)=>{let i=n,a={type:`string`,format:`binary`,contentEncoding:`binary`},{minimum:o,maximum:s,mime:c}=e._zod.bag;o!==void 0&&(a.minLength=o),s!==void 0&&(a.maxLength=s),c?c.length===1?(a.contentMediaType=c[0],Object.assign(i,a)):(Object.assign(i,a),i.anyOf=c.map(e=>({contentMediaType:e}))):Object.assign(i,a)},cUt=(e,t,n,r)=>{n.type=`boolean`},GZ=(e,t,n,r)=>{if(t.unrepresentable===`throw`)throw Error(`Custom types cannot be represented in JSON Schema`)},lUt=(e,t,n,r)=>{if(t.unrepresentable===`throw`)throw Error(`Function types cannot be represented in JSON Schema`)},KZ=(e,t,n,r)=>{if(t.unrepresentable===`throw`)throw Error(`Transforms cannot be represented in JSON Schema`)},uUt=(e,t,n,r)=>{if(t.unrepresentable===`throw`)throw Error(`Map cannot be represented in JSON Schema`)},dUt=(e,t,n,r)=>{if(t.unrepresentable===`throw`)throw Error(`Set cannot be represented in JSON Schema`)},qZ=(e,t,n,r)=>{let i=n,a=e._zod.def,{minimum:o,maximum:s}=e._zod.bag;typeof o==`number`&&(i.minItems=o),typeof s==`number`&&(i.maxItems=s),i.type=`array`,i.items=jZ(a.element,t,{...r,path:[...r.path,`items`]})},JZ=(e,t,n,r)=>{let i=n,a=e._zod.def;i.type=`object`,i.properties={};let o=a.shape;for(let e in o)i.properties[e]=jZ(o[e],t,{...r,path:[...r.path,`properties`,e]});let s=new Set(Object.keys(o)),c=new Set([...s].filter(e=>{let n=a.shape[e]._zod;return t.io===`input`?n.optin===void 0:n.optout===void 0}));c.size>0&&(i.required=Array.from(c)),a.catchall?._zod.def.type===`never`?i.additionalProperties=!1:a.catchall?a.catchall&&(i.additionalProperties=jZ(a.catchall,t,{...r,path:[...r.path,`additionalProperties`]})):t.io===`output`&&(i.additionalProperties=!1)},YZ=(e,t,n,r)=>{let i=e._zod.def,a=i.inclusive===!1,o=i.options.map((e,n)=>jZ(e,t,{...r,path:[...r.path,a?`oneOf`:`anyOf`,n]}));a?n.oneOf=o:n.anyOf=o},XZ=(e,t,n,r)=>{let i=e._zod.def,a=jZ(i.left,t,{...r,path:[...r.path,`allOf`,0]}),o=jZ(i.right,t,{...r,path:[...r.path,`allOf`,1]}),s=e=>`allOf`in e&&Object.keys(e).length===1;n.allOf=[...s(a)?a.allOf:[a],...s(o)?o.allOf:[o]]},fUt=(e,t,n,r)=>{let i=n,a=e._zod.def;i.type=`array`;let o=t.target===`draft-2020-12`?`prefixItems`:`items`,s=t.target===`draft-2020-12`||t.target===`openapi-3.0`?`items`:`additionalItems`,c=a.items.map((e,n)=>jZ(e,t,{...r,path:[...r.path,o,n]})),l=a.rest?jZ(a.rest,t,{...r,path:[...r.path,s,...t.target===`openapi-3.0`?[a.items.length]:[]]}):null;t.target===`draft-2020-12`?(i.prefixItems=c,l&&(i.items=l)):t.target===`openapi-3.0`?(i.items={anyOf:c},l&&i.items.anyOf.push(l),i.minItems=c.length,l||(i.maxItems=c.length)):(i.items=c,l&&(i.additionalItems=l));let{minimum:u,maximum:d}=e._zod.bag;typeof u==`number`&&(i.minItems=u),typeof d==`number`&&(i.maxItems=d)},ZZ=(e,t,n,r)=>{let i=n,a=e._zod.def;i.type=`object`;let o=a.keyType,s=o._zod.bag?.patterns;if(a.mode===`loose`&&s&&s.size>0){let e=jZ(a.valueType,t,{...r,path:[...r.path,`patternProperties`,`*`]});i.patternProperties={};for(let t of s)i.patternProperties[t.source]=e}else (t.target===`draft-07`||t.target===`draft-2020-12`)&&(i.propertyNames=jZ(a.keyType,t,{...r,path:[...r.path,`propertyNames`]})),i.additionalProperties=jZ(a.valueType,t,{...r,path:[...r.path,`additionalProperties`]});let c=o._zod.values;if(c){let e=[...c].filter(e=>typeof e==`string`||typeof e==`number`);e.length>0&&(i.required=e)}},QZ=(e,t,n,r)=>{let i=e._zod.def,a=jZ(i.innerType,t,r),o=t.seen.get(e);t.target===`openapi-3.0`?(o.ref=i.innerType,n.nullable=!0):n.anyOf=[a,{type:`null`}]},$Z=(e,t,n,r)=>{let i=e._zod.def;jZ(i.innerType,t,r);let a=t.seen.get(e);a.ref=i.innerType},eQ=(e,t,n,r)=>{let i=e._zod.def;jZ(i.innerType,t,r);let a=t.seen.get(e);a.ref=i.innerType,n.default=JSON.parse(JSON.stringify(i.defaultValue))},tQ=(e,t,n,r)=>{let i=e._zod.def;jZ(i.innerType,t,r);let a=t.seen.get(e);a.ref=i.innerType,t.io===`input`&&(n._prefault=JSON.parse(JSON.stringify(i.defaultValue)))},nQ=(e,t,n,r)=>{let i=e._zod.def;jZ(i.innerType,t,r);let a=t.seen.get(e);a.ref=i.innerType;let o;try{o=i.catchValue(void 0)}catch{throw Error(`Dynamic catch values are not supported in JSON Schema`)}n.default=o},rQ=(e,t,n,r)=>{let i=e._zod.def,a=t.io===`input`?i.in._zod.def.type===`transform`?i.out:i.in:i.out;jZ(a,t,r);let o=t.seen.get(e);o.ref=a},iQ=(e,t,n,r)=>{let i=e._zod.def;jZ(i.innerType,t,r);let a=t.seen.get(e);a.ref=i.innerType,n.readOnly=!0},pUt=(e,t,n,r)=>{let i=e._zod.def;jZ(i.innerType,t,r);let a=t.seen.get(e);a.ref=i.innerType},aQ=(e,t,n,r)=>{let i=e._zod.def;jZ(i.innerType,t,r);let a=t.seen.get(e);a.ref=i.innerType},oQ=(e,t,n,r)=>{let i=e._zod.innerType;jZ(i,t,r);let a=t.seen.get(e);a.ref=i},sQ={string:LZ,number:RZ,boolean:zZ,bigint:$Ht,symbol:eUt,null:BZ,undefined:tUt,void:nUt,never:VZ,any:rUt,unknown:HZ,date:iUt,enum:UZ,literal:WZ,nan:aUt,template_literal:oUt,file:sUt,success:cUt,custom:GZ,function:lUt,transform:KZ,map:uUt,set:dUt,array:qZ,object:JZ,union:YZ,intersection:XZ,tuple:fUt,record:ZZ,nullable:QZ,nonoptional:$Z,default:eQ,prefault:tQ,catch:nQ,pipe:rQ,readonly:iQ,promise:pUt,optional:aQ,lazy:oQ}})),cQ=s((()=>{SX(),Gzt(),Hzt(),HVt(),mZ(),FBt(),UX(),TZ(),NBt(),YHt(),IZ()})),hUt=s((()=>{cQ()}));function gUt(e){return vHt(bUt,e)}function _Ut(e){return yHt(xUt,e)}function vUt(e){return bHt(SUt,e)}function yUt(e){return xHt(CUt,e)}var bUt,xUt,SUt,CUt,wUt=s((()=>{cQ(),VWt(),bUt=_X(`ZodISODateTime`,(e,t)=>{oVt.init(e,t),TQ.init(e,t)}),xUt=_X(`ZodISODate`,(e,t)=>{sVt.init(e,t),TQ.init(e,t)}),SUt=_X(`ZodISOTime`,(e,t)=>{cVt.init(e,t),TQ.init(e,t)}),CUt=_X(`ZodISODuration`,(e,t)=>{lVt.init(e,t),TQ.init(e,t)})})),lQ,uQ,TUt=s((()=>{cQ(),UX(),lQ=(e,t)=>{GX.init(e,t),e.name=`ZodError`,Object.defineProperties(e,{format:{value:t=>Vzt(e,t)},flatten:{value:t=>Bzt(e,t)},addIssue:{value:t=>{e.issues.push(t),e.message=JSON.stringify(e.issues,CX,2)}},addIssues:{value:t=>{e.issues.push(...t),e.message=JSON.stringify(e.issues,CX,2)}},isEmpty:{get(){return e.issues.length===0}}})},_X(`ZodError`,lQ),uQ=_X(`ZodError`,lQ,{Parent:Error})})),EUt,DUt,OUt,dQ,kUt,AUt,jUt,MUt,NUt,PUt,FUt,IUt,LUt=s((()=>{cQ(),TUt(),EUt=qX(uQ),DUt=JX(uQ),OUt=YX(uQ),dQ=XX(uQ),kUt=ZX(uQ),AUt=QX(uQ),jUt=$X(uQ),MUt=eZ(uQ),NUt=tZ(uQ),PUt=nZ(uQ),FUt=rZ(uQ),IUt=iZ(uQ)}));function fQ(e){return YVt(iWt,e)}function RUt(e){return SHt(OQ,e)}function zUt(e){return CHt(SWt,e)}function pQ(e){return wHt(CWt,e)}function BUt(e){return THt(wWt,e)}function mQ(){return EHt(TWt)}function VUt(e){return DHt(EWt,e)}function hQ(e,t){return WHt(DWt,e,t)}function gQ(e,t){return new kQ({type:`object`,shape:e??{},...PX(t)})}function _Q(e,t){return new kQ({type:`object`,shape:e,catchall:VUt(),...PX(t)})}function vQ(e,t){return new AQ({type:`union`,options:e,...PX(t)})}function HUt(e,t,n){return new OWt({type:`union`,options:t,discriminator:e,...PX(n)})}function UUt(e,t){return new kWt({type:`intersection`,left:e,right:t})}function yQ(e,t,n){return new AWt({type:`record`,keyType:e,valueType:t,...PX(n)})}function bQ(e,t){return new jQ({type:`enum`,entries:Array.isArray(e)?Object.fromEntries(e.map(e=>[e,e])):e,...PX(t)})}function xQ(e,t){return new jWt({type:`literal`,values:Array.isArray(e)?e:[e],...PX(t)})}function WUt(e){return new MWt({type:`transform`,transform:e})}function GUt(e){return new MQ({type:`optional`,innerType:e})}function KUt(e){return new NWt({type:`optional`,innerType:e})}function qUt(e){return new PWt({type:`nullable`,innerType:e})}function JUt(e,t){return new FWt({type:`default`,innerType:e,get defaultValue(){return typeof t==`function`?t():Ezt(t)}})}function YUt(e,t){return new IWt({type:`prefault`,innerType:e,get defaultValue(){return typeof t==`function`?t():Ezt(t)}})}function XUt(e,t){return new NQ({type:`nonoptional`,innerType:e,...PX(t)})}function ZUt(e,t){return new LWt({type:`catch`,innerType:e,catchValue:typeof t==`function`?t:()=>t})}function QUt(e,t){return new RWt({type:`pipe`,in:e,out:t})}function $Ut(e){return new zWt({type:`readonly`,innerType:e})}function eWt(e){return new BWt({type:`lazy`,getter:e})}function tWt(e,t){return GHt(PQ,e??(()=>!0),t)}function nWt(e,t={}){return KHt(PQ,e,t)}function rWt(e){return qHt(e)}function SQ(e,t={}){let n=new PQ({type:`custom`,check:`custom`,fn:t=>t instanceof e,abort:!0,...PX(t)});return n._zod.bag.Class=e,n._zod.check=t=>{t.value instanceof e||t.issues.push({code:`invalid_type`,expected:e.name,input:t.value,inst:n,path:[...n._zod.def.path??[]]})},n}var CQ,wQ,iWt,TQ,aWt,EQ,DQ,oWt,sWt,cWt,lWt,uWt,dWt,fWt,pWt,mWt,hWt,gWt,_Wt,vWt,yWt,bWt,xWt,OQ,SWt,CWt,wWt,TWt,EWt,DWt,kQ,AQ,OWt,kWt,AWt,jQ,jWt,MWt,MQ,NWt,PWt,FWt,IWt,NQ,LWt,RWt,zWt,BWt,PQ,VWt=s((()=>{cQ(),mUt(),IZ(),hUt(),wUt(),LUt(),CQ=_X(`ZodType`,(e,t)=>(vZ.init(e,t),Object.assign(e[`~standard`],{jsonSchema:{input:FZ(e,`input`),output:FZ(e,`output`)}}),e.toJSONSchema=XHt(e,{}),e.def=t,e.type=t.type,Object.defineProperty(e,`_def`,{value:t}),e.check=(...n)=>e.clone(kX(t,{checks:[...t.checks??[],...n.map(e=>typeof e==`function`?{_zod:{check:e,def:{check:`custom`},onattach:[]}}:e)]}),{parent:!0}),e.with=e.check,e.clone=(t,n)=>NX(e,t,n),e.brand=()=>e,e.register=((t,n)=>(t.add(e,n),e)),e.parse=(t,n)=>EUt(e,t,n,{callee:e.parse}),e.safeParse=(t,n)=>OUt(e,t,n),e.parseAsync=async(t,n)=>DUt(e,t,n,{callee:e.parseAsync}),e.safeParseAsync=async(t,n)=>dQ(e,t,n),e.spa=e.safeParseAsync,e.encode=(t,n)=>kUt(e,t,n),e.decode=(t,n)=>AUt(e,t,n),e.encodeAsync=async(t,n)=>jUt(e,t,n),e.decodeAsync=async(t,n)=>MUt(e,t,n),e.safeEncode=(t,n)=>NUt(e,t,n),e.safeDecode=(t,n)=>PUt(e,t,n),e.safeEncodeAsync=async(t,n)=>FUt(e,t,n),e.safeDecodeAsync=async(t,n)=>IUt(e,t,n),e.refine=(t,n)=>e.check(nWt(t,n)),e.superRefine=t=>e.check(rWt(t)),e.overwrite=t=>e.check(kZ(t)),e.optional=()=>GUt(e),e.exactOptional=()=>KUt(e),e.nullable=()=>qUt(e),e.nullish=()=>GUt(qUt(e)),e.nonoptional=t=>XUt(e,t),e.array=()=>hQ(e),e.or=t=>vQ([e,t]),e.and=t=>UUt(e,t),e.transform=t=>QUt(e,WUt(t)),e.default=t=>JUt(e,t),e.prefault=t=>YUt(e,t),e.catch=t=>ZUt(e,t),e.pipe=t=>QUt(e,t),e.readonly=()=>$Ut(e),e.describe=t=>{let n=e.clone();return wZ.add(n,{description:t}),n},Object.defineProperty(e,`description`,{get(){return wZ.get(e)?.description},configurable:!0}),e.meta=(...t)=>{if(t.length===0)return wZ.get(e);let n=e.clone();return wZ.add(n,t[0]),n},e.isOptional=()=>e.safeParse(void 0).success,e.isNullable=()=>e.safeParse(null).success,e.apply=t=>t(e),e)),wQ=_X(`_ZodString`,(e,t)=>{yZ.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>LZ(e,t,n,r);let n=e._zod.bag;e.format=n.format??null,e.minLength=n.minimum??null,e.maxLength=n.maximum??null,e.regex=(...t)=>e.check(NHt(...t)),e.includes=(...t)=>e.check(IHt(...t)),e.startsWith=(...t)=>e.check(LHt(...t)),e.endsWith=(...t)=>e.check(RHt(...t)),e.min=(...t)=>e.check(OZ(...t)),e.max=(...t)=>e.check(jHt(...t)),e.length=(...t)=>e.check(MHt(...t)),e.nonempty=(...t)=>e.check(OZ(1,...t)),e.lowercase=t=>e.check(PHt(t)),e.uppercase=t=>e.check(FHt(t)),e.trim=()=>e.check(BHt()),e.normalize=(...t)=>e.check(zHt(...t)),e.toLowerCase=()=>e.check(VHt()),e.toUpperCase=()=>e.check(HHt()),e.slugify=()=>e.check(UHt())}),iWt=_X(`ZodString`,(e,t)=>{yZ.init(e,t),wQ.init(e,t),e.email=t=>e.check(XVt(aWt,t)),e.url=t=>e.check(nHt(oWt,t)),e.jwt=t=>e.check(_Ht(xWt,t)),e.emoji=t=>e.check(rHt(sWt,t)),e.guid=t=>e.check(ZVt(EQ,t)),e.uuid=t=>e.check(QVt(DQ,t)),e.uuidv4=t=>e.check($Vt(DQ,t)),e.uuidv6=t=>e.check(eHt(DQ,t)),e.uuidv7=t=>e.check(tHt(DQ,t)),e.nanoid=t=>e.check(iHt(cWt,t)),e.guid=t=>e.check(ZVt(EQ,t)),e.cuid=t=>e.check(aHt(lWt,t)),e.cuid2=t=>e.check(oHt(uWt,t)),e.ulid=t=>e.check(sHt(dWt,t)),e.base64=t=>e.check(mHt(vWt,t)),e.base64url=t=>e.check(hHt(yWt,t)),e.xid=t=>e.check(cHt(fWt,t)),e.ksuid=t=>e.check(lHt(pWt,t)),e.ipv4=t=>e.check(uHt(mWt,t)),e.ipv6=t=>e.check(dHt(hWt,t)),e.cidrv4=t=>e.check(fHt(gWt,t)),e.cidrv6=t=>e.check(pHt(_Wt,t)),e.e164=t=>e.check(gHt(bWt,t)),e.datetime=t=>e.check(gUt(t)),e.date=t=>e.check(_Ut(t)),e.time=t=>e.check(vUt(t)),e.duration=t=>e.check(yUt(t))}),TQ=_X(`ZodStringFormat`,(e,t)=>{bZ.init(e,t),wQ.init(e,t)}),aWt=_X(`ZodEmail`,(e,t)=>{ZBt.init(e,t),TQ.init(e,t)}),EQ=_X(`ZodGUID`,(e,t)=>{YBt.init(e,t),TQ.init(e,t)}),DQ=_X(`ZodUUID`,(e,t)=>{XBt.init(e,t),TQ.init(e,t)}),oWt=_X(`ZodURL`,(e,t)=>{QBt.init(e,t),TQ.init(e,t)}),sWt=_X(`ZodEmoji`,(e,t)=>{$Bt.init(e,t),TQ.init(e,t)}),cWt=_X(`ZodNanoID`,(e,t)=>{eVt.init(e,t),TQ.init(e,t)}),lWt=_X(`ZodCUID`,(e,t)=>{tVt.init(e,t),TQ.init(e,t)}),uWt=_X(`ZodCUID2`,(e,t)=>{nVt.init(e,t),TQ.init(e,t)}),dWt=_X(`ZodULID`,(e,t)=>{rVt.init(e,t),TQ.init(e,t)}),fWt=_X(`ZodXID`,(e,t)=>{iVt.init(e,t),TQ.init(e,t)}),pWt=_X(`ZodKSUID`,(e,t)=>{aVt.init(e,t),TQ.init(e,t)}),mWt=_X(`ZodIPv4`,(e,t)=>{uVt.init(e,t),TQ.init(e,t)}),hWt=_X(`ZodIPv6`,(e,t)=>{dVt.init(e,t),TQ.init(e,t)}),gWt=_X(`ZodCIDRv4`,(e,t)=>{fVt.init(e,t),TQ.init(e,t)}),_Wt=_X(`ZodCIDRv6`,(e,t)=>{pVt.init(e,t),TQ.init(e,t)}),vWt=_X(`ZodBase64`,(e,t)=>{mVt.init(e,t),TQ.init(e,t)}),yWt=_X(`ZodBase64URL`,(e,t)=>{hVt.init(e,t),TQ.init(e,t)}),bWt=_X(`ZodE164`,(e,t)=>{gVt.init(e,t),TQ.init(e,t)}),xWt=_X(`ZodJWT`,(e,t)=>{_Vt.init(e,t),TQ.init(e,t)}),OQ=_X(`ZodNumber`,(e,t)=>{xZ.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>RZ(e,t,n,r),e.gt=(t,n)=>e.check(kHt(t,n)),e.gte=(t,n)=>e.check(DZ(t,n)),e.min=(t,n)=>e.check(DZ(t,n)),e.lt=(t,n)=>e.check(OHt(t,n)),e.lte=(t,n)=>e.check(EZ(t,n)),e.max=(t,n)=>e.check(EZ(t,n)),e.int=t=>e.check(zUt(t)),e.safe=t=>e.check(zUt(t)),e.positive=t=>e.check(kHt(0,t)),e.nonnegative=t=>e.check(DZ(0,t)),e.negative=t=>e.check(OHt(0,t)),e.nonpositive=t=>e.check(EZ(0,t)),e.multipleOf=(t,n)=>e.check(AHt(t,n)),e.step=(t,n)=>e.check(AHt(t,n)),e.finite=()=>e;let n=e._zod.bag;e.minValue=Math.max(n.minimum??-1/0,n.exclusiveMinimum??-1/0)??null,e.maxValue=Math.min(n.maximum??1/0,n.exclusiveMaximum??1/0)??null,e.isInt=(n.format??``).includes(`int`)||Number.isSafeInteger(n.multipleOf??.5),e.isFinite=!0,e.format=n.format??null}),SWt=_X(`ZodNumberFormat`,(e,t)=>{vVt.init(e,t),OQ.init(e,t)}),CWt=_X(`ZodBoolean`,(e,t)=>{yVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>zZ(e,t,n,r)}),wWt=_X(`ZodNull`,(e,t)=>{bVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>BZ(e,t,n,r)}),TWt=_X(`ZodUnknown`,(e,t)=>{xVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>HZ(e,t,n,r)}),EWt=_X(`ZodNever`,(e,t)=>{SVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>VZ(e,t,n,r)}),DWt=_X(`ZodArray`,(e,t)=>{CVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>qZ(e,t,n,r),e.element=t.element,e.min=(t,n)=>e.check(OZ(t,n)),e.nonempty=t=>e.check(OZ(1,t)),e.max=(t,n)=>e.check(jHt(t,n)),e.length=(t,n)=>e.check(MHt(t,n)),e.unwrap=()=>e.element}),kQ=_X(`ZodObject`,(e,t)=>{TVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>JZ(e,t,n,r),DX(e,`shape`,()=>t.shape),e.keyof=()=>bQ(Object.keys(e._zod.def.shape)),e.catchall=t=>e.clone({...e._zod.def,catchall:t}),e.passthrough=()=>e.clone({...e._zod.def,catchall:mQ()}),e.loose=()=>e.clone({...e._zod.def,catchall:mQ()}),e.strict=()=>e.clone({...e._zod.def,catchall:VUt()}),e.strip=()=>e.clone({...e._zod.def,catchall:void 0}),e.extend=t=>jzt(e,t),e.safeExtend=t=>Mzt(e,t),e.merge=t=>Nzt(e,t),e.pick=t=>kzt(e,t),e.omit=t=>Azt(e,t),e.partial=(...t)=>Pzt(MQ,e,t[0]),e.required=(...t)=>Fzt(NQ,e,t[0])}),AQ=_X(`ZodUnion`,(e,t)=>{SZ.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>YZ(e,t,n,r),e.options=t.options}),OWt=_X(`ZodDiscriminatedUnion`,(e,t)=>{AQ.init(e,t),EVt.init(e,t)}),kWt=_X(`ZodIntersection`,(e,t)=>{DVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>XZ(e,t,n,r)}),AWt=_X(`ZodRecord`,(e,t)=>{OVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>ZZ(e,t,n,r),e.keyType=t.keyType,e.valueType=t.valueType}),jQ=_X(`ZodEnum`,(e,t)=>{kVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>UZ(e,t,n,r),e.enum=t.entries,e.options=Object.values(t.entries);let n=new Set(Object.keys(t.entries));e.extract=(e,r)=>{let i={};for(let r of e)if(n.has(r))i[r]=t.entries[r];else throw Error(`Key ${r} not found in enum`);return new jQ({...t,checks:[],...PX(r),entries:i})},e.exclude=(e,r)=>{let i={...t.entries};for(let t of e)if(n.has(t))delete i[t];else throw Error(`Key ${t} not found in enum`);return new jQ({...t,checks:[],...PX(r),entries:i})}}),jWt=_X(`ZodLiteral`,(e,t)=>{AVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>WZ(e,t,n,r),e.values=new Set(t.values),Object.defineProperty(e,`value`,{get(){if(t.values.length>1)throw Error("This schema contains multiple valid literal values. Use `.values` instead.");return t.values[0]}})}),MWt=_X(`ZodTransform`,(e,t)=>{jVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>KZ(e,t,n,r),e._zod.parse=(n,r)=>{if(r.direction===`backward`)throw new bX(e.constructor.name);n.addIssue=r=>{if(typeof r==`string`)n.issues.push(BX(r,n.value,t));else{let t=r;t.fatal&&(t.continue=!1),t.code??=`custom`,t.input??=n.value,t.inst??=e,n.issues.push(BX(t))}};let i=t.transform(n.value,n);return i instanceof Promise?i.then(e=>(n.value=e,n)):(n.value=i,n)}}),MQ=_X(`ZodOptional`,(e,t)=>{CZ.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>aQ(e,t,n,r),e.unwrap=()=>e._zod.def.innerType}),NWt=_X(`ZodExactOptional`,(e,t)=>{MVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>aQ(e,t,n,r),e.unwrap=()=>e._zod.def.innerType}),PWt=_X(`ZodNullable`,(e,t)=>{NVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>QZ(e,t,n,r),e.unwrap=()=>e._zod.def.innerType}),FWt=_X(`ZodDefault`,(e,t)=>{PVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>eQ(e,t,n,r),e.unwrap=()=>e._zod.def.innerType,e.removeDefault=e.unwrap}),IWt=_X(`ZodPrefault`,(e,t)=>{FVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>tQ(e,t,n,r),e.unwrap=()=>e._zod.def.innerType}),NQ=_X(`ZodNonOptional`,(e,t)=>{IVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>$Z(e,t,n,r),e.unwrap=()=>e._zod.def.innerType}),LWt=_X(`ZodCatch`,(e,t)=>{LVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>nQ(e,t,n,r),e.unwrap=()=>e._zod.def.innerType,e.removeCatch=e.unwrap}),RWt=_X(`ZodPipe`,(e,t)=>{RVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>rQ(e,t,n,r),e.in=t.in,e.out=t.out}),zWt=_X(`ZodReadonly`,(e,t)=>{zVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>iQ(e,t,n,r),e.unwrap=()=>e._zod.def.innerType}),BWt=_X(`ZodLazy`,(e,t)=>{BVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>oQ(e,t,n,r),e.unwrap=()=>e._zod.def.getter()}),PQ=_X(`ZodCustom`,(e,t)=>{VVt.init(e,t),CQ.init(e,t),e._zod.processJSONSchema=(t,n,r)=>GZ(e,t,n,r)})})),HWt,UWt=s((()=>{(function(e){})(HWt||={})})),FQ=s((()=>{VWt(),hUt(),TUt(),LUt(),UWt(),cQ(),GVt(),mUt(),vX(UVt())})),WWt=s((()=>{FQ(),FQ()})),GWt,KWt=s((()=>{sb(),WWt(),GWt=fQ().min(7).default(()=>ob())})),IQ,LQ,RQ,qWt,JWt,zQ,YWt,XWt,BQ,ZWt,VQ,HQ,UQ,WQ,GQ,KQ,qQ,QWt,$Wt=s((()=>{WWt(),KWt(),IQ=gQ({description:fQ().optional()}),LQ=gQ({uid:GWt.brand(),nameKey:fQ().optional().default(``)}),RQ=IQ.extend({type:xQ(`apiKey`),name:fQ().optional().default(``),in:bQ([`query`,`header`,`cookie`]).optional().default(`header`).catch(`header`)}),qWt=gQ({value:fQ().default(``)}),JWt=RQ.merge(LQ).merge(qWt),zQ=IQ.extend({type:xQ(`http`),scheme:fQ().toLowerCase().pipe(bQ([`basic`,`bearer`])).optional().default(`basic`),bearerFormat:vQ([xQ(`JWT`),fQ()]).optional().default(`JWT`)}),YWt=gQ({username:fQ().default(``),password:fQ().default(``),token:fQ().default(``)}),XWt=zQ.merge(LQ).merge(YWt),BQ=IQ.extend({type:xQ(`openIdConnect`),openIdConnectUrl:fQ().optional().default(``)}),ZWt=BQ.merge(LQ),VQ=fQ().default(``),HQ=fQ().default(``),UQ=gQ({refreshUrl:fQ().optional().default(``),scopes:yQ(fQ(),fQ().optional().default(``)).optional().default({}).catch({}),selectedScopes:hQ(fQ()).optional().default([]),"x-scalar-client-id":fQ().optional().default(``),token:fQ().default(``),"x-scalar-security-query":yQ(fQ(),fQ()).optional(),"x-scalar-security-body":yQ(fQ(),fQ()).optional(),"x-tokenName":fQ().optional()}),WQ=typeof window<`u`?window.location.origin+window.location.pathname:``,GQ=[`SHA-256`,`plain`,`no`],KQ=bQ([`header`,`body`]).optional(),qQ=IQ.extend({type:xQ(`oauth2`),"x-default-scopes":hQ(fQ()).optional(),flows:gQ({implicit:UQ.extend({type:xQ(`implicit`).default(`implicit`),authorizationUrl:VQ,"x-scalar-redirect-uri":fQ().optional().default(WQ)}),password:UQ.extend({type:xQ(`password`).default(`password`),tokenUrl:HQ,clientSecret:fQ().default(``),username:fQ().default(``),password:fQ().default(``),"x-scalar-credentials-location":KQ}),clientCredentials:UQ.extend({type:xQ(`clientCredentials`).default(`clientCredentials`),tokenUrl:HQ,clientSecret:fQ().default(``),"x-scalar-credentials-location":KQ}),authorizationCode:UQ.extend({type:xQ(`authorizationCode`).default(`authorizationCode`),authorizationUrl:VQ,"x-usePkce":bQ(GQ).optional().default(`no`),"x-scalar-redirect-uri":fQ().optional().default(WQ),tokenUrl:HQ,clientSecret:fQ().default(``),"x-scalar-credentials-location":KQ})}).partial().default({implicit:{selectedScopes:[],scopes:{},"x-scalar-client-id":``,refreshUrl:``,token:``,type:`implicit`,authorizationUrl:`http://localhost:8080`,"x-scalar-redirect-uri":WQ}})}),QWt=qQ.merge(LQ),yQ(fQ(),hQ(fQ()).optional().default([])),vQ([RQ,zQ,qQ,BQ]),HUt(`type`,[JWt,XWt,ZWt,QWt]).transform(e=>(e.type===`oauth2`&&e[`x-default-scopes`]?.length&&Object.keys(e.flows).forEach(t=>{e.flows[t]?.selectedScopes&&e[`x-default-scopes`]&&(e.flows[t].selectedScopes=[e[`x-default-scopes`]].flat())}),e))})),eGt=s((()=>{$Wt()})),tGt,nGt,rGt,iGt=s((()=>{eY(),_Rt(),TRt(),DRt(),QY(),W(),kE(),QI(),gX(),eGt(),tGt={class:`flex h-8 items-center justify-end gap-2 border-t`},nGt={class:`flex h-8 w-full items-center justify-end border-t`},rGt=N({__name:`OAuth2`,props:{environment:{},flows:{},type:{},selectedScopes:{},scheme:{},server:{},proxyUrl:{},name:{},eventBus:{},options:{default:()=>({})}},emits:[`update:selectedScopes`,`upsert:scope`,`delete:scope`],setup(e,{emit:t}){let n=t,r=mf(),{toast:i}=pX(),a=U(()=>e.flows[e.type]),o=U(()=>{let t=a.value.scopes;return t?e.selectedScopes.filter(e=>Object.hasOwn(t,e)):[]}),s=U(()=>{if(!(`x-scalar-secret-client-secret`in a.value))return!1;let e=`x-usePkce`in a.value?a.value[`x-usePkce`]:void 0;return e!==`SHA-256`&&e!==`plain`}),c=U(()=>a.value[`x-scalar-secret-client-secret`]??``),l=t=>{if(e.scheme.type===`openIdConnect`)return u(t);e.eventBus.emit(`auth:update:security-scheme`,{payload:{type:e.scheme.type,flows:{[e.type]:t}},name:e.name})},u=t=>e.eventBus.emit(`auth:update:security-scheme-secrets`,{payload:{type:e.scheme.type,[e.type]:t},name:e.name}),d=()=>{r.isLoading||e.eventBus.emit(`auth:clear:security-scheme-secrets`,{name:e.name})},f=()=>{r.isLoading||u({"x-scalar-secret-token":``,"x-scalar-secret-refresh-token":``})},p=A(null),m=A(!1),h=t=>JSON.stringify({type:e.type,authorizationUrl:t&&`authorizationUrl`in t?t.authorizationUrl:``,tokenUrl:t&&`tokenUrl`in t?t.tokenUrl:``,refreshUrl:t?.refreshUrl??``,scopes:Object.keys(t?.scopes??{})});mr(()=>a.value,t=>{if(!t||!(`x-scalar-secret-redirect-uri`in t))return;let n=h(t);if(p.value!==n&&(p.value=n,m.value=!1),m.value)return;let r=t[`x-scalar-secret-redirect-uri`],i=ERt(e.options);m.value=!0,!(r||!i)&&u({"x-scalar-secret-redirect-uri":i})},{immediate:!0});let g=async()=>{if(r.isLoading)return;r.start();let[t,n]=await CRt(e.flows,e.type,o.value,e.server,e.proxyUrl,dI(e.environment));await r.clear(),n?.accessToken?u({"x-scalar-secret-token":n.accessToken,...n.refreshToken?{"x-scalar-secret-refresh-token":n.refreshToken}:{}}):(console.error(t),i(t?.message??`Failed to authorize`,`error`))},_=U(()=>e.type!==`implicit`),v=U(()=>`tokenUrl`in a.value&&a.value.tokenUrl?a.value.tokenUrl:`https://galaxy.scalar.com/oauth/refresh`),y=async()=>{if(r.isLoading||e.type===`implicit`)return;r.start();let[t,n]=await wRt(e.flows,e.type,e.proxyUrl,e.server,dI(e.environment));await r.clear(),n?.accessToken?u({"x-scalar-secret-token":n.accessToken,...n.refreshToken?{"x-scalar-secret-refresh-token":n.refreshToken}:{}}):(console.error(t),i(t?.message??`Failed to refresh token`,`error`))},b=t=>{let n=t===`body`?`body`:`header`;e.scheme.type!==`openIdConnect`&&l({"x-scalar-credentials-location":n}),u({"x-scalar-credentials-location":n})};return(t,i)=>a.value[`x-scalar-secret-token`]?(F(),I(V,{key:0},[H(j($J),null,{default:M(()=>[H(ZY,{class:`border-r-transparent`,environment:e.environment,modelValue:a.value[`x-scalar-secret-token`],placeholder:`QUxMIFlPVVIgQkFTRSBBUkUgQkVMT05HIFRPIFVT`,type:`password`,"onUpdate:modelValue":i[0]||=e=>u({"x-scalar-secret-token":e})},{default:M(()=>[...i[14]||=[z(` Access Token `,-1)]]),_:1},8,[`environment`,`modelValue`])]),_:1}),_.value?(F(),L(j($J),{key:0},{default:M(()=>[H(ZY,{class:`border-r-transparent`,environment:e.environment,modelValue:a.value.refreshUrl??``,placeholder:v.value,"onUpdate:modelValue":i[1]||=e=>l({refreshUrl:e})},{default:M(()=>[...i[15]||=[z(` Refresh URL `,-1)]]),_:1},8,[`environment`,`modelValue`,`placeholder`])]),_:1})):B(``,!0),H(j($J),{class:`min-w-full`},{default:M(()=>[R(`div`,tGt,[_.value?(F(),L(j(gf),{key:0,class:`p-0 px-2 py-0.5`,loader:j(r),size:`sm`,variant:`outlined`,onClick:y},{default:M(()=>[...i[16]||=[z(` Refresh `,-1)]]),_:1},8,[`loader`])):B(``,!0),H(j(gf),{class:`mr-1 p-0 px-2 py-0.5`,disabled:j(r).isLoading,size:`sm`,variant:`outlined`,onClick:f},{default:M(()=>[...i[17]||=[z(` Clear `,-1)]]),_:1},8,[`disabled`])])]),_:1})],64)):(F(),I(V,{key:1},[H(j($J),null,{default:M(()=>[`authorizationUrl`in a.value?(F(),L(ZY,{key:0,containerClass:`border-r-0`,environment:e.environment,modelValue:a.value[`x-scalar-secret-auth-url`]??``,placeholder:`https://galaxy.scalar.com/authorize`,"onUpdate:modelValue":i[2]||=e=>{u({"x-scalar-secret-auth-url":e}),l({authorizationUrl:e})}},{default:M(()=>[...i[18]||=[z(` Auth URL `,-1)]]),_:1},8,[`environment`,`modelValue`])):B(``,!0),`tokenUrl`in a.value?(F(),L(ZY,{key:1,environment:e.environment,modelValue:a.value[`x-scalar-secret-token-url`]??``,placeholder:`https://galaxy.scalar.com/token`,"onUpdate:modelValue":i[3]||=e=>{u({"x-scalar-secret-token-url":e}),l({tokenUrl:e})}},{default:M(()=>[...i[19]||=[z(` Token URL `,-1)]]),_:1},8,[`environment`,`modelValue`])):B(``,!0)]),_:1}),`x-scalar-secret-redirect-uri`in a.value?(F(),L(j($J),{key:0},{default:M(()=>[H(ZY,{environment:e.environment,modelValue:a.value[`x-scalar-secret-redirect-uri`],placeholder:`Optional redirect URL`,"onUpdate:modelValue":i[4]||=e=>{m.value=!0,u({"x-scalar-secret-redirect-uri":e})}},{default:M(()=>[...i[20]||=[z(` Redirect URL `,-1)]]),_:1},8,[`environment`,`modelValue`])]),_:1})):B(``,!0),`x-scalar-secret-username`in a.value&&`x-scalar-secret-password`in a.value?(F(),I(V,{key:1},[H(j($J),null,{default:M(()=>[H(ZY,{class:`text-c-2`,environment:e.environment,modelValue:a.value[`x-scalar-secret-username`],placeholder:`janedoe`,"onUpdate:modelValue":i[5]||=e=>u({"x-scalar-secret-username":e})},{default:M(()=>[...i[21]||=[z(` Username `,-1)]]),_:1},8,[`environment`,`modelValue`])]),_:1}),H(j($J),null,{default:M(()=>[H(ZY,{environment:e.environment,modelValue:a.value[`x-scalar-secret-password`],placeholder:`********`,type:`password`,"onUpdate:modelValue":i[6]||=e=>u({"x-scalar-secret-password":e})},{default:M(()=>[...i[22]||=[z(` Password `,-1)]]),_:1},8,[`environment`,`modelValue`])]),_:1})],64)):B(``,!0),H(j($J),null,{default:M(()=>[H(ZY,{environment:e.environment,modelValue:a.value[`x-scalar-secret-client-id`],placeholder:`12345`,"onUpdate:modelValue":i[7]||=e=>u({"x-scalar-secret-client-id":e})},{default:M(()=>[...i[23]||=[z(` Client ID `,-1)]]),_:1},8,[`environment`,`modelValue`])]),_:1}),s.value?(F(),L(j($J),{key:2},{default:M(()=>[H(ZY,{environment:e.environment,modelValue:c.value,placeholder:`XYZ123`,type:`password`,"onUpdate:modelValue":i[8]||=e=>u({"x-scalar-secret-client-secret":e})},{default:M(()=>[...i[24]||=[z(` Client Secret `,-1)]]),_:1},8,[`environment`,`modelValue`])]),_:1})):B(``,!0),`x-usePkce`in a.value?(F(),L(j($J),{key:3},{default:M(()=>[H(ZY,{enum:j(GQ),environment:e.environment,modelValue:a.value[`x-usePkce`],readOnly:``,"onUpdate:modelValue":i[9]||=e=>l({"x-usePkce":e})},{default:M(()=>[...i[25]||=[z(` Use PKCE `,-1)]]),_:1},8,[`enum`,`environment`,`modelValue`])]),_:1})):B(``,!0),e.type===`implicit`?B(``,!0):(F(),L(j($J),{key:4},{default:M(()=>[H(ZY,{enum:[`header`,`body`],environment:e.environment,modelValue:a.value[`x-scalar-credentials-location`]||`header`,placeholder:`header`,readOnly:``,"onUpdate:modelValue":i[10]||=e=>b(e)},{default:M(()=>[...i[26]||=[z(` Credentials Location `,-1)]]),_:1},8,[`environment`,`modelValue`])]),_:1})),H(j($J),null,{default:M(()=>[H(gRt,{flow:a.value,flowType:e.type,selectedScopes:o.value,"onUpdate:selectedScopes":i[11]||=e=>n(`update:selectedScopes`,e),"onUpsert:scope":i[12]||=e=>n(`upsert:scope`,e),"onDelete:scope":i[13]||=e=>n(`delete:scope`,e)},null,8,[`flow`,`flowType`,`selectedScopes`])]),_:1}),H(j($J),{class:`min-w-full`},{default:M(()=>[R(`div`,nGt,[e.scheme.type===`openIdConnect`?(F(),L(j(gf),{key:0,class:`mr-1 p-0 px-2 py-0.5`,disabled:j(r).isLoading,size:`sm`,variant:`outlined`,onClick:d},{default:M(()=>[...i[27]||=[z(` Clear `,-1)]]),_:1},8,[`disabled`])):B(``,!0),H(j(gf),{class:`mr-0.75 p-0 px-2 py-0.5`,loader:j(r),size:`sm`,variant:`outlined`,onClick:g},{default:M(()=>[...i[28]||=[z(` Authorize `,-1)]]),_:1},8,[`loader`])])]),_:1})],64))}})})),aGt,oGt=s((()=>{iGt(),aGt=rGt})),sGt,cGt,lGt=s((()=>{yF(),cM(),oN(),sGt=Z.Object({authorization_endpoint:Z.Optional(Z.String()),token_endpoint:Z.Optional(Z.String()),scopes_supported:Z.Optional(Z.Array(Z.String())),grant_types_supported:Z.Optional(Z.Array(Z.String())),code_challenge_methods_supported:Z.Optional(Z.Array(Z.String()))}),cGt=async(e,t)=>{try{let n=e.trim();if(!n)return[Error(`URL cannot be empty`),null];n.endsWith(`/`)&&(n=n.slice(0,-1)),n.includes(`/.well-known/openid-configuration`)||(n=`${n}/.well-known/openid-configuration`);let r=_F(t,n),i=await fetch(r);if(!i.ok)return[Error(`Failed to fetch OpenID Connect discovery document: ${i.status} ${i.statusText}`),null];let a=aN(sGt,await i.json());return!a.authorization_endpoint&&!a.token_endpoint?[Error(`Invalid OpenID Connect discovery document: missing required endpoints`),null]:[null,a]}catch(e){return e instanceof Error?[e,null]:[Error(`Failed to fetch OpenID Connect discovery document`),null]}}})),uGt,dGt,JQ,fGt,pGt,YQ,XQ,mGt,ZQ,QQ,hGt,gGt=s((()=>{cM(),uM(),oP(),dP(),adt(),VP(),uGt=lM(Z.Object({type:Z.Literal(`apiKey`)}),sP),dGt=lM(Z.Object({type:Z.Literal(`http`)}),sP,cP),JQ=lM(Qut,sP,qut),fGt=Z.Object({implicit:Z.Optional(lM(JQ,uP)),password:Z.Optional(lM(JQ,cP,lP,iP)),clientCredentials:Z.Optional(lM(JQ,lP,iP)),authorizationCode:Z.Optional(lM(JQ,lP,uP,iP))}),pGt=lM(Z.Object({type:Z.Literal(`oauth2`)}),fGt),YQ=Z.Object({type:Z.Literal(`openIdConnect`),implicit:Z.Optional(lM(pP,JQ,uP)),password:Z.Optional(lM(mP,JQ,cP,lP,iP)),clientCredentials:Z.Optional(lM(hP,JQ,lP,iP)),authorizationCode:Z.Optional(lM(gP,JQ,lP,uP,iP))}),XQ=Z.Union([uGt,dGt,pGt,YQ]),mGt=Z.Record(Z.String(),XQ),ZQ=Z.Object({selectedIndex:Z.Number(),selectedSchemes:Z.Array(Vft)}),QQ=Z.Object({secrets:mGt,selected:Z.Object({document:Z.Optional(ZQ),path:Z.Optional(Z.Record(Z.String(),Z.Record(Z.String(),Z.Optional(ZQ))))})}),hGt=Z.Record(Z.String(),QQ)}));function _Gt(e){return e.startsWith(`#`)}var $Q,e$=s((()=>{$Q=(e,t)=>{Object.assign(e,t)}})),vGt,t$=s((()=>{PY(),W(),gGt(),e$(),dD(),oN(),vGt=({hooks:e}={})=>{let t=fn({});return{clearAuthSelectedSchemas:n=>{let r=t[n.documentName];if(!r)return;if(n.type===`document`){delete r.selected.document,e?.onAuthChange?.(n.documentName);return}NY(n.method),NY(n.path);let i=r.selected.path?.[n.path];i&&(delete i[n.method],e?.onAuthChange?.(n.documentName))},getAuthSecrets:(e,n)=>t[e]?.secrets?.[n],setAuthSecrets:(n,r,i)=>{t[n]||={secrets:{},selected:{document:void 0,path:void 0}},t[n].secrets[r]=aN(XQ,i),e?.onAuthChange?.(n)},clearAuthSecrets:(n,r)=>{delete t[n]?.secrets?.[r],e?.onAuthChange?.(n)},getAuthSelectedSchemas:e=>e.type===`document`?t[e.documentName]?.selected?.document:t[e.documentName]?.selected?.path?.[e.path]?.[e.method],setAuthSelectedSchemas:(n,r)=>{t[n.documentName]||={secrets:{},selected:{document:void 0,path:void 0}};let i=t[n.documentName];if(n.type===`document`)i.selected.document=r;else{NY(n.path),NY(n.method),i.selected.path||={},i.selected.path[n.path]||={};let e=i.selected.path[n.path];e[n.method]=r}e?.onAuthChange?.(n.documentName)},clearDocumentAuth:n=>{delete t[n],e?.onAuthChange?.(n)},load:n=>{$Q(t,aN(hGt,n)),Object.keys(n).forEach(t=>{e?.onAuthChange?.(t)})},export:()=>uD(t)}}})),yGt,bGt=s((()=>{oN(),t$(),yGt=e=>{let t=Object.fromEntries((e.scopes_supported??[]).map(e=>[e,``])),n=new Set(e.grant_types_supported??[`authorization_code`,`implicit`]),r=e.authorization_endpoint,i=e.token_endpoint,a=e.code_challenge_methods_supported?.includes(`S256`)?`SHA-256`:e.code_challenge_methods_supported?.includes(`plain`)?`plain`:`no`,o={};return n.has(`implicit`)&&r&&(o.implicit={authorizationUrl:r,refreshUrl:r,scopes:t}),n.has(`password`)&&i&&(o.password={tokenUrl:i,refreshUrl:i,scopes:t}),n.has(`client_credentials`)&&i&&(o.clientCredentials={tokenUrl:i,refreshUrl:i,scopes:t}),n.has(`authorization_code`)&&r&&i&&(o.authorizationCode={authorizationUrl:r,tokenUrl:i,refreshUrl:i,"x-usePkce":a,scopes:t}),aN(YQ,o)}})),xGt,SGt,CGt=s((()=>{eY(),QY(),lGt(),bGt(),W(),kE(),gX(),xGt={class:`flex h-8 w-full items-center justify-end border-t`},SGt=N({__name:`OpenIDConnect`,props:{environment:{},eventBus:{},getStaticBorderClass:{type:Function},name:{},proxyUrl:{},scheme:{}},setup(e){let t=mf(),{toast:n}=pX(),r=async()=>{if(t.isLoading||!e.scheme.openIdConnectUrl)return;t.start();let[r,i]=await cGt(e.scheme.openIdConnectUrl,e.proxyUrl);if(await t.clear(),r){console.error(r),n(r?.message??`Failed to fetch OpenID Connect configuration`,`error`);return}let a=yGt(i);e.eventBus.emit(`auth:update:security-scheme-secrets`,{payload:a,name:e.name,overwrite:!0})},i=t=>e.eventBus.emit(`auth:update:security-scheme`,{payload:{type:`openIdConnect`,openIdConnectUrl:t},name:e.name});return(n,a)=>(F(),I(V,null,[H(j($J),null,{default:M(()=>[H(ZY,{containerClass:e.getStaticBorderClass(),environment:e.environment,modelValue:e.scheme.openIdConnectUrl,placeholder:`https://example.com/.well-known/openid-configuration`,required:``,"onUpdate:modelValue":i},{default:M(()=>[...a[0]||=[z(` Discovery URL `,-1)]]),_:1},8,[`containerClass`,`environment`,`modelValue`])]),_:1}),H(j($J),{class:`min-w-full`},{default:M(()=>[R(`div`,xGt,[H(j(gf),{class:`mr-0.75 p-0 px-2 py-0.5`,disabled:!e.scheme.openIdConnectUrl,loader:j(t),size:`sm`,variant:`outlined`,onClick:r},{default:M(()=>[...a[1]||=[z(` Fetch Configuration `,-1)]]),_:1},8,[`disabled`,`loader`])])]),_:1})],64))}})})),wGt,TGt=s((()=>{CGt(),wGt=SGt})),EGt,DGt,OGt,kGt,AGt,jGt,MGt,NGt,PGt=s((()=>{XJ(),eY(),QY(),oGt(),TGt(),W(),kE(),zE(),EGt={class:`bg-b-1 min-w-0 flex-1 px-3 py-1.25`},DGt={class:`text-c-1 leading-5.5 font-medium`},OGt={class:`flex min-h-8 border-t text-base`},kGt={class:`flex h-8 max-w-full gap-2.5 overflow-x-auto px-3`},AGt=[`onClick`],jGt={class:`relative z-10`},MGt={key:5,class:`text-c-3 flex items-center justify-center border-t p-4 px-4 text-center text-xs text-balance`},NGt=N({__name:`RequestAuthTab`,props:{environment:{},isStatic:{type:Boolean},proxyUrl:{},selectedSecuritySchemas:{},securitySchemes:{},server:{},eventBus:{},options:{}},emits:[`update:selectedScopes`,`upsert:scope`,`delete:scope`],setup(e,{emit:t}){let n=t,r=U(()=>Object.entries(e.selectedSecuritySchemas).map(([t,n=[]])=>({scheme:RE(e.securitySchemes[t]),name:t,scopes:n}))),i=A(``),a=U(()=>r.value.flatMap(({scheme:e})=>e?.type!==`oauth2`&&e?.type!==`openIdConnect`?[]:Object.keys(e.flows??{})).includes(i.value)?i.value:``),o=e=>{i.value=e},s=U(()=>r.value.length>1),c=(e,t)=>{let n=Pt(e);switch(t.type){case`apiKey`:return`${n}: ${t.in}`;case`openIdConnect`:case`oauth2`:{let e=Object.keys(t.flows??{})[0],r=a.value||e;return r?`${n}: ${r}`:n}case`http`:return`${n}: ${t.scheme}`;default:return n}},l=(e,t)=>a.value===e||t===0&&!a.value,u=()=>e.isStatic&&`border-t`,d=(t,n)=>e.eventBus.emit(`auth:update:security-scheme-secrets`,{payload:{type:`http`,...t},name:n}),f=(t,n)=>e.eventBus.emit(`auth:update:security-scheme-secrets`,{payload:{type:`apiKey`,...t},name:n}),p=(t,n)=>e.eventBus.emit(`auth:update:security-scheme`,{payload:{type:`apiKey`,...t},name:n}),m=(t,r)=>{n(`update:selectedScopes`,{id:Object.keys(e.selectedSecuritySchemas),name:t,...r})},h=(e,t)=>{n(`upsert:scope`,{...t,name:e})},g=(e,t)=>{n(`delete:scope`,{...t,name:e})},_=(t,n)=>{let r=`floating-bg text-c-3 relative cursor-pointer border-b border-transparent py-1 text-base font-medium`;return l(t,n)?`${r} !text-c-1 !rounded-none border-b !border-current ${e.isStatic?`opacity-100`:``}`:r};return(t,n)=>(F(!0),I(V,null,Ar(r.value,({scheme:t,name:r,scopes:i})=>(F(),I(V,{key:r},[s.value&&t?(F(),L(j($J),{key:0},{default:M(()=>[H(j(YJ),{"aria-label":c(r,t),class:`max-h-[auto]`},{default:M(()=>[R(`div`,EGt,[R(`p`,DGt,k(c(r,t)),1),t.description?(F(),L(j(JT),{key:0,class:`auth-description text-c-2 w-full`,value:t.description},null,8,[`value`])):B(``,!0)])]),_:2},1032,[`aria-label`])]),_:2},1024)):B(``,!0),t?.description&&!s.value?(F(),L(j($J),{key:1},{default:M(()=>[H(j(YJ),{"aria-label":t.description,class:`max-h-[auto]`},{default:M(()=>[H(j(JT),{class:`auth-description bg-b-1 text-c-2 min-w-0 flex-1 px-3 py-1.25`,value:t.description},null,8,[`value`])]),_:2},1032,[`aria-label`])]),_:2},1024)):B(``,!0),t?.type===`http`?(F(),I(V,{key:2},[t.scheme===`bearer`?(F(),L(j($J),{key:0},{default:M(()=>[H(ZY,{containerClass:u(),environment:e.environment,modelValue:t[`x-scalar-secret-token`],placeholder:`Token`,type:`password`,"onUpdate:modelValue":e=>d({"x-scalar-secret-token":e},r)},{default:M(()=>[...n[0]||=[z(` Bearer Token `,-1)]]),_:1},8,[`containerClass`,`environment`,`modelValue`,`onUpdate:modelValue`])]),_:2},1024)):t?.scheme===`basic`?(F(),I(V,{key:1},[H(j($J),null,{default:M(()=>[H(ZY,{class:`text-c-2`,environment:e.environment,modelValue:t[`x-scalar-secret-username`],placeholder:`janedoe`,required:``,"onUpdate:modelValue":e=>d({"x-scalar-secret-username":e},r)},{default:M(()=>[...n[1]||=[z(` Username `,-1)]]),_:1},8,[`environment`,`modelValue`,`onUpdate:modelValue`])]),_:2},1024),H(j($J),null,{default:M(()=>[H(ZY,{environment:e.environment,modelValue:t[`x-scalar-secret-password`],placeholder:`********`,type:`password`,"onUpdate:modelValue":e=>d({"x-scalar-secret-password":e},r)},{default:M(()=>[...n[2]||=[z(` Password `,-1)]]),_:1},8,[`environment`,`modelValue`,`onUpdate:modelValue`])]),_:2},1024)],64)):B(``,!0)],64)):t?.type===`apiKey`?(F(),I(V,{key:3},[H(j($J),null,{default:M(()=>[H(ZY,{containerClass:u(),environment:e.environment,modelValue:t.name,placeholder:`api-key`,"onUpdate:modelValue":e=>p({name:e},r)},{default:M(()=>[...n[3]||=[z(` Name `,-1)]]),_:1},8,[`containerClass`,`environment`,`modelValue`,`onUpdate:modelValue`])]),_:2},1024),H(j($J),null,{default:M(()=>[H(ZY,{environment:e.environment,modelValue:t[`x-scalar-secret-token`],placeholder:`QUxMIFlPVVIgQkFTRSBBUkUgQkVMT05HIFRPIFVT`,type:`password`,"onUpdate:modelValue":e=>f({"x-scalar-secret-token":e},r)},{default:M(()=>[...n[4]||=[z(` Value `,-1)]]),_:1},8,[`environment`,`modelValue`,`onUpdate:modelValue`])]),_:2},1024)],64)):t?.type===`oauth2`||t?.type===`openIdConnect`?(F(),I(V,{key:4},[t?.type===`openIdConnect`&&!Object.keys(t.flows??{}).length?(F(),L(wGt,{key:0,environment:e.environment,eventBus:e.eventBus,getStaticBorderClass:u,name:r,proxyUrl:e.proxyUrl,scheme:t},null,8,[`environment`,`eventBus`,`name`,`proxyUrl`,`scheme`])):B(``,!0),Object.keys(t.flows??{}).length>1?(F(),L(j($J),{key:1},{default:M(()=>[R(`div`,OGt,[R(`div`,kGt,[(F(!0),I(V,null,Ar(t.flows,(e,t,n)=>(F(),I(`button`,{key:t,class:O(_(t,n)),type:`button`,onClick:e=>o(t)},[R(`span`,jGt,k(t),1)],10,AGt))),128))])])]),_:2},1024)):B(``,!0),(F(!0),I(V,null,Ar(t.flows,(n,a,o)=>(F(),I(V,{key:a},[t.flows&&l(a,o)?(F(),L(aGt,{key:0,environment:e.environment,eventBus:e.eventBus,flows:t.flows,name:r,options:e.options,proxyUrl:e.proxyUrl,scheme:t,selectedScopes:i,server:e.server,type:a,"onDelete:scope":e=>g(r,e),"onUpdate:selectedScopes":e=>m(r,e),"onUpsert:scope":e=>h(r,e)},null,8,[`environment`,`eventBus`,`flows`,`name`,`options`,`proxyUrl`,`scheme`,`selectedScopes`,`server`,`type`,`onDelete:scope`,`onUpdate:selectedScopes`,`onUpsert:scope`])):B(``,!0)],64))),128))],64)):(F(),I(`div`,MGt,` The security scheme is missing a type, please double check your OpenAPI document or Authentication Configuration `))],64))),128))}})})),FGt,IGt=s((()=>{PGt(),FGt=NGt})),LGt,RGt,zGt,BGt,VGt=s((()=>{JJ(),IGt(),W(),LGt=[`onClick`],RGt={class:`relative z-10 font-medium whitespace-nowrap`},zGt={key:0,class:`absolute inset-x-1 bottom-[var(--scalar-border-width)] left-1/2 z-1 h-px w-full -translate-x-1/2 bg-current`},BGt=N({__name:`RequestAuthDataTable`,props:{environment:{},isStatic:{type:Boolean},selectedSchemeOptions:{},activeAuthIndex:{},proxyUrl:{},securitySchemes:{default:()=>({})},server:{},eventBus:{},meta:{},options:{}},setup(e,{expose:t}){let n=U(()=>e.selectedSchemeOptions[e.activeAuthIndex]),r=U(()=>e.selectedSchemeOptions.length>1),i=t=>e.eventBus.emit(`auth:update:active-index`,{index:t,meta:e.meta}),a=t=>e.eventBus.emit(`auth:update:selected-scopes`,{...t,meta:e.meta}),o=t=>e.eventBus.emit(`auth:upsert:scopes`,t),s=t=>e.eventBus.emit(`auth:delete:scopes`,t),c=t=>e.activeAuthIndex===t;return t({activeScheme:n}),(t,l)=>(F(),I(`form`,{onSubmit:l[0]||=po(()=>{},[`prevent`])},[r.value?(F(),I(`div`,{key:0,class:O([`box-content flex flex-wrap gap-x-2.5 overflow-hidden border-x border-t px-3`,{"border-x-0":!e.isStatic}]),"data-testid":`auth-tabs`},[(F(!0),I(V,null,Ar(e.selectedSchemeOptions,(e,t)=>(F(),I(`div`,{key:e.id,class:`relative z-1 -mb-[var(--scalar-border-width)] flex h-8`},[R(`button`,{class:O([`floating-bg relative cursor-pointer border-b border-transparent py-1 text-sm font-medium transition-colors`,c(t)?`text-c-1`:`text-c-3`]),type:`button`,onClick:e=>i(t)},[R(`span`,RGt,k(e.label),1)],10,LGt),c(t)?(F(),I(`div`,zGt)):B(``,!0)]))),128))],2)):B(``,!0),n.value?(F(),L(j(qJ),{key:1,class:O([`flex-1`,{"bg-b-1 rounded-b-lg border-x border-b":e.isStatic}]),columns:[``],presentational:``},{default:M(()=>[H(FGt,{environment:e.environment,eventBus:e.eventBus,isStatic:e.isStatic,options:e.options,proxyUrl:e.proxyUrl,securitySchemes:e.securitySchemes,selectedSecuritySchemas:n.value.value,server:e.server,"onDelete:scope":s,"onUpdate:selectedScopes":a,"onUpsert:scope":o},null,8,[`environment`,`eventBus`,`isStatic`,`options`,`proxyUrl`,`securitySchemes`,`selectedSecuritySchemas`,`server`])]),_:1},8,[`class`])):(F(),I(`div`,{key:2,class:O([`bg-b-1 text-c-3 flex min-h-16 items-center justify-center border-t px-4 text-sm`,{"min-h-[calc(4rem+0.5px)] rounded-b-lg border":e.isStatic}])},` No authentication selected `,2))],32))}})})),HGt,UGt=s((()=>{VGt(),HGt=BGt})),WGt,GGt,KGt,qGt=s((()=>{hY(),OLt(),MLt(),UGt(),W(),kE(),Ou(),QI(),zE(),dD(),WGt=[`id`],GGt={class:`min-w-0 flex-1 truncate`},KGt=N({__name:`AuthSelector`,props:{environment:{},eventBus:{},createAnySecurityScheme:{type:Boolean,default:!1},defaultOpen:{type:Boolean,default:!0},isStatic:{type:Boolean,default:!1},meta:{},proxyUrl:{},securityRequirements:{},securitySchemes:{},selectedSecurity:{},server:{},title:{},options:{}},setup(e,{expose:t}){let n=Sr(),r=A(null),i=A(!1),a=nE(),o=A(null),s=U(()=>{if(!e.securityRequirements?.length)return null;let t=II(e.securityRequirements);return{icon:t?`Unlock`:`Lock`,text:t?`Optional`:`Required`}}),c=U(()=>jLt(e.securityRequirements??[],e.securitySchemes??{},e.selectedSecurity?.selectedSchemes??[],e.createAnySecurityScheme)),l=U(()=>{let t=e.selectedSecurity?.selectedSchemes;return t?.length?t.flatMap(t=>{let n=Object.keys(t);if(n.length===0)return[];if(n.length>1)return YY(t);let r=n[0];return!r||!RE(e.securitySchemes?.[r])?[]:JY({name:r,value:t})}):[]}),u=e=>{i.value&&e.stopPropagation(),r.value?.$el.click()},d=t=>{let n=t.filter(e=>e.payload===void 0).map(e=>uD(e.value,{depth:2})),r=t.filter(e=>e.payload!==void 0).map(e=>({name:e.label,scheme:e.payload}));e.eventBus.emit(`auth:update:selected-security-schemes`,{selectedRequirements:n,newSchemes:r,meta:e.meta})},f=e=>{o.value={label:e.label,payload:e.value},a.show()},p=()=>{o.value&&(e.eventBus.emit(`auth:delete:security-scheme`,{names:Object.keys(o.value.payload)}),o.value=null,a.hide())};return t({authIndicator:s,selectedSchemeOptions:l,schemeOptions:c}),(t,m)=>(F(),L(j(mY),{class:`group/params relative`,defaultOpen:e.defaultOpen,isStatic:e.isStatic,itemCount:l.value.length,"onUpdate:modelValue":m[1]||=e=>i.value=e},{title:M(()=>[R(`div`,{id:j(n),class:`inline-flex items-center gap-0.5 leading-[20px]`},[R(`span`,null,k(e.title),1),s.value?(F(),I(`span`,{key:0,class:O([`text-c-3 hover:bg-b-3 hover:text-c-1 -my-0.5 -mr-1 cursor-pointer rounded px-1 py-0.5 leading-[normal] font-normal`,{"text-c-1":s.value.text===`Required`}]),"data-testid":`auth-indicator`,onClick:u},k(s.value.text),3)):B(``,!0)],8,WGt)]),actions:M(()=>[H(j(IS),{class:`w-72 text-xs`,modelValue:l.value,multiple:``,options:c.value,placement:`bottom-end`,teleport:``,onDelete:f,"onUpdate:modelValue":d},{option:M(({option:e,selected:t})=>[H(j(oS),{multiselect:``,selected:t},null,8,[`selected`]),R(`div`,GGt,k(e.label),1),e.isDeletable?(F(),L(j(GT),{key:0,class:`-m-0.5 shrink-0 p-0.5 opacity-0 group-hover/item:opacity-100`,icon:j(Tu),label:`Delete ${e.label}`,size:`xs`,onClick:po(t=>f(e),[`stop`])},null,8,[`icon`,`label`,`onClick`])):B(``,!0)]),default:M(()=>[H(j(gf),{ref_key:`comboboxButtonRef`,ref:r,"aria-describedby":j(n),class:`group/combobox-button hover:text-c-1 text-c-2 flex h-fit w-full items-center gap-1 px-0.75 py-0.25 text-base font-normal`,variant:`ghost`},{default:M(()=>[l.value.length===1?(F(),I(V,{key:0},[m[2]||=R(`span`,{class:`sr-only`},`Selected Auth Type:`,-1),z(` `+k(l.value[0]?.label),1)],64)):l.value.length>1?(F(),I(V,{key:1},[m[3]||=z(` Multiple `,-1),m[4]||=R(`span`,{class:`sr-only`},`Auth Types Selected`,-1)],64)):(F(),I(V,{key:2},[m[5]||=R(`span`,{class:`sr-only`},`Select`,-1),m[6]||=z(` Auth Type `,-1)],64)),H(j(tl),{class:`size-3 shrink-0 transition-transform duration-100 group-aria-expanded/combobox-button:rotate-180`,weight:`bold`})]),_:1},8,[`aria-describedby`])]),_:1},8,[`modelValue`,`options`])]),default:M(()=>[H(HGt,{activeAuthIndex:e.selectedSecurity?.selectedIndex??0,environment:e.environment,eventBus:e.eventBus,isStatic:e.isStatic,meta:e.meta,options:e.options,proxyUrl:e.proxyUrl,securitySchemes:e.securitySchemes,selectedSchemeOptions:l.value,server:e.server},null,8,[`activeAuthIndex`,`environment`,`eventBus`,`isStatic`,`meta`,`options`,`proxyUrl`,`securitySchemes`,`selectedSchemeOptions`,`server`]),o.value?(F(),L(DLt,{key:0,label:o.value.label,scheme:o.value,state:j(a),onClose:m[0]||=e=>j(a).hide(),onDelete:p},null,8,[`label`,`scheme`,`state`])):B(``,!0)]),_:1},8,[`defaultOpen`,`isStatic`,`itemCount`]))}})})),n$,JGt=s((()=>{qGt(),n$=KGt})),YGt,XGt,ZGt,QGt,$Gt,eKt,tKt=s((()=>{Sxt(),Nxt(),wIt(),tLt(),oLt(),uLt(),xLt(),SLt(),JGt(),W(),kE(),QI(),Au(),nd(),zE(),dD(),lF(),YGt={class:`group pointer-events-none flex flex-1 items-center gap-1 lg:pr-24`},XGt=[`for`],ZGt=[`id`,`placeholder`,`value`],QGt={key:2,class:`text-c-1 flex h-8 items-center`},$Gt=[`id`,`role`],eKt=N({__name:`RequestBlock`,props:{authMeta:{default:()=>({type:`document`})},clientOptions:{},environment:{},eventBus:{},exampleKey:{},workspaceCookies:{},documentCookies:{},layout:{},method:{},operation:{},path:{},plugins:{},proxyUrl:{},securityRequirements:{},securitySchemes:{},requestBodyCompositionSelection:{},selectedClient:{},selectedSecurity:{},selectedSecuritySchemes:{},server:{},defaultHeaders:{},options:{}},setup(e){let t=U(()=>({method:e.method,path:e.path,exampleKey:e.exampleKey})),n=A({}),r=e=>`${e.in}:${e.name}`,i=e=>n.value[r(e)]??[],a=U(()=>WY(e.operation.parameters?.map(e=>RE(e)).flatMap(t=>bLt(t,e.exampleKey,{hiddenValuePaths:t.in===`query`?i(t):[]}).map(e=>({...e,in:t.in})))??[],`in`,({in:e,...t})=>t)),o=U(()=>WY(a.value.header?.map(e=>({...e,name:e.name.toLowerCase()}))??[],`name`)),s=U(()=>{let t=e.operation[`x-scalar-disable-parameters`]?.[`default-headers`]?.[e.exampleKey]??{},n=e=>{let t=o.value[e.toLowerCase()]?.[0];return t?!t.isDisabled:!1};return Object.entries(e.defaultHeaders).map(([e,r])=>({name:e,value:r,schema:void 0,isOverridden:n(e),isReadonly:!0,isDisabled:t[e.toLowerCase()]??!1}))}),c=U(()=>[...s.value,...a.value.header??[]]),l=U(()=>{let t=dI(e.environment),n=cF(gI({server:e.server,path:e.path}),t),r=e.operation[`x-scalar-disable-parameters`]?.[`global-cookies`]?.[e.exampleKey]??{},i=(e,t)=>({name:e.name,value:e.value,globalRoute:{page:t,path:`cookies`},isReadonly:!0,isDisabled:r[e.name.toLowerCase()]??!1});return[{location:`workspace`,cookies:e.workspaceCookies},{location:`document`,cookies:e.documentCookies}].flatMap(({location:e,cookies:t})=>t.filter(e=>jF({cookie:e,url:n,disabledGlobalCookies:{}})).map(t=>i(t,e)))}),u=U(()=>[...l.value??[],...a.value.cookie??[]]),d=A(`All`),f=[`Auth`,`Variables`,`Cookies`,`Headers`,`Query`,`Body`],p={All:Sr(),Auth:Sr(),Variables:Sr(),Cookies:Sr(),Headers:Sr(),Query:Sr(),Body:Sr()},m=U(()=>{let t=new Set([`All`,...f]);return a.value.path?.length||t.delete(`Variables`),ed(e.method)||t.delete(`Body`),g.value&&t.delete(`Auth`),[...t]}),h=U(()=>Object.fromEntries(m.value.map(e=>[e,p[e]]))),g=U(()=>e.layout===`modal`&&!Object.keys(e.securitySchemes??{}).length),_=U(()=>e.layout!==`modal`||!!(e.securityRequirements?.length||e.selectedSecurity.selectedSchemes.length)),v=U(()=>e.operation.summary?e.operation.summary:e.path.replace(ku.PROTOCOL,``)||`Request Name`),y=e=>d.value===`All`||d.value===e;mr(()=>e.method,e=>{d.value===`Body`&&!ed(e)&&(d.value=`All`)}),mr(()=>[e.method,e.path,e.exampleKey],()=>{n.value={}});let b=n=>{let r=n.target.value;e.eventBus.emit(`operation:update:meta`,{meta:t.value,payload:{summary:r.trim()}})},x=U(()=>({path:LY(`path`,e.eventBus,t.value,{context:a.value.path??[]}),cookie:LY(`cookie`,e.eventBus,t.value,{context:u.value??[],globalParameters:l.value.length}),header:LY(`header`,e.eventBus,t.value,{context:c.value,defaultParameters:s.value.length}),query:LY(`query`,e.eventBus,t.value,{context:a.value.query??[],onDeleteExpandedRow:e=>{if(!e.originalParameter||!e.sourceParameterValuePath)return;let t=r(e.originalParameter);n.value={...n.value,[t]:[...n.value[t]??[],e.sourceParameterValuePath]}}})})),S=n=>e.eventBus.emit(`operation:update:requestBody:contentType`,{payload:{contentType:n.value},meta:t.value}),C=({payload:n,contentType:r})=>{let i=typeof n==`string`?`update:requestBody:value-${r}`:void 0;e.eventBus.emit(`operation:update:requestBody:value`,{payload:n,contentType:r,meta:t.value},{debounceKey:i})},w=({payload:n,contentType:r})=>{let i=`update:requestBody:${r}-form-value`;e.eventBus.emit(`operation:update:requestBody:formValue`,{payload:n.map(e=>uD(e,{depth:1})),contentType:r,meta:t.value},{debounceKey:i})},ee=Sr(),te=U(()=>[...e.workspaceCookies,...e.documentCookies]),ne=n=>e.eventBus.emit(`operation:update:extension`,{payload:n,meta:t.value});return(t,n)=>(F(),L(ER,{"aria-label":`Request: ${e.operation.summary}`},{title:M(()=>[R(`div`,YGt,[e.layout===`modal`?B(``,!0):(F(),I(`label`,{key:0,class:`pointer-events-auto absolute top-0 left-0 h-full w-full cursor-text opacity-0`,for:j(ee)},null,8,XGt)),e.layout===`modal`?(F(),I(`span`,QGt,k(e.operation.summary),1)):(F(),I(`input`,{key:1,id:j(ee),class:`text-c-1 group-hover-input pointer-events-auto relative z-10 -ml-0.5 h-8 w-full rounded pl-1.25 has-[:focus-visible]:outline md:-ml-1.25`,placeholder:v.value,value:e.operation.summary,onBlur:b},null,40,ZGt))]),H(DR,{modelValue:d.value,"onUpdate:modelValue":n[0]||=e=>d.value=e,filterIds:h.value,filters:m.value},null,8,[`modelValue`,`filterIds`,`filters`])]),default:M(()=>[R(`div`,{id:h.value.All,class:`request-section-content custom-scroll relative flex flex-1 flex-col`,role:d.value===`All`?`tabpanel`:`none`},[lr(H(j(n$),{id:h.value.Auth,createAnySecurityScheme:e.layout!==`modal`,defaultOpen:_.value,environment:e.environment,eventBus:e.eventBus,meta:e.authMeta,options:e.options,proxyUrl:e.proxyUrl,securityRequirements:e.securityRequirements,securitySchemes:e.securitySchemes,selectedSecurity:e.selectedSecurity,selectedSecuritySchemes:e.selectedSecuritySchemes,server:e.server,title:`Authentication`},null,8,[`id`,`createAnySecurityScheme`,`defaultOpen`,`environment`,`eventBus`,`meta`,`options`,`proxyUrl`,`securityRequirements`,`securitySchemes`,`selectedSecurity`,`selectedSecuritySchemes`,`server`]),[[Za,y(`Auth`)&&!g.value]]),lr(H(MY,ai({id:h.value.Variables,environment:e.environment,eventBus:e.eventBus,exampleKey:e.exampleKey,rows:a.value.path??[],showAddRowPlaceholder:!1,title:`Variables`},Nr(x.value.path)),null,16,[`id`,`environment`,`eventBus`,`exampleKey`,`rows`]),[[Za,y(`Variables`)&&a.value.path?.length]]),lr(H(MY,ai({id:h.value.Cookies,environment:e.environment,eventBus:e.eventBus,exampleKey:e.exampleKey,rows:u.value??[],showAddRowPlaceholder:!0,title:`Cookies`},Nr(x.value.cookie)),null,16,[`id`,`environment`,`eventBus`,`exampleKey`,`rows`]),[[Za,y(`Cookies`)]]),lr(H(MY,ai({id:h.value.Headers,environment:e.environment,eventBus:e.eventBus,exampleKey:e.exampleKey,rows:c.value??[],title:`Headers`},Nr(x.value.header)),null,16,[`id`,`environment`,`eventBus`,`exampleKey`,`rows`]),[[Za,y(`Headers`)]]),lr(H(MY,ai({id:h.value.Query,environment:e.environment,eventBus:e.eventBus,exampleKey:e.exampleKey,rows:a.value.query??[],title:`Query Parameters`},Nr(x.value.query)),null,16,[`id`,`environment`,`eventBus`,`exampleKey`,`rows`]),[[Za,y(`Query`)]]),lr(H(CIt,{id:h.value.Body,environment:e.environment,exampleKey:e.exampleKey,requestBody:j(RE)(e.operation.requestBody),requestBodyCompositionSelection:e.requestBodyCompositionSelection,title:`Request Body`,"onUpdate:contentType":S,"onUpdate:formValue":w,"onUpdate:value":C},null,8,[`id`,`environment`,`exampleKey`,`requestBody`,`requestBodyCompositionSelection`]),[[Za,y(`Body`)&&j(ed)(e.method)]]),(F(!0),I(V,null,Ar(e.plugins,(t,n)=>(F(),L(j(aC),{key:n},{default:M(()=>[t?.components?.request?lr((F(),L(kr(t.components.request.component),ai({key:0,operation:e.operation},{ref_for:!0},t.components.request.additionalProps,{"onOperation:update:extension":ne}),null,16,[`operation`])),[[Za,d.value===`All`]]):B(``,!0)]),_:2},1024))),128)),n[1]||=R(`div`,{class:`flex grow`},null,-1),lr(H(eLt,{clientOptions:e.clientOptions,eventBus:e.eventBus,globalCookies:te.value,integration:`client`,method:e.method,operation:e.operation,path:e.path,securitySchemes:e.selectedSecuritySchemes,selectedClient:e.selectedClient,selectedContentType:j(RE)(e.operation.requestBody)?.[`x-scalar-selected-content-type`]?.[e.exampleKey],selectedServer:e.server??void 0},null,8,[`clientOptions`,`eventBus`,`globalCookies`,`method`,`operation`,`path`,`securitySchemes`,`selectedClient`,`selectedContentType`,`selectedServer`]),[[Za,d.value===`All`]])],8,$Gt)]),_:1},8,[`aria-label`]))}})})),nKt,rKt=s((()=>{Bc(),tKt(),nKt=zc(eKt,[[`__scopeId`,`data-v-dc6f670a`]])})),iKt,aKt,oKt=s((()=>{XJ(),W(),iKt={class:`flex-1 px-2 py-1.5 whitespace-nowrap`},aKt=N({__name:`DataTableText`,props:{text:{}},setup(e){return(t,n)=>(F(),L(YJ,{class:`relative flex`},{default:M(()=>[R(`span`,iKt,[P(t.$slots,`default`,{},()=>[z(k(e.text),1)])])]),_:3}))}})})),r$,sKt=s((()=>{oKt(),r$=aKt})),cKt,lKt,uKt=s((()=>{W(),cKt=[`href`],lKt=N({__name:`HelpfulLink`,props:{href:{}},setup(e){return(t,n)=>(F(),I(`a`,{class:`decoration-c-3 cursor-help underline underline-offset-2`,href:e.href,rel:`noopener noreferrer`,target:`_blank`},[P(t.$slots,`default`)],8,cKt))}})})),i$,dKt=s((()=>{uKt(),i$=lKt})),fKt,pKt=s((()=>{fKt={accept:{name:`Accept`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept`},"accept-ch":{name:`Accept-CH`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-CH`},"accept-ch-lifetime":{name:`Accept-CH-Lifetime`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-CH-Lifetime`},"accept-charset":{name:`Accept-Charset`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Charset`},"accept-encoding":{name:`Accept-Encoding`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Encoding`},"accept-language":{name:`Accept-Language`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Language`},"accept-patch":{name:`Accept-Patch`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Patch`},"accept-post":{name:`Accept-Post`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Post`},"accept-ranges":{name:`Accept-Ranges`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Ranges`},"access-control-allow-credentials":{name:`Access-Control-Allow-Credentials`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials`},"access-control-allow-headers":{name:`Access-Control-Allow-Headers`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers`},"access-control-allow-methods":{name:`Access-Control-Allow-Methods`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods`},"access-control-allow-origin":{name:`Access-Control-Allow-Origin`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin`},"access-control-expose-headers":{name:`Access-Control-Expose-Headers`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers`},"access-control-max-age":{name:`Access-Control-Max-Age`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age`},"access-control-request-headers":{name:`Access-Control-Request-Headers`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers`},"access-control-request-method":{name:`Access-Control-Request-Method`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Method`},age:{name:`Age`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Age`},allow:{name:`Allow`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Allow`},"alt-svc":{name:`Alt-Svc`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Alt-Svc`},"alt-used":{name:`Alt-Used`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Alt-Used`},authorization:{name:`Authorization`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization`},"cache-control":{name:`Cache-Control`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control`},"clear-site-data":{name:`Clear-Site-Data`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data`},connection:{name:`Connection`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Connection`},"content-disposition":{name:`Content-Disposition`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition`},"content-dpr":{name:`Content-DPR`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-DPR`},"content-encoding":{name:`Content-Encoding`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Encoding`},"content-language":{name:`Content-Language`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Language`},"content-length":{name:`Content-Length`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Length`},"content-location":{name:`Content-Location`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Location`},"content-range":{name:`Content-Range`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Range`},"content-security-policy":{name:`Content-Security-Policy`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy`},"content-security-policy-report-only":{name:`Content-Security-Policy-Report-Only`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only`},"content-type":{name:`Content-Type`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type`},cookie:{name:`Cookie`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cookie`},"critical-ch":{name:`Critical-CH`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Critical-CH`},"cross-origin-embedder-policy":{name:`Cross-Origin-Embedder-Policy`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy`},"cross-origin-opener-policy":{name:`Cross-Origin-Opener-Policy`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy`},"cross-origin-resource-policy":{name:`Cross-Origin-Resource-Policy`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy`},date:{name:`Date`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Date`},"device-memory":{name:`Device-Memory`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Device-Memory`},digest:{name:`Digest`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Digest`},dnt:{name:`DNT`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT`},downlink:{name:`Downlink`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Downlink`},dpr:{name:`DPR`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DPR`},"early-data":{name:`Early-Data`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Early-Data`},ect:{name:`ECT`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ECT`},etag:{name:`ETag`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag`},expect:{name:`Expect`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect`},"expect-ct":{name:`Expect-CT`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT`},expires:{name:`Expires`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expires`},forwarded:{name:`Forwarded`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded`},from:{name:`From`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/From`},host:{name:`Host`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Host`},"if-match":{name:`If-Match`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Match`},"if-modified-since":{name:`If-Modified-Since`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Modified-Since`},"if-none-match":{name:`If-None-Match`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-None-Match`},"if-range":{name:`If-Range`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Range`},"if-unmodified-since":{name:`If-Unmodified-Since`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Unmodified-Since`},"keep-alive":{name:`Keep-Alive`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Keep-Alive`},"large-allocation":{name:`Large-Allocation`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Large-Allocation`},"last-modified":{name:`Last-Modified`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Last-Modified`},link:{name:`Link`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Link`},location:{name:`Location`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Location`},"max-forwards":{name:`Max-Forwards`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Max-Forwards`},nel:{name:`NEL`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/NEL`},origin:{name:`Origin`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin`},"permissions-policy":{name:`Permissions-Policy`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy`},pragma:{name:`Pragma`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Pragma`},"proxy-authenticate":{name:`Proxy-Authenticate`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Proxy-Authenticate`},"proxy-authorization":{name:`Proxy-Authorization`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Proxy-Authorization`},range:{name:`Range`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Range`},referer:{name:`Referer`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer`},"referrer-policy":{name:`Referrer-Policy`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy`},"retry-after":{name:`Retry-After`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Retry-After`},rtt:{name:`RTT`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/RTT`},"save-data":{name:`Save-Data`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Save-Data`},"sec-ch-prefers-reduced-motion":{name:`Sec-CH-Prefers-Reduced-Motion`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-CH-Prefers-Reduced-Motion`},"sec-ch-prefers-reduced-transparency":{name:`Sec-CH-Prefers-Reduced-Transparency`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-CH-Prefers-Reduced-Transparency`},"sec-ch-ua":{name:`Sec-CH-UA`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-CH-UA`},"sec-ch-ua-arch":{name:`Sec-CH-UA-Arch`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-CH-UA-Arch`},"sec-ch-ua-bitness":{name:`Sec-CH-UA-Bitness`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-CH-UA-Bitness`},"sec-ch-ua-full-version":{name:`Sec-CH-UA-Full-Version`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-CH-UA-Full-Version`},"sec-ch-ua-full-version-list":{name:`Sec-CH-UA-Full-Version-List`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-CH-UA-Full-Version-List`},"sec-ch-ua-mobile":{name:`Sec-CH-UA-Mobile`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-CH-UA-Mobile`},"sec-ch-ua-model":{name:`Sec-CH-UA-Model`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-CH-UA-Model`},"sec-ch-ua-platform":{name:`Sec-CH-UA-Platform`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-CH-UA-Platform`},"sec-ch-ua-platform-version":{name:`Sec-CH-UA-Platform-Version`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-CH-UA-Platform-Version`},"sec-fetch-dest":{name:`Sec-Fetch-Dest`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Dest`},"sec-fetch-mode":{name:`Sec-Fetch-Mode`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Mode`},"sec-fetch-site":{name:`Sec-Fetch-Site`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Site`},"sec-fetch-user":{name:`Sec-Fetch-User`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-User`},"sec-gpc":{name:`Sec-GPC`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-GPC`},"sec-purpose":{name:`Sec-Purpose`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Purpose`},"sec-websocket-accept":{name:`Sec-WebSocket-Accept`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-WebSocket-Accept`},server:{name:`Server`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Server`},"server-timing":{name:`Server-Timing`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Server-Timing`},"service-worker-navigation-preload":{name:`Service-Worker-Navigation-Preload`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Service-Worker-Navigation-Preload`},"set-cookie":{name:`Set-Cookie`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie`},sourcemap:{name:`SourceMap`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/SourceMap`},"strict-transport-security":{name:`Strict-Transport-Security`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security`},te:{name:`TE`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/TE`},"timing-allow-origin":{name:`Timing-Allow-Origin`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Timing-Allow-Origin`},tk:{name:`Tk`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Tk`},trailer:{name:`Trailer`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Trailer`},"transfer-encoding":{name:`Transfer-Encoding`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Transfer-Encoding`},upgrade:{name:`Upgrade`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Upgrade`},"upgrade-insecure-requests":{name:`Upgrade-Insecure-Requests`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Upgrade-Insecure-Requests`},"user-agent":{name:`User-Agent`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/User-Agent`},vary:{name:`Vary`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Vary`},via:{name:`Via`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Via`},"viewport-width":{name:`Viewport-Width`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Viewport-Width`},"want-digest":{name:`Want-Digest`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Want-Digest`},warning:{name:`Warning`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Warning`},width:{name:`Width`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Width`},"www-authenticate":{name:`WWW-Authenticate`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/WWW-Authenticate`},"x-content-type-options":{name:`X-Content-Type-Options`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options`},"x-dns-prefetch-control":{name:`X-DNS-Prefetch-Control`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control`},"x-forwarded-for":{name:`X-Forwarded-For`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For`},"x-forwarded-host":{name:`X-Forwarded-Host`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host`},"x-forwarded-proto":{name:`X-Forwarded-Proto`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto`},"x-frame-options":{name:`X-Frame-Options`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options`},"x-xss-protection":{name:`X-XSS-Protection`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection`},"cf-cache-status":{name:`Cf-Cache-Status`,url:`https://developers.cloudflare.com/cache/concepts/default-cache-behavior/#cloudflare-cache-responses`},"cf-ray":{name:`Cf-Ray`,url:`https://developers.cloudflare.com/fundamentals/get-started/reference/http-request-headers/#cf-ray`},"report-to":{name:`Report-To`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-to`},"x-cloud-trace-context":{name:`X-Cloud-Trace-Context`,url:`https://cloud.google.com/trace/docs/trace-context#legacy-http-header`},"speculation-rules":{name:`Speculation-Rules`,url:`https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Speculation-Rules`}}})),mKt,hKt,gKt,_Kt=s((()=>{JJ(),QJ(),eY(),sKt(),hY(),dKt(),W(),pKt(),mKt={key:0,class:`max-h-[calc(100%-32px)] overflow-y-auto`},hKt={key:1,class:`text-c-3 bg-b-1 flex min-h-[64px] items-center justify-center border-t px-4 text-sm`},gKt=N({__name:`Headers`,props:{headers:{}},setup(e){let t=e=>fKt[e.toLowerCase()];return(n,r)=>(F(),L(j(mY),{class:`overflow-auto`,defaultOpen:!1,itemCount:e.headers.length},{title:M(()=>[P(n.$slots,`title`)]),default:M(()=>[e.headers.length?(F(),I(`div`,mKt,[H(j(qJ),{columns:[`minmax(auto, min-content)`,`minmax(50%, 1fr)`],scroll:``},{default:M(()=>[H(j($J),{class:`sr-only !block`},{default:M(()=>[H(j(ZJ),null,{default:M(()=>[...r[0]||=[z(`Header Key`,-1)]]),_:1}),H(j(ZJ),null,{default:M(()=>[...r[1]||=[z(`Header Value`,-1)]]),_:1})]),_:1}),(F(!0),I(V,null,Ar(e.headers,e=>(F(),L(j($J),{key:e.name,class:`group/row text-c-1`},{default:M(()=>[H(j(r$),{class:`bg-b-1 sticky left-0 z-1 max-w-full group-first/row:border-t-0`},{default:M(()=>[typeof t(e.name)?.url==`string`?(F(),L(i$,{key:0,class:`decoration-c-3`,href:t(e.name).url},{default:M(()=>[z(k(e.name),1)]),_:2},1032,[`href`])):(F(),I(V,{key:1},[z(k(e.name),1)],64))]),_:2},1024),H(j(r$),{class:`z-0 group-first/row:border-t-0`,text:e.value},null,8,[`text`])]),_:2},1024))),128))]),_:1})])):(F(),I(`div`,hKt,` No headers `))]),_:3},8,[`itemCount`]))}})})),a$,vKt=s((()=>{_Kt(),a$=gKt}));function yKt(e){let t=``;if(e){let n=e.match(/filename\*=UTF-8''([^;]+)/)?.[1]??e.match(/filename\s*=\s*"?([^";]+)"?/)?.[1];n&&(t=bKt(n.trim()))}return t}var bKt,xKt=s((()=>{bKt=e=>{try{return decodeURIComponent(e)}catch{return e}}}));function SKt({data:e,headers:t}){let n=Ku(t.find(e=>e.name.toLowerCase()===`content-type`)?.value);return{mimeType:n,attachmentFilename:yKt(t.find(e=>e.name.toLowerCase()===`content-disposition`)?.value??``),dataUrl:CKt(e)?URL.createObjectURL(e):typeof e==`string`?URL.createObjectURL(new Blob([e],{type:n?n.toString():void 0})):e instanceof Object&&Object.keys(e).length?URL.createObjectURL(new Blob([JSON.stringify(e)],{type:n?n.toString():void 0})):``}}var CKt,wKt=s((()=>{Yhe(),xKt(),CKt=e=>e instanceof Blob})),TKt,EKt,DKt=s((()=>{Yu(),W(),kE(),TKt=[`download`,`href`],EKt=N({__name:`ResponseBodyDownload`,props:{href:{},type:{},filename:{}},setup(e){let t=e,n=U(()=>{let e=qu(t.type??``)?.extension??`.unknown`;return t.filename?t.filename:`response${e}`});return(t,r)=>(F(),I(`a`,{class:`text-c-3 text-xxs hover:bg-b-3 flex items-center gap-1 rounded px-1.5 py-0.5 no-underline`,download:`${n.value}`,href:e.href,onClick:r[0]||=po(()=>{},[`stop`])},[H(j(jT),{icon:`Download`,size:`xs`}),r[1]||=R(`span`,null,[R(`span`,null,`Download`),R(`span`,{class:`sr-only`},`Response Body`)],-1)],8,TKt))}})})),o$,OKt=s((()=>{DKt(),o$=EKt}));function kKt(e,t){return F(),I(`div`,jKt,[R(`div`,MKt,[P(e.$slots,`default`)])])}var AKt,jKt,MKt,s$,NKt=s((()=>{Bc(),W(),AKt={},jKt={class:`flex justify-center px-2 py-3`},MKt={class:`text-c-3 p-2 text-sm`},s$=zc(AKt,[[`render`,kKt]])}));function PKt(e,t=!1){let n=e.length,r=0,i=``,a=0,o=16,s=0,c=0,l=0,u=0,d=0;function f(t,n){let i=0,a=0;for(;i<t||!n;){let t=e.charCodeAt(r);if(t>=48&&t<=57)a=a*16+t-48;else if(t>=65&&t<=70)a=a*16+t-65+10;else if(t>=97&&t<=102)a=a*16+t-97+10;else break;r++,i++}return i<t&&(a=-1),a}function p(e){r=e,i=``,a=0,o=16,d=0}function m(){let t=r;if(e.charCodeAt(r)===48)r++;else for(r++;r<e.length&&u$(e.charCodeAt(r));)r++;if(r<e.length&&e.charCodeAt(r)===46)if(r++,r<e.length&&u$(e.charCodeAt(r)))for(r++;r<e.length&&u$(e.charCodeAt(r));)r++;else return d=3,e.substring(t,r);let n=r;if(r<e.length&&(e.charCodeAt(r)===69||e.charCodeAt(r)===101))if(r++,(r<e.length&&e.charCodeAt(r)===43||e.charCodeAt(r)===45)&&r++,r<e.length&&u$(e.charCodeAt(r))){for(r++;r<e.length&&u$(e.charCodeAt(r));)r++;n=r}else d=3;return e.substring(t,n)}function h(){let t=``,i=r;for(;;){if(r>=n){t+=e.substring(i,r),d=2;break}let a=e.charCodeAt(r);if(a===34){t+=e.substring(i,r),r++;break}if(a===92){if(t+=e.substring(i,r),r++,r>=n){d=2;break}switch(e.charCodeAt(r++)){case 34:t+=`"`;break;case 92:t+=`\\`;break;case 47:t+=`/`;break;case 98:t+=`\b`;break;case 102:t+=`\f`;break;case 110:t+=`
-`;break;case 114:t+=`\r`;break;case 116:t+=`	`;break;case 117:let e=f(4,!0);e>=0?t+=String.fromCharCode(e):d=4;break;default:d=5}i=r;continue}if(a>=0&&a<=31)if(l$(a)){t+=e.substring(i,r),d=2;break}else d=6;r++}return t}function g(){if(i=``,d=0,a=r,c=s,u=l,r>=n)return a=n,o=17;let t=e.charCodeAt(r);if(c$(t)){do r++,i+=String.fromCharCode(t),t=e.charCodeAt(r);while(c$(t));return o=15}if(l$(t))return r++,i+=String.fromCharCode(t),t===13&&e.charCodeAt(r)===10&&(r++,i+=`
-`),s++,l=r,o=14;switch(t){case 123:return r++,o=1;case 125:return r++,o=2;case 91:return r++,o=3;case 93:return r++,o=4;case 58:return r++,o=6;case 44:return r++,o=5;case 34:return r++,i=h(),o=10;case 47:let c=r-1;if(e.charCodeAt(r+1)===47){for(r+=2;r<n&&!l$(e.charCodeAt(r));)r++;return i=e.substring(c,r),o=12}if(e.charCodeAt(r+1)===42){r+=2;let t=n-1,a=!1;for(;r<t;){let t=e.charCodeAt(r);if(t===42&&e.charCodeAt(r+1)===47){r+=2,a=!0;break}r++,l$(t)&&(t===13&&e.charCodeAt(r)===10&&r++,s++,l=r)}return a||(r++,d=1),i=e.substring(c,r),o=13}return i+=String.fromCharCode(t),r++,o=16;case 45:if(i+=String.fromCharCode(t),r++,r===n||!u$(e.charCodeAt(r)))return o=16;case 48:case 49:case 50:case 51:case 52:case 53:case 54:case 55:case 56:case 57:return i+=m(),o=11;default:for(;r<n&&_(t);)r++,t=e.charCodeAt(r);if(a!==r){switch(i=e.substring(a,r),i){case`true`:return o=8;case`false`:return o=9;case`null`:return o=7}return o=16}return i+=String.fromCharCode(t),r++,o=16}}function _(e){if(c$(e)||l$(e))return!1;switch(e){case 125:case 93:case 123:case 91:case 34:case 58:case 44:case 47:return!1}return!0}function v(){let e;do e=g();while(e>=12&&e<=15);return e}return{setPosition:p,getPosition:()=>r,scan:t?v:g,getToken:()=>o,getTokenValue:()=>i,getTokenOffset:()=>a,getTokenLength:()=>r-a,getTokenStartLine:()=>c,getTokenStartCharacter:()=>a-u,getTokenError:()=>d}}function c$(e){return e===32||e===9}function l$(e){return e===10||e===13}function u$(e){return e>=48&&e<=57}var FKt,d$=s((()=>{(function(e){e[e.lineFeed=10]=`lineFeed`,e[e.carriageReturn=13]=`carriageReturn`,e[e.space=32]=`space`,e[e._0=48]=`_0`,e[e._1=49]=`_1`,e[e._2=50]=`_2`,e[e._3=51]=`_3`,e[e._4=52]=`_4`,e[e._5=53]=`_5`,e[e._6=54]=`_6`,e[e._7=55]=`_7`,e[e._8=56]=`_8`,e[e._9=57]=`_9`,e[e.a=97]=`a`,e[e.b=98]=`b`,e[e.c=99]=`c`,e[e.d=100]=`d`,e[e.e=101]=`e`,e[e.f=102]=`f`,e[e.g=103]=`g`,e[e.h=104]=`h`,e[e.i=105]=`i`,e[e.j=106]=`j`,e[e.k=107]=`k`,e[e.l=108]=`l`,e[e.m=109]=`m`,e[e.n=110]=`n`,e[e.o=111]=`o`,e[e.p=112]=`p`,e[e.q=113]=`q`,e[e.r=114]=`r`,e[e.s=115]=`s`,e[e.t=116]=`t`,e[e.u=117]=`u`,e[e.v=118]=`v`,e[e.w=119]=`w`,e[e.x=120]=`x`,e[e.y=121]=`y`,e[e.z=122]=`z`,e[e.A=65]=`A`,e[e.B=66]=`B`,e[e.C=67]=`C`,e[e.D=68]=`D`,e[e.E=69]=`E`,e[e.F=70]=`F`,e[e.G=71]=`G`,e[e.H=72]=`H`,e[e.I=73]=`I`,e[e.J=74]=`J`,e[e.K=75]=`K`,e[e.L=76]=`L`,e[e.M=77]=`M`,e[e.N=78]=`N`,e[e.O=79]=`O`,e[e.P=80]=`P`,e[e.Q=81]=`Q`,e[e.R=82]=`R`,e[e.S=83]=`S`,e[e.T=84]=`T`,e[e.U=85]=`U`,e[e.V=86]=`V`,e[e.W=87]=`W`,e[e.X=88]=`X`,e[e.Y=89]=`Y`,e[e.Z=90]=`Z`,e[e.asterisk=42]=`asterisk`,e[e.backslash=92]=`backslash`,e[e.closeBrace=125]=`closeBrace`,e[e.closeBracket=93]=`closeBracket`,e[e.colon=58]=`colon`,e[e.comma=44]=`comma`,e[e.dot=46]=`dot`,e[e.doubleQuote=34]=`doubleQuote`,e[e.minus=45]=`minus`,e[e.openBrace=123]=`openBrace`,e[e.openBracket=91]=`openBracket`,e[e.plus=43]=`plus`,e[e.slash=47]=`slash`,e[e.formFeed=12]=`formFeed`,e[e.tab=9]=`tab`})(FKt||={})})),f$,p$,m$,IKt,LKt=s((()=>{f$=Array(20).fill(0).map((e,t)=>` `.repeat(t)),p$=200,m$={" ":{"\n":Array(p$).fill(0).map((e,t)=>`
-`+` `.repeat(t)),"\r":Array(p$).fill(0).map((e,t)=>`\r`+` `.repeat(t)),"\r\n":Array(p$).fill(0).map((e,t)=>`\r
-`+` `.repeat(t))},"	":{"\n":Array(p$).fill(0).map((e,t)=>`
-`+`	`.repeat(t)),"\r":Array(p$).fill(0).map((e,t)=>`\r`+`	`.repeat(t)),"\r\n":Array(p$).fill(0).map((e,t)=>`\r
-`+`	`.repeat(t))}},IKt=[`
-`,`\r`,`\r
-`]}));function RKt(e,t,n){let r,i,a,o,s;if(t){for(o=t.offset,s=o+t.length,a=o;a>0&&!VKt(e,a-1);)a--;let c=s;for(;c<e.length&&!VKt(e,c);)c++;i=e.substring(a,c),r=zKt(i,n)}else i=e,r=0,a=0,o=0,s=e.length;let c=BKt(n,e),l=IKt.includes(c),u=0,d=0,f;f=n.insertSpaces?f$[n.tabSize||4]??h$(f$[1],n.tabSize||4):`	`;let p=f===`	`?`	`:` `,m=PKt(i,!1),h=!1;function g(){if(u>1)return h$(c,u)+h$(f,r+d);let e=f.length*(r+d);return!l||e>m$[p][c].length?c+h$(f,r+d):e<=0?c:m$[p][c][e]}function _(){let e=m.scan();for(u=0;e===15||e===14;)e===14&&n.keepLines?u+=1:e===14&&(u=1),e=m.scan();return h=e===16||m.getTokenError()!==0,e}let v=[];function y(n,r,i){!h&&(!t||r<s&&i>o)&&e.substring(r,i)!==n&&v.push({offset:r,length:i-r,content:n})}let b=_();if(n.keepLines&&u>0&&y(h$(c,u),0,0),b!==17){let e=m.getTokenOffset()+a;y(f.length*r<20&&n.insertSpaces?f$[f.length*r]:h$(f,r),a,e)}for(;b!==17;){let e=m.getTokenOffset()+m.getTokenLength()+a,t=_(),r=``,i=!1;for(;u===0&&(t===12||t===13);){let n=m.getTokenOffset()+a;y(f$[1],e,n),e=m.getTokenOffset()+m.getTokenLength()+a,i=t===12,r=i?g():``,t=_()}if(t===2)b!==1&&d--,n.keepLines&&u>0||!n.keepLines&&b!==1?r=g():n.keepLines&&(r=f$[1]);else if(t===4)b!==3&&d--,n.keepLines&&u>0||!n.keepLines&&b!==3?r=g():n.keepLines&&(r=f$[1]);else{switch(b){case 3:case 1:d++,r=n.keepLines&&u>0||!n.keepLines?g():f$[1];break;case 5:r=n.keepLines&&u>0||!n.keepLines?g():f$[1];break;case 12:r=g();break;case 13:u>0?r=g():i||(r=f$[1]);break;case 6:n.keepLines&&u>0?r=g():i||(r=f$[1]);break;case 10:n.keepLines&&u>0?r=g():t===6&&!i&&(r=``);break;case 7:case 8:case 9:case 11:case 2:case 4:n.keepLines&&u>0?r=g():(t===12||t===13)&&!i?r=f$[1]:t!==5&&t!==17&&(h=!0);break;case 16:h=!0;break}u>0&&(t===12||t===13)&&(r=g())}t===17&&(r=n.keepLines&&u>0?g():n.insertFinalNewline?c:``);let o=m.getTokenOffset()+a;y(r,e,o),b=t}return v}function h$(e,t){let n=``;for(let r=0;r<t;r++)n+=e;return n}function zKt(e,t){let n=0,r=0,i=t.tabSize||4;for(;n<e.length;){let t=e.charAt(n);if(t===f$[1])r++;else if(t===`	`)r+=i;else break;n++}return Math.floor(r/i)}function BKt(e,t){for(let e=0;e<t.length;e++){let n=t.charAt(e);if(n===`\r`)return e+1<t.length&&t.charAt(e+1)===`
-`?`\r
-`:`\r`;if(n===`
-`)return`
-`}return e&&e.eol||`
-`}function VKt(e,t){return`\r
-`.indexOf(e.charAt(t))!==-1}var HKt=s((()=>{d$(),LKt()}));function UKt(e){if(!e.parent||!e.parent.children)return[];let t=UKt(e.parent);if(e.parent.type===`property`){let n=e.parent.children[0].value;t.push(n)}else if(e.parent.type===`array`){let n=e.parent.children.indexOf(e);n!==-1&&t.push(n)}return t}function WKt(e){switch(e.type){case`array`:return e.children.map(WKt);case`object`:let t=Object.create(null);for(let n of e.children){let e=n.children[1];e&&(t[n.children[0].value]=WKt(e))}return t;case`null`:case`string`:case`number`:case`boolean`:return e.value;default:return}}function GKt(e,t,n=!1){return t>=e.offset&&t<e.offset+e.length||n&&t===e.offset+e.length}function KKt(e,t,n=!1){if(GKt(e,t,n)){let r=e.children;if(Array.isArray(r))for(let e=0;e<r.length&&r[e].offset<=t;e++){let i=KKt(r[e],t,n);if(i)return i}return e}}var qKt,JKt=s((()=>{d$(),(function(e){e.DEFAULT={allowTrailingComma:!1}})(qKt||={})}));function YKt(e,t){return e.substring(0,t.offset)+t.content+e.substring(t.offset+t.length)}var XKt=s((()=>{HKt(),JKt()}));function ZKt(e,t,n){return RKt(e,t,n)}function QKt(e,t){let n=t.slice(0).sort((e,t)=>{let n=e.offset-t.offset;return n===0?e.length-t.length:n}),r=e.length;for(let t=n.length-1;t>=0;t--){let i=n[t];if(i.offset+i.length<=r)e=YKt(e,i);else throw Error(`Overlapping edit`);r=i.offset}return e}var $Kt,eqt,tqt,nqt=s((()=>{HKt(),XKt(),d$(),JKt(),(function(e){e[e.None=0]=`None`,e[e.UnexpectedEndOfComment=1]=`UnexpectedEndOfComment`,e[e.UnexpectedEndOfString=2]=`UnexpectedEndOfString`,e[e.UnexpectedEndOfNumber=3]=`UnexpectedEndOfNumber`,e[e.InvalidUnicode=4]=`InvalidUnicode`,e[e.InvalidEscapeCharacter=5]=`InvalidEscapeCharacter`,e[e.InvalidCharacter=6]=`InvalidCharacter`})($Kt||={}),(function(e){e[e.OpenBraceToken=1]=`OpenBraceToken`,e[e.CloseBraceToken=2]=`CloseBraceToken`,e[e.OpenBracketToken=3]=`OpenBracketToken`,e[e.CloseBracketToken=4]=`CloseBracketToken`,e[e.CommaToken=5]=`CommaToken`,e[e.ColonToken=6]=`ColonToken`,e[e.NullKeyword=7]=`NullKeyword`,e[e.TrueKeyword=8]=`TrueKeyword`,e[e.FalseKeyword=9]=`FalseKeyword`,e[e.StringLiteral=10]=`StringLiteral`,e[e.NumericLiteral=11]=`NumericLiteral`,e[e.LineCommentTrivia=12]=`LineCommentTrivia`,e[e.BlockCommentTrivia=13]=`BlockCommentTrivia`,e[e.LineBreakTrivia=14]=`LineBreakTrivia`,e[e.Trivia=15]=`Trivia`,e[e.Unknown=16]=`Unknown`,e[e.EOF=17]=`EOF`})(eqt||={}),(function(e){e[e.InvalidSymbol=1]=`InvalidSymbol`,e[e.InvalidNumberFormat=2]=`InvalidNumberFormat`,e[e.PropertyNameExpected=3]=`PropertyNameExpected`,e[e.ValueExpected=4]=`ValueExpected`,e[e.ColonExpected=5]=`ColonExpected`,e[e.CommaExpected=6]=`CommaExpected`,e[e.CloseBraceExpected=7]=`CloseBraceExpected`,e[e.CloseBracketExpected=8]=`CloseBracketExpected`,e[e.EndOfFileExpected=9]=`EndOfFileExpected`,e[e.InvalidCommentToken=10]=`InvalidCommentToken`,e[e.UnexpectedEndOfComment=11]=`UnexpectedEndOfComment`,e[e.UnexpectedEndOfString=12]=`UnexpectedEndOfString`,e[e.UnexpectedEndOfNumber=13]=`UnexpectedEndOfNumber`,e[e.InvalidUnicode=14]=`InvalidUnicode`,e[e.InvalidEscapeCharacter=15]=`InvalidEscapeCharacter`,e[e.InvalidCharacter=16]=`InvalidCharacter`})(tqt||={})}));function rqt(e){try{let t=ZKt(e,void 0,iqt);if(t.length>0)return QKt(e,t)}catch{}return e}var iqt,aqt=s((()=>{nqt(),iqt={tabSize:2,insertSpaces:!0,eol:`
-`}})),oqt,sqt,cqt,lqt=s((()=>{aqt(),W(),kE(),WJ(),oqt={class:`scalar-code-block group/code-block relative grid min-h-0 overflow-hidden p-px outline-none has-focus-visible:outline`,"data-testid":`response-body-raw`},sqt={class:`custom-scroll relative pr-1`,tabindex:`0`},cqt=N({__name:`ResponseBodyRaw`,props:{content:{},language:{},prettyPrintJson:{type:Boolean}},setup(e){let t=e,n=A(null),r=Sr(),{codeMirror:i}=HJ({codeMirrorRef:n,readOnly:!0,lineNumbers:!0,content:wn(U(()=>{let{content:e,language:n,prettyPrintJson:r=!1}=t;return typeof e==`string`?r&&n===`json`?rqt(e):e:e==null?``:String(e)})),language:wn(()=>t.language),forceFoldGutter:!0}),a=()=>i.value?.state.doc.toString()||``;return(e,t)=>(F(),I(`div`,oqt,[R(`div`,sqt,[R(`div`,{ref_key:`codeMirrorRef`,ref:n},null,512)]),a()?(F(),L(j($f),{key:0,"aria-controls":j(r),class:`absolute top-2 right-2`,content:a()},null,8,[`aria-controls`,`content`])):B(``,!0)]))}})})),g$,uqt=s((()=>{Bc(),lqt(),g$=zc(cqt,[[`__scopeId`,`data-v-20050fd6`]])})),dqt,fqt,pqt,mqt,hqt,gqt=s((()=>{NKt(),uqt(),W(),dqt=[`src`],fqt=[`src`,`type`],pqt=[`src`,`type`],mqt=[`data`,`type`],hqt=N({__name:`ResponseBodyPreview`,props:{src:{},type:{},mode:{},alpha:{type:Boolean,default:!1},content:{}},setup(e){let t=U(()=>{let t=e.content;return typeof t==`string`?t:t==null?``:String(t)}),n=A(!1);return mr(()=>e.src,()=>n.value=!1),(r,i)=>e.mode===`json`?(F(),L(g$,{key:0,content:t.value,language:`json`,prettyPrintJson:``},null,8,[`content`])):!n.value&&e.src?(F(),I(`div`,{key:1,class:O([`flex justify-center overflow-auto rounded-b`,{"bg-preview p-2":e.alpha}])},[e.mode===`image`?(F(),I(`img`,{key:0,class:O([`h-full max-w-full`,{rounded:e.alpha}]),src:e.src,onError:i[0]||=e=>n.value=!0},null,42,dqt)):e.mode===`video`?(F(),I(`video`,{key:1,autoplay:``,controls:``,width:`100%`,onError:i[1]||=e=>n.value=!0},[R(`source`,{src:e.src,type:e.type},null,8,fqt)],32)):e.mode===`audio`?(F(),I(`audio`,{key:2,class:`my-12`,controls:``,onError:i[2]||=e=>n.value=!0},[R(`source`,{src:e.src,type:e.type},null,8,pqt)],32)):(F(),I(`object`,{key:3,class:`aspect-[4/3] w-full`,data:e.src,type:e.type,onError:i[3]||=e=>n.value=!0},null,40,mqt))],2)):(F(),L(s$,{key:2},{default:M(()=>[...i[4]||=[z(`Preview unavailable`,-1)]]),_:1}))}})})),_qt,vqt=s((()=>{Bc(),gqt(),_qt=zc(hqt,[[`__scopeId`,`data-v-65a8f4ce`]])})),yqt,bqt,xqt=s((()=>{W(),yqt={class:`text-c-3 text-xxs -my-1 flex justify-center gap-0.5 rounded p-0.5`},bqt=N({__name:`ResponseBodyToggle`,props:{modelValue:{type:Boolean}},emits:[`update:modelValue`],setup(e){return(t,n)=>(F(),I(`div`,yqt,[R(`button`,{class:O([`hover:bg-b-3 rounded px-1`,{"bg-b-3 text-c-1 cursor-default":e.modelValue}]),type:`button`,onClick:n[0]||=po(e=>t.$emit(`update:modelValue`,!0),[`stop`])},` Preview `,2),R(`button`,{class:O([`hover:bg-b-3 rounded px-1`,{"bg-b-3 text-c-1 cursor-default":!e.modelValue}]),type:`button`,onClick:n[1]||=po(e=>t.$emit(`update:modelValue`,!1),[`stop`])},` Raw `,2)]))}})})),Sqt,Cqt=s((()=>{xqt(),Sqt=bqt})),wqt,Tqt,Eqt,Dqt,Oqt=s((()=>{Khe(),Yu(),hY(),wKt(),OKt(),NKt(),uqt(),vqt(),Cqt(),W(),wqt={key:0,class:`bg-b-1 flex max-h-[calc(100%-32px)] flex-col overflow-hidden`},Tqt={class:`box-content flex min-h-8 items-center justify-between border-y px-3`},Eqt={class:`text-xxs font-code leading-5`},Dqt=N({__name:`ResponseBody`,props:{title:{},layout:{},data:{},headers:{},plugins:{default:()=>[]}},setup(e){let t=A(!0),n=U(()=>SKt({data:e.data,headers:e.headers})),r=U(()=>n.value.mimeType.essence),i=U(()=>qu(r.value)),a=U(()=>Bu(r.value,e.plugins)),o=U(()=>!!a.value?.rawComponent||!!a.value?.decode||!!i.value?.raw),s=U(()=>!!a.value?.previewComponent||!!i.value?.preview),c=U(()=>o.value&&s.value),l=U(()=>t.value||!c.value),u=U(()=>!t.value||!c.value),d=U(()=>a.value?.language??i.value?.language);return(f,p)=>(F(),L(j(mY),{class:`max-h-content overflow-y-hidden`,isStatic:e.layout===`reference`},jr({title:M(()=>[z(k(e.title),1)]),default:M(()=>[e.data?(F(),I(`div`,wqt,[R(`div`,Tqt,[R(`span`,Eqt,k(r.value),1),c.value?(F(),L(Sqt,{key:0,modelValue:t.value,"onUpdate:modelValue":p[0]||=e=>t.value=e},null,8,[`modelValue`])):B(``,!0)]),a.value?.previewComponent&&s.value&&l.value?(F(),L(kr(a.value.previewComponent),{key:`plugin-preview-${n.value.dataUrl}`,content:e.data,contentType:r.value,dataUrl:n.value.dataUrl},null,8,[`content`,`contentType`,`dataUrl`])):i.value?.preview&&l.value?(F(),L(_qt,{key:`preview-${n.value.dataUrl}`,alpha:i.value.alpha,content:e.data,mode:i.value.preview,src:n.value.dataUrl,type:r.value},null,8,[`alpha`,`content`,`mode`,`src`,`type`])):B(``,!0),a.value?.rawComponent&&o.value&&u.value?(F(),L(kr(a.value.rawComponent),{key:`plugin-raw-${n.value.dataUrl}`,content:e.data,contentType:r.value},null,8,[`content`,`contentType`])):o.value&&u.value&&!a.value?.rawComponent?(F(),L(g$,{key:`raw-${n.value.dataUrl}`,content:e.data,language:d.value},null,8,[`content`,`language`])):B(``,!0),!o.value&&!s.value?(F(),L(s$,{key:4},{default:M(()=>[...p[1]||=[z(` Binary file `,-1)]]),_:1})):B(``,!0)])):B(``,!0)]),_:2},[e.data&&n.value.dataUrl?{name:`actions`,fn:M(()=>[H(o$,{filename:n.value.attachmentFilename,href:n.value.dataUrl,type:n.value.mimeType?.essence},null,8,[`filename`,`href`,`type`])]),key:`0`}:void 0]),1032,[`isStatic`]))}})})),kqt,Aqt=s((()=>{Bc(),Oqt(),kqt=zc(Dqt,[[`__scopeId`,`data-v-bb31ac6f`]])})),jqt,Mqt,Nqt,Pqt,Fqt,Iqt=s((()=>{hY(),W(),kE(),jqt={class:`flex w-full items-center justify-between`},Mqt={key:0,class:`mr-2 flex items-center gap-2`},Nqt={key:0,class:`text-red bg-b-danger sticky top-0 border-b p-2`},Pqt={key:1,class:`p-2`},Fqt=N({__name:`ResponseBodyStreaming`,props:{reader:{}},setup(e){let t=mf(),n=A(``),r=A(null),i=A(null),a=A(null),o=A(null),s=()=>{i.value&&(i.value.scrollTop=i.value.scrollHeight)};mr(n,async()=>{await ar(s)});async function c(e){try{for(;t.isLoading&&a.value===e;){let{done:r,value:i}=await e.read();if(a.value!==e)break;if(r){t.clear();break}i&&o.value&&(n.value+=o.value.decode(i,{stream:!0}))}}catch(n){a.value===e&&(console.error(`Error reading stream:`,n),t.clear(),r.value=n)}finally{a.value===e&&o.value&&(n.value+=o.value.decode())}}let l=()=>{a.value&&a.value.cancel(),a.value=e.reader,o.value=new TextDecoder,t.start(),n.value=``,r.value=null,c(e.reader)},u=()=>{a.value&&=(a.value.cancel(),null),t.clear()};return mr(()=>e.reader,l,{immediate:!0}),Wi(u),(e,a)=>(F(),L(j(mY),{class:`max-h-content overflow-y-hidden`},jr({title:M(()=>[R(`div`,jqt,[a[1]||=R(`div`,null,`Body`,-1),j(t).isLoading?(F(),I(`div`,Mqt,[H(j(ff),{loadingState:j(t),size:`xs`},null,8,[`loadingState`]),a[0]||=R(`span`,{class:`text-c-2`},` Listening… `,-1)])):B(``,!0)])]),default:M(()=>[R(`div`,{ref_key:`contentContainer`,ref:i,class:`text-xxs font-code h-full overflow-auto leading-6 whitespace-pre-wrap`},[r.value?(F(),I(`div`,Nqt,k(r.value.message),1)):B(``,!0),n.value?(F(),I(`div`,Pqt,k(n.value),1)):B(``,!0)],512)]),_:2},[j(t).isLoading?{name:`actions`,fn:M(()=>[H(j(gf),{size:`sm`,variant:`ghost`,onClick:u},{default:M(()=>[...a[2]||=[z(` Cancel `,-1)]]),_:1})]),key:`0`}:void 0]),1024))}})})),Lqt,Rqt=s((()=>{Iqt(),Lqt=Fqt})),zqt,_$,Bqt=s((()=>{zqt=(e,t)=>t.on?e.onAny(t.on):()=>{},_$=async(e,t,n)=>{let r=e;for(let e of n){let n=e.hooks?.[t];n&&(r=await n(r)??r)}return r}}));function v$(e){if(e&&typeof e==`object`)switch(e[E$]){case S$:case T$:return!0}return!1}function y$(e){if(e&&typeof e==`object`)switch(e[E$]){case b$:case S$:case w$:case T$:return!0}return!1}var b$,x$,S$,C$,w$,T$,E$,D$,O$,k$,A$,j$,M$,N$,P$=s((()=>{b$=Symbol.for(`yaml.alias`),x$=Symbol.for(`yaml.document`),S$=Symbol.for(`yaml.map`),C$=Symbol.for(`yaml.pair`),w$=Symbol.for(`yaml.scalar`),T$=Symbol.for(`yaml.seq`),E$=Symbol.for(`yaml.node.type`),D$=e=>!!e&&typeof e==`object`&&e[E$]===b$,O$=e=>!!e&&typeof e==`object`&&e[E$]===x$,k$=e=>!!e&&typeof e==`object`&&e[E$]===S$,A$=e=>!!e&&typeof e==`object`&&e[E$]===C$,j$=e=>!!e&&typeof e==`object`&&e[E$]===w$,M$=e=>!!e&&typeof e==`object`&&e[E$]===T$,N$=e=>(j$(e)||v$(e))&&!!e.anchor}));function F$(e,t){let n=Vqt(t);O$(e)?I$(null,e.contents,n,Object.freeze([e]))===V$&&(e.contents=null):I$(null,e,n,Object.freeze([]))}function I$(e,t,n,r){let i=Hqt(e,t,n,r);if(y$(i)||A$(i))return Uqt(e,r,i),I$(e,i,n,r);if(typeof i!=`symbol`){if(v$(t)){r=Object.freeze(r.concat(t));for(let e=0;e<t.items.length;++e){let i=I$(e,t.items[e],n,r);if(typeof i==`number`)e=i-1;else if(i===z$)return z$;else i===V$&&(t.items.splice(e,1),--e)}}else if(A$(t)){r=Object.freeze(r.concat(t));let e=I$(`key`,t.key,n,r);if(e===z$)return z$;e===V$&&(t.key=null);let i=I$(`value`,t.value,n,r);if(i===z$)return z$;i===V$&&(t.value=null)}}return i}async function L$(e,t){let n=Vqt(t);O$(e)?await R$(null,e.contents,n,Object.freeze([e]))===V$&&(e.contents=null):await R$(null,e,n,Object.freeze([]))}async function R$(e,t,n,r){let i=await Hqt(e,t,n,r);if(y$(i)||A$(i))return Uqt(e,r,i),R$(e,i,n,r);if(typeof i!=`symbol`){if(v$(t)){r=Object.freeze(r.concat(t));for(let e=0;e<t.items.length;++e){let i=await R$(e,t.items[e],n,r);if(typeof i==`number`)e=i-1;else if(i===z$)return z$;else i===V$&&(t.items.splice(e,1),--e)}}else if(A$(t)){r=Object.freeze(r.concat(t));let e=await R$(`key`,t.key,n,r);if(e===z$)return z$;e===V$&&(t.key=null);let i=await R$(`value`,t.value,n,r);if(i===z$)return z$;i===V$&&(t.value=null)}}return i}function Vqt(e){return typeof e==`object`&&(e.Collection||e.Node||e.Value)?Object.assign({Alias:e.Node,Map:e.Node,Scalar:e.Node,Seq:e.Node},e.Value&&{Map:e.Value,Scalar:e.Value,Seq:e.Value},e.Collection&&{Map:e.Collection,Seq:e.Collection},e):e}function Hqt(e,t,n,r){if(typeof n==`function`)return n(e,t,r);if(k$(t))return n.Map?.(e,t,r);if(M$(t))return n.Seq?.(e,t,r);if(A$(t))return n.Pair?.(e,t,r);if(j$(t))return n.Scalar?.(e,t,r);if(D$(t))return n.Alias?.(e,t,r)}function Uqt(e,t,n){let r=t[t.length-1];if(v$(r))r.items[e]=n;else if(A$(r))e===`key`?r.key=n:r.value=n;else if(O$(r))r.contents=n;else{let e=D$(r)?`alias`:`scalar`;throw Error(`Cannot replace node with ${e} parent`)}}var z$,B$,V$,H$=s((()=>{P$(),z$=Symbol(`break visit`),B$=Symbol(`skip children`),V$=Symbol(`remove node`),F$.BREAK=z$,F$.SKIP=B$,F$.REMOVE=V$,L$.BREAK=z$,L$.SKIP=B$,L$.REMOVE=V$})),Wqt,Gqt,U$,Kqt=s((()=>{P$(),H$(),Wqt={"!":`%21`,",":`%2C`,"[":`%5B`,"]":`%5D`,"{":`%7B`,"}":`%7D`},Gqt=e=>e.replace(/[!,[\]{}]/g,e=>Wqt[e]),U$=class e{constructor(t,n){this.docStart=null,this.docEnd=!1,this.yaml=Object.assign({},e.defaultYaml,t),this.tags=Object.assign({},e.defaultTags,n)}clone(){let t=new e(this.yaml,this.tags);return t.docStart=this.docStart,t}atDocument(){let t=new e(this.yaml,this.tags);switch(this.yaml.version){case`1.1`:this.atNextDocument=!0;break;case`1.2`:this.atNextDocument=!1,this.yaml={explicit:e.defaultYaml.explicit,version:`1.2`},this.tags=Object.assign({},e.defaultTags);break}return t}add(t,n){this.atNextDocument&&=(this.yaml={explicit:e.defaultYaml.explicit,version:`1.1`},this.tags=Object.assign({},e.defaultTags),!1);let r=t.trim().split(/[ \t]+/),i=r.shift();switch(i){case`%TAG`:{if(r.length!==2&&(n(0,`%TAG directive should contain exactly two parts`),r.length<2))return!1;let[e,t]=r;return this.tags[e]=t,!0}case`%YAML`:{if(this.yaml.explicit=!0,r.length!==1)return n(0,`%YAML directive should contain exactly one part`),!1;let[e]=r;if(e===`1.1`||e===`1.2`)return this.yaml.version=e,!0;{let t=/^\d+\.\d+$/.test(e);return n(6,`Unsupported YAML version ${e}`,t),!1}}default:return n(0,`Unknown directive ${i}`,!0),!1}}tagName(e,t){if(e===`!`)return`!`;if(e[0]!==`!`)return t(`Not a valid tag: ${e}`),null;if(e[1]===`<`){let n=e.slice(2,-1);return n===`!`||n===`!!`?(t(`Verbatim tags aren't resolved, so ${e} is invalid.`),null):(e[e.length-1]!==`>`&&t(`Verbatim tags must end with a >`),n)}let[,n,r]=e.match(/^(.*!)([^!]*)$/s);r||t(`The ${e} tag has no suffix`);let i=this.tags[n];if(i)try{return i+decodeURIComponent(r)}catch(e){return t(String(e)),null}return n===`!`?e:(t(`Could not resolve tag: ${e}`),null)}tagString(e){for(let[t,n]of Object.entries(this.tags))if(e.startsWith(n))return t+Gqt(e.substring(n.length));return e[0]===`!`?e:`!<${e}>`}toString(e){let t=this.yaml.explicit?[`%YAML ${this.yaml.version||`1.2`}`]:[],n=Object.entries(this.tags),r;if(e&&n.length>0&&y$(e.contents)){let t={};F$(e.contents,(e,n)=>{y$(n)&&n.tag&&(t[n.tag]=!0)}),r=Object.keys(t)}else r=[];for(let[i,a]of n)i===`!!`&&a===`tag:yaml.org,2002:`||(!e||r.some(e=>e.startsWith(a)))&&t.push(`%TAG ${i} ${a}`);return t.join(`
-`)}},U$.defaultYaml={explicit:!1,version:`1.2`},U$.defaultTags={"!!":`tag:yaml.org,2002:`}}));function qqt(e){if(/[\x00-\x19\s,[\]{}]/.test(e)){let t=`Anchor must not contain whitespace or control characters: ${JSON.stringify(e)}`;throw Error(t)}return!0}function Jqt(e){let t=new Set;return F$(e,{Value(e,n){n.anchor&&t.add(n.anchor)}}),t}function Yqt(e,t){for(let n=1;;++n){let r=`${e}${n}`;if(!t.has(r))return r}}function Xqt(e,t){let n=[],r=new Map,i=null;return{onAnchor:r=>{n.push(r),i??=Jqt(e);let a=Yqt(t,i);return i.add(a),a},setAnchors:()=>{for(let e of n){let t=r.get(e);if(typeof t==`object`&&t.anchor&&(j$(t.node)||v$(t.node)))t.node.anchor=t.anchor;else{let t=Error(`Failed to resolve repeated object (this should not happen)`);throw t.source=e,t}}},sourceObjects:r}}var W$=s((()=>{P$(),H$()}));function G$(e,t,n,r){if(r&&typeof r==`object`)if(Array.isArray(r))for(let t=0,n=r.length;t<n;++t){let n=r[t],i=G$(e,r,String(t),n);i===void 0?delete r[t]:i!==n&&(r[t]=i)}else if(r instanceof Map)for(let t of Array.from(r.keys())){let n=r.get(t),i=G$(e,r,t,n);i===void 0?r.delete(t):i!==n&&r.set(t,i)}else if(r instanceof Set)for(let t of Array.from(r)){let n=G$(e,r,t,t);n===void 0?r.delete(t):n!==t&&(r.delete(t),r.add(n))}else for(let[t,n]of Object.entries(r)){let i=G$(e,r,t,n);i===void 0?delete r[t]:i!==n&&(r[t]=i)}return e.call(t,n,r)}var Zqt=s((()=>{}));function K$(e,t,n){if(Array.isArray(e))return e.map((e,t)=>K$(e,String(t),n));if(e&&typeof e.toJSON==`function`){if(!n||!N$(e))return e.toJSON(t,n);let r={aliasCount:0,count:1,res:void 0};n.anchors.set(e,r),n.onCreate=e=>{r.res=e,delete n.onCreate};let i=e.toJSON(t,n);return n.onCreate&&n.onCreate(i),i}return typeof e==`bigint`&&!n?.keep?Number(e):e}var q$=s((()=>{P$()})),J$,Y$=s((()=>{Zqt(),P$(),q$(),J$=class{constructor(e){Object.defineProperty(this,E$,{value:e})}clone(){let e=Object.create(Object.getPrototypeOf(this),Object.getOwnPropertyDescriptors(this));return this.range&&(e.range=this.range.slice()),e}toJS(e,{mapAsMap:t,maxAliasCount:n,onAnchor:r,reviver:i}={}){if(!O$(e))throw TypeError(`A document argument is required`);let a={anchors:new Map,doc:e,keep:!0,mapAsMap:t===!0,mapKeyWarned:!1,maxAliasCount:typeof n==`number`?n:100},o=K$(this,``,a);if(typeof r==`function`)for(let{count:e,res:t}of a.anchors.values())r(t,e);return typeof i==`function`?G$(i,{"":o},``,o):o}}}));function X$(e,t,n){if(D$(t)){let r=t.resolve(e),i=n&&r&&n.get(r);return i?i.count*i.aliasCount:0}else if(v$(t)){let r=0;for(let i of t.items){let t=X$(e,i,n);t>r&&(r=t)}return r}else if(A$(t)){let r=X$(e,t.key,n),i=X$(e,t.value,n);return Math.max(r,i)}return 1}var Z$,Q$=s((()=>{W$(),H$(),P$(),Y$(),q$(),Z$=class extends J${constructor(e){super(b$),this.source=e,Object.defineProperty(this,`tag`,{set(){throw Error(`Alias nodes cannot have tags`)}})}resolve(e,t){let n;t?.aliasResolveCache?n=t.aliasResolveCache:(n=[],F$(e,{Node:(e,t)=>{(D$(t)||N$(t))&&n.push(t)}}),t&&(t.aliasResolveCache=n));let r;for(let e of n){if(e===this)break;e.anchor===this.source&&(r=e)}return r}toJSON(e,t){if(!t)return{source:this.source};let{anchors:n,doc:r,maxAliasCount:i}=t,a=this.resolve(r,t);if(!a){let e=`Unresolved alias (the anchor must be set before the alias): ${this.source}`;throw ReferenceError(e)}let o=n.get(a);if(o||=(K$(a,null,t),n.get(a)),o?.res===void 0)throw ReferenceError(`This should not happen: Alias anchor was not resolved?`);if(i>=0&&(o.count+=1,o.aliasCount===0&&(o.aliasCount=X$(r,a,n)),o.count*o.aliasCount>i))throw ReferenceError(`Excessive alias count indicates a resource exhaustion attack`);return o.res}toString(e,t,n){let r=`*${this.source}`;if(e){if(qqt(this.source),e.options.verifyAliasOrder&&!e.anchors.has(this.source)){let e=`Unresolved alias (the anchor must be set before the alias): ${this.source}`;throw Error(e)}if(e.implicitKey)return`${r} `}return r}}})),$$,e1,t1=s((()=>{P$(),Y$(),q$(),$$=e=>!e||typeof e!=`function`&&typeof e!=`object`,e1=class extends J${constructor(e){super(w$),this.value=e}toJSON(e,t){return t?.keep?this.value:K$(this.value,e,t)}toString(){return String(this.value)}},e1.BLOCK_FOLDED=`BLOCK_FOLDED`,e1.BLOCK_LITERAL=`BLOCK_LITERAL`,e1.PLAIN=`PLAIN`,e1.QUOTE_DOUBLE=`QUOTE_DOUBLE`,e1.QUOTE_SINGLE=`QUOTE_SINGLE`}));function Qqt(e,t,n){if(t){let e=n.filter(e=>e.tag===t),r=e.find(e=>!e.format)??e[0];if(!r)throw Error(`Tag ${t} not found`);return r}return n.find(t=>t.identify?.(e)&&!t.format)}function n1(e,t,n){if(O$(e)&&(e=e.contents),y$(e))return e;if(A$(e)){let t=n.schema[S$].createNode?.(n.schema,null,n);return t.items.push(e),t}(e instanceof String||e instanceof Number||e instanceof Boolean||typeof BigInt<`u`&&e instanceof BigInt)&&(e=e.valueOf());let{aliasDuplicateObjects:r,onAnchor:i,onTagObj:a,schema:o,sourceObjects:s}=n,c;if(r&&e&&typeof e==`object`){if(c=s.get(e),c)return c.anchor??=i(e),new Z$(c.anchor);c={anchor:null,node:null},s.set(e,c)}t?.startsWith(`!!`)&&(t=$qt+t.slice(2));let l=Qqt(e,t,o.tags);if(!l){if(e&&typeof e.toJSON==`function`&&(e=e.toJSON()),!e||typeof e!=`object`){let t=new e1(e);return c&&(c.node=t),t}l=e instanceof Map?o[S$]:Symbol.iterator in Object(e)?o[T$]:o[S$]}a&&(a(l),delete n.onTagObj);let u=l?.createNode?l.createNode(n.schema,e,n):typeof l?.nodeClass?.from==`function`?l.nodeClass.from(n.schema,e,n):new e1(e);return t?u.tag=t:l.default||(u.tag=l.tag),c&&(c.node=u),u}var $qt,r1=s((()=>{Q$(),P$(),t1(),$qt=`tag:yaml.org,2002:`}));function i1(e,t,n){let r=n;for(let e=t.length-1;e>=0;--e){let n=t[e];if(typeof n==`number`&&Number.isInteger(n)&&n>=0){let e=[];e[n]=r,r=e}else r=new Map([[n,r]])}return n1(r,void 0,{aliasDuplicateObjects:!1,keepUndefined:!1,onAnchor:()=>{throw Error(`This should not happen, please report a bug.`)},schema:e,sourceObjects:new Map})}var a1,o1,s1=s((()=>{r1(),P$(),Y$(),a1=e=>e==null||typeof e==`object`&&!!e[Symbol.iterator]().next().done,o1=class extends J${constructor(e,t){super(e),Object.defineProperty(this,`schema`,{value:t,configurable:!0,enumerable:!1,writable:!0})}clone(e){let t=Object.create(Object.getPrototypeOf(this),Object.getOwnPropertyDescriptors(this));return e&&(t.schema=e),t.items=t.items.map(t=>y$(t)||A$(t)?t.clone(e):t),this.range&&(t.range=this.range.slice()),t}addIn(e,t){if(a1(e))this.add(t);else{let[n,...r]=e,i=this.get(n,!0);if(v$(i))i.addIn(r,t);else if(i===void 0&&this.schema)this.set(n,i1(this.schema,r,t));else throw Error(`Expected YAML collection at ${n}. Remaining path: ${r}`)}}deleteIn(e){let[t,...n]=e;if(n.length===0)return this.delete(t);let r=this.get(t,!0);if(v$(r))return r.deleteIn(n);throw Error(`Expected YAML collection at ${t}. Remaining path: ${n}`)}getIn(e,t){let[n,...r]=e,i=this.get(n,!0);return r.length===0?!t&&j$(i)?i.value:i:v$(i)?i.getIn(r,t):void 0}hasAllNullValues(e){return this.items.every(t=>{if(!A$(t))return!1;let n=t.value;return n==null||e&&j$(n)&&n.value==null&&!n.commentBefore&&!n.comment&&!n.tag})}hasIn(e){let[t,...n]=e;if(n.length===0)return this.has(t);let r=this.get(t,!0);return v$(r)?r.hasIn(n):!1}setIn(e,t){let[n,...r]=e;if(r.length===0)this.set(n,t);else{let e=this.get(n,!0);if(v$(e))e.setIn(r,t);else if(e===void 0&&this.schema)this.set(n,i1(this.schema,r,t));else throw Error(`Expected YAML collection at ${n}. Remaining path: ${r}`)}}}}));function c1(e,t){return/^\n+$/.test(e)?e.substring(1):t?e.replace(/^(?! *$)/gm,t):e}var eJt,l1,u1=s((()=>{eJt=e=>e.replace(/^(?!$)(?: $)?/gm,`#`),l1=(e,t,n)=>e.endsWith(`
-`)?c1(n,t):n.includes(`
-`)?`
-`+c1(n,t):(e.endsWith(` `)?``:` `)+n}));function d1(e,t,n=`flow`,{indentAtStart:r,lineWidth:i=80,minContentWidth:a=20,onFold:o,onOverflow:s}={}){if(!i||i<0)return e;i<a&&(a=0);let c=Math.max(1+a,1+i-t.length);if(e.length<=c)return e;let l=[],u={},d=i-t.length;typeof r==`number`&&(r>i-Math.max(2,a)?l.push(0):d=i-r);let f,p,m=!1,h=-1,g=-1,_=-1;n===`block`&&(h=tJt(e,h,t.length),h!==-1&&(d=h+c));for(let r;r=e[h+=1];){if(n===`quoted`&&r===`\\`){switch(g=h,e[h+1]){case`x`:h+=3;break;case`u`:h+=5;break;case`U`:h+=9;break;default:h+=1}_=h}if(r===`
-`)n===`block`&&(h=tJt(e,h,t.length)),d=h+t.length+c,f=void 0;else{if(r===` `&&p&&p!==` `&&p!==`
-`&&p!==`	`){let t=e[h+1];t&&t!==` `&&t!==`
-`&&t!==`	`&&(f=h)}if(h>=d)if(f)l.push(f),d=f+c,f=void 0;else if(n===`quoted`){for(;p===` `||p===`	`;)p=r,r=e[h+=1],m=!0;let t=h>_+1?h-2:g-1;if(u[t])return e;l.push(t),u[t]=!0,d=t+c,f=void 0}else m=!0}p=r}if(m&&s&&s(),l.length===0)return e;o&&o();let v=e.slice(0,l[0]);for(let r=0;r<l.length;++r){let i=l[r],a=l[r+1]||e.length;i===0?v=`\n${t}${e.slice(0,a)}`:(n===`quoted`&&u[i]&&(v+=`${e[i]}\\`),v+=`\n${t}${e.slice(i+1,a)}`)}return v}function tJt(e,t,n){let r=t,i=t+1,a=e[i];for(;a===` `||a===`	`;)if(t<i+n)a=e[++t];else{do a=e[++t];while(a&&a!==`
-`);r=t,i=t+1,a=e[i]}return r}var f1,nJt,rJt,iJt=s((()=>{f1=`flow`,nJt=`block`,rJt=`quoted`}));function aJt(e,t,n){if(!t||t<0)return!1;let r=t-n,i=e.length;if(i<=r)return!1;for(let t=0,n=0;t<i;++t)if(e[t]===`
-`){if(t-n>r)return!0;if(n=t+1,i-n<=r)return!1}return!0}function p1(e,t){let n=JSON.stringify(e);if(t.options.doubleQuotedAsJSON)return n;let{implicitKey:r}=t,i=t.options.doubleQuotedMinMultiLineLength,a=t.indent||(y1(e)?`  `:``),o=``,s=0;for(let e=0,t=n[e];t;t=n[++e])if(t===` `&&n[e+1]===`\\`&&n[e+2]===`n`&&(o+=n.slice(s,e)+`\\ `,e+=1,s=e,t=`\\`),t===`\\`)switch(n[e+1]){case`u`:{o+=n.slice(s,e);let t=n.substr(e+2,4);switch(t){case`0000`:o+=`\\0`;break;case`0007`:o+=`\\a`;break;case`000b`:o+=`\\v`;break;case`001b`:o+=`\\e`;break;case`0085`:o+=`\\N`;break;case`00a0`:o+=`\\_`;break;case`2028`:o+=`\\L`;break;case`2029`:o+=`\\P`;break;default:t.substr(0,2)===`00`?o+=`\\x`+t.substr(2):o+=n.substr(e,6)}e+=5,s=e+1}break;case`n`:if(r||n[e+2]===`"`||n.length<i)e+=1;else{for(o+=n.slice(s,e)+`
-
-`;n[e+2]===`\\`&&n[e+3]===`n`&&n[e+4]!==`"`;)o+=`
-`,e+=2;o+=a,n[e+2]===` `&&(o+=`\\`),e+=1,s=e+1}break;default:e+=1}return o=s?o+n.slice(s):n,r?o:d1(o,a,rJt,v1(t,!1))}function m1(e,t){if(t.options.singleQuote===!1||t.implicitKey&&e.includes(`
-`)||/[ \t]\n|\n[ \t]/.test(e))return p1(e,t);let n=t.indent||(y1(e)?`  `:``),r=`'`+e.replace(/'/g,`''`).replace(/\n+/g,`$&\n${n}`)+`'`;return t.implicitKey?r:d1(r,n,f1,v1(t,!1))}function h1(e,t){let{singleQuote:n}=t.options,r;if(n===!1)r=p1;else{let t=e.includes(`"`),i=e.includes(`'`);r=t&&!i?m1:i&&!t?p1:n?m1:p1}return r(e,t)}function g1({comment:e,type:t,value:n},r,i,a){let{blockQuote:o,commentString:s,lineWidth:c}=r.options;if(!o||/\n[\t ]+$/.test(n))return h1(n,r);let l=r.indent||(r.forceBlockIndent||y1(n)?`  `:``),u=o===`literal`?!0:o===`folded`||t===e1.BLOCK_FOLDED?!1:t===e1.BLOCK_LITERAL?!0:!aJt(n,c,l.length);if(!n)return u?`|
-`:`>
-`;let d,f;for(f=n.length;f>0;--f){let e=n[f-1];if(e!==`
-`&&e!==`	`&&e!==` `)break}let p=n.substring(f),m=p.indexOf(`
-`);m===-1?d=`-`:n===p||m!==p.length-1?(d=`+`,a&&a()):d=``,p&&=(n=n.slice(0,-p.length),p[p.length-1]===`
-`&&(p=p.slice(0,-1)),p.replace(b1,`$&${l}`));let h=!1,g,_=-1;for(g=0;g<n.length;++g){let e=n[g];if(e===` `)h=!0;else if(e===`
-`)_=g;else break}let v=n.substring(0,_<g?_+1:g);v&&=(n=n.substring(v.length),v.replace(/\n+/g,`$&${l}`));let y=(h?l?`2`:`1`:``)+d;if(e&&(y+=` `+s(e.replace(/ ?[\r\n]+/g,` `)),i&&i()),!u){let e=n.replace(/\n+/g,`
-$&`).replace(/(?:^|\n)([\t ].*)(?:([\n\t ]*)\n(?![\n\t ]))?/g,`$1$2`).replace(/\n+/g,`$&${l}`),i=!1,a=v1(r,!0);o!==`folded`&&t!==e1.BLOCK_FOLDED&&(a.onOverflow=()=>{i=!0});let s=d1(`${v}${e}${p}`,l,nJt,a);if(!i)return`>${y}\n${l}${s}`}return n=n.replace(/\n+/g,`$&${l}`),`|${y}\n${l}${v}${n}${p}`}function oJt(e,t,n,r){let{type:i,value:a}=e,{actualString:o,implicitKey:s,indent:c,indentStep:l,inFlow:u}=t;if(s&&a.includes(`
-`)||u&&/[[\]{},]/.test(a))return h1(a,t);if(/^[\n\t ,[\]{}#&*!|>'"%@`]|^[?-]$|^[?-][ \t]|[\n:][ \t]|[ \t]\n|[\n\t ]#|[\n\t :]$/.test(a))return s||u||!a.includes(`
-`)?h1(a,t):g1(e,t,n,r);if(!s&&!u&&i!==e1.PLAIN&&a.includes(`
-`))return g1(e,t,n,r);if(y1(a)){if(c===``)return t.forceBlockIndent=!0,g1(e,t,n,r);if(s&&c===l)return h1(a,t)}let d=a.replace(/\n+/g,`$&\n${c}`);if(o){let e=e=>e.default&&e.tag!==`tag:yaml.org,2002:str`&&e.test?.test(d),{compat:n,tags:r}=t.doc.schema;if(r.some(e)||n?.some(e))return h1(a,t)}return s?d:d1(d,c,f1,v1(t,!1))}function _1(e,t,n,r){let{implicitKey:i,inFlow:a}=t,o=typeof e.value==`string`?e:Object.assign({},e,{value:String(e.value)}),{type:s}=e;s!==e1.QUOTE_DOUBLE&&/[\x00-\x08\x0b-\x1f\x7f-\x9f\u{D800}-\u{DFFF}]/u.test(o.value)&&(s=e1.QUOTE_DOUBLE);let c=e=>{switch(e){case e1.BLOCK_FOLDED:case e1.BLOCK_LITERAL:return i||a?h1(o.value,t):g1(o,t,n,r);case e1.QUOTE_DOUBLE:return p1(o.value,t);case e1.QUOTE_SINGLE:return m1(o.value,t);case e1.PLAIN:return oJt(o,t,n,r);default:return null}},l=c(s);if(l===null){let{defaultKeyType:e,defaultStringType:n}=t.options,r=i&&e||n;if(l=c(r),l===null)throw Error(`Unsupported default string type ${r}`)}return l}var v1,y1,b1,x1=s((()=>{t1(),iJt(),v1=(e,t)=>({indentAtStart:t?e.indent.length:e.indentAtStart,lineWidth:e.options.lineWidth,minContentWidth:e.options.minContentWidth}),y1=e=>/^(%|---|\.\.\.)/m.test(e);try{b1=RegExp(`(^|(?<!
-))
-+(?!
-|$)`,`g`)}catch{b1=/\n+(?!\n|$)/g}}));function sJt(e,t){let n=Object.assign({blockQuote:!0,commentString:eJt,defaultKeyType:null,defaultStringType:`PLAIN`,directives:null,doubleQuotedAsJSON:!1,doubleQuotedMinMultiLineLength:40,falseStr:`false`,flowCollectionPadding:!0,indentSeq:!0,lineWidth:80,minContentWidth:20,nullStr:`null`,simpleKeys:!1,singleQuote:null,trailingComma:!1,trueStr:`true`,verifyAliasOrder:!0},e.schema.toStringOptions,t),r;switch(n.collectionStyle){case`block`:r=!1;break;case`flow`:r=!0;break;default:r=null}return{anchors:new Set,doc:e,flowCollectionPadding:n.flowCollectionPadding?` `:``,indent:``,indentStep:typeof n.indent==`number`?` `.repeat(n.indent):`  `,inFlow:r,options:n}}function cJt(e,t){if(t.tag){let n=e.filter(e=>e.tag===t.tag);if(n.length>0)return n.find(e=>e.format===t.format)??n[0]}let n,r;if(j$(t)){r=t.value;let i=e.filter(e=>e.identify?.(r));if(i.length>1){let e=i.filter(e=>e.test);e.length>0&&(i=e)}n=i.find(e=>e.format===t.format)??i.find(e=>!e.format)}else r=t,n=e.find(e=>e.nodeClass&&r instanceof e.nodeClass);if(!n){let e=r?.constructor?.name??(r===null?`null`:typeof r);throw Error(`Tag not resolved for ${e} value`)}return n}function lJt(e,t,{anchors:n,doc:r}){if(!r.directives)return``;let i=[],a=(j$(e)||v$(e))&&e.anchor;a&&qqt(a)&&(n.add(a),i.push(`&${a}`));let o=e.tag??(t.default?null:t.tag);return o&&i.push(r.directives.tagString(o)),i.join(` `)}function S1(e,t,n,r){if(A$(e))return e.toString(t,n,r);if(D$(e)){if(t.doc.directives)return e.toString(t);if(t.resolvedAliases?.has(e))throw TypeError(`Cannot stringify circular structure without alias nodes`);t.resolvedAliases?t.resolvedAliases.add(e):t.resolvedAliases=new Set([e]),e=e.resolve(t.doc)}let i,a=y$(e)?e:t.doc.createNode(e,{onTagObj:e=>i=e});i??=cJt(t.doc.schema.tags,a);let o=lJt(a,i,t);o.length>0&&(t.indentAtStart=(t.indentAtStart??0)+o.length+1);let s=typeof i.stringify==`function`?i.stringify(a,t,n,r):j$(a)?_1(a,t,n,r):a.toString(t,n,r);return o?j$(a)||s[0]===`{`||s[0]===`[`?`${o} ${s}`:`${o}\n${t.indent}${s}`:s}var C1=s((()=>{W$(),P$(),u1(),x1()}));function uJt({key:e,value:t},n,r,i){let{allNullValues:a,doc:o,indent:s,indentStep:c,options:{commentString:l,indentSeq:u,simpleKeys:d}}=n,f=y$(e)&&e.comment||null;if(d){if(f)throw Error(`With simple keys, key nodes cannot have comments`);if(v$(e)||!y$(e)&&typeof e==`object`)throw Error(`With simple keys, collection cannot be used as a key value`)}let p=!d&&(!e||f&&t==null&&!n.inFlow||v$(e)||(j$(e)?e.type===e1.BLOCK_FOLDED||e.type===e1.BLOCK_LITERAL:typeof e==`object`));n=Object.assign({},n,{allNullValues:!1,implicitKey:!p&&(d||!a),indent:s+c});let m=!1,h=!1,g=S1(e,n,()=>m=!0,()=>h=!0);if(!p&&!n.inFlow&&g.length>1024){if(d)throw Error(`With simple keys, single line scalar must not span more than 1024 characters`);p=!0}if(n.inFlow){if(a||t==null)return m&&r&&r(),g===``?`?`:p?`? ${g}`:g}else if(a&&!d||t==null&&p)return g=`? ${g}`,f&&!m?g+=l1(g,n.indent,l(f)):h&&i&&i(),g;m&&(f=null),p?(f&&(g+=l1(g,n.indent,l(f))),g=`? ${g}\n${s}:`):(g=`${g}:`,f&&(g+=l1(g,n.indent,l(f))));let _,v,y;y$(t)?(_=!!t.spaceBefore,v=t.commentBefore,y=t.comment):(_=!1,v=null,y=null,t&&typeof t==`object`&&(t=o.createNode(t))),n.implicitKey=!1,!p&&!f&&j$(t)&&(n.indentAtStart=g.length+1),h=!1,!u&&c.length>=2&&!n.inFlow&&!p&&M$(t)&&!t.flow&&!t.tag&&!t.anchor&&(n.indent=n.indent.substring(2));let b=!1,x=S1(t,n,()=>b=!0,()=>h=!0),S=` `;if(f||_||v){if(S=_?`
-`:``,v){let e=l(v);S+=`\n${c1(e,n.indent)}`}x===``&&!n.inFlow?S===`
-`&&y&&(S=`
-
-`):S+=`\n${n.indent}`}else if(!p&&v$(t)){let e=x[0],r=x.indexOf(`
-`),i=r!==-1,a=n.inFlow??t.flow??t.items.length===0;if(i||!a){let t=!1;if(i&&(e===`&`||e===`!`)){let n=x.indexOf(` `);e===`&`&&n!==-1&&n<r&&x[n+1]===`!`&&(n=x.indexOf(` `,n+1)),(n===-1||r<n)&&(t=!0)}t||(S=`\n${n.indent}`)}}else (x===``||x[0]===`
-`)&&(S=``);return g+=S+x,n.inFlow?b&&r&&r():y&&!b?g+=l1(g,n.indent,l(y)):h&&i&&i(),g}var dJt=s((()=>{P$(),t1(),C1(),u1()}));function fJt(e,t){(e===`debug`||e===`warn`)&&console.warn(t)}var pJt=s((()=>{}));function mJt(e,t,n){if(n=e&&D$(n)?n.resolve(e.doc):n,M$(n))for(let r of n.items)w1(e,t,r);else if(Array.isArray(n))for(let r of n)w1(e,t,r);else w1(e,t,n)}function w1(e,t,n){let r=e&&D$(n)?n.resolve(e.doc):n;if(!k$(r))throw Error(`Merge sources must be maps or map aliases`);let i=r.toJSON(null,e,Map);for(let[e,n]of i)t instanceof Map?t.has(e)||t.set(e,n):t instanceof Set?t.add(e):Object.prototype.hasOwnProperty.call(t,e)||Object.defineProperty(t,e,{value:n,writable:!0,enumerable:!0,configurable:!0});return t}var T1,E1,hJt,D1=s((()=>{P$(),t1(),T1=`<<`,E1={identify:e=>e===T1||typeof e==`symbol`&&e.description===T1,default:`key`,tag:`tag:yaml.org,2002:merge`,test:/^<<$/,resolve:()=>Object.assign(new e1(Symbol(T1)),{addToJSMap:mJt}),stringify:()=>T1},hJt=(e,t)=>(E1.identify(t)||j$(t)&&(!t.type||t.type===e1.PLAIN)&&E1.identify(t.value))&&e?.doc.schema.tags.some(e=>e.tag===E1.tag&&e.default)}));function gJt(e,t,{key:n,value:r}){if(y$(n)&&n.addToJSMap)n.addToJSMap(e,t,r);else if(hJt(e,n))mJt(e,t,r);else{let i=K$(n,``,e);if(t instanceof Map)t.set(i,K$(r,i,e));else if(t instanceof Set)t.add(i);else{let a=_Jt(n,i,e),o=K$(r,a,e);a in t?Object.defineProperty(t,a,{value:o,writable:!0,enumerable:!0,configurable:!0}):t[a]=o}}return t}function _Jt(e,t,n){if(t===null)return``;if(typeof t!=`object`)return String(t);if(y$(e)&&n?.doc){let t=sJt(n.doc,{});t.anchors=new Set;for(let e of n.anchors.keys())t.anchors.add(e.anchor);t.inFlow=!0,t.inStringifyKey=!0;let r=e.toString(t);if(!n.mapKeyWarned){let e=JSON.stringify(r);e.length>40&&(e=e.substring(0,36)+`..."`),fJt(n.doc.options.logLevel,`Keys with collection values will be stringified due to JS Object restrictions: ${e}. Set mapAsMap: true to use object keys.`),n.mapKeyWarned=!0}return r}return JSON.stringify(t)}var vJt=s((()=>{pJt(),D1(),C1(),P$(),q$()}));function O1(e,t,n){return new k1(n1(e,void 0,n),n1(t,void 0,n))}var k1,A1=s((()=>{r1(),dJt(),vJt(),P$(),k1=class e{constructor(e,t=null){Object.defineProperty(this,E$,{value:C$}),this.key=e,this.value=t}clone(t){let{key:n,value:r}=this;return y$(n)&&(n=n.clone(t)),y$(r)&&(r=r.clone(t)),new e(n,r)}toJSON(e,t){return gJt(t,t?.mapAsMap?new Map:{},this)}toString(e,t,n){return e?.doc?uJt(this,e,t,n):JSON.stringify(this)}}}));function yJt(e,t,n){return(t.inFlow??e.flow?xJt:bJt)(e,t,n)}function bJt({comment:e,items:t},n,{blockItemPrefix:r,flowChars:i,itemIndent:a,onChompKeep:o,onComment:s}){let{indent:c,options:{commentString:l}}=n,u=Object.assign({},n,{indent:a,type:null}),d=!1,f=[];for(let e=0;e<t.length;++e){let i=t[e],o=null;if(y$(i))!d&&i.spaceBefore&&f.push(``),j1(n,f,i.commentBefore,d),i.comment&&(o=i.comment);else if(A$(i)){let e=y$(i.key)?i.key:null;e&&(!d&&e.spaceBefore&&f.push(``),j1(n,f,e.commentBefore,d))}d=!1;let s=S1(i,u,()=>o=null,()=>d=!0);o&&(s+=l1(s,a,l(o))),d&&o&&(d=!1),f.push(r+s)}let p;if(f.length===0)p=i.start+i.end;else{p=f[0];for(let e=1;e<f.length;++e){let t=f[e];p+=t?`\n${c}${t}`:`
-`}}return e?(p+=`
-`+c1(l(e),c),s&&s()):d&&o&&o(),p}function xJt({items:e},t,{flowChars:n,itemIndent:r}){let{indent:i,indentStep:a,flowCollectionPadding:o,options:{commentString:s}}=t;r+=a;let c=Object.assign({},t,{indent:r,inFlow:!0,type:null}),l=!1,u=0,d=[];for(let n=0;n<e.length;++n){let i=e[n],a=null;if(y$(i))i.spaceBefore&&d.push(``),j1(t,d,i.commentBefore,!1),i.comment&&(a=i.comment);else if(A$(i)){let e=y$(i.key)?i.key:null;e&&(e.spaceBefore&&d.push(``),j1(t,d,e.commentBefore,!1),e.comment&&(l=!0));let n=y$(i.value)?i.value:null;n?(n.comment&&(a=n.comment),n.commentBefore&&(l=!0)):i.value==null&&e?.comment&&(a=e.comment)}a&&(l=!0);let o=S1(i,c,()=>a=null);l||=d.length>u||o.includes(`
-`),n<e.length-1?o+=`,`:t.options.trailingComma&&(t.options.lineWidth>0&&(l||=d.reduce((e,t)=>e+t.length+2,2)+(o.length+2)>t.options.lineWidth),l&&(o+=`,`)),a&&(o+=l1(o,r,s(a))),d.push(o),u=d.length}let{start:f,end:p}=n;if(d.length===0)return f+p;if(!l){let e=d.reduce((e,t)=>e+t.length+2,2);l=t.options.lineWidth>0&&e>t.options.lineWidth}if(l){let e=f;for(let t of d)e+=t?`\n${a}${i}${t}`:`
-`;return`${e}\n${i}${p}`}else return`${f}${o}${d.join(` `)}${o}${p}`}function j1({indent:e,options:{commentString:t}},n,r,i){if(r&&i&&(r=r.replace(/^\n+/,``)),r){let i=c1(t(r),e);n.push(i.trimStart())}}var SJt=s((()=>{P$(),C1(),u1()}));function M1(e,t){let n=j$(t)?t.value:t;for(let r of e)if(A$(r)&&(r.key===t||r.key===n||j$(r.key)&&r.key.value===n))return r}var N1,P1=s((()=>{SJt(),vJt(),s1(),P$(),A1(),t1(),N1=class extends o1{static get tagName(){return`tag:yaml.org,2002:map`}constructor(e){super(S$,e),this.items=[]}static from(e,t,n){let{keepUndefined:r,replacer:i}=n,a=new this(e),o=(e,o)=>{if(typeof i==`function`)o=i.call(t,e,o);else if(Array.isArray(i)&&!i.includes(e))return;(o!==void 0||r)&&a.items.push(O1(e,o,n))};if(t instanceof Map)for(let[e,n]of t)o(e,n);else if(t&&typeof t==`object`)for(let e of Object.keys(t))o(e,t[e]);return typeof e.sortMapEntries==`function`&&a.items.sort(e.sortMapEntries),a}add(e,t){let n;n=A$(e)?e:!e||typeof e!=`object`||!(`key`in e)?new k1(e,e?.value):new k1(e.key,e.value);let r=M1(this.items,n.key),i=this.schema?.sortMapEntries;if(r){if(!t)throw Error(`Key ${n.key} already set`);j$(r.value)&&$$(n.value)?r.value.value=n.value:r.value=n.value}else if(i){let e=this.items.findIndex(e=>i(n,e)<0);e===-1?this.items.push(n):this.items.splice(e,0,n)}else this.items.push(n)}delete(e){let t=M1(this.items,e);return t?this.items.splice(this.items.indexOf(t),1).length>0:!1}get(e,t){let n=M1(this.items,e)?.value;return(!t&&j$(n)?n.value:n)??void 0}has(e){return!!M1(this.items,e)}set(e,t){this.add(new k1(e,t),!0)}toJSON(e,t,n){let r=n?new n:t?.mapAsMap?new Map:{};t?.onCreate&&t.onCreate(r);for(let e of this.items)gJt(t,r,e);return r}toString(e,t,n){if(!e)return JSON.stringify(this);for(let e of this.items)if(!A$(e))throw Error(`Map items must all be pairs; found ${JSON.stringify(e)} instead`);return!e.allNullValues&&this.hasAllNullValues(!1)&&(e=Object.assign({},e,{allNullValues:!0})),yJt(this,e,{blockItemPrefix:``,flowChars:{start:`{`,end:`}`},itemIndent:e.indent||``,onChompKeep:n,onComment:t})}}})),F1,I1=s((()=>{P$(),P1(),F1={collection:`map`,default:!0,nodeClass:N1,tag:`tag:yaml.org,2002:map`,resolve(e,t){return k$(e)||t(`Expected a mapping for this tag`),e},createNode:(e,t,n)=>N1.from(e,t,n)}}));function L1(e){let t=j$(e)?e.value:e;return t&&typeof t==`string`&&(t=Number(t)),typeof t==`number`&&Number.isInteger(t)&&t>=0?t:null}var R1,z1=s((()=>{r1(),SJt(),s1(),P$(),t1(),q$(),R1=class extends o1{static get tagName(){return`tag:yaml.org,2002:seq`}constructor(e){super(T$,e),this.items=[]}add(e){this.items.push(e)}delete(e){let t=L1(e);return typeof t==`number`?this.items.splice(t,1).length>0:!1}get(e,t){let n=L1(e);if(typeof n!=`number`)return;let r=this.items[n];return!t&&j$(r)?r.value:r}has(e){let t=L1(e);return typeof t==`number`&&t<this.items.length}set(e,t){let n=L1(e);if(typeof n!=`number`)throw Error(`Expected a valid index, not ${e}.`);let r=this.items[n];j$(r)&&$$(t)?r.value=t:this.items[n]=t}toJSON(e,t){let n=[];t?.onCreate&&t.onCreate(n);let r=0;for(let e of this.items)n.push(K$(e,String(r++),t));return n}toString(e,t,n){return e?yJt(this,e,{blockItemPrefix:`- `,flowChars:{start:`[`,end:`]`},itemIndent:(e.indent||``)+`  `,onChompKeep:n,onComment:t}):JSON.stringify(this)}static from(e,t,n){let{replacer:r}=n,i=new this(e);if(t&&Symbol.iterator in Object(t)){let e=0;for(let a of t){if(typeof r==`function`){let n=t instanceof Set?a:String(e++);a=r.call(t,n,a)}i.items.push(n1(a,void 0,n))}}return i}}})),B1,V1=s((()=>{P$(),z1(),B1={collection:`seq`,default:!0,nodeClass:R1,tag:`tag:yaml.org,2002:seq`,resolve(e,t){return M$(e)||t(`Expected a sequence for this tag`),e},createNode:(e,t,n)=>R1.from(e,t,n)}})),H1,U1=s((()=>{x1(),H1={identify:e=>typeof e==`string`,default:!0,tag:`tag:yaml.org,2002:str`,resolve:e=>e,stringify(e,t,n,r){return t=Object.assign({actualString:!0},t),_1(e,t,n,r)}}})),W1,G1=s((()=>{t1(),W1={identify:e=>e==null,createNode:()=>new e1(null),default:!0,tag:`tag:yaml.org,2002:null`,test:/^(?:~|[Nn]ull|NULL)?$/,resolve:()=>new e1(null),stringify:({source:e},t)=>typeof e==`string`&&W1.test.test(e)?e:t.options.nullStr}})),K1,CJt=s((()=>{t1(),K1={identify:e=>typeof e==`boolean`,default:!0,tag:`tag:yaml.org,2002:bool`,test:/^(?:[Tt]rue|TRUE|[Ff]alse|FALSE)$/,resolve:e=>new e1(e[0]===`t`||e[0]===`T`),stringify({source:e,value:t},n){return e&&K1.test.test(e)&&t===(e[0]===`t`||e[0]===`T`)?e:t?n.options.trueStr:n.options.falseStr}}}));function q1({format:e,minFractionDigits:t,tag:n,value:r}){if(typeof r==`bigint`)return String(r);let i=typeof r==`number`?r:Number(r);if(!isFinite(i))return isNaN(i)?`.nan`:i<0?`-.inf`:`.inf`;let a=Object.is(r,-0)?`-0`:JSON.stringify(r);if(!e&&t&&(!n||n===`tag:yaml.org,2002:float`)&&/^\d/.test(a)){let e=a.indexOf(`.`);e<0&&(e=a.length,a+=`.`);let n=t-(a.length-e-1);for(;n-- >0;)a+=`0`}return a}var J1=s((()=>{})),Y1,X1,Z1,wJt=s((()=>{t1(),J1(),Y1={identify:e=>typeof e==`number`,default:!0,tag:`tag:yaml.org,2002:float`,test:/^(?:[-+]?\.(?:inf|Inf|INF)|\.nan|\.NaN|\.NAN)$/,resolve:e=>e.slice(-3).toLowerCase()===`nan`?NaN:e[0]===`-`?-1/0:1/0,stringify:q1},X1={identify:e=>typeof e==`number`,default:!0,tag:`tag:yaml.org,2002:float`,format:`EXP`,test:/^[-+]?(?:\.[0-9]+|[0-9]+(?:\.[0-9]*)?)[eE][-+]?[0-9]+$/,resolve:e=>parseFloat(e),stringify(e){let t=Number(e.value);return isFinite(t)?t.toExponential():q1(e)}},Z1={identify:e=>typeof e==`number`,default:!0,tag:`tag:yaml.org,2002:float`,test:/^[-+]?(?:\.[0-9]+|[0-9]+\.[0-9]*)$/,resolve(e){let t=new e1(parseFloat(e)),n=e.indexOf(`.`);return n!==-1&&e[e.length-1]===`0`&&(t.minFractionDigits=e.length-n-1),t},stringify:q1}}));function TJt(e,t,n){let{value:r}=e;return Q1(r)&&r>=0?n+r.toString(t):q1(e)}var Q1,$1,e0,t0,n0,EJt=s((()=>{J1(),Q1=e=>typeof e==`bigint`||Number.isInteger(e),$1=(e,t,n,{intAsBigInt:r})=>r?BigInt(e):parseInt(e.substring(t),n),e0={identify:e=>Q1(e)&&e>=0,default:!0,tag:`tag:yaml.org,2002:int`,format:`OCT`,test:/^0o[0-7]+$/,resolve:(e,t,n)=>$1(e,2,8,n),stringify:e=>TJt(e,8,`0o`)},t0={identify:Q1,default:!0,tag:`tag:yaml.org,2002:int`,test:/^[-+]?[0-9]+$/,resolve:(e,t,n)=>$1(e,0,10,n),stringify:q1},n0={identify:e=>Q1(e)&&e>=0,default:!0,tag:`tag:yaml.org,2002:int`,format:`HEX`,test:/^0x[0-9a-fA-F]+$/,resolve:(e,t,n)=>$1(e,2,16,n),stringify:e=>TJt(e,16,`0x`)}})),DJt,OJt=s((()=>{I1(),G1(),V1(),U1(),CJt(),wJt(),EJt(),DJt=[F1,B1,H1,W1,K1,e0,t0,n0,Y1,X1,Z1]}));function kJt(e){return typeof e==`bigint`||Number.isInteger(e)}var r0,AJt,jJt,MJt=s((()=>{t1(),I1(),V1(),r0=({value:e})=>JSON.stringify(e),AJt=[{identify:e=>typeof e==`string`,default:!0,tag:`tag:yaml.org,2002:str`,resolve:e=>e,stringify:r0},{identify:e=>e==null,createNode:()=>new e1(null),default:!0,tag:`tag:yaml.org,2002:null`,test:/^null$/,resolve:()=>null,stringify:r0},{identify:e=>typeof e==`boolean`,default:!0,tag:`tag:yaml.org,2002:bool`,test:/^true$|^false$/,resolve:e=>e===`true`,stringify:r0},{identify:kJt,default:!0,tag:`tag:yaml.org,2002:int`,test:/^-?(?:0|[1-9][0-9]*)$/,resolve:(e,t,{intAsBigInt:n})=>n?BigInt(e):parseInt(e,10),stringify:({value:e})=>kJt(e)?e.toString():JSON.stringify(e)},{identify:e=>typeof e==`number`,default:!0,tag:`tag:yaml.org,2002:float`,test:/^-?(?:0|[1-9][0-9]*)(?:\.[0-9]*)?(?:[eE][-+]?[0-9]+)?$/,resolve:e=>parseFloat(e),stringify:r0}],jJt=[F1,B1].concat(AJt,{default:!0,tag:``,test:/^/,resolve(e,t){return t(`Unresolved plain scalar ${JSON.stringify(e)}`),e}})})),i0,NJt=s((()=>{t1(),x1(),i0={identify:e=>e instanceof Uint8Array,default:!1,tag:`tag:yaml.org,2002:binary`,resolve(e,t){if(typeof atob==`function`){let t=atob(e.replace(/[\n\r]/g,``)),n=new Uint8Array(t.length);for(let e=0;e<t.length;++e)n[e]=t.charCodeAt(e);return n}else return t(`This environment does not support reading binary tags; either Buffer or atob is required`),e},stringify({comment:e,type:t,value:n},r,i,a){if(!n)return``;let o=n,s;if(typeof btoa==`function`){let e=``;for(let t=0;t<o.length;++t)e+=String.fromCharCode(o[t]);s=btoa(e)}else throw Error(`This environment does not support writing binary tags; either Buffer or btoa is required`);if(t??=e1.BLOCK_LITERAL,t!==e1.QUOTE_DOUBLE){let e=Math.max(r.options.lineWidth-r.indent.length,r.options.minContentWidth),n=Math.ceil(s.length/e),i=Array(n);for(let t=0,r=0;t<n;++t,r+=e)i[t]=s.substr(r,e);s=i.join(t===e1.BLOCK_LITERAL?`
-`:` `)}return _1({comment:e,type:t,value:s},r,i,a)}}}));function PJt(e,t){if(M$(e))for(let n=0;n<e.items.length;++n){let r=e.items[n];if(!A$(r)){if(k$(r)){r.items.length>1&&t(`Each pair must have its own sequence indicator`);let e=r.items[0]||new k1(new e1(null));if(r.commentBefore&&(e.key.commentBefore=e.key.commentBefore?`${r.commentBefore}\n${e.key.commentBefore}`:r.commentBefore),r.comment){let t=e.value??e.key;t.comment=t.comment?`${r.comment}\n${t.comment}`:r.comment}r=e}e.items[n]=A$(r)?r:new k1(r)}}else t(`Expected a sequence for this tag`);return e}function FJt(e,t,n){let{replacer:r}=n,i=new R1(e);i.tag=`tag:yaml.org,2002:pairs`;let a=0;if(t&&Symbol.iterator in Object(t))for(let e of t){typeof r==`function`&&(e=r.call(t,String(a++),e));let o,s;if(Array.isArray(e))if(e.length===2)o=e[0],s=e[1];else throw TypeError(`Expected [key, value] tuple: ${e}`);else if(e&&e instanceof Object){let t=Object.keys(e);if(t.length===1)o=t[0],s=e[o];else throw TypeError(`Expected tuple with one key, not ${t.length} keys`)}else o=e;i.items.push(O1(o,s,n))}return i}var a0,o0=s((()=>{P$(),A1(),t1(),z1(),a0={collection:`seq`,default:!1,tag:`tag:yaml.org,2002:pairs`,resolve:PJt,createNode:FJt}})),s0,c0,IJt=s((()=>{P$(),q$(),P1(),z1(),o0(),s0=class e extends R1{constructor(){super(),this.add=N1.prototype.add.bind(this),this.delete=N1.prototype.delete.bind(this),this.get=N1.prototype.get.bind(this),this.has=N1.prototype.has.bind(this),this.set=N1.prototype.set.bind(this),this.tag=e.tag}toJSON(e,t){if(!t)return super.toJSON(e);let n=new Map;t?.onCreate&&t.onCreate(n);for(let e of this.items){let r,i;if(A$(e)?(r=K$(e.key,``,t),i=K$(e.value,r,t)):r=K$(e,``,t),n.has(r))throw Error(`Ordered maps must not include duplicate keys`);n.set(r,i)}return n}static from(e,t,n){let r=FJt(e,t,n),i=new this;return i.items=r.items,i}},s0.tag=`tag:yaml.org,2002:omap`,c0={collection:`seq`,identify:e=>e instanceof Map,nodeClass:s0,default:!1,tag:`tag:yaml.org,2002:omap`,resolve(e,t){let n=PJt(e,t),r=[];for(let{key:e}of n.items)j$(e)&&(r.includes(e.value)?t(`Ordered maps must not include duplicate keys: ${e.value}`):r.push(e.value));return Object.assign(new s0,n)},createNode:(e,t,n)=>s0.from(e,t,n)}}));function LJt({value:e,source:t},n){return t&&(e?l0:u0).test.test(t)?t:e?n.options.trueStr:n.options.falseStr}var l0,u0,RJt=s((()=>{t1(),l0={identify:e=>e===!0,default:!0,tag:`tag:yaml.org,2002:bool`,test:/^(?:Y|y|[Yy]es|YES|[Tt]rue|TRUE|[Oo]n|ON)$/,resolve:()=>new e1(!0),stringify:LJt},u0={identify:e=>e===!1,default:!0,tag:`tag:yaml.org,2002:bool`,test:/^(?:N|n|[Nn]o|NO|[Ff]alse|FALSE|[Oo]ff|OFF)$/,resolve:()=>new e1(!1),stringify:LJt}})),zJt,BJt,VJt,HJt=s((()=>{t1(),J1(),zJt={identify:e=>typeof e==`number`,default:!0,tag:`tag:yaml.org,2002:float`,test:/^(?:[-+]?\.(?:inf|Inf|INF)|\.nan|\.NaN|\.NAN)$/,resolve:e=>e.slice(-3).toLowerCase()===`nan`?NaN:e[0]===`-`?-1/0:1/0,stringify:q1},BJt={identify:e=>typeof e==`number`,default:!0,tag:`tag:yaml.org,2002:float`,format:`EXP`,test:/^[-+]?(?:[0-9][0-9_]*)?(?:\.[0-9_]*)?[eE][-+]?[0-9]+$/,resolve:e=>parseFloat(e.replace(/_/g,``)),stringify(e){let t=Number(e.value);return isFinite(t)?t.toExponential():q1(e)}},VJt={identify:e=>typeof e==`number`,default:!0,tag:`tag:yaml.org,2002:float`,test:/^[-+]?(?:[0-9][0-9_]*)?\.[0-9_]*$/,resolve(e){let t=new e1(parseFloat(e.replace(/_/g,``))),n=e.indexOf(`.`);if(n!==-1){let r=e.substring(n+1).replace(/_/g,``);r[r.length-1]===`0`&&(t.minFractionDigits=r.length)}return t},stringify:q1}}));function d0(e,t,n,{intAsBigInt:r}){let i=e[0];if((i===`-`||i===`+`)&&(t+=1),e=e.substring(t).replace(/_/g,``),r){switch(n){case 2:e=`0b${e}`;break;case 8:e=`0o${e}`;break;case 16:e=`0x${e}`;break}let t=BigInt(e);return i===`-`?BigInt(-1)*t:t}let a=parseInt(e,n);return i===`-`?-1*a:a}function f0(e,t,n){let{value:r}=e;if(p0(r)){let e=r.toString(t);return r<0?`-`+n+e.substr(1):n+e}return q1(e)}var p0,UJt,WJt,GJt,KJt,qJt=s((()=>{J1(),p0=e=>typeof e==`bigint`||Number.isInteger(e),UJt={identify:p0,default:!0,tag:`tag:yaml.org,2002:int`,format:`BIN`,test:/^[-+]?0b[0-1_]+$/,resolve:(e,t,n)=>d0(e,2,2,n),stringify:e=>f0(e,2,`0b`)},WJt={identify:p0,default:!0,tag:`tag:yaml.org,2002:int`,format:`OCT`,test:/^[-+]?0[0-7_]+$/,resolve:(e,t,n)=>d0(e,1,8,n),stringify:e=>f0(e,8,`0`)},GJt={identify:p0,default:!0,tag:`tag:yaml.org,2002:int`,test:/^[-+]?[0-9][0-9_]*$/,resolve:(e,t,n)=>d0(e,0,10,n),stringify:q1},KJt={identify:p0,default:!0,tag:`tag:yaml.org,2002:int`,format:`HEX`,test:/^[-+]?0x[0-9a-fA-F_]+$/,resolve:(e,t,n)=>d0(e,2,16,n),stringify:e=>f0(e,16,`0x`)}})),m0,h0,JJt=s((()=>{P$(),A1(),P1(),m0=class e extends N1{constructor(t){super(t),this.tag=e.tag}add(e){let t;t=A$(e)?e:e&&typeof e==`object`&&`key`in e&&`value`in e&&e.value===null?new k1(e.key,null):new k1(e,null),M1(this.items,t.key)||this.items.push(t)}get(e,t){let n=M1(this.items,e);return!t&&A$(n)?j$(n.key)?n.key.value:n.key:n}set(e,t){if(typeof t!=`boolean`)throw Error(`Expected boolean value for set(key, value) in a YAML set, not ${typeof t}`);let n=M1(this.items,e);n&&!t?this.items.splice(this.items.indexOf(n),1):!n&&t&&this.items.push(new k1(e))}toJSON(e,t){return super.toJSON(e,t,Set)}toString(e,t,n){if(!e)return JSON.stringify(this);if(this.hasAllNullValues(!0))return super.toString(Object.assign({},e,{allNullValues:!0}),t,n);throw Error(`Set items must all have null values`)}static from(e,t,n){let{replacer:r}=n,i=new this(e);if(t&&Symbol.iterator in Object(t))for(let e of t)typeof r==`function`&&(e=r.call(t,e,e)),i.items.push(O1(e,null,n));return i}},m0.tag=`tag:yaml.org,2002:set`,h0={collection:`map`,identify:e=>e instanceof Set,nodeClass:m0,default:!1,tag:`tag:yaml.org,2002:set`,createNode:(e,t,n)=>m0.from(e,t,n),resolve(e,t){if(k$(e)){if(e.hasAllNullValues(!0))return Object.assign(new m0,e);t(`Set items must all have null values`)}else t(`Expected a mapping for this tag`);return e}}}));function g0(e,t){let n=e[0],r=n===`-`||n===`+`?e.substring(1):e,i=e=>t?BigInt(e):Number(e),a=r.replace(/_/g,``).split(`:`).reduce((e,t)=>e*i(60)+i(t),i(0));return n===`-`?i(-1)*a:a}function YJt(e){let{value:t}=e,n=e=>e;if(typeof t==`bigint`)n=e=>BigInt(e);else if(isNaN(t)||!isFinite(t))return q1(e);let r=``;t<0&&(r=`-`,t*=n(-1));let i=n(60),a=[t%i];return t<60?a.unshift(0):(t=(t-a[0])/i,a.unshift(t%i),t>=60&&(t=(t-a[0])/i,a.unshift(t))),r+a.map(e=>String(e).padStart(2,`0`)).join(`:`).replace(/000000\d*$/,``)}var _0,v0,y0,XJt=s((()=>{J1(),_0={identify:e=>typeof e==`bigint`||Number.isInteger(e),default:!0,tag:`tag:yaml.org,2002:int`,format:`TIME`,test:/^[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+$/,resolve:(e,t,{intAsBigInt:n})=>g0(e,n),stringify:YJt},v0={identify:e=>typeof e==`number`,default:!0,tag:`tag:yaml.org,2002:float`,format:`TIME`,test:/^[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+\.[0-9_]*$/,resolve:e=>g0(e,!1),stringify:YJt},y0={identify:e=>e instanceof Date,default:!0,tag:`tag:yaml.org,2002:timestamp`,test:RegExp(`^([0-9]{4})-([0-9]{1,2})-([0-9]{1,2})(?:(?:t|T|[ \\t]+)([0-9]{1,2}):([0-9]{1,2}):([0-9]{1,2}(\\.[0-9]+)?)(?:[ \\t]*(Z|[-+][012]?[0-9](?::[0-9]{2})?))?)?$`),resolve(e){let t=e.match(y0.test);if(!t)throw Error(`!!timestamp expects a date, starting with yyyy-mm-dd`);let[,n,r,i,a,o,s]=t.map(Number),c=t[7]?Number((t[7]+`00`).substr(1,3)):0,l=Date.UTC(n,r-1,i,a||0,o||0,s||0,c),u=t[8];if(u&&u!==`Z`){let e=g0(u,!1);Math.abs(e)<30&&(e*=60),l-=6e4*e}return new Date(l)},stringify:({value:e})=>e?.toISOString().replace(/(T00:00:00)?\.000Z$/,``)??``}})),b0,ZJt=s((()=>{I1(),G1(),V1(),U1(),NJt(),RJt(),HJt(),qJt(),D1(),IJt(),o0(),JJt(),XJt(),b0=[F1,B1,H1,W1,l0,u0,UJt,WJt,GJt,KJt,zJt,BJt,VJt,i0,E1,c0,a0,h0,_0,v0,y0]}));function x0(e,t,n){let r=S0.get(t);if(r&&!e)return n&&!r.includes(E1)?r.concat(E1):r.slice();let i=r;if(!i)if(Array.isArray(e))i=[];else{let e=Array.from(S0.keys()).filter(e=>e!==`yaml11`).map(e=>JSON.stringify(e)).join(`, `);throw Error(`Unknown schema "${t}"; use one of ${e} or define customTags array`)}if(Array.isArray(e))for(let t of e)i=i.concat(t);else typeof e==`function`&&(i=e(i.slice()));return n&&(i=i.concat(E1)),i.reduce((e,t)=>{let n=typeof t==`string`?C0[t]:t;if(!n){let e=JSON.stringify(t),n=Object.keys(C0).map(e=>JSON.stringify(e)).join(`, `);throw Error(`Unknown custom tag ${e}; use one of ${n}`)}return e.includes(n)||e.push(n),e},[])}var S0,C0,QJt,$Jt=s((()=>{I1(),G1(),V1(),U1(),CJt(),wJt(),EJt(),OJt(),MJt(),NJt(),D1(),IJt(),o0(),ZJt(),JJt(),XJt(),S0=new Map([[`core`,DJt],[`failsafe`,[F1,B1,H1]],[`json`,jJt],[`yaml11`,b0],[`yaml-1.1`,b0]]),C0={binary:i0,bool:K1,float:Z1,floatExp:X1,floatNaN:Y1,floatTime:v0,int:t0,intHex:n0,intOct:e0,intTime:_0,map:F1,merge:E1,null:W1,omap:c0,pairs:a0,seq:B1,set:h0,timestamp:y0},QJt={"tag:yaml.org,2002:binary":i0,"tag:yaml.org,2002:merge":E1,"tag:yaml.org,2002:omap":c0,"tag:yaml.org,2002:pairs":a0,"tag:yaml.org,2002:set":h0,"tag:yaml.org,2002:timestamp":y0}})),eYt,w0,tYt=s((()=>{P$(),I1(),V1(),U1(),$Jt(),eYt=(e,t)=>e.key<t.key?-1:e.key>t.key?1:0,w0=class e{constructor({compat:e,customTags:t,merge:n,resolveKnownTags:r,schema:i,sortMapEntries:a,toStringDefaults:o}){this.compat=Array.isArray(e)?x0(e,`compat`):e?x0(null,e):null,this.name=typeof i==`string`&&i||`core`,this.knownTags=r?QJt:{},this.tags=x0(t,this.name,n),this.toStringOptions=o??null,Object.defineProperty(this,S$,{value:F1}),Object.defineProperty(this,w$,{value:H1}),Object.defineProperty(this,T$,{value:B1}),this.sortMapEntries=typeof a==`function`?a:a===!0?eYt:null}clone(){let t=Object.create(e.prototype,Object.getOwnPropertyDescriptors(this));return t.tags=this.tags.slice(),t}}}));function nYt(e,t){let n=[],r=t.directives===!0;if(t.directives!==!1&&e.directives){let t=e.directives.toString(e);t?(n.push(t),r=!0):e.directives.docStart&&(r=!0)}r&&n.push(`---`);let i=sJt(e,t),{commentString:a}=i.options;if(e.commentBefore){n.length!==1&&n.unshift(``);let t=a(e.commentBefore);n.unshift(c1(t,``))}let o=!1,s=null;if(e.contents){if(y$(e.contents)){if(e.contents.spaceBefore&&r&&n.push(``),e.contents.commentBefore){let t=a(e.contents.commentBefore);n.push(c1(t,``))}i.forceBlockIndent=!!e.comment,s=e.contents.comment}let t=s?void 0:()=>o=!0,c=S1(e.contents,i,()=>s=null,t);s&&(c+=l1(c,``,a(s))),(c[0]===`|`||c[0]===`>`)&&n[n.length-1]===`---`?n[n.length-1]=`--- ${c}`:n.push(c)}else n.push(S1(e.contents,i));if(e.directives?.docEnd)if(e.comment){let t=a(e.comment);t.includes(`
-`)?(n.push(`...`),n.push(c1(t,``))):n.push(`... ${t}`)}else n.push(`...`);else{let t=e.comment;t&&o&&(t=t.replace(/^\n+/,``)),t&&((!o||s)&&n[n.length-1]!==``&&n.push(``),n.push(c1(a(t),``)))}return n.join(`
-`)+`
-`}var rYt=s((()=>{P$(),C1(),u1()}));function T0(e){if(v$(e))return!0;throw Error(`Expected a YAML collection as document contents`)}var E0,D0=s((()=>{Q$(),s1(),P$(),A1(),q$(),tYt(),rYt(),W$(),Zqt(),r1(),Kqt(),E0=class e{constructor(e,t,n){this.commentBefore=null,this.comment=null,this.errors=[],this.warnings=[],Object.defineProperty(this,E$,{value:x$});let r=null;typeof t==`function`||Array.isArray(t)?r=t:n===void 0&&t&&(n=t,t=void 0);let i=Object.assign({intAsBigInt:!1,keepSourceTokens:!1,logLevel:`warn`,prettyErrors:!0,strict:!0,stringKeys:!1,uniqueKeys:!0,version:`1.2`},n);this.options=i;let{version:a}=i;n?._directives?(this.directives=n._directives.atDocument(),this.directives.yaml.explicit&&(a=this.directives.yaml.version)):this.directives=new U$({version:a}),this.setSchema(a,n),this.contents=e===void 0?null:this.createNode(e,r,n)}clone(){let t=Object.create(e.prototype,{[E$]:{value:x$}});return t.commentBefore=this.commentBefore,t.comment=this.comment,t.errors=this.errors.slice(),t.warnings=this.warnings.slice(),t.options=Object.assign({},this.options),this.directives&&(t.directives=this.directives.clone()),t.schema=this.schema.clone(),t.contents=y$(this.contents)?this.contents.clone(t.schema):this.contents,this.range&&(t.range=this.range.slice()),t}add(e){T0(this.contents)&&this.contents.add(e)}addIn(e,t){T0(this.contents)&&this.contents.addIn(e,t)}createAlias(e,t){if(!e.anchor){let n=Jqt(this);e.anchor=!t||n.has(t)?Yqt(t||`a`,n):t}return new Z$(e.anchor)}createNode(e,t,n){let r;if(typeof t==`function`)e=t.call({"":e},``,e),r=t;else if(Array.isArray(t)){let e=t.filter(e=>typeof e==`number`||e instanceof String||e instanceof Number).map(String);e.length>0&&(t=t.concat(e)),r=t}else n===void 0&&t&&(n=t,t=void 0);let{aliasDuplicateObjects:i,anchorPrefix:a,flow:o,keepUndefined:s,onTagObj:c,tag:l}=n??{},{onAnchor:u,setAnchors:d,sourceObjects:f}=Xqt(this,a||`a`),p={aliasDuplicateObjects:i??!0,keepUndefined:s??!1,onAnchor:u,onTagObj:c,replacer:r,schema:this.schema,sourceObjects:f},m=n1(e,l,p);return o&&v$(m)&&(m.flow=!0),d(),m}createPair(e,t,n={}){return new k1(this.createNode(e,null,n),this.createNode(t,null,n))}delete(e){return T0(this.contents)?this.contents.delete(e):!1}deleteIn(e){return a1(e)?this.contents==null?!1:(this.contents=null,!0):T0(this.contents)?this.contents.deleteIn(e):!1}get(e,t){return v$(this.contents)?this.contents.get(e,t):void 0}getIn(e,t){return a1(e)?!t&&j$(this.contents)?this.contents.value:this.contents:v$(this.contents)?this.contents.getIn(e,t):void 0}has(e){return v$(this.contents)?this.contents.has(e):!1}hasIn(e){return a1(e)?this.contents!==void 0:v$(this.contents)?this.contents.hasIn(e):!1}set(e,t){this.contents==null?this.contents=i1(this.schema,[e],t):T0(this.contents)&&this.contents.set(e,t)}setIn(e,t){a1(e)?this.contents=t:this.contents==null?this.contents=i1(this.schema,Array.from(e),t):T0(this.contents)&&this.contents.setIn(e,t)}setSchema(e,t={}){typeof e==`number`&&(e=String(e));let n;switch(e){case`1.1`:this.directives?this.directives.yaml.version=`1.1`:this.directives=new U$({version:`1.1`}),n={resolveKnownTags:!1,schema:`yaml-1.1`};break;case`1.2`:case`next`:this.directives?this.directives.yaml.version=e:this.directives=new U$({version:e}),n={resolveKnownTags:!0,schema:`core`};break;case null:this.directives&&delete this.directives,n=null;break;default:{let t=JSON.stringify(e);throw Error(`Expected '1.1', '1.2' or null as first argument, but found: ${t}`)}}if(t.schema instanceof Object)this.schema=t.schema;else if(n)this.schema=new w0(Object.assign(n,t));else throw Error(`With a null YAML version, the { schema: Schema } option is required`)}toJS({json:e,jsonArg:t,mapAsMap:n,maxAliasCount:r,onAnchor:i,reviver:a}={}){let o={anchors:new Map,doc:this,keep:!e,mapAsMap:n===!0,mapKeyWarned:!1,maxAliasCount:typeof r==`number`?r:100},s=K$(this.contents,t??``,o);if(typeof i==`function`)for(let{count:e,res:t}of o.anchors.values())i(t,e);return typeof a==`function`?G$(a,{"":s},``,s):s}toJSON(e,t){return this.toJS({json:!0,jsonArg:e,mapAsMap:!1,onAnchor:t})}toString(e={}){if(this.errors.length>0)throw Error(`Document with errors cannot be stringified`);if(`indent`in e&&(!Number.isInteger(e.indent)||Number(e.indent)<=0)){let t=JSON.stringify(e.indent);throw Error(`"indent" option must be a positive integer, not ${t}`)}return nYt(this,e)}}})),O0,k0,A0,j0,M0=s((()=>{O0=class extends Error{constructor(e,t,n,r){super(),this.name=e,this.code=n,this.message=r,this.pos=t}},k0=class extends O0{constructor(e,t,n){super(`YAMLParseError`,e,t,n)}},A0=class extends O0{constructor(e,t,n){super(`YAMLWarning`,e,t,n)}},j0=(e,t)=>n=>{if(n.pos[0]===-1)return;n.linePos=n.pos.map(e=>t.linePos(e));let{line:r,col:i}=n.linePos[0];n.message+=` at line ${r}, column ${i}`;let a=i-1,o=e.substring(t.lineStarts[r-1],t.lineStarts[r]).replace(/[\n\r]+$/,``);if(a>=60&&o.length>80){let e=Math.min(a-39,o.length-79);o=`…`+o.substring(e),a-=e-1}if(o.length>80&&(o=o.substring(0,79)+`…`),r>1&&/^ *$/.test(o.substring(0,a))){let n=e.substring(t.lineStarts[r-2],t.lineStarts[r-1]);n.length>80&&(n=n.substring(0,79)+`…
-`),o=n+o}if(/[^ ]/.test(o)){let e=1,t=n.linePos[1];t?.line===r&&t.col>i&&(e=Math.max(1,Math.min(t.col-i,80-a)));let s=` `.repeat(a)+`^`.repeat(e);n.message+=`:\n\n${o}\n${s}\n`}}}));function N0(e,{flow:t,indicator:n,next:r,offset:i,onError:a,parentIndent:o,startOnNewline:s}){let c=!1,l=s,u=s,d=``,f=``,p=!1,m=!1,h=null,g=null,_=null,v=null,y=null,b=null,x=null;for(let i of e)switch(m&&=(i.type!==`space`&&i.type!==`newline`&&i.type!==`comma`&&a(i.offset,`MISSING_CHAR`,`Tags and anchors must be separated from the next token by white space`),!1),h&&=(l&&i.type!==`comment`&&i.type!==`newline`&&a(h,`TAB_AS_INDENT`,`Tabs are not allowed as indentation`),null),i.type){case`space`:!t&&(n!==`doc-start`||r?.type!==`flow-collection`)&&i.source.includes(`	`)&&(h=i),u=!0;break;case`comment`:{u||a(i,`MISSING_CHAR`,`Comments must be separated from other tokens by white space characters`);let e=i.source.substring(1)||` `;d?d+=f+e:d=e,f=``,l=!1;break}case`newline`:l?d?d+=i.source:(!b||n!==`seq-item-ind`)&&(c=!0):f+=i.source,l=!0,p=!0,(g||_)&&(v=i),u=!0;break;case`anchor`:g&&a(i,`MULTIPLE_ANCHORS`,`A node can have at most one anchor`),i.source.endsWith(`:`)&&a(i.offset+i.source.length-1,`BAD_ALIAS`,`Anchor ending in : is ambiguous`,!0),g=i,x??=i.offset,l=!1,u=!1,m=!0;break;case`tag`:_&&a(i,`MULTIPLE_TAGS`,`A node can have at most one tag`),_=i,x??=i.offset,l=!1,u=!1,m=!0;break;case n:(g||_)&&a(i,`BAD_PROP_ORDER`,`Anchors and tags must be after the ${i.source} indicator`),b&&a(i,`UNEXPECTED_TOKEN`,`Unexpected ${i.source} in ${t??`collection`}`),b=i,l=n===`seq-item-ind`||n===`explicit-key-ind`,u=!1;break;case`comma`:if(t){y&&a(i,`UNEXPECTED_TOKEN`,`Unexpected , in ${t}`),y=i,l=!1,u=!1;break}default:a(i,`UNEXPECTED_TOKEN`,`Unexpected ${i.type} token`),l=!1,u=!1}let S=e[e.length-1],C=S?S.offset+S.source.length:i;return m&&r&&r.type!==`space`&&r.type!==`newline`&&r.type!==`comma`&&(r.type!==`scalar`||r.source!==``)&&a(r.offset,`MISSING_CHAR`,`Tags and anchors must be separated from the next token by white space`),h&&(l&&h.indent<=o||r?.type===`block-map`||r?.type===`block-seq`)&&a(h,`TAB_AS_INDENT`,`Tabs are not allowed as indentation`),{comma:y,found:b,spaceBefore:c,comment:d,hasNewline:p,anchor:g,tag:_,newlineAfterProp:v,end:C,start:x??C}}var P0=s((()=>{}));function F0(e){if(!e)return null;switch(e.type){case`alias`:case`scalar`:case`double-quoted-scalar`:case`single-quoted-scalar`:if(e.source.includes(`
-`))return!0;if(e.end){for(let t of e.end)if(t.type===`newline`)return!0}return!1;case`flow-collection`:for(let t of e.items){for(let e of t.start)if(e.type===`newline`)return!0;if(t.sep){for(let e of t.sep)if(e.type===`newline`)return!0}if(F0(t.key)||F0(t.value))return!0}return!1;default:return!0}}var I0=s((()=>{}));function L0(e,t,n){if(t?.type===`flow-collection`){let r=t.end[0];r.indent===e&&(r.source===`]`||r.source===`}`)&&F0(t)&&n(r,`BAD_INDENT`,`Flow end indicator should be more indented than parent`,!0)}}var iYt=s((()=>{I0()}));function aYt(e,t,n){let{uniqueKeys:r}=e.options;if(r===!1)return!1;let i=typeof r==`function`?r:(e,t)=>e===t||j$(e)&&j$(t)&&e.value===t.value;return t.some(e=>i(e.key,n))}var oYt=s((()=>{P$()}));function sYt({composeNode:e,composeEmptyNode:t},n,r,i,a){let o=new(a?.nodeClass??N1)(n.schema);n.atRoot&&=!1;let s=r.offset,c=null;for(let a of r.items){let{start:l,key:u,sep:d,value:f}=a,p=N0(l,{indicator:`explicit-key-ind`,next:u??d?.[0],offset:s,onError:i,parentIndent:r.indent,startOnNewline:!0}),m=!p.found;if(m){if(u&&(u.type===`block-seq`?i(s,`BLOCK_AS_IMPLICIT_KEY`,`A block sequence may not be used as an implicit map key`):`indent`in u&&u.indent!==r.indent&&i(s,`BAD_INDENT`,R0)),!p.anchor&&!p.tag&&!d){c=p.end,p.comment&&(o.comment?o.comment+=`
-`+p.comment:o.comment=p.comment);continue}(p.newlineAfterProp||F0(u))&&i(u??l[l.length-1],`MULTILINE_IMPLICIT_KEY`,`Implicit keys need to be on a single line`)}else p.found?.indent!==r.indent&&i(s,`BAD_INDENT`,R0);n.atKey=!0;let h=p.end,g=u?e(n,u,p,i):t(n,h,l,null,p,i);n.schema.compat&&L0(r.indent,u,i),n.atKey=!1,aYt(n,o.items,g)&&i(h,`DUPLICATE_KEY`,`Map keys must be unique`);let _=N0(d??[],{indicator:`map-value-ind`,next:f,offset:g.range[2],onError:i,parentIndent:r.indent,startOnNewline:!u||u.type===`block-scalar`});if(s=_.end,_.found){m&&(f?.type===`block-map`&&!_.hasNewline&&i(s,`BLOCK_AS_IMPLICIT_KEY`,`Nested mappings are not allowed in compact mappings`),n.options.strict&&p.start<_.found.offset-1024&&i(g.range,`KEY_OVER_1024_CHARS`,`The : indicator must be at most 1024 chars after the start of an implicit block mapping key`));let c=f?e(n,f,_,i):t(n,s,d,null,_,i);n.schema.compat&&L0(r.indent,f,i),s=c.range[2];let l=new k1(g,c);n.options.keepSourceTokens&&(l.srcToken=a),o.items.push(l)}else{m&&i(g.range,`MISSING_CHAR`,`Implicit map keys need to be followed by map values`),_.comment&&(g.comment?g.comment+=`
-`+_.comment:g.comment=_.comment);let e=new k1(g);n.options.keepSourceTokens&&(e.srcToken=a),o.items.push(e)}}return c&&c<s&&i(c,`IMPOSSIBLE`,`Map comment with trailing content`),o.range=[r.offset,s,c??s],o}var R0,cYt=s((()=>{A1(),P1(),P0(),I0(),iYt(),oYt(),R0=`All mapping items must start at the same column`}));function lYt({composeNode:e,composeEmptyNode:t},n,r,i,a){let o=new(a?.nodeClass??R1)(n.schema);n.atRoot&&=!1,n.atKey&&=!1;let s=r.offset,c=null;for(let{start:a,value:l}of r.items){let u=N0(a,{indicator:`seq-item-ind`,next:l,offset:s,onError:i,parentIndent:r.indent,startOnNewline:!0});if(!u.found)if(u.anchor||u.tag||l)l?.type===`block-seq`?i(u.end,`BAD_INDENT`,`All sequence items must start at the same column`):i(s,`MISSING_CHAR`,`Sequence item without - indicator`);else{c=u.end,u.comment&&(o.comment=u.comment);continue}let d=l?e(n,l,u,i):t(n,u.end,a,null,u,i);n.schema.compat&&L0(r.indent,l,i),s=d.range[2],o.items.push(d)}return o.range=[r.offset,s,c??s],o}var uYt=s((()=>{z1(),P0(),iYt()}));function z0(e,t,n,r){let i=``;if(e){let a=!1,o=``;for(let s of e){let{source:e,type:c}=s;switch(c){case`space`:a=!0;break;case`comment`:{n&&!a&&r(s,`MISSING_CHAR`,`Comments must be separated from other tokens by white space characters`);let t=e.substring(1)||` `;i?i+=o+t:i=t,o=``;break}case`newline`:i&&(o+=e),a=!0;break;default:r(s,`UNEXPECTED_TOKEN`,`Unexpected ${c} at node end`)}t+=e.length}}return{comment:i,offset:t}}var B0=s((()=>{}));function dYt({composeNode:e,composeEmptyNode:t},n,r,i,a){let o=r.start.source===`{`,s=o?`flow map`:`flow sequence`,c=new(a?.nodeClass??(o?N1:R1))(n.schema);c.flow=!0;let l=n.atRoot;l&&(n.atRoot=!1),n.atKey&&=!1;let u=r.offset+r.start.source.length;for(let a=0;a<r.items.length;++a){let l=r.items[a],{start:d,key:f,sep:p,value:m}=l,h=N0(d,{flow:s,indicator:`explicit-key-ind`,next:f??p?.[0],offset:u,onError:i,parentIndent:r.indent,startOnNewline:!1});if(!h.found){if(!h.anchor&&!h.tag&&!p&&!m){a===0&&h.comma?i(h.comma,`UNEXPECTED_TOKEN`,`Unexpected , in ${s}`):a<r.items.length-1&&i(h.start,`UNEXPECTED_TOKEN`,`Unexpected empty item in ${s}`),h.comment&&(c.comment?c.comment+=`
-`+h.comment:c.comment=h.comment),u=h.end;continue}!o&&n.options.strict&&F0(f)&&i(f,`MULTILINE_IMPLICIT_KEY`,`Implicit keys of flow sequence pairs need to be on a single line`)}if(a===0)h.comma&&i(h.comma,`UNEXPECTED_TOKEN`,`Unexpected , in ${s}`);else if(h.comma||i(h.start,`MISSING_CHAR`,`Missing , between ${s} items`),h.comment){let e=``;loop:for(let t of d)switch(t.type){case`comma`:case`space`:break;case`comment`:e=t.source.substring(1);break loop;default:break loop}if(e){let t=c.items[c.items.length-1];A$(t)&&(t=t.value??t.key),t.comment?t.comment+=`
-`+e:t.comment=e,h.comment=h.comment.substring(e.length+1)}}if(!o&&!p&&!h.found){let r=m?e(n,m,h,i):t(n,h.end,p,null,h,i);c.items.push(r),u=r.range[2],H0(m)&&i(r.range,`BLOCK_IN_FLOW`,V0)}else{n.atKey=!0;let a=h.end,g=f?e(n,f,h,i):t(n,a,d,null,h,i);H0(f)&&i(g.range,`BLOCK_IN_FLOW`,V0),n.atKey=!1;let _=N0(p??[],{flow:s,indicator:`map-value-ind`,next:m,offset:g.range[2],onError:i,parentIndent:r.indent,startOnNewline:!1});if(_.found){if(!o&&!h.found&&n.options.strict){if(p)for(let e of p){if(e===_.found)break;if(e.type===`newline`){i(e,`MULTILINE_IMPLICIT_KEY`,`Implicit keys of flow sequence pairs need to be on a single line`);break}}h.start<_.found.offset-1024&&i(_.found,`KEY_OVER_1024_CHARS`,`The : indicator must be at most 1024 chars after the start of an implicit flow sequence key`)}}else m&&(`source`in m&&m.source?.[0]===`:`?i(m,`MISSING_CHAR`,`Missing space after : in ${s}`):i(_.start,`MISSING_CHAR`,`Missing , or : between ${s} items`));let v=m?e(n,m,_,i):_.found?t(n,_.end,p,null,_,i):null;v?H0(m)&&i(v.range,`BLOCK_IN_FLOW`,V0):_.comment&&(g.comment?g.comment+=`
-`+_.comment:g.comment=_.comment);let y=new k1(g,v);if(n.options.keepSourceTokens&&(y.srcToken=l),o){let e=c;aYt(n,e.items,g)&&i(a,`DUPLICATE_KEY`,`Map keys must be unique`),e.items.push(y)}else{let e=new N1(n.schema);e.flow=!0,e.items.push(y);let t=(v??g).range;e.range=[g.range[0],t[1],t[2]],c.items.push(e)}u=v?v.range[2]:_.end}}let d=o?`}`:`]`,[f,...p]=r.end,m=u;if(f?.source===d)m=f.offset+f.source.length;else{let e=s[0].toUpperCase()+s.substring(1),t=l?`${e} must end with a ${d}`:`${e} in block collection must be sufficiently indented and end with a ${d}`;i(u,l?`MISSING_CHAR`:`BAD_INDENT`,t),f&&f.source.length!==1&&p.unshift(f)}if(p.length>0){let e=z0(p,m,n.options.strict,i);e.comment&&(c.comment?c.comment+=`
-`+e.comment:c.comment=e.comment),c.range=[r.offset,m,e.offset]}else c.range=[r.offset,m,m];return c}var V0,H0,fYt=s((()=>{P$(),A1(),P1(),z1(),B0(),P0(),I0(),oYt(),V0=`Block collections are not allowed within flow collections`,H0=e=>e&&(e.type===`block-map`||e.type===`block-seq`)}));function U0(e,t,n,r,i,a){let o=n.type===`block-map`?sYt(e,t,n,r,a):n.type===`block-seq`?lYt(e,t,n,r,a):dYt(e,t,n,r,a),s=o.constructor;return i===`!`||i===s.tagName?(o.tag=s.tagName,o):(i&&(o.tag=i),o)}function pYt(e,t,n,r,i){let a=r.tag,o=a?t.directives.tagName(a.source,e=>i(a,`TAG_RESOLVE_FAILED`,e)):null;if(n.type===`block-seq`){let{anchor:e,newlineAfterProp:t}=r,n=e&&a?e.offset>a.offset?e:a:e??a;n&&(!t||t.offset<n.offset)&&i(n,`MISSING_CHAR`,`Missing newline after block sequence props`)}let s=n.type===`block-map`?`map`:n.type===`block-seq`?`seq`:n.start.source===`{`?`map`:`seq`;if(!a||!o||o===`!`||o===N1.tagName&&s===`map`||o===R1.tagName&&s===`seq`)return U0(e,t,n,i,o);let c=t.schema.tags.find(e=>e.tag===o&&e.collection===s);if(!c){let r=t.schema.knownTags[o];if(r?.collection===s)t.schema.tags.push(Object.assign({},r,{default:!1})),c=r;else return r?i(a,`BAD_COLLECTION_TYPE`,`${r.tag} used for ${s} collection, but expects ${r.collection??`scalar`}`,!0):i(a,`TAG_RESOLVE_FAILED`,`Unresolved tag: ${o}`,!0),U0(e,t,n,i,o)}let l=U0(e,t,n,i,o,c),u=c.resolve?.(l,e=>i(a,`TAG_RESOLVE_FAILED`,e),t.options)??l,d=y$(u)?u:new e1(u);return d.range=l.range,d.tag=o,c?.format&&(d.format=c.format),d}var mYt=s((()=>{P$(),t1(),P1(),z1(),cYt(),uYt(),fYt()}));function hYt(e,t,n){let r=t.offset,i=gYt(t,e.options.strict,n);if(!i)return{value:``,type:null,comment:``,range:[r,r,r]};let a=i.mode===`>`?e1.BLOCK_FOLDED:e1.BLOCK_LITERAL,o=t.source?_Yt(t.source):[],s=o.length;for(let e=o.length-1;e>=0;--e){let t=o[e][1];if(t===``||t===`\r`)s=e;else break}if(s===0){let e=i.chomp===`+`&&o.length>0?`
-`.repeat(Math.max(1,o.length-1)):``,n=r+i.length;return t.source&&(n+=t.source.length),{value:e,type:a,comment:i.comment,range:[r,n,n]}}let c=t.indent+i.indent,l=t.offset+i.length,u=0;for(let t=0;t<s;++t){let[r,a]=o[t];if(a===``||a===`\r`)i.indent===0&&r.length>c&&(c=r.length);else{r.length<c&&n(l+r.length,`MISSING_CHAR`,`Block scalars with more-indented leading empty lines must use an explicit indentation indicator`),i.indent===0&&(c=r.length),u=t,c===0&&!e.atRoot&&n(l,`BAD_INDENT`,`Block scalar values in collections must be indented`);break}l+=r.length+a.length+1}for(let e=o.length-1;e>=s;--e)o[e][0].length>c&&(s=e+1);let d=``,f=``,p=!1;for(let e=0;e<u;++e)d+=o[e][0].slice(c)+`
-`;for(let e=u;e<s;++e){let[t,r]=o[e];l+=t.length+r.length+1;let s=r[r.length-1]===`\r`;if(s&&(r=r.slice(0,-1)),r&&t.length<c){let e=`Block scalar lines must not be less indented than their ${i.indent?`explicit indentation indicator`:`first line`}`;n(l-r.length-(s?2:1),`BAD_INDENT`,e),t=``}a===e1.BLOCK_LITERAL?(d+=f+t.slice(c)+r,f=`
-`):t.length>c||r[0]===`	`?(f===` `?f=`
-`:!p&&f===`
-`&&(f=`
-
-`),d+=f+t.slice(c)+r,f=`
-`,p=!0):r===``?f===`
-`?d+=`
-`:f=`
-`:(d+=f+r,f=` `,p=!1)}switch(i.chomp){case`-`:break;case`+`:for(let e=s;e<o.length;++e)d+=`
-`+o[e][0].slice(c);d[d.length-1]!==`
-`&&(d+=`
-`);break;default:d+=`
-`}let m=r+i.length+t.source.length;return{value:d,type:a,comment:i.comment,range:[r,m,m]}}function gYt({offset:e,props:t},n,r){if(t[0].type!==`block-scalar-header`)return r(t[0],`IMPOSSIBLE`,`Block scalar header not found`),null;let{source:i}=t[0],a=i[0],o=0,s=``,c=-1;for(let t=1;t<i.length;++t){let n=i[t];if(!s&&(n===`-`||n===`+`))s=n;else{let r=Number(n);!o&&r?o=r:c===-1&&(c=e+t)}}c!==-1&&r(c,`UNEXPECTED_TOKEN`,`Block scalar header includes extra characters: ${i}`);let l=!1,u=``,d=i.length;for(let e=1;e<t.length;++e){let i=t[e];switch(i.type){case`space`:l=!0;case`newline`:d+=i.source.length;break;case`comment`:n&&!l&&r(i,`MISSING_CHAR`,`Comments must be separated from other tokens by white space characters`),d+=i.source.length,u=i.source.substring(1);break;case`error`:r(i,`UNEXPECTED_TOKEN`,i.message),d+=i.source.length;break;default:{r(i,`UNEXPECTED_TOKEN`,`Unexpected token in block scalar header: ${i.type}`);let e=i.source;e&&typeof e==`string`&&(d+=e.length)}}}return{mode:a,indent:o,chomp:s,comment:u,length:d}}function _Yt(e){let t=e.split(/\n( *)/),n=t[0],r=n.match(/^( *)/),i=[r?.[1]?[r[1],n.slice(r[1].length)]:[``,n]];for(let e=1;e<t.length;e+=2)i.push([t[e],t[e+1]]);return i}var vYt=s((()=>{t1()}));function yYt(e,t,n){let{offset:r,type:i,source:a,end:o}=e,s,c,l=(e,t,i)=>n(r+e,t,i);switch(i){case`scalar`:s=e1.PLAIN,c=bYt(a,l);break;case`single-quoted-scalar`:s=e1.QUOTE_SINGLE,c=xYt(a,l);break;case`double-quoted-scalar`:s=e1.QUOTE_DOUBLE,c=CYt(a,l);break;default:return n(e,`UNEXPECTED_TOKEN`,`Expected a flow scalar value, but found: ${i}`),{value:``,type:null,comment:``,range:[r,r+a.length,r+a.length]}}let u=r+a.length,d=z0(o,u,t,n);return{value:c,type:s,comment:d.comment,range:[r,u,d.offset]}}function bYt(e,t){let n=``;switch(e[0]){case`	`:n=`a tab character`;break;case`,`:n=`flow indicator character ,`;break;case`%`:n=`directive indicator character %`;break;case`|`:case`>`:n=`block scalar indicator ${e[0]}`;break;case`@`:case"`":n=`reserved character ${e[0]}`;break}return n&&t(0,`BAD_SCALAR_START`,`Plain value cannot start with ${n}`),SYt(e)}function xYt(e,t){return(e[e.length-1]!==`'`||e.length===1)&&t(e.length,`MISSING_CHAR`,`Missing closing 'quote`),SYt(e.slice(1,-1)).replace(/''/g,`'`)}function SYt(e){let t,n;try{t=RegExp(`(.*?)(?<![ 	])[ 	]*\r?
-`,`sy`),n=RegExp(`[ 	]*(.*?)(?:(?<![ 	])[ 	]*)?\r?
-`,`sy`)}catch{t=/(.*?)[ \t]*\r?\n/sy,n=/[ \t]*(.*?)[ \t]*\r?\n/sy}let r=t.exec(e);if(!r)return e;let i=r[1],a=` `,o=t.lastIndex;for(n.lastIndex=o;r=n.exec(e);)r[1]===``?a===`
-`?i+=a:a=`
-`:(i+=a+r[1],a=` `),o=n.lastIndex;let s=/[ \t]*(.*)/sy;return s.lastIndex=o,r=s.exec(e),i+a+(r?.[1]??``)}function CYt(e,t){let n=``;for(let r=1;r<e.length-1;++r){let i=e[r];if(!(i===`\r`&&e[r+1]===`
-`))if(i===`
-`){let{fold:t,offset:i}=wYt(e,r);n+=t,r=i}else if(i===`\\`){let i=e[++r],a=EYt[i];if(a)n+=a;else if(i===`
-`)for(i=e[r+1];i===` `||i===`	`;)i=e[++r+1];else if(i===`\r`&&e[r+1]===`
-`)for(i=e[++r+1];i===` `||i===`	`;)i=e[++r+1];else if(i===`x`||i===`u`||i===`U`){let a={x:2,u:4,U:8}[i];n+=TYt(e,r+1,a,t),r+=a}else{let i=e.substr(r-1,2);t(r-1,`BAD_DQ_ESCAPE`,`Invalid escape sequence ${i}`),n+=i}}else if(i===` `||i===`	`){let t=r,a=e[r+1];for(;a===` `||a===`	`;)a=e[++r+1];a!==`
-`&&!(a===`\r`&&e[r+2]===`
-`)&&(n+=r>t?e.slice(t,r+1):i)}else n+=i}return(e[e.length-1]!==`"`||e.length===1)&&t(e.length,`MISSING_CHAR`,`Missing closing "quote`),n}function wYt(e,t){let n=``,r=e[t+1];for(;(r===` `||r===`	`||r===`
-`||r===`\r`)&&!(r===`\r`&&e[t+2]!==`
-`);)r===`
-`&&(n+=`
-`),t+=1,r=e[t+1];return n||=` `,{fold:n,offset:t}}function TYt(e,t,n,r){let i=e.substr(t,n),a=i.length===n&&/^[0-9a-fA-F]+$/.test(i)?parseInt(i,16):NaN;if(isNaN(a)){let i=e.substr(t-2,n+2);return r(t-2,`BAD_DQ_ESCAPE`,`Invalid escape sequence ${i}`),i}return String.fromCodePoint(a)}var EYt,DYt=s((()=>{t1(),B0(),EYt={0:`\0`,a:`\x07`,b:`\b`,e:`\x1B`,f:`\f`,n:`
-`,r:`\r`,t:`	`,v:`\v`,N:`…`,_:`\xA0`,L:`\u2028`,P:`\u2029`," ":` `,'"':`"`,"/":`/`,"\\":`\\`,"	":`	`}}));function OYt(e,t,n,r){let{value:i,type:a,comment:o,range:s}=t.type===`block-scalar`?hYt(e,t,r):yYt(t,e.options.strict,r),c=n?e.directives.tagName(n.source,e=>r(n,`TAG_RESOLVE_FAILED`,e)):null,l;l=e.options.stringKeys&&e.atKey?e.schema[w$]:c?kYt(e.schema,i,c,n,r):t.type===`scalar`?AYt(e,i,t,r):e.schema[w$];let u;try{let a=l.resolve(i,e=>r(n??t,`TAG_RESOLVE_FAILED`,e),e.options);u=j$(a)?a:new e1(a)}catch(e){let a=e instanceof Error?e.message:String(e);r(n??t,`TAG_RESOLVE_FAILED`,a),u=new e1(i)}return u.range=s,u.source=i,a&&(u.type=a),c&&(u.tag=c),l.format&&(u.format=l.format),o&&(u.comment=o),u}function kYt(e,t,n,r,i){if(n===`!`)return e[w$];let a=[];for(let t of e.tags)if(!t.collection&&t.tag===n)if(t.default&&t.test)a.push(t);else return t;for(let e of a)if(e.test?.test(t))return e;let o=e.knownTags[n];return o&&!o.collection?(e.tags.push(Object.assign({},o,{default:!1,test:void 0})),o):(i(r,`TAG_RESOLVE_FAILED`,`Unresolved tag: ${n}`,n!==`tag:yaml.org,2002:str`),e[w$])}function AYt({atKey:e,directives:t,schema:n},r,i,a){let o=n.tags.find(t=>(t.default===!0||e&&t.default===`key`)&&t.test?.test(r))||n[w$];if(n.compat){let e=n.compat.find(e=>e.default&&e.test?.test(r))??n[w$];o.tag!==e.tag&&a(i,`TAG_RESOLVE_FAILED`,`Value may be parsed as either ${t.tagString(o.tag)} or ${t.tagString(e.tag)}`,!0)}return o}var jYt=s((()=>{P$(),t1(),vYt(),DYt()}));function MYt(e,t,n){if(t){n??=t.length;for(let r=n-1;r>=0;--r){let n=t[r];switch(n.type){case`space`:case`comment`:case`newline`:e-=n.source.length;continue}for(n=t[++r];n?.type===`space`;)e+=n.source.length,n=t[++r];break}}return e}var NYt=s((()=>{}));function PYt(e,t,n,r){let i=e.atKey,{spaceBefore:a,comment:o,anchor:s,tag:c}=n,l,u=!0;switch(t.type){case`alias`:l=FYt(e,t,r),(s||c)&&r(t,`ALIAS_PROPS`,`An alias node must not specify any properties`);break;case`scalar`:case`single-quoted-scalar`:case`double-quoted-scalar`:case`block-scalar`:l=OYt(e,t,c,r),s&&(l.anchor=s.source.substring(1));break;case`block-map`:case`block-seq`:case`flow-collection`:try{l=pYt(IYt,e,t,n,r),s&&(l.anchor=s.source.substring(1))}catch(e){r(t,`RESOURCE_EXHAUSTION`,e instanceof Error?e.message:String(e))}break;default:r(t,`UNEXPECTED_TOKEN`,t.type===`error`?t.message:`Unsupported token (type: ${t.type})`),u=!1}return l??=W0(e,t.offset,void 0,null,n,r),s&&l.anchor===``&&r(s,`BAD_ALIAS`,`Anchor cannot be an empty string`),i&&e.options.stringKeys&&(!j$(l)||typeof l.value!=`string`||l.tag&&l.tag!==`tag:yaml.org,2002:str`)&&r(c??t,`NON_STRING_KEY`,`With stringKeys, all keys must be strings`),a&&(l.spaceBefore=!0),o&&(t.type===`scalar`&&t.source===``?l.comment=o:l.commentBefore=o),e.options.keepSourceTokens&&u&&(l.srcToken=t),l}function W0(e,t,n,r,{spaceBefore:i,comment:a,anchor:o,tag:s,end:c},l){let u=OYt(e,{type:`scalar`,offset:MYt(t,n,r),indent:-1,source:``},s,l);return o&&(u.anchor=o.source.substring(1),u.anchor===``&&l(o,`BAD_ALIAS`,`Anchor cannot be an empty string`)),i&&(u.spaceBefore=!0),a&&(u.comment=a,u.range[2]=c),u}function FYt({options:e},{offset:t,source:n,end:r},i){let a=new Z$(n.substring(1));a.source===``&&i(t,`BAD_ALIAS`,`Alias cannot be an empty string`),a.source.endsWith(`:`)&&i(t+n.length-1,`BAD_ALIAS`,`Alias ending in : is ambiguous`,!0);let o=t+n.length,s=z0(r,o,e.strict,i);return a.range=[t,o,s.offset],s.comment&&(a.comment=s.comment),a}var IYt,LYt=s((()=>{Q$(),P$(),mYt(),jYt(),B0(),NYt(),IYt={composeNode:PYt,composeEmptyNode:W0}}));function RYt(e,t,{offset:n,start:r,value:i,end:a},o){let s=new E0(void 0,Object.assign({_directives:t},e)),c={atKey:!1,atRoot:!0,directives:s.directives,options:s.options,schema:s.schema},l=N0(r,{indicator:`doc-start`,next:i??a?.[0],offset:n,onError:o,parentIndent:0,startOnNewline:!0});l.found&&(s.directives.docStart=!0,i&&(i.type===`block-map`||i.type===`block-seq`)&&!l.hasNewline&&o(l.end,`MISSING_CHAR`,`Block collection cannot start on same line with directives-end marker`)),s.contents=i?PYt(c,i,l,o):W0(c,l.end,r,null,l,o);let u=s.contents.range[2],d=z0(a,u,!1,o);return d.comment&&(s.comment=d.comment),s.range=[n,u,d.offset],s}var zYt=s((()=>{D0(),LYt(),B0(),P0()}));function G0(e){if(typeof e==`number`)return[e,e+1];if(Array.isArray(e))return e.length===2?e:[e[0],e[1]];let{offset:t,source:n}=e;return[t,t+(typeof n==`string`?n.length:1)]}function BYt(e){let t=``,n=!1,r=!1;for(let i=0;i<e.length;++i){let a=e[i];switch(a[0]){case`#`:t+=(t===``?``:r?`
-
-`:`
-`)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}var K0,VYt=s((()=>{Kqt(),D0(),M0(),P$(),zYt(),B0(),K0=class{constructor(e={}){this.doc=null,this.atDirectives=!1,this.prelude=[],this.errors=[],this.warnings=[],this.onError=(e,t,n,r)=>{let i=G0(e);r?this.warnings.push(new A0(i,t,n)):this.errors.push(new k0(i,t,n))},this.directives=new U$({version:e.version||`1.2`}),this.options=e}decorate(e,t){let{comment:n,afterEmptyLine:r}=BYt(this.prelude);if(n){let i=e.contents;if(t)e.comment=e.comment?`${e.comment}\n${n}`:n;else if(r||e.directives.docStart||!i)e.commentBefore=n;else if(v$(i)&&!i.flow&&i.items.length>0){let e=i.items[0];A$(e)&&(e=e.key);let t=e.commentBefore;e.commentBefore=t?`${n}\n${t}`:n}else{let e=i.commentBefore;i.commentBefore=e?`${n}\n${e}`:n}}t?(Array.prototype.push.apply(e.errors,this.errors),Array.prototype.push.apply(e.warnings,this.warnings)):(e.errors=this.errors,e.warnings=this.warnings),this.prelude=[],this.errors=[],this.warnings=[]}streamInfo(){return{comment:BYt(this.prelude).comment,directives:this.directives,errors:this.errors,warnings:this.warnings}}*compose(e,t=!1,n=-1){for(let t of e)yield*this.next(t);yield*this.end(t,n)}*next(e){switch(e.type){case`directive`:this.directives.add(e.source,(t,n,r)=>{let i=G0(e);i[0]+=t,this.onError(i,`BAD_DIRECTIVE`,n,r)}),this.prelude.push(e.source),this.atDirectives=!0;break;case`document`:{let t=RYt(this.options,this.directives,e,this.onError);this.atDirectives&&!t.directives.docStart&&this.onError(e,`MISSING_CHAR`,`Missing directives-end/doc-start indicator line`),this.decorate(t,!1),this.doc&&(yield this.doc),this.doc=t,this.atDirectives=!1;break}case`byte-order-mark`:case`space`:break;case`comment`:case`newline`:this.prelude.push(e.source);break;case`error`:{let t=e.source?`${e.message}: ${JSON.stringify(e.source)}`:e.message,n=new k0(G0(e),`UNEXPECTED_TOKEN`,t);this.atDirectives||!this.doc?this.errors.push(n):this.doc.errors.push(n);break}case`doc-end`:{if(!this.doc){this.errors.push(new k0(G0(e),`UNEXPECTED_TOKEN`,`Unexpected doc-end without preceding document`));break}this.doc.directives.docEnd=!0;let t=z0(e.end,e.offset+e.source.length,this.doc.options.strict,this.onError);if(this.decorate(this.doc,!0),t.comment){let e=this.doc.comment;this.doc.comment=e?`${e}\n${t.comment}`:t.comment}this.doc.range[2]=t.offset;break}default:this.errors.push(new k0(G0(e),`UNEXPECTED_TOKEN`,`Unsupported token ${e.type}`))}}*end(e=!1,t=-1){if(this.doc)this.decorate(this.doc,!0),yield this.doc,this.doc=null;else if(e){let e=new E0(void 0,Object.assign({_directives:this.directives},this.options));this.atDirectives&&this.onError(t,`MISSING_CHAR`,`Missing directives-end indicator line`),e.range=[0,t,t],this.decorate(e,!1),yield e}}}}));function HYt(e,t=!0,n){if(e){let r=(e,t,r)=>{let i=typeof e==`number`?e:Array.isArray(e)?e[0]:e.offset;if(n)n(i,t,r);else throw new k0([i,i+1],t,r)};switch(e.type){case`scalar`:case`single-quoted-scalar`:case`double-quoted-scalar`:return yYt(e,t,r);case`block-scalar`:return hYt({options:{strict:t}},e,r)}}return null}function UYt(e,t){let{implicitKey:n=!1,indent:r,inFlow:i=!1,offset:a=-1,type:o=`PLAIN`}=t,s=_1({type:o,value:e},{implicitKey:n,indent:r>0?` `.repeat(r):``,inFlow:i,options:{blockQuote:!0,lineWidth:-1}}),c=t.end??[{type:`newline`,offset:-1,indent:r,source:`
-`}];switch(s[0]){case`|`:case`>`:{let e=s.indexOf(`
-`),t=s.substring(0,e),n=s.substring(e+1)+`
-`,i=[{type:`block-scalar-header`,offset:a,indent:r,source:t}];return KYt(i,c)||i.push({type:`newline`,offset:-1,indent:r,source:`
-`}),{type:`block-scalar`,offset:a,indent:r,props:i,source:n}}case`"`:return{type:`double-quoted-scalar`,offset:a,indent:r,source:s,end:c};case`'`:return{type:`single-quoted-scalar`,offset:a,indent:r,source:s,end:c};default:return{type:`scalar`,offset:a,indent:r,source:s,end:c}}}function WYt(e,t,n={}){let{afterKey:r=!1,implicitKey:i=!1,inFlow:a=!1,type:o}=n,s=`indent`in e?e.indent:null;if(r&&typeof s==`number`&&(s+=2),!o)switch(e.type){case`single-quoted-scalar`:o=`QUOTE_SINGLE`;break;case`double-quoted-scalar`:o=`QUOTE_DOUBLE`;break;case`block-scalar`:{let t=e.props[0];if(t.type!==`block-scalar-header`)throw Error(`Invalid block scalar header`);o=t.source[0]===`>`?`BLOCK_FOLDED`:`BLOCK_LITERAL`;break}default:o=`PLAIN`}let c=_1({type:o,value:t},{implicitKey:i||s===null,indent:s!==null&&s>0?` `.repeat(s):``,inFlow:a,options:{blockQuote:!0,lineWidth:-1}});switch(c[0]){case`|`:case`>`:GYt(e,c);break;case`"`:q0(e,c,`double-quoted-scalar`);break;case`'`:q0(e,c,`single-quoted-scalar`);break;default:q0(e,c,`scalar`)}}function GYt(e,t){let n=t.indexOf(`
-`),r=t.substring(0,n),i=t.substring(n+1)+`
-`;if(e.type===`block-scalar`){let t=e.props[0];if(t.type!==`block-scalar-header`)throw Error(`Invalid block scalar header`);t.source=r,e.source=i}else{let{offset:t}=e,n=`indent`in e?e.indent:-1,a=[{type:`block-scalar-header`,offset:t,indent:n,source:r}];KYt(a,`end`in e?e.end:void 0)||a.push({type:`newline`,offset:-1,indent:n,source:`
-`});for(let t of Object.keys(e))t!==`type`&&t!==`offset`&&delete e[t];Object.assign(e,{type:`block-scalar`,indent:n,props:a,source:i})}}function KYt(e,t){if(t)for(let n of t)switch(n.type){case`space`:case`comment`:e.push(n);break;case`newline`:return e.push(n),!0}return!1}function q0(e,t,n){switch(e.type){case`scalar`:case`double-quoted-scalar`:case`single-quoted-scalar`:e.type=n,e.source=t;break;case`block-scalar`:{let r=e.props.slice(1),i=t.length;e.props[0].type===`block-scalar-header`&&(i-=e.props[0].source.length);for(let e of r)e.offset+=i;delete e.props,Object.assign(e,{type:n,source:t,end:r});break}case`block-map`:case`block-seq`:{let r={type:`newline`,offset:e.offset+t.length,indent:e.indent,source:`
-`};delete e.items,Object.assign(e,{type:n,source:t,end:[r]});break}default:{let r=`indent`in e?e.indent:-1,i=`end`in e&&Array.isArray(e.end)?e.end.filter(e=>e.type===`space`||e.type===`comment`||e.type===`newline`):[];for(let t of Object.keys(e))t!==`type`&&t!==`offset`&&delete e[t];Object.assign(e,{type:n,indent:r,source:t,end:i})}}}var qYt=s((()=>{vYt(),DYt(),M0(),x1()}));function J0(e){switch(e.type){case`block-scalar`:{let t=``;for(let n of e.props)t+=J0(n);return t+e.source}case`block-map`:case`block-seq`:{let t=``;for(let n of e.items)t+=Y0(n);return t}case`flow-collection`:{let t=e.start.source;for(let n of e.items)t+=Y0(n);for(let n of e.end)t+=n.source;return t}case`document`:{let t=Y0(e);if(e.end)for(let n of e.end)t+=n.source;return t}default:{let t=e.source;if(`end`in e&&e.end)for(let n of e.end)t+=n.source;return t}}}function Y0({start:e,key:t,sep:n,value:r}){let i=``;for(let t of e)i+=t.source;if(t&&(i+=J0(t)),n)for(let e of n)i+=e.source;return r&&(i+=J0(r)),i}var JYt,YYt=s((()=>{JYt=e=>`type`in e?J0(e):Y0(e)}));function X0(e,t){`type`in e&&e.type===`document`&&(e={start:e.start,value:e.value}),XYt(Object.freeze([]),e,t)}function XYt(e,t,n){let r=n(t,e);if(typeof r==`symbol`)return r;for(let i of[`key`,`value`]){let a=t[i];if(a&&`items`in a){for(let t=0;t<a.items.length;++t){let r=XYt(Object.freeze(e.concat([[i,t]])),a.items[t],n);if(typeof r==`number`)t=r-1;else if(r===Z0)return Z0;else r===Q0&&(a.items.splice(t,1),--t)}typeof r==`function`&&i===`key`&&(r=r(t,e))}}return typeof r==`function`?r(t,e):r}var Z0,ZYt,Q0,QYt=s((()=>{Z0=Symbol(`break visit`),ZYt=Symbol(`skip children`),Q0=Symbol(`remove item`),X0.BREAK=Z0,X0.SKIP=ZYt,X0.REMOVE=Q0,X0.itemAtPath=(e,t)=>{let n=e;for(let[e,r]of t){let t=n?.[e];if(t&&`items`in t)n=t.items[r];else return}return n},X0.parentCollection=(e,t)=>{let n=X0.itemAtPath(e,t.slice(0,-1)),r=t[t.length-1][0],i=n?.[r];if(i&&`items`in i)return i;throw Error(`Parent collection not found`)}})),$Yt=l({BOM:()=>``,DOCUMENT:()=>``,FLOW_END:()=>``,SCALAR:()=>``,createScalarToken:()=>UYt,isCollection:()=>nXt,isScalar:()=>rXt,prettyToken:()=>eXt,resolveAsScalar:()=>HYt,setScalarValue:()=>WYt,stringify:()=>JYt,tokenType:()=>tXt,visit:()=>X0});function eXt(e){switch(e){case``:return`<BOM>`;case``:return`<DOC>`;case``:return`<FLOW_END>`;case``:return`<SCALAR>`;default:return JSON.stringify(e)}}function tXt(e){switch(e){case``:return`byte-order-mark`;case``:return`doc-mode`;case``:return`flow-error-end`;case``:return`scalar`;case`---`:return`doc-start`;case`...`:return`doc-end`;case``:case`
-`:case`\r
-`:return`newline`;case`-`:return`seq-item-ind`;case`?`:return`explicit-key-ind`;case`:`:return`map-value-ind`;case`{`:return`flow-map-start`;case`}`:return`flow-map-end`;case`[`:return`flow-seq-start`;case`]`:return`flow-seq-end`;case`,`:return`comma`}switch(e[0]){case` `:case`	`:return`space`;case`#`:return`comment`;case`%`:return`directive-line`;case`*`:return`alias`;case`&`:return`anchor`;case`!`:return`tag`;case`'`:return`single-quoted-scalar`;case`"`:return`double-quoted-scalar`;case`|`:case`>`:return`block-scalar-header`}return null}var nXt,rXt,$0=s((()=>{qYt(),YYt(),QYt(),nXt=e=>!!e&&`items`in e,rXt=e=>!!e&&(e.type===`scalar`||e.type===`single-quoted-scalar`||e.type===`double-quoted-scalar`||e.type===`block-scalar`)}));function e2(e){switch(e){case void 0:case` `:case`
-`:case`\r`:case`	`:return!0;default:return!1}}var t2,iXt,n2,aXt,r2,i2,oXt=s((()=>{$0(),t2=new Set(`0123456789ABCDEFabcdef`),iXt=new Set(`0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-#;/?:@&=+$_.!~*'()`),n2=new Set(`,[]{}`),aXt=new Set(` ,[]{}
-\r	`),r2=e=>!e||aXt.has(e),i2=class{constructor(){this.atEnd=!1,this.blockScalarIndent=-1,this.blockScalarKeep=!1,this.buffer=``,this.flowKey=!1,this.flowLevel=0,this.indentNext=0,this.indentValue=0,this.lineEndPos=null,this.next=null,this.pos=0}*lex(e,t=!1){if(e){if(typeof e!=`string`)throw TypeError(`source is not a string`);this.buffer=this.buffer?this.buffer+e:e,this.lineEndPos=null}this.atEnd=!t;let n=this.next??`stream`;for(;n&&(t||this.hasChars(1));)n=yield*this.parseNext(n)}atLineEnd(){let e=this.pos,t=this.buffer[e];for(;t===` `||t===`	`;)t=this.buffer[++e];return!t||t===`#`||t===`
-`?!0:t===`\r`?this.buffer[e+1]===`
-`:!1}charAt(e){return this.buffer[this.pos+e]}continueScalar(e){let t=this.buffer[e];if(this.indentNext>0){let n=0;for(;t===` `;)t=this.buffer[++n+e];if(t===`\r`){let t=this.buffer[n+e+1];if(t===`
-`||!t&&!this.atEnd)return e+n+1}return t===`
-`||n>=this.indentNext||!t&&!this.atEnd?e+n:-1}if(t===`-`||t===`.`){let t=this.buffer.substr(e,3);if((t===`---`||t===`...`)&&e2(this.buffer[e+3]))return-1}return e}getLine(){let e=this.lineEndPos;return(typeof e!=`number`||e!==-1&&e<this.pos)&&(e=this.buffer.indexOf(`
-`,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buffer.substring(this.pos),this.pos=0,this.lineEndPos=null,this.next=e,null}peek(e){return this.buffer.substr(this.pos,e)}*parseNext(e){switch(e){case`stream`:return yield*this.parseStream();case`line-start`:return yield*this.parseLineStart();case`block-start`:return yield*this.parseBlockStart();case`doc`:return yield*this.parseDocument();case`flow`:return yield*this.parseFlowCollection();case`quoted-scalar`:return yield*this.parseQuotedScalar();case`block-scalar`:return yield*this.parseBlockScalar();case`plain-scalar`:return yield*this.parsePlainScalar()}}*parseStream(){let e=this.getLine();if(e===null)return this.setNext(`stream`);if(e[0]===``&&(yield*this.pushCount(1),e=e.substring(1)),e[0]===`%`){let t=e.length,n=e.indexOf(`#`);for(;n!==-1;){let r=e[n-1];if(r===` `||r===`	`){t=n-1;break}else n=e.indexOf(`#`,n+1)}for(;;){let n=e[t-1];if(n===` `||n===`	`)--t;else break}let r=(yield*this.pushCount(t))+(yield*this.pushSpaces(!0));return yield*this.pushCount(e.length-r),this.pushNewline(),`stream`}if(this.atLineEnd()){let t=yield*this.pushSpaces(!0);return yield*this.pushCount(e.length-t),yield*this.pushNewline(),`stream`}return yield``,yield*this.parseLineStart()}*parseLineStart(){let e=this.charAt(0);if(!e&&!this.atEnd)return this.setNext(`line-start`);if(e===`-`||e===`.`){if(!this.atEnd&&!this.hasChars(4))return this.setNext(`line-start`);let e=this.peek(3);if((e===`---`||e===`...`)&&e2(this.charAt(3)))return yield*this.pushCount(3),this.indentValue=0,this.indentNext=0,e===`---`?`doc`:`stream`}return this.indentValue=yield*this.pushSpaces(!1),this.indentNext>this.indentValue&&!e2(this.charAt(1))&&(this.indentNext=this.indentValue),yield*this.parseBlockStart()}*parseBlockStart(){let[e,t]=this.peek(2);if(!t&&!this.atEnd)return this.setNext(`block-start`);if((e===`-`||e===`?`||e===`:`)&&e2(t)){let e=(yield*this.pushCount(1))+(yield*this.pushSpaces(!0));return this.indentNext=this.indentValue+1,this.indentValue+=e,yield*this.parseBlockStart()}return`doc`}*parseDocument(){yield*this.pushSpaces(!0);let e=this.getLine();if(e===null)return this.setNext(`doc`);let t=yield*this.pushIndicators();switch(e[t]){case`#`:yield*this.pushCount(e.length-t);case void 0:return yield*this.pushNewline(),yield*this.parseLineStart();case`{`:case`[`:return yield*this.pushCount(1),this.flowKey=!1,this.flowLevel=1,`flow`;case`}`:case`]`:return yield*this.pushCount(1),`doc`;case`*`:return yield*this.pushUntil(r2),`doc`;case`"`:case`'`:return yield*this.parseQuotedScalar();case`|`:case`>`:return t+=yield*this.parseBlockScalarHeader(),t+=yield*this.pushSpaces(!0),yield*this.pushCount(e.length-t),yield*this.pushNewline(),yield*this.parseBlockScalar();default:return yield*this.parsePlainScalar()}}*parseFlowCollection(){let e,t,n=-1;do e=yield*this.pushNewline(),e>0?(t=yield*this.pushSpaces(!1),this.indentValue=n=t):t=0,t+=yield*this.pushSpaces(!0);while(e+t>0);let r=this.getLine();if(r===null)return this.setNext(`flow`);if((n!==-1&&n<this.indentNext&&r[0]!==`#`||n===0&&(r.startsWith(`---`)||r.startsWith(`...`))&&e2(r[3]))&&!(n===this.indentNext-1&&this.flowLevel===1&&(r[0]===`]`||r[0]===`}`)))return this.flowLevel=0,yield``,yield*this.parseLineStart();let i=0;for(;r[i]===`,`;)i+=yield*this.pushCount(1),i+=yield*this.pushSpaces(!0),this.flowKey=!1;switch(i+=yield*this.pushIndicators(),r[i]){case void 0:return`flow`;case`#`:return yield*this.pushCount(r.length-i),`flow`;case`{`:case`[`:return yield*this.pushCount(1),this.flowKey=!1,this.flowLevel+=1,`flow`;case`}`:case`]`:return yield*this.pushCount(1),this.flowKey=!0,--this.flowLevel,this.flowLevel?`flow`:`doc`;case`*`:return yield*this.pushUntil(r2),`flow`;case`"`:case`'`:return this.flowKey=!0,yield*this.parseQuotedScalar();case`:`:{let e=this.charAt(1);if(this.flowKey||e2(e)||e===`,`)return this.flowKey=!1,yield*this.pushCount(1),yield*this.pushSpaces(!0),`flow`}default:return this.flowKey=!1,yield*this.parsePlainScalar()}}*parseQuotedScalar(){let e=this.charAt(0),t=this.buffer.indexOf(e,this.pos+1);if(e===`'`)for(;t!==-1&&this.buffer[t+1]===`'`;)t=this.buffer.indexOf(`'`,t+2);else for(;t!==-1;){let e=0;for(;this.buffer[t-1-e]===`\\`;)e+=1;if(e%2==0)break;t=this.buffer.indexOf(`"`,t+1)}let n=this.buffer.substring(0,t),r=n.indexOf(`
-`,this.pos);if(r!==-1){for(;r!==-1;){let e=this.continueScalar(r+1);if(e===-1)break;r=n.indexOf(`
-`,e)}r!==-1&&(t=r-(n[r-1]===`\r`?2:1))}if(t===-1){if(!this.atEnd)return this.setNext(`quoted-scalar`);t=this.buffer.length}return yield*this.pushToIndex(t+1,!1),this.flowLevel?`flow`:`doc`}*parseBlockScalarHeader(){this.blockScalarIndent=-1,this.blockScalarKeep=!1;let e=this.pos;for(;;){let t=this.buffer[++e];if(t===`+`)this.blockScalarKeep=!0;else if(t>`0`&&t<=`9`)this.blockScalarIndent=Number(t)-1;else if(t!==`-`)break}return yield*this.pushUntil(e=>e2(e)||e===`#`)}*parseBlockScalar(){let e=this.pos-1,t=0,n;loop:for(let r=this.pos;n=this.buffer[r];++r)switch(n){case` `:t+=1;break;case`
-`:e=r,t=0;break;case`\r`:{let e=this.buffer[r+1];if(!e&&!this.atEnd)return this.setNext(`block-scalar`);if(e===`
-`)break}default:break loop}if(!n&&!this.atEnd)return this.setNext(`block-scalar`);if(t>=this.indentNext){this.blockScalarIndent===-1?this.indentNext=t:this.indentNext=this.blockScalarIndent+(this.indentNext===0?1:this.indentNext);do{let t=this.continueScalar(e+1);if(t===-1)break;e=this.buffer.indexOf(`
-`,t)}while(e!==-1);if(e===-1){if(!this.atEnd)return this.setNext(`block-scalar`);e=this.buffer.length}}let r=e+1;for(n=this.buffer[r];n===` `;)n=this.buffer[++r];if(n===`	`){for(;n===`	`||n===` `||n===`\r`||n===`
-`;)n=this.buffer[++r];e=r-1}else if(!this.blockScalarKeep)do{let n=e-1,r=this.buffer[n];r===`\r`&&(r=this.buffer[--n]);let i=n;for(;r===` `;)r=this.buffer[--n];if(r===`
-`&&n>=this.pos&&n+1+t>i)e=n;else break}while(!0);return yield``,yield*this.pushToIndex(e+1,!0),yield*this.parseLineStart()}*parsePlainScalar(){let e=this.flowLevel>0,t=this.pos-1,n=this.pos-1,r;for(;r=this.buffer[++n];)if(r===`:`){let r=this.buffer[n+1];if(e2(r)||e&&n2.has(r))break;t=n}else if(e2(r)){let i=this.buffer[n+1];if(r===`\r`&&(i===`
-`?(n+=1,r=`
-`,i=this.buffer[n+1]):t=n),i===`#`||e&&n2.has(i))break;if(r===`
-`){let e=this.continueScalar(n+1);if(e===-1)break;n=Math.max(n,e-2)}}else{if(e&&n2.has(r))break;t=n}return!r&&!this.atEnd?this.setNext(`plain-scalar`):(yield``,yield*this.pushToIndex(t+1,!0),e?`flow`:`doc`)}*pushCount(e){return e>0?(yield this.buffer.substr(this.pos,e),this.pos+=e,e):0}*pushToIndex(e,t){let n=this.buffer.slice(this.pos,e);return n?(yield n,this.pos+=n.length,n.length):(t&&(yield``),0)}*pushIndicators(){switch(this.charAt(0)){case`!`:return(yield*this.pushTag())+(yield*this.pushSpaces(!0))+(yield*this.pushIndicators());case`&`:return(yield*this.pushUntil(r2))+(yield*this.pushSpaces(!0))+(yield*this.pushIndicators());case`-`:case`?`:case`:`:{let e=this.flowLevel>0,t=this.charAt(1);if(e2(t)||e&&n2.has(t))return e?this.flowKey&&=!1:this.indentNext=this.indentValue+1,(yield*this.pushCount(1))+(yield*this.pushSpaces(!0))+(yield*this.pushIndicators())}}return 0}*pushTag(){if(this.charAt(1)===`<`){let e=this.pos+2,t=this.buffer[e];for(;!e2(t)&&t!==`>`;)t=this.buffer[++e];return yield*this.pushToIndex(t===`>`?e+1:e,!1)}else{let e=this.pos+1,t=this.buffer[e];for(;t;)if(iXt.has(t))t=this.buffer[++e];else if(t===`%`&&t2.has(this.buffer[e+1])&&t2.has(this.buffer[e+2]))t=this.buffer[e+=3];else break;return yield*this.pushToIndex(e,!1)}}*pushNewline(){let e=this.buffer[this.pos];return e===`
-`?yield*this.pushCount(1):e===`\r`&&this.charAt(1)===`
-`?yield*this.pushCount(2):0}*pushSpaces(e){let t=this.pos-1,n;do n=this.buffer[++t];while(n===` `||e&&n===`	`);let r=t-this.pos;return r>0&&(yield this.buffer.substr(this.pos,r),this.pos=t),r}*pushUntil(e){let t=this.pos,n=this.buffer[t];for(;!e(n);)n=this.buffer[++t];return yield*this.pushToIndex(t,!1)}}})),a2,sXt=s((()=>{a2=class{constructor(){this.lineStarts=[],this.addNewLine=e=>this.lineStarts.push(e),this.linePos=e=>{let t=0,n=this.lineStarts.length;for(;t<n;){let r=t+n>>1;this.lineStarts[r]<e?t=r+1:n=r}if(this.lineStarts[t]===e)return{line:t+1,col:1};if(t===0)return{line:0,col:e};let r=this.lineStarts[t-1];return{line:t,col:e-r+1}}}}}));function o2(e,t){for(let n=0;n<e.length;++n)if(e[n].type===t)return!0;return!1}function cXt(e){for(let t=0;t<e.length;++t)switch(e[t].type){case`space`:case`comment`:case`newline`:break;default:return t}return-1}function lXt(e){switch(e?.type){case`alias`:case`scalar`:case`single-quoted-scalar`:case`double-quoted-scalar`:case`flow-collection`:return!0;default:return!1}}function s2(e){switch(e.type){case`document`:return e.start;case`block-map`:{let t=e.items[e.items.length-1];return t.sep??t.start}case`block-seq`:return e.items[e.items.length-1].start;default:return[]}}function c2(e){if(e.length===0)return[];let t=e.length;loop:for(;--t>=0;)switch(e[t].type){case`doc-start`:case`explicit-key-ind`:case`map-value-ind`:case`seq-item-ind`:case`newline`:break loop}for(;e[++t]?.type===`space`;);return e.splice(t,e.length)}function uXt(e){if(e.start.type===`flow-seq-start`)for(let t of e.items)t.sep&&!t.value&&!o2(t.start,`explicit-key-ind`)&&!o2(t.sep,`map-value-ind`)&&(t.key&&(t.value=t.key),delete t.key,lXt(t.value)?t.value.end?Array.prototype.push.apply(t.value.end,t.sep):t.value.end=t.sep:Array.prototype.push.apply(t.start,t.sep),delete t.sep)}var l2,dXt=s((()=>{$0(),oXt(),l2=class{constructor(e){this.atNewLine=!0,this.atScalar=!1,this.indent=0,this.offset=0,this.onKeyLine=!1,this.stack=[],this.source=``,this.type=``,this.lexer=new i2,this.onNewLine=e}*parse(e,t=!1){this.onNewLine&&this.offset===0&&this.onNewLine(0);for(let n of this.lexer.lex(e,t))yield*this.next(n);t||(yield*this.end())}*next(e){if(this.source=e,this.atScalar){this.atScalar=!1,yield*this.step(),this.offset+=e.length;return}let t=tXt(e);if(!t){let t=`Not a YAML token: ${e}`;yield*this.pop({type:`error`,offset:this.offset,message:t,source:e}),this.offset+=e.length}else if(t===`scalar`)this.atNewLine=!1,this.atScalar=!0,this.type=`scalar`;else{switch(this.type=t,yield*this.step(),t){case`newline`:this.atNewLine=!0,this.indent=0,this.onNewLine&&this.onNewLine(this.offset+e.length);break;case`space`:this.atNewLine&&e[0]===` `&&(this.indent+=e.length);break;case`explicit-key-ind`:case`map-value-ind`:case`seq-item-ind`:this.atNewLine&&(this.indent+=e.length);break;case`doc-mode`:case`flow-error-end`:return;default:this.atNewLine=!1}this.offset+=e.length}}*end(){for(;this.stack.length>0;)yield*this.pop()}get sourceToken(){return{type:this.type,offset:this.offset,indent:this.indent,source:this.source}}*step(){let e=this.peek(1);if(this.type===`doc-end`&&e?.type!==`doc-end`){for(;this.stack.length>0;)yield*this.pop();this.stack.push({type:`doc-end`,offset:this.offset,source:this.source});return}if(!e)return yield*this.stream();switch(e.type){case`document`:return yield*this.document(e);case`alias`:case`scalar`:case`single-quoted-scalar`:case`double-quoted-scalar`:return yield*this.scalar(e);case`block-scalar`:return yield*this.blockScalar(e);case`block-map`:return yield*this.blockMap(e);case`block-seq`:return yield*this.blockSequence(e);case`flow-collection`:return yield*this.flowCollection(e);case`doc-end`:return yield*this.documentEnd(e)}yield*this.pop()}peek(e){return this.stack[this.stack.length-e]}*pop(e){let t=e??this.stack.pop();if(!t)yield{type:`error`,offset:this.offset,source:``,message:`Tried to pop an empty stack`};else if(this.stack.length===0)yield t;else{let e=this.peek(1);switch(t.type===`block-scalar`?t.indent=`indent`in e?e.indent:0:t.type===`flow-collection`&&e.type===`document`&&(t.indent=0),t.type===`flow-collection`&&uXt(t),e.type){case`document`:e.value=t;break;case`block-scalar`:e.props.push(t);break;case`block-map`:{let n=e.items[e.items.length-1];if(n.value){e.items.push({start:[],key:t,sep:[]}),this.onKeyLine=!0;return}else if(n.sep)n.value=t;else{Object.assign(n,{key:t,sep:[]}),this.onKeyLine=!n.explicitKey;return}break}case`block-seq`:{let n=e.items[e.items.length-1];n.value?e.items.push({start:[],value:t}):n.value=t;break}case`flow-collection`:{let n=e.items[e.items.length-1];!n||n.value?e.items.push({start:[],key:t,sep:[]}):n.sep?n.value=t:Object.assign(n,{key:t,sep:[]});return}default:yield*this.pop(),yield*this.pop(t)}if((e.type===`document`||e.type===`block-map`||e.type===`block-seq`)&&(t.type===`block-map`||t.type===`block-seq`)){let n=t.items[t.items.length-1];n&&!n.sep&&!n.value&&n.start.length>0&&cXt(n.start)===-1&&(t.indent===0||n.start.every(e=>e.type!==`comment`||e.indent<t.indent))&&(e.type===`document`?e.end=n.start:e.items.push({start:n.start}),t.items.splice(-1,1))}}}*stream(){switch(this.type){case`directive-line`:yield{type:`directive`,offset:this.offset,source:this.source};return;case`byte-order-mark`:case`space`:case`comment`:case`newline`:yield this.sourceToken;return;case`doc-mode`:case`doc-start`:{let e={type:`document`,offset:this.offset,start:[]};this.type===`doc-start`&&e.start.push(this.sourceToken),this.stack.push(e);return}}yield{type:`error`,offset:this.offset,message:`Unexpected ${this.type} token in YAML stream`,source:this.source}}*document(e){if(e.value)return yield*this.lineEnd(e);switch(this.type){case`doc-start`:cXt(e.start)===-1?e.start.push(this.sourceToken):(yield*this.pop(),yield*this.step());return;case`anchor`:case`tag`:case`space`:case`comment`:case`newline`:e.start.push(this.sourceToken);return}let t=this.startBlockValue(e);t?this.stack.push(t):yield{type:`error`,offset:this.offset,message:`Unexpected ${this.type} token in YAML document`,source:this.source}}*scalar(e){if(this.type===`map-value-ind`){let t=c2(s2(this.peek(2))),n;e.end?(n=e.end,n.push(this.sourceToken),delete e.end):n=[this.sourceToken];let r={type:`block-map`,offset:e.offset,indent:e.indent,items:[{start:t,key:e,sep:n}]};this.onKeyLine=!0,this.stack[this.stack.length-1]=r}else yield*this.lineEnd(e)}*blockScalar(e){switch(this.type){case`space`:case`comment`:case`newline`:e.props.push(this.sourceToken);return;case`scalar`:if(e.source=this.source,this.atNewLine=!0,this.indent=0,this.onNewLine){let e=this.source.indexOf(`
-`)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(`
-`,e)+1}yield*this.pop();break;default:yield*this.pop(),yield*this.step()}}*blockMap(e){let t=e.items[e.items.length-1];switch(this.type){case`newline`:if(this.onKeyLine=!1,t.value){let n=`end`in t.value?t.value.end:void 0;(Array.isArray(n)?n[n.length-1]:void 0)?.type===`comment`?n?.push(this.sourceToken):e.items.push({start:[this.sourceToken]})}else t.sep?t.sep.push(this.sourceToken):t.start.push(this.sourceToken);return;case`space`:case`comment`:if(t.value)e.items.push({start:[this.sourceToken]});else if(t.sep)t.sep.push(this.sourceToken);else{if(this.atIndentedComment(t.start,e.indent)){let n=e.items[e.items.length-2]?.value?.end;if(Array.isArray(n)){Array.prototype.push.apply(n,t.start),n.push(this.sourceToken),e.items.pop();return}}t.start.push(this.sourceToken)}return}if(this.indent>=e.indent){let n=!this.onKeyLine&&this.indent===e.indent,r=n&&(t.sep||t.explicitKey)&&this.type!==`seq-item-ind`,i=[];if(r&&t.sep&&!t.value){let n=[];for(let r=0;r<t.sep.length;++r){let i=t.sep[r];switch(i.type){case`newline`:n.push(r);break;case`space`:break;case`comment`:i.indent>e.indent&&(n.length=0);break;default:n.length=0}}n.length>=2&&(i=t.sep.splice(n[1]))}switch(this.type){case`anchor`:case`tag`:r||t.value?(i.push(this.sourceToken),e.items.push({start:i}),this.onKeyLine=!0):t.sep?t.sep.push(this.sourceToken):t.start.push(this.sourceToken);return;case`explicit-key-ind`:!t.sep&&!t.explicitKey?(t.start.push(this.sourceToken),t.explicitKey=!0):r||t.value?(i.push(this.sourceToken),e.items.push({start:i,explicitKey:!0})):this.stack.push({type:`block-map`,offset:this.offset,indent:this.indent,items:[{start:[this.sourceToken],explicitKey:!0}]}),this.onKeyLine=!0;return;case`map-value-ind`:if(t.explicitKey)if(!t.sep)if(o2(t.start,`newline`))Object.assign(t,{key:null,sep:[this.sourceToken]});else{let e=c2(t.start);this.stack.push({type:`block-map`,offset:this.offset,indent:this.indent,items:[{start:e,key:null,sep:[this.sourceToken]}]})}else if(t.value)e.items.push({start:[],key:null,sep:[this.sourceToken]});else if(o2(t.sep,`map-value-ind`))this.stack.push({type:`block-map`,offset:this.offset,indent:this.indent,items:[{start:i,key:null,sep:[this.sourceToken]}]});else if(lXt(t.key)&&!o2(t.sep,`newline`)){let e=c2(t.start),n=t.key,r=t.sep;r.push(this.sourceToken),delete t.key,delete t.sep,this.stack.push({type:`block-map`,offset:this.offset,indent:this.indent,items:[{start:e,key:n,sep:r}]})}else i.length>0?t.sep=t.sep.concat(i,this.sourceToken):t.sep.push(this.sourceToken);else t.sep?t.value||r?e.items.push({start:i,key:null,sep:[this.sourceToken]}):o2(t.sep,`map-value-ind`)?this.stack.push({type:`block-map`,offset:this.offset,indent:this.indent,items:[{start:[],key:null,sep:[this.sourceToken]}]}):t.sep.push(this.sourceToken):Object.assign(t,{key:null,sep:[this.sourceToken]});this.onKeyLine=!0;return;case`alias`:case`scalar`:case`single-quoted-scalar`:case`double-quoted-scalar`:{let n=this.flowScalar(this.type);r||t.value?(e.items.push({start:i,key:n,sep:[]}),this.onKeyLine=!0):t.sep?this.stack.push(n):(Object.assign(t,{key:n,sep:[]}),this.onKeyLine=!0);return}default:{let r=this.startBlockValue(e);if(r){if(r.type===`block-seq`){if(!t.explicitKey&&t.sep&&!o2(t.sep,`newline`)){yield*this.pop({type:`error`,offset:this.offset,message:`Unexpected block-seq-ind on same line with key`,source:this.source});return}}else n&&e.items.push({start:i});this.stack.push(r);return}}}}yield*this.pop(),yield*this.step()}*blockSequence(e){let t=e.items[e.items.length-1];switch(this.type){case`newline`:if(t.value){let n=`end`in t.value?t.value.end:void 0;(Array.isArray(n)?n[n.length-1]:void 0)?.type===`comment`?n?.push(this.sourceToken):e.items.push({start:[this.sourceToken]})}else t.start.push(this.sourceToken);return;case`space`:case`comment`:if(t.value)e.items.push({start:[this.sourceToken]});else{if(this.atIndentedComment(t.start,e.indent)){let n=e.items[e.items.length-2]?.value?.end;if(Array.isArray(n)){Array.prototype.push.apply(n,t.start),n.push(this.sourceToken),e.items.pop();return}}t.start.push(this.sourceToken)}return;case`anchor`:case`tag`:if(t.value||this.indent<=e.indent)break;t.start.push(this.sourceToken);return;case`seq-item-ind`:if(this.indent!==e.indent)break;t.value||o2(t.start,`seq-item-ind`)?e.items.push({start:[this.sourceToken]}):t.start.push(this.sourceToken);return}if(this.indent>e.indent){let t=this.startBlockValue(e);if(t){this.stack.push(t);return}}yield*this.pop(),yield*this.step()}*flowCollection(e){let t=e.items[e.items.length-1];if(this.type===`flow-error-end`){let e;do yield*this.pop(),e=this.peek(1);while(e?.type===`flow-collection`)}else if(e.end.length===0){switch(this.type){case`comma`:case`explicit-key-ind`:!t||t.sep?e.items.push({start:[this.sourceToken]}):t.start.push(this.sourceToken);return;case`map-value-ind`:!t||t.value?e.items.push({start:[],key:null,sep:[this.sourceToken]}):t.sep?t.sep.push(this.sourceToken):Object.assign(t,{key:null,sep:[this.sourceToken]});return;case`space`:case`comment`:case`newline`:case`anchor`:case`tag`:!t||t.value?e.items.push({start:[this.sourceToken]}):t.sep?t.sep.push(this.sourceToken):t.start.push(this.sourceToken);return;case`alias`:case`scalar`:case`single-quoted-scalar`:case`double-quoted-scalar`:{let n=this.flowScalar(this.type);!t||t.value?e.items.push({start:[],key:n,sep:[]}):t.sep?this.stack.push(n):Object.assign(t,{key:n,sep:[]});return}case`flow-map-end`:case`flow-seq-end`:e.end.push(this.sourceToken);return}let n=this.startBlockValue(e);n?this.stack.push(n):(yield*this.pop(),yield*this.step())}else{let t=this.peek(2);if(t.type===`block-map`&&(this.type===`map-value-ind`&&t.indent===e.indent||this.type===`newline`&&!t.items[t.items.length-1].sep))yield*this.pop(),yield*this.step();else if(this.type===`map-value-ind`&&t.type!==`flow-collection`){let n=c2(s2(t));uXt(e);let r=e.end.splice(1,e.end.length);r.push(this.sourceToken);let i={type:`block-map`,offset:e.offset,indent:e.indent,items:[{start:n,key:e,sep:r}]};this.onKeyLine=!0,this.stack[this.stack.length-1]=i}else yield*this.lineEnd(e)}}flowScalar(e){if(this.onNewLine){let e=this.source.indexOf(`
-`)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(`
-`,e)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case`alias`:case`scalar`:case`single-quoted-scalar`:case`double-quoted-scalar`:return this.flowScalar(this.type);case`block-scalar-header`:return{type:`block-scalar`,offset:this.offset,indent:this.indent,props:[this.sourceToken],source:``};case`flow-map-start`:case`flow-seq-start`:return{type:`flow-collection`,offset:this.offset,indent:this.indent,start:this.sourceToken,items:[],end:[]};case`seq-item-ind`:return{type:`block-seq`,offset:this.offset,indent:this.indent,items:[{start:[this.sourceToken]}]};case`explicit-key-ind`:{this.onKeyLine=!0;let t=c2(s2(e));return t.push(this.sourceToken),{type:`block-map`,offset:this.offset,indent:this.indent,items:[{start:t,explicitKey:!0}]}}case`map-value-ind`:{this.onKeyLine=!0;let t=c2(s2(e));return{type:`block-map`,offset:this.offset,indent:this.indent,items:[{start:t,key:null,sep:[this.sourceToken]}]}}}return null}atIndentedComment(e,t){return this.type!==`comment`||this.indent<=t?!1:e.every(e=>e.type===`newline`||e.type===`space`)}*documentEnd(e){this.type!==`doc-mode`&&(e.end?e.end.push(this.sourceToken):e.end=[this.sourceToken],this.type===`newline`&&(yield*this.pop()))}*lineEnd(e){switch(this.type){case`comma`:case`doc-start`:case`doc-end`:case`flow-seq-end`:case`flow-map-end`:case`map-value-ind`:yield*this.pop(),yield*this.step();break;case`newline`:this.onKeyLine=!1;default:e.end?e.end.push(this.sourceToken):e.end=[this.sourceToken],this.type===`newline`&&(yield*this.pop())}}}}));function fXt(e){let t=e.prettyErrors!==!1;return{lineCounter:e.lineCounter||t&&new a2||null,prettyErrors:t}}function pXt(e,t={}){let{lineCounter:n,prettyErrors:r}=fXt(t),i=new l2(n?.addNewLine),a=new K0(t),o=Array.from(a.compose(i.parse(e)));if(r&&n)for(let t of o)t.errors.forEach(j0(e,n)),t.warnings.forEach(j0(e,n));return o.length>0?o:Object.assign([],{empty:!0},a.streamInfo())}function u2(e,t={}){let{lineCounter:n,prettyErrors:r}=fXt(t),i=new l2(n?.addNewLine),a=new K0(t),o=null;for(let t of a.compose(i.parse(e),!0,e.length))if(!o)o=t;else if(o.options.logLevel!==`silent`){o.errors.push(new k0(t.range.slice(0,2),`MULTIPLE_DOCS`,`Source contains multiple documents; please use YAML.parseAllDocuments()`));break}return r&&n&&(o.errors.forEach(j0(e,n)),o.warnings.forEach(j0(e,n))),o}function d2(e,t,n){let r;typeof t==`function`?r=t:n===void 0&&t&&typeof t==`object`&&(n=t);let i=u2(e,n);if(!i)return null;if(i.warnings.forEach(e=>fJt(i.options.logLevel,e)),i.errors.length>0){if(i.options.logLevel!==`silent`)throw i.errors[0];i.errors=[]}return i.toJS(Object.assign({reviver:r},n))}function f2(e,t,n){let r=null;if(typeof t==`function`||Array.isArray(t)?r=t:n===void 0&&t&&(n=t),typeof n==`string`&&(n=n.length),typeof n==`number`){let e=Math.round(n);n=e<1?void 0:e>8?{indent:8}:{indent:e}}if(e===void 0){let{keepUndefined:e}=n??t??{};if(!e)return}return O$(e)&&!r?e.toString(n):new E0(e,r,n).toString(n)}var mXt=s((()=>{VYt(),D0(),M0(),pJt(),P$(),sXt(),dXt()})),hXt=l({Alias:()=>Z$,CST:()=>$Yt,Composer:()=>K0,Document:()=>E0,Lexer:()=>i2,LineCounter:()=>a2,Pair:()=>k1,Parser:()=>l2,Scalar:()=>e1,Schema:()=>w0,YAMLError:()=>O0,YAMLMap:()=>N1,YAMLParseError:()=>k0,YAMLSeq:()=>R1,YAMLWarning:()=>A0,isAlias:()=>D$,isCollection:()=>v$,isDocument:()=>O$,isMap:()=>k$,isNode:()=>y$,isPair:()=>A$,isScalar:()=>j$,isSeq:()=>M$,parse:()=>d2,parseAllDocuments:()=>pXt,parseDocument:()=>u2,stringify:()=>f2,visit:()=>F$,visitAsync:()=>L$}),gXt=s((()=>{VYt(),D0(),tYt(),M0(),Q$(),P$(),A1(),t1(),P1(),z1(),$0(),oXt(),sXt(),dXt(),mXt(),H$()})),_Xt=l({Alias:()=>Z$,CST:()=>$Yt,Composer:()=>K0,Document:()=>E0,Lexer:()=>i2,LineCounter:()=>a2,Pair:()=>k1,Parser:()=>l2,Scalar:()=>e1,Schema:()=>w0,YAMLError:()=>O0,YAMLMap:()=>N1,YAMLParseError:()=>k0,YAMLSeq:()=>R1,YAMLWarning:()=>A0,default:()=>p2,isAlias:()=>D$,isCollection:()=>v$,isDocument:()=>O$,isMap:()=>k$,isNode:()=>y$,isPair:()=>A$,isScalar:()=>j$,isSeq:()=>M$,parse:()=>d2,parseAllDocuments:()=>pXt,parseDocument:()=>u2,stringify:()=>f2,visit:()=>F$,visitAsync:()=>L$}),p2,m2=s((()=>{gXt(),gXt(),p2=hXt}));function vXt(e){let t=e.trim();if(t[0]!==`{`&&t[0]!==`[`)return e;try{return JSON.stringify(JSON.parse(e),null,2)}catch{return e}}var h2,g2,yXt,bXt=s((()=>{m2(),h2={parse:e=>{let t=d2(e,{merge:!0,maxAliasCount:1e4});if(typeof t!=`object`)throw Error(`Invalid YAML object`);return t},parseSafe(e,t){try{return h2.parse(e)}catch(e){return typeof t==`function`?t(e):t}},stringify:f2},g2={parse:e=>{let t=JSON.parse(e);if(typeof t!=`object`)throw Error(`Invalid JSON object`);return t},parseSafe(e,t){try{return g2.parse(e)}catch(e){return typeof t==`function`?t(e):t}},stringify:e=>JSON.stringify(e)},yXt=e=>{if(typeof e!=`string`)return e;let t=g2.parseSafe(e,null);if(t)return t;if(e.length>0&&[`{`,`[`].includes(e[0]??``))throw Error(`Invalid JSON or YAML`);return h2.parseSafe(e,e=>{throw Error(e)})}})),_2=s((()=>{Bqt(),bXt()})),xXt,SXt=s((()=>{hY(),wKt(),OKt(),W(),kE(),_2(),xXt=N({__name:`ResponseBodyVirtual`,props:{content:{},data:{},headers:{}},setup(e){let t=U(()=>vXt(e.content)),n=U(()=>SKt({data:e.data,headers:e.headers}));return(e,r)=>(F(),L(j(mY),{class:`!max-h-100% response-body-virtual overflow-x-auto`},jr({title:M(()=>[r[0]||=z(`Body`,-1)]),default:M(()=>[r[1]||=R(`div`,{class:`font-code text-xxs rounded-t border-x border-t px-2.5 py-1.5`},` This response body is massive! Syntax highlighting won't work here. `,-1),H(j(CE),{containerClass:`custom-scroll scalar-code-block border rounded-b flex flex-1 max-h-screen`,contentClass:`language-plaintext whitespace-pre font-code text-base`,lineHeight:20,searchable:``,text:t.value},null,8,[`text`])]),_:2},[n.value.dataUrl?{name:`actions`,fn:M(()=>[H(o$,{filename:n.value.attachmentFilename,href:n.value.dataUrl,type:n.value.mimeType?.essence},null,8,[`filename`,`href`,`type`])]),key:`0`}:void 0]),1024))}})})),CXt,wXt=s((()=>{SXt(),CXt=xXt})),TXt,EXt,DXt,OXt=s((()=>{JJ(),QJ(),eY(),sKt(),hY(),W(),TXt={key:0,class:`max-h-[calc(100%-32px)] overflow-y-auto`},EXt={key:1,class:`text-c-3 bg-b-1 flex min-h-[64px] items-center justify-center border-t px-4 text-sm`},DXt=N({__name:`ResponseCookies`,props:{cookies:{}},setup(e){return(t,n)=>(F(),L(j(mY),{class:`overflow-auto`,defaultOpen:!1,itemCount:e.cookies.length},{title:M(()=>[...n[0]||=[z(`Cookies`,-1)]]),default:M(()=>[e.cookies.length?(F(),I(`div`,TXt,[H(j(qJ),{columns:[`minmax(auto, min-content)`,`minmax(50%, 1fr)`],scroll:``},{default:M(()=>[H(j($J),{class:`sr-only !block`},{default:M(()=>[H(j(ZJ),null,{default:M(()=>[...n[1]||=[z(`Cookie Name`,-1)]]),_:1}),H(j(ZJ),null,{default:M(()=>[...n[2]||=[z(`Cookie Value`,-1)]]),_:1})]),_:1}),(F(!0),I(V,null,Ar(e.cookies,(e,t)=>(F(),L(j($J),{key:e.name,class:`group/row text-c-1`},{default:M(()=>[H(j(r$),{class:O([`bg-b-1 sticky left-0 z-1 max-w-full`,{"border-t-0":t===0}]),text:e.name},null,8,[`class`,`text`]),H(j(r$),{class:O([`z-0`,{"border-t-0":t===0}]),text:e.value},null,8,[`class`,`text`])]),_:2},1024))),128))]),_:1})])):(F(),I(`div`,EXt,` No cookies `))]),_:1},8,[`itemCount`]))}})})),kXt,AXt=s((()=>{OXt(),kXt=DXt})),v2,y2,jXt,MXt=s((()=>{W(),v2=500,y2=100,jXt=N({__name:`ScalarAsciiArt`,props:{art:{},animate:{type:Boolean}},setup(e){let t=e,n=U(()=>t.art.split(`
-`)),r=(e,t)=>({animationDuration:`${e*y2}ms, ${v2}ms`,animationTimingFunction:`steps(${e}), step-end`,animationDelay:`${t*y2}ms, 0ms`,animationIterationCount:`1, ${((n.value?.length??0)+(n.value?.[n.value?.length-1]?.length??0)+5)*y2/v2}`});return(t,i)=>(F(),I(`div`,{"aria-hidden":`true`,class:O([`ascii-art font-code flex flex-col items-start text-[6px] leading-[7px]`,{"ascii-art-animate":e.animate}]),role:`presentation`,inert:``},[(F(!0),I(V,null,Ar(n.value,(e,t)=>(F(),I(`span`,{key:t,class:`inline-block`,style:it({width:`calc(${e.length+1}ch)`})},[R(`span`,{class:`inline-block whitespace-pre overflow-hidden`,style:it(r(e.length,t))},k(e),5)],4))),128))],2))}})})),NXt,PXt=s((()=>{Bc(),MXt(),NXt=zc(jXt,[[`__scopeId`,`data-v-9a695e58`]])})),FXt,IXt=s((()=>{FXt=`                         .,,uod8B8bou,,.
-                ..,uod8BBBBBBBBBBBBBBBBRPFT?l!i:.
-           ||||||||||||||!?TFPRBBBBBBBBBBBBBBB8m=,
-           ||||   '""^^!!||||||||||TFPRBBBVT!:...!
-           ||||            '""^^!!|||||?!:.......!
-           ||||                     ||||.........!
-           ||||                     ||||.........!
-           ||||                     ||||.........!
-           ||||                     ||||.........!
-           ||||                     ||||.........!
-           ||||                     ||||.........!
-           ||||,                    ||||.........\`
-           |||||!!-._               ||||.......;.
-           ':!|||||||||!!-._        ||||.....bBBBBWdou,.
-         bBBBBB86foi!|||||||!!-..:|||!..bBBBBBBBBBBBBBBY!
-         ::!?TFPRBBBBBB86foi!||||||||!!bBBBBBBBBBBBBBBY..!
-         :::::::::!?TFPRBBBBBB86ftiaabBBBBBBBBBBBBBBY....!
-         :::;\`"^!:;::::::!?TFPRBBBBBBBBBBBBBBBBBBBY......!
-         ;::::::...''^::::::::::!?TFPRBBBBBBBBBBY........!
-     .ob86foi;::::::::::::::::::::::::!?TFPRBY..........\`
-    .b888888888886foi;:::::::::::::::::::::::..........\`
- .b888888888888888888886foi;::::::::::::::::..........
-.b888888888888888888888888888886foi;:::::::::......\`
-!Tf998888888888888888888888888888888886foi;:::....\`
-  '"^!|Tf9988888888888888888888888888888888!::..\`
-       '"^!|Tf998888888888888888888888889!! '\`
-             '"^!|Tf9988888888888888888!!\`            iBBbo.
-                  '"^!|Tf998888888889!\`             WBBBBbo.
-                        '"^!|Tf9989!\`              YBBBP^'
-                              '"^!\`               \`
-`})),LXt,RXt,zXt,BXt,VXt=s((()=>{PXt(),IXt(),W(),kE(),LXt={class:`flex-center relative flex flex-1 flex-col gap-6 p-2 capitalize`},RXt={key:0,class:`scalar-version-number`},zXt={class:`text-c-3 right-4 mt-auto flex w-full flex-col items-end gap-2 text-sm`},BXt=N({__name:`ResponseEmpty`,props:{layout:{},totalPerformedRequests:{},appVersion:{}},emits:[`addRequest`,`sendRequest`,`openCommandPalette`],setup(e,{emit:t}){let n=t;return(t,r)=>(F(),I(`div`,LXt,[R(`div`,{class:O([`flex h-[calc(100%_-_50px)] flex-col items-center justify-center`,{"hidden opacity-0":e.totalPerformedRequests>0&&e.layout!==`modal`}])},[e.layout===`modal`?B(``,!0):(F(),I(`div`,RXt,[z(` Scalar App V`+k(e.appVersion)+` Beta `,1),r[3]||=R(`div`,{class:`mt-2`},[R(`a`,{href:`https://github.com/scalar/scalar/issues/2669`,target:`_blank`},` Roadmap `)],-1)])),r[4]||=R(`a`,{class:`gitbook-show scalar-version-number`,href:`https://www.scalar.com`,target:`_blank`},` Powered By Scalar.com `,-1),H(j(NXt),{art:j(FXt),class:`text-c-3`},null,8,[`art`])],2),R(`div`,zXt,[e.layout===`modal`?B(``,!0):(F(),I(`button`,{key:0,class:`flex items-center gap-1.5`,type:`button`,onClick:r[0]||=e=>n(`openCommandPalette`)},[r[5]||=z(` Get Started `,-1),H(j(DC),{hotkey:`k`,modifier:[`default`]})])),e.layout===`desktop`?(F(),I(`button`,{key:1,class:`flex items-center gap-1.5`,type:`button`,onClick:r[1]||=e=>n(`addRequest`)},[r[6]||=z(` New Request `,-1),H(j(DC),{hotkey:`N`})])):B(``,!0),R(`button`,{class:`flex items-center gap-1.5`,type:`button`,onClick:r[2]||=e=>n(`sendRequest`)},[r[7]||=z(` Send Request `,-1),H(j(DC),{hotkey:`↵`})])])]))}})})),HXt,UXt=s((()=>{Bc(),VXt(),HXt=zc(BXt,[[`__scopeId`,`data-v-ab8886a2`]])})),WXt,GXt,KXt=s((()=>{W(),kE(),WXt={key:0,class:`bg-b-1 z-overlay absolute inset-0 flex flex-col items-center justify-center gap-6`},GXt=N({__name:`ResponseLoadingOverlay`,props:{eventBus:{}},setup(e){let t=mf(),n=A(),r=()=>{clearTimeout(n.value),n.value=setTimeout(()=>t.start(),1e3)},i=()=>{clearTimeout(n.value),n.value=void 0,t.clear()};return Hi(()=>{e.eventBus.on(`hooks:on:request:sent`,r),e.eventBus.on(`hooks:on:request:complete`,i)}),Wi(()=>{e.eventBus.off(`hooks:on:request:sent`,r),e.eventBus.off(`hooks:on:request:complete`,i),i()}),(n,r)=>(F(),L(Ka,null,{default:M(()=>[j(t).isActive?(F(),I(`div`,WXt,[H(j(ff),{class:`text-c-3`,loader:j(t),size:`3xl`},null,8,[`loader`]),H(j(gf),{variant:`ghost`,onClick:r[0]||=t=>e.eventBus.emit(`operation:cancel:request`)},{default:M(()=>[...r[1]||=[z(` Cancel `,-1)]]),_:1})])):B(``,!0)]),_:1}))}})})),qXt,JXt=s((()=>{Bc(),KXt(),qXt=zc(GXt,[[`__scopeId`,`data-v-21dc7abd`]])})),b2,YXt=s((()=>{yHe(),b2=e=>{let t=Number.parseInt(e.headers?.[`Content-Length`]||e.headers?.[`content-length`]||`0`,10);if(!(isNaN(t)||t<=0))return fC(t)}}));function XXt(e){return{days:Math.trunc(e/864e5),hours:Math.trunc(e/36e5%24),minutes:Math.trunc(e/6e4%60),seconds:Math.trunc(e/1e3%60),milliseconds:Math.trunc(e%1e3),microseconds:Math.trunc(x2(e*1e3)%1e3),nanoseconds:Math.trunc(x2(e*1e6)%1e3)}}function ZXt(e){return{days:e/86400000n,hours:e/3600000n%24n,minutes:e/60000n%60n,seconds:e/1000n%60n,milliseconds:e%1000n,microseconds:0n,nanoseconds:0n}}function QXt(e){switch(typeof e){case`number`:if(Number.isFinite(e))return XXt(e);break;case`bigint`:return ZXt(e)}throw TypeError(`Expected a finite number or bigint`)}var x2,$Xt=s((()=>{x2=e=>Number.isFinite(e)?e:0}));function eZt(e,t){let n=typeof e==`bigint`;if(!n&&!Number.isFinite(e))throw TypeError(`Expected a finite number or bigint`);t={...t};let r=e<0?`-`:``;e=e<0?-e:e,t.colonNotation&&(t.compact=!1,t.formatSubMilliseconds=!1,t.separateMilliseconds=!1,t.verbose=!1),t.compact&&(t.unitCount=1,t.secondsDecimalDigits=0,t.millisecondsDecimalDigits=0);let i=[],a=(e,t)=>{let n=Math.floor(e*10**t+rZt);return(Math.round(n)/10**t).toFixed(t)},o=(e,n,r,a)=>{if(!((i.length===0||!t.colonNotation)&&tZt(e)&&!(t.colonNotation&&r===`m`))){if(a??=String(e),t.colonNotation){let e=a.includes(`.`)?a.split(`.`)[0].length:a.length,t=i.length>0?2:1;a=`0`.repeat(Math.max(0,t-e))+a}else a+=t.verbose?` `+nZt(n,e):r;i.push(a)}},s=QXt(e),c=BigInt(s.days);if(t.hideYearAndDays?o(BigInt(c)*24n+BigInt(s.hours),`hour`,`h`):(t.hideYear?o(c,`day`,`d`):(o(c/365n,`year`,`y`),o(c%365n,`day`,`d`)),o(Number(s.hours),`hour`,`h`)),o(Number(s.minutes),`minute`,`m`),!t.hideSeconds)if(t.separateMilliseconds||t.formatSubMilliseconds||!t.colonNotation&&e<1e3&&!t.subSecondsAsDecimals){let e=Number(s.seconds),n=Number(s.milliseconds),r=Number(s.microseconds),i=Number(s.nanoseconds);if(o(e,`second`,`s`),t.formatSubMilliseconds)o(n,`millisecond`,`ms`),o(r,`microsecond`,`µs`),o(i,`nanosecond`,`ns`);else{let e=n+r/1e3+i/1e6,a=typeof t.millisecondsDecimalDigits==`number`?t.millisecondsDecimalDigits:0,s=a?e.toFixed(a):e>=1?Math.round(e):Math.ceil(e);o(Number.parseFloat(s),`millisecond`,`ms`,s)}}else{let r=a((n?Number(e%iZt):e)/1e3%60,typeof t.secondsDecimalDigits==`number`?t.secondsDecimalDigits:1),i=t.keepDecimalsOnWholeSeconds?r:r.replace(/\.0+$/,``);o(Number.parseFloat(i),`second`,`s`,i)}if(i.length===0)return r+`0`+(t.verbose?` milliseconds`:`ms`);let l=t.colonNotation?`:`:` `;return typeof t.unitCount==`number`&&(i=i.slice(0,Math.max(t.unitCount,1))),r+i.join(l)}var tZt,nZt,rZt,iZt,aZt=s((()=>{$Xt(),tZt=e=>e===0||e===0n,nZt=(e,t)=>t===1||t===1n?e:`${e}s`,rZt=1e-7,iZt=24n*60n*60n*1000n})),oZt,sZt,cZt,lZt,uZt,dZt=s((()=>{dKt(),YXt(),W(),id(),aZt(),oZt={class:`text-c-1 flex gap-1.5`},sZt={key:0},cZt={key:0},lZt={key:1},uZt=N({__name:`ResponseMetaInformation`,props:{response:{},eventBus:{}},setup(e){let t=A(),n=A(0),r=()=>{clearInterval(t.value),t.value=void 0,n.value=0},i=()=>{t.value=setInterval(()=>n.value+=1e3,1e3)};Hi(()=>{e.eventBus.on(`hooks:on:request:sent`,i),e.eventBus.on(`hooks:on:request:complete`,r)}),Wi(()=>{e.eventBus.off(`hooks:on:request:sent`,i),e.eventBus.off(`hooks:on:request:complete`,r),r()});let a=U(()=>{let t=e.response?.status;if(t)return rd[t]??void 0});return(r,i)=>(F(),I(`div`,oZt,[t.value&&n.value?(F(),I(`span`,sZt,k(j(eZt)(n.value)),1)):(F(),I(V,{key:1},[R(`span`,null,[i[0]||=R(`span`,{class:`sr-only`},`Response Information, Duration:`,-1),z(` `+k(j(eZt)(e.response.duration)),1)]),j(b2)(e.response)?(F(),I(`span`,cZt,[i[1]||=R(`span`,{class:`sr-only`},`, Size:`,-1),z(` `+k(j(b2)(e.response)),1)])):B(``,!0),a.value?(F(),I(V,{key:1},[i[2]||=R(`span`,{class:`sr-only`},`, Status:`,-1),a.value.url?(F(),L(i$,{key:0,class:`flex items-center gap-1.5`,href:a.value.url},{default:M(()=>[z(k(e.response.status)+` `+k(a.value.name)+` `,1),R(`span`,{class:`block h-1.5 w-1.5 rounded-full`,style:it({backgroundColor:a.value.color})},null,4)]),_:1},8,[`href`])):(F(),I(`span`,lZt,[z(k(e.response.status)+` `+k(a.value.name)+` `,1),R(`span`,{class:`block h-1.5 w-1.5 rounded-full`,style:it({backgroundColor:a.value.color})},null,4)]))],64)):B(``,!0)],64))]))}})})),fZt,pZt=s((()=>{dZt(),fZt=uZt})),mZt,hZt=s((()=>{mZt=e=>{if(!e||typeof e!=`string`)return null;let t=e.indexOf(`=`);if(t===-1)return null;let n=e.substring(0,t).trim(),r=e.substring(t+1).trim();return n?{name:n,value:r}:null}})),gZt,_Zt,S2,vZt,yZt=s((()=>{Sxt(),Yu(),Nxt(),vKt(),Aqt(),Rqt(),wXt(),AXt(),UXt(),JXt(),pZt(),hZt(),W(),kE(),ME(),gZt={class:`flex h-8 flex-1 items-center`},_Zt=[`id`,`role`],S2=2e5,vZt=N({__name:`ResponseBlock`,props:{response:{},requestPayload:{},layout:{},totalPerformedRequests:{},appVersion:{},plugins:{},eventBus:{}},setup(e,{expose:t}){let n=U(()=>{let t=e.response?.headers;return t?Object.keys(t).map(e=>({name:e,value:t[e]??``})):[]}),r=U(()=>e.response?.cookieHeaderKeys.map(e=>mZt(e)).filter(jE)??[]),i=[`Cookies`,`Headers`,`Body`],a=A(`All`),o=U(()=>[`All`,...i]),s=U(()=>Object.fromEntries(o.value.map(e=>[e,Sr()]))),c=U(()=>{if(!e.response||!(`size`in e.response))return!1;let t=e.response.headers?.[`content-type`]||e.response.headers?.[`Content-Type`];return!t||(e.response.size??0)<=S2||t.includes(`text/html`)?!1:Zhe.some(e=>t.includes(e))&&(e.response.size??0)>S2}),l=U(()=>{let t=e.requestPayload?.[1]?.headers;return t?[...new Headers(t)].map(([e,t])=>({name:e,value:t,required:!1})):[]}),u=e=>a.value===`All`||a.value===e;return t({responseHeaders:n,responseCookies:r,requestHeaders:l,shouldVirtualize:c,activeFilter:a,filters:o}),(t,i)=>(F(),L(ER,{"aria-label":`Response`},{title:M(()=>[R(`div`,gZt,[R(`div`,{"aria-live":`polite`,class:O([`flex items-center`,{"animate-response-heading":e.response}])},[i[4]||=R(`span`,{class:`response-heading pointer-events-none absolute`},` Response `,-1),e.response?(F(),L(fZt,{key:0,class:`animate-response-children`,eventBus:e.eventBus,response:e.response},null,8,[`eventBus`,`response`])):B(``,!0)],2),H(DR,{modelValue:a.value,"onUpdate:modelValue":i[0]||=e=>a.value=e,filterIds:s.value,filters:o.value},null,8,[`modelValue`,`filterIds`,`filters`])])]),default:M(()=>[R(`div`,{id:s.value.All,class:O([`custom-scroll response-section-content relative grid h-full justify-stretch`,{"content-start":e.response}]),role:a.value===`All`&&e.response?`tabpanel`:`none`},[e.response?(F(),I(V,{key:1},[u(`Cookies`)?(F(),L(kXt,{key:0,id:s.value.Cookies,class:`response-section-content-cookies`,cookies:r.value,role:a.value===`All`?`none`:`tabpanel`},null,8,[`id`,`cookies`,`role`])):B(``,!0),u(`Headers`)?(F(),L(a$,{key:1,id:s.value.Headers,class:`response-section-content-headers`,headers:l.value,role:a.value===`All`?`none`:`tabpanel`},{title:M(()=>[...i[5]||=[z(`Request Headers`,-1)]]),_:1},8,[`id`,`headers`,`role`])):B(``,!0),u(`Headers`)?(F(),L(a$,{key:2,id:s.value.Headers,class:`response-section-content-headers`,headers:n.value,role:a.value===`All`?`none`:`tabpanel`},{title:M(()=>[...i[6]||=[z(`Response Headers`,-1)]]),_:1},8,[`id`,`headers`,`role`])):B(``,!0),(F(!0),I(V,null,Ar(e.plugins,(e,t)=>(F(),L(j(aC),{key:t},{default:M(()=>[e?.components?.response?lr((F(),L(kr(e.components.response.component),ai({key:0,ref_for:!0},e.components.response.additionalProps),null,16)),[[Za,a.value===`All`]]):B(``,!0)]),_:2},1024))),128)),a.value===`All`||a.value===`Body`?(F(),I(V,{key:3},[`reader`in e.response?(F(),L(Lqt,{key:0,id:s.value.Body,class:`response-section-content-body`,reader:e.response.reader},null,8,[`id`,`reader`])):c.value&&typeof e.response?.data==`string`?(F(),L(CXt,{key:1,id:s.value.Body,content:e.response.data,data:e.response?.data,headers:n.value,role:a.value===`All`?`none`:`tabpanel`},null,8,[`id`,`content`,`data`,`headers`,`role`])):(F(),L(kqt,{key:2,id:s.value.Body,active:!0,class:`response-section-content-body`,data:e.response?.data,headers:n.value,layout:`client`,plugins:e.plugins,role:a.value===`All`?`none`:`tabpanel`,title:`Body`},null,8,[`id`,`data`,`headers`,`plugins`,`role`]))],64)):B(``,!0)],64)):(F(),L(HXt,{key:0,appVersion:e.appVersion,layout:e.layout,totalPerformedRequests:e.totalPerformedRequests,onAddRequest:i[1]||=t=>e.eventBus.emit(`ui:open:command-palette`,{action:`create-request`,payload:void 0}),onOpenCommandPalette:i[2]||=t=>e.eventBus.emit(`ui:open:command-palette`),onSendRequest:i[3]||=t=>e.eventBus.emit(`operation:send:request:hotkey`)},null,8,[`appVersion`,`layout`,`totalPerformedRequests`])),H(qXt,{eventBus:e.eventBus},null,8,[`eventBus`])],10,_Zt)]),_:1}))}})})),bZt,xZt=s((()=>{Bc(),yZt(),bZt=zc(vZt,[[`__scopeId`,`data-v-82f4df98`]])})),C2,w2,T2=s((()=>{C2={get:{short:`GET`,colorClass:`text-blue`,colorVar:`var(--scalar-color-blue)`,backgroundColor:`bg-blue/10`},post:{short:`POST`,colorClass:`text-green`,colorVar:`var(--scalar-color-green)`,backgroundColor:`bg-green/10`},put:{short:`PUT`,colorClass:`text-orange`,colorVar:`var(--scalar-color-orange)`,backgroundColor:`bg-orange/10`},patch:{short:`PATCH`,colorClass:`text-yellow`,colorVar:`var(--scalar-color-yellow)`,backgroundColor:`bg-yellow/10`},delete:{short:`DEL`,colorClass:`text-red`,colorVar:`var(--scalar-color-red)`,backgroundColor:`bg-red/10`},options:{short:`OPTS`,colorClass:`text-purple`,colorVar:`var(--scalar-color-purple)`,backgroundColor:`bg-purple/10`},head:{short:`HEAD`,colorClass:`text-c-2`,colorVar:`var(--scalar-color-2)`,backgroundColor:`bg-c-2/10`},trace:{short:`TRACE`,colorClass:`text-c-2`,colorVar:`var(--scalar-color-2)`,backgroundColor:`bg-c-2/10`}},w2=e=>{let t=e.trim().toLowerCase();return C2[t]??{short:t,color:`text-c-2`,backgroundColor:`bg-c-2`}}})),SZt,CZt=s((()=>{W(),kE(),T2(),pI(),SZt=N({__name:`HttpMethod`,props:{isSquare:{type:Boolean,default:!1},method:{},isEditable:{type:Boolean,default:!1}},emits:[`change`],setup(e,{emit:t}){let n=e,r=t,i=U(()=>w2(n.method)),a=fI(C2).map(([e])=>({id:e,label:e.toUpperCase(),color:w2(e).colorClass})),o=U({get:()=>a.find(({id:e})=>e===n.method),set:e=>e?.id&&r(`change`,e.id)}),s=of({base:`text-center font-code text-3xs justify-center items-center flex`,variants:{isSquare:{true:`px-2.5 whitespace-nowrap font-bold border-r h-fit m-auto`,false:`rounded-full`},isEditable:{true:`http-bg-gradient rounded-md border`,false:`cursor-auto`}}}),c=U(()=>i.value.short);return(t,n)=>e.isEditable?(F(),L(j(pS),{key:0,modelValue:o.value,"onUpdate:modelValue":n[0]||=e=>o.value=e,class:`font-code scalar-client mt-1 text-sm`,options:j(a)},{default:M(()=>[R(`div`,{class:O([`h-full`,{"pointer-events-none":!e.isEditable}])},[R(`button`,{class:O([`relative h-full`,j(sf)(j(s)({isSquare:e.isSquare,isEditable:e.isEditable}),i.value.colorClass)]),type:`button`},[R(`span`,null,k(c.value),1)],2)],2)]),_:1},8,[`modelValue`,`options`])):(F(),I(`div`,{key:1,class:O([`relative gap-1 whitespace-nowrap`,j(sf)(j(s)({isSquare:e.isSquare,isEditable:e.isEditable}),i.value.colorClass)]),type:`button`},k(i.value.short),3))}})})),E2,wZt=s((()=>{CZt(),Bc(),E2=zc(SZt,[[`__scopeId`,`data-v-7a19f363`]])})),TZt,EZt,DZt=s((()=>{TZt=/^\/_scalar_temp[a-f0-9]*$/i,EZt=(e,t)=>t.toLowerCase()===`drafts`&&e===`/`?!0:TZt.test(e)})),OZt,kZt=s((()=>{OZt=e=>{if(!e)return;let t=document.querySelector(e);if(t instanceof HTMLButtonElement){t.click();return}(t instanceof HTMLInputElement||t instanceof HTMLTextAreaElement||t instanceof HTMLElement&&t.getAttribute(`contenteditable`)===`true`)&&t.focus()}})),D2,O2,AZt,jZt,MZt,NZt,PZt,FZt=s((()=>{W(),D2=20,O2=100,AZt=0,jZt=15,MZt=60,NZt=400/D2,PZt=()=>{let e=A(O2),t=A(0),n=A(!1),r=A(),i=()=>{clearInterval(r.value),r.value=void 0,e.value=O2,n.value=!1},a=()=>{n.value?e.value-=(e.value-jZt)/MZt:e.value-=t.value/NZt,e.value<=AZt&&i()};return{startLoading:()=>{if(r.value){n.value=!0;return}n.value=!0,r.value=setInterval(a,D2)},stopLoading:()=>{t.value=e.value,n.value=!1},percentage:e,isLoading:n}}})),IZt,LZt=s((()=>{W(),IZt=({isReady:e,operationKey:t,shouldMask:n,onMask:r})=>{mr([e,t],([e])=>{e&&n()&&r()},{flush:`post`})}})),RZt,zZt,BZt=s((()=>{W(),kE(),Ou(),RZt={key:0,class:`sr-only`},zZt=N({__name:`ServerVariablesSelect`,props:{enum:{},value:{},controls:{}},emits:[`change`],setup(e,{emit:t}){let n=e,r=t,i=U(()=>n.enum.map(e=>({id:e,label:e}))),a=U({get:()=>i.value.find(e=>e.id===n.value),set:e=>r(`change`,e?.id??``)});return(t,n)=>(F(),L(j(pS),{modelValue:a.value,"onUpdate:modelValue":n[0]||=e=>a.value=e,options:i.value},{default:M(()=>[H(j(gf),{"aria-controls":e.controls,class:`group/button h-8 gap-1.5 p-1.5 text-base font-normal`,variant:`ghost`},{default:M(()=>[R(`span`,{class:O({"text-c-1":e.value})},[e.value?(F(),I(`span`,RZt,` Selected: `)):B(``,!0),z(` `+k(e.value||`Select value`),1)],2),H(j(tl),{weight:`bold`,class:`mt-0.25 size-3 transition-transform duration-100 group-aria-expanded/button:rotate-180`})]),_:1},8,[`aria-controls`])]),_:1},8,[`modelValue`,`options`]))}})})),VZt,HZt=s((()=>{BZt(),VZt=zZt})),UZt,WZt=s((()=>{W(),UZt=N({__name:`ServerVariablesTextbox`,props:{value:{},controls:{}},emits:[`change`],setup(e,{emit:t}){let n=e,r=t,i=U({get:()=>n.value,set:e=>r(`change`,e)});return(t,n)=>lr((F(),I(`input`,ai({"onUpdate:modelValue":n[0]||=e=>i.value=e},e.controls?{...t.$attrs,"aria-controls":e.controls}:{},{autocomplete:`off`,class:`text-c-1 w-full border-transparent px-1.5 py-1.25 -outline-offset-1 group-last/label:rounded-br-lg`,placeholder:`value`,spellcheck:`false`,type:`text`}),null,16)),[[lo,i.value]])}})})),GZt,KZt=s((()=>{WZt(),GZt=UZt})),qZt,JZt,YZt=s((()=>{HZt(),KZt(),W(),qZt=[`for`],JZt=N({__name:`ServerVariablesForm`,props:{variables:{},values:{},controls:{},layout:{default:`client`}},emits:[`update:variable`],setup(e,{emit:t}){let n=t,r=Sr();function i(e,t){n(`update:variable`,e,t)}let a=t=>(e.values?.[t]??e.variables?.[t]?.default??``).toString();return(t,n)=>e.variables&&Object.keys(e.variables??{}).length?(F(!0),I(V,{key:0},Ar(Object.keys(e.variables),t=>(F(),I(`div`,{key:t,class:O([`group/label flex h-8 w-full`,e.layout===`reference`&&`items-center border-x border-b last:rounded-b-lg`])},[R(`label`,{class:`flex items-center py-2 pl-3 group-has-[input]/label:mr-0 after:content-[':']`,for:`${j(r)}-${t}`},k(t),9,qZt),e.variables?.[t]?.enum?.length?(F(),L(VZt,{key:0,id:`${j(r)}-${t}`,controls:e.controls,enum:e.variables[t]?.enum?.map(e=>`${e}`)??[],value:a(t),onChange:e=>i(t,e)},null,8,[`id`,`controls`,`enum`,`value`,`onChange`])):(F(),L(GZt,{key:1,id:`${j(r)}-${t}`,controls:e.controls,value:a(t),onChange:e=>i(t,e)},null,8,[`id`,`controls`,`value`,`onChange`]))],2))),128)):B(``,!0)}})})),k2,XZt=s((()=>{YZt(),k2=JZt})),ZZt,QZt,$Zt,eQt,tQt,nQt,rQt=s((()=>{XZt(),W(),kE(),ZZt=[`aria-expanded`],QZt={class:`overflow-hidden text-ellipsis whitespace-nowrap`},$Zt=[`id`],eQt={key:0},tQt={class:`description text-c-3 px-3 py-1.5`},nQt=N({__name:`ServerDropdownItem`,props:{server:{},serverOption:{}},emits:[`update:variable`,`update:selectedServer`],setup(e,{emit:t}){let n=t,r=Sr(),i=()=>Object.keys(e.server?.variables??{}).length>0,a=U(()=>e.serverOption.id===e.server?.url),o=U(()=>a.value&&i());return(t,i)=>(F(),I(`div`,{class:O([`group/item flex min-h-fit flex-col rounded border`,{"border-transparent":!a.value}])},[R(`button`,ai(o.value?{"aria-controls":j(r)}:{},{"aria-expanded":o.value,class:[`flex min-h-8 cursor-pointer items-center gap-1.5 rounded px-1.5`,a.value?`text-c-1 bg-b-2`:`hover:bg-b-2`],type:`button`,onClick:i[0]||=e=>n(`update:selectedServer`)}),[H(j(oS),{selected:a.value},null,8,[`selected`]),R(`span`,QZt,k(e.serverOption.label),1)],16,ZZt),o.value?(F(),I(`div`,{key:0,id:j(r),class:`bg-b-2 divide divide-y rounded-b border-t *:pl-4`,onClick:i[2]||=po(()=>{},[`stop`])},[H(k2,{variables:e.server?.variables,"onUpdate:variable":i[1]||=(e,t)=>n(`update:variable`,e,t)},null,8,[`variables`]),e.server?.description?(F(),I(`div`,eQt,[R(`div`,tQt,[H(j(qT),{value:e.server.description},null,8,[`value`])])])):B(``,!0)],8,$Zt)):B(``,!0)],2))}})})),iQt,aQt=s((()=>{Bc(),rQt(),iQt=zc(nQt,[[`__scopeId`,`data-v-1b7a32a4`]])})),oQt,sQt,cQt,lQt=s((()=>{pY(),aQt(),W(),kE(),Ou(),oQt=[`onClick`],sQt={class:`flex items-center justify-center`},cQt=N({name:`ServerDropdown`,props:{meta:{},servers:{},server:{},target:{},layout:{}},emits:[`update:selectedServer`,`update:variable`,`update:servers`,`update:open`],setup(e,{emit:t}){let n=t,r=U(()=>e.servers.map(e=>({id:e.url,label:e.url??`Unknown server`}))),i=U(()=>e.server?.url?.endsWith(`/`)?e.server.url.slice(0,-1):e.server?.url||``);return(t,a)=>(F(),L(j(iE),{class:`max-h-[inherit] p-0 text-base`,focus:``,offset:0,placement:`bottom`,resize:``,target:e.target,teleport:`#${e.target}`},{popover:M(({close:t})=>[R(`div`,{class:`custom-scroll flex max-h-[inherit] flex-col gap-1 p-1`,onClick:t},[(F(!0),I(V,null,Ar(r.value,(t,r)=>(F(),L(iQt,{key:t.id,server:e.server,serverOption:t,type:`request`,"onUpdate:selectedServer":r=>n(`update:selectedServer`,{url:t.id,meta:e.meta}),"onUpdate:variable":(t,i)=>n(`update:variable`,{index:r,key:t,value:i,meta:e.meta})},null,8,[`server`,`serverOption`,`onUpdate:selectedServer`,`onUpdate:variable`]))),128)),e.layout===`modal`?B(``,!0):(F(),I(`button`,{key:0,class:`text-xxs hover:bg-b-2 flex cursor-pointer items-center gap-1.5 rounded p-1.75`,type:`button`,onClick:a[0]||=e=>n(`update:servers`)},[R(`div`,sQt,[H(j(yu),{class:`size-4`})]),a[5]||=R(`span`,null,`Update Servers`,-1)]))],8,oQt)]),backdrop:M(({open:e})=>[H(fY,{value:e,onChange:a[1]||=e=>n(`update:open`,e),onUnmount:a[2]||=e=>n(`update:open`,!1)},null,8,[`value`]),H(j(rS),{class:`inset-x-px rounded-none rounded-b-lg`})]),default:M(()=>[H(j(gf),{class:`hover:bg-b-2 font-code text-c-2 h-auto gap-0.75 rounded border px-1.5 text-base whitespace-nowrap @3xl:ml-0.75`,variant:`ghost`},{default:M(()=>[e.server?(F(),I(V,{key:0},[a[3]||=R(`span`,{class:`sr-only`},`Server:`,-1),z(` `+k(i.value),1)],64)):(F(),I(V,{key:1},[a[4]||=R(`span`,{class:`sr-only`},`Add Server`,-1),H(j(xu),{class:`size-3`})],64))]),_:1})]),_:1},8,[`target`,`teleport`]))}})})),uQt,dQt=s((()=>{lQt(),uQt=cQt})),fQt,pQt,mQt=s((()=>{fQt={100:{color:`text-yellow`},200:{color:`text-green`},202:{color:`text-green`},300:{color:`text-blue`},304:{color:`text-blue`},400:{color:`text-red`},401:{color:`text-orange`},422:{color:`text-yellow`},423:{color:`text-purple`},505:{color:`text-orange`}},pQt=e=>fQt[e]||{color:`text-grey`}})),hQt,gQt=s((()=>{hQt=(e,t=2)=>e>1e3?(e/1e3).toFixed(t)+`s`:e.toFixed(t)+`ms`})),_Qt,vQt,yQt,bQt=s((()=>{wZt(),pY(),mQt(),W(),kE(),id(),Rc(),gQt(),_Qt={class:`min-w-0`},vQt={class:`text-c-1 min-w-0 truncate`},yQt=N({__name:`AddressBarHistory`,props:{target:{},history:{}},emits:[`select:history:item`,`update:open`],setup(e,{emit:t}){let n=t;return(t,r)=>(F(),L(j(Roe),{as:`div`},{default:M(({open:t})=>[H(fY,{value:t,onChange:r[0]||=e=>n(`update:open`,e),onUnmount:r[1]||=e=>n(`update:open`,!1)},null,8,[`value`]),H(j(eS),{offset:0,resize:``,target:e.target},jr({default:M(()=>[e.history.length?(F(),L(j(zoe),{key:0,class:`address-bar-history-button text-c-3 focus:text-c-1 relative mr-1 rounded-lg p-1.5`},{default:M(()=>[H(j(jT),{icon:`History`,size:`sm`,thickness:`2.25`}),r[2]||=R(`span`,{class:`sr-only`},`Request History`,-1)]),_:1})):B(``,!0)]),_:2},[t?{name:`floating`,fn:M(({width:t})=>[H(j(Boe),{class:`custom-scroll grid max-h-[inherit] grid-cols-[44px_1fr_repeat(3,auto)] items-center p-0.75`,static:``,style:it({width:t})},{default:M(()=>[(F(!0),I(V,null,Ar(e.history,(e,t)=>(F(),L(j(Voe),{key:t,as:`button`,class:`font-code ui-active:*:bg-b-2 text-c-2 contents text-sm font-medium *:flex *:h-8 *:cursor-pointer *:items-center *:rounded-none *:px-1.5 *:first:rounded-l *:last:rounded-r`,value:t,onClick:e=>n(`select:history:item`,{index:t})},{default:M(()=>[H(j(E2),{class:`text-[11px]`,method:e.method},null,8,[`method`]),R(`div`,_Qt,[R(`div`,vQt,k(e.path),1)]),R(`div`,null,k(j(hQt)(e.duration)),1),R(`div`,{class:O([j(pQt)(e.status).color])},k(e.status),3),R(`div`,null,k(j(rd)[e.status]?.name),1)]),_:2},1032,[`value`,`onClick`]))),128))]),_:1},8,[`style`]),H(j(rS),{class:`inset-x-px rounded-none rounded-b-lg`})]),key:`0`}:void 0]),1032,[`target`])]),_:1}))}})})),xQt,SQt=s((()=>{Bc(),bQt(),xQt=zc(yQt,[[`__scopeId`,`data-v-2cc840c9`]])})),CQt,wQt=s((()=>{CQt=e=>{if(!e||!(e instanceof Element))return null;let t=[],n=e;for(;n instanceof Element;){let e=n.localName,r=1,i=n.previousElementSibling;for(;i;)i.localName===e&&r++,i=i.previousElementSibling;t.unshift(r>1?`${e}:nth-of-type(${r})`:e),n=n.parentElement}return t.join(` > `)}})),TQt,EQt=s((()=>{TQt=(e=``)=>{if(!e.trim())return null;if(!e.startsWith(`/`)&&!/^[a-z][a-z0-9+\-.]*:\/\//i.test(e)){let t=e.search(/[/?#]/),n=t===-1?e:e.slice(0,t);if(n.includes(`.`))try{let t=new URL(`https://${e}`);if(t.origin===`null`)return null;let r=t.host,i=n.match(/:(\d+)$/);i&&!t.port&&(r=`${t.hostname}:${i[1]}`);let a=decodeURIComponent(t.pathname)+t.search+t.hash;return[r,a]}catch{return null}}if(e.startsWith(`//`))try{let t=new URL(`https:${e}`);return t.origin===`null`?null:[t.origin.replace(/^https?:/,``),decodeURIComponent(t.pathname)+t.search+t.hash]}catch{return null}try{let t=new URL(e);if(t.origin===`null`)return null;let n=decodeURIComponent(t.pathname)+t.search+t.hash;return[t.origin,n]}catch{return null}}})),DQt,OQt,kQt,AQt,jQt,MQt,NQt,PQt,FQt,IQt,LQt,RQt,zQt,BQt=s((()=>{wZt(),KJ(),M4e(),DZt(),kZt(),FZt(),LZt(),dQt(),SQt(),W(),kE(),Ou(),T2(),WJ(),wQt(),EQt(),DQt={class:`order-last flex h-auto w-full max-w-3xl grow-3 flex-wrap items-stretch [--scalar-address-bar-height:32px] @3xl:order-0 @3xl:flex-nowrap`},OQt=[`id`],kQt={class:`hidden @3xl:flex`},AQt={class:`scroll-timeline-x scroll-timeline-x-hidden relative flex w-full bg-blend-normal`},jQt={key:0,class:`z-context absolute inset-x-0 top-[calc(100%+4px)] flex flex-col items-center rounded px-6`},MQt={class:`text-c-danger bg-b-danger border-c-danger flex items-center gap-1 rounded border p-1`},NQt={class:`min-w-0 flex-1`},PQt={"aria-hidden":`true`,class:`inline-flex items-center gap-1`},FQt={class:`sr-only`},IQt={class:`mt-2 flex h-(--scalar-address-bar-height) w-full items-stretch gap-1 @3xl:hidden`},LQt={"aria-hidden":`true`,class:`inline-flex items-center gap-1`},RQt={class:`sr-only`},zQt=N({name:`AddressBar`,props:{path:{},method:{},documentSlug:{},exampleKey:{},server:{},servers:{},history:{},layout:{},eventBus:{},environment:{},serverMeta:{}},emits:[`execute`,`select:history:item`],setup(e,{expose:t,emit:n}){let r=n,i=Sr(),a=wr(`sendButtonRef`),o=wr(`mobileSendButtonRef`),s=wr(`addressBarRef`),{percentage:c,startLoading:l,stopLoading:u,isLoading:d}=PZt(),f=A(null),p=A(null),m=A(!1),h=A(!1),g=A(!1),_=oU.scrollMargins.of(()=>({right:24})),v=U(()=>({backgroundColor:`color-mix(in srgb, transparent 90%, ${C2[e.method].colorVar})`,transform:`translate3d(-${c.value}%,0,0)`})),y=U(()=>p.value||f.value),b=U(()=>h.value||g.value),x=U(()=>NE(e.method,e.path,e.exampleKey,e.documentSlug));mr(x,()=>{f.value=null,p.value=null});let S=()=>{let e=a.value?.$el,t=o.value?.$el;e&&e.offsetParent!==null?e.focus():t?.focus()},C=t=>{s.value?.isFocused&&e.layout!==`desktop`||(s.value?.focus(`end`),t&&`clear`in t&&t.clear&&s.value?.setCodeMirrorContent(``),t&&`event`in t&&t.event.preventDefault())};IZt({isReady:()=>s.value?.codeMirror,operationKey:()=>x.value,shouldMask:()=>EZt(e.path,e.documentSlug),onMask:()=>requestAnimationFrame(()=>{let t=s.value?.codeMirror?.state.doc.toString();t&&t!==e.path||C({clear:!0})})});let w=t=>{let n=TQt(t);if(!n)return t;let[r,i]=n;return r===e.server?.url||(e.servers.find(e=>e.url===r)?e.eventBus.emit(`server:update:selected`,{url:r,meta:e.serverMeta}):e.eventBus.emit(`server:add:server`,{url:r,select:!0,meta:{type:`operation`,path:e.path,method:e.method}})),i},ee=e=>e.startsWith(`/`)?e:`/${e}`,te=(t,n,r=null)=>{let i=w(n),a=ee(i);s.value?.setCodeMirrorContent(a),e.eventBus.emit(`operation:update:pathMethod`,{meta:{method:e.method,path:e.path},blurTargetSelector:r,payload:{method:t,path:a},callback:(n,r)=>{if(n===`success`||n===`no-change`)p.value=null,f.value=null;else if(n===`conflict`){t!==e.method&&(p.value=t),a!==e.path&&(f.value=a);return}let o=s.value?.codeMirrorRef?.textContent;n===`no-change`&&o&&o!==i&&s.value?.setCodeMirrorContent(i),ar(()=>OZt(r))}})},ne=t=>te(t,f.value??e.path),re=(t,n)=>{let r=n.relatedTarget,i=m.value?null:CQt(r);m.value=!1,te(p.value??e.method,t,i)},T=(t,n)=>{n.stopPropagation(),te(p.value??e.method,t,`[data-addressbar-action="send"]`)},ie=t=>{t.target?.innerText===`
-`&&e.eventBus.emit(`server:update:selected`,{url:``,meta:e.serverMeta})},ae=()=>{e.eventBus.emit(`copy-url:address-bar`)},E=()=>{if(e.serverMeta.type===`operation`){e.eventBus.emit(`ui:navigate`,{page:`operation`,path:`servers`,operationPath:e.serverMeta.path,method:e.serverMeta.method});return}e.eventBus.emit(`ui:navigate`,{page:`document`,path:`servers`})},D=[];return Hi(()=>{D.push(e.eventBus.on(`ui:focus:address-bar`,C),e.eventBus.on(`ui:focus:send-button`,S),e.eventBus.on(`hooks:on:request:sent`,l),e.eventBus.on(`hooks:on:request:complete`,u))}),Wi(()=>{for(let e of D)e();u()}),t({methodConflict:p,pathConflict:f}),(t,n)=>(F(),I(`div`,DQt,[R(`div`,{id:j(i),class:O([`address-bar-bg-states text-xxs group relative flex h-(--scalar-address-bar-height) w-full flex-1 flex-row items-stretch rounded-lg p-0.75`,{"outline-c-danger outline":y.value,"rounded-b-none":b.value}])},[R(`div`,{class:O([`pointer-events-none absolute top-0 left-0 block h-full w-full overflow-hidden rounded-lg border`,{"rounded-b-none":b.value}])},[R(`div`,{class:`absolute top-0 left-0 h-full w-full`,style:it(v.value)},null,4)],2),R(`div`,kQt,[H(j(E2),{isEditable:e.layout!==`modal`,isSquare:``,method:p.value??e.method,teleport:``,onChange:ne},null,8,[`isEditable`,`method`])]),R(`div`,AQt,[e.servers.length?(F(),L(j(uQt),{key:0,layout:e.layout,meta:e.serverMeta,server:e.server,servers:e.servers,target:j(i),"onUpdate:open":n[0]||=e=>h.value=e,"onUpdate:selectedServer":n[1]||=t=>e.eventBus.emit(`server:update:selected`,t),"onUpdate:servers":E,"onUpdate:variable":n[2]||=t=>e.eventBus.emit(`server:update:variables`,t)},null,8,[`layout`,`meta`,`server`,`servers`,`target`])):B(``,!0),H(j(GJ),{ref_key:`addressBarRef`,ref:s,alwaysEmitChange:``,"aria-label":`Path`,class:`ml-1 min-w-fit pl-px outline-none`,disableCloseBrackets:``,disabled:e.layout===`modal`,disableEnter:``,disableTabIndent:``,emitOnBlur:!1,environment:e.environment,extensions:[j(_)],importCurl:``,layout:e.layout,modelValue:e.path,placeholder:e.server?``:`Enter a URL`,server:``,onBlur:re,onKeydown:[mo(ie,[`delete`]),n[3]||=mo(e=>m.value=!0,[`tab`])],onSubmit:T},null,8,[`disabled`,`environment`,`extensions`,`layout`,`modelValue`,`placeholder`])]),H(j(gf),{class:`hover:bg-b-3 mx-1 hidden @3xl:flex`,size:`xs`,variant:`ghost`,onClick:ae},{default:M(()=>[H(j(Vl)),n[8]||=R(`span`,{class:`sr-only`},`Copy URL`,-1)]),_:1}),H(xQt,{history:e.history,target:j(i),"onSelect:history:item":n[4]||=e=>r(`select:history:item`,e),"onUpdate:open":n[5]||=e=>g.value=e},null,8,[`history`,`target`]),y.value?(F(),I(`div`,jQt,[R(`div`,MQt,[H(j(Zme),{size:`sm`}),R(`div`,NQt,[n[9]||=z(` A `,-1),R(`em`,null,k(p.value?.toUpperCase()??e.method.toUpperCase()),1),n[10]||=z(` request to `,-1),H(j(wE),{text:f.value??e.path},null,8,[`text`]),n[11]||=z(` already exists in this document `,-1)])])])):B(``,!0),H(j(gf),{ref_key:`sendButtonRef`,ref:a,class:`relative hidden h-auto shrink-0 overflow-hidden py-1 pr-2.5 pl-2 font-bold @3xl:flex`,"data-addressbar-action":`send`,disabled:j(d),onClick:n[6]||=e=>r(`execute`)},{default:M(()=>[R(`span`,PQt,[H(j(jT),{class:`relative shrink-0 fill-current`,icon:`Play`,size:`xs`}),n[12]||=R(`span`,{class:`text-xxs flex`},`Send`,-1)]),R(`span`,FQt,` Send `+k(e.method)+` request to `+k(e.server?.url??``)+k(e.path),1)]),_:1},8,[`disabled`])],10,OQt),R(`div`,IQt,[H(j(E2),{isEditable:e.layout!==`modal`,isSquare:``,method:p.value??e.method,teleport:``,onChange:ne},null,8,[`isEditable`,`method`]),H(j(gf),{class:`hover:bg-b-3 ml-auto`,size:`xs`,variant:`ghost`,onClick:ae},{default:M(()=>[H(j(Vl)),n[13]||=R(`span`,{class:`sr-only`},`Copy URL`,-1)]),_:1}),H(j(gf),{ref_key:`mobileSendButtonRef`,ref:o,class:`relative h-auto shrink-0 overflow-hidden py-1 pr-2.5 pl-2 font-bold`,"data-addressbar-action":`send`,disabled:j(d),onClick:n[7]||=e=>r(`execute`)},{default:M(()=>[R(`span`,LQt,[H(j(jT),{class:`relative shrink-0 fill-current`,icon:`Play`,size:`xs`}),n[14]||=R(`span`,{class:`text-xxs`},`Send`,-1)]),R(`span`,RQt,` Send `+k(e.method)+` request to `+k(e.server?.url??``)+k(e.path),1)]),_:1},8,[`disabled`])])]))}})})),VQt,HQt=s((()=>{Bc(),BQt(),VQt=zc(zQt,[[`__scopeId`,`data-v-4d85ebb9`]])})),UQt,WQt,GQt,KQt,qQt,JQt,YQt,XQt,ZQt,QQt,$Qt=s((()=>{W(),kE(),UQt={class:`relative flex items-center`},WQt={class:`flex max-w-[220px] min-w-0 items-center gap-1.5`},GQt={class:`text-xxs block max-w-[160px] min-w-0 truncate text-left font-medium`},KQt={class:`min-w-0 flex-1 truncate`},qQt={class:`bg-c-accent text-b-1 mt-0.5 flex h-4 w-4 shrink-0 items-center justify-center rounded-full p-[3px]`},JQt={class:`min-w-0 flex-1 text-left`},YQt={class:`block truncate`},XQt={class:`flex h-4 w-4 items-center justify-center`},ZQt={key:5,class:`text-c-3 px-2 py-1.5 text-xs`},QQt=N({__name:`EnvironmentSelector`,props:{environments:{default:()=>[]},activeEnvironment:{}},emits:[`select:environment`,`add:environment`],setup(e,{emit:t}){let n=t,r=U(()=>!!e.activeEnvironment),i=U(()=>e.environments.length>0),a=U(()=>e.activeEnvironment?e.environments.includes(e.activeEnvironment):!1),o=U(()=>r.value&&!a.value),s=U(()=>o.value?`${e.activeEnvironment} (Unavailable)`:r.value?e.activeEnvironment:i.value?`Select Environment`:`Add Environment`),c=U(()=>o.value?`hover:bg-b-2 text-c-2 border-transparent`:r.value?`bg-c-accent/10 text-c-accent hover:bg-c-accent/20 border-c-accent/30`:i.value?`hover:bg-b-2 text-c-2 border-transparent`:`hover:bg-b-2 text-c-3 border-transparent`),l=()=>{n(`add:environment`)},u=e=>{n(`select:environment`,e)};return(t,n)=>(F(),I(`div`,UQt,[H(j(KS),null,{items:M(()=>[r.value?(F(),L(j(tC),{key:0,class:`group/item flex w-full items-center gap-1.5`,onClick:n[0]||=e=>u(``)},{default:M(()=>[R(`div`,{class:O([`flex h-4 w-4 items-center justify-center rounded-full p-[3px]`,e.activeEnvironment?`shadow-border text-transparent`:`bg-c-accent text-b-1`])},[H(j(jT),{class:`size-2.5`,icon:`Checkmark`,thickness:`3`})],2),n[1]||=R(`span`,{class:`text-c-2`},`No Environment`,-1)]),_:1})):B(``,!0),r.value&&i.value?(F(),L(j(QS),{key:1})):B(``,!0),(F(!0),I(V,null,Ar(e.environments,t=>(F(),L(j(tC),{key:t,class:`group/item flex w-full min-w-0 items-center gap-1.5 overflow-hidden text-ellipsis whitespace-nowrap`,onClick:e=>u(t)},{default:M(()=>[R(`div`,{class:O([`flex h-4 w-4 items-center justify-center rounded-full p-[3px]`,e.activeEnvironment===t?`bg-c-accent text-b-1`:`shadow-border text-transparent`])},[H(j(jT),{class:`size-2.5`,icon:`Checkmark`,thickness:`3`})],2),R(`span`,KQt,k(t),1)]),_:2},1032,[`onClick`]))),128)),o.value?(F(),L(j(QS),{key:2})):B(``,!0),o.value?(F(),L(j(tC),{key:3,class:`group/item flex h-auto w-full min-w-0 items-start gap-1.5 overflow-hidden`,disabled:``},{default:M(()=>[R(`div`,qQt,[H(j(jT),{class:`size-2.5`,icon:`Checkmark`,thickness:`3`})]),R(`div`,JQt,[R(`span`,YQt,k(e.activeEnvironment),1),n[2]||=R(`span`,{class:`text-c-3 block truncate text-xs`},` Not available in this context `,-1)])]),_:1})):B(``,!0),i.value?(F(),L(j(QS),{key:4})):B(``,!0),H(j(tC),{class:`text-c-accent flex items-center gap-1.5`,onClick:l},{default:M(()=>[R(`div`,XQt,[H(j(jT),{icon:`Add`,size:`sm`})]),R(`span`,null,k(i.value?`New Environment`:`Create Environment`),1)]),_:1}),!i.value&&!r.value?(F(),I(`div`,ZQt,[...n[3]||=[R(`p`,{class:`mb-1`},` Environments let you manage variables like API keys and base URLs across different contexts. `,-1)]])):B(``,!0)]),default:M(()=>[H(j(gf),{"aria-label":`Current environment: ${s.value}`,class:O([`line-clamp-1 h-full w-fit justify-start border px-2 py-1 font-normal transition-colors`,c.value]),size:`sm`,variant:`ghost`},{default:M(()=>[R(`div`,WQt,[H(j(jT),{class:O([`shrink-0`,r.value&&!o.value?`text-c-accent`:`text-c-3`]),icon:`Globe`,size:`sm`},null,8,[`class`]),R(`span`,GQt,k(s.value),1),H(j(jT),{class:`shrink-0`,icon:`ChevronDown`,size:`xs`})])]),_:1},8,[`aria-label`,`class`])]),_:1})]))}})})),e$t,t$t=s((()=>{$Qt(),e$t=QQt})),n$t,r$t,i$t,a$t=s((()=>{Uhe(),HQt(),t$t(),W(),kE(),Ou(),n$t={class:`lg:min-h-header t-app__top-container @container flex w-full flex-wrap items-center justify-center p-2`},r$t={class:`mb-2 flex flex-1 items-center justify-end gap-2 @3xl:mb-0`},i$t=N({__name:`Header`,props:{path:{},method:{},layout:{},hideClientButton:{type:Boolean,default:!1},integration:{},documentSlug:{},exampleKey:{},documentUrl:{},source:{},server:{},servers:{},history:{},eventBus:{},environments:{},activeEnvironment:{},environment:{},serverMeta:{}},emits:[`execute`,`select:history:item`,`add:environment`,`navigate:settings`],setup(e,{emit:t}){let n=t,r=t=>{e.eventBus.emit(`workspace:update:active-environment`,t)},i=()=>{e.eventBus.emit(`ui:navigate`,{page:`document`,path:`environment`})};return(t,a)=>(F(),I(`div`,n$t,[a[8]||=R(`div`,{class:`flex flex-1`},null,-1),H(j(VQt),{activeEnvironment:e.activeEnvironment,documentSlug:e.documentSlug,environment:e.environment,environments:e.environments,eventBus:e.eventBus,exampleKey:e.exampleKey,history:e.history,layout:e.layout,method:e.method,path:e.path,server:e.server,serverMeta:e.serverMeta,servers:e.servers,"onAdd:environment":a[0]||=e=>n(`add:environment`),onExecute:a[1]||=e=>n(`execute`),"onSelect:history:item":a[2]||=e=>n(`select:history:item`,e)},null,8,[`activeEnvironment`,`documentSlug`,`environment`,`environments`,`eventBus`,`exampleKey`,`history`,`layout`,`method`,`path`,`server`,`serverMeta`,`servers`]),R(`div`,r$t,[e.layout===`modal`?B(``,!0):(F(),L(e$t,{key:0,activeEnvironment:e.activeEnvironment,environments:e.environments,"onAdd:environment":i,"onSelect:environment":r},null,8,[`activeEnvironment`,`environments`])),e.layout===`modal`?B(``,!0):(F(),L(j(GT),{key:1,icon:j(sue),label:`Operation settings`,size:`sm`,weight:`bold`,onClick:a[3]||=e=>n(`navigate:settings`)},null,8,[`icon`])),e.layout===`modal`&&e.documentUrl&&!e.hideClientButton?(F(),L(Ru,{key:2,buttonSource:`modal`,class:`!w-fit lg:-mr-1`,integration:e.integration??null,source:e.source??`api-reference`,url:e.documentUrl},null,8,[`integration`,`source`,`url`])):B(``,!0),e.layout===`modal`&&e.source!==`gitbook`?(F(),I(`button`,{key:3,class:`app-exit-button zoomed:static zoomed:p-1 fixed top-2 right-2 rounded-full p-2`,type:`button`,onClick:a[4]||=t=>e.eventBus.emit(`ui:close:client-modal`)},[H(j(jT),{icon:`Close`,size:`lg`,thickness:`2`}),a[6]||=R(`span`,{class:`sr-only`},`Close Client`,-1)])):B(``,!0),e.layout===`modal`&&e.source===`gitbook`?(F(),I(`button`,{key:4,class:`text-c-1 hover:bg-b-2 active:text-c-1 -mr-1.5 rounded p-2`,type:`button`,onClick:a[5]||=t=>e.eventBus.emit(`ui:close:client-modal`)},[H(j(jT),{icon:`Close`,size:`md`,thickness:`1.75`}),a[7]||=R(`span`,{class:`sr-only`},`Close Client`,-1)])):B(``,!0)])]))}})})),o$t,s$t=s((()=>{Bc(),a$t(),o$t=zc(i$t,[[`__scopeId`,`data-v-b1eef1b6`]])}));function A2(e={}){let{notify:t=e=>n(e,`info`)}=e,{toast:n}=pX();async function r(e){try{let n=c$t(e);await navigator.clipboard.writeText(n),t(`Copied to the clipboard`)}catch(e){let n=e;console.error(n.message),t(`Failed to copy to clipboard`)}}return{copyToClipboard:r}}var c$t,l$t=s((()=>{gX(),c$t=e=>e===void 0?`undefined`:typeof e==`string`?e:JSON.stringify(e)})),j2=s((()=>{l$t()})),u$t,d$t,f$t,p$t=s((()=>{v4e(),C4e(),Sge(),D4e(),A4e(),M4e(),xgt(),TR(),rKt(),xZt(),s$t(),W(),QI(),tge(),$u(),nd(),_2(),tL(),j2(),gX(),u$t={class:`bg-b-1 flex h-full flex-col`},d$t={class:`lg:min-h-header flex w-full flex-wrap items-center justify-center p-2 lg:p-0`},f$t=N({name:`OperationBlock`,props:{eventBus:{},appVersion:{},document:{},documentSlug:{},workspaceCookies:{default:()=>[]},documentCookies:{default:()=>[]},path:{},method:{},httpClients:{default:()=>eL},history:{default:()=>[]},layout:{},server:{},selectedClient:{},servers:{},serverMeta:{},hideClientButton:{type:Boolean},integration:{},documentUrl:{},source:{},operation:{},exampleKey:{},authMeta:{},securitySchemes:{},plugins:{default:()=>[]},environments:{},activeEnvironment:{},environment:{},proxyUrl:{},selectedSecurity:{},selectedSecuritySchemes:{},securityRequirements:{},defaultHeaders:{},requestBodyCompositionSelection:{},options:{}},setup(e){let t=U(()=>wR(e.httpClients)),{toast:n}=pX(),{copyToClipboard:r}=A2(),i=A(null),a=A(null),o=A(null),s=()=>i.value?.abort(Xu.REQUEST_ABORTED),c=async()=>{let{request:t}=TI({defaultHeaders:e.defaultHeaders,environment:e.environment,exampleName:e.exampleKey,globalCookies:[...e.workspaceCookies,...e.documentCookies],method:e.method,operation:e.operation,path:e.path,proxyUrl:e.proxyUrl,server:e.server,selectedSecuritySchemes:e.selectedSecuritySchemes,isElectron:Qu(),requestBodyCompositionSelection:e.requestBodyCompositionSelection});await r(xht(t,dI(e.environment)))},l=async()=>{if(e.eventBus.flushDebouncedEmits?.(),bgt(e.operation.parameters??[],e.exampleKey).ok===!1){n(`Path parameters must have values.`,`error`);return}let t=[...e.workspaceCookies,...e.documentCookies],{request:r}=TI({defaultHeaders:e.defaultHeaders,environment:e.environment,exampleName:e.exampleKey,globalCookies:t,method:e.method,operation:e.operation,path:e.path,proxyUrl:e.proxyUrl,server:e.server,selectedSecuritySchemes:e.selectedSecuritySchemes,isElectron:Qu(),requestBodyCompositionSelection:e.requestBodyCompositionSelection});a.value&&`reader`in a.value&&a.value.reader.cancel();let s=_gt();await _$({requestBuilder:r,document:e.document,operation:e.operation,variablesStore:s},`beforeRequest`,e.plugins);let c=nI(r,{envVariables:{...dI(e.environment),...s.getVariables()},allowMissingRequestServerBase:e.layout===`modal`});if(!c.ok){n(c.message??c.error,`error`);return}i.value=c.data.controller,e.eventBus.emit(`hooks:on:request:sent`,{meta:{method:e.method,path:e.path,exampleKey:e.exampleKey}});let[l,u]=await yge({isUsingProxy:c.data.isUsingProxy,requestPayload:c.data.requestPayload,plugins:e.plugins,customFetch:Cn(e.options)?.customFetch});if(u&&await _$({response:u.originalResponse.clone(),requestBuilder:r,request:td(...u.requestPayload),document:e.document,operation:e.operation,variablesStore:s},`responseReceived`,e.plugins),e.eventBus.emit(`hooks:on:request:complete`,{payload:u?{response:u.originalResponse.clone(),requestPayload:u.requestPayload,duration:u.response.duration,timestamp:u.timestamp}:void 0,meta:{method:e.method,path:e.path,exampleKey:e.exampleKey}}),l){a.value=null,o.value=null,i.value=null,n(l.message,`error`);return}a.value=u.response,o.value=u.requestPayload,j4e(u.response)||PE.set(NE(e.method,e.path,e.exampleKey),{response:u.response,requestPayload:u.requestPayload})};Hi(()=>{e.eventBus.on(`operation:send:request:hotkey`,l),e.eventBus.on(`operation:cancel:request`,s),e.eventBus.on(`copy-url:address-bar`,c)}),Wi(()=>{e.eventBus.off(`operation:send:request:hotkey`,l),e.eventBus.off(`operation:cancel:request`,s),e.eventBus.off(`copy-url:address-bar`,c)});let u=U(()=>e.history.map(e=>({method:e.request.method,path:e.request.url,duration:e.time,status:e.response.status})).reverse()),d=({index:t})=>{let n=(e.history.length??0)-t-1,r=e.history[n];r&&e.eventBus.emit(`operation:reload:history`,{meta:{path:e.path,method:e.method},index:n,callback:()=>e.eventBus.emit(`ui:navigate`,{page:`example`,method:e.method,path:e.path,exampleName:`draft`,callback:t=>{if(t!==`success`)return;let n=AE({harResponse:r.response,url:r.request.url,method:e.method,path:e.path,duration:r.time}),i=w4e({harRequest:r.request});a.value=n,o.value=i}})})},f=()=>{e.eventBus.emit(`ui:navigate`,{page:`operation`,path:`overview`,operationPath:e.path,method:e.method})};return mr([()=>e.path,()=>e.method,()=>e.exampleKey],([t,n,r])=>{let i=PE.get(NE(n,t,r));if(i)a.value=i.response,o.value=i.requestPayload;else{let i=(()=>{for(let t=e.history.length-1;t>=0;t--){let n=e.history[t];if(n?.meta.example===r)return n}})();i?(a.value=AE({harResponse:i.response,url:i.request.url,method:n,path:t,duration:i.time}),o.value=null):(a.value=null,o.value=null)}s()},{immediate:!0}),Wi(()=>{s()}),(n,r)=>(F(),I(`div`,u$t,[R(`div`,d$t,[H(o$t,{activeEnvironment:e.activeEnvironment,documentSlug:e.documentSlug,documentUrl:e.documentUrl,environment:e.environment,environments:e.environments,eventBus:e.eventBus,exampleKey:e.exampleKey,hideClientButton:e.hideClientButton,history:u.value,integration:e.integration,layout:e.layout,method:e.method,path:e.path,server:e.server,serverMeta:e.serverMeta,servers:e.servers,source:e.source,onExecute:l,"onNavigate:settings":f,"onSelect:history:item":d},null,8,[`activeEnvironment`,`documentSlug`,`documentUrl`,`environment`,`environments`,`eventBus`,`exampleKey`,`hideClientButton`,`history`,`integration`,`layout`,`method`,`path`,`server`,`serverMeta`,`servers`,`source`])]),H(_4e,{class:`border-t`},{default:M(()=>[H(S4e,{class:`flex-1`},{default:M(()=>[H(j(nKt),{authMeta:e.authMeta,clientOptions:t.value,defaultHeaders:e.defaultHeaders,documentCookies:e.documentCookies,environment:e.environment,eventBus:e.eventBus,exampleKey:e.exampleKey,layout:e.layout,method:e.method,operation:e.operation,options:Cn(e.options),path:e.path,plugins:e.plugins,proxyUrl:e.proxyUrl,requestBodyCompositionSelection:e.requestBodyCompositionSelection,securityRequirements:e.securityRequirements,securitySchemes:e.securitySchemes,selectedClient:e.selectedClient,selectedSecurity:e.selectedSecurity,selectedSecuritySchemes:e.selectedSecuritySchemes,server:e.server,workspaceCookies:e.workspaceCookies},null,8,[`authMeta`,`clientOptions`,`defaultHeaders`,`documentCookies`,`environment`,`eventBus`,`exampleKey`,`layout`,`method`,`operation`,`options`,`path`,`plugins`,`proxyUrl`,`requestBodyCompositionSelection`,`securityRequirements`,`securitySchemes`,`selectedClient`,`selectedSecurity`,`selectedSecuritySchemes`,`server`,`workspaceCookies`]),H(j(bZt),{appVersion:e.appVersion,eventBus:e.eventBus,layout:e.layout,plugins:e.plugins,requestPayload:o.value,response:a.value,totalPerformedRequests:u.value.length},null,8,[`appVersion`,`eventBus`,`layout`,`plugins`,`requestPayload`,`response`,`totalPerformedRequests`])]),_:1})]),_:1})]))}})})),m$t,h$t=s((()=>{p$t(),m$t=f$t}));Uhe(),Sge(),h$t();async function g$t({defaultValue:e,validation:t,transformation:n,maxRetries:r=5}){let i=n?.(e)??e;return await t(i)?i:_$t({value:[i,1],validation:t,maxRetries:r,transformation:n})}async function _$t({value:e,validation:t,maxRetries:n,attempts:r=0,transformation:i}){if(r>=n)return;let a=e.join(` `),o=i?.(a)??a;return await t(o)?o:_$t({value:[e[0],e[1]+1],validation:t,maxRetries:n,transformation:i,attempts:r+1})}var v$t=s((()=>{})),M2,y$t=s((()=>{M2=e=>e!==void 0&&Object.keys(e).length>0})),b$t,x$t,S$t,C$t,w$t,T$t,E$t,D$t,N2,P2,O$t,k$t,A$t,j$t,M$t=s((()=>{v$t(),zE(),y$t(),UI(),dD(),zI(),OI(),b$t=async(e,t,{selectedRequirements:n,newSchemes:r,meta:i})=>{if(!EI(t))return;let a=t[`x-scalar-navigation`]?.name;if(!a)return;let o=()=>i.type===`document`?e?.auth.getAuthSelectedSchemas({type:`document`,documentName:a}):e?.auth.getAuthSelectedSchemas({type:`operation`,documentName:a,path:i.path,method:i.method}),s=(await Promise.all(r.map(async e=>{let n=await g$t({defaultValue:e.name,validation:e=>!t.components?.securitySchemes?.[e],maxRetries:100});if(n)return t.components||={},t.components.securitySchemes||(t.components.securitySchemes={}),t.components.securitySchemes[n]=e.scheme,{[n]:[]}}))).filter(Boolean),c=o(),l=[...n,...s],u=()=>c?.selectedIndex?c.selectedIndex>=l.length?l.length-1:c.selectedIndex:0;return i.type===`document`?e?.auth.setAuthSelectedSchemas({type:`document`,documentName:a},{selectedIndex:u(),selectedSchemes:l}):e?.auth.setAuthSelectedSchemas({type:`operation`,documentName:a,path:i.path,method:i.method},{selectedIndex:u(),selectedSchemes:l})},x$t=(e,t,{meta:n})=>{if(!EI(t))return;let r=t[`x-scalar-navigation`]?.name;if(r)return n.type===`document`?e?.auth.clearAuthSelectedSchemas({type:`document`,documentName:r}):e?.auth.clearAuthSelectedSchemas({type:`operation`,documentName:r,path:n.path,method:n.method})},S$t=(e,{payload:t,name:n})=>{if(!EI(e))return;let r=RE(e.components?.securitySchemes?.[n]);if(!r){console.error(`Security scheme ${n} not found`);return}return r.type===t.type&&HI(r,t),r},C$t=(e,t,{payload:n,name:r,overwrite:i=!1})=>{if(!EI(t))return;let a=t[`x-scalar-navigation`]?.name;if(!a)return;if(i){e?.auth.setAuthSecrets(a,r,n);return}let o=e?.auth.getAuthSecrets(a,r),s=HI(uD(o,{depth:1})??{},n);e?.auth.setAuthSecrets(a,r,s)},w$t=(e,t,{name:n})=>{if(!EI(t))return;let r=t[`x-scalar-navigation`]?.name;r&&e?.auth.clearAuthSecrets(r,n)},T$t=(e,t,{index:n,meta:r})=>{if(!EI(t))return;let i=t[`x-scalar-navigation`]?.name;if(!i||r.type===`operation`&&t.paths?.[r.path]?.[r.method]===void 0)return;let a=r.type===`document`?e?.auth.getAuthSelectedSchemas({type:`document`,documentName:i}):e?.auth.getAuthSelectedSchemas({type:`operation`,documentName:i,path:r.path,method:r.method});if(!a)return r.type===`document`?e?.auth.setAuthSelectedSchemas({type:`document`,documentName:i},{selectedIndex:n,selectedSchemes:[]}):e?.auth.setAuthSelectedSchemas({type:`operation`,documentName:i,path:r.path,method:r.method},{selectedIndex:n,selectedSchemes:[]});e?.auth.setAuthSelectedSchemas(r.type===`document`?{type:`document`,documentName:i}:{type:`operation`,documentName:i,path:r.path,method:r.method},{selectedIndex:n,selectedSchemes:uD(a.selectedSchemes,{depth:null})??[]})},E$t=(e,t)=>{let n=[...Object.keys(e)].sort((e,t)=>e.localeCompare(t)),r=[...t].sort((e,t)=>e.localeCompare(t));return JSON.stringify(n)===JSON.stringify(r)},D$t=(e,t,{id:n,name:r,scopes:i,meta:a})=>{if(!EI(t))return;let o=t[`x-scalar-navigation`]?.name;if(!o)return;let s=(a.type===`document`?e?.auth.getAuthSelectedSchemas({type:`document`,documentName:o}):e?.auth.getAuthSelectedSchemas({type:`operation`,documentName:o,path:a.path,method:a.method}))??RI(void 0,void 0,[],t.components?.securitySchemes??{},n.length===1?n[0]:n),c=uD(s.selectedSchemes,{depth:1})??[],l=c.find(e=>E$t(e,n));M2(l)&&(l[r]=i,e?.auth.setAuthSelectedSchemas(a.type===`document`?{type:`document`,documentName:o}:{type:`operation`,documentName:o,path:a.path,method:a.method},{selectedIndex:s.selectedIndex,selectedSchemes:c}))},N2=(e,t,n)=>{if(!EI(e))return null;let r=RE(e.components?.securitySchemes?.[t]);return!r||r.type!==`oauth2`&&r.type!==`openIdConnect`?null:r.flows?.[n]??null},P2=(e,t,n)=>{if(!EI(t)||!e)return;let r=t[`x-scalar-navigation`]?.name;if(!r)return;let i=t=>{let r=e.auth.getAuthSelectedSchemas(t);if(!r)return;let i=uD(r.selectedSchemes,{depth:1})??[];n(i),e.auth.setAuthSelectedSchemas(t,{selectedIndex:r.selectedIndex,selectedSchemes:i})};i({type:`document`,documentName:r}),Object.entries(t.paths??{}).forEach(([e,t])=>{Object.entries(t).forEach(([t,n])=>{typeof n==`object`&&i({type:`operation`,documentName:r,path:e,method:t})})})},O$t=(e,t,{name:n,flowType:r,scope:i,description:a,oldScope:o,enable:s})=>{if(!EI(t))return;let c=N2(t,n,r);if(!c)return;c.scopes||={};let l=!!o&&o!==i;if(l){if(!(o in c.scopes))return;delete c.scopes[o]}c.scopes[i]=a,!(!l&&!s)&&P2(e,t,e=>{e.forEach(e=>{if(!M2(e))return;let t=e[n];if(!Array.isArray(t))return;let r=t;l&&r.includes(o)&&(r=r.map(e=>e===o?i:e)),s&&!r.includes(i)&&(r=[...r,i]),r!==t&&(e[n]=r)})})},k$t=(e,t,{name:n,flowType:r,scope:i})=>{if(!EI(t))return;let a=N2(t,n,r);a?.scopes&&(delete a.scopes[i],P2(e,t,e=>{e.forEach(e=>{if(!M2(e))return;let t=e[n];!Array.isArray(t)||!t.includes(i)||(e[n]=t.filter(e=>e!==i))})}))},A$t=(e,t,{names:n})=>{if(!EI(t))return;let r=t[`x-scalar-navigation`]?.name;if(!r)return;let i=RE(t.components?.securitySchemes);if(!i)return;n.forEach(e=>{delete i[e]});let a=(e,t)=>Math.max(0,Math.min(e,t-1)),o=e=>(uD(e,{depth:1})??[]).filter(e=>!n.some(t=>Object.keys(e).includes(t))),s=e?.auth.getAuthSelectedSchemas({type:`document`,documentName:r});if(s){let t=o(s.selectedSchemes);e?.auth.setAuthSelectedSchemas({type:`document`,documentName:r},{selectedIndex:a(s.selectedIndex,t.length),selectedSchemes:t})}t.security&&=o(t.security),Object.entries(t.paths??{}).forEach(([t,n])=>{Object.entries(n).forEach(([n,i])=>{if(typeof i!=`object`)return;let s=RE(i);`security`in s&&s.security&&(s.security=o(s.security));let c=e?.auth.getAuthSelectedSchemas({type:`operation`,documentName:r,path:t,method:n});if(c){let i=o(c.selectedSchemes);e?.auth.setAuthSelectedSchemas({type:`operation`,documentName:r,path:t,method:n},{selectedIndex:a(c.selectedIndex,i.length),selectedSchemes:i})}})})},j$t=({document:e,store:t})=>({updateSelectedSecuritySchemes:n=>b$t(t,e,n),clearSelectedSecuritySchemes:n=>x$t(t,e,n),updateSecurityScheme:t=>S$t(e,t),updateSecuritySchemeSecrets:n=>C$t(t,e,n),clearSecuritySchemeSecrets:n=>w$t(t,e,n),updateSelectedAuthTab:n=>T$t(t,e,n),updateSelectedScopes:n=>D$t(t,e,n),upsertScope:n=>O$t(t,e,n),deleteScope:n=>k$t(t,e,n),deleteSecurityScheme:n=>A$t(t,e,n)})})),N$t,P$t,F2,F$t=s((()=>{yN(),OI(),oN(),N$t=(e,{payload:t,index:n})=>{if(!e||DI(e))return;if(e[`x-scalar-cookies`]||=[],n!==void 0){if(n<0||n>=e[`x-scalar-cookies`].length)return;let r=aN(vN,{...e[`x-scalar-cookies`][n],...t});return e[`x-scalar-cookies`][n]=r,r}let r=aN(vN,t);return e[`x-scalar-cookies`].push(r),r},P$t=(e,{index:t})=>!e||DI(e)||!e[`x-scalar-cookies`]||t<0||t>=e[`x-scalar-cookies`].length?!1:(e[`x-scalar-cookies`].splice(t,1),!0),F2=({collection:e})=>({upsertCookie:t=>N$t(e,t),deleteCookie:t=>P$t(e,t)})})),I$t,L$t,R$t,z$t,B$t,V$t,H$t,U$t=s((()=>{UI(),OI(),I$t=(e,t)=>{EI(e)&&HI(e,t)},L$t=(e,t)=>{EI(e)&&(e[`x-scalar-watch-mode`]=t)},R$t=(e,t)=>{EI(e)&&(HI(e.info,t),e[`x-scalar-navigation`]&&t.title!==void 0&&(e[`x-scalar-navigation`].title=t.title?.trim()||`Untitled Document`))},z$t=(e,t)=>{!EI(e)||!e[`x-scalar-navigation`]||(e[`x-scalar-icon`]=t,e[`x-scalar-navigation`].icon=t)},B$t=async(e,t)=>{if(e){if(e.workspace.documents[t.name]){t.callback?.(!1);return}await e.addDocument({name:t.name,document:{openapi:`3.1.0`,info:{title:t.name,version:`1.0.0`},paths:{"/":{get:{}}},"x-scalar-icon":t.icon}}),t.callback?.(!0)}},V$t=(e,t)=>{e&&e.deleteDocument(t.name)},H$t=({document:e,store:t})=>({updateDocumentExtension:t=>I$t(e,t),updateDocumentInfo:t=>R$t(e,t),updateWatchMode:t=>L$t(e,t),updateDocumentIcon:t=>z$t(e,t),createEmptyDocument:e=>B$t(t,e),deleteDocument:e=>V$t(t,e)})})),W$t,G$t,K$t,q$t,I2,J$t=s((()=>{dD(),dN(),OI(),oN(),W$t=(e,t,{environmentName:n,payload:r,oldEnvironmentName:i})=>{if(!t||!e||DI(t))return;t[`x-scalar-environments`]||={};let a=!t[`x-scalar-environments`][i??n],o=aN(uN,{...uD(t[`x-scalar-environments`][i??n],{depth:1}),...r});return t[`x-scalar-environments`][n]=o,i&&i!==n&&(delete t[`x-scalar-environments`][i],e[`x-scalar-active-environment`]===i&&(e[`x-scalar-active-environment`]=n)),a&&(e[`x-scalar-active-environment`]=n),o},G$t=(e,t,{environmentName:n})=>{!t||!e||DI(t)||delete t[`x-scalar-environments`]?.[n]},K$t=(e,{environmentName:t,variable:n,index:r})=>{if(!e||DI(e))return;if(!e[`x-scalar-environments`]?.[t]){console.error(`Environment not found`,t);return}let i=aN(lN,n);if(r!==void 0){if(i.name===``){e[`x-scalar-environments`][t].variables.splice(r,1);return}e[`x-scalar-environments`][t].variables[r]=i}else e[`x-scalar-environments`][t].variables.push(i);return i},q$t=(e,{environmentName:t,index:n})=>{if(!(!e||DI(e))){if(!e[`x-scalar-environments`]?.[t]){console.error(`Environment not found`,t);return}e[`x-scalar-environments`][t]?.variables?.splice(n,1)}},I2=({workspace:e,collection:t})=>({upsertEnvironment:n=>W$t(e,t,n),deleteEnvironment:n=>G$t(e,t,n),upsertEnvironmentVariable:e=>K$t(t,e),deleteEnvironmentVariable:e=>q$t(t,e)})})),Y$t,X$t=s((()=>{Y$t=(e,t)=>e&&e.workspace.documents[t]||null})),L2,Z$t,Q$t,$$t,e1t=s((()=>{zE(),dD(),OI(),L2=(e,t,n)=>{if(!EI(e))return null;let r=RE(e.paths?.[n.path]?.[n.method]);if(!r)return null;let i=RE(r.requestBody);return i||=(r.requestBody={content:{}},RE(r.requestBody)),i.content[t]||={},i.content[t].examples||={},i.content[t].examples[n.exampleKey]||={},RE(i.content[t].examples?.[n.exampleKey])??null},Z$t=(e,{meta:t,payload:n})=>{if(!EI(e))return;let r=RE(e.paths?.[t.path]?.[t.method]);if(!r)return;let i=RE(r.requestBody);i||=(r.requestBody={content:{}},RE(r.requestBody)),i[`x-scalar-selected-content-type`]||={},i[`x-scalar-selected-content-type`][t.exampleKey]=n.contentType},Q$t=(e,{meta:t,payload:n,contentType:r})=>{let i=L2(e,r,t);if(!i){console.error(`Example not found`,t.exampleKey);return}i.value=n},$$t=(e,{meta:t,payload:n,contentType:r})=>{let i=L2(e,r,t);if(!i){console.error(`Example not found`,t.exampleKey);return}i.value=uD(n,{depth:3})}})),t1t,n1t=s((()=>{zE(),UI(),OI(),t1t=(e,{meta:t,payload:n})=>{if(!EI(e))return;let r=RE(e.paths?.[t.path]?.[t.method]);r&&HI(r,n)}})),r1t,i1t,a1t,o1t,s1t,c1t,l1t=s((()=>{r1t=async({requestPayload:e,includeBody:t=!0,httpVersion:n=`HTTP/1.1`,bodySizeLimit:r=1048576})=>{let[i,a]=e,o=new URL(i),s=Array.from(o.searchParams.entries()).map(([e,t])=>({name:e,value:t})),c=new Headers(a.headers),l=c.get(`content-type`)?.split(`;`)[0]?.trim()??`text/plain`,{headers:u,headersSize:d,cookies:f}=s1t(c),p=await(async()=>{if(t&&a.body!=null){let e=await i1t(a.body,l);if(e.size<=r)return e}return{text:``,size:-1}})();return{method:a.method??`GET`,url:i,httpVersion:n,headers:u,cookies:f,queryString:s,headersSize:d,bodySize:p.size,postData:`params`in p?{mimeType:l,params:p.params}:{mimeType:l,text:p.text}}},i1t=async(e,t)=>e instanceof FormData?a1t(e):e instanceof URLSearchParams?o1t(e):t.includes(`application/octet-stream`)?{text:``,size:-1}:typeof e==`string`?{text:e,size:new TextEncoder().encode(e).byteLength}:e instanceof Blob?{text:await e.text(),size:e.size}:e instanceof ArrayBuffer||ArrayBuffer.isView(e)?{text:new TextDecoder().decode(e),size:e.byteLength}:{text:``,size:-1},a1t=e=>Array.from(e.entries()).reduce((e,[t,n])=>{if(n instanceof File){let r=`@${n.name}`;return e.params.push({name:t,value:r}),e.size+=r.length,e}return e.params.push({name:t,value:n}),e.size+=n.length,e},{params:[],size:0}),o1t=e=>Array.from(e.entries()).reduce((e,[t,n])=>(e.params.push({name:t,value:n}),e.size+=t.length+n.length,e),{params:[],size:0}),s1t=e=>Array.from(e.entries()).reduce((e,[t,n])=>{if(t.toLowerCase()===`cookie`){let t=c1t(n);e.cookies.push(...t.cookies)}else e.headers.push({name:t,value:n}),e.headersSize+=t.length+2+n.length+2;return e},{headers:[],headersSize:0,cookies:[]}),c1t=e=>e.split(`;`).reduce((e,t)=>{let n=t.trim(),r=n.indexOf(`=`);if(r===-1)return e;let i=n.substring(0,r).trim(),a=n.substring(r+1).trim();return e.cookies.push({name:i,value:a}),e.size+=i.length+2+a.length+2,e},{cookies:[],size:0})})),u1t,d1t,f1t,p1t,m1t,h1t=s((()=>{u1t=async({response:e,includeBody:t=!0,httpVersion:n=`HTTP/1.1`,bodySizeLimit:r=1048576})=>{let{headers:i,headersSize:a,cookies:o}=d1t(e),s=e.headers.get(`location`)||``,c=e.headers.get(`content-type`)??`text/plain`,l=await(async()=>{if(t&&e.body){let t=await f1t(e.clone());if(t.size<=r)return t}return{text:``,size:-1,encoding:void 0}})();return{status:e.status,statusText:e.statusText,httpVersion:n,headers:i,cookies:o,content:{size:l.size,mimeType:c,text:l.text,encoding:l.encoding},redirectURL:s,headersSize:a,bodySize:l.size}},d1t=e=>Array.from(e.headers.entries()).reduce((e,[t,n])=>{if(e.headers.push({name:t,value:n}),e.headersSize+=t.length+2+n.length+2,t.toLowerCase()===`set-cookie`){let t=m1t(n);t&&e.cookies.push(t)}return e},{headers:[],headersSize:0,cookies:[]}),f1t=async e=>{let t=e.headers.get(`content-type`);if(!t||!p1t(t))return{text:``,size:-1,encoding:void 0};try{let t=await e.arrayBuffer(),n=t.byteLength;return{text:new TextDecoder(`utf-8`).decode(t),size:n,encoding:void 0}}catch{return{text:``,size:-1,encoding:void 0}}},p1t=e=>{let t=e.toLowerCase();return!!(t.startsWith(`text/`)||t.includes(`application/json`)||t.includes(`+json`)||t.includes(`application/xml`)||t.includes(`text/xml`)||t.includes(`+xml`)||t.includes(`application/javascript`)||t.includes(`application/x-javascript`)||t.includes(`application/x-www-form-urlencoded`)||t.includes(`application/graphql`))},m1t=e=>{let t=e.split(`;`);if(t.length===0||!t[0])return null;let n=t[0].trim(),r=n.indexOf(`=`);return r===-1?null:{name:n.substring(0,r).trim(),value:n.substring(r+1).trim()}}})),g1t,_1t,v1t,R2,y1t=s((()=>{zE(),dY(),g1t=(e,t,n)=>{e.forEach(e=>{let r=RE(e);uY(r)||(v1t(RE(e),n,!0),r.in===`path`&&(r.examples||={},r.examples[n]={value:t[r.name]??``,"x-disabled":!1}))})},_1t=({harRequest:e,exampleKey:t,baseOperation:n={},pathVariables:r={}})=>{if(n.parameters||=[],g1t(n.parameters,r,t),e.queryString&&e.queryString.length>0)for(let r of e.queryString){let e=R2(n.parameters,r.name,`query`);!e||uY(e)||(e.examples||={},e.examples[t]={value:r.value,"x-disabled":!1})}if(e.headers&&e.headers.length>0)for(let r of e.headers){let e=R2(n.parameters,r.name,`header`);!e||uY(e)||(e.examples||={},e.examples[t]={value:r.value,"x-disabled":!1})}if(e.cookies&&e.cookies.length>0)for(let r of e.cookies){let e=R2(n.parameters,r.name,`cookie`);!e||uY(e)||(e.examples||={},e.examples[t]={value:r.value,"x-disabled":!1})}if(e.postData){let{mimeType:r,text:i,params:a}=e.postData;n.requestBody||={content:{}};let o=RE(n.requestBody);o.content[r]||(o.content[r]={schema:{type:`object`}});let s=o.content[r];if(!s)return n;s.examples||={};let c;if(a&&a.length>0){c=[];for(let e of a)c.push({name:e.name,value:e.value,"x-disabled":!1})}else c=i;s.examples[t]={value:c,"x-disabled":!1},o[`x-scalar-selected-content-type`]||={},o[`x-scalar-selected-content-type`][t]=r}return n},v1t=(e,t,n)=>{uY(e)||e.examples?.[t]&&(RE(e.examples[t])[`x-disabled`]=n)},R2=(e,t,n)=>{for(let r of e){let e=RE(r);if(!uY(e)&&e.in===n&&(n===`header`?e.name.toLowerCase()===t.toLowerCase():e.name===t))return e}let r={name:t,in:n,schema:{type:`string`}};return e.push(r),r}})),b1t,x1t,S1t=s((()=>{zE(),OI(),dY(),l1t(),h1t(),y1t(),b1t=async(e,t,{payload:n,meta:r})=>{if(!EI(t))return;let i=t[`x-scalar-navigation`]?.name;if(!i||!n)return;let a=RE(t.paths?.[r.path]?.[r.method]);if(!a)return;let o=(a.parameters??[]).reduce((e,t)=>{let n=RE(t);return uY(n)||n.in===`path`&&(e[n.name]=RE(n.examples?.[r.exampleKey])?.value??``),e},{}),s=await r1t({requestPayload:n.requestPayload}),c=await u1t({response:n.response});e?.history.addHistory(i,r.path,r.method,{response:c,request:s,meta:{example:r.exampleKey},time:n.duration,timestamp:n.timestamp,requestMetadata:{variables:o}})},x1t=(e,t,{meta:n,index:r,callback:i})=>{if(!EI(t)){console.error(`Document not found`,n.path,n.method);return}let a=RE(t.paths?.[n.path]?.[n.method]);if(!a){console.error(`Operation not found`,n.path,n.method);return}let o=e?.history.getHistory(t[`x-scalar-navigation`]?.name??``,n.path,n.method)?.[r];if(!o){console.error(`History item not found`,r);return}_1t({harRequest:o.request,exampleKey:`draft`,baseOperation:a,pathVariables:o.requestMetadata.variables}),i(`success`)}})),z2,B2=s((()=>{DN(),z2=e=>e&&typeof e==`string`?Ult.has(e.toLowerCase()):!1})),V2,H2=s((()=>{Au(),V2=(e,{includePath:t=!0,includeEnv:n=!0}={})=>[t&&ku.PATH,n&&ku.VARIABLES].flatMap(t=>t?[...e.matchAll(t)].map(e=>e[1]?.trim()).filter(e=>e!==void 0):[])})),U2,C1t=s((()=>{U2=(e,t)=>{let n={};for(let r of t){let t=e.indexOf(`{${r}}`);t!==-1&&(n[r]=t)}return n}})),W2,w1t=s((()=>{H2(),dD(),C1t(),W2=(e,t,n,r)=>{let i=V2(t,{includePath:!0,includeEnv:!1}).filter(e=>e!==void 0),a=V2(e,{includePath:!0,includeEnv:!1}).filter(e=>e!==void 0),o=U2(t,i),s=U2(e,a),c=Object.create(null);for(let e of n){let t=r(e);t?.in===`path`&&(c[t.name]=e)}let l=new Set,u=new Set,d=[];for(let e of a){if(c[e]){l.add(e),u.add(c[e]);continue}let t=s[e],n=i.find(e=>o[e]===t&&!l.has(e));if(n&&c[n]!==void 0){let t=c[n];t&&(r(t).name=e,u.add(t)),l.add(n);continue}d.push({in:`path`,name:e})}let f=[];for(let e of n){let t=r(e),n=uD(e,{depth:1});if(t?.in!==`path`){f.push(n);continue}u.has(e)&&f.push(n)}return f.concat(d)}})),G2,K2=s((()=>{G2=(e,t)=>{if(t)return t.type===e?t:G2(e,t.parent)}})),T1t,E1t,D1t=s((()=>{zE(),OI(),K2(),T1t=e=>e.type===`document`||e.type===`tag`||e.type===`operation`,E1t=({store:e,entry:t})=>{let n=G2(`document`,t);if(!n)return null;let r=e.workspace.documents[n.name];return r?t.type===`document`?r:EI(r)?t.type===`tag`?r.tags?.find(e=>e.name===t.name)??null:t.type===`operation`?RE(r.paths?.[t.path]?.[t.method])??null:null:null:null}})),q2,O1t=s((()=>{q2=e=>{let t=new Map,n=(e,n)=>{let r=t.get(e);r?r.push(n):t.set(e,[n])},r=(e,t)=>{if(e)for(let i of e)i.type===`operation`?n(`${i.path}|${i.method}`,{...i,parent:t}):i.type===`webhook`?n(`${i.name}|${i.method}`,{...i,parent:t}):`children`in i&&i.children&&r(i.children,{...i,parent:t})};return r(e.children,e),t}})),k1t,A1t=s((()=>{k1t=e=>{let t=new Map,n=(e,n)=>{let r=t.get(e);r?r.push(n):t.set(e,[n])},r=(e,t)=>{if(e)for(let i of e)i.type===`tag`?(n(i.name,{...i,parent:t}),r(i.children,{...i,parent:t})):`children`in i&&i.children&&r(i.children,{...i,parent:t})};return r(e.children,e),t}})),j1t,M1t,N1t,P1t,J2,Y2,F1t=s((()=>{j1t=/[^\p{L}\p{M}\p{N}\s_-]/gu,M1t=/[\s_-]+/g,N1t=/^-+|-+$/g,P1t=/\p{M}/gu,J2=new Map,Y2=(e,t={})=>{let{allowedSpecialChars:n=``,preserveCase:r=!1,normalizationForm:i=`NFC`,stripAccents:a=!1}=t,o=(()=>{if(n.length===0)return j1t;let e=J2.get(n);if(e)return e;let t=n.replace(/[-[\]{}()*+?.,\\^$|#\s]/g,`\\$&`),r=RegExp(`[^\\p{L}\\p{M}\\p{N}\\s_\\-${t}]`,`gu`);return J2.set(n,r),r})(),s=e.slice(0,255).trim(),c=a?s.normalize(`NFD`).replace(P1t,``):s.normalize(i);return(r?c:c.toLowerCase()).replace(o,``).replace(M1t,`-`).replace(N1t,``)}})),X2,Z2=s((()=>{F1t(),X2=(e,t)=>{let n=r=>{let i=Y2(e);if(r.type===`text`)return t?.generateHeadingSlug?t?.generateHeadingSlug({slug:r.slug}):r.slug?`${i}/description/${r.slug}`:`${i}/`;if(r.type===`tag`){let e=r.isGroup?`tag-group`:`tag`;return t?.generateTagSlug?`${i}/${e}/${t.generateTagSlug(r.tag)}`:`${i}/${e}/${Y2(r.tag.name??``)}`}if(r.type===`operation`){let e=r.parentTag?`${n({type:`tag`,tag:r.parentTag.tag,parentId:r.parentTag.id})}/`:`${i}/`;return t?.generateOperationSlug?`${e}${t.generateOperationSlug({path:r.path,operationId:r.operation.operationId,method:r.method.toUpperCase(),summary:r.operation.summary})}`:`${e}${r.method.toUpperCase()}${r.path}`}if(r.type===`webhook`){let e=r.parentTag?`${n({type:`tag`,parentId:r.parentTag.id,tag:r.parentTag.tag})}/`:`${i}/`;return t?.generateWebhookSlug?`${e}webhook/${t.generateWebhookSlug({name:r.name,method:r.method?.toUpperCase()})}`:`${e}webhook/${r.method?.toUpperCase()}/${Y2(r.name)}`}if(r.type===`model`){if(!r.name)return`${i}/models`;let e=r.parentTag?`${n({type:`tag`,parentId:r.parentTag.id,tag:r.parentTag.tag})}/`:`${i}/`;return t?.generateModelSlug?`${e}model/${t.generateModelSlug({name:r.name})}`:`${e}model/${Y2(r.name,{preserveCase:!0})}`}return r.type===`example`?`${r.parentId}/example/${Y2(r.name)}`:r.type===`document`?i:(console.warn(`[WARNING]: unhandled id generation for navigation item:`,r),`unknown-id`)};return{hideModels:t?.hideModels??!1,operationsSorter:t?.operationsSorter,tagsSorter:t?.tagsSorter,generateId:n}}}));function I1t(e){return e.replace(/!\[([^\]]*)\]\([^)]*\)/g,`$1`).replace(/\[([^\]]*)\]\([^)]*\)/g,`$1`).replace(/(\*{3}|_{3})(.+?)\1/g,`$2`).replace(/(\*{2}|_{2})(.+?)\1/g,`$2`).replace(/(\*|_)(.+?)\1/g,`$2`).replace(/~~(.+?)~~/g,`$1`).replace(/`([^`]+)`/g,`$1`).replace(/<[^>]+>/g,``).replace(/[<>]/g,``).trim()}function L1t(e){let t=e.split(/\r?\n/),n=[],r=!1,i=``,a=0;for(let e=0;e<t.length;e++){let o=t[e]??``,s=o.trimStart();if(r){let e=/^(`{3,}|~{3,})\s*$/.exec(s)?.[1];e&&e[0]===i&&e.length>=a&&(r=!1);continue}else{let e=/^(`{3,}|~{3,})/.exec(s)?.[1];if(e){r=!0,i=e.charAt(0),a=e.length;continue}}if(/^(?: {4}|\t)/.test(o))continue;let c=/^(#{1,6})\s+(.+?)(?:\s+#+\s*)?$/.exec(s),l=c?.[1],u=c?.[2];if(l&&u){let e=I1t(u);e&&n.push({depth:l.length,value:e});continue}let d=t[e+1];if(!d||/^(?: {4}|\t)/.test(d))continue;let f=/^(=+|-+)\s*$/.exec(d.trim())?.[1];if(!f)continue;let p=I1t(s);p&&(n.push({depth:f[0]===`=`?1:2,value:p}),e++)}return n}var R1t=s((()=>{})),Q2,$2=s((()=>{F1t(),Q2=(e={})=>{let t=new Map;return{slug(n){let r=Y2(n,e),i=t.get(r);if(i===void 0)return t.set(r,0),r;let a=i+1;return t.set(r,a),`${r}-${a}`},reset(){t.clear()}}}}));function z1t(e){let{slug:t}=Q2();return B1t(L1t(e),t)}var B1t,V1t,H1t=s((()=>{R1t(),$2(),B1t=(e,t)=>e.map(e=>({...e,slug:t(e.value)})),V1t=e=>{let t=Math.min(...e.map(e=>e.depth));return t>=1&&t<=6?t:1}})),e4,t4,U1t,W1t=s((()=>{H1t(),e4={TITLE:`Introduction`,SLUG:`introduction`},t4=(e,t,n)=>({id:e({type:`text`,depth:1,slug:e4.SLUG,parentId:t,info:n,value:e4.TITLE}),title:e4.TITLE,type:`text`}),U1t=({generateId:e,parentId:t,info:n})=>{let r=n.description?.trim();if(!r)return[t4(e,t,n)];let i=z1t(r),a=V1t(i),o=[],s=null,c=null;if(!r.startsWith(`#`)){let r=t4(e,t,n);o.push(r),s=r}for(let r of i){if(r.depth!==a&&r.depth!==a+1)continue;let i={id:e({type:`text`,depth:r.depth,slug:r.slug,parentId:t,info:n,value:r.value}),title:r.value,type:`text`};r.depth===a?(i.children=[],s?(s.children||=[],s.children.push(i)):o.push(i),c=i):c&&c.children?.push(i)}return o}}));function n4(e){return e.replace(/~/g,`~0`).replace(/\//g,`~1`)}var G1t=s((()=>{})),r4,i4=s((()=>{r4=e=>!!(e?.[`x-internal`]||e?.[`x-scalar-ignore`])})),K1t,q1t=s((()=>{zE(),K1t=e=>{let t=new Set(e[`x-draft-examples`]??[]);if(e.requestBody){let n=RE(e.requestBody);Object.values(n.content??{}).forEach(e=>{Object.keys(e.examples??{}).forEach(e=>{t.add(e)})})}return e.parameters&&e.parameters.forEach(e=>{let n=RE(e)??{};`content`in n&&n.content&&Object.values(n.content).forEach(e=>{Object.keys(e.examples??{}).forEach(e=>{t.add(e)})}),`examples`in n&&n.examples&&Object.keys(n.examples??{}).forEach(e=>{t.add(e)})}),Array.from(t)}})),J1t=s((()=>{CP(),EP(),MP(),kP()})),a4,o4=s((()=>{a4=({tagsMap:e,name:t,documentId:n,generateId:r})=>(e.get(t)||e.set(t,{id:r({type:`tag`,tag:{name:t},parentId:n}),parentId:n,entries:[],tag:{name:t}}),e.get(t))})),s4,c4,Y1t,X1t=s((()=>{B2(),PI(),G1t(),zE(),i4(),q1t(),J1t(),o4(),s4=e=>e.deprecated||e[`x-scalar-stability`]===Cdt.Deprecated,c4=({ref:e,operation:t,method:n,path:r,generateId:i,parentId:a,parentTag:o})=>{let s=i({type:`operation`,operation:t,parentTag:o,method:n,path:r,parentId:a}),c=t.summary?.trim()?t.summary:r,l=s4(t),u=K1t(t).map(e=>({type:`example`,id:i({type:`example`,parentId:s,name:e}),title:e,name:e}));return{id:s,title:c,path:r,method:n,ref:e,type:`operation`,isDeprecated:l,children:u.length?u:void 0}},Y1t=({document:e,tagsMap:t,generateId:n,documentId:r})=>{let i=[];return Object.entries(e.paths??{}).forEach(([e,a])=>{NI(a??{}).filter(e=>z2(e)).forEach(o=>{let s=a?.[o],c=RE(s,LE);if(!c||r4(c)||!z2(o))return;let l=`#/paths/${n4(e)}/${o}`;c.tags?.length?c.tags.forEach(i=>{let{tag:a,id:s}=a4({tagsMap:t,name:i,documentId:r,generateId:n});t.get(i)?.entries.push(c4({ref:l,operation:c,method:o,path:e,parentTag:{tag:a,id:s},generateId:n,parentId:s}))}):i.push(c4({ref:l,operation:c,method:o,path:e,generateId:n,parentId:r}))})}),{untaggedOperations:i}}})),l4,Z1t,Q1t=s((()=>{zE(),i4(),o4(),l4=({ref:e,name:t,generateId:n,parentTag:r,_schema:i,parentId:a})=>{let o=n({name:t,type:`model`,parentTag:r,parentId:a,schema:i}),s=RE(i);return{id:o,title:s&&`title`in s&&s.title||t,name:t,ref:e,type:`model`}},Z1t=({document:e,tagsMap:t,generateId:n,documentId:r})=>{let i=e.components?.schemas??{},a=[];for(let e in i){if(!Object.hasOwn(i,e))continue;let o=RE(i[e],LE);if(r4(o))continue;let s=`#/components/schemas/${e}`;o?.[`x-tags`]?o[`x-tags`].forEach(i=>{let{tag:a,id:o}=a4({tagsMap:t,name:i,documentId:r,generateId:n});t.get(i)?.entries.push(l4({ref:s,name:e,generateId:n,parentTag:{tag:a,id:o},parentId:r}))}):a.push(l4({ref:s,name:e,generateId:n,_schema:RE(i[e]),parentId:r}))}return a}}));function $1t(e,t,n){let r=new Map;t.forEach((e,t)=>r.set(e,t));let i=[],a=[];return e.forEach(e=>{let t=r.get(n(e));if(t===void 0){a.push(e);return}i[t]=e}),[...i.filter(e=>e!==void 0),...a]}var e0t=s((()=>{})),t0t,n0t=s((()=>{t0t=e=>e?Object.fromEntries(Object.entries(e).filter(([e])=>e.startsWith(`x-`))):{}})),u4,d4,r0t,i0t=s((()=>{e0t(),i4(),dD(),n0t(),o4(),u4=({tag:e,generateId:t,children:n,isGroup:r=!1,parentId:i})=>{let a=t({type:`tag`,tag:e,parentId:i,isGroup:r}),o=e[`x-displayName`]??e.name??`Untitled Tag`;return e[`x-scalar-order`]=n.map(e=>e.id),{id:a,title:o,name:e.name||o,description:e.description,children:n,isGroup:r,isWebhooks:!1,type:`tag`,xKeys:t0t(uD(e))}},d4=({_keys:e,tagsMap:t,options:{tagsSorter:n,operationsSorter:r,generateId:i},documentId:a,sortOrder:o})=>{let s=e.flatMap(e=>{let{tag:n,entries:o}=a4({tagsMap:t,name:e,documentId:a,generateId:i});if(r4(n))return[];let s=n[`x-scalar-order`];return s===void 0&&(r===`alpha`?o.sort((e,t)=>e.type===`operation`&&t.type===`operation`?e.title.localeCompare(t.title):0):r===`method`?o.sort((e,t)=>e.type===`operation`&&t.type===`operation`?e.method.localeCompare(t.method):0):typeof r==`function`&&o.sort((e,t)=>{if(!(e.type===`operation`||e.type===`webhook`)||!(t.type===`operation`||t.type===`webhook`))return 0;let n=e.type===`operation`?e.path:e.name,i=t.type===`operation`?t.path:t.name;return r({method:e.method,path:n,ref:e.ref,httpVerb:e.method},{method:t.method,path:i,ref:t.ref,httpVerb:t.method})})),u4({tag:n,generateId:i,children:s?$1t(o,s,e=>e.id):o,parentId:a,isGroup:!1})});return o?$1t(s,o,e=>e.id):(n===`alpha`?s.sort((e,n)=>{let r=a4({tagsMap:t,name:e.title,documentId:a,generateId:i}).tag[`x-displayName`]||e.title||`Untitled Tag`,o=a4({tagsMap:t,name:n.title,documentId:a,generateId:i}).tag[`x-displayName`]||n.title||`Untitled Tag`;return r.localeCompare(o)}):typeof n==`function`&&s.sort((e,r)=>n(a4({tagsMap:t,name:e.name,documentId:a,generateId:i}).tag,a4({tagsMap:t,name:r.name,documentId:a,generateId:i}).tag)),s)},r0t=({document:e,tagsMap:t,documentId:n,options:{generateId:r,tagsSorter:i,operationsSorter:a}})=>e[`x-tagGroups`]?e[`x-tagGroups`].flatMap(e=>{let o=d4({_keys:e.tags,tagsMap:t,options:{tagsSorter:i,operationsSorter:a,generateId:r},documentId:n,sortOrder:e[`x-scalar-order`]});return e[`x-scalar-order`]=o.map(e=>e.id),o.length?u4({tag:e,generateId:r,children:o,parentId:n,isGroup:!0}):[]}):d4({_keys:Array.from(t.keys()),tagsMap:t,options:{generateId:r,tagsSorter:i,operationsSorter:a},documentId:n,sortOrder:e[`x-scalar-order`]})})),f4,a0t,o0t=s((()=>{B2(),PI(),zE(),i4(),X1t(),o4(),f4=({ref:e,method:t,name:n,title:r,generateId:i,parentTag:a,webhook:o,isDeprecated:s,parentId:c})=>({id:i({type:`webhook`,name:n,method:t,webhook:o,parentTag:a,parentId:c}),title:r,name:n,ref:e,method:t,type:`webhook`,isDeprecated:s}),a0t=({document:e,tagsMap:t,generateId:n,untaggedWebhooksParentId:r,documentId:i})=>{let a=[];return Object.entries(e.webhooks??{}).forEach(([e,o])=>{NI(o??{}).filter(e=>z2(e)).forEach(s=>{let c=o?.[s],l=RE(c,LE);if(!l||r4(l))return;let u=`#/webhooks/${e}/${s}`;l.tags?.length?l.tags.forEach(r=>{let{tag:a,id:o}=a4({tagsMap:t,name:r,documentId:i,generateId:n});t.get(r)?.entries.push(f4({ref:u,method:s,name:e,title:l.summary??e,webhook:l,generateId:n,parentTag:{tag:a,id:o},parentId:o,isDeprecated:s4(l)}))}):a.push(f4({ref:u,method:s,name:e,title:l.summary??e,generateId:n,isDeprecated:s4(l),webhook:l,parentId:r}))})}),a}})),p4,s0t=s((()=>{dD(),Z2(),W1t(),X1t(),Q1t(),i0t(),o0t(),p4=(e,t,n)=>{let{hideModels:r,tagsSorter:i,operationsSorter:a,generateId:o}=X2(e,n),s=o({type:`document`,info:t.info,name:e}),c=new Map(t.tags?.map(e=>[e.name??`Untitled Tag`,{id:o({type:`tag`,tag:e,parentId:s}),parentId:s,tag:e,entries:[]}])??[]),l=U1t({generateId:o,parentId:s,info:t.info}),{untaggedOperations:u}=Y1t({document:t,tagsMap:c,generateId:o,documentId:s}),d=o({type:`webhook`,name:``,parentId:s}),f=a0t({document:t,generateId:o,tagsMap:c,untaggedWebhooksParentId:d,documentId:s}),p=r0t({document:t,tagsMap:c,documentId:s,options:{tagsSorter:i,operationsSorter:a,generateId:o}});if(l.push(...p),l.push(...u),f.length&&l.push({type:`tag`,id:d,title:`Webhooks`,name:`Webhooks`,children:f,isGroup:!1,isWebhooks:!0}),!r&&t.components?.schemas){let e=Z1t({documentId:s,document:t,generateId:o,tagsMap:c});e.length&&l.push({type:`models`,id:o({type:`model`,parentId:s}),title:`Models`,name:`Models`,children:e})}let m=t[`x-scalar-order`];return m&&l.sort((e,t)=>{let n=m.indexOf(e.id),r=m.indexOf(t.id);return(n===-1?1/0:n)-(r===-1?1/0:r)}),t[`x-scalar-order`]=uD(l.map(e=>e.id)),{id:s,type:`document`,title:t.info?.title?.trim()||`Untitled Document`,name:e,children:l,icon:t[`x-scalar-icon`]}}})),m4=s((()=>{O1t(),K2(),s0t()})),h4,c0t=s((()=>{D1t(),K2(),OI(),h4=({store:e,generateId:t,...n})=>{n.entries?.forEach(r=>{if(!T1t(r.parent))return;let i=E1t({store:e,entry:r.parent});if(!i||!(`x-scalar-order`in i))return;let a=i[`x-scalar-order`],o=a?.indexOf(r.id);if(!Array.isArray(a)||typeof o!=`number`||o<0)return;if(`tag`in n){let i=r.id,s=t({type:`tag`,parentId:r.parent.id,tag:n.tag});if(a[o]=s,i!==s){let t=G2(`document`,r),a=t?e.workspace.documents[t.name]:null,o=EI(a)?a.tags?.find(e=>e.name===n.tag.name):void 0,c=o?.[`x-scalar-order`];if(o&&Array.isArray(c)){let e=`${i}/`,t=`${s}/`;o[`x-scalar-order`]=c.map(n=>n.startsWith(e)?t+n.slice(e.length):n)}}return}let s=r.parent.type===`tag`&&`name`in i?{tag:i,id:r.parent.id}:void 0;a[o]=t({type:`operation`,path:n.path,method:n.method,operation:n.operation,parentId:r.parent.id,parentTag:s})})}})),l0t,u0t,d0t,f0t,p0t,m0t,h0t,g0t=s((()=>{B2(),PY(),H2(),zE(),dD(),w1t(),m4(),Z2(),c0t(),OI(),l0t=(e,t)=>{let n=e?.workspace.documents[t.documentName];if(!EI(n)){t.callback?.(!1);return}let{path:r,method:i,operation:a}=t,o=r.startsWith(`/`)?r:`/${r}`;n.paths||={},n.paths[o]||(n.paths[o]={}),NY(o),NY(i),n.paths[o][i]=a;let{servers:s}=a,c=uD(s?.[0]);for(let e of s??[])n.servers?.some(t=>t.url===e.url)||(n.servers||=[],n.servers.push(uD(e)));c&&(n[`x-scalar-selected-server`]=c.url);let l=a.parameters,u=W2(o,o,l??[],RE);return(l!==void 0||u.length>0)&&(a.parameters=u),t.callback?.(!0),o},u0t=(e,t,{meta:n,payload:r})=>{if(!e||!EI(t))return;let i=t[`x-scalar-navigation`]?.name;if(i===void 0)return;let a=RE(t.paths?.[n.path]?.[n.method]);if(!a){console.error(`Operation not found`,{meta:n,document:t});return}Object.assign(a,r),e.buildSidebar(i)},d0t=(e,t,{meta:n,payload:{method:r,path:i},blurTargetSelector:a,callback:o})=>{let s=n.method!==r,c=n.path!==i;if(!s&&!c){o(`no-change`,a);return}let l=s?r:n.method,u=c?i:n.path;if(!t||!EI(e)){console.error(`Document or workspace not found`,{document:e});return}if(e.paths?.[u]?.[l]){o(`conflict`,a);return}let d=e[`x-scalar-navigation`];if(!d){console.error(`Document navigation missing`,{document:e});return}let f=RE(e.paths?.[n.path]?.[n.method]);if(!f){console.error(`Operation not found`,{meta:n,document:e});return}if(c){let e=V2(n.path,{includePath:!0,includeEnv:!1}).filter(e=>e!==void 0),t=V2(u,{includePath:!0,includeEnv:!1}).filter(e=>e!==void 0);if(e.length>0||t.length>0){let e=f.parameters??[];f.parameters=W2(u,n.path,e,RE)}}let{generateId:p}=X2(d.name),m=q2(d).get(`${n.path}|${n.method}`);m&&h4({store:t,operation:f,generateId:p,method:l,path:u,entries:m}),e.paths||={},e.paths[u]||(e.paths[u]={}),NY(u),NY(n.path),NY(l),e.paths[u][l]=uD(f);let h=e.paths[n.path];h&&z2(n.method)&&(delete h[n.method],Object.keys(h).length===0&&delete e.paths[n.path]),t.history.clearOperationHistory(e[`x-scalar-navigation`]?.name??``,n.path,n.method),o(`success`,a)},f0t=(e,{meta:t,documentName:n})=>{let r=e?.workspace.documents[n];EI(r)&&(NY(t.path),NY(t.method),delete r.paths?.[t.path]?.[t.method],Object.keys(r.paths?.[t.path]??{}).length===0&&delete r.paths?.[t.path])},p0t=(e,{meta:{path:t,method:n},documentName:r,exampleName:i})=>{let a=e?.workspace.documents[r];if(!EI(a)){console.error(`Document not found`,{documentName:r});return}let o=RE(a.paths?.[t]?.[n]);if(!o){console.error(`Operation not found`,{path:t,method:n});return}o[`x-draft-examples`]??=[];let s=new Set(o[`x-draft-examples`]);s.add(i),o[`x-draft-examples`]=Array.from(s)},m0t=(e,{meta:{path:t,method:n,exampleKey:r},documentName:i})=>{let a=e?.workspace.documents[i];if(!EI(a))return;let o=RE(a.paths?.[t]?.[n]);if(!o)return;let s=new Set(o[`x-draft-examples`]??[]);s.delete(r),o[`x-draft-examples`]!==void 0&&(o[`x-draft-examples`]=Array.from(s)),o.parameters?.forEach(e=>{let t=RE(e);`content`in t&&t.content&&Object.values(t.content).forEach(e=>{delete e.examples?.[r]}),`examples`in t&&t.examples&&delete t.examples?.[r]});let c=RE(o.requestBody);c&&Object.values(c.content??{}).forEach(e=>{delete e.examples?.[r]})},h0t=(e,{meta:{path:t,method:n,exampleKey:r},documentName:i,payload:a})=>{let o=e?.workspace.documents[i];if(!EI(o))return;let s=RE(o.paths?.[t]?.[n]);if(!s)return;let c=a.name.trim();if(!c||c===r)return;NY(c);let l=[];s.parameters?.forEach(e=>{let t=RE(e);`examples`in t&&t.examples&&l.push(t.examples),`content`in t&&t.content&&Object.values(t.content).forEach(e=>{e.examples&&l.push(e.examples)})});let u=RE(s.requestBody);u&&(Object.values(u.content??{}).forEach(e=>{e.examples&&l.push(e.examples)}),u[`x-scalar-selected-content-type`]&&l.push(u[`x-scalar-selected-content-type`])),!(s[`x-draft-examples`]?.includes(c)||l.some(e=>Object.hasOwn(e,c)))&&(s[`x-draft-examples`]&&=s[`x-draft-examples`].map(e=>e===r?c:e),l.forEach(e=>{Object.hasOwn(e,r)&&(e[c]=uD(e[r]),delete e[r])}))}})),_0t,v0t,y0t,b0t,x0t=s((()=>{zE(),dD(),OI(),_0t=(e,{meta:t,type:n,payload:r,originalParameter:i})=>{if(i){let e=i;e.name=r.name,e.examples||={},e.examples[t.exampleKey]||(e.examples[t.exampleKey]={});let n=RE(e.examples[t.exampleKey]);n.value=r.value,n[`x-disabled`]=r.isDisabled;return}if(!EI(e))return;let a=RE(e.paths?.[t.path]?.[t.method]);if(!a){console.error(`Operation not found`,{meta:t,document:e});return}a.parameters||=[],a.parameters.push({name:r.name,in:n,required:n===`path`,examples:{[t.exampleKey]:{value:r.value,"x-disabled":!1}}})},v0t=(e,{type:t,meta:n,payload:r,in:i})=>{if(!EI(e))return;let a=RE(e.paths?.[n.path]?.[n.method]);if(!a)return;a[`x-scalar-disable-parameters`]||={};let o={global:{cookie:`global-cookies`},default:{header:`default-headers`}}[t]?.[i];o&&(a[`x-scalar-disable-parameters`][o]||(a[`x-scalar-disable-parameters`][o]={}),a[`x-scalar-disable-parameters`][o][n.exampleKey]={...a[`x-scalar-disable-parameters`][o][n.exampleKey]??{},[n.name]:r.isDisabled??!1})},y0t=(e,{meta:t,originalParameter:n})=>{if(!EI(e))return;let r=RE(e.paths?.[t.path]?.[t.method]),i=r?.parameters?.findIndex(e=>RE(e)===n)??-1;if(r&&i>=0){r.parameters=uD(r.parameters?.filter((e,t)=>t!==i),{depth:1});return}let a=RE(e.paths?.[t.path]),o=a?.parameters?.findIndex(e=>RE(e)===n)??-1;a&&o>=0&&(a.parameters=uD(a.parameters?.filter((e,t)=>t!==o),{depth:1}))},b0t=(e,{meta:t,type:n})=>{if(!EI(e))return;let r=RE(e.paths?.[t.path]?.[t.method]);r&&(r.parameters=r.parameters?.filter(e=>RE(e).in!==n)??[])}})),S0t,C0t=s((()=>{e1t(),n1t(),S1t(),g0t(),x0t(),S0t=({document:e,store:t})=>({createOperation:e=>l0t(t,e),updateOperationMeta:n=>u0t(t,e,n),updateOperationPathMethod:n=>d0t(e,t,n),deleteOperation:e=>f0t(t,e),createOperationDraftExample:e=>p0t(t,e),deleteOperationExample:e=>m0t(t,e),renameOperationExample:e=>h0t(t,e),updateOperationExtension:t=>t1t(e,t),updateOperationExtraParameters:t=>v0t(e,t),upsertOperationParameter:t=>_0t(e,t),deleteOperationParameter:t=>y0t(e,t),deleteAllOperationParameters:t=>b0t(e,t),updateOperationRequestBodyContentType:t=>Z$t(e,t),updateOperationRequestBodyExample:t=>Q$t(e,t),updateOperationRequestBodyFormValue:t=>$$t(e,t),addResponseToHistory:n=>b1t(t,e,n),reloadOperationHistory:n=>x1t(t,e,n)})})),g4,w0t,T0t,_4,E0t,D0t,O0t,k0t,A0t,j0t,M0t,N0t=s((()=>{H2(),zE(),dD(),OI(),oN(),VP(),g4=(e,t)=>EI(e)?t.type===`document`?e:RE(e.paths?.[t.path]?.[t.method])??null:null,w0t=(e,{meta:t})=>{let n=g4(e,t);if(!n){console.error(`Target not found`,t);return}return n.servers=[],n.servers},T0t=(e,{url:t,select:n,meta:r})=>{let i=g4(e,r);if(!i){console.error(`Target not found`,r);return}let a=aN(BP,{url:t});return i.servers||=[],i.servers.push(a),n&&(i[`x-scalar-selected-server`]=a.url),a},_4=(e,t)=>{let n={};for(let r of t){let t=e.indexOf(`{${r}}`);t!==-1&&(n[r]=t)}return n},E0t=(e,t,n)=>{let r=V2(t,{includePath:!0,includeEnv:!1}).filter(e=>e!==void 0),i=V2(e,{includePath:!0,includeEnv:!1}).filter(e=>e!==void 0),a=_4(t,r),o=_4(e,i),s=new Set,c={};for(let e of i){if(n[e]){c[e]=n[e],s.add(e);continue}let t=o[e],i=r.find(e=>a[e]===t&&!s.has(e));if(i&&n[i]){c[e]=n[i],s.add(i);continue}c[e]={default:``}}return c},D0t=(e,{index:t,server:n,meta:r})=>{let i=g4(e,r);if(!i)return;let a=uD(i.servers?.[t],{depth:1});if(!a){console.error(`Server not found at index:`,t);return}let o=a.url,s=aN(BP,{...a,...n});if(o&&o!==s.url){let e=s.variables??{};s.variables=E0t(s.url,o,e),i[`x-scalar-selected-server`]===o&&(i[`x-scalar-selected-server`]=s.url)}return i.servers?i.servers[t]=s:i.servers=[s],s},O0t=(e,{index:t,meta:n})=>{let r=g4(e,n);if(!r?.servers)return;let i=r.servers[t]?.url;r.servers.splice(t,1),r[`x-scalar-selected-server`]===i&&(r[`x-scalar-selected-server`]=r.servers[0]?.url??void 0)},k0t=(e,{meta:t})=>{let n=g4(e,t);n&&(n.servers=void 0,n[`x-scalar-selected-server`]=void 0)},A0t=(e,{index:t,key:n,value:r,meta:i})=>{let a=g4(e,i)?.servers?.[t]?.variables?.[n];if(!a){console.error(`Variable not found`,n,t);return}return a.default=r,a},j0t=(e,{url:t,meta:n})=>{let r=g4(e,n);if(r)return t===``?(r[`x-scalar-selected-server`]=``,``):(r[`x-scalar-selected-server`]=r[`x-scalar-selected-server`]===t?``:t,r[`x-scalar-selected-server`])},M0t=({document:e})=>({initializeServers:t=>w0t(e,t),addServer:t=>T0t(e,t),updateServer:t=>D0t(e,t),deleteServer:t=>O0t(e,t),clearServers:t=>k0t(e,t),updateServerVariables:t=>A0t(e,t),updateSelectedServer:t=>j0t(e,t)})})),P0t,v4,y4,b4,F0t,I0t,L0t,R0t,z0t,B0t,V0t,H0t,U0t,W0t=s((()=>{dD(),P0t=1,v4=e=>e!==null&&e[`x-scalar-tabs`]!==void 0,y4=e=>uD(e[`x-scalar-tabs`],{depth:P0t}),b4=e=>e[`x-scalar-active-tab`]??0,F0t=(e,t)=>{e&&(t[`x-scalar-tabs`]&&(e[`x-scalar-tabs`]=t[`x-scalar-tabs`]),t[`x-scalar-active-tab`]!==void 0&&(e[`x-scalar-active-tab`]=t[`x-scalar-active-tab`]))},I0t=(e,t)=>{if(!v4(e))return!1;let n=y4(e),r=n[b4(e)];if(!r)return!1;let i=[...n,{...r}];return e[`x-scalar-tabs`]=i,e[`x-scalar-active-tab`]=i.length-1,!0},L0t=(e,t)=>{let n=()=>`event`in t?t.event.code.startsWith(`Digit`)?Number.parseInt(t.event.key,10)-1:NaN:t.index;if(!v4(e))return!1;let r=n(),i=b4(e),a=y4(e).filter((e,t)=>t!==r);return a.length<=0?!1:(e[`x-scalar-tabs`]=a,e[`x-scalar-active-tab`]=r<i?i-1:Math.min(i,a.length-1),!0)},R0t=(e,t)=>{if(!v4(e))return!1;let n=y4(e);return n.length<=1?!1:(e[`x-scalar-tabs`]=n.filter((e,n)=>n===t.index),e[`x-scalar-active-tab`]=0,!0)},z0t=(e,t)=>{if(!v4(e))return!1;let n=b4(e);return n<=0?!1:(e[`x-scalar-active-tab`]=n-1,!0)},B0t=(e,t)=>{if(!v4(e))return!1;let n=y4(e),r=b4(e);return r>=n.length-1?!1:(e[`x-scalar-active-tab`]=r+1,!0)},V0t=(e,t)=>{if(!v4(e))return!1;let n=()=>`event`in t?t.event.code.startsWith(`Digit`)?Number.parseInt(t.event.key,10)-1:NaN:t.index,r=y4(e),i=n();return Number.isNaN(i)||i<0||i>=r.length?!1:(e[`x-scalar-active-tab`]=i,!0)},H0t=(e,t)=>{if(!v4(e))return!1;let n=y4(e);return n.length<=1?!1:(e[`x-scalar-active-tab`]=n.length-1,!0)},U0t=({workspace:e})=>({updateTabs:t=>F0t(e,t),addTab:t=>I0t(e,t),closeTab:t=>L0t(e,t),closeOtherTabs:t=>R0t(e,t),navigatePreviousTab:t=>z0t(e,t),navigateNextTab:t=>B0t(e,t),focusTab:t=>V0t(e,t),focusLastTab:t=>H0t(e,t)})})),G0t,K0t,q0t,J0t,Y0t=s((()=>{zE(),dD(),Z2(),A1t(),c0t(),OI(),G0t=(e,t)=>{let n=e?.workspace.documents[t.documentName];if(!EI(n)){console.error(`Document not found`,{payload:t,store:e});return}n.tags||=[],n.tags.push({name:t.name})},K0t=(e,t)=>{let n=e?.workspace.documents[t.documentName];if(!e||!EI(n)){console.error(`Document not found`,{payload:t,store:e});return}let r=n[`x-scalar-navigation`];if(!r){console.error(`Document navigation missing`,{payload:t,store:e});return}let i=t.tag.name,a=t.newName;n.tags?.length&&(n.tags=n.tags.map(e=>{let t=uD(e);return t.name===i?{...t,name:a}:t})),t.tag.children?.forEach(e=>{if(e.type===`operation`){let t=RE(n.paths?.[e.path]?.[e.method]);t&&`tags`in t&&(t.tags=uD(t.tags,{depth:null})?.map(e=>e===i?a:e))}else if(e.type===`webhook`){let t=RE(n.webhooks?.[e.name]?.[e.method]);t&&`tags`in t&&(t.tags=uD(t.tags,{depth:null})?.map(e=>e===i?a:e))}}),n[`x-tagGroups`]&&=uD(n[`x-tagGroups`],{depth:null}).map(e=>({...e,tags:e.tags.map(e=>e===i?a:e)}));let{generateId:o}=X2(r.name),s=k1t(r).get(i);s&&h4({store:e,tag:{name:a},generateId:o,entries:s})},q0t=(e,t)=>{let n=e?.workspace.documents[t.documentName];EI(n)&&(Object.values(n.paths??{}).forEach(e=>{Object.values(e).forEach(e=>{if(typeof e!=`object`||Array.isArray(e))return;let n=RE(e);`tags`in n&&(n.tags=uD(n.tags,{depth:1})?.filter(e=>e!==t.name))})}),Object.values(n.webhooks??{}).forEach(e=>{Object.values(e).forEach(e=>{if(typeof e!=`object`||Array.isArray(e))return;let n=RE(e);n.tags=uD(n.tags,{depth:1})?.filter(e=>e!==t.name)})}),n.tags=uD(n.tags,{depth:null})?.filter(e=>e.name!==t.name))},J0t=({store:e})=>({createTag:t=>G0t(e,t),editTag:t=>K0t(e,t),deleteTag:t=>q0t(e,t)})})),X0t,Z0t,Q0t,$0t,e2t,t2t,n2t=s((()=>{X0t=(e,t)=>{e&&(e[`x-scalar-active-proxy`]=t)},Z0t=(e,t)=>{e&&(e[`x-scalar-color-mode`]=t)},Q0t=(e,t)=>{e&&(e[`x-scalar-theme`]=t)},$0t=(e,t)=>{e&&(e[`x-scalar-active-environment`]=t??void 0)},e2t=(e,t)=>{e&&(e[`x-scalar-default-client`]=t)},t2t=({workspace:e})=>({updateActiveProxy:t=>X0t(e,t),updateColorMode:t=>Z0t(e,t),updateTheme:t=>Q0t(e,t),updateSelectedClient:t=>e2t(e,t),updateActiveEnvironment:t=>$0t(e,t)})}));function r2t(e){let t=t=>({auth:j$t({store:e,document:t}),cookie:F2({collection:t}),document:H$t({document:t,store:e}),operation:S0t({document:t,store:e}),server:M0t({document:t}),tag:J0t({store:e}),environment:I2({workspace:e?.workspace??null,collection:t})}),n=()=>({cookie:F2({collection:e?.workspace??null}),tabs:U0t({workspace:e?.workspace??null}),workspace:t2t({workspace:e?.workspace??null}),environment:I2({workspace:e?.workspace??null,collection:e?.workspace??null})});return{workspace:()=>n(),active:()=>t(e?.workspace.activeDocument??null),doc:n=>t(Y$t(e,n))}}var i2t=s((()=>{M$t(),F$t(),U$t(),J$t(),X$t(),C0t(),N0t(),W0t(),Y0t(),n2t()}));function a2t({eventBus:e,store:t,hooks:n}){let r=U(()=>r2t(t.value)),i=({collectionType:e})=>e===`document`?r.value.active():r.value.workspace();e.on(`workspace:update:active-proxy`,e=>x4(`workspace:update:active-proxy`,r.value.workspace().workspace.updateActiveProxy,n)(e)),e.on(`workspace:update:color-mode`,e=>x4(`workspace:update:color-mode`,r.value.workspace().workspace.updateColorMode,n)(e)),e.on(`workspace:update:theme`,e=>x4(`workspace:update:theme`,r.value.workspace().workspace.updateTheme,n)(e)),e.on(`workspace:update:selected-client`,e=>x4(`workspace:update:selected-client`,r.value.workspace().workspace.updateSelectedClient,n)(e)),e.on(`workspace:update:active-environment`,e=>x4(`workspace:update:active-environment`,r.value.workspace().workspace.updateActiveEnvironment,n)(e)),e.on(`document:update:extension`,e=>x4(`document:update:extension`,r.value.active().document.updateDocumentExtension,n)(e)),e.on(`document:update:icon`,e=>x4(`document:update:icon`,r.value.active().document.updateDocumentIcon,n)(e)),e.on(`document:update:info`,e=>x4(`document:update:info`,r.value.active().document.updateDocumentInfo,n)(e)),e.on(`document:update:watch-mode`,e=>x4(`document:update:watch-mode`,r.value.active().document.updateWatchMode,n)(e)),e.on(`document:create:empty-document`,e=>x4(`document:create:empty-document`,r.value.active().document.createEmptyDocument,n)(e)),e.on(`document:delete:document`,e=>x4(`document:delete:document`,r.value.active().document.deleteDocument,n)(e)),e.on(`environment:upsert:environment`,e=>x4(`environment:upsert:environment`,i(e).environment.upsertEnvironment,n)(e)),e.on(`environment:delete:environment`,e=>x4(`environment:delete:environment`,i(e).environment.deleteEnvironment,n)(e)),e.on(`environment:upsert:environment-variable`,e=>x4(`environment:upsert:environment-variable`,i(e).environment.upsertEnvironmentVariable,n)(e)),e.on(`environment:delete:environment-variable`,e=>x4(`environment:delete:environment-variable`,i(e).environment.deleteEnvironmentVariable,n)(e)),e.on(`cookie:upsert:cookie`,async e=>{await x4(`cookie:upsert:cookie`,i(e).cookie.upsertCookie,n)(e)}),e.on(`cookie:delete:cookie`,async e=>{await x4(`cookie:delete:cookie`,i(e).cookie.deleteCookie,n)(e)}),e.on(`auth:delete:security-scheme`,e=>x4(`auth:delete:security-scheme`,r.value.active().auth.deleteSecurityScheme,n)(e)),e.on(`auth:update:active-index`,e=>x4(`auth:update:active-index`,r.value.active().auth.updateSelectedAuthTab,n)(e)),e.on(`auth:update:security-scheme`,e=>x4(`auth:update:security-scheme`,r.value.active().auth.updateSecurityScheme,n)(e)),e.on(`auth:update:selected-scopes`,e=>x4(`auth:update:selected-scopes`,r.value.active().auth.updateSelectedScopes,n)(e)),e.on(`auth:upsert:scopes`,e=>x4(`auth:upsert:scopes`,r.value.active().auth.upsertScope,n)(e)),e.on(`auth:delete:scopes`,e=>x4(`auth:delete:scopes`,r.value.active().auth.deleteScope,n)(e)),e.on(`auth:update:selected-security-schemes`,e=>x4(`auth:update:selected-security-schemes`,r.value.active().auth.updateSelectedSecuritySchemes,n)(e)),e.on(`auth:clear:selected-security-schemes`,e=>x4(`auth:clear:selected-security-schemes`,r.value.active().auth.clearSelectedSecuritySchemes,n)(e)),e.on(`auth:update:security-scheme-secrets`,e=>x4(`auth:update:security-scheme-secrets`,r.value.active().auth.updateSecuritySchemeSecrets,n)(e)),e.on(`auth:clear:security-scheme-secrets`,e=>x4(`auth:clear:security-scheme-secrets`,r.value.active().auth.clearSecuritySchemeSecrets,n)(e)),e.on(`server:initialize:servers`,e=>x4(`server:initialize:servers`,r.value.active().server.initializeServers,n)(e)),e.on(`server:add:server`,e=>x4(`server:add:server`,r.value.active().server.addServer,n)(e)),e.on(`server:update:server`,e=>x4(`server:update:server`,r.value.active().server.updateServer,n)(e)),e.on(`server:delete:server`,e=>x4(`server:delete:server`,r.value.active().server.deleteServer,n)(e)),e.on(`server:clear:servers`,e=>x4(`server:clear:servers`,r.value.active().server.clearServers,n)(e)),e.on(`server:update:variables`,e=>x4(`server:update:variables`,r.value.active().server.updateServerVariables,n)(e)),e.on(`server:update:selected`,e=>x4(`server:update:selected`,r.value.active().server.updateSelectedServer,n)(e)),e.on(`operation:create:operation`,e=>x4(`operation:create:operation`,r.value.active().operation.createOperation,n)(e)),e.on(`operation:update:pathMethod`,e=>x4(`operation:update:pathMethod`,r.value.active().operation.updateOperationPathMethod,n)(e)),e.on(`operation:update:meta`,e=>x4(`operation:update:meta`,r.value.active().operation.updateOperationMeta,n)(e)),e.on(`operation:delete:operation`,e=>x4(`operation:delete:operation`,r.value.active().operation.deleteOperation,n)(e)),e.on(`operation:create:draft-example`,e=>x4(`operation:create:draft-example`,r.value.active().operation.createOperationDraftExample,n)(e)),e.on(`operation:delete:example`,e=>x4(`operation:delete:example`,r.value.active().operation.deleteOperationExample,n)(e)),e.on(`operation:rename:example`,e=>x4(`operation:rename:example`,r.value.active().operation.renameOperationExample,n)(e)),e.on(`operation:upsert:parameter`,e=>x4(`operation:upsert:parameter`,r.value.active().operation.upsertOperationParameter,n)(e)),e.on(`operation:update:extra-parameters`,e=>x4(`operation:update:extra-parameters`,r.value.active().operation.updateOperationExtraParameters,n)(e)),e.on(`operation:delete:parameter`,e=>x4(`operation:delete:parameter`,r.value.active().operation.deleteOperationParameter,n)(e)),e.on(`operation:delete-all:parameters`,e=>x4(`operation:delete-all:parameters`,r.value.active().operation.deleteAllOperationParameters,n)(e)),e.on(`operation:update:extension`,e=>x4(`operation:update:extension`,r.value.active().operation.updateOperationExtension,n)(e)),e.on(`operation:update:requestBody:contentType`,e=>x4(`operation:update:requestBody:contentType`,r.value.active().operation.updateOperationRequestBodyContentType,n)(e)),e.on(`operation:update:requestBody:value`,e=>x4(`operation:update:requestBody:value`,r.value.active().operation.updateOperationRequestBodyExample,n)(e)),e.on(`operation:update:requestBody:formValue`,e=>x4(`operation:update:requestBody:formValue`,r.value.active().operation.updateOperationRequestBodyFormValue,n)(e)),e.on(`operation:reload:history`,e=>x4(`operation:reload:history`,r.value.active().operation.reloadOperationHistory,n)(e)),e.on(`tag:create:tag`,e=>x4(`tag:create:tag`,r.value.active().tag.createTag,n)(e)),e.on(`tag:edit:tag`,e=>x4(`tag:edit:tag`,r.value.active().tag.editTag,n)(e)),e.on(`tag:delete:tag`,e=>x4(`tag:delete:tag`,r.value.active().tag.deleteTag,n)(e)),e.on(`tabs:add:tab`,e=>x4(`tabs:add:tab`,r.value.workspace().tabs.addTab,n)(e)),e.on(`tabs:close:tab`,e=>x4(`tabs:close:tab`,r.value.workspace().tabs.closeTab,n)(e)),e.on(`tabs:close:other-tabs`,e=>x4(`tabs:close:other-tabs`,r.value.workspace().tabs.closeOtherTabs,n)(e)),e.on(`tabs:focus:tab`,e=>x4(`tabs:focus:tab`,r.value.workspace().tabs.focusTab,n)(e)),e.on(`tabs:focus:tab-last`,e=>x4(`tabs:focus:tab-last`,r.value.workspace().tabs.focusLastTab,n)(e)),e.on(`tabs:navigate:previous`,e=>x4(`tabs:navigate:previous`,r.value.workspace().tabs.navigatePreviousTab,n)(e)),e.on(`tabs:navigate:next`,e=>x4(`tabs:navigate:next`,r.value.workspace().tabs.navigateNextTab,n)(e)),e.on(`tabs:update:tabs`,e=>x4(`tabs:update:tabs`,r.value.workspace().tabs.updateTabs,n)(e)),e.on(`hooks:on:request:complete`,e=>x4(`hooks:on:request:complete`,r.value.active().operation.addResponseToHistory,n)(e))}var x4,o2t=s((()=>{W(),i2t(),x4=(e,t,n)=>async r=>{let i=await n[e]?.onBeforeExecute?.(r)??r;return await t(i),await n[e]?.onAfterExecute?.(i),i}}));function s2t({eventBus:e,isSidebarOpen:t,requestBodyCompositionSelection:n,sidebarState:r,modalState:i,store:a}){a2t({eventBus:e,store:A(a),hooks:{}}),e.on(`scroll-to:nav-item`,({id:e})=>r.handleSelectItem(e)),e.on(`ui:toggle:sidebar`,()=>t.value=!t.value),e.on(`ui:close:client-modal`,()=>i.hide()),e.on(`ui:open:client-modal`,e=>{if(n.value=e&&`requestBodyCompositionSelection`in e&&e.requestBodyCompositionSelection?e.requestBodyCompositionSelection:c2t,!e){i.show();return}if(`id`in e&&e.id){let t=e.id;if(`exampleName`in e&&e.exampleName){let n=r.state.getEntryById(e.id);if(n&&`children`in n&&n.children){let r=n.children.find(t=>t.type===`example`&&t.name===e.exampleName);r&&(t=r.id)}}r.handleSelectItem(t)}else if(`method`in e&&`path`in e){let t=a.workspace.activeDocument;r.handleSelectItem(r.getEntryByLocation({document:EI(t)?t[`x-scalar-navigation`]?.id??``:``,path:e.path,method:e.method,example:e.exampleName})?.id??``)}i.show()})}var c2t,l2t=s((()=>{o2t(),W(),OI(),c2t={}})),S4,u2t=s((()=>{tL(),PI(),S4=e=>{if(e===!0)return[];if(!e||Array.isArray(e)&&e.length===0)return eL;let t=new Set(eL);if(Array.isArray(e))for(let n of e){let e=$I[n];if(e)for(let r of e)t.delete(`${n}/${r}`);else if(n.includes(`/`))t.delete(n);else for(let e of NI($I))t.delete(`${e}/${n}`)}else if(typeof e==`object`){for(let[n,r]of Object.entries(e))if(r===!0){let e=$I[n];if(e)for(let r of e)t.delete(`${n}/${r}`)}else if(Array.isArray(r))for(let e of r)t.delete(e),t.delete(`${n}/${e}`)}return Array.from(t)}})),d2t,C4,f2t,p2t,m2t,h2t,g2t,_2t=s((()=>{OI(),B2(),m4(),d2t=e=>e.type===`example`,C4=e=>{let t=e.store.workspace.documents[e.documentSlug??``];return EI(t)?t:void 0},f2t=(e,t)=>{if(t!==`default`||e.workspace.documents[t]!==void 0)return t;let n=e.workspace[`x-scalar-active-document`];return n&&EI(e.workspace.documents[n])?n:Object.entries(e.workspace.documents).find(([,e])=>EI(e))?.[0]},p2t=(e,t)=>{let n=C4(e);if(n)return t===`default`?Object.keys(n.paths??{})[0]:t},m2t=(e,t,n)=>{let r=C4(e);if(!(!r||!t))return n===`default`?Object.keys(r.paths?.[t]??{}).find(z2):z2(n)?n:void 0},h2t=(e,t,n)=>{if(!C4(e)||t?.type!==`operation`)return`default`;let r=t.children?.filter(d2t)??[],i=r.find(e=>e.name===n);return i?i.name:n===`default`?r[0]?.name??`default`:`default`},g2t=(e,t)=>{let n=f2t(e,t.documentSlug),r={store:e,documentSlug:n},i=p2t(r,t.path),a=m2t(r,i,t.method),o=C4(r)?.[`x-scalar-navigation`];if(!o)return{documentSlug:n,path:i,method:a,example:`default`};let s=q2(o).get(`${i}|${a}`)?.find(e=>e.type===`operation`);return{documentSlug:n,path:i,method:a,example:h2t(r,s,t.example)}}})),w4,v2t=s((()=>{ME(),w4=({document:e,path:t,method:n,example:r})=>JSON.stringify([e,t,n,r].filter(jE))})),T4,E4,D4=s((()=>{B2(),T4=`get`,E4=e=>{if(typeof e!=`string`)return console.warn(`Request method is not a string. Using ${T4} as the default.`),T4;let t=e.trim().toLowerCase();return z2(t)?t:(console.warn(`${e||`Request method`} is not a valid request method. Using ${T4} as the default.`),T4)}})),y2t,b2t=s((()=>{W(),T2(),D4(),y2t=N({__name:`HttpMethod`,props:{as:{},property:{},short:{type:Boolean},method:{}},setup(e){let t=e,n=U(()=>w2(String(t.method||``))),r=U(()=>E4(t.method));return(t,i)=>(F(),L(kr(e.as??`span`),{class:`uppercase`,style:it({[e.property||`color`]:n.value.colorVar})},{default:M(()=>[P(t.$slots,`default`),z(` `+k(e.short?n.value.short:r.value),1)]),_:3},8,[`style`]))}})})),O4,x2t=s((()=>{b2t(),O4=y2t})),S2t,k4,C2t=s((()=>{S2t=new Set([`document`,`operation`,`example`,`tag`]),k4=(e,t,n)=>n&&t.length===1&&t[0]?.type===`example`&&t[0]?.name===`default`?[]:e===`reference`?t:t.filter(e=>S2t.has(e.type))}));function w2t(e){let{ceiling:t=.8,floor:n=.2,isDraggable:r=!0,isDroppable:i=!0,parentIds:a=[],id:o,onDragStart:s,onDragEnd:c}=e,l=U(()=>a.at(-1)??null),u=e=>typeof i==`function`?i(A4.value,{id:o,parentId:l.value,offset:e}):Cn(i),d=e=>{if(!Cn(r)||!e.dataTransfer||!(e.target instanceof HTMLElement))return;e.target.setAttribute(`data-dragging`,`true`),e.dataTransfer.dropEffect=`move`,e.dataTransfer.effectAllowed=`move`;let t={id:o,parentId:l.value};A4.value=t,s?.(t)},f=T2t(e=>{if(!A4.value||A4.value.id===o||a.includes(A4.value?.id??``))return;let r=j4.value?.offset,i=e.target.offsetHeight,s=n*i,c=t*i,d=null;e.offsetY<=0&&r&&r!==`after`?d=r:e.offsetY<=s?d=`before`:e.offsetY>=c?d=`after`:e.offsetY>s&&e.offsetY<c&&(d=`into`),u(d)&&(j4.value={id:o,parentId:l.value,offset:d})},25),p=()=>{if(!j4.value||!A4.value)return;let e={...A4.value},t={...j4.value};A4.value=null,j4.value=null,document.querySelectorAll(`[data-dragging]`).forEach(e=>e.removeAttribute(`data-dragging`)),e.id!==t.id&&c?.(e,t)},m=U(()=>{let e=o===j4.value?.id?j4.value.offset:void 0;return e?E2t({position:e}):``});return{draggableAttrs:U(()=>({class:m.value||void 0,draggable:Cn(r)?!0:void 0})),draggableEvents:{dragend:p,dragover:e=>{e.preventDefault(),e.stopPropagation(),f(e)},dragstart:e=>{e.stopPropagation(),d(e)}},draggingItem:A4,hoveredItem:j4}}var T2t,E2t,A4,j4,D2t=s((()=>{W(),lf(),T2t=(e,t)=>{let n=!1;return(...r)=>{n||(e(...r),n=!0,setTimeout(()=>n=!1,t))}},E2t=of({base:`relative after:absolute after:inset-x-0 after:block after:bg-blue after:opacity-15 after:pointer-events-none after:rounded`,variants:{position:{before:`after:-top-0.5 after:h-0.75`,after:`after:-bottom-0.5 after:h-0.75`,into:`after:inset-0`}}}),A4=A(null),j4=A(null)})),M4,O2t=s((()=>{M4=(e,t)=>{let n=e.__vccOpts||e;for(let[e,r]of t)n[e]=r;return n}})),k2t,A2t=s((()=>{x2t(),W(),T2(),Ou(),k2t=N({__name:`SidebarHttpBadge`,props:{method:{},active:{type:Boolean},webhook:{type:Boolean}},setup(e){return(t,n)=>(F(),L(O4,{class:O([`sidebar-heading-type`,`sidebar-heading-type--${e.method.toLowerCase()}`,{"sidebar-heading-type-active":e.active}]),method:e.method,property:`--method-color`,short:``},{default:M(()=>[n[0]||=R(`span`,{class:`sr-only`},`HTTP Method:\xA0`,-1),P(t.$slots,`default`,{},()=>[e.webhook?(F(),L(j(Eu),{key:0,style:it({color:j(w2)(e.method).colorVar}),weight:`bold`},null,8,[`style`])):B(``,!0)],!0)]),_:3},8,[`class`,`method`]))}})})),N4,j2t=s((()=>{O2t(),A2t(),N4=M4(k2t,[[`__scopeId`,`data-v-1857170e`]])}));function M2t(e,t){return F(),I(`div`,P2t,[P(e.$slots,`default`)])}var N2t,P2t,P4,F2t=s((()=>{O2t(),W(),N2t={},P2t={class:`absolute top-[1lh] right-0.75 flex -translate-y-1/2 opacity-0 peer-hover/button:opacity-100 peer-focus-visible/button:opacity-100 focus-within:opacity-100 hover:opacity-100 has-[&[aria-expanded=true]]:opacity-100`},P4=M4(N2t,[[`render`,M2t]])})),F4,I2t=s((()=>{F4=e=>`children`in e&&Array.isArray(e.children)&&e.children.length>0})),L2t,R2t=s((()=>{I2t(),L2t=(e,t,n,r)=>F4(t)?r&&t.type===`operation`&&t.children?.length===1&&t.children[0]?.type===`example`&&t.children[0]?.name===`default`?!1:e===`client`?!0:e===`reference`?t.type!==`operation`&&t.type!==`webhook`:!1:e===`client`&&n?t.type===`document`||t.type===`tag`:!1})),z2t,B2t=s((()=>{W(),kE(),z2t=N({__name:`SidebarItemLabel`,props:{item:{},operationTitleSource:{}},setup(e){return(t,n)=>e.item.type===`model`||e.item.type===`example`?(F(),L(j(wE),{key:0,preset:`property`,text:e.item.title},null,8,[`text`])):(F(),L(j(wE),{key:1,text:e.operationTitleSource===`path`&&`path`in e.item?e.item.path:e.item.title},null,8,[`text`]))}})})),I4,V2t=s((()=>{B2t(),I4=z2t})),H2t=l({default:()=>G2t,render:()=>U2t});function U2t(e,t){return F(),I(`svg`,W2t,[...t[0]||=[R(`path`,{d:`m246 98.73-56-64a8 8 0 0 0-6-2.73H72a8 8 0 0 0-6 2.73l-56 64a8 8 0 0 0 .17 10.73l112 120a8 8 0 0 0 11.7 0l112-120a8 8 0 0 0 .13-10.73M222.37 96H180l-36-48h36.37ZM74.58 112l30.13 75.33L34.41 112Zm89.6 0L128 202.46 91.82 112ZM96 96l32-42.67L160 96Zm85.42 16h40.17l-70.3 75.33ZM75.63 48H112L76 96H33.63Z`},null,-1)]])}var W2t,G2t,K2t=s((()=>{W(),W2t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},G2t={render:U2t}})),q2t=l({default:()=>X2t,render:()=>J2t});function J2t(e,t){return F(),I(`svg`,Y2t,[...t[0]||=[R(`path`,{d:`m223.68 66.15-88-48.15a15.88 15.88 0 0 0-15.36 0l-88 48.17a16 16 0 0 0-8.32 14v95.64a16 16 0 0 0 8.32 14l88 48.17a15.88 15.88 0 0 0 15.36 0l88-48.17a16 16 0 0 0 8.32-14V80.18a16 16 0 0 0-8.32-14.03M216 175.82 128 224l-88-48.18V80.18L128 32l88 48.17Z`},null,-1)]])}var Y2t,X2t,Z2t=s((()=>{W(),Y2t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},X2t={render:J2t}})),Q2t=l({default:()=>t4t,render:()=>$2t});function $2t(e,t){return F(),I(`svg`,e4t,[...t[0]||=[R(`path`,{d:`M128 24a104 104 0 1 0 104 104A104.11 104.11 0 0 0 128 24m0 192a88 88 0 1 1 88-88 88.1 88.1 0 0 1-88 88`},null,-1)]])}var e4t,t4t,n4t=s((()=>{W(),e4t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},t4t={render:$2t}})),r4t=l({default:()=>o4t,render:()=>i4t});function i4t(e,t){return F(),I(`svg`,a4t,[...t[0]||=[R(`path`,{d:`M208 96a16 16 0 0 0 16-16V48a16 16 0 0 0-16-16h-32a16 16 0 0 0-16 16v8H96v-8a16 16 0 0 0-16-16H48a16 16 0 0 0-16 16v32a16 16 0 0 0 16 16h8v64h-8a16 16 0 0 0-16 16v32a16 16 0 0 0 16 16h32a16 16 0 0 0 16-16v-8h64v8a16 16 0 0 0 16 16h32a16 16 0 0 0 16-16v-32a16 16 0 0 0-16-16h-8V96Zm-32-48h32v32h-32ZM48 48h32v15.9a.5.5 0 0 0 0 .2V80H48Zm32 160H48v-32h32v15.9a.5.5 0 0 0 0 .2zm128 0h-32v-32h32Zm-24-48h-8a16 16 0 0 0-16 16v8H96v-8a16 16 0 0 0-16-16h-8V96h8a16 16 0 0 0 16-16v-8h64v8a16 16 0 0 0 16 16h8Z`},null,-1)]])}var a4t,o4t,s4t=s((()=>{W(),a4t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},o4t={render:i4t}})),c4t=l({default:()=>d4t,render:()=>l4t});function l4t(e,t){return F(),I(`svg`,u4t,[...t[0]||=[R(`path`,{d:`M208 40H48a16 16 0 0 0-16 16v56c0 52.72 25.52 84.67 46.93 102.19 23.06 18.86 46 25.27 47 25.53a8 8 0 0 0 4.2 0c1-.26 23.91-6.67 47-25.53C198.48 196.67 224 164.72 224 112V56a16 16 0 0 0-16-16m0 16v56c0 2.71-.08 5.37-.23 8H136V56ZM48 56h72v64H48.23c-.15-2.63-.23-5.29-.23-8Zm2.06 80H120v84.55a131 131 0 0 1-30.93-18.74c-21.15-17.3-34.2-39.37-38.99-65.81Zm117.34 65.42a131.3 131.3 0 0 1-31.4 19.11V136h69.91c-4.75 26.24-17.64 48.18-38.51 65.42`},null,-1)]])}var u4t,d4t,f4t=s((()=>{W(),u4t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},d4t={render:l4t}})),p4t=l({default:()=>g4t,render:()=>m4t});function m4t(e,t){return F(),I(`svg`,h4t,[...t[0]||=[R(`path`,{d:`M216 64h-68.69l34.35-34.34a8 8 0 1 0-11.32-11.32L128 60.69 85.66 18.34a8 8 0 0 0-11.32 11.32L108.69 64H40a16 16 0 0 0-16 16v120a16 16 0 0 0 16 16h176a16 16 0 0 0 16-16V80a16 16 0 0 0-16-16M40 80h104v120H40Zm176 120h-56V80h56zm-16-84a12 12 0 1 1-12-12 12 12 0 0 1 12 12m0 48a12 12 0 1 1-12-12 12 12 0 0 1 12 12`},null,-1)]])}var h4t,g4t,_4t=s((()=>{W(),h4t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},g4t={render:m4t}})),v4t=l({default:()=>x4t,render:()=>y4t});function y4t(e,t){return F(),I(`svg`,b4t,[...t[0]||=[R(`path`,{d:`M224 72h-16v-8a24 24 0 0 0-24-24H40a24 24 0 0 0-24 24v96a24 24 0 0 0 24 24h112v8a24 24 0 0 0 24 24h48a24 24 0 0 0 24-24V96a24 24 0 0 0-24-24M40 168a8 8 0 0 1-8-8V64a8 8 0 0 1 8-8h144a8 8 0 0 1 8 8v8h-16a24 24 0 0 0-24 24v72Zm192 24a8 8 0 0 1-8 8h-48a8 8 0 0 1-8-8V96a8 8 0 0 1 8-8h48a8 8 0 0 1 8 8Zm-96 16a8 8 0 0 1-8 8H88a8 8 0 0 1 0-16h40a8 8 0 0 1 8 8m80-96a8 8 0 0 1-8 8h-16a8 8 0 0 1 0-16h16a8 8 0 0 1 8 8`},null,-1)]])}var b4t,x4t,S4t=s((()=>{W(),b4t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},x4t={render:y4t}})),C4t=l({default:()=>E4t,render:()=>w4t});function w4t(e,t){return F(),I(`svg`,T4t,[...t[0]||=[R(`path`,{d:`M232 168h-8V72a24 24 0 0 0-24-24H56a24 24 0 0 0-24 24v96h-8a8 8 0 0 0-8 8v16a24 24 0 0 0 24 24h176a24 24 0 0 0 24-24v-16a8 8 0 0 0-8-8M48 72a8 8 0 0 1 8-8h144a8 8 0 0 1 8 8v96H48Zm176 120a8 8 0 0 1-8 8H40a8 8 0 0 1-8-8v-8h192ZM152 88a8 8 0 0 1-8 8h-32a8 8 0 0 1 0-16h32a8 8 0 0 1 8 8`},null,-1)]])}var T4t,E4t,D4t=s((()=>{W(),T4t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},E4t={render:w4t}})),O4t=l({default:()=>j4t,render:()=>k4t});function k4t(e,t){return F(),I(`svg`,A4t,[...t[0]||=[R(`path`,{d:`M176 148a12 12 0 1 1-12-12 12 12 0 0 1 12 12m-84-12a12 12 0 1 0 12 12 12 12 0 0 0-12-12m148 24v24a16 16 0 0 1-16 16H32a16 16 0 0 1-16-16v-22.87a113.38 113.38 0 0 1 35.4-82.41L26.34 53.66a8 8 0 0 1 11.32-11.32L63.82 68.5a111.43 111.43 0 0 1 128.55-.19l26-26a8 8 0 0 1 11.32 11.32L204.82 78.5c.75.71 1.5 1.43 2.24 2.17A111.25 111.25 0 0 1 240 160m-16 0a96 96 0 0 0-96-96h-.34C74.91 64.18 32 107.75 32 161.13V184h192Z`},null,-1)]])}var A4t,j4t,M4t=s((()=>{W(),A4t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},j4t={render:k4t}})),N4t=l({default:()=>I4t,render:()=>P4t});function P4t(e,t){return F(),I(`svg`,F4t,[...t[0]||=[R(`path`,{d:`M168 72v128a8 8 0 0 1-16 0V72a8 8 0 0 1 16 0m32-48a8 8 0 0 0-8 8v168a8 8 0 0 0 16 0V32a8 8 0 0 0-8-8m-80 80a8 8 0 0 0-8 8v88a8 8 0 0 0 16 0v-88a8 8 0 0 0-8-8m-40 40a8 8 0 0 0-8 8v48a8 8 0 0 0 16 0v-48a8 8 0 0 0-8-8m-40 40a8 8 0 0 0-8 8v8a8 8 0 0 0 16 0v-8a8 8 0 0 0-8-8`},null,-1)]])}var F4t,I4t,L4t=s((()=>{W(),F4t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},I4t={render:P4t}})),R4t=l({default:()=>V4t,render:()=>z4t});function z4t(e,t){return F(),I(`svg`,B4t,[...t[0]||=[R(`path`,{d:`m64.34 196.07-9.45 16a8 8 0 1 1-13.78-8.14l9.46-16a8 8 0 1 1 13.77 8.14M232 152h-47.8l-30.73-52a8 8 0 1 0-13.77 8.14l61.41 103.93a8 8 0 0 0 13.78-8.14L193.66 168H232a8 8 0 0 0 0-16m-89.53 0H90.38l68.51-115.93a8 8 0 0 0-13.78-8.14L128 56.89l-17.11-29a8 8 0 1 0-13.78 8.14l21.6 36.55L71.8 152H24a8 8 0 0 0 0 16h118.47a8 8 0 1 0 0-16`},null,-1)]])}var B4t,V4t,H4t=s((()=>{W(),B4t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},V4t={render:z4t}})),U4t=l({default:()=>K4t,render:()=>W4t});function W4t(e,t){return F(),I(`svg`,G4t,[...t[0]||=[R(`path`,{d:`M180 144h-20v-32h20a36 36 0 1 0-36-36v20h-32V76a36 36 0 1 0-36 36h20v32H76a36 36 0 1 0 36 36v-20h32v20a36 36 0 1 0 36-36m-20-68a20 20 0 1 1 20 20h-20ZM56 76a20 20 0 0 1 40 0v20H76a20 20 0 0 1-20-20m40 104a20 20 0 1 1-20-20h20Zm16-68h32v32h-32Zm68 88a20 20 0 0 1-20-20v-20h20a20 20 0 0 1 0 40`},null,-1)]])}var G4t,K4t,q4t=s((()=>{W(),G4t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},K4t={render:W4t}})),J4t=l({default:()=>Z4t,render:()=>Y4t});function Y4t(e,t){return F(),I(`svg`,X4t,[...t[0]||=[R(`path`,{d:`M237.33 106.21 61.41 41l-.16-.05a16 16 0 0 0-20.35 20.3 1 1 0 0 0 .05.16l65.26 175.92A15.77 15.77 0 0 0 121.28 248h.3a15.77 15.77 0 0 0 15-11.29l.06-.2 21.84-78 78-21.84.2-.06a16 16 0 0 0 .62-30.38Zm-87.49 38.09a8 8 0 0 0-5.54 5.54l-23 82.16-.06-.17L56 56l175.82 65.22.16.06Z`},null,-1)]])}var X4t,Z4t,Q4t=s((()=>{W(),X4t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},Z4t={render:Y4t}})),$4t=l({default:()=>n3t,render:()=>e3t});function e3t(e,t){return F(),I(`svg`,t3t,[...t[0]||=[R(`path`,{d:`M176 16H80a24 24 0 0 0-24 24v176a24 24 0 0 0 24 24h96a24 24 0 0 0 24-24V40a24 24 0 0 0-24-24M72 64h112v128H72Zm8-32h96a8 8 0 0 1 8 8v8H72v-8a8 8 0 0 1 8-8m96 192H80a8 8 0 0 1-8-8v-8h112v8a8 8 0 0 1-8 8`},null,-1)]])}var t3t,n3t,r3t=s((()=>{W(),t3t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},n3t={render:e3t}})),i3t=l({default:()=>s3t,render:()=>a3t});function a3t(e,t){return F(),I(`svg`,o3t,[...t[0]||=[R(`path`,{d:`M237.66 18.34a8 8 0 0 0-11.32 0l-52.4 52.41-5.37-5.38a32.05 32.05 0 0 0-45.26 0L100 88.69l-6.34-6.35a8 8 0 0 0-11.32 11.32l6.35 6.34-23.32 23.31a32 32 0 0 0 0 45.26l5.38 5.37-52.41 52.4a8 8 0 0 0 11.32 11.32l52.4-52.41 5.37 5.38a32 32 0 0 0 45.26 0L156 167.31l6.34 6.35a8 8 0 0 0 11.32-11.32l-6.35-6.34 23.32-23.31a32 32 0 0 0 0-45.26l-5.38-5.37 52.41-52.4a8 8 0 0 0 0-11.32m-116.29 161a16 16 0 0 1-22.62 0l-22.06-22.09a16 16 0 0 1 0-22.62L100 111.31 144.69 156Zm57.94-57.94L156 144.69 111.31 100l23.32-23.31a16 16 0 0 1 22.62 0l22.06 22a16 16 0 0 1 0 22.68ZM88.57 35a8 8 0 0 1 14.86-6l8 20a8 8 0 0 1-14.86 6Zm-64 58A8 8 0 0 1 35 88.57l20 8a8 8 0 0 1-6 14.86l-20-8A8 8 0 0 1 24.57 93m206.86 70a8 8 0 0 1-10.4 4.46l-20-8a8 8 0 1 1 5.97-14.89l20 8a8 8 0 0 1 4.43 10.43m-64 58.06a8 8 0 0 1-14.86 5.94l-8-20a8 8 0 0 1 14.86-6Z`},null,-1)]])}var o3t,s3t,c3t=s((()=>{W(),o3t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},s3t={render:a3t}})),l3t=l({default:()=>f3t,render:()=>u3t});function u3t(e,t){return F(),I(`svg`,d3t,[...t[0]||=[R(`path`,{d:`M128 24a104 104 0 1 0 104 104A104.12 104.12 0 0 0 128 24m88 104a87.6 87.6 0 0 1-3.33 24h-38.51a157.4 157.4 0 0 0 0-48h38.51a87.6 87.6 0 0 1 3.33 24m-114 40h52a115.1 115.1 0 0 1-26 45 115.3 115.3 0 0 1-26-45m-3.9-16a140.8 140.8 0 0 1 0-48h59.88a140.8 140.8 0 0 1 0 48ZM40 128a87.6 87.6 0 0 1 3.33-24h38.51a157.4 157.4 0 0 0 0 48H43.33A87.6 87.6 0 0 1 40 128m114-40h-52a115.1 115.1 0 0 1 26-45 115.3 115.3 0 0 1 26 45m52.33 0h-35.62a135.3 135.3 0 0 0-22.3-45.6A88.29 88.29 0 0 1 206.37 88Zm-98.74-45.6A135.3 135.3 0 0 0 85.29 88H49.63a88.29 88.29 0 0 1 57.96-45.6M49.63 168h35.66a135.3 135.3 0 0 0 22.3 45.6A88.29 88.29 0 0 1 49.63 168m98.78 45.6a135.3 135.3 0 0 0 22.3-45.6h35.66a88.29 88.29 0 0 1-57.96 45.6`},null,-1)]])}var d3t,f3t,p3t=s((()=>{W(),d3t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},f3t={render:u3t}})),m3t=l({default:()=>_3t,render:()=>h3t});function h3t(e,t){return F(),I(`svg`,g3t,[...t[0]||=[R(`path`,{d:`M140 204a12 12 0 1 1-12-12 12 12 0 0 1 12 12m97.08-117a172 172 0 0 0-218.16 0 8 8 0 0 0 10.16 12.37 156 156 0 0 1 197.84 0A8 8 0 0 0 237.08 87M205 122.77a124 124 0 0 0-153.94 0A8 8 0 0 0 61 135.31a108 108 0 0 1 134.06 0 8 8 0 0 0 11.24-1.3 8 8 0 0 0-1.3-11.24m-32.26 35.76a76.05 76.05 0 0 0-89.42 0 8 8 0 0 0 9.42 12.94 60 60 0 0 1 70.58 0 8 8 0 1 0 9.42-12.94`},null,-1)]])}var g3t,_3t,v3t=s((()=>{W(),g3t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},_3t={render:h3t}})),y3t=l({default:()=>S3t,render:()=>b3t});function b3t(e,t){return F(),I(`svg`,x3t,[...t[0]||=[R(`path`,{d:`M128 88a40 40 0 1 0 40 40 40 40 0 0 0-40-40m0 64a24 24 0 1 1 24-24 24 24 0 0 1-24 24m73.71 7.14a80 80 0 0 1-14.08 22.2 8 8 0 0 1-11.92-10.67 63.95 63.95 0 0 0 0-85.33 8 8 0 1 1 11.92-10.67 80.08 80.08 0 0 1 14.08 84.47M69 103.09a64 64 0 0 0 11.26 67.58 8 8 0 0 1-11.92 10.67 79.93 79.93 0 0 1 0-106.67 8 8 0 1 1 11.95 10.67A63.8 63.8 0 0 0 69 103.09M248 128a119.58 119.58 0 0 1-34.29 84 8 8 0 1 1-11.42-11.2 103.9 103.9 0 0 0 0-145.56A8 8 0 1 1 213.71 44 119.58 119.58 0 0 1 248 128M53.71 200.78A8 8 0 1 1 42.29 212a119.87 119.87 0 0 1 0-168 8 8 0 1 1 11.42 11.2 103.9 103.9 0 0 0 0 145.56Z`},null,-1)]])}var x3t,S3t,C3t=s((()=>{W(),x3t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},S3t={render:b3t}})),w3t=l({default:()=>D3t,render:()=>T3t});function T3t(e,t){return F(),I(`svg`,E3t,[...t[0]||=[R(`path`,{d:`M221.69 199.77 160 96.92V40h8a8 8 0 0 0 0-16H88a8 8 0 0 0 0 16h8v56.92L34.31 199.77A16 16 0 0 0 48 224h160a16 16 0 0 0 13.72-24.23Zm-110.83-96.52a7.93 7.93 0 0 0 1.14-4.11V40h32v59.14a7.93 7.93 0 0 0 1.14 4.11L183.36 167c-12 2.37-29.07 1.37-51.75-10.11-15.91-8.05-31.05-12.32-45.22-12.81ZM48 208l28.54-47.58c14.25-1.74 30.31 1.85 47.82 10.72 19 9.61 35 12.88 48 12.88a69.9 69.9 0 0 0 19.55-2.7L208 208Z`},null,-1)]])}var E3t,D3t,O3t=s((()=>{W(),E3t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},D3t={render:T3t}})),k3t=l({default:()=>M3t,render:()=>A3t});function A3t(e,t){return F(),I(`svg`,j3t,[...t[0]||=[R(`path`,{d:`M215.79 118.17a8 8 0 0 0-5-5.66L153.18 90.9l14.66-73.33a8 8 0 0 0-13.69-7l-112 120a8 8 0 0 0 3 13l57.63 21.61-14.62 73.25a8 8 0 0 0 13.69 7l112-120a8 8 0 0 0 1.94-7.26M109.37 214l10.47-52.38a8 8 0 0 0-5-9.06L62 132.71l84.62-90.66-10.46 52.38a8 8 0 0 0 5 9.06l52.8 19.8Z`},null,-1)]])}var j3t,M3t,N3t=s((()=>{W(),j3t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},M3t={render:A3t}})),P3t=l({default:()=>L3t,render:()=>F3t});function F3t(e,t){return F(),I(`svg`,I3t,[...t[0]||=[R(`path`,{d:`M210.35 129.36c-.81-.47-1.7-.92-2.62-1.36.92-.44 1.81-.89 2.62-1.36a40 40 0 1 0-40-69.28c-.81.47-1.65 1-2.48 1.59.08-1 .13-2 .13-3a40 40 0 0 0-80 0c0 .94 0 1.94.13 3-.83-.57-1.67-1.12-2.48-1.59a40 40 0 1 0-40 69.28c.81.47 1.7.92 2.62 1.36-.92.44-1.81.89-2.62 1.36a40 40 0 1 0 40 69.28c.81-.47 1.65-1 2.48-1.59-.08 1-.13 2-.13 2.95a40 40 0 0 0 80 0c0-.94-.05-1.94-.13-2.95.83.57 1.67 1.12 2.48 1.59a39.8 39.8 0 0 0 19.94 5.36 40.4 40.4 0 0 0 10.42-1.38 40 40 0 0 0 9.64-73.28ZM104 128a24 24 0 1 1 24 24 24 24 0 0 1-24-24m74.35-56.79a24 24 0 1 1 24 41.57c-6.27 3.63-18.61 6.13-35.16 7.19a40 40 0 0 0-12.66-21.87c9.2-13.82 17.55-23.26 23.82-26.89M128 32a24 24 0 0 1 24 24c0 7.24-4 19.19-11.36 34.06a39.8 39.8 0 0 0-25.28 0C108 75.19 104 63.24 104 56a24 24 0 0 1 24-24M44.86 80a24 24 0 0 1 32.79-8.79c6.27 3.63 14.62 13.07 23.82 26.89A40 40 0 0 0 88.81 120c-16.55-1.06-28.89-3.56-35.16-7.18A24 24 0 0 1 44.86 80m32.79 104.79a24 24 0 1 1-24-41.57c6.27-3.63 18.61-6.13 35.16-7.19a40 40 0 0 0 12.66 21.87c-9.2 13.82-17.55 23.26-23.82 26.89M128 224a24 24 0 0 1-24-24c0-7.24 4-19.19 11.36-34.06a39.8 39.8 0 0 0 25.28 0C148 180.81 152 192.76 152 200a24 24 0 0 1-24 24m83.14-48a24 24 0 0 1-32.79 8.79c-6.27-3.63-14.62-13.07-23.82-26.89a40 40 0 0 0 12.66-21.9c16.55 1.06 28.89 3.56 35.16 7.18a24 24 0 0 1 8.79 32.82`},null,-1)]])}var I3t,L3t,R3t=s((()=>{W(),I3t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},L3t={render:F3t}})),z3t=l({default:()=>H3t,render:()=>B3t});function B3t(e,t){return F(),I(`svg`,V3t,[...t[0]||=[R(`path`,{d:`M128 72a8 8 0 0 1 8 8v56a8 8 0 0 1-16 0V80a8 8 0 0 1 8-8m-12 100a12 12 0 1 0 12-12 12 12 0 0 0-12 12m124-44a15.85 15.85 0 0 1-4.67 11.28l-96.05 96.06a16 16 0 0 1-22.56 0l-96-96.06a16 16 0 0 1 0-22.56l96.05-96.06a16 16 0 0 1 22.56 0l96.05 96.06A15.85 15.85 0 0 1 240 128m-16 0-96-96-96 96 96 96Z`},null,-1)]])}var V3t,H3t,U3t=s((()=>{W(),V3t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},H3t={render:B3t}})),W3t=l({default:()=>q3t,render:()=>G3t});function G3t(e,t){return F(),I(`svg`,K3t,[...t[0]||=[R(`path`,{d:`M236.8 188.09 149.35 36.22a24.76 24.76 0 0 0-42.7 0L19.2 188.09a23.51 23.51 0 0 0 0 23.72A24.35 24.35 0 0 0 40.55 224h174.9a24.35 24.35 0 0 0 21.33-12.19 23.51 23.51 0 0 0 .02-23.72m-13.87 15.71a8.5 8.5 0 0 1-7.48 4.2H40.55a8.5 8.5 0 0 1-7.48-4.2 7.59 7.59 0 0 1 0-7.72l87.45-151.87a8.75 8.75 0 0 1 15 0l87.45 151.87a7.59 7.59 0 0 1-.04 7.72M120 144v-40a8 8 0 0 1 16 0v40a8 8 0 0 1-16 0m20 36a12 12 0 1 1-12-12 12 12 0 0 1 12 12`},null,-1)]])}var K3t,q3t,J3t=s((()=>{W(),K3t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},q3t={render:G3t}})),Y3t=l({default:()=>Q3t,render:()=>X3t});function X3t(e,t){return F(),I(`svg`,Z3t,[...t[0]||=[R(`path`,{d:`M128 24a104 104 0 1 0 104 104A104.11 104.11 0 0 0 128 24m0 192a88 88 0 1 1 88-88 88.1 88.1 0 0 1-88 88m16-40a8 8 0 0 1-8 8 16 16 0 0 1-16-16v-40a8 8 0 0 1 0-16 16 16 0 0 1 16 16v40a8 8 0 0 1 8 8m-32-92a12 12 0 1 1 12 12 12 12 0 0 1-12-12`},null,-1)]])}var Z3t,Q3t,$3t=s((()=>{W(),Z3t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},Q3t={render:X3t}})),e6t=l({default:()=>r6t,render:()=>t6t});function t6t(e,t){return F(),I(`svg`,n6t,[...t[0]||=[R(`path`,{d:`M248 80a28 28 0 1 0-51.12 15.77l-26.79 33L146 73.4a28 28 0 1 0-36.06 0l-24.03 55.34-26.79-33a28 28 0 1 0-26.6 12L47 194.63A16 16 0 0 0 62.78 208h130.44A16 16 0 0 0 209 194.63l14.47-86.85A28 28 0 0 0 248 80M128 40a12 12 0 1 1-12 12 12 12 0 0 1 12-12M24 80a12 12 0 1 1 12 12 12 12 0 0 1-12-12m169.22 112H62.78l-13.92-83.48L81.79 149a8 8 0 0 0 6.21 3 8 8 0 0 0 1.08-.07 8 8 0 0 0 6.26-4.74l29.3-67.4a27 27 0 0 0 6.72 0l29.3 67.4a8 8 0 0 0 6.26 4.74 8 8 0 0 0 1.08.07 8 8 0 0 0 6.21-3l32.93-40.52ZM220 92a12 12 0 1 1 12-12 12 12 0 0 1-12 12`},null,-1)]])}var n6t,r6t,i6t=s((()=>{W(),n6t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},r6t={render:t6t}})),a6t=l({default:()=>c6t,render:()=>o6t});function o6t(e,t){return F(),I(`svg`,s6t,[...t[0]||=[R(`path`,{d:`M184 32H72a16 16 0 0 0-16 16v176a8 8 0 0 0 12.24 6.78L128 193.43l59.77 37.35A8 8 0 0 0 200 224V48a16 16 0 0 0-16-16m0 177.57-51.77-32.35a8 8 0 0 0-8.48 0L72 209.57V48h112Z`},null,-1)]])}var s6t,c6t,l6t=s((()=>{W(),s6t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},c6t={render:o6t}})),u6t=l({default:()=>p6t,render:()=>d6t});function d6t(e,t){return F(),I(`svg`,f6t,[...t[0]||=[R(`path`,{d:`M184 32H72a16 16 0 0 0-16 16v176a8 8 0 0 0 12.24 6.78L128 193.43l59.77 37.35A8 8 0 0 0 200 224V48a16 16 0 0 0-16-16m0 177.57-51.77-32.35a8 8 0 0 0-8.48 0L72 209.57V48h112Z`},null,-1)]])}var f6t,p6t,m6t=s((()=>{W(),f6t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},p6t={render:d6t}})),h6t=l({default:()=>v6t,render:()=>g6t});function g6t(e,t){return F(),I(`svg`,_6t,[...t[0]||=[R(`path`,{d:`M208 32h-24v-8a8 8 0 0 0-16 0v8H88v-8a8 8 0 0 0-16 0v8H48a16 16 0 0 0-16 16v160a16 16 0 0 0 16 16h160a16 16 0 0 0 16-16V48a16 16 0 0 0-16-16M72 48v8a8 8 0 0 0 16 0v-8h80v8a8 8 0 0 0 16 0v-8h24v32H48V48Zm136 160H48V96h160zm-96-88v64a8 8 0 0 1-16 0v-51.06l-4.42 2.22a8 8 0 0 1-7.16-14.32l16-8A8 8 0 0 1 112 120m59.16 30.45L152 176h16a8 8 0 0 1 0 16h-32a8 8 0 0 1-6.4-12.8l28.78-38.37a8 8 0 1 0-13.31-8.83 8 8 0 1 1-13.85-8A24 24 0 0 1 176 136a23.76 23.76 0 0 1-4.84 14.45`},null,-1)]])}var _6t,v6t,y6t=s((()=>{W(),_6t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},v6t={render:g6t}})),b6t=l({default:()=>C6t,render:()=>x6t});function x6t(e,t){return F(),I(`svg`,S6t,[...t[0]||=[R(`path`,{d:`M232 48h-72a40 40 0 0 0-32 16 40 40 0 0 0-32-16H24a8 8 0 0 0-8 8v144a8 8 0 0 0 8 8h72a24 24 0 0 1 24 24 8 8 0 0 0 16 0 24 24 0 0 1 24-24h72a8 8 0 0 0 8-8V56a8 8 0 0 0-8-8M96 192H32V64h64a24 24 0 0 1 24 24v112a39.8 39.8 0 0 0-24-8m128 0h-64a39.8 39.8 0 0 0-24 8V88a24 24 0 0 1 24-24h64Z`},null,-1)]])}var S6t,C6t,w6t=s((()=>{W(),S6t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},C6t={render:x6t}})),T6t=l({default:()=>O6t,render:()=>E6t});function E6t(e,t){return F(),I(`svg`,D6t,[...t[0]||=[R(`path`,{d:`M208 24H72a32 32 0 0 0-32 32v168a8 8 0 0 0 8 8h144a8 8 0 0 0 0-16H56a16 16 0 0 1 16-16h136a8 8 0 0 0 8-8V32a8 8 0 0 0-8-8m-88 16h48v72l-19.21-14.4a8 8 0 0 0-9.6 0L120 112Zm80 144H72a31.8 31.8 0 0 0-16 4.29V56a16 16 0 0 1 16-16h32v88a8 8 0 0 0 12.8 6.4L144 114l27.21 20.4A8 8 0 0 0 176 136a8 8 0 0 0 8-8V40h16Z`},null,-1)]])}var D6t,O6t,k6t=s((()=>{W(),D6t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},O6t={render:E6t}})),A6t=l({default:()=>N6t,render:()=>j6t});function j6t(e,t){return F(),I(`svg`,M6t,[...t[0]||=[R(`path`,{d:`m213.66 82.34-56-56A8 8 0 0 0 152 24H56a16 16 0 0 0-16 16v176a16 16 0 0 0 16 16h144a16 16 0 0 0 16-16V88a8 8 0 0 0-2.34-5.66M160 51.31 188.69 80H160ZM200 216H56V40h88v48a8 8 0 0 0 8 8h48z`},null,-1)]])}var M6t,N6t,P6t=s((()=>{W(),M6t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},N6t={render:j6t}})),F6t=l({default:()=>R6t,render:()=>I6t});function I6t(e,t){return F(),I(`svg`,L6t,[...t[0]||=[R(`path`,{d:`M216 72h-85.33l-27.74-20.8a16.12 16.12 0 0 0-9.6-3.2H40a16 16 0 0 0-16 16v136a16 16 0 0 0 16 16h176.89A15.13 15.13 0 0 0 232 200.89V88a16 16 0 0 0-16-16m0 128H40V64h53.33l29.87 22.4A8 8 0 0 0 128 88h88Z`},null,-1)]])}var L6t,R6t,z6t=s((()=>{W(),L6t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},R6t={render:I6t}})),B6t=l({default:()=>U6t,render:()=>V6t});function V6t(e,t){return F(),I(`svg`,H6t,[...t[0]||=[R(`path`,{d:`M200 32h-36.26a47.92 47.92 0 0 0-71.48 0H56a16 16 0 0 0-16 16v168a16 16 0 0 0 16 16h144a16 16 0 0 0 16-16V48a16 16 0 0 0-16-16m-72 0a32 32 0 0 1 32 32H96a32 32 0 0 1 32-32m72 184H56V48h26.75A47.9 47.9 0 0 0 80 64v8a8 8 0 0 0 8 8h80a8 8 0 0 0 8-8v-8a47.9 47.9 0 0 0-2.75-16H200Z`},null,-1)]])}var H6t,U6t,W6t=s((()=>{W(),H6t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},U6t={render:V6t}})),G6t=l({default:()=>J6t,render:()=>K6t});function K6t(e,t){return F(),I(`svg`,q6t,[...t[0]||=[R(`path`,{d:`M209.66 122.34a8 8 0 0 1 0 11.32l-82.05 82a56 56 0 0 1-79.2-79.21l99.26-100.72a40 40 0 1 1 56.61 56.55L105 193a24 24 0 1 1-34-34l83.3-84.62a8 8 0 1 1 11.4 11.22l-83.31 84.71a8 8 0 1 0 11.27 11.36L192.93 81A24 24 0 1 0 159 47L59.76 147.68a40 40 0 1 0 56.53 56.62l82.06-82a8 8 0 0 1 11.31.04`},null,-1)]])}var q6t,J6t,Y6t=s((()=>{W(),q6t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},J6t={render:K6t}})),X6t=l({default:()=>$6t,render:()=>Z6t});function Z6t(e,t){return F(),I(`svg`,Q6t,[...t[0]||=[R(`path`,{d:`M237.2 151.87a47 47 0 0 0-2.35-5.45L193.26 51.8a7.8 7.8 0 0 0-1.66-2.44 32 32 0 0 0-45.26 0A8 8 0 0 0 144 55v25h-32V55a8 8 0 0 0-2.34-5.66 32 32 0 0 0-45.26 0 7.8 7.8 0 0 0-1.66 2.44L21.15 146.4a47 47 0 0 0-2.35 5.45A48 48 0 1 0 112 168V96h32v72a48 48 0 1 0 93.2-16.13M76.71 59.75a16 16 0 0 1 19.29-1v73.51a47.9 47.9 0 0 0-46.79-9.92ZM64 200a32 32 0 1 1 32-32 32 32 0 0 1-32 32m96-141.26a16 16 0 0 1 19.29 1l27.5 62.58a47.9 47.9 0 0 0-46.79 9.93ZM192 200a32 32 0 1 1 32-32 32 32 0 0 1-32 32`},null,-1)]])}var Q6t,$6t,e8t=s((()=>{W(),Q6t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},$6t={render:Z6t}})),t8t=l({default:()=>i8t,render:()=>n8t});function n8t(e,t){return F(),I(`svg`,r8t,[...t[0]||=[R(`path`,{d:`M48 64a8 8 0 0 1 8-8h16V40a8 8 0 0 1 16 0v16h16a8 8 0 0 1 0 16H88v16a8 8 0 0 1-16 0V72H56a8 8 0 0 1-8-8m136 128h-8v-8a8 8 0 0 0-16 0v8h-8a8 8 0 0 0 0 16h8v8a8 8 0 0 0 16 0v-8h8a8 8 0 0 0 0-16m56-48h-16v-16a8 8 0 0 0-16 0v16h-16a8 8 0 0 0 0 16h16v16a8 8 0 0 0 16 0v-16h16a8 8 0 0 0 0-16m-20.69-64L80 219.31a16 16 0 0 1-22.62 0l-20.7-20.68a16 16 0 0 1 0-22.63L176 36.69a16 16 0 0 1 22.63 0l20.68 20.68a16 16 0 0 1 0 22.63m-54.63 32L144 91.31l-96 96L68.68 208ZM208 68.69 187.31 48l-32 32L176 100.69Z`},null,-1)]])}var r8t,i8t,a8t=s((()=>{W(),r8t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},i8t={render:n8t}})),o8t=l({default:()=>l8t,render:()=>s8t});function s8t(e,t){return F(),I(`svg`,c8t,[...t[0]||=[R(`path`,{d:`M232 88h-16V64a16 16 0 0 0-16-16H48a16 16 0 0 0-16 16v24H16a8 8 0 0 0 0 16h16v24a16 16 0 0 0 16 16h152a16 16 0 0 0 16-16v-24h16v50l-100.4 28.65A16.07 16.07 0 0 0 120 198v34a8 8 0 0 0 16 0v-34l100.4-28.68A16.07 16.07 0 0 0 248 154v-50a16 16 0 0 0-16-16m-32 40H48V64h152z`},null,-1)]])}var c8t,l8t,u8t=s((()=>{W(),c8t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},l8t={render:s8t}})),d8t=l({default:()=>m8t,render:()=>f8t});function f8t(e,t){return F(),I(`svg`,p8t,[...t[0]||=[R(`path`,{d:`M253.93 154.63c-1.32-1.46-24.09-26.22-61-40.56-1.72-18.42-8.46-35.17-19.41-47.92C158.87 49 137.58 40 112 40c-51.52 0-85.11 46.18-86.51 48.15a8 8 0 0 0 13 9.31C38.8 97.05 68.81 56 112 56c20.77 0 37.86 7.11 49.41 20.57 7.42 8.64 12.44 19.69 14.67 32A141 141 0 0 0 140.6 104c-26.06 0-47.93 6.81-63.26 19.69C63.78 135.09 56 151 56 167.25a47.6 47.6 0 0 0 13.87 34.05c9.66 9.62 23.06 14.7 38.73 14.7 51.81 0 81.18-42.13 84.49-84.42a161.4 161.4 0 0 1 49 33.79 8 8 0 1 0 11.86-10.74Zm-94.46 21.64C150.64 187.09 134.66 200 108.6 200 83.32 200 72 183.55 72 167.25 72 144.49 93.47 120 140.6 120a124.3 124.3 0 0 1 36.78 5.68c-.45 18.76-6.92 37.1-17.91 50.59`},null,-1)]])}var p8t,m8t,h8t=s((()=>{W(),p8t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},m8t={render:f8t}})),g8t=l({default:()=>y8t,render:()=>_8t});function _8t(e,t){return F(),I(`svg`,v8t,[...t[0]||=[R(`path`,{d:`M216 96a88 88 0 1 0-144 67.83V240a8 8 0 0 0 11.58 7.16L128 225l44.43 22.21a8.1 8.1 0 0 0 3.57.79 8 8 0 0 0 8-8v-76.17A87.85 87.85 0 0 0 216 96M56 96a72 72 0 1 1 72 72 72.08 72.08 0 0 1-72-72m112 131.06-36.43-18.21a8 8 0 0 0-7.16 0L88 227.06v-52.69a87.89 87.89 0 0 0 80 0ZM128 152a56 56 0 1 0-56-56 56.06 56.06 0 0 0 56 56m0-96a40 40 0 1 1-40 40 40 40 0 0 1 40-40`},null,-1)]])}var v8t,y8t,b8t=s((()=>{W(),v8t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},y8t={render:_8t}})),x8t=l({default:()=>w8t,render:()=>S8t});function S8t(e,t){return F(),I(`svg`,C8t,[...t[0]||=[R(`path`,{d:`M42.76 50A8 8 0 0 0 40 56v168a8 8 0 0 0 16 0v-44.23c26.79-21.16 49.87-9.75 76.45 3.41 16.4 8.11 34.06 16.85 53 16.85 13.93 0 28.54-4.75 43.82-18a8 8 0 0 0 2.76-6V56a8 8 0 0 0-13.27-6c-28 24.23-51.72 12.49-79.21-1.12C111.07 34.76 78.78 18.79 42.76 50M216 172.25c-26.79 21.16-49.87 9.74-76.45-3.41-25-12.35-52.81-26.13-83.55-8.4V59.79c26.79-21.16 49.87-9.75 76.45 3.4 25 12.35 52.82 26.13 83.55 8.4Z`},null,-1)]])}var C8t,w8t,T8t=s((()=>{W(),C8t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},w8t={render:S8t}})),E8t=l({default:()=>k8t,render:()=>D8t});function D8t(e,t){return F(),I(`svg`,O8t,[...t[0]||=[R(`path`,{d:`M178 40c-20.65 0-38.73 8.88-50 23.89C116.73 48.88 98.65 40 78 40a62.07 62.07 0 0 0-62 62c0 70 103.79 126.66 108.21 129a8 8 0 0 0 7.58 0C136.21 228.66 240 172 240 102a62.07 62.07 0 0 0-62-62m-50 174.8c-18.26-10.64-96-59.11-96-112.8a46.06 46.06 0 0 1 46-46c19.45 0 35.78 10.36 42.6 27a8 8 0 0 0 14.8 0c6.82-16.67 23.15-27 42.6-27a46.06 46.06 0 0 1 46 46c0 53.61-77.76 102.15-96 112.8`},null,-1)]])}var O8t,k8t,A8t=s((()=>{W(),O8t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},k8t={render:D8t}})),j8t=l({default:()=>P8t,render:()=>M8t});function M8t(e,t){return F(),I(`svg`,N8t,[...t[0]||=[R(`path`,{d:`M239.18 97.26A16.38 16.38 0 0 0 224.92 86l-59-4.76-22.78-55.09a16.36 16.36 0 0 0-30.27 0L90.11 81.23 31.08 86a16.46 16.46 0 0 0-9.37 28.86l45 38.83L53 211.75a16.38 16.38 0 0 0 24.5 17.82l50.5-31.08 50.53 31.08A16.4 16.4 0 0 0 203 211.75l-13.76-58.07 45-38.83a16.43 16.43 0 0 0 4.94-17.59m-15.34 5.47-48.7 42a8 8 0 0 0-2.56 7.91l14.88 62.8a.37.37 0 0 1-.17.48c-.18.14-.23.11-.38 0l-54.72-33.65a8 8 0 0 0-8.38 0l-54.72 33.67c-.15.09-.19.12-.38 0a.37.37 0 0 1-.17-.48l14.88-62.8a8 8 0 0 0-2.56-7.91l-48.7-42c-.12-.1-.23-.19-.13-.5s.18-.27.33-.29l63.92-5.16a8 8 0 0 0 6.72-4.94l24.62-59.61c.08-.17.11-.25.35-.25s.27.08.35.25L153 91.86a8 8 0 0 0 6.75 4.92l63.92 5.16c.15 0 .24 0 .33.29s0 .4-.16.5`},null,-1)]])}var N8t,P8t,F8t=s((()=>{W(),N8t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},P8t={render:M8t}})),I8t=l({default:()=>z8t,render:()=>L8t});function L8t(e,t){return F(),I(`svg`,R8t,[...t[0]||=[R(`path`,{d:`M197.58 129.06 146 110l-19-51.62a15.92 15.92 0 0 0-29.88 0L78 110l-51.62 19a15.92 15.92 0 0 0 0 29.88L78 178l19 51.62a15.92 15.92 0 0 0 29.88 0L146 178l51.62-19a15.92 15.92 0 0 0 0-29.88ZM137 164.22a8 8 0 0 0-4.74 4.74L112 223.85 91.78 169a8 8 0 0 0-4.78-4.78L32.15 144 87 123.78a8 8 0 0 0 4.78-4.78L112 64.15 132.22 119a8 8 0 0 0 4.74 4.74L191.85 144ZM144 40a8 8 0 0 1 8-8h16V16a8 8 0 0 1 16 0v16h16a8 8 0 0 1 0 16h-16v16a8 8 0 0 1-16 0V48h-16a8 8 0 0 1-8-8m104 48a8 8 0 0 1-8 8h-8v8a8 8 0 0 1-16 0v-8h-8a8 8 0 0 1 0-16h8v-8a8 8 0 0 1 16 0v8h8a8 8 0 0 1 8 8`},null,-1)]])}var R8t,z8t,B8t=s((()=>{W(),R8t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},z8t={render:L8t}})),V8t=l({default:()=>W8t,render:()=>H8t});function H8t(e,t){return F(),I(`svg`,U8t,[...t[0]||=[R(`path`,{d:`M160 112h48a16 16 0 0 0 16-16V48a16 16 0 0 0-16-16h-48a16 16 0 0 0-16 16v16h-16a24 24 0 0 0-24 24v32H72v-8a16 16 0 0 0-16-16H24a16 16 0 0 0-16 16v32a16 16 0 0 0 16 16h32a16 16 0 0 0 16-16v-8h32v32a24 24 0 0 0 24 24h16v16a16 16 0 0 0 16 16h48a16 16 0 0 0 16-16v-48a16 16 0 0 0-16-16h-48a16 16 0 0 0-16 16v16h-16a8 8 0 0 1-8-8V88a8 8 0 0 1 8-8h16v16a16 16 0 0 0 16 16M56 144H24v-32h32zm104 16h48v48h-48Zm0-112h48v48h-48Z`},null,-1)]])}var U8t,W8t,G8t=s((()=>{W(),U8t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},W8t={render:H8t}})),K8t=l({default:()=>Y8t,render:()=>q8t});function q8t(e,t){return F(),I(`svg`,J8t,[...t[0]||=[R(`path`,{d:`m219.31 108.68-80-80a16 16 0 0 0-22.62 0l-80 80A15.87 15.87 0 0 0 32 120v96a8 8 0 0 0 8 8h64a8 8 0 0 0 8-8v-56h32v56a8 8 0 0 0 8 8h64a8 8 0 0 0 8-8v-96a15.87 15.87 0 0 0-4.69-11.32M208 208h-48v-56a8 8 0 0 0-8-8h-48a8 8 0 0 0-8 8v56H48v-88l80-80 80 80Z`},null,-1)]])}var J8t,Y8t,X8t=s((()=>{W(),J8t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},Y8t={render:q8t}})),Z8t=l({default:()=>e5t,render:()=>Q8t});function Q8t(e,t){return F(),I(`svg`,$8t,[...t[0]||=[R(`path`,{d:`M240 88.23a54.43 54.43 0 0 1-16 37L189.25 160a54.27 54.27 0 0 1-38.63 16h-.05A54.63 54.63 0 0 1 96 119.84a8 8 0 0 1 16 .45A38.62 38.62 0 0 0 150.58 160a38.4 38.4 0 0 0 27.31-11.31l34.75-34.75a38.63 38.63 0 0 0-54.63-54.63l-11 11A8 8 0 0 1 135.7 59l11-11a54.65 54.65 0 0 1 77.3 0 54.86 54.86 0 0 1 16 40.23m-131 97.43-11 11A38.4 38.4 0 0 1 70.6 208a38.63 38.63 0 0 1-27.29-65.94L78 107.31a38.63 38.63 0 0 1 66 28.4 8 8 0 0 0 16 .45A54.86 54.86 0 0 0 144 96a54.65 54.65 0 0 0-77.27 0L32 130.75A54.62 54.62 0 0 0 70.56 224a54.28 54.28 0 0 0 38.64-16l11-11a8 8 0 0 0-11.2-11.34`},null,-1)]])}var $8t,e5t,t5t=s((()=>{W(),$8t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},e5t={render:Q8t}})),n5t=l({default:()=>a5t,render:()=>r5t});function r5t(e,t){return F(),I(`svg`,i5t,[...t[0]||=[R(`path`,{d:`M120 40V16a8 8 0 0 1 16 0v24a8 8 0 0 1-16 0m72 88a64 64 0 1 1-64-64 64.07 64.07 0 0 1 64 64m-16 0a48 48 0 1 0-48 48 48.05 48.05 0 0 0 48-48M58.34 69.66a8 8 0 0 0 11.32-11.32l-16-16a8 8 0 0 0-11.32 11.32Zm0 116.68-16 16a8 8 0 0 0 11.32 11.32l16-16a8 8 0 0 0-11.32-11.32M192 72a8 8 0 0 0 5.66-2.34l16-16a8 8 0 0 0-11.32-11.32l-16 16A8 8 0 0 0 192 72m5.66 114.34a8 8 0 0 0-11.32 11.32l16 16a8 8 0 0 0 11.32-11.32ZM48 128a8 8 0 0 0-8-8H16a8 8 0 0 0 0 16h24a8 8 0 0 0 8-8m80 80a8 8 0 0 0-8 8v24a8 8 0 0 0 16 0v-24a8 8 0 0 0-8-8m112-88h-24a8 8 0 0 0 0 16h24a8 8 0 0 0 0-16`},null,-1)]])}var i5t,a5t,o5t=s((()=>{W(),i5t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},a5t={render:r5t}})),s5t=l({default:()=>u5t,render:()=>c5t});function c5t(e,t){return F(),I(`svg`,l5t,[...t[0]||=[R(`path`,{d:`M208 80h-32V56a48 48 0 0 0-96 0v24H48a16 16 0 0 0-16 16v112a16 16 0 0 0 16 16h160a16 16 0 0 0 16-16V96a16 16 0 0 0-16-16M96 56a32 32 0 0 1 64 0v24H96Zm112 152H48V96h160zm-68-56a12 12 0 1 1-12-12 12 12 0 0 1 12 12`},null,-1)]])}var l5t,u5t,d5t=s((()=>{W(),l5t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},u5t={render:c5t}})),f5t=l({default:()=>h5t,render:()=>p5t});function p5t(e,t){return F(),I(`svg`,m5t,[...t[0]||=[R(`path`,{d:`M208 80H96V56a32 32 0 0 1 32-32c15.37 0 29.2 11 32.16 25.59a8 8 0 0 0 15.68-3.18C171.32 24.15 151.2 8 128 8a48.05 48.05 0 0 0-48 48v24H48a16 16 0 0 0-16 16v112a16 16 0 0 0 16 16h160a16 16 0 0 0 16-16V96a16 16 0 0 0-16-16m0 128H48V96h160zm-68-56a12 12 0 1 1-12-12 12 12 0 0 1 12 12`},null,-1)]])}var m5t,h5t,g5t=s((()=>{W(),m5t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},h5t={render:p5t}})),_5t=l({default:()=>b5t,render:()=>v5t});function v5t(e,t){return F(),I(`svg`,y5t,[...t[0]||=[R(`path`,{d:`M216.57 39.43a80 80 0 0 0-132.66 81.35L28.69 176A15.86 15.86 0 0 0 24 187.31V216a16 16 0 0 0 16 16h32a8 8 0 0 0 8-8v-16h16a8 8 0 0 0 8-8v-16h16a8 8 0 0 0 5.66-2.34l9.56-9.57A79.7 79.7 0 0 0 160 176h.1a80 80 0 0 0 56.47-136.57M224 98.1c-1.09 34.09-29.75 61.86-63.89 61.9H160a63.7 63.7 0 0 1-23.65-4.51 8 8 0 0 0-8.84 1.68L116.69 168H96a8 8 0 0 0-8 8v16H72a8 8 0 0 0-8 8v16H40v-28.69l58.83-58.82a8 8 0 0 0 1.68-8.84A63.7 63.7 0 0 1 96 95.92c0-34.14 27.81-62.8 61.9-63.89A64 64 0 0 1 224 98.1M192 76a12 12 0 1 1-12-12 12 12 0 0 1 12 12`},null,-1)]])}var y5t,b5t,x5t=s((()=>{W(),y5t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},b5t={render:v5t}})),S5t=l({default:()=>T5t,render:()=>C5t});function C5t(e,t){return F(),I(`svg`,w5t,[...t[0]||=[R(`path`,{d:`m229.66 218.34-50.07-50.06a88.11 88.11 0 1 0-11.31 11.31l50.06 50.07a8 8 0 0 0 11.32-11.32M40 112a72 72 0 1 1 72 72 72.08 72.08 0 0 1-72-72`},null,-1)]])}var w5t,T5t,E5t=s((()=>{W(),w5t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},T5t={render:C5t}})),D5t=l({default:()=>A5t,render:()=>O5t});function O5t(e,t){return F(),I(`svg`,k5t,[...t[0]||=[R(`path`,{d:`M128 80a48 48 0 1 0 48 48 48.05 48.05 0 0 0-48-48m0 80a32 32 0 1 1 32-32 32 32 0 0 1-32 32m88-29.84q.06-2.16 0-4.32l14.92-18.64a8 8 0 0 0 1.48-7.06 107.2 107.2 0 0 0-10.88-26.25 8 8 0 0 0-6-3.93l-23.72-2.64q-1.48-1.56-3-3L186 40.54a8 8 0 0 0-3.94-6 107.7 107.7 0 0 0-26.25-10.87 8 8 0 0 0-7.06 1.49L130.16 40h-4.32L107.2 25.11a8 8 0 0 0-7.06-1.48 107.6 107.6 0 0 0-26.25 10.88 8 8 0 0 0-3.93 6l-2.64 23.76q-1.56 1.49-3 3L40.54 70a8 8 0 0 0-6 3.94 107.7 107.7 0 0 0-10.87 26.25 8 8 0 0 0 1.49 7.06L40 125.84v4.32L25.11 148.8a8 8 0 0 0-1.48 7.06 107.2 107.2 0 0 0 10.88 26.25 8 8 0 0 0 6 3.93l23.72 2.64q1.49 1.56 3 3L70 215.46a8 8 0 0 0 3.94 6 107.7 107.7 0 0 0 26.25 10.87 8 8 0 0 0 7.06-1.49L125.84 216q2.16.06 4.32 0l18.64 14.92a8 8 0 0 0 7.06 1.48 107.2 107.2 0 0 0 26.25-10.88 8 8 0 0 0 3.93-6l2.64-23.72q1.56-1.48 3-3l23.78-2.8a8 8 0 0 0 6-3.94 107.7 107.7 0 0 0 10.87-26.25 8 8 0 0 0-1.49-7.06Zm-16.1-6.5a74 74 0 0 1 0 8.68 8 8 0 0 0 1.74 5.48l14.19 17.73a91.6 91.6 0 0 1-6.23 15l-22.6 2.56a8 8 0 0 0-5.1 2.64 74 74 0 0 1-6.14 6.14 8 8 0 0 0-2.64 5.1l-2.51 22.58a91.3 91.3 0 0 1-15 6.23l-17.74-14.19a8 8 0 0 0-5-1.75h-.48a74 74 0 0 1-8.68 0 8 8 0 0 0-5.48 1.74l-17.78 14.2a91.6 91.6 0 0 1-15-6.23L82.89 187a8 8 0 0 0-2.64-5.1 74 74 0 0 1-6.14-6.14 8 8 0 0 0-5.1-2.64l-22.58-2.52a91.3 91.3 0 0 1-6.23-15l14.19-17.74a8 8 0 0 0 1.74-5.48 74 74 0 0 1 0-8.68 8 8 0 0 0-1.74-5.48L40.2 100.45a91.6 91.6 0 0 1 6.23-15L69 82.89a8 8 0 0 0 5.1-2.64 74 74 0 0 1 6.14-6.14A8 8 0 0 0 82.89 69l2.51-22.57a91.3 91.3 0 0 1 15-6.23l17.74 14.19a8 8 0 0 0 5.48 1.74 74 74 0 0 1 8.68 0 8 8 0 0 0 5.48-1.74l17.77-14.19a91.6 91.6 0 0 1 15 6.23L173.11 69a8 8 0 0 0 2.64 5.1 74 74 0 0 1 6.14 6.14 8 8 0 0 0 5.1 2.64l22.58 2.51a91.3 91.3 0 0 1 6.23 15l-14.19 17.74a8 8 0 0 0-1.74 5.53Z`},null,-1)]])}var k5t,A5t,j5t=s((()=>{W(),k5t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},A5t={render:O5t}})),M5t=l({default:()=>F5t,render:()=>N5t});function N5t(e,t){return F(),I(`svg`,P5t,[...t[0]||=[R(`path`,{d:`M155.51 24.81a8 8 0 0 0-8.42.88L77.25 80H32a16 16 0 0 0-16 16v64a16 16 0 0 0 16 16h45.25l69.84 54.31A8 8 0 0 0 160 224V32a8 8 0 0 0-4.49-7.19M32 96h40v64H32Zm112 111.64-56-43.55V91.91l56-43.55Zm54-106.08a40 40 0 0 1 0 52.88 8 8 0 0 1-12-10.58 24 24 0 0 0 0-31.72 8 8 0 0 1 12-10.58M248 128a79.9 79.9 0 0 1-20.37 53.34 8 8 0 0 1-11.92-10.67 64 64 0 0 0 0-85.33 8 8 0 1 1 11.92-10.67A79.83 79.83 0 0 1 248 128`},null,-1)]])}var P5t,F5t,I5t=s((()=>{W(),P5t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},F5t={render:N5t}})),L5t=l({default:()=>B5t,render:()=>R5t});function R5t(e,t){return F(),I(`svg`,z5t,[...t[0]||=[R(`path`,{d:`M223.85 47.12a16 16 0 0 0-15-15c-12.58-.75-44.73.4-71.41 27.07L132.69 64H74.36A15.9 15.9 0 0 0 63 68.68L28.7 103a16 16 0 0 0 9.07 27.16l38.47 5.37 44.21 44.21 5.37 38.49a15.94 15.94 0 0 0 10.78 12.92 16.1 16.1 0 0 0 5.1.83 15.9 15.9 0 0 0 11.3-4.68l34.32-34.3a15.9 15.9 0 0 0 4.68-11.36v-58.33l4.77-4.77c26.68-26.68 27.83-58.83 27.08-71.42M74.36 80h42.33l-39.53 39.52L40 114.34Zm74.41-9.45a76.65 76.65 0 0 1 59.11-22.47 76.46 76.46 0 0 1-22.42 59.16L128 164.68 91.32 128ZM176 181.64 141.67 216l-5.19-37.17L176 139.31Zm-74.16 9.5C97.34 201 82.29 224 40 224a8 8 0 0 1-8-8c0-42.29 23-57.34 32.86-61.85a8 8 0 0 1 6.64 14.56c-6.43 2.93-20.62 12.36-23.12 38.91 26.55-2.5 36-16.69 38.91-23.12a8 8 0 1 1 14.56 6.64Z`},null,-1)]])}var z5t,B5t,V5t=s((()=>{W(),z5t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},B5t={render:R5t}})),H5t=l({default:()=>G5t,render:()=>U5t});function U5t(e,t){return F(),I(`svg`,W5t,[...t[0]||=[R(`path`,{d:`M245.11 60.68c-7.65-13.19-27.84-16.16-58.5-8.66A95.93 95.93 0 0 0 32 128a98 98 0 0 0 .78 12.31C5.09 169 5.49 186 10.9 195.32 16 204.16 26.64 208 40.64 208a124 124 0 0 0 28.79-4A95.93 95.93 0 0 0 224 128a97 97 0 0 0-.77-12.25c12.5-13 20.82-25.35 23.65-35.92 1.95-7.32 1.36-13.76-1.77-19.15M128 48a80.11 80.11 0 0 1 78 62.2c-17.06 16.06-40.15 32.53-62.07 45.13-27.55 15.81-51.45 25.67-70.51 31.07A79.94 79.94 0 0 1 128 48M24.74 187.29c-1.46-2.51-.65-7.24 2.22-13a79 79 0 0 1 10.29-15.05 96 96 0 0 0 18 31.32c-17.25 2.9-28.01 1.05-30.51-3.27M128 208a79.45 79.45 0 0 1-38.56-9.94 370 370 0 0 0 62.43-28.86c21.58-12.39 40.68-25.82 56.07-39.08A80.07 80.07 0 0 1 128 208M231.42 75.69c-1.7 6.31-6.19 13.53-12.63 21.13a95.7 95.7 0 0 0-18-31.35c14.21-2.35 27.37-2.17 30.5 3.24.9 1.57.95 3.92.13 6.98`},null,-1)]])}var W5t,G5t,K5t=s((()=>{W(),W5t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},G5t={render:U5t}})),q5t=l({default:()=>X5t,render:()=>J5t});function J5t(e,t){return F(),I(`svg`,Y5t,[...t[0]||=[R(`path`,{d:`M183.59 213.47a8 8 0 0 1-15.18 5.06l-8-24a8 8 0 0 1 15.18-5.06ZM128 184a8 8 0 0 0-8 8v32a8 8 0 0 0 16 0v-32a8 8 0 0 0-8-8m-37.47.41a8 8 0 0 0-10.12 5.06l-8 24a8 8 0 0 0 15.18 5.06l8-24a8 8 0 0 0-5.06-10.12M248 112c0 16.22-13.37 30.89-37.65 41.29C188.22 162.78 159 168 128 168s-60.22-5.22-82.35-14.71C21.37 142.89 8 128.22 8 112c0-8.37 3.67-20.79 21.17-32.5 11.37-7.61 26.94-13.76 45.18-17.85A63.64 63.64 0 0 1 173 50.45a64.8 64.8 0 0 1 9.11 11.3C223.43 71.09 248 89.74 248 112M80 96.83v3a7.92 7.92 0 0 0 6.13 7.76A188.2 188.2 0 0 0 128 112a188 188 0 0 0 41.85-4.37 7.93 7.93 0 0 0 6.15-7.76V96a48 48 0 0 0-48.64-48C101.25 48.34 80 70.25 80 96.83M232 112c0-11.7-16.63-23.89-41.9-31.59A64.7 64.7 0 0 1 192 96v3.92a23.86 23.86 0 0 1-18.56 23.3A204 204 0 0 1 128 128a204 204 0 0 1-45.44-4.78A23.86 23.86 0 0 1 64 99.92v-3.06a65.3 65.3 0 0 1 2.13-16.52C40.72 88 24 100.25 24 112c0 18.92 42.71 40 104 40s104-21.08 104-40`},null,-1)]])}var Y5t,X5t,Z5t=s((()=>{W(),Y5t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},X5t={render:J5t}})),Q5t=l({default:()=>t7t,render:()=>$5t});function $5t(e,t){return F(),I(`svg`,e7t,[...t[0]||=[R(`path`,{d:`M176 160a39.9 39.9 0 0 0-28.62 12.09l-46.1-29.63a39.8 39.8 0 0 0 0-28.92l46.1-29.63a40 40 0 1 0-8.66-13.45l-46.1 29.63a40 40 0 1 0 0 55.82l46.1 29.63A40 40 0 1 0 176 160m0-128a24 24 0 1 1-24 24 24 24 0 0 1 24-24M64 152a24 24 0 1 1 24-24 24 24 0 0 1-24 24m112 72a24 24 0 1 1 24-24 24 24 0 0 1-24 24`},null,-1)]])}var e7t,t7t,n7t=s((()=>{W(),e7t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},t7t={render:$5t}})),r7t=l({default:()=>o7t,render:()=>i7t});function i7t(e,t){return F(),I(`svg`,a7t,[...t[0]||=[R(`path`,{d:`M240 128a8 8 0 0 1-8 8h-27.06l-37.78 75.58A8 8 0 0 1 160 216h-.4a8 8 0 0 1-7.08-5.14L95.35 60.76l-32.07 70.55A8 8 0 0 1 56 136H24a8 8 0 0 1 0-16h26.85l37.87-83.31a8 8 0 0 1 14.76.46l57.51 151 31.85-63.71A8 8 0 0 1 200 120h32a8 8 0 0 1 8 8`},null,-1)]])}var a7t,o7t,s7t=s((()=>{W(),a7t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},o7t={render:i7t}})),c7t=l({default:()=>d7t,render:()=>l7t});function l7t(e,t){return F(),I(`svg`,u7t,[...t[0]||=[R(`path`,{d:`M128 24a104 104 0 1 0 104 104A104.11 104.11 0 0 0 128 24m0 192a88 88 0 1 1 88-88 88.1 88.1 0 0 1-88 88m64-88a8 8 0 0 1-8 8h-56a8 8 0 0 1-8-8V72a8 8 0 0 1 16 0v48h48a8 8 0 0 1 8 8`},null,-1)]])}var u7t,d7t,f7t=s((()=>{W(),u7t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},d7t={render:l7t}})),p7t=l({default:()=>g7t,render:()=>m7t});function m7t(e,t){return F(),I(`svg`,h7t,[...t[0]||=[R(`path`,{d:`M184 24H72a16 16 0 0 0-16 16v36a16.07 16.07 0 0 0 6.4 12.8l52.27 39.2-52.27 39.2A16.07 16.07 0 0 0 56 180v36a16 16 0 0 0 16 16h112a16 16 0 0 0 16-16v-35.64a16.09 16.09 0 0 0-6.35-12.77L141.27 128l52.38-39.6A16.05 16.05 0 0 0 200 75.64V40a16 16 0 0 0-16-16m0 16v16H72V40Zm0 176H72v-36l56-42 56 42.35Zm-56-98L72 76v-4h112v3.64Z`},null,-1)]])}var h7t,g7t,_7t=s((()=>{W(),h7t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},g7t={render:m7t}})),v7t=l({default:()=>x7t,render:()=>y7t});function y7t(e,t){return F(),I(`svg`,b7t,[...t[0]||=[R(`path`,{d:`M117.25 157.92a60 60 0 1 0-66.5 0 95.83 95.83 0 0 0-47.22 37.71 8 8 0 1 0 13.4 8.74 80 80 0 0 1 134.14 0 8 8 0 0 0 13.4-8.74 95.83 95.83 0 0 0-47.22-37.71M40 108a44 44 0 1 1 44 44 44.05 44.05 0 0 1-44-44m210.14 98.7a8 8 0 0 1-11.07-2.33A79.83 79.83 0 0 0 172 168a8 8 0 0 1 0-16 44 44 0 1 0-16.34-84.87 8 8 0 1 1-5.94-14.85 60 60 0 0 1 55.53 105.64 95.83 95.83 0 0 1 47.22 37.71 8 8 0 0 1-2.33 11.07`},null,-1)]])}var b7t,x7t,S7t=s((()=>{W(),b7t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},x7t={render:y7t}})),C7t=l({default:()=>E7t,render:()=>w7t});function w7t(e,t){return F(),I(`svg`,T7t,[...t[0]||=[R(`path`,{d:`M233.54 142.23a8 8 0 0 0-8-2 88.08 88.08 0 0 1-109.8-109.8 8 8 0 0 0-10-10 104.84 104.84 0 0 0-52.91 37A104 104 0 0 0 136 224a103.1 103.1 0 0 0 62.52-20.88 104.84 104.84 0 0 0 37-52.91 8 8 0 0 0-1.98-7.98m-44.64 48.11A88 88 0 0 1 65.66 67.11a89 89 0 0 1 31.4-26A106 106 0 0 0 96 56a104.11 104.11 0 0 0 104 104 106 106 0 0 0 14.92-1.06 89 89 0 0 1-26.02 31.4`},null,-1)]])}var T7t,E7t,D7t=s((()=>{W(),T7t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},E7t={render:w7t}})),O7t=l({default:()=>j7t,render:()=>k7t});function k7t(e,t){return F(),I(`svg`,A7t,[...t[0]||=[R(`path`,{d:`M216 48H40a16 16 0 0 0-16 16v160a15.84 15.84 0 0 0 9.25 14.5A16.05 16.05 0 0 0 40 240a15.9 15.9 0 0 0 10.25-3.78l.09-.07L83 208h133a16 16 0 0 0 16-16V64a16 16 0 0 0-16-16m0 144H80a8 8 0 0 0-5.23 1.95L40 224V64h176Z`},null,-1)]])}var A7t,j7t,M7t=s((()=>{W(),A7t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},j7t={render:k7t}})),N7t=l({default:()=>I7t,render:()=>P7t});function P7t(e,t){return F(),I(`svg`,F7t,[...t[0]||=[R(`path`,{d:`M227.32 28.68a16 16 0 0 0-15.66-4.08h-.15L19.57 82.84a16 16 0 0 0-2.49 29.8L102 154l41.3 84.87a15.86 15.86 0 0 0 14.44 9.13q.69 0 1.38-.06a15.88 15.88 0 0 0 14-11.51l58.2-191.94v-.15a16 16 0 0 0-4-15.66m-69.49 203.17-.05.14v-.07l-40.06-82.3 48-48a8 8 0 0 0-11.31-11.31l-48 48-82.33-40.06h-.07.14L216 40Z`},null,-1)]])}var F7t,I7t,L7t=s((()=>{W(),F7t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},I7t={render:P7t}})),R7t=l({default:()=>V7t,render:()=>z7t});function z7t(e,t){return F(),I(`svg`,B7t,[...t[0]||=[R(`path`,{d:`M224 48H32a8 8 0 0 0-8 8v136a16 16 0 0 0 16 16h176a16 16 0 0 0 16-16V56a8 8 0 0 0-8-8m-96 85.15L52.57 64h150.86ZM98.71 128 40 181.81V74.19Zm11.84 10.85 12 11.05a8 8 0 0 0 10.82 0l12-11.05 58 53.15H52.57ZM157.29 128 216 74.18v107.64Z`},null,-1)]])}var B7t,V7t,H7t=s((()=>{W(),B7t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},V7t={render:z7t}})),U7t=l({default:()=>K7t,render:()=>W7t});function W7t(e,t){return F(),I(`svg`,G7t,[...t[0]||=[R(`path`,{d:`M96 104a8 8 0 0 1 8-8h64a8 8 0 0 1 0 16h-64a8 8 0 0 1-8-8m8 40h64a8 8 0 0 0 0-16h-64a8 8 0 0 0 0 16m128 48a32 32 0 0 1-32 32H88a32 32 0 0 1-32-32V64a16 16 0 0 0-32 0c0 5.74 4.83 9.62 4.88 9.66A8 8 0 0 1 24 88a7.9 7.9 0 0 1-4.79-1.61C18.05 85.54 8 77.61 8 64a32 32 0 0 1 32-32h136a32 32 0 0 1 32 32v104h8a8 8 0 0 1 4.8 1.6c1.2.86 11.2 8.79 11.2 22.4M96.26 173.48A8.07 8.07 0 0 1 104 168h88V64a16 16 0 0 0-16-16H67.69A31.7 31.7 0 0 1 72 64v128a16 16 0 0 0 32 0c0-5.74-4.83-9.62-4.88-9.66a7.82 7.82 0 0 1-2.86-8.86M216 192a12.58 12.58 0 0 0-3.23-8h-94a27 27 0 0 1 1.21 8 31.8 31.8 0 0 1-4.29 16H200a16 16 0 0 0 16-16`},null,-1)]])}var G7t,K7t,q7t=s((()=>{W(),G7t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},K7t={render:W7t}})),J7t=l({default:()=>Z7t,render:()=>Y7t});function Y7t(e,t){return F(),I(`svg`,X7t,[...t[0]||=[R(`path`,{stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,d:`M12 2v20m5-17H9.5a3.5 3.5 0 1 0 0 7h5a3.5 3.5 0 1 1 0 7H6`},null,-1)]])}var X7t,Z7t,Q7t=s((()=>{W(),X7t={xmlns:`http://www.w3.org/2000/svg`,fill:`none`,viewBox:`0 0 24 24`},Z7t={render:Y7t}})),$7t=l({default:()=>n9t,render:()=>e9t});function e9t(e,t){return F(),I(`svg`,t9t,[...t[0]||=[R(`path`,{d:`M152 120h-16V56h8a32 32 0 0 1 32 32 8 8 0 0 0 16 0 48.05 48.05 0 0 0-48-48h-8V24a8 8 0 0 0-16 0v16h-8a48 48 0 0 0 0 96h8v64h-16a32 32 0 0 1-32-32 8 8 0 0 0-16 0 48.05 48.05 0 0 0 48 48h16v16a8 8 0 0 0 16 0v-16h16a48 48 0 0 0 0-96m-40 0a32 32 0 0 1 0-64h8v64Zm40 80h-16v-64h16a32 32 0 0 1 0 64`},null,-1)]])}var t9t,n9t,r9t=s((()=>{W(),t9t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},n9t={render:e9t}})),i9t=l({default:()=>s9t,render:()=>a9t});function a9t(e,t){return F(),I(`svg`,o9t,[...t[0]||=[R(`path`,{d:`M216 40h-80V24a8 8 0 0 0-16 0v16H40a16 16 0 0 0-16 16v120a16 16 0 0 0 16 16h39.36l-21.61 27a8 8 0 0 0 12.5 10l29.59-37h56.32l29.59 37a8 8 0 1 0 12.5-10l-21.61-27H216a16 16 0 0 0 16-16V56a16 16 0 0 0-16-16m0 136H40V56h176zm-112-56v24a8 8 0 0 1-16 0v-24a8 8 0 0 1 16 0m32-16v40a8 8 0 0 1-16 0v-40a8 8 0 0 1 16 0m32-16v56a8 8 0 0 1-16 0V88a8 8 0 0 1 16 0`},null,-1)]])}var o9t,s9t,c9t=s((()=>{W(),o9t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},s9t={render:a9t}})),l9t=l({default:()=>f9t,render:()=>u9t});function u9t(e,t){return F(),I(`svg`,d9t,[...t[0]||=[R(`path`,{d:`M223.45 40.07a8 8 0 0 0-7.52-7.52C139.8 28.08 78.82 51 52.82 94a87.1 87.1 0 0 0-12.76 49c.57 15.92 5.21 32 13.79 47.85l-19.51 19.5a8 8 0 0 0 11.32 11.32l19.5-19.51C81 210.73 97.09 215.37 113 215.94q1.67.06 3.33.06A86.93 86.93 0 0 0 162 203.18c43-26 65.93-86.97 61.45-163.11m-69.7 149.43c-22.75 13.78-49.68 14-76.71.77l88.63-88.62a8 8 0 0 0-11.32-11.32L65.73 179c-13.19-27-13-54 .77-76.71 22.09-36.47 74.6-56.44 141.31-54.06 2.39 66.66-17.59 119.18-54.06 141.27`},null,-1)]])}var d9t,f9t,p9t=s((()=>{W(),d9t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},f9t={render:u9t}})),m9t=l({default:()=>_9t,render:()=>h9t});function h9t(e,t){return F(),I(`svg`,g9t,[...t[0]||=[R(`path`,{d:`m222.37 158.46-47.11-21.11-.13-.06a16 16 0 0 0-15.17 1.4 8 8 0 0 0-.75.56L134.87 160c-15.42-7.49-31.34-23.29-38.83-38.51l20.78-24.71c.2-.25.39-.5.57-.77a16 16 0 0 0 1.32-15.06v-.12L97.54 33.64a16 16 0 0 0-16.62-9.52A56.26 56.26 0 0 0 32 80c0 79.4 64.6 144 144 144a56.26 56.26 0 0 0 55.88-48.92 16 16 0 0 0-9.51-16.62M176 208A128.14 128.14 0 0 1 48 80a40.2 40.2 0 0 1 34.87-40 .6.6 0 0 0 0 .12l21 47-20.67 24.74a6 6 0 0 0-.57.77 16 16 0 0 0-1 15.7c9.06 18.53 27.73 37.06 46.46 46.11a16 16 0 0 0 15.75-1.14 8 8 0 0 0 .74-.56L168.89 152l47 21.05h.11A40.21 40.21 0 0 1 176 208`},null,-1)]])}var g9t,_9t,v9t=s((()=>{W(),g9t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},_9t={render:h9t}})),y9t=l({default:()=>S9t,render:()=>b9t});function b9t(e,t){return F(),I(`svg`,x9t,[...t[0]||=[R(`path`,{d:`M208 152h16a8 8 0 0 0 0-16h-16v-16h16a8 8 0 0 0 0-16h-16.4a79.76 79.76 0 0 0-21.44-46.85l19.5-19.49a8 8 0 0 0-11.32-11.32l-20.29 20.3a79.74 79.74 0 0 0-92.1 0l-20.29-20.3a8 8 0 0 0-11.32 11.32l19.5 19.49A79.76 79.76 0 0 0 48.4 104H32a8 8 0 0 0 0 16h16v16H32a8 8 0 0 0 0 16h16v8c0 2.7.14 5.37.4 8H32a8 8 0 0 0 0 16h19.68a80 80 0 0 0 152.64 0H224a8 8 0 0 0 0-16h-16.4c.26-2.63.4-5.3.4-8ZM128 48a64.07 64.07 0 0 1 63.48 56h-127A64.07 64.07 0 0 1 128 48m8 175.48V144a8 8 0 0 0-16 0v79.48A64.07 64.07 0 0 1 64 160v-40h128v40a64.07 64.07 0 0 1-56 63.48`},null,-1)]])}var x9t,S9t,C9t=s((()=>{W(),x9t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},S9t={render:b9t}})),w9t=l({default:()=>D9t,render:()=>T9t});function T9t(e,t){return F(),I(`svg`,E9t,[...t[0]||=[R(`path`,{d:`M160 40a88.09 88.09 0 0 0-78.71 48.67A64 64 0 1 0 72 216h88a88 88 0 0 0 0-176m0 160H72a48 48 0 0 1 0-96c1.1 0 2.2 0 3.29.11A88 88 0 0 0 72 128a8 8 0 0 0 16 0 72 72 0 1 1 72 72`},null,-1)]])}var E9t,D9t,O9t=s((()=>{W(),E9t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},D9t={render:T9t}})),k9t=l({default:()=>M9t,render:()=>A9t});function A9t(e,t){return F(),I(`svg`,j9t,[...t[0]||=[R(`path`,{d:`M208 136H48a16 16 0 0 0-16 16v48a16 16 0 0 0 16 16h160a16 16 0 0 0 16-16v-48a16 16 0 0 0-16-16m0 64H48v-48h160zm0-160H48a16 16 0 0 0-16 16v48a16 16 0 0 0 16 16h160a16 16 0 0 0 16-16V56a16 16 0 0 0-16-16m0 64H48V56h160zm-16-24a12 12 0 1 1-12-12 12 12 0 0 1 12 12m0 96a12 12 0 1 1-12-12 12 12 0 0 1 12 12`},null,-1)]])}var j9t,M9t,N9t=s((()=>{W(),j9t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},M9t={render:A9t}})),P9t=l({default:()=>L9t,render:()=>F9t});function F9t(e,t){return F(),I(`svg`,I9t,[...t[0]||=[R(`path`,{d:`M128 24c-53.83 0-96 24.6-96 56v96c0 31.4 42.17 56 96 56s96-24.6 96-56V80c0-31.4-42.17-56-96-56m80 104c0 9.62-7.88 19.43-21.61 26.92C170.93 163.35 150.19 168 128 168s-42.93-4.65-58.39-13.08C55.88 147.43 48 137.62 48 128v-16.64c17.06 15 46.23 24.64 80 24.64s62.94-9.68 80-24.64ZM69.61 53.08C85.07 44.65 105.81 40 128 40s42.93 4.65 58.39 13.08C200.12 60.57 208 70.38 208 80s-7.88 19.43-21.61 26.92C170.93 115.35 150.19 120 128 120s-42.93-4.65-58.39-13.08C55.88 99.43 48 89.62 48 80s7.88-19.43 21.61-26.92m116.78 149.84C170.93 211.35 150.19 216 128 216s-42.93-4.65-58.39-13.08C55.88 195.43 48 185.62 48 176v-16.64c17.06 15 46.23 24.64 80 24.64s62.94-9.68 80-24.64V176c0 9.62-7.88 19.43-21.61 26.92`},null,-1)]])}var I9t,L9t,R9t=s((()=>{W(),I9t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},L9t={render:F9t}})),z9t=l({default:()=>H9t,render:()=>B9t});function B9t(e,t){return F(),I(`svg`,V9t,[...t[0]||=[R(`path`,{d:`M104 40H56a16 16 0 0 0-16 16v48a16 16 0 0 0 16 16h48a16 16 0 0 0 16-16V56a16 16 0 0 0-16-16m0 64H56V56h48zm96-64h-48a16 16 0 0 0-16 16v48a16 16 0 0 0 16 16h48a16 16 0 0 0 16-16V56a16 16 0 0 0-16-16m0 64h-48V56h48zm-96 32H56a16 16 0 0 0-16 16v48a16 16 0 0 0 16 16h48a16 16 0 0 0 16-16v-48a16 16 0 0 0-16-16m0 64H56v-48h48zm96-64h-48a16 16 0 0 0-16 16v48a16 16 0 0 0 16 16h48a16 16 0 0 0 16-16v-48a16 16 0 0 0-16-16m0 64h-48v-48h48z`},null,-1)]])}var V9t,H9t,U9t=s((()=>{W(),V9t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},H9t={render:B9t}})),W9t=l({default:()=>q9t,render:()=>G9t});function G9t(e,t){return F(),I(`svg`,K9t,[...t[0]||=[R(`path`,{d:`M192 32H64a32 32 0 0 0-32 32v128a32 32 0 0 0 32 32h128a32 32 0 0 0 32-32V64a32 32 0 0 0-32-32m16 160a16 16 0 0 1-16 16H64a16 16 0 0 1-16-16V64a16 16 0 0 1 16-16h128a16 16 0 0 1 16 16ZM104 92a12 12 0 1 1-12-12 12 12 0 0 1 12 12m36 36a12 12 0 1 1-12-12 12 12 0 0 1 12 12m36 36a12 12 0 1 1-12-12 12 12 0 0 1 12 12`},null,-1)]])}var K9t,q9t,J9t=s((()=>{W(),K9t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},q9t={render:G9t}})),Y9t=l({default:()=>Q9t,render:()=>X9t});function X9t(e,t){return F(),I(`svg`,Z9t,[...t[0]||=[R(`path`,{d:`m223.68 66.15-88-48.15a15.88 15.88 0 0 0-15.36 0l-88 48.17a16 16 0 0 0-8.32 14v95.64a16 16 0 0 0 8.32 14l88 48.17a15.88 15.88 0 0 0 15.36 0l88-48.17a16 16 0 0 0 8.32-14V80.18a16 16 0 0 0-8.32-14.03M128 32l80.34 44L128 120 47.66 76ZM40 90l80 43.78v85.79l-80-43.75Zm96 129.57v-85.75L216 90v85.78Z`},null,-1)]])}var Z9t,Q9t,$9t=s((()=>{W(),Z9t={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},Q9t={render:X9t}})),een=l({default:()=>ren,render:()=>ten});function ten(e,t){return F(),I(`svg`,nen,[...t[0]||=[R(`path`,{d:`M128 128a8 8 0 0 1-3 6.25l-40 32a8 8 0 1 1-10-12.5L107.19 128 75 102.25a8 8 0 1 1 10-12.5l40 32a8 8 0 0 1 3 6.25m48 24h-40a8 8 0 0 0 0 16h40a8 8 0 0 0 0-16m56-96v144a16 16 0 0 1-16 16H40a16 16 0 0 1-16-16V56a16 16 0 0 1 16-16h176a16 16 0 0 1 16 16m-16 144V56H40v144z`},null,-1)]])}var nen,ren,ien=s((()=>{W(),nen={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},ren={render:ten}})),aen=l({default:()=>cen,render:()=>oen});function oen(e,t){return F(),I(`svg`,sen,[...t[0]||=[R(`path`,{d:`M104 216a16 16 0 1 1-16-16 16 16 0 0 1 16 16m88-16a16 16 0 1 0 16 16 16 16 0 0 0-16-16m47.71-125.86-25.64 92.28A24.06 24.06 0 0 1 191 184H92.16A24.06 24.06 0 0 1 69 166.42L33.92 40H16a8 8 0 0 1 0-16h24a8 8 0 0 1 7.71 5.86L57.19 64H232a8 8 0 0 1 7.71 10.14M221.47 80H61.64l22.81 82.14a8 8 0 0 0 7.71 5.86H191a8 8 0 0 0 7.71-5.86Z`},null,-1)]])}var sen,cen,len=s((()=>{W(),sen={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},cen={render:oen}})),uen=l({default:()=>pen,render:()=>den});function den(e,t){return F(),I(`svg`,fen,[...t[0]||=[R(`path`,{d:`M216 72h-35.08c.39-.33.79-.65 1.17-1A29.53 29.53 0 0 0 192 49.57 32.62 32.62 0 0 0 158.44 16 29.53 29.53 0 0 0 137 25.91a55 55 0 0 0-9 14.48 55 55 0 0 0-9-14.48A29.53 29.53 0 0 0 97.56 16 32.62 32.62 0 0 0 64 49.57 29.53 29.53 0 0 0 73.91 71c.38.33.78.65 1.17 1H40a16 16 0 0 0-16 16v32a16 16 0 0 0 16 16v64a16 16 0 0 0 16 16h144a16 16 0 0 0 16-16v-64a16 16 0 0 0 16-16V88a16 16 0 0 0-16-16m-67-35.49a13.7 13.7 0 0 1 10-4.5h.49A16.62 16.62 0 0 1 176 49.08a13.7 13.7 0 0 1-4.5 10c-9.49 8.4-25.24 11.36-35 12.4 1.2-10.59 4.5-25.98 12.5-34.97m-64.09.36A16.63 16.63 0 0 1 96.59 32h.49a13.7 13.7 0 0 1 10 4.5c8.39 9.48 11.35 25.2 12.39 34.92-9.72-1-25.44-4-34.92-12.39a13.7 13.7 0 0 1-4.5-10 16.6 16.6 0 0 1 4.82-12.16ZM40 88h80v32H40Zm16 48h64v64H56Zm144 64h-64v-64h64Zm16-80h-80V88h80z`},null,-1)]])}var fen,pen,men=s((()=>{W(),fen={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},pen={render:den}})),hen=l({default:()=>ven,render:()=>gen});function gen(e,t){return F(),I(`svg`,_en,[...t[0]||=[R(`path`,{d:`m223.68 66.15-88-48.15a15.88 15.88 0 0 0-15.36 0l-88 48.17a16 16 0 0 0-8.32 14v95.64a16 16 0 0 0 8.32 14l88 48.17a15.88 15.88 0 0 0 15.36 0l88-48.17a16 16 0 0 0 8.32-14V80.18a16 16 0 0 0-8.32-14.03M128 32l80.34 44-29.77 16.3-80.35-44Zm0 88L47.66 76l33.9-18.56 80.34 44ZM40 90l80 43.78v85.79l-80-43.75Zm176 85.78-80 43.79v-85.75l32-17.51V152a8 8 0 0 0 16 0v-44.45L216 90v85.77Z`},null,-1)]])}var _en,ven,yen=s((()=>{W(),_en={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},ven={render:gen}})),ben=l({default:()=>Cen,render:()=>xen});function xen(e,t){return F(),I(`svg`,Sen,[...t[0]||=[R(`path`,{d:`M232 208h-18.31L153.42 34.75A16 16 0 0 0 138.31 24h-20.62a16 16 0 0 0-15.11 10.74L42.31 208H24a8 8 0 0 0 0 16h208a8 8 0 0 0 0-16M95.43 104h65.14l16.7 48H78.73Zm22.26-64h20.62L155 88h-54ZM73.17 168h109.66l13.92 40H59.25Z`},null,-1)]])}var Sen,Cen,wen=s((()=>{W(),Sen={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},Cen={render:xen}})),Ten=l({default:()=>Oen,render:()=>Een});function Een(e,t){return F(),I(`svg`,Den,[...t[0]||=[R(`path`,{d:`M128 24a104 104 0 1 0 104 104A104.11 104.11 0 0 0 128 24m88 104a87.6 87.6 0 0 1-6.4 32.94l-44.7-27.49a15.9 15.9 0 0 0-6.24-2.23l-22.82-3.08a16.11 16.11 0 0 0-16 7.86h-8.72l-3.8-7.86a15.91 15.91 0 0 0-11-8.67l-8-1.73L96.14 104h16.71a16.06 16.06 0 0 0 7.73-2l12.25-6.76a16.6 16.6 0 0 0 3-2.14l26.91-24.34A15.93 15.93 0 0 0 166 49.1l-.36-.65A88.11 88.11 0 0 1 216 128m-72.69-86.66L152 56.9l-26.91 24.34L112.85 88H96.14a16 16 0 0 0-13.88 8l-8.73 15.23-10.15-27.04 10.94-25.87a87.87 87.87 0 0 1 69-17ZM40 128a87.5 87.5 0 0 1 8.54-37.8l11.34 30.27a16 16 0 0 0 11.62 10l21.43 4.61 3.81 7.92a16.09 16.09 0 0 0 14.4 9h1.48l-7.23 16.23a16 16 0 0 0 2.86 17.37l.14.14 19.61 20.2-1.94 10A88.11 88.11 0 0 1 40 128m102.58 86.78 1.13-5.81a16.09 16.09 0 0 0-4-13.9 2 2 0 0 1-.14-.14L120 174.74 133.7 144l22.82 3.08 45.72 28.12a88.18 88.18 0 0 1-59.66 39.58`},null,-1)]])}var Den,Oen,ken=s((()=>{W(),Den={xmlns:`http://www.w3.org/2000/svg`,fill:`currentColor`,viewBox:`0 0 256 256`},Oen={render:Een}}));async function Aen(e){let t=R4.get(e);if(t)return t;let n=L4[`./icons/${e}.svg`];if(!n)return;let r=await n(),i=Zee(r.default??r);return R4.set(e,i),i}var L4,R4,jen=s((()=>{W(),L4=Object.assign({"./icons/basic-shape-diamond.svg":()=>Promise.resolve().then(()=>(K2t(),H2t)),"./icons/basic-shape-hexagon.svg":()=>Promise.resolve().then(()=>(Z2t(),q2t)),"./icons/basic-shape-primary-circle-ellipse-round.svg":()=>Promise.resolve().then(()=>(n4t(),Q2t)),"./icons/basic-shape-primary-square-rectangle.svg":()=>Promise.resolve().then(()=>(s4t(),r4t)),"./icons/basic-shape-shield.svg":()=>Promise.resolve().then(()=>(f4t(),c4t)),"./icons/computer-device-desktop-monitor.svg":()=>Promise.resolve().then(()=>(_4t(),p4t)),"./icons/computer-device-desktop.svg":()=>Promise.resolve().then(()=>(S4t(),v4t)),"./icons/computer-device-laptop.svg":()=>Promise.resolve().then(()=>(D4t(),C4t)),"./icons/computer-device-mobile-phone-android-samsung-back.svg":()=>Promise.resolve().then(()=>(M4t(),O4t)),"./icons/computer-device-mobile-phone-android-samsung.svg":()=>Promise.resolve().then(()=>(L4t(),N4t)),"./icons/computer-device-mobile-phone-iphone-x-back.svg":()=>Promise.resolve().then(()=>(H4t(),R4t)),"./icons/computer-device-mobile-phone-iphone-x.svg":()=>Promise.resolve().then(()=>(q4t(),U4t)),"./icons/computer-device-mobile-tablet-touch.svg":()=>Promise.resolve().then(()=>(Q4t(),J4t)),"./icons/computer-device-mobile-tablet.svg":()=>Promise.resolve().then(()=>(r3t(),$4t)),"./icons/computer-device-network-ethernet-cat6.svg":()=>Promise.resolve().then(()=>(c3t(),i3t)),"./icons/computer-device-network-lan-www.svg":()=>Promise.resolve().then(()=>(p3t(),l3t)),"./icons/computer-device-network-wifi-connection.svg":()=>Promise.resolve().then(()=>(v3t(),m3t)),"./icons/computer-device-network-wifi-router.svg":()=>Promise.resolve().then(()=>(C3t(),y3t)),"./icons/ecology-science-erlenmeyer-flask.svg":()=>Promise.resolve().then(()=>(O3t(),w3t)),"./icons/image-flash-lightning.svg":()=>Promise.resolve().then(()=>(N3t(),k3t)),"./icons/image-picture-flower.svg":()=>Promise.resolve().then(()=>(R3t(),P3t)),"./icons/interface-alert-exclamation-diamond.svg":()=>Promise.resolve().then(()=>(U3t(),z3t)),"./icons/interface-alert-exclamation-triangle-warning.svg":()=>Promise.resolve().then(()=>(J3t(),W3t)),"./icons/interface-alert-information-circle.svg":()=>Promise.resolve().then(()=>($3t(),Y3t)),"./icons/interface-award-crown.svg":()=>Promise.resolve().then(()=>(i6t(),e6t)),"./icons/interface-bookmark-tag.svg":()=>Promise.resolve().then(()=>(l6t(),a6t)),"./icons/interface-bookmark.svg":()=>Promise.resolve().then(()=>(m6t(),u6t)),"./icons/interface-calendar-date-one.svg":()=>Promise.resolve().then(()=>(y6t(),h6t)),"./icons/interface-content-book-open-pages.svg":()=>Promise.resolve().then(()=>(w6t(),b6t)),"./icons/interface-content-book-page.svg":()=>Promise.resolve().then(()=>(k6t(),T6t)),"./icons/interface-content-file.svg":()=>Promise.resolve().then(()=>(P6t(),A6t)),"./icons/interface-content-folder.svg":()=>Promise.resolve().then(()=>(z6t(),F6t)),"./icons/interface-copy-clipboard.svg":()=>Promise.resolve().then(()=>(W6t(),B6t)),"./icons/interface-edit-attachment.svg":()=>Promise.resolve().then(()=>(Y6t(),G6t)),"./icons/interface-edit-binocular.svg":()=>Promise.resolve().then(()=>(e8t(),X6t)),"./icons/interface-edit-magic-wand.svg":()=>Promise.resolve().then(()=>(a8t(),t8t)),"./icons/interface-edit-tool-paint-roller.svg":()=>Promise.resolve().then(()=>(u8t(),o8t)),"./icons/interface-edit-tool-pencil.svg":()=>Promise.resolve().then(()=>(h8t(),d8t)),"./icons/interface-favorite-award.svg":()=>Promise.resolve().then(()=>(b8t(),g8t)),"./icons/interface-favorite-flag.svg":()=>Promise.resolve().then(()=>(T8t(),x8t)),"./icons/interface-favorite-heart.svg":()=>Promise.resolve().then(()=>(A8t(),E8t)),"./icons/interface-favorite-star.svg":()=>Promise.resolve().then(()=>(F8t(),j8t)),"./icons/interface-favorite-stars-sparkles.svg":()=>Promise.resolve().then(()=>(B8t(),I8t)),"./icons/interface-hierarchy-flowchart.svg":()=>Promise.resolve().then(()=>(G8t(),V8t)),"./icons/interface-home-house.svg":()=>Promise.resolve().then(()=>(X8t(),K8t)),"./icons/interface-hyperlink.svg":()=>Promise.resolve().then(()=>(t5t(),Z8t)),"./icons/interface-lighting-brightness.svg":()=>Promise.resolve().then(()=>(o5t(),n5t)),"./icons/interface-lock-closed.svg":()=>Promise.resolve().then(()=>(d5t(),s5t)),"./icons/interface-lock-open-unlock.svg":()=>Promise.resolve().then(()=>(g5t(),f5t)),"./icons/interface-login-key.svg":()=>Promise.resolve().then(()=>(x5t(),_5t)),"./icons/interface-search.svg":()=>Promise.resolve().then(()=>(E5t(),S5t)),"./icons/interface-setting-cog.svg":()=>Promise.resolve().then(()=>(j5t(),D5t)),"./icons/interface-share-megaphone-bullhorn.svg":()=>Promise.resolve().then(()=>(I5t(),M5t)),"./icons/interface-share-rocket.svg":()=>Promise.resolve().then(()=>(V5t(),L5t)),"./icons/interface-share-satellite.svg":()=>Promise.resolve().then(()=>(K5t(),H5t)),"./icons/interface-share-space-ship.svg":()=>Promise.resolve().then(()=>(Z5t(),q5t)),"./icons/interface-share.svg":()=>Promise.resolve().then(()=>(n7t(),Q5t)),"./icons/interface-signal-square.svg":()=>Promise.resolve().then(()=>(s7t(),r7t)),"./icons/interface-time-clock-circle.svg":()=>Promise.resolve().then(()=>(f7t(),c7t)),"./icons/interface-time-hour-glass.svg":()=>Promise.resolve().then(()=>(_7t(),p7t)),"./icons/interface-users-multiple.svg":()=>Promise.resolve().then(()=>(S7t(),v7t)),"./icons/interface-weather-moon.svg":()=>Promise.resolve().then(()=>(D7t(),C7t)),"./icons/mail-chat-bubble-square.svg":()=>Promise.resolve().then(()=>(M7t(),O7t)),"./icons/mail-send-email-paper-airplane.svg":()=>Promise.resolve().then(()=>(L7t(),N7t)),"./icons/mail-send-envelope.svg":()=>Promise.resolve().then(()=>(H7t(),R7t)),"./icons/money-cashier-receipt.svg":()=>Promise.resolve().then(()=>(q7t(),U7t)),"./icons/money-currency-dollar-pay.svg":()=>Promise.resolve().then(()=>(Q7t(),J7t)),"./icons/money-graph-arrow-increase.svg":()=>Promise.resolve().then(()=>(r9t(),$7t)),"./icons/money-graph-bar-chart-increase.svg":()=>Promise.resolve().then(()=>(c9t(),i9t)),"./icons/nature-ecology-leaf.svg":()=>Promise.resolve().then(()=>(p9t(),l9t)),"./icons/phone-telephone.svg":()=>Promise.resolve().then(()=>(v9t(),m9t)),"./icons/programming-bug.svg":()=>Promise.resolve().then(()=>(C9t(),y9t)),"./icons/programming-cloud.svg":()=>Promise.resolve().then(()=>(O9t(),w9t)),"./icons/programming-computer-database-server.svg":()=>Promise.resolve().then(()=>(N9t(),k9t)),"./icons/programming-computer-database.svg":()=>Promise.resolve().then(()=>(R9t(),P9t)),"./icons/programming-module-four-layout.svg":()=>Promise.resolve().then(()=>(U9t(),z9t)),"./icons/programming-module-three.svg":()=>Promise.resolve().then(()=>(J9t(),W9t)),"./icons/programming-module.svg":()=>Promise.resolve().then(()=>($9t(),Y9t)),"./icons/programming-script-code.svg":()=>Promise.resolve().then(()=>(ien(),een)),"./icons/shopping-cart.svg":()=>Promise.resolve().then(()=>(len(),aen)),"./icons/shopping-gift-present.svg":()=>Promise.resolve().then(()=>(men(),uen)),"./icons/shopping-shipping-box-parcel-package.svg":()=>Promise.resolve().then(()=>(yen(),hen)),"./icons/tag-new-circle.svg":()=>Promise.resolve().then(()=>(wen(),ben)),"./icons/travel-map-earth-globe.svg":()=>Promise.resolve().then(()=>(ken(),Ten))}),Object.keys(L4).map(e=>e.replace(`./icons/`,``).replace(`.svg`,``)).map(e=>({src:e,title:e.replaceAll(`-`,` `),tags:[]})),R4=new Map})),Men,Nen=s((()=>{jen(),W(),Men=N({__name:`LibraryIcon`,props:{src:{}},setup(e){let t=e,n=Sn();return pr(async()=>{n.value=await Aen(t.src)}),(e,t)=>n.value?(F(),L(kr(n.value),{key:0})):B(``,!0)}})})),Pen,Fen=s((()=>{Nen(),Pen=Men})),Ien=s((()=>{Fen()})),Len,Ren,zen,Ben=s((()=>{C2t(),F2t(),I2t(),R2t(),D2t(),j2t(),V2t(),W(),kE(),Ien(),Len={key:0,class:`line-through`},Ren={key:0,class:`line-through`},zen=N({__name:`SidebarItem`,props:{item:{},layout:{},isSelected:{type:Function},isExpanded:{type:Function},options:{},isDraggable:{},isDroppable:{type:Function}},emits:[`selectItem`,`onDragEnd`,`toggleGroup`],setup(e,{emit:t}){let n=t,r=Pr(),i=e=>`isGroup`in e&&e.isGroup,a=e=>(`isDeprecated`in e&&e.isDeprecated)??!1,o=(e,t)=>{n(`onDragEnd`,e,t)},{draggableAttrs:s,draggableEvents:c}=w2t({id:e.item.id,isDraggable:e.isDraggable,isDroppable:e.isDroppable,onDragEnd:o}),l=U(()=>F4(e.item)?k4(e.layout,e.item.children,e.options?.hideOperationDefaultExamples):[]);return(t,u)=>{let d=$te(`SidebarItem`,!0);return l.value.length>0&&i(e.item)?(F(),L(j(p2e),ai({key:0,"data-sidebar-id":e.item.id},j(s),Nr(j(c))),{items:M(()=>[(F(!0),I(V,null,Ar(l.value,i=>(F(),L(d,{key:i.id,isDraggable:e.isDraggable,isDroppable:e.isDroppable,isExpanded:e.isExpanded,isSelected:e.isSelected,item:i,layout:e.layout,options:e.options,onOnDragEnd:o,onSelectItem:u[0]||=e=>n(`selectItem`,e),onToggleGroup:u[1]||=e=>n(`toggleGroup`,e)},jr({_:2},[r.decorator?{name:`decorator`,fn:M(e=>[P(t.$slots,`decorator`,ai({ref_for:!0},e))]),key:`0`}:void 0,r.empty?{name:`empty`,fn:M(e=>[P(t.$slots,`empty`,ai({ref_for:!0},e))]),key:`1`}:void 0,r.icon?{name:`icon`,fn:M(e=>[P(t.$slots,`icon`,ai({ref_for:!0},e))]),key:`2`}:void 0]),1032,[`isDraggable`,`isDroppable`,`isExpanded`,`isSelected`,`item`,`layout`,`options`]))),128))]),default:M(()=>[z(k(e.item.title)+` `,1)]),_:3},16,[`data-sidebar-id`])):j(L2t)(e.layout,e.item,r.empty!==void 0,e.options?.hideOperationDefaultExamples??!1)?(F(),L(j(B0e),ai({key:1,active:e.isSelected(e.item.id),class:`relative`,controlled:``,"data-sidebar-id":e.item.id},j(s),{discrete:e.layout===`reference`&&e.item.type===`text`,open:e.isExpanded(e.item.id)},Nr(j(c)),{onClick:u[4]||=()=>n(`selectItem`,e.item.id),onToggle:u[5]||=()=>n(`toggleGroup`,e.item.id)}),jr({items:M(()=>[(F(!0),I(V,null,Ar(l.value,i=>(F(),L(d,{key:i.id,isDraggable:e.isDraggable,isDroppable:e.isDroppable,isExpanded:e.isExpanded,isSelected:e.isSelected,item:i,layout:e.layout,options:e.options,parentIds:[],onOnDragEnd:o,onSelectItem:u[2]||=e=>n(`selectItem`,e),onToggleGroup:u[3]||=e=>n(`toggleGroup`,e)},jr({_:2},[r.decorator?{name:`decorator`,fn:M(e=>[P(t.$slots,`decorator`,ai({ref_for:!0},e))]),key:`0`}:void 0,r.empty?{name:`empty`,fn:M(e=>[P(t.$slots,`empty`,ai({ref_for:!0},e))]),key:`1`}:void 0,r.icon?{name:`icon`,fn:M(e=>[P(t.$slots,`icon`,ai({ref_for:!0},e))]),key:`2`}:void 0]),1032,[`isDraggable`,`isDroppable`,`isExpanded`,`isSelected`,`item`,`layout`,`options`]))),128)),r.empty&&(e.item.children?.length??0)===0?P(t.$slots,`empty`,{key:0,item:e.item}):B(``,!0)]),default:M(()=>[a(e.item)?(F(),I(`span`,Len,[H(I4,{item:e.item,operationTitleSource:e.options?.operationTitleSource},null,8,[`item`,`operationTitleSource`])])):(F(),L(I4,{key:1,item:e.item,operationTitleSource:e.options?.operationTitleSource},null,8,[`item`,`operationTitleSource`]))]),_:2},[e.item.type===`document`?{name:`icon`,fn:M(({open:n})=>[P(t.$slots,`icon`,{item:e.item,open:n},()=>[H(j(Pen),{class:`block`,src:`icon`in e.item&&e.item.icon||`interface-content-folder`},null,8,[`src`])])]),key:`0`}:void 0,`method`in e.item?{name:`aside`,fn:M(()=>[H(N4,{active:e.isSelected(e.item.id),class:O([`ml-2 h-4 self-start`,{"group-hover/button:opacity-0 group-focus-visible/button:opacity-0 group-has-[~*_[aria-expanded=true]]/button:opacity-0 group-has-[~*:focus-within]/button:opacity-0 group-has-[~*:hover]/button:opacity-0":r.decorator}]),method:e.item.method,webhook:e.item.type===`webhook`},null,8,[`active`,`class`,`method`,`webhook`])]),key:`1`}:void 0,`method`in e.item?{name:`toggle`,fn:M(()=>[]),key:`2`}:void 0,r.decorator?{name:`after`,fn:M(()=>[H(P4,null,{default:M(()=>[P(t.$slots,`decorator`,{item:e.item})]),_:3})]),key:`3`}:void 0]),1040,[`active`,`data-sidebar-id`,`discrete`,`open`])):(F(),L(j(mE),ai({key:2,is:`button`},j(s),{class:`relative`,"data-sidebar-id":e.item.id,selected:e.isSelected(e.item.id)},Nr(j(c)),{onClick:u[6]||=()=>n(`selectItem`,e.item.id)}),jr({default:M(()=>[a(e.item)?(F(),I(`span`,Ren,[H(I4,{item:e.item,operationTitleSource:e.options?.operationTitleSource},null,8,[`item`,`operationTitleSource`])])):(F(),L(I4,{key:1,item:e.item,operationTitleSource:e.options?.operationTitleSource},null,8,[`item`,`operationTitleSource`]))]),_:2},[r.icon?{name:`icon`,fn:M(()=>[P(t.$slots,`icon`,{item:e.item,open:!0})]),key:`0`}:void 0,`method`in e.item?{name:`aside`,fn:M(()=>[`method`in e.item?(F(),L(N4,{key:0,active:e.isSelected(e.item.id),class:O([`ml-2 h-4 self-start`,{"group-hover/button:opacity-0 group-focus-visible/button:opacity-0 group-has-[~*_[aria-expanded=true]]/button:opacity-0 group-has-[~*:focus-within]/button:opacity-0 group-has-[~*:hover]/button:opacity-0":r.decorator}]),method:e.item.method,webhook:e.item.type===`webhook`},null,8,[`active`,`class`,`method`,`webhook`])):B(``,!0)]),key:`1`}:void 0,r.decorator?{name:`after`,fn:M(()=>[H(P4,null,{default:M(()=>[P(t.$slots,`decorator`,{item:e.item})]),_:3})]),key:`2`}:void 0]),1040,[`data-sidebar-id`,`selected`]))}}})})),Ven,Hen=s((()=>{Ben(),Ven=zen})),Uen,Wen=s((()=>{C2t(),Hen(),W(),kE(),Uen=N({__name:`ScalarSidebar`,props:{layout:{},items:{},isSelected:{type:Function},isExpanded:{type:Function},options:{},indent:{default:20},isDraggable:{},isDroppable:{type:Function}},emits:[`reorder`,`selectItem`,`toggleGroup`],setup(e,{emit:t}){let n=t,r=Pr(),i=(e,t)=>{n(`reorder`,e,t)};return(t,a)=>(F(),L(j(d0e),{class:`flex min-h-0 flex-col`,style:it({"--scalar-sidebar-indent":e.indent+`px`})},{default:M(()=>[P(t.$slots,`header`),P(t.$slots,`default`,{},()=>[H(j(q0e),{class:`custom-scroll`},{default:M(()=>[P(t.$slots,`before`),(F(!0),I(V,null,Ar(j(k4)(e.layout,e.items),o=>(F(),L(Ven,{key:o.id,isDraggable:e.isDraggable??e.layout===`client`,isDroppable:e.isDroppable,isExpanded:e.isExpanded,isSelected:e.isSelected,item:o,layout:e.layout,options:e.options,onOnDragEnd:i,onSelectItem:a[0]||=e=>n(`selectItem`,e),onToggleGroup:a[1]||=e=>n(`toggleGroup`,e)},jr({_:2},[r.decorator?{name:`decorator`,fn:M(e=>[P(t.$slots,`decorator`,ai({ref_for:!0},e))]),key:`0`}:void 0,r.empty?{name:`empty`,fn:M(e=>[P(t.$slots,`empty`,ai({ref_for:!0},e))]),key:`1`}:void 0,r.icon?{name:`icon`,fn:M(e=>[P(t.$slots,`icon`,ai({ref_for:!0},e))]),key:`2`}:void 0]),1032,[`isDraggable`,`isDroppable`,`isExpanded`,`isSelected`,`item`,`layout`,`options`]))),128))]),_:3}),P(t.$slots,`spacer`,{},()=>[a[2]||=R(`div`,{class:`flex-1`},null,-1)])]),P(t.$slots,`footer`)]),_:3},8,[`style`]))}})})),z4,Gen=s((()=>{Wen(),z4=Uen})),B4,Ken=s((()=>{B4=({items:e,nestedKey:t=`children`,filter:n=()=>!0,getId:r=e=>e.id})=>{let i=new Map,a=e=>{n(e)&&i.set(r(e),e),t in e&&Array.isArray(e[t])&&e[t]?.forEach(t=>a({...t,parent:e}))};return e.forEach(a),i}})),V4,qen=s((()=>{Ken(),W(),V4=(e,t)=>{let n=U(()=>B4({items:Cn(e),nestedKey:t?.key??`children`})),r=A({}),i=A({}),a=A(null);return{items:U(()=>Cn(e)),index:n,selectedItems:r,expandedItems:i,selectedItem:a,setSelected:e=>{let i=e=>{e&&(r.value[e.id]=!0,`parent`in e&&e.parent&&i(e.parent))};t?.hooks?.onBeforeSelect&&t.hooks.onBeforeSelect(e),r.value={},a.value=e,e!==null&&i(n.value.get(e)),t?.hooks?.onAfterSelect&&t.hooks.onAfterSelect(e)},setExpanded:(e,r)=>{let a=e=>{e&&(i.value[e.id]=!0,`parent`in e&&e.parent&&a(e.parent))};t?.hooks?.onBeforeExpand&&t.hooks.onBeforeExpand(e),r===!1?i.value[e]=!1:a(n.value.get(e)),t?.hooks?.onAfterExpand&&t.hooks.onAfterExpand(e)},isExpanded:e=>i.value[e]??!1,isSelected:e=>r.value[e]??!1,getEntryById:e=>n.value.get(e),reset:()=>{r.value={},i.value={}}}}})),H4,Jen=s((()=>{H4=(e,t)=>{if(t.type===e)return t;if(`children`in t)for(let n of t.children??[]){let t=H4(e,n);if(t)return t}return null}})),Yen,Xen,Zen,Qen,$en,etn=s((()=>{Yen=100,Xen=e=>{if(window.getComputedStyle(e).display!==`contents`)return e;for(let t of e.children)if(t instanceof HTMLElement&&t.offsetParent!==null)return t;return e},Zen=e=>e.dataset.sidebarType===`heading`?e.querySelector(`.sidebar-heading`)?.offsetHeight??0:0,Qen=(e,t)=>{let n=e.offsetTop,r=e.offsetParent;for(;r&&r!==t;)n+=r.offsetTop,r=r.offsetParent;return n},$en=(e,t=Yen)=>{if(typeof window>`u`)return;let n=document.querySelector(`[data-sidebar-id="${e}"]`),r=n?.closest(`.custom-scroll, .custom-scrollbar`)??null;if(!n||!r)return;let i=Qen(Xen(n),r)+Zen(n)-t;r.scrollTo({top:i>0?i:0})}})),U4=s((()=>{x2t(),D2t(),j2t(),Hen(),Gen(),Ken(),qen(),Jen(),etn()})),ttn,ntn=s((()=>{v2t(),W(),U4(),OI(),m4(),ttn=({workspaceStore:e,documentSlug:t,path:n,method:r,exampleName:i,route:a})=>{let o=U(()=>{let n=e?.workspace.documents[Cn(t)??``];return EI(n)?n[`x-scalar-navigation`]?.children??[]:[]}),s=V4(o),c=U(()=>B4({items:o.value,nestedKey:`children`,filter:e=>e.type===`operation`||e.type===`example`,getId:e=>{let n=G2(`operation`,e);return w4({document:Cn(t)??``,path:n?.path,method:n?.method,example:e.type===`example`?e.name:void 0})}})),l=e=>c.value.get(w4({document:e.document,path:e.path,method:e.method,example:e.example}))||c.value.get(w4({document:e.document,path:e.path,method:e.method}));return mr([t,n,r,i],([e,t,n,r])=>{if(!e){s.setSelected(null);return}let i=l({document:e,path:t,method:n,example:r});i&&(s.setSelected(i.id),s.setExpanded(i.id,!0))},{immediate:!0}),{handleSelectItem:e=>{let n=s.getEntryById(e);if(!n){console.warn(`Could not find sidebar entry with id ${e} to select`);return}if(n.type===`operation`||n.type===`example`){if(s.isSelected(e)){s.setExpanded(e,!s.isExpanded(e));return}let r=G2(`operation`,n),i=H4(`example`,n);return i?(s.setSelected(i.id),s.setExpanded(i.id,!0)):s.setSelected(e),r?a({documentSlug:Cn(t),path:r.path,method:r.method,example:i?.name??`default`}):void 0}s.setExpanded(e,!s.isExpanded(e))},state:s,getEntryByLocation:l}}})),W4,rtn,itn,atn,otn,stn,ctn=s((()=>{xC(),W4={Enter:{event:`operation:send:request:hotkey`,modifiers:[`default`]},b:{event:`ui:toggle:sidebar`,modifiers:[`default`]},k:{event:`ui:open:command-palette`,modifiers:[`default`]},l:{event:`ui:focus:address-bar`,modifiers:[`default`]},j:{event:`ui:focus:search`,modifiers:[`default`]},i:{event:`ui:open:settings`,modifiers:[`default`]},s:{event:`ui:save:local-document`,modifiers:[`default`]}},rtn={web:W4,modal:{...W4,Escape:{event:`ui:close:client-modal`,modifiers:[]},l:{event:`ui:focus:send-button`,modifiers:[`default`]}},desktop:{...W4,n:{event:`ui:open:command-palette`,modifiers:[`default`]},t:{event:`tabs:add:tab`,modifiers:[`default`]},w:{event:`tabs:close:tab`,modifiers:[`default`]},ArrowLeft:{event:`tabs:navigate:previous`,modifiers:[`default`,`altKey`]},ArrowRight:{event:`tabs:navigate:next`,modifiers:[`default`,`altKey`]},1:{event:`tabs:focus:tab`,modifiers:[`default`]},2:{event:`tabs:focus:tab`,modifiers:[`default`]},3:{event:`tabs:focus:tab`,modifiers:[`default`]},4:{event:`tabs:focus:tab`,modifiers:[`default`]},5:{event:`tabs:focus:tab`,modifiers:[`default`]},6:{event:`tabs:focus:tab`,modifiers:[`default`]},7:{event:`tabs:focus:tab`,modifiers:[`default`]},8:{event:`tabs:focus:tab`,modifiers:[`default`]},9:{event:`tabs:focus:tab-last`,modifiers:[`default`]}}},itn=new Set([`Escape`,`ArrowDown`,`ArrowUp`,`Enter`]),atn=(e,t)=>t.length>0&&t.map(e=>e===`default`?bC()?`metaKey`:`ctrlKey`:e).every(t=>e[t]===!0),otn=(e,t)=>{if(!(e.target instanceof HTMLElement))return!1;let n=e.target;return n.tagName===`INPUT`?!itn.has(t):n.tagName===`TEXTAREA`||n.contentEditable===`true`||n.hasAttribute(`contenteditable`)},stn=(e,t,n)=>{let r=e.key===` `?`Space`:e.key,i=rtn[n][r];if(!i)return;let a={event:e};if(r===`Escape`){t.emit(i.event,a,{skipUnpackProxy:!0});return}if(atn(e,i.modifiers)){t.emit(i.event,a,{skipUnpackProxy:!0});return}i.modifiers.length>0||otn(e,r)||t.emit(i.event,a,{skipUnpackProxy:!0})}})),ltn,utn=s((()=>{ctn(),W(),ltn=(e,t,n)=>{let r=r=>{Cn(n)||stn(r,e,t)};Hi(()=>window.addEventListener(`keydown`,r)),Wi(()=>window.removeEventListener(`keydown`,r))}})),G4,dtn,ftn=s((()=>{W(),G4=`scalar-dragging`,dtn=N({__name:`Resize`,props:{width:{}},emits:[`update:width`],setup(e,{emit:t}){let n=t,r=A(!1),i=t=>{t.preventDefault();let i=t.clientX,a=e.width,o=e=>{r.value=!0,document.body.classList.add(G4);let t=a+e.clientX-i;t>420&&(t=420+(t-420)*.2),t<240&&(t=240),n(`update:width`,t)},s=()=>{r.value=!1,document.body.classList.remove(G4),document.documentElement.removeEventListener(`mousemove`,o,!1),document.documentElement.removeEventListener(`mouseup`,s,!1),e.width>420?n(`update:width`,360):e.width<240&&n(`update:width`,240)};document.documentElement.addEventListener(`mousemove`,o,!1),document.documentElement.addEventListener(`mouseup`,s,!1)};return(t,n)=>(F(),I(`div`,{class:`relative`,style:it({width:`${e.width}px`})},[P(t.$slots,`default`,{},void 0,!0),R(`div`,{class:`resizer`,onMousedown:i},null,32)],4))}})})),ptn,mtn=s((()=>{Bc(),ftn(),ptn=zc(dtn,[[`__scopeId`,`data-v-e2c54c18`]])}));function htn(){return new QR([],{keys:[{name:`title`,weight:.7},{name:`description`,weight:.3},{name:`operationId`,weight:.6},{name:`path`,weight:.5},{name:`tag`,weight:.4},{name:`method`,weight:.3},{name:`documentName`,weight:.3}],threshold:.3,distance:100,includeScore:!0,includeMatches:!0,ignoreLocation:!0,useExtendedSearch:!0,findAllMatches:!0})}var gtn=s((()=>{$R()}));function _tn(e){let t=[];function n(e,r){e.forEach(e=>{vtn(e,t,r),`children`in e&&e.children&&n(e.children,r)})}return e?.forEach(e=>n(e[`x-scalar-navigation`]?.children??[],e)),t}function vtn(e,t,n){if(e.type===`operation`){let r=RE(n?.paths?.[e.path]?.[e.method])??{};t.push({type:`operation`,title:e.title,id:e.id,description:r.description||``,method:e.method,path:e.path,operationId:r.operationId,entry:e,documentName:n?.info.title??``});return}if(e.type===`tag`&&e.isGroup===!1){t.push({id:e.id,title:e.title,description:e.description||``,type:`tag`,entry:e,documentName:n?.info.title??``});return}if(e.type===`tag`&&e.isGroup===!0){t.push({id:e.id,title:e.title,description:`Tag Group`,type:`tag`,entry:e,documentName:n?.info.title??``});return}if(e.type===`text`){t.push({id:e.id,type:`heading`,title:e.title??``,description:`Heading`,entry:e,documentName:n?.info.title??``});return}}var ytn=s((()=>{zE()})),btn,xtn,Stn=s((()=>{gtn(),ytn(),W(),btn=25,xtn=e=>{let t=U(()=>{let t=htn();return t.setCollection(_tn(Cn(e))),t}),n=A(``);return{results:U(()=>n.value.length===0?null:t.value.search(n.value,{limit:btn}).flatMap(e=>e.item.entry.type===`operation`?e.item.entry:[])),query:n}}})),Ctn,wtn=s((()=>{W(),kE(),Ou(),Ctn=N({__name:`SidebarMenu`,props:{activeWorkspace:{},workspaces:{}},emits:[`create:workspace`,`select:workspace`,`navigate:to:settings`],setup(e,{emit:t}){let n=t;return(t,r)=>(F(),L(j(y1e),null,{products:M(()=>[H(j(QT),{selected:`client`})]),sections:M(({close:i})=>[H(j($T),null,{default:M(()=>[P(t.$slots,`sidebarMenuActions`,{},()=>[H(j(M1e),{modelValue:e.activeWorkspace.id,workspaceOptions:e.workspaces,onCreateWorkspace:r[0]||=e=>n(`create:workspace`),"onUpdate:modelValue":r[1]||=e=>n(`select:workspace`,e)},null,8,[`modelValue`,`workspaceOptions`]),H(j(YT),{is:`button`,icon:j(Zle),onClick:()=>{i(),n(`navigate:to:settings`)}},{default:M(()=>[...r[2]||=[z(` Settings `,-1)]]),_:1},8,[`icon`,`onClick`])])]),_:2},1024),H(j(tE)),H(j(C1e))]),_:3}))}})})),Ttn,Etn=s((()=>{wtn(),Ttn=Ctn})),Dtn,Otn,ktn=s((()=>{mtn(),Stn(),Etn(),W(),kE(),Ou(),U4(),OI(),Dtn={key:1},Otn=N({__name:`Sidebar`,props:Lr({sidebarState:{},layout:{},activeWorkspace:{},workspaces:{},documents:{},isDroppable:{type:[Boolean,Function]}},{sidebarWidth:{required:!0,default:288},sidebarWidthModifiers:{}}),emits:Lr([`selectItem`,`select:workspace`,`create:workspace`,`reorder`,`navigate:to:settings`],[`update:sidebarWidth`]),setup(e,{emit:t}){let n=t,r=Pr(),i=A(!1),a=Ur(e,`sidebarWidth`),o=e=>e.type===`example`&&e.title===`draft`,{query:s,results:c}=xtn(()=>e.documents.filter(EI)),l=U(()=>c.value??e.sidebarState.items.value),u=e=>{n(`selectItem`,e),s.value=``,i.value=!1};return(t,c)=>(F(),L(j(ptn),{width:a.value,"onUpdate:width":c[6]||=e=>a.value=e,class:`flex flex-col`},{default:M(()=>[H(j(z4),{class:`flex w-auto flex-1`,indent:20,isDraggable:e.layout!==`modal`,isDroppable:e.isDroppable,isExpanded:e.sidebarState.isExpanded,isSelected:e.sidebarState.isSelected,items:l.value,layout:`client`,options:{hideOperationDefaultExamples:e.layout===`modal`},onReorder:c[5]||=(e,t)=>n(`reorder`,e,t),onSelectItem:u},jr({header:M(()=>[c[7]||=R(`div`,{class:`mac:h-12 mac:app-drag-region h-2`},null,-1),R(`div`,{class:O([`bg-sidebar-b-1 z-1 flex flex-col gap-1.5 px-3 pb-1.5`,{"max-md:pt-12":e.layout===`desktop`,"max-md:pt-2 max-md:pl-4!":e.layout===`modal`,"pt-1 max-md:pt-2 max-md:pl-14":e.layout===`web`}])},[e.layout===`web`?B(``,!0):(F(),I(`div`,{key:0,class:O([`flex items-center justify-between`,{"max-md:pl-10":e.layout===`desktop`}])},[e.layout===`modal`?e.layout===`modal`?(F(),I(`div`,Dtn)):B(``,!0):(F(),L(Ttn,{key:0,activeWorkspace:e.activeWorkspace,workspaces:e.workspaces,"onCreate:workspace":c[0]||=e=>n(`create:workspace`),"onNavigate:to:settings":c[1]||=e=>n(`navigate:to:settings`),"onSelect:workspace":c[2]||=e=>n(`select:workspace`,e)},{sidebarMenuActions:M(()=>[P(t.$slots,`sidebarMenuActions`)]),_:3},8,[`activeWorkspace`,`workspaces`])),H(j(GT),{class:`hover:bg-b-2 active:text-c-1 size-8 rounded p-2`,icon:j(vu),label:`Search`,size:`sm`,onClick:c[3]||=e=>i.value=!i.value},null,8,[`icon`])],2)),i.value||e.layout===`web`?(F(),L(j(c2e),{key:1,modelValue:j(s),"onUpdate:modelValue":c[4]||=e=>xn(s)?s.value=e:null,autofocus:e.layout!==`web`},null,8,[`modelValue`,`autofocus`])):B(``,!0)],2)]),spacer:M(()=>[c[8]||=R(`div`,{class:`flex-1`},null,-1)]),icon:M(e=>[r.icon||o(e.item)?(F(),I(V,{key:0},[o(e.item)?(F(),L(j(fle),{key:0})):B(``,!0),P(t.$slots,`icon`,at($r(e)))],64)):B(``,!0)]),before:M(()=>[P(t.$slots,`workspaceButton`)]),footer:M(()=>[P(t.$slots,`footer`)]),_:2},[r.decorator?{name:`decorator`,fn:M(e=>[P(t.$slots,`decorator`,at($r(e)))]),key:`0`}:void 0,r.empty?{name:`empty`,fn:M(e=>[P(t.$slots,`empty`,at($r(e)))]),key:`1`}:void 0]),1032,[`isDraggable`,`isDroppable`,`isExpanded`,`isSelected`,`items`,`options`])]),_:3},8,[`width`]))}})})),Atn,jtn=s((()=>{ktn(),Atn=Otn})),Mtn,Ntn,Ptn,Ftn,Itn,Ltn=s((()=>{W(),Mtn=[`aria-pressed`],Ntn={class:`sr-only`},Ptn={class:`size-4`,fill:`none`,viewBox:`0 0 24 24`,xmlns:`http://www.w3.org/2000/svg`},Ftn={"clip-path":`url(#mask)`},Itn=N({__name:`SidebarToggle`,props:{modelValue:{type:Boolean,required:!0},modelModifiers:{}},emits:[`update:modelValue`],setup(e){let t=Ur(e,`modelValue`);return(e,n)=>(F(),I(`button`,{"aria-pressed":t.value,class:`scalar-sidebar-toggle text-c-3 hover:bg-b-2 active:text-c-1 rounded p-2`,type:`button`,onClick:n[0]||=e=>t.value=!t.value},[R(`span`,Ntn,k(t.value?`Hide`:`Show`)+` sidebar`,1),(F(),I(`svg`,Ptn,[n[1]||=R(`defs`,null,[R(`clipPath`,{id:`mask`},[R(`path`,{"clip-rule":`evenodd`,d:`M9 3.2H4c-1.7 0-3 1.3-3 3v11.5c0 1.7 1.3 3 3 3h5V3.2z`})])],-1),R(`g`,Ftn,[R(`path`,{class:O([`transition-transform duration-300`,t.value?`translate-x-0`:`-translate-x-1/2`]),d:`M1 3.2h8v17.5H1z`,fill:`currentColor`},null,2)]),n[2]||=R(`path`,{d:`M20 20.8H4c-1.7 0-3-1.3-3-3V6.2c0-1.7 1.3-3 3-3h16c1.7 0 3 1.3 3 3v11.5c0 1.7-1.3 3-3 3zM9 3.2v17.5`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-linejoin":`round`,"stroke-width":`2`},null,-1)]))],8,Mtn))}})})),Rtn,ztn=s((()=>{Ltn(),Rtn=Itn})),K4,q4,J4,Y4,X4,Z4,Btn,Q4,$4,e3,t3,Vtn,Htn,n3,Utn,Wtn,Gtn,Ktn,qtn,Jtn,Ytn,r3,Xtn,Ztn,i3,a3,Qtn,o3,$tn,enn,s3,tnn,c3,nnn=s((()=>{K4=[`input:not([inert]):not([inert] *)`,`select:not([inert]):not([inert] *)`,`textarea:not([inert]):not([inert] *)`,`a[href]:not([inert]):not([inert] *)`,`button:not([inert]):not([inert] *)`,`[tabindex]:not(slot):not([inert]):not([inert] *)`,`audio[controls]:not([inert]):not([inert] *)`,`video[controls]:not([inert]):not([inert] *)`,`[contenteditable]:not([contenteditable="false"]):not([inert]):not([inert] *)`,`details>summary:first-of-type:not([inert]):not([inert] *)`,`details:not([inert]):not([inert] *)`],q4=K4.join(`,`),J4=typeof Element>`u`,Y4=J4?function(){}:Element.prototype.matches||Element.prototype.msMatchesSelector||Element.prototype.webkitMatchesSelector,X4=!J4&&Element.prototype.getRootNode?function(e){return e?.getRootNode?.call(e)}:function(e){return e?.ownerDocument},Z4=function(e,t){t===void 0&&(t=!0);var n=e?.getAttribute?.call(e,`inert`);return n===``||n===`true`||t&&e&&(typeof e.closest==`function`?e.closest(`[inert]`):Z4(e.parentNode))},Btn=function(e){var t=e?.getAttribute?.call(e,`contenteditable`);return t===``||t===`true`},Q4=function(e,t,n){if(Z4(e))return[];var r=Array.prototype.slice.apply(e.querySelectorAll(q4));return t&&Y4.call(e,q4)&&r.unshift(e),r=r.filter(n),r},$4=function(e,t,n){for(var r=[],i=Array.from(e);i.length;){var a=i.shift();if(!Z4(a,!1))if(a.tagName===`SLOT`){var o=a.assignedElements(),s=$4(o.length?o:a.children,!0,n);n.flatten?r.push.apply(r,s):r.push({scopeParent:a,candidates:s})}else{Y4.call(a,q4)&&n.filter(a)&&(t||!e.includes(a))&&r.push(a);var c=a.shadowRoot||typeof n.getShadowRoot==`function`&&n.getShadowRoot(a),l=!Z4(c,!1)&&(!n.shadowRootFilter||n.shadowRootFilter(a));if(c&&l){var u=$4(c===!0?a.children:c.children,!0,n);n.flatten?r.push.apply(r,u):r.push({scopeParent:a,candidates:u})}else i.unshift.apply(i,a.children)}}return r},e3=function(e){return!isNaN(parseInt(e.getAttribute(`tabindex`),10))},t3=function(e){if(!e)throw Error(`No node provided`);return e.tabIndex<0&&(/^(AUDIO|VIDEO|DETAILS)$/.test(e.tagName)||Btn(e))&&!e3(e)?0:e.tabIndex},Vtn=function(e,t){var n=t3(e);return n<0&&t&&!e3(e)?0:n},Htn=function(e,t){return e.tabIndex===t.tabIndex?e.documentOrder-t.documentOrder:e.tabIndex-t.tabIndex},n3=function(e){return e.tagName===`INPUT`},Utn=function(e){return n3(e)&&e.type===`hidden`},Wtn=function(e){return e.tagName===`DETAILS`&&Array.prototype.slice.apply(e.children).some(function(e){return e.tagName===`SUMMARY`})},Gtn=function(e,t){for(var n=0;n<e.length;n++)if(e[n].checked&&e[n].form===t)return e[n]},Ktn=function(e){if(!e.name)return!0;var t=e.form||X4(e),n=function(e){return t.querySelectorAll(`input[type="radio"][name="`+e+`"]`)},r;if(typeof window<`u`&&window.CSS!==void 0&&typeof window.CSS.escape==`function`)r=n(window.CSS.escape(e.name));else try{r=n(e.name)}catch(e){return console.error(`Looks like you have a radio button with a name attribute containing invalid CSS selector characters and need the CSS.escape polyfill: %s`,e.message),!1}var i=Gtn(r,e.form);return!i||i===e},qtn=function(e){return n3(e)&&e.type===`radio`},Jtn=function(e){return qtn(e)&&!Ktn(e)},Ytn=function(e){var t=e&&X4(e),n=t?.host,r=!1;if(t&&t!==e){var i,a,o;for(r=!!((i=n)!=null&&(a=i.ownerDocument)!=null&&a.contains(n)||e!=null&&(o=e.ownerDocument)!=null&&o.contains(e));!r&&n;){var s,c;t=X4(n),n=t?.host,r=!!((s=n)!=null&&(c=s.ownerDocument)!=null&&c.contains(n))}}return r},r3=function(e){var t=e.getBoundingClientRect(),n=t.width,r=t.height;return n===0&&r===0},Xtn=function(e,t){var n=t.displayCheck,r=t.getShadowRoot;if(n===`full-native`&&`checkVisibility`in e)return!e.checkVisibility({checkOpacity:!1,opacityProperty:!1,contentVisibilityAuto:!0,visibilityProperty:!0,checkVisibilityCSS:!0});if(getComputedStyle(e).visibility===`hidden`)return!0;var i=Y4.call(e,`details>summary:first-of-type`)?e.parentElement:e;if(Y4.call(i,`details:not([open]) *`))return!0;if(!n||n===`full`||n===`full-native`||n===`legacy-full`){if(typeof r==`function`){for(var a=e;e;){var o=e.parentElement,s=X4(e);if(o&&!o.shadowRoot&&r(o)===!0)return r3(e);e=e.assignedSlot?e.assignedSlot:!o&&s!==e.ownerDocument?s.host:o}e=a}if(Ytn(e))return!e.getClientRects().length;if(n!==`legacy-full`)return!0}else if(n===`non-zero-area`)return r3(e);return!1},Ztn=function(e){if(/^(INPUT|BUTTON|SELECT|TEXTAREA)$/.test(e.tagName))for(var t=e.parentElement;t;){if(t.tagName===`FIELDSET`&&t.disabled){for(var n=0;n<t.children.length;n++){var r=t.children.item(n);if(r.tagName===`LEGEND`)return Y4.call(t,`fieldset[disabled] *`)?!0:!r.contains(e)}return!0}t=t.parentElement}return!1},i3=function(e,t){return!(t.disabled||Utn(t)||Xtn(t,e)||Wtn(t)||Ztn(t))},a3=function(e,t){return!(Jtn(t)||t3(t)<0||!i3(e,t))},Qtn=function(e){var t=parseInt(e.getAttribute(`tabindex`),10);return!!(isNaN(t)||t>=0)},o3=function(e){var t=[],n=[];return e.forEach(function(e,r){var i=!!e.scopeParent,a=i?e.scopeParent:e,o=Vtn(a,i),s=i?o3(e.candidates):a;o===0?i?t.push.apply(t,s):t.push(a):n.push({documentOrder:r,tabIndex:o,item:e,isScope:i,content:s})}),n.sort(Htn).reduce(function(e,t){return t.isScope?e.push.apply(e,t.content):e.push(t.content),e},[]).concat(t)},$tn=function(e,t){t||={};var n=t.getShadowRoot?$4([e],t.includeContainer,{filter:a3.bind(null,t),flatten:!1,getShadowRoot:t.getShadowRoot,shadowRootFilter:Qtn}):Q4(e,t.includeContainer,a3.bind(null,t));return o3(n)},enn=function(e,t){return t||={},t.getShadowRoot?$4([e],t.includeContainer,{filter:i3.bind(null,t),flatten:!0,getShadowRoot:t.getShadowRoot}):Q4(e,t.includeContainer,i3.bind(null,t))},s3=function(e,t){if(t||={},!e)throw Error(`No node provided`);return Y4.call(e,q4)===!1?!1:a3(t,e)},tnn=K4.concat(`iframe:not([inert]):not([inert] *)`).join(`,`),c3=function(e,t){if(t||={},!e)throw Error(`No node provided`);return Y4.call(e,tnn)===!1?!1:i3(t,e)}}));function l3(e,t){(t==null||t>e.length)&&(t=e.length);for(var n=0,r=Array(t);n<t;n++)r[n]=e[n];return r}function rnn(e){if(Array.isArray(e))return l3(e)}function inn(e,t){var n=typeof Symbol<`u`&&e[Symbol.iterator]||e[`@@iterator`];if(!n){if(Array.isArray(e)||(n=pnn(e))||t){n&&(e=n);var r=0,i=function(){};return{s:i,n:function(){return r>=e.length?{done:!0}:{done:!1,value:e[r++]}},e:function(e){throw e},f:i}}throw TypeError(`Invalid attempt to iterate non-iterable instance.
-In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,o=!0,s=!1;return{s:function(){n=n.call(e)},n:function(){var e=n.next();return o=e.done,e},e:function(e){s=!0,a=e},f:function(){try{o||n.return==null||n.return()}finally{if(s)throw a}}}}function ann(e,t,n){return(t=fnn(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function onn(e){if(typeof Symbol<`u`&&e[Symbol.iterator]!=null||e[`@@iterator`]!=null)return Array.from(e)}function snn(){throw TypeError(`Invalid attempt to spread non-iterable instance.
-In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function cnn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter(function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable})),n.push.apply(n,r)}return n}function lnn(e){for(var t=1;t<arguments.length;t++){var n=arguments[t]==null?{}:arguments[t];t%2?cnn(Object(n),!0).forEach(function(t){ann(e,t,n[t])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):cnn(Object(n)).forEach(function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))})}return e}function unn(e){return rnn(e)||onn(e)||pnn(e)||snn()}function dnn(e,t){if(typeof e!=`object`||!e)return e;var n=e[Symbol.toPrimitive];if(n!==void 0){var r=n.call(e,t);if(typeof r!=`object`)return r;throw TypeError(`@@toPrimitive must return a primitive value.`)}return(t===`string`?String:Number)(e)}function fnn(e){var t=dnn(e,`string`);return typeof t==`symbol`?t:t+``}function pnn(e,t){if(e){if(typeof e==`string`)return l3(e,t);var n={}.toString.call(e).slice(8,-1);return n===`Object`&&e.constructor&&(n=e.constructor.name),n===`Map`||n===`Set`?Array.from(e):n===`Arguments`||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?l3(e,t):void 0}}var u3,mnn,hnn,d3,gnn,_nn,f3,p3,m3,vnn,ynn,bnn=s((()=>{nnn(),u3={getActiveTrap:function(e){return e?.length>0?e[e.length-1]:null},activateTrap:function(e,t){t!==u3.getActiveTrap(e)&&u3.pauseTrap(e);var n=e.indexOf(t);n===-1||e.splice(n,1),e.push(t)},deactivateTrap:function(e,t){var n=e.indexOf(t);n!==-1&&e.splice(n,1),u3.unpauseTrap(e)},pauseTrap:function(e){u3.getActiveTrap(e)?._setPausedState(!0)},unpauseTrap:function(e){var t=u3.getActiveTrap(e);t&&!t._isManuallyPaused()&&t._setPausedState(!1)}},mnn=function(e){return e.tagName&&e.tagName.toLowerCase()===`input`&&typeof e.select==`function`},hnn=function(e){return e?.key===`Escape`||e?.key===`Esc`||e?.keyCode===27},d3=function(e){return e?.key===`Tab`||e?.keyCode===9},gnn=function(e){return d3(e)&&!e.shiftKey},_nn=function(e){return d3(e)&&e.shiftKey},f3=function(e){return setTimeout(e,0)},p3=function(e){for(var t=arguments.length,n=Array(t>1?t-1:0),r=1;r<t;r++)n[r-1]=arguments[r];return typeof e==`function`?e.apply(void 0,n):e},m3=function(e){return e.target.shadowRoot&&typeof e.composedPath==`function`?e.composedPath()[0]:e.target},vnn=[],ynn=function(e,t){var n=t?.document||document,r=t?.trapStack||vnn,i=lnn({returnFocusOnDeactivate:!0,escapeDeactivates:!0,delayInitialFocus:!0,isolateSubtrees:!1,isKeyForward:gnn,isKeyBackward:_nn},t),a={containers:[],containerGroups:[],tabbableGroups:[],adjacentElements:new Set,alreadySilent:new Set,nodeFocusedBeforeActivation:null,mostRecentlyFocusedNode:null,active:!1,paused:!1,manuallyPaused:!1,delayInitialFocusTimer:void 0,recentNavEvent:void 0},o,s=function(e,t,n){return e&&e[t]!==void 0?e[t]:i[n||t]},c=function(e,t){var n=typeof t?.composedPath==`function`?t.composedPath():void 0;return a.containerGroups.findIndex(function(t){var r=t.container,i=t.tabbableNodes;return r.contains(e)||n?.includes(r)||i.find(function(t){return t===e})})},l=function(e){var t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},r=t.hasFallback,a=r===void 0?!1:r,o=t.params,s=o===void 0?[]:o,c=i[e];if(typeof c==`function`&&(c=c.apply(void 0,unn(s))),c===!0&&(c=void 0),!c){if(c===void 0||c===!1)return c;throw Error(`\`${e}\` was specified but was not a node, or did not return a node`)}var l=c;if(typeof c==`string`){try{l=n.querySelector(c)}catch(t){throw Error(`\`${e}\` appears to be an invalid selector; error="${t.message}"`)}if(!l&&!a)throw Error(`\`${e}\` as selector refers to no known node`)}return l},u=function(){var e=l(`initialFocus`,{hasFallback:!0});if(e===!1)return!1;if(e===void 0||e&&!c3(e,i.tabbableOptions))if(c(n.activeElement)>=0)e=n.activeElement;else{var t=a.tabbableGroups[0];e=t&&t.firstTabbableNode||l(`fallbackFocus`)}else e===null&&(e=l(`fallbackFocus`));if(!e)throw Error(`Your focus-trap needs to have at least one focusable element`);return e},d=function(){if(a.containerGroups=a.containers.map(function(e){var t=$tn(e,i.tabbableOptions),n=enn(e,i.tabbableOptions),r=t.length>0?t[0]:void 0,a=t.length>0?t[t.length-1]:void 0,o=n.find(function(e){return s3(e)}),s=n.slice().reverse().find(function(e){return s3(e)});return{container:e,tabbableNodes:t,focusableNodes:n,posTabIndexesFound:!!t.find(function(e){return t3(e)>0}),firstTabbableNode:r,lastTabbableNode:a,firstDomTabbableNode:o,lastDomTabbableNode:s,nextTabbableNode:function(e){var r=arguments.length>1&&arguments[1]!==void 0?arguments[1]:!0,i=t.indexOf(e);return i<0?r?n.slice(n.indexOf(e)+1).find(function(e){return s3(e)}):n.slice(0,n.indexOf(e)).reverse().find(function(e){return s3(e)}):t[i+(r?1:-1)]}}}),a.tabbableGroups=a.containerGroups.filter(function(e){return e.tabbableNodes.length>0}),a.tabbableGroups.length<=0&&!l(`fallbackFocus`))throw Error(`Your focus-trap must have at least one container with at least one tabbable node in it at all times`);if(a.containerGroups.find(function(e){return e.posTabIndexesFound})&&a.containerGroups.length>1)throw Error(`At least one node with a positive tabindex was found in one of your focus-trap's multiple containers. Positive tabindexes are only supported in single-container focus-traps.`)},f=function(e){var t=e.activeElement;if(t)return t.shadowRoot&&t.shadowRoot.activeElement!==null?f(t.shadowRoot):t},p=function(e){if(e!==!1&&e!==f(document)){if(!e||!e.focus){p(u());return}e.focus({preventScroll:!!i.preventScroll}),a.mostRecentlyFocusedNode=e,mnn(e)&&e.select()}},m=function(e){var t=l(`setReturnFocus`,{params:[e]});return t||(t===!1?!1:e)},h=function(e){var t=e.target,n=e.event,r=e.isBackward,o=r===void 0?!1:r;t||=m3(n),d();var s=null;if(a.tabbableGroups.length>0){var u=c(t,n),f=u>=0?a.containerGroups[u]:void 0;if(u<0)s=o?a.tabbableGroups[a.tabbableGroups.length-1].lastTabbableNode:a.tabbableGroups[0].firstTabbableNode;else if(o){var p=a.tabbableGroups.findIndex(function(e){var n=e.firstTabbableNode;return t===n});if(p<0&&(f.container===t||c3(t,i.tabbableOptions)&&!s3(t,i.tabbableOptions)&&!f.nextTabbableNode(t,!1))&&(p=u),p>=0){var m=p===0?a.tabbableGroups.length-1:p-1,h=a.tabbableGroups[m];s=t3(t)>=0?h.lastTabbableNode:h.lastDomTabbableNode}else d3(n)||(s=f.nextTabbableNode(t,!1))}else{var g=a.tabbableGroups.findIndex(function(e){var n=e.lastTabbableNode;return t===n});if(g<0&&(f.container===t||c3(t,i.tabbableOptions)&&!s3(t,i.tabbableOptions)&&!f.nextTabbableNode(t))&&(g=u),g>=0){var _=g===a.tabbableGroups.length-1?0:g+1,v=a.tabbableGroups[_];s=t3(t)>=0?v.firstTabbableNode:v.firstDomTabbableNode}else d3(n)||(s=f.nextTabbableNode(t))}}else s=l(`fallbackFocus`);return s},g=function(e){if(!(c(m3(e),e)>=0)){if(p3(i.clickOutsideDeactivates,e)){o.deactivate({returnFocus:i.returnFocusOnDeactivate});return}p3(i.allowOutsideClick,e)||e.preventDefault()}},_=function(e){var t=m3(e),n=c(t,e)>=0;if(n||t instanceof Document)n&&(a.mostRecentlyFocusedNode=t);else{e.stopImmediatePropagation();var r,o=!0;if(a.mostRecentlyFocusedNode)if(t3(a.mostRecentlyFocusedNode)>0){var s=c(a.mostRecentlyFocusedNode),l=a.containerGroups[s].tabbableNodes;if(l.length>0){var d=l.findIndex(function(e){return e===a.mostRecentlyFocusedNode});d>=0&&(i.isKeyForward(a.recentNavEvent)?d+1<l.length&&(r=l[d+1],o=!1):d-1>=0&&(r=l[d-1],o=!1))}}else a.containerGroups.some(function(e){return e.tabbableNodes.some(function(e){return t3(e)>0})})||(o=!1);else o=!1;o&&(r=h({target:a.mostRecentlyFocusedNode,isBackward:i.isKeyBackward(a.recentNavEvent)})),p(r||a.mostRecentlyFocusedNode||u())}a.recentNavEvent=void 0},v=function(e){var t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:!1;a.recentNavEvent=e;var n=h({event:e,isBackward:t});n&&(d3(e)&&e.preventDefault(),p(n))},y=function(e){(i.isKeyForward(e)||i.isKeyBackward(e))&&v(e,i.isKeyBackward(e))},b=function(e){hnn(e)&&p3(i.escapeDeactivates,e)!==!1&&(e.preventDefault(),o.deactivate())},x=function(e){c(m3(e),e)>=0||p3(i.clickOutsideDeactivates,e)||p3(i.allowOutsideClick,e)||(e.preventDefault(),e.stopImmediatePropagation())},S=function(){if(a.active)return u3.activateTrap(r,o),a.delayInitialFocusTimer=i.delayInitialFocus?f3(function(){p(u())}):p(u()),n.addEventListener(`focusin`,_,!0),n.addEventListener(`mousedown`,g,{capture:!0,passive:!1}),n.addEventListener(`touchstart`,g,{capture:!0,passive:!1}),n.addEventListener(`click`,x,{capture:!0,passive:!1}),n.addEventListener(`keydown`,y,{capture:!0,passive:!1}),n.addEventListener(`keydown`,b),o},C=function(e){a.active&&!a.paused&&o._setSubtreeIsolation(!1),a.adjacentElements.clear(),a.alreadySilent.clear();var t=new Set,n=new Set,r=inn(e),i;try{for(r.s();!(i=r.n()).done;){var s=i.value;t.add(s);for(var c=typeof ShadowRoot<`u`&&s.getRootNode()instanceof ShadowRoot,l=s;l;){t.add(l);var u=l.parentElement,d=[];u?d=u.children:!u&&c&&(d=l.getRootNode().children,u=l.getRootNode().host,c=typeof ShadowRoot<`u`&&u.getRootNode()instanceof ShadowRoot);var f=inn(d),p;try{for(f.s();!(p=f.n()).done;){var m=p.value;n.add(m)}}catch(e){f.e(e)}finally{f.f()}l=u}}}catch(e){r.e(e)}finally{r.f()}t.forEach(function(e){n.delete(e)}),a.adjacentElements=n},w=function(){if(a.active)return n.removeEventListener(`focusin`,_,!0),n.removeEventListener(`mousedown`,g,!0),n.removeEventListener(`touchstart`,g,!0),n.removeEventListener(`click`,x,!0),n.removeEventListener(`keydown`,y,!0),n.removeEventListener(`keydown`,b),o},ee=typeof window<`u`&&`MutationObserver`in window?new MutationObserver(function(e){e.some(function(e){return Array.from(e.removedNodes).some(function(e){return e===a.mostRecentlyFocusedNode})})&&p(u())}):void 0,te=function(){ee&&(ee.disconnect(),a.active&&!a.paused&&a.containers.map(function(e){ee.observe(e,{subtree:!0,childList:!0})}))};return o={get active(){return a.active},get paused(){return a.paused},activate:function(e){if(a.active)return this;var t=s(e,`onActivate`),c=s(e,`onPostActivate`),l=s(e,`checkCanFocusTrap`),u=u3.getActiveTrap(r),p=!1;if(u&&!u.paused){var m;(m=u._setSubtreeIsolation)==null||m.call(u,!1),p=!0}try{l||d(),a.active=!0,a.paused=!1,a.nodeFocusedBeforeActivation=f(n),t?.();var h=function(){l&&d(),S(),te(),i.isolateSubtrees&&o._setSubtreeIsolation(!0),c?.()};if(l)return l(a.containers.concat()).then(h,h),this;h()}catch(e){if(u===u3.getActiveTrap(r)&&p){var g;(g=u._setSubtreeIsolation)==null||g.call(u,!0)}throw e}return this},deactivate:function(e){if(!a.active)return this;var t=lnn({onDeactivate:i.onDeactivate,onPostDeactivate:i.onPostDeactivate,checkCanReturnFocus:i.checkCanReturnFocus},e);clearTimeout(a.delayInitialFocusTimer),a.delayInitialFocusTimer=void 0,a.paused||o._setSubtreeIsolation(!1),a.alreadySilent.clear(),w(),a.active=!1,a.paused=!1,te(),u3.deactivateTrap(r,o);var n=s(t,`onDeactivate`),c=s(t,`onPostDeactivate`),l=s(t,`checkCanReturnFocus`),u=s(t,`returnFocus`,`returnFocusOnDeactivate`);n?.();var d=function(){f3(function(){u&&p(m(a.nodeFocusedBeforeActivation)),c?.()})};return u&&l?(l(m(a.nodeFocusedBeforeActivation)).then(d,d),this):(d(),this)},pause:function(e){return a.active?(a.manuallyPaused=!0,this._setPausedState(!0,e)):this},unpause:function(e){return!a.active||(a.manuallyPaused=!1,r[r.length-1]!==this)?this:this._setPausedState(!1,e)},updateContainerElements:function(e){return a.containers=[].concat(e).filter(Boolean).map(function(e){return typeof e==`string`?n.querySelector(e):e}),i.isolateSubtrees&&C(a.containers),a.active&&(d(),i.isolateSubtrees&&!a.paused&&o._setSubtreeIsolation(!0)),te(),this}},Object.defineProperties(o,{_isManuallyPaused:{value:function(){return a.manuallyPaused}},_setPausedState:{value:function(e,t){if(a.paused===e)return this;if(a.paused=e,e){var n=s(t,`onPause`),r=s(t,`onPostPause`);n?.(),w(),te(),o._setSubtreeIsolation(!1),r?.()}else{var i=s(t,`onUnpause`),c=s(t,`onPostUnpause`);i?.(),o._setSubtreeIsolation(!0),d(),S(),te(),c?.()}return this}},_setSubtreeIsolation:{value:function(e){i.isolateSubtrees&&a.adjacentElements.forEach(function(t){if(e)switch(i.isolateSubtrees){case`aria-hidden`:(t.ariaHidden===`true`||t.getAttribute(`aria-hidden`)?.toLowerCase()===`true`)&&a.alreadySilent.add(t),t.setAttribute(`aria-hidden`,`true`);break;default:(t.inert||t.hasAttribute(`inert`))&&a.alreadySilent.add(t),t.setAttribute(`inert`,!0);break}else if(!a.alreadySilent.has(t))switch(i.isolateSubtrees){case`aria-hidden`:t.removeAttribute(`aria-hidden`);break;default:t.removeAttribute(`inert`);break}})}}}),o.updateContainerElements(e),o}}));function xnn(e,t={}){let n,{immediate:r,...i}=t,a=Sn(!1),o=Sn(!1),s=e=>n&&n.activate(e),c=e=>n&&n.deactivate(e);return mr(U(()=>Lf(Cn(e)).map(e=>{let t=Cn(e);return typeof t==`string`?t:Uf(t)}).filter(zf)),e=>{if(e.length)if(!n)n=ynn(e,{...i,onActivate(){a.value=!0,t.onActivate&&t.onActivate()},onDeactivate(){a.value=!1,t.onDeactivate&&t.onDeactivate()}}),r&&s();else{let t=n?.active;n?.updateContainerElements(e),!t&&r&&s()}},{flush:`post`}),If(()=>c()),{hasFocus:a,isPaused:o,activate:s,deactivate:c,pause:()=>{n&&(n.pause(),o.value=!0)},unpause:()=>{n&&(n.unpause(),o.value=!1)}}}var Snn=s((()=>{Zf(),Hf(),bnn(),W()})),Cnn,wnn,Tnn=s((()=>{W(),kE(),Snn(),Cnn={class:`scalar scalar-app z-overlay relative`},wnn=N({__name:`ModalClientContainer`,props:{modalState:{}},emits:[`open`,`close`],setup(e,{emit:t}){let n=e,r=t,i=A(null),{activate:a,deactivate:o}=xnn(i,{allowOutsideClick:!0,fallbackFocus:()=>i.value});return Vi(()=>OE()),mr(()=>n.modalState.open,async e=>{e?(await ar(),a(),r(`open`)):(o(),r(`close`))},{immediate:!1}),Wi(()=>{o()}),(t,n)=>(F(),I(`div`,Cnn,[R(`div`,{class:O([`scalar-container`,{"scalar-client--open":e.modalState.open}])},[R(`div`,ai({ref_key:`client`,ref:i,"aria-label":`API Client`,"aria-modal":`true`},t.$attrs,{class:`scalar-app-layout scalar-client`,role:`dialog`,tabindex:`-1`}),[H(j(_b),null,{default:M(()=>[P(t.$slots,`default`,{},void 0,!0)]),_:3})],16),R(`div`,{class:`scalar-app-exit`,onClick:n[0]||=t=>e.modalState.hide()})],2)]))}})})),Enn,Dnn=s((()=>{Bc(),Tnn(),Enn=zc(wnn,[[`__scopeId`,`data-v-ae5e8531`]])})),Onn,knn,Ann=s((()=>{OIt(),h$t(),u2t(),W(),QI(),$u(),Onn={key:1,class:`flex h-full w-full items-center justify-center`},knn=N({__name:`Operation`,props:{documentSlug:{},document:{},eventBus:{},layout:{},path:{},method:{},exampleName:{},environment:{},workspaceStore:{},plugins:{},options:{},requestBodyCompositionSelection:{}},setup(e){let t=U(()=>{if(!e.path||!e.method||!e.exampleName||!e.document)return null;let t=mgt(e.workspaceStore,e.documentSlug,{path:e.path,method:e.method,exampleName:e.exampleName},{baseServerUrl:Cn(e.options)?.baseServerURL,fallbackDocument:e.document,isElectron:Qu(),layout:e.layout===`web`?`web`:`other`,servers:Cn(e.options)?.servers,appVersion:wY,authentication:Cn(e.options)?.authentication});return t.ok?t.data:null}),n=U(()=>t.value?.operation??null),r=U(()=>t.value?.cookies.workspace??[]),i=U(()=>t.value?.cookies.document??[]),a=U(()=>t.value?.servers.list??[]),o=U(()=>t.value?.servers.selected??null),s=U(()=>t.value?.servers.meta??{type:`document`}),c=U(()=>t.value?.security.schemes??{}),l=U(()=>t.value?.security.selected??{selectedIndex:-1,selectedSchemes:[]}),u=U(()=>t.value?.security.selectedSchemes??[]),d=U(()=>t.value?.security.requirements??[]),f=U(()=>t.value?.security.meta??{type:`document`}),p=U(()=>t.value?.headers.default??{}),m=U(()=>Array.from(new Set(Object.keys({...e.document?.[`x-scalar-environments`],...e.workspaceStore.workspace[`x-scalar-environments`]})))),h=U(()=>S4(Cn(e.options)?.hiddenClients));return(t,g)=>e.path&&e.method&&e.exampleName&&n.value&&e.document?(F(),L(j(m$t),{key:0,activeEnvironment:e.workspaceStore.workspace[`x-scalar-active-environment`],appVersion:j(wY),authMeta:f.value,defaultHeaders:p.value,document:e.document,documentCookies:i.value,documentSecurity:e.document?.security??[],documentSlug:e.documentSlug,documentUrl:e.document?.[`x-scalar-original-source-url`],environment:e.environment,environments:m.value,eventBus:e.eventBus,exampleKey:e.exampleName,hideClientButton:Cn(e.options)?.hideClientButton??!1,history:e.workspaceStore.history.getHistory(e.documentSlug,e.path,e.method),httpClients:h.value,layout:e.layout,method:e.method,operation:n.value,options:e.options,path:e.path,plugins:e.plugins,proxyUrl:j(jI)(e.workspaceStore.workspace[`x-scalar-active-proxy`],e.layout===`web`?`web`:`other`)??``,requestBodyCompositionSelection:e.requestBodyCompositionSelection,securityRequirements:d.value,securitySchemes:c.value,selectedClient:e.workspaceStore.workspace[`x-scalar-default-client`],selectedSecurity:l.value,selectedSecuritySchemes:u.value,server:o.value,serverMeta:s.value,servers:a.value,workspaceCookies:r.value},null,8,`activeEnvironment.appVersion.authMeta.defaultHeaders.document.documentCookies.documentSecurity.documentSlug.documentUrl.environment.environments.eventBus.exampleKey.hideClientButton.history.httpClients.layout.method.operation.options.path.plugins.proxyUrl.requestBodyCompositionSelection.securityRequirements.securitySchemes.selectedClient.selectedSecurity.selectedSecuritySchemes.server.serverMeta.servers.workspaceCookies`.split(`.`))):(F(),I(`div`,Onn,[...g[0]||=[R(`span`,{class:`text-c-3`},`Select an operation to view details`,-1)]]))}})})),jnn,Mnn=s((()=>{Ann(),jnn=knn})),Nnn,Pnn=s((()=>{W(),Nnn=e=>{let t=A(``),n=A(!1),r=()=>{let n=Cn(e);n&&(t.value=n.style.overflow,n.style.overflow=`hidden`)},i=()=>{let n=Cn(e);n&&(t.value===``?n.style.removeProperty(`overflow`):n.style.overflow=t.value)},a=U({get:()=>n.value,set:e=>{n.value=e,e?r():i()}});return Wi(()=>{n.value&&i()}),a}})),Fnn,Inn,Lnn,Rnn=s((()=>{utn(),jtn(),ztn(),Dnn(),l2t(),Mnn(),Pnn(),W(),QI(),gX(),Fnn={key:0,class:`relative flex h-full min-h-0 w-full flex-1`},Inn={key:1,class:`flex h-full w-full items-center justify-center`},Lnn=N({__name:`Modal`,props:{workspaceStore:{},document:{},path:{},eventBus:{},method:{},exampleName:{},requestBodyCompositionSelection:{},modalState:{},sidebarState:{},plugins:{},options:{}},setup(e,{expose:t}){let n={label:`default`,id:`default`},r=A(!1);s2t({eventBus:e.eventBus,isSidebarOpen:r,requestBodyCompositionSelection:e.requestBodyCompositionSelection,sidebarState:e.sidebarState,modalState:e.modalState,store:e.workspaceStore}),ltn(e.eventBus,`modal`,()=>!e.modalState.open);let i=()=>{e.eventBus.emit(`operation:cancel:request`)},a=Nnn(()=>typeof window<`u`?window.document.body:null);mr(()=>e.modalState.open,e=>{a.value=e,e||i()}),Wi(()=>i());let o=U(()=>e.workspaceStore?.workspace?.[`x-scalar-sidebar-width`]??288),s=t=>e.workspaceStore?.update(`x-scalar-sidebar-width`,t),c=U(()=>kI(e.workspaceStore,e.document.value).environment);return t({sidebarWidth:o,environment:c}),(t,i)=>(F(),L(Enn,{modalState:e.modalState},{default:M(()=>[H(j(hX)),e.document.value&&e.path?.value&&e.method?.value?(F(),I(`main`,Fnn,[H(j(Rtn),{modelValue:r.value,"onUpdate:modelValue":i[0]||=e=>r.value=e,class:`absolute top-2 left-4 z-10 max-md:top-4`},null,8,[`modelValue`]),lr(H(j(Atn),{sidebarWidth:o.value,"onUpdate:sidebarWidth":[i[1]||=e=>o.value=e,s],activeWorkspace:n,class:`h-full max-md:absolute! max-md:z-5 max-md:w-full!`,documents:[e.document.value],eventBus:e.eventBus,isDroppable:()=>!1,layout:`modal`,sidebarState:e.sidebarState.state,workspaces:[],onSelectItem:e.sidebarState.handleSelectItem},null,8,[`sidebarWidth`,`documents`,`eventBus`,`sidebarState`,`onSelectItem`]),[[Za,r.value]]),H(jnn,{activeWorkspace:n,class:`flex-1`,document:e.document.value,documentSlug:e.document.value[`x-scalar-navigation`]?.id??``,environment:c.value,eventBus:e.eventBus,exampleName:e.exampleName?.value,layout:`modal`,method:e.method?.value,options:e.options,path:e.path?.value,plugins:e.plugins,requestBodyCompositionSelection:e.requestBodyCompositionSelection.value,workspaceStore:e.workspaceStore},null,8,[`document`,`documentSlug`,`environment`,`eventBus`,`exampleName`,`method`,`options`,`path`,`plugins`,`requestBodyCompositionSelection`,`workspaceStore`])])):(F(),I(`div`,Inn,[...i[2]||=[R(`span`,{class:`text-c-3`},`No document selected`,-1)]]))]),_:1},8,[`modalState`]))}})})),znn,Bnn=s((()=>{Rnn(),znn=Lnn})),h3,g3=s((()=>{h3=(e={})=>{let{delay:t=328,maxWait:n}=e,r=new Map,i=new Map,a=new Map,o=()=>{r.forEach(clearTimeout),i.forEach(clearTimeout),r.clear(),i.clear(),a.clear()},s=e=>{let t=a.get(e),n=r.get(e);n!==void 0&&(clearTimeout(n),r.delete(e));let o=i.get(e);if(o!==void 0&&(clearTimeout(o),i.delete(e)),a.delete(e),t!==void 0)try{t()}catch{}};return{execute:(e,o)=>{a.set(e,o);let c=r.get(e);c!==void 0&&clearTimeout(c),r.set(e,setTimeout(()=>s(e),t)),n!==void 0&&!i.has(e)&&i.set(e,setTimeout(()=>s(e),n))},cleanup:o,flush:e=>{a.has(e)&&s(e)},flushAll:()=>{let e=[...a.keys()];for(let t of e)s(t)}}}})),_3,Vnn=s((()=>{g3(),dD(),_3=(e={})=>{let{debug:t=!1}=e,n=new Map,r=new Set,i=[],a=null,{execute:o,flushAll:s}=h3({delay:328}),c=e=>{let t=n.get(e)??new Set;return n.set(e,t),t},l=()=>{if(i.length!==0){if(t)if(i.length===1){let e=i[0];e&&console.log(`[EventBus] ${e.message}`,...e.args)}else{console.groupCollapsed(`[EventBus] ${i.length} operations`);for(let{message:e,args:t}of i)console.log(e,...t);console.groupEnd()}i.length=0,a=null}},u=(e,...n)=>{t&&(i.push({message:e,args:n}),a&&clearTimeout(a),a=setTimeout(l,500))},d=(e,t)=>{let n=r=>{p(e,n),t(r)};return f(e,n)},f=(e,t)=>{let n=c(e);return n.add(t),u(`Added listener for "${String(e)}" (${n.size} total)`),()=>p(e,t)},p=(e,t)=>{let r=n.get(e);r&&(r.delete(t),u(`Removed listener for "${String(e)}" (${r.size} remaining)`),r.size===0&&n.delete(e))},m=e=>(r.add(e),u(`Added wildcard listener (${r.size} total)`),()=>h(e)),h=e=>{r.delete(e),u(`Removed wildcard listener (${r.size} remaining)`)},g=(e,t,i)=>{let a=i?.skipUnpackProxy?t:uD(t,{depth:5}),o=n.get(e),s=o!==void 0&&o.size>0;if(!s&&r.size===0){u(`🛑 No listeners for "${String(e)}"`);return}if(s&&o){u(`Emitting "${String(e)}" to ${o.size} listener(s)`,t);let n=Array.from(o);for(let t of n)try{t(a)}catch(t){console.error(`[EventBus] Error in listener for "${String(e)}":`,t)}}if(r.size>0){u(`Emitting "${String(e)}" to ${r.size} wildcard listener(s)`,t);let n={event:e,payload:a},i=Array.from(r);for(let t of i)try{t(n)}catch(t){console.error(`[EventBus] Error in wildcard listener for "${String(e)}":`,t)}}};return{on:f,once:d,off:p,onAny:m,offAny:h,emit:(...e)=>{let[t,n,r]=e;if(!r?.debounceKey){g(t,n,r);return}o(`${t}-${r.debounceKey}`,()=>g(t,n,r))},flushDebouncedEmits:()=>{s()}}}})),Hnn=s((()=>{W()})),v3=s((()=>{Vnn(),Hnn()})),y3,Unn=s((()=>{_2t(),ntn(),Bnn(),W(),kE(),_2(),v3(),OI(),y3=({el:e,eventBus:t=_3({debug:!1}),mountOnInitialize:n=!0,plugins:r=[],workspaceStore:i,options:a={}})=>{let o=A({}),s=xn(a)?a:A(Cn(a)),c={path:`default`,method:`default`,example:`default`,documentSlug:i.workspace[`x-scalar-active-document`]||`default`},l=fn({...c}),u=e=>{Object.assign(l,c,e)},d=U(()=>g2t(i,l)),f=U(()=>d.value.documentSlug),p=U(()=>d.value.path),m=U(()=>d.value.method),h=U(()=>d.value.example),g=U(()=>{let e=i.workspace.documents[f.value??``];return EI(e)?e:null}),_=ttn({workspaceStore:i,documentSlug:f,path:p,method:m,exampleName:h,route:u}),v=nE(),y=vo(znn,{document:g,eventBus:t,exampleName:h,method:m,modalState:v,path:p,plugins:r,requestBodyCompositionSelection:o,sidebarState:_,workspaceStore:i,options:s}),b=()=>{o.value={}},x=[];for(let e of r)e.lifecycle?.onInit?.(),x.push(zqt(t,e));y.onUnmount(()=>{for(let e of x)e();for(let e of r)e.lifecycle?.onDestroy?.()}),mr(()=>v.open,e=>e?null:b()),mr(()=>Cn(s).proxyUrl,e=>i.update(`x-scalar-active-proxy`,e),{immediate:!0}),y.config.idPrefix=`scalar-client`;let S=(t=e)=>{if(!t){console.error(`[@scalar/api-client] Could not create the API client Modal.`,`Invalid HTML element provided.`,`Read more: https://github.com/scalar/scalar/tree/main/packages/api-client`);return}y.mount(t)};return n&&S(),{app:y,open:e=>{v.open=!0,e&&u(e)},mount:S,route:u,modalState:v,updateOptions:(e,t=!1)=>{s.value=t?e:{...s.value,...e}}}}})),b3=s((()=>{l2t(),u2t(),Unn()}));b3();var Wnn=`/* Inter (--scalar-font) */
-/* cyrillic-ext */
-@font-face {
-  font-family: "Inter";
-  font-style: normal;
-  font-weight: 100 900;
-  font-display: swap;
-  src: url(https://fonts.scalar.com/inter-cyrillic-ext.woff2) format("woff2");
-  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
-}
-/* cyrillic */
-@font-face {
-  font-family: "Inter";
-  font-style: normal;
-  font-weight: 100 900;
-  font-display: swap;
-  src: url(https://fonts.scalar.com/inter-cyrillic.woff2) format("woff2");
-  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
-}
-/* greek-ext */
-@font-face {
-  font-family: "Inter";
-  font-style: normal;
-  font-weight: 100 900;
-  font-display: swap;
-  src: url(https://fonts.scalar.com/inter-greek-ext.woff2) format("woff2");
-  unicode-range: U+1F00-1FFF;
-}
-/* greek */
-@font-face {
-  font-family: "Inter";
-  font-style: normal;
-  font-weight: 100 900;
-  font-display: swap;
-  src: url(https://fonts.scalar.com/inter-greek.woff2) format("woff2");
-  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
-}
-/* vietnamese */
-@font-face {
-  font-family: "Inter";
-  font-style: normal;
-  font-weight: 100 900;
-  font-display: swap;
-  src: url(https://fonts.scalar.com/inter-vietnamese.woff2) format("woff2");
-  unicode-range:
-    U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169,
-    U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323,
-    U+0329, U+1EA0-1EF9, U+20AB;
-}
-/* latin-ext */
-@font-face {
-  font-family: "Inter";
-  font-style: normal;
-  font-weight: 100 900;
-  font-display: swap;
-  src: url(https://fonts.scalar.com/inter-latin-ext.woff2) format("woff2");
-  unicode-range:
-    U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F,
-    U+A720-A7FF;
-}
-/* latin */
-@font-face {
-  font-family: "Inter";
-  font-style: normal;
-  font-weight: 100 900;
-  font-display: swap;
-  src: url(https://fonts.scalar.com/inter-latin.woff2) format("woff2");
-  unicode-range:
-    U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA,
-    U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191,
-    U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-/* keyboard symbols (←↑→↓↵⇧⇪⌘⌥) */
-@font-face {
-  font-family: "Inter";
-  font-style: normal;
-  font-weight: 100 900;
-  font-display: swap;
-  src: url(https://fonts.scalar.com/inter-symbols.woff2) format("woff2");
-  unicode-range: U+2190-2193, U+21B5, U+21E7, U+21EA, U+2318, U+2325;
-}
-/* JetBrains Mono (--scalar-font-code) */
-/* cyrillic-ext */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 400;
-  src: url(https://fonts.scalar.com/mono-cyrillic-ext.woff2) format("woff2");
-  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
-}
-/* cyrillic */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 400;
-  src: url(https://fonts.scalar.com/mono-cyrillic.woff2) format("woff2");
-  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
-}
-/* greek */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 400;
-  src: url(https://fonts.scalar.com/mono-greek.woff2) format("woff2");
-  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
-}
-/* vietnamese */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 400;
-  src: url(https://fonts.scalar.com/mono-vietnamese.woff2) format("woff2");
-  unicode-range:
-    U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169,
-    U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323,
-    U+0329, U+1EA0-1EF9, U+20AB;
-}
-/* latin-ext */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 400;
-  src: url(https://fonts.scalar.com/mono-latin-ext.woff2) format("woff2");
-  unicode-range:
-    U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F,
-    U+A720-A7FF;
-}
-/* latin */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 400;
-  src: url(https://fonts.scalar.com/mono-latin.woff2) format("woff2");
-  unicode-range:
-    U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA,
-    U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191,
-    U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-`,Gnn=`/* basic theme */
-:root {
-  --scalar-text-decoration: underline;
-  --scalar-text-decoration-hover: underline;
-}
-
-.dark-mode {
-  --scalar-background-1: #131313;
-  --scalar-background-2: #1d1d1d;
-  --scalar-background-3: #272727;
-  --scalar-background-card: #1d1d1d;
-
-  --scalar-color-1: rgba(255, 255, 255, 0.9);
-  --scalar-color-2: rgba(255, 255, 255, 0.62);
-  --scalar-color-3: rgba(255, 255, 255, 0.44);
-
-  --scalar-color-accent: var(--scalar-color-1);
-  --scalar-background-accent: var(--scalar-background-3);
-
-  --scalar-border-color: #2a2b2a;
-}
-
-.light-mode,
-.light-mode .dark-mode {
-  --scalar-background-1: #f9f9f9;
-  --scalar-background-2: #f1f1f1;
-  --scalar-background-3: #e7e7e7;
-  --scalar-background-card: #fff;
-
-  --scalar-color-1: #1b1b1b;
-  --scalar-color-2: #757575;
-  --scalar-color-3: #8e8e8e;
-
-  --scalar-color-accent: var(--scalar-color-1);
-  --scalar-background-accent: var(--scalar-background-3);
-
-  --scalar-border-color: rgba(0, 0, 0, 0.1);
-}
-
-/* Document Sidebar */
-.t-doc__sidebar {
-  --scalar-color-green: var(--scalar-color-1);
-  --scalar-color-red: var(--scalar-color-1);
-  --scalar-color-yellow: var(--scalar-color-1);
-  --scalar-color-blue: var(--scalar-color-1);
-  --scalar-color-orange: var(--scalar-color-1);
-  --scalar-color-purple: var(--scalar-color-1);
-}
-
-.light-mode .t-doc__sidebar,
-.dark-mode .t-doc__sidebar {
-  --scalar-sidebar-background-1: var(--scalar-background-1);
-  --scalar-sidebar-color-1: var(--scalar-color-1);
-  --scalar-sidebar-color-2: var(--scalar-color-2);
-  --scalar-sidebar-border-color: var(--scalar-border-color);
-
-  --scalar-sidebar-item-hover-background: var(--scalar-background-2);
-  --scalar-sidebar-item-hover-color: currentColor;
-
-  --scalar-sidebar-item-active-background: var(--scalar-background-accent);
-  --scalar-sidebar-color-active: var(--scalar-color-accent);
-
-  --scalar-sidebar-search-background: transparent;
-  --scalar-sidebar-search-color: var(--scalar-color-3);
-  --scalar-sidebar-search-border-color: var(--scalar-border-color);
-}
-/* advanced */
-.light-mode .dark-mode,
-.light-mode {
-  --scalar-color-green: #069061;
-  --scalar-color-red: #ef0006;
-  --scalar-color-yellow: #edbe20;
-  --scalar-color-blue: #0082d0;
-  --scalar-color-orange: #fb892c;
-  --scalar-color-purple: #5203d1;
-
-  --scalar-button-1: rgba(0, 0, 0, 1);
-  --scalar-button-1-hover: rgba(0, 0, 0, 0.8);
-  --scalar-button-1-color: rgba(255, 255, 255, 0.9);
-}
-.dark-mode {
-  --scalar-color-green: #00b648;
-  --scalar-color-red: #dd2f2c;
-  --scalar-color-yellow: #ffc90d;
-  --scalar-color-blue: #4eb3ec;
-  --scalar-color-orange: #ff8d4d;
-  --scalar-color-purple: #b191f9;
-
-  --scalar-button-1: rgba(255, 255, 255, 1);
-  --scalar-button-1-hover: rgba(255, 255, 255, 0.9);
-  --scalar-button-1-color: black;
-}
-
-.scalar-api-client__item,
-.scalar-card,
-.dark-mode .dark-mode.scalar-card {
-  --scalar-background-1: var(--scalar-background-card);
-  --scalar-background-2: var(--scalar-background-1);
-  --scalar-background-3: var(--scalar-background-1);
-}
-.dark-mode .dark-mode.scalar-card {
-  --scalar-background-3: var(--scalar-background-3);
-}
-
-.light-mode *::selection {
-  background-color: color-mix(in srgb, var(--scalar-color-blue), transparent 70%);
-}
-.dark-mode *::selection {
-  background-color: color-mix(in srgb, var(--scalar-color-blue), transparent 50%);
-}
-`,Knn=`/* basic theme */
-:root {
-  --scalar-text-decoration: underline;
-  --scalar-text-decoration-hover: underline;
-}
-.light-mode {
-  --scalar-background-1: #f0f2f5;
-  --scalar-background-2: #eaecf0;
-  --scalar-background-3: #e0e2e6;
-  --scalar-border-color: rgb(213 213 213);
-
-  --scalar-color-1: rgb(9, 9, 11);
-  --scalar-color-2: rgb(113, 113, 122);
-  --scalar-color-3: rgba(25, 25, 28, 0.5);
-
-  --scalar-color-accent: var(--scalar-color-1);
-  --scalar-background-accent: #8ab4f81f;
-}
-.light-mode .scalar-card.dark-mode,
-.dark-mode {
-  --scalar-background-1: #000e23;
-  --scalar-background-2: #01132e;
-  --scalar-background-3: #03193b;
-  --scalar-border-color: #2e394c;
-
-  --scalar-color-1: #fafafa;
-  --scalar-color-2: rgb(161, 161, 170);
-  --scalar-color-3: rgba(255, 255, 255, 0.533);
-
-  --scalar-color-accent: var(--scalar-color-1);
-  --scalar-background-accent: #8ab4f81f;
-
-  --scalar-code-language-color-supersede: var(--scalar-color-1);
-}
-/* Document Sidebar */
-.light-mode .t-doc__sidebar,
-.dark-mode .t-doc__sidebar {
-  --scalar-sidebar-background-1: var(--scalar-background-1);
-  --scalar-sidebar-color-1: var(--scalar-color-1);
-  --scalar-sidebar-color-2: var(--scalar-color-2);
-  --scalar-sidebar-border-color: var(--scalar-border-color);
-
-  --scalar-sidebar-item-hover-background: var(--scalar-background-2);
-  --scalar-sidebar-item-hover-color: currentColor;
-
-  --scalar-sidebar-item-active-background: var(--scalar-background-3);
-  --scalar-sidebar-color-active: var(--scalar-color-accent);
-
-  --scalar-sidebar-search-background: rgba(255, 255, 255, 0.1);
-  --scalar-sidebar-search-border-color: var(--scalar-border-color);
-  --scalar-sidebar-search-color: var(--scalar-color-3);
-  z-index: 1;
-}
-.light-mode .t-doc__sidebar {
-  --scalar-sidebar-search-background: white;
-}
-/* advanced */
-.light-mode {
-  --scalar-color-green: #069061;
-  --scalar-color-red: #ef0006;
-  --scalar-color-yellow: #edbe20;
-  --scalar-color-blue: #0082d0;
-  --scalar-color-orange: #fb892c;
-  --scalar-color-purple: #5203d1;
-
-  --scalar-button-1: rgba(0, 0, 0, 1);
-  --scalar-button-1-hover: rgba(0, 0, 0, 0.8);
-  --scalar-button-1-color: rgba(255, 255, 255, 0.9);
-}
-.dark-mode {
-  --scalar-color-green: rgba(69, 255, 165, 0.823);
-  --scalar-color-red: #ff8589;
-  --scalar-color-yellow: #ffcc4d;
-  --scalar-color-blue: #6bc1fe;
-  --scalar-color-orange: #f98943;
-  --scalar-color-purple: #b191f9;
-
-  --scalar-button-1: rgba(255, 255, 255, 1);
-  --scalar-button-1-hover: rgba(255, 255, 255, 0.9);
-  --scalar-button-1-color: black;
-}
-/* Custom theme */
-/* Document header */
-@keyframes headerbackground {
-  from {
-    background: transparent;
-    backdrop-filter: none;
-  }
-  to {
-    background: var(--scalar-header-background-1);
-    backdrop-filter: blur(12px);
-  }
-}
-
-.light-mode .t-doc__header,
-.dark-mode .t-doc__header {
-  animation: headerbackground forwards;
-  animation-timeline: scroll();
-  animation-range: 0px 200px;
-}
-
-/* Document Layout */
-.dark-mode .t-doc .layout-content {
-  background: transparent;
-}
-
-.dark-mode h2.t-editor__heading,
-.dark-mode .t-editor__page-title h1,
-.dark-mode h1.section-header:not(::selection),
-.dark-mode .markdown h1,
-.dark-mode .markdown h2,
-.dark-mode .markdown h3,
-.dark-mode .markdown h4,
-.dark-mode .markdown h5,
-.dark-mode .markdown h6 {
-  -webkit-text-fill-color: transparent;
-  background-image: linear-gradient(to right bottom, rgb(255, 255, 255) 30%, rgba(255, 255, 255, 0.38));
-  -webkit-background-clip: text;
-  background-clip: text;
-}
-/* Hero Section Flare */
-.section-flare-item:nth-of-type(1) {
-  --c1: #ffffff;
-  --c2: #babfd8;
-  --c3: #2e8bb2;
-  --c4: #1a8593;
-  --c5: #0a143e;
-  --c6: #0a0f52;
-  --c7: #2341b8;
-
-  --solid: var(--c1), var(--c2), var(--c3), var(--c4), var(--c5), var(--c6), var(--c7);
-  --solid-wrap: var(--solid), var(--c1);
-  --trans:
-    var(--c1), transparent, var(--c2), transparent, var(--c3),
-    transparent, var(--c4), transparent, var(--c5), transparent, var(--c6),
-    transparent, var(--c7);
-  --trans-wrap: var(--trans), transparent, var(--c1);
-
-  background:
-    radial-gradient(circle, var(--trans)), conic-gradient(from 180deg, var(--trans-wrap)),
-    radial-gradient(circle, var(--trans)), conic-gradient(var(--solid-wrap));
-  width: 70vw;
-  height: 700px;
-  border-radius: 50%;
-  filter: blur(100px);
-  z-index: 0;
-  right: 0;
-  position: absolute;
-  transform: rotate(-45deg);
-  top: -300px;
-  opacity: 0.3;
-}
-.section-flare-item:nth-of-type(3) {
-  --star-color: #6b9acc;
-  --star-color2: #446b8d;
-  --star-color3: #3e5879;
-  background-image:
-    radial-gradient(2px 2px at 20px 30px, var(--star-color2), rgba(0, 0, 0, 0)),
-    radial-gradient(2px 2px at 40px 70px, var(--star-color), rgba(0, 0, 0, 0)),
-    radial-gradient(2px 2px at 50px 160px, var(--star-color3), rgba(0, 0, 0, 0)),
-    radial-gradient(2px 2px at 90px 40px, var(--star-color), rgba(0, 0, 0, 0)),
-    radial-gradient(2px 2px at 130px 80px, var(--star-color), rgba(0, 0, 0, 0)),
-    radial-gradient(2px 2px at 160px 120px, var(--star-color3), rgba(0, 0, 0, 0));
-  background-repeat: repeat;
-  background-size: 200px 200px;
-  width: 100%;
-  height: 100%;
-  mask-image: radial-gradient(ellipse at 100% 0%, black 40%, transparent 70%);
-}
-.section-flare {
-  top: -150px !important;
-  height: 100vh;
-  background: linear-gradient(#000, var(--scalar-background-1));
-  width: 100vw;
-  overflow-x: hidden;
-}
-.light-mode .section-flare {
-  display: none;
-}
-.light-mode .scalar-card {
-  --scalar-background-1: #fff;
-  --scalar-background-2: #fff;
-  --scalar-background-3: #fff;
-}
-
-*::selection {
-  background-color: color-mix(in srgb, var(--scalar-color-blue), transparent 60%);
-}
-
-@media (max-width: 1000px) {
-  .light-mode .t-doc__sidebar,
-  .dark-mode .t-doc__sidebar {
-    --scalar-sidebar-background-1: var(--scalar-background-1);
-  }
-  .light-mode .t-doc__header,
-  .dark-mode .t-doc__header {
-    animation: none;
-    background: var(--scalar-header-background-1);
-    backdrop-filter: blur(12px);
-  }
-}
-`,qnn=`/* basic theme */
-:root {
-  --scalar-text-decoration: underline;
-  --scalar-text-decoration-hover: underline;
-}
-.light-mode {
-  --scalar-color-1: rgb(9, 9, 11);
-  --scalar-color-2: rgb(113, 113, 122);
-  --scalar-color-3: rgba(25, 25, 28, 0.5);
-  --scalar-color-accent: var(--scalar-color-1);
-
-  --scalar-background-1: #fff;
-  --scalar-background-2: #f4f4f5;
-  --scalar-background-3: #e3e3e6;
-  --scalar-background-accent: #8ab4f81f;
-
-  --scalar-border-color: rgb(228, 228, 231);
-  --scalar-code-language-color-supersede: var(--scalar-color-1);
-}
-.dark-mode {
-  --scalar-color-1: #fafafa;
-  --scalar-color-2: rgb(161, 161, 170);
-  --scalar-color-3: rgba(255, 255, 255, 0.533);
-  --scalar-color-accent: var(--scalar-color-1);
-
-  --scalar-background-1: #09090b;
-  --scalar-background-2: #18181b;
-  --scalar-background-3: #2c2c30;
-  --scalar-background-accent: #8ab4f81f;
-
-  --scalar-border-color: rgba(255, 255, 255, 0.16);
-  --scalar-code-language-color-supersede: var(--scalar-color-1);
-}
-
-/* Document Sidebar */
-.light-mode .t-doc__sidebar,
-.dark-mode .t-doc__sidebar {
-  --scalar-sidebar-background-1: var(--scalar-background-1);
-  --scalar-sidebar-color-1: var(--scalar-color-1);
-  --scalar-sidebar-color-2: var(--scalar-color-2);
-  --scalar-sidebar-border-color: var(--scalar-border-color);
-
-  --scalar-sidebar-item-hover-color: currentColor;
-  --scalar-sidebar-item-hover-background: var(--scalar-background-2);
-
-  --scalar-sidebar-item-active-background: var(--scalar-background-3);
-  --scalar-sidebar-color-active: var(--scalar-color-accent);
-
-  --scalar-sidebar-search-background: transparent;
-  --scalar-sidebar-search-border-color: var(--scalar-border-color);
-  --scalar-sidebar-search-color: var(--scalar-color-3);
-}
-.light-mode .t-doc__sidebar {
-  --scalar-sidebar-item-active-background: var(--scalar-background-2);
-}
-/* advanced */
-.light-mode {
-  --scalar-color-green: #069061;
-  --scalar-color-red: #ef0006;
-  --scalar-color-yellow: #edbe20;
-  --scalar-color-blue: #0082d0;
-  --scalar-color-orange: #fb892c;
-  --scalar-color-purple: #5203d1;
-
-  --scalar-button-1: rgba(0, 0, 0, 1);
-  --scalar-button-1-hover: rgba(0, 0, 0, 0.8);
-  --scalar-button-1-color: rgba(255, 255, 255, 0.9);
-}
-.dark-mode {
-  --scalar-color-green: rgba(69, 255, 165, 0.823);
-  --scalar-color-red: #ff8589;
-  --scalar-color-yellow: #ffcc4d;
-  --scalar-color-blue: #6bc1fe;
-  --scalar-color-orange: #f98943;
-  --scalar-color-purple: #b191f9;
-
-  --scalar-button-1: rgba(255, 255, 255, 1);
-  --scalar-button-1-hover: rgba(255, 255, 255, 0.9);
-  --scalar-button-1-color: black;
-}
-/* Custom theme */
-.dark-mode h2.t-editor__heading,
-.dark-mode .t-editor__page-title h1,
-.dark-mode h1.section-header:not(::selection),
-.dark-mode .markdown h1,
-.dark-mode .markdown h2,
-.dark-mode .markdown h3,
-.dark-mode .markdown h4,
-.dark-mode .markdown h5,
-.dark-mode .markdown h6 {
-  -webkit-text-fill-color: transparent;
-  background-image: linear-gradient(to right bottom, rgb(255, 255, 255) 30%, rgba(255, 255, 255, 0.38));
-  -webkit-background-clip: text;
-  background-clip: text;
-}
-.examples .scalar-card-footer {
-  --scalar-background-3: transparent;
-  padding-top: 0;
-}
-/* Hero section flare */
-.section-flare {
-  width: 100vw;
-  height: 550px;
-  position: absolute;
-}
-.section-flare-item:nth-of-type(1) {
-  position: absolute;
-  width: 100vw;
-  height: 550px;
-  --stripesDark: repeating-linear-gradient(100deg, #000 0%, #000 7%, transparent 10%, transparent 12%, #000 16%);
-  --rainbow: repeating-linear-gradient(100deg, #fff 10%, #fff 16%, #fff 22%, #fff 30%);
-  background-image: var(--stripesDark), var(--rainbow);
-  background-size: 300%, 200%;
-  background-position:
-    50% 50%,
-    50% 50%;
-  filter: invert(100%);
-  -webkit-mask-image: radial-gradient(ellipse at 100% 0%, black 40%, transparent 70%);
-  mask-image: radial-gradient(ellipse at 100% 0%, black 40%, transparent 70%);
-  pointer-events: none;
-  opacity: 0.07;
-}
-.dark-mode .section-flare-item:nth-of-type(1) {
-  background-image: var(--stripesDark), var(--rainbow);
-  filter: opacity(50%) saturate(200%);
-  opacity: 0.25;
-  height: 350px;
-}
-.section-flare-item:nth-of-type(1):after {
-  content: "";
-  position: absolute;
-  top: 0;
-  right: 0;
-  bottom: 0;
-  left: 0;
-  background-image: var(--stripesDark), var(--rainbow);
-  background-size: 200%, 100%;
-  background-attachment: fixed;
-  mix-blend-mode: difference;
-}
-.dark-mode .section-flare:after {
-  background-image: var(--stripesDark), var(--rainbow);
-}
-.section-flare-item:nth-of-type(2) {
-  --star-color: #fff;
-  --star-color2: #fff;
-  --star-color3: #fff;
-  width: 100%;
-  height: 100%;
-  position: absolute;
-  background-image:
-    radial-gradient(2px 2px at 20px 30px, var(--star-color2), rgba(0, 0, 0, 0)),
-    radial-gradient(2px 2px at 40px 70px, var(--star-color), rgba(0, 0, 0, 0)),
-    radial-gradient(2px 2px at 50px 160px, var(--star-color3), rgba(0, 0, 0, 0)),
-    radial-gradient(2px 2px at 90px 40px, var(--star-color), rgba(0, 0, 0, 0)),
-    radial-gradient(2px 2px at 130px 80px, var(--star-color), rgba(0, 0, 0, 0)),
-    radial-gradient(2px 2px at 160px 120px, var(--star-color3), rgba(0, 0, 0, 0));
-  background-repeat: repeat;
-  background-size: 200px 200px;
-  mask-image: radial-gradient(ellipse at 100% 0%, black 40%, transparent 70%);
-  opacity: 0.2;
-}
-.light-mode *::selection {
-  background-color: color-mix(in srgb, var(--scalar-color-blue), transparent 70%);
-}
-.dark-mode *::selection {
-  background-color: color-mix(in srgb, var(--scalar-color-blue), transparent 50%);
-}
-
-/* document header */
-.light-mode .t-doc__header,
-.dark-mode .t-doc__header {
-  animation: headerbackground forwards;
-  animation-timeline: scroll();
-  animation-range: 0px 200px;
-}
-@keyframes headerbackground {
-  from {
-    background: transparent;
-    backdrop-filter: none;
-  }
-  to {
-    background: var(--scalar-header-background-1);
-    backdrop-filter: blur(12px);
-  }
-}
-/* remove flare on safari to prevent dropped frames on scroll */
-@supports (-webkit-hyphens: none) {
-  .section-flare {
-    display: none;
-  }
-}
-
-/* document background */
-.light-mode .t-doc .layout-content,
-.dark-mode .t-doc .layout-content {
-  background: transparent;
-}
-`,Jnn=`/* basic theme */
-:root {
-  --scalar-text-decoration: underline;
-  --scalar-text-decoration-hover: underline;
-}
-.light-mode {
-  --scalar-background-1: #fff;
-  --scalar-background-2: #f6f6f6;
-  --scalar-background-3: #e7e7e7;
-  --scalar-background-accent: #8ab4f81f;
-
-  --scalar-color-1: #1b1b1b;
-  --scalar-color-2: #757575;
-  --scalar-color-3: #8e8e8e;
-
-  --scalar-color-accent: #0099ff;
-  --scalar-border-color: #dfdfdf;
-}
-.dark-mode {
-  --scalar-background-1: #0f0f0f;
-  --scalar-background-2: #1a1a1a;
-  --scalar-background-3: #272727;
-
-  --scalar-color-1: #e7e7e7;
-  --scalar-color-2: #a4a4a4;
-  --scalar-color-3: #797979;
-
-  --scalar-color-accent: #00aeff;
-  --scalar-background-accent: #3ea6ff1f;
-
-  --scalar-border-color: #2d2d2d;
-}
-/* Document Sidebar */
-.light-mode,
-.dark-mode {
-  --scalar-sidebar-background-1: var(--scalar-background-1);
-  --scalar-sidebar-color-1: var(--scalar-color-1);
-  --scalar-sidebar-color-2: var(--scalar-color-2);
-  --scalar-sidebar-border-color: var(--scalar-border-color);
-
-  --scalar-sidebar-item-hover-background: var(--scalar-background-2);
-  --scalar-sidebar-item-hover-color: var(--scalar-sidebar-color-2);
-
-  --scalar-sidebar-item-active-background: var(--scalar-background-2);
-  --scalar-sidebar-color-active: var(--scalar-sidebar-color-1);
-
-  --scalar-sidebar-indent-border: var(--scalar-sidebar-border-color);
-  --scalar-sidebar-indent-border-hover: var(--scalar-sidebar-border-color);
-  --scalar-sidebar-indent-border-active: var(--scalar-sidebar-border-color);
-
-  --scalar-sidebar-search-background: color-mix(in srgb, var(--scalar-background-2), var(--scalar-background-1));
-  --scalar-sidebar-search-color: var(--scalar-color-3);
-  --scalar-sidebar-search-border-color: var(--scalar-border-color);
-}
-/* advanced */
-.light-mode {
-  --scalar-color-green: #069061;
-  --scalar-color-red: #ef0006;
-  --scalar-color-yellow: #edbe20;
-  --scalar-color-blue: #0082d0;
-  --scalar-color-orange: #ff5800;
-  --scalar-color-purple: #5203d1;
-
-  --scalar-link-color: var(--scalar-color-1);
-  --scalar-link-color-hover: var(--scalar-link-color);
-
-  --scalar-button-1: rgba(0, 0, 0, 1);
-  --scalar-button-1-hover: rgba(0, 0, 0, 0.8);
-  --scalar-button-1-color: rgba(255, 255, 255, 0.9);
-
-  --scalar-tooltip-background: color-mix(in srgb, #1a1a1a, transparent 10%);
-  --scalar-tooltip-color: color-mix(in srgb, #fff, transparent 15%);
-
-  --scalar-color-alert: color-mix(in srgb, var(--scalar-color-orange), var(--scalar-color-1) 20%);
-  --scalar-color-danger: color-mix(in srgb, var(--scalar-color-red), var(--scalar-color-1) 20%);
-
-  --scalar-background-alert: color-mix(in srgb, var(--scalar-color-orange), var(--scalar-background-1) 95%);
-  --scalar-background-danger: color-mix(in srgb, var(--scalar-color-red), var(--scalar-background-1) 95%);
-}
-.dark-mode {
-  --scalar-color-green: #00b648;
-  --scalar-color-red: #dc1b19;
-  --scalar-color-yellow: #ffc90d;
-  --scalar-color-blue: #4eb3ec;
-  --scalar-color-orange: #ff8d4d;
-  --scalar-color-purple: #b191f9;
-
-  --scalar-link-color: var(--scalar-color-1);
-  --scalar-link-color-hover: var(--scalar-link-color);
-
-  --scalar-button-1: rgba(255, 255, 255, 1);
-  --scalar-button-1-hover: rgba(255, 255, 255, 0.9);
-  --scalar-button-1-color: black;
-
-  --scalar-tooltip-background: color-mix(in srgb, var(--scalar-background-1), #fff 10%);
-  --scalar-tooltip-color: color-mix(in srgb, #fff, transparent 5%);
-
-  --scalar-color-danger: color-mix(in srgb, var(--scalar-color-red), var(--scalar-background-1) 20%);
-
-  --scalar-background-alert: color-mix(in srgb, var(--scalar-color-orange), var(--scalar-background-1) 95%);
-  --scalar-background-danger: color-mix(in srgb, var(--scalar-color-red), var(--scalar-background-1) 95%);
-}
-@supports (color: color(display-p3 1 1 1)) {
-  .light-mode {
-    --scalar-color-accent: color(display-p3 0 0.6 1 / 1);
-    --scalar-color-green: color(display-p3 0.023529 0.564706 0.380392 / 1);
-    --scalar-color-red: color(display-p3 0.937255 0 0.023529 / 1);
-    --scalar-color-yellow: color(display-p3 0.929412 0.745098 0.12549 / 1);
-    --scalar-color-blue: color(display-p3 0 0.509804 0.815686 / 1);
-    --scalar-color-orange: color(display-p3 1 0.4 0.02);
-    --scalar-color-purple: color(display-p3 0.321569 0.011765 0.819608 / 1);
-  }
-  .dark-mode {
-    --scalar-color-accent: color(display-p3 0.07 0.67 1);
-    --scalar-color-green: color(display-p3 0 0.713725 0.282353 / 1);
-    --scalar-color-red: color(display-p3 0.862745 0.105882 0.098039 / 1);
-    --scalar-color-yellow: color(display-p3 1 0.788235 0.05098 / 1);
-    --scalar-color-blue: color(display-p3 0.305882 0.701961 0.92549 / 1);
-    --scalar-color-orange: color(display-p3 1 0.552941 0.301961 / 1);
-    --scalar-color-purple: color(display-p3 0.694118 0.568627 0.976471 / 1);
-  }
-}
-`,Ynn=`.light-mode {
-  --scalar-color-1: #1b1b1b;
-  --scalar-color-2: #757575;
-  --scalar-color-3: #8e8e8e;
-  --scalar-color-accent: #f06292;
-
-  --scalar-background-1: #fff;
-  --scalar-background-2: #f6f6f6;
-  --scalar-background-3: #e7e7e7;
-
-  --scalar-border-color: rgba(0, 0, 0, 0.1);
-}
-.dark-mode {
-  --scalar-color-1: rgba(255, 255, 255, 0.9);
-  --scalar-color-2: rgba(156, 163, 175, 1);
-  --scalar-color-3: rgba(255, 255, 255, 0.44);
-  --scalar-color-accent: #f06292;
-
-  --scalar-background-1: #111728;
-  --scalar-background-2: #1e293b;
-  --scalar-background-3: #334155;
-  --scalar-background-accent: #f062921f;
-
-  --scalar-border-color: rgba(255, 255, 255, 0.1);
-}
-
-/* Document Sidebar */
-.light-mode .t-doc__sidebar,
-.dark-mode .t-doc__sidebar {
-  --scalar-sidebar-background-1: var(--scalar-background-1);
-  --scalar-sidebar-color-1: var(--scalar-color-1);
-  --scalar-sidebar-color-2: var(--scalar-color-2);
-  --scalar-sidebar-border-color: var(--scalar-border-color);
-
-  --scalar-sidebar-item-hover-background: var(--scalar-background-2);
-  --scalar-sidebar-item-hover-color: currentColor;
-
-  --scalar-sidebar-item-active-background: #f062921f;
-  --scalar-sidebar-color-active: var(--scalar-color-accent);
-
-  --scalar-sidebar-search-background: transparent;
-  --scalar-sidebar-search-color: var(--scalar-color-3);
-  --scalar-sidebar-search-border-color: var(--scalar-border-color);
-}
-
-/* advanced */
-.light-mode {
-  --scalar-button-1: rgb(49 53 56);
-  --scalar-button-1-color: #fff;
-  --scalar-button-1-hover: rgb(28 31 33);
-
-  --scalar-color-green: #069061;
-  --scalar-color-red: #ef0006;
-  --scalar-color-yellow: #edbe20;
-  --scalar-color-blue: #0082d0;
-  --scalar-color-orange: #fb892c;
-  --scalar-color-purple: #5203d1;
-
-  --scalar-scrollbar-color: rgba(0, 0, 0, 0.18);
-  --scalar-scrollbar-color-active: rgba(0, 0, 0, 0.36);
-}
-.dark-mode {
-  --scalar-button-1: #f6f6f6;
-  --scalar-button-1-color: #000;
-  --scalar-button-1-hover: #e7e7e7;
-
-  --scalar-color-green: #a3ffa9;
-  --scalar-color-red: #ffa3a3;
-  --scalar-color-yellow: #fffca3;
-  --scalar-color-blue: #a5d6ff;
-  --scalar-color-orange: #e2ae83;
-  --scalar-color-purple: #d2a8ff;
-
-  --scalar-scrollbar-color: rgba(255, 255, 255, 0.24);
-  --scalar-scrollbar-color-active: rgba(255, 255, 255, 0.48);
-}
-.section-flare {
-  width: 100%;
-  height: 400px;
-  position: absolute;
-}
-.section-flare-item:first-of-type:before {
-  content: "";
-  position: absolute;
-  top: 0;
-  right: 0;
-  bottom: 0;
-  left: 0;
-  --stripes: repeating-linear-gradient(100deg, #fff 0%, #fff 0%, transparent 2%, transparent 12%, #fff 17%);
-  --stripesDark: repeating-linear-gradient(100deg, #000 0%, #000 0%, transparent 10%, transparent 12%, #000 17%);
-  --rainbow: repeating-linear-gradient(100deg, #60a5fa 10%, #e879f9 16%, #5eead4 22%, #60a5fa 30%);
-  contain: strict;
-  contain-intrinsic-size: 100vw 40vh;
-  background-image: var(--stripesDark), var(--rainbow);
-  background-size: 300%, 200%;
-  background-position:
-    50% 50%,
-    50% 50%;
-  filter: opacity(20%) saturate(200%);
-  -webkit-mask-image: radial-gradient(ellipse at 100% 0%, black 40%, transparent 70%);
-  mask-image: radial-gradient(ellipse at 100% 0%, black 40%, transparent 70%);
-  pointer-events: none;
-}
-.section-flare-item:first-of-type:after {
-  content: "";
-  position: absolute;
-  top: 0;
-  right: 0;
-  bottom: 0;
-  left: 0;
-  background-image: var(--stripes), var(--rainbow);
-  background-size: 200%, 100%;
-  background-attachment: fixed;
-  mix-blend-mode: difference;
-  background-image: var(--stripesDark), var(--rainbow);
-  pointer-events: none;
-}
-.light-mode .section-flare-item:first-of-type:after,
-.light-mode .section-flare-item:first-of-type:before {
-  background-image: var(--stripes), var(--rainbow);
-  filter: opacity(4%) saturate(200%);
-}
-`,Xnn=`.light-mode {
-  color-scheme: light;
-  --scalar-color-1: #1c1e21;
-  --scalar-color-2: #757575;
-  --scalar-color-3: #8e8e8e;
-  --scalar-color-disabled: #b4b1b1;
-  --scalar-color-ghost: #a7a7a7;
-  --scalar-color-accent: #2f8555;
-  --scalar-background-1: #fff;
-  --scalar-background-2: #f5f5f5;
-  --scalar-background-3: #ededed;
-  --scalar-background-4: rgba(0, 0, 0, 0.06);
-  --scalar-background-accent: #2f85551f;
-
-  --scalar-border-color: rgba(0, 0, 0, 0.1);
-  --scalar-scrollbar-color: rgba(0, 0, 0, 0.18);
-  --scalar-scrollbar-color-active: rgba(0, 0, 0, 0.36);
-  --scalar-lifted-brightness: 1;
-  --scalar-backdrop-brightness: 1;
-
-  --scalar-shadow-1: 0 1px 3px 0 rgba(0, 0, 0, 0.11);
-  --scalar-shadow-2: rgba(0, 0, 0, 0.08) 0px 13px 20px 0px, rgba(0, 0, 0, 0.08) 0px 3px 8px 0px, #eeeeed 0px 0 0 1px;
-
-  --scalar-button-1: rgb(49 53 56);
-  --scalar-button-1-color: #fff;
-  --scalar-button-1-hover: rgb(28 31 33);
-
-  --scalar-color-green: #007300;
-  --scalar-color-red: #af272b;
-  --scalar-color-yellow: #b38200;
-  --scalar-color-blue: #3b8ba5;
-  --scalar-color-orange: #fb892c;
-  --scalar-color-purple: #5203d1;
-}
-
-.dark-mode {
-  color-scheme: dark;
-  --scalar-color-1: rgba(255, 255, 255, 0.9);
-  --scalar-color-2: rgba(255, 255, 255, 0.62);
-  --scalar-color-3: rgba(255, 255, 255, 0.44);
-  --scalar-color-disabled: rgba(255, 255, 255, 0.34);
-  --scalar-color-ghost: rgba(255, 255, 255, 0.26);
-  --scalar-color-accent: #27c2a0;
-  --scalar-background-1: #1b1b1d;
-  --scalar-background-2: #242526;
-  --scalar-background-3: #3b3b3b;
-  --scalar-background-4: rgba(255, 255, 255, 0.06);
-  --scalar-background-accent: #27c2a01f;
-
-  --scalar-border-color: rgba(255, 255, 255, 0.1);
-  --scalar-scrollbar-color: rgba(255, 255, 255, 0.24);
-  --scalar-scrollbar-color-active: rgba(255, 255, 255, 0.48);
-  --scalar-lifted-brightness: 1.45;
-  --scalar-backdrop-brightness: 0.5;
-
-  --scalar-shadow-1: 0 1px 3px 0 rgb(0, 0, 0, 0.1);
-  --scalar-shadow-2:
-    rgba(15, 15, 15, 0.2) 0px 3px 6px, rgba(15, 15, 15, 0.4) 0px 9px 24px, 0 0 0 1px rgba(255, 255, 255, 0.1);
-
-  --scalar-button-1: #f6f6f6;
-  --scalar-button-1-color: #000;
-  --scalar-button-1-hover: #e7e7e7;
-
-  --scalar-color-green: #26b226;
-  --scalar-color-red: #fb565b;
-  --scalar-color-yellow: #ffc426;
-  --scalar-color-blue: #6ecfef;
-  --scalar-color-orange: #ff8d4d;
-  --scalar-color-purple: #b191f9;
-}
-`,Znn=`/* basic theme */
-.light-mode {
-  --scalar-color-1: #1b1b1b;
-  --scalar-color-2: #757575;
-  --scalar-color-3: #8e8e8e;
-  --scalar-color-accent: #7070ff;
-
-  --scalar-background-1: #fff;
-  --scalar-background-2: #f6f6f6;
-  --scalar-background-3: #e7e7e7;
-  --scalar-background-accent: #7070ff1f;
-
-  --scalar-border-color: rgba(0, 0, 0, 0.1);
-
-  --scalar-code-language-color-supersede: var(--scalar-color-3);
-}
-.dark-mode {
-  --scalar-color-1: #f7f8f8;
-  --scalar-color-2: rgb(180, 188, 208);
-  --scalar-color-3: #b4bcd099;
-  --scalar-color-accent: #828fff;
-
-  --scalar-background-1: #000212;
-  --scalar-background-2: #0d0f1e;
-  --scalar-background-3: #232533;
-  --scalar-background-accent: #8ab4f81f;
-
-  --scalar-border-color: #313245;
-  --scalar-code-language-color-supersede: var(--scalar-color-3);
-}
-/* Document Sidebar */
-.light-mode .t-doc__sidebar {
-  --scalar-sidebar-background-1: var(--scalar-background-1);
-  --scalar-sidebar-item-hover-color: currentColor;
-  --scalar-sidebar-item-hover-background: var(--scalar-background-2);
-  --scalar-sidebar-item-active-background: var(--scalar-background-accent);
-  --scalar-sidebar-border-color: var(--scalar-border-color);
-  --scalar-sidebar-color-1: var(--scalar-color-1);
-  --scalar-sidebar-color-2: var(--scalar-color-2);
-  --scalar-sidebar-color-active: var(--scalar-color-accent);
-  --scalar-sidebar-search-background: rgba(0, 0, 0, 0.05);
-  --scalar-sidebar-search-border-color: 1px solid rgba(0, 0, 0, 0.05);
-  --scalar-sidebar-search-color: var(--scalar-color-3);
-  --scalar-background-2: rgba(0, 0, 0, 0.03);
-}
-.dark-mode .t-doc__sidebar {
-  --scalar-sidebar-background-1: var(--scalar-background-1);
-  --scalar-sidebar-item-hover-color: currentColor;
-  --scalar-sidebar-item-hover-background: var(--scalar-background-2);
-  --scalar-sidebar-item-active-background: rgba(255, 255, 255, 0.1);
-  --scalar-sidebar-border-color: var(--scalar-border-color);
-  --scalar-sidebar-color-1: var(--scalar-color-1);
-  --scalar-sidebar-color-2: var(--scalar-color-2);
-  --scalar-sidebar-color-active: var(--scalar-color-accent);
-  --scalar-sidebar-search-background: rgba(255, 255, 255, 0.1);
-  --scalar-sidebar-search-border-color: 1px solid rgba(255, 255, 255, 0.05);
-  --scalar-sidebar-search-color: var(--scalar-color-3);
-}
-/* advanced */
-.light-mode {
-  --scalar-color-green: #069061;
-  --scalar-color-red: #ef0006;
-  --scalar-color-yellow: #edbe20;
-  --scalar-color-blue: #0082d0;
-  --scalar-color-orange: #fb892c;
-  --scalar-color-purple: #5203d1;
-
-  --scalar-button-1: rgba(0, 0, 0, 1);
-  --scalar-button-1-hover: rgba(0, 0, 0, 0.8);
-  --scalar-button-1-color: rgba(255, 255, 255, 0.9);
-}
-.dark-mode {
-  --scalar-color-green: #00b648;
-  --scalar-color-red: #dc1b19;
-  --scalar-color-yellow: #ffc90d;
-  --scalar-color-blue: #4eb3ec;
-  --scalar-color-orange: #ff8d4d;
-  --scalar-color-purple: #b191f9;
-
-  --scalar-button-1: rgba(255, 255, 255, 1);
-  --scalar-button-1-hover: rgba(255, 255, 255, 0.9);
-  --scalar-button-1-color: black;
-}
-/* Custom Theme */
-.dark-mode h2.t-editor__heading,
-.dark-mode .t-editor__page-title h1,
-.dark-mode h1.section-header:not(::selection),
-.dark-mode .markdown h1,
-.dark-mode .markdown h2,
-.dark-mode .markdown h3,
-.dark-mode .markdown h4,
-.dark-mode .markdown h5,
-.dark-mode .markdown h6 {
-  -webkit-text-fill-color: transparent;
-  background-image: linear-gradient(to right bottom, rgb(255, 255, 255) 30%, rgba(255, 255, 255, 0.38));
-  -webkit-background-clip: text;
-  background-clip: text;
-}
-.sidebar-search {
-  backdrop-filter: blur(12px);
-}
-@keyframes headerbackground {
-  from {
-    background: transparent;
-    backdrop-filter: none;
-  }
-  to {
-    background: var(--scalar-header-background-1);
-    backdrop-filter: blur(12px);
-  }
-}
-.dark-mode .scalar-card {
-  background: rgba(255, 255, 255, 0.05) !important;
-}
-.dark-mode .scalar-card * {
-  --scalar-background-2: transparent !important;
-  --scalar-background-1: transparent !important;
-}
-.light-mode .dark-mode.scalar-card *,
-.light-mode .dark-mode.scalar-card {
-  --scalar-background-1: #0d0f1e !important;
-  --scalar-background-2: #0d0f1e !important;
-  --scalar-background-3: #191b29 !important;
-}
-.light-mode .dark-mode.scalar-card {
-  background: #191b29 !important;
-}
-.badge {
-  box-shadow: 0 0 0 1px var(--scalar-border-color);
-  margin-right: 6px;
-}
-
-.table-row.required-parameter .table-row-item:nth-of-type(2):after {
-  background: transparent;
-  box-shadow: none;
-}
-/* Hero Section Flare */
-.section-flare {
-  width: 100vw;
-  background: radial-gradient(ellipse 80% 50% at 50% -20%, rgba(120, 119, 198, 0.3), transparent);
-  height: 100vh;
-}
-.light-mode *::selection {
-  background-color: color-mix(in srgb, var(--scalar-color-accent), transparent 70%);
-}
-.dark-mode *::selection {
-  background-color: color-mix(in srgb, var(--scalar-color-accent), transparent 50%);
-}
-
-/* document layout */
-.light-mode .t-doc .layout-content,
-.dark-mode .t-doc .layout-content {
-  background: transparent;
-}
-`,Qnn=`/* basic theme */
-.light-mode {
-  color-scheme: light;
-  --scalar-color-1: #322b3b;
-  --scalar-color-2: #645676;
-  --scalar-color-3: #9789a9;
-  --scalar-color-accent: #40b4c4;
-
-  --scalar-background-1: #fff;
-  --scalar-background-2: #f4f2f7;
-  --scalar-background-3: #cfc7dc;
-  --scalar-background-accent: #f3fafb;
-
-  --scalar-border-color: #e4e0eb;
-}
-.dark-mode {
-  color-scheme: dark;
-  --scalar-color-1: #fff;
-  --scalar-color-2: #b8b6ba;
-  --scalar-color-3: #706c74;
-  --scalar-color-accent: #ed78c2;
-
-  --scalar-background-1: #27212e;
-  --scalar-background-2: #322c39;
-  --scalar-background-3: #4c4059;
-  --scalar-background-accent: #eb64b91f;
-
-  --scalar-border-color: rgba(255, 255, 255, 0.1);
-}
-
-/* Sidebar */
-.light-mode .t-doc__sidebar {
-  --scalar-sidebar-background-1: var(--scalar-background-1);
-  --scalar-sidebar-item-hover-color: currentColor;
-  --scalar-sidebar-item-hover-background: var(--scalar-background-2);
-  --scalar-sidebar-item-active-background: var(--scalar-background-accent);
-  --scalar-sidebar-border-color: var(--scalar-border-color);
-  --scalar-sidebar-color-1: var(--scalar-color-1);
-  --scalar-sidebar-color-2: var(--scalar-color-2);
-  --scalar-sidebar-color-active: var(--scalar-color-accent);
-  --scalar-sidebar-search-background: var(--scalar-background-2);
-  --scalar-sidebar-search-border-color: var(--scalar-sidebar-border-color);
-  --scalar-sidebar-search--color: var(--scalar-color-3);
-}
-.dark-mode .t-doc__sidebar {
-  --scalar-sidebar-background-1: var(--scalar-background-1);
-  --scalar-sidebar-item-hover-color: currentColor;
-  --scalar-sidebar-item-hover-background: var(--scalar-background-2);
-  --scalar-sidebar-item-active-background: var(--scalar-background-accent);
-  --scalar-sidebar-border-color: var(--scalar-border-color);
-  --scalar-sidebar-color-1: var(--scalar-color-1);
-  --scalar-sidebar-color-2: var(--scalar-color-2);
-  --scalar-sidebar-color-active: var(--scalar-color-accent);
-  --scalar-sidebar-search-background: var(--scalar-background-2);
-  --scalar-sidebar-search-border-color: #514c56;
-  --scalar-sidebar-search--color: var(--scalar-color-3);
-}
-/* advanced */
-.light-mode {
-  --scalar-button-1: rgb(49 53 56);
-  --scalar-button-1-color: #fff;
-  --scalar-button-1-hover: rgb(28 31 33);
-
-  --scalar-color-green: #74dfc4;
-  --scalar-color-red: #d887f5;
-  --scalar-color-yellow: #ffe261;
-  --scalar-color-blue: #40b4c4;
-  --scalar-color-orange: #ff52bf;
-  --scalar-color-purple: #91889b;
-
-  --scalar-scrollbar-color: rgba(0, 0, 0, 0.18);
-  --scalar-scrollbar-color-active: rgba(0, 0, 0, 0.36);
-}
-.dark-mode {
-  --scalar-button-1: #f6f6f6;
-  --scalar-button-1-color: #27212e;
-  --scalar-button-1-hover: #e7e7e7;
-
-  --scalar-color-green: #74dfc4;
-  --scalar-color-red: #d887f5;
-  --scalar-color-yellow: #ffe261;
-  --scalar-color-blue: #40b4c4;
-  --scalar-color-orange: #ff52bf;
-  --scalar-color-purple: #91889b;
-
-  --scalar-scrollbar-color: rgba(255, 255, 255, 0.24);
-  --scalar-scrollbar-color-active: rgba(255, 255, 255, 0.48);
-}
-/* Radius */
-:root {
-  --scalar-radius: 2px;
-  --scalar-radius-lg: 3px;
-  --scalar-radius-xl: 4px;
-}
-/* P3 color support */
-@supports (color: color(display-p3 1 1 1)) {
-  .light-mode {
-    --scalar-color-accent: color(display-p3 0.25098 0.705882 0.768627 / 1);
-    --scalar-color-green: color(display-p3 0.454902 0.87451 0.768627 / 1);
-    --scalar-color-red: color(display-p3 0.847059 0.529412 0.960784 / 1);
-    --scalar-color-yellow: color(display-p3 1 0.886275 0.380392 / 1);
-    --scalar-color-blue: color(display-p3 0.25098 0.705882 0.768627 / 1);
-    --scalar-color-orange: color(display-p3 1 0.321569 0.74902 / 1);
-    --scalar-color-purple: color(display-p3 0.568627 0.533333 0.607843 / 1);
-  }
-  .dark-mode {
-    --scalar-color-accent: color(display-p3 0.929412 0.470588 0.760784 / 1);
-    --scalar-color-green: color(display-p3 0.454902 0.87451 0.768627 / 1);
-    --scalar-color-red: color(display-p3 0.847059 0.529412 0.960784 / 1);
-    --scalar-color-yellow: color(display-p3 1 0.886275 0.380392 / 1);
-    --scalar-color-blue: color(display-p3 0.25098 0.705882 0.768627 / 1);
-    --scalar-color-orange: color(display-p3 1 0.321569 0.74902 / 1);
-    --scalar-color-purple: color(display-p3 0.568627 0.533333 0.607843 / 1);
-  }
-}
-`,$nn=`/* basic theme */
-:root {
-  --scalar-text-decoration: underline;
-  --scalar-text-decoration-hover: underline;
-}
-.light-mode {
-  --scalar-background-1: #f9f6f0;
-  --scalar-background-2: #f2efe8;
-  --scalar-background-3: #e9e7e2;
-  --scalar-border-color: rgba(203, 165, 156, 0.6);
-
-  --scalar-color-1: #c75549;
-  --scalar-color-2: #c75549;
-  --scalar-color-3: #c75549;
-
-  --scalar-color-accent: #c75549;
-  --scalar-background-accent: #dcbfa81f;
-
-  --scalar-code-language-color-supersede: var(--scalar-color-1);
-}
-.dark-mode {
-  --scalar-background-1: #140507;
-  --scalar-background-2: #20090c;
-  --scalar-background-3: #321116;
-  --scalar-border-color: #3c3031;
-
-  --scalar-color-1: rgba(255, 255, 255, 0.9);
-  --scalar-color-2: rgba(255, 255, 255, 0.62);
-  --scalar-color-3: rgba(255, 255, 255, 0.44);
-
-  --scalar-color-accent: rgba(255, 255, 255, 0.9);
-  --scalar-background-accent: #441313;
-
-  --scalar-code-language-color-supersede: var(--scalar-color-1);
-}
-
-/* Document Sidebar */
-.light-mode .t-doc__sidebar,
-.dark-mode .t-doc__sidebar {
-  --scalar-sidebar-background-1: var(--scalar-background-1);
-  --scalar-sidebar-color-1: var(--scalar-color-1);
-  --scalar-sidebar-color-2: var(--scalar-color-2);
-  --scalar-sidebar-border-color: var(--scalar-border-color);
-
-  --scalar-sidebar-item-hover-color: currentColor;
-  --scalar-sidebar-item-hover-background: var(--scalar-background-2);
-
-  --scalar-sidebar-item-active-background: var(--scalar-background-3);
-  --scalar-sidebar-color-active: var(--scalar-color-accent);
-
-  --scalar-sidebar-search-background: rgba(255, 255, 255, 0.1);
-  --scalar-sidebar-search-color: var(--scalar-color-3);
-  --scalar-sidebar-search-border-color: var(--scalar-border-color);
-  z-index: 1;
-}
-/* advanced */
-.light-mode {
-  --scalar-color-green: #09533a;
-  --scalar-color-red: #aa181d;
-  --scalar-color-yellow: #ab8d2b;
-  --scalar-color-blue: #19689a;
-  --scalar-color-orange: #b26c34;
-  --scalar-color-purple: #4c2191;
-
-  --scalar-button-1: rgba(0, 0, 0, 1);
-  --scalar-button-1-hover: rgba(0, 0, 0, 0.8);
-  --scalar-button-1-color: rgba(255, 255, 255, 0.9);
-}
-.dark-mode {
-  --scalar-color-green: rgba(69, 255, 165, 0.823);
-  --scalar-color-red: #ff8589;
-  --scalar-color-yellow: #ffcc4d;
-  --scalar-color-blue: #6bc1fe;
-  --scalar-color-orange: #f98943;
-  --scalar-color-purple: #b191f9;
-
-  --scalar-button-1: rgba(255, 255, 255, 1);
-  --scalar-button-1-hover: rgba(255, 255, 255, 0.9);
-  --scalar-button-1-color: black;
-}
-/* Custom Theme */
-.dark-mode h2.t-editor__heading,
-.dark-mode .t-editor__page-title h1,
-.dark-mode h1.section-header:not(::selection),
-.dark-mode .markdown h1,
-.dark-mode .markdown h2,
-.dark-mode .markdown h3,
-.dark-mode .markdown h4,
-.dark-mode .markdown h5,
-.dark-mode .markdown h6 {
-  -webkit-text-fill-color: transparent;
-  background-image: linear-gradient(to right bottom, rgb(255, 255, 255) 30%, rgba(255, 255, 255, 0.38));
-  -webkit-background-clip: text;
-  background-clip: text;
-}
-.light-mode .t-doc__sidebar {
-  --scalar-sidebar-search-background: white;
-}
-.examples .scalar-card-footer {
-  --scalar-background-3: transparent;
-  padding-top: 0;
-}
-/* Hero section flare */
-.section-flare {
-  overflow-x: hidden;
-  height: 100vh;
-  left: initial;
-}
-.section-flare-item:nth-of-type(1) {
-  background: #d25019;
-  position: relative;
-  top: -150px;
-  right: -400px;
-  width: 80vw;
-  height: 500px;
-  margin-top: -150px;
-  border-radius: 50%;
-  filter: blur(100px);
-  z-index: 0;
-}
-.light-mode .section-flare {
-  display: none;
-}
-*::selection {
-  background-color: color-mix(in srgb, var(--scalar-color-red), transparent 75%);
-}
-
-/* document layout */
-.dark-mode .t-doc .layout-content {
-  background: transparent;
-}
-`,ern=`.light-mode {
-  color-scheme: light;
-  --scalar-color-1: #000000;
-  --scalar-color-2: #000000;
-  --scalar-color-3: #000000;
-  --scalar-color-accent: #645b0f;
-  --scalar-background-1: #ccc9b3;
-  --scalar-background-2: #c2bfaa;
-  --scalar-background-3: #b8b5a1;
-  --scalar-background-accent: #000000;
-
-  --scalar-border-color: rgba(0, 0, 0, 0.2);
-  --scalar-scrollbar-color: rgba(0, 0, 0, 0.18);
-  --scalar-scrollbar-color-active: rgba(0, 0, 0, 0.36);
-  --scalar-lifted-brightness: 1;
-  --scalar-backdrop-brightness: 1;
-
-  --scalar-shadow-1: 0 1px 3px 0 rgba(0, 0, 0, 0.11);
-  --scalar-shadow-2:
-    rgba(0, 0, 0, 0.08) 0px 13px 20px 0px, rgba(0, 0, 0, 0.08) 0px 3px 8px 0px, var(--scalar-border-color) 0px 0 0 1px;
-
-  --scalar-button-1: rgb(49 53 56);
-  --scalar-button-1-color: #fff;
-  --scalar-button-1-hover: rgb(28 31 33);
-
-  --scalar-color-red: #b91c1c;
-  --scalar-color-orange: #a16207;
-  --scalar-color-green: #047857;
-  --scalar-color-blue: #1d4ed8;
-  --scalar-color-orange: #c2410c;
-  --scalar-color-purple: #6d28d9;
-}
-
-.dark-mode {
-  color-scheme: dark;
-  --scalar-color-1: #fffef3;
-  --scalar-color-2: #fffef3;
-  --scalar-color-3: #fffef3;
-  --scalar-color-accent: #c3b531;
-  --scalar-background-1: #313332;
-  --scalar-background-2: #393b3a;
-  --scalar-background-3: #414342;
-  --scalar-background-accent: #fffef3;
-
-  --scalar-border-color: #505452;
-  --scalar-scrollbar-color: rgba(255, 255, 255, 0.24);
-  --scalar-scrollbar-color-active: rgba(255, 255, 255, 0.48);
-  --scalar-lifted-brightness: 1.45;
-  --scalar-backdrop-brightness: 0.5;
-
-  --scalar-shadow-1: 0 1px 3px 0 rgba(0, 0, 0, 0.11);
-  --scalar-shadow-2:
-    rgba(15, 15, 15, 0.2) 0px 3px 6px, rgba(15, 15, 15, 0.4) 0px 9px 24px, 0 0 0 1px rgba(255, 255, 255, 0.1);
-
-  --scalar-button-1: #f6f6f6;
-  --scalar-button-1-color: #000;
-  --scalar-button-1-hover: #e7e7e7;
-
-  --scalar-color-green: #00b648;
-  --scalar-color-red: #dc1b19;
-  --scalar-color-yellow: #ffc90d;
-  --scalar-color-blue: #4eb3ec;
-  --scalar-color-orange: #ff8d4d;
-  --scalar-color-purple: #b191f9;
-}
-
-/* Sidebar */
-.light-mode .t-doc__sidebar,
-.dark-mode .t-doc__sidebar {
-  --scalar-sidebar-background-1: var(--scalar-background-1);
-  --scalar-sidebar-color-1: var(--scalar-color-1);
-  --scalar-sidebar-color-2: var(--scalar-color-2);
-  --scalar-sidebar-border-color: var(--scalar-border-color);
-
-  --scalar-sidebar-item-hover-background: var(--scalar-background-2);
-  --scalar-sidebar-item-hover-color: currentColor;
-
-  --scalar-sidebar-item-active-background: var(--scalar-background-3);
-  --scalar-sidebar-color-active: var(--scalar-color-1);
-
-  --scalar-sidebar-search-background: transparent;
-  --scalar-sidebar-search-color: var(--scalar-color-3);
-  --scalar-sidebar-search-border-color: var(--scalar-border-color);
-}
-*::selection {
-  background-color: color-mix(in srgb, var(--scalar-color-accent), transparent 80%);
-}
-`,trn=`/* basic theme */
-.light-mode {
-  --scalar-background-1: #fff;
-  --scalar-background-2: #f5f6f8;
-  --scalar-background-3: #eceef1;
-
-  --scalar-color-1: #1b1b1b;
-  --scalar-color-2: #757575;
-  --scalar-color-3: #8e8e8e;
-
-  --scalar-color-accent: #5469d4;
-  --scalar-background-accent: #5469d41f;
-
-  --scalar-border-color: rgba(215, 215, 206, 0.68);
-}
-.dark-mode {
-  --scalar-background-1: #15171c;
-  --scalar-background-2: #1c1e24;
-  --scalar-background-3: #22252b;
-
-  --scalar-color-1: #fafafa;
-  --scalar-color-2: #c9ced8;
-  --scalar-color-3: #8c99ad;
-
-  --scalar-color-accent: #5469d4;
-  --scalar-background-accent: #5469d41f;
-
-  --scalar-border-color: #3f4145;
-}
-/* Document Sidebar */
-.light-mode .t-doc__sidebar,
-.dark-mode .t-doc__sidebar {
-  --scalar-sidebar-background-1: var(--scalar-background-1);
-  --scalar-sidebar-color-1: var(--scalar-color-1);
-  --scalar-sidebar-color-2: var(--scalar-color-2);
-  --scalar-sidebar-border-color: var(--scalar-border-color);
-
-  --scalar-sidebar-item-hover-color: currentColor;
-  --scalar-sidebar-item-hover-background: var(--scalar-background-3);
-
-  --scalar-sidebar-item-active-background: var(--scalar-background-accent);
-  --scalar-sidebar-color-active: var(--scalar-color-accent);
-
-  --scalar-sidebar-search-background: var(--scalar-background-1);
-  --scalar-sidebar-search-color: var(--scalar-color-3);
-  --scalar-sidebar-search-border-color: var(--scalar-border-color);
-}
-
-/* advanced */
-.light-mode {
-  --scalar-color-green: #17803d;
-  --scalar-color-red: #e10909;
-  --scalar-color-yellow: #edbe20;
-  --scalar-color-blue: #1763a6;
-  --scalar-color-orange: #e25b09;
-  --scalar-color-purple: #5c3993;
-
-  --scalar-button-1: rgba(0, 0, 0, 1);
-  --scalar-button-1-hover: rgba(0, 0, 0, 0.8);
-  --scalar-button-1-color: rgba(255, 255, 255, 0.9);
-}
-.dark-mode {
-  --scalar-color-green: #30a159;
-  --scalar-color-red: #dc1b19;
-  --scalar-color-yellow: #eec644;
-  --scalar-color-blue: #2b7abf;
-  --scalar-color-orange: #f07528;
-  --scalar-color-purple: #7a59b1;
-
-  --scalar-button-1: rgba(255, 255, 255, 1);
-  --scalar-button-1-hover: rgba(255, 255, 255, 0.9);
-  --scalar-button-1-color: black;
-}
-.light-mode *::selection {
-  background-color: color-mix(in srgb, var(--scalar-color-accent), transparent 70%);
-}
-.dark-mode *::selection {
-  background-color: color-mix(in srgb, var(--scalar-color-accent), transparent 50%);
-}
-`,nrn=`/* basic theme */
-.light-mode {
-  --scalar-background-1: #f3f3ee;
-  --scalar-background-2: #e8e8e3;
-  --scalar-background-3: #e4e4df;
-  --scalar-border-color: rgba(215, 215, 206, 0.85);
-
-  --scalar-color-1: #1b1b1b;
-  --scalar-color-2: #757575;
-  --scalar-color-3: #8e8e8e;
-
-  --scalar-color-accent: #1763a6;
-  --scalar-background-accent: #1f648e1f;
-}
-.dark-mode {
-  --scalar-background-1: #09090b;
-  --scalar-background-2: #18181b;
-  --scalar-background-3: #2c2c30;
-  --scalar-border-color: rgba(255, 255, 255, 0.17);
-
-  --scalar-color-1: #fafafa;
-  --scalar-color-2: rgb(161, 161, 170);
-  --scalar-color-3: rgba(255, 255, 255, 0.533);
-
-  --scalar-color-accent: #4eb3ec;
-  --scalar-background-accent: #8ab4f81f;
-}
-/* Document Sidebar */
-.light-mode .t-doc__sidebar,
-.dark-mode .t-doc__sidebar {
-  --scalar-sidebar-background-1: var(--scalar-background-1);
-  --scalar-sidebar-color-1: var(--scalar-color-1);
-  --scalar-sidebar-color-2: var(--scalar-color-2);
-  --scalar-sidebar-border-color: var(--scalar-border-color);
-
-  --scalar-sidebar-item-hover-background: var(--scalar-background-2);
-  --scalar-sidebar-item-hover-color: currentColor;
-
-  --scalar-sidebar-item-active-background: var(--scalar-background-3);
-  --scalar-sidebar-color-active: var(--scalar-color-1);
-
-  --scalar-sidebar-search-background: var(--scalar-background-1);
-  --scalar-sidebar-search-border-color: var(--scalar-border-color);
-  --scalar-sidebar-search-color: var(--scalar-color-3);
-}
-
-/* advanced */
-.light-mode {
-  --scalar-color-green: #17803d;
-  --scalar-color-red: #e10909;
-  --scalar-color-yellow: #edbe20;
-  --scalar-color-blue: #1763a6;
-  --scalar-color-orange: #e25b09;
-  --scalar-color-purple: #5c3993;
-
-  --scalar-button-1: rgba(0, 0, 0, 1);
-  --scalar-button-1-hover: rgba(0, 0, 0, 0.8);
-  --scalar-button-1-color: rgba(255, 255, 255, 0.9);
-}
-.dark-mode {
-  --scalar-color-green: #30a159;
-  --scalar-color-red: #dc1b19;
-  --scalar-color-yellow: #eec644;
-  --scalar-color-blue: #2b7abf;
-  --scalar-color-orange: #f07528;
-  --scalar-color-purple: #7a59b1;
-
-  --scalar-button-1: rgba(255, 255, 255, 1);
-  --scalar-button-1-hover: rgba(255, 255, 255, 0.9);
-  --scalar-button-1-color: black;
-}
-.dark-mode h2.t-editor__heading,
-.dark-mode .t-editor__page-title h1,
-.dark-mode h1.section-header:not(::selection),
-.dark-mode .markdown h1,
-.dark-mode .markdown h2,
-.dark-mode .markdown h3,
-.dark-mode .markdown h4,
-.dark-mode .markdown h5,
-.dark-mode .markdown h6 {
-  -webkit-text-fill-color: transparent;
-  background-image: linear-gradient(to right bottom, rgb(255, 255, 255) 30%, rgba(255, 255, 255, 0.38));
-  -webkit-background-clip: text;
-  background-clip: text;
-}
-.light-mode *::selection {
-  background-color: color-mix(in srgb, var(--scalar-color-accent), transparent 70%);
-}
-.dark-mode *::selection {
-  background-color: color-mix(in srgb, var(--scalar-color-accent), transparent 50%);
-}
-`,rrn=`.light-mode {
-  color-scheme: light;
-  --scalar-color-1: #584c27;
-  --scalar-color-2: #616161;
-  --scalar-color-3: #a89f84;
-  --scalar-color-accent: #b58900;
-  --scalar-background-1: #fdf6e3;
-  --scalar-background-2: #eee8d5;
-  --scalar-background-3: #ddd6c1;
-  --scalar-background-accent: #b589001f;
-
-  --scalar-border-color: #ded8c8;
-  --scalar-scrollbar-color: rgba(0, 0, 0, 0.18);
-  --scalar-scrollbar-color-active: rgba(0, 0, 0, 0.36);
-  --scalar-lifted-brightness: 1;
-  --scalar-backdrop-brightness: 1;
-
-  --scalar-shadow-1: 0 1px 3px 0 rgba(0, 0, 0, 0.11);
-  --scalar-shadow-2: rgba(0, 0, 0, 0.08) 0px 13px 20px 0px, rgba(0, 0, 0, 0.08) 0px 3px 8px 0px, #eeeeed 0px 0 0 1px;
-
-  --scalar-button-1: rgb(49 53 56);
-  --scalar-button-1-color: #fff;
-  --scalar-button-1-hover: rgb(28 31 33);
-
-  --scalar-color-red: #b91c1c;
-  --scalar-color-orange: #a16207;
-  --scalar-color-green: #047857;
-  --scalar-color-blue: #1d4ed8;
-  --scalar-color-orange: #c2410c;
-  --scalar-color-purple: #6d28d9;
-}
-
-.dark-mode {
-  color-scheme: dark;
-  --scalar-color-1: #fff;
-  --scalar-color-2: #cccccc;
-  --scalar-color-3: #6d8890;
-  --scalar-color-accent: #007acc;
-  --scalar-background-1: #00212b;
-  --scalar-background-2: #012b36;
-  --scalar-background-3: #004052;
-  --scalar-background-accent: #015a6f;
-
-  --scalar-border-color: #2f4851;
-  --scalar-scrollbar-color: rgba(255, 255, 255, 0.24);
-  --scalar-scrollbar-color-active: rgba(255, 255, 255, 0.48);
-  --scalar-lifted-brightness: 1.45;
-  --scalar-backdrop-brightness: 0.5;
-
-  --scalar-shadow-1: 0 1px 3px 0 rgb(0, 0, 0, 0.1);
-  --scalar-shadow-2:
-    rgba(15, 15, 15, 0.2) 0px 3px 6px, rgba(15, 15, 15, 0.4) 0px 9px 24px, 0 0 0 1px rgba(255, 255, 255, 0.1);
-
-  --scalar-button-1: #f6f6f6;
-  --scalar-button-1-color: #000;
-  --scalar-button-1-hover: #e7e7e7;
-
-  --scalar-color-green: #00b648;
-  --scalar-color-red: #dc1b19;
-  --scalar-color-yellow: #ffc90d;
-  --scalar-color-blue: #4eb3ec;
-  --scalar-color-orange: #ff8d4d;
-  --scalar-color-purple: #b191f9;
-}
-
-/* Sidebar */
-.light-mode .t-doc__sidebar {
-  --scalar-sidebar-background-1: var(--scalar-background-1);
-  --scalar-sidebar-item-hover-color: currentColor;
-  --scalar-sidebar-item-hover-background: var(--scalar-background-2);
-  --scalar-sidebar-item-active-background: var(--scalar-background-accent);
-  --scalar-sidebar-border-color: var(--scalar-border-color);
-  --scalar-sidebar-color-1: var(--scalar-color-1);
-  --scalar-sidebar-color-2: var(--scalar-color-2);
-  --scalar-sidebar-color-active: var(--scalar-color-accent);
-  --scalar-sidebar-search-background: var(--scalar-background-2);
-  --scalar-sidebar-search-border-color: var(--scalar-sidebar-search-background);
-  --scalar-sidebar-search--color: var(--scalar-color-3);
-}
-
-.dark-mode .t-doc__sidebar {
-  --scalar-sidebar-background-1: var(--scalar-background-1);
-  --scalar-sidebar-item-hover-color: currentColor;
-  --scalar-sidebar-item-hover-background: var(--scalar-background-2);
-  --scalar-sidebar-item-active-background: var(--scalar-background-accent);
-  --scalar-sidebar-border-color: var(--scalar-border-color);
-  --scalar-sidebar-color-1: var(--scalar-color-1);
-  --scalar-sidebar-color-2: var(--scalar-color-2);
-  --scalar-sidebar-color-active: var(--scalar-sidebar-color-1);
-  --scalar-sidebar-search-background: var(--scalar-background-2);
-  --scalar-sidebar-search-border-color: var(--scalar-sidebar-search-background);
-  --scalar-sidebar-search--color: var(--scalar-color-3);
-}
-*::selection {
-  background-color: color-mix(in srgb, var(--scalar-color-accent), transparent 70%);
-}
-`;function irn(){if(typeof window>`u`)return!1;let e=document.createElement(`div`);e.setAttribute(`style`,`width:30px;height:30px;overflow-y:scroll;`),e.classList.add(`scrollbar-test`);let t=document.createElement(`div`);t.setAttribute(`style`,`width:100%;height:40px`),e.appendChild(t),document.body.appendChild(e);let n=30-e.firstChild.clientWidth;return document.body.removeChild(e),!!n}var arn=[`alternate`,`default`,`moon`,`purple`,`solarized`,`bluePlanet`,`deepSpace`,`saturn`,`kepler`,`elysiajs`,`fastify`,`mars`,`laserwave`,`none`],orn={default:`Default`,alternate:`Alternate`,moon:`Moon`,purple:`Purple`,solarized:`Solarized`,elysiajs:`Elysia.js`,fastify:`Fastify`,bluePlanet:`Blue Planet`,saturn:`Saturn`,kepler:`Kepler-11e`,mars:`Mars`,deepSpace:`Deep Space`,laserwave:`Laserwave`,none:`None`},x3={default:{uid:`qTQR9jSM8E-LihpyZzPOi`,name:`Default`,description:`Default Scalar theme`,theme:Jnn,slug:`default`},alternate:{uid:`2skUDSH4S8HYFF9yXysr-`,name:`Alternate`,description:`Alternate Scalar theme`,theme:Gnn,slug:`alternate`},moon:{uid:`DG9ZUNp5lJhDeX_kPX4Bl`,name:`Moon`,description:`Lunar styles`,theme:ern,slug:`moon`},purple:{uid:`pE_1ysxcZ-y2LM1GGNBUv`,name:`Purple`,description:`Purple Scalar theme`,theme:trn,slug:`purple`},solarized:{uid:`BdGVG1vf-4nYl3wJKyj8l`,name:`Solarized`,description:`Solarized Scalar theme`,theme:rrn,slug:`solarized`},bluePlanet:{uid:`X12IfAvl7ue-42V2lW40S`,name:`Blue Planet`,description:`Blue Planet Scalar theme`,theme:Knn,slug:`blue-planet`},deepSpace:{uid:`K8b38NWQiicq4-zXGXKdI`,name:`Deep Space`,description:`Deep Space Scalar theme`,theme:qnn,slug:`deep-space`},saturn:{uid:`1jyAjmbIZQG-RUU4Ugk9o`,name:`Saturn`,description:`Saturn Scalar theme`,theme:nrn,slug:`saturn`},kepler:{uid:`jZ6dnWbtqQ0Hz3s9jLPH0`,name:`Kepler-11e`,description:`Kepler-11e Scalar theme`,theme:Znn,slug:`kepler-11e`},mars:{uid:`YY4LQgwiXix55-TmMz9qd`,name:`Mars`,description:`Mars Scalar theme`,theme:$nn,slug:`mars`},laserwave:{uid:`c5fZEi-K-hP-xXf885dkf`,name:`Laserwave`,description:`Laserwave Scalar theme`,theme:Qnn,slug:`laserwave`},elysiajs:{uid:`nEVZkRmCylPkT0o9YJa7y`,name:`Elysia.js`,description:`Elysia.js theme`,theme:Ynn,slug:`elysiajs`},fastify:{uid:`nTZcdcM2_yHFZFxTQe9Kk`,name:`Fastify`,description:`Fastify theme`,theme:Xnn,slug:`fastify`}};Object.values(x3);var srn=(e,t)=>{let{fonts:n=!0,layer:r=`scalar-theme`}=t??{},i=[x3[e||`default`]?.theme??`/* basic theme */
-:root {
-  --scalar-text-decoration: underline;
-  --scalar-text-decoration-hover: underline;
-}
-.light-mode {
-  --scalar-background-1: #fff;
-  --scalar-background-2: #f6f6f6;
-  --scalar-background-3: #e7e7e7;
-  --scalar-background-accent: #8ab4f81f;
-
-  --scalar-color-1: #1b1b1b;
-  --scalar-color-2: #757575;
-  --scalar-color-3: #8e8e8e;
-
-  --scalar-color-accent: #0099ff;
-  --scalar-border-color: #dfdfdf;
-}
-.dark-mode {
-  --scalar-background-1: #0f0f0f;
-  --scalar-background-2: #1a1a1a;
-  --scalar-background-3: #272727;
-
-  --scalar-color-1: #e7e7e7;
-  --scalar-color-2: #a4a4a4;
-  --scalar-color-3: #797979;
-
-  --scalar-color-accent: #00aeff;
-  --scalar-background-accent: #3ea6ff1f;
-
-  --scalar-border-color: #2d2d2d;
-}
-/* Document Sidebar */
-.light-mode,
-.dark-mode {
-  --scalar-sidebar-background-1: var(--scalar-background-1);
-  --scalar-sidebar-color-1: var(--scalar-color-1);
-  --scalar-sidebar-color-2: var(--scalar-color-2);
-  --scalar-sidebar-border-color: var(--scalar-border-color);
-
-  --scalar-sidebar-item-hover-background: var(--scalar-background-2);
-  --scalar-sidebar-item-hover-color: var(--scalar-sidebar-color-2);
-
-  --scalar-sidebar-item-active-background: var(--scalar-background-2);
-  --scalar-sidebar-color-active: var(--scalar-sidebar-color-1);
-
-  --scalar-sidebar-indent-border: var(--scalar-sidebar-border-color);
-  --scalar-sidebar-indent-border-hover: var(--scalar-sidebar-border-color);
-  --scalar-sidebar-indent-border-active: var(--scalar-sidebar-border-color);
-
-  --scalar-sidebar-search-background: color-mix(in srgb, var(--scalar-background-2), var(--scalar-background-1));
-  --scalar-sidebar-search-color: var(--scalar-color-3);
-  --scalar-sidebar-search-border-color: var(--scalar-border-color);
-}
-/* advanced */
-.light-mode {
-  --scalar-color-green: #069061;
-  --scalar-color-red: #ef0006;
-  --scalar-color-yellow: #edbe20;
-  --scalar-color-blue: #0082d0;
-  --scalar-color-orange: #ff5800;
-  --scalar-color-purple: #5203d1;
-
-  --scalar-link-color: var(--scalar-color-1);
-  --scalar-link-color-hover: var(--scalar-link-color);
-
-  --scalar-button-1: rgba(0, 0, 0, 1);
-  --scalar-button-1-hover: rgba(0, 0, 0, 0.8);
-  --scalar-button-1-color: rgba(255, 255, 255, 0.9);
-
-  --scalar-tooltip-background: color-mix(in srgb, #1a1a1a, transparent 10%);
-  --scalar-tooltip-color: color-mix(in srgb, #fff, transparent 15%);
-
-  --scalar-color-alert: color-mix(in srgb, var(--scalar-color-orange), var(--scalar-color-1) 20%);
-  --scalar-color-danger: color-mix(in srgb, var(--scalar-color-red), var(--scalar-color-1) 20%);
-
-  --scalar-background-alert: color-mix(in srgb, var(--scalar-color-orange), var(--scalar-background-1) 95%);
-  --scalar-background-danger: color-mix(in srgb, var(--scalar-color-red), var(--scalar-background-1) 95%);
-}
-.dark-mode {
-  --scalar-color-green: #00b648;
-  --scalar-color-red: #dc1b19;
-  --scalar-color-yellow: #ffc90d;
-  --scalar-color-blue: #4eb3ec;
-  --scalar-color-orange: #ff8d4d;
-  --scalar-color-purple: #b191f9;
-
-  --scalar-link-color: var(--scalar-color-1);
-  --scalar-link-color-hover: var(--scalar-link-color);
-
-  --scalar-button-1: rgba(255, 255, 255, 1);
-  --scalar-button-1-hover: rgba(255, 255, 255, 0.9);
-  --scalar-button-1-color: black;
-
-  --scalar-tooltip-background: color-mix(in srgb, var(--scalar-background-1), #fff 10%);
-  --scalar-tooltip-color: color-mix(in srgb, #fff, transparent 5%);
-
-  --scalar-color-danger: color-mix(in srgb, var(--scalar-color-red), var(--scalar-background-1) 20%);
-
-  --scalar-background-alert: color-mix(in srgb, var(--scalar-color-orange), var(--scalar-background-1) 95%);
-  --scalar-background-danger: color-mix(in srgb, var(--scalar-color-red), var(--scalar-background-1) 95%);
-}
-@supports (color: color(display-p3 1 1 1)) {
-  .light-mode {
-    --scalar-color-accent: color(display-p3 0 0.6 1 / 1);
-    --scalar-color-green: color(display-p3 0.023529 0.564706 0.380392 / 1);
-    --scalar-color-red: color(display-p3 0.937255 0 0.023529 / 1);
-    --scalar-color-yellow: color(display-p3 0.929412 0.745098 0.12549 / 1);
-    --scalar-color-blue: color(display-p3 0 0.509804 0.815686 / 1);
-    --scalar-color-orange: color(display-p3 1 0.4 0.02);
-    --scalar-color-purple: color(display-p3 0.321569 0.011765 0.819608 / 1);
-  }
-  .dark-mode {
-    --scalar-color-accent: color(display-p3 0.07 0.67 1);
-    --scalar-color-green: color(display-p3 0 0.713725 0.282353 / 1);
-    --scalar-color-red: color(display-p3 0.862745 0.105882 0.098039 / 1);
-    --scalar-color-yellow: color(display-p3 1 0.788235 0.05098 / 1);
-    --scalar-color-blue: color(display-p3 0.305882 0.701961 0.92549 / 1);
-    --scalar-color-orange: color(display-p3 1 0.552941 0.301961 / 1);
-    --scalar-color-purple: color(display-p3 0.694118 0.568627 0.976471 / 1);
-  }
-}
-`,n?Wnn:``].join(``);return r?`@layer ${r} {\n${i}}`:i},crn=e=>!!(!Array.isArray(e)&&e&&`sources`in e&&Array.isArray(e.sources)),lrn,urn,drn=s((()=>{lrn=(e,t)=>{let n=performance.now(),r=t(),i=performance.now(),a=Math.round(i-n);return console.info(`${e}: ${a} ms`),r},urn=async(e,t)=>{let n=performance.now(),r=await t(),i=performance.now(),a=Math.round(i-n);return console.info(`${e}: ${a} ms`),r}}));function S3(e){try{let t=new URL(e);return t.protocol===`http:`||t.protocol===`https:`}catch{return!1}}var C3=s((()=>{}));function frn(e){if(!/^\s*(\{)/.test(e.slice(0,500)))return!1;try{return BE(JSON.parse(e))}catch{return!1}}var prn=s((()=>{HE()}));function mrn(e){return/^\s*(?:-\s*)?[\w\-]+\s*:\s*.+\n.*/.test(e)}var hrn=s((()=>{}));function grn(e){return!S3(e)&&!mrn(e)&&!frn(e)}var _rn=s((()=>{C3(),prn(),hrn()}));function w3(e=``){return e&&e.replace(/\\/g,`/`).replace(brn,e=>e.toUpperCase())}function vrn(){return typeof process<`u`&&typeof process.cwd==`function`?process.cwd().replace(/\\/g,`/`):`/`}function T3(e,t){let n=``,r=0,i=-1,a=0,o=null;for(let s=0;s<=e.length;++s){if(s<e.length)o=e[s];else if(o===`/`)break;else o=`/`;if(o===`/`){if(!(i===s-1||a===1))if(a===2){if(n.length<2||r!==2||n[n.length-1]!==`.`||n[n.length-2]!==`.`){if(n.length>2){let e=n.lastIndexOf(`/`);e===-1?(n=``,r=0):(n=n.slice(0,e),r=n.length-1-n.lastIndexOf(`/`)),i=s,a=0;continue}else if(n.length>0){n=``,r=0,i=s,a=0;continue}}t&&(n+=n.length>0?`/..`:`..`,r=2)}else n.length>0?n+=`/${e.slice(i+1,s)}`:n=e.slice(i+1,s),r=s-i-1;i=s,a=0}else o===`.`&&a!==-1?++a:a=-1}return n}var E3,D3,yrn,brn,xrn,Srn,O3,k3,Crn,wrn,A3,Trn,j3,M3,Ern,N3,Drn,P3,Orn,F3,krn,Arn,I3,jrn=s((()=>{E3=()=>{var e=(()=>{var e=Object.defineProperty,t=Object.getOwnPropertyDescriptor,n=Object.getOwnPropertyNames,r=Object.prototype.hasOwnProperty,i=(t,n)=>{for(var r in n)e(t,r,{get:n[r],enumerable:!0})},a=(i,a,o,s)=>{if(a&&typeof a==`object`||typeof a==`function`)for(let c of n(a))!r.call(i,c)&&c!==o&&e(i,c,{get:()=>a[c],enumerable:!(s=t(a,c))||s.enumerable});return i},o=t=>a(e({},`__esModule`,{value:!0}),t),s={};i(s,{default:()=>Ue});var c=e=>Array.isArray(e),l=e=>typeof e==`function`,u=e=>e.length===0,d=e=>typeof e==`number`,f=e=>typeof e==`object`&&!!e,p=e=>e instanceof RegExp,m=e=>typeof e==`string`,h=e=>e===void 0,g=e=>{let t=new Map;return n=>{let r=t.get(n);if(r)return r;let i=e(n);return t.set(n,i),i}},_=(e,t,n={})=>{let r={cache:{},input:e,index:0,indexMax:0,options:n,output:[]};if(ae(t)(r)&&r.index===e.length)return r.output;throw Error(`Failed to parse at index ${r.indexMax}`)},v=(e,t)=>c(e)?y(e,t):m(e)?x(e,t):b(e,t),y=(e,t)=>{let n={};for(let t of e){if(t.length!==1)throw Error(`Invalid character: "${t}"`);let e=t.charCodeAt(0);n[e]=!0}return e=>{let r=e.index,i=e.input;for(;e.index<i.length&&i.charCodeAt(e.index)in n;)e.index+=1;let a=e.index;if(a>r){if(!h(t)&&!e.options.silent){let n=e.input.slice(r,a),o=l(t)?t(n,i,String(r)):t;h(o)||e.output.push(o)}e.indexMax=Math.max(e.indexMax,e.index)}return!0}},b=(e,t)=>{let n=e.source,r=e.flags.replace(/y|$/,`y`),i=new RegExp(n,r);return T(e=>{i.lastIndex=e.index;let n=i.exec(e.input);if(n){if(!h(t)&&!e.options.silent){let r=l(t)?t(...n,e.input,String(e.index)):t;h(r)||e.output.push(r)}return e.index+=n[0].length,e.indexMax=Math.max(e.indexMax,e.index),!0}else return!1})},x=(e,t)=>n=>{if(n.input.startsWith(e,n.index)){if(!h(t)&&!n.options.silent){let r=l(t)?t(e,n.input,String(n.index)):t;h(r)||n.output.push(r)}return n.index+=e.length,n.indexMax=Math.max(n.indexMax,n.index),!0}else return!1},S=(e,t,n,r)=>{let i=ae(e);return T(re(ne(e=>{let r=0;for(;r<n;){let t=e.index;if(!i(e)||(r+=1,e.index===t))break}return r>=t})))},C=(e,t)=>S(e,0,1),w=(e,t)=>S(e,0,1/0),ee=(e,t)=>{let n=e.map(ae);return T(re(ne(e=>{for(let t=0,r=n.length;t<r;t++)if(!n[t](e))return!1;return!0})))},te=(e,t)=>{let n=e.map(ae);return T(re(e=>{for(let t=0,r=n.length;t<r;t++)if(n[t](e))return!0;return!1}))},ne=(e,t=!1)=>{let n=ae(e);return e=>{let r=e.index,i=e.output.length,a=n(e);return(!a||t)&&(e.index=r,e.output.length!==i&&(e.output.length=i)),a}},re=(e,t)=>ae(e),T=(()=>{let e=0;return t=>{let n=ae(t),r=e+=1;return e=>{var t;if(e.options.memoization===!1)return n(e);let i=e.index,a=(t=e.cache)[r]||(t[r]=new Map),o=a.get(i);if(o===!1)return!1;if(d(o))return e.index=o,!0;if(o)return e.index=o.index,o.output?.length&&e.output.push(...o.output),!0;{let t=e.output.length;if(n(e)){let n=e.index,r=e.output.length;if(r>t){let o=e.output.slice(t,r);a.set(i,{index:n,output:o})}else a.set(i,n);return!0}else return a.set(i,!1),!1}}}})(),ie=e=>{let t;return n=>(t||=ae(e()),t(n))},ae=g(e=>{if(l(e))return u(e)?ie(e):e;if(m(e)||p(e))return v(e);if(c(e))return ee(e);if(f(e))return te(Object.values(e));throw Error(`Invalid rule`)}),E=`abcdefghijklmnopqrstuvwxyz`,D=e=>{let t=``;for(;e>0;)t=E[(e-1)%26]+t,e=Math.floor((e-1)/26);return t},oe=e=>{let t=0;for(let n=0,r=e.length;n<r;n++)t=t*26+E.indexOf(e[n])+1;return t},se=(e,t)=>{if(t<e)return se(t,e);let n=[];for(;e<=t;)n.push(e++);return n},ce=(e,t,n)=>se(e,t).map(e=>String(e).padStart(n,`0`)),le=(e,t)=>se(oe(e),oe(t)).map(D),ue=e=>e,de=e=>fe(t=>_(t,e,{memoization:!1}).join(``)),fe=e=>{let t={};return n=>t[n]??(t[n]=e(n))},pe=v(/^\*\*\/\*$/,`.*`),me=v(/^\*\*\/(\*)?([ a-zA-Z0-9._-]+)$/,(e,t,n)=>`.*${t?``:`(?:^|/)`}${n.replaceAll(`.`,`\\.`)}`),he=v(/^\*\*\/(\*)?([ a-zA-Z0-9._-]*)\{([ a-zA-Z0-9._-]+(?:,[ a-zA-Z0-9._-]+)*)\}$/,(e,t,n,r)=>`.*${t?``:`(?:^|/)`}${n.replaceAll(`.`,`\\.`)}(?:${r.replaceAll(`,`,`|`).replaceAll(`.`,`\\.`)})`),ge=v(/\\./,ue),_e=v(/[$.*+?^(){}[\]\|]/,e=>`\\${e}`),ve=v(/./,ue),ye=te([v(/^(?:!!)*!(.*)$/,(e,t)=>`(?!^${Re(t)}$).*?`),v(/^(!!)+/,``)]),be=te([v(/\/(\*\*\/)+/,`(?:/.+/|/)`),v(/^(\*\*\/)+/,`(?:^|.*/)`),v(/\/(\*\*)$/,`(?:/.*|$)`),v(/\*\*/,`.*`)]),xe=te([v(/\*\/(?!\*\*\/)/,`[^/]*/`),v(/\*/,`[^/]*`)]),Se=v(`?`,`[^/]`),Ce=v(`[`,ue),we=v(`]`,ue),Te=v(/[!^]/,`^/`),Ee=v(/[a-z]-[a-z]|[0-9]-[0-9]/i,ue),De=te([ge,v(/[$.*+?^(){}[\|]/,e=>`\\${e}`),Ee,v(/[^\]]/,ue)]),Oe=ee([Ce,C(Te),w(De),we]),ke=v(`{`,`(?:`),Ae=v(`}`,`)`),je=ee([ke,te([v(/(\d+)\.\.(\d+)/,(e,t,n)=>ce(+t,+n,Math.min(t.length,n.length)).join(`|`)),v(/([a-z]+)\.\.([a-z]+)/,(e,t,n)=>le(t,n).join(`|`)),v(/([A-Z]+)\.\.([A-Z]+)/,(e,t,n)=>le(t.toLowerCase(),n.toLowerCase()).join(`|`).toUpperCase())]),Ae]),Me=v(`{`,`(?:`),Ne=v(`}`,`)`),Pe=v(`,`,`|`),Fe=v(/[$.*+?^(){[\]\|]/,e=>`\\${e}`),Ie=v(/[^}]/,ue),Le=ee([Me,w(te([be,xe,Se,Oe,je,ie(()=>Le),ge,Fe,Pe,Ie])),Ne]),Re=de(w(te([pe,me,he,ye,be,xe,Se,Oe,je,Le,ge,_e,ve]))),ze=v(/\\./,ue),Be=v(/./,ue),Ve=de(w(te([ze,v(/\*\*\*+/,`*`),v(/([^/{[(!])\*\*/,(e,t)=>`${t}*`),v(/(^|.)\*\*(?=[^*/)\]}])/,(e,t)=>`${t}*`),Be]))),He=(e,t)=>{let n=Array.isArray(e)?e:[e];if(!n.length)return!1;let r=n.map(He.compile),i=n.every(e=>/(\/(?:\*\*)?|\[\/\])$/.test(e)),a=t.replace(/[\\\/]+/g,`/`).replace(/\/$/,i?`/`:``);return r.some(e=>e.test(a))};He.compile=e=>RegExp(`^${Re(Ve(e))}$`,`s`);var Ue=He;return o(s)})();return e.default||e},yrn=(e,t)=>(D3||(D3=E3(),E3=null),D3(e,t)),brn=/^[A-Za-z]:\//,xrn=/^[/\\]{2}/,Srn=/^[/\\](?![/\\])|^[/\\]{2}(?!\.)|^[A-Za-z]:[/\\]/,O3=/^[A-Za-z]:$/,k3=/^\/([A-Za-z]:)?$/,Crn=/.(\.[^./]+|\.)$/,wrn=/^[/\\]|^[a-zA-Z]:[/\\]/,A3=function(e){if(e.length===0)return`.`;e=w3(e);let t=e.match(xrn),n=M3(e),r=e[e.length-1]===`/`;return e=T3(e,!n),e.length===0?n?`/`:r?`./`:`.`:(r&&(e+=`/`),O3.test(e)&&(e+=`/`),t?n?`//${e}`:`//./${e}`:n&&!M3(e)?`/${e}`:e)},Trn=function(...e){let t=``;for(let n of e)if(n)if(t.length>0){let e=t[t.length-1]===`/`,r=n[0]===`/`;e&&r?t+=n.slice(1):t+=e||r?n:`/${n}`}else t+=n;return A3(t)},j3=function(...e){e=e.map(e=>w3(e));let t=``,n=!1;for(let r=e.length-1;r>=-1&&!n;r--){let i=r>=0?e[r]:vrn();!i||i.length===0||(t=`${i}/${t}`,n=M3(i))}return t=T3(t,!n),n&&!M3(t)?`/${t}`:t.length>0?t:`.`},M3=function(e){return Srn.test(e)},Ern=function(e){return w3(e)},N3=function(e){if(e===`..`)return``;let t=Crn.exec(w3(e));return t&&t[1]||``},Drn=function(e,t){let n=j3(e).replace(k3,`$1`).split(`/`),r=j3(t).replace(k3,`$1`).split(`/`);if(r[0][1]===`:`&&n[0][1]===`:`&&n[0]!==r[0])return r.join(`/`);let i=[...n];for(let e of i){if(r[0]!==e)break;n.shift(),r.shift()}return[...n.map(()=>`..`),...r].join(`/`)},P3=function(e){let t=w3(e).replace(/\/$/,``).split(`/`).slice(0,-1);return t.length===1&&O3.test(t[0])&&(t[0]+=`/`),t.join(`/`)||(M3(e)?`/`:`.`)},Orn=function(e){let t=e.ext?e.ext.startsWith(`.`)?e.ext:`.${e.ext}`:``,n=[e.root,e.dir,e.base??(e.name??``)+t].filter(Boolean);return w3(e.root?j3(...n):n.join(`/`))},F3=function(e,t){let n=w3(e).split(`/`),r=``;for(let e=n.length-1;e>=0;e--){let t=n[e];if(t){r=t;break}}return t&&r.endsWith(t)?r.slice(0,-t.length):r},krn=function(e){let t=wrn.exec(e)?.[0]?.replace(/\\/g,`/`)||``,n=F3(e),r=N3(n);return{root:t,dir:P3(e),base:n,ext:r,name:n.slice(0,n.length-r.length)}},Arn=(e,t)=>yrn(t,A3(e)),I3={__proto__:null,basename:F3,dirname:P3,extname:N3,format:Orn,isAbsolute:M3,join:Trn,matchesGlob:Arn,normalize:A3,normalizeString:T3,parse:krn,relative:Drn,resolve:j3,sep:`/`,toNamespacedPath:Ern}})),Mrn,Nrn,L3,R3,Prn,Frn=s((()=>{jrn(),Mrn=globalThis.process?.platform===`win32`?`;`:`:`,Nrn={posix:void 0,win32:void 0},L3=(e=Mrn)=>new Proxy(I3,{get(t,n){return n===`delimiter`?e:n===`posix`?R3:n===`win32`?Prn:Nrn[n]||I3[n]}}),R3=L3(`:`),Prn=L3(`;`)})),Irn,Lrn=s((()=>{Frn(),C3(),Irn=(e,t)=>{if(S3(t))return t;if(S3(e)){let n=new URL(e);return n.pathname=R3.posix.resolve(`/`,R3.dirname(n.pathname),t),n.toString()}return R3.resolve(R3.dirname(e),t)}}));function Rrn(e){return decodeURI(e.replace(/~1/g,`/`).replace(/~0/g,`~`))}var zrn=s((()=>{}));function z3(e){return e.split(`/`).slice(1).map(Rrn)}var B3=s((()=>{zrn()}));function V3(e,t,n){if(t===``)throw Error(`Cannot set value at root ('') pointer`);let r=z3(t);r.forEach(e=>NY(e));let i=e;for(let e=0;e<r.length;e++){let t=r[e],a=e===r.length-1,o=r[e+1],s=/^\d+$/.test(o??``);a?i[t]=n:((!(t in i)||typeof i[t]!=`object`)&&(i[t]=s?[]:{}),i=i[t])}}var Brn=s((()=>{PY(),B3()})),Vrn,Hrn=s((()=>{Frn(),C3(),Vrn=(e,t)=>{if(S3(e)&&S3(t)){let n=new URL(e),r=new URL(t);if(n.origin!==r.origin)return e;let i=R3.dirname(R3.posix.resolve(`/`,r.pathname)),a=R3.posix.resolve(`/`,n.pathname);return R3.posix.relative(i,a)}if(S3(t)){let n=new URL(t),r=R3.dirname(R3.posix.resolve(`/`,n.pathname));return n.pathname=R3.posix.relative(r,R3.posix.resolve(`/`,e)),n.toString()}if(S3(e))return e;let n=R3.dirname(R3.resolve(t)),r=R3.resolve(e);return R3.relative(n,r)}}));function Urn(e){let t=GY(e).substring(0,7);return t.match(/^\d+$/)?`a`+t.substring(1):t}async function Wrn(e,t,n,r,i=0){if(i>=100)throw`Can not generate unique compressed values`;let a=await e(r??t);return n[a]!==void 0&&n[a]!==t?Wrn(e,t,n,a,i+1):(n[a]=t,a)}var Grn,Krn=s((()=>{KY(),Grn=(e,t)=>{let n=Object.fromEntries(Object.entries(t).map(([e,t])=>[t,e]));return{generate:async r=>{let i=n[r];if(i)return i;let a=await Wrn(e,r,t),o=a.match(/^\d+$/)?`a${a}`:a;return n[r]=o,o}}}}));function qrn(e){return e.startsWith(`#`)}function Jrn(e,t){let n=t.find(t=>t.validate(e));return n?n.exec(e):Promise.resolve({ok:!1})}function H3(e,t){if(!qrn(e))throw`Please provide an internal ref`;return`#/${t.map(n4).join(`/`)}${e.substring(1)}`}function U3(e,t){if(Array.isArray(e)){e.forEach(e=>U3(e,t));return}if(BE(e)&&(Object.values(e).forEach(e=>U3(e,t)),typeof e==`object`&&`$ref`in e&&typeof e.$ref==`string`)){let n=e.$ref;if(!qrn(n))return;e.$ref=H3(n,t)}}async function W3(e,t){t.externalDocumentsKey=t.externalDocumentsKey??K3.externalDocuments,t.externalDocumentsMappingsKey=t.externalDocumentsMappingsKey??K3.externalDocumentsMappings;let n=t.cache??new Map,r=t.plugins.filter(e=>e.type===`loader`),i=t.plugins.filter(e=>e.type===`lifecycle`),a=await(async()=>{if(typeof e!=`string`)return e;let t=await Jrn(e,r);if(t.ok&&typeof t.data==`object`)return t.data;throw Error(`Failed to resolve input: Please provide a valid string value or pass a loader to process the input`)})(),o=t.root??a,s=qE(o),c=t.root!==void 0&&t.root!==a||t.depth!==void 0,l=t.visitedNodes??new Set,u=GE(o)||(t.origin?t.origin:typeof e==`string`&&(S3(e)||grn(e))?e:`/`);o[t.externalDocumentsMappingsKey]===void 0&&(o[t.externalDocumentsMappingsKey]={});let{generate:d}=Grn(t.compress??Urn,o[t.externalDocumentsMappingsKey]),f=async(e,...n)=>{let r=t.hooks?.[e];r&&await r(...n);for(let t of i){let r=t[e];r&&await r(...n)}},p=async(e,i=u,a=!1,m=0,h=[],g=null)=>{if(t.depth!==void 0&&m>t.depth||!BE(e)&&!Array.isArray(e)||l.has(e))return;l.add(e);let _={path:h,resolutionCache:n,parentNode:g,rootNode:o,loaders:r};await f(`onBeforeNodeProcess`,e,_);let v=GE(e);if(Yrn(e)){let l=e.$ref,h=`$global`in e&&typeof e.$global==`boolean`&&e.$global,g=WE(l,v??i,s);if(g!==void 0){if(c){let e=z3(`/${g}`),t=e.length>0?YE(o,e.slice(0,-1)).value:void 0,n=YE(o,e);await p(n.value,n.context,a,m+1,e,t)}await f(`onAfterNodeProcess`,e,_);return}let[y,b=``]=l.split(`#`,2),x=Irn(v??i,y),S=Vrn(x,u),C=await d(S),w=n.has(S);w||n.set(S,Jrn(x,r)),await f(`onResolveStart`,e);let ee=await n.get(S);if(ee.ok){w||(h||U3(ee.data,[K3.externalDocuments,C]),await p(ee.data,h?i:x,h,m+1,[t.externalDocumentsKey,C,o[t.externalDocumentsMappingsKey]]),V3(o,`/${t.externalDocumentsMappingsKey}/${n4(C)}`,S)),t.treeShake===!0?G3(o,{[t.externalDocumentsKey]:{[C]:ee.data}},H3(`#${b}`,[t.externalDocumentsKey,C]).substring(1),t.externalDocumentsKey,C):w||V3(o,`/${t.externalDocumentsKey}/${C}`,ee.data),e.$ref=H3(`#${b}`,[t.externalDocumentsKey,C]),await f(`onResolveSuccess`,e),await f(`onAfterNodeProcess`,e,_);return}return await f(`onResolveError`,e),await f(`onAfterNodeProcess`,e,_),console.warn(`Failed to resolve external reference "${x}". The reference may be invalid, inaccessible, or missing a loader for this type of reference.`)}for(let n in e)n===t.externalDocumentsKey||n===t.externalDocumentsMappingsKey||await p(e[n],v??i,a,m+1,[...h,n],e);await f(`onAfterNodeProcess`,e,_)};return await p(a),!t.urlMap&&!c&&delete o[t.externalDocumentsMappingsKey],a}var Yrn,G3,K3,Xrn=s((()=>{HE(),L4e(),JE(),R4e(),_rn(),C3(),Lrn(),Brn(),Hrn(),G1t(),B3(),Krn(),Yrn=e=>BE(e)&&`$ref`in e&&typeof e.$ref==`string`,G3=(e,t,n,r,i,a=!1,o=new Set)=>{let s=YE(t,z3(n)).value;if(o.has(s))return;o.add(s),V3(e,n,s);let c=n=>{if(!(!n||typeof n!=`object`)){`$ref`in n&&typeof n.$ref==`string`&&(n.$ref.startsWith(`#/${r}/${n4(i)}`)||a)&&G3(e,t,n.$ref.substring(1),r,i,a,o);for(let e of Object.values(n))c(e)}};c(s)},K3={externalDocuments:`x-ext`,externalDocumentsMappings:`x-ext-urls`}})),Zrn=s((()=>{Xrn()})),Qrn,$rn,ein=s((()=>{Qrn=class{data;next;constructor(e){this.data=e,this.next=null}},$rn=class{front;rear;size;constructor(){this.front=null,this.rear=null,this.size=0}enqueue(e){let t=new Qrn(e);this.isEmpty()||!this.rear?(this.front=t,this.rear=t):(this.rear.next=t,this.rear=t),this.size++}dequeue(){if(this.isEmpty()||!this.front)return null;let e=this.front;return this.front=this.front.next,this.front===null&&(this.rear=null),this.size--,e.data}peek(){return this.isEmpty()||!this.front?null:this.front.data}isEmpty(){return this.size===0}getSize(){return this.size}toString(){let e=this.front,t=[];for(;e;)t.push(e.data),e=e.next;return t.join(` -> `)}}}));function tin(e){let t=0,n=new $rn,r=()=>{if(n.isEmpty()||t>=e)return;let r=n.dequeue();r&&r()};return async i=>{t>=e&&await new Promise(e=>n.enqueue(e)),t++;try{return await i()}finally{t--,r()}}}var nin=s((()=>{ein()}));function rin(e){if(e!==null){if(typeof e==`string`){let t=iin(e);if(t.trim()===``)return;try{return JSON.parse(t)}catch{let e=/^[^:]+:/.test(t),n=t.slice(0,50).trimStart(),r=n.startsWith(`{`)||n.startsWith(`[`);return!e||r?void 0:d2(t,{maxAliasCount:1e4,merge:!0})}}return e}}var iin,ain=s((()=>{m2(),iin=e=>e.startsWith(``)?e.slice(1):e}));async function oin(e,t,n){try{let r=sin(e),i=n?.headers?.find(e=>e.domains.find(e=>e===r)!==void 0)?.headers,a=n?.fetch??fetch,o=await t(()=>a(e,{headers:i}));if(o.ok){let e=await o.text();return{ok:!0,data:rin(e),raw:e}}let s=o.headers.get(`Content-Type`)??``;return[`text/html`,`application/xml`].includes(s)&&console.warn(`[WARN] We only support JSON/YAML formats, received ${s}`),console.warn(`[WARN] Fetch failed with status ${o.status} ${o.statusText} for URL: ${e}`),{ok:!1}}catch{return console.warn(`[WARN] Failed to parse JSON/YAML from URL: ${e}`),{ok:!1}}}function q3(e){let t=e?.limit?tin(e.limit):e=>e();return{type:`loader`,validate:S3,exec:n=>oin(n,t,e)}}var sin,cin=s((()=>{nin(),C3(),ain(),sin=e=>{try{return new URL(e).host}catch{return null}}})),lin=s((()=>{m2()})),uin=s((()=>{cin(),lin()})),J3,din,fin=s((()=>{J3=class extends Error{constructor(e){super(e),this.name=`InvalidChangesDetectedError`}},din=(e,t)=>{let n=(e,t,r,i=0)=>{if(t[i]===void 0)throw new J3(`Process aborted. Path ${t.join(`.`)} at depth ${i} is undefined, check diff object`);if(i>=t.length-1){r.type===`add`||r.type===`update`?e[t[i]]=r.changes:Array.isArray(e)?e.splice(Number.parseInt(t[i]),1):delete e[t[i]];return}if(e[t[i]]===void 0||typeof e[t[i]]!=`object`)throw new J3(`Process aborted, check diff object`);n(e[t[i]],t,r,i+1)};for(let r of t)n(e,r.path,r);return e}})),Y3,pin=s((()=>{Y3=(e,t)=>{let n=[],r=(e,t,i=[])=>{if(typeof e!=typeof t){if(e===void 0){n.push({path:i,changes:t,type:`add`});return}if(t===void 0){n.push({path:i,changes:e,type:`delete`});return}n.push({path:i,changes:t,type:`update`});return}if(typeof e==`object`&&typeof t==`object`&&e!==null&&t!==null){let n=new Set([...Object.keys(e),...Object.keys(t)]);for(let a of n)r(e[a],t[a],[...i,a]);return}e!==t&&n.push({path:i,changes:t,type:`update`})};return r(e,t),n}})),X3,min,hin=s((()=>{X3=class{value;children;constructor(e,t){this.value=e,this.children=t}},min=class{root;constructor(){this.root=new X3(null,{})}addPath(e,t){let n=this.root;for(let t of e)n.children[t]||(n.children[t]=new X3(null,{})),n=n.children[t];n.value=t}findMatch(e,t){let n=this.root;for(let r of e){n.value!==null&&t(n.value);let e=n.children[r];if(!e)return;n=e}let r=e=>{for(let t of Object.keys(e?.children??{}))e&&Object.hasOwn(e.children,t)&&r(e?.children[t]);e?.value&&t(e.value)};r(n)}}})),Z3,Q3,gin,_in=s((()=>{Z3=(e,t)=>{if(typeof e!=typeof t)return!0;if(typeof e==`object`&&typeof t==`object`&&e!==null&&t!==null){let n=new Set([...Object.keys(e),...Object.keys(t)]);for(let r of n)if(e[r]!==void 0&&t[r]!==void 0&&Z3(e[r],t[r]))return!0;return!1}return e!==t},Q3=(e,t)=>{for(let n in t)if(!(n in e))e[n]=t[n];else{let r=e[n],i=t[n];typeof r==`object`&&r&&typeof i==`object`&&i&&(e[n]=Q3(r,i))}return e},gin=(e,t)=>{if(e.length!==t.length)return!1;for(let n=0;n<=e.length;++n)if(e[n]!==t[n])return!1;return!0}})),vin,yin=s((()=>{hin(),_in(),vin=(e,t)=>{let n=new min;for(let[t,r]of e.entries())n.addPath(r.path,{index:t,changes:r});let r=new Set,i=new Set,a=new Map,o=new Map;for(let[e,s]of t.entries())n.findMatch(s.path,t=>{if(s.type===`delete`)if(t.changes.type===`delete`)t.changes.path.length>s.path.length?r.add(t.index):i.add(t.index);else{r.add(t.index),i.add(e);let n=o.get(e);n===void 0?o.set(e,[[t.changes],[s]]):n[0].push(t.changes)}if(s.type===`add`||s.type===`update`){if(gin(s.path,t.changes.path)&&t.changes.type!==`delete`&&!Z3(s.changes,t.changes.changes)){r.add(t.index),typeof s.changes==`object`&&Q3(s.changes,t.changes.changes);return}r.add(t.index),i.add(e);let n=a.get(t.index);n===void 0?a.set(t.index,[[t.changes],[s]]):n[1].push(s)}});let s=[...a.values(),...o.values()];return{diffs:[...e.filter((e,t)=>!r.has(t)),...t.filter((e,t)=>!i.has(t))],conflicts:s}}})),bin=s((()=>{fin(),pin(),yin()}));function $3(e){if(!(typeof e!=`object`||!e)){if(Array.isArray(e)){for(let t of e)$3(t);return}if(e.xml&&typeof e.xml==`object`){if(e.xml.wrapped===!0&&e.xml.attribute===!0)throw Error(`Invalid XML configuration: wrapped and attribute cannot be true at the same time.`);e.xml.wrapped===!0&&(delete e.xml.wrapped,e.xml.nodeType=`element`),e.xml.attribute===!0&&(delete e.xml.attribute,e.xml.nodeType=`attribute`)}for(let t in e)Object.hasOwn(e,t)&&$3(e[t])}}function xin(e){if(e[`x-tagGroups`]&&Array.isArray(e[`x-tagGroups`])){let t=e[`x-tagGroups`];e.tags||=[];let n=new Map;for(let e of t)for(let t of e.tags)n.set(t,e.name);if(Array.isArray(e.tags)){for(let t of e.tags)if(typeof t==`object`&&t&&`name`in t){let e=n.get(t.name);e&&(e.toLowerCase().includes(`nav`)||e.toLowerCase().includes(`navigation`)?t.kind=`nav`:e.toLowerCase().includes(`audience`)?t.kind=`audience`:e.toLowerCase().includes(`badge`)?t.kind=`badge`:t.kind=`nav`)}}delete e[`x-tagGroups`]}}function Sin(e){let t=e;if(typeof t==`object`&&t&&typeof t.openapi==`string`&&t.openapi?.startsWith(`3.1`))t.openapi=`3.2.0`;else return t;return xin(t),$3(t),t}var Cin=s((()=>{})),win=s((()=>{Cin()}));function e6(e,t,n=[]){let r={};for(let[i,a]of Object.entries(e)){let e=[...n,i];if(Array.isArray(a)){r[i]=a.map((n,r)=>typeof n==`object`&&!Array.isArray(n)&&n!==null?e6(n,t,[...e,r.toString()]):n);continue}if(typeof a==`object`&&a){r[i]=e6(a,t,e);continue}r[i]=a}return t(r,n)}var Tin=s((()=>{}));function Ein(e){let t=e[`x-example`],n=e[`x-examples`];return delete e[`x-example`],delete e[`x-examples`],{xExample:t,xExamples:n}}function t6(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.keys(e).length>0}function Din(e){return t6(e)&&Object.values(e).every(e=>typeof e==`object`&&!!e&&!Array.isArray(e))}function Oin(e){if(typeof e!=`object`||!e)return!0;let t=e;return!(t.allOf||t.oneOf||t.anyOf||t.items||t.$ref||`additionalProperties`in t||[`enum`,`const`,`not`,`format`,`multipleOf`,`maximum`,`exclusiveMaximum`,`minimum`,`exclusiveMinimum`,`maxLength`,`minLength`,`pattern`,`maxItems`,`minItems`,`uniqueItems`,`maxProperties`,`minProperties`,`required`].some(e=>e in t)||typeof t.properties==`object`&&t.properties!==null&&Object.keys(t.properties).length>0)}function kin(e){let t=Object.keys(e);if(t.some(t=>{let n=e[t];return n?.example!==void 0||n?.examples!==void 0}))for(let n of t){let t=e[n];if(!t)continue;let r=t.example!==void 0||t.examples!==void 0;t.schema!==void 0&&!r&&Object.keys(t).length===1&&Oin(t.schema)&&delete e[n]}}function Ain(e){if(typeof e!=`object`||!e)return!1;let t=e,n=`value`in t||`externalValue`in t,r=Object.keys(t).every(e=>Bin.has(e));return n&&r}function n6(e){return Ain(e)?e:{value:e}}function r6(e){return Vin.test(e)}function jin(e){return Object.entries(e).reduce((e,[t,n])=>(e[t]={value:n},e),{})}function Min(e){let t=e;if(typeof t==`object`&&t&&typeof t.swagger==`string`&&t.swagger?.startsWith(`2.0`))t.openapi=`3.0.4`,delete t.swagger;else return t;if(t.host){let e=Array.isArray(t.schemes)&&t.schemes?.length?t.schemes:[`http`];t.servers=e.map(e=>({url:`${e}://${t.host}${t.basePath??``}`})),delete t.basePath,delete t.schemes,delete t.host}else t.basePath&&(t.servers=[{url:t.basePath}],delete t.basePath);if(t.definitions&&(t.components=Object.assign({},t.components,{schemas:t.definitions}),delete t.definitions,t=e6(t,e=>(typeof e.$ref==`string`&&e.$ref.startsWith(`#/definitions/`)&&(e.$ref=e.$ref.replace(/^#\/definitions\//,`#/components/schemas/`)),e))),t=e6(t,e=>(e.type===`file`&&(e.type=`string`,e.format=`binary`),e)),Object.hasOwn(t,`parameters`)){t=e6(t,e=>{if(typeof e.$ref==`string`&&e.$ref.startsWith(`#/parameters/`)){let n=e.$ref.split(`/`)[2];if(!n)return e;let r=t.parameters&&typeof t.parameters==`object`&&n in t.parameters?t.parameters[n]:void 0;r&&typeof r==`object`&&`in`in r&&(r.in===`body`||r.in===`formData`)?e.$ref=e.$ref.replace(/^#\/parameters\//,`#/components/requestBodies/`):e.$ref=e.$ref.replace(/^#\/parameters\//,`#/components/parameters/`)}return e}),t.components??={};let e={},n={},r=t.parameters&&typeof t.parameters==`object`?t.parameters:{};for(let[i,a]of Object.entries(r))a&&typeof a==`object`&&(`$ref`in a?e[i]=i6(a):`in`in a&&(a.in===`body`?n[i]=Lin(a,t.consumes??[a6]):a.in===`formData`?n[i]=Rin([a],t.consumes):e[i]=i6(a)));Object.keys(e).length>0&&(t.components.parameters=e),Object.keys(n).length>0&&(t.components.requestBodies=n),delete t.parameters}if(Object.hasOwn(t,`responses`)&&typeof t.responses==`object`&&t.responses!==null){t=e6(t,e=>(typeof e.$ref==`string`&&e.$ref.startsWith(`#/responses/`)&&(e.$ref=e.$ref.replace(/^#\/responses\//,`#/components/responses/`)),e)),t.components??={};let e={},n=t.responses;for(let[r,i]of Object.entries(n))if(i&&typeof i==`object`)if(`$ref`in i)e[r]=i;else{let n=i,a=t.produces??[a6];if(n.schema){typeof n.content!=`object`&&(n.content={});for(let e of a)n.content[e]={schema:n.schema};delete n.schema}if(n.examples&&typeof n.examples==`object`){typeof n.content!=`object`&&(n.content={});let e=a[0]??a6;for(let[t,r]of Object.entries(n.examples))if(r6(t))typeof n.content[t]!=`object`&&(n.content[t]={}),n.content[t].example=r;else{typeof n.content[e]!=`object`&&(n.content[e]={});let i=n.content[e];typeof i.examples!=`object`&&(i.examples={}),i.examples[t]=n6(r)}delete n.examples}n.content&&typeof n.content==`object`&&kin(n.content),n.headers&&typeof n.headers==`object`&&(n.headers=Object.entries(n.headers).reduce((e,[t,n])=>n&&typeof n==`object`?{[t]:Fin(n),...e}:e,{})),e[r]=n}Object.keys(e).length>0&&(t.components.responses=e),delete t.responses}if(typeof t.paths==`object`){for(let e in t.paths)if(Object.hasOwn(t.paths,e)){let n=t.paths&&typeof t.paths==`object`&&e in t.paths?t.paths[e]:void 0;if(!n||typeof n!=`object`)continue;let r;for(let e in n)if(e===`parameters`&&Object.hasOwn(n,e)){let e=zin(n.parameters,t.consumes??[a6]);n.parameters=e.parameters,r=e.requestBody}else if(Object.hasOwn(n,e)){let i=n[e];if(r&&(i.requestBody=r),i.parameters){let e=zin(i.parameters,i.consumes??t.consumes??[a6]);i.parameters=e.parameters,e.requestBody&&(i.requestBody=e.requestBody)}if(delete i.consumes,i.responses){for(let e in i.responses)if(Object.hasOwn(i.responses,e)){let n=i.responses[e];if(n.headers&&typeof n.headers==`object`&&(n.headers=Object.entries(n.headers).reduce((e,[t,n])=>n&&typeof n==`object`?{[t]:Fin(n),...e}:e,{})),n.schema){let e=t.produces??i.produces??[a6];typeof n.content!=`object`&&(n.content={});for(let t of e)n.content[t]={schema:n.schema};delete n.schema}if(n.examples&&typeof n.examples==`object`){typeof n.content!=`object`&&(n.content={});let e=(t.produces??i.produces??[a6])[0]??a6;for(let[t,r]of Object.entries(n.examples))if(r6(t))typeof n.content[t]!=`object`&&(n.content[t]={}),n.content[t].example=r;else{typeof n.content[e]!=`object`&&(n.content[e]={});let i=n.content[e];typeof i.examples!=`object`&&(i.examples={}),i.examples[t]=n6(r)}delete n.examples}n.content&&typeof n.content==`object`&&kin(n.content)}}delete i.produces,i.parameters?.length===0&&delete i.parameters}}}if(t.securityDefinitions){(typeof t.components!=`object`||t.components===null)&&(t.components={}),t.components&&typeof t.components==`object`&&Object.assign(t.components,{securitySchemes:{}});for(let[e,n]of Object.entries(t.securityDefinitions))if(typeof n==`object`)if(`type`in n&&n.type===`oauth2`){let{flow:r,authorizationUrl:i,tokenUrl:a,scopes:o}=n;t.components&&typeof t.components==`object`&&`securitySchemes`in t.components&&t.components.securitySchemes&&Object.assign(t.components.securitySchemes,{[e]:{type:`oauth2`,flows:{[Hin(r||`implicit`)]:Object.assign({},i&&{authorizationUrl:i},a&&{tokenUrl:a},o&&{scopes:o})}}})}else `type`in n&&n.type===`basic`?t.components&&typeof t.components==`object`&&`securitySchemes`in t.components&&t.components.securitySchemes&&Object.assign(t.components.securitySchemes,{[e]:{type:`http`,scheme:`basic`}}):t.components&&typeof t.components==`object`&&`securitySchemes`in t.components&&t.components.securitySchemes&&Object.assign(t.components.securitySchemes,{[e]:n});delete t.securityDefinitions}return delete t.consumes,delete t.produces,t}function Nin(e){return[`type`,`format`,`default`,`items`,`maximum`,`exclusiveMaximum`,`minimum`,`exclusiveMinimum`,`maxLength`,`minLength`,`pattern`,`maxItems`,`minItems`,`uniqueItems`,`enum`,`multipleOf`].reduce((t,n)=>(Object.hasOwn(e,n)&&(t[n]=e[n],delete e[n]),t),{})}function Pin(e){if(e===`formData`)throw Error(`Encountered a formData parameter which should have been filtered out by the caller`);if(e===`body`)throw Error(`Encountered a body parameter which should have been filtered out by the caller`);return e}function i6(e){if(Object.hasOwn(e,`$ref`)&&typeof e.$ref==`string`)return{$ref:e.$ref};let t=Iin(e),n=Nin(e),{xExample:r,xExamples:i}=Ein(e);if(t6(r)?e.examples=jin(r):t6(i)&&(e.examples=Object.entries(i).reduce((e,[t,n])=>(e[t]=n6(n),e),{})),delete e.collectionFormat,delete e.default,!e.in)throw Error(`Parameter object must have an "in" property`);return{schema:n,...t,...e,in:Pin(e.in)}}function Fin(e){if(Object.hasOwn(e,`$ref`)&&typeof e.$ref==`string`)return{$ref:e.$ref};let t=Nin(e);return{...e,schema:t}}function Iin(e){if(e.type!==`array`||!(e.in===`query`||e.in===`path`||e.in===`header`))return{};let t=e.collectionFormat??`csv`;return e.in in s6&&t in s6[e.in]?s6[e.in][t]:{}}function Lin(e,t){let{xExample:n,xExamples:r}=Ein(e);delete e.name,delete e.in;let{schema:i,...a}=e,o={content:{},...a};if(o.content)for(let e of t){if(o.content[e]={schema:i},t6(r)&&e in r){let t=r[e];t6(t)&&Object.values(t).every(e=>Ain(e))?o.content[e].examples=t:Din(t)?o.content[e].examples=Object.entries(t).reduce((e,[t,n])=>(e[t]=n6(n),e),{}):o.content[e].examples={default:n6(t)}}else t6(r)&&!Object.keys(r).some(r6)&&(o.content[e].examples=Object.entries(r).reduce((e,[t,n])=>(e[t]=n6(n),e),{}));!o.content[e].examples&&t6(n)&&e in n&&(o.content[e].example=n[e])}return o}function Rin(e,t=[`multipart/form-data`]){let n={content:{}},r=t.filter(e=>e===`multipart/form-data`||e===`application/x-www-form-urlencoded`),i=r.length>0?r:[`multipart/form-data`];if(n.content)for(let t of i){n.content[t]={schema:{type:`object`,properties:{},required:[]}};let r=n.content?.[t];if(r?.schema&&typeof r.schema==`object`&&`properties`in r.schema)for(let t of e)t.name&&r.schema.properties&&(r.schema.properties[t.name]={type:t.type,description:t.description,...t.format?{format:t.format}:{}},t.required&&Array.isArray(r.schema.required)&&r.schema.required.push(t.name))}return n}function zin(e,t){let n={parameters:e.filter(e=>!(e.in===`body`||e.in===`formData`)).map(e=>i6(e))},r=structuredClone(e.find(e=>e.in===`body`)??{});r&&Object.keys(r).length&&(n.requestBody=Lin(r,t));let i=e.filter(e=>e.in===`formData`);if(i.length>0){let e=Rin(i,t);typeof n.requestBody==`object`?n.requestBody={...n.requestBody,content:{...n.requestBody.content,...e.content}}:n.requestBody=e,typeof n.requestBody!=`object`&&(n.requestBody={content:{}})}return n}var a6,Bin,Vin,Hin,Uin,o6,s6,Win=s((()=>{Tin(),a6=`application/json`,Bin=new Set([`summary`,`description`,`value`,`externalValue`]),Vin=/^[a-zA-Z0-9*+.-]+\/[a-zA-Z0-9*+.+-]+$/,Hin=e=>{switch(e){case`application`:return`clientCredentials`;case`accessCode`:return`authorizationCode`;case`implicit`:return`implicit`;case`password`:return`password`;default:return e}},Uin={ssv:{style:`spaceDelimited`,explode:!1},pipes:{style:`pipeDelimited`,explode:!1},multi:{style:`form`,explode:!0},csv:{style:`form`,explode:!1},tsv:{}},o6={ssv:{},pipes:{},multi:{},csv:{style:`simple`,explode:!1},tsv:{}},s6={header:o6,query:Uin,path:o6}})),Gin=s((()=>{Win()}));function Kin(e){return e?!!(e.some(e=>Jin.has(e))||e.some(e=>e.endsWith(`Schema`))||e.length>=2&&e[0]===`components`&&e[1]===`schemas`):!1}function qin(e){let t=e;return t===null||typeof t.openapi!=`string`||!t.openapi.startsWith(`3.0`)?t:(t.openapi=`3.1.1`,t=e6(t,Yin),t)}var Jin,Yin,Xin=s((()=>{Tin(),Jin=new Set([`properties`,`items`,`allOf`,`anyOf`,`oneOf`,`not`,`additionalProperties`,`schema`]),Yin=(e,t)=>{e.type!==void 0&&e.nullable===!0&&(e.type=[e.type,`null`],delete e.nullable),e.exclusiveMinimum===!0?(e.exclusiveMinimum=e.minimum,delete e.minimum):e.exclusiveMinimum===!1&&delete e.exclusiveMinimum,e.exclusiveMaximum===!0?(e.exclusiveMaximum=e.maximum,delete e.maximum):e.exclusiveMaximum===!1&&delete e.exclusiveMaximum;let n=t?.some((e,n)=>e===`examples`&&n>0?t[n-1]!==`properties`:!1);if(e.example!==void 0&&!n&&(Kin(t)?e.examples=[e.example]:e.examples={default:{value:e.example}},delete e.example),e.type===`object`&&e.properties!==void 0&&(t?.slice(0,-1))?.some((e,n)=>e===`content`&&t?.[n+1]===`multipart/form-data`)&&e.properties!==null)for(let t of Object.values(e.properties))typeof t==`object`&&t&&`type`in t&&`format`in t&&t.type===`string`&&t.format===`binary`&&(t.contentMediaType=`application/octet-stream`,delete t.format);if(t?.includes(`content`)&&t?.includes(`application/octet-stream`))return{};let{format:r,...i}=e;if(e.type===`string`){if(e.format===`binary`)return{...i,type:`string`,contentMediaType:`application/octet-stream`};if(e.format===`base64`)return{...i,type:`string`,contentEncoding:`base64`};if(e.format===`byte`){let e=(t?.slice(0,-1))?.find((e,n)=>t?.[n-1]===`content`);return{...i,type:`string`,contentEncoding:`base64`,contentMediaType:e}}}return e[`x-webhooks`]!==void 0&&(e.webhooks=e[`x-webhooks`],delete e[`x-webhooks`]),e}})),Zin=s((()=>{Xin()}));function Qin(e,t){let n=Min(e);if(t===`3.0`)return n;let r=qin(n);return t===`3.1`?r:Sin(r)}var $in=s((()=>{win(),Gin(),Zin()})),ean=s((()=>{$in()})),c6,tan,nan,ran,ian,aan,oan=s((()=>{cM(),c6=Z.Object({name:Z.String(),value:Z.String()}),tan=Z.Object({url:Z.String(),method:Z.String(),httpVersion:Z.String(),headers:Z.Array(c6),cookies:Z.Array(c6),headersSize:Z.Number(),queryString:Z.Array(c6),bodySize:Z.Number(),postData:Z.Optional(Z.Union([Z.Object({mimeType:Z.String(),text:Z.String()}),Z.Object({mimeType:Z.String(),params:Z.Array(Z.Object({name:Z.String(),value:Z.Optional(Z.String())}))})]))}),nan=Z.Object({status:Z.Number(),statusText:Z.String(),headers:Z.Array(c6),cookies:Z.Array(c6),httpVersion:Z.String(),redirectURL:Z.String(),headersSize:Z.Number(),bodySize:Z.Number(),content:Z.Object({size:Z.Number(),mimeType:Z.String(),encoding:Z.Optional(Z.String()),text:Z.Optional(Z.String())})}),ran=Z.Object({time:Z.Number(),timestamp:Z.Number(),request:tan,response:nan,meta:Z.Object({example:Z.String()}),requestMetadata:Z.Object({variables:Z.Record(Z.String(),Z.String())})}),ian=Z.Record(Z.String(),Z.Record(Z.String(),Z.Array(ran))),aan=Z.Record(Z.String(),ian)})),san,can,lan=s((()=>{W(),oan(),e$(),dD(),oN(),san=5,can=({hooks:e})=>{let t=fn({});return{getHistory:(e,n,r)=>t[e]?.[n]?.[r],addHistory:(n,r,i,a)=>{t[n]||={},t[n][r]||={},t[n][r][i]||=[],t[n][r][i].length>=san&&(t[n][r][i]=uD(t[n][r][i].filter((e,t)=>t!==0),{depth:1})),t[n][r][i].push(a),e?.onHistoryChange?.(n)},clearOperationHistory:(n,r,i)=>{delete t[n]?.[r]?.[i],e?.onHistoryChange?.(n)},clearPathHistory:(n,r)=>{delete t[n]?.[r],e?.onHistoryChange?.(n)},clearDocumentHistory:n=>{delete t[n],e?.onHistoryChange?.(n)},load:n=>{let r=aN(aan,n);$Q(t,r),Object.keys(r).forEach(t=>{e?.onHistoryChange?.(t)})},export:()=>uD(t)}}})),uan,dan=s((()=>{yF(),uan=e=>e.fetch?e.fetch:((t,n)=>fetch(_F(e.proxyUrl,t.toString()),n))})),l6,fan=s((()=>{zY(),B3(),l6=(e,t)=>{if(e&&typeof e==`object`&&`$ref`in e&&typeof e.$ref==`string`&&e.$ref.startsWith(`#`)){let n=z3(e.$ref.slice(1));return l6(RY(t.rootNode,n),t)}return e}})),pan,u6,man,han,gan,_an,van,yan,ban,xan=s((()=>{DN(),HE(),e$(),w1t(),fan(),pan=()=>({type:`lifecycle`,onResolveStart:e=>{e.$status=`loading`},onResolveError:e=>{e.$status=`error`},onResolveSuccess:e=>{delete e.$status}}),u6=()=>({type:`lifecycle`,onAfterNodeProcess:async(e,t)=>{let n=e.externalValue,r=t.resolutionCache;if(typeof n!=`string`)return;let i=t.loaders.find(e=>e.validate(n));if(!i)return;r.has(n)||r.set(n,i.exec(n));let a=await r.get(n);a?.ok&&(e.value=a.data)}}),man=()=>({type:`lifecycle`,onBeforeNodeProcess:async(e,t)=>{let{path:n,resolutionCache:r,parentNode:i}=t,a=e.$ref;if(typeof a!=`string`||!i||!n.length)return;let o=t.loaders.find(e=>e.validate(a));if(o&&n[0]===`info`){r.has(a)||r.set(a,o.exec(a));let e=await r.get(a);e?.ok&&(i[n.at(-1)]=e.data)}}}),han=()=>({type:`lifecycle`,onBeforeNodeProcess:(e,t)=>{let n=e.$ref,r=t.rootNode[`x-ext-urls`];typeof n!=`string`||typeof r!=`object`||!r||!_Gt(n)||(e.$ref=r[n.split(`/`).at(-1)??``]??n)}}),gan=()=>({type:`lifecycle`,onAfterNodeProcess:(e,t)=>{let{path:n}=t;if(n.length===3&&n[0]===`components`&&n[1]===`securitySchemes`){let n=l6(e,t);typeof n==`object`&&n&&`scheme`in n&&typeof n.scheme==`string`&&n.scheme.toLowerCase()!==n.scheme&&(n.scheme=n.scheme.toLowerCase())}}}),_an=()=>({type:`lifecycle`,onBeforeNodeProcess:(e,t)=>{let{path:n}=t;if(typeof e.$ref==`string`&&!(n[0]===`components`&&n[1]===`schemas`)){let t=new Set([`$ref`,`summary`,`description`,`$status`]);Object.keys(e).forEach(n=>{t.has(n)||delete e[n]})}}}),van=()=>({type:`lifecycle`,onBeforeNodeProcess:(e,t)=>{let{path:n}=t;if(n.length!==2||n[0]!==`paths`||typeof n[1]!=`string`)return;let r=n[1];for(let n of EN){let i=l6(e[n],t);if(!BE(i))continue;let a=e=>{let n=l6(e,t);return BE(n)&&`name`in n&&typeof n.name==`string`&&`in`in n&&typeof n.in==`string`},o=e=>{let n=l6(e,t);return a(n)&&n.in===`path`},s=(`parameters`in i&&Array.isArray(i.parameters)?i.parameters:[]).filter(a),c=new Set(s.map(e=>l6(e,t)).filter(o).map(e=>e.name)),l=(`parameters`in e&&Array.isArray(e.parameters)?e.parameters:[]).filter(e=>{let n=l6(e,t);if(!o(n))return!1;let r=!c.has(n.name);return r&&c.add(n.name),r}),u=W2(r,r,[...s,...l],e=>l6(e,t));u.length>0&&(i.parameters=u)}}}),yan=[`__scalar_`,`$status`],ban=()=>({type:`lifecycle`,onBeforeNodeProcess:e=>{if(BE(e))for(let t of yan)t in e&&delete e[t]}})})),San,Can=s((()=>{le(),cN(),ult(),yP(),dN(),_lt(),SP(),blt(),Clt(),Olt(),Mut(),jlt(),Jdt(),but(),mN(),_N(),Plt(),yN(),SN(),CP(),EP(),gdt(),Sdt(),MP(),kP(),kdt(),Zdt(),eft(),rft(),oft(),lft(),xft(),oP(),Uut(),Kut(),dP(),tdt(),idt(),TN(),Pft(),Hlt(),San=e=>{let t=T({name:E(x({typeComment:`The name of the contact.`})),url:E(x({typeComment:`The URI for the contact information. This MUST be in the form of a URI.`})),email:E(x({typeComment:`The email address of the contact person/organization. This MUST be in the form of an email address.`}))},{typeName:`ContactObject`}),n=T({name:E(x({typeComment:`REQUIRED. The license name used for the API.`})),identifier:E(x({typeComment:`An SPDX license expression for the API. The identifier field is mutually exclusive of the url field.`})),url:E(x({typeComment:`A URI for the license used for the API. This MUST be in the form of a URI. The url field is mutually exclusive of the identifier field.`}))},{typeName:`LicenseObject`}),r=ae([T({title:x({typeComment:`REQUIRED. The title of the API.`}),version:x({typeComment:`REQUIRED. The version of the OpenAPI Document (which is distinct from the OpenAPI Specification version or the version of the API being described or the version of the OpenAPI Description).`}),summary:E(x({typeComment:`A short summary of the API.`})),description:E(x({typeComment:`A description of the API. CommonMark syntax MAY be used for rich text representation.`})),termsOfService:E(x({typeComment:`A URI for the Terms of Service for the API. This MUST be in the form of a URI.`})),contact:E(t),license:E(n)},{typeName:`InfoObject`}),jut]),i=T({enum:E(ne(x(),{typeComment:`An enumeration of string values to be used if the substitution options are from a limited set. The array MUST NOT be empty.`})),default:E(x({typeComment:`The default value to use for substitution, which SHALL be sent if an alternate value is not supplied. If the enum is defined, the value MUST exist in the enum's values. Note that this behavior is different from the Schema Object's default keyword, which documents the receiver's behavior rather than inserting the value into the data.`})),description:E(x({typeComment:`An optional description for the server variable. CommonMark syntax MAY be used for rich text representation.`}))},{typeName:`ServerVariableObject`}),a=T({url:x({typeComment:`REQUIRED. A URL to the target host. This URL supports Server Variables and MAY be relative, to indicate that the host location is relative to the location where the document containing the Server Object is being served. Variable substitutions will be made when a variable is named in {braces}.`}),description:E(x({typeComment:`An optional string describing the host designated by the URL. CommonMark syntax MAY be used for rich text representation.`})),variables:E(re(x(),i,{typeComment:`A map between a variable name and its value. The value is used for substitution in the server's URL template.`}))},{typeName:`ServerObject`}),o=T({url:x({typeComment:`REQUIRED. The URI for the target documentation. This MUST be in the form of a URI.`}),description:E(x({typeComment:`A description of the target documentation. CommonMark syntax MAY be used for rich text representation.`}))},{typeName:`ExternalDocumentationObject`}),s=ae([T({name:x({typeComment:`REQUIRED. The name of the tag.`}),description:E(x({typeComment:`A description for the tag. CommonMark syntax MAY be used for rich text representation.`})),externalDocs:E(o)},{typeName:`TagObject`}),Nft,vP,xP,xN]),c=re(x(),ne(x()),{typeName:`SecurityRequirementObject`,typeComment:`Lists the required security schemes to execute this operation. An empty object ({}) indicates anonymous access is supported.`}),l=T({name:E(x({typeComment:`Replaces the name of the element/attribute used for the described schema property. When defined within items, it will affect the name of the individual XML elements within the list. When defined alongside type being "array" (outside the items), it will affect the wrapping element if and only if wrapped is true. If wrapped is false, it will be ignored.`})),namespace:E(x({typeComment:`The URI of the namespace definition. Value MUST be in the form of a non-relative URI.`})),prefix:E(x({typeComment:`The prefix to be used for the name.`})),attribute:E(S({typeComment:`Declares whether the property definition translates to an attribute instead of an element. Default value is false.`})),wrapped:E(S({typeComment:`MAY be used only for an array definition. Signifies whether the array is wrapped (for example, <books><book/><book/></books>) or unwrapped (<book/><book/>). Default value is false. The definition takes effect only when defined alongside type being "array" (outside the items).`}))},{typeName:`XMLObject`}),u=T({propertyName:x({typeComment:`REQUIRED. The name of the property in the payload that will hold the discriminating value. This property SHOULD be required in the payload schema, as the behavior when the property is absent is undefined.`}),mapping:E(re(x(),x(),{typeComment:`An object to hold mappings between payload values and schema names or URI references.`}))},{typeName:`DiscriminatorObject`}),d=[xP,vP,cft,aft,$dt,nft,Xdt,qdt],f=T({name:E(x({typeComment:`Schema name (extension).`})),title:E(x({typeComment:`A title for the schema.`})),description:E(x({typeComment:`A description of the schema.`})),default:E(w({typeComment:`Default value for the schema.`})),enum:E(ne(w(),{typeComment:`Array of allowed values.`,typeName:`JsonSchemaEnum`})),const:E(w({typeComment:`Constant value that must match exactly.`})),contentMediaType:E(x({typeComment:`Media type for content validation.`})),contentEncoding:E(x({typeComment:`Content encoding.`})),contentSchema:E(e(oe(()=>C))),deprecated:E(S({typeComment:`Whether the schema is deprecated.`})),discriminator:E(u),readOnly:E(S({typeComment:`Whether the schema is read-only.`})),writeOnly:E(S({typeComment:`Whether the schema is write-only.`})),xml:E(l),externalDocs:E(o),example:E(w({typeComment:`A free-form field to include an example of an instance for this schema. Deprecated in favor of the JSON Schema examples keyword.`})),examples:E(ne(w(),{typeComment:`An array of examples of valid instances for this schema. This keyword follows the JSON Schema Draft 2020-12 specification.`,typeName:`SchemaExamplesArray`})),allOf:E(ne(e(oe(()=>C)),{typeName:`SchemaObjectAllOf`})),oneOf:E(ne(e(oe(()=>C)),{typeName:`SchemaObjectOneOf`})),anyOf:E(ne(e(oe(()=>C)),{typeName:`SchemaObjectAnyOf`})),not:E(e(oe(()=>C)))}),p=T({__scalar_:x({typeComment:`Internal marker for schema object disambiguation.`})}),m=T({type:ie([D(`number`),D(`integer`)]),format:E(x({typeComment:`Different subtypes.`})),multipleOf:E(b({typeComment:`Number must be a multiple of this value.`})),maximum:E(b({typeComment:`Maximum value (inclusive).`})),exclusiveMaximum:E(b({typeComment:`Maximum value (exclusive).`})),minimum:E(b({typeComment:`Minimum value (inclusive).`})),exclusiveMinimum:E(b({typeComment:`Minimum value (exclusive).`}))},{typeName:`NumberSchemaObject`}),h=T({type:D(`string`),format:E(x({typeComment:`Different subtypes.`})),maxLength:E(b({typeComment:`Maximum string length.`})),minLength:E(b({typeComment:`Minimum string length.`})),pattern:E(x({typeComment:`Regular expression pattern.`}))},{typeName:`StringSchemaObject`}),g=T({type:D(`object`),maxProperties:E(b({typeComment:`Maximum number of properties.`})),minProperties:E(b({typeComment:`Minimum number of properties.`})),properties:E(re(x(),e(oe(()=>C)),{typeName:`SchemaObjectProperties`})),required:E(ne(x(),{typeName:`SchemaObjectRequired`})),additionalProperties:E(ie([S(),e(oe(()=>C))],{typeName:`SchemaObjectAdditionalProperties`})),patternProperties:E(re(x(),e(oe(()=>C)),{typeName:`SchemaObjectPatternProperties`})),propertyNames:E(e(oe(()=>C)))},{typeName:`ObjectSchemaObject`}),_=T({type:D(`array`),maxItems:E(b({typeComment:`Maximum number of items in array.`})),minItems:E(b({typeComment:`Minimum number of items in array.`})),uniqueItems:E(S({typeComment:`Whether array items must be unique.`})),items:E(e(oe(()=>C))),prefixItems:E(ne(e(oe(()=>C)),{typeComment:`Schema for tuple validation.`}))},{typeName:`ArraySchemaObject`}),v=ie([D(`null`),D(`boolean`),D(`string`),D(`number`),D(`integer`),D(`object`),D(`array`)],{typeName:`SchemaObjectMultiTypeKeywords`}),y=T({type:ie([D(`null`),D(`boolean`),ne(v)],{typeName:`SchemaObjectOtherTypeKeyword`})},{typeName:`MultiTypeSchemaObject`}),C=ae([f,...d,ie([p,y,m,h,g,_])],{typeName:`SchemaObject`}),ee=T({description:E(x({typeComment:`A description for security scheme. CommonMark syntax MAY be used for rich text representation.`}))}),te=T({...ee.properties,type:D(`apiKey`),name:x({typeComment:`REQUIRED. The name of the header, query or cookie parameter to be used.`}),in:ie([D(`query`),D(`header`),D(`cookie`)],{typeComment:`REQUIRED. The location of the API key. Valid values are "query", "header", or "cookie".`})},{typeName:`ApiKeySecuritySchemeObject`}),se=T({...ee.properties,type:D(`http`),scheme:ie([D(`basic`),D(`bearer`)],{typeName:`HttpSecuritySchemeScheme`,typeComment:`REQUIRED. The name of the HTTP Authentication scheme to be used in the Authorization header as defined in RFC7235.`}),bearerFormat:E(x({typeComment:`A hint to the client to identify how the bearer token is formatted. Bearer tokens are usually generated by an authorization server, so this information is primarily for documentation purposes.`}))},{typeName:`HttpSecuritySchemeObject`}),ce=[Gut,Hut,edt,Yut,Zut],le=T({refreshUrl:x({typeComment:`The URL to be used for obtaining refresh tokens. This MUST be in the form of a URL. The OAuth2 standard requires the use of TLS.`}),scopes:re(x(),x(),{typeComment:`REQUIRED. The available scopes for the OAuth2 security scheme. A map between the scope name and a short description for it. The map MAY be empty.`,typeName:`OAuthFlowScopes`})},{typeName:`OAuthFlowBaseCore`}),ue=ae([le,...ce,T({authorizationUrl:x({typeComment:`REQUIRED. The authorization URL to be used for this flow. This MUST be in the form of a URL. The OAuth2 standard requires the use of TLS.`})},{typeName:`ImplicitOAuthFlowObject`})]),de=ae([le,...ce,T({tokenUrl:x({typeComment:`REQUIRED. The token URL to be used for this flow. This MUST be in the form of a URL. The OAuth2 standard requires the use of TLS.`})},{typeName:`PasswordOAuthFlowObject`}),aP]),fe=ae([le,...ce,T({tokenUrl:x({typeComment:`REQUIRED. The token URL to be used for this flow. This MUST be in the form of a URL. The OAuth2 standard requires the use of TLS.`})},{typeName:`ClientCredentialsOAuthFlowObject`}),aP]),pe=ae([le,...ce,T({authorizationUrl:x({typeComment:`REQUIRED. The authorization URL to be used for this flow. This MUST be in the form of a URL. The OAuth2 standard requires the use of TLS.`}),tokenUrl:x({typeComment:`REQUIRED. The token URL to be used for this flow. This MUST be in the form of a URL. The OAuth2 standard requires the use of TLS.`})},{typeName:`AuthorizationCodeOAuthFlowObject`}),rdt,aP]),me=T({implicit:E(ue),password:E(de),clientCredentials:E(fe),authorizationCode:E(pe)},{typeName:`OAuthFlowsObject`}),he=ie([te,se,ae([T({...ee.properties,type:D(`oauth2`),flows:me},{typeName:`OAuth2SecuritySchemeObject`}),bft]),T({...ee.properties,type:D(`openIdConnect`),openIdConnectUrl:x({typeComment:`REQUIRED. Well-known URL to discover the [[OpenID-Connect-Discovery]] provider metadata.`})},{typeName:`OpenIdConnectSecuritySchemeObject`})],{typeName:`SecuritySchemeObject`}),ge=T({schemas:E(re(x(),e(C),{typeName:`ComponentsSchemas`})),responses:E(re(x(),e(oe(()=>Te)),{typeName:`ComponentsResponses`})),parameters:E(re(x(),e(oe(()=>Se)),{typeName:`ComponentsParameters`})),examples:E(re(x(),e(oe(()=>_e)),{typeName:`ComponentsExamples`})),requestBodies:E(re(x(),e(oe(()=>Ce)),{typeName:`ComponentsRequestBodies`})),headers:E(re(x(),e(oe(()=>ye)),{typeName:`ComponentsHeaders`})),securitySchemes:E(re(x(),e(oe(()=>he)),{typeName:`ComponentsSecuritySchemes`})),links:E(re(x(),e(oe(()=>we)),{typeName:`ComponentsLinks`})),callbacks:E(re(x(),e(oe(()=>De)),{typeName:`ComponentsCallbacks`})),pathItems:E(re(x(),oe(()=>ke),{typeName:`ComponentsPathItems`}))},{typeName:`ComponentsObject`}),_e=ae([T({summary:E(x({typeComment:`Short description for the example.`})),description:E(x({typeComment:`Long description for the example. CommonMark syntax MAY be used for rich text representation.`})),value:E(w({typeComment:`Embedded literal example. The value field and externalValue field are mutually exclusive.`})),externalValue:E(x({typeComment:`A URI that identifies the literal example. The value field and externalValue field are mutually exclusive.`}))},{typeName:`ExampleObject`}),yut]),ve=T({description:E(x({typeComment:`A brief description of the header. This could contain examples of use. CommonMark syntax MAY be used for rich text representation.`})),required:E(S({typeComment:`Determines whether this header is mandatory. The default value is false.`})),deprecated:E(S({typeComment:`Specifies that the header is deprecated and SHOULD be transitioned out of usage. Default value is false.`}))},{typeName:`HeaderBase`}),ye=ie([ae([ve,T({style:E(x({typeComment:`Describes how the header value will be serialized. The default (and only legal value for headers) is "simple".`})),explode:E(S({typeComment:`When this is true, header values of type array or object generate a single header whose value is a comma-separated list of the array items or key-value pairs of the map, see Style Examples.`})),schema:E(e(oe(()=>C))),example:E(w()),examples:E(re(x(),e(oe(()=>_e)),{typeName:`HeaderExamples`}))},{typeName:`HeaderObjectWithSchema`})]),ae([ve,T({content:E(re(x(),oe(()=>xe),{typeName:`HeaderContent`}))},{typeName:`HeaderObjectWithContent`})])],{typeName:`HeaderObject`}),be=T({contentType:E(x({typeComment:`The Content-Type for encoding a specific property. The value is a comma-separated list, each element of which is either a specific media type (e.g. image/png) or a wildcard media type (e.g. image/*).`})),headers:E(re(x(),e(oe(()=>ye)),{typeName:`EncodingHeaders`}))},{typeName:`EncodingObject`}),xe=T({schema:E(e(oe(()=>C))),example:E(w({typeComment:`Example of the media type.`})),examples:E(re(x(),e(oe(()=>_e)),{typeName:`MediaTypeExamples`})),encoding:E(re(x(),be,{typeComment:`A map between a property name and its encoding information. The key, being the property name, MUST exist in the schema as a property.`,typeName:`MediaTypeEncoding`}))},{typeName:`MediaTypeObject`}),Se=ie([ae([T({name:x({typeComment:`REQUIRED. The name of the parameter. Parameter names are case sensitive. If in is "path", the name field MUST correspond to a template expression occurring within the path field in the Paths Object.`}),in:ie([D(`query`),D(`header`),D(`path`),D(`cookie`)],{typeName:`ParameterLocation`,typeComment:`REQUIRED. The location of the parameter. Possible values are "query", "header", "path" or "cookie".`}),description:E(x({typeComment:`A brief description of the parameter. This could contain examples of use. CommonMark syntax MAY be used for rich text representation.`})),required:E(S({typeComment:`Determines whether this parameter is mandatory. If the parameter location is "path", this field is REQUIRED and its value MUST be true.`})),deprecated:E(S({typeComment:`Specifies that a parameter is deprecated and SHOULD be transitioned out of usage. Default value is false.`})),allowEmptyValue:E(S({typeComment:`If true, clients MAY pass a zero-length string value in place of parameters that would otherwise be omitted entirely. This field is valid only for query parameters.`})),allowReserved:E(S({typeComment:`When this is true, parameter values are serialized using reserved expansion, as defined by RFC6570. This field only applies to parameters with an in value of query. The default value is false.`})),style:E(x({typeComment:`Describes how the parameter value will be serialized (depending on the schema type).`})),explode:E(S({typeComment:`When this is true, parameter values of type array or object generate separate parameters for each array item or object property.`})),schema:E(e(oe(()=>C))),example:E(w()),examples:E(re(x(),e(oe(()=>_e)),{typeName:`ParameterExamples`}))},{typeName:`ParameterObjectWithSchema`}),AP,vP,xP]),ae([T({name:x({typeComment:`REQUIRED. The name of the parameter. Parameter names are case sensitive. If in is "path", the name field MUST correspond to a template expression occurring within the path field in the Paths Object.`}),in:ie([D(`query`),D(`header`),D(`path`),D(`cookie`)],{typeName:`ParameterLocation`,typeComment:`REQUIRED. The location of the parameter. Possible values are "query", "header", "path" or "cookie".`}),description:E(x({typeComment:`A brief description of the parameter. This could contain examples of use. CommonMark syntax MAY be used for rich text representation.`})),required:E(S({typeComment:`Determines whether this parameter is mandatory. If the parameter location is "path", this field is REQUIRED and its value MUST be true.`})),deprecated:E(S({typeComment:`Specifies that a parameter is deprecated and SHOULD be transitioned out of usage. Default value is false.`})),allowEmptyValue:E(S({typeComment:`If true, clients MAY pass a zero-length string value in place of parameters that would otherwise be omitted entirely. This field is valid only for query parameters.`})),allowReserved:E(S({typeComment:`When this is true, parameter values are serialized using reserved expansion, as defined by RFC6570. This field only applies to parameters with an in value of query. The default value is false.`})),content:E(re(x(),oe(()=>xe),{typeName:`ParameterContent`}))},{typeName:`ParameterObjectWithContent`}),AP,vP,xP])],{typeName:`ParameterObject`}),Ce=ae([T({description:E(x({typeComment:`A brief description of the request body. This could contain examples of use. CommonMark syntax MAY be used for rich text representation.`})),content:re(x(),oe(()=>xe),{typeComment:`REQUIRED. The content of the request body. The key is a media type or media type range and the value describes it.`,typeName:`RequestBodyContent`}),required:E(S({typeComment:`Determines if the request body is required in the request. Defaults to false.`}))},{typeName:`RequestBodyObject`}),zdt]),we=T({operationRef:E(x({typeComment:`A URI reference to an OAS operation. This field is mutually exclusive of the operationId field, and MUST point to an Operation Object.`})),operationId:E(x({typeComment:`The name of an existing, resolvable OAS operation, as defined with a unique operationId. This field is mutually exclusive of the operationRef field.`})),parameters:E(re(x(),w(),{typeComment:`A map representing parameters to pass to an operation as specified with operationId or identified via operationRef.`,typeName:`LinkParameters`})),requestBody:E(w({typeComment:`A literal value or {expression} to use as a request body when calling the target operation.`})),description:E(x({typeComment:`A description of the link. CommonMark syntax MAY be used for rich text representation.`})),server:E(a)},{typeName:`LinkObject`}),Te=T({description:x({typeComment:`REQUIRED. A description of the response. CommonMark syntax MAY be used for rich text representation.`}),headers:E(re(x(),e(oe(()=>ye)),{typeName:`ResponseHeaders`})),content:E(re(x(),oe(()=>xe),{typeName:`ResponseContent`})),links:E(re(x(),e(oe(()=>we)),{typeName:`ResponseLinks`}))},{typeName:`ResponseObject`}),Ee=re(x(),e(oe(()=>Te)),{typeName:`ResponsesObject`}),De=re(x(),e(oe(()=>ke)),{typeName:`CallbackObject`}),Oe=ae([T({tags:E(ne(x(),{typeComment:`A list of tags for API documentation control. Tags can be used for logical grouping of operations by resources or any other qualifier.`,typeName:`OperationTags`})),summary:E(x({typeComment:`A short summary of what the operation does.`})),description:E(x({typeComment:`A verbose explanation of the operation behavior. CommonMark syntax MAY be used for rich text representation.`})),externalDocs:E(o),operationId:E(x({typeComment:`Unique string used to identify the operation. The id MUST be unique among all operations described in the API. The operationId value is case-sensitive.`})),parameters:E(ne(e(oe(()=>Se)),{typeName:`OperationParameters`})),requestBody:E(e(oe(()=>Ce))),responses:E(oe(()=>Ee)),deprecated:E(S({typeComment:`Declares this operation to be deprecated. Consumers SHOULD refrain from usage of the declared operation. Default value is false.`})),security:E(ne(c,{typeName:`OperationSecurity`})),servers:E(ne(a,{typeName:`OperationServers`})),callbacks:E(re(x(),e(oe(()=>De)),{typeName:`OperationCallbacks`}))},{typeName:`OperationObject`}),ddt,vP,xP,pdt,Tdt,xdt,pN,gN,hdt,wN]),ke=T({$ref:E(x({typeComment:`Allows for a referenced definition of this path item. The value MUST be in the form of a URI, and the referenced structure MUST be in the form of a Path Item Object.`})),summary:E(x({typeComment:`An optional string summary, intended to apply to all operations in this path.`})),description:E(x({typeComment:`An optional string description, intended to apply to all operations in this path. CommonMark syntax MAY be used for rich text representation.`})),get:E(e(oe(()=>Oe))),put:E(e(oe(()=>Oe))),post:E(e(oe(()=>Oe))),delete:E(e(oe(()=>Oe))),patch:E(e(oe(()=>Oe))),connect:E(e(oe(()=>Oe))),options:E(e(oe(()=>Oe))),head:E(e(oe(()=>Oe))),trace:E(e(oe(()=>Oe))),servers:E(ne(a,{typeName:`PathItemServers`})),parameters:E(ne(e(oe(()=>Se)),{typeName:`PathItemParameters`}))},{typeName:`PathItemObject`}),Ae=T({"x-original-oas-version":E(x({typeComment:`Original OpenAPI Specification version of the source document.`})),[sN.document.navigation]:E(w({typeComment:`Client navigation tree (TraversedDocument) for this OpenAPI description. Matches TraversedDocumentObjectRef in strict schemas.`}))},{typeName:`OpenApiExtensionsPartial`});return ae([T({openapi:x({typeComment:`REQUIRED. This string MUST be the version number of the OpenAPI Specification that the OpenAPI Document uses. The openapi field SHOULD be used by tooling to interpret the OpenAPI Document. This is not related to the API info.version string.`}),info:r,jsonSchemaDialect:E(x({typeComment:`The default value for the $schema keyword within Schema Objects contained within this OAS document. This MUST be in the form of a URI.`})),servers:E(ne(a,{typeComment:`An array of Server Objects, which provide connectivity information to a target server. If the servers field is not provided, or is an empty array, the default value would be a Server Object with a url value of /.`,typeName:`OpenApiServers`})),paths:E(re(x(),ke,{typeComment:`The available paths and operations for the API.`,typeName:`PathsObject`})),webhooks:E(re(x(),ke,{typeComment:`The incoming webhooks that MAY be received as part of this API and that the API consumer MAY choose to implement.`,typeName:`WebhooksObject`})),components:E(ge),security:E(ne(c,{typeComment:`A declaration of which security mechanisms can be used across the API. The list of values includes alternative Security Requirement Objects that can be used. Only one of the Security Requirement Objects need to be satisfied to authorize a request.`,typeName:`OpenApiSecurity`})),tags:E(ne(s,{typeComment:`A list of tags used by the OpenAPI Description with additional metadata. The order of the tags can be used to reflect on their order by the parsing tools.`})),externalDocs:E(o)},{typeName:`OpenApiDocumentCore`}),Ae,llt,Vlt,mlt,wN,glt,xN,Llt,Slt,ylt,Nlt,Alt,Dlt,gN,pN],{typeName:`OpenApiDocument`,typeComment:`Root OpenAPI 3.1 document including Scalar workspace extensions (OpenApiExtensionsSchema).`})}})),wan,Tan,d6,Ean,Dan=s((()=>{HE(),le(),wan=T({$status:E(ie([D(`loading`),D(`error`)]),{typeComment:`Indicates the current status of the reference resolution. Can be either 'loading' while fetching the reference or 'error' if the resolution failed.`}),$global:E(S({typeComment:`Indicates whether this reference should be resolved globally across all documents, rather than just within the current document context.`}))},{typeName:`ReferenceObjectExtensions`}),Tan=T({$ref:x({typeComment:`REQUIRED. The reference identifier. This MUST be in the form of a URI.`}),summary:E(x({typeComment:`A short summary which by default SHOULD override that of the referenced component. If the referenced object-type does not allow a summary field, then this field has no effect.`})),description:E(x({typeComment:`A description which by default SHOULD override that of the referenced component. CommonMark syntax MAY be used for rich text representation. If the referenced object-type does not allow a description field, then this field has no effect.`}))},{typeName:`ReferenceObject`}),d6=e=>BE(e)&&`$ref`in e?d6(e[`$ref-value`]):e,Ean=e=>ie([e,ae([Tan,T({"$ref-value":se(d6,e)}),wan])])}));function Oan(e){if(`url`in e)return q3({fetch:e.fetch}).exec(e.url);if(`path`in e){let t=e.fileLoader;return t?t.exec(e.path):(console.error(`No loader provided for loading files`),Promise.resolve({ok:!1}))}return Promise.resolve({ok:!0,data:e.document,raw:JSON.stringify(e.document)})}var f6,kan,p6,Aan,m6,jan=s((()=>{zY(),HE(),PY(),KY(),drn(),Zrn(),uin(),bin(),rD(),ean(),slt(),le(),W(),m2(),t$(),lan(),VI(),W4e(),e$(),dan(),UI(),q4e(),dD(),m4(),xan(),cN(),OI(),Can(),Dan(),VP(),i2t(),f6=e=>{if(`url`in e)return e.url;if(`path`in e)return e.path},kan=San(Ean),p6=new Set([`x-scalar-is-dirty`,`x-scalar-registry-meta`]),Aan=e=>{let t=BI(e);for(let e of[`x-ext`,`x-ext-urls`,`x-scalar-navigation`,`x-scalar-is-dirty`,`x-original-oas-version`,`x-scalar-original-document-hash`,`x-scalar-original-source-url`,`x-scalar-registry-meta`])delete t[e];return t},m6=e=>{let{verbose:t=!1}=e??{},n=(e,n)=>t?lrn(e,n):n(),r=(e,n)=>t?urn(e,n):n(),i={},a=t=>{e?.plugins?.forEach(e=>e.hooks?.onWorkspaceStateChanges?.(t))},o=fn(oD({...e?.meta,documents:{},get activeDocument(){return o.documents[f()]}},{hooks:{onAfterChange(e){let t=e[0];if(t===`documents`){if(e.length<2){console.log(`[WARN]: Overriding entire documents object is not supported`);return}let t=e[1],n=o.documents[t]??{openapi:`3.1.0`,info:{title:``,version:``},"x-scalar-original-document-hash":``},r={type:`documents`,documentName:t,value:uD(n),path:e.slice(2)};r.path.length>0&&!p6.has(r.path[0])&&(n[`x-scalar-is-dirty`]=!0),a(r);return}if(t===`activeDocument`){let t=f(),n=o.documents[t]??{openapi:`3.1.0`,info:{title:``,version:``},"x-scalar-original-document-hash":``},r={type:`documents`,documentName:t,value:uD(n),path:e.slice(2)};r.path.length>0&&!p6.has(r.path[0])&&(n[`x-scalar-is-dirty`]=!0),a(r);return}let{activeDocument:n,documents:r,...i}=o;a({type:`meta`,value:uD(i,{depth:1})})}}})),{originalDocuments:s,intermediateDocuments:c,overrides:l}=oD({originalDocuments:{},intermediateDocuments:{},overrides:{}},{hooks:{onAfterChange(e){let t=e[0];if(!t||e.length<2)return;let n=e[1];t===`originalDocuments`&&a({type:t,documentName:n,value:uD(s[n]??{}),path:e.splice(2)}),t===`intermediateDocuments`&&a({type:t,documentName:n,value:uD(c[n]??{}),path:e.splice(2)}),t===`overrides`&&a({type:t,documentName:n,value:uD(l[n]??{})})}}}),u=can({hooks:{onHistoryChange:e=>{a({type:`history`,documentName:e,value:u.export()[e]??{}})}}}),d=vGt({hooks:{onAuthChange:e=>{a({type:`auth`,documentName:e,value:d.export()[e]??{secrets:{},selected:{document:{selectedIndex:0,selectedSchemes:[]},path:{}}}})}}});function f(){return o[sN.workspace.activeDocument]??Object.keys(o.documents)[0]??``}function p(e,t,n){let r=s[e];if(r)return t===`json`?n?JSON.stringify(r):JSON.stringify(r,null,2):p2.stringify(r)}let m=async e=>{let t=o.documents[e],n=await x(e);return!t||!n?(console.warn(`Failed to save document, active document is missing`),!1):(s[e]=n,c[e]=BI(n),t[`x-scalar-is-dirty`]=!1,!0)};async function h(t,a){let{name:u}=t,d=BI(t.meta),f=n(`deepClone`,()=>BI(t.document));if(n(`initialize`,()=>{t.initialize!==!1&&(s[u]=BI(f),c[u]=BI(f),l[u]=t.overrides??{},i[u]={fetch:t.fetch})}),DI(f)){let e={...f,...d,"x-original-aas-version":f.asyncapi,"x-scalar-original-document-hash":t.documentHash,"x-scalar-original-source-url":t.documentSource};o.documents[u]=lD(tD(e),{overrides:uD(l[u])});return}let p=tD({...n(`upgrade`,()=>Qin(BI(f),`3.1`)),...d,"x-original-oas-version":s[u]?.openapi??s[u]?.swagger,"x-scalar-original-document-hash":t.documentHash,"x-scalar-original-source-url":t.documentSource},{showInternal:!0});if(p[sN.document.navigation]===void 0){let a=[q3({fetch:i[u]?.fetch??e?.fetch})];e?.fileLoader&&a.push(e.fileLoader),await r(`bundle`,async()=>await W3(XE(p),{treeShake:!1,plugins:[...a,_an(),u6(),man(),gan(),van()],urlMap:!0,origin:t.documentSource}));let o=n(`coerceValue`,()=>v(kan,BI(p)));n(`mergeObjects`,()=>HI(p,o))}if(!wM(zP,p)){let e=Array.from(yat(zP,p));console.warn(`document validation errors: `),console.warn(e.map(e=>({message:e.message,path:e.path,schema:e.schema,value:e.value})))}if(p[sN.document.navigation]===void 0){let e=p4(u,p,a);p[sN.document.navigation]=e}o.documents[u]=lD(tD(XE(p)),{overrides:uD(l[u])})}async function g(t,n){let{name:i,meta:a}=t,s=uan({fetch:t.fetch??e?.fetch,proxyUrl:o[`x-scalar-active-proxy`]??void 0}),c=await r(`loadDocument`,async()=>await Oan({...t,fetch:s,fileLoader:e?.fileLoader}));return await r(`addDocument`,async()=>c.ok?BE(c.data)?(await h({...t,document:c.data,documentSource:f6(t),documentHash:GY(c.raw)},n),!0):(console.error(`Failed to load document '${i}': response data is not a valid object`),o.documents[i]={...a,openapi:`3.1.0`,info:{title:`Document '${i}' could not be loaded`,version:`unknown`},"x-scalar-original-document-hash":`not-a-hash`},!1):(console.error(`Failed to fetch document '${i}': request was not successful`),o.documents[i]={...a,openapi:`3.1.0`,info:{title:`Document '${i}' could not be loaded`,version:`unknown`},"x-scalar-original-document-hash":`not-a-hash`},!1))}let _=e=>uD(s[e],{depth:1})||null,y=e=>uD(c[e],{depth:1})||null,b=e=>!!c[e],x=async e=>{let t=uD(o.documents[e],{depth:1});return t?Aan(await W3(BI(t),{plugins:[han(),ban()],treeShake:!1,urlMap:!0})):null},S=e=>{let t=o.documents[e];if(!t)return console.error(`Document '${e}' does not exist in the workspace.`),!1;if(!EI(t))return!1;let n=p4(e,t);return t[sN.document.navigation]=n,!0},C=new Set;return{get workspace(){return o},get history(){return u},get auth(){return d},update(e,t){NY(e),Object.assign(o,{[e]:t})},getEditableDocument:x,getOriginalDocument:_,getIntermediateDocument:y,updateDocument(e,t,n){let r=o.documents[e===`active`?f():e];return r?(NY(t),Object.assign(r,{[t]:n}),!0):!1},async replaceDocument(e,t){let n=uD(o.documents[e],{depth:1});if(!n)return console.error(`Document '${e}' does not exist in the workspace.`);await h({name:e,document:t,documentSource:n[`x-scalar-original-source-url`],documentHash:n[`x-scalar-original-document-hash`],meta:{"x-scalar-registry-meta":n[`x-scalar-registry-meta`],"x-scalar-is-dirty":!0,"x-scalar-navigation":void 0},initialize:!1})},resolve:e=>{let t=o.activeDocument,n=RY(t,e);return BE(n)?W3(n,{root:t,treeShake:!1,plugins:[q3(),pan(),u6()],urlMap:!0,visitedNodes:C}):(console.error(`Invalid path provided for resolution. Path: [${e.join(`, `)}]. Found value of type: ${typeof n}. Expected an object.`),Promise.resolve())},addDocument:g,deleteDocument:e=>{if(!o.documents[e])return;delete o.documents[e],delete s[e],delete c[e],delete l[e],delete i[e],u.clearDocumentHistory(e),d.clearDocumentAuth(e);let t=Object.keys(o.documents);o[`x-scalar-active-document`]===e&&(o[`x-scalar-active-document`]=t[0]??void 0),a({type:`deleteDocument`,documentName:e})},exportDocument:p,exportActiveDocument:(e,t)=>p(f(),e,t),buildSidebar:S,saveDocument:m,promoteIntermediateToOriginal:b,async revertDocumentChanges(e){let t=uD(o.documents[e],{depth:1}),n=uD(s[e],{depth:1});!t||!n||(c[e]=BI(n),await h({name:e,document:n,documentSource:t[`x-scalar-original-source-url`],documentHash:t[`x-scalar-original-document-hash`],initialize:!1,meta:{"x-scalar-registry-meta":t[`x-scalar-registry-meta`]}}))},commitDocument(e){console.warn(`Commit operation for document '${e}' is not implemented yet.`)},exportWorkspace(){let{activeDocument:e,documents:t,...n}=uD(o);return{documents:{...Object.fromEntries(Object.entries(t).map(([e,t])=>[e,uD(t)]))},meta:uD(n)??{},originalDocuments:uD(s),intermediateDocuments:uD(c),overrides:uD(l),history:u.export(),auth:d.export()}},loadWorkspace(e){$Q(o.documents,Object.fromEntries(Object.entries(e.documents).map(([t,n])=>[t,lD(tD(n),{overrides:e.overrides[t]})]))),$Q(s,e.originalDocuments),$Q(c,e.intermediateDocuments),$Q(l,e.overrides),$Q(o,e.meta),u.load(e.history),d.load(e.auth)},importWorkspaceFromSpecification:e=>{let{documents:t,overrides:n,info:r,workspace:i,...a}=e;return $Q(o,a),Promise.all(Object.entries(t??{}).map(([e,t])=>g({url:t.$ref,name:e,overrides:n?.[e]})))},rebaseDocument:async t=>{let{name:n}=t,a=uD(s[n],{depth:1}),u=uD(o.documents[n],{depth:1}),d=await x(n);if(!a||!d||!u)return{ok:!1,type:`CORRUPTED_STATE`,message:`Cannot rebase document '${n}': missing original or active document state`};let f=await r(`loadDocument`,async()=>await Oan({...t,fetch:t.fetch??e?.fetch,fileLoader:e?.fileLoader}));if(!f.ok||!BE(f.data))return{ok:!1,type:`FETCH_FAILED`,message:`Failed to fetch document '${n}': request was not successful or returned invalid data`};let p=GY(f.raw);if(u[`x-scalar-original-document-hash`]===p)return{ok:!1,type:`NO_CHANGES_DETECTED`,message:`No changes detected for document '${n}': document hash matches the active document`};let m=f.data;l[n]=t.overrides??{},i[n]={fetch:t.fetch};let g=Y3(a,m);if(g.length===0)return{ok:!1,type:`NO_CHANGES_DETECTED`,message:`No changes detected for document '${n}' after fetching the latest version.`};let _=vin(g,Y3(a,d));return{ok:!0,conflicts:_.conflicts,changes:_.diffs,applyChanges:async e=>{let r=(()=>{if(`resolvedConflicts`in e){let t=_.diffs.concat(e.resolvedConflicts);return din(BI(a),t)}return e.resolvedDocument})(),i=Y3(m,r).length>0;s[n]=r,c[n]=BI(r),await h({...t,document:{...r,[sN.document.navigation]:void 0},documentSource:f6(t),documentHash:GY(f.raw),initialize:!1,meta:{...t.meta,"x-scalar-registry-meta":u[`x-scalar-registry-meta`],"x-scalar-is-dirty":i}})}}}}}}));jan();var Man={Date:!0,RegExp:!0,String:!0,Number:!0};function Nan(e,t,n={cyclesFix:!0},r=[]){let i=[],a=Array.isArray(e);for(let o in e){let s=e[o],c=a?+o:o;if(!(o in t)){i.push({type:`REMOVE`,path:[c],oldValue:e[o]});continue}let l=t[o],u=typeof s==`object`&&typeof l==`object`&&Array.isArray(s)===Array.isArray(l);s&&l&&u&&!Man[Object.getPrototypeOf(s)?.constructor?.name]&&(!n.cyclesFix||!r.includes(s))?i.push.apply(i,Nan(s,l,n,n.cyclesFix?r.concat([s]):[]).map(e=>(e.path.unshift(c),e))):s!==l&&!(Number.isNaN(s)&&Number.isNaN(l))&&!(u&&(isNaN(s)?s+``==l+``:+s==+l))&&i.push({path:[c],type:`CHANGE`,value:l,oldValue:s})}let o=Array.isArray(t);for(let n in t)n in e||i.push({type:`CREATE`,path:[o?+n:n],value:t[n]});return i}gF(),W();var Pan=Symbol(),Fan=A(null);function Ian(e){let t=A(!1),n=A(``),r={showAgent:t,agentEnabled:e.agentEnabled??U(()=>hF(window.location.href)),prefilledMessage:n,openAgent:e=>{n.value=e??``,t.value=!0},closeAgent:()=>{t.value=!1,n.value=``},toggleAgent:()=>{t.value=!t.value,t.value||(n.value=``)}};return Fan.value=r,r}function h6(){let e=fr(Pan,void 0);return U(()=>e??Fan.value??void 0)}W(),Ou();var Lan=N({__name:`AgentScalarButton`,setup(e){let t=h6();return(e,n)=>(F(),I(`button`,{class:`bg-sidebar-b-search text-sidebar-c-2 hover:text-sidebar-c-1 flex items-center gap-1.5 rounded border px-2 text-base whitespace-nowrap`,type:`button`,onClick:n[0]||=e=>j(t)?.toggleAgent()},[H(j(Su)),n[1]||=z(` Ask AI `,-1)]))}});function g6(e,t){return{code:e,detail:t}}var _6=s((()=>{})),v6,Ran=s((()=>{le(),v6=T({id:x(),title:x(),namespace:x(),currentVersion:x(),logoUrl:ie([x(),C()]),slug:x()})}));function zan(e,t){let n=e=>({success:!1,error:t?.(e)??null});return(...t)=>{try{let r=e(...t);return r instanceof Promise?r.catch(n):r}catch(e){return n(e)}}}function Ban(e,t){let n=e=>({success:!1,error:t?.(e)??null}),r=e=>({success:!0,data:e});try{let t=e();return t instanceof Promise?t.then(r).catch(n):r(t)}catch(e){return n(e)}}function Van(e){let t=!0,n=[],r=[];for(let i of e)i.success?r.push(i.data):(t=!1,n.push(i.error));return t?{success:!0,data:r}:{success:!1,error:n}}var y6,b6=s((()=>{y6={safeFn:zan,fromUnsafe:Ban,resultsToResult:Van}}));function Han({getAccessToken:e,getAgentKey:t}){let n=e?.(),r=t?.();return{...n&&{Authorization:`Bearer ${n}`},...r&&{"x-scalar-agent-key":r}}}function Uan({baseUrl:e,getAccessToken:t,getAgentKey:n}){let r=T({message:x(),code:x()}),i=y6.safeFn(async({path:i,method:a=`get`,query:o,body:s,responseSchema:c})=>{let l=`${e}${i}${o?`?${new URLSearchParams(o)}`:``}`,u=await y6.fromUnsafe(async()=>fetch(l,{method:a,...s&&{body:JSON.stringify(s)},headers:{...Han({getAccessToken:t,getAgentKey:n})}}),e=>g6(`FAILED_TO_FETCH`,e));if(!u.success)return u;let d=await y6.fromUnsafe(async()=>u.data.json(),e=>g6(`FAILED_TO_FETCH_DATA`,e));if(!d.success)return{success:!1,error:g6(`UNKNOWN_ERROR`,`Unknown error occurred. Please contact support.`)};if(!u.data.ok){if(!m(r,d.data))return{success:!1,error:g6(`UNKNOWN_ERROR`,`Unknown error occurred. Please contact support.`)};let e=v(r,d.data);return{success:!1,error:g6(e.code,e.message)}}return m(c,d.data)?{success:!0,data:v(c,d.data)}:{success:!1,error:g6(`INVALID_RESPONSE`,`Invalid response. Please contact support`)}});return{search:async e=>i({path:`/vector/registry/search`,query:{query:e},responseSchema:T({results:ne(v6)})}),getDocument:async e=>i({path:`/vector/registry/document/${e.namespace}/${e.slug}`,responseSchema:v6}),getKeyDocuments:async()=>i({path:`/vector/registry/documents`,responseSchema:T({documents:ne(v6)})}),getCuratedDocuments:async()=>i({path:`/vector/registry/curated`,responseSchema:T({results:ne(v6)})})}}var Wan=s((()=>{_6(),Ran(),b6(),le()}));function Gan(e,t){return`${e}/${t}`}var Kan=s((()=>{})),x6,S6=s((()=>{le(),x6=`execute-request`,T({method:x(),path:x(),headers:E(re(x(),x())),body:E(x()),documentName:x(),documentIdentifier:x({typeComment:`Needed for legacy support for old clients`})})})),qan,C6,Jan,Yan,Xan,Zan,Qan=s((()=>{qan=e=>{let t=C6(e,0);if(t===void 0||!Yan(e[t]))return;let n=C6(e,t+1);if(n!==void 0)return Xan(e,t,n)},C6=(e,t)=>{for(let n=t;n<e.length;n+=1){let t=e[n];if(!Jan(t))return n}},Jan=e=>e===` `||e===`	`||e===`
-`||e===`\r`,Yan=e=>e===`{`||e===`[`,Xan=(e,t,n)=>{let r;for(let i=n-1;i>t;--i){let t=e[i];if(t===`\r`)return;if(t===`
-`)return Zan(r);if(r===void 0)r=t;else if(r[0]===t)r+=t;else return}},Zan=e=>e===void 0?0:e[0]===` `?e.length:e})),$an,w6,eon,ton,non=s((()=>{$an=(e,t)=>{let n=w6(e,`toPrecision`,t,t);return n===void 0?w6(e,`toExponential`,t,t):n},w6=(e,t,n,r)=>{let i=e[t](r).replace(eon,`$1`).replace(ton,`$1`);return i.length<=n?i:r===1?void 0:w6(e,t,n,r-1)},eon=/(e)\+/iu,ton=/\.?0*($|e)/iu})),ron,ion,aon,oon=s((()=>{ron=(e,t)=>{if(typeof e!=`string`)throw TypeError(`Input must be a JSON string: ${e}`);ion(t)},ion=e=>{if(aon(e),e<0)throw TypeError(`"maxSize" argument must be positive: ${e}`);if(e<7)throw TypeError(`"maxSize" argument must be at least 7: ${e}`)},aon=e=>{if(e===void 0)throw TypeError(`"maxSize" argument must be defined`);if(!Number.isInteger(e))throw TypeError(`"maxSize" argument must be an integer: ${e}`)}})),T6,E6,D6,son,con,lon,uon,O6,don,fon,pon,mon,hon,gon,_on=s((()=>{T6=(e,t,n)=>E6(e,t,O6(t,n)),E6=(e,t,n)=>{if(n>=t)return n;let r=e[n];return r>=hon&&r<=gon?E6(e,t,n+1):n},D6=(e,t,n)=>n===void 0?n:son(e,O6(t,n)),son=(e,t)=>con(e,t)?t-3:lon(e,t)?t-2:uon(e,t)?t-1:t,con=(e,t)=>t>=3&&e[t-3]>=don&&e[t-3]<=fon,lon=(e,t)=>t>=2&&e[t-2]>=pon,uon=(e,t)=>t>=1&&e[t-1]>=mon,O6=(e,t)=>t<0||Object.is(t,-0)?Math.max(e+t,0):t,don=240,fon=244,pon=224,mon=194,hon=128,gon=191})),von,yon=s((()=>{_on(),von=(e,t,n)=>{let r=globalThis.Buffer.from(e),i=T6(r,r.length,t),a=D6(r,r.length,n);return i===0&&a>=r.length?r.toString():r.toString(`utf8`,i,a)}})),k6,A6,j6,M6,bon,N6=s((()=>{k6=55296,A6=56319,j6=56320,M6=57343,bon=/[\uD800-\uDFFF]/gu})),P6,xon,Son=s((()=>{N6(),P6=e=>xon(e)?e.replace(bon,`�`):e,xon=e=>{for(let t=0;t<e.length;t+=1){let n=e.codePointAt(t);if(n>=55296&&n<=57343)return!0}return!1}})),F6,Con=s((()=>{N6(),F6=({input:e,targetByteCount:t,firstStartSurrogate:n,lastStartSurrogate:r,firstEndSurrogate:i,lastEndSurrogate:a,increment:o,canBacktrack:s,shift:c,charIndexInit:l})=>{let u=l,d=u,f=0;for(;f<t;u+=o){d=u;let t=e.charCodeAt(u);if(Number.isNaN(t))break;if(t<=127){f+=1;continue}if(t<=2047){f+=2;continue}if(f+=3,t<n||t>r)continue;let s=e.charCodeAt(u+o);Number.isNaN(s)||s<i||s>a||(f+=1,u+=o)}return(s&&f>t?d:u)+c}})),I6,won,Ton,Eon=s((()=>{N6(),Con(),I6=(e,t,n)=>t<0||Object.is(t,-0)?Ton(e,t,n):won(e,t,n),won=(e,t,n)=>F6({input:e,targetByteCount:t,firstStartSurrogate:k6,lastStartSurrogate:A6,firstEndSurrogate:j6,lastEndSurrogate:M6,increment:1,canBacktrack:n,shift:0,charIndexInit:0}),Ton=(e,t,n)=>F6({input:e,targetByteCount:-t,firstStartSurrogate:j6,lastStartSurrogate:M6,firstEndSurrogate:k6,lastEndSurrogate:A6,increment:-1,canBacktrack:!n,shift:1,charIndexInit:e.length-1})})),L6,Don,Oon=s((()=>{Son(),Eon(),L6=(e,t,n)=>{let r=I6(e,t,!1),i=Don(e,n);return P6(r===0&&i===void 0?e:e.slice(r,i))},Don=(e,t)=>{if(t===void 0)return t;let n=I6(e,t,!0);return n===e.length?void 0:n}})),kon,Aon,R6,jon,Mon,z6,Non=s((()=>{_on(),kon=(e,t,n)=>{let{textEncoder:r,textDecoder:i}=Aon(),a=Mon(e),{written:o}=r.encodeInto(e,a),s=T6(a,o,t),c=D6(a,o,n),l=c===void 0?o:Math.min(c,o),u=a.subarray(s,l);return i.decode(u)},Aon=()=>(R6===void 0&&(R6=new globalThis.TextEncoder,jon=new globalThis.TextDecoder(`utf8`,{fatal:!1})),{textEncoder:R6,textDecoder:jon}),Mon=e=>{let t=e.length*3;return t>1e5?new Uint8Array(t):((z6===void 0||z6.length<t)&&(z6=new Uint8Array(t)),z6)}})),Pon,B6,V6,Fon=s((()=>{Pon=(e,t)=>{if(t===void 0)return t;let n=B6(e,t);return n>=e.length*V6?void 0:n},B6=(e,t)=>t<=e.length*-V6?0:t,V6=4})),Ion,Lon,Ron,H6,zon=s((()=>{Ion=(e,t,n)=>{if(typeof e!=`string`)throw TypeError(`First argument must be a string: ${e}`);Lon(t),Ron(n)},Lon=e=>{if(e===void 0)throw TypeError(`Second argument is required.`);H6(`Second`,e)},Ron=e=>{e!==void 0&&H6(`Third`,e)},H6=(e,t)=>{if(!Number.isInteger(t))throw TypeError(`${e} argument must be an integer: ${t}`)}})),Bon,Von,U6,Hon=s((()=>{N6(),Bon=e=>{let t=!0,n=0;for(let r=0;r<U6;r+=1){let i=Von(e,r);i<=127||(t&&=!1,i>2047&&(n+=1))}return{asciiOnly:t,longCharsPercentage:n/U6}},Von=(e,t)=>{let n=U6-1,r=1-(n-t)/n,i=Math.round(r*(e.length-1));return e.charCodeAt(i)},U6=50})),Uon,Won,Gon,Kon,qon,W6,Jon=s((()=>{yon(),Oon(),Non(),Fon(),Son(),zon(),Hon(),Uon=(e,t,n)=>{if(Ion(e,t,n),e===``)return e;let r=B6(e,t),i=Pon(e,n);return i===void 0&&Object.is(r,0)?P6(e):Won(e,r,i)},Won=(e,t,n)=>{if(e.length<=Gon)return L6(e,t,n);let{asciiOnly:r,longCharsPercentage:i}=Bon(e);return r?qon(e,t,n):i>=Kon?L6(e,t,n):W6(e,t,n)},Gon=200,Kon=.4,qon=(e,t,n)=>`Buffer`in globalThis&&`from`in globalThis.Buffer?von(e,t,n):W6(e,t,n),W6=(e,t,n)=>`TextEncoder`in globalThis?kon(e,t,n):L6(e,t,n)})),Yon,Xon,Zon,Qon,$on,G6,K6,esn=s((()=>{Jon(),Yon=(e,t)=>$on(`${Xon(Uon(Qon(JSON.stringify(e)),0,t-K6.length-G6.length*2))}${K6}`),Xon=e=>e.replace(Zon,``),Zon=/(\\|\\u[0-9a-fA-F]{0,3})$/u,Qon=e=>e.slice(G6.length,-G6.length),$on=e=>`${G6}${e}${G6}`,G6=`"`,K6=`...`})),tsn,nsn=s((()=>{tsn=e=>globalThis.Buffer.byteLength(e)})),q6,rsn,isn,asn,osn,ssn,csn,lsn=s((()=>{q6=e=>{let t=e.length,n=t;for(let r=0;r<t;r+=1){let t=e.charCodeAt(r);if(t<=rsn)continue;if(t<=isn){n+=1;continue}if(n+=2,t<asn||t>osn)continue;let i=e.charCodeAt(r+1);i<ssn||i>csn||(r+=1)}return n},rsn=127,isn=2047,asn=55296,osn=56319,ssn=56320,csn=57343})),usn,dsn,fsn,J6,psn=s((()=>{usn=()=>dsn.bind(void 0,new TextEncoder),dsn=(e,t)=>{let n=fsn(t);return e.encodeInto(t,n).written},fsn=e=>{let t=e.length*3;return t>1e5?new Uint8Array(t):((J6===void 0||J6.length<t)&&(J6=new Uint8Array(t)),J6)}})),msn,hsn,gsn,_sn=s((()=>{nsn(),lsn(),psn(),msn=()=>`Buffer`in globalThis&&`byteLength`in globalThis.Buffer?tsn:`TextEncoder`in globalThis?hsn.bind(void 0,usn()):q6,hsn=(e,t)=>t.length<100?q6(t):e(t),gsn=msn()})),vsn,ysn,bsn,xsn,Ssn,Y6,Csn=s((()=>{_sn(),vsn=e=>{if(e===null)return ysn;if(e===!0)return bsn;if(e===!1)return xsn;let t=typeof e;return t===`object`?Ssn:t===`number`?JSON.stringify(e).length:Y6(e)},ysn=4,bsn=4,xsn=5,Ssn=2,Y6=e=>gsn(JSON.stringify(e))})),X6,wsn,Tsn,Esn,Dsn,Z6,Q6,$6,Osn,e8=s((()=>{Csn(),X6=({size:e,increment:t,maxSize:n,truncatedProps:r,path:i,value:a})=>{let o=e+t,s=o>n;return s?{size:e,stop:s,truncatedProps:[...r,{path:i,value:a}]}:{size:o,stop:s,truncatedProps:r}},wsn=e=>vsn(e),Tsn=(e,t,n)=>Z6({empty:e,indent:t,depth:n,keySpaceSize:0})+$6(e),Esn=({key:e,empty:t,indent:n,depth:r})=>{let i=Z6({empty:t,indent:n,depth:r,keySpaceSize:1}),a=Y6(e),o=$6(t);return i+a+Dsn+o},Dsn=1,Z6=({empty:e,indent:t,depth:n,keySpaceSize:r})=>{if(t===void 0)return 0;let i=Q6+t*(n+1),a=e?Q6+t*n:0;return r+i+a},Q6=1,$6=e=>e?0:Osn,Osn=1})),t8,ksn,Asn=s((()=>{e8(),t8=({parent:e,truncatedProps:t,path:n,increment:r,maxSize:i,key:a,empty:o,size:s,truncateValue:c,indent:l,depth:u})=>{let d=e[a],f=[...n,a],{size:p,stop:m,truncatedProps:h}=X6({size:s,increment:r,maxSize:i,truncatedProps:t,path:f,value:d});return m?{empty:o,size:p,truncatedProps:h}:ksn({value:d,truncatedProps:t,path:f,maxSize:i,empty:o,size:s,newSize:p,truncateValue:c,indent:l,depth:u})},ksn=({value:e,truncatedProps:t,path:n,maxSize:r,empty:i,size:a,newSize:o,truncateValue:s,indent:c,depth:l})=>{let{value:u,size:d,truncatedProps:f}=s({value:e,truncatedProps:t,path:n,size:o,maxSize:r,indent:c,depth:l+1});return u===void 0?{empty:i,size:a,truncatedProps:f}:{empty:!1,size:d,value:u,truncatedProps:f}}})),jsn,Msn=s((()=>{Asn(),e8(),jsn=({array:e,truncatedProps:t,path:n,size:r,maxSize:i,truncateValue:a,indent:o,depth:s})=>{let c=[],l={empty:!0,size:r,truncatedProps:t};for(let t=0;t<e.length;t+=1){let r=Tsn(l.empty,o,s);l=t8({parent:e,truncatedProps:l.truncatedProps,path:n,increment:r,maxSize:i,key:t,empty:l.empty,size:l.size,truncateValue:a,indent:o,depth:s}),l.value!==void 0&&c.push(l.value)}return{value:c,size:l.size,truncatedProps:l.truncatedProps}}})),Nsn,Psn=s((()=>{Asn(),e8(),Nsn=({object:e,truncatedProps:t,path:n,size:r,maxSize:i,truncateValue:a,indent:o,depth:s})=>{let c={},l={empty:!0,size:r,truncatedProps:t};for(let t in e){let r=Esn({key:t,empty:l.empty,indent:o,depth:s});l=t8({parent:e,truncatedProps:l.truncatedProps,path:n,increment:r,maxSize:i,key:t,empty:l.empty,size:l.size,truncateValue:a,indent:o,depth:s}),l.value!==void 0&&(c[t]=l.value)}return{value:c,size:l.size,truncatedProps:l.truncatedProps}}})),n8,Fsn,Isn=s((()=>{Msn(),Psn(),e8(),n8=({value:e,truncatedProps:t,path:n,size:r,maxSize:i,indent:a,depth:o})=>{let{size:s,stop:c,truncatedProps:l}=X6({size:r,increment:wsn(e),maxSize:i,truncatedProps:t,path:n,value:e});return c?{value:void 0,size:s,truncatedProps:l}:Fsn({value:e,truncatedProps:l,path:n,size:s,maxSize:i,indent:a,depth:o})},Fsn=({value:e,truncatedProps:t,path:n,size:r,maxSize:i,indent:a,depth:o})=>typeof e!=`object`||!e?{value:e,size:r,truncatedProps:t}:Array.isArray(e)?jsn({array:e,truncatedProps:t,path:n,size:r,maxSize:i,truncateValue:n8,indent:a,depth:o}):Nsn({object:e,truncatedProps:t,path:n,size:r,maxSize:i,truncateValue:n8,indent:a,depth:o})})),Lsn,Rsn,zsn,Bsn,Vsn=s((()=>{Qan(),non(),oon(),esn(),Isn(),Lsn=(e,t)=>{ron(e,t);let n=Rsn(e),r=zsn(e),{value:i,truncatedProps:a}=n8({value:r,truncatedProps:[],path:[],size:0,maxSize:t,indent:n,depth:0});return{jsonString:Bsn({newValue:i,value:r,maxSize:t,indent:n}),truncatedProps:a}},Rsn=e=>{let t=qan(e);return typeof t==`string`?t.length:t},zsn=e=>{try{return JSON.parse(e)}catch(t){throw TypeError(`Invalid JSON string: "${e}"\n${t.message}`)}},Bsn=({newValue:e,value:t,maxSize:n,indent:r})=>e===void 0?typeof t==`number`?$an(t,n):Yon(t,n):JSON.stringify(e,void 0,r)}));function Hsn({path:e,activeServer:t,proxyUrl:n,queryParams:r}){return _F(n,gI({path:e,server:t,urlParams:r}))}var Usn,Wsn,r8,Gsn,i8,Ksn=s((()=>{_6(),S6(),b6(),yF(),QI(),AF(),Vsn(),Usn=5e4,Wsn=y6.safeFn(async e=>e.headers.get(`content-type`)===`application/json`?{success:!0,data:await e.json()}:{success:!0,data:await e.text()},e=>g6(`FAILED_TO_PARSE_RESPONSE_BODY`,{originalError:e})),r8=e=>JSON.parse(Lsn(JSON.stringify(e),Usn).jsonString),Gsn=y6.safeFn(async(e,t)=>{let n=await fetch(e,t),r=await Wsn(n);return n.ok?r.success?{success:!0,data:{status:n.status,responseBody:r8(r.data),headers:Object.fromEntries(n.headers.entries())}}:r:{success:!1,error:g6(`REQUEST_NOT_OK`,{status:n.status,url:n.url,responseBody:r8(r.success?r.data:void 0),headers:Object.fromEntries(n.headers.entries())})}},e=>g6(`FAILED_TO_FETCH`,{originalError:e})),i8=y6.safeFn(async({documentSettings:e,toolCallId:t,chat:n,proxyUrl:r,input:{method:i,path:a,body:o,headers:s,documentName:c}})=>{let l=e[c];if(!l)return{success:!1,error:g6(`DOCUMENT_SETTINGS_COULD_NOT_BE_DETERMINED`,{documentName:c})};let u=_I(l.securitySchemes).reduce((e,t)=>{let n=t.format===`basic`?`Basic ${kF(t.value)}`:t.format===`bearer`?`Bearer ${t.value}`:t.value;return t.in===`header`?e.headers[t.name]=n:t.in===`query`?e.queryParams.set(t.name,n):t.in===`cookie`&&(e.cookies[t.name]=n),e},{headers:{},queryParams:new URLSearchParams,cookies:{}}),d=Object.entries(u.cookies).map(([e,t])=>`${e}=${t}`).join(`; `),f={method:i,body:o,headers:{...s,...u.headers,Cookie:d}},p=await Gsn(Hsn({path:a,activeServer:l.activeServer,proxyUrl:r,queryParams:u.queryParams}),f);return n.addToolOutput({tool:x6,toolCallId:t,output:p,state:`output-available`}),p},e=>g6(`FAILED_TO_EXECUTE_REQUEST`,e))})),a8,o8=s((()=>{a8={DEFAULT_PROXY_URL:`https://proxy.scalar.com`,PRIVACY_POLICY:`https://scalar.com/legal/privacy-policy`,TERMS_AND_CONDITIONS:`https://scalar.com/legal/terms-and-conditions`,AGENT_SCALAR_DOCUMENTATION:`https://scalar.com/products/agent/getting-started`,PROXY_SOURCE_CODE:`https://github.com/scalar/scalar/tree/main/projects/proxy-scalar-com`}})),s8,c8,qsn=s((()=>{s8={SELECTED_CLIENT:`scalar-reference-selected-client-v2`,AUTH:`scalar-reference-auth`},c8=()=>typeof window>`u`?{getItem:()=>null,setItem:()=>null,removeItem:()=>null}:localStorage}));function Jsn(e){return Object.values(e.paths??{}).flatMap(e=>Object.values(e??{}))}function Ysn(e,t,n){let r=YI(t?.components?.securitySchemes,{},n,e),i=MI(t.security),a=RI(n.getAuthSelectedSchemas({type:`document`,documentName:e}),void 0,i);return FI(r,a.selectedSchemes[a.selectedIndex]??{})}function Xsn(e){let t=[];for(let[n,r]of Object.entries(e.workspace.documents))EI(r)&&t.push([n,r]);return Object.fromEntries(t.map(([t,n])=>[t,{activeServer:ZI(n,null,null,XI(n.servers,{documentUrl:n[`x-scalar-original-source-url`]})),securitySchemes:Ysn(t,n,e.auth)}]))}function Zsn(e){try{return JSON.parse(e)}catch{return}}var l8,u8,Qsn,d8=s((()=>{QI(),qsn(),t$(),OI(),oN(),l8=c8(),u8=()=>{let e=e=>`${s8.AUTH}-${e}`;return{getAuth:t=>aN(QQ,JSON.parse(l8.getItem(e(t))??`{}`)),setAuth:(t,n)=>{l8.setItem(e(t),JSON.stringify(n))}}},Qsn=({documentName:e,workspaceStore:t})=>{let n=u8().getAuth(e);t.auth.load({[e]:n})}}));function $sn(){let e=A(!1);Hi(()=>{e.value=localStorage.getItem(f8)===`true`});function t(){e.value=!0,localStorage.setItem(f8,`true`)}return{accepted:e,accept:t}}var f8,ecn=s((()=>{W(),f8=`scalar/agent-terms-accepted`}));function tcn({namespace:e,slug:t}){localStorage.setItem(p8,JSON.stringify({namespace:e,slug:t}))}function ncn(){let e=localStorage.getItem(p8);if(e)return v(ocn,JSON.parse(e))}function rcn(){localStorage.getItem(p8)&&localStorage.removeItem(p8)}function icn(){let e=k7(),t=A();function n(t){let n=`${e.baseUrl}${t}`;return _F(e.platformProxyUrl,n)}async function r(r,i=!1){try{t.value={type:`uploading`};let a=await fetch(n(`/core/share/upload/apis${i?`?source=agent`:``}`),{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({document:r})});if(!a.ok){t.value={type:`error`,error:`Failed to upload your OpenAPI document.`};return}let o=await a.json(),s=T({url:x(),namespace:x(),slug:x()});if(!m(s,o)){t.value={type:`error`,error:`Failed to process document.`};return}let c=v(s,o);t.value={type:`processing`};let l=await fetch(n(`/vector/registry/embeddings/${c.namespace}/${c.slug}`),{method:`GET`});if(tcn({namespace:c.namespace,slug:c.slug}),await e.addDocument({namespace:c.namespace,slug:c.slug,removable:!1,tmp:!0}),!l.ok){t.value={type:`error`,error:`Failed to embed document.`};return}return t.value={type:`done`},e.uploadedTmpDocumentUrl.value=c.url,setTimeout(()=>{t.value=void 0},acn),c}catch{t.value={type:`error`,error:`Failed to upload your OpenAPI document.`};return}}return{uploadTempDocument:r,uploadState:t}}var acn,p8,ocn,m8=s((()=>{M7(),W(),le(),yF(),acn=5e3,p8=`scalar-tmp-doc`,ocn=T({namespace:x(),slug:x()})})),scn,ccn=s((()=>{d8(),g3(),scn=({debounceDelay:e=500,maxWait:t=1e4,persistAuth:n=!1})=>{let{execute:r}=h3({delay:e,maxWait:t}),i=u8(),a=()=>typeof n==`function`?n():n;return{hooks:{onWorkspaceStateChanges(e){a()&&e.type===`auth`&&r(`auth`,()=>i.setAuth(e.documentName,e.value))}}}}})),h8,lcn=s((()=>{_6(),Kan(),d8(),b6(),Zrn(),uin(),h8=y6.safeFn(async({namespace:e,slug:t,workspaceStore:n,registryDocuments:r,getAccessToken:i,registryUrl:a,config:o,api:s,removable:c})=>{let l=await s.getDocument({namespace:e,slug:t});if(!l.success)return l;r.value.push({...l.data,removable:c});let u=new URL(`/@${e}/apis/${t}/latest`,a),d=[],f=i?.();f&&d.push({domains:[new URL(a).host],headers:{"x-scalar-auth":f}});let p=await W3(u.toString(),{plugins:[q3({headers:d})],treeShake:!1}),m=Gan(e,t);return await n.addDocument({name:m,document:p},o),n.update(`x-scalar-active-document`,m),Qsn({documentName:m,workspaceStore:n}),{success:!0,data:l.data}},e=>g6(`UNABLE_TO_LOAD_DOCUMENT`,e))}));function ucn(e){return e==null?`unknown error`:typeof e==`string`?e:e instanceof Error?e.message:JSON.stringify(e)}var g8,dcn,fcn,pcn,_8,mcn,hcn,v8,y8,gcn,_cn,vcn,ycn,bcn,xcn,b8,x8,Scn,Ccn,wcn,S8,Tcn,Ecn,Dcn,Ocn,kcn,C8,w8,Acn,jcn,Mcn,T8,Ncn,Pcn=s((()=>{g8=`vercel.ai.error`,dcn=Symbol.for(g8),_8=class e extends (pcn=Error,fcn=dcn,pcn){constructor({name:e,message:t,cause:n}){super(t),this[fcn]=!0,this.name=e,this.cause=n}static isInstance(t){return e.hasMarker(t,g8)}static hasMarker(e,t){let n=Symbol.for(t);return typeof e==`object`&&!!e&&n in e&&typeof e[n]==`boolean`&&e[n]===!0}},mcn=`AI_APICallError`,`${mcn}`,hcn=`AI_EmptyResponseBodyError`,`${hcn}`,v8=`AI_InvalidArgumentError`,y8=`vercel.ai.error.${v8}`,gcn=Symbol.for(y8),ycn=class extends (vcn=_8,_cn=gcn,vcn){constructor({message:e,cause:t,argument:n}){super({name:v8,message:e,cause:t}),this[_cn]=!0,this.argument=n}static isInstance(e){return _8.hasMarker(e,y8)}},bcn=`AI_InvalidPromptError`,`${bcn}`,xcn=`AI_InvalidResponseDataError`,`${xcn}`,b8=`AI_JSONParseError`,x8=`vercel.ai.error.${b8}`,Scn=Symbol.for(x8),S8=class extends (wcn=_8,Ccn=Scn,wcn){constructor({text:e,cause:t}){super({name:b8,message:`JSON parsing failed: Text: ${e}.
-Error message: ${ucn(t)}`,cause:t}),this[Ccn]=!0,this.text=e}static isInstance(e){return _8.hasMarker(e,x8)}},Tcn=`AI_LoadAPIKeyError`,`${Tcn}`,Ecn=`AI_LoadSettingError`,`${Ecn}`,Dcn=`AI_NoContentGeneratedError`,`${Dcn}`,Ocn=`AI_NoSuchModelError`,`${Ocn}`,kcn=`AI_TooManyEmbeddingValuesForCallError`,`${kcn}`,C8=`AI_TypeValidationError`,w8=`vercel.ai.error.${C8}`,Acn=Symbol.for(w8),T8=class e extends (Mcn=_8,jcn=Acn,Mcn){constructor({value:e,cause:t}){super({name:C8,message:`Type validation failed: Value: ${JSON.stringify(e)}.
-Error message: ${ucn(t)}`,cause:t}),this[jcn]=!0,this.value=e}static isInstance(e){return _8.hasMarker(e,w8)}static wrap({value:t,cause:n}){return e.isInstance(n)&&n.value===t?n:new e({value:t,cause:n})}},Ncn=`AI_UnsupportedFunctionalityError`,`${Ncn}`})),Fcn=s((()=>{FQ(),FQ()})),Icn=s((()=>{Fcn()})),E8,Lcn,D8,O8,k8=s((()=>{(function(e){e.assertEqual=e=>{};function t(e){}e.assertIs=t;function n(e){throw Error()}e.assertNever=n,e.arrayToEnum=e=>{let t={};for(let n of e)t[n]=n;return t},e.getValidEnumValues=t=>{let n=e.objectKeys(t).filter(e=>typeof t[t[e]]!=`number`),r={};for(let e of n)r[e]=t[e];return e.objectValues(r)},e.objectValues=t=>e.objectKeys(t).map(function(e){return t[e]}),e.objectKeys=typeof Object.keys==`function`?e=>Object.keys(e):e=>{let t=[];for(let n in e)Object.prototype.hasOwnProperty.call(e,n)&&t.push(n);return t},e.find=(e,t)=>{for(let n of e)if(t(n))return n},e.isInteger=typeof Number.isInteger==`function`?e=>Number.isInteger(e):e=>typeof e==`number`&&Number.isFinite(e)&&Math.floor(e)===e;function r(e,t=` | `){return e.map(e=>typeof e==`string`?`'${e}'`:e).join(t)}e.joinValues=r,e.jsonStringifyReplacer=(e,t)=>typeof t==`bigint`?t.toString():t})(E8||={}),(function(e){e.mergeShapes=(e,t)=>({...e,...t})})(Lcn||={}),D8=E8.arrayToEnum([`string`,`nan`,`number`,`integer`,`float`,`boolean`,`date`,`bigint`,`symbol`,`function`,`undefined`,`null`,`array`,`object`,`unknown`,`promise`,`void`,`never`,`map`,`set`]),O8=e=>{switch(typeof e){case`undefined`:return D8.undefined;case`string`:return D8.string;case`number`:return Number.isNaN(e)?D8.nan:D8.number;case`boolean`:return D8.boolean;case`function`:return D8.function;case`bigint`:return D8.bigint;case`symbol`:return D8.symbol;case`object`:return Array.isArray(e)?D8.array:e===null?D8.null:e.then&&typeof e.then==`function`&&e.catch&&typeof e.catch==`function`?D8.promise:typeof Map<`u`&&e instanceof Map?D8.map:typeof Set<`u`&&e instanceof Set?D8.set:typeof Date<`u`&&e instanceof Date?D8.date:D8.object;default:return D8.unknown}}})),A8,j8,M8=s((()=>{k8(),A8=E8.arrayToEnum([`invalid_type`,`invalid_literal`,`custom`,`invalid_union`,`invalid_union_discriminator`,`invalid_enum_value`,`unrecognized_keys`,`invalid_arguments`,`invalid_return_type`,`invalid_date`,`invalid_string`,`too_small`,`too_big`,`invalid_intersection_types`,`not_multiple_of`,`not_finite`]),j8=class e extends Error{get errors(){return this.issues}constructor(e){super(),this.issues=[],this.addIssue=e=>{this.issues=[...this.issues,e]},this.addIssues=(e=[])=>{this.issues=[...this.issues,...e]};let t=new.target.prototype;Object.setPrototypeOf?Object.setPrototypeOf(this,t):this.__proto__=t,this.name=`ZodError`,this.issues=e}format(e){let t=e||function(e){return e.message},n={_errors:[]},r=e=>{for(let i of e.issues)if(i.code===`invalid_union`)i.unionErrors.map(r);else if(i.code===`invalid_return_type`)r(i.returnTypeError);else if(i.code===`invalid_arguments`)r(i.argumentsError);else if(i.path.length===0)n._errors.push(t(i));else{let e=n,r=0;for(;r<i.path.length;){let n=i.path[r];r===i.path.length-1?(e[n]=e[n]||{_errors:[]},e[n]._errors.push(t(i))):e[n]=e[n]||{_errors:[]},e=e[n],r++}}};return r(this),n}static assert(t){if(!(t instanceof e))throw Error(`Not a ZodError: ${t}`)}toString(){return this.message}get message(){return JSON.stringify(this.issues,E8.jsonStringifyReplacer,2)}get isEmpty(){return this.issues.length===0}flatten(e=e=>e.message){let t=Object.create(null),n=[];for(let r of this.issues)if(r.path.length>0){let n=r.path[0];t[n]=t[n]||[],t[n].push(e(r))}else n.push(e(r));return{formErrors:n,fieldErrors:t}}get formErrors(){return this.flatten()}},j8.create=e=>new j8(e)})),N8,Rcn=s((()=>{M8(),k8(),N8=(e,t)=>{let n;switch(e.code){case A8.invalid_type:n=e.received===D8.undefined?`Required`:`Expected ${e.expected}, received ${e.received}`;break;case A8.invalid_literal:n=`Invalid literal value, expected ${JSON.stringify(e.expected,E8.jsonStringifyReplacer)}`;break;case A8.unrecognized_keys:n=`Unrecognized key(s) in object: ${E8.joinValues(e.keys,`, `)}`;break;case A8.invalid_union:n=`Invalid input`;break;case A8.invalid_union_discriminator:n=`Invalid discriminator value. Expected ${E8.joinValues(e.options)}`;break;case A8.invalid_enum_value:n=`Invalid enum value. Expected ${E8.joinValues(e.options)}, received '${e.received}'`;break;case A8.invalid_arguments:n=`Invalid function arguments`;break;case A8.invalid_return_type:n=`Invalid function return type`;break;case A8.invalid_date:n=`Invalid date`;break;case A8.invalid_string:typeof e.validation==`object`?`includes`in e.validation?(n=`Invalid input: must include "${e.validation.includes}"`,typeof e.validation.position==`number`&&(n=`${n} at one or more positions greater than or equal to ${e.validation.position}`)):`startsWith`in e.validation?n=`Invalid input: must start with "${e.validation.startsWith}"`:`endsWith`in e.validation?n=`Invalid input: must end with "${e.validation.endsWith}"`:E8.assertNever(e.validation):n=e.validation===`regex`?`Invalid`:`Invalid ${e.validation}`;break;case A8.too_small:n=e.type===`array`?`Array must contain ${e.exact?`exactly`:e.inclusive?`at least`:`more than`} ${e.minimum} element(s)`:e.type===`string`?`String must contain ${e.exact?`exactly`:e.inclusive?`at least`:`over`} ${e.minimum} character(s)`:e.type===`number`||e.type===`bigint`?`Number must be ${e.exact?`exactly equal to `:e.inclusive?`greater than or equal to `:`greater than `}${e.minimum}`:e.type===`date`?`Date must be ${e.exact?`exactly equal to `:e.inclusive?`greater than or equal to `:`greater than `}${new Date(Number(e.minimum))}`:`Invalid input`;break;case A8.too_big:n=e.type===`array`?`Array must contain ${e.exact?`exactly`:e.inclusive?`at most`:`less than`} ${e.maximum} element(s)`:e.type===`string`?`String must contain ${e.exact?`exactly`:e.inclusive?`at most`:`under`} ${e.maximum} character(s)`:e.type===`number`?`Number must be ${e.exact?`exactly`:e.inclusive?`less than or equal to`:`less than`} ${e.maximum}`:e.type===`bigint`?`BigInt must be ${e.exact?`exactly`:e.inclusive?`less than or equal to`:`less than`} ${e.maximum}`:e.type===`date`?`Date must be ${e.exact?`exactly`:e.inclusive?`smaller than or equal to`:`smaller than`} ${new Date(Number(e.maximum))}`:`Invalid input`;break;case A8.custom:n=`Invalid input`;break;case A8.invalid_intersection_types:n=`Intersection results could not be merged`;break;case A8.not_multiple_of:n=`Number must be a multiple of ${e.multipleOf}`;break;case A8.not_finite:n=`Number must be finite`;break;default:n=t.defaultError,E8.assertNever(e)}return{message:n}}}));function P8(){return zcn}var zcn,F8=s((()=>{Rcn(),zcn=N8}));function I8(e,t){let n=P8(),r=L8({issueData:t,data:e.data,path:e.path,errorMaps:[e.common.contextualErrorMap,e.schemaErrorMap,n,n===N8?void 0:N8].filter(e=>!!e)});e.common.issues.push(r)}var L8,R8,z8,B8,V8,H8,U8,W8,G8,Bcn=s((()=>{F8(),Rcn(),L8=e=>{let{data:t,path:n,errorMaps:r,issueData:i}=e,a=[...n,...i.path||[]],o={...i,path:a};if(i.message!==void 0)return{...i,path:a,message:i.message};let s=``,c=r.filter(e=>!!e).slice().reverse();for(let e of c)s=e(o,{data:t,defaultError:s}).message;return{...i,path:a,message:s}},R8=class e{constructor(){this.value=`valid`}dirty(){this.value===`valid`&&(this.value=`dirty`)}abort(){this.value!==`aborted`&&(this.value=`aborted`)}static mergeArray(e,t){let n=[];for(let r of t){if(r.status===`aborted`)return z8;r.status===`dirty`&&e.dirty(),n.push(r.value)}return{status:e.value,value:n}}static async mergeObjectAsync(t,n){let r=[];for(let e of n){let t=await e.key,n=await e.value;r.push({key:t,value:n})}return e.mergeObjectSync(t,r)}static mergeObjectSync(e,t){let n={};for(let r of t){let{key:t,value:i}=r;if(t.status===`aborted`||i.status===`aborted`)return z8;t.status===`dirty`&&e.dirty(),i.status===`dirty`&&e.dirty(),t.value!==`__proto__`&&(i.value!==void 0||r.alwaysSet)&&(n[t.value]=i.value)}return{status:e.value,value:n}}},z8=Object.freeze({status:`aborted`}),B8=e=>({status:`dirty`,value:e}),V8=e=>({status:`valid`,value:e}),H8=e=>e.status===`aborted`,U8=e=>e.status===`dirty`,W8=e=>e.status===`valid`,G8=e=>typeof Promise<`u`&&e instanceof Promise})),Vcn=s((()=>{})),K8,Hcn=s((()=>{(function(e){e.errToObj=e=>typeof e==`string`?{message:e}:e||{},e.toString=e=>typeof e==`string`?e:e?.message})(K8||={})}));function q8(e){if(!e)return{};let{errorMap:t,invalid_type_error:n,required_error:r,description:i}=e;if(t&&(n||r))throw Error(`Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`);return t?{errorMap:t,description:i}:{errorMap:(t,i)=>{let{message:a}=e;return t.code===`invalid_enum_value`?{message:a??i.defaultError}:i.data===void 0?{message:a??r??i.defaultError}:t.code===`invalid_type`?{message:a??n??i.defaultError}:{message:i.defaultError}},description:i}}function Ucn(e){let t=`[0-5]\\d`;e.precision?t=`${t}\\.\\d{${e.precision}}`:e.precision??(t=`${t}(\\.\\d+)?`);let n=e.precision?`+`:`?`;return`([01]\\d|2[0-3]):[0-5]\\d(:${t})${n}`}function Wcn(e){return RegExp(`^${Ucn(e)}$`)}function Gcn(e){let t=`${$8}T${Ucn(e)}`,n=[];return n.push(e.local?`Z?`:`Z`),e.offset&&n.push(`([+-]\\d{2}:?\\d{2})`),t=`${t}(${n.join(`|`)})`,RegExp(`^${t}$`)}function Kcn(e,t){return!!((t===`v4`||!t)&&sln.test(e)||(t===`v6`||!t)&&lln.test(e))}function qcn(e,t){if(!nln.test(e))return!1;try{let[n]=e.split(`.`);if(!n)return!1;let r=n.replace(/-/g,`+`).replace(/_/g,`/`).padEnd(n.length+(4-n.length%4)%4,`=`),i=JSON.parse(atob(r));return!(typeof i!=`object`||!i||`typ`in i&&i?.typ!==`JWT`||!i.alg||t&&i.alg!==t)}catch{return!1}}function Jcn(e,t){return!!((t===`v4`||!t)&&cln.test(e)||(t===`v6`||!t)&&uln.test(e))}function Ycn(e,t){let n=(e.toString().split(`.`)[1]||``).length,r=(t.toString().split(`.`)[1]||``).length,i=n>r?n:r;return Number.parseInt(e.toFixed(i).replace(`.`,``))%Number.parseInt(t.toFixed(i).replace(`.`,``))/10**i}function J8(e){if(e instanceof p5){let t={};for(let n in e.shape){let r=e.shape[n];t[n]=E5.create(J8(r))}return new p5({...e._def,shape:()=>t})}else if(e instanceof f5)return new f5({...e._def,type:J8(e.element)});else if(e instanceof E5)return E5.create(J8(e.unwrap()));else if(e instanceof D5)return D5.create(J8(e.unwrap()));else if(e instanceof _5)return _5.create(e.items.map(e=>J8(e)));else return e}function Y8(e,t){let n=O8(e),r=O8(t);if(e===t)return{valid:!0,data:e};if(n===D8.object&&r===D8.object){let n=E8.objectKeys(t),r=E8.objectKeys(e).filter(e=>n.indexOf(e)!==-1),i={...e,...t};for(let n of r){let r=Y8(e[n],t[n]);if(!r.valid)return{valid:!1};i[n]=r.data}return{valid:!0,data:i}}else if(n===D8.array&&r===D8.array){if(e.length!==t.length)return{valid:!1};let n=[];for(let r=0;r<e.length;r++){let i=e[r],a=t[r],o=Y8(i,a);if(!o.valid)return{valid:!1};n.push(o.data)}return{valid:!0,data:n}}else if(n===D8.date&&r===D8.date&&+e==+t)return{valid:!0,data:e};else return{valid:!1}}function Xcn(e,t){return new S5({values:e,typeName:P5.ZodEnum,...q8(t)})}var X8,Z8,Q8,Zcn,Qcn,$cn,eln,tln,nln,rln,iln,aln,oln,sln,cln,lln,uln,dln,fln,$8,pln,e5,t5,n5,r5,i5,a5,o5,s5,c5,l5,u5,d5,f5,p5,m5,h5,mln,g5,_5,hln,v5,y5,gln,b5,x5,S5,C5,w5,T5,E5,D5,O5,k5,A5,j5,M5,N5,P5,_ln=s((()=>{M8(),F8(),Hcn(),Bcn(),k8(),X8=class{constructor(e,t,n,r){this._cachedPath=[],this.parent=e,this.data=t,this._path=n,this._key=r}get path(){return this._cachedPath.length||(Array.isArray(this._key)?this._cachedPath.push(...this._path,...this._key):this._cachedPath.push(...this._path,this._key)),this._cachedPath}},Z8=(e,t)=>{if(W8(t))return{success:!0,data:t.value};if(!e.common.issues.length)throw Error(`Validation failed but no issues detected.`);return{success:!1,get error(){return this._error||=new j8(e.common.issues),this._error}}},Q8=class{get description(){return this._def.description}_getType(e){return O8(e.data)}_getOrReturnCtx(e,t){return t||{common:e.parent.common,data:e.data,parsedType:O8(e.data),schemaErrorMap:this._def.errorMap,path:e.path,parent:e.parent}}_processInputParams(e){return{status:new R8,ctx:{common:e.parent.common,data:e.data,parsedType:O8(e.data),schemaErrorMap:this._def.errorMap,path:e.path,parent:e.parent}}}_parseSync(e){let t=this._parse(e);if(G8(t))throw Error(`Synchronous parse encountered promise.`);return t}_parseAsync(e){let t=this._parse(e);return Promise.resolve(t)}parse(e,t){let n=this.safeParse(e,t);if(n.success)return n.data;throw n.error}safeParse(e,t){let n={common:{issues:[],async:t?.async??!1,contextualErrorMap:t?.errorMap},path:t?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:e,parsedType:O8(e)};return Z8(n,this._parseSync({data:e,path:n.path,parent:n}))}"~validate"(e){let t={common:{issues:[],async:!!this[`~standard`].async},path:[],schemaErrorMap:this._def.errorMap,parent:null,data:e,parsedType:O8(e)};if(!this[`~standard`].async)try{let n=this._parseSync({data:e,path:[],parent:t});return W8(n)?{value:n.value}:{issues:t.common.issues}}catch(e){e?.message?.toLowerCase()?.includes(`encountered`)&&(this[`~standard`].async=!0),t.common={issues:[],async:!0}}return this._parseAsync({data:e,path:[],parent:t}).then(e=>W8(e)?{value:e.value}:{issues:t.common.issues})}async parseAsync(e,t){let n=await this.safeParseAsync(e,t);if(n.success)return n.data;throw n.error}async safeParseAsync(e,t){let n={common:{issues:[],contextualErrorMap:t?.errorMap,async:!0},path:t?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:e,parsedType:O8(e)},r=this._parse({data:e,path:n.path,parent:n});return Z8(n,await(G8(r)?r:Promise.resolve(r)))}refine(e,t){let n=e=>typeof t==`string`||t===void 0?{message:t}:typeof t==`function`?t(e):t;return this._refinement((t,r)=>{let i=e(t),a=()=>r.addIssue({code:A8.custom,...n(t)});return typeof Promise<`u`&&i instanceof Promise?i.then(e=>e?!0:(a(),!1)):i?!0:(a(),!1)})}refinement(e,t){return this._refinement((n,r)=>e(n)?!0:(r.addIssue(typeof t==`function`?t(n,r):t),!1))}_refinement(e){return new T5({schema:this,typeName:P5.ZodEffects,effect:{type:`refinement`,refinement:e}})}superRefine(e){return this._refinement(e)}constructor(e){this.spa=this.safeParseAsync,this._def=e,this.parse=this.parse.bind(this),this.safeParse=this.safeParse.bind(this),this.parseAsync=this.parseAsync.bind(this),this.safeParseAsync=this.safeParseAsync.bind(this),this.spa=this.spa.bind(this),this.refine=this.refine.bind(this),this.refinement=this.refinement.bind(this),this.superRefine=this.superRefine.bind(this),this.optional=this.optional.bind(this),this.nullable=this.nullable.bind(this),this.nullish=this.nullish.bind(this),this.array=this.array.bind(this),this.promise=this.promise.bind(this),this.or=this.or.bind(this),this.and=this.and.bind(this),this.transform=this.transform.bind(this),this.brand=this.brand.bind(this),this.default=this.default.bind(this),this.catch=this.catch.bind(this),this.describe=this.describe.bind(this),this.pipe=this.pipe.bind(this),this.readonly=this.readonly.bind(this),this.isNullable=this.isNullable.bind(this),this.isOptional=this.isOptional.bind(this),this[`~standard`]={version:1,vendor:`zod`,validate:e=>this[`~validate`](e)}}optional(){return E5.create(this,this._def)}nullable(){return D5.create(this,this._def)}nullish(){return this.nullable().optional()}array(){return f5.create(this)}promise(){return w5.create(this,this._def)}or(e){return m5.create([this,e],this._def)}and(e){return g5.create(this,e,this._def)}transform(e){return new T5({...q8(this._def),schema:this,typeName:P5.ZodEffects,effect:{type:`transform`,transform:e}})}default(e){let t=typeof e==`function`?e:()=>e;return new O5({...q8(this._def),innerType:this,defaultValue:t,typeName:P5.ZodDefault})}brand(){return new j5({typeName:P5.ZodBranded,type:this,...q8(this._def)})}catch(e){let t=typeof e==`function`?e:()=>e;return new k5({...q8(this._def),innerType:this,catchValue:t,typeName:P5.ZodCatch})}describe(e){let t=this.constructor;return new t({...this._def,description:e})}pipe(e){return M5.create(this,e)}readonly(){return N5.create(this)}isOptional(){return this.safeParse(void 0).success}isNullable(){return this.safeParse(null).success}},Zcn=/^c[^\s-]{8,}$/i,Qcn=/^[0-9a-z]+$/,$cn=/^[0-9A-HJKMNP-TV-Z]{26}$/i,eln=/^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$/i,tln=/^[a-z0-9_-]{21}$/i,nln=/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/,rln=/^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/,iln=/^(?!\.)(?!.*\.\.)([A-Z0-9_'+\-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i,aln=`^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`,sln=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,cln=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/(3[0-2]|[12]?[0-9])$/,lln=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/,uln=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,dln=/^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/,fln=/^([0-9a-zA-Z-_]{4})*(([0-9a-zA-Z-_]{2}(==)?)|([0-9a-zA-Z-_]{3}(=)?))?$/,$8=`((\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\\d|3[01])|(0[469]|11)-(0[1-9]|[12]\\d|30)|(02)-(0[1-9]|1\\d|2[0-8])))`,pln=RegExp(`^${$8}$`),e5=class e extends Q8{_parse(e){if(this._def.coerce&&(e.data=String(e.data)),this._getType(e)!==D8.string){let t=this._getOrReturnCtx(e);return I8(t,{code:A8.invalid_type,expected:D8.string,received:t.parsedType}),z8}let t=new R8,n;for(let r of this._def.checks)if(r.kind===`min`)e.data.length<r.value&&(n=this._getOrReturnCtx(e,n),I8(n,{code:A8.too_small,minimum:r.value,type:`string`,inclusive:!0,exact:!1,message:r.message}),t.dirty());else if(r.kind===`max`)e.data.length>r.value&&(n=this._getOrReturnCtx(e,n),I8(n,{code:A8.too_big,maximum:r.value,type:`string`,inclusive:!0,exact:!1,message:r.message}),t.dirty());else if(r.kind===`length`){let i=e.data.length>r.value,a=e.data.length<r.value;(i||a)&&(n=this._getOrReturnCtx(e,n),i?I8(n,{code:A8.too_big,maximum:r.value,type:`string`,inclusive:!0,exact:!0,message:r.message}):a&&I8(n,{code:A8.too_small,minimum:r.value,type:`string`,inclusive:!0,exact:!0,message:r.message}),t.dirty())}else if(r.kind===`email`)iln.test(e.data)||(n=this._getOrReturnCtx(e,n),I8(n,{validation:`email`,code:A8.invalid_string,message:r.message}),t.dirty());else if(r.kind===`emoji`)oln||=new RegExp(aln,`u`),oln.test(e.data)||(n=this._getOrReturnCtx(e,n),I8(n,{validation:`emoji`,code:A8.invalid_string,message:r.message}),t.dirty());else if(r.kind===`uuid`)eln.test(e.data)||(n=this._getOrReturnCtx(e,n),I8(n,{validation:`uuid`,code:A8.invalid_string,message:r.message}),t.dirty());else if(r.kind===`nanoid`)tln.test(e.data)||(n=this._getOrReturnCtx(e,n),I8(n,{validation:`nanoid`,code:A8.invalid_string,message:r.message}),t.dirty());else if(r.kind===`cuid`)Zcn.test(e.data)||(n=this._getOrReturnCtx(e,n),I8(n,{validation:`cuid`,code:A8.invalid_string,message:r.message}),t.dirty());else if(r.kind===`cuid2`)Qcn.test(e.data)||(n=this._getOrReturnCtx(e,n),I8(n,{validation:`cuid2`,code:A8.invalid_string,message:r.message}),t.dirty());else if(r.kind===`ulid`)$cn.test(e.data)||(n=this._getOrReturnCtx(e,n),I8(n,{validation:`ulid`,code:A8.invalid_string,message:r.message}),t.dirty());else if(r.kind===`url`)try{new URL(e.data)}catch{n=this._getOrReturnCtx(e,n),I8(n,{validation:`url`,code:A8.invalid_string,message:r.message}),t.dirty()}else r.kind===`regex`?(r.regex.lastIndex=0,r.regex.test(e.data)||(n=this._getOrReturnCtx(e,n),I8(n,{validation:`regex`,code:A8.invalid_string,message:r.message}),t.dirty())):r.kind===`trim`?e.data=e.data.trim():r.kind===`includes`?e.data.includes(r.value,r.position)||(n=this._getOrReturnCtx(e,n),I8(n,{code:A8.invalid_string,validation:{includes:r.value,position:r.position},message:r.message}),t.dirty()):r.kind===`toLowerCase`?e.data=e.data.toLowerCase():r.kind===`toUpperCase`?e.data=e.data.toUpperCase():r.kind===`startsWith`?e.data.startsWith(r.value)||(n=this._getOrReturnCtx(e,n),I8(n,{code:A8.invalid_string,validation:{startsWith:r.value},message:r.message}),t.dirty()):r.kind===`endsWith`?e.data.endsWith(r.value)||(n=this._getOrReturnCtx(e,n),I8(n,{code:A8.invalid_string,validation:{endsWith:r.value},message:r.message}),t.dirty()):r.kind===`datetime`?Gcn(r).test(e.data)||(n=this._getOrReturnCtx(e,n),I8(n,{code:A8.invalid_string,validation:`datetime`,message:r.message}),t.dirty()):r.kind===`date`?pln.test(e.data)||(n=this._getOrReturnCtx(e,n),I8(n,{code:A8.invalid_string,validation:`date`,message:r.message}),t.dirty()):r.kind===`time`?Wcn(r).test(e.data)||(n=this._getOrReturnCtx(e,n),I8(n,{code:A8.invalid_string,validation:`time`,message:r.message}),t.dirty()):r.kind===`duration`?rln.test(e.data)||(n=this._getOrReturnCtx(e,n),I8(n,{validation:`duration`,code:A8.invalid_string,message:r.message}),t.dirty()):r.kind===`ip`?Kcn(e.data,r.version)||(n=this._getOrReturnCtx(e,n),I8(n,{validation:`ip`,code:A8.invalid_string,message:r.message}),t.dirty()):r.kind===`jwt`?qcn(e.data,r.alg)||(n=this._getOrReturnCtx(e,n),I8(n,{validation:`jwt`,code:A8.invalid_string,message:r.message}),t.dirty()):r.kind===`cidr`?Jcn(e.data,r.version)||(n=this._getOrReturnCtx(e,n),I8(n,{validation:`cidr`,code:A8.invalid_string,message:r.message}),t.dirty()):r.kind===`base64`?dln.test(e.data)||(n=this._getOrReturnCtx(e,n),I8(n,{validation:`base64`,code:A8.invalid_string,message:r.message}),t.dirty()):r.kind===`base64url`?fln.test(e.data)||(n=this._getOrReturnCtx(e,n),I8(n,{validation:`base64url`,code:A8.invalid_string,message:r.message}),t.dirty()):E8.assertNever(r);return{status:t.value,value:e.data}}_regex(e,t,n){return this.refinement(t=>e.test(t),{validation:t,code:A8.invalid_string,...K8.errToObj(n)})}_addCheck(t){return new e({...this._def,checks:[...this._def.checks,t]})}email(e){return this._addCheck({kind:`email`,...K8.errToObj(e)})}url(e){return this._addCheck({kind:`url`,...K8.errToObj(e)})}emoji(e){return this._addCheck({kind:`emoji`,...K8.errToObj(e)})}uuid(e){return this._addCheck({kind:`uuid`,...K8.errToObj(e)})}nanoid(e){return this._addCheck({kind:`nanoid`,...K8.errToObj(e)})}cuid(e){return this._addCheck({kind:`cuid`,...K8.errToObj(e)})}cuid2(e){return this._addCheck({kind:`cuid2`,...K8.errToObj(e)})}ulid(e){return this._addCheck({kind:`ulid`,...K8.errToObj(e)})}base64(e){return this._addCheck({kind:`base64`,...K8.errToObj(e)})}base64url(e){return this._addCheck({kind:`base64url`,...K8.errToObj(e)})}jwt(e){return this._addCheck({kind:`jwt`,...K8.errToObj(e)})}ip(e){return this._addCheck({kind:`ip`,...K8.errToObj(e)})}cidr(e){return this._addCheck({kind:`cidr`,...K8.errToObj(e)})}datetime(e){return typeof e==`string`?this._addCheck({kind:`datetime`,precision:null,offset:!1,local:!1,message:e}):this._addCheck({kind:`datetime`,precision:e?.precision===void 0?null:e?.precision,offset:e?.offset??!1,local:e?.local??!1,...K8.errToObj(e?.message)})}date(e){return this._addCheck({kind:`date`,message:e})}time(e){return typeof e==`string`?this._addCheck({kind:`time`,precision:null,message:e}):this._addCheck({kind:`time`,precision:e?.precision===void 0?null:e?.precision,...K8.errToObj(e?.message)})}duration(e){return this._addCheck({kind:`duration`,...K8.errToObj(e)})}regex(e,t){return this._addCheck({kind:`regex`,regex:e,...K8.errToObj(t)})}includes(e,t){return this._addCheck({kind:`includes`,value:e,position:t?.position,...K8.errToObj(t?.message)})}startsWith(e,t){return this._addCheck({kind:`startsWith`,value:e,...K8.errToObj(t)})}endsWith(e,t){return this._addCheck({kind:`endsWith`,value:e,...K8.errToObj(t)})}min(e,t){return this._addCheck({kind:`min`,value:e,...K8.errToObj(t)})}max(e,t){return this._addCheck({kind:`max`,value:e,...K8.errToObj(t)})}length(e,t){return this._addCheck({kind:`length`,value:e,...K8.errToObj(t)})}nonempty(e){return this.min(1,K8.errToObj(e))}trim(){return new e({...this._def,checks:[...this._def.checks,{kind:`trim`}]})}toLowerCase(){return new e({...this._def,checks:[...this._def.checks,{kind:`toLowerCase`}]})}toUpperCase(){return new e({...this._def,checks:[...this._def.checks,{kind:`toUpperCase`}]})}get isDatetime(){return!!this._def.checks.find(e=>e.kind===`datetime`)}get isDate(){return!!this._def.checks.find(e=>e.kind===`date`)}get isTime(){return!!this._def.checks.find(e=>e.kind===`time`)}get isDuration(){return!!this._def.checks.find(e=>e.kind===`duration`)}get isEmail(){return!!this._def.checks.find(e=>e.kind===`email`)}get isURL(){return!!this._def.checks.find(e=>e.kind===`url`)}get isEmoji(){return!!this._def.checks.find(e=>e.kind===`emoji`)}get isUUID(){return!!this._def.checks.find(e=>e.kind===`uuid`)}get isNANOID(){return!!this._def.checks.find(e=>e.kind===`nanoid`)}get isCUID(){return!!this._def.checks.find(e=>e.kind===`cuid`)}get isCUID2(){return!!this._def.checks.find(e=>e.kind===`cuid2`)}get isULID(){return!!this._def.checks.find(e=>e.kind===`ulid`)}get isIP(){return!!this._def.checks.find(e=>e.kind===`ip`)}get isCIDR(){return!!this._def.checks.find(e=>e.kind===`cidr`)}get isBase64(){return!!this._def.checks.find(e=>e.kind===`base64`)}get isBase64url(){return!!this._def.checks.find(e=>e.kind===`base64url`)}get minLength(){let e=null;for(let t of this._def.checks)t.kind===`min`&&(e===null||t.value>e)&&(e=t.value);return e}get maxLength(){let e=null;for(let t of this._def.checks)t.kind===`max`&&(e===null||t.value<e)&&(e=t.value);return e}},e5.create=e=>new e5({checks:[],typeName:P5.ZodString,coerce:e?.coerce??!1,...q8(e)}),t5=class e extends Q8{constructor(){super(...arguments),this.min=this.gte,this.max=this.lte,this.step=this.multipleOf}_parse(e){if(this._def.coerce&&(e.data=Number(e.data)),this._getType(e)!==D8.number){let t=this._getOrReturnCtx(e);return I8(t,{code:A8.invalid_type,expected:D8.number,received:t.parsedType}),z8}let t,n=new R8;for(let r of this._def.checks)r.kind===`int`?E8.isInteger(e.data)||(t=this._getOrReturnCtx(e,t),I8(t,{code:A8.invalid_type,expected:`integer`,received:`float`,message:r.message}),n.dirty()):r.kind===`min`?(r.inclusive?e.data<r.value:e.data<=r.value)&&(t=this._getOrReturnCtx(e,t),I8(t,{code:A8.too_small,minimum:r.value,type:`number`,inclusive:r.inclusive,exact:!1,message:r.message}),n.dirty()):r.kind===`max`?(r.inclusive?e.data>r.value:e.data>=r.value)&&(t=this._getOrReturnCtx(e,t),I8(t,{code:A8.too_big,maximum:r.value,type:`number`,inclusive:r.inclusive,exact:!1,message:r.message}),n.dirty()):r.kind===`multipleOf`?Ycn(e.data,r.value)!==0&&(t=this._getOrReturnCtx(e,t),I8(t,{code:A8.not_multiple_of,multipleOf:r.value,message:r.message}),n.dirty()):r.kind===`finite`?Number.isFinite(e.data)||(t=this._getOrReturnCtx(e,t),I8(t,{code:A8.not_finite,message:r.message}),n.dirty()):E8.assertNever(r);return{status:n.value,value:e.data}}gte(e,t){return this.setLimit(`min`,e,!0,K8.toString(t))}gt(e,t){return this.setLimit(`min`,e,!1,K8.toString(t))}lte(e,t){return this.setLimit(`max`,e,!0,K8.toString(t))}lt(e,t){return this.setLimit(`max`,e,!1,K8.toString(t))}setLimit(t,n,r,i){return new e({...this._def,checks:[...this._def.checks,{kind:t,value:n,inclusive:r,message:K8.toString(i)}]})}_addCheck(t){return new e({...this._def,checks:[...this._def.checks,t]})}int(e){return this._addCheck({kind:`int`,message:K8.toString(e)})}positive(e){return this._addCheck({kind:`min`,value:0,inclusive:!1,message:K8.toString(e)})}negative(e){return this._addCheck({kind:`max`,value:0,inclusive:!1,message:K8.toString(e)})}nonpositive(e){return this._addCheck({kind:`max`,value:0,inclusive:!0,message:K8.toString(e)})}nonnegative(e){return this._addCheck({kind:`min`,value:0,inclusive:!0,message:K8.toString(e)})}multipleOf(e,t){return this._addCheck({kind:`multipleOf`,value:e,message:K8.toString(t)})}finite(e){return this._addCheck({kind:`finite`,message:K8.toString(e)})}safe(e){return this._addCheck({kind:`min`,inclusive:!0,value:-(2**53-1),message:K8.toString(e)})._addCheck({kind:`max`,inclusive:!0,value:2**53-1,message:K8.toString(e)})}get minValue(){let e=null;for(let t of this._def.checks)t.kind===`min`&&(e===null||t.value>e)&&(e=t.value);return e}get maxValue(){let e=null;for(let t of this._def.checks)t.kind===`max`&&(e===null||t.value<e)&&(e=t.value);return e}get isInt(){return!!this._def.checks.find(e=>e.kind===`int`||e.kind===`multipleOf`&&E8.isInteger(e.value))}get isFinite(){let e=null,t=null;for(let n of this._def.checks)if(n.kind===`finite`||n.kind===`int`||n.kind===`multipleOf`)return!0;else n.kind===`min`?(t===null||n.value>t)&&(t=n.value):n.kind===`max`&&(e===null||n.value<e)&&(e=n.value);return Number.isFinite(t)&&Number.isFinite(e)}},t5.create=e=>new t5({checks:[],typeName:P5.ZodNumber,coerce:e?.coerce||!1,...q8(e)}),n5=class e extends Q8{constructor(){super(...arguments),this.min=this.gte,this.max=this.lte}_parse(e){if(this._def.coerce)try{e.data=BigInt(e.data)}catch{return this._getInvalidInput(e)}if(this._getType(e)!==D8.bigint)return this._getInvalidInput(e);let t,n=new R8;for(let r of this._def.checks)r.kind===`min`?(r.inclusive?e.data<r.value:e.data<=r.value)&&(t=this._getOrReturnCtx(e,t),I8(t,{code:A8.too_small,type:`bigint`,minimum:r.value,inclusive:r.inclusive,message:r.message}),n.dirty()):r.kind===`max`?(r.inclusive?e.data>r.value:e.data>=r.value)&&(t=this._getOrReturnCtx(e,t),I8(t,{code:A8.too_big,type:`bigint`,maximum:r.value,inclusive:r.inclusive,message:r.message}),n.dirty()):r.kind===`multipleOf`?e.data%r.value!==BigInt(0)&&(t=this._getOrReturnCtx(e,t),I8(t,{code:A8.not_multiple_of,multipleOf:r.value,message:r.message}),n.dirty()):E8.assertNever(r);return{status:n.value,value:e.data}}_getInvalidInput(e){let t=this._getOrReturnCtx(e);return I8(t,{code:A8.invalid_type,expected:D8.bigint,received:t.parsedType}),z8}gte(e,t){return this.setLimit(`min`,e,!0,K8.toString(t))}gt(e,t){return this.setLimit(`min`,e,!1,K8.toString(t))}lte(e,t){return this.setLimit(`max`,e,!0,K8.toString(t))}lt(e,t){return this.setLimit(`max`,e,!1,K8.toString(t))}setLimit(t,n,r,i){return new e({...this._def,checks:[...this._def.checks,{kind:t,value:n,inclusive:r,message:K8.toString(i)}]})}_addCheck(t){return new e({...this._def,checks:[...this._def.checks,t]})}positive(e){return this._addCheck({kind:`min`,value:BigInt(0),inclusive:!1,message:K8.toString(e)})}negative(e){return this._addCheck({kind:`max`,value:BigInt(0),inclusive:!1,message:K8.toString(e)})}nonpositive(e){return this._addCheck({kind:`max`,value:BigInt(0),inclusive:!0,message:K8.toString(e)})}nonnegative(e){return this._addCheck({kind:`min`,value:BigInt(0),inclusive:!0,message:K8.toString(e)})}multipleOf(e,t){return this._addCheck({kind:`multipleOf`,value:e,message:K8.toString(t)})}get minValue(){let e=null;for(let t of this._def.checks)t.kind===`min`&&(e===null||t.value>e)&&(e=t.value);return e}get maxValue(){let e=null;for(let t of this._def.checks)t.kind===`max`&&(e===null||t.value<e)&&(e=t.value);return e}},n5.create=e=>new n5({checks:[],typeName:P5.ZodBigInt,coerce:e?.coerce??!1,...q8(e)}),r5=class extends Q8{_parse(e){if(this._def.coerce&&(e.data=!!e.data),this._getType(e)!==D8.boolean){let t=this._getOrReturnCtx(e);return I8(t,{code:A8.invalid_type,expected:D8.boolean,received:t.parsedType}),z8}return V8(e.data)}},r5.create=e=>new r5({typeName:P5.ZodBoolean,coerce:e?.coerce||!1,...q8(e)}),i5=class e extends Q8{_parse(e){if(this._def.coerce&&(e.data=new Date(e.data)),this._getType(e)!==D8.date){let t=this._getOrReturnCtx(e);return I8(t,{code:A8.invalid_type,expected:D8.date,received:t.parsedType}),z8}if(Number.isNaN(e.data.getTime()))return I8(this._getOrReturnCtx(e),{code:A8.invalid_date}),z8;let t=new R8,n;for(let r of this._def.checks)r.kind===`min`?e.data.getTime()<r.value&&(n=this._getOrReturnCtx(e,n),I8(n,{code:A8.too_small,message:r.message,inclusive:!0,exact:!1,minimum:r.value,type:`date`}),t.dirty()):r.kind===`max`?e.data.getTime()>r.value&&(n=this._getOrReturnCtx(e,n),I8(n,{code:A8.too_big,message:r.message,inclusive:!0,exact:!1,maximum:r.value,type:`date`}),t.dirty()):E8.assertNever(r);return{status:t.value,value:new Date(e.data.getTime())}}_addCheck(t){return new e({...this._def,checks:[...this._def.checks,t]})}min(e,t){return this._addCheck({kind:`min`,value:e.getTime(),message:K8.toString(t)})}max(e,t){return this._addCheck({kind:`max`,value:e.getTime(),message:K8.toString(t)})}get minDate(){let e=null;for(let t of this._def.checks)t.kind===`min`&&(e===null||t.value>e)&&(e=t.value);return e==null?null:new Date(e)}get maxDate(){let e=null;for(let t of this._def.checks)t.kind===`max`&&(e===null||t.value<e)&&(e=t.value);return e==null?null:new Date(e)}},i5.create=e=>new i5({checks:[],coerce:e?.coerce||!1,typeName:P5.ZodDate,...q8(e)}),a5=class extends Q8{_parse(e){if(this._getType(e)!==D8.symbol){let t=this._getOrReturnCtx(e);return I8(t,{code:A8.invalid_type,expected:D8.symbol,received:t.parsedType}),z8}return V8(e.data)}},a5.create=e=>new a5({typeName:P5.ZodSymbol,...q8(e)}),o5=class extends Q8{_parse(e){if(this._getType(e)!==D8.undefined){let t=this._getOrReturnCtx(e);return I8(t,{code:A8.invalid_type,expected:D8.undefined,received:t.parsedType}),z8}return V8(e.data)}},o5.create=e=>new o5({typeName:P5.ZodUndefined,...q8(e)}),s5=class extends Q8{_parse(e){if(this._getType(e)!==D8.null){let t=this._getOrReturnCtx(e);return I8(t,{code:A8.invalid_type,expected:D8.null,received:t.parsedType}),z8}return V8(e.data)}},s5.create=e=>new s5({typeName:P5.ZodNull,...q8(e)}),c5=class extends Q8{constructor(){super(...arguments),this._any=!0}_parse(e){return V8(e.data)}},c5.create=e=>new c5({typeName:P5.ZodAny,...q8(e)}),l5=class extends Q8{constructor(){super(...arguments),this._unknown=!0}_parse(e){return V8(e.data)}},l5.create=e=>new l5({typeName:P5.ZodUnknown,...q8(e)}),u5=class extends Q8{_parse(e){let t=this._getOrReturnCtx(e);return I8(t,{code:A8.invalid_type,expected:D8.never,received:t.parsedType}),z8}},u5.create=e=>new u5({typeName:P5.ZodNever,...q8(e)}),d5=class extends Q8{_parse(e){if(this._getType(e)!==D8.undefined){let t=this._getOrReturnCtx(e);return I8(t,{code:A8.invalid_type,expected:D8.void,received:t.parsedType}),z8}return V8(e.data)}},d5.create=e=>new d5({typeName:P5.ZodVoid,...q8(e)}),f5=class e extends Q8{_parse(e){let{ctx:t,status:n}=this._processInputParams(e),r=this._def;if(t.parsedType!==D8.array)return I8(t,{code:A8.invalid_type,expected:D8.array,received:t.parsedType}),z8;if(r.exactLength!==null){let e=t.data.length>r.exactLength.value,i=t.data.length<r.exactLength.value;(e||i)&&(I8(t,{code:e?A8.too_big:A8.too_small,minimum:i?r.exactLength.value:void 0,maximum:e?r.exactLength.value:void 0,type:`array`,inclusive:!0,exact:!0,message:r.exactLength.message}),n.dirty())}if(r.minLength!==null&&t.data.length<r.minLength.value&&(I8(t,{code:A8.too_small,minimum:r.minLength.value,type:`array`,inclusive:!0,exact:!1,message:r.minLength.message}),n.dirty()),r.maxLength!==null&&t.data.length>r.maxLength.value&&(I8(t,{code:A8.too_big,maximum:r.maxLength.value,type:`array`,inclusive:!0,exact:!1,message:r.maxLength.message}),n.dirty()),t.common.async)return Promise.all([...t.data].map((e,n)=>r.type._parseAsync(new X8(t,e,t.path,n)))).then(e=>R8.mergeArray(n,e));let i=[...t.data].map((e,n)=>r.type._parseSync(new X8(t,e,t.path,n)));return R8.mergeArray(n,i)}get element(){return this._def.type}min(t,n){return new e({...this._def,minLength:{value:t,message:K8.toString(n)}})}max(t,n){return new e({...this._def,maxLength:{value:t,message:K8.toString(n)}})}length(t,n){return new e({...this._def,exactLength:{value:t,message:K8.toString(n)}})}nonempty(e){return this.min(1,e)}},f5.create=(e,t)=>new f5({type:e,minLength:null,maxLength:null,exactLength:null,typeName:P5.ZodArray,...q8(t)}),p5=class e extends Q8{constructor(){super(...arguments),this._cached=null,this.nonstrict=this.passthrough,this.augment=this.extend}_getCached(){if(this._cached!==null)return this._cached;let e=this._def.shape();return this._cached={shape:e,keys:E8.objectKeys(e)},this._cached}_parse(e){if(this._getType(e)!==D8.object){let t=this._getOrReturnCtx(e);return I8(t,{code:A8.invalid_type,expected:D8.object,received:t.parsedType}),z8}let{status:t,ctx:n}=this._processInputParams(e),{shape:r,keys:i}=this._getCached(),a=[];if(!(this._def.catchall instanceof u5&&this._def.unknownKeys===`strip`))for(let e in n.data)i.includes(e)||a.push(e);let o=[];for(let e of i){let t=r[e],i=n.data[e];o.push({key:{status:`valid`,value:e},value:t._parse(new X8(n,i,n.path,e)),alwaysSet:e in n.data})}if(this._def.catchall instanceof u5){let e=this._def.unknownKeys;if(e===`passthrough`)for(let e of a)o.push({key:{status:`valid`,value:e},value:{status:`valid`,value:n.data[e]}});else if(e===`strict`)a.length>0&&(I8(n,{code:A8.unrecognized_keys,keys:a}),t.dirty());else if(e!==`strip`)throw Error(`Internal ZodObject error: invalid unknownKeys value.`)}else{let e=this._def.catchall;for(let t of a){let r=n.data[t];o.push({key:{status:`valid`,value:t},value:e._parse(new X8(n,r,n.path,t)),alwaysSet:t in n.data})}}return n.common.async?Promise.resolve().then(async()=>{let e=[];for(let t of o){let n=await t.key,r=await t.value;e.push({key:n,value:r,alwaysSet:t.alwaysSet})}return e}).then(e=>R8.mergeObjectSync(t,e)):R8.mergeObjectSync(t,o)}get shape(){return this._def.shape()}strict(t){return K8.errToObj,new e({...this._def,unknownKeys:`strict`,...t===void 0?{}:{errorMap:(e,n)=>{let r=this._def.errorMap?.(e,n).message??n.defaultError;return e.code===`unrecognized_keys`?{message:K8.errToObj(t).message??r}:{message:r}}}})}strip(){return new e({...this._def,unknownKeys:`strip`})}passthrough(){return new e({...this._def,unknownKeys:`passthrough`})}extend(t){return new e({...this._def,shape:()=>({...this._def.shape(),...t})})}merge(t){return new e({unknownKeys:t._def.unknownKeys,catchall:t._def.catchall,shape:()=>({...this._def.shape(),...t._def.shape()}),typeName:P5.ZodObject})}setKey(e,t){return this.augment({[e]:t})}catchall(t){return new e({...this._def,catchall:t})}pick(t){let n={};for(let e of E8.objectKeys(t))t[e]&&this.shape[e]&&(n[e]=this.shape[e]);return new e({...this._def,shape:()=>n})}omit(t){let n={};for(let e of E8.objectKeys(this.shape))t[e]||(n[e]=this.shape[e]);return new e({...this._def,shape:()=>n})}deepPartial(){return J8(this)}partial(t){let n={};for(let e of E8.objectKeys(this.shape)){let r=this.shape[e];t&&!t[e]?n[e]=r:n[e]=r.optional()}return new e({...this._def,shape:()=>n})}required(t){let n={};for(let e of E8.objectKeys(this.shape))if(t&&!t[e])n[e]=this.shape[e];else{let t=this.shape[e];for(;t instanceof E5;)t=t._def.innerType;n[e]=t}return new e({...this._def,shape:()=>n})}keyof(){return Xcn(E8.objectKeys(this.shape))}},p5.create=(e,t)=>new p5({shape:()=>e,unknownKeys:`strip`,catchall:u5.create(),typeName:P5.ZodObject,...q8(t)}),p5.strictCreate=(e,t)=>new p5({shape:()=>e,unknownKeys:`strict`,catchall:u5.create(),typeName:P5.ZodObject,...q8(t)}),p5.lazycreate=(e,t)=>new p5({shape:e,unknownKeys:`strip`,catchall:u5.create(),typeName:P5.ZodObject,...q8(t)}),m5=class extends Q8{_parse(e){let{ctx:t}=this._processInputParams(e),n=this._def.options;function r(e){for(let t of e)if(t.result.status===`valid`)return t.result;for(let n of e)if(n.result.status===`dirty`)return t.common.issues.push(...n.ctx.common.issues),n.result;let n=e.map(e=>new j8(e.ctx.common.issues));return I8(t,{code:A8.invalid_union,unionErrors:n}),z8}if(t.common.async)return Promise.all(n.map(async e=>{let n={...t,common:{...t.common,issues:[]},parent:null};return{result:await e._parseAsync({data:t.data,path:t.path,parent:n}),ctx:n}})).then(r);{let e,r=[];for(let i of n){let n={...t,common:{...t.common,issues:[]},parent:null},a=i._parseSync({data:t.data,path:t.path,parent:n});if(a.status===`valid`)return a;a.status===`dirty`&&!e&&(e={result:a,ctx:n}),n.common.issues.length&&r.push(n.common.issues)}if(e)return t.common.issues.push(...e.ctx.common.issues),e.result;let i=r.map(e=>new j8(e));return I8(t,{code:A8.invalid_union,unionErrors:i}),z8}}get options(){return this._def.options}},m5.create=(e,t)=>new m5({options:e,typeName:P5.ZodUnion,...q8(t)}),h5=e=>e instanceof b5?h5(e.schema):e instanceof T5?h5(e.innerType()):e instanceof x5?[e.value]:e instanceof S5?e.options:e instanceof C5?E8.objectValues(e.enum):e instanceof O5?h5(e._def.innerType):e instanceof o5?[void 0]:e instanceof s5?[null]:e instanceof E5?[void 0,...h5(e.unwrap())]:e instanceof D5?[null,...h5(e.unwrap())]:e instanceof j5||e instanceof N5?h5(e.unwrap()):e instanceof k5?h5(e._def.innerType):[],mln=class e extends Q8{_parse(e){let{ctx:t}=this._processInputParams(e);if(t.parsedType!==D8.object)return I8(t,{code:A8.invalid_type,expected:D8.object,received:t.parsedType}),z8;let n=this.discriminator,r=t.data[n],i=this.optionsMap.get(r);return i?t.common.async?i._parseAsync({data:t.data,path:t.path,parent:t}):i._parseSync({data:t.data,path:t.path,parent:t}):(I8(t,{code:A8.invalid_union_discriminator,options:Array.from(this.optionsMap.keys()),path:[n]}),z8)}get discriminator(){return this._def.discriminator}get options(){return this._def.options}get optionsMap(){return this._def.optionsMap}static create(t,n,r){let i=new Map;for(let e of n){let n=h5(e.shape[t]);if(!n.length)throw Error(`A discriminator value for key \`${t}\` could not be extracted from all schema options`);for(let r of n){if(i.has(r))throw Error(`Discriminator property ${String(t)} has duplicate value ${String(r)}`);i.set(r,e)}}return new e({typeName:P5.ZodDiscriminatedUnion,discriminator:t,options:n,optionsMap:i,...q8(r)})}},g5=class extends Q8{_parse(e){let{status:t,ctx:n}=this._processInputParams(e),r=(e,r)=>{if(H8(e)||H8(r))return z8;let i=Y8(e.value,r.value);return i.valid?((U8(e)||U8(r))&&t.dirty(),{status:t.value,value:i.data}):(I8(n,{code:A8.invalid_intersection_types}),z8)};return n.common.async?Promise.all([this._def.left._parseAsync({data:n.data,path:n.path,parent:n}),this._def.right._parseAsync({data:n.data,path:n.path,parent:n})]).then(([e,t])=>r(e,t)):r(this._def.left._parseSync({data:n.data,path:n.path,parent:n}),this._def.right._parseSync({data:n.data,path:n.path,parent:n}))}},g5.create=(e,t,n)=>new g5({left:e,right:t,typeName:P5.ZodIntersection,...q8(n)}),_5=class e extends Q8{_parse(e){let{status:t,ctx:n}=this._processInputParams(e);if(n.parsedType!==D8.array)return I8(n,{code:A8.invalid_type,expected:D8.array,received:n.parsedType}),z8;if(n.data.length<this._def.items.length)return I8(n,{code:A8.too_small,minimum:this._def.items.length,inclusive:!0,exact:!1,type:`array`}),z8;!this._def.rest&&n.data.length>this._def.items.length&&(I8(n,{code:A8.too_big,maximum:this._def.items.length,inclusive:!0,exact:!1,type:`array`}),t.dirty());let r=[...n.data].map((e,t)=>{let r=this._def.items[t]||this._def.rest;return r?r._parse(new X8(n,e,n.path,t)):null}).filter(e=>!!e);return n.common.async?Promise.all(r).then(e=>R8.mergeArray(t,e)):R8.mergeArray(t,r)}get items(){return this._def.items}rest(t){return new e({...this._def,rest:t})}},_5.create=(e,t)=>{if(!Array.isArray(e))throw Error(`You must pass an array of schemas to z.tuple([ ... ])`);return new _5({items:e,typeName:P5.ZodTuple,rest:null,...q8(t)})},hln=class e extends Q8{get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse(e){let{status:t,ctx:n}=this._processInputParams(e);if(n.parsedType!==D8.object)return I8(n,{code:A8.invalid_type,expected:D8.object,received:n.parsedType}),z8;let r=[],i=this._def.keyType,a=this._def.valueType;for(let e in n.data)r.push({key:i._parse(new X8(n,e,n.path,e)),value:a._parse(new X8(n,n.data[e],n.path,e)),alwaysSet:e in n.data});return n.common.async?R8.mergeObjectAsync(t,r):R8.mergeObjectSync(t,r)}get element(){return this._def.valueType}static create(t,n,r){return n instanceof Q8?new e({keyType:t,valueType:n,typeName:P5.ZodRecord,...q8(r)}):new e({keyType:e5.create(),valueType:t,typeName:P5.ZodRecord,...q8(n)})}},v5=class extends Q8{get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse(e){let{status:t,ctx:n}=this._processInputParams(e);if(n.parsedType!==D8.map)return I8(n,{code:A8.invalid_type,expected:D8.map,received:n.parsedType}),z8;let r=this._def.keyType,i=this._def.valueType,a=[...n.data.entries()].map(([e,t],a)=>({key:r._parse(new X8(n,e,n.path,[a,`key`])),value:i._parse(new X8(n,t,n.path,[a,`value`]))}));if(n.common.async){let e=new Map;return Promise.resolve().then(async()=>{for(let n of a){let r=await n.key,i=await n.value;if(r.status===`aborted`||i.status===`aborted`)return z8;(r.status===`dirty`||i.status===`dirty`)&&t.dirty(),e.set(r.value,i.value)}return{status:t.value,value:e}})}else{let e=new Map;for(let n of a){let r=n.key,i=n.value;if(r.status===`aborted`||i.status===`aborted`)return z8;(r.status===`dirty`||i.status===`dirty`)&&t.dirty(),e.set(r.value,i.value)}return{status:t.value,value:e}}}},v5.create=(e,t,n)=>new v5({valueType:t,keyType:e,typeName:P5.ZodMap,...q8(n)}),y5=class e extends Q8{_parse(e){let{status:t,ctx:n}=this._processInputParams(e);if(n.parsedType!==D8.set)return I8(n,{code:A8.invalid_type,expected:D8.set,received:n.parsedType}),z8;let r=this._def;r.minSize!==null&&n.data.size<r.minSize.value&&(I8(n,{code:A8.too_small,minimum:r.minSize.value,type:`set`,inclusive:!0,exact:!1,message:r.minSize.message}),t.dirty()),r.maxSize!==null&&n.data.size>r.maxSize.value&&(I8(n,{code:A8.too_big,maximum:r.maxSize.value,type:`set`,inclusive:!0,exact:!1,message:r.maxSize.message}),t.dirty());let i=this._def.valueType;function a(e){let n=new Set;for(let r of e){if(r.status===`aborted`)return z8;r.status===`dirty`&&t.dirty(),n.add(r.value)}return{status:t.value,value:n}}let o=[...n.data.values()].map((e,t)=>i._parse(new X8(n,e,n.path,t)));return n.common.async?Promise.all(o).then(e=>a(e)):a(o)}min(t,n){return new e({...this._def,minSize:{value:t,message:K8.toString(n)}})}max(t,n){return new e({...this._def,maxSize:{value:t,message:K8.toString(n)}})}size(e,t){return this.min(e,t).max(e,t)}nonempty(e){return this.min(1,e)}},y5.create=(e,t)=>new y5({valueType:e,minSize:null,maxSize:null,typeName:P5.ZodSet,...q8(t)}),gln=class e extends Q8{constructor(){super(...arguments),this.validate=this.implement}_parse(e){let{ctx:t}=this._processInputParams(e);if(t.parsedType!==D8.function)return I8(t,{code:A8.invalid_type,expected:D8.function,received:t.parsedType}),z8;function n(e,n){return L8({data:e,path:t.path,errorMaps:[t.common.contextualErrorMap,t.schemaErrorMap,P8(),N8].filter(e=>!!e),issueData:{code:A8.invalid_arguments,argumentsError:n}})}function r(e,n){return L8({data:e,path:t.path,errorMaps:[t.common.contextualErrorMap,t.schemaErrorMap,P8(),N8].filter(e=>!!e),issueData:{code:A8.invalid_return_type,returnTypeError:n}})}let i={errorMap:t.common.contextualErrorMap},a=t.data;if(this._def.returns instanceof w5){let e=this;return V8(async function(...t){let o=new j8([]),s=await e._def.args.parseAsync(t,i).catch(e=>{throw o.addIssue(n(t,e)),o}),c=await Reflect.apply(a,this,s);return await e._def.returns._def.type.parseAsync(c,i).catch(e=>{throw o.addIssue(r(c,e)),o})})}else{let e=this;return V8(function(...t){let o=e._def.args.safeParse(t,i);if(!o.success)throw new j8([n(t,o.error)]);let s=Reflect.apply(a,this,o.data),c=e._def.returns.safeParse(s,i);if(!c.success)throw new j8([r(s,c.error)]);return c.data})}}parameters(){return this._def.args}returnType(){return this._def.returns}args(...t){return new e({...this._def,args:_5.create(t).rest(l5.create())})}returns(t){return new e({...this._def,returns:t})}implement(e){return this.parse(e)}strictImplement(e){return this.parse(e)}static create(t,n,r){return new e({args:t||_5.create([]).rest(l5.create()),returns:n||l5.create(),typeName:P5.ZodFunction,...q8(r)})}},b5=class extends Q8{get schema(){return this._def.getter()}_parse(e){let{ctx:t}=this._processInputParams(e);return this._def.getter()._parse({data:t.data,path:t.path,parent:t})}},b5.create=(e,t)=>new b5({getter:e,typeName:P5.ZodLazy,...q8(t)}),x5=class extends Q8{_parse(e){if(e.data!==this._def.value){let t=this._getOrReturnCtx(e);return I8(t,{received:t.data,code:A8.invalid_literal,expected:this._def.value}),z8}return{status:`valid`,value:e.data}}get value(){return this._def.value}},x5.create=(e,t)=>new x5({value:e,typeName:P5.ZodLiteral,...q8(t)}),S5=class e extends Q8{_parse(e){if(typeof e.data!=`string`){let t=this._getOrReturnCtx(e),n=this._def.values;return I8(t,{expected:E8.joinValues(n),received:t.parsedType,code:A8.invalid_type}),z8}if(this._cache||=new Set(this._def.values),!this._cache.has(e.data)){let t=this._getOrReturnCtx(e),n=this._def.values;return I8(t,{received:t.data,code:A8.invalid_enum_value,options:n}),z8}return V8(e.data)}get options(){return this._def.values}get enum(){let e={};for(let t of this._def.values)e[t]=t;return e}get Values(){let e={};for(let t of this._def.values)e[t]=t;return e}get Enum(){let e={};for(let t of this._def.values)e[t]=t;return e}extract(t,n=this._def){return e.create(t,{...this._def,...n})}exclude(t,n=this._def){return e.create(this.options.filter(e=>!t.includes(e)),{...this._def,...n})}},S5.create=Xcn,C5=class extends Q8{_parse(e){let t=E8.getValidEnumValues(this._def.values),n=this._getOrReturnCtx(e);if(n.parsedType!==D8.string&&n.parsedType!==D8.number){let e=E8.objectValues(t);return I8(n,{expected:E8.joinValues(e),received:n.parsedType,code:A8.invalid_type}),z8}if(this._cache||=new Set(E8.getValidEnumValues(this._def.values)),!this._cache.has(e.data)){let e=E8.objectValues(t);return I8(n,{received:n.data,code:A8.invalid_enum_value,options:e}),z8}return V8(e.data)}get enum(){return this._def.values}},C5.create=(e,t)=>new C5({values:e,typeName:P5.ZodNativeEnum,...q8(t)}),w5=class extends Q8{unwrap(){return this._def.type}_parse(e){let{ctx:t}=this._processInputParams(e);return t.parsedType!==D8.promise&&t.common.async===!1?(I8(t,{code:A8.invalid_type,expected:D8.promise,received:t.parsedType}),z8):V8((t.parsedType===D8.promise?t.data:Promise.resolve(t.data)).then(e=>this._def.type.parseAsync(e,{path:t.path,errorMap:t.common.contextualErrorMap})))}},w5.create=(e,t)=>new w5({type:e,typeName:P5.ZodPromise,...q8(t)}),T5=class extends Q8{innerType(){return this._def.schema}sourceType(){return this._def.schema._def.typeName===P5.ZodEffects?this._def.schema.sourceType():this._def.schema}_parse(e){let{status:t,ctx:n}=this._processInputParams(e),r=this._def.effect||null,i={addIssue:e=>{I8(n,e),e.fatal?t.abort():t.dirty()},get path(){return n.path}};if(i.addIssue=i.addIssue.bind(i),r.type===`preprocess`){let e=r.transform(n.data,i);if(n.common.async)return Promise.resolve(e).then(async e=>{if(t.value===`aborted`)return z8;let r=await this._def.schema._parseAsync({data:e,path:n.path,parent:n});return r.status===`aborted`?z8:r.status===`dirty`||t.value===`dirty`?B8(r.value):r});{if(t.value===`aborted`)return z8;let r=this._def.schema._parseSync({data:e,path:n.path,parent:n});return r.status===`aborted`?z8:r.status===`dirty`||t.value===`dirty`?B8(r.value):r}}if(r.type===`refinement`){let e=e=>{let t=r.refinement(e,i);if(n.common.async)return Promise.resolve(t);if(t instanceof Promise)throw Error(`Async refinement encountered during synchronous parse operation. Use .parseAsync instead.`);return e};if(n.common.async===!1){let r=this._def.schema._parseSync({data:n.data,path:n.path,parent:n});return r.status===`aborted`?z8:(r.status===`dirty`&&t.dirty(),e(r.value),{status:t.value,value:r.value})}else return this._def.schema._parseAsync({data:n.data,path:n.path,parent:n}).then(n=>n.status===`aborted`?z8:(n.status===`dirty`&&t.dirty(),e(n.value).then(()=>({status:t.value,value:n.value}))))}if(r.type===`transform`)if(n.common.async===!1){let e=this._def.schema._parseSync({data:n.data,path:n.path,parent:n});if(!W8(e))return z8;let a=r.transform(e.value,i);if(a instanceof Promise)throw Error(`Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.`);return{status:t.value,value:a}}else return this._def.schema._parseAsync({data:n.data,path:n.path,parent:n}).then(e=>W8(e)?Promise.resolve(r.transform(e.value,i)).then(e=>({status:t.value,value:e})):z8);E8.assertNever(r)}},T5.create=(e,t,n)=>new T5({schema:e,typeName:P5.ZodEffects,effect:t,...q8(n)}),T5.createWithPreprocess=(e,t,n)=>new T5({schema:t,effect:{type:`preprocess`,transform:e},typeName:P5.ZodEffects,...q8(n)}),E5=class extends Q8{_parse(e){return this._getType(e)===D8.undefined?V8(void 0):this._def.innerType._parse(e)}unwrap(){return this._def.innerType}},E5.create=(e,t)=>new E5({innerType:e,typeName:P5.ZodOptional,...q8(t)}),D5=class extends Q8{_parse(e){return this._getType(e)===D8.null?V8(null):this._def.innerType._parse(e)}unwrap(){return this._def.innerType}},D5.create=(e,t)=>new D5({innerType:e,typeName:P5.ZodNullable,...q8(t)}),O5=class extends Q8{_parse(e){let{ctx:t}=this._processInputParams(e),n=t.data;return t.parsedType===D8.undefined&&(n=this._def.defaultValue()),this._def.innerType._parse({data:n,path:t.path,parent:t})}removeDefault(){return this._def.innerType}},O5.create=(e,t)=>new O5({innerType:e,typeName:P5.ZodDefault,defaultValue:typeof t.default==`function`?t.default:()=>t.default,...q8(t)}),k5=class extends Q8{_parse(e){let{ctx:t}=this._processInputParams(e),n={...t,common:{...t.common,issues:[]}},r=this._def.innerType._parse({data:n.data,path:n.path,parent:{...n}});return G8(r)?r.then(e=>({status:`valid`,value:e.status===`valid`?e.value:this._def.catchValue({get error(){return new j8(n.common.issues)},input:n.data})})):{status:`valid`,value:r.status===`valid`?r.value:this._def.catchValue({get error(){return new j8(n.common.issues)},input:n.data})}}removeCatch(){return this._def.innerType}},k5.create=(e,t)=>new k5({innerType:e,typeName:P5.ZodCatch,catchValue:typeof t.catch==`function`?t.catch:()=>t.catch,...q8(t)}),A5=class extends Q8{_parse(e){if(this._getType(e)!==D8.nan){let t=this._getOrReturnCtx(e);return I8(t,{code:A8.invalid_type,expected:D8.nan,received:t.parsedType}),z8}return{status:`valid`,value:e.data}}},A5.create=e=>new A5({typeName:P5.ZodNaN,...q8(e)}),j5=class extends Q8{_parse(e){let{ctx:t}=this._processInputParams(e),n=t.data;return this._def.type._parse({data:n,path:t.path,parent:t})}unwrap(){return this._def.type}},M5=class e extends Q8{_parse(e){let{status:t,ctx:n}=this._processInputParams(e);if(n.common.async)return(async()=>{let e=await this._def.in._parseAsync({data:n.data,path:n.path,parent:n});return e.status===`aborted`?z8:e.status===`dirty`?(t.dirty(),B8(e.value)):this._def.out._parseAsync({data:e.value,path:n.path,parent:n})})();{let e=this._def.in._parseSync({data:n.data,path:n.path,parent:n});return e.status===`aborted`?z8:e.status===`dirty`?(t.dirty(),{status:`dirty`,value:e.value}):this._def.out._parseSync({data:e.value,path:n.path,parent:n})}}static create(t,n){return new e({in:t,out:n,typeName:P5.ZodPipeline})}},N5=class extends Q8{_parse(e){let t=this._def.innerType._parse(e),n=e=>(W8(e)&&(e.value=Object.freeze(e.value)),e);return G8(t)?t.then(e=>n(e)):n(t)}unwrap(){return this._def.innerType}},N5.create=(e,t)=>new N5({innerType:e,typeName:P5.ZodReadonly,...q8(t)}),p5.lazycreate,(function(e){e.ZodString=`ZodString`,e.ZodNumber=`ZodNumber`,e.ZodNaN=`ZodNaN`,e.ZodBigInt=`ZodBigInt`,e.ZodBoolean=`ZodBoolean`,e.ZodDate=`ZodDate`,e.ZodSymbol=`ZodSymbol`,e.ZodUndefined=`ZodUndefined`,e.ZodNull=`ZodNull`,e.ZodAny=`ZodAny`,e.ZodUnknown=`ZodUnknown`,e.ZodNever=`ZodNever`,e.ZodVoid=`ZodVoid`,e.ZodArray=`ZodArray`,e.ZodObject=`ZodObject`,e.ZodUnion=`ZodUnion`,e.ZodDiscriminatedUnion=`ZodDiscriminatedUnion`,e.ZodIntersection=`ZodIntersection`,e.ZodTuple=`ZodTuple`,e.ZodRecord=`ZodRecord`,e.ZodMap=`ZodMap`,e.ZodSet=`ZodSet`,e.ZodFunction=`ZodFunction`,e.ZodLazy=`ZodLazy`,e.ZodLiteral=`ZodLiteral`,e.ZodEnum=`ZodEnum`,e.ZodEffects=`ZodEffects`,e.ZodNativeEnum=`ZodNativeEnum`,e.ZodOptional=`ZodOptional`,e.ZodNullable=`ZodNullable`,e.ZodDefault=`ZodDefault`,e.ZodCatch=`ZodCatch`,e.ZodPromise=`ZodPromise`,e.ZodBranded=`ZodBranded`,e.ZodPipeline=`ZodPipeline`,e.ZodReadonly=`ZodReadonly`})(P5||={}),e5.create,t5.create,A5.create,n5.create,r5.create,i5.create,a5.create,o5.create,s5.create,c5.create,l5.create,u5.create,d5.create,f5.create,p5.create,p5.strictCreate,m5.create,mln.create,g5.create,_5.create,hln.create,v5.create,y5.create,gln.create,b5.create,x5.create,S5.create,C5.create,w5.create,T5.create,E5.create,D5.create,T5.createWithPreprocess,M5.create})),vln=s((()=>{F8(),Bcn(),Vcn(),k8(),_ln(),M8()})),yln=s((()=>{vln()}));function F5(e){}function bln(e){if(typeof e==`function`)throw TypeError("`callbacks` must be an object, got a function instead. Did you mean `{onEvent: fn}`?");let{onEvent:t=F5,onError:n=F5,onRetry:r=F5,onComment:i}=e,a=``,o=!0,s,c=``,l=``;function u(e){let t=o?e.replace(/^\xEF\xBB\xBF/,``):e,[n,r]=xln(`${a}${t}`);for(let e of n)d(e);a=r,o=!1}function d(e){if(e===``){p();return}if(e.startsWith(`:`)){i&&i(e.slice(e.startsWith(`: `)?2:1));return}let t=e.indexOf(`:`);if(t!==-1){let n=e.slice(0,t),r=e[t+1]===` `?2:1;f(n,e.slice(t+r),e);return}f(e,``,e)}function f(e,t,i){switch(e){case`event`:l=t;break;case`data`:c=`${c}${t}
-`;break;case`id`:s=t.includes(`\0`)?void 0:t;break;case`retry`:/^\d+$/.test(t)?r(parseInt(t,10)):n(new I5(`Invalid \`retry\` value: "${t}"`,{type:`invalid-retry`,value:t,line:i}));break;default:n(new I5(`Unknown field "${e.length>20?`${e.slice(0,20)}\u2026`:e}"`,{type:`unknown-field`,field:e,value:t,line:i}));break}}function p(){c.length>0&&t({id:s,event:l||void 0,data:c.endsWith(`
-`)?c.slice(0,-1):c}),s=void 0,c=``,l=``}function m(e={}){a&&e.consume&&d(a),o=!0,s=void 0,c=``,l=``,a=``}return{feed:u,reset:m}}function xln(e){let t=[],n=``,r=0;for(;r<e.length;){let i=e.indexOf(`\r`,r),a=e.indexOf(`
-`,r),o=-1;if(i!==-1&&a!==-1?o=Math.min(i,a):i===-1?a!==-1&&(o=a):o=i===e.length-1?-1:i,o===-1){n=e.slice(r);break}else{let n=e.slice(r,o);t.push(n),r=o+1,e[r-1]===`\r`&&e[r]===`
-`&&r++}}return[t,n]}var I5,Sln=s((()=>{I5=class extends Error{constructor(e,t){super(e),this.name=`ParseError`,this.type=t.type,this.field=t.field,this.value=t.value,this.line=t.line}}})),Cln,wln=s((()=>{Sln(),Cln=class extends TransformStream{constructor({onError:e,onRetry:t,onComment:n}={}){let r;super({start(i){r=bln({onEvent:e=>{i.enqueue(e)},onError(t){e===`terminate`?i.error(t):typeof e==`function`&&e(t)},onRetry:t,onComment:n})},transform(e){r.feed(e)}})}}})),Tln=s((()=>{}));function Eln(e=globalThis){return e.window?`runtime/browser`:e.navigator?.userAgent?`runtime/${e.navigator.userAgent.toLowerCase()}`:e.process?.versions?.node?`runtime/node.js/${e.process.version.substring(0)}`:e.EdgeRuntime?`runtime/vercel-edge`:`runtime/unknown`}function L5(e){if(e==null)return{};let t={};if(e instanceof Headers)e.forEach((e,n)=>{t[n.toLowerCase()]=e});else{Array.isArray(e)||(e=Object.entries(e));for(let[n,r]of e)r!=null&&(t[n.toLowerCase()]=r)}return t}function Dln(e,...t){let n=new Headers(L5(e)),r=n.get(`user-agent`)||``;return n.set(`user-agent`,[r,...t].filter(Boolean).join(` `)),Object.fromEntries(n.entries())}function Oln(e){let t=JSON.parse(e);return typeof t!=`object`||!t||yun.test(e)===!1&&bun.test(e)===!1?t:kln(t)}function kln(e){let t=[e];for(;t.length;){let e=t;t=[];for(let n of e){if(Object.prototype.hasOwnProperty.call(n,`__proto__`)||Object.prototype.hasOwnProperty.call(n,`constructor`)&&Object.prototype.hasOwnProperty.call(n.constructor,`prototype`))throw SyntaxError(`Object contains forbidden prototype property`);for(let e in n){let r=n[e];r&&typeof r==`object`&&t.push(r)}}}return e}function Aln(e){let{stackTraceLimit:t}=Error;try{Error.stackTraceLimit=0}catch{return Oln(e)}try{return Oln(e)}finally{Error.stackTraceLimit=t}}function R5(e){if(e.type===`object`||Array.isArray(e.type)&&e.type.includes(`object`)){e.additionalProperties=!1;let{properties:t}=e;if(t!=null)for(let e of Object.keys(t))t[e]=z5(t[e])}e.items!=null&&(e.items=Array.isArray(e.items)?e.items.map(z5):z5(e.items)),e.anyOf!=null&&(e.anyOf=e.anyOf.map(z5)),e.allOf!=null&&(e.allOf=e.allOf.map(z5)),e.oneOf!=null&&(e.oneOf=e.oneOf.map(z5));let{definitions:t}=e;if(t!=null)for(let e of Object.keys(t))t[e]=z5(t[e]);return e}function z5(e){return typeof e==`boolean`?e:R5(e)}function B5(){return{}}function jln(e,t){let n={type:`array`};return e.type?._def&&e.type?._def?.typeName!==P5.ZodAny&&(n.items=W5(e.type._def,{...t,currentPath:[...t.currentPath,`items`]})),e.minLength&&(n.minItems=e.minLength.value),e.maxLength&&(n.maxItems=e.maxLength.value),e.exactLength&&(n.minItems=e.exactLength.value,n.maxItems=e.exactLength.value),n}function Mln(e){let t={type:`integer`,format:`int64`};if(!e.checks)return t;for(let n of e.checks)switch(n.kind){case`min`:n.inclusive?t.minimum=n.value:t.exclusiveMinimum=n.value;break;case`max`:n.inclusive?t.maximum=n.value:t.exclusiveMaximum=n.value;break;case`multipleOf`:t.multipleOf=n.value;break}return t}function Nln(){return{type:`boolean`}}function Pln(e,t){return W5(e.type._def,t)}function Fln(e,t,n){let r=n??t.dateStrategy;if(Array.isArray(r))return{anyOf:r.map((n,r)=>Fln(e,t,n))};switch(r){case`string`:case`format:date-time`:return{type:`string`,format:`date-time`};case`format:date`:return{type:`string`,format:`date`};case`integer`:return wun(e)}}function Iln(e,t){return{...W5(e.innerType._def,t),default:e.defaultValue()}}function Lln(e,t){return t.effectStrategy===`input`?W5(e.schema._def,t):B5()}function Rln(e){return{type:`string`,enum:Array.from(e.values)}}function zln(e,t){let n=[W5(e.left._def,{...t,currentPath:[...t.currentPath,`allOf`,`0`]}),W5(e.right._def,{...t,currentPath:[...t.currentPath,`allOf`,`1`]})].filter(e=>!!e),r=[];return n.forEach(e=>{if(Tun(e))r.push(...e.allOf);else{let t=e;if(`additionalProperties`in e&&e.additionalProperties===!1){let{additionalProperties:n,...r}=e;t=r}r.push(t)}}),r.length?{allOf:r}:void 0}function Bln(e){let t=typeof e.value;return t!==`bigint`&&t!==`number`&&t!==`boolean`&&t!==`string`?{type:Array.isArray(e.value)?`array`:`object`}:{type:t===`bigint`?`integer`:t,const:e.value}}function Vln(e,t){let n={type:`string`};if(e.checks)for(let r of e.checks)switch(r.kind){case`min`:n.minLength=typeof n.minLength==`number`?Math.max(n.minLength,r.value):r.value;break;case`max`:n.maxLength=typeof n.maxLength==`number`?Math.min(n.maxLength,r.value):r.value;break;case`email`:switch(t.emailStrategy){case`format:email`:H5(n,`email`,r.message,t);break;case`format:idn-email`:H5(n,`idn-email`,r.message,t);break;case`pattern:zod`:U5(n,$5.email,r.message,t);break}break;case`url`:H5(n,`uri`,r.message,t);break;case`uuid`:H5(n,`uuid`,r.message,t);break;case`regex`:U5(n,r.regex,r.message,t);break;case`cuid`:U5(n,$5.cuid,r.message,t);break;case`cuid2`:U5(n,$5.cuid2,r.message,t);break;case`startsWith`:U5(n,RegExp(`^${V5(r.value,t)}`),r.message,t);break;case`endsWith`:U5(n,RegExp(`${V5(r.value,t)}$`),r.message,t);break;case`datetime`:H5(n,`date-time`,r.message,t);break;case`date`:H5(n,`date`,r.message,t);break;case`time`:H5(n,`time`,r.message,t);break;case`duration`:H5(n,`duration`,r.message,t);break;case`length`:n.minLength=typeof n.minLength==`number`?Math.max(n.minLength,r.value):r.value,n.maxLength=typeof n.maxLength==`number`?Math.min(n.maxLength,r.value):r.value;break;case`includes`:U5(n,RegExp(V5(r.value,t)),r.message,t);break;case`ip`:r.version!==`v6`&&H5(n,`ipv4`,r.message,t),r.version!==`v4`&&H5(n,`ipv6`,r.message,t);break;case`base64url`:U5(n,$5.base64url,r.message,t);break;case`jwt`:U5(n,$5.jwt,r.message,t);break;case`cidr`:r.version!==`v6`&&U5(n,$5.ipv4Cidr,r.message,t),r.version!==`v4`&&U5(n,$5.ipv6Cidr,r.message,t);break;case`emoji`:U5(n,$5.emoji(),r.message,t);break;case`ulid`:U5(n,$5.ulid,r.message,t);break;case`base64`:switch(t.base64Strategy){case`format:binary`:H5(n,`binary`,r.message,t);break;case`contentEncoding:base64`:n.contentEncoding=`base64`;break;case`pattern:zod`:U5(n,$5.base64,r.message,t);break}break;case`nanoid`:U5(n,$5.nanoid,r.message,t);case`toLowerCase`:case`toUpperCase`:case`trim`:break;default:}return n}function V5(e,t){return t.patternStrategy===`escape`?Hln(e):e}function Hln(e){let t=``;for(let n=0;n<e.length;n++)Eun.has(e[n])||(t+=`\\`),t+=e[n];return t}function H5(e,t,n,r){e.format||e.anyOf?.some(e=>e.format)?(e.anyOf||=[],e.format&&(e.anyOf.push({format:e.format}),delete e.format),e.anyOf.push({format:t,...n&&r.errorMessages&&{errorMessage:{format:n}}})):e.format=t}function U5(e,t,n,r){e.pattern||e.allOf?.some(e=>e.pattern)?(e.allOf||=[],e.pattern&&(e.allOf.push({pattern:e.pattern}),delete e.pattern),e.allOf.push({pattern:Uln(t,r),...n&&r.errorMessages&&{errorMessage:{pattern:n}}})):e.pattern=Uln(t,r)}function Uln(e,t){if(!t.applyRegexFlags||!e.flags)return e.source;let n={i:e.flags.includes(`i`),m:e.flags.includes(`m`),s:e.flags.includes(`s`)},r=n.i?e.source.toLowerCase():e.source,i=``,a=!1,o=!1,s=!1;for(let e=0;e<r.length;e++){if(a){i+=r[e],a=!1;continue}if(n.i){if(o){if(r[e].match(/[a-z]/)){s?(i+=r[e],i+=`${r[e-2]}-${r[e]}`.toUpperCase(),s=!1):r[e+1]===`-`&&r[e+2]?.match(/[a-z]/)?(i+=r[e],s=!0):i+=`${r[e]}${r[e].toUpperCase()}`;continue}}else if(r[e].match(/[a-z]/)){i+=`[${r[e]}${r[e].toUpperCase()}]`;continue}}if(n.m){if(r[e]===`^`){i+=`(^|(?<=[\r
-]))`;continue}else if(r[e]===`$`){i+=`($|(?=[\r
-]))`;continue}}if(n.s&&r[e]===`.`){i+=o?`${r[e]}\r
-`:`[${r[e]}\r
-]`;continue}i+=r[e],r[e]===`\\`?a=!0:o&&r[e]===`]`?o=!1:!o&&r[e]===`[`&&(o=!0)}try{new RegExp(i)}catch{return console.warn(`Could not convert regex pattern at ${t.currentPath.join(`/`)} to a flag-independent form! Falling back to the flag-ignorant source`),e.source}return i}function Wln(e,t){let n={type:`object`,additionalProperties:W5(e.valueType._def,{...t,currentPath:[...t.currentPath,`additionalProperties`]})??t.allowedAdditionalProperties};if(e.keyType?._def.typeName===P5.ZodString&&e.keyType._def.checks?.length){let{type:r,...i}=Vln(e.keyType._def,t);return{...n,propertyNames:i}}else if(e.keyType?._def.typeName===P5.ZodEnum)return{...n,propertyNames:{enum:e.keyType._def.values}};else if(e.keyType?._def.typeName===P5.ZodBranded&&e.keyType._def.type._def.typeName===P5.ZodString&&e.keyType._def.type._def.checks?.length){let{type:r,...i}=Pln(e.keyType._def,t);return{...n,propertyNames:i}}return n}function Gln(e,t){return t.mapStrategy===`record`?Wln(e,t):{type:`array`,maxItems:125,items:{type:`array`,items:[W5(e.keyType._def,{...t,currentPath:[...t.currentPath,`items`,`items`,`0`]})||B5(),W5(e.valueType._def,{...t,currentPath:[...t.currentPath,`items`,`items`,`1`]})||B5()],minItems:2,maxItems:2}}}function Kln(e){let t=e.values,n=Object.keys(e.values).filter(e=>typeof t[t[e]]!=`number`).map(e=>t[e]),r=Array.from(new Set(n.map(e=>typeof e)));return{type:r.length===1?r[0]===`string`?`string`:`number`:[`string`,`number`],enum:n}}function qln(){return{not:B5()}}function Jln(){return{type:`null`}}function Yln(e,t){let n=e.options instanceof Map?Array.from(e.options.values()):e.options;if(n.every(e=>e._def.typeName in e7&&(!e._def.checks||!e._def.checks.length))){let e=n.reduce((e,t)=>{let n=e7[t._def.typeName];return n&&!e.includes(n)?[...e,n]:e},[]);return{type:e.length>1?e:e[0]}}else if(n.every(e=>e._def.typeName===`ZodLiteral`&&!e.description)){let e=n.reduce((e,t)=>{let n=typeof t._def.value;switch(n){case`string`:case`number`:case`boolean`:return[...e,n];case`bigint`:return[...e,`integer`];case`object`:if(t._def.value===null)return[...e,`null`];default:return e}},[]);if(e.length===n.length){let t=e.filter((e,t,n)=>n.indexOf(e)===t);return{type:t.length>1?t:t[0],enum:n.reduce((e,t)=>e.includes(t._def.value)?e:[...e,t._def.value],[])}}}else if(n.every(e=>e._def.typeName===`ZodEnum`))return{type:`string`,enum:n.reduce((e,t)=>[...e,...t._def.values.filter(t=>!e.includes(t))],[])};return Dun(e,t)}function Xln(e,t){if([`ZodString`,`ZodNumber`,`ZodBigInt`,`ZodBoolean`,`ZodNull`].includes(e.innerType._def.typeName)&&(!e.innerType._def.checks||!e.innerType._def.checks.length))return{type:[e7[e.innerType._def.typeName],`null`]};let n=W5(e.innerType._def,{...t,currentPath:[...t.currentPath,`anyOf`,`0`]});return n&&{anyOf:[n,{type:`null`}]}}function Zln(e){let t={type:`number`};if(!e.checks)return t;for(let n of e.checks)switch(n.kind){case`int`:t.type=`integer`;break;case`min`:n.inclusive?t.minimum=n.value:t.exclusiveMinimum=n.value;break;case`max`:n.inclusive?t.maximum=n.value:t.exclusiveMaximum=n.value;break;case`multipleOf`:t.multipleOf=n.value;break}return t}function Qln(e,t){let n={type:`object`,properties:{}},r=[],i=e.shape();for(let e in i){let a=i[e];if(a===void 0||a._def===void 0)continue;let o=eun(a),s=W5(a._def,{...t,currentPath:[...t.currentPath,`properties`,e],propertyPath:[...t.currentPath,`properties`,e]});s!==void 0&&(n.properties[e]=s,o||r.push(e))}r.length&&(n.required=r);let a=$ln(e,t);return a!==void 0&&(n.additionalProperties=a),n}function $ln(e,t){if(e.catchall._def.typeName!==`ZodNever`)return W5(e.catchall._def,{...t,currentPath:[...t.currentPath,`additionalProperties`]});switch(e.unknownKeys){case`passthrough`:return t.allowedAdditionalProperties;case`strict`:return t.rejectedAdditionalProperties;case`strip`:return t.removeAdditionalStrategy===`strict`?t.allowedAdditionalProperties:t.rejectedAdditionalProperties}}function eun(e){try{return e.isOptional()}catch{return!0}}function tun(e,t){return W5(e.type._def,t)}function nun(e,t){let n={type:`array`,uniqueItems:!0,items:W5(e.valueType._def,{...t,currentPath:[...t.currentPath,`items`]})};return e.minSize&&(n.minItems=e.minSize.value),e.maxSize&&(n.maxItems=e.maxSize.value),n}function run(e,t){return e.rest?{type:`array`,minItems:e.items.length,items:e.items.map((e,n)=>W5(e._def,{...t,currentPath:[...t.currentPath,`items`,`${n}`]})).reduce((e,t)=>t===void 0?e:[...e,t],[]),additionalItems:W5(e.rest._def,{...t,currentPath:[...t.currentPath,`additionalItems`]})}:{type:`array`,minItems:e.items.length,maxItems:e.items.length,items:e.items.map((e,n)=>W5(e._def,{...t,currentPath:[...t.currentPath,`items`,`${n}`]})).reduce((e,t)=>t===void 0?e:[...e,t],[])}}function iun(){return{not:B5()}}function aun(){return B5()}function W5(e,t,n=!1){let r=t.seen.get(e);if(t.override){let i=t.override?.call(t,e,t,r,n);if(i!==xun)return i}if(r&&!n){let e=Nun(r,t);if(e!==void 0)return e}let i={def:e,path:t.currentPath,jsonSchema:void 0};t.seen.set(e,i);let a=jun(e,e.typeName,t),o=typeof a==`function`?W5(a(),t):a;if(o&&Pun(e,t,o),t.postProcess){let n=t.postProcess(o,e,t);return i.jsonSchema=o,n}return i.jsonSchema=o,o}function oun(e){let t;return()=>(t??=e(),t)}function G5(e,{validate:t}={}){return{[t7]:!0,_type:void 0,get jsonSchema(){return typeof e==`function`&&(e=e()),e},validate:t}}function sun(e){return typeof e==`object`&&!!e&&t7 in e&&e[t7]===!0&&`jsonSchema`in e&&`validate`in e}function K5(e){return e==null?G5({properties:{},additionalProperties:!1}):sun(e)?e:`~standard`in e?e[`~standard`].vendor===`zod`?fun(e):cun(e):e()}function cun(e){return G5(()=>R5(e[`~standard`].jsonSchema.input({target:`draft-07`})),{validate:async t=>{let n=await e[`~standard`].validate(t);return`value`in n?{success:!0,value:n.value}:{success:!1,error:new T8({value:t,cause:n.issues})}}})}function lun(e,t){let n=t?.useReferences??!1;return G5(()=>Iun(e,{$refStrategy:n?`root`:`none`}),{validate:async t=>{let n=await e.safeParseAsync(t);return n.success?{success:!0,value:n.data}:{success:!1,error:n.error}}})}function uun(e,t){let n=t?.useReferences??!1;return G5(()=>R5(ZHt(e,{target:`draft-7`,io:`input`,reused:n?`ref`:`inline`})),{validate:async t=>{let n=await dQ(e,t);return n.success?{success:!0,value:n.data}:{success:!1,error:n.error}}})}function dun(e){return`_zod`in e}function fun(e,t){return dun(e)?uun(e,t):lun(e,t)}async function pun({value:e,schema:t}){let n=await q5({value:e,schema:t});if(!n.success)throw T8.wrap({value:e,cause:n.error});return n.value}async function q5({value:e,schema:t}){let n=K5(t);try{if(n.validate==null)return{success:!0,value:e,rawValue:e};let t=await n.validate(e);return t.success?{success:!0,value:t.value,rawValue:e}:{success:!1,error:T8.wrap({value:e,cause:t.error}),rawValue:e}}catch(t){return{success:!1,error:T8.wrap({value:e,cause:t}),rawValue:e}}}async function J5({text:e,schema:t}){try{let n=Aln(e);return t==null?{success:!0,value:n,rawValue:n}:await q5({value:n,schema:t})}catch(t){return{success:!1,error:S8.isInstance(t)?t:new S8({text:e,cause:t}),rawValue:void 0}}}function mun({stream:e,schema:t}){return e.pipeThrough(new TextDecoderStream).pipeThrough(new Cln).pipeThrough(new TransformStream({async transform({data:e},n){e!==`[DONE]`&&n.enqueue(await J5({text:e,schema:t}))}}))}async function Y5(e){return typeof e==`function`&&(e=e()),Promise.resolve(e)}var hun,gun,_un,X5,vun,yun,bun,xun,Z5,Sun,Cun,wun,Tun,Q5,$5,Eun,e7,Dun,Oun,kun,Aun,jun,Mun,Nun,Pun,Fun,Iun,t7,Lun=s((()=>{Pcn(),Icn(),yln(),wln(),Tln(),{btoa:hun,atob:gun}=globalThis,_un=`AI_DownloadError`,`${_un}`,X5=({prefix:e,size:t=16,alphabet:n=`0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz`,separator:r=`-`}={})=>{let i=()=>{let e=n.length,r=Array(t);for(let i=0;i<t;i++)r[i]=n[Math.random()*e|0];return r.join(``)};if(e==null)return i;if(n.includes(r))throw new ycn({argument:`separator`,message:`The separator "${r}" must not be part of the alphabet "${n}".`});return()=>`${e}${r}${i()}`},vun=X5(),yun=/"__proto__"\s*:/,bun=/"constructor"\s*:/,xun=Symbol(`Let zodToJsonSchema decide on which parser to use`),Z5={name:void 0,$refStrategy:`root`,basePath:[`#`],effectStrategy:`input`,pipeStrategy:`all`,dateStrategy:`format:date-time`,mapStrategy:`entries`,removeAdditionalStrategy:`passthrough`,allowedAdditionalProperties:!0,rejectedAdditionalProperties:!1,definitionPath:`definitions`,strictUnions:!1,definitions:{},errorMessages:!1,patternStrategy:`escape`,applyRegexFlags:!1,emailStrategy:`format:email`,base64Strategy:`contentEncoding:base64`,nameStrategy:`ref`},Sun=e=>typeof e==`string`?{...Z5,name:e}:{...Z5,...e},Cun=(e,t)=>W5(e.innerType._def,t),wun=e=>{let t={type:`integer`,format:`unix-time`};for(let n of e.checks)switch(n.kind){case`min`:t.minimum=n.value;break;case`max`:t.maximum=n.value;break}return t},Tun=e=>`type`in e&&e.type===`string`?!1:`allOf`in e,Q5=void 0,$5={cuid:/^[cC][^\s-]{8,}$/,cuid2:/^[0-9a-z]+$/,ulid:/^[0-9A-HJKMNP-TV-Z]{26}$/,email:/^(?!\.)(?!.*\.\.)([a-zA-Z0-9_'+\-\.]*)[a-zA-Z0-9_+-]@([a-zA-Z0-9][a-zA-Z0-9\-]*\.)+[a-zA-Z]{2,}$/,emoji:()=>(Q5===void 0&&(Q5=RegExp(`^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`,`u`)),Q5),uuid:/^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$/,ipv4:/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,ipv4Cidr:/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/(3[0-2]|[12]?[0-9])$/,ipv6:/^(([a-f0-9]{1,4}:){7}|::([a-f0-9]{1,4}:){0,6}|([a-f0-9]{1,4}:){1}:([a-f0-9]{1,4}:){0,5}|([a-f0-9]{1,4}:){2}:([a-f0-9]{1,4}:){0,4}|([a-f0-9]{1,4}:){3}:([a-f0-9]{1,4}:){0,3}|([a-f0-9]{1,4}:){4}:([a-f0-9]{1,4}:){0,2}|([a-f0-9]{1,4}:){5}:([a-f0-9]{1,4}:){0,1})([a-f0-9]{1,4}|(((25[0-5])|(2[0-4][0-9])|(1[0-9]{2})|([0-9]{1,2}))\.){3}((25[0-5])|(2[0-4][0-9])|(1[0-9]{2})|([0-9]{1,2})))$/,ipv6Cidr:/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,base64:/^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/,base64url:/^([0-9a-zA-Z-_]{4})*(([0-9a-zA-Z-_]{2}(==)?)|([0-9a-zA-Z-_]{3}(=)?))?$/,nanoid:/^[a-zA-Z0-9_-]{21}$/,jwt:/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/},Eun=new Set(`ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvxyz0123456789`),e7={ZodString:`string`,ZodNumber:`number`,ZodBigInt:`integer`,ZodBoolean:`boolean`,ZodNull:`null`},Dun=(e,t)=>{let n=(e.options instanceof Map?Array.from(e.options.values()):e.options).map((e,n)=>W5(e._def,{...t,currentPath:[...t.currentPath,`anyOf`,`${n}`]})).filter(e=>!!e&&(!t.strictUnions||typeof e==`object`&&Object.keys(e).length>0));return n.length?{anyOf:n}:void 0},Oun=(e,t)=>{if(t.currentPath.toString()===t.propertyPath?.toString())return W5(e.innerType._def,t);let n=W5(e.innerType._def,{...t,currentPath:[...t.currentPath,`anyOf`,`1`]});return n?{anyOf:[{not:B5()},n]}:B5()},kun=(e,t)=>{if(t.pipeStrategy===`input`)return W5(e.in._def,t);if(t.pipeStrategy===`output`)return W5(e.out._def,t);let n=W5(e.in._def,{...t,currentPath:[...t.currentPath,`allOf`,`0`]});return{allOf:[n,W5(e.out._def,{...t,currentPath:[...t.currentPath,`allOf`,n?`1`:`0`]})].filter(e=>e!==void 0)}},Aun=(e,t)=>W5(e.innerType._def,t),jun=(e,t,n)=>{switch(t){case P5.ZodString:return Vln(e,n);case P5.ZodNumber:return Zln(e);case P5.ZodObject:return Qln(e,n);case P5.ZodBigInt:return Mln(e);case P5.ZodBoolean:return Nln();case P5.ZodDate:return Fln(e,n);case P5.ZodUndefined:return iun();case P5.ZodNull:return Jln();case P5.ZodArray:return jln(e,n);case P5.ZodUnion:case P5.ZodDiscriminatedUnion:return Yln(e,n);case P5.ZodIntersection:return zln(e,n);case P5.ZodTuple:return run(e,n);case P5.ZodRecord:return Wln(e,n);case P5.ZodLiteral:return Bln(e);case P5.ZodEnum:return Rln(e);case P5.ZodNativeEnum:return Kln(e);case P5.ZodNullable:return Xln(e,n);case P5.ZodOptional:return Oun(e,n);case P5.ZodMap:return Gln(e,n);case P5.ZodSet:return nun(e,n);case P5.ZodLazy:return()=>e.getter()._def;case P5.ZodPromise:return tun(e,n);case P5.ZodNaN:case P5.ZodNever:return qln();case P5.ZodEffects:return Lln(e,n);case P5.ZodAny:return B5();case P5.ZodUnknown:return aun();case P5.ZodDefault:return Iln(e,n);case P5.ZodBranded:return Pln(e,n);case P5.ZodReadonly:return Aun(e,n);case P5.ZodCatch:return Cun(e,n);case P5.ZodPipeline:return kun(e,n);case P5.ZodFunction:case P5.ZodVoid:case P5.ZodSymbol:return;default:return(e=>void 0)(t)}},Mun=(e,t)=>{let n=0;for(;n<e.length&&n<t.length&&e[n]===t[n];n++);return[(e.length-n).toString(),...t.slice(n)].join(`/`)},Nun=(e,t)=>{switch(t.$refStrategy){case`root`:return{$ref:e.path.join(`/`)};case`relative`:return{$ref:Mun(t.currentPath,e.path)};case`none`:case`seen`:return e.path.length<t.currentPath.length&&e.path.every((e,n)=>t.currentPath[n]===e)?(console.warn(`Recursive reference detected at ${t.currentPath.join(`/`)}! Defaulting to any`),B5()):t.$refStrategy===`seen`?B5():void 0}},Pun=(e,t,n)=>(e.description&&(n.description=e.description),n),Fun=e=>{let t=Sun(e),n=t.name===void 0?t.basePath:[...t.basePath,t.definitionPath,t.name];return{...t,currentPath:n,propertyPath:void 0,seen:new Map(Object.entries(t.definitions).map(([e,n])=>[n._def,{def:n._def,path:[...t.basePath,t.definitionPath,e],jsonSchema:void 0}]))}},Iun=(e,t)=>{let n=Fun(t),r=typeof t==`object`&&t.definitions?Object.entries(t.definitions).reduce((e,[t,r])=>({...e,[t]:W5(r._def,{...n,currentPath:[...n.basePath,n.definitionPath,t]},!0)??B5()}),{}):void 0,i=typeof t==`string`?t:t?.nameStrategy===`title`?void 0:t?.name,a=W5(e._def,i===void 0?n:{...n,currentPath:[...n.basePath,n.definitionPath,i]},!1)??B5(),o=typeof t==`object`&&t.name!==void 0&&t.nameStrategy===`title`?t.name:void 0;o!==void 0&&(a.title=o);let s=i===void 0?r?{...a,[n.definitionPath]:r}:a:{$ref:[...n.$refStrategy===`relative`?[]:n.basePath,n.definitionPath,i].join(`/`),[n.definitionPath]:{...r,[i]:a}};return s.$schema=`http://json-schema.org/draft-07/schema#`,s},t7=Symbol.for(`vercel.ai.schema`)}));function Run(e,t){if(e===void 0&&t===void 0)return;if(e===void 0)return t;if(t===void 0)return e;let n={...e};for(let r in t)if(Object.prototype.hasOwnProperty.call(t,r)){let i=t[r];if(i===void 0)continue;let a=r in e?e[r]:void 0,o=typeof i==`object`&&!!i&&!Array.isArray(i)&&!(i instanceof Date)&&!(i instanceof RegExp),s=typeof a==`object`&&!!a&&!Array.isArray(a)&&!(a instanceof Date)&&!(a instanceof RegExp);o&&s?n[r]=Run(a,i):n[r]=i}return n}function zun(e){let t=[`ROOT`],n=-1,r=null;function i(e,i,a){switch(e){case`"`:n=i,t.pop(),t.push(a),t.push(`INSIDE_STRING`);break;case`f`:case`t`:case`n`:n=i,r=i,t.pop(),t.push(a),t.push(`INSIDE_LITERAL`);break;case`-`:t.pop(),t.push(a),t.push(`INSIDE_NUMBER`);break;case`0`:case`1`:case`2`:case`3`:case`4`:case`5`:case`6`:case`7`:case`8`:case`9`:n=i,t.pop(),t.push(a),t.push(`INSIDE_NUMBER`);break;case`{`:n=i,t.pop(),t.push(a),t.push(`INSIDE_OBJECT_START`);break;case`[`:n=i,t.pop(),t.push(a),t.push(`INSIDE_ARRAY_START`);break}}function a(e,r){switch(e){case`,`:t.pop(),t.push(`INSIDE_OBJECT_AFTER_COMMA`);break;case`}`:n=r,t.pop();break}}function o(e,r){switch(e){case`,`:t.pop(),t.push(`INSIDE_ARRAY_AFTER_COMMA`);break;case`]`:n=r,t.pop();break}}for(let s=0;s<e.length;s++){let c=e[s];switch(t[t.length-1]){case`ROOT`:i(c,s,`FINISH`);break;case`INSIDE_OBJECT_START`:switch(c){case`"`:t.pop(),t.push(`INSIDE_OBJECT_KEY`);break;case`}`:n=s,t.pop();break}break;case`INSIDE_OBJECT_AFTER_COMMA`:switch(c){case`"`:t.pop(),t.push(`INSIDE_OBJECT_KEY`);break}break;case`INSIDE_OBJECT_KEY`:switch(c){case`"`:t.pop(),t.push(`INSIDE_OBJECT_AFTER_KEY`);break}break;case`INSIDE_OBJECT_AFTER_KEY`:switch(c){case`:`:t.pop(),t.push(`INSIDE_OBJECT_BEFORE_VALUE`);break}break;case`INSIDE_OBJECT_BEFORE_VALUE`:i(c,s,`INSIDE_OBJECT_AFTER_VALUE`);break;case`INSIDE_OBJECT_AFTER_VALUE`:a(c,s);break;case`INSIDE_STRING`:switch(c){case`"`:t.pop(),n=s;break;case`\\`:t.push(`INSIDE_STRING_ESCAPE`);break;default:n=s}break;case`INSIDE_ARRAY_START`:switch(c){case`]`:n=s,t.pop();break;default:n=s,i(c,s,`INSIDE_ARRAY_AFTER_VALUE`);break}break;case`INSIDE_ARRAY_AFTER_VALUE`:switch(c){case`,`:t.pop(),t.push(`INSIDE_ARRAY_AFTER_COMMA`);break;case`]`:n=s,t.pop();break;default:n=s;break}break;case`INSIDE_ARRAY_AFTER_COMMA`:i(c,s,`INSIDE_ARRAY_AFTER_VALUE`);break;case`INSIDE_STRING_ESCAPE`:t.pop(),n=s;break;case`INSIDE_NUMBER`:switch(c){case`0`:case`1`:case`2`:case`3`:case`4`:case`5`:case`6`:case`7`:case`8`:case`9`:n=s;break;case`e`:case`E`:case`-`:case`.`:break;case`,`:t.pop(),t[t.length-1]===`INSIDE_ARRAY_AFTER_VALUE`&&o(c,s),t[t.length-1]===`INSIDE_OBJECT_AFTER_VALUE`&&a(c,s);break;case`}`:t.pop(),t[t.length-1]===`INSIDE_OBJECT_AFTER_VALUE`&&a(c,s);break;case`]`:t.pop(),t[t.length-1]===`INSIDE_ARRAY_AFTER_VALUE`&&o(c,s);break;default:t.pop();break}break;case`INSIDE_LITERAL`:{let i=e.substring(r,s+1);!`false`.startsWith(i)&&!`true`.startsWith(i)&&!`null`.startsWith(i)?(t.pop(),t[t.length-1]===`INSIDE_OBJECT_AFTER_VALUE`?a(c,s):t[t.length-1]===`INSIDE_ARRAY_AFTER_VALUE`&&o(c,s)):n=s;break}}}let s=e.slice(0,n+1);for(let n=t.length-1;n>=0;n--)switch(t[n]){case`INSIDE_STRING`:s+=`"`;break;case`INSIDE_OBJECT_KEY`:case`INSIDE_OBJECT_AFTER_KEY`:case`INSIDE_OBJECT_AFTER_COMMA`:case`INSIDE_OBJECT_START`:case`INSIDE_OBJECT_BEFORE_VALUE`:case`INSIDE_OBJECT_AFTER_VALUE`:s+=`}`;break;case`INSIDE_ARRAY_START`:case`INSIDE_ARRAY_AFTER_COMMA`:case`INSIDE_ARRAY_AFTER_VALUE`:s+=`]`;break;case`INSIDE_LITERAL`:{let t=e.substring(r,e.length);`true`.startsWith(t)?s+=`true`.slice(t.length):`false`.startsWith(t)?s+=`false`.slice(t.length):`null`.startsWith(t)&&(s+=`null`.slice(t.length))}}return s}async function n7(e){if(e===void 0)return{value:void 0,state:`undefined-input`};let t=await J5({text:e});return t.success?{value:t.value,state:`successful-parse`}:(t=await J5({text:zun(e)}),t.success?{value:t.value,state:`repaired-parse`}:{value:void 0,state:`failed-parse`})}function Bun(e){return e.type.startsWith(`data-`)}function r7(e){return e.type.startsWith(`tool-`)}function Vun(e){return e.type===`dynamic-tool`}function i7(e){return r7(e)||Vun(e)}function Hun(e){return e.type.split(`-`).slice(1).join(`-`)}function Uun({lastMessage:e,messageId:t}){return{message:e?.role===`assistant`?e:{id:t,metadata:void 0,role:`assistant`,parts:[]},activeTextParts:{},activeReasoningParts:{},partialToolCalls:{}}}function Wun({stream:e,messageMetadataSchema:t,dataPartSchemas:n,runUpdateMessageJob:r,onError:i,onToolCall:a,onData:o}){return e.pipeThrough(new TransformStream({async transform(e,s){await r(async({state:r,write:c})=>{function l(e){let t=r.message.parts.filter(i7).find(t=>t.toolCallId===e);if(t==null)throw Error(`no tool invocation found for tool call ${e}`);return t}function u(e){let t=r.message.parts.find(t=>r7(t)&&t.toolCallId===e.toolCallId),n=e,i=t;t==null?r.message.parts.push({type:`tool-${e.toolName}`,toolCallId:e.toolCallId,state:e.state,title:e.title,input:n.input,output:n.output,rawInput:n.rawInput,errorText:n.errorText,providerExecuted:n.providerExecuted,preliminary:n.preliminary,...n.providerMetadata==null?{}:{callProviderMetadata:n.providerMetadata}}):(t.state=e.state,i.input=n.input,i.output=n.output,i.errorText=n.errorText,i.rawInput=n.rawInput,i.preliminary=n.preliminary,e.title!==void 0&&(i.title=e.title),i.providerExecuted=n.providerExecuted??t.providerExecuted,n.providerMetadata!=null&&t.state===`input-available`&&(t.callProviderMetadata=n.providerMetadata))}function d(e){let t=r.message.parts.find(t=>t.type===`dynamic-tool`&&t.toolCallId===e.toolCallId),n=e,i=t;t==null?r.message.parts.push({type:`dynamic-tool`,toolName:e.toolName,toolCallId:e.toolCallId,state:e.state,input:n.input,output:n.output,errorText:n.errorText,preliminary:n.preliminary,providerExecuted:n.providerExecuted,title:e.title,...n.providerMetadata==null?{}:{callProviderMetadata:n.providerMetadata}}):(t.state=e.state,i.toolName=e.toolName,i.input=n.input,i.output=n.output,i.errorText=n.errorText,i.rawInput=n.rawInput??i.rawInput,i.preliminary=n.preliminary,e.title!==void 0&&(i.title=e.title),i.providerExecuted=n.providerExecuted??t.providerExecuted,n.providerMetadata!=null&&t.state===`input-available`&&(t.callProviderMetadata=n.providerMetadata))}async function f(e){if(e!=null){let n=r.message.metadata==null?e:Run(r.message.metadata,e);t!=null&&await pun({value:n,schema:t}),r.message.metadata=n}}switch(e.type){case`text-start`:{let t={type:`text`,text:``,providerMetadata:e.providerMetadata,state:`streaming`};r.activeTextParts[e.id]=t,r.message.parts.push(t),c();break}case`text-delta`:{let t=r.activeTextParts[e.id];t.text+=e.delta,t.providerMetadata=e.providerMetadata??t.providerMetadata,c();break}case`text-end`:{let t=r.activeTextParts[e.id];t.state=`done`,t.providerMetadata=e.providerMetadata??t.providerMetadata,delete r.activeTextParts[e.id],c();break}case`reasoning-start`:{let t={type:`reasoning`,text:``,providerMetadata:e.providerMetadata,state:`streaming`};r.activeReasoningParts[e.id]=t,r.message.parts.push(t),c();break}case`reasoning-delta`:{let t=r.activeReasoningParts[e.id];t.text+=e.delta,t.providerMetadata=e.providerMetadata??t.providerMetadata,c();break}case`reasoning-end`:{let t=r.activeReasoningParts[e.id];t.providerMetadata=e.providerMetadata??t.providerMetadata,t.state=`done`,delete r.activeReasoningParts[e.id],c();break}case`file`:r.message.parts.push({type:`file`,mediaType:e.mediaType,url:e.url}),c();break;case`source-url`:r.message.parts.push({type:`source-url`,sourceId:e.sourceId,url:e.url,title:e.title,providerMetadata:e.providerMetadata}),c();break;case`source-document`:r.message.parts.push({type:`source-document`,sourceId:e.sourceId,mediaType:e.mediaType,title:e.title,filename:e.filename,providerMetadata:e.providerMetadata}),c();break;case`tool-input-start`:{let t=r.message.parts.filter(r7);r.partialToolCalls[e.toolCallId]={text:``,toolName:e.toolName,index:t.length,dynamic:e.dynamic,title:e.title},e.dynamic?d({toolCallId:e.toolCallId,toolName:e.toolName,state:`input-streaming`,input:void 0,providerExecuted:e.providerExecuted,title:e.title}):u({toolCallId:e.toolCallId,toolName:e.toolName,state:`input-streaming`,input:void 0,providerExecuted:e.providerExecuted,title:e.title}),c();break}case`tool-input-delta`:{let t=r.partialToolCalls[e.toolCallId];t.text+=e.inputTextDelta;let{value:n}=await n7(t.text);t.dynamic?d({toolCallId:e.toolCallId,toolName:t.toolName,state:`input-streaming`,input:n,title:t.title}):u({toolCallId:e.toolCallId,toolName:t.toolName,state:`input-streaming`,input:n,title:t.title}),c();break}case`tool-input-available`:e.dynamic?d({toolCallId:e.toolCallId,toolName:e.toolName,state:`input-available`,input:e.input,providerExecuted:e.providerExecuted,providerMetadata:e.providerMetadata,title:e.title}):u({toolCallId:e.toolCallId,toolName:e.toolName,state:`input-available`,input:e.input,providerExecuted:e.providerExecuted,providerMetadata:e.providerMetadata,title:e.title}),c(),a&&!e.providerExecuted&&await a({toolCall:e});break;case`tool-input-error`:e.dynamic?d({toolCallId:e.toolCallId,toolName:e.toolName,state:`output-error`,input:e.input,errorText:e.errorText,providerExecuted:e.providerExecuted,providerMetadata:e.providerMetadata}):u({toolCallId:e.toolCallId,toolName:e.toolName,state:`output-error`,input:void 0,rawInput:e.input,errorText:e.errorText,providerExecuted:e.providerExecuted,providerMetadata:e.providerMetadata}),c();break;case`tool-approval-request`:{let t=l(e.toolCallId);t.state=`approval-requested`,t.approval={id:e.approvalId},c();break}case`tool-output-denied`:{let t=l(e.toolCallId);t.state=`output-denied`,c();break}case`tool-output-available`:{let t=l(e.toolCallId);t.type===`dynamic-tool`?d({toolCallId:e.toolCallId,toolName:t.toolName,state:`output-available`,input:t.input,output:e.output,preliminary:e.preliminary,providerExecuted:e.providerExecuted,title:t.title}):u({toolCallId:e.toolCallId,toolName:Hun(t),state:`output-available`,input:t.input,output:e.output,providerExecuted:e.providerExecuted,preliminary:e.preliminary,title:t.title}),c();break}case`tool-output-error`:{let t=l(e.toolCallId);t.type===`dynamic-tool`?d({toolCallId:e.toolCallId,toolName:t.toolName,state:`output-error`,input:t.input,errorText:e.errorText,providerExecuted:e.providerExecuted,title:t.title}):u({toolCallId:e.toolCallId,toolName:Hun(t),state:`output-error`,input:t.input,rawInput:t.rawInput,errorText:e.errorText,providerExecuted:e.providerExecuted,title:t.title}),c();break}case`start-step`:r.message.parts.push({type:`step-start`});break;case`finish-step`:r.activeTextParts={},r.activeReasoningParts={};break;case`start`:e.messageId!=null&&(r.message.id=e.messageId),await f(e.messageMetadata),(e.messageId!=null||e.messageMetadata!=null)&&c();break;case`finish`:e.finishReason!=null&&(r.finishReason=e.finishReason),await f(e.messageMetadata),e.messageMetadata!=null&&c();break;case`message-metadata`:await f(e.messageMetadata),e.messageMetadata!=null&&c();break;case`error`:i?.(Error(e.errorText));break;default:if(Bun(e)){n?.[e.type]!=null&&await pun({value:e.data,schema:n[e.type]});let t=e;if(t.transient){o?.(t);break}let i=t.id==null?void 0:r.message.parts.find(e=>t.type===e.type&&t.id===e.id);i==null?r.message.parts.push(t):i.data=t.data,o?.(t),c()}}s.enqueue(e)})}}))}async function Gun({stream:e,onError:t}){let n=e.getReader();try{for(;;){let{done:e}=await n.read();if(e)break}}catch(e){t?.(e)}finally{n.releaseLock()}}async function Kun(e){if(e==null)return[];if(!globalThis.FileList||!(e instanceof globalThis.FileList))throw Error(`FileList is not supported in the current environment`);return Promise.all(Array.from(e).map(async e=>{let{name:t,type:n}=e;return{type:`file`,mediaType:n,filename:t,url:await new Promise((t,n)=>{let r=new FileReader;r.onload=e=>{t(e.target?.result)},r.onerror=e=>n(e),r.readAsDataURL(e)})}}))}function qun({messages:e}){let t=e[e.length-1];if(!t||t.role!==`assistant`)return!1;let n=t.parts.reduce((e,t,n)=>t.type===`step-start`?n:e,-1),r=t.parts.slice(n+1).filter(i7).filter(e=>!e.providerExecuted);return r.length>0&&r.every(e=>e.state===`output-available`||e.state===`output-error`)}var Jun,Yun,Xun,Zun,Qun,$un,edn,tdn,a7,o7,ndn,rdn,s7,idn,adn,odn,sdn,cdn,ldn,udn,c7,l7,u7,d7,f7,ddn,p7,fdn,pdn,mdn,m7,hdn,gdn,_dn,vdn,ydn,bdn,xdn,Sdn,Cdn,wdn,Tdn,Edn,Ddn,Odn,kdn,Adn,h7,jdn,Mdn=s((()=>{Lun(),Pcn(),Icn(),Jun=Object.defineProperty,Yun=(e,t)=>{for(var n in t)Jun(e,n,{get:t[n],enumerable:!0})},Xun=`AI_InvalidArgumentError`,`${Xun}`,Zun=`AI_InvalidStreamPartError`,`${Zun}`,Qun=`AI_InvalidToolApprovalError`,`${Qun}`,$un=`AI_InvalidToolInputError`,`${$un}`,edn=`AI_ToolCallNotFoundForApprovalError`,`${edn}`,tdn=`AI_NoImageGeneratedError`,`${tdn}`,a7=`AI_NoObjectGeneratedError`,o7=`vercel.ai.error.${a7}`,ndn=Symbol.for(o7),s7=class extends _8{constructor({message:e=`No object generated.`,cause:t,text:n,response:r,usage:i,finishReason:a}){super({name:a7,message:e,cause:t}),this[rdn]=!0,this.text=n,this.response=r,this.usage=i,this.finishReason=a}static isInstance(e){return _8.hasMarker(e,o7)}},rdn=ndn,idn=`AI_NoOutputGeneratedError`,`${idn}`,adn=`AI_NoSuchToolError`,`${adn}`,odn=`AI_ToolCallRepairError`,`${odn}`,sdn=`AI_InvalidDataContentError`,`${sdn}`,cdn=`AI_InvalidMessageRoleError`,`${cdn}`,ldn=`AI_MessageConversionError`,`${ldn}`,udn=`AI_RetryError`,`${udn}`,c7=`6.0.33`,l7=vQ([fQ(),SQ(Uint8Array),SQ(ArrayBuffer),tWt(e=>globalThis.Buffer?.isBuffer(e)??!1,{message:`Must be a Buffer`})]),u7=eWt(()=>vQ([BUt(),fQ(),RUt(),pQ(),yQ(fQ(),u7.optional()),hQ(u7)])),d7=yQ(fQ(),yQ(fQ(),u7.optional())),f7=gQ({type:xQ(`text`),text:fQ(),providerOptions:d7.optional()}),ddn=gQ({type:xQ(`image`),image:vQ([l7,SQ(URL)]),mediaType:fQ().optional(),providerOptions:d7.optional()}),p7=gQ({type:xQ(`file`),data:vQ([l7,SQ(URL)]),filename:fQ().optional(),mediaType:fQ(),providerOptions:d7.optional()}),fdn=gQ({type:xQ(`reasoning`),text:fQ(),providerOptions:d7.optional()}),pdn=gQ({type:xQ(`tool-call`),toolCallId:fQ(),toolName:fQ(),input:mQ(),providerOptions:d7.optional(),providerExecuted:pQ().optional()}),mdn=HUt(`type`,[gQ({type:xQ(`text`),value:fQ(),providerOptions:d7.optional()}),gQ({type:xQ(`json`),value:u7,providerOptions:d7.optional()}),gQ({type:xQ(`execution-denied`),reason:fQ().optional(),providerOptions:d7.optional()}),gQ({type:xQ(`error-text`),value:fQ(),providerOptions:d7.optional()}),gQ({type:xQ(`error-json`),value:u7,providerOptions:d7.optional()}),gQ({type:xQ(`content`),value:hQ(vQ([gQ({type:xQ(`text`),text:fQ(),providerOptions:d7.optional()}),gQ({type:xQ(`media`),data:fQ(),mediaType:fQ()}),gQ({type:xQ(`file-data`),data:fQ(),mediaType:fQ(),filename:fQ().optional(),providerOptions:d7.optional()}),gQ({type:xQ(`file-url`),url:fQ(),providerOptions:d7.optional()}),gQ({type:xQ(`file-id`),fileId:vQ([fQ(),yQ(fQ(),fQ())]),providerOptions:d7.optional()}),gQ({type:xQ(`image-data`),data:fQ(),mediaType:fQ(),providerOptions:d7.optional()}),gQ({type:xQ(`image-url`),url:fQ(),providerOptions:d7.optional()}),gQ({type:xQ(`image-file-id`),fileId:vQ([fQ(),yQ(fQ(),fQ())]),providerOptions:d7.optional()}),gQ({type:xQ(`custom`),providerOptions:d7.optional()})]))})]),m7=gQ({type:xQ(`tool-result`),toolCallId:fQ(),toolName:fQ(),output:mdn,providerOptions:d7.optional()}),hdn=gQ({type:xQ(`tool-approval-request`),approvalId:fQ(),toolCallId:fQ()}),gdn=gQ({type:xQ(`tool-approval-response`),approvalId:fQ(),approved:pQ(),reason:fQ().optional()}),_dn=gQ({role:xQ(`system`),content:fQ(),providerOptions:d7.optional()}),vdn=gQ({role:xQ(`user`),content:vQ([fQ(),hQ(vQ([f7,ddn,p7]))]),providerOptions:d7.optional()}),ydn=gQ({role:xQ(`assistant`),content:vQ([fQ(),hQ(vQ([f7,p7,fdn,pdn,m7,hdn]))]),providerOptions:d7.optional()}),bdn=gQ({role:xQ(`tool`),content:hQ(vQ([m7,gdn])),providerOptions:d7.optional()}),vQ([_dn,vdn,ydn,bdn]),xdn={},Yun(xdn,{array:()=>wdn,choice:()=>Tdn,json:()=>Edn,object:()=>Cdn,text:()=>Sdn}),Sdn=()=>({name:`text`,responseFormat:Promise.resolve({type:`text`}),async parseCompleteOutput({text:e}){return e},async parsePartialOutput({text:e}){return{partial:e}},createElementStreamTransform(){}}),Cdn=({schema:e,name:t,description:n})=>{let r=K5(e);return{name:`object`,responseFormat:Y5(r.jsonSchema).then(e=>({type:`json`,schema:e,...t!=null&&{name:t},...n!=null&&{description:n}})),async parseCompleteOutput({text:e},t){let n=await J5({text:e});if(!n.success)throw new s7({message:`No object generated: could not parse the response.`,cause:n.error,text:e,response:t.response,usage:t.usage,finishReason:t.finishReason});let i=await q5({value:n.value,schema:r});if(!i.success)throw new s7({message:`No object generated: response did not match schema.`,cause:i.error,text:e,response:t.response,usage:t.usage,finishReason:t.finishReason});return i.value},async parsePartialOutput({text:e}){let t=await n7(e);switch(t.state){case`failed-parse`:case`undefined-input`:return;case`repaired-parse`:case`successful-parse`:return{partial:t.value}}},createElementStreamTransform(){}}},wdn=({element:e,name:t,description:n})=>{let r=K5(e);return{name:`array`,responseFormat:Y5(r.jsonSchema).then(e=>{let{$schema:r,...i}=e;return{type:`json`,schema:{$schema:`http://json-schema.org/draft-07/schema#`,type:`object`,properties:{elements:{type:`array`,items:i}},required:[`elements`],additionalProperties:!1},...t!=null&&{name:t},...n!=null&&{description:n}}}),async parseCompleteOutput({text:e},t){let n=await J5({text:e});if(!n.success)throw new s7({message:`No object generated: could not parse the response.`,cause:n.error,text:e,response:t.response,usage:t.usage,finishReason:t.finishReason});let i=n.value;if(typeof i!=`object`||!i||!(`elements`in i)||!Array.isArray(i.elements))throw new s7({message:`No object generated: response did not match schema.`,cause:new T8({value:i,cause:`response must be an object with an elements array`}),text:e,response:t.response,usage:t.usage,finishReason:t.finishReason});for(let n of i.elements){let i=await q5({value:n,schema:r});if(!i.success)throw new s7({message:`No object generated: response did not match schema.`,cause:i.error,text:e,response:t.response,usage:t.usage,finishReason:t.finishReason})}return i.elements},async parsePartialOutput({text:e}){let t=await n7(e);switch(t.state){case`failed-parse`:case`undefined-input`:return;case`repaired-parse`:case`successful-parse`:{let e=t.value;if(typeof e!=`object`||!e||!(`elements`in e)||!Array.isArray(e.elements))return;let n=t.state===`repaired-parse`&&e.elements.length>0?e.elements.slice(0,-1):e.elements,i=[];for(let e of n){let t=await q5({value:e,schema:r});t.success&&i.push(t.value)}return{partial:i}}}},createElementStreamTransform(){let e=0;return new TransformStream({transform({partialOutput:t},n){if(t!=null)for(;e<t.length;e++)n.enqueue(t[e])}})}}},Tdn=({options:e,name:t,description:n})=>({name:`choice`,responseFormat:Promise.resolve({type:`json`,schema:{$schema:`http://json-schema.org/draft-07/schema#`,type:`object`,properties:{result:{type:`string`,enum:e}},required:[`result`],additionalProperties:!1},...t!=null&&{name:t},...n!=null&&{description:n}}),async parseCompleteOutput({text:t},n){let r=await J5({text:t});if(!r.success)throw new s7({message:`No object generated: could not parse the response.`,cause:r.error,text:t,response:n.response,usage:n.usage,finishReason:n.finishReason});let i=r.value;if(typeof i!=`object`||!i||!(`result`in i)||typeof i.result!=`string`||!e.includes(i.result))throw new s7({message:`No object generated: response did not match schema.`,cause:new T8({value:i,cause:`response must be an object that contains a choice value.`}),text:t,response:n.response,usage:n.usage,finishReason:n.finishReason});return i.result},async parsePartialOutput({text:t}){let n=await n7(t);switch(n.state){case`failed-parse`:case`undefined-input`:return;case`repaired-parse`:case`successful-parse`:{let t=n.value;if(typeof t!=`object`||!t||!(`result`in t)||typeof t.result!=`string`)return;let r=e.filter(e=>e.startsWith(t.result));return n.state===`successful-parse`?r.includes(t.result)?{partial:t.result}:void 0:r.length===1?{partial:r[0]}:void 0}}},createElementStreamTransform(){}}),Edn=({name:e,description:t}={})=>({name:`json`,responseFormat:Promise.resolve({type:`json`,...e!=null&&{name:e},...t!=null&&{description:t}}),async parseCompleteOutput({text:e},t){let n=await J5({text:e});if(!n.success)throw new s7({message:`No object generated: could not parse the response.`,cause:n.error,text:e,response:t.response,usage:t.usage,finishReason:t.finishReason});return n.value},async parsePartialOutput({text:e}){let t=await n7(e);switch(t.state){case`failed-parse`:case`undefined-input`:return;case`repaired-parse`:case`successful-parse`:return t.value===void 0?void 0:{partial:t.value}}},createElementStreamTransform(){}}),X5({prefix:`aitxt`,size:24}),Ddn=oun(()=>fun(vQ([_Q({type:xQ(`text-start`),id:fQ(),providerMetadata:d7.optional()}),_Q({type:xQ(`text-delta`),id:fQ(),delta:fQ(),providerMetadata:d7.optional()}),_Q({type:xQ(`text-end`),id:fQ(),providerMetadata:d7.optional()}),_Q({type:xQ(`error`),errorText:fQ()}),_Q({type:xQ(`tool-input-start`),toolCallId:fQ(),toolName:fQ(),providerExecuted:pQ().optional(),dynamic:pQ().optional(),title:fQ().optional()}),_Q({type:xQ(`tool-input-delta`),toolCallId:fQ(),inputTextDelta:fQ()}),_Q({type:xQ(`tool-input-available`),toolCallId:fQ(),toolName:fQ(),input:mQ(),providerExecuted:pQ().optional(),providerMetadata:d7.optional(),dynamic:pQ().optional(),title:fQ().optional()}),_Q({type:xQ(`tool-input-error`),toolCallId:fQ(),toolName:fQ(),input:mQ(),providerExecuted:pQ().optional(),providerMetadata:d7.optional(),dynamic:pQ().optional(),errorText:fQ(),title:fQ().optional()}),_Q({type:xQ(`tool-approval-request`),approvalId:fQ(),toolCallId:fQ()}),_Q({type:xQ(`tool-output-available`),toolCallId:fQ(),output:mQ(),providerExecuted:pQ().optional(),dynamic:pQ().optional(),preliminary:pQ().optional()}),_Q({type:xQ(`tool-output-error`),toolCallId:fQ(),errorText:fQ(),providerExecuted:pQ().optional(),dynamic:pQ().optional()}),_Q({type:xQ(`tool-output-denied`),toolCallId:fQ()}),_Q({type:xQ(`reasoning-start`),id:fQ(),providerMetadata:d7.optional()}),_Q({type:xQ(`reasoning-delta`),id:fQ(),delta:fQ(),providerMetadata:d7.optional()}),_Q({type:xQ(`reasoning-end`),id:fQ(),providerMetadata:d7.optional()}),_Q({type:xQ(`source-url`),sourceId:fQ(),url:fQ(),title:fQ().optional(),providerMetadata:d7.optional()}),_Q({type:xQ(`source-document`),sourceId:fQ(),mediaType:fQ(),title:fQ(),filename:fQ().optional(),providerMetadata:d7.optional()}),_Q({type:xQ(`file`),url:fQ(),mediaType:fQ(),providerMetadata:d7.optional()}),_Q({type:tWt(e=>typeof e==`string`&&e.startsWith(`data-`),{message:`Type must start with "data-"`}),id:fQ().optional(),data:mQ(),transient:pQ().optional()}),_Q({type:xQ(`start-step`)}),_Q({type:xQ(`finish-step`)}),_Q({type:xQ(`start`),messageId:fQ().optional(),messageMetadata:mQ().optional()}),_Q({type:xQ(`finish`),finishReason:bQ([`stop`,`length`,`content-filter`,`tool-calls`,`error`,`other`]).optional(),messageMetadata:mQ().optional()}),_Q({type:xQ(`abort`),reason:fQ().optional()}),_Q({type:xQ(`message-metadata`),messageMetadata:mQ()})]))),X5({prefix:`aitxt`,size:24}),X5({prefix:`aiobj`,size:24}),Odn=class{constructor(){this.queue=[],this.isProcessing=!1}async processQueue(){if(!this.isProcessing){for(this.isProcessing=!0;this.queue.length>0;)await this.queue[0](),this.queue.shift();this.isProcessing=!1}}async run(e){return new Promise((t,n)=>{this.queue.push(async()=>{try{await e(),t()}catch(e){n(e)}}),this.processQueue()})}},X5({prefix:`aiobj`,size:24}),kdn=`AI_NoSuchProviderError`,`${kdn}`,Adn=class{constructor({api:e=`/api/chat`,credentials:t,headers:n,body:r,fetch:i,prepareSendMessagesRequest:a,prepareReconnectToStreamRequest:o}){this.api=e,this.credentials=t,this.headers=n,this.body=r,this.fetch=i,this.prepareSendMessagesRequest=a,this.prepareReconnectToStreamRequest=o}async sendMessages({abortSignal:e,...t}){let n=await Y5(this.body),r=await Y5(this.headers),i=await Y5(this.credentials),a={...L5(r),...L5(t.headers)},o=await this.prepareSendMessagesRequest?.call(this,{api:this.api,id:t.chatId,messages:t.messages,body:{...n,...t.body},headers:a,credentials:i,requestMetadata:t.metadata,trigger:t.trigger,messageId:t.messageId}),s=o?.api??this.api,c=o?.headers===void 0?a:L5(o.headers),l=o?.body===void 0?{...n,...t.body,id:t.chatId,messages:t.messages,trigger:t.trigger,messageId:t.messageId}:o.body,u=o?.credentials??i,d=await(this.fetch??globalThis.fetch)(s,{method:`POST`,headers:Dln({"Content-Type":`application/json`,...c},`ai-sdk/${c7}`,Eln()),body:JSON.stringify(l),credentials:u,signal:e});if(!d.ok)throw Error(await d.text()??`Failed to fetch the chat response.`);if(!d.body)throw Error(`The response body is empty.`);return this.processResponseStream(d.body)}async reconnectToStream(e){let t=await Y5(this.body),n=await Y5(this.headers),r=await Y5(this.credentials),i={...L5(n),...L5(e.headers)},a=await this.prepareReconnectToStreamRequest?.call(this,{api:this.api,id:e.chatId,body:{...t,...e.body},headers:i,credentials:r,requestMetadata:e.metadata}),o=a?.api??`${this.api}/${e.chatId}/stream`,s=a?.headers===void 0?i:L5(a.headers),c=a?.credentials??r,l=await(this.fetch??globalThis.fetch)(o,{method:`GET`,headers:Dln(s,`ai-sdk/${c7}`,Eln()),credentials:c});if(l.status===204)return null;if(!l.ok)throw Error(await l.text()??`Failed to fetch the chat response.`);if(!l.body)throw Error(`The response body is empty.`);return this.processResponseStream(l.body)}},h7=class extends Adn{constructor(e={}){super(e)}processResponseStream(e){return mun({stream:e,schema:Ddn}).pipeThrough(new TransformStream({async transform(e,t){if(!e.success)throw e.error;t.enqueue(e.value)}}))}},jdn=class{constructor({generateId:e=vun,id:t=e(),transport:n=new h7,messageMetadataSchema:r,dataPartSchemas:i,state:a,onError:o,onToolCall:s,onFinish:c,onData:l,sendAutomaticallyWhen:u}){this.activeResponse=void 0,this.jobExecutor=new Odn,this.sendMessage=async(e,t)=>{if(e==null){await this.makeRequest({trigger:`submit-message`,messageId:this.lastMessage?.id,...t});return}let n;if(n=`text`in e||`files`in e?{parts:[...Array.isArray(e.files)?e.files:await Kun(e.files),...`text`in e&&e.text!=null?[{type:`text`,text:e.text}]:[]]}:e,e.messageId!=null){let t=this.state.messages.findIndex(t=>t.id===e.messageId);if(t===-1)throw Error(`message with id ${e.messageId} not found`);if(this.state.messages[t].role!==`user`)throw Error(`message with id ${e.messageId} is not a user message`);this.state.messages=this.state.messages.slice(0,t+1),this.state.replaceMessage(t,{...n,id:e.messageId,role:n.role??`user`,metadata:e.metadata})}else this.state.pushMessage({...n,id:n.id??this.generateId(),role:n.role??`user`,metadata:e.metadata});await this.makeRequest({trigger:`submit-message`,messageId:e.messageId,...t})},this.regenerate=async({messageId:e,...t}={})=>{let n=e==null?this.state.messages.length-1:this.state.messages.findIndex(t=>t.id===e);if(n===-1)throw Error(`message ${e} not found`);this.state.messages=this.state.messages.slice(0,this.messages[n].role===`assistant`?n:n+1),await this.makeRequest({trigger:`regenerate-message`,messageId:e,...t})},this.resumeStream=async(e={})=>{await this.makeRequest({trigger:`resume-stream`,...e})},this.clearError=()=>{this.status===`error`&&(this.state.error=void 0,this.setStatus({status:`ready`}))},this.addToolApprovalResponse=async({id:e,approved:t,reason:n})=>this.jobExecutor.run(async()=>{let r=this.state.messages,i=r[r.length-1],a=r=>i7(r)&&r.state===`approval-requested`&&r.approval.id===e?{...r,state:`approval-responded`,approval:{id:e,approved:t,reason:n}}:r;this.state.replaceMessage(r.length-1,{...i,parts:i.parts.map(a)}),this.activeResponse&&(this.activeResponse.state.message.parts=this.activeResponse.state.message.parts.map(a)),this.status!==`streaming`&&this.status!==`submitted`&&this.sendAutomaticallyWhen?.call(this,{messages:this.state.messages})&&this.makeRequest({trigger:`submit-message`,messageId:this.lastMessage?.id})}),this.addToolOutput=async({state:e=`output-available`,tool:t,toolCallId:n,output:r,errorText:i})=>this.jobExecutor.run(async()=>{let t=this.state.messages,a=t[t.length-1],o=t=>i7(t)&&t.toolCallId===n?{...t,state:e,output:r,errorText:i}:t;this.state.replaceMessage(t.length-1,{...a,parts:a.parts.map(o)}),this.activeResponse&&(this.activeResponse.state.message.parts=this.activeResponse.state.message.parts.map(o)),this.status!==`streaming`&&this.status!==`submitted`&&this.sendAutomaticallyWhen?.call(this,{messages:this.state.messages})&&this.makeRequest({trigger:`submit-message`,messageId:this.lastMessage?.id})}),this.addToolResult=this.addToolOutput,this.stop=async()=>{this.status!==`streaming`&&this.status!==`submitted`||this.activeResponse?.abortController&&this.activeResponse.abortController.abort()},this.id=t,this.transport=n,this.generateId=e,this.messageMetadataSchema=r,this.dataPartSchemas=i,this.state=a,this.onError=o,this.onToolCall=s,this.onFinish=c,this.onData=l,this.sendAutomaticallyWhen=u}get status(){return this.state.status}setStatus({status:e,error:t}){this.status!==e&&(this.state.status=e,this.state.error=t)}get error(){return this.state.error}get messages(){return this.state.messages}get lastMessage(){return this.state.messages[this.state.messages.length-1]}set messages(e){this.state.messages=e}async makeRequest({trigger:e,metadata:t,headers:n,body:r,messageId:i}){var a;this.setStatus({status:`submitted`,error:void 0});let o=this.lastMessage,s=!1,c=!1,l=!1;try{let a={state:Uun({lastMessage:this.state.snapshot(o),messageId:this.generateId()}),abortController:new AbortController};a.abortController.signal.addEventListener(`abort`,()=>{s=!0}),this.activeResponse=a;let c;if(e===`resume-stream`){let e=await this.transport.reconnectToStream({chatId:this.id,metadata:t,headers:n,body:r});if(e==null){this.setStatus({status:`ready`});return}c=e}else c=await this.transport.sendMessages({chatId:this.id,messages:this.state.messages,abortSignal:a.abortController.signal,metadata:t,headers:n,body:r,trigger:e,messageId:i});await Gun({stream:Wun({stream:c,onToolCall:this.onToolCall,onData:this.onData,messageMetadataSchema:this.messageMetadataSchema,dataPartSchemas:this.dataPartSchemas,runUpdateMessageJob:e=>this.jobExecutor.run(()=>e({state:a.state,write:()=>{this.setStatus({status:`streaming`}),a.state.message.id===this.lastMessage?.id?this.state.replaceMessage(this.state.messages.length-1,a.state.message):this.state.pushMessage(a.state.message)}})),onError:e=>{throw e}}),onError:e=>{throw e}}),this.setStatus({status:`ready`})}catch(e){if(s||e.name===`AbortError`)return s=!0,this.setStatus({status:`ready`}),null;l=!0,e instanceof TypeError&&(e.message.toLowerCase().includes(`fetch`)||e.message.toLowerCase().includes(`network`))&&(c=!0),this.onError&&e instanceof Error&&this.onError(e),this.setStatus({status:`error`,error:e})}finally{try{(a=this.onFinish)==null||a.call(this,{message:this.activeResponse.state.message,messages:this.state.messages,isAbort:s,isDisconnect:c,isError:l,finishReason:this.activeResponse?.state.finishReason})}catch(e){console.error(e)}this.activeResponse=void 0}this.sendAutomaticallyWhen?.call(this,{messages:this.state.messages})&&!l&&await this.makeRequest({trigger:`submit-message`,messageId:this.lastMessage?.id,metadata:t,headers:n,body:r})}}}));function Ndn(e){if(!e.length)return``;for(var t=`arg`,n=0;n<e.length;++n){var r=void 0;e[n]===null||typeof e[n]!=`object`&&typeof e[n]!=`function`?r=typeof e[n]==`string`?`"`+e[n]+`"`:String(e[n]):g7.has(e[n])?r=g7.get(e[n]):(r=_7,g7.set(e[n],_7++)),t+=`@`+r}return t}var g7,_7,Pdn=s((()=>{g7=new WeakMap,_7=0}));function Fdn(e){if(typeof e==`function`)try{e=e()}catch{e=``}return e=Array.isArray(e)?Ndn(e):String(e||``),e}var v7,Idn=s((()=>{Pdn(),v7=function(){function e(e){e===void 0&&(e=0),this.items=new Map,this.ttl=e}return e.prototype.serializeKey=function(e){return Fdn(e)},e.prototype.get=function(e){var t=this.serializeKey(e);return this.items.get(t)},e.prototype.set=function(e,t,n){var r=this.serializeKey(e),i=n||this.ttl,a=Date.now(),o={data:t,createdAt:a,expiresAt:i?a+i:1/0};this.dispatchExpire(i,o,r),this.items.set(r,o)},e.prototype.dispatchExpire=function(e,t,n){var r=this;e&&setTimeout(function(){Date.now()>=t.expiresAt&&r.delete(n)},e)},e.prototype.delete=function(e){this.items.delete(e)},e}()}));function Ldn(){return navigator.onLine===void 0?!0:navigator.onLine}function Rdn(){return typeof document<`u`&&document.visibilityState!==void 0?document.visibilityState!==`hidden`:!0}var zdn,y7,Bdn=s((()=>{zdn=function(e){return fetch(e).then(function(e){return e.json()})},y7={isOnline:Ldn,isDocumentVisible:Rdn,fetcher:zdn}}));function Vdn(e,t,n){var r=w7.get(e);r?r.data.push(t):w7.set(e,[t],n>0?n+5e3:n)}function Hdn(e,t,n){if(n.isDocumentVisible()&&!(n.errorRetryCount!==void 0&&t>n.errorRetryCount)){var r=Math.min(t||0,n.errorRetryCount),i=r*n.errorRetryInterval;setTimeout(function(){e(null,{errorRetryCount:r+1,shouldRetryOnError:!0})},i)}}function Udn(){for(var e=this,t=[],n=0;n<arguments.length;n++)t[n]=arguments[n];var r,i,a=b7({},E7),o=!1,s=!1,c=ba(),l=c?.proxy||c;if(!l)return console.error("Could not get current instance, check to make sure that `useSwrv` is declared in the top level of the setup function."),null;var u=l?.$isServer||!1;t.length>=1&&(r=t[0]),t.length>=2&&(i=t[1]),t.length>2&&(a=b7(b7({},a),t[2]));var d=u?a.serverTTL:a.ttl,f=typeof r==`function`?r:A(r);i===void 0&&(i=a.fetcher);var p=null;p||=fn({data:void 0,error:void 0,isValidating:!0,isLoading:!0,key:null});var m=function(t,n){return x7(e,void 0,void 0,function(){var e,r,s,c,l,u,h,g=this;return S7(this,function(_){switch(_.label){case 0:return e=p.data===void 0,r=f.value,r?(s=a.cache.get(r),c=s&&s.data,p.isValidating=!0,p.isLoading=!c,c&&(p.data=c.data,p.error=c.error),l=t||i,!l||!a.isDocumentVisible()&&!e||n?.forceRevalidate!==void 0&&!n?.forceRevalidate||s&&(u=!!(Date.now()-s.createdAt>=a.dedupingInterval||n?.forceRevalidate),!u)?(p.isValidating=!1,p.isLoading=!1,[2]):(h=function(){return x7(g,void 0,void 0,function(){var e,t,i,s;return S7(this,function(c){switch(c.label){case 0:return e=T7.get(r),e?[3,2]:(t=Array.isArray(r)?r:[r],i=l.apply(void 0,Kdn([],Gdn(t),!1)),T7.set(r,i,a.dedupingInterval),[4,D7(r,i,a.cache,d)]);case 1:return c.sent(),[3,4];case 2:return[4,D7(r,e.data,a.cache,d)];case 3:c.sent(),c.label=4;case 4:return p.isValidating=!1,p.isLoading=!1,T7.delete(r),p.error!==void 0&&(s=!o&&a.shouldRetryOnError&&(n?n.shouldRetryOnError:!0),s&&Hdn(m,n?n.errorRetryCount:1,a)),[2]}})})},c&&a.revalidateDebounce?(setTimeout(function(){return x7(g,void 0,void 0,function(){return S7(this,function(e){switch(e.label){case 0:return o?[3,2]:[4,h()];case 1:e.sent(),e.label=2;case 2:return[2]}})})},a.revalidateDebounce),[3,3]):[3,1])):[2];case 1:return[4,h()];case 2:_.sent(),_.label=3;case 3:return[2]}})})},h=function(){return x7(e,void 0,void 0,function(){return S7(this,function(e){return[2,m(null,{shouldRetryOnError:!1})]})})},g=null;Hi(function(){var t=function(){return x7(e,void 0,void 0,function(){return S7(this,function(e){switch(e.label){case 0:return!p.error&&a.isOnline()?[4,m()]:[3,2];case 1:return e.sent(),[3,3];case 2:g&&clearTimeout(g),e.label=3;case 3:return a.refreshInterval&&!o&&(g=setTimeout(t,a.refreshInterval)),[2]}})})};a.refreshInterval&&(g=setTimeout(t,a.refreshInterval)),a.revalidateOnFocus&&(document.addEventListener(`visibilitychange`,h,!1),window.addEventListener(`focus`,h,!1))}),Gi(function(){o=!0,g&&clearTimeout(g),a.revalidateOnFocus&&(document.removeEventListener(`visibilitychange`,h,!1),window.removeEventListener(`focus`,h,!1));var e=w7.get(f.value);e&&(e.data=e.data.filter(function(e){return e!==p}))});try{mr(f,function(e){_n(f)||(f.value=e),p.key=e,p.isValidating=!!e,Vdn(f.value,p,d),!u&&!s&&f.value&&m(),s=!1},{immediate:!0})}catch{}return b7(b7({},nte(p)),{mutate:function(e,t){return m(e,b7(b7({},t),{forceRevalidate:!0}))}})}function Wdn(e){return typeof e==`object`&&!!e&&typeof e.then==`function`}var b7,x7,S7,Gdn,Kdn,C7,w7,T7,E7,D7,qdn=s((()=>{W(),Bdn(),Idn(),b7=function(){return b7=Object.assign||function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var i in t=arguments[n],t)Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i]);return e},b7.apply(this,arguments)},x7=function(e,t,n,r){function i(e){return e instanceof n?e:new n(function(t){t(e)})}return new(n||=Promise)(function(n,a){function o(e){try{c(r.next(e))}catch(e){a(e)}}function s(e){try{c(r.throw(e))}catch(e){a(e)}}function c(e){e.done?n(e.value):i(e.value).then(o,s)}c((r=r.apply(e,t||[])).next())})},S7=function(e,t){var n={label:0,sent:function(){if(a[0]&1)throw a[1];return a[1]},trys:[],ops:[]},r,i,a,o;return o={next:s(0),throw:s(1),return:s(2)},typeof Symbol==`function`&&(o[Symbol.iterator]=function(){return this}),o;function s(e){return function(t){return c([e,t])}}function c(o){if(r)throw TypeError(`Generator is already executing.`);for(;n;)try{if(r=1,i&&(a=o[0]&2?i.return:o[0]?i.throw||((a=i.return)&&a.call(i),0):i.next)&&!(a=a.call(i,o[1])).done)return a;switch(i=0,a&&(o=[o[0]&2,a.value]),o[0]){case 0:case 1:a=o;break;case 4:return n.label++,{value:o[1],done:!1};case 5:n.label++,i=o[1],o=[0];continue;case 7:o=n.ops.pop(),n.trys.pop();continue;default:if((a=n.trys,!(a=a.length>0&&a[a.length-1]))&&(o[0]===6||o[0]===2)){n=0;continue}if(o[0]===3&&(!a||o[1]>a[0]&&o[1]<a[3])){n.label=o[1];break}if(o[0]===6&&n.label<a[1]){n.label=a[1],a=o;break}if(a&&n.label<a[2]){n.label=a[2],n.ops.push(o);break}a[2]&&n.ops.pop(),n.trys.pop();continue}o=t.call(e,n)}catch(e){o=[6,e],i=0}finally{r=a=0}if(o[0]&5)throw o[1];return{value:o[0]?o[1]:void 0,done:!0}}},Gdn=function(e,t){var n=typeof Symbol==`function`&&e[Symbol.iterator];if(!n)return e;var r=n.call(e),i,a=[],o;try{for(;(t===void 0||t-- >0)&&!(i=r.next()).done;)a.push(i.value)}catch(e){o={error:e}}finally{try{i&&!i.done&&(n=r.return)&&n.call(r)}finally{if(o)throw o.error}}return a},Kdn=function(e,t,n){if(n||arguments.length===2)for(var r=0,i=t.length,a;r<i;r++)(a||!(r in t))&&(a||=Array.prototype.slice.call(t,0,r),a[r]=t[r]);return e.concat(a||Array.prototype.slice.call(t))},C7=new v7,w7=new v7,T7=new v7,E7={cache:C7,refreshInterval:0,ttl:0,serverTTL:1e3,dedupingInterval:2e3,revalidateOnFocus:!0,revalidateDebounce:0,shouldRetryOnError:!0,errorRetryInterval:5e3,errorRetryCount:5,fetcher:y7.fetcher,isOnline:y7.isOnline,isDocumentVisible:y7.isDocumentVisible},D7=function(e,t,n,r){return n===void 0&&(n=C7),r===void 0&&(r=E7.ttl),x7(void 0,void 0,void 0,function(){var i,a,o,s,c,l,u;return S7(this,function(d){switch(d.label){case 0:if(!Wdn(t))return[3,5];d.label=1;case 1:return d.trys.push([1,3,,4]),[4,t];case 2:return i=d.sent(),[3,4];case 3:return s=d.sent(),a=s,[3,4];case 4:return[3,6];case 5:i=t,d.label=6;case 6:if(o=!1,c={data:i,error:a,isValidating:o},i!==void 0)try{n.set(e,c,r)}catch(e){console.error(`swrv(mutate): failed to set cache`,e)}return l=w7.get(e),l&&l.data.length&&(u=l.data.filter(function(t){return t.key===e}),u.forEach(function(e,t){c.data!==void 0&&(e.data=c.data),e.error=c.error,e.isValidating=c.isValidating,e.isLoading=c.isValidating,t!==u.length-1&&delete u[t]}),u=u.filter(Boolean)),[2,c]}})})}})),O7,Jdn=s((()=>{Idn(),qdn(),O7=Udn})),Ydn,Xdn,Zdn=s((()=>{Jdn(),W(),Mdn(),O7.default,Ydn=class{constructor(e){this.statusRef=A(`ready`),this.errorRef=A(void 0),this.pushMessage=e=>{this.messagesRef.value=[...this.messagesRef.value,e]},this.popMessage=()=>{this.messagesRef.value=this.messagesRef.value.slice(0,-1)},this.replaceMessage=(e,t)=>{this.messagesRef.value[e]={...t}},this.snapshot=e=>e,this.messagesRef=A(e??[])}get messages(){return this.messagesRef.value}set messages(e){this.messagesRef.value=e}get status(){return this.statusRef.value}set status(e){this.statusRef.value=e}get error(){return this.errorRef.value}set error(e){this.errorRef.value=e}},Xdn=class extends jdn{constructor({messages:e,...t}){super({...t,state:new Ydn(e)})}},O7.default}));function Qdn({registryDocuments:e,workspaceStore:t,baseUrl:n,proxyUrl:r,getAccessToken:i,getAgentKey:a}){let o=new Xdn({sendAutomaticallyWhen:qun,transport:new h7({api:`${n}/vector/openapi/chat`,headers:()=>Han({getAccessToken:i,getAgentKey:a}),body:()=>({registryDocuments:e.value})}),async onToolCall({toolCall:e}){e.dynamic||e.toolName===`execute-request`&&e.input.method.toLowerCase()===`get`&&await i8({documentSettings:Xsn(t),input:e.input,toolCallId:e.toolCallId,chat:o,proxyUrl:r.value})}});return o}function $dn({initialRegistryDocuments:e,registryUrl:t,dashboardUrl:n,platformProxyUrl:r,baseUrl:i,mode:a,isLoggedIn:o,getAccessToken:s,getAgentKey:c,getActiveDocumentJson:l,prefilledMessageRef:u,hideAddApi:d}){let f=A(u?.value??``),p=A([]),m=fn({}),h=A([]),g=A(a8.DEFAULT_PROXY_URL),_=U(()=>g.value?.trim()||a8.DEFAULT_PROXY_URL),y=A(),b=$sn(),x=_3(),S=m6({plugins:[scn({persistAuth:!0})]}),C=U(()=>v(ye,{proxyUrl:_.value,persistAuth:!0})),w=Qdn({registryDocuments:p,workspaceStore:S,baseUrl:i,proxyUrl:_,getAccessToken:s,getAgentKey:c}),ee=Uan({baseUrl:i,getAccessToken:s,getAgentKey:c}),te=U(()=>w.status===`submitted`||w.status===`streaming`&&!w.lastMessage?.parts.some(e=>e.type===`text`));mr(()=>w.status,()=>{w.status===`streaming`&&(f.value=``)}),u&&mr(u,async e=>{e&&(f.value=e,b.accepted.value&&await w.sendMessage({text:f.value}))});let ne=nE();async function re({namespace:e,slug:n,removable:r=!0,tmp:i=!1}){if(p.value.find(t=>t.namespace===e&&t.slug===n))return;let a=`@${e}/${n}`;m[a]=!0;let o=await h8({namespace:e,slug:n,workspaceStore:S,registryUrl:t,registryDocuments:p,config:C.value,getAccessToken:s,api:ee,removable:r});if(m[a]=!1,!o.success)throw i?(rcn(),o.error):(console.warn(`[AGENT]: Unable to load document`,o.error),j7(`Unable to load the document @${e}/${n}`,`warn`),o.error)}async function T({namespace:e,slug:n,removable:r=!0}){if(p.value.find(t=>t.namespace===e&&t.slug===n))return;let a=`@${e}/${n}`;m[a]=!0;let o=await y6.fromUnsafe(()=>fetch(`${i}/vector/registry/embeddings/${e}/${n}`,{method:`GET`}),e=>g6(`FAILED_TO_GET_EMBEDDING_STATUS`,e));if(o.success&&o.data.ok){let i=await h8({namespace:e,slug:n,workspaceStore:S,registryUrl:t,registryDocuments:p,config:C.value,getAccessToken:s,api:ee,removable:r});i.success||(console.warn(`[AGENT]: Unable to load document`,i.error),j7(`Unable to load the document @${e}/${n}`,`warn`))}else console.warn(`[AGENT]: Document could not be embedded`),j7(`Unable to embed the document @${e}/${n}`,`warn`);m[a]=!1}function ie({namespace:e,slug:t}){p.value=p.value.filter(n=>!(n.namespace===e&&n.slug===t)),S.deleteDocument(Gan(e,t))}return e.forEach(({namespace:e,slug:t})=>re({namespace:e,slug:t,removable:!1})),{prompt:f,chat:w,workspaceStore:S,eventBus:x,loading:te,settingsModal:ne,config:C,registryUrl:t,dashboardUrl:n,platformProxyUrl:r,baseUrl:i,registryDocuments:p,pendingDocuments:m,proxyUrl:_,proxyUrlRaw:g,mode:a,terms:b,isLoggedIn:o,addDocument:re,addDocumentAsync:T,removeDocument:ie,getAccessToken:s,getAgentKey:c,api:ee,uploadedTmpDocumentUrl:y,curatedDocuments:h,getActiveDocumentJson:l,hideAddApi:d}}function k7(){let e=fr(A7);if(!e)throw Error(`No state provided.`);return e}var A7,j7,M7=s((()=>{_6(),Wan(),Kan(),S6(),Ksn(),o8(),d8(),ecn(),m8(),ccn(),lcn(),W(),gX(),Zdn(),kE(),v3(),Mdn(),b6(),le(),A7=Symbol(`STATE_SYMBOL`),{toast:j7}=pX()}));function efn(){let{api:e,addDocument:t,mode:n,getAgentKey:r}=k7(),{toast:i}=pX();Hi(async()=>{if(n!==`full`||!r)return;let a=await e.getKeyDocuments();if(!a.success){i(`Failed to fetch your OpenAPI document. The Agent key may be invalid.`,`error`);return}a.data.documents.forEach(({namespace:e,slug:n})=>t({namespace:e,slug:n,removable:!1}))})}var tfn=s((()=>{M7(),W(),gX()}));function nfn(){let e=k7();function t(e){let t=e?.parts.at(-1);if(t&&t.type===`text`)return t.text}mr([()=>e.chat.status,()=>t(e.chat.lastMessage)],async()=>{await ar(),window.scrollTo(0,document.body.scrollHeight)})}var rfn=s((()=>{M7(),W()}));function ifn(){let{api:e,curatedDocuments:t}=k7();Hi(async()=>{let n=await e.getCuratedDocuments();n.success&&(t.value=n.data.results)})}var afn=s((()=>{M7(),W()})),N7,P7=s((()=>{N7=(e,t)=>{let n=e.__vccOpts||e;for(let[e,r]of t)n[e]=r;return n}})),ofn,sfn=s((()=>{le(),ofn=`ask-for-authentication`,T({documentName:x(),uniqueIdentifier:x({typeComment:`Needed for legacy support for old clients`})})})),cfn=s((()=>{le(),T({question:x()})}));function lfn(e,t){return F(),I(`div`,dfn,[...t[0]||=[ti(`<svg fill="none" height="16" viewBox="0 0 16 16" width="16" xmlns="http://www.w3.org/2000/svg" data-v-e3416cd5><rect height="14.25" rx="7.125" width="14.25" x="0.875" y="0.875" data-v-e3416cd5></rect><rect height="14.25" rx="7.125" stroke="currentColor" stroke-width="1.75" width="14.25" x="0.875" y="0.875" data-v-e3416cd5></rect><g clip-path="url(#clip0_74_840)" data-v-e3416cd5><path d="M11.6037 6.841L7.59117 10.8535C7.49742 10.9472 7.37029 10.9998 7.23774 10.9998C7.10519 10.9998 6.97806 10.9472 6.8843 10.8535L4.64617 8.6035C4.55257 8.50975 4.5 8.38269 4.5 8.25022C4.5 8.11774 4.55257 7.99068 4.64617 7.89694L5.27117 7.27194C5.36488 7.17862 5.49174 7.12623 5.62399 7.12623C5.75623 7.12623 5.88309 7.17862 5.9768 7.27194L7.25024 8.50694L10.274 5.52037C10.3677 5.42696 10.4946 5.37451 10.627 5.37451C10.7593 5.37451 10.8862 5.42696 10.9799 5.52037L11.6034 6.131C11.6502 6.17746 11.6875 6.23274 11.7129 6.29366C11.7383 6.35458 11.7514 6.41993 11.7514 6.48593C11.7514 6.55194 11.7384 6.6173 11.713 6.67824C11.6877 6.73918 11.6505 6.7945 11.6037 6.841Z" fill="currentColor" data-v-e3416cd5></path></g><defs data-v-e3416cd5><clipPath id="clip0_74_840" data-v-e3416cd5><rect height="8" rx="4" width="8" x="4" y="4" data-v-e3416cd5></rect></clipPath></defs></svg> Authorized `,2)]])}var ufn,dfn,ffn,pfn=s((()=>{P7(),W(),ufn={},dfn={class:`authenticationProvided`},ffn=N7(ufn,[[`render`,lfn],[`__scopeId`,`data-v-e3416cd5`]])}));function mfn(e,t){return F(),I(`div`,gfn,[...t[0]||=[ti(`<svg fill="none" height="16" viewBox="0 0 16 16" width="16" xmlns="http://www.w3.org/2000/svg" data-v-d15ef40b><rect height="14.25" rx="7.125" width="14.25" x="0.875" y="0.875" data-v-d15ef40b></rect><rect height="14.25" rx="7.125" stroke="currentColor" stroke-width="1.5" width="14.25" x="0.875" y="0.875" data-v-d15ef40b></rect><g clip-path="url(#clip0_74_585)" data-v-d15ef40b><path d="M10.75 5.5V10.5C10.75 10.6326 10.6973 10.7598 10.6036 10.8536C10.5098 10.9473 10.3826 11 10.25 11H9C8.86739 11 8.74021 10.9473 8.64645 10.8536C8.55268 10.7598 8.5 10.6326 8.5 10.5V5.5C8.5 5.36739 8.55268 5.24021 8.64645 5.14645C8.74021 5.05268 8.86739 5 9 5H10.25C10.3826 5 10.5098 5.05268 10.6036 5.14645C10.6973 5.24021 10.75 5.36739 10.75 5.5ZM7 5H5.75C5.61739 5 5.49021 5.05268 5.39645 5.14645C5.30268 5.24021 5.25 5.36739 5.25 5.5V10.5C5.25 10.6326 5.30268 10.7598 5.39645 10.8536C5.49021 10.9473 5.61739 11 5.75 11H7C7.13261 11 7.25979 10.9473 7.35355 10.8536C7.44732 10.7598 7.5 10.6326 7.5 10.5V5.5C7.5 5.36739 7.44732 5.24021 7.35355 5.14645C7.25979 5.05268 7.13261 5 7 5Z" fill="currentColor" data-v-d15ef40b></path></g><defs data-v-d15ef40b><clipPath id="clip0_74_585" data-v-d15ef40b><rect height="8" rx="4" width="8" x="4" y="4" data-v-d15ef40b></rect></clipPath></defs></svg> Authentication required `,2)]])}var hfn,gfn,_fn,vfn=s((()=>{P7(),W(),hfn={},gfn={class:`authenticationRequired`},_fn=N7(hfn,[[`render`,mfn],[`__scopeId`,`data-v-d15ef40b`]])})),yfn=s((()=>{JGt()})),bfn,xfn=s((()=>{M7(),W(),QI(),yfn(),Zf(),bfn=N({__name:`Auth`,props:{options:{},name:{},authStore:{},document:{},eventBus:{},selectedServer:{},environment:{}},setup(e){let{workspaceStore:t}=k7(),n=U(()=>MI(e.document?.security)),r=U(()=>YI(e.document?.components?.securitySchemes??{},e.options.authentication?.securitySchemes,e.authStore,e.name)),i=U(()=>RI(e.authStore.getAuthSelectedSchemas({type:`document`,documentName:e.name}),void 0,n.value,r.value,e.options.authentication?.preferredSecurityScheme)),a=Sn(),{focused:o}=sye(a);return mr(o,n=>{n&&t.update(`x-scalar-active-document`,e.name)}),(t,o)=>(F(),I(`div`,{ref_key:`focusRef`,ref:a,tabindex:`0`},[Object.keys(r.value).length?(F(),L(j(n$),{key:0,authStore:e.authStore,documentSlug:e.name,environment:e.environment,eventBus:e.eventBus,isReadOnly:``,isStatic:``,layout:`reference`,meta:{type:`document`},persistAuth:e.options.persistAuth,proxyUrl:e.options.proxyUrl??``,securityRequirements:n.value,securitySchemes:r.value,selectedSecurity:i.value,server:e.selectedServer,title:`Authentication`},null,8,[`authStore`,`documentSlug`,`environment`,`eventBus`,`persistAuth`,`proxyUrl`,`securityRequirements`,`securitySchemes`,`selectedSecurity`,`server`])):B(``,!0)],512))}})})),F7,Sfn=s((()=>{xfn(),F7=bfn})),Cfn,wfn,Tfn,Efn,Dfn=s((()=>{sfn(),M7(),pfn(),vfn(),Sfn(),W(),kE(),QI(),OI(),Ou(),Cfn={class:`toggleButton`},wfn={class:`authContent`},Tfn={class:`authContentInner`},Efn=N({__name:`AskForAuthentication`,props:{messagePart:{}},setup(e){let{workspaceStore:t,eventBus:n,config:r,chat:i}=k7(),a=U(()=>e.messagePart.value.input?.documentName),o=U(()=>{if(!a.value)return;let e=t.workspace.documents[a.value];return EI(e)?e:void 0}),s=U(()=>{if(o.value)return kI(t,o.value).environment}),c=U(()=>{if(!o.value)return;let e=XI(o.value.servers,{documentUrl:o.value[`x-scalar-original-source-url`]});return ZI(o.value,null,null,e)}),l=U(()=>a.value&&s.value&&c.value);async function u(){await i.addToolOutput({toolCallId:e.messagePart.value.toolCallId,output:`Authentication provided.`,tool:ofn,state:`output-available`})}return(i,d)=>(F(),I(`div`,{class:O([`askForAuthentication`,{open:l.value}])},[R(`div`,Cfn,[e.messagePart.value.state===`output-available`?(F(),L(ffn,{key:0})):B(``,!0),e.messagePart.value.state===`input-available`?(F(),L(_fn,{key:1})):B(``,!0),e.messagePart.value.state===`input-available`?(F(),L(j(gf),{key:2,class:`authorizeButton`,size:`xs`,onClick:u},{default:M(()=>[d[0]||=z(` Authorize `,-1),H(j(Ase),{weight:`bold`})]),_:1})):B(``,!0)]),R(`div`,wfn,[R(`div`,Tfn,[a.value&&o.value&&s.value&&c.value?(F(),L(F7,{key:0,authStore:j(t).auth,document:o.value,environment:s.value,eventBus:j(n),name:a.value,options:j(r),selectedServer:c.value},null,8,[`authStore`,`document`,`environment`,`eventBus`,`name`,`options`,`selectedServer`])):B(``,!0)])])],2))}})})),Ofn,kfn=s((()=>{P7(),Dfn(),Ofn=N7(Efn,[[`__scopeId`,`data-v-3e7aa176`]])}));function Afn(e,t){return F(),I(`div`,Mfn,[...t[0]||=[ti(`<svg fill="none" height="16" viewBox="0 0 16 16" width="16" xmlns="http://www.w3.org/2000/svg" data-v-d08225db><rect height="14.25" rx="7.125" width="14.25" x="0.875" y="0.875" data-v-d08225db></rect><rect height="14.25" rx="7.125" stroke="currentColor" stroke-width="1.5" width="14.25" x="0.875" y="0.875" data-v-d08225db></rect><g clip-path="url(#clip0_74_585)" data-v-d08225db><path d="M10.75 5.5V10.5C10.75 10.6326 10.6973 10.7598 10.6036 10.8536C10.5098 10.9473 10.3826 11 10.25 11H9C8.86739 11 8.74021 10.9473 8.64645 10.8536C8.55268 10.7598 8.5 10.6326 8.5 10.5V5.5C8.5 5.36739 8.55268 5.24021 8.64645 5.14645C8.74021 5.05268 8.86739 5 9 5H10.25C10.3826 5 10.5098 5.05268 10.6036 5.14645C10.6973 5.24021 10.75 5.36739 10.75 5.5ZM7 5H5.75C5.61739 5 5.49021 5.05268 5.39645 5.14645C5.30268 5.24021 5.25 5.36739 5.25 5.5V10.5C5.25 10.6326 5.30268 10.7598 5.39645 10.8536C5.49021 10.9473 5.61739 11 5.75 11H7C7.13261 11 7.25979 10.9473 7.35355 10.8536C7.44732 10.7598 7.5 10.6326 7.5 10.5V5.5C7.5 5.36739 7.44732 5.24021 7.35355 5.14645C7.25979 5.05268 7.13261 5 7 5Z" fill="currentColor" data-v-d08225db></path></g><defs data-v-d08225db><clipPath id="clip0_74_585" data-v-d08225db><rect height="8" rx="4" width="8" x="4" y="4" data-v-d08225db></rect></clipPath></defs></svg> Accept Request to Continue `,2)]])}var jfn,Mfn,Nfn,Pfn=s((()=>{P7(),W(),jfn={},Mfn={class:`autosendPaused`},Nfn=N7(jfn,[[`render`,Afn],[`__scopeId`,`data-v-d08225db`]])}));function Ffn(e,t){return F(),I(`div`,Lfn,[...t[0]||=[R(`div`,{class:`playIcon`},[R(`svg`,{fill:`currentColor`,height:`32`,viewBox:`0 0 256 256`,width:`32`,xmlns:`http://www.w3.org/2000/svg`},[R(`path`,{d:`M240,128a15.74,15.74,0,0,1-7.6,13.51L88.32,229.65a16,16,0,0,1-16.2.3A15.86,15.86,0,0,1,64,216.13V39.87a15.86,15.86,0,0,1,8.12-13.82,16,16,0,0,1,16.2.3L232.4,114.49A15.74,15.74,0,0,1,240,128Z`})])],-1),z(` Building Request... `,-1)]])}var Ifn,Lfn,Rfn,zfn=s((()=>{P7(),W(),Ifn={},Lfn={class:`buildingRequest`},Rfn=N7(Ifn,[[`render`,Ffn],[`__scopeId`,`data-v-5749c429`]])}));function Bfn(e,t){return F(),I(`div`,Hfn,[...t[0]||=[ti(`<svg fill="none" height="16" viewBox="0 0 16 16" width="16" xmlns="http://www.w3.org/2000/svg" data-v-bb311586><rect height="14.25" rx="7.125" width="14.25" x="0.875" y="0.875" data-v-bb311586></rect><rect height="14.25" rx="7.125" stroke="var(--scalar-color-green)" stroke-width="1.75" width="14.25" x="0.875" y="0.875" data-v-bb311586></rect><g clip-path="url(#clip0_74_840)" data-v-bb311586><path d="M11.6037 6.841L7.59117 10.8535C7.49742 10.9472 7.37029 10.9998 7.23774 10.9998C7.10519 10.9998 6.97806 10.9472 6.8843 10.8535L4.64617 8.6035C4.55257 8.50975 4.5 8.38269 4.5 8.25022C4.5 8.11774 4.55257 7.99068 4.64617 7.89694L5.27117 7.27194C5.36488 7.17862 5.49174 7.12623 5.62399 7.12623C5.75623 7.12623 5.88309 7.17862 5.9768 7.27194L7.25024 8.50694L10.274 5.52037C10.3677 5.42696 10.4946 5.37451 10.627 5.37451C10.7593 5.37451 10.8862 5.42696 10.9799 5.52037L11.6034 6.131C11.6502 6.17746 11.6875 6.23274 11.7129 6.29366C11.7383 6.35458 11.7514 6.41993 11.7514 6.48593C11.7514 6.55194 11.7384 6.6173 11.713 6.67824C11.6877 6.73918 11.6505 6.7945 11.6037 6.841Z" fill="var(--scalar-color-green)" data-v-bb311586></path></g><defs data-v-bb311586><clipPath id="clip0_74_840" data-v-bb311586><rect height="8" rx="4" width="8" x="4" y="4" data-v-bb311586></rect></clipPath></defs></svg> Request Approved `,2)]])}var Vfn,Hfn,Ufn,Wfn=s((()=>{P7(),W(),Vfn={},Hfn={class:`requestApproved`},Ufn=N7(Vfn,[[`render`,Bfn],[`__scopeId`,`data-v-bb311586`]])}));function Gfn(e,t){return F(),I(`div`,qfn,[...t[0]||=[R(`i`,{class:`requestFailedIcon`},[R(`svg`,{fill:`currentColor`,height:`100%`,viewBox:`0 0 256 256`,width:`100%`,xmlns:`http://www.w3.org/2000/svg`},[R(`path`,{d:`M216,48V208a16,16,0,0,1-16,16H160a16,16,0,0,1-16-16V48a16,16,0,0,1,16-16h40A16,16,0,0,1,216,48ZM96,32H56A16,16,0,0,0,40,48V208a16,16,0,0,0,16,16H96a16,16,0,0,0,16-16V48A16,16,0,0,0,96,32Z`})])],-1),z(` Request Failed `,-1)]])}var Kfn,qfn,Jfn,Yfn=s((()=>{P7(),W(),Kfn={},qfn={class:`requestFailed`},Jfn=N7(Kfn,[[`render`,Gfn],[`__scopeId`,`data-v-bc27e533`]])}));function Xfn(e,t){return F(),I(`div`,Qfn,[...t[0]||=[R(`svg`,{fill:`currentColor`,height:`16`,viewBox:`0 0 256 256`,width:`16`,xmlns:`http://www.w3.org/2000/svg`},[R(`path`,{d:`M56.88,31.93A12,12,0,1,0,39.12,48.07l7.81,8.59A108,108,0,0,0,31.85,177.23L21,209.66A20,20,0,0,0,46.34,235l32.43-10.81a108.08,108.08,0,0,0,112.55-8.66l7.8,8.58a12,12,0,0,0,17.76-16.14ZM128,212a83.91,83.91,0,0,1-42-11.27,12,12,0,0,0-9.82-1l-29.79,9.93,9.93-29.79a12,12,0,0,0-1-9.82,84,84,0,0,1,7.94-95.49l111.84,123A83.83,83.83,0,0,1,128,212Zm108-84a107.22,107.22,0,0,1-8.65,42.4A12,12,0,0,1,205.28,161a84.07,84.07,0,0,0-102.77-113,12,12,0,0,1-7.27-22.87A108.08,108.08,0,0,1,236,128Z`})],-1),z(` Request Rejected `,-1)]])}var Zfn,Qfn,$fn,epn=s((()=>{P7(),W(),Zfn={},Qfn={class:`requestRejected`},$fn=N7(Zfn,[[`render`,Xfn],[`__scopeId`,`data-v-9803a54c`]])}));function tpn(e,t){return F(),I(`div`,rpn,[...t[0]||=[ti(`<svg fill="none" height="16" viewBox="0 0 16 16" width="16" xmlns="http://www.w3.org/2000/svg" data-v-acc2c0d8><rect height="14.25" rx="7.125" width="14.25" x="0.875" y="0.875" data-v-acc2c0d8></rect><rect height="14.25" rx="7.125" stroke="currentColor" stroke-width="1.75" width="14.25" x="0.875" y="0.875" data-v-acc2c0d8></rect><g clip-path="url(#clip0_74_840)" data-v-acc2c0d8><path d="M11.6037 6.841L7.59117 10.8535C7.49742 10.9472 7.37029 10.9998 7.23774 10.9998C7.10519 10.9998 6.97806 10.9472 6.8843 10.8535L4.64617 8.6035C4.55257 8.50975 4.5 8.38269 4.5 8.25022C4.5 8.11774 4.55257 7.99068 4.64617 7.89694L5.27117 7.27194C5.36488 7.17862 5.49174 7.12623 5.62399 7.12623C5.75623 7.12623 5.88309 7.17862 5.9768 7.27194L7.25024 8.50694L10.274 5.52037C10.3677 5.42696 10.4946 5.37451 10.627 5.37451C10.7593 5.37451 10.8862 5.42696 10.9799 5.52037L11.6034 6.131C11.6502 6.17746 11.6875 6.23274 11.7129 6.29366C11.7383 6.35458 11.7514 6.41993 11.7514 6.48593C11.7514 6.55194 11.7384 6.6173 11.713 6.67824C11.6877 6.73918 11.6505 6.7945 11.6037 6.841Z" fill="currentColor" data-v-acc2c0d8></path></g><defs data-v-acc2c0d8><clipPath id="clip0_74_840" data-v-acc2c0d8><rect height="8" rx="4" width="8" x="4" y="4" data-v-acc2c0d8></rect></clipPath></defs></svg> Request Succeeded `,2)]])}var npn,rpn,ipn,apn=s((()=>{P7(),W(),npn={},rpn={class:`requestSuccess`},ipn=N7(npn,[[`render`,tpn],[`__scopeId`,`data-v-acc2c0d8`]])}));function opn(e){let t=spn[e];if(t)return t;if(e.endsWith(`+json`))return{extension:`.json`,raw:!0,language:`json`}}var spn,cpn=s((()=>{spn={"application/epub+zip":{extension:`.epub`},"application/gzip":{extension:`.gz`},"application/java-archive":{extension:`.jar`},"application/javascript":{extension:`.js`,raw:!0},"application/json":{extension:`.json`,raw:!0,language:`json`},"application/ld+json":{extension:`.jsonld`,raw:!0,language:`json`},"application/problem+json":{extension:`.json`,raw:!0,language:`json`},"application/vnd.api+json":{extension:`.json`,raw:!0,language:`json`},"application/dns-json":{extension:`.json`,raw:!0,language:`json`},"application/msword":{extension:`.doc`},"application/octet-stream":{extension:`.bin`},"application/ogg":{extension:`.ogx`},"application/pdf":{extension:`.pdf`,preview:`object`},"application/rtf":{extension:`.rtf`,raw:!0},"application/vnd.amazon.ebook":{extension:`.azw`},"application/vnd.apple.installer+xml":{extension:`.mpkg`,raw:!0,language:`xml`},"application/vnd.mozilla.xul+xml":{extension:`.xul`,raw:!0,language:`xml`},"application/vnd.ms-excel":{extension:`.xls`},"application/vnd.ms-fontobject":{extension:`.eot`},"application/vnd.ms-powerpoint":{extension:`.ppt`},"application/vnd.oasis.opendocument.presentation":{extension:`.odp`},"application/vnd.oasis.opendocument.spreadsheet":{extension:`.ods`},"application/vnd.oasis.opendocument.text":{extension:`.odt`},"application/vnd.openxmlformats-officedocument.presentationml.presentation":{extension:`.pptx`},"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet":{extension:`.xlsx`},"application/vnd.openxmlformats-officedocument.wordprocessingml.document":{extension:`.docx`},"application/vnd.rar":{extension:`.rar`},"application/vnd.visio":{extension:`.vsd`},"application/x-7z-compressed":{extension:`.7z`},"application/x-abiword":{extension:`.abw`},"application/x-bzip":{extension:`.bz`},"application/x-bzip2":{extension:`.bz2`},"application/x-cdf":{extension:`.cda`},"application/x-csh":{extension:`.csh`},"application/x-freearc":{extension:`.arc`},"application/x-httpd-php":{extension:`.php`,raw:!0},"application/x-sh":{extension:`.sh`,raw:!0},"application/x-tar":{extension:`.tar`},"application/xhtml+xml":{extension:`.xhtml`,raw:!0,language:`html`},"application/xml":{extension:`.xml`,raw:!0,language:`xml`},"application/yaml":{extension:`.yaml`,raw:!0,language:`yaml`},"application/zip":{extension:`.zip`},"audio/aac":{extension:`.aac`},"audio/midi":{extension:`.midi`},"audio/mpeg":{extension:`.mp3`,preview:`audio`},"audio/ogg":{extension:`.oga`},"audio/wav":{extension:`.wav`},"audio/webm":{extension:`.weba`},"font/otf":{extension:`.otf`},"font/ttf":{extension:`.ttf`},"font/woff":{extension:`.woff`},"font/woff2":{extension:`.woff2`},"image/apng":{extension:`.apng`,preview:`image`,alpha:!0},"image/avif":{extension:`.avif`,preview:`image`},"image/bmp":{extension:`.bmp`,preview:`image`},"image/gif":{extension:`.gif`,preview:`image`,alpha:!0},"image/jpeg":{extension:`.jpg`,preview:`image`},"image/png":{extension:`.png`,preview:`image`,alpha:!0},"image/svg+xml":{extension:`.svg`,raw:!0,language:`xml`,preview:`image`,alpha:!0},"image/tiff":{extension:`.tiff`},"image/vnd.microsoft.icon":{extension:`.ico`,preview:`image`},"image/webp":{extension:`.webp`,preview:`image`,alpha:!0},"text/calendar":{extension:`.ics`,raw:!0},"text/css":{extension:`.css`,raw:!0,language:`css`},"text/csv":{extension:`.csv`,raw:!0},"text/html":{extension:`.html`,raw:!0,language:`html`,preview:`object`},"text/javascript":{extension:`.js`,raw:!0},"text/plain":{extension:`.txt`,raw:!0},"text/xml":{extension:`.xml`,raw:!0,language:`xml`},"text/yaml":{extension:`.yaml`,raw:!0,language:`yaml`},"video/3gpp":{extension:`.3gp`},"audio/3gpp":{extension:`.3gp`},"video/3gpp2":{extension:`.3g2`},"audio/3gpp2":{extension:`.3g2`},"video/mp2t":{extension:`.ts`},"video/mp4":{extension:`.mp4`,preview:`video`},"video/mpeg":{extension:`.mpeg`},"video/ogg":{extension:`.ogv`},"video/webm":{extension:`.webm`,preview:`video`},"video/x-msvideo":{extension:`.avi`}}}));function lpn(e){let t=``;if(e){let n=e.match(/filename\*=UTF-8''([^;]+)/)?.[1]??e.match(/filename\s*=\s*"?([^";]+)"?/)?.[1];n&&(t=dpn(n.trim()))}return t}function upn({data:e,headers:t}){let n=ppn(t),r=n.find(e=>e.name.toLowerCase()===`content-type`),i=r?.value?Uu(r.value):void 0;return{mimeType:i,attachmentFilename:lpn(n.find(e=>e.name.toLowerCase()===`content-disposition`)?.value??``),dataUrl:fpn(e)?URL.createObjectURL(e):typeof e==`string`?URL.createObjectURL(new Blob([e],{type:i?i.toString():void 0})):e instanceof Object&&Object.keys(e).length?URL.createObjectURL(new Blob([JSON.stringify(e)],{type:i?i.toString():void 0})):``}}var dpn,fpn,ppn,mpn=s((()=>{Wu(),dpn=e=>{try{return decodeURIComponent(e)}catch{return e}},fpn=e=>e instanceof Blob,ppn=e=>e?Object.keys(e).map(t=>({name:t,value:e[t]??``})):[]}));function hpn(e,t){return F(),I(`div`,_pn,[R(`div`,vpn,[P(e.$slots,`default`)])])}var gpn,_pn,vpn,I7,ypn=s((()=>{P7(),W(),gpn={},_pn={class:`flex justify-center px-2 py-3`},vpn={class:`text-c-3 p-2 text-sm`},I7=N7(gpn,[[`render`,hpn]])})),bpn,xpn,Spn,Cpn,wpn,Tpn=s((()=>{ypn(),W(),bpn=[`src`],xpn=[`src`,`type`],Spn=[`src`,`type`],Cpn=[`data`,`type`],wpn=N({__name:`ResponseBodyPreview`,props:{src:{},type:{},mode:{},alpha:{type:Boolean,default:!1}},setup(e){let t=A(!1);return mr(()=>e.src,()=>{t.value=!1}),(n,r)=>!t.value&&e.src?(F(),I(`div`,{key:0,class:O([`flex justify-center overflow-auto rounded-b`,{"bg-preview p-2":e.alpha}])},[e.mode===`image`?(F(),I(`img`,{key:0,class:O([`h-full max-w-full`,{rounded:e.alpha}]),src:e.src,onError:r[0]||=e=>t.value=!0},null,42,bpn)):e.mode===`video`?(F(),I(`video`,{key:1,autoplay:``,controls:``,width:`100%`,onError:r[1]||=e=>t.value=!0},[R(`source`,{src:e.src,type:e.type},null,8,xpn)],32)):e.mode===`audio`?(F(),I(`audio`,{key:2,class:`my-12`,controls:``,onError:r[2]||=e=>t.value=!0},[R(`source`,{src:e.src,type:e.type},null,8,Spn)],32)):(F(),I(`object`,{key:3,class:`aspect-[4/3] w-full`,data:e.src,type:e.type,onError:r[3]||=e=>t.value=!0},null,40,Cpn))],2)):(F(),L(I7,{key:1},{default:M(()=>[...r[4]||=[z(`Preview unavailable`,-1)]]),_:1}))}})})),Epn,Dpn=s((()=>{P7(),Tpn(),Epn=N7(wpn,[[`__scopeId`,`data-v-92f84612`]])})),Opn,kpn=s((()=>{W(),kE(),Opn=N({__name:`ResponseBodyRaw`,props:{content:{},language:{}},setup(e){let t=e;return(n,r)=>(F(),L(j(Wy),{class:`codeBlock`,content:t.content,lang:e.language},null,8,[`content`,`lang`]))}})})),Apn,jpn=s((()=>{kpn(),Apn=Opn})),Mpn,Npn=s((()=>{ypn(),Dpn(),jpn(),W(),Mpn=N({__name:`ResponseBody`,props:{data:{},responseBody:{},mediaConfig:{},display:{}},setup(e){return mr(()=>e.display,e=>console.log(e)),(t,n)=>(F(),I(V,null,[e.mediaConfig?.raw&&e.display===`raw`&&e.mediaConfig.language?(F(),L(Apn,{key:e.responseBody.dataUrl,content:e.data,language:e.mediaConfig.language},null,8,[`content`,`language`])):B(``,!0),e.mediaConfig?.preview&&e.display===`preview`?(F(),L(Epn,{key:e.responseBody.dataUrl,alpha:e.mediaConfig.alpha,mode:e.mediaConfig.preview,src:e.responseBody.dataUrl,type:e.responseBody.mimeType?.essence??``},null,8,[`alpha`,`mode`,`src`,`type`])):B(``,!0),!e.mediaConfig?.raw&&!e.mediaConfig?.preview?(F(),L(I7,{key:2},{default:M(()=>[...n[0]||=[z(` Binary file `,-1)]]),_:1})):B(``,!0)],64))}})})),Ppn,Fpn=s((()=>{Npn(),Ppn=Mpn})),Ipn,Lpn,Rpn=s((()=>{W(),Ipn={class:`text-c-3 text-xxs -my-1 flex justify-center gap-0.5 rounded p-0.5`},Lpn=N({__name:`ResponseBodyToggle`,props:{modelValue:{}},emits:[`toggle`],setup(e,{emit:t}){let n=t;return(t,r)=>(F(),I(`div`,Ipn,[R(`button`,{class:O([`hover:bg-b-3 rounded px-1`,{"bg-b-3 text-c-1 cursor-default":e.modelValue===`preview`}]),type:`button`,onClick:r[0]||=po(e=>n(`toggle`,`preview`),[`stop`])},` Preview `,2),R(`button`,{class:O([`hover:bg-b-3 rounded px-1`,{"bg-b-3 text-c-1 cursor-default":e.modelValue===`raw`}]),type:`button`,onClick:r[1]||=po(e=>n(`toggle`,`raw`),[`stop`])},` Raw `,2)]))}})})),zpn,Bpn=s((()=>{Rpn(),zpn=Lpn}));function Vpn(e,t){return F(),I(`div`,Upn,[...t[0]||=[R(`div`,{class:`playIcon`},[R(`svg`,{fill:`currentColor`,height:`32`,viewBox:`0 0 256 256`,width:`32`,xmlns:`http://www.w3.org/2000/svg`},[R(`path`,{d:`M240,128a15.74,15.74,0,0,1-7.6,13.51L88.32,229.65a16,16,0,0,1-16.2.3A15.86,15.86,0,0,1,64,216.13V39.87a15.86,15.86,0,0,1,8.12-13.82,16,16,0,0,1,16.2.3L232.4,114.49A15.74,15.74,0,0,1,240,128Z`})])],-1),z(` Sending Request to Endpoint `,-1)]])}var Hpn,Upn,Wpn,Gpn=s((()=>{P7(),W(),Hpn={},Upn={class:`sendingRequest`},Wpn=N7(Hpn,[[`render`,Vpn],[`__scopeId`,`data-v-65dc6dfb`]])})),Kpn,qpn,Jpn,Ypn,Xpn,Zpn,Qpn,$pn,emn=s((()=>{Pfn(),zfn(),Wfn(),Yfn(),epn(),apn(),cpn(),mpn(),Fpn(),Bpn(),Gpn(),W(),kE(),Ou(),Kpn={key:1,class:`autosendContainer`},qpn={key:2,class:`autosendContainer`},Jpn={class:`requestContent`},Ypn={class:`requestContentInner`},Xpn={key:0,class:`code`},Zpn={key:1,class:`code`},Qpn={class:`requestHeaderContainer`},$pn=N({__name:`RequestPreview`,props:{request:{},response:{},state:{}},setup(e){let t=U(()=>{if(e.response?.success)return{data:e.response.data.responseBody,headers:e.response.data.headers};if(e.response?.error?.code===`REQUEST_NOT_OK`)return{data:e.response.error.detail.responseBody,headers:e.response.error.detail.headers}}),n=A(!1),r=U(()=>e.state===`requestFailed`||e.state===`requiresApproval`?!0:n.value),i=U(()=>upn({data:t.value?.data,headers:t.value?.headers})),a=U(()=>opn(i.value.mimeType?.essence??``)),o=A();function s(e){o.value=e}let c=U(()=>o.value?o.value:a.value?.raw&&!a.value.preview?`raw`:a.value?.preview?`preview`:`raw`);return(o,l)=>(F(),I(`div`,{class:O([`requestPreview`,{open:r.value,succeeded:e.state===`requestSucceeded`}])},[e.state===`approved`?(F(),L(Ufn,{key:0})):e.state===`buildingRequest`?(F(),I(`div`,Kpn,[H(Rfn)])):e.state===`requiresApproval`?(F(),I(`div`,qpn,[H(Nfn)])):e.state===`sendingRequest`?(F(),I(`button`,{key:3,class:`toggleButton`,type:`button`,onClick:l[0]||=e=>n.value=!n.value},[H(Wpn),r.value?(F(),L(j(tl),{key:0})):(F(),L(j(ll),{key:1}))])):e.state===`requestSucceeded`?(F(),I(`button`,{key:4,class:`toggleButton`,type:`button`,onClick:l[1]||=e=>n.value=!n.value},[H(ipn),r.value?(F(),L(j(tl),{key:0})):(F(),L(j(ll),{key:1}))])):e.state===`rejected`?(F(),I(`button`,{key:5,class:`toggleButton`,type:`button`,onClick:l[2]||=e=>n.value=!n.value},[H($fn),r.value?(F(),L(j(tl),{key:0})):(F(),L(j(ll),{key:1}))])):e.state===`requestFailed`?(F(),L(Jfn,{key:6})):B(``,!0),R(`div`,Jpn,[R(`div`,Ypn,[e.request?(F(),I(`div`,Xpn,[l[4]||=R(`div`,{class:`requestHeaderContainer`},[R(`h1`,null,`Request`)],-1),H(j(Wy),{class:`codeBlock`,content:JSON.stringify(e.request,null,2),lang:`json`},null,8,[`content`])])):B(``,!0),t.value?(F(),I(`div`,Zpn,[R(`div`,Qpn,[l[5]||=R(`h1`,null,`Response`,-1),a.value?.raw&&a.value.preview?(F(),L(zpn,{key:0,modelValue:c.value,"onUpdate:modelValue":l[3]||=e=>c.value=e,onToggle:s},null,8,[`modelValue`])):B(``,!0)]),H(Ppn,{data:t.value.data,display:c.value,mediaConfig:a.value,responseBody:i.value},null,8,[`data`,`display`,`mediaConfig`,`responseBody`])])):B(``,!0)])])],2))}})})),tmn,nmn=s((()=>{P7(),emn(),tmn=N7($pn,[[`__scopeId`,`data-v-0eb5f95d`]])}));function L7(e){return e.type===`tool-execute-request`&&e.state===`input-available`&&e.input?.method?.toLowerCase()!==`get`}function rmn(){let e=k7(),t=U(()=>e.chat.messages.filter(e=>e.parts.some(L7)).flatMap(e=>e.parts).filter(L7));async function n(n){let r=t.value.map(async t=>{if(!n)return await e.chat.addToolOutput({tool:x6,toolCallId:t.toolCallId,state:`output-error`,errorText:`The user denied the request.`});await i8({documentSettings:Xsn(e.workspaceStore),proxyUrl:e.proxyUrl.value,input:t.input,toolCallId:t.toolCallId,chat:e.chat})});await Promise.all(r)}return{approvalRequiredParts:t,respondToRequestApprovals:n}}var imn=s((()=>{S6(),Ksn(),d8(),M7(),W()})),amn,omn,smn=s((()=>{M7(),nmn(),imn(),W(),amn={class:`executeRequestTool`},omn=N({__name:`ExecuteRequestTool`,props:{messagePart:{}},setup(e){let t=k7(),n=U(()=>e.messagePart.value.state===`input-streaming`?`buildingRequest`:e.messagePart.value.state===`approval-responded`&&t.chat.status===`submitted`?`sendingRequest`:L7(e.messagePart.value)?`requiresApproval`:e.messagePart.value.state===`output-available`?e.messagePart.value.output.success?`requestSucceeded`:`requestFailed`:e.messagePart.value.state===`output-error`?`rejected`:null);return(t,r)=>(F(),I(`div`,amn,[n.value?(F(),L(tmn,{key:0,request:e.messagePart.value.input,response:e.messagePart.value.output,state:n.value},null,8,[`request`,`response`,`state`])):B(``,!0)]))}})})),cmn,lmn=s((()=>{P7(),smn(),cmn=N7(omn,[[`__scopeId`,`data-v-3e825a81`]])}));function umn(e,t){return F(),I(`div`,fmn,[...t[0]||=[R(`div`,{class:`playIcon`},null,-1),z(` Loading APIs... `,-1)]])}var dmn,fmn,pmn,mmn=s((()=>{P7(),W(),dmn={},fmn={class:`loadingApiSpecs`},pmn=N7(dmn,[[`render`,umn],[`__scopeId`,`data-v-9d9724d2`]])})),hmn,gmn,_mn=s((()=>{mmn(),W(),hmn={key:0},gmn=N({__name:`GetOpenAPISpecsSummary`,props:{messagePart:{},message:{}},setup(e){let t=A(!1);return mr(()=>e.message,()=>{let n=e.message.parts;t.value=!!n[n.findIndex(t=>`toolCallId`in t&&t.toolCallId===e.messagePart.value.toolCallId)+1]}),(e,n)=>t.value?B(``,!0):(F(),I(`div`,hmn,[H(pmn)]))}})})),vmn,ymn=s((()=>{_mn(),vmn=gmn})),bmn,xmn,Smn=s((()=>{W(),bmn={class:`contextItemText`},xmn=N({__name:`ContextItem`,props:{loading:{type:Boolean}},setup(e){return(t,n)=>(F(),I(`div`,{class:O([`contextItem`,{shimmer:e.loading}])},[R(`span`,bmn,[P(t.$slots,`default`,{},void 0,!0)])],2))}})})),R7,Cmn=s((()=>{P7(),Smn(),R7=N7(xmn,[[`__scopeId`,`data-v-e6786ce3`]])}));function wmn(e,t){return F(),I(`div`,Emn,[...t[0]||=[R(`div`,{class:`playIcon`},null,-1),z(` Retrieving relevant information... `,-1)]])}var Tmn,Emn,Dmn,Omn=s((()=>{P7(),W(),Tmn={},Emn={class:`sendingRequest`},Dmn=N7(Tmn,[[`render`,wmn],[`__scopeId`,`data-v-6e0ac42c`]])})),kmn,Amn,jmn,z7,Mmn,Nmn=s((()=>{d8(),M7(),Cmn(),Omn(),W(),kE(),kmn={key:0},Amn={key:1,class:`operations`},jmn={class:`overflowPopover`},z7=5,Mmn=N({__name:`SearchOpenAPIOperationsTool`,props:{messagePart:{},message:{}},setup(e){let t=A(!1);mr(()=>e.message,()=>{let n=e.message.parts;t.value=!!n[n.findIndex(t=>`toolCallId`in t&&t.toolCallId===e.messagePart.value.toolCallId)+1]});let n=U(()=>{if(e.messagePart.value.output)return e.messagePart.value.output.flatMap(e=>{let t=e.info?.title;return Jsn(e).map(e=>`${t?`${t} - `:``}${e.summary??``}`).filter(Boolean)})}),r=U(()=>n.value?.slice(0,z7)),i=U(()=>n.value?.slice(z7)??[]),a=k7();return(o,s)=>(F(),I(V,null,[e.messagePart.value.state===`input-available`&&j(a).chat.status===`streaming`?(F(),I(`div`,kmn,[H(Dmn)])):B(``,!0),n.value?(F(),I(`div`,Amn,[(F(!0),I(V,null,Ar(r.value,e=>(F(),L(R7,{key:e,loading:!t.value},{default:M(()=>[z(k(e),1)]),_:2},1032,[`loading`]))),128)),i.value.length?(F(),L(j(iE),{key:0,placement:`bottom-start`},{popover:M(()=>[R(`div`,jmn,[(F(!0),I(V,null,Ar(i.value,e=>(F(),L(R7,{key:e,loading:!t.value},{default:M(()=>[z(k(e),1)]),_:2},1032,[`loading`]))),128))])]),default:M(()=>[H(R7,{loading:!t.value},{default:M(()=>[z(` +`+k(i.value.length),1)]),_:1},8,[`loading`])]),_:1})):B(``,!0)])):B(``,!0)],64))}})})),Pmn,Fmn=s((()=>{P7(),Nmn(),Pmn=N7(Mmn,[[`__scopeId`,`data-v-43dd2b86`]])})),Imn,Lmn=s((()=>{W(),kE(),Imn=N({__name:`Text`,props:{messagePart:{}},setup(e){return(t,n)=>(F(),L(j(qT),{value:e.messagePart.value.text},null,8,[`value`]))}})})),Rmn,zmn=s((()=>{Lmn(),Rmn=Imn})),B7,Bmn=s((()=>{B7={LIMIT_REACHED:`LIMIT_REACHED`}})),Vmn,Hmn=s((()=>{Vmn=1e4}));function Umn(){let{api:e}=k7(),t=A(``),n=Hve(async t=>{let n=await e.search(t);n.success&&(i.value=n.data.results)},200),r=U({get:()=>t.value,set:e=>{n(e),t.value=e}}),i=A([]);return n(``),{query:r,results:i}}var Wmn=s((()=>{M7(),W(),Zf()})),Gmn,Kmn,qmn,Jmn,Ymn,Xmn,Zmn,Qmn,$mn,ehn=s((()=>{M7(),Wmn(),W(),kE(),Gmn={key:0,class:`catalog custom-scroll`},Kmn=[`onClick`],qmn={class:`left`},Jmn=[`src`],Ymn={class:`right`},Xmn={class:`item-top`},Zmn={class:`version`},Qmn={class:`description`},$mn=N({__name:`Catalog`,props:{modal:{}},setup(e){let t=Umn(),n=k7(),r=U(()=>t.results.value.filter(e=>!n.registryDocuments.value.some(t=>t.namespace===e.namespace&&t.slug===e.slug)).map(e=>({...e,label:e.title,id:e.id})));return(i,a)=>(F(),L(j(rE),{class:`catalogModal`,state:e.modal},{default:M(()=>[H(j(aE),{autofocus:``,class:`searchInput`,modelValue:j(t).query.value,"onUpdate:modelValue":a[0]||=e=>j(t).query.value=e??``},null,8,[`modelValue`]),r.value.length?(F(),I(`div`,Gmn,[(F(!0),I(V,null,Ar(r.value,t=>(F(),I(`button`,{key:t.id,class:`item`,type:`button`,onClick:()=>{j(n).addDocument(t),e.modal.hide()}},[R(`div`,qmn,[t.logoUrl?(F(),I(`img`,{key:0,class:`logo`,src:t.logoUrl},null,8,Jmn)):(F(),L(j(jT),{key:1,class:`logo`,logo:`Openapi`}))]),R(`div`,Ymn,[R(`div`,Xmn,[R(`span`,null,k(t.title),1),R(`span`,Zmn,`v`+k(t.currentVersion),1)]),R(`span`,Qmn,` @`+k(t.namespace)+`/`+k(t.slug),1)])],8,Kmn))),128))])):B(``,!0)]),_:1},8,[`state`]))}})})),thn,nhn=s((()=>{P7(),ehn(),thn=N7($mn,[[`__scopeId`,`data-v-bc24f891`]])})),rhn,ihn,ahn,ohn=s((()=>{nhn(),W(),kE(),Ou(),rhn={class:`dropdown-item`},ihn={class:`dropdown-item`},ahn=N({__name:`ActionsDropdown`,emits:[`uploadApi`],setup(e){let t=nE();return(e,n)=>(F(),I(V,null,[H(j(KS),{offset:{crossAxis:-5,mainAxis:5}},{items:M(()=>[H(j(tC),{onClick:n[0]||=t=>e.$emit(`uploadApi`)},{default:M(()=>[R(`div`,rhn,[H(j(jme)),n[2]||=z(` Upload API `,-1)])]),_:1}),H(j(tC),{onClick:n[1]||=e=>j(t).show()},{default:M(()=>[R(`div`,ihn,[H(j(vu)),n[3]||=z(` Search Catalog `,-1)])]),_:1})]),default:M(()=>[P(e.$slots,`default`,{},void 0,!0)]),_:3}),j(t).open?(F(),L(thn,{key:0,modal:j(t)},null,8,[`modal`])):B(``,!0)],64))}})})),shn,chn=s((()=>{P7(),ohn(),shn=N7(ahn,[[`__scopeId`,`data-v-2d142bb5`]])})),lhn,uhn,dhn,fhn,phn=s((()=>{W(),Ou(),lhn={class:`approvalSection`},uhn={class:`approvalText flex items-center gap-1.5`},dhn={class:`approveContainer`},fhn=N({__name:`ApprovalSection`,emits:[`approve`,`reject`],setup(e,{emit:t}){let n=t;return(e,t)=>(F(),I(`div`,lhn,[R(`strong`,uhn,[H(j(gu),{class:`text-blue size-4`,weight:`bold`}),t[2]||=z(` One or more requests require approval. `,-1)]),R(`div`,dhn,[R(`button`,{type:`button`,class:`actionButton rejectButton`,onClick:t[0]||=e=>n(`reject`)},` Reject `),R(`button`,{type:`button`,class:`actionButton approveButton`,onClick:t[1]||=e=>n(`approve`)},` Approve `)])]))}})})),mhn,hhn=s((()=>{P7(),phn(),mhn=N7(fhn,[[`__scopeId`,`data-v-a7e6c699`]])}));function ghn(){let{chat:e}=k7();return U(()=>{if(!e.error)return;let t=Zsn(e.error.message);return!t||!m(V7,t)?{message:e.error.message,code:`UNKNOWN_ERROR`}:v(V7,t)})}var V7,_hn=s((()=>{d8(),M7(),W(),le(),V7=T({message:x(),code:x(),status:E(b())})})),vhn,yhn,bhn=s((()=>{Bmn(),W(),Ou(),vhn={key:0,class:`error gap-1.5`},yhn=N({__name:`ErrorMessage`,props:{error:{}},setup(e){let t=[B7.LIMIT_REACHED];return(n,r)=>t.includes(e.error.code)?B(``,!0):(F(),I(`div`,vhn,[H(j(gu),{class:`text-red size-4`,weight:`bold`}),z(` `+k(e.error.message),1)]))}})})),xhn,Shn=s((()=>{P7(),bhn(),xhn=N7(yhn,[[`__scopeId`,`data-v-63a481da`]])}));function Chn(){let{dashboardUrl:e,mode:t,uploadedTmpDocumentUrl:n}=k7(),r=U(()=>t===`full`?e:n.value?`${e}/register?flow=oss-agent&docUrl=${n.value}`:e);function i(){window.location.assign(r.value)}return{signupLink:r,navigateToSignup:i}}var whn=s((()=>{M7(),W()})),Thn,Ehn,Dhn,Ohn,khn,Ahn,jhn=s((()=>{o8(),whn(),W(),Ou(),Thn={class:`freeMessagesInfoSection`},Ehn={class:`infoText flex items-center gap-1.5`},Dhn=[`href`],Ohn={class:`actionsContainer`},khn=[`href`],Ahn=N({__name:`FreeMessagesInfoSection`,setup(e){let t=A(!1),{signupLink:n}=Chn();function r(){t.value=!0}return(e,i)=>lr((F(),I(`div`,Thn,[R(`strong`,Ehn,[H(j(gu),{class:`text-blue size-4`,weight:`bold`}),R(`a`,{class:`underline`,href:j(n),target:`_blank`},`Sign up for Agent Scalar`,8,Dhn),i[0]||=z(` to continue without hitting limits. `,-1)]),R(`div`,Ohn,[R(`a`,{class:`actionButton upgradeButton`,href:j(a8).AGENT_SCALAR_DOCUMENTATION,target:`_blank`,type:`button`},` Read more `,8,khn),R(`button`,{"aria-label":`Close`,class:`closeButton`,type:`button`,onClick:r},[H(j(Du),{class:`size-4`,weight:`bold`})])])],512)),[[Za,!t.value]])}})})),Mhn,Nhn=s((()=>{P7(),jhn(),Mhn=N7(Ahn,[[`__scopeId`,`data-v-913a3815`]])})),Phn,Fhn,Ihn,Lhn,Rhn=s((()=>{whn(),W(),Ou(),Phn={class:`paymentSection`},Fhn={class:`approvalText flex items-center gap-1.5`},Ihn={class:`paymentContainer`},Lhn=N({__name:`PaymentSection`,setup(e){let{navigateToSignup:t}=Chn();return(e,n)=>(F(),I(`div`,Phn,[R(`strong`,Fhn,[H(j(gu),{class:`text-blue size-4`,weight:`bold`}),n[1]||=z(` You've used up your complimentary Scalar Credits. Sign up to get free Credits. `,-1)]),R(`div`,Ihn,[R(`button`,{class:`actionButton approveButton`,type:`button`,onClick:n[0]||=(...e)=>j(t)&&j(t)(...e)},` Sign up `),n[2]||=ti(`<div class="paymentInfo" data-v-8f005a5c><h3 data-v-8f005a5c>$0 <span data-v-8f005a5c>/ month</span></h3><div class="paymentInfoSection" data-v-8f005a5c><div class="paymentInfoItem" data-v-8f005a5c><span data-v-8f005a5c>Credits</span><span data-v-8f005a5c>100</span></div><div class="paymentInfoItem" data-v-8f005a5c><span data-v-8f005a5c>MCP Servers</span><span data-v-8f005a5c>Unlimited</span></div><div class="paymentInfoItem" data-v-8f005a5c><span data-v-8f005a5c>Base monthly total</span><span data-v-8f005a5c>$0.00</span></div></div><div class="paymentInfoSection" data-v-8f005a5c><div class="paymentInfoItem" data-v-8f005a5c><span data-v-8f005a5c>Additional Credits</span><span data-v-8f005a5c>+ $0.02 per Credit</span></div></div></div>`,1)])]))}})})),zhn,Bhn=s((()=>{P7(),Rhn(),zhn=N7(Lhn,[[`__scopeId`,`data-v-8f005a5c`]])})),Vhn,Hhn,Uhn,Whn,Ghn=s((()=>{M7(),Wmn(),W(),kE(),Ou(),Vhn=[`onClick`],Hhn=[`src`],Uhn={key:1,class:`searchResultsEmpty`},Whn=N({__name:`SearchPopover`,setup(e){let t=k7(),n=Umn(),r=U(()=>n.results.value.filter(e=>!t.registryDocuments.value.some(t=>t.namespace===e.namespace&&t.slug===e.slug)).map(e=>({...e,label:e.title,id:e.id})));return(e,i)=>(F(),L(j(iE),{offset:0,placement:`top-start`,resize:``,style:{width:`220px`}},{popover:M(({close:e})=>[H(j(yE),{autofocus:``,class:`searchInput`,modelValue:j(n).query.value,placeholder:`Add an API`,"onUpdate:modelValue":i[0]||=e=>j(n).query.value=e??``},{prefix:M(()=>[H(j(vu),{class:`searchIcon`})]),_:1},8,[`modelValue`]),r.value.length?(F(!0),I(V,{key:0},Ar(r.value,n=>(F(),I(`button`,{key:n.id,class:`searchItem`,type:`button`,onClick:()=>{j(t).addDocument(n),e()}},[n.logoUrl?(F(),I(`img`,{key:0,class:`searchItemLogo`,src:n.logoUrl},null,8,Hhn)):B(``,!0),R(`span`,null,k(n.title),1)],8,Vhn))),128)):(F(),I(`span`,Uhn,` No APIs found `))]),default:M(()=>[P(e.$slots,`default`,{},void 0,!0)]),_:3}))}})})),Khn,qhn=s((()=>{P7(),Ghn(),Khn=N7(Whn,[[`__scopeId`,`data-v-7945f74c`]])})),Jhn,Yhn,Xhn,Zhn,Qhn,$hn,egn,tgn=s((()=>{W(),kE(),Ou(),Jhn={key:0,class:`flex items-center gap-1.5`},Yhn={key:0,class:`uploadText`},Xhn={key:1,class:`uploadText`},Zhn={key:2,class:`uploadText`},Qhn={key:1,class:`uploadText flex items-center gap-1.5`},$hn={key:2,class:`uploadText flex items-center gap-1.5`},egn=N({__name:`UploadSection`,props:{uploadState:{}},setup(e){let t=mf(),n=U(()=>[`uploading`,`processing`,`loading`].includes(e.uploadState.type));return(r,i)=>(F(),I(`div`,{class:O([`uploadSection`,{error:e.uploadState.type===`error`,done:e.uploadState.type===`done`}])},[n.value?(F(),I(`div`,Jhn,[H(j(ff),{class:`text-blue`,loader:{...j(t),isLoading:!0},size:`lg`},null,8,[`loader`]),e.uploadState.type===`loading`?(F(),I(`strong`,Yhn,` Loading OpenAPI document… `)):e.uploadState.type===`processing`?(F(),I(`strong`,Xhn,` Processing OpenAPI document… `)):(F(),I(`strong`,Zhn,` Uploading OpenAPI document… `))])):B(``,!0),e.uploadState.type===`done`?(F(),I(`strong`,Qhn,[H(j(Tl),{class:`icon text-green`}),i[0]||=z(` Your OpenAPI document has been processed successfully. `,-1)])):B(``,!0),e.uploadState.type===`error`?(F(),I(`strong`,$hn,[H(j(Fhe),{class:`icon text-red`}),z(` `+k(e.uploadState.error),1)])):B(``,!0)],2))}})})),ngn,rgn=s((()=>{P7(),tgn(),ngn=N7(egn,[[`__scopeId`,`data-v-9551cf83`]])}));function ign(e){return e.type.startsWith(`tool`)&&e.state===`input-available`}function agn(){let e=k7();return{pendingClientToolParts:U(()=>e.chat.messages.filter(e=>e.parts.some(ign)).flatMap(e=>e.parts).filter(ign))}}var ogn=s((()=>{M7(),W()})),sgn,cgn,lgn,ugn,dgn,fgn,pgn,mgn,hgn,ggn,_gn,vgn,ygn,bgn,xgn,Sgn,Cgn,wgn=s((()=>{Bmn(),Hmn(),m8(),M7(),imn(),chn(),hhn(),_hn(),Shn(),Nhn(),Bhn(),qhn(),rgn(),ogn(),W(),kE(),Ou(),sgn={class:`actionContainer`},cgn=[`disabled`],lgn={class:`inputActionsContainer`},ugn={class:`inputActionsLeft`},dgn={class:`addAPIButton`,type:`button`},fgn={class:`addAPIButton`,type:`button`},pgn=[`src`],mgn=[`onClick`],hgn={class:`inputActionsRight`},ggn={class:`sendCheckboxContinue`},_gn={key:0,class:`relative flex items-center gap-1.5`},vgn={class:`termsAgree`,for:`agentTermsAgree`},ygn={key:5,class:`addMoreContext`},bgn={class:`ml-auto flex items-center gap-1`},xgn=[`onClick`],Sgn=[`alt`,`src`],Cgn=N({__name:`PromptForm`,emits:[`submit`,`uploadApi`],setup(e,{expose:t,emit:n}){let r=n;t({focusPrompt:u});let i=wr(`agentPrompt`),a=k7(),o=U(()=>a.prompt.value.trim().length>0),s=U(()=>a.prompt.value.trim().length>Vmn),c=U(()=>a.chat.messages.length>1&&!a.getAgentKey?.()&&y?.value?.code!==B7.LIMIT_REACHED);mr(a.prompt,()=>{if(i?.value){if(!a.prompt.value.length){i.value.style.height=`0px`;return}i.value.style.height=`auto`,i.value.style.height=i.value.scrollHeight+`px`}});function l(e){a.loading.value||e.key===`Enter`&&!e.shiftKey&&(e.preventDefault(),v(),window.scrollTo(0,document.body.scrollHeight))}function u(){i.value?.focus()}mr(()=>a.chat.status,e=>{(e===`ready`||e===`error`)&&i.value?.focus()});let{approvalRequiredParts:d,respondToRequestApprovals:f}=rmn(),{pendingClientToolParts:p}=agn(),m=icn();function h(){a.terms.accept(),a.mode===`preview`&&a.getActiveDocumentJson&&m.uploadTempDocument(a.getActiveDocumentJson(),!0)}let g=U(()=>Object.values(a.pendingDocuments).some(Boolean)),_=U(()=>{let e=s.value,t=!o.value,n=d.value.length>0,r=p.value.length>0,i=a.mode===`preview`,c=i&&!a.terms.accepted.value,l=i&&!!m.uploadState.value,u=g.value;return e||t||n||r||c||l||u});function v(){_.value||r(`submit`)}let y=ghn();return(e,t)=>(F(),I(`div`,sgn,[j(m).uploadState.value||g.value?(F(),L(ngn,{key:0,uploadState:j(m).uploadState.value??{type:`loading`}},null,8,[`uploadState`])):B(``,!0),j(y)?(F(),L(xhn,{key:1,error:j(y)},null,8,[`error`])):B(``,!0),j(d).length?(F(),L(mhn,{key:2,onApprove:t[0]||=e=>j(f)(!0),onReject:t[1]||=e=>j(f)(!1)})):B(``,!0),j(y)?.code===j(B7).LIMIT_REACHED?(F(),L(zhn,{key:3})):B(``,!0),c.value?(F(),L(Mhn,{key:4})):B(``,!0),R(`form`,{class:`promptForm`,onSubmit:po(v,[`prevent`])},[t[6]||=R(`label`,{class:`agentLabel`,for:`agentTextarea`},` Type a Request To get Started `,-1),lr(R(`textarea`,{id:`agentTextarea`,ref:`agentPrompt`,"onUpdate:modelValue":t[2]||=e=>j(a).prompt.value=e,class:`prompt custom-scroll`,disabled:j(a).loading.value,name:`prompt`,placeholder:`Ask me anything…`,onKeydown:l},null,40,cgn),[[lo,j(a).prompt.value]]),R(`div`,lgn,[R(`div`,ugn,[j(a).hideAddApi?B(``,!0):(F(),I(V,{key:0},[j(a).isLoggedIn?.value?(F(),L(shn,{key:1,onUploadApi:t[3]||=t=>e.$emit(`uploadApi`)},{default:M(()=>[R(`button`,fgn,[H(j(xu),{class:`size-4`,weight:`bold`})])]),_:1})):(F(),L(Khn,{key:0},{default:M(()=>[R(`button`,dgn,[H(j(xu),{class:`size-4`,weight:`bold`})])]),_:1}))],64)),(F(!0),I(V,null,Ar(j(a).registryDocuments.value,e=>(F(),I(`div`,{key:e.id,class:`apiPill`},[e.logoUrl?(F(),I(`img`,{key:0,class:`apiPillLogo`,src:e.logoUrl},null,8,pgn)):B(``,!0),z(` `+k(e.title)+` `,1),e.removable?(F(),I(`button`,{key:1,class:`apiPillRemove`,type:`button`,onClick:t=>j(a).removeDocument(e)},[H(j(Du),{class:`size-4`,weight:`bold`})],8,mgn)):B(``,!0)]))),128))]),R(`div`,hgn,[j(a).loading.value?B(``,!0):(F(),L(j(WT),{key:0,content:`Settings`},{default:M(()=>[H(j(GT),{class:`settingsButton h-7 w-7 p-1.5`,icon:j(_u),label:`Scalar`,size:`md`,weight:`bold`,onClick:t[4]||=e=>j(a).settingsModal.show()},null,8,[`icon`])]),_:1})),R(`div`,ggn,[!j(a).terms.accepted.value&&j(a).mode===`preview`?(F(),I(`div`,_gn,[R(`input`,{id:`agentTermsAgree`,class:`sr-only`,type:`checkbox`,onChange:h},null,32),R(`label`,vgn,[H(j(Tl),{class:`termsAgreeIcon`,weight:`bold`}),t[5]||=z(` Agree to Terms & Conditions `,-1)])])):B(``,!0),j(a).loading.value?(F(),L(j(ff),{key:2,class:`loader h-7 w-7`,loader:{isLoading:j(a).loading.value,isValid:!1,clear:async()=>{},invalidate:async()=>{},isInvalid:!1,isActive:!1,validate:async()=>{},start:()=>{}},size:`2xl`},null,8,[`loader`])):(F(),L(j(GT),{key:1,class:`sendButton h-7 w-7 p-1.5`,disabled:_.value,icon:j(Uc),label:`Scalar`,size:`md`,type:`submit`,weight:`bold`},null,8,[`disabled`,`icon`]))])])])],32),j(a).chat.messages.length<=1&&!j(a).hideAddApi?(F(),I(`div`,ygn,[t[7]||=R(`span`,null,`Load additional APIs`,-1),R(`div`,bgn,[(F(!0),I(V,null,Ar(j(a).curatedDocuments.value,e=>(F(),I(`button`,{key:e.id,class:`addAPIContext`,type:`button`,onClick:t=>j(a).addDocument(e)},[e.logoUrl?(F(),I(`img`,{key:0,alt:e.title,class:`size-4`,src:e.logoUrl},null,8,Sgn)):B(``,!0)],8,xgn))),128))])])):B(``,!0)]))}})})),H7,Tgn=s((()=>{P7(),wgn(),H7=N7(Cgn,[[`__scopeId`,`data-v-e7c7c266`]])})),Egn,Dgn,Ogn,kgn,Agn=s((()=>{sfn(),S6(),cfn(),M7(),kfn(),lmn(),ymn(),Fmn(),zmn(),Tgn(),W(),Egn={class:`chat`},Dgn={key:0},Ogn={class:`formContainer`},kgn=N({__name:`Chat`,emits:[`submit`,`uploadApi`],setup(e,{emit:t}){let n=t,r=k7();return(e,t)=>(F(),I(V,null,[R(`div`,Egn,[(F(!0),I(V,null,Ar(j(r).chat.messages,e=>(F(),I(V,{key:e.id},[e.role===`user`?(F(!0),I(V,{key:0},Ar(e.parts,(t,n)=>(F(),I(`div`,{key:`${e.id}-${n}`,class:`userMessage`},[t.type===`text`?(F(),I(`p`,Dgn,k(t.text),1)):B(``,!0)]))),128)):B(``,!0),e.role===`assistant`?(F(!0),I(V,{key:1},Ar(e.parts,(t,n)=>(F(),I(`div`,{key:`${e.id}-${n}`},[t.type===`text`?(F(),L(Rmn,{key:0,messagePart:wn(t)},null,8,[`messagePart`])):B(``,!0),t.type===`tool-${j(`execute-request`)}`?(F(),L(cmn,{key:1,messagePart:wn(t)},null,8,[`messagePart`])):B(``,!0),t.type===`tool-${j(`search-openapi-operations`)}`?(F(),L(Pmn,{key:2,message:fn(e),messagePart:wn(t)},null,8,[`message`,`messagePart`])):B(``,!0),t.type===`tool-${j(`summarize-openapi-specs`)}`?(F(),L(vmn,{key:3,message:fn(e),messagePart:wn(t)},null,8,[`message`,`messagePart`])):B(``,!0),t.type===`tool-${j(`ask-for-authentication`)}`?(F(),L(Ofn,{key:4,message:fn(e),messagePart:wn(t)},null,8,[`message`,`messagePart`])):B(``,!0)]))),128)):B(``,!0)],64))),128)),t[2]||=R(`div`,{class:`spacer`},null,-1)]),R(`div`,Ogn,[H(H7,{onSubmit:t[0]||=e=>n(`submit`),onUploadApi:t[1]||=e=>n(`uploadApi`)})])],64))}})})),jgn,Mgn=s((()=>{P7(),Agn(),jgn=N7(kgn,[[`__scopeId`,`data-v-8e43ed7a`]])}));function Ngn(e,t){return F(),I(`svg`,Fgn,[...t[0]||=[R(`path`,{"clip-rule":`evenodd`,d:`M31.0667 0C40.2667 0 48.3333 6.13333 52.6 14.9333H57.2667C59.6 14.9333 61.5333 16.8 61.5333 19.1333V32.2C61.5333 33.4667 60.8667 34.6 60 35.3333L63.3333 45.4V45.4667C63.5639 46.207 63.6166 46.9912 63.4874 47.7557C63.3582 48.5202 63.0505 49.2435 62.5895 49.8669C62.1284 50.4903 61.5269 50.9962 60.8338 51.3437C60.1406 51.6911 59.3754 51.8703 58.6 51.8667H54.3333C53.9895 52.4222 53.5082 52.8797 52.936 53.195C52.3638 53.5103 51.72 53.6728 51.0667 53.6667H47.0667C46.5764 53.6755 46.0892 53.5877 45.6328 53.4082C45.1765 53.2287 44.76 52.961 44.4071 52.6205C44.0542 52.28 43.7719 51.8733 43.5762 51.4237C43.3805 50.9741 43.2753 50.4903 43.2667 50C43.2667 47.9333 44.9333 46.2667 47 46.2667H51.0667C52.4667 46.2667 53.7333 46.9333 54.3333 48.0667H58.6C59.3333 48.0667 59.9333 47.4 59.6667 46.6L56.3333 36.3333H51.3333C49.9333 36.3333 48.6 35.6667 47.8 34.5333V34.4667L46.8 32.9333C46.7585 32.8643 46.6999 32.8072 46.6298 32.7675C46.5597 32.7279 46.4805 32.707 46.4 32.707C46.3195 32.707 46.2403 32.7279 46.1702 32.7675C46.1001 32.8072 46.0415 32.8643 46 32.9333L45.4667 34C45.1162 34.7065 44.5739 35.3 43.9019 35.7126C43.2299 36.1253 42.4552 36.3404 41.6667 36.3333H24.9333C23.4 36.3333 21.9333 35.7333 20.8667 34.6667H20.8L19.8667 33.6667C19.6667 33.4667 19.4667 33.3333 19.2 33.3333L17.4667 33.1333C17.3333 38.8667 13.4667 43.4667 8.73333 43.4667C3.93333 43.4667 0 38.6667 0 32.9333C0 32.2667 0 31.6667 0.133333 31.1333V31C0.8 26.8 3.46667 23.4667 6.93333 22.6C9.46667 9.93333 19.3333 0 31.0667 0ZM3.93333 31.5333C4.46667 28 6.93333 26.2 8.73333 26.2C10.7333 26.2 13.6 28.4 13.6 32.8667C13.6 34.4667 13.2667 35.7333 12.7333 36.7333C11.7333 38.7333 10.0667 39.6667 8.73333 39.6667C7.67025 39.6269 6.66506 39.1722 5.93333 38.4C5.8414 38.3142 5.75246 38.2253 5.66667 38.1333C5.19113 37.6008 4.80806 36.9924 4.53333 36.3333C4.0607 35.2169 3.83335 34.0119 3.86667 32.8V31.6667L3.93333 31.6V31.5333ZM24.3333 20.6667C24.3333 19.6667 25.2 18.8 26.2667 18.8H55.8667C56.9333 18.8 57.8 19.6667 57.7333 20.7333V30.7333C57.6667 31.8 56.8 32.6667 55.7333 32.6667H53.4C53.0667 32.6667 52.7333 32.6667 52.4 32.5333C51.5333 32.3333 50.7333 31.8667 50.4 31.3333L47.9333 27.6C47.7363 27.2901 47.4602 27.0383 47.1336 26.8706C46.8069 26.7028 46.4414 26.6251 46.0747 26.6455C45.7081 26.6658 45.3535 26.7835 45.0474 26.9865C44.7413 27.1894 44.4948 27.4702 44.3333 27.8L42.6667 31C42.4199 31.4974 42.04 31.9165 41.5692 32.2107C41.0984 32.505 40.5552 32.6628 40 32.6667L26.2 32.8C25.1333 32.8 24.2667 31.9333 24.2667 30.8667V20.6667H24.3333ZM11 22.2C13.5333 11.5333 22 3.86667 31 3.86667C37.9333 3.86667 44.4 8.2 48.3333 15H24.3333C21.4667 15 18.6 16 16.3333 17.8L16.2667 17.8667L10.9333 22.2H11Z`,fill:`currentColor`,"fill-rule":`evenodd`},null,-1)]])}var Pgn,Fgn,Ign,Lgn=s((()=>{P7(),W(),Pgn={},Fgn={fill:`none`,height:`54`,viewBox:`0 0 64 54`,width:`64`,xmlns:`http://www.w3.org/2000/svg`},Ign=N7(Pgn,[[`render`,Ngn]])})),Rgn,zgn,Bgn,Vgn,Hgn,Ugn=s((()=>{o8(),M7(),Tgn(),Lgn(),W(),Rgn={class:`startContainer`},zgn={class:`disclaimerText`},Bgn=[`href`],Vgn=[`href`],Hgn=N({__name:`Start`,emits:[`submit`,`uploadApi`],setup(e,{emit:t}){let n=t,{mode:r}=k7();return(e,t)=>(F(),I(`div`,Rgn,[H(Ign,{class:`agentLogo`}),t[4]||=R(`h1`,{class:`heading`},`How can I help you today?`,-1),H(H7,{ref:`promptFormField`,onSubmit:t[0]||=e=>n(`submit`),onUploadApi:t[1]||=e=>n(`uploadApi`)},null,512),R(`p`,zgn,[j(r)===`preview`?(F(),I(V,{key:0},[z(` By messaging Agent Scalar your OpenAPI document will be temporarily uploaded to Scalar's servers. You must agree to our `)],64)):(F(),I(V,{key:1},[z(`By messaging Agent Scalar you agree to our `)],64)),R(`a`,{class:`disclaimerLink`,href:j(a8).TERMS_AND_CONDITIONS,target:`_blank`},`Terms`,8,Bgn),t[2]||=z(` and `,-1),R(`a`,{class:`disclaimerLink`,href:j(a8).PRIVACY_POLICY,target:`_blank`},`Privacy Policy`,8,Vgn),t[3]||=z(`. `,-1)])]))}})})),Wgn,Ggn=s((()=>{P7(),Ugn(),Wgn=N7(Hgn,[[`__scopeId`,`data-v-56f7e8dd`]])})),Kgn,qgn,Jgn=s((()=>{M7(),Mgn(),Ggn(),W(),Kgn={class:`wrapper`},qgn=N({__name:`Layout`,emits:[`submit`,`uploadApi`],setup(e,{emit:t}){let n=t,{chat:r}=k7();return(e,t)=>(F(),I(`div`,Kgn,[j(r).messages.length&&(j(r).messages.length>1||j(r).status!==`submitted`)?(F(),L(jgn,{key:0,onSubmit:t[0]||=e=>n(`submit`),onUploadApi:t[1]||=e=>n(`uploadApi`)})):(F(),L(Wgn,{key:1,onSubmit:t[2]||=e=>n(`submit`),onUploadApi:t[3]||=e=>n(`uploadApi`)}))]))}})})),Ygn,Xgn=s((()=>{P7(),Jgn(),Ygn=N7(qgn,[[`__scopeId`,`data-v-f1eee0af`]])})),Zgn,Qgn,$gn,e_n,t_n=s((()=>{W(),kE(),Ou(),Zgn={class:`overflow-x-auto`},Qgn={key:1,class:`text-c-1 flex h-auto w-full items-center gap-0.75 rounded-b-lg px-3 py-1.5 text-base leading-[20px] whitespace-nowrap`},$gn={class:`overflow-x-auto`},e_n=N({__name:`Selector`,props:{selectedServer:{},servers:{},target:{}},emits:[`update:modelValue`],setup(e,{expose:t,emit:n}){let r=n,i=U(()=>e.servers.map(e=>({id:e.url,label:e.url}))),a=U(()=>e.selectedServer?.url?.replace(/\/$/,``)||``),o=U(()=>i.value.find(t=>t.id===e.selectedServer?.url));return t({servers:e.servers,serverUrlWithoutTrailingSlash:a,serverOptions:i,selectedServer:e.selectedServer}),(t,n)=>i.value.length>1?(F(),L(j(pS),{key:0,ref:`elem`,class:`group`,modelValue:o.value,options:i.value,placement:`bottom-start`,resize:``,target:e.target,"onUpdate:modelValue":n[0]||=e=>r(`update:modelValue`,e.id)},{default:M(()=>[H(j(gf),{class:`bg-b-1 text-c-1 h-auto w-full justify-start gap-1.5 overflow-x-auto rounded-t-none rounded-b-xl px-3 py-1.5 text-base font-normal whitespace-nowrap -outline-offset-1`,variant:`ghost`},{default:M(()=>[n[1]||=R(`span`,{class:`sr-only`},`Server:`,-1),R(`span`,Zgn,k(a.value||`Select a server`),1),H(j(tl),{class:`text-c-2 ui-open:rotate-180 mt-0.25 size-3 transition-transform duration-100`,weight:`bold`})]),_:1})]),_:1},8,[`modelValue`,`options`,`target`])):(F(),I(`div`,Qgn,[n[2]||=R(`span`,{class:`sr-only`},`Server:`,-1),R(`span`,$gn,k(a.value),1)]))}})})),n_n,r_n=s((()=>{t_n(),n_n=e_n})),i_n=s((()=>{XZt()})),a_n,o_n,s_n=s((()=>{r_n(),W(),kE(),i_n(),a_n=[`id`],o_n=N({__name:`ServerSelector`,props:{eventBus:{},selectedServer:{},servers:{}},setup(e){let t=Sr(),n=t=>{e.eventBus.emit(`server:update:selected`,{url:e.selectedServer?.url===t?``:t,meta:{type:`document`}})},r=(t,n)=>{let r=e.servers.findIndex(t=>t.url===e.selectedServer?.url);r!==-1&&e.eventBus.emit(`server:update:variables`,{index:r,key:t,value:n,meta:{type:`document`}})};return(i,a)=>(F(),I(V,null,[a[0]||=R(`label`,{class:`bg-b-2 flex h-8 items-center rounded-t-xl border-x border-t px-3 py-2.5 font-medium`},` Server `,-1),R(`div`,{id:j(t),class:O([`border`,{"rounded-b-xl":!e.selectedServer?.description&&!e.selectedServer?.variables}])},[e.servers.length?(F(),L(n_n,{key:0,selectedServer:e.selectedServer,servers:e.servers,target:j(t),"onUpdate:modelValue":n},null,8,[`selectedServer`,`servers`,`target`])):B(``,!0)],10,a_n),H(j(k2),{layout:`reference`,variables:e.selectedServer?.variables,"onUpdate:variable":r},null,8,[`variables`]),e.selectedServer?.description?(F(),L(j(qT),{key:0,class:`text-c-3 rounded-b-xl border-x border-b px-3 py-1.5`,value:e.selectedServer.description},null,8,[`value`])):B(``,!0)],64))}})})),c_n,l_n=s((()=>{s_n(),c_n=o_n})),u_n,d_n,f_n=s((()=>{M7(),Sfn(),l_n(),W(),QI(),u_n={class:`docSettings`},d_n=N({__name:`DocSettings`,props:{document:{},name:{}},setup(e){let{workspaceStore:t,config:n,eventBus:r}=k7(),i=U(()=>kI(t,e.document).environment),a=U(()=>{let t=XI(e.document.servers,{documentUrl:e.document[`x-scalar-original-source-url`]});return ZI(e.document,null,null,t)}),o=U(()=>e.document.components?.securitySchemes??{});return(s,c)=>(F(),I(`div`,u_n,[R(`div`,null,[H(F7,{authStore:j(t).auth,document:e.document,environment:i.value,eventBus:j(r),name:e.name,options:j(n),securitySchemes:o.value,selectedServer:a.value},null,8,[`authStore`,`document`,`environment`,`eventBus`,`name`,`options`,`securitySchemes`,`selectedServer`])]),R(`div`,null,[H(c_n,{eventBus:j(r),selectedServer:a.value,servers:e.document.servers??[]},null,8,[`eventBus`,`selectedServer`,`servers`])])]))}})})),p_n,m_n=s((()=>{P7(),f_n(),p_n=N7(d_n,[[`__scopeId`,`data-v-01a25619`]])})),h_n,g_n,__n,v_n,y_n,b_n,x_n,S_n,C_n=s((()=>{o8(),M7(),m_n(),W(),kE(),OI(),Ou(),h_n={class:`settingsHeading`},g_n={class:`documentList`},__n=[`onClick`],v_n={key:0},y_n={key:1,class:`noDocuments`},b_n={class:`proxyUrlContainer`},x_n=[`href`],S_n=N({__name:`Settings`,props:{modalState:{}},setup(e){let{workspaceStore:t,proxyUrlRaw:n}=k7();function r(e){t.update(`x-scalar-active-document`,e)}return(i,a)=>(F(),L(j(rE),{class:`settingsModal`,state:e.modalState},{default:M(()=>[R(`div`,h_n,[a[1]||=R(`h1`,null,`Settings`,-1),H(j(rb),{class:`colorToggle ml-auto`})]),R(`div`,g_n,[Object.entries(j(t).workspace.documents).length?(F(!0),I(V,{key:0},Ar(Object.entries(j(t).workspace.documents),([e,n])=>(F(),I(`div`,{key:e,class:`document`},[R(`button`,{class:O([`documentName`,{documentNameActive:j(t).workspace.activeDocument===n}]),type:`button`,onClick:t=>r(e)},[z(` @`+k(e)+` `,1),j(t).workspace.activeDocument===n?(F(),L(j(tl),{key:0})):(F(),L(j(ll),{key:1}))],10,__n),j(t).workspace.activeDocument===n&&j(EI)(n)?(F(),I(`div`,v_n,[H(p_n,{document:n,name:e},null,8,[`document`,`name`])])):B(``,!0)]))),128)):(F(),I(`div`,y_n,` There's no API definition loaded. Use the + button to load APIs. `))]),R(`div`,b_n,[a[3]||=R(`label`,{for:`proxyUrl`},`CORS Proxy`,-1),R(`p`,null,[a[2]||=z(` All requests will be sent through the specified proxy URL to help avoid CORS (Cross-Origin Resource Sharing) issues. `,-1),R(`a`,{class:`underline`,href:j(a8).PROXY_SOURCE_CODE,target:`_blank`},` Read more `,8,x_n)]),H(j(yE),{id:`proxyUrl`,modelValue:j(n),"onUpdate:modelValue":a[0]||=e=>xn(n)?n.value=e:null,label:`Proxy URL`,placeholder:j(a8).DEFAULT_PROXY_URL},null,8,[`modelValue`,`placeholder`])])]),_:1},8,[`state`]))}})})),w_n,T_n=s((()=>{P7(),C_n(),w_n=N7(S_n,[[`__scopeId`,`data-v-9843da37`]])})),E_n,D_n,O_n=s((()=>{m8(),M7(),tfn(),rfn(),afn(),Xgn(),T_n(),W(),E_n={ref:`clientModal`},D_n=N({__name:`Chat`,emits:[`uploadApi`],setup(e){let{chat:t,prompt:n,settingsModal:r,eventBus:i,workspaceStore:a,config:o,mode:s,addDocument:c}=k7(),l=wr(`clientModal`),u=A(null);Hi(async()=>{let e=ncn();s===`preview`&&e&&await c({namespace:e.namespace,slug:e.slug,removable:!1,tmp:!0}),l.value&&(u.value=y3({el:l.value,options:o,eventBus:i,workspaceStore:a}))}),Wi(()=>{u.value?.app.unmount()}),nfn(),efn(),ifn();async function d(){await t.sendMessage({text:n.value})}return(e,t)=>(F(),I(V,null,[R(`div`,E_n,null,512),H(Ygn,{onSubmit:d,onUploadApi:t[0]||=t=>e.$emit(`uploadApi`)}),H(w_n,{modalState:j(r)},null,8,[`modalState`])],64))}})})),k_n,A_n=s((()=>{O_n(),k_n=D_n})),j_n,M_n=s((()=>{M7(),A_n(),W(),j_n=N({__name:`App`,props:{registryDocuments:{},registryUrl:{},dashboardUrl:{},platformProxyUrl:{},baseUrl:{},mode:{default:`full`},getAccessToken:{type:Function},getAgentKey:{type:Function},getActiveDocumentJson:{type:Function},isLoggedIn:{},prefilledMessage:{},hideAddApi:{type:Boolean}},emits:[`uploadApi`],setup(e,{expose:t}){let n=$dn({getActiveDocumentJson:e.getActiveDocumentJson,initialRegistryDocuments:e.registryDocuments,prefilledMessageRef:e.prefilledMessage,platformProxyUrl:e.platformProxyUrl,registryUrl:e.registryUrl,baseUrl:e.baseUrl,mode:e.mode,getAccessToken:e.getAccessToken,getAgentKey:e.getAgentKey,isLoggedIn:e.isLoggedIn,dashboardUrl:e.dashboardUrl,hideAddApi:e.hideAddApi});return dr(A7,n),t({addDocumentAsync:n.addDocumentAsync}),(e,t)=>(F(),L(k_n,{onUploadApi:t[0]||=t=>e.$emit(`uploadApi`)}))}})})),N_n,P_n=s((()=>{M_n(),N_n=j_n})),F_n=s((()=>{P_n()})),I_n,L_n=s((()=>{W(),F_n(),I_n=N({__name:`AgentScalarChatInterface`,props:{agentScalarConfiguration:{},externalUrls:{},workspaceStore:{},prefilledMessage:{}},setup(e){return(t,n)=>(F(),L(j(N_n),{baseUrl:e.externalUrls.apiBaseUrl,dashboardUrl:e.externalUrls.dashboardUrl,getActiveDocumentJson:()=>e.workspaceStore.exportActiveDocument(`json`),getAgentKey:e.agentScalarConfiguration?.key?()=>e.agentScalarConfiguration?.key??``:void 0,hideAddApi:e.agentScalarConfiguration?.hideAddApi,mode:e.agentScalarConfiguration?.key?`full`:`preview`,platformProxyUrl:e.externalUrls.proxyUrl,prefilledMessage:e.prefilledMessage,registryDocuments:[],registryUrl:e.externalUrls.registryUrl},null,8,[`baseUrl`,`dashboardUrl`,`getActiveDocumentJson`,`getAgentKey`,`hideAddApi`,`mode`,`platformProxyUrl`,`prefilledMessage`,`registryUrl`]))}})})),R_n=l({default:()=>z_n}),z_n,B_n=s((()=>{L_n(),L_n(),z_n=I_n}));W(),kE(),Ou();var V_n={class:`agent-scalar-container custom-scroll custom-scroll-self-contain-overflow overflow-auto px-6`},H_n=N({__name:`AgentScalarDrawer`,props:{agentScalarConfiguration:{},externalUrls:{},workspaceStore:{}},setup(e){let t=h6(),n=qte(async()=>Promise.resolve().then(()=>(B_n(),R_n)));return(r,i)=>(F(),I(V,null,[H(Ka,{enterActiveClass:`transition-opacity duration-500`,enterFromClass:`opacity-0`,enterToClass:`opacity-100`,leaveActiveClass:`transition-opacity duration-200`,leaveFromClass:`opacity-100`,leaveToClass:`opacity-0`},{default:M(()=>[lr(R(`div`,{class:`agent-scalar-overlay bg-backdrop fixed inset-0 z-10 ease-[cubic-bezier(0.77,0,0.175,1)]`,onClick:i[0]||=e=>j(t)?.closeAgent()},null,512),[[Za,j(t)?.showAgent.value]])]),_:1}),H(Ka,{enterActiveClass:`transition-transform duration-300`,enterFromClass:`-translate-x-full`,enterToClass:`translate-x-0`,leaveActiveClass:`transition-transform duration-200`,leaveFromClass:`translate-x-0`,leaveToClass:`-translate-x-full`},{default:M(()=>[lr(R(`div`,{class:`agent-scalar left-refs-w-sidebar bg-b-1 fixed inset-y-0 right-12 z-10 grid border-r shadow-lg`,onKeydown:i[2]||=mo(e=>j(t)?.closeAgent(),[`escape`])},[R(`div`,V_n,[H(j(n),{agentScalarConfiguration:e.agentScalarConfiguration,externalUrls:e.externalUrls,prefilledMessage:j(t)?.prefilledMessage,workspaceStore:e.workspaceStore},null,8,[`agentScalarConfiguration`,`externalUrls`,`prefilledMessage`,`workspaceStore`])]),H(j(GT),{class:`agent-scalar-exit-button absolute top-2 right-2`,icon:j(Du),label:`Close Client`,weight:`bold`,onClick:i[1]||=e=>j(t)?.closeAgent()},null,8,[`icon`])],544),[[Za,j(t)?.showAgent.value]])]),_:1})],64))}}),U7=(e,t)=>{let n=e.__vccOpts||e;for(let[e,r]of t)n[e]=r;return n},U_n=U7(H_n,[[`__scopeId`,`data-v-a9f22fa8`]]);function W_n(e){try{return!!new URL(e)}catch{return!1}}yF();function G_n(e){return!!e&&typeof e==`object`&&`url`in e&&typeof e.url==`string`}async function W7(e,t){let n=JSON.stringify({document:e}),r=`${t.apiBaseUrl}/core/share/upload/apis`,i=await fetch(_F(t.proxyUrl,r),{method:`POST`,headers:{"Content-Type":`application/json`},body:n});if(!i.ok)throw Error(` Failed to generate temporary link, server responded with ${i.status}`);let a=await i.json();if(!G_n(a))throw Error(`Failed to generate temporary link, invalid response from server`);return a.url}W(),kE(),Ou(),j2(),gX();var K_n={class:`scalar-mcp-layer`},q_n=[`href`,`target`],J_n=[`href`,`target`],Y_n=U7(N({__name:`OpenMCPButton`,props:Lr({config:{},externalUrls:{},url:{},workspace:{}},{url:{},urlModifiers:{}}),emits:[`update:url`],setup(e){let t=e,{copyToClipboard:n}=A2(),{toast:r}=pX(),i=mf(),a=t.config?.name||t.config?.url,o=btoa(JSON.stringify(t.config??{})),s=`cursor://anysphere.cursor-deeplink/mcp/install?name=${encodeURIComponent(t.config?.name??``)}&config=${o}`,c=`vscode:mcp/install?${encodeURIComponent(JSON.stringify(t.config??{}))}`,l=Ur(e,`url`);async function u(){if(i.isLoading||!t.workspace)return;if(l.value&&W_n(l.value)){d(l.value);return}i.start();let e=t.workspace.exportActiveDocument(`json`);if(!e){r(`Unable to export active document`,`error`),await i.invalidate();return}try{l.value=await W7(e,t.externalUrls),await i.validate(),d(l.value),await ar(),await i.clear()}catch(e){r(e instanceof Error?e.message:`An unknown error occurred`,`error`),await i.invalidate()}}function d(e){let n=new URL(`${t.externalUrls.dashboardUrl}/register`);n.searchParams.set(`url`,e),n.searchParams.set(`createMcp`,`true`),window.open(n.toString(),`_blank`)}return(t,r)=>(F(),I(`div`,K_n,[R(`a`,{class:`scalar-mcp-layer-link`,href:j(a)?c:void 0,target:j(a)?`_blank`:void 0,onClick:r[0]||=e=>{j(a)||(e.preventDefault(),u())}},[r[3]||=R(`svg`,{class:`mcp-logo`,fill:`currentColor`,height:`800`,viewBox:`0 0 32 32`,width:`800`,xmlns:`http://www.w3.org/2000/svg`},[R(`path`,{d:`M30.865 3.448 24.282.281a1.99 1.99 0 0 0-2.276.385L9.397 12.171 3.902 8.004a1.33 1.33 0 0 0-1.703.073L.439 9.681a1.33 1.33 0 0 0-.005 1.969L5.2 15.999.434 20.348a1.33 1.33 0 0 0 .005 1.969l1.76 1.604a1.33 1.33 0 0 0 1.703.073l5.495-4.172 12.615 11.51a1.98 1.98 0 0 0 2.271.385l6.589-3.172a1.99 1.99 0 0 0 1.13-1.802V5.248c0-.766-.443-1.469-1.135-1.802zm-6.86 19.818L14.432 16l9.573-7.266z`})],-1),r[4]||=z(` VS Code `,-1),H(j(Wc),{class:`mcp-nav ml-auto size-4`})],8,q_n),R(`a`,{class:`scalar-mcp-layer-link`,href:j(a)?s:void 0,target:j(a)?`_blank`:void 0,onClick:r[1]||=e=>{j(a)||(e.preventDefault(),u())}},[r[5]||=R(`svg`,{class:`mcp-logo`,viewBox:`0 0 466.73 532.09`,xmlns:`http://www.w3.org/2000/svg`},[R(`path`,{d:`M457.43 125.94 244.42 2.96a22.13 22.13 0 0 0-22.12 0L9.3 125.94C3.55 129.26 0 135.4 0 142.05v247.99c0 6.65 3.55 12.79 9.3 16.11l213.01 122.98a22.13 22.13 0 0 0 22.12 0l213.01-122.98c5.75-3.32 9.3-9.46 9.3-16.11V142.05c0-6.65-3.55-12.79-9.3-16.11zm-13.38 26.05L238.42 508.15c-1.39 2.4-5.06 1.42-5.06-1.36V273.58c0-4.66-2.49-8.97-6.53-11.31L24.87 145.67c-2.4-1.39-1.42-5.06 1.36-5.06h411.26c5.84 0 9.49 6.33 6.57 11.39h-.01Z`,style:{fill:`currentColor`}})],-1),r[6]||=z(` Cursor `,-1),H(j(Wc),{class:`mcp-nav ml-auto size-4`})],8,J_n),j(a)?(F(),I(`div`,{key:1,class:`scalar-mcp-layer-link`,onClick:r[2]||=t=>j(n)(e.config?.url??``)},[...r[9]||=[z(` Connect MCP `,-1),R(`svg`,{class:`mcp-logo ml-auto`,fill:`none`,height:`173`,viewBox:`0 0 156 173`,width:`156`,xmlns:`http://www.w3.org/2000/svg`},[R(`path`,{d:`m6 80.912 67.882-67.883c9.373-9.372 24.569-9.372 33.941 0s9.373 24.569 0 33.942L56.558 98.236`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-width":`12`}),R(`path`,{d:`m57.265 97.529 50.558-50.558c9.373-9.373 24.569-9.373 33.942 0l.353.353c9.373 9.373 9.373 24.569 0 33.941L80.725 142.66a8 8 0 0 0 0 11.313l12.606 12.607`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-width":`12`}),R(`path`,{d:`M90.853 30 40.648 80.205c-9.372 9.372-9.372 24.568 0 33.941 9.373 9.372 24.569 9.372 33.941 0l50.205-50.205`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-width":`12`})],-1)]])):(F(),I(`div`,{key:0,class:`scalar-mcp-layer-link`,onClick:u},[r[7]||=R(`svg`,{class:`mcp-logo`,fill:`none`,height:`173`,viewBox:`0 0 156 173`,width:`156`,xmlns:`http://www.w3.org/2000/svg`},[R(`path`,{d:`m6 80.912 67.882-67.883c9.373-9.372 24.569-9.372 33.941 0s9.373 24.569 0 33.942L56.558 98.236`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-width":`12`}),R(`path`,{d:`m57.265 97.529 50.558-50.558c9.373-9.373 24.569-9.373 33.942 0l.353.353c9.373 9.373 9.373 24.569 0 33.941L80.725 142.66a8 8 0 0 0 0 11.313l12.606 12.607`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-width":`12`}),R(`path`,{d:`M90.853 30 40.648 80.205c-9.372 9.372-9.372 24.568 0 33.941 9.373 9.372 24.569 9.372 33.941 0l50.205-50.205`,stroke:`currentColor`,"stroke-linecap":`round`,"stroke-width":`12`})],-1),r[8]||=z(` Generate MCP `,-1),H(j(Wc),{class:`mcp-nav ml-auto size-4`})]))]))}}),[[`__scopeId`,`data-v-496918d9`]]);W();var X_n={},Z_n={class:`references-classic-header-container`},Q_n={class:`references-classic-header`},$_n={class:`references-classic-header-content`};function evn(e,t){return F(),I(`div`,Z_n,[R(`div`,Q_n,[R(`div`,$_n,[P(e.$slots,`default`,{},void 0,!0)]),P(e.$slots,`dark-mode-toggle`,{},void 0,!0)])])}var tvn=U7(X_n,[[`render`,evn],[`__scopeId`,`data-v-8a3822ca`]]);W(),kE(),Ou();var nvn={class:`min-w-0 flex-1 truncate`},rvn=N({inheritAttrs:!1,__name:`ExamplePicker`,props:Lr({examples:{default:()=>({})}},{modelValue:{required:!0},modelModifiers:{}}),emits:[`update:modelValue`],setup(e){let t=Ur(e,`modelValue`),n=U(()=>Object.entries(e.examples).map(([e,t])=>({id:e,label:t?.summary??e}))),r=U({get:()=>n.value.find(({id:e})=>e===t.value),set:e=>t.value=e?.id??``});return(e,t)=>(F(),L(j(pS),{modelValue:r.value,"onUpdate:modelValue":t[0]||=e=>r.value=e,class:`w-fit min-w-32`,options:n.value,placement:`bottom-start`,teleport:``},{default:M(()=>[H(j(gf),ai({class:`text-c-2 hover:text-c-1 flex h-full w-fit min-w-0 gap-1.5 px-1.5 py-0.75 text-base font-normal`,"data-testid":`example-picker`,variant:`ghost`},e.$attrs),{default:M(()=>[R(`div`,nvn,k(r.value?.label??`Select an example`),1),H(j(tl),{class:`ui-open:rotate-180 mt-0.25 size-3 transition-transform duration-100`,weight:`bold`})]),_:1},16)]),_:1},8,[`modelValue`,`options`]))}});W(),T2(),D4();var ivn=N({__name:`HttpMethod`,props:{as:{},property:{},short:{type:Boolean},method:{}},setup(e){let t=e,n=U(()=>w2(String(t.method||``))),r=U(()=>E4(t.method));return(t,i)=>(F(),L(kr(e.as??`span`),{class:`uppercase`,style:it({[e.property||`color`]:n.value.colorVar})},{default:M(()=>[P(t.$slots,`default`),z(` `+k(e.short?n.value.short:r.value),1)]),_:3},8,[`style`]))}}),avn=(e,t)=>{let n=t.toLowerCase();return e.label.toLowerCase().includes(n)||e.clientKey.toLowerCase().includes(n)||e.lang.toLowerCase().includes(n)},ovn=(e,t)=>{let n=t.toLowerCase();return e.label.toLowerCase().includes(n)||e.key.toLowerCase().includes(n)},svn=((e,t,n)=>{if(e===``)return t;let r=e.toLowerCase(),i=n?n.filter(e=>e.label&&e.options.length>0).length:0;if(n&&i>1){let e=[];for(let t of n)ovn(t,r)?e.push(...t.options):e.push(...t.options.filter(e=>avn(e,r)));return e}return t.filter(e=>avn(e,r))}),cvn=e=>{if(!e)return()=>null;let t=e.getBoundingClientRect().top,n=null,r=new MutationObserver(r=>{r.some(e=>e.type===`childList`||e.type===`attributes`&&(e.attributeName===`style`||e.attributeName===`class`))&&(n!==null&&cancelAnimationFrame(n),n=requestAnimationFrame(()=>{let r=e.getBoundingClientRect().top;if(r!==t){let e=r-t;window.scrollBy(0,e)}n=null}))});return r.observe(document.body,{childList:!0,subtree:!0,attributes:!0,attributeFilter:[`style`,`class`],characterData:!1}),()=>{n!==null&&cancelAnimationFrame(n),r.disconnect()}};KIt(),bY(),TIt(),EIt(),DIt(),YIt(),W(),kE(),Ou(),zE();var lvn=[`innerHTML`],uvn=[`id`],dvn={key:0,class:`request-card-footer-addon`},fvn={class:`request-header`},pvn=N({__name:`OperationCodeSample`,props:Lr({integration:{},clientOptions:{},selectedClient:{},selectedServer:{default:null},selectedContentType:{},selectedExample:{},eventBus:{},securitySchemes:{default:()=>[]},method:{},path:{},operation:{},fallback:{type:Boolean},generateLabel:{type:Function},isWebhook:{type:Boolean},globalCookies:{},requestBodyCompositionSelection:{}},{selectedExample:{default:``},selectedExampleModifiers:{}}),emits:[`update:selectedExample`],setup(e){let t=U(()=>{let t=RE(e.operation.requestBody)?.content??{},n=e.selectedContentType||Object.keys(t)[0];return n?t[n]?.examples??{}:{}}),n=Ur(e,`selectedExample`);Vi(()=>{n.value||=Object.keys(t.value)[0]??``}),mr(()=>e.selectedContentType,()=>{Object.keys(t.value).includes(n.value)||(n.value=Object.keys(t.value)[0]??``)});let r=U(()=>SY(e.operation)),i=U(()=>xY(r.value,e.clientOptions)),a=A(yY(i.value,e.selectedClient));mr(()=>e.selectedClient,e=>{let t=yY(i.value,e);t&&(a.value=t)});let o=U(()=>{if(!e.isWebhook)return null;try{return kY({operation:e.operation,method:e.method,path:e.path,example:n.value,requestBodyCompositionSelection:e.requestBodyCompositionSelection,defaultDisabledParameters:!1})}catch(e){return console.error(`[webhookHar]`,e),null}}),s=U(()=>e.isWebhook?o.value?.postData?.text??``:jY({defaultDisabledParameters:!1,includeDefaultHeaders:e.integration===`client`,clientId:a.value?.id,customCodeSamples:r.value,operation:e.operation,method:e.method,path:e.path,contentType:e.selectedContentType,server:e.selectedServer,securitySchemes:e.securitySchemes,example:n.value,globalCookies:e.globalCookies,requestBodyCompositionSelection:e.requestBodyCompositionSelection})),c=U(()=>e.isWebhook?l.value:a.value?.lang),l=U(()=>{if(!o.value?.postData)return`json`;let e=o.value.postData.mimeType;return e?.includes(`json`)?`json`:e?.includes(`xml`)?`xml`:e?.includes(`yaml`)||e?.includes(`yml`)?`yaml`:e?.includes(`text/plain`)?`text`:`json`}),u=U(()=>CY(e.securitySchemes)),d=A(null),f=t=>{if(d.value){let e=cvn(d.value.$el);setTimeout(()=>{e()},300)}a.value=t,t&&!t.id.startsWith(`custom`)&&e.eventBus.emit(`workspace:update:selected-client`,t.id)},p=U(()=>(s.value.length??0)>2e4),m=Sr();return(r,o)=>s.value?(F(),L(j(yf),{key:0,ref_key:`elem`,ref:d,class:`request-card dark-mode`},{default:M(()=>[H(j(Cf),{class:`pr-2.5`},jr({default:M(()=>[o[2]||=R(`span`,{class:`sr-only`},`Request Example for`,-1),H(ivn,{as:`span`,class:`request-method`,method:e.method},null,8,[`method`]),e.generateLabel?(F(),I(`span`,{key:0,innerHTML:e.generateLabel()},null,8,lvn)):B(``,!0),P(r.$slots,`header`,{},void 0,!0)]),_:2},[!e.isWebhook&&i.value.length?{name:`actions`,fn:M(()=>[H(j(PS),{class:`max-h-80`,filterFn:j(svn),modelValue:a.value,options:i.value,placement:`bottom-end`,teleport:``,"onUpdate:modelValue":o[0]||=e=>f(e)},{default:M(()=>[H(j(gf),{class:`text-c-2 hover:text-c-1 flex h-full w-fit gap-1.5 px-0.5 py-0 text-base font-normal`,"data-testid":`client-picker`,variant:`ghost`},{default:M(()=>[z(k(a.value?.title)+` `,1),H(j(tl),{class:`ui-open:rotate-180 mt-px size-3 transition-transform duration-100`,weight:`bold`})]),_:1})]),_:1},8,[`filterFn`,`modelValue`,`options`])]),key:`0`}:void 0]),1024),H(j(bf),{class:`request-editor-section custom-scroll p-0`},{default:M(()=>[R(`div`,{id:`${j(m)}-example`,class:`code-snippet`},[p.value?(F(),L(j(CE),{key:1,containerClass:`custom-scroll scalar-code-block border rounded-b flex flex-1 max-h-screen`,contentClass:`language-plaintext whitespace-pre font-code text-base p-2`,lineHeight:20,text:s.value},null,8,[`text`])):(F(),L(j(Wy),{key:0,class:`bg-b-2 h-full`,content:s.value,hideCredentials:u.value,lang:c.value,lineNumbers:``},null,8,[`content`,`hideCredentials`,`lang`]))],8,uvn)]),_:1}),Object.keys(t.value).length>1||r.$slots.footer?(F(),L(j(Sf),{key:0,class:`request-card-footer bg-b-3`},{default:M(()=>[Object.keys(t.value).length>1?(F(),I(`div`,dvn,[Object.keys(t.value).length?(F(),L(rvn,{key:0,modelValue:n.value,"onUpdate:modelValue":o[1]||=e=>n.value=e,examples:t.value},null,8,[`modelValue`,`examples`])):B(``,!0)])):B(``,!0),P(r.$slots,`footer`,{exampleName:n.value},void 0,!0)]),_:3})):B(``,!0)]),_:3},512)):e.fallback?(F(),L(j(yf),{key:1,class:`request-card dark-mode`},{default:M(()=>[H(j(bf),{class:`request-card-simple`},{default:M(()=>[R(`div`,fvn,[H(ivn,{as:`span`,class:`request-method`,method:e.method},null,8,[`method`]),P(r.$slots,`header`,{},void 0,!0)]),P(r.$slots,`footer`,{exampleName:n.value},void 0,!0)]),_:3})]),_:3})):B(``,!0)}});Bc();var mvn=zc(pvn,[[`__scopeId`,`data-v-8d155354`]]);kIt(),bY(),TR();var hvn=[`shell/curl`,`ruby/native`,`node/undici`,`php/guzzle`,`python/python3`],G7=(e,t=hvn)=>!!(e&&t.includes(e)),gvn=(e,t=hvn)=>{let n=new Map;for(let t of e)for(let e of t.options)n.set(e.id,e);return t.flatMap(e=>n.get(e)??[])};W(),Rc(),kE(),v3();var _vn={class:`client-libraries-text`},vvn={"aria-hidden":`true`,class:`client-libraries-icon__more`},yvn={key:1,class:`client-libraries-icon`,height:`50`,role:`presentation`,viewBox:`0 0 50 50`,width:`50`,xmlns:`http://www.w3.org/2000/svg`},bvn={key:0,class:`client-libraries-text client-libraries-text-more`},xvn=U7(N({__name:`ClientDropdown`,props:{clientOptions:{},selectedClient:{},featuredClients:{},eventBus:{}},setup(e){let t=A(),n=e=>`programming-language-${e===`js`?`javascript`:e}`,r=n=>{if(!t.value)return;let r=cvn(t.value);setTimeout(()=>{r()},300),n.clientKey!==`custom`&&e.eventBus.emit(`workspace:update:selected-client`,n.id)},i=U(()=>e.selectedClient?.split(`/`)[0]);return(a,o)=>(F(),I(`div`,{ref_key:`containerRef`,ref:t,class:`client-libraries-content`},[(F(!0),I(V,null,Ar(e.featuredClients,t=>(F(),L(j(kc),{key:t.clientKey,class:O([`client-libraries rendered-code-sdks`,{"client-libraries__active":t.id===e.selectedClient}])},{default:M(()=>[R(`div`,{class:O(`client-libraries-icon__${t.targetKey}`)},[H(j(jT),{class:`client-libraries-icon`,icon:n(t.targetKey)},null,8,[`icon`])],2),R(`span`,_vn,k(t.targetTitle),1)]),_:2},1032,[`class`]))),128)),H(j(PS),{filterFn:j(svn),modelValue:j(yY)(e.clientOptions,e.selectedClient),options:e.clientOptions,placement:`bottom-end`,teleport:``,"onUpdate:modelValue":o[0]||=e=>r(e)},{default:M(()=>[R(`button`,{class:O([`client-libraries client-libraries__select`,{"client-libraries__active":e.selectedClient&&!j(G7)(e.selectedClient)}]),type:`button`},[R(`div`,vvn,[e.selectedClient&&!j(G7)(e.selectedClient)?(F(),I(`div`,{key:0,class:O(`client-libraries-icon__${i.value}`)},[i.value?(F(),L(j(jT),{key:0,class:`client-libraries-icon`,icon:n(i.value)},null,8,[`icon`])):B(``,!0)],2)):(F(),I(`svg`,yvn,[...o[1]||=[R(`g`,{fill:`currentColor`,"fill-rule":`nonzero`},[R(`path`,{d:`M10.71 25.3a3.87 3.87 0 1 0 7.74 0 3.87 3.87 0 0 0-7.74 0M21.13 25.3a3.87 3.87 0 1 0 7.74 0 3.87 3.87 0 0 0-7.74 0M31.55 25.3a3.87 3.87 0 1 0 7.74 0 3.87 3.87 0 0 0-7.74 0`})],-1)]]))]),e.clientOptions.length?(F(),I(`span`,bvn,` More `)):B(``,!0),o[2]||=R(`span`,{class:`sr-only`},`Select from all clients`,-1)],2)]),_:1},8,[`filterFn`,`modelValue`,`options`])],512))}}),[[`__scopeId`,`data-v-75d206b8`]]);W(),Rc(),kE(),v3();var Svn={key:0,ref:`wrapper-ref`},Cvn=[`id`],wvn={key:1,class:`selected-client card-footer border-t-0 p-0`,role:`tabpanel`,tabindex:`1`},Tvn=[`id`],Evn=U7(N({__name:`ClientSelector`,props:{xScalarSdkInstallation:{},clientOptions:{},selectedClient:{default:()=>_Y},eventBus:{}},setup(e,{expose:t}){let n=Sr(),r=Sr(),i=U(()=>e.clientOptions.flatMap(t=>t.options.find(t=>t.id===e.selectedClient)??[])[0]),a=U(()=>gvn(e.clientOptions)),o=U(()=>a.value.findIndex(t=>e.selectedClient===t.id)),s=wr(`wrapper-ref`),c=t=>{let n=a.value[t];!n||!s.value||e.eventBus.emit(`workspace:update:selected-client`,n.id)},l=U(()=>{if(!Array.isArray(e.xScalarSdkInstallation)||!e.xScalarSdkInstallation?.length)return;let t=e.xScalarSdkInstallation.find(t=>{let n=e.selectedClient?.split(`/`)[0]?.toLowerCase();return t.lang.toLowerCase()===n});if(t)return t});return t({selectedClientOption:i}),(t,s)=>e.clientOptions.length?(F(),I(`div`,Svn,[H(j(Dc),{manual:``,selectedIndex:o.value,onChange:c},{default:M(()=>[R(`div`,{id:j(n),class:`client-libraries-heading`},` Client Libraries `,8,Cvn),H(j(Oc),{"aria-labelledby":j(n),class:`client-libraries-list`},{default:M(()=>[H(xvn,{clientOptions:e.clientOptions,eventBus:e.eventBus,featuredClients:a.value,morePanel:j(r),selectedClient:e.selectedClient},null,8,[`clientOptions`,`eventBus`,`featuredClients`,`morePanel`,`selectedClient`])]),_:1},8,[`aria-labelledby`]),H(j(ise),null,{default:M(()=>[l.value?.source||l.value?.description?(F(),I(V,{key:0},[l.value.description?(F(),I(`div`,{key:0,class:O([`selected-client card-footer -outline-offset-2`,l.value.source&&`rounded-b-none`]),role:`tabpanel`,tabindex:`0`},[H(j(qT),{value:l.value.description},null,8,[`value`])],2)):B(``,!0),l.value.source?(F(),I(`div`,wvn,[H(j(Wy),{class:`rounded-b-lg *:first:p-3`,content:l.value.source,copy:`always`,lang:`shell`},null,8,[`content`])])):B(``,!0)],64)):j(G7)(e.selectedClient)?(F(!0),I(V,{key:1},Ar(a.value,e=>(F(),L(j(ase),{key:e.id,class:`selected-client card-footer -outline-offset-2`},{default:M(()=>[z(k(e.title),1)]),_:2},1024))),128)):(F(),I(`div`,{key:2,id:j(r),class:`selected-client card-footer -outline-offset-2`,role:`tabpanel`,tabindex:`0`},k(i.value?.title),9,Tvn))]),_:1})]),_:1},8,[`selectedIndex`])],512)):B(``,!0)}}),[[`__scopeId`,`data-v-c6251633`]]);W();var K7=U7(N({__name:`Badge`,props:{color:{}},setup(e){let t=U(()=>e.color?{"--badge-background-color":e.color,"--badge-text-color":`color-mix(in srgb, ${e.color}, black 40%)`}:{});return(e,n)=>(F(),I(`div`,{class:`badge`,style:it(t.value)},[P(e.$slots,`default`,{},void 0,!0)],4))}}),[[`__scopeId`,`data-v-fb946bb8`]]);W(),v3();var Dvn=[`href`],Ovn=U7(N({__name:`DownloadLink`,props:{documentDownloadType:{},eventBus:{},documentUrl:{},documentType:{default:`openapi`}},setup(e){let t=U(()=>e.documentType===`asyncapi`?`Download AsyncAPI Document`:`Download OpenAPI Document`),n=t=>{e.eventBus.emit(`ui:download:document`,{format:t})};return(r,i)=>[`yaml`,`json`,`both`].includes(e.documentDownloadType)||e.documentDownloadType===`direct`&&e.documentUrl?(F(),I(`div`,{key:0,class:O([`download-container group`,{"download-both":e.documentDownloadType===`both`}])},[e.documentDownloadType===`direct`&&e.documentUrl?(F(),I(`a`,{key:0,class:`download-link download-button`,href:e.documentUrl},[R(`span`,null,k(t.value),1)],8,Dvn)):B(``,!0),e.documentDownloadType===`json`||e.documentDownloadType===`both`?(F(),I(`button`,{key:1,class:`download-button`,type:`button`,onClick:i[0]||=po(()=>n(`json`),[`prevent`])},[R(`span`,null,k(t.value),1),H(K7,{class:`extension hidden group-hover:flex`},{default:M(()=>[...i[2]||=[z(`json`,-1)]]),_:1})])):B(``,!0),e.documentDownloadType===`yaml`||e.documentDownloadType===`both`?(F(),I(`button`,{key:2,class:`download-button`,type:`button`,onClick:i[1]||=po(()=>n(`yaml`),[`prevent`])},[R(`span`,null,k(t.value),1),H(K7,{class:`extension hidden group-hover:flex`},{default:M(()=>[...i[3]||=[z(`yaml`,-1)]]),_:1})])):B(``,!0)],2)):B(``,!0)}}),[[`__scopeId`,`data-v-b258a15f`]]);W();var kvn=U7(N({__name:`IntroductionCard`,props:{row:{type:Boolean}},setup(e){return(t,n)=>(F(),I(`div`,{class:O([`introduction-card`,{"introduction-card-row":e.row}])},[P(t.$slots,`default`,{},void 0,!0)],2))}}),[[`__scopeId`,`data-v-5764c94a`]]);Zf(),W();var Avn=`-49% 0px -49% 0px`,q7=(e,t,n)=>{Hi(()=>{let r={rootMargin:n?.immediate?`0px 0px 0px 0px`:Avn,threshold:0};e.value&&aye(e,([e])=>{e?.isIntersecting?t():n?.onExit?.()},r)})};W();var J7=U7(N({__name:`Section`,emits:[`intersecting`],setup(e,{emit:t}){let n=t,r=wr(`section`);return q7(r,()=>n(`intersecting`)),(e,t)=>(F(),I(`section`,{ref_key:`section`,ref:r,class:`section`},[P(e.$slots,`default`,{},void 0,!0)],512))}}),[[`__scopeId`,`data-v-be4443e9`]]);W(),Rc(),Ou(),Zf();var jvn={class:`section-accordion-button-content`},Mvn={key:0,class:`section-accordion-button-actions`},Nvn={key:0,class:`section-accordion-description`},Pvn={class:`section-accordion-content-card`},Fvn=U7(N({__name:`SectionAccordion`,props:{transparent:{type:Boolean},modelValue:{type:Boolean}},emits:[`update:modelValue`],setup(e,{emit:t}){let n=t,r=A(),i=iye(r);return(t,a)=>(F(),L(j(ac),{as:`section`,class:O([`section-accordion`,{"section-accordion-transparent":e.transparent}])},{default:M(()=>[H(j(oc),{ref_key:`button`,ref:r,class:`section-accordion-button`,onClick:a[0]||=()=>n(`update:modelValue`,!e.modelValue)},{default:M(()=>[R(`div`,jvn,[P(t.$slots,`title`,{},void 0,!0)]),t.$slots.actions?(F(),I(`div`,Mvn,[P(t.$slots,`actions`,{active:j(i)||e.modelValue},void 0,!0)])):B(``,!0),H(j(ll),{class:O([`section-accordion-chevron size-4.5 transition-transform`,{"rotate-90":e.modelValue}])},null,8,[`class`])]),_:3},512),e.modelValue?(F(),L(j(sc),{key:0,class:`section-accordion-content`,static:``},{default:M(()=>[t.$slots.description?(F(),I(`div`,Nvn,[P(t.$slots,`description`,{},void 0,!0)])):B(``,!0),R(`div`,Pvn,[P(t.$slots,`default`,{},void 0,!0)])]),_:3})):B(``,!0)]),_:3},8,[`class`]))}}),[[`__scopeId`,`data-v-ff689b94`]]);W();var Ivn={},Lvn={class:`section-column`};function Rvn(e,t){return F(),I(`div`,Lvn,[P(e.$slots,`default`,{},void 0,!0)])}var Y7=U7(Ivn,[[`render`,Rvn],[`__scopeId`,`data-v-699c28e3`]]);W();var zvn={},Bvn={class:`section-columns`};function Vvn(e,t){return F(),I(`div`,Bvn,[P(e.$slots,`default`,{},void 0,!0)])}var X7=U7(zvn,[[`render`,Vvn],[`__scopeId`,`data-v-8b9602bf`]]);W();var Hvn={key:1,class:`section-container`},Z7=U7(N({__name:`SectionContainer`,props:{omit:{type:Boolean}},setup(e){return(t,n)=>e.omit?P(t.$slots,`default`,{key:0},void 0,!0):(F(),I(`div`,Hvn,[P(t.$slots,`default`,{},void 0,!0)]))}}),[[`__scopeId`,`data-v-20a1472a`]]);W(),Rc(),Ou();var Uvn={class:`section-accordion-wrapper`},Wvn={class:`section-accordion-title`},Gvn=U7(N({__name:`SectionContainerAccordion`,props:{modelValue:{type:Boolean}},emits:[`update:modelValue`],setup(e,{emit:t}){let n=t;return(t,r)=>(F(),I(`section`,Uvn,[H(j(ac),{as:`div`,class:`section-accordion`},{default:M(()=>[H(j(oc),{class:`section-accordion-button`,onClick:r[0]||=t=>n(`update:modelValue`,!e.modelValue)},{default:M(()=>[H(j(ll),{class:O([`section-accordion-chevron size-5 transition-transform`,{"rotate-90":e.modelValue}])},null,8,[`class`]),R(`div`,Wvn,[P(t.$slots,`title`,{},void 0,!0)])]),_:3}),e.modelValue?(F(),L(j(sc),{key:0,class:`section-accordion-content`,static:``},{default:M(()=>[P(t.$slots,`default`,{},void 0,!0)]),_:3})):B(``,!0)]),_:3})]))}}),[[`__scopeId`,`data-v-9419dd23`]]);W();var Kvn=U7(N({__name:`LoadingSkeleton`,props:{lines:{default:1}},setup(e){return(t,n)=>(F(!0),I(V,null,Ar([...Array(e.lines).keys()],t=>(F(),I(`div`,{key:t,class:O([`loading`,{"single-line":e.lines===1}])},null,2))),128))}}),[[`__scopeId`,`data-v-8e0226d7`]]);W();var qvn={class:`section-content`},Q7=U7(N({__name:`SectionContent`,props:{loading:{type:Boolean,default:!1}},setup(e){return(t,n)=>(F(),I(`div`,qvn,[e.loading?(F(),L(Kvn,{key:1,lines:8})):P(t.$slots,`default`,{key:0},void 0,!0)]))}}),[[`__scopeId`,`data-v-9735459e`]]);W();var Jvn={class:`section-header-wrapper xl:gap-12`},$7=U7(N({__name:`SectionHeader`,props:{loading:{type:Boolean},tight:{type:Boolean},removeMargin:{type:Boolean,default:!1}},setup(e){return(t,n)=>(F(),I(`div`,Jvn,[e.loading?(F(),L(Kvn,{key:0})):(F(),I(`div`,{key:1,class:O([`section-header`,{tight:e.tight,"mb-3":!e.removeMargin}])},[P(t.$slots,`default`,{},void 0,!0)],2)),t.$slots.links?P(t.$slots,`links`,{key:2},void 0,!0):B(``,!0)]))}}),[[`__scopeId`,`data-v-8a5913a9`]]);W();var e9=U7(N({__name:`SectionHeaderTag`,props:{level:{default:1}},setup(e){return(t,n)=>(F(),L(kr(`h${e.level}`),{class:`section-header-label`},{default:M(()=>[P(t.$slots,`default`,{},void 0,!0)]),_:3}))}}),[[`__scopeId`,`data-v-f1ac6c38`]]);W();var Yvn={key:0,class:`screenreader-only`},t9=U7(N({__name:`ScreenReader`,props:{if:{type:Boolean,default:!0}},setup(e){return(e,t)=>e.$props.if?(F(),I(`span`,Yvn,[P(e.$slots,`default`,{},void 0,!0)])):P(e.$slots,`default`,{key:1},void 0,!0)}}),[[`__scopeId`,`data-v-df2e1026`]]);W(),kE(),Ou();var Xvn=[`id`],Zvn={class:`relative`},n9=N({__name:`Anchor`,emits:[`copyAnchorUrl`],setup(e,{emit:t}){let n=t,r=Sr(),{cx:i}=cf();return(e,t)=>(F(),I(`span`,at($r(j(i)(`group/heading wrap-break-word relative`))),[R(`span`,{id:j(r),class:`contents`},[P(e.$slots,`default`)],8,Xvn),R(`span`,Zvn,[t[2]||=R(`span`,null,`​`,-1),H(j(gf),{"aria-describedby":j(r),class:`absolute top-1/2 left-0 inline-block h-fit -translate-y-1/2 px-1.5 py-1 opacity-0 group-hover/heading:opacity-100 group-has-focus-visible/heading:opacity-100`,variant:`ghost`,onClick:t[0]||=po(()=>n(`copyAnchorUrl`),[`stop`])},{default:M(()=>[H(j(rde),{"aria-hidden":`true`,class:`size-4.5`}),H(t9,null,{default:M(()=>[...t[1]||=[z(`Copy link`,-1)]]),_:1})]),_:1},8,[`aria-describedby`])])],16))}});W(),Ou();var Qvn=[`id`],$vn={class:`sr-only`},eyn=N({__name:`WithBreadcrumb`,props:{breadcrumb:{},eventBus:{}},setup(e){return(t,n)=>e.breadcrumb&&e.breadcrumb.length>0?(F(),I(`div`,{key:0,id:e.breadcrumb.join(`.`),class:`relative scroll-mt-24`},[P(t.$slots,`default`),R(`button`,{class:`text-c-3 hover:text-c-1 absolute -top-2 -left-4.5 flex h-[calc(100%+16px)] w-4.5 cursor-pointer items-center justify-center pr-1.5 opacity-0 group-hover:opacity-100 focus-visible:opacity-100`,type:`button`,onClick:n[0]||=()=>e.eventBus?.emit(`copy-url:nav-item`,{id:e.breadcrumb.join(`.`)})},[H(j(Mde),{class:`size-3`,weight:`bold`}),R(`span`,$vn,[P(t.$slots,`sr-label`,{},()=>[n[1]||=z(`Copy link to `,-1),P(t.$slots,`default`)])])])],8,Qvn)):P(t.$slots,`default`,{key:1})}});W(),Ou();var tyn=[`aria-label`],nyn=[`id`,`aria-controls`,`aria-expanded`],ryn=U7(N({__name:`CompactSection`,props:{id:{},label:{},modelValue:{type:Boolean}},emits:[`update:modelValue`,`copyAnchorUrl`],setup(e,{emit:t}){let n=t;return(t,r)=>(F(),I(`section`,{"aria-label":e.label,class:`collapsible-section`},[R(`button`,{id:e.id,"aria-controls":e.id,"aria-expanded":e.modelValue,class:O([`collapsible-section-trigger`,{"collapsible-section-trigger-open":e.modelValue}]),type:`button`,onClick:r[1]||=t=>n(`update:modelValue`,!e.modelValue)},[H(j(ll),{class:O([`size-3 transition-transform duration-100`,{"rotate-90":e.modelValue}]),weight:`bold`},null,8,[`class`]),H(j(n9),{class:`collapsible-section-header`,onCopyAnchorUrl:r[0]||=()=>n(`copyAnchorUrl`)},{default:M(()=>[P(t.$slots,`heading`,{},void 0,!0)]),_:3})],10,nyn),e.modelValue?(F(),L(J7,{key:0,class:`collapsible-section-content`,label:e.label},{default:M(()=>[P(t.$slots,`default`,{},void 0,!0)]),_:3},8,[`label`])):B(``,!0)],8,tyn))}}),[[`__scopeId`,`data-v-999a158a`]]),r9=e=>e?Object.fromEntries(Object.entries(e).filter(([e])=>e.startsWith(`x-`))):{},iyn=({plugins:e=[]})=>{let t=new Map;return e.forEach(e=>{let n=e();t.set(n.name,n)}),{getSpecificationExtensions:e=>{let n=[];for(let r of t.values())for(let t of r.extensions)t.name===e&&n.push(t);return n},getViewComponents:e=>{let n=[];for(let r of t.values()){let t=r.views?.[e];t&&n.push(...t)}return n},notifyInit:e=>{for(let n of t.values())n.hooks?.onInit?.({config:e})},notifyConfigChange:e=>{for(let n of t.values())n.hooks?.onConfigChange?.({config:e})},notifyDestroy:()=>{for(let e of t.values())e.hooks?.onDestroy?.()},getApiClientPlugins:()=>{let e=[];for(let n of t.values())n.apiClientPlugins&&e.push(...n.apiClientPlugins);return e}}};W();var ayn=Symbol(),oyn=()=>fr(ayn)||iyn({});qsn(),t$(),oN();var i9=c8(),syn=()=>{let e=s8.SELECTED_CLIENT;return{get:()=>i9.getItem(e),set:t=>{i9.setItem(e,t)}}},cyn=()=>{let e=e=>`${s8.AUTH}-${e}`;return{getAuth:t=>aN(QQ,JSON.parse(i9.getItem(e(t))??`{}`)),setAuth:(t,n)=>{i9.setItem(e(t),JSON.stringify(n))}}};g3();var lyn=({debounceDelay:e=500,maxWait:t=1e4,prefix:n=``,persistAuth:r=!1})=>{let{execute:i}=h3({delay:e,maxWait:t}),a=cyn(),o=syn(),s=()=>typeof n==`string`?n:n(),c=()=>typeof r==`function`?r():r;return{hooks:{onWorkspaceStateChanges(e){if(e.type===`meta`){let t=e.value[`x-scalar-default-client`];t!==void 0&&i(`x-scalar-default-client`,()=>o.set(t));return}c()&&e.type===`auth`&&i(`auth`,()=>a.setAuth(s(),e.value))}}}};W(),kE();var uyn={key:0,class:`text-base`},a9=N({__name:`SpecificationExtension`,props:{value:{}},setup(e){let{getSpecificationExtensions:t}=oyn();function n(e){return Object.keys(e??{}).filter(e=>e.startsWith(`x-`))}function r(e){return e.flatMap(e=>t(e)).filter(e=>e.component)}let i=U(()=>n(e.value)),a=U(()=>r(i.value));return(t,n)=>typeof e.value==`object`&&a.value.length?(F(),I(`div`,uyn,[(F(!0),I(V,null,Ar(a.value,t=>(F(),L(j(aC),null,{default:M(()=>[t.renderer?(F(),L(kr(t.renderer),ai({key:0,ref_for:!0},{[t.name]:e.value?.[t.name],component:t.component}),null,16)):(F(),L(kr(t.component),ai({key:1,ref_for:!0},{[t.name]:e.value?.[t.name]}),null,16))]),_:2},1024))),256))])):B(``,!0)}});W(),kE();var dyn=[`id`],fyn=N({__name:`InfoMarkdownSection`,props:{id:{},content:{},transformHeading:{type:Function},eventBus:{}},setup(e){let t=wr(`element`);return q7(t,()=>e.id?e.eventBus?.emit(`intersecting:nav-item`,{id:e.id}):void 0),(n,r)=>(F(),I(`div`,{id:e.id,ref_key:`element`,ref:t,class:`introduction-description-heading scroll-mt-16`},[H(j(qT),{transform:e.transformHeading,transformType:`heading`,value:e.content,withImages:``},null,8,[`transform`,`value`])],8,dyn))}});W(),Ly(),$2();var pyn={key:0,class:`introduction-description mt-6 flex flex-col`},myn=U7(N({__name:`InfoDescription`,props:{eventBus:{},headingSlugGenerator:{type:Function},description:{}},setup(e){let t=U(()=>{if(!e.description)return[];let{slug:t}=Q2();return KBe(e.description).map(n=>{let r=GBe(n)[0];return{id:r?e.headingSlugGenerator({...r,slug:t(r.value)}):void 0,content:n}})}),n=t=>{if(!Ey(t))return t;let{slug:n}=Q2(),r=Ty(t);return t.data={hProperties:{id:e.headingSlugGenerator({depth:t.depth,value:r,slug:n(r)})}},t};return(r,i)=>e.description?(F(),I(`div`,pyn,[(F(!0),I(V,null,Ar(t.value,t=>(F(),L(fyn,{id:t.id,key:t.id,content:t.content,eventBus:e.eventBus,transformHeading:n},null,8,[`id`,`content`,`eventBus`]))),128))])):B(``,!0)}}),[[`__scopeId`,`data-v-0370764f`]]);W();var o9=U7(N({__name:`LinkList`,setup(e){let t=A(),n=A(!1),r=()=>{if(!t.value)return;let{scrollWidth:e,clientWidth:r}=t.value;n.value=e>r},i=null;return Hi(()=>{r(),window.addEventListener(`resize`,r),t.value&&(i=new MutationObserver(()=>{r()}),i.observe(t.value,{childList:!0,subtree:!0}))}),Gi(()=>{window.removeEventListener(`resize`,r),i&&=(i.disconnect(),null)}),(e,r)=>(F(),I(`div`,{ref_key:`containerRef`,ref:t,class:O([{"icons-only":n.value},`custom-scroll mb-3 flex h-auto min-h-8 max-w-full items-center gap-2 overflow-x-auto text-base whitespace-nowrap xl:mb-1.5`])},[P(e.$slots,`default`,{},void 0,!0)],2))}}),[[`__scopeId`,`data-v-b59b0acf`]]);W(),Ou();var hyn={key:0,class:`group flex items-center last:border-r-0 xl:border-r xl:first:ml-auto`},gyn=[`href`],_yn={key:0,class:`ml-1 empty:hidden`},vyn={key:1,class:`ml-1 empty:hidden`},s9=N({__name:`ExternalDocs`,props:{value:{}},setup(e){return(t,n)=>e.value?(F(),I(`div`,hyn,[R(`a`,{href:e.value.url,class:`text-c-1 hover:bg-b-2 mr-2 flex min-h-7 min-w-7 items-center rounded-lg border px-2 py-1 no-underline group-last:mr-0 xl:border-none`,target:`_blank`,rel:`noopener noreferrer`},[H(j(Gc),{weight:`bold`,class:`size-3 text-current`}),e.value.description?(F(),I(`span`,_yn,k(e.value.description),1)):(F(),I(`span`,vyn,k(e.value.url),1))],8,gyn)])):B(``,!0)}});W(),kE(),Ou();var yyn={key:0,class:`group flex items-center last:border-r-0 xl:border-r xl:first:ml-auto`},byn=[`href`],xyn={class:`ml-1 empty:hidden`},Syn=N({__name:`Contact`,props:{value:{}},setup(e){let t=of({base:`text-c-1 mr-2 flex min-h-7 min-w-7 items-center rounded-lg border px-2 py-1 group-last:mr-0 xl:border-none`,variants:{link:{true:`no-underline hover:bg-b-2`}}});return(n,r)=>e.value?(F(),I(`div`,yyn,[e.value?.email?(F(),I(`a`,{key:0,class:O(j(t)({link:!0})),href:`mailto:${e.value?.email}`},[H(j(ru),{weight:`bold`,class:`size-3 text-current`}),R(`span`,xyn,k(e.value.name),1)],10,byn)):e.value?.name?(F(),I(`span`,{key:1,class:O(j(t)({link:!1}))},k(e.value.name),3)):B(``,!0)])):B(``,!0)}});W(),Ou();var Cyn={class:`group flex h-fit items-center last:border-r-0 xl:border-r xl:first:ml-auto`},wyn=[`href`],Tyn={class:`ml-1 empty:hidden`},Eyn={class:`ml-1 empty:hidden`},Dyn=N({__name:`License`,props:{value:{}},setup(e){return(t,n)=>(F(),I(`div`,Cyn,[e.value?.url?(F(),I(`a`,{key:0,class:`text-c-1 hover:bg-b-2 mr-2 flex min-h-7 min-w-7 items-center rounded-lg border px-2 py-1 no-underline group-last:mr-0 xl:border-none`,href:e.value.url,target:`_blank`,rel:`noopener noreferrer`},[H(j(hu),{weight:`bold`,class:`size-3 text-current`}),R(`span`,Tyn,k(e.value?.name||e.value.identifier||e.value.url),1)],8,wyn)):(F(),I(V,{key:1},[H(j(hu),{weight:`bold`,class:`size-3 text-current`}),R(`span`,Eyn,k(e.value?.name),1)],64))]))}});W(),Ou();var Oyn={key:0,class:`group flex items-center last:border-r-0 xl:border-r xl:first:ml-auto`},kyn=[`href`],Ayn=N({__name:`TermsOfService`,props:{value:{}},setup(e){return(t,n)=>e.value?(F(),I(`div`,Oyn,[R(`a`,{class:`text-c-1 hover:bg-b-2 mr-2 flex min-h-7 min-w-7 items-center rounded-lg border px-2 py-1 no-underline group-last:mr-0 xl:border-none`,href:e.value,target:`_blank`,rel:`noopener noreferrer`},[H(j(ype),{weight:`bold`,class:`size-3 text-current`}),n[0]||=R(`span`,{class:`ml-1 empty:hidden`},`Terms of Service`,-1)],8,kyn)])):B(``,!0)}});W();var jyn=N({__name:`InfoLinks`,props:{info:{},externalDocs:{}},setup(e){return(t,n)=>(F(),L(j(o9),null,{default:M(()=>[H(j(s9),{value:e.externalDocs},null,8,[`value`]),e.info.contact?(F(),L(j(Syn),{key:0,value:e.info.contact},null,8,[`value`])):B(``,!0),e.info.license?(F(),L(j(Dyn),{key:1,value:e.info.license},null,8,[`value`])):B(``,!0),e.info.termsOfService?(F(),L(j(Ayn),{key:2,value:e.info.termsOfService},null,8,[`value`])):B(``,!0)]),_:1}))}});W();var Myn=N({__name:`InfoVersion`,props:{version:{}},setup(e){let t=U(()=>{if(e.version==null)return e.version;let t=String(e.version);return/^\d/.test(t)?`v${t}`:t});return(e,n)=>t.value?(F(),L(j(K7),{key:0},{default:M(()=>[z(k(t.value),1)]),_:1})):B(``,!0)}});W();var Nyn=N({__name:`SpecificationVersion`,props:{documentType:{default:`openapi`},version:{}},setup(e){let t=U(()=>e.documentType===`asyncapi`?`AsyncAPI`:`OpenAPI`);return(n,r)=>e.version?(F(),L(j(K7),{key:0},{default:M(()=>[z(k(t.value)+` `+k(e.version),1)]),_:1})):B(``,!0)}});W();var Pyn={class:`flex gap-1.5`},Fyn={class:`sticky-cards`},Iyn=U7(N({__name:`IntroductionLayout`,props:{id:{},documentType:{},specificationVersion:{},info:{},externalDocs:{},documentExtensions:{},infoExtensions:{},headingSlugGenerator:{type:Function},eventBus:{}},setup(e){return(t,n)=>(F(),L(j(Z7),null,{default:M(()=>[H(j(J7),{id:e.id,"aria-label":`Introduction`,class:`introduction-section z-1 gap-12`,onIntersecting:n[0]||=()=>e.id&&e.eventBus?.emit(`intersecting:nav-item`,{id:e.id})},{default:M(()=>[H(j(Q7),{loading:!e.info},{default:M(()=>[R(`div`,Pyn,[e.info?(F(),L(Myn,{key:0,version:e.info?.version},null,8,[`version`])):B(``,!0),H(Nyn,{documentType:e.documentType,version:e.specificationVersion},null,8,[`documentType`,`version`])]),H(j($7),{loading:!e.info?.title,tight:``},{links:M(()=>[e.info?(F(),L(jyn,{key:0,externalDocs:e.externalDocs,info:e.info},null,8,[`externalDocs`,`info`])):B(``,!0)]),default:M(()=>[H(j(e9),{level:1},{default:M(()=>[z(k(e.info?.title),1)]),_:1})]),_:1},8,[`loading`]),H(j(X7),null,{default:M(()=>[H(j(Y7),null,{default:M(()=>[P(t.$slots,`download-link`,{},void 0,!0),H(myn,{description:e.info?.description,eventBus:e.eventBus,headingSlugGenerator:e.headingSlugGenerator},null,8,[`description`,`eventBus`,`headingSlugGenerator`])]),_:3}),t.$slots.aside?(F(),L(j(Y7),{key:0},{default:M(()=>[R(`div`,Fyn,[P(t.$slots,`aside`,{},void 0,!0)])]),_:3})):B(``,!0)]),_:3}),H(j(a9),{value:e.documentExtensions},null,8,[`value`]),H(j(a9),{value:e.infoExtensions},null,8,[`value`])]),_:3},8,[`loading`]),P(t.$slots,`after`,{},void 0,!0)]),_:3},8,[`id`])]),_:3}))}}),[[`__scopeId`,`data-v-6c24d687`]]);W();var Lyn=N({__name:`InfoBlock`,props:{id:{},specificationVersion:{},info:{},externalDocs:{},documentExtensions:{},infoExtensions:{},eventBus:{},headingSlugGenerator:{type:Function},layout:{},documentDownloadType:{default:`both`},documentUrl:{},documentType:{}},setup(e){let t=U(()=>e.layout===`classic`?`after`:`aside`);return(n,r)=>(F(),L(Iyn,{id:e.id,documentExtensions:e.documentExtensions,documentType:e.documentType,eventBus:e.eventBus,externalDocs:e.externalDocs,headingSlugGenerator:e.headingSlugGenerator,info:e.info,infoExtensions:e.infoExtensions,specificationVersion:e.specificationVersion},{[t.value]:M(()=>[H(kvn,{row:e.layout===`classic`},{default:M(()=>[P(n.$slots,`selectors`)]),_:3},8,[`row`])]),"download-link":M(()=>[H(Ovn,{documentDownloadType:e.documentDownloadType,documentType:e.documentType,documentUrl:e.documentUrl,eventBus:e.eventBus},null,8,[`documentDownloadType`,`documentType`,`documentUrl`,`eventBus`])]),_:2},1032,[`id`,`documentExtensions`,`documentType`,`eventBus`,`externalDocs`,`headingSlugGenerator`,`info`,`infoExtensions`,`specificationVersion`]))}});W();var Ryn={},zyn={class:`introduction-card-item`};function Byn(e,t){return F(),I(`div`,zyn,[P(e.$slots,`default`,{},void 0,!0)])}var c9=U7(Ryn,[[`render`,Byn],[`__scopeId`,`data-v-dfab866f`]]);W(),kE(),Ou();var Vyn={class:`overflow-x-auto`},Hyn={key:1,class:`text-c-1 flex h-auto w-full items-center gap-0.75 !rounded-b-xl px-3 py-1.5 text-base leading-[20px] whitespace-nowrap`},Uyn={class:`overflow-x-auto`},Wyn=N({__name:`Selector`,props:{selectedServer:{},servers:{},target:{}},emits:[`update:modelValue`],setup(e,{expose:t,emit:n}){let r=n,i=U(()=>e.servers.map(e=>({id:e.url,label:e.url}))),a=U(()=>e.selectedServer?.url?.replace(/\/$/,``)||``),o=U(()=>i.value.find(t=>t.id===e.selectedServer?.url));return t({servers:e.servers,serverUrlWithoutTrailingSlash:a,serverOptions:i,selectedServer:e.selectedServer}),(t,n)=>i.value.length>1?(F(),L(j(pS),{key:0,ref:`elem`,class:`group`,modelValue:o.value,options:i.value,placement:`bottom-start`,resize:``,target:e.target,"onUpdate:modelValue":n[0]||=e=>r(`update:modelValue`,e.id)},{default:M(()=>[H(j(gf),{class:`bg-b-1 text-c-1 h-auto w-full justify-start gap-1.5 overflow-x-auto rounded-t-none !rounded-b-xl px-3 py-1.5 text-base/5.25 font-normal whitespace-nowrap -outline-offset-1`,variant:`ghost`},{default:M(()=>[n[1]||=R(`span`,{class:`sr-only`},`Server:`,-1),R(`span`,Vyn,k(a.value||`Select a server`),1),H(j(tl),{class:`text-c-2 ui-open:rotate-180 mt-0.25 size-3 transition-transform duration-100`,weight:`bold`})]),_:1})]),_:1},8,[`modelValue`,`options`,`target`])):(F(),I(`div`,Hyn,[n[2]||=R(`span`,{class:`sr-only`},`Server:`,-1),R(`span`,Uyn,k(a.value),1)]))}});W(),i_n(),kE();var Gyn=[`id`],Kyn=N({__name:`ServerSelector`,props:{eventBus:{},selectedServer:{},servers:{}},setup(e){let t=Sr(),n=t=>{e.eventBus.emit(`server:update:selected`,{url:e.selectedServer?.url===t?``:t,meta:{type:`document`}})},r=(t,n)=>{let r=e.servers.findIndex(t=>t.url===e.selectedServer?.url);r!==-1&&e.eventBus.emit(`server:update:variables`,{index:r,key:t,value:n,meta:{type:`document`}})};return(i,a)=>(F(),I(V,null,[a[0]||=R(`label`,{class:`bg-b-2 flex h-8 items-center rounded-t-xl border-x border-t px-3 py-2.5 font-medium`},` Server `,-1),R(`div`,{id:j(t),class:O([`border`,{"rounded-b-xl":!e.selectedServer?.description&&!e.selectedServer?.variables}])},[e.servers.length?(F(),L(Wyn,{key:0,selectedServer:e.selectedServer,servers:e.servers,target:j(t),"onUpdate:modelValue":n},null,8,[`selectedServer`,`servers`,`target`])):B(``,!0)],10,Gyn),H(j(k2),{layout:`reference`,variables:e.selectedServer?.variables,"onUpdate:variable":r},null,8,[`variables`]),e.selectedServer?.description?(F(),L(j(qT),{key:0,class:`text-c-3 rounded-b-xl border-x border-b px-3 py-1.5`,value:e.selectedServer.description},null,8,[`value`])):B(``,!0)],64))}});W(),yfn(),QI(),OI();var qyn=N({__name:`Auth`,props:{options:{},authStore:{},document:{},eventBus:{},securitySchemes:{},selectedServer:{},environment:{}},setup(e){let t=U(()=>MI(EI(e.document)?e.document.security:void 0)),n=U(()=>e.authStore.getAuthSelectedSchemas({type:`document`,documentName:EI(e.document)?e.document[`x-scalar-navigation`]?.name??``:``})),r=U(()=>RI(n.value,void 0,t.value,e.securitySchemes,e.options.authentication?.preferredSecurityScheme));return(n,i)=>Object.keys(e.securitySchemes).length?(F(),L(j(n$),{key:0,createAnySecurityScheme:e.options.authentication?.createAnySecurityScheme??!1,environment:e.environment,eventBus:e.eventBus,isStatic:``,layout:`reference`,meta:{type:`document`},persistAuth:e.options.persistAuth,proxyUrl:e.options.proxyUrl??``,securityRequirements:t.value,securitySchemes:e.securitySchemes,selectedSecurity:r.value,server:e.selectedServer,title:`Authentication`},null,8,[`createAnySecurityScheme`,`environment`,`eventBus`,`persistAuth`,`proxyUrl`,`securityRequirements`,`securitySchemes`,`selectedSecurity`,`server`])):B(``,!0)}}),l9=e=>{if(typeof e!=`object`||!e||Array.isArray(e)||`oneOf`in e||`anyOf`in e||`allOf`in e||`not`in e)return!1;let t=`type`in e;if(t&&Array.isArray(e.type))return e.type.includes(`object`);let n=t&&e.type===`object`;if(n)return!0;if(t&&!n)return!1;let r=`properties`in e,i=`additionalProperties`in e,a=`patternProperties`in e;return r||i||a},Jyn=e=>{if(!l9(e))return!1;let t=Object.keys(e.properties??{}).length===0,n=e.additionalProperties===void 0||e.additionalProperties===!1,r=Object.keys(e.patternProperties??{}).length===0;return t&&n&&r};W(),kE(),dY();var Yyn={key:0,class:`schema-type`},Xyn=[`title`],u9=U7(N({__name:`SchemaHeading`,props:{value:{},name:{}},setup(e){let t=U(()=>`type`in e.value?e.value.type:e.value.enum?`enum`:sY(e.value)&&e.value.items?`array`:l9(e.value)&&(e.value.properties||e.value.additionalProperties)?`object`:`unknown`);return(n,r)=>typeof e.value==`object`?(F(),I(`span`,Yyn,[R(`span`,{class:`schema-type-icon`,title:`type`in e.value&&typeof e.value.type==`string`?e.value.type:`type`in e.value&&Array.isArray(e.value.type)?e.value.type.join(` | `):`unknown type`},[j(l9)(e.value)?(F(),I(V,{key:0},[z(` {} `)],64)):B(``,!0),j(sY)(e.value)?(F(),I(V,{key:1},[z(` [] `)],64)):B(``,!0),e.value.enum?(F(),I(V,{key:2},[z(` enum `)],64)):B(``,!0)],8,Xyn),e.name?(F(),L(j(wE),{key:0,text:e.name,preset:`property`},null,8,[`text`])):(F(),I(V,{key:1},[z(k(t.value),1)],64))])):B(``,!0)}}),[[`__scopeId`,`data-v-70cb5c13`]]);UP();var Zyn=(e,t)=>e.reduce((e,n)=>{let r=t?.[n];return r&&(e[n]=r),e},{}),Qyn=(e,t,{hideReadOnly:n=!1,hideWriteOnly:r=!1,orderSchemaPropertiesBy:i=`alpha`,orderRequiredPropertiesFirst:a=!0}={})=>{if(!l9(e)||!e.properties)return[];let o=Object.keys(e.properties),s=new Set(e.required||[]);return o.sort((n,r)=>{let o=n===t?.propertyName,c=r===t?.propertyName,l=s.has(n),u=s.has(r);if(o&&!c)return-1;if(!o&&c)return 1;let d=e.properties?.[n],f=e.properties?.[r],p=d&&typeof d==`object`&&`x-order`in d?d[`x-order`]:void 0,m=f&&typeof f==`object`&&`x-order`in f?f[`x-order`]:void 0;if(p!==void 0&&m!==void 0)return Number(p)-Number(m);if(p!==void 0&&m===void 0)return-1;if(p===void 0&&m!==void 0)return 1;if(a){if(l&&!u)return-1;if(!l&&u)return 1}return i===`alpha`?n.localeCompare(r):0}).filter(t=>{let i=e.properties&&HP.schema(e.properties[t]);return!(n&&i?.readOnly===!0||r&&i?.writeOnly===!0)})},$yn=[`oneOf`,`anyOf`,`allOf`,`not`];zE(),dY();var ebn=[`allOf`,`oneOf`,`anyOf`],tbn=e=>`type`in e&&e.type?Array.isArray(e.type)?e.type.includes(`object`):e.type===`object`:`properties`in e,nbn=e=>`$ref`in e||`discriminator`in e||ebn.some(t=>t in e),rbn=e=>{if(!sY(e)||typeof e.items!=`object`)return!1;if(`$ref`in e.items)return!0;let t=RE(e.items);return t?tbn(t)||nbn(t)||sY(t):!1},ibn=e=>{if(!e||!sY(e)||typeof e.items!=`object`)return!1;if(`$ref`in e.items)return!0;let t=RE(e.items);return t?nbn(t)||tbn(t)?!0:rbn(t):!1};dY();var abn=(e,t)=>{if(!e||!sY(e))return!1;let n=e.items;return!n||typeof n!=`object`||!(t in n)?!1:!ibn(e)};ME(),UP(),dY();var obn=e=>e?$yn.map(t=>abn(e,t)&&sY(e)&&e.items?{composition:t,value:HP.schema(e.items)}:e[t]&&!(sY(e)&&e.items&&typeof e.items==`object`&&t in e.items)?{composition:t,value:HP.schema(e)}:null).filter(jE):[];UP(),dY();var sbn=e=>{if(!e)return[];if(e.enum)return e.enum;if(sY(e)&&typeof e.items==`object`){let t=HP.schema(e.items);if(t&&`enum`in t&&t.enum)return t.enum}return[]};dY();var cbn={integer:{_default:`Integer numbers.`,int32:`Signed 32-bit integers (commonly used integer type).`,int64:`Signed 64-bit integers (long type).`},string:{date:`full-date notation as defined by RFC 3339, section 5.6, for example, 2017-07-21`,"date-time":`the date-time notation as defined by RFC 3339, section 5.6, for example, 2017-07-21T17:32:28Z`,password:`a hint to UIs to mask the input`,base64:`base64-encoded characters, for example, U3dhZ2dlciByb2Nrcw==`,byte:`base64-encoded characters, for example, U3dhZ2dlciByb2Nrcw==`,binary:`binary data, used to describe files`}},lbn=e=>{if(!QFt(e))return null;let t=Array.isArray(e.type)?e.type[0]:e.type;if(!t)return null;let n=cbn[t];return n?n[`format`in e&&e.format||`contentEncoding`in e&&e.contentEncoding||`_default`]??null:null};UP();function ubn(e){if(!e||typeof e!=`object`)return e;let t=$yn.find(t=>t in e&&t!==`not`);if(!t)return{...e};let n=e[t];if(!Array.isArray(n))return{...e};let{[t]:r,nullable:i,...a}=e,o=Object.keys(a).length>0,{filteredSchemas:s,hasNullSchema:c}=n.reduce((e,t)=>{let n=HP.schema(t);return`type`in n&&n.type===`null`?e.hasNullSchema=!0:e.filteredSchemas.push(n),e},{filteredSchemas:[],hasNullSchema:!1}),l=c||i===!0;if(s.length===1){let e={...a,...s[0]};return l&&(e.nullable=!0),e}if((t===`oneOf`||t===`anyOf`)&&(o||s.some(e=>e.allOf))){let n=s.map(e=>{let t=HP.schema(e);if(t.allOf?.length===1){let{allOf:e,...n}=t;return{...a,...n,...HP.schema(e[0])}}return{...a,...t}}),r={[t]:n};return typeof e.description==`string`&&(r.description=e.description),l&&(r.nullable=!0),r}if(s.length!==n.length){let n={...e,[t]:s};return l&&(n.nullable=!0),n}return{...e}}var dbn=(e,t)=>!e||e.allOf?null:t&&e.description&&(e.oneOf||e.anyOf)?t===e.description?t:`${t}\n\n${e.description}`:t||e.description||null,fbn=(e,t,n=!1)=>t||n?!0:e?e.deprecated===!0||e.const!==void 0||e.enum?.length===1||`type`in e&&e.type!==void 0||`nullable`in e&&e.nullable===!0||e.writeOnly===!0||e.readOnly===!0:!1,d9=Symbol();UP(),dY();var pbn=e=>e?`array ${e.includes(` | `)?`(${e})`:e}[]`:`array`,mbn=(e,t=!1)=>{if(!e.items)return`array`;let n=pbn(f9(HP.schema(e.items)));return t?n:e.nullable?`${n} | null`:n},f9=e=>{if(!e)return``;let t=HP.schema(e);if(t.const!==void 0)return`const`;if(`type`in t&&Array.isArray(t.type)){if(t.type.includes(`array`)&&t.items){let e=mbn(t,!0),n=t.type.filter(e=>e!==`array`);return n.length>0?`${e} | ${n.join(` | `)}`:e}return t.type.join(` | `)}return sY(t)?mbn(t,!1):`type`in t&&t.type&&t.contentEncoding?`${t.type} • ${t.contentEncoding}`:`type`in t?t.type:``};PI(),zE(),UP(),dY();var p9=(e,t)=>{if(!e?.allOf?.length||!Array.isArray(e.allOf))return t||{};let n={},{allOf:r,...i}=e;for(let t of e.allOf){if(!t||typeof t!=`object`)continue;let e=HP.schema(t);if(e.allOf){m9(n,p9(e));continue}m9(n,e)}return Object.keys(i).length>0&&m9(n,i,!0),t&&typeof t==`object`&&(t.allOf?m9(n,p9(t),!0):m9(n,t,!0)),n},m9=(e,t,n=!1)=>{let r=NI(t);if(r.length!==0)for(let i of r){let r=RE(t[i]);if(r!==void 0)if(i===`required`)Array.isArray(r)&&r.length>0&&(e.required?.length?e.required=[...new Set([...e.required,...r])]:e.required=r.slice());else if(i===`properties`)r&&typeof r==`object`&&(e.properties||={},h9(e.properties,r));else if(i===`items`){let n=HP.schema(r);if(n)if(sY(t))if(e.items||={},n.allOf){let t=p9(n);Object.assign(e.items,t)}else hbn(RE(e.items),n);else if(n.allOf){let t=p9(n);`properties`in t&&(`properties`in e||(e.properties={}),`properties`in e&&h9(e.properties,t.properties))}else `items`in e||(e.items=n)}else if(i===`enum`)Array.isArray(r)&&r.length>0&&(e.enum=[...new Set([...e.enum||[],...r])]);else if(i===`oneOf`||i===`anyOf`){if(Array.isArray(r)){`properties`in e||(e.properties={});for(let t of r){let n=HP.schema(t);n&&`properties`in n&&`properties`in e&&h9(e.properties,n.properties)}}}else if(i===`allOf`)continue;else (n||e[i]===void 0)&&(e[i]=r)}},h9=(e,t)=>{let n=Object.keys(t??{});if(!(!t||!e||n.length===0))for(let r of n){let n=HP.schema(t[r]);if(!n){delete e[r];continue}if(typeof n!=`object`){e[r]=n;continue}if(!e[r]){n.allOf?e[r]=p9(n):sY(n)&&HP.schema(n.items)?.allOf?e[r]={...n,items:p9(HP.schema(n.items))}:t[r]&&(e[r]=t[r]);continue}let i=HP.schema(e[r]);if(n.allOf)e[r]=p9({allOf:[i,...n.allOf]});else if(sY(n)&&sY(i)&&n.items){let t=HP.schema(i.items);e[r]={...i,type:`array`,items:t?gbn(t,HP.schema(n.items)):HP.schema(n.items)}}else if(`properties`in i&&`properties`in n){let t={...i,...n};t.properties={...i.properties},h9(t.properties,n.properties),e[r]=t}else e[r]={...n,...i}}},hbn=(e,t)=>{if(t.allOf||e.allOf){let n=[];if(e.allOf)for(let t of e.allOf)n.push(HP.schema(t));else n.push(e);if(t.allOf)for(let e of t.allOf)n.push(HP.schema(e));else n.push(t);let r=p9({allOf:n});Object.assign(e,r);return}Object.assign(e,t),`properties`in e&&`properties`in t&&h9(e.properties,t.properties)},gbn=(e,t)=>{if(e.allOf||t.allOf){let n=[];if(e.allOf)for(let t of e.allOf)n.push(HP.schema(t));else n.push(e);if(t.allOf)for(let e of t.allOf)n.push(HP.schema(e));else n.push(t);return p9({allOf:n})}let n={...e,...t};return`properties`in e&&`properties`in t&&(n.properties={...e.properties},h9(n.properties,t.properties)),n};Au();var _bn=e=>{if(!e)return null;let t=e.match(ku.REF_NAME);return t?t[1]:null};UP();var g9=e=>{if(!e)return null;let t=HP.schema(e),n=`$ref`in e?_bn(e.$ref)??null:null;return t.title?{schemaKey:n,label:t.title}:t.name?{schemaKey:n,label:t.name}:`$ref`in e&&n?{schemaKey:n,label:n}:null};W(),kE(),ME(),Ou(),UP();var vbn={class:`property-rule`},ybn={class:`composition-selector bg-b-1.5 hover:bg-b-2 flex w-full cursor-pointer items-center gap-1 rounded-t-lg border px-2.5 py-2.5 pr-3 text-left`,type:`button`},bbn={class:`text-c-2`},xbn={key:0,class:`text-red`},Sbn={class:`composition-panel`},Cbn=N({__name:`SchemaComposition`,props:{composition:{},discriminator:{},name:{},schema:{},level:{},compact:{type:Boolean,default:!1},hideHeading:{type:Boolean,default:!1},hideModelNames:{type:Boolean},breadcrumb:{},eventBus:{},options:{},schemaContext:{},compositionPath:{}},setup(e){let t=e,n=U(()=>[t.schema[t.composition]].flat().map(e=>({value:HP.schema(e),original:e})).filter(e=>jE(e.value))),r=U(()=>n.value.map((e,t)=>{let n=HP.schema(e.original),r=(g9(n)?.label??f9(n))||`Schema`;return{id:String(t),label:r}})),i=U(()=>t.compositionPath?.length?[...t.compositionPath,t.composition].join(`.`):``),a=fr(d9,void 0),o=U(()=>{if(t.schemaContext!==`requestBody`||!a?.value||!i.value)return 0;let e=a.value[i.value];return typeof e!=`number`||Number.isNaN(e)?0:Math.max(0,Math.min(e,r.value.length-1))}),s=A();mr([r,o],([e,t])=>{(!s.value||!e.some(e=>e.id===s.value?.id))&&(s.value=e[t]??e[0])},{immediate:!0});let c=e=>e.replace(/([A-Z])/g,` $1`).replace(/^./,e=>e.toUpperCase()).toLowerCase().replace(/^(\w)/,e=>e.toUpperCase()),l=U(()=>n.value[Number(s.value?.id??`0`)]?.value),u=A(!1);return a&&t.schemaContext===`requestBody`&&i.value&&mr(s,e=>{let t=e?Number(e.id):0;Number.isNaN(t)||(a.value={...a.value,[i.value]:t})},{immediate:!0}),(n,i)=>(F(),I(`div`,vbn,[t.composition===`allOf`?(F(),L(x9,{key:0,breadcrumb:e.breadcrumb,compact:e.compact,compositionPath:e.compositionPath,discriminator:e.discriminator,eventBus:e.eventBus,hideHeading:e.hideHeading,hideModelNames:e.hideModelNames,level:e.level+1,name:e.name,noncollapsible:!0,options:e.options,schema:j(p9)(e.schema),schemaContext:e.schemaContext},null,8,[`breadcrumb`,`compact`,`compositionPath`,`discriminator`,`eventBus`,`hideHeading`,`hideModelNames`,`level`,`name`,`options`,`schema`,`schemaContext`])):(F(),I(V,{key:1},[H(j(pS),{modelValue:s.value,"onUpdate:modelValue":i[0]||=e=>s.value=e,options:r.value,resize:``},{default:M(()=>[R(`button`,ybn,[R(`span`,bbn,k(c(t.composition)),1),R(`span`,{class:O([`composition-selector-label text-c-1`,{"line-through":l.value?.deprecated}])},k(s.value?.label||`Schema`),3),l.value?.deprecated?(F(),I(`div`,xbn,` deprecated `)):B(``,!0),H(j(tl))])]),_:1},8,[`modelValue`,`options`]),R(`div`,Sbn,[!u.value&&e.level>2?(F(),I(`button`,{key:0,class:`bg-b-1 hover:bg-b-2 text-c-1 flex w-full items-center justify-center gap-2 rounded-b-lg border border-t-0 px-2 py-2 text-sm font-medium transition-colors`,type:`button`,onClick:i[1]||=e=>u.value=!0},[i[2]||=z(` Show Schema Details `,-1),H(j(tl),{class:`h-3 w-3`})])):(F(),L(x9,{key:1,breadcrumb:e.breadcrumb,compact:e.compact,compositionPath:e.compositionPath,discriminator:e.discriminator,eventBus:e.eventBus,hideHeading:e.hideHeading,hideModelNames:e.hideModelNames,level:e.level+1,name:e.name,noncollapsible:!0,options:e.options,schema:l.value,schemaContext:e.schemaContext},null,8,[`breadcrumb`,`compact`,`compositionPath`,`discriminator`,`eventBus`,`hideHeading`,`hideModelNames`,`level`,`name`,`options`,`schema`,`schemaContext`]))])],64))]))}});W(),kE();var wbn={class:`property-enum-value`},Tbn={class:`property-enum-value-content`},Ebn={class:`property-enum-value-label`},Dbn={key:0,class:`property-enum-value-description`},Obn=U7(N({__name:`SchemaEnumPropertyItem`,props:{label:{},description:{}},setup(e){return(t,n)=>(F(),I(`li`,wbn,[R(`div`,Tbn,[R(`span`,Ebn,[H(j(wE),{text:e.label,preset:`property`},null,8,[`text`])]),e.description?(F(),I(`span`,Dbn,[H(j(qT),{value:e.description},null,8,[`value`])])):B(``,!0)])]))}}),[[`__scopeId`,`data-v-f4b54bdd`]]);W(),kE(),Ou(),UP(),dY();var kbn={key:0,class:`property-enum`},Abn={key:0,class:`property-enum-property-names`},jbn={key:1,class:`property-enum-property-names`},Mbn={class:`property-enum-values`},Nbn={key:1},Pbn=9,Fbn=5,Ibn=` `,Lbn=U7(N({__name:`SchemaEnums`,props:{value:{},propertyNames:{type:Boolean}},setup(e){let t=U(()=>e.value&&(e.value.enum||sY(e.value)&&HP.schema(e.value.items)?.enum)||[]),n=U(()=>t.value.length>Pbn),r=U(()=>n.value?Fbn:t.value.length),i=U(()=>t.value.slice(0,r.value)),a=U(()=>t.value.slice(r.value)),o=(t,n)=>{let r=e.value?.[`x-enumDescriptions`]??e.value?.[`x-enum-descriptions`];if(r){if(Array.isArray(r))return r[n];if(typeof r==`object`&&r)return r[String(t)]}},s=(t,n)=>{let r=e.value?.[`x-enum-varnames`]??e.value?.[`x-enumNames`],i=Array.isArray(r)?r[n]:void 0;return i?`${t}${Ibn}=${Ibn}${i}`:String(t)},c=A(!1),l=()=>{c.value=!c.value};return(u,d)=>t.value.length>0?(F(),I(`div`,kbn,[e.propertyNames?(F(),I(`div`,Abn,` property names `)):(F(),I(`div`,jbn,` values `)),R(`ul`,Mbn,[(F(!0),I(V,null,Ar(i.value,(e,t)=>(F(),L(Obn,{key:String(e),description:o(e,t),label:s(e,t)},null,8,[`description`,`label`]))),128)),n.value&&c.value?(F(!0),I(V,{key:0},Ar(a.value,(e,t)=>(F(),L(Obn,{key:String(e),description:o(e,r.value+t),label:s(e,r.value+t)},null,8,[`description`,`label`]))),128)):B(``,!0),n.value?(F(),I(`li`,Nbn,[H(j(gf),{class:`enum-toggle-button my-2 flex h-fit gap-1 rounded-full border py-1.5 pr-2.5 pl-2 leading-none`,variant:`ghost`,onClick:l},{default:M(()=>[H(j(xu),{class:O({"rotate-45":c.value}),weight:`bold`},null,8,[`class`]),z(` `+k(c.value?`Hide values`:`Show all values`),1)]),_:1})])):B(``,!0)])])):B(``,!0)}}),[[`__scopeId`,`data-v-55c01b89`]]);W();var Rbn={},zbn={class:`text-c-3 hover:text-c-1 underline`,type:`button`};function Bbn(e,t){return F(),I(`button`,zbn,[P(e.$slots,`default`)])}var _9=U7(Rbn,[[`render`,Bbn]]);W();var Vbn=N({__name:`RenderString`,props:{value:{}},setup(e){let t=U(()=>e.value===``?`''`:e.value===null?`null`:e.value===void 0?`undefined`:e.value);return(e,n)=>k(t.value)}});function Hbn(e){return Array.isArray(e)?`[${e.map(e=>typeof e==`string`?`"${e.toString().trim()}"`:typeof e==`object`?JSON.stringify(e):e===void 0?`undefined`:e===null?`null`:e).join(`, `)}]`:e===null?`null`:typeof e==`object`?JSON.stringify(e):e===void 0?`undefined`:typeof e==`string`?e.trim():e.toString().trim()}W(),kE(),j2();var Ubn={key:0,class:`property-default`},Wbn={class:`property-default-value-list`},Gbn=U7(N({__name:`SchemaPropertyDefault`,props:{value:{}},setup(e){let{copyToClipboard:t}=A2();return(n,r)=>e.value===void 0?B(``,!0):(F(),I(`div`,Ubn,[r[1]||=R(`button`,{class:`property-default-label`,type:`button`},[R(`span`,null,`Default`)],-1),R(`div`,Wbn,[R(`button`,{class:`property-default-value group`,type:`button`,onClick:r[0]||=n=>j(t)(j(Hbn)(e.value))},[R(`span`,null,k(j(Hbn)(e.value)),1),H(j(jT),{class:`group-hover:text-c-1 text-c-3 ml-auto min-h-3 min-w-3`,icon:`Clipboard`,size:`xs`})])])]))}}),[[`__scopeId`,`data-v-4da5c70a`]]);W();var Kbn={key:0,class:`property-detail-prefix`},qbn={key:1,class:`property-detail-value`},Jbn={key:2,class:`property-detail-value`},v9=U7(N({__name:`SchemaPropertyDetail`,props:{truncate:{type:Boolean},code:{type:Boolean}},setup(e){return(t,n)=>(F(),I(`span`,{class:O([`property-detail`,{"property-detail-truncate":e.truncate}])},[t.$slots.prefix?(F(),I(`div`,Kbn,[P(t.$slots,`prefix`,{},void 0,!0),n[0]||=z(`\xA0 `,-1)])):B(``,!0),e.code?(F(),I(`code`,qbn,[P(t.$slots,`default`,{},void 0,!0)])):(F(),I(`span`,Jbn,[P(t.$slots,`default`,{},void 0,!0)]))],2))}}),[[`__scopeId`,`data-v-1295f965`]]);function y9(e){return Array.isArray(e)?`[${e.map(e=>typeof e==`string`?`"${e.toString().trim()}"`:typeof e==`object`?JSON.stringify(e):e===void 0?`undefined`:e===null?`null`:e).join(`, `)}]`:e===null?`null`:typeof e==`object`?`value`in e?e.value:`externalValue`in e?e.externalValue:JSON.stringify(e):e===void 0?`undefined`:typeof e==`string`?e.trim():e.toString().trim()}W(),kE(),ME(),j2();var Ybn={key:0,class:`property-example`},Xbn={class:`property-example-value-list`},Zbn={key:1,class:`property-example`},Qbn={class:`property-example-value-list`},$bn=[`onClick`],exn=U7(N({__name:`SchemaPropertyExamples`,props:{examples:{},example:{}},setup(e){let{copyToClipboard:t}=A2(),n=U(()=>jE(e.example)),r=U(()=>e.examples&&typeof e.examples==`object`?e.examples:{}),i=U(()=>Object.keys(r.value).length>0),a=U(()=>Object.keys(r.value).length===1?`Example`:`Examples`);return(o,s)=>(F(),I(V,null,[n.value?(F(),I(`div`,Ybn,[H(_9,{class:`decoration-dotted`},{default:M(()=>[...s[1]||=[z(`Example`,-1)]]),_:1}),R(`div`,Xbn,[R(`button`,{class:`property-example-value group`,type:`button`,onClick:s[0]||=n=>j(t)(j(y9)(e.example))},[R(`span`,null,k(j(y9)(e.example)),1),H(j(jT),{class:`group-hover:text-c-1 text-c-3 ml-auto min-h-3 min-w-3`,icon:`Clipboard`,size:`xs`})])])])):B(``,!0),i.value?(F(),I(`div`,Zbn,[H(_9,{class:`decoration-dotted`},{default:M(()=>[z(k(a.value),1)]),_:1}),R(`div`,Qbn,[(F(!0),I(V,null,Ar(r.value,(e,n)=>(F(),I(`button`,{key:n,class:`property-example-value group`,type:`button`,onClick:n=>j(t)(j(y9)(e))},[R(`span`,null,k(j(y9)(e)),1),H(j(jT),{class:`text-c-3 group-hover:text-c-1 ml-auto min-h-3 min-w-3`,icon:`Clipboard`,size:`xs`})],8,$bn))),128))])])):B(``,!0)],64))}}),[[`__scopeId`,`data-v-77f8279d`]]);W(),ME(),UP(),dY();var txn={class:`property-heading`},nxn={key:1,class:`property-discriminator`},rxn={key:3,class:`property-additional`},ixn={key:4,class:`property-deprecated`},axn={key:5,class:`property-const`},oxn={key:7,class:`property-write-only`},sxn={key:8,class:`property-read-only`},cxn={key:9,class:`property-required`},lxn=U7(N({__name:`SchemaPropertyHeading`,props:{value:{},enum:{type:Boolean},isDiscriminator:{type:Boolean,default:!1},required:{type:Boolean,default:!1},additional:{type:Boolean},withExamples:{type:Boolean,default:!0},hideModelNames:{type:Boolean,default:!1},modelName:{},eventBus:{default:null}},setup(e){let t=e,n=wn(t,`value`),r=U(()=>{if(!n.value)return;let e=n.value;if(e.const!==void 0)return e.const;if(e.enum?.length===1)return e.enum[0];if(sY(e)&&e.items){let t=HP.schema(e.items);if(jE(t.const))return t.const;if(t.enum?.length===1)return t.enum[0]}}),i=U(()=>{if(!n.value)return[];let e=n.value,t=[];return sY(e)&&((e.minItems||e.maxItems)&&t.push({key:`array-range`,value:`${e.minItems||``}…${e.maxItems||``}`}),e.uniqueItems&&t.push({key:`unique-items`,value:`unique!`})),cY(e)&&(e.minLength&&t.push({key:`min-length`,prefix:`min length: `,value:e.minLength}),e.maxLength&&t.push({key:`max-length`,prefix:`max length: `,value:e.maxLength}),e.pattern&&t.push({key:`pattern`,value:e.pattern,code:!0,truncate:!0})),(cY(e)||lY(e))&&e.format&&t.push({key:`format`,value:e.format,truncate:!0}),lY(e)&&(jE(e.exclusiveMinimum)&&t.push({key:`exclusive-minimum`,prefix:`greater than: `,value:e.exclusiveMinimum}),jE(e.minimum)&&t.push({key:`minimum`,prefix:`min: `,value:e.minimum}),jE(e.exclusiveMaximum)&&t.push({key:`exclusive-maximum`,prefix:`less than: `,value:e.exclusiveMaximum}),jE(e.maximum)&&t.push({key:`maximum`,prefix:`max: `,value:e.maximum}),jE(e.multipleOf)&&t.push({key:`multiple-of`,prefix:`multiple of: `,value:e.multipleOf})),t}),a=U(()=>{if(!t.value||t.hideModelNames)return null;if(t.modelName)return{schemaKey:t.modelName,label:t.modelName};let e=g9(t.value);if(e)return{schemaKey:e.schemaKey,label:e.label};if(sY(t.value)&&t.value.items){let e=g9(t.value.items);return e?{schemaKey:e.schemaKey,label:`${e.label}[]`}:null}return null}),o=U(()=>!t.value||!(`type`in t.value)?!1:t.value.type===`array`?!0:!r.value),s=U(()=>t.value?f9(t.value):``),c=U(()=>{if(jE(t.value?.example))return t.value.example;if(t.value&&sY(t.value)){let e=HP.schema(t.value.items)?.example;return jE(e)?e:void 0}});return(e,n)=>(F(),I(`div`,txn,[e.$slots.name?(F(),I(`div`,{key:0,class:O([`property-name`,{deprecated:t.value?.deprecated}])},[P(e.$slots,`name`,{},void 0,!0)],2)):B(``,!0),t.isDiscriminator?(F(),I(`div`,nxn,` Discriminator `)):B(``,!0),t.value?(F(),I(V,{key:2},[o.value?(F(),L(v9,{key:0,truncate:``},{default:M(()=>[H(t9,null,{default:M(()=>[...n[1]||=[z(`Type: `,-1)]]),_:1}),z(k(s.value),1),a.value?(F(),I(V,{key:0},[n[2]||=z(` · `,-1),t.eventBus&&a.value.schemaKey?(F(),L(_9,{key:0,onClick:n[0]||=e=>t.eventBus.emit(`scroll-to:model-by-name`,{name:a.value.schemaKey})},{default:M(()=>[z(k(a.value.label),1)]),_:1})):(F(),I(V,{key:1},[z(k(a.value.label),1)],64))],64)):B(``,!0)]),_:1})):B(``,!0),(F(!0),I(V,null,Ar(i.value,e=>(F(),L(v9,{key:e.key,code:e.code,truncate:e.truncate},jr({default:M(()=>[e.key===`format`?(F(),L(t9,{key:0},{default:M(()=>[...n[3]||=[z(`Format:`,-1)]]),_:1})):e.key===`pattern`?(F(),L(t9,{key:1},{default:M(()=>[...n[4]||=[z(` Pattern: `,-1)]]),_:1})):B(``,!0),z(` `+k(e.value),1)]),_:2},[e.prefix?{name:`prefix`,fn:M(()=>[z(k(e.prefix),1)]),key:`0`}:void 0]),1032,[`code`,`truncate`]))),128)),t.enum?(F(),L(v9,{key:1},{default:M(()=>[...n[5]||=[z(`enum`,-1)]]),_:1})):B(``,!0)],64)):B(``,!0),t.additional?(F(),I(`div`,rxn,[t.value?.[`x-additionalPropertiesName`]?(F(),I(V,{key:0},[z(k(t.value[`x-additionalPropertiesName`]),1)],64)):(F(),I(V,{key:1},[z(`additional properties`)],64))])):B(``,!0),t.value?.deprecated?(F(),I(`div`,ixn,[H(j(K7),null,{default:M(()=>[...n[6]||=[z(`deprecated`,-1)]]),_:1})])):B(``,!0),r.value===void 0?(F(),I(V,{key:6},[t.value?.nullable===!0?(F(),L(v9,{key:0},{default:M(()=>[...n[8]||=[z(` nullable `,-1)]]),_:1})):B(``,!0)],64)):(F(),I(`div`,axn,[H(v9,{truncate:``},{prefix:M(()=>[...n[7]||=[z(`const: `,-1)]]),default:M(()=>[H(Vbn,{value:r.value},null,8,[`value`])]),_:1})])),t.value?.writeOnly?(F(),I(`div`,oxn,` write-only `)):t.value?.readOnly?(F(),I(`div`,sxn,` read-only `)):B(``,!0),t.required?(F(),I(`div`,cxn,` required `)):B(``,!0),H(Gbn,{value:t.value?.default},null,8,[`value`]),t.withExamples?(F(),L(exn,{key:10,example:c.value,examples:t.value?.examples},null,8,[`example`,`examples`])):B(``,!0)]))}}),[[`__scopeId`,`data-v-3264097c`]]);W(),kE(),UP(),dY();var uxn={key:0,class:`property-name-pattern-properties`},dxn={key:1,class:`property-name-additional-properties`},fxn={key:1,class:`property-description`},pxn={key:4,class:`children`},mxn={key:5,class:`children`},b9=U7(N({__name:`SchemaProperty`,props:{is:{},schema:{},noncollapsible:{type:Boolean},level:{default:0},name:{},required:{type:Boolean,default:!1},compact:{type:Boolean,default:!1},discriminator:{},description:{},hideModelNames:{type:Boolean,default:!1},hideHeading:{type:Boolean},modelName:{},variant:{},breadcrumb:{},eventBus:{},options:{},propertyNamesEnum:{},schemaContext:{},compositionPath:{},compositionPathSegment:{}},setup(e){let t=e,n=U(()=>ubn(t.schema)),r=U(()=>t.breadcrumb&&t.name?[...t.breadcrumb,t.name]:void 0),i=U(()=>t.compositionPathSegment?[...t.compositionPath??[],t.compositionPathSegment]:t.compositionPath??[]),a=U(()=>[...i.value,`items`]),o=U(()=>t.level<=2),s=U(()=>ibn(n.value)),c=U(()=>d.value.length>0),l=U(()=>{let e=n.value;return e?l9(e)&&(`properties`in e||`additionalProperties`in e):!1}),u=U(()=>{let e=n.value;return!e||!sY(e)||typeof e.items!=`object`?!1:s.value}),d=U(()=>sbn(n.value)),f=U(()=>lbn(n.value)),p=U(()=>dbn(n.value,t.description)),m=U(()=>{let e=n.value;if(!e||!p.value||!(`description`in e))return e;let{description:t,...r}=e;return r}),h=U(()=>fbn(n.value,t.name,t.required)),g=U(()=>obn(n.value)),_=U(()=>{let e=n.value;if(!(!e||!sY(e)||typeof e.items!=`object`))return HP.schema(e.items)}),v=U(()=>!!(t.name&&t.discriminator?.propertyName===t.name));return(t,s)=>(F(),L(kr(e.is??`li`),{class:O([`property`,[`property--level-${e.level}`,{"property--compact":e.compact,"property--deprecated":n.value?.deprecated}]])},{default:M(()=>[h.value?(F(),L(lxn,{key:0,class:`group`,enum:c.value,eventBus:e.eventBus,hideModelNames:e.hideModelNames,isDiscriminator:v.value,modelName:e.modelName,required:e.required,value:n.value},jr({_:2},[e.name?{name:`name`,fn:M(()=>[H(j(eyn),{breadcrumb:o.value?r.value:void 0,eventBus:e.eventBus},{default:M(()=>[e.variant===`patternProperties`?(F(),I(`span`,uxn,[H(j(wE),{preset:`property`,text:e.name},null,8,[`text`])])):e.variant===`additionalProperties`?(F(),I(`span`,dxn,[H(j(wE),{preset:`property`,text:e.name},null,8,[`text`])])):(F(),L(j(wE),{key:2,preset:`property`,text:e.name},null,8,[`text`]))]),_:1},8,[`breadcrumb`,`eventBus`])]),key:`0`}:void 0,n.value?.example===void 0?void 0:{name:`example`,fn:M(()=>[z(` Example: `+k(n.value.example),1)]),key:`1`}]),1032,[`enum`,`eventBus`,`hideModelNames`,`isDiscriminator`,`modelName`,`required`,`value`])):B(``,!0),p.value||f.value?(F(),I(`div`,fxn,[H(j(qT),{value:p.value||f.value||``},null,8,[`value`])])):B(``,!0),e.propertyNamesEnum&&e.propertyNamesEnum.length>0?(F(),L(Lbn,{key:2,propertyNames:``,value:{enum:e.propertyNamesEnum}},null,8,[`value`])):B(``,!0),d.value.length>0?(F(),L(Lbn,{key:3,value:n.value},null,8,[`value`])):B(``,!0),l.value?(F(),I(`div`,pxn,[H(x9,{breadcrumb:r.value,compact:e.compact,compositionPath:i.value,eventBus:e.eventBus,hideModelNames:e.hideModelNames,level:e.level+1,name:e.name,noncollapsible:e.noncollapsible,options:e.options,schema:m.value,schemaContext:e.schemaContext},null,8,[`breadcrumb`,`compact`,`compositionPath`,`eventBus`,`hideModelNames`,`level`,`name`,`noncollapsible`,`options`,`schema`,`schemaContext`])])):B(``,!0),u.value&&_.value?(F(),I(`div`,mxn,[H(x9,{compact:e.compact,compositionPath:a.value,eventBus:e.eventBus,hideModelNames:e.hideModelNames,level:e.level+1,name:e.name,noncollapsible:e.noncollapsible,options:e.options,schema:j(HP).schema(_.value),schemaContext:e.schemaContext},null,8,[`compact`,`compositionPath`,`eventBus`,`hideModelNames`,`level`,`name`,`noncollapsible`,`options`,`schema`,`schemaContext`])])):B(``,!0),(F(!0),I(V,null,Ar(g.value,t=>(F(),L(Cbn,{key:t.composition,breadcrumb:e.breadcrumb,compact:e.compact,composition:t.composition,compositionPath:i.value,discriminator:e.schema?.discriminator,eventBus:e.eventBus,hideHeading:e.hideHeading,hideModelNames:e.hideModelNames,level:e.level,name:e.name,noncollapsible:e.noncollapsible,options:e.options,schema:t.value,schemaContext:e.schemaContext},null,8,[`breadcrumb`,`compact`,`composition`,`compositionPath`,`discriminator`,`eventBus`,`hideHeading`,`hideModelNames`,`level`,`name`,`noncollapsible`,`options`,`schema`,`schemaContext`]))),128)),H(j(a9),{value:n.value},null,8,[`value`])]),_:1},8,[`class`]))}}),[[`__scopeId`,`data-v-c8e3c666`]]);W(),zE(),UP();var hxn=N({__name:`SchemaObjectProperties`,props:{schema:{},discriminator:{},compact:{type:Boolean},hideHeading:{type:Boolean},level:{},hideModelNames:{type:Boolean},breadcrumb:{},eventBus:{},options:{},schemaContext:{},compositionPath:{}},setup(e){let t=U(()=>Qyn(e.schema,e.discriminator,e.options)),n=(e,t)=>{let n=typeof e==`boolean`?e:HP.schema(e);if(typeof n==`object`&&typeof n[`x-additionalPropertiesName`]==`string`&&n[`x-additionalPropertiesName`].trim().length>0)return`${n[`x-additionalPropertiesName`].trim()}`;if(t){let e=HP.schema(t);if(e?.title)return e.title}return`propertyName`},r=e=>{if(!e)return;let t=HP.schema(e);if(t&&`enum`in t&&Array.isArray(t.enum)&&t.enum.length>0)return t.enum},i=U(()=>{if(!(!l9(e.schema)||!e.schema.additionalProperties))return r(e.schema.propertyNames)}),a=e=>{if(e)return`$ref`in e&&typeof e.$ref==`string`?RE(e):HP.schema(e)},o=e=>{if(e)return typeof e.description==`string`?e.description:void 0},s=e=>{let t=typeof e==`boolean`?e:HP.schema(e);return t===!0||typeof t==`object`&&Object.keys(t).length===0||typeof t!=`object`||!(`type`in t)?{type:`anything`,...typeof t==`object`?t:{}}:t};return(r,c)=>(F(),I(V,null,[j(l9)(e.schema)&&e.schema.properties?(F(!0),I(V,{key:0},Ar(t.value,t=>(F(),L(b9,{key:t,breadcrumb:e.breadcrumb,compact:e.compact,compositionPath:e.compositionPath,compositionPathSegment:t,discriminator:e.discriminator,eventBus:e.eventBus,hideHeading:e.hideHeading,hideModelNames:e.hideModelNames,level:e.level,name:t,options:e.options,required:e.schema.required?.includes(t),description:o(e.schema.properties[t]),schema:a(e.schema.properties[t]),schemaContext:e.schemaContext},null,8,[`breadcrumb`,`compact`,`compositionPath`,`compositionPathSegment`,`discriminator`,`eventBus`,`hideHeading`,`hideModelNames`,`level`,`name`,`options`,`required`,`description`,`schema`,`schemaContext`]))),128)):B(``,!0),j(l9)(e.schema)&&e.schema.patternProperties?(F(!0),I(V,{key:1},Ar(Object.entries(e.schema.patternProperties),([t,n])=>(F(),L(b9,{key:t,breadcrumb:e.breadcrumb,compact:e.compact,compositionPath:e.compositionPath,compositionPathSegment:t,discriminator:e.discriminator,eventBus:e.eventBus,hideHeading:e.hideHeading,hideModelNames:e.hideModelNames,level:e.level,name:t,options:e.options,description:o(n),schema:a(n),schemaContext:e.schemaContext},null,8,[`breadcrumb`,`compact`,`compositionPath`,`compositionPathSegment`,`discriminator`,`eventBus`,`hideHeading`,`hideModelNames`,`level`,`name`,`options`,`description`,`schema`,`schemaContext`]))),128)):B(``,!0),j(l9)(e.schema)&&e.schema.additionalProperties?(F(),L(b9,{key:2,breadcrumb:e.breadcrumb,compact:e.compact,compositionPath:e.compositionPath,compositionPathSegment:n(e.schema.additionalProperties,e.schema.propertyNames),discriminator:e.discriminator,eventBus:e.eventBus,hideHeading:e.hideHeading,hideModelNames:e.hideModelNames,level:e.level,name:n(e.schema.additionalProperties,e.schema.propertyNames),noncollapsible:``,options:e.options,propertyNamesEnum:i.value,schema:s(e.schema.additionalProperties),schemaContext:e.schemaContext,variant:`additionalProperties`},null,8,[`breadcrumb`,`compact`,`compositionPath`,`compositionPathSegment`,`discriminator`,`eventBus`,`hideHeading`,`hideModelNames`,`level`,`name`,`options`,`propertyNamesEnum`,`schema`,`schemaContext`])):B(``,!0)],64))}});W(),Rc(),kE();var gxn={key:0,class:`schema-card-description`},_xn={key:1,class:`pt-2`},vxn={key:0,class:`schema-properties`},x9=U7(N({__name:`Schema`,props:{schema:{},level:{default:0},name:{},compact:{type:Boolean},noncollapsible:{type:Boolean,default:!1},hideHeading:{type:Boolean},hideDescription:{type:Boolean,default:!1},additionalProperties:{type:Boolean},hideModelNames:{type:Boolean,default:!1},discriminator:{},breadcrumb:{},eventBus:{},options:{},schemaContext:{},compositionPath:{}},setup(e){let t=U(()=>!e.noncollapsible&&e.level>0),n=U(()=>e.hideDescription?null:e.schema?.allOf&&e.schema.allOf.length>0&&e.name===`Request Body`?e.schema.description||e.schema.allOf[0]?.description||null:!e.schema?.description||typeof e.schema.description!=`string`||e.schema.enum||!(`properties`in e.schema)&&!(`patternProperties`in e.schema)&&!(`additionalProperties`in e.schema)?null:e.schema.description),r=t=>e.noncollapsible&&t.stopPropagation();return(i,a)=>typeof e.schema==`object`&&Object.keys(e.schema).length?(F(),L(j(ac),{key:0,defaultOpen:e.noncollapsible},{default:M(({open:i})=>[R(`div`,{class:O([`schema-card`,[`schema-card--level-${e.level}`,{"schema-card--compact":e.compact,"schema-card--open":i},{"border-t":e.additionalProperties&&i}]])},[n.value?(F(),I(`div`,gxn,[H(j(qT),{value:n.value},null,8,[`value`])])):B(``,!0),j(Jyn)(e.schema)?(F(),I(`div`,_xn,` Empty object `)):B(``,!0),R(`div`,{class:O([`schema-properties`,{"schema-properties-open":i}])},[e.additionalProperties?lr((F(),I(`div`,vxn,[H(j(oc),{as:`button`,class:`schema-card-title schema-card-title--compact`,onClickCapture:r},{default:M(()=>[H(j(jT),{class:`schema-card-title-icon`,icon:`Add`,size:`sm`}),a[0]||=z(` Show additional properties `,-1),e.name?(F(),L(t9,{key:0},{default:M(()=>[z(`for `+k(e.name),1)]),_:1})):B(``,!0)]),_:1})],512)),[[Za,!i]]):t.value?lr((F(),L(j(oc),{key:1,as:e.noncollapsible?`div`:`button`,class:O([`schema-card-title`,{"schema-card-title--compact":e.compact}]),style:it({top:`calc(var(--refs-viewport-offset) +  calc(var(--schema-title-height) * ${e.level}))`}),onClickCapture:r},{default:M(()=>[e.compact?(F(),I(V,{key:0},[H(j(jT),{class:O([`schema-card-title-icon`,{"schema-card-title-icon--open":i}]),icon:`Add`,size:`sm`},null,8,[`class`]),i?(F(),I(V,{key:0},[z(` Hide `+k(e.schema?.title??`Child Attributes`),1)],64)):(F(),I(V,{key:1},[z(` Show `+k(e.schema?.title??`Child Attributes`),1)],64)),e.name?(F(),L(t9,{key:2},{default:M(()=>[z(`for `+k(e.name),1)]),_:1})):B(``,!0)],64)):(F(),I(V,{key:1},[H(j(jT),{class:O([`schema-card-title-icon`,{"schema-card-title-icon--open":i}]),icon:`Add`,size:`sm`},null,8,[`class`]),H(u9,{name:e.schema?.title??e.name,value:e.schema},null,8,[`name`,`value`])],64))]),_:2},1032,[`as`,`class`,`style`])),[[Za,!e.hideHeading&&!(e.noncollapsible&&e.compact)]]):B(``,!0),!e.additionalProperties||i?(F(),L(j(sc),{key:2,as:`ul`,static:!t.value},{default:M(()=>[j(l9)(e.schema)?(F(),L(hxn,{key:0,breadcrumb:e.breadcrumb,compact:e.compact,compositionPath:e.compositionPath,discriminator:e.discriminator,eventBus:e.eventBus,hideHeading:e.hideHeading,hideModelNames:e.hideModelNames,level:e.level+1,options:e.options,schema:e.schema,schemaContext:e.schemaContext},null,8,[`breadcrumb`,`compact`,`compositionPath`,`discriminator`,`eventBus`,`hideHeading`,`hideModelNames`,`level`,`options`,`schema`,`schemaContext`])):(F(),I(V,{key:1},[e.schema?(F(),L(b9,{key:0,breadcrumb:e.breadcrumb,compact:e.compact,compositionPath:e.compositionPath,eventBus:e.eventBus,hideHeading:e.hideHeading,hideModelNames:e.hideModelNames,level:e.level,options:e.options,schema:e.schema,schemaContext:e.schemaContext},null,8,[`breadcrumb`,`compact`,`compositionPath`,`eventBus`,`hideHeading`,`hideModelNames`,`level`,`options`,`schema`,`schemaContext`])):B(``,!0)],64))]),_:1},8,[`static`])):B(``,!0)],2)],2)]),_:1},8,[`defaultOpen`])):B(``,!0)}}),[[`__scopeId`,`data-v-c988b726`]]);W(),kE(),W(),UP();var yxn={key:0,class:`properties`},bxn={key:1},xxn=U7(N({__name:`ClassicLayout`,props:{id:{},name:{},schema:{},isCollapsed:{type:Boolean},eventBus:{},options:{}},setup(e){return(t,n)=>(F(),L(j(Fvn),{"aria-label":e.schema.title??e.name,modelValue:!e.isCollapsed,"onUpdate:modelValue":n[1]||=t=>e.eventBus?.emit(`toggle:nav-item`,{id:e.id,open:t})},{title:M(()=>[H(j(n9),{class:`reference-models-anchor`,eventBus:e.eventBus,onCopyAnchorUrl:n[0]||=()=>e.eventBus?.emit(`copy-url:nav-item`,{id:e.id})},{default:M(()=>[H(j(e9),{level:3},{default:M(()=>[H(j(u9),{class:`reference-models-label`,name:e.schema.title??e.name,value:e.schema},null,8,[`name`,`value`])]),_:1})]),_:1},8,[`eventBus`])]),default:M(()=>[`properties`in e.schema?(F(),I(`div`,yxn,[(F(!0),I(V,null,Ar(Object.entries(e.schema.properties??{}),([t,n])=>(F(),L(j(b9),{key:t,eventBus:e.eventBus,hideModelNames:e.options.hideModels,name:t,options:e.options,required:e.schema.required?.includes(t),schema:j(HP).schema(n)},null,8,[`eventBus`,`hideModelNames`,`name`,`options`,`required`,`schema`]))),128))])):(F(),I(`div`,bxn,[H(j(b9),{eventBus:e.eventBus,hideModelNames:e.options.hideModels,options:e.options,schema:e.schema},null,8,[`eventBus`,`hideModelNames`,`options`,`schema`])]))]),_:1},8,[`aria-label`,`modelValue`]))}}),[[`__scopeId`,`data-v-5aa6b456`]]);W(),kE();var Sxn=N({__name:`ModernLayout`,props:{id:{},name:{},schema:{},isCollapsed:{type:Boolean},eventBus:{},options:{}},setup(e){return(t,n)=>(F(),L(j(ryn),{id:e.id,key:e.name,label:e.name,modelValue:!e.isCollapsed,onCopyAnchorUrl:n[0]||=()=>e.eventBus?.emit(`copy-url:nav-item`,{id:e.id}),"onUpdate:modelValue":n[1]||=t=>e.eventBus?.emit(`toggle:nav-item`,{id:e.id,open:t})},{heading:M(()=>[H(j(e9),{level:3},{default:M(()=>[H(j(u9),{name:e.schema.title??e.name,value:e.schema},null,8,[`name`,`value`])]),_:1})]),default:M(()=>[H(j(aC),null,{default:M(()=>[H(j(x9),{eventBus:e.eventBus,hideModelNames:e.options.hideModels,hideHeading:``,level:1,noncollapsible:``,options:e.options,schema:e.schema},null,8,[`eventBus`,`hideModelNames`,`options`,`schema`])]),_:1})]),_:1},8,[`id`,`label`,`modelValue`]))}});W();var Cxn=N({__name:`Model`,props:{id:{},name:{},options:{},schema:{},isCollapsed:{type:Boolean},eventBus:{}},setup(e){let t=wr(`section`);return q7(t,()=>e.eventBus?.emit(`intersecting:nav-item`,{id:e.id})),(n,r)=>e.schema?(F(),I(`div`,{key:0,ref_key:`section`,ref:t},[e.options.layout===`classic`?(F(),L(xxn,{key:0,id:e.id,eventBus:e.eventBus,isCollapsed:e.isCollapsed,name:e.name,options:e.options,schema:e.schema},null,8,[`id`,`eventBus`,`isCollapsed`,`name`,`options`,`schema`])):(F(),L(Sxn,{key:1,id:e.id,eventBus:e.eventBus,isCollapsed:e.isCollapsed,name:e.name,options:e.options,schema:e.schema},null,8,[`id`,`eventBus`,`isCollapsed`,`name`,`options`,`schema`]))],512)):B(``,!0)}});W(),Ou();var wxn={class:`show-more`,type:`button`},Txn=U7(N({__name:`ShowMoreButton`,setup(e){return(e,t)=>(F(),I(`button`,wxn,[t[0]||=z(` Show More `,-1),H(j(tl),{class:`text-c-2 mt-0.25 size-3`,weight:`bold`})]))}}),[[`__scopeId`,`data-v-d1c2b649`]]);W();var Exn=N({__name:`ModelTag`,props:{id:{},isCollapsed:{type:Boolean},eventBus:{},layout:{}},setup(e){return(t,n)=>e.layout===`modern`?(F(),L(Z7,{key:0,id:`model`},{default:M(()=>[H(j(J7),{id:e.id,"aria-label":`Models`,onIntersecting:n[1]||=()=>e.eventBus?.emit(`intersecting:nav-item`,{id:e.id})},{default:M(()=>[H(j($7),null,{default:M(()=>[H(e9,{level:2},{default:M(()=>[...n[3]||=[z(` Models `,-1)]]),_:1})]),_:1}),e.isCollapsed?(F(),L(Txn,{key:1,id:e.id,class:`top-0`,onClick:n[0]||=()=>e.eventBus.emit(`toggle:nav-item`,{id:e.id,open:!0})},null,8,[`id`])):P(t.$slots,`default`,{key:0})]),_:3},8,[`id`])]),_:3})):(F(),L(Gvn,{key:1,"aria-label":`Models`,class:`pb-12`,modelValue:!e.isCollapsed,"onUpdate:modelValue":n[2]||=()=>e.eventBus?.emit(`toggle:nav-item`,{id:e.id,open:e.isCollapsed})},{title:M(()=>[H(j($7),{level:2},{default:M(()=>[...n[4]||=[z(`Models`,-1)]]),_:1})]),default:M(()=>[P(t.$slots,`default`)]),_:3},8,[`modelValue`]))}});W(),kE();var Dxn=U7(N({__name:`ClassicLayout`,props:{tag:{},isCollapsed:{type:Boolean},eventBus:{}},setup(e){return(t,n)=>(F(),L(j(Gvn),{"aria-label":e.tag.title,class:O([`tag-section`,{"tag-section-group":e.tag.isGroup}]),modelValue:!e.isCollapsed,"onUpdate:modelValue":n[1]||=t=>e.eventBus?.emit(`toggle:nav-item`,{id:e.tag.id,open:t})},{title:M(()=>[H(j($7),{class:O([`tag-name`,{"tag-group-name":e.tag.isGroup}])},{default:M(()=>[H(j(n9),{onCopyAnchorUrl:n[0]||=()=>e.eventBus?.emit(`copy-url:nav-item`,{id:e.tag.id})},{default:M(()=>[H(j(e9),{level:2},{default:M(()=>[z(k(e.tag.title),1)]),_:1})]),_:1})]),_:1},8,[`class`]),H(j(qT),{class:`tag-description`,value:e.tag?.description,withImages:``},null,8,[`value`])]),default:M(()=>[P(t.$slots,`default`,{},void 0,!0)]),_:3},8,[`aria-label`,`class`,`modelValue`]))}}),[[`__scopeId`,`data-v-d4f47ce7`]]);W(),T2(),D4();var S9=N({__name:`HttpMethod`,props:{as:{},property:{},short:{type:Boolean},method:{}},setup(e){let t=e,n=U(()=>w2(String(t.method||``))),r=U(()=>E4(t.method));return(t,i)=>(F(),L(kr(e.as??`span`),{class:`uppercase`,style:it({[e.property||`color`]:n.value.colorVar})},{default:M(()=>[P(t.$slots,`default`),z(` `+k(e.short?n.value.short:r.value),1)]),_:3},8,[`style`]))}});W(),T2(),Ou();var Oxn=U7(N({__name:`OperationsListItem`,props:{operation:{},isCollapsed:{type:Boolean},eventBus:{}},setup(e){let t=U(()=>`path`in e.operation?e.operation.path:e.operation.title),n=e=>e.type===`webhook`;return(r,i)=>(F(),I(`li`,{key:e.operation.id,class:`contents`},[e.isCollapsed?(F(),L(j(e9),{key:0,class:`sr-only`,level:3},{default:M(()=>[z(k(e.operation.title)+` (Hidden) `,1)]),_:1})):B(``,!0),R(`a`,{class:`endpoint`,onClick:i[0]||=po(()=>e.eventBus?.emit(`scroll-to:nav-item`,{id:e.operation.id}),[`prevent`])},[H(j(S9),{class:`endpoint-method items-center justify-end gap-2`,method:e.operation.method},{default:M(()=>[n(e.operation)?(F(),L(j(Eu),{key:0,class:`size-3.5`,style:it({color:j(w2)(e.operation.method).colorVar})},null,8,[`style`])):B(``,!0)]),_:1},8,[`method`]),R(`span`,{class:O([`endpoint-path`,{deprecated:e.operation.isDeprecated}])},k(t.value),3)])]))}}),[[`__scopeId`,`data-v-ad8530a6`]]);W(),kE();var kxn=[`aria-label`],Axn=U7(N({__name:`OperationsList`,props:{tag:{},eventBus:{}},setup(e){let t=U(()=>e.tag.children?.filter(e=>e.type===`operation`||e.type===`webhook`)??[]);return(n,r)=>e.tag.children&&e.tag.children?.length>0?(F(),L(j(yf),{key:0,class:`endpoints-card`},{default:M(()=>[H(j(Cf),{muted:``},{default:M(()=>[H(t9,null,{default:M(()=>[z(k(e.tag.title),1)]),_:1}),z(` `+k(e.tag.isWebhooks?`Webhooks`:`Operations`),1)]),_:1}),H(j(bf),{class:`custom-scroll max-h-[60vh]`},{default:M(()=>[R(`ul`,{"aria-label":`${e.tag.title} endpoints`,class:`endpoints`},[(F(!0),I(V,null,Ar(t.value,t=>(F(),L(Oxn,{key:t.id,eventBus:e.eventBus,operation:t},null,8,[`eventBus`,`operation`]))),128))],8,kxn)]),_:1})]),_:1})):B(``,!0)}}),[[`__scopeId`,`data-v-f726f753`]]);W(),kE();var jxn=N({__name:`TagSection`,props:{tag:{},headerId:{},isCollapsed:{type:Boolean},isLoading:{type:Boolean},eventBus:{}},setup(e){return(t,n)=>e.tag?(F(),L(j(J7),{key:0,id:e.tag.id,role:`none`,onIntersecting:n[1]||=()=>e.eventBus?.emit(`intersecting:nav-item`,{id:e.tag.id})},{default:M(()=>[lr(H(j($7),null,{default:M(()=>[H(j(n9),{onCopyAnchorUrl:n[0]||=()=>e.eventBus?.emit(`copy-url:nav-item`,{id:e.tag.id})},{default:M(()=>[H(j(e9),{id:e.headerId,level:2},{default:M(()=>[z(k(e.tag.title)+` `,1),e.isCollapsed?(F(),L(t9,{key:0},{default:M(()=>[...n[2]||=[z(` (Collapsed)`,-1)]]),_:1})):B(``,!0)]),_:1},8,[`id`])]),_:1})]),_:1},512),[[Za,!e.isLoading]]),H(j(Q7),{loading:e.isLoading},{default:M(()=>[H(j(X7),null,{default:M(()=>[H(j(Y7),null,{default:M(()=>[H(j(qT),{clamp:e.isCollapsed?7:void 0,value:e.tag?.description??``,withImages:``},null,8,[`clamp`,`value`])]),_:1}),H(j(Y7),null,{default:M(()=>[H(j(Axn),{eventBus:e.eventBus,tag:e.tag},null,8,[`eventBus`,`tag`])]),_:1})]),_:1})]),_:1},8,[`loading`]),H(j(a9),{value:e.tag.xKeys},null,8,[`value`])]),_:1},8,[`id`])):B(``,!0)}});W();var Mxn={key:2,class:`contents divide-y`},Nxn=U7(N({__name:`ModernLayout`,props:{tag:{},moreThanOneTag:{type:Boolean},isLoading:{type:Boolean},isCollapsed:{type:Boolean},eventBus:{}},setup(e){let t=Sr(),n=U(()=>e.moreThanOneTag||e.tag?.title!==`default`||e.tag?.description!==``),r=U(()=>(e.tag?.children?.length??0)>0);return(i,a)=>(F(),L(j(Z7),{"aria-labelledby":j(t),class:`tag-section-container`,role:`region`},{default:M(()=>[n.value?(F(),L(jxn,{key:0,eventBus:e.eventBus,headerId:j(t),isCollapsed:e.isCollapsed,isLoading:e.isLoading,tag:e.tag},null,8,[`eventBus`,`headerId`,`isCollapsed`,`isLoading`,`tag`])):B(``,!0),e.isCollapsed&&e.moreThanOneTag&&r.value?(F(),L(Txn,{key:1,id:e.tag.id,"aria-label":`Show all ${e.tag.title} endpoints`,onClick:a[0]||=()=>e.eventBus?.emit(`toggle:nav-item`,{id:e.tag.id,open:!0})},null,8,[`id`,`aria-label`])):B(``,!0),e.isCollapsed&&e.moreThanOneTag?B(``,!0):(F(),I(`div`,Mxn,[P(i.$slots,`default`,{},void 0,!0)]))]),_:3},8,[`aria-labelledby`]))}}),[[`__scopeId`,`data-v-8f1a275c`]]);W();var Pxn=N({__name:`Tag`,props:{tag:{},layout:{},moreThanOneTag:{type:Boolean},isLoading:{type:Boolean},isCollapsed:{type:Boolean},eventBus:{}},setup(e){return(t,n)=>e.layout===`classic`?(F(),L(Dxn,{key:0,eventBus:e.eventBus,isCollapsed:e.isCollapsed,layout:e.layout,tag:e.tag},{default:M(()=>[P(t.$slots,`default`)]),_:3},8,[`eventBus`,`isCollapsed`,`layout`,`tag`])):(F(),L(Nxn,{key:1,eventBus:e.eventBus,isCollapsed:e.isCollapsed,isLoading:e.isLoading,layout:e.layout,moreThanOneTag:e.moreThanOneTag,tag:e.tag},{default:M(()=>[P(t.$slots,`default`)]),_:3},8,[`eventBus`,`isCollapsed`,`isLoading`,`layout`,`moreThanOneTag`,`tag`]))}}),C9=e=>e.replace(/^\/+|\/+$/g,``),w9=e=>e.startsWith(`#`),Fxn=e=>e.replace(/^#+/,``).replace(/\/+$/g,``),T9=(e,t)=>t?`${t}${e?`/`:``}${e}`:e,Ixn=(e,t)=>e===t?``:e.startsWith(`${t}/`)?e.slice(t.length+1):null,Lxn=(e,t)=>{let n=typeof e==`string`?new URL(e):e;return T9(decodeURIComponent(n.hash.slice(1)),t)},Rxn=(e,t,n)=>{let r=typeof e==`string`?new URL(e):e,i=C9(t),a=i?`/${i.split(`/`).map(e=>encodeURIComponent(e)).join(`/`)}`:``;if(r.pathname.startsWith(a)){let e=r.pathname.slice(a.length);return T9(decodeURIComponent(e.startsWith(`/`)?e.slice(1):e),n)}return n??``},zxn=(e,t,n)=>{let r=typeof e==`string`?new URL(e):e,i=Ixn(decodeURIComponent(r.hash.slice(1)),Fxn(t));return i===null?n??``:T9(i,n)},Bxn=(e,t)=>{let n=typeof e==`string`?new URL(e):e;if(w9(t)){let e=decodeURIComponent(n.hash);return e===t||e.startsWith(`${t}/`)}let r=C9(t),i=r?`/${r.split(`/`).map(e=>encodeURIComponent(e)).join(`/`)}`:``;return n.pathname===i||n.pathname.startsWith(`${i}/`)},E9=(e,t,n)=>typeof t==`string`?w9(t)?zxn(e,t,n):Rxn(e,t,n):Lxn(e,n),Vxn=e=>{let t=e.endsWith(`/`),n=e.split(`/`).filter(Boolean).slice(1).join(`/`);return t&&n?`${n}/`:n},D9=(e,t,n)=>{if(typeof window>`u`)return;let r=n?e:Vxn(e),i=new URL(window.location.href);return typeof t==`string`?w9(t)?i.hash=[Fxn(t),r].filter(Boolean).join(`/`):i.pathname=`${C9(t)}/${r}`:i.hash=r,i},Hxn=e=>{let t=e.match(/(.*)(\.body\.|\.path\.|\.query\.|\.header\.)(.*)/);return t&&typeof t[1]==`string`&&typeof t[2]==`string`?{rawId:t[1],params:t[2].slice(1)+t[3]}:{rawId:e,params:``}};Zf(),sb(),W();var O9=fn(new Set),k9=fn(new Set),A9=fn(new Set),j9=A(!1),Uxn=3e3,M9=A(!1),N9=fn(new Set),P9=new Set,F9=fn(new Map),Wxn=e=>F9.get(e),I9=(e,t)=>{!Number.isFinite(t)||t<=0||F9.set(e,Math.round(t))},Gxn=e=>{e&&P9.add(e)},Kxn=()=>{let e=ob();return N9.add(e),()=>setTimeout(()=>N9.delete(e),100)},qxn=U(()=>N9.size===0),L9=()=>{if(typeof window>`u`||j9.value)return;j9.value=!0;let e=async()=>{let e=[...O9],t=[...k9];if(e.length===0&&t.length===0){P9.forEach(e=>e()),P9.clear(),j9.value=!1,M9.value=!0;return}for(let t of e)A9.add(t),O9.delete(t);for(let e of t)A9.add(e),k9.delete(e);await ar(),P9.forEach(e=>e()),P9.clear(),j9.value=!1,M9.value=!0};window.requestIdleCallback?window.requestIdleCallback(e,{timeout:1500}):ar(e)};Gve([()=>k9.size,()=>O9.size,()=>j9.value],()=>{(k9.size>0||O9.size>0)&&!j9.value&&L9()},{debounce:300,maxWait:1500});var Jxn=e=>{e&&!A9.has(e)&&!O9.has(e)&&k9.add(e)},R9=e=>{e&&!O9.has(e)&&O9.add(e)},Yxn=(e,t=!1)=>{!e||A9.has(e)||(t?R9(e):Jxn(e),j9.value||L9())},Xxn=()=>{typeof window>`u`||window.setTimeout(()=>L9(),400)},Zxn=e=>{O9.delete(e),k9.delete(e),A9.delete(e),F9.delete(e)};function Qxn(e){return Wi(()=>{Zxn(e)}),{isReady:U(()=>typeof window>`u`||O9.has(e)||A9.has(e))}}var $xn=(e,t,n)=>{let r=n(e),i=!A9.has(e)||r?.children?.some(e=>!A9.has(e.id))?tSn(e):void 0;Gxn(i);let a=Kxn(),{rawId:o}=Hxn(e);if(R9(e),R9(o),r?.children&&r.children.slice(0,2).forEach(e=>R9(e.id)),r?.parent){let t=n(r.parent.id),i=t?.children?.findIndex(t=>t.id===e);i!==void 0&&i>=0&&t?.children?.slice(i,i+2).forEach(e=>R9(e.id))}t(o,!0);let s=e=>{let r=n(e)?.parent;r&&(R9(r.id),t(r.id,!0),s(r.id))};s(o),ar(()=>{eSn(e,Date.now()+Uxn,a,i)})},eSn=(e,t,n,r)=>{let i=document.getElementById(e);i?(i.scrollIntoView({block:`start`}),n()):Date.now()<t?requestAnimationFrame(()=>eSn(e,t,n,r)):(n(),r?.())},tSn=e=>{let t=!1,n=r=>{let i=document.getElementById(e);i&&i.scrollIntoView({block:`start`}),r||requestAnimationFrame(()=>n(t))};return n(!1),()=>{t=!0}};W(),Zf();var nSn=[`id`,`data-placeholder`],rSn=760,iSn=1200,aSn=N({__name:`Lazy`,props:{id:{},expanded:{type:Boolean,default:!1}},setup(e){let t=`${iSn}px 0px`,{isReady:n}=Qxn(e.id),r=A(null),i=A(Wxn(e.id)??rSn),a=null,o=U(()=>n.value||e.expanded);return Hi(()=>{if(!(typeof window>`u`)){if(!(`IntersectionObserver`in window)){Yxn(e.id,!0);return}aye(r,([t])=>{t?.isIntersecting&&!n.value&&Yxn(e.id,!0)},{rootMargin:t})}}),mr(()=>o.value,(t,n)=>{if(n&&!t&&r.value){let t=r.value.offsetHeight;Number.isFinite(t)&&t>0&&(i.value=t,I9(e.id,t))}},{flush:`pre`}),mr(()=>o.value,t=>{if(!t){a?.disconnect(),a=null;return}ar(()=>{if(!r.value||typeof ResizeObserver>`u`)return;a||=new ResizeObserver(()=>{if(!r.value)return;let t=r.value.offsetHeight;Number.isFinite(t)&&t>0&&(i.value=t,I9(e.id,t))}),a.observe(r.value);let t=r.value.offsetHeight;Number.isFinite(t)&&t>0&&(i.value=t,I9(e.id,t))})},{immediate:!0}),Wi(()=>{a?.disconnect()}),(t,n)=>(F(),I(`div`,{id:o.value?void 0:e.id,ref_key:`lazyContainerRef`,ref:r,"data-placeholder":!o.value,"data-testid":`lazy-container`,style:it({height:o.value?void 0:`${i.value}px`})},[o.value?P(t.$slots,`default`,{key:0}):B(``,!0)],12,nSn))}});QI();var z9=e=>Object.keys(e).sort().join(`,`),oSn=(e,t,n,r,i={})=>{let a=t?.security??e.security??[],o=RI(n,r,a),s=new Set(a.map(e=>z9(e))),c=o.selectedSchemes[o.selectedIndex];if(c&&s.has(z9(c)))return FI(i,c);for(let e of o.selectedSchemes)if(s.has(z9(e)))return FI(i,e);return t?.security?.length?FI(i,a[0]??{}):[]};zE();var sSn=(...e)=>{for(let t of e)if(t){if(!Array.isArray(t)){let e=RE(t);if(e?.url)return e;continue}for(let e of t){let t=RE(e);if(t?.url)return t}}return null};zE(),y$t();var cSn=(e,t)=>{let n=e?.security??t.security??[],r=t.components?.securitySchemes??{},i=!1,a=[];for(let e of n){if(!M2(e)){i=!0;continue}let t=Object.entries(e).map(([e,t])=>({name:e,scheme:RE(r[e]),scopes:t.filter(e=>e.length>0)}));t.length>0&&a.push({schemes:t})}return a.length===0?{state:i?`optional`:`none`,requirements:[]}:{state:i?`optional`:`required`,requirements:a}};W();var lSn={key:0},uSn=U7(N({__name:`OperationPath`,props:{path:{},deprecated:{type:Boolean}},setup(e){let t=e,n=e=>e.startsWith(`{`)&&e.endsWith(`}`),r=U(()=>t.path.split(/({[^}]+})/));return(t,i)=>(F(),I(`span`,{class:O([`operation-path`,{deprecated:e.deprecated}])},[(F(!0),I(V,null,Ar(r.value,(e,t)=>(F(),I(V,{key:t},[n(e)?(F(),I(`em`,lSn,k(e),1)):(F(),I(V,{key:1},[z(k(e),1)],64))],64))),128))],2))}}),[[`__scopeId`,`data-v-ec6c8861`]]);W(),kE(),By();var dSn=2e4,fSn=N({__name:`ExampleSchema`,props:{id:{},schema:{}},setup(e){let t=U(()=>{if(e.schema)return zy(TY(e.schema))}),n=U(()=>(t.value?.length??0)>dSn);return(r,i)=>n.value?(F(),L(j(CE),{key:1,id:e.id,containerClass:`custom-scroll scalar-code-block border rounded-b flex flex-1 max-h-screen`,contentClass:`language-plaintext whitespace-pre font-code text-base`,lineHeight:20,text:t.value??``},null,8,[`id`,`text`])):(F(),L(j(Wy),{key:0,id:e.id,class:`bg-b-2`,lang:`json`,prettyPrintedContent:t.value??``},null,8,[`id`,`prettyPrintedContent`]))}});W(),kE(),By(),QI();var pSn={key:2,class:`empty-state`},mSn=2e4,hSn=U7(N({__name:`ExampleResponse`,props:{response:{},example:{}},setup(e){let t=()=>{if(e.example!==void 0)return TY(e.example)?.value??``;if(e.response?.schema)return iF(TY(e.response.schema),{emptyString:`string`,mode:`read`})},n=U(()=>{let e=t();if(e!==void 0)return zy(e)}),r=U(()=>n.value===void 0?!1:n.value.length>mSn);return(e,t)=>n.value!==void 0&&!r.value?(F(),L(j(Wy),{key:0,class:`bg-b-2`,lang:`json`,prettyPrintedContent:n.value},null,8,[`prettyPrintedContent`])):n.value!==void 0&&r.value?(F(),L(j(CE),{key:1,containerClass:`custom-scroll scalar-code-block border rounded-b flex flex-1 max-h-screen`,contentClass:`language-plaintext whitespace-pre font-code text-base p-2`,lineHeight:20,text:n.value},null,8,[`text`])):(F(),I(`div`,pSn,` No Body `))}}),[[`__scopeId`,`data-v-6aae906d`]]);W(),Rc();var gSn=U7(N({__name:`ExampleResponseTab`,setup(e){return(e,t)=>(F(),L(j(kc),{as:`template`},{default:M(({selected:t})=>[R(`button`,{class:O([`tab`,{"tab-selected":t}]),type:`button`},[R(`span`,null,[P(e.$slots,`default`,{},void 0,!0)])],2)]),_:3}))}}),[[`__scopeId`,`data-v-804dba49`]]);W(),Rc(),kE();var _Sn=U7(N({__name:`ExampleResponseTabList`,emits:[`change`],setup(e,{emit:t}){let n=t,r=e=>{n(`change`,e)};return(e,t)=>(F(),L(j(Cf),{class:`scalar-card-header scalar-card-header-tabs`},{actions:M(()=>[P(e.$slots,`actions`,{},void 0,!0)]),default:M(()=>[H(j(Dc),{onChange:r},{default:M(()=>[H(j(Oc),{class:`tab-list custom-scroll`},{default:M(()=>[P(e.$slots,`default`,{},void 0,!0)]),_:3})]),_:3})]),_:3}))}}),[[`__scopeId`,`data-v-fec8fbbb`]]);function vSn(e){if(typeof e==`string`)return e.replace(/;.*$/,``).replace(/\/(?!.*vnd\.|fhir\+).*\+/,`/`).trim()}function ySn(e){if(!e)return e;let t={...e};return Object.entries(t).forEach(([e,n])=>{let r=vSn(e);r&&(t[r]=n)}),t}PI();function bSn(e){if(!e)return!1;let t=!!e.schema,n=`example`in e&&e.example!==null,r=!!e.examples;return t||n||r}function xSn(e){return e===`default`||/^[1-5][0-9]{2}$/.test(e)||/^[1-5]XX$/.test(e)}function SSn(e,t){if(t!==void 0)return xSn(t)?!!e:!1;let n=ySn(e?.content),r=NI(n??{});return bSn(n?.[`application/json`]??n?.[`application/xml`]??n?.[`text/plain`]??n?.[`text/html`]??n?.[`*/*`]??n?.[r[0]??``])}W(),kE(),PI(),j2(),zE(),QI();var CSn={key:1,class:`scalar-card-checkbox`},wSn=[`aria-controls`],TSn={class:`response-description`},ESn=U7(N({__name:`ExampleResponses`,props:{responses:{}},setup(e){let t=Sr(),{copyToClipboard:n}=A2(),r=U(()=>Object.keys(e.responses??{}).sort()),i=U(()=>r.value.filter(t=>SSn(RE(e.responses?.[t]),t))),a=A(0);mr(i,e=>{e.length===0?(a.value=0,l.value=``):a.value>=e.length&&(a.value=e.length-1,l.value=``)});let o=U(()=>{let t=Cn(i)[Cn(a)]??``;return RE(e.responses?.[t])}),s=U(()=>{let e=ySn(o.value?.content),t=NI(e??{});return e?.[t[0]??``]}),c=U(()=>!!s.value?.examples&&Object.keys(s.value?.examples??{}).length>1),l=A(Object.keys(s.value?.examples??{})[0]??``),u=U(()=>{if(s.value)return c.value&&l.value?s.value.examples?.[l.value]:pD(s.value,void 0,void 0)}),d=e=>{a.value=e,l.value=``},f=A(!1);return(e,r)=>i.value.length?(F(),L(j(yf),{key:0,"aria-label":`Example Responses`,class:`response-card`,role:`region`},{default:M(()=>[H(_Sn,{onChange:d},{actions:M(()=>[s.value?.example?(F(),I(`button`,{key:0,class:`code-copy`,type:`button`,onClick:r[0]||=()=>j(n)(s.value?.example)},[H(j(jT),{icon:`Clipboard`,width:`12px`})])):B(``,!0),s.value?.schema?(F(),I(`label`,CSn,[r[4]||=z(` Show Schema `,-1),lr(R(`input`,{"onUpdate:modelValue":r[1]||=e=>f.value=e,"aria-controls":j(t),class:`scalar-card-checkbox-input`,type:`checkbox`},null,8,wSn),[[uo,f.value]]),r[5]||=R(`span`,{class:`scalar-card-checkbox-checkmark`},null,-1)])):B(``,!0)]),default:M(()=>[(F(!0),I(V,null,Ar(i.value,e=>(F(),L(gSn,{key:e,"aria-controls":j(t)},{default:M(()=>[H(t9,null,{default:M(()=>[...r[3]||=[z(`Status:`,-1)]]),_:1}),z(` `+k(e),1)]),_:2},1032,[`aria-controls`]))),128))]),_:1}),H(j(bf),{class:`grid flex-1`},{default:M(()=>[s.value?.schema&&f.value?(F(),L(fSn,{key:0,id:j(t),schema:s.value?.schema},null,8,[`id`,`schema`])):(F(),L(hSn,{key:1,id:j(t),example:u.value,response:s.value},null,8,[`id`,`example`,`response`]))]),_:1}),o.value?.description||c.value?(F(),L(j(Sf),{key:0,class:`response-card-footer`},{default:M(()=>[c.value?(F(),L(j(rvn),{key:0,modelValue:l.value,"onUpdate:modelValue":r[2]||=e=>l.value=e,class:`response-example-selector px-0`,examples:s.value?.examples},null,8,[`modelValue`,`examples`])):B(``,!0),R(`div`,TSn,[o.value?.description?(F(),L(j(qT),{key:0,class:`response-description-markdown`,value:o.value.description},null,8,[`value`])):B(``,!0)])]),_:1})):B(``,!0)]),_:1})):B(``,!0)}}),[[`__scopeId`,`data-v-4e56e3cf`]]);zE(),dY();var DSn=e=>`schema`in e&&e.schema!==void 0,OSn=e=>RE(e),kSn=(e,t,n,r,i)=>{let{example:a,examples:o,...s}=e;return{...s,name:t,description:n,required:r,schema:i}},ASn=(e,t,n)=>{if(!t.properties)return[e];let r=new Set(t.required??[]),i=Object.entries(t.properties).flatMap(([t,i])=>{let a=OSn(i);if(!a)return[];let o=`${n}[${t}]`,s=kSn(e,o,a.description??e.description,r.has(t),a);return oY(a)&&a.properties?ASn(s,a,o):[s]});return i.length>0?i:[e]},jSn=e=>{if(e.in!==`query`||!DSn(e)||e.style!==`deepObject`)return[e];let t=OSn(e.schema);return!t||!oY(t)?[e]:ASn(e,t,e.name)},MSn=e=>!!(e?.[`x-internal`]||e?.[`x-scalar-ignore`]);W(),kE(),Ou();var NSn=N({inheritAttrs:!1,__name:`ContentTypeSelect`,props:Lr({content:{}},{modelValue:{required:!0},modelModifiers:{}}),emits:[`update:modelValue`],setup(e){let t=Ur(e,`modelValue`),n=U(()=>Object.keys(e.content??{})),r=U({get:()=>i.value.find(e=>e.id===t.value),set:e=>{e&&(t.value=e.id)}}),i=U(()=>n.value.map(e=>({id:e,label:e}))),a=of({base:`font-normal text-c-2 bg-b-1 py-1 flex items-center gap-1 rounded-full text-xs leading-none border`,variants:{dropdown:{true:`hover:text-c-1 pl-2 pr-1.5 font-medium cursor-pointer`,false:`px-2`}}});return(e,o)=>n.value.length>1?(F(),L(j(pS),{key:0,modelValue:r.value,"onUpdate:modelValue":o[1]||=e=>r.value=e,options:i.value,placement:`bottom-end`,teleport:``,onClick:o[2]||=po(()=>{},[`stop`])},{default:M(({open:n})=>[H(j(gf),ai({class:[`h-fit`,j(a)({dropdown:!0})],variant:`ghost`},e.$attrs,{onClick:o[0]||=po(()=>{},[`stop`])}),{default:M(()=>[H(t9,null,{default:M(()=>[...o[3]||=[z(`Selected Content Type:`,-1)]]),_:1}),R(`span`,null,k(t.value),1),H(j(tl),{class:O([`size-2.75 transition-transform duration-100`,{"rotate-180":n}]),weight:`bold`},null,8,[`class`])]),_:2},1040,[`class`])]),_:1},8,[`modelValue`,`options`])):(F(),I(`div`,ai({key:1,class:[`selected-content-type`,j(a)({dropdown:!1})]},e.$attrs,{tabindex:`0`}),[R(`span`,null,k(t.value),1)],16))}});W(),zE();var PSn=N({__name:`Header`,props:{header:{},name:{},breadcrumb:{},eventBus:{},orderSchemaPropertiesBy:{},orderRequiredPropertiesFirst:{type:Boolean}},setup(e){return(t,n)=>`schema`in e.header&&e.header.schema?(F(),L(b9,{key:0,breadcrumb:e.breadcrumb?[...e.breadcrumb,`headers`]:void 0,description:e.header.description,eventBus:e.eventBus,name:e.name,options:{orderRequiredPropertiesFirst:e.orderRequiredPropertiesFirst,orderSchemaPropertiesBy:e.orderSchemaPropertiesBy},schema:j(RE)(e.header.schema)},null,8,[`breadcrumb`,`description`,`eventBus`,`name`,`options`,`schema`])):B(``,!0)}});W(),Rc(),kE(),zE();var FSn=U7(N({__name:`Headers`,props:{headers:{},breadcrumb:{},eventBus:{},orderRequiredPropertiesFirst:{type:Boolean},orderSchemaPropertiesBy:{}},setup(e){return(t,n)=>(F(),L(j(ac),null,{default:M(({open:t})=>[R(`div`,{class:O([`headers-card headers-card--compact`,[{"headers-card--open":t}]])},[R(`div`,{class:O([`headers-properties`,{"headers-properties-open":t}])},[H(j(oc),{class:`headers-card-title headers-card-title--compact`,style:{top:`calc(var(--refs-viewport-offset)))`}},{default:M(()=>[H(j(jT),{class:O([`headers-card-title-icon`,{"headers-card-title-icon--open":t}]),icon:`Add`,size:`sm`},null,8,[`class`]),t?(F(),I(V,{key:0},[z(` Hide Headers `)],64)):(F(),I(V,{key:1},[z(` Show Headers `)],64))]),_:2},1024),H(j(sc),null,{default:M(()=>[(F(!0),I(V,null,Ar(e.headers,(t,n)=>(F(),L(PSn,{key:n,breadcrumb:e.breadcrumb?[...e.breadcrumb,`headers`]:void 0,eventBus:e.eventBus,header:j(RE)(t),name:n,orderRequiredPropertiesFirst:e.orderRequiredPropertiesFirst,orderSchemaPropertiesBy:e.orderSchemaPropertiesBy},null,8,[`breadcrumb`,`eventBus`,`header`,`name`,`orderRequiredPropertiesFirst`,`orderSchemaPropertiesBy`]))),128))]),_:1})],2)],2)]),_:1}))}}),[[`__scopeId`,`data-v-ab19704d`]]);HE();var ISn=e=>e!==void 0,LSn=({parameter:e,schemaExamples:t,contentExamples:n})=>{let r=`examples`in e&&VE(e.examples)?e.examples:{},i=Object.values({...r,...VE(n)?n:{}}).filter(ISn),a=i.length===0&&`example`in e&&e.example!==void 0?[e.example]:[],o=(t??a).filter(ISn);return[...i,...o]};W(),Rc(),kE(),Ou(),zE();var RSn={class:`parameter-item group/parameter-item`},zSn={class:`parameter-item-name min-w-0`},BSn={key:1,class:`flex-1`},VSn=U7(N({__name:`ParameterListItem`,props:{parameter:{},name:{},breadcrumb:{},eventBus:{},collapsableItems:{type:Boolean},options:{}},setup(e){let t=A(!1),n=U(()=>`schema`in e.parameter&&e.parameter.schema?RE(e.parameter.schema):null),r=U(()=>!(`content`in e.parameter)||!e.parameter.content||Object.keys(e.parameter.content).length===0?null:e.parameter.content),i=A(Object.keys(r.value||{})[0]??``),a=U(()=>`headers`in e.parameter&&e.parameter.headers?e.parameter.headers:null),o=U(()=>r.value?r.value?.[i.value]?.schema:`schema`in e.parameter&&e.parameter.schema?e.parameter.schema:null),s=U(()=>{let e=o.value;return e&&`$ref`in e?_bn(e.$ref):null}),c=U(()=>{let t=o.value,a=r.value?RE(t):n.value,s=`deprecated`in e.parameter?e.parameter.deprecated:n.value?.deprecated,c=LSn({parameter:e.parameter,schemaExamples:n.value?.examples,contentExamples:r.value?.[i.value]?.examples});return{...a,deprecated:s,examples:c}}),l=U(()=>!!(r.value||a.value||n.value||t.value));return(n,o)=>(F(),I(`li`,RSn,[H(j(ac),null,{default:M(({open:n})=>[e.collapsableItems?(F(),L(kr(l.value?j(oc):`div`),{key:0,class:O([`parameter-item-trigger`,{"parameter-item-trigger-open":n}])},{default:M(()=>[R(`div`,zSn,[l.value?(F(),L(j(ll),{key:0,class:O([`parameter-item-icon size-3 transition-transform duration-100`,{"rotate-90":n}]),weight:`bold`},null,8,[`class`])):B(``,!0),R(`div`,null,[H(j(wE),{preset:`property`,text:e.name},null,8,[`text`])])]),!n&&e.parameter.description?(F(),L(j(JT),{key:0,truncated:t.value,"onUpdate:truncated":o[0]||=e=>t.value=e,class:`parameter-item-description-summary min-w-0 flex-1`,controlled:``,value:e.parameter.description},null,8,[`truncated`,`value`])):(F(),I(`div`,BSn))]),_:2},1032,[`class`])):B(``,!0),l.value&&r.value?(F(),I(`div`,{key:1,class:O([`absolute top-[calc(10px+0.5lh)] right-0 z-0 flex -translate-y-1/2 items-center text-base`,{"opacity-0 group-focus-within/parameter-item:opacity-100 group-hover/parameter-item:opacity-100":!n}])},[o[2]||=R(`div`,{class:`from-b-1 absolute inset-y-0 -left-6 -z-1 w-8 bg-linear-to-l from-40% to-transparent`},null,-1),H(NSn,{modelValue:i.value,"onUpdate:modelValue":o[1]||=e=>i.value=e,content:r.value},null,8,[`modelValue`,`content`])],2)):B(``,!0),H(j(sc),{class:`parameter-item-container parameter-item-container-markdown`,static:!e.collapsableItems},{default:M(()=>[e.collapsableItems&&e.parameter.description?(F(),L(j(qT),{key:0,class:`parameter-item-description`,value:e.parameter.description},null,8,[`value`])):B(``,!0),a.value?(F(),L(FSn,{key:1,breadcrumb:e.breadcrumb,eventBus:e.eventBus,headers:a.value,orderRequiredPropertiesFirst:e.options.orderRequiredPropertiesFirst,orderSchemaPropertiesBy:e.options.orderSchemaPropertiesBy},null,8,[`breadcrumb`,`eventBus`,`headers`,`orderRequiredPropertiesFirst`,`orderSchemaPropertiesBy`])):B(``,!0),H(b9,{is:`div`,breadcrumb:e.breadcrumb,compact:``,description:e.collapsableItems?``:e.parameter.description,eventBus:e.eventBus,hideWriteOnly:!0,modelName:s.value,name:e.collapsableItems?``:e.name,noncollapsible:!0,options:{hideWriteOnly:!0,orderRequiredPropertiesFirst:e.options.orderRequiredPropertiesFirst,orderSchemaPropertiesBy:e.options.orderSchemaPropertiesBy},required:`required`in e.parameter&&e.parameter.required,schema:c.value},null,8,[`breadcrumb`,`description`,`eventBus`,`modelName`,`name`,`options`,`required`,`schema`])]),_:1},8,[`static`])]),_:1})]))}}),[[`__scopeId`,`data-v-bd50387f`]]);W();var HSn={key:0,class:`mt-6`},USn=[`id`],WSn=[`aria-labelledby`],B9=N({__name:`ParameterList`,props:{parameters:{},breadcrumb:{},eventBus:{},collapsableItems:{type:Boolean},options:{}},setup(e){let t=Sr();return(n,r)=>e.parameters?.length?(F(),I(`div`,HSn,[R(`div`,{id:j(t),class:`text-c-1 mt-3 mb-3 text-lg leading-[1.45] font-medium`},[P(n.$slots,`title`)],8,USn),R(`ul`,{"aria-labelledby":j(t),class:`mb-3 list-none p-0 text-sm`},[(F(!0),I(V,null,Ar(e.parameters,t=>(F(),L(VSn,{key:t.name,breadcrumb:e.breadcrumb,collapsableItems:e.collapsableItems,eventBus:e.eventBus,name:t.name,options:e.options,parameter:t},null,8,[`breadcrumb`,`collapsableItems`,`eventBus`,`name`,`options`,`parameter`]))),128))],8,WSn)])):B(``,!0)}});W(),kE(),zE();var GSn={key:0,"aria-label":`Request Body`,class:`request-body`,role:`group`},KSn={class:`request-body-header`},qSn={class:`request-body-title`},JSn={key:0,class:`text-c-2 text-xs leading-none font-normal`,"data-testid":`request-body-schema-name`},YSn={class:`flex items-center gap-2`},XSn={key:0,class:`request-body-required`},ZSn={key:0,class:`request-body-description`},QSn={key:0,class:`request-body-schema`},$Sn={key:1,class:`request-body-schema`},V9=12,eCn=U7(N({__name:`RequestBody`,props:Lr({breadcrumb:{},requestBody:{},eventBus:{},options:{}},{selectedContentType:{default:`application/json`},selectedContentTypeModifiers:{}}),emits:[`update:selectedContentType`],setup(e){let t=U(()=>Object.keys(e.requestBody?.content??{})),n=Ur(e,`selectedContentType`);e.requestBody?.content&&t.value[0]&&(n.value=t.value[0]);let r=U(()=>e.requestBody?.content?.[n.value]?.schema),i=U(()=>RE(r.value)),a=U(()=>(r.value&&g9(r.value))??null),o=U(()=>{if(!i.value||!l9(i.value))return null;let t=Qyn(i.value,i.value.discriminator,{hideReadOnly:!0,orderSchemaPropertiesBy:e.options.orderSchemaPropertiesBy,orderRequiredPropertiesFirst:e.options.orderRequiredPropertiesFirst});if(t.length<=V9)return null;let{properties:n,...r}=i.value;return n?{visibleProperties:{...r,properties:Zyn(t.slice(0,V9),n)},collapsedProperties:{...r,properties:Zyn(t.slice(V9),n)}}:null}),s=U(()=>Object.keys(e.requestBody?.content??{}).length>0||e.requestBody?.description||e.requestBody?.required);return(t,r)=>e.requestBody&&s.value?(F(),I(`div`,GSn,[R(`div`,KSn,[R(`div`,qSn,[P(t.$slots,`title`,{},void 0,!0),a.value?(F(),I(`span`,JSn,[r[2]||=R(`span`,{class:`text-c-3 mx-1.5`},`·`,-1),e.eventBus&&a.value.schemaKey?(F(),L(_9,{key:0,onClick:r[0]||=t=>e.eventBus.emit(`scroll-to:model-by-name`,{name:a.value.schemaKey})},{default:M(()=>[z(k(a.value.label),1)]),_:1})):(F(),I(V,{key:1},[z(k(a.value.label),1)],64))])):B(``,!0)]),R(`div`,YSn,[e.requestBody.required?(F(),I(`div`,XSn,` required `)):B(``,!0),H(NSn,{modelValue:n.value,"onUpdate:modelValue":r[1]||=e=>n.value=e,content:e.requestBody.content},null,8,[`modelValue`,`content`])]),e.requestBody.description?(F(),I(`div`,ZSn,[H(j(qT),{value:e.requestBody.description},null,8,[`value`])])):B(``,!0)]),o.value?(F(),I(`div`,QSn,[H(j(x9),{breadcrumb:e.breadcrumb,compact:``,compositionPath:[`requestBody`],eventBus:e.eventBus,name:`Request Body`,noncollapsible:``,options:{hideReadOnly:!0,orderRequiredPropertiesFirst:e.options.orderRequiredPropertiesFirst,orderSchemaPropertiesBy:e.options.orderSchemaPropertiesBy},schema:o.value.visibleProperties,schemaContext:`requestBody`},null,8,[`breadcrumb`,`eventBus`,`options`,`schema`]),H(j(x9),{additionalProperties:``,breadcrumb:e.breadcrumb,compact:``,compositionPath:[`requestBody`],eventBus:e.eventBus,hideDescription:``,name:`Request Body`,options:{hideReadOnly:!0,orderRequiredPropertiesFirst:e.options.orderRequiredPropertiesFirst,orderSchemaPropertiesBy:e.options.orderSchemaPropertiesBy},schema:o.value.collapsedProperties,schemaContext:`requestBody`},null,8,[`breadcrumb`,`eventBus`,`options`,`schema`])])):i.value?(F(),I(`div`,$Sn,[H(j(x9),{breadcrumb:e.breadcrumb,compact:``,compositionPath:[`requestBody`],eventBus:e.eventBus,hideReadOnly:!0,name:`Request Body`,noncollapsible:``,options:{hideReadOnly:!0,orderRequiredPropertiesFirst:e.options.orderRequiredPropertiesFirst,orderSchemaPropertiesBy:e.options.orderSchemaPropertiesBy},schema:i.value,schemaContext:`requestBody`},null,8,[`breadcrumb`,`eventBus`,`options`,`schema`])])):B(``,!0)])):B(``,!0)}}),[[`__scopeId`,`data-v-e475e108`]]);W(),zE();var H9=N({__name:`OperationParameters`,props:Lr({breadcrumb:{},parameters:{default:()=>[]},requestBody:{},eventBus:{},options:{}},{selectedContentType:{},selectedContentTypeModifiers:{}}),emits:[`update:selectedContentType`],setup(e){let t=Ur(e,`selectedContentType`),n=U(()=>(e.parameters??[]).reduce((e,t)=>{let n=RE(t);return MSn(n)||jSn(n).forEach(t=>{e[t.in].push(t)}),e},{cookie:[],header:[],path:[],query:[]}));return(r,i)=>(F(),I(V,null,[H(B9,{breadcrumb:e.breadcrumb?[...e.breadcrumb,`path`]:void 0,eventBus:e.eventBus,options:e.options,parameters:n.value.path},{title:M(()=>[...i[1]||=[z(`Path Parameters`,-1)]]),_:1},8,[`breadcrumb`,`eventBus`,`options`,`parameters`]),H(B9,{breadcrumb:e.breadcrumb?[...e.breadcrumb,`query`]:void 0,eventBus:e.eventBus,options:e.options,parameters:n.value.query},{title:M(()=>[...i[2]||=[z(`Query Parameters`,-1)]]),_:1},8,[`breadcrumb`,`eventBus`,`options`,`parameters`]),H(B9,{breadcrumb:e.breadcrumb?[...e.breadcrumb,`headers`]:void 0,eventBus:e.eventBus,options:e.options,parameters:n.value.header},{title:M(()=>[...i[3]||=[z(`Headers`,-1)]]),_:1},8,[`breadcrumb`,`eventBus`,`options`,`parameters`]),H(B9,{breadcrumb:e.breadcrumb?[...e.breadcrumb,`cookies`]:void 0,eventBus:e.eventBus,options:e.options,parameters:n.value.cookie},{title:M(()=>[...i[4]||=[z(`Cookies`,-1)]]),_:1},8,[`breadcrumb`,`eventBus`,`options`,`parameters`]),e.requestBody?(F(),L(eCn,{key:0,selectedContentType:t.value,"onUpdate:selectedContentType":i[0]||=e=>t.value=e,breadcrumb:e.breadcrumb?[...e.breadcrumb,`body`]:void 0,eventBus:e.eventBus,options:e.options,requestBody:e.requestBody},{title:M(()=>[...i[5]||=[z(`Body`,-1)]]),_:1},8,[`selectedContentType`,`breadcrumb`,`eventBus`,`options`,`requestBody`])):B(``,!0)],64))}});W(),zE();var tCn={key:0,class:`mt-6`},nCn={"aria-label":`Responses`,class:`mb-3 list-none p-0 text-sm`},U9=N({__name:`OperationResponses`,props:{responses:{},breadcrumb:{},collapsableItems:{type:Boolean},eventBus:{},options:{}},setup(e){return(t,n)=>Object.keys(e.responses??{}).length?(F(),I(`div`,tCn,[n[0]||=R(`div`,{class:`text-c-1 mt-3 mb-3 leading-[1.45] font-medium`},`Responses`,-1),R(`ul`,nCn,[(F(!0),I(V,null,Ar(e.responses,(t,n)=>(F(),L(VSn,{key:n,breadcrumb:e.breadcrumb,collapsableItems:e.collapsableItems,eventBus:e.eventBus,name:n,options:e.options,parameter:j(RE)(t)},null,8,[`breadcrumb`,`collapsableItems`,`eventBus`,`name`,`options`,`parameter`]))),128))])])):B(``,!0)}});W(),Ou(),zE(),VP();var rCn={class:`group callback-list-item`},iCn={class:`font-code bg-b-1 callback-sticky-offset callback-list-item-title sticky flex cursor-pointer flex-row items-start gap-2 border-t py-2.5 text-sm group-open:flex-wrap`},aCn={class:`text-c-1 min-w-0 flex-1 truncate text-sm leading-5 font-bold group-open:whitespace-normal`},oCn={class:`text-c-2 font-normal`},sCn={class:`callback-operation-container flex flex-col gap-2`},cCn=U7(N({__name:`Callback`,props:{callback:{},method:{},name:{},url:{},eventBus:{},options:{}},setup(e){return(t,n)=>(F(),I(`details`,rCn,[R(`summary`,iCn,[H(j(ll),{class:`callback-list-item-icon text-c-3 group-hover:text-c-1 absolute top-3.5 -left-5 size-3 transition-transform duration-100 group-open:rotate-90`,weight:`bold`}),H(j(S9),{as:`span`,class:`request-method py-0.75 font-bold`,method:e.method},null,8,[`method`]),R(`div`,aCn,[z(k(e.name)+` `,1),R(`span`,oCn,k(e.url),1)])]),R(`div`,sCn,[H(H9,{eventBus:e.eventBus,options:e.options,parameters:e.callback.parameters?.map(e=>j(RE)(e))??[],requestBody:j(RE)(e.callback.requestBody)},null,8,[`eventBus`,`options`,`parameters`,`requestBody`]),H(U9,{collapsableItems:!1,eventBus:e.eventBus,options:e.options,responses:e.callback.responses},null,8,[`eventBus`,`options`,`responses`])])]))}}),[[`__scopeId`,`data-v-12fe1373`]]);W(),B2(),pI(),zE();var lCn={"aria-label":`Callbacks`,class:`callbacks-list gap-3`,role:`group`},uCn=N({__name:`Callbacks`,props:{path:{},callbacks:{},eventBus:{},options:{}},setup(e){let t=U(()=>{let t=[];return fI(e.callbacks).forEach(([e,n])=>{fI(RE(n)).forEach(([n,r])=>{typeof r!=`object`||!r||fI(r).forEach(([r,i])=>{z2(r)&&t.push({name:e,url:n,method:r,callback:i})})})}),t});return(n,r)=>(F(),I(`div`,lCn,[r[0]||=R(`div`,{class:`callbacks-title text-c-1 my-3 text-lg font-medium`},` Callbacks `,-1),(F(!0),I(V,null,Ar(t.value,({callback:t,method:n,name:r,url:i})=>(F(),L(cCn,{key:`${r}-${i}-${n}`,callback:t,eventBus:e.eventBus,method:n,name:r,options:e.options,path:e.path,url:i},null,8,[`callback`,`eventBus`,`method`,`name`,`options`,`path`,`url`]))),128))]))}});W();var dCn={key:0},fCn={key:1},W9=N({__name:`SecurityRequirementBadgeScheme`,props:{is:{default:`li`},scheme:{}},setup(e){return(t,n)=>(F(),L(kr(e.is),{class:`markdown`},{default:M(()=>[z(k(e.scheme.name)+` `,1),e.scheme.scheme?.type?(F(),I(`code`,dCn,k(e.scheme.scheme.type),1)):B(``,!0),e.scheme.scopes.length?(F(),I(`ul`,fCn,[(F(!0),I(V,null,Ar(e.scheme.scopes,e=>(F(),I(`li`,{key:e,class:`font-code text-c-2`},k(e),1))),128))])):B(``,!0)]),_:1}))}});W(),kE(),Ou();var pCn={key:2},mCn={class:`flex max-w-xs min-w-48 flex-col gap-1.5 p-2 text-sm`},hCn={class:`font-medium`},gCn={key:0,class:`contents`},_Cn={key:1,class:`contents`},vCn={key:1,class:`contents`},yCn=N({__name:`SecurityRequirementBadge`,props:{requiredSecurity:{},hideLabel:{type:Boolean,default:!1}},setup(e){let t=U(()=>e.requiredSecurity.state===`required`?`Auth Required`:`Auth Optional`),n=U(()=>e.requiredSecurity.state===`required`?`Requires`:`Accepts`),r=U(()=>e.requiredSecurity.requirements.length===1&&e.requiredSecurity.requirements[0]?.schemes.length===1),i=U(()=>e.requiredSecurity.requirements.length===1&&(e.requiredSecurity.requirements[0]?.schemes.length??0)>1),a=U(()=>e.requiredSecurity.requirements.length>1);return(o,s)=>e.requiredSecurity.state===`none`?B(``,!0):(F(),L(j(iE),{key:0,placement:`bottom-end`},{popover:M(()=>[R(`div`,mCn,[R(`div`,hCn,[z(k(n.value)+` `,1),r.value?(F(),L(W9,{key:0,is:`span`,class:`contents`,scheme:e.requiredSecurity.requirements[0].schemes[0]},null,8,[`scheme`])):a.value?(F(),I(V,{key:1},[z(`one of:`)],64)):i.value?(F(),I(V,{key:2},[z(`all of:`)],64)):(F(),I(V,{key:3},[z(`authentication`)],64))]),a.value?(F(),I(`ul`,gCn,[(F(!0),I(V,null,Ar(e.requiredSecurity.requirements,(e,t)=>(F(),I(`li`,{key:t,class:`markdown`},[e.schemes.length===1?(F(),L(W9,{key:0,is:`span`,class:`contents`,scheme:e.schemes[0]},null,8,[`scheme`])):(F(),I(`ul`,_Cn,[(F(!0),I(V,null,Ar(e.schemes,(e,t)=>(F(),L(W9,{key:t,scheme:e},null,8,[`scheme`]))),128))]))]))),128))])):i.value?(F(),I(`ul`,vCn,[(F(!0),I(V,null,Ar(e.requiredSecurity.requirements[0].schemes,(e,t)=>(F(),L(W9,{key:t,scheme:e},null,8,[`scheme`]))),128))])):B(``,!0)])]),default:M(()=>[R(`button`,{class:O([`security-requirement-badge inline-flex w-fit items-center justify-center gap-1 text-sm`,e.requiredSecurity.state===`optional`?`text-c-2`:`text-c-1 font-medium`]),type:`button`,onClick:s[0]||=po(()=>{},[`stop`])},[e.requiredSecurity.state===`required`?(F(),L(j(_u),{key:0,class:`size-3`,weight:`bold`})):(F(),L(j(sfe),{key:1,class:`size-3`,weight:`bold`})),e.hideLabel?B(``,!0):(F(),I(`span`,pCn,k(t.value),1))],2)]),_:1}))}}),G9;(function(e){e.Deprecated=`deprecated`,e.Experimental=`experimental`,e.Stable=`stable`})(G9||={});var bCn=e=>e.deprecated||e[`x-scalar-stability`]===G9.Deprecated,K9=e=>e.deprecated?G9.Deprecated:e[`x-scalar-stability`],xCn=e=>{switch(K9(e)){case G9.Deprecated:return`text-red`;case G9.Experimental:return`text-orange`;case G9.Stable:return`text-green`;default:return``}};W(),Ou();var SCn=[`method`],CCn=U7(N({__name:`TestRequestButton`,props:{id:{},method:{},path:{},eventBus:{},exampleName:{},requestBodyCompositionSelection:{}},setup(e){let t=()=>{let t={id:e.id,...e.exampleName&&{exampleName:e.exampleName},...e.requestBodyCompositionSelection&&Object.keys(e.requestBodyCompositionSelection).length>0&&{requestBodyCompositionSelection:e.requestBodyCompositionSelection}};e.eventBus.emit(`ui:open:client-modal`,t)};return(n,r)=>(F(),I(`button`,{class:`show-api-client-button`,method:e.method,type:`button`,onClick:po(t,[`stop`])},[H(j(bu),{class:`size-3`,weight:`fill`}),r[0]||=R(`span`,null,`Test Request`,-1),H(t9,null,{default:M(()=>[z(`(`+k(e.method)+` `+k(e.path)+`)`,1)]),_:1})],8,SCn))}}),[[`__scopeId`,`data-v-15e312d9`]]);W();var q9=N({__name:`XBadges`,props:{position:{},badges:{}},setup(e){let t=U(()=>Array.isArray(e.badges)?e.badges.filter(t=>t.position===e.position||e.position===`after`&&!t.position):[]);return(e,n)=>t.value.length?(F(!0),I(V,{key:0},Ar(t.value,e=>(F(),L(j(K7),{key:e.name,color:e.color},{default:M(()=>[z(k(e.name),1)]),_:2},1032,[`color`]))),128)):B(``,!0)}});W(),kE(),Ou(),j2(),zE();var wCn={class:`operation-title`},TCn={class:`operation-details`},ECn={class:`endpoint-label`},DCn={class:`endpoint-label-path`},OCn={class:`endpoint-label-name`},kCn={key:1,class:`font-code text-sm`},ACn={class:`endpoint-content`},jCn={class:`operation-details-card`},MCn={key:0,class:`operation-details-card-item`},NCn={class:`operation-details-card-item`},PCn={class:`operation-details-card-item`},FCn={key:1,class:`operation-details-card-item`},ICn=U7(N({__name:`ClassicLayout`,props:{id:{},method:{},options:{},path:{},clientOptions:{},isCollapsed:{type:Boolean},isWebhook:{type:Boolean},selectedClient:{},eventBus:{},operation:{},selectedServer:{},selectedSecuritySchemes:{},requiredSecurity:{}},setup(e){let t=U(()=>e.operation.summary||e.path||``),n=U(()=>r9(e.operation)),r=A(``),i=A(),a=A({}),o=U(()=>({...a.value})),s=U(()=>JSON.stringify(o.value));dr(d9,a);let{copyToClipboard:c}=A2();return(a,l)=>(F(),L(j(Fvn),{id:e.id,"aria-label":t.value,class:`reference-endpoint`,modelValue:!e.isCollapsed,transparent:``,"onUpdate:modelValue":l[4]||=t=>e.eventBus?.emit(`toggle:nav-item`,{id:e.id,open:t})},jr({title:M(()=>[R(`div`,wCn,[R(`div`,TCn,[H(j(S9),{class:`endpoint-type`,method:e.method,short:``},null,8,[`method`]),H(j(n9),{class:`endpoint-anchor`,onCopyAnchorUrl:l[0]||=()=>e.eventBus?.emit(`copy-url:nav-item`,{id:e.id})},{default:M(()=>[R(`h3`,ECn,[R(`div`,DCn,[H(uSn,{deprecated:j(bCn)(e.operation),path:e.path},null,8,[`deprecated`,`path`])]),R(`div`,OCn,k(t.value),1),j(K9)(e.operation)?(F(),L(j(K7),{key:0,class:O([`capitalize`,j(xCn)(e.operation)])},{default:M(()=>[z(k(j(K9)(e.operation)),1)]),_:1},8,[`class`])):B(``,!0),e.isWebhook?(F(),L(j(K7),{key:1,class:`font-code text-green flex w-fit items-center justify-center gap-1`},{default:M(()=>[H(j(Eu),{weight:`bold`}),l[5]||=z(`Webhook `,-1)]),_:1})):B(``,!0),H(j(q9),{badges:e.operation[`x-badges`],position:`before`},null,8,[`badges`])])]),_:1})])])]),actions:M(({active:t})=>[H(yCn,{hideLabel:``,requiredSecurity:e.requiredSecurity},null,8,[`requiredSecurity`]),H(j(q9),{badges:e.operation[`x-badges`],position:`after`},null,8,[`badges`]),e.options.hideTestRequestButton?B(``,!0):(F(),I(V,{key:0},[t&&!e.isWebhook?(F(),L(j(CCn),{key:0,id:e.id,eventBus:e.eventBus,exampleName:r.value,method:e.method,path:e.path,requestBodyCompositionSelection:o.value},null,8,[`id`,`eventBus`,`exampleName`,`method`,`path`,`requestBodyCompositionSelection`])):(F(),L(j(bu),{key:1,class:`endpoint-try-hint size-4.5`}))],64)),e.options.showOperationId&&e.operation.operationId?(F(),I(`span`,kCn,k(e.operation.operationId),1)):B(``,!0),H(j(GT),{class:`endpoint-copy p-0.5`,icon:j(Vl),label:`Copy endpoint URL`,size:`xs`,variant:`ghost`,onClick:l[1]||=po(t=>j(c)(e.path),[`stop`])},null,8,[`icon`])]),default:M(()=>[R(`div`,ACn,[R(`div`,jCn,[Object.keys(n.value).length>0?(F(),I(`div`,MCn,[H(a9,{value:n.value},null,8,[`value`])])):B(``,!0),R(`div`,NCn,[H(H9,{selectedContentType:i.value,"onUpdate:selectedContentType":l[2]||=e=>i.value=e,eventBus:e.eventBus,options:e.options,parameters:e.operation.parameters,requestBody:j(RE)(e.operation.requestBody)},null,8,[`selectedContentType`,`eventBus`,`options`,`parameters`,`requestBody`])]),R(`div`,PCn,[H(U9,{eventBus:e.eventBus,options:e.options,responses:e.operation.responses},null,8,[`eventBus`,`options`,`responses`])]),e.operation?.callbacks?(F(),I(`div`,FCn,[H(uCn,{callbacks:e.operation.callbacks,eventBus:e.eventBus,options:e.options,path:e.path},null,8,[`callbacks`,`eventBus`,`options`,`path`])])):B(``,!0)]),e.operation.responses?(F(),L(j(ESn),{key:0,class:`operation-example-card`,responses:e.operation.responses},null,8,[`responses`])):B(``,!0),R(`div`,null,[e.operation.externalDocs?(F(),L(j(o9),{key:0},{default:M(()=>[H(j(s9),{value:e.operation.externalDocs},null,8,[`value`])]),_:1})):B(``,!0),H(j(aC),null,{default:M(()=>[(F(),L(j(mvn),{key:s.value,selectedExample:r.value,"onUpdate:selectedExample":l[3]||=e=>r.value=e,class:`operation-example-card`,clientOptions:e.clientOptions,eventBus:e.eventBus,fallback:``,isWebhook:e.isWebhook,method:e.method,operation:e.operation,path:e.path,requestBodyCompositionSelection:o.value,securitySchemes:e.selectedSecuritySchemes,selectedClient:e.selectedClient,selectedContentType:i.value,selectedServer:e.selectedServer},null,8,[`selectedExample`,`clientOptions`,`eventBus`,`isWebhook`,`method`,`operation`,`path`,`requestBodyCompositionSelection`,`securitySchemes`,`selectedClient`,`selectedContentType`,`selectedServer`]))]),_:1})])])]),_:2},[e.operation.description?{name:`description`,fn:M(()=>[H(j(qT),{anchorPrefix:e.id,"aria-label":`Operation Description`,role:`group`,transformType:`heading`,value:e.operation.description,withAnchors:``,withImages:``},null,8,[`anchorPrefix`,`value`])]),key:`0`}:void 0]),1032,[`id`,`aria-label`,`modelValue`]))}}),[[`__scopeId`,`data-v-8f643b1c`]]);W(),Ou();var LCn={class:`ask-agent-scalar-send`,type:`submit`},RCn=U7(N({__name:`AskAgentButton`,setup(e){let t=h6(),n=A(``),r=A();function i(){t.value?.openAgent(n.value),n.value=``}return(e,a)=>j(t)?.agentEnabled.value?(F(),I(`form`,{key:0,class:`agent-button-container`,onClick:a[1]||=e=>r.value?.focus(),onSubmit:a[2]||=po(e=>i(),[`prevent`])},[H(j(Su),{class:`size-3 shrink-0`,weight:`fill`}),a[3]||=R(`div`,{class:`ask-agent-scalar-input-label`},`Ask AI Agent`,-1),lr(R(`input`,{ref_key:`inputRef`,ref:r,"onUpdate:modelValue":a[0]||=e=>n.value=e,class:O([`ask-agent-scalar-input`,{"ask-agent-scalar-input-not-empty":n.value.length>0}]),placeholder:`Ask AI Agent`},null,2),[[lo,n.value]]),R(`button`,LCn,[H(j(Uc),{class:`size-3`,weight:`bold`})])],32)):B(``,!0)}}),[[`__scopeId`,`data-v-78f5377c`]]);W(),kE(),Ou(),zE();var zCn={class:`flex flex-row justify-between gap-1`},BCn={class:`flex gap-1`},VCn={class:`flex gap-1`},HCn={class:`operation-header`},UCn={class:`operation-details`},WCn={class:`examples`},GCn={class:`flex`},KCn=U7(N({__name:`ModernLayout`,props:{id:{},method:{},options:{},path:{},clientOptions:{},isWebhook:{type:Boolean},selectedClient:{},eventBus:{},operation:{},selectedServer:{},selectedSecuritySchemes:{},requiredSecurity:{}},setup(e){let t=U(()=>e.operation.summary||e.path||``),n=Sr(),r=U(()=>r9(e.operation)),i=A(),a=A({}),o=U(()=>({...a.value})),s=U(()=>JSON.stringify(o.value));return dr(d9,a),(a,c)=>(F(),L(j(J7),{id:e.id,"aria-labelledby":j(n),label:t.value,tabindex:`-1`,onIntersecting:c[2]||=()=>e.eventBus?.emit(`intersecting:nav-item`,{id:e.id})},{default:M(()=>[H(j(Q7),null,{default:M(()=>[R(`div`,zCn,[R(`div`,BCn,[e.options?.showOperationId&&e.operation.operationId?(F(),L(j(K7),{key:0},{default:M(()=>[z(k(e.operation.operationId),1)]),_:1})):B(``,!0),j(K9)(e.operation)?(F(),L(j(K7),{key:1,class:O([`capitalize`,j(xCn)(e.operation)])},{default:M(()=>[z(k(j(K9)(e.operation)),1)]),_:1},8,[`class`])):B(``,!0),e.isWebhook?(F(),L(j(K7),{key:2,class:`font-code text-green flex w-fit items-center justify-center gap-1`},{default:M(()=>[H(j(Eu),{weight:`bold`}),c[3]||=z(`Webhook `,-1)]),_:1})):B(``,!0),H(j(q9),{badges:e.operation[`x-badges`],position:`before`},null,8,[`badges`])]),R(`div`,VCn,[H(j(q9),{badges:e.operation[`x-badges`],position:`after`},null,8,[`badges`])])]),R(`div`,HCn,[R(`div`,{class:O(j(bCn)(e.operation)&&`deprecated`)},[H(j($7),{removeMargin:``},{default:M(()=>[H(j(n9),{onCopyAnchorUrl:c[0]||=()=>e.eventBus?.emit(`copy-url:nav-item`,{id:e.id})},{default:M(()=>[H(j(e9),{id:j(n),level:3},{default:M(()=>[z(k(t.value),1)]),_:1},8,[`id`])]),_:1})]),_:1})],2),H(yCn,{requiredSecurity:e.requiredSecurity},null,8,[`requiredSecurity`])]),H(j(X7),null,{default:M(()=>[H(j(Y7),null,{default:M(()=>[R(`div`,UCn,[H(a9,{value:r.value},null,8,[`value`]),H(j(qT),{anchorPrefix:e.id,"aria-label":`Operation Description`,role:`group`,transformType:`heading`,value:e.operation.description,withAnchors:``,withImages:``},null,8,[`anchorPrefix`,`value`]),H(H9,{selectedContentType:i.value,"onUpdate:selectedContentType":c[1]||=e=>i.value=e,breadcrumb:[e.id],eventBus:e.eventBus,options:e.options,parameters:e.operation.parameters,requestBody:j(RE)(e.operation.requestBody)},null,8,[`selectedContentType`,`breadcrumb`,`eventBus`,`options`,`parameters`,`requestBody`]),H(U9,{breadcrumb:[e.id],collapsableItems:!e.options.expandAllResponses,eventBus:e.eventBus,options:e.options,responses:e.operation.responses},null,8,[`breadcrumb`,`collapsableItems`,`eventBus`,`options`,`responses`]),H(j(aC),null,{default:M(()=>[e.operation.callbacks?(F(),L(uCn,{key:0,callbacks:e.operation.callbacks,class:`mt-6`,eventBus:e.eventBus,options:e.options,path:e.path},null,8,[`callbacks`,`eventBus`,`options`,`path`])):B(``,!0)]),_:1})])]),_:1}),H(j(Y7),null,{default:M(()=>[R(`div`,WCn,[e.operation.externalDocs?(F(),L(j(o9),{key:0},{default:M(()=>[H(j(s9),{value:e.operation.externalDocs},null,8,[`value`])]),_:1})):B(``,!0),H(j(aC),null,{default:M(()=>[(F(),L(j(mvn),{key:s.value,clientOptions:e.clientOptions,eventBus:e.eventBus,fallback:``,isWebhook:e.isWebhook,method:e.method,operation:e.operation,path:e.path,requestBodyCompositionSelection:o.value,securitySchemes:e.selectedSecuritySchemes,selectedClient:e.selectedClient,selectedContentType:i.value,selectedServer:e.selectedServer},jr({header:M(()=>[H(uSn,{class:`font-code text-c-2 [&_em]:text-c-1 min-w-0 [&_em]:not-italic`,deprecated:e.operation?.deprecated,path:e.path},null,8,[`deprecated`,`path`])]),_:2},[e.isWebhook?void 0:{name:`footer`,fn:M(({exampleName:t})=>[R(`div`,GCn,[H(RCn),e.options.hideTestRequestButton?B(``,!0):(F(),L(j(CCn),{key:0,id:e.id,eventBus:e.eventBus,exampleName:t,method:e.method,path:e.path,requestBodyCompositionSelection:o.value},null,8,[`id`,`eventBus`,`exampleName`,`method`,`path`,`requestBodyCompositionSelection`]))])]),key:`0`}]),1032,[`clientOptions`,`eventBus`,`isWebhook`,`method`,`operation`,`path`,`requestBodyCompositionSelection`,`securitySchemes`,`selectedClient`,`selectedContentType`,`selectedServer`]))]),_:1}),H(j(aC),null,{default:M(()=>[e.operation.responses?(F(),L(j(ESn),{key:0,responses:e.operation.responses,style:{"margin-top":`12px`}},null,8,[`responses`])):B(``,!0)]),_:1})])]),_:1})]),_:1})]),_:1})]),_:1},8,[`id`,`aria-labelledby`,`label`]))}}),[[`__scopeId`,`data-v-1f2d95d2`]]);W(),zE(),QI();var qCn=N({__name:`Operation`,props:{id:{},method:{},options:{},document:{},path:{},pathValue:{},server:{},securitySchemes:{},clientOptions:{},isCollapsed:{type:Boolean},isWebhook:{type:Boolean},selectedClient:{},eventBus:{},authStore:{}},setup(e){let t=U(()=>{let t=RE(e.pathValue?.[e.method]);if(!t)return null;let n=AI(e.pathValue?.parameters,t.parameters);return{...t,parameters:n}}),n=U(()=>sSn(t.value?.servers??null,e.pathValue?.servers??null,e.server)),r=U(()=>cSn(t.value,e.document)),i=U(()=>oSn(e.document,t.value,e.authStore.getAuthSelectedSchemas({type:`document`,documentName:e.document?.[`x-scalar-navigation`]?.name??``}),e.authStore.getAuthSelectedSchemas({type:`operation`,documentName:e.document?.[`x-scalar-navigation`]?.name??``,path:e.path,method:e.method}),e.securitySchemes));return(a,o)=>t.value?(F(),I(V,{key:0},[e.options.layout===`classic`?(F(),L(ICn,{key:0,id:e.id,clientOptions:e.clientOptions,eventBus:e.eventBus,isCollapsed:e.isCollapsed,isWebhook:e.isWebhook,method:e.method,operation:t.value,options:e.options,path:e.path,requiredSecurity:r.value,selectedClient:e.selectedClient,selectedSecuritySchemes:i.value,selectedServer:n.value},null,8,[`id`,`clientOptions`,`eventBus`,`isCollapsed`,`isWebhook`,`method`,`operation`,`options`,`path`,`requiredSecurity`,`selectedClient`,`selectedSecuritySchemes`,`selectedServer`])):(F(),L(KCn,{key:1,id:e.id,clientOptions:e.clientOptions,eventBus:e.eventBus,isWebhook:e.isWebhook,method:e.method,operation:t.value,options:e.options,path:e.path,requiredSecurity:r.value,selectedClient:e.selectedClient,selectedSecuritySchemes:i.value,selectedServer:n.value},null,8,[`id`,`clientOptions`,`eventBus`,`isWebhook`,`method`,`operation`,`options`,`path`,`requiredSecurity`,`selectedClient`,`selectedSecuritySchemes`,`selectedServer`]))],64)):B(``,!0)}});W(),zE();var JCn=N({__name:`TraversedEntry`,props:{authStore:{},level:{default:0},entries:{},document:{},clientOptions:{},options:{},selectedServer:{},securitySchemes:{},selectedClient:{},expandedItems:{},eventBus:{}},setup(e){let t=e=>e.type===`tag`&&e.isGroup===!0,n=e=>e.type===`tag`&&!t(e)&&e.id!==`models`,r=e=>e.type===`operation`,i=e=>e.type===`webhook`,a=e=>e.type===`models`,o=e=>e.type===`model`;function s(t){return i(t)?e.document.webhooks?.[t.name]:e.document.paths?.[t.path]}return(c,l)=>{let u=$te(`TraversedEntry`,!0);return F(!0),I(V,null,Ar(e.entries,c=>(F(),L(aSn,{id:c.id,key:`${c.id}-${e.options.layout}`,expanded:!!e.expandedItems[c.id]},{default:M(()=>[r(c)||i(c)?(F(),L(j(Z7),{key:0,omit:e.level!==0},{default:M(()=>[H(j(qCn),{id:c.id,authStore:e.authStore,clientOptions:e.clientOptions,document:e.document,eventBus:e.eventBus,isCollapsed:!e.expandedItems[c.id],isWebhook:i(c),method:c.method,options:e.options,path:i(c)?c.name:c.path,pathValue:s(c),securitySchemes:e.securitySchemes,selectedClient:e.selectedClient,server:e.selectedServer},null,8,[`id`,`authStore`,`clientOptions`,`document`,`eventBus`,`isCollapsed`,`isWebhook`,`method`,`options`,`path`,`pathValue`,`securitySchemes`,`selectedClient`,`server`])]),_:2},1032,[`omit`])):n(c)||t(c)&&e.options.layout===`classic`?(F(),L(j(Pxn),{key:1,eventBus:e.eventBus,isCollapsed:!e.expandedItems[c.id],isLoading:!1,layout:e.options.layout,moreThanOneTag:e.entries.filter(n).length>1,tag:c},{default:M(()=>[`children`in c&&c.children?.length?(F(),L(u,{key:0,authStore:e.authStore,clientOptions:e.clientOptions,document:e.document,entries:c.children,eventBus:e.eventBus,expandedItems:e.expandedItems,level:e.level+1,options:e.options,securitySchemes:e.securitySchemes,selectedClient:e.selectedClient,selectedServer:e.selectedServer},null,8,[`authStore`,`clientOptions`,`document`,`entries`,`eventBus`,`expandedItems`,`level`,`options`,`securitySchemes`,`selectedClient`,`selectedServer`])):B(``,!0)]),_:2},1032,[`eventBus`,`isCollapsed`,`layout`,`moreThanOneTag`,`tag`])):t(c)?(F(),L(u,{key:2,authStore:e.authStore,clientOptions:e.clientOptions,document:e.document,entries:c.children||[],eventBus:e.eventBus,expandedItems:e.expandedItems,level:e.level+1,options:e.options,securitySchemes:e.securitySchemes,selectedClient:e.selectedClient,selectedServer:e.selectedServer},null,8,[`authStore`,`clientOptions`,`document`,`entries`,`eventBus`,`expandedItems`,`level`,`options`,`securitySchemes`,`selectedClient`,`selectedServer`])):a(c)&&e.document.components?.schemas?(F(),L(Exn,{key:3,id:c.id,eventBus:e.eventBus,isCollapsed:!e.expandedItems[c.id],layout:e.options.layout},{default:M(()=>[H(u,{authStore:e.authStore,clientOptions:e.clientOptions,document:e.document,entries:c.children||[],eventBus:e.eventBus,expandedItems:e.expandedItems,level:e.level+1,options:e.options,securitySchemes:e.securitySchemes,selectedClient:e.selectedClient,selectedServer:e.selectedServer},null,8,[`authStore`,`clientOptions`,`document`,`entries`,`eventBus`,`expandedItems`,`level`,`options`,`securitySchemes`,`selectedClient`,`selectedServer`])]),_:2},1032,[`id`,`eventBus`,`isCollapsed`,`layout`])):o(c)&&e.document.components?.schemas?.[c.name]?(F(),L(Cxn,{key:4,id:c.id,eventBus:e.eventBus,isCollapsed:!e.expandedItems[c.id],name:c.name,options:e.options,schema:j(RE)(e.document.components.schemas[c.name])},null,8,[`id`,`eventBus`,`isCollapsed`,`name`,`options`,`schema`])):B(``,!0)]),_:2},1032,[`id`,`expanded`]))),128)}}});W(),kE();var YCn={key:0,class:`plugin-view`},XCn=N({__name:`RenderPlugins`,props:{viewName:{},options:{}},setup(e){let{getViewComponents:t}=oyn(),n=t(e.viewName);return(t,r)=>j(n).length?(F(),I(`div`,YCn,[(F(!0),I(V,null,Ar(j(n),(t,n)=>(F(),L(j(aC),{key:n},{default:M(()=>[t.renderer?(F(),L(kr(t.renderer),ai({key:0,ref_for:!0},{component:t.component,options:e.options,...t.props}),null,16)):(F(),L(kr(t.component),ai({key:1,ref_for:!0},{options:e.options,...t.props}),null,16))]),_:2},1024))),128))])):B(``,!0)}});W();var ZCn={},QCn={class:`section-flare`};function $Cn(e,t){return F(),I(`div`,QCn,[...t[0]||=[ti(`<div class="section-flare-item" data-v-5cebff7a></div><div class="section-flare-item" data-v-5cebff7a></div><div class="section-flare-item" data-v-5cebff7a></div><div class="section-flare-item" data-v-5cebff7a></div><div class="section-flare-item" data-v-5cebff7a></div><div class="section-flare-item" data-v-5cebff7a></div><div class="section-flare-item" data-v-5cebff7a></div><div class="section-flare-item" data-v-5cebff7a></div>`,8)]])}var ewn=U7(ZCn,[[`render`,$Cn],[`__scopeId`,`data-v-5cebff7a`]]);W(),b3(),kE(),QI(),OI();var twn={class:`narrow-references-container`},nwn={key:1,class:`h-dvh`},rwn=N({__name:`Content`,props:{infoSectionId:{},options:{},document:{},clientDocument:{},authStore:{},xScalarDefaultClient:{},items:{},expandedItems:{},eventBus:{},environment:{},headingSlugGenerator:{type:Function}},setup(e){let t=U(()=>wR(S4(e.options.hiddenClients))),n=U(()=>EI(e.document)?e.document:void 0),r=U(()=>EI(e.clientDocument)?e.clientDocument:void 0),i=U(()=>Xht(e.document)),a=U(()=>DI(e.document)?e.document[`x-original-aas-version`]??e.document.asyncapi:n.value?.[`x-original-oas-version`]),o=U(()=>r9(e.document)),s=U(()=>r9(e.document?.info)),c=U(()=>XI(e.options?.servers??r.value?.servers,{baseServerUrl:e.options?.baseServerURL,documentUrl:e.clientDocument?.[`x-scalar-original-source-url`]})),l=U(()=>ZI(r.value??null,null,null,c.value)),u=U(()=>YI(r.value?.components?.securitySchemes,e.options.authentication?.securitySchemes,e.authStore,r.value?.[`x-scalar-navigation`]?.name??``));return Hi(()=>{Xxn()}),(r,d)=>(F(),I(V,null,[H(j(ewn)),R(`div`,twn,[P(r.$slots,`start`),H(j(Lyn),{id:e.infoSectionId,documentDownloadType:e.options.documentDownloadType,documentExtensions:o.value,documentType:i.value,documentUrl:e.document?.[`x-scalar-original-source-url`],eventBus:e.eventBus,externalDocs:n.value?.externalDocs,headingSlugGenerator:e.headingSlugGenerator,info:e.document?.info,infoExtensions:s.value,layout:e.options.layout,specificationVersion:a.value},{selectors:M(()=>[H(j(aC),null,{default:M(()=>[c.value?.length?(F(),L(j(c9),{key:0,class:`scalar-reference-intro-server scalar-client introduction-card-item text-base leading-normal [--scalar-address-bar-height:0px]`},{default:M(()=>[H(j(Kyn),{eventBus:e.eventBus,selectedServer:l.value,servers:c.value},null,8,[`eventBus`,`selectedServer`,`servers`])]),_:1})):B(``,!0)]),_:1}),H(j(aC),null,{default:M(()=>[e.document&&!e.options.hideTestRequestButton?(F(),L(j(c9),{key:0,class:`scalar-reference-intro-auth scalar-client introduction-card-item leading-normal`},{default:M(()=>[H(j(qyn),{authStore:e.authStore,document:e.clientDocument,environment:e.environment,eventBus:e.eventBus,options:e.options,securitySchemes:u.value,selectedServer:l.value},null,8,[`authStore`,`document`,`environment`,`eventBus`,`options`,`securitySchemes`,`selectedServer`])]),_:1})):B(``,!0)]),_:1}),H(j(aC),null,{default:M(()=>[t.value.length?(F(),L(j(c9),{key:0,class:`introduction-card-item scalar-reference-intro-clients`},{default:M(()=>[H(j(Evn),{class:`introduction-card-item scalar-reference-intro-clients`,clientOptions:t.value,eventBus:e.eventBus,selectedClient:e.xScalarDefaultClient,xScalarSdkInstallation:n.value?.info?.[`x-scalar-sdk-installation`]},null,8,[`clientOptions`,`eventBus`,`selectedClient`,`xScalarSdkInstallation`])]),_:1})):B(``,!0)]),_:1})]),_:1},8,[`id`,`documentDownloadType`,`documentExtensions`,`documentType`,`documentUrl`,`eventBus`,`externalDocs`,`headingSlugGenerator`,`info`,`infoExtensions`,`layout`,`specificationVersion`]),e.items.length&&n.value?(F(),L(JCn,{key:0,authStore:e.authStore,clientOptions:t.value,document:n.value,entries:e.items,eventBus:e.eventBus,expandedItems:e.expandedItems,options:e.options,securitySchemes:u.value,selectedClient:e.xScalarDefaultClient,selectedServer:l.value},null,8,[`authStore`,`clientOptions`,`document`,`entries`,`eventBus`,`expandedItems`,`options`,`securitySchemes`,`selectedClient`,`selectedServer`])):B(``,!0),H(j(XCn),{options:e.options,viewName:`content.end`},null,8,[`options`]),P(r.$slots,`end`),j(M9)?B(``,!0):(F(),I(`div`,nwn))])],64))}});W(),kE(),Ou();var iwn={class:`flex h-(--scalar-header-height) w-full items-center border-b bg-inherit px-2`},awn={key:1,class:`flex-1 text-sm font-medium whitespace-nowrap`},own={class:`flex h-6 items-center gap-1 pl-1`},swn=N({__name:`MobileHeader`,props:{breadcrumb:{},isSidebarOpen:{type:Boolean},showSidebar:{type:Boolean}},emits:[`toggleSidebar`],setup(e,{emit:t}){let n=t,r=of({base:`lg:hidden items-center bg-b-1 sticky top-(--scalar-custom-header-height,0) z-10 [grid-area:header]`,variants:{open:{true:`h-(--refs-sidebar-height) custom-scrollbar flex flex-col z-50`}}});return(t,i)=>(F(),I(V,null,[P(t.$slots,`sidebar`,at($r({sidebarClasses:`hidden lg:flex sticky top-(--refs-header-height) h-(--refs-sidebar-height) w-(--refs-sidebar-width) [grid-area:navigation]`}))),R(`div`,{class:O([`t-doc__header`,j(r)({open:e.isSidebarOpen})])},[R(`header`,iwn,[e.showSidebar?(F(),L(j(GT),{key:0,icon:e.isSidebarOpen?j(Du):j(Hde),label:e.isSidebarOpen?`Close Menu`:`Open Menu`,size:`md`,onClick:i[0]||=e=>n(`toggleSidebar`)},null,8,[`icon`,`label`])):B(``,!0),e.showSidebar?(F(),I(`span`,awn,k(e.breadcrumb),1)):P(t.$slots,`search`,{key:2}),R(`div`,own,[P(t.$slots,`actions`)])]),e.isSidebarOpen?P(t.$slots,`sidebar`,at(ai({key:0},{sidebarClasses:`overflow-y-auto custom-scrollbar min-h-0 flex-1 w-full border-none`}))):B(``,!0)],2)],64))}});W(),kE(),Ou();var cwn={class:`text-c-2 hover:text-c-1 hover:bg-b-2 flex items-center gap-1 rounded px-2 py-2.25 text-base leading-none`,type:`button`},lwn={class:`custom-scroll bg-b-1 flex flex-col gap-7 rounded-lg p-7 pb-6`},uwn={class:`text-c-2 flex items-center justify-center gap-1 p-2 text-sm`},J9=N({__name:`ApiReferenceToolbarPopover`,setup(e){return(e,t)=>(F(),L(j(iE),{class:`max-h-[inherit] max-w-[inherit] p-0 text-base`,placement:`bottom-end`,teleport:``},{default:M(({open:t})=>[P(e.$slots,`button`,{open:t},()=>[R(`button`,cwn,[P(e.$slots,`label`),H(j(tl),{class:O([`size-3`,{"rotate-180":t}])},null,8,[`class`])])])]),popover:M(n=>[R(`div`,lwn,[P(e.$slots,`default`,at($r(n)))]),R(`div`,uwn,[H(j(gu),{class:`size-3.5 shrink-0`}),R(`div`,null,[P(e.$slots,`info`,{},()=>[t[0]||=z(` "`,-1),P(e.$slots,`label`),t[1]||=z(`" will only appear when running on localhost. `,-1)])])])]),backdrop:M(()=>[H(j(rS),{class:`bg-b-2 rounded-lg`})]),_:3}))}});W(),kE(),Ou(),j2();var dwn={class:`text-c-2 hover:text-c-1 hover:bg-b-2 ml-auto flex items-center gap-1 rounded px-2 py-2.25 text-base leading-none`,type:`button`},fwn={class:`-m-2 flex flex-col gap-2 leading-relaxed`},pwn={class:`bg-b-2 inline-flex items-center gap-0.5 rounded border px-1 py-0.5 text-sm`},mwn=`showDeveloperTools: "never"`,hwn=N({__name:`ApiReferenceToolbarTitle`,setup(e){let{copyToClipboard:t}=A2();return(e,n)=>(F(),L(J9,{class:`w-120`,placement:`bottom-start`},{button:M(()=>[R(`button`,dwn,[H(j(gu)),n[1]||=z(` Developer Tools `,-1)])]),info:M(()=>[...n[5]||=[z(` The developer tools will only appear when running on localhost. `,-1)]]),default:M(()=>[R(`div`,fwn,[n[4]||=R(`div`,null,` The developer tools allow you to customize the appearance and behavior of your documentation. You can also share your documentation using the Scalar Registry. `,-1),R(`div`,null,[n[2]||=z(` To disable the toolbar, set `,-1),R(`div`,pwn,[R(`code`,{class:`font-code`},k(mwn)),H(j(GT),{class:`-m-1 p-1.25`,icon:j(Vl),label:`Copy link to clipboard`,size:`sm`,onClick:n[0]||=e=>j(t)(mwn)},null,8,[`icon`])]),n[3]||=z(` in your configuration. `,-1)])])]),_:1}))}});W();var gwn={},_wn={class:`text-c-3 [&_code]:font-code [&_a:hover]:text-c-1 text-center leading-normal [&_a]:underline`};function vwn(e,t){return F(),I(`p`,_wn,[P(e.$slots,`default`)])}var ywn=U7(gwn,[[`render`,vwn]]);W(),kE(),gX();var bwn=N({__name:`ApiReferenceToolbarRegisterButton`,props:Lr({workspace:{},externalUrls:{},sdks:{default:()=>[]}},{url:{},urlModifiers:{}}),emits:[`update:url`],setup(e){let t=Ur(e,`url`),{toast:n}=pX(),r=mf();function i(t){let n=new URL(`${e.externalUrls.dashboardUrl}/register`);n.searchParams.set(`url`,t),e.sdks.forEach(e=>n.searchParams.append(`sdk`,e)),window.open(n.toString(),`_blank`)}async function a(){if(r.isLoading||!e.workspace)return;if(t.value){i(t.value);return}r.start();let a=e.workspace.exportActiveDocument(`json`);if(!a){n(`Unable to export active document`,`error`),await r.invalidate();return}try{t.value=await W7(a,e.externalUrls),await r.validate(),i(t.value),await ar(),await r.clear()}catch(e){n(e instanceof Error?e.message:`An unknown error occurred`,`error`),await r.invalidate()}}return(e,t)=>(F(),L(j(gf),{class:`h-auto p-2.5`,loader:j(r),onClick:a},{default:M(()=>[P(e.$slots,`default`,{},()=>[t[0]||=z(`Generate`,-1)])]),_:3},8,[`loader`]))}});W(),Ou();var xwn={class:`text-c-2 mb-2 grid grid-cols-2 gap-2.5 font-medium`},Swn=N({__name:`ApiReferenceToolbarShareRegister`,props:{workspace:{},externalUrls:{}},setup(e){let t=[{icon:_u,label:`Password Protection`},{icon:que,label:`Custom Domains`},{icon:pce,label:`Free-form content`},{icon:Nl,label:`CDN Infrastructure`},{icon:_ue,label:`Pull from GitHub`},{icon:Sle,label:`Markdown/MDX`},{icon:she,label:`Spectral Linting`},{icon:qc,label:`JSON Schema Hosting`}];return(n,r)=>(F(),I(V,null,[R(`ul`,xwn,[(F(),I(V,null,Ar(t,e=>R(`li`,{key:e.label,class:`flex items-center gap-2`},[(F(),L(kr(e.icon),{class:`text-c-3 size-3.5`,weight:`bold`})),z(` `+k(e.label),1)])),64))]),H(bwn,{externalUrls:e.externalUrls,workspace:e.workspace},{default:M(()=>[...r[0]||=[z(` Deploy on Scalar `,-1)]]),_:1},8,[`externalUrls`,`workspace`]),H(ywn,null,{default:M(()=>[...r[1]||=[z(` Deploy your documentation for free. `,-1),R(`br`,null,null,-1),z(` Additional features might require `,-1),R(`a`,{href:`https://scalar.com/products/docs/getting-started`,target:`_blank`},`Scalar Pro`,-1),z(`. `,-1)]]),_:1})],64))}});W(),kE();var Cwn=N({__name:`DeployApiReference`,props:{workspace:{},externalUrls:{}},setup(e){return(t,n)=>(F(),L(J9,{class:`w-120`},{label:M(()=>[...n[0]||=[z(`Deploy`,-1)]]),default:M(()=>[H(j(Af),null,{label:M(()=>[...n[1]||=[z(`Scalar Docs`,-1)]]),default:M(()=>[n[2]||=R(`p`,{class:`text-c-2 mb-2 leading-normal`},` Deploy your documentation on Scalar, the modern documentation platform for your API and everything else. `,-1),H(Swn,{externalUrls:e.externalUrls,workspace:e.workspace},null,8,[`externalUrls`,`workspace`])]),_:1})]),_:1}))}});W(),kE();var wwn=N({__name:`ApiReferenceToolbarConfigLayout`,props:{modelValue:{},modelModifiers:{}},emits:[`update:modelValue`],setup(e){let t={label:`Modern`,value:`modern`},n={label:`Classic`,value:`classic`},r=[t,n],i=Ur(e,`modelValue`),a=U({get:()=>i.value===`modern`?t:n,set:e=>i.value=e.value});return(e,t)=>(F(),L(j(Dve),{modelValue:a.value,"onUpdate:modelValue":t[0]||=e=>a.value=e,options:r},null,8,[`modelValue`]))}});W(),kE();var Twn=N({__name:`ApiReferenceToolbarConfigLayoutOptions`,props:Lr({configuration:{}},{modelValue:{default:{}},modelModifiers:{}}),emits:[`update:modelValue`],setup(e){let t=Ur(e,`modelValue`);function n(n,r=!1){return t.value[n]??e.configuration?.[n]??r}function r(e,n,r=!1){n===r?t.value=Object.fromEntries(Object.entries(t.value).filter(([t])=>e!==t)):t.value={...t.value,[e]:n}}return(e,t)=>(F(),L(j(Of),null,{default:M(()=>[H(j(SE),{modelValue:n(`showSidebar`,!0),"onUpdate:modelValue":t[0]||=e=>r(`showSidebar`,!!e,!0)},{default:M(()=>[...t[11]||=[z(` Show Sidebar `,-1)]]),_:1},8,[`modelValue`]),H(j(SE),{modelValue:n(`defaultOpenFirstTag`,!0),"onUpdate:modelValue":t[1]||=e=>r(`defaultOpenFirstTag`,!!e,!0)},{default:M(()=>[...t[12]||=[z(` Default Open First Tag `,-1)]]),_:1},8,[`modelValue`]),H(j(SE),{modelValue:n(`defaultOpenAllTags`),"onUpdate:modelValue":t[2]||=e=>r(`defaultOpenAllTags`,!!e)},{default:M(()=>[...t[13]||=[z(` Default Open All Tags `,-1)]]),_:1},8,[`modelValue`]),H(j(SE),{modelValue:n(`expandAllModelSections`),"onUpdate:modelValue":t[3]||=e=>r(`expandAllModelSections`,!!e)},{default:M(()=>[...t[14]||=[z(` Expand All Model Sections `,-1)]]),_:1},8,[`modelValue`]),H(j(SE),{modelValue:n(`expandAllResponses`),"onUpdate:modelValue":t[4]||=e=>r(`expandAllResponses`,!!e)},{default:M(()=>[...t[15]||=[z(` Expand All Responses `,-1)]]),_:1},8,[`modelValue`]),H(j(SE),{modelValue:n(`hideClientButton`),"onUpdate:modelValue":t[5]||=e=>r(`hideClientButton`,!!e)},{default:M(()=>[...t[16]||=[z(` Hide Client Button `,-1)]]),_:1},8,[`modelValue`]),H(j(SE),{modelValue:n(`hideDarkModeToggle`),"onUpdate:modelValue":t[6]||=e=>r(`hideDarkModeToggle`,!!e)},{default:M(()=>[...t[17]||=[z(` Hide Dark Mode Toggle `,-1)]]),_:1},8,[`modelValue`]),H(j(SE),{modelValue:n(`hideModels`),"onUpdate:modelValue":t[7]||=e=>r(`hideModels`,!!e)},{default:M(()=>[...t[18]||=[z(` Hide Models `,-1)]]),_:1},8,[`modelValue`]),H(j(SE),{modelValue:n(`hideSearch`),"onUpdate:modelValue":t[8]||=e=>r(`hideSearch`,!!e)},{default:M(()=>[...t[19]||=[z(` Hide Search `,-1)]]),_:1},8,[`modelValue`]),H(j(SE),{modelValue:n(`showOperationId`),"onUpdate:modelValue":t[9]||=e=>r(`showOperationId`,!!e)},{default:M(()=>[...t[20]||=[z(` Show Operation ID `,-1)]]),_:1},8,[`modelValue`]),H(j(SE),{modelValue:n(`hideTestRequestButton`),"onUpdate:modelValue":t[10]||=e=>r(`hideTestRequestButton`,!!e)},{default:M(()=>[...t[21]||=[z(` Hide Test Request Button `,-1)]]),_:1},8,[`modelValue`])]),_:1}))}});W(),kE(),Ou();var Ewn={class:`min-w-0 flex-1 truncate text-left`},Dwn={class:`text-c-1 inline-block min-w-0 flex-1 truncate`},Own=N({__name:`ApiReferenceToolbarConfigTheme`,props:{modelValue:{},modelModifiers:{}},emits:[`update:modelValue`],setup(e){let t=Ur(e,`modelValue`),n=U(()=>arn.filter(e=>e!==`none`).map(e=>({id:e,label:orn[e],css:x3[e].theme}))),r=U({get:()=>{let e=t.value??`default`;return n.value.find(t=>t.id===e)??n.value[0]},set:e=>t.value=e.id});return(e,t)=>(F(),L(j(PS),{modelValue:r.value,"onUpdate:modelValue":t[0]||=e=>r.value=e,options:n.value,resize:``},{default:M(({open:e})=>[H(j(Ef),null,{default:M(()=>[R(`div`,Ewn,k(r.value.label),1),H(j(xE),{class:`mr-2`,css:r.value.css},null,8,[`css`]),H(j(tl),{class:O([`size-3.5 transition-transform`,{"rotate-180":e}])},null,8,[`class`])]),_:2},1024)]),option:M(({selected:e,option:t})=>[H(j(oS),{selected:e},null,8,[`selected`]),R(`span`,Dwn,k(t.label),1),H(j(xE),{css:t.css},null,8,[`css`])]),_:1},8,[`modelValue`,`options`]))}});W(),kE(),By();var kwn={class:`flex flex-col gap-4`},Awn=N({__name:`ModifyConfiguration`,props:Lr({configuration:{}},{overrides:{},overridesModifiers:{}}),emits:[`update:overrides`],setup(e){let t=Ur(e,`overrides`),n=U(()=>zy({...t.value,...e.configuration,...t.value})),r=U({get:()=>t.value?.theme??e.configuration?.theme??`default`,set:e=>t.value={...t.value,theme:e}}),i=U({get:()=>t.value?.layout??e.configuration?.layout??`modern`,set:e=>t.value={...t.value,layout:e}});return(a,o)=>(F(),L(J9,{class:`w-120`},{label:M(()=>[...o[3]||=[z(`Configure`,-1)]]),default:M(()=>[H(j(Af),null,{label:M(()=>[...o[4]||=[z(`Scalar Configuration`,-1)]]),default:M(()=>[H(j(Wy),{class:`bg-b-1.5 flex max-h-40 flex-col rounded border text-sm`,content:n.value,lang:`json`},null,8,[`content`])]),_:1}),R(`div`,kwn,[H(j(wf),null,{label:M(()=>[...o[5]||=[z(`Theme`,-1)]]),default:M(()=>[H(Own,{modelValue:r.value,"onUpdate:modelValue":o[0]||=e=>r.value=e},null,8,[`modelValue`])]),_:1}),H(j(wf),null,{label:M(()=>[...o[6]||=[z(`Layout`,-1)]]),default:M(()=>[H(wwn,{modelValue:i.value,"onUpdate:modelValue":o[1]||=e=>i.value=e},null,8,[`modelValue`])]),_:1}),H(j(wf),{is:`div`},{label:M(()=>[...o[7]||=[z(`Layout Options`,-1)]]),default:M(()=>[H(Twn,{modelValue:t.value,"onUpdate:modelValue":o[2]||=e=>t.value=e,configuration:e.configuration},null,8,[`modelValue`,`configuration`])]),_:1})])]),_:1}))}});W(),kE(),gX();var jwn=N({__name:`ApiReferenceToolbarShareTemporary`,props:Lr({workspace:{},externalUrls:{}},{url:{},urlModifiers:{}}),emits:[`update:url`],setup(e){let{toast:t}=pX(),n=mf(),r=Ur(e,`url`);async function i(){if(n.isLoading||!e.workspace||r.value)return;n.start();let i=e.workspace.exportActiveDocument(`json`);if(!i){t(`Unable to export active document`,`error`),await n.invalidate();return}try{let t=await W7(i,e.externalUrls);await n.validate({duration:900,persist:!0}),r.value=t}catch(e){t(e instanceof Error?e.message:`An unknown error occurred`,`error`),await n.invalidate()}}return(t,a)=>(F(),I(V,null,[r.value?(F(),L(j(k2e),{key:0,immediate:``,modelValue:r.value,name:`temporary-link`,placeholder:`${e.externalUrls.registryUrl}/share/apis/…`},null,8,[`modelValue`,`placeholder`])):(F(),L(j(gf),{key:1,class:`h-auto p-2.5`,loader:j(n),variant:`gradient`,onClick:i},{default:M(()=>[...a[0]||=[z(` Upload Document `,-1)]]),_:1},8,[`loader`])),H(ywn,{class:`-mt-1`},{default:M(()=>[...a[1]||=[z(` Your document will automatically be deleted after 7 days. `,-1)]]),_:1})],64))}});W(),kE();var Mwn=N({__name:`ShareApiReference`,props:{workspace:{},externalUrls:{}},setup(e){return(t,n)=>(F(),L(J9,{class:`w-120`},{label:M(()=>[...n[0]||=[z(`Share`,-1)]]),default:M(()=>[H(j(Af),null,{label:M(()=>[...n[1]||=[z(`Share your API Reference`,-1)]]),default:M(()=>[n[2]||=R(`p`,{class:`text-c-2 mb-2 leading-normal`},` Upload your OpenAPI document to share your API Reference with others. As easy as pressing a button. `,-1),H(jwn,{externalUrls:e.externalUrls,workspace:e.workspace},null,8,[`externalUrls`,`workspace`])]),_:1})]),_:1}))}});W(),gF();var Nwn={key:0,"aria-label":`Developer Tools`,class:`api-reference-toolbar bg-b-1 relative z-1 flex h-10 justify-center border-b px-15`},Pwn={class:`-mx-2 flex max-w-(--refs-content-max-width) flex-1 items-center`},Fwn={class:`flex flex-1 items-center`},Iwn=N({__name:`DeveloperTools`,props:Lr({workspace:{},configuration:{},externalUrls:{}},{overrides:{},overridesModifiers:{}}),emits:[`update:overrides`],setup(e){let t=Ur(e,`overrides`),n=U(()=>e.configuration?.showDeveloperTools===`always`?!0:e.configuration?.showDeveloperTools===`never`||typeof window>`u`?!1:hF(window.location.href));return(r,i)=>n.value?(F(),I(`header`,Nwn,[R(`div`,Pwn,[R(`div`,Fwn,[H(hwn)]),H(Awn,{overrides:t.value,"onUpdate:overrides":i[0]||=e=>t.value=e,configuration:e.configuration},null,8,[`overrides`,`configuration`]),e.workspace?(F(),I(V,{key:0},[H(Mwn,{externalUrls:e.externalUrls,workspace:e.workspace},null,8,[`externalUrls`,`workspace`]),H(Cwn,{externalUrls:e.externalUrls,workspace:e.workspace},null,8,[`externalUrls`,`workspace`])],64)):B(``,!0)])])):B(``,!0)}});W(),kE(),Ou();var Lwn={key:0,class:`document-selector px-3 pt-3`},Rwn={class:`group/dropdown-label text-c-2 hover:text-c-1 flex w-full cursor-pointer items-center gap-1 font-medium`,type:`button`},zwn={class:`overflow-hidden text-base text-ellipsis`},Bwn=N({__name:`DocumentSelector`,props:{options:{},modelValue:{}},emits:[`update:modelValue`],setup(e,{emit:t}){let n=e,r=t,i=U(()=>n.options.map(e=>({id:e.id,label:e.label}))),a=U(()=>i.value.find(e=>e.id===n.modelValue));return(t,n)=>e.options.length>1?(F(),I(`div`,Lwn,[H(j(pS),{modelValue:a.value,options:i.value,resize:``,"onUpdate:modelValue":n[0]||=e=>r(`update:modelValue`,e.id)},{default:M(({open:e})=>[R(`button`,Rwn,[R(`span`,zwn,k(a.value?.label||`Select API`),1),H(j(tl),{class:O([`size-3 text-current transition-transform`,{"rotate-180":e}]),weight:`bold`},null,8,[`class`])])]),_:1},8,[`modelValue`,`options`])])):B(``,!0)}});$R();function Vwn(){return new QR([],{keys:[{name:`title`,weight:.7},{name:`operationId`,weight:.6},{name:`parameters`,weight:.55},{name:`body`,weight:.55},{name:`path`,weight:.5},{name:`tag`,weight:.4},{name:`description`,weight:.3},{name:`method`,weight:.3},{name:`responseExamples`,weight:.25},{name:`parameterDescriptions`,weight:.2},{name:`bodyDescriptions`,weight:.2}],threshold:.3,distance:100,includeScore:!0,includeMatches:!0,ignoreLocation:!0,useExtendedSearch:!0,findAllMatches:!0})}zE(),dY();var Hwn=e=>typeof e==`object`&&!!e;function Uwn(e){return typeof e==`object`&&e&&`$ref`in e?Hwn(e[`$ref-value`])?e[`$ref-value`]:void 0:e}function Y9(e,t){t&&(e.includes(t)||e.push(t))}function X9(e,t,n=0){!e||t.visited.has(e)||(t.visited.add(e),[...e.oneOf??[],...e.anyOf??[],...e.allOf??[]].forEach(e=>{X9(Uwn(e),t,n)}),oY(e)&&e.properties&&Object.entries(e.properties).forEach(([e,r])=>{let i=Uwn(r);t.visit(e,i),n+1<t.maxPropertyDepth&&X9(i,t,n+1)}))}function Wwn(e,t){let n=RE(e?.requestBody)?.content;if(!n)return;let r=new Set;Object.values(n).forEach(e=>{X9(RE(RE(e)?.schema),{visit:t,visited:r,maxPropertyDepth:2})})}function Gwn(e){let t=[];return e.forEach(e=>{Y9(t,RE(e)?.name)}),t}function Kwn(e){let t=[];return e.forEach(e=>{Y9(t,RE(e)?.description)}),t}function qwn(e){let t=[];return Wwn(e,e=>{Y9(t,e)}),t}function Jwn(e){let t=[];return Wwn(e,(e,n)=>{n&&`description`in n&&typeof n.description==`string`&&Y9(t,n.description)}),t}function Ywn(e){let t=[];return X9(e,{visit:e=>Y9(t,e),visited:new Set,maxPropertyDepth:2}),t}function Xwn(e){let t=[];return X9(e,{visit:(e,n)=>{n&&`description`in n&&typeof n.description==`string`&&Y9(t,n.description)},visited:new Set,maxPropertyDepth:2}),t}zE(),QI();function Zwn(e){if(typeof e==`string`)return e;try{return JSON.stringify(e)}catch{return``}}function Qwn(e){let t=Object.values(e.examples??{}).flatMap(e=>{let t=RE(e);return!t||!(`value`in t)?[]:Zwn(t.value)}).filter(e=>e.length>0),n=`example`in e&&e.example!==void 0?Zwn(e.example):``;return n?[n,...t]:t}function $wn(e){return e?Object.values(e).flatMap(e=>{let t=RE(e);return t?.content?Object.values(t.content).flatMap(e=>{let t=RE(e);return t?Qwn(t):[]}):[]}).filter(e=>e.length>0):[]}function eTn(e){let t=[];function n(r){r.forEach(r=>{tTn(r,t,e),`children`in r&&r.children&&n(r.children)})}return n(e?.[`x-scalar-navigation`]?.children??[]),t}function tTn(e,t,n){if(e.type===`operation`){let r=RE(n?.paths?.[e.path]),i=RE(r?.[e.method])??{},a={...i,parameters:AI(r?.parameters,i.parameters)},o=Gwn(a.parameters??[]),s=Kwn(a.parameters??[]),c=qwn(a),l=Jwn(a),u=$wn(a.responses);t.push({type:`operation`,title:e.title,id:e.id,description:a.description||``,method:e.method,path:e.path,body:c,bodyDescriptions:l,parameters:o,parameterDescriptions:s,responseExamples:u,operationId:a.operationId,entry:e});return}if(e.type===`webhook`){let r=RE(n?.webhooks?.[e.name]?.[e.method])??{},i=r.description||``;t.push({id:e.id,type:`webhook`,title:e.title,description:`Webhook`,method:e.method,body:``,bodyDescriptions:i?[i]:[],operationId:r.operationId,entry:e});return}if(e.type===`model`){let r=RE(n?.components?.schemas?.[e.name]),i=r?.description??``,a=Ywn(r),o=Xwn(r);t.push({type:`model`,title:e.title,description:`Model`,id:e.id,body:a,bodyDescriptions:i?[i,...o]:o,entry:e});return}if(e.type===`models`){t.push({id:e.id,type:`heading`,title:`Models`,description:`Heading`,body:``,entry:e});return}if(e.type===`tag`&&e.isWebhooks===!0){t.push({id:e.id,type:`heading`,title:`Webhooks`,description:`Heading`,body:``,entry:e});return}if(e.type===`tag`&&e.isGroup===!1){t.push({id:e.id,title:e.title,description:e.description||``,type:`tag`,body:``,entry:e});return}if(e.type===`tag`&&e.isGroup===!0){t.push({id:e.id,title:e.title,description:`Tag Group`,type:`tag`,body:``,entry:e});return}if(e.type===`text`){t.push({id:e.id,type:`heading`,title:e.title??``,description:`Heading`,body:``,entry:e});return}}W();var nTn=25;function rTn(e){let t=U(()=>eTn(Cn(e))),n=U(()=>{let e=Vwn();return e.setCollection(t.value),e}),r=A(``);return{results:U(()=>r.value.length===0?t.value.slice(0,nTn).map((e,t)=>({item:e,refIndex:t})):n.value.search(r.value,{limit:nTn})),query:r}}W(),kE(),Ou(),U4();var iTn={class:`sr-only`},aTn={class:`inline-flex items-center gap-1`},oTn={class:`sr-only`},sTn=N({__name:`SearchResult`,props:{id:{},isSelected:{type:Boolean},result:{}},setup(e){let t={heading:pme,model:qc,operation:Cu,tag:Jpe,webhook:Cu},n={heading:`Heading`,operation:`Operation`,tag:`Tag`,model:`Model`,webhook:`Webhook`};return(r,i)=>(F(),L(j(r0e),{id:e.id,icon:t[e.result.item.type],selected:e.isSelected},jr({default:M(()=>[R(`span`,{class:O({"text-decoration-line":e.result.item.entry.type===`operation`&&e.result.item.entry.isDeprecated})},[R(`span`,iTn,[z(k(n[e.result.item.type])+`:\xA0 `,1),e.result.item.entry.type===`operation`&&e.result.item.entry.isDeprecated?(F(),I(V,{key:0},[z(` (Deprecated)\xA0 `)],64)):B(``,!0)]),z(` `+k(e.result.item.title)+` `,1),i[0]||=R(`span`,{class:`sr-only`},`,`,-1)],2)]),_:2},[e.result.item.type!==`webhook`&&(e.result.item.method||e.result.item.path)&&e.result.item.path!==e.result.item.title?{name:`description`,fn:M(()=>[R(`span`,aTn,[e.result.item.type===`operation`?(F(),I(V,{key:0},[H(j(O4),{"aria-hidden":`true`,method:e.result.item.method??`get`},null,8,[`method`]),R(`span`,oTn,` HTTP Method: `+k(e.result.item.method??`get`),1)],64)):B(``,!0),i[1]||=R(`span`,{class:`sr-only`},`Path:\xA0`,-1),z(` `+k(e.result.item.path),1)])]),key:`0`}:e.result.item.description?{name:`description`,fn:M(()=>[i[2]||=R(`span`,{class:`sr-only`},`Description:\xA0`,-1),z(` `+k(e.result.item.description),1)]),key:`1`}:void 0]),1032,[`id`,`icon`,`selected`]))}});W(),kE(),sb();var cTn={class:`mb-0 flex flex-col`,role:`search`},lTn=U7(N({__name:`SearchModal`,props:{modalState:{},document:{},eventBus:{}},setup(e){let t=e,n=ob(),r=`${n}-search-result`,i=`${n}-search-instructions`,{query:a,results:o}=rTn(()=>t.document),s=A(void 0);mr(()=>t.modalState.open,e=>{e&&(a.value=``)});let c=e=>{let t=e===`up`?-1:1,n=o.value.length;typeof s.value==`number`?s.value=(s.value+t+n)%n:s.value=t===-1?n-1:0};function l(e){if(typeof e!=`number`||!o.value[e])return;let n=o.value[e];t.modalState.hide(),t.eventBus.emit(`scroll-to:nav-item`,{id:n.item.id})}let u=U(()=>{let e=o.value[s.value??-1];return e?`search-result-${e.item.id}`:void 0});return(t,n)=>(F(),L(j(rE),{"aria-label":`Reference Search`,state:e.modalState,variant:`search`},{default:M(()=>[R(`div`,cTn,[H(j(aE),{modelValue:j(a),"onUpdate:modelValue":n[0]||=e=>xn(a)?a.value=e:null,"aria-activedescendant":u.value,"aria-autocomplete":`list`,"aria-controls":r,"aria-describedby":i,role:`combobox`,onBlur:n[1]||=e=>s.value=void 0,onKeydown:[n[2]||=mo(po(e=>c(`down`),[`stop`,`prevent`]),[`down`]),n[3]||=mo(po(()=>l(s.value),[`stop`,`prevent`]),[`enter`]),n[4]||=mo(po(e=>c(`up`),[`stop`,`prevent`]),[`up`])]},null,8,[`modelValue`,`aria-activedescendant`])]),H(j(s0e),{id:r,"aria-label":`Reference Search Results`,class:`custom-scroll px-1 pb-1`,noResults:!j(o).length},{query:M(()=>[z(k(j(a)),1)]),default:M(()=>[(F(!0),I(V,null,Ar(j(o),(e,t)=>(F(),L(sTn,{id:`search-result-${e.item.id}`,key:e.refIndex,isSelected:s.value===t,result:e,onClick:po(()=>l(t),[`prevent`])},null,8,[`id`,`isSelected`,`result`,`onClick`]))),128))]),_:1},8,[`noResults`]),R(`div`,{id:i,class:`ref-search-meta`},[...n[5]||=[R(`span`,{"aria-hidden":`true`,class:`contents`},[R(`span`,null,`↑↓ Navigate`),R(`span`,null,`⏎ Select`)],-1),R(`span`,{class:`sr-only`},` Press up arrow / down arrow to navigate, enter to select, type to filter results `,-1)]])]),_:1},8,[`state`]))}}),[[`__scopeId`,`data-v-9b0e55ef`]]);W(),kE(),xC(),Ou();var Z9=N({__name:`SearchButton`,props:{forceIcon:{type:Boolean},searchHotKey:{default:`k`},hideModels:{type:Boolean,default:!1},document:{},eventBus:{}},setup(e){let t=A(),n=nE(),r=t=>{(bC()?t.metaKey:t.ctrlKey)&&t.key===e.searchHotKey&&(t.preventDefault(),t.stopPropagation(),n.open?n.hide():n.show())};mr(()=>n.open,async(e,n)=>{!e&&n&&(await ar(),t.value?.$el.focus())}),Hi(()=>window.addEventListener(`keydown`,r)),Wi(()=>window.removeEventListener(`keydown`,r));function i(){n.show()}return(r,a)=>(F(),I(V,null,[e.forceIcon?(F(),L(j(GT),{key:0,icon:j(vu),label:`Search`,onClick:i},null,8,[`icon`])):(F(),L(j(r2e),{key:1,ref_key:`button`,ref:t,class:O([`w-full`,r.$attrs.class]),onClick:i},{shortcut:M(()=>[j(bC)()?(F(),I(V,{key:0},[a[0]||=R(`span`,{class:`sr-only`},`Command`,-1),a[1]||=R(`span`,{"aria-hidden":`true`},`⌘`,-1)],64)):(F(),I(V,{key:1},[a[2]||=R(`span`,{class:`sr-only`},`CTRL`,-1),a[3]||=R(`span`,{"aria-hidden":`true`},`⌃`,-1)],64)),z(` `+k(e.searchHotKey),1)]),default:M(()=>[a[4]||=R(`span`,{class:`sr-only`},`Open Search`,-1),a[5]||=R(`span`,{"aria-hidden":`true`,class:`sidebar-search-placeholder`},` Search `,-1)]),_:1},8,[`class`])),H(lTn,{document:e.document,eventBus:e.eventBus,hideModels:e.hideModels,modalState:j(n)},null,8,[`document`,`eventBus`,`hideModels`,`modalState`])],64))}}),uTn=()=>typeof window>`u`||typeof window?.matchMedia!=`function`?`light`:window.matchMedia(`(prefers-color-scheme: dark)`).matches?`dark`:`light`;function dTn(){try{return new MouseEvent(`click`,{bubbles:!0,cancelable:!0,view:window})}catch{return new MouseEvent(`click`,{bubbles:!0,cancelable:!0})}}async function fTn(e){try{return JSON.parse(e)}catch{let{parse:t}=await Promise.resolve().then(()=>(m2(),_Xt));return t(e,{maxAliasCount:1e4,merge:!0})}}function pTn(e){let t=e.trimStart();return t.startsWith(`{`)||t.startsWith(`[`)?`json`:`yaml`}async function mTn(e,t,n){if(t===n)return e;let r=await fTn(e);if(n===`json`)return JSON.stringify(r,null,2);let{stringify:i}=await Promise.resolve().then(()=>(m2(),_Xt));return i(r)}async function hTn(e,t,n){let r=pTn(e),i=n??r,a=`${t??`openapi`}.${i}`,o=i===`json`?`application/json`:`application/x-yaml`,s=await mTn(e,r,i),c=new Blob([s],{type:o}),l=URL.createObjectURL(c),u=document.createElement(`a`);u.href=l,u.download=a,u.dispatchEvent(dTn()),setTimeout(()=>{window.URL.revokeObjectURL(l),u.remove()},100)}var gTn=e=>{let t=syn().get();vY(t)&&!e.workspace[`x-scalar-default-client`]&&e.update(`x-scalar-default-client`,t)},_Tn=(e,t)=>{let n=cyn().getAuth(t);e.auth.load({[t]:n})};nd(),QI(),W();var vTn=(e,t)=>{let n={hooks:{}};return mr([()=>e.value.onBeforeRequest,()=>e.value.onRequestSent,()=>t.value],([e,t,r])=>{let i=dI(r);n.hooks||={},n.hooks.beforeRequest=e?async t=>{let n=nI(t.requestBuilder,{envVariables:i,allowMissingRequestServerBase:!0});if(!n.ok){console.error(`[@scalar/api-reference] onBeforeRequest was not run because the request could not be built:`,n.message??n.error);return}await e({request:td(...n.data.requestPayload),requestBuilder:t.requestBuilder,envVariables:i})}:void 0,n.hooks.responseReceived=t?e=>{t(e.request.url)}:void 0},{immediate:!0}),[n]};Zf(),W();var yTn=({config:e,store:t,isDarkMode:n})=>{mr(()=>Cn(e).defaultHttpClient,e=>{if(e){let{targetKey:n,clientKey:r}=e,i=`${n}/${r}`;vY(i)&&t.update(`x-scalar-default-client`,i)}},{immediate:!0}),mr(()=>Cn(e).darkMode,e=>t.update(`x-scalar-color-mode`,e?`dark`:`light`)),mr(()=>n.value,e=>t.update(`x-scalar-color-mode`,e?`dark`:`light`),{immediate:!0}),Cn(e).metaData&&xie(Cn(e).metaData),mr(()=>Cn(e).proxyUrl,e=>t.update(`x-scalar-active-proxy`,e),{immediate:!0}),oye(U(()=>Cn(e).favicon))};$2(),_2(),Te();var bTn=e=>!!e.url?.trim()||!!e.content,xTn=e=>{let{slug:t}=Q2(),n={};return e&&(Array.isArray(e)?e:[e]).flatMap(e=>{if(crn(e)){let{sources:t,...n}=e;return t?.map(e=>({...n,...e}))??[]}return[e]}).map(e=>Se(e)).filter(bTn).map((e,n)=>CTn(e,n,t)).forEach(e=>{let{url:t,content:r,...i}=e;n[e.slug]={config:i,title:e.title,slug:e.slug,default:!!e?.default,agent:e.agent,source:r?{content:STn(r)??{}}:{url:t}}}),n},STn=e=>e?typeof e==`function`?STn(e()):typeof e==`string`?yXt(e):e:null,CTn=(e,t=0,n)=>e.title?{...e,slug:e.slug||n(e.title),title:e.title}:e.slug?{...e,slug:n(e.slug),title:e.slug}:{...e,slug:`api-${t+1}`,title:`API #${t+1}`};VI();var wTn=e=>typeof window>`u`?BI(e):window.structuredClone(e);W(),Rc(),b3(),kE(),gF(),Te(),U4(),j2(),tb(),gX(),le(),jan(),v3(),QI(),OI(),Zf();var TTn={key:1,class:`flex gap-1.5 px-3 pt-3`},ETn={key:1},DTn=[`aria-label`,`inert`],OTn={class:`w-64 empty:hidden`},kTn={key:2,class:`references-footer`};typeof window<`u`&&console.info(`@scalar/api-reference@1.57.1`);var ATn=U7(N({__name:`ApiReference`,props:{configuration:{}},setup(e,{expose:t}){let n=e,{copyToClipboard:r}=A2(),i=U(irn),a=_3({debug:!1}),o=A(!1);Uie(()=>Sr());let s=U(()=>xTn(n.configuration)),c=U(()=>Object.keys(s.value).length>1),l=A(Object.values(s.value).find(e=>e.default)?.slug??s.value[Object.keys(s.value)?.[0]??``]?.slug??``);if(typeof window<`u`){let e=new URL(window.location.href),t=e.searchParams.get(`api`);if(t&&s.value[t]){l.value=t;let n=D9(E9(e,s.value[t].config.pathRouting?.basePath,t),s.value[t].config.pathRouting?.basePath,c.value);n&&(n.searchParams.delete(`api`),window.history.replaceState({},``,n.toString()))}let n=E9(e,Object.values(s.value).map(e=>e.config.pathRouting?.basePath).find(t=>t?Bxn(e,t):!1),c.value?void 0:l.value).split(`/`)[0];n&&s.value[n]&&(l.value=n)}let u=U(()=>Object.values(s.value).map(e=>({label:e.title,id:e.slug}))),d=A({}),f=U(()=>({...v(ye,{}),...s.value[l.value]?.config,...d.value})),p=U(()=>f.value.pathRouting?.basePath),m=U(()=>srn(f.value.theme,{fonts:f.value.withDefaultFonts})),h=iyn({plugins:Object.values(s.value).flatMap(e=>e.config.plugins??[])});if(dr(ayn,h),h.notifyInit(f.value),mr(f,e=>h.notifyConfigChange(e)),f.value.redirect&&typeof window<`u`){let e=f.value.redirect((f.value.pathRouting?window.location.pathname:``)+window.location.hash);e&&window.history.replaceState({},``,e)}function g(e,t,n){let r=D9(t||e,n.pathRouting?.basePath,c.value);r&&window.history.replaceState({},``,r.toString()),l.value=e}let _=m6({verbose:!1}),y=m6({verbose:!1,plugins:[lyn({prefix:()=>l.value,persistAuth:()=>f.value.persistAuth??!1})]}),{toggleColorMode:b,isDarkMode:x}=Qy({initialColorMode:{true:`dark`,false:`light`,undefined:`system`}[String(f.value.darkMode)],overrideColorMode:f.value.forceDarkModeState}),S=U(()=>{let e=_.workspace.activeDocument;return EI(e)?e:void 0}),C=V4(U(()=>Object.entries(_.workspace.documents).map(([e,t])=>({id:e,type:`document`,description:t.info.description,name:t.info.title??e,title:t.info.title??e,children:EI(t)?t[`x-scalar-navigation`]?.children??[]:[]}))),{hooks:{}}),w=e=>{e.forEach(e=>{(e.type===`tag`||e.type===`models`)&&C.setExpanded(e.id,!0),`children`in e&&e.children&&w(e.children)})},ee=U(()=>{let e=f.value;if(!e)return[];let t=C.items.value.find(e=>e.id===l.value)?.children??[];if(e.defaultOpenAllTags&&w(t),e.expandAllModelSections){let e=t.find(e=>e.type===`models`);e&&(C.setExpanded(e.id,!0),e.children?.forEach(e=>{C.setExpanded(e.id,!0)}))}return t}),te=U(()=>ee.value.find(e=>e.type===`text`&&e.title===`Introduction`)?.id??`${l.value}/description/introduction`),ne=A(``),re=U(()=>({breadcrumb:ne.value})),T=e=>{let t=C.getEntryById(e);!t||t.type===`document`?ne.value=``:ne.value=t.title},ie=e=>{T(e),C.setSelected(e),$xn(e,C.setExpanded,C.getEntryById)};yTn({config:()=>f.value,store:_,isDarkMode:x}),yTn({config:()=>f.value,store:y,isDarkMode:x});let ae=U(()=>kI(_,_.workspace.activeDocument??null).environment);typeof window<`u`&&(window.dataDumpWorkspace=()=>_),t({eventBus:a,workspaceStore:_,sidebarItems:ee});let E=U(()=>ee.value.filter(e=>e.type===`models`).flatMap(e=>e.children??[]).filter(e=>e.type===`model`).reduce((e,t)=>(e[t.name]=t.id,e),{}));a.on(`scroll-to:model-by-name`,({name:e})=>{let t=E.value[e];t&&ie(t)});let D=async(e,t)=>{let n=await _.addDocument(e,t),r=_.exportWorkspace();return y.loadWorkspace({auth:{},documents:{[e.name]:wTn(r.documents[e.name])??{openapi:`3.1.0`,info:{title:``,version:``},"x-scalar-original-document-hash":``}},intermediateDocuments:{},originalDocuments:{},overrides:{},history:{},meta:{}}),n},oe=async(e,t)=>{let n=s.value[e];if(!n){console.warn(`Document ${e} not found in configList`);return}let r={...n.config,...d.value},i=r.onDocumentSelect?.();if(g(e,t,r),ue.value?.route({documentSlug:e,method:`get`,path:`/`}),!_.workspace.documents[e]){let t=await D(n.source.url?{name:e,url:n.source.url,fetch:r.fetch}:{name:e,document:n.source.content??{}},r),i=y.workspace.documents[e];if(t===!0&&EI(i)&&i[`x-scalar-selected-server`]===void 0){let t=XI(n.config.servers??i.servers,{baseServerUrl:f.value.baseServerURL,documentUrl:n.source.url});t.length>0&&y.updateDocument(e,`x-scalar-selected-server`,t[0].url)}}if(_.update(`x-scalar-active-document`,e),y.update(`x-scalar-active-document`,e),r.persistAuth&&_Tn(y,e),(async()=>{await i,r.onLoaded?.(e)})(),t&&t!==e)ie(t);else if(r.defaultOpenFirstTag){let e=ee.value.find(e=>e.type===`tag`);e&&C.setExpanded(e.id,!0)}};mr(()=>Object.values(s.value),async(e,t)=>{let n=async(e,t)=>{if(_.workspace.documents[e.slug]){if(e.source.url&&e.source.url!==t?.source.url){await D({name:e.slug,url:e.source.url,fetch:e.config.fetch},e.config);return}e.source.content&&Nan(e.source.content,t&&`content`in t.source?t.source.content??{}:{}).length&&await D({name:e.slug,document:e.source.content},e.config)}};e.forEach((e,r)=>n(e,t[r]));let r=e.map(e=>e.slug),i=t.map(e=>e.slug);(r.length!==i.length||!r.every((e,t)=>e===i[t]))&&await oe(r[0]??``)},{deep:!0}),Ki(()=>oe(l.value)),Vi(async()=>{gTn(y),await oe(l.value,E9(window.location.href,s.value[l.value]?.config.pathRouting?.basePath,c.value?void 0:l.value))});let se=U(()=>s.value[l.value]?.source?.url),ce=Ian({agentEnabled:U(()=>s.value[l.value]?.agent?.disabled?!1:typeof window<`u`&&hF(window.location.href)?!0:!!s.value[l.value]?.agent?.key)});dr(Pan,ce);let le=wr(`modal`),ue=A(null);Hi(()=>{le.value&&(ue.value=y3({el:le.value,eventBus:a,workspaceStore:y,options:f,plugins:[...h.getApiClientPlugins(),...vTn(f,ae)]}))}),Wi(()=>{h.notifyDestroy(),ue.value?.app.unmount()}),a.on(`server:update:selected`,({url:e})=>f.value.onServerChange?.(e)),a.on(`ui:download:document`,({format:e})=>{let t=_.exportActiveDocument(e);if(!t){console.error(`No document found to download`);return}hTn(t,l.value??`openapi`,e)});let de=(e,t)=>{let n=C.getEntryById(e);if((n?.type===`tag`||n?.type===`models`||n?.type===`text`)&&C.isExpanded(e)&&C.selectedItem.value===e){let t=Kxn();C.setExpanded(e,!1),t();return}n?.type!==`tag`&&n?.type!==`models`&&(o.value=!1),ie(e);let r=D9(e,p.value,c.value);r&&(window.history.pushState({},``,r),t===`sidebar`&&f.value.onSidebarClick?.(r.toString())),ce.showAgent.value&&ce.closeAgent()};a.on(`select:nav-item`,({id:e})=>de(e)),a.on(`scroll-to:nav-item`,({id:e})=>de(e)),a.on(`intersecting:nav-item`,({id:e})=>{if(!qxn.value)return;C.setSelected(e),T(e),$en(e);let t=D9(e,p.value,c.value);t&&_.workspace.activeDocument&&window.history.replaceState({},``,t.toString())}),a.on(`toggle:nav-item`,({id:e,open:t})=>{if(t){f.value.onShowMore?.(e);let t=C.getEntryById(e);if(t&&`children`in t&&t.children){let e=t.children[0];e&&R9(e.id)}}C.setExpanded(e,t??!C.isExpanded(e))}),a.on(`copy-url:nav-item`,({id:e})=>{let t=D9(e,p.value,c.value)?.toString();return t&&r(t)}),Vi(()=>{window.history.scrollRestoration=`manual`,OE(),window.addEventListener(`popstate`,()=>{let e=E9(window.location.href,f.value.pathRouting?.basePath,c.value?void 0:l.value);e&&ie(e)})});let fe=wr(`documentStartRef`);q7(fe,()=>{a.emit(`intersecting:nav-item`,{id:l.value})},{onExit:()=>{let e=window.innerHeight/2,t=document.elementsFromPoint(window.innerWidth/2,e).find(e=>e.tagName===`SECTION`&&e.id);t?.id&&a.emit(`intersecting:nav-item`,{id:t.id})},immediate:!0});let pe=U(()=>{let e=_.workspace[`x-scalar-color-mode`];return e===`system`?uTn():e}),me=uye(typeof document<`u`?document.body:null);mr(ce.showAgent,()=>me.value=ce.showAgent.value);let he=U(()=>f.value.mcp?.disabled?!1:!!(typeof window<`u`&&hF(window.location.href)||f.value.mcp));return(e,t)=>(F(),I(`div`,null,[(F(),L(kr(`style`),null,{default:M(()=>[z(k(f.value.customCss)+` `+k(m.value),1)]),_:1})),R(`div`,{ref:`documentEl`,class:O([`scalar-app scalar-api-reference references-layout`,[{"scalar-api-references-standalone-mobile":f.value.showSidebar,"scalar-scrollbars-obtrusive":i.value,"references-editable":f.value.isEditable,"references-sidebar":f.value.showSidebar,"references-sidebar-mobile-open":o.value,"references-classic":f.value.layout===`classic`},e.$attrs.class]])},[j(ce).agentEnabled.value?(F(),L(j(U_n),{key:0,agentScalarConfiguration:s.value[l.value]?.agent,externalUrls:f.value.externalUrls,workspaceStore:j(_)},null,8,[`agentScalarConfiguration`,`externalUrls`,`workspaceStore`])):B(``,!0),f.value.layout===`modern`?(F(),L(swn,{key:1,breadcrumb:ne.value,isSidebarOpen:o.value,showSidebar:f.value.showSidebar,onToggleSidebar:t[3]||=()=>o.value=!o.value},{search:M(()=>[f.value.hideSearch?B(``,!0):(F(),L(Z9,{key:0,class:`my-2`,document:S.value,eventBus:j(a),hideModels:f.value.hideModels,searchHotKey:f.value.searchHotKey,showSidebar:f.value.showSidebar},null,8,[`document`,`eventBus`,`hideModels`,`searchHotKey`,`showSidebar`]))]),sidebar:M(({sidebarClasses:n})=>[f.value.showSidebar&&f.value.layout===`modern`?(F(),L(j(z4),{key:0,"aria-label":`Sidebar for ${j(_).workspace.activeDocument?.info?.title}`,class:O([`t-doc__sidebar`,n]),isExpanded:j(C).isExpanded,isSelected:j(C).isSelected,items:ee.value,layout:`reference`,options:f.value,role:`navigation`,onSelectItem:t[1]||=e=>de(e,`sidebar`),onToggleGroup:t[2]||=e=>j(C).setExpanded(e,!j(C).isExpanded(e))},{header:M(()=>[u.value.length>1?(F(),L(Bwn,{key:0,modelValue:l.value,options:u.value,"onUpdate:modelValue":oe},null,8,[`modelValue`,`options`])):B(``,!0),f.value.hideSearch?B(``,!0):(F(),I(`div`,TTn,[H(Z9,{document:S.value,eventBus:j(a),hideModels:f.value.hideModels,searchHotKey:f.value.searchHotKey},null,8,[`document`,`eventBus`,`hideModels`,`searchHotKey`]),j(ce).agentEnabled.value?(F(),L(j(Lan),{key:0})):B(``,!0)])),P(e.$slots,`sidebar-start`,at($r(re.value)),void 0,!0)]),footer:M(()=>[P(e.$slots,`sidebar-end`,at($r(re.value)),()=>[H(j(C0e),{class:`darklight-reference`},{toggle:M(()=>[!f.value.hideDarkModeToggle&&!f.value.forceDarkModeState?(F(),L(j(Xy),{key:0,modelValue:pe.value===`dark`,"onUpdate:modelValue":t[0]||=()=>j(b)()},null,8,[`modelValue`])):(F(),I(`span`,ETn))]),default:M(()=>[!f.value.hideClientButton&&!he.value?(F(),L(j(Ru),{key:0,buttonSource:`sidebar`,integration:f.value._integration,isDevelopment:j(!1),url:se.value},null,8,[`integration`,`isDevelopment`,`url`])):B(``,!0),he.value?(F(),L(j(Y_n),{key:1,config:f.value.mcp,externalUrls:f.value.externalUrls,isDevelopment:j(!1),url:se.value,workspace:j(_)},null,8,[`config`,`externalUrls`,`isDevelopment`,`url`,`workspace`])):B(``,!0)]),_:1})],!0)]),_:3},8,[`aria-label`,`class`,`isExpanded`,`isSelected`,`items`,`options`])):B(``,!0)]),_:3},8,[`breadcrumb`,`isSidebarOpen`,`showSidebar`])):B(``,!0),R(`main`,{"aria-label":`Open API Documentation for ${j(_).workspace.activeDocument?.info?.title}`,class:`references-rendered`,inert:j(ce).showAgent.value},[H(rwn,{authStore:j(y).auth,clientDocument:j(y).workspace.activeDocument,document:j(_).workspace.activeDocument,environment:ae.value,eventBus:j(a),expandedItems:j(C).expandedItems.value,headingSlugGenerator:f.value.generateHeadingSlug??(e=>`${l.value}/description/${e.slug}`),infoSectionId:te.value,items:ee.value,options:f.value,xScalarDefaultClient:j(y).workspace[`x-scalar-default-client`]},jr({start:M(()=>[R(`div`,{ref_key:`documentStartRef`,ref:fe},null,512),j(_).workspace.activeDocument?(F(),L(j(Iwn),{key:0,overrides:d.value,"onUpdate:overrides":t[4]||=e=>d.value=e,class:`references-developer-tools`,configuration:f.value,externalUrls:f.value.externalUrls,workspace:j(_)},null,8,[`overrides`,`configuration`,`externalUrls`,`workspace`])):B(``,!0),f.value.layout===`classic`?(F(),L(tvn,{key:1},{"dark-mode-toggle":M(()=>[!f.value.hideDarkModeToggle&&!f.value.forceDarkModeState?(F(),L(j(Ky),{key:0,class:`text-c-2 hover:text-c-1`,mode:pe.value,style:{transform:`scale(1.4)`},variant:`icon`,onClick:t[5]||=()=>j(b)()},null,8,[`mode`])):B(``,!0)]),default:M(()=>[R(`div`,OTn,[u.value.length>1?(F(),L(Bwn,{key:0,modelValue:l.value,options:u.value,"onUpdate:modelValue":oe},null,8,[`modelValue`,`options`])):B(``,!0)]),f.value.hideSearch?B(``,!0):(F(),L(Z9,{key:0,class:`t-doc__sidebar max-w-64`,document:S.value,eventBus:j(a),hideModels:f.value.hideModels,searchHotKey:f.value.searchHotKey},null,8,[`document`,`eventBus`,`hideModels`,`searchHotKey`]))]),_:1})):B(``,!0),P(e.$slots,`content-start`,at($r(re.value)),void 0,!0)]),end:M(()=>[P(e.$slots,`content-end`,at($r(re.value)),void 0,!0)]),_:2},[f.value.isEditable?{name:`empty-state`,fn:M(()=>[P(e.$slots,`editor-placeholder`,at($r(re.value)),void 0,!0)]),key:`0`}:void 0]),1032,[`authStore`,`clientDocument`,`document`,`environment`,`eventBus`,`expandedItems`,`headingSlugGenerator`,`infoSectionId`,`items`,`options`,`xScalarDefaultClient`])],8,DTn),e.$slots.footer?(F(),I(`div`,kTn,[P(e.$slots,`footer`,at($r(re.value)),void 0,!0)])):B(``,!0),R(`div`,{ref_key:`modal`,ref:le},null,512)],2),H(j(hX))]))}}),[[`__scopeId`,`data-v-e26e2526`]]);Te(),W();var Q9=e=>e.getElementById(`api-reference`);function jTn(e){let t=e.querySelector(`[data-spec]`),n=e.querySelector(`[data-spec-url]`),r=e.querySelector(`#api-reference[data-configuration]`),i=()=>{if(r){let e=r.getAttribute(`data-configuration`);if(e)return{_integration:`html`,...JSON.parse(e.split(`&quot;`).join(`"`))}}return Se({_integration:`html`})},a=()=>{if(i().url)return i().url;if(i().spec?.url)return i().spec?.url;let t=Q9(e);if(t){let e=t.getAttribute(`data-url`)?.trim();if(e)return e}if(n){console.warn(`[@scalar/api-reference] The [data-spec-url] HTML API is deprecated. Use the new <script id="api-reference" data-url="/scalar.json" /> API instead.`);let e=n.getAttribute(`data-spec-url`);if(e)return e}},o=()=>{let n=Q9(e);if(n){let e=n.innerHTML?.trim();if(e)return e}if(t){console.warn(`[@scalar/api-reference] The [data-spec] HTML API is deprecated. Use the new <script id="api-reference" type="application/json">{"openapi":"3.1.0","info":{"title":"Example"},"paths":{}}<\/script> API instead.`);let e=t.getAttribute(`data-spec`)?.trim();if(e)return e}},s=()=>{let t=Q9(e);if(t){let e=t.getAttribute(`data-proxy-url`);if(e)return e.trim()}};if(!(!n&&!t&&!Q9(e))){let e=o()?{content:o()}:{url:a()};return Se({_integration:`html`,proxyUrl:s(),...i(),...e})}return Se({_integration:`html`})}function MTn(e,t){let n=e.querySelector(`[data-spec]`),r=e.querySelector(`[data-spec-url]`);t?.darkMode?e.body?.classList.add(`dark-mode`):e.body?.classList.add(`light-mode`);let i=NTn(e,n||r);i&&$9(i,t)}var NTn=(e,t)=>{let n=null,r=Q9(e);return r?(n=e.createElement(`div`),r?.parentNode?.insertBefore(n,r)):t&&(n=t),n},$9=(e,t)=>{let n=fn({configuration:t??e??{}}),r=(e=!1)=>{let t=e?pie(()=>ci(ATn,n)):vo(()=>ci(ATn,n));return t.use(Sie()),t.config.idPrefix=`scalar-refs`,t},i=t?typeof e==`string`?document.querySelector(e):e:null,a=r(!!t&&!!i&&i.children.length>0);t&&(i?a.mount(i):console.error(`Could not find a mount point for API References:`,e));let o=new AbortController,s={capture:!1,signal:o.signal};document.addEventListener(`scalar:reload-references`,()=>{if(console.warn(`scalar:reload-references event has been deprecated, please use the scalarInstance.app.mount method instead.`),!n.configuration)return;let t=typeof e==`string`?document.querySelector(e):e;t&&(t&&!document.body.contains(t)&&document.body.appendChild(t),a.unmount(),a=r(),a.mount(t))},s);let c=()=>{o.abort(),n.configuration={},a.unmount()};return document.addEventListener(`scalar:destroy-references`,()=>{console.warn(`scalar:destroy-references event has been deprecated, please use scalarInstance.destroy instead.`),c()},s),document.addEventListener(`scalar:update-references-config`,e=>{console.warn(`scalar:update-references-config event has been deprecated, please use scalarInstance.updateConfiguration instead.`),`detail`in e&&Object.assign(n,e.detail)},s),{app:a,getConfiguration:()=>n.configuration??{},updateConfiguration:e=>{n.configuration=e},destroy:c}};typeof window==`object`&&(window.Scalar={createApiReference:$9}),MTn(document,jTn(document))});
\ No newline at end of file
diff --git a/crates/registry-notary-server/src/api.rs b/crates/registry-notary-server/src/api.rs
deleted file mode 100644
index bba2621e3..000000000
--- a/crates/registry-notary-server/src/api.rs
+++ /dev/null
@@ -1,232 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Standalone Registry Notary routes.
-
-mod admin;
-mod audit;
-mod catalog;
-mod credentials;
-mod evaluations;
-mod oid4vci;
-mod probes;
-mod request;
-mod state;
-mod status;
-mod subject_access_policy;
-
-use admin::*;
-use audit::*;
-use catalog::*;
-use credentials::*;
-use evaluations::*;
-use oid4vci::*;
-use probes::*;
-use request::*;
-use status::*;
-use subject_access_policy::*;
-
-pub(crate) use admin::{ConfigApplyPosture, ConfigEmergencyPosture};
-pub(crate) use audit::{evidence_error_response, evidence_error_response_with_request_id};
-pub use probes::AUDIT_CHAIN_INCONSISTENT_CODE;
-#[cfg(test)]
-use state::{ApiRuntimeSnapshot, IssuerRuntimeBundle};
-pub use state::{EvidenceIssuerResolver, RegistryNotaryApiState};
-
-use std::{
-    collections::{BTreeMap, BTreeSet},
-    net::{IpAddr, SocketAddr},
-    sync::{Arc, OnceLock, RwLock},
-    time::{Duration, SystemTime},
-};
-
-use axum::body::{to_bytes, Body, Bytes};
-use axum::extract::rejection::JsonRejection;
-use axum::extract::{Path, Query, State};
-use axum::http::{header, HeaderMap, HeaderValue, Request, StatusCode, Uri};
-use axum::middleware::Next;
-use axum::response::{Html, IntoResponse, Json, Redirect, Response};
-use axum::routing::{get, post};
-use axum::{Extension, Router};
-use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-use base64::Engine;
-use registry_notary_core::sd_jwt;
-use registry_notary_core::tokens::{
-    mint_access_token, mint_pre_authorized_code, verify_notary_token, AccessTokenClaims,
-    BoundSubject, PreAuthorizedCodeClaims, PRE_AUTHORIZED_CODE_JWT_TYP,
-};
-#[cfg(feature = "registry-notary-cel")]
-use registry_notary_core::RegistryNotaryCelConfig;
-use registry_notary_core::{
-    signing_key_uses_local_software_custody, AccessMode, BatchEvaluateItemRequest,
-    BatchEvaluateRequest, BoundedClaimId, BoundedCorrelationId, ClaimEvidenceMode, ClaimRef,
-    ClaimResultView, ClaimSet, ConfigMetadata, CredentialIssueRequest, CredentialProfileConfig,
-    DeploymentProfile, DisclosureProfile, EvaluateRequest, EvaluationCapability, EvidenceActor,
-    EvidenceAuditEvent, EvidenceBatchItemAuditEvent, EvidenceConfig, EvidenceEntity,
-    EvidenceEntityReference, EvidenceError, EvidenceOnBehalfOf, EvidencePrincipal,
-    EvidenceRelationship, FederationConfig, Hashed, HolderRequest, Oid4vciConfig,
-    Oid4vciCredentialClaimMode, Oid4vciCredentialConfigurationConfig, Oid4vciDisplayImageConfig,
-    Oid4vciIssuerDisplayConfig, PolicyIdentifier, RateLimitBucket, RegistryNotaryAdminListenerMode,
-    RenderEvaluationRequest, RuleConfig, StandaloneRegistryNotaryConfig,
-    StoredSubjectAccessMetadata, SubjectAccessConfig, SubjectAccessDelegatedRelationshipConfig,
-    SubjectAccessDenialCode, SubjectAccessScopePolicy, SubjectRequest, TargetRefView,
-    VerifiedClaimValue, FORMAT_CLAIM_RESULT_JSON, FORMAT_SD_JWT_VC,
-};
-use registry_platform_audit::AuditKeyHasher;
-use registry_platform_crypto::KeyReadiness;
-use registry_platform_crypto::PublicJwk;
-use registry_platform_crypto::SigningProvider;
-use registry_platform_oid4vci::{
-    consume_validated_proof_nonce_once, validate_proof_jwt, CredentialConfigurationMetadata,
-    CredentialIssuerMetadata, CredentialOffer, CredentialRequest as Oid4vciCredentialRequest,
-    CredentialResponse as Oid4vciCredentialResponse, CredentialResponseCredential,
-    DisplayImageMetadata, DisplayMetadata, ProofValidationPolicy,
-    TokenRequest as Oid4vciTokenRequest, TokenResponse as Oid4vciTokenResponse, TxCode,
-    ValidatedProof, WireError, PRE_AUTHORIZED_CODE_GRANT_TYPE, PROOF_TYPE_JWT, SD_JWT_VC_FORMAT,
-};
-use registry_platform_ops::{
-    AckObservation, ConfigOverridePin, ConfigProvenance, ConfigSource, PostureApplyResult,
-};
-use registry_platform_pdp::{
-    decide as pdp_decide, Decision as PdpDecision, EvidenceRequestContext as PdpRequestContext,
-    PolicyInput as PdpPolicyInput,
-};
-use registry_platform_replay::{ReplayKey, ReplayScope, RequiredReplayError};
-use registry_platform_sdjwt::{validate_holder_proof, HolderProofBindings, HolderProofPolicy};
-use serde::{Deserialize, Serialize};
-use serde_json::{json, Value};
-use sha2::{Digest, Sha256};
-use time::format_description::well_known::Rfc3339;
-use time::OffsetDateTime;
-
-#[cfg(feature = "registry-notary-cel")]
-use crate::cel_worker::CelWorker;
-use crate::config_governed::ConfigGovernanceContext;
-use crate::{
-    credential_profile_for,
-    credential_status::{
-        encoded_single_entry_status_list, is_mutable_status, CredentialStatusRecord,
-        CredentialStatusStore, CredentialStatusStoreError,
-    },
-    format_time,
-    machine_quota::{MachineQuotaOperationOutcome, OPERATION_LEASE_SECONDS},
-    metrics::AppMetrics,
-    openapi_document,
-    posture::{posture_document, PostureContext, PostureDocumentError},
-    preauth_state::{
-        AuthenticatedRepresentative, CredentialMaterialization, IssuanceAuthority,
-        IssuanceTransaction, LoginState, PreauthorizationStateError,
-        RegistryClientOfferPreflightOutcome, RegistryClientOfferReservation,
-        RegistryClientOfferReservationOutcome, RegistryClientOfferResponse,
-        RegistryClientTransactionCode,
-    },
-    replay::{require_replay_insert, ReplayReadiness, ReplayStores},
-    runtime::{
-        build_claim_levels, claim_ids, claim_semantics_metadata,
-        issuance_authorization_target_binding, requested_claim_versions,
-        require_issuable_evaluation_provenance, require_registry_backed_credential_claims,
-        validate_batch_subject_limit, EvaluationAuditSnapshot,
-    },
-    standalone::{
-        generate_numeric_tx_code, generate_opaque_token, pkce_s256_challenge, pre_auth_audit_event,
-        AuthAuditState, PreAuthAuditFields, PreAuthRuntime, SignerReadiness,
-    },
-    BatchEvaluateOptions, EvidenceStore, MachineQuotaLimiter, RegistryNotaryRuntime,
-    SubjectAccessRateLimitBucket, SubjectAccessRateLimitError, SubjectAccessRateLimitKeys,
-    SubjectAccessRateLimiter,
-};
-use subtle::ConstantTimeEq;
-
-pub(crate) use crate::digest::evidence_claim_hash;
-use crate::digest::{sha256_canonical_json, sha256_json};
-pub(crate) use crate::problem::{evidence_detail, evidence_status, evidence_title};
-pub use crate::response_context::{EvidenceAuditContext, EvidenceErrorCodeContext};
-pub use oid4vci::oid4vci_proof_precheck_middleware;
-
-const DATA_PURPOSE_HEADER: &str = "data-purpose";
-const IDEMPOTENCY_KEY_HEADER: &str = "idempotency-key";
-pub(crate) const ADMIN_SCOPE: &str = "registry_notary:admin";
-pub(crate) const METRICS_SCOPE: &str = "registry_notary:metrics_read";
-pub(crate) const OPS_READ_SCOPE: &str = "registry_notary:ops_read";
-pub(crate) const REGISTRY_OFFER_CREATE_SCOPE: &str = "registry_notary:credential_offer_create";
-const OID4VCI_CREDENTIAL_PATH: &str = "/oid4vci/credential";
-// SD-JWT VC Type Metadata well-known prefix inserted between host and vct path.
-const WELL_KNOWN_VCT_PREFIX: &str = "/.well-known/vct";
-const POSTURE_FILTER_FAILED_CODE: &str = "posture.filter_failed";
-const ADMIN_CAPABILITY_NOT_SUPPORTED_CODE: &str = "registry.admin.capability.not_supported";
-const POSTURE_TIER_INVALID_CODE: &str = "registry.admin.posture.invalid_tier";
-
-pub use crate::federation::federation_router;
-
-pub(crate) fn oid4vci_proof_precheck_applies(path: &str) -> bool {
-    path == OID4VCI_CREDENTIAL_PATH
-}
-
-pub fn router<S>() -> Router<S>
-where
-    S: Clone + Send + Sync + 'static,
-{
-    public_router().merge(admin_router())
-}
-
-/// Routes mounted on the public listener.
-///
-/// This is not an unauthenticated router. Standalone composition wraps these
-/// routes in the auth/audit middleware, which exempts only explicit public
-/// protocol and probe paths.
-pub fn public_router<S>() -> Router<S>
-where
-    S: Clone + Send + Sync + 'static,
-{
-    Router::new()
-        .merge(crate::docs::router())
-        .route("/healthz", get(healthz))
-        .route("/ready", get(ready))
-        .route("/openapi.json", get(openapi_json))
-        .route("/.well-known/evidence-service", get(service_document))
-        .route("/.well-known/evidence/jwks.json", get(issuer_jwks))
-        .route(
-            "/.well-known/openid-credential-issuer",
-            get(oid4vci_issuer_metadata),
-        )
-        .route("/credentials/{*vct_path}", get(oid4vci_type_metadata))
-        .route(
-            "/.well-known/vct/{*vct_path}",
-            get(oid4vci_well_known_type_metadata),
-        )
-        .route("/oid4vci/offer/start", get(oid4vci_offer_start))
-        .route("/oid4vci/offer/callback", get(oid4vci_offer_callback))
-        .route("/oid4vci/offers", post(oid4vci_create_registry_offer))
-        .route(
-            "/oid4vci/offer/representative",
-            post(oid4vci_offer_representative),
-        )
-        .route("/oid4vci/token", post(oid4vci_token))
-        .route("/oid4vci/credential", post(oid4vci_credential))
-        .route("/v1/claims", get(list_claims))
-        .route("/v1/claims/{claim_id}", get(get_claim))
-        .route("/v1/formats", get(list_formats))
-        .route("/v1/evaluations", post(evaluate))
-        .route("/v1/batch-evaluations", post(batch_evaluate))
-        .route("/v1/evaluations/{evaluation_id}/render", post(render))
-        .route("/v1/credentials", post(issue_credential))
-        .route(
-            "/v1/credentials/{credential_id}/status",
-            get(get_credential_status),
-        )
-}
-
-pub fn admin_router<S>() -> Router<S>
-where
-    S: Clone + Send + Sync + 'static,
-{
-    Router::new()
-        .route("/admin/v1/capabilities", get(admin_capabilities))
-        .route("/admin/v1/posture", get(admin_posture))
-        .route("/admin/v1/reload", post(admin_reload))
-        .route(
-            "/admin/v1/credentials/{credential_id}/status",
-            post(update_credential_status),
-        )
-}
-
-#[cfg(test)]
-mod tests;
diff --git a/crates/registry-notary-server/src/api/admin.rs b/crates/registry-notary-server/src/api/admin.rs
deleted file mode 100644
index b6bc661b5..000000000
--- a/crates/registry-notary-server/src/api/admin.rs
+++ /dev/null
@@ -1,306 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Administrative handlers and posture response helpers.
-
-use super::*;
-
-#[derive(Clone, Debug)]
-pub(crate) struct ConfigApplyPosture {
-    pub(crate) source: ConfigSource,
-    pub(crate) last_config_hash: Option<String>,
-    pub(crate) last_bundle_id: Option<String>,
-    pub(crate) last_bundle_sequence: Option<u64>,
-    pub(crate) last_bundle_signer_kids: Vec<String>,
-    pub(crate) override_pin: Option<ConfigOverridePin>,
-    pub(crate) last_apply_result: Option<PostureApplyResult>,
-    pub(crate) last_apply_at: Option<String>,
-    pub(crate) restart_required: bool,
-    pub(crate) emergency: Option<ConfigEmergencyPosture>,
-}
-
-#[derive(Clone, Debug)]
-pub(crate) struct ConfigEmergencyPosture {
-    pub(crate) last_emergency_sequence: u64,
-    pub(crate) last_emergency_change_class: String,
-    pub(crate) last_emergency_at: Option<String>,
-    pub(crate) accepted_expires_at_unix_seconds: Vec<u64>,
-}
-
-impl Default for ConfigApplyPosture {
-    fn default() -> Self {
-        Self {
-            source: ConfigSource::LocalFile,
-            last_config_hash: None,
-            last_bundle_id: None,
-            last_bundle_sequence: None,
-            last_bundle_signer_kids: Vec::new(),
-            override_pin: None,
-            last_apply_result: None,
-            last_apply_at: None,
-            restart_required: false,
-            emergency: None,
-        }
-    }
-}
-
-impl ConfigApplyPosture {
-    pub(crate) fn from_provenance(provenance: ConfigProvenance) -> Self {
-        Self {
-            source: provenance.source,
-            last_config_hash: Some(provenance.internal_config_hash),
-            last_bundle_id: provenance.last_bundle_id,
-            last_bundle_sequence: provenance.last_bundle_sequence,
-            last_bundle_signer_kids: provenance.last_bundle_signer_kids,
-            override_pin: provenance.override_pin,
-            last_apply_result: provenance.last_apply_result,
-            last_apply_at: provenance.last_apply_at,
-            restart_required: provenance.restart_required,
-            emergency: None,
-        }
-    }
-}
-pub(super) async fn admin_reload(principal: Option<Extension<EvidencePrincipal>>) -> Response {
-    let Some(Extension(principal)) = principal else {
-        return evidence_error_response(EvidenceError::MissingCredential);
-    };
-    if !principal.has_scope(ADMIN_SCOPE) {
-        return evidence_error_response(EvidenceError::ScopeDenied {
-            required: ADMIN_SCOPE.to_string(),
-        });
-    }
-    admin_problem_response(
-        StatusCode::NOT_IMPLEMENTED,
-        ADMIN_CAPABILITY_NOT_SUPPORTED_CODE,
-        "Admin capability not supported",
-        "registry-notary standalone runtime does not support reload",
-        Some("reload.config_reload"),
-    )
-}
-
-pub(super) async fn admin_capabilities(
-    principal: Option<Extension<EvidencePrincipal>>,
-    Extension(state): Extension<Arc<RegistryNotaryApiState>>,
-) -> Response {
-    let Some(Extension(principal)) = principal else {
-        return evidence_error_response(EvidenceError::MissingCredential);
-    };
-    if !principal.has_scope(OPS_READ_SCOPE) {
-        return evidence_error_response(EvidenceError::ScopeDenied {
-            required: OPS_READ_SCOPE.to_string(),
-        });
-    }
-    let listeners = admin_capabilities_listeners(state.runtime_config().as_deref());
-    let mut response = Json(json!({
-        "schema": "registry.admin.capabilities.v1",
-        "product": "registry-notary",
-        "admin_api_version": "v1",
-        "supported_posture_tiers": ["default", "restricted"],
-        "config": {
-            "verify": {
-                "supported": false,
-                "currently_available": false
-            },
-            "dry_run": {
-                "supported": false,
-                "currently_available": false
-            },
-            "apply": {
-                "supported": false,
-                "currently_available": false,
-                "supported_sources": [],
-                "requires_signed_input": true
-            }
-        },
-        "break_glass": {
-            "supported": false,
-            "currently_available": false,
-            "rate_limit_scope": "none"
-        },
-        "listeners": listeners,
-        "root_transition": {
-            "supported": false,
-            "currently_available": false
-        },
-        "hot_swap": {
-            "supported": false,
-            "currently_available": false,
-            "components": []
-        },
-        "reload": {
-            "resource_reload": {
-                "supported": false,
-                "currently_available": false
-            },
-            "table_reload": {
-                "supported": false,
-                "currently_available": false
-            },
-            "config_reload": {
-                "supported": false,
-                "currently_available": false
-            }
-        }
-    }))
-    .into_response();
-    response
-        .headers_mut()
-        .insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
-    response
-}
-
-pub(super) fn admin_capabilities_listeners(
-    config: Option<&StandaloneRegistryNotaryConfig>,
-) -> Value {
-    let mode = config
-        .map(|config| config.server.admin_listener.mode)
-        .unwrap_or(RegistryNotaryAdminListenerMode::SharedWithPublic);
-    match mode {
-        RegistryNotaryAdminListenerMode::Dedicated => json!({
-            "admin": {
-                "mode": "dedicated",
-                "public_admin_routes": false
-            },
-            "metrics": {
-                "mode": "admin",
-                "requires_admin_scope": false,
-                "required_scope": METRICS_SCOPE
-            }
-        }),
-        RegistryNotaryAdminListenerMode::SharedWithPublic => json!({
-            "admin": {
-                "mode": "shared_with_public",
-                "public_admin_routes": true
-            },
-            "metrics": {
-                "mode": "shared_with_public",
-                "requires_admin_scope": false,
-                "required_scope": METRICS_SCOPE
-            }
-        }),
-        RegistryNotaryAdminListenerMode::Disabled => json!({
-            "admin": {
-                "mode": "disabled",
-                "public_admin_routes": false
-            },
-            "metrics": {
-                "mode": "disabled",
-                "requires_admin_scope": false,
-                "required_scope": METRICS_SCOPE
-            }
-        }),
-    }
-}
-
-pub(super) async fn admin_posture(
-    Query(query): Query<PostureQuery>,
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    principal: Option<Extension<EvidencePrincipal>>,
-) -> Response {
-    let Some(Extension(principal)) = principal else {
-        return evidence_error_response(EvidenceError::MissingCredential);
-    };
-    if !principal.has_scope(OPS_READ_SCOPE) {
-        return evidence_error_response(EvidenceError::ScopeDenied {
-            required: OPS_READ_SCOPE.to_string(),
-        });
-    }
-    let Some(Extension(state)) = state else {
-        return posture_unavailable();
-    };
-    let tier = match query.tier.as_deref() {
-        Some("restricted") => registry_platform_ops::PostureTier::Restricted,
-        Some("default") | None => registry_platform_ops::PostureTier::Default,
-        Some(_) => {
-            return admin_problem_response(
-                StatusCode::BAD_REQUEST,
-                POSTURE_TIER_INVALID_CODE,
-                "Admin posture tier invalid",
-                "posture tier must be default or restricted",
-                None,
-            )
-        }
-    };
-    match posture_document(&state, tier).await {
-        Ok(posture) => Json(posture).into_response(),
-        Err(error) => posture_filter_failed(error),
-    }
-}
-
-pub(super) fn admin_problem_response(
-    status: StatusCode,
-    code: &'static str,
-    title: &'static str,
-    detail: &'static str,
-    capability: Option<&'static str>,
-) -> Response {
-    let mut body = json!({
-        "schema": "registry.admin.error.v1",
-        "type": format!("{}/{}", crate::PROBLEM_TYPE_BASE_URL, code.replace('.', "/")),
-        "title": title,
-        "status": status.as_u16(),
-        "code": code,
-        "message": detail,
-        "detail": detail,
-    });
-    if let Some(capability) = capability {
-        body["capability"] = json!(capability);
-    }
-    let mut response = (status, Json(body)).into_response();
-    response.headers_mut().insert(
-        header::CONTENT_TYPE,
-        HeaderValue::from_static("application/problem+json"),
-    );
-    response
-}
-
-/// Service-unavailable problem for the admin posture endpoint when shared
-/// server state is not installed. Mirrors the other admin posture problems so
-/// the body shape and `application/problem+json` media type stay consistent.
-pub(super) fn posture_unavailable() -> Response {
-    admin_problem_response(
-        StatusCode::SERVICE_UNAVAILABLE,
-        "posture.unavailable",
-        "Admin posture unavailable",
-        "posture state is unavailable",
-        None,
-    )
-}
-
-#[derive(Debug, Default, Deserialize)]
-pub(super) struct PostureQuery {
-    pub(super) tier: Option<String>,
-}
-pub(super) fn posture_filter_failed(error: PostureDocumentError) -> Response {
-    let detail = match &error {
-        PostureDocumentError::Filter(filter_error) => {
-            tracing::error!(error = %filter_error, "failed to filter admin posture");
-            "admin posture could not be filtered for the requested tier"
-        }
-        PostureDocumentError::SigningKey(signing_key_error) => {
-            tracing::error!(
-                key_id = signing_key_error.key_id(),
-                "failed to project signing key posture"
-            );
-            "admin posture contains an unsupported signing key status"
-        }
-    };
-    let status = StatusCode::INTERNAL_SERVER_ERROR;
-    let mut response = (
-        status,
-        Json(json!({
-            "type": format!("{}/posture/filter_failed", crate::PROBLEM_TYPE_BASE_URL),
-            "title": "Admin posture unavailable",
-            "status": status.as_u16(),
-            "detail": detail,
-            "code": POSTURE_FILTER_FAILED_CODE,
-        })),
-    )
-        .into_response();
-    response.headers_mut().insert(
-        header::CONTENT_TYPE,
-        HeaderValue::from_static("application/problem+json"),
-    );
-    response.extensions_mut().insert(EvidenceErrorCodeContext(
-        POSTURE_FILTER_FAILED_CODE.to_string(),
-    ));
-    response
-}
diff --git a/crates/registry-notary-server/src/api/audit.rs b/crates/registry-notary-server/src/api/audit.rs
deleted file mode 100644
index 2b21e5697..000000000
--- a/crates/registry-notary-server/src/api/audit.rs
+++ /dev/null
@@ -1,774 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Audit context assembly and shared evidence problem responses.
-
-use super::*;
-
-pub(super) fn attach_evidence_audit(
-    response: &mut Response,
-    decision: &str,
-    verification_id: Option<String>,
-    claim_ids: &[String],
-    row_count: Option<u64>,
-) {
-    attach_evidence_audit_with_purposes(
-        response,
-        decision,
-        verification_id,
-        claim_ids,
-        row_count,
-        None,
-    );
-}
-
-pub(super) fn attach_evidence_audit_with_purposes(
-    response: &mut Response,
-    decision: &str,
-    verification_id: Option<String>,
-    claim_ids: &[String],
-    row_count: Option<u64>,
-    purposes: Option<Vec<String>>,
-) {
-    response.extensions_mut().insert(EvidenceAuditContext {
-        verification_id,
-        verification_decision: Some(decision.to_string()),
-        claim_hash: (!claim_ids.is_empty()).then(|| evidence_claim_hash(claim_ids)),
-        purposes,
-        row_count,
-        relay_consultation_count: None,
-        forwarded: None,
-        access_mode: None,
-        denial_code: None,
-        token_claim_name: None,
-        credential_profile: None,
-        protocol: None,
-        credential_configuration_id: None,
-        holder_binding_mode: None,
-        rate_limit_bucket: None,
-        policy_hash: None,
-        target_type: None,
-        target_ref_hash: None,
-        requester_type: None,
-        requester_ref_hash: None,
-        batch_items: None,
-        ..EvidenceAuditContext::default()
-    });
-}
-
-pub(super) fn attach_zero_relay_no_forward_audit(response: &mut Response) {
-    if let Some(audit) = response.extensions_mut().get_mut::<EvidenceAuditContext>() {
-        audit.relay_consultation_count = Some(0);
-        audit.forwarded = Some(false);
-    }
-}
-
-pub(super) fn attach_relay_consultation_audit(response: &mut Response, ids: Vec<String>) {
-    if ids.is_empty() {
-        return;
-    }
-    if let Some(audit) = response.extensions_mut().get_mut::<EvidenceAuditContext>() {
-        audit.relay_consultation_count = u64::try_from(ids.len()).ok();
-        audit.relay_consultation_ids = ids;
-    }
-}
-
-pub(super) fn attach_runtime_evaluation_audit(
-    response: &mut Response,
-    runtime_audit: EvaluationAuditSnapshot,
-) {
-    let relay_forwarded_count = runtime_audit.relay_forwarded_count();
-    let (evaluation_id, relay_consultation_ids) = runtime_audit.into_parts();
-    if let Some(audit) = response.extensions_mut().get_mut::<EvidenceAuditContext>() {
-        if evaluation_id.is_some() {
-            audit.verification_id = evaluation_id;
-        }
-        if relay_forwarded_count > 0 {
-            audit.forwarded = Some(true);
-        }
-    }
-    attach_relay_consultation_audit(response, relay_consultation_ids);
-}
-
-pub(super) fn attach_redacted_fields_audit(response: &mut Response, results: &[ClaimResultView]) {
-    let redacted_fields: BTreeSet<String> = results
-        .iter()
-        .flat_map(|result| result.redacted_fields.iter().cloned())
-        .collect();
-    if redacted_fields.is_empty() {
-        return;
-    }
-    if let Some(audit) = response.extensions_mut().get_mut::<EvidenceAuditContext>() {
-        audit.redacted_fields = Some(redacted_fields.into_iter().collect());
-    }
-}
-
-pub(super) fn attach_evaluate_request_audit(
-    response: &mut Response,
-    keys: &SubjectAccessRateLimitKeys,
-    request: &EvaluateRequest,
-    result: Option<&ClaimResultView>,
-) -> Result<(), EvidenceError> {
-    let Some(audit) = response.extensions_mut().get_mut::<EvidenceAuditContext>() else {
-        return Ok(());
-    };
-    if audit.purposes.is_none() {
-        audit.purposes = request
-            .purpose
-            .as_ref()
-            .map(|purpose| vec![purpose.clone()]);
-    }
-    audit.target_type = result
-        .map(|result| result.target_ref.entity_type.as_str())
-        .or_else(|| {
-            request
-                .target
-                .as_ref()
-                .map(|target| target.entity_type.as_str())
-        })
-        .filter(|entity_type| !entity_type.is_empty())
-        .map(str::to_string);
-    audit.target_ref_hash = match result {
-        Some(result) => Some(hash_audit_handle(
-            keys,
-            "target",
-            result.target_ref.entity_type.as_str(),
-            request.purpose.as_deref(),
-            &result.target_ref.handle,
-        )?),
-        None => match request.target.as_ref() {
-            Some(target) => {
-                hash_audit_matching_attempt(keys, "target", request.purpose.as_deref(), target)?
-            }
-            None => None,
-        },
-    };
-    if let Some(requester_ref) = result.and_then(|result| result.requester_ref.as_ref()) {
-        audit.requester_type = Some(requester_ref.entity_type.clone());
-        audit.requester_ref_hash = Some(hash_audit_handle(
-            keys,
-            "requester",
-            requester_ref.entity_type.as_str(),
-            request.purpose.as_deref(),
-            &requester_ref.handle,
-        )?);
-    } else if let Some(requester) = request.requester.as_ref() {
-        audit.requester_type = Some(requester.entity_type.clone());
-        audit.requester_ref_hash =
-            hash_audit_matching_attempt(keys, "requester", request.purpose.as_deref(), requester)?;
-    }
-    if audit.redacted_fields.is_none() {
-        audit.redacted_fields = result.and_then(|result| {
-            (!result.redacted_fields.is_empty()).then(|| result.redacted_fields.clone())
-        });
-    }
-    Ok(())
-}
-
-pub(super) fn attach_batch_evaluate_response_audit(
-    response: &mut Response,
-    keys: &SubjectAccessRateLimitKeys,
-    _evidence: &EvidenceConfig,
-    request: &BatchEvaluateRequest,
-    result: &registry_notary_core::BatchEvaluateResponse,
-    audit_purposes: Option<&[String]>,
-) -> Result<(), EvidenceError> {
-    let Some(audit) = response.extensions_mut().get_mut::<EvidenceAuditContext>() else {
-        return Ok(());
-    };
-    let mut batch_items = Vec::with_capacity(result.items.len());
-    let mut relay_consultation_ids = BTreeSet::new();
-    let mut relay_forwarded_count = 0u64;
-    for item in &result.items {
-        let request_item = request
-            .items
-            .get(item.input_index)
-            .ok_or(EvidenceError::InvalidRequest)?;
-        let purpose_scope = audit_purposes
-            .and_then(|purposes| purposes.get(item.input_index))
-            .map(String::as_str);
-        relay_forwarded_count =
-            relay_forwarded_count.saturating_add(item.runtime_audit.relay_forwarded_count);
-        relay_consultation_ids.extend(item.runtime_audit.relay_consultation_ids.iter().cloned());
-        batch_items.push(EvidenceBatchItemAuditEvent {
-            input_index: item.input_index,
-            outcome: match item.status {
-                registry_notary_core::BatchItemStatus::Succeeded => "succeeded",
-                registry_notary_core::BatchItemStatus::Failed => "failed",
-            }
-            .to_string(),
-            error_code: item
-                .errors
-                .first()
-                .map(|error| error.audit_code.as_ref().unwrap_or(&error.code).clone()),
-            relay_consultation_count: u64::try_from(
-                item.runtime_audit.relay_consultation_ids.len(),
-            )
-            .unwrap_or(u64::MAX),
-            forwarded: item.runtime_audit.relay_forwarded_count > 0,
-            relay_consultation_ids: item.runtime_audit.relay_consultation_ids.clone(),
-            target_type: Some(item.target_ref.entity_type.clone())
-                .filter(|entity_type| !entity_type.is_empty()),
-            target_ref_hash: if item.errors.is_empty() {
-                Some(hash_audit_handle(
-                    keys,
-                    "target",
-                    item.target_ref.entity_type.as_str(),
-                    purpose_scope,
-                    &item.target_ref.handle,
-                )?)
-            } else {
-                hash_audit_matching_attempt(keys, "target", purpose_scope, &request_item.target)?
-            },
-            requester_type: request_item
-                .requester
-                .as_ref()
-                .map(|requester| requester.entity_type.clone()),
-            requester_ref_hash: if item.errors.is_empty() {
-                item.requester_ref
-                    .as_ref()
-                    .map(|requester| {
-                        hash_audit_handle(
-                            keys,
-                            "requester",
-                            requester.entity_type.as_str(),
-                            purpose_scope,
-                            &requester.handle,
-                        )
-                    })
-                    .transpose()?
-            } else {
-                request_item
-                    .requester
-                    .as_ref()
-                    .map(|requester| {
-                        hash_audit_matching_attempt(keys, "requester", purpose_scope, requester)
-                    })
-                    .transpose()?
-                    .flatten()
-            },
-        });
-    }
-    audit.batch_items = Some(batch_items);
-    audit.relay_consultation_count =
-        Some(u64::try_from(relay_consultation_ids.len()).unwrap_or(u64::MAX));
-    audit.forwarded = Some(relay_forwarded_count > 0);
-    audit.relay_consultation_ids = relay_consultation_ids.into_iter().collect();
-    Ok(())
-}
-
-pub(super) fn hash_audit_handle(
-    keys: &SubjectAccessRateLimitKeys,
-    role: &str,
-    entity_type: &str,
-    purpose_scope: Option<&str>,
-    handle: &str,
-) -> Result<Hashed<EvidenceEntityReference>, EvidenceError> {
-    let input = canonical_audit_handle_input(role, entity_type, purpose_scope, handle)?;
-    keys.audit_pseudonym_ref("matched-reference-v1", &input)
-        .map(|hash| Hashed::from_hash(hash.as_str().to_string()))
-        .map_err(|error| error.evidence_error())
-}
-
-pub(super) fn hash_audit_matching_attempt(
-    keys: &SubjectAccessRateLimitKeys,
-    role: &str,
-    purpose_scope: Option<&str>,
-    entity: &EvidenceEntity,
-) -> Result<Option<Hashed<EvidenceEntityReference>>, EvidenceError> {
-    let Some(input) = canonical_audit_identifier_input(role, purpose_scope, entity)? else {
-        return Ok(None);
-    };
-    keys.audit_pseudonym_ref("matching-attempt-v1", &input)
-        .map(|hash| Some(Hashed::from_hash(hash.as_str().to_string())))
-        .map_err(|error| error.evidence_error())
-}
-
-pub(super) fn canonical_audit_handle_input(
-    role: &str,
-    entity_type: &str,
-    purpose_scope: Option<&str>,
-    handle: &str,
-) -> Result<String, EvidenceError> {
-    serde_json::to_string(&json!({
-        "class": "matched-reference-v1",
-        "version": 1,
-        "role": role,
-        "entity_type": entity_type,
-        "purpose_scope": purpose_scope.unwrap_or(""),
-        "handle": handle,
-    }))
-    .map_err(|_| EvidenceError::InvalidRequest)
-}
-
-pub(super) fn canonical_audit_identifier_input(
-    role: &str,
-    purpose_scope: Option<&str>,
-    entity: &EvidenceEntity,
-) -> Result<Option<String>, EvidenceError> {
-    let mut identifiers = entity
-        .identifiers
-        .iter()
-        .filter(|identifier| !identifier.value.trim().is_empty())
-        .map(|identifier| {
-            let mut canonical = BTreeMap::new();
-            canonical.insert("country", identifier.country.as_deref().unwrap_or(""));
-            canonical.insert("issuer", identifier.issuer.as_deref().unwrap_or(""));
-            canonical.insert("scheme", identifier.scheme.as_str());
-            canonical.insert("value", identifier.value.as_str());
-            canonical
-        })
-        .collect::<Vec<_>>();
-    identifiers.sort_by(|left, right| {
-        (
-            left["scheme"],
-            left["issuer"],
-            left["country"],
-            left["value"],
-        )
-            .cmp(&(
-                right["scheme"],
-                right["issuer"],
-                right["country"],
-                right["value"],
-            ))
-    });
-    identifiers.dedup();
-    if identifiers.is_empty() && entity.id.as_deref().is_none_or(str::is_empty) {
-        return Ok(None);
-    }
-    serde_json::to_string(&json!({
-        "class": "matching-attempt-v1",
-        "version": 1,
-        "role": role,
-        "entity_type": entity.entity_type,
-        "purpose_scope": purpose_scope.unwrap_or(""),
-        "id": entity.id.as_deref().unwrap_or(""),
-        "identifiers": identifiers,
-    }))
-    .map(Some)
-    .map_err(|_| EvidenceError::InvalidRequest)
-}
-
-// Before a stored evaluation is found, keep caller-controlled evaluation ids out of audit data.
-pub(super) fn credential_denial_response_without_evaluation(error: EvidenceError) -> Response {
-    let denial_code = denial_code_from_error(&error);
-    let mut response = evidence_error_response(error);
-    attach_evidence_audit(&mut response, "credential_denied", None, &[], None);
-    attach_zero_relay_no_forward_audit(&mut response);
-    if let Some(audit) = response.extensions_mut().get_mut::<EvidenceAuditContext>() {
-        audit.denial_code = denial_code;
-    }
-    response
-}
-
-pub(super) fn credential_denial_response_for_evaluation(
-    state: &RegistryNotaryApiState,
-    error: EvidenceError,
-    evaluation_id: &str,
-    evaluation: &registry_notary_core::StoredEvaluation,
-    principal: &EvidencePrincipal,
-    profile: Option<(&str, &CredentialProfileConfig)>,
-) -> Response {
-    let denial_code = denial_code_from_error(&error);
-    let mut response = evidence_error_response(error);
-    if evaluation.subject_access.is_some() || principal.is_subject_access() {
-        if let Err(error) = attach_subject_access_credential_denial_audit(
-            &mut response,
-            &state.subject_access_rate_keys,
-            evaluation_id,
-            evaluation,
-            profile,
-        ) {
-            return evidence_error_response(error);
-        }
-        override_subject_access_audit_access_mode(&mut response, evaluation.access_mode());
-    } else {
-        attach_evidence_audit_with_purposes(
-            &mut response,
-            "credential_denied",
-            Some(evaluation_id.to_string()),
-            &evaluation.claim_ids,
-            None,
-            Some(vec![evaluation.purpose.clone()]),
-        );
-        if let Some((profile_id, profile)) = profile {
-            if let Some(audit) = response.extensions_mut().get_mut::<EvidenceAuditContext>() {
-                audit.credential_profile = ConfigMetadata::new(profile_id).ok();
-                audit.holder_binding_mode =
-                    ConfigMetadata::new(profile.holder_binding.mode.as_str()).ok();
-            }
-        }
-    }
-    attach_zero_relay_no_forward_audit(&mut response);
-    if let Some(audit) = response.extensions_mut().get_mut::<EvidenceAuditContext>() {
-        audit.denial_code = denial_code;
-    }
-    response
-}
-
-pub(super) struct SubjectAccessCredentialAuditDetails<'a> {
-    pub(super) profile_id: &'a str,
-    pub(super) holder_binding_mode: &'a str,
-    pub(super) access_mode: AccessMode,
-    pub(super) policy_hash: Option<Hashed<PolicyIdentifier>>,
-    pub(super) purposes: Option<Vec<String>>,
-    pub(super) protocol: Option<&'a str>,
-    pub(super) credential_configuration_id: Option<&'a str>,
-}
-
-pub(super) fn attach_subject_access_credential_denial_audit(
-    response: &mut Response,
-    keys: &SubjectAccessRateLimitKeys,
-    evaluation_id: &str,
-    evaluation: &registry_notary_core::StoredEvaluation,
-    profile: Option<(&str, &CredentialProfileConfig)>,
-) -> Result<(), EvidenceError> {
-    let first_result = evaluation.results.first();
-    let target_type = first_result
-        .map(|result| result.target_ref.entity_type.clone())
-        .filter(|entity_type| !entity_type.is_empty());
-    let target_ref_hash = first_result
-        .map(|result| {
-            hash_audit_handle(
-                keys,
-                "target",
-                result.target_ref.entity_type.as_str(),
-                None,
-                &result.target_ref.handle,
-            )
-        })
-        .transpose()?;
-    let requester_type = first_result
-        .and_then(|result| result.requester_ref.as_ref())
-        .map(|requester| requester.entity_type.clone());
-    let requester_ref_hash = first_result
-        .and_then(|result| result.requester_ref.as_ref())
-        .map(|requester| {
-            hash_audit_handle(
-                keys,
-                "requester",
-                requester.entity_type.as_str(),
-                None,
-                &requester.handle,
-            )
-        })
-        .transpose()?;
-    let profile_id = profile.map(|(profile_id, _)| profile_id);
-    let holder_binding_mode = profile.map(|(_, profile)| profile.holder_binding.mode.as_str());
-    response.extensions_mut().insert(EvidenceAuditContext {
-        verification_id: Some(evaluation_id.to_string()),
-        verification_decision: Some("credential_denied".to_string()),
-        claim_hash: (!evaluation.claim_ids.is_empty())
-            .then(|| evidence_claim_hash(&evaluation.claim_ids)),
-        purposes: Some(vec![evaluation.purpose.clone()]),
-        row_count: None,
-        access_mode: Some(evaluation.access_mode()),
-        denial_code: None,
-        token_claim_name: None,
-        credential_profile: profile_id.and_then(|value| ConfigMetadata::new(value).ok()),
-        protocol: None,
-        credential_configuration_id: None,
-        holder_binding_mode: holder_binding_mode.and_then(|value| ConfigMetadata::new(value).ok()),
-        rate_limit_bucket: None,
-        policy_hash: evaluation
-            .subject_access
-            .as_ref()
-            .and_then(|metadata| metadata.policy_hash.clone()),
-        target_type,
-        target_ref_hash,
-        requester_type,
-        requester_ref_hash,
-        batch_items: None,
-        ..EvidenceAuditContext::default()
-    });
-    Ok(())
-}
-
-pub(super) fn attach_subject_access_credential_audit(
-    response: &mut Response,
-    keys: &SubjectAccessRateLimitKeys,
-    evaluation_id: &str,
-    claim_ids: &[String],
-    results: &[ClaimResultView],
-    row_count: u64,
-    details: SubjectAccessCredentialAuditDetails<'_>,
-) -> Result<(), EvidenceError> {
-    let first_result = results.first();
-    let target_type = first_result
-        .map(|result| result.target_ref.entity_type.clone())
-        .filter(|entity_type| !entity_type.is_empty());
-    let target_ref_hash = first_result
-        .map(|result| {
-            hash_audit_handle(
-                keys,
-                "target",
-                result.target_ref.entity_type.as_str(),
-                None,
-                &result.target_ref.handle,
-            )
-        })
-        .transpose()?;
-    let requester_type = first_result
-        .and_then(|result| result.requester_ref.as_ref())
-        .map(|requester| requester.entity_type.clone());
-    let requester_ref_hash = first_result
-        .and_then(|result| result.requester_ref.as_ref())
-        .map(|requester| {
-            hash_audit_handle(
-                keys,
-                "requester",
-                requester.entity_type.as_str(),
-                None,
-                &requester.handle,
-            )
-        })
-        .transpose()?;
-    response.extensions_mut().insert(EvidenceAuditContext {
-        verification_id: Some(evaluation_id.to_string()),
-        verification_decision: Some("credential_issued".to_string()),
-        claim_hash: (!claim_ids.is_empty()).then(|| evidence_claim_hash(claim_ids)),
-        purposes: details.purposes,
-        row_count: Some(row_count),
-        access_mode: Some(details.access_mode),
-        denial_code: None,
-        token_claim_name: None,
-        credential_profile: ConfigMetadata::new(details.profile_id).ok(),
-        protocol: details
-            .protocol
-            .and_then(|value| ConfigMetadata::new(value).ok()),
-        credential_configuration_id: details
-            .credential_configuration_id
-            .and_then(|value| ConfigMetadata::new(value).ok()),
-        holder_binding_mode: ConfigMetadata::new(details.holder_binding_mode).ok(),
-        rate_limit_bucket: None,
-        policy_hash: details.policy_hash,
-        target_type,
-        target_ref_hash,
-        requester_type,
-        requester_ref_hash,
-        batch_items: None,
-        ..EvidenceAuditContext::default()
-    });
-    Ok(())
-}
-
-#[allow(clippy::too_many_arguments)]
-pub(super) fn attach_registry_client_offer_audit(
-    response: &mut Response,
-    keys: &SubjectAccessRateLimitKeys,
-    decision: &str,
-    evaluation_id: &str,
-    evaluation: &registry_notary_core::StoredEvaluation,
-    credential_configuration_id: &str,
-    profile_id: &str,
-    holder_binding_mode: &str,
-    target_ref: &TargetRefView,
-) -> Result<(), EvidenceError> {
-    let target_ref_hash = hash_audit_handle(
-        keys,
-        "target",
-        target_ref.entity_type.as_str(),
-        Some(evaluation.purpose.as_str()),
-        &target_ref.handle,
-    )?;
-    response.extensions_mut().insert(EvidenceAuditContext {
-        verification_id: Some(evaluation_id.to_string()),
-        verification_decision: Some(decision.to_string()),
-        claim_hash: (!evaluation.claim_ids.is_empty())
-            .then(|| evidence_claim_hash(&evaluation.claim_ids)),
-        purposes: Some(vec![evaluation.purpose.clone()]),
-        row_count: Some(evaluation.results.len() as u64),
-        relay_consultation_count: Some(0),
-        forwarded: Some(false),
-        access_mode: Some(AccessMode::MachineClient),
-        credential_profile: ConfigMetadata::new(profile_id).ok(),
-        protocol: ConfigMetadata::new("openid4vci").ok(),
-        credential_configuration_id: ConfigMetadata::new(credential_configuration_id).ok(),
-        holder_binding_mode: ConfigMetadata::new(holder_binding_mode).ok(),
-        target_type: Some(target_ref.entity_type.clone())
-            .filter(|entity_type| !entity_type.is_empty()),
-        target_ref_hash: Some(target_ref_hash),
-        ..EvidenceAuditContext::default()
-    });
-    Ok(())
-}
-
-pub(super) fn attach_subject_access_success_audit(
-    response: &mut Response,
-    decision: &str,
-    verification_id: Option<String>,
-    claim_ids: &[String],
-    row_count: Option<u64>,
-    purposes: Option<Vec<String>>,
-    policy_hash: Option<Hashed<PolicyIdentifier>>,
-) {
-    response.extensions_mut().insert(EvidenceAuditContext {
-        verification_id,
-        verification_decision: Some(decision.to_string()),
-        claim_hash: (!claim_ids.is_empty()).then(|| evidence_claim_hash(claim_ids)),
-        purposes,
-        row_count,
-        access_mode: Some(AccessMode::SubjectBound),
-        denial_code: None,
-        token_claim_name: None,
-        credential_profile: None,
-        protocol: None,
-        credential_configuration_id: None,
-        holder_binding_mode: None,
-        rate_limit_bucket: None,
-        policy_hash,
-        target_type: None,
-        target_ref_hash: None,
-        requester_type: None,
-        requester_ref_hash: None,
-        batch_items: None,
-        ..EvidenceAuditContext::default()
-    });
-}
-
-pub(super) fn override_subject_access_audit_access_mode(
-    response: &mut Response,
-    access_mode: AccessMode,
-) {
-    if let Some(audit) = response.extensions_mut().get_mut::<EvidenceAuditContext>() {
-        audit.access_mode = Some(access_mode);
-    }
-}
-
-pub(super) fn attach_subject_access_audit(
-    response: &mut Response,
-    decision: &str,
-    claim_ids: &[String],
-    denial_code: Option<SubjectAccessDenialCode>,
-    token_claim_name: Option<&str>,
-) {
-    response.extensions_mut().insert(EvidenceAuditContext {
-        verification_id: None,
-        verification_decision: Some(decision.to_string()),
-        claim_hash: (!claim_ids.is_empty()).then(|| evidence_claim_hash(claim_ids)),
-        purposes: None,
-        row_count: None,
-        access_mode: Some(AccessMode::SubjectBound),
-        denial_code,
-        token_claim_name: token_claim_name.and_then(|name| ConfigMetadata::new(name).ok()),
-        credential_profile: None,
-        protocol: None,
-        credential_configuration_id: None,
-        holder_binding_mode: None,
-        rate_limit_bucket: None,
-        policy_hash: None,
-        target_type: None,
-        target_ref_hash: None,
-        requester_type: None,
-        requester_ref_hash: None,
-        batch_items: None,
-        ..EvidenceAuditContext::default()
-    });
-}
-
-pub(super) fn attach_oid4vci_subject_access_denial_audit(
-    response: &mut Response,
-    decision: &str,
-    claim_ids: &[String],
-    credential_configuration_id: &str,
-    denial_code: Option<SubjectAccessDenialCode>,
-    token_claim_name: Option<&str>,
-) {
-    response.extensions_mut().insert(EvidenceAuditContext {
-        verification_id: None,
-        verification_decision: Some(decision.to_string()),
-        claim_hash: (!claim_ids.is_empty()).then(|| evidence_claim_hash(claim_ids)),
-        purposes: None,
-        row_count: None,
-        access_mode: Some(AccessMode::SubjectBound),
-        denial_code,
-        token_claim_name: token_claim_name.and_then(|name| ConfigMetadata::new(name).ok()),
-        credential_profile: None,
-        protocol: ConfigMetadata::new("openid4vci").ok(),
-        credential_configuration_id: ConfigMetadata::new(credential_configuration_id).ok(),
-        holder_binding_mode: None,
-        rate_limit_bucket: None,
-        policy_hash: None,
-        target_type: None,
-        target_ref_hash: None,
-        requester_type: None,
-        requester_ref_hash: None,
-        batch_items: None,
-        ..EvidenceAuditContext::default()
-    });
-}
-
-pub(super) fn attach_subject_access_rate_limit_audit(
-    response: &mut Response,
-    decision: &str,
-    claim_ids: &[String],
-    bucket: Option<SubjectAccessRateLimitBucket>,
-) {
-    response.extensions_mut().insert(EvidenceAuditContext {
-        verification_id: None,
-        verification_decision: Some(decision.to_string()),
-        claim_hash: (!claim_ids.is_empty()).then(|| evidence_claim_hash(claim_ids)),
-        purposes: None,
-        row_count: None,
-        access_mode: Some(AccessMode::SubjectBound),
-        denial_code: Some(SubjectAccessDenialCode::RateLimited),
-        token_claim_name: None,
-        credential_profile: None,
-        protocol: None,
-        credential_configuration_id: None,
-        holder_binding_mode: None,
-        rate_limit_bucket: bucket.and_then(|bucket| RateLimitBucket::new(bucket.as_str()).ok()),
-        policy_hash: None,
-        target_type: None,
-        target_ref_hash: None,
-        requester_type: None,
-        requester_ref_hash: None,
-        batch_items: None,
-        ..EvidenceAuditContext::default()
-    });
-}
-
-pub(crate) fn evidence_error_response(error: EvidenceError) -> Response {
-    let request_id = crate::standalone::current_request_correlation_id();
-    evidence_error_response_with_request_id(error, request_id.as_ref())
-}
-
-pub(crate) fn evidence_error_response_with_request_id(
-    error: EvidenceError,
-    request_id: Option<&BoundedCorrelationId>,
-) -> Response {
-    let code = error.code().to_string();
-    let audit_code = error.audit_code().to_string();
-    let status = evidence_status(&error);
-    let mut body = json!({
-        "type": format!("{}/{}", crate::PROBLEM_TYPE_BASE_URL, code.replace('.', "/")),
-        "title": evidence_title(&error),
-        "status": status.as_u16(),
-        "detail": evidence_detail(&error),
-        "code": code,
-    });
-    if let Some(request_id) = request_id {
-        body["request_id"] = json!(request_id.as_str());
-    }
-    let mut response = (status, Json(body)).into_response();
-    response
-        .extensions_mut()
-        .insert(EvidenceErrorCodeContext(audit_code));
-    response.headers_mut().insert(
-        header::CONTENT_TYPE,
-        HeaderValue::from_static("application/problem+json"),
-    );
-    if let EvidenceError::MachineQuotaExceeded {
-        retry_after_seconds,
-    } = &error
-    {
-        if let Ok(value) = HeaderValue::from_str(&retry_after_seconds.to_string()) {
-            response.headers_mut().insert(header::RETRY_AFTER, value);
-        }
-    }
-    if let Some(request_id) = request_id {
-        if let Ok(value) = HeaderValue::from_str(request_id.as_str()) {
-            response.headers_mut().insert("x-request-id", value);
-        }
-    }
-    response
-}
diff --git a/crates/registry-notary-server/src/api/catalog.rs b/crates/registry-notary-server/src/api/catalog.rs
deleted file mode 100644
index 67c7dc004..000000000
--- a/crates/registry-notary-server/src/api/catalog.rs
+++ /dev/null
@@ -1,132 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Service discovery, schema catalog, formats, and issuer key handlers.
-
-use super::*;
-
-pub(super) async fn openapi_json(
-    principal: Option<Extension<EvidencePrincipal>>,
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-) -> Response {
-    let state = state.map(|Extension(state)| state);
-    if openapi_requires_auth_from_state(state.as_deref()) && principal.is_none() {
-        return evidence_error_response(EvidenceError::MissingCredential);
-    }
-    Json(openapi_document()).into_response()
-}
-
-pub(super) fn openapi_requires_auth_from_state(state: Option<&RegistryNotaryApiState>) -> bool {
-    state.is_none_or(RegistryNotaryApiState::openapi_requires_auth)
-}
-pub(super) async fn service_document(
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    principal: Option<Extension<EvidencePrincipal>>,
-) -> Response {
-    let Some(Extension(principal)) = principal else {
-        return evidence_error_response(EvidenceError::MissingCredential);
-    };
-    let Some(Extension(state)) = state else {
-        return evidence_error_response(EvidenceError::ServerDisabled);
-    };
-    let evidence = match state.enabled_evidence() {
-        Ok(evidence) => evidence,
-        Err(error) => return evidence_error_response(error),
-    };
-    let include_subject_access_details =
-        classify_subject_access_principal(&state.subject_access, &principal)
-            .is_ok_and(|principal| principal.is_subject_access());
-    let mut document = RegistryNotaryRuntime::service_document_with_subject_access(
-        evidence,
-        &state.subject_access,
-        include_subject_access_details,
-    );
-    if state.credential_status.is_enabled() {
-        advertise_credential_status(&mut document);
-    }
-    Json(document).into_response()
-}
-
-pub(super) fn advertise_credential_status(document: &mut Value) {
-    document["credential_capabilities"]["sd_jwt_vc"]["status_methods"] = json!(["status_list"]);
-    document["credential_capabilities"]["sd_jwt_vc"]["credential_status_url"] =
-        json!("/v1/credentials/{credential_id}/status");
-    document["credential_capabilities"]["sd_jwt_vc"]["credential_status_media_type"] =
-        json!("application/statuslist+jwt");
-    if let Some(features) =
-        document["credential_capabilities"]["unsupported_features"].as_array_mut()
-    {
-        features.retain(|feature| feature.as_str() != Some("credential_status"));
-    }
-}
-pub(super) async fn issuer_jwks(state: Option<Extension<Arc<RegistryNotaryApiState>>>) -> Response {
-    let Some(Extension(state)) = state else {
-        return evidence_error_response(EvidenceError::ServerDisabled);
-    };
-    let evidence = match state.enabled_evidence() {
-        Ok(evidence) => evidence,
-        Err(error) => return evidence_error_response(error),
-    };
-    match state.issuer_resolver().public_jwks(evidence) {
-        Ok(keys) => Json(json!({ "keys": keys })).into_response(),
-        Err(error) => evidence_error_response(error),
-    }
-}
-
-pub(super) async fn list_claims(
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    principal: Option<Extension<EvidencePrincipal>>,
-) -> Response {
-    let Some(Extension(state)) = state else {
-        return evidence_error_response(EvidenceError::ServerDisabled);
-    };
-    let Some(Extension(principal)) = principal else {
-        return evidence_error_response(EvidenceError::MissingCredential);
-    };
-    let evidence = match state.enabled_evidence() {
-        Ok(evidence) => evidence,
-        Err(error) => return evidence_error_response(error),
-    };
-    Json(json!({
-        "data": RegistryNotaryRuntime::list_claims(evidence, &principal),
-    }))
-    .into_response()
-}
-
-pub(super) async fn get_claim(
-    Path(claim_id): Path<String>,
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    principal: Option<Extension<EvidencePrincipal>>,
-) -> Response {
-    let Some(Extension(state)) = state else {
-        return evidence_error_response(EvidenceError::ServerDisabled);
-    };
-    let Some(Extension(principal)) = principal else {
-        return evidence_error_response(EvidenceError::MissingCredential);
-    };
-    let evidence = match state.enabled_evidence() {
-        Ok(evidence) => evidence,
-        Err(error) => return evidence_error_response(error),
-    };
-    result_json(RegistryNotaryRuntime::get_claim(
-        evidence, &principal, &claim_id,
-    ))
-}
-
-pub(super) async fn list_formats(
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    principal: Option<Extension<EvidencePrincipal>>,
-) -> Response {
-    if principal.is_none() {
-        return evidence_error_response(EvidenceError::MissingCredential);
-    }
-    let Some(Extension(state)) = state else {
-        return evidence_error_response(EvidenceError::ServerDisabled);
-    };
-    let evidence = match state.enabled_evidence() {
-        Ok(evidence) => evidence,
-        Err(error) => return evidence_error_response(error),
-    };
-    Json(json!({
-        "formats": RegistryNotaryRuntime::list_formats(evidence),
-    }))
-    .into_response()
-}
diff --git a/crates/registry-notary-server/src/api/credentials.rs b/crates/registry-notary-server/src/api/credentials.rs
deleted file mode 100644
index a15f9b629..000000000
--- a/crates/registry-notary-server/src/api/credentials.rs
+++ /dev/null
@@ -1,629 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Direct credential issuance and issuance policy hashing.
-
-use super::*;
-
-pub(super) async fn issue_credential(
-    headers: HeaderMap,
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    principal: Option<Extension<EvidencePrincipal>>,
-    request: Result<Json<CredentialIssueRequest>, JsonRejection>,
-) -> Response {
-    if has_idempotency_key(&headers) {
-        return credential_denial_response_without_evaluation(EvidenceError::InvalidRequest);
-    }
-    let request = match parse_json_body(request) {
-        Ok(request) => request,
-        Err(error) => return credential_denial_response_without_evaluation(error),
-    };
-    let Some(Extension(state)) = state else {
-        return evidence_error_response(EvidenceError::ServerDisabled);
-    };
-    let Some(Extension(principal)) = principal else {
-        return credential_denial_response_without_evaluation(EvidenceError::MissingCredential);
-    };
-    let evidence = match state.enabled_evidence() {
-        Ok(evidence) => evidence,
-        Err(error) => return evidence_error_response(error),
-    };
-    let mut principal = match classify_subject_access_principal(&state.subject_access, &principal) {
-        Ok(principal) => principal,
-        Err(error) => {
-            let denial_code = denial_code_from_error(&error);
-            let mut response = evidence_error_response(error);
-            attach_subject_access_audit(
-                &mut response,
-                "credential_denied",
-                &[],
-                denial_code,
-                Some(state.subject_access.subject_binding.token_claim.as_str()),
-            );
-            attach_zero_relay_no_forward_audit(&mut response);
-            return response;
-        }
-    };
-    let lookup_client_id = match stored_evaluation_client_id(&state, &principal) {
-        Ok(client_id) => client_id,
-        Err(error) => return credential_denial_response_without_evaluation(error),
-    };
-    let evaluation = match state
-        .store
-        .get(&request.evaluation_id, &lookup_client_id)
-        .await
-    {
-        Ok(Some(evaluation)) => evaluation,
-        Ok(None) => {
-            return credential_denial_response_without_evaluation(
-                EvidenceError::EvaluationNotFound,
-            );
-        }
-        Err(error) => return credential_denial_response_without_evaluation(error),
-    };
-    if let Some(metadata) = evaluation.subject_access.as_ref() {
-        if principal.is_subject_access() {
-            if let Err(error) = apply_stored_subject_access_access_mode(&mut principal, metadata) {
-                return credential_denial_response_for_evaluation(
-                    &state,
-                    error,
-                    &request.evaluation_id,
-                    &evaluation,
-                    &principal,
-                    None,
-                );
-            }
-        }
-    }
-    if !evaluation_client_matches(&state, &principal, &evaluation)
-        || evaluation.access_mode() != principal.access_mode()
-    {
-        let error = if principal.is_subject_access() {
-            EvidenceError::EvaluationNotFound
-        } else {
-            EvidenceError::EvaluationBindingMismatch
-        };
-        return credential_denial_response_for_evaluation(
-            &state,
-            error,
-            &request.evaluation_id,
-            &evaluation,
-            &principal,
-            None,
-        );
-    }
-    if let Err(error) = require_evaluation_access(evidence, &principal, &evaluation) {
-        return credential_denial_response_for_evaluation(
-            &state,
-            error,
-            &request.evaluation_id,
-            &evaluation,
-            &principal,
-            None,
-        );
-    }
-    if let Some(format) = request.format.as_deref() {
-        if format != FORMAT_SD_JWT_VC {
-            return credential_denial_response_for_evaluation(
-                &state,
-                EvidenceError::FormatUnsupported,
-                &request.evaluation_id,
-                &evaluation,
-                &principal,
-                None,
-            );
-        }
-    }
-    if let Some(disclosure) = request.disclosure.as_deref() {
-        if disclosure != evaluation.disclosure {
-            return credential_denial_response_for_evaluation(
-                &state,
-                EvidenceError::EvaluationBindingMismatch,
-                &request.evaluation_id,
-                &evaluation,
-                &principal,
-                None,
-            );
-        }
-    }
-    if let Some(claims) = &request.claims {
-        if claims != &evaluation.claim_ids {
-            return credential_denial_response_for_evaluation(
-                &state,
-                EvidenceError::EvaluationBindingMismatch,
-                &request.evaluation_id,
-                &evaluation,
-                &principal,
-                None,
-            );
-        }
-    }
-    if let Some(purpose) = request.purpose.as_deref() {
-        if purpose != evaluation.purpose {
-            return credential_denial_response_for_evaluation(
-                &state,
-                EvidenceError::EvaluationBindingMismatch,
-                &request.evaluation_id,
-                &evaluation,
-                &principal,
-                None,
-            );
-        }
-    }
-    let (profile_id, profile) = match credential_profile_for(
-        evidence,
-        &evaluation,
-        request.credential_profile.as_deref(),
-    ) {
-        Ok(profile) => profile,
-        Err(error) => return evidence_error_response(error),
-    };
-    if evaluation.format != FORMAT_CLAIM_RESULT_JSON {
-        return credential_denial_response_for_evaluation(
-            &state,
-            EvidenceError::EvaluationBindingMismatch,
-            &request.evaluation_id,
-            &evaluation,
-            &principal,
-            Some((profile_id, profile)),
-        );
-    }
-    if evaluation
-        .subject_access
-        .as_ref()
-        .is_some_and(|metadata| metadata.access_mode == AccessMode::DelegatedSubjectAccess)
-    {
-        return credential_denial_response_for_evaluation(
-            &state,
-            subject_access_denied(SubjectAccessDenialCode::ProfileDenied),
-            &request.evaluation_id,
-            &evaluation,
-            &principal,
-            Some((profile_id, profile)),
-        );
-    }
-    if let Err(error) = require_subject_access_stored_access(
-        &state,
-        evidence,
-        &principal,
-        &evaluation,
-        request.claims.as_deref().unwrap_or(&evaluation.claim_ids),
-        request
-            .disclosure
-            .as_deref()
-            .unwrap_or(&evaluation.disclosure),
-        &evaluation.format,
-        true,
-    ) {
-        return credential_denial_response_for_evaluation(
-            &state,
-            error,
-            &request.evaluation_id,
-            &evaluation,
-            &principal,
-            Some((profile_id, profile)),
-        );
-    }
-    if principal.is_subject_access() {
-        if !state.subject_access.allowed_operations.issue_credential {
-            return credential_denial_response_for_evaluation(
-                &state,
-                subject_access_denied(SubjectAccessDenialCode::OperationDenied),
-                &request.evaluation_id,
-                &evaluation,
-                &principal,
-                Some((profile_id, profile)),
-            );
-        }
-        if let Err(error) = require_subject_access_credential_profile_policy(
-            &state.subject_access,
-            profile_id,
-            profile,
-        ) {
-            return credential_denial_response_for_evaluation(
-                &state,
-                error,
-                &request.evaluation_id,
-                &evaluation,
-                &principal,
-                Some((profile_id, profile)),
-            );
-        }
-    }
-    // Fail-closed: every evaluated claim must appear in the profile's
-    // allow-list. An empty `allowed_claims` therefore permits nothing rather
-    // than permitting everything. The config-load validator (see
-    // `EvidenceConfigError::EmptyAllowedClaims`) catches misconfiguration up
-    // front; this inversion is the type-level safety net for any code path
-    // that constructs an `EvidenceConfig` without going through validate().
-    if !evaluation.claim_ids.iter().all(|claim| {
-        profile
-            .allowed_claims
-            .iter()
-            .any(|allowed| allowed == claim)
-    }) {
-        return credential_denial_response_for_evaluation(
-            &state,
-            EvidenceError::EvaluationBindingMismatch,
-            &request.evaluation_id,
-            &evaluation,
-            &principal,
-            Some((profile_id, profile)),
-        );
-    }
-    if !profile.disclosure.allowed.is_empty()
-        && !profile
-            .disclosure
-            .allowed
-            .iter()
-            .any(|allowed| allowed == &evaluation.disclosure)
-    {
-        return credential_denial_response_for_evaluation(
-            &state,
-            EvidenceError::DisclosureNotAllowed,
-            &request.evaluation_id,
-            &evaluation,
-            &principal,
-            Some((profile_id, profile)),
-        );
-    }
-    let proof_binding = match validate_holder_request(
-        profile,
-        profile_id,
-        &request,
-        &evaluation,
-        request.holder.as_ref(),
-        &evidence.service_id,
-    ) {
-        Ok(binding) => binding,
-        Err(error) => {
-            return credential_denial_response_for_evaluation(
-                &state,
-                error,
-                &request.evaluation_id,
-                &evaluation,
-                &principal,
-                Some((profile_id, profile)),
-            );
-        }
-    };
-    if let Err(error) =
-        require_issuable_evaluation_provenance(evidence, &request.evaluation_id, &evaluation)
-    {
-        return credential_denial_response_for_evaluation(
-            &state,
-            error,
-            &request.evaluation_id,
-            &evaluation,
-            &principal,
-            Some((profile_id, profile)),
-        );
-    }
-    let holder_id = request
-        .holder
-        .as_ref()
-        .and_then(|holder| holder.id.as_deref());
-    if principal.is_subject_access() {
-        let principal_hash = match state
-            .subject_access_rate_keys
-            .principal(&principal.principal_id)
-        {
-            Ok(hash) => hash,
-            Err(error) => return evidence_error_response(error.evidence_error()),
-        };
-        let holder_hash = match holder_id
-            .map(|holder_id| state.subject_access_rate_keys.holder(holder_id))
-            .transpose()
-        {
-            Ok(hash) => hash,
-            Err(error) => return evidence_error_response(error.evidence_error()),
-        };
-        if let Err(error) = state
-            .subject_access_rate_limiter
-            .check_credential_issuance(&principal_hash, holder_hash.as_ref())
-            .await
-        {
-            let mut response = evidence_error_response(error.evidence_error());
-            if let Err(audit_error) = attach_subject_access_credential_denial_audit(
-                &mut response,
-                &state.subject_access_rate_keys,
-                &request.evaluation_id,
-                &evaluation,
-                Some((profile_id, profile)),
-            ) {
-                return evidence_error_response(audit_error);
-            }
-            if let Some(audit) = response.extensions_mut().get_mut::<EvidenceAuditContext>() {
-                audit.verification_decision = Some("credential_issue_rate_limited".to_string());
-                audit.denial_code = Some(SubjectAccessDenialCode::RateLimited);
-                audit.rate_limit_bucket = error
-                    .bucket()
-                    .and_then(|bucket| RateLimitBucket::new(bucket.as_str()).ok());
-            }
-            override_subject_access_audit_access_mode(&mut response, principal.access_mode());
-            attach_zero_relay_no_forward_audit(&mut response);
-            return response;
-        }
-    }
-    let issuer = match state.issuer_resolver().issuer(profile_id) {
-        Ok(issuer) => issuer,
-        Err(error) => return evidence_error_response(error),
-    };
-    // Anchor the signed JWT `iat` to the earliest claim `issued_at` so two
-    // re-issuances of the same evaluation produce identical `iat`. When claims
-    // shared a memoized upstream read, all `issued_at` are equal and the JWT
-    // `iat` matches the disclosure timestamps.
-    let iat = earliest_issued_at(&evaluation.results).unwrap_or_else(OffsetDateTime::now_utc);
-    let subject_ref = if principal.is_subject_access() {
-        match holder_id {
-            Some(holder_id) => holder_id,
-            None => {
-                return credential_denial_response_for_evaluation(
-                    &state,
-                    EvidenceError::HolderProofRequired,
-                    &request.evaluation_id,
-                    &evaluation,
-                    &principal,
-                    Some((profile_id, profile)),
-                );
-            }
-        }
-    } else {
-        match holder_id.or_else(|| {
-            evaluation
-                .results
-                .first()
-                .map(|result| result.target_ref.handle.as_str())
-        }) {
-            Some(subject_ref) => subject_ref,
-            None => {
-                return credential_denial_response_for_evaluation(
-                    &state,
-                    EvidenceError::InvalidRequest,
-                    &request.evaluation_id,
-                    &evaluation,
-                    &principal,
-                    Some((profile_id, profile)),
-                );
-            }
-        }
-    };
-    if let Some(binding) = proof_binding {
-        if let Err(error) = require_replay_insert(
-            state.replay.store().as_ref(),
-            &binding.scope,
-            &binding.key,
-            binding.expires_at,
-        )
-        .await
-        {
-            let evidence_error = match error {
-                RequiredReplayError::AlreadySeen => {
-                    state.metrics.record_replay("holder_proof", "replayed");
-                    EvidenceError::HolderProofReplay
-                }
-                RequiredReplayError::Store { .. } => {
-                    state.metrics.record_replay("holder_proof", "error");
-                    EvidenceError::CredentialIssuanceFailed
-                }
-                _ => {
-                    state.metrics.record_replay("holder_proof", "error");
-                    EvidenceError::CredentialIssuanceFailed
-                }
-            };
-            if matches!(evidence_error, EvidenceError::HolderProofReplay) {
-                return credential_denial_response_for_evaluation(
-                    &state,
-                    evidence_error,
-                    &request.evaluation_id,
-                    &evaluation,
-                    &principal,
-                    Some((profile_id, profile)),
-                );
-            }
-            return evidence_error_response(evidence_error);
-        }
-        state.metrics.record_replay("holder_proof", "accepted");
-    }
-    if !principal.is_subject_access() {
-        if let Some(preauth) = preauth_runtime(&state) {
-            let evaluation_expires_at =
-                match OffsetDateTime::parse(&evaluation.expires_at, &Rfc3339) {
-                    Ok(expires_at) if expires_at > OffsetDateTime::now_utc() => expires_at,
-                    _ => {
-                        return credential_denial_response_for_evaluation(
-                            &state,
-                            EvidenceError::EvaluationNotFound,
-                            &request.evaluation_id,
-                            &evaluation,
-                            &principal,
-                            Some((profile_id, profile)),
-                        )
-                    }
-                };
-            if let Err(error) = preauth
-                .preauthorization_state()
-                .reserve_evaluation_issuance(
-                    &request.evaluation_id,
-                    &evaluation.client_id,
-                    evaluation_expires_at,
-                )
-                .await
-            {
-                let error = match error {
-                    PreauthorizationStateError::EvaluationConsumed => {
-                        EvidenceError::EvidenceNotAvailable
-                    }
-                    _ => EvidenceError::CredentialIssuanceFailed,
-                };
-                return credential_denial_response_for_evaluation(
-                    &state,
-                    error,
-                    &request.evaluation_id,
-                    &evaluation,
-                    &principal,
-                    Some((profile_id, profile)),
-                );
-            }
-        }
-    }
-    let credential_id = state
-        .credential_status
-        .is_enabled()
-        .then(sd_jwt::new_credential_id);
-    let status_claim = credential_id
-        .as_deref()
-        .and_then(|credential_id| state.credential_status.status_claim(credential_id));
-    let signed = match sd_jwt::issue(
-        profile,
-        &issuer,
-        &evaluation.results,
-        subject_ref,
-        holder_id,
-        iat,
-        sd_jwt::IssueOptions {
-            credential_id,
-            status: status_claim,
-            projection: None,
-        },
-    )
-    .await
-    {
-        Ok(signed) => signed,
-        Err(error) => return evidence_error_response(error),
-    };
-    let expires_at = match iat.checked_add(time::Duration::seconds(profile.validity_seconds)) {
-        Some(expires_at) => expires_at,
-        None => return evidence_error_response(EvidenceError::CredentialIssuanceFailed),
-    };
-    if state.credential_status.is_enabled()
-        && state
-            .credential_status
-            .record_issued(
-                signed.credential_id.clone(),
-                signed.issuer.clone(),
-                profile_id.to_string(),
-                iat,
-                expires_at,
-            )
-            .await
-            .is_err()
-    {
-        return evidence_error_response(EvidenceError::CredentialIssuanceFailed);
-    }
-    state.metrics.record_credential("direct", "issued");
-    let mut response = Json(json!({
-        "credential_id": signed.credential_id,
-        "credential_profile": profile_id,
-        "format": FORMAT_SD_JWT_VC,
-        "issuer": signed.issuer,
-        "expires_at": signed.expires_at,
-        "credential": signed.compact,
-        "issuer_signed_jwt": signed.issuer_signed_jwt,
-        "disclosures": signed.disclosures,
-    }))
-    .into_response();
-    response.headers_mut().insert(
-        header::CONTENT_TYPE,
-        HeaderValue::from_static("application/json"),
-    );
-    if let Some(metadata) = evaluation.subject_access.as_ref() {
-        if let Err(error) = attach_subject_access_credential_audit(
-            &mut response,
-            &state.subject_access_rate_keys,
-            &request.evaluation_id,
-            &evaluation.claim_ids,
-            &evaluation.results,
-            evaluation.results.len() as u64,
-            SubjectAccessCredentialAuditDetails {
-                profile_id,
-                holder_binding_mode: &profile.holder_binding.mode,
-                access_mode: metadata.access_mode,
-                policy_hash: metadata.policy_hash.clone(),
-                purposes: Some(vec![evaluation.purpose.clone()]),
-                protocol: None,
-                credential_configuration_id: None,
-            },
-        ) {
-            return evidence_error_response(error);
-        }
-        override_subject_access_audit_access_mode(&mut response, metadata.access_mode);
-    } else {
-        attach_evidence_audit_with_purposes(
-            &mut response,
-            "credential_issued",
-            Some(request.evaluation_id.clone()),
-            &evaluation.claim_ids,
-            Some(evaluation.results.len() as u64),
-            Some(vec![evaluation.purpose.clone()]),
-        );
-    }
-    response
-}
-
-/// Pick the earliest `issued_at` from a set of claim results to use as the
-/// signed JWT `iat`. Returns `None` if there are no results or none parse,
-/// in which case the caller falls back to `OffsetDateTime::now_utc()`.
-pub(super) fn subject_access_policy_hash(
-    evidence: &EvidenceConfig,
-    config: &SubjectAccessConfig,
-    claim_ids: &[String],
-    disclosure: &str,
-    format: &str,
-) -> Result<Hashed<PolicyIdentifier>, EvidenceError> {
-    let mut claim_profiles = Vec::new();
-    let mut credential_profiles = Vec::new();
-    for claim_id in claim_ids {
-        let claim = crate::find_claim(evidence, claim_id)?;
-        claim_profiles.push(json!({
-            "id": claim.id,
-            "purpose": claim.purpose,
-            "formats": claim.formats,
-            "disclosure": {
-                "default": claim.disclosure.default,
-                "allowed": claim.disclosure.allowed,
-            },
-            "credential_profiles": claim.credential_profiles,
-        }));
-    }
-    for profile_id in &config.credential_profiles {
-        let Some(profile) = evidence.credential_profiles.get(profile_id) else {
-            continue;
-        };
-        credential_profiles.push(json!({
-            "id": profile_id,
-            "format": profile.format,
-            "issuer": profile.issuer,
-            "signing_key": profile.signing_key,
-            "vct": profile.vct,
-            "validity_seconds": profile.validity_seconds,
-            "holder_binding": {
-                "mode": profile.holder_binding.mode,
-                "proof_of_possession": profile.holder_binding.proof_of_possession,
-                "allowed_did_methods": profile.holder_binding.allowed_did_methods,
-            },
-            "allowed_claims": profile.allowed_claims,
-            "disclosure": {
-                "allowed": profile.disclosure.allowed,
-            },
-        }));
-    }
-    let canonical = json!({
-        "subject_binding": {
-            "token_claim": config.subject_binding.token_claim,
-            "request_field": config.subject_binding.request_field,
-            "id_type": config.subject_binding.id_type,
-            "normalize": config.subject_binding.normalize,
-        },
-        "allowed_claims": config.allowed_claims,
-        "requested_claims": claim_ids,
-        "allowed_disclosures": config.allowed_disclosures,
-        "requested_disclosure": disclosure,
-        "allowed_formats": config.allowed_formats,
-        "requested_format": format,
-        "credential_profiles": config.credential_profiles,
-        "delegation": config.delegation,
-        "credential_profile_policy": credential_profiles,
-        "max_credential_validity_seconds": config.token_policy.max_credential_validity_seconds,
-        "claim_profiles": claim_profiles,
-    });
-    sha256_canonical_json(&canonical).map(Hashed::from_hash)
-}
diff --git a/crates/registry-notary-server/src/api/evaluations.rs b/crates/registry-notary-server/src/api/evaluations.rs
deleted file mode 100644
index a4439500f..000000000
--- a/crates/registry-notary-server/src/api/evaluations.rs
+++ /dev/null
@@ -1,670 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Evaluation, batch evaluation, and rendering handlers.
-
-use super::*;
-pub(super) async fn evaluate(
-    headers: HeaderMap,
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    principal: Option<Extension<EvidencePrincipal>>,
-    correlation_id: Option<Extension<BoundedCorrelationId>>,
-    request: Result<Json<EvaluateRequest>, JsonRejection>,
-) -> Response {
-    if has_idempotency_key(&headers) {
-        return evidence_error_response(EvidenceError::InvalidRequest);
-    }
-    let request = match parse_json_body(request) {
-        Ok(request) => request,
-        Err(error) => return evidence_error_response(error),
-    };
-    let Some(Extension(state)) = state else {
-        return evidence_error_response(EvidenceError::ServerDisabled);
-    };
-    let Some(Extension(principal)) = principal else {
-        return evidence_error_response(EvidenceError::MissingCredential);
-    };
-    let evidence = match state.enabled_evidence() {
-        Ok(evidence) => evidence,
-        Err(error) => return evidence_error_response(error),
-    };
-    let mut request = request;
-    match negotiate_request_format(evidence, &headers, request.format.as_deref()) {
-        Ok(format) => request.format = Some(format),
-        Err(error) => return evidence_error_response(error),
-    }
-    let request_claim_ids = claim_ids(&request.claims);
-    let mut principal = match classify_subject_access_principal(&state.subject_access, &principal) {
-        Ok(principal) => principal,
-        Err(error) => {
-            if let Err(rate_error) =
-                consume_classification_denial_if_keyable(&state, &principal).await
-            {
-                let mut response = evidence_error_response(rate_error.evidence_error());
-                attach_subject_access_rate_limit_audit(
-                    &mut response,
-                    "evaluate_rate_limited",
-                    &request_claim_ids,
-                    rate_error.bucket(),
-                );
-                return response;
-            }
-            let mut response = evidence_error_response(error);
-            let denial_code = denial_code_from_response(&response);
-            attach_subject_access_audit(
-                &mut response,
-                "evaluate_denied",
-                &request_claim_ids,
-                denial_code,
-                Some(state.subject_access.subject_binding.token_claim.as_str()),
-            );
-            return response;
-        }
-    };
-    let mut subject_access_context = None;
-    if principal.is_subject_access() {
-        // Classification only proves the caller is a citizen attester. The
-        // transaction token authorization details select self vs delegated.
-        let subject_access_mode = requested_subject_access_mode(&principal);
-        principal.access_mode = subject_access_mode;
-        let principal_hash = match state
-            .subject_access_rate_keys
-            .principal(&principal.principal_id)
-        {
-            Ok(hash) => hash,
-            Err(error) => return evidence_error_response(error.evidence_error()),
-        };
-        if let Err(error) = state
-            .subject_access_rate_limiter
-            .check_authenticated_request(&principal_hash)
-            .await
-        {
-            let mut response = evidence_error_response(error.evidence_error());
-            attach_subject_access_rate_limit_audit(
-                &mut response,
-                "evaluate_rate_limited",
-                &request_claim_ids,
-                error.bucket(),
-            );
-            override_subject_access_audit_access_mode(&mut response, principal.access_mode());
-            return response;
-        }
-        let context_result = if subject_access_mode == AccessMode::DelegatedSubjectAccess {
-            derive_delegated_subject_access_request_context(
-                &state.subject_access,
-                evidence,
-                &state.subject_access_rate_keys,
-                &principal,
-                &mut request,
-            )
-        } else {
-            derive_subject_access_request_context(&state.subject_access, &principal, &mut request)
-        };
-        if let Err(error) = context_result {
-            if denial_code_from_error(&error).is_some_and(subject_mismatch_denial_code) {
-                if let Err(rate_error) =
-                    consume_subject_mismatch_denial(&state, &principal_hash).await
-                {
-                    let mut response = evidence_error_response(rate_error.evidence_error());
-                    attach_subject_access_rate_limit_audit(
-                        &mut response,
-                        "evaluate_rate_limited",
-                        &request_claim_ids,
-                        rate_error.bucket(),
-                    );
-                    override_subject_access_audit_access_mode(
-                        &mut response,
-                        principal.access_mode(),
-                    );
-                    return response;
-                }
-            }
-            let denial_code = denial_code_from_error(&error);
-            let mut response = evidence_error_response(error);
-            attach_subject_access_audit(
-                &mut response,
-                "evaluate_denied",
-                &request_claim_ids,
-                denial_code,
-                Some(state.subject_access.subject_binding.token_claim.as_str()),
-            );
-            override_subject_access_audit_access_mode(&mut response, principal.access_mode());
-            return response;
-        }
-        match prepare_subject_access_evaluate(&state, evidence, &principal, &request) {
-            Ok(context) => {
-                request.purpose = Some(context.purpose.clone());
-                subject_access_context = Some(context);
-            }
-            Err(error) => {
-                if denial_code_from_error(&error).is_some_and(subject_mismatch_denial_code) {
-                    if let Err(rate_error) =
-                        consume_subject_mismatch_denial(&state, &principal_hash).await
-                    {
-                        let mut response = evidence_error_response(rate_error.evidence_error());
-                        attach_subject_access_rate_limit_audit(
-                            &mut response,
-                            "evaluate_rate_limited",
-                            &request_claim_ids,
-                            rate_error.bucket(),
-                        );
-                        override_subject_access_audit_access_mode(
-                            &mut response,
-                            principal.access_mode(),
-                        );
-                        return response;
-                    }
-                }
-                let denial_code = denial_code_from_error(&error);
-                let mut response = evidence_error_response(error);
-                attach_subject_access_audit(
-                    &mut response,
-                    "evaluate_denied",
-                    &request_claim_ids,
-                    denial_code,
-                    Some(state.subject_access.subject_binding.token_claim.as_str()),
-                );
-                override_subject_access_audit_access_mode(&mut response, principal.access_mode());
-                return response;
-            }
-        }
-    } else if let Err(error) = state
-        .machine_quota_limiter
-        .check_and_consume(&principal.principal_id, 1)
-        .await
-    {
-        let quota_error = EvidenceError::MachineQuotaExceeded {
-            retry_after_seconds: error.retry_after_seconds,
-        };
-        let mut response = evidence_error_response(quota_error);
-        attach_evidence_audit_with_purposes(
-            &mut response,
-            "evaluate_denied",
-            None,
-            &request_claim_ids,
-            None,
-            resolved_evaluate_audit_purposes(purpose_header(&headers), request.purpose.as_deref()),
-        );
-        attach_zero_relay_no_forward_audit(&mut response);
-        if let Err(error) = attach_evaluate_request_audit(
-            &mut response,
-            &state.subject_access_rate_keys,
-            &request,
-            None,
-        ) {
-            return evidence_error_response(error);
-        }
-        return response;
-    }
-    let runtime = state.runtime();
-    let requested_claims = request_claim_ids;
-    let subject_access_policy_hash = subject_access_context
-        .as_ref()
-        .and_then(|context| context.metadata.policy_hash.clone());
-    let request_correlation_id = correlation_id
-        .as_ref()
-        .map(|Extension(correlation_id)| correlation_id.clone());
-    let audit_request = request.clone();
-    let evaluation_future = async {
-        if let Some(context) = subject_access_context {
-            runtime
-                .evaluate_with_capability_for_api(
-                    Arc::clone(&state.evidence),
-                    &state.store,
-                    &principal,
-                    context.evaluation_capability,
-                    request,
-                    None,
-                    Some(context.metadata),
-                    request_correlation_id.clone(),
-                )
-                .await
-        } else {
-            runtime
-                .evaluate_for_api(
-                    Arc::clone(&state.evidence),
-                    &state.store,
-                    &principal,
-                    request,
-                    purpose_header(&headers),
-                )
-                .await
-        }
-    };
-    let evaluation = if let Some(Extension(correlation_id)) = correlation_id {
-        crate::standalone::with_request_correlation_id(correlation_id, evaluation_future).await
-    } else {
-        evaluation_future.await
-    };
-    match evaluation {
-        (Ok(results), runtime_audit) => {
-            let evaluation_id = runtime_audit.evaluation_id().map(str::to_string);
-            let mut response = Json(json!({ "results": results })).into_response();
-            if principal.is_subject_access() {
-                attach_subject_access_success_audit(
-                    &mut response,
-                    "evaluate",
-                    evaluation_id,
-                    &requested_claims,
-                    Some(1),
-                    None,
-                    subject_access_policy_hash,
-                );
-                override_subject_access_audit_access_mode(&mut response, principal.access_mode());
-            } else {
-                attach_evidence_audit(
-                    &mut response,
-                    "evaluate",
-                    evaluation_id,
-                    &requested_claims,
-                    Some(1),
-                );
-            }
-            attach_runtime_evaluation_audit(&mut response, runtime_audit);
-            attach_redacted_fields_audit(&mut response, &results);
-            if let Err(error) = attach_evaluate_request_audit(
-                &mut response,
-                &state.subject_access_rate_keys,
-                &audit_request,
-                results.first(),
-            ) {
-                return evidence_error_response(error);
-            }
-            response
-        }
-        (Err(error), runtime_audit) => {
-            let zero_source_no_forward = matches!(
-                &error,
-                EvidenceError::PolicyDenied { code, .. } if *code != registry_platform_pdp::EVIDENCE_STALE
-            );
-            let mut response = evidence_error_response(error);
-            attach_evidence_audit(
-                &mut response,
-                "evaluate_denied",
-                runtime_audit.evaluation_id().map(str::to_string),
-                &requested_claims,
-                None,
-            );
-            attach_runtime_evaluation_audit(&mut response, runtime_audit);
-            if principal.is_subject_access() {
-                override_subject_access_audit_access_mode(&mut response, principal.access_mode());
-            }
-            if zero_source_no_forward {
-                attach_zero_relay_no_forward_audit(&mut response);
-            }
-            if let Err(error) = attach_evaluate_request_audit(
-                &mut response,
-                &state.subject_access_rate_keys,
-                &audit_request,
-                None,
-            ) {
-                return evidence_error_response(error);
-            }
-            response
-        }
-    }
-}
-
-pub(super) async fn batch_evaluate(
-    headers: HeaderMap,
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    principal: Option<Extension<EvidencePrincipal>>,
-    correlation_id: Option<Extension<BoundedCorrelationId>>,
-    request: Result<Json<BatchEvaluateRequest>, JsonRejection>,
-) -> Response {
-    let request = match parse_json_body(request) {
-        Ok(request) => request,
-        Err(error) => return evidence_error_response(error),
-    };
-    let Some(Extension(state)) = state else {
-        return evidence_error_response(EvidenceError::ServerDisabled);
-    };
-    let Some(Extension(principal)) = principal else {
-        return evidence_error_response(EvidenceError::MissingCredential);
-    };
-    let evidence = match state.enabled_evidence() {
-        Ok(evidence) => evidence,
-        Err(error) => return evidence_error_response(error),
-    };
-    let mut request = request;
-    match negotiate_request_format(evidence, &headers, request.format.as_deref()) {
-        Ok(format) => request.format = Some(format),
-        Err(error) => return evidence_error_response(error),
-    }
-    let request_claim_ids = claim_ids(&request.claims);
-    let principal = match classify_subject_access_principal(&state.subject_access, &principal) {
-        Ok(principal) => principal,
-        Err(error) => {
-            let mut response = evidence_error_response(error);
-            let denial_code = denial_code_from_response(&response);
-            attach_subject_access_audit(
-                &mut response,
-                "batch_evaluate_denied",
-                &request_claim_ids,
-                denial_code,
-                Some(state.subject_access.subject_binding.token_claim.as_str()),
-            );
-            return response;
-        }
-    };
-    if principal.is_subject_access() {
-        let error = EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::BatchDenied,
-        };
-        let mut response = evidence_error_response(error);
-        attach_subject_access_audit(
-            &mut response,
-            "batch_evaluate_denied",
-            &request_claim_ids,
-            Some(SubjectAccessDenialCode::BatchDenied),
-            Some(state.subject_access.subject_binding.token_claim.as_str()),
-        );
-        return response;
-    }
-    let requested_claims = request_claim_ids;
-    let requested_subject_count = request.items.len();
-    let audit_purposes = resolved_batch_audit_purposes(
-        purpose_header(&headers),
-        request.purpose.as_deref(),
-        &request.items,
-    );
-    let audit_request = request.clone();
-    if let Err(error) = validate_batch_subject_limit(evidence, &request) {
-        return evidence_error_response(error);
-    }
-    if idempotency_key(&headers).is_none_or(|key| key.is_empty() || key.len() > 256) {
-        return evidence_error_response(EvidenceError::ConsultationInvalidRequest);
-    }
-    let batch_cost = u32::try_from(request.items.len()).unwrap_or(u32::MAX);
-    let runtime = state.runtime();
-    let evaluation_future = runtime.batch_evaluate(
-        Arc::clone(&state.evidence),
-        &state.store,
-        &principal,
-        request,
-        BatchEvaluateOptions {
-            header_purpose: purpose_header(&headers),
-            idempotency_key: idempotency_key(&headers),
-            owner_quota: Some((&state.machine_quota_limiter, batch_cost)),
-        },
-    );
-    let result = if let Some(Extension(correlation_id)) = correlation_id {
-        crate::standalone::with_request_correlation_id(correlation_id, evaluation_future).await
-    } else {
-        evaluation_future.await
-    };
-    match result {
-        Ok(result) => {
-            let mut response = Json(result.clone()).into_response();
-            let batch_audit_purposes = audit_purposes.clone();
-            attach_evidence_audit_with_purposes(
-                &mut response,
-                "batch_evaluate",
-                None,
-                &requested_claims,
-                Some(requested_subject_count as u64),
-                audit_purposes,
-            );
-            if let Err(error) = attach_batch_evaluate_response_audit(
-                &mut response,
-                &state.subject_access_rate_keys,
-                evidence,
-                &audit_request,
-                &result,
-                batch_audit_purposes.as_deref(),
-            ) {
-                return evidence_error_response(error);
-            }
-            response
-        }
-        Err(error) => {
-            let owner_quota_denial = matches!(error, EvidenceError::MachineQuotaExceeded { .. });
-            let mut response = evidence_error_response(error);
-            if owner_quota_denial {
-                attach_evidence_audit_with_purposes(
-                    &mut response,
-                    "batch_evaluate_denied",
-                    None,
-                    &requested_claims,
-                    None,
-                    audit_purposes,
-                );
-                attach_zero_relay_no_forward_audit(&mut response);
-            }
-            response
-        }
-    }
-}
-
-pub(super) async fn render(
-    headers: HeaderMap,
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    principal: Option<Extension<EvidencePrincipal>>,
-    Path(evaluation_id): Path<String>,
-    request: Result<Json<RenderEvaluationRequest>, JsonRejection>,
-) -> Response {
-    if has_idempotency_key(&headers) {
-        return evidence_error_response(EvidenceError::InvalidRequest);
-    }
-    let request = match parse_json_body(request) {
-        Ok(request) => request,
-        Err(error) => return evidence_error_response(error),
-    };
-    let Some(Extension(state)) = state else {
-        return evidence_error_response(EvidenceError::ServerDisabled);
-    };
-    let Some(Extension(principal)) = principal else {
-        return evidence_error_response(EvidenceError::MissingCredential);
-    };
-    let request = request.with_evaluation_id(evaluation_id);
-    let evaluation_id = request.evaluation_id.clone();
-    let requested_claims = request.claims.clone();
-    let evidence = match state.enabled_evidence() {
-        Ok(evidence) => evidence,
-        Err(error) => return evidence_error_response(error),
-    };
-    let mut principal = match classify_subject_access_principal(&state.subject_access, &principal) {
-        Ok(principal) => principal,
-        Err(error) => return evidence_error_response(error),
-    };
-    let lookup_client_id = match stored_evaluation_client_id(&state, &principal) {
-        Ok(client_id) => client_id,
-        Err(error) => return evidence_error_response(error),
-    };
-    let evaluation = match state
-        .store
-        .get(&request.evaluation_id, &lookup_client_id)
-        .await
-    {
-        Ok(Some(evaluation)) => evaluation,
-        Ok(None) => return evidence_error_response(EvidenceError::EvaluationNotFound),
-        Err(error) => return evidence_error_response(error),
-    };
-    if let Some(metadata) = evaluation.subject_access.as_ref() {
-        if principal.is_subject_access() {
-            if let Err(error) = apply_stored_subject_access_access_mode(&mut principal, metadata) {
-                return evidence_error_response(error);
-            }
-        }
-    }
-    if !evaluation_client_matches(&state, &principal, &evaluation)
-        || evaluation.access_mode() != principal.access_mode()
-    {
-        return evidence_error_response(EvidenceError::EvaluationNotFound);
-    }
-    if let Err(error) = require_subject_access_stored_access(
-        &state,
-        evidence,
-        &principal,
-        &evaluation,
-        request.claims.as_deref().unwrap_or(&evaluation.claim_ids),
-        request
-            .disclosure
-            .as_deref()
-            .unwrap_or(&evaluation.disclosure),
-        &request.format,
-        false,
-    ) {
-        return evidence_error_response(error);
-    }
-    if principal.is_subject_access() {
-        let principal_hash = match state
-            .subject_access_rate_keys
-            .principal(&principal.principal_id)
-        {
-            Ok(hash) => hash,
-            Err(error) => return evidence_error_response(error.evidence_error()),
-        };
-        if let Err(error) = state
-            .subject_access_rate_limiter
-            .check_authenticated_request(&principal_hash)
-            .await
-        {
-            let mut response = evidence_error_response(error.evidence_error());
-            attach_subject_access_rate_limit_audit(
-                &mut response,
-                "render_rate_limited",
-                &evaluation.claim_ids,
-                error.bucket(),
-            );
-            override_subject_access_audit_access_mode(&mut response, principal.access_mode());
-            return response;
-        }
-    }
-    if let Err(error) = require_evaluation_access(evidence, &principal, &evaluation) {
-        return evidence_error_response(error);
-    }
-    let runtime = state.runtime();
-    let runtime_principal = runtime_principal_for_stored_evaluation(&principal, &evaluation);
-    match runtime
-        .render(evidence, &state.store, &runtime_principal, request)
-        .await
-    {
-        Ok(value) => {
-            let mut response = Json(value).into_response();
-            if principal.is_subject_access() {
-                attach_subject_access_success_audit(
-                    &mut response,
-                    "render",
-                    Some(evaluation_id),
-                    requested_claims.as_deref().unwrap_or(&evaluation.claim_ids),
-                    None,
-                    Some(vec![evaluation.purpose.clone()]),
-                    evaluation
-                        .subject_access
-                        .as_ref()
-                        .and_then(|metadata| metadata.policy_hash.clone()),
-                );
-                override_subject_access_audit_access_mode(&mut response, principal.access_mode());
-            } else {
-                attach_evidence_audit_with_purposes(
-                    &mut response,
-                    "render",
-                    Some(evaluation_id),
-                    requested_claims.as_deref().unwrap_or(&[]),
-                    None,
-                    Some(vec![evaluation.purpose.clone()]),
-                );
-            }
-            response
-        }
-        Err(error) => {
-            let mut response = evidence_error_response(error);
-            if principal.is_subject_access() {
-                attach_subject_access_success_audit(
-                    &mut response,
-                    "render_failed",
-                    Some(evaluation_id),
-                    requested_claims.as_deref().unwrap_or(&evaluation.claim_ids),
-                    None,
-                    None,
-                    evaluation
-                        .subject_access
-                        .as_ref()
-                        .and_then(|metadata| metadata.policy_hash.clone()),
-                );
-                override_subject_access_audit_access_mode(&mut response, principal.access_mode());
-            } else {
-                attach_evidence_audit(
-                    &mut response,
-                    "render_failed",
-                    Some(evaluation_id),
-                    requested_claims.as_deref().unwrap_or(&[]),
-                    None,
-                );
-            }
-            response
-        }
-    }
-}
-pub(super) fn result_json(result: Result<Value, EvidenceError>) -> Response {
-    match result {
-        Ok(value) => Json(value).into_response(),
-        Err(error) => evidence_error_response(error),
-    }
-}
-
-pub(super) fn require_evaluation_access(
-    evidence: &EvidenceConfig,
-    principal: &EvidencePrincipal,
-    evaluation: &registry_notary_core::StoredEvaluation,
-) -> Result<(), EvidenceError> {
-    if principal.is_subject_access() {
-        return Ok(());
-    }
-    for claim_ref in evaluation.selected_claim_refs() {
-        let claim = find_requested_claim(evidence, &claim_ref)?;
-        for scope in &claim.required_scopes {
-            if !principal.has_scope(scope) {
-                return Err(EvidenceError::ScopeDenied {
-                    required: scope.clone(),
-                });
-            }
-        }
-    }
-    Ok(())
-}
-
-pub(super) fn evaluation_client_matches(
-    state: &RegistryNotaryApiState,
-    principal: &EvidencePrincipal,
-    evaluation: &registry_notary_core::StoredEvaluation,
-) -> bool {
-    if let Some(metadata) = evaluation.subject_access.as_ref() {
-        principal.is_subject_access()
-            && state
-                .subject_access_rate_keys
-                .principal(&principal.principal_id)
-                .is_ok_and(|hash| {
-                    hash == metadata.principal_hash && evaluation.client_id == hash.as_str()
-                })
-    } else {
-        evaluation.client_id == principal.principal_id
-    }
-}
-
-pub(super) fn stored_evaluation_client_id(
-    state: &RegistryNotaryApiState,
-    principal: &EvidencePrincipal,
-) -> Result<String, EvidenceError> {
-    if principal.is_subject_access() {
-        state
-            .subject_access_rate_keys
-            .principal(&principal.principal_id)
-            .map(|hash| hash.as_str().to_string())
-            .map_err(|error| error.evidence_error())
-    } else {
-        Ok(principal.principal_id.clone())
-    }
-}
-
-pub(super) fn runtime_principal_for_stored_evaluation(
-    principal: &EvidencePrincipal,
-    evaluation: &registry_notary_core::StoredEvaluation,
-) -> EvidencePrincipal {
-    if evaluation.subject_access.is_some() {
-        let mut runtime_principal = principal.clone();
-        runtime_principal.principal_id = evaluation.client_id.clone();
-        runtime_principal
-    } else {
-        principal.clone()
-    }
-}
diff --git a/crates/registry-notary-server/src/api/oid4vci.rs b/crates/registry-notary-server/src/api/oid4vci.rs
deleted file mode 100644
index 50b455c94..000000000
--- a/crates/registry-notary-server/src/api/oid4vci.rs
+++ /dev/null
@@ -1,15 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! OpenID for Verifiable Credential Issuance HTTP implementation.
-
-mod credential;
-mod metadata;
-mod preauth;
-mod problem;
-mod proof;
-
-pub(in crate::api) use credential::*;
-pub(in crate::api) use metadata::*;
-pub(in crate::api) use preauth::*;
-pub(in crate::api) use problem::*;
-pub use proof::oid4vci_proof_precheck_middleware;
-pub(in crate::api) use proof::*;
diff --git a/crates/registry-notary-server/src/api/oid4vci/credential.rs b/crates/registry-notary-server/src/api/oid4vci/credential.rs
deleted file mode 100644
index f7411928b..000000000
--- a/crates/registry-notary-server/src/api/oid4vci/credential.rs
+++ /dev/null
@@ -1,1199 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! OID4VCI credential issuance and authorization binding.
-
-use super::super::*;
-
-const CREDENTIAL_SIGNING_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(25);
-const CREDENTIAL_COMPLETION_MARGIN: time::Duration = time::Duration::seconds(5);
-
-pub(in crate::api) async fn oid4vci_credential(
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    principal: Option<Extension<EvidencePrincipal>>,
-    validated_proof: Option<Extension<ValidatedProof>>,
-    Json(request): Json<Oid4vciCredentialRequest>,
-) -> Response {
-    let Some(Extension(state)) = state else {
-        return oid4vci_error_response(Oid4vciWireError::ServerError);
-    };
-    if !state.oid4vci.enabled {
-        return StatusCode::NOT_FOUND.into_response();
-    }
-    let Some(Extension(principal)) = principal else {
-        return oid4vci_error_response(Oid4vciWireError::InvalidToken);
-    };
-    let evidence = match state.enabled_evidence() {
-        Ok(evidence) => evidence,
-        Err(_) => return oid4vci_error_response(Oid4vciWireError::ServerError),
-    };
-    let Some(preauth) = preauth_runtime(&state) else {
-        return StatusCode::NOT_FOUND.into_response();
-    };
-    let mut principal = match classify_subject_access_principal(&state.subject_access, &principal) {
-        Ok(principal)
-            if principal.is_subject_access()
-                || (principal.access_mode() == AccessMode::MachineClient
-                    && principal.auth_profile_id
-                        == registry_notary_core::EvidenceAuthProfileId::NotaryAccessToken) =>
-        {
-            principal
-        }
-        _ => return oid4vci_error_response(Oid4vciWireError::InvalidToken),
-    };
-    if let Err(error) = require_oid4vci_token_audience(&state.oid4vci, &principal) {
-        return oid4vci_error_response(error);
-    }
-    if request.format != SD_JWT_VC_FORMAT {
-        return oid4vci_error_response(Oid4vciWireError::UnsupportedCredentialType);
-    }
-    if let Err(error) = oid4vci_single_proof_jwt(&request) {
-        return oid4vci_error_response(error);
-    }
-    let Some(Extension(validated_proof)) = validated_proof else {
-        return oid4vci_error_response(Oid4vciWireError::InvalidProof);
-    };
-    let (configuration_id, configuration) =
-        match oid4vci_configuration_for_request(&state.oid4vci, &request) {
-            Ok(configuration) => configuration,
-            Err(error) => return oid4vci_error_response(error),
-        };
-    let configuration_claim_ids = configuration.credential_claim_ids();
-    let requested_access_mode = requested_subject_access_mode(&principal);
-    let representative_configuration = configuration.representative_issuance.is_some();
-    if (principal.is_subject_access()
-        && (requested_access_mode == AccessMode::DelegatedSubjectAccess)
-            != representative_configuration)
-        || (!principal.is_subject_access() && representative_configuration)
-    {
-        let mut response = oid4vci_error_response(Oid4vciWireError::AccessDenied);
-        attach_oid4vci_subject_access_denial_audit(
-            &mut response,
-            "oid4vci_credential_denied",
-            &configuration_claim_ids,
-            configuration_id,
-            Some(SubjectAccessDenialCode::DelegatedRelationshipNotAllowed),
-            Some(state.subject_access.subject_binding.token_claim.as_str()),
-        );
-        return response;
-    }
-    if principal.is_subject_access() {
-        principal.access_mode = requested_access_mode;
-    }
-    if let Err(error) = require_oid4vci_configuration_scope(configuration, &principal) {
-        let mut response = oid4vci_error_response(error);
-        attach_oid4vci_subject_access_denial_audit(
-            &mut response,
-            "oid4vci_credential_denied",
-            &configuration_claim_ids,
-            configuration_id,
-            Some(SubjectAccessDenialCode::OperationDenied),
-            Some(state.subject_access.subject_binding.token_claim.as_str()),
-        );
-        return response;
-    }
-    if principal.is_subject_access() {
-        if let Err(error) = require_oid4vci_issuance_authorization_details(
-            evidence,
-            &state.subject_access,
-            configuration,
-            &principal,
-            oid4vci_requires_authorization_details(
-                &principal,
-                state.runtime_config().as_deref(),
-                Some(preauth.as_ref()),
-            ),
-        ) {
-            let denial_code = denial_code_from_error(&error);
-            let mut response = oid4vci_error_response(oid4vci_error_from_evidence(&error));
-            attach_oid4vci_subject_access_denial_audit(
-                &mut response,
-                "oid4vci_credential_denied",
-                &configuration_claim_ids,
-                configuration_id,
-                denial_code,
-                Some(state.subject_access.subject_binding.token_claim.as_str()),
-            );
-            return response;
-        }
-    }
-    let Some(claims) = principal.verified_claims.as_ref() else {
-        return oid4vci_error_response(Oid4vciWireError::InvalidToken);
-    };
-    let (Some(transaction_id), Some(transaction_commitment), Some(token_configuration_id)) = (
-        claims
-            .issuance_transaction_id
-            .as_ref()
-            .map(VerifiedClaimValue::as_str),
-        claims
-            .issuance_transaction_commitment
-            .as_ref()
-            .map(VerifiedClaimValue::as_str),
-        claims
-            .credential_configuration_id
-            .as_ref()
-            .map(VerifiedClaimValue::as_str),
-    ) else {
-        return oid4vci_error_response(Oid4vciWireError::InvalidToken);
-    };
-    if token_configuration_id != configuration_id {
-        return oid4vci_error_response(Oid4vciWireError::InvalidToken);
-    }
-    let Some(nonce) = validated_proof.nonce.as_deref() else {
-        return oid4vci_error_response(Oid4vciWireError::InvalidProof);
-    };
-    let holder_thumbprint = match validated_proof.holder_jwk.jkt() {
-        Ok(thumbprint) => thumbprint,
-        Err(_) => return oid4vci_error_response(Oid4vciWireError::InvalidProof),
-    };
-    let request_hash = match serde_json::to_value(&request)
-        .map_err(|_| EvidenceError::InvalidRequest)
-        .and_then(|value| sha256_canonical_json(&value))
-    {
-        Ok(hash) => hash,
-        Err(_) => return oid4vci_error_response(Oid4vciWireError::InvalidRequest),
-    };
-    let transaction = match preauth
-        .preauthorization_state()
-        .begin_credential_materialization(
-            transaction_id,
-            transaction_commitment,
-            configuration_id,
-            nonce,
-            &holder_thumbprint,
-            &request_hash,
-        )
-        .await
-    {
-        Ok(CredentialMaterialization::Cached(response)) => {
-            let transaction = match preauth
-                .preauthorization_state()
-                .transaction(transaction_id)
-                .await
-            {
-                Ok(Some(live)) => live.transaction,
-                _ => return oid4vci_error_response(Oid4vciWireError::ServerError),
-            };
-            let evaluation = match state
-                .store
-                .get(
-                    &transaction.evaluation_id,
-                    &transaction.evaluation_client_id,
-                )
-                .await
-            {
-                Ok(Some(evaluation)) => evaluation,
-                _ => return oid4vci_error_response(Oid4vciWireError::ServerError),
-            };
-            let response = match oid4vci_credential_response_with_audit(
-                &state,
-                evidence,
-                configuration_id,
-                configuration,
-                &transaction,
-                &evaluation,
-                response,
-            ) {
-                Ok(response) => response,
-                Err(error) => return oid4vci_error_response(error),
-            };
-            state
-                .metrics
-                .record_credential("openid4vci", "retry_cached");
-            return response;
-        }
-        Ok(CredentialMaterialization::Acquired(transaction)) => transaction,
-        Ok(CredentialMaterialization::Busy) => {
-            return oid4vci_error_response(Oid4vciWireError::ServerError);
-        }
-        Ok(CredentialMaterialization::Denied) | Err(_) => {
-            return oid4vci_error_response(Oid4vciWireError::InvalidToken);
-        }
-    };
-    let materialized = materialize_oid4vci_transaction(
-        &state,
-        evidence,
-        &principal,
-        Oid4vciTransactionMaterialization {
-            validated_proof: &validated_proof,
-            configuration_id,
-            configuration,
-            transaction: &transaction,
-            nonce,
-        },
-    )
-    .await;
-    let (response_body, evaluation) = match materialized {
-        Ok(materialized) => materialized,
-        Err(error) => {
-            // Materialization failures are terminal in both state backends.
-            // Resetting after an ambiguous signer or persistence failure could
-            // produce a second credential for the same transaction.
-            let _ = preauth
-                .preauthorization_state()
-                .fail_credential_materialization(transaction_id, &holder_thumbprint)
-                .await;
-            return oid4vci_error_response(error);
-        }
-    };
-    if !matches!(
-        preauth
-            .preauthorization_state()
-            .complete_credential_materialization(
-                transaction_id,
-                &holder_thumbprint,
-                &request_hash,
-                response_body.clone(),
-            )
-            .await,
-        Ok(true)
-    ) {
-        let _ = preauth
-            .preauthorization_state()
-            .fail_credential_materialization(transaction_id, &holder_thumbprint)
-            .await;
-        return oid4vci_error_response(Oid4vciWireError::ServerError);
-    }
-    let response = match oid4vci_credential_response_with_audit(
-        &state,
-        evidence,
-        configuration_id,
-        configuration,
-        &transaction,
-        &evaluation,
-        response_body,
-    ) {
-        Ok(response) => response,
-        Err(error) => return oid4vci_error_response(error),
-    };
-    state.metrics.record_credential("openid4vci", "issued");
-    response
-}
-
-pub(in crate::api) fn oid4vci_credential_response_with_audit(
-    state: &RegistryNotaryApiState,
-    evidence: &EvidenceConfig,
-    configuration_id: &str,
-    configuration: &Oid4vciCredentialConfigurationConfig,
-    transaction: &IssuanceTransaction,
-    evaluation: &registry_notary_core::StoredEvaluation,
-    response_body: Value,
-) -> Result<Response, Oid4vciWireError> {
-    let profile = evidence
-        .credential_profiles
-        .get(&configuration.credential_profile)
-        .ok_or(Oid4vciWireError::ServerError)?;
-    let mut response = Json(response_body).into_response();
-    if attach_subject_access_credential_audit(
-        &mut response,
-        &state.subject_access_rate_keys,
-        &transaction.evaluation_id,
-        &evaluation.claim_ids,
-        &evaluation.results,
-        evaluation.results.len() as u64,
-        SubjectAccessCredentialAuditDetails {
-            profile_id: &configuration.credential_profile,
-            holder_binding_mode: &profile.holder_binding.mode,
-            access_mode: evaluation.access_mode(),
-            policy_hash: evaluation
-                .subject_access
-                .as_ref()
-                .and_then(|metadata| metadata.policy_hash.clone()),
-            purposes: Some(vec![evaluation.purpose.clone()]),
-            protocol: Some("openid4vci"),
-            credential_configuration_id: Some(configuration_id),
-        },
-    )
-    .is_err()
-    {
-        return Err(Oid4vciWireError::ServerError);
-    }
-    override_subject_access_audit_access_mode(&mut response, evaluation.access_mode());
-    Ok(response)
-}
-
-struct Oid4vciTransactionMaterialization<'a> {
-    validated_proof: &'a ValidatedProof,
-    configuration_id: &'a str,
-    configuration: &'a Oid4vciCredentialConfigurationConfig,
-    transaction: &'a IssuanceTransaction,
-    nonce: &'a str,
-}
-
-async fn materialize_oid4vci_transaction(
-    state: &RegistryNotaryApiState,
-    evidence: &EvidenceConfig,
-    principal: &EvidencePrincipal,
-    materialization: Oid4vciTransactionMaterialization<'_>,
-) -> Result<(Value, registry_notary_core::StoredEvaluation), Oid4vciWireError> {
-    let Oid4vciTransactionMaterialization {
-        validated_proof,
-        configuration_id,
-        configuration,
-        transaction,
-        nonce,
-    } = materialization;
-    let evaluation = state
-        .store
-        .get(
-            &transaction.evaluation_id,
-            &transaction.evaluation_client_id,
-        )
-        .await
-        .map_err(|_| Oid4vciWireError::ServerError)?
-        .ok_or(Oid4vciWireError::AccessDenied)?;
-    let configuration_claim_ids = configuration.credential_claim_ids();
-    let configuration_claim_refs = oid4vci_credential_claim_refs(configuration);
-    let result_claim_ids = evaluation
-        .results
-        .iter()
-        .map(|result| result.claim_id.clone())
-        .collect::<Vec<_>>();
-    if !crate::authz_details::exact_unique_string_set(
-        &evaluation.claim_ids,
-        &configuration_claim_ids,
-    ) || !crate::authz_details::exact_unique_string_set(
-        &result_claim_ids,
-        &configuration_claim_ids,
-    ) || !crate::authz_details::exact_unique_claim_ref_set(
-        &evaluation.selected_claim_refs(),
-        &configuration_claim_refs,
-    ) {
-        return Err(Oid4vciWireError::AccessDenied);
-    }
-    let profile = evidence
-        .credential_profiles
-        .get(&configuration.credential_profile)
-        .ok_or(Oid4vciWireError::UnsupportedCredentialType)?;
-    match &transaction.authority {
-        IssuanceAuthority::SubjectAccess if principal.is_subject_access() => {
-            require_oid4vci_transaction_stored_access(
-                state,
-                evidence,
-                principal,
-                &evaluation,
-                &evaluation.claim_ids,
-                &evaluation.disclosure,
-                &evaluation.format,
-            )
-            .map_err(|error| oid4vci_error_from_evidence(&error))?;
-            require_subject_access_credential_profile_policy(
-                &state.subject_access,
-                &configuration.credential_profile,
-                profile,
-            )
-            .map_err(|error| oid4vci_error_from_evidence(&error))?;
-        }
-        IssuanceAuthority::RegistryClient {
-            initiating_client_id,
-            initiating_client_id_hash,
-            auth_profile_id,
-            authorized_scopes,
-            target_ref,
-            service_id,
-            purpose,
-        } if principal.access_mode() == AccessMode::MachineClient
-            && principal.auth_profile_id
-                == registry_notary_core::EvidenceAuthProfileId::NotaryAccessToken =>
-        {
-            let recomputed_client_hash = state
-                .subject_access_rate_keys
-                .principal(initiating_client_id)
-                .map_err(|_| Oid4vciWireError::ServerError)?;
-            if recomputed_client_hash.as_str() != initiating_client_id_hash
-                || transaction.evaluation_client_id != *initiating_client_id
-                || *auth_profile_id
-                    == registry_notary_core::EvidenceAuthProfileId::NotaryAccessToken
-                || service_id != &evidence.service_id
-                || purpose != &evaluation.purpose
-                || evaluation.subject_access.is_some()
-                || evaluation.access_mode() != AccessMode::MachineClient
-                || evaluation.client_id != *initiating_client_id
-                || evaluation.disclosure != DisclosureProfile::Value.as_str()
-                || evaluation.format != FORMAT_CLAIM_RESULT_JSON
-                || !authorized_scopes
-                    .iter()
-                    .any(|scope| scope == REGISTRY_OFFER_CREATE_SCOPE)
-                || !authorized_scopes
-                    .iter()
-                    .any(|scope| scope == &configuration.scope)
-                || evaluation.results.is_empty()
-                || evaluation.results.iter().any(|result| {
-                    !same_target_ref(&result.target_ref, target_ref)
-                        || result.value.as_ref().is_none_or(Value::is_null)
-                        || result.satisfied == Some(false)
-                        || !result.redacted_fields.is_empty()
-                })
-                || !OffsetDateTime::parse(&evaluation.expires_at, &Rfc3339)
-                    .is_ok_and(|expires_at| expires_at > OffsetDateTime::now_utc())
-            {
-                return Err(Oid4vciWireError::AccessDenied);
-            }
-            let registry_principal = EvidencePrincipal {
-                auth_profile_id: *auth_profile_id,
-                principal_id: initiating_client_id.clone(),
-                scopes: authorized_scopes.clone(),
-                access_mode: AccessMode::MachineClient,
-                verified_claims: None,
-                authorization_details: None,
-            };
-            require_evaluation_access(evidence, &registry_principal, &evaluation)
-                .map_err(|error| oid4vci_error_from_evidence(&error))?;
-            require_oid4vci_registry_client_authorization_details(
-                evidence,
-                configuration,
-                purpose,
-                principal,
-            )
-            .map_err(|error| oid4vci_error_from_evidence(&error))?;
-        }
-        IssuanceAuthority::SubjectAccess | IssuanceAuthority::RegistryClient { .. } => {
-            return Err(Oid4vciWireError::AccessDenied);
-        }
-    }
-    require_issuable_evaluation_provenance(evidence, &transaction.evaluation_id, &evaluation)
-        .map_err(|error| oid4vci_error_from_evidence(&error))?;
-    let configuration_fingerprint =
-        oid4vci_configuration_fingerprint(evidence, configuration_id, configuration)
-            .map_err(|_| Oid4vciWireError::ServerError)?;
-    let commitment = match &transaction.authority {
-        IssuanceAuthority::SubjectAccess => oid4vci_issuance_transaction_commitment(
-            &transaction.transaction_id,
-            Oid4vciIssuanceCommitmentContext {
-                evidence,
-                subject_access_config: &state.subject_access,
-                configuration_id,
-                configuration,
-                configuration_fingerprint: &configuration_fingerprint,
-            },
-            &transaction.evaluation_id,
-            &evaluation,
-        ),
-        IssuanceAuthority::RegistryClient {
-            initiating_client_id_hash,
-            auth_profile_id,
-            authorized_scopes,
-            target_ref,
-            ..
-        } => oid4vci_registry_client_transaction_commitment(
-            &transaction.transaction_id,
-            evidence,
-            configuration_id,
-            configuration,
-            &configuration_fingerprint,
-            &transaction.evaluation_id,
-            &evaluation,
-            initiating_client_id_hash,
-            *auth_profile_id,
-            authorized_scopes,
-            target_ref,
-        ),
-    }
-    .map_err(|_| Oid4vciWireError::ServerError)?;
-    if commitment != transaction.commitment {
-        return Err(Oid4vciWireError::AccessDenied);
-    }
-    let iat = earliest_issued_at(&evaluation.results).unwrap_or_else(OffsetDateTime::now_utc);
-    let expires_at = iat
-        .checked_add(time::Duration::seconds(profile.validity_seconds))
-        .ok_or(Oid4vciWireError::ServerError)?;
-    if expires_at <= OffsetDateTime::now_utc() {
-        return Err(Oid4vciWireError::AccessDenied);
-    }
-    let key = state
-        .subject_access_rate_keys
-        .oid4vci_nonce(&state.oid4vci.credential_issuer, configuration_id, nonce)
-        .map_err(|_| Oid4vciWireError::ServerError)?;
-    let replay_scope = oid4vci_nonce_replay_scope(state, configuration_id)?;
-    let replay_key = ReplayKey::new(key).map_err(|_| Oid4vciWireError::ServerError)?;
-    consume_validated_proof_nonce_once(
-        validated_proof,
-        nonce,
-        state.replay.nonce_store().as_ref(),
-        &replay_scope,
-        &replay_key,
-    )
-    .await
-    .map_err(|_| Oid4vciWireError::InvalidProof)?;
-    state.metrics.record_replay("oid4vci_nonce", "consumed");
-    if principal.is_subject_access() {
-        let stored_principal_hash = evaluation
-            .subject_access
-            .as_ref()
-            .filter(|metadata| metadata.access_mode == AccessMode::DelegatedSubjectAccess)
-            .map(|metadata| &metadata.principal_hash);
-        check_oid4vci_subject_access_rate_limit(
-            state,
-            principal,
-            stored_principal_hash,
-            Some(validated_proof.holder_id.as_str()),
-        )
-        .await
-        .map_err(|_| Oid4vciWireError::RateLimited)?;
-    }
-    let issuer = state
-        .issuer_resolver()
-        .issuer(&configuration.credential_profile)
-        .map_err(|_| Oid4vciWireError::ServerError)?;
-    if holder_key_matches_issuer_key(&validated_proof.holder_jwk, &issuer.public_jwk()) {
-        return Err(Oid4vciWireError::InvalidProof);
-    }
-    let holder_id = validated_proof.holder_id.as_str();
-    let subject_ref = if principal.access_mode() == AccessMode::DelegatedSubjectAccess {
-        let Some(first) = evaluation.results.first() else {
-            return Err(Oid4vciWireError::AccessDenied);
-        };
-        if first.target_ref.handle.is_empty()
-            || evaluation
-                .results
-                .iter()
-                .any(|result| result.target_ref.handle != first.target_ref.handle)
-        {
-            return Err(Oid4vciWireError::AccessDenied);
-        }
-        first.target_ref.handle.as_str()
-    } else {
-        holder_id
-    };
-    let credential_id = state
-        .credential_status
-        .is_enabled()
-        .then(sd_jwt::new_credential_id);
-    let status_claim = credential_id
-        .as_deref()
-        .and_then(|credential_id| state.credential_status.status_claim(credential_id));
-    let signing_budget = std::time::Duration::try_from(
-        expires_at - OffsetDateTime::now_utc() - CREDENTIAL_COMPLETION_MARGIN,
-    )
-    .map_err(|_| Oid4vciWireError::AccessDenied)?
-    .min(CREDENTIAL_SIGNING_TIMEOUT);
-    if signing_budget.is_zero() {
-        return Err(Oid4vciWireError::AccessDenied);
-    }
-    let signed = tokio::time::timeout(
-        signing_budget,
-        sd_jwt::issue(
-            profile,
-            &issuer,
-            &evaluation.results,
-            subject_ref,
-            Some(holder_id),
-            iat,
-            sd_jwt::IssueOptions {
-                credential_id,
-                status: status_claim,
-                projection: oid4vci_sd_jwt_projection(configuration),
-            },
-        ),
-    )
-    .await
-    .map_err(|_| Oid4vciWireError::AccessDenied)?
-    .map_err(|_| Oid4vciWireError::ServerError)?;
-    if expires_at <= OffsetDateTime::now_utc() + CREDENTIAL_COMPLETION_MARGIN {
-        return Err(Oid4vciWireError::AccessDenied);
-    }
-    if state.credential_status.is_enabled() {
-        state
-            .credential_status
-            .record_issued(
-                signed.credential_id.clone(),
-                signed.issuer.clone(),
-                configuration.credential_profile.clone(),
-                iat,
-                expires_at,
-            )
-            .await
-            .map_err(|_| Oid4vciWireError::ServerError)?;
-    }
-    let credential = signed.compact;
-    let response = Oid4vciCredentialResponse {
-        credential: credential.clone().into(),
-        credentials: vec![CredentialResponseCredential {
-            credential: credential.into(),
-        }],
-        format: Some(SD_JWT_VC_FORMAT.to_string()),
-        // The 1.0 profile has no response next-nonce.
-        c_nonce: None,
-        c_nonce_expires_in: None,
-    };
-    let response = serde_json::to_value(response).map_err(|_| Oid4vciWireError::ServerError)?;
-    Ok((response, evaluation))
-}
-
-pub(in crate::api) fn earliest_issued_at(
-    results: &[registry_notary_core::ClaimResultView],
-) -> Option<OffsetDateTime> {
-    results
-        .iter()
-        .filter_map(|r| OffsetDateTime::parse(&r.issued_at, &Rfc3339).ok())
-        .min()
-}
-pub(in crate::api) fn oid4vci_configuration_for_request<'a>(
-    config: &'a Oid4vciConfig,
-    request: &Oid4vciCredentialRequest,
-) -> Result<(&'a str, &'a Oid4vciCredentialConfigurationConfig), Oid4vciWireError> {
-    if let (Some(identifier), Some(configuration_id)) = (
-        request.credential_identifier.as_deref(),
-        request.credential_configuration_id.as_deref(),
-    ) {
-        if identifier != configuration_id {
-            return Err(Oid4vciWireError::InvalidRequest);
-        }
-    }
-    if let Some(id) = request
-        .credential_configuration_id
-        .as_deref()
-        .or(request.credential_identifier.as_deref())
-    {
-        let (id, configuration) = config
-            .credential_configurations
-            .get_key_value(id)
-            .ok_or(Oid4vciWireError::UnsupportedCredentialType)?;
-        if let Some(vct) = request.vct.as_deref() {
-            if configuration.vct != vct {
-                return Err(Oid4vciWireError::InvalidRequest);
-            }
-        }
-        return Ok((id.as_str(), configuration));
-    }
-    if let Some(vct) = request.vct.as_deref() {
-        return config
-            .credential_configurations
-            .iter()
-            .find(|(_, configuration)| configuration.vct == vct)
-            .map(|(id, configuration)| (id.as_str(), configuration))
-            .ok_or(Oid4vciWireError::UnsupportedCredentialType);
-    }
-    config
-        .credential_configurations
-        .iter()
-        .next()
-        .map(|(id, configuration)| (id.as_str(), configuration))
-        .ok_or(Oid4vciWireError::UnsupportedCredentialType)
-}
-
-pub(in crate::api) fn oid4vci_nonce_replay_scope(
-    state: &RegistryNotaryApiState,
-    configuration_id: &str,
-) -> Result<ReplayScope, Oid4vciWireError> {
-    ReplayScope::oid4vci_nonce(
-        &state.evidence.service_id,
-        &state.oid4vci.credential_issuer,
-        configuration_id,
-    )
-    .map_err(|_| Oid4vciWireError::ServerError)
-}
-
-pub(in crate::api) fn require_oid4vci_token_audience(
-    config: &Oid4vciConfig,
-    principal: &EvidencePrincipal,
-) -> Result<(), Oid4vciWireError> {
-    let claims = principal
-        .verified_claims
-        .as_ref()
-        .ok_or(Oid4vciWireError::InvalidToken)?;
-    let accepted = config.accepted_token_audiences.iter().any(|accepted| {
-        claims
-            .audiences
-            .iter()
-            .any(|audience| audience.as_str() == accepted)
-    });
-    if accepted {
-        Ok(())
-    } else {
-        Err(Oid4vciWireError::InvalidToken)
-    }
-}
-
-pub(in crate::api) fn require_oid4vci_configuration_scope(
-    configuration: &Oid4vciCredentialConfigurationConfig,
-    principal: &EvidencePrincipal,
-) -> Result<(), Oid4vciWireError> {
-    if principal.has_scope(&configuration.scope) {
-        Ok(())
-    } else {
-        Err(Oid4vciWireError::AccessDenied)
-    }
-}
-
-pub(in crate::api) fn oid4vci_issuance_authorization_details(
-    evidence: &EvidenceConfig,
-    config: &SubjectAccessConfig,
-    configuration: &Oid4vciCredentialConfigurationConfig,
-) -> Result<registry_notary_core::EvidenceAuthorizationDetails, EvidenceError> {
-    let claims = oid4vci_credential_claim_refs(configuration);
-    let claim_ids = claim_ids(&claims);
-    let disclosure = selected_disclosure(evidence, &claim_ids, None)
-        .map_err(|_| EvidenceError::InvalidRequest)?;
-    let purpose = common_subject_access_purpose(evidence, &claims)?;
-    Ok(registry_notary_core::EvidenceAuthorizationDetails {
-        detail_type: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE.to_string(),
-        schema_version: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION
-            .to_string(),
-        actions: vec!["evaluate".to_string()],
-        locations: vec![evidence.service_id.clone()],
-        claims,
-        disclosure: Some(disclosure),
-        format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-        purpose: Some(purpose),
-        subject: Some(registry_notary_core::EvidenceAuthorizationSubject {
-            binding_claim: config.subject_binding.token_claim.clone(),
-            id_type: config.subject_binding.id_type.clone(),
-        }),
-        access_mode: Some(AccessMode::SubjectBound),
-        ..Default::default()
-    })
-}
-
-pub(in crate::api) fn oid4vci_registry_client_authorization_details(
-    evidence: &EvidenceConfig,
-    configuration: &Oid4vciCredentialConfigurationConfig,
-    purpose: &str,
-) -> registry_notary_core::EvidenceAuthorizationDetails {
-    registry_notary_core::EvidenceAuthorizationDetails {
-        detail_type: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE.to_string(),
-        schema_version: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION
-            .to_string(),
-        actions: vec!["issue_credential".to_string()],
-        locations: vec![evidence.service_id.clone()],
-        claims: oid4vci_credential_claim_refs(configuration),
-        disclosure: Some(DisclosureProfile::Value.as_str().to_string()),
-        format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-        purpose: Some(purpose.to_string()),
-        access_mode: Some(AccessMode::MachineClient),
-        ..Default::default()
-    }
-}
-
-pub(in crate::api) fn require_oid4vci_registry_client_authorization_details(
-    evidence: &EvidenceConfig,
-    configuration: &Oid4vciCredentialConfigurationConfig,
-    purpose: &str,
-    principal: &EvidencePrincipal,
-) -> Result<(), EvidenceError> {
-    let details = principal
-        .authorization_details
-        .as_ref()
-        .filter(|details| crate::authz_details::has_transaction_scope(details))
-        .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-    let claims = oid4vci_credential_claim_refs(configuration);
-    crate::authz_details::validate_scoped_authorization_details(
-        details,
-        &crate::authz_details::ScopedAuthorizationRequest {
-            service_id: evidence.service_id.as_str(),
-            action: "issue_credential",
-            claims: &claims,
-            disclosure: DisclosureProfile::Value.as_str(),
-            format: FORMAT_CLAIM_RESULT_JSON,
-            purpose,
-            access_mode: AccessMode::MachineClient,
-            subject: None,
-            target: None,
-            allow_subset_claims: false,
-            allowed_claims: None,
-        },
-    )
-    .map_err(|_| EvidenceError::EvaluationBindingMismatch)
-}
-
-pub(in crate::api) fn oid4vci_representative_issuance_authorization_details(
-    evidence: &EvidenceConfig,
-    config: &SubjectAccessConfig,
-    configuration: &Oid4vciCredentialConfigurationConfig,
-    relationship: &SubjectAccessDelegatedRelationshipConfig,
-    target_id: &str,
-) -> Result<registry_notary_core::EvidenceAuthorizationDetails, EvidenceError> {
-    let mut details = oid4vci_issuance_authorization_details(evidence, config, configuration)?;
-    details.claims = details
-        .claims
-        .iter()
-        .map(|claim_ref| {
-            let claim = crate::find_claim(evidence, &claim_ref.id)
-                .map_err(|_| EvidenceError::InvalidRequest)?;
-            Ok(ClaimRef::with_version(&claim.id, &claim.version))
-        })
-        .collect::<Result<Vec<_>, EvidenceError>>()?;
-    let proof_claim = crate::find_claim(evidence, &relationship.proof_claim)
-        .map_err(|_| EvidenceError::InvalidRequest)?;
-    details.claims.push(ClaimRef::with_version(
-        &proof_claim.id,
-        &proof_claim.version,
-    ));
-    details.access_mode = Some(AccessMode::DelegatedSubjectAccess);
-    details.target = Some(registry_notary_core::EvidenceAuthorizationTarget {
-        id_type: delegated_target_id_type(config, relationship).to_string(),
-        id: target_id.to_string(),
-    });
-    details.relationship = Some(registry_notary_core::EvidenceAuthorizationRelationship {
-        relationship_type: relationship.relationship_type.clone(),
-        proof_claim: relationship.proof_claim.clone(),
-    });
-    Ok(details)
-}
-
-pub(in crate::api) fn require_oid4vci_issuance_authorization_details(
-    evidence: &EvidenceConfig,
-    config: &SubjectAccessConfig,
-    configuration: &Oid4vciCredentialConfigurationConfig,
-    principal: &EvidencePrincipal,
-    require_details: bool,
-) -> Result<(), EvidenceError> {
-    let details = match principal.authorization_details.as_ref() {
-        Some(details) if crate::authz_details::has_transaction_scope(details) => details,
-        Some(_) | None if require_details => {
-            return Err(subject_access_denied(
-                SubjectAccessDenialCode::OperationDenied,
-            ));
-        }
-        Some(_) | None => {
-            // Direct Walt/Inji/eSignet OIDC issuance can arrive without
-            // RAR-style transaction details, so those tokens keep using the
-            // configured credential scope. Notary-minted pre-auth tokens are
-            // local to this issuer and must carry the scoped detail minted by
-            // `oid4vci_token`; empty or context-only details are not enough.
-            return Ok(());
-        }
-    };
-    let expected = if let Some(representative) = configuration.representative_issuance.as_ref() {
-        let relationship = config
-            .delegation
-            .relationship(&representative.relationship)
-            .ok_or(EvidenceError::InvalidRequest)?;
-        oid4vci_representative_issuance_authorization_details(
-            evidence,
-            config,
-            configuration,
-            relationship,
-            "",
-        )?
-    } else {
-        oid4vci_issuance_authorization_details(evidence, config, configuration)?
-    };
-    let expected_mode = expected.access_mode.unwrap_or(AccessMode::SubjectBound);
-    crate::authz_details::validate_scoped_authorization_details(
-        details,
-        &crate::authz_details::ScopedAuthorizationRequest {
-            service_id: evidence.service_id.as_str(),
-            action: "evaluate",
-            claims: &expected.claims,
-            disclosure: expected.disclosure.as_deref().unwrap_or(""),
-            format: expected.format.as_deref().unwrap_or(""),
-            purpose: expected.purpose.as_deref().unwrap_or(""),
-            access_mode: expected_mode,
-            subject: Some(crate::authz_details::ScopedAuthorizationSubject {
-                binding_claim: config.subject_binding.token_claim.clone(),
-                id_type: config.subject_binding.id_type.clone(),
-            }),
-            target: None,
-            allow_subset_claims: false,
-            allowed_claims: None,
-        },
-    )
-    .map_err(subject_access_authorization_details_denial)
-}
-
-pub(in crate::api) fn oid4vci_requires_authorization_details(
-    principal: &EvidencePrincipal,
-    runtime_config: Option<&StandaloneRegistryNotaryConfig>,
-    preauth: Option<&PreAuthRuntime>,
-) -> bool {
-    let Some(claims) = principal.verified_claims.as_ref() else {
-        return false;
-    };
-    let Some(token_type) = claims.token_type.as_ref() else {
-        return false;
-    };
-    let Some(config) = runtime_config else {
-        return token_type.as_str()
-            == registry_notary_core::tokens::NOTARY_TRANSACTION_TOKEN_JWT_TYP
-            || token_type.as_str() == registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP
-            || preauth.is_some_and(|preauth| token_type.as_str() == preauth.access_token_typ());
-    };
-    let signing = &config.auth.access_token_signing;
-    let notary_issuer_matches = signing.enabled && claims.issuer.as_str() == signing.issuer;
-    notary_issuer_matches
-        && (token_type.as_str() == registry_notary_core::tokens::NOTARY_TRANSACTION_TOKEN_JWT_TYP
-            || token_type.as_str() == registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP
-            || preauth.is_some_and(|preauth| token_type.as_str() == preauth.access_token_typ())
-            || token_type.as_str() == signing.token_typ)
-}
-
-pub(in crate::api) fn oid4vci_credential_claim_refs(
-    configuration: &Oid4vciCredentialConfigurationConfig,
-) -> Vec<ClaimRef> {
-    configuration
-        .credential_claim_ids()
-        .into_iter()
-        .map(ClaimRef::from)
-        .collect()
-}
-
-pub(in crate::api) fn add_scope_if_missing(scopes: &mut Vec<String>, scope: &str) {
-    if !scopes.iter().any(|candidate| candidate == scope) {
-        scopes.push(scope.to_string());
-    }
-}
-
-pub(in crate::api) fn oid4vci_bound_subject(
-    config: &SubjectAccessConfig,
-    principal: &EvidencePrincipal,
-) -> Result<SubjectRequest, EvidenceError> {
-    let subject_id = principal
-        .verified_subject_binding_value(&config.subject_binding.token_claim)
-        .ok_or(EvidenceError::SubjectAccessInvalidToken)?;
-    Ok(SubjectRequest {
-        id: subject_id.to_string(),
-        id_type: Some(config.subject_binding.id_type.clone()),
-    })
-}
-
-pub(in crate::api) fn subject_access_bound_subject(
-    config: &SubjectAccessConfig,
-    principal: &EvidencePrincipal,
-) -> Result<SubjectRequest, EvidenceError> {
-    let subject_id = principal
-        .verified_subject_binding_value(&config.subject_binding.token_claim)
-        .ok_or_else(|| subject_access_denied(SubjectAccessDenialCode::SubjectClaimMissing))?;
-    Ok(SubjectRequest {
-        id: subject_id.to_string(),
-        id_type: Some(config.subject_binding.id_type.clone()),
-    })
-}
-
-pub(in crate::api) fn derive_subject_access_request_context(
-    config: &SubjectAccessConfig,
-    principal: &EvidencePrincipal,
-    request: &mut EvaluateRequest,
-) -> Result<(), EvidenceError> {
-    let subject = subject_access_bound_subject(config, principal)?;
-    let derived = EvidenceEntity::from_subject_request("Person", subject.clone());
-    ensure_optional_entity_matches_subject(config, request.target.as_ref(), &subject)?;
-    ensure_optional_entity_matches_subject(config, request.requester.as_ref(), &subject)?;
-    if let Some(relationship) = request.relationship.as_ref() {
-        if relationship.relationship_type != "self" || !relationship.attributes.is_empty() {
-            return Err(subject_access_denied(
-                SubjectAccessDenialCode::SubjectMismatch,
-            ));
-        }
-    }
-    if request.on_behalf_of.is_some() {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::SubjectMismatch,
-        ));
-    }
-    request.target = Some(derived.clone());
-    request.requester = Some(derived);
-    request.relationship = Some(EvidenceRelationship {
-        relationship_type: "self".to_string(),
-        attributes: Default::default(),
-    });
-    Ok(())
-}
-
-pub(in crate::api) fn requested_subject_access_mode(principal: &EvidencePrincipal) -> AccessMode {
-    match principal
-        .authorization_details
-        .as_ref()
-        .and_then(|details| details.access_mode)
-    {
-        Some(AccessMode::DelegatedSubjectAccess) => AccessMode::DelegatedSubjectAccess,
-        _ => AccessMode::SubjectBound,
-    }
-}
-
-pub(in crate::api) fn apply_stored_subject_access_access_mode(
-    principal: &mut EvidencePrincipal,
-    metadata: &StoredSubjectAccessMetadata,
-) -> Result<(), EvidenceError> {
-    let requested_access_mode = requested_subject_access_mode(principal);
-    if requested_access_mode != metadata.access_mode {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    principal.access_mode = requested_access_mode;
-    Ok(())
-}
-
-pub(in crate::api) fn derive_delegated_subject_access_request_context(
-    config: &SubjectAccessConfig,
-    evidence: &EvidenceConfig,
-    keys: &SubjectAccessRateLimitKeys,
-    principal: &EvidencePrincipal,
-    request: &mut EvaluateRequest,
-) -> Result<(), EvidenceError> {
-    if !config.delegation.enabled {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedRelationshipNotAllowed,
-        ));
-    }
-    if request.requester.is_some()
-        || request.relationship.is_some()
-        || request.on_behalf_of.is_some()
-    {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedSubjectNotPermitted,
-        ));
-    }
-    let Some(details) = principal.authorization_details.as_ref() else {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedRelationshipNotAllowed,
-        ));
-    };
-    let Some(relationship) = details.relationship.as_ref() else {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedRelationshipNotAllowed,
-        ));
-    };
-    let relationship_config = config
-        .delegation
-        .relationship(&relationship.relationship_type)
-        .ok_or_else(|| {
-            subject_access_denied(SubjectAccessDenialCode::DelegatedRelationshipNotAllowed)
-        })?;
-    if relationship_config.proof_claim != relationship.proof_claim {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedRelationshipNotAllowed,
-        ));
-    }
-    let target_id_type = delegated_target_id_type(config, relationship_config);
-    let Some(target_subject) = request.target_subject() else {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedSubjectNotPermitted,
-        ));
-    };
-    if target_subject.id.trim().is_empty()
-        || target_subject.id_type.as_deref() != Some(target_id_type)
-    {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedSubjectNotPermitted,
-        ));
-    }
-    // Rebuild the target canonically from the validated (id, id_type) only,
-    // mirroring how the requester is derived below. This collapses
-    // to_subject_request(), target.identifiers.<id_type>, and target.id to a
-    // single value so the binding hash, the proof claim, and the dependent
-    // claim provably read the same subject. No arbitrary caller-supplied target
-    // context (extra identifiers, canonical id, attributes, profile) is trusted.
-    let mut subject_types = request.claims.iter().map(|claim| {
-        find_requested_claim(evidence, claim).map(|claim| claim.subject_type.as_str())
-    });
-    let target_entity_type = subject_types
-        .next()
-        .transpose()
-        .map_err(|_| subject_access_denied(SubjectAccessDenialCode::ClaimDenied))?
-        .ok_or_else(|| subject_access_denied(SubjectAccessDenialCode::ClaimDenied))?;
-    if subject_types.any(|subject_type| {
-        subject_type.is_err()
-            || subject_type.is_ok_and(|subject_type| subject_type != target_entity_type)
-    }) {
-        return Err(subject_access_denied(SubjectAccessDenialCode::ClaimDenied));
-    }
-    request.target = Some(EvidenceEntity::from_subject_request(
-        target_entity_type.to_string(),
-        target_subject,
-    ));
-
-    let requester_subject = subject_access_bound_subject(config, principal)?;
-    let requester = EvidenceEntity::from_subject_request("Person", requester_subject);
-    let principal_hash = keys
-        .principal(&principal.principal_id)
-        .map_err(|error| error.evidence_error())?;
-    let assurance = principal
-        .verified_claims
-        .as_ref()
-        .and_then(|claims| claims.acr.as_ref())
-        .map(|acr| acr.as_str().to_string());
-    request.requester = Some(requester);
-    request.relationship = Some(EvidenceRelationship {
-        relationship_type: relationship_config.relationship_type.clone(),
-        attributes: Default::default(),
-    });
-    request.on_behalf_of = Some(EvidenceOnBehalfOf {
-        actor: EvidenceActor {
-            actor_type: "person".to_string(),
-            id_hash: principal_hash.as_str().to_string(),
-            assurance,
-        },
-        delegation_ref: None,
-    });
-    Ok(())
-}
-
-pub(in crate::api) fn delegated_target_id_type<'a>(
-    config: &'a SubjectAccessConfig,
-    relationship: &'a SubjectAccessDelegatedRelationshipConfig,
-) -> &'a str {
-    relationship
-        .target_id_type
-        .as_deref()
-        .unwrap_or(config.subject_binding.id_type.as_str())
-}
-
-pub(in crate::api) fn ensure_optional_entity_matches_subject(
-    config: &SubjectAccessConfig,
-    entity: Option<&EvidenceEntity>,
-    expected: &SubjectRequest,
-) -> Result<(), EvidenceError> {
-    let Some(entity) = entity else {
-        return Ok(());
-    };
-    let Some(actual) = entity.to_subject_request() else {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::SubjectMismatch,
-        ));
-    };
-    if actual.id.trim().is_empty()
-        || actual.id != expected.id
-        || actual.id_type.as_deref() != Some(config.subject_binding.id_type.as_str())
-    {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::SubjectMismatch,
-        ));
-    }
-    Ok(())
-}
-
-pub(in crate::api) async fn check_oid4vci_subject_access_rate_limit(
-    state: &RegistryNotaryApiState,
-    principal: &EvidencePrincipal,
-    stored_principal_hash: Option<&Hashed<registry_notary_core::PrincipalIdentifier>>,
-    holder_id: Option<&str>,
-) -> Result<(), SubjectAccessRateLimitError> {
-    let principal_hash = oid4vci_rate_limit_principal_hash(
-        &state.subject_access_rate_keys,
-        &principal.principal_id,
-        stored_principal_hash,
-    )?;
-    let holder_hash = holder_id
-        .map(|holder_id| state.subject_access_rate_keys.holder(holder_id))
-        .transpose()?;
-    state
-        .subject_access_rate_limiter
-        .check_credential_issuance(&principal_hash, holder_hash.as_ref())
-        .await
-}
-
-fn oid4vci_rate_limit_principal_hash(
-    keys: &SubjectAccessRateLimitKeys,
-    principal_id: &str,
-    stored_principal_hash: Option<&Hashed<registry_notary_core::PrincipalIdentifier>>,
-) -> Result<Hashed<registry_notary_core::PrincipalIdentifier>, SubjectAccessRateLimitError> {
-    stored_principal_hash
-        .cloned()
-        .map_or_else(|| keys.principal(principal_id), Ok)
-}
-
-#[cfg(test)]
-mod rate_limit_principal_tests {
-    use super::*;
-
-    #[test]
-    fn delegated_wallet_handle_reuses_the_authenticated_principal_bucket() {
-        let keys = SubjectAccessRateLimitKeys::new(AuditKeyHasher::unkeyed_dev_only());
-        let ordinary = oid4vci_rate_limit_principal_hash(&keys, "representative-1", None).unwrap();
-        let delegated =
-            oid4vci_rate_limit_principal_hash(&keys, ordinary.as_str(), Some(&ordinary)).unwrap();
-        let double_hashed =
-            oid4vci_rate_limit_principal_hash(&keys, ordinary.as_str(), None).unwrap();
-
-        assert_eq!(delegated.as_str(), ordinary.as_str());
-        assert_ne!(double_hashed.as_str(), ordinary.as_str());
-    }
-}
diff --git a/crates/registry-notary-server/src/api/oid4vci/metadata.rs b/crates/registry-notary-server/src/api/oid4vci/metadata.rs
deleted file mode 100644
index f5ae3ebdc..000000000
--- a/crates/registry-notary-server/src/api/oid4vci/metadata.rs
+++ /dev/null
@@ -1,438 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! OID4VCI issuer, offer, and SD-JWT VC type metadata.
-
-use super::super::*;
-
-pub(in crate::api) async fn oid4vci_issuer_metadata(
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-) -> Response {
-    let Some(Extension(state)) = state else {
-        return oid4vci_error_response(Oid4vciWireError::ServerError);
-    };
-    if !state.oid4vci.enabled {
-        return StatusCode::NOT_FOUND.into_response();
-    }
-    match oid4vci_metadata(&state.oid4vci, &state.evidence) {
-        Ok(metadata) => Json(metadata).into_response(),
-        Err(error) => oid4vci_error_response(error),
-    }
-}
-
-pub(in crate::api) async fn oid4vci_type_metadata(
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    connect_info: Option<Extension<axum::extract::ConnectInfo<SocketAddr>>>,
-    headers: HeaderMap,
-    uri: Uri,
-) -> Response {
-    let Some(Extension(state)) = state else {
-        return oid4vci_error_response(Oid4vciWireError::ServerError);
-    };
-    let trust_forwarded = forwarded_host_trusted(&state, connect_info.as_deref());
-    oid4vci_type_metadata_response(&state, &headers, &uri, uri.path(), trust_forwarded)
-}
-
-pub(in crate::api) async fn oid4vci_well_known_type_metadata(
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    connect_info: Option<Extension<axum::extract::ConnectInfo<SocketAddr>>>,
-    headers: HeaderMap,
-    uri: Uri,
-) -> Response {
-    let Some(Extension(state)) = state else {
-        return oid4vci_error_response(Oid4vciWireError::ServerError);
-    };
-    // Consumers dereference an HTTPS vct by inserting /.well-known/vct between the
-    // host and the path. Strip that prefix so the candidate vct reconstructs to the
-    // configured identifier (https://{host}/{vct_path}), not the well-known URL.
-    let Some(vct_path) = uri.path().strip_prefix(WELL_KNOWN_VCT_PREFIX) else {
-        return StatusCode::NOT_FOUND.into_response();
-    };
-    let trust_forwarded = forwarded_host_trusted(&state, connect_info.as_deref());
-    oid4vci_type_metadata_response(&state, &headers, &uri, vct_path, trust_forwarded)
-}
-
-/// Whether `X-Forwarded-*` headers may be trusted for this request, i.e. the
-/// socket peer is in the configured `trusted_proxy_ips`. Mirrors the gate in
-/// `token_client_address_with_trusted_proxy_ips`.
-pub(in crate::api) fn forwarded_host_trusted(
-    state: &RegistryNotaryApiState,
-    connect_info: Option<&axum::extract::ConnectInfo<SocketAddr>>,
-) -> bool {
-    let Some(axum::extract::ConnectInfo(addr)) = connect_info else {
-        return false;
-    };
-    state
-        .runtime_config()
-        .map(|config| config.server.trusted_proxy_ips.contains(&addr.ip()))
-        .unwrap_or(false)
-}
-
-pub(in crate::api) fn oid4vci_type_metadata_response(
-    state: &RegistryNotaryApiState,
-    headers: &HeaderMap,
-    uri: &Uri,
-    request_path: &str,
-    trust_forwarded: bool,
-) -> Response {
-    if !state.oid4vci.enabled {
-        return StatusCode::NOT_FOUND.into_response();
-    }
-    let Some(request_vct) = oid4vci_requested_absolute_url_for_path(
-        &state.oid4vci,
-        headers,
-        uri,
-        request_path,
-        trust_forwarded,
-    ) else {
-        return StatusCode::NOT_FOUND.into_response();
-    };
-    let Some(configuration) = state
-        .oid4vci
-        .credential_configurations
-        .values()
-        .find(|configuration| configuration.vct == request_vct)
-    else {
-        return StatusCode::NOT_FOUND.into_response();
-    };
-    Json(oid4vci_type_metadata_document(
-        &state.evidence,
-        configuration,
-    ))
-    .into_response()
-}
-
-pub(in crate::api) fn oid4vci_metadata(
-    config: &Oid4vciConfig,
-    evidence: &EvidenceConfig,
-) -> Result<CredentialIssuerMetadata, Oid4vciWireError> {
-    let metadata = CredentialIssuerMetadata::new(
-        config.credential_issuer.clone(),
-        config.credential_endpoint.clone(),
-        // The initial nonce is transaction-scoped and returned only by the
-        // token endpoint. The 1.0 profile has no public nonce endpoint.
-        None,
-        config.authorization_servers.clone(),
-        config
-            .credential_configurations
-            .iter()
-            .map(|(id, configuration)| {
-                oid4vci_configuration_metadata(configuration, evidence)
-                    .map(|metadata| (id.clone(), metadata))
-            })
-            .collect::<Result<BTreeMap<_, _>, _>>()?,
-    )
-    .with_display(oid4vci_issuer_display_metadata(&config.display));
-    // When the pre-authorized-code flow is enabled the Notary is its own
-    // authorization server for that grant, so issuer metadata advertises its
-    // token endpoint. Per OID4VCI, the credential offer's `grants` carries the
-    // `urn:ietf:params:oauth:grant-type:pre-authorized_code` advertisement
-    // per-offer (see the offer/callback handler); the `token_endpoint` is the
-    // metadata signal that the issuer accepts that grant directly. When the
-    // flow is disabled there is no token endpoint and metadata is unchanged.
-    Ok(
-        match (
-            config.pre_authorized_code.enabled,
-            oid4vci_token_endpoint_url(config),
-        ) {
-            (true, Some(token_endpoint)) => metadata.with_token_endpoint(token_endpoint),
-            _ => metadata,
-        },
-    )
-}
-
-/// The Notary's own OID4VCI token endpoint URL: the credential-issuer base with
-/// `oid4vci/token` appended (preserving any configured base subpath). Returns
-/// `None` when the configured `credential_issuer` is not a usable absolute URL.
-pub(in crate::api) fn oid4vci_token_endpoint_url(config: &Oid4vciConfig) -> Option<String> {
-    let base = reqwest::Url::parse(config.credential_issuer.trim()).ok()?;
-    registry_platform_httputil::url::append_path_segments(&base, &["oid4vci", "token"])
-        .ok()
-        .map(|url| url.to_string())
-}
-
-pub(in crate::api) fn oid4vci_configuration_metadata(
-    configuration: &Oid4vciCredentialConfigurationConfig,
-    evidence: &EvidenceConfig,
-) -> Result<CredentialConfigurationMetadata, Oid4vciWireError> {
-    let credential_signing_alg = oid4vci_credential_signing_alg(configuration, evidence)?;
-    let mut metadata = CredentialConfigurationMetadata::sd_jwt_vc_with_algs(
-        configuration.scope.clone(),
-        configuration
-            .cryptographic_binding_methods_supported
-            .clone(),
-        vec![credential_signing_alg],
-        configuration.proof_signing_alg_values_supported.clone(),
-        configuration.display_name.clone(),
-        configuration.vct.clone(),
-    );
-    metadata.display = vec![oid4vci_credential_display_metadata(configuration)];
-    Ok(metadata)
-}
-
-pub(in crate::api) fn oid4vci_credential_signing_alg(
-    configuration: &Oid4vciCredentialConfigurationConfig,
-    evidence: &EvidenceConfig,
-) -> Result<String, Oid4vciWireError> {
-    let profile = evidence
-        .credential_profiles
-        .get(&configuration.credential_profile)
-        .ok_or(Oid4vciWireError::ServerError)?;
-    let signing_key = evidence
-        .signing_keys
-        .get(&profile.signing_key)
-        .ok_or(Oid4vciWireError::ServerError)?;
-    Ok(signing_key.alg.clone())
-}
-
-pub(in crate::api) fn oid4vci_sd_jwt_projection(
-    configuration: &Oid4vciCredentialConfigurationConfig,
-) -> Option<Vec<sd_jwt::SdJwtProjectionClaim>> {
-    match configuration.credential_claim_mode() {
-        Oid4vciCredentialClaimMode::LegacyClaimWrapper { .. } => None,
-        Oid4vciCredentialClaimMode::FieldProjection { entries } => Some(
-            entries
-                .iter()
-                .map(|entry| sd_jwt::SdJwtProjectionClaim {
-                    claim_id: entry.id.clone(),
-                    output_name: entry.output_path[0].clone(),
-                })
-                .collect(),
-        ),
-    }
-}
-
-pub(in crate::api) fn oid4vci_type_metadata_document(
-    evidence: &EvidenceConfig,
-    configuration: &Oid4vciCredentialConfigurationConfig,
-) -> Value {
-    let display = oid4vci_credential_type_display_metadata(configuration);
-    let locale = configuration.display.locale.as_deref().unwrap_or("en-US");
-    let claims = match configuration.credential_claim_mode() {
-        Oid4vciCredentialClaimMode::LegacyClaimWrapper { claim_id } => {
-            vec![oid4vci_type_metadata_claim(
-                evidence,
-                claim_id,
-                vec![claim_id.to_string()],
-                &configuration.display_name,
-                locale,
-            )]
-        }
-        Oid4vciCredentialClaimMode::FieldProjection { entries } => entries
-            .iter()
-            .map(|entry| {
-                oid4vci_type_metadata_claim(
-                    evidence,
-                    &entry.id,
-                    entry.output_path.clone(),
-                    &entry.display_name,
-                    locale,
-                )
-            })
-            .collect(),
-    };
-    let mut document = json!({
-        "vct": configuration.vct,
-        "name": configuration.display_name,
-        "display": [display],
-        "claims": claims,
-    });
-    if let Some(description) = configuration.display.description.as_deref() {
-        document["description"] = json!(description);
-    }
-    document
-}
-
-pub(in crate::api) fn oid4vci_type_metadata_claim(
-    evidence: &EvidenceConfig,
-    claim_id: &str,
-    path: Vec<String>,
-    label: &str,
-    locale: &str,
-) -> Value {
-    let mut claim = json!({
-        "path": path,
-        "display": [
-            {
-                "locale": locale,
-                "label": label,
-            }
-        ],
-        "sd": "always",
-        "mandatory": true,
-    });
-    if let Some(semantics) = evidence
-        .claims
-        .iter()
-        .find(|claim| claim.id == claim_id)
-        .and_then(claim_semantics_metadata)
-    {
-        claim["registry_notary_semantics"] = semantics;
-    }
-    if let Some(value_schema) = evidence
-        .claims
-        .iter()
-        .find(|definition| definition.id == claim_id)
-        .and_then(
-            |definition| match (&definition.evidence_mode, &definition.rule) {
-                (
-                    ClaimEvidenceMode::RegistryBacked { consultations },
-                    RuleConfig::ConsultationOutput {
-                        consultation,
-                        output,
-                    },
-                ) => consultations
-                    .get(consultation)
-                    .and_then(|consultation| consultation.outputs.get(output)),
-                _ => None,
-            },
-        )
-        .and_then(|schema| serde_json::to_value(schema).ok())
-    {
-        // SD-JWT VC Type Metadata intentionally has no standard JSON Schema
-        // member. This namespaced extension publishes the exact compiler-pinned
-        // closed Relay value shape without suggesting nested disclosure.
-        claim["registry_notary_value_schema"] = value_schema;
-    }
-    claim
-}
-
-pub(in crate::api) fn oid4vci_issuer_display_metadata(
-    displays: &[Oid4vciIssuerDisplayConfig],
-) -> Vec<DisplayMetadata> {
-    displays
-        .iter()
-        .map(|display| {
-            let mut metadata = DisplayMetadata::new(display.name.clone());
-            metadata.locale = display.locale.clone();
-            metadata.logo = display.logo.as_ref().map(oid4vci_display_image_metadata);
-            metadata
-        })
-        .collect()
-}
-
-pub(in crate::api) fn oid4vci_credential_display_metadata(
-    configuration: &Oid4vciCredentialConfigurationConfig,
-) -> DisplayMetadata {
-    let mut metadata = DisplayMetadata::new(configuration.display_name.clone());
-    metadata.locale = configuration.display.locale.clone();
-    metadata.logo = configuration
-        .display
-        .logo
-        .as_ref()
-        .map(oid4vci_display_image_metadata);
-    metadata.description = configuration.display.description.clone();
-    metadata.background_color = configuration.display.background_color.clone();
-    metadata.text_color = configuration.display.text_color.clone();
-    metadata.background_image = configuration
-        .display
-        .background_image
-        .as_ref()
-        .map(oid4vci_display_image_metadata);
-    metadata.secondary_image = configuration
-        .display
-        .secondary_image
-        .as_ref()
-        .map(oid4vci_display_image_metadata);
-    metadata
-}
-
-pub(in crate::api) fn oid4vci_display_image_metadata(
-    image: &Oid4vciDisplayImageConfig,
-) -> DisplayImageMetadata {
-    DisplayImageMetadata {
-        uri: image.uri.clone().or_else(|| image.url.clone()),
-        url: None,
-        alt_text: image.alt_text.clone(),
-    }
-}
-
-pub(in crate::api) fn oid4vci_credential_type_display_metadata(
-    configuration: &Oid4vciCredentialConfigurationConfig,
-) -> Value {
-    let display = oid4vci_credential_display_metadata(configuration);
-    let mut value = serde_json::to_value(display).expect("display metadata serializes");
-    if value
-        .get("locale")
-        .and_then(|value| value.as_str())
-        .is_none()
-    {
-        value["locale"] = json!("en-US");
-    }
-    value
-}
-
-pub(in crate::api) fn oid4vci_requested_absolute_url_for_path(
-    config: &Oid4vciConfig,
-    headers: &HeaderMap,
-    uri: &Uri,
-    request_path: &str,
-    trust_forwarded: bool,
-) -> Option<String> {
-    let (issuer_scheme, issuer_authority, issuer_path) =
-        absolute_url_parts(&config.credential_issuer)?;
-    // `X-Forwarded-*` headers are caller-controlled, so they are honored only
-    // when the socket peer is a trusted proxy (mirrors `token_client_address`).
-    // Otherwise fall back to the `Host` header / URI / configured issuer.
-    let scheme = trust_forwarded
-        .then(|| forwarded_header_value(headers, "x-forwarded-proto"))
-        .flatten()
-        .or_else(|| uri.scheme_str())
-        .unwrap_or(issuer_scheme)
-        .to_lowercase();
-    let authority = trust_forwarded
-        .then(|| forwarded_header_value(headers, "x-forwarded-host"))
-        .flatten()
-        .or_else(|| {
-            headers
-                .get(header::HOST)
-                .and_then(|value| value.to_str().ok())
-                .map(str::trim)
-                .filter(|value| !value.is_empty())
-        })
-        .or_else(|| uri.authority().map(|authority| authority.as_str()))
-        .unwrap_or(issuer_authority)
-        .to_lowercase();
-    let external_path = oid4vci_external_path(issuer_path, request_path);
-    Some(format!("{scheme}://{authority}{external_path}"))
-}
-
-pub(in crate::api) fn absolute_url_parts(url: &str) -> Option<(&str, &str, &str)> {
-    let (scheme, rest) = url.trim().split_once("://")?;
-    let authority_end = rest.find(['/', '?', '#']).unwrap_or(rest.len());
-    let authority = rest[..authority_end].trim();
-    if scheme.is_empty() || authority.is_empty() {
-        return None;
-    }
-    let path = if rest[authority_end..].starts_with('/') {
-        rest[authority_end..]
-            .split(['?', '#'])
-            .next()
-            .unwrap_or_default()
-    } else {
-        ""
-    };
-    Some((scheme, authority, path))
-}
-
-pub(in crate::api) fn oid4vci_external_path(issuer_path: &str, path: &str) -> String {
-    let issuer_path = issuer_path.trim_end_matches('/');
-    if issuer_path.is_empty()
-        || path.starts_with(&format!("{issuer_path}/"))
-        || !path.starts_with("/credentials/")
-    {
-        path.to_string()
-    } else {
-        format!("{issuer_path}{path}")
-    }
-}
-
-pub(in crate::api) fn forwarded_header_value<'a>(
-    headers: &'a HeaderMap,
-    name: &str,
-) -> Option<&'a str> {
-    headers
-        .get(name)
-        .and_then(|value| value.to_str().ok())
-        .and_then(|value| value.split(',').next())
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-}
diff --git a/crates/registry-notary-server/src/api/oid4vci/preauth.rs b/crates/registry-notary-server/src/api/oid4vci/preauth.rs
deleted file mode 100644
index 9c0c5c95c..000000000
--- a/crates/registry-notary-server/src/api/oid4vci/preauth.rs
+++ /dev/null
@@ -1,3565 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! OID4VCI pre-authorized-code offer and token flow.
-
-use super::super::*;
-
-const REGISTRY_OFFER_SIGNER_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(25);
-const REGISTRY_OFFER_LEASE_RENEWAL_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(5);
-const REGISTRY_OFFER_FINAL_RESERVATION_TIMEOUT: std::time::Duration =
-    std::time::Duration::from_secs(45);
-const REGISTRY_OFFER_OPERATION_POLL_INTERVAL: std::time::Duration =
-    std::time::Duration::from_millis(250);
-const REGISTRY_OFFER_OPERATION_MAX_POLL_INTERVAL: std::time::Duration =
-    std::time::Duration::from_secs(2);
-const REGISTRY_OFFER_OPERATION_WAIT: std::time::Duration = std::time::Duration::from_secs(20);
-pub(in crate::api) const REGISTRY_OFFER_OPERATION_RETRY_AFTER_SECONDS: &str = "5";
-const _: () = assert!(
-    REGISTRY_OFFER_LEASE_RENEWAL_TIMEOUT.as_secs()
-        + REGISTRY_OFFER_FINAL_RESERVATION_TIMEOUT.as_secs()
-        < OPERATION_LEASE_SECONDS as u64
-);
-
-#[derive(Debug, Deserialize)]
-pub(in crate::api) struct Oid4vciOfferStartQuery {
-    pub(in crate::api) credential_configuration_id: Option<String>,
-}
-
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-pub(in crate::api) struct Oid4vciRegistryOfferRequest {
-    pub(in crate::api) evaluation_id: String,
-    pub(in crate::api) credential_configuration_id: String,
-}
-
-/// `POST /oid4vci/offers` (authenticated): create one registrar-initiated
-/// pre-authorized offer from an already stored machine evaluation.
-///
-/// The request cannot supply facts, target, purpose, profile, or provenance.
-/// Every authority-bearing value is recovered from authenticated configuration
-/// and the immutable stored evaluation.
-pub(in crate::api) async fn oid4vci_create_registry_offer(
-    headers: HeaderMap,
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    principal: Option<Extension<EvidencePrincipal>>,
-    request: Result<Json<Oid4vciRegistryOfferRequest>, JsonRejection>,
-) -> Response {
-    let mut response =
-        oid4vci_create_registry_offer_inner(headers, state, principal, request).await;
-    response
-        .headers_mut()
-        .insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
-    response
-        .headers_mut()
-        .insert(header::PRAGMA, HeaderValue::from_static("no-cache"));
-    response
-}
-
-async fn oid4vci_create_registry_offer_inner(
-    headers: HeaderMap,
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    principal: Option<Extension<EvidencePrincipal>>,
-    request: Result<Json<Oid4vciRegistryOfferRequest>, JsonRejection>,
-) -> Response {
-    let request = match parse_json_body(request) {
-        Ok(request) => request,
-        Err(error) => return evidence_error_response(error),
-    };
-    let Some(Extension(state)) = state else {
-        return evidence_error_response(EvidenceError::ServerDisabled);
-    };
-    let Some(preauth) = preauth_runtime(&state) else {
-        return StatusCode::NOT_FOUND.into_response();
-    };
-    let Some(Extension(principal)) = principal else {
-        return evidence_error_response(EvidenceError::MissingCredential);
-    };
-    let principal = match classify_subject_access_principal(&state.subject_access, &principal) {
-        Ok(principal)
-            if principal.access_mode() == AccessMode::MachineClient
-                && principal.auth_profile_id
-                    != registry_notary_core::EvidenceAuthProfileId::NotaryAccessToken
-                && principal.has_scope(REGISTRY_OFFER_CREATE_SCOPE) =>
-        {
-            principal
-        }
-        Ok(_) => {
-            return evidence_error_response(EvidenceError::ScopeDenied {
-                required: REGISTRY_OFFER_CREATE_SCOPE.to_string(),
-            })
-        }
-        Err(error) => return evidence_error_response(error),
-    };
-    let Some(idempotency_key) = idempotency_key(&headers).filter(|key| {
-        !key.is_empty()
-            && key.len() <= 256
-            && key
-                .bytes()
-                .all(|byte| matches!(byte, b'!' | b'#'..=b'[' | b']'..=b'~'))
-    }) else {
-        return evidence_error_response(EvidenceError::InvalidRequest);
-    };
-    let evidence = match state.enabled_evidence() {
-        Ok(evidence) => evidence,
-        Err(error) => return evidence_error_response(error),
-    };
-    let Some((configuration_id, configuration)) = state
-        .oid4vci
-        .credential_configurations
-        .get_key_value(&request.credential_configuration_id)
-    else {
-        return evidence_error_response(EvidenceError::EvaluationNotFound);
-    };
-    if !principal.has_scope(&configuration.scope) {
-        return evidence_error_response(EvidenceError::ScopeDenied {
-            required: configuration.scope.clone(),
-        });
-    }
-    if configuration.representative_issuance.is_some() {
-        return registry_offer_problem(
-            StatusCode::FORBIDDEN,
-            "representative_offer_requires_authenticated_ceremony",
-        );
-    }
-    let evaluation = match state
-        .store
-        .get(&request.evaluation_id, &principal.principal_id)
-        .await
-    {
-        Ok(Some(evaluation))
-            if evaluation.subject_access.is_none()
-                && evaluation.client_id == principal.principal_id
-                && evaluation.access_mode() == AccessMode::MachineClient =>
-        {
-            evaluation
-        }
-        Ok(Some(_)) | Ok(None) => {
-            return evidence_error_response(EvidenceError::EvaluationNotFound);
-        }
-        Err(error) => return evidence_error_response(error),
-    };
-    let now = OffsetDateTime::now_utc();
-    let evaluation_expires_at = match OffsetDateTime::parse(&evaluation.expires_at, &Rfc3339) {
-        Ok(expires_at) if expires_at > now => expires_at,
-        _ => return evidence_error_response(EvidenceError::EvaluationNotFound),
-    };
-    let configuration_claim_ids = configuration.credential_claim_ids();
-    let configuration_claim_refs = oid4vci_credential_claim_refs(configuration);
-    let result_claim_ids = evaluation
-        .results
-        .iter()
-        .map(|result| result.claim_id.clone())
-        .collect::<Vec<_>>();
-    if !crate::authz_details::exact_unique_string_set(
-        &evaluation.claim_ids,
-        &configuration_claim_ids,
-    ) || !crate::authz_details::exact_unique_string_set(
-        &result_claim_ids,
-        &configuration_claim_ids,
-    ) || !crate::authz_details::exact_unique_claim_ref_set(
-        &evaluation.selected_claim_refs(),
-        &configuration_claim_refs,
-    ) || evaluation.disclosure != DisclosureProfile::Value.as_str()
-        || evaluation.format != FORMAT_CLAIM_RESULT_JSON
-        || evaluation.results.is_empty()
-        || evaluation.results.iter().any(|result| {
-            result.value.as_ref().is_none_or(Value::is_null)
-                || result.satisfied == Some(false)
-                || !result.redacted_fields.is_empty()
-        })
-    {
-        return evidence_error_response(EvidenceError::EvaluationBindingMismatch);
-    }
-    let Some(target_ref) = evaluation.results.first().map(|result| &result.target_ref) else {
-        return evidence_error_response(EvidenceError::EvaluationBindingMismatch);
-    };
-    if evaluation
-        .results
-        .iter()
-        .any(|result| !same_target_ref(&result.target_ref, target_ref))
-    {
-        return evidence_error_response(EvidenceError::EvaluationBindingMismatch);
-    }
-    if let Err(error) = require_evaluation_access(evidence, &principal, &evaluation) {
-        return evidence_error_response(error);
-    }
-    let selected = evaluation.selected_claim_refs();
-    let configured_purpose = match common_subject_access_purpose(evidence, &selected) {
-        Ok(purpose) => purpose,
-        Err(error) => return evidence_error_response(error),
-    };
-    if configured_purpose != evaluation.purpose
-        || (!evidence.allowed_purposes.is_empty()
-            && !evidence
-                .allowed_purposes
-                .iter()
-                .any(|purpose| purpose == &evaluation.purpose))
-    {
-        return evidence_error_response(EvidenceError::PurposeNotAllowed);
-    }
-    if let Err(error) =
-        require_registry_backed_credential_claims(evidence, &configuration_claim_ids)
-    {
-        return evidence_error_response(error);
-    }
-    let (profile_id, profile) = match credential_profile_for(
-        evidence,
-        &evaluation,
-        Some(&configuration.credential_profile),
-    ) {
-        Ok(profile) => profile,
-        Err(error) => return evidence_error_response(error),
-    };
-    if profile_id != configuration.credential_profile
-        || (!profile.disclosure.allowed.is_empty()
-            && !profile
-                .disclosure
-                .allowed
-                .iter()
-                .any(|allowed| allowed == &evaluation.disclosure))
-    {
-        return evidence_error_response(EvidenceError::DisclosureNotAllowed);
-    }
-    let credential_issued_at = earliest_issued_at(&evaluation.results).unwrap_or(now);
-    let credential_expires_at =
-        match credential_issued_at.checked_add(time::Duration::seconds(profile.validity_seconds)) {
-            Some(expires_at) if expires_at > now => expires_at,
-            Some(_) => return evidence_error_response(EvidenceError::EvaluationNotFound),
-            None => return evidence_error_response(EvidenceError::CredentialIssuanceFailed),
-        };
-    let offer_expires_at = evaluation_expires_at.min(credential_expires_at);
-    if let Err(error) =
-        require_issuable_evaluation_provenance(evidence, &request.evaluation_id, &evaluation)
-    {
-        return evidence_error_response(error);
-    }
-    let Some(details) = principal.authorization_details.as_ref() else {
-        return evidence_error_response(EvidenceError::EvaluationBindingMismatch);
-    };
-    let Some(authorized_target) = details.target.as_ref() else {
-        return evidence_error_response(EvidenceError::EvaluationBindingMismatch);
-    };
-    let Some(stored_target_binding) = evaluation
-        .issuance_provenance
-        .as_ref()
-        .map(|provenance| provenance.authorization_target_binding.as_str())
-        .filter(|binding| !binding.is_empty())
-    else {
-        return evidence_error_response(EvidenceError::EvaluationBindingMismatch);
-    };
-    let authorized_target_binding = match issuance_authorization_target_binding(
-        &state.subject_access_rate_keys,
-        target_ref,
-        &authorized_target.id_type,
-        &authorized_target.id,
-    ) {
-        Ok(binding) => binding,
-        Err(error) => return evidence_error_response(error),
-    };
-    if authorized_target_binding != stored_target_binding
-        || crate::authz_details::validate_scoped_authorization_details(
-            details,
-            &crate::authz_details::ScopedAuthorizationRequest {
-                service_id: evidence.service_id.as_str(),
-                action: "create_credential_offer",
-                claims: &selected,
-                disclosure: DisclosureProfile::Value.as_str(),
-                format: FORMAT_CLAIM_RESULT_JSON,
-                purpose: evaluation.purpose.as_str(),
-                access_mode: AccessMode::MachineClient,
-                subject: None,
-                target: Some(crate::authz_details::ScopedAuthorizationTarget {
-                    id_type: authorized_target.id_type.clone(),
-                    id: authorized_target.id.clone(),
-                }),
-                allow_subset_claims: false,
-                allowed_claims: None,
-            },
-        )
-        .is_err()
-    {
-        return evidence_error_response(EvidenceError::EvaluationBindingMismatch);
-    }
-    let configuration_fingerprint =
-        match oid4vci_configuration_fingerprint(evidence, configuration_id, configuration) {
-            Ok(fingerprint) => fingerprint,
-            Err(error) => return evidence_error_response(error),
-        };
-    let initiating_client_id_hash = match state
-        .subject_access_rate_keys
-        .principal(&principal.principal_id)
-    {
-        Ok(hash) => hash.as_str().to_string(),
-        Err(error) => return evidence_error_response(error.evidence_error()),
-    };
-    let canonical_idempotency_input = format!(
-        "client\0{}\0{}\0key\0{}\0{}",
-        initiating_client_id_hash.len(),
-        initiating_client_id_hash,
-        idempotency_key.len(),
-        idempotency_key
-    );
-    let idempotency_key_hash = match state.subject_access_rate_keys.audit_pseudonym_ref(
-        "oid4vci-registry-offer-idempotency-v1",
-        &canonical_idempotency_input,
-    ) {
-        Ok(hash) => hash.as_str().to_string(),
-        Err(error) => return evidence_error_response(error.evidence_error()),
-    };
-    let mut canonical_authorized_scopes = principal.scopes.clone();
-    canonical_authorized_scopes.sort();
-    canonical_authorized_scopes.dedup();
-    let canonical_authorization_details = canonical_registry_offer_authorization_details(details);
-    let canonical_request_hash = match sha256_canonical_json(&json!({
-        "schema": "registry.notary.registry-client-offer-request/v1",
-        "request": request,
-        "configuration_fingerprint": configuration_fingerprint,
-        "evaluation": evaluation,
-        "initiating_client_id_hash": initiating_client_id_hash,
-        "auth_profile_id": principal.auth_profile_id,
-        "authorized_scopes": canonical_authorized_scopes,
-        "authorization_details": canonical_authorization_details,
-    })) {
-        Ok(hash) => hash,
-        Err(error) => return evidence_error_response(error),
-    };
-    match preauth
-        .preauthorization_state()
-        .registry_client_offer_preflight(
-            &request.evaluation_id,
-            &principal.principal_id,
-            &idempotency_key_hash,
-            &canonical_request_hash,
-        )
-        .await
-    {
-        Ok(RegistryClientOfferPreflightOutcome::Available) => {}
-        Ok(RegistryClientOfferPreflightOutcome::Replayed(response)) => {
-            state
-                .metrics
-                .record_credential("openid4vci_registry_offer", "replayed");
-            return registry_client_offer_success_response(
-                response,
-                &state.subject_access_rate_keys,
-                "registry_offer_replayed",
-                &request.evaluation_id,
-                &evaluation,
-                configuration_id,
-                profile_id,
-                &profile.holder_binding.mode,
-                target_ref,
-            );
-        }
-        Ok(RegistryClientOfferPreflightOutcome::IdempotencyConflict)
-        | Ok(RegistryClientOfferPreflightOutcome::EvaluationConsumed) => {
-            return registry_offer_problem(StatusCode::CONFLICT, "offer_conflict");
-        }
-        Err(_) => {
-            return registry_offer_problem(StatusCode::SERVICE_UNAVAILABLE, "offer_unavailable");
-        }
-    }
-    let quota_operation_id = format!(
-        "idempotency\0{}\0{}",
-        idempotency_key_hash.len(),
-        idempotency_key_hash,
-    );
-    let transaction_id = match generate_opaque_token() {
-        Ok(transaction_id) => transaction_id,
-        Err(_) => return evidence_error_response(EvidenceError::CredentialIssuanceFailed),
-    };
-    let quota_wait_deadline = tokio::time::Instant::now() + REGISTRY_OFFER_OPERATION_WAIT;
-    let quota_poll_jitter = std::time::Duration::from_millis(
-        transaction_id.bytes().fold(0_u64, |accumulator, byte| {
-            accumulator.wrapping_mul(33).wrapping_add(u64::from(byte))
-        }) % 101,
-    );
-    let mut quota_poll_interval = REGISTRY_OFFER_OPERATION_POLL_INTERVAL;
-    let _initial_quota_operation_fence = loop {
-        let quota_outcome = match tokio::time::timeout_at(
-            quota_wait_deadline,
-            state.machine_quota_limiter.check_and_consume_once(
-                &principal.principal_id,
-                1,
-                &quota_operation_id,
-                &canonical_request_hash,
-                &transaction_id,
-                offer_expires_at,
-            ),
-        )
-        .await
-        {
-            Ok(outcome) => outcome,
-            Err(_) => {
-                return registry_offer_problem(
-                    StatusCode::SERVICE_UNAVAILABLE,
-                    "offer_unavailable",
-                );
-            }
-        };
-        match quota_outcome {
-            Ok(MachineQuotaOperationOutcome::Acquired(fence)) => break fence,
-            Ok(MachineQuotaOperationOutcome::Conflict) => {
-                return registry_offer_problem(StatusCode::CONFLICT, "offer_conflict");
-            }
-            Ok(MachineQuotaOperationOutcome::Existing) => {
-                // A concurrent exact request owns the charged lease. Only
-                // that owner may sign. Contenders wait for its authoritative
-                // reservation, or take over an expired/released lease without
-                // spending quota again.
-                let preflight = match tokio::time::timeout_at(
-                    quota_wait_deadline,
-                    preauth
-                        .preauthorization_state()
-                        .registry_client_offer_preflight(
-                            &request.evaluation_id,
-                            &principal.principal_id,
-                            &idempotency_key_hash,
-                            &canonical_request_hash,
-                        ),
-                )
-                .await
-                {
-                    Ok(preflight) => preflight,
-                    Err(_) => {
-                        return registry_offer_problem(
-                            StatusCode::SERVICE_UNAVAILABLE,
-                            "offer_unavailable",
-                        );
-                    }
-                };
-                match preflight {
-                    Ok(RegistryClientOfferPreflightOutcome::Replayed(response)) => {
-                        state
-                            .metrics
-                            .record_credential("openid4vci_registry_offer", "replayed");
-                        return registry_client_offer_success_response(
-                            response,
-                            &state.subject_access_rate_keys,
-                            "registry_offer_replayed",
-                            &request.evaluation_id,
-                            &evaluation,
-                            configuration_id,
-                            profile_id,
-                            &profile.holder_binding.mode,
-                            target_ref,
-                        );
-                    }
-                    Ok(RegistryClientOfferPreflightOutcome::IdempotencyConflict)
-                    | Ok(RegistryClientOfferPreflightOutcome::EvaluationConsumed) => {
-                        return registry_offer_problem(StatusCode::CONFLICT, "offer_conflict");
-                    }
-                    Ok(RegistryClientOfferPreflightOutcome::Available) => {}
-                    Err(_) => {
-                        return registry_offer_problem(
-                            StatusCode::SERVICE_UNAVAILABLE,
-                            "offer_unavailable",
-                        );
-                    }
-                }
-                let now = tokio::time::Instant::now();
-                if now >= quota_wait_deadline {
-                    return registry_offer_problem(
-                        StatusCode::SERVICE_UNAVAILABLE,
-                        "offer_unavailable",
-                    );
-                }
-                tokio::time::sleep_until(std::cmp::min(
-                    now + quota_poll_interval + quota_poll_jitter,
-                    quota_wait_deadline,
-                ))
-                .await;
-                quota_poll_interval = std::cmp::min(
-                    quota_poll_interval.saturating_mul(2),
-                    REGISTRY_OFFER_OPERATION_MAX_POLL_INTERVAL,
-                );
-            }
-            Err(error) => {
-                return evidence_error_response(EvidenceError::MachineQuotaExceeded {
-                    retry_after_seconds: error.retry_after_seconds,
-                });
-            }
-        }
-    };
-    let (quota_principal_hash, _quota_limit, quota_cost) = match state
-        .machine_quota_limiter
-        .batch_reservation_parameters(&principal.principal_id, 1)
-    {
-        Ok(parameters) => parameters,
-        Err(error) => {
-            release_registry_offer_quota_operation(
-                &state,
-                &principal.principal_id,
-                &quota_operation_id,
-                &transaction_id,
-            )
-            .await;
-            return evidence_error_response(EvidenceError::MachineQuotaExceeded {
-                retry_after_seconds: error.retry_after_seconds,
-            });
-        }
-    };
-    let commitment = match oid4vci_registry_client_transaction_commitment(
-        &transaction_id,
-        evidence,
-        configuration_id,
-        configuration,
-        &configuration_fingerprint,
-        &request.evaluation_id,
-        &evaluation,
-        &initiating_client_id_hash,
-        principal.auth_profile_id,
-        &principal.scopes,
-        target_ref,
-    ) {
-        Ok(commitment) => commitment,
-        Err(error) => {
-            release_registry_offer_quota_operation(
-                &state,
-                &principal.principal_id,
-                &quota_operation_id,
-                &transaction_id,
-            )
-            .await;
-            return evidence_error_response(error);
-        }
-    };
-    let authority = IssuanceAuthority::RegistryClient {
-        initiating_client_id: principal.principal_id.clone(),
-        initiating_client_id_hash,
-        auth_profile_id: principal.auth_profile_id,
-        authorized_scopes: principal.scopes.clone(),
-        target_ref: target_ref.clone(),
-        service_id: evidence.service_id.clone(),
-        purpose: evaluation.purpose.clone(),
-    };
-    let transaction = IssuanceTransaction {
-        transaction_id: transaction_id.clone(),
-        evaluation_id: request.evaluation_id.clone(),
-        evaluation_client_id: principal.principal_id.clone(),
-        credential_configuration_id: configuration_id.clone(),
-        commitment: commitment.clone(),
-        authority,
-    };
-    let now_unix = now.unix_timestamp();
-    let code_exp = (now_unix + preauth.pre_authorized_code_ttl_seconds() as i64)
-        .min(offer_expires_at.unix_timestamp());
-    if code_exp <= now_unix {
-        release_registry_offer_quota_operation(
-            &state,
-            &principal.principal_id,
-            &quota_operation_id,
-            &transaction_id,
-        )
-        .await;
-        return evidence_error_response(EvidenceError::EvaluationNotFound);
-    }
-    let code_expires_at = match OffsetDateTime::from_unix_timestamp(code_exp) {
-        Ok(expires_at) => expires_at,
-        Err(_) => {
-            release_registry_offer_quota_operation(
-                &state,
-                &principal.principal_id,
-                &quota_operation_id,
-                &transaction_id,
-            )
-            .await;
-            return evidence_error_response(EvidenceError::CredentialIssuanceFailed);
-        }
-    };
-    let transaction_expires_at = offer_expires_at
-        .min(code_expires_at + time::Duration::seconds(preauth.access_token_ttl_seconds() as i64));
-    let wallet_authority = BoundSubject {
-        subject: transaction_id.clone(),
-        subject_binding_claim: state.subject_access.subject_binding.token_claim.clone(),
-        subject_binding_value: transaction_id.clone(),
-        client_id: "registry-notary-wallet-transaction".to_string(),
-        scopes: vec![configuration.scope.clone()],
-        acr: None,
-        auth_time: None,
-    };
-    let code_claims = PreAuthorizedCodeClaims {
-        issuer: preauth.notary_issuer().to_string(),
-        jti: transaction_id.clone(),
-        credential_configuration_id: configuration_id.clone(),
-        issuance_transaction_id: transaction_id.clone(),
-        issuance_transaction_commitment: commitment,
-        // Registrar-initiated offers always require a separately presented
-        // transaction code, independent of the citizen self-service setting.
-        tx_code_required: true,
-        subject: wallet_authority,
-        iat: now_unix,
-        exp: code_exp,
-    };
-    let Some(signing_timeout) =
-        registry_offer_completion_timeout(code_expires_at, REGISTRY_OFFER_SIGNER_TIMEOUT)
-    else {
-        release_registry_offer_quota_operation(
-            &state,
-            &principal.principal_id,
-            &quota_operation_id,
-            &transaction_id,
-        )
-        .await;
-        return evidence_error_response(EvidenceError::EvaluationNotFound);
-    };
-    let signed_code = match tokio::time::timeout(
-        signing_timeout,
-        mint_pre_authorized_code(
-            preauth.access_token_signer(),
-            PRE_AUTHORIZED_CODE_JWT_TYP,
-            &code_claims,
-        ),
-    )
-    .await
-    {
-        Ok(Ok(code)) => code,
-        Ok(Err(error)) => {
-            release_registry_offer_quota_operation(
-                &state,
-                &principal.principal_id,
-                &quota_operation_id,
-                &transaction_id,
-            )
-            .await;
-            return evidence_error_response(error);
-        }
-        Err(_) => {
-            release_registry_offer_quota_operation(
-                &state,
-                &principal.principal_id,
-                &quota_operation_id,
-                &transaction_id,
-            )
-            .await;
-            return evidence_error_response(EvidenceError::CredentialIssuanceFailed);
-        }
-    };
-    let Some(lease_renewal_timeout) =
-        registry_offer_completion_timeout(code_expires_at, REGISTRY_OFFER_LEASE_RENEWAL_TIMEOUT)
-    else {
-        release_registry_offer_quota_operation(
-            &state,
-            &principal.principal_id,
-            &quota_operation_id,
-            &transaction_id,
-        )
-        .await;
-        return evidence_error_response(EvidenceError::EvaluationNotFound);
-    };
-    // The initial 60-second owner lease safely contains the 25-second signer
-    // deadline. Renew immediately after signing, then bound the authoritative
-    // reservation to 45 seconds. The 5-second renewal deadline leaves at
-    // least ten seconds before takeover is possible. PostgreSQL and the
-    // in-memory path both fence final completion on this returned owner token.
-    let quota_operation_fence = match tokio::time::timeout(
-        lease_renewal_timeout,
-        state.machine_quota_limiter.check_and_consume_once(
-            &principal.principal_id,
-            1,
-            &quota_operation_id,
-            &canonical_request_hash,
-            &transaction_id,
-            offer_expires_at,
-        ),
-    )
-    .await
-    {
-        Ok(Ok(MachineQuotaOperationOutcome::Acquired(fence))) => fence,
-        Ok(Ok(MachineQuotaOperationOutcome::Conflict)) => {
-            release_registry_offer_quota_operation(
-                &state,
-                &principal.principal_id,
-                &quota_operation_id,
-                &transaction_id,
-            )
-            .await;
-            return registry_offer_problem(StatusCode::CONFLICT, "offer_conflict");
-        }
-        Ok(Ok(MachineQuotaOperationOutcome::Existing)) | Ok(Err(_)) | Err(_) => {
-            release_registry_offer_quota_operation(
-                &state,
-                &principal.principal_id,
-                &quota_operation_id,
-                &transaction_id,
-            )
-            .await;
-            return registry_offer_problem(StatusCode::SERVICE_UNAVAILABLE, "offer_unavailable");
-        }
-    };
-    let tx_code = match generate_numeric_tx_code(preauth.tx_code_length()) {
-        Ok(code) => code,
-        Err(_) => {
-            release_registry_offer_quota_operation(
-                &state,
-                &principal.principal_id,
-                &quota_operation_id,
-                &transaction_id,
-            )
-            .await;
-            return evidence_error_response(EvidenceError::CredentialIssuanceFailed);
-        }
-    };
-    let offer = CredentialOffer::pre_authorized_code(
-        state.oid4vci.credential_issuer.clone(),
-        vec![configuration_id.clone()],
-        signed_code.compact,
-        Some(TxCode::new(
-            preauth.tx_code_length(),
-            Some("Enter the PIN delivered separately by the registrar".to_string()),
-        )),
-    );
-    let credential_offer_uri = match offer_request_uri(&offer) {
-        Ok(uri) => uri,
-        Err(()) => {
-            release_registry_offer_quota_operation(
-                &state,
-                &principal.principal_id,
-                &quota_operation_id,
-                &transaction_id,
-            )
-            .await;
-            return evidence_error_response(EvidenceError::CredentialIssuanceFailed);
-        }
-    };
-    let response = RegistryClientOfferResponse {
-        credential_offer_uri,
-        tx_code: Some(tx_code.clone()),
-        expires_at: format_time(code_expires_at),
-    };
-    let audit_evaluation_id = request.evaluation_id.clone();
-    let quota_lease_owner_id = transaction_id.clone();
-    let reservation = RegistryClientOfferReservation {
-        transaction_id,
-        evaluation_id: request.evaluation_id,
-        evaluation_expires_at,
-        idempotency_key_hash,
-        canonical_request_hash,
-        transaction,
-        transaction_code: Some(RegistryClientTransactionCode {
-            pin: tx_code,
-            pin_length: preauth.tx_code_length(),
-        }),
-        code_expires_at,
-        transaction_expires_at,
-        response,
-        // Replays must stop when the signed code does. Evaluation consumption
-        // remains independently retained through evaluation_expires_at.
-        retention_expires_at: code_expires_at,
-        quota_principal_hash,
-        // Quota was charged before signer work. The atomic final reservation
-        // must not debit the same request a second time.
-        quota_limit: None,
-        quota_cost,
-    };
-    let Some(final_reservation_timeout) = registry_offer_completion_timeout(
-        code_expires_at,
-        REGISTRY_OFFER_FINAL_RESERVATION_TIMEOUT,
-    ) else {
-        release_registry_offer_quota_operation(
-            &state,
-            &principal.principal_id,
-            &quota_operation_id,
-            &quota_lease_owner_id,
-        )
-        .await;
-        return evidence_error_response(EvidenceError::EvaluationNotFound);
-    };
-    let reservation_result = tokio::time::timeout(
-        final_reservation_timeout,
-        preauth
-            .preauthorization_state()
-            .reserve_registry_client_offer_fenced(reservation, &quota_operation_fence),
-    )
-    .await;
-    let (response, audit_decision) = match reservation_result {
-        Ok(Ok(RegistryClientOfferReservationOutcome::Created(response))) => {
-            state
-                .metrics
-                .record_credential("openid4vci_registry_offer", "created");
-            (response, "registry_offer_created")
-        }
-        Ok(Ok(RegistryClientOfferReservationOutcome::Replayed(response))) => {
-            state
-                .metrics
-                .record_credential("openid4vci_registry_offer", "replayed");
-            (response, "registry_offer_replayed")
-        }
-        Ok(Err(PreauthorizationStateError::IdempotencyConflict))
-        | Ok(Err(PreauthorizationStateError::EvaluationConsumed)) => {
-            release_registry_offer_quota_operation(
-                &state,
-                &principal.principal_id,
-                &quota_operation_id,
-                &quota_lease_owner_id,
-            )
-            .await;
-            return registry_offer_problem(StatusCode::CONFLICT, "offer_conflict");
-        }
-        Ok(Err(PreauthorizationStateError::IssuanceTransactionCapacity)) => {
-            release_registry_offer_quota_operation(
-                &state,
-                &principal.principal_id,
-                &quota_operation_id,
-                &quota_lease_owner_id,
-            )
-            .await;
-            return registry_offer_problem(StatusCode::TOO_MANY_REQUESTS, "offer_rate_limited");
-        }
-        Ok(Err(PreauthorizationStateError::MachineQuotaExceeded {
-            retry_after_seconds,
-        })) => {
-            release_registry_offer_quota_operation(
-                &state,
-                &principal.principal_id,
-                &quota_operation_id,
-                &quota_lease_owner_id,
-            )
-            .await;
-            return evidence_error_response(EvidenceError::MachineQuotaExceeded {
-                retry_after_seconds,
-            });
-        }
-        Ok(Err(_)) => {
-            release_registry_offer_quota_operation(
-                &state,
-                &principal.principal_id,
-                &quota_operation_id,
-                &quota_lease_owner_id,
-            )
-            .await;
-            return registry_offer_problem(StatusCode::SERVICE_UNAVAILABLE, "offer_unavailable");
-        }
-        Err(_) => {
-            // Do not release early: the dropped PostgreSQL request is poisoned
-            // and canceled, but retaining the renewed lease until its bounded
-            // expiry prevents a contender from signing while cancellation is
-            // still propagating. A later request may take over safely.
-            return registry_offer_problem(StatusCode::SERVICE_UNAVAILABLE, "offer_unavailable");
-        }
-    };
-    registry_client_offer_success_response(
-        response,
-        &state.subject_access_rate_keys,
-        audit_decision,
-        &audit_evaluation_id,
-        &evaluation,
-        configuration_id,
-        profile_id,
-        &profile.holder_binding.mode,
-        target_ref,
-    )
-}
-
-/// Match authorization's exact claim-set semantics: order carries no
-/// authority, while multiplicity and version do. Every other signed field
-/// remains unchanged in the request identity.
-fn canonical_registry_offer_authorization_details(
-    details: &registry_notary_core::EvidenceAuthorizationDetails,
-) -> registry_notary_core::EvidenceAuthorizationDetails {
-    let mut canonical = details.clone();
-    canonical.claims.sort_by(|left, right| {
-        left.id
-            .cmp(&right.id)
-            .then_with(|| left.version.cmp(&right.version))
-    });
-    canonical
-}
-
-pub(in crate::api) fn same_target_ref(left: &TargetRefView, right: &TargetRefView) -> bool {
-    left.entity_type == right.entity_type
-        && left.handle == right.handle
-        && left.identifier_schemes == right.identifier_schemes
-        && left.profile == right.profile
-}
-
-async fn release_registry_offer_quota_operation(
-    state: &RegistryNotaryApiState,
-    principal_id: &str,
-    operation_id: &str,
-    lease_owner_id: &str,
-) {
-    let _ = state
-        .machine_quota_limiter
-        .release_operation(principal_id, operation_id, lease_owner_id)
-        .await;
-}
-
-fn registry_offer_completion_timeout(
-    code_expires_at: OffsetDateTime,
-    maximum: std::time::Duration,
-) -> Option<std::time::Duration> {
-    std::time::Duration::try_from(code_expires_at - OffsetDateTime::now_utc())
-        .ok()
-        .filter(|remaining| !remaining.is_zero())
-        .map(|remaining| remaining.min(maximum))
-}
-
-pub(in crate::api) fn registry_offer_problem(status: StatusCode, code: &'static str) -> Response {
-    let request_id = crate::standalone::current_request_correlation_id();
-    let mut body = json!({
-        "type": format!("{}/{}", crate::PROBLEM_TYPE_BASE_URL, code.replace('_', "/")),
-        "title": "Credential offer was not created",
-        "status": status.as_u16(),
-        "detail": "the registrar-initiated credential offer could not be created",
-        "code": code,
-    });
-    if let Some(request_id) = request_id.as_ref() {
-        body["request_id"] = json!(request_id.as_str());
-    }
-    let mut response = (status, Json(body)).into_response();
-    response.headers_mut().insert(
-        header::CONTENT_TYPE,
-        HeaderValue::from_static("application/problem+json"),
-    );
-    if status == StatusCode::SERVICE_UNAVAILABLE {
-        response.headers_mut().insert(
-            header::RETRY_AFTER,
-            HeaderValue::from_static(REGISTRY_OFFER_OPERATION_RETRY_AFTER_SECONDS),
-        );
-    }
-    response
-        .extensions_mut()
-        .insert(EvidenceErrorCodeContext(code.to_string()));
-    if let Some(request_id) = request_id {
-        if let Ok(value) = HeaderValue::from_str(request_id.as_str()) {
-            response.headers_mut().insert("x-request-id", value);
-        }
-    }
-    response
-}
-
-#[allow(clippy::too_many_arguments)]
-fn registry_client_offer_success_response(
-    response: RegistryClientOfferResponse,
-    keys: &SubjectAccessRateLimitKeys,
-    audit_decision: &str,
-    evaluation_id: &str,
-    evaluation: &registry_notary_core::StoredEvaluation,
-    configuration_id: &str,
-    profile_id: &str,
-    holder_binding_mode: &str,
-    target_ref: &TargetRefView,
-) -> Response {
-    let response_is_fresh = OffsetDateTime::parse(&response.expires_at, &Rfc3339)
-        .is_ok_and(|expires_at| expires_at > OffsetDateTime::now_utc());
-    if !response_is_fresh {
-        return evidence_error_response(EvidenceError::EvaluationNotFound);
-    }
-    let mut response = Json(response).into_response();
-    if let Err(error) = attach_registry_client_offer_audit(
-        &mut response,
-        keys,
-        audit_decision,
-        evaluation_id,
-        evaluation,
-        configuration_id,
-        profile_id,
-        holder_binding_mode,
-        target_ref,
-    ) {
-        return evidence_error_response(error);
-    }
-    response
-}
-
-/// `GET /oid4vci/offer/start` (public): begin the eSignet authorization-code
-/// login as the confidential RP and redirect the citizen browser to eSignet.
-///
-/// Mints no code or credential material. Only a short-lived single-use login
-/// state (PKCE verifier + nonce + selection) is reserved.
-pub(in crate::api) async fn oid4vci_offer_start(
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    Query(query): Query<Oid4vciOfferStartQuery>,
-) -> Response {
-    let Some(Extension(state)) = state else {
-        return StatusCode::NOT_FOUND.into_response();
-    };
-    let Some(preauth) = preauth_runtime(&state) else {
-        return StatusCode::NOT_FOUND.into_response();
-    };
-    let configuration_id = match query
-        .credential_configuration_id
-        .as_deref()
-        .map(|id| oid4vci_validated_configuration_id(&state.oid4vci, id))
-        .transpose()
-    {
-        Ok(Some(id)) => id,
-        Ok(None) => match single_credential_configuration_id(&state.oid4vci) {
-            Some(id) => id,
-            None => return oid4vci_error_response(Oid4vciWireError::InvalidRequest),
-        },
-        Err(()) => return oid4vci_error_response(Oid4vciWireError::InvalidRequest),
-    };
-    let (Ok(login_state), Ok(nonce), Ok(pkce_verifier)) = (
-        generate_opaque_token(),
-        generate_opaque_token(),
-        generate_opaque_token(),
-    ) else {
-        return oid4vci_error_response(Oid4vciWireError::ServerError);
-    };
-    let pkce_challenge = pkce_s256_challenge(&pkce_verifier);
-    let reserved = preauth
-        .preauthorization_state()
-        .reserve_login(
-            &login_state,
-            LoginState {
-                pkce_verifier,
-                nonce: nonce.clone(),
-                credential_configuration_id: configuration_id,
-                representative: None,
-                csrf_token: None,
-            },
-            preauth.login_state_ttl_seconds(),
-        )
-        .await;
-    if let Err(error) = reserved {
-        return match error {
-            PreauthorizationStateError::LoginStateCapacity => {
-                oid4vci_error_response(Oid4vciWireError::RateLimited)
-            }
-            PreauthorizationStateError::DuplicateLoginState
-            | PreauthorizationStateError::DuplicateIssuanceTransaction
-            | PreauthorizationStateError::IssuanceTransactionCapacity
-            | PreauthorizationStateError::IdempotencyConflict
-            | PreauthorizationStateError::EvaluationConsumed
-            | PreauthorizationStateError::MachineQuotaExceeded { .. }
-            | PreauthorizationStateError::OperationLeaseLost
-            | PreauthorizationStateError::Unavailable
-            | PreauthorizationStateError::IncompatibleTransactionCodeProof
-            | PreauthorizationStateError::InvalidExpiry
-            | PreauthorizationStateError::SensitiveState(_) => {
-                oid4vci_error_response(Oid4vciWireError::ServerError)
-            }
-        };
-    }
-    let redirect_url = match preauth.authorize_redirect_url(&login_state, &nonce, &pkce_challenge) {
-        Ok(url) => url,
-        Err(_) => return oid4vci_error_response(Oid4vciWireError::ServerError),
-    };
-    Redirect::to(&redirect_url).into_response()
-}
-
-#[derive(Debug, Deserialize)]
-pub(in crate::api) struct Oid4vciOfferCallbackQuery {
-    pub(in crate::api) code: Option<String>,
-    pub(in crate::api) state: Option<String>,
-}
-
-pub(in crate::api) async fn prepare_registry_backed_issuance_transaction(
-    state: &RegistryNotaryApiState,
-    preauth: &PreAuthRuntime,
-    bound_subject: &BoundSubject,
-    configuration_id: &str,
-    transaction_id: &str,
-    representative_target: Option<&str>,
-) -> Result<IssuanceTransaction, EvidenceError> {
-    let evidence = state.enabled_evidence()?;
-    let (configuration_id, configuration) = state
-        .oid4vci
-        .credential_configurations
-        .get_key_value(configuration_id)
-        .ok_or(EvidenceError::InvalidRequest)?;
-    let configuration_claim_ids = configuration.credential_claim_ids();
-    require_registry_backed_credential_claims(evidence, &configuration_claim_ids)?;
-    let target_subject_type = configuration_claim_ids
-        .first()
-        .and_then(|claim_id| crate::find_claim(evidence, claim_id).ok())
-        .map(|claim| claim.subject_type.as_str())
-        .ok_or(EvidenceError::InvalidRequest)?;
-    let mut principal = preauth.principal_for_subject(bound_subject)?;
-    add_scope_if_missing(&mut principal.scopes, &configuration.scope);
-    let mut principal = classify_subject_access_principal(&state.subject_access, &principal)?;
-    if !principal.is_subject_access() {
-        return Err(EvidenceError::SubjectAccessInvalidToken);
-    }
-    let mut request = if let Some(representative) = configuration.representative_issuance.as_ref() {
-        let target = representative_target.ok_or(EvidenceError::InvalidRequest)?;
-        if target.trim().is_empty() || target.len() > 256 || target.trim() != target {
-            return Err(EvidenceError::InvalidRequest);
-        }
-        let relationship = state
-            .subject_access
-            .delegation
-            .relationship(&representative.relationship)
-            .ok_or(EvidenceError::InvalidRequest)?;
-        principal.authorization_details =
-            Some(oid4vci_representative_issuance_authorization_details(
-                evidence,
-                &state.subject_access,
-                configuration,
-                relationship,
-                target,
-            )?);
-        principal.access_mode = AccessMode::DelegatedSubjectAccess;
-        let mut request = EvaluateRequest {
-            requester: None,
-            target: Some(EvidenceEntity::from_subject_request(
-                target_subject_type,
-                SubjectRequest {
-                    id: target.to_string(),
-                    id_type: Some(
-                        delegated_target_id_type(&state.subject_access, relationship).to_string(),
-                    ),
-                },
-            )),
-            relationship: None,
-            on_behalf_of: None,
-            variables: Default::default(),
-            claims: configuration_claim_ids
-                .iter()
-                .map(|claim_id| ClaimRef::from(claim_id.as_str()))
-                .collect(),
-            disclosure: None,
-            format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-            purpose: None,
-        };
-        derive_delegated_subject_access_request_context(
-            &state.subject_access,
-            evidence,
-            &state.subject_access_rate_keys,
-            &principal,
-            &mut request,
-        )?;
-        request
-    } else {
-        if representative_target.is_some()
-            || requested_subject_access_mode(&principal) == AccessMode::DelegatedSubjectAccess
-        {
-            return Err(EvidenceError::SubjectAccessInvalidToken);
-        }
-        let target = EvidenceEntity::from_subject_request(
-            "Person",
-            oid4vci_bound_subject(&state.subject_access, &principal)?,
-        );
-        EvaluateRequest {
-            requester: Some(target.clone()),
-            target: Some(target),
-            relationship: Some(EvidenceRelationship {
-                relationship_type: "self".to_string(),
-                attributes: Default::default(),
-            }),
-            on_behalf_of: None,
-            variables: Default::default(),
-            claims: configuration_claim_ids
-                .iter()
-                .map(|claim_id| ClaimRef::from(claim_id.as_str()))
-                .collect(),
-            disclosure: None,
-            format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-            purpose: None,
-        }
-    };
-    let context =
-        prepare_subject_access_credential_evaluation(state, evidence, &principal, &request)?;
-    request.purpose = Some(context.purpose.clone());
-    let results = state
-        .runtime()
-        .evaluate_with_capability(
-            Arc::clone(&state.evidence),
-            &state.store,
-            &principal,
-            context.evaluation_capability,
-            request,
-            None,
-            Some(context.metadata),
-            None,
-        )
-        .await?;
-    let evaluation_id = results
-        .first()
-        .map(|result| result.evaluation_id.clone())
-        .filter(|id| !id.is_empty())
-        .ok_or(EvidenceError::CredentialIssuanceFailed)?;
-    let evaluation_client_id = stored_evaluation_client_id(state, &principal)?;
-    let evaluation = state
-        .store
-        .get(&evaluation_id, &evaluation_client_id)
-        .await?
-        .ok_or(EvidenceError::EvaluationNotFound)?;
-    require_subject_access_stored_access(
-        state,
-        evidence,
-        &principal,
-        &evaluation,
-        &evaluation.claim_ids,
-        &evaluation.disclosure,
-        &evaluation.format,
-        true,
-    )?;
-    if !state.subject_access.allowed_operations.issue_credential {
-        return Err(EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::OperationDenied,
-        });
-    }
-    let profile = evidence
-        .credential_profiles
-        .get(&configuration.credential_profile)
-        .ok_or(EvidenceError::ProfileUnsupported)?;
-    require_subject_access_credential_profile_policy(
-        &state.subject_access,
-        &configuration.credential_profile,
-        profile,
-    )?;
-    require_issuable_evaluation_provenance(evidence, &evaluation_id, &evaluation)?;
-    let configuration_fingerprint =
-        oid4vci_configuration_fingerprint(evidence, configuration_id, configuration)?;
-    let commitment = oid4vci_issuance_transaction_commitment(
-        transaction_id,
-        Oid4vciIssuanceCommitmentContext {
-            evidence,
-            subject_access_config: &state.subject_access,
-            configuration_id,
-            configuration,
-            configuration_fingerprint: &configuration_fingerprint,
-        },
-        &evaluation_id,
-        &evaluation,
-    )?;
-    Ok(IssuanceTransaction {
-        transaction_id: transaction_id.to_string(),
-        evaluation_id,
-        evaluation_client_id,
-        credential_configuration_id: configuration_id.clone(),
-        commitment,
-        authority: crate::preauth_state::IssuanceAuthority::SubjectAccess,
-    })
-}
-
-pub(in crate::api) fn oid4vci_configuration_fingerprint(
-    evidence: &EvidenceConfig,
-    configuration_id: &str,
-    configuration: &Oid4vciCredentialConfigurationConfig,
-) -> Result<String, EvidenceError> {
-    let profile = evidence
-        .credential_profiles
-        .get(&configuration.credential_profile)
-        .ok_or(EvidenceError::ProfileUnsupported)?;
-    let signing_key = evidence
-        .signing_keys
-        .get(&profile.signing_key)
-        .ok_or(EvidenceError::CredentialIssuerNotConfigured)?;
-    let mut normalized = BTreeMap::new();
-    normalized.insert("schema_version", json!("registry-notary-oid4vci-config/v1"));
-    normalized.insert("service_id", json!(evidence.service_id));
-    normalized.insert("credential_configuration_id", json!(configuration_id));
-    normalized.insert(
-        "credential_configuration",
-        serde_json::to_value(configuration).map_err(|_| EvidenceError::InvalidRequest)?,
-    );
-    let claim_definitions = configuration
-        .credential_claim_ids()
-        .into_iter()
-        .map(|claim_id| {
-            let definition = evidence
-                .claims
-                .iter()
-                .find(|claim| claim.id == claim_id)
-                .ok_or(EvidenceError::InvalidRequest)?;
-            serde_json::to_value(definition)
-                .map(|definition| (claim_id, definition))
-                .map_err(|_| EvidenceError::InvalidRequest)
-        })
-        .collect::<Result<BTreeMap<_, _>, _>>()?;
-    normalized.insert("claim_definitions", json!(claim_definitions));
-    normalized.insert(
-        "credential_profile",
-        json!({
-            "id": configuration.credential_profile,
-            "format": profile.format,
-            "issuer": profile.issuer,
-            "signing_key": profile.signing_key,
-            "vct": profile.vct,
-            "validity_seconds": profile.validity_seconds,
-            "holder_binding": profile.holder_binding,
-            "allowed_claims": profile.allowed_claims,
-            "disclosure": profile.disclosure,
-        }),
-    );
-    normalized.insert(
-        "signing_key",
-        json!({
-            "id": profile.signing_key,
-            "provider": signing_key.provider,
-            "alg": signing_key.alg,
-            "kid": signing_key.kid,
-            "status": signing_key.status,
-            "publish_until_unix_seconds": signing_key.publish_until_unix_seconds,
-        }),
-    );
-    sha256_canonical_json(
-        &serde_json::to_value(normalized).map_err(|_| EvidenceError::InvalidRequest)?,
-    )
-}
-
-pub(in crate::api) struct Oid4vciIssuanceCommitmentContext<'a> {
-    pub(in crate::api) evidence: &'a EvidenceConfig,
-    pub(in crate::api) subject_access_config: &'a SubjectAccessConfig,
-    pub(in crate::api) configuration_id: &'a str,
-    pub(in crate::api) configuration: &'a Oid4vciCredentialConfigurationConfig,
-    pub(in crate::api) configuration_fingerprint: &'a str,
-}
-
-pub(in crate::api) fn oid4vci_issuance_transaction_commitment(
-    transaction_id: &str,
-    context: Oid4vciIssuanceCommitmentContext<'_>,
-    evaluation_id: &str,
-    evaluation: &registry_notary_core::StoredEvaluation,
-) -> Result<String, EvidenceError> {
-    let Oid4vciIssuanceCommitmentContext {
-        evidence,
-        subject_access_config,
-        configuration_id,
-        configuration,
-        configuration_fingerprint,
-    } = context;
-    let subject_access = evaluation
-        .subject_access
-        .as_ref()
-        .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-    let provenance = evaluation
-        .issuance_provenance
-        .as_ref()
-        .ok_or(EvidenceError::CredentialIssuanceFailed)?;
-    if !subject_access
-        .principal_hash
-        .as_str()
-        .starts_with("hmac-sha256:")
-        || !subject_access
-            .subject_binding_hash
-            .as_str()
-            .starts_with("hmac-sha256:")
-    {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    let mut normalized = BTreeMap::new();
-    normalized.insert(
-        "schema_version",
-        json!("registry-notary-oid4vci-issuance-transaction/v1"),
-    );
-    normalized.insert("transaction_id", json!(transaction_id));
-    normalized.insert(
-        "authenticated_principal_hash",
-        json!(subject_access.principal_hash),
-    );
-    normalized.insert(
-        "authenticated_subject_binding_hash",
-        json!(subject_access.subject_binding_hash),
-    );
-    normalized.insert("authenticated_issuer", json!(subject_access.issuer));
-    normalized.insert("authenticated_client", json!(subject_access.client_id));
-    normalized.insert(
-        "subject_access_binding",
-        serde_json::to_value(subject_access).map_err(|_| EvidenceError::InvalidRequest)?,
-    );
-    let delegated_proof_max_age_seconds =
-        if let Some(representative) = configuration.representative_issuance.as_ref() {
-            let relationship = subject_access_config
-                .delegation
-                .relationship(&representative.relationship)
-                .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-            if subject_access
-                .relationship_type
-                .as_ref()
-                .is_none_or(|stored| stored.as_str() != relationship.relationship_type)
-                || subject_access
-                    .proof_claim_id
-                    .as_ref()
-                    .is_none_or(|stored| stored.as_str() != relationship.proof_claim)
-            {
-                return Err(EvidenceError::EvaluationBindingMismatch);
-            }
-            Some(relationship.max_proof_age_seconds)
-        } else {
-            None
-        };
-    normalized.insert(
-        "delegated_proof_max_age_seconds",
-        json!(delegated_proof_max_age_seconds),
-    );
-    normalized.insert("service", json!(evidence.service_id));
-    normalized.insert("purpose", json!(evaluation.purpose));
-    normalized.insert("disclosure", json!(evaluation.disclosure));
-    normalized.insert("format", json!(evaluation.format));
-    normalized.insert("evaluation_created_at", json!(evaluation.created_at));
-    normalized.insert("evaluation_expires_at", json!(evaluation.expires_at));
-    normalized.insert("evaluation_request_hash", json!(evaluation.request_hash));
-    normalized.insert(
-        "result_target_refs",
-        json!(evaluation
-            .results
-            .iter()
-            .map(|result| &result.target_ref)
-            .collect::<Vec<_>>()),
-    );
-    normalized.insert(
-        "canonical_claim_references",
-        json!(evaluation.selected_claim_refs()),
-    );
-    normalized.insert("credential_configuration_id", json!(configuration_id));
-    normalized.insert(
-        "credential_profile",
-        json!(configuration.credential_profile),
-    );
-    normalized.insert(
-        "configuration_fingerprint",
-        json!(configuration_fingerprint),
-    );
-    normalized.insert(
-        "relay_contract_and_provenance",
-        serde_json::to_value(provenance).map_err(|_| EvidenceError::InvalidRequest)?,
-    );
-    normalized.insert("stored_evaluation_id", json!(evaluation_id));
-    sha256_canonical_json(
-        &serde_json::to_value(normalized).map_err(|_| EvidenceError::InvalidRequest)?,
-    )
-}
-
-#[allow(clippy::too_many_arguments)]
-pub(in crate::api) fn oid4vci_registry_client_transaction_commitment(
-    transaction_id: &str,
-    evidence: &EvidenceConfig,
-    configuration_id: &str,
-    configuration: &Oid4vciCredentialConfigurationConfig,
-    configuration_fingerprint: &str,
-    evaluation_id: &str,
-    evaluation: &registry_notary_core::StoredEvaluation,
-    initiating_client_id_hash: &str,
-    auth_profile_id: registry_notary_core::EvidenceAuthProfileId,
-    authorized_scopes: &[String],
-    target_ref: &TargetRefView,
-) -> Result<String, EvidenceError> {
-    if evaluation.subject_access.is_some()
-        || evaluation.client_id.is_empty()
-        || !initiating_client_id_hash.starts_with("hmac-sha256:")
-        || evaluation.results.is_empty()
-        || evaluation
-            .results
-            .iter()
-            .any(|result| !same_target_ref(&result.target_ref, target_ref))
-    {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    let provenance = evaluation
-        .issuance_provenance
-        .as_ref()
-        .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-    let issuance_material_binding = sha256_canonical_json(&json!({
-        "schema": "registry.notary.oid4vci-issuance-material/v1",
-        "evaluation_id": evaluation_id,
-        "purpose": evaluation.purpose,
-        "claim_references": evaluation.selected_claim_refs(),
-        "disclosure": evaluation.disclosure,
-        "format": evaluation.format,
-        "results": evaluation.results,
-        "created_at": evaluation.created_at,
-        "expires_at": evaluation.expires_at,
-        "request_hash": evaluation.request_hash,
-        "issuance_provenance": provenance,
-    }))?;
-    let mut authorized_scopes = authorized_scopes.to_vec();
-    authorized_scopes.sort();
-    authorized_scopes.dedup();
-    let mut normalized = BTreeMap::new();
-    normalized.insert(
-        "schema_version",
-        json!("registry-notary-oid4vci-registry-client-transaction/v1"),
-    );
-    normalized.insert("transaction_id", json!(transaction_id));
-    normalized.insert(
-        "initiating_client_id_hash",
-        json!(initiating_client_id_hash),
-    );
-    normalized.insert("auth_profile_id", json!(auth_profile_id));
-    normalized.insert("authorized_scopes", json!(authorized_scopes));
-    normalized.insert("target_ref", json!(target_ref));
-    normalized.insert("service", json!(evidence.service_id));
-    normalized.insert("purpose", json!(evaluation.purpose));
-    normalized.insert(
-        "canonical_claim_references",
-        json!(evaluation.selected_claim_refs()),
-    );
-    normalized.insert("credential_configuration_id", json!(configuration_id));
-    normalized.insert(
-        "credential_profile",
-        json!(configuration.credential_profile),
-    );
-    normalized.insert(
-        "configuration_fingerprint",
-        json!(configuration_fingerprint),
-    );
-    normalized.insert("stored_evaluation_id", json!(evaluation_id));
-    normalized.insert(
-        "issuance_material_binding",
-        json!(issuance_material_binding),
-    );
-    sha256_canonical_json(
-        &serde_json::to_value(normalized).map_err(|_| EvidenceError::InvalidRequest)?,
-    )
-}
-
-/// `GET /oid4vci/offer/callback` (public): consume the login state, exchange the
-/// eSignet code via `private_key_jwt`, validate the `id_token`, mint a single-use
-/// `pre-authorized_code`, and render the offer page.
-pub(in crate::api) async fn oid4vci_offer_callback(
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    Query(query): Query<Oid4vciOfferCallbackQuery>,
-) -> Response {
-    let Some(Extension(state)) = state else {
-        return StatusCode::NOT_FOUND.into_response();
-    };
-    let Some(preauth) = preauth_runtime(&state) else {
-        return StatusCode::NOT_FOUND.into_response();
-    };
-    let path = "/oid4vci/offer/callback";
-    let (Some(code), Some(login_state)) = (query.code.as_deref(), query.state.as_deref()) else {
-        return preauth_denied(
-            &preauth,
-            path,
-            "GET",
-            None,
-            SubjectAccessDenialCode::InvalidToken,
-            Oid4vciWireError::InvalidRequest,
-        )
-        .await;
-    };
-    // Single-use consume: unknown/expired/replayed state is the CSRF/replay
-    // guard. A missing state yields no code.
-    let stored = match preauth
-        .preauthorization_state()
-        .consume_login(login_state)
-        .await
-    {
-        Ok(Some(stored)) => stored,
-        Ok(None) => {
-            return preauth_denied(
-                &preauth,
-                path,
-                "GET",
-                None,
-                SubjectAccessDenialCode::InvalidToken,
-                Oid4vciWireError::InvalidRequest,
-            )
-            .await;
-        }
-        Err(_) => {
-            return preauth_denied(
-                &preauth,
-                path,
-                "GET",
-                None,
-                SubjectAccessDenialCode::OperationDenied,
-                Oid4vciWireError::ServerError,
-            )
-            .await;
-        }
-    };
-    // Login and representative-selection records share the encrypted,
-    // single-use store. Reject the selection shape before attempting any
-    // authorization-code exchange so the two state capabilities cannot be
-    // substituted for one another.
-    if stored.pkce_verifier.is_empty()
-        || stored.nonce.is_empty()
-        || stored.representative.is_some()
-        || stored.csrf_token.is_some()
-    {
-        return preauth_denied(
-            &preauth,
-            path,
-            "GET",
-            Some(&stored.credential_configuration_id),
-            SubjectAccessDenialCode::InvalidToken,
-            Oid4vciWireError::InvalidRequest,
-        )
-        .await;
-    }
-    let subject_binding_claim = state.subject_access.subject_binding.token_claim.clone();
-    let subject = match preauth
-        .exchange_code_for_subject(
-            code,
-            &stored.pkce_verifier,
-            &stored.nonce,
-            &subject_binding_claim,
-        )
-        .await
-    {
-        Ok(subject) => subject,
-        Err(_) => {
-            return preauth_denied(
-                &preauth,
-                path,
-                "GET",
-                Some(&stored.credential_configuration_id),
-                SubjectAccessDenialCode::InvalidToken,
-                Oid4vciWireError::InvalidToken,
-            )
-            .await;
-        }
-    };
-    let bound_subject = BoundSubject {
-        subject: subject.subject,
-        subject_binding_claim,
-        subject_binding_value: subject.subject_binding_value,
-        client_id: subject.client_id,
-        scopes: subject.scopes,
-        acr: subject.acr,
-        auth_time: subject.auth_time,
-    };
-    let representative_enabled = state
-        .oid4vci
-        .credential_configurations
-        .get(&stored.credential_configuration_id)
-        .is_some_and(|configuration| configuration.representative_issuance.is_some());
-    if representative_enabled {
-        let (Ok(selection_state), Ok(csrf_token)) =
-            (generate_opaque_token(), generate_opaque_token())
-        else {
-            return preauth_server_error_for_access_mode(
-                &preauth,
-                path,
-                "GET",
-                &stored.credential_configuration_id,
-                AccessMode::DelegatedSubjectAccess,
-            )
-            .await;
-        };
-        let selection = LoginState {
-            pkce_verifier: String::new(),
-            nonce: String::new(),
-            credential_configuration_id: stored.credential_configuration_id.clone(),
-            representative: Some(AuthenticatedRepresentative::from_bound_subject(
-                bound_subject,
-            )),
-            csrf_token: Some(csrf_token.clone()),
-        };
-        if preauth
-            .preauthorization_state()
-            .reserve_login(
-                &selection_state,
-                selection,
-                preauth.login_state_ttl_seconds(),
-            )
-            .await
-            .is_err()
-        {
-            return preauth_server_error_for_access_mode(
-                &preauth,
-                path,
-                "GET",
-                &stored.credential_configuration_id,
-                AccessMode::DelegatedSubjectAccess,
-            )
-            .await;
-        }
-        let audit = pre_auth_audit_event(
-            "GET",
-            path,
-            StatusCode::OK.as_u16(),
-            "representative_target_selection_started",
-            PreAuthAuditFields {
-                credential_configuration_id: ConfigMetadata::new(
-                    &stored.credential_configuration_id,
-                )
-                .ok(),
-                access_mode: Some(AccessMode::DelegatedSubjectAccess),
-                ..PreAuthAuditFields::default()
-            },
-        );
-        if preauth.emit_audit(&audit).await.is_err() {
-            return oid4vci_error_response(Oid4vciWireError::ServerError);
-        }
-        return no_store_html(representative_target_page_html(
-            &selection_state,
-            &csrf_token,
-        ));
-    }
-    complete_oid4vci_offer(
-        state,
-        preauth,
-        path,
-        "GET",
-        stored.credential_configuration_id.clone(),
-        bound_subject,
-        None,
-    )
-    .await
-}
-
-struct RepresentativeTargetSelection {
-    selection_state: String,
-    csrf_token: String,
-    target_id: String,
-}
-
-/// `POST /oid4vci/offer/representative` (public): consume the authenticated
-/// representative's single-use selection state and evaluate the configured
-/// relationship plus credential claim before minting a wallet offer.
-pub(in crate::api) async fn oid4vci_offer_representative(
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    connect_info: Option<Extension<axum::extract::ConnectInfo<SocketAddr>>>,
-    headers: HeaderMap,
-    body: Bytes,
-) -> Response {
-    let Some(Extension(state)) = state else {
-        return StatusCode::NOT_FOUND.into_response();
-    };
-    let Some(preauth) = preauth_runtime(&state) else {
-        return StatusCode::NOT_FOUND.into_response();
-    };
-    let path = "/oid4vci/offer/representative";
-    let client_address = token_client_address(&state, &headers, connect_info.as_deref());
-    if check_token_client_address_rate_limit(&state, &client_address)
-        .await
-        .is_err()
-    {
-        return preauth_denied_for_access_mode(
-            &preauth,
-            path,
-            "POST",
-            None,
-            SubjectAccessDenialCode::RateLimited,
-            Oid4vciWireError::RateLimited,
-            AccessMode::DelegatedSubjectAccess,
-        )
-        .await;
-    }
-    let selection = match parse_representative_target_selection(&headers, &body) {
-        Ok(selection) => selection,
-        Err(()) => {
-            return preauth_denied_after_invalid_client_attempt(
-                &state,
-                &preauth,
-                path,
-                &client_address,
-                None,
-                Oid4vciWireError::InvalidRequest,
-            )
-            .await;
-        }
-    };
-    let mut stored = match preauth
-        .preauthorization_state()
-        .consume_login(&selection.selection_state)
-        .await
-    {
-        Ok(Some(stored)) => stored,
-        Ok(None) => {
-            return preauth_denied_after_invalid_client_attempt(
-                &state,
-                &preauth,
-                path,
-                &client_address,
-                None,
-                Oid4vciWireError::InvalidRequest,
-            )
-            .await;
-        }
-        Err(_) => {
-            return preauth_denied_for_access_mode(
-                &preauth,
-                path,
-                "POST",
-                None,
-                SubjectAccessDenialCode::OperationDenied,
-                Oid4vciWireError::ServerError,
-                AccessMode::DelegatedSubjectAccess,
-            )
-            .await;
-        }
-    };
-    let Some(expected_csrf) = stored.csrf_token.take() else {
-        return preauth_denied_for_access_mode(
-            &preauth,
-            path,
-            "POST",
-            Some(&stored.credential_configuration_id),
-            SubjectAccessDenialCode::InvalidToken,
-            Oid4vciWireError::InvalidRequest,
-            AccessMode::DelegatedSubjectAccess,
-        )
-        .await;
-    };
-    if !stored.pkce_verifier.is_empty()
-        || !stored.nonce.is_empty()
-        || expected_csrf.len() != selection.csrf_token.len()
-        || !bool::from(
-            expected_csrf
-                .as_bytes()
-                .ct_eq(selection.csrf_token.as_bytes()),
-        )
-    {
-        return preauth_denied_for_access_mode(
-            &preauth,
-            path,
-            "POST",
-            Some(&stored.credential_configuration_id),
-            SubjectAccessDenialCode::InvalidToken,
-            Oid4vciWireError::InvalidRequest,
-            AccessMode::DelegatedSubjectAccess,
-        )
-        .await;
-    }
-    let representative_configuration = state
-        .oid4vci
-        .credential_configurations
-        .get(&stored.credential_configuration_id)
-        .is_some_and(|configuration| configuration.representative_issuance.is_some());
-    let Some(representative) = stored.representative.take() else {
-        return preauth_denied_for_access_mode(
-            &preauth,
-            path,
-            "POST",
-            Some(&stored.credential_configuration_id),
-            SubjectAccessDenialCode::InvalidToken,
-            Oid4vciWireError::InvalidRequest,
-            AccessMode::DelegatedSubjectAccess,
-        )
-        .await;
-    };
-    if !representative_configuration {
-        return preauth_denied_for_access_mode(
-            &preauth,
-            path,
-            "POST",
-            Some(&stored.credential_configuration_id),
-            SubjectAccessDenialCode::DelegatedRelationshipNotAllowed,
-            Oid4vciWireError::AccessDenied,
-            AccessMode::DelegatedSubjectAccess,
-        )
-        .await;
-    }
-    let bound_subject = representative.into_bound_subject();
-    let principal = match preauth.principal_for_subject(&bound_subject) {
-        Ok(principal) => principal,
-        Err(_) => {
-            return preauth_denied_for_access_mode(
-                &preauth,
-                path,
-                "POST",
-                Some(&stored.credential_configuration_id),
-                SubjectAccessDenialCode::InvalidToken,
-                Oid4vciWireError::InvalidToken,
-                AccessMode::DelegatedSubjectAccess,
-            )
-            .await;
-        }
-    };
-    let principal_hash = match state
-        .subject_access_rate_keys
-        .principal(&principal.principal_id)
-    {
-        Ok(hash) => hash,
-        Err(_) => {
-            return preauth_server_error_for_access_mode(
-                &preauth,
-                path,
-                "POST",
-                &stored.credential_configuration_id,
-                AccessMode::DelegatedSubjectAccess,
-            )
-            .await;
-        }
-    };
-    if state
-        .subject_access_rate_limiter
-        .check_authenticated_request(&principal_hash)
-        .await
-        .is_err()
-    {
-        return preauth_denied_for_access_mode(
-            &preauth,
-            path,
-            "POST",
-            Some(&stored.credential_configuration_id),
-            SubjectAccessDenialCode::RateLimited,
-            Oid4vciWireError::RateLimited,
-            AccessMode::DelegatedSubjectAccess,
-        )
-        .await;
-    }
-    complete_oid4vci_offer(
-        state,
-        preauth,
-        path,
-        "POST",
-        stored.credential_configuration_id.clone(),
-        bound_subject,
-        Some(selection.target_id),
-    )
-    .await
-}
-
-async fn complete_oid4vci_offer(
-    state: Arc<RegistryNotaryApiState>,
-    preauth: Arc<PreAuthRuntime>,
-    path: &str,
-    method: &str,
-    configuration_id: String,
-    bound_subject: BoundSubject,
-    representative_target: Option<String>,
-) -> Response {
-    let access_mode = if representative_target.is_some() {
-        AccessMode::DelegatedSubjectAccess
-    } else {
-        AccessMode::SubjectBound
-    };
-    let Ok(jti) = generate_opaque_token() else {
-        return preauth_server_error_for_access_mode(
-            &preauth,
-            path,
-            method,
-            &configuration_id,
-            access_mode,
-        )
-        .await;
-    };
-    // The registry-backed evaluation is completed before any offer is minted.
-    // A denied, unavailable, stale, malformed, or provenance-invalid Relay
-    // outcome therefore leaves the caller with no wallet grant at all.
-    let transaction = match prepare_registry_backed_issuance_transaction(
-        &state,
-        &preauth,
-        &bound_subject,
-        &configuration_id,
-        &jti,
-        representative_target.as_deref(),
-    )
-    .await
-    {
-        Ok(transaction) => transaction,
-        Err(error) => {
-            tracing::warn!(
-                code = error.audit_code(),
-                "registry-backed OID4VCI evaluation denied before offer minting"
-            );
-            return preauth_denied_for_access_mode(
-                &preauth,
-                path,
-                method,
-                Some(&configuration_id),
-                denial_code_from_error(&error).unwrap_or(SubjectAccessDenialCode::OperationDenied),
-                oid4vci_error_from_evidence(&error),
-                access_mode,
-            )
-            .await;
-        }
-    };
-    let evaluation = match state
-        .store
-        .get(
-            &transaction.evaluation_id,
-            &transaction.evaluation_client_id,
-        )
-        .await
-    {
-        Ok(Some(evaluation)) => evaluation,
-        _ => {
-            return preauth_server_error_for_access_mode(
-                &preauth,
-                path,
-                method,
-                &configuration_id,
-                access_mode,
-            )
-            .await;
-        }
-    };
-    // Relay evaluation can take long enough for a short-lived relationship
-    // proof to expire. Take the offer timestamp only after evaluation and
-    // storage complete so no already-expired wallet grant can be minted.
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let evaluation_expires_at = match evaluation
-        .subject_access
-        .as_ref()
-        .and_then(|metadata| metadata.evaluation_expires_at.as_deref())
-        .and_then(|expires_at| OffsetDateTime::parse(expires_at, &Rfc3339).ok())
-    {
-        Some(expires_at) if expires_at.unix_timestamp() > now => expires_at,
-        _ => {
-            return preauth_server_error_for_access_mode(
-                &preauth,
-                path,
-                method,
-                &configuration_id,
-                access_mode,
-            )
-            .await;
-        }
-    };
-    let token_subject = match wallet_token_subject(bound_subject, &evaluation, access_mode) {
-        Ok(subject) => subject,
-        Err(_) => {
-            return preauth_server_error_for_access_mode(
-                &preauth,
-                path,
-                method,
-                &configuration_id,
-                access_mode,
-            )
-            .await;
-        }
-    };
-    let code_exp = (now + preauth.pre_authorized_code_ttl_seconds() as i64)
-        .min(evaluation_expires_at.unix_timestamp());
-    let transaction_expires_at =
-        match OffsetDateTime::from_unix_timestamp(evaluation_expires_at.unix_timestamp()) {
-            Ok(expires_at) => expires_at,
-            Err(_) => {
-                return preauth_server_error_for_access_mode(
-                    &preauth,
-                    path,
-                    method,
-                    &configuration_id,
-                    access_mode,
-                )
-                .await;
-            }
-        };
-    if preauth
-        .preauthorization_state()
-        .reserve_issuance_transaction(&jti, transaction.clone(), transaction_expires_at)
-        .await
-        .is_err()
-    {
-        return preauth_server_error_for_access_mode(
-            &preauth,
-            path,
-            method,
-            &configuration_id,
-            access_mode,
-        )
-        .await;
-    };
-    let code_claims = PreAuthorizedCodeClaims {
-        issuer: preauth.notary_issuer().to_string(),
-        jti: jti.clone(),
-        credential_configuration_id: configuration_id.clone(),
-        issuance_transaction_id: jti.clone(),
-        issuance_transaction_commitment: transaction.commitment.clone(),
-        tx_code_required: preauth.tx_code_required(),
-        subject: token_subject,
-        iat: now,
-        exp: code_exp,
-    };
-    let signed_code = match mint_pre_authorized_code(
-        preauth.access_token_signer(),
-        PRE_AUTHORIZED_CODE_JWT_TYP,
-        &code_claims,
-    )
-    .await
-    {
-        Ok(signed) => signed,
-        Err(_) => {
-            return preauth_server_error_for_access_mode(
-                &preauth,
-                path,
-                method,
-                &configuration_id,
-                access_mode,
-            )
-            .await;
-        }
-    };
-    let tx_code_pin = if preauth.tx_code_required() {
-        let Ok(pin) = generate_numeric_tx_code(preauth.tx_code_length()) else {
-            return preauth_server_error_for_access_mode(
-                &preauth,
-                path,
-                method,
-                &configuration_id,
-                access_mode,
-            )
-            .await;
-        };
-        // Persist the PIN keyed by the code's jti so the token endpoint can verify
-        // the holder-presented tx_code. The PIN is never embedded in the offer code
-        // JWT (otherwise the code holder would know it).
-        let expires_at = match OffsetDateTime::from_unix_timestamp(code_claims.exp) {
-            Ok(expires_at) => expires_at,
-            Err(_) => {
-                return preauth_server_error_for_access_mode(
-                    &preauth,
-                    path,
-                    method,
-                    &configuration_id,
-                    access_mode,
-                )
-                .await;
-            }
-        };
-        if !matches!(
-            preauth
-                .preauthorization_state()
-                .reserve_transaction_code(&jti, &pin, preauth.tx_code_length(), expires_at,)
-                .await,
-            Ok(true)
-        ) {
-            return preauth_server_error_for_access_mode(
-                &preauth,
-                path,
-                method,
-                &configuration_id,
-                access_mode,
-            )
-            .await;
-        }
-        Some(pin)
-    } else {
-        None
-    };
-    let tx_code = tx_code_pin.as_ref().map(|_| {
-        TxCode::new(
-            preauth.tx_code_length(),
-            Some("Enter the PIN shown by the issuer".to_string()),
-        )
-    });
-    let offer = CredentialOffer::pre_authorized_code(
-        state.oid4vci.credential_issuer.clone(),
-        vec![configuration_id.clone()],
-        signed_code.compact.clone(),
-        tx_code,
-    );
-    let offer_uri = match offer_request_uri(&offer) {
-        Ok(uri) => uri,
-        Err(_) => {
-            return preauth_server_error_for_access_mode(
-                &preauth,
-                path,
-                method,
-                &configuration_id,
-                access_mode,
-            )
-            .await;
-        }
-    };
-    let audit = pre_auth_audit_event(
-        method,
-        path,
-        StatusCode::OK.as_u16(),
-        "preauth_offer_minted",
-        PreAuthAuditFields {
-            credential_configuration_id: registry_notary_core::ConfigMetadata::new(
-                &configuration_id,
-            )
-            .ok(),
-            access_mode: Some(access_mode),
-            ..PreAuthAuditFields::default()
-        },
-    );
-    if preauth.emit_audit(&audit).await.is_err() {
-        return oid4vci_error_response(Oid4vciWireError::ServerError);
-    }
-    state
-        .metrics
-        .record_credential("openid4vci_preauth", "offer_minted");
-    Html(offer_page_html(&offer_uri, tx_code_pin.as_deref())).into_response()
-}
-
-fn wallet_token_subject(
-    mut subject: BoundSubject,
-    evaluation: &registry_notary_core::StoredEvaluation,
-    access_mode: AccessMode,
-) -> Result<BoundSubject, EvidenceError> {
-    let metadata = evaluation
-        .subject_access
-        .as_ref()
-        .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-    if metadata.access_mode != access_mode {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    if access_mode == AccessMode::DelegatedSubjectAccess {
-        if !metadata.principal_hash.as_str().starts_with("hmac-sha256:")
-            || !metadata
-                .subject_binding_hash
-                .as_str()
-                .starts_with("hmac-sha256:")
-        {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-        // Relationship evaluation needs the representative's verified
-        // identifiers, but the wallet needs only opaque handles that bind its
-        // signed tokens back to the committed transaction.
-        subject.subject = metadata.principal_hash.as_str().to_string();
-        subject.subject_binding_value = metadata.subject_binding_hash.as_str().to_string();
-    }
-    Ok(subject)
-}
-
-/// `POST /oid4vci/token` (public): the OID4VCI token endpoint for the
-/// pre-authorized-code grant. Verifies the code and optional `tx_code`, then mints a
-/// short-TTL Notary access token + `c_nonce`.
-pub(in crate::api) async fn oid4vci_token(
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    connect_info: Option<Extension<axum::extract::ConnectInfo<SocketAddr>>>,
-    headers: HeaderMap,
-    body: Bytes,
-) -> Response {
-    let Some(Extension(state)) = state else {
-        return StatusCode::NOT_FOUND.into_response();
-    };
-    let Some(preauth) = preauth_runtime(&state) else {
-        return StatusCode::NOT_FOUND.into_response();
-    };
-    let path = "/oid4vci/token";
-    let client_address = token_client_address(&state, &headers, connect_info.as_deref());
-    let request = match parse_token_request(&headers, &body) {
-        Ok(request) => request,
-        Err(error) => {
-            return token_error_with_audit(
-                &preauth,
-                path,
-                None,
-                SubjectAccessDenialCode::OperationDenied,
-                error,
-            )
-            .await;
-        }
-    };
-    if request.grant_type != PRE_AUTHORIZED_CODE_GRANT_TYPE {
-        return token_error_with_audit(
-            &preauth,
-            path,
-            None,
-            SubjectAccessDenialCode::OperationDenied,
-            TokenWireError::UnsupportedGrantType,
-        )
-        .await;
-    }
-    let Some(code) = request
-        .pre_authorized_code
-        .as_deref()
-        .filter(|c| !c.is_empty())
-    else {
-        return token_error_with_audit(
-            &preauth,
-            path,
-            None,
-            SubjectAccessDenialCode::OperationDenied,
-            TokenWireError::InvalidRequest,
-        )
-        .await;
-    };
-    // Throttle random-code floods per client address (reuse the existing
-    // invalid-token-per-address limiter bucket).
-    if check_token_client_address_rate_limit(&state, &client_address)
-        .await
-        .is_err()
-    {
-        return token_error_with_audit(
-            &preauth,
-            path,
-            None,
-            SubjectAccessDenialCode::RateLimited,
-            TokenWireError::SlowDown,
-        )
-        .await;
-    }
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let verified = match preauth
-        .access_token_verification_keys()
-        .iter()
-        .filter(|key| key.may_verify_at(now))
-        .find_map(|key| {
-            verify_notary_token(
-                code,
-                key.public_jwk(),
-                PRE_AUTHORIZED_CODE_JWT_TYP,
-                preauth.notary_issuer(),
-                &[],
-                now,
-            )
-            .ok()
-        }) {
-        Some(verified) => verified,
-        None => {
-            return token_error_after_invalid_attempt(
-                &state,
-                &preauth,
-                path,
-                &client_address,
-                None,
-                TokenWireError::InvalidGrant,
-            )
-            .await;
-        }
-    };
-    let configuration_id = verified
-        .claim_str("credential_configuration_id")
-        .map(ToString::to_string);
-    let Some(jti) = verified.claim_str("jti").map(ToString::to_string) else {
-        return token_error_after_invalid_attempt(
-            &state,
-            &preauth,
-            path,
-            &client_address,
-            configuration_id.as_deref(),
-            TokenWireError::InvalidGrant,
-        )
-        .await;
-    };
-    let Some(code_expires_at) = verified
-        .claim_i64("exp")
-        .and_then(|expiry| OffsetDateTime::from_unix_timestamp(expiry).ok())
-    else {
-        return token_error_after_invalid_attempt(
-            &state,
-            &preauth,
-            path,
-            &client_address,
-            configuration_id.as_deref(),
-            TokenWireError::InvalidGrant,
-        )
-        .await;
-    };
-    let Some(tx_code_required) = verified
-        .payload
-        .get("tx_code_required")
-        .and_then(Value::as_bool)
-    else {
-        return token_error_after_invalid_attempt(
-            &state,
-            &preauth,
-            path,
-            &client_address,
-            configuration_id.as_deref(),
-            TokenWireError::InvalidGrant,
-        )
-        .await;
-    };
-    let Some(configuration_id) = configuration_id else {
-        return token_error_after_invalid_attempt(
-            &state,
-            &preauth,
-            path,
-            &client_address,
-            None,
-            TokenWireError::InvalidGrant,
-        )
-        .await;
-    };
-    let Some((configuration_id, configuration)) = state
-        .oid4vci
-        .credential_configurations
-        .get_key_value(&configuration_id)
-    else {
-        return token_error_after_invalid_attempt(
-            &state,
-            &preauth,
-            path,
-            &client_address,
-            Some(&configuration_id),
-            TokenWireError::InvalidGrant,
-        )
-        .await;
-    };
-    let Some(transaction_id) = verified.claim_str("issuance_transaction_id") else {
-        return token_error_after_invalid_attempt(
-            &state,
-            &preauth,
-            path,
-            &client_address,
-            Some(configuration_id),
-            TokenWireError::InvalidGrant,
-        )
-        .await;
-    };
-    let Some(transaction_commitment) = verified.claim_str("issuance_transaction_commitment") else {
-        return token_error_after_invalid_attempt(
-            &state,
-            &preauth,
-            path,
-            &client_address,
-            Some(configuration_id),
-            TokenWireError::InvalidGrant,
-        )
-        .await;
-    };
-    let live_transaction = match preauth
-        .preauthorization_state()
-        .transaction(transaction_id)
-        .await
-    {
-        Ok(Some(live))
-            if live.transaction.commitment == transaction_commitment
-                && live.transaction.credential_configuration_id == *configuration_id =>
-        {
-            Some(live)
-        }
-        _ => None,
-    };
-    let transaction_access_mode = live_transaction
-        .as_ref()
-        .map(|live| {
-            issuance_authority_access_mode(
-                &live.transaction.authority,
-                configuration.representative_issuance.is_some(),
-            )
-        })
-        .unwrap_or(AccessMode::SubjectBound);
-    // Enforce the signed code's PIN-attempt policy even when its transaction
-    // binding is absent or invalid. This prevents a forged transaction ID from
-    // bypassing the per-code brute-force guard.
-    if tx_code_required && check_tx_code_attempt(&state, code).await.is_err() {
-        return token_error_after_invalid_attempt_with_access_mode(
-            &state,
-            &preauth,
-            path,
-            &client_address,
-            Some(configuration_id),
-            transaction_access_mode,
-            TokenWireError::SlowDown,
-        )
-        .await;
-    }
-    if transaction_id != jti {
-        return token_error_after_invalid_attempt_with_access_mode(
-            &state,
-            &preauth,
-            path,
-            &client_address,
-            Some(configuration_id),
-            transaction_access_mode,
-            TokenWireError::InvalidGrant,
-        )
-        .await;
-    }
-    let Some(live_transaction) = live_transaction else {
-        return token_error_after_invalid_attempt_with_access_mode(
-            &state,
-            &preauth,
-            path,
-            &client_address,
-            Some(configuration_id),
-            transaction_access_mode,
-            TokenWireError::InvalidGrant,
-        )
-        .await;
-    };
-    let transaction_expires_at = live_transaction.expires_at;
-    let transaction = live_transaction.transaction;
-    let transaction_code = if tx_code_required {
-        let tx_code = request.tx_code.as_deref().unwrap_or("");
-        match preauth
-            .preauthorization_state()
-            .verify_transaction_code(&jti, tx_code)
-            .await
-        {
-            Ok(Some(proof)) => Some(proof),
-            Ok(None) => {
-                return token_error_after_invalid_attempt_with_access_mode(
-                    &state,
-                    &preauth,
-                    path,
-                    &client_address,
-                    Some(configuration_id),
-                    transaction_access_mode,
-                    TokenWireError::InvalidGrant,
-                )
-                .await;
-            }
-            Err(_) => {
-                return token_error_with_audit_access_mode(
-                    &preauth,
-                    path,
-                    Some(configuration_id),
-                    SubjectAccessDenialCode::OperationDenied,
-                    transaction_access_mode,
-                    TokenWireError::ServerError,
-                )
-                .await;
-            }
-        }
-    } else {
-        None
-    };
-    let Some(bound_subject) = bound_subject_from_code(&verified, &state) else {
-        return token_error_after_invalid_attempt_with_access_mode(
-            &state,
-            &preauth,
-            path,
-            &client_address,
-            Some(configuration_id),
-            transaction_access_mode,
-            TokenWireError::InvalidGrant,
-        )
-        .await;
-    };
-    let mut bound_subject = bound_subject;
-    add_scope_if_missing(&mut bound_subject.scopes, &configuration.scope);
-    let (authorization_detail, actor) = match &transaction.authority {
-        IssuanceAuthority::SubjectAccess => {
-            let detail =
-                if let Some(representative) = configuration.representative_issuance.as_ref() {
-                    let evaluation = match state
-                        .store
-                        .get(
-                            &transaction.evaluation_id,
-                            &transaction.evaluation_client_id,
-                        )
-                        .await
-                    {
-                        Ok(Some(evaluation)) => evaluation,
-                        _ => {
-                            return token_error_with_audit_access_mode(
-                                &preauth,
-                                path,
-                                Some(configuration_id),
-                                SubjectAccessDenialCode::OperationDenied,
-                                transaction_access_mode,
-                                TokenWireError::ServerError,
-                            )
-                            .await;
-                        }
-                    };
-                    (|| {
-                        let metadata = evaluation
-                            .subject_access
-                            .as_ref()
-                            .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-                        let relationship = state
-                            .subject_access
-                            .delegation
-                            .relationship(&representative.relationship)
-                            .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-                        if metadata.access_mode != AccessMode::DelegatedSubjectAccess
-                            || metadata
-                                .relationship_type
-                                .as_ref()
-                                .map(ConfigMetadata::as_str)
-                                != Some(relationship.relationship_type.as_str())
-                        {
-                            return Err(EvidenceError::EvaluationBindingMismatch);
-                        }
-                        let target_hash = metadata
-                            .dependent_target_hash
-                            .as_ref()
-                            .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-                        oid4vci_representative_issuance_authorization_details(
-                            &state.evidence,
-                            &state.subject_access,
-                            configuration,
-                            relationship,
-                            target_hash.as_str(),
-                        )
-                    })()
-                } else {
-                    oid4vci_issuance_authorization_details(
-                        &state.evidence,
-                        &state.subject_access,
-                        configuration,
-                    )
-                };
-            (detail, None)
-        }
-        IssuanceAuthority::RegistryClient {
-            initiating_client_id_hash,
-            auth_profile_id,
-            service_id,
-            purpose,
-            ..
-        } if service_id == &state.evidence.service_id
-            && initiating_client_id_hash.starts_with("hmac-sha256:") =>
-        {
-            (
-                Ok(oid4vci_registry_client_authorization_details(
-                    &state.evidence,
-                    configuration,
-                    purpose,
-                )),
-                Some(json!({
-                    "type": "registry_client",
-                    "client_id_hash": initiating_client_id_hash,
-                    "auth_profile_id": auth_profile_id,
-                })),
-            )
-        }
-        IssuanceAuthority::RegistryClient { .. } => {
-            return token_error_with_audit_access_mode(
-                &preauth,
-                path,
-                Some(configuration_id),
-                SubjectAccessDenialCode::OperationDenied,
-                transaction_access_mode,
-                TokenWireError::InvalidGrant,
-            )
-            .await;
-        }
-    };
-    let authorization_details = match authorization_detail.and_then(|details| {
-        serde_json::to_value(details).map_err(|_| EvidenceError::CredentialIssuanceFailed)
-    }) {
-        Ok(details) => vec![details],
-        Err(_) => {
-            return token_error_with_audit_access_mode(
-                &preauth,
-                path,
-                Some(configuration_id),
-                SubjectAccessDenialCode::OperationDenied,
-                transaction_access_mode,
-                TokenWireError::ServerError,
-            )
-            .await;
-        }
-    };
-    let replay_scope = match verified
-        .claim_str("iss")
-        .and_then(|issuer| pre_authorized_code_replay_scope(issuer).ok())
-    {
-        Some(scope) => scope,
-        None => {
-            return token_error_with_audit_access_mode(
-                &preauth,
-                path,
-                Some(configuration_id),
-                SubjectAccessDenialCode::OperationDenied,
-                transaction_access_mode,
-                TokenWireError::ServerError,
-            )
-            .await;
-        }
-    };
-    match preauth
-        .preauthorization_state()
-        .redeem(
-            &replay_scope,
-            &jti,
-            code_expires_at,
-            tx_code_required,
-            transaction_code,
-        )
-        .await
-    {
-        Ok(true) => {}
-        Ok(false) => {
-            return token_error_after_invalid_attempt_with_access_mode(
-                &state,
-                &preauth,
-                path,
-                &client_address,
-                Some(configuration_id),
-                transaction_access_mode,
-                TokenWireError::InvalidGrant,
-            )
-            .await;
-        }
-        Err(_) => {
-            return token_error_with_audit_access_mode(
-                &preauth,
-                path,
-                Some(configuration_id),
-                SubjectAccessDenialCode::OperationDenied,
-                transaction_access_mode,
-                TokenWireError::ServerError,
-            )
-            .await;
-        }
-    }
-    let configuration_id = configuration_id.as_str();
-    let c_nonce = match issue_c_nonce(&state, configuration_id).await {
-        Some(c_nonce) => c_nonce,
-        None => {
-            return token_error_with_audit_access_mode(
-                &preauth,
-                path,
-                Some(configuration_id),
-                SubjectAccessDenialCode::OperationDenied,
-                transaction_access_mode,
-                TokenWireError::ServerError,
-            )
-            .await;
-        }
-    };
-    if !matches!(
-        preauth
-            .preauthorization_state()
-            .bind_transaction_nonce(transaction_id, &transaction.commitment, c_nonce.clone(),)
-            .await,
-        Ok(true)
-    ) {
-        return token_error_with_audit_access_mode(
-            &preauth,
-            path,
-            Some(configuration_id),
-            SubjectAccessDenialCode::OperationDenied,
-            transaction_access_mode,
-            TokenWireError::ServerError,
-        )
-        .await;
-    }
-    // The code was valid when verified, but transaction lookup, replay
-    // redemption, and nonce persistence are asynchronous. Refresh the clock
-    // here so a short-lived proof can never produce an already-expired access
-    // token after those operations complete.
-    let access_token_now = OffsetDateTime::now_utc().unix_timestamp();
-    let Some((access_token_iat, access_token_exp)) = capped_access_token_window(
-        access_token_now,
-        preauth.access_token_ttl_seconds(),
-        Some(transaction_expires_at.unix_timestamp()),
-    ) else {
-        return token_error_with_audit(
-            &preauth,
-            path,
-            Some(configuration_id),
-            SubjectAccessDenialCode::InvalidToken,
-            TokenWireError::InvalidGrant,
-        )
-        .await;
-    };
-    let access_token_claims = AccessTokenClaims {
-        issuer: preauth.notary_issuer().to_string(),
-        jti: None,
-        audiences: preauth.notary_audiences().to_vec(),
-        token_type: "Bearer".to_string(),
-        credential_configuration_id: configuration_id.to_string(),
-        issuance_transaction_id: transaction_id.to_string(),
-        issuance_transaction_commitment: transaction.commitment.clone(),
-        subject: bound_subject,
-        authorization_details,
-        confirmation: None,
-        actor,
-        iat: access_token_iat,
-        exp: access_token_exp,
-    };
-    let access_token = match mint_access_token(
-        preauth.access_token_signer(),
-        preauth.access_token_typ(),
-        &access_token_claims,
-    )
-    .await
-    {
-        Ok(token) => token,
-        Err(_) => {
-            return token_error_with_audit_access_mode(
-                &preauth,
-                path,
-                Some(configuration_id),
-                SubjectAccessDenialCode::OperationDenied,
-                transaction_access_mode,
-                TokenWireError::ServerError,
-            )
-            .await;
-        }
-    };
-    let audit = pre_auth_audit_event(
-        "POST",
-        path,
-        StatusCode::OK.as_u16(),
-        "preauth_token_issued",
-        PreAuthAuditFields {
-            credential_configuration_id: registry_notary_core::ConfigMetadata::new(
-                configuration_id,
-            )
-            .ok(),
-            access_mode: Some(issuance_authority_access_mode(
-                &transaction.authority,
-                configuration.representative_issuance.is_some(),
-            )),
-            ..PreAuthAuditFields::default()
-        },
-    );
-    if preauth.emit_audit(&audit).await.is_err() {
-        return token_error_response(TokenWireError::ServerError);
-    }
-    state
-        .metrics
-        .record_credential("openid4vci_preauth", "token_issued");
-    Json(Oid4vciTokenResponse {
-        access_token: access_token.compact,
-        token_type: "Bearer".to_string(),
-        expires_in: Some(
-            access_token_claims
-                .exp
-                .saturating_sub(access_token_claims.iat)
-                .try_into()
-                .unwrap_or_default(),
-        ),
-        c_nonce: Some(c_nonce),
-        c_nonce_expires_in: state
-            .oid4vci
-            .nonce
-            .enabled
-            .then_some(state.oid4vci.nonce.ttl_seconds),
-    })
-    .into_response()
-}
-
-pub(in crate::api) const fn issuance_authority_access_mode(
-    authority: &IssuanceAuthority,
-    representative_issuance: bool,
-) -> AccessMode {
-    match authority {
-        IssuanceAuthority::SubjectAccess if representative_issuance => {
-            AccessMode::DelegatedSubjectAccess
-        }
-        IssuanceAuthority::SubjectAccess => AccessMode::SubjectBound,
-        IssuanceAuthority::RegistryClient { .. } => AccessMode::MachineClient,
-    }
-}
-
-/// The pre-auth runtime, present only when the flow is enabled and configured.
-pub(in crate::api) fn preauth_runtime(
-    state: &RegistryNotaryApiState,
-) -> Option<Arc<PreAuthRuntime>> {
-    if !state.oid4vci.enabled {
-        return None;
-    }
-    state.runtime_snapshot().preauth.clone()
-}
-
-/// Validate a requested `credential_configuration_id` against the configured
-/// set. Returns the canonical id, or `Err(())` if unknown.
-pub(in crate::api) fn oid4vci_validated_configuration_id(
-    config: &Oid4vciConfig,
-    requested: &str,
-) -> Result<String, ()> {
-    config
-        .credential_configurations
-        .get_key_value(requested)
-        .map(|(id, _)| id.clone())
-        .ok_or(())
-}
-
-/// The single configured credential configuration id, or `None` if zero or
-/// more than one are configured.
-pub(in crate::api) fn single_credential_configuration_id(config: &Oid4vciConfig) -> Option<String> {
-    let mut ids = config.credential_configurations.keys();
-    let first = ids.next()?;
-    if ids.next().is_some() {
-        return None;
-    }
-    Some(first.clone())
-}
-
-pub(in crate::api) fn pre_authorized_code_replay_scope(
-    verified_notary_issuer: &str,
-) -> Result<ReplayScope, ()> {
-    ReplayScope::new([
-        (
-            "protocol".to_string(),
-            "openid4vci-pre-authorized-code".to_string(),
-        ),
-        (
-            "notary_issuer".to_string(),
-            verified_notary_issuer.to_string(),
-        ),
-    ])
-    .map_err(|_| ())
-}
-
-/// Build the `openid-credential-offer://` request URI carrying the offer JSON.
-pub(in crate::api) fn offer_request_uri(offer: &CredentialOffer) -> Result<String, ()> {
-    let json = serde_json::to_string(offer).map_err(|_| ())?;
-    let encoded = url_percent_encode(&json);
-    Ok(format!(
-        "openid-credential-offer://?credential_offer={encoded}"
-    ))
-}
-
-/// Percent-encode a value for a query string (RFC 3986 unreserved set kept).
-pub(in crate::api) fn url_percent_encode(value: &str) -> String {
-    const HEX: &[u8; 16] = b"0123456789ABCDEF";
-    let mut out = String::with_capacity(value.len() * 3);
-    for byte in value.as_bytes() {
-        match byte {
-            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
-                out.push(*byte as char);
-            }
-            other => {
-                out.push('%');
-                out.push(HEX[(other >> 4) as usize] as char);
-                out.push(HEX[(other & 0x0F) as usize] as char);
-            }
-        }
-    }
-    out
-}
-
-fn parse_representative_target_selection(
-    headers: &HeaderMap,
-    body: &Bytes,
-) -> Result<RepresentativeTargetSelection, ()> {
-    const MAX_BODY_BYTES: usize = 4096;
-    let content_type = headers
-        .get(header::CONTENT_TYPE)
-        .and_then(|value| value.to_str().ok())
-        .unwrap_or("");
-    if content_type
-        .split(';')
-        .next()
-        .is_none_or(|value| value.trim() != "application/x-www-form-urlencoded")
-        || body.len() > MAX_BODY_BYTES
-    {
-        return Err(());
-    }
-    let raw = std::str::from_utf8(body).map_err(|_| ())?;
-    let mut selection_state = None;
-    let mut csrf_token = None;
-    let mut target_id = None;
-    for pair in raw.split('&').filter(|pair| !pair.is_empty()) {
-        let (key, value) = pair.split_once('=').unwrap_or((pair, ""));
-        let key = form_urldecode(key).map_err(|_| ())?;
-        let value = form_urldecode(value).map_err(|_| ())?;
-        let slot = match key.as_str() {
-            "selection_state" => &mut selection_state,
-            "csrf_token" => &mut csrf_token,
-            "target_id" => &mut target_id,
-            _ => return Err(()),
-        };
-        if slot.replace(value).is_some() {
-            return Err(());
-        }
-    }
-    let selection = RepresentativeTargetSelection {
-        selection_state: selection_state.ok_or(())?,
-        csrf_token: csrf_token.ok_or(())?,
-        target_id: target_id.ok_or(())?,
-    };
-    if selection.selection_state.is_empty()
-        || selection.csrf_token.is_empty()
-        || selection.target_id.is_empty()
-        || selection.target_id.len() > 256
-        || selection.target_id.trim() != selection.target_id
-    {
-        return Err(());
-    }
-    Ok(selection)
-}
-
-fn representative_target_page_html(selection_state: &str, csrf_token: &str) -> String {
-    let selection_state = html_escape(selection_state);
-    let csrf_token = html_escape(csrf_token);
-    format!(
-        "<!DOCTYPE html><html lang=\"en\"><head><meta charset=\"utf-8\">\
-<meta name=\"referrer\" content=\"no-referrer\"><title>Select credential subject</title></head>\
-<body><h1>Who is this credential for?</h1>\
-<p>Enter the identifier of the subject you are authorized to represent.</p>\
-<form method=\"post\" action=\"representative\">\
-<input type=\"hidden\" name=\"selection_state\" value=\"{selection_state}\">\
-<input type=\"hidden\" name=\"csrf_token\" value=\"{csrf_token}\">\
-<label for=\"target-id\">Subject identifier</label>\
-<input id=\"target-id\" name=\"target_id\" type=\"text\" maxlength=\"256\" required autocomplete=\"off\">\
-<button type=\"submit\">Verify relationship and continue</button>\
-</form></body></html>"
-    )
-}
-
-fn no_store_html(html: String) -> Response {
-    let mut response = Html(html).into_response();
-    let headers = response.headers_mut();
-    headers.insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
-    headers.insert(header::PRAGMA, HeaderValue::from_static("no-cache"));
-    headers.insert(
-        axum::http::HeaderName::from_static("referrer-policy"),
-        HeaderValue::from_static("no-referrer"),
-    );
-    headers.insert(
-        axum::http::HeaderName::from_static("content-security-policy"),
-        HeaderValue::from_static(
-            "default-src 'none'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
-        ),
-    );
-    headers.insert(
-        axum::http::HeaderName::from_static("x-content-type-options"),
-        HeaderValue::from_static("nosniff"),
-    );
-    response
-}
-
-/// Render the citizen-facing offer page: the QR-encodable offer URI plus an
-/// out-of-band PIN when the offer requires one.
-pub(in crate::api) fn offer_page_html(offer_uri: &str, pin: Option<&str>) -> String {
-    let offer_uri = html_escape(offer_uri);
-    let pin_html = pin.map(|pin| {
-        let pin = html_escape(pin);
-        format!(
-            "<p>Then enter this PIN when your wallet asks:</p>\
-<p><strong id=\"tx-code\">{pin}</strong></p>"
-        )
-    });
-    format!(
-        "<!DOCTYPE html><html lang=\"en\"><head><meta charset=\"utf-8\">\
-<title>Credential offer</title></head><body>\
-<h1>Scan to receive your credential</h1>\
-<p>Scan this offer in your wallet:</p>\
-<p><a id=\"credential-offer\" href=\"{offer_uri}\">{offer_uri}</a></p>\
-{}\
-</body></html>",
-        pin_html.unwrap_or_default()
-    )
-}
-
-pub(in crate::api) fn html_escape(value: &str) -> String {
-    let mut out = String::with_capacity(value.len());
-    for c in value.chars() {
-        match c {
-            '&' => out.push_str("&amp;"),
-            '<' => out.push_str("&lt;"),
-            '>' => out.push_str("&gt;"),
-            '"' => out.push_str("&quot;"),
-            '\'' => out.push_str("&#39;"),
-            _ => out.push(c),
-        }
-    }
-    out
-}
-
-/// Reconstruct the `BoundSubject` carried inside a verified pre-authorized code.
-pub(in crate::api) fn bound_subject_from_code(
-    verified: &registry_notary_core::tokens::VerifiedNotaryToken,
-    state: &RegistryNotaryApiState,
-) -> Option<BoundSubject> {
-    let subject_binding_claim = state.subject_access.subject_binding.token_claim.clone();
-    Some(BoundSubject {
-        subject: verified.claim_str("sub")?.to_string(),
-        subject_binding_value: verified.claim_str(&subject_binding_claim)?.to_string(),
-        subject_binding_claim,
-        client_id: verified.claim_str("client_id")?.to_string(),
-        scopes: verified.scopes(),
-        acr: verified.claim_str("acr").map(ToString::to_string),
-        auth_time: verified.claim_i64("auth_time"),
-    })
-}
-
-/// Issue a `c_nonce` for the credential endpoint, reserving it in the replay
-/// store exactly as the nonce endpoint does.
-pub(in crate::api) async fn issue_c_nonce(
-    state: &RegistryNotaryApiState,
-    configuration_id: &str,
-) -> Option<String> {
-    if !state.oid4vci.nonce.enabled {
-        // The credential endpoint requires a c_nonce; without the nonce
-        // endpoint enabled there is nothing to reserve, so the value is unused.
-        return generate_nonce().ok();
-    }
-    let nonce = generate_nonce().ok()?;
-    let key = state
-        .subject_access_rate_keys
-        .oid4vci_nonce(&state.oid4vci.credential_issuer, configuration_id, &nonce)
-        .ok()?;
-    let scope = oid4vci_nonce_replay_scope(state, configuration_id).ok()?;
-    let replay_key = ReplayKey::new(key).ok()?;
-    let expires_at =
-        OffsetDateTime::now_utc() + time::Duration::seconds(state.oid4vci.nonce.ttl_seconds as i64);
-    if state
-        .replay
-        .nonce_store()
-        .reserve_nonce(&scope, &replay_key, expires_at)
-        .await
-        .is_ok()
-    {
-        state.metrics.record_replay("oid4vci_nonce", "reserved");
-        Some(nonce)
-    } else {
-        None
-    }
-}
-
-/// Derive a per-client identifier for public endpoint flood throttles.
-///
-/// Forwarding headers are accepted only from explicitly trusted proxy peers.
-/// Otherwise the public OID4VCI endpoints use the socket peer so
-/// caller-controlled `X-Forwarded-*` headers cannot create fresh buckets.
-pub(in crate::api) fn token_client_address(
-    state: &RegistryNotaryApiState,
-    headers: &HeaderMap,
-    connect_info: Option<&axum::extract::ConnectInfo<SocketAddr>>,
-) -> String {
-    token_client_address_with_trusted_proxy_ips(
-        headers,
-        connect_info,
-        &state
-            .runtime_config()
-            .map(|config| config.server.trusted_proxy_ips.clone())
-            .unwrap_or_default(),
-    )
-}
-
-pub(in crate::api) fn token_client_address_with_trusted_proxy_ips(
-    headers: &HeaderMap,
-    connect_info: Option<&axum::extract::ConnectInfo<SocketAddr>>,
-    trusted_proxy_ips: &[IpAddr],
-) -> String {
-    let Some(axum::extract::ConnectInfo(addr)) = connect_info else {
-        return "unknown-client-address".to_string();
-    };
-    let peer_ip = addr.ip();
-    if trusted_proxy_ips.contains(&peer_ip) {
-        if let Some(forwarded_ip) = forwarded_client_ip(headers) {
-            return forwarded_ip.to_string();
-        }
-    }
-    peer_ip.to_string()
-}
-
-pub(in crate::api) fn forwarded_client_ip(headers: &HeaderMap) -> Option<IpAddr> {
-    headers
-        .get("x-forwarded-for")
-        .and_then(|value| value.to_str().ok())
-        .and_then(|value| {
-            value
-                .split(',')
-                .map(str::trim)
-                .find_map(|candidate| candidate.parse::<IpAddr>().ok())
-        })
-        .or_else(|| {
-            headers
-                .get("x-real-ip")
-                .and_then(|value| value.to_str().ok())
-                .and_then(|value| value.trim().parse::<IpAddr>().ok())
-        })
-}
-
-/// Per-client-address throttle so random-code floods are bounded. Reuses the
-/// existing invalid-token-per-address limiter bucket. This is a check-only gate
-/// (availability); the bucket is consumed only on an invalid attempt, matching
-/// the auth middleware's check-before / consume-after pattern.
-pub(in crate::api) async fn check_token_client_address_rate_limit(
-    state: &RegistryNotaryApiState,
-    client_address: &str,
-) -> Result<(), SubjectAccessRateLimitError> {
-    let hashed = state
-        .subject_access_rate_keys
-        .client_address(client_address)?;
-    state
-        .subject_access_rate_limiter
-        .check_invalid_token_for_client_address_available(&hashed)
-        .await
-}
-
-/// Record one `tx_code` attempt against the hashed pre-authorized code. After
-/// the configured cap the code is locked.
-pub(in crate::api) async fn check_tx_code_attempt(
-    state: &RegistryNotaryApiState,
-    pre_authorized_code: &str,
-) -> Result<(), SubjectAccessRateLimitError> {
-    let hashed = state
-        .subject_access_rate_keys
-        .pre_authorized_code(pre_authorized_code)?;
-    state
-        .subject_access_rate_limiter
-        .check_tx_code_attempt(&hashed)
-        .await
-}
-
-/// Emit a denial audit event for a public pre-auth endpoint and return the
-/// matching OID4VCI error response.
-pub(in crate::api) async fn preauth_denied(
-    preauth: &PreAuthRuntime,
-    path: &str,
-    method: &str,
-    credential_configuration_id: Option<&str>,
-    denial_code: SubjectAccessDenialCode,
-    wire_error: Oid4vciWireError,
-) -> Response {
-    preauth_denied_for_access_mode(
-        preauth,
-        path,
-        method,
-        credential_configuration_id,
-        denial_code,
-        wire_error,
-        AccessMode::SubjectBound,
-    )
-    .await
-}
-
-async fn preauth_denied_after_invalid_client_attempt(
-    state: &RegistryNotaryApiState,
-    preauth: &PreAuthRuntime,
-    path: &str,
-    client_address: &str,
-    credential_configuration_id: Option<&str>,
-    wire_error: Oid4vciWireError,
-) -> Response {
-    consume_invalid_client_address_attempt(state, client_address).await;
-    preauth_denied_for_access_mode(
-        preauth,
-        path,
-        "POST",
-        credential_configuration_id,
-        SubjectAccessDenialCode::InvalidToken,
-        wire_error,
-        AccessMode::DelegatedSubjectAccess,
-    )
-    .await
-}
-
-async fn preauth_denied_for_access_mode(
-    preauth: &PreAuthRuntime,
-    path: &str,
-    method: &str,
-    credential_configuration_id: Option<&str>,
-    denial_code: SubjectAccessDenialCode,
-    wire_error: Oid4vciWireError,
-    access_mode: AccessMode,
-) -> Response {
-    let response = oid4vci_error_response(wire_error);
-    let status = response.status().as_u16();
-    let audit = pre_auth_audit_event(
-        method,
-        path,
-        status,
-        "denied",
-        PreAuthAuditFields {
-            credential_configuration_id: credential_configuration_id
-                .and_then(|id| registry_notary_core::ConfigMetadata::new(id).ok()),
-            denial_code: Some(denial_code),
-            access_mode: Some(access_mode),
-            ..PreAuthAuditFields::default()
-        },
-    );
-    if preauth.emit_audit(&audit).await.is_err() {
-        return oid4vci_error_response(Oid4vciWireError::ServerError);
-    }
-    response
-}
-
-async fn preauth_server_error_for_access_mode(
-    preauth: &PreAuthRuntime,
-    path: &str,
-    method: &str,
-    credential_configuration_id: &str,
-    access_mode: AccessMode,
-) -> Response {
-    let audit = pre_auth_audit_event(
-        method,
-        path,
-        StatusCode::INTERNAL_SERVER_ERROR.as_u16(),
-        "denied",
-        PreAuthAuditFields {
-            credential_configuration_id: registry_notary_core::ConfigMetadata::new(
-                credential_configuration_id,
-            )
-            .ok(),
-            access_mode: Some(access_mode),
-            ..PreAuthAuditFields::default()
-        },
-    );
-    let _ = preauth.emit_audit(&audit).await;
-    oid4vci_error_response(Oid4vciWireError::ServerError)
-}
-
-/// Count an invalid token-endpoint attempt against the client address, emit a
-/// denial audit event, and return the OAuth error. The rate counter for the
-/// flood guard is consumed here so repeated random codes are throttled.
-pub(in crate::api) async fn token_error_after_invalid_attempt(
-    state: &RegistryNotaryApiState,
-    preauth: &PreAuthRuntime,
-    path: &str,
-    client_address: &str,
-    credential_configuration_id: Option<&str>,
-    error: TokenWireError,
-) -> Response {
-    token_error_after_invalid_attempt_with_access_mode(
-        state,
-        preauth,
-        path,
-        client_address,
-        credential_configuration_id,
-        AccessMode::SubjectBound,
-        error,
-    )
-    .await
-}
-
-async fn token_error_after_invalid_attempt_with_access_mode(
-    state: &RegistryNotaryApiState,
-    preauth: &PreAuthRuntime,
-    path: &str,
-    client_address: &str,
-    credential_configuration_id: Option<&str>,
-    access_mode: AccessMode,
-    error: TokenWireError,
-) -> Response {
-    consume_invalid_client_address_attempt(state, client_address).await;
-    token_error_with_audit_access_mode(
-        preauth,
-        path,
-        credential_configuration_id,
-        SubjectAccessDenialCode::InvalidToken,
-        access_mode,
-        error,
-    )
-    .await
-}
-
-async fn consume_invalid_client_address_attempt(
-    state: &RegistryNotaryApiState,
-    client_address: &str,
-) {
-    if let Ok(hashed) = state
-        .subject_access_rate_keys
-        .client_address(client_address)
-    {
-        let _ = state
-            .subject_access_rate_limiter
-            .check_invalid_token_for_client_address(&hashed)
-            .await;
-    }
-}
-
-pub(in crate::api) async fn token_error_with_audit(
-    preauth: &PreAuthRuntime,
-    path: &str,
-    credential_configuration_id: Option<&str>,
-    denial_code: SubjectAccessDenialCode,
-    error: TokenWireError,
-) -> Response {
-    token_error_with_audit_access_mode(
-        preauth,
-        path,
-        credential_configuration_id,
-        denial_code,
-        AccessMode::SubjectBound,
-        error,
-    )
-    .await
-}
-
-async fn token_error_with_audit_access_mode(
-    preauth: &PreAuthRuntime,
-    path: &str,
-    credential_configuration_id: Option<&str>,
-    denial_code: SubjectAccessDenialCode,
-    access_mode: AccessMode,
-    error: TokenWireError,
-) -> Response {
-    let response = token_error_response(error);
-    let audit = token_error_audit_event_with_access_mode(
-        path,
-        response.status().as_u16(),
-        credential_configuration_id,
-        denial_code,
-        access_mode,
-    );
-    if preauth.emit_audit(&audit).await.is_err() {
-        return token_error_after_audit_result(response, true);
-    }
-    token_error_after_audit_result(response, false)
-}
-
-pub(in crate::api) fn token_error_after_audit_result(
-    response: Response,
-    audit_failed: bool,
-) -> Response {
-    if audit_failed {
-        token_error_response(TokenWireError::ServerError)
-    } else {
-        response
-    }
-}
-
-pub(in crate::api) fn token_error_audit_event_with_access_mode(
-    path: &str,
-    status: u16,
-    credential_configuration_id: Option<&str>,
-    denial_code: SubjectAccessDenialCode,
-    access_mode: AccessMode,
-) -> EvidenceAuditEvent {
-    let mut audit = token_error_audit_event(path, status, credential_configuration_id, denial_code);
-    audit.access_mode = Some(access_mode);
-    audit
-}
-
-pub(in crate::api) fn token_error_audit_event(
-    path: &str,
-    status: u16,
-    credential_configuration_id: Option<&str>,
-    denial_code: SubjectAccessDenialCode,
-) -> EvidenceAuditEvent {
-    pre_auth_audit_event(
-        "POST",
-        path,
-        status,
-        "denied",
-        PreAuthAuditFields {
-            credential_configuration_id: credential_configuration_id
-                .and_then(|id| registry_notary_core::ConfigMetadata::new(id).ok()),
-            denial_code: Some(denial_code),
-            ..PreAuthAuditFields::default()
-        },
-    )
-}
-
-/// Parse a `TokenRequest` from a form-encoded or JSON body. A missing/other
-/// grant or unparseable body is returned as a clean `invalid_request`, never a
-/// deserialize panic.
-pub(in crate::api) fn parse_token_request(
-    headers: &HeaderMap,
-    body: &Bytes,
-) -> Result<Oid4vciTokenRequest, TokenWireError> {
-    let content_type = headers
-        .get(header::CONTENT_TYPE)
-        .and_then(|value| value.to_str().ok())
-        .unwrap_or("");
-    if content_type.contains("application/json") {
-        serde_json::from_slice(body).map_err(|_| TokenWireError::InvalidRequest)
-    } else {
-        // Default to form encoding (the OID4VCI / OAuth content type).
-        parse_token_form(body)
-    }
-}
-
-/// Parse an `application/x-www-form-urlencoded` token request body. Only the
-/// three pre-authorized-code grant fields are recognized; a missing
-/// `grant_type` is `invalid_request`.
-pub(in crate::api) fn parse_token_form(
-    body: &Bytes,
-) -> Result<Oid4vciTokenRequest, TokenWireError> {
-    let raw = std::str::from_utf8(body).map_err(|_| TokenWireError::InvalidRequest)?;
-    let mut grant_type = None;
-    let mut pre_authorized_code = None;
-    let mut tx_code = None;
-    for pair in raw.split('&').filter(|pair| !pair.is_empty()) {
-        let (key, value) = pair.split_once('=').unwrap_or((pair, ""));
-        let key = form_urldecode(key)?;
-        let value = form_urldecode(value)?;
-        match key.as_str() {
-            "grant_type" => grant_type = Some(value),
-            "pre-authorized_code" => pre_authorized_code = Some(value),
-            "tx_code" => tx_code = Some(value),
-            _ => {}
-        }
-    }
-    Ok(Oid4vciTokenRequest {
-        grant_type: grant_type.ok_or(TokenWireError::InvalidRequest)?,
-        pre_authorized_code,
-        tx_code,
-    })
-}
-
-/// Decode one `application/x-www-form-urlencoded` component (`+` to space,
-/// `%XX` to byte). Rejects malformed percent escapes.
-pub(in crate::api) fn form_urldecode(value: &str) -> Result<String, TokenWireError> {
-    let bytes = value.as_bytes();
-    let mut out = Vec::with_capacity(bytes.len());
-    let mut index = 0;
-    while index < bytes.len() {
-        match bytes[index] {
-            b'+' => {
-                out.push(b' ');
-                index += 1;
-            }
-            b'%' => {
-                let hi = bytes
-                    .get(index + 1)
-                    .copied()
-                    .ok_or(TokenWireError::InvalidRequest)?;
-                let lo = bytes
-                    .get(index + 2)
-                    .copied()
-                    .ok_or(TokenWireError::InvalidRequest)?;
-                let byte = hex_nibble(hi)? * 16 + hex_nibble(lo)?;
-                out.push(byte);
-                index += 3;
-            }
-            other => {
-                out.push(other);
-                index += 1;
-            }
-        }
-    }
-    String::from_utf8(out).map_err(|_| TokenWireError::InvalidRequest)
-}
-
-pub(in crate::api) fn hex_nibble(byte: u8) -> Result<u8, TokenWireError> {
-    match byte {
-        b'0'..=b'9' => Ok(byte - b'0'),
-        b'a'..=b'f' => Ok(byte - b'a' + 10),
-        b'A'..=b'F' => Ok(byte - b'A' + 10),
-        _ => Err(TokenWireError::InvalidRequest),
-    }
-}
-
-fn capped_access_token_window(
-    now: i64,
-    access_token_ttl_seconds: u64,
-    expires_at_cap: Option<i64>,
-) -> Option<(i64, i64)> {
-    let ttl = i64::try_from(access_token_ttl_seconds).ok()?;
-    let expires_at = expires_at_cap
-        .map(|cap| now.checked_add(ttl).map(|expiry| expiry.min(cap)))
-        .unwrap_or_else(|| now.checked_add(ttl))?;
-    (expires_at > now).then_some((now, expires_at))
-}
-
-#[cfg(test)]
-mod replay_scope_tests {
-    use super::*;
-
-    #[test]
-    fn preauthorized_code_scope_is_fixed_by_the_verified_token_issuer() {
-        let issuer = "https://notary.example";
-        assert_eq!(
-            pre_authorized_code_replay_scope(issuer).unwrap(),
-            pre_authorized_code_replay_scope(issuer).unwrap()
-        );
-        assert_ne!(
-            pre_authorized_code_replay_scope(issuer).unwrap(),
-            pre_authorized_code_replay_scope("https://other-notary.example").unwrap()
-        );
-    }
-
-    #[test]
-    fn access_token_window_uses_the_optional_transaction_expiry_cap() {
-        assert_eq!(capped_access_token_window(100, 300, None), Some((100, 400)));
-        assert_eq!(
-            capped_access_token_window(100, 300, Some(120)),
-            Some((100, 120))
-        );
-        assert_eq!(capped_access_token_window(120, 300, Some(120)), None);
-        assert_eq!(capped_access_token_window(121, 300, Some(120)), None);
-    }
-
-    #[test]
-    fn representative_target_form_is_closed_bounded_and_exact() {
-        let mut headers = HeaderMap::new();
-        headers.insert(
-            header::CONTENT_TYPE,
-            HeaderValue::from_static("application/x-www-form-urlencoded"),
-        );
-        let body =
-            Bytes::from_static(b"selection_state=state-1&csrf_token=csrf-1&target_id=CHILD-123");
-        let parsed =
-            parse_representative_target_selection(&headers, &body).expect("valid form parses");
-        assert_eq!(parsed.selection_state, "state-1");
-        assert_eq!(parsed.csrf_token, "csrf-1");
-        assert_eq!(parsed.target_id, "CHILD-123");
-
-        for invalid in [
-            "selection_state=one&selection_state=two&csrf_token=csrf&target_id=CHILD-123",
-            "selection_state=one&csrf_token=csrf&target_id=CHILD-123&unexpected=value",
-            "selection_state=one&csrf_token=csrf&target_id=%20CHILD-123",
-        ] {
-            assert!(parse_representative_target_selection(
-                &headers,
-                &Bytes::copy_from_slice(invalid.as_bytes())
-            )
-            .is_err());
-        }
-        assert!(
-            parse_representative_target_selection(&headers, &Bytes::from(vec![b'a'; 4097]))
-                .is_err()
-        );
-    }
-
-    #[test]
-    fn representative_target_page_escapes_tokens_and_is_not_cached() {
-        let html = representative_target_page_html("state<&", "csrf<&");
-        assert!(!html.contains("state<&"));
-        assert!(!html.contains("csrf<&"));
-        assert!(html.contains("state&lt;&amp;"));
-        assert!(html.contains("csrf&lt;&amp;"));
-        assert!(
-            html.contains("action=\"representative\""),
-            "the relative action must preserve an external issuer base path"
-        );
-        let response = no_store_html(html);
-        assert_eq!(
-            response.headers().get(header::CACHE_CONTROL).unwrap(),
-            "no-store"
-        );
-        assert_eq!(
-            response.headers().get("referrer-policy").unwrap(),
-            "no-referrer"
-        );
-    }
-}
diff --git a/crates/registry-notary-server/src/api/oid4vci/problem.rs b/crates/registry-notary-server/src/api/oid4vci/problem.rs
deleted file mode 100644
index c1d31d335..000000000
--- a/crates/registry-notary-server/src/api/oid4vci/problem.rs
+++ /dev/null
@@ -1,129 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! OID4VCI wire-problem mappings.
-
-use super::super::*;
-
-/// OAuth 2.0 token-endpoint errors per RFC 6749 / OID4VCI.
-#[derive(Debug, Clone, Copy)]
-pub(in crate::api) enum TokenWireError {
-    InvalidRequest,
-    InvalidGrant,
-    UnsupportedGrantType,
-    SlowDown,
-    ServerError,
-}
-
-pub(in crate::api) fn token_error_response(error: TokenWireError) -> Response {
-    let (status, code, description) = match error {
-        TokenWireError::InvalidRequest => (
-            StatusCode::BAD_REQUEST,
-            "invalid_request",
-            "token request is invalid",
-        ),
-        TokenWireError::InvalidGrant => (
-            StatusCode::BAD_REQUEST,
-            "invalid_grant",
-            "pre-authorized code or tx_code is invalid",
-        ),
-        TokenWireError::UnsupportedGrantType => (
-            StatusCode::BAD_REQUEST,
-            "unsupported_grant_type",
-            "only the pre-authorized_code grant is supported",
-        ),
-        TokenWireError::SlowDown => (
-            StatusCode::TOO_MANY_REQUESTS,
-            "slow_down",
-            "too many token requests",
-        ),
-        TokenWireError::ServerError => (
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "server_error",
-            "token issuance failed",
-        ),
-    };
-    let mut response = (
-        status,
-        Json(WireError::new(code, Some(description.to_string()))),
-    )
-        .into_response();
-    response
-        .extensions_mut()
-        .insert(EvidenceErrorCodeContext(format!("oid4vci.token.{code}")));
-    response
-}
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(in crate::api) enum Oid4vciWireError {
-    InvalidRequest,
-    InvalidToken,
-    InvalidProof,
-    UnsupportedCredentialType,
-    AccessDenied,
-    RateLimited,
-    ServerError,
-}
-
-pub(in crate::api) fn oid4vci_error_response(error: Oid4vciWireError) -> Response {
-    let (status, code, description) = match error {
-        Oid4vciWireError::InvalidRequest => (
-            StatusCode::BAD_REQUEST,
-            "invalid_request",
-            "credential request is invalid",
-        ),
-        Oid4vciWireError::InvalidToken => (
-            StatusCode::UNAUTHORIZED,
-            "invalid_token",
-            "credential access token is invalid",
-        ),
-        Oid4vciWireError::InvalidProof => (
-            StatusCode::BAD_REQUEST,
-            "invalid_proof",
-            "credential proof is invalid",
-        ),
-        Oid4vciWireError::UnsupportedCredentialType => (
-            StatusCode::BAD_REQUEST,
-            "unsupported_credential_type",
-            "credential request is not supported",
-        ),
-        Oid4vciWireError::AccessDenied => (
-            StatusCode::FORBIDDEN,
-            "access_denied",
-            "credential request is denied",
-        ),
-        Oid4vciWireError::RateLimited => (
-            StatusCode::TOO_MANY_REQUESTS,
-            "temporarily_unavailable",
-            "credential request is rate limited",
-        ),
-        Oid4vciWireError::ServerError => (
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "server_error",
-            "credential issuer failed",
-        ),
-    };
-    let mut response = (
-        status,
-        Json(WireError::new(code, Some(description.to_string()))),
-    )
-        .into_response();
-    response
-        .extensions_mut()
-        .insert(EvidenceErrorCodeContext(format!("oid4vci.{code}")));
-    response
-}
-
-pub(in crate::api) fn oid4vci_error_from_evidence(error: &EvidenceError) -> Oid4vciWireError {
-    match error {
-        EvidenceError::SubjectAccessRateLimited => Oid4vciWireError::RateLimited,
-        EvidenceError::HolderProofRequired | EvidenceError::HolderProofReplay => {
-            Oid4vciWireError::InvalidProof
-        }
-        EvidenceError::SubjectAccessInvalidToken | EvidenceError::SubjectAccessAssuranceDenied => {
-            Oid4vciWireError::InvalidToken
-        }
-        EvidenceError::FormatUnsupported | EvidenceError::CredentialIssuerNotConfigured => {
-            Oid4vciWireError::UnsupportedCredentialType
-        }
-        EvidenceError::CredentialIssuanceFailed => Oid4vciWireError::ServerError,
-        _ => Oid4vciWireError::AccessDenied,
-    }
-}
diff --git a/crates/registry-notary-server/src/api/oid4vci/proof.rs b/crates/registry-notary-server/src/api/oid4vci/proof.rs
deleted file mode 100644
index 0df5d26b4..000000000
--- a/crates/registry-notary-server/src/api/oid4vci/proof.rs
+++ /dev/null
@@ -1,259 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! OID4VCI proof precheck, nonce, and holder-binding validation.
-
-use super::super::*;
-
-pub(in crate::api) fn oid4vci_single_proof_jwt(
-    request: &Oid4vciCredentialRequest,
-) -> Result<&str, Oid4vciWireError> {
-    match request.proof_jwts() {
-        [proof] if !proof.is_empty() => {
-            if request.proofs.jwt.is_empty() && request.proof.proof_type != PROOF_TYPE_JWT {
-                return Err(Oid4vciWireError::InvalidProof);
-            }
-            Ok(proof.as_str())
-        }
-        _ => Err(Oid4vciWireError::InvalidProof),
-    }
-}
-
-pub async fn oid4vci_proof_precheck_middleware(
-    State(state): State<Arc<RegistryNotaryApiState>>,
-    request: Request<Body>,
-    next: Next,
-) -> Response {
-    if !oid4vci_proof_precheck_applies(request.uri().path()) {
-        return next.run(request).await;
-    }
-    if !state.oid4vci.enabled {
-        return StatusCode::NOT_FOUND.into_response();
-    }
-    let (parts, body) = request.into_parts();
-    let bytes = match to_bytes(body, 64 * 1024).await {
-        Ok(bytes) => bytes,
-        Err(_) => return oid4vci_error_response(Oid4vciWireError::InvalidRequest),
-    };
-    let request = match serde_json::from_slice::<Oid4vciCredentialRequest>(&bytes) {
-        Ok(request) => request,
-        Err(_) => return oid4vci_error_response(Oid4vciWireError::InvalidRequest),
-    };
-    let proof_jwt = match oid4vci_single_proof_jwt(&request) {
-        Ok(proof_jwt) => proof_jwt,
-        Err(error) => return oid4vci_error_response(error),
-    };
-    let expected_nonce = if state.oid4vci.nonce.enabled {
-        match oid4vci_proof_nonce(proof_jwt) {
-            Ok(nonce) => Some(nonce),
-            Err(error) => return oid4vci_error_response(error),
-        }
-    } else {
-        None
-    };
-    let validated_proof = match validate_proof_jwt(
-        proof_jwt,
-        &ProofValidationPolicy::credential_endpoint(
-            &state.oid4vci.credential_issuer,
-            expected_nonce.as_deref(),
-            Duration::from_secs(state.oid4vci.proof.max_age_seconds),
-            Duration::from_secs(state.oid4vci.proof.max_clock_skew_seconds),
-        ),
-        OffsetDateTime::now_utc().unix_timestamp(),
-    ) {
-        Ok(proof) => proof,
-        Err(_) => return oid4vci_error_response(Oid4vciWireError::InvalidProof),
-    };
-    if require_oid4vci_did_jwk_proof(&validated_proof).is_err() {
-        return oid4vci_error_response(Oid4vciWireError::InvalidProof);
-    }
-    let mut request = Request::from_parts(parts, Body::from(bytes));
-    request.extensions_mut().insert(validated_proof);
-    next.run(request).await
-}
-
-pub(in crate::api) fn require_oid4vci_did_jwk_proof(
-    proof: &ValidatedProof,
-) -> Result<(), Oid4vciWireError> {
-    if proof
-        .kid
-        .as_deref()
-        .is_some_and(|kid| kid.starts_with("did:jwk:"))
-        && proof.holder_id.starts_with("did:jwk:")
-    {
-        Ok(())
-    } else {
-        Err(Oid4vciWireError::InvalidProof)
-    }
-}
-pub(in crate::api) fn oid4vci_proof_nonce(proof_jwt: &str) -> Result<String, Oid4vciWireError> {
-    #[derive(Deserialize)]
-    struct NonceClaims {
-        nonce: Option<String>,
-    }
-
-    let mut parts = proof_jwt.split('.');
-    let Some(_) = parts.next() else {
-        return Err(Oid4vciWireError::InvalidProof);
-    };
-    let Some(payload_b64) = parts.next() else {
-        return Err(Oid4vciWireError::InvalidProof);
-    };
-    let Some(_) = parts.next() else {
-        return Err(Oid4vciWireError::InvalidProof);
-    };
-    if parts.next().is_some() {
-        return Err(Oid4vciWireError::InvalidProof);
-    }
-    let payload = URL_SAFE_NO_PAD
-        .decode(payload_b64)
-        .map_err(|_| Oid4vciWireError::InvalidProof)?;
-    let claims: NonceClaims =
-        serde_json::from_slice(&payload).map_err(|_| Oid4vciWireError::InvalidProof)?;
-    claims
-        .nonce
-        .filter(|nonce| !nonce.is_empty())
-        .ok_or(Oid4vciWireError::InvalidProof)
-}
-pub(in crate::api) fn holder_key_matches_issuer_key(
-    holder_jwk: &PublicJwk,
-    issuer_jwk: &Value,
-) -> bool {
-    let Ok(issuer) = PublicJwk::parse(&issuer_jwk.to_string()) else {
-        return false;
-    };
-    let Ok(issuer_jkt) = issuer.jkt() else {
-        return false;
-    };
-    let Ok(holder_jkt) = holder_jwk.jkt() else {
-        return false;
-    };
-    issuer_jkt == holder_jkt
-}
-pub(in crate::api) fn generate_nonce() -> Result<String, EvidenceError> {
-    let mut nonce = [0_u8; 32];
-    getrandom::fill(&mut nonce).map_err(|_| EvidenceError::CredentialIssuanceFailed)?;
-    Ok(URL_SAFE_NO_PAD.encode(nonce))
-}
-
-#[cfg(test)]
-mod oid4vci_proof_tests {
-    use super::*;
-
-    fn proof(kid: Option<&str>) -> ValidatedProof {
-        ValidatedProof {
-            holder_jwk: PublicJwk::parse(
-                r#"{"kty":"OKP","crv":"Ed25519","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA"}"#,
-            )
-            .expect("public JWK parses"),
-            holder_id: "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IjFhal9yTEpzR0Zndy01djkyNUVNbWVaalBKcDQ0eGVnYWZFS2ZaYmR4YyJ9".to_string(),
-            kid: kid.map(str::to_string),
-            nonce: Some("nonce".to_string()),
-            iat: 1,
-            exp: Some(2),
-            raw_claims: json!({}),
-        }
-    }
-
-    #[test]
-    fn oid4vci_holder_proof_requires_explicit_did_jwk_key_reference() {
-        let did = proof(None).holder_id;
-        assert!(require_oid4vci_did_jwk_proof(&proof(Some(&did))).is_ok());
-        assert_eq!(
-            require_oid4vci_did_jwk_proof(&proof(None)),
-            Err(Oid4vciWireError::InvalidProof)
-        );
-    }
-}
-
-#[derive(Debug)]
-pub(in crate::api) struct HolderProofBinding {
-    pub(in crate::api) scope: ReplayScope,
-    pub(in crate::api) key: ReplayKey,
-    pub(in crate::api) expires_at: OffsetDateTime,
-}
-
-pub(in crate::api) fn validate_holder_request(
-    profile: &CredentialProfileConfig,
-    profile_id: &str,
-    request: &CredentialIssueRequest,
-    evaluation: &registry_notary_core::StoredEvaluation,
-    holder: Option<&HolderRequest>,
-    service_id: &str,
-) -> Result<Option<HolderProofBinding>, EvidenceError> {
-    if profile.holder_binding.mode == "none" {
-        return Ok(None);
-    }
-    let Some(holder) = holder else {
-        return Err(EvidenceError::HolderProofRequired);
-    };
-    if holder.binding.as_deref() != Some(profile.holder_binding.mode.as_str()) {
-        return Err(EvidenceError::HolderProofRequired);
-    }
-    let holder_id = holder
-        .id
-        .as_deref()
-        .ok_or(EvidenceError::HolderProofRequired)?;
-    if profile.holder_binding.mode == "did"
-        && !profile
-            .holder_binding
-            .allowed_did_methods
-            .iter()
-            .any(|method| holder_id.starts_with(&format!("{method}:")))
-    {
-        return Err(EvidenceError::HolderProofRequired);
-    }
-    if profile.holder_binding.proof_of_possession.as_deref() == Some("required") {
-        let proof = holder
-            .proof
-            .as_deref()
-            .ok_or(EvidenceError::HolderProofRequired)?;
-        return validate_holder_proof_payload(
-            proof, holder_id, profile_id, request, evaluation, service_id,
-        )
-        .map(Some);
-    }
-    Ok(None)
-}
-
-pub(in crate::api) fn validate_holder_proof_payload(
-    proof: &str,
-    holder_id: &str,
-    profile_id: &str,
-    request: &CredentialIssueRequest,
-    evaluation: &registry_notary_core::StoredEvaluation,
-    service_id: &str,
-) -> Result<HolderProofBinding, EvidenceError> {
-    let jwk = sd_jwt::holder_jwk(holder_id)?;
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let disclosure = request
-        .disclosure
-        .as_deref()
-        .unwrap_or(evaluation.disclosure.as_str());
-    let disclosure_hash = Sha256::digest(disclosure.as_bytes()).to_vec();
-    let claims = validate_holder_proof(
-        proof,
-        &jwk,
-        &HolderProofBindings {
-            expected_sub: holder_id,
-            evaluation_id: request.evaluation_id.as_str(),
-            credential_profile: profile_id,
-            disclosure_hash: &disclosure_hash,
-            claim_set: &evaluation.claim_ids,
-        },
-        &HolderProofPolicy {
-            audience: service_id.to_string(),
-            max_lifetime: Duration::from_secs(300),
-        },
-        now,
-    )
-    .map_err(|_| EvidenceError::HolderProofRequired)?;
-    let expires_at = OffsetDateTime::from_unix_timestamp(claims.exp)
-        .map_err(|_| EvidenceError::HolderProofRequired)?;
-    let scope = ReplayScope::holder_proof_jwt(service_id, service_id, profile_id, holder_id)
-        .map_err(|_| EvidenceError::HolderProofRequired)?;
-    let key = ReplayKey::new(claims.jti).map_err(|_| EvidenceError::HolderProofRequired)?;
-    Ok(HolderProofBinding {
-        scope,
-        key,
-        expires_at,
-    })
-}
diff --git a/crates/registry-notary-server/src/api/probes.rs b/crates/registry-notary-server/src/api/probes.rs
deleted file mode 100644
index 465819718..000000000
--- a/crates/registry-notary-server/src/api/probes.rs
+++ /dev/null
@@ -1,401 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Health and readiness probe handlers.
-
-use super::*;
-
-/// Stable public readiness code for a confirmed retained-chain integrity failure.
-pub const AUDIT_CHAIN_INCONSISTENT_CODE: &str = "audit.chain.inconsistent";
-
-pub(super) async fn healthz() -> Response {
-    Json(json!({
-        "status": "ok",
-        "checks": {
-            "total": 1,
-            "ok": 1,
-            "failed": 0,
-        },
-    }))
-    .into_response()
-}
-
-pub(super) async fn ready(state: Option<Extension<Arc<RegistryNotaryApiState>>>) -> Response {
-    if state
-        .as_ref()
-        .and_then(|Extension(state)| state.audit.as_ref())
-        .is_some_and(|audit| !audit.chain_healthy())
-    {
-        return audit_chain_not_ready_response();
-    }
-
-    let (base_ready, base_degraded, signer_total, signer_ok, signer_failed) = match state.as_ref() {
-        Some(Extension(state)) if state.enabled_evidence().is_ok() => {
-            let replay_readiness = state.replay.check_ready().await;
-            let credential_status_ready = state.credential_status.check_ready().await.is_ok();
-            let replay_ready = matches!(replay_readiness, Ok(ReplayReadiness::Ready));
-            let signer_readiness = state.signer_readiness();
-            let signer_ready = signer_readiness.is_ready();
-            let degraded = matches!(replay_readiness, Ok(ReplayReadiness::Degraded))
-                && credential_status_ready
-                && signer_ready;
-            (
-                replay_ready && credential_status_ready && signer_ready && !degraded,
-                degraded,
-                signer_readiness.total(),
-                signer_readiness.ready_count(),
-                signer_readiness.failed_count(),
-            )
-        }
-        _ => (false, false, 0, 0, 0),
-    };
-    let degraded = usize::from(base_degraded);
-    let current_deployment_gates = match state.as_ref() {
-        Some(Extension(state)) => Some(state.current_deployment_gates().await),
-        None => None,
-    };
-    let (relay_total, relay_ok, relay_failed) = match state.as_ref() {
-        Some(Extension(state)) if state.relay_required() => {
-            let readiness = state.relay_readiness().await;
-            (readiness.total(), readiness.ready(), readiness.failed())
-        }
-        _ => (0, 0, 0),
-    };
-    #[cfg(feature = "registry-notary-cel")]
-    let (cel_total, cel_ok, cel_failed) = {
-        let mut total = 0;
-        let mut ok = 0;
-        let mut failed = 0;
-        if let Some(Extension(state)) = state.as_ref() {
-            if let Some(cel_worker) = &state.cel_worker {
-                total += 1;
-                if cel_worker.check_ready().await {
-                    ok += 1;
-                } else {
-                    failed += 1;
-                }
-            }
-        }
-        (total, ok, failed)
-    };
-    #[cfg(not(feature = "registry-notary-cel"))]
-    let (cel_total, cel_ok, cel_failed) = (0, 0, 0);
-
-    let (total, ok, failed) = {
-        let mut total = 1 + signer_total + relay_total + cel_total;
-        let mut ok = usize::from(base_ready) + signer_ok + relay_ok + cel_ok;
-        let mut failed =
-            usize::from(!base_ready && !base_degraded) + signer_failed + relay_failed + cel_failed;
-        if let Some(gates) = current_deployment_gates
-            .as_ref()
-            .filter(|gates| gates.is_bound())
-        {
-            total += 1;
-            if gates.has_readiness_failure() {
-                failed += 1;
-            } else {
-                ok += 1;
-            }
-        }
-        (total, ok, failed)
-    };
-
-    let ready = ok == total;
-    let is_degraded = !ready && failed == 0 && degraded > 0;
-    let state_ref = state.as_ref().map(|Extension(state)| state.as_ref());
-    let signer_custody = state_ref
-        .map(signer_custody_checks)
-        .unwrap_or_else(default_signer_custody_checks);
-    let status = if ready {
-        StatusCode::OK
-    } else {
-        StatusCode::SERVICE_UNAVAILABLE
-    };
-    let status_text = match (ready, is_degraded) {
-        (true, _) => KeyReadiness::Ready,
-        (false, true) => KeyReadiness::Degraded,
-        (false, false) => KeyReadiness::NotReady,
-    };
-    let checks = json!({
-        "total": total,
-        "ok": ok,
-        "degraded": degraded,
-        "failed": failed,
-        "signing_providers": {
-            "total": signer_total,
-            "ok": signer_ok,
-            "failed": signer_failed,
-            "custody": signer_custody,
-        },
-        "relay": {
-            "total": relay_total,
-            "ok": relay_ok,
-            "failed": relay_failed,
-        },
-        "cel": {
-            "total": cel_total,
-            "ok": cel_ok,
-            "failed": cel_failed,
-        },
-    });
-    if ready {
-        return Json(json!({
-            "status": status_text.as_str(),
-            "checks": checks,
-        }))
-        .into_response();
-    }
-
-    let request_id = crate::standalone::current_request_correlation_id()
-        .unwrap_or_else(crate::standalone::new_request_correlation_id);
-    let mut response = (
-        status,
-        Json(json!({
-            "type": format!("{}/readiness/not-ready", crate::PROBLEM_TYPE_BASE_URL),
-            "title": "Evidence runtime is not ready",
-            "status": status.as_u16(),
-            "detail": "one or more readiness checks are not ready",
-            "code": "readiness.not_ready",
-            "request_id": request_id.as_str(),
-            "readiness_status": status_text.as_str(),
-            "checks": checks,
-        })),
-    )
-        .into_response();
-    response.headers_mut().insert(
-        header::CONTENT_TYPE,
-        "application/problem+json".parse().unwrap(),
-    );
-    response.headers_mut().insert(
-        "x-request-id",
-        request_id
-            .as_str()
-            .parse()
-            .expect("bounded correlation id is a valid header value"),
-    );
-    response
-}
-
-fn audit_chain_not_ready_response() -> Response {
-    let status = StatusCode::SERVICE_UNAVAILABLE;
-    let request_id = crate::standalone::current_request_correlation_id()
-        .unwrap_or_else(crate::standalone::new_request_correlation_id);
-    let mut response = (
-        status,
-        Json(json!({
-            "type": format!("{}/audit/chain-inconsistent", crate::PROBLEM_TYPE_BASE_URL),
-            "title": "Audit chain inconsistent",
-            "status": status.as_u16(),
-            "detail": "the retained audit chain has an integrity failure and requires operator recovery",
-            "code": AUDIT_CHAIN_INCONSISTENT_CODE,
-            "request_id": request_id.as_str(),
-        })),
-    )
-        .into_response();
-    response.headers_mut().insert(
-        header::CONTENT_TYPE,
-        "application/problem+json".parse().unwrap(),
-    );
-    response.headers_mut().insert(
-        "x-request-id",
-        request_id
-            .as_str()
-            .parse()
-            .expect("bounded correlation id is a valid header value"),
-    );
-    response
-}
-
-pub(super) fn signer_custody_checks(state: &RegistryNotaryApiState) -> Value {
-    let signer_readiness = state.signer_readiness();
-    let provider_counts = signer_readiness.provider_counts();
-    let config = state.runtime_config();
-    let custody_approved = config
-        .as_deref()
-        .is_some_and(|config| config.deployment.evidence.signer_custody_approved);
-    let approval_required = config
-        .as_deref()
-        .is_some_and(signer_custody_approval_required);
-    let scoped = config
-        .as_deref()
-        .map(custody_scoped_signer_counts)
-        .unwrap_or_default();
-    let credential_issuance = config
-        .as_deref()
-        .map(credential_issuance_signer_counts)
-        .unwrap_or_default();
-    let access_token_issuance = config
-        .as_deref()
-        .map(access_token_issuance_signer_counts)
-        .unwrap_or_default();
-    let access_token_issuance_enabled = config
-        .as_deref()
-        .is_some_and(|config| config.auth.access_token_signing.enabled);
-    let federation = config
-        .as_deref()
-        .map(federation_signer_counts)
-        .unwrap_or_default();
-    let federation_enabled = config
-        .as_deref()
-        .is_some_and(|config| config.federation.enabled);
-
-    json!({
-        "active_provider_counts": provider_counts,
-        "signing_provider_count": scoped.total,
-        "local_software_signing_provider_count": scoped.local_software,
-        "custody_approval_required": approval_required,
-        "custody_approved": custody_approved,
-        "unapproved_signing_provider_count": unapproved_signer_count(
-            scoped.total,
-            custody_approved,
-        ),
-        "surfaces": {
-            "credential_issuance": signer_surface_checks(
-                credential_issuance,
-                custody_approved,
-            ),
-            "access_token_issuance": signer_surface_checks_with_enabled(
-                access_token_issuance_enabled,
-                access_token_issuance,
-                custody_approved,
-            ),
-            "federation": {
-                "enabled": federation_enabled,
-                "signing_provider_count": federation.total,
-                "local_software_signing_provider_count": federation.local_software,
-                "unapproved_signing_provider_count": unapproved_signer_count(
-                    federation.total,
-                    custody_approved,
-                ),
-            },
-        },
-    })
-}
-
-pub(super) fn default_signer_custody_checks() -> Value {
-    json!({
-        "active_provider_counts": {},
-        "signing_provider_count": 0,
-        "local_software_signing_provider_count": 0,
-        "custody_approval_required": false,
-        "custody_approved": false,
-        "unapproved_signing_provider_count": 0,
-        "surfaces": {
-            "credential_issuance": {
-                "signing_provider_count": 0,
-                "local_software_signing_provider_count": 0,
-                "unapproved_signing_provider_count": 0,
-            },
-            "access_token_issuance": {
-                "enabled": false,
-                "signing_provider_count": 0,
-                "local_software_signing_provider_count": 0,
-                "unapproved_signing_provider_count": 0,
-            },
-            "federation": {
-                "enabled": false,
-                "signing_provider_count": 0,
-                "local_software_signing_provider_count": 0,
-                "unapproved_signing_provider_count": 0,
-            },
-        },
-    })
-}
-
-#[derive(Clone, Copy, Default)]
-pub(super) struct SignerCounts {
-    pub(super) total: usize,
-    pub(super) local_software: usize,
-}
-
-pub(super) fn signer_custody_approval_required(config: &StandaloneRegistryNotaryConfig) -> bool {
-    matches!(
-        config.deployment.profile,
-        Some(DeploymentProfile::Production | DeploymentProfile::EvidenceGrade)
-    )
-}
-
-pub(super) fn custody_scoped_signer_counts(
-    config: &StandaloneRegistryNotaryConfig,
-) -> SignerCounts {
-    signing_key_counts(config, config.custody_scoped_signing_key_ids())
-}
-
-pub(super) fn credential_issuance_signer_counts(
-    config: &StandaloneRegistryNotaryConfig,
-) -> SignerCounts {
-    signing_key_counts(
-        config,
-        config
-            .evidence
-            .credential_profiles
-            .values()
-            .map(|profile| profile.signing_key.as_str()),
-    )
-}
-
-pub(super) fn access_token_issuance_signer_counts(
-    config: &StandaloneRegistryNotaryConfig,
-) -> SignerCounts {
-    if !config.auth.access_token_signing.enabled {
-        return SignerCounts::default();
-    }
-    signing_key_counts(
-        config,
-        [config.auth.access_token_signing.signing_key_id.as_str()],
-    )
-}
-
-pub(super) fn federation_signer_counts(config: &StandaloneRegistryNotaryConfig) -> SignerCounts {
-    if !config.federation.enabled {
-        return SignerCounts::default();
-    }
-    signing_key_counts(config, [config.federation.signing.signing_key.as_str()])
-}
-
-pub(super) fn signing_key_counts<'a>(
-    config: &StandaloneRegistryNotaryConfig,
-    key_ids: impl IntoIterator<Item = &'a str>,
-) -> SignerCounts {
-    let mut counts = SignerCounts::default();
-    for key_id in key_ids.into_iter().collect::<BTreeSet<_>>() {
-        let Some(key) = config
-            .evidence
-            .signing_keys
-            .get(key_id)
-            .filter(|key| key.status.may_sign())
-        else {
-            continue;
-        };
-        counts.total += 1;
-        counts.local_software += usize::from(signing_key_uses_local_software_custody(key));
-    }
-    counts
-}
-
-pub(super) fn signer_surface_checks(counts: SignerCounts, custody_approved: bool) -> Value {
-    json!({
-        "signing_provider_count": counts.total,
-        "local_software_signing_provider_count": counts.local_software,
-        "unapproved_signing_provider_count": unapproved_signer_count(
-            counts.total,
-            custody_approved,
-        ),
-    })
-}
-
-pub(super) fn signer_surface_checks_with_enabled(
-    enabled: bool,
-    counts: SignerCounts,
-    custody_approved: bool,
-) -> Value {
-    let mut checks = signer_surface_checks(counts, custody_approved);
-    checks["enabled"] = json!(enabled);
-    checks
-}
-
-pub(super) const fn unapproved_signer_count(count: usize, custody_approved: bool) -> usize {
-    if custody_approved {
-        0
-    } else {
-        count
-    }
-}
diff --git a/crates/registry-notary-server/src/api/request.rs b/crates/registry-notary-server/src/api/request.rs
deleted file mode 100644
index df4a59116..000000000
--- a/crates/registry-notary-server/src/api/request.rs
+++ /dev/null
@@ -1,174 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Shared HTTP request parsing and content-negotiation helpers.
-
-use super::*;
-
-pub(super) fn negotiate_request_format(
-    evidence: &EvidenceConfig,
-    headers: &HeaderMap,
-    body_format: Option<&str>,
-) -> Result<String, EvidenceError> {
-    let supported = RegistryNotaryRuntime::list_formats(evidence)
-        .into_iter()
-        .filter(|format| format.status == "enabled")
-        .map(|format| format.id)
-        .collect::<Vec<_>>();
-    let accept = headers
-        .get(header::ACCEPT)
-        .and_then(|value| value.to_str().ok());
-    if let Some(format) = body_format.filter(|format| !format.trim().is_empty()) {
-        if accept_permits(accept, format) {
-            return Ok(format.to_string());
-        }
-        return Err(EvidenceError::FormatUnsupported);
-    }
-    match accept {
-        None => Ok(FORMAT_CLAIM_RESULT_JSON.to_string()),
-        Some(value) if accept_is_default(value) => Ok(FORMAT_CLAIM_RESULT_JSON.to_string()),
-        Some(value) => {
-            accept_preferred_format(value, &supported).ok_or(EvidenceError::FormatUnsupported)
-        }
-    }
-}
-
-pub(super) fn accept_is_default(value: &str) -> bool {
-    accept_entries(value)
-        .into_iter()
-        .find(|entry| entry.q > 0.0)
-        .is_some_and(|entry| entry.media_range == "*/*" || entry.media_range.trim().is_empty())
-}
-
-pub(super) fn accept_permits(accept: Option<&str>, format: &str) -> bool {
-    let Some(accept) = accept else {
-        return true;
-    };
-    accept_entries(accept)
-        .into_iter()
-        .any(|entry| entry.q > 0.0 && media_range_matches(&entry.media_range, format))
-}
-
-pub(super) fn accept_preferred_format(accept: &str, supported: &[String]) -> Option<String> {
-    accept_entries(accept).into_iter().find_map(|entry| {
-        if entry.q <= 0.0 {
-            return None;
-        }
-        supported
-            .iter()
-            .find(|format| media_range_matches(&entry.media_range, format))
-            .cloned()
-    })
-}
-
-#[derive(Debug)]
-pub(super) struct AcceptEntry {
-    pub(super) media_range: String,
-    pub(super) q: f32,
-    pub(super) order: usize,
-}
-
-pub(super) fn accept_entries(accept: &str) -> Vec<AcceptEntry> {
-    let mut entries = accept
-        .split(',')
-        .enumerate()
-        .filter_map(|(order, part)| {
-            let mut segments = part.split(';').map(str::trim);
-            let media_type = segments.next()?.to_ascii_lowercase();
-            let mut params = Vec::new();
-            let mut q = 1.0;
-            for segment in segments {
-                if let Some(raw_q) = segment.strip_prefix("q=") {
-                    q = raw_q.parse::<f32>().unwrap_or(0.0);
-                } else if !segment.is_empty() {
-                    params.push(segment.to_ascii_lowercase());
-                }
-            }
-            let suffix = if params.is_empty() {
-                String::new()
-            } else {
-                format!("; {}", params.join("; "))
-            };
-            Some(AcceptEntry {
-                media_range: format!("{media_type}{suffix}"),
-                q,
-                order,
-            })
-        })
-        .collect::<Vec<_>>();
-    entries.sort_by(|left, right| {
-        right
-            .q
-            .partial_cmp(&left.q)
-            .unwrap_or(std::cmp::Ordering::Equal)
-            .then_with(|| left.order.cmp(&right.order))
-    });
-    entries
-}
-
-pub(super) fn media_range_matches(range: &str, format: &str) -> bool {
-    let format = format.to_ascii_lowercase();
-    if range == "*/*" || range == format {
-        return true;
-    }
-    range
-        .strip_suffix("/*")
-        .and_then(|prefix| format.split_once('/').map(|(kind, _)| (prefix, kind)))
-        .is_some_and(|(prefix, kind)| prefix == kind)
-}
-
-pub(super) fn purpose_header(headers: &HeaderMap) -> Option<&str> {
-    headers
-        .get(DATA_PURPOSE_HEADER)
-        .and_then(|value| value.to_str().ok())
-}
-
-pub(super) fn parse_json_body<T>(
-    request: Result<Json<T>, JsonRejection>,
-) -> Result<T, EvidenceError> {
-    request
-        .map(|Json(request)| request)
-        .map_err(|_| EvidenceError::InvalidRequest)
-}
-
-pub(super) fn resolved_evaluate_audit_purposes(
-    header_purpose: Option<&str>,
-    body_purpose: Option<&str>,
-) -> Option<Vec<String>> {
-    match (header_purpose, body_purpose) {
-        (Some(header), Some(body)) if header != body => None,
-        (Some(header), _) if !header.trim().is_empty() => Some(vec![header.to_string()]),
-        (_, Some(body)) if !body.trim().is_empty() => Some(vec![body.to_string()]),
-        _ => None,
-    }
-}
-
-pub(super) fn resolved_batch_audit_purposes(
-    header_purpose: Option<&str>,
-    body_purpose: Option<&str>,
-    subjects: &[BatchEvaluateItemRequest],
-) -> Option<Vec<String>> {
-    let default = match (header_purpose, body_purpose) {
-        (Some(header), Some(body)) if header != body => return None,
-        (Some(header), _) if !header.trim().is_empty() => Some(header),
-        (_, Some(body)) if !body.trim().is_empty() => Some(body),
-        (Some(_), _) | (_, Some(_)) => return None,
-        _ => None,
-    };
-    subjects
-        .iter()
-        .map(|subject| match subject.purpose.as_deref() {
-            Some(purpose) if !purpose.trim().is_empty() => Some(purpose.to_string()),
-            Some(_) => None,
-            None => default.map(str::to_string),
-        })
-        .collect()
-}
-
-pub(super) fn idempotency_key(headers: &HeaderMap) -> Option<&str> {
-    headers
-        .get(IDEMPOTENCY_KEY_HEADER)
-        .and_then(|value| value.to_str().ok())
-}
-
-pub(super) fn has_idempotency_key(headers: &HeaderMap) -> bool {
-    headers.contains_key(IDEMPOTENCY_KEY_HEADER)
-}
diff --git a/crates/registry-notary-server/src/api/state.rs b/crates/registry-notary-server/src/api/state.rs
deleted file mode 100644
index d6a2c1b67..000000000
--- a/crates/registry-notary-server/src/api/state.rs
+++ /dev/null
@@ -1,582 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! API runtime state and atomic runtime-snapshot publication.
-
-use super::*;
-
-pub(super) const AUDIT_ACK_CURSOR_READ_TIMEOUT: Duration = Duration::from_millis(500);
-pub(super) const RELAY_READINESS_TIMEOUT: Duration = Duration::from_secs(5);
-const RELAY_READINESS_TTL: Duration = Duration::from_secs(5);
-pub(super) static AUDIT_ACK_CURSOR_READ_PERMIT: OnceLock<Arc<tokio::sync::Semaphore>> =
-    OnceLock::new();
-
-#[derive(Debug, Default)]
-struct RelayReadinessCache {
-    checked_at: Option<tokio::time::Instant>,
-    readiness: crate::runtime::RelayProfileReadiness,
-}
-
-pub(super) fn audit_ack_cursor_read_permit() -> Arc<tokio::sync::Semaphore> {
-    Arc::clone(
-        AUDIT_ACK_CURSOR_READ_PERMIT.get_or_init(|| Arc::new(tokio::sync::Semaphore::new(1))),
-    )
-}
-
-pub(super) async fn bounded_audit_ack_observation(
-    config: &StandaloneRegistryNotaryConfig,
-) -> AckObservation {
-    let Some(path) = config
-        .deployment
-        .evidence
-        .audit_ack_cursor_path()
-        .map(std::path::Path::to_path_buf)
-    else {
-        return AckObservation::unverified();
-    };
-    let max_age = config.deployment.evidence.audit_ack_max_age();
-    let permit = match audit_ack_cursor_read_permit().try_acquire_owned() {
-        Ok(permit) => permit,
-        Err(tokio::sync::TryAcquireError::Closed) => {
-            return AckObservation::invalid("ack cursor read worker is unavailable");
-        }
-        Err(tokio::sync::TryAcquireError::NoPermits) => {
-            return AckObservation::invalid("ack cursor read is still in progress");
-        }
-    };
-    let worker = tokio::task::spawn_blocking(move || {
-        let _permit = permit;
-        registry_platform_ops::evaluate_ack_health(Some(path.as_path()), SystemTime::now(), max_age)
-    });
-    match tokio::time::timeout(AUDIT_ACK_CURSOR_READ_TIMEOUT, worker).await {
-        Ok(Ok(observation)) => observation,
-        Ok(Err(_)) => AckObservation::invalid("ack cursor read worker failed"),
-        Err(_) => AckObservation::invalid("ack cursor read timed out"),
-    }
-}
-pub trait EvidenceIssuerResolver: Send + Sync {
-    fn issuer(
-        &self,
-        profile_id: &str,
-    ) -> Result<registry_notary_core::sd_jwt::EvidenceIssuer, EvidenceError>;
-
-    fn public_jwks(&self, evidence: &EvidenceConfig) -> Result<Vec<Value>, EvidenceError> {
-        evidence
-            .credential_profiles
-            .keys()
-            .map(|profile_id| {
-                self.issuer(profile_id)
-                    .map(|issuer| issuer.public_jwk().clone())
-            })
-            .collect()
-    }
-}
-
-#[derive(Clone)]
-pub struct RegistryNotaryApiState {
-    pub(crate) evidence: Arc<EvidenceConfig>,
-    pub(crate) subject_access: Arc<SubjectAccessConfig>,
-    pub(crate) oid4vci: Arc<Oid4vciConfig>,
-    pub(crate) federation: Arc<FederationConfig>,
-    pub(super) subject_access_rate_limiter: Arc<SubjectAccessRateLimiter>,
-    pub(crate) subject_access_rate_keys: Arc<SubjectAccessRateLimitKeys>,
-    pub(super) machine_quota_limiter: Arc<MachineQuotaLimiter>,
-    pub(crate) replay: ReplayStores,
-    pub(crate) credential_status: CredentialStatusStore,
-    pub(super) status_list_jwt_cache: Arc<StatusListJwtCache>,
-    pub(crate) metrics: Arc<AppMetrics>,
-    pub(crate) activated_relay: Arc<OnceLock<Arc<dyn crate::runtime::ActivatedRelayConsultations>>>,
-    relay_readiness: Arc<tokio::sync::Mutex<RelayReadinessCache>>,
-    pub(crate) store: Arc<EvidenceStore>,
-    pub(super) runtime: Arc<RwLock<Arc<ApiRuntimeSnapshot>>>,
-    pub(super) auth_state: Option<Arc<AuthAuditState>>,
-    pub(super) audit: Option<crate::standalone::AuditPipeline>,
-    pub(crate) posture: Option<Arc<PostureContext>>,
-    pub(crate) deployment_gates: Arc<crate::standalone::DeploymentGateState>,
-    pub(super) config_apply_posture: Arc<RwLock<ConfigApplyPosture>>,
-    #[cfg(feature = "registry-notary-cel")]
-    pub(crate) cel_worker: Option<Arc<CelWorker>>,
-    #[cfg(feature = "registry-notary-cel")]
-    pub(crate) cel_config: Arc<RegistryNotaryCelConfig>,
-}
-
-#[derive(Clone)]
-pub(super) struct ApiRuntimeSnapshot {
-    pub(super) federation_runtime: Option<Arc<crate::federation::FederationRuntimeState>>,
-    pub(super) issuer_runtime: Arc<IssuerRuntimeBundle>,
-    pub(super) config_governance: ConfigGovernanceContext,
-    pub(super) runtime_config: Option<Arc<StandaloneRegistryNotaryConfig>>,
-    /// Pre-authorized-code flow runtime. `None` unless the flow is enabled and
-    /// the dedicated access-token signing key plus eSignet RP settings loaded.
-    pub(super) preauth: Option<Arc<PreAuthRuntime>>,
-}
-
-pub(super) struct IssuerRuntimeBundle {
-    pub(super) issuers: Arc<dyn EvidenceIssuerResolver>,
-    pub(super) signer_readiness: SignerReadiness,
-}
-
-impl RegistryNotaryApiState {
-    #[must_use]
-    pub fn new(
-        evidence: Arc<EvidenceConfig>,
-        audit_hasher: AuditKeyHasher,
-        store: Arc<EvidenceStore>,
-        issuers: Arc<dyn EvidenceIssuerResolver>,
-    ) -> Self {
-        Self::new_with_subject_access(
-            evidence,
-            Arc::new(SubjectAccessConfig::default()),
-            audit_hasher,
-            store,
-            issuers,
-        )
-    }
-
-    #[must_use]
-    pub fn new_with_subject_access(
-        evidence: Arc<EvidenceConfig>,
-        subject_access: Arc<SubjectAccessConfig>,
-        audit_hasher: AuditKeyHasher,
-        store: Arc<EvidenceStore>,
-        issuers: Arc<dyn EvidenceIssuerResolver>,
-    ) -> Self {
-        Self::new_with_subject_access_and_oid4vci(
-            evidence,
-            subject_access,
-            Arc::new(Oid4vciConfig::default()),
-            audit_hasher,
-            store,
-            issuers,
-        )
-    }
-
-    #[must_use]
-    pub fn new_with_subject_access_and_oid4vci(
-        evidence: Arc<EvidenceConfig>,
-        subject_access: Arc<SubjectAccessConfig>,
-        oid4vci: Arc<Oid4vciConfig>,
-        audit_hasher: AuditKeyHasher,
-        store: Arc<EvidenceStore>,
-        issuers: Arc<dyn EvidenceIssuerResolver>,
-    ) -> Self {
-        Self::new_with_subject_access_and_oid4vci_hasher(
-            evidence,
-            subject_access,
-            oid4vci,
-            audit_hasher,
-            store,
-            issuers,
-        )
-    }
-
-    #[must_use]
-    pub fn new_with_subject_access_hasher(
-        evidence: Arc<EvidenceConfig>,
-        subject_access: Arc<SubjectAccessConfig>,
-        audit_hasher: AuditKeyHasher,
-        store: Arc<EvidenceStore>,
-        issuers: Arc<dyn EvidenceIssuerResolver>,
-    ) -> Self {
-        Self::new_with_subject_access_and_oid4vci_hasher(
-            evidence,
-            subject_access,
-            Arc::new(Oid4vciConfig::default()),
-            audit_hasher,
-            store,
-            issuers,
-        )
-    }
-
-    #[must_use]
-    pub fn new_with_subject_access_and_oid4vci_hasher(
-        evidence: Arc<EvidenceConfig>,
-        subject_access: Arc<SubjectAccessConfig>,
-        oid4vci: Arc<Oid4vciConfig>,
-        audit_hasher: AuditKeyHasher,
-        store: Arc<EvidenceStore>,
-        issuers: Arc<dyn EvidenceIssuerResolver>,
-    ) -> Self {
-        Self::new_with_runtime_blocks(
-            evidence,
-            subject_access,
-            oid4vci,
-            Arc::new(FederationConfig::default()),
-            None,
-            audit_hasher,
-            ReplayStores::memory(),
-            CredentialStatusStore::disabled(),
-            Arc::new(AppMetrics::default()),
-            store,
-            issuers,
-            SignerReadiness::default(),
-        )
-    }
-
-    #[allow(clippy::too_many_arguments)]
-    pub(crate) fn new_with_federation(
-        evidence: Arc<EvidenceConfig>,
-        subject_access: Arc<SubjectAccessConfig>,
-        oid4vci: Arc<Oid4vciConfig>,
-        federation: Arc<FederationConfig>,
-        audit_hasher: AuditKeyHasher,
-        federation_audit: Option<crate::standalone::AuditPipeline>,
-        replay: ReplayStores,
-        credential_status: CredentialStatusStore,
-        metrics: Arc<AppMetrics>,
-        store: Arc<EvidenceStore>,
-        issuers: Arc<dyn EvidenceIssuerResolver>,
-        federation_signing_provider: Option<Arc<dyn SigningProvider>>,
-    ) -> Result<Self, crate::standalone::StandaloneServerError> {
-        let federation_runtime = federation
-            .enabled
-            .then(|| {
-                let signing_provider = federation_signing_provider.clone().ok_or_else(|| {
-                    crate::standalone::StandaloneServerError::InvalidFederationConfig(
-                        "federation signing provider was not built".to_string(),
-                    )
-                })?;
-                crate::federation::FederationRuntimeState::from_config(
-                    &federation,
-                    signing_provider,
-                    federation_audit,
-                    replay.store(),
-                    Arc::clone(&metrics),
-                )
-            })
-            .transpose()?
-            .map(Arc::new);
-        Ok(Self::new_with_runtime_blocks(
-            evidence,
-            subject_access,
-            oid4vci,
-            federation,
-            federation_runtime,
-            audit_hasher,
-            replay,
-            credential_status,
-            metrics,
-            store,
-            issuers,
-            SignerReadiness::default(),
-        ))
-    }
-
-    #[allow(clippy::too_many_arguments)]
-    pub(super) fn new_with_runtime_blocks(
-        evidence: Arc<EvidenceConfig>,
-        subject_access: Arc<SubjectAccessConfig>,
-        oid4vci: Arc<Oid4vciConfig>,
-        federation: Arc<FederationConfig>,
-        federation_runtime: Option<Arc<crate::federation::FederationRuntimeState>>,
-        audit_hasher: AuditKeyHasher,
-        replay: ReplayStores,
-        credential_status: CredentialStatusStore,
-        metrics: Arc<AppMetrics>,
-        store: Arc<EvidenceStore>,
-        issuers: Arc<dyn EvidenceIssuerResolver>,
-        signer_readiness: SignerReadiness,
-    ) -> Self {
-        let subject_access_rate_limiter = Arc::new(SubjectAccessRateLimiter::new(
-            subject_access.rate_limits.clone(),
-        ));
-        let subject_access_rate_keys = Arc::new(SubjectAccessRateLimitKeys::new(audit_hasher));
-        let machine_quota_limiter = Arc::new(MachineQuotaLimiter::new(evidence.machine_quota));
-        let issuer_runtime = Arc::new(IssuerRuntimeBundle {
-            issuers,
-            signer_readiness,
-        });
-        let runtime = Arc::new(ApiRuntimeSnapshot {
-            federation_runtime,
-            issuer_runtime,
-            config_governance: ConfigGovernanceContext::default(),
-            runtime_config: None,
-            preauth: None,
-        });
-        Self {
-            evidence,
-            subject_access,
-            oid4vci,
-            federation,
-            subject_access_rate_limiter,
-            subject_access_rate_keys,
-            machine_quota_limiter,
-            replay,
-            credential_status,
-            status_list_jwt_cache: Arc::new(StatusListJwtCache::default()),
-            metrics,
-            activated_relay: Arc::new(OnceLock::new()),
-            relay_readiness: Arc::new(tokio::sync::Mutex::new(RelayReadinessCache::default())),
-            store,
-            runtime: Arc::new(RwLock::new(runtime)),
-            auth_state: None,
-            audit: None,
-            posture: None,
-            deployment_gates: Arc::new(crate::standalone::DeploymentGateState::default()),
-            config_apply_posture: Arc::new(RwLock::new(ConfigApplyPosture::default())),
-            #[cfg(feature = "registry-notary-cel")]
-            cel_worker: None,
-            #[cfg(feature = "registry-notary-cel")]
-            cel_config: Arc::new(RegistryNotaryCelConfig::default()),
-        }
-    }
-
-    #[must_use]
-    pub(crate) fn with_auth_state(mut self, auth_state: Arc<AuthAuditState>) -> Self {
-        self.auth_state = Some(auth_state);
-        self
-    }
-
-    #[must_use]
-    pub(crate) fn with_postgres_state_plane(
-        mut self,
-        state_plane: Arc<crate::state_plane::NotaryStatePlaneHandle>,
-        audit_hasher: AuditKeyHasher,
-    ) -> Self {
-        self.subject_access_rate_limiter = Arc::new(SubjectAccessRateLimiter::with_state_plane(
-            self.subject_access.rate_limits.clone(),
-            Arc::clone(&state_plane),
-        ));
-        self.machine_quota_limiter = Arc::new(MachineQuotaLimiter::with_state_plane(
-            self.evidence.machine_quota,
-            state_plane,
-            audit_hasher,
-        ));
-        self
-    }
-
-    #[must_use]
-    pub(crate) fn with_audit_pipeline(mut self, audit: crate::standalone::AuditPipeline) -> Self {
-        self.audit = Some(audit);
-        self
-    }
-
-    #[must_use]
-    pub(crate) fn with_preauth_runtime(self, preauth: Option<Arc<PreAuthRuntime>>) -> Self {
-        let mut runtime = (*self.runtime_snapshot()).clone();
-        runtime.preauth = preauth;
-        self.publish_runtime_snapshot(Arc::new(runtime));
-        self
-    }
-
-    pub(crate) fn with_signer_readiness(self, signer_readiness: SignerReadiness) -> Self {
-        let current = self.issuer_runtime();
-        let mut runtime = (*self.runtime_snapshot()).clone();
-        runtime.issuer_runtime = Arc::new(IssuerRuntimeBundle {
-            issuers: current.issuers.clone(),
-            signer_readiness,
-        });
-        self.publish_runtime_snapshot(Arc::new(runtime));
-        self
-    }
-
-    pub(crate) fn with_posture_context(mut self, posture: PostureContext) -> Self {
-        self.posture = Some(Arc::new(posture));
-        self
-    }
-
-    pub(crate) fn with_deployment_gates(
-        mut self,
-        gates: crate::standalone::DeploymentGateState,
-    ) -> Self {
-        self.deployment_gates = Arc::new(gates);
-        self
-    }
-
-    pub(crate) fn with_config_governance(self, context: ConfigGovernanceContext) -> Self {
-        let mut runtime = (*self.runtime_snapshot()).clone();
-        runtime.config_governance = context;
-        self.publish_runtime_snapshot(Arc::new(runtime));
-        self
-    }
-
-    pub(crate) fn with_runtime_config(self, config: Arc<StandaloneRegistryNotaryConfig>) -> Self {
-        let mut runtime = (*self.runtime_snapshot()).clone();
-        runtime.runtime_config = Some(config);
-        self.publish_runtime_snapshot(Arc::new(runtime));
-        self
-    }
-
-    pub(super) fn runtime_snapshot(&self) -> Arc<ApiRuntimeSnapshot> {
-        self.runtime
-            .read()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-            .clone()
-    }
-
-    pub(super) fn publish_runtime_snapshot(&self, snapshot: Arc<ApiRuntimeSnapshot>) {
-        *self
-            .runtime
-            .write()
-            .unwrap_or_else(|poisoned| poisoned.into_inner()) = snapshot;
-    }
-
-    pub(crate) fn runtime_config(&self) -> Option<Arc<StandaloneRegistryNotaryConfig>> {
-        self.runtime_snapshot().runtime_config.clone()
-    }
-
-    pub(crate) fn deployment_gates_for_observation(
-        &self,
-        config: &StandaloneRegistryNotaryConfig,
-        observation: &registry_platform_ops::AckObservation,
-    ) -> crate::standalone::DeploymentGateState {
-        self.deployment_gates.evaluate_current(config, observation)
-    }
-
-    pub(crate) async fn current_audit_ack_observation(
-        &self,
-        config: &StandaloneRegistryNotaryConfig,
-    ) -> registry_platform_ops::AckObservation {
-        let observation = bounded_audit_ack_observation(config).await;
-        if !observation.requires_audit_tail_binding() {
-            return observation;
-        }
-        let tail = match &self.audit {
-            Some(audit) => audit.current_tail_hash_bounded().await,
-            None => None,
-        };
-        observation.bind_to_audit_tail(tail)
-    }
-
-    pub(crate) async fn current_deployment_gates(&self) -> crate::standalone::DeploymentGateState {
-        let Some(config) = self.runtime_config() else {
-            return (*self.deployment_gates).clone();
-        };
-        let observation = self.current_audit_ack_observation(&config).await;
-        self.deployment_gates_for_observation(&config, &observation)
-    }
-
-    pub(super) fn openapi_requires_auth(&self) -> bool {
-        self.auth_state.as_ref().map_or_else(
-            || {
-                self.runtime_config()
-                    .map(|config| config.server.openapi_requires_auth)
-                    .unwrap_or(true)
-            },
-            |auth_state| auth_state.openapi_requires_auth(),
-        )
-    }
-
-    pub(crate) fn federation_runtime(
-        &self,
-    ) -> Option<Arc<crate::federation::FederationRuntimeState>> {
-        self.runtime_snapshot().federation_runtime.clone()
-    }
-
-    pub(crate) fn config_apply_posture(&self) -> ConfigApplyPosture {
-        self.config_apply_posture
-            .read()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-            .clone()
-    }
-
-    pub(crate) fn record_config_apply(&self, posture: ConfigApplyPosture) {
-        *self
-            .config_apply_posture
-            .write()
-            .unwrap_or_else(|poisoned| poisoned.into_inner()) = posture;
-    }
-
-    pub(super) fn issuer_runtime(&self) -> Arc<IssuerRuntimeBundle> {
-        self.runtime_snapshot().issuer_runtime.clone()
-    }
-
-    pub(super) fn issuer_resolver(&self) -> Arc<dyn EvidenceIssuerResolver> {
-        self.issuer_runtime().issuers.clone()
-    }
-
-    pub(crate) fn signer_readiness(&self) -> SignerReadiness {
-        self.issuer_runtime().signer_readiness.clone()
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    #[must_use]
-    pub fn with_cel_worker(mut self, cel_worker: Option<Arc<CelWorker>>) -> Self {
-        self.cel_worker = cel_worker;
-        self
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    #[must_use]
-    pub(crate) fn with_cel_config(mut self, cel_config: Arc<RegistryNotaryCelConfig>) -> Self {
-        self.cel_config = cel_config;
-        self
-    }
-
-    pub(crate) fn runtime(&self) -> RegistryNotaryRuntime {
-        let runtime = RegistryNotaryRuntime::new_with_subject_access_rate_keys(Arc::clone(
-            &self.subject_access_rate_keys,
-        ))
-        .with_activated_relay(self.activated_relay.get().map(Arc::clone));
-        #[cfg(feature = "registry-notary-cel")]
-        {
-            runtime
-                .with_cel_worker(self.cel_worker.as_ref().map(Arc::clone))
-                .with_cel_config(Arc::clone(&self.cel_config))
-        }
-        #[cfg(not(feature = "registry-notary-cel"))]
-        {
-            runtime
-        }
-    }
-
-    pub(crate) fn install_activated_relay(
-        &self,
-        activated: Arc<dyn crate::runtime::ActivatedRelayConsultations>,
-    ) -> Result<(), ()> {
-        self.activated_relay.set(activated).map_err(|_| ())
-    }
-
-    pub(crate) fn relay_required(&self) -> bool {
-        !self.evidence.claims.is_empty()
-    }
-
-    pub(crate) fn relay_activated(&self) -> bool {
-        self.activated_relay.get().is_some()
-    }
-
-    #[cfg(test)]
-    pub(crate) async fn relay_ready(&self) -> bool {
-        if !self.relay_required() {
-            return true;
-        }
-        self.relay_readiness().await.is_ready()
-    }
-
-    pub(crate) async fn relay_readiness(&self) -> crate::runtime::RelayProfileReadiness {
-        let Some(relay) = self.activated_relay.get() else {
-            return crate::runtime::RelayProfileReadiness::all_failed(1);
-        };
-        // Hold this mutex across the bounded remote check. This keeps the
-        // public readiness endpoint from amplifying concurrent probes into
-        // concurrent Relay metadata requests.
-        let mut cache = self.relay_readiness.lock().await;
-        if cache
-            .checked_at
-            .is_some_and(|checked_at| checked_at.elapsed() < RELAY_READINESS_TTL)
-        {
-            return cache.readiness;
-        }
-        cache.readiness =
-            match tokio::time::timeout(RELAY_READINESS_TIMEOUT, relay.readiness()).await {
-                Ok(readiness) => readiness,
-                Err(_) => crate::runtime::RelayProfileReadiness::all_failed(relay.profile_count()),
-            };
-        // Cache timeout failures too, otherwise a slow or unavailable Relay
-        // would trigger a new request for every readiness probe.
-        cache.checked_at = Some(tokio::time::Instant::now());
-        cache.readiness
-    }
-
-    #[cfg(test)]
-    pub(super) async fn expire_relay_readiness_cache(&self) {
-        self.relay_readiness.lock().await.checked_at =
-            Some(tokio::time::Instant::now() - RELAY_READINESS_TTL);
-    }
-
-    pub(crate) fn enabled_evidence(&self) -> Result<&EvidenceConfig, EvidenceError> {
-        if self.evidence.enabled {
-            Ok(&self.evidence)
-        } else {
-            Err(EvidenceError::ServerDisabled)
-        }
-    }
-}
diff --git a/crates/registry-notary-server/src/api/status.rs b/crates/registry-notary-server/src/api/status.rs
deleted file mode 100644
index 0fdd17732..000000000
--- a/crates/registry-notary-server/src/api/status.rs
+++ /dev/null
@@ -1,338 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Credential status handlers and signed status-list caching.
-
-use super::*;
-
-pub(super) async fn get_credential_status(
-    Path(credential_id): Path<String>,
-    headers: HeaderMap,
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-) -> Response {
-    let Some(Extension(state)) = state else {
-        return credential_status_problem(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "credential_status.unavailable",
-            "Credential status unavailable",
-            "credential status is unavailable",
-        );
-    };
-    if !state.credential_status.is_enabled() {
-        return credential_status_problem(
-            StatusCode::NOT_FOUND,
-            "credential_status.disabled",
-            "Credential status disabled",
-            "credential status is not enabled",
-        );
-    }
-    match state.credential_status.get(&credential_id).await {
-        Ok(Some(record)) if accepts_status_list_jwt(&headers) => {
-            credential_status_list_response(&state, &record).await
-        }
-        Ok(Some(record)) => Json(record.response_body(OffsetDateTime::now_utc())).into_response(),
-        Ok(None) => credential_status_problem(
-            StatusCode::NOT_FOUND,
-            "credential_status.not_found",
-            "Credential status not found",
-            "credential status record was not found",
-        ),
-        Err(_) => credential_status_problem(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "credential_status.unavailable",
-            "Credential status unavailable",
-            "credential status store is unavailable",
-        ),
-    }
-}
-
-pub(super) fn accepts_status_list_jwt(headers: &HeaderMap) -> bool {
-    headers
-        .get(header::ACCEPT)
-        .and_then(|value| value.to_str().ok())
-        .is_some_and(|value| {
-            value.split(',').any(|part| {
-                part.split(';').next().is_some_and(|media_type| {
-                    media_type
-                        .trim()
-                        .eq_ignore_ascii_case("application/statuslist+jwt")
-                })
-            })
-        })
-}
-
-pub(super) async fn credential_status_list_response(
-    state: &RegistryNotaryApiState,
-    record: &CredentialStatusRecord,
-) -> Response {
-    let Ok(issuer) = state.issuer_resolver().issuer(&record.credential_profile) else {
-        return credential_status_problem(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "credential_status.unavailable",
-            "Credential status unavailable",
-            "credential status issuer is unavailable",
-        );
-    };
-    let now = OffsetDateTime::now_utc();
-    let ttl_seconds = 300_u64;
-    let Some(token_expires_at) = now.checked_add(time::Duration::seconds(ttl_seconds as i64))
-    else {
-        return credential_status_problem(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "credential_status.unavailable",
-            "Credential status unavailable",
-            "credential status token expiry could not be calculated",
-        );
-    };
-    let effective_status = record.effective_status(now);
-    let status_list = encoded_single_entry_status_list(&effective_status);
-    let status_url = state.credential_status.status_url(&record.credential_id);
-    let public_jwk = issuer.public_jwk();
-    let Ok(cache_key) = status_list_jwt_cache_key(
-        record,
-        &status_url,
-        &effective_status,
-        status_list,
-        ttl_seconds,
-        &public_jwk,
-    ) else {
-        return credential_status_problem(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "credential_status.unavailable",
-            "Credential status unavailable",
-            "credential status cache key could not be calculated",
-        );
-    };
-    let cache_expires_at =
-        status_list_jwt_cache_expires_at(record, &effective_status, token_expires_at);
-    let payload = json!({
-        "iss": record.issuer,
-        "sub": status_url,
-        "aud": status_url,
-        "iat": now.unix_timestamp(),
-        "exp": token_expires_at.unix_timestamp(),
-        "ttl": ttl_seconds,
-        "status_list": {
-            "bits": 8,
-            "lst": status_list,
-        }
-    });
-    let Ok(token) = state
-        .status_list_jwt_cache
-        .get_or_insert_with(cache_key, now, cache_expires_at, || async move {
-            issuer.sign_compact_jwt("statuslist+jwt", payload).await
-        })
-        .await
-    else {
-        return credential_status_problem(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "credential_status.unavailable",
-            "Credential status unavailable",
-            "credential status token could not be signed",
-        );
-    };
-    let mut response = token.into_response();
-    response.headers_mut().insert(
-        header::CONTENT_TYPE,
-        HeaderValue::from_static("application/statuslist+jwt"),
-    );
-    response
-}
-
-#[derive(Debug)]
-pub(super) struct StatusListJwtCache {
-    pub(super) entries: tokio::sync::Mutex<BTreeMap<String, StatusListJwtCacheEntry>>,
-}
-
-#[derive(Debug)]
-pub(super) struct StatusListJwtCacheEntry {
-    pub(super) token: String,
-    pub(super) expires_at: OffsetDateTime,
-}
-
-impl Default for StatusListJwtCache {
-    fn default() -> Self {
-        Self {
-            entries: tokio::sync::Mutex::new(BTreeMap::new()),
-        }
-    }
-}
-
-impl StatusListJwtCache {
-    pub(super) async fn get_or_insert_with<F, Fut>(
-        &self,
-        key: String,
-        now: OffsetDateTime,
-        expires_at: OffsetDateTime,
-        sign: F,
-    ) -> Result<String, EvidenceError>
-    where
-        F: FnOnce() -> Fut,
-        Fut: std::future::Future<Output = Result<String, EvidenceError>>,
-    {
-        {
-            let mut entries = self.entries.lock().await;
-            entries.retain(|_, entry| entry.expires_at > now);
-            if let Some(entry) = entries.get(&key) {
-                return Ok(entry.token.clone());
-            }
-        }
-
-        let token = sign().await?;
-
-        let mut entries = self.entries.lock().await;
-        entries.retain(|_, entry| entry.expires_at > now);
-        if let Some(entry) = entries.get(&key) {
-            return Ok(entry.token.clone());
-        }
-        if expires_at > now {
-            entries.insert(
-                key,
-                StatusListJwtCacheEntry {
-                    token: token.clone(),
-                    expires_at,
-                },
-            );
-        }
-        Ok(token)
-    }
-}
-
-pub(super) fn status_list_jwt_cache_key(
-    record: &CredentialStatusRecord,
-    status_url: &str,
-    effective_status: &str,
-    status_list: &str,
-    ttl_seconds: u64,
-    public_jwk: &Value,
-) -> Result<String, serde_json::Error> {
-    let public_jwk_hash = sha256_json(public_jwk)?;
-    let key_material = json!({
-        "typ": "statuslist+jwt",
-        "issuer": record.issuer,
-        "issuer_public_jwk_sha256": public_jwk_hash,
-        "audience": status_url,
-        "credential_id": record.credential_id,
-        "credential_profile": record.credential_profile,
-        "status_url": status_url,
-        "status": record.status,
-        "effective_status": effective_status,
-        "issued_at": record.issued_at,
-        "expires_at": record.expires_at,
-        "updated_at": record.updated_at,
-        "ttl": ttl_seconds,
-        "status_list": {
-            "bits": 8,
-            "lst": status_list,
-        }
-    });
-    sha256_json(&key_material)
-}
-
-pub(super) fn status_list_jwt_cache_expires_at(
-    record: &CredentialStatusRecord,
-    effective_status: &str,
-    token_expires_at: OffsetDateTime,
-) -> OffsetDateTime {
-    if record.status == registry_notary_core::CREDENTIAL_STATUS_VALID
-        && effective_status == registry_notary_core::CREDENTIAL_STATUS_VALID
-    {
-        return OffsetDateTime::parse(
-            &record.expires_at,
-            &time::format_description::well_known::Rfc3339,
-        )
-        .ok()
-        .filter(|credential_expires_at| *credential_expires_at < token_expires_at)
-        .unwrap_or(token_expires_at);
-    }
-    token_expires_at
-}
-
-#[derive(Debug, Deserialize)]
-pub(super) struct CredentialStatusUpdateRequest {
-    pub(super) status: String,
-}
-
-pub(super) async fn update_credential_status(
-    Path(credential_id): Path<String>,
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    principal: Option<Extension<EvidencePrincipal>>,
-    Json(request): Json<CredentialStatusUpdateRequest>,
-) -> Response {
-    let Some(Extension(principal)) = principal else {
-        return evidence_error_response(EvidenceError::MissingCredential);
-    };
-    if !principal.has_scope(ADMIN_SCOPE) {
-        return evidence_error_response(EvidenceError::ScopeDenied {
-            required: ADMIN_SCOPE.to_string(),
-        });
-    }
-    let Some(Extension(state)) = state else {
-        return credential_status_problem(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "credential_status.unavailable",
-            "Credential status unavailable",
-            "credential status is unavailable",
-        );
-    };
-    if !state.credential_status.is_enabled() {
-        return credential_status_problem(
-            StatusCode::NOT_FOUND,
-            "credential_status.disabled",
-            "Credential status disabled",
-            "credential status is not enabled",
-        );
-    }
-    if !is_mutable_status(request.status.as_str()) {
-        return credential_status_problem(
-            StatusCode::BAD_REQUEST,
-            "credential_status.invalid_status",
-            "Invalid credential status",
-            "status must be valid, suspended, or revoked",
-        );
-    }
-    match state
-        .credential_status
-        .update_status(&credential_id, &request.status)
-        .await
-    {
-        Ok(Some(record)) => Json(record.response_body(OffsetDateTime::now_utc())).into_response(),
-        Ok(None) => credential_status_problem(
-            StatusCode::NOT_FOUND,
-            "credential_status.not_found",
-            "Credential status not found",
-            "credential status record was not found",
-        ),
-        Err(CredentialStatusStoreError::InvalidTransition) => credential_status_problem(
-            StatusCode::CONFLICT,
-            "credential_status.invalid_transition",
-            "Invalid credential status transition",
-            "revoked credential status is terminal",
-        ),
-        Err(_) => credential_status_problem(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "credential_status.unavailable",
-            "Credential status unavailable",
-            "credential status store is unavailable",
-        ),
-    }
-}
-
-pub(super) fn credential_status_problem(
-    status: StatusCode,
-    code: &'static str,
-    title: &'static str,
-    detail: &'static str,
-) -> Response {
-    let body = json!({
-        "type": format!("{}/{}", crate::PROBLEM_TYPE_BASE_URL, code.replace('.', "/")),
-        "title": title,
-        "status": status.as_u16(),
-        "detail": detail,
-        "code": code,
-    });
-    let mut response = (status, Json(body)).into_response();
-    response.headers_mut().insert(
-        header::CONTENT_TYPE,
-        HeaderValue::from_static("application/problem+json"),
-    );
-    response
-}
diff --git a/crates/registry-notary-server/src/api/subject_access_policy.rs b/crates/registry-notary-server/src/api/subject_access_policy.rs
deleted file mode 100644
index 6909d5abd..000000000
--- a/crates/registry-notary-server/src/api/subject_access_policy.rs
+++ /dev/null
@@ -1,1513 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Subject-bound and delegated subject-access authorization policy.
-
-use super::*;
-
-#[derive(Debug)]
-pub(super) struct SubjectAccessEvaluateContext {
-    pub(super) evaluation_capability: EvaluationCapability,
-    pub(super) metadata: StoredSubjectAccessMetadata,
-    pub(super) purpose: String,
-}
-pub(super) async fn consume_classification_denial_if_keyable(
-    state: &RegistryNotaryApiState,
-    principal: &EvidencePrincipal,
-) -> Result<(), SubjectAccessRateLimitError> {
-    if principal.verified_claims.is_none() {
-        return Ok(());
-    }
-    let principal_hash = state
-        .subject_access_rate_keys
-        .principal(&principal.principal_id)?;
-    state
-        .subject_access_rate_limiter
-        .check_authenticated_request(&principal_hash)
-        .await
-}
-
-pub(super) fn classify_subject_access_principal(
-    config: &SubjectAccessConfig,
-    principal: &EvidencePrincipal,
-) -> Result<EvidencePrincipal, EvidenceError> {
-    if !config.enabled {
-        if principal.is_subject_access() {
-            return Err(subject_access_denied(SubjectAccessDenialCode::Disabled));
-        }
-        return Ok(principal.clone());
-    }
-
-    // A locally verified transaction-scoped token minted from a
-    // registry-client offer remains machine authority. Its opaque `sub` lets
-    // the wallet present the token, but must never reclassify the wallet as the
-    // civil subject. The encrypted issuance transaction is the authority.
-    if principal.auth_profile_id == registry_notary_core::EvidenceAuthProfileId::NotaryAccessToken
-        && principal.verified_claims.is_some()
-        && principal
-            .authorization_details
-            .as_ref()
-            .is_some_and(|details| {
-                details.access_mode == Some(AccessMode::MachineClient)
-                    && details.actions.as_slice() == ["issue_credential"]
-                    && crate::authz_details::has_transaction_scope(details)
-            })
-    {
-        let mut classified = principal.clone();
-        classified.access_mode = AccessMode::MachineClient;
-        return Ok(classified);
-    }
-
-    let citizen_scope_signal = config
-        .required_scopes
-        .iter()
-        .any(|scope| principal.has_scope(scope));
-    if principal.verified_claims.is_none() && citizen_scope_signal {
-        return Err(subject_access_denied(SubjectAccessDenialCode::InvalidToken));
-    }
-    let citizen_client_signal = principal
-        .verified_claims
-        .as_ref()
-        .is_some_and(|claims| citizen_client_or_audience_matches(config, claims));
-    let subject_access_candidate =
-        principal.is_subject_access() || citizen_scope_signal || citizen_client_signal;
-    if !subject_access_candidate {
-        return Ok(principal.clone());
-    }
-
-    let Some(verified_claims) = principal.verified_claims.as_ref() else {
-        return Err(subject_access_denied(SubjectAccessDenialCode::InvalidToken));
-    };
-    if !citizen_client_or_audience_matches(config, verified_claims) {
-        return Err(subject_access_denied(SubjectAccessDenialCode::InvalidToken));
-    }
-    if !subject_access_scope_policy_allows(config, principal, verified_claims) {
-        return Err(subject_access_denied(SubjectAccessDenialCode::InvalidToken));
-    }
-
-    let mut classified = principal.clone();
-    classified.access_mode = AccessMode::SubjectBound;
-    Ok(classified)
-}
-
-pub(super) fn subject_access_scope_policy_allows(
-    config: &SubjectAccessConfig,
-    principal: &EvidencePrincipal,
-    verified_claims: &registry_notary_core::BoundedVerifiedClaims,
-) -> bool {
-    match config.scope_policy {
-        SubjectAccessScopePolicy::Required => config
-            .required_scopes
-            .iter()
-            .all(|scope| principal.has_scope(scope) || verified_claims.has_scope(scope)),
-        SubjectAccessScopePolicy::Optional => {
-            let saw_scope_signal =
-                !principal.scopes.is_empty() || !verified_claims.scopes.is_empty();
-            !saw_scope_signal
-                || config
-                    .required_scopes
-                    .iter()
-                    .all(|scope| principal.has_scope(scope) || verified_claims.has_scope(scope))
-        }
-        SubjectAccessScopePolicy::Disabled => true,
-    }
-}
-
-pub(super) fn citizen_client_or_audience_matches(
-    config: &SubjectAccessConfig,
-    claims: &registry_notary_core::BoundedVerifiedClaims,
-) -> bool {
-    let client_matches = claims.client_id.as_ref().is_some_and(|client_id| {
-        config
-            .citizen_clients
-            .allowed_client_ids
-            .iter()
-            .any(|allowed| verified_client_matches(client_id.as_str(), allowed))
-    });
-    let audience_matches = claims.audiences.iter().any(|audience| {
-        config
-            .citizen_clients
-            .allowed_audiences
-            .iter()
-            .any(|allowed| audience.as_str() == allowed)
-    });
-    client_matches || audience_matches
-}
-
-pub(super) fn verified_client_matches(candidate: &str, allowed: &str) -> bool {
-    candidate == allowed
-        || candidate
-            .strip_prefix("azp:")
-            .or_else(|| candidate.strip_prefix("client_id:"))
-            .is_some_and(|raw| raw == allowed)
-}
-
-#[cfg(test)]
-pub(super) fn require_subject_access_evaluate(
-    evidence: &EvidenceConfig,
-    config: &SubjectAccessConfig,
-    principal: &EvidencePrincipal,
-    request: &EvaluateRequest,
-) -> Result<(), EvidenceError> {
-    require_subject_access_evaluation_for_operation(
-        evidence,
-        config,
-        principal,
-        request,
-        None,
-        SubjectAccessEvaluationOperation::Evaluate,
-    )
-}
-
-#[derive(Clone, Copy)]
-enum SubjectAccessEvaluationOperation {
-    Evaluate,
-    IssueCredential,
-}
-
-fn require_subject_access_evaluation_for_operation(
-    evidence: &EvidenceConfig,
-    config: &SubjectAccessConfig,
-    principal: &EvidencePrincipal,
-    request: &EvaluateRequest,
-    runtime_config: Option<&StandaloneRegistryNotaryConfig>,
-    operation: SubjectAccessEvaluationOperation,
-) -> Result<(), EvidenceError> {
-    let operation_allowed = match operation {
-        SubjectAccessEvaluationOperation::Evaluate => config.allowed_operations.evaluate,
-        SubjectAccessEvaluationOperation::IssueCredential => {
-            config.allowed_operations.issue_credential
-        }
-    };
-    if !operation_allowed {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::OperationDenied,
-        ));
-    }
-    let request_claim_ids = claim_ids(&request.claims);
-    if request.claims.is_empty()
-        || !request.claims.iter().all(|claim_id| {
-            config
-                .allowed_claims
-                .iter()
-                .any(|allowed| allowed == &claim_id.id)
-        })
-    {
-        return Err(subject_access_denied(SubjectAccessDenialCode::ClaimDenied));
-    }
-
-    let format = request
-        .format
-        .as_deref()
-        .unwrap_or(FORMAT_CLAIM_RESULT_JSON);
-    if !config
-        .allowed_formats
-        .iter()
-        .any(|allowed| allowed == format)
-    {
-        return Err(subject_access_denied(SubjectAccessDenialCode::FormatDenied));
-    }
-
-    let disclosure =
-        selected_disclosure(evidence, &request_claim_ids, request.disclosure.as_deref())
-            .map_err(|_| subject_access_denied(SubjectAccessDenialCode::DisclosureDenied))?;
-    if !config
-        .allowed_disclosures
-        .iter()
-        .any(|allowed| allowed == &disclosure)
-        || !request
-            .claims
-            .iter()
-            .all(|claim_id| claim_allows_disclosure(evidence, claim_id, &disclosure))
-    {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DisclosureDenied,
-        ));
-    }
-
-    for claim_id in &request.claims {
-        let claim = find_requested_claim(evidence, claim_id)
-            .map_err(|_| subject_access_denied(SubjectAccessDenialCode::ClaimDenied))?;
-        if !claim.operations.evaluate.enabled {
-            return Err(subject_access_denied(
-                SubjectAccessDenialCode::OperationDenied,
-            ));
-        }
-        if claim.purpose.as_deref().is_none_or(|purpose| {
-            !config
-                .allowed_purposes
-                .iter()
-                .any(|allowed| allowed == purpose)
-        }) {
-            return Err(subject_access_denied(
-                SubjectAccessDenialCode::OperationDenied,
-            ));
-        }
-    }
-
-    let purpose = common_subject_access_purpose(evidence, &request.claims)?;
-    if request
-        .purpose
-        .as_deref()
-        .is_some_and(|requested| requested != purpose)
-    {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::OperationDenied,
-        ));
-    }
-    require_subject_access_authorization_details(
-        evidence.service_id.as_str(),
-        config,
-        principal,
-        request,
-        &disclosure,
-        format,
-        &purpose,
-        runtime_config,
-    )?;
-
-    let subject_binding = &config.subject_binding;
-    let Some(target_subject) = request.target_subject() else {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::SubjectMismatch,
-        ));
-    };
-    if target_subject.id.trim().is_empty() {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::SubjectMismatch,
-        ));
-    }
-    if target_subject.id_type.as_deref() != Some(subject_binding.id_type.as_str()) {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::SubjectMismatch,
-        ));
-    }
-    let Some(bound_subject) =
-        principal.verified_subject_binding_value(&subject_binding.token_claim)
-    else {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::SubjectClaimMissing,
-        ));
-    };
-    if bound_subject != target_subject.id {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::SubjectMismatch,
-        ));
-    }
-    Ok(())
-}
-
-#[allow(clippy::too_many_arguments)]
-pub(super) fn require_subject_access_authorization_details(
-    service_id: &str,
-    config: &SubjectAccessConfig,
-    principal: &EvidencePrincipal,
-    request: &EvaluateRequest,
-    disclosure: &str,
-    format: &str,
-    purpose: &str,
-    runtime_config: Option<&StandaloneRegistryNotaryConfig>,
-) -> Result<(), EvidenceError> {
-    let Some(details) = principal.authorization_details.as_ref() else {
-        if subject_access_requires_authorization_details(principal, runtime_config) {
-            return Err(subject_access_denied(
-                SubjectAccessDenialCode::OperationDenied,
-            ));
-        }
-        return Ok(());
-    };
-
-    crate::authz_details::validate_scoped_authorization_details(
-        details,
-        &crate::authz_details::ScopedAuthorizationRequest {
-            service_id,
-            action: "evaluate",
-            claims: &request.claims,
-            disclosure,
-            format,
-            purpose,
-            access_mode: AccessMode::SubjectBound,
-            subject: Some(crate::authz_details::ScopedAuthorizationSubject {
-                binding_claim: config.subject_binding.token_claim.clone(),
-                id_type: config.subject_binding.id_type.clone(),
-            }),
-            target: None,
-            allow_subset_claims: false,
-            allowed_claims: None,
-        },
-    )
-    .map_err(subject_access_authorization_details_denial)
-}
-
-pub(super) fn delegated_relationship_config<'a>(
-    config: &'a SubjectAccessConfig,
-    principal: &EvidencePrincipal,
-) -> Result<&'a SubjectAccessDelegatedRelationshipConfig, EvidenceError> {
-    let details = principal.authorization_details.as_ref().ok_or_else(|| {
-        subject_access_denied(SubjectAccessDenialCode::DelegatedRelationshipNotAllowed)
-    })?;
-    let relationship = details.relationship.as_ref().ok_or_else(|| {
-        subject_access_denied(SubjectAccessDenialCode::DelegatedRelationshipNotAllowed)
-    })?;
-    let relationship_config = config
-        .delegation
-        .relationship(&relationship.relationship_type)
-        .ok_or_else(|| {
-            subject_access_denied(SubjectAccessDenialCode::DelegatedRelationshipNotAllowed)
-        })?;
-    if relationship_config.proof_claim != relationship.proof_claim {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedRelationshipNotAllowed,
-        ));
-    }
-    Ok(relationship_config)
-}
-
-pub(super) fn require_delegated_subject_access_evaluate(
-    evidence: &EvidenceConfig,
-    config: &SubjectAccessConfig,
-    principal: &EvidencePrincipal,
-    request: &EvaluateRequest,
-) -> Result<(), EvidenceError> {
-    if !config.allowed_operations.evaluate || !config.delegation.enabled {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedRelationshipNotAllowed,
-        ));
-    }
-    if request.claims.len() != 1 {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedClaimDenied,
-        ));
-    }
-    let relationship_config = delegated_relationship_config(config, principal)?;
-    let requested_claim = request
-        .claims
-        .first()
-        .ok_or_else(|| subject_access_denied(SubjectAccessDenialCode::DelegatedClaimDenied))?;
-    if !relationship_config
-        .allowed_claims
-        .iter()
-        .any(|allowed| allowed == &requested_claim.id)
-    {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedClaimDenied,
-        ));
-    }
-    let claim = find_requested_claim(evidence, requested_claim)
-        .map_err(|_| subject_access_denied(SubjectAccessDenialCode::DelegatedClaimDenied))?;
-    let proof_claim = find_requested_claim(
-        evidence,
-        &ClaimRef::from(relationship_config.proof_claim.as_str()),
-    )
-    .map_err(|_| subject_access_denied(SubjectAccessDenialCode::DelegatedProofDenied))?;
-    if !claim.operations.evaluate.enabled || !proof_claim.operations.evaluate.enabled {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedClaimDenied,
-        ));
-    }
-    if !claim
-        .depends_on
-        .iter()
-        .any(|depends_on| depends_on == &relationship_config.proof_claim)
-    {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedClaimDenied,
-        ));
-    }
-
-    let purpose = claim
-        .purpose
-        .as_deref()
-        .ok_or_else(|| subject_access_denied(SubjectAccessDenialCode::DelegatedClaimDenied))?;
-    if !relationship_config
-        .allowed_purposes
-        .iter()
-        .any(|allowed| allowed == purpose)
-        || request
-            .purpose
-            .as_deref()
-            .is_some_and(|requested| requested != purpose)
-    {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedClaimDenied,
-        ));
-    }
-    let format = request
-        .format
-        .as_deref()
-        .unwrap_or(FORMAT_CLAIM_RESULT_JSON);
-    if !relationship_config
-        .allowed_formats
-        .iter()
-        .any(|allowed| allowed == format)
-    {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedClaimDenied,
-        ));
-    }
-    let request_claim_ids = claim_ids(&request.claims);
-    let disclosure =
-        selected_disclosure(evidence, &request_claim_ids, request.disclosure.as_deref())
-            .map_err(|_| subject_access_denied(SubjectAccessDenialCode::DelegatedClaimDenied))?;
-    if !relationship_config
-        .allowed_disclosures
-        .iter()
-        .any(|allowed| allowed == &disclosure)
-        || !claim_allows_disclosure(evidence, requested_claim, &disclosure)
-    {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedClaimDenied,
-        ));
-    }
-    let Some(target_subject) = request.target_subject() else {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedSubjectNotPermitted,
-        ));
-    };
-    if target_subject.id.trim().is_empty()
-        || target_subject.id_type.as_deref()
-            != Some(delegated_target_id_type(config, relationship_config))
-    {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedSubjectNotPermitted,
-        ));
-    }
-    require_delegated_subject_access_authorization_details(
-        evidence,
-        config,
-        principal,
-        request,
-        relationship_config,
-        claim,
-        proof_claim,
-        &disclosure,
-        format,
-        purpose,
-    )
-}
-
-#[allow(clippy::too_many_arguments)]
-pub(super) fn require_delegated_subject_access_authorization_details(
-    evidence: &EvidenceConfig,
-    config: &SubjectAccessConfig,
-    principal: &EvidencePrincipal,
-    request: &EvaluateRequest,
-    relationship_config: &SubjectAccessDelegatedRelationshipConfig,
-    claim: &registry_notary_core::ClaimDefinition,
-    proof_claim: &registry_notary_core::ClaimDefinition,
-    disclosure: &str,
-    format: &str,
-    purpose: &str,
-) -> Result<(), EvidenceError> {
-    let Some(details) = principal.authorization_details.as_ref() else {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedRelationshipNotAllowed,
-        ));
-    };
-    let target_subject = request.target_subject().ok_or_else(|| {
-        subject_access_denied(SubjectAccessDenialCode::DelegatedSubjectNotPermitted)
-    })?;
-    let target_id_type = delegated_target_id_type(config, relationship_config);
-    if target_subject.id.trim().is_empty()
-        || target_subject.id_type.as_deref() != Some(target_id_type)
-    {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedSubjectNotPermitted,
-        ));
-    }
-    let authorized_claims = [
-        ClaimRef::with_version(&claim.id, &claim.version),
-        ClaimRef::with_version(&proof_claim.id, &proof_claim.version),
-    ];
-    crate::authz_details::validate_scoped_authorization_details(
-        details,
-        &crate::authz_details::ScopedAuthorizationRequest {
-            service_id: evidence.service_id.as_str(),
-            action: "evaluate",
-            claims: &authorized_claims,
-            disclosure,
-            format,
-            purpose,
-            access_mode: AccessMode::DelegatedSubjectAccess,
-            subject: Some(crate::authz_details::ScopedAuthorizationSubject {
-                binding_claim: config.subject_binding.token_claim.clone(),
-                id_type: config.subject_binding.id_type.clone(),
-            }),
-            target: Some(crate::authz_details::ScopedAuthorizationTarget {
-                id_type: target_id_type.to_string(),
-                id: target_subject.id.clone(),
-            }),
-            allow_subset_claims: true,
-            allowed_claims: Some(&authorized_claims),
-        },
-    )
-    .map_err(delegated_subject_access_authorization_details_denial)?;
-    let relationship = details.relationship.as_ref().ok_or_else(|| {
-        subject_access_denied(SubjectAccessDenialCode::DelegatedRelationshipNotAllowed)
-    })?;
-    if relationship.relationship_type != relationship_config.relationship_type
-        || relationship.proof_claim != relationship_config.proof_claim
-    {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedRelationshipNotAllowed,
-        ));
-    }
-    if request
-        .relationship
-        .as_ref()
-        .map(|relationship| relationship.relationship_type.as_str())
-        != Some(relationship_config.relationship_type.as_str())
-    {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedSubjectNotPermitted,
-        ));
-    }
-    Ok(())
-}
-
-pub(super) fn subject_access_requires_authorization_details(
-    principal: &EvidencePrincipal,
-    runtime_config: Option<&StandaloneRegistryNotaryConfig>,
-) -> bool {
-    let Some(claims) = principal.verified_claims.as_ref() else {
-        return false;
-    };
-    let Some(token_type) = claims.token_type.as_ref() else {
-        return false;
-    };
-    if token_type.as_str() != registry_notary_core::tokens::NOTARY_TRANSACTION_TOKEN_JWT_TYP {
-        return false;
-    }
-    let Some(config) = runtime_config else {
-        return true;
-    };
-    let signing = &config.auth.access_token_signing;
-    signing.enabled && claims.issuer.as_str() == signing.issuer
-}
-
-pub(super) fn subject_access_authorization_details_denial(
-    error: crate::authz_details::ScopedAuthorizationError,
-) -> EvidenceError {
-    let reason = match error {
-        crate::authz_details::ScopedAuthorizationError::Claim => {
-            SubjectAccessDenialCode::ClaimDenied
-        }
-        crate::authz_details::ScopedAuthorizationError::Disclosure => {
-            SubjectAccessDenialCode::DisclosureDenied
-        }
-        crate::authz_details::ScopedAuthorizationError::Format => {
-            SubjectAccessDenialCode::FormatDenied
-        }
-        crate::authz_details::ScopedAuthorizationError::Subject => {
-            SubjectAccessDenialCode::SubjectMismatch
-        }
-        crate::authz_details::ScopedAuthorizationError::Target => {
-            SubjectAccessDenialCode::SubjectMismatch
-        }
-        crate::authz_details::ScopedAuthorizationError::DetailType
-        | crate::authz_details::ScopedAuthorizationError::Action
-        | crate::authz_details::ScopedAuthorizationError::Location
-        | crate::authz_details::ScopedAuthorizationError::Purpose
-        | crate::authz_details::ScopedAuthorizationError::AccessMode => {
-            SubjectAccessDenialCode::OperationDenied
-        }
-    };
-    subject_access_denied(reason)
-}
-
-pub(super) fn delegated_subject_access_authorization_details_denial(
-    error: crate::authz_details::ScopedAuthorizationError,
-) -> EvidenceError {
-    let reason = match error {
-        crate::authz_details::ScopedAuthorizationError::Claim
-        | crate::authz_details::ScopedAuthorizationError::Disclosure
-        | crate::authz_details::ScopedAuthorizationError::Format
-        | crate::authz_details::ScopedAuthorizationError::Purpose => {
-            SubjectAccessDenialCode::DelegatedClaimDenied
-        }
-        crate::authz_details::ScopedAuthorizationError::Subject => {
-            SubjectAccessDenialCode::DelegatedSubjectNotPermitted
-        }
-        crate::authz_details::ScopedAuthorizationError::Target => {
-            SubjectAccessDenialCode::DelegatedSubjectNotPermitted
-        }
-        crate::authz_details::ScopedAuthorizationError::DetailType
-        | crate::authz_details::ScopedAuthorizationError::Action
-        | crate::authz_details::ScopedAuthorizationError::Location
-        | crate::authz_details::ScopedAuthorizationError::AccessMode => {
-            SubjectAccessDenialCode::DelegatedRelationshipNotAllowed
-        }
-    };
-    subject_access_denied(reason)
-}
-
-pub(super) fn find_requested_claim<'a>(
-    evidence: &'a EvidenceConfig,
-    claim: &ClaimRef,
-) -> Result<&'a registry_notary_core::ClaimDefinition, EvidenceError> {
-    match claim.version.as_deref() {
-        Some(version) => crate::runtime::find_claim_version(evidence, &claim.id, version),
-        None => crate::find_claim(evidence, &claim.id),
-    }
-}
-
-pub(super) fn common_subject_access_purpose(
-    evidence: &EvidenceConfig,
-    claims: &[ClaimRef],
-) -> Result<String, EvidenceError> {
-    if claims.is_empty() {
-        return Err(subject_access_denied(SubjectAccessDenialCode::ClaimDenied));
-    }
-    let mut purpose = None;
-    for claim_ref in claims {
-        let claim = find_requested_claim(evidence, claim_ref)
-            .map_err(|_| subject_access_denied(SubjectAccessDenialCode::ClaimDenied))?;
-        let claim_purpose = claim
-            .purpose
-            .as_deref()
-            .ok_or_else(|| subject_access_denied(SubjectAccessDenialCode::OperationDenied))?;
-        if let Some(existing) = purpose {
-            if existing != claim_purpose {
-                return Err(subject_access_denied(
-                    SubjectAccessDenialCode::OperationDenied,
-                ));
-            }
-        } else {
-            purpose = Some(claim_purpose);
-        }
-    }
-    purpose
-        .map(str::to_string)
-        .ok_or_else(|| subject_access_denied(SubjectAccessDenialCode::ClaimDenied))
-}
-
-pub(super) fn prepare_subject_access_evaluate(
-    state: &RegistryNotaryApiState,
-    evidence: &EvidenceConfig,
-    principal: &EvidencePrincipal,
-    request: &EvaluateRequest,
-) -> Result<SubjectAccessEvaluateContext, EvidenceError> {
-    prepare_subject_access_evaluation_for_operation(
-        state,
-        evidence,
-        principal,
-        request,
-        SubjectAccessEvaluationOperation::Evaluate,
-    )
-}
-
-pub(super) fn prepare_subject_access_credential_evaluation(
-    state: &RegistryNotaryApiState,
-    evidence: &EvidenceConfig,
-    principal: &EvidencePrincipal,
-    request: &EvaluateRequest,
-) -> Result<SubjectAccessEvaluateContext, EvidenceError> {
-    prepare_subject_access_evaluation_for_operation(
-        state,
-        evidence,
-        principal,
-        request,
-        SubjectAccessEvaluationOperation::IssueCredential,
-    )
-}
-
-fn prepare_subject_access_evaluation_for_operation(
-    state: &RegistryNotaryApiState,
-    evidence: &EvidenceConfig,
-    principal: &EvidencePrincipal,
-    request: &EvaluateRequest,
-    operation: SubjectAccessEvaluationOperation,
-) -> Result<SubjectAccessEvaluateContext, EvidenceError> {
-    if principal.access_mode() == AccessMode::DelegatedSubjectAccess {
-        return prepare_delegated_subject_access_evaluate(state, evidence, principal, request);
-    }
-    let runtime_config = state.runtime_config();
-    require_subject_access_evaluation_for_operation(
-        evidence,
-        &state.subject_access,
-        principal,
-        request,
-        runtime_config.as_deref(),
-        operation,
-    )?;
-    require_subject_access_token_policy(&state.subject_access, principal)?;
-
-    let purpose = common_subject_access_purpose(evidence, &request.claims)?;
-    let format = request
-        .format
-        .as_deref()
-        .unwrap_or(FORMAT_CLAIM_RESULT_JSON)
-        .to_string();
-    let request_claim_ids = claim_ids(&request.claims);
-    let disclosure =
-        selected_disclosure(evidence, &request_claim_ids, request.disclosure.as_deref()).map_err(
-            |_| EvidenceError::SubjectAccessDenied {
-                reason: SubjectAccessDenialCode::DisclosureDenied,
-            },
-        )?;
-    let claims = principal
-        .verified_claims
-        .as_ref()
-        .ok_or(EvidenceError::SubjectAccessInvalidToken)?;
-    let subject_binding_value = principal
-        .verified_subject_binding_value(&state.subject_access.subject_binding.token_claim)
-        .ok_or(EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::SubjectClaimMissing,
-        })?;
-    let principal_hash = state
-        .subject_access_rate_keys
-        .principal(&principal.principal_id)
-        .map_err(|error| error.evidence_error())?;
-    let subject_binding_hash = state
-        .subject_access_rate_keys
-        .subject_binding(subject_binding_value)
-        .map_err(|error| error.evidence_error())?;
-    let requested_claims_hash =
-        Hashed::<ClaimSet>::from_hash(evidence_claim_hash(&request_claim_ids));
-    let policy_hash = subject_access_policy_hash(
-        evidence,
-        &state.subject_access,
-        &request_claim_ids,
-        &disclosure,
-        &format,
-    )?;
-    let now = OffsetDateTime::now_utc();
-    let evaluation_expires_at = now
-        + time::Duration::seconds(
-            state.subject_access.token_policy.max_evaluation_age_seconds as i64,
-        );
-
-    let metadata = StoredSubjectAccessMetadata {
-        access_mode: AccessMode::SubjectBound,
-        issuer: claims.issuer.clone(),
-        audiences: claims.audiences.clone(),
-        client_id: claims.client_id.clone(),
-        principal_hash,
-        subject_id_type: ConfigMetadata::new(state.subject_access.subject_binding.id_type.clone())
-            .map_err(|_| EvidenceError::InvalidRequest)?,
-        subject_binding_claim: ConfigMetadata::new(
-            state.subject_access.subject_binding.token_claim.clone(),
-        )
-        .map_err(|_| EvidenceError::InvalidRequest)?,
-        subject_binding_hash: subject_binding_hash.clone(),
-        dependent_target_hash: None,
-        relationship_type: None,
-        proof_claim_id: None,
-        requested_claims_hash,
-        disclosure: ConfigMetadata::new(disclosure.clone())
-            .map_err(|_| EvidenceError::InvalidRequest)?,
-        result_format: ConfigMetadata::new(format).map_err(|_| EvidenceError::InvalidRequest)?,
-        delegation_chain: Vec::new(),
-        policy_version: None,
-        policy_hash: Some(policy_hash.clone()),
-        evaluation_expires_at: Some(format_time(evaluation_expires_at)),
-    };
-    let root_claim_id = (request_claim_ids.len() == 1)
-        .then(|| BoundedClaimId::new(request_claim_ids[0].clone()))
-        .transpose()
-        .map_err(|_| EvidenceError::InvalidRequest)?;
-    let claim_versions = requested_claim_versions(&request.claims)?;
-    let levels = build_claim_levels(evidence, &request.claims, &claim_versions)?;
-    let mut allowed_claim_ids = BTreeSet::new();
-    for claim_id in levels.into_iter().flatten() {
-        allowed_claim_ids
-            .insert(BoundedClaimId::new(claim_id).map_err(|_| EvidenceError::InvalidRequest)?);
-    }
-    let evaluation_capability = EvaluationCapability::SubjectBound {
-        claim_id: root_claim_id,
-        allowed_claim_ids,
-        subject_binding_hash,
-    };
-
-    Ok(SubjectAccessEvaluateContext {
-        evaluation_capability,
-        metadata,
-        purpose,
-    })
-}
-
-pub(super) fn prepare_delegated_subject_access_evaluate(
-    state: &RegistryNotaryApiState,
-    evidence: &EvidenceConfig,
-    principal: &EvidencePrincipal,
-    request: &EvaluateRequest,
-) -> Result<SubjectAccessEvaluateContext, EvidenceError> {
-    require_delegated_subject_access_evaluate(evidence, &state.subject_access, principal, request)?;
-    require_subject_access_token_policy(&state.subject_access, principal)?;
-
-    let relationship_config = delegated_relationship_config(&state.subject_access, principal)?;
-    let claim_id = request
-        .claims
-        .first()
-        .ok_or(EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::DelegatedClaimDenied,
-        })?;
-    let claim = find_requested_claim(evidence, claim_id).map_err(|_| {
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::DelegatedClaimDenied,
-        }
-    })?;
-    let purpose = claim
-        .purpose
-        .clone()
-        .ok_or(EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::DelegatedClaimDenied,
-        })?;
-    let format = request
-        .format
-        .as_deref()
-        .unwrap_or(FORMAT_CLAIM_RESULT_JSON)
-        .to_string();
-    let request_claim_ids = claim_ids(&request.claims);
-    let disclosure =
-        selected_disclosure(evidence, &request_claim_ids, request.disclosure.as_deref()).map_err(
-            |_| EvidenceError::SubjectAccessDenied {
-                reason: SubjectAccessDenialCode::DelegatedClaimDenied,
-            },
-        )?;
-    let claims = principal
-        .verified_claims
-        .as_ref()
-        .ok_or(EvidenceError::SubjectAccessInvalidToken)?;
-    let subject_binding_value = principal
-        .verified_subject_binding_value(&state.subject_access.subject_binding.token_claim)
-        .ok_or(EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::SubjectClaimMissing,
-        })?;
-    let target_subject = request
-        .target_subject()
-        .ok_or(EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::DelegatedSubjectNotPermitted,
-        })?;
-    let principal_hash = state
-        .subject_access_rate_keys
-        .principal(&principal.principal_id)
-        .map_err(|error| error.evidence_error())?;
-    let requester_subject_binding_hash = state
-        .subject_access_rate_keys
-        .delegated_subject_binding(
-            state.subject_access.subject_binding.id_type.as_str(),
-            subject_binding_value,
-        )
-        .map_err(|error| error.evidence_error())?;
-    let target_id_type = delegated_target_id_type(&state.subject_access, relationship_config);
-    let dependent_target_hash = state
-        .subject_access_rate_keys
-        .delegated_subject_binding(target_id_type, target_subject.id.as_str())
-        .map_err(|error| error.evidence_error())?;
-    let requested_claims_hash =
-        Hashed::<ClaimSet>::from_hash(evidence_claim_hash(&request_claim_ids));
-    let policy_hash = subject_access_policy_hash(
-        evidence,
-        &state.subject_access,
-        &request_claim_ids,
-        &disclosure,
-        &format,
-    )?;
-    let now = OffsetDateTime::now_utc();
-    let evaluation_expires_at =
-        now + time::Duration::seconds(relationship_config.max_proof_age_seconds as i64);
-    let proof_claim_id = BoundedClaimId::new(relationship_config.proof_claim.clone())
-        .map_err(|_| EvidenceError::InvalidRequest)?;
-    let claim_versions = requested_claim_versions(&request.claims)?;
-    let levels = build_claim_levels(evidence, &request.claims, &claim_versions)?;
-    let mut allowed_claim_ids = BTreeSet::new();
-    for allowed_claim_id in levels.into_iter().flatten() {
-        if allowed_claim_id != relationship_config.proof_claim {
-            allowed_claim_ids.insert(
-                BoundedClaimId::new(allowed_claim_id).map_err(|_| EvidenceError::InvalidRequest)?,
-            );
-        }
-    }
-    let relationship_type = ConfigMetadata::new(relationship_config.relationship_type.clone())
-        .map_err(|_| EvidenceError::InvalidRequest)?;
-    let metadata = StoredSubjectAccessMetadata {
-        access_mode: AccessMode::DelegatedSubjectAccess,
-        issuer: claims.issuer.clone(),
-        audiences: claims.audiences.clone(),
-        client_id: claims.client_id.clone(),
-        principal_hash,
-        subject_id_type: ConfigMetadata::new(target_id_type.to_string())
-            .map_err(|_| EvidenceError::InvalidRequest)?,
-        subject_binding_claim: ConfigMetadata::new(
-            state.subject_access.subject_binding.token_claim.clone(),
-        )
-        .map_err(|_| EvidenceError::InvalidRequest)?,
-        subject_binding_hash: requester_subject_binding_hash.clone(),
-        dependent_target_hash: Some(dependent_target_hash.clone()),
-        relationship_type: Some(relationship_type.clone()),
-        proof_claim_id: Some(proof_claim_id.clone()),
-        requested_claims_hash,
-        disclosure: ConfigMetadata::new(disclosure.clone())
-            .map_err(|_| EvidenceError::InvalidRequest)?,
-        result_format: ConfigMetadata::new(format.clone())
-            .map_err(|_| EvidenceError::InvalidRequest)?,
-        delegation_chain: request
-            .on_behalf_of
-            .as_ref()
-            .map(|delegation| vec![delegation.actor.clone()])
-            .unwrap_or_default(),
-        policy_version: None,
-        policy_hash: Some(policy_hash.clone()),
-        evaluation_expires_at: Some(format_time(evaluation_expires_at)),
-    };
-    let evaluation_capability = EvaluationCapability::DelegatedSubjectAccess {
-        proof_claim_id,
-        allowed_claim_ids,
-        requester_subject_binding_hash,
-        dependent_target_hash,
-        relationship_type,
-    };
-
-    Ok(SubjectAccessEvaluateContext {
-        evaluation_capability,
-        metadata,
-        purpose,
-    })
-}
-
-pub(super) fn require_subject_access_token_policy(
-    config: &SubjectAccessConfig,
-    principal: &EvidencePrincipal,
-) -> Result<(), EvidenceError> {
-    let claims = principal
-        .verified_claims
-        .as_ref()
-        .ok_or(EvidenceError::SubjectAccessInvalidToken)?;
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let leeway = config.token_policy.max_clock_leeway_seconds as i64;
-    let auth_time = claims
-        .auth_time
-        .ok_or(EvidenceError::SubjectAccessAssuranceDenied)?;
-    if auth_time > now + leeway {
-        return Err(EvidenceError::SubjectAccessAssuranceDenied);
-    }
-    if now.saturating_sub(auth_time) > config.token_policy.max_auth_age_seconds as i64 + leeway {
-        return Err(EvidenceError::SubjectAccessAssuranceDenied);
-    }
-    require_subject_access_pdp_decision(
-        config,
-        claims.acr.as_ref().map(|acr| acr.as_str()),
-        now,
-        auth_time,
-        leeway,
-    )?;
-    let exp = claims.exp.ok_or(EvidenceError::SubjectAccessInvalidToken)?;
-    let iat = claims.iat.ok_or(EvidenceError::SubjectAccessInvalidToken)?;
-    if iat > now + leeway {
-        return Err(EvidenceError::SubjectAccessAssuranceDenied);
-    }
-    if exp < iat
-        || exp.saturating_sub(iat)
-            > config.token_policy.max_access_token_lifetime_seconds as i64 + leeway
-    {
-        return Err(EvidenceError::SubjectAccessAssuranceDenied);
-    }
-    Ok(())
-}
-
-pub(super) fn require_subject_access_pdp_decision(
-    config: &SubjectAccessConfig,
-    acr: Option<&str>,
-    now: i64,
-    auth_time: i64,
-    leeway: i64,
-) -> Result<(), EvidenceError> {
-    let observed_age = now
-        .saturating_sub(auth_time)
-        .try_into()
-        .ok()
-        .unwrap_or_default();
-    let context = PdpRequestContext {
-        purpose: "subject_access".to_string(),
-        legal_basis_ref: None,
-        consent_ref: None,
-        asserted_assurance: acr.map(str::to_string),
-        jurisdiction: None,
-        requester_identity: None,
-        subject_ref: None,
-        relationship: None,
-        on_behalf_of: None,
-        requested_fact: None,
-        requested_disclosure: None,
-        requested_credential_format: None,
-        source_binding: None,
-        route_identity: Some("registry-notary.subject-access".to_string()),
-        checked_scopes: Default::default(),
-        source_observed_at_unix_seconds: None,
-        source_observed_age_seconds: Some(observed_age),
-    };
-    let policy = PdpPolicyInput {
-        policy_id: "subject-access".to_string(),
-        policy_hash: subject_access_token_policy_hash(config)?,
-        ecosystem_binding_id: None,
-        ecosystem_binding_version: None,
-        rule_ids: vec!["subject-access-token-policy".to_string()],
-        rule_ids_by_gate: Default::default(),
-        permit_unconstrained: false,
-        required_context: Default::default(),
-        odrl_constraint_terms: Vec::new(),
-        purpose_constraints: vec![vec!["subject_access".to_string()]],
-        permitted_jurisdictions: Vec::new(),
-        allowed_assurance: config.token_policy.required_acr_values.clone(),
-        minimum_assurance: None,
-        max_source_age_seconds: Some(config.token_policy.max_auth_age_seconds + leeway as u64),
-        require_legal_basis: false,
-        require_consent: false,
-        allowed_legal_basis_refs: Vec::new(),
-        allowed_consent_refs: Vec::new(),
-        redaction_fields: Default::default(),
-        allowed_relationships: Vec::new(),
-        relationship_purpose_constraints: Vec::new(),
-        allowed_requested_facts: Vec::new(),
-        allowed_requested_disclosures: Vec::new(),
-        allowed_credential_formats: Vec::new(),
-        allowed_source_bindings: Vec::new(),
-        allowed_route_identities: vec!["registry-notary.subject-access".to_string()],
-        required_checked_scopes: Default::default(),
-        unsupported_odrl_terms: Vec::new(),
-    };
-    match pdp_decide(&context, &policy) {
-        PdpDecision::Permit(_) | PdpDecision::PermitWithRedaction { .. } => Ok(()),
-        PdpDecision::Deny { .. } => Err(EvidenceError::SubjectAccessAssuranceDenied),
-    }
-}
-
-pub(super) fn subject_access_token_policy_hash(
-    config: &SubjectAccessConfig,
-) -> Result<String, EvidenceError> {
-    let canonical = json!({
-        "purpose_constraints": [["subject_access"]],
-        "required_acr_values": config.token_policy.required_acr_values,
-        "assurance_claim_source": config.token_policy.assurance_claim_source,
-        "max_auth_age_seconds": config.token_policy.max_auth_age_seconds,
-        "max_clock_leeway_seconds": config.token_policy.max_clock_leeway_seconds,
-    });
-    sha256_canonical_json(&canonical)
-}
-
-pub(super) fn require_subject_access_credential_profile_policy(
-    config: &SubjectAccessConfig,
-    profile_id: &str,
-    profile: &CredentialProfileConfig,
-) -> Result<(), EvidenceError> {
-    let allowed = config
-        .credential_profiles
-        .iter()
-        .any(|allowed| allowed == profile_id);
-    let validity_seconds = u64::try_from(profile.validity_seconds).ok();
-    let validity_ceiling = config.token_policy.max_credential_validity_seconds;
-    let did_jwk_only = !profile.holder_binding.allowed_did_methods.is_empty()
-        && profile
-            .holder_binding
-            .allowed_did_methods
-            .iter()
-            .all(|method| method == "did:jwk");
-    if !allowed
-        || profile.format != FORMAT_SD_JWT_VC
-        || validity_seconds.is_none_or(|seconds| seconds == 0 || seconds > validity_ceiling)
-        || profile.holder_binding.mode != "did"
-        || profile.holder_binding.proof_of_possession.as_deref() != Some("required")
-        || !did_jwk_only
-    {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::ProfileDenied,
-        ));
-    }
-    Ok(())
-}
-
-pub(super) async fn consume_subject_mismatch_denial(
-    state: &RegistryNotaryApiState,
-    principal_hash: &Hashed<registry_notary_core::PrincipalIdentifier>,
-) -> Result<(), SubjectAccessRateLimitError> {
-    state
-        .subject_access_rate_limiter
-        .consume_subject_mismatch_denial_only(principal_hash)
-        .await
-}
-
-#[allow(clippy::too_many_arguments)]
-pub(super) fn require_subject_access_stored_access(
-    state: &RegistryNotaryApiState,
-    evidence: &EvidenceConfig,
-    principal: &EvidencePrincipal,
-    evaluation: &registry_notary_core::StoredEvaluation,
-    requested_claims: &[String],
-    disclosure: &str,
-    format: &str,
-    issue_credential: bool,
-) -> Result<(), EvidenceError> {
-    require_subject_access_stored_access_inner(
-        state,
-        evidence,
-        principal,
-        evaluation,
-        requested_claims,
-        disclosure,
-        format,
-        issue_credential,
-        false,
-    )
-}
-
-/// Validate a stored evaluation when the credential request is authenticated
-/// by the Notary access token minted from the issuer-initiated transaction.
-///
-/// The callback evaluation records the external identity provider as its
-/// authenticated issuer and audience. The wallet later presents a
-/// Notary-signed, transaction-bound token, so those two token-envelope fields
-/// intentionally change. All subject, client, policy, claim, disclosure, and
-/// format bindings remain enforced here; the caller separately verifies the
-/// Notary token's issuer, audience, transaction id, and commitment.
-#[allow(clippy::too_many_arguments)]
-pub(super) fn require_oid4vci_transaction_stored_access(
-    state: &RegistryNotaryApiState,
-    evidence: &EvidenceConfig,
-    principal: &EvidencePrincipal,
-    evaluation: &registry_notary_core::StoredEvaluation,
-    requested_claims: &[String],
-    disclosure: &str,
-    format: &str,
-) -> Result<(), EvidenceError> {
-    require_subject_access_stored_access_inner(
-        state,
-        evidence,
-        principal,
-        evaluation,
-        requested_claims,
-        disclosure,
-        format,
-        true,
-        true,
-    )
-}
-
-#[allow(clippy::too_many_arguments)]
-fn require_subject_access_stored_access_inner(
-    state: &RegistryNotaryApiState,
-    evidence: &EvidenceConfig,
-    principal: &EvidencePrincipal,
-    evaluation: &registry_notary_core::StoredEvaluation,
-    requested_claims: &[String],
-    disclosure: &str,
-    format: &str,
-    issue_credential: bool,
-    allow_token_envelope_transition: bool,
-) -> Result<(), EvidenceError> {
-    let Some(metadata) = evaluation.subject_access.as_ref() else {
-        if principal.is_subject_access() {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-        return Ok(());
-    };
-    if !principal.is_subject_access() {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    if principal.access_mode() != metadata.access_mode {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    if issue_credential && !state.subject_access.allowed_operations.issue_credential {
-        return Err(EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::OperationDenied,
-        });
-    }
-    if !issue_credential && !state.subject_access.allowed_operations.render {
-        return Err(EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::OperationDenied,
-        });
-    }
-    if let Some(expires_at) = metadata.evaluation_expires_at.as_deref() {
-        let expires_at = OffsetDateTime::parse(expires_at, &Rfc3339)
-            .map_err(|_| EvidenceError::EvaluationBindingMismatch)?;
-        if OffsetDateTime::now_utc() > expires_at {
-            return Err(EvidenceError::EvaluationNotFound);
-        }
-    }
-    require_subject_access_token_policy(&state.subject_access, principal)?;
-    let principal_matches = allow_token_envelope_transition
-        && principal.principal_id == metadata.principal_hash.as_str();
-    if !principal_matches
-        && state
-            .subject_access_rate_keys
-            .principal(&principal.principal_id)
-            .map_err(|error| error.evidence_error())?
-            != metadata.principal_hash
-    {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    if metadata.subject_binding_claim.as_str() != state.subject_access.subject_binding.token_claim {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    let delegated_relationship = if metadata.access_mode == AccessMode::DelegatedSubjectAccess {
-        if !state.subject_access.delegation.enabled || metadata.dependent_target_hash.is_none() {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-        let relationship_type = metadata
-            .relationship_type
-            .as_ref()
-            .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-        let proof_claim_id = metadata
-            .proof_claim_id
-            .as_ref()
-            .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-        let relationship = state
-            .subject_access
-            .delegation
-            .relationship(relationship_type.as_str())
-            .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-        if proof_claim_id.as_str() != relationship.proof_claim
-            || metadata.subject_id_type.as_str()
-                != delegated_target_id_type(&state.subject_access, relationship)
-        {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-        Some(relationship)
-    } else {
-        if metadata.subject_id_type.as_str() != state.subject_access.subject_binding.id_type
-            || metadata.dependent_target_hash.is_some()
-            || metadata.relationship_type.is_some()
-            || metadata.proof_claim_id.is_some()
-        {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-        None
-    };
-    if let Some(relationship) = delegated_relationship {
-        require_delegated_stored_authorization_details(
-            evidence,
-            &state.subject_access,
-            &state.subject_access_rate_keys,
-            principal,
-            evaluation,
-            metadata,
-            relationship,
-        )?;
-    }
-    let claims = principal
-        .verified_claims
-        .as_ref()
-        .ok_or(EvidenceError::SubjectAccessInvalidToken)?;
-    if claims.client_id != metadata.client_id
-        || (!allow_token_envelope_transition
-            && (claims.issuer != metadata.issuer
-                || !verified_audiences_match(&claims.audiences, &metadata.audiences)))
-    {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    let subject_binding_value = principal
-        .verified_subject_binding_value(&state.subject_access.subject_binding.token_claim)
-        .ok_or(EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::SubjectClaimMissing,
-        })?;
-    // Delegated evaluations bind the requester subject over the (id_type, id)
-    // pair (see prepare_delegated_subject_access_evaluate); non-delegated
-    // subject-access keeps the value-only binding byte-for-byte unchanged.
-    let subject_binding_matches = allow_token_envelope_transition
-        && subject_binding_value == metadata.subject_binding_hash.as_str();
-    let subject_binding_hash = if subject_binding_matches {
-        metadata.subject_binding_hash.clone()
-    } else if metadata.access_mode == AccessMode::DelegatedSubjectAccess {
-        state
-            .subject_access_rate_keys
-            .delegated_subject_binding(
-                state.subject_access.subject_binding.id_type.as_str(),
-                subject_binding_value,
-            )
-            .map_err(|error| error.evidence_error())?
-    } else {
-        state
-            .subject_access_rate_keys
-            .subject_binding(subject_binding_value)
-            .map_err(|error| error.evidence_error())?
-    };
-    if subject_binding_hash != metadata.subject_binding_hash {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    if metadata.requested_claims_hash.as_str() != evidence_claim_hash(requested_claims) {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    if metadata.disclosure.as_str() != disclosure || metadata.result_format.as_str() != format {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    let expected_policy_hash = subject_access_policy_hash(
-        evidence,
-        &state.subject_access,
-        &evaluation.claim_ids,
-        &evaluation.disclosure,
-        &evaluation.format,
-    )?;
-    if metadata.policy_hash.as_ref() != Some(&expected_policy_hash) {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    Ok(())
-}
-
-pub(super) fn require_delegated_stored_authorization_details(
-    evidence: &EvidenceConfig,
-    config: &SubjectAccessConfig,
-    keys: &SubjectAccessRateLimitKeys,
-    principal: &EvidencePrincipal,
-    evaluation: &registry_notary_core::StoredEvaluation,
-    metadata: &StoredSubjectAccessMetadata,
-    relationship_config: &SubjectAccessDelegatedRelationshipConfig,
-) -> Result<(), EvidenceError> {
-    let details = principal.authorization_details.as_ref().ok_or_else(|| {
-        subject_access_denied(SubjectAccessDenialCode::DelegatedRelationshipNotAllowed)
-    })?;
-    let relationship = details.relationship.as_ref().ok_or_else(|| {
-        subject_access_denied(SubjectAccessDenialCode::DelegatedRelationshipNotAllowed)
-    })?;
-    let proof_claim_id = metadata
-        .proof_claim_id
-        .as_ref()
-        .ok_or_else(|| subject_access_denied(SubjectAccessDenialCode::DelegatedProofDenied))?;
-    if relationship.relationship_type != relationship_config.relationship_type
-        || relationship.proof_claim != relationship_config.proof_claim
-        || relationship.proof_claim != proof_claim_id.as_str()
-    {
-        return Err(subject_access_denied(
-            SubjectAccessDenialCode::DelegatedRelationshipNotAllowed,
-        ));
-    }
-    require_delegated_authorization_target_binding(details, metadata, keys)?;
-    let proof_claim = find_requested_claim(evidence, &ClaimRef::from(proof_claim_id.as_str()))
-        .map_err(|_| subject_access_denied(SubjectAccessDenialCode::DelegatedProofDenied))?;
-    let mut authorized_claims = evaluation
-        .selected_claim_refs()
-        .into_iter()
-        .map(|selected| {
-            let claim = find_requested_claim(evidence, &selected).map_err(|_| {
-                subject_access_denied(SubjectAccessDenialCode::DelegatedClaimDenied)
-            })?;
-            Ok(ClaimRef::with_version(&claim.id, &claim.version))
-        })
-        .collect::<Result<Vec<_>, EvidenceError>>()?;
-    let proof_ref = ClaimRef::with_version(&proof_claim.id, &proof_claim.version);
-    if !authorized_claims.contains(&proof_ref) {
-        authorized_claims.push(proof_ref);
-    }
-    crate::authz_details::validate_scoped_authorization_details(
-        details,
-        &crate::authz_details::ScopedAuthorizationRequest {
-            service_id: evidence.service_id.as_str(),
-            action: "evaluate",
-            claims: &authorized_claims,
-            disclosure: &evaluation.disclosure,
-            format: &evaluation.format,
-            purpose: &evaluation.purpose,
-            access_mode: AccessMode::DelegatedSubjectAccess,
-            subject: Some(crate::authz_details::ScopedAuthorizationSubject {
-                binding_claim: config.subject_binding.token_claim.clone(),
-                id_type: config.subject_binding.id_type.clone(),
-            }),
-            target: None,
-            allow_subset_claims: true,
-            allowed_claims: Some(&authorized_claims),
-        },
-    )
-    .map_err(delegated_subject_access_authorization_details_denial)
-}
-
-pub(super) fn require_delegated_authorization_target_binding(
-    details: &registry_notary_core::EvidenceAuthorizationDetails,
-    metadata: &StoredSubjectAccessMetadata,
-    keys: &SubjectAccessRateLimitKeys,
-) -> Result<(), EvidenceError> {
-    let target = details
-        .target
-        .as_ref()
-        .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-    let expected_hash = metadata
-        .dependent_target_hash
-        .as_ref()
-        .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-    if target.id.trim().is_empty() || target.id_type != metadata.subject_id_type.as_str() {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    // The internal evaluation authorization carries the selected civil
-    // identifier so Relay can resolve the relationship. The wallet-facing
-    // Notary token carries only the committed HMAC handle. Both forms bind to
-    // the same stored value, but the raw target never crosses into the wallet.
-    if target.id == expected_hash.as_str() {
-        return Ok(());
-    }
-    let target_hash = keys
-        .delegated_subject_binding(target.id_type.as_str(), target.id.as_str())
-        .map_err(|error| error.evidence_error())?;
-    if &target_hash != expected_hash {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    Ok(())
-}
-
-pub(super) fn verified_audiences_match(
-    left: &[VerifiedClaimValue],
-    right: &[VerifiedClaimValue],
-) -> bool {
-    let left = left.iter().collect::<std::collections::BTreeSet<_>>();
-    let right = right.iter().collect::<std::collections::BTreeSet<_>>();
-    left == right
-}
-
-pub(super) fn claim_allows_disclosure(
-    evidence: &EvidenceConfig,
-    claim_id: &str,
-    disclosure: &str,
-) -> bool {
-    crate::find_claim(evidence, claim_id).is_ok_and(|claim| {
-        claim.disclosure.default == disclosure
-            || claim
-                .disclosure
-                .allowed
-                .iter()
-                .any(|allowed| allowed == disclosure)
-    })
-}
-
-pub(super) fn selected_disclosure(
-    evidence: &EvidenceConfig,
-    claim_ids: &[String],
-    requested: Option<&str>,
-) -> Result<String, EvidenceError> {
-    let disclosure = requested
-        .or_else(|| {
-            claim_ids
-                .first()
-                .and_then(|claim_id| crate::find_claim(evidence, claim_id).ok())
-                .map(|claim| claim.disclosure.default.as_str())
-        })
-        .unwrap_or("redacted");
-    registry_notary_core::DisclosureProfile::parse(disclosure)
-        .ok_or(EvidenceError::InvalidRequest)
-        .map(|profile| profile.as_str().to_string())
-}
-
-pub(super) fn subject_access_denied(reason: SubjectAccessDenialCode) -> EvidenceError {
-    EvidenceError::SubjectAccessDenied { reason }
-}
-
-pub(super) fn denial_code_from_error(error: &EvidenceError) -> Option<SubjectAccessDenialCode> {
-    match error {
-        EvidenceError::SubjectAccessDenied { reason } => Some(*reason),
-        EvidenceError::SubjectAccessRateLimited => Some(SubjectAccessDenialCode::RateLimited),
-        EvidenceError::SubjectAccessInvalidToken => Some(SubjectAccessDenialCode::InvalidToken),
-        EvidenceError::SubjectAccessAssuranceDenied => {
-            Some(SubjectAccessDenialCode::AssuranceDenied)
-        }
-        _ => None,
-    }
-}
-
-pub(super) fn subject_mismatch_denial_code(reason: SubjectAccessDenialCode) -> bool {
-    matches!(
-        reason,
-        SubjectAccessDenialCode::SubjectMismatch
-            | SubjectAccessDenialCode::DelegatedSubjectNotPermitted
-    )
-}
-
-pub(super) fn denial_code_from_response(response: &Response) -> Option<SubjectAccessDenialCode> {
-    response
-        .extensions()
-        .get::<EvidenceErrorCodeContext>()
-        .and_then(|context| SubjectAccessDenialCode::parse(&context.0))
-}
diff --git a/crates/registry-notary-server/src/api/tests/admin.rs b/crates/registry-notary-server/src/api/tests/admin.rs
deleted file mode 100644
index 527f81135..000000000
--- a/crates/registry-notary-server/src/api/tests/admin.rs
+++ /dev/null
@@ -1,19 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Admin API tests.
-
-use super::*;
-
-#[test]
-fn posture_problem_response_uses_problem_json() {
-    // RFC 9457 problem details must be served as application/problem+json,
-    // not application/json.
-    let response = posture_unavailable();
-    let content_type = response
-        .headers()
-        .get(header::CONTENT_TYPE)
-        .expect("problem response sets a content-type");
-    assert_eq!(
-        content_type, "application/problem+json",
-        "RFC 9457 problem responses must use application/problem+json"
-    );
-}
diff --git a/crates/registry-notary-server/src/api/tests/audit.rs b/crates/registry-notary-server/src/api/tests/audit.rs
deleted file mode 100644
index c59ac9b0c..000000000
--- a/crates/registry-notary-server/src/api/tests/audit.rs
+++ /dev/null
@@ -1,268 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Audit API tests.
-
-use super::*;
-
-#[test]
-fn pdp_pre_evaluation_denial_audit_records_zero_consultations_and_no_forward() {
-    let mut response = StatusCode::FORBIDDEN.into_response();
-    attach_evidence_audit(
-        &mut response,
-        "evaluate_denied",
-        None,
-        &["person-is-alive".to_string()],
-        None,
-    );
-    attach_zero_relay_no_forward_audit(&mut response);
-
-    let audit = response
-        .extensions()
-        .get::<EvidenceAuditContext>()
-        .expect("audit context is attached");
-    assert_eq!(audit.relay_consultation_count, Some(0));
-    assert_eq!(audit.forwarded, Some(false));
-}
-
-#[test]
-fn batch_audit_purposes_resolve_per_subject_overrides() {
-    let purposes = resolved_batch_audit_purposes(
-        None,
-        Some("program-b"),
-        &[
-            registry_notary_core::BatchEvaluateItemRequest::from(
-                registry_notary_core::BatchSubjectRequest {
-                    id: "NAT-123".to_string(),
-                    id_type: Some("national_id".to_string()),
-                    purpose: Some("program-a".to_string()),
-                },
-            ),
-            registry_notary_core::BatchEvaluateItemRequest::from(
-                registry_notary_core::BatchSubjectRequest {
-                    id: "NAT-456".to_string(),
-                    id_type: Some("national_id".to_string()),
-                    purpose: None,
-                },
-            ),
-        ],
-    )
-    .expect("audit purposes resolve");
-
-    assert_eq!(purposes, vec!["program-a", "program-b"]);
-}
-
-#[test]
-fn redacted_fields_audit_unions_all_result_redactions() {
-    let mut response = StatusCode::OK.into_response();
-    attach_evidence_audit(
-        &mut response,
-        "evaluate",
-        Some("eval-1".to_string()),
-        &["opencrvs-age-band".to_string(), "opencrvs-sex".to_string()],
-        Some(1),
-    );
-    let mut age_band = claim_result_view("eval-1", "opencrvs-age-band");
-    age_band.disclosure = "redacted".to_string();
-    age_band.redacted_fields = vec!["opencrvs-age-band".to_string()];
-    let mut sex = claim_result_view("eval-1", "opencrvs-sex");
-    sex.disclosure = "redacted".to_string();
-    sex.redacted_fields = vec!["opencrvs-sex".to_string()];
-
-    attach_redacted_fields_audit(&mut response, &[sex, age_band]);
-
-    let audit = response
-        .extensions()
-        .get::<EvidenceAuditContext>()
-        .expect("audit context is attached");
-    assert_eq!(
-        audit.redacted_fields.as_deref(),
-        Some(&["opencrvs-age-band".to_string(), "opencrvs-sex".to_string()][..])
-    );
-}
-
-#[test]
-fn canonical_audit_identifier_input_sorts_identifiers_and_explicit_empty_fields() {
-    let mut first = registry_notary_core::EvidenceIdentifier {
-        scheme: "national_id".to_string(),
-        value: "NID-1001".to_string(),
-        issuer: None,
-        country: Some("RW".to_string()),
-    };
-    let second = registry_notary_core::EvidenceIdentifier {
-        scheme: "animal_ear_tag".to_string(),
-        value: "EAR-77".to_string(),
-        issuer: Some("vet-registry".to_string()),
-        country: None,
-    };
-    let mut entity = EvidenceEntity::new("Person");
-    entity.identifiers = vec![first.clone(), second.clone()];
-    let canonical = canonical_audit_identifier_input("target", Some("program-a"), &entity)
-        .expect("canonicalizes")
-        .expect("identifier input is present");
-
-    first.country = Some("RW".to_string());
-    let mut reordered = EvidenceEntity::new("Person");
-    reordered.identifiers = vec![second, first];
-    let reordered_canonical =
-        canonical_audit_identifier_input("target", Some("program-a"), &reordered)
-            .expect("canonicalizes")
-            .expect("identifier input is present");
-
-    assert_eq!(canonical, reordered_canonical);
-    assert!(canonical.contains(r#""issuer":"""#));
-    assert!(canonical.contains(r#""country":"""#));
-    assert!(canonical.find("animal_ear_tag") < canonical.find("national_id"));
-}
-
-#[test]
-fn failed_matching_attempts_receive_stable_purpose_scoped_keyed_pseudonyms() {
-    let keys = SubjectAccessRateLimitKeys::new(AuditKeyHasher::unkeyed_dev_only());
-    let entity = EvidenceEntity::with_identifier("Person", "national_id", "NID-1001");
-
-    let first = hash_audit_matching_attempt(&keys, "target", Some("program-a"), &entity)
-        .expect("matching attempt hashes")
-        .expect("matching input produces a pseudonym");
-    let repeated = hash_audit_matching_attempt(&keys, "target", Some("program-a"), &entity)
-        .expect("matching attempt hashes")
-        .expect("matching input produces a pseudonym");
-    let other_purpose = hash_audit_matching_attempt(&keys, "target", Some("program-b"), &entity)
-        .expect("matching attempt hashes")
-        .expect("matching input produces a pseudonym");
-
-    assert_eq!(first, repeated);
-    assert_ne!(first, other_purpose);
-    assert!(!serde_json::to_string(&first)
-        .expect("pseudonym serializes")
-        .contains("NID-1001"));
-}
-
-#[test]
-fn failed_batch_member_audit_is_value_free_and_keeps_consultation_evidence() {
-    let keys = SubjectAccessRateLimitKeys::new(AuditKeyHasher::unkeyed_dev_only());
-    let request = registry_notary_core::BatchEvaluateRequest {
-        items: vec![registry_notary_core::BatchEvaluateItemRequest {
-            requester: Some(EvidenceEntity::with_identifier(
-                "Organization",
-                "organization_id",
-                "ORG-SENSITIVE",
-            )),
-            target: EvidenceEntity::with_identifier("Person", "national_id", "NID-SENSITIVE"),
-            relationship: None,
-            on_behalf_of: None,
-            purpose: Some("program-a".to_string()),
-        }],
-        claims: vec![ClaimRef::from("person-is-alive")],
-        disclosure: Some("predicate".to_string()),
-        format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-        purpose: Some("program-a".to_string()),
-    };
-    let result = registry_notary_core::BatchEvaluateResponse {
-        batch_id: "batch-1".to_string(),
-        status: registry_notary_core::BatchStatus::Completed,
-        claims: vec!["person-is-alive".to_string()],
-        items: vec![registry_notary_core::BatchItemResponse {
-            input_index: 0,
-            target_ref: registry_notary_core::TargetRefView {
-                entity_type: "Person".to_string(),
-                handle: "rnref:v1:failed-target".to_string(),
-                identifier_schemes: vec!["national_id".to_string()],
-                profile: None,
-            },
-            requester_ref: None,
-            evaluation_id: None,
-            status: registry_notary_core::BatchItemStatus::Failed,
-            claim_results: Vec::new(),
-            errors: vec![registry_notary_core::BatchItemError {
-                code: "evidence.not_available".to_string(),
-                title: "Evidence not available".to_string(),
-                retryable: true,
-                audit_code: Some("relay.transport_failed".to_string()),
-            }],
-            runtime_audit: registry_notary_core::BatchItemRuntimeAudit {
-                relay_forwarded_count: 1,
-                relay_consultation_ids: vec!["01JRELAYBATCHAUDIT".to_string()],
-            },
-        }],
-        summary: registry_notary_core::BatchSummary {
-            succeeded: 0,
-            failed: 1,
-        },
-    };
-    let mut response = StatusCode::OK.into_response();
-    attach_evidence_audit_with_purposes(
-        &mut response,
-        "batch_evaluate",
-        None,
-        &["person-is-alive".to_string()],
-        Some(1),
-        Some(vec!["program-a".to_string()]),
-    );
-
-    attach_batch_evaluate_response_audit(
-        &mut response,
-        &keys,
-        &evidence_config(),
-        &request,
-        &result,
-        Some(&["program-a".to_string()]),
-    )
-    .expect("batch audit attaches");
-
-    let audit = response
-        .extensions()
-        .get::<EvidenceAuditContext>()
-        .expect("audit context is attached");
-    let item = &audit.batch_items.as_ref().expect("batch items exist")[0];
-    assert_eq!(item.outcome, "failed");
-    assert_eq!(item.error_code.as_deref(), Some("relay.transport_failed"));
-    assert_eq!(item.relay_consultation_count, 1);
-    assert!(item.forwarded);
-    assert!(item.target_ref_hash.is_some());
-    assert!(item.requester_ref_hash.is_some());
-    assert_eq!(audit.relay_consultation_count, Some(1));
-    assert_eq!(audit.forwarded, Some(true));
-    let serialized = serde_json::to_string(&audit.batch_items).expect("batch audit serializes");
-    assert!(!serialized.contains("NID-SENSITIVE"));
-    assert!(!serialized.contains("ORG-SENSITIVE"));
-}
-
-#[test]
-fn credential_audit_context_links_stored_target_and_requester_refs() {
-    let keys = SubjectAccessRateLimitKeys::new(AuditKeyHasher::unkeyed_dev_only());
-    let mut result = claim_result_view("eval-1", "person-is-alive");
-    result.requester_ref = Some(registry_notary_core::EvidenceEntityRef {
-        entity_type: "Person".to_string(),
-        handle: "rnref:v1:requester-handle".to_string(),
-        identifier_schemes: vec!["national_id".to_string()],
-        profile: None,
-    });
-    let mut response = StatusCode::OK.into_response();
-
-    attach_subject_access_credential_audit(
-        &mut response,
-        &keys,
-        "eval-1",
-        &["person-is-alive".to_string()],
-        &[result],
-        1,
-        SubjectAccessCredentialAuditDetails {
-            profile_id: "person_is_alive_sd_jwt",
-            holder_binding_mode: "did",
-            access_mode: AccessMode::SubjectBound,
-            policy_hash: None,
-            purposes: Some(vec!["citizen_subject_access".to_string()]),
-            protocol: Some("openid4vci"),
-            credential_configuration_id: Some("person_is_alive_sd_jwt"),
-        },
-    )
-    .expect("credential audit attaches");
-
-    let audit = response
-        .extensions()
-        .get::<EvidenceAuditContext>()
-        .expect("audit context is attached");
-    assert_eq!(audit.target_type.as_deref(), Some("Person"));
-    assert_eq!(audit.requester_type.as_deref(), Some("Person"));
-    assert_eq!(audit.access_mode, Some(AccessMode::SubjectBound));
-    assert!(audit.target_ref_hash.is_some());
-    assert!(audit.requester_ref_hash.is_some());
-}
diff --git a/crates/registry-notary-server/src/api/tests/credentials.rs b/crates/registry-notary-server/src/api/tests/credentials.rs
deleted file mode 100644
index c0ba759e7..000000000
--- a/crates/registry-notary-server/src/api/tests/credentials.rs
+++ /dev/null
@@ -1,1186 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Credentials API tests.
-
-use super::*;
-use async_trait::async_trait;
-use registry_platform_cache::{
-    CacheCompareAndSetOutcome, CacheKey, CacheSetOutcome, CacheStore, CacheStoreError,
-};
-
-struct UnavailableCredentialStatusStore;
-
-fn unavailable_status_error() -> CacheStoreError {
-    CacheStoreError::Operation {
-        message: "test store unavailable".to_string(),
-    }
-}
-
-#[async_trait]
-impl CacheStore for UnavailableCredentialStatusStore {
-    async fn get(&self, _key: &CacheKey) -> Result<Option<Vec<u8>>, CacheStoreError> {
-        Err(unavailable_status_error())
-    }
-
-    async fn set(
-        &self,
-        _key: &CacheKey,
-        _value: &[u8],
-        _expires_at: OffsetDateTime,
-    ) -> Result<(), CacheStoreError> {
-        Err(unavailable_status_error())
-    }
-
-    async fn set_if_absent(
-        &self,
-        _key: &CacheKey,
-        _value: &[u8],
-        _expires_at: OffsetDateTime,
-    ) -> Result<CacheSetOutcome, CacheStoreError> {
-        Err(unavailable_status_error())
-    }
-
-    async fn compare_and_set(
-        &self,
-        _key: &CacheKey,
-        _expected: &[u8],
-        _value: &[u8],
-        _expires_at: OffsetDateTime,
-    ) -> Result<CacheCompareAndSetOutcome, CacheStoreError> {
-        Err(unavailable_status_error())
-    }
-
-    async fn delete(&self, _key: &CacheKey) -> Result<bool, CacheStoreError> {
-        Err(unavailable_status_error())
-    }
-
-    async fn check_ready(&self) -> Result<(), CacheStoreError> {
-        Err(unavailable_status_error())
-    }
-}
-
-fn structured_direct_credential_evidence() -> EvidenceConfig {
-    let mut evidence = credential_issue_evidence_config();
-    let claim = evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "person-is-alive")
-        .expect("credential claim exists");
-    claim.value = registry_notary_core::ClaimValueConfig {
-        value_type: "object".to_string(),
-        nullable: true,
-        max_bytes: None,
-        unit: None,
-    };
-    claim.disclosure.default = "value".to_string();
-    claim.disclosure.allowed = vec!["value".to_string()];
-    claim.disclosure.downgrade = "deny".to_string();
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-        panic!("credential claim is registry backed");
-    };
-    let consultation = consultations
-        .get_mut("person_status")
-        .expect("credential consultation exists");
-    consultation.outputs = BTreeMap::from([(
-        "record".to_string(),
-        registry_notary_core::RelayOutputContract::Object {
-            nullable: false,
-            max_bytes: 4_096,
-            fields: BTreeMap::from([
-                (
-                    "name".to_string(),
-                    registry_notary_core::RelayOutputObjectFieldContract {
-                        required: true,
-                        schema: Box::new(registry_notary_core::RelayOutputContract::String {
-                            nullable: false,
-                            max_bytes: 128,
-                        }),
-                    },
-                ),
-                (
-                    "parents".to_string(),
-                    registry_notary_core::RelayOutputObjectFieldContract {
-                        required: true,
-                        schema: Box::new(registry_notary_core::RelayOutputContract::Array {
-                            nullable: false,
-                            max_bytes: 2_048,
-                            max_items: 4,
-                            items: Box::new(registry_notary_core::RelayOutputContract::Object {
-                                nullable: false,
-                                max_bytes: 512,
-                                fields: BTreeMap::from([
-                                    (
-                                        "identifier".to_string(),
-                                        registry_notary_core::RelayOutputObjectFieldContract {
-                                            required: true,
-                                            schema: Box::new(
-                                                registry_notary_core::RelayOutputContract::String {
-                                                    nullable: false,
-                                                    max_bytes: 64,
-                                                },
-                                            ),
-                                        },
-                                    ),
-                                    (
-                                        "name".to_string(),
-                                        registry_notary_core::RelayOutputObjectFieldContract {
-                                            required: true,
-                                            schema: Box::new(
-                                                registry_notary_core::RelayOutputContract::String {
-                                                    nullable: false,
-                                                    max_bytes: 128,
-                                                },
-                                            ),
-                                        },
-                                    ),
-                                ]),
-                            }),
-                        }),
-                    },
-                ),
-            ]),
-        },
-    )]);
-    claim.rule = RuleConfig::ConsultationOutput {
-        consultation: "person_status".to_string(),
-        output: "record".to_string(),
-    };
-    evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("credential profile exists")
-        .disclosure
-        .allowed = vec!["value".to_string()];
-    evidence
-}
-
-fn bind_exact_stored_result(evaluation: &mut registry_notary_core::StoredEvaluation) {
-    let result_content_binding =
-        crate::runtime::issuance_result_content_binding(&evaluation.results[0])
-            .expect("structured result content binding hashes");
-    let issuance = evaluation
-        .issuance_provenance
-        .as_mut()
-        .expect("private issuance provenance exists");
-    let claim = issuance
-        .claims
-        .iter_mut()
-        .find(|claim| claim.claim_id == evaluation.results[0].claim_id)
-        .expect("selected claim provenance exists");
-    claim.result_content_binding = result_content_binding;
-    let consultation = issuance
-        .consultations
-        .iter()
-        .find(|consultation| consultation.consultation_id == claim.consultation_id)
-        .expect("selected consultation provenance exists");
-    claim.execution_binding = crate::runtime::issuance_execution_binding(
-        claim,
-        consultation,
-        &evaluation.results[0].evaluation_id,
-        &evaluation.results[0].issued_at,
-        &evaluation.results[0].provenance,
-    )
-    .expect("structured execution binding hashes");
-}
-
-#[tokio::test]
-async fn structured_result_issues_as_one_verifiable_direct_sd_jwt_disclosure() {
-    let evidence = Arc::new(structured_direct_credential_evidence());
-    let store = Arc::new(EvidenceStore::default());
-    let sign_count = Arc::new(AtomicUsize::new(0));
-    let evaluation_id = "eval-structured-direct";
-    let structured_value = json!({
-        "name": "Ada",
-        "parents": [
-            { "identifier": "PARENT-2", "name": "Grace" },
-            { "identifier": "PARENT-1", "name": "Charles" }
-        ]
-    });
-    let mut result = claim_result_view(evaluation_id, "person-is-alive");
-    result.value = Some(structured_value.clone());
-    result.satisfied = None;
-    result.disclosure = "value".to_string();
-    let mut evaluation = registry_notary_core::StoredEvaluation {
-        client_id: "caseworker".to_string(),
-        purpose: "test".to_string(),
-        claim_ids: vec!["person-is-alive".to_string()],
-        claim_refs: Vec::new(),
-        disclosure: "value".to_string(),
-        format: FORMAT_CLAIM_RESULT_JSON.to_string(),
-        results: vec![result],
-        created_at: "2026-05-23T00:00:00Z".to_string(),
-        expires_at: "2999-01-01T00:00:00Z".to_string(),
-        request_hash: "request-hash".to_string(),
-        issuance_provenance: Some(issuance_provenance(
-            "person-is-alive",
-            "test",
-            evaluation_id,
-        )),
-        subject_access: None,
-    };
-    bind_exact_stored_result(&mut evaluation);
-    store
-        .insert(evaluation.clone())
-        .await
-        .expect("structured evaluation inserts");
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_federation(
-            Arc::clone(&evidence),
-            Arc::new(SubjectAccessConfig::default()),
-            Arc::new(Oid4vciConfig::default()),
-            Arc::new(FederationConfig::default()),
-            AuditKeyHasher::unkeyed_dev_only(),
-            None,
-            ReplayStores::memory(),
-            CredentialStatusStore::disabled(),
-            Arc::new(AppMetrics::default()),
-            Arc::clone(&store),
-            Arc::new(CountingIssuerResolver {
-                sign_count: Arc::clone(&sign_count),
-            }),
-            None,
-        )
-        .expect("state builds"),
-    );
-    let principal = EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
-        principal_id: "caseworker".to_string(),
-        scopes: vec!["civil_registry:evidence_verification".to_string()],
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: None,
-    };
-    let request = CredentialIssueRequest {
-        evaluation_id: evaluation_id.to_string(),
-        credential_profile: Some("civil_status_sd_jwt".to_string()),
-        format: Some(FORMAT_SD_JWT_VC.to_string()),
-        claims: Some(vec!["person-is-alive".to_string()]),
-        disclosure: Some("value".to_string()),
-        purpose: Some("test".to_string()),
-        holder: Some(HolderRequest {
-            binding: Some("did".to_string()),
-            id: Some(holder_did_jwk()),
-            proof: None,
-        }),
-    };
-
-    let response = issue_credential(
-        HeaderMap::new(),
-        Some(Extension(Arc::clone(&state))),
-        Some(Extension(principal.clone())),
-        Ok(Json(request.clone())),
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::OK);
-    let audit = response
-        .extensions()
-        .get::<EvidenceAuditContext>()
-        .expect("credential response carries value-free audit context");
-    let audit_debug = format!("{audit:?}");
-    for secret in ["Ada", "Grace", "Charles", "PARENT-1", "PARENT-2"] {
-        assert!(
-            !audit_debug.contains(secret),
-            "credential audit Debug must not expose {secret}"
-        );
-    }
-    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("credential body reads");
-    let body: Value = serde_json::from_slice(&body).expect("credential response parses");
-    let disclosures = body["disclosures"]
-        .as_array()
-        .expect("response disclosures are an array");
-    assert_eq!(
-        disclosures.len(),
-        1,
-        "the complete structured claim is one top-level disclosure unit"
-    );
-    let encoded_disclosure = disclosures[0]
-        .as_str()
-        .expect("encoded disclosure is a string");
-    let decoded_disclosure: Value = serde_json::from_slice(
-        &URL_SAFE_NO_PAD
-            .decode(encoded_disclosure)
-            .expect("disclosure is base64url"),
-    )
-    .expect("disclosure is JSON");
-    assert_eq!(decoded_disclosure[1], json!("person-is-alive"));
-    assert_eq!(decoded_disclosure[2]["value"], structured_value);
-
-    let issuer_signed_jwt = body["issuer_signed_jwt"]
-        .as_str()
-        .expect("issuer-signed JWT exists");
-    let payload = decode_jwt_payload(issuer_signed_jwt);
-    let disclosure_digest = URL_SAFE_NO_PAD.encode(Sha256::digest(encoded_disclosure.as_bytes()));
-    assert!(
-        payload["_sd"]
-            .as_array()
-            .is_some_and(|digests| digests.contains(&json!(disclosure_digest))),
-        "the disclosed recursive value verifies against the issuer-signed _sd digest"
-    );
-    let withheld_presentation = format!("{issuer_signed_jwt}~");
-    assert!(!withheld_presentation.contains(encoded_disclosure));
-    assert!(!withheld_presentation.contains("Ada"));
-    let disclosed_presentation = format!("{issuer_signed_jwt}~{encoded_disclosure}~");
-    assert_eq!(
-        disclosed_presentation
-            .split('~')
-            .filter(|part| !part.is_empty())
-            .count(),
-        2,
-        "presenting the claim adds exactly one complete disclosure"
-    );
-    assert_eq!(sign_count.load(Ordering::SeqCst), 1);
-
-    evaluation.results[0].value.as_mut().unwrap()["parents"][0]["name"] = json!("Mallory");
-    store
-        .insert(evaluation)
-        .await
-        .expect("tampered structured evaluation inserts");
-    let tampered_status_store = CredentialStatusStore::with_test_store(
-        &CredentialStatusConfig {
-            enabled: true,
-            base_url: "https://issuer.example".to_string(),
-            retention_seconds: 60,
-        },
-        Arc::new(UnavailableCredentialStatusStore),
-    );
-    let tamper_state = Arc::new(
-        RegistryNotaryApiState::new_with_federation(
-            evidence,
-            Arc::new(SubjectAccessConfig::default()),
-            Arc::new(Oid4vciConfig::default()),
-            Arc::new(FederationConfig::default()),
-            AuditKeyHasher::unkeyed_dev_only(),
-            None,
-            ReplayStores::memory(),
-            tampered_status_store,
-            Arc::new(AppMetrics::default()),
-            store,
-            Arc::new(CountingIssuerResolver {
-                sign_count: Arc::clone(&sign_count),
-            }),
-            None,
-        )
-        .expect("tamper-check state builds"),
-    );
-    let denied = issue_credential(
-        HeaderMap::new(),
-        Some(Extension(tamper_state)),
-        Some(Extension(principal)),
-        Ok(Json(request)),
-    )
-    .await;
-    assert_eq!(denied.status(), StatusCode::FORBIDDEN);
-    assert_eq!(
-        sign_count.load(Ordering::SeqCst),
-        1,
-        "altered nested stored values are rejected before signing or the unavailable status store"
-    );
-}
-
-#[tokio::test]
-async fn registry_backed_evaluation_with_exact_provenance_issues_directly() {
-    let evidence = credential_issue_evidence_with_dependency();
-    let store = Arc::new(EvidenceStore::default());
-    let sign_count = Arc::new(AtomicUsize::new(0));
-    let evaluation_id = "eval-registry-direct";
-    let mut result = claim_result_view(evaluation_id, "person-is-alive");
-    result.provenance.used.relay_consultation_count = 2;
-    let mut evaluation = registry_notary_core::StoredEvaluation {
-        client_id: "caseworker".to_string(),
-        purpose: "test".to_string(),
-        claim_ids: vec!["person-is-alive".to_string()],
-        claim_refs: Vec::new(),
-        disclosure: "predicate".to_string(),
-        format: FORMAT_CLAIM_RESULT_JSON.to_string(),
-        results: vec![result],
-        created_at: "2026-05-23T00:00:00Z".to_string(),
-        expires_at: "2999-01-01T00:00:00Z".to_string(),
-        request_hash: "request-hash".to_string(),
-        issuance_provenance: Some(issuance_provenance_with_dependency(
-            "person-is-alive",
-            "civil-record-active",
-            "test",
-            evaluation_id,
-        )),
-        subject_access: None,
-    };
-    store
-        .insert(evaluation.clone())
-        .await
-        .expect("registry-backed evaluation inserts");
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_federation(
-            Arc::new(evidence),
-            Arc::new(SubjectAccessConfig::default()),
-            Arc::new(Oid4vciConfig::default()),
-            Arc::new(FederationConfig::default()),
-            AuditKeyHasher::unkeyed_dev_only(),
-            None,
-            ReplayStores::memory(),
-            CredentialStatusStore::disabled(),
-            Arc::new(AppMetrics::default()),
-            Arc::clone(&store),
-            Arc::new(CountingIssuerResolver {
-                sign_count: Arc::clone(&sign_count),
-            }),
-            None,
-        )
-        .expect("state builds"),
-    );
-    let principal = EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
-        principal_id: "caseworker".to_string(),
-        scopes: vec!["civil_registry:evidence_verification".to_string()],
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: None,
-    };
-
-    let request = CredentialIssueRequest {
-        evaluation_id: evaluation_id.to_string(),
-        credential_profile: Some("civil_status_sd_jwt".to_string()),
-        format: Some(FORMAT_SD_JWT_VC.to_string()),
-        claims: Some(vec!["person-is-alive".to_string()]),
-        disclosure: Some("predicate".to_string()),
-        purpose: Some("test".to_string()),
-        holder: Some(HolderRequest {
-            binding: Some("did".to_string()),
-            id: Some(holder_did_jwk()),
-            proof: None,
-        }),
-    };
-    let response = issue_credential(
-        HeaderMap::new(),
-        Some(Extension(Arc::clone(&state))),
-        Some(Extension(principal.clone())),
-        Ok(Json(request.clone())),
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::OK);
-    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("credential body reads");
-    let body: Value = serde_json::from_slice(&body).expect("credential response parses");
-    assert_eq!(body["credential_profile"], "civil_status_sd_jwt");
-    assert!(body["credential"]
-        .as_str()
-        .is_some_and(|credential| credential.contains('~')));
-    assert_eq!(sign_count.load(Ordering::SeqCst), 1);
-
-    evaluation
-        .issuance_provenance
-        .as_mut()
-        .expect("private closure exists")
-        .claims
-        .retain(|claim| claim.claim_id != "civil-record-active");
-    store
-        .insert(evaluation.clone())
-        .await
-        .expect("missing dependency fixture inserts");
-    let missing = issue_credential(
-        HeaderMap::new(),
-        Some(Extension(Arc::clone(&state))),
-        Some(Extension(principal.clone())),
-        Ok(Json(request.clone())),
-    )
-    .await;
-    assert_eq!(missing.status(), StatusCode::FORBIDDEN);
-    assert_eq!(sign_count.load(Ordering::SeqCst), 1);
-
-    evaluation.issuance_provenance = Some(issuance_provenance_with_dependency(
-        "person-is-alive",
-        "civil-record-active",
-        "test",
-        evaluation_id,
-    ));
-    evaluation
-        .issuance_provenance
-        .as_mut()
-        .expect("private closure exists")
-        .consultations
-        .push(registry_notary_core::StoredIssuanceConsultationProvenance {
-            consultation_id: "01J00000000000000000000002".to_string(),
-            acquired_at: "2026-05-23T00:00:00Z".to_string(),
-        });
-    store
-        .insert(evaluation)
-        .await
-        .expect("extra dependency execution fixture inserts");
-    let extra = issue_credential(
-        HeaderMap::new(),
-        Some(Extension(state)),
-        Some(Extension(principal)),
-        Ok(Json(request)),
-    )
-    .await;
-    assert_eq!(extra.status(), StatusCode::FORBIDDEN);
-    assert_eq!(sign_count.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn direct_dependency_execution_tampering_is_denied_before_signing() {
-    let evidence = credential_issue_evidence_with_dependency();
-    let store = Arc::new(EvidenceStore::default());
-    let sign_count = Arc::new(AtomicUsize::new(0));
-    let evaluation_id = "eval-registry-direct-tamper";
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_federation(
-            Arc::new(evidence),
-            Arc::new(SubjectAccessConfig::default()),
-            Arc::new(Oid4vciConfig::default()),
-            Arc::new(FederationConfig::default()),
-            AuditKeyHasher::unkeyed_dev_only(),
-            None,
-            ReplayStores::memory(),
-            CredentialStatusStore::disabled(),
-            Arc::new(AppMetrics::default()),
-            Arc::clone(&store),
-            Arc::new(CountingIssuerResolver {
-                sign_count: Arc::clone(&sign_count),
-            }),
-            None,
-        )
-        .expect("state builds"),
-    );
-    let principal = EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
-        principal_id: "caseworker".to_string(),
-        scopes: vec!["civil_registry:evidence_verification".to_string()],
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: None,
-    };
-    let request = CredentialIssueRequest {
-        evaluation_id: evaluation_id.to_string(),
-        credential_profile: Some("civil_status_sd_jwt".to_string()),
-        format: Some(FORMAT_SD_JWT_VC.to_string()),
-        claims: Some(vec!["person-is-alive".to_string()]),
-        disclosure: Some("predicate".to_string()),
-        purpose: Some("test".to_string()),
-        holder: Some(HolderRequest {
-            binding: Some("did".to_string()),
-            id: Some(holder_did_jwk()),
-            proof: None,
-        }),
-    };
-    let mut result = claim_result_view(evaluation_id, "person-is-alive");
-    result.provenance.used.relay_consultation_count = 2;
-    let baseline = registry_notary_core::StoredEvaluation {
-        client_id: "caseworker".to_string(),
-        purpose: "test".to_string(),
-        claim_ids: vec!["person-is-alive".to_string()],
-        claim_refs: Vec::new(),
-        disclosure: "predicate".to_string(),
-        format: FORMAT_CLAIM_RESULT_JSON.to_string(),
-        results: vec![result],
-        created_at: "2026-05-23T00:00:00Z".to_string(),
-        expires_at: "2999-01-01T00:00:00Z".to_string(),
-        request_hash: "request-hash".to_string(),
-        issuance_provenance: Some(issuance_provenance_with_dependency(
-            "person-is-alive",
-            "civil-record-active",
-            "test",
-            evaluation_id,
-        )),
-        subject_access: None,
-    };
-
-    let mut acquired_at_tampered = baseline.clone();
-    acquired_at_tampered
-        .issuance_provenance
-        .as_mut()
-        .expect("private closure exists")
-        .consultations[1]
-        .acquired_at = "2026-05-23T00:00:01Z".to_string();
-    store
-        .insert(acquired_at_tampered)
-        .await
-        .expect("acquired-at tamper fixture inserts");
-    let acquired_at_denial = issue_credential(
-        HeaderMap::new(),
-        Some(Extension(Arc::clone(&state))),
-        Some(Extension(principal.clone())),
-        Ok(Json(request.clone())),
-    )
-    .await;
-    assert_eq!(acquired_at_denial.status(), StatusCode::FORBIDDEN);
-    assert_eq!(sign_count.load(Ordering::SeqCst), 0);
-
-    let mut ids_swapped = baseline;
-    let claims = &mut ids_swapped
-        .issuance_provenance
-        .as_mut()
-        .expect("private closure exists")
-        .claims;
-    let dependency_id = claims[0].consultation_id.clone();
-    claims[0].consultation_id = claims[1].consultation_id.clone();
-    claims[1].consultation_id = dependency_id;
-    store
-        .insert(ids_swapped)
-        .await
-        .expect("execution-id swap fixture inserts");
-    let swapped_denial = issue_credential(
-        HeaderMap::new(),
-        Some(Extension(state)),
-        Some(Extension(principal)),
-        Ok(Json(request)),
-    )
-    .await;
-    assert_eq!(swapped_denial.status(), StatusCode::FORBIDDEN);
-    assert_eq!(sign_count.load(Ordering::SeqCst), 0);
-}
-
-#[tokio::test]
-async fn delegated_evaluation_cannot_issue_directly_even_with_registry_provenance() {
-    let evidence = Arc::new(registry_backed_oid4vci_evidence_with_dependency());
-    let subject_access = Arc::new(subject_access_config());
-    let store = Arc::new(EvidenceStore::default());
-    let sign_count = Arc::new(AtomicUsize::new(0));
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_federation(
-            Arc::clone(&evidence),
-            Arc::clone(&subject_access),
-            Arc::new(Oid4vciConfig::default()),
-            Arc::new(FederationConfig::default()),
-            AuditKeyHasher::unkeyed_dev_only(),
-            None,
-            ReplayStores::memory(),
-            CredentialStatusStore::disabled(),
-            Arc::new(AppMetrics::default()),
-            Arc::clone(&store),
-            Arc::new(CountingIssuerResolver {
-                sign_count: Arc::clone(&sign_count),
-            }),
-            None,
-        )
-        .expect("state builds"),
-    );
-    let mut principal = fresh_oidc_principal(
-        Some("client_id:citizen-portal"),
-        &["subject_access", "person_is_alive"],
-    );
-    let classified = classify_subject_access_principal(&subject_access, &principal)
-        .expect("subject-access principal classifies");
-    let mut context = prepare_subject_access_evaluate(
-        &state,
-        &evidence,
-        &classified,
-        &evaluate_request("NAT-123"),
-    )
-    .expect("subject-access metadata prepares");
-    context.metadata.access_mode = AccessMode::DelegatedSubjectAccess;
-    principal.authorization_details = Some(registry_notary_core::EvidenceAuthorizationDetails {
-        access_mode: Some(AccessMode::DelegatedSubjectAccess),
-        ..Default::default()
-    });
-    let evaluation_id = "eval-delegated-direct-retired";
-    let mut result = claim_result_view(evaluation_id, "person-is-alive");
-    result.provenance.used.relay_consultation_count = 2;
-    store
-        .insert(registry_notary_core::StoredEvaluation {
-            client_id: context.metadata.principal_hash.as_str().to_string(),
-            purpose: "citizen_subject_access".to_string(),
-            claim_ids: vec!["person-is-alive".to_string()],
-            claim_refs: Vec::new(),
-            disclosure: "predicate".to_string(),
-            format: FORMAT_CLAIM_RESULT_JSON.to_string(),
-            results: vec![result],
-            created_at: "2026-05-23T00:00:00Z".to_string(),
-            expires_at: "2999-01-01T00:00:00Z".to_string(),
-            request_hash: "request-hash".to_string(),
-            issuance_provenance: Some(issuance_provenance_with_dependency(
-                "person-is-alive",
-                "civil-record-active",
-                "citizen_subject_access",
-                evaluation_id,
-            )),
-            subject_access: Some(context.metadata),
-        })
-        .await
-        .expect("delegated evaluation fixture inserts");
-
-    let response = issue_credential(
-        HeaderMap::new(),
-        Some(Extension(state)),
-        Some(Extension(principal)),
-        Ok(Json(CredentialIssueRequest {
-            evaluation_id: evaluation_id.to_string(),
-            credential_profile: Some("civil_status_sd_jwt".to_string()),
-            format: Some(FORMAT_SD_JWT_VC.to_string()),
-            claims: Some(vec!["person-is-alive".to_string()]),
-            disclosure: Some("predicate".to_string()),
-            purpose: Some("citizen_subject_access".to_string()),
-            holder: Some(HolderRequest {
-                binding: Some("did".to_string()),
-                id: Some(holder_did_jwk()),
-                proof: None,
-            }),
-        })),
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-    assert_eq!(sign_count.load(Ordering::SeqCst), 0);
-}
-
-#[tokio::test]
-async fn issue_credential_fails_closed_when_status_record_write_fails() {
-    let evidence = credential_issue_evidence_config();
-    let store = Arc::new(EvidenceStore::default());
-    store
-        .insert(registry_notary_core::StoredEvaluation {
-            client_id: "caseworker".to_string(),
-            purpose: "test".to_string(),
-            claim_ids: vec!["person-is-alive".to_string()],
-            claim_refs: Vec::new(),
-            disclosure: "predicate".to_string(),
-            format: FORMAT_CLAIM_RESULT_JSON.to_string(),
-            results: vec![claim_result_view(
-                "eval-status-write-fails",
-                "person-is-alive",
-            )],
-            created_at: "2026-05-23T00:00:00Z".to_string(),
-            expires_at: "2999-01-01T00:00:00Z".to_string(),
-            request_hash: "request-hash".to_string(),
-            issuance_provenance: Some(issuance_provenance(
-                "person-is-alive",
-                "test",
-                "eval-status-write-fails",
-            )),
-            subject_access: None,
-        })
-        .await
-        .expect("evaluation inserts");
-    let credential_status = CredentialStatusStore::with_test_store(
-        &CredentialStatusConfig {
-            enabled: true,
-            base_url: "https://issuer.example".to_string(),
-            retention_seconds: 60,
-        },
-        Arc::new(UnavailableCredentialStatusStore),
-    );
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_federation(
-            Arc::new(evidence),
-            Arc::new(SubjectAccessConfig::default()),
-            Arc::new(Oid4vciConfig::default()),
-            Arc::new(FederationConfig::default()),
-            AuditKeyHasher::unkeyed_dev_only(),
-            None,
-            ReplayStores::memory(),
-            credential_status,
-            Arc::new(AppMetrics::default()),
-            Arc::clone(&store),
-            Arc::new(TestIssuerResolver),
-            None,
-        )
-        .expect("state builds"),
-    );
-    let principal = EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
-        principal_id: "caseworker".to_string(),
-        scopes: vec!["civil_registry:evidence_verification".to_string()],
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: None,
-    };
-
-    let response = issue_credential(
-        HeaderMap::new(),
-        Some(Extension(state)),
-        Some(Extension(principal)),
-        Ok(Json(CredentialIssueRequest {
-            evaluation_id: "eval-status-write-fails".to_string(),
-            credential_profile: Some("civil_status_sd_jwt".to_string()),
-            format: Some(FORMAT_SD_JWT_VC.to_string()),
-            claims: Some(vec!["person-is-alive".to_string()]),
-            disclosure: Some("predicate".to_string()),
-            purpose: None,
-            holder: Some(HolderRequest {
-                binding: Some("did".to_string()),
-                id: Some(holder_did_jwk()),
-                proof: None,
-            }),
-        })),
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::INTERNAL_SERVER_ERROR);
-    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("body reads");
-    let body: Value = serde_json::from_slice(&body).expect("problem body parses");
-    assert_eq!(body["code"], json!("credential.issuance_failed"));
-}
-
-#[tokio::test]
-async fn issue_credential_rejects_purpose_mismatch() {
-    let evidence = credential_issue_evidence_config();
-    let store = Arc::new(EvidenceStore::default());
-    let sign_count = Arc::new(AtomicUsize::new(0));
-    store
-        .insert(registry_notary_core::StoredEvaluation {
-            client_id: "caseworker".to_string(),
-            purpose: "benefits".to_string(),
-            claim_ids: vec!["person-is-alive".to_string()],
-            claim_refs: Vec::new(),
-            disclosure: "predicate".to_string(),
-            format: FORMAT_CLAIM_RESULT_JSON.to_string(),
-            results: vec![claim_result_view(
-                "eval-purpose-mismatch",
-                "person-is-alive",
-            )],
-            created_at: "2026-05-23T00:00:00Z".to_string(),
-            expires_at: "2999-01-01T00:00:00Z".to_string(),
-            request_hash: "request-hash".to_string(),
-            issuance_provenance: Some(issuance_provenance(
-                "person-is-alive",
-                "benefits",
-                "eval-purpose-mismatch",
-            )),
-            subject_access: None,
-        })
-        .await
-        .expect("evaluation inserts");
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_federation(
-            Arc::new(evidence),
-            Arc::new(SubjectAccessConfig::default()),
-            Arc::new(Oid4vciConfig::default()),
-            Arc::new(FederationConfig::default()),
-            AuditKeyHasher::unkeyed_dev_only(),
-            None,
-            ReplayStores::memory(),
-            CredentialStatusStore::disabled(),
-            Arc::new(AppMetrics::default()),
-            Arc::clone(&store),
-            Arc::new(CountingIssuerResolver {
-                sign_count: Arc::clone(&sign_count),
-            }),
-            None,
-        )
-        .expect("state builds"),
-    );
-    let principal = EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
-        principal_id: "caseworker".to_string(),
-        scopes: vec!["civil_registry:evidence_verification".to_string()],
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: None,
-    };
-
-    let response = issue_credential(
-        HeaderMap::new(),
-        Some(Extension(state)),
-        Some(Extension(principal)),
-        Ok(Json(CredentialIssueRequest {
-            evaluation_id: "eval-purpose-mismatch".to_string(),
-            credential_profile: Some("civil_status_sd_jwt".to_string()),
-            format: Some(FORMAT_SD_JWT_VC.to_string()),
-            claims: Some(vec!["person-is-alive".to_string()]),
-            disclosure: Some("predicate".to_string()),
-            purpose: Some("appeals".to_string()),
-            holder: None,
-        })),
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("body reads");
-    let body: Value = serde_json::from_slice(&body).expect("problem body parses");
-    assert_eq!(body["code"], json!("evaluation.binding_mismatch"));
-    assert_eq!(
-        sign_count.load(Ordering::SeqCst),
-        0,
-        "purpose mismatch must be denied before credential signing"
-    );
-}
-
-#[tokio::test]
-async fn issuance_provenance_denial_precedes_signer_status_and_holder_replay() {
-    let mut evidence = credential_issue_evidence_config();
-    evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("credential profile exists")
-        .holder_binding = holder_required_profile().holder_binding;
-    let store = Arc::new(EvidenceStore::default());
-    let sign_count = Arc::new(AtomicUsize::new(0));
-    let evaluation_id = "eval-provenance-denied";
-    let mut evaluation = registry_notary_core::StoredEvaluation {
-        client_id: "caseworker".to_string(),
-        purpose: "test".to_string(),
-        claim_ids: vec!["person-is-alive".to_string()],
-        claim_refs: Vec::new(),
-        disclosure: "predicate".to_string(),
-        format: FORMAT_CLAIM_RESULT_JSON.to_string(),
-        results: vec![claim_result_view(evaluation_id, "person-is-alive")],
-        created_at: "2026-05-23T00:00:00Z".to_string(),
-        expires_at: "2999-01-01T00:00:00Z".to_string(),
-        request_hash: "request-hash".to_string(),
-        issuance_provenance: None,
-        subject_access: None,
-    };
-    store
-        .insert(evaluation.clone())
-        .await
-        .expect("legacy evaluation inserts");
-    let credential_status = CredentialStatusStore::with_test_store(
-        &CredentialStatusConfig {
-            enabled: true,
-            base_url: "https://issuer.example".to_string(),
-            retention_seconds: 60,
-        },
-        Arc::new(UnavailableCredentialStatusStore),
-    );
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_federation(
-            Arc::new(evidence),
-            Arc::new(SubjectAccessConfig::default()),
-            Arc::new(Oid4vciConfig::default()),
-            Arc::new(FederationConfig::default()),
-            AuditKeyHasher::unkeyed_dev_only(),
-            None,
-            ReplayStores::memory(),
-            credential_status,
-            Arc::new(AppMetrics::default()),
-            Arc::clone(&store),
-            Arc::new(CountingIssuerResolver {
-                sign_count: Arc::clone(&sign_count),
-            }),
-            None,
-        )
-        .expect("state builds"),
-    );
-    let principal = EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
-        principal_id: "caseworker".to_string(),
-        scopes: vec!["civil_registry:evidence_verification".to_string()],
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: None,
-    };
-    let holder_id = holder_did_jwk();
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let proof = sign_holder_proof(
-        &holder_id,
-        json!({
-            "sub": holder_id,
-            "aud": "registry-notary",
-            "iat": now,
-            "exp": now + 60,
-            "jti": "provenance-denial-proof",
-            "evaluation_id": evaluation_id,
-            "credential_profile": "civil_status_sd_jwt",
-            "disclosure": holder_proof_disclosure("predicate"),
-            "claims": ["person-is-alive"],
-        }),
-    );
-    let request = CredentialIssueRequest {
-        evaluation_id: evaluation_id.to_string(),
-        credential_profile: Some("civil_status_sd_jwt".to_string()),
-        format: Some(FORMAT_SD_JWT_VC.to_string()),
-        claims: Some(vec!["person-is-alive".to_string()]),
-        disclosure: Some("predicate".to_string()),
-        purpose: Some("test".to_string()),
-        holder: Some(HolderRequest {
-            binding: Some("did".to_string()),
-            id: Some(holder_id),
-            proof: Some(proof),
-        }),
-    };
-
-    let denied = issue_credential(
-        HeaderMap::new(),
-        Some(Extension(Arc::clone(&state))),
-        Some(Extension(principal.clone())),
-        Ok(Json(request.clone())),
-    )
-    .await;
-    assert_eq!(denied.status(), StatusCode::FORBIDDEN);
-    assert_eq!(sign_count.load(Ordering::SeqCst), 0);
-
-    evaluation.issuance_provenance = Some(issuance_provenance(
-        "person-is-alive",
-        "test",
-        evaluation_id,
-    ));
-    store
-        .insert(evaluation)
-        .await
-        .expect("re-evaluated record replaces legacy test record");
-    let after_reevaluation = issue_credential(
-        HeaderMap::new(),
-        Some(Extension(state)),
-        Some(Extension(principal)),
-        Ok(Json(request)),
-    )
-    .await;
-    assert_eq!(
-        after_reevaluation.status(),
-        StatusCode::INTERNAL_SERVER_ERROR,
-        "the same holder proof reaches status persistence after re-evaluation, so the denial did not consume replay state"
-    );
-    assert_eq!(sign_count.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn replayed_holder_proof_does_not_consume_machine_evaluation_lineage() {
-    let mut evidence = credential_issue_evidence_config();
-    evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("credential profile exists")
-        .holder_binding = holder_required_profile().holder_binding;
-    let store = Arc::new(EvidenceStore::default());
-    let evaluation_id = "eval-replayed-proof";
-    let evaluation_expires_at = OffsetDateTime::now_utc() + time::Duration::hours(1);
-    let evaluation = registry_notary_core::StoredEvaluation {
-        client_id: "caseworker".to_string(),
-        purpose: "test".to_string(),
-        claim_ids: vec!["person-is-alive".to_string()],
-        claim_refs: Vec::new(),
-        disclosure: "predicate".to_string(),
-        format: FORMAT_CLAIM_RESULT_JSON.to_string(),
-        results: vec![claim_result_view(evaluation_id, "person-is-alive")],
-        created_at: format_time(OffsetDateTime::now_utc()),
-        expires_at: format_time(evaluation_expires_at),
-        request_hash: "request-hash".to_string(),
-        issuance_provenance: Some(issuance_provenance(
-            "person-is-alive",
-            "test",
-            evaluation_id,
-        )),
-        subject_access: None,
-    };
-    store
-        .insert(evaluation.clone())
-        .await
-        .expect("evaluation inserts");
-    let replay = ReplayStores::memory();
-    let preauth =
-        oid4vci_test_preauth_runtime(registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP);
-    let oid4vci = Oid4vciConfig {
-        enabled: true,
-        ..Oid4vciConfig::default()
-    };
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_federation(
-            Arc::new(evidence),
-            Arc::new(SubjectAccessConfig::default()),
-            Arc::new(oid4vci),
-            Arc::new(FederationConfig::default()),
-            AuditKeyHasher::unkeyed_dev_only(),
-            None,
-            replay.clone(),
-            CredentialStatusStore::disabled(),
-            Arc::new(AppMetrics::default()),
-            Arc::clone(&store),
-            Arc::new(CountingIssuerResolver {
-                sign_count: Arc::new(AtomicUsize::new(0)),
-            }),
-            None,
-        )
-        .expect("state builds")
-        .with_preauth_runtime(Some(Arc::clone(&preauth))),
-    );
-    let principal = EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
-        principal_id: "caseworker".to_string(),
-        scopes: vec!["civil_registry:evidence_verification".to_string()],
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: None,
-    };
-    let holder_id = holder_did_jwk();
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let proof = sign_holder_proof(
-        &holder_id,
-        json!({
-            "sub": holder_id,
-            "aud": "registry-notary",
-            "iat": now,
-            "exp": now + 60,
-            "jti": "already-used-holder-proof",
-            "evaluation_id": evaluation_id,
-            "credential_profile": "civil_status_sd_jwt",
-            "disclosure": holder_proof_disclosure("predicate"),
-            "claims": ["person-is-alive"],
-        }),
-    );
-    let request = CredentialIssueRequest {
-        evaluation_id: evaluation_id.to_string(),
-        credential_profile: Some("civil_status_sd_jwt".to_string()),
-        format: Some(FORMAT_SD_JWT_VC.to_string()),
-        claims: Some(vec!["person-is-alive".to_string()]),
-        disclosure: Some("predicate".to_string()),
-        purpose: Some("test".to_string()),
-        holder: Some(HolderRequest {
-            binding: Some("did".to_string()),
-            id: Some(holder_id),
-            proof: Some(proof),
-        }),
-    };
-    let binding = validate_holder_request(
-        &state.evidence.credential_profiles["civil_status_sd_jwt"],
-        "civil_status_sd_jwt",
-        &request,
-        &evaluation,
-        request.holder.as_ref(),
-        &state.evidence.service_id,
-    )
-    .expect("holder proof validates")
-    .expect("holder proof has a replay binding");
-    require_replay_insert(
-        replay.store().as_ref(),
-        &binding.scope,
-        &binding.key,
-        binding.expires_at,
-    )
-    .await
-    .expect("test pre-consumes holder proof");
-
-    let denied = issue_credential(
-        HeaderMap::new(),
-        Some(Extension(state)),
-        Some(Extension(principal)),
-        Ok(Json(request)),
-    )
-    .await;
-    assert_eq!(denied.status(), StatusCode::CONFLICT);
-    preauth
-        .preauthorization_state()
-        .reserve_evaluation_issuance(evaluation_id, "caseworker", evaluation_expires_at)
-        .await
-        .expect("proof replay denial must leave evaluation lineage available");
-}
-
-#[test]
-fn strict_credential_issue_rejects_oid4vci_proof_shape() {
-    let holder_id = holder_did_jwk();
-    let proof = sign_oid4vci_proof("registry-notary", "nonce-1");
-    let request = issue_request();
-    let evaluation = evaluation_for_proof();
-    let holder = HolderRequest {
-        binding: Some("did".to_string()),
-        id: Some(holder_id),
-        proof: Some(proof),
-    };
-
-    let err = validate_holder_request(
-        &holder_required_profile(),
-        "profile-a",
-        &request,
-        &evaluation,
-        Some(&holder),
-        "registry-notary",
-    )
-    .expect_err("OID4VCI proof must not relax the strict credential endpoint proof");
-
-    assert!(matches!(err, EvidenceError::HolderProofRequired));
-}
diff --git a/crates/registry-notary-server/src/api/tests/evaluations.rs b/crates/registry-notary-server/src/api/tests/evaluations.rs
deleted file mode 100644
index fdd61f75b..000000000
--- a/crates/registry-notary-server/src/api/tests/evaluations.rs
+++ /dev/null
@@ -1,343 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Evaluations API tests.
-
-use super::*;
-
-#[derive(Debug)]
-struct AmbiguousApiRelay {
-    calls: std::sync::atomic::AtomicU64,
-}
-
-#[derive(Debug)]
-struct MatchingApiRelay {
-    calls: std::sync::atomic::AtomicU64,
-}
-
-#[async_trait::async_trait]
-impl crate::runtime::ActivatedRelayConsultations for MatchingApiRelay {
-    async fn check_ready(&self) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    fn validate(
-        &self,
-        _key: &crate::runtime::consultation::ConsultationGroupKeyV1,
-    ) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    async fn execute(
-        &self,
-        _key: &crate::runtime::consultation::ConsultationGroupKeyV1,
-    ) -> Result<
-        crate::runtime::consultation::RuntimeRelayConsultationResult,
-        crate::relay_client::RelayClientError,
-    > {
-        self.calls.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
-        let outputs = crate::runtime::consultation::RuntimeRelayOutputMap::from_json(
-            BTreeMap::from([("registration_status".to_string(), json!("ACTIVE"))]),
-        )?;
-        crate::runtime::consultation::RuntimeRelayConsultationResult::new(
-            ulid::Ulid::from_parts(3, 1),
-            crate::runtime::consultation::RuntimeRelayOutcome::Match,
-            Some(crate::runtime::consultation::RuntimeRelayMatchData::OutputMap(outputs)),
-            OffsetDateTime::UNIX_EPOCH,
-        )
-    }
-}
-
-fn registry_backed_api_evidence() -> EvidenceConfig {
-    let mut evidence = evidence_config();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    let claim = evidence.claims.first_mut().expect("claim exists");
-    claim.evidence_mode = registry_notary_core::ClaimEvidenceMode::RegistryBacked {
-        consultations: BTreeMap::from([(
-            "enrollment".to_string(),
-            registry_notary_core::RelayConsultationConfig {
-                profile: registry_notary_core::RelayConsultationProfileRef {
-                    id: "example.enrollment-status.exact".to_string(),
-                    contract_hash:
-                        "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-                            .to_string(),
-                },
-                inputs: BTreeMap::from([(
-                    "tracked_entity".to_string(),
-                    registry_notary_core::RelayConsultationInput::TargetId,
-                )]),
-                outputs: BTreeMap::from([(
-                    "registration_status".to_string(),
-                    registry_notary_core::RelayOutputContract::String {
-                        nullable: true,
-                        max_bytes: 64,
-                    },
-                )]),
-            },
-        )]),
-    };
-    claim.purpose = Some("test".to_string());
-    claim.required_scopes = vec!["registry:evidence".to_string()];
-    claim.value.value_type = "string".to_string();
-    claim.value.nullable = true;
-    claim.rule = registry_notary_core::RuleConfig::ConsultationOutput {
-        consultation: "enrollment".to_string(),
-        output: "registration_status".to_string(),
-    };
-    evidence
-}
-
-#[async_trait::async_trait]
-impl crate::runtime::ActivatedRelayConsultations for AmbiguousApiRelay {
-    async fn check_ready(&self) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    fn validate(
-        &self,
-        _key: &crate::runtime::consultation::ConsultationGroupKeyV1,
-    ) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    async fn execute(
-        &self,
-        _key: &crate::runtime::consultation::ConsultationGroupKeyV1,
-    ) -> Result<
-        crate::runtime::consultation::RuntimeRelayConsultationResult,
-        crate::relay_client::RelayClientError,
-    > {
-        self.calls.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
-        crate::runtime::consultation::RuntimeRelayConsultationResult::new(
-            ulid::Ulid::from_parts(2, 1),
-            crate::runtime::consultation::RuntimeRelayOutcome::Ambiguous,
-            None,
-            OffsetDateTime::UNIX_EPOCH,
-        )
-    }
-}
-
-#[tokio::test]
-async fn ambiguous_relay_response_keeps_ids_only_in_restricted_audit_context() {
-    let evidence = registry_backed_api_evidence();
-    let state = Arc::new(RegistryNotaryApiState::new(
-        Arc::new(evidence),
-        AuditKeyHasher::unkeyed_dev_only(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    ));
-    let relay = Arc::new(AmbiguousApiRelay {
-        calls: std::sync::atomic::AtomicU64::new(0),
-    });
-    state
-        .install_activated_relay(relay.clone())
-        .expect("test Relay activates once");
-    let principal = EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
-        principal_id: "machine".to_string(),
-        scopes: vec![
-            "registry:evidence".to_string(),
-            "person-is-alive:1".to_string(),
-        ],
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: None,
-    };
-    let mut request = evaluate_request("subject-1");
-    request.target = Some(EvidenceEntity::from_subject_request(
-        "Person",
-        SubjectRequest {
-            id: "subject-1".to_string(),
-            id_type: None,
-        },
-    ));
-    request.purpose = Some("test".to_string());
-
-    let response = evaluate(
-        HeaderMap::new(),
-        Some(Extension(state)),
-        Some(Extension(principal)),
-        None,
-        Ok(Json(request)),
-    )
-    .await;
-
-    assert!(!response.status().is_success());
-    assert_eq!(
-        response
-            .extensions()
-            .get::<EvidenceErrorCodeContext>()
-            .expect("problem code context is attached")
-            .0,
-        "evidence.not_available"
-    );
-    assert_eq!(relay.calls.load(std::sync::atomic::Ordering::SeqCst), 1);
-    let audit = response
-        .extensions()
-        .get::<EvidenceAuditContext>()
-        .expect("denial audit context is attached");
-    let evaluation_id = audit
-        .verification_id
-        .clone()
-        .expect("post-preflight evaluation id is restricted-audited");
-    assert!(ulid::Ulid::from_string(&evaluation_id).is_ok());
-    let consultation_id = ulid::Ulid::from_parts(2, 1).to_string();
-    assert_eq!(audit.relay_consultation_ids, vec![consultation_id.clone()]);
-    assert_eq!(audit.relay_consultation_count, Some(1));
-    assert_eq!(audit.forwarded, Some(true));
-    let audit_debug = format!("{audit:?}");
-    assert!(!audit_debug.contains(&evaluation_id));
-    assert!(!audit_debug.contains(&consultation_id));
-
-    let public_body = to_bytes(response.into_body(), 64 * 1024)
-        .await
-        .expect("public problem body reads");
-    let public_body = String::from_utf8(public_body.to_vec()).expect("problem body is UTF-8");
-    assert!(!public_body.contains(&evaluation_id));
-    assert!(!public_body.contains(&consultation_id));
-}
-
-#[tokio::test]
-async fn machine_quota_is_atomic_at_the_handler_boundary_and_isolated_by_principal() {
-    let mut evidence = registry_backed_api_evidence();
-    evidence.machine_quota = registry_notary_core::MachineQuotaConfig {
-        enabled: true,
-        subjects_per_minute: 1,
-    };
-    let state = Arc::new(RegistryNotaryApiState::new(
-        Arc::new(evidence),
-        AuditKeyHasher::unkeyed_dev_only(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    ));
-    let relay = Arc::new(MatchingApiRelay {
-        calls: std::sync::atomic::AtomicU64::new(0),
-    });
-    state
-        .install_activated_relay(relay.clone())
-        .expect("test Relay activates once");
-
-    let principal = EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
-        principal_id: "machine-a".to_string(),
-        scopes: vec!["registry:evidence".to_string()],
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: None,
-    };
-    let request = || {
-        let mut request = evaluate_request("subject-1");
-        request.target = Some(EvidenceEntity::from_subject_request(
-            "Person",
-            SubjectRequest {
-                id: "subject-1".to_string(),
-                id_type: None,
-            },
-        ));
-        request.purpose = Some("test".to_string());
-        request
-    };
-    let invoke = || {
-        evaluate(
-            HeaderMap::new(),
-            Some(Extension(Arc::clone(&state))),
-            Some(Extension(principal.clone())),
-            None,
-            Ok(Json(request())),
-        )
-    };
-    let (first, second) = tokio::join!(invoke(), invoke());
-    let statuses = [first.status(), second.status()];
-    assert_eq!(
-        statuses.iter().filter(|status| status.is_success()).count(),
-        1
-    );
-    assert_eq!(
-        statuses
-            .iter()
-            .filter(|status| **status == StatusCode::TOO_MANY_REQUESTS)
-            .count(),
-        1
-    );
-    assert_eq!(relay.calls.load(std::sync::atomic::Ordering::SeqCst), 1);
-
-    let other_principal = EvidencePrincipal {
-        principal_id: "machine-b".to_string(),
-        ..principal
-    };
-    let response = evaluate(
-        HeaderMap::new(),
-        Some(Extension(state)),
-        Some(Extension(other_principal)),
-        None,
-        Ok(Json(request())),
-    )
-    .await;
-    assert!(response.status().is_success());
-    assert_eq!(relay.calls.load(std::sync::atomic::Ordering::SeqCst), 2);
-}
-
-#[test]
-fn pdp_policy_denials_keep_public_stable_problem_codes() {
-    let error = EvidenceError::PolicyDenied {
-        code: "pdp.assurance_insufficient",
-        policy_id: None,
-        policy_hash: None,
-        evaluated_rule_ids: Vec::new(),
-    };
-
-    assert_eq!(error.code(), "pdp.assurance_insufficient");
-    assert_eq!(error.audit_code(), "pdp.assurance_insufficient");
-    assert_eq!(evidence_status(&error), StatusCode::FORBIDDEN);
-    assert_eq!(evidence_title(&error), "Policy decision denied");
-    assert_eq!(
-        evidence_detail(&error),
-        "the configured policy denied the evidence request"
-    );
-}
-
-#[test]
-fn evaluation_access_uses_stored_claim_version_scope() {
-    let mut evidence = evidence_config();
-    let mut older_claim = evidence.claims[0].clone();
-    older_claim.version = "1.0".to_string();
-    older_claim.required_scopes = vec!["person-is-alive:1.0".to_string()];
-    let mut newer_claim = older_claim.clone();
-    newer_claim.version = "2.0".to_string();
-    newer_claim.required_scopes = vec!["person-is-alive:2.0".to_string()];
-    evidence.claims = vec![older_claim, newer_claim];
-    let evaluation = registry_notary_core::StoredEvaluation {
-        client_id: "caseworker".to_string(),
-        purpose: "test".to_string(),
-        claim_ids: vec!["person-is-alive".to_string()],
-        claim_refs: vec![ClaimRef::with_version("person-is-alive", "2.0")],
-        disclosure: "predicate".to_string(),
-        format: FORMAT_CLAIM_RESULT_JSON.to_string(),
-        results: Vec::new(),
-        created_at: "2026-05-23T00:00:00Z".to_string(),
-        expires_at: "2999-01-01T00:00:00Z".to_string(),
-        request_hash: "request-hash".to_string(),
-        issuance_provenance: None,
-        subject_access: None,
-    };
-    let principal = EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
-        principal_id: "caseworker".to_string(),
-        scopes: vec!["person-is-alive:1.0".to_string()],
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: None,
-    };
-
-    let err = require_evaluation_access(&evidence, &principal, &evaluation)
-        .expect_err("version 1 scope must not authorize stored version 2 evaluation");
-    assert!(matches!(
-        err,
-        EvidenceError::ScopeDenied { required } if required == "person-is-alive:2.0"
-    ));
-
-    let principal = EvidencePrincipal {
-        scopes: vec!["person-is-alive:2.0".to_string()],
-        ..principal
-    };
-    require_evaluation_access(&evidence, &principal, &evaluation)
-        .expect("version 2 scope authorizes stored version 2 evaluation");
-}
diff --git a/crates/registry-notary-server/src/api/tests/mod.rs b/crates/registry-notary-server/src/api/tests/mod.rs
deleted file mode 100644
index a911a2e5f..000000000
--- a/crates/registry-notary-server/src/api/tests/mod.rs
+++ /dev/null
@@ -1,13 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Owner-oriented API unit and security-invariant tests.
-
-include!("support.rs");
-
-mod admin;
-mod audit;
-mod credentials;
-mod evaluations;
-mod oid4vci;
-mod state;
-mod status;
-mod subject_access;
diff --git a/crates/registry-notary-server/src/api/tests/oid4vci.rs b/crates/registry-notary-server/src/api/tests/oid4vci.rs
deleted file mode 100644
index bfa3d99e1..000000000
--- a/crates/registry-notary-server/src/api/tests/oid4vci.rs
+++ /dev/null
@@ -1,3526 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Oid4Vci API tests.
-
-use super::*;
-
-#[test]
-fn token_client_address_ignores_forwarded_headers_from_untrusted_peer() {
-    let mut headers = HeaderMap::new();
-    headers.insert("x-forwarded-for", HeaderValue::from_static("203.0.113.10"));
-    let connect_info =
-        axum::extract::ConnectInfo("198.51.100.10:443".parse::<SocketAddr>().unwrap());
-
-    assert_eq!(
-        token_client_address_with_trusted_proxy_ips(&headers, Some(&connect_info), &[]),
-        "198.51.100.10"
-    );
-}
-
-#[test]
-fn token_client_address_trusts_forwarded_for_from_configured_proxy() {
-    let mut headers = HeaderMap::new();
-    headers.insert(
-        "x-forwarded-for",
-        HeaderValue::from_static("203.0.113.10, 198.51.100.20"),
-    );
-    let connect_info =
-        axum::extract::ConnectInfo("198.51.100.10:443".parse::<SocketAddr>().unwrap());
-    let trusted_proxy = "198.51.100.10".parse::<IpAddr>().unwrap();
-
-    assert_eq!(
-        token_client_address_with_trusted_proxy_ips(
-            &headers,
-            Some(&connect_info),
-            &[trusted_proxy]
-        ),
-        "203.0.113.10"
-    );
-}
-
-#[test]
-fn token_client_address_trusts_real_ip_from_configured_proxy() {
-    let mut headers = HeaderMap::new();
-    headers.insert("x-real-ip", HeaderValue::from_static("203.0.113.11"));
-    let connect_info =
-        axum::extract::ConnectInfo("198.51.100.10:443".parse::<SocketAddr>().unwrap());
-    let trusted_proxy = "198.51.100.10".parse::<IpAddr>().unwrap();
-
-    assert_eq!(
-        token_client_address_with_trusted_proxy_ips(
-            &headers,
-            Some(&connect_info),
-            &[trusted_proxy]
-        ),
-        "203.0.113.11"
-    );
-}
-
-#[test]
-fn oid4vci_requested_url_ignores_forwarded_host_from_untrusted_peer() {
-    let config = Oid4vciConfig {
-        credential_issuer: "https://issuer.example".to_string(),
-        ..Oid4vciConfig::default()
-    };
-    let mut headers = HeaderMap::new();
-    headers.insert("x-forwarded-proto", HeaderValue::from_static("http"));
-    headers.insert("x-forwarded-host", HeaderValue::from_static("evil.example"));
-    headers.insert(header::HOST, HeaderValue::from_static("host.example"));
-    let uri = "/credentials/identity".parse::<Uri>().unwrap();
-
-    // Untrusted peer: forwarded scheme/host are ignored, Host header wins.
-    assert_eq!(
-        oid4vci_requested_absolute_url_for_path(
-            &config,
-            &headers,
-            &uri,
-            "/credentials/identity",
-            false,
-        ),
-        Some("https://host.example/credentials/identity".to_string())
-    );
-}
-
-#[test]
-fn oid4vci_requested_url_trusts_forwarded_host_from_trusted_peer() {
-    let config = Oid4vciConfig {
-        credential_issuer: "https://issuer.example".to_string(),
-        ..Oid4vciConfig::default()
-    };
-    let mut headers = HeaderMap::new();
-    headers.insert("x-forwarded-proto", HeaderValue::from_static("http"));
-    headers.insert(
-        "x-forwarded-host",
-        HeaderValue::from_static("proxy.example"),
-    );
-    headers.insert(header::HOST, HeaderValue::from_static("host.example"));
-    let uri = "/credentials/identity".parse::<Uri>().unwrap();
-
-    // Trusted peer: forwarded scheme/host are honored.
-    assert_eq!(
-        oid4vci_requested_absolute_url_for_path(
-            &config,
-            &headers,
-            &uri,
-            "/credentials/identity",
-            true,
-        ),
-        Some("http://proxy.example/credentials/identity".to_string())
-    );
-}
-
-#[test]
-fn oid4vci_metadata_is_public_but_not_operationally_leaky() {
-    let evidence = oid4vci_evidence_config();
-    let metadata = serde_json::to_value(
-        oid4vci_metadata(&oid4vci_config(), &evidence).expect("metadata builds"),
-    )
-    .expect("metadata serializes");
-
-    assert_eq!(
-        metadata["credential_endpoint"],
-        "http://127.0.0.1:4325/oid4vci/credential"
-    );
-    assert!(metadata.get("nonce_endpoint").is_none());
-    assert_eq!(
-        metadata["credential_configurations_supported"]["person_is_alive_sd_jwt"]["display"][0]
-            ["name"],
-        "Person is alive"
-    );
-    assert_eq!(metadata["display"][0]["name"], "Civil Registry Notary");
-    assert_eq!(
-        metadata["display"][0]["logo"]["uri"],
-        "https://issuer.example/assets/notary-logo.png"
-    );
-    assert_eq!(
-        metadata["credential_configurations_supported"]["person_is_alive_sd_jwt"]["display"][0]
-            ["description"],
-        "Proof that the civil registry currently records this person as alive."
-    );
-    assert_eq!(
-        metadata["credential_configurations_supported"]["person_is_alive_sd_jwt"]["display"][0]
-            ["background_color"],
-        "#0057B8"
-    );
-    assert_eq!(
-        metadata["credential_configurations_supported"]["person_is_alive_sd_jwt"]["display"][0]
-            ["logo"]["uri"],
-        "https://issuer.example/assets/person-is-alive.png"
-    );
-    assert!(
-        metadata["credential_configurations_supported"]["person_is_alive_sd_jwt"]["display"][0]
-            ["logo"]
-            .get("url")
-            .is_none()
-    );
-    assert_eq!(
-        metadata["credential_configurations_supported"]["person_is_alive_sd_jwt"]["scope"],
-        "person_is_alive"
-    );
-    assert_eq!(
-        metadata["credential_configurations_supported"]["person_is_alive_sd_jwt"]
-            ["credential_signing_alg_values_supported"][0],
-        "EdDSA"
-    );
-    assert_eq!(
-        metadata["credential_configurations_supported"]["person_is_alive_sd_jwt"]
-            ["proof_types_supported"]["jwt"]["proof_signing_alg_values_supported"][0],
-        "EdDSA"
-    );
-    let text = metadata.to_string();
-    assert!(!text.contains("token_env"));
-    assert!(!text.contains("source_connections"));
-    assert!(!text.contains("NAT-123"));
-}
-
-#[test]
-fn oid4vci_metadata_advertises_configured_credential_signing_alg() {
-    let oid4vci = oid4vci_config();
-    let mut evidence = oid4vci_evidence_config();
-    evidence
-        .signing_keys
-        .get_mut("issuer-key")
-        .expect("issuer key exists")
-        .alg = "ES256".to_string();
-
-    let metadata =
-        serde_json::to_value(oid4vci_metadata(&oid4vci, &evidence).expect("metadata builds"))
-            .expect("metadata serializes");
-    let configuration = &metadata["credential_configurations_supported"]["person_is_alive_sd_jwt"];
-
-    assert_eq!(
-        configuration["credential_signing_alg_values_supported"],
-        json!(["ES256"])
-    );
-    assert_eq!(
-        configuration["proof_types_supported"]["jwt"]["proof_signing_alg_values_supported"],
-        json!(["EdDSA"]),
-        "holder proof algorithms stay independent from issuer signing algorithms"
-    );
-}
-
-#[tokio::test]
-async fn oid4vci_credential_rejects_delegated_transaction_token() {
-    let store = Arc::new(EvidenceStore::default());
-    let mut oid4vci = oid4vci_config();
-    oid4vci.accepted_token_audiences = vec!["registry-notary-citizen".to_string()];
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_subject_access_and_oid4vci(
-            Arc::new(oid4vci_evidence_config()),
-            Arc::new(delegated_subject_access_config()),
-            Arc::new(oid4vci),
-            AuditKeyHasher::unkeyed_dev_only(),
-            Arc::clone(&store),
-            Arc::new(TestIssuerResolver),
-        )
-        .with_preauth_runtime(Some(oid4vci_test_preauth_runtime(
-            registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
-        ))),
-    );
-    let mut principal = fresh_oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]);
-    principal.authorization_details =
-        Some(delegated_authorization_details(&delegated_evidence_config()));
-    let nonce = "delegated-oid4vci-nonce";
-    let proof = sign_oid4vci_proof(&state.oid4vci.credential_issuer, nonce);
-    let response = oid4vci_credential(
-        Some(Extension(Arc::clone(&state))),
-        Some(Extension(principal)),
-        Some(Extension(validated_oid4vci_proof(
-            &state,
-            &proof,
-            Some(nonce),
-        ))),
-        Json(Oid4vciCredentialRequest {
-            format: SD_JWT_VC_FORMAT.to_string(),
-            credential_identifier: Some("person_is_alive_sd_jwt".to_string()),
-            credential_configuration_id: None,
-            vct: None,
-            proof: registry_platform_oid4vci::CredentialRequestProof {
-                proof_type: PROOF_TYPE_JWT.to_string(),
-                jwt: proof,
-            },
-            proofs: registry_platform_oid4vci::CredentialRequestProofs::default(),
-        }),
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("body reads");
-    let body: Value = serde_json::from_slice(&body).expect("error body parses");
-    assert_eq!(body["error"], "access_denied");
-}
-
-#[tokio::test]
-async fn oid4vci_credential_scope_prevents_cross_configuration_issuance_before_nonce_consume() {
-    let store = Arc::new(EvidenceStore::default());
-    let evidence = Arc::new(oid4vci_evidence_config());
-    let subject_access = Arc::new(subject_access_config());
-    let mut oid4vci = oid4vci_config();
-    oid4vci.accepted_token_audiences = vec!["registry-notary-citizen".to_string()];
-    let mut other_configuration = oid4vci
-        .credential_configurations
-        .get("person_is_alive_sd_jwt")
-        .expect("base configuration exists")
-        .clone();
-    other_configuration.scope = "date_of_birth".to_string();
-    other_configuration.vct = "https://issuer.example/credentials/date-of-birth".to_string();
-    oid4vci
-        .credential_configurations
-        .insert("date_of_birth_sd_jwt".to_string(), other_configuration);
-    let principal = oid4vci_authorized_principal(
-        &evidence,
-        &subject_access,
-        &oid4vci,
-        "person_is_alive_sd_jwt",
-        &["subject_access", "person_is_alive"],
-    );
-    let oid4vci = Arc::new(oid4vci);
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_subject_access_and_oid4vci(
-            Arc::clone(&evidence),
-            Arc::clone(&subject_access),
-            Arc::clone(&oid4vci),
-            AuditKeyHasher::unkeyed_dev_only(),
-            Arc::clone(&store),
-            Arc::new(TestIssuerResolver),
-        )
-        .with_preauth_runtime(Some(oid4vci_test_preauth_runtime(
-            registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
-        ))),
-    );
-    let nonce = "cross-configuration-nonce";
-    let (nonce_scope, nonce_key) =
-        reserve_oid4vci_test_nonce(&state, "date_of_birth_sd_jwt", nonce).await;
-    let proof = sign_oid4vci_proof(&state.oid4vci.credential_issuer, nonce);
-
-    let response = oid4vci_credential(
-        Some(Extension(Arc::clone(&state))),
-        Some(Extension(principal)),
-        Some(Extension(validated_oid4vci_proof(
-            &state,
-            &proof,
-            Some(nonce),
-        ))),
-        Json(Oid4vciCredentialRequest {
-            format: SD_JWT_VC_FORMAT.to_string(),
-            credential_identifier: Some("date_of_birth_sd_jwt".to_string()),
-            credential_configuration_id: None,
-            vct: None,
-            proof: registry_platform_oid4vci::CredentialRequestProof {
-                proof_type: PROOF_TYPE_JWT.to_string(),
-                jwt: proof,
-            },
-            proofs: registry_platform_oid4vci::CredentialRequestProofs::default(),
-        }),
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("body reads");
-    let body: Value = serde_json::from_slice(&body).expect("error body parses");
-    assert_eq!(body["error"], "access_denied");
-    assert!(matches!(
-        state
-            .replay
-            .nonce_store()
-            .consume_nonce(&nonce_scope, &nonce_key)
-            .await
-            .expect("nonce store is available"),
-        ReplayInsertOutcome::Inserted
-    ));
-}
-
-#[tokio::test]
-async fn oid4vci_credential_requires_authorization_details_before_nonce_consume() {
-    let store = Arc::new(EvidenceStore::default());
-    let evidence = Arc::new(oid4vci_evidence_config());
-    let subject_access = Arc::new(subject_access_config());
-    let mut oid4vci = oid4vci_config();
-    oid4vci.accepted_token_audiences = vec!["registry-notary-citizen".to_string()];
-    let oid4vci = Arc::new(oid4vci);
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_subject_access_and_oid4vci(
-            Arc::clone(&evidence),
-            Arc::clone(&subject_access),
-            Arc::clone(&oid4vci),
-            AuditKeyHasher::unkeyed_dev_only(),
-            Arc::clone(&store),
-            Arc::new(TestIssuerResolver),
-        )
-        .with_preauth_runtime(Some(oid4vci_test_preauth_runtime(
-            registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
-        ))),
-    );
-    let nonce = "missing-authz-nonce";
-    let (nonce_scope, nonce_key) =
-        reserve_oid4vci_test_nonce(&state, "person_is_alive_sd_jwt", nonce).await;
-    let proof = sign_oid4vci_proof(&state.oid4vci.credential_issuer, nonce);
-    let mut principal = fresh_oidc_principal(
-        Some("client_id:citizen-portal"),
-        &["subject_access", "person_is_alive"],
-    );
-    let claims = principal
-        .verified_claims
-        .as_mut()
-        .expect("test principal has claims");
-    claims.token_type = Some(bounded(
-        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
-    ));
-
-    let response = oid4vci_credential(
-        Some(Extension(Arc::clone(&state))),
-        Some(Extension(principal)),
-        Some(Extension(validated_oid4vci_proof(
-            &state,
-            &proof,
-            Some(nonce),
-        ))),
-        Json(Oid4vciCredentialRequest {
-            format: SD_JWT_VC_FORMAT.to_string(),
-            credential_identifier: Some("person_is_alive_sd_jwt".to_string()),
-            credential_configuration_id: None,
-            vct: None,
-            proof: registry_platform_oid4vci::CredentialRequestProof {
-                proof_type: PROOF_TYPE_JWT.to_string(),
-                jwt: proof,
-            },
-            proofs: registry_platform_oid4vci::CredentialRequestProofs::default(),
-        }),
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("body reads");
-    let body: Value = serde_json::from_slice(&body).expect("error body parses");
-    assert_eq!(body["error"], "access_denied");
-    assert!(matches!(
-        state
-            .replay
-            .nonce_store()
-            .consume_nonce(&nonce_scope, &nonce_key)
-            .await
-            .expect("nonce store is available"),
-        ReplayInsertOutcome::Inserted
-    ));
-}
-
-#[tokio::test]
-async fn oid4vci_credential_requires_custom_notary_typ_details_before_nonce_consume() {
-    let store = Arc::new(EvidenceStore::default());
-    let evidence = Arc::new(oid4vci_evidence_config());
-    let subject_access = Arc::new(subject_access_config());
-    let mut oid4vci = oid4vci_config();
-    oid4vci.accepted_token_audiences = vec!["registry-notary-citizen".to_string()];
-    let oid4vci = Arc::new(oid4vci);
-    let runtime_config = Arc::new(runtime_config_with_custom_access_token_typ());
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_subject_access_and_oid4vci(
-            Arc::clone(&evidence),
-            Arc::clone(&subject_access),
-            Arc::clone(&oid4vci),
-            AuditKeyHasher::unkeyed_dev_only(),
-            Arc::clone(&store),
-            Arc::new(TestIssuerResolver),
-        )
-        .with_runtime_config(runtime_config)
-        .with_preauth_runtime(Some(oid4vci_test_preauth_runtime(
-            "custom-notary-access+jwt",
-        ))),
-    );
-    let nonce = "custom-typ-missing-authz-nonce";
-    let (nonce_scope, nonce_key) =
-        reserve_oid4vci_test_nonce(&state, "person_is_alive_sd_jwt", nonce).await;
-    let proof = sign_oid4vci_proof(&state.oid4vci.credential_issuer, nonce);
-    let mut principal = fresh_oidc_principal(
-        Some("client_id:citizen-portal"),
-        &["subject_access", "person_is_alive"],
-    );
-    let claims = principal
-        .verified_claims
-        .as_mut()
-        .expect("test principal has claims");
-    claims.issuer = bounded("https://notary.example.test");
-    claims.token_type = Some(bounded("custom-notary-access+jwt"));
-
-    let response = oid4vci_credential(
-        Some(Extension(Arc::clone(&state))),
-        Some(Extension(principal)),
-        Some(Extension(validated_oid4vci_proof(
-            &state,
-            &proof,
-            Some(nonce),
-        ))),
-        Json(Oid4vciCredentialRequest {
-            format: SD_JWT_VC_FORMAT.to_string(),
-            credential_identifier: Some("person_is_alive_sd_jwt".to_string()),
-            credential_configuration_id: None,
-            vct: None,
-            proof: registry_platform_oid4vci::CredentialRequestProof {
-                proof_type: PROOF_TYPE_JWT.to_string(),
-                jwt: proof,
-            },
-            proofs: registry_platform_oid4vci::CredentialRequestProofs::default(),
-        }),
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("body reads");
-    let body: Value = serde_json::from_slice(&body).expect("error body parses");
-    assert_eq!(body["error"], "access_denied");
-    assert!(matches!(
-        state
-            .replay
-            .nonce_store()
-            .consume_nonce(&nonce_scope, &nonce_key)
-            .await
-            .expect("nonce store is available"),
-        ReplayInsertOutcome::Inserted
-    ));
-}
-
-#[test]
-fn oid4vci_type_metadata_defaults_display_locale_when_unconfigured() {
-    let mut oid4vci = oid4vci_config();
-    let configuration = oid4vci
-        .credential_configurations
-        .get_mut("person_is_alive_sd_jwt")
-        .expect("configuration exists");
-    configuration.display.locale = None;
-
-    let evidence = evidence_config();
-    let metadata = oid4vci_type_metadata_document(&evidence, configuration);
-
-    assert_eq!(metadata["display"][0]["locale"], "en-US");
-    assert_eq!(metadata["claims"][0]["display"][0]["locale"], "en-US");
-}
-
-#[test]
-fn oid4vci_type_metadata_advertises_claim_semantics_extension() {
-    let oid4vci = oid4vci_config();
-    let configuration = oid4vci
-        .credential_configurations
-        .get("person_is_alive_sd_jwt")
-        .expect("configuration exists");
-    let mut evidence = oid4vci_evidence_config();
-    evidence.claims.first_mut().expect("claim exists").semantics = Some(
-        serde_json::from_value(json!({
-            "concept": "https://publicschema.org/Person",
-            "predicate": "urn:registry-notary:predicate:person-is-alive",
-            "derived_from": ["https://publicschema.org/date_of_death"]
-        }))
-        .expect("claim semantics parses"),
-    );
-
-    let metadata = oid4vci_type_metadata_document(&evidence, configuration);
-
-    assert_eq!(
-        metadata["claims"][0]["registry_notary_semantics"]["concept"],
-        json!("https://publicschema.org/Person")
-    );
-    assert_eq!(
-        metadata["claims"][0]["registry_notary_semantics"]["predicate"],
-        json!("urn:registry-notary:predicate:person-is-alive")
-    );
-    assert_eq!(
-        metadata["claims"][0]["registry_notary_semantics"]["derived_from"],
-        json!(["https://publicschema.org/date_of_death"])
-    );
-}
-
-#[test]
-fn oid4vci_metadata_advertises_token_endpoint_only_when_preauth_enabled() {
-    // Pre-auth disabled (the default): no token endpoint is advertised, so a
-    // wallet sees an authorization_code-only issuer.
-    let disabled = oid4vci_config();
-    assert!(!disabled.pre_authorized_code.enabled);
-    let evidence = oid4vci_evidence_config();
-    let disabled_metadata =
-        serde_json::to_value(oid4vci_metadata(&disabled, &evidence).expect("metadata builds"))
-            .expect("metadata serializes");
-    assert!(
-        disabled_metadata.get("token_endpoint").is_none(),
-        "disabled pre-auth must not advertise a token endpoint"
-    );
-
-    // Pre-auth enabled: the Notary's own token endpoint is advertised,
-    // derived from the credential-issuer base like the credential endpoint.
-    let mut enabled = oid4vci_config();
-    enabled.pre_authorized_code.enabled = true;
-    let enabled_metadata =
-        serde_json::to_value(oid4vci_metadata(&enabled, &evidence).expect("metadata builds"))
-            .expect("metadata serializes");
-    assert_eq!(
-        enabled_metadata["token_endpoint"],
-        json!("http://127.0.0.1:4325/oid4vci/token"),
-        "enabled pre-auth advertises the Notary token endpoint"
-    );
-    // The credential-configuration metadata is otherwise unchanged: the
-    // pre-authorized-code grant is advertised per-offer in `grants`, not on
-    // the credential configuration.
-    assert_eq!(
-        enabled_metadata["credential_configurations_supported"]["person_is_alive_sd_jwt"]["scope"],
-        json!("person_is_alive")
-    );
-}
-
-#[tokio::test]
-async fn oid4vci_wire_errors_use_oauth_codes_and_keep_internal_audit_code() {
-    let response = oid4vci_error_response(Oid4vciWireError::InvalidProof);
-    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-    assert_eq!(
-        response
-            .extensions()
-            .get::<EvidenceErrorCodeContext>()
-            .map(|context| context.0.as_str()),
-        Some("oid4vci.invalid_proof")
-    );
-    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("body reads");
-    let body: Value = serde_json::from_slice(&body).expect("error body parses");
-
-    assert_eq!(body["error"], "invalid_proof");
-    assert!(body.get("code").is_none());
-}
-
-#[test]
-fn oid4vci_token_denial_audit_records_public_token_path() {
-    let audit = token_error_audit_event(
-        "/oid4vci/token",
-        StatusCode::BAD_REQUEST.as_u16(),
-        Some("person_is_alive_sd_jwt"),
-        SubjectAccessDenialCode::OperationDenied,
-    );
-
-    assert_eq!(audit.method, "POST");
-    assert_eq!(audit.path, "/oid4vci/token");
-    assert_eq!(audit.status, StatusCode::BAD_REQUEST.as_u16());
-    assert_eq!(audit.decision, "denied");
-    assert_eq!(
-        audit.denial_code,
-        Some(SubjectAccessDenialCode::OperationDenied)
-    );
-    assert_eq!(
-        audit.protocol.as_ref().map(|value| value.as_str()),
-        Some("openid4vci")
-    );
-    assert_eq!(
-        audit
-            .credential_configuration_id
-            .as_ref()
-            .map(|value| value.as_str()),
-        Some("person_is_alive_sd_jwt")
-    );
-}
-
-#[tokio::test]
-async fn oid4vci_token_error_fails_closed_when_denial_audit_fails() {
-    let response =
-        token_error_after_audit_result(token_error_response(TokenWireError::InvalidRequest), true);
-
-    assert_eq!(response.status(), StatusCode::INTERNAL_SERVER_ERROR);
-    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("body reads");
-    let body: Value = serde_json::from_slice(&body).expect("error body parses");
-    assert_eq!(body["error"], "server_error");
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[derive(Debug, Default)]
-struct StructuredRegistryCredentialRelay {
-    calls: AtomicUsize,
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[async_trait::async_trait]
-impl crate::runtime::ActivatedRelayConsultations for StructuredRegistryCredentialRelay {
-    async fn check_ready(&self) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    fn validate(
-        &self,
-        _key: &crate::runtime::consultation::ConsultationGroupKeyV1,
-    ) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    async fn execute(
-        &self,
-        _key: &crate::runtime::consultation::ConsultationGroupKeyV1,
-    ) -> Result<
-        crate::runtime::consultation::RuntimeRelayConsultationResult,
-        crate::relay_client::RelayClientError,
-    > {
-        self.calls.fetch_add(1, Ordering::SeqCst);
-        let outputs =
-            crate::runtime::consultation::RuntimeRelayOutputMap::from_json(BTreeMap::from([(
-                "record".to_string(),
-                json!({
-                    "name": "Ada",
-                    "parents": [
-                        { "identifier": "PARENT-2", "name": "Grace" },
-                        { "identifier": "PARENT-1", "name": "Charles" }
-                    ]
-                }),
-            )]))?;
-        crate::runtime::consultation::RuntimeRelayConsultationResult::new(
-            ulid::Ulid::new(),
-            crate::runtime::consultation::RuntimeRelayOutcome::Match,
-            Some(crate::runtime::consultation::RuntimeRelayMatchData::OutputMap(outputs)),
-            OffsetDateTime::now_utc(),
-        )
-    }
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn structured_oid4vci_configs() -> (SubjectAccessConfig, EvidenceConfig, Oid4vciConfig) {
-    let mut subject_access = subject_access_config();
-    subject_access.allowed_disclosures = vec!["value".to_string()];
-
-    let mut evidence = registry_backed_oid4vci_evidence_config();
-    let claim = evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "person-is-alive")
-        .expect("OID4VCI claim exists");
-    claim.value = registry_notary_core::ClaimValueConfig {
-        value_type: "object".to_string(),
-        nullable: true,
-        max_bytes: None,
-        unit: None,
-    };
-    claim.disclosure.default = "value".to_string();
-    claim.disclosure.allowed = vec!["value".to_string()];
-    claim.disclosure.downgrade = "deny".to_string();
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-        panic!("OID4VCI claim is registry backed");
-    };
-    let consultation = consultations
-        .get_mut("person_status")
-        .expect("OID4VCI consultation exists");
-    consultation.outputs = BTreeMap::from([(
-        "record".to_string(),
-        registry_notary_core::RelayOutputContract::Object {
-            nullable: false,
-            max_bytes: 4_096,
-            fields: BTreeMap::from([
-                (
-                    "name".to_string(),
-                    registry_notary_core::RelayOutputObjectFieldContract {
-                        required: true,
-                        schema: Box::new(registry_notary_core::RelayOutputContract::String {
-                            nullable: false,
-                            max_bytes: 128,
-                        }),
-                    },
-                ),
-                (
-                    "parents".to_string(),
-                    registry_notary_core::RelayOutputObjectFieldContract {
-                        required: true,
-                        schema: Box::new(registry_notary_core::RelayOutputContract::Array {
-                            nullable: false,
-                            max_bytes: 2_048,
-                            max_items: 4,
-                            items: Box::new(registry_notary_core::RelayOutputContract::Object {
-                                nullable: false,
-                                max_bytes: 512,
-                                fields: BTreeMap::from([
-                                    (
-                                        "identifier".to_string(),
-                                        registry_notary_core::RelayOutputObjectFieldContract {
-                                            required: true,
-                                            schema: Box::new(
-                                                registry_notary_core::RelayOutputContract::String {
-                                                    nullable: false,
-                                                    max_bytes: 64,
-                                                },
-                                            ),
-                                        },
-                                    ),
-                                    (
-                                        "name".to_string(),
-                                        registry_notary_core::RelayOutputObjectFieldContract {
-                                            required: true,
-                                            schema: Box::new(
-                                                registry_notary_core::RelayOutputContract::String {
-                                                    nullable: false,
-                                                    max_bytes: 128,
-                                                },
-                                            ),
-                                        },
-                                    ),
-                                ]),
-                            }),
-                        }),
-                    },
-                ),
-            ]),
-        },
-    )]);
-    claim.rule = RuleConfig::ConsultationOutput {
-        consultation: "person_status".to_string(),
-        output: "record".to_string(),
-    };
-    evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("OID4VCI credential profile exists")
-        .disclosure
-        .allowed = vec!["value".to_string()];
-
-    let mut oid4vci = oid4vci_config();
-    oid4vci.accepted_token_audiences = vec!["registry-notary-citizen".to_string()];
-    let configuration = oid4vci
-        .credential_configurations
-        .get_mut("person_is_alive_sd_jwt")
-        .expect("OID4VCI credential configuration exists");
-    configuration.claim_id = None;
-    configuration.claims = vec![registry_notary_core::Oid4vciCredentialClaimConfig {
-        id: "person-is-alive".to_string(),
-        output_path: vec!["person_record".to_string()],
-        display_name: "Person record".to_string(),
-        sd: "always".to_string(),
-    }];
-    (subject_access, evidence, oid4vci)
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_preserves_structured_result_as_one_verifiable_sd_jwt_disclosure() {
-    let store = Arc::new(EvidenceStore::default());
-    let (subject_access, evidence, oid4vci) = structured_oid4vci_configs();
-    let evidence = Arc::new(evidence);
-    let subject_access = Arc::new(subject_access);
-    let oid4vci = Arc::new(oid4vci);
-    let sign_count = Arc::new(AtomicUsize::new(0));
-    let preauth =
-        oid4vci_test_preauth_runtime(registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP);
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_subject_access_and_oid4vci(
-            Arc::clone(&evidence),
-            Arc::clone(&subject_access),
-            Arc::clone(&oid4vci),
-            oid4vci_test_audit_hasher(),
-            Arc::clone(&store),
-            Arc::new(CountingIssuerResolver {
-                sign_count: Arc::clone(&sign_count),
-            }),
-        )
-        .with_preauth_runtime(Some(Arc::clone(&preauth))),
-    );
-    let relay = Arc::new(StructuredRegistryCredentialRelay::default());
-    state
-        .install_activated_relay(relay.clone())
-        .expect("structured Registry Relay activates once");
-    let nonce = "structured-oid4vci-nonce";
-    let test_transaction = reserve_registry_backed_oid4vci_test_transaction(
-        &state,
-        &preauth,
-        "person_is_alive_sd_jwt",
-        nonce,
-    )
-    .await;
-    assert_eq!(relay.calls.load(Ordering::SeqCst), 1);
-
-    let stored = store
-        .get(
-            &test_transaction.transaction.evaluation_id,
-            &test_transaction.transaction.evaluation_client_id,
-        )
-        .await
-        .expect("structured evaluation reads")
-        .expect("structured evaluation is stored");
-    let expected_value = json!({
-        "name": "Ada",
-        "parents": [
-            { "identifier": "PARENT-2", "name": "Grace" },
-            { "identifier": "PARENT-1", "name": "Charles" }
-        ]
-    });
-    assert_eq!(stored.results[0].value, Some(expected_value.clone()));
-    assert_eq!(stored.results[0].disclosure, "value");
-
-    let proof = sign_oid4vci_proof(&state.oid4vci.credential_issuer, nonce);
-    let response = oid4vci_credential(
-        Some(Extension(Arc::clone(&state))),
-        Some(Extension(test_transaction.principal)),
-        Some(Extension(validated_oid4vci_proof(
-            &state,
-            &proof,
-            Some(nonce),
-        ))),
-        Json(Oid4vciCredentialRequest {
-            format: SD_JWT_VC_FORMAT.to_string(),
-            credential_identifier: Some("person_is_alive_sd_jwt".to_string()),
-            credential_configuration_id: None,
-            vct: None,
-            proof: registry_platform_oid4vci::CredentialRequestProof {
-                proof_type: PROOF_TYPE_JWT.to_string(),
-                jwt: proof,
-            },
-            proofs: registry_platform_oid4vci::CredentialRequestProofs::default(),
-        }),
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::OK);
-    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("OID4VCI credential body reads");
-    let body: Value = serde_json::from_slice(&body).expect("OID4VCI credential body parses");
-    let compact = body["credential"]
-        .as_str()
-        .expect("OID4VCI returns compact SD-JWT");
-    let parts = compact
-        .split('~')
-        .filter(|part| !part.is_empty())
-        .collect::<Vec<_>>();
-    assert_eq!(
-        parts.len(),
-        2,
-        "OID4VCI presents the complete structured result as one disclosure"
-    );
-    let decoded: Value = serde_json::from_slice(
-        &URL_SAFE_NO_PAD
-            .decode(parts[1])
-            .expect("OID4VCI disclosure is base64url"),
-    )
-    .expect("OID4VCI disclosure is JSON");
-    assert_eq!(decoded[1], json!("person_record"));
-    assert_eq!(decoded[2], expected_value);
-    let payload = decode_jwt_payload(parts[0]);
-    let digest = URL_SAFE_NO_PAD.encode(Sha256::digest(parts[1].as_bytes()));
-    assert!(payload["_sd"]
-        .as_array()
-        .is_some_and(|digests| digests.contains(&json!(digest))));
-    assert_eq!(sign_count.load(Ordering::SeqCst), 1);
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_projected_registry_credential_issues_and_caches_exact_retry() {
-    let store = Arc::new(EvidenceStore::default());
-    let mut subject_access = subject_access_config();
-    subject_access
-        .allowed_claims
-        .push("person-is-registered".to_string());
-    let mut evidence = registry_backed_oid4vci_evidence_with_dependency();
-    let mut registered = evidence.claims[0].clone();
-    registered.id = "person-is-registered".to_string();
-    registered.title = "Person is registered".to_string();
-    evidence.claims.push(registered);
-    evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("credential profile exists")
-        .allowed_claims
-        .push("person-is-registered".to_string());
-    let mut oid4vci = oid4vci_config();
-    oid4vci.accepted_token_audiences = vec!["registry-notary-citizen".to_string()];
-    let configuration = oid4vci
-        .credential_configurations
-        .get_mut("person_is_alive_sd_jwt")
-        .expect("credential configuration exists");
-    configuration.claim_id = None;
-    configuration.claims = vec![
-        registry_notary_core::Oid4vciCredentialClaimConfig {
-            id: "person-is-alive".to_string(),
-            output_path: vec!["person_alive".to_string()],
-            display_name: "Person is alive".to_string(),
-            sd: "always".to_string(),
-        },
-        registry_notary_core::Oid4vciCredentialClaimConfig {
-            id: "person-is-registered".to_string(),
-            output_path: vec!["person_registered".to_string()],
-            display_name: "Person is registered".to_string(),
-            sd: "always".to_string(),
-        },
-    ];
-    let evidence = Arc::new(evidence);
-    let subject_access = Arc::new(subject_access);
-    let oid4vci = Arc::new(oid4vci);
-    require_registry_backed_credential_claims(
-        &evidence,
-        &oid4vci
-            .credential_configurations
-            .get("person_is_alive_sd_jwt")
-            .unwrap()
-            .credential_claim_ids(),
-    )
-    .expect("positive fixture has registry-backed credential roots and dependency");
-    let sign_count = Arc::new(AtomicUsize::new(0));
-    let preauth =
-        oid4vci_test_preauth_runtime(registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP);
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_subject_access_and_oid4vci(
-            Arc::clone(&evidence),
-            Arc::clone(&subject_access),
-            Arc::clone(&oid4vci),
-            oid4vci_test_audit_hasher(),
-            Arc::clone(&store),
-            Arc::new(CountingIssuerResolver {
-                sign_count: Arc::clone(&sign_count),
-            }),
-        )
-        .with_preauth_runtime(Some(Arc::clone(&preauth))),
-    );
-    let relay = Arc::new(RegistryCredentialRelay::default());
-    state
-        .install_activated_relay(relay.clone())
-        .expect("registry credential Relay activates once");
-    let missing_nonce = oid4vci_credential(
-        Some(Extension(Arc::clone(&state))),
-        Some(Extension(fresh_oidc_principal(
-            Some("client_id:citizen-portal"),
-            &["subject_access"],
-        ))),
-        None,
-        Json(Oid4vciCredentialRequest {
-            format: SD_JWT_VC_FORMAT.to_string(),
-            credential_identifier: Some("person_is_alive_sd_jwt".to_string()),
-            credential_configuration_id: None,
-            vct: None,
-            proof: registry_platform_oid4vci::CredentialRequestProof {
-                proof_type: PROOF_TYPE_JWT.to_string(),
-                jwt: sign_oid4vci_proof_without_nonce(&state.oid4vci.credential_issuer),
-            },
-            proofs: registry_platform_oid4vci::CredentialRequestProofs::default(),
-        }),
-    )
-    .await;
-    assert_eq!(missing_nonce.status(), StatusCode::BAD_REQUEST);
-    let missing_nonce_body = axum::body::to_bytes(missing_nonce.into_body(), usize::MAX)
-        .await
-        .expect("body reads");
-    let missing_nonce_body: Value =
-        serde_json::from_slice(&missing_nonce_body).expect("error body parses");
-    assert_eq!(missing_nonce_body["error"], "invalid_proof");
-
-    let nonce = "nonce-1";
-    let test_transaction = reserve_registry_backed_oid4vci_test_transaction(
-        &state,
-        &preauth,
-        "person_is_alive_sd_jwt",
-        nonce,
-    )
-    .await;
-    assert_eq!(relay.calls.load(Ordering::SeqCst), 2);
-
-    let proof_without_nonce = sign_oid4vci_proof_without_nonce(&state.oid4vci.credential_issuer);
-    let missing_validated_nonce = oid4vci_credential(
-        Some(Extension(Arc::clone(&state))),
-        Some(Extension(test_transaction.principal.clone())),
-        Some(Extension(validated_oid4vci_proof(
-            &state,
-            &proof_without_nonce,
-            None,
-        ))),
-        Json(Oid4vciCredentialRequest {
-            format: SD_JWT_VC_FORMAT.to_string(),
-            credential_identifier: Some("person_is_alive_sd_jwt".to_string()),
-            credential_configuration_id: None,
-            vct: None,
-            proof: registry_platform_oid4vci::CredentialRequestProof {
-                proof_type: PROOF_TYPE_JWT.to_string(),
-                jwt: proof_without_nonce,
-            },
-            proofs: registry_platform_oid4vci::CredentialRequestProofs::default(),
-        }),
-    )
-    .await;
-    assert_eq!(missing_validated_nonce.status(), StatusCode::BAD_REQUEST);
-    let missing_validated_nonce_body =
-        axum::body::to_bytes(missing_validated_nonce.into_body(), usize::MAX)
-            .await
-            .expect("body reads");
-    let missing_validated_nonce_body: Value =
-        serde_json::from_slice(&missing_validated_nonce_body).expect("error body parses");
-    assert_eq!(missing_validated_nonce_body["error"], "invalid_proof");
-
-    let proof = sign_oid4vci_proof(&state.oid4vci.credential_issuer, nonce);
-    let request = Oid4vciCredentialRequest {
-        format: SD_JWT_VC_FORMAT.to_string(),
-        credential_identifier: Some("person_is_alive_sd_jwt".to_string()),
-        credential_configuration_id: None,
-        vct: None,
-        proof: registry_platform_oid4vci::CredentialRequestProof {
-            proof_type: PROOF_TYPE_JWT.to_string(),
-            jwt: proof.clone(),
-        },
-        proofs: registry_platform_oid4vci::CredentialRequestProofs::default(),
-    };
-    let validated_proof = validated_oid4vci_proof(&state, &proof, Some(nonce));
-    let response = oid4vci_credential(
-        Some(Extension(Arc::clone(&state))),
-        Some(Extension(test_transaction.principal.clone())),
-        Some(Extension(validated_proof.clone())),
-        Json(request.clone()),
-    )
-    .await;
-
-    let denial = response
-        .extensions()
-        .get::<EvidenceAuditContext>()
-        .and_then(|audit| audit.denial_code)
-        .map(|code| code.as_str().to_string());
-    assert_eq!(
-        relay.calls.load(Ordering::SeqCst),
-        2,
-        "registry Relay must execute before issuance response: {}, denial={denial:?}",
-        response.status(),
-    );
-    assert_eq!(response.status(), StatusCode::OK);
-    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("body reads");
-    let body: Value = serde_json::from_slice(&body).expect("credential body parses");
-    assert_eq!(body["format"], SD_JWT_VC_FORMAT);
-    assert!(
-        body["credential"]
-            .as_str()
-            .is_some_and(|credential| credential.contains('~')),
-        "expected compact SD-JWT credential: {body}"
-    );
-    let stored = store
-        .get(
-            &test_transaction.transaction.evaluation_id,
-            &test_transaction.transaction.evaluation_client_id,
-        )
-        .await
-        .expect("stored evaluation read succeeds")
-        .expect("projected registry evaluation is stored");
-    let issuance = stored
-        .issuance_provenance
-        .expect("projected evaluation stores private issuance provenance");
-    assert_eq!(issuance.claims.len(), 3);
-    assert_eq!(issuance.consultations.len(), 2);
-    let claim_ids = issuance
-        .claims
-        .iter()
-        .map(|entry| entry.claim_id.as_str())
-        .collect::<BTreeSet<_>>();
-    assert_eq!(
-        claim_ids,
-        BTreeSet::from([
-            "civil-record-active",
-            "person-is-alive",
-            "person-is-registered",
-        ])
-    );
-    assert!(issuance.claims.iter().all(|entry| {
-        let expected_pin = if entry.claim_id == "civil-record-active" {
-            (
-                "example.civil-record.exact",
-                "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-            )
-        } else {
-            (
-                "example.person-status.exact",
-                "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-            )
-        };
-        entry.claim_version == "1"
-            && entry.relay_profile_id == expected_pin.0
-            && entry.relay_contract_hash == expected_pin.1
-            && entry.canonical_purpose == "citizen_subject_access"
-            && ulid::Ulid::from_string(&entry.consultation_id).is_ok()
-            && entry.execution_binding.starts_with("sha256:")
-    }));
-    assert!(issuance.consultations.iter().all(|execution| {
-        ulid::Ulid::from_string(&execution.consultation_id).is_ok()
-            && OffsetDateTime::parse(&execution.acquired_at, &Rfc3339).is_ok()
-    }));
-    assert!(stored
-        .results
-        .iter()
-        .all(|result| { result.provenance.used.relay_consultation_count == 2 }));
-
-    assert_eq!(sign_count.load(Ordering::SeqCst), 1);
-    assert!(matches!(
-        state
-            .replay
-            .nonce_store()
-            .consume_nonce(&test_transaction.nonce_scope, &test_transaction.nonce_key,)
-            .await
-            .expect("nonce store is available"),
-        ReplayInsertOutcome::AlreadySeen
-    ));
-
-    let retry = oid4vci_credential(
-        Some(Extension(Arc::clone(&state))),
-        Some(Extension(test_transaction.principal)),
-        Some(Extension(validated_proof)),
-        Json(request),
-    )
-    .await;
-    assert_eq!(retry.status(), StatusCode::OK);
-    let retry_body = axum::body::to_bytes(retry.into_body(), usize::MAX)
-        .await
-        .expect("body reads");
-    let retry_body: Value = serde_json::from_slice(&retry_body).expect("credential body parses");
-    assert_eq!(retry_body, body);
-    assert_eq!(relay.calls.load(Ordering::SeqCst), 2);
-    assert_eq!(sign_count.load(Ordering::SeqCst), 1);
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_rejects_tampered_dependency_catalog_before_signing() {
-    let store = Arc::new(EvidenceStore::default());
-    let subject_access = Arc::new(subject_access_config());
-    let mut evidence = registry_backed_oid4vci_evidence_with_dependency();
-    let duplicate_dependency = evidence
-        .claims
-        .iter()
-        .find(|claim| claim.id == "civil-record-active")
-        .cloned()
-        .expect("dependency exists");
-    evidence.claims.push(duplicate_dependency);
-    let evidence = Arc::new(evidence);
-    let mut oid4vci = oid4vci_config();
-    oid4vci.accepted_token_audiences = vec!["registry-notary-citizen".to_string()];
-    let oid4vci = Arc::new(oid4vci);
-    let sign_count = Arc::new(AtomicUsize::new(0));
-    let preauth =
-        oid4vci_test_preauth_runtime(registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP);
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_subject_access_and_oid4vci(
-            Arc::clone(&evidence),
-            Arc::clone(&subject_access),
-            Arc::clone(&oid4vci),
-            AuditKeyHasher::unkeyed_dev_only(),
-            store,
-            Arc::new(CountingIssuerResolver {
-                sign_count: Arc::clone(&sign_count),
-            }),
-        )
-        .with_preauth_runtime(Some(Arc::clone(&preauth))),
-    );
-    let relay = Arc::new(RegistryCredentialRelay::default());
-    state
-        .install_activated_relay(relay.clone())
-        .expect("registry credential Relay activates once");
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let err = prepare_registry_backed_issuance_transaction(
-        &state,
-        &preauth,
-        &BoundSubject {
-            subject: "citizen-subject".to_string(),
-            subject_binding_claim: SUBJECT_BINDING_CLAIM.to_string(),
-            subject_binding_value: "NAT-123".to_string(),
-            client_id: "citizen-portal".to_string(),
-            scopes: vec!["subject_access".to_string()],
-            acr: Some("urn:example:loa:substantial".to_string()),
-            auth_time: Some(now),
-        },
-        "person_is_alive_sd_jwt",
-        &ulid::Ulid::new().to_string(),
-        None,
-    )
-    .await
-    .expect_err("duplicate dependency catalog is rejected before an offer");
-
-    assert!(matches!(err, EvidenceError::EvaluationBindingMismatch));
-    assert_eq!(relay.calls.load(Ordering::SeqCst), 0);
-    assert_eq!(sign_count.load(Ordering::SeqCst), 0);
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_dependency_execution_tampering_is_denied_before_signing() {
-    for tamper_acquired_at in [true, false] {
-        let store = Arc::new(EvidenceStore::default());
-        let subject_access = Arc::new(subject_access_config());
-        let evidence = Arc::new(registry_backed_oid4vci_evidence_with_dependency());
-        let mut oid4vci = oid4vci_config();
-        oid4vci.accepted_token_audiences = vec!["registry-notary-citizen".to_string()];
-        let oid4vci = Arc::new(oid4vci);
-        let sign_count = Arc::new(AtomicUsize::new(0));
-        let preauth =
-            oid4vci_test_preauth_runtime(registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP);
-        let state = Arc::new(
-            RegistryNotaryApiState::new_with_subject_access_and_oid4vci(
-                Arc::clone(&evidence),
-                Arc::clone(&subject_access),
-                Arc::clone(&oid4vci),
-                oid4vci_test_audit_hasher(),
-                Arc::clone(&store),
-                Arc::new(CountingIssuerResolver {
-                    sign_count: Arc::clone(&sign_count),
-                }),
-            )
-            .with_preauth_runtime(Some(Arc::clone(&preauth))),
-        );
-        let relay = Arc::new(RegistryCredentialRelay::default());
-        state
-            .install_activated_relay(relay.clone())
-            .expect("registry credential Relay activates once");
-        let nonce = if tamper_acquired_at {
-            "tampered-acquired-at-nonce"
-        } else {
-            "tampered-consultation-binding-nonce"
-        };
-        let test_transaction = reserve_registry_backed_oid4vci_test_transaction(
-            &state,
-            &preauth,
-            "person_is_alive_sd_jwt",
-            nonce,
-        )
-        .await;
-        store.tamper_next_read(move |evaluation| {
-            let issuance = evaluation
-                .issuance_provenance
-                .as_mut()
-                .expect("OID evaluation retained a credential-capable closure");
-            if tamper_acquired_at {
-                let dependency_execution_id = issuance
-                    .claims
-                    .iter()
-                    .find(|claim| claim.claim_id == "civil-record-active")
-                    .expect("dependency pin exists")
-                    .consultation_id
-                    .clone();
-                issuance
-                    .consultations
-                    .iter_mut()
-                    .find(|execution| execution.consultation_id == dependency_execution_id)
-                    .expect("dependency execution exists")
-                    .acquired_at = "2026-05-23T00:00:01Z".to_string();
-            } else {
-                let dependency_index = issuance
-                    .claims
-                    .iter()
-                    .position(|claim| claim.claim_id == "civil-record-active")
-                    .expect("dependency pin exists");
-                let root_index = issuance
-                    .claims
-                    .iter()
-                    .position(|claim| claim.claim_id == "person-is-alive")
-                    .expect("root pin exists");
-                let dependency_id = issuance.claims[dependency_index].consultation_id.clone();
-                issuance.claims[dependency_index].consultation_id =
-                    issuance.claims[root_index].consultation_id.clone();
-                issuance.claims[root_index].consultation_id = dependency_id;
-            }
-        });
-        let proof = sign_oid4vci_proof(&state.oid4vci.credential_issuer, nonce);
-        let response = oid4vci_credential(
-            Some(Extension(Arc::clone(&state))),
-            Some(Extension(test_transaction.principal)),
-            Some(Extension(validated_oid4vci_proof(
-                &state,
-                &proof,
-                Some(nonce),
-            ))),
-            Json(Oid4vciCredentialRequest {
-                format: SD_JWT_VC_FORMAT.to_string(),
-                credential_identifier: Some("person_is_alive_sd_jwt".to_string()),
-                credential_configuration_id: None,
-                vct: None,
-                proof: registry_platform_oid4vci::CredentialRequestProof {
-                    proof_type: PROOF_TYPE_JWT.to_string(),
-                    jwt: proof,
-                },
-                proofs: registry_platform_oid4vci::CredentialRequestProofs::default(),
-            }),
-        )
-        .await;
-
-        assert_eq!(response.status(), StatusCode::FORBIDDEN);
-        assert_eq!(relay.calls.load(Ordering::SeqCst), 2);
-        assert_eq!(sign_count.load(Ordering::SeqCst), 0);
-    }
-}
-
-#[tokio::test]
-async fn oid4vci_rejects_holder_key_equal_to_issuer_key_after_registry_evaluation() {
-    let store = Arc::new(EvidenceStore::default());
-    let subject_access = subject_access_config();
-    let evidence = registry_backed_oid4vci_evidence_config();
-    let mut oid4vci = oid4vci_config();
-    oid4vci.accepted_token_audiences = vec!["registry-notary-citizen".to_string()];
-    let evidence = Arc::new(evidence);
-    let subject_access = Arc::new(subject_access);
-    let oid4vci = Arc::new(oid4vci);
-    let preauth =
-        oid4vci_test_preauth_runtime(registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP);
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_subject_access_and_oid4vci(
-            Arc::clone(&evidence),
-            Arc::clone(&subject_access),
-            Arc::clone(&oid4vci),
-            oid4vci_test_audit_hasher(),
-            Arc::clone(&store),
-            Arc::new(HolderIssuerResolver),
-        )
-        .with_preauth_runtime(Some(Arc::clone(&preauth))),
-    );
-    let relay = Arc::new(RegistryCredentialRelay::default());
-    state
-        .install_activated_relay(relay.clone())
-        .expect("registry credential Relay activates once");
-    let nonce = "nonce-equal-key";
-    let test_transaction = reserve_registry_backed_oid4vci_test_transaction(
-        &state,
-        &preauth,
-        "person_is_alive_sd_jwt",
-        nonce,
-    )
-    .await;
-    let proof = sign_oid4vci_proof(&state.oid4vci.credential_issuer, nonce);
-
-    let response = oid4vci_credential(
-        Some(Extension(Arc::clone(&state))),
-        Some(Extension(test_transaction.principal)),
-        Some(Extension(validated_oid4vci_proof(
-            &state,
-            &proof,
-            Some(nonce),
-        ))),
-        Json(Oid4vciCredentialRequest {
-            format: SD_JWT_VC_FORMAT.to_string(),
-            credential_identifier: Some("person_is_alive_sd_jwt".to_string()),
-            credential_configuration_id: None,
-            vct: None,
-            proof: registry_platform_oid4vci::CredentialRequestProof {
-                proof_type: PROOF_TYPE_JWT.to_string(),
-                jwt: proof,
-            },
-            proofs: registry_platform_oid4vci::CredentialRequestProofs::default(),
-        }),
-    )
-    .await;
-
-    let denial = response
-        .extensions()
-        .get::<EvidenceAuditContext>()
-        .and_then(|audit| audit.denial_code)
-        .map(|code| code.as_str().to_string());
-    assert_eq!(
-        relay.calls.load(Ordering::SeqCst),
-        1,
-        "registry Relay must execute before holder and issuer keys are compared: {}, denial={denial:?}",
-        response.status(),
-    );
-    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-    assert!(matches!(
-        state
-            .replay
-            .nonce_store()
-            .consume_nonce(&test_transaction.nonce_scope, &test_transaction.nonce_key,)
-            .await
-            .expect("nonce store is available"),
-        ReplayInsertOutcome::AlreadySeen
-    ));
-}
-
-#[test]
-fn oid4vci_single_proof_jwt_accepts_proofs_array() {
-    let mut request = Oid4vciCredentialRequest {
-        format: SD_JWT_VC_FORMAT.to_string(),
-        credential_identifier: Some("person_is_alive_sd_jwt".to_string()),
-        credential_configuration_id: None,
-        vct: None,
-        proof: registry_platform_oid4vci::CredentialRequestProof {
-            proof_type: String::new(),
-            jwt: String::new(),
-        },
-        proofs: registry_platform_oid4vci::CredentialRequestProofs {
-            jwt: vec!["array-proof.jwt.sig".to_string()],
-        },
-    };
-
-    assert_eq!(
-        oid4vci_single_proof_jwt(&request).expect("single array proof is accepted"),
-        "array-proof.jwt.sig"
-    );
-
-    request.proofs.jwt.push("second-proof.jwt.sig".to_string());
-    assert_eq!(
-        oid4vci_single_proof_jwt(&request),
-        Err(Oid4vciWireError::InvalidProof)
-    );
-}
-
-#[test]
-fn oid4vci_credential_request_rejects_ambiguous_configuration_ids() {
-    let mut request = Oid4vciCredentialRequest {
-        format: SD_JWT_VC_FORMAT.to_string(),
-        credential_identifier: Some("person_is_alive_sd_jwt".to_string()),
-        credential_configuration_id: Some("other_sd_jwt".to_string()),
-        vct: None,
-        proof: registry_platform_oid4vci::CredentialRequestProof {
-            proof_type: PROOF_TYPE_JWT.to_string(),
-            jwt: "a.b.c".to_string(),
-        },
-        proofs: registry_platform_oid4vci::CredentialRequestProofs::default(),
-    };
-
-    assert_eq!(
-        oid4vci_configuration_for_request(&oid4vci_config(), &request),
-        Err(Oid4vciWireError::InvalidRequest)
-    );
-
-    request.credential_configuration_id = Some("person_is_alive_sd_jwt".to_string());
-    request.vct = Some("https://issuer.example/credentials/other".to_string());
-    assert_eq!(
-        oid4vci_configuration_for_request(&oid4vci_config(), &request),
-        Err(Oid4vciWireError::InvalidRequest)
-    );
-}
-
-#[test]
-fn oid4vci_issuance_authorization_details_bind_selected_configuration() {
-    let evidence = oid4vci_evidence_config();
-    let config = subject_access_config();
-    let oid4vci = oid4vci_config();
-    let configuration = oid4vci
-        .credential_configurations
-        .get("person_is_alive_sd_jwt")
-        .expect("configuration exists");
-
-    let details = oid4vci_issuance_authorization_details(&evidence, &config, configuration)
-        .expect("details build");
-
-    assert_eq!(details.actions, vec!["evaluate"]);
-    assert_eq!(details.locations, vec![evidence.service_id.clone()]);
-    assert_eq!(details.claims, vec![ClaimRef::from("person-is-alive")]);
-    assert_eq!(details.disclosure.as_deref(), Some("predicate"));
-    assert_eq!(details.format.as_deref(), Some(FORMAT_CLAIM_RESULT_JSON));
-    assert_eq!(details.purpose.as_deref(), Some("citizen_subject_access"));
-    assert_eq!(details.access_mode, Some(AccessMode::SubjectBound));
-    let subject = details.subject.as_ref().expect("subject binding is set");
-    assert_eq!(subject.binding_claim, SUBJECT_BINDING_CLAIM);
-    assert_eq!(subject.id_type, "national_id");
-
-    let principal = oid4vci_authorized_principal(
-        &evidence,
-        &config,
-        &oid4vci,
-        "person_is_alive_sd_jwt",
-        &["subject_access", "person_is_alive"],
-    );
-    require_oid4vci_issuance_authorization_details(
-        &evidence,
-        &config,
-        configuration,
-        &principal,
-        true,
-    )
-    .expect("matching details authorize issuance");
-
-    let direct_esignet_principal = fresh_oidc_principal(
-        Some("client_id:citizen-portal"),
-        &["subject_access", "person_is_alive"],
-    );
-    require_oid4vci_issuance_authorization_details(
-        &evidence,
-        &config,
-        configuration,
-        &direct_esignet_principal,
-        false,
-    )
-    .expect("direct eSignet tokens can rely on scope without RAR details");
-}
-
-#[test]
-fn oid4vci_issuance_authorization_details_fail_closed_for_empty_notary_details() {
-    let evidence = oid4vci_evidence_config();
-    let config = subject_access_config();
-    let oid4vci = oid4vci_config();
-    let configuration = oid4vci
-        .credential_configurations
-        .get("person_is_alive_sd_jwt")
-        .expect("configuration exists");
-    let mut principal = fresh_oidc_principal(
-        Some("client_id:citizen-portal"),
-        &["subject_access", "person_is_alive"],
-    );
-    principal.authorization_details = Some(EvidenceAuthorizationDetails {
-        detail_type: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE.to_string(),
-        schema_version: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION
-            .to_string(),
-        legal_basis_ref: Some("wallet-compat-context".to_string()),
-        ..EvidenceAuthorizationDetails::default()
-    });
-
-    require_oid4vci_issuance_authorization_details(
-        &evidence,
-        &config,
-        configuration,
-        &principal,
-        false,
-    )
-    .expect("direct eSignet/OIDC tokens can carry context-only details");
-
-    let err = require_oid4vci_issuance_authorization_details(
-        &evidence,
-        &config,
-        configuration,
-        &principal,
-        true,
-    )
-    .expect_err("Notary-issued tokens must carry transaction-scoped details");
-
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::OperationDenied
-        }
-    ));
-}
-
-#[test]
-fn oid4vci_requires_authorization_details_for_custom_notary_access_typ() {
-    let runtime_config = runtime_config_with_custom_access_token_typ();
-    let mut principal = fresh_oidc_principal(
-        Some("client_id:citizen-portal"),
-        &["subject_access", "person_is_alive"],
-    );
-    {
-        let claims = principal
-            .verified_claims
-            .as_mut()
-            .expect("test principal has claims");
-        claims.issuer = bounded("https://notary.example.test");
-        claims.token_type = Some(bounded("custom-notary-access+jwt"));
-    }
-
-    assert!(oid4vci_requires_authorization_details(
-        &principal,
-        Some(&runtime_config),
-        None
-    ));
-
-    principal
-        .verified_claims
-        .as_mut()
-        .expect("test principal has claims")
-        .issuer = bounded("https://id.example.gov");
-
-    assert!(!oid4vci_requires_authorization_details(
-        &principal,
-        Some(&runtime_config),
-        None
-    ));
-
-    {
-        let claims = principal
-            .verified_claims
-            .as_mut()
-            .expect("test principal has claims");
-        claims.issuer = bounded("https://notary.example.test");
-        claims.token_type = Some(bounded(
-            registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
-        ));
-    }
-
-    assert!(oid4vci_requires_authorization_details(
-        &principal,
-        Some(&runtime_config),
-        None
-    ));
-
-    principal
-        .verified_claims
-        .as_mut()
-        .expect("test principal has claims")
-        .issuer = bounded("https://id.example.gov");
-
-    assert!(!oid4vci_requires_authorization_details(
-        &principal,
-        Some(&runtime_config),
-        None
-    ));
-}
-
-#[test]
-fn oid4vci_rejects_holder_key_equal_to_issuer_key() {
-    let issuer = registry_notary_core::sd_jwt::EvidenceIssuer::from_jwk_str(
-        &issuer_private_jwk(),
-        "did:web:issuer.example#key-1".to_string(),
-    )
-    .expect("issuer parses");
-    let issuer_public =
-        PublicJwk::parse(&issuer.public_jwk().to_string()).expect("issuer public parses");
-    let holder_public = PrivateJwk::parse(&holder_private_jwk())
-        .expect("holder parses")
-        .public();
-
-    assert!(holder_key_matches_issuer_key(
-        &issuer_public,
-        &issuer.public_jwk()
-    ));
-    assert!(!holder_key_matches_issuer_key(
-        &holder_public,
-        &issuer.public_jwk()
-    ));
-}
-
-#[test]
-fn holder_proof_audience_must_match_configured_service_id() {
-    // Aim: the holder proof JWT's `aud` is bound to the configured
-    // service_id, not the hard-coded literal "registry-notary".
-    let holder_id = holder_did_jwk();
-    let service_id = "my.notary.example";
-    let request = issue_request();
-    let evaluation = evaluation_for_proof();
-
-    let proof_matching = sign_holder_proof(&holder_id, proof_payload(&holder_id, service_id));
-    validate_holder_proof_payload(
-        &proof_matching,
-        &holder_id,
-        "profile-a",
-        &request,
-        &evaluation,
-        service_id,
-    )
-    .expect("proof signed with aud=service_id must be accepted");
-
-    let proof_legacy_literal =
-        sign_holder_proof(&holder_id, proof_payload(&holder_id, "registry-notary"));
-    let err = validate_holder_proof_payload(
-        &proof_legacy_literal,
-        &holder_id,
-        "profile-a",
-        &request,
-        &evaluation,
-        service_id,
-    )
-    .expect_err("proof with aud=\"registry-notary\" must be rejected when service_id differs");
-    assert!(matches!(err, EvidenceError::HolderProofRequired));
-}
-
-#[test]
-fn holder_proof_exp_window_is_bounded_below_and_above() {
-    // The accepted lifetime is a strictly positive interval up to 300s.
-    // Anything outside that window must be rejected before reaching the
-    // replay-key path.
-    let holder_id = holder_did_jwk();
-    let service_id = "my.notary.example";
-    let request = issue_request();
-    let evaluation = evaluation_for_proof();
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-
-    let proof_zero_window = sign_holder_proof(
-        &holder_id,
-        windowed_proof_payload(&holder_id, service_id, now, now),
-    );
-    let err = validate_holder_proof_payload(
-        &proof_zero_window,
-        &holder_id,
-        "profile-a",
-        &request,
-        &evaluation,
-        service_id,
-    )
-    .expect_err("exp == iat must be rejected");
-    assert!(matches!(err, EvidenceError::HolderProofRequired));
-
-    let proof_backdated = sign_holder_proof(
-        &holder_id,
-        windowed_proof_payload(&holder_id, service_id, now, now - 60),
-    );
-    let err = validate_holder_proof_payload(
-        &proof_backdated,
-        &holder_id,
-        "profile-a",
-        &request,
-        &evaluation,
-        service_id,
-    )
-    .expect_err("exp < iat must be rejected");
-    assert!(matches!(err, EvidenceError::HolderProofRequired));
-
-    let proof_over_ceiling = sign_holder_proof(
-        &holder_id,
-        windowed_proof_payload(&holder_id, service_id, now, now + 301),
-    );
-    let err = validate_holder_proof_payload(
-        &proof_over_ceiling,
-        &holder_id,
-        "profile-a",
-        &request,
-        &evaluation,
-        service_id,
-    )
-    .expect_err("exp > iat + 300 must be rejected");
-    assert!(matches!(err, EvidenceError::HolderProofRequired));
-
-    let valid_now = OffsetDateTime::now_utc().unix_timestamp() + 20;
-    let proof_just_positive = sign_holder_proof(
-        &holder_id,
-        windowed_proof_payload(&holder_id, service_id, valid_now, valid_now + 1),
-    );
-    validate_holder_proof_payload(
-        &proof_just_positive,
-        &holder_id,
-        "profile-a",
-        &request,
-        &evaluation,
-        service_id,
-    )
-    .expect("exp = iat + 1 must be accepted");
-}
-
-const REGISTRY_OFFER_CONFIGURATION_ID: &str = "person_is_alive_sd_jwt";
-#[cfg(feature = "registry-notary-cel")]
-const REGISTRY_OFFER_EVALUATE_SCOPE: &str = "registry:evidence";
-#[cfg(feature = "registry-notary-cel")]
-const REGISTRY_OFFER_PRINCIPAL_ID: &str = "registrar-a";
-#[cfg(feature = "registry-notary-cel")]
-const REGISTRY_OFFER_PURPOSE: &str = "citizen_subject_access";
-
-#[cfg(feature = "registry-notary-cel")]
-struct RegistryOfferTestFixture {
-    state: Arc<RegistryNotaryApiState>,
-    preauth: Arc<PreAuthRuntime>,
-    principal: EvidencePrincipal,
-    store: Arc<EvidenceStore>,
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn registry_offer_test_evidence() -> EvidenceConfig {
-    let mut evidence = registry_backed_oid4vci_evidence_config();
-    evidence.allowed_purposes = vec![REGISTRY_OFFER_PURPOSE.to_string()];
-    let claim = evidence.claims.first_mut().expect("claim exists");
-    claim.required_scopes = vec![REGISTRY_OFFER_EVALUATE_SCOPE.to_string()];
-    claim.disclosure.default = DisclosureProfile::Value.as_str().to_string();
-    claim.disclosure.allowed = vec![DisclosureProfile::Value.as_str().to_string()];
-    evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("credential profile exists")
-        .disclosure
-        .allowed = vec![DisclosureProfile::Value.as_str().to_string()];
-    let mut registered = evidence.claims[0].clone();
-    registered.id = "person-is-registered".to_string();
-    registered.title = "Person is registered".to_string();
-    evidence.claims.push(registered);
-    evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("credential profile exists")
-        .allowed_claims
-        .push("person-is-registered".to_string());
-    evidence
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn registry_offer_test_oid4vci() -> Oid4vciConfig {
-    let mut oid4vci = oid4vci_config();
-    oid4vci.pre_authorized_code.enabled = true;
-    oid4vci.accepted_token_audiences = vec!["registry-notary-citizen".to_string()];
-    let configuration = oid4vci
-        .credential_configurations
-        .get_mut(REGISTRY_OFFER_CONFIGURATION_ID)
-        .expect("registry offer credential configuration exists");
-    configuration.claim_id = None;
-    configuration.claims = vec![
-        registry_notary_core::Oid4vciCredentialClaimConfig {
-            id: "person-is-alive".to_string(),
-            output_path: vec!["person_alive".to_string()],
-            display_name: "Person is alive".to_string(),
-            sd: "always".to_string(),
-        },
-        registry_notary_core::Oid4vciCredentialClaimConfig {
-            id: "person-is-registered".to_string(),
-            output_path: vec!["person_registered".to_string()],
-            display_name: "Person is registered".to_string(),
-            sd: "always".to_string(),
-        },
-    ];
-    oid4vci
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn registry_offer_machine_principal(
-    state: &RegistryNotaryApiState,
-    principal_id: &str,
-) -> EvidencePrincipal {
-    let configuration = &state.oid4vci.credential_configurations[REGISTRY_OFFER_CONFIGURATION_ID];
-    EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
-        principal_id: principal_id.to_string(),
-        scopes: vec![
-            REGISTRY_OFFER_EVALUATE_SCOPE.to_string(),
-            REGISTRY_OFFER_CREATE_SCOPE.to_string(),
-            configuration.scope.clone(),
-        ],
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: None,
-    }
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn registry_offer_authorization_details(
-    state: &RegistryNotaryApiState,
-    target_id: &str,
-) -> EvidenceAuthorizationDetails {
-    EvidenceAuthorizationDetails {
-        detail_type: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE.to_string(),
-        schema_version: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION
-            .to_string(),
-        actions: vec!["create_credential_offer".to_string()],
-        locations: vec![state.evidence.service_id.clone()],
-        // Deliberately reverse configuration order. Authorization is an exact
-        // set; configuration order is authoritative only for projection.
-        claims: vec![
-            ClaimRef::from("person-is-registered"),
-            ClaimRef::from("person-is-alive"),
-        ],
-        disclosure: Some(DisclosureProfile::Value.as_str().to_string()),
-        format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-        purpose: Some(REGISTRY_OFFER_PURPOSE.to_string()),
-        target: Some(registry_notary_core::EvidenceAuthorizationTarget {
-            id_type: "national_id".to_string(),
-            id: target_id.to_string(),
-        }),
-        access_mode: Some(AccessMode::MachineClient),
-        ..Default::default()
-    }
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn registry_offer_headers(idempotency_key: &str) -> HeaderMap {
-    let mut headers = HeaderMap::new();
-    headers.insert(
-        IDEMPOTENCY_KEY_HEADER,
-        HeaderValue::from_str(idempotency_key).expect("test idempotency key is a valid header"),
-    );
-    headers
-}
-
-#[cfg(feature = "registry-notary-cel")]
-async fn registry_offer_fixture() -> RegistryOfferTestFixture {
-    registry_offer_fixture_with(
-        registry_offer_test_evidence(),
-        oid4vci_test_preauth_runtime(registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP),
-    )
-    .await
-}
-
-#[cfg(feature = "registry-notary-cel")]
-async fn registry_offer_fixture_with(
-    evidence: EvidenceConfig,
-    preauth: Arc<PreAuthRuntime>,
-) -> RegistryOfferTestFixture {
-    registry_offer_fixture_with_configuration(evidence, preauth, registry_offer_test_oid4vci())
-        .await
-}
-
-#[cfg(feature = "registry-notary-cel")]
-async fn registry_offer_fixture_with_configuration(
-    evidence: EvidenceConfig,
-    preauth: Arc<PreAuthRuntime>,
-    oid4vci: Oid4vciConfig,
-) -> RegistryOfferTestFixture {
-    let evidence = Arc::new(evidence);
-    let oid4vci = Arc::new(oid4vci);
-    let store = Arc::new(EvidenceStore::default());
-    let mut subject_access = subject_access_config();
-    subject_access
-        .rate_limits
-        .tx_code_attempts_per_code_per_minute = 5;
-    let state = Arc::new(
-        RegistryNotaryApiState::new_with_subject_access_and_oid4vci(
-            Arc::clone(&evidence),
-            Arc::new(subject_access),
-            oid4vci,
-            oid4vci_test_audit_hasher(),
-            Arc::clone(&store),
-            Arc::new(TestIssuerResolver),
-        )
-        .with_preauth_runtime(Some(Arc::clone(&preauth))),
-    );
-    state
-        .install_activated_relay(Arc::new(RegistryCredentialRelay::default()))
-        .expect("registry offer test Relay activates once");
-    let principal = registry_offer_machine_principal(&state, REGISTRY_OFFER_PRINCIPAL_ID);
-    RegistryOfferTestFixture {
-        state,
-        preauth,
-        principal,
-        store,
-    }
-}
-
-#[cfg(feature = "registry-notary-cel")]
-async fn registry_offer_evaluate(fixture: &RegistryOfferTestFixture, target_id: &str) -> String {
-    let mut request = evaluate_request(target_id);
-    request.claims = vec![
-        ClaimRef::from("person-is-registered"),
-        ClaimRef::from("person-is-alive"),
-    ];
-    let target = request.target.as_mut().expect("evaluation target exists");
-    target.id = Some(format!("registry-record:{target_id}"));
-    target
-        .identifiers
-        .push(registry_notary_core::EvidenceIdentifier {
-            scheme: "registry_file_number".to_string(),
-            value: format!("FILE-{target_id}"),
-            issuer: Some("civil-registry".to_string()),
-            country: Some("ZZ".to_string()),
-        });
-    target
-        .attributes
-        .insert("registry_region".to_string(), json!("central"));
-    request.disclosure = Some(DisclosureProfile::Value.as_str().to_string());
-    request.purpose = Some(REGISTRY_OFFER_PURPOSE.to_string());
-    let response = evaluate(
-        HeaderMap::new(),
-        Some(Extension(Arc::clone(&fixture.state))),
-        Some(Extension(fixture.principal.clone())),
-        None,
-        Ok(Json(request)),
-    )
-    .await;
-    assert_eq!(
-        response.status(),
-        StatusCode::OK,
-        "registry-client evaluation succeeds"
-    );
-    let body = to_bytes(response.into_body(), 64 * 1024)
-        .await
-        .expect("evaluation body reads");
-    let body: Value = serde_json::from_slice(&body).expect("evaluation body parses");
-    body["results"][0]["evaluation_id"]
-        .as_str()
-        .expect("evaluation id is returned")
-        .to_string()
-}
-
-#[cfg(feature = "registry-notary-cel")]
-async fn registry_offer_create(
-    fixture: &RegistryOfferTestFixture,
-    principal: EvidencePrincipal,
-    evaluation_id: &str,
-    idempotency_key: &str,
-) -> Response {
-    oid4vci_create_registry_offer(
-        registry_offer_headers(idempotency_key),
-        Some(Extension(Arc::clone(&fixture.state))),
-        Some(Extension(principal)),
-        Ok(Json(Oid4vciRegistryOfferRequest {
-            evaluation_id: evaluation_id.to_string(),
-            credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
-        })),
-    )
-    .await
-}
-
-#[cfg(feature = "registry-notary-cel")]
-async fn registry_offer_response_json(response: Response) -> Value {
-    let body = to_bytes(response.into_body(), 64 * 1024)
-        .await
-        .expect("offer body reads");
-    serde_json::from_slice(&body).expect("offer body parses")
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn percent_decode_query_value(encoded: &str) -> String {
-    fn hex(byte: u8) -> Option<u8> {
-        match byte {
-            b'0'..=b'9' => Some(byte - b'0'),
-            b'a'..=b'f' => Some(byte - b'a' + 10),
-            b'A'..=b'F' => Some(byte - b'A' + 10),
-            _ => None,
-        }
-    }
-
-    let bytes = encoded.as_bytes();
-    let mut decoded = Vec::with_capacity(bytes.len());
-    let mut index = 0;
-    while index < bytes.len() {
-        if bytes[index] == b'%' && index + 2 < bytes.len() {
-            if let (Some(high), Some(low)) = (hex(bytes[index + 1]), hex(bytes[index + 2])) {
-                decoded.push((high << 4) | low);
-                index += 3;
-            } else {
-                decoded.push(bytes[index]);
-                index += 1;
-            }
-        } else {
-            decoded.push(bytes[index]);
-            index += 1;
-        }
-    }
-    String::from_utf8(decoded).expect("offer query is UTF-8")
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn credential_offer_from_uri(uri: &str) -> Value {
-    let encoded = uri
-        .strip_prefix("openid-credential-offer://?credential_offer=")
-        .expect("credential offer URI uses the registered scheme");
-    serde_json::from_str(&percent_decode_query_value(encoded)).expect("credential offer parses")
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn form_encoded_token_request(pre_authorized_code: &str, tx_code: &str) -> Bytes {
-    Bytes::from(format!(
-        "grant_type={}&pre-authorized_code={}&tx_code={}",
-        url_percent_encode(PRE_AUTHORIZED_CODE_GRANT_TYPE),
-        url_percent_encode(pre_authorized_code),
-        url_percent_encode(tx_code),
-    ))
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn principal_from_registry_offer_access_token(
-    fixture: &RegistryOfferTestFixture,
-    access_token: &str,
-) -> EvidencePrincipal {
-    let verified = verify_notary_token(
-        access_token,
-        fixture.preauth.access_token_verification_keys()[0].public_jwk(),
-        fixture.preauth.access_token_typ(),
-        fixture.preauth.notary_issuer(),
-        fixture.preauth.notary_audiences(),
-        OffsetDateTime::now_utc().unix_timestamp(),
-    )
-    .expect("access token verifies");
-    let payload = &verified.payload;
-    let audiences = match &payload["aud"] {
-        Value::String(audience) => vec![bounded(audience)],
-        Value::Array(audiences) => audiences
-            .iter()
-            .map(|audience| bounded(audience.as_str().expect("audience is a string")))
-            .collect(),
-        _ => panic!("access token has a string or array audience"),
-    };
-    let authorization_details = payload["authorization_details"]
-        .as_array()
-        .and_then(|details| details.first())
-        .cloned()
-        .map(serde_json::from_value)
-        .transpose()
-        .expect("authorization details parse");
-    EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::NotaryAccessToken,
-        principal_id: payload["sub"]
-            .as_str()
-            .expect("access token subject")
-            .to_string(),
-        scopes: verified.scopes(),
-        access_mode: AccessMode::MachineClient,
-        verified_claims: Some(BoundedVerifiedClaims {
-            issuer: bounded(payload["iss"].as_str().expect("access token issuer")),
-            audiences,
-            client_id: payload["client_id"]
-                .as_str()
-                .map(|client_id| bounded(&format!("client_id:{client_id}"))),
-            token_type: payload["token_type"].as_str().map(bounded),
-            credential_configuration_id: payload["credential_configuration_id"]
-                .as_str()
-                .map(bounded),
-            issuance_transaction_id: payload["issuance_transaction_id"].as_str().map(bounded),
-            issuance_transaction_commitment: payload["issuance_transaction_commitment"]
-                .as_str()
-                .map(bounded),
-            scopes: verified
-                .scopes()
-                .iter()
-                .map(|scope| bounded(scope))
-                .collect(),
-            subject: payload["sub"].as_str().map(bounded),
-            subject_binding_claim: Some(
-                VerifiedClaimName::new(&fixture.state.subject_access.subject_binding.token_claim)
-                    .expect("subject-binding claim is bounded"),
-            ),
-            subject_binding_value: payload
-                [&fixture.state.subject_access.subject_binding.token_claim]
-                .as_str()
-                .map(bounded),
-            acr: None,
-            auth_time: None,
-            exp: payload["exp"].as_i64(),
-            iat: payload["iat"].as_i64(),
-            nbf: payload["nbf"].as_i64(),
-        }),
-        authorization_details,
-    }
-}
-
-#[test]
-fn oid4vci_registry_offer_request_has_a_closed_minimal_wire_shape() {
-    let valid = json!({
-        "evaluation_id": "01KTEST",
-        "credential_configuration_id": REGISTRY_OFFER_CONFIGURATION_ID,
-    });
-    serde_json::from_value::<Oid4vciRegistryOfferRequest>(valid.clone())
-        .expect("the two-field request parses");
-
-    let mut missing_evaluation = valid.clone();
-    missing_evaluation
-        .as_object_mut()
-        .expect("request is an object")
-        .remove("evaluation_id");
-    assert!(serde_json::from_value::<Oid4vciRegistryOfferRequest>(missing_evaluation).is_err());
-
-    let mut extra_target = valid;
-    extra_target["target_id"] = json!("NAT-SECRET");
-    assert!(serde_json::from_value::<Oid4vciRegistryOfferRequest>(extra_target).is_err());
-}
-
-#[test]
-fn oid4vci_registry_offer_unavailable_response_is_explicitly_retryable() {
-    let response = registry_offer_problem(StatusCode::SERVICE_UNAVAILABLE, "offer_unavailable");
-    assert_eq!(
-        response.headers()[header::RETRY_AFTER],
-        HeaderValue::from_static(REGISTRY_OFFER_OPERATION_RETRY_AFTER_SECONDS)
-    );
-}
-
-#[test]
-fn oid4vci_token_audit_mode_follows_issuance_authority_without_exposing_values() {
-    assert_eq!(
-        issuance_authority_access_mode(&IssuanceAuthority::SubjectAccess, false),
-        AccessMode::SubjectBound
-    );
-    assert_eq!(
-        issuance_authority_access_mode(&IssuanceAuthority::SubjectAccess, true),
-        AccessMode::DelegatedSubjectAccess
-    );
-    let authority = IssuanceAuthority::RegistryClient {
-        initiating_client_id: "registrar-audit-secret".to_string(),
-        initiating_client_id_hash: "hmac-sha256:registrar".to_string(),
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
-        authorized_scopes: vec![REGISTRY_OFFER_CREATE_SCOPE.to_string()],
-        target_ref: TargetRefView {
-            entity_type: "Person".to_string(),
-            handle: "hmac-sha256:target-secret".to_string(),
-            identifier_schemes: vec!["national_id".to_string()],
-            profile: None,
-        },
-        service_id: "https://notary.example.test".to_string(),
-        purpose: "audit-purpose-secret".to_string(),
-    };
-    assert_eq!(
-        issuance_authority_access_mode(&authority, false),
-        AccessMode::MachineClient
-    );
-    assert_eq!(
-        issuance_authority_access_mode(&authority, true),
-        AccessMode::MachineClient
-    );
-    let debug = format!("{authority:?}");
-    assert!(!debug.contains("registrar-audit-secret"));
-    assert!(!debug.contains("target-secret"));
-    assert!(!debug.contains("audit-purpose-secret"));
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_registry_offer_completes_machine_evaluation_to_wallet_credential() {
-    let fixture = registry_offer_fixture().await;
-    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-REGISTRAR-001").await;
-    let mut short_evaluation = fixture
-        .store
-        .get(&evaluation_id, REGISTRY_OFFER_PRINCIPAL_ID)
-        .await
-        .expect("stored evaluation read succeeds")
-        .expect("stored evaluation exists");
-    short_evaluation.expires_at =
-        format_time(OffsetDateTime::now_utc() + time::Duration::seconds(90));
-    fixture
-        .store
-        .insert(short_evaluation)
-        .await
-        .expect("short evaluation lifetime fixture writes");
-    let mut principal = fixture.principal.clone();
-    principal.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-REGISTRAR-001",
-    ));
-
-    let offer_response = registry_offer_create(
-        &fixture,
-        principal,
-        &evaluation_id,
-        "registrar-offer-journey",
-    )
-    .await;
-    assert_eq!(offer_response.status(), StatusCode::OK);
-    assert_eq!(
-        offer_response.headers()[header::CACHE_CONTROL],
-        HeaderValue::from_static("no-store")
-    );
-    assert_eq!(
-        offer_response.headers()[header::PRAGMA],
-        HeaderValue::from_static("no-cache")
-    );
-    let offer_body = registry_offer_response_json(offer_response).await;
-    let offer_uri = offer_body["credential_offer_uri"]
-        .as_str()
-        .expect("offer URI is returned");
-    let tx_code = offer_body["tx_code"]
-        .as_str()
-        .expect("transaction code is delivered separately");
-    assert_eq!(tx_code.len(), 6);
-    assert!(tx_code.bytes().all(|byte| byte.is_ascii_digit()));
-    assert!(
-        !offer_uri.contains(tx_code),
-        "out-of-band transaction code must not enter the offer URI"
-    );
-    let offer = credential_offer_from_uri(offer_uri);
-    let grant = &offer["grants"][PRE_AUTHORIZED_CODE_GRANT_TYPE];
-    let pre_authorized_code = grant["pre-authorized_code"]
-        .as_str()
-        .expect("offer carries a pre-authorized code");
-    assert_eq!(grant["tx_code"]["length"], 6);
-    let verified_code = verify_notary_token(
-        pre_authorized_code,
-        fixture.preauth.access_token_verification_keys()[0].public_jwk(),
-        PRE_AUTHORIZED_CODE_JWT_TYP,
-        fixture.preauth.notary_issuer(),
-        &[],
-        OffsetDateTime::now_utc().unix_timestamp(),
-    )
-    .expect("pre-authorized code verifies");
-    assert!(
-        !verified_code.payload.to_string().contains(tx_code),
-        "the signed bearer grant must not disclose its second factor"
-    );
-
-    let mut token_headers = HeaderMap::new();
-    token_headers.insert(
-        header::CONTENT_TYPE,
-        HeaderValue::from_static("application/x-www-form-urlencoded"),
-    );
-    let wrong_tx_code = if tx_code == "000000" {
-        "111111"
-    } else {
-        "000000"
-    };
-    let wrong_pin_response = oid4vci_token(
-        Some(Extension(Arc::clone(&fixture.state))),
-        None,
-        token_headers.clone(),
-        form_encoded_token_request(pre_authorized_code, wrong_tx_code),
-    )
-    .await;
-    assert_eq!(wrong_pin_response.status(), StatusCode::BAD_REQUEST);
-    let wrong_pin_body = to_bytes(wrong_pin_response.into_body(), 64 * 1024)
-        .await
-        .expect("wrong-PIN response reads");
-    let wrong_pin_body: Value =
-        serde_json::from_slice(&wrong_pin_body).expect("wrong-PIN response parses");
-    assert_eq!(wrong_pin_body["error"], "invalid_grant");
-    assert!(!wrong_pin_body.to_string().contains(tx_code));
-    assert_eq!(
-        token_error_audit_event_with_access_mode(
-            "/oid4vci/token",
-            StatusCode::BAD_REQUEST.as_u16(),
-            Some(REGISTRY_OFFER_CONFIGURATION_ID),
-            SubjectAccessDenialCode::InvalidToken,
-            AccessMode::MachineClient,
-        )
-        .access_mode,
-        Some(AccessMode::MachineClient),
-        "the wrong-PIN audit path retains the loaded registry transaction mode",
-    );
-
-    let token_response = oid4vci_token(
-        Some(Extension(Arc::clone(&fixture.state))),
-        None,
-        token_headers.clone(),
-        form_encoded_token_request(pre_authorized_code, tx_code),
-    )
-    .await;
-    assert_eq!(token_response.status(), StatusCode::OK);
-    let token_body = to_bytes(token_response.into_body(), 64 * 1024)
-        .await
-        .expect("token response reads");
-    let token_body: Value = serde_json::from_slice(&token_body).expect("token response parses");
-    let expires_in = token_body["expires_in"]
-        .as_u64()
-        .expect("access token lifetime is returned");
-    assert!(
-        (1..=90).contains(&expires_in),
-        "access token lifetime is capped to the authoritative transaction remainder",
-    );
-    let access_token = token_body["access_token"]
-        .as_str()
-        .expect("access token is returned");
-    let nonce = token_body["c_nonce"]
-        .as_str()
-        .expect("credential nonce is returned");
-    let wallet_principal = principal_from_registry_offer_access_token(&fixture, access_token);
-    assert_eq!(wallet_principal.access_mode(), AccessMode::MachineClient);
-    assert_ne!(wallet_principal.principal_id, "NAT-REGISTRAR-001");
-    let verified_access = verify_notary_token(
-        access_token,
-        fixture.preauth.access_token_verification_keys()[0].public_jwk(),
-        fixture.preauth.access_token_typ(),
-        fixture.preauth.notary_issuer(),
-        fixture.preauth.notary_audiences(),
-        OffsetDateTime::now_utc().unix_timestamp(),
-    )
-    .expect("access token verifies");
-    assert_eq!(
-        u64::try_from(
-            verified_access.payload["exp"]
-                .as_i64()
-                .expect("access token exp exists")
-                - verified_access.payload["iat"]
-                    .as_i64()
-                    .expect("access token iat exists"),
-        )
-        .expect("access token lifetime is positive"),
-        expires_in,
-    );
-    let access_payload = verified_access.payload.to_string();
-    assert!(!access_payload.contains(REGISTRY_OFFER_PRINCIPAL_ID));
-    assert!(!access_payload.contains("NAT-REGISTRAR-001"));
-    assert_eq!(
-        verified_access.payload["act"]["type"],
-        json!("registry_client")
-    );
-    let code_replay = oid4vci_token(
-        Some(Extension(Arc::clone(&fixture.state))),
-        None,
-        token_headers,
-        form_encoded_token_request(pre_authorized_code, tx_code),
-    )
-    .await;
-    assert_eq!(code_replay.status(), StatusCode::BAD_REQUEST);
-    let code_replay_body = to_bytes(code_replay.into_body(), 64 * 1024)
-        .await
-        .expect("code replay response reads");
-    let code_replay_body: Value =
-        serde_json::from_slice(&code_replay_body).expect("code replay response parses");
-    assert_eq!(code_replay_body["error"], "invalid_grant");
-    assert!(!code_replay_body.to_string().contains(tx_code));
-
-    let proof = sign_oid4vci_proof(&fixture.state.oid4vci.credential_issuer, nonce);
-    let credential_response = oid4vci_credential(
-        Some(Extension(Arc::clone(&fixture.state))),
-        Some(Extension(wallet_principal)),
-        Some(Extension(validated_oid4vci_proof(
-            &fixture.state,
-            &proof,
-            Some(nonce),
-        ))),
-        Json(Oid4vciCredentialRequest {
-            format: SD_JWT_VC_FORMAT.to_string(),
-            credential_identifier: Some(REGISTRY_OFFER_CONFIGURATION_ID.to_string()),
-            credential_configuration_id: None,
-            vct: None,
-            proof: registry_platform_oid4vci::CredentialRequestProof {
-                proof_type: PROOF_TYPE_JWT.to_string(),
-                jwt: proof,
-            },
-            proofs: registry_platform_oid4vci::CredentialRequestProofs::default(),
-        }),
-    )
-    .await;
-    assert_eq!(credential_response.status(), StatusCode::OK);
-    let audit = credential_response
-        .extensions()
-        .get::<EvidenceAuditContext>()
-        .expect("credential audit context is attached");
-    assert_eq!(audit.access_mode, Some(AccessMode::MachineClient));
-    let audit_debug = format!("{audit:?}");
-    assert!(!audit_debug.contains("NAT-REGISTRAR-001"));
-    assert!(!audit_debug.contains(tx_code));
-    let credential_body = to_bytes(credential_response.into_body(), 256 * 1024)
-        .await
-        .expect("credential response reads");
-    let credential_body: Value =
-        serde_json::from_slice(&credential_body).expect("credential response parses");
-    assert_eq!(credential_body["format"], SD_JWT_VC_FORMAT);
-    assert!(credential_body["credential"]
-        .as_str()
-        .is_some_and(|credential| credential.contains('~')));
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_registry_offer_rejects_elapsed_credential_validity_before_signing() {
-    let sign_attempt_count = Arc::new(AtomicUsize::new(0));
-    let preauth = oid4vci_test_preauth_runtime_with_limited_signer(
-        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
-        Arc::clone(&sign_attempt_count),
-        0,
-    );
-    let fixture = registry_offer_fixture_with(registry_offer_test_evidence(), preauth).await;
-    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-EXPIRED-CREDENTIAL").await;
-    let mut evaluation = fixture
-        .store
-        .get(&evaluation_id, REGISTRY_OFFER_PRINCIPAL_ID)
-        .await
-        .expect("stored evaluation read succeeds")
-        .expect("stored evaluation exists");
-    let expired_issued_at = format_time(OffsetDateTime::now_utc() - time::Duration::days(1));
-    for result in &mut evaluation.results {
-        result.issued_at.clone_from(&expired_issued_at);
-    }
-    fixture
-        .store
-        .insert(evaluation)
-        .await
-        .expect("expired credential-validity fixture writes");
-    let mut principal = fixture.principal.clone();
-    principal.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-EXPIRED-CREDENTIAL",
-    ));
-
-    let response = registry_offer_create(
-        &fixture,
-        principal,
-        &evaluation_id,
-        "registrar-expired-credential",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::NOT_FOUND);
-    assert_eq!(
-        sign_attempt_count.load(Ordering::SeqCst),
-        0,
-        "elapsed credential validity rejects before quota or signer work"
-    );
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_registry_offer_caps_signer_deadline_to_remaining_validity() {
-    let sign_attempt_count = Arc::new(AtomicUsize::new(0));
-    let preauth = oid4vci_test_preauth_runtime_with_limited_signer(
-        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
-        Arc::clone(&sign_attempt_count),
-        1,
-    );
-    let mut evidence = registry_offer_test_evidence();
-    evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("registry offer credential profile exists")
-        .validity_seconds = 20;
-    let fixture = registry_offer_fixture_with(evidence, preauth).await;
-    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-SIGNER-DEADLINE").await;
-    let mut principal = fixture.principal.clone();
-    principal.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-SIGNER-DEADLINE",
-    ));
-
-    let response = registry_offer_create(
-        &fixture,
-        principal,
-        &evaluation_id,
-        "registrar-signer-deadline",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::OK);
-    assert_eq!(
-        sign_attempt_count.load(Ordering::SeqCst),
-        1,
-        "the signer runs with a deadline capped to the remaining validity",
-    );
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_registry_offer_caps_code_and_transaction_to_credential_validity() {
-    const VALIDITY_SECONDS: i64 = 60;
-    let mut evidence = registry_offer_test_evidence();
-    evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("registry offer credential profile exists")
-        .validity_seconds = VALIDITY_SECONDS;
-    let fixture = registry_offer_fixture_with(
-        evidence,
-        oid4vci_test_preauth_runtime(registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP),
-    )
-    .await;
-    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-SHORT-CREDENTIAL").await;
-    let evaluation = fixture
-        .store
-        .get(&evaluation_id, REGISTRY_OFFER_PRINCIPAL_ID)
-        .await
-        .expect("stored evaluation read succeeds")
-        .expect("stored evaluation exists");
-    let credential_expires_at = earliest_issued_at(&evaluation.results)
-        .expect("registry results have an issuance time")
-        + time::Duration::seconds(VALIDITY_SECONDS);
-    let mut principal = fixture.principal.clone();
-    principal.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-SHORT-CREDENTIAL",
-    ));
-
-    let response = registry_offer_create(
-        &fixture,
-        principal,
-        &evaluation_id,
-        "registrar-short-credential",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::OK);
-    let body = registry_offer_response_json(response).await;
-    let response_expires_at = OffsetDateTime::parse(
-        body["expires_at"]
-            .as_str()
-            .expect("offer response has an expiry"),
-        &Rfc3339,
-    )
-    .expect("offer response expiry parses");
-    assert_eq!(
-        response_expires_at.unix_timestamp(),
-        credential_expires_at.unix_timestamp()
-    );
-    let offer = credential_offer_from_uri(
-        body["credential_offer_uri"]
-            .as_str()
-            .expect("offer URI is returned"),
-    );
-    let pre_authorized_code = offer["grants"][PRE_AUTHORIZED_CODE_GRANT_TYPE]
-        ["pre-authorized_code"]
-        .as_str()
-        .expect("offer carries a pre-authorized code");
-    let verified_code = verify_notary_token(
-        pre_authorized_code,
-        fixture.preauth.access_token_verification_keys()[0].public_jwk(),
-        PRE_AUTHORIZED_CODE_JWT_TYP,
-        fixture.preauth.notary_issuer(),
-        &[],
-        OffsetDateTime::now_utc().unix_timestamp(),
-    )
-    .expect("pre-authorized code verifies");
-    assert_eq!(
-        verified_code.payload["exp"].as_i64(),
-        Some(credential_expires_at.unix_timestamp())
-    );
-    let transaction_id = verified_code.payload["jti"]
-        .as_str()
-        .expect("pre-authorized code has a transaction ID");
-    let live_transaction = fixture
-        .preauth
-        .preauthorization_state()
-        .transaction(transaction_id)
-        .await
-        .expect("transaction lookup succeeds")
-        .expect("transaction remains live");
-    assert_eq!(
-        live_transaction.expires_at.unix_timestamp(),
-        credential_expires_at.unix_timestamp()
-    );
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_registry_offer_is_atomic_for_retry_conflict_and_consumption() {
-    let fixture = registry_offer_fixture().await;
-    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-IDEMPOTENCY-001").await;
-    let mut principal = fixture.principal.clone();
-    principal.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-IDEMPOTENCY-001",
-    ));
-
-    let invoke = || {
-        registry_offer_create(
-            &fixture,
-            principal.clone(),
-            &evaluation_id,
-            "registrar-idempotency",
-        )
-    };
-    let (first, second) = tokio::join!(invoke(), invoke());
-    assert_eq!(first.status(), StatusCode::OK);
-    assert_eq!(second.status(), StatusCode::OK);
-    assert_eq!(
-        first.headers()[header::CACHE_CONTROL],
-        HeaderValue::from_static("no-store")
-    );
-    assert_eq!(
-        second.headers()[header::CACHE_CONTROL],
-        HeaderValue::from_static("no-store")
-    );
-    let first_body = registry_offer_response_json(first).await;
-    let second_body = registry_offer_response_json(second).await;
-    assert_eq!(
-        first_body, second_body,
-        "concurrent exact retries return the one persisted offer and PIN"
-    );
-
-    let exact_retry = registry_offer_create(
-        &fixture,
-        principal.clone(),
-        &evaluation_id,
-        "registrar-idempotency",
-    )
-    .await;
-    assert_eq!(exact_retry.status(), StatusCode::OK);
-    assert_eq!(
-        registry_offer_response_json(exact_retry).await,
-        first_body,
-        "later exact retry returns byte-for-byte equivalent response data"
-    );
-
-    let consumed = registry_offer_create(
-        &fixture,
-        principal.clone(),
-        &evaluation_id,
-        "registrar-new-operation",
-    )
-    .await;
-    assert_eq!(consumed.status(), StatusCode::CONFLICT);
-    assert_eq!(
-        consumed.headers()[header::CACHE_CONTROL],
-        HeaderValue::from_static("no-store")
-    );
-    let consumed_body = registry_offer_response_json(consumed).await;
-    assert_eq!(consumed_body["code"], "offer_conflict");
-    assert!(!consumed_body.to_string().contains("NAT-IDEMPOTENCY-001"));
-
-    let other_evaluation_id = registry_offer_evaluate(&fixture, "NAT-IDEMPOTENCY-002").await;
-    let mut other_principal = principal;
-    other_principal.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-IDEMPOTENCY-002",
-    ));
-    let key_reuse = registry_offer_create(
-        &fixture,
-        other_principal,
-        &other_evaluation_id,
-        "registrar-idempotency",
-    )
-    .await;
-    assert_eq!(key_reuse.status(), StatusCode::CONFLICT);
-    assert_eq!(
-        registry_offer_response_json(key_reuse).await["code"],
-        "offer_conflict"
-    );
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_registry_offer_exact_retry_canonicalizes_authorized_claim_order() {
-    let fixture = registry_offer_fixture().await;
-    let target_id = "NAT-IDEMPOTENCY-CLAIM-ORDER";
-    let evaluation_id = registry_offer_evaluate(&fixture, target_id).await;
-    let mut initial_principal = fixture.principal.clone();
-    initial_principal.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        target_id,
-    ));
-
-    let initial = registry_offer_create(
-        &fixture,
-        initial_principal,
-        &evaluation_id,
-        "registrar-claim-order",
-    )
-    .await;
-    assert_eq!(initial.status(), StatusCode::OK);
-    let initial_body = registry_offer_response_json(initial).await;
-
-    let mut reordered_principal = fixture.principal.clone();
-    let mut reordered_details = registry_offer_authorization_details(&fixture.state, target_id);
-    reordered_details.claims.reverse();
-    reordered_principal.authorization_details = Some(reordered_details);
-    let reordered = registry_offer_create(
-        &fixture,
-        reordered_principal,
-        &evaluation_id,
-        "registrar-claim-order",
-    )
-    .await;
-    assert_eq!(
-        reordered.status(),
-        StatusCode::OK,
-        "claim order does not change the authorized request identity",
-    );
-    assert_eq!(
-        registry_offer_response_json(reordered).await,
-        initial_body,
-        "equivalent claim sets replay the exact persisted offer",
-    );
-
-    let mut version_changed_principal = fixture.principal.clone();
-    let mut version_changed_details =
-        registry_offer_authorization_details(&fixture.state, target_id);
-    version_changed_details.claims[0].version = Some("different-version".to_string());
-    version_changed_principal.authorization_details = Some(version_changed_details);
-    let version_changed = registry_offer_create(
-        &fixture,
-        version_changed_principal,
-        &evaluation_id,
-        "registrar-claim-order",
-    )
-    .await;
-    assert_eq!(
-        version_changed.status(),
-        StatusCode::FORBIDDEN,
-        "claim versions remain authorization-sensitive",
-    );
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_registry_offer_concurrent_exact_retry_debits_last_quota_unit_once() {
-    let sign_attempt_count = Arc::new(AtomicUsize::new(0));
-    let gate = Arc::new(FirstSigningAttemptGate::new());
-    let preauth = oid4vci_test_preauth_runtime_with_first_signing_attempt_gate(
-        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
-        Arc::clone(&sign_attempt_count),
-        Arc::clone(&gate),
-    );
-    let mut evidence = registry_offer_test_evidence();
-    evidence.machine_quota = registry_notary_core::MachineQuotaConfig {
-        enabled: true,
-        // Evaluation consumes the first unit. Both concurrent exact offer
-        // attempts must share the one remaining operation debit.
-        subjects_per_minute: 2,
-    };
-    let fixture = registry_offer_fixture_with(evidence, preauth).await;
-    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-CONCURRENT-QUOTA").await;
-    let mut principal = fixture.principal.clone();
-    principal.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-CONCURRENT-QUOTA",
-    ));
-
-    let first_state = Arc::clone(&fixture.state);
-    let first_principal = principal.clone();
-    let first_evaluation_id = evaluation_id.clone();
-    let first = tokio::spawn(async move {
-        oid4vci_create_registry_offer(
-            registry_offer_headers("registrar-concurrent-quota"),
-            Some(Extension(first_state)),
-            Some(Extension(first_principal)),
-            Ok(Json(Oid4vciRegistryOfferRequest {
-                evaluation_id: first_evaluation_id,
-                credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
-            })),
-        )
-        .await
-    });
-    gate.wait_until_entered().await;
-
-    let second_state = Arc::clone(&fixture.state);
-    let second_evaluation_id = evaluation_id;
-    let second = tokio::spawn(async move {
-        oid4vci_create_registry_offer(
-            registry_offer_headers("registrar-concurrent-quota"),
-            Some(Extension(second_state)),
-            Some(Extension(principal)),
-            Ok(Json(Oid4vciRegistryOfferRequest {
-                evaluation_id: second_evaluation_id,
-                credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
-            })),
-        )
-        .await
-    });
-    tokio::time::sleep(std::time::Duration::from_millis(50)).await;
-    assert_eq!(
-        sign_attempt_count.load(Ordering::SeqCst),
-        1,
-        "the exact contender must wait without entering the signer"
-    );
-    assert!(
-        !second.is_finished(),
-        "the exact contender waits for the authoritative reservation"
-    );
-    gate.release();
-    let first = first.await.expect("first offer task joins");
-    let second = second.await.expect("second offer task joins");
-
-    assert_eq!(first.status(), StatusCode::OK);
-    assert_eq!(second.status(), StatusCode::OK);
-    assert_eq!(
-        registry_offer_response_json(first).await,
-        registry_offer_response_json(second).await,
-        "both exact attempts replay the one authoritative offer"
-    );
-    assert_eq!(
-        sign_attempt_count.load(Ordering::SeqCst),
-        1,
-        "one leased quota-operation owner performs signer work"
-    );
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_registry_offer_concurrent_exact_retry_is_serialized_when_quota_is_disabled() {
-    let sign_attempt_count = Arc::new(AtomicUsize::new(0));
-    let gate = Arc::new(FirstSigningAttemptGate::new());
-    let preauth = oid4vci_test_preauth_runtime_with_first_signing_attempt_gate(
-        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
-        Arc::clone(&sign_attempt_count),
-        Arc::clone(&gate),
-    );
-    let mut evidence = registry_offer_test_evidence();
-    evidence.machine_quota.enabled = false;
-    let fixture = registry_offer_fixture_with(evidence, preauth).await;
-    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-DISABLED-QUOTA-LEASE").await;
-    let mut principal = fixture.principal.clone();
-    principal.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-DISABLED-QUOTA-LEASE",
-    ));
-
-    let first_state = Arc::clone(&fixture.state);
-    let first_principal = principal.clone();
-    let first_evaluation_id = evaluation_id.clone();
-    let first = tokio::spawn(async move {
-        oid4vci_create_registry_offer(
-            registry_offer_headers("registrar-disabled-quota-lease"),
-            Some(Extension(first_state)),
-            Some(Extension(first_principal)),
-            Ok(Json(Oid4vciRegistryOfferRequest {
-                evaluation_id: first_evaluation_id,
-                credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
-            })),
-        )
-        .await
-    });
-    gate.wait_until_entered().await;
-
-    let second_state = Arc::clone(&fixture.state);
-    let second = tokio::spawn(async move {
-        oid4vci_create_registry_offer(
-            registry_offer_headers("registrar-disabled-quota-lease"),
-            Some(Extension(second_state)),
-            Some(Extension(principal)),
-            Ok(Json(Oid4vciRegistryOfferRequest {
-                evaluation_id,
-                credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
-            })),
-        )
-        .await
-    });
-    tokio::time::sleep(std::time::Duration::from_millis(50)).await;
-    assert_eq!(sign_attempt_count.load(Ordering::SeqCst), 1);
-    assert!(!second.is_finished());
-    gate.release();
-    let first = first.await.expect("first offer task joins");
-    let second = second.await.expect("second offer task joins");
-    assert_eq!(first.status(), StatusCode::OK);
-    assert_eq!(second.status(), StatusCode::OK);
-    assert_eq!(
-        registry_offer_response_json(first).await,
-        registry_offer_response_json(second).await,
-    );
-    assert_eq!(sign_attempt_count.load(Ordering::SeqCst), 1);
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_registry_offer_concurrent_request_conflict_never_reaches_second_signer() {
-    let sign_attempt_count = Arc::new(AtomicUsize::new(0));
-    let gate = Arc::new(FirstSigningAttemptGate::new());
-    let preauth = oid4vci_test_preauth_runtime_with_first_signing_attempt_gate(
-        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
-        Arc::clone(&sign_attempt_count),
-        Arc::clone(&gate),
-    );
-    let mut evidence = registry_offer_test_evidence();
-    evidence.machine_quota = registry_notary_core::MachineQuotaConfig {
-        enabled: true,
-        subjects_per_minute: 4,
-    };
-    let fixture = registry_offer_fixture_with(evidence, preauth).await;
-    let first_evaluation =
-        registry_offer_evaluate(&fixture, "NAT-CONCURRENT-REQUEST-CONFLICT").await;
-    let second_evaluation =
-        registry_offer_evaluate(&fixture, "NAT-CONCURRENT-REQUEST-CONFLICT").await;
-    let mut principal = fixture.principal.clone();
-    principal.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-CONCURRENT-REQUEST-CONFLICT",
-    ));
-
-    let first_state = Arc::clone(&fixture.state);
-    let first_principal = principal.clone();
-    let first = tokio::spawn(async move {
-        oid4vci_create_registry_offer(
-            registry_offer_headers("registrar-request-conflict"),
-            Some(Extension(first_state)),
-            Some(Extension(first_principal)),
-            Ok(Json(Oid4vciRegistryOfferRequest {
-                evaluation_id: first_evaluation,
-                credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
-            })),
-        )
-        .await
-    });
-    gate.wait_until_entered().await;
-
-    let conflict = oid4vci_create_registry_offer(
-        registry_offer_headers("registrar-request-conflict"),
-        Some(Extension(Arc::clone(&fixture.state))),
-        Some(Extension(principal)),
-        Ok(Json(Oid4vciRegistryOfferRequest {
-            evaluation_id: second_evaluation,
-            credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
-        })),
-    )
-    .await;
-    assert_eq!(conflict.status(), StatusCode::CONFLICT);
-    assert_eq!(
-        sign_attempt_count.load(Ordering::SeqCst),
-        1,
-        "the different request shape conflicts on the shared idempotency operation",
-    );
-    gate.release();
-    assert_eq!(
-        first.await.expect("first offer task joins").status(),
-        StatusCode::OK,
-    );
-    assert_eq!(sign_attempt_count.load(Ordering::SeqCst), 1);
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_registry_offer_signer_failure_releases_lease_without_refunding_quota() {
-    let sign_attempt_count = Arc::new(AtomicUsize::new(0));
-    let preauth = oid4vci_test_preauth_runtime_with_first_signing_attempt_failure(
-        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
-        Arc::clone(&sign_attempt_count),
-    );
-    let mut evidence = registry_offer_test_evidence();
-    evidence.machine_quota = registry_notary_core::MachineQuotaConfig {
-        enabled: true,
-        subjects_per_minute: 2,
-    };
-    let fixture = registry_offer_fixture_with(evidence, preauth).await;
-    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-QUOTA-TAKEOVER").await;
-    let mut principal = fixture.principal.clone();
-    principal.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-QUOTA-TAKEOVER",
-    ));
-
-    let failed = registry_offer_create(
-        &fixture,
-        principal.clone(),
-        &evaluation_id,
-        "registrar-quota-takeover",
-    )
-    .await;
-    assert!(failed.status().is_server_error());
-    assert_eq!(sign_attempt_count.load(Ordering::SeqCst), 1);
-
-    let takeover = registry_offer_create(
-        &fixture,
-        principal,
-        &evaluation_id,
-        "registrar-quota-takeover",
-    )
-    .await;
-    assert_eq!(takeover.status(), StatusCode::OK);
-    assert_eq!(
-        sign_attempt_count.load(Ordering::SeqCst),
-        2,
-        "released lease is taken over without a second quota debit"
-    );
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_registry_offer_preflight_skips_signer_for_sequential_denials_and_replay() {
-    let sign_attempt_count = Arc::new(AtomicUsize::new(0));
-    let preauth = oid4vci_test_preauth_runtime_with_limited_signer(
-        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
-        Arc::clone(&sign_attempt_count),
-        1,
-    );
-    let fixture = registry_offer_fixture_with(registry_offer_test_evidence(), preauth).await;
-    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-PREFLIGHT-001").await;
-    let mut principal = fixture.principal.clone();
-    principal.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-PREFLIGHT-001",
-    ));
-
-    let created = registry_offer_create(
-        &fixture,
-        principal.clone(),
-        &evaluation_id,
-        "registrar-preflight",
-    )
-    .await;
-    assert_eq!(created.status(), StatusCode::OK);
-    let created_body = registry_offer_response_json(created).await;
-    assert_eq!(sign_attempt_count.load(Ordering::SeqCst), 1);
-
-    let exact_replay = registry_offer_create(
-        &fixture,
-        principal.clone(),
-        &evaluation_id,
-        "registrar-preflight",
-    )
-    .await;
-    assert_eq!(exact_replay.status(), StatusCode::OK);
-    assert_eq!(
-        registry_offer_response_json(exact_replay).await,
-        created_body
-    );
-    assert_eq!(
-        sign_attempt_count.load(Ordering::SeqCst),
-        1,
-        "exact replay must return before signer work"
-    );
-
-    let other_evaluation_id = registry_offer_evaluate(&fixture, "NAT-PREFLIGHT-002").await;
-    let mut other_principal = fixture.principal.clone();
-    other_principal.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-PREFLIGHT-002",
-    ));
-    let idempotency_conflict = registry_offer_create(
-        &fixture,
-        other_principal,
-        &other_evaluation_id,
-        "registrar-preflight",
-    )
-    .await;
-    assert_eq!(idempotency_conflict.status(), StatusCode::CONFLICT);
-    assert_eq!(
-        sign_attempt_count.load(Ordering::SeqCst),
-        1,
-        "idempotency-key conflict must return before signer work"
-    );
-
-    let consumed = registry_offer_create(
-        &fixture,
-        principal,
-        &evaluation_id,
-        "registrar-preflight-new-operation",
-    )
-    .await;
-    assert_eq!(consumed.status(), StatusCode::CONFLICT);
-    assert_eq!(
-        sign_attempt_count.load(Ordering::SeqCst),
-        1,
-        "consumed evaluation must return before signer work"
-    );
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_registry_offer_charges_quota_before_signer_work() {
-    let sign_attempt_count = Arc::new(AtomicUsize::new(0));
-    let preauth = oid4vci_test_preauth_runtime_with_limited_signer(
-        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
-        Arc::clone(&sign_attempt_count),
-        0,
-    );
-    let mut evidence = registry_offer_test_evidence();
-    evidence.machine_quota = registry_notary_core::MachineQuotaConfig {
-        enabled: true,
-        // The two evaluations consume two units. The first offer consumes the
-        // third before its signer failure, leaving the second offer over quota.
-        subjects_per_minute: 3,
-    };
-    let fixture = registry_offer_fixture_with(evidence, preauth).await;
-    let first_evaluation_id = registry_offer_evaluate(&fixture, "NAT-QUOTA-SIGN-001").await;
-    let second_evaluation_id = registry_offer_evaluate(&fixture, "NAT-QUOTA-SIGN-002").await;
-
-    let mut first_principal = fixture.principal.clone();
-    first_principal.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-QUOTA-SIGN-001",
-    ));
-    let signer_failure = registry_offer_create(
-        &fixture,
-        first_principal,
-        &first_evaluation_id,
-        "registrar-quota-sign-1",
-    )
-    .await;
-    assert!(signer_failure.status().is_server_error());
-    assert_eq!(sign_attempt_count.load(Ordering::SeqCst), 1);
-
-    let mut second_principal = fixture.principal.clone();
-    second_principal.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-QUOTA-SIGN-002",
-    ));
-    let quota_denial = registry_offer_create(
-        &fixture,
-        second_principal,
-        &second_evaluation_id,
-        "registrar-quota-sign-2",
-    )
-    .await;
-    assert_eq!(quota_denial.status(), StatusCode::TOO_MANY_REQUESTS);
-    assert_eq!(
-        sign_attempt_count.load(Ordering::SeqCst),
-        1,
-        "over-quota offer must return before signer work"
-    );
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_registry_offer_denies_unbound_authority_and_mutated_evidence() {
-    let fixture = registry_offer_fixture().await;
-    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-BOUNDARY-001").await;
-    let correct_details = registry_offer_authorization_details(&fixture.state, "NAT-BOUNDARY-001");
-
-    let missing_idempotency = oid4vci_create_registry_offer(
-        HeaderMap::new(),
-        Some(Extension(Arc::clone(&fixture.state))),
-        Some(Extension(fixture.principal.clone())),
-        Ok(Json(Oid4vciRegistryOfferRequest {
-            evaluation_id: evaluation_id.clone(),
-            credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
-        })),
-    )
-    .await;
-    assert_eq!(missing_idempotency.status(), StatusCode::BAD_REQUEST);
-
-    let missing_authentication = oid4vci_create_registry_offer(
-        registry_offer_headers("missing-authentication"),
-        Some(Extension(Arc::clone(&fixture.state))),
-        None,
-        Ok(Json(Oid4vciRegistryOfferRequest {
-            evaluation_id: evaluation_id.clone(),
-            credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
-        })),
-    )
-    .await;
-    assert_eq!(missing_authentication.status(), StatusCode::UNAUTHORIZED);
-
-    let mut authorized = fixture.principal.clone();
-    authorized.authorization_details = Some(correct_details.clone());
-    let unknown_configuration = oid4vci_create_registry_offer(
-        registry_offer_headers("unknown-configuration"),
-        Some(Extension(Arc::clone(&fixture.state))),
-        Some(Extension(authorized)),
-        Ok(Json(Oid4vciRegistryOfferRequest {
-            evaluation_id: evaluation_id.clone(),
-            credential_configuration_id: "unknown_configuration".to_string(),
-        })),
-    )
-    .await;
-    assert_eq!(unknown_configuration.status(), StatusCode::NOT_FOUND);
-
-    let mut missing_create_scope = fixture.principal.clone();
-    missing_create_scope
-        .scopes
-        .retain(|scope| scope != REGISTRY_OFFER_CREATE_SCOPE);
-    let response = registry_offer_create(
-        &fixture,
-        missing_create_scope,
-        &evaluation_id,
-        "missing-create-scope",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-
-    let mut missing_configuration_scope = fixture.principal.clone();
-    let configuration_scope = fixture.state.oid4vci.credential_configurations
-        [REGISTRY_OFFER_CONFIGURATION_ID]
-        .scope
-        .clone();
-    missing_configuration_scope
-        .scopes
-        .retain(|scope| scope != &configuration_scope);
-    let response = registry_offer_create(
-        &fixture,
-        missing_configuration_scope,
-        &evaluation_id,
-        "missing-configuration-scope",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-
-    let mut wallet_token_principal = fixture.principal.clone();
-    wallet_token_principal.auth_profile_id =
-        registry_notary_core::EvidenceAuthProfileId::NotaryAccessToken;
-    let response = registry_offer_create(
-        &fixture,
-        wallet_token_principal,
-        &evaluation_id,
-        "wallet-cannot-create",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-
-    let mut wrong_rar = fixture.principal.clone();
-    let mut wrong_details = correct_details.clone();
-    wrong_details.actions = vec!["issue_credential".to_string()];
-    wrong_rar.authorization_details = Some(wrong_details);
-    let response = registry_offer_create(&fixture, wrong_rar, &evaluation_id, "wrong-rar").await;
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-
-    let mut wrong_target_rar = fixture.principal.clone();
-    let mut wrong_target_details = correct_details.clone();
-    wrong_target_details
-        .target
-        .as_mut()
-        .expect("offer RAR has a target")
-        .id = "NAT-BOUNDARY-OTHER".to_string();
-    wrong_target_rar.authorization_details = Some(wrong_target_details);
-    let response = registry_offer_create(
-        &fixture,
-        wrong_target_rar,
-        &evaluation_id,
-        "wrong-rar-target",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-
-    let mut foreign_principal =
-        registry_offer_machine_principal(&fixture.state, "registrar-foreign");
-    foreign_principal.authorization_details = Some(correct_details.clone());
-    let response = registry_offer_create(
-        &fixture,
-        foreign_principal,
-        &evaluation_id,
-        "foreign-evaluation",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::NOT_FOUND);
-
-    let stale_id = registry_offer_evaluate(&fixture, "NAT-BOUNDARY-STALE").await;
-    let mut stale = fixture
-        .store
-        .get(&stale_id, REGISTRY_OFFER_PRINCIPAL_ID)
-        .await
-        .expect("stored evaluation read succeeds")
-        .expect("stored evaluation exists");
-    stale.expires_at = "2020-01-01T00:00:00Z".to_string();
-    fixture
-        .store
-        .insert(stale)
-        .await
-        .expect("stale fixture writes");
-    let mut authorized = fixture.principal.clone();
-    authorized.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-BOUNDARY-STALE",
-    ));
-    let response = registry_offer_create(&fixture, authorized, &stale_id, "stale-evaluation").await;
-    assert_eq!(response.status(), StatusCode::NOT_FOUND);
-
-    let wrong_purpose_id = registry_offer_evaluate(&fixture, "NAT-BOUNDARY-PURPOSE").await;
-    let mut wrong_purpose = fixture
-        .store
-        .get(&wrong_purpose_id, REGISTRY_OFFER_PRINCIPAL_ID)
-        .await
-        .expect("stored evaluation read succeeds")
-        .expect("stored evaluation exists");
-    wrong_purpose.purpose = "different-purpose".to_string();
-    fixture
-        .store
-        .insert(wrong_purpose)
-        .await
-        .expect("purpose mutation fixture writes");
-    let mut authorized = fixture.principal.clone();
-    authorized.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-BOUNDARY-PURPOSE",
-    ));
-    let response =
-        registry_offer_create(&fixture, authorized, &wrong_purpose_id, "wrong-purpose").await;
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-
-    let value_tamper_id = registry_offer_evaluate(&fixture, "NAT-BOUNDARY-VALUE").await;
-    fixture.store.tamper_next_read(|evaluation| {
-        evaluation.results[0].value = Some(json!("mutated-after-evaluation"));
-    });
-    let mut authorized = fixture.principal.clone();
-    authorized.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-BOUNDARY-VALUE",
-    ));
-    let response =
-        registry_offer_create(&fixture, authorized, &value_tamper_id, "value-mutated").await;
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-
-    let provenance_tamper_id = registry_offer_evaluate(&fixture, "NAT-BOUNDARY-PROVENANCE").await;
-    fixture.store.tamper_next_read(|evaluation| {
-        evaluation
-            .issuance_provenance
-            .as_mut()
-            .expect("issuance provenance exists")
-            .claims[0]
-            .relay_contract_hash =
-            "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc".to_string();
-    });
-    let mut authorized = fixture.principal.clone();
-    authorized.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-BOUNDARY-PROVENANCE",
-    ));
-    let response = registry_offer_create(
-        &fixture,
-        authorized,
-        &provenance_tamper_id,
-        "provenance-mutated",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_registry_offer_rejects_representative_credential_configurations() {
-    let mut oid4vci = registry_offer_test_oid4vci();
-    oid4vci
-        .credential_configurations
-        .get_mut(REGISTRY_OFFER_CONFIGURATION_ID)
-        .expect("registry offer credential configuration exists")
-        .representative_issuance =
-        Some(registry_notary_core::Oid4vciRepresentativeIssuanceConfig {
-            ceremony: registry_notary_core::Oid4vciRepresentativeIssuanceCeremony::DigitallyAuthenticatedRepresentative,
-            relationship: "authorized-representative".to_string(),
-        });
-    let fixture = registry_offer_fixture_with_configuration(
-        registry_offer_test_evidence(),
-        oid4vci_test_preauth_runtime(registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP),
-        oid4vci,
-    )
-    .await;
-    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-REPRESENTATIVE-DENIED").await;
-    let mut principal = fixture.principal.clone();
-    principal.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-REPRESENTATIVE-DENIED",
-    ));
-
-    let response = registry_offer_create(
-        &fixture,
-        principal,
-        &evaluation_id,
-        "representative-configuration",
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-    let body = registry_offer_response_json(response).await;
-    assert_eq!(
-        body["code"],
-        json!("representative_offer_requires_authenticated_ceremony")
-    );
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_registry_offer_rejects_non_exact_claim_and_target_authority() {
-    let fixture = registry_offer_fixture().await;
-    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-EXACT-AUTHORITY").await;
-    let correct_details =
-        registry_offer_authorization_details(&fixture.state, "NAT-EXACT-AUTHORITY");
-
-    let mut wrong_scheme_rar = fixture.principal.clone();
-    let mut wrong_scheme_details = correct_details.clone();
-    wrong_scheme_details
-        .target
-        .as_mut()
-        .expect("offer RAR has a target")
-        .id_type = "registry_file_number".to_string();
-    wrong_scheme_rar.authorization_details = Some(wrong_scheme_details);
-    let response = registry_offer_create(
-        &fixture,
-        wrong_scheme_rar,
-        &evaluation_id,
-        "wrong-rar-target-scheme",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-
-    let mut duplicate_claim_rar = fixture.principal.clone();
-    let mut duplicate_claim_details = correct_details.clone();
-    duplicate_claim_details.claims[1] = duplicate_claim_details.claims[0].clone();
-    duplicate_claim_rar.authorization_details = Some(duplicate_claim_details);
-    let response = registry_offer_create(
-        &fixture,
-        duplicate_claim_rar,
-        &evaluation_id,
-        "duplicate-rar-claim",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-
-    let mut version_substitution_rar = fixture.principal.clone();
-    let mut version_substitution_details = correct_details;
-    version_substitution_details.claims[0].version = Some("1".to_string());
-    version_substitution_rar.authorization_details = Some(version_substitution_details);
-    let response = registry_offer_create(
-        &fixture,
-        version_substitution_rar,
-        &evaluation_id,
-        "version-substitution-rar-claim",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn oid4vci_registry_offer_rejects_missing_or_cross_evaluation_target_binding() {
-    let fixture = registry_offer_fixture().await;
-    let legacy_binding_id = registry_offer_evaluate(&fixture, "NAT-BOUNDARY-LEGACY").await;
-    fixture.store.tamper_next_read(|evaluation| {
-        evaluation
-            .issuance_provenance
-            .as_mut()
-            .expect("issuance provenance exists")
-            .authorization_target_binding
-            .clear();
-    });
-    let mut authorized = fixture.principal.clone();
-    authorized.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-BOUNDARY-LEGACY",
-    ));
-    let response = registry_offer_create(
-        &fixture,
-        authorized,
-        &legacy_binding_id,
-        "legacy-target-binding",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-
-    let first_binding_id = registry_offer_evaluate(&fixture, "NAT-BOUNDARY-BINDING-A").await;
-    let second_binding_id = registry_offer_evaluate(&fixture, "NAT-BOUNDARY-BINDING-B").await;
-    let second_binding = fixture
-        .store
-        .get(&second_binding_id, REGISTRY_OFFER_PRINCIPAL_ID)
-        .await
-        .expect("stored evaluation read succeeds")
-        .expect("stored evaluation exists")
-        .issuance_provenance
-        .expect("issuance provenance exists")
-        .authorization_target_binding;
-    fixture.store.tamper_next_read(move |evaluation| {
-        evaluation
-            .issuance_provenance
-            .as_mut()
-            .expect("issuance provenance exists")
-            .authorization_target_binding = second_binding.clone();
-    });
-    let mut authorized = fixture.principal.clone();
-    authorized.authorization_details = Some(registry_offer_authorization_details(
-        &fixture.state,
-        "NAT-BOUNDARY-BINDING-A",
-    ));
-    let response = registry_offer_create(
-        &fixture,
-        authorized,
-        &first_binding_id,
-        "cross-evaluation-target-binding",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-}
diff --git a/crates/registry-notary-server/src/api/tests/state.rs b/crates/registry-notary-server/src/api/tests/state.rs
deleted file mode 100644
index 2aa5e98d4..000000000
--- a/crates/registry-notary-server/src/api/tests/state.rs
+++ /dev/null
@@ -1,396 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! State API tests.
-
-use super::*;
-
-#[derive(Debug)]
-struct ReadinessRelay {
-    calls: AtomicUsize,
-    ready: AtomicBool,
-}
-
-impl ReadinessRelay {
-    fn new(ready: bool) -> Self {
-        Self {
-            calls: AtomicUsize::new(0),
-            ready: AtomicBool::new(ready),
-        }
-    }
-}
-
-#[async_trait::async_trait]
-impl crate::runtime::ActivatedRelayConsultations for ReadinessRelay {
-    async fn check_ready(&self) -> Result<(), crate::relay_client::RelayClientError> {
-        self.calls.fetch_add(1, Ordering::SeqCst);
-        tokio::task::yield_now().await;
-        if self.ready.load(Ordering::SeqCst) {
-            Ok(())
-        } else {
-            Err(crate::relay_client::RelayClientError::Unavailable)
-        }
-    }
-
-    fn validate(
-        &self,
-        _key: &crate::runtime::consultation::ConsultationGroupKeyV1,
-    ) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    async fn execute(
-        &self,
-        _key: &crate::runtime::ConsultationGroupKeyV1,
-    ) -> Result<crate::runtime::RuntimeRelayConsultationResult, crate::relay_client::RelayClientError>
-    {
-        Err(crate::relay_client::RelayClientError::InvalidRequest)
-    }
-}
-
-fn relay_readiness_state() -> RegistryNotaryApiState {
-    let mut evidence = evidence_config();
-    evidence.claims[0].evidence_mode = registry_notary_core::ClaimEvidenceMode::RegistryBacked {
-        consultations: BTreeMap::new(),
-    };
-    RegistryNotaryApiState::new(
-        Arc::new(evidence),
-        AuditKeyHasher::unkeyed_dev_only(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    )
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn readiness_reports_unactivated_cel_without_starting_the_worker() {
-    let worker = Arc::new(crate::cel_worker::CelWorker::lazy(
-        crate::cel_worker::CelWorkerConfig::for_current_exe_subcommand(),
-    ));
-    let state = Arc::new(
-        RegistryNotaryApiState::new(
-            Arc::new(evidence_config()),
-            AuditKeyHasher::unkeyed_dev_only(),
-            Arc::new(EvidenceStore::default()),
-            Arc::new(NoopIssuerResolver),
-        )
-        .with_cel_worker(Some(Arc::clone(&worker))),
-    );
-
-    let response = ready(Some(Extension(state))).await;
-    assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
-    let body = to_bytes(response.into_body(), 1024 * 1024)
-        .await
-        .expect("ready body reads");
-    let value: Value = serde_json::from_slice(&body).expect("ready body is JSON");
-
-    assert_eq!(value["checks"]["cel"]["total"], json!(1));
-    assert_eq!(value["checks"]["cel"]["ok"], json!(0));
-    assert_eq!(value["checks"]["cel"]["failed"], json!(1));
-    assert!(
-        !worker.is_activated(),
-        "readiness must not spawn the worker"
-    );
-}
-
-#[tokio::test]
-async fn registry_backed_state_is_not_ready_before_relay_activation() {
-    let state = Arc::new(relay_readiness_state());
-
-    assert!(state.relay_required());
-    assert!(!state.relay_activated());
-    assert!(!state.relay_ready().await);
-
-    let response = ready(Some(Extension(state))).await;
-    assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
-    let body = to_bytes(response.into_body(), 1024 * 1024)
-        .await
-        .expect("ready body reads");
-    let value: Value = serde_json::from_slice(&body).expect("ready body is JSON");
-    assert_eq!(value["checks"]["total"], json!(2));
-    assert_eq!(value["checks"]["ok"], json!(0));
-    assert_eq!(value["checks"]["degraded"], json!(1));
-    assert_eq!(value["checks"]["failed"], json!(1));
-    assert_eq!(value["checks"]["relay"]["total"], json!(1));
-    assert_eq!(value["checks"]["relay"]["ok"], json!(0));
-    assert_eq!(value["checks"]["relay"]["failed"], json!(1));
-    assert_eq!(value["checks"]["cel"]["total"], json!(0));
-    assert_eq!(value["checks"]["cel"]["ok"], json!(0));
-    assert_eq!(value["checks"]["cel"]["failed"], json!(0));
-}
-
-#[tokio::test]
-async fn relay_readiness_is_singleflight_cached_and_recovers() {
-    let state = Arc::new(relay_readiness_state());
-    let relay = Arc::new(ReadinessRelay::new(false));
-    let activated: Arc<dyn crate::runtime::ActivatedRelayConsultations> = relay.clone();
-    state
-        .install_activated_relay(activated)
-        .expect("Relay activation succeeds once");
-
-    let (first, second, third) = tokio::join!(
-        state.relay_ready(),
-        state.relay_ready(),
-        state.relay_ready()
-    );
-    assert!(!first && !second && !third);
-    assert_eq!(relay.calls.load(Ordering::SeqCst), 1);
-
-    relay.ready.store(true, Ordering::SeqCst);
-    assert!(!state.relay_ready().await, "failure is briefly cached");
-    assert_eq!(relay.calls.load(Ordering::SeqCst), 1);
-
-    state.expire_relay_readiness_cache().await;
-    assert!(state.relay_ready().await);
-    assert_eq!(relay.calls.load(Ordering::SeqCst), 2);
-}
-
-#[tokio::test]
-async fn readiness_reports_each_relay_profile_without_hiding_partial_availability() {
-    let state = Arc::new(relay_readiness_state());
-    let ready_profile: Arc<dyn crate::runtime::ActivatedRelayConsultations> =
-        Arc::new(ReadinessRelay::new(true));
-    let unavailable: Arc<dyn crate::runtime::ActivatedRelayConsultations> =
-        Arc::new(ReadinessRelay::new(false));
-    let contract_hash = "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
-    let expected_result = || {
-        crate::runtime::RuntimeRelayExpectedResult::output_map(BTreeMap::from([(
-            "status".to_string(),
-            registry_notary_core::RelayOutputContract::String {
-                nullable: false,
-                max_bytes: 64,
-            },
-        )]))
-        .expect("output contract is valid")
-    };
-    let clients = crate::runtime::ActivatedRelayClientSet::new([
-        (
-            crate::runtime::RelayClientSelectionV1::new(
-                "example.live-status.exact",
-                contract_hash,
-                "benefit-verification",
-                "subject_id",
-                expected_result(),
-            )
-            .expect("ready profile selection is valid"),
-            ready_profile,
-        ),
-        (
-            crate::runtime::RelayClientSelectionV1::new(
-                "example.snapshot-status.exact",
-                contract_hash,
-                "benefit-verification",
-                "subject_id",
-                expected_result(),
-            )
-            .expect("unavailable profile selection is valid"),
-            unavailable,
-        ),
-    ])
-    .expect("both exact profile selections are retained");
-    state
-        .install_activated_relay(Arc::new(clients))
-        .expect("Relay activation succeeds once");
-
-    let response = ready(Some(Extension(state))).await;
-    assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
-    let body = to_bytes(response.into_body(), 1024 * 1024)
-        .await
-        .expect("ready body reads");
-    let value: Value = serde_json::from_slice(&body).expect("ready body is JSON");
-
-    assert_eq!(value["checks"]["relay"]["total"], json!(2));
-    assert_eq!(value["checks"]["relay"]["ok"], json!(1));
-    assert_eq!(value["checks"]["relay"]["failed"], json!(1));
-    assert_eq!(value["checks"]["total"], json!(3));
-    assert_eq!(value["checks"]["ok"], json!(1));
-    assert_eq!(value["checks"]["failed"], json!(1));
-}
-
-#[test]
-fn runtime_snapshot_read_never_observes_torn_issuer_federation_generation() {
-    let old_issuers: Arc<dyn EvidenceIssuerResolver> = Arc::new(NoopIssuerResolver);
-    let new_issuers: Arc<dyn EvidenceIssuerResolver> = Arc::new(TestIssuerResolver);
-    let old_federation = test_federation_runtime("old");
-    let new_federation = test_federation_runtime("new");
-    let old_snapshot = Arc::new(ApiRuntimeSnapshot {
-        federation_runtime: Some(Arc::clone(&old_federation)),
-        issuer_runtime: Arc::new(IssuerRuntimeBundle {
-            issuers: Arc::clone(&old_issuers),
-            signer_readiness: SignerReadiness::default(),
-        }),
-        config_governance: ConfigGovernanceContext::default(),
-        runtime_config: None,
-        preauth: None,
-    });
-    let new_snapshot = Arc::new(ApiRuntimeSnapshot {
-        federation_runtime: Some(Arc::clone(&new_federation)),
-        issuer_runtime: Arc::new(IssuerRuntimeBundle {
-            issuers: Arc::clone(&new_issuers),
-            signer_readiness: SignerReadiness::default(),
-        }),
-        config_governance: ConfigGovernanceContext::default(),
-        runtime_config: None,
-        preauth: None,
-    });
-    let state = Arc::new(RegistryNotaryApiState::new_with_runtime_blocks(
-        Arc::new(EvidenceConfig::default()),
-        Arc::new(SubjectAccessConfig::default()),
-        Arc::new(Oid4vciConfig::default()),
-        Arc::new(FederationConfig::default()),
-        Some(Arc::clone(&old_federation)),
-        AuditKeyHasher::unkeyed_dev_only(),
-        ReplayStores::memory(),
-        CredentialStatusStore::disabled(),
-        Arc::new(AppMetrics::default()),
-        Arc::new(EvidenceStore::default()),
-        Arc::clone(&old_issuers),
-        SignerReadiness::default(),
-    ));
-    state.publish_runtime_snapshot(Arc::clone(&old_snapshot));
-
-    let worker_count = 8;
-    let start = Arc::new(Barrier::new(worker_count + 1));
-    let done = Arc::new(AtomicBool::new(false));
-    let torn = Arc::new(AtomicBool::new(false));
-    let observed_old = Arc::new(AtomicBool::new(false));
-    let observed_new = Arc::new(AtomicBool::new(false));
-    let mut workers = Vec::new();
-    for _ in 0..worker_count {
-        let state = Arc::clone(&state);
-        let start = Arc::clone(&start);
-        let done = Arc::clone(&done);
-        let torn = Arc::clone(&torn);
-        let observed_old = Arc::clone(&observed_old);
-        let observed_new = Arc::clone(&observed_new);
-        let old_issuers = Arc::clone(&old_issuers);
-        let new_issuers = Arc::clone(&new_issuers);
-        let old_federation = Arc::clone(&old_federation);
-        let new_federation = Arc::clone(&new_federation);
-        workers.push(thread::spawn(move || {
-            start.wait();
-            while !done.load(Ordering::SeqCst) {
-                let snapshot = state.runtime_snapshot();
-                let issuer_is_old = Arc::ptr_eq(&snapshot.issuer_runtime.issuers, &old_issuers);
-                let issuer_is_new = Arc::ptr_eq(&snapshot.issuer_runtime.issuers, &new_issuers);
-                let federation_is_old = snapshot
-                    .federation_runtime
-                    .as_ref()
-                    .is_some_and(|runtime| Arc::ptr_eq(runtime, &old_federation));
-                let federation_is_new = snapshot
-                    .federation_runtime
-                    .as_ref()
-                    .is_some_and(|runtime| Arc::ptr_eq(runtime, &new_federation));
-                if issuer_is_old && federation_is_old {
-                    observed_old.store(true, Ordering::SeqCst);
-                } else if issuer_is_new && federation_is_new {
-                    observed_new.store(true, Ordering::SeqCst);
-                } else {
-                    torn.store(true, Ordering::SeqCst);
-                    break;
-                }
-            }
-        }));
-    }
-
-    start.wait();
-    // The reader threads race a publisher that does nothing but atomic swaps, so on
-    // an oversubscribed runner every publish can complete before any reader executes
-    // its loop body even once. A fixed iteration count therefore isn't a reliable way
-    // to guarantee both generations get observed; keep alternating publishes until
-    // they actually have been, bounded by a generous wall-clock deadline so a genuine
-    // regression (e.g. readers never getting scheduled at all) still fails the test
-    // instead of hanging.
-    let coverage_deadline_duration = Duration::from_secs(15);
-    let coverage_deadline = Instant::now() + coverage_deadline_duration;
-    let mut publish_pairs: u64 = 0;
-    loop {
-        state.publish_runtime_snapshot(Arc::clone(&new_snapshot));
-        state.publish_runtime_snapshot(Arc::clone(&old_snapshot));
-        publish_pairs += 1;
-
-        if torn.load(Ordering::SeqCst) {
-            break;
-        }
-        if observed_old.load(Ordering::SeqCst) && observed_new.load(Ordering::SeqCst) {
-            break;
-        }
-        if Instant::now() >= coverage_deadline {
-            break;
-        }
-    }
-    done.store(true, Ordering::SeqCst);
-    for worker in workers {
-        worker.join().expect("observer thread joins");
-    }
-
-    // The real correctness property: a reader must never see a snapshot with an old
-    // issuer paired with a new federation runtime (or vice versa).
-    assert!(!torn.load(Ordering::SeqCst));
-    // Coverage is a test-harness concern, not a correctness one: it just confirms the
-    // race above actually exercised both generations before the deadline elapsed.
-    assert!(
-        observed_old.load(Ordering::SeqCst) && observed_new.load(Ordering::SeqCst),
-        "reader threads never observed both snapshot generations after {publish_pairs} \
-             publish pairs and a {:?} coverage deadline (observed_old={}, observed_new={}); \
-             this is a scheduling coverage failure, not a torn read (the torn invariant above \
-             already holds)",
-        coverage_deadline_duration,
-        observed_old.load(Ordering::SeqCst),
-        observed_new.load(Ordering::SeqCst),
-    );
-}
-
-#[tokio::test]
-async fn readiness_fails_when_signer_readiness_fails() {
-    let state = Arc::new(
-        RegistryNotaryApiState::new(
-            Arc::new(evidence_config()),
-            AuditKeyHasher::unkeyed_dev_only(),
-            Arc::new(EvidenceStore::default()),
-            Arc::new(NoopIssuerResolver),
-        )
-        .with_signer_readiness(SignerReadiness::from_provider_flags(vec![Arc::new(
-            AtomicBool::new(false),
-        )])),
-    );
-
-    let response = ready(Some(Extension(state))).await;
-    assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
-    let body = to_bytes(response.into_body(), 1024 * 1024)
-        .await
-        .expect("ready body reads");
-    let value: Value = serde_json::from_slice(&body).expect("ready body is JSON");
-
-    assert_eq!(value["status"], json!(503));
-    assert_eq!(value["code"], "readiness.not_ready");
-    assert_eq!(value["readiness_status"], "not_ready");
-    assert_eq!(value["checks"]["signing_providers"]["total"], json!(1));
-    assert_eq!(value["checks"]["signing_providers"]["ok"], json!(0));
-    assert_eq!(value["checks"]["signing_providers"]["failed"], json!(1));
-}
-
-#[test]
-fn access_token_issuance_signer_is_in_custody_counts() {
-    let mut config = classifier_config();
-    config.auth.access_token_signing.enabled = true;
-    config.auth.access_token_signing.signing_key_id = "access-token-key".to_string();
-    config.evidence.signing_keys.insert(
-        "access-token-key".to_string(),
-        serde_norway::from_str(
-            r#"
-provider: local_jwk_env
-private_jwk_env: ACCESS_TOKEN_JWK
-alg: EdDSA
-kid: access-token-key
-status: active
-"#,
-        )
-        .expect("signing key parses"),
-    );
-
-    let access_token = access_token_issuance_signer_counts(&config);
-    assert_eq!(access_token.total, 1);
-    assert_eq!(access_token.local_software, 1);
-    let scoped = custody_scoped_signer_counts(&config);
-    assert_eq!(scoped.total, 1);
-    assert_eq!(scoped.local_software, 1);
-}
diff --git a/crates/registry-notary-server/src/api/tests/status.rs b/crates/registry-notary-server/src/api/tests/status.rs
deleted file mode 100644
index ae7ffa7f0..000000000
--- a/crates/registry-notary-server/src/api/tests/status.rs
+++ /dev/null
@@ -1,170 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Status API tests.
-
-use super::*;
-
-#[tokio::test]
-async fn credential_status_list_response_is_signed_status_list_jwt() {
-    let credential_status = CredentialStatusStore::from_config(&CredentialStatusConfig {
-        enabled: true,
-        base_url: "https://issuer.example".to_string(),
-        ..CredentialStatusConfig::default()
-    });
-    let issued_at = OffsetDateTime::now_utc();
-    credential_status
-        .record_issued(
-            "credential-1".to_string(),
-            "did:web:issuer.example".to_string(),
-            "civil_status_sd_jwt".to_string(),
-            issued_at,
-            issued_at + time::Duration::seconds(600),
-        )
-        .await
-        .expect("status record writes");
-    let record = credential_status
-        .get("credential-1")
-        .await
-        .expect("status record reads")
-        .expect("status record exists");
-    let state = RegistryNotaryApiState::new_with_runtime_blocks(
-        Arc::new(evidence_config()),
-        Arc::new(SubjectAccessConfig::default()),
-        Arc::new(Oid4vciConfig::default()),
-        Arc::new(FederationConfig::default()),
-        None,
-        AuditKeyHasher::unkeyed_dev_only(),
-        ReplayStores::memory(),
-        credential_status,
-        Arc::new(AppMetrics::default()),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(TestIssuerResolver),
-        SignerReadiness::default(),
-    );
-
-    let response = credential_status_list_response(&state, &record).await;
-
-    assert_eq!(response.status(), StatusCode::OK);
-    assert_eq!(
-        response
-            .headers()
-            .get(header::CONTENT_TYPE)
-            .and_then(|value| value.to_str().ok()),
-        Some("application/statuslist+jwt")
-    );
-    let body = to_bytes(response.into_body(), usize::MAX)
-        .await
-        .expect("status list body reads");
-    let jwt = std::str::from_utf8(&body).expect("status list JWT is UTF-8");
-    let header = decode_jwt_header(jwt);
-    let payload = decode_jwt_payload(jwt);
-    assert_eq!(header["typ"], json!("statuslist+jwt"));
-    assert_eq!(header["kid"], json!("did:web:issuer.example#key-1"));
-    assert_eq!(payload["iss"], json!("did:web:issuer.example"));
-    assert_eq!(
-        payload["sub"],
-        json!("https://issuer.example/v1/credentials/credential-1/status")
-    );
-    assert_eq!(
-        payload["aud"],
-        json!("https://issuer.example/v1/credentials/credential-1/status")
-    );
-    assert_eq!(payload["ttl"], json!(300));
-    assert_eq!(payload["status_list"]["bits"], json!(8));
-    assert_eq!(payload["status_list"]["lst"], json!("eJxjAAAAAQAB"));
-}
-
-#[tokio::test]
-async fn credential_status_list_response_reuses_cached_signature() {
-    let credential_status = CredentialStatusStore::from_config(&CredentialStatusConfig {
-        enabled: true,
-        base_url: "https://issuer.example".to_string(),
-        ..CredentialStatusConfig::default()
-    });
-    let issued_at = OffsetDateTime::now_utc();
-    credential_status
-        .record_issued(
-            "credential-cache".to_string(),
-            "did:web:issuer.example".to_string(),
-            "civil_status_sd_jwt".to_string(),
-            issued_at,
-            issued_at + time::Duration::seconds(600),
-        )
-        .await
-        .expect("status record writes");
-    let record = credential_status
-        .get("credential-cache")
-        .await
-        .expect("status record reads")
-        .expect("status record exists");
-    let sign_count = Arc::new(AtomicUsize::new(0));
-    let state = RegistryNotaryApiState::new_with_runtime_blocks(
-        Arc::new(evidence_config()),
-        Arc::new(SubjectAccessConfig::default()),
-        Arc::new(Oid4vciConfig::default()),
-        Arc::new(FederationConfig::default()),
-        None,
-        AuditKeyHasher::unkeyed_dev_only(),
-        ReplayStores::memory(),
-        credential_status,
-        Arc::new(AppMetrics::default()),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(CountingIssuerResolver {
-            sign_count: Arc::clone(&sign_count),
-        }),
-        SignerReadiness::default(),
-    );
-
-    let first = credential_status_list_response(&state, &record).await;
-    let second = credential_status_list_response(&state, &record).await;
-
-    assert_eq!(first.status(), StatusCode::OK);
-    assert_eq!(second.status(), StatusCode::OK);
-    assert_eq!(sign_count.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn status_list_jwt_cache_does_not_hold_lock_while_signing() {
-    let cache = Arc::new(StatusListJwtCache::default());
-    let nested_cache = Arc::clone(&cache);
-    let now = OffsetDateTime::now_utc();
-    let expires_at = now + time::Duration::seconds(60);
-
-    let result = tokio::time::timeout(
-        Duration::from_secs(1),
-        cache.get_or_insert_with("outer".to_string(), now, expires_at, || async move {
-            nested_cache
-                .get_or_insert_with("inner".to_string(), now, expires_at, || async {
-                    Ok("inner-token".to_string())
-                })
-                .await?;
-            Ok("outer-token".to_string())
-        }),
-    )
-    .await
-    .expect("cache lookup should not block behind its own signing future")
-    .expect("outer token signs");
-
-    assert_eq!(result, "outer-token");
-}
-
-#[test]
-fn accepts_status_list_jwt_matches_exact_media_type() {
-    let mut headers = HeaderMap::new();
-    headers.insert(
-        header::ACCEPT,
-        HeaderValue::from_static("application/statuslist+jwt; q=0.8"),
-    );
-    assert!(accepts_status_list_jwt(&headers));
-
-    headers.insert(
-        header::ACCEPT,
-        HeaderValue::from_static("Application/StatusList+JWT"),
-    );
-    assert!(accepts_status_list_jwt(&headers));
-
-    headers.insert(
-        header::ACCEPT,
-        HeaderValue::from_static("application/statuslist+jwt-seq"),
-    );
-    assert!(!accepts_status_list_jwt(&headers));
-}
diff --git a/crates/registry-notary-server/src/api/tests/subject_access.rs b/crates/registry-notary-server/src/api/tests/subject_access.rs
deleted file mode 100644
index 96139ad01..000000000
--- a/crates/registry-notary-server/src/api/tests/subject_access.rs
+++ /dev/null
@@ -1,1337 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Attestation API tests.
-
-use super::*;
-
-#[test]
-fn subject_access_authorization_details_allow_exact_transaction() {
-    let config = subject_access_config();
-    let evidence = evidence_config();
-    let principal = classified_transaction_principal(&config, &evidence);
-    let mut request = evaluate_request("NAT-123");
-    request.claims = vec![ClaimRef::with_version("person-is-alive", "1")];
-
-    require_subject_access_evaluate(&evidence, &config, &principal, &request)
-        .expect("exact transaction details authorize request");
-}
-
-#[test]
-fn subject_access_authorization_details_required_for_transaction_token() {
-    let config = subject_access_config();
-    let evidence = evidence_config();
-    let mut principal = classify_subject_access_principal(
-        &config,
-        &fresh_oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-    )
-    .expect("citizen principal classifies");
-    principal.authorization_details = None;
-    let claims = principal
-        .verified_claims
-        .as_mut()
-        .expect("classified principal carries verified claims");
-    claims.token_type = Some(bounded(
-        registry_notary_core::tokens::NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-    ));
-    let mut request = evaluate_request("NAT-123");
-    request.claims = vec![ClaimRef::with_version("person-is-alive", "1")];
-
-    let err = require_subject_access_evaluate(&evidence, &config, &principal, &request)
-        .expect_err("transaction tokens must carry authorization_details");
-
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::OperationDenied
-        }
-    ));
-}
-
-#[test]
-fn subject_access_authorization_details_reject_omitted_claim_version() {
-    let config = subject_access_config();
-    let evidence = evidence_config();
-    let principal = classified_transaction_principal(&config, &evidence);
-    let request = evaluate_request("NAT-123");
-
-    let err = require_subject_access_evaluate(&evidence, &config, &principal, &request)
-        .expect_err("omitting a versioned authorized claim broadens the request");
-
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::ClaimDenied
-        }
-    ));
-}
-
-#[test]
-fn subject_access_authorization_details_reject_broadened_claims() {
-    let config = subject_access_config();
-    let evidence = evidence_config();
-    let mut principal = classified_transaction_principal(&config, &evidence);
-    principal
-        .authorization_details
-        .as_mut()
-        .expect("details exist")
-        .claims
-        .push(ClaimRef::with_version("date-of-birth", "1"));
-    let mut request = evaluate_request("NAT-123");
-    request.claims = vec![ClaimRef::with_version("person-is-alive", "1")];
-
-    let err = require_subject_access_evaluate(&evidence, &config, &principal, &request)
-        .expect_err("broadened transaction claims must be denied");
-
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::ClaimDenied
-        }
-    ));
-}
-
-#[test]
-fn subject_access_authorization_details_reject_duplicate_action() {
-    let config = subject_access_config();
-    let evidence = evidence_config();
-    let mut principal = classified_transaction_principal(&config, &evidence);
-    principal
-        .authorization_details
-        .as_mut()
-        .expect("details exist")
-        .actions
-        .push("evaluate".to_string());
-    let mut request = evaluate_request("NAT-123");
-    request.claims = vec![ClaimRef::with_version("person-is-alive", "1")];
-
-    let err = require_subject_access_evaluate(&evidence, &config, &principal, &request)
-        .expect_err("duplicate transaction action must be denied");
-
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::OperationDenied
-        }
-    ));
-}
-
-#[test]
-fn subject_access_authorization_details_reject_empty_claims_without_panic() {
-    let config = subject_access_config();
-    let evidence = evidence_config();
-    let principal = classified_transaction_principal(&config, &evidence);
-    let mut request = evaluate_request("NAT-123");
-    request.claims = Vec::new();
-
-    let err = require_subject_access_evaluate(&evidence, &config, &principal, &request)
-        .expect_err("empty claim array must deny instead of panicking");
-
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::ClaimDenied
-        }
-    ));
-}
-
-#[test]
-fn subject_access_authorization_details_tolerate_future_fields() {
-    let details: EvidenceAuthorizationDetails = serde_json::from_value(serde_json::json!({
-        "type": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE,
-        "schema_version": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION,
-        "actions": ["evaluate"],
-        "locations": ["registry-notary:test"],
-        "claims": [{"id": "person-is-alive", "version": "1"}],
-        "subject": {
-            "binding_claim": SUBJECT_BINDING_CLAIM,
-            "id_type": "national_id",
-            "future_subject_metadata": true
-        },
-        "assisted_access_context": {
-            "channel": "citizen_self_service",
-            "future_context_metadata": true
-        },
-        "future_authorization_metadata": true
-    }))
-    .expect("authorization_details should ignore future metadata fields");
-
-    assert_eq!(
-        details.subject.as_ref().unwrap().binding_claim,
-        SUBJECT_BINDING_CLAIM
-    );
-    assert_eq!(
-        details.assisted_access_context.as_ref().unwrap().channel,
-        "citizen_self_service"
-    );
-}
-
-#[test]
-fn subject_access_authorization_details_reject_wrong_notary_location() {
-    let config = subject_access_config();
-    let evidence = evidence_config();
-    let mut principal = classified_transaction_principal(&config, &evidence);
-    principal
-        .authorization_details
-        .as_mut()
-        .expect("details exist")
-        .locations = vec!["other-notary".to_string()];
-    let mut request = evaluate_request("NAT-123");
-    request.claims = vec![ClaimRef::with_version("person-is-alive", "1")];
-
-    let err = require_subject_access_evaluate(&evidence, &config, &principal, &request)
-        .expect_err("wrong Notary audience broadens the transaction");
-
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::OperationDenied
-        }
-    ));
-}
-
-#[test]
-fn subject_access_authorization_details_reject_wrong_subject_binding_metadata() {
-    let config = subject_access_config();
-    let evidence = evidence_config();
-    let mut principal = classified_transaction_principal(&config, &evidence);
-    principal
-        .authorization_details
-        .as_mut()
-        .and_then(|details| details.subject.as_mut())
-        .expect("subject details exist")
-        .id_type = "other_id".to_string();
-    let mut request = evaluate_request("NAT-123");
-    request.claims = vec![ClaimRef::with_version("person-is-alive", "1")];
-
-    let err = require_subject_access_evaluate(&evidence, &config, &principal, &request)
-        .expect_err("wrong subject binding metadata broadens the transaction");
-
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::SubjectMismatch
-        }
-    ));
-}
-
-#[test]
-fn subject_access_classification_requires_citizen_client_and_scope() {
-    let config = subject_access_config();
-
-    let classified = classify_subject_access_principal(
-        &config,
-        &oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-    )
-    .expect("citizen client and scope classify");
-    assert!(classified.is_subject_access());
-
-    let missing_scope = classify_subject_access_principal(
-        &config,
-        &oidc_principal(Some("client_id:citizen-portal"), &[]),
-    )
-    .expect_err("citizen client without scope fails closed");
-    assert!(matches!(
-        missing_scope,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::InvalidToken
-        }
-    ));
-
-    let mut no_citizen_client_or_audience =
-        oidc_principal(Some("client_id:other"), &["subject_access"]);
-    no_citizen_client_or_audience
-        .verified_claims
-        .as_mut()
-        .expect("test principal has claims")
-        .audiences
-        .clear();
-    let missing_client = classify_subject_access_principal(&config, &no_citizen_client_or_audience)
-        .expect_err("scope without citizen client or audience fails closed");
-    assert!(matches!(
-        missing_client,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::InvalidToken
-        }
-    ));
-}
-
-#[test]
-fn subject_access_optional_scope_policy_allows_absent_scope_only() {
-    let mut config = subject_access_config();
-    config.scope_policy = SubjectAccessScopePolicy::Optional;
-
-    let no_scope = classify_subject_access_principal(
-        &config,
-        &oidc_principal(Some("client_id:citizen-portal"), &[]),
-    )
-    .expect("optional policy accepts a scoped-out citizen token when no scope claim is present");
-    assert!(no_scope.is_subject_access());
-
-    let wrong_scope = classify_subject_access_principal(
-        &config,
-        &oidc_principal(Some("client_id:citizen-portal"), &["openid"]),
-    )
-    .expect_err("optional policy still rejects a present but insufficient scope claim");
-    assert!(matches!(
-        wrong_scope,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::InvalidToken
-        }
-    ));
-}
-
-#[test]
-fn subject_access_disabled_scope_policy_uses_client_and_audience_only() {
-    let mut config = subject_access_config();
-    config.scope_policy = SubjectAccessScopePolicy::Disabled;
-    config.required_scopes.clear();
-
-    let classified = classify_subject_access_principal(
-        &config,
-        &oidc_principal(Some("client_id:citizen-portal"), &[]),
-    )
-    .expect("disabled policy classifies by verified citizen client and audience");
-    assert!(classified.is_subject_access());
-
-    let mut wrong_client = oidc_principal(Some("client_id:other"), &[]);
-    wrong_client
-        .verified_claims
-        .as_mut()
-        .expect("test principal has claims")
-        .audiences
-        .clear();
-    let denied = classify_subject_access_principal(&config, &wrong_client)
-        .expect("non-citizen token remains a machine-client candidate");
-    assert!(!denied.is_subject_access());
-}
-
-#[test]
-fn subject_access_scope_without_verified_claims_fails_closed() {
-    let config = subject_access_config();
-    let principal = EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::ExternalOidc,
-        principal_id: "citizen-subject".to_string(),
-        scopes: vec!["subject_access".to_string()],
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: None,
-    };
-
-    let err = classify_subject_access_principal(&config, &principal)
-        .expect_err("citizen scope without verified claims must not fall back to machine mode");
-
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::InvalidToken
-        }
-    ));
-}
-
-#[test]
-fn subject_access_evaluate_guard_rejects_subject_mismatch() {
-    let config = subject_access_config();
-    let evidence = evidence_config();
-    let principal = classify_subject_access_principal(
-        &config,
-        &oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-    )
-    .expect("citizen principal classifies");
-
-    let err = require_subject_access_evaluate(
-        &evidence,
-        &config,
-        &principal,
-        &evaluate_request("NAT-999"),
-    )
-    .expect_err("mismatched subject must be denied before runtime");
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::SubjectMismatch
-        }
-    ));
-}
-
-#[test]
-fn subject_access_derives_missing_request_identity_from_token_binding() {
-    let config = subject_access_config();
-    let principal = classify_subject_access_principal(
-        &config,
-        &oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-    )
-    .expect("citizen principal classifies");
-    let mut request = EvaluateRequest {
-        requester: None,
-        target: None,
-        relationship: None,
-        on_behalf_of: None,
-        variables: Default::default(),
-        claims: vec![ClaimRef::from("person-is-alive")],
-        disclosure: Some("predicate".to_string()),
-        format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-        purpose: None,
-    };
-
-    derive_subject_access_request_context(&config, &principal, &mut request)
-        .expect("request identity is derived");
-
-    let target_subject = request
-        .target_subject()
-        .expect("derived target maps to subject");
-    assert_eq!(target_subject.id, "NAT-123");
-    assert_eq!(target_subject.id_type.as_deref(), Some("national_id"));
-    assert_eq!(
-        request
-            .requester
-            .as_ref()
-            .and_then(EvidenceEntity::to_subject_request)
-            .expect("derived requester maps to subject")
-            .id,
-        "NAT-123"
-    );
-    assert_eq!(
-        request
-            .relationship
-            .as_ref()
-            .map(|relationship| relationship.relationship_type.as_str()),
-        Some("self")
-    );
-}
-
-#[test]
-fn subject_access_derivation_rejects_conflicting_request_identity() {
-    let config = subject_access_config();
-    let principal = classify_subject_access_principal(
-        &config,
-        &oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-    )
-    .expect("citizen principal classifies");
-    let mut request = evaluate_request("NAT-999");
-
-    let err = derive_subject_access_request_context(&config, &principal, &mut request)
-        .expect_err("conflicting target must be denied before runtime");
-
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::SubjectMismatch
-        }
-    ));
-}
-
-#[test]
-fn subject_access_prepare_pins_claim_purpose_and_metadata() {
-    let config = subject_access_config();
-    let evidence = evidence_config();
-    let principal = classify_subject_access_principal(
-        &config,
-        &fresh_oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-    )
-    .expect("citizen principal classifies");
-    let state = RegistryNotaryApiState::new_with_subject_access(
-        Arc::new(evidence.clone()),
-        Arc::new(config),
-        AuditKeyHasher::unkeyed_dev_only(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    );
-
-    let context = prepare_subject_access_evaluate(
-        &state,
-        &evidence,
-        &principal,
-        &evaluate_request("NAT-123"),
-    )
-    .expect("subject-access evaluate context prepares");
-
-    assert_eq!(context.purpose, "citizen_subject_access");
-    assert_eq!(context.metadata.access_mode, AccessMode::SubjectBound);
-    assert_eq!(context.metadata.subject_id_type.as_str(), "national_id");
-    assert!(context.metadata.policy_hash.is_some());
-    assert!(
-        context.metadata.evaluation_expires_at.is_some(),
-        "subject-access evaluation must carry its capped expiry"
-    );
-    assert!(matches!(
-        context.evaluation_capability,
-        EvaluationCapability::SubjectBound { .. }
-    ));
-}
-
-#[test]
-fn credential_issuance_can_evaluate_internally_without_enabling_public_evaluate() {
-    let mut config = subject_access_config();
-    config.allowed_operations.evaluate = false;
-    config.allowed_operations.issue_credential = true;
-    let evidence = evidence_config();
-    let principal = classify_subject_access_principal(
-        &config,
-        &fresh_oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-    )
-    .expect("citizen principal classifies");
-    let state = RegistryNotaryApiState::new_with_subject_access(
-        Arc::new(evidence.clone()),
-        Arc::new(config),
-        AuditKeyHasher::unkeyed_dev_only(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    );
-    let request = evaluate_request("NAT-123");
-
-    let public_error = prepare_subject_access_evaluate(&state, &evidence, &principal, &request)
-        .expect_err("the public evaluate operation remains disabled");
-    assert!(matches!(
-        public_error,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::OperationDenied
-        }
-    ));
-
-    prepare_subject_access_credential_evaluation(&state, &evidence, &principal, &request)
-        .expect("credential issuance may run its policy-bound internal evaluation");
-}
-
-#[test]
-fn subject_access_external_standard_at_jwt_uses_scope_without_notary_details() {
-    let config = subject_access_config();
-    let evidence = evidence_config();
-    let mut principal = classify_subject_access_principal(
-        &config,
-        &fresh_oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-    )
-    .expect("citizen principal classifies");
-    let claims = principal
-        .verified_claims
-        .as_mut()
-        .expect("classified principal carries verified claims");
-    claims.issuer = bounded("https://id.example.gov");
-    claims.token_type = Some(bounded(
-        registry_notary_core::tokens::NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-    ));
-    let state = RegistryNotaryApiState::new_with_subject_access(
-        Arc::new(evidence.clone()),
-        Arc::new(config),
-        AuditKeyHasher::unkeyed_dev_only(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    )
-    .with_runtime_config(Arc::new(runtime_config_with_custom_access_token_typ()));
-
-    prepare_subject_access_evaluate(&state, &evidence, &principal, &evaluate_request("NAT-123"))
-        .expect("external standard at+jwt can rely on configured subject-access scope");
-}
-
-#[test]
-fn subject_access_notary_standard_at_jwt_still_requires_transaction_details() {
-    let config = subject_access_config();
-    let evidence = evidence_config();
-    let mut principal = classify_subject_access_principal(
-        &config,
-        &fresh_oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-    )
-    .expect("citizen principal classifies");
-    let claims = principal
-        .verified_claims
-        .as_mut()
-        .expect("classified principal carries verified claims");
-    claims.issuer = bounded("https://notary.example.test");
-    claims.token_type = Some(bounded(
-        registry_notary_core::tokens::NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-    ));
-    let state = RegistryNotaryApiState::new_with_subject_access(
-        Arc::new(evidence.clone()),
-        Arc::new(config),
-        AuditKeyHasher::unkeyed_dev_only(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    )
-    .with_runtime_config(Arc::new(runtime_config_with_custom_access_token_typ()));
-
-    let err = prepare_subject_access_evaluate(
-        &state,
-        &evidence,
-        &principal,
-        &evaluate_request("NAT-123"),
-    )
-    .expect_err("Notary-issued standard at+jwt must carry transaction details");
-
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::OperationDenied
-        }
-    ));
-}
-
-#[test]
-fn delegated_subject_access_derives_requester_and_pins_metadata() {
-    let config = delegated_subject_access_config();
-    let evidence = delegated_evidence_config();
-    let principal = delegated_transaction_principal(&config, &evidence);
-    let state = RegistryNotaryApiState::new_with_subject_access(
-        Arc::new(evidence.clone()),
-        Arc::new(config),
-        delegated_test_audit_hasher(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    );
-    let mut request = delegated_request();
-
-    derive_delegated_subject_access_request_context(
-        &state.subject_access,
-        &evidence,
-        &state.subject_access_rate_keys,
-        &principal,
-        &mut request,
-    )
-    .expect("delegated request context derives");
-    let context = prepare_subject_access_evaluate(&state, &evidence, &principal, &request)
-        .expect("delegated evaluate context prepares");
-
-    assert_eq!(
-        request
-            .requester
-            .as_ref()
-            .and_then(EvidenceEntity::to_subject_request)
-            .expect("requester is derived")
-            .id,
-        "NAT-123"
-    );
-    assert_eq!(
-        request
-            .relationship
-            .as_ref()
-            .map(|relationship| relationship.relationship_type.as_str()),
-        Some("guardian")
-    );
-    assert!(
-        request
-            .on_behalf_of
-            .as_ref()
-            .map(|delegation| delegation.actor.id_hash.starts_with("hmac-sha256:"))
-            .unwrap_or(false),
-        "delegated actor is stored as a keyed hash"
-    );
-    assert_eq!(context.purpose, "dependent_attestation");
-    assert_eq!(
-        context.metadata.access_mode,
-        AccessMode::DelegatedSubjectAccess
-    );
-    assert_eq!(
-        context
-            .metadata
-            .relationship_type
-            .as_ref()
-            .map(ConfigMetadata::as_str),
-        Some("guardian")
-    );
-    assert_eq!(
-        context
-            .metadata
-            .proof_claim_id
-            .as_ref()
-            .map(BoundedClaimId::as_str),
-        Some("guardian-link-established")
-    );
-    assert!(context
-        .metadata
-        .dependent_target_hash
-        .as_ref()
-        .map(|hash| hash.as_str().starts_with("hmac-sha256:"))
-        .unwrap_or(false));
-    assert!(matches!(
-        context.evaluation_capability,
-        EvaluationCapability::DelegatedSubjectAccess { .. }
-    ));
-}
-
-#[test]
-fn delegated_subject_access_rejects_spoofed_requester_context() {
-    let config = delegated_subject_access_config();
-    let evidence = delegated_evidence_config();
-    let principal = delegated_transaction_principal(&config, &evidence);
-    let state = RegistryNotaryApiState::new_with_subject_access(
-        Arc::new(evidence.clone()),
-        Arc::new(config),
-        delegated_test_audit_hasher(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    );
-    let mut request = delegated_request();
-    request.requester = Some(EvidenceEntity::from_subject_request(
-        "Person",
-        SubjectRequest {
-            id: "ATTACKER".to_string(),
-            id_type: Some("national_id".to_string()),
-        },
-    ));
-
-    let err = derive_delegated_subject_access_request_context(
-        &state.subject_access,
-        &evidence,
-        &state.subject_access_rate_keys,
-        &principal,
-        &mut request,
-    )
-    .expect_err("caller-supplied requester must not be trusted");
-
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::DelegatedSubjectNotPermitted
-        }
-    ));
-}
-
-#[test]
-fn delegated_subject_access_canonicalizes_target_to_validated_subject() {
-    let config = delegated_subject_access_config();
-    let evidence = delegated_evidence_config();
-    let principal = delegated_transaction_principal(&config, &evidence);
-    let state = RegistryNotaryApiState::new_with_subject_access(
-        Arc::new(evidence.clone()),
-        Arc::new(config),
-        delegated_test_audit_hasher(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    );
-    // Caller pins the validated subject CHILD-123 via the configured id_type,
-    // but smuggles a false entity type, divergent canonical id (VICTIM-A),
-    // extra identifier, and attribute that the binding hash would never see.
-    let mut request = delegated_request();
-    let target = request
-        .target
-        .as_mut()
-        .expect("delegated target is present");
-    target.entity_type = "Household".to_string();
-    target.id = Some("VICTIM-A".to_string());
-    target
-        .identifiers
-        .push(registry_notary_core::EvidenceIdentifier {
-            scheme: "national_id".to_string(),
-            value: "DIVERGENT-NID".to_string(),
-            issuer: None,
-            country: None,
-        });
-    target
-        .attributes
-        .insert("given_name".to_string(), json!("smuggled"));
-    target.profile = Some("smuggled-profile".to_string());
-
-    derive_delegated_subject_access_request_context(
-        &state.subject_access,
-        &evidence,
-        &state.subject_access_rate_keys,
-        &principal,
-        &mut request,
-    )
-    .expect("delegated request context derives");
-
-    let canonical_target = request.target.as_ref().expect("target survives derivation");
-    assert_eq!(
-        canonical_target.entity_type, "person",
-        "delegation must derive the target type from the selected claim"
-    );
-    // The canonical id field must be collapsed so an arbitrary lookup keyed on
-    // target.id can never read the smuggled VICTIM-A value.
-    assert!(
-        canonical_target.id.is_none(),
-        "divergent canonical id must be dropped"
-    );
-    assert!(
-        canonical_target.attributes.is_empty(),
-        "caller-supplied target attributes must be dropped"
-    );
-    assert!(
-        canonical_target.profile.is_none(),
-        "caller-supplied target profile must be dropped"
-    );
-    // The only surviving identifier is the validated (id_type, id) pair, so
-    // to_subject_request() and every configured lookup path resolve the same
-    // subject.
-    let subject = canonical_target
-        .to_subject_request()
-        .expect("canonical target resolves a subject");
-    assert_eq!(subject.id, "CHILD-123");
-    assert_eq!(subject.id_type.as_deref(), Some("civil_registration_id"));
-
-    let context = request
-        .request_context()
-        .expect("delegated request yields a context");
-    assert_eq!(
-        context.lookup_value("target.identifiers.civil_registration_id"),
-        Some(json!("CHILD-123"))
-    );
-    // The binding-hash projection and the proof/dependent lookups now agree:
-    // no path can observe VICTIM-A or DIVERGENT-NID.
-    assert_eq!(context.lookup_value("target.id"), None);
-    assert_eq!(context.lookup_value("target.identifiers.national_id"), None);
-}
-
-#[test]
-fn delegated_subject_access_requires_transaction_details_to_cover_proof_claim() {
-    let config = delegated_subject_access_config();
-    let evidence = delegated_evidence_config();
-    let mut principal = delegated_transaction_principal(&config, &evidence);
-    principal
-        .authorization_details
-        .as_mut()
-        .expect("delegated details exist")
-        .claims = vec![ClaimRef::with_version("dependent-person-is-alive", "1")];
-    let state = RegistryNotaryApiState::new_with_subject_access(
-        Arc::new(evidence.clone()),
-        Arc::new(config),
-        delegated_test_audit_hasher(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    );
-    let mut request = delegated_request();
-    derive_delegated_subject_access_request_context(
-        &state.subject_access,
-        &evidence,
-        &state.subject_access_rate_keys,
-        &principal,
-        &mut request,
-    )
-    .expect("relationship context still derives");
-
-    let err = prepare_subject_access_evaluate(&state, &evidence, &principal, &request)
-        .expect_err("missing proof claim authorization must fail closed");
-
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::DelegatedClaimDenied
-        }
-    ));
-}
-
-#[test]
-fn delegated_subject_access_requires_transaction_details_target() {
-    let config = delegated_subject_access_config();
-    let evidence = delegated_evidence_config();
-    let mut principal = delegated_transaction_principal(&config, &evidence);
-    principal
-        .authorization_details
-        .as_mut()
-        .expect("delegated details exist")
-        .target = None;
-    let state = RegistryNotaryApiState::new_with_subject_access(
-        Arc::new(evidence.clone()),
-        Arc::new(config),
-        delegated_test_audit_hasher(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    );
-    let mut request = delegated_request();
-    derive_delegated_subject_access_request_context(
-        &state.subject_access,
-        &evidence,
-        &state.subject_access_rate_keys,
-        &principal,
-        &mut request,
-    )
-    .expect("relationship context still derives before target-scoped authorization check");
-
-    let err = prepare_subject_access_evaluate(&state, &evidence, &principal, &request)
-        .expect_err("delegated target must be explicit in authorization_details");
-
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::DelegatedSubjectNotPermitted
-        }
-    ));
-}
-
-#[test]
-fn stored_delegated_subject_access_rechecks_current_authorization_details() {
-    let config = delegated_subject_access_config();
-    let evidence = delegated_evidence_config();
-    let principal = delegated_transaction_principal(&config, &evidence);
-    let state = RegistryNotaryApiState::new_with_subject_access(
-        Arc::new(evidence.clone()),
-        Arc::new(config),
-        delegated_test_audit_hasher(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    );
-    let mut request = delegated_request();
-    derive_delegated_subject_access_request_context(
-        &state.subject_access,
-        &evidence,
-        &state.subject_access_rate_keys,
-        &principal,
-        &mut request,
-    )
-    .expect("delegated request context derives");
-    let context = prepare_subject_access_evaluate(&state, &evidence, &principal, &request)
-        .expect("delegated context prepares");
-    let mut evaluation = evaluation_for_proof();
-    evaluation.client_id = context.metadata.principal_hash.as_str().to_string();
-    evaluation.purpose = context.purpose.clone();
-    evaluation.claim_ids = vec!["dependent-person-is-alive".to_string()];
-    evaluation.claim_refs = request.claims.clone();
-    evaluation.disclosure = context.metadata.disclosure.as_str().to_string();
-    evaluation.format = context.metadata.result_format.as_str().to_string();
-    evaluation.subject_access = Some(context.metadata);
-    let mut narrowed = principal.clone();
-    narrowed
-        .authorization_details
-        .as_mut()
-        .expect("delegated authorization details exist")
-        .claims = vec![ClaimRef::with_version("dependent-person-is-alive", "1")];
-
-    let err = require_subject_access_stored_access(
-        &state,
-        &evidence,
-        &narrowed,
-        &evaluation,
-        &evaluation.claim_ids,
-        &evaluation.disclosure,
-        &evaluation.format,
-        false,
-    )
-    .expect_err("stored delegated access must re-check current proof coverage");
-
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::DelegatedClaimDenied
-        }
-    ));
-}
-
-#[test]
-fn stored_delegated_subject_access_rechecks_current_target_binding() {
-    let config = delegated_subject_access_config();
-    let evidence = delegated_evidence_config();
-    let principal = delegated_transaction_principal(&config, &evidence);
-    let state = RegistryNotaryApiState::new_with_subject_access(
-        Arc::new(evidence.clone()),
-        Arc::new(config),
-        delegated_test_audit_hasher(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    );
-    let mut request = delegated_request();
-    derive_delegated_subject_access_request_context(
-        &state.subject_access,
-        &evidence,
-        &state.subject_access_rate_keys,
-        &principal,
-        &mut request,
-    )
-    .expect("delegated request context derives");
-    let context = prepare_subject_access_evaluate(&state, &evidence, &principal, &request)
-        .expect("delegated context prepares");
-    let mut evaluation = evaluation_for_proof();
-    evaluation.client_id = context.metadata.principal_hash.as_str().to_string();
-    evaluation.purpose = context.purpose.clone();
-    evaluation.claim_ids = vec!["dependent-person-is-alive".to_string()];
-    evaluation.claim_refs = request.claims.clone();
-    evaluation.disclosure = context.metadata.disclosure.as_str().to_string();
-    evaluation.format = context.metadata.result_format.as_str().to_string();
-    evaluation.subject_access = Some(context.metadata);
-    let mut different_target = principal.clone();
-    different_target
-        .authorization_details
-        .as_mut()
-        .and_then(|details| details.target.as_mut())
-        .expect("delegated authorization target exists")
-        .id = "OTHER-CHILD".to_string();
-
-    let err = require_subject_access_stored_access(
-        &state,
-        &evidence,
-        &different_target,
-        &evaluation,
-        &evaluation.claim_ids,
-        &evaluation.disclosure,
-        &evaluation.format,
-        false,
-    )
-    .expect_err("stored delegated access must re-check current target binding");
-
-    assert!(matches!(err, EvidenceError::EvaluationBindingMismatch));
-}
-
-#[test]
-fn stored_delegated_subject_access_accepts_the_committed_target_handle_in_wallet_tokens() {
-    let evidence = delegated_evidence_config();
-    let config = delegated_subject_access_config();
-    let mut principal = delegated_transaction_principal(&config, &evidence);
-    let state = RegistryNotaryApiState::new_with_subject_access(
-        Arc::new(evidence.clone()),
-        Arc::new(config),
-        delegated_test_audit_hasher(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    );
-    let mut request = delegated_request();
-    derive_delegated_subject_access_request_context(
-        &state.subject_access,
-        &evidence,
-        &state.subject_access_rate_keys,
-        &principal,
-        &mut request,
-    )
-    .expect("delegated request context derives");
-    let context = prepare_subject_access_evaluate(&state, &evidence, &principal, &request)
-        .expect("delegated context prepares");
-    let target_handle = context
-        .metadata
-        .dependent_target_hash
-        .as_ref()
-        .expect("target handle exists")
-        .as_str()
-        .to_string();
-    principal
-        .authorization_details
-        .as_mut()
-        .and_then(|details| details.target.as_mut())
-        .expect("delegated authorization target exists")
-        .id = target_handle;
-    let mut evaluation = evaluation_for_proof();
-    evaluation.client_id = context.metadata.principal_hash.as_str().to_string();
-    evaluation.purpose = context.purpose;
-    evaluation.claim_ids = vec!["dependent-person-is-alive".to_string()];
-    evaluation.claim_refs = request.claims;
-    evaluation.disclosure = context.metadata.disclosure.as_str().to_string();
-    evaluation.format = context.metadata.result_format.as_str().to_string();
-    evaluation.subject_access = Some(context.metadata);
-
-    require_subject_access_stored_access(
-        &state,
-        &evidence,
-        &principal,
-        &evaluation,
-        &evaluation.claim_ids,
-        &evaluation.disclosure,
-        &evaluation.format,
-        false,
-    )
-    .expect("the wallet-facing committed handle binds to the stored target");
-}
-
-#[test]
-fn subject_access_token_policy_fails_closed_without_auth_time() {
-    let config = subject_access_config();
-    let mut principal = classify_subject_access_principal(
-        &config,
-        &fresh_oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-    )
-    .expect("citizen principal classifies");
-    principal
-        .verified_claims
-        .as_mut()
-        .expect("test principal has claims")
-        .auth_time = None;
-
-    let err = require_subject_access_token_policy(&config, &principal)
-        .expect_err("missing auth_time fails closed");
-
-    assert!(matches!(err, EvidenceError::SubjectAccessAssuranceDenied));
-}
-
-#[test]
-fn subject_access_token_policy_fails_closed_without_required_acr() {
-    let mut config = subject_access_config();
-    config.token_policy.required_acr_values = vec!["urn:example:loa:substantial".to_string()];
-    let mut principal = classify_subject_access_principal(
-        &config,
-        &fresh_oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-    )
-    .expect("citizen principal classifies");
-    principal
-        .verified_claims
-        .as_mut()
-        .expect("test principal has claims")
-        .acr = None;
-
-    let err = require_subject_access_token_policy(&config, &principal)
-        .expect_err("missing acr fails closed when required");
-
-    assert!(matches!(err, EvidenceError::SubjectAccessAssuranceDenied));
-}
-
-#[test]
-fn subject_access_token_policy_rejects_stale_auth_time() {
-    let config = subject_access_config();
-    let mut principal = classify_subject_access_principal(
-        &config,
-        &fresh_oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-    )
-    .expect("citizen principal classifies");
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    principal
-        .verified_claims
-        .as_mut()
-        .expect("test principal has claims")
-        .auth_time = Some(
-        now - config.token_policy.max_auth_age_seconds as i64
-            - config.token_policy.max_clock_leeway_seconds as i64
-            - 1,
-    );
-
-    let err = require_subject_access_token_policy(&config, &principal)
-        .expect_err("stale auth_time fails closed");
-
-    assert!(matches!(err, EvidenceError::SubjectAccessAssuranceDenied));
-}
-
-#[test]
-fn subject_access_token_policy_rejects_future_iat_and_auth_time() {
-    let config = subject_access_config();
-    let principal = classify_subject_access_principal(
-        &config,
-        &fresh_oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-    )
-    .expect("citizen principal classifies");
-
-    let mut future_auth_time = principal.clone();
-    future_auth_time
-        .verified_claims
-        .as_mut()
-        .expect("test principal has claims")
-        .auth_time = Some(OffsetDateTime::now_utc().unix_timestamp() + 3_600);
-    assert!(matches!(
-        require_subject_access_token_policy(&config, &future_auth_time),
-        Err(EvidenceError::SubjectAccessAssuranceDenied)
-    ));
-
-    let mut future_iat = principal;
-    future_iat
-        .verified_claims
-        .as_mut()
-        .expect("test principal has claims")
-        .iat = Some(OffsetDateTime::now_utc().unix_timestamp() + 3_600);
-    assert!(matches!(
-        require_subject_access_token_policy(&config, &future_iat),
-        Err(EvidenceError::SubjectAccessAssuranceDenied)
-    ));
-}
-
-#[test]
-fn stored_subject_access_rechecks_issuer_client_and_audience() {
-    let config = subject_access_config();
-    let evidence = evidence_config();
-    let principal = classify_subject_access_principal(
-        &config,
-        &fresh_oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-    )
-    .expect("citizen principal classifies");
-    let state = RegistryNotaryApiState::new_with_subject_access(
-        Arc::new(evidence.clone()),
-        Arc::new(config),
-        AuditKeyHasher::unkeyed_dev_only(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    );
-    let context = prepare_subject_access_evaluate(
-        &state,
-        &evidence,
-        &principal,
-        &evaluate_request("NAT-123"),
-    )
-    .expect("subject-access context prepares");
-    let mut evaluation = evaluation_for_proof();
-    evaluation.client_id = principal.principal_id.clone();
-    evaluation.claim_ids = vec!["person-is-alive".to_string()];
-    evaluation.disclosure = "predicate".to_string();
-    evaluation.format = FORMAT_CLAIM_RESULT_JSON.to_string();
-    evaluation.subject_access = Some(context.metadata);
-
-    let mut changed_client = principal.clone();
-    changed_client
-        .verified_claims
-        .as_mut()
-        .expect("test principal has claims")
-        .client_id = Some(bounded("client_id:other-portal"));
-
-    let err = require_subject_access_stored_access(
-        &state,
-        &evidence,
-        &changed_client,
-        &evaluation,
-        &evaluation.claim_ids,
-        &evaluation.disclosure,
-        &evaluation.format,
-        false,
-    )
-    .expect_err("changed client id must not access stored evaluation");
-
-    assert!(matches!(err, EvidenceError::EvaluationBindingMismatch));
-}
-
-#[test]
-fn stored_subject_access_rejects_expired_metadata_even_with_future_store_ttl() {
-    let config = subject_access_config();
-    let evidence = evidence_config();
-    let principal = classify_subject_access_principal(
-        &config,
-        &fresh_oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-    )
-    .expect("citizen principal classifies");
-    let state = RegistryNotaryApiState::new_with_subject_access(
-        Arc::new(evidence.clone()),
-        Arc::new(config),
-        AuditKeyHasher::unkeyed_dev_only(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    );
-    let mut context = prepare_subject_access_evaluate(
-        &state,
-        &evidence,
-        &principal,
-        &evaluate_request("NAT-123"),
-    )
-    .expect("subject-access context prepares");
-    context.metadata.evaluation_expires_at = Some("1970-01-01T00:00:00Z".to_string());
-    let mut evaluation = evaluation_for_proof();
-    evaluation.client_id = context.metadata.principal_hash.as_str().to_string();
-    evaluation.claim_ids = vec!["person-is-alive".to_string()];
-    evaluation.disclosure = "predicate".to_string();
-    evaluation.format = FORMAT_CLAIM_RESULT_JSON.to_string();
-    evaluation.expires_at = "2999-01-01T00:00:00Z".to_string();
-    evaluation.subject_access = Some(context.metadata);
-
-    let err = require_subject_access_stored_access(
-        &state,
-        &evidence,
-        &principal,
-        &evaluation,
-        &evaluation.claim_ids,
-        &evaluation.disclosure,
-        &evaluation.format,
-        false,
-    )
-    .expect_err("expired subject-access metadata must fail closed");
-
-    assert!(matches!(err, EvidenceError::EvaluationNotFound));
-}
-
-#[test]
-fn subject_access_public_problem_codes_remain_generic() {
-    assert_eq!(
-        EvidenceError::SubjectAccessInvalidToken.code(),
-        "subject_access.denied"
-    );
-    assert_eq!(
-        EvidenceError::SubjectAccessInvalidToken.audit_code(),
-        "subject_access.invalid_token"
-    );
-    assert_eq!(
-        evidence_status(&EvidenceError::SubjectAccessInvalidToken),
-        StatusCode::UNAUTHORIZED
-    );
-    assert_eq!(
-        EvidenceError::SubjectAccessAssuranceDenied.code(),
-        "subject_access.denied"
-    );
-    assert_eq!(
-        EvidenceError::SubjectAccessAssuranceDenied.audit_code(),
-        "subject_access.assurance_denied"
-    );
-    assert_eq!(
-        evidence_status(&EvidenceError::SubjectAccessAssuranceDenied),
-        StatusCode::FORBIDDEN
-    );
-}
-
-#[test]
-fn subject_access_policy_hash_includes_credential_profile_policy() {
-    let config = subject_access_config();
-    let mut evidence = evidence_config();
-    evidence.credential_profiles.insert(
-        "civil_status_sd_jwt".to_string(),
-        serde_json::from_value(json!({
-            "format": FORMAT_SD_JWT_VC,
-            "issuer": "did:web:issuer.example",
-            "signing_key": "issuer-key",
-            "vct": "https://issuer.example/credentials/civil-status",
-            "validity_seconds": 600,
-            "holder_binding": {
-                "mode": "did",
-                "proof_of_possession": "required",
-                "allowed_did_methods": ["did:jwk"]
-            },
-            "allowed_claims": ["person-is-alive"],
-            "disclosure": { "allowed": ["predicate"] }
-        }))
-        .expect("profile parses"),
-    );
-    let claims = vec!["person-is-alive".to_string()];
-    let original = subject_access_policy_hash(
-        &evidence,
-        &config,
-        &claims,
-        "predicate",
-        FORMAT_CLAIM_RESULT_JSON,
-    )
-    .expect("policy hashes");
-
-    evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("profile exists")
-        .holder_binding
-        .proof_of_possession = None;
-    let changed = subject_access_policy_hash(
-        &evidence,
-        &config,
-        &claims,
-        "predicate",
-        FORMAT_CLAIM_RESULT_JSON,
-    )
-    .expect("changed policy hashes");
-
-    assert_ne!(original, changed);
-}
-
-#[tokio::test]
-async fn subject_access_batch_evaluate_is_rejected_before_evaluation() {
-    let state = Arc::new(RegistryNotaryApiState::new_with_subject_access(
-        Arc::new(evidence_config()),
-        Arc::new(subject_access_config()),
-        AuditKeyHasher::unkeyed_dev_only(),
-        Arc::new(EvidenceStore::default()),
-        Arc::new(NoopIssuerResolver),
-    ));
-    let request = BatchEvaluateRequest {
-        items: vec![registry_notary_core::BatchEvaluateItemRequest::from(
-            registry_notary_core::BatchSubjectRequest {
-                id: "NAT-123".to_string(),
-                id_type: Some("national_id".to_string()),
-                purpose: None,
-            },
-        )],
-        claims: vec![ClaimRef::from("person-is-alive")],
-        disclosure: Some("predicate".to_string()),
-        format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-        purpose: None,
-    };
-
-    let response = batch_evaluate(
-        HeaderMap::new(),
-        Some(Extension(state)),
-        Some(Extension(oidc_principal(
-            Some("client_id:citizen-portal"),
-            &["subject_access"],
-        ))),
-        None,
-        Ok(Json(request)),
-    )
-    .await;
-
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-    let audit = response
-        .extensions()
-        .get::<EvidenceAuditContext>()
-        .expect("subject-access denial audit context is attached");
-    assert_eq!(audit.access_mode, Some(AccessMode::SubjectBound));
-    assert_eq!(
-        audit.denial_code,
-        Some(SubjectAccessDenialCode::BatchDenied)
-    );
-}
diff --git a/crates/registry-notary-server/src/api/tests/support.rs b/crates/registry-notary-server/src/api/tests/support.rs
deleted file mode 100644
index a67560a3c..000000000
--- a/crates/registry-notary-server/src/api/tests/support.rs
+++ /dev/null
@@ -1,1568 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-    use super::*;
-    use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-    use base64::Engine;
-    use registry_notary_core::{
-        BoundedVerifiedClaims, ClaimEvidenceMode, CredentialStatusConfig,
-        EvidenceAuthorizationDetails, RuleConfig, SubjectRequest, VerifiedClaimName,
-        VerifiedClaimValue,
-    };
-    use registry_platform_crypto::{did_jwk_from_public_jwk, sign, LocalJwkSigner, PrivateJwk};
-    use registry_platform_replay::ReplayInsertOutcome;
-    use registry_platform_testing::sign_openid4vci_proof_jwt;
-    use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
-    use std::sync::{Arc, Barrier, Mutex};
-    use std::thread;
-    use std::time::Instant;
-
-    // Ed25519 keypair: `d` is the seed, `x` is the corresponding public key,
-    // both base64url (no padding). Identical to the key in
-    // registry-notary-core::sd_jwt tests so behavior is consistent.
-    const HOLDER_PRIV_D_B64: &str = "2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw";
-    const HOLDER_PUB_X_B64: &str = "1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc";
-    const ISSUER_PRIV_D_B64: &str = "f4QIxnAyRWzhuBOmNRgvBTE56mWePdsPL0mvCtl8Gys";
-    const ISSUER_PUB_X_B64: &str = "pv4e_hXHBLN27rcs6VDFV1ED0TiU8M3xy9vsuWFEsec";
-    const SUBJECT_BINDING_CLAIM: &str = "https://id.example.gov/claims/national_id";
-
-    fn classifier_config() -> StandaloneRegistryNotaryConfig {
-        serde_json::from_value(json!({
-            "evidence": {
-                "enabled": true
-            },
-            "auth": {
-                "api_keys": [{
-                    "id": "primary-api-key",
-                    "fingerprint": {
-                        "provider": "env",
-                        "name": "PRIMARY_API_KEY_HASH"
-                    },
-                    "scopes": ["claims:read"]
-                }],
-                "bearer_tokens": [{
-                    "id": "primary-bearer-token",
-                    "fingerprint": {
-                        "provider": "env",
-                        "name": "PRIMARY_BEARER_TOKEN_HASH"
-                    },
-                    "scopes": ["claims:write"]
-                }]
-            }
-        }))
-        .expect("classifier config parses")
-    }
-
-    fn holder_did_jwk() -> String {
-        let holder = PrivateJwk::parse(
-            &json!({
-                "kty": "OKP",
-                "crv": "Ed25519",
-                "d": HOLDER_PRIV_D_B64,
-                "x": HOLDER_PUB_X_B64,
-                "alg": "EdDSA"
-            })
-            .to_string(),
-        )
-        .expect("holder JWK parses");
-        did_jwk_from_public_jwk(&holder.public()).expect("did:jwk encodes")
-    }
-
-    fn bounded(value: &str) -> VerifiedClaimValue {
-        VerifiedClaimValue::new(value).expect("test claim value is bounded")
-    }
-
-    fn subject_access_config() -> SubjectAccessConfig {
-        serde_json::from_value(json!({
-            "enabled": true,
-            "subject_binding": {
-                "token_claim": SUBJECT_BINDING_CLAIM,
-                "request_field": "SubjectId",
-                "id_type": "national_id",
-                "normalize": "exact",
-                "allow_sub_as_civil_id": false
-            },
-            "citizen_clients": {
-                "allowed_client_ids": ["citizen-portal"],
-                "allowed_audiences": ["registry-notary-citizen"]
-            },
-            "token_policy": {
-                "required_acr_values": ["urn:example:loa:substantial"],
-                "max_auth_age_seconds": 900,
-                "max_access_token_lifetime_seconds": 900,
-                "max_evaluation_age_seconds": 600,
-                "max_credential_validity_seconds": 600,
-                "max_clock_leeway_seconds": 60
-            },
-            "allowed_operations": {
-                "evaluate": true,
-                "render": true,
-                "issue_credential": true,
-                "batch_evaluate": false
-            },
-            "allowed_purposes": ["citizen_subject_access"],
-            "allowed_claims": ["person-is-alive"],
-            "allowed_formats": [FORMAT_CLAIM_RESULT_JSON],
-            "allowed_disclosures": ["predicate"],
-            "required_scopes": ["subject_access"],
-            "allowed_wallet_origins": ["https://wallet.example.gov"],
-            "credential_profiles": ["civil_status_sd_jwt"],
-            "rate_limits": {
-                "invalid_token_per_client_address_per_minute": 20,
-                "per_principal_per_minute": 10,
-                "subject_mismatch_per_principal_per_hour": 5,
-                "per_holder_per_hour": 10,
-                "credential_issuance_per_principal_per_hour": 5
-            }
-        }))
-        .expect("subject-access config parses")
-    }
-
-    fn evidence_config() -> EvidenceConfig {
-        serde_json::from_value(json!({
-            "enabled": true,
-            "claims": [{
-                "id": "person-is-alive",
-                "title": "Person is alive",
-                "version": "1",
-                "subject_type": "person",
-                "evidence_mode": {
-                    "type": "registry_backed",
-                    "consultations": {
-                        "civil_status": {
-                            "profile": {
-                                "id": "example.civil-status.exact",
-                                "contract_hash": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-                            },
-                            "inputs": { "subject_id": "target.id" }
-                        }
-                    }
-                },
-                "purpose": "citizen_subject_access",
-                "rule": { "type": "consultation_matched", "consultation": "civil_status" },
-                "operations": {
-                    "evaluate": { "enabled": true },
-                    "batch_evaluate": { "enabled": true, "max_subjects": 5 }
-                },
-                "disclosure": {
-                    "default": "predicate",
-                    "allowed": ["predicate"],
-                    "downgrade": "deny"
-                },
-                "formats": [FORMAT_CLAIM_RESULT_JSON]
-            }]
-        }))
-        .expect("evidence config parses")
-    }
-
-    fn delegated_subject_access_config() -> SubjectAccessConfig {
-        let mut config = subject_access_config();
-        config.delegation = registry_notary_core::SubjectAccessDelegationConfig {
-            enabled: true,
-            allowed_relationships: vec![SubjectAccessDelegatedRelationshipConfig {
-                relationship_type: "guardian".to_string(),
-                proof_claim: "guardian-link-established".to_string(),
-                target_id_type: Some("civil_registration_id".to_string()),
-                max_proof_age_seconds: 300,
-                allowed_claims: vec!["dependent-person-is-alive".to_string()],
-                allowed_purposes: vec!["dependent_attestation".to_string()],
-                allowed_formats: vec![FORMAT_CLAIM_RESULT_JSON.to_string()],
-                allowed_disclosures: vec!["predicate".to_string()],
-            }],
-        };
-        config
-    }
-
-    fn delegated_evidence_config() -> EvidenceConfig {
-        serde_json::from_value(json!({
-            "enabled": true,
-            "service_id": "https://notary.example.test",
-            "claims": [
-                {
-                    "id": "guardian-link-established",
-                    "title": "Guardian link is established",
-                    "version": "1",
-                    "subject_type": "relationship",
-                    "evidence_mode": {
-                        "type": "registry_backed",
-                        "consultations": {
-                            "guardian_link": {
-                                "profile": {
-                                    "id": "example.guardian-link.exact",
-                                    "contract_hash": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-                                },
-                                "inputs": {
-                                    "requester_id": "request.requester.identifiers.national_id",
-                                    "target_id": "request.target.identifiers.civil_registration_id"
-                                },
-                                "outputs": {
-                                    "established": { "type": "boolean", "nullable": true }
-                                }
-                            }
-                        }
-                    },
-                    "purpose": "dependent_attestation",
-                    "required_scopes": ["subject_access"],
-                    "value": { "type": "boolean", "nullable": true },
-                    "rule": { "type": "consultation_output", "consultation": "guardian_link", "output": "established" },
-                    "operations": {
-                        "evaluate": { "enabled": true },
-                        "batch_evaluate": { "enabled": false, "max_subjects": 1 }
-                    },
-                    "disclosure": {
-                        "default": "predicate",
-                        "allowed": ["predicate"],
-                        "downgrade": "deny"
-                    },
-                    "formats": [FORMAT_CLAIM_RESULT_JSON]
-                },
-                {
-                    "id": "dependent-person-is-alive",
-                    "title": "Dependent person is alive",
-                    "version": "1",
-                    "subject_type": "person",
-                    "evidence_mode": {
-                        "type": "registry_backed",
-                        "consultations": {
-                            "dependent_status": {
-                                "profile": {
-                                    "id": "example.dependent-status.exact",
-                                    "contract_hash": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
-                                },
-                                "inputs": {
-                                    "subject_id": "request.target.identifiers.civil_registration_id"
-                                }
-                            }
-                        }
-                    },
-                    "purpose": "dependent_attestation",
-                    "depends_on": ["guardian-link-established"],
-                    "rule": {
-                        "type": "consultation_matched",
-                        "consultation": "dependent_status"
-                    },
-                    "operations": {
-                        "evaluate": { "enabled": true },
-                        "batch_evaluate": { "enabled": false, "max_subjects": 1 }
-                    },
-                    "disclosure": {
-                        "default": "predicate",
-                        "allowed": ["predicate"],
-                        "downgrade": "deny"
-                    },
-                    "formats": [FORMAT_CLAIM_RESULT_JSON]
-                }
-            ]
-        }))
-        .expect("delegated evidence config parses")
-    }
-
-    fn delegated_request() -> EvaluateRequest {
-        EvaluateRequest {
-            requester: None,
-            target: Some(EvidenceEntity::from_subject_request(
-                "Person",
-                SubjectRequest {
-                    id: "CHILD-123".to_string(),
-                    id_type: Some("civil_registration_id".to_string()),
-                },
-            )),
-            relationship: None,
-            on_behalf_of: None,
-            variables: Default::default(),
-            claims: vec![ClaimRef::with_version("dependent-person-is-alive", "1")],
-            disclosure: Some("predicate".to_string()),
-            format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-            purpose: None,
-        }
-    }
-
-    fn delegated_authorization_details(evidence: &EvidenceConfig) -> EvidenceAuthorizationDetails {
-        EvidenceAuthorizationDetails {
-            detail_type: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE.to_string(),
-            schema_version: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION
-                    .to_string(),
-            actions: vec!["evaluate".to_string()],
-            locations: vec![evidence.service_id.clone()],
-            claims: vec![
-                ClaimRef::with_version("dependent-person-is-alive", "1"),
-                ClaimRef::with_version("guardian-link-established", "1"),
-            ],
-            disclosure: Some("predicate".to_string()),
-            format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-            purpose: Some("dependent_attestation".to_string()),
-            legal_basis_ref: None,
-            consent_ref: None,
-            jurisdiction: None,
-            assurance_level: None,
-            subject: Some(registry_notary_core::EvidenceAuthorizationSubject {
-                binding_claim: SUBJECT_BINDING_CLAIM.to_string(),
-                id_type: "national_id".to_string(),
-            }),
-            target: Some(registry_notary_core::EvidenceAuthorizationTarget {
-                id_type: "civil_registration_id".to_string(),
-                id: "CHILD-123".to_string(),
-            }),
-            relationship: Some(registry_notary_core::EvidenceAuthorizationRelationship {
-                relationship_type: "guardian".to_string(),
-                proof_claim: "guardian-link-established".to_string(),
-            }),
-            access_mode: Some(AccessMode::DelegatedSubjectAccess),
-            assisted_access_context: None,
-        }
-    }
-
-    fn delegated_transaction_principal(
-        config: &SubjectAccessConfig,
-        evidence: &EvidenceConfig,
-    ) -> EvidencePrincipal {
-        let mut principal = classify_subject_access_principal(
-            config,
-            &fresh_oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-        )
-        .expect("citizen principal classifies");
-        principal.authorization_details = Some(delegated_authorization_details(evidence));
-        principal.access_mode = AccessMode::DelegatedSubjectAccess;
-        principal
-    }
-
-    fn delegated_test_audit_hasher() -> AuditKeyHasher {
-        const ENV: &str = "TEST_DELEGATED_AUDIT_HASH_SECRET";
-        std::env::set_var(ENV, "0123456789abcdef0123456789abcdef");
-        AuditKeyHasher::from_env(ENV).expect("delegated test audit hasher loads")
-    }
-
-    fn oid4vci_config() -> Oid4vciConfig {
-        serde_json::from_value(json!({
-            "enabled": true,
-            "credential_issuer": "http://127.0.0.1:4325",
-            "authorization_servers": ["http://localhost:8088/v1/esignet"],
-            "accepted_token_audiences": ["http://127.0.0.1:4325"],
-            "credential_endpoint": "http://127.0.0.1:4325/oid4vci/credential",
-            "nonce": { "enabled": true, "ttl_seconds": 300 },
-            "display": [{
-                "name": "Civil Registry Notary",
-                "locale": "en-US",
-                "logo": {
-                    "uri": "https://issuer.example/assets/notary-logo.png",
-                    "alt_text": "Civil Registry Notary logo"
-                }
-            }],
-            "credential_configurations": {
-                "person_is_alive_sd_jwt": {
-                    "claim_id": "person-is-alive",
-                    "credential_profile": "civil_status_sd_jwt",
-                    "format": "dc+sd-jwt",
-                    "scope": "person_is_alive",
-                    "vct": "https://issuer.example/credentials/civil-status",
-                    "display_name": "Person is alive",
-                    "display": {
-                        "locale": "en-US",
-                        "description": "Proof that the civil registry currently records this person as alive.",
-                        "background_color": "#0057B8",
-                        "text_color": "#FFFFFF",
-                        "logo": {
-                            "url": "https://issuer.example/assets/person-is-alive.png",
-                            "alt_text": "Person is alive credential logo"
-                        }
-                    }
-                }
-            }
-        }))
-        .expect("oid4vci config parses")
-    }
-
-    fn oid4vci_evidence_config() -> EvidenceConfig {
-        let mut evidence = evidence_config();
-        let claim = evidence.claims.first_mut().expect("claim exists");
-        claim
-            .credential_profiles
-            .push("civil_status_sd_jwt".to_string());
-        evidence.signing_keys.insert(
-            "issuer-key".to_string(),
-            serde_json::from_value(json!({
-                "provider": "local_jwk_env",
-                "private_jwk_env": "ISSUER_KEY",
-                "alg": "EdDSA",
-                "kid": "did:web:issuer.example#key-1",
-                "status": "active"
-            }))
-            .expect("signing key parses"),
-        );
-        evidence.credential_profiles.insert(
-            "civil_status_sd_jwt".to_string(),
-            serde_json::from_value(json!({
-                "format": FORMAT_SD_JWT_VC,
-                "issuer": "did:web:issuer.example",
-                "signing_key": "issuer-key",
-                "vct": "https://issuer.example/credentials/civil-status",
-                "validity_seconds": 600,
-                "holder_binding": {
-                    "mode": "did",
-                    "proof_of_possession": "required",
-                    "allowed_did_methods": ["did:jwk"]
-                },
-                "allowed_claims": ["person-is-alive"],
-                "disclosure": { "allowed": ["predicate"] }
-            }))
-            .expect("credential profile parses"),
-        );
-        evidence
-    }
-
-    fn registry_backed_oid4vci_evidence_config() -> EvidenceConfig {
-        let mut evidence = oid4vci_evidence_config();
-        let claim = evidence.claims.first_mut().expect("claim exists");
-        claim.required_scopes = vec!["subject_access".to_string()];
-        claim.evidence_mode = ClaimEvidenceMode::RegistryBacked {
-            consultations: BTreeMap::from([(
-                "person_status".to_string(),
-                registry_notary_core::RelayConsultationConfig {
-                    profile: registry_notary_core::RelayConsultationProfileRef {
-                        id: "example.person-status.exact".to_string(),
-                        contract_hash:
-                            "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-                                .to_string(),
-                    },
-                    inputs: BTreeMap::from([(
-                        "subject_id".to_string(),
-                        registry_notary_core::RelayConsultationInput::TargetIdentifier(
-                            "request.target.identifiers.national_id".to_string(),
-                        ),
-                    )]),
-                    outputs: BTreeMap::from([(
-                        "active".to_string(),
-                        registry_notary_core::RelayOutputContract::Boolean { nullable: false },
-                    )]),
-                },
-            )]),
-        };
-        claim.rule = RuleConfig::ConsultationMatched {
-            consultation: "person_status".to_string(),
-        };
-        evidence
-    }
-
-    fn registry_backed_oid4vci_evidence_with_dependency() -> EvidenceConfig {
-        let mut evidence = registry_backed_oid4vci_evidence_config();
-        let mut dependency = evidence.claims[0].clone();
-        dependency.id = "civil-record-active".to_string();
-        dependency.title = "Civil record active".to_string();
-        dependency.credential_profiles.clear();
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &mut dependency.evidence_mode
-        else {
-            panic!("dependency is registry backed");
-        };
-        let consultation = consultations
-            .get_mut("person_status")
-            .expect("dependency consultation exists");
-        consultation.profile.id = "example.civil-record.exact".to_string();
-        consultation.profile.contract_hash =
-            "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
-                .to_string();
-        evidence.claims[0].depends_on = vec![dependency.id.clone()];
-        evidence.claims.push(dependency);
-        evidence
-    }
-
-    #[derive(Debug, Default)]
-    struct RegistryCredentialRelay {
-        calls: AtomicUsize,
-        evaluation_ids: Mutex<Vec<String>>,
-    }
-
-    #[async_trait::async_trait]
-    impl crate::runtime::ActivatedRelayConsultations for RegistryCredentialRelay {
-        async fn check_ready(&self) -> Result<(), crate::relay_client::RelayClientError> {
-            Ok(())
-        }
-
-        fn validate(
-            &self,
-            _key: &crate::runtime::consultation::ConsultationGroupKeyV1,
-        ) -> Result<(), crate::relay_client::RelayClientError> {
-            Ok(())
-        }
-
-        async fn execute(
-            &self,
-            key: &crate::runtime::consultation::ConsultationGroupKeyV1,
-        ) -> Result<
-            crate::runtime::consultation::RuntimeRelayConsultationResult,
-            crate::relay_client::RelayClientError,
-        > {
-            self.calls.fetch_add(1, Ordering::SeqCst);
-            self.evaluation_ids
-                .lock()
-                .expect("evaluation id lock is not poisoned")
-                .push(key.evaluation_id().to_string());
-            let outputs = crate::runtime::consultation::RuntimeRelayOutputMap::from_json(
-                BTreeMap::from([("active".to_string(), json!(true))]),
-            )?;
-            crate::runtime::consultation::RuntimeRelayConsultationResult::new(
-                ulid::Ulid::new(),
-                crate::runtime::consultation::RuntimeRelayOutcome::Match,
-                Some(crate::runtime::consultation::RuntimeRelayMatchData::OutputMap(outputs)),
-                OffsetDateTime::now_utc(),
-            )
-        }
-    }
-
-    fn runtime_config_with_custom_access_token_typ() -> StandaloneRegistryNotaryConfig {
-        let mut config = classifier_config();
-        config.auth.access_token_signing.enabled = true;
-        config.auth.access_token_signing.issuer = "https://notary.example.test".to_string();
-        config.auth.access_token_signing.token_typ = "custom-notary-access+jwt".to_string();
-        config
-    }
-
-    fn oidc_principal(client_id: Option<&str>, scopes: &[&str]) -> EvidencePrincipal {
-        EvidencePrincipal {
-            auth_profile_id: registry_notary_core::EvidenceAuthProfileId::ExternalOidc,
-            principal_id: "citizen-subject".to_string(),
-            scopes: scopes.iter().map(|scope| (*scope).to_string()).collect(),
-            access_mode: AccessMode::MachineClient,
-            verified_claims: Some(BoundedVerifiedClaims {
-                issuer: bounded("https://id.example.gov"),
-                audiences: vec![bounded("registry-notary-citizen")],
-                client_id: client_id.map(bounded),
-                token_type: Some(bounded("JWT")),
-                credential_configuration_id: None,
-                issuance_transaction_id: None,
-                issuance_transaction_commitment: None,
-                scopes: scopes.iter().map(|scope| bounded(scope)).collect(),
-                subject: Some(bounded("login-subject")),
-                subject_binding_claim: Some(
-                    VerifiedClaimName::new(SUBJECT_BINDING_CLAIM)
-                        .expect("subject claim name is bounded"),
-                ),
-                subject_binding_value: Some(bounded("NAT-123")),
-                acr: Some(bounded("urn:example:loa:substantial")),
-                auth_time: Some(1_700_000_000),
-                exp: Some(1_700_000_900),
-                iat: Some(1_700_000_000),
-                nbf: None,
-            }),
-            authorization_details: None,
-        }
-    }
-
-    fn fresh_oidc_principal(client_id: Option<&str>, scopes: &[&str]) -> EvidencePrincipal {
-        let mut principal = oidc_principal(client_id, scopes);
-        let now = OffsetDateTime::now_utc().unix_timestamp();
-        let claims = principal
-            .verified_claims
-            .as_mut()
-            .expect("test principal has claims");
-        claims.auth_time = Some(now);
-        claims.iat = Some(now);
-        claims.exp = Some(now + 600);
-        principal
-    }
-
-    fn oid4vci_authorized_principal(
-        evidence: &EvidenceConfig,
-        config: &SubjectAccessConfig,
-        oid4vci: &Oid4vciConfig,
-        configuration_id: &str,
-        scopes: &[&str],
-    ) -> EvidencePrincipal {
-        let mut principal = fresh_oidc_principal(Some("client_id:citizen-portal"), scopes);
-        let configuration = oid4vci
-            .credential_configurations
-            .get(configuration_id)
-            .expect("credential configuration exists");
-        principal.authorization_details = Some(
-            oid4vci_issuance_authorization_details(evidence, config, configuration)
-                .expect("authorization details build"),
-        );
-        principal
-    }
-
-    fn oid4vci_test_preauth_runtime(access_token_typ: &str) -> Arc<PreAuthRuntime> {
-        Arc::new(PreAuthRuntime::for_api_tests(access_token_typ))
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    struct AttemptLimitedAccessTokenSigner {
-        inner: LocalJwkSigner,
-        sign_attempt_count: Arc<AtomicUsize>,
-        allowed_signatures: usize,
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    impl AttemptLimitedAccessTokenSigner {
-        fn new(sign_attempt_count: Arc<AtomicUsize>, allowed_signatures: usize) -> Self {
-            let inner = LocalJwkSigner::new(
-                PrivateJwk::parse(
-                    &json!({
-                        "kty": "OKP",
-                        "crv": "Ed25519",
-                        "d": HOLDER_PRIV_D_B64,
-                        "x": HOLDER_PUB_X_B64,
-                        "alg": "EdDSA",
-                        "kid": "did:web:notary.example#access"
-                    })
-                    .to_string(),
-                )
-                .expect("test access-token JWK parses"),
-            )
-            .expect("test access-token signer builds");
-            Self {
-                inner,
-                sign_attempt_count,
-                allowed_signatures,
-            }
-        }
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    #[async_trait::async_trait]
-    impl SigningProvider for AttemptLimitedAccessTokenSigner {
-        fn algorithm(&self) -> registry_platform_crypto::SigningAlgorithm {
-            self.inner.algorithm()
-        }
-
-        fn key_id(&self) -> &str {
-            self.inner.key_id()
-        }
-
-        fn public_jwk(&self) -> PublicJwk {
-            self.inner.public_jwk()
-        }
-
-        async fn sign(
-            &self,
-            payload: &[u8],
-        ) -> Result<Vec<u8>, registry_platform_crypto::SigningError> {
-            let attempt = self.sign_attempt_count.fetch_add(1, Ordering::SeqCst);
-            if attempt >= self.allowed_signatures {
-                return Err(registry_platform_crypto::SigningError::external(
-                    "test access-token signer capacity exhausted",
-                ));
-            }
-            self.inner.sign(payload).await
-        }
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    fn oid4vci_test_preauth_runtime_with_limited_signer(
-        access_token_typ: &str,
-        sign_attempt_count: Arc<AtomicUsize>,
-        allowed_signatures: usize,
-    ) -> Arc<PreAuthRuntime> {
-        let signer = Arc::new(AttemptLimitedAccessTokenSigner::new(
-            sign_attempt_count,
-            allowed_signatures,
-        ));
-        Arc::new(
-            PreAuthRuntime::for_api_tests(access_token_typ)
-                .with_access_token_signer_for_tests(signer),
-        )
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    struct FirstSigningAttemptGate {
-        entered: tokio::sync::Notify,
-        release: tokio::sync::Notify,
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    impl FirstSigningAttemptGate {
-        fn new() -> Self {
-            Self {
-                entered: tokio::sync::Notify::new(),
-                release: tokio::sync::Notify::new(),
-            }
-        }
-
-        async fn wait_until_entered(&self) {
-            self.entered.notified().await;
-        }
-
-        fn release(&self) {
-            self.release.notify_one();
-        }
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    struct FirstAttemptBlockingAccessTokenSigner {
-        inner: LocalJwkSigner,
-        sign_attempt_count: Arc<AtomicUsize>,
-        gate: Arc<FirstSigningAttemptGate>,
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    impl FirstAttemptBlockingAccessTokenSigner {
-        fn new(
-            sign_attempt_count: Arc<AtomicUsize>,
-            gate: Arc<FirstSigningAttemptGate>,
-        ) -> Self {
-            let inner = LocalJwkSigner::new(
-                PrivateJwk::parse(
-                    &json!({
-                        "kty": "OKP",
-                        "crv": "Ed25519",
-                        "d": HOLDER_PRIV_D_B64,
-                        "x": HOLDER_PUB_X_B64,
-                        "alg": "EdDSA",
-                        "kid": "did:web:notary.example#access"
-                    })
-                    .to_string(),
-                )
-                .expect("test access-token JWK parses"),
-            )
-            .expect("test access-token signer builds");
-            Self {
-                inner,
-                sign_attempt_count,
-                gate,
-            }
-        }
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    #[async_trait::async_trait]
-    impl SigningProvider for FirstAttemptBlockingAccessTokenSigner {
-        fn algorithm(&self) -> registry_platform_crypto::SigningAlgorithm {
-            self.inner.algorithm()
-        }
-
-        fn key_id(&self) -> &str {
-            self.inner.key_id()
-        }
-
-        fn public_jwk(&self) -> PublicJwk {
-            self.inner.public_jwk()
-        }
-
-        async fn sign(
-            &self,
-            payload: &[u8],
-        ) -> Result<Vec<u8>, registry_platform_crypto::SigningError> {
-            let attempt = self.sign_attempt_count.fetch_add(1, Ordering::SeqCst);
-            if attempt == 0 {
-                self.gate.entered.notify_one();
-                self.gate.release.notified().await;
-            }
-            self.inner.sign(payload).await
-        }
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    fn oid4vci_test_preauth_runtime_with_first_signing_attempt_gate(
-        access_token_typ: &str,
-        sign_attempt_count: Arc<AtomicUsize>,
-        gate: Arc<FirstSigningAttemptGate>,
-    ) -> Arc<PreAuthRuntime> {
-        let signer = Arc::new(FirstAttemptBlockingAccessTokenSigner::new(
-            sign_attempt_count,
-            gate,
-        ));
-        Arc::new(
-            PreAuthRuntime::for_api_tests(access_token_typ)
-                .with_access_token_signer_for_tests(signer),
-        )
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    struct FirstAttemptFailingAccessTokenSigner {
-        inner: LocalJwkSigner,
-        sign_attempt_count: Arc<AtomicUsize>,
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    impl FirstAttemptFailingAccessTokenSigner {
-        fn new(sign_attempt_count: Arc<AtomicUsize>) -> Self {
-            let inner = LocalJwkSigner::new(
-                PrivateJwk::parse(
-                    &json!({
-                        "kty": "OKP",
-                        "crv": "Ed25519",
-                        "d": HOLDER_PRIV_D_B64,
-                        "x": HOLDER_PUB_X_B64,
-                        "alg": "EdDSA",
-                        "kid": "did:web:notary.example#access"
-                    })
-                    .to_string(),
-                )
-                .expect("test access-token JWK parses"),
-            )
-            .expect("test access-token signer builds");
-            Self {
-                inner,
-                sign_attempt_count,
-            }
-        }
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    #[async_trait::async_trait]
-    impl SigningProvider for FirstAttemptFailingAccessTokenSigner {
-        fn algorithm(&self) -> registry_platform_crypto::SigningAlgorithm {
-            self.inner.algorithm()
-        }
-
-        fn key_id(&self) -> &str {
-            self.inner.key_id()
-        }
-
-        fn public_jwk(&self) -> PublicJwk {
-            self.inner.public_jwk()
-        }
-
-        async fn sign(
-            &self,
-            payload: &[u8],
-        ) -> Result<Vec<u8>, registry_platform_crypto::SigningError> {
-            if self.sign_attempt_count.fetch_add(1, Ordering::SeqCst) == 0 {
-                return Err(registry_platform_crypto::SigningError::external(
-                    "test first signing attempt failed",
-                ));
-            }
-            self.inner.sign(payload).await
-        }
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    fn oid4vci_test_preauth_runtime_with_first_signing_attempt_failure(
-        access_token_typ: &str,
-        sign_attempt_count: Arc<AtomicUsize>,
-    ) -> Arc<PreAuthRuntime> {
-        let signer = Arc::new(FirstAttemptFailingAccessTokenSigner::new(
-            sign_attempt_count,
-        ));
-        Arc::new(
-            PreAuthRuntime::for_api_tests(access_token_typ)
-                .with_access_token_signer_for_tests(signer),
-        )
-    }
-
-    fn oid4vci_test_audit_hasher() -> AuditKeyHasher {
-        const ENV: &str = "TEST_OID4VCI_AUDIT_HASH_SECRET";
-        std::env::set_var(ENV, "0123456789abcdef0123456789abcdef");
-        AuditKeyHasher::from_env(ENV).expect("OID4VCI test audit hasher loads")
-    }
-
-    struct Oid4vciTestTransaction {
-        principal: EvidencePrincipal,
-        #[cfg(feature = "registry-notary-cel")]
-        transaction: IssuanceTransaction,
-        nonce_scope: ReplayScope,
-        nonce_key: ReplayKey,
-    }
-
-    async fn reserve_registry_backed_oid4vci_test_transaction(
-        state: &RegistryNotaryApiState,
-        preauth: &PreAuthRuntime,
-        configuration_id: &str,
-        nonce: &str,
-    ) -> Oid4vciTestTransaction {
-        let now = OffsetDateTime::now_utc().unix_timestamp();
-        let transaction_id = ulid::Ulid::new().to_string();
-        let bound_subject = BoundSubject {
-            subject: "citizen-subject".to_string(),
-            subject_binding_claim: SUBJECT_BINDING_CLAIM.to_string(),
-            subject_binding_value: "NAT-123".to_string(),
-            client_id: "citizen-portal".to_string(),
-            scopes: vec!["subject_access".to_string()],
-            acr: Some("urn:example:loa:substantial".to_string()),
-            auth_time: Some(now),
-        };
-        let transaction = prepare_registry_backed_issuance_transaction(
-            state,
-            preauth,
-            &bound_subject,
-            configuration_id,
-            &transaction_id,
-            None,
-        )
-        .await
-        .expect("registry-backed issuance transaction prepares");
-        preauth
-            .preauthorization_state()
-            .reserve_issuance_transaction(
-                &transaction_id,
-                transaction.clone(),
-                OffsetDateTime::now_utc() + time::Duration::minutes(10),
-            )
-            .await
-            .expect("issuance transaction reserves");
-        assert!(preauth
-            .preauthorization_state()
-            .bind_transaction_nonce(&transaction_id, &transaction.commitment, nonce.to_string())
-            .await
-            .expect("transaction nonce binds"));
-        let (nonce_scope, nonce_key) =
-            reserve_oid4vci_test_nonce(state, configuration_id, nonce).await;
-
-        let mut principal = oid4vci_authorized_principal(
-            &state.evidence,
-            &state.subject_access,
-            &state.oid4vci,
-            configuration_id,
-            &["subject_access", state.oid4vci.credential_configurations[configuration_id].scope.as_str()],
-        );
-        let claims = principal
-            .verified_claims
-            .as_mut()
-            .expect("test principal has claims");
-        claims.issuer = bounded(preauth.notary_issuer());
-        claims.audiences = preauth
-            .notary_audiences()
-            .iter()
-            .map(|audience| bounded(audience))
-            .collect();
-        claims.token_type = Some(bounded(preauth.access_token_typ()));
-        claims.credential_configuration_id = Some(bounded(configuration_id));
-        claims.issuance_transaction_id = Some(bounded(&transaction_id));
-        claims.issuance_transaction_commitment = Some(bounded(&transaction.commitment));
-
-        Oid4vciTestTransaction {
-            principal,
-            #[cfg(feature = "registry-notary-cel")]
-            transaction,
-            nonce_scope,
-            nonce_key,
-        }
-    }
-
-    async fn reserve_oid4vci_test_nonce(
-        state: &RegistryNotaryApiState,
-        configuration_id: &str,
-        nonce: &str,
-    ) -> (ReplayScope, ReplayKey) {
-        let nonce_key = state
-            .subject_access_rate_keys
-            .oid4vci_nonce(&state.oid4vci.credential_issuer, configuration_id, nonce)
-            .expect("nonce hashes");
-        let nonce_scope = oid4vci_nonce_replay_scope(state, configuration_id).expect("nonce scope");
-        let nonce_key = ReplayKey::new(nonce_key).expect("nonce replay key");
-        state
-            .replay
-            .nonce_store()
-            .reserve_nonce(
-                &nonce_scope,
-                &nonce_key,
-                OffsetDateTime::now_utc() + time::Duration::seconds(60),
-            )
-            .await
-            .expect("nonce reserves");
-        (nonce_scope, nonce_key)
-    }
-
-    fn evaluate_request(subject_id: &str) -> EvaluateRequest {
-        EvaluateRequest {
-            requester: None,
-            target: Some(EvidenceEntity::from_subject_request(
-                "Person",
-                SubjectRequest {
-                    id: subject_id.to_string(),
-                    id_type: Some("national_id".to_string()),
-                },
-            )),
-            relationship: None,
-            on_behalf_of: None,
-            variables: Default::default(),
-            claims: vec![ClaimRef::from("person-is-alive")],
-            disclosure: Some("predicate".to_string()),
-            format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-            purpose: None,
-        }
-    }
-
-    fn transaction_authorization_details(evidence: &EvidenceConfig) -> EvidenceAuthorizationDetails {
-        EvidenceAuthorizationDetails {
-            detail_type: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE.to_string(),
-            schema_version: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION
-                    .to_string(),
-            actions: vec!["evaluate".to_string()],
-            locations: vec![evidence.service_id.clone()],
-            claims: vec![ClaimRef::with_version("person-is-alive", "1")],
-            disclosure: Some("predicate".to_string()),
-            format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-            purpose: Some("citizen_subject_access".to_string()),
-            legal_basis_ref: None,
-            consent_ref: None,
-            jurisdiction: None,
-            assurance_level: None,
-            subject: Some(registry_notary_core::EvidenceAuthorizationSubject {
-                binding_claim: SUBJECT_BINDING_CLAIM.to_string(),
-                id_type: "national_id".to_string(),
-            }),
-            target: None,
-            relationship: None,
-            access_mode: Some(AccessMode::SubjectBound),
-            assisted_access_context: None,
-        }
-    }
-
-    fn classified_transaction_principal(
-        config: &SubjectAccessConfig,
-        evidence: &EvidenceConfig,
-    ) -> EvidencePrincipal {
-        let mut principal = classify_subject_access_principal(
-            config,
-            &fresh_oidc_principal(Some("client_id:citizen-portal"), &["subject_access"]),
-        )
-        .expect("citizen principal classifies");
-        principal.authorization_details = Some(transaction_authorization_details(evidence));
-        principal
-    }
-
-    struct NoopIssuerResolver;
-
-    impl EvidenceIssuerResolver for NoopIssuerResolver {
-        fn issuer(
-            &self,
-            _profile_id: &str,
-        ) -> Result<registry_notary_core::sd_jwt::EvidenceIssuer, EvidenceError> {
-            Err(EvidenceError::CredentialIssuerNotConfigured)
-        }
-    }
-
-    struct TestIssuerResolver;
-
-    impl EvidenceIssuerResolver for TestIssuerResolver {
-        fn issuer(
-            &self,
-            _profile_id: &str,
-        ) -> Result<registry_notary_core::sd_jwt::EvidenceIssuer, EvidenceError> {
-            registry_notary_core::sd_jwt::EvidenceIssuer::from_jwk_str(
-                &issuer_private_jwk(),
-                "did:web:issuer.example#key-1".to_string(),
-            )
-        }
-    }
-
-    struct CountingSigningProvider {
-        inner: LocalJwkSigner,
-        sign_count: Arc<AtomicUsize>,
-    }
-
-    impl CountingSigningProvider {
-        fn new(sign_count: Arc<AtomicUsize>) -> Self {
-            let mut jwk = PrivateJwk::parse(&issuer_private_jwk()).expect("issuer key parses");
-            jwk.kid = Some("did:web:issuer.example#key-1".to_string());
-            let inner = LocalJwkSigner::new(jwk).expect("local signer builds");
-            Self { inner, sign_count }
-        }
-    }
-
-    #[async_trait::async_trait]
-    impl SigningProvider for CountingSigningProvider {
-        fn algorithm(&self) -> registry_platform_crypto::SigningAlgorithm {
-            self.inner.algorithm()
-        }
-
-        fn key_id(&self) -> &str {
-            self.inner.key_id()
-        }
-
-        fn public_jwk(&self) -> PublicJwk {
-            self.inner.public_jwk()
-        }
-
-        async fn sign(
-            &self,
-            payload: &[u8],
-        ) -> Result<Vec<u8>, registry_platform_crypto::SigningError> {
-            self.sign_count.fetch_add(1, Ordering::SeqCst);
-            self.inner.sign(payload).await
-        }
-    }
-
-    struct CountingIssuerResolver {
-        sign_count: Arc<AtomicUsize>,
-    }
-
-    impl EvidenceIssuerResolver for CountingIssuerResolver {
-        fn issuer(
-            &self,
-            _profile_id: &str,
-        ) -> Result<registry_notary_core::sd_jwt::EvidenceIssuer, EvidenceError> {
-            registry_notary_core::sd_jwt::EvidenceIssuer::from_signing_provider(Arc::new(
-                CountingSigningProvider::new(Arc::clone(&self.sign_count)),
-            ))
-        }
-    }
-
-    struct HolderIssuerResolver;
-
-    impl EvidenceIssuerResolver for HolderIssuerResolver {
-        fn issuer(
-            &self,
-            _profile_id: &str,
-        ) -> Result<registry_notary_core::sd_jwt::EvidenceIssuer, EvidenceError> {
-            registry_notary_core::sd_jwt::EvidenceIssuer::from_jwk_str(
-                &holder_private_jwk(),
-                "did:web:issuer.example#key-1".to_string(),
-            )
-        }
-    }
-
-    fn sign_holder_proof(holder_id: &str, payload: Value) -> String {
-        let holder = PrivateJwk::parse(
-            &json!({
-                "kty": "OKP",
-                "crv": "Ed25519",
-                "d": HOLDER_PRIV_D_B64,
-                "x": HOLDER_PUB_X_B64,
-                "alg": "EdDSA",
-                "kid": holder_id,
-            })
-            .to_string(),
-        )
-        .expect("holder JWK parses");
-        let header_b64 = URL_SAFE_NO_PAD.encode(
-            serde_json::to_vec(&json!({
-                "alg": "EdDSA",
-                "typ": "kb+jwt",
-                "kid": holder_id,
-            }))
-            .expect("header serializes"),
-        );
-        let payload_b64 =
-            URL_SAFE_NO_PAD.encode(serde_json::to_vec(&payload).expect("payload serializes"));
-        let signing_input = format!("{header_b64}.{payload_b64}");
-        let signature = sign(signing_input.as_bytes(), &holder).expect("sign holder proof");
-        format!("{signing_input}.{}", URL_SAFE_NO_PAD.encode(signature))
-    }
-
-    fn sign_oid4vci_proof(audience: &str, nonce: &str) -> String {
-        let now = OffsetDateTime::now_utc().unix_timestamp();
-        sign_openid4vci_proof_jwt(&holder_private_jwk(), audience, Some(nonce), now)
-    }
-
-    fn validated_oid4vci_proof(
-        state: &RegistryNotaryApiState,
-        proof: &str,
-        nonce: Option<&str>,
-    ) -> ValidatedProof {
-        validate_proof_jwt(
-            proof,
-            &ProofValidationPolicy::credential_endpoint(
-                &state.oid4vci.credential_issuer,
-                nonce,
-                Duration::from_secs(state.oid4vci.proof.max_age_seconds),
-                Duration::from_secs(state.oid4vci.proof.max_clock_skew_seconds),
-            ),
-            OffsetDateTime::now_utc().unix_timestamp(),
-        )
-        .expect("proof validates")
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    fn sign_oid4vci_proof_without_nonce(audience: &str) -> String {
-        let now = OffsetDateTime::now_utc().unix_timestamp();
-        sign_openid4vci_proof_jwt(&holder_private_jwk(), audience, None, now)
-    }
-
-    fn holder_private_jwk() -> String {
-        json!({
-            "kty": "OKP",
-            "crv": "Ed25519",
-            "d": HOLDER_PRIV_D_B64,
-            "x": HOLDER_PUB_X_B64,
-            "alg": "EdDSA"
-        })
-        .to_string()
-    }
-
-    fn issuer_private_jwk() -> String {
-        json!({
-            "kty": "OKP",
-            "crv": "Ed25519",
-            "d": ISSUER_PRIV_D_B64,
-            "x": ISSUER_PUB_X_B64,
-            "alg": "EdDSA"
-        })
-        .to_string()
-    }
-
-    fn test_federation_runtime(generation: &str) -> Arc<crate::federation::FederationRuntimeState> {
-        let secret_env = format!(
-            "TEST_ATOMIC_FEDERATION_SECRET_{}",
-            generation.to_uppercase()
-        );
-        std::env::set_var(&secret_env, format!("{generation}-pairwise-secret"));
-        let federation: FederationConfig = serde_norway::from_str(&format!(
-            r#"
-enabled: true
-node_id: did:web:{generation}.notary.example
-issuer: https://{generation}.notary.example
-jwks_uri: https://{generation}.notary.example/federation/jwks.json
-federation_api: https://{generation}.notary.example/federation/v1
-supported_protocol_versions:
-  - registry-notary-federation/v0.1
-signing:
-  signing_key: federation-key
-pairwise_subject_hash:
-  secret_env: {secret_env}
-response_shaping:
-  minimum_denial_latency_ms: 1
-peers:
-  - node_id: did:web:peer.{generation}.example
-    issuer: https://peer.{generation}.example
-    jwks_uri: http://127.0.0.1:9/{generation}/jwks.json
-    allow_insecure_localhost: true
-    allowed_protocol_versions:
-      - registry-notary-federation/v0.1
-    allowed_purposes:
-      - https://purpose.example.test/eligibility
-    allowed_profiles:
-      - person_alive
-    evaluation_scopes:
-      - civil_registry:evidence_verification
-evaluation_profiles:
-  - id: person_alive
-    ruleset: person-alive-v1
-    claim_id: person-is-alive
-    subject_id_type: national_id
-"#
-        ))
-        .expect("federation config parses");
-        let signer_jwk = PrivateJwk::parse(
-            &json!({
-                "kty": "OKP",
-                "crv": "Ed25519",
-                "kid": format!("{generation}-federation-key"),
-                "d": ISSUER_PRIV_D_B64,
-                "x": ISSUER_PUB_X_B64,
-                "alg": "EdDSA"
-            })
-            .to_string(),
-        )
-        .expect("federation signer JWK parses");
-        let signer: Arc<dyn SigningProvider> =
-            Arc::new(LocalJwkSigner::new(signer_jwk).expect("federation signer builds"));
-        Arc::new(
-            crate::federation::FederationRuntimeState::from_config(
-                &federation,
-                signer,
-                None,
-                ReplayStores::memory().store(),
-                Arc::new(AppMetrics::default()),
-            )
-            .expect("federation runtime builds"),
-        )
-    }
-
-    fn evaluation_for_proof() -> registry_notary_core::StoredEvaluation {
-        registry_notary_core::StoredEvaluation {
-            client_id: "client".to_string(),
-            purpose: "test".to_string(),
-            claim_ids: vec!["claim-a".to_string()],
-            claim_refs: Vec::new(),
-            disclosure: "redacted".to_string(),
-            format: FORMAT_CLAIM_RESULT_JSON.to_string(),
-            results: Vec::new(),
-            created_at: "1970-01-01T00:00:00Z".to_string(),
-            expires_at: "1970-01-01T00:00:00Z".to_string(),
-            request_hash: "h".to_string(),
-            issuance_provenance: None,
-            subject_access: None,
-        }
-    }
-
-    fn claim_result_view(evaluation_id: &str, claim_id: &str) -> registry_notary_core::ClaimResultView {
-        registry_notary_core::ClaimResultView {
-            evaluation_id: evaluation_id.to_string(),
-            claim_id: claim_id.to_string(),
-            claim_version: "1".to_string(),
-            subject_type: "person".to_string(),
-            requester_ref: None,
-            target_ref: registry_notary_core::TargetRefView {
-                entity_type: "Person".to_string(),
-                handle: "rnref:v1:subject-hash".to_string(),
-                identifier_schemes: Vec::new(),
-                profile: None,
-            },
-            value: Some(json!(true)),
-            satisfied: Some(true),
-            disclosure: "predicate".to_string(),
-            redacted_fields: Vec::new(),
-            format: FORMAT_CLAIM_RESULT_JSON.to_string(),
-            issued_at: "2026-05-23T00:00:00Z".to_string(),
-            expires_at: None,
-            provenance: registry_notary_core::ClaimProvenance::new(
-                "registry-notary".to_string(),
-                evaluation_id.to_string(),
-                claim_id.to_string(),
-                "1".to_string(),
-                registry_notary_core::ProvenanceUsed {
-                    relay_consultation_count: 1,
-                },
-            ),
-        }
-    }
-
-    fn issuance_provenance(
-        claim_id: &str,
-        purpose: &str,
-        evaluation_id: &str,
-    ) -> registry_notary_core::StoredIssuanceProvenance {
-        let mut stored = registry_notary_core::StoredIssuanceProvenance {
-            claims: vec![registry_notary_core::StoredIssuanceClaimProvenance {
-                claim_id: claim_id.to_string(),
-                claim_version: "1".to_string(),
-                relay_profile_id: "example.person-status.exact".to_string(),
-                relay_contract_hash:
-                    "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-                        .to_string(),
-                canonical_purpose: purpose.to_string(),
-                consultation_id: "01J00000000000000000000000".to_string(),
-                execution_binding: String::new(),
-                result_content_binding: String::new(),
-            }],
-            consultations: vec![
-                registry_notary_core::StoredIssuanceConsultationProvenance {
-                    consultation_id: "01J00000000000000000000000".to_string(),
-                    acquired_at: "2026-05-23T00:00:00Z".to_string(),
-                },
-            ],
-            authorization_target_binding: String::new(),
-        };
-        bind_fixture_issuance_claim(&mut stored, 0, evaluation_id, 1);
-        stored
-    }
-
-    fn issuance_provenance_with_dependency(
-        root_claim_id: &str,
-        dependency_claim_id: &str,
-        purpose: &str,
-        evaluation_id: &str,
-    ) -> registry_notary_core::StoredIssuanceProvenance {
-        let mut stored = registry_notary_core::StoredIssuanceProvenance {
-            claims: vec![
-                registry_notary_core::StoredIssuanceClaimProvenance {
-                    claim_id: dependency_claim_id.to_string(),
-                    claim_version: "1".to_string(),
-                    relay_profile_id: "example.civil-record.exact".to_string(),
-                    relay_contract_hash:
-                        "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
-                            .to_string(),
-                    canonical_purpose: purpose.to_string(),
-                    consultation_id: "01J00000000000000000000001".to_string(),
-                    execution_binding: String::new(),
-                    result_content_binding: String::new(),
-                },
-                registry_notary_core::StoredIssuanceClaimProvenance {
-                    claim_id: root_claim_id.to_string(),
-                    claim_version: "1".to_string(),
-                    relay_profile_id: "example.person-status.exact".to_string(),
-                    relay_contract_hash:
-                        "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-                            .to_string(),
-                    canonical_purpose: purpose.to_string(),
-                    consultation_id: "01J00000000000000000000000".to_string(),
-                    execution_binding: String::new(),
-                    result_content_binding: String::new(),
-                },
-            ],
-            consultations: vec![
-                registry_notary_core::StoredIssuanceConsultationProvenance {
-                    consultation_id: "01J00000000000000000000000".to_string(),
-                    acquired_at: "2026-05-23T00:00:00Z".to_string(),
-                },
-                registry_notary_core::StoredIssuanceConsultationProvenance {
-                    consultation_id: "01J00000000000000000000001".to_string(),
-                    acquired_at: "2026-05-23T00:00:00Z".to_string(),
-                },
-            ],
-            authorization_target_binding: String::new(),
-        };
-        bind_fixture_issuance_claim(&mut stored, 0, evaluation_id, 1);
-        bind_fixture_issuance_claim(&mut stored, 1, evaluation_id, 2);
-        stored
-    }
-
-    fn bind_fixture_issuance_claim(
-        stored: &mut registry_notary_core::StoredIssuanceProvenance,
-        claim_index: usize,
-        evaluation_id: &str,
-        relay_consultation_count: usize,
-    ) {
-        let mut result = claim_result_view(evaluation_id, &stored.claims[claim_index].claim_id);
-        result.provenance.used.relay_consultation_count = relay_consultation_count;
-        stored.claims[claim_index].result_content_binding =
-            crate::runtime::issuance_result_content_binding(&result)
-                .expect("fixture result content binding hashes");
-        let claim = &stored.claims[claim_index];
-        let consultation = stored
-            .consultations
-            .iter()
-            .find(|execution| execution.consultation_id == claim.consultation_id)
-            .expect("claim execution exists");
-        let provenance = registry_notary_core::ClaimProvenance::new(
-            "registry-notary".to_string(),
-            evaluation_id.to_string(),
-            claim.claim_id.clone(),
-            claim.claim_version.clone(),
-            registry_notary_core::ProvenanceUsed {
-                relay_consultation_count,
-            },
-        );
-        let binding = crate::runtime::issuance_execution_binding(
-            claim,
-            consultation,
-            evaluation_id,
-            &consultation.acquired_at,
-            &provenance,
-        )
-        .expect("fixture execution binding hashes");
-        stored.claims[claim_index].execution_binding = binding;
-    }
-
-    fn credential_issue_evidence_config() -> EvidenceConfig {
-        let mut evidence = evidence_config();
-        evidence.service_id = "registry-notary".to_string();
-        let claim = evidence
-            .claims
-            .first_mut()
-            .expect("person-is-alive claim exists");
-        claim.purpose = Some("test".to_string());
-        claim.required_scopes = vec!["civil_registry:evidence_verification".to_string()];
-        claim.evidence_mode = ClaimEvidenceMode::RegistryBacked {
-            consultations: BTreeMap::from([(
-                "person_status".to_string(),
-                registry_notary_core::RelayConsultationConfig {
-                    profile: registry_notary_core::RelayConsultationProfileRef {
-                        id: "example.person-status.exact".to_string(),
-                        contract_hash:
-                            "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-                                .to_string(),
-                    },
-                    inputs: BTreeMap::from([(
-                        "subject_id".to_string(),
-                        registry_notary_core::RelayConsultationInput::TargetId,
-                    )]),
-                    outputs: BTreeMap::from([(
-                        "active".to_string(),
-                        registry_notary_core::RelayOutputContract::Boolean { nullable: false },
-                    )]),
-                },
-            )]),
-        };
-        claim.rule = RuleConfig::ConsultationMatched {
-            consultation: "person_status".to_string(),
-        };
-        claim
-            .credential_profiles
-            .push("civil_status_sd_jwt".to_string());
-        evidence.credential_profiles.insert(
-            "civil_status_sd_jwt".to_string(),
-            serde_json::from_value(json!({
-                "format": FORMAT_SD_JWT_VC,
-                "issuer": "did:web:issuer.example",
-                "signing_key": "issuer-key",
-                "vct": "https://issuer.example/credentials/civil-status",
-                "validity_seconds": 600,
-                "allowed_claims": ["person-is-alive"],
-                "disclosure": { "allowed": ["predicate"] }
-            }))
-            .expect("credential profile parses"),
-        );
-        evidence
-    }
-
-    fn credential_issue_evidence_with_dependency() -> EvidenceConfig {
-        let mut evidence = credential_issue_evidence_config();
-        let mut dependency = evidence.claims[0].clone();
-        dependency.id = "civil-record-active".to_string();
-        dependency.title = "Civil record active".to_string();
-        dependency.credential_profiles.clear();
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &mut dependency.evidence_mode
-        else {
-            panic!("dependency is registry backed");
-        };
-        let consultation = consultations
-            .get_mut("person_status")
-            .expect("dependency consultation exists");
-        consultation.profile.id = "example.civil-record.exact".to_string();
-        consultation.profile.contract_hash =
-            "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
-                .to_string();
-        evidence.claims[0].depends_on = vec![dependency.id.clone()];
-        evidence.claims.push(dependency);
-        evidence
-    }
-
-    fn decode_jwt_header(jwt: &str) -> Value {
-        decode_jwt_segment(jwt, 0)
-    }
-
-    fn decode_jwt_payload(jwt: &str) -> Value {
-        decode_jwt_segment(jwt, 1)
-    }
-
-    fn decode_jwt_segment(jwt: &str, index: usize) -> Value {
-        let segment = jwt.split('.').nth(index).expect("jwt segment exists");
-        serde_json::from_slice(
-            &URL_SAFE_NO_PAD
-                .decode(segment)
-                .expect("jwt segment is base64url"),
-        )
-        .expect("jwt segment is JSON")
-    }
-
-    fn issue_request() -> CredentialIssueRequest {
-        CredentialIssueRequest {
-            evaluation_id: "eval-1".to_string(),
-            credential_profile: Some("profile-a".to_string()),
-            format: None,
-            claims: None,
-            disclosure: None,
-            purpose: None,
-            holder: None,
-        }
-    }
-
-    fn holder_required_profile() -> CredentialProfileConfig {
-        serde_json::from_value(json!({
-            "format": FORMAT_SD_JWT_VC,
-            "issuer": "did:web:issuer.example",
-            "signing_key": "issuer-key",
-            "vct": "https://issuer.example/credentials/civil-status",
-            "validity_seconds": 600,
-            "holder_binding": {
-                "mode": "did",
-                "proof_of_possession": "required",
-                "allowed_did_methods": ["did:jwk"]
-            },
-            "allowed_claims": ["claim-a"],
-            "disclosure": { "allowed": ["redacted"] }
-        }))
-        .expect("profile parses")
-    }
-
-    fn proof_payload(holder_id: &str, aud: &str) -> Value {
-        let now = OffsetDateTime::now_utc().unix_timestamp() + 10;
-        json!({
-            "sub": holder_id,
-            "aud": aud,
-            "iat": now,
-            "exp": now + 60,
-            "jti": "jti-1",
-            "evaluation_id": "eval-1",
-            "credential_profile": "profile-a",
-            "disclosure": holder_proof_disclosure("redacted"),
-            "claims": ["claim-a"],
-        })
-    }
-
-    fn windowed_proof_payload(holder_id: &str, aud: &str, iat: i64, exp: i64) -> Value {
-        json!({
-            "sub": holder_id,
-            "aud": aud,
-            "iat": iat,
-            "exp": exp,
-            "jti": "jti-window",
-            "evaluation_id": "eval-1",
-            "credential_profile": "profile-a",
-            "disclosure": holder_proof_disclosure("redacted"),
-            "claims": ["claim-a"],
-        })
-    }
-
-    fn holder_proof_disclosure(disclosure: &str) -> String {
-        URL_SAFE_NO_PAD.encode(Sha256::digest(disclosure.as_bytes()))
-    }
diff --git a/crates/registry-notary-server/src/authz_details.rs b/crates/registry-notary-server/src/authz_details.rs
deleted file mode 100644
index 68a48ef03..000000000
--- a/crates/registry-notary-server/src/authz_details.rs
+++ /dev/null
@@ -1,448 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Shared authorization_details enforcement for Notary transaction scopes.
-
-use registry_notary_core::{
-    AccessMode, ClaimRef, EvidenceAuthorizationDetails, EvidenceAuthorizationSubject,
-    EvidenceAuthorizationTarget, EvidenceError,
-};
-use serde_json::Value;
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum ScopedAuthorizationError {
-    DetailType,
-    Action,
-    Location,
-    Claim,
-    Disclosure,
-    Format,
-    Purpose,
-    AccessMode,
-    Subject,
-    Target,
-}
-
-pub(crate) struct ScopedAuthorizationSubject {
-    pub(crate) binding_claim: String,
-    pub(crate) id_type: String,
-}
-
-pub(crate) struct ScopedAuthorizationTarget {
-    pub(crate) id_type: String,
-    pub(crate) id: String,
-}
-
-pub(crate) struct ScopedAuthorizationRequest<'a> {
-    pub(crate) service_id: &'a str,
-    pub(crate) action: &'a str,
-    pub(crate) claims: &'a [ClaimRef],
-    pub(crate) disclosure: &'a str,
-    pub(crate) format: &'a str,
-    pub(crate) purpose: &'a str,
-    pub(crate) access_mode: AccessMode,
-    pub(crate) subject: Option<ScopedAuthorizationSubject>,
-    pub(crate) target: Option<ScopedAuthorizationTarget>,
-    pub(crate) allow_subset_claims: bool,
-    pub(crate) allowed_claims: Option<&'a [ClaimRef]>,
-}
-
-pub(crate) fn extract_notary_transaction_authorization_details(
-    raw: &Value,
-) -> Result<Option<EvidenceAuthorizationDetails>, EvidenceError> {
-    let details = raw.as_array().ok_or(EvidenceError::MissingCredential)?;
-    let mut matched = None;
-    for detail in details {
-        let Some(object) = detail.as_object() else {
-            continue;
-        };
-        let type_matches = object.get("type").and_then(Value::as_str)
-            == Some(registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE);
-        let schema_matches = object.get("schema_version").and_then(Value::as_str)
-            == Some(registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION);
-        if !type_matches && !schema_matches {
-            continue;
-        }
-        if !type_matches || !schema_matches || matched.is_some() {
-            return Err(EvidenceError::MissingCredential);
-        }
-        matched = Some(
-            serde_json::from_value::<EvidenceAuthorizationDetails>(detail.clone())
-                .map_err(|_| EvidenceError::MissingCredential)?,
-        );
-    }
-    Ok(matched)
-}
-
-pub(crate) fn has_transaction_scope(details: &EvidenceAuthorizationDetails) -> bool {
-    !details.actions.is_empty()
-        || !details.locations.is_empty()
-        || !details.claims.is_empty()
-        || details.disclosure.is_some()
-        || details.format.is_some()
-        || details.purpose.is_some()
-        || details.subject.is_some()
-        || details.target.is_some()
-        || details.relationship.is_some()
-        || details.access_mode.is_some()
-        || details.assisted_access_context.is_some()
-}
-
-pub(crate) fn validate_scoped_authorization_details(
-    details: &EvidenceAuthorizationDetails,
-    expected: &ScopedAuthorizationRequest<'_>,
-) -> Result<(), ScopedAuthorizationError> {
-    if details.detail_type != registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE
-        || details.schema_version
-            != registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION
-    {
-        return Err(ScopedAuthorizationError::DetailType);
-    }
-    if !exact_single(&details.actions, expected.action) {
-        return Err(ScopedAuthorizationError::Action);
-    }
-    if !exact_single(&details.locations, expected.service_id) {
-        return Err(ScopedAuthorizationError::Location);
-    }
-    let claims_match = if expected.allow_subset_claims {
-        unique_claim_refs(&details.claims)
-            && unique_claim_refs(expected.claims)
-            && expected
-                .claims
-                .iter()
-                .all(|expected_claim| details.claims.contains(expected_claim))
-            && expected.allowed_claims.is_some_and(|allowed_claims| {
-                unique_claim_refs(allowed_claims)
-                    && details
-                        .claims
-                        .iter()
-                        .all(|detail_claim| allowed_claims.contains(detail_claim))
-            })
-    } else {
-        exact_unique_claim_ref_set(&details.claims, expected.claims)
-    };
-    if !claims_match {
-        return Err(ScopedAuthorizationError::Claim);
-    }
-    if details.disclosure.as_deref() != Some(expected.disclosure) {
-        return Err(ScopedAuthorizationError::Disclosure);
-    }
-    if details.format.as_deref() != Some(expected.format) {
-        return Err(ScopedAuthorizationError::Format);
-    }
-    if details.purpose.as_deref() != Some(expected.purpose) {
-        return Err(ScopedAuthorizationError::Purpose);
-    }
-    if details.access_mode != Some(expected.access_mode) {
-        return Err(ScopedAuthorizationError::AccessMode);
-    }
-    if !subject_matches(details.subject.as_ref(), expected.subject.as_ref()) {
-        return Err(ScopedAuthorizationError::Subject);
-    }
-    if !target_matches(details.target.as_ref(), expected.target.as_ref()) {
-        return Err(ScopedAuthorizationError::Target);
-    }
-    Ok(())
-}
-
-pub(crate) fn exact_unique_claim_ref_set(left: &[ClaimRef], right: &[ClaimRef]) -> bool {
-    left.len() == right.len()
-        && unique_claim_refs(left)
-        && unique_claim_refs(right)
-        && left.iter().all(|claim| right.contains(claim))
-}
-
-pub(crate) fn exact_unique_string_set(left: &[String], right: &[String]) -> bool {
-    left.len() == right.len()
-        && left
-            .iter()
-            .enumerate()
-            .all(|(position, value)| !left[..position].contains(value) && right.contains(value))
-        && right
-            .iter()
-            .enumerate()
-            .all(|(position, value)| !right[..position].contains(value))
-}
-
-fn unique_claim_refs(claims: &[ClaimRef]) -> bool {
-    claims
-        .iter()
-        .enumerate()
-        .all(|(position, claim)| !claims[..position].contains(claim))
-}
-
-fn exact_single(values: &[String], expected: &str) -> bool {
-    values.len() == 1 && values[0] == expected
-}
-
-fn subject_matches(
-    actual: Option<&EvidenceAuthorizationSubject>,
-    expected: Option<&ScopedAuthorizationSubject>,
-) -> bool {
-    match (actual, expected) {
-        (Some(actual), Some(expected)) => {
-            actual.binding_claim == expected.binding_claim && actual.id_type == expected.id_type
-        }
-        (None, None) => true,
-        _ => false,
-    }
-}
-
-fn target_matches(
-    actual: Option<&EvidenceAuthorizationTarget>,
-    expected: Option<&ScopedAuthorizationTarget>,
-) -> bool {
-    match expected {
-        Some(expected) => actual
-            .is_some_and(|actual| actual.id_type == expected.id_type && actual.id == expected.id),
-        None => true,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use registry_notary_core::{EvidenceAssistedAccessContext, EvidenceAuthorizationRelationship};
-
-    fn claim(id: &str) -> ClaimRef {
-        ClaimRef::with_version(id, "1")
-    }
-
-    fn details(claims: Vec<ClaimRef>) -> EvidenceAuthorizationDetails {
-        EvidenceAuthorizationDetails {
-            detail_type: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE
-                .to_string(),
-            schema_version:
-                registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION
-                    .to_string(),
-            actions: vec!["evaluate".to_string()],
-            locations: vec!["https://notary.example.test".to_string()],
-            claims,
-            disclosure: Some("predicate".to_string()),
-            format: Some("application/vnd.registry-notary.claim-result+json".to_string()),
-            purpose: Some("citizen_subject_access".to_string()),
-            legal_basis_ref: None,
-            consent_ref: None,
-            jurisdiction: None,
-            assurance_level: None,
-            subject: Some(EvidenceAuthorizationSubject {
-                binding_claim: "national_id".to_string(),
-                id_type: "national_id".to_string(),
-            }),
-            target: None,
-            relationship: None,
-            access_mode: Some(AccessMode::SubjectBound),
-            assisted_access_context: None,
-        }
-    }
-
-    fn context_only_details() -> EvidenceAuthorizationDetails {
-        EvidenceAuthorizationDetails {
-            detail_type: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE
-                .to_string(),
-            schema_version:
-                registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION
-                    .to_string(),
-            legal_basis_ref: Some("demo:casework".to_string()),
-            consent_ref: Some("demo:consent".to_string()),
-            jurisdiction: Some("ZZ".to_string()),
-            assurance_level: Some("substantial".to_string()),
-            ..EvidenceAuthorizationDetails::default()
-        }
-    }
-
-    fn request<'a>(
-        claims: &'a [ClaimRef],
-        allow_subset_claims: bool,
-        allowed_claims: Option<&'a [ClaimRef]>,
-    ) -> ScopedAuthorizationRequest<'a> {
-        ScopedAuthorizationRequest {
-            service_id: "https://notary.example.test",
-            action: "evaluate",
-            claims,
-            disclosure: "predicate",
-            format: "application/vnd.registry-notary.claim-result+json",
-            purpose: "citizen_subject_access",
-            access_mode: AccessMode::SubjectBound,
-            subject: Some(ScopedAuthorizationSubject {
-                binding_claim: "national_id".to_string(),
-                id_type: "national_id".to_string(),
-            }),
-            target: None,
-            allow_subset_claims,
-            allowed_claims,
-        }
-    }
-
-    #[test]
-    fn context_only_authorization_details_are_not_transaction_scoped() {
-        let mut details = context_only_details();
-
-        assert!(!has_transaction_scope(&details));
-
-        details.actions = vec!["evaluate".to_string()];
-        assert!(has_transaction_scope(&details));
-    }
-
-    #[test]
-    fn every_transaction_scope_field_marks_authorization_details_as_transaction_scoped() {
-        let mut details = context_only_details();
-        details.locations = vec!["https://notary.example.test".to_string()];
-        assert!(has_transaction_scope(&details));
-
-        let mut details = context_only_details();
-        details.claims = vec![claim("person-is-alive")];
-        assert!(has_transaction_scope(&details));
-
-        let mut details = context_only_details();
-        details.disclosure = Some("predicate".to_string());
-        assert!(has_transaction_scope(&details));
-
-        let mut details = context_only_details();
-        details.format = Some("application/vnd.registry-notary.claim-result+json".to_string());
-        assert!(has_transaction_scope(&details));
-
-        let mut details = context_only_details();
-        details.purpose = Some("citizen_subject_access".to_string());
-        assert!(has_transaction_scope(&details));
-
-        let mut details = context_only_details();
-        details.subject = Some(EvidenceAuthorizationSubject {
-            binding_claim: "national_id".to_string(),
-            id_type: "national_id".to_string(),
-        });
-        assert!(has_transaction_scope(&details));
-
-        let mut details = context_only_details();
-        details.target = Some(EvidenceAuthorizationTarget {
-            id_type: "national_id".to_string(),
-            id: "NID-1001".to_string(),
-        });
-        assert!(has_transaction_scope(&details));
-
-        let mut details = context_only_details();
-        details.relationship = Some(EvidenceAuthorizationRelationship {
-            relationship_type: "parent_or_guardian".to_string(),
-            proof_claim: "caregiver-link".to_string(),
-        });
-        assert!(has_transaction_scope(&details));
-
-        let mut details = context_only_details();
-        details.access_mode = Some(AccessMode::MachineClient);
-        assert!(has_transaction_scope(&details));
-
-        let mut details = context_only_details();
-        details.assisted_access_context = Some(EvidenceAssistedAccessContext {
-            channel: "assisted-service-desk".to_string(),
-        });
-        assert!(has_transaction_scope(&details));
-    }
-
-    #[test]
-    fn subset_claims_allow_per_claim_validation_against_multi_claim_token() {
-        let claim_a = claim("person-is-alive");
-        let claim_b = claim("address-is-current");
-        let token_details = details(vec![claim_a.clone(), claim_b]);
-        let expected_claims = [claim_a];
-        let allowed_claims = token_details.claims.clone();
-
-        validate_scoped_authorization_details(
-            &token_details,
-            &request(&expected_claims, true, Some(&allowed_claims)),
-        )
-        .expect("single claim is covered by multi-claim transaction token");
-    }
-
-    #[test]
-    fn exact_claim_validation_rejects_subset_and_subset_rejects_missing_claim() {
-        let claim_a = claim("person-is-alive");
-        let claim_b = claim("address-is-current");
-        let token_details = details(vec![claim_a.clone(), claim_b]);
-        let expected_claims = [claim_a];
-
-        assert_eq!(
-            validate_scoped_authorization_details(
-                &token_details,
-                &request(&expected_claims, false, None),
-            ),
-            Err(ScopedAuthorizationError::Claim)
-        );
-
-        let missing_claim = [claim("income-is-below-threshold")];
-        assert_eq!(
-            validate_scoped_authorization_details(
-                &token_details,
-                &request(&missing_claim, true, Some(&token_details.claims)),
-            ),
-            Err(ScopedAuthorizationError::Claim)
-        );
-
-        let request_claims = [expected_claims[0].clone()];
-        assert_eq!(
-            validate_scoped_authorization_details(
-                &token_details,
-                &request(&expected_claims, true, Some(&request_claims)),
-            ),
-            Err(ScopedAuthorizationError::Claim)
-        );
-    }
-
-    #[test]
-    fn exact_claim_validation_treats_order_as_non_authoritative() {
-        let claim_a = claim("person-is-alive");
-        let claim_b = claim("address-is-current");
-        let token_details = details(vec![claim_b.clone(), claim_a.clone()]);
-        let expected_claims = [claim_a, claim_b];
-
-        validate_scoped_authorization_details(
-            &token_details,
-            &request(&expected_claims, false, None),
-        )
-        .expect("authorization claims are an exact set");
-    }
-
-    #[test]
-    fn exact_claim_validation_rejects_duplicates_and_version_substitution() {
-        let claim_a = claim("person-is-alive");
-        let duplicate = details(vec![claim_a.clone(), claim_a.clone()]);
-        assert_eq!(
-            validate_scoped_authorization_details(
-                &duplicate,
-                &request(&[claim_a.clone(), claim_a.clone()], false, None),
-            ),
-            Err(ScopedAuthorizationError::Claim)
-        );
-
-        let token_details = details(vec![ClaimRef::with_version("person-is-alive", "2")]);
-        assert_eq!(
-            validate_scoped_authorization_details(
-                &token_details,
-                &request(&[claim_a], false, None),
-            ),
-            Err(ScopedAuthorizationError::Claim)
-        );
-    }
-
-    #[test]
-    fn target_validation_requires_exact_delegated_target() {
-        let claim_a = claim("person-is-alive");
-        let request_claims = [claim_a.clone()];
-        let mut token_details = details(vec![claim_a]);
-        token_details.target = Some(EvidenceAuthorizationTarget {
-            id_type: "civil_registration_id".to_string(),
-            id: "CHILD-123".to_string(),
-        });
-        let mut request = request(&request_claims, false, None);
-        request.target = Some(ScopedAuthorizationTarget {
-            id_type: "civil_registration_id".to_string(),
-            id: "CHILD-123".to_string(),
-        });
-
-        validate_scoped_authorization_details(&token_details, &request)
-            .expect("exact target is accepted");
-
-        token_details.target.as_mut().expect("target is present").id = "OTHER-CHILD".to_string();
-        assert_eq!(
-            validate_scoped_authorization_details(&token_details, &request),
-            Err(ScopedAuthorizationError::Target)
-        );
-    }
-}
diff --git a/crates/registry-notary-server/src/bin/registry_notary_cel_worker.rs b/crates/registry-notary-server/src/bin/registry_notary_cel_worker.rs
deleted file mode 100644
index d09da334c..000000000
--- a/crates/registry-notary-server/src/bin/registry_notary_cel_worker.rs
+++ /dev/null
@@ -1,6 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Registry Notary CEL worker process.
-
-fn main() {
-    registry_notary_server::cel_worker::run_stdio_worker();
-}
diff --git a/crates/registry-notary-server/src/bin/registry_notary_cel_worker_fixture.rs b/crates/registry-notary-server/src/bin/registry_notary_cel_worker_fixture.rs
deleted file mode 100644
index 35841767e..000000000
--- a/crates/registry-notary-server/src/bin/registry_notary_cel_worker_fixture.rs
+++ /dev/null
@@ -1,181 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-#![cfg(feature = "registry-notary-cel")]
-
-use std::env;
-use std::io::{self, BufRead, Write};
-use std::process;
-use std::thread;
-use std::time::Duration;
-
-use registry_notary_server::cel_worker::{
-    CelWorkerRequest, CelWorkerResponse, CelWorkerResponseOutcome, CEL_WORKER_PROTOCOL_V1,
-};
-use serde_json::Value;
-
-fn main() {
-    let startup_mode = env::var("REGISTRY_NOTARY_CEL_WORKER_FIXTURE_STARTUP_MODE").ok();
-    match startup_mode.as_deref() {
-        Some("sleep") => loop {
-            thread::sleep(Duration::from_secs(60));
-        },
-        Some("wrong_protocol") => {
-            let mut stdout = io::stdout();
-            serde_json::to_writer(&mut stdout, &serde_json::json!({ "ready": true }))
-                .expect("write wrong-protocol startup response");
-            stdout
-                .write_all(b"\n")
-                .expect("write wrong-protocol startup newline");
-            stdout
-                .flush()
-                .expect("flush wrong-protocol startup response");
-        }
-        Some("crash") => process::exit(7),
-        _ => {}
-    }
-    let stdin = io::stdin();
-    let mut stdout = io::stdout();
-    let mut stderr = io::stderr();
-    let mut startup_probe_count = 0_u64;
-
-    for line in stdin.lock().lines() {
-        let line = match line {
-            Ok(line) => line,
-            Err(_) => process::exit(2),
-        };
-        let request = match serde_json::from_str::<CelWorkerRequest>(&line) {
-            Ok(request) => request,
-            Err(_) => {
-                write_response(&mut stdout, None, None, Some("invalid_request"));
-                continue;
-            }
-        };
-        if request.protocol != CEL_WORKER_PROTOCOL_V1 {
-            write_response(
-                &mut stdout,
-                request.policy_hash.as_deref(),
-                None,
-                Some("invalid_request"),
-            );
-            continue;
-        }
-
-        match request.expression.as_str() {
-            "true" => {
-                startup_probe_count = startup_probe_count.saturating_add(1);
-                let probe_value = startup_mode.as_deref() != Some("reject_repeated_probe")
-                    || startup_probe_count == 1;
-                write_response(
-                    &mut stdout,
-                    request.policy_hash.as_deref(),
-                    Some(Value::Bool(probe_value)),
-                    None,
-                );
-                if startup_mode.as_deref() == Some("reply_then_exit") {
-                    process::exit(0);
-                }
-            }
-            "fixture.hang" => loop {
-                thread::sleep(Duration::from_secs(60));
-            },
-            "fixture.big_stdout" => {
-                let bytes = request
-                    .root_bindings
-                    .get("stdout_bytes")
-                    .and_then(Value::as_u64)
-                    .unwrap_or(1024) as usize;
-                let _ = stdout.write_all(vec![b'x'; bytes].as_slice());
-                let _ = stdout.write_all(b"\n");
-                let _ = stdout.flush();
-            }
-            "fixture.stderr_then_crash" => {
-                let secret = request
-                    .root_bindings
-                    .get("secret")
-                    .and_then(Value::as_str)
-                    .unwrap_or("fixture-secret");
-                let bytes = request
-                    .root_bindings
-                    .get("stderr_bytes")
-                    .and_then(Value::as_u64)
-                    .unwrap_or(1024) as usize;
-                let mut written = 0_usize;
-                while written < bytes {
-                    let chunk = secret.as_bytes();
-                    let remaining = bytes - written;
-                    let size = remaining.min(chunk.len());
-                    let _ = stderr.write_all(&chunk[..size]);
-                    written += size;
-                }
-                let _ = stderr.flush();
-                process::exit(7);
-            }
-            "fixture.env" => {
-                let mut values = serde_json::Map::new();
-                for key in request
-                    .root_bindings
-                    .get("env_keys")
-                    .and_then(Value::as_array)
-                    .into_iter()
-                    .flatten()
-                    .filter_map(Value::as_str)
-                {
-                    values.insert(
-                        key.to_string(),
-                        env::var(key).map_or(Value::Null, Value::String),
-                    );
-                }
-                write_response(
-                    &mut stdout,
-                    request.policy_hash.as_deref(),
-                    Some(Value::Object(values)),
-                    None,
-                );
-            }
-            "fixture.value" => {
-                write_response(
-                    &mut stdout,
-                    request.policy_hash.as_deref(),
-                    Some(
-                        request
-                            .root_bindings
-                            .get("value")
-                            .cloned()
-                            .unwrap_or(Value::Null),
-                    ),
-                    None,
-                );
-            }
-            _ => write_response(
-                &mut stdout,
-                request.policy_hash.as_deref(),
-                None,
-                Some("evaluate"),
-            ),
-        }
-    }
-}
-
-fn write_response(
-    stdout: &mut io::Stdout,
-    policy_hash: Option<&str>,
-    value: Option<Value>,
-    error: Option<&str>,
-) {
-    let outcome = match (value, error) {
-        (Some(value), None) => CelWorkerResponseOutcome::Success { value },
-        (None, Some(error)) => CelWorkerResponseOutcome::Error {
-            error: error.to_string(),
-        },
-        _ => panic!("fixture response must be exactly one of success or error"),
-    };
-    let response = CelWorkerResponse {
-        protocol: CEL_WORKER_PROTOCOL_V1.to_string(),
-        policy_hash: policy_hash.map(str::to_string),
-        outcome,
-    };
-    serde_json::to_writer(&mut *stdout, &response).expect("write fixture response");
-    stdout
-        .write_all(b"\n")
-        .expect("write fixture response newline");
-    stdout.flush().expect("flush fixture response");
-}
diff --git a/crates/registry-notary-server/src/cel_worker.rs b/crates/registry-notary-server/src/cel_worker.rs
deleted file mode 100644
index 090b4e852..000000000
--- a/crates/registry-notary-server/src/cel_worker.rs
+++ /dev/null
@@ -1,761 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Hardened CEL worker client and line protocol.
-
-use std::collections::BTreeSet;
-use std::ffi::OsString;
-use std::io::{self, BufRead, Write};
-use std::path::{Path, PathBuf};
-use std::process;
-use std::sync::{
-    atomic::{AtomicBool, Ordering},
-    Arc,
-};
-use std::time::{Duration, Instant};
-
-use crosswalk_core::{
-    MappingRuntime, RuntimeOptions, SecurityLimits, StandaloneEvalError, StandaloneExpressionInput,
-};
-use registry_notary_core::RegistryNotaryCelConfig;
-use registry_notary_worker_harness::{
-    WorkerCommand, WorkerError, WorkerPool, WorkerPoolConfig, WorkerPoolSnapshot,
-    WorkerStartupProbe,
-};
-use serde::{Deserialize, Serialize};
-use serde_json::Value;
-use sha2::{Digest, Sha256};
-use thiserror::Error;
-use tokio::sync::OnceCell;
-
-use crate::{digest::hex_encode, metrics::AppMetrics};
-
-pub const CEL_WORKER_PROTOCOL_V1: &str = "registry-notary-cel-worker/v1";
-pub const CEL_WORKER_REQUEST_ENVELOPE_BYTES: usize = 4096;
-pub const CEL_WORKER_MAX_STDIN_BYTES: usize =
-    1024 * 1024 + 256 * 1024 + CEL_WORKER_REQUEST_ENVELOPE_BYTES;
-
-#[derive(Clone, Debug)]
-pub struct CelWorkerConfig {
-    pub command: PathBuf,
-    pub command_args: Vec<OsString>,
-    pub command_envs: Vec<(OsString, OsString)>,
-    pub current_dir: Option<PathBuf>,
-    pub forbidden_env_names: BTreeSet<OsString>,
-    pub max_workers: usize,
-    pub startup_timeout: Duration,
-    pub request_timeout: Duration,
-    pub max_request_bytes: usize,
-    pub max_response_bytes: usize,
-    pub max_stderr_bytes: usize,
-    pub max_memory_bytes: Option<u64>,
-    pub allow_regex: bool,
-    pub limits: CelWorkerLimits,
-}
-
-impl CelWorkerConfig {
-    #[must_use]
-    pub fn for_current_exe_subcommand() -> Self {
-        let mut forbidden_env_names = BTreeSet::new();
-        for name in [
-            "REGISTRY_NOTARY_PKCS11_PIN",
-            "REGISTRY_NOTARY_PKCS11_USER_PIN",
-            "REGISTRY_NOTARY_HSM_PIN",
-            "REGISTRY_NOTARY_API_KEY",
-            "REGISTRY_NOTARY_BEARER_TOKEN",
-            "REGISTRY_NOTARY_SOURCE_TOKEN",
-            "REGISTRY_NOTARY_SOURCE_CREDENTIAL_JSON",
-            "REGISTRY_NOTARY_DCI_CLIENT_SECRET",
-            "REGISTRY_NOTARY_AUDIT_HASH_SECRET",
-        ] {
-            forbidden_env_names.insert(OsString::from(name));
-        }
-        let (command, command_args) = default_worker_command();
-        Self {
-            command,
-            command_args,
-            command_envs: Vec::new(),
-            current_dir: None,
-            forbidden_env_names,
-            max_workers: 2,
-            startup_timeout: Duration::from_secs(10),
-            request_timeout: Duration::from_secs(2),
-            max_request_bytes: 64 * 1024,
-            max_response_bytes: 16 * 1024,
-            max_stderr_bytes: 1024,
-            max_memory_bytes: Some(128 * 1024 * 1024),
-            allow_regex: false,
-            limits: CelWorkerLimits::default(),
-        }
-    }
-
-    #[must_use]
-    pub fn from_standalone_config(config: &RegistryNotaryCelConfig) -> Self {
-        let mut worker = Self::for_current_exe_subcommand();
-        worker.max_workers = config.worker_count;
-        worker.request_timeout = Duration::from_millis(config.eval_timeout_ms);
-        worker.max_request_bytes = config
-            .max_binding_json_bytes
-            .saturating_add(config.max_expression_bytes)
-            .saturating_add(CEL_WORKER_REQUEST_ENVELOPE_BYTES);
-        worker.max_response_bytes = config
-            .max_result_json_bytes
-            .saturating_add(2048)
-            .max(config.max_result_json_bytes);
-        worker.max_stderr_bytes = config.worker_stderr_bytes;
-        worker.max_memory_bytes = Some(config.worker_memory_bytes);
-        worker.allow_regex = config.allow_regex;
-        worker.limits = CelWorkerLimits::from(config);
-        worker
-    }
-}
-
-pub struct CelWorker {
-    config: Arc<CelWorkerConfig>,
-    pool: OnceCell<WorkerPool>,
-    activated: AtomicBool,
-    metrics: Option<Arc<AppMetrics>>,
-}
-
-impl std::fmt::Debug for CelWorker {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("CelWorker").finish_non_exhaustive()
-    }
-}
-
-impl CelWorker {
-    #[must_use]
-    pub fn lazy(config: CelWorkerConfig) -> Self {
-        Self {
-            config: Arc::new(config),
-            pool: OnceCell::new(),
-            activated: AtomicBool::new(false),
-            metrics: None,
-        }
-    }
-
-    #[must_use]
-    pub(crate) fn with_metrics(mut self, metrics: Arc<AppMetrics>) -> Self {
-        self.metrics = Some(metrics);
-        self
-    }
-
-    pub async fn new(config: CelWorkerConfig) -> Result<Self, CelWorkerError> {
-        let worker = Self::lazy(config);
-        worker.activate().await?;
-        Ok(worker)
-    }
-
-    pub async fn activate(&self) -> Result<(), CelWorkerError> {
-        match self.pool().await {
-            Ok(pool) => {
-                let snapshot = pool.snapshot().await;
-                self.record_snapshot(&snapshot);
-                let ready = pool.check_ready().await;
-                self.activated.store(ready, Ordering::Release);
-                if ready {
-                    self.record_startup(true);
-                    Ok(())
-                } else {
-                    self.record_startup(false);
-                    Err(CelWorkerError::Unavailable)
-                }
-            }
-            Err(_) => {
-                self.activated.store(false, Ordering::Release);
-                self.record_startup(false);
-                Err(CelWorkerError::Unavailable)
-            }
-        }
-    }
-
-    #[must_use]
-    pub fn is_activated(&self) -> bool {
-        self.activated.load(Ordering::Acquire)
-    }
-
-    async fn pool(&self) -> Result<&WorkerPool, CelWorkerError> {
-        self.pool
-            .get_or_try_init(|| async {
-                WorkerPool::new(worker_pool_config((*self.config).clone()))
-                    .await
-                    .map_err(CelWorkerError::Harness)
-            })
-            .await
-    }
-
-    pub fn validate_config(&self) -> Result<(), CelWorkerError> {
-        if command_requires_existing_path(&self.config.command) && !self.config.command.is_file() {
-            return Err(CelWorkerError::Harness(WorkerError::InvalidConfig {
-                reason: "worker command path must exist",
-            }));
-        }
-        worker_pool_config((*self.config).clone())
-            .validate()
-            .map_err(CelWorkerError::Harness)
-    }
-
-    pub async fn evaluate(
-        &self,
-        expression: &str,
-        root_bindings: Value,
-    ) -> Result<Value, CelWorkerError> {
-        let started_at = Instant::now();
-        let policy_hash = cel_policy_hash(expression);
-        let request = CelWorkerRequest {
-            protocol: CEL_WORKER_PROTOCOL_V1.to_string(),
-            expression: expression.to_string(),
-            policy_hash: Some(policy_hash.clone()),
-            allow_regex: self.config.allow_regex,
-            limits: self.config.limits.clone(),
-            root_bindings,
-        };
-        let pool = match self.pool().await {
-            Ok(pool) => pool,
-            Err(error) => {
-                self.record_startup(false);
-                self.record_evaluation(&error, started_at.elapsed());
-                return Err(error);
-            }
-        };
-        let value = match pool.execute_json(request).await {
-            Ok(value) => value,
-            Err(error) => {
-                let error = CelWorkerError::Harness(error);
-                self.record_evaluation(&error, started_at.elapsed());
-                return Err(error);
-            }
-        };
-        let snapshot = pool.snapshot().await;
-        self.record_snapshot(&snapshot);
-        let response = match serde_json::from_value::<CelWorkerResponse>(value) {
-            Ok(response) => response,
-            Err(_) => {
-                let error = CelWorkerError::Protocol;
-                self.record_evaluation(&error, started_at.elapsed());
-                return Err(error);
-            }
-        };
-        if response.protocol != CEL_WORKER_PROTOCOL_V1 {
-            let error = CelWorkerError::Protocol;
-            self.record_evaluation(&error, started_at.elapsed());
-            return Err(error);
-        }
-        if response.policy_hash.as_deref() != Some(policy_hash.as_str()) {
-            let error = CelWorkerError::Protocol;
-            self.record_evaluation(&error, started_at.elapsed());
-            return Err(error);
-        }
-        let result = match response.outcome {
-            CelWorkerResponseOutcome::Success { value } => {
-                self.record_evaluation_success(started_at.elapsed());
-                return Ok(value);
-            }
-            CelWorkerResponseOutcome::Error { error } => match error.as_str() {
-                "compile" => Err(CelWorkerError::Compile),
-                "evaluate" => Err(CelWorkerError::Evaluate),
-                "invalid_request" => Err(CelWorkerError::Protocol),
-                _ => Err(CelWorkerError::Protocol),
-            },
-        };
-        if let Err(error) = &result {
-            self.record_evaluation(error, started_at.elapsed());
-        }
-        result
-    }
-
-    pub async fn snapshot(&self) -> Result<WorkerPoolSnapshot, CelWorkerError> {
-        let snapshot = self.pool().await?.snapshot().await;
-        self.record_snapshot(&snapshot);
-        Ok(snapshot)
-    }
-
-    pub async fn check_ready(&self) -> bool {
-        let Some(pool) = self.pool.get() else {
-            return false;
-        };
-        let ready = pool.check_ready().await;
-        let snapshot = pool.snapshot().await;
-        self.record_snapshot(&snapshot);
-        ready
-    }
-
-    fn record_evaluation_success(&self, duration: Duration) {
-        if let Some(metrics) = &self.metrics {
-            metrics.record_cel_evaluation("success", duration.as_millis() as u64);
-        }
-    }
-
-    fn record_evaluation(&self, error: &CelWorkerError, duration: Duration) {
-        if let Some(metrics) = &self.metrics {
-            metrics.record_cel_evaluation(error.metric_outcome(), duration.as_millis() as u64);
-        }
-    }
-
-    fn record_snapshot(&self, snapshot: &WorkerPoolSnapshot) {
-        if let Some(metrics) = &self.metrics {
-            metrics.set_cel_worker_pool("max", snapshot.max_workers as u64);
-            metrics.set_cel_worker_pool("idle", snapshot.idle_workers as u64);
-            metrics.set_cel_worker_pool("warming", snapshot.warming_workers as u64);
-            metrics.set_cel_worker_pool("in_flight", snapshot.in_flight as u64);
-            metrics.set_cel_worker_pool("replacements_total", snapshot.replacements_total);
-            metrics.set_cel_worker_pool("circuit_open", u64::from(snapshot.circuit_open));
-        }
-    }
-
-    fn record_startup(&self, ready: bool) {
-        if let Some(metrics) = &self.metrics {
-            metrics.set_cel_worker_pool("startup_ready", u64::from(ready));
-            metrics.set_cel_worker_pool("startup_failed", u64::from(!ready));
-        }
-    }
-}
-
-#[must_use]
-pub fn cel_policy_hash(expression: &str) -> String {
-    format!(
-        "sha256:{}",
-        hex_encode(&Sha256::digest(expression.as_bytes()))
-    )
-}
-
-fn worker_pool_config(config: CelWorkerConfig) -> WorkerPoolConfig {
-    let startup_probe = cel_startup_probe(&config);
-    let mut command = WorkerCommand::new(config.command);
-    for arg in config.command_args {
-        command = command.arg(arg);
-    }
-    for (key, value) in config.command_envs {
-        command = command.env(key, value);
-    }
-    if let Some(current_dir) = config.current_dir {
-        command = command.current_dir(current_dir);
-    }
-    WorkerPoolConfig {
-        command,
-        forbidden_env_names: config.forbidden_env_names,
-        max_workers: config.max_workers,
-        startup_probe: Some(startup_probe),
-        startup_timeout: config.startup_timeout,
-        request_timeout: config.request_timeout,
-        max_request_bytes: config.max_request_bytes,
-        max_stdout_bytes: config.max_response_bytes,
-        max_stderr_bytes: config.max_stderr_bytes,
-        max_memory_bytes: config.max_memory_bytes,
-        replacement_window: Duration::from_secs(60),
-        max_replacements_per_window: config.max_workers.saturating_mul(4).max(4),
-        circuit_breaker_cooldown: Duration::from_secs(30),
-    }
-}
-
-fn cel_startup_probe(config: &CelWorkerConfig) -> WorkerStartupProbe {
-    let expression = "true";
-    let policy_hash = cel_policy_hash(expression);
-    let request = CelWorkerRequest {
-        protocol: CEL_WORKER_PROTOCOL_V1.to_string(),
-        expression: expression.to_string(),
-        policy_hash: Some(policy_hash.clone()),
-        allow_regex: config.allow_regex,
-        limits: config.limits.clone(),
-        root_bindings: Value::Object(serde_json::Map::new()),
-    };
-    let response = CelWorkerResponse {
-        protocol: CEL_WORKER_PROTOCOL_V1.to_string(),
-        policy_hash: Some(policy_hash),
-        outcome: CelWorkerResponseOutcome::Success {
-            value: Value::Bool(true),
-        },
-    };
-    WorkerStartupProbe {
-        request: serde_json::to_value(request)
-            .expect("CEL startup probe request must serialize to JSON"),
-        expected_response: serde_json::to_value(response)
-            .expect("CEL startup probe response must serialize to JSON"),
-    }
-}
-
-fn default_worker_command() -> (PathBuf, Vec<OsString>) {
-    if let Some(command) = std::env::var_os("REGISTRY_NOTARY_CEL_WORKER_COMMAND") {
-        return (PathBuf::from(command), Vec::new());
-    }
-    let current_exe = std::env::current_exe().unwrap_or_else(|_| PathBuf::from("registry-notary"));
-    if let Some(sibling) = sibling_worker_binary(&current_exe) {
-        return (sibling, Vec::new());
-    }
-    (current_exe, vec![OsString::from("cel-worker")])
-}
-
-fn command_requires_existing_path(command: &Path) -> bool {
-    command.is_absolute() || command.components().count() > 1
-}
-
-fn sibling_worker_binary(current_exe: &Path) -> Option<PathBuf> {
-    let parent = current_exe.parent()?;
-    for candidate_parent in [Some(parent), parent.parent()].into_iter().flatten() {
-        let candidate = candidate_parent.join("registry-notary-cel-worker");
-        if candidate.is_file() {
-            return Some(candidate);
-        }
-    }
-    None
-}
-
-#[derive(Debug, Error)]
-pub enum CelWorkerError {
-    #[error("CEL worker is unavailable")]
-    Unavailable,
-    #[error("CEL worker harness failed")]
-    Harness(#[source] WorkerError),
-    #[error("CEL worker protocol mismatch")]
-    Protocol,
-    #[error("CEL expression did not compile")]
-    Compile,
-    #[error("CEL expression evaluation failed")]
-    Evaluate,
-}
-
-impl CelWorkerError {
-    fn metric_outcome(&self) -> &'static str {
-        match self {
-            Self::Unavailable => "worker_unavailable",
-            Self::Harness(WorkerError::Saturated { .. }) => "saturated",
-            Self::Harness(WorkerError::CircuitOpen { .. }) => "circuit_open",
-            Self::Harness(WorkerError::Timeout { .. }) => "timeout",
-            Self::Harness(WorkerError::StartupTimeout { .. }) => "startup_timeout",
-            Self::Harness(WorkerError::RequestTooLarge { .. }) => "request_too_large",
-            Self::Harness(WorkerError::StdoutTooLarge { .. }) => "output_too_large",
-            Self::Harness(WorkerError::InvalidOutput { .. }) | Self::Protocol => "protocol_error",
-            Self::Harness(WorkerError::StartupProbeFailed { .. }) => "startup_probe_error",
-            Self::Harness(
-                WorkerError::InvalidConfig { .. }
-                | WorkerError::Encode { .. }
-                | WorkerError::Spawn { .. }
-                | WorkerError::WorkerExited { .. }
-                | WorkerError::Io { .. },
-            ) => "worker_error",
-            Self::Compile => "compile_error",
-            Self::Evaluate => "evaluate_error",
-        }
-    }
-}
-
-#[derive(Serialize, Deserialize)]
-pub struct CelWorkerRequest {
-    pub protocol: String,
-    pub expression: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub policy_hash: Option<String>,
-    #[serde(default)]
-    pub allow_regex: bool,
-    #[serde(default)]
-    pub limits: CelWorkerLimits,
-    pub root_bindings: Value,
-}
-
-#[derive(Serialize, Deserialize)]
-pub struct CelWorkerResponse {
-    pub protocol: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub policy_hash: Option<String>,
-    #[serde(flatten)]
-    pub outcome: CelWorkerResponseOutcome,
-}
-
-#[derive(Serialize, Deserialize)]
-#[serde(tag = "status", rename_all = "snake_case")]
-pub enum CelWorkerResponseOutcome {
-    Success { value: Value },
-    Error { error: String },
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct CelWorkerLimits {
-    pub max_expression_bytes: usize,
-    pub max_binding_json_bytes: usize,
-    pub max_output_json_bytes: usize,
-    pub max_list_len: usize,
-    pub max_string_bytes: usize,
-    pub max_object_depth: usize,
-    pub max_object_keys: usize,
-}
-
-impl Default for CelWorkerLimits {
-    fn default() -> Self {
-        Self::from(&RegistryNotaryCelConfig::default())
-    }
-}
-
-impl From<&RegistryNotaryCelConfig> for CelWorkerLimits {
-    fn from(config: &RegistryNotaryCelConfig) -> Self {
-        Self {
-            max_expression_bytes: config.max_expression_bytes,
-            max_binding_json_bytes: config.max_binding_json_bytes,
-            max_output_json_bytes: config.max_result_json_bytes,
-            max_list_len: config.max_list_items,
-            max_string_bytes: config.max_string_bytes,
-            max_object_depth: config.max_object_depth,
-            max_object_keys: config.max_object_keys,
-        }
-    }
-}
-
-impl From<&CelWorkerLimits> for SecurityLimits {
-    fn from(limits: &CelWorkerLimits) -> Self {
-        Self {
-            max_expression_bytes: limits.max_expression_bytes,
-            max_output_json_bytes: limits.max_output_json_bytes,
-            max_list_len: limits.max_list_len,
-            max_string_bytes: limits.max_string_bytes,
-            ..SecurityLimits::default()
-        }
-    }
-}
-
-pub fn run_stdio_worker() {
-    let stdin = io::stdin();
-    let mut stdin = stdin.lock();
-    let mut stdout = io::stdout();
-    let mut line = Vec::new();
-
-    loop {
-        line.clear();
-        match read_worker_stdin_frame(&mut stdin, &mut line) {
-            Ok(Some(())) => {}
-            Ok(None) => break,
-            Err(_) => process::exit(2),
-        }
-        let response = match serde_json::from_slice::<CelWorkerRequest>(line.trim_ascii_end()) {
-            Ok(request) => handle_worker_request(request),
-            Err(_) => CelWorkerResponse {
-                protocol: CEL_WORKER_PROTOCOL_V1.to_string(),
-                policy_hash: None,
-                outcome: CelWorkerResponseOutcome::Error {
-                    error: "invalid_request".to_string(),
-                },
-            },
-        };
-        if serde_json::to_writer(&mut stdout, &response).is_err() {
-            process::exit(2);
-        }
-        if writeln!(stdout).and_then(|_| stdout.flush()).is_err() {
-            process::exit(2);
-        }
-    }
-}
-
-fn read_worker_stdin_frame<R: BufRead>(
-    reader: &mut R,
-    line: &mut Vec<u8>,
-) -> io::Result<Option<()>> {
-    loop {
-        let buffer = reader.fill_buf()?;
-        if buffer.is_empty() {
-            return if line.is_empty() {
-                Ok(None)
-            } else {
-                Ok(Some(()))
-            };
-        }
-
-        let (consumed, payload_bytes) =
-            if let Some(newline) = buffer.iter().position(|byte| *byte == b'\n') {
-                (newline + 1, newline)
-            } else {
-                (buffer.len(), buffer.len())
-            };
-
-        if line.len() + payload_bytes > CEL_WORKER_MAX_STDIN_BYTES {
-            return Err(io::Error::new(
-                io::ErrorKind::InvalidData,
-                "CEL worker stdin frame exceeds configured limit",
-            ));
-        }
-
-        line.extend_from_slice(&buffer[..consumed]);
-        reader.consume(consumed);
-        if line.last() == Some(&b'\n') {
-            return Ok(Some(()));
-        }
-    }
-}
-
-fn handle_worker_request(request: CelWorkerRequest) -> CelWorkerResponse {
-    if request.protocol != CEL_WORKER_PROTOCOL_V1 {
-        return worker_error(None, "invalid_request");
-    }
-    let policy_hash = cel_policy_hash(&request.expression);
-    if request
-        .policy_hash
-        .as_deref()
-        .is_some_and(|provided| provided != policy_hash)
-    {
-        return worker_error(Some(policy_hash), "invalid_request");
-    }
-    if !request.allow_regex && cel_expression_uses_regex(&request.expression) {
-        return worker_error(Some(policy_hash), "compile");
-    }
-    let security_limits = SecurityLimits::from(&request.limits);
-    if security_limits.check_expr(&request.expression).is_err()
-        || validate_worker_json_limits(&request.root_bindings, &request.limits).is_err()
-    {
-        return worker_error(Some(policy_hash), "invalid_request");
-    }
-    let Value::Object(bindings) = request.root_bindings else {
-        return worker_error(Some(policy_hash), "invalid_request");
-    };
-    let mut runtime = MappingRuntime::new(RuntimeOptions::default());
-    runtime.limits = security_limits;
-    match runtime.evaluate_cel_expression_with_input(
-        &request.expression,
-        StandaloneExpressionInput::new(bindings.into_iter().collect()),
-    ) {
-        Ok(value) => CelWorkerResponse {
-            protocol: CEL_WORKER_PROTOCOL_V1.to_string(),
-            policy_hash: Some(policy_hash),
-            outcome: CelWorkerResponseOutcome::Success { value },
-        },
-        Err(StandaloneEvalError::Compile(_))
-        | Err(StandaloneEvalError::InvalidBindingName { .. }) => {
-            worker_error(Some(policy_hash), "compile")
-        }
-        Err(StandaloneEvalError::Evaluate { .. }) => worker_error(Some(policy_hash), "evaluate"),
-    }
-}
-fn worker_error(policy_hash: Option<String>, error: &str) -> CelWorkerResponse {
-    CelWorkerResponse {
-        protocol: CEL_WORKER_PROTOCOL_V1.to_string(),
-        policy_hash,
-        outcome: CelWorkerResponseOutcome::Error {
-            error: error.to_string(),
-        },
-    }
-}
-
-#[must_use]
-pub fn cel_expression_uses_regex(expression: &str) -> bool {
-    if expression.contains("=~") {
-        return true;
-    }
-    cel_function_calls(expression).into_iter().any(|call| {
-        let final_segment = call.rsplit('.').next().unwrap_or(call.as_str());
-        matches!(
-            final_segment,
-            "matches"
-                | "regex_replace"
-                | "regex_extract"
-                | "text_matches"
-                | "text_regex_replace"
-                | "text_regex_extract"
-                | "validate_matches"
-                | "id_is_valid"
-        )
-    })
-}
-
-fn cel_function_calls(expression: &str) -> Vec<String> {
-    let bytes = expression.as_bytes();
-    let mut calls = Vec::new();
-    let mut index = 0;
-    let mut quote: Option<u8> = None;
-    while index < bytes.len() {
-        let byte = bytes[index];
-        if let Some(active_quote) = quote {
-            if byte == b'\\' {
-                index = index.saturating_add(2);
-                continue;
-            }
-            if byte == active_quote {
-                quote = None;
-            }
-            index += 1;
-            continue;
-        }
-        if matches!(byte, b'\'' | b'"' | b'`') {
-            quote = Some(byte);
-            index += 1;
-            continue;
-        }
-        if !is_cel_identifier_start_byte(byte) {
-            index += 1;
-            continue;
-        }
-        let start = index;
-        index += 1;
-        while index < bytes.len()
-            && (is_cel_identifier_continue_byte(bytes[index]) || bytes[index] == b'.')
-        {
-            index += 1;
-        }
-        let mut lookahead = index;
-        while lookahead < bytes.len() && bytes[lookahead].is_ascii_whitespace() {
-            lookahead += 1;
-        }
-        if bytes.get(lookahead) == Some(&b'(') {
-            calls.push(expression[start..index].to_string());
-        }
-    }
-    calls
-}
-
-fn is_cel_identifier_start_byte(byte: u8) -> bool {
-    byte == b'_' || byte.is_ascii_alphabetic()
-}
-
-fn is_cel_identifier_continue_byte(byte: u8) -> bool {
-    byte == b'_' || byte.is_ascii_alphanumeric()
-}
-
-fn validate_worker_json_limits(value: &Value, limits: &CelWorkerLimits) -> Result<(), ()> {
-    if serialized_json_len(value)? > limits.max_binding_json_bytes {
-        return Err(());
-    }
-    let mut stack = vec![(value, 0_usize)];
-    while let Some((value, depth)) = stack.pop() {
-        if depth > limits.max_object_depth {
-            return Err(());
-        }
-        match value {
-            Value::String(value) if value.len() > limits.max_string_bytes => return Err(()),
-            Value::Array(values) => {
-                if values.len() > limits.max_list_len {
-                    return Err(());
-                }
-                for value in values {
-                    stack.push((value, depth + 1));
-                }
-            }
-            Value::Object(values) => {
-                if values.len() > limits.max_object_keys {
-                    return Err(());
-                }
-                for value in values.values() {
-                    stack.push((value, depth + 1));
-                }
-            }
-            _ => {}
-        }
-    }
-    Ok(())
-}
-
-fn serialized_json_len(value: &Value) -> Result<usize, ()> {
-    struct CountingWriter {
-        count: usize,
-    }
-
-    impl std::io::Write for CountingWriter {
-        fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
-            self.count = self
-                .count
-                .checked_add(buf.len())
-                .ok_or_else(|| std::io::Error::other("serialized JSON length overflow"))?;
-            Ok(buf.len())
-        }
-
-        fn flush(&mut self) -> std::io::Result<()> {
-            Ok(())
-        }
-    }
-
-    let mut writer = CountingWriter { count: 0 };
-    serde_json::to_writer(&mut writer, value).map_err(|_| ())?;
-    Ok(writer.count)
-}
diff --git a/crates/registry-notary-server/src/config_governed.rs b/crates/registry-notary-server/src/config_governed.rs
deleted file mode 100644
index b66acf55c..000000000
--- a/crates/registry-notary-server/src/config_governed.rs
+++ /dev/null
@@ -1,77 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Shared parsing helpers for signed config bundle verification.
-
-use registry_notary_core::{
-    deprecated_config_fields, ConfigTrustConfig, StandaloneRegistryNotaryConfig,
-};
-use registry_platform_config::reject_deprecated_config_fields;
-use serde_json::Value;
-
-#[derive(Clone, Debug)]
-pub struct ConfigGovernanceContext {
-    pub(crate) instance_id: String,
-    pub(crate) environment: String,
-    pub(crate) config_trust: Option<ConfigTrustConfig>,
-}
-
-impl ConfigGovernanceContext {
-    #[must_use]
-    pub fn from_config(config: &StandaloneRegistryNotaryConfig) -> Self {
-        Self {
-            instance_id: config.instance.id.clone(),
-            environment: config.instance.environment.clone(),
-            config_trust: config.config_trust.clone(),
-        }
-    }
-
-    #[must_use]
-    pub fn instance_id(&self) -> &str {
-        &self.instance_id
-    }
-
-    #[must_use]
-    pub fn environment(&self) -> &str {
-        &self.environment
-    }
-
-    #[must_use]
-    pub fn config_trust(&self) -> Option<&ConfigTrustConfig> {
-        self.config_trust.as_ref()
-    }
-}
-
-impl Default for ConfigGovernanceContext {
-    fn default() -> Self {
-        Self {
-            instance_id: "registry-notary-standalone".to_string(),
-            environment: "development".to_string(),
-            config_trust: None,
-        }
-    }
-}
-
-pub fn parse_candidate_config(config_yaml: &str) -> Result<StandaloneRegistryNotaryConfig, String> {
-    let value: Value = serde_norway::from_str(config_yaml)
-        .map_err(|error| format!("candidate config could not be parsed: {error}"))?;
-    reject_deprecated_config_fields(&value, &deprecated_config_fields())
-        .map_err(|error| error.to_string())?;
-    let config: StandaloneRegistryNotaryConfig = serde_norway::from_str(config_yaml)
-        .map_err(|error| format!("candidate config could not be parsed: {error}"))?;
-    config
-        .validate()
-        .map_err(|error| format!("candidate config did not validate: {error}"))?;
-    Ok(config)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn parse_candidate_config_names_deprecated_field_replacements() {
-        let err = parse_candidate_config("audit:\n  max_size_bytes: 10485760\n")
-            .expect_err("deprecated candidate field is rejected");
-
-        assert!(err.contains("audit.max_size_mb"), "unexpected: {err}");
-    }
-}
diff --git a/crates/registry-notary-server/src/credential_status.rs b/crates/registry-notary-server/src/credential_status.rs
deleted file mode 100644
index 273323397..000000000
--- a/crates/registry-notary-server/src/credential_status.rs
+++ /dev/null
@@ -1,882 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Storage-backed SD-JWT VC credential status records.
-
-use std::collections::hash_map::DefaultHasher;
-use std::hash::{Hash, Hasher};
-use std::sync::Arc;
-
-use registry_notary_core::{
-    CredentialStatusConfig, CREDENTIAL_STATUS_EXPIRED, CREDENTIAL_STATUS_REVOKED,
-    CREDENTIAL_STATUS_SUSPENDED, CREDENTIAL_STATUS_VALID,
-};
-use registry_platform_cache::{
-    CacheCompareAndSetOutcome, CacheKey, CacheKeyError, CacheStore, CacheStoreError,
-    InMemoryCacheStore,
-};
-use serde::{Deserialize, Serialize};
-use serde_json::{json, Value};
-use time::format_description::well_known::Rfc3339;
-use time::OffsetDateTime;
-
-use crate::state_plane::{NotaryPostgresStatePlaneReadiness, NotaryStatePlaneHandle};
-
-type CredentialStatusTransitionLock = Arc<tokio::sync::Mutex<()>>;
-type CredentialStatusTransitionLocks = Arc<Vec<CredentialStatusTransitionLock>>;
-const CREDENTIAL_STATUS_TRANSITION_LOCK_STRIPES: usize = 1024;
-
-#[derive(Debug, thiserror::Error)]
-pub enum CredentialStatusStoreError {
-    #[error("credential status record is invalid")]
-    InvalidRecord,
-    #[error("credential status transition is invalid")]
-    InvalidTransition,
-    #[error("credential status key is invalid")]
-    InvalidKey(#[source] CacheKeyError),
-    #[error("credential status store failed")]
-    Store(#[source] CacheStoreError),
-    #[error("credential status record already exists")]
-    DuplicateCredential,
-    #[error("credential status PostgreSQL operation is unavailable")]
-    PostgresUnavailable,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub(crate) struct CredentialStatusRecord {
-    pub credential_id: String,
-    pub issuer: String,
-    pub credential_profile: String,
-    pub status: String,
-    pub issued_at: String,
-    pub expires_at: String,
-    pub updated_at: String,
-    #[serde(skip)]
-    database_effective_status: Option<String>,
-}
-
-impl CredentialStatusRecord {
-    pub(crate) fn effective_status(&self, now: OffsetDateTime) -> String {
-        if let Some(status) = &self.database_effective_status {
-            return status.clone();
-        }
-        if self.status == CREDENTIAL_STATUS_REVOKED {
-            return CREDENTIAL_STATUS_REVOKED.to_string();
-        }
-        let expired = OffsetDateTime::parse(&self.expires_at, &Rfc3339).is_ok_and(|exp| exp <= now);
-        if expired {
-            CREDENTIAL_STATUS_EXPIRED.to_string()
-        } else {
-            self.status.clone()
-        }
-    }
-
-    pub(crate) fn response_body(&self, now: OffsetDateTime) -> Value {
-        json!({
-            "credential_id": self.credential_id,
-            "issuer": self.issuer,
-            "credential_profile": self.credential_profile,
-            "status": self.effective_status(now),
-            "issued_at": self.issued_at,
-            "expires_at": self.expires_at,
-            "updated_at": self.updated_at,
-        })
-    }
-}
-
-#[derive(Clone)]
-pub(crate) struct CredentialStatusStore {
-    enabled: bool,
-    base_url: String,
-    retention_seconds: u64,
-    key_prefix: String,
-    store: Option<Arc<dyn CacheStore>>,
-    state_plane: Option<Arc<NotaryStatePlaneHandle>>,
-    transition_locks: CredentialStatusTransitionLocks,
-}
-
-impl std::fmt::Debug for CredentialStatusStore {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("CredentialStatusStore")
-            .field("enabled", &self.enabled)
-            .field("base_url", &self.base_url)
-            .field("retention_seconds", &self.retention_seconds)
-            .field("key_prefix", &self.key_prefix)
-            .field("store", &self.store.as_ref().map(|_| "<redacted>"))
-            .field("postgresql", &self.state_plane.is_some())
-            .finish()
-    }
-}
-
-impl CredentialStatusStore {
-    pub(crate) fn from_config(config: &CredentialStatusConfig) -> Self {
-        if !config.enabled {
-            return Self::disabled();
-        }
-        Self {
-            enabled: true,
-            base_url: config.base_url.trim_end_matches('/').to_string(),
-            retention_seconds: config.retention_seconds,
-            key_prefix: "registry-notary".to_string(),
-            store: Some(Arc::new(InMemoryCacheStore::new())),
-            state_plane: None,
-            transition_locks: transition_locks(),
-        }
-    }
-
-    pub(crate) fn postgres(
-        config: &CredentialStatusConfig,
-        state_plane: Arc<NotaryStatePlaneHandle>,
-    ) -> Self {
-        Self {
-            enabled: config.enabled,
-            base_url: config.base_url.trim_end_matches('/').to_string(),
-            retention_seconds: config.retention_seconds,
-            key_prefix: "registry-notary".to_string(),
-            store: None,
-            state_plane: Some(state_plane),
-            transition_locks: transition_locks(),
-        }
-    }
-
-    pub(crate) fn disabled() -> Self {
-        Self {
-            enabled: false,
-            base_url: String::new(),
-            retention_seconds: 86_400,
-            key_prefix: "registry-notary".to_string(),
-            store: None,
-            state_plane: None,
-            transition_locks: transition_locks(),
-        }
-    }
-
-    #[cfg(test)]
-    pub(crate) fn with_test_store(
-        config: &CredentialStatusConfig,
-        store: Arc<dyn CacheStore>,
-    ) -> Self {
-        Self {
-            enabled: config.enabled,
-            base_url: config.base_url.trim_end_matches('/').to_string(),
-            retention_seconds: config.retention_seconds,
-            key_prefix: "registry-notary".to_string(),
-            store: Some(store),
-            state_plane: None,
-            transition_locks: transition_locks(),
-        }
-    }
-
-    pub(crate) fn is_enabled(&self) -> bool {
-        self.enabled
-    }
-
-    pub(crate) fn status_claim(&self, credential_id: &str) -> Option<Value> {
-        self.enabled.then(|| {
-            json!({
-                "status_list": {
-                    "idx": 0,
-                    "uri": self.status_url(credential_id),
-                }
-            })
-        })
-    }
-
-    pub(crate) fn status_url(&self, credential_id: &str) -> String {
-        format!("{}/v1/credentials/{}/status", self.base_url, credential_id)
-    }
-
-    pub(crate) async fn record_issued(
-        &self,
-        credential_id: String,
-        issuer: String,
-        credential_profile: String,
-        issued_at: OffsetDateTime,
-        expires_at: OffsetDateTime,
-    ) -> Result<(), CredentialStatusStoreError> {
-        if !self.enabled {
-            return Ok(());
-        }
-        if let Some(state_plane) = &self.state_plane {
-            let runtime = state_plane
-                .runtime()
-                .map_err(|_| CredentialStatusStoreError::PostgresUnavailable)?;
-            let session = runtime
-                .open_domain_session()
-                .await
-                .map_err(|_| CredentialStatusStoreError::PostgresUnavailable)?;
-            let retention_seconds = i32::try_from(self.retention_seconds)
-                .map_err(|_| CredentialStatusStoreError::InvalidRecord)?;
-            let row = session
-                .run_operation(session.client().query_one(
-                    "SELECT registry_notary_api.credential_status_insert_v1(\
-                        $1, $2, $3, $4, $5, $6) AS inserted",
-                    &[
-                        &credential_id,
-                        &issuer,
-                        &credential_profile,
-                        &issued_at,
-                        &expires_at,
-                        &retention_seconds,
-                    ],
-                ))
-                .await
-                .map_err(|_| CredentialStatusStoreError::PostgresUnavailable)?;
-            let inserted = row
-                .try_get::<_, bool>("inserted")
-                .map_err(|_| CredentialStatusStoreError::InvalidRecord)?;
-            return if inserted {
-                Ok(())
-            } else {
-                Err(CredentialStatusStoreError::DuplicateCredential)
-            };
-        }
-        let record = CredentialStatusRecord {
-            credential_id,
-            issuer,
-            credential_profile,
-            status: CREDENTIAL_STATUS_VALID.to_string(),
-            issued_at: format_time(issued_at),
-            expires_at: format_time(expires_at),
-            updated_at: format_time(OffsetDateTime::now_utc()),
-            database_effective_status: None,
-        };
-        self.write_record(&record).await
-    }
-
-    pub(crate) async fn get(
-        &self,
-        credential_id: &str,
-    ) -> Result<Option<CredentialStatusRecord>, CredentialStatusStoreError> {
-        if !self.enabled {
-            return Ok(None);
-        }
-        if let Some(state_plane) = &self.state_plane {
-            let runtime = state_plane
-                .runtime()
-                .map_err(|_| CredentialStatusStoreError::PostgresUnavailable)?;
-            let session = runtime
-                .open_domain_session()
-                .await
-                .map_err(|_| CredentialStatusStoreError::PostgresUnavailable)?;
-            let row = session
-                .run_operation(session.client().query_opt(
-                    "SELECT credential_id, issuer, profile, status, effective_status, issued_at,\
-                            credential_expires_at, updated_at\
-                       FROM registry_notary_api.credential_status_get_v1($1)",
-                    &[&credential_id],
-                ))
-                .await
-                .map_err(|_| CredentialStatusStoreError::PostgresUnavailable)?;
-            return row.as_ref().map(postgres_status_record).transpose();
-        }
-        let Some(store) = self.store.as_ref() else {
-            return Ok(None);
-        };
-        let key = self.key(credential_id)?;
-        let Some(raw) = store
-            .get(&key)
-            .await
-            .map_err(CredentialStatusStoreError::Store)?
-        else {
-            return Ok(None);
-        };
-        serde_json::from_slice(&raw).map_err(|_| CredentialStatusStoreError::InvalidRecord)
-    }
-
-    pub(crate) async fn update_status(
-        &self,
-        credential_id: &str,
-        status: &str,
-    ) -> Result<Option<CredentialStatusRecord>, CredentialStatusStoreError> {
-        if !self.enabled {
-            return Ok(None);
-        }
-        if let Some(state_plane) = &self.state_plane {
-            let runtime = state_plane
-                .runtime()
-                .map_err(|_| CredentialStatusStoreError::PostgresUnavailable)?;
-            let session = runtime
-                .open_domain_session()
-                .await
-                .map_err(|_| CredentialStatusStoreError::PostgresUnavailable)?;
-            let row = session
-                .run_operation(session.client().query_one(
-                    "SELECT outcome, credential_id, issuer, profile, status, effective_status, issued_at,\
-                            credential_expires_at, updated_at\
-                       FROM registry_notary_api.credential_status_update_v1($1, $2)",
-                    &[&credential_id, &status],
-                ))
-                .await
-                .map_err(|_| CredentialStatusStoreError::PostgresUnavailable)?;
-            let outcome = row
-                .try_get::<_, String>("outcome")
-                .map_err(|_| CredentialStatusStoreError::InvalidRecord)?;
-            return match outcome.as_str() {
-                "not_found" => Ok(None),
-                "invalid_transition" => Err(CredentialStatusStoreError::InvalidTransition),
-                "updated" => postgres_status_record(&row).map(Some),
-                _ => Err(CredentialStatusStoreError::InvalidRecord),
-            };
-        }
-        let Some(store) = self.store.as_ref() else {
-            return Ok(None);
-        };
-        let key = self.key(credential_id)?;
-        let transition_lock = self.transition_lock(credential_id);
-        let _transition_guard = transition_lock.lock().await;
-
-        loop {
-            let Some(raw) = store
-                .get(&key)
-                .await
-                .map_err(CredentialStatusStoreError::Store)?
-            else {
-                return Ok(None);
-            };
-            let mut record: CredentialStatusRecord = serde_json::from_slice(&raw)
-                .map_err(|_| CredentialStatusStoreError::InvalidRecord)?;
-            if record.status == CREDENTIAL_STATUS_REVOKED && status != CREDENTIAL_STATUS_REVOKED {
-                return Err(CredentialStatusStoreError::InvalidTransition);
-            }
-            record.status = status.to_string();
-            record.updated_at = format_time(OffsetDateTime::now_utc());
-            let expires_at = self.record_cache_expires_at(&record)?;
-            let value = serde_json::to_vec(&record)
-                .map_err(|_| CredentialStatusStoreError::InvalidRecord)?;
-            match store
-                .compare_and_set(&key, &raw, &value, expires_at)
-                .await
-                .map_err(CredentialStatusStoreError::Store)?
-            {
-                CacheCompareAndSetOutcome::Stored => return Ok(Some(record)),
-                CacheCompareAndSetOutcome::Missing => return Ok(None),
-                CacheCompareAndSetOutcome::Mismatch => continue,
-            }
-        }
-    }
-
-    pub(crate) async fn check_ready(&self) -> Result<(), CacheStoreError> {
-        if let Some(state_plane) = &self.state_plane {
-            return match state_plane.readiness().await {
-                NotaryPostgresStatePlaneReadiness::Ready => Ok(()),
-                _ => Err(CacheStoreError::Operation {
-                    message: "Notary PostgreSQL state is unavailable".to_string(),
-                }),
-            };
-        }
-        Ok(())
-    }
-
-    async fn write_record(
-        &self,
-        record: &CredentialStatusRecord,
-    ) -> Result<(), CredentialStatusStoreError> {
-        let Some(store) = self.store.as_ref() else {
-            return Ok(());
-        };
-        let expires_at = self.record_cache_expires_at(record)?;
-        let key = self.key(&record.credential_id)?;
-        let value =
-            serde_json::to_vec(record).map_err(|_| CredentialStatusStoreError::InvalidRecord)?;
-        store
-            .set(&key, &value, expires_at)
-            .await
-            .map_err(CredentialStatusStoreError::Store)
-    }
-
-    fn record_cache_expires_at(
-        &self,
-        record: &CredentialStatusRecord,
-    ) -> Result<OffsetDateTime, CredentialStatusStoreError> {
-        let retention_seconds = i64::try_from(self.retention_seconds)
-            .map_err(|_| CredentialStatusStoreError::InvalidRecord)?;
-        OffsetDateTime::parse(&record.expires_at, &Rfc3339)
-            .map_err(|_| CredentialStatusStoreError::InvalidRecord)?
-            .checked_add(time::Duration::seconds(retention_seconds))
-            .ok_or(CredentialStatusStoreError::InvalidRecord)
-    }
-
-    fn key(&self, credential_id: &str) -> Result<CacheKey, CredentialStatusStoreError> {
-        CacheKey::from_hashed_parts(
-            &self.key_prefix,
-            "credential-status",
-            [("credential_id", credential_id)],
-        )
-        .map_err(CredentialStatusStoreError::InvalidKey)
-    }
-
-    fn transition_lock(&self, credential_id: &str) -> CredentialStatusTransitionLock {
-        let mut hasher = DefaultHasher::new();
-        credential_id.hash(&mut hasher);
-        let bucket = hasher.finish() as usize % self.transition_locks.len();
-        Arc::clone(&self.transition_locks[bucket])
-    }
-}
-
-pub(crate) fn postgres_status_record(
-    row: &tokio_postgres::Row,
-) -> Result<CredentialStatusRecord, CredentialStatusStoreError> {
-    let issued_at = row
-        .try_get::<_, OffsetDateTime>("issued_at")
-        .map_err(|_| CredentialStatusStoreError::InvalidRecord)?;
-    let expires_at = row
-        .try_get::<_, OffsetDateTime>("credential_expires_at")
-        .map_err(|_| CredentialStatusStoreError::InvalidRecord)?;
-    let updated_at = row
-        .try_get::<_, OffsetDateTime>("updated_at")
-        .map_err(|_| CredentialStatusStoreError::InvalidRecord)?;
-    Ok(CredentialStatusRecord {
-        credential_id: row
-            .try_get("credential_id")
-            .map_err(|_| CredentialStatusStoreError::InvalidRecord)?,
-        issuer: row
-            .try_get("issuer")
-            .map_err(|_| CredentialStatusStoreError::InvalidRecord)?,
-        credential_profile: row
-            .try_get("profile")
-            .map_err(|_| CredentialStatusStoreError::InvalidRecord)?,
-        status: row
-            .try_get("status")
-            .map_err(|_| CredentialStatusStoreError::InvalidRecord)?,
-        issued_at: format_time(issued_at),
-        expires_at: format_time(expires_at),
-        updated_at: format_time(updated_at),
-        database_effective_status: Some(
-            row.try_get("effective_status")
-                .map_err(|_| CredentialStatusStoreError::InvalidRecord)?,
-        ),
-    })
-}
-
-pub(crate) fn is_mutable_status(value: &str) -> bool {
-    matches!(
-        value,
-        CREDENTIAL_STATUS_VALID | CREDENTIAL_STATUS_SUSPENDED | CREDENTIAL_STATUS_REVOKED
-    )
-}
-
-pub(crate) fn status_list_value(status: &str) -> u8 {
-    match status {
-        CREDENTIAL_STATUS_VALID => 0,
-        CREDENTIAL_STATUS_SUSPENDED => 2,
-        _ => 1,
-    }
-}
-
-pub(crate) fn encoded_single_entry_status_list(status: &str) -> &'static str {
-    match status_list_value(status) {
-        0 => "eJxjAAAAAQAB",
-        2 => "eJxjAgAAAwAD",
-        _ => "eJxjBAAAAgAC",
-    }
-}
-
-fn format_time(value: OffsetDateTime) -> String {
-    value
-        .format(&Rfc3339)
-        .expect("OffsetDateTime within supported RFC3339 range")
-}
-
-fn transition_locks() -> CredentialStatusTransitionLocks {
-    Arc::new(
-        (0..CREDENTIAL_STATUS_TRANSITION_LOCK_STRIPES)
-            .map(|_| Arc::new(tokio::sync::Mutex::new(())))
-            .collect(),
-    )
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use async_trait::async_trait;
-    use registry_platform_cache::{CacheCompareAndSetOutcome, CacheSetOutcome};
-    use std::sync::atomic::{AtomicBool, Ordering};
-    use std::time::Duration;
-    use tokio::sync::Notify;
-
-    struct BlockingInMemoryCacheStore {
-        inner: InMemoryCacheStore,
-        block_next_suspended_set: AtomicBool,
-        suspended_set_started: Notify,
-        release_suspended_set: Notify,
-        revoked_set_finished: Notify,
-    }
-
-    impl BlockingInMemoryCacheStore {
-        fn new() -> Self {
-            Self {
-                inner: InMemoryCacheStore::new(),
-                block_next_suspended_set: AtomicBool::new(true),
-                suspended_set_started: Notify::new(),
-                release_suspended_set: Notify::new(),
-                revoked_set_finished: Notify::new(),
-            }
-        }
-    }
-
-    #[async_trait]
-    impl CacheStore for BlockingInMemoryCacheStore {
-        async fn get(&self, key: &CacheKey) -> Result<Option<Vec<u8>>, CacheStoreError> {
-            self.inner.get(key).await
-        }
-
-        async fn set(
-            &self,
-            key: &CacheKey,
-            value: &[u8],
-            expires_at: OffsetDateTime,
-        ) -> Result<(), CacheStoreError> {
-            let status = serde_json::from_slice::<CredentialStatusRecord>(value)
-                .ok()
-                .map(|record| record.status);
-            if status.as_deref() == Some(CREDENTIAL_STATUS_SUSPENDED)
-                && self.block_next_suspended_set.swap(false, Ordering::SeqCst)
-            {
-                self.suspended_set_started.notify_one();
-                self.release_suspended_set.notified().await;
-            }
-            let result = self.inner.set(key, value, expires_at).await;
-            if status.as_deref() == Some(CREDENTIAL_STATUS_REVOKED) {
-                self.revoked_set_finished.notify_one();
-            }
-            result
-        }
-
-        async fn set_if_absent(
-            &self,
-            key: &CacheKey,
-            value: &[u8],
-            expires_at: OffsetDateTime,
-        ) -> Result<CacheSetOutcome, CacheStoreError> {
-            self.inner.set_if_absent(key, value, expires_at).await
-        }
-
-        async fn compare_and_set(
-            &self,
-            key: &CacheKey,
-            expected: &[u8],
-            value: &[u8],
-            expires_at: OffsetDateTime,
-        ) -> Result<CacheCompareAndSetOutcome, CacheStoreError> {
-            let status = serde_json::from_slice::<CredentialStatusRecord>(value)
-                .ok()
-                .map(|record| record.status);
-            if status.as_deref() == Some(CREDENTIAL_STATUS_SUSPENDED)
-                && self.block_next_suspended_set.swap(false, Ordering::SeqCst)
-            {
-                self.suspended_set_started.notify_one();
-                self.release_suspended_set.notified().await;
-            }
-            let result = self
-                .inner
-                .compare_and_set(key, expected, value, expires_at)
-                .await;
-            if status.as_deref() == Some(CREDENTIAL_STATUS_REVOKED) {
-                self.revoked_set_finished.notify_one();
-            }
-            result
-        }
-
-        async fn delete(&self, key: &CacheKey) -> Result<bool, CacheStoreError> {
-            self.inner.delete(key).await
-        }
-
-        async fn check_ready(&self) -> Result<(), CacheStoreError> {
-            Ok(())
-        }
-    }
-
-    fn memory_store() -> CredentialStatusStore {
-        CredentialStatusStore::from_config(&CredentialStatusConfig {
-            enabled: true,
-            base_url: "https://issuer.example/".to_string(),
-            retention_seconds: 60,
-        })
-    }
-
-    fn memory_store_with_cache(cache: Arc<dyn CacheStore>) -> CredentialStatusStore {
-        CredentialStatusStore {
-            enabled: true,
-            base_url: "https://issuer.example".to_string(),
-            retention_seconds: 60,
-            key_prefix: "registry-notary".to_string(),
-            store: Some(cache),
-            state_plane: None,
-            transition_locks: transition_locks(),
-        }
-    }
-
-    async fn record_test_credential(store: &CredentialStatusStore, credential_id: &str) {
-        let issued_at = OffsetDateTime::now_utc() - time::Duration::seconds(10);
-        let expires_at = OffsetDateTime::now_utc() + time::Duration::seconds(120);
-        store
-            .record_issued(
-                credential_id.to_string(),
-                "did:web:issuer.example".to_string(),
-                "civil_status_sd_jwt".to_string(),
-                issued_at,
-                expires_at,
-            )
-            .await
-            .expect("record writes");
-    }
-
-    #[tokio::test]
-    async fn memory_store_records_updates_and_derives_expired_status() {
-        let store = memory_store();
-        let issued_at = OffsetDateTime::now_utc() - time::Duration::seconds(10);
-        let expires_at = OffsetDateTime::now_utc() + time::Duration::seconds(10);
-
-        store
-            .record_issued(
-                "urn:ulid:01HX7Y5F2WAJ7ZP0Q4M5K9E8NC".to_string(),
-                "did:web:issuer.example".to_string(),
-                "civil_status_sd_jwt".to_string(),
-                issued_at,
-                expires_at,
-            )
-            .await
-            .expect("record writes");
-        let record = store
-            .get("urn:ulid:01HX7Y5F2WAJ7ZP0Q4M5K9E8NC")
-            .await
-            .expect("lookup succeeds")
-            .expect("record exists");
-        assert_eq!(record.status, CREDENTIAL_STATUS_VALID);
-        assert_eq!(record.effective_status(issued_at), CREDENTIAL_STATUS_VALID);
-        assert_eq!(
-            record.effective_status(expires_at + time::Duration::seconds(1)),
-            CREDENTIAL_STATUS_EXPIRED
-        );
-
-        let suspended = store
-            .update_status(
-                "urn:ulid:01HX7Y5F2WAJ7ZP0Q4M5K9E8NC",
-                CREDENTIAL_STATUS_SUSPENDED,
-            )
-            .await
-            .expect("update succeeds")
-            .expect("record exists");
-        assert_eq!(
-            suspended.effective_status(issued_at),
-            CREDENTIAL_STATUS_SUSPENDED
-        );
-        assert_eq!(
-            suspended.effective_status(expires_at + time::Duration::seconds(1)),
-            CREDENTIAL_STATUS_EXPIRED,
-            "credential expiry supersedes suspension"
-        );
-
-        let revoked = store
-            .update_status(
-                "urn:ulid:01HX7Y5F2WAJ7ZP0Q4M5K9E8NC",
-                CREDENTIAL_STATUS_REVOKED,
-            )
-            .await
-            .expect("update succeeds")
-            .expect("record exists");
-        assert_eq!(
-            revoked.effective_status(expires_at + time::Duration::seconds(1)),
-            CREDENTIAL_STATUS_REVOKED
-        );
-    }
-
-    #[tokio::test]
-    async fn memory_store_allows_valid_and_suspended_until_revoked() {
-        let store = memory_store();
-        let credential_id = "urn:ulid:01HX7Y5F2WAJ7ZP0Q4M5K9E8ND";
-        record_test_credential(&store, credential_id).await;
-
-        let suspended = store
-            .update_status(credential_id, CREDENTIAL_STATUS_SUSPENDED)
-            .await
-            .expect("valid to suspended succeeds")
-            .expect("record exists");
-        assert_eq!(suspended.status, CREDENTIAL_STATUS_SUSPENDED);
-
-        let valid = store
-            .update_status(credential_id, CREDENTIAL_STATUS_VALID)
-            .await
-            .expect("suspended to valid succeeds")
-            .expect("record exists");
-        assert_eq!(valid.status, CREDENTIAL_STATUS_VALID);
-
-        let revoked = store
-            .update_status(credential_id, CREDENTIAL_STATUS_REVOKED)
-            .await
-            .expect("valid to revoked succeeds")
-            .expect("record exists");
-        assert_eq!(revoked.status, CREDENTIAL_STATUS_REVOKED);
-    }
-
-    #[tokio::test]
-    async fn memory_store_rejects_revoked_to_valid_transition() {
-        let store = memory_store();
-        let credential_id = "urn:ulid:01HX7Y5F2WAJ7ZP0Q4M5K9E8NE";
-        record_test_credential(&store, credential_id).await;
-        store
-            .update_status(credential_id, CREDENTIAL_STATUS_REVOKED)
-            .await
-            .expect("revocation succeeds")
-            .expect("record exists");
-
-        let err = store
-            .update_status(credential_id, CREDENTIAL_STATUS_VALID)
-            .await
-            .expect_err("revoked credential must not become valid");
-        assert!(matches!(err, CredentialStatusStoreError::InvalidTransition));
-
-        let record = store
-            .get(credential_id)
-            .await
-            .expect("lookup succeeds")
-            .expect("record exists");
-        assert_eq!(record.status, CREDENTIAL_STATUS_REVOKED);
-    }
-
-    #[tokio::test]
-    async fn memory_store_rejects_revoked_to_suspended_transition() {
-        let store = memory_store();
-        let credential_id = "urn:ulid:01HX7Y5F2WAJ7ZP0Q4M5K9E8NF";
-        record_test_credential(&store, credential_id).await;
-        store
-            .update_status(credential_id, CREDENTIAL_STATUS_REVOKED)
-            .await
-            .expect("revocation succeeds")
-            .expect("record exists");
-
-        let err = store
-            .update_status(credential_id, CREDENTIAL_STATUS_SUSPENDED)
-            .await
-            .expect_err("revoked credential must not become suspended");
-        assert!(matches!(err, CredentialStatusStoreError::InvalidTransition));
-
-        let record = store
-            .get(credential_id)
-            .await
-            .expect("lookup succeeds")
-            .expect("record exists");
-        assert_eq!(record.status, CREDENTIAL_STATUS_REVOKED);
-    }
-
-    #[tokio::test]
-    async fn memory_store_concurrent_revoke_wins_over_stale_non_revoked_update() {
-        let cache = Arc::new(BlockingInMemoryCacheStore::new());
-        let store = memory_store_with_cache(cache.clone());
-        let credential_id = "urn:ulid:01HX7Y5F2WAJ7ZP0Q4M5K9E8NG";
-        record_test_credential(&store, credential_id).await;
-
-        let suspended_store = store.clone();
-        let suspended_update = tokio::spawn(async move {
-            suspended_store
-                .update_status(credential_id, CREDENTIAL_STATUS_SUSPENDED)
-                .await
-        });
-        cache.suspended_set_started.notified().await;
-
-        let revoked_store = store.clone();
-        let revoked_update = tokio::spawn(async move {
-            revoked_store
-                .update_status(credential_id, CREDENTIAL_STATUS_REVOKED)
-                .await
-        });
-        let revoked_before_suspended_released = tokio::time::timeout(
-            Duration::from_millis(50),
-            cache.revoked_set_finished.notified(),
-        )
-        .await;
-        assert!(
-            revoked_before_suspended_released.is_err(),
-            "revocation must wait for the in-flight non-revoked transition"
-        );
-
-        cache.release_suspended_set.notify_waiters();
-        let suspended = suspended_update
-            .await
-            .expect("suspended task joins")
-            .expect("suspended update succeeds")
-            .expect("record exists");
-        assert_eq!(suspended.status, CREDENTIAL_STATUS_SUSPENDED);
-        let revoked = revoked_update
-            .await
-            .expect("revoked task joins")
-            .expect("revoked update succeeds")
-            .expect("record exists");
-        assert_eq!(revoked.status, CREDENTIAL_STATUS_REVOKED);
-
-        let record = store
-            .get(credential_id)
-            .await
-            .expect("lookup succeeds")
-            .expect("record exists");
-        assert_eq!(record.status, CREDENTIAL_STATUS_REVOKED);
-    }
-
-    #[tokio::test]
-    async fn shared_cache_rejects_stale_non_revoked_update_after_cross_process_revoke() {
-        let cache = Arc::new(BlockingInMemoryCacheStore::new());
-        let suspended_store = memory_store_with_cache(cache.clone());
-        let revoked_store = memory_store_with_cache(cache.clone());
-        let credential_id = "urn:ulid:01HX7Y5F2WAJ7ZP0Q4M5K9E8NH";
-        record_test_credential(&suspended_store, credential_id).await;
-
-        let stale_suspended_store = suspended_store.clone();
-        let suspended_update = tokio::spawn(async move {
-            stale_suspended_store
-                .update_status(credential_id, CREDENTIAL_STATUS_SUSPENDED)
-                .await
-        });
-        cache.suspended_set_started.notified().await;
-
-        let revoked = revoked_store
-            .update_status(credential_id, CREDENTIAL_STATUS_REVOKED)
-            .await
-            .expect("revocation succeeds")
-            .expect("record exists");
-        assert_eq!(revoked.status, CREDENTIAL_STATUS_REVOKED);
-        cache.release_suspended_set.notify_waiters();
-
-        let err = suspended_update
-            .await
-            .expect("suspended task joins")
-            .expect_err("stale non-revoked update must lose to revocation");
-        assert!(matches!(err, CredentialStatusStoreError::InvalidTransition));
-
-        let record = suspended_store
-            .get(credential_id)
-            .await
-            .expect("lookup succeeds")
-            .expect("record exists");
-        assert_eq!(record.status, CREDENTIAL_STATUS_REVOKED);
-    }
-
-    #[test]
-    fn status_claim_uses_trimmed_base_url() {
-        let store = CredentialStatusStore::from_config(&CredentialStatusConfig {
-            enabled: true,
-            base_url: "https://issuer.example/".to_string(),
-            ..CredentialStatusConfig::default()
-        });
-
-        assert_eq!(
-            store.status_claim("credential-1"),
-            Some(json!({
-                "status_list": {
-                    "idx": 0,
-                    "uri": "https://issuer.example/v1/credentials/credential-1/status"
-                }
-            }))
-        );
-    }
-
-    #[test]
-    fn status_list_values_use_registered_token_status_codes() {
-        assert_eq!(status_list_value(CREDENTIAL_STATUS_VALID), 0);
-        assert_eq!(status_list_value(CREDENTIAL_STATUS_REVOKED), 1);
-        assert_eq!(status_list_value(CREDENTIAL_STATUS_EXPIRED), 1);
-        assert_eq!(status_list_value(CREDENTIAL_STATUS_SUSPENDED), 2);
-        assert_eq!(
-            encoded_single_entry_status_list(CREDENTIAL_STATUS_VALID),
-            "eJxjAAAAAQAB"
-        );
-    }
-}
diff --git a/crates/registry-notary-server/src/digest.rs b/crates/registry-notary-server/src/digest.rs
deleted file mode 100644
index d94f40aee..000000000
--- a/crates/registry-notary-server/src/digest.rs
+++ /dev/null
@@ -1,45 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Stable digest and hexadecimal encoding helpers.
-
-use registry_notary_core::EvidenceError;
-use serde_json::Value;
-use sha2::{Digest, Sha256};
-
-pub(crate) fn sha256_json(value: &Value) -> Result<String, serde_json::Error> {
-    let bytes = serde_json::to_vec(value)?;
-    Ok(format!("sha256:{}", hex_encode(&Sha256::digest(bytes))))
-}
-
-pub(crate) fn evidence_claim_hash(claim_ids: &[String]) -> String {
-    let mut hasher = Sha256::new();
-    for claim_id in claim_ids {
-        hasher.update(claim_id.as_bytes());
-        hasher.update([0]);
-    }
-    format!("sha256:{}", hex_encode(&hasher.finalize()))
-}
-
-pub(crate) fn sha256_canonical_json(value: &Value) -> Result<String, EvidenceError> {
-    let bytes = serde_json::to_vec(value).map_err(|_| EvidenceError::InvalidRequest)?;
-    Ok(format!("sha256:{}", hex_encode(&Sha256::digest(bytes))))
-}
-
-pub(crate) fn hex_encode(bytes: &[u8]) -> String {
-    const HEX: &[u8; 16] = b"0123456789abcdef";
-    let mut out = String::with_capacity(bytes.len() * 2);
-    for byte in bytes {
-        out.push(HEX[(byte >> 4) as usize] as char);
-        out.push(HEX[(byte & 0x0f) as usize] as char);
-    }
-    out
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn hex_encoding_is_lowercase_and_zero_padded() {
-        assert_eq!(hex_encode(&[0x00, 0x0f, 0xa0, 0xff]), "000fa0ff");
-    }
-}
diff --git a/crates/registry-notary-server/src/docs.rs b/crates/registry-notary-server/src/docs.rs
deleted file mode 100644
index 5513566e6..000000000
--- a/crates/registry-notary-server/src/docs.rs
+++ /dev/null
@@ -1,269 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! `/docs` Scalar API reference viewer.
-//!
-//! The docs shell and vendored Scalar bundle are public static routes. The
-//! OpenAPI document at `/openapi.json` remains auth-gated by default, but the
-//! shell can fetch it anonymously when demo deployments set
-//! `server.openapi_requires_auth: false`. For protected deployments, operators
-//! can paste an API key and the shell uses it for both the spec fetch and
-//! Scalar's "Try it" calls.
-
-use axum::http::{header, HeaderName, HeaderValue, StatusCode};
-use axum::response::{IntoResponse, Response};
-use axum::routing::get;
-use axum::Router;
-
-/// Vendored Scalar API Reference standalone bundle.
-/// Pinned to `@scalar/api-reference@1.57.1`.
-pub const SCALAR_BUNDLE: &[u8] = include_bytes!("../resources/scalar/api-reference.js");
-
-const TEXT_HTML: HeaderValue = HeaderValue::from_static("text/html; charset=utf-8");
-const APPLICATION_JAVASCRIPT: HeaderValue =
-    HeaderValue::from_static("application/javascript; charset=utf-8");
-const NO_STORE: HeaderValue = HeaderValue::from_static("no-store");
-const CACHE_CONTROL_7D_IMMUTABLE: HeaderValue =
-    HeaderValue::from_static("public, max-age=604800, immutable");
-const CONTENT_SECURITY_POLICY: HeaderName = HeaderName::from_static("content-security-policy");
-const DOCS_HTML_CSP: HeaderValue = HeaderValue::from_static(
-    "default-src 'none'; script-src 'self' 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' 'sha256-W+ePrtSBohwU9Ex8EJT1P2P93ZDXNOUJGYyWFN0+WB8='; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; form-action 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; frame-src 'none'; worker-src 'none'; manifest-src 'none'",
-);
-const SCALAR_BUNDLE_CSP: HeaderValue = HeaderValue::from_static(
-    "default-src 'none'; script-src 'none'; style-src 'none'; img-src 'none'; font-src 'none'; connect-src 'none'; form-action 'none'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; frame-src 'none'",
-);
-
-/// HTML shell that mounts Scalar with a pre-fetched OpenAPI document.
-const DOCS_HTML: &str = r#"<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>Registry Notary API</title>
-    <style>
-      body { margin: 0; font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; }
-      #auth-bar {
-        display: flex; align-items: center; gap: 8px;
-        padding: 8px 12px;
-        background: #f6f7f9;
-        border-bottom: 1px solid #dde0e3;
-        font-size: 13px;
-      }
-      #auth-bar label { color: #555; white-space: nowrap; }
-      #auth-bar input {
-        flex: 1; min-width: 0;
-        padding: 6px 8px;
-        border: 1px solid #ccc;
-        border-radius: 4px;
-        font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
-        font-size: 12px;
-      }
-      #auth-bar button {
-        padding: 6px 12px;
-        border: 1px solid #c1c5cb;
-        background: white;
-        border-radius: 4px;
-        cursor: pointer;
-        font-size: 13px;
-      }
-      #auth-bar button:hover { background: #eef0f3; }
-      #auth-bar .status { color: #888; font-size: 12px; white-space: nowrap; }
-    </style>
-  </head>
-  <body>
-    <form id="auth-bar" autocomplete="off">
-      <label for="token">API key:</label>
-      <input id="token" name="token" type="password" placeholder="Paste X-Api-Key; persisted in localStorage" />
-      <button type="submit">Apply</button>
-      <button type="button" id="clear">Clear</button>
-      <span id="status" class="status"></span>
-    </form>
-
-    <script id="api-reference"></script>
-    <script>
-      (function () {
-        var STORAGE_KEY = 'registry-notary.api_key';
-        var SPEC_URL = '/openapi.json';
-        var BUNDLE_URL = '/docs/scalar.js';
-        var input = document.getElementById('token');
-        var status = document.getElementById('status');
-        var form = document.getElementById('auth-bar');
-        var clearBtn = document.getElementById('clear');
-        var refEl = document.getElementById('api-reference');
-
-        var stored = '';
-        try { stored = localStorage.getItem(STORAGE_KEY) || ''; } catch (e) {}
-        if (stored) { input.value = stored; }
-
-        form.addEventListener('submit', function (e) {
-          e.preventDefault();
-          var v = input.value.trim();
-          try {
-            if (v) { localStorage.setItem(STORAGE_KEY, v); }
-            else   { localStorage.removeItem(STORAGE_KEY); }
-          } catch (e) {}
-          location.reload();
-        });
-        clearBtn.addEventListener('click', function () {
-          try { localStorage.removeItem(STORAGE_KEY); } catch (e) {}
-          input.value = '';
-          location.reload();
-        });
-
-        function mountScalar(spec, token) {
-          refEl.dataset.configuration = JSON.stringify({
-            content: spec,
-            authentication: {
-              preferredSecurityScheme: 'apiKeyAuth',
-              securitySchemes: {
-                apiKeyAuth: {
-                  name: 'X-Api-Key',
-                  in: 'header',
-                  value: token,
-                },
-              },
-            },
-          });
-          var s = document.createElement('script');
-          s.src = BUNDLE_URL;
-          document.body.appendChild(s);
-        }
-
-        function specHeaders(token) {
-          var headers = { 'Accept': 'application/json' };
-          if (token) { headers['X-Api-Key'] = token; }
-          return headers;
-        }
-
-        status.textContent = stored ? 'fetching spec with stored key...' : 'fetching public spec...';
-        fetch(SPEC_URL, {
-          headers: specHeaders(stored),
-          credentials: 'omit',
-          cache: 'no-store',
-        })
-          .then(function (r) {
-            if (!r.ok) {
-              return r.text().then(function (text) {
-                throw new Error(r.status + ' ' + r.statusText + (text ? ' - ' + text.slice(0, 200) : ''));
-              });
-            }
-            return r.json();
-          })
-          .then(function (spec) {
-            var ver = spec && spec.info && spec.info.version ? 'v' + spec.info.version : 'ok';
-            status.textContent = 'spec loaded (' + ver + ')';
-            mountScalar(spec, stored);
-          })
-          .catch(function (err) {
-            var message = err && err.message ? err.message : err;
-            status.textContent = stored
-              ? 'spec fetch failed: ' + message
-              : 'spec fetch failed; paste an API key above if this deployment protects OpenAPI: ' + message;
-          });
-      })();
-    </script>
-  </body>
-</html>
-"#;
-
-pub fn router<S>() -> Router<S>
-where
-    S: Clone + Send + Sync + 'static,
-{
-    Router::new()
-        .route("/docs", get(serve_html))
-        .route("/docs/scalar.js", get(serve_bundle))
-}
-
-async fn serve_html() -> Response {
-    (
-        StatusCode::OK,
-        [
-            (header::CONTENT_TYPE, TEXT_HTML),
-            (header::CACHE_CONTROL, NO_STORE),
-            (CONTENT_SECURITY_POLICY, DOCS_HTML_CSP),
-        ],
-        DOCS_HTML,
-    )
-        .into_response()
-}
-
-async fn serve_bundle() -> Response {
-    (
-        StatusCode::OK,
-        [
-            (header::CONTENT_TYPE, APPLICATION_JAVASCRIPT),
-            (header::CACHE_CONTROL, CACHE_CONTROL_7D_IMMUTABLE),
-            (CONTENT_SECURITY_POLICY, SCALAR_BUNDLE_CSP),
-        ],
-        SCALAR_BUNDLE,
-    )
-        .into_response()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn scalar_bundle_is_non_empty() {
-        assert!(!SCALAR_BUNDLE.is_empty());
-    }
-
-    #[test]
-    fn docs_html_references_openapi_and_bundle() {
-        assert!(DOCS_HTML.contains("/openapi.json"));
-        assert!(DOCS_HTML.contains("/docs/scalar.js"));
-    }
-
-    #[test]
-    fn docs_html_wires_optional_api_key_into_scalar_config() {
-        assert!(DOCS_HTML.contains("registry-notary.api_key"));
-        assert!(DOCS_HTML.contains("localStorage"));
-        assert!(DOCS_HTML.contains("preferredSecurityScheme: 'apiKeyAuth'"));
-        assert!(DOCS_HTML.contains("securitySchemes"));
-        assert!(DOCS_HTML.contains("headers['X-Api-Key'] = token"));
-        assert!(
-            DOCS_HTML.contains("dataset.configuration"),
-            "Scalar configuration must be set"
-        );
-        let config_pos = DOCS_HTML
-            .find("dataset.configuration")
-            .expect("configuration write present");
-        let bundle_pos = DOCS_HTML
-            .find("s.src = BUNDLE_URL")
-            .expect("dynamic bundle load present");
-        assert!(
-            config_pos < bundle_pos,
-            "Scalar configuration must be set before the bundle is loaded"
-        );
-    }
-
-    #[test]
-    fn docs_html_csp_hashes_cover_inline_scripts() {
-        use base64::Engine;
-        use sha2::{Digest, Sha256};
-
-        let script_hashes: Vec<String> = DOCS_HTML
-            .split("<script")
-            .skip(1)
-            .filter_map(|part| part.split_once('>').map(|(_, rest)| rest))
-            .filter_map(|part| part.split_once("</script>").map(|(script, _)| script))
-            .map(|script| {
-                let digest = Sha256::digest(script.as_bytes());
-                format!(
-                    "'sha256-{}'",
-                    base64::engine::general_purpose::STANDARD.encode(digest)
-                )
-            })
-            .collect();
-        let csp_header = DOCS_HTML_CSP;
-        let csp = csp_header.to_str().expect("CSP is ASCII");
-
-        assert!(!script_hashes.is_empty());
-        for hash in script_hashes {
-            assert!(
-                csp.contains(&hash),
-                "docs CSP must allow inline script hash {hash}"
-            );
-        }
-    }
-}
diff --git a/crates/registry-notary-server/src/federation/audit.rs b/crates/registry-notary-server/src/federation/audit.rs
deleted file mode 100644
index 0994028dc..000000000
--- a/crates/registry-notary-server/src/federation/audit.rs
+++ /dev/null
@@ -1,190 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use axum::response::Response;
-use registry_notary_core::{
-    AccessMode, ConfigMetadata, FederationPeerConfig, FEDERATION_PROTOCOL_V0_1,
-};
-use registry_platform_oidc::VerifiedToken;
-use time::format_description::well_known::Rfc3339;
-use time::OffsetDateTime;
-use ulid::Ulid;
-
-use crate::api::evidence_claim_hash;
-
-use super::errors::FederationProblem;
-
-#[derive(Clone, Debug, Default)]
-pub(super) struct FederationAuditContext {
-    pub(super) claim_ids: Vec<String>,
-    pub(super) scopes_used: Vec<String>,
-    pub(super) peer_node_id: Option<String>,
-    pub(super) issuer: Option<String>,
-    pub(super) profile: Option<String>,
-    pub(super) purpose: Option<String>,
-    pub(super) request_jti: Option<String>,
-    pub(super) subject_ref_hash: Option<String>,
-}
-
-impl FederationAuditContext {
-    pub(super) fn from_verified(peer: &FederationPeerConfig, verified: &VerifiedToken) -> Self {
-        Self {
-            scopes_used: peer.evaluation_scopes.clone(),
-            peer_node_id: Some(peer.node_id.clone()),
-            issuer: Some(peer.issuer.clone()),
-            profile: verified
-                .claims
-                .extra
-                .get("profile")
-                .and_then(|value| value.as_str())
-                .map(str::to_string),
-            purpose: verified
-                .claims
-                .extra
-                .get("purpose")
-                .and_then(|value| value.as_str())
-                .map(str::to_string),
-            request_jti: verified
-                .claims
-                .extra
-                .get("jti")
-                .and_then(|value| value.as_str())
-                .map(str::to_string),
-            ..Self::default()
-        }
-    }
-
-    pub(super) fn denied(&self, problem: FederationProblem) -> FederationDeniedOutcome {
-        FederationDeniedOutcome::with_context(problem, self.clone())
-    }
-}
-
-#[derive(Debug)]
-pub(super) struct FederationAuditOutcome {
-    pub(super) decision: String,
-    pub(super) verification_id: Option<String>,
-    pub(super) claim_ids: Vec<String>,
-    pub(super) scopes_used: Vec<String>,
-    pub(super) error_code: Option<String>,
-    pub(super) peer_node_id: Option<String>,
-    pub(super) issuer: Option<String>,
-    pub(super) profile: Option<String>,
-    pub(super) purpose: Option<String>,
-    pub(super) request_jti: Option<String>,
-    pub(super) subject_ref_hash: Option<String>,
-}
-
-impl FederationAuditOutcome {
-    pub(super) fn denied(problem: &FederationProblem) -> Self {
-        Self::denied_with_context(problem, FederationAuditContext::default())
-    }
-
-    pub(super) fn denied_with_context(
-        problem: &FederationProblem,
-        context: FederationAuditContext,
-    ) -> Self {
-        Self {
-            decision: "federated_evaluate_denied".to_string(),
-            verification_id: None,
-            claim_ids: context.claim_ids,
-            scopes_used: context.scopes_used,
-            error_code: Some(problem.code.clone()),
-            peer_node_id: context.peer_node_id,
-            issuer: context.issuer,
-            profile: context.profile,
-            purpose: context.purpose,
-            request_jti: context.request_jti,
-            subject_ref_hash: context.subject_ref_hash,
-        }
-    }
-
-    pub(super) fn into_denied(mut self, problem: &FederationProblem) -> Self {
-        self.decision = "federated_evaluate_denied".to_string();
-        self.error_code = Some(problem.code.clone());
-        self
-    }
-}
-
-#[derive(Debug)]
-pub(super) struct FederationDeniedOutcome {
-    pub(super) problem: FederationProblem,
-    pub(super) audit: FederationAuditOutcome,
-}
-
-impl FederationDeniedOutcome {
-    pub(super) fn with_context(
-        problem: FederationProblem,
-        context: FederationAuditContext,
-    ) -> Self {
-        let audit = FederationAuditOutcome::denied_with_context(&problem, context);
-        Self { problem, audit }
-    }
-}
-
-impl From<FederationProblem> for FederationDeniedOutcome {
-    fn from(problem: FederationProblem) -> Self {
-        let audit = FederationAuditOutcome::denied(&problem);
-        Self { problem, audit }
-    }
-}
-
-pub(super) fn federation_audit_event(
-    response: &Response,
-    audit: FederationAuditOutcome,
-    audit_pipeline: Option<&crate::standalone::AuditPipeline>,
-) -> registry_notary_core::EvidenceAuditEvent {
-    let occurred_at = OffsetDateTime::now_utc()
-        .format(&Rfc3339)
-        .unwrap_or_else(|_| "1970-01-01T00:00:00Z".to_string());
-    let federation_peer_id_hash = audit.peer_node_id.as_deref().and_then(|peer_node_id| {
-        audit_pipeline.map(|pipeline| pipeline.hash_principal(peer_node_id))
-    });
-    registry_notary_core::EvidenceAuditEvent {
-        event_id: Ulid::new().to_string(),
-        occurred_at,
-        principal_id_hash: None,
-        scopes_used: audit.scopes_used,
-        decision: audit.decision,
-        method: "POST".to_string(),
-        path: "/federation/v1/evaluations".to_string(),
-        status: response.status().as_u16(),
-        verification_id: audit.verification_id,
-        claim_hash: (!audit.claim_ids.is_empty()).then(|| evidence_claim_hash(&audit.claim_ids)),
-        purposes: None,
-        row_count: response.status().is_success().then_some(1),
-        relay_consultation_count: None,
-        relay_consultation_ids: Vec::new(),
-        forwarded: None,
-        error_code: audit.error_code,
-        access_mode: Some(AccessMode::MachineClient),
-        federation_peer_id_hash,
-        federation_issuer: audit.issuer,
-        federation_profile: audit.profile,
-        federation_purpose: audit.purpose,
-        federation_request_jti_hash: audit.request_jti.as_deref().and_then(|request_jti| {
-            audit_pipeline.map(|pipeline| pipeline.hash_request_identifier(request_jti))
-        }),
-        federation_subject_ref_hash: audit.subject_ref_hash,
-        denial_code: None,
-        token_claim_name: None,
-        correlation_id_hash: crate::standalone::current_request_correlation_id()
-            .as_ref()
-            .and_then(|correlation_id| {
-                audit_pipeline
-                    .map(|pipeline| pipeline.hash_request_identifier(correlation_id.as_str()))
-            }),
-        credential_profile: None,
-        protocol: ConfigMetadata::new(FEDERATION_PROTOCOL_V0_1).ok(),
-        credential_configuration_id: None,
-        holder_binding_mode: None,
-        rate_limit_bucket: None,
-        policy_version: None,
-        policy_hash: None,
-        target_type: None,
-        target_ref_hash: None,
-        requester_type: None,
-        requester_ref_hash: None,
-        redacted_fields: None,
-        batch_items: None,
-        config: None,
-    }
-}
diff --git a/crates/registry-notary-server/src/federation/claims.rs b/crates/registry-notary-server/src/federation/claims.rs
deleted file mode 100644
index 721f5e6e2..000000000
--- a/crates/registry-notary-server/src/federation/claims.rs
+++ /dev/null
@@ -1,272 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-use base64::Engine;
-use registry_notary_core::{
-    FederationConfig, FederationEvaluationProfileConfig, FederationPeerConfig, SubjectRequest,
-    FEDERATION_PROTOCOL_V0_1,
-};
-use registry_platform_oidc::VerifiedToken;
-use serde_json::Value;
-use time::format_description::well_known::Rfc3339;
-use time::OffsetDateTime;
-use ulid::Ulid;
-
-use super::errors::FederationProblem;
-
-pub(super) fn validate_federation_claims(
-    federation: &FederationConfig,
-    peer: &FederationPeerConfig,
-    verified: &VerifiedToken,
-) -> Result<(), FederationProblem> {
-    if verified.claims.sub.as_deref() != Some(peer.node_id.as_str()) {
-        return Err(FederationProblem::invalid_token());
-    }
-    let Some(iat) = verified.claims.iat else {
-        return Err(FederationProblem::invalid_token());
-    };
-    let Some(nbf) = verified.claims.nbf else {
-        return Err(FederationProblem::invalid_token());
-    };
-    let Some(exp) = verified.claims.exp else {
-        return Err(FederationProblem::invalid_token());
-    };
-    if nbf < iat.saturating_sub(federation.clock_leeway_seconds as i64) {
-        return Err(FederationProblem::invalid_token());
-    }
-    let Some(lifetime) = exp.checked_sub(iat).filter(|lifetime| *lifetime > 0) else {
-        return Err(FederationProblem::invalid_token());
-    };
-    if lifetime as u64 > federation.max_request_lifetime_seconds {
-        return Err(FederationProblem::invalid_token());
-    }
-    let jti = string_extra(verified, "jti").ok_or_else(FederationProblem::invalid_token)?;
-    if !Ulid::from_string(jti).is_ok_and(|candidate| candidate.to_string() == jti) {
-        return Err(FederationProblem::invalid_token());
-    }
-    let protocol =
-        string_extra(verified, "protocol").ok_or_else(FederationProblem::invalid_request_owned)?;
-    if protocol != FEDERATION_PROTOCOL_V0_1
-        || !peer
-            .allowed_protocol_versions
-            .iter()
-            .any(|allowed| allowed == protocol)
-    {
-        return Err(FederationProblem::forbidden("protocol is not allowed"));
-    }
-    if string_extra(verified, "action") != Some("evaluate") {
-        return Err(FederationProblem::invalid_request(
-            "action must be evaluate",
-        ));
-    }
-    let profile =
-        string_extra(verified, "profile").ok_or_else(FederationProblem::invalid_request_owned)?;
-    if !peer
-        .allowed_profiles
-        .iter()
-        .any(|allowed| allowed == profile)
-    {
-        return Err(FederationProblem::forbidden("profile is not allowed"));
-    }
-    let purpose =
-        string_extra(verified, "purpose").ok_or_else(FederationProblem::invalid_request_owned)?;
-    if !peer
-        .allowed_purposes
-        .iter()
-        .any(|allowed| allowed == purpose)
-    {
-        return Err(FederationProblem::forbidden("purpose is not allowed"));
-    }
-    Ok(())
-}
-
-pub(super) fn request_subject(
-    verified: &VerifiedToken,
-    profile: &FederationEvaluationProfileConfig,
-) -> Result<SubjectRequest, FederationProblem> {
-    let subject = request_subject_identifier(verified, profile)?;
-    let request = request_object(verified)?;
-    let requested_claims = request
-        .get("claims")
-        .and_then(Value::as_array)
-        .ok_or_else(|| FederationProblem::invalid_request("request.claims is required"))?;
-    if requested_claims.len() != 1
-        || requested_claims.first().and_then(Value::as_str) != Some(profile.claim_id.as_str())
-    {
-        return Err(FederationProblem::forbidden(
-            "request claims do not match profile",
-        ));
-    }
-    Ok(subject)
-}
-
-pub(super) fn request_subject_identifier(
-    verified: &VerifiedToken,
-    profile: &FederationEvaluationProfileConfig,
-) -> Result<SubjectRequest, FederationProblem> {
-    let request = request_object(verified)?;
-    let subject = request
-        .get("subject")
-        .and_then(Value::as_object)
-        .ok_or_else(|| FederationProblem::invalid_request("request.subject is required"))?;
-    let id = subject
-        .get("id")
-        .and_then(Value::as_str)
-        .ok_or_else(|| FederationProblem::invalid_request("request.subject.id is required"))?;
-    let id_type = subject
-        .get("id_type")
-        .and_then(Value::as_str)
-        .ok_or_else(|| FederationProblem::invalid_request("request.subject.id_type is required"))?;
-    if id_type != profile.subject_id_type {
-        return Err(FederationProblem::forbidden(
-            "subject id type is not allowed",
-        ));
-    }
-    Ok(SubjectRequest {
-        id: id.to_string(),
-        id_type: Some(id_type.to_string()),
-    })
-}
-
-fn request_object(
-    verified: &VerifiedToken,
-) -> Result<&serde_json::Map<String, Value>, FederationProblem> {
-    verified
-        .claims
-        .extra
-        .get("request")
-        .and_then(Value::as_object)
-        .ok_or_else(|| FederationProblem::invalid_request("request object is required"))
-}
-
-pub(super) fn claim_result_is_stale(
-    profile: &FederationEvaluationProfileConfig,
-    results: &[registry_notary_core::ClaimResultView],
-) -> bool {
-    let Some(max_age) = profile.max_claim_result_age_seconds else {
-        return false;
-    };
-    if max_age == 0 {
-        return true;
-    }
-    let Some(observed_at) = results
-        .first()
-        .and_then(|result| OffsetDateTime::parse(&result.issued_at, &Rfc3339).ok())
-    else {
-        return true;
-    };
-    let age = OffsetDateTime::now_utc() - observed_at;
-    age > time::Duration::seconds(max_age as i64)
-}
-
-pub(super) fn string_extra<'a>(verified: &'a VerifiedToken, claim: &str) -> Option<&'a str> {
-    verified.claims.extra.get(claim).and_then(Value::as_str)
-}
-
-pub(super) fn string_claim<'a>(claims: &'a Value, claim: &str) -> Option<&'a str> {
-    claims.get(claim).and_then(Value::as_str)
-}
-
-pub(super) fn decode_unverified_jwt_payload(token: &str) -> Result<Value, FederationProblem> {
-    let payload = token
-        .split('.')
-        .nth(1)
-        .ok_or_else(FederationProblem::invalid_token)?;
-    let bytes = URL_SAFE_NO_PAD
-        .decode(payload)
-        .map_err(|_| FederationProblem::invalid_token())?;
-    serde_json::from_slice(&bytes).map_err(|_| FederationProblem::invalid_token())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use registry_platform_oidc::{Claims, VerifiedToken};
-    use serde_json::{json, Map};
-
-    fn federation() -> FederationConfig {
-        FederationConfig {
-            max_request_lifetime_seconds: 300,
-            clock_leeway_seconds: 60,
-            ..FederationConfig::default()
-        }
-    }
-
-    fn peer() -> FederationPeerConfig {
-        FederationPeerConfig {
-            node_id: "did:web:peer.example".to_string(),
-            allowed_protocol_versions: vec![FEDERATION_PROTOCOL_V0_1.to_string()],
-            allowed_profiles: vec!["basic".to_string()],
-            allowed_purposes: vec!["https://purpose.example/federation".to_string()],
-            ..FederationPeerConfig::default()
-        }
-    }
-
-    fn verified_token(iat: i64, nbf: i64, exp: i64) -> VerifiedToken {
-        let mut extra = Map::new();
-        extra.insert("jti".to_string(), json!(Ulid::new().to_string()));
-        extra.insert("protocol".to_string(), json!(FEDERATION_PROTOCOL_V0_1));
-        extra.insert("action".to_string(), json!("evaluate"));
-        extra.insert("profile".to_string(), json!("basic"));
-        extra.insert(
-            "purpose".to_string(),
-            json!("https://purpose.example/federation"),
-        );
-
-        VerifiedToken {
-            claims: Claims {
-                sub: Some("did:web:peer.example".to_string()),
-                iat: Some(iat),
-                nbf: Some(nbf),
-                exp: Some(exp),
-                iss: None,
-                aud: None,
-                azp: None,
-                client_id: None,
-                extra,
-            },
-            matched_client: None,
-            scopes: Vec::new(),
-        }
-    }
-
-    fn validate(iat: i64, nbf: i64, exp: i64) -> Result<(), FederationProblem> {
-        validate_federation_claims(&federation(), &peer(), &verified_token(iat, nbf, exp))
-    }
-
-    #[test]
-    fn accepts_token_with_valid_lifetime() {
-        assert!(validate(1_000, 1_000, 1_300).is_ok());
-    }
-
-    #[test]
-    fn rejects_noncanonical_ulid_jti() {
-        let mut token = verified_token(1_000, 1_000, 1_300);
-        token
-            .claims
-            .extra
-            .insert("jti".to_string(), json!("01j9z6q6q6q6q6q6q6q6q6q6q6"));
-
-        assert!(validate_federation_claims(&federation(), &peer(), &token).is_err());
-    }
-
-    #[test]
-    fn rejects_token_with_equal_exp_and_iat() {
-        assert!(validate(1_000, 1_000, 1_000).is_err());
-    }
-
-    #[test]
-    fn rejects_token_with_exp_before_iat() {
-        assert!(validate(1_000, 1_000, 999).is_err());
-    }
-
-    #[test]
-    fn rejects_token_lifetime_subtraction_overflow() {
-        assert!(validate(i64::MIN, i64::MIN, i64::MAX).is_err());
-    }
-
-    #[test]
-    fn accepts_extreme_values_with_valid_lifetime() {
-        assert!(validate(i64::MAX - 1, i64::MAX - 1, i64::MAX).is_ok());
-    }
-}
diff --git a/crates/registry-notary-server/src/federation/errors.rs b/crates/registry-notary-server/src/federation/errors.rs
deleted file mode 100644
index e7a50350e..000000000
--- a/crates/registry-notary-server/src/federation/errors.rs
+++ /dev/null
@@ -1,120 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use std::time::{Duration, Instant};
-
-use axum::http::{header, HeaderValue, StatusCode};
-use axum::response::{IntoResponse, Json, Response};
-use registry_notary_core::EvidenceError;
-use serde_json::json;
-use ulid::Ulid;
-
-use crate::api::{evidence_detail, evidence_status, evidence_title};
-
-#[derive(Debug)]
-pub(super) struct FederationProblem {
-    pub(super) status: StatusCode,
-    problem_type: String,
-    title: String,
-    detail: String,
-    pub(super) code: String,
-}
-
-impl FederationProblem {
-    pub(super) fn new(status: StatusCode, suffix: &str, title: &str, code: &str) -> Self {
-        Self {
-            status,
-            problem_type: format!("urn:registry-notary:problem:federation:{suffix}"),
-            title: title.to_string(),
-            detail: title.to_ascii_lowercase(),
-            code: code.to_string(),
-        }
-    }
-
-    pub(super) fn invalid_request(detail: &str) -> Self {
-        Self {
-            status: StatusCode::BAD_REQUEST,
-            problem_type: "urn:registry-notary:problem:federation:invalid-request".to_string(),
-            title: "Invalid federation request".to_string(),
-            detail: detail.to_string(),
-            code: "federation.invalid_request".to_string(),
-        }
-    }
-
-    pub(super) fn invalid_request_owned() -> Self {
-        Self::invalid_request("required federation claim is missing")
-    }
-
-    pub(super) fn invalid_token() -> Self {
-        Self::new(
-            StatusCode::UNAUTHORIZED,
-            "invalid-token",
-            "Invalid federation token",
-            "federation.invalid_token",
-        )
-    }
-
-    pub(super) fn forbidden(detail: &str) -> Self {
-        Self {
-            status: StatusCode::FORBIDDEN,
-            problem_type: "urn:registry-notary:problem:federation:forbidden".to_string(),
-            title: "Federation request forbidden".to_string(),
-            detail: detail.to_string(),
-            code: "federation.forbidden".to_string(),
-        }
-    }
-
-    pub(super) fn server_disabled() -> Self {
-        Self::new(
-            StatusCode::NOT_IMPLEMENTED,
-            "disabled",
-            "Federation is disabled",
-            "federation.disabled",
-        )
-    }
-
-    pub(super) fn server_error(detail: &str) -> Self {
-        Self {
-            status: StatusCode::INTERNAL_SERVER_ERROR,
-            problem_type: "urn:registry-notary:problem:federation:server-error".to_string(),
-            title: "Federation server error".to_string(),
-            detail: detail.to_string(),
-            code: "federation.server_error".to_string(),
-        }
-    }
-
-    pub(super) fn from_evidence_error(error: EvidenceError) -> Self {
-        let status = evidence_status(&error);
-        Self {
-            status,
-            problem_type: format!("urn:registry-notary:problem:federation:{}", error.code()),
-            title: evidence_title(&error).to_string(),
-            detail: evidence_detail(&error).to_string(),
-            code: error.audit_code().to_string(),
-        }
-    }
-}
-
-pub(super) fn federation_problem_response(problem: FederationProblem) -> Response {
-    let body = json!({
-        "type": problem.problem_type,
-        "title": problem.title,
-        "status": problem.status.as_u16(),
-        "detail": problem.detail,
-        "code": problem.code,
-        "instance": format!("urn:ulid:{}", Ulid::new()),
-    });
-    let mut response = (problem.status, Json(body)).into_response();
-    response.headers_mut().insert(
-        header::CONTENT_TYPE,
-        HeaderValue::from_static("application/problem+json"),
-    );
-    response
-}
-
-pub(super) async fn apply_denial_latency(started: Instant, minimum_denial_latency_ms: u64) {
-    let floor = Duration::from_millis(minimum_denial_latency_ms);
-    let elapsed = started.elapsed();
-    if elapsed < floor {
-        tokio::time::sleep(floor - elapsed).await;
-    }
-}
diff --git a/crates/registry-notary-server/src/federation/mod.rs b/crates/registry-notary-server/src/federation/mod.rs
deleted file mode 100644
index afb8f3cf2..000000000
--- a/crates/registry-notary-server/src/federation/mod.rs
+++ /dev/null
@@ -1,645 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Federated Registry Notary delegated evaluation routes.
-
-mod audit;
-mod claims;
-mod errors;
-mod runtime;
-mod signing;
-
-use std::collections::BTreeSet;
-use std::sync::Arc;
-use std::time::Instant;
-
-use axum::body::{to_bytes, Body};
-use axum::http::{header, HeaderMap, StatusCode};
-use axum::response::{IntoResponse, Response};
-use axum::routing::post;
-use axum::{Extension, Router};
-use jsonwebtoken::{decode_header, Algorithm};
-use registry_notary_core::{
-    AccessMode, BoundedCorrelationId, ClaimRef, EvaluateRequest, EvaluationCapability,
-    EvidenceAuthProfileId, EvidenceAuthorizationDetails, EvidenceEntity, EvidencePrincipal,
-    FederationEvaluationProfileConfig, FEDERATION_REQUEST_JWT_TYP, FORMAT_CLAIM_RESULT_JSON,
-};
-use registry_platform_crypto::pairwise_subject_ref_hash;
-use registry_platform_oidc::VerifiedToken;
-use registry_platform_replay::{ReplayKey, ReplayScope, RequiredReplayError};
-use time::OffsetDateTime;
-
-use crate::{api::RegistryNotaryApiState, replay::require_replay_insert};
-
-use audit::{federation_audit_event, FederationAuditContext, FederationDeniedOutcome};
-use claims::{
-    claim_result_is_stale, decode_unverified_jwt_payload, request_subject,
-    request_subject_identifier, string_claim, string_extra, validate_federation_claims,
-};
-use errors::{apply_denial_latency, federation_problem_response, FederationProblem};
-pub(crate) use runtime::FederationRuntimeState;
-use signing::{FederationResponseSigner, FederationSignedOutcome};
-
-pub fn federation_router<S>() -> Router<S>
-where
-    S: Clone + Send + Sync + 'static,
-{
-    Router::new().route("/federation/v1/evaluations", post(federated_evaluate))
-}
-
-async fn federated_evaluate(
-    headers: HeaderMap,
-    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
-    body: Body,
-) -> Response {
-    let started = Instant::now();
-    let Some(Extension(state)) = state else {
-        return federation_problem_response(FederationProblem::server_disabled());
-    };
-    let Some(runtime) = state.federation_runtime() else {
-        return StatusCode::NOT_FOUND.into_response();
-    };
-    let outcome =
-        handle_federated_evaluate(&headers, Arc::clone(&state), Arc::clone(&runtime), body).await;
-    finalize_federated_evaluate(
-        outcome,
-        started,
-        state.federation.response_shaping.minimum_denial_latency_ms,
-        &runtime.response_signer,
-        runtime.audit.as_ref(),
-    )
-    .await
-}
-
-async fn finalize_federated_evaluate(
-    outcome: Result<FederationSignedOutcome, FederationDeniedOutcome>,
-    started: Instant,
-    minimum_denial_latency_ms: u64,
-    response_signer: &FederationResponseSigner,
-    audit_pipeline: Option<&crate::standalone::AuditPipeline>,
-) -> Response {
-    let (mut response, audit) = match outcome {
-        Ok(outcome) => outcome.into_response(response_signer).await,
-        Err(denied) => {
-            apply_denial_latency(started, minimum_denial_latency_ms).await;
-            (federation_problem_response(denied.problem), denied.audit)
-        }
-    };
-    if let Some(audit_pipeline) = audit_pipeline {
-        let event = federation_audit_event(&response, audit, Some(audit_pipeline));
-        if let Err(error) = audit_pipeline.emit(&event).await {
-            response = crate::standalone::audit_error_response(error);
-        }
-    }
-    response
-}
-
-async fn handle_federated_evaluate(
-    headers: &HeaderMap,
-    state: Arc<RegistryNotaryApiState>,
-    runtime: Arc<FederationRuntimeState>,
-    body: Body,
-) -> Result<FederationSignedOutcome, FederationDeniedOutcome> {
-    state
-        .enabled_evidence()
-        .map_err(|_| FederationProblem::server_disabled())?;
-    if headers
-        .get(header::CONTENT_TYPE)
-        .and_then(|value| value.to_str().ok())
-        .map(|value| value.split(';').next().unwrap_or_default().trim())
-        != Some("application/jwt")
-    {
-        return Err(FederationProblem::new(
-            StatusCode::UNSUPPORTED_MEDIA_TYPE,
-            "unsupported-media-type",
-            "Federation request content type must be application/jwt",
-            "federation.unsupported_media_type",
-        )
-        .into());
-    }
-    let body = to_bytes(body, state.federation.inbound_body_limit_bytes)
-        .await
-        .map_err(|_| {
-            FederationProblem::new(
-                StatusCode::PAYLOAD_TOO_LARGE,
-                "payload-too-large",
-                "Federation request is too large",
-                "federation.payload_too_large",
-            )
-        })?;
-    let token = std::str::from_utf8(&body)
-        .map(str::trim)
-        .map_err(|_| FederationProblem::invalid_request("request body must be a compact JWS"))?;
-    if token.split('.').count() != 3 {
-        return Err(
-            FederationProblem::invalid_request("request body must be a compact JWS").into(),
-        );
-    }
-    let header = decode_header(token).map_err(|_| FederationProblem::invalid_token())?;
-    if header.alg != Algorithm::EdDSA {
-        return Err(FederationProblem::invalid_token().into());
-    }
-    if header.typ.as_deref() != Some(FEDERATION_REQUEST_JWT_TYP) {
-        return Err(FederationProblem::invalid_token().into());
-    }
-    let kid = header
-        .kid
-        .as_deref()
-        .ok_or_else(FederationProblem::invalid_token)?;
-    if state
-        .federation
-        .emergency_denylist
-        .kids
-        .iter()
-        .any(|denied| denied == kid)
-    {
-        return Err(FederationProblem::forbidden("signing key is denied").into());
-    }
-    let unverified = decode_unverified_jwt_payload(token)?;
-    let issuer = string_claim(&unverified, "iss")
-        .ok_or_else(FederationProblem::invalid_token)?
-        .to_string();
-    let peer = runtime
-        .peers_by_issuer
-        .get(&issuer)
-        .ok_or_else(FederationProblem::invalid_token)?;
-    if state
-        .federation
-        .emergency_denylist
-        .node_ids
-        .iter()
-        .any(|denied| denied == &peer.config.node_id)
-    {
-        return Err(FederationProblem::forbidden("peer node is denied").into());
-    }
-    let verified = peer
-        .verifier
-        .verify(token)
-        .await
-        .map_err(|_| FederationProblem::invalid_token())?;
-    let mut audit_context =
-        verified_federation_audit_context(&state, &runtime, &peer.config, &verified)
-            .map_err(|denied| *denied)?;
-    validate_federation_claims(&state.federation, &peer.config, &verified)
-        .map_err(|problem| audit_context.denied(problem))?;
-    let request_jti = string_extra(&verified, "jti")
-        .ok_or_else(|| audit_context.denied(FederationProblem::invalid_token()))?
-        .to_string();
-    let exp = verified
-        .claims
-        .exp
-        .ok_or_else(|| audit_context.denied(FederationProblem::invalid_token()))?;
-    let protocol = string_extra(&verified, "protocol")
-        .ok_or_else(|| audit_context.denied(FederationProblem::invalid_request_owned()))?
-        .to_string();
-    let profile_id = string_extra(&verified, "profile")
-        .ok_or_else(|| audit_context.denied(FederationProblem::invalid_request_owned()))?
-        .to_string();
-    let purpose = string_extra(&verified, "purpose")
-        .ok_or_else(|| audit_context.denied(FederationProblem::invalid_request_owned()))?
-        .to_string();
-    let replay_scope = ReplayScope::federation_request_jwt(
-        &state.federation.node_id,
-        &peer.config.issuer,
-        &state.federation.node_id,
-        &profile_id,
-    )
-    .map_err(|_| audit_context.denied(FederationProblem::invalid_token()))?;
-    let replay_key = ReplayKey::new(request_jti.as_str())
-        .map_err(|_| audit_context.denied(FederationProblem::invalid_token()))?;
-    let replay_expires_at = OffsetDateTime::from_unix_timestamp(
-        exp.saturating_add(state.federation.clock_leeway_seconds as i64),
-    )
-    .map_err(|_| audit_context.denied(FederationProblem::invalid_token()))?;
-    match require_replay_insert(
-        runtime.replay.as_ref(),
-        &replay_scope,
-        &replay_key,
-        replay_expires_at,
-    )
-    .await
-    {
-        Ok(()) => runtime
-            .metrics
-            .record_replay("federation_request", "accepted"),
-        Err(RequiredReplayError::AlreadySeen) => {
-            runtime
-                .metrics
-                .record_replay("federation_request", "replayed");
-            return Err(audit_context.denied(FederationProblem::new(
-                StatusCode::CONFLICT,
-                "replay",
-                "Federation request replay detected",
-                "federation.replay",
-            )));
-        }
-        Err(RequiredReplayError::Store { .. }) => {
-            runtime.metrics.record_replay("federation_request", "error");
-            return Err(audit_context.denied(FederationProblem::server_error(
-                "required replay protection failed",
-            )));
-        }
-        Err(_) => {
-            runtime.metrics.record_replay("federation_request", "error");
-            return Err(audit_context.denied(FederationProblem::server_error(
-                "required replay protection failed",
-            )));
-        }
-    }
-    let profile = state
-        .federation
-        .evaluation_profiles
-        .iter()
-        .find(|candidate| candidate.id == profile_id)
-        .ok_or_else(|| {
-            audit_context.denied(FederationProblem::forbidden("profile is not allowed"))
-        })?;
-    audit_context.claim_ids = vec![profile.claim_id.clone()];
-    let subject =
-        request_subject(&verified, profile).map_err(|problem| audit_context.denied(problem))?;
-    let principal = federation_principal(&peer.config, profile);
-    let evaluation_capability = EvaluationCapability::Machine {
-        scopes: peer
-            .config
-            .evaluation_scopes
-            .iter()
-            .cloned()
-            .collect::<BTreeSet<_>>(),
-    };
-    let request = EvaluateRequest {
-        requester: None,
-        target: Some(EvidenceEntity::from_subject_request(
-            "Person",
-            subject.clone(),
-        )),
-        relationship: None,
-        on_behalf_of: None,
-        variables: Default::default(),
-        claims: vec![ClaimRef::from(profile.claim_id.clone())],
-        disclosure: Some(
-            profile
-                .disclosure
-                .clone()
-                .unwrap_or_else(|| "redacted".to_string()),
-        ),
-        format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-        purpose: Some(purpose.clone()),
-    };
-    let subject_hash = pairwise_subject_ref_hash(
-        runtime.pairwise_subject_hash_secret.as_slice(),
-        &peer.config.node_id,
-        &state.federation.node_id,
-        &profile.id,
-        subject.id_type.as_deref().unwrap_or(""),
-        &subject.id,
-    )
-    .map_err(|_| {
-        audit_context.denied(FederationProblem::server_error(
-            "failed to hash subject reference",
-        ))
-    })?;
-    audit_context.subject_ref_hash = Some(subject_hash.clone());
-    let runtime_eval = state.runtime();
-    let correlation_id = BoundedCorrelationId::new(request_jti.to_string()).map_err(|_| {
-        audit_context.denied(FederationProblem::server_error(
-            "verified request jti exceeds the correlation identifier bound",
-        ))
-    })?;
-    let results = runtime_eval
-        .evaluate_with_capability(
-            Arc::clone(&state.evidence),
-            &state.store,
-            &principal,
-            evaluation_capability,
-            request,
-            None,
-            None,
-            Some(correlation_id),
-        )
-        .await
-        .map_err(|error| audit_context.denied(FederationProblem::from_evidence_error(error)))?;
-    if claim_result_is_stale(profile, &results) {
-        return Ok(FederationSignedOutcome::evaluation_error(
-            &state.federation,
-            &peer.config,
-            &protocol,
-            profile,
-            &purpose,
-            &request_jti,
-            subject_hash,
-            "urn:registry-notary:problem:federation:stale-claim-result",
-            "Claim result is stale",
-        ));
-    }
-    Ok(FederationSignedOutcome::success(
-        &state.federation,
-        &peer.config,
-        &protocol,
-        profile,
-        &purpose,
-        &request_jti,
-        subject.id_type.as_deref().unwrap_or(""),
-        subject_hash,
-        &results,
-    ))
-}
-
-fn verified_federation_audit_context(
-    state: &RegistryNotaryApiState,
-    runtime: &FederationRuntimeState,
-    peer: &registry_notary_core::FederationPeerConfig,
-    verified: &VerifiedToken,
-) -> Result<FederationAuditContext, Box<FederationDeniedOutcome>> {
-    let mut context = FederationAuditContext::from_verified(peer, verified);
-    let Some(profile_id) = context.profile.as_deref() else {
-        return Ok(context);
-    };
-    if !peer
-        .allowed_profiles
-        .iter()
-        .any(|allowed| allowed == profile_id)
-    {
-        return Ok(context);
-    }
-    let Some(profile) = state
-        .federation
-        .evaluation_profiles
-        .iter()
-        .find(|candidate| candidate.id == profile_id)
-    else {
-        return Ok(context);
-    };
-    context.claim_ids = vec![profile.claim_id.clone()];
-    let Ok(subject) = request_subject_identifier(verified, profile) else {
-        return Ok(context);
-    };
-    let subject_hash = pairwise_subject_ref_hash(
-        runtime.pairwise_subject_hash_secret.as_slice(),
-        &peer.node_id,
-        &state.federation.node_id,
-        &profile.id,
-        subject.id_type.as_deref().unwrap_or(""),
-        &subject.id,
-    )
-    .map_err(|_| {
-        Box::new(context.denied(FederationProblem::server_error(
-            "failed to hash subject reference",
-        )))
-    })?;
-    context.subject_ref_hash = Some(subject_hash);
-    Ok(context)
-}
-
-fn federation_authorization_details(
-    profile: &FederationEvaluationProfileConfig,
-) -> Option<EvidenceAuthorizationDetails> {
-    if profile.legal_basis_ref.is_none()
-        && profile.consent_ref.is_none()
-        && profile.jurisdiction.is_none()
-        && profile.assurance_level.is_none()
-    {
-        return None;
-    }
-    Some(EvidenceAuthorizationDetails {
-        detail_type: "registry-notary/evidence-authorization/v1".to_string(),
-        schema_version: "v1".to_string(),
-        legal_basis_ref: profile.legal_basis_ref.clone(),
-        consent_ref: profile.consent_ref.clone(),
-        jurisdiction: profile.jurisdiction.clone(),
-        assurance_level: profile.assurance_level.clone(),
-        ..EvidenceAuthorizationDetails::default()
-    })
-}
-
-fn federation_principal(
-    peer: &registry_notary_core::FederationPeerConfig,
-    profile: &FederationEvaluationProfileConfig,
-) -> EvidencePrincipal {
-    EvidencePrincipal {
-        auth_profile_id: EvidenceAuthProfileId::Federation,
-        principal_id: peer.node_id.clone(),
-        scopes: peer.evaluation_scopes.clone(),
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: federation_authorization_details(profile),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use async_trait::async_trait;
-    use axum::http::HeaderValue;
-    use registry_notary_core::{FederationConfig, FederationPeerConfig, FEDERATION_PROTOCOL_V0_1};
-    use registry_platform_audit::{
-        AuditChainHasher, AuditEnvelope, AuditError, AuditSink as PlatformAuditSink,
-    };
-    use registry_platform_crypto::{
-        PrivateJwk, PublicJwk, SigningAlgorithm, SigningError, SigningProvider,
-    };
-    use registry_platform_testing::fixtures;
-    use serde_json::json;
-    use std::sync::atomic::{AtomicUsize, Ordering};
-    use tokio::sync::Mutex;
-
-    use crate::standalone::AuditPipeline;
-
-    #[derive(Default)]
-    struct MemoryAuditSink {
-        envelopes: Mutex<Vec<AuditEnvelope>>,
-    }
-
-    #[async_trait]
-    impl PlatformAuditSink for MemoryAuditSink {
-        async fn write(&self, envelope: &AuditEnvelope) -> Result<(), AuditError> {
-            self.envelopes.lock().await.push(envelope.clone());
-            Ok(())
-        }
-
-        async fn tail_hash(&self) -> Result<Option<[u8; 32]>, AuditError> {
-            Ok(self
-                .envelopes
-                .lock()
-                .await
-                .last()
-                .map(|envelope| envelope.record_hash))
-        }
-
-        async fn tail_hash_with_hasher(
-            &self,
-            _hasher: &AuditChainHasher,
-        ) -> Result<Option<[u8; 32]>, AuditError> {
-            Ok(self
-                .envelopes
-                .lock()
-                .await
-                .last()
-                .map(|envelope| envelope.record_hash))
-        }
-    }
-
-    struct FailingSigningProvider {
-        attempts: Arc<AtomicUsize>,
-    }
-
-    #[async_trait]
-    impl SigningProvider for FailingSigningProvider {
-        fn algorithm(&self) -> SigningAlgorithm {
-            SigningAlgorithm::EdDsa
-        }
-
-        fn key_id(&self) -> &str {
-            "registry-platform-testing-ed25519-1"
-        }
-
-        fn public_jwk(&self) -> PublicJwk {
-            PrivateJwk::parse(fixtures::ED25519_PRIVATE_JWK)
-                .expect("fixture private JWK parses")
-                .public()
-        }
-
-        async fn sign(&self, _payload: &[u8]) -> Result<Vec<u8>, SigningError> {
-            self.attempts.fetch_add(1, Ordering::SeqCst);
-            Err(SigningError::external("forced federation signing failure"))
-        }
-    }
-
-    #[tokio::test]
-    async fn federation_response_signing_failure_emits_denial_audit_with_context() {
-        let federation = FederationConfig {
-            node_id: "did:web:agency-a.example.gov".to_string(),
-            issuer: "https://agency-a.example.gov".to_string(),
-            ..FederationConfig::default()
-        };
-        let peer = FederationPeerConfig {
-            node_id: "did:web:agency-b.example.gov".to_string(),
-            issuer: "https://agency-b.example.gov".to_string(),
-            evaluation_scopes: vec!["farmer_registry:evidence_verification".to_string()],
-            ..FederationPeerConfig::default()
-        };
-        let profile = FederationEvaluationProfileConfig {
-            id: "farmer_under_4ha".to_string(),
-            claim_id: "farmer-under-4ha".to_string(),
-            ..FederationEvaluationProfileConfig::default()
-        };
-        let request_jti = "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6";
-        let outcome = FederationSignedOutcome::evaluation_error(
-            &federation,
-            &peer,
-            FEDERATION_PROTOCOL_V0_1,
-            &profile,
-            "https://purpose.example.test/eligibility",
-            request_jti,
-            "hmac-sha256:subject".to_string(),
-            "urn:registry-notary:problem:federation:stale-claim-result",
-            "Claim result is stale",
-        );
-        let attempts = Arc::new(AtomicUsize::new(0));
-        let signer = FederationResponseSigner {
-            provider: Arc::new(FailingSigningProvider {
-                attempts: Arc::clone(&attempts),
-            }),
-        };
-        let sink = Arc::new(MemoryAuditSink::default());
-        let audit_pipeline = AuditPipeline::for_sink_dev_only(sink.clone());
-
-        let response = finalize_federated_evaluate(
-            Ok(outcome),
-            Instant::now(),
-            0,
-            &signer,
-            Some(&audit_pipeline),
-        )
-        .await;
-
-        assert_eq!(attempts.load(Ordering::SeqCst), 1);
-        assert_eq!(response.status(), StatusCode::INTERNAL_SERVER_ERROR);
-        assert_eq!(
-            response.headers().get(header::CONTENT_TYPE),
-            Some(&HeaderValue::from_static("application/problem+json"))
-        );
-        let envelopes = sink.envelopes.lock().await;
-        assert_eq!(envelopes.len(), 1);
-        let record = &envelopes[0].record;
-        assert_eq!(record["decision"], json!("federated_evaluate_denied"));
-        assert_eq!(record["status"], json!(500));
-        assert_eq!(record["error_code"], json!("federation.server_error"));
-        assert!(record["claim_hash"].is_string());
-        assert_eq!(
-            record["scopes_used"],
-            json!(["farmer_registry:evidence_verification"])
-        );
-        assert!(record["federation_peer_id_hash"].is_string());
-        assert_eq!(
-            record["federation_issuer"],
-            json!("https://agency-b.example.gov")
-        );
-        assert_eq!(record["federation_profile"], json!("farmer_under_4ha"));
-        assert_eq!(
-            record["federation_purpose"],
-            json!("https://purpose.example.test/eligibility")
-        );
-        assert!(record["federation_request_jti_hash"].is_string());
-        assert_eq!(
-            record["federation_subject_ref_hash"],
-            json!("hmac-sha256:subject")
-        );
-        let serialized = serde_json::to_string(record).expect("audit record serializes");
-        assert!(!serialized.contains("did:web:agency-b.example.gov"));
-        assert!(!serialized.contains(request_jti));
-    }
-
-    #[test]
-    fn federation_profile_can_supply_trusted_policy_context() {
-        let profile = FederationEvaluationProfileConfig {
-            id: "beneficiary_active_predicate".to_string(),
-            legal_basis_ref: Some("demo:child-support-eligibility".to_string()),
-            consent_ref: Some("demo:child-support-consent".to_string()),
-            jurisdiction: Some("ZZ".to_string()),
-            assurance_level: Some("substantial".to_string()),
-            ..FederationEvaluationProfileConfig::default()
-        };
-
-        let details = federation_authorization_details(&profile)
-            .expect("profile context should produce authorization details");
-
-        assert_eq!(
-            details.detail_type,
-            "registry-notary/evidence-authorization/v1"
-        );
-        assert_eq!(details.schema_version, "v1");
-        assert_eq!(details.purpose.as_deref(), None);
-        assert_eq!(
-            details.legal_basis_ref.as_deref(),
-            Some("demo:child-support-eligibility")
-        );
-        assert_eq!(
-            details.consent_ref.as_deref(),
-            Some("demo:child-support-consent")
-        );
-        assert_eq!(details.jurisdiction.as_deref(), Some("ZZ"));
-        assert_eq!(details.assurance_level.as_deref(), Some("substantial"));
-        assert!(!crate::authz_details::has_transaction_scope(&details));
-    }
-
-    #[test]
-    fn federation_principal_uses_stable_federation_profile() {
-        let peer = FederationPeerConfig {
-            node_id: "did:web:agency-b.example.gov".to_string(),
-            evaluation_scopes: vec!["farmer_registry:evidence_verification".to_string()],
-            ..FederationPeerConfig::default()
-        };
-        let profile = FederationEvaluationProfileConfig::default();
-
-        let principal = federation_principal(&peer, &profile);
-
-        assert_eq!(principal.auth_profile_id, EvidenceAuthProfileId::Federation);
-        assert_eq!(principal.principal_id, peer.node_id);
-        assert_eq!(principal.scopes, peer.evaluation_scopes);
-    }
-
-    #[test]
-    fn federation_profile_without_policy_context_uses_peer_scopes_only() {
-        let profile = FederationEvaluationProfileConfig::default();
-
-        assert!(federation_authorization_details(&profile).is_none());
-    }
-}
diff --git a/crates/registry-notary-server/src/federation/runtime.rs b/crates/registry-notary-server/src/federation/runtime.rs
deleted file mode 100644
index 6ef7d0e23..000000000
--- a/crates/registry-notary-server/src/federation/runtime.rs
+++ /dev/null
@@ -1,203 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use std::collections::HashMap;
-use std::{env, sync::Arc, time::Duration};
-
-use jsonwebtoken::Algorithm;
-use registry_notary_core::{FederationConfig, FederationPeerConfig, FEDERATION_REQUEST_JWT_TYP};
-use registry_platform_crypto::SigningProvider;
-use registry_platform_httputil::FetchUrlPolicy;
-use registry_platform_oidc::{JwksFetcher, JwksFetcherConfig, TokenVerifier, TokenVerifierConfig};
-use registry_platform_replay::ReplayStore;
-
-use super::signing::FederationResponseSigner;
-use crate::metrics::AppMetrics;
-
-#[derive(Clone)]
-pub(crate) struct FederationRuntimeState {
-    pub(super) response_signer: FederationResponseSigner,
-    pub(super) pairwise_subject_hash_secret: Arc<Vec<u8>>,
-    pub(super) peers_by_issuer: Arc<HashMap<String, FederationResolvedPeer>>,
-    pub(super) replay: Arc<dyn ReplayStore>,
-    pub(super) metrics: Arc<AppMetrics>,
-    pub(super) audit: Option<crate::standalone::AuditPipeline>,
-}
-
-#[derive(Clone)]
-pub(super) struct FederationResolvedPeer {
-    pub(super) config: FederationPeerConfig,
-    pub(super) verifier: Arc<TokenVerifier>,
-}
-
-impl FederationRuntimeState {
-    pub(crate) fn from_config(
-        config: &FederationConfig,
-        signing_provider: Arc<dyn SigningProvider>,
-        audit: Option<crate::standalone::AuditPipeline>,
-        replay: Arc<dyn ReplayStore>,
-        metrics: Arc<AppMetrics>,
-    ) -> Result<Self, crate::standalone::StandaloneServerError> {
-        let pairwise_subject_hash_secret = env::var(&config.pairwise_subject_hash.secret_env)
-            .ok()
-            .filter(|value| !value.is_empty())
-            .ok_or_else(|| {
-                crate::standalone::StandaloneServerError::MissingFederationSecretEnv(
-                    config.pairwise_subject_hash.secret_env.clone(),
-                )
-            })?
-            .into_bytes();
-        let mut peers_by_issuer = HashMap::new();
-        for peer in &config.peers {
-            let fetch_url_policy = if peer.allow_insecure_private_network {
-                FetchUrlPolicy {
-                    allowed_schemes: vec!["http".to_string(), "https".to_string()],
-                    allow_localhost: true,
-                    allow_http_private_network: true,
-                    deny_private_ranges: false,
-                    deny_cloud_metadata: true,
-                }
-            } else if peer.allow_insecure_localhost {
-                FetchUrlPolicy::dev()
-            } else {
-                FetchUrlPolicy::strict()
-            };
-            let fetcher = Arc::new(JwksFetcher::new_with_fetch_url_policy(
-                peer.jwks_uri.clone(),
-                JwksFetcherConfig::defaults(),
-                fetch_url_policy,
-            ));
-            let verifier = Arc::new(TokenVerifier::new(
-                TokenVerifierConfig::registry_notary_federation_request_profile(
-                    peer.issuer.clone(),
-                    config.node_id.clone(),
-                    vec![Algorithm::EdDSA],
-                    FEDERATION_REQUEST_JWT_TYP,
-                )
-                .with_leeway(Duration::from_secs(config.clock_leeway_seconds)),
-                fetcher,
-            ));
-            peers_by_issuer.insert(
-                peer.issuer.clone(),
-                FederationResolvedPeer {
-                    config: peer.clone(),
-                    verifier,
-                },
-            );
-        }
-        Ok(Self {
-            response_signer: FederationResponseSigner {
-                provider: signing_provider,
-            },
-            pairwise_subject_hash_secret: Arc::new(pairwise_subject_hash_secret),
-            peers_by_issuer: Arc::new(peers_by_issuer),
-            replay,
-            metrics,
-            audit,
-        })
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use registry_notary_core::{
-        FederationEvaluationProfileConfig, FederationPairwiseSubjectHashConfig,
-        FederationSigningConfig, FEDERATION_PROTOCOL_V0_1,
-    };
-    use registry_platform_replay::InMemoryReplayStore;
-    use registry_platform_testing::{fixtures, sign_ed25519_compact_jwt, MockIdp};
-    use serde_json::json;
-    use time::OffsetDateTime;
-
-    fn test_federation_config(peer_issuer: &str, peer_jwks_uri: &str) -> FederationConfig {
-        FederationConfig {
-            enabled: true,
-            node_id: "did:web:agency-a.example.gov".to_string(),
-            issuer: "https://agency-a.example.gov".to_string(),
-            jwks_uri: "https://agency-a.example.gov/federation/jwks.json".to_string(),
-            federation_api: "https://agency-a.example.gov/federation/v1".to_string(),
-            supported_protocol_versions: vec![FEDERATION_PROTOCOL_V0_1.to_string()],
-            signing: FederationSigningConfig {
-                signing_key: "federation-key".to_string(),
-            },
-            pairwise_subject_hash: FederationPairwiseSubjectHashConfig {
-                secret_env: "TEST_FEDERATION_RUNTIME_PAIRWISE_SECRET".to_string(),
-            },
-            peers: vec![FederationPeerConfig {
-                node_id: "did:web:agency-b.example.gov".to_string(),
-                issuer: peer_issuer.to_string(),
-                jwks_uri: peer_jwks_uri.to_string(),
-                allow_insecure_localhost: true,
-                allowed_protocol_versions: vec![FEDERATION_PROTOCOL_V0_1.to_string()],
-                allowed_purposes: vec!["https://purpose.example.test/eligibility".to_string()],
-                allowed_profiles: vec!["farmer_under_4ha".to_string()],
-                evaluation_scopes: vec!["farmer_registry:evidence_verification".to_string()],
-                ..FederationPeerConfig::default()
-            }],
-            evaluation_profiles: vec![FederationEvaluationProfileConfig {
-                id: "farmer_under_4ha".to_string(),
-                ruleset: "farmer-under-4ha-v1".to_string(),
-                claim_id: "farmer-under-4ha".to_string(),
-                subject_id_type: "national_id".to_string(),
-                ..FederationEvaluationProfileConfig::default()
-            }],
-            ..FederationConfig::default()
-        }
-    }
-
-    fn federation_token(issuer: &str, typ: &str) -> String {
-        let now = OffsetDateTime::now_utc().unix_timestamp();
-        sign_ed25519_compact_jwt(
-            fixtures::ED25519_PRIVATE_JWK,
-            typ,
-            "registry-platform-testing-ed25519-1",
-            json!({
-                "iss": issuer,
-                "sub": "did:web:agency-b.example.gov",
-                "aud": "did:web:agency-a.example.gov",
-                "scope": "farmer_registry:evidence_verification",
-                "iat": now,
-                "nbf": now,
-                "exp": now + 300,
-                "jti": "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q999",
-            }),
-        )
-    }
-
-    #[tokio::test]
-    async fn federation_runtime_verifier_accepts_only_federation_request_typ() {
-        std::env::set_var(
-            "TEST_FEDERATION_RUNTIME_PAIRWISE_SECRET",
-            "federation-pairwise-secret",
-        );
-        let idp = MockIdp::start().await;
-        let config = test_federation_config(&idp.issuer(), &idp.jwks_uri());
-        let runtime = FederationRuntimeState::from_config(
-            &config,
-            Arc::new(fixtures::ed25519_signer()),
-            None,
-            Arc::new(InMemoryReplayStore::new()),
-            Arc::new(AppMetrics::default()),
-        )
-        .expect("federation runtime builds");
-        let peer = runtime
-            .peers_by_issuer
-            .get(&idp.issuer())
-            .expect("peer verifier is registered");
-
-        peer.verifier
-            .verify(&federation_token(&idp.issuer(), FEDERATION_REQUEST_JWT_TYP))
-            .await
-            .expect("federation request typ is accepted");
-        peer.verifier
-            .verify(&federation_token(&idp.issuer(), "JWT"))
-            .await
-            .expect_err("plain JWT typ is rejected for federation");
-        peer.verifier
-            .verify(&federation_token(&idp.issuer(), "id_token"))
-            .await
-            .expect_err("ID token typ is rejected for federation");
-
-        idp.stop().await;
-    }
-}
diff --git a/crates/registry-notary-server/src/federation/signing.rs b/crates/registry-notary-server/src/federation/signing.rs
deleted file mode 100644
index bcb090864..000000000
--- a/crates/registry-notary-server/src/federation/signing.rs
+++ /dev/null
@@ -1,220 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use axum::http::{header, HeaderValue, StatusCode};
-use axum::response::{IntoResponse, Response};
-use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-use base64::Engine;
-use registry_notary_core::{
-    FederationConfig, FederationEvaluationProfileConfig, FederationPeerConfig,
-    FEDERATION_RESPONSE_JWT_TYP,
-};
-use registry_platform_crypto::SigningProvider;
-use serde_json::{json, Map, Value};
-use std::sync::Arc;
-use time::OffsetDateTime;
-use ulid::Ulid;
-
-use super::audit::FederationAuditOutcome;
-use super::errors::{federation_problem_response, FederationProblem};
-
-#[derive(Debug)]
-pub(super) struct FederationSignedOutcome {
-    claims: Value,
-    audit: FederationAuditOutcome,
-}
-
-impl FederationSignedOutcome {
-    #[allow(clippy::too_many_arguments)]
-    pub(super) fn success(
-        federation: &FederationConfig,
-        peer: &FederationPeerConfig,
-        protocol: &str,
-        profile: &FederationEvaluationProfileConfig,
-        purpose: &str,
-        request_jti: &str,
-        subject_id_type: &str,
-        subject_hash: String,
-        results: &[registry_notary_core::ClaimResultView],
-    ) -> Self {
-        let now = OffsetDateTime::now_utc().unix_timestamp();
-        let evaluation_id = results
-            .first()
-            .map(|result| format!("eval_{}", result.evaluation_id))
-            .unwrap_or_else(|| format!("eval_{}", Ulid::new()));
-        let mut claims = Map::new();
-        for result in results {
-            claims.insert(
-                result.claim_id.clone(),
-                json!({
-                    "satisfied": result.satisfied,
-                    "disclosure": result.disclosure,
-                    "value": result.value,
-                }),
-            );
-        }
-        let claim_result_issued_at = results.first().map(|result| result.issued_at.clone());
-        let subject_ref_hash = subject_hash;
-        let body = federation_base_response_claims(
-            federation,
-            peer,
-            protocol,
-            &profile.id,
-            request_jti,
-            now,
-            "result",
-            json!({
-                "evaluation_id": evaluation_id,
-                "subject_ref": {
-                    "hash": subject_ref_hash.clone(),
-                    "id_type": subject_id_type,
-                },
-                "claim_result_issued_at": claim_result_issued_at,
-                "claims": Value::Object(claims),
-            }),
-        );
-        Self {
-            claims: body,
-            audit: FederationAuditOutcome {
-                decision: "federated_evaluate".to_string(),
-                verification_id: Some(evaluation_id),
-                claim_ids: vec![profile.claim_id.clone()],
-                scopes_used: peer.evaluation_scopes.clone(),
-                error_code: None,
-                peer_node_id: Some(peer.node_id.clone()),
-                issuer: Some(peer.issuer.clone()),
-                profile: Some(profile.id.clone()),
-                purpose: Some(purpose.to_string()),
-                request_jti: Some(request_jti.to_string()),
-                subject_ref_hash: Some(subject_ref_hash),
-            },
-        }
-    }
-
-    #[allow(clippy::too_many_arguments)]
-    pub(super) fn evaluation_error(
-        federation: &FederationConfig,
-        peer: &FederationPeerConfig,
-        protocol: &str,
-        profile: &FederationEvaluationProfileConfig,
-        purpose: &str,
-        request_jti: &str,
-        subject_hash: String,
-        error_type: &str,
-        title: &str,
-    ) -> Self {
-        let now = OffsetDateTime::now_utc().unix_timestamp();
-        let body = federation_base_response_claims(
-            federation,
-            peer,
-            protocol,
-            &profile.id,
-            request_jti,
-            now,
-            "error",
-            json!({
-                "type": error_type,
-                "title": title,
-                "code": "federation.stale_claim_result",
-            }),
-        );
-        Self {
-            claims: body,
-            audit: FederationAuditOutcome {
-                decision: "federated_evaluate_error".to_string(),
-                verification_id: None,
-                claim_ids: vec![profile.claim_id.clone()],
-                scopes_used: peer.evaluation_scopes.clone(),
-                error_code: Some("federation.stale_claim_result".to_string()),
-                peer_node_id: Some(peer.node_id.clone()),
-                issuer: Some(peer.issuer.clone()),
-                profile: Some(profile.id.clone()),
-                purpose: Some(purpose.to_string()),
-                request_jti: Some(request_jti.to_string()),
-                subject_ref_hash: Some(subject_hash),
-            },
-        }
-    }
-
-    pub(super) async fn into_response(
-        self,
-        signer: &FederationResponseSigner,
-    ) -> (Response, FederationAuditOutcome) {
-        match sign_federation_response(signer, &self.claims).await {
-            Ok(jwt) => {
-                let mut response = (StatusCode::OK, jwt).into_response();
-                response.headers_mut().insert(
-                    header::CONTENT_TYPE,
-                    HeaderValue::from_static("application/jwt"),
-                );
-                (response, self.audit)
-            }
-            Err(problem) => {
-                let audit = self.audit.into_denied(&problem);
-                (federation_problem_response(problem), audit)
-            }
-        }
-    }
-}
-
-#[allow(clippy::too_many_arguments)]
-fn federation_base_response_claims(
-    federation: &FederationConfig,
-    peer: &FederationPeerConfig,
-    protocol: &str,
-    profile_id: &str,
-    request_jti: &str,
-    now: i64,
-    body_field: &str,
-    result: Value,
-) -> Value {
-    let mut claims = Map::from_iter([
-        ("iss".to_string(), json!(federation.issuer)),
-        ("sub".to_string(), json!(federation.node_id)),
-        ("aud".to_string(), json!(peer.node_id)),
-        ("iat".to_string(), json!(now)),
-        ("nbf".to_string(), json!(now)),
-        ("exp".to_string(), json!(now + 300)),
-        ("jti".to_string(), json!(Ulid::new().to_string())),
-        ("request_jti".to_string(), json!(request_jti)),
-        ("protocol".to_string(), json!(protocol)),
-        ("action".to_string(), json!("evaluate")),
-        ("profile".to_string(), json!(profile_id)),
-    ]);
-    claims.insert(body_field.to_string(), result);
-    Value::Object(claims)
-}
-
-async fn sign_federation_response(
-    signer: &FederationResponseSigner,
-    claims: &Value,
-) -> Result<String, FederationProblem> {
-    let header = json!({
-        "alg": "EdDSA",
-        "typ": FEDERATION_RESPONSE_JWT_TYP,
-        "kid": signer.provider.key_id(),
-    });
-    let signing_input = format!(
-        "{}.{}",
-        URL_SAFE_NO_PAD.encode(serde_json::to_vec(&header).map_err(|_| {
-            FederationProblem::server_error("failed to encode response header")
-        })?),
-        URL_SAFE_NO_PAD.encode(serde_json::to_vec(claims).map_err(|_| {
-            FederationProblem::server_error("failed to encode response claims")
-        })?)
-    );
-    let signature = signer
-        .provider
-        .sign(signing_input.as_bytes())
-        .await
-        .map_err(|_| FederationProblem::server_error("failed to sign response"))?;
-    Ok(format!(
-        "{}.{}",
-        signing_input,
-        URL_SAFE_NO_PAD.encode(signature)
-    ))
-}
-
-#[derive(Clone)]
-pub(super) struct FederationResponseSigner {
-    pub(super) provider: Arc<dyn SigningProvider>,
-}
diff --git a/crates/registry-notary-server/src/json_path.rs b/crates/registry-notary-server/src/json_path.rs
deleted file mode 100644
index 3967827f7..000000000
--- a/crates/registry-notary-server/src/json_path.rs
+++ /dev/null
@@ -1,46 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! JSON Pointer and dotted-path lookup for verified Relay projections and evaluation.
-
-use serde_json::Value;
-
-pub(crate) fn get_json_path<'a>(value: &'a Value, path: &str) -> Option<&'a Value> {
-    if path.starts_with('/') {
-        return value.pointer(path);
-    }
-    let mut current = value;
-    for part in path.split('.') {
-        if part.is_empty() {
-            return None;
-        }
-        current = match current {
-            Value::Array(values) => values.get(part.parse::<usize>().ok()?)?,
-            _ => current.get(part)?,
-        };
-    }
-    Some(current)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use serde_json::json;
-
-    #[test]
-    fn resolves_pointer_dotted_and_array_paths() {
-        let value = json!({
-            "message": {
-                "records": [{ "id": "person-1" }]
-            }
-        });
-
-        assert_eq!(
-            get_json_path(&value, "/message/records/0/id"),
-            Some(&json!("person-1"))
-        );
-        assert_eq!(
-            get_json_path(&value, "message.records.0.id"),
-            Some(&json!("person-1"))
-        );
-        assert_eq!(get_json_path(&value, "message..records"), None);
-    }
-}
diff --git a/crates/registry-notary-server/src/lib.rs b/crates/registry-notary-server/src/lib.rs
deleted file mode 100644
index 8195e3e7f..000000000
--- a/crates/registry-notary-server/src/lib.rs
+++ /dev/null
@@ -1,62 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Standalone Registry Notary runtime.
-
-// The OpenAPI document is a single large `json!` literal; the pre-authorized-code
-// paths push its expansion past the default macro recursion limit.
-#![recursion_limit = "256"]
-
-pub mod api;
-pub(crate) mod authz_details;
-#[cfg(feature = "registry-notary-cel")]
-pub mod cel_worker;
-pub mod config_governed;
-pub(crate) mod credential_status;
-pub(crate) mod digest;
-pub mod docs;
-pub(crate) mod federation;
-pub(crate) mod json_path;
-pub mod machine_quota;
-pub(crate) mod metrics;
-pub mod openapi;
-pub(crate) mod posture;
-pub(crate) mod preauth_state;
-pub(crate) mod problem;
-pub(crate) mod relay_client;
-pub(crate) mod relay_contract;
-#[cfg(feature = "relay-contract-test-support")]
-#[doc(hidden)]
-pub mod relay_contract_test_support;
-pub(crate) mod replay;
-pub(crate) mod request_context;
-pub(crate) mod response_context;
-pub mod runtime;
-pub mod standalone;
-pub mod state_plane;
-pub mod subject_access_rate_limit;
-
-pub(crate) use problem::PROBLEM_TYPE_BASE_URL;
-
-pub use api::{
-    router, EvidenceAuditContext, EvidenceErrorCodeContext, EvidenceIssuerResolver,
-    RegistryNotaryApiState, AUDIT_CHAIN_INCONSISTENT_CODE,
-};
-pub use machine_quota::{MachineQuotaExceeded, MachineQuotaLimiter};
-pub use openapi::openapi_document;
-pub use runtime::{
-    claim_summary, credential_profile_for, find_claim, format_time, formats, BatchEvaluateOptions,
-    EvidenceStore, RegistryNotaryRuntime,
-};
-pub use standalone::{
-    compile_notary_runtime, compile_notary_runtime_with_provenance,
-    emit_prepare_state_store_mutation_intent_audit, emit_product_action_mutation_intent_audit,
-    notary_admin_router_from_runtime, notary_public_router_from_runtime,
-    notary_routers_from_runtime, notary_shared_router_from_runtime, standalone_router,
-    verify_relay_from_config, EvidenceIssuerRegistry, NotaryActivationCode,
-    NotaryActivationCodeDefinition, NotaryActivationCodeLifecycle, NotaryActivationFailure,
-    NotaryRouters, NotaryRuntimeSnapshot, PrepareStateStoreAuditEvidence, StandaloneServerError,
-    NOTARY_ACTIVATION_CODE_DEFINITIONS,
-};
-pub use subject_access_rate_limit::{
-    SubjectAccessRateLimitBucket, SubjectAccessRateLimitError, SubjectAccessRateLimitKeys,
-    SubjectAccessRateLimiter,
-};
diff --git a/crates/registry-notary-server/src/machine_quota.rs b/crates/registry-notary-server/src/machine_quota.rs
deleted file mode 100644
index 28620fbb4..000000000
--- a/crates/registry-notary-server/src/machine_quota.rs
+++ /dev/null
@@ -1,1130 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Quota for machine (non-subject-access) `evaluate` and `batch_evaluate`
-//! traffic. PostgreSQL is authoritative when a state plane is configured;
-//! the bounded in-memory path remains for local and test deployments.
-//!
-//! Budget is counted in subjects per principal over a fixed one-minute
-//! window: a single `/v1/evaluations` call consumes 1, a batch consumes
-//! `items.len()`. A request whose cost would cross the remaining budget is
-//! rejected whole so the response stays deterministic and no partial
-//! evaluation work is ever performed for a rejected request.
-//!
-//! Subject-access principals never reach this limiter; enforcement in
-//! `api.rs` only calls it for principals that failed
-//! [`registry_notary_core::model::EvidencePrincipal::is_subject_access`].
-
-use std::{
-    collections::HashMap,
-    sync::{Arc, Mutex},
-};
-
-use registry_notary_core::{Bounded, MachineQuotaConfig};
-use registry_platform_audit::AuditKeyHasher;
-use time::{Duration, OffsetDateTime};
-
-use crate::state_plane::NotaryStatePlaneHandle;
-
-const MAX_MACHINE_QUOTA_KEY_LEN: usize = 128;
-
-/// Upper bound on the number of distinct principals tracked at once. Once
-/// this many principals are being tracked, adding a new one evicts the
-/// least-recently-started window so the map cannot grow without bound.
-const MAX_TRACKED_PRINCIPALS: usize = 10_000;
-const MAX_TRACKED_OPERATIONS: usize = 65_536;
-
-const WINDOW: Duration = Duration::minutes(1);
-pub(crate) const OPERATION_LEASE_SECONDS: i64 = 60;
-const OPERATION_LEASE: Duration = Duration::seconds(OPERATION_LEASE_SECONDS);
-
-type MachineQuotaKey = Bounded<MAX_MACHINE_QUOTA_KEY_LEN>;
-
-/// The machine quota budget was exhausted for a principal.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct MachineQuotaExceeded {
-    pub retry_after_seconds: u64,
-}
-
-#[derive(Debug, Clone)]
-pub(crate) enum MachineQuotaOperationOutcome {
-    Acquired(MachineQuotaOperationFence),
-    Existing,
-    Conflict,
-}
-
-#[derive(Debug, Clone)]
-pub(crate) struct MachineQuotaOperationFence {
-    principal_key: MachineQuotaKey,
-    principal_hash: [u8; 32],
-    operation_hash: [u8; 32],
-    request_hash: [u8; 32],
-    lease_owner_hash: [u8; 32],
-    in_memory: Option<Arc<Mutex<InMemoryQuotaState>>>,
-}
-
-#[derive(Debug)]
-struct Counter {
-    window_start: OffsetDateTime,
-    used: u32,
-}
-
-#[derive(Debug, Default)]
-struct InMemoryQuotaState {
-    counters: HashMap<MachineQuotaKey, Counter>,
-    operations: HashMap<(MachineQuotaKey, [u8; 32]), QuotaOperation>,
-}
-
-#[derive(Debug)]
-struct QuotaOperation {
-    request_hash: [u8; 32],
-    lease_owner_hash: [u8; 32],
-    lease_expires_at: OffsetDateTime,
-    expires_at: OffsetDateTime,
-}
-
-impl MachineQuotaOperationFence {
-    pub(crate) fn principal_hash(&self) -> &[u8; 32] {
-        &self.principal_hash
-    }
-
-    pub(crate) fn operation_hash(&self) -> &[u8; 32] {
-        &self.operation_hash
-    }
-
-    pub(crate) fn lease_owner_hash(&self) -> &[u8; 32] {
-        &self.lease_owner_hash
-    }
-
-    pub(crate) fn complete_in_memory<T>(&self, operation: impl FnOnce() -> T) -> Result<T, ()> {
-        self.complete_in_memory_at(OffsetDateTime::now_utc(), operation)
-    }
-
-    fn complete_in_memory_at<T>(
-        &self,
-        now: OffsetDateTime,
-        operation: impl FnOnce() -> T,
-    ) -> Result<T, ()> {
-        let Some(in_memory) = self.in_memory.as_ref() else {
-            return Err(());
-        };
-        let state = match in_memory.lock() {
-            Ok(guard) => guard,
-            Err(poisoned) => poisoned.into_inner(),
-        };
-        let Some(stored) = state
-            .operations
-            .get(&(self.principal_key.clone(), self.operation_hash))
-        else {
-            return Err(());
-        };
-        if stored.request_hash != self.request_hash
-            || stored.lease_owner_hash != self.lease_owner_hash
-            || stored.lease_expires_at <= now
-        {
-            return Err(());
-        }
-        Ok(operation())
-    }
-}
-
-impl Counter {
-    fn in_window(&self, now: OffsetDateTime) -> bool {
-        now < self.window_start + WINDOW
-    }
-
-    /// Seconds until the current window rolls over, rounded up so callers
-    /// never see a zero-second hint while still inside the window.
-    fn retry_after_seconds(&self, now: OffsetDateTime) -> u64 {
-        let remaining = (self.window_start + WINDOW) - now;
-        remaining.whole_seconds().max(1) as u64
-    }
-}
-
-/// Fixed-window quota limiter keyed by an audit pseudonym of `principal_id`,
-/// with a single bucket kind and cost-aware consumption.
-#[derive(Debug)]
-pub struct MachineQuotaLimiter {
-    config: MachineQuotaConfig,
-    state_plane: Option<Arc<NotaryStatePlaneHandle>>,
-    principal_hasher: AuditKeyHasher,
-    in_memory: Arc<Mutex<InMemoryQuotaState>>,
-}
-
-impl MachineQuotaLimiter {
-    #[must_use]
-    pub fn new(config: MachineQuotaConfig) -> Self {
-        Self {
-            config,
-            state_plane: None,
-            principal_hasher: AuditKeyHasher::unkeyed_dev_only(),
-            in_memory: Arc::new(Mutex::new(InMemoryQuotaState::default())),
-        }
-    }
-
-    #[must_use]
-    pub(crate) fn with_state_plane(
-        config: MachineQuotaConfig,
-        state_plane: Arc<NotaryStatePlaneHandle>,
-        principal_hasher: AuditKeyHasher,
-    ) -> Self {
-        Self {
-            config,
-            state_plane: Some(state_plane),
-            principal_hasher,
-            in_memory: Arc::new(Mutex::new(InMemoryQuotaState::default())),
-        }
-    }
-
-    /// Atomically check and consume `cost` subjects from `principal_id`'s
-    /// budget. When the quota is disabled this always succeeds. A `cost`
-    /// that would exceed the remaining budget is rejected in full: nothing
-    /// is consumed, so the caller may retry with a smaller batch (or wait
-    /// out the window) without having partially spent its quota.
-    pub async fn check_and_consume(
-        &self,
-        principal_id: &str,
-        cost: u32,
-    ) -> Result<(), MachineQuotaExceeded> {
-        if !self.config.enabled || cost == 0 {
-            return Ok(());
-        }
-        validate_principal_id(principal_id)?;
-        let Some(state_plane) = self
-            .state_plane
-            .as_ref()
-            .filter(|state_plane| !state_plane.is_in_memory())
-        else {
-            return self.check_and_consume_at(principal_id, cost, OffsetDateTime::now_utc());
-        };
-        self.check_and_consume_postgres(state_plane, principal_id, cost)
-            .await
-    }
-
-    /// Consume quota once for one canonical operation. Concurrent exact
-    /// retries share the operation hash, so only the first attempt spends
-    /// budget. One leased owner may reach the authoritative reservation;
-    /// contenders wait or take over without another debit.
-    pub(crate) async fn check_and_consume_once(
-        &self,
-        principal_id: &str,
-        cost: u32,
-        operation_id: &str,
-        request_id: &str,
-        lease_owner_id: &str,
-        operation_expires_at: OffsetDateTime,
-    ) -> Result<MachineQuotaOperationOutcome, MachineQuotaExceeded> {
-        validate_principal_id(principal_id)?;
-        if cost == 0 {
-            return Err(quota_failure());
-        }
-        let operation_hash = machine_quota_operation_hash(&self.principal_hasher, operation_id)?;
-        let request_hash = machine_quota_operation_request_hash(request_id)?;
-        let lease_owner_hash =
-            machine_quota_operation_owner_hash(&self.principal_hasher, lease_owner_id)?;
-        if operation_expires_at <= OffsetDateTime::now_utc() {
-            return Err(quota_failure());
-        }
-        let Some(state_plane) = self
-            .state_plane
-            .as_ref()
-            .filter(|state_plane| !state_plane.is_in_memory())
-        else {
-            return self.check_and_consume_once_at(
-                principal_id,
-                cost,
-                Some(operation_hash),
-                Some(request_hash),
-                Some(lease_owner_hash),
-                Some(operation_expires_at),
-                OffsetDateTime::now_utc(),
-            );
-        };
-        self.check_and_consume_once_postgres(
-            state_plane,
-            principal_id,
-            cost,
-            &operation_hash,
-            &request_hash,
-            &lease_owner_hash,
-            operation_expires_at,
-        )
-        .await
-    }
-
-    /// Release only the operation claim after a post-debit failure. The quota
-    /// debit is intentionally retained, so retries cannot turn signer or
-    /// construction failures into free work.
-    pub(crate) async fn release_operation(
-        &self,
-        principal_id: &str,
-        operation_id: &str,
-        lease_owner_id: &str,
-    ) -> Result<(), MachineQuotaExceeded> {
-        validate_principal_id(principal_id)?;
-        let operation_hash = machine_quota_operation_hash(&self.principal_hasher, operation_id)?;
-        let lease_owner_hash =
-            machine_quota_operation_owner_hash(&self.principal_hasher, lease_owner_id)?;
-        let Some(state_plane) = self
-            .state_plane
-            .as_ref()
-            .filter(|state_plane| !state_plane.is_in_memory())
-        else {
-            let key = MachineQuotaKey::new(principal_id).map_err(|_| quota_failure())?;
-            let mut state = match self.in_memory.lock() {
-                Ok(guard) => guard,
-                Err(poisoned) => poisoned.into_inner(),
-            };
-            if let Some(operation) = state.operations.get_mut(&(key, operation_hash)) {
-                if operation.lease_owner_hash == lease_owner_hash {
-                    operation.lease_expires_at = OffsetDateTime::now_utc();
-                }
-            }
-            return Ok(());
-        };
-        let principal_hash = machine_quota_hash(&self.principal_hasher, principal_id)?;
-        let runtime = state_plane.runtime().map_err(|_| quota_failure())?;
-        let session = runtime
-            .open_domain_session()
-            .await
-            .map_err(|_| quota_failure())?;
-        session
-            .run_operation(session.client().query_one(
-                "SELECT registry_notary_api.machine_quota_operation_release_v1($1, $2, $3)",
-                &[
-                    &principal_hash,
-                    &&operation_hash[..],
-                    &&lease_owner_hash[..],
-                ],
-            ))
-            .await
-            .map_err(|_| quota_failure())?;
-        Ok(())
-    }
-
-    #[must_use]
-    pub(crate) const fn is_enabled(&self) -> bool {
-        self.config.enabled
-    }
-
-    fn operation_fence(
-        &self,
-        principal_id: &str,
-        operation_hash: [u8; 32],
-        request_hash: [u8; 32],
-        lease_owner_hash: [u8; 32],
-        in_memory: bool,
-    ) -> Result<MachineQuotaOperationFence, MachineQuotaExceeded> {
-        Ok(MachineQuotaOperationFence {
-            principal_key: MachineQuotaKey::new(principal_id).map_err(|_| quota_failure())?,
-            principal_hash: machine_quota_hash(&self.principal_hasher, principal_id)?
-                .try_into()
-                .map_err(|_| quota_failure())?,
-            operation_hash,
-            request_hash,
-            lease_owner_hash,
-            in_memory: in_memory.then(|| Arc::clone(&self.in_memory)),
-        })
-    }
-
-    pub(crate) fn batch_reservation_parameters(
-        &self,
-        principal_id: &str,
-        cost: u32,
-    ) -> Result<(Vec<u8>, Option<i32>, i32), MachineQuotaExceeded> {
-        validate_principal_id(principal_id)?;
-        let principal_hash = machine_quota_hash(&self.principal_hasher, principal_id)?;
-        let cost = i32::try_from(cost)
-            .ok()
-            .filter(|cost| *cost > 0)
-            .ok_or_else(quota_failure)?;
-        let limit = self
-            .config
-            .enabled
-            .then(|| i32::try_from(self.config.subjects_per_minute).ok())
-            .flatten()
-            .filter(|limit| *limit > 0);
-        if self.config.enabled && limit.is_none() {
-            return Err(quota_failure());
-        }
-        Ok((principal_hash, limit, cost))
-    }
-
-    async fn check_and_consume_postgres(
-        &self,
-        state_plane: &NotaryStatePlaneHandle,
-        principal_id: &str,
-        cost: u32,
-    ) -> Result<(), MachineQuotaExceeded> {
-        let limit = i32::try_from(self.config.subjects_per_minute)
-            .ok()
-            .filter(|limit| *limit > 0)
-            .ok_or_else(quota_failure)?;
-        let cost = i32::try_from(cost)
-            .ok()
-            .filter(|cost| *cost > 0)
-            .ok_or_else(quota_failure)?;
-        let principal_hash = machine_quota_hash(&self.principal_hasher, principal_id)?;
-        let runtime = state_plane.runtime().map_err(|_| quota_failure())?;
-        let session = runtime
-            .open_domain_session()
-            .await
-            .map_err(|_| quota_failure())?;
-        let row = session
-            .run_operation(session.client().query_one(
-                concat!(
-                    "SELECT allowed, retry_after_seconds ",
-                    "FROM registry_notary_api.machine_quota_debit_v1($1, $2, $3)"
-                ),
-                &[&principal_hash, &limit, &cost],
-            ))
-            .await
-            .map_err(|_| quota_failure())?;
-        let allowed: bool = row.try_get("allowed").map_err(|_| quota_failure())?;
-        if allowed {
-            return Ok(());
-        }
-        let retry_after_seconds: i64 = row
-            .try_get("retry_after_seconds")
-            .map_err(|_| quota_failure())?;
-        Err(MachineQuotaExceeded {
-            retry_after_seconds: retry_after_seconds.max(1) as u64,
-        })
-    }
-
-    // Keep each hash explicit at the trust boundary so operation, request,
-    // and owner identities cannot be accidentally substituted or reordered.
-    #[allow(clippy::too_many_arguments)]
-    async fn check_and_consume_once_postgres(
-        &self,
-        state_plane: &NotaryStatePlaneHandle,
-        principal_id: &str,
-        cost: u32,
-        operation_hash: &[u8; 32],
-        request_hash: &[u8; 32],
-        lease_owner_hash: &[u8; 32],
-        operation_expires_at: OffsetDateTime,
-    ) -> Result<MachineQuotaOperationOutcome, MachineQuotaExceeded> {
-        let limit = if self.config.enabled {
-            Some(
-                i32::try_from(self.config.subjects_per_minute)
-                    .ok()
-                    .filter(|limit| *limit > 0)
-                    .ok_or_else(quota_failure)?,
-            )
-        } else {
-            None
-        };
-        let cost = i32::try_from(cost)
-            .ok()
-            .filter(|cost| *cost > 0)
-            .ok_or_else(quota_failure)?;
-        let principal_hash = machine_quota_hash(&self.principal_hasher, principal_id)?;
-        let runtime = state_plane.runtime().map_err(|_| quota_failure())?;
-        let session = runtime
-            .open_domain_session()
-            .await
-            .map_err(|_| quota_failure())?;
-        let row = session
-            .run_operation(session.client().query_one(
-                concat!(
-                    "SELECT allowed, acquired, conflict, retry_after_seconds ",
-                    "FROM registry_notary_api.machine_quota_debit_once_v1(",
-                    "$1, $2, $3, $4, $5, $6, $7, $8)"
-                ),
-                &[
-                    &principal_hash,
-                    &&operation_hash[..],
-                    &&request_hash[..],
-                    &&lease_owner_hash[..],
-                    &limit,
-                    &cost,
-                    &(OPERATION_LEASE.whole_seconds() as i32),
-                    &operation_expires_at,
-                ],
-            ))
-            .await
-            .map_err(|_| quota_failure())?;
-        let allowed: bool = row.try_get("allowed").map_err(|_| quota_failure())?;
-        if allowed {
-            let conflict: bool = row.try_get("conflict").map_err(|_| quota_failure())?;
-            if conflict {
-                return Ok(MachineQuotaOperationOutcome::Conflict);
-            }
-            let acquired: bool = row.try_get("acquired").map_err(|_| quota_failure())?;
-            return Ok(if acquired {
-                MachineQuotaOperationOutcome::Acquired(self.operation_fence(
-                    principal_id,
-                    *operation_hash,
-                    *request_hash,
-                    *lease_owner_hash,
-                    false,
-                )?)
-            } else {
-                MachineQuotaOperationOutcome::Existing
-            });
-        }
-        let retry_after_seconds: i64 = row
-            .try_get("retry_after_seconds")
-            .map_err(|_| quota_failure())?;
-        Err(MachineQuotaExceeded {
-            retry_after_seconds: retry_after_seconds.max(1) as u64,
-        })
-    }
-
-    fn check_and_consume_at(
-        &self,
-        principal_id: &str,
-        cost: u32,
-        now: OffsetDateTime,
-    ) -> Result<(), MachineQuotaExceeded> {
-        if !self.config.enabled || cost == 0 {
-            return Ok(());
-        }
-        self.check_and_consume_once_at(principal_id, cost, None, None, None, None, now)
-            .map(|_| ())
-    }
-
-    // Tests inject every clock and identity component independently to cover
-    // takeover and stale-owner behavior without wall-clock sleeps.
-    #[allow(clippy::too_many_arguments)]
-    fn check_and_consume_once_at(
-        &self,
-        principal_id: &str,
-        cost: u32,
-        operation_hash: Option<[u8; 32]>,
-        request_hash: Option<[u8; 32]>,
-        lease_owner_hash: Option<[u8; 32]>,
-        operation_expires_at: Option<OffsetDateTime>,
-        now: OffsetDateTime,
-    ) -> Result<MachineQuotaOperationOutcome, MachineQuotaExceeded> {
-        if cost == 0 {
-            return Err(quota_failure());
-        }
-
-        // A principal id that does not fit the bounded key is treated as
-        // over quota rather than silently bypassing the limiter: this is a
-        // denial surface, so failures must fail closed.
-        let key = match MachineQuotaKey::new(principal_id) {
-            Ok(key) => key,
-            Err(_) => {
-                return Err(MachineQuotaExceeded {
-                    retry_after_seconds: WINDOW.whole_seconds() as u64,
-                })
-            }
-        };
-
-        let mut state = match self.in_memory.lock() {
-            Ok(guard) => guard,
-            Err(poisoned) => poisoned.into_inner(),
-        };
-        prune_expired(&mut state, now);
-
-        let operation = operation_hash
-            .zip(request_hash)
-            .zip(lease_owner_hash)
-            .zip(operation_expires_at)
-            .map(
-                |(((operation_hash, request_hash), lease_owner_hash), operation_expires_at)| {
-                    (
-                        (key.clone(), operation_hash),
-                        request_hash,
-                        lease_owner_hash,
-                        operation_expires_at,
-                    )
-                },
-            );
-        if operation_hash.is_some() != operation.is_some()
-            || request_hash.is_some() != operation.is_some()
-            || lease_owner_hash.is_some() != operation.is_some()
-            || operation_expires_at.is_some() != operation.is_some()
-        {
-            return Err(quota_failure());
-        }
-        if let Some((operation_key, request_hash, lease_owner_hash, _)) = operation.as_ref() {
-            if let Some(stored) = state.operations.get_mut(operation_key) {
-                if stored.request_hash != *request_hash {
-                    return Ok(MachineQuotaOperationOutcome::Conflict);
-                }
-                if stored.lease_owner_hash == *lease_owner_hash || stored.lease_expires_at <= now {
-                    stored.lease_owner_hash = *lease_owner_hash;
-                    stored.lease_expires_at =
-                        std::cmp::min(now + OPERATION_LEASE, stored.expires_at);
-                    return Ok(MachineQuotaOperationOutcome::Acquired(
-                        self.operation_fence(
-                            principal_id,
-                            operation_key.1,
-                            *request_hash,
-                            *lease_owner_hash,
-                            true,
-                        )?,
-                    ));
-                }
-                return Ok(MachineQuotaOperationOutcome::Existing);
-            }
-        }
-        if operation.is_some() && state.operations.len() >= MAX_TRACKED_OPERATIONS {
-            return Err(quota_failure());
-        }
-
-        if self.config.enabled {
-            let limit = self.config.subjects_per_minute;
-            let (window_start, used) = match state.counters.get(&key) {
-                Some(counter) if counter.in_window(now) => (counter.window_start, counter.used),
-                _ => (now, 0),
-            };
-
-            let remaining = limit.saturating_sub(used);
-            if cost > remaining {
-                let retry_after_seconds = match state.counters.get(&key) {
-                    Some(counter) if counter.in_window(now) => counter.retry_after_seconds(now),
-                    _ => WINDOW.whole_seconds() as u64,
-                };
-                return Err(MachineQuotaExceeded {
-                    retry_after_seconds,
-                });
-            }
-
-            if !state.counters.contains_key(&key) {
-                evict_oldest_if_at_capacity(&mut state.counters);
-            }
-            state.counters.insert(
-                key,
-                Counter {
-                    window_start,
-                    used: used + cost,
-                },
-            );
-        }
-        if let Some((operation_key, request_hash, lease_owner_hash, operation_expires_at)) =
-            operation
-        {
-            state.operations.insert(
-                operation_key,
-                QuotaOperation {
-                    request_hash,
-                    lease_owner_hash,
-                    lease_expires_at: std::cmp::min(now + OPERATION_LEASE, operation_expires_at),
-                    expires_at: operation_expires_at,
-                },
-            );
-        }
-        let Some(operation_hash) = operation_hash else {
-            return Ok(MachineQuotaOperationOutcome::Existing);
-        };
-        Ok(MachineQuotaOperationOutcome::Acquired(
-            self.operation_fence(
-                principal_id,
-                operation_hash,
-                request_hash.ok_or_else(quota_failure)?,
-                lease_owner_hash.ok_or_else(quota_failure)?,
-                true,
-            )?,
-        ))
-    }
-
-    #[cfg(test)]
-    fn tracked_principal_count(&self) -> usize {
-        self.in_memory
-            .lock()
-            .expect("counter mutex is not poisoned")
-            .counters
-            .len()
-    }
-
-    #[cfg(test)]
-    fn is_tracked(&self, principal_id: &str) -> bool {
-        let key = MachineQuotaKey::new(principal_id).expect("test principal id is bounded");
-        self.in_memory
-            .lock()
-            .expect("counter mutex is not poisoned")
-            .counters
-            .contains_key(&key)
-    }
-}
-
-fn validate_principal_id(principal_id: &str) -> Result<(), MachineQuotaExceeded> {
-    MachineQuotaKey::new(principal_id)
-        .map(|_| ())
-        .map_err(|_| quota_failure())
-}
-
-fn quota_failure() -> MachineQuotaExceeded {
-    MachineQuotaExceeded {
-        retry_after_seconds: WINDOW.whole_seconds() as u64,
-    }
-}
-
-fn machine_quota_hash(
-    hasher: &AuditKeyHasher,
-    principal_id: &str,
-) -> Result<Vec<u8>, MachineQuotaExceeded> {
-    let encoded = hasher
-        .audit_reference_hash("notary-machine-quota-v1", "", principal_id)
-        .map_err(|_| quota_failure())?;
-    let digest = encoded
-        .strip_prefix("hmac-sha256:")
-        .or_else(|| encoded.strip_prefix("sha256:"))
-        .ok_or_else(quota_failure)?;
-    decode_32_byte_hex(digest).ok_or_else(quota_failure)
-}
-
-fn machine_quota_operation_hash(
-    hasher: &AuditKeyHasher,
-    operation_id: &str,
-) -> Result<[u8; 32], MachineQuotaExceeded> {
-    if operation_id.is_empty() || operation_id.len() > 512 {
-        return Err(quota_failure());
-    }
-    let encoded = hasher
-        .audit_reference_hash("notary-machine-quota-operation-v1", "", operation_id)
-        .map_err(|_| quota_failure())?;
-    let digest = encoded
-        .strip_prefix("hmac-sha256:")
-        .or_else(|| encoded.strip_prefix("sha256:"))
-        .ok_or_else(quota_failure)?;
-    decode_32_byte_hex(digest)
-        .ok_or_else(quota_failure)?
-        .try_into()
-        .map_err(|_| quota_failure())
-}
-
-fn machine_quota_operation_request_hash(
-    request_id: &str,
-) -> Result<[u8; 32], MachineQuotaExceeded> {
-    let digest = request_id
-        .strip_prefix("sha256:")
-        .ok_or_else(quota_failure)?;
-    decode_32_byte_hex(digest)
-        .ok_or_else(quota_failure)?
-        .try_into()
-        .map_err(|_| quota_failure())
-}
-
-fn machine_quota_operation_owner_hash(
-    hasher: &AuditKeyHasher,
-    lease_owner_id: &str,
-) -> Result<[u8; 32], MachineQuotaExceeded> {
-    if lease_owner_id.is_empty() || lease_owner_id.len() > 256 {
-        return Err(quota_failure());
-    }
-    let encoded = hasher
-        .audit_reference_hash(
-            "notary-machine-quota-operation-owner-v1",
-            "",
-            lease_owner_id,
-        )
-        .map_err(|_| quota_failure())?;
-    let digest = encoded
-        .strip_prefix("hmac-sha256:")
-        .or_else(|| encoded.strip_prefix("sha256:"))
-        .ok_or_else(quota_failure)?;
-    decode_32_byte_hex(digest)
-        .ok_or_else(quota_failure)?
-        .try_into()
-        .map_err(|_| quota_failure())
-}
-
-fn decode_32_byte_hex(encoded: &str) -> Option<Vec<u8>> {
-    if encoded.len() != 64 {
-        return None;
-    }
-    encoded
-        .as_bytes()
-        .chunks_exact(2)
-        .map(|pair| {
-            let high = hex_nibble(pair[0])?;
-            let low = hex_nibble(pair[1])?;
-            Some((high << 4) | low)
-        })
-        .collect()
-}
-
-fn hex_nibble(value: u8) -> Option<u8> {
-    match value {
-        b'0'..=b'9' => Some(value - b'0'),
-        b'a'..=b'f' => Some(value - b'a' + 10),
-        b'A'..=b'F' => Some(value - b'A' + 10),
-        _ => None,
-    }
-}
-
-fn prune_expired(state: &mut InMemoryQuotaState, now: OffsetDateTime) {
-    state.counters.retain(|_, counter| counter.in_window(now));
-    state
-        .operations
-        .retain(|_, operation| operation.expires_at > now);
-}
-
-fn evict_oldest_if_at_capacity(counters: &mut HashMap<MachineQuotaKey, Counter>) {
-    if counters.len() < MAX_TRACKED_PRINCIPALS {
-        return;
-    }
-    if let Some(oldest_key) = counters
-        .iter()
-        .min_by_key(|(_, counter)| counter.window_start)
-        .map(|(key, _)| key.clone())
-    {
-        counters.remove(&oldest_key);
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn now() -> OffsetDateTime {
-        OffsetDateTime::from_unix_timestamp(1_700_000_000).expect("fixed timestamp is valid")
-    }
-
-    fn config(enabled: bool, subjects_per_minute: u32) -> MachineQuotaConfig {
-        MachineQuotaConfig {
-            enabled,
-            subjects_per_minute,
-        }
-    }
-
-    fn acquired(
-        outcome: Result<MachineQuotaOperationOutcome, MachineQuotaExceeded>,
-    ) -> MachineQuotaOperationFence {
-        match outcome.expect("operation succeeds") {
-            MachineQuotaOperationOutcome::Acquired(fence) => fence,
-            other => panic!("expected acquired operation, got {other:?}"),
-        }
-    }
-
-    #[test]
-    fn disabled_quota_never_denies() {
-        let limiter = MachineQuotaLimiter::new(config(false, 1));
-        for _ in 0..1000 {
-            assert!(limiter
-                .check_and_consume_at("machine-a", 1_000_000, now())
-                .is_ok());
-        }
-    }
-
-    #[test]
-    fn exact_boundary_batch_exhausts_then_next_call_fails() {
-        let limiter = MachineQuotaLimiter::new(config(true, 10));
-
-        assert!(limiter.check_and_consume_at("machine-a", 10, now()).is_ok());
-
-        let err = limiter
-            .check_and_consume_at("machine-a", 1, now())
-            .expect_err("budget is exhausted");
-        assert_eq!(err.retry_after_seconds, 60);
-    }
-
-    #[test]
-    fn exact_operation_retries_consume_quota_once() {
-        let limiter = MachineQuotaLimiter::new(config(true, 1));
-        let exact_operation = [0x11; 32];
-        let distinct_operation = [0x22; 32];
-        let exact_request = [0x21; 32];
-
-        assert!(limiter
-            .check_and_consume_once_at(
-                "machine-a",
-                1,
-                Some(exact_operation),
-                Some(exact_request),
-                Some([0x31; 32]),
-                Some(now() + Duration::minutes(5)),
-                now(),
-            )
-            .is_ok());
-        assert!(matches!(
-            limiter
-                .check_and_consume_once_at(
-                    "machine-a",
-                    1,
-                    Some(exact_operation),
-                    Some(exact_request),
-                    Some([0x32; 32]),
-                    Some(now() + Duration::minutes(5)),
-                    now(),
-                )
-                .unwrap(),
-            MachineQuotaOperationOutcome::Existing
-        ));
-        assert!(matches!(
-            limiter
-                .check_and_consume_once_at(
-                    "machine-a",
-                    1,
-                    Some(exact_operation),
-                    Some([0x23; 32]),
-                    Some([0x32; 32]),
-                    Some(now() + Duration::minutes(5)),
-                    now(),
-                )
-                .unwrap(),
-            MachineQuotaOperationOutcome::Conflict
-        ));
-        assert!(limiter
-            .check_and_consume_once_at(
-                "machine-a",
-                1,
-                Some(distinct_operation),
-                Some([0x24; 32]),
-                Some([0x33; 32]),
-                Some(now() + Duration::minutes(5)),
-                now(),
-            )
-            .is_err());
-        acquired(limiter.check_and_consume_once_at(
-            "machine-a",
-            1,
-            Some(exact_operation),
-            Some(exact_request),
-            Some([0x32; 32]),
-            Some(now() + Duration::minutes(5)),
-            now() + Duration::seconds(61),
-        ));
-    }
-
-    #[test]
-    fn operation_identity_outlives_the_quota_window() {
-        let limiter = MachineQuotaLimiter::new(config(true, 1));
-        let exact_operation = [0x33; 32];
-
-        assert!(limiter
-            .check_and_consume_once_at(
-                "machine-a",
-                1,
-                Some(exact_operation),
-                Some([0x34; 32]),
-                Some([0x41; 32]),
-                Some(now() + Duration::minutes(5)),
-                now(),
-            )
-            .is_ok());
-        let next_window = now() + Duration::seconds(61);
-        acquired(limiter.check_and_consume_once_at(
-            "machine-a",
-            1,
-            Some(exact_operation),
-            Some([0x34; 32]),
-            Some([0x42; 32]),
-            Some(now() + Duration::minutes(5)),
-            next_window,
-        ));
-        assert!(limiter
-            .check_and_consume_once_at(
-                "machine-a",
-                1,
-                Some([0x44; 32]),
-                Some([0x35; 32]),
-                Some([0x43; 32]),
-                Some(now() + Duration::minutes(5)),
-                next_window,
-            )
-            .is_ok());
-    }
-
-    #[test]
-    fn owner_renewal_keeps_contenders_outside_the_completion_window() {
-        let limiter = MachineQuotaLimiter::new(config(true, 1));
-        let operation = [0x51; 32];
-        let request = [0x52; 32];
-        let owner = [0x53; 32];
-        let contender = [0x54; 32];
-        let expires_at = now() + Duration::minutes(5);
-
-        acquired(limiter.check_and_consume_once_at(
-            "machine-a",
-            1,
-            Some(operation),
-            Some(request),
-            Some(owner),
-            Some(expires_at),
-            now(),
-        ));
-        let renewed_fence = acquired(limiter.check_and_consume_once_at(
-            "machine-a",
-            1,
-            Some(operation),
-            Some(request),
-            Some(owner),
-            Some(expires_at),
-            now() + Duration::seconds(25),
-        ));
-        assert!(matches!(
-            limiter
-                .check_and_consume_once_at(
-                    "machine-a",
-                    1,
-                    Some(operation),
-                    Some(request),
-                    Some(contender),
-                    Some(expires_at),
-                    now() + Duration::seconds(61),
-                )
-                .unwrap(),
-            MachineQuotaOperationOutcome::Existing
-        ));
-        let takeover_fence = acquired(limiter.check_and_consume_once_at(
-            "machine-a",
-            1,
-            Some(operation),
-            Some(request),
-            Some(contender),
-            Some(expires_at),
-            now() + Duration::seconds(86),
-        ));
-        assert!(
-            renewed_fence
-                .complete_in_memory_at(now() + Duration::seconds(86), || ())
-                .is_err(),
-            "a stale owner is fenced after crash-style lease takeover",
-        );
-        assert!(takeover_fence
-            .complete_in_memory_at(now() + Duration::seconds(86), || ())
-            .is_ok());
-    }
-
-    #[test]
-    fn disabled_quota_still_serializes_idempotent_operations() {
-        let limiter = MachineQuotaLimiter::new(config(false, 1));
-        let operation = [0x61; 32];
-        let request = [0x62; 32];
-        acquired(limiter.check_and_consume_once_at(
-            "machine-a",
-            1,
-            Some(operation),
-            Some(request),
-            Some([0x63; 32]),
-            Some(now() + Duration::minutes(5)),
-            now(),
-        ));
-        assert!(matches!(
-            limiter
-                .check_and_consume_once_at(
-                    "machine-a",
-                    1,
-                    Some(operation),
-                    Some(request),
-                    Some([0x64; 32]),
-                    Some(now() + Duration::minutes(5)),
-                    now(),
-                )
-                .unwrap(),
-            MachineQuotaOperationOutcome::Existing
-        ));
-        assert!(matches!(
-            limiter
-                .check_and_consume_once_at(
-                    "machine-a",
-                    1,
-                    Some(operation),
-                    Some([0x65; 32]),
-                    Some([0x64; 32]),
-                    Some(now() + Duration::minutes(5)),
-                    now(),
-                )
-                .unwrap(),
-            MachineQuotaOperationOutcome::Conflict
-        ));
-        assert_eq!(limiter.tracked_principal_count(), 0);
-    }
-
-    #[test]
-    fn window_expiry_resets_budget() {
-        let limiter = MachineQuotaLimiter::new(config(true, 10));
-        assert!(limiter.check_and_consume_at("machine-a", 10, now()).is_ok());
-
-        // Still inside the window: exhausted.
-        assert!(limiter
-            .check_and_consume_at("machine-a", 1, now() + Duration::seconds(59))
-            .is_err());
-
-        // Window has rolled over: budget resets.
-        assert!(limiter
-            .check_and_consume_at("machine-a", 10, now() + Duration::seconds(61))
-            .is_ok());
-    }
-
-    #[test]
-    fn cost_greater_than_remaining_rejects_whole_batch_without_partial_consumption() {
-        let limiter = MachineQuotaLimiter::new(config(true, 10));
-        assert!(limiter.check_and_consume_at("machine-a", 4, now()).is_ok());
-
-        // 8 would push used from 4 to 12, over the limit of 10: rejected,
-        // and nothing should be consumed.
-        let err = limiter
-            .check_and_consume_at("machine-a", 8, now())
-            .expect_err("cost exceeds remaining budget");
-        assert_eq!(err.retry_after_seconds, 60);
-
-        // The remaining budget (6) must be untouched by the rejected call.
-        assert!(limiter.check_and_consume_at("machine-a", 6, now()).is_ok());
-        assert!(limiter.check_and_consume_at("machine-a", 1, now()).is_err());
-    }
-
-    #[test]
-    fn distinct_principals_track_independent_budgets() {
-        let limiter = MachineQuotaLimiter::new(config(true, 5));
-        assert!(limiter.check_and_consume_at("machine-a", 5, now()).is_ok());
-        assert!(limiter.check_and_consume_at("machine-a", 1, now()).is_err());
-
-        // machine-b has its own, untouched budget.
-        assert!(limiter.check_and_consume_at("machine-b", 5, now()).is_ok());
-    }
-
-    #[test]
-    fn map_is_bounded_and_evicts_oldest_entry() {
-        // Nanosecond-spaced timestamps keep every principal inside the same
-        // one-minute window (10,000ns is far under 60s), while still giving
-        // each one a strictly distinct, increasing `window_start` so the
-        // "oldest" entry is well-defined for the eviction assertion below.
-        let limiter = MachineQuotaLimiter::new(config(true, 1));
-        for index in 0..MAX_TRACKED_PRINCIPALS {
-            let principal = format!("machine-{index}");
-            assert!(limiter
-                .check_and_consume_at(&principal, 1, now() + Duration::nanoseconds(index as i64))
-                .is_ok());
-        }
-        assert_eq!(limiter.tracked_principal_count(), MAX_TRACKED_PRINCIPALS);
-
-        // One more distinct principal pushes the map over capacity: the
-        // oldest tracked window (machine-0) must be evicted to make room.
-        let overflow_now = now() + Duration::nanoseconds(MAX_TRACKED_PRINCIPALS as i64);
-        assert!(limiter
-            .check_and_consume_at("machine-overflow", 1, overflow_now)
-            .is_ok());
-        assert_eq!(limiter.tracked_principal_count(), MAX_TRACKED_PRINCIPALS);
-        assert!(!limiter.is_tracked("machine-0"));
-        assert!(limiter.is_tracked("machine-overflow"));
-    }
-
-    #[test]
-    fn oversized_principal_id_fails_closed() {
-        let limiter = MachineQuotaLimiter::new(config(true, 1000));
-        let oversized = "x".repeat(MAX_MACHINE_QUOTA_KEY_LEN + 1);
-        let err = limiter
-            .check_and_consume_at(&oversized, 1, now())
-            .expect_err("oversized principal id must fail closed");
-        assert_eq!(err.retry_after_seconds, 60);
-    }
-
-    #[test]
-    fn zero_cost_never_denies() {
-        let limiter = MachineQuotaLimiter::new(config(true, 1));
-        assert!(limiter.check_and_consume_at("machine-a", 0, now()).is_ok());
-        assert!(limiter.check_and_consume_at("machine-a", 0, now()).is_ok());
-    }
-
-    #[tokio::test]
-    async fn public_in_memory_path_uses_the_same_atomic_budget() {
-        let limiter = MachineQuotaLimiter::new(config(true, 2));
-        assert!(limiter.check_and_consume("machine-a", 2).await.is_ok());
-        assert!(limiter.check_and_consume("machine-a", 1).await.is_err());
-    }
-
-    #[test]
-    fn database_principal_key_is_a_fixed_width_audit_pseudonym() {
-        let hasher = AuditKeyHasher::unkeyed_dev_only();
-        let pseudonym = machine_quota_hash(&hasher, "machine-a").unwrap();
-
-        assert_eq!(pseudonym.len(), 32);
-        assert_ne!(pseudonym, b"machine-a");
-    }
-}
diff --git a/crates/registry-notary-server/src/metrics.rs b/crates/registry-notary-server/src/metrics.rs
deleted file mode 100644
index ed9216ea9..000000000
--- a/crates/registry-notary-server/src/metrics.rs
+++ /dev/null
@@ -1,472 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Low-cardinality Prometheus text metrics for Registry Notary.
-
-use std::collections::BTreeMap;
-use std::sync::{Arc, Mutex};
-use std::time::Instant;
-
-use axum::extract::{MatchedPath, Request, State};
-use axum::http::{header, StatusCode};
-use axum::middleware::Next;
-use axum::response::{IntoResponse, Response};
-
-use crate::api::EvidenceErrorCodeContext;
-
-#[derive(Debug, Default)]
-pub(crate) struct AppMetrics {
-    inner: Mutex<MetricsState>,
-}
-
-#[derive(Debug, Default)]
-struct MetricsState {
-    http: BTreeMap<HttpKey, HttpDuration>,
-    audit: BTreeMap<OutcomeKey, u64>,
-    replay: BTreeMap<ReplayKey, u64>,
-    credentials: BTreeMap<CredentialKey, u64>,
-    cel_evaluations: BTreeMap<CelEvaluationKey, CountDuration>,
-    cel_worker_pools: BTreeMap<CelWorkerStateKey, u64>,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
-struct HttpKey {
-    method: &'static str,
-    endpoint_kind: &'static str,
-    status_code: u16,
-    status_class: &'static str,
-    error_code: String,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
-struct OutcomeKey {
-    outcome: &'static str,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
-struct ReplayKey {
-    flow: &'static str,
-    outcome: &'static str,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
-struct CredentialKey {
-    protocol: &'static str,
-    outcome: &'static str,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
-struct CelEvaluationKey {
-    outcome: &'static str,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
-struct CelWorkerStateKey {
-    state: &'static str,
-}
-
-#[derive(Debug, Clone, Copy, Default)]
-struct CountDuration {
-    count: u64,
-    duration_ms_total: u64,
-}
-
-const HTTP_DURATION_BUCKETS_SECONDS: &[f64] = &[
-    0.005, 0.010, 0.025, 0.050, 0.100, 0.250, 0.500, 1.000, 2.500, 5.000, 10.000,
-];
-
-#[derive(Debug, Clone)]
-struct HttpDuration {
-    count: u64,
-    duration_sum_seconds: f64,
-    duration_buckets: Vec<u64>,
-}
-
-impl Default for HttpDuration {
-    fn default() -> Self {
-        Self {
-            count: 0,
-            duration_sum_seconds: 0.0,
-            duration_buckets: vec![0; HTTP_DURATION_BUCKETS_SECONDS.len()],
-        }
-    }
-}
-
-impl AppMetrics {
-    pub(crate) fn record_http(
-        &self,
-        method: &str,
-        endpoint_kind: &'static str,
-        status: StatusCode,
-        error_code: &str,
-        duration_seconds: f64,
-    ) {
-        let key = HttpKey {
-            method: normalize_method(method),
-            endpoint_kind,
-            status_code: status.as_u16(),
-            status_class: status_class(status),
-            error_code: error_code.to_string(),
-        };
-        let mut metrics = self.inner.lock().expect("metrics mutex is healthy");
-        let value = metrics.http.entry(key).or_default();
-        value.count = value.count.saturating_add(1);
-        value.duration_sum_seconds += duration_seconds;
-        for (index, bucket) in HTTP_DURATION_BUCKETS_SECONDS.iter().enumerate() {
-            if duration_seconds <= *bucket {
-                value.duration_buckets[index] = value.duration_buckets[index].saturating_add(1);
-            }
-        }
-    }
-
-    pub(crate) fn record_audit_event(&self, outcome: &'static str) {
-        let mut metrics = self.inner.lock().expect("metrics mutex is healthy");
-        let value = metrics.audit.entry(OutcomeKey { outcome }).or_default();
-        *value = value.saturating_add(1);
-    }
-
-    pub(crate) fn record_replay(&self, flow: &'static str, outcome: &'static str) {
-        let mut metrics = self.inner.lock().expect("metrics mutex is healthy");
-        let value = metrics
-            .replay
-            .entry(ReplayKey { flow, outcome })
-            .or_default();
-        *value = value.saturating_add(1);
-    }
-
-    pub(crate) fn record_credential(&self, protocol: &'static str, outcome: &'static str) {
-        let mut metrics = self.inner.lock().expect("metrics mutex is healthy");
-        let value = metrics
-            .credentials
-            .entry(CredentialKey { protocol, outcome })
-            .or_default();
-        *value = value.saturating_add(1);
-    }
-
-    #[cfg_attr(not(feature = "registry-notary-cel"), allow(dead_code))]
-    pub(crate) fn record_cel_evaluation(&self, outcome: &'static str, duration_ms: u64) {
-        let mut metrics = self.inner.lock().expect("metrics mutex is healthy");
-        let value = metrics
-            .cel_evaluations
-            .entry(CelEvaluationKey { outcome })
-            .or_default();
-        value.count = value.count.saturating_add(1);
-        value.duration_ms_total = value.duration_ms_total.saturating_add(duration_ms);
-    }
-
-    #[cfg_attr(not(feature = "registry-notary-cel"), allow(dead_code))]
-    pub(crate) fn set_cel_worker_pool(&self, state: &'static str, value: u64) {
-        let mut metrics = self.inner.lock().expect("metrics mutex is healthy");
-        metrics
-            .cel_worker_pools
-            .insert(CelWorkerStateKey { state }, value);
-    }
-
-    fn render(&self) -> String {
-        let metrics = self.inner.lock().expect("metrics mutex is healthy");
-        let mut body = String::new();
-        body.push_str("# TYPE registry_notary_http_requests_total counter\n");
-        body.push_str("# TYPE registry_notary_http_request_duration_seconds histogram\n");
-        for (key, value) in &metrics.http {
-            body.push_str(&format!(
-                "registry_notary_http_requests_total{{method=\"{}\",endpoint_kind=\"{}\",status_code=\"{}\",status_class=\"{}\",error_code=\"{}\"}} {}\n",
-                escape_metric_label(key.method),
-                escape_metric_label(key.endpoint_kind),
-                key.status_code,
-                escape_metric_label(key.status_class),
-                escape_metric_label(&key.error_code),
-                value.count
-            ));
-            for (index, bucket) in HTTP_DURATION_BUCKETS_SECONDS.iter().enumerate() {
-                body.push_str(&format!(
-                    "registry_notary_http_request_duration_seconds_bucket{{method=\"{}\",endpoint_kind=\"{}\",status_code=\"{}\",status_class=\"{}\",error_code=\"{}\",le=\"{:.3}\"}} {}\n",
-                    escape_metric_label(key.method),
-                    escape_metric_label(key.endpoint_kind),
-                    key.status_code,
-                    escape_metric_label(key.status_class),
-                    escape_metric_label(&key.error_code),
-                    bucket,
-                    value.duration_buckets[index]
-                ));
-            }
-            body.push_str(&format!(
-                "registry_notary_http_request_duration_seconds_bucket{{method=\"{}\",endpoint_kind=\"{}\",status_code=\"{}\",status_class=\"{}\",error_code=\"{}\",le=\"+Inf\"}} {}\n",
-                escape_metric_label(key.method),
-                escape_metric_label(key.endpoint_kind),
-                key.status_code,
-                escape_metric_label(key.status_class),
-                escape_metric_label(&key.error_code),
-                value.count
-            ));
-            body.push_str(&format!(
-                "registry_notary_http_request_duration_seconds_sum{{method=\"{}\",endpoint_kind=\"{}\",status_code=\"{}\",status_class=\"{}\",error_code=\"{}\"}} {:.6}\n",
-                escape_metric_label(key.method),
-                escape_metric_label(key.endpoint_kind),
-                key.status_code,
-                escape_metric_label(key.status_class),
-                escape_metric_label(&key.error_code),
-                value.duration_sum_seconds
-            ));
-            body.push_str(&format!(
-                "registry_notary_http_request_duration_seconds_count{{method=\"{}\",endpoint_kind=\"{}\",status_code=\"{}\",status_class=\"{}\",error_code=\"{}\"}} {}\n",
-                escape_metric_label(key.method),
-                escape_metric_label(key.endpoint_kind),
-                key.status_code,
-                escape_metric_label(key.status_class),
-                escape_metric_label(&key.error_code),
-                value.count
-            ));
-        }
-        body.push_str("# TYPE registry_notary_audit_events_total counter\n");
-        for (key, value) in &metrics.audit {
-            body.push_str(&format!(
-                "registry_notary_audit_events_total{{outcome=\"{}\"}} {}\n",
-                key.outcome, value
-            ));
-        }
-        body.push_str("# TYPE registry_notary_replay_events_total counter\n");
-        for (key, value) in &metrics.replay {
-            body.push_str(&format!(
-                "registry_notary_replay_events_total{{flow=\"{}\",outcome=\"{}\"}} {}\n",
-                key.flow, key.outcome, value
-            ));
-        }
-        body.push_str("# TYPE registry_notary_credential_issuance_total counter\n");
-        for (key, value) in &metrics.credentials {
-            body.push_str(&format!(
-                "registry_notary_credential_issuance_total{{protocol=\"{}\",outcome=\"{}\"}} {}\n",
-                key.protocol, key.outcome, value
-            ));
-        }
-        body.push_str("# TYPE registry_notary_cel_evaluations_total counter\n");
-        body.push_str("# TYPE registry_notary_cel_evaluation_duration_ms_total counter\n");
-        for (key, value) in &metrics.cel_evaluations {
-            body.push_str(&format!(
-                "registry_notary_cel_evaluations_total{{outcome=\"{}\"}} {}\n",
-                key.outcome, value.count
-            ));
-            body.push_str(&format!(
-                "registry_notary_cel_evaluation_duration_ms_total{{outcome=\"{}\"}} {}\n",
-                key.outcome, value.duration_ms_total
-            ));
-        }
-        body.push_str("# TYPE registry_notary_cel_worker_pool gauge\n");
-        for (key, value) in &metrics.cel_worker_pools {
-            body.push_str(&format!(
-                "registry_notary_cel_worker_pool{{state=\"{}\"}} {}\n",
-                key.state, value
-            ));
-        }
-        body
-    }
-}
-
-pub(crate) async fn metrics_handler(State(metrics): State<Arc<AppMetrics>>) -> Response {
-    (
-        StatusCode::OK,
-        [(header::CONTENT_TYPE, "text/plain; version=0.0.4")],
-        metrics.render(),
-    )
-        .into_response()
-}
-
-pub(crate) async fn metrics_middleware(
-    State(metrics): State<Arc<AppMetrics>>,
-    request: Request,
-    next: Next,
-) -> Response {
-    let method = normalize_method(request.method().as_str());
-    let route = request
-        .extensions()
-        .get::<MatchedPath>()
-        .map(|matched| matched.as_str().to_string());
-    let path = request.uri().path().to_string();
-    let started_at = Instant::now();
-    let response = next.run(request).await;
-    let error_code = response
-        .extensions()
-        .get::<EvidenceErrorCodeContext>()
-        .map(|context| context.0.as_str())
-        .unwrap_or("none");
-    metrics.record_http(
-        method,
-        route
-            .as_deref()
-            .map(endpoint_kind_from_route)
-            .unwrap_or_else(|| endpoint_kind_from_path(&path)),
-        response.status(),
-        error_code,
-        started_at.elapsed().as_secs_f64(),
-    );
-    response
-}
-
-fn endpoint_kind_from_route(route: &str) -> &'static str {
-    match route {
-        "/healthz" => "health",
-        "/ready" => "ready",
-        "/metrics" | "/admin/v1/capabilities" | "/admin/v1/posture" | "/admin/v1/reload" => "admin",
-        "/openapi.json" | "/docs" | "/docs/scalar.js" => "openapi",
-        "/.well-known/evidence-service"
-        | "/.well-known/evidence/jwks.json"
-        | "/.well-known/openid-credential-issuer" => "well_known",
-        "/.well-known/vct/{*vct_path}" | "/credentials/{*vct_path}" => "credential_metadata",
-        "/oid4vci/offer/start"
-        | "/oid4vci/offer/callback"
-        | "/oid4vci/offers"
-        | "/oid4vci/offer/representative"
-        | "/oid4vci/token"
-        | "/oid4vci/credential" => "oid4vci",
-        "/v1/claims" | "/v1/claims/{claim_id}" | "/v1/formats" => "catalog",
-        "/v1/evaluations" | "/v1/batch-evaluations" | "/v1/evaluations/{evaluation_id}/render" => {
-            "evaluation"
-        }
-        "/v1/credentials" | "/v1/credentials/{credential_id}/status" => "credential",
-        "/federation/v1/evaluations" => "federation",
-        _ => "other",
-    }
-}
-
-fn endpoint_kind_from_path(path: &str) -> &'static str {
-    if path == "/healthz" {
-        "health"
-    } else if path == "/ready" {
-        "ready"
-    } else if path == "/metrics" || path.starts_with("/admin/") {
-        "admin"
-    } else if path == "/openapi.json" || path.starts_with("/docs") {
-        "openapi"
-    } else if path.starts_with("/.well-known/") {
-        "well_known"
-    } else if path.starts_with("/oid4vci/") {
-        "oid4vci"
-    } else if path.starts_with("/credentials/") || path.starts_with("/.well-known/vct/") {
-        "credential_metadata"
-    } else if path.starts_with("/v1/credentials") {
-        "credential"
-    } else if path.starts_with("/v1/evaluations") || path == "/v1/batch-evaluations" {
-        "evaluation"
-    } else if path.starts_with("/v1/claims") || path == "/v1/formats" {
-        "catalog"
-    } else if path.starts_with("/federation/") {
-        "federation"
-    } else {
-        "other"
-    }
-}
-
-fn status_class(status: StatusCode) -> &'static str {
-    match status.as_u16() / 100 {
-        1 => "1xx",
-        2 => "2xx",
-        3 => "3xx",
-        4 => "4xx",
-        5 => "5xx",
-        6 => "6xx",
-        7 => "7xx",
-        8 => "8xx",
-        9 => "9xx",
-        _ => "other",
-    }
-}
-
-fn normalize_method(method: &str) -> &'static str {
-    match method {
-        "GET" => "GET",
-        "POST" => "POST",
-        "PUT" => "PUT",
-        "PATCH" => "PATCH",
-        "DELETE" => "DELETE",
-        "HEAD" => "HEAD",
-        "OPTIONS" => "OPTIONS",
-        "TRACE" => "TRACE",
-        "CONNECT" => "CONNECT",
-        _ => "OTHER",
-    }
-}
-
-fn escape_metric_label(value: &str) -> String {
-    value
-        .replace('\\', "\\\\")
-        .replace('\n', "\\n")
-        .replace('"', "\\\"")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn metric_labels_escape_prometheus_special_characters() {
-        assert_eq!(escape_metric_label("a\\b\n\"c"), "a\\\\b\\n\\\"c");
-    }
-
-    #[test]
-    fn http_method_labels_collapse_unknown_methods() {
-        let metrics = AppMetrics::default();
-
-        metrics.record_http(
-            "BREW1",
-            "health",
-            StatusCode::METHOD_NOT_ALLOWED,
-            "none",
-            0.001,
-        );
-        metrics.record_http(
-            "BREW2",
-            "health",
-            StatusCode::METHOD_NOT_ALLOWED,
-            "none",
-            0.002,
-        );
-        metrics.record_http("GET", "health", StatusCode::OK, "none", 0.003);
-
-        let rendered = metrics.render();
-        assert!(rendered.contains(
-            "registry_notary_http_requests_total{method=\"OTHER\",endpoint_kind=\"health\",status_code=\"405\",status_class=\"4xx\",error_code=\"none\"} 2"
-        ));
-        assert!(rendered.contains("# TYPE registry_notary_http_request_duration_seconds histogram"));
-        assert!(rendered.contains(
-            "registry_notary_http_request_duration_seconds_bucket{method=\"OTHER\",endpoint_kind=\"health\",status_code=\"405\",status_class=\"4xx\",error_code=\"none\",le=\"0.005\"} 2"
-        ));
-        assert!(rendered.contains(
-            "registry_notary_http_request_duration_seconds_bucket{method=\"OTHER\",endpoint_kind=\"health\",status_code=\"405\",status_class=\"4xx\",error_code=\"none\",le=\"+Inf\"} 2"
-        ));
-        assert!(rendered.contains(
-            "registry_notary_http_request_duration_seconds_sum{method=\"OTHER\",endpoint_kind=\"health\",status_code=\"405\",status_class=\"4xx\",error_code=\"none\"} 0.003000"
-        ));
-        assert!(rendered.contains(
-            "registry_notary_http_request_duration_seconds_count{method=\"OTHER\",endpoint_kind=\"health\",status_code=\"405\",status_class=\"4xx\",error_code=\"none\"} 2"
-        ));
-        assert!(rendered.contains(
-            "registry_notary_http_requests_total{method=\"GET\",endpoint_kind=\"health\",status_code=\"200\",status_class=\"2xx\",error_code=\"none\"} 1"
-        ));
-        assert!(!rendered.contains("registry_notary_http_request_duration_ms_total"));
-        assert!(!rendered.contains("route="));
-        assert!(!rendered.contains("BREW1"));
-        assert!(!rendered.contains("BREW2"));
-    }
-
-    #[test]
-    fn cel_metrics_are_low_cardinality_and_do_not_include_policy_text() {
-        let metrics = AppMetrics::default();
-
-        metrics.record_cel_evaluation("success", 7);
-        metrics.record_cel_evaluation("compile_error", 3);
-        metrics.set_cel_worker_pool("max", 2);
-        metrics.set_cel_worker_pool("idle", 1);
-        metrics.set_cel_worker_pool("replacements_total", 4);
-        metrics.set_cel_worker_pool("circuit_open", 1);
-
-        let rendered = metrics.render();
-        assert!(rendered.contains("registry_notary_cel_evaluations_total{outcome=\"success\"} 1"));
-        assert!(rendered.contains(
-            "registry_notary_cel_evaluation_duration_ms_total{outcome=\"compile_error\"} 3"
-        ));
-        assert!(rendered.contains("registry_notary_cel_worker_pool{state=\"max\"} 2"));
-        assert!(
-            rendered.contains("registry_notary_cel_worker_pool{state=\"replacements_total\"} 4")
-        );
-        assert!(rendered.contains("registry_notary_cel_worker_pool{state=\"circuit_open\"} 1"));
-        assert!(!rendered.contains("source.age"));
-        assert!(!rendered.contains("secret-source-value"));
-    }
-}
diff --git a/crates/registry-notary-server/src/openapi.rs b/crates/registry-notary-server/src/openapi.rs
deleted file mode 100644
index 5dd4fa9c0..000000000
--- a/crates/registry-notary-server/src/openapi.rs
+++ /dev/null
@@ -1,5089 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Registry Notary OpenAPI document generation.
-
-use registry_notary_core::model::{
-    ClaimRef, CredentialIssueRequest, HolderRequest, RenderEvaluationRequest, FORMAT_SD_JWT_VC,
-    SD_JWT_VC_HOLDER_BINDING_METHOD, SD_JWT_VC_ISSUER_KEY_TYPE, SD_JWT_VC_JWT_TYP,
-    SD_JWT_VC_SIGNING_ALG,
-};
-use serde_json::{json, Value};
-use std::sync::OnceLock;
-use utoipa::openapi::OpenApi;
-use utoipa::PartialSchema;
-
-const INFO_SUMMARY: &str =
-    "Standalone evidence evaluation, rendering, and credential issuance service.";
-const CONTACT_NAME: &str = "Registry Notary owning team";
-
-#[must_use]
-pub fn openapi_document() -> &'static Value {
-    static DOCUMENT: OnceLock<Value> = OnceLock::new();
-
-    DOCUMENT.get_or_init(build_openapi_document)
-}
-
-fn build_openapi_document() -> Value {
-    let mut raw_document = json!({
-        "openapi": "3.1.0",
-        "info": {
-            "title": "Registry Notary API",
-            "summary": INFO_SUMMARY,
-            "version": env!("CARGO_PKG_VERSION"),
-            "description": "Standalone claim evaluation, rendering, and credential issuance API.",
-            "contact": {
-                "name": CONTACT_NAME
-            },
-            "license": {
-                "name": env!("CARGO_PKG_LICENSE"),
-                "identifier": env!("CARGO_PKG_LICENSE")
-            }
-        },
-        "security": [
-            { "apiKeyAuth": [] },
-            { "bearerAuth": [] }
-        ],
-        "paths": {
-            "/healthz": {
-                "get": {
-                    "summary": "Return the liveness probe",
-                    "operationId": "getHealthz",
-                    "security": [],
-                    "responses": {
-                        "200": { "description": "Service process is alive" },
-                        "4XX": { "description": "Client error" }
-                    }
-                }
-            },
-            "/ready": {
-                "get": {
-                    "summary": "Return the readiness probe",
-                    "operationId": "getReady",
-                    "security": [],
-                    "responses": {
-                        "200": { "description": "Evidence runtime is ready" },
-                        "4XX": { "description": "Client error" },
-                        "503": { "description": "Evidence runtime is not ready, is degraded, or has an inconsistent audit chain" }
-                    }
-                }
-            },
-            "/admin/v1/reload": {
-                "post": {
-                    "summary": "Report unsupported runtime reload",
-                    "description": "Standalone mode does not support runtime configuration reload. Operators should call /admin/v1/capabilities before invoking product-specific reload operations.",
-                    "operationId": "adminReload",
-                    "security": [
-                        { "apiKeyAuth": [] },
-                        { "bearerAuth": [] }
-                    ],
-                    "responses": {
-                        "501": { "description": "Runtime configuration reload is not supported" },
-                        "401": { "description": "Missing or invalid credential" },
-                        "403": { "description": "Caller lacks registry_notary:admin scope" }
-                    }
-                }
-            },
-            "/admin/v1/capabilities": {
-                "get": {
-                    "summary": "Discover authenticated admin capabilities",
-                    "description": "Returns redacted product capability metadata for posture and supported admin operations.",
-                    "operationId": "adminCapabilities",
-                    "security": [
-                        { "apiKeyAuth": [] },
-                        { "bearerAuth": [] }
-                    ],
-                    "responses": {
-                        "200": { "description": "Admin capabilities for this product runtime" },
-                        "401": { "description": "Missing or invalid credential" },
-                        "403": { "description": "Caller lacks registry_notary:ops_read scope" }
-                    }
-                }
-            },
-            "/admin/v1/posture": {
-                "get": {
-                    "summary": "Read redacted runtime posture",
-                    "description": "Returns redacted runtime posture for the requested tier. The response body is a registry.ops.posture.v1 document describing instance, configuration, notary, deployment, and audit posture.",
-                    "operationId": "adminPosture",
-                    "security": [
-                        { "apiKeyAuth": [] },
-                        { "bearerAuth": [] }
-                    ],
-                    "parameters": [
-                        {
-                            "name": "tier",
-                            "in": "query",
-                            "required": false,
-                            "description": "Redaction tier for the posture document. Defaults to default.",
-                            "schema": { "type": "string", "enum": ["default", "restricted"] }
-                        }
-                    ],
-                    "responses": {
-                        "200": { "description": "Redacted posture for the requested tier" },
-                        "400": { "description": "Posture tier is invalid" },
-                        "401": { "description": "Missing or invalid credential" },
-                        "403": { "description": "Caller lacks registry_notary:ops_read scope" },
-                        "500": { "description": "Posture could not be filtered for the requested tier" },
-                        "503": { "description": "Posture state is unavailable" }
-                    }
-                }
-            },
-            "/openapi.json": {
-                "get": {
-                    "summary": "Fetch this OpenAPI document",
-                    "operationId": "getOpenApi",
-                    "responses": {
-                        "200": { "description": "OpenAPI document" },
-                        "401": { "description": "Missing or invalid credential" }
-                    }
-                }
-            },
-            "/.well-known/evidence-service": {
-                "get": {
-                    "summary": "Discover Registry Notary capabilities",
-                    "operationId": "getEvidenceService",
-                    "responses": {
-                        "200": { "description": "Service document" },
-                        "401": { "description": "Missing or invalid credential" }
-                    }
-                }
-            },
-            "/.well-known/evidence/jwks.json": {
-                "get": {
-                    "summary": "Fetch public issuer verification keys",
-                    "operationId": "getEvidenceJwks",
-                    "description": "Returns public issuer verification keys for wallet and verifier discovery. This well-known route is intentionally unauthenticated; it only exposes public JWK members.",
-                    "security": [],
-                    "responses": {
-                        "200": { "description": "Public JWKS" }
-                    }
-                }
-            },
-            "/.well-known/openid-credential-issuer": {
-                "get": {
-                    "summary": "Discover OpenID4VCI credential issuer metadata",
-                    "operationId": "getOpenidCredentialIssuer",
-                    "description": "Returns the OpenID4VCI issuer metadata for Registry Notary' dc+sd-jwt issuance profile.",
-                    "security": [],
-                    "responses": {
-                        "200": {
-                            "description": "OpenID4VCI credential issuer metadata",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/CredentialIssuerMetadata" }
-                                }
-                            }
-                        },
-                        "404": { "description": "OpenID4VCI issuer is disabled" },
-                        "500": {
-                            "description": "OpenID4VCI issuer failed",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        }
-                    }
-                }
-            },
-            "/credentials/{vct_path}": {
-                "x-registry-notary-catch-all": true,
-                "get": {
-                    "summary": "Fetch SD-JWT VC Type Metadata",
-                    "operationId": "getSdJwtVcTypeMetadata",
-                    "description": "Returns public SD-JWT VC Type Metadata for a configured OID4VCI credential configuration whose vct exactly matches the requested absolute URL. The path key uses the OpenAPI single-segment form {vct_path} for standard tooling compatibility, but the route is a multi-segment catch-all: vct_path captures the full path remainder after /credentials/ (slashes included, not percent-encoded) and may span multiple segments. This route is intentionally unversioned and must remain at /credentials/{vct_path} (without a /v1/ prefix): per SD-JWT VC type-metadata dereference, a client resolves the credential type by dereferencing the vct claim directly (for example, https://{host}/credentials/{vct_path}), so the server path must match the vct URL path component exactly. Adding a /v1/ prefix would break dereference for any credential whose vct does not include that prefix. This route serves type metadata only and is unrelated to POST /v1/credentials (credential issuance).",
-                    "security": [],
-                    "parameters": [
-                        {
-                            "name": "vct_path",
-                            "in": "path",
-                            "required": true,
-                            "schema": {
-                                "type": "string",
-                                "pattern": "^[^/]+(/[^/]+)*$"
-                            },
-                            "description": "Full path remainder after /credentials/ captured as a multi-segment catch-all. The value is the unencoded path suffix of the VCT URL (slashes not percent-encoded) and may contain one or more segments."
-                        }
-                    ],
-                    "responses": {
-                        "200": {
-                            "description": "SD-JWT VC Type Metadata",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/SdJwtVcTypeMetadata" }
-                                }
-                            }
-                        },
-                        "404": { "description": "OpenID4VCI issuer is disabled or no configured vct matches the requested URL" }
-                    }
-                }
-            },
-            "/.well-known/vct/{vct_path}": {
-                "x-registry-notary-catch-all": true,
-                "get": {
-                    "summary": "Fetch SD-JWT VC Type Metadata at the well-known location",
-                    "operationId": "getWellKnownSdJwtVcTypeMetadata",
-                    "description": "Returns public SD-JWT VC Type Metadata at the SD-JWT VC well-known location. Consumers dereference an HTTPS vct by inserting /.well-known/vct between the host and the path; the server strips that prefix and matches the reconstructed vct (https://{host}/{vct_path}) against a configured OID4VCI credential configuration. The path key uses the OpenAPI single-segment form {vct_path} for standard tooling compatibility, but the route is a multi-segment catch-all: vct_path captures the full path remainder (slashes included, not percent-encoded) and may span multiple segments. This route is intentionally unversioned and must remain at /.well-known/vct/{vct_path}: per RFC 8615 well-known URI semantics, the path prefix is determined by the protocol and cannot be changed. Adding a /v1/ prefix would violate the well-known URI convention. This route serves type metadata only and is unrelated to POST /v1/credentials (credential issuance).",
-                    "security": [],
-                    "parameters": [
-                        {
-                            "name": "vct_path",
-                            "in": "path",
-                            "required": true,
-                            "schema": {
-                                "type": "string",
-                                "pattern": "^[^/]+(/[^/]+)*$"
-                            },
-                            "description": "Full path remainder after /.well-known/vct/ captured as a multi-segment catch-all. The value is the unencoded path suffix of the VCT URL (slashes not percent-encoded) and may contain one or more segments."
-                        }
-                    ],
-                    "responses": {
-                        "200": {
-                            "description": "SD-JWT VC Type Metadata",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/SdJwtVcTypeMetadata" }
-                                }
-                            }
-                        },
-                        "404": { "description": "OpenID4VCI issuer is disabled or no configured vct matches the reconstructed URL" }
-                    }
-                }
-            },
-            "/oid4vci/credential": {
-                "post": {
-                    "summary": "Issue a credential through OpenID4VCI",
-                    "operationId": "issueOid4vciCredential",
-                    "description": "Materializes at most one dc+sd-jwt credential from the immutable registry-backed evaluation transaction authorized before the issuer-initiated offer. The access token supplies the transaction nonce, holder proof must use EdDSA with did:jwk, and an exact retry returns the cached response without another Relay call or signature. Delegated issuance is accepted only for a credential configuration using the digitally authenticated representative ceremony. Error responses use the OpenID4VCI error envelope, not RFC 9457 Problem Details.",
-                    "security": [
-                        { "bearerAuth": [] }
-                    ],
-                    "requestBody": {
-                        "required": true,
-                        "content": {
-                            "application/json": {
-                                "schema": { "$ref": "#/components/schemas/CredentialRequest" }
-                            }
-                        }
-                    },
-                    "responses": {
-                        "200": {
-                            "description": "Credential response",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/CredentialResponse" }
-                                }
-                            }
-                        },
-                        "400": {
-                            "description": "Invalid credential request, proof, or type",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        },
-                        "401": {
-                            "description": "Invalid credential access token",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        },
-                        "403": {
-                            "description": "Credential request is denied",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        },
-                        "429": {
-                            "description": "Credential request is rate limited",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        },
-                        "500": {
-                            "description": "OpenID4VCI issuer failed",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        }
-                    }
-                }
-            },
-            "/oid4vci/offers": {
-                "post": {
-                    "summary": "Create a registrar-initiated pre-authorized offer",
-                    "operationId": "createOid4vciRegistryOffer",
-                    "description": "Creates one short-lived pre-authorized OID4VCI offer from an existing fresh registry-backed evaluation owned by the authenticated machine client. Representative-enabled credential configurations are reserved for their authenticated browser ceremony and are rejected here. The client supplies only the evaluation id and credential configuration id. Registry Notary reloads the exact stored values, target, purpose, compiler-pinned Relay provenance, credential profile, and configuration fingerprint. The caller must present an external API-key or OIDC machine credential with registry_notary:credential_offer_create, the selected configuration scope, and exact target-scoped authorization_details for create_credential_offer; a Notary-issued wallet access token is not accepted. Idempotency-Key is required. Reusing one key with the same request returns the exact stored response, while changing the request or attempting to create another offer from the consumed evaluation returns 409. The credential_offer_uri describes the required tx_code but never contains its numeric value. The registrar must deliver that value to the holder through a separate channel. Every response is non-storable.",
-                    "security": [
-                        { "apiKeyAuth": [] },
-                        { "bearerAuth": [] }
-                    ],
-                    "parameters": [
-                        {
-                            "name": "Idempotency-Key",
-                            "in": "header",
-                            "required": true,
-                            "description": "Caller-generated retry key. Use the same key only for an exact retry of the same request.",
-                            "schema": {
-                                "type": "string",
-                                "minLength": 1,
-                                "maxLength": 256,
-                                "pattern": "^[\\x21\\x23-\\x5B\\x5D-\\x7E]{1,256}$"
-                            }
-                        }
-                    ],
-                    "requestBody": {
-                        "required": true,
-                        "content": {
-                            "application/json": {
-                                "schema": {
-                                    "$ref": "#/components/schemas/RegistryClientOfferRequest"
-                                }
-                            }
-                        }
-                    },
-                    "responses": {
-                        "200": {
-                            "description": "New or exactly replayed credential offer response",
-                            "content": {
-                                "application/json": {
-                                    "schema": {
-                                        "$ref": "#/components/schemas/RegistryClientOfferResponse"
-                                    }
-                                }
-                            }
-                        },
-                        "400": {
-                            "description": "Invalid request or idempotency key",
-                            "content": {
-                                "application/problem+json": {
-                                    "schema": { "$ref": "#/components/schemas/ProblemDetails" }
-                                }
-                            }
-                        },
-                        "401": {
-                            "description": "Missing or invalid machine credential",
-                            "content": {
-                                "application/problem+json": {
-                                    "schema": { "$ref": "#/components/schemas/ProblemDetails" }
-                                }
-                            }
-                        },
-                        "403": {
-                            "description": "Caller lacks required authority or selected a representative-only credential configuration",
-                            "content": {
-                                "application/problem+json": {
-                                    "schema": { "$ref": "#/components/schemas/ProblemDetails" }
-                                }
-                            }
-                        },
-                        "404": {
-                            "description": "Flow is disabled or the evaluation is unavailable to this caller",
-                            "content": {
-                                "application/problem+json": {
-                                    "schema": { "$ref": "#/components/schemas/ProblemDetails" }
-                                }
-                            }
-                        },
-                        "409": {
-                            "description": "Idempotency conflict or evaluation already consumed",
-                            "content": {
-                                "application/problem+json": {
-                                    "schema": { "$ref": "#/components/schemas/ProblemDetails" }
-                                }
-                            }
-                        },
-                        "429": {
-                            "description": "Offer creation is rate limited",
-                            "content": {
-                                "application/problem+json": {
-                                    "schema": { "$ref": "#/components/schemas/ProblemDetails" }
-                                }
-                            }
-                        },
-                        "503": {
-                            "description": "Offer correctness state or another required dependency is unavailable",
-                            "content": {
-                                "application/problem+json": {
-                                    "schema": { "$ref": "#/components/schemas/ProblemDetails" }
-                                }
-                            }
-                        }
-                    }
-                }
-            },
-            "/oid4vci/offer/start": {
-                "get": {
-                    "summary": "Begin an authenticated pre-authorized-code offer",
-                    "operationId": "startOid4vciOffer",
-                    "description": "Public and unauthenticated. Begins the eSignet authorization-code login as the confidential RP and 302-redirects the browser to eSignet. Mints no pre-authorized_code or credential material. Returns 404 when the pre-authorized-code flow is disabled. Error responses use the OpenID4VCI error envelope, not RFC 9457 Problem Details.",
-                    "security": [],
-                    "parameters": [
-                        {
-                            "name": "credential_configuration_id",
-                            "in": "query",
-                            "required": false,
-                            "schema": { "type": "string" }
-                        }
-                    ],
-                    "responses": {
-                        "303": { "description": "Redirect to the eSignet authorization endpoint" },
-                        "400": {
-                            "description": "Invalid or unknown credential configuration",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        },
-                        "404": { "description": "Pre-authorized-code flow is disabled" },
-                        "500": {
-                            "description": "OpenID4VCI issuer failed",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        }
-                    }
-                }
-            },
-            "/oid4vci/offer/callback": {
-                "get": {
-                    "summary": "Complete eSignet login for a pre-authorized-code offer",
-                    "operationId": "completeOid4vciOffer",
-                    "description": "Public and unauthenticated. Consumes the login state, exchanges the eSignet code with private_key_jwt, and validates the id_token. For an ordinary credential configuration, it completes the exact registry-backed Relay evaluation and only then mints one single-use pre-authorized_code bound to that immutable transaction. For a representative configuration, it reserves a fresh single-use target-selection state and returns a no-store form; POST /oid4vci/offer/representative completes the proof-bounded evaluation. Denied, unavailable, malformed, or provenance-invalid evaluations produce no offer. When configured, the offer also includes one numeric tx_code (PIN) shown out-of-band from the QR. Returns 404 when the pre-authorized-code flow is disabled.",
-                    "security": [],
-                    "parameters": [
-                        {
-                            "name": "code",
-                            "in": "query",
-                            "required": true,
-                            "schema": { "type": "string" }
-                        },
-                        {
-                            "name": "state",
-                            "in": "query",
-                            "required": true,
-                            "schema": { "type": "string" }
-                        }
-                    ],
-                    "responses": {
-                        "200": {
-                            "description": "Offer page, or a representative target-selection page for a representative configuration",
-                            "content": {
-                                "text/html": {
-                                    "schema": { "type": "string" }
-                                }
-                            }
-                        },
-                        "400": {
-                            "description": "Login state, eSignet code, or id_token is invalid",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        },
-                        "403": {
-                            "description": "Registry-backed evaluation or issuance policy denied the transaction",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        },
-                        "404": { "description": "Pre-authorized-code flow is disabled" },
-                        "500": {
-                            "description": "OpenID4VCI issuer failed",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        }
-                    }
-                }
-            },
-            "/oid4vci/offer/representative": {
-                "post": {
-                    "summary": "Select a represented subject and render a pre-authorized-code offer",
-                    "operationId": "completeRepresentativeOid4vciOffer",
-                    "description": "Public and unauthenticated. Consumes the single-use target-selection state created after identity-provider authentication, verifies the CSRF token, binds the represented subject to the configured identifier type, proves the configured relationship through the exact Registry Relay claim closure, and only then renders a single-use pre-authorized-code offer. The relationship-proof expiry caps the transaction, offer, and access-token expiry. This endpoint is an HTML browser ceremony and accepts only a closed, bounded form body.",
-                    "security": [],
-                    "requestBody": {
-                        "required": true,
-                        "content": {
-                            "application/x-www-form-urlencoded": {
-                                "schema": {
-                                    "type": "object",
-                                    "additionalProperties": false,
-                                    "required": ["selection_state", "csrf_token", "target_id"],
-                                    "properties": {
-                                        "selection_state": { "type": "string", "minLength": 1 },
-                                        "csrf_token": { "type": "string", "minLength": 1 },
-                                        "target_id": { "type": "string", "minLength": 1, "maxLength": 256 }
-                                    }
-                                }
-                            }
-                        }
-                    },
-                    "responses": {
-                        "200": {
-                            "description": "Offer page with the credential offer URI and optional tx_code PIN",
-                            "content": {
-                                "text/html": {
-                                    "schema": { "type": "string" }
-                                }
-                            }
-                        },
-                        "400": {
-                            "description": "Selection state, CSRF token, or represented subject is invalid",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        },
-                        "403": {
-                            "description": "Relationship proof or issuance policy denied the transaction",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        },
-                        "404": { "description": "Representative pre-authorized-code flow is disabled" },
-                        "429": {
-                            "description": "Representative credential request is rate limited",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        },
-                        "500": {
-                            "description": "OpenID4VCI issuer failed",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        }
-                    }
-                }
-            },
-            "/oid4vci/token": {
-                "post": {
-                    "summary": "Redeem a pre-authorized-code for an access token",
-                    "operationId": "redeemOid4vciToken",
-                    "description": "Public and unauthenticated OID4VCI token endpoint for the pre-authorized-code grant. Accepts only grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code with a valid, unexpired, single-use pre-authorized_code. A matching tx_code is required when the credential offer includes a tx_code object. Mints a short-TTL Notary-signed access token plus a c_nonce. Returns 404 when the pre-authorized-code flow is disabled. Error responses use the OpenID4VCI error envelope, not RFC 9457 Problem Details.",
-                    "security": [],
-                    "requestBody": {
-                        "required": true,
-                        "content": {
-                            "application/x-www-form-urlencoded": {
-                                "schema": { "$ref": "#/components/schemas/TokenRequest" }
-                            },
-                            "application/json": {
-                                "schema": { "$ref": "#/components/schemas/TokenRequest" }
-                            }
-                        }
-                    },
-                    "responses": {
-                        "200": {
-                            "description": "Token response",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/TokenResponse" }
-                                }
-                            }
-                        },
-                        "400": {
-                            "description": "Invalid request, grant, or tx_code",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        },
-                        "404": { "description": "Pre-authorized-code flow is disabled" },
-                        "429": {
-                            "description": "Too many token attempts (wrong-PIN lockout or random-code flood)",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        },
-                        "500": {
-                            "description": "Token issuance failed",
-                            "content": {
-                                "application/json": {
-                                    "schema": { "$ref": "#/components/schemas/Oid4vciError" }
-                                }
-                            }
-                        }
-                    }
-                }
-            },
-            "/v1/claims": {
-                "get": {
-                    "summary": "List claims visible to the caller",
-                    "operationId": "listClaims",
-                    "responses": {
-                        "200": { "description": "Visible claims" },
-                        "401": { "description": "Missing or invalid credential" }
-                    }
-                }
-            },
-            "/v1/claims/{claim_id}": {
-                "get": {
-                    "summary": "Get one claim definition",
-                    "operationId": "getClaim",
-                    "parameters": [
-                        {
-                            "name": "claim_id",
-                            "in": "path",
-                            "required": true,
-                            "schema": { "type": "string" }
-                        }
-                    ],
-                    "responses": {
-                        "200": { "description": "Claim definition" },
-                        "401": { "description": "Missing or invalid credential" },
-                        "404": { "description": "Claim not found" }
-                    }
-                }
-            },
-            "/v1/formats": {
-                "get": {
-                    "summary": "List supported output formats",
-                    "operationId": "listFormats",
-                    "responses": {
-                        "200": { "description": "Supported formats" },
-                        "401": { "description": "Missing or invalid credential" }
-                    }
-                }
-            },
-            "/v1/evaluations": {
-                "post": {
-                    "summary": "Evaluate claims for one target",
-                    "operationId": "evaluateClaims",
-                    "requestBody": {
-                        "required": true,
-                        "content": {
-                            "application/json": {
-                                "schema": { "$ref": "#/components/schemas/EvaluateRequest" }
-                            }
-                        }
-                    },
-                    "responses": {
-                        "200": { "description": "Claim evaluation result" },
-                        "400": { "description": "Invalid request" },
-                        "401": { "description": "Missing or invalid credential" },
-                        "403": { "description": "Not authorized for requested claim, purpose, disclosure, or format" },
-                        "406": { "description": "Requested format is not acceptable" },
-                        "413": { "description": "Request body is too large" },
-                        "429": { "description": "Subject-access request is rate limited, or the machine evaluation quota was exceeded" },
-                        "503": { "description": "Required Relay consultation or operational dependency is unavailable" }
-                    }
-                }
-            },
-            "/federation/v1/evaluations": {
-                "post": {
-                    "summary": "Evaluate one configured federation profile for a trusted peer",
-                    "operationId": "federatedEvaluate",
-                    "description": "Accepts a compact JWS request with typ registry-notary-request+jwt. This route is mounted only when federation is enabled and uses body-JWT authentication instead of API key or bearer authentication.",
-                    "security": [],
-                    "requestBody": {
-                        "required": true,
-                        "content": {
-                            "application/jwt": {
-                                "schema": {
-                                    "type": "string",
-                                    "description": "Compact JWS signed federation evaluation request"
-                                }
-                            }
-                        }
-                    },
-                    "responses": {
-                        "200": {
-                            "description": "Compact JWS signed federation evaluation response",
-                            "content": {
-                                "application/jwt": {
-                                    "schema": {
-                                        "type": "string",
-                                        "description": "Compact JWS with typ registry-notary-response+jwt"
-                                    }
-                                }
-                            }
-                        },
-                        "400": { "description": "Invalid federation request" },
-                        "401": { "description": "Invalid federation token" },
-                        "403": { "description": "Peer, profile, purpose, or requester/target identity path is not allowed" },
-                        "409": { "description": "Request replay detected" },
-                        "413": { "description": "Request body is too large" },
-                        "415": { "description": "Content type is not application/jwt" },
-                        "503": { "description": "An operational dependency required for a fail-closed response is unavailable" }
-                    }
-                }
-            },
-            "/v1/batch-evaluations": {
-                "post": {
-                    "summary": "Evaluate claims for multiple request items inline",
-                    "operationId": "batchEvaluateClaims",
-                    "parameters": [
-                        {
-                            "name": "Idempotency-Key",
-                            "in": "header",
-                            "required": true,
-                            "description": "Required for every batch. The value is caller-bound and may contain 1 to 256 bytes.",
-                            "schema": { "type": "string", "minLength": 1, "maxLength": 256 }
-                        }
-                    ],
-                    "requestBody": {
-                        "required": true,
-                        "content": {
-                            "application/json": {
-                                "schema": { "$ref": "#/components/schemas/BatchEvaluateRequest" }
-                            }
-                        }
-                    },
-                    "responses": {
-                        "200": { "description": "Per-item claim evaluation results" },
-                        "400": { "description": "Invalid request, including a batch without a valid Idempotency-Key or an item that fails whole-batch preflight" },
-                        "401": { "description": "Missing or invalid credential" },
-                        "403": { "description": "Not authorized for requested claim, purpose, disclosure, or format" },
-                        "406": { "description": "Requested format is not acceptable" },
-                        "409": { "description": "Idempotency key conflicts with another request body" },
-                        "413": { "description": "The request exceeds the hard 100-member ceiling or a lower configured batch limit. Rejection occurs before quota, idempotency, Relay, source, or retained-state side effects." },
-                        "429": { "description": "Subject-access request is rate limited, or the machine evaluation quota was exceeded" },
-                        "503": { "description": "Required Relay consultation or operational dependency is unavailable" }
-                    }
-                }
-            },
-            "/v1/evaluations/{evaluation_id}/render": {
-                "post": {
-                    "summary": "Render a stored evaluation",
-                    "operationId": "renderEvidence",
-                    "parameters": [
-                        {
-                            "name": "evaluation_id",
-                            "in": "path",
-                            "required": true,
-                            "schema": { "type": "string" }
-                        }
-                    ],
-                    "requestBody": {
-                        "required": true,
-                        "content": {
-                            "application/json": {
-                                "schema": { "$ref": "#/components/schemas/RenderEvaluationRequest" }
-                            }
-                        }
-                    },
-                    "responses": {
-                        "200": { "description": "Rendered evidence artifact" },
-                        "400": { "description": "Invalid request or disclosure widening attempt" },
-                        "401": { "description": "Missing or invalid credential" },
-                        "404": { "description": "Evaluation not found" },
-                        "406": { "description": "Requested format is not acceptable" },
-                        "413": { "description": "Request body is too large" },
-                        "429": { "description": "Subject-access request is rate limited" },
-                        "503": { "description": "Required Relay consultation or operational dependency is unavailable" }
-                    }
-                }
-            },
-            "/v1/credentials": {
-                "post": {
-                    "summary": "Issue a credential from a stored evaluation",
-                    "description": "Issues only when a fresh non-delegated registry-backed evaluation has exact compiler pins and normalized unique Relay executions for every selected root's dependency closure, matching the active configuration and public evaluation result. Representative issuance uses the separately configured OpenID4VCI ceremony.",
-                    "operationId": "issueCredential",
-                    "requestBody": {
-                        "required": true,
-                        "content": {
-                            "application/json": {
-                                "schema": { "$ref": "#/components/schemas/CredentialIssueRequest" }
-                            }
-                        }
-                    },
-                    "responses": {
-                        "200": { "description": "Issued credential" },
-                        "400": { "description": "Invalid request or disclosure widening attempt" },
-                        "401": { "description": "Missing or invalid credential" },
-                        "404": { "description": "Evaluation not found" },
-                        "406": { "description": "Requested format is not acceptable" },
-                        "409": { "description": "Holder proof replay or Relay ambiguity conflict" },
-                        "413": { "description": "Request body is too large" },
-                        "429": { "description": "Subject-access request is rate limited" },
-                        "503": { "description": "Required Relay consultation or operational dependency is unavailable" }
-                    }
-                }
-            },
-            "/v1/credentials/{credential_id}/status": {
-                "get": {
-                    "summary": "Fetch credential lifecycle status",
-                    "operationId": "getCredentialStatus",
-                    "security": [],
-                    "parameters": [
-                        {
-                            "name": "credential_id",
-                            "in": "path",
-                            "required": true,
-                            "schema": { "type": "string" }
-                        }
-                    ],
-                    "responses": {
-                        "200": { "description": "Credential status record" },
-                        "404": { "description": "Credential status is disabled or not found" },
-                        "503": { "description": "Credential status store is unavailable" }
-                    }
-                }
-            },
-            "/admin/v1/credentials/{credential_id}/status": {
-                "post": {
-                    "summary": "Update credential lifecycle status",
-                    "operationId": "updateCredentialStatus",
-                    "security": [
-                        { "apiKeyAuth": [] },
-                        { "bearerAuth": [] }
-                    ],
-                    "parameters": [
-                        {
-                            "name": "credential_id",
-                            "in": "path",
-                            "required": true,
-                            "schema": { "type": "string" }
-                        }
-                    ],
-                    "requestBody": {
-                        "required": true,
-                        "content": {
-                            "application/json": {
-                                "schema": { "$ref": "#/components/schemas/CredentialStatusUpdateRequest" }
-                            }
-                        }
-                    },
-                    "responses": {
-                        "200": { "description": "Updated credential status record" },
-                        "400": { "description": "Invalid status value" },
-                        "401": { "description": "Missing or invalid credential" },
-                        "403": { "description": "Caller lacks registry_notary:admin scope" },
-                        "404": { "description": "Credential status is disabled or not found" },
-                        "503": { "description": "Credential status store is unavailable" }
-                    }
-                }
-            }
-        },
-        "components": {
-            "schemas": {
-                "ProblemDetails": problem_details_schema(),
-                "CredentialStatus": credential_status_schema(),
-                "CredentialStatusUpdateRequest": credential_status_update_request_schema(),
-                "CredentialIssuerMetadata": credential_issuer_metadata_schema(),
-                "CredentialConfigurationMetadata": credential_configuration_metadata_schema(),
-                "SdJwtVcTypeMetadata": sd_jwt_vc_type_metadata_schema(),
-                "CredentialRequest": credential_request_schema(),
-                "CredentialResponse": credential_response_schema(),
-                "RegistryClientOfferRequest": registry_client_offer_request_schema(),
-                "RegistryClientOfferResponse": registry_client_offer_response_schema(),
-                "TokenRequest": token_request_schema(),
-                "TokenResponse": token_response_schema(),
-                "Oid4vciError": oid4vci_error_schema()
-            },
-            "securitySchemes": {
-                "apiKeyAuth": {
-                    "type": "apiKey",
-                    "in": "header",
-                    "name": "X-Api-Key"
-                },
-                "bearerAuth": {
-                    "type": "http",
-                    "scheme": "bearer"
-                }
-            }
-        }
-    });
-    add_response_examples(&mut raw_document);
-
-    let mut document: OpenApi = serde_json::from_value(raw_document)
-        .expect("static Registry Notary OpenAPI document is valid");
-
-    let components = document
-        .components
-        .get_or_insert_with(utoipa::openapi::Components::new);
-    components
-        .schemas
-        .insert("ClaimRef".to_string(), ClaimRef::schema());
-    components.schemas.insert(
-        "RenderEvaluationRequest".to_string(),
-        RenderEvaluationRequest::schema(),
-    );
-    components.schemas.insert(
-        "CredentialIssueRequest".to_string(),
-        CredentialIssueRequest::schema(),
-    );
-    components
-        .schemas
-        .insert("HolderRequest".to_string(), HolderRequest::schema());
-
-    let mut document_value =
-        serde_json::to_value(&document).expect("Registry Notary OpenAPI document serializes");
-    let schema_overrides = [
-        ("ClaimRef", claim_ref_schema()),
-        ("EvaluateRequest", evaluate_request_schema()),
-        ("BatchEvaluateRequest", batch_evaluate_request_schema()),
-        (
-            "BatchEvaluateItemRequest",
-            batch_evaluate_item_request_schema(),
-        ),
-        ("EvidenceEntity", evidence_entity_schema()),
-        ("EvidenceIdentifier", evidence_identifier_schema()),
-        ("EvidenceAssurance", evidence_assurance_schema()),
-        ("EvidenceRelationship", evidence_relationship_schema()),
-        ("EvidenceOnBehalfOf", evidence_on_behalf_of_schema()),
-        ("EvidenceActor", evidence_actor_schema()),
-        ("ReadinessResponse", readiness_response_schema()),
-        ("ReadinessChecks", readiness_checks_schema()),
-        (
-            "SigningProviderReadinessChecks",
-            signing_provider_readiness_checks_schema(),
-        ),
-        ("SignerCustodyChecks", signer_custody_checks_schema()),
-        ("SignerCustodySurfaces", signer_custody_surfaces_schema()),
-        ("SignerSurfaceChecks", signer_surface_checks_schema()),
-        (
-            "EnabledSignerSurfaceChecks",
-            enabled_signer_surface_checks_schema(),
-        ),
-        ("ReadinessProblem", readiness_problem_schema()),
-        ("ReadinessCheckProblem", readiness_check_problem_schema()),
-        (
-            "AuditChainInconsistentProblem",
-            audit_chain_inconsistent_problem_schema(),
-        ),
-        ("ListClaimsResponse", list_claims_response_schema()),
-        ("ClaimSummary", claim_summary_schema()),
-        ("ClaimSemantics", claim_semantics_schema()),
-        ("ClaimTargetInputMethod", claim_target_input_method_schema()),
-        ("ClaimTargetInputGroup", claim_target_input_group_schema()),
-        ("ClaimTargetInput", claim_target_input_schema()),
-        ("EvaluationResponse", evaluation_response_schema()),
-        ("ClaimResultView", claim_result_view_schema()),
-        ("BatchEvaluateResponse", batch_evaluate_response_schema()),
-        ("BatchItemResponse", batch_item_response_schema()),
-        ("BatchClaimResultView", batch_claim_result_view_schema()),
-        ("BatchItemError", batch_item_error_schema()),
-        ("BatchSummary", batch_summary_schema()),
-        ("ClaimProvenance", claim_provenance_schema()),
-        ("ProvenanceGeneratedBy", provenance_generated_by_schema()),
-        ("ProvenanceUsed", provenance_used_schema()),
-        ("TargetRefView", target_ref_view_schema()),
-        ("EvidenceEntityRef", evidence_entity_ref_schema()),
-        ("RelayOutputContract", relay_output_contract_schema()),
-        (
-            "RelayOutputObjectFieldContract",
-            relay_output_object_field_contract_schema(),
-        ),
-    ];
-    for (name, schema) in schema_overrides.iter() {
-        document_value["components"]["schemas"][*name] = schema.clone();
-    }
-    set_registry_offer_no_store_headers(&mut document_value);
-    set_json_response_schema(
-        &mut document_value,
-        "/ready",
-        "get",
-        "200",
-        "#/components/schemas/ReadinessResponse",
-    );
-    set_problem_response_schema(
-        &mut document_value,
-        "/ready",
-        "get",
-        "503",
-        "#/components/schemas/ReadinessProblem",
-    );
-    set_json_response_schema(
-        &mut document_value,
-        "/v1/claims",
-        "get",
-        "200",
-        "#/components/schemas/ListClaimsResponse",
-    );
-    set_json_response_schema(
-        &mut document_value,
-        "/v1/claims/{claim_id}",
-        "get",
-        "200",
-        "#/components/schemas/ClaimSummary",
-    );
-    set_json_response_schema(
-        &mut document_value,
-        "/v1/evaluations",
-        "post",
-        "200",
-        "#/components/schemas/EvaluationResponse",
-    );
-    set_json_response_schema(
-        &mut document_value,
-        "/v1/batch-evaluations",
-        "post",
-        "200",
-        "#/components/schemas/BatchEvaluateResponse",
-    );
-    set_json_response_schema(
-        &mut document_value,
-        "/v1/evaluations/{evaluation_id}/render",
-        "post",
-        "200",
-        "#/components/schemas/EvaluationResponse",
-    );
-    document_value["info"]["summary"] = json!(INFO_SUMMARY);
-    document_value["info"]["contact"] = json!({ "name": CONTACT_NAME });
-    serde_json::from_value::<OpenApi>(document_value.clone()).unwrap_or_else(|err| {
-        let base_document_value =
-            serde_json::to_value(&document).expect("Registry Notary OpenAPI document serializes");
-        for (name, schema) in schema_overrides {
-            let mut probe = base_document_value.clone();
-            probe["components"]["schemas"][name] = schema;
-            if let Err(schema_err) = serde_json::from_value::<OpenApi>(probe) {
-                panic!("Registry Notary OpenAPI {name} schema is valid: {schema_err}");
-            }
-        }
-        panic!("Registry Notary OpenAPI schema overrides are valid: {err}");
-    });
-    document_value
-}
-
-fn add_response_examples(document: &mut Value) {
-    set_json_response(
-        document,
-        "/healthz",
-        "get",
-        "200",
-        "Service process is alive",
-        json!({
-            "status": "ok",
-            "checks": {
-                "total": 1,
-                "ok": 1,
-                "degraded": 0,
-                "failed": 0
-            }
-        }),
-    );
-    set_problem_response(
-        document,
-        "/healthz",
-        "get",
-        "4XX",
-        "Client error",
-        problem_example(
-            400,
-            "request.invalid",
-            "Invalid evidence request",
-            "the evidence request is invalid",
-        ),
-    );
-    set_json_response(
-        document,
-        "/ready",
-        "get",
-        "200",
-        "Evidence runtime is ready",
-        json!({
-            "status": "ready",
-            "checks": {
-                "total": 3,
-                "ok": 3,
-                "degraded": 0,
-                "failed": 0,
-                "signing_providers": {
-                    "total": 1,
-                    "ok": 1,
-                    "failed": 0,
-                    "custody": {
-                        "active_provider_counts": {
-                            "pkcs11": 1
-                        },
-                        "signing_provider_count": 1,
-                        "local_software_signing_provider_count": 0,
-                        "custody_approval_required": true,
-                        "custody_approved": true,
-                        "unapproved_signing_provider_count": 0,
-                        "surfaces": {
-                            "credential_issuance": {
-                                "signing_provider_count": 1,
-                                "local_software_signing_provider_count": 0,
-                                "unapproved_signing_provider_count": 0
-                            },
-                            "access_token_issuance": {
-                                "enabled": false,
-                                "signing_provider_count": 0,
-                                "local_software_signing_provider_count": 0,
-                                "unapproved_signing_provider_count": 0
-                            },
-                            "federation": {
-                                "enabled": false,
-                                "signing_provider_count": 0,
-                                "local_software_signing_provider_count": 0,
-                                "unapproved_signing_provider_count": 0
-                            }
-                        }
-                    }
-                },
-                "relay": {
-                    "total": 1,
-                    "ok": 1,
-                    "failed": 0
-                }
-            }
-        }),
-    );
-    set_problem_response(
-        document,
-        "/ready",
-        "get",
-        "4XX",
-        "Client error",
-        problem_example(
-            400,
-            "request.invalid",
-            "Invalid evidence request",
-            "the evidence request is invalid",
-        ),
-    );
-    set_problem_response(
-        document,
-        "/ready",
-        "get",
-        "503",
-        "Evidence runtime is not ready, is degraded, or has an inconsistent audit chain",
-        json!({
-            "type": format!("{}/readiness/not-ready", crate::PROBLEM_TYPE_BASE_URL),
-            "title": "Evidence runtime is not ready",
-            "status": 503,
-            "detail": "one or more readiness checks are not ready",
-            "code": "readiness.not_ready",
-            "request_id": "01J00000000000000000000000",
-            "readiness_status": "not_ready",
-            "checks": {
-                "total": 3,
-                "ok": 1,
-                "degraded": 1,
-                "failed": 1,
-                "signing_providers": {
-                    "total": 1,
-                    "ok": 1,
-                    "failed": 0,
-                    "custody": {
-                        "active_provider_counts": {
-                            "local_jwk_env": 1
-                        },
-                        "signing_provider_count": 1,
-                        "local_software_signing_provider_count": 1,
-                        "custody_approval_required": true,
-                        "custody_approved": false,
-                        "unapproved_signing_provider_count": 1,
-                        "surfaces": {
-                            "credential_issuance": {
-                                "signing_provider_count": 1,
-                                "local_software_signing_provider_count": 1,
-                                "unapproved_signing_provider_count": 1
-                            },
-                            "access_token_issuance": {
-                                "enabled": false,
-                                "signing_provider_count": 0,
-                                "local_software_signing_provider_count": 0,
-                                "unapproved_signing_provider_count": 0
-                            },
-                            "federation": {
-                                "enabled": false,
-                                "signing_provider_count": 0,
-                                "local_software_signing_provider_count": 0,
-                                "unapproved_signing_provider_count": 0
-                            }
-                        }
-                    }
-                },
-                "relay": {
-                    "total": 1,
-                    "ok": 0,
-                    "failed": 1
-                }
-            }
-        }),
-    );
-    let readiness_media = &mut document["paths"]["/ready"]["get"]["responses"]["503"]["content"]
-        ["application/problem+json"];
-    let readiness_example = readiness_media["example"].take();
-    readiness_media
-        .as_object_mut()
-        .expect("readiness problem media type is an object")
-        .insert(
-            "examples".to_string(),
-            json!({
-                "notReady": {
-                    "summary": "A runtime readiness check is not ready",
-                    "value": readiness_example
-                },
-                "auditChainInconsistent": {
-                    "summary": "The retained audit chain failed integrity verification",
-                    "value": {
-                        "type": format!("{}/audit/chain-inconsistent", crate::PROBLEM_TYPE_BASE_URL),
-                        "title": "Audit chain inconsistent",
-                        "status": 503,
-                        "detail": "the retained audit chain has an integrity failure and requires operator recovery",
-                        "code": "audit.chain.inconsistent",
-                        "request_id": "01J00000000000000000000000"
-                    }
-                }
-            }),
-        );
-    set_problem_response(
-        document,
-        "/admin/v1/reload",
-        "post",
-        "501",
-        "Runtime configuration reload is not supported",
-        admin_error_example(
-            501,
-            "registry.admin.capability.not_supported",
-            "Admin capability not supported",
-            "registry-notary standalone runtime does not support reload",
-        ),
-    );
-    set_json_response(
-        document,
-        "/admin/v1/capabilities",
-        "get",
-        "200",
-        "Admin capabilities for this product runtime",
-        json!({
-            "schema": "registry.admin.capabilities.v1",
-            "product": "registry-notary",
-            "admin_api_version": "v1",
-            "supported_posture_tiers": ["default", "restricted"],
-            "config": {
-                "verify": {
-                    "supported": false,
-                    "currently_available": false
-                },
-                "dry_run": {
-                    "supported": false,
-                    "currently_available": false
-                },
-                "apply": {
-                    "supported": false,
-                    "currently_available": false,
-                    "supported_sources": [],
-                    "requires_signed_input": true
-                }
-            },
-            "break_glass": {
-                "supported": false,
-                "currently_available": false,
-                "rate_limit_scope": "none"
-            },
-            "listeners": {
-                "admin": {
-                    "mode": "shared_with_public",
-                    "public_admin_routes": true
-                },
-                "metrics": {
-                    "mode": "shared_with_public",
-                    "requires_admin_scope": false,
-                    "required_scope": "registry_notary:metrics_read"
-                }
-            },
-            "root_transition": {
-                "supported": false,
-                "currently_available": false
-            },
-            "hot_swap": {
-                "supported": false,
-                "currently_available": false,
-                "components": []
-            },
-            "reload": {
-                "resource_reload": {
-                    "supported": false,
-                    "currently_available": false
-                },
-                "table_reload": {
-                    "supported": false,
-                    "currently_available": false
-                },
-                "config_reload": {
-                    "supported": false,
-                    "currently_available": false
-                }
-            }
-        }),
-    );
-    set_problem_response(
-        document,
-        "/admin/v1/capabilities",
-        "get",
-        "401",
-        "Missing or invalid credential",
-        missing_credential_example(),
-    );
-    set_problem_response(
-        document,
-        "/admin/v1/capabilities",
-        "get",
-        "403",
-        "Caller lacks registry_notary:ops_read scope",
-        problem_example(
-            403,
-            "auth.scope_denied",
-            "Scope denied",
-            "missing required scope",
-        ),
-    );
-    set_problem_response(
-        document,
-        "/admin/v1/reload",
-        "post",
-        "401",
-        "Missing or invalid credential",
-        missing_credential_example(),
-    );
-    set_problem_response(
-        document,
-        "/admin/v1/reload",
-        "post",
-        "403",
-        "Caller lacks registry_notary:admin scope",
-        problem_example(
-            403,
-            "auth.scope_denied",
-            "Scope denied",
-            "missing required scope",
-        ),
-    );
-    set_json_response(
-        document,
-        "/admin/v1/posture",
-        "get",
-        "200",
-        "Redacted posture for the requested tier",
-        serde_json::from_str(registry_platform_ops::NOTARY_POSTURE_EXAMPLE_V1)
-            .expect("notary posture example is valid JSON"),
-    );
-    set_problem_response(
-        document,
-        "/admin/v1/posture",
-        "get",
-        "400",
-        "Posture tier is invalid",
-        admin_error_example(
-            400,
-            "registry.admin.posture.invalid_tier",
-            "Admin posture tier invalid",
-            "posture tier must be default or restricted",
-        ),
-    );
-    set_problem_response(
-        document,
-        "/admin/v1/posture",
-        "get",
-        "401",
-        "Missing or invalid credential",
-        missing_credential_example(),
-    );
-    set_problem_response(
-        document,
-        "/admin/v1/posture",
-        "get",
-        "403",
-        "Caller lacks registry_notary:ops_read scope",
-        problem_example(
-            403,
-            "auth.scope_denied",
-            "Scope denied",
-            "missing required scope",
-        ),
-    );
-    set_problem_response(
-        document,
-        "/admin/v1/posture",
-        "get",
-        "500",
-        "Posture could not be filtered for the requested tier",
-        problem_example(
-            500,
-            "posture.filter_failed",
-            "Admin posture unavailable",
-            "admin posture could not be filtered for the requested tier",
-        ),
-    );
-    set_problem_response(
-        document,
-        "/admin/v1/posture",
-        "get",
-        "503",
-        "Posture state is unavailable",
-        admin_error_example(
-            503,
-            "posture.unavailable",
-            "Admin posture unavailable",
-            "posture state is unavailable",
-        ),
-    );
-    set_json_response(
-        document,
-        "/openapi.json",
-        "get",
-        "200",
-        "OpenAPI document",
-        json!({
-            "openapi": "3.1.0",
-            "info": {
-                "title": "Registry Notary API",
-                "version": env!("CARGO_PKG_VERSION")
-            },
-            "paths": {
-                "/v1/evaluations": {}
-            }
-        }),
-    );
-    set_problem_response(
-        document,
-        "/openapi.json",
-        "get",
-        "401",
-        "Missing or invalid credential",
-        missing_credential_example(),
-    );
-    set_json_response(
-        document,
-        "/.well-known/evidence-service",
-        "get",
-        "200",
-        "Service document",
-        discovery_example(),
-    );
-    set_problem_response(
-        document,
-        "/.well-known/evidence-service",
-        "get",
-        "401",
-        "Missing or invalid credential",
-        missing_credential_example(),
-    );
-    set_json_response(
-        document,
-        "/.well-known/evidence/jwks.json",
-        "get",
-        "200",
-        "Public JWKS",
-        jwks_example(),
-    );
-    set_problem_response(
-        document,
-        "/.well-known/evidence/jwks.json",
-        "get",
-        "401",
-        "Missing or invalid credential",
-        missing_credential_example(),
-    );
-    set_json_response(
-        document,
-        "/.well-known/openid-credential-issuer",
-        "get",
-        "200",
-        "OpenID4VCI credential issuer metadata",
-        oid4vci_issuer_metadata_example(),
-    );
-    set_oid4vci_error_response(
-        document,
-        "/.well-known/openid-credential-issuer",
-        "get",
-        "500",
-        "OpenID4VCI issuer failed",
-        oid4vci_error_example("server_error", "credential issuer failed"),
-    );
-    set_json_response(
-        document,
-        "/credentials/{vct_path}",
-        "get",
-        "200",
-        "SD-JWT VC Type Metadata",
-        sd_jwt_vc_type_metadata_example(),
-    );
-    set_json_response(
-        document,
-        "/.well-known/vct/{vct_path}",
-        "get",
-        "200",
-        "SD-JWT VC Type Metadata",
-        sd_jwt_vc_type_metadata_example(),
-    );
-    set_json_response(
-        document,
-        "/oid4vci/credential",
-        "post",
-        "200",
-        "Credential response",
-        oid4vci_credential_response_example(),
-    );
-    for (status, code, description) in [
-        ("400", "invalid_proof", "credential proof is invalid"),
-        ("401", "invalid_token", "credential access token is invalid"),
-        ("403", "access_denied", "credential request is denied"),
-        (
-            "429",
-            "temporarily_unavailable",
-            "credential request is rate limited",
-        ),
-        ("500", "server_error", "credential issuer failed"),
-    ] {
-        set_oid4vci_error_response(
-            document,
-            "/oid4vci/credential",
-            "post",
-            status,
-            match status {
-                "400" => "Invalid credential request, proof, or type",
-                "401" => "Invalid credential access token",
-                "403" => "Credential request is denied",
-                "429" => "Credential request is rate limited",
-                _ => "OpenID4VCI issuer failed",
-            },
-            oid4vci_error_example(code, description),
-        );
-    }
-    set_json_response(
-        document,
-        "/oid4vci/offers",
-        "post",
-        "200",
-        "New or exactly replayed credential offer response",
-        registry_client_offer_response_example(),
-    );
-    for (status, code, title, detail) in [
-        (
-            "400",
-            "request.invalid",
-            "Invalid evidence request",
-            "the offer request or Idempotency-Key is invalid",
-        ),
-        (
-            "401",
-            "auth.missing_credential",
-            "Missing credential",
-            "missing authentication credential",
-        ),
-        (
-            "403",
-            "auth.scope_denied",
-            "Scope denied",
-            "missing the offer-create or credential-configuration scope",
-        ),
-        (
-            "404",
-            "evaluation.not_found",
-            "Evaluation not found",
-            "the evaluation is unknown, expired, or not owned by this client",
-        ),
-        (
-            "409",
-            "offer_conflict",
-            "Credential offer was not created",
-            "the idempotency key conflicts or the evaluation was already consumed",
-        ),
-        (
-            "429",
-            "evaluation.quota_exceeded",
-            "Machine quota exceeded",
-            "the machine offer quota was exceeded for this principal",
-        ),
-        (
-            "503",
-            "offer_unavailable",
-            "Credential offer was not created",
-            "the offer correctness state is unavailable",
-        ),
-    ] {
-        let status_code = status.parse::<u16>().expect("static status is valid");
-        set_problem_response(
-            document,
-            "/oid4vci/offers",
-            "post",
-            status,
-            title,
-            problem_example(status_code, code, title, detail),
-        );
-    }
-    set_json_response(
-        document,
-        "/oid4vci/token",
-        "post",
-        "200",
-        "Token response",
-        oid4vci_token_response_example(),
-    );
-    for (status, code, description) in [
-        (
-            "400",
-            "invalid_grant",
-            "pre-authorized code or tx_code is invalid",
-        ),
-        ("429", "slow_down", "too many token requests"),
-        ("500", "server_error", "token issuance failed"),
-    ] {
-        set_oid4vci_error_response(
-            document,
-            "/oid4vci/token",
-            "post",
-            status,
-            match status {
-                "400" => "Invalid request, grant, or tx_code",
-                "429" => "Too many token attempts (wrong-PIN lockout or random-code flood)",
-                _ => "Token issuance failed",
-            },
-            oid4vci_error_example(code, description),
-        );
-    }
-    set_json_response(
-        document,
-        "/v1/claims",
-        "get",
-        "200",
-        "Visible claims",
-        claims_list_example(),
-    );
-    set_problem_response(
-        document,
-        "/v1/claims",
-        "get",
-        "401",
-        "Missing or invalid credential",
-        missing_credential_example(),
-    );
-    set_json_response(
-        document,
-        "/v1/claims/{claim_id}",
-        "get",
-        "200",
-        "Claim definition",
-        farmer_under_4ha_claim_example(),
-    );
-    set_problem_response(
-        document,
-        "/v1/claims/{claim_id}",
-        "get",
-        "401",
-        "Missing or invalid credential",
-        missing_credential_example(),
-    );
-    set_problem_response(
-        document,
-        "/v1/claims/{claim_id}",
-        "get",
-        "404",
-        "Claim not found",
-        problem_example(
-            404,
-            "claim.not_found",
-            "Claim not found",
-            "the requested claim is not available",
-        ),
-    );
-    set_json_response(
-        document,
-        "/v1/formats",
-        "get",
-        "200",
-        "Supported formats",
-        formats_example(),
-    );
-    set_problem_response(
-        document,
-        "/v1/formats",
-        "get",
-        "401",
-        "Missing or invalid credential",
-        missing_credential_example(),
-    );
-    set_json_response(
-        document,
-        "/v1/evaluations",
-        "post",
-        "200",
-        "Claim evaluation result",
-        evaluate_example(),
-    );
-    set_problem_response(
-        document,
-        "/v1/evaluations",
-        "post",
-        "400",
-        "Invalid request",
-        problem_example(
-            400,
-            "request.invalid",
-            "Invalid evidence request",
-            "the evidence request is invalid",
-        ),
-    );
-    set_problem_response(
-        document,
-        "/v1/evaluations",
-        "post",
-        "401",
-        "Missing or invalid credential",
-        missing_credential_example(),
-    );
-    set_problem_response(
-        document,
-        "/v1/evaluations",
-        "post",
-        "403",
-        "Not authorized for requested claim, purpose, disclosure, or format",
-        problem_example(
-            403,
-            "auth.scope_denied",
-            "Scope denied",
-            "missing required scope",
-        ),
-    );
-    add_runtime_problem_responses(
-        document,
-        "/v1/evaluations",
-        "post",
-        &["406", "413", "429", "503"],
-    );
-    set_json_response(
-        document,
-        "/v1/batch-evaluations",
-        "post",
-        "200",
-        "Per-item claim evaluation results",
-        batch_evaluate_example(),
-    );
-    set_problem_response(
-        document,
-        "/v1/batch-evaluations",
-        "post",
-        "400",
-        "Invalid request",
-        problem_example(
-            400,
-            "request.invalid",
-            "Invalid evidence request",
-            "the evidence request is invalid",
-        ),
-    );
-    set_problem_response(
-        document,
-        "/v1/batch-evaluations",
-        "post",
-        "401",
-        "Missing or invalid credential",
-        missing_credential_example(),
-    );
-    set_problem_response(
-        document,
-        "/v1/batch-evaluations",
-        "post",
-        "403",
-        "Not authorized for requested claim, purpose, disclosure, or format",
-        problem_example(
-            403,
-            "claim.disclosure_not_allowed",
-            "Disclosure not allowed",
-            "the requested disclosure profile is not allowed",
-        ),
-    );
-    add_runtime_problem_responses(
-        document,
-        "/v1/batch-evaluations",
-        "post",
-        &["406", "409", "413", "429", "503"],
-    );
-    set_problem_response(
-        document,
-        "/v1/batch-evaluations",
-        "post",
-        "413",
-        "Batch too large",
-        problem_example(
-            413,
-            "batch.too_large",
-            "Batch too large",
-            "the batch exceeds the platform or configured member limit",
-        ),
-    );
-    set_json_response(
-        document,
-        "/v1/evaluations/{evaluation_id}/render",
-        "post",
-        "200",
-        "Rendered evidence artifact",
-        render_example(),
-    );
-    set_problem_response(
-        document,
-        "/v1/evaluations/{evaluation_id}/render",
-        "post",
-        "400",
-        "Invalid request or disclosure widening attempt",
-        problem_example(
-            400,
-            "request.invalid",
-            "Invalid evidence request",
-            "the evidence request is invalid",
-        ),
-    );
-    set_problem_response(
-        document,
-        "/v1/evaluations/{evaluation_id}/render",
-        "post",
-        "401",
-        "Missing or invalid credential",
-        missing_credential_example(),
-    );
-    set_problem_response(
-        document,
-        "/v1/evaluations/{evaluation_id}/render",
-        "post",
-        "404",
-        "Evaluation not found",
-        evaluation_not_found_example(),
-    );
-    add_runtime_problem_responses(
-        document,
-        "/v1/evaluations/{evaluation_id}/render",
-        "post",
-        &["406", "413", "429", "503"],
-    );
-    set_json_response(
-        document,
-        "/v1/credentials",
-        "post",
-        "200",
-        "Issued credential",
-        credential_issue_example(),
-    );
-    set_problem_response(
-        document,
-        "/v1/credentials",
-        "post",
-        "400",
-        "Invalid request or disclosure widening attempt",
-        problem_example(
-            400,
-            "credential.holder_proof_required",
-            "Holder proof required",
-            "holder proof of possession is required",
-        ),
-    );
-    set_problem_response(
-        document,
-        "/v1/credentials",
-        "post",
-        "401",
-        "Missing or invalid credential",
-        missing_credential_example(),
-    );
-    set_problem_response(
-        document,
-        "/v1/credentials",
-        "post",
-        "404",
-        "Evaluation not found",
-        evaluation_not_found_example(),
-    );
-    add_runtime_problem_responses(
-        document,
-        "/v1/credentials",
-        "post",
-        &["406", "409", "413", "429", "503"],
-    );
-    set_json_response(
-        document,
-        "/v1/credentials/{credential_id}/status",
-        "get",
-        "200",
-        "Credential status record",
-        credential_status_example("valid"),
-    );
-    set_problem_response(
-        document,
-        "/v1/credentials/{credential_id}/status",
-        "get",
-        "404",
-        "Credential status is disabled or not found",
-        credential_status_problem_example(404, "credential_status.not_found"),
-    );
-    set_problem_response(
-        document,
-        "/v1/credentials/{credential_id}/status",
-        "get",
-        "503",
-        "Credential status store is unavailable",
-        credential_status_problem_example(503, "credential_status.unavailable"),
-    );
-    set_json_response(
-        document,
-        "/admin/v1/credentials/{credential_id}/status",
-        "post",
-        "200",
-        "Updated credential status record",
-        credential_status_example("revoked"),
-    );
-    set_problem_response(
-        document,
-        "/admin/v1/credentials/{credential_id}/status",
-        "post",
-        "400",
-        "Invalid status value",
-        credential_status_problem_example(400, "credential_status.invalid_status"),
-    );
-    set_problem_response(
-        document,
-        "/admin/v1/credentials/{credential_id}/status",
-        "post",
-        "401",
-        "Missing or invalid credential",
-        missing_credential_example(),
-    );
-    set_problem_response(
-        document,
-        "/admin/v1/credentials/{credential_id}/status",
-        "post",
-        "403",
-        "Caller lacks registry_notary:admin scope",
-        problem_example(
-            403,
-            "auth.scope_denied",
-            "Scope denied",
-            "missing required scope",
-        ),
-    );
-    set_problem_response(
-        document,
-        "/admin/v1/credentials/{credential_id}/status",
-        "post",
-        "404",
-        "Credential status is disabled or not found",
-        credential_status_problem_example(404, "credential_status.not_found"),
-    );
-    set_problem_response(
-        document,
-        "/admin/v1/credentials/{credential_id}/status",
-        "post",
-        "503",
-        "Credential status store is unavailable",
-        credential_status_problem_example(503, "credential_status.unavailable"),
-    );
-}
-
-fn claim_ref_schema() -> Value {
-    json!({
-        "type": "object",
-        "description": "Claim reference. Wire requests may also use a plain string claim id.",
-        "required": ["id"],
-        "properties": {
-            "id": { "type": "string" },
-            "version": { "type": "string" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn evaluate_request_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["claims"],
-        "properties": {
-            "requester": { "$ref": "#/components/schemas/EvidenceEntity" },
-            "target": { "$ref": "#/components/schemas/EvidenceEntity" },
-            "relationship": { "$ref": "#/components/schemas/EvidenceRelationship" },
-            "on_behalf_of": { "$ref": "#/components/schemas/EvidenceOnBehalfOf" },
-            "variables": {
-                "type": "object",
-                "maxProperties": 16,
-                "propertyNames": {
-                    "type": "string",
-                    "maxLength": 96,
-                    "pattern": "^[a-z][a-z0-9_]{0,95}$"
-                },
-                "additionalProperties": {
-                    "type": "string",
-                    "format": "date",
-                    "minLength": 10,
-                    "maxLength": 10
-                }
-            },
-            "claims": {
-                "type": "array",
-                "items": { "$ref": "#/components/schemas/ClaimRef" }
-            },
-            "disclosure": { "type": "string" },
-            "format": { "type": "string" },
-            "purpose": { "type": "string" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn batch_evaluate_request_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["items", "claims"],
-        "properties": {
-            "items": {
-                "type": "array",
-                "maxItems": registry_notary_core::MAX_BATCH_EVALUATION_MEMBERS_V1,
-                "items": { "$ref": "#/components/schemas/BatchEvaluateItemRequest" }
-            },
-            "claims": {
-                "type": "array",
-                "items": { "$ref": "#/components/schemas/ClaimRef" }
-            },
-            "disclosure": { "type": "string" },
-            "format": { "type": "string" },
-            "purpose": { "type": "string" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn batch_evaluate_item_request_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["target"],
-        "properties": {
-            "requester": { "$ref": "#/components/schemas/EvidenceEntity" },
-            "target": { "$ref": "#/components/schemas/EvidenceEntity" },
-            "relationship": { "$ref": "#/components/schemas/EvidenceRelationship" },
-            "on_behalf_of": { "$ref": "#/components/schemas/EvidenceOnBehalfOf" },
-            "purpose": { "type": "string" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn evidence_entity_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["type"],
-        "properties": {
-            "type": { "type": "string" },
-            "id": { "type": "string" },
-            "identifiers": {
-                "type": "array",
-                "items": { "$ref": "#/components/schemas/EvidenceIdentifier" }
-            },
-            "attributes": {
-                "type": "object",
-                "additionalProperties": true
-            },
-            "assurance": { "$ref": "#/components/schemas/EvidenceAssurance" },
-            "profile": { "type": "string" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn evidence_identifier_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["scheme", "value"],
-        "properties": {
-            "scheme": { "type": "string" },
-            "value": { "type": "string" },
-            "issuer": { "type": "string" },
-            "country": { "type": "string" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn evidence_assurance_schema() -> Value {
-    json!({
-        "type": "object",
-        "properties": {
-            "method": { "type": "string" },
-            "level_scheme": { "type": "string" },
-            "level": { "type": "string" },
-            "verified_at": { "type": "string", "format": "date-time" },
-            "issuer": { "type": "string" },
-            "evidence": {
-                "type": "array",
-                "items": { "type": "object", "additionalProperties": true }
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn evidence_relationship_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["type"],
-        "properties": {
-            "type": { "type": "string" },
-            "attributes": {
-                "type": "object",
-                "additionalProperties": true
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn evidence_on_behalf_of_schema() -> Value {
-    json!({
-        "type": "object",
-        "description": "Frozen minimal actor/delegation envelope. Replaces the previous free-form object; free-form payloads are rejected. Simple deployments omit on_behalf_of entirely. Production-grade delegation (OAuth token exchange / RAR / CIBA) arrives post-1.0 as an additive profile that maps the actor onto OAuth act-claim semantics via the opaque delegation_ref; the shape does not bake in a single-actor assumption.",
-        "required": ["actor"],
-        "properties": {
-            "actor": { "$ref": "#/components/schemas/EvidenceActor" },
-            "delegation_ref": {
-                "type": "string",
-                "description": "Opaque reference to an out-of-band delegation record. Not interpreted by the envelope; the indirection point through which a later OAuth profile resolves an actor chain."
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn evidence_actor_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["type", "id_hash"],
-        "properties": {
-            "type": { "type": "string" },
-            "id_hash": {
-                "type": "string",
-                "description": "Keyed-hash identifier of the actor in hmac-sha256:<hex> format. Never a raw principal value."
-            },
-            "assurance": {
-                "type": "string",
-                "description": "Optional assurance level of the actor (for example an acr value)."
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn list_claims_response_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["data"],
-        "properties": {
-            "data": {
-                "type": "array",
-                "items": { "$ref": "#/components/schemas/ClaimSummary" }
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn claim_summary_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["id", "title", "version", "subject_type", "operations", "formats", "disclosure"],
-        "properties": {
-            "id": { "type": "string" },
-            "title": { "type": "string" },
-            "version": { "type": "string" },
-            "subject_type": { "type": "string" },
-            "evidence_type": { "type": "string" },
-            "evidence_type_iri": { "type": "string", "format": "uri" },
-            "semantics": { "$ref": "#/components/schemas/ClaimSemantics" },
-            "operations": {
-                "type": "object",
-                "required": ["evaluate", "batch_evaluate"],
-                "properties": {
-                    "evaluate": { "type": "boolean" },
-                    "batch_evaluate": { "type": "boolean" }
-                },
-                "additionalProperties": false
-            },
-            "formats": {
-                "type": "array",
-                "items": { "type": "string" }
-            },
-            "disclosure": {
-                "type": "object",
-                "required": ["default", "allowed", "downgrade"],
-                "properties": {
-                    "default": { "type": "string" },
-                    "allowed": {
-                        "type": "array",
-                        "items": { "type": "string" }
-                    },
-                    "downgrade": { "type": "string" }
-                },
-                "additionalProperties": false
-            },
-            "target_inputs": {
-                "type": "array",
-                "description": "Safe request-input metadata for building evaluation targets. It exposes target-side paths and matching method labels, never upstream connection, dataset, entity, or field details.",
-                "items": { "$ref": "#/components/schemas/ClaimTargetInputMethod" }
-            },
-            "cccev": {
-                "oneOf": [
-                    { "type": "null" },
-                    { "type": "object", "additionalProperties": true }
-                ]
-            },
-            "oots": {
-                "oneOf": [
-                    { "type": "null" },
-                    { "type": "object", "additionalProperties": true }
-                ]
-            }
-        },
-        "additionalProperties": true
-    })
-}
-
-fn claim_semantics_schema() -> Value {
-    json!({
-        "type": "object",
-        "description": "Optional semantic binding for a Notary claim. These fields label the claim output or predicate with external vocabulary terms such as PublicSchema URIs; they do not change the Notary result shape or by themselves prove privacy minimization.",
-        "properties": {
-            "concept": {
-                "type": "string",
-                "description": "External concept URI, for example https://publicschema.org/Person."
-            },
-            "property": {
-                "type": "string",
-                "description": "External property URI for raw value claims, for example https://publicschema.org/date_of_birth."
-            },
-            "vocabulary": {
-                "type": "string",
-                "description": "External vocabulary or value-set URI used by the claim value."
-            },
-            "predicate": {
-                "type": "string",
-                "description": "External or local predicate URI/URN for derived boolean claims."
-            },
-            "derived_from": {
-                "type": "array",
-                "items": { "type": "string" },
-                "description": "External property URIs the predicate or derived value depends on."
-            },
-            "value_mapping": {
-                "type": "string",
-                "description": "Operator label for the value mapping/canonicalization applied before returning the claim."
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn claim_target_input_method_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["target_type", "method", "confidence", "groups"],
-        "properties": {
-            "policy_id": {
-                "type": "string",
-                "description": "Stable target-matching policy identifier when configured."
-            },
-            "target_type": { "type": "string" },
-            "method": {
-                "type": "string",
-                "description": "Configured target-matching method label."
-            },
-            "confidence": {
-                "type": "string",
-                "description": "Policy-asserted confidence label for this target-input method."
-            },
-            "groups": {
-                "type": "array",
-                "description": "OR-of-AND input groups. A request needs to satisfy one group.",
-                "items": { "$ref": "#/components/schemas/ClaimTargetInputGroup" }
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn claim_target_input_group_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["inputs"],
-        "properties": {
-            "inputs": {
-                "type": "array",
-                "items": { "$ref": "#/components/schemas/ClaimTargetInput" }
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn claim_target_input_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["path", "kind", "name", "label"],
-        "properties": {
-            "path": {
-                "type": "string",
-                "description": "Target-side request path, for example target.identifiers.national_id or target.attributes.birthdate."
-            },
-            "kind": {
-                "type": "string",
-                "enum": ["id", "identifier", "attribute"]
-            },
-            "name": { "type": "string" },
-            "label": { "type": "string" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn evaluation_response_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["results"],
-        "properties": {
-            "results": {
-                "type": "array",
-                "items": { "$ref": "#/components/schemas/ClaimResultView" }
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn claim_result_view_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": [
-            "evaluation_id",
-            "claim_id",
-            "claim_version",
-            "subject_type",
-            "target_ref",
-            "value",
-            "satisfied",
-            "disclosure",
-            "format",
-            "issued_at",
-            "expires_at",
-            "provenance"
-        ],
-        "properties": {
-            "evaluation_id": { "type": "string" },
-            "claim_id": { "type": "string" },
-            "claim_version": { "type": "string" },
-            "subject_type": { "type": "string" },
-            "requester_ref": { "$ref": "#/components/schemas/EvidenceEntityRef" },
-            "target_ref": { "$ref": "#/components/schemas/TargetRefView" },
-            "value": {
-                "type": ["object", "array", "string", "number", "integer", "boolean", "null"],
-                "description": "Claim value. The runtime may return any JSON value."
-            },
-            "satisfied": { "type": ["boolean", "null"] },
-            "disclosure": { "type": "string" },
-            "redacted_fields": {
-                "type": "array",
-                "items": { "type": "string" },
-                "description": "Claim or top-level field names redacted from the public result. Omitted when no redaction was applied."
-            },
-            "format": { "type": "string" },
-            "issued_at": { "type": "string", "format": "date-time" },
-            "expires_at": { "type": ["string", "null"], "format": "date-time" },
-            "provenance": { "$ref": "#/components/schemas/ClaimProvenance" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn batch_evaluate_response_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["batch_id", "status", "claims", "items", "summary"],
-        "properties": {
-            "batch_id": { "type": "string" },
-            "status": { "type": "string", "enum": ["completed"] },
-            "claims": {
-                "type": "array",
-                "items": { "type": "string" }
-            },
-            "items": {
-                "type": "array",
-                "items": { "$ref": "#/components/schemas/BatchItemResponse" }
-            },
-            "summary": { "$ref": "#/components/schemas/BatchSummary" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn batch_item_response_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["input_index", "target_ref", "status", "claim_results", "errors"],
-        "properties": {
-            "input_index": { "type": "integer", "minimum": 0 },
-            "target_ref": { "$ref": "#/components/schemas/TargetRefView" },
-            "requester_ref": { "$ref": "#/components/schemas/EvidenceEntityRef" },
-            "evaluation_id": { "type": "string" },
-            "status": { "type": "string", "enum": ["succeeded", "failed"] },
-            "claim_results": {
-                "type": "array",
-                "items": { "$ref": "#/components/schemas/BatchClaimResultView" }
-            },
-            "errors": {
-                "type": "array",
-                "items": { "$ref": "#/components/schemas/BatchItemError" }
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn batch_claim_result_view_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": [
-            "result_id",
-            "claim_id",
-            "claim_version",
-            "value_type",
-            "value",
-            "disclosure",
-            "provenance"
-        ],
-        "properties": {
-            "result_id": { "type": "string" },
-            "claim_id": { "type": "string" },
-            "claim_version": { "type": "string" },
-            "value_type": { "type": "string" },
-            "value": {
-                "type": ["object", "array", "string", "number", "integer", "boolean", "null"],
-                "description": "Claim value. The runtime may return any JSON value."
-            },
-            "satisfied": { "type": ["boolean", "null"] },
-            "disclosure": { "type": "string" },
-            "provenance": { "$ref": "#/components/schemas/ClaimProvenance" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn batch_item_error_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["code", "title", "retryable"],
-        "properties": {
-            "code": { "type": "string" },
-            "title": { "type": "string" },
-            "retryable": { "type": "boolean" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn batch_summary_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["succeeded", "failed"],
-        "properties": {
-            "succeeded": { "type": "integer", "minimum": 0 },
-            "failed": { "type": "integer", "minimum": 0 }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn claim_provenance_schema() -> Value {
-    json!({
-        "type": "object",
-        "description": "Versioned claim provenance (registry-notary-claim-provenance/v2). PROV-mappable but not PROV-O. Requester-side identity (client, actor, subject) is deliberately absent; it lives in restricted audit only.",
-        "required": ["schema_version", "generated_by", "used", "derived_from"],
-        "properties": {
-            "schema_version": {
-                "type": "string",
-                "enum": ["registry-notary-claim-provenance/v2"]
-            },
-            "generated_by": { "$ref": "#/components/schemas/ProvenanceGeneratedBy" },
-            "used": { "$ref": "#/components/schemas/ProvenanceUsed" },
-            "derived_from": {
-                "type": "array",
-                "description": "Upstream provenance records this result was derived from. Always empty in v1; reserved for additive cross-evaluation linking.",
-                "items": { "type": "object" }
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn provenance_generated_by_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["type", "service_id", "evaluation_id", "claim_id", "claim_version"],
-        "properties": {
-            "type": {
-                "type": "string",
-                "enum": ["claim_evaluation"]
-            },
-            "service_id": {
-                "type": "string",
-                "description": "Identifier of the service that produced the result. Replaces the dropped computed_by field; the CCCEV renderer maps its provider agent from here."
-            },
-            "evaluation_id": { "type": "string" },
-            "claim_id": { "type": "string" },
-            "claim_version": { "type": "string" },
-            "policy_id": {
-                "type": "string",
-                "description": "Evaluation policy identifier under which this result was produced. Present for flows evaluated under a named policy, such as subject-access, and omitted for machine-client flows with no evaluation policy."
-            },
-            "policy_version": { "type": "string" },
-            "policy_hash": {
-                "type": "string",
-                "description": "sha256:<hex> digest of the evaluation policy. Public in v1: a hash revealing no policy content, used to correlate the result with a policy evidence-pack."
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn provenance_used_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["relay_consultation_count"],
-        "properties": {
-            "relay_consultation_count": { "type": "integer", "minimum": 0 }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn target_ref_view_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["handle"],
-        "properties": {
-            "type": { "type": "string" },
-            "handle": { "type": "string" },
-            "identifier_schemes": {
-                "type": "array",
-                "items": { "type": "string" }
-            },
-            "profile": { "type": "string" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn evidence_entity_ref_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["type", "handle"],
-        "properties": {
-            "type": { "type": "string" },
-            "handle": { "type": "string" },
-            "identifier_schemes": {
-                "type": "array",
-                "items": { "type": "string" }
-            },
-            "profile": { "type": "string" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn set_json_response(
-    document: &mut Value,
-    path: &str,
-    method: &str,
-    status: &str,
-    description: &str,
-    example: Value,
-) {
-    set_response_example(
-        document,
-        path,
-        method,
-        status,
-        description,
-        "application/json",
-        example,
-    );
-}
-
-fn set_json_response_schema(
-    document: &mut Value,
-    path: &str,
-    method: &str,
-    status: &str,
-    schema_ref: &str,
-) {
-    set_response_schema(
-        document,
-        path,
-        method,
-        status,
-        "application/json",
-        schema_ref,
-    );
-}
-
-fn set_problem_response_schema(
-    document: &mut Value,
-    path: &str,
-    method: &str,
-    status: &str,
-    schema_ref: &str,
-) {
-    set_response_schema(
-        document,
-        path,
-        method,
-        status,
-        "application/problem+json",
-        schema_ref,
-    );
-}
-
-fn set_registry_offer_no_store_headers(document: &mut Value) {
-    let Some(responses) = document
-        .pointer_mut("/paths/~1oid4vci~1offers/post/responses")
-        .and_then(Value::as_object_mut)
-    else {
-        return;
-    };
-    for status in ["200", "400", "401", "403", "404", "409", "429", "503"] {
-        let Some(response) = responses.get_mut(status).and_then(Value::as_object_mut) else {
-            continue;
-        };
-        response.insert(
-            "headers".to_string(),
-            json!({
-                "Cache-Control": {
-                    "description": "Prevents storage of offer, code, and transaction material.",
-                    "schema": { "type": "string", "enum": ["no-store"] }
-                },
-                "Pragma": {
-                    "description": "Compatibility cache directive for sensitive offer responses.",
-                    "schema": { "type": "string", "enum": ["no-cache"] }
-                }
-            }),
-        );
-    }
-}
-
-fn set_response_schema(
-    document: &mut Value,
-    path: &str,
-    method: &str,
-    status: &str,
-    content_type: &str,
-    schema_ref: &str,
-) {
-    let Some(media_type) = document
-        .get_mut("paths")
-        .and_then(Value::as_object_mut)
-        .and_then(|paths| paths.get_mut(path))
-        .and_then(Value::as_object_mut)
-        .and_then(|path_item| path_item.get_mut(method))
-        .and_then(Value::as_object_mut)
-        .and_then(|operation| operation.get_mut("responses"))
-        .and_then(Value::as_object_mut)
-        .and_then(|responses| responses.get_mut(status))
-        .and_then(Value::as_object_mut)
-        .and_then(|response| response.get_mut("content"))
-        .and_then(Value::as_object_mut)
-        .and_then(|content| content.get_mut(content_type))
-        .and_then(Value::as_object_mut)
-    else {
-        return;
-    };
-
-    media_type.insert(
-        "schema".to_string(),
-        json!({
-            "$ref": schema_ref
-        }),
-    );
-}
-
-fn set_problem_response(
-    document: &mut Value,
-    path: &str,
-    method: &str,
-    status: &str,
-    description: &str,
-    example: Value,
-) {
-    set_response_example(
-        document,
-        path,
-        method,
-        status,
-        description,
-        "application/problem+json",
-        example,
-    );
-}
-
-fn set_oid4vci_error_response(
-    document: &mut Value,
-    path: &str,
-    method: &str,
-    status: &str,
-    description: &str,
-    example: Value,
-) {
-    set_response_example(
-        document,
-        path,
-        method,
-        status,
-        description,
-        "application/json",
-        example,
-    );
-}
-
-fn add_runtime_problem_responses(
-    document: &mut Value,
-    path: &str,
-    method: &str,
-    statuses: &[&str],
-) {
-    for status in statuses {
-        let (status_code, code, title, detail) = match *status {
-            "406" => (
-                406,
-                "format.unsupported",
-                "Claim format not supported",
-                "the requested claim format is not supported",
-            ),
-            "409" => (
-                409,
-                "request.conflict",
-                "Request conflict",
-                "the request conflicts with existing state",
-            ),
-            "413" => (
-                413,
-                "request.too_large",
-                "Request too large",
-                "the request body or batch is too large",
-            ),
-            "429" => (
-                429,
-                "subject_access.rate_limited",
-                "Subject access rate limited",
-                "subject-access request is rate limited",
-            ),
-            "503" => (
-                503,
-                "evidence.not_available",
-                "Evidence not available",
-                "the required evidence or operational dependency is unavailable",
-            ),
-            _ => continue,
-        };
-        set_problem_response(
-            document,
-            path,
-            method,
-            status,
-            title,
-            problem_example(status_code, code, title, detail),
-        );
-    }
-}
-
-fn set_response_example(
-    document: &mut Value,
-    path: &str,
-    method: &str,
-    status: &str,
-    description: &str,
-    content_type: &str,
-    example: Value,
-) {
-    let Some(response) = document
-        .get_mut("paths")
-        .and_then(Value::as_object_mut)
-        .and_then(|paths| paths.get_mut(path))
-        .and_then(Value::as_object_mut)
-        .and_then(|path_item| path_item.get_mut(method))
-        .and_then(Value::as_object_mut)
-        .and_then(|operation| operation.get_mut("responses"))
-        .and_then(Value::as_object_mut)
-        .and_then(|responses| responses.get_mut(status))
-        .and_then(Value::as_object_mut)
-    else {
-        return;
-    };
-
-    response
-        .entry("description")
-        .or_insert_with(|| json!(description));
-    let content_entry = response.entry("content").or_insert_with(|| json!({}));
-    let Some(content) = content_entry.as_object_mut() else {
-        return;
-    };
-
-    let media_type_entry = if content.is_empty() {
-        content
-            .entry(content_type.to_string())
-            .or_insert_with(|| json!({}))
-    } else {
-        let Some(media_type) = content.get_mut(content_type) else {
-            return;
-        };
-        media_type
-    };
-    let Some(media_type) = media_type_entry.as_object_mut() else {
-        return;
-    };
-
-    if content_type == "application/problem+json" {
-        media_type.entry("schema").or_insert_with(|| {
-            json!({
-                "$ref": "#/components/schemas/ProblemDetails"
-            })
-        });
-    }
-    media_type.insert("example".to_string(), example);
-}
-
-fn readiness_response_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["status", "checks"],
-        "properties": {
-            "status": { "type": "string", "enum": ["ready"] },
-            "checks": { "$ref": "#/components/schemas/ReadinessChecks" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn readiness_checks_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["total", "ok", "degraded", "failed", "signing_providers", "relay"],
-        "properties": {
-            "total": non_negative_count_schema(),
-            "ok": non_negative_count_schema(),
-            "degraded": non_negative_count_schema(),
-            "failed": non_negative_count_schema(),
-            "signing_providers": {
-                "$ref": "#/components/schemas/SigningProviderReadinessChecks"
-            },
-            "relay": {
-                "type": "object",
-                "required": ["total", "ok", "failed"],
-                "properties": {
-                    "total": non_negative_count_schema(),
-                    "ok": non_negative_count_schema(),
-                    "failed": non_negative_count_schema()
-                },
-                "additionalProperties": false
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn signing_provider_readiness_checks_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["total", "ok", "failed", "custody"],
-        "properties": {
-            "total": non_negative_count_schema(),
-            "ok": non_negative_count_schema(),
-            "failed": non_negative_count_schema(),
-            "custody": { "$ref": "#/components/schemas/SignerCustodyChecks" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn signer_custody_checks_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": [
-            "active_provider_counts",
-            "signing_provider_count",
-            "local_software_signing_provider_count",
-            "custody_approval_required",
-            "custody_approved",
-            "unapproved_signing_provider_count",
-            "surfaces"
-        ],
-        "properties": {
-            "active_provider_counts": {
-                "type": "object",
-                "description": "Counts by configured provider kind. PKCS#11 identifies an interface, not whether custody is hardware- or software-backed.",
-                "additionalProperties": non_negative_count_schema()
-            },
-            "signing_provider_count": non_negative_count_schema(),
-            "local_software_signing_provider_count": non_negative_count_schema(),
-            "custody_approval_required": { "type": "boolean" },
-            "custody_approved": { "type": "boolean" },
-            "unapproved_signing_provider_count": non_negative_count_schema(),
-            "surfaces": { "$ref": "#/components/schemas/SignerCustodySurfaces" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn signer_custody_surfaces_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["credential_issuance", "access_token_issuance", "federation"],
-        "properties": {
-            "credential_issuance": { "$ref": "#/components/schemas/SignerSurfaceChecks" },
-            "access_token_issuance": {
-                "$ref": "#/components/schemas/EnabledSignerSurfaceChecks"
-            },
-            "federation": { "$ref": "#/components/schemas/EnabledSignerSurfaceChecks" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn signer_surface_checks_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": [
-            "signing_provider_count",
-            "local_software_signing_provider_count",
-            "unapproved_signing_provider_count"
-        ],
-        "properties": {
-            "signing_provider_count": non_negative_count_schema(),
-            "local_software_signing_provider_count": non_negative_count_schema(),
-            "unapproved_signing_provider_count": non_negative_count_schema()
-        },
-        "additionalProperties": false
-    })
-}
-
-fn enabled_signer_surface_checks_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": [
-            "enabled",
-            "signing_provider_count",
-            "local_software_signing_provider_count",
-            "unapproved_signing_provider_count"
-        ],
-        "properties": {
-            "enabled": { "type": "boolean" },
-            "signing_provider_count": non_negative_count_schema(),
-            "local_software_signing_provider_count": non_negative_count_schema(),
-            "unapproved_signing_provider_count": non_negative_count_schema()
-        },
-        "additionalProperties": false
-    })
-}
-
-fn readiness_problem_schema() -> Value {
-    json!({
-        "description": "Bounded readiness failures. Audit-chain integrity failures do not expose audit records, paths, hashes, or verification details.",
-        "oneOf": [
-            { "$ref": "#/components/schemas/ReadinessCheckProblem" },
-            { "$ref": "#/components/schemas/AuditChainInconsistentProblem" }
-        ]
-    })
-}
-
-fn readiness_check_problem_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": [
-            "type",
-            "title",
-            "status",
-            "detail",
-            "code",
-            "request_id",
-            "readiness_status",
-            "checks"
-        ],
-        "properties": {
-            "type": {
-                "type": "string",
-                "format": "uri",
-                "enum": [format!("{}/readiness/not-ready", crate::PROBLEM_TYPE_BASE_URL)]
-            },
-            "title": {
-                "type": "string",
-                "enum": ["Evidence runtime is not ready"]
-            },
-            "status": {
-                "type": "integer",
-                "format": "int32",
-                "enum": [503]
-            },
-            "detail": {
-                "type": "string",
-                "enum": ["one or more readiness checks are not ready"]
-            },
-            "code": {
-                "type": "string",
-                "enum": ["readiness.not_ready"]
-            },
-            "request_id": {
-                "type": "string",
-                "maxLength": 128
-            },
-            "readiness_status": {
-                "type": "string",
-                "enum": ["degraded", "not_ready"]
-            },
-            "checks": { "$ref": "#/components/schemas/ReadinessChecks" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn audit_chain_inconsistent_problem_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["type", "title", "status", "detail", "code", "request_id"],
-        "properties": {
-            "type": {
-                "type": "string",
-                "format": "uri",
-                "enum": [format!("{}/audit/chain-inconsistent", crate::PROBLEM_TYPE_BASE_URL)]
-            },
-            "title": {
-                "type": "string",
-                "enum": ["Audit chain inconsistent"]
-            },
-            "status": {
-                "type": "integer",
-                "format": "int32",
-                "enum": [503]
-            },
-            "detail": {
-                "type": "string",
-                "enum": ["the retained audit chain has an integrity failure and requires operator recovery"]
-            },
-            "code": {
-                "type": "string",
-                "enum": ["audit.chain.inconsistent"]
-            },
-            "request_id": {
-                "type": "string",
-                "maxLength": 128
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn non_negative_count_schema() -> Value {
-    json!({ "type": "integer", "minimum": 0 })
-}
-
-fn problem_details_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["type", "title", "status", "detail", "code", "request_id"],
-        "properties": {
-            "type": { "type": "string", "format": "uri" },
-            "title": { "type": "string" },
-            "status": { "type": "integer", "format": "int32" },
-            "detail": { "type": "string" },
-            "code": { "type": "string" },
-            "request_id": { "type": "string" }
-        },
-        "additionalProperties": true
-    })
-}
-
-fn credential_status_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": [
-            "credential_id",
-            "issuer",
-            "credential_profile",
-            "status",
-            "issued_at",
-            "expires_at",
-            "updated_at"
-        ],
-        "properties": {
-            "credential_id": { "type": "string" },
-            "issuer": { "type": "string" },
-            "credential_profile": { "type": "string" },
-            "status": {
-                "type": "string",
-                "enum": ["valid", "suspended", "revoked", "expired"]
-            },
-            "issued_at": { "type": "string", "format": "date-time" },
-            "expires_at": { "type": "string", "format": "date-time" },
-            "updated_at": { "type": "string", "format": "date-time" }
-        }
-    })
-}
-
-fn credential_status_update_request_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["status"],
-        "properties": {
-            "status": {
-                "type": "string",
-                "enum": ["valid", "suspended", "revoked"]
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn credential_issuer_metadata_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["credential_issuer", "credential_endpoint", "credential_configurations_supported"],
-        "properties": {
-            "credential_issuer": { "type": "string", "format": "uri" },
-            "credential_endpoint": { "type": "string", "format": "uri" },
-            "token_endpoint": { "type": "string", "format": "uri" },
-            "authorization_servers": { "type": "array", "items": { "type": "string", "format": "uri" } },
-            "display": { "type": "array", "items": { "type": "object", "additionalProperties": true } },
-            "credential_configurations_supported": {
-                "type": "object",
-                "additionalProperties": { "$ref": "#/components/schemas/CredentialConfigurationMetadata" }
-            }
-        }
-    })
-}
-
-fn credential_configuration_metadata_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["format"],
-        "properties": {
-            "format": { "type": "string" },
-            "scope": { "type": "string" },
-            "cryptographic_binding_methods_supported": { "type": "array", "items": { "type": "string" } },
-            "credential_signing_alg_values_supported": { "type": "array", "items": { "type": "string" } },
-            "proof_types_supported": { "type": "object", "additionalProperties": true },
-            "display": { "type": "array", "items": { "type": "object", "additionalProperties": true } },
-            "vct": { "type": "string", "format": "uri" }
-        }
-    })
-}
-
-fn sd_jwt_vc_type_metadata_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["vct", "name", "display", "claims"],
-        "properties": {
-            "vct": { "type": "string", "format": "uri" },
-            "name": { "type": "string" },
-            "description": { "type": "string" },
-            "display": {
-                "type": "array",
-                "items": {
-                    "type": "object",
-                    "required": ["locale", "name"],
-                    "properties": {
-                        "locale": { "type": "string" },
-                        "name": { "type": "string" }
-                    },
-                    "additionalProperties": true
-                }
-            },
-            "claims": {
-                "type": "array",
-                "items": {
-                    "type": "object",
-                    "required": ["path", "display", "sd", "mandatory"],
-                    "properties": {
-                        "path": {
-                            "type": "array",
-                            "items": { "type": "string" }
-                        },
-                        "display": {
-                            "type": "array",
-                            "items": {
-                                "type": "object",
-                                "required": ["locale", "label"],
-                                "properties": {
-                                    "locale": { "type": "string" },
-                                    "label": { "type": "string" }
-                                },
-                                "additionalProperties": true
-                            }
-                        },
-                        "sd": {
-                            "type": "string",
-                            "enum": ["always"],
-                            "description": "The complete top-level claim is selectively disclosed as one unit. Nested object fields and array items are not independently disclosable."
-                        },
-                        "mandatory": { "type": "boolean" },
-                        "registry_notary_semantics": {
-                            "$ref": "#/components/schemas/ClaimSemantics"
-                        },
-                        "registry_notary_value_schema": {
-                            "$ref": "#/components/schemas/RelayOutputContract"
-                        }
-                    },
-                    "additionalProperties": true
-                }
-            }
-        },
-        "additionalProperties": true
-    })
-}
-
-fn registry_client_offer_request_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["evaluation_id", "credential_configuration_id"],
-        "properties": {
-            "evaluation_id": {
-                "type": "string",
-                "description": "Identifier of the fresh registry-backed evaluation owned by the authenticated machine client."
-            },
-            "credential_configuration_id": {
-                "type": "string",
-                "description": "Configured credential type authorized for the evaluation's exact claim set, purpose, and target."
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn registry_client_offer_response_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["credential_offer_uri", "tx_code", "expires_at"],
-        "properties": {
-            "credential_offer_uri": {
-                "type": "string",
-                "format": "uri",
-                "description": "Sensitive standard credential offer URI. It contains the pre-authorized code and describes the tx_code requirement, but never contains the numeric tx_code value."
-            },
-            "tx_code": {
-                "type": "string",
-                "pattern": "^[0-9]+$",
-                "description": "Required sensitive numeric transaction code. Deliver it to the holder through a channel separate from the credential_offer_uri."
-            },
-            "expires_at": {
-                "type": "string",
-                "format": "date-time",
-                "description": "Expiry of the pre-authorized code, capped by the stored evaluation expiry."
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn relay_output_contract_schema() -> Value {
-    // Keep the published schema aligned with the v1 recursive contract bounds
-    // enforced by registry-notary-core.
-    let max_bytes = 65_536_u32;
-    let max_fields = 32_usize;
-    let max_items = 256_u16;
-    json!({
-        "description": "Recursive, closed compiler-pinned Relay output contract. Runtime validation also enforces maximum depth 8, 256 schema nodes, 4096 expanded nodes, and 128-byte field names.",
-        "oneOf": [
-            {
-                "type": "object",
-                "required": ["type"],
-                "properties": {
-                    "type": { "type": "string", "enum": ["boolean"] },
-                    "nullable": { "type": "boolean", "default": false }
-                },
-                "additionalProperties": false
-            },
-            {
-                "type": "object",
-                "required": ["type", "minimum", "maximum"],
-                "properties": {
-                    "type": { "type": "string", "enum": ["integer"] },
-                    "nullable": { "type": "boolean", "default": false },
-                    "minimum": { "type": "integer", "format": "int64" },
-                    "maximum": { "type": "integer", "format": "int64" }
-                },
-                "additionalProperties": false
-            },
-            {
-                "type": "object",
-                "required": ["type", "max_bytes"],
-                "properties": {
-                    "type": { "type": "string", "enum": ["string"] },
-                    "nullable": { "type": "boolean", "default": false },
-                    "max_bytes": {
-                        "type": "integer",
-                        "minimum": 1,
-                        "maximum": max_bytes
-                    }
-                },
-                "additionalProperties": false
-            },
-            {
-                "type": "object",
-                "required": ["type"],
-                "properties": {
-                    "type": { "type": "string", "enum": ["date"] },
-                    "nullable": { "type": "boolean", "default": false }
-                },
-                "additionalProperties": false
-            },
-            {
-                "type": "object",
-                "required": ["type", "max_bytes", "fields"],
-                "properties": {
-                    "type": { "type": "string", "enum": ["object"] },
-                    "nullable": { "type": "boolean", "default": false },
-                    "max_bytes": {
-                        "type": "integer",
-                        "minimum": 1,
-                        "maximum": max_bytes
-                    },
-                    "fields": {
-                        "type": "object",
-                        "minProperties": 1,
-                        "maxProperties": max_fields,
-                        "additionalProperties": {
-                            "$ref": "#/components/schemas/RelayOutputObjectFieldContract"
-                        }
-                    }
-                },
-                "additionalProperties": false
-            },
-            {
-                "type": "object",
-                "required": ["type", "max_bytes", "max_items", "items"],
-                "properties": {
-                    "type": { "type": "string", "enum": ["array"] },
-                    "nullable": { "type": "boolean", "default": false },
-                    "max_bytes": {
-                        "type": "integer",
-                        "minimum": 1,
-                        "maximum": max_bytes
-                    },
-                    "max_items": {
-                        "type": "integer",
-                        "minimum": 1,
-                        "maximum": max_items
-                    },
-                    "items": {
-                        "$ref": "#/components/schemas/RelayOutputContract"
-                    }
-                },
-                "additionalProperties": false
-            }
-        ]
-    })
-}
-
-fn relay_output_object_field_contract_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["required", "schema"],
-        "properties": {
-            "required": { "type": "boolean" },
-            "schema": { "$ref": "#/components/schemas/RelayOutputContract" }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn credential_request_schema() -> Value {
-    json!({
-        "type": "object",
-        "oneOf": [
-            { "required": ["proof"] },
-            { "required": ["proofs"] }
-        ],
-        "properties": {
-            "format": { "type": "string", "example": "dc+sd-jwt" },
-            "credential_identifier": { "type": "string" },
-            "credential_configuration_id": { "type": "string" },
-            "vct": { "type": "string", "format": "uri" },
-            "proof": {
-                "type": "object",
-                "required": ["proof_type", "jwt"],
-                "properties": {
-                    "proof_type": { "type": "string", "example": "jwt" },
-                    "jwt": { "type": "string" }
-                },
-                "additionalProperties": false
-            },
-            "proofs": {
-                "type": "object",
-                "properties": {
-                    "jwt": {
-                        "type": "array",
-                        "items": { "type": "string" },
-                        "minItems": 1
-                    }
-                },
-                "additionalProperties": false
-            }
-        },
-        "additionalProperties": false
-    })
-}
-
-fn credential_response_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["credential"],
-        "properties": {
-            "credential": { "type": "string" },
-            "credentials": {
-                "type": "array",
-                "items": {
-                    "type": "object",
-                    "required": ["credential"],
-                    "properties": {
-                        "credential": { "type": "string" }
-                    },
-                    "additionalProperties": true
-                }
-            },
-            "credential_profile": { "type": "string" },
-            "format": { "type": "string" }
-        }
-    })
-}
-
-fn token_request_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["grant_type", "pre-authorized_code"],
-        "properties": {
-            "grant_type": {
-                "type": "string",
-                "example": "urn:ietf:params:oauth:grant-type:pre-authorized_code"
-            },
-            "pre-authorized_code": { "type": "string" },
-            "tx_code": {
-                "type": "string",
-                "description": "The numeric PIN shown on the offer page. Required when the credential offer includes a tx_code object."
-            }
-        }
-    })
-}
-
-fn token_response_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["access_token", "token_type"],
-        "properties": {
-            "access_token": { "type": "string" },
-            "token_type": { "type": "string", "example": "Bearer" },
-            "expires_in": { "type": "integer", "format": "uint64" },
-            "c_nonce": { "type": "string" },
-            "c_nonce_expires_in": { "type": "integer", "format": "uint64" }
-        }
-    })
-}
-
-fn oid4vci_error_schema() -> Value {
-    json!({
-        "type": "object",
-        "required": ["error"],
-        "properties": {
-            "error": { "type": "string" },
-            "error_description": { "type": "string" }
-        }
-    })
-}
-
-fn problem_example(status: u16, code: &str, title: &str, detail: &str) -> Value {
-    json!({
-        "type": format!("{}/{}", crate::PROBLEM_TYPE_BASE_URL, code.replace('.', "/")),
-        "title": title,
-        "status": status,
-        "detail": detail,
-        "code": code,
-        "request_id": "01J00000000000000000000000"
-    })
-}
-
-fn admin_error_example(status: u16, code: &str, title: &str, detail: &str) -> Value {
-    json!({
-        "schema": "registry.admin.error.v1",
-        "type": format!("{}/{}", crate::PROBLEM_TYPE_BASE_URL, code.replace('.', "/")),
-        "title": title,
-        "status": status,
-        "detail": detail,
-        "message": detail,
-        "code": code,
-        "request_id": "01J00000000000000000000000"
-    })
-}
-
-fn missing_credential_example() -> Value {
-    problem_example(
-        401,
-        "auth.missing_credential",
-        "Missing credential",
-        "missing authentication credential",
-    )
-}
-
-fn evaluation_not_found_example() -> Value {
-    problem_example(
-        404,
-        "evaluation.not_found",
-        "Evaluation not found",
-        "the evaluation id is unknown or expired",
-    )
-}
-
-fn credential_status_example(status: &str) -> Value {
-    json!({
-        "credential_id": "urn:ulid:01HX7Y5F2WAJ7ZP0Q4M5K9E8NC",
-        "issuer": "did:web:issuer.example",
-        "credential_profile": "civil_status_sd_jwt",
-        "status": status,
-        "issued_at": "2026-05-25T12:00:00Z",
-        "expires_at": "2026-05-25T12:10:00Z",
-        "updated_at": "2026-05-25T12:00:00Z"
-    })
-}
-
-fn credential_status_problem_example(status: u16, code: &str) -> Value {
-    let (title, detail) = match code {
-        "credential_status.invalid_status" => (
-            "Invalid credential status",
-            "status must be valid, suspended, or revoked",
-        ),
-        "credential_status.unavailable" => (
-            "Credential status unavailable",
-            "credential status store is unavailable",
-        ),
-        _ => (
-            "Credential status not found",
-            "credential status record was not found",
-        ),
-    };
-    problem_example(status, code, title, detail)
-}
-
-fn discovery_example() -> Value {
-    json!({
-        "service_id": "demo.registry-notary",
-        "api_version": "2026-05",
-        "base_url": "http://127.0.0.1:4255",
-        "issuer": {
-            "id": "did:web:agriculture.demo.example.gov",
-            "name": "demo.registry-notary"
-        },
-        "auth": {
-            "methods": ["api_key", "bearer"],
-            "api_key": {
-                "header": "X-Api-Key"
-            },
-            "bearer": {
-                "header": "Authorization",
-                "scheme": "bearer",
-                "format": "Bearer <token>"
-            },
-            "audience": "demo.registry-notary"
-        },
-        "operations": {
-            "evaluate": true,
-            "batch_evaluate": true,
-            "render": true,
-            "credential_issue": true
-        },
-        "claims_url": "/v1/claims",
-        "formats_url": "/v1/formats",
-        "credential_capabilities": {
-            "formats": [FORMAT_SD_JWT_VC],
-            "sd_jwt_vc": {
-                "media_type": FORMAT_SD_JWT_VC,
-                "jwt_typ": SD_JWT_VC_JWT_TYP,
-                "signing_algs": [SD_JWT_VC_SIGNING_ALG],
-                "issuer_key_types": [SD_JWT_VC_ISSUER_KEY_TYPE],
-                "holder_binding_methods": [SD_JWT_VC_HOLDER_BINDING_METHOD],
-                "status_methods": [],
-                "credential_profiles": [
-                    {
-                        "id": "smallholder_sd_jwt",
-                        "format": FORMAT_SD_JWT_VC,
-                        "issuer": "did:web:agriculture.demo.example.gov",
-                        "vct": "https://demo.example.gov/credentials/smallholder-farmer/v1",
-                        "validity_seconds": 86400,
-                        "holder_binding": {
-                            "mode": "did",
-                            "proof_of_possession": "required",
-                            "allowed_did_methods": [SD_JWT_VC_HOLDER_BINDING_METHOD]
-                        },
-                        "allowed_claims": ["farmer-under-4ha"],
-                        "disclosure": {
-                            "allowed": ["predicate"]
-                        }
-                    }
-                ],
-                "openid4vci": {
-                    "support": "not_full_issuer"
-                }
-            },
-            "unsupported_features": [
-                "application/vc+sd-jwt",
-                "json_ld_vc_issuance",
-                "data_integrity_proofs",
-                "credential_status",
-                "delegated_credential_issuance",
-                "mso_mdoc",
-                "openid4vci_full_issuer"
-            ]
-        },
-        "batch": {
-            "max_inline_subjects": 20,
-            "idempotency_window": "PT15M"
-        },
-        "identity": {
-            "mapper": "common_subject_id",
-            "production_mapper": false
-        },
-        "formats": formats_value()
-    })
-}
-
-fn jwks_example() -> Value {
-    json!({
-        "keys": [
-            {
-                "kty": "OKP",
-                "crv": "Ed25519",
-                "x": "11qYAYKxCrfVS_3XDbXJC2AgYI57qXzcS7P0W5Y9f4Y",
-                "alg": "EdDSA",
-                "kid": "did:web:agriculture.demo.example.gov#registry-notary-demo-key-1"
-            }
-        ]
-    })
-}
-
-fn oid4vci_issuer_metadata_example() -> Value {
-    json!({
-        "credential_issuer": "https://issuer.example.gov",
-        "credential_endpoint": "https://issuer.example.gov/oid4vci/credential",
-        "authorization_servers": ["https://id.example.gov"],
-        "display": [
-            {
-                "name": "Civil Registry Notary",
-                "locale": "en-US"
-            }
-        ],
-        "credential_configurations_supported": {
-            "person_is_alive_sd_jwt": {
-                "format": "dc+sd-jwt",
-                "scope": "person_is_alive",
-                "cryptographic_binding_methods_supported": ["did:jwk"],
-                "credential_signing_alg_values_supported": ["EdDSA"],
-                "proof_types_supported": {
-                    "jwt": {
-                        "proof_signing_alg_values_supported": ["EdDSA"]
-                    }
-                },
-                "display": [
-                    {
-                        "name": "Person is alive",
-                        "locale": "en-US",
-                        "description": "Proof that the civil registry currently records this person as alive.",
-                        "background_color": "#0057B8",
-                        "text_color": "#FFFFFF"
-                    }
-                ],
-                "vct": "https://issuer.example.gov/credentials/person-is-alive"
-            }
-        }
-    })
-}
-
-fn sd_jwt_vc_type_metadata_example() -> Value {
-    json!({
-        "vct": "https://issuer.example.gov/credentials/person-is-alive",
-        "name": "Person is alive",
-        "display": [
-            {
-                "locale": "en-US",
-                "name": "Person is alive",
-                "description": "Proof that the civil registry currently records this person as alive.",
-                "background_color": "#0057B8",
-                "text_color": "#FFFFFF"
-            }
-        ],
-        "claims": [
-            {
-                "path": ["person-is-alive"],
-                "display": [
-                    {
-                        "locale": "en-US",
-                        "label": "Person is alive"
-                    }
-                ],
-                "sd": "always",
-                "mandatory": true,
-                "registry_notary_semantics": {
-                    "concept": "https://publicschema.org/Person",
-                    "predicate": "urn:registry-notary:predicate:person-is-alive",
-                    "derived_from": ["https://publicschema.org/date_of_death"]
-                },
-                "registry_notary_value_schema": {
-                    "type": "boolean",
-                    "nullable": false
-                }
-            }
-        ]
-    })
-}
-
-fn oid4vci_credential_response_example() -> Value {
-    json!({
-        "credential": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRjK3NkLWp3dCJ9.payload.signature~disclosure~",
-        "format": "dc+sd-jwt"
-    })
-}
-
-fn registry_client_offer_response_example() -> Value {
-    json!({
-        "credential_offer_uri": "openid-credential-offer://?credential_offer=%7B%22credential_issuer%22%3A%22https%3A%2F%2Fissuer.example.gov%22%2C%22credential_configuration_ids%22%3A%5B%22birth_certificate_sd_jwt%22%5D%2C%22grants%22%3A%7B%22urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Apre-authorized_code%22%3A%7B%22pre-authorized_code%22%3A%22fake-example-code%22%2C%22tx_code%22%3A%7B%22input_mode%22%3A%22numeric%22%2C%22length%22%3A6%7D%7D%7D%7D",
-        "tx_code": "123456",
-        "expires_at": "2026-07-29T12:05:00Z"
-    })
-}
-
-fn oid4vci_token_response_example() -> Value {
-    json!({
-        "access_token": "eyJhbGciOiJFZERTQSIsInR5cCI6InJlZ2lzdHJ5LW5vdGFyeS1hY2Nlc3MrancifQ.payload.signature",
-        "token_type": "Bearer",
-        "expires_in": 300,
-        "c_nonce": "b64url-nonce",
-        "c_nonce_expires_in": 300
-    })
-}
-
-fn oid4vci_error_example(code: &str, description: &str) -> Value {
-    json!({
-        "error": code,
-        "error_description": description
-    })
-}
-
-fn claims_list_example() -> Value {
-    json!({
-        "data": [
-            date_of_birth_claim_example(),
-            farmer_under_4ha_claim_example()
-        ]
-    })
-}
-
-fn date_of_birth_claim_example() -> Value {
-    json!({
-        "id": "date-of-birth",
-        "title": "Date of birth",
-        "version": "2026-05",
-        "subject_type": "person",
-        "semantics": {
-            "concept": "https://publicschema.org/Person",
-            "property": "https://publicschema.org/date_of_birth",
-            "value_mapping": "publicschema"
-        },
-        "operations": {
-            "evaluate": true,
-            "batch_evaluate": false
-        },
-        "formats": [
-            "application/vnd.registry-notary.claim-result+json",
-            "application/ld+json; profile=\"cccev\""
-        ],
-        "disclosure": {
-            "default": "value",
-            "allowed": ["value", "redacted"],
-            "downgrade": "deny"
-        },
-        "cccev": null,
-        "oots": null
-    })
-}
-
-fn farmer_under_4ha_claim_example() -> Value {
-    json!({
-        "id": "farmer-under-4ha",
-        "title": "Farmer under four hectares",
-        "version": "2026-05",
-        "subject_type": "person",
-        "evidence_type": "smallholder_farmer_evidence",
-        "evidence_type_iri": "https://demo.example.gov/evidence-types/smallholder-farmer",
-        "operations": {
-            "evaluate": true,
-            "batch_evaluate": true
-        },
-        "formats": [
-            "application/vnd.registry-notary.claim-result+json",
-            "application/ld+json; profile=\"cccev\""
-        ],
-        "disclosure": {
-            "default": "predicate",
-            "allowed": ["predicate", "redacted"],
-            "downgrade": "deny"
-        },
-        "target_inputs": [
-            {
-                "policy_id": "smallholder-demographic-v1",
-                "target_type": "Person",
-                "method": "exact_name_birthdate",
-                "confidence": "high",
-                "groups": [
-                    {
-                        "inputs": [
-                            {
-                                "path": "target.identifiers.farmer_id",
-                                "kind": "identifier",
-                                "name": "farmer_id",
-                                "label": "Farmer id"
-                            }
-                        ]
-                    },
-                    {
-                        "inputs": [
-                            {
-                                "path": "target.attributes.given_name",
-                                "kind": "attribute",
-                                "name": "given_name",
-                                "label": "Given name"
-                            },
-                            {
-                                "path": "target.attributes.family_name",
-                                "kind": "attribute",
-                                "name": "family_name",
-                                "label": "Family name"
-                            },
-                            {
-                                "path": "target.attributes.birthdate",
-                                "kind": "attribute",
-                                "name": "birthdate",
-                                "label": "Birthdate"
-                            }
-                        ]
-                    }
-                ]
-            }
-        ],
-        "cccev": {
-            "requirement_type": "InformationRequirement",
-            "evidence_type": "smallholder_farmer_evidence",
-            "evidence_type_iri": "https://demo.example.gov/evidence-types/smallholder-farmer"
-        },
-        "oots": null
-    })
-}
-
-fn formats_example() -> Value {
-    json!({
-        "formats": formats_value()
-    })
-}
-
-fn formats_value() -> Value {
-    json!([
-        {
-            "id": "application/dc+sd-jwt",
-            "kind": "credential",
-            "status": "enabled"
-        },
-        {
-            "id": "application/ld+json; profile=\"cccev\"",
-            "kind": "renderer",
-            "status": "enabled"
-        },
-        {
-            "id": "application/vnd.registry-notary.claim-result+json",
-            "kind": "claim_result",
-            "status": "enabled"
-        }
-    ])
-}
-
-fn evaluate_example() -> Value {
-    json!({
-        "results": [
-            claim_result_example()
-        ]
-    })
-}
-
-fn batch_evaluate_example() -> Value {
-    json!({
-        "batch_id": "01HX7Y4N6S7ZK0R2T8Q9V1M3PA",
-        "status": "completed",
-        "claims": ["farmer-under-4ha"],
-        "items": [
-            {
-                "input_index": 0,
-                "target_ref": target_ref_example("Person"),
-                "requester_ref": requester_ref_example(),
-                "evaluation_id": "01HX7Y5F2WAJ7ZP0Q4M5K9E8NC",
-                "status": "succeeded",
-                "claim_results": [
-                    {
-                        "result_id": "01HX7Y5F31M8BZWQ2HY7P6J9FA",
-                        "claim_id": "farmer-under-4ha",
-                        "claim_version": "2026-05",
-                        "value_type": "boolean",
-                        "value": true,
-                        "satisfied": true,
-                        "disclosure": "predicate",
-                        "provenance": provenance_example()
-                    }
-                ],
-                "errors": []
-            }
-        ],
-        "summary": {
-            "succeeded": 1,
-            "failed": 0
-        }
-    })
-}
-
-fn render_example() -> Value {
-    json!({
-        "results": [
-            claim_result_example()
-        ]
-    })
-}
-
-fn claim_result_example() -> Value {
-    json!({
-        "evaluation_id": "01HX7Y5F2WAJ7ZP0Q4M5K9E8NC",
-        "claim_id": "farmer-under-4ha",
-        "claim_version": "2026-05",
-        "subject_type": "person",
-        "requester_ref": requester_ref_example(),
-        "target_ref": target_ref_example("Person"),
-        "value": true,
-        "satisfied": true,
-        "disclosure": "predicate",
-        "format": "application/vnd.registry-notary.claim-result+json",
-        "issued_at": "2026-05-24T12:00:00Z",
-        "expires_at": "2026-05-25T12:00:00Z",
-        "provenance": provenance_example()
-    })
-}
-
-fn target_ref_example(entity_type: &str) -> Value {
-    json!({
-        "type": entity_type,
-        "handle": "rnref:v1:example-target-ref",
-        "identifier_schemes": ["national_id"],
-        "profile": "resident"
-    })
-}
-
-fn requester_ref_example() -> Value {
-    json!({
-        "type": "Agency",
-        "handle": "rnref:v1:example-requester-ref",
-        "identifier_schemes": ["agency_id"],
-        "profile": "benefits"
-    })
-}
-
-fn provenance_example() -> Value {
-    json!({
-        "schema_version": "registry-notary-claim-provenance/v2",
-        "generated_by": {
-            "type": "claim_evaluation",
-            "service_id": "demo.registry-notary",
-            "evaluation_id": "01HX7Y5F2WAJ7ZP0Q4M5K9E8NC",
-            "claim_id": "person_is_alive",
-            "claim_version": "1",
-            "policy_id": "subject-access",
-            "policy_version": "v1",
-            "policy_hash": "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
-        },
-        "used": {
-            "relay_consultation_count": 1
-        },
-        "derived_from": []
-    })
-}
-
-fn credential_issue_example() -> Value {
-    json!({
-        "credential_id": "urn:registry-notary:credential:01HX7Y5F2WAJ7ZP0Q4M5K9E8NC",
-        "credential_profile": "climate_smart_input_voucher_sd_jwt",
-        "format": "application/dc+sd-jwt",
-        "issuer": "did:web:agriculture.demo.example.gov",
-        "expires_at": "2026-05-25T12:00:00Z",
-        "credential": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRjK3NkLWp3dCIsImtpZCI6ImRpZDp3ZWI6YWdyaWN1bHR1cmUuZGVtby5leGFtcGxlLmdvdiNyZWdpc3RyeS13aXRuZXNzLWRlbW8ta2V5LTEifQ.eyJpc3MiOiJkaWQ6d2ViOmFncmljdWx0dXJlLmRlbW8uZXhhbXBsZS5nb3YiLCJzdWIiOiJkaWQ6andrOmV5SnJkSGtpT2lKUFMxQWlMQ0pqY25ZaU9pSkZaREkxTlRFNUlpd2llQ0k2SWpFeGNWbEJXVXQ0UTNKbVZsTmZNMWhFWWxoS1F6SkJaMWxKTlRkeFdIcGpVemRRTUZjMVdUbG1ORmtpZlEiLCJpYXQiOjE3Nzk2MjQwMDAsImV4cCI6MTc3OTcxMDQwMCwidmN0IjoiaHR0cHM6Ly9kZW1vLmV4YW1wbGUuZ292L2NyZWRlbnRpYWxzL3NtYWxsaG9sZGVyLWZhcm1lci92MSIsImp0aSI6InVybjpyZWdpc3RyeS13aXRuZXNzOmNyZWRlbnRpYWw6MDFIWDdZNUYyV0FKN1pQMFE0TTVLOUU4TkMiLCJpZCI6InVybjpyZWdpc3RyeS13aXRuZXNzOmNyZWRlbnRpYWw6MDFIWDdZNUYyV0FKN1pQMFE0TTVLOUU4TkMiLCJfc2QiOlsia0ZxYXpKcDdleVhjS1ZIX0tiMzNnQ1lwMGM3dzFDLWd0WjVORkJxbDdYcyJdLCJjbmYiOnsia2lkIjoiZGlkOmp3azpleUpyZEhraU9pSlBTMUFpTENKamNuWWlPaUpGWkRJMU5URTVJaXdpZUNJNklqRXhjVmxCV1V0NFEzSm1WbE5mTTFoRVlsaEtRekpCWjFsSk5UZHhXSHBqVXpkUU1GYzFXVGxtTkZraWZRIiwiandrIjp7Imt0eSI6Ik9LUCIsImNydiI6IkVkMjU1MTkiLCJ4IjoiMTFxWUFZS3hDcmZWU18zWERiWEpDMkFnWUk1N3FYemNTN1AwVzVZOWY0WSJ9fX0.c2lnbmF0dXJl~ZGlzY2xvc3VyZQ~",
-        "issuer_signed_jwt": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRjK3NkLWp3dCIsImtpZCI6ImRpZDp3ZWI6YWdyaWN1bHR1cmUuZGVtby5leGFtcGxlLmdvdiNyZWdpc3RyeS13aXRuZXNzLWRlbW8ta2V5LTEifQ.eyJpc3MiOiJkaWQ6d2ViOmFncmljdWx0dXJlLmRlbW8uZXhhbXBsZS5nb3YiLCJzdWIiOiJkaWQ6andrOmV5SnJkSGtpT2lKUFMxQWlMQ0pqY25ZaU9pSkZaREkxTlRFNUlpd2llQ0k2SWpFeGNWbEJXVXQ0UTNKbVZsTmZNMWhFWWxoS1F6SkJaMWxKTlRkeFdIcGpVemRRTUZjMVdUbG1ORmtpZlEiLCJpYXQiOjE3Nzk2MjQwMDAsImV4cCI6MTc3OTcxMDQwMCwidmN0IjoiaHR0cHM6Ly9kZW1vLmV4YW1wbGUuZ292L2NyZWRlbnRpYWxzL3NtYWxsaG9sZGVyLWZhcm1lci92MSIsImp0aSI6InVybjpyZWdpc3RyeS13aXRuZXNzOmNyZWRlbnRpYWw6MDFIWDdZNUYyV0FKN1pQMFE0TTVLOUU4TkMiLCJpZCI6InVybjpyZWdpc3RyeS13aXRuZXNzOmNyZWRlbnRpYWw6MDFIWDdZNUYyV0FKN1pQMFE0TTVLOUU4TkMiLCJfc2QiOlsia0ZxYXpKcDdleVhjS1ZIX0tiMzNnQ1lwMGM3dzFDLWd0WjVORkJxbDdYcyJdLCJjbmYiOnsia2lkIjoiZGlkOmp3azpleUpyZEhraU9pSlBTMUFpTENKamNuWWlPaUpGWkRJMU5URTVJaXdpZUNJNklqRXhjVmxCV1V0NFEzSm1WbE5mTTFoRVlsaEtRekpCWjFsSk5UZHhXSHBqVXpkUU1GYzFXVGxtTkZraWZRIiwiandrIjp7Imt0eSI6Ik9LUCIsImNydiI6IkVkMjU1MTkiLCJ4IjoiMTFxWUFZS3hDcmZWU18zWERiWEpDMkFnWUk1N3FYemNTN1AwVzVZOWY0WSJ9fX0.c2lnbmF0dXJl",
-        "disclosures": ["ZGlzY2xvc3VyZQ"]
-    })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{openapi_document, set_response_example};
-    use serde_json::json;
-
-    #[test]
-    fn claim_provenance_schema_is_v2_relay_consultation_contract() {
-        let doc = openapi_document();
-        let schemas = &doc["components"]["schemas"];
-
-        let provenance = &schemas["ClaimProvenance"];
-        let required: Vec<&str> = provenance["required"]
-            .as_array()
-            .expect("required array")
-            .iter()
-            .map(|value| value.as_str().expect("required entry is string"))
-            .collect();
-        assert_eq!(
-            required,
-            vec!["schema_version", "generated_by", "used", "derived_from"]
-        );
-        assert_eq!(provenance["additionalProperties"], json!(false));
-        assert_eq!(
-            provenance["properties"]["schema_version"]["enum"],
-            json!(["registry-notary-claim-provenance/v2"])
-        );
-
-        let generated_by = &schemas["ProvenanceGeneratedBy"];
-        assert_eq!(generated_by["additionalProperties"], json!(false));
-        // computed_by is dropped entirely; service_id replaces it.
-        assert!(generated_by["properties"].get("computed_by").is_none());
-        assert!(generated_by["properties"]["service_id"].is_object());
-        assert_eq!(
-            generated_by["properties"]["type"]["enum"],
-            json!(["claim_evaluation"])
-        );
-
-        let used = &schemas["ProvenanceUsed"];
-        assert_eq!(used["additionalProperties"], json!(false));
-        let used_required: Vec<&str> = used["required"]
-            .as_array()
-            .expect("required array")
-            .iter()
-            .map(|value| value.as_str().expect("string"))
-            .collect();
-        assert_eq!(used_required, vec!["relay_consultation_count"]);
-    }
-
-    #[test]
-    fn provenance_policy_id_description_names_evaluation_policy() {
-        let doc = openapi_document();
-        let schemas = &doc["components"]["schemas"];
-
-        let generated_by_policy = schemas["ProvenanceGeneratedBy"]["properties"]["policy_id"]
-            ["description"]
-            .as_str()
-            .expect("generated_by.policy_id has a description");
-        assert!(
-            generated_by_policy.contains("Evaluation policy"),
-            "generated_by.policy_id must name the evaluation policy: {generated_by_policy}"
-        );
-    }
-
-    #[test]
-    fn on_behalf_of_schema_is_frozen_envelope_rejecting_free_form() {
-        let doc = openapi_document();
-        let schemas = &doc["components"]["schemas"];
-
-        let envelope = &schemas["EvidenceOnBehalfOf"];
-        assert_eq!(
-            envelope["additionalProperties"],
-            json!(false),
-            "envelope must reject free-form payloads"
-        );
-        assert_eq!(envelope["required"], json!(["actor"]));
-        assert_eq!(
-            envelope["properties"]["actor"]["$ref"],
-            json!("#/components/schemas/EvidenceActor")
-        );
-        assert!(envelope["properties"]["delegation_ref"].is_object());
-
-        let actor = &schemas["EvidenceActor"];
-        assert_eq!(actor["additionalProperties"], json!(false));
-        let actor_required: Vec<&str> = actor["required"]
-            .as_array()
-            .expect("required array")
-            .iter()
-            .map(|value| value.as_str().expect("string"))
-            .collect();
-        assert_eq!(actor_required, vec!["type", "id_hash"]);
-        assert!(actor["properties"]["id_hash"]["description"]
-            .as_str()
-            .expect("id_hash description")
-            .contains("hmac-sha256"));
-    }
-
-    #[test]
-    fn documents_split_registry_notary_routes() {
-        let doc = openapi_document();
-        let paths = doc["paths"].as_object().expect("paths object");
-        for route in [
-            "/healthz",
-            "/ready",
-            "/admin/v1/reload",
-            "/admin/v1/capabilities",
-            "/admin/v1/posture",
-            "/openapi.json",
-            "/.well-known/evidence-service",
-            "/.well-known/evidence/jwks.json",
-            "/.well-known/openid-credential-issuer",
-            "/credentials/{vct_path}",
-            "/.well-known/vct/{vct_path}",
-            "/oid4vci/credential",
-            "/oid4vci/offers",
-            "/oid4vci/offer/start",
-            "/oid4vci/offer/callback",
-            "/oid4vci/offer/representative",
-            "/oid4vci/token",
-            "/v1/claims",
-            "/v1/claims/{claim_id}",
-            "/v1/formats",
-            "/v1/evaluations",
-            "/federation/v1/evaluations",
-            "/v1/batch-evaluations",
-            "/v1/evaluations/{evaluation_id}/render",
-            "/v1/credentials",
-            "/v1/credentials/{credential_id}/status",
-            "/admin/v1/credentials/{credential_id}/status",
-        ] {
-            assert!(paths.contains_key(route), "missing {route}");
-        }
-        for route in [
-            "/admin/v1/config/verify",
-            "/admin/v1/config/dry-run",
-            "/admin/v1/config/apply",
-            "/v1/batch-credentials",
-            "/v1/credentials/batch",
-            "/oid4vci/batch-credential",
-            "/oid4vci/batch-credentials",
-            "/oid4vci/credential-offer",
-            "/oid4vci/nonce",
-        ] {
-            assert!(
-                !paths.contains_key(route),
-                "unsupported or removed route is documented: {route}"
-            );
-        }
-        for route in paths.keys().filter(|route| route.contains("batch")) {
-            assert_eq!(
-                route, "/v1/batch-evaluations",
-                "Notary must not expose Relay, credential, or OID4VCI batch routes"
-            );
-        }
-    }
-
-    #[test]
-    fn documents_admin_posture_query_and_response_contract() {
-        let doc = openapi_document();
-        let posture = &doc["paths"]["/admin/v1/posture"]["get"];
-        assert!(posture.is_object(), "admin posture GET is documented");
-        // Authenticated read: posture must not be exposed as a public route.
-        assert_eq!(
-            posture["security"],
-            json!([{ "apiKeyAuth": [] }, { "bearerAuth": [] }])
-        );
-        // The tier query parameter is constrained to the runtime-accepted values.
-        let tier = &posture["parameters"][0];
-        assert_eq!(tier["name"], json!("tier"));
-        assert_eq!(tier["in"], json!("query"));
-        assert_eq!(tier["schema"]["enum"], json!(["default", "restricted"]));
-        // Every response the handler can return is documented.
-        for status in ["200", "400", "401", "403", "500", "503"] {
-            assert!(
-                posture["responses"][status].is_object(),
-                "posture documents the {status} response"
-            );
-        }
-        // The 200 body is documented with the real posture document shape.
-        assert_eq!(
-            posture["responses"]["200"]["content"]["application/json"]["example"]["schema"],
-            json!("registry.ops.posture.v1")
-        );
-    }
-
-    #[test]
-    fn document_info_tracks_crate_metadata() {
-        let doc = serde_json::to_value(openapi_document()).expect("document serializes");
-        assert_eq!(
-            doc["info"]["summary"],
-            "Standalone evidence evaluation, rendering, and credential issuance service."
-        );
-        assert_eq!(
-            doc["info"]["contact"]["name"],
-            "Registry Notary owning team"
-        );
-        assert_eq!(doc["info"]["version"], env!("CARGO_PKG_VERSION"));
-        assert_eq!(doc["info"]["license"]["name"], env!("CARGO_PKG_LICENSE"));
-        assert_eq!(
-            doc["info"]["license"]["identifier"],
-            env!("CARGO_PKG_LICENSE")
-        );
-    }
-
-    #[test]
-    fn document_security_contract_uses_default_security_and_canonical_api_key_header() {
-        let doc = serde_json::to_value(openapi_document()).expect("document serializes");
-        assert_eq!(
-            doc["security"],
-            json!([{ "apiKeyAuth": [] }, { "bearerAuth": [] }])
-        );
-        assert_eq!(
-            doc["components"]["securitySchemes"]["apiKeyAuth"]["name"],
-            "X-Api-Key"
-        );
-    }
-
-    #[test]
-    fn deleted_config_admin_operations_are_not_documented() {
-        let doc = serde_json::to_value(openapi_document()).expect("document serializes");
-        for path in [
-            "/admin/v1/config/verify",
-            "/admin/v1/config/dry-run",
-            "/admin/v1/config/apply",
-        ] {
-            assert!(
-                doc["paths"].get(path).is_none(),
-                "{path} must not be documented"
-            );
-        }
-        for schema in [
-            "ConfigApplyRequest",
-            "ConfigApplyResponse",
-            "TufConfigTargetRequest",
-            "LocalTufConfigTargetRequest",
-            "RemoteTufConfigTargetRequest",
-            "BreakGlassApproval",
-            "BreakGlassRateLimit",
-        ] {
-            assert!(
-                doc["components"]["schemas"].get(schema).is_none(),
-                "retired schema is still documented: {schema}"
-            );
-        }
-    }
-
-    #[test]
-    fn public_probe_routes_do_not_require_security() {
-        let doc = serde_json::to_value(openapi_document()).expect("document serializes");
-        assert_eq!(doc["paths"]["/healthz"]["get"]["security"], json!([]));
-        assert_eq!(doc["paths"]["/ready"]["get"]["security"], json!([]));
-        assert_eq!(
-            doc["paths"]["/.well-known/evidence/jwks.json"]["get"]["security"],
-            json!([])
-        );
-        assert_eq!(
-            doc["paths"]["/.well-known/openid-credential-issuer"]["get"]["security"],
-            json!([])
-        );
-        assert_eq!(
-            doc["paths"]["/credentials/{vct_path}"]["get"]["security"],
-            json!([])
-        );
-        assert_eq!(
-            doc["paths"]["/.well-known/vct/{vct_path}"]["get"]["security"],
-            json!([])
-        );
-        assert_eq!(
-            doc["paths"]["/oid4vci/offer/start"]["get"]["security"],
-            json!([])
-        );
-        assert_eq!(
-            doc["paths"]["/oid4vci/offer/callback"]["get"]["security"],
-            json!([])
-        );
-        assert_eq!(
-            doc["paths"]["/oid4vci/offer/representative"]["post"]["security"],
-            json!([])
-        );
-        let representative_form = &doc["paths"]["/oid4vci/offer/representative"]["post"]
-            ["requestBody"]["content"]["application/x-www-form-urlencoded"]["schema"];
-        assert_eq!(
-            representative_form["required"],
-            json!(["selection_state", "csrf_token", "target_id"])
-        );
-        assert!(representative_form["properties"]["target_id"].is_object());
-        assert_eq!(
-            doc["paths"]["/oid4vci/token"]["post"]["security"],
-            json!([])
-        );
-        assert_eq!(
-            doc["paths"]["/federation/v1/evaluations"]["post"]["security"],
-            json!([])
-        );
-        assert_eq!(
-            doc["paths"]["/v1/credentials/{credential_id}/status"]["get"]["security"],
-            json!([])
-        );
-        assert_eq!(
-            doc["paths"]["/healthz"]["get"]["responses"]["4XX"]["description"],
-            "Client error"
-        );
-        assert_eq!(
-            doc["paths"]["/ready"]["get"]["responses"]["4XX"]["description"],
-            "Client error"
-        );
-    }
-
-    #[test]
-    fn documents_typed_readiness_custody_contract() {
-        let doc = openapi_document();
-        let ready = &doc["paths"]["/ready"]["get"]["responses"];
-        assert_eq!(
-            ready["200"]["content"]["application/json"]["schema"]["$ref"],
-            json!("#/components/schemas/ReadinessResponse")
-        );
-        assert_eq!(
-            ready["503"]["content"]["application/problem+json"]["schema"]["$ref"],
-            json!("#/components/schemas/ReadinessProblem")
-        );
-        assert!(
-            doc["components"]["schemas"]["ReadinessCheckProblem"]["required"]
-                .as_array()
-                .expect("required array")
-                .iter()
-                .any(|field| field == "request_id")
-        );
-        assert_eq!(
-            doc["components"]["schemas"]["ReadinessProblem"]["oneOf"],
-            json!([
-                { "$ref": "#/components/schemas/ReadinessCheckProblem" },
-                { "$ref": "#/components/schemas/AuditChainInconsistentProblem" }
-            ])
-        );
-        let audit_problem = &doc["components"]["schemas"]["AuditChainInconsistentProblem"];
-        assert_eq!(
-            audit_problem["properties"]["code"]["enum"],
-            json!(["audit.chain.inconsistent"])
-        );
-        assert_eq!(audit_problem["additionalProperties"], json!(false));
-
-        let custody = &doc["components"]["schemas"]["SignerCustodyChecks"];
-        let required = custody["required"].as_array().expect("required array");
-        for field in [
-            "active_provider_counts",
-            "custody_approval_required",
-            "custody_approved",
-            "unapproved_signing_provider_count",
-            "surfaces",
-        ] {
-            assert!(required.iter().any(|entry| entry == field));
-        }
-
-        for status in ["200", "503"] {
-            let checks = if status == "200" {
-                &ready[status]["content"]["application/json"]["example"]["checks"]
-            } else {
-                &ready[status]["content"]["application/problem+json"]["examples"]["notReady"]
-                    ["value"]["checks"]
-            };
-            assert!(checks.get("deployment").is_none());
-            assert!(checks["relay"].get("total").is_some());
-            assert!(checks["signing_providers"]["custody"]["surfaces"]
-                .get("access_token_issuance")
-                .is_some());
-        }
-        let audit_example = &ready["503"]["content"]["application/problem+json"]["examples"]
-            ["auditChainInconsistent"]["value"];
-        assert_eq!(audit_example["code"], "audit.chain.inconsistent");
-        assert!(audit_example.get("checks").is_none());
-    }
-
-    #[test]
-    fn high_value_routes_have_redoc_response_examples() {
-        let doc = serde_json::to_value(openapi_document()).expect("document serializes");
-        for (path, method, status) in [
-            ("/healthz", "get", "200"),
-            ("/ready", "get", "200"),
-            ("/admin/v1/capabilities", "get", "200"),
-            ("/admin/v1/posture", "get", "200"),
-            ("/openapi.json", "get", "200"),
-            ("/.well-known/evidence-service", "get", "200"),
-            ("/.well-known/evidence/jwks.json", "get", "200"),
-            ("/.well-known/openid-credential-issuer", "get", "200"),
-            ("/credentials/{vct_path}", "get", "200"),
-            ("/.well-known/vct/{vct_path}", "get", "200"),
-            ("/oid4vci/credential", "post", "200"),
-            ("/oid4vci/offers", "post", "200"),
-            ("/oid4vci/token", "post", "200"),
-            ("/v1/claims", "get", "200"),
-            ("/v1/claims/{claim_id}", "get", "200"),
-            ("/v1/formats", "get", "200"),
-            ("/v1/evaluations", "post", "200"),
-            ("/v1/batch-evaluations", "post", "200"),
-            ("/v1/evaluations/{evaluation_id}/render", "post", "200"),
-            ("/v1/credentials", "post", "200"),
-            ("/v1/credentials/{credential_id}/status", "get", "200"),
-            (
-                "/admin/v1/credentials/{credential_id}/status",
-                "post",
-                "200",
-            ),
-        ] {
-            assert_json_example(&doc, path, method, status);
-        }
-
-        assert_eq!(
-            doc["paths"]["/.well-known/evidence-service"]["get"]["responses"]["200"]["content"]
-                ["application/json"]["example"]["service_id"],
-            json!("demo.registry-notary")
-        );
-        assert_eq!(
-            doc["paths"]["/v1/evaluations"]["post"]["responses"]["200"]["content"]
-                ["application/json"]["example"]["results"][0]["claim_id"],
-            json!("farmer-under-4ha")
-        );
-        assert_eq!(
-            doc["paths"]["/v1/credentials"]["post"]["responses"]["200"]["content"]
-                ["application/json"]["example"]["format"],
-            json!("application/dc+sd-jwt")
-        );
-    }
-
-    #[test]
-    fn evaluation_response_schemas_use_target_and_requester_refs() {
-        let doc = serde_json::to_value(openapi_document()).expect("document serializes");
-
-        assert_eq!(
-            doc["paths"]["/v1/evaluations"]["post"]["responses"]["200"]["content"]
-                ["application/json"]["schema"]["$ref"],
-            json!("#/components/schemas/EvaluationResponse")
-        );
-        assert_eq!(
-            doc["paths"]["/v1/batch-evaluations"]["post"]["responses"]["200"]["content"]
-                ["application/json"]["schema"]["$ref"],
-            json!("#/components/schemas/BatchEvaluateResponse")
-        );
-        assert_eq!(
-            doc["components"]["schemas"]["ClaimResultView"]["properties"]["target_ref"]["$ref"],
-            json!("#/components/schemas/TargetRefView")
-        );
-        assert_eq!(
-            doc["components"]["schemas"]["ClaimResultView"]["properties"]["requester_ref"]["$ref"],
-            json!("#/components/schemas/EvidenceEntityRef")
-        );
-        let evaluate_example = &doc["paths"]["/v1/evaluations"]["post"]["responses"]["200"]
-            ["content"]["application/json"]["example"]["results"][0];
-        assert!(evaluate_example.get("subject_ref").is_none());
-        assert!(evaluate_example.get("target_ref").is_some());
-        assert!(evaluate_example.get("requester_ref").is_some());
-        assert!(evaluate_example.get("matching").is_none());
-        assert!(evaluate_example["value"].is_boolean());
-
-        let batch_item_example = &doc["paths"]["/v1/batch-evaluations"]["post"]["responses"]["200"]
-            ["content"]["application/json"]["example"]["items"][0];
-        assert!(batch_item_example.get("subject_ref").is_none());
-        assert!(batch_item_example.get("target_ref").is_some());
-        assert!(batch_item_example.get("requester_ref").is_some());
-        assert!(batch_item_example.get("matching").is_none());
-        assert!(batch_item_example["claim_results"][0]["value"].is_boolean());
-        assert_eq!(
-            doc["components"]["schemas"]["ClaimResultView"]["properties"]["value"]["type"],
-            json!(["object", "array", "string", "number", "integer", "boolean", "null"])
-        );
-        assert_eq!(
-            doc["components"]["schemas"]["BatchClaimResultView"]["properties"]["value"]["type"],
-            json!(["object", "array", "string", "number", "integer", "boolean", "null"])
-        );
-        assert_eq!(
-            doc["components"]["schemas"]["ClaimResultView"]["properties"]["redacted_fields"]
-                ["items"]["type"],
-            json!("string")
-        );
-        assert!(!doc["components"]["schemas"]["ClaimResultView"]["required"]
-            .as_array()
-            .expect("required claim-result fields are an array")
-            .contains(&json!("redacted_fields")));
-
-        let evaluate_request = &doc["components"]["schemas"]["EvaluateRequest"]["properties"];
-        assert!(evaluate_request.get("subject").is_none());
-        assert!(evaluate_request.get("id_type").is_none());
-        assert!(evaluate_request.get("target").is_some());
-        assert_eq!(evaluate_request["variables"]["maxProperties"], json!(16));
-        assert_eq!(
-            evaluate_request["variables"]["additionalProperties"]["format"],
-            json!("date")
-        );
-        assert_eq!(
-            doc["components"]["schemas"]["EvaluateRequest"]["required"],
-            json!(["claims"])
-        );
-
-        let batch_request = &doc["components"]["schemas"]["BatchEvaluateRequest"]["properties"];
-        assert!(batch_request.get("subjects").is_none());
-        assert!(batch_request.get("items").is_some());
-        assert!(batch_request["items"].get("minItems").is_none());
-        assert_eq!(
-            batch_request["items"]["maxItems"],
-            json!(registry_notary_core::MAX_BATCH_EVALUATION_MEMBERS_V1)
-        );
-        assert_eq!(
-            doc["paths"]["/v1/batch-evaluations"]["post"]["responses"]["413"]["content"]
-                ["application/problem+json"]["example"]["code"],
-            json!("batch.too_large")
-        );
-    }
-
-    #[test]
-    fn common_error_responses_have_problem_detail_examples() {
-        let doc = serde_json::to_value(openapi_document()).expect("document serializes");
-        for (path, method, status) in [
-            ("/admin/v1/reload", "post", "401"),
-            ("/admin/v1/reload", "post", "403"),
-            ("/admin/v1/posture", "get", "400"),
-            ("/admin/v1/posture", "get", "401"),
-            ("/admin/v1/posture", "get", "403"),
-            ("/admin/v1/posture", "get", "500"),
-            ("/admin/v1/posture", "get", "503"),
-            ("/.well-known/evidence-service", "get", "401"),
-            ("/v1/claims", "get", "401"),
-            ("/v1/claims/{claim_id}", "get", "401"),
-            ("/v1/claims/{claim_id}", "get", "404"),
-            ("/v1/formats", "get", "401"),
-            ("/v1/evaluations", "post", "400"),
-            ("/v1/evaluations", "post", "401"),
-            ("/v1/evaluations", "post", "403"),
-            ("/v1/evaluations", "post", "406"),
-            ("/v1/evaluations", "post", "413"),
-            ("/v1/evaluations", "post", "429"),
-            ("/v1/evaluations", "post", "503"),
-            ("/v1/batch-evaluations", "post", "400"),
-            ("/v1/batch-evaluations", "post", "401"),
-            ("/v1/batch-evaluations", "post", "403"),
-            ("/v1/batch-evaluations", "post", "406"),
-            ("/v1/batch-evaluations", "post", "409"),
-            ("/v1/batch-evaluations", "post", "413"),
-            ("/v1/batch-evaluations", "post", "429"),
-            ("/v1/batch-evaluations", "post", "503"),
-            ("/v1/evaluations/{evaluation_id}/render", "post", "400"),
-            ("/v1/evaluations/{evaluation_id}/render", "post", "401"),
-            ("/v1/evaluations/{evaluation_id}/render", "post", "404"),
-            ("/v1/evaluations/{evaluation_id}/render", "post", "406"),
-            ("/v1/evaluations/{evaluation_id}/render", "post", "413"),
-            ("/v1/evaluations/{evaluation_id}/render", "post", "429"),
-            ("/v1/evaluations/{evaluation_id}/render", "post", "503"),
-            ("/v1/credentials", "post", "400"),
-            ("/v1/credentials", "post", "401"),
-            ("/v1/credentials", "post", "404"),
-            ("/v1/credentials", "post", "406"),
-            ("/v1/credentials", "post", "409"),
-            ("/v1/credentials", "post", "413"),
-            ("/v1/credentials", "post", "429"),
-            ("/v1/credentials", "post", "503"),
-            ("/ready", "get", "503"),
-            ("/v1/credentials/{credential_id}/status", "get", "404"),
-            ("/v1/credentials/{credential_id}/status", "get", "503"),
-            (
-                "/admin/v1/credentials/{credential_id}/status",
-                "post",
-                "400",
-            ),
-            (
-                "/admin/v1/credentials/{credential_id}/status",
-                "post",
-                "401",
-            ),
-            (
-                "/admin/v1/credentials/{credential_id}/status",
-                "post",
-                "403",
-            ),
-            (
-                "/admin/v1/credentials/{credential_id}/status",
-                "post",
-                "404",
-            ),
-            (
-                "/admin/v1/credentials/{credential_id}/status",
-                "post",
-                "503",
-            ),
-        ] {
-            assert_problem_example(&doc, path, method, status);
-        }
-
-        assert_eq!(
-            doc["paths"]["/v1/claims/{claim_id}"]["get"]["responses"]["404"]["content"]
-                ["application/problem+json"]["example"]["code"],
-            json!("claim.not_found")
-        );
-        assert_eq!(
-            doc["paths"]["/v1/evaluations/{evaluation_id}/render"]["post"]["responses"]["404"]
-                ["content"]["application/problem+json"]["example"]["code"],
-            json!("evaluation.not_found")
-        );
-    }
-
-    #[test]
-    fn every_problem_example_carries_the_required_request_id() {
-        let doc = serde_json::to_value(openapi_document()).expect("document serializes");
-        for (path, path_item) in doc["paths"].as_object().expect("paths are an object") {
-            for (method, operation) in path_item.as_object().expect("path item is an object") {
-                let Some(responses) = operation
-                    .get("responses")
-                    .and_then(serde_json::Value::as_object)
-                else {
-                    continue;
-                };
-                for (status, response) in responses {
-                    let Some(example) = response
-                        .pointer("/content/application~1problem+json/example")
-                        .filter(|example| example.is_object())
-                    else {
-                        continue;
-                    };
-                    assert!(
-                        example["request_id"]
-                            .as_str()
-                            .is_some_and(|value| !value.is_empty()),
-                        "problem example must include request_id for {method} {path} {status}"
-                    );
-                }
-            }
-        }
-    }
-
-    #[test]
-    fn oid4vci_routes_document_json_error_envelope() {
-        let doc = serde_json::to_value(openapi_document()).expect("document serializes");
-        assert_eq!(
-            doc["components"]["schemas"]["CredentialIssuerMetadata"]["type"],
-            json!("object")
-        );
-        assert!(
-            doc["components"]["schemas"]["CredentialIssuerMetadata"]["properties"]
-                .get("nonce_endpoint")
-                .is_none(),
-            "the 1.0 issuer metadata schema must not advertise a public nonce endpoint"
-        );
-        assert_eq!(
-            doc["components"]["schemas"]["CredentialRequest"]["type"],
-            json!("object")
-        );
-        assert_eq!(
-            doc["components"]["schemas"]["CredentialResponse"]["type"],
-            json!("object")
-        );
-        assert_eq!(
-            doc["paths"]["/oid4vci/credential"]["post"]["responses"]["400"]["content"]
-                ["application/json"]["schema"]["$ref"],
-            json!("#/components/schemas/Oid4vciError")
-        );
-        let credential_description = doc["paths"]["/oid4vci/credential"]["post"]["description"]
-            .as_str()
-            .expect("credential endpoint has a description");
-        assert!(
-            credential_description.contains("immutable registry-backed evaluation transaction")
-                && credential_description.contains("exact retry")
-                && credential_description.contains("without another Relay call or signature"),
-            "credential endpoint documents transaction-bound materialization and retry semantics"
-        );
-        assert_eq!(
-            doc["components"]["schemas"]["TokenRequest"]["type"],
-            json!("object")
-        );
-        assert_eq!(
-            doc["components"]["schemas"]["TokenResponse"]["type"],
-            json!("object")
-        );
-        assert_eq!(
-            doc["paths"]["/oid4vci/token"]["post"]["requestBody"]["content"]
-                ["application/x-www-form-urlencoded"]["schema"]["$ref"],
-            json!("#/components/schemas/TokenRequest")
-        );
-        assert_eq!(
-            doc["paths"]["/oid4vci/token"]["post"]["responses"]["200"]["content"]
-                ["application/json"]["schema"]["$ref"],
-            json!("#/components/schemas/TokenResponse")
-        );
-        assert_eq!(
-            doc["paths"]["/oid4vci/token"]["post"]["responses"]["400"]["content"]
-                ["application/json"]["schema"]["$ref"],
-            json!("#/components/schemas/Oid4vciError")
-        );
-        // The token endpoint documents its grant, the conditional tx_code, and the
-        // public/unauthenticated nature.
-        let token_description = doc["paths"]["/oid4vci/token"]["post"]["description"]
-            .as_str()
-            .expect("token endpoint has a description");
-        assert!(
-            token_description.contains("urn:ietf:params:oauth:grant-type:pre-authorized_code"),
-            "token endpoint documents the pre-authorized-code grant"
-        );
-        assert!(
-            token_description.contains("tx_code") && token_description.contains("offer includes"),
-            "token endpoint documents when tx_code is required"
-        );
-        assert!(
-            token_description.contains("unauthenticated"),
-            "token endpoint documents that it is unauthenticated"
-        );
-        assert!(
-            token_description.contains("404") && token_description.contains("disabled"),
-            "token endpoint documents the disabled 404 behavior"
-        );
-        assert_eq!(
-            doc["components"]["schemas"]["SdJwtVcTypeMetadata"]["properties"]["claims"]["items"]
-                ["properties"]["sd"]["enum"],
-            json!(["always"])
-        );
-        assert_eq!(
-            doc["components"]["schemas"]["SdJwtVcTypeMetadata"]["properties"]["claims"]["items"]
-                ["properties"]["registry_notary_value_schema"]["$ref"],
-            json!("#/components/schemas/RelayOutputContract")
-        );
-        assert_eq!(
-            doc["paths"]["/credentials/{vct_path}"]["get"]["responses"]["200"]["content"]
-                ["application/json"]["example"]["claims"][0]["registry_notary_value_schema"],
-            json!({"type": "boolean", "nullable": false})
-        );
-        assert_eq!(
-            doc["paths"]["/credentials/{vct_path}"]["get"]["responses"]["200"]["content"]
-                ["application/json"]["schema"]["$ref"],
-            json!("#/components/schemas/SdJwtVcTypeMetadata")
-        );
-        assert_eq!(
-            doc["paths"]["/credentials/{vct_path}"]["get"]["responses"]["200"]["content"]
-                ["application/json"]["example"]["claims"][0]["path"],
-            json!(["person-is-alive"])
-        );
-        assert!(
-            doc["paths"]["/credentials/{vct_path}"]["get"]["description"]
-                .as_str()
-                .is_some_and(|description| description.contains("multi-segment catch-all")),
-            "Type Metadata route must document that vct_path is a multi-segment catch-all"
-        );
-        // x-registry-notary-catch-all lives on the path item, not the operation.
-        assert_eq!(
-            doc["paths"]["/credentials/{vct_path}"]["x-registry-notary-catch-all"],
-            json!(true)
-        );
-        assert_eq!(
-            doc["paths"]["/credentials/{vct_path}"]["get"]["parameters"][0]["schema"]["pattern"],
-            json!("^[^/]+(/[^/]+)*$"),
-            "vct_path parameter schema must carry a pattern permitting slash-separated segments"
-        );
-        assert_eq!(
-            doc["paths"]["/.well-known/vct/{vct_path}"]["get"]["responses"]["200"]["content"]
-                ["application/json"]["schema"]["$ref"],
-            json!("#/components/schemas/SdJwtVcTypeMetadata")
-        );
-        assert_eq!(
-            doc["paths"]["/.well-known/vct/{vct_path}"]["get"]["responses"]["200"]["content"]
-                ["application/json"]["example"]["claims"][0]["path"],
-            json!(["person-is-alive"])
-        );
-        assert!(
-            doc["paths"]["/.well-known/vct/{vct_path}"]["get"]["description"]
-                .as_str()
-                .is_some_and(|description| description.contains("/.well-known/vct")
-                    && description.contains("multi-segment catch-all")),
-            "well-known Type Metadata route must document the well-known prefix and catch-all semantics"
-        );
-        // x-registry-notary-catch-all lives on the path item, not the operation.
-        assert_eq!(
-            doc["paths"]["/.well-known/vct/{vct_path}"]["x-registry-notary-catch-all"],
-            json!(true)
-        );
-        assert_eq!(
-            doc["paths"]["/.well-known/vct/{vct_path}"]["get"]["parameters"][0]["schema"]
-                ["pattern"],
-            json!("^[^/]+(/[^/]+)*$"),
-            "well-known vct_path parameter schema must carry a pattern permitting slash-separated segments"
-        );
-    }
-
-    #[test]
-    fn batch_openapi_requires_the_idempotency_header() {
-        let doc = serde_json::to_value(openapi_document()).expect("document serializes");
-        let operation = &doc["paths"]["/v1/batch-evaluations"]["post"];
-        let idempotency_key = operation["parameters"]
-            .as_array()
-            .expect("batch parameters are an array")
-            .iter()
-            .find(|parameter| parameter["name"] == "Idempotency-Key")
-            .expect("Idempotency-Key is documented");
-
-        assert_eq!(idempotency_key["required"], json!(true));
-        assert_eq!(idempotency_key["schema"]["minLength"], json!(1));
-        assert_eq!(idempotency_key["schema"]["maxLength"], json!(256));
-    }
-
-    #[test]
-    fn registrar_offer_openapi_is_machine_authenticated_idempotent_and_non_storable() {
-        let doc = serde_json::to_value(openapi_document()).expect("document serializes");
-        let operation = &doc["paths"]["/oid4vci/offers"]["post"];
-
-        assert_eq!(
-            operation["security"],
-            json!([{ "apiKeyAuth": [] }, { "bearerAuth": [] }])
-        );
-        assert!(operation["description"]
-            .as_str()
-            .is_some_and(|description| {
-                description.contains("registry_notary:credential_offer_create")
-                    && description.contains("Idempotency-Key")
-                    && description.contains("authenticated browser ceremony")
-                    && description.contains("exact stored values")
-                    && description.contains("exact target-scoped authorization_details")
-                    && description.contains("never contains its numeric value")
-                    && description.contains("separate channel")
-                    && description.contains("non-storable")
-            }));
-        let idempotency_key = operation["parameters"]
-            .as_array()
-            .expect("offer parameters are an array")
-            .iter()
-            .find(|parameter| parameter["name"] == "Idempotency-Key")
-            .expect("Idempotency-Key is documented");
-        assert_eq!(idempotency_key["required"], json!(true));
-        assert_eq!(idempotency_key["schema"]["maxLength"], json!(256));
-        assert_eq!(
-            operation["requestBody"]["content"]["application/json"]["schema"]["$ref"],
-            json!("#/components/schemas/RegistryClientOfferRequest")
-        );
-        assert_eq!(
-            doc["components"]["schemas"]["RegistryClientOfferRequest"]["required"],
-            json!(["evaluation_id", "credential_configuration_id"])
-        );
-        assert_eq!(
-            doc["components"]["schemas"]["RegistryClientOfferRequest"]["additionalProperties"],
-            json!(false)
-        );
-        assert_eq!(
-            operation["responses"]["200"]["content"]["application/json"]["schema"]["$ref"],
-            json!("#/components/schemas/RegistryClientOfferResponse")
-        );
-        assert_eq!(
-            operation["responses"]["200"]["headers"]["Cache-Control"]["schema"]["enum"],
-            json!(["no-store"])
-        );
-        assert_eq!(
-            operation["responses"]["200"]["headers"]["Pragma"]["schema"]["enum"],
-            json!(["no-cache"])
-        );
-        for status in ["400", "401", "403", "404", "409", "429", "503"] {
-            assert_eq!(
-                operation["responses"][status]["content"]["application/problem+json"]["schema"]
-                    ["$ref"],
-                json!("#/components/schemas/ProblemDetails")
-            );
-            assert_eq!(
-                operation["responses"][status]["headers"]["Cache-Control"]["schema"]["enum"],
-                json!(["no-store"])
-            );
-        }
-        let response = &doc["components"]["schemas"]["RegistryClientOfferResponse"];
-        assert_eq!(
-            response["required"],
-            json!(["credential_offer_uri", "tx_code", "expires_at"])
-        );
-        assert!(
-            response["properties"]["credential_offer_uri"]["description"]
-                .as_str()
-                .is_some_and(|description| description.contains("never contains the numeric"))
-        );
-        assert!(response["properties"]["tx_code"]["description"]
-            .as_str()
-            .is_some_and(|description| description.contains("separate")));
-    }
-
-    #[test]
-    fn type_metadata_documents_closed_recursive_claim_value_contract() {
-        let doc = serde_json::to_value(openapi_document()).expect("document serializes");
-        let contract = &doc["components"]["schemas"]["RelayOutputContract"];
-        let variants = contract["oneOf"]
-            .as_array()
-            .expect("Relay output contract variants");
-        assert_eq!(variants.len(), 6);
-
-        let object = variants
-            .iter()
-            .find(|variant| variant["properties"]["type"]["enum"] == json!(["object"]))
-            .expect("object output contract");
-        assert_eq!(object["additionalProperties"], json!(false));
-        assert_eq!(object["properties"]["fields"]["maxProperties"], json!(32));
-        assert_eq!(
-            object["properties"]["fields"]["additionalProperties"]["$ref"],
-            json!("#/components/schemas/RelayOutputObjectFieldContract")
-        );
-
-        let array = variants
-            .iter()
-            .find(|variant| variant["properties"]["type"]["enum"] == json!(["array"]))
-            .expect("array output contract");
-        assert_eq!(array["additionalProperties"], json!(false));
-        assert_eq!(array["properties"]["max_items"]["maximum"], json!(256));
-        assert_eq!(
-            array["properties"]["items"]["$ref"],
-            json!("#/components/schemas/RelayOutputContract")
-        );
-        assert_eq!(array["properties"]["max_bytes"]["maximum"], json!(65_536));
-    }
-
-    #[test]
-    fn problem_responses_reference_shared_problem_details_schema() {
-        let doc = serde_json::to_value(openapi_document()).expect("document serializes");
-        assert!(doc["components"]["schemas"]["ProblemDetails"].is_object());
-
-        for (path, method, status) in [
-            ("/admin/v1/reload", "post", "501"),
-            ("/admin/v1/capabilities", "get", "401"),
-            ("/admin/v1/capabilities", "get", "403"),
-            ("/v1/evaluations", "post", "400"),
-            ("/v1/evaluations", "post", "401"),
-            ("/v1/evaluations", "post", "403"),
-            ("/v1/credentials", "post", "404"),
-        ] {
-            assert_eq!(
-                doc["paths"][path][method]["responses"][status]["content"]
-                    ["application/problem+json"]["schema"]["$ref"],
-                json!("#/components/schemas/ProblemDetails"),
-                "problem response schema must reference the shared component for {method} {path} {status}"
-            );
-        }
-    }
-
-    #[test]
-    fn response_example_patcher_noops_when_target_shape_is_missing() {
-        let mut doc = json!({
-            "paths": {
-                "/demo": {
-                    "get": {
-                        "responses": {
-                            "200": {
-                                "description": "plain response",
-                                "content": {
-                                    "text/plain": {}
-                                }
-                            },
-                            "400": {
-                                "description": "problem response",
-                                "content": {
-                                    "application/problem+json": "not an object"
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-        });
-
-        set_response_example(
-            &mut doc,
-            "/missing",
-            "get",
-            "200",
-            "Missing path",
-            "application/json",
-            json!({ "ignored": true }),
-        );
-        set_response_example(
-            &mut doc,
-            "/demo",
-            "get",
-            "200",
-            "JSON response",
-            "application/json",
-            json!({ "ignored": true }),
-        );
-        set_response_example(
-            &mut doc,
-            "/demo",
-            "get",
-            "400",
-            "Problem response",
-            "application/problem+json",
-            json!({ "ignored": true }),
-        );
-
-        assert!(
-            doc["paths"]["/demo"]["get"]["responses"]["200"]["content"]["application/json"]
-                .is_null()
-        );
-        assert_eq!(
-            doc["paths"]["/demo"]["get"]["responses"]["400"]["content"]["application/problem+json"],
-            json!("not an object")
-        );
-    }
-
-    #[test]
-    fn admin_routes_carry_explicit_per_route_security() {
-        // Admin routes must declare security explicitly so OpenAPI consumers do not
-        // treat them as equivalent to data routes that merely inherit the doc-level
-        // default. The declared schemes must match what the runtime enforces: an API
-        // key (X-Api-Key header) or an OIDC bearer token.
-        let doc = serde_json::to_value(openapi_document()).expect("document serializes");
-        let expected = json!([{ "apiKeyAuth": [] }, { "bearerAuth": [] }]);
-        for (path, method) in [
-            ("/admin/v1/reload", "post"),
-            ("/admin/v1/capabilities", "get"),
-            ("/admin/v1/credentials/{credential_id}/status", "post"),
-        ] {
-            assert_eq!(
-                doc["paths"][path][method]["security"], expected,
-                "admin route {method} {path} must carry explicit per-route security"
-            );
-        }
-    }
-
-    fn assert_json_example(doc: &serde_json::Value, path: &str, method: &str, status: &str) {
-        assert!(
-            doc["paths"][path][method]["responses"][status]["content"]["application/json"]
-                ["example"]
-                .is_object(),
-            "missing JSON example for {method} {path} {status}"
-        );
-    }
-
-    fn assert_problem_example(doc: &serde_json::Value, path: &str, method: &str, status: &str) {
-        let media =
-            &doc["paths"][path][method]["responses"][status]["content"]["application/problem+json"];
-        let examples = if media["example"].is_object() {
-            vec![&media["example"]]
-        } else {
-            media["examples"]
-                .as_object()
-                .map(|examples| examples.values().map(|example| &example["value"]).collect())
-                .unwrap_or_default()
-        };
-        assert!(
-            !examples.is_empty() && examples.iter().all(|example| example.is_object()),
-            "missing problem example for {method} {path} {status}"
-        );
-        for example in examples {
-            assert!(
-                example["type"].as_str().is_some_and(|value| {
-                    value.starts_with("https://id.registrystack.org/problems/registry-notary/")
-                }),
-                "problem example must include a Registry Notary problem type for {method} {path} {status}"
-            );
-            assert!(
-                example["code"].is_string(),
-                "problem example must include a code for {method} {path} {status}"
-            );
-        }
-    }
-}
diff --git a/crates/registry-notary-server/src/posture.rs b/crates/registry-notary-server/src/posture.rs
deleted file mode 100644
index fd75fbe3b..000000000
--- a/crates/registry-notary-server/src/posture.rs
+++ /dev/null
@@ -1,892 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Redacted Registry Ops posture for standalone Registry Notary.
-
-use registry_notary_core::{
-    DeploymentEvidenceConfig, EvidenceAuditConfig, SigningKeyStatus,
-    StandaloneRegistryNotaryConfig, SubjectAccessConfig,
-    MAX_BEARER_PRE_AUTHORIZED_CODE_TTL_SECONDS, STATE_STORAGE_IN_MEMORY, STATE_STORAGE_POSTGRESQL,
-};
-use registry_platform_ops::{
-    audit_shipping_target, filter_posture_for_tier, override_pin_posture,
-    posture_safe_runtime_config_hash, AckObservation, AuditSinkKind, PostureFilterError,
-    PostureTier,
-};
-use serde_json::{json, Map, Value};
-use std::collections::{BTreeMap, BTreeSet};
-use time::OffsetDateTime;
-
-use crate::{
-    api::{ConfigApplyPosture, ConfigEmergencyPosture},
-    format_time,
-    replay::ReplayReadiness,
-    standalone::{AuditPipeline, DeploymentGateState},
-    RegistryNotaryApiState,
-};
-
-#[derive(Clone, Debug)]
-pub(crate) struct PostureContext {
-    instance: InstancePosture,
-    auth_mode: String,
-    auth_methods: Vec<String>,
-    config_hash: String,
-    state_storage: String,
-    credential_status_enabled: bool,
-    credential_status_storage: String,
-    audit: AuditPosture,
-    signing_keys: SigningKeyPosture,
-    oid4vci: Oid4vciPosture,
-    subject_access: SubjectAccessPosture,
-}
-
-#[derive(Clone, Debug)]
-struct InstancePosture {
-    id: String,
-    environment: String,
-    owner: Option<String>,
-    jurisdiction: Option<String>,
-    public_base_url: Option<String>,
-}
-
-#[derive(Clone, Debug)]
-struct AuditPosture {
-    sink: String,
-    configured: bool,
-    shipping_target_configured: bool,
-    shipping_target: String,
-    /// Observed off-host shipping health from the local ack cursor. `None`
-    /// (rendered null) iff `shipping_target_configured` is false. Runtime `ok`
-    /// requires freshness plus a watermark bound to the live keyed chain tail.
-    shipping_health: Option<String>,
-    /// The ack cursor's `acked_at` when one was read, else `None` (null).
-    shipping_observed_at: Option<String>,
-}
-
-#[derive(Clone, Debug, Default)]
-struct SigningKeyPosture {
-    active: Vec<String>,
-    publish_only: Vec<String>,
-    disabled: Vec<String>,
-}
-
-#[derive(Clone, Debug, Eq, PartialEq)]
-pub(crate) enum SigningKeyPostureError {
-    UnknownStatus { key_id: String },
-}
-
-impl SigningKeyPostureError {
-    pub(crate) fn key_id(&self) -> &str {
-        match self {
-            Self::UnknownStatus { key_id } => key_id,
-        }
-    }
-}
-
-#[derive(Debug)]
-pub(crate) enum PostureDocumentError {
-    Filter(PostureFilterError),
-    SigningKey(SigningKeyPostureError),
-}
-
-#[derive(Clone, Debug)]
-struct Oid4vciPosture {
-    pre_authorized_code_enabled: bool,
-    pre_authorized_code_ttl_seconds: u64,
-    tx_code_required: bool,
-    offer_security_mode: String,
-}
-
-#[derive(Clone, Debug)]
-struct SubjectAccessPosture {
-    enabled: bool,
-    allowed_claim_count: usize,
-    allowed_purpose_count: usize,
-    credential_profile_count: usize,
-    wallet_origin_count: usize,
-    rate_limit_mode: String,
-}
-
-impl PostureContext {
-    pub(crate) fn from_config(
-        config: &StandaloneRegistryNotaryConfig,
-        _audit: &AuditPipeline,
-    ) -> Result<Self, SigningKeyPostureError> {
-        // Runtime posture replaces this boot-time placeholder with one bounded
-        // cursor sample bound to the live audit tail.
-        let audit_observation = registry_platform_ops::AckObservation::unverified();
-        let auth_methods = configured_auth_methods(config);
-        Ok(Self {
-            instance: InstancePosture {
-                id: config.instance.id.clone(),
-                environment: config.instance.environment.clone(),
-                owner: config.instance.owner.clone(),
-                jurisdiction: config.instance.jurisdiction.clone(),
-                public_base_url: config.instance.public_base_url.clone(),
-            },
-            auth_mode: if auth_methods.len() == 1 {
-                auth_methods[0].clone()
-            } else {
-                "mixed".to_string()
-            },
-            auth_methods,
-            config_hash: config_hash(config),
-            state_storage: classify_state_storage(config.state.storage.as_str()),
-            credential_status_enabled: config.credential_status.enabled,
-            credential_status_storage: classify_credential_status_storage(
-                &config.credential_status,
-            ),
-            audit: audit_posture(
-                &config.audit,
-                &config.deployment.evidence,
-                &audit_observation,
-            ),
-            signing_keys: signing_key_posture(config)?,
-            oid4vci: oid4vci_posture(config),
-            subject_access: subject_access_posture(
-                &config.subject_access,
-                config.state.storage.as_str(),
-            ),
-        })
-    }
-}
-
-pub(crate) async fn posture_document(
-    state: &RegistryNotaryApiState,
-    tier: PostureTier,
-) -> Result<Value, PostureDocumentError> {
-    let replay_ready = state.replay.check_ready().await;
-    let replay_ready_bool = matches!(replay_ready, Ok(ReplayReadiness::Ready));
-    let credential_status_ready = state.credential_status.check_ready().await.is_ok();
-    let signer_readiness = state.signer_readiness();
-    let signer_ready = signer_readiness.is_ready();
-    let config_apply = state.config_apply_posture();
-    let runtime_config = state.runtime_config();
-    let (deployment_gates, current_audit) = match runtime_config.as_deref() {
-        Some(config) => {
-            let observation = state.current_audit_ack_observation(config).await;
-            (
-                state.deployment_gates_for_observation(config, &observation),
-                Some(audit_posture(
-                    &config.audit,
-                    &config.deployment.evidence,
-                    &observation,
-                )),
-            )
-        }
-        None => ((*state.deployment_gates).clone(), None),
-    };
-    let deployment_ready = !deployment_gates.has_readiness_failure();
-    let readiness =
-        if replay_ready_bool && credential_status_ready && signer_ready && deployment_ready {
-            "ready"
-        } else if matches!(replay_ready, Ok(ReplayReadiness::Degraded))
-            && credential_status_ready
-            && signer_ready
-            && deployment_ready
-        {
-            "degraded"
-        } else {
-            "not_ready"
-        };
-
-    let context = state
-        .posture
-        .as_ref()
-        .map(|context| (**context).clone())
-        .unwrap_or_else(default_posture_context);
-    let audit = current_audit.unwrap_or_else(|| context.audit.clone());
-    let signing_keys = match runtime_config.as_deref() {
-        Some(config) => signing_key_posture(config).map_err(PostureDocumentError::SigningKey)?,
-        None => context.signing_keys.clone(),
-    };
-    let mut warnings = Vec::<String>::new();
-    let mut findings = Vec::new();
-    if production_like(context.instance.environment.as_str())
-        && context.state_storage == STATE_STORAGE_IN_MEMORY
-    {
-        let finding = json!({
-            "id": "notary.state.in_memory.production",
-            "severity": "high",
-            "title": "Production Notary uses in-memory correctness state",
-            "detail": "Multiple instances cannot share correctness decisions.",
-            "evidence": [
-                {
-                    "field": "notary.state.storage",
-                    "value": "in_memory"
-                }
-            ],
-            "standards_refs": [],
-            "recommended_action": "Use PostgreSQL correctness state before enabling production traffic."
-        });
-        warnings.push("notary.state.in_memory.production".to_string());
-        findings.push(finding);
-    }
-    if !context.audit.configured {
-        warnings.push("notary.audit.not_configured".to_string());
-    }
-    if context.oid4vci.pre_authorized_code_enabled && !context.oid4vci.tx_code_required {
-        let finding = json!({
-            "id": "notary.oid4vci.bearer_offer",
-            "severity": "medium",
-            "title": "OID4VCI pre-authorized-code offers run without tx_code",
-            "detail": "A copied offer URI can be redeemed until the pre-authorized code expires.",
-            "evidence": [
-                {
-                    "field": "notary.oid4vci.offer_security_mode",
-                    "value": context.oid4vci.offer_security_mode.as_str()
-                },
-                {
-                    "field": "notary.oid4vci.pre_authorized_code_ttl_seconds",
-                    "value": context.oid4vci.pre_authorized_code_ttl_seconds
-                },
-                {
-                    "field": "notary.oid4vci.max_bearer_pre_authorized_code_ttl_seconds",
-                    "value": MAX_BEARER_PRE_AUTHORIZED_CODE_TTL_SECONDS
-                }
-            ],
-            "standards_refs": [],
-            "recommended_action": "Require tx_code where wallets support it; otherwise keep bearer-offer mode limited to controlled demos."
-        });
-        warnings.push("notary.oid4vci.bearer_offer".to_string());
-        findings.push(finding);
-    }
-
-    let mut instance = Map::new();
-    instance.insert("id".to_string(), json!(context.instance.id));
-    instance.insert(
-        "environment".to_string(),
-        json!(context.instance.environment),
-    );
-    if let Some(owner) = &context.instance.owner {
-        instance.insert("owner".to_string(), json!(owner));
-    }
-    if let Some(jurisdiction) = &context.instance.jurisdiction {
-        instance.insert("jurisdiction".to_string(), json!(jurisdiction));
-    }
-    if let Some(public_base_url) = &context.instance.public_base_url {
-        instance.insert("public_base_url".to_string(), json!(public_base_url));
-    }
-
-    let deployment = deployment_object(&deployment_gates);
-    let audit_assurance = audit_assurance_object(runtime_config.as_deref());
-    let configuration = configuration_object(&config_apply, &context);
-
-    let posture = json!({
-        "schema": "registry.ops.posture.v1",
-        "observed_at": format_time(OffsetDateTime::now_utc()),
-        "component": "registry-notary",
-        "tier": "default",
-        "instance": instance,
-        "build": {
-            "package": "registry-notary",
-            "version": env!("CARGO_PKG_VERSION"),
-        },
-        "runtime": {
-            "auth_mode": context.auth_mode,
-            "auth_methods": context.auth_methods,
-            "admin_enabled": true,
-            "readiness": readiness,
-        },
-        "deployment": deployment,
-        "audit": audit_assurance,
-        "configuration": configuration,
-        "standards_artifacts": standards_artifacts(state),
-        "notary": {
-            "claim_count": state.evidence.claims.len(),
-            "signing_keys": {
-                "active": signing_keys.active,
-                "publish_only": signing_keys.publish_only,
-                "disabled": signing_keys.disabled,
-                "readiness": signing_key_readiness_by_kid(state),
-            },
-            "credential_profile_count": state.evidence.credential_profiles.len(),
-            "state": {
-                "storage": context.state_storage,
-                "ready": replay_ready_bool,
-            },
-            "credential_status": {
-                "enabled": context.credential_status_enabled,
-                "storage": context.credential_status_storage,
-            },
-            "federation": federation_summary(state),
-            "oid4vci": {
-                "enabled": state.oid4vci.enabled,
-                "credential_configuration_count": state.oid4vci.credential_configurations.len(),
-            },
-            "subject_access": {
-                "enabled": context.subject_access.enabled,
-                "allowed_claim_count": context.subject_access.allowed_claim_count,
-                "allowed_purpose_count": context.subject_access.allowed_purpose_count,
-                "credential_profile_count": context.subject_access.credential_profile_count,
-                "wallet_origin_count": context.subject_access.wallet_origin_count,
-                "rate_limit_mode": context.subject_access.rate_limit_mode,
-            },
-        },
-        "posture": {
-            "warnings": warnings,
-            "findings": findings,
-            "audit": audit_posture_object(&audit),
-        },
-    });
-    filter_posture_for_tier(posture, tier).map_err(PostureDocumentError::Filter)
-}
-
-fn audit_posture_object(audit: &AuditPosture) -> Value {
-    json!({
-        "configured": audit.configured,
-        "sink_type": audit.sink,
-        "shipping_target_configured": audit.shipping_target_configured,
-        "shipping_target": audit.shipping_target,
-        "shipping_health": audit.shipping_health,
-        "shipping_observed_at": audit.shipping_observed_at,
-        "checkpoint_status": "unavailable",
-        "latest_tail_hash": Value::Null,
-        "latest_sequence": Value::Null,
-        "verified_at": Value::Null,
-        "verification_status": "not_supported",
-    })
-}
-
-fn configuration_object(config_apply: &ConfigApplyPosture, context: &PostureContext) -> Value {
-    let mut configuration = Map::new();
-    configuration.insert(
-        "source".to_string(),
-        json!(config_apply.source.as_posture_str()),
-    );
-    configuration.insert("dynamic_reload_supported".to_string(), json!(false));
-    configuration.insert(
-        "last_config_hash".to_string(),
-        json!(config_apply
-            .last_config_hash
-            .as_deref()
-            .unwrap_or(context.config_hash.as_str())),
-    );
-    configuration.insert(
-        "last_bundle_id".to_string(),
-        config_apply
-            .last_bundle_id
-            .as_ref()
-            .map_or(Value::Null, |value| json!(value)),
-    );
-    configuration.insert(
-        "last_bundle_sequence".to_string(),
-        config_apply
-            .last_bundle_sequence
-            .map_or(Value::Null, |value| json!(value)),
-    );
-    configuration.insert(
-        "last_bundle_signer_kids".to_string(),
-        json!(config_apply.last_bundle_signer_kids),
-    );
-    configuration.insert(
-        "last_apply_result".to_string(),
-        config_apply
-            .last_apply_result
-            .map_or(Value::Null, |value| json!(value.as_str())),
-    );
-    configuration.insert(
-        "last_apply_at".to_string(),
-        config_apply
-            .last_apply_at
-            .as_ref()
-            .map_or(Value::Null, |value| json!(value)),
-    );
-    configuration.insert(
-        "restart_required".to_string(),
-        json!(config_apply.restart_required),
-    );
-    if let Some(emergency) = &config_apply.emergency {
-        configuration.insert(
-            "emergency".to_string(),
-            emergency_object(config_apply, emergency),
-        );
-    }
-    if let Some(pin) = &config_apply.override_pin {
-        configuration.insert("override".to_string(), override_pin_posture(pin));
-    }
-    Value::Object(configuration)
-}
-
-fn emergency_object(
-    config_apply: &ConfigApplyPosture,
-    emergency: &ConfigEmergencyPosture,
-) -> Value {
-    let now = OffsetDateTime::now_utc().unix_timestamp().max(0) as u64;
-    let open_expiries = emergency
-        .accepted_expires_at_unix_seconds
-        .iter()
-        .copied()
-        .filter(|expires_at| *expires_at > now)
-        .collect::<Vec<_>>();
-    let exception_window_expires_at = open_expiries
-        .iter()
-        .copied()
-        .max()
-        .and_then(unix_seconds_rfc3339);
-    let last_apply_emergency = config_apply
-        .last_bundle_sequence
-        .is_some_and(|sequence| sequence == emergency.last_emergency_sequence);
-
-    json!({
-        "last_apply_emergency": last_apply_emergency,
-        "last_emergency_change_class": emergency.last_emergency_change_class,
-        "last_emergency_at": emergency.last_emergency_at,
-        "exception_window_open": !open_expiries.is_empty(),
-        "exception_window_expires_at": exception_window_expires_at,
-        "open_exception_count": open_expiries.len(),
-    })
-}
-
-fn unix_seconds_rfc3339(seconds: u64) -> Option<String> {
-    OffsetDateTime::from_unix_timestamp(seconds.try_into().ok()?)
-        .ok()?
-        .format(&time::format_description::well_known::Rfc3339)
-        .ok()
-}
-
-fn default_posture_context() -> PostureContext {
-    PostureContext {
-        instance: InstancePosture {
-            id: "registry-notary-standalone".to_string(),
-            environment: "development".to_string(),
-            owner: None,
-            jurisdiction: None,
-            public_base_url: None,
-        },
-        auth_mode: "unknown".to_string(),
-        auth_methods: vec!["unknown".to_string()],
-        config_hash: "sha256:0000000000000000000000000000000000000000000000000000000000000000"
-            .to_string(),
-        state_storage: STATE_STORAGE_IN_MEMORY.to_string(),
-        credential_status_enabled: false,
-        credential_status_storage: "disabled".to_string(),
-        audit: AuditPosture {
-            sink: "unknown".to_string(),
-            configured: false,
-            shipping_target_configured: false,
-            shipping_target: "unknown".to_string(),
-            shipping_health: None,
-            shipping_observed_at: None,
-        },
-        signing_keys: SigningKeyPosture::default(),
-        oid4vci: Oid4vciPosture {
-            pre_authorized_code_enabled: false,
-            pre_authorized_code_ttl_seconds: 0,
-            tx_code_required: true,
-            offer_security_mode: "disabled".to_string(),
-        },
-        subject_access: SubjectAccessPosture {
-            enabled: false,
-            allowed_claim_count: 0,
-            allowed_purpose_count: 0,
-            credential_profile_count: 0,
-            wallet_origin_count: 0,
-            rate_limit_mode: "disabled".to_string(),
-        },
-    }
-}
-
-fn config_hash(config: &StandaloneRegistryNotaryConfig) -> String {
-    let value = serde_json::to_value(config).expect("notary config serializes to JSON");
-    posture_safe_runtime_config_hash(&value)
-}
-
-fn configured_auth_methods(config: &StandaloneRegistryNotaryConfig) -> Vec<String> {
-    let mut methods = Vec::with_capacity(4);
-    if !config.auth.api_keys.is_empty() {
-        methods.push("api_key".to_string());
-    }
-    if !config.auth.bearer_tokens.is_empty() {
-        methods.push("static_bearer".to_string());
-    }
-    if config.auth.oidc.is_some() {
-        methods.push("oidc".to_string());
-    }
-    if config.auth.access_token_signing.enabled {
-        methods.push("notary_access_token".to_string());
-    }
-    methods
-}
-
-fn classify_state_storage(storage: &str) -> String {
-    match storage {
-        STATE_STORAGE_POSTGRESQL => STATE_STORAGE_POSTGRESQL.to_string(),
-        _ => STATE_STORAGE_IN_MEMORY.to_string(),
-    }
-}
-
-fn classify_credential_status_storage(
-    config: &registry_notary_core::CredentialStatusConfig,
-) -> String {
-    if !config.enabled {
-        "disabled".to_string()
-    } else {
-        "state".to_string()
-    }
-}
-
-fn audit_posture(
-    config: &EvidenceAuditConfig,
-    evidence: &DeploymentEvidenceConfig,
-    observation: &AckObservation,
-) -> AuditPosture {
-    // Map the config sink string onto the shared classifier's sink kinds; an
-    // unrecognised sink is explicitly Unknown rather than a silent wildcard.
-    let sink_kind = match config.sink.as_str() {
-        "stdout" => AuditSinkKind::Stdout,
-        "syslog" => AuditSinkKind::Syslog,
-        "file" | "jsonl" => AuditSinkKind::LocalFile,
-        _ => AuditSinkKind::Unknown,
-    };
-    let (shipping_target_configured, shipping_target) =
-        audit_shipping_target(sink_kind, evidence.audit_offhost_shipping);
-    let shipping_health =
-        shipping_target_configured.then(|| observation.health.as_str().to_string());
-    AuditPosture {
-        sink: match config.sink.as_str() {
-            "file" | "jsonl" => "file".to_string(),
-            "syslog" => "syslog".to_string(),
-            "stdout" => "stdout".to_string(),
-            _ => "unknown".to_string(),
-        },
-        configured: config.hash_secret_env.is_some(),
-        shipping_target_configured,
-        shipping_target: shipping_target.to_string(),
-        shipping_health,
-        shipping_observed_at: observation.acked_at.clone(),
-    }
-}
-
-/// Render the operator-declared deployment profile, gate findings, and active
-/// waivers as the posture `deployment` object. The default tier strips waiver
-/// metadata via the allowlist; this object carries it so the restricted tier
-/// can surface the validated reference and optional summary to Trust
-/// Operations.
-fn deployment_object(gates: &DeploymentGateState) -> Value {
-    let mut object = Map::new();
-    if let Some(profile) = gates.profile {
-        object.insert("profile".to_string(), json!(profile));
-    }
-    let findings = gates
-        .findings
-        .iter()
-        .map(|finding| {
-            let mut entry = Map::new();
-            entry.insert("id".to_string(), json!(finding.id));
-            entry.insert("severity".to_string(), json!(finding.severity.as_str()));
-            entry.insert("status".to_string(), json!(finding.status.as_str()));
-            if let Some(waiver) = &finding.waiver {
-                entry.insert("waiver".to_string(), evaluated_waiver_metadata_json(waiver));
-            }
-            Value::Object(entry)
-        })
-        .collect::<Vec<_>>();
-    object.insert("findings".to_string(), Value::Array(findings));
-    let waivers = gates
-        .active_waivers
-        .iter()
-        .map(evaluated_waiver_json)
-        .collect::<Vec<_>>();
-    object.insert("waivers".to_string(), Value::Array(waivers));
-    Value::Object(object)
-}
-
-fn evaluated_waiver_metadata_json(
-    waiver: &registry_notary_core::deployment::EvaluatedWaiver,
-) -> Value {
-    let mut object = Map::new();
-    object.insert("reference".to_string(), json!(waiver.reference));
-    if let Some(summary) = &waiver.summary {
-        object.insert("summary".to_string(), json!(summary));
-    }
-    object.insert("expires".to_string(), json!(waiver.expires));
-    Value::Object(object)
-}
-
-fn evaluated_waiver_json(waiver: &registry_notary_core::deployment::EvaluatedWaiver) -> Value {
-    let mut object = evaluated_waiver_metadata_json(waiver)
-        .as_object()
-        .expect("waiver metadata renders as an object")
-        .clone();
-    object.insert("finding".to_string(), json!(waiver.finding));
-    Value::Object(object)
-}
-
-/// Render the audit assurance object: eight separate facts so "audit exists"
-/// cannot be overclaimed. Protected routes fail closed once a hash secret is
-/// configured; the keyed integrity is HMAC whenever that secret is present.
-fn audit_assurance_object(config: Option<&StandaloneRegistryNotaryConfig>) -> Value {
-    let audit = config.map(|config| &config.audit);
-    let keyed = audit.is_some_and(|audit| audit.hash_secret_env.is_some());
-    let sink_class = match audit.map(|audit| audit.sink.as_str()) {
-        Some("file" | "jsonl") => "file",
-        Some("syslog") => "external",
-        Some("stdout") => "stdout",
-        Some("none") => "none",
-        Some(_) | None => "none",
-    };
-    let durable = matches!(sink_class, "file" | "external");
-    json!({
-        "write_policy": if keyed { "fail_closed_route_families" } else { "availability_first" },
-        "redaction_mode": "redacted",
-        "hash_chain": if keyed { "process_local" } else { "none" },
-        "keyed_integrity": if keyed { "hmac" } else { "none" },
-        "sink_class": sink_class,
-        "retention_owner": if durable { "operator" } else { "unspecified" },
-        "checkpoints": "unsupported",
-        "anchoring": "none",
-    })
-}
-
-fn signing_key_readiness_by_kid(state: &RegistryNotaryApiState) -> BTreeMap<String, String> {
-    state
-        .signer_readiness()
-        .by_kid()
-        .into_iter()
-        .map(|entry| (entry.kid, entry.readiness.as_str().to_string()))
-        .collect()
-}
-
-fn signing_key_posture(
-    config: &StandaloneRegistryNotaryConfig,
-) -> Result<SigningKeyPosture, SigningKeyPostureError> {
-    let now = u64::try_from(OffsetDateTime::now_utc().unix_timestamp()).unwrap_or(0);
-    let mut posture = SigningKeyPosture::default();
-    for (key_id, key) in &config.evidence.signing_keys {
-        project_signing_key_status(
-            key_id,
-            Some(key.status),
-            key.may_publish_at(now),
-            &mut posture,
-        )?;
-    }
-    Ok(posture)
-}
-
-fn project_signing_key_status(
-    key_id: &str,
-    status: Option<SigningKeyStatus>,
-    currently_published: bool,
-    posture: &mut SigningKeyPosture,
-) -> Result<(), SigningKeyPostureError> {
-    match status {
-        Some(SigningKeyStatus::Active) => posture.active.push(key_id.to_string()),
-        Some(SigningKeyStatus::PublishOnly) if currently_published => {
-            posture.publish_only.push(key_id.to_string());
-        }
-        Some(SigningKeyStatus::PublishOnly) => {}
-        Some(SigningKeyStatus::Disabled) => posture.disabled.push(key_id.to_string()),
-        Some(_) | None => {
-            return Err(SigningKeyPostureError::UnknownStatus {
-                key_id: key_id.to_string(),
-            })
-        }
-    }
-    Ok(())
-}
-
-fn oid4vci_posture(config: &StandaloneRegistryNotaryConfig) -> Oid4vciPosture {
-    let preauth = &config.oid4vci.pre_authorized_code;
-    let offer_security_mode = if !config.oid4vci.enabled || !preauth.enabled {
-        "disabled"
-    } else if preauth.tx_code.required {
-        "tx_code"
-    } else {
-        "bearer_offer"
-    };
-    Oid4vciPosture {
-        pre_authorized_code_enabled: config.oid4vci.enabled && preauth.enabled,
-        pre_authorized_code_ttl_seconds: preauth.pre_authorized_code_ttl_seconds,
-        tx_code_required: preauth.tx_code.required,
-        offer_security_mode: offer_security_mode.to_string(),
-    }
-}
-
-fn subject_access_posture(
-    config: &SubjectAccessConfig,
-    state_storage: &str,
-) -> SubjectAccessPosture {
-    SubjectAccessPosture {
-        enabled: config.enabled,
-        allowed_claim_count: config.allowed_claims.len(),
-        allowed_purpose_count: config.allowed_purposes.len(),
-        credential_profile_count: config.credential_profiles.len(),
-        wallet_origin_count: config.allowed_wallet_origins.len(),
-        rate_limit_mode: if config.enabled {
-            classify_state_storage(state_storage)
-        } else {
-            "disabled".to_string()
-        },
-    }
-}
-
-fn federation_summary(state: &RegistryNotaryApiState) -> Value {
-    let allowed_profiles = state
-        .federation
-        .peers
-        .iter()
-        .flat_map(|peer| peer.allowed_profiles.iter().cloned())
-        .collect::<BTreeSet<_>>();
-    let allowed_purposes = state
-        .federation
-        .peers
-        .iter()
-        .flat_map(|peer| peer.allowed_purposes.iter().cloned())
-        .collect::<BTreeSet<_>>();
-    let mut summary = Map::new();
-    summary.insert("enabled".to_string(), json!(state.federation.enabled));
-    if state.federation.enabled {
-        summary.insert("node_id".to_string(), json!(state.federation.node_id));
-    }
-    summary.insert(
-        "peer_count".to_string(),
-        json!(state.federation.peers.len()),
-    );
-    summary.insert(
-        "supported_protocol_versions".to_string(),
-        json!(state.federation.supported_protocol_versions),
-    );
-    summary.insert(
-        "allowed_profile_count".to_string(),
-        json!(allowed_profiles.len()),
-    );
-    summary.insert(
-        "allowed_purpose_count".to_string(),
-        json!(allowed_purposes.len()),
-    );
-    Value::Object(summary)
-}
-
-fn standards_artifacts(state: &RegistryNotaryApiState) -> Value {
-    json!({
-        "evidence_service_discovery": artifact_ref(
-            service_url(&state.evidence.api_base_url, "/.well-known/evidence-service"),
-            "application/json",
-        ),
-        "jwks": artifact_ref(
-            service_url(&state.evidence.api_base_url, "/.well-known/evidence/jwks.json"),
-            "application/json",
-        ),
-        "openapi": artifact_ref(
-            service_url(&state.evidence.api_base_url, "/openapi.json"),
-            "application/json",
-        ),
-        "oid4vci_issuer_metadata": if state.oid4vci.enabled {
-            artifact_ref(
-                service_url(&state.evidence.api_base_url, "/.well-known/openid-credential-issuer"),
-                "application/json",
-            )
-        } else {
-            json!({ "observed_status": "not_configured" })
-        },
-    })
-}
-
-fn artifact_ref(url: Option<String>, media_type: &str) -> Value {
-    match url {
-        Some(url) => json!({
-            "url": url,
-            "media_type": media_type,
-            "observed_status": "configured_not_checked",
-        }),
-        None => json!({ "observed_status": "not_configured" }),
-    }
-}
-
-fn service_url(base_url: &str, path: &str) -> Option<String> {
-    let base = base_url.trim_end_matches('/');
-    if base.starts_with("https://") {
-        Some(format!("{base}{path}"))
-    } else {
-        None
-    }
-}
-
-fn production_like(environment: &str) -> bool {
-    matches!(
-        environment.to_ascii_lowercase().as_str(),
-        "production" | "prod" | "pilot" | "staging" | "production-like"
-    )
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn named_posture_example_audit_matches_live_projection() {
-        let example: Value = serde_json::from_str(registry_platform_ops::NOTARY_POSTURE_EXAMPLE_V1)
-            .expect("named Notary posture example parses");
-        let live = audit_posture_object(&AuditPosture {
-            sink: "file".to_string(),
-            configured: true,
-            shipping_target_configured: true,
-            shipping_target: "declared_external".to_string(),
-            shipping_health: Some("ok".to_string()),
-            shipping_observed_at: Some("2026-06-04T09:59:00Z".to_string()),
-        });
-
-        assert_eq!(example["posture"]["audit"], live);
-    }
-
-    #[test]
-    fn config_hash_is_stable_for_json_object_order() {
-        let left = json!({
-            "b": 1,
-            "a": {
-                "z": true,
-                "y": false
-            },
-            "c": [
-                {
-                    "d": "last",
-                    "a": "first"
-                }
-            ]
-        });
-        let right = json!({
-            "c": [
-                {
-                    "a": "first",
-                    "d": "last"
-                }
-            ],
-            "a": {
-                "y": false,
-                "z": true
-            },
-            "b": 1
-        });
-
-        assert_eq!(
-            posture_safe_runtime_config_hash(&left),
-            posture_safe_runtime_config_hash(&right)
-        );
-    }
-
-    #[test]
-    fn production_like_environment_is_case_insensitive() {
-        assert!(production_like("Production"));
-        assert!(production_like("STAGING"));
-        assert!(production_like("production-like"));
-        assert!(!production_like("development"));
-    }
-
-    #[test]
-    fn unknown_signing_key_status_projection_fails_closed() {
-        let mut posture = SigningKeyPosture::default();
-        // SigningKeyStatus is non_exhaustive, so None is the unit-test stand-in
-        // for a future status variant that this product has not classified yet.
-        let error = project_signing_key_status("future-key", None, true, &mut posture)
-            .expect_err("future signing key status must fail closed");
-
-        assert_eq!(
-            error,
-            SigningKeyPostureError::UnknownStatus {
-                key_id: "future-key".to_string()
-            }
-        );
-        assert!(posture.active.is_empty());
-        assert!(posture.publish_only.is_empty());
-        assert!(posture.disabled.is_empty());
-    }
-}
diff --git a/crates/registry-notary-server/src/preauth_state.rs b/crates/registry-notary-server/src/preauth_state.rs
deleted file mode 100644
index e2646d7ef..000000000
--- a/crates/registry-notary-server/src/preauth_state.rs
+++ /dev/null
@@ -1,2454 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Typed correctness state for the OID4VCI pre-authorized-code flow.
-//!
-//! PostgreSQL mode delegates to the fixed Notary-owned transactions. The
-//! in-memory backend intentionally remains local-only and holds all three
-//! related decisions under one mutex so a successful PIN check, replay claim,
-//! and PIN-verifier removal are atomic within the process.
-
-use std::{
-    collections::HashMap,
-    sync::{Arc, Mutex},
-};
-
-use registry_notary_core::tokens::BoundSubject;
-use registry_platform_replay::ReplayScope;
-use serde::{Deserialize, Serialize};
-use serde_json::Value;
-use subtle::ConstantTimeEq;
-use thiserror::Error;
-use time::{Duration, OffsetDateTime};
-use zeroize::{Zeroize, ZeroizeOnDrop};
-
-use crate::{
-    machine_quota::MachineQuotaOperationFence,
-    replay::{replay_identifier_hash, replay_scope_hash},
-    state_plane::{NotaryStatePlaneHandle, SensitiveStateError, SensitiveStateKeys},
-};
-
-const PREAUTH_LOGIN_STATE_MAX_ENTRIES: usize = 4_096;
-const OID4VCI_ISSUANCE_TRANSACTION_MAX_ENTRIES: usize = 4_096;
-const REGISTRY_CLIENT_OFFER_MAX_ENTRIES: usize = 4_096;
-const EVALUATION_ISSUANCE_MAX_ENTRIES: usize = 4_096;
-const MACHINE_QUOTA_MAX_ENTRIES: usize = 10_000;
-const MACHINE_QUOTA_WINDOW: Duration = Duration::minutes(1);
-const EVALUATION_ISSUANCE_CONTEXT: &[u8] = b"oid4vci-evaluation-issuance";
-
-/// The authority that initiated an immutable issuance transaction.
-///
-/// The registry-client variant is encrypted at rest in PostgreSQL. Its custom
-/// `Debug` implementation deliberately omits the client, target, scopes,
-/// service, and purpose because those values can be identifying.
-#[allow(clippy::large_enum_variant)]
-#[derive(Clone, Default, Serialize, Deserialize)]
-#[serde(tag = "kind", rename_all = "snake_case")]
-pub(crate) enum IssuanceAuthority {
-    #[default]
-    SubjectAccess,
-    RegistryClient {
-        initiating_client_id: String,
-        initiating_client_id_hash: String,
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId,
-        authorized_scopes: Vec<String>,
-        target_ref: registry_notary_core::TargetRefView,
-        service_id: String,
-        purpose: String,
-    },
-}
-
-impl std::fmt::Debug for IssuanceAuthority {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::SubjectAccess => formatter.write_str("SubjectAccess"),
-            Self::RegistryClient {
-                auth_profile_id, ..
-            } => formatter
-                .debug_struct("RegistryClient")
-                .field("auth_profile_id", auth_profile_id)
-                .finish_non_exhaustive(),
-        }
-    }
-}
-
-/// Immutable authority-bearing portion of one registry-backed issuance.
-///
-/// The raw authenticated civil identifier is deliberately absent. The stored
-/// evaluation is retrieved through its secret-keyed client binding, while the
-/// commitment covers only normalized, authority-bearing values.
-#[derive(Clone, Serialize, Deserialize)]
-pub(crate) struct IssuanceTransaction {
-    pub(crate) transaction_id: String,
-    pub(crate) evaluation_id: String,
-    pub(crate) evaluation_client_id: String,
-    pub(crate) credential_configuration_id: String,
-    pub(crate) commitment: String,
-    #[serde(default)]
-    pub(crate) authority: IssuanceAuthority,
-}
-
-#[derive(Clone)]
-pub(crate) struct LiveIssuanceTransaction {
-    pub(crate) transaction: IssuanceTransaction,
-    pub(crate) expires_at: OffsetDateTime,
-}
-
-impl std::fmt::Debug for LiveIssuanceTransaction {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("LiveIssuanceTransaction")
-            .field("transaction", &self.transaction)
-            .field("expires_at", &self.expires_at)
-            .finish()
-    }
-}
-
-impl std::fmt::Debug for IssuanceTransaction {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("IssuanceTransaction")
-            .field("transaction_id", &"[redacted]")
-            .field("evaluation_id", &"[redacted]")
-            .field("evaluation_client_id", &"[redacted]")
-            .field(
-                "credential_configuration_id",
-                &self.credential_configuration_id,
-            )
-            .field("commitment", &self.commitment)
-            .field("authority", &self.authority)
-            .finish()
-    }
-}
-
-/// Exact response cached by the atomic registry-client offer operation.
-#[derive(Clone, PartialEq, Eq, Serialize, Deserialize, Zeroize, ZeroizeOnDrop)]
-#[serde(deny_unknown_fields)]
-pub(crate) struct RegistryClientOfferResponse {
-    pub(crate) credential_offer_uri: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub(crate) tx_code: Option<String>,
-    pub(crate) expires_at: String,
-}
-
-impl std::fmt::Debug for RegistryClientOfferResponse {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("RegistryClientOfferResponse")
-            .field("credential_offer_uri", &"[redacted]")
-            .field("tx_code", &self.tx_code.as_ref().map(|_| "[redacted]"))
-            .field("expires_at", &self.expires_at)
-            .finish()
-    }
-}
-
-/// Optional out-of-band PIN material consumed by an atomic offer reservation.
-///
-/// The plaintext is accepted only at this typed boundary, converted to a keyed
-/// verifier inside the same state transition, and zeroized on drop.
-#[derive(Zeroize, ZeroizeOnDrop)]
-pub(crate) struct RegistryClientTransactionCode {
-    pub(crate) pin: String,
-    pub(crate) pin_length: u64,
-}
-
-impl std::fmt::Debug for RegistryClientTransactionCode {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("RegistryClientTransactionCode")
-            .field("pin", &"[redacted]")
-            .field("pin_length", &self.pin_length)
-            .finish()
-    }
-}
-
-/// Complete input for one registry-client offer reservation.
-///
-/// The idempotency key must already be represented as
-/// `hmac-sha256:<lowercase hex>`. The request hash is the endpoint's canonical
-/// `sha256:<lowercase hex>` request identity. Neither raw value is rendered by
-/// `Debug`.
-pub(crate) struct RegistryClientOfferReservation {
-    pub(crate) transaction_id: String,
-    pub(crate) evaluation_id: String,
-    pub(crate) evaluation_expires_at: OffsetDateTime,
-    pub(crate) idempotency_key_hash: String,
-    pub(crate) canonical_request_hash: String,
-    pub(crate) transaction: IssuanceTransaction,
-    pub(crate) transaction_code: Option<RegistryClientTransactionCode>,
-    pub(crate) code_expires_at: OffsetDateTime,
-    pub(crate) transaction_expires_at: OffsetDateTime,
-    pub(crate) response: RegistryClientOfferResponse,
-    pub(crate) retention_expires_at: OffsetDateTime,
-    pub(crate) quota_principal_hash: Vec<u8>,
-    pub(crate) quota_limit: Option<i32>,
-    pub(crate) quota_cost: i32,
-}
-
-impl std::fmt::Debug for RegistryClientOfferReservation {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("RegistryClientOfferReservation")
-            .field("transaction_id", &"[redacted]")
-            .field("evaluation_id", &"[redacted]")
-            .field("evaluation_expires_at", &self.evaluation_expires_at)
-            .field("idempotency_key_hash", &"[redacted]")
-            .field("canonical_request_hash", &"[redacted]")
-            .field("transaction", &self.transaction)
-            .field("transaction_code", &self.transaction_code)
-            .field("code_expires_at", &self.code_expires_at)
-            .field("transaction_expires_at", &self.transaction_expires_at)
-            .field("response", &self.response)
-            .field("retention_expires_at", &self.retention_expires_at)
-            .field("quota_principal_hash", &"[redacted]")
-            .field("quota_limit", &self.quota_limit)
-            .field("quota_cost", &self.quota_cost)
-            .finish()
-    }
-}
-
-#[derive(Clone, PartialEq, Eq)]
-pub(crate) enum RegistryClientOfferReservationOutcome {
-    Created(RegistryClientOfferResponse),
-    Replayed(RegistryClientOfferResponse),
-}
-
-#[derive(Clone, PartialEq, Eq)]
-pub(crate) enum RegistryClientOfferPreflightOutcome {
-    Available,
-    Replayed(RegistryClientOfferResponse),
-    IdempotencyConflict,
-    EvaluationConsumed,
-}
-
-impl std::fmt::Debug for RegistryClientOfferPreflightOutcome {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Available => formatter.write_str("Available"),
-            Self::Replayed(_) => formatter.write_str("Replayed([redacted])"),
-            Self::IdempotencyConflict => formatter.write_str("IdempotencyConflict"),
-            Self::EvaluationConsumed => formatter.write_str("EvaluationConsumed"),
-        }
-    }
-}
-
-impl std::fmt::Debug for RegistryClientOfferReservationOutcome {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Created(_) => formatter.write_str("Created([redacted])"),
-            Self::Replayed(_) => formatter.write_str("Replayed([redacted])"),
-        }
-    }
-}
-
-#[allow(clippy::large_enum_variant)]
-#[derive(Debug)]
-pub(crate) enum CredentialMaterialization {
-    Acquired(IssuanceTransaction),
-    Cached(Value),
-    Busy,
-    Denied,
-}
-
-#[derive(Clone)]
-enum MaterializationState {
-    Ready,
-    Issuing {
-        holder_thumbprint: String,
-        request_hash: String,
-    },
-    Completed {
-        holder_thumbprint: String,
-        request_hash: String,
-        response: Value,
-    },
-    Failed,
-}
-
-#[derive(Clone)]
-struct StoredIssuanceTransaction {
-    transaction: IssuanceTransaction,
-    nonce: Option<String>,
-    state: MaterializationState,
-}
-
-/// The login state reserved at `offer/start` and consumed exactly once at the
-/// eSignet callback. Secret fields are redacted from `Debug`.
-#[derive(Clone, Zeroize, ZeroizeOnDrop)]
-pub(crate) struct LoginState {
-    pub(crate) pkce_verifier: String,
-    pub(crate) nonce: String,
-    pub(crate) credential_configuration_id: String,
-    pub(crate) representative: Option<AuthenticatedRepresentative>,
-    pub(crate) csrf_token: Option<String>,
-}
-
-impl std::fmt::Debug for LoginState {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("LoginState")
-            .field("pkce_verifier", &"[redacted]")
-            .field("nonce", &"[redacted]")
-            .field(
-                "credential_configuration_id",
-                &self.credential_configuration_id,
-            )
-            .field(
-                "representative",
-                &self.representative.as_ref().map(|_| "[redacted]"),
-            )
-            .field(
-                "csrf_token",
-                &self.csrf_token.as_ref().map(|_| "[redacted]"),
-            )
-            .finish()
-    }
-}
-
-#[derive(Clone, Serialize, Deserialize, Zeroize, ZeroizeOnDrop)]
-pub(crate) struct AuthenticatedRepresentative {
-    subject: String,
-    subject_binding_claim: String,
-    subject_binding_value: String,
-    client_id: String,
-    scopes: Vec<String>,
-    acr: Option<String>,
-    auth_time: Option<i64>,
-}
-
-impl AuthenticatedRepresentative {
-    pub(crate) fn from_bound_subject(subject: BoundSubject) -> Self {
-        Self {
-            subject: subject.subject,
-            subject_binding_claim: subject.subject_binding_claim,
-            subject_binding_value: subject.subject_binding_value,
-            client_id: subject.client_id,
-            scopes: subject.scopes,
-            acr: subject.acr,
-            auth_time: subject.auth_time,
-        }
-    }
-
-    pub(crate) fn into_bound_subject(mut self) -> BoundSubject {
-        BoundSubject {
-            subject: std::mem::take(&mut self.subject),
-            subject_binding_claim: std::mem::take(&mut self.subject_binding_claim),
-            subject_binding_value: std::mem::take(&mut self.subject_binding_value),
-            client_id: std::mem::take(&mut self.client_id),
-            scopes: std::mem::take(&mut self.scopes),
-            acr: std::mem::take(&mut self.acr),
-            auth_time: self.auth_time.take(),
-        }
-    }
-}
-
-impl std::fmt::Debug for AuthenticatedRepresentative {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("AuthenticatedRepresentative")
-            .field("subject", &"[redacted]")
-            .field("subject_binding_claim", &self.subject_binding_claim)
-            .field("subject_binding_value", &"[redacted]")
-            .field("client_id", &self.client_id)
-            .field("scopes", &self.scopes)
-            .field("acr", &self.acr)
-            .field("auth_time", &self.auth_time)
-            .finish()
-    }
-}
-
-/// Opaque proof that a transaction code matched the verifier stored for one
-/// stable JTI hash. It contains no plaintext PIN and is consumed by redemption.
-#[derive(Zeroize, ZeroizeOnDrop)]
-pub(crate) struct VerifiedTransactionCode {
-    jti_hash: [u8; 32],
-    verifier: [u8; 32],
-}
-
-impl VerifiedTransactionCode {
-    pub(crate) fn new(jti_hash: [u8; 32], verifier: [u8; 32]) -> Self {
-        Self { jti_hash, verifier }
-    }
-
-    pub(crate) fn into_verifier_for(mut self, expected_jti_hash: &[u8; 32]) -> Option<[u8; 32]> {
-        if self.jti_hash.ct_eq(expected_jti_hash).unwrap_u8() != 1 {
-            return None;
-        }
-        Some(std::mem::take(&mut self.verifier))
-    }
-}
-
-impl std::fmt::Debug for VerifiedTransactionCode {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("VerifiedTransactionCode")
-            .finish_non_exhaustive()
-    }
-}
-
-/// Stable, value-free failures for the typed preauthorization state API.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
-pub(crate) enum PreauthorizationStateError {
-    #[error("preauthorization login state already exists")]
-    DuplicateLoginState,
-    #[error("issuance transaction already exists")]
-    DuplicateIssuanceTransaction,
-    #[error("preauthorization login-state capacity is exhausted")]
-    LoginStateCapacity,
-    #[error("issuance transaction capacity is exhausted")]
-    IssuanceTransactionCapacity,
-    #[error("preauthorization state is unavailable")]
-    Unavailable,
-    #[error("preauthorization transaction-code proof is incompatible")]
-    IncompatibleTransactionCodeProof,
-    #[error("preauthorization expiry is invalid")]
-    InvalidExpiry,
-    #[error("registry-client offer idempotency key conflicts with its original request")]
-    IdempotencyConflict,
-    #[error("evaluation issuance lineage was already consumed")]
-    EvaluationConsumed,
-    #[error("registry-client offer quota was exhausted")]
-    MachineQuotaExceeded { retry_after_seconds: u64 },
-    #[error("registry-client offer operation lease is no longer owned")]
-    OperationLeaseLost,
-    #[error(transparent)]
-    SensitiveState(#[from] SensitiveStateError),
-}
-
-/// Implementer-facing preauthorization state contract. Callers select the
-/// backend once during runtime compilation and cannot issue arbitrary storage
-/// operations.
-pub(crate) struct PreauthorizationState {
-    backend: PreauthorizationBackend,
-}
-
-enum PreauthorizationBackend {
-    InMemory(Arc<InMemoryPreauthorizationState>),
-    Postgresql(Arc<NotaryStatePlaneHandle>),
-}
-
-impl PreauthorizationState {
-    pub(crate) fn from_state_plane(
-        state_plane: Arc<NotaryStatePlaneHandle>,
-    ) -> Result<Self, PreauthorizationStateError> {
-        let backend = if state_plane.is_in_memory() {
-            PreauthorizationBackend::InMemory(Arc::new(InMemoryPreauthorizationState::new()?))
-        } else {
-            PreauthorizationBackend::Postgresql(state_plane)
-        };
-        Ok(Self { backend })
-    }
-
-    pub(crate) async fn reserve_issuance_transaction(
-        &self,
-        transaction_id: &str,
-        transaction: IssuanceTransaction,
-        expires_at: OffsetDateTime,
-    ) -> Result<(), PreauthorizationStateError> {
-        if let PreauthorizationBackend::Postgresql(handle) = &self.backend {
-            use crate::state_plane::IssuanceReserveOutcome;
-            return match handle
-                .sensitive_state()?
-                .reserve_issuance_transaction(transaction_id, &transaction, expires_at)
-                .await?
-            {
-                IssuanceReserveOutcome::Reserved => Ok(()),
-                IssuanceReserveOutcome::Duplicate => {
-                    Err(PreauthorizationStateError::DuplicateIssuanceTransaction)
-                }
-                IssuanceReserveOutcome::Capacity => {
-                    Err(PreauthorizationStateError::IssuanceTransactionCapacity)
-                }
-            };
-        }
-        let PreauthorizationBackend::InMemory(state) = &self.backend else {
-            unreachable!("PostgreSQL issuance reservation returned above");
-        };
-        state.reserve_issuance_transaction(transaction_id, transaction, expires_at)
-    }
-
-    /// Atomically reserve the immutable transaction, optional transaction-code
-    /// verifier, evaluation consumption, and exact response for a
-    /// registry-client initiated offer.
-    #[cfg(test)]
-    pub(crate) async fn reserve_registry_client_offer(
-        &self,
-        reservation: RegistryClientOfferReservation,
-    ) -> Result<RegistryClientOfferReservationOutcome, PreauthorizationStateError> {
-        match &self.backend {
-            PreauthorizationBackend::InMemory(state) => {
-                state.reserve_registry_client_offer(reservation)
-            }
-            PreauthorizationBackend::Postgresql(handle) => {
-                handle
-                    .sensitive_state()?
-                    .reserve_registry_client_offer(reservation)
-                    .await
-            }
-        }
-    }
-
-    /// Finalize an offer only while the caller still owns the quota-operation
-    /// lease. In-memory mode holds the operation mutex through the synchronous
-    /// reservation; PostgreSQL verifies and locks the same owner token inside
-    /// the authoritative reservation transaction.
-    pub(crate) async fn reserve_registry_client_offer_fenced(
-        &self,
-        reservation: RegistryClientOfferReservation,
-        fence: &MachineQuotaOperationFence,
-    ) -> Result<RegistryClientOfferReservationOutcome, PreauthorizationStateError> {
-        match &self.backend {
-            PreauthorizationBackend::InMemory(state) => fence
-                .complete_in_memory(|| state.reserve_registry_client_offer(reservation))
-                .map_err(|()| PreauthorizationStateError::OperationLeaseLost)?,
-            PreauthorizationBackend::Postgresql(handle) => {
-                handle
-                    .sensitive_state()?
-                    .reserve_registry_client_offer_fenced(reservation, fence)
-                    .await
-            }
-        }
-    }
-
-    /// Read-only fast path for exact replay/conflict and consumed-evaluation
-    /// decisions. The final reservation remains authoritative for races.
-    pub(crate) async fn registry_client_offer_preflight(
-        &self,
-        evaluation_id: &str,
-        evaluation_client_id: &str,
-        idempotency_key_hash: &str,
-        canonical_request_hash: &str,
-    ) -> Result<RegistryClientOfferPreflightOutcome, PreauthorizationStateError> {
-        match &self.backend {
-            PreauthorizationBackend::InMemory(state) => state.registry_client_offer_preflight(
-                evaluation_id,
-                evaluation_client_id,
-                idempotency_key_hash,
-                canonical_request_hash,
-            ),
-            PreauthorizationBackend::Postgresql(handle) => {
-                handle
-                    .sensitive_state()?
-                    .registry_client_offer_preflight(
-                        evaluation_id,
-                        evaluation_client_id,
-                        idempotency_key_hash,
-                        canonical_request_hash,
-                    )
-                    .await
-            }
-        }
-    }
-
-    /// Terminally consume one evaluation lineage before direct issuance side
-    /// effects. Registry-client offer creation uses the same ledger, so only
-    /// one path can win for an evaluation and its owning client.
-    pub(crate) async fn reserve_evaluation_issuance(
-        &self,
-        evaluation_id: &str,
-        evaluation_client_id: &str,
-        evaluation_expires_at: OffsetDateTime,
-    ) -> Result<(), PreauthorizationStateError> {
-        match &self.backend {
-            PreauthorizationBackend::InMemory(state) => state.reserve_evaluation_issuance(
-                evaluation_id,
-                evaluation_client_id,
-                evaluation_expires_at,
-            ),
-            PreauthorizationBackend::Postgresql(handle) => {
-                handle
-                    .sensitive_state()?
-                    .reserve_evaluation_issuance(
-                        evaluation_id,
-                        evaluation_client_id,
-                        evaluation_expires_at,
-                    )
-                    .await
-            }
-        }
-    }
-
-    pub(crate) async fn transaction(
-        &self,
-        transaction_id: &str,
-    ) -> Result<Option<LiveIssuanceTransaction>, PreauthorizationStateError> {
-        if let PreauthorizationBackend::Postgresql(handle) = &self.backend {
-            return Ok(handle
-                .sensitive_state()?
-                .issuance_transaction(transaction_id)
-                .await?);
-        }
-        let PreauthorizationBackend::InMemory(state) = &self.backend else {
-            unreachable!("PostgreSQL issuance lookup returned above");
-        };
-        state.transaction(transaction_id)
-    }
-
-    pub(crate) async fn bind_transaction_nonce(
-        &self,
-        transaction_id: &str,
-        commitment: &str,
-        nonce: String,
-    ) -> Result<bool, PreauthorizationStateError> {
-        if let PreauthorizationBackend::Postgresql(handle) = &self.backend {
-            return Ok(handle
-                .sensitive_state()?
-                .bind_issuance_nonce(transaction_id, commitment, &nonce)
-                .await?);
-        }
-        let PreauthorizationBackend::InMemory(state) = &self.backend else {
-            unreachable!("PostgreSQL nonce binding returned above");
-        };
-        state.bind_transaction_nonce(transaction_id, commitment, nonce)
-    }
-
-    pub(crate) async fn begin_credential_materialization(
-        &self,
-        transaction_id: &str,
-        commitment: &str,
-        configuration_id: &str,
-        nonce: &str,
-        holder_thumbprint: &str,
-        request_hash: &str,
-    ) -> Result<CredentialMaterialization, PreauthorizationStateError> {
-        if let PreauthorizationBackend::Postgresql(handle) = &self.backend {
-            return Ok(handle
-                .sensitive_state()?
-                .begin_issuance_materialization(
-                    transaction_id,
-                    commitment,
-                    configuration_id,
-                    nonce,
-                    holder_thumbprint,
-                    request_hash,
-                )
-                .await?);
-        }
-        let PreauthorizationBackend::InMemory(state) = &self.backend else {
-            unreachable!("PostgreSQL materialization begin returned above");
-        };
-        state.begin_credential_materialization(
-            transaction_id,
-            commitment,
-            configuration_id,
-            nonce,
-            holder_thumbprint,
-            request_hash,
-        )
-    }
-
-    pub(crate) async fn complete_credential_materialization(
-        &self,
-        transaction_id: &str,
-        holder_thumbprint: &str,
-        request_hash: &str,
-        response: Value,
-    ) -> Result<bool, PreauthorizationStateError> {
-        if let PreauthorizationBackend::Postgresql(handle) = &self.backend {
-            return Ok(handle
-                .sensitive_state()?
-                .complete_issuance_materialization(
-                    transaction_id,
-                    holder_thumbprint,
-                    request_hash,
-                    &response,
-                )
-                .await?);
-        }
-        let PreauthorizationBackend::InMemory(state) = &self.backend else {
-            unreachable!("PostgreSQL materialization completion returned above");
-        };
-        state.complete_credential_materialization(
-            transaction_id,
-            holder_thumbprint,
-            request_hash,
-            response,
-        )
-    }
-
-    pub(crate) async fn fail_credential_materialization(
-        &self,
-        transaction_id: &str,
-        holder_thumbprint: &str,
-    ) -> Result<(), PreauthorizationStateError> {
-        if let PreauthorizationBackend::Postgresql(handle) = &self.backend {
-            return Ok(handle
-                .sensitive_state()?
-                .fail_issuance_materialization(transaction_id, holder_thumbprint)
-                .await?);
-        }
-        let PreauthorizationBackend::InMemory(state) = &self.backend else {
-            unreachable!("PostgreSQL materialization failure returned above");
-        };
-        state.fail_credential_materialization(transaction_id, holder_thumbprint)
-    }
-
-    pub(crate) async fn reserve_login(
-        &self,
-        opaque_state: &str,
-        login: LoginState,
-        ttl_seconds: u64,
-    ) -> Result<(), PreauthorizationStateError> {
-        let expires_at = expiry_after(ttl_seconds)?;
-        match &self.backend {
-            PreauthorizationBackend::InMemory(state) => {
-                state.reserve_login(opaque_state, login, expires_at)
-            }
-            PreauthorizationBackend::Postgresql(handle) => {
-                use crate::state_plane::LoginReserveOutcome;
-                match handle
-                    .sensitive_state()?
-                    .reserve_login(opaque_state, &login, expires_at)
-                    .await?
-                {
-                    LoginReserveOutcome::Reserved => Ok(()),
-                    LoginReserveOutcome::Duplicate => {
-                        Err(PreauthorizationStateError::DuplicateLoginState)
-                    }
-                    LoginReserveOutcome::Capacity => {
-                        Err(PreauthorizationStateError::LoginStateCapacity)
-                    }
-                }
-            }
-        }
-    }
-
-    pub(crate) async fn consume_login(
-        &self,
-        opaque_state: &str,
-    ) -> Result<Option<LoginState>, PreauthorizationStateError> {
-        match &self.backend {
-            PreauthorizationBackend::InMemory(state) => state.consume_login(opaque_state),
-            PreauthorizationBackend::Postgresql(handle) => Ok(handle
-                .sensitive_state()?
-                .consume_login(opaque_state)
-                .await?),
-        }
-    }
-
-    pub(crate) async fn reserve_transaction_code(
-        &self,
-        jti: &str,
-        pin: &str,
-        pin_length: u64,
-        expires_at: OffsetDateTime,
-    ) -> Result<bool, PreauthorizationStateError> {
-        match &self.backend {
-            PreauthorizationBackend::InMemory(state) => {
-                state.reserve_transaction_code(jti, pin, pin_length, expires_at)
-            }
-            PreauthorizationBackend::Postgresql(handle) => Ok(handle
-                .sensitive_state()?
-                .reserve_transaction_code(jti, pin, pin_length, expires_at)
-                .await?),
-        }
-    }
-
-    /// Verify a PIN without mutation. `Ok(None)` means the PIN was wrong or
-    /// the offer is absent/expired, and therefore does not burn a valid offer.
-    pub(crate) async fn verify_transaction_code(
-        &self,
-        jti: &str,
-        presented_pin: &str,
-    ) -> Result<Option<VerifiedTransactionCode>, PreauthorizationStateError> {
-        match &self.backend {
-            PreauthorizationBackend::InMemory(state) => {
-                state.verify_transaction_code(jti, presented_pin)
-            }
-            PreauthorizationBackend::Postgresql(handle) => Ok(handle
-                .sensitive_state()?
-                .verify_transaction_code(jti, presented_pin)
-                .await?),
-        }
-    }
-
-    /// Atomically claim the code JTI and, when required by the signed code,
-    /// validate and remove the corresponding transaction-code verifier.
-    pub(crate) async fn redeem(
-        &self,
-        scope: &ReplayScope,
-        jti: &str,
-        expires_at: OffsetDateTime,
-        transaction_code_required: bool,
-        proof: Option<VerifiedTransactionCode>,
-    ) -> Result<bool, PreauthorizationStateError> {
-        if transaction_code_required != proof.is_some() {
-            return Err(PreauthorizationStateError::IncompatibleTransactionCodeProof);
-        }
-        match &self.backend {
-            PreauthorizationBackend::InMemory(state) => {
-                state.redeem(scope, jti, expires_at, transaction_code_required, proof)
-            }
-            PreauthorizationBackend::Postgresql(handle) => {
-                let sensitive = handle.sensitive_state()?;
-                // Issuance reserves before exposing the signed code, and no
-                // typed path adds a verifier for an existing code afterward.
-                // A concurrent successful redemption can only remove this row;
-                // the atomic replay claim below still makes that request lose.
-                if !transaction_code_required && sensitive.has_live_transaction_code(jti).await? {
-                    return Ok(false);
-                }
-                Ok(sensitive.redeem(scope, jti, expires_at, proof).await?)
-            }
-        }
-    }
-}
-
-impl std::fmt::Debug for PreauthorizationState {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("PreauthorizationState")
-            .field(
-                "backend",
-                &match self.backend {
-                    PreauthorizationBackend::InMemory(_) => "in_memory_local_only",
-                    PreauthorizationBackend::Postgresql(_) => "postgresql",
-                },
-            )
-            .finish()
-    }
-}
-
-struct InMemoryPreauthorizationState {
-    keys: SensitiveStateKeys,
-    records: Mutex<InMemoryRecords>,
-}
-
-#[derive(Default)]
-struct InMemoryRecords {
-    login: HashMap<[u8; 32], Stored<LoginState>>,
-    transaction_codes: HashMap<[u8; 32], Stored<TransactionCodeVerifier>>,
-    redeemed: HashMap<([u8; 32], [u8; 32]), OffsetDateTime>,
-    issuance: HashMap<[u8; 32], Stored<StoredIssuanceTransaction>>,
-    registry_client_offers: HashMap<[u8; 32], StoredRegistryClientOffer>,
-    consumed_evaluations: HashMap<[u8; 32], OffsetDateTime>,
-    machine_quota: HashMap<[u8; 32], StoredMachineQuota>,
-}
-
-struct StoredRegistryClientOffer {
-    request_hash: [u8; 32],
-    response: RegistryClientOfferResponse,
-    retention_expires_at: OffsetDateTime,
-    purge_after: OffsetDateTime,
-}
-
-struct StoredMachineQuota {
-    window_expires_at: OffsetDateTime,
-    used: i32,
-}
-
-struct Stored<V> {
-    value: V,
-    expires_at: OffsetDateTime,
-}
-
-#[derive(Zeroize, ZeroizeOnDrop)]
-struct TransactionCodeVerifier {
-    verifier: [u8; 32],
-    pin_length: usize,
-}
-
-impl InMemoryPreauthorizationState {
-    fn new() -> Result<Self, PreauthorizationStateError> {
-        Ok(Self {
-            keys: SensitiveStateKeys::random()?,
-            records: Mutex::new(InMemoryRecords::default()),
-        })
-    }
-
-    fn reserve_issuance_transaction(
-        &self,
-        transaction_id: &str,
-        transaction: IssuanceTransaction,
-        expires_at: OffsetDateTime,
-    ) -> Result<(), PreauthorizationStateError> {
-        let now = OffsetDateTime::now_utc();
-        if expires_at <= now {
-            return Err(PreauthorizationStateError::InvalidExpiry);
-        }
-        let key = replay_identifier_hash(transaction_id);
-        let mut records = self.lock_records()?;
-        records.issuance.retain(|_, record| record.expires_at > now);
-        if records.issuance.contains_key(&key) {
-            return Err(PreauthorizationStateError::DuplicateIssuanceTransaction);
-        }
-        if records.issuance.len() >= OID4VCI_ISSUANCE_TRANSACTION_MAX_ENTRIES {
-            return Err(PreauthorizationStateError::IssuanceTransactionCapacity);
-        }
-        records.issuance.insert(
-            key,
-            Stored {
-                value: StoredIssuanceTransaction {
-                    transaction,
-                    nonce: None,
-                    state: MaterializationState::Ready,
-                },
-                expires_at,
-            },
-        );
-        Ok(())
-    }
-
-    fn reserve_registry_client_offer(
-        &self,
-        reservation: RegistryClientOfferReservation,
-    ) -> Result<RegistryClientOfferReservationOutcome, PreauthorizationStateError> {
-        validate_registry_client_offer_structure(&reservation)?;
-        let idempotency_hash = decode_hash_uri(&reservation.idempotency_key_hash, "hmac-sha256:")?;
-        let request_hash = decode_hash_uri(&reservation.canonical_request_hash, "sha256:")?;
-        let evaluation_hash = self.evaluation_issuance_hash(
-            &reservation.evaluation_id,
-            &reservation.transaction.evaluation_client_id,
-        );
-        let transaction_hash = replay_identifier_hash(&reservation.transaction_id);
-        let now = OffsetDateTime::now_utc();
-        let mut records = self.lock_records()?;
-        prune_offer_records(&mut records, now);
-
-        if let Some(stored) = records.registry_client_offers.get(&idempotency_hash) {
-            if stored.request_hash != request_hash {
-                return Err(PreauthorizationStateError::IdempotencyConflict);
-            }
-            if stored.retention_expires_at > now {
-                return Ok(RegistryClientOfferReservationOutcome::Replayed(
-                    stored.response.clone(),
-                ));
-            }
-            return Err(PreauthorizationStateError::EvaluationConsumed);
-        }
-
-        validate_registry_client_offer_reservation(&reservation, now)?;
-        if records.consumed_evaluations.contains_key(&evaluation_hash) {
-            return Err(PreauthorizationStateError::EvaluationConsumed);
-        }
-        if records.issuance.contains_key(&transaction_hash)
-            || records.transaction_codes.contains_key(&transaction_hash)
-        {
-            return Err(PreauthorizationStateError::DuplicateIssuanceTransaction);
-        }
-        if records.issuance.len() >= OID4VCI_ISSUANCE_TRANSACTION_MAX_ENTRIES
-            || records.registry_client_offers.len() >= REGISTRY_CLIENT_OFFER_MAX_ENTRIES
-            || records.consumed_evaluations.len() >= EVALUATION_ISSUANCE_MAX_ENTRIES
-        {
-            return Err(PreauthorizationStateError::IssuanceTransactionCapacity);
-        }
-        let transaction_code = reservation
-            .transaction_code
-            .as_ref()
-            .map(|code| {
-                let pin_length = usize::try_from(code.pin_length)
-                    .map_err(|_| PreauthorizationStateError::Unavailable)?;
-                Ok::<TransactionCodeVerifier, PreauthorizationStateError>(TransactionCodeVerifier {
-                    verifier: self.keys.pin_verifier(&transaction_hash, &code.pin),
-                    pin_length,
-                })
-            })
-            .transpose()?;
-        reserve_offer_quota(&mut records, &reservation, now)?;
-        let response = reservation.response.clone();
-        let purge_after = std::cmp::max(
-            reservation.evaluation_expires_at,
-            reservation.retention_expires_at,
-        );
-
-        records.issuance.insert(
-            transaction_hash,
-            Stored {
-                value: StoredIssuanceTransaction {
-                    transaction: reservation.transaction,
-                    nonce: None,
-                    state: MaterializationState::Ready,
-                },
-                expires_at: reservation.transaction_expires_at,
-            },
-        );
-        if let Some(verifier) = transaction_code {
-            records.transaction_codes.insert(
-                transaction_hash,
-                Stored {
-                    value: verifier,
-                    expires_at: reservation.code_expires_at,
-                },
-            );
-        }
-        records
-            .consumed_evaluations
-            .insert(evaluation_hash, reservation.evaluation_expires_at);
-        records.registry_client_offers.insert(
-            idempotency_hash,
-            StoredRegistryClientOffer {
-                request_hash,
-                response: reservation.response,
-                retention_expires_at: reservation.retention_expires_at,
-                purge_after,
-            },
-        );
-        Ok(RegistryClientOfferReservationOutcome::Created(response))
-    }
-
-    fn registry_client_offer_preflight(
-        &self,
-        evaluation_id: &str,
-        evaluation_client_id: &str,
-        idempotency_key_hash: &str,
-        canonical_request_hash: &str,
-    ) -> Result<RegistryClientOfferPreflightOutcome, PreauthorizationStateError> {
-        if evaluation_id.is_empty() || evaluation_client_id.is_empty() {
-            return Err(PreauthorizationStateError::Unavailable);
-        }
-        let idempotency_hash = decode_hash_uri(idempotency_key_hash, "hmac-sha256:")?;
-        let request_hash = decode_hash_uri(canonical_request_hash, "sha256:")?;
-        let evaluation_hash = self.evaluation_issuance_hash(evaluation_id, evaluation_client_id);
-        let now = OffsetDateTime::now_utc();
-        let records = self.lock_records()?;
-        if let Some(stored) = records
-            .registry_client_offers
-            .get(&idempotency_hash)
-            .filter(|stored| stored.purge_after > now)
-        {
-            if stored.request_hash != request_hash {
-                return Ok(RegistryClientOfferPreflightOutcome::IdempotencyConflict);
-            }
-            if stored.retention_expires_at > now {
-                return Ok(RegistryClientOfferPreflightOutcome::Replayed(
-                    stored.response.clone(),
-                ));
-            }
-            return Ok(RegistryClientOfferPreflightOutcome::EvaluationConsumed);
-        }
-        if records
-            .consumed_evaluations
-            .get(&evaluation_hash)
-            .is_some_and(|expires_at| *expires_at > now)
-        {
-            return Ok(RegistryClientOfferPreflightOutcome::EvaluationConsumed);
-        }
-        Ok(RegistryClientOfferPreflightOutcome::Available)
-    }
-
-    fn reserve_evaluation_issuance(
-        &self,
-        evaluation_id: &str,
-        evaluation_client_id: &str,
-        evaluation_expires_at: OffsetDateTime,
-    ) -> Result<(), PreauthorizationStateError> {
-        let now = OffsetDateTime::now_utc();
-        if evaluation_id.is_empty() || evaluation_client_id.is_empty() {
-            return Err(PreauthorizationStateError::Unavailable);
-        }
-        if evaluation_expires_at <= now {
-            return Err(PreauthorizationStateError::InvalidExpiry);
-        }
-        let evaluation_hash = self.evaluation_issuance_hash(evaluation_id, evaluation_client_id);
-        let mut records = self.lock_records()?;
-        prune_offer_records(&mut records, now);
-        if records.consumed_evaluations.contains_key(&evaluation_hash) {
-            return Err(PreauthorizationStateError::EvaluationConsumed);
-        }
-        if records.consumed_evaluations.len() >= EVALUATION_ISSUANCE_MAX_ENTRIES {
-            return Err(PreauthorizationStateError::IssuanceTransactionCapacity);
-        }
-        records
-            .consumed_evaluations
-            .insert(evaluation_hash, evaluation_expires_at);
-        Ok(())
-    }
-
-    fn evaluation_issuance_hash(
-        &self,
-        evaluation_id: &str,
-        evaluation_client_id: &str,
-    ) -> [u8; 32] {
-        self.keys.identifier_hash_fields(
-            EVALUATION_ISSUANCE_CONTEXT,
-            &[evaluation_id.as_bytes(), evaluation_client_id.as_bytes()],
-        )
-    }
-
-    fn transaction(
-        &self,
-        transaction_id: &str,
-    ) -> Result<Option<LiveIssuanceTransaction>, PreauthorizationStateError> {
-        let now = OffsetDateTime::now_utc();
-        let key = replay_identifier_hash(transaction_id);
-        let mut records = self.lock_records()?;
-        records.issuance.retain(|_, record| record.expires_at > now);
-        Ok(records
-            .issuance
-            .get(&key)
-            .map(|record| LiveIssuanceTransaction {
-                transaction: record.value.transaction.clone(),
-                expires_at: record.expires_at,
-            }))
-    }
-
-    fn bind_transaction_nonce(
-        &self,
-        transaction_id: &str,
-        commitment: &str,
-        nonce: String,
-    ) -> Result<bool, PreauthorizationStateError> {
-        let now = OffsetDateTime::now_utc();
-        let key = replay_identifier_hash(transaction_id);
-        let mut records = self.lock_records()?;
-        records.issuance.retain(|_, record| record.expires_at > now);
-        let Some(record) = records.issuance.get_mut(&key) else {
-            return Ok(false);
-        };
-        if record.value.transaction.commitment != commitment || record.value.nonce.is_some() {
-            return Ok(false);
-        }
-        record.value.nonce = Some(nonce);
-        Ok(true)
-    }
-
-    fn begin_credential_materialization(
-        &self,
-        transaction_id: &str,
-        commitment: &str,
-        configuration_id: &str,
-        nonce: &str,
-        holder_thumbprint: &str,
-        request_hash: &str,
-    ) -> Result<CredentialMaterialization, PreauthorizationStateError> {
-        let now = OffsetDateTime::now_utc();
-        let key = replay_identifier_hash(transaction_id);
-        let mut records = self.lock_records()?;
-        records.issuance.retain(|_, record| record.expires_at > now);
-        let Some(record) = records.issuance.get_mut(&key) else {
-            return Ok(CredentialMaterialization::Denied);
-        };
-        let transaction = &record.value.transaction;
-        if transaction.commitment != commitment
-            || transaction.credential_configuration_id != configuration_id
-            || record.value.nonce.as_deref() != Some(nonce)
-        {
-            return Ok(CredentialMaterialization::Denied);
-        }
-        match &record.value.state {
-            MaterializationState::Ready => {
-                let transaction = transaction.clone();
-                record.value.state = MaterializationState::Issuing {
-                    holder_thumbprint: holder_thumbprint.to_string(),
-                    request_hash: request_hash.to_string(),
-                };
-                Ok(CredentialMaterialization::Acquired(transaction))
-            }
-            MaterializationState::Issuing {
-                holder_thumbprint: bound,
-                request_hash: bound_request,
-            } if bound == holder_thumbprint && bound_request == request_hash => {
-                Ok(CredentialMaterialization::Busy)
-            }
-            MaterializationState::Completed {
-                holder_thumbprint: bound,
-                request_hash: bound_request,
-                response,
-            } if bound == holder_thumbprint && bound_request == request_hash => {
-                Ok(CredentialMaterialization::Cached(response.clone()))
-            }
-            MaterializationState::Issuing { .. }
-            | MaterializationState::Completed { .. }
-            | MaterializationState::Failed => Ok(CredentialMaterialization::Denied),
-        }
-    }
-
-    fn complete_credential_materialization(
-        &self,
-        transaction_id: &str,
-        holder_thumbprint: &str,
-        request_hash: &str,
-        response: Value,
-    ) -> Result<bool, PreauthorizationStateError> {
-        let now = OffsetDateTime::now_utc();
-        let key = replay_identifier_hash(transaction_id);
-        let mut records = self.lock_records()?;
-        // Match the PostgreSQL completion function: signer or status-store
-        // work that crosses the transaction expiry must not commit a
-        // wallet-visible credential response.
-        records.issuance.retain(|_, record| record.expires_at > now);
-        let Some(record) = records.issuance.get_mut(&key) else {
-            return Ok(false);
-        };
-        match &record.value.state {
-            MaterializationState::Issuing {
-                holder_thumbprint: bound,
-                request_hash: bound_request,
-            } if bound == holder_thumbprint && bound_request == request_hash => {
-                record.value.state = MaterializationState::Completed {
-                    holder_thumbprint: holder_thumbprint.to_string(),
-                    request_hash: request_hash.to_string(),
-                    response,
-                };
-                Ok(true)
-            }
-            _ => Ok(false),
-        }
-    }
-
-    fn fail_credential_materialization(
-        &self,
-        transaction_id: &str,
-        holder_thumbprint: &str,
-    ) -> Result<(), PreauthorizationStateError> {
-        let key = replay_identifier_hash(transaction_id);
-        let mut records = self.lock_records()?;
-        if let Some(record) = records.issuance.get_mut(&key) {
-            if matches!(
-                &record.value.state,
-                MaterializationState::Issuing { holder_thumbprint: bound, .. } if bound == holder_thumbprint
-            ) {
-                record.value.state = MaterializationState::Failed;
-            }
-        }
-        Ok(())
-    }
-
-    fn reserve_login(
-        &self,
-        opaque_state: &str,
-        login: LoginState,
-        expires_at: OffsetDateTime,
-    ) -> Result<(), PreauthorizationStateError> {
-        let now = OffsetDateTime::now_utc();
-        let mut records = self.lock_records()?;
-        records.login.retain(|_, stored| stored.expires_at > now);
-        let state_hash = self.keys.login_state_hash(opaque_state);
-        if records.login.contains_key(&state_hash) {
-            return Err(PreauthorizationStateError::DuplicateLoginState);
-        }
-        if records.login.len() >= PREAUTH_LOGIN_STATE_MAX_ENTRIES {
-            return Err(PreauthorizationStateError::LoginStateCapacity);
-        }
-        records.login.insert(
-            state_hash,
-            Stored {
-                value: login,
-                expires_at,
-            },
-        );
-        Ok(())
-    }
-
-    fn consume_login(
-        &self,
-        opaque_state: &str,
-    ) -> Result<Option<LoginState>, PreauthorizationStateError> {
-        let now = OffsetDateTime::now_utc();
-        let state_hash = self.keys.login_state_hash(opaque_state);
-        let mut records = self.lock_records()?;
-        let Some(stored) = records.login.remove(&state_hash) else {
-            return Ok(None);
-        };
-        Ok((stored.expires_at > now).then_some(stored.value))
-    }
-
-    fn reserve_transaction_code(
-        &self,
-        jti: &str,
-        pin: &str,
-        pin_length: u64,
-        expires_at: OffsetDateTime,
-    ) -> Result<bool, PreauthorizationStateError> {
-        let now = OffsetDateTime::now_utc();
-        if expires_at <= now {
-            return Err(PreauthorizationStateError::InvalidExpiry);
-        }
-        let pin_length =
-            usize::try_from(pin_length).map_err(|_| PreauthorizationStateError::Unavailable)?;
-        let jti_hash = replay_identifier_hash(jti);
-        let verifier = self.keys.pin_verifier(&jti_hash, pin);
-        let mut records = self.lock_records()?;
-        records
-            .transaction_codes
-            .retain(|_, stored| stored.expires_at > now);
-        if records.transaction_codes.contains_key(&jti_hash) {
-            return Ok(false);
-        }
-        records.transaction_codes.insert(
-            jti_hash,
-            Stored {
-                value: TransactionCodeVerifier {
-                    verifier,
-                    pin_length,
-                },
-                expires_at,
-            },
-        );
-        Ok(true)
-    }
-
-    fn verify_transaction_code(
-        &self,
-        jti: &str,
-        presented_pin: &str,
-    ) -> Result<Option<VerifiedTransactionCode>, PreauthorizationStateError> {
-        let now = OffsetDateTime::now_utc();
-        let jti_hash = replay_identifier_hash(jti);
-        let records = self.lock_records()?;
-        let Some(stored) = records.transaction_codes.get(&jti_hash) else {
-            return Ok(None);
-        };
-        if stored.expires_at <= now || stored.value.pin_length != presented_pin.len() {
-            return Ok(None);
-        }
-        let expected = self.keys.pin_verifier(&jti_hash, presented_pin);
-        if expected.ct_eq(&stored.value.verifier).unwrap_u8() != 1 {
-            return Ok(None);
-        }
-        Ok(Some(VerifiedTransactionCode::new(jti_hash, expected)))
-    }
-
-    fn redeem(
-        &self,
-        scope: &ReplayScope,
-        jti: &str,
-        expires_at: OffsetDateTime,
-        transaction_code_required: bool,
-        proof: Option<VerifiedTransactionCode>,
-    ) -> Result<bool, PreauthorizationStateError> {
-        let now = OffsetDateTime::now_utc();
-        if expires_at <= now {
-            return Ok(false);
-        }
-        let scope_hash = replay_scope_hash(scope);
-        let jti_hash = replay_identifier_hash(jti);
-        let replay_key = (scope_hash, jti_hash);
-        let mut records = self.lock_records()?;
-        records.redeemed.retain(|_, expiry| *expiry > now);
-        if records.redeemed.contains_key(&replay_key) {
-            return Ok(false);
-        }
-        let has_live_transaction_code = records
-            .transaction_codes
-            .get(&jti_hash)
-            .is_some_and(|stored| stored.expires_at > now);
-        if transaction_code_required != has_live_transaction_code {
-            return Ok(false);
-        }
-        if let Some(proof) = proof {
-            let Some(proof_verifier) = proof.into_verifier_for(&jti_hash) else {
-                return Err(PreauthorizationStateError::IncompatibleTransactionCodeProof);
-            };
-            let Some(stored) = records.transaction_codes.get(&jti_hash) else {
-                return Ok(false);
-            };
-            if stored.expires_at <= now
-                || proof_verifier.ct_eq(&stored.value.verifier).unwrap_u8() != 1
-            {
-                return Ok(false);
-            }
-        }
-        records.redeemed.insert(replay_key, expires_at);
-        records.transaction_codes.remove(&jti_hash);
-        Ok(true)
-    }
-
-    fn lock_records(
-        &self,
-    ) -> Result<std::sync::MutexGuard<'_, InMemoryRecords>, PreauthorizationStateError> {
-        self.records
-            .lock()
-            .map_err(|_| PreauthorizationStateError::Unavailable)
-    }
-}
-
-fn prune_offer_records(records: &mut InMemoryRecords, now: OffsetDateTime) {
-    records.issuance.retain(|_, stored| stored.expires_at > now);
-    records
-        .transaction_codes
-        .retain(|_, stored| stored.expires_at > now);
-    records
-        .registry_client_offers
-        .retain(|_, stored| stored.purge_after > now);
-    records
-        .consumed_evaluations
-        .retain(|_, expires_at| *expires_at > now);
-    records
-        .machine_quota
-        .retain(|_, quota| quota.window_expires_at > now);
-}
-
-fn reserve_offer_quota(
-    records: &mut InMemoryRecords,
-    reservation: &RegistryClientOfferReservation,
-    now: OffsetDateTime,
-) -> Result<(), PreauthorizationStateError> {
-    let principal_hash: [u8; 32] = reservation
-        .quota_principal_hash
-        .as_slice()
-        .try_into()
-        .map_err(|_| PreauthorizationStateError::Unavailable)?;
-    if reservation.quota_cost <= 0 || reservation.quota_limit.is_some_and(|limit| limit <= 0) {
-        return Err(PreauthorizationStateError::Unavailable);
-    }
-    let Some(limit) = reservation.quota_limit else {
-        return Ok(());
-    };
-    let (window_expires_at, used) = records
-        .machine_quota
-        .get(&principal_hash)
-        .filter(|quota| quota.window_expires_at > now)
-        .map_or((now + MACHINE_QUOTA_WINDOW, 0), |quota| {
-            (quota.window_expires_at, quota.used)
-        });
-    if reservation.quota_cost > limit.saturating_sub(used) {
-        let remaining_millis = (window_expires_at - now).whole_milliseconds().max(1);
-        return Err(PreauthorizationStateError::MachineQuotaExceeded {
-            retry_after_seconds: ((remaining_millis + 999) / 1_000) as u64,
-        });
-    }
-    if !records.machine_quota.contains_key(&principal_hash)
-        && records.machine_quota.len() >= MACHINE_QUOTA_MAX_ENTRIES
-    {
-        if let Some(oldest) = records
-            .machine_quota
-            .iter()
-            .min_by_key(|(_, quota)| quota.window_expires_at)
-            .map(|(principal_hash, _)| *principal_hash)
-        {
-            records.machine_quota.remove(&oldest);
-        }
-    }
-    records.machine_quota.insert(
-        principal_hash,
-        StoredMachineQuota {
-            window_expires_at,
-            used: used + reservation.quota_cost,
-        },
-    );
-    Ok(())
-}
-
-pub(crate) fn validate_registry_client_offer_reservation(
-    reservation: &RegistryClientOfferReservation,
-    now: OffsetDateTime,
-) -> Result<(), PreauthorizationStateError> {
-    validate_registry_client_offer_structure(reservation)?;
-    if reservation.code_expires_at <= now
-        || reservation.transaction_expires_at < reservation.code_expires_at
-        || reservation.evaluation_expires_at <= now
-        || reservation.retention_expires_at < reservation.code_expires_at
-    {
-        return Err(PreauthorizationStateError::InvalidExpiry);
-    }
-    Ok(())
-}
-
-pub(crate) fn validate_registry_client_offer_structure(
-    reservation: &RegistryClientOfferReservation,
-) -> Result<(), PreauthorizationStateError> {
-    if reservation.transaction_id != reservation.transaction.transaction_id
-        || reservation.evaluation_id != reservation.transaction.evaluation_id
-    {
-        return Err(PreauthorizationStateError::Unavailable);
-    }
-    let IssuanceAuthority::RegistryClient {
-        initiating_client_id,
-        initiating_client_id_hash,
-        target_ref,
-        ..
-    } = &reservation.transaction.authority
-    else {
-        return Err(PreauthorizationStateError::Unavailable);
-    };
-    if initiating_client_id.is_empty()
-        || initiating_client_id != &reservation.transaction.evaluation_client_id
-        || decode_hash_uri(initiating_client_id_hash, "hmac-sha256:").is_err()
-        || target_ref.handle.is_empty()
-        || reservation.quota_principal_hash.len() != 32
-        || reservation.quota_cost <= 0
-        || reservation.quota_limit.is_some_and(|limit| limit <= 0)
-    {
-        return Err(PreauthorizationStateError::Unavailable);
-    }
-    match (
-        reservation.transaction_code.as_ref(),
-        reservation.response.tx_code.as_deref(),
-    ) {
-        (None, None) => {}
-        (Some(code), Some(response_code))
-            if (4..=12).contains(&code.pin_length)
-                && usize::try_from(code.pin_length).ok() == Some(code.pin.len())
-                && code.pin.bytes().all(|byte| byte.is_ascii_digit())
-                && response_code
-                    .as_bytes()
-                    .ct_eq(code.pin.as_bytes())
-                    .unwrap_u8()
-                    == 1 => {}
-        _ => return Err(PreauthorizationStateError::Unavailable),
-    }
-    Ok(())
-}
-
-pub(crate) fn decode_hash_uri(
-    value: &str,
-    expected_prefix: &str,
-) -> Result<[u8; 32], PreauthorizationStateError> {
-    let encoded = value
-        .strip_prefix(expected_prefix)
-        .ok_or(PreauthorizationStateError::Unavailable)?;
-    if encoded.len() != 64 {
-        return Err(PreauthorizationStateError::Unavailable);
-    }
-    let mut decoded = [0_u8; 32];
-    for (destination, pair) in decoded.iter_mut().zip(encoded.as_bytes().chunks_exact(2)) {
-        let high = hex_nibble(pair[0]).ok_or(PreauthorizationStateError::Unavailable)?;
-        let low = hex_nibble(pair[1]).ok_or(PreauthorizationStateError::Unavailable)?;
-        *destination = (high << 4) | low;
-    }
-    Ok(decoded)
-}
-
-fn hex_nibble(value: u8) -> Option<u8> {
-    match value {
-        b'0'..=b'9' => Some(value - b'0'),
-        b'a'..=b'f' => Some(value - b'a' + 10),
-        _ => None,
-    }
-}
-
-fn expiry_after(ttl_seconds: u64) -> Result<OffsetDateTime, PreauthorizationStateError> {
-    let seconds =
-        i64::try_from(ttl_seconds).map_err(|_| PreauthorizationStateError::InvalidExpiry)?;
-    OffsetDateTime::now_utc()
-        .checked_add(Duration::seconds(seconds))
-        .ok_or(PreauthorizationStateError::InvalidExpiry)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn login_state() -> LoginState {
-        LoginState {
-            pkce_verifier: "verifier-secret".to_string(),
-            nonce: "nonce-secret".to_string(),
-            credential_configuration_id: "person_is_alive_sd_jwt".to_string(),
-            representative: None,
-            csrf_token: None,
-        }
-    }
-
-    fn memory_state() -> PreauthorizationState {
-        PreauthorizationState {
-            backend: PreauthorizationBackend::InMemory(Arc::new(
-                InMemoryPreauthorizationState::new().unwrap(),
-            )),
-        }
-    }
-
-    fn scope() -> ReplayScope {
-        ReplayScope::new([("tenant", "tenant-a"), ("kind", "oid4vci-preauth-code")]).unwrap()
-    }
-
-    fn issuance_transaction() -> IssuanceTransaction {
-        IssuanceTransaction {
-            transaction_id: "transaction-1".to_string(),
-            evaluation_id: "evaluation-1".to_string(),
-            evaluation_client_id: "client-1".to_string(),
-            credential_configuration_id: "person_is_alive_sd_jwt".to_string(),
-            commitment: format!("sha256:{}", "a".repeat(64)),
-            authority: IssuanceAuthority::SubjectAccess,
-        }
-    }
-
-    fn registry_client_offer_reservation(
-        transaction_id: &str,
-        evaluation_id: &str,
-        idempotency_byte: char,
-        request_byte: char,
-    ) -> RegistryClientOfferReservation {
-        let now = OffsetDateTime::now_utc();
-        let pin = "246810".to_string();
-        RegistryClientOfferReservation {
-            transaction_id: transaction_id.to_string(),
-            evaluation_id: evaluation_id.to_string(),
-            evaluation_expires_at: now + Duration::minutes(20),
-            idempotency_key_hash: format!(
-                "hmac-sha256:{}",
-                idempotency_byte.to_string().repeat(64)
-            ),
-            canonical_request_hash: format!("sha256:{}", request_byte.to_string().repeat(64)),
-            transaction: IssuanceTransaction {
-                transaction_id: transaction_id.to_string(),
-                evaluation_id: evaluation_id.to_string(),
-                evaluation_client_id: "registry-client".to_string(),
-                credential_configuration_id: "person_is_alive_sd_jwt".to_string(),
-                commitment: format!("sha256:{}", "a".repeat(64)),
-                authority: IssuanceAuthority::RegistryClient {
-                    initiating_client_id: "registry-client".to_string(),
-                    initiating_client_id_hash: format!("hmac-sha256:{}", "c".repeat(64)),
-                    auth_profile_id: registry_notary_core::EvidenceAuthProfileId::ExternalOidc,
-                    authorized_scopes: vec!["registry:evidence".to_string()],
-                    target_ref: registry_notary_core::TargetRefView {
-                        entity_type: "Person".to_string(),
-                        handle: "opaque-target-handle".to_string(),
-                        identifier_schemes: Vec::new(),
-                        profile: None,
-                    },
-                    service_id: "notary.test".to_string(),
-                    purpose: "civil-registration".to_string(),
-                },
-            },
-            transaction_code: Some(RegistryClientTransactionCode {
-                pin: pin.clone(),
-                pin_length: 6,
-            }),
-            code_expires_at: now + Duration::minutes(5),
-            transaction_expires_at: now + Duration::minutes(15),
-            response: RegistryClientOfferResponse {
-                credential_offer_uri: format!(
-                    "openid-credential-offer://?credential_offer_uri={transaction_id}"
-                ),
-                tx_code: Some(pin),
-                expires_at: "2030-01-01T00:00:00Z".to_string(),
-            },
-            retention_expires_at: now + Duration::minutes(10),
-            quota_principal_hash: vec![0x71; 32],
-            quota_limit: None,
-            quota_cost: 1,
-        }
-    }
-
-    #[tokio::test]
-    async fn login_state_is_consumed_exactly_once() {
-        let state = memory_state();
-        state
-            .reserve_login("opaque", login_state(), 300)
-            .await
-            .unwrap();
-        assert!(state.consume_login("opaque").await.unwrap().is_some());
-        assert!(state.consume_login("opaque").await.unwrap().is_none());
-    }
-
-    #[tokio::test]
-    async fn representative_selection_state_is_sensitive_and_single_use() {
-        let state = memory_state();
-        let bound_subject = BoundSubject {
-            subject: "representative-subject".to_string(),
-            subject_binding_claim: "national_id".to_string(),
-            subject_binding_value: "NAT-123".to_string(),
-            client_id: "citizen-portal".to_string(),
-            scopes: vec!["subject_access".to_string()],
-            acr: Some("urn:example:loa:substantial".to_string()),
-            auth_time: Some(123),
-        };
-        state
-            .reserve_login(
-                "selection-state",
-                LoginState {
-                    pkce_verifier: String::new(),
-                    nonce: String::new(),
-                    credential_configuration_id: "dependent_birth_sd_jwt".to_string(),
-                    representative: Some(AuthenticatedRepresentative::from_bound_subject(
-                        bound_subject.clone(),
-                    )),
-                    csrf_token: Some("csrf-secret".to_string()),
-                },
-                300,
-            )
-            .await
-            .unwrap();
-
-        let mut consumed = state
-            .consume_login("selection-state")
-            .await
-            .unwrap()
-            .expect("selection state is present once");
-        assert_eq!(consumed.csrf_token.take().as_deref(), Some("csrf-secret"));
-        let recovered = consumed
-            .representative
-            .take()
-            .expect("representative is present")
-            .into_bound_subject();
-        assert_eq!(recovered.subject, bound_subject.subject);
-        assert_eq!(
-            recovered.subject_binding_value,
-            bound_subject.subject_binding_value
-        );
-        assert_eq!(recovered.client_id, bound_subject.client_id);
-        assert_eq!(recovered.scopes, bound_subject.scopes);
-        assert_eq!(recovered.acr, bound_subject.acr);
-        assert_eq!(recovered.auth_time, bound_subject.auth_time);
-        assert!(state
-            .consume_login("selection-state")
-            .await
-            .unwrap()
-            .is_none());
-    }
-
-    #[tokio::test]
-    async fn issuance_materialization_binds_holder_and_exact_request_and_caches_response() {
-        let state = memory_state();
-        let transaction = issuance_transaction();
-        let expires_at = OffsetDateTime::now_utc() + Duration::minutes(5);
-        state
-            .reserve_issuance_transaction(
-                &transaction.transaction_id,
-                transaction.clone(),
-                expires_at,
-            )
-            .await
-            .unwrap();
-        assert!(state
-            .bind_transaction_nonce(
-                &transaction.transaction_id,
-                &transaction.commitment,
-                "token-nonce".to_string(),
-            )
-            .await
-            .unwrap());
-        assert!(matches!(
-            state
-                .begin_credential_materialization(
-                    &transaction.transaction_id,
-                    &transaction.commitment,
-                    &transaction.credential_configuration_id,
-                    "token-nonce",
-                    "holder-one",
-                    "request-one",
-                )
-                .await
-                .unwrap(),
-            CredentialMaterialization::Acquired(_)
-        ));
-        assert!(matches!(
-            state
-                .begin_credential_materialization(
-                    &transaction.transaction_id,
-                    &transaction.commitment,
-                    &transaction.credential_configuration_id,
-                    "token-nonce",
-                    "holder-two",
-                    "request-one",
-                )
-                .await
-                .unwrap(),
-            CredentialMaterialization::Denied
-        ));
-        let response = serde_json::json!({"credential": "signed-once"});
-        assert!(state
-            .complete_credential_materialization(
-                &transaction.transaction_id,
-                "holder-one",
-                "request-one",
-                response.clone(),
-            )
-            .await
-            .unwrap());
-        match state
-            .begin_credential_materialization(
-                &transaction.transaction_id,
-                &transaction.commitment,
-                &transaction.credential_configuration_id,
-                "token-nonce",
-                "holder-one",
-                "request-one",
-            )
-            .await
-            .unwrap()
-        {
-            CredentialMaterialization::Cached(cached) => assert_eq!(cached, response),
-            outcome => panic!("expected cached response, got {outcome:?}"),
-        }
-        assert!(matches!(
-            state
-                .begin_credential_materialization(
-                    &transaction.transaction_id,
-                    &transaction.commitment,
-                    &transaction.credential_configuration_id,
-                    "token-nonce",
-                    "holder-one",
-                    "different-request",
-                )
-                .await
-                .unwrap(),
-            CredentialMaterialization::Denied
-        ));
-    }
-
-    #[tokio::test]
-    async fn failed_issuance_materialization_is_terminal() {
-        let state = memory_state();
-        let transaction = issuance_transaction();
-        state
-            .reserve_issuance_transaction(
-                &transaction.transaction_id,
-                transaction.clone(),
-                OffsetDateTime::now_utc() + Duration::minutes(5),
-            )
-            .await
-            .unwrap();
-        assert!(state
-            .bind_transaction_nonce(
-                &transaction.transaction_id,
-                &transaction.commitment,
-                "token-nonce".to_string(),
-            )
-            .await
-            .unwrap());
-        assert!(matches!(
-            state
-                .begin_credential_materialization(
-                    &transaction.transaction_id,
-                    &transaction.commitment,
-                    &transaction.credential_configuration_id,
-                    "token-nonce",
-                    "holder-one",
-                    "request-one",
-                )
-                .await
-                .unwrap(),
-            CredentialMaterialization::Acquired(_)
-        ));
-        state
-            .fail_credential_materialization(&transaction.transaction_id, "holder-one")
-            .await
-            .unwrap();
-        assert!(matches!(
-            state
-                .begin_credential_materialization(
-                    &transaction.transaction_id,
-                    &transaction.commitment,
-                    &transaction.credential_configuration_id,
-                    "token-nonce",
-                    "holder-one",
-                    "request-one",
-                )
-                .await
-                .unwrap(),
-            CredentialMaterialization::Denied
-        ));
-    }
-
-    #[tokio::test]
-    async fn registry_client_offer_exact_replay_returns_the_cached_response() {
-        let state = memory_state();
-        let reservation =
-            registry_client_offer_reservation("offer-transaction", "evaluation", '1', 'a');
-        let expected = reservation.response.clone();
-        assert_eq!(
-            state
-                .reserve_registry_client_offer(reservation)
-                .await
-                .unwrap(),
-            RegistryClientOfferReservationOutcome::Created(expected.clone())
-        );
-        assert_eq!(
-            state
-                .reserve_registry_client_offer(registry_client_offer_reservation(
-                    "offer-transaction",
-                    "evaluation",
-                    '1',
-                    'a',
-                ))
-                .await
-                .unwrap(),
-            RegistryClientOfferReservationOutcome::Replayed(expected)
-        );
-    }
-
-    #[tokio::test]
-    async fn registry_client_offer_replay_stops_when_the_signed_code_expires() {
-        let state = memory_state();
-        let mut reservation =
-            registry_client_offer_reservation("expiring-offer", "evaluation", '9', 'f');
-        let code_expires_at = OffsetDateTime::now_utc() + Duration::milliseconds(250);
-        reservation.code_expires_at = code_expires_at;
-        reservation.retention_expires_at = code_expires_at;
-        reservation.response.expires_at = crate::format_time(code_expires_at);
-        state
-            .reserve_registry_client_offer(reservation)
-            .await
-            .expect("live offer reserves");
-
-        tokio::time::sleep(std::time::Duration::from_millis(300)).await;
-
-        assert!(matches!(
-            state
-                .registry_client_offer_preflight(
-                    "evaluation",
-                    "registry-client",
-                    &format!("hmac-sha256:{}", "9".repeat(64)),
-                    &format!("sha256:{}", "f".repeat(64)),
-                )
-                .await
-                .expect("expired replay lookup succeeds"),
-            RegistryClientOfferPreflightOutcome::EvaluationConsumed
-        ));
-    }
-
-    #[tokio::test]
-    async fn registry_client_offer_preflight_is_exact_and_nonmutating() {
-        let state = memory_state();
-        let reservation =
-            registry_client_offer_reservation("offer-transaction", "evaluation", '1', 'a');
-        assert!(matches!(
-            state
-                .registry_client_offer_preflight(
-                    "evaluation",
-                    "registry-client",
-                    &reservation.idempotency_key_hash,
-                    &reservation.canonical_request_hash,
-                )
-                .await
-                .unwrap(),
-            RegistryClientOfferPreflightOutcome::Available
-        ));
-        assert!(state
-            .transaction("offer-transaction")
-            .await
-            .unwrap()
-            .is_none());
-        let expected = reservation.response.clone();
-        state
-            .reserve_registry_client_offer(reservation)
-            .await
-            .unwrap();
-        assert_eq!(
-            state
-                .registry_client_offer_preflight(
-                    "evaluation",
-                    "registry-client",
-                    &format!("hmac-sha256:{}", "1".repeat(64)),
-                    &format!("sha256:{}", "a".repeat(64)),
-                )
-                .await
-                .unwrap(),
-            RegistryClientOfferPreflightOutcome::Replayed(expected)
-        );
-        assert!(matches!(
-            state
-                .registry_client_offer_preflight(
-                    "evaluation",
-                    "registry-client",
-                    &format!("hmac-sha256:{}", "1".repeat(64)),
-                    &format!("sha256:{}", "b".repeat(64)),
-                )
-                .await
-                .unwrap(),
-            RegistryClientOfferPreflightOutcome::IdempotencyConflict
-        ));
-        assert!(matches!(
-            state
-                .registry_client_offer_preflight(
-                    "evaluation",
-                    "registry-client",
-                    &format!("hmac-sha256:{}", "2".repeat(64)),
-                    &format!("sha256:{}", "a".repeat(64)),
-                )
-                .await
-                .unwrap(),
-            RegistryClientOfferPreflightOutcome::EvaluationConsumed
-        ));
-    }
-
-    #[tokio::test]
-    async fn registry_client_offer_conflict_and_consumed_evaluation_are_distinct() {
-        let state = memory_state();
-        state
-            .reserve_registry_client_offer(registry_client_offer_reservation(
-                "offer-transaction",
-                "evaluation",
-                '1',
-                'a',
-            ))
-            .await
-            .unwrap();
-        assert!(matches!(
-            state
-                .reserve_registry_client_offer(registry_client_offer_reservation(
-                    "offer-transaction",
-                    "evaluation",
-                    '1',
-                    'b',
-                ))
-                .await,
-            Err(PreauthorizationStateError::IdempotencyConflict)
-        ));
-        assert!(matches!(
-            state
-                .reserve_registry_client_offer(registry_client_offer_reservation(
-                    "other-transaction",
-                    "evaluation",
-                    '2',
-                    'a',
-                ))
-                .await,
-            Err(PreauthorizationStateError::EvaluationConsumed)
-        ));
-        assert!(state
-            .transaction("other-transaction")
-            .await
-            .unwrap()
-            .is_none());
-    }
-
-    #[tokio::test]
-    async fn concurrent_exact_retries_create_once_and_replay_once() {
-        let state = Arc::new(memory_state());
-        let barrier = Arc::new(tokio::sync::Barrier::new(3));
-        let mut attempts = Vec::new();
-        for _ in 0..2 {
-            let state = Arc::clone(&state);
-            let barrier = Arc::clone(&barrier);
-            attempts.push(tokio::spawn(async move {
-                barrier.wait().await;
-                let mut reservation =
-                    registry_client_offer_reservation("offer-transaction", "evaluation", '1', 'a');
-                reservation.quota_limit = Some(1);
-                state
-                    .reserve_registry_client_offer(reservation)
-                    .await
-                    .unwrap()
-            }));
-        }
-        barrier.wait().await;
-        let outcomes = [
-            attempts.remove(0).await.unwrap(),
-            attempts.remove(0).await.unwrap(),
-        ];
-        assert_eq!(
-            outcomes
-                .iter()
-                .filter(|outcome| matches!(
-                    outcome,
-                    RegistryClientOfferReservationOutcome::Created(_)
-                ))
-                .count(),
-            1
-        );
-        assert_eq!(
-            outcomes
-                .iter()
-                .filter(|outcome| matches!(
-                    outcome,
-                    RegistryClientOfferReservationOutcome::Replayed(_)
-                ))
-                .count(),
-            1
-        );
-    }
-
-    #[tokio::test]
-    async fn concurrent_idempotency_keys_consume_an_evaluation_once() {
-        let state = Arc::new(memory_state());
-        let barrier = Arc::new(tokio::sync::Barrier::new(3));
-        let mut attempts = Vec::new();
-        for (transaction_id, idempotency_byte) in [
-            ("offer-transaction-one", '1'),
-            ("offer-transaction-two", '2'),
-        ] {
-            let state = Arc::clone(&state);
-            let barrier = Arc::clone(&barrier);
-            attempts.push(tokio::spawn(async move {
-                barrier.wait().await;
-                state
-                    .reserve_registry_client_offer(registry_client_offer_reservation(
-                        transaction_id,
-                        "evaluation",
-                        idempotency_byte,
-                        'a',
-                    ))
-                    .await
-            }));
-        }
-        barrier.wait().await;
-        let outcomes = [
-            attempts.remove(0).await.unwrap(),
-            attempts.remove(0).await.unwrap(),
-        ];
-        assert_eq!(
-            outcomes
-                .iter()
-                .filter(|outcome| matches!(
-                    outcome,
-                    Ok(RegistryClientOfferReservationOutcome::Created(_))
-                ))
-                .count(),
-            1
-        );
-        assert_eq!(
-            outcomes
-                .iter()
-                .filter(|outcome| matches!(
-                    outcome,
-                    Err(PreauthorizationStateError::EvaluationConsumed)
-                ))
-                .count(),
-            1
-        );
-    }
-
-    #[tokio::test]
-    async fn direct_and_offer_reservations_share_one_evaluation_lineage() {
-        let state = memory_state();
-        let expires_at = OffsetDateTime::now_utc() + Duration::minutes(20);
-        state
-            .reserve_evaluation_issuance("direct-first", "registry-client", expires_at)
-            .await
-            .unwrap();
-        assert!(matches!(
-            state
-                .reserve_registry_client_offer(registry_client_offer_reservation(
-                    "offer-after-direct",
-                    "direct-first",
-                    '3',
-                    'a',
-                ))
-                .await,
-            Err(PreauthorizationStateError::EvaluationConsumed)
-        ));
-
-        state
-            .reserve_registry_client_offer(registry_client_offer_reservation(
-                "offer-first",
-                "offer-first-evaluation",
-                '4',
-                'a',
-            ))
-            .await
-            .unwrap();
-        assert!(matches!(
-            state
-                .reserve_evaluation_issuance(
-                    "offer-first-evaluation",
-                    "registry-client",
-                    expires_at,
-                )
-                .await,
-            Err(PreauthorizationStateError::EvaluationConsumed)
-        ));
-    }
-
-    #[tokio::test]
-    async fn concurrent_direct_and_offer_reservations_have_exactly_one_winner() {
-        let state = Arc::new(memory_state());
-        let barrier = Arc::new(tokio::sync::Barrier::new(3));
-        let direct_state = Arc::clone(&state);
-        let direct_barrier = Arc::clone(&barrier);
-        let direct = tokio::spawn(async move {
-            direct_barrier.wait().await;
-            direct_state
-                .reserve_evaluation_issuance(
-                    "raced-evaluation",
-                    "registry-client",
-                    OffsetDateTime::now_utc() + Duration::minutes(20),
-                )
-                .await
-                .map(|()| "direct")
-        });
-        let offer_state = Arc::clone(&state);
-        let offer_barrier = Arc::clone(&barrier);
-        let offer = tokio::spawn(async move {
-            offer_barrier.wait().await;
-            offer_state
-                .reserve_registry_client_offer(registry_client_offer_reservation(
-                    "raced-offer",
-                    "raced-evaluation",
-                    '5',
-                    'a',
-                ))
-                .await
-                .map(|_| "offer")
-        });
-        barrier.wait().await;
-        let outcomes = [direct.await.unwrap(), offer.await.unwrap()];
-        assert_eq!(outcomes.iter().filter(|outcome| outcome.is_ok()).count(), 1);
-        assert_eq!(
-            outcomes
-                .iter()
-                .filter(|outcome| matches!(
-                    outcome,
-                    Err(PreauthorizationStateError::EvaluationConsumed)
-                ))
-                .count(),
-            1
-        );
-    }
-
-    #[tokio::test]
-    async fn offer_quota_charges_only_a_new_winning_reservation() {
-        let state = memory_state();
-        let mut first =
-            registry_client_offer_reservation("quota-first", "quota-evaluation-one", '6', 'a');
-        first.quota_limit = Some(1);
-        assert!(matches!(
-            state.reserve_registry_client_offer(first).await,
-            Ok(RegistryClientOfferReservationOutcome::Created(_))
-        ));
-
-        let mut replay =
-            registry_client_offer_reservation("quota-first", "quota-evaluation-one", '6', 'a');
-        replay.quota_limit = Some(1);
-        assert!(matches!(
-            state.reserve_registry_client_offer(replay).await,
-            Ok(RegistryClientOfferReservationOutcome::Replayed(_))
-        ));
-
-        let mut second =
-            registry_client_offer_reservation("quota-second", "quota-evaluation-two", '7', 'a');
-        second.quota_limit = Some(1);
-        assert!(matches!(
-            state.reserve_registry_client_offer(second).await,
-            Err(PreauthorizationStateError::MachineQuotaExceeded {
-                retry_after_seconds: 1..=60
-            })
-        ));
-        state
-            .reserve_evaluation_issuance(
-                "quota-evaluation-two",
-                "registry-client",
-                OffsetDateTime::now_utc() + Duration::minutes(20),
-            )
-            .await
-            .unwrap();
-    }
-
-    #[tokio::test]
-    async fn rejected_registry_client_offer_rolls_back_every_reservation() {
-        let state = memory_state();
-        let mut invalid =
-            registry_client_offer_reservation("offer-transaction", "evaluation", '1', 'a');
-        invalid.retention_expires_at = OffsetDateTime::now_utc() + Duration::minutes(1);
-        assert!(matches!(
-            state.reserve_registry_client_offer(invalid).await,
-            Err(PreauthorizationStateError::InvalidExpiry)
-        ));
-        let valid = registry_client_offer_reservation("offer-transaction", "evaluation", '1', 'a');
-        assert!(matches!(
-            state.reserve_registry_client_offer(valid).await,
-            Ok(RegistryClientOfferReservationOutcome::Created(_))
-        ));
-        assert!(state
-            .verify_transaction_code("offer-transaction", "246810")
-            .await
-            .unwrap()
-            .is_some());
-        assert!(state
-            .transaction("offer-transaction")
-            .await
-            .unwrap()
-            .is_some());
-    }
-
-    #[tokio::test]
-    async fn registry_client_offer_without_pin_remains_atomically_redeemable() {
-        let state = memory_state();
-        let mut reservation =
-            registry_client_offer_reservation("offer-transaction", "evaluation", '1', 'a');
-        reservation.transaction_code = None;
-        reservation.response.tx_code = None;
-        let code_expires_at = reservation.code_expires_at;
-        assert!(matches!(
-            state.reserve_registry_client_offer(reservation).await,
-            Ok(RegistryClientOfferReservationOutcome::Created(_))
-        ));
-        assert!(state
-            .redeem(&scope(), "offer-transaction", code_expires_at, false, None,)
-            .await
-            .unwrap());
-    }
-
-    #[tokio::test]
-    async fn issuance_materialization_cannot_complete_after_transaction_expiry() {
-        let state = memory_state();
-        let transaction = issuance_transaction();
-        state
-            .reserve_issuance_transaction(
-                &transaction.transaction_id,
-                transaction.clone(),
-                OffsetDateTime::now_utc() + Duration::minutes(5),
-            )
-            .await
-            .unwrap();
-        assert!(state
-            .bind_transaction_nonce(
-                &transaction.transaction_id,
-                &transaction.commitment,
-                "token-nonce".to_string(),
-            )
-            .await
-            .unwrap());
-        assert!(matches!(
-            state
-                .begin_credential_materialization(
-                    &transaction.transaction_id,
-                    &transaction.commitment,
-                    &transaction.credential_configuration_id,
-                    "token-nonce",
-                    "holder-one",
-                    "request-one",
-                )
-                .await
-                .unwrap(),
-            CredentialMaterialization::Acquired(_)
-        ));
-        let key = replay_identifier_hash(&transaction.transaction_id);
-        let PreauthorizationBackend::InMemory(memory) = &state.backend else {
-            panic!("test requires the in-memory backend");
-        };
-        memory
-            .lock_records()
-            .unwrap()
-            .issuance
-            .get_mut(&key)
-            .expect("issuance transaction exists")
-            .expires_at = OffsetDateTime::now_utc();
-
-        assert!(!state
-            .complete_credential_materialization(
-                &transaction.transaction_id,
-                "holder-one",
-                "request-one",
-                serde_json::json!({"credential": "must-not-be-cached"}),
-            )
-            .await
-            .unwrap());
-        assert!(state
-            .transaction(&transaction.transaction_id)
-            .await
-            .unwrap()
-            .is_none());
-    }
-
-    #[tokio::test]
-    async fn wrong_pin_preserves_offer_and_successful_redemption_is_single_use() {
-        let state = memory_state();
-        let expires_at = OffsetDateTime::now_utc() + Duration::minutes(5);
-        assert!(state
-            .reserve_transaction_code("jti", "246810", 6, expires_at)
-            .await
-            .unwrap());
-        assert!(state
-            .verify_transaction_code("jti", "000000")
-            .await
-            .unwrap()
-            .is_none());
-        let proof = state
-            .verify_transaction_code("jti", "246810")
-            .await
-            .unwrap()
-            .expect("correct PIN remains available after wrong PIN");
-        assert!(state
-            .redeem(&scope(), "jti", expires_at, true, Some(proof))
-            .await
-            .unwrap());
-        assert!(state
-            .verify_transaction_code("jti", "246810")
-            .await
-            .unwrap()
-            .is_none());
-        assert!(state
-            .redeem(&scope(), "jti", expires_at, true, None)
-            .await
-            .is_err());
-    }
-
-    #[tokio::test]
-    async fn live_transaction_code_row_rejects_no_pin_policy() {
-        let backend = Arc::new(InMemoryPreauthorizationState::new().unwrap());
-        let issuing_runtime = PreauthorizationState {
-            backend: PreauthorizationBackend::InMemory(Arc::clone(&backend)),
-        };
-        let expires_at = OffsetDateTime::now_utc() + Duration::minutes(5);
-        assert!(issuing_runtime
-            .reserve_transaction_code("reconfigured-jti", "246810", 6, expires_at)
-            .await
-            .unwrap());
-
-        let reconfigured_runtime = PreauthorizationState {
-            backend: PreauthorizationBackend::InMemory(backend),
-        };
-        assert!(matches!(
-            reconfigured_runtime
-                .redeem(&scope(), "reconfigured-jti", expires_at, true, None)
-                .await,
-            Err(PreauthorizationStateError::IncompatibleTransactionCodeProof)
-        ));
-        assert!(!reconfigured_runtime
-            .redeem(&scope(), "reconfigured-jti", expires_at, false, None)
-            .await
-            .unwrap());
-        let proof = reconfigured_runtime
-            .verify_transaction_code("reconfigured-jti", "246810")
-            .await
-            .unwrap()
-            .expect("the persisted per-code PIN requirement remains redeemable");
-        assert!(reconfigured_runtime
-            .redeem(&scope(), "reconfigured-jti", expires_at, true, Some(proof),)
-            .await
-            .unwrap());
-    }
-
-    #[tokio::test]
-    async fn redemption_without_pin_is_atomic_and_single_use() {
-        let state = memory_state();
-        let expires_at = OffsetDateTime::now_utc() + Duration::minutes(5);
-        assert!(state
-            .redeem(&scope(), "jti", expires_at, false, None)
-            .await
-            .unwrap());
-        assert!(!state
-            .redeem(&scope(), "jti", expires_at, false, None)
-            .await
-            .unwrap());
-    }
-
-    #[tokio::test]
-    async fn concurrent_redemptions_have_exactly_one_winner() {
-        let state = Arc::new(memory_state());
-        let expires_at = OffsetDateTime::now_utc() + Duration::minutes(5);
-        let barrier = Arc::new(tokio::sync::Barrier::new(3));
-        let mut attempts = Vec::new();
-        for _ in 0..2 {
-            let state = Arc::clone(&state);
-            let barrier = Arc::clone(&barrier);
-            attempts.push(tokio::spawn(async move {
-                barrier.wait().await;
-                state
-                    .redeem(&scope(), "jti", expires_at, false, None)
-                    .await
-                    .unwrap()
-            }));
-        }
-        barrier.wait().await;
-        let first = attempts.remove(0).await.unwrap();
-        let second = attempts.remove(0).await.unwrap();
-        assert_ne!(first, second);
-    }
-
-    #[test]
-    fn debug_redacts_login_secrets_and_transaction_code_proof() {
-        let login = login_state();
-        let rendered = format!("{login:?}");
-        assert!(!rendered.contains("verifier-secret"));
-        assert!(!rendered.contains("nonce-secret"));
-        let proof = VerifiedTransactionCode::new([7; 32], [9; 32]);
-        let rendered = format!("{proof:?}");
-        assert!(!rendered.contains('7'));
-        assert!(!rendered.contains('9'));
-
-        let reservation =
-            registry_client_offer_reservation("secret-transaction", "secret-evaluation", '1', 'a');
-        let rendered = format!("{reservation:?}");
-        for secret in [
-            "registry-client",
-            "opaque-target-handle",
-            "civil-registration",
-            "secret-transaction",
-            "secret-evaluation",
-            "openid-credential-offer",
-            "246810",
-        ] {
-            assert!(!rendered.contains(secret), "Debug exposed {secret}");
-        }
-    }
-
-    #[test]
-    fn login_state_has_an_explicit_zeroize_lifecycle() {
-        fn requires_zeroize<T: Zeroize + ZeroizeOnDrop>() {}
-        requires_zeroize::<LoginState>();
-        requires_zeroize::<RegistryClientOfferResponse>();
-        requires_zeroize::<RegistryClientTransactionCode>();
-    }
-}
diff --git a/crates/registry-notary-server/src/problem.rs b/crates/registry-notary-server/src/problem.rs
deleted file mode 100644
index d8707c5d0..000000000
--- a/crates/registry-notary-server/src/problem.rs
+++ /dev/null
@@ -1,130 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Stable problem metadata shared by Notary HTTP surfaces.
-
-use axum::http::StatusCode;
-use registry_notary_core::EvidenceError;
-
-pub(crate) const PROBLEM_TYPE_BASE_URL: &str =
-    "https://id.registrystack.org/problems/registry-notary";
-
-pub(crate) fn evidence_status(error: &EvidenceError) -> StatusCode {
-    match error {
-        EvidenceError::ServerDisabled
-        | EvidenceError::OperationUnsupported
-        | EvidenceError::CredentialIssuerNotConfigured => StatusCode::NOT_IMPLEMENTED,
-        EvidenceError::FormatUnsupported => StatusCode::NOT_ACCEPTABLE,
-        EvidenceError::ClaimNotFound
-        | EvidenceError::ClaimVersionNotFound
-        | EvidenceError::EvaluationNotFound => StatusCode::NOT_FOUND,
-        EvidenceError::MissingCredential => StatusCode::UNAUTHORIZED,
-        EvidenceError::MultipleCredentials => StatusCode::BAD_REQUEST,
-        EvidenceError::SubjectAccessInvalidToken => StatusCode::UNAUTHORIZED,
-        EvidenceError::InvalidRequest
-        | EvidenceError::ConsultationInvalidRequest
-        | EvidenceError::ProfileUnsupported
-        | EvidenceError::HolderProofRequired
-        | EvidenceError::PurposeRequired => StatusCode::BAD_REQUEST,
-        EvidenceError::DisclosureNotAllowed
-        | EvidenceError::EvaluationBindingMismatch
-        | EvidenceError::PurposeNotAllowed
-        | EvidenceError::PolicyDenied { .. }
-        | EvidenceError::ScopeDenied { .. }
-        | EvidenceError::SubjectAccessDenied { .. }
-        | EvidenceError::SubjectAccessAssuranceDenied => StatusCode::FORBIDDEN,
-        EvidenceError::EvidenceNotAvailable
-        | EvidenceError::IdempotencyConflict
-        | EvidenceError::HolderProofReplay => StatusCode::CONFLICT,
-        EvidenceError::SubjectAccessRateLimited | EvidenceError::MachineQuotaExceeded { .. } => {
-            StatusCode::TOO_MANY_REQUESTS
-        }
-        EvidenceError::BatchTooLarge => StatusCode::PAYLOAD_TOO_LARGE,
-        EvidenceError::CredentialIssuanceFailed | EvidenceError::RuleEvaluationFailed => {
-            StatusCode::INTERNAL_SERVER_ERROR
-        }
-        _ => StatusCode::INTERNAL_SERVER_ERROR,
-    }
-}
-
-pub(crate) fn evidence_title(error: &EvidenceError) -> &'static str {
-    match error {
-        EvidenceError::ServerDisabled => "Evidence server disabled",
-        EvidenceError::ClaimNotFound => "Claim not found",
-        EvidenceError::ClaimVersionNotFound => "Claim version not found",
-        EvidenceError::OperationUnsupported => "Claim operation unsupported",
-        EvidenceError::InvalidRequest => "Invalid evidence request",
-        EvidenceError::ConsultationInvalidRequest => "Invalid consultation request",
-        EvidenceError::DisclosureNotAllowed => "Disclosure not allowed",
-        EvidenceError::PurposeNotAllowed => "Purpose not allowed",
-        EvidenceError::PolicyDenied { .. } => "Policy decision denied",
-        EvidenceError::ProfileUnsupported => "Profile unsupported",
-        EvidenceError::EvidenceNotAvailable => "Evidence not available",
-        EvidenceError::BatchTooLarge => "Batch too large",
-        EvidenceError::EvaluationNotFound => "Evaluation not found",
-        EvidenceError::EvaluationBindingMismatch => "Evaluation binding mismatch",
-        EvidenceError::FormatUnsupported => "Claim format not supported",
-        EvidenceError::CredentialIssuerNotConfigured => "Credential issuer not configured",
-        EvidenceError::HolderProofRequired => "Holder proof required",
-        EvidenceError::HolderProofReplay => "Holder proof replay",
-        EvidenceError::CredentialIssuanceFailed => "Credential issuance failed",
-        EvidenceError::RuleEvaluationFailed => "Claim rule evaluation failed",
-        EvidenceError::IdempotencyConflict => "Idempotency conflict",
-        EvidenceError::PurposeRequired => "Purpose required",
-        EvidenceError::MissingCredential => "Missing credential",
-        EvidenceError::MultipleCredentials => "Multiple credentials",
-        EvidenceError::ScopeDenied { .. } => "Scope denied",
-        EvidenceError::SubjectAccessDenied { .. } => "Subject access denied",
-        EvidenceError::SubjectAccessRateLimited => "Subject access rate limited",
-        EvidenceError::SubjectAccessInvalidToken | EvidenceError::SubjectAccessAssuranceDenied => {
-            "Subject access denied"
-        }
-        EvidenceError::MachineQuotaExceeded { .. } => "Machine quota exceeded",
-        _ => "Evidence error",
-    }
-}
-
-pub(crate) fn evidence_detail(error: &EvidenceError) -> &'static str {
-    match error {
-        EvidenceError::ServerDisabled => "the evidence server is not enabled",
-        EvidenceError::ClaimNotFound => "the requested claim is not available",
-        EvidenceError::ClaimVersionNotFound => "the requested claim version is not available",
-        EvidenceError::OperationUnsupported => "the requested operation is not enabled",
-        EvidenceError::InvalidRequest => "the evidence request is invalid",
-        EvidenceError::ConsultationInvalidRequest => {
-            "the registry-backed batch consultation request is invalid"
-        }
-        EvidenceError::DisclosureNotAllowed => "the requested disclosure profile is not allowed",
-        EvidenceError::PurposeNotAllowed => "the declared purpose is not allowed",
-        EvidenceError::PolicyDenied { .. } => "the configured policy denied the evidence request",
-        EvidenceError::ProfileUnsupported => "the requested profile is not supported",
-        EvidenceError::EvidenceNotAvailable => "the evidence is not available",
-        EvidenceError::BatchTooLarge => "the batch exceeds the platform or configured member limit",
-        EvidenceError::EvaluationNotFound => "the evaluation id is unknown or expired",
-        EvidenceError::EvaluationBindingMismatch => {
-            "the request exceeds the original evaluation binding"
-        }
-        EvidenceError::FormatUnsupported => "the requested claim format is not supported",
-        EvidenceError::CredentialIssuerNotConfigured => {
-            "no credential issuer is configured for this claim and format"
-        }
-        EvidenceError::HolderProofRequired => "holder proof of possession is required",
-        EvidenceError::HolderProofReplay => "holder proof of possession has already been used",
-        EvidenceError::CredentialIssuanceFailed => "credential issuance failed",
-        EvidenceError::RuleEvaluationFailed => "claim rule evaluation failed",
-        EvidenceError::IdempotencyConflict => {
-            "the idempotency key was reused with a different request"
-        }
-        EvidenceError::PurposeRequired => "a data purpose is required",
-        EvidenceError::MissingCredential => "missing authentication credential",
-        EvidenceError::MultipleCredentials => "provide exactly one authentication credential",
-        EvidenceError::ScopeDenied { .. } => "missing required scope",
-        EvidenceError::SubjectAccessDenied { .. } => "subject-access request was denied",
-        EvidenceError::SubjectAccessRateLimited => "subject-access request was rate limited",
-        EvidenceError::SubjectAccessInvalidToken | EvidenceError::SubjectAccessAssuranceDenied => {
-            "subject-access request was denied"
-        }
-        EvidenceError::MachineQuotaExceeded { .. } => {
-            "the machine evaluation quota was exceeded for this principal"
-        }
-        _ => "evidence request failed",
-    }
-}
diff --git a/crates/registry-notary-server/src/relay_client.rs b/crates/registry-notary-server/src/relay_client.rs
deleted file mode 100644
index 5042fd5e7..000000000
--- a/crates/registry-notary-server/src/relay_client.rs
+++ /dev/null
@@ -1,1623 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Strict, single-origin Registry Relay consultation client.
-//!
-//! Startup verifies one hash-pinned consultation profile over the same
-//! authenticated Relay connection used for execution. Runtime calls can then
-//! select only that profile's exact route, purpose, input, and closed typed
-//! output map.
-//!
-//! Notary independently re-hashes the narrowed public contract before
-//! accepting Relay's metadata identity. Relay is the sole cryptographic and
-//! semantic verifier of the workload JWT on every protected request.
-
-use std::collections::BTreeMap;
-use std::fmt;
-use std::fs::File;
-use std::io::Read as _;
-use std::path::{Component, Path, PathBuf};
-use std::sync::Arc;
-
-use axum::http::StatusCode;
-use registry_notary_core::{
-    is_rfc3339_full_date, RelayOutputContract as NotaryRelayOutputContract,
-};
-use registry_platform_httputil::destination::input_pattern::MAX_BOUNDED_INPUT_BYTES;
-use registry_platform_httputil::destination::json::{
-    decode_typed_hash_envelope_as, ClosedJsonDecoder, ClosedJsonField, ClosedJsonOutcome,
-    ClosedJsonPresenceProjection, ClosedJsonRecordRoot, ClosedJsonScalarProjection,
-    ClosedJsonSchema, ProjectedJsonField, ProjectedJsonScalar,
-};
-use registry_platform_httputil::destination::{
-    DataDestinationRequestTemplate, DestinationAuthorizationTemplate,
-    DestinationAuthorizationValue, DestinationBodyTemplate, DestinationMethod,
-    DestinationResponseError, DestinationSendError, ServiceHopDataDestinationPolicy,
-    MAX_DESTINATION_HEADER_VALUE_BYTES, MAX_SERVICE_HOP_OPERATION_TIMEOUT,
-};
-use serde::ser::{SerializeMap, SerializeStruct};
-use serde::{Serialize, Serializer};
-use serde_json::Value;
-use thiserror::Error;
-use time::format_description::well_known::Rfc3339;
-use time::OffsetDateTime;
-use tokio::sync::{OwnedSemaphorePermit, Semaphore};
-use tokio::time::{timeout_at, Instant};
-use ulid::Ulid;
-use zeroize::Zeroizing;
-
-use crate::relay_contract::{
-    verify_contract, RelayPublicContract, VerifiedAcquisitionClass, VerifiedContractSemantics,
-    VerifiedInputType, VerifiedSourceField, CONTRACT_HASH_DOMAIN,
-};
-
-const PROFILE_ID_MAX_BYTES: usize = 96;
-const HASH_BYTES: usize = 71;
-const PURPOSE_MAX_BYTES: usize = 256;
-const INPUT_NAME_MAX_BYTES: usize = 96;
-const INPUT_VALUE_MAX_BYTES: usize = MAX_BOUNDED_INPUT_BYTES as usize;
-const OUTPUT_NAME_MAX_BYTES: usize = 96;
-const TOKEN_MAX_BYTES: usize = MAX_DESTINATION_HEADER_VALUE_BYTES - "Bearer ".len();
-const MAX_METADATA_BYTES: usize = 256 * 1024;
-const MAX_RESULT_BYTES: usize = 64 * 1024;
-const MAX_REQUEST_BYTES: usize = 8 * 1024;
-const MAX_WIRE_REQUEST_BYTES: usize = 18 * 1024;
-const MAX_PUBLIC_STRING_BYTES: u32 = 64 * 1024;
-const MAX_ACQUIRED_FIELDS: usize = 64;
-const MAX_JSON_INTEROPERABLE_INTEGER: u64 = (1_u64 << 53) - 1;
-const RESULT_SCHEMA: &str = "registry.relay.consultation-result.v1";
-const MAX_TOKEN_FILE_PATH_BYTES: usize = 4_096;
-const MAX_TOKEN_FILE_BYTES: usize = TOKEN_MAX_BYTES + 2;
-const BATCH_CHILD_IDENTITY_MAX_BYTES: usize = 43;
-const DEFAULT_MAX_IN_FLIGHT: usize = 8;
-const MAX_CONFIGURED_IN_FLIGHT: usize = 64;
-
-/// The hash-pinned public profile identity selected at Notary startup.
-#[derive(Clone, PartialEq, Eq)]
-pub struct RelayProfilePin {
-    id: Box<str>,
-    contract_hash: Box<str>,
-}
-
-impl RelayProfilePin {
-    /// Validate one exact Relay profile path and public-contract identity.
-    pub fn new(
-        id: impl Into<Box<str>>,
-        contract_hash: impl Into<Box<str>>,
-    ) -> Result<Self, RelayClientError> {
-        let id = id.into();
-        let contract_hash = contract_hash.into();
-        if !stable_id(&id, PROFILE_ID_MAX_BYTES) || !sha256_uri(&contract_hash) {
-            return Err(RelayClientError::InvalidConfiguration);
-        }
-        Ok(Self { id, contract_hash })
-    }
-
-    /// Return the pinned profile id.
-    #[must_use]
-    pub fn id(&self) -> &str {
-        &self.id
-    }
-
-    /// Return the pinned public contract hash.
-    #[must_use]
-    pub fn contract_hash(&self) -> &str {
-        &self.contract_hash
-    }
-}
-
-impl fmt::Debug for RelayProfilePin {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("RelayProfilePin")
-            .field("identity", &"[REDACTED]")
-            .finish()
-    }
-}
-
-/// The exact public result contract Notary expects Relay to expose.
-#[derive(Clone, PartialEq, Eq)]
-pub enum RelayExpectedResult {
-    OutputMap(BTreeMap<String, NotaryRelayOutputContract>),
-}
-
-impl RelayExpectedResult {
-    /// Require one complete closed typed output map.
-    pub fn output_map(
-        outputs: BTreeMap<String, NotaryRelayOutputContract>,
-    ) -> Result<Self, RelayClientError> {
-        if outputs.len() > MAX_ACQUIRED_FIELDS
-            || outputs.iter().any(|(name, output)| {
-                !output_name(name, OUTPUT_NAME_MAX_BYTES)
-                    || matches!(name.as_str(), "matched" | "outcome")
-                    || !valid_output(output)
-            })
-        {
-            return Err(RelayClientError::InvalidConfiguration);
-        }
-        Ok(Self::OutputMap(outputs))
-    }
-}
-
-fn valid_output(output: &NotaryRelayOutputContract) -> bool {
-    match output {
-        NotaryRelayOutputContract::String { max_bytes, .. } => {
-            (1..=MAX_PUBLIC_STRING_BYTES).contains(max_bytes)
-        }
-        NotaryRelayOutputContract::Integer {
-            minimum, maximum, ..
-        } => {
-            minimum <= maximum
-                && *minimum >= -(MAX_JSON_INTEROPERABLE_INTEGER as i64)
-                && *maximum <= MAX_JSON_INTEROPERABLE_INTEGER as i64
-        }
-        NotaryRelayOutputContract::Boolean { .. } | NotaryRelayOutputContract::Date { .. } => true,
-        NotaryRelayOutputContract::Object {
-            max_bytes, fields, ..
-        } => {
-            (1..=MAX_PUBLIC_STRING_BYTES).contains(max_bytes)
-                && (1..=32).contains(&fields.len())
-                && fields.iter().all(|(name, field)| {
-                    !name.is_empty()
-                        && name.len() <= 128
-                        && !name.chars().any(char::is_control)
-                        && valid_output(&field.schema)
-                })
-        }
-        NotaryRelayOutputContract::Array {
-            max_bytes,
-            max_items,
-            items,
-            ..
-        } => {
-            (1..=MAX_PUBLIC_STRING_BYTES).contains(max_bytes)
-                && (1..=256).contains(max_items)
-                && valid_output(items)
-        }
-    }
-}
-
-impl fmt::Debug for RelayExpectedResult {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("RelayExpectedResult")
-            .field("contract", &"[REDACTED]")
-            .finish()
-    }
-}
-
-/// A bounded reloadable workload-JWT file binding.
-///
-/// The path is restart-only. The current token is reopened, bounded,
-/// structurally checked, and zeroized for every metadata or execution
-/// operation, so atomic secret-file rotation requires no restart. Relay is the
-/// sole cryptographic and semantic verifier.
-pub struct RelayWorkloadCredentialFile {
-    path: PathBuf,
-    read_permit: Arc<Semaphore>,
-}
-
-impl RelayWorkloadCredentialFile {
-    /// Freeze the reloadable credential-file reference.
-    pub fn new(path: impl Into<PathBuf>) -> Result<Self, RelayClientError> {
-        let path = path.into();
-        if !valid_token_file_path(&path) {
-            return Err(RelayClientError::InvalidConfiguration);
-        }
-        Ok(Self {
-            path,
-            read_permit: Arc::new(Semaphore::new(1)),
-        })
-    }
-
-    async fn authorization(&self) -> Result<DestinationAuthorizationValue, RelayClientError> {
-        let permit = Arc::clone(&self.read_permit)
-            .acquire_owned()
-            .await
-            .map_err(|_| RelayClientError::CredentialUnavailable)?;
-        let token = read_token_file(self.path.clone(), permit).await?;
-        validate_compact_jws(&token)?;
-        DestinationAuthorizationValue::bearer_zeroizing(token)
-            .map_err(|_| RelayClientError::InvalidCredentials)
-    }
-}
-
-impl fmt::Debug for RelayWorkloadCredentialFile {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("RelayWorkloadCredentialFile")
-            .field("path", &"[REDACTED]")
-            .finish()
-    }
-}
-
-/// Unverified, fixed-origin client. Consume it with [`Self::verify_profile`]
-/// before serving evaluations.
-pub struct RelayConsultationClient {
-    destination: ServiceHopDataDestinationPolicy,
-    metadata_request: DataDestinationRequestTemplate,
-    execute_request: DataDestinationRequestTemplate,
-    execute_batch_request: DataDestinationRequestTemplate,
-    credential: RelayWorkloadCredentialFile,
-    workload_client_id: Box<str>,
-    pin: RelayProfilePin,
-    purpose: Box<str>,
-    input_names: Box<[String]>,
-    expected_result: RelayExpectedResult,
-    max_in_flight: usize,
-}
-
-#[doc(hidden)]
-pub enum RelayInputNames {
-    One(String),
-    Many(Vec<String>),
-}
-
-impl From<&str> for RelayInputNames {
-    fn from(value: &str) -> Self {
-        Self::One(value.to_string())
-    }
-}
-
-impl From<String> for RelayInputNames {
-    fn from(value: String) -> Self {
-        Self::One(value)
-    }
-}
-
-impl From<Vec<String>> for RelayInputNames {
-    fn from(value: Vec<String>) -> Self {
-        Self::Many(value)
-    }
-}
-
-impl RelayInputNames {
-    pub(crate) fn into_vec(self) -> Vec<String> {
-        match self {
-            Self::One(value) => vec![value],
-            Self::Many(values) => values,
-        }
-    }
-}
-
-impl RelayConsultationClient {
-    /// Freeze one Relay destination and one exact consultation route.
-    pub fn new(
-        destination: ServiceHopDataDestinationPolicy,
-        credential: RelayWorkloadCredentialFile,
-        workload_client_id: impl Into<Box<str>>,
-        pin: RelayProfilePin,
-        purpose: impl Into<Box<str>>,
-        input_names: impl Into<RelayInputNames>,
-        expected_result: RelayExpectedResult,
-    ) -> Result<Self, RelayClientError> {
-        let workload_client_id = workload_client_id.into();
-        let purpose = purpose.into();
-        let mut input_names = input_names.into().into_vec();
-        input_names.sort();
-        input_names.dedup();
-        if !stable_id(&workload_client_id, PROFILE_ID_MAX_BYTES)
-            || !valid_purpose(&purpose)
-            || !(1..=16).contains(&input_names.len())
-            || input_names
-                .iter()
-                .any(|name| !stable_id(name, INPUT_NAME_MAX_BYTES))
-        {
-            return Err(RelayClientError::InvalidConfiguration);
-        }
-
-        let profile_path = format!("/v1/consultations/{}", pin.id);
-        let execute_path = format!("{profile_path}/execute");
-        let metadata_request = DataDestinationRequestTemplate::new_with_exact_headers(
-            DestinationMethod::Get,
-            &profile_path,
-            &[],
-            &[("accept", b"application/json")],
-            DestinationAuthorizationTemplate::Bearer {
-                max_value_bytes: MAX_DESTINATION_HEADER_VALUE_BYTES,
-            },
-            DestinationBodyTemplate::Forbidden,
-            MAX_WIRE_REQUEST_BYTES,
-        )
-        .map_err(|_| RelayClientError::InvalidConfiguration)?;
-        let execute_request = DataDestinationRequestTemplate::new(
-            DestinationMethod::ReviewedReadOnlyPost,
-            &execute_path,
-            &[],
-            &[
-                ("accept", "application/json".len()),
-                ("content-type", "application/json".len()),
-                ("data-purpose", PURPOSE_MAX_BYTES),
-                ("registry-notary-evaluation-id", 26),
-            ],
-            DestinationAuthorizationTemplate::Bearer {
-                max_value_bytes: MAX_DESTINATION_HEADER_VALUE_BYTES,
-            },
-            DestinationBodyTemplate::Required {
-                max_bytes: MAX_REQUEST_BYTES,
-            },
-            MAX_WIRE_REQUEST_BYTES,
-        )
-        .map_err(|_| RelayClientError::InvalidConfiguration)?;
-        let execute_batch_request = DataDestinationRequestTemplate::new(
-            DestinationMethod::ReviewedReadOnlyPost,
-            &execute_path,
-            &[],
-            &[
-                ("accept", "application/json".len()),
-                ("content-type", "application/json".len()),
-                ("data-purpose", PURPOSE_MAX_BYTES),
-                ("registry-notary-evaluation-id", 26),
-                (
-                    "registry-notary-batch-child-id",
-                    BATCH_CHILD_IDENTITY_MAX_BYTES,
-                ),
-            ],
-            DestinationAuthorizationTemplate::Bearer {
-                max_value_bytes: MAX_DESTINATION_HEADER_VALUE_BYTES,
-            },
-            DestinationBodyTemplate::Required {
-                max_bytes: MAX_REQUEST_BYTES,
-            },
-            MAX_WIRE_REQUEST_BYTES,
-        )
-        .map_err(|_| RelayClientError::InvalidConfiguration)?;
-        Ok(Self {
-            destination,
-            metadata_request,
-            execute_request,
-            execute_batch_request,
-            credential,
-            workload_client_id,
-            pin,
-            purpose,
-            input_names: input_names.into_boxed_slice(),
-            expected_result,
-            max_in_flight: DEFAULT_MAX_IN_FLIGHT,
-        })
-    }
-
-    /// Apply the operator-owned cap for concurrent calls to the pinned Relay profile.
-    pub fn with_max_in_flight(mut self, max_in_flight: usize) -> Result<Self, RelayClientError> {
-        if !(1..=MAX_CONFIGURED_IN_FLIGHT).contains(&max_in_flight) {
-            return Err(RelayClientError::InvalidConfiguration);
-        }
-        self.max_in_flight = max_in_flight;
-        Ok(self)
-    }
-
-    /// Authenticate to Relay, verify the pinned public profile, and compile
-    /// the exact result contract used by runtime evaluations.
-    pub async fn verify_profile(self) -> Result<VerifiedRelayClient, RelayClientError> {
-        let profile = fetch_verified_profile(
-            &self.destination,
-            &self.metadata_request,
-            &self.credential,
-            &self.pin,
-            &self.workload_client_id,
-            &self.purpose,
-            &self.input_names,
-            &self.expected_result,
-            self.max_in_flight,
-        )
-        .await?;
-        let result_decoder = result_decoder(&profile)?;
-        let max_in_flight = profile.max_in_flight;
-
-        Ok(VerifiedRelayClient {
-            destination: self.destination,
-            metadata_request: self.metadata_request,
-            execute_request: self.execute_request,
-            execute_batch_request: self.execute_batch_request,
-            result_decoder,
-            credential: self.credential,
-            workload_client_id: self.workload_client_id,
-            permits: Semaphore::new(max_in_flight),
-            profile,
-        })
-    }
-}
-
-#[allow(clippy::too_many_arguments)]
-async fn fetch_verified_profile(
-    destination: &ServiceHopDataDestinationPolicy,
-    metadata_request: &DataDestinationRequestTemplate,
-    credential: &RelayWorkloadCredentialFile,
-    pin: &RelayProfilePin,
-    workload_client_id: &str,
-    purpose: &str,
-    input_names: &[String],
-    expected_result: &RelayExpectedResult,
-    max_in_flight: usize,
-) -> Result<VerifiedRelayProfile, RelayClientError> {
-    let deadline = operation_deadline()?;
-    let authorization = authorization_before_deadline(credential, deadline).await?;
-    let request = metadata_request
-        .render(&[], &[], Some(authorization), None)
-        .map_err(|_| RelayClientError::InvalidConfiguration)?;
-    require_deadline(deadline)?;
-    let response = destination
-        .send_with_deadline(request, deadline)
-        .await
-        .map_err(map_send_error)?;
-    require_deadline(deadline)?;
-    require_success(response.status())?;
-    response
-        .require_exact_json_content_type()
-        .map_err(|_| RelayClientError::InvalidProfileMetadata)?;
-    require_deadline(deadline)?;
-    let body = response
-        .read_bounded(MAX_METADATA_BYTES)
-        .await
-        .map_err(|error| map_response_error(error, RelayClientError::InvalidProfileMetadata))?;
-    require_deadline(deadline)?;
-    let envelope = decode_typed_hash_envelope_as::<RelayPublicContract>(body, CONTRACT_HASH_DOMAIN)
-        .map_err(|_| RelayClientError::InvalidProfileMetadata)?;
-    if envelope.advertised_hash() != pin.contract_hash()
-        || envelope.computed_hash() != pin.contract_hash()
-    {
-        return Err(RelayClientError::InvalidProfileMetadata);
-    }
-    let contract = envelope.into_contract();
-    let RelayExpectedResult::OutputMap(outputs) = expected_result;
-    let semantics = verify_contract(
-        contract,
-        pin.id(),
-        workload_client_id,
-        purpose,
-        input_names,
-        outputs,
-    )
-    .map_err(|()| RelayClientError::InvalidProfileMetadata)?;
-    let result = VerifiedRelayResult::OutputMap(outputs.clone());
-    let profile = VerifiedRelayProfile {
-        pin: pin.clone(),
-        purpose: purpose.to_string().into_boxed_str(),
-        input_names: input_names.to_vec().into_boxed_slice(),
-        max_in_flight,
-        result,
-        semantics,
-    };
-    require_deadline(deadline)?;
-    Ok(profile)
-}
-
-impl fmt::Debug for RelayConsultationClient {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("RelayConsultationClient")
-            .field("destination", &"[REDACTED]")
-            .field("route", &"[REDACTED]")
-            .field("authorization", &"[REDACTED]")
-            .field("contract", &"[REDACTED]")
-            .finish()
-    }
-}
-
-/// Startup-verified Relay client ready to serve evaluations.
-pub struct VerifiedRelayClient {
-    destination: ServiceHopDataDestinationPolicy,
-    metadata_request: DataDestinationRequestTemplate,
-    execute_request: DataDestinationRequestTemplate,
-    execute_batch_request: DataDestinationRequestTemplate,
-    result_decoder: ClosedJsonDecoder,
-    credential: RelayWorkloadCredentialFile,
-    workload_client_id: Box<str>,
-    permits: Semaphore,
-    profile: VerifiedRelayProfile,
-}
-
-impl VerifiedRelayClient {
-    /// Return the verified public profile snapshot used to validate results.
-    #[must_use]
-    pub const fn profile(&self) -> &VerifiedRelayProfile {
-        &self.profile
-    }
-
-    /// Reload and validate the current credential, then re-fetch and verify
-    /// the exact pinned metadata profile. Readiness uses this operation so a
-    /// rotated or expired token cannot remain ready on stale startup state.
-    pub async fn verify_current_profile(&self) -> Result<(), RelayClientError> {
-        let expected_result = self.profile.result.expected();
-        fetch_verified_profile(
-            &self.destination,
-            &self.metadata_request,
-            &self.credential,
-            &self.profile.pin,
-            &self.workload_client_id,
-            &self.profile.purpose,
-            &self.profile.input_names,
-            &expected_result,
-            self.profile.max_in_flight,
-        )
-        .await
-        .map(|_| ())
-    }
-
-    /// Validate the caller-owned request fields without acquiring capacity,
-    /// reading credentials, or touching the network.
-    pub(crate) fn canonicalize_execute_inputs(
-        &self,
-        evaluation_id: &str,
-        inputs: &BTreeMap<String, Zeroizing<String>>,
-    ) -> Result<BTreeMap<String, Zeroizing<String>>, RelayClientError> {
-        if !canonical_ulid(evaluation_id)
-            || inputs.len() != self.profile.input_names.len()
-            || inputs.keys().ne(self.profile.input_names.iter())
-        {
-            return Err(RelayClientError::InvalidRequest);
-        }
-        let mut canonical = BTreeMap::new();
-        for name in &self.profile.input_names {
-            let value = inputs.get(name).ok_or(RelayClientError::InvalidRequest)?;
-            let input_type = self
-                .profile
-                .semantics
-                .input_types
-                .get(name)
-                .ok_or(RelayClientError::InvalidConfiguration)?;
-            if value.is_empty()
-                || value.len() > INPUT_VALUE_MAX_BYTES
-                || value.chars().any(char::is_control)
-                || !valid_wire_input(value, *input_type)
-            {
-                return Err(RelayClientError::InvalidRequest);
-            }
-            canonical.insert(name.clone(), Zeroizing::new(value.to_string()));
-        }
-        Ok(canonical)
-    }
-
-    /// Execute one purpose-bound consultation. The evaluation id and input are
-    /// validated before either value reaches the transport.
-    #[allow(dead_code)]
-    pub async fn execute(
-        &self,
-        evaluation_id: &str,
-        input: Zeroizing<String>,
-    ) -> Result<RelayConsultationResult, RelayClientError> {
-        let Some(input_name) = self.profile.input_names.first() else {
-            return Err(RelayClientError::InvalidConfiguration);
-        };
-        if self.profile.input_names.len() != 1 {
-            return Err(RelayClientError::InvalidRequest);
-        }
-        self.execute_inputs(evaluation_id, BTreeMap::from([(input_name.clone(), input)]))
-            .await
-    }
-
-    pub(crate) async fn execute_inputs(
-        &self,
-        evaluation_id: &str,
-        inputs: BTreeMap<String, Zeroizing<String>>,
-    ) -> Result<RelayConsultationResult, RelayClientError> {
-        self.execute_inputs_with_batch_child(evaluation_id, inputs, None)
-            .await
-    }
-
-    pub(crate) async fn execute_batch_inputs(
-        &self,
-        evaluation_id: &str,
-        inputs: BTreeMap<String, Zeroizing<String>>,
-        batch_child_identity: &str,
-    ) -> Result<RelayConsultationResult, RelayClientError> {
-        if batch_child_identity.len() != BATCH_CHILD_IDENTITY_MAX_BYTES
-            || !batch_child_identity
-                .bytes()
-                .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
-        {
-            return Err(RelayClientError::InvalidRequest);
-        }
-        self.execute_inputs_with_batch_child(evaluation_id, inputs, Some(batch_child_identity))
-            .await
-    }
-
-    async fn execute_inputs_with_batch_child(
-        &self,
-        evaluation_id: &str,
-        inputs: BTreeMap<String, Zeroizing<String>>,
-        batch_child_identity: Option<&str>,
-    ) -> Result<RelayConsultationResult, RelayClientError> {
-        let inputs = self.canonicalize_execute_inputs(evaluation_id, &inputs)?;
-        let deadline = operation_deadline()?;
-        let _permit = timeout_at(deadline, self.permits.acquire())
-            .await
-            .map_err(|_| RelayClientError::Unavailable)?
-            .map_err(|_| RelayClientError::CapacityUnavailable)?;
-        require_deadline(deadline)?;
-
-        let mut body = Zeroizing::new(Vec::with_capacity(128));
-        serde_json::to_writer(
-            &mut *body,
-            &ExecuteRequestBody {
-                contract_hash: self.profile.pin.contract_hash(),
-                inputs: &inputs,
-                input_types: &self.profile.semantics.input_types,
-            },
-        )
-        .map_err(|_| RelayClientError::InvalidRequest)?;
-        if body.len() > MAX_REQUEST_BYTES {
-            return Err(RelayClientError::InvalidRequest);
-        }
-
-        require_deadline(deadline)?;
-        let authorization = authorization_before_deadline(&self.credential, deadline).await?;
-        let headers: [&[u8]; 4] = [
-            b"application/json",
-            b"application/json",
-            self.profile.purpose.as_bytes(),
-            evaluation_id.as_bytes(),
-        ];
-        let batch_headers: [&[u8]; 5] = [
-            headers[0],
-            headers[1],
-            headers[2],
-            headers[3],
-            batch_child_identity.unwrap_or_default().as_bytes(),
-        ];
-        let request = match batch_child_identity {
-            Some(_) => self.execute_batch_request.render_zeroizing(
-                &[],
-                &batch_headers,
-                Some(authorization),
-                Some(body),
-            ),
-            None => self.execute_request.render_zeroizing(
-                &[],
-                &headers,
-                Some(authorization),
-                Some(body),
-            ),
-        }
-        .map_err(|_| RelayClientError::InvalidRequest)?;
-        require_deadline(deadline)?;
-        let response = self
-            .destination
-            .send_with_deadline(request, deadline)
-            .await
-            .map_err(map_send_error)?;
-        require_deadline(deadline)?;
-        require_success(response.status())?;
-        response
-            .require_exact_json_content_type()
-            .map_err(|_| RelayClientError::InvalidResult)?;
-        require_deadline(deadline)?;
-        let body = response
-            .read_bounded(MAX_RESULT_BYTES)
-            .await
-            .map_err(|error| map_response_error(error, RelayClientError::InvalidResult))?;
-        require_deadline(deadline)?;
-        let decoded = self
-            .result_decoder
-            .decode(body)
-            .map_err(|_| RelayClientError::InvalidResult)?;
-        require_deadline(deadline)?;
-        let ClosedJsonOutcome::One(record) = decoded else {
-            return Err(RelayClientError::InvalidResult);
-        };
-        let result = parse_result(record.into_fields(), evaluation_id, &self.profile)?;
-        require_deadline(deadline)?;
-        Ok(result)
-    }
-}
-
-impl fmt::Debug for VerifiedRelayClient {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("VerifiedRelayClient")
-            .field("destination", &"[REDACTED]")
-            .field("route", &"[REDACTED]")
-            .field("authorization", &"[REDACTED]")
-            .field("profile", &"[REDACTED]")
-            .finish()
-    }
-}
-
-/// Public metadata verified over the authenticated Relay connection.
-pub struct VerifiedRelayProfile {
-    pin: RelayProfilePin,
-    purpose: Box<str>,
-    input_names: Box<[String]>,
-    max_in_flight: usize,
-    result: VerifiedRelayResult,
-    semantics: VerifiedContractSemantics,
-}
-
-impl VerifiedRelayProfile {
-    #[must_use]
-    pub const fn pin(&self) -> &RelayProfilePin {
-        &self.pin
-    }
-
-    #[must_use]
-    pub fn purpose(&self) -> &str {
-        &self.purpose
-    }
-
-    #[must_use]
-    pub fn input_names(&self) -> &[String] {
-        &self.input_names
-    }
-}
-
-impl fmt::Debug for VerifiedRelayProfile {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("VerifiedRelayProfile")
-            .field("identity", &"[REDACTED]")
-            .field("purpose", &"[REDACTED]")
-            .field("input", &"[REDACTED]")
-            .field("output", &"[REDACTED]")
-            .field("provenance", &"[REDACTED]")
-            .finish()
-    }
-}
-
-enum VerifiedRelayResult {
-    OutputMap(BTreeMap<String, NotaryRelayOutputContract>),
-}
-
-impl VerifiedRelayResult {
-    fn expected(&self) -> RelayExpectedResult {
-        let Self::OutputMap(outputs) = self;
-        RelayExpectedResult::OutputMap(outputs.clone())
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum RelayAcquisitionClass {
-    SourceProjectedExact,
-    BoundedFullRecord,
-    MaterializedSnapshot,
-}
-
-/// Closed Relay outcome.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum RelayConsultationOutcome {
-    Match,
-    NoMatch,
-    Ambiguous,
-}
-
-/// Match-only output contract verified against the pinned Relay profile.
-pub(crate) enum RelayMatchData {
-    OutputMap(RelayOutputMap),
-}
-
-pub(crate) struct RelayOutputMap {
-    fields: BTreeMap<Box<str>, ProjectedJsonScalar>,
-}
-
-impl RelayOutputMap {
-    pub(crate) fn fields(&self) -> impl ExactSizeIterator<Item = (&str, &ProjectedJsonScalar)> {
-        self.fields
-            .iter()
-            .map(|(name, value)| (name.as_ref(), value))
-    }
-}
-
-impl fmt::Debug for RelayOutputMap {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("RelayOutputMap")
-            .field("fields", &"[REDACTED]")
-            .finish()
-    }
-}
-
-impl fmt::Debug for RelayMatchData {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str("RelayMatchData([REDACTED])")
-    }
-}
-
-/// Relay observation outputs bound to one completed consultation.
-pub struct RelayConsultationProvenance {
-    acquired_at: OffsetDateTime,
-}
-
-impl RelayConsultationProvenance {
-    #[must_use]
-    pub const fn acquired_at(&self) -> OffsetDateTime {
-        self.acquired_at
-    }
-}
-
-impl fmt::Debug for RelayConsultationProvenance {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("RelayConsultationProvenance")
-            .field("outputs", &"[REDACTED]")
-            .finish()
-    }
-}
-
-/// Strictly validated Relay consultation result.
-pub struct RelayConsultationResult {
-    consultation_id: Ulid,
-    outcome: RelayConsultationOutcome,
-    match_data: Option<RelayMatchData>,
-    provenance: RelayConsultationProvenance,
-}
-
-impl RelayConsultationResult {
-    #[must_use]
-    pub const fn consultation_id(&self) -> Ulid {
-        self.consultation_id
-    }
-
-    #[must_use]
-    pub const fn outcome(&self) -> RelayConsultationOutcome {
-        self.outcome
-    }
-
-    #[must_use]
-    pub(crate) const fn match_data(&self) -> Option<&RelayMatchData> {
-        self.match_data.as_ref()
-    }
-
-    #[must_use]
-    pub const fn provenance(&self) -> &RelayConsultationProvenance {
-        &self.provenance
-    }
-}
-
-impl fmt::Debug for RelayConsultationResult {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("RelayConsultationResult")
-            .field("consultation_id", &"[REDACTED]")
-            .field("outcome", &self.outcome)
-            .field("outputs", &"[REDACTED]")
-            .field("provenance", &"[REDACTED]")
-            .finish()
-    }
-}
-
-/// Closed, value-free client failures.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
-pub enum RelayClientError {
-    #[error("Relay client configuration is invalid")]
-    InvalidConfiguration,
-    #[error("Relay workload credential is unavailable")]
-    CredentialUnavailable,
-    #[error("Relay operation capacity is unavailable")]
-    CapacityUnavailable,
-    #[error("Relay transport is unavailable")]
-    TransportUnavailable,
-    #[error("Relay rejected its client credentials")]
-    InvalidCredentials,
-    #[error("Relay denied the consultation")]
-    Denied,
-    #[error("Relay consultation profile was not found")]
-    ProfileNotFound,
-    #[error("Relay consultation contract does not match the pinned contract")]
-    ContractMismatch,
-    #[error("Relay rate-limited the consultation")]
-    RateLimited,
-    #[error("Relay consultation service is unavailable")]
-    Unavailable,
-    #[error("Relay returned an unexpected HTTP status")]
-    UnexpectedStatus,
-    #[error("Relay profile metadata is invalid")]
-    InvalidProfileMetadata,
-    #[error("Relay consultation request is invalid")]
-    InvalidRequest,
-    #[error("Relay consultation result is invalid")]
-    InvalidResult,
-}
-
-struct ExecuteRequestBody<'a> {
-    contract_hash: &'a str,
-    inputs: &'a BTreeMap<String, Zeroizing<String>>,
-    input_types: &'a BTreeMap<String, VerifiedInputType>,
-}
-
-impl Serialize for ExecuteRequestBody<'_> {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        let mut root = serializer.serialize_struct("ConsultationExecuteRequest", 2)?;
-        root.serialize_field("contract_hash", self.contract_hash)?;
-        root.serialize_field("inputs", &SerializableInputs(self.inputs, self.input_types))?;
-        root.end()
-    }
-}
-
-struct SerializableInputs<'a>(
-    &'a BTreeMap<String, Zeroizing<String>>,
-    &'a BTreeMap<String, VerifiedInputType>,
-);
-
-impl Serialize for SerializableInputs<'_> {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        let mut map = serializer.serialize_map(Some(self.0.len()))?;
-        for (name, value) in self.0 {
-            let input_type = self
-                .1
-                .get(name)
-                .ok_or_else(|| serde::ser::Error::custom("verified input type is absent"))?;
-            map.serialize_entry(
-                name,
-                &SerializableInputValue {
-                    value,
-                    input_type: *input_type,
-                },
-            )?;
-        }
-        map.end()
-    }
-}
-
-struct SerializableInputValue<'a> {
-    value: &'a str,
-    input_type: VerifiedInputType,
-}
-
-impl Serialize for SerializableInputValue<'_> {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        match self.input_type {
-            VerifiedInputType::String => serializer.serialize_str(self.value),
-            VerifiedInputType::Boolean => match self.value {
-                "true" => serializer.serialize_bool(true),
-                "false" => serializer.serialize_bool(false),
-                _ => Err(serde::ser::Error::custom(
-                    "Boolean consultation input is not canonical",
-                )),
-            },
-            VerifiedInputType::Integer => self
-                .value
-                .parse::<i64>()
-                .ok()
-                .filter(|value| value.to_string() == self.value)
-                .ok_or_else(|| {
-                    serde::ser::Error::custom("Integer consultation input is not canonical")
-                })?
-                .serialize(serializer),
-        }
-    }
-}
-
-fn valid_wire_input(value: &str, input_type: VerifiedInputType) -> bool {
-    match input_type {
-        VerifiedInputType::String => true,
-        VerifiedInputType::Boolean => matches!(value, "true" | "false"),
-        VerifiedInputType::Integer => value
-            .parse::<i64>()
-            .is_ok_and(|parsed| parsed.to_string() == value),
-    }
-}
-
-// The remainder of this module compiles the exact consultation-v1 result
-// schema into the platform decoder. No unvalidated response bytes cross this
-// boundary.
-
-fn result_decoder(profile: &VerifiedRelayProfile) -> Result<ClosedJsonDecoder, RelayClientError> {
-    let VerifiedRelayResult::OutputMap(outputs) = &profile.result;
-    let output_fields = if outputs.is_empty() {
-        vec![field(
-            "__registry_notary_empty_output_sentinel",
-            false,
-            ClosedJsonSchema::boolean(false),
-        )?]
-    } else {
-        outputs
-            .iter()
-            .map(|(name, output)| field(name, true, relay_output_schema(output)?))
-            .collect::<Result<Vec<_>, RelayClientError>>()?
-    };
-    let outputs_schema = object(true, output_fields)?;
-    let mut provenance_fields = vec![
-        field("acquired_at", true, string(false, 64)?)?,
-        field("source_observed_at", true, string(true, 64)?)?,
-        field("source_revision", true, string(true, 128)?)?,
-        field("acquisition_class", true, string(false, 32)?)?,
-        field(
-            "integration",
-            true,
-            object(
-                false,
-                vec![
-                    field("id", true, string(false, PROFILE_ID_MAX_BYTES as u32)?)?,
-                    field(
-                        "revision",
-                        true,
-                        ClosedJsonSchema::integer(false, 1, MAX_JSON_INTEROPERABLE_INTEGER as i64)
-                            .map_err(|_| RelayClientError::InvalidConfiguration)?,
-                    )?,
-                ],
-            )?,
-        )?,
-    ];
-    provenance_fields.push(field(
-        "snapshot",
-        false,
-        object(
-            false,
-            vec![
-                field("generation_id", true, string(true, 128)?)?,
-                field("published_at", true, string(true, 64)?)?,
-            ],
-        )?,
-    )?);
-    let provenance = object(false, provenance_fields)?;
-    let schema = object(
-        false,
-        vec![
-            field("schema", true, string(false, 64)?)?,
-            field("consultation_id", true, string(false, 26)?)?,
-            field("notary_evaluation_id", true, string(false, 26)?)?,
-            field(
-                "profile",
-                true,
-                object(
-                    false,
-                    vec![
-                        field("id", true, string(false, PROFILE_ID_MAX_BYTES as u32)?)?,
-                        field("contract_hash", true, string(false, HASH_BYTES as u32)?)?,
-                    ],
-                )?,
-            )?,
-            field("outcome", true, string(false, 16)?)?,
-            field("outputs", false, outputs_schema)?,
-            field("provenance", true, provenance)?,
-        ],
-    )?;
-    let mut projections = vec![
-        projection("r00", &["schema"])?,
-        projection("r01", &["consultation_id"])?,
-        projection("r02", &["notary_evaluation_id"])?,
-        projection("r03", &["profile", "id"])?,
-        projection("r05", &["profile", "contract_hash"])?,
-        projection("r06", &["outcome"])?,
-        projection("r07", &["provenance", "acquired_at"])?,
-        projection("r08", &["provenance", "source_observed_at"])?,
-        projection("r09", &["provenance", "source_revision"])?,
-        projection("r10", &["provenance", "acquisition_class"])?,
-        projection("r11", &["provenance", "integration", "id"])?,
-        projection("r12", &["provenance", "integration", "revision"])?,
-        projection("r13", &["provenance", "snapshot", "generation_id"])?,
-        projection("r14", &["provenance", "snapshot", "published_at"])?,
-    ];
-    let mut presence = Vec::new();
-    let output_projection_offset = 15;
-    let VerifiedRelayResult::OutputMap(outputs) = &profile.result;
-    for (index, name) in outputs.keys().enumerate() {
-        projections.push(projection(
-            &format!("r{:02}", output_projection_offset + index),
-            &["outputs", name],
-        )?);
-    }
-    presence.push(
-        ClosedJsonPresenceProjection::new(
-            &format!("r{:02}", output_projection_offset + outputs.len()),
-            ["outputs"],
-        )
-        .map_err(|_| RelayClientError::InvalidConfiguration)?,
-    );
-    presence.push(
-        ClosedJsonPresenceProjection::new("z00", ["provenance", "snapshot"])
-            .map_err(|_| RelayClientError::InvalidConfiguration)?,
-    );
-    ClosedJsonDecoder::new_with_presence(
-        schema,
-        ClosedJsonRecordRoot::Object,
-        projections,
-        presence,
-    )
-    .map_err(|_| RelayClientError::InvalidConfiguration)
-}
-
-fn relay_output_schema(
-    output: &NotaryRelayOutputContract,
-) -> Result<ClosedJsonSchema, RelayClientError> {
-    match output {
-        NotaryRelayOutputContract::Boolean { nullable } => Ok(ClosedJsonSchema::boolean(*nullable)),
-        NotaryRelayOutputContract::Integer {
-            nullable,
-            minimum,
-            maximum,
-        } => ClosedJsonSchema::integer(*nullable, *minimum, *maximum)
-            .map_err(|_| RelayClientError::InvalidConfiguration),
-        NotaryRelayOutputContract::String {
-            nullable,
-            max_bytes,
-        } => string(*nullable, *max_bytes),
-        NotaryRelayOutputContract::Date { nullable } => string(*nullable, 10),
-        NotaryRelayOutputContract::Object {
-            nullable, fields, ..
-        } => object(
-            *nullable,
-            fields
-                .iter()
-                .map(|(name, field_contract)| {
-                    field(
-                        name,
-                        field_contract.required,
-                        relay_output_schema(&field_contract.schema)?,
-                    )
-                })
-                .collect::<Result<Vec<_>, RelayClientError>>()?,
-        ),
-        NotaryRelayOutputContract::Array {
-            nullable,
-            max_items,
-            items,
-            ..
-        } => ClosedJsonSchema::array(*nullable, *max_items, relay_output_schema(items)?)
-            .map_err(|_| RelayClientError::InvalidConfiguration),
-    }
-}
-
-fn parse_result(
-    fields: Box<[ProjectedJsonField]>,
-    evaluation_id: &str,
-    profile: &VerifiedRelayProfile,
-) -> Result<RelayConsultationResult, RelayClientError> {
-    let mut fields = FieldCursor::new(fields, RelayClientError::InvalidResult);
-    fields.require_string(RESULT_SCHEMA)?;
-    let consultation_id_text = fields.string()?;
-    let consultation_id = Ulid::from_string(&consultation_id_text)
-        .ok()
-        .filter(|id| id.to_string() == consultation_id_text.as_str())
-        .ok_or(RelayClientError::InvalidResult)?;
-    fields.require_string(evaluation_id)?;
-    fields.require_string(profile.pin.id())?;
-    fields.require_string(profile.pin.contract_hash())?;
-    let outcome = match fields.string()?.as_str() {
-        "match" => RelayConsultationOutcome::Match,
-        "no_match" => RelayConsultationOutcome::NoMatch,
-        "ambiguous" => RelayConsultationOutcome::Ambiguous,
-        _ => return Err(RelayClientError::InvalidResult),
-    };
-    let acquired_at_text = fields.string()?;
-    let acquired_at = OffsetDateTime::parse(&acquired_at_text, &Rfc3339)
-        .map_err(|_| RelayClientError::InvalidResult)?;
-    if acquired_at.unix_timestamp_nanos() <= 0 {
-        return Err(RelayClientError::InvalidResult);
-    }
-    let source_observed_at = match fields.scalar()? {
-        ProjectedJsonScalar::String(value) => {
-            let observed_at = OffsetDateTime::parse(&value, &Rfc3339)
-                .map_err(|_| RelayClientError::InvalidResult)?;
-            if observed_at.unix_timestamp_nanos() <= 0 || observed_at > acquired_at {
-                return Err(RelayClientError::InvalidResult);
-            }
-            Some(observed_at)
-        }
-        ProjectedJsonScalar::Null => None,
-        _ => return Err(RelayClientError::InvalidResult),
-    };
-    let source_revision_present = match fields.scalar()? {
-        ProjectedJsonScalar::String(value) => {
-            if value.is_empty() || value.len() > 128 {
-                return Err(RelayClientError::InvalidResult);
-            }
-            true
-        }
-        ProjectedJsonScalar::Null => false,
-        _ => return Err(RelayClientError::InvalidResult),
-    };
-    let acquisition_class = match fields.string()?.as_str() {
-        "source_projected_exact" => RelayAcquisitionClass::SourceProjectedExact,
-        "bounded_full_record" => RelayAcquisitionClass::BoundedFullRecord,
-        "materialized_snapshot" => RelayAcquisitionClass::MaterializedSnapshot,
-        _ => return Err(RelayClientError::InvalidResult),
-    };
-    let integration_id = fields.string()?;
-    let integration_revision = fields.integer()?;
-    if integration_id.as_str() != profile.semantics.integration_id.as_ref()
-        || integration_revision != profile.semantics.integration_revision
-    {
-        return Err(RelayClientError::InvalidResult);
-    }
-    let snapshot = match (fields.scalar()?, fields.scalar()?) {
-        (ProjectedJsonScalar::String(generation_id), ProjectedJsonScalar::String(published_at)) => {
-            if generation_id.is_empty() {
-                return Err(RelayClientError::InvalidResult);
-            }
-            let published_at = OffsetDateTime::parse(&published_at, &Rfc3339)
-                .map_err(|_| RelayClientError::InvalidResult)?;
-            if published_at.unix_timestamp_nanos() <= 0 || published_at > acquired_at {
-                return Err(RelayClientError::InvalidResult);
-            }
-            Some(())
-        }
-        (ProjectedJsonScalar::Null, ProjectedJsonScalar::Null) => None,
-        _ => return Err(RelayClientError::InvalidResult),
-    };
-    let VerifiedRelayResult::OutputMap(outputs) = &profile.result;
-    let projected = outputs
-        .iter()
-        .map(|(name, output)| {
-            let value = fields.scalar()?;
-            let valid = if outcome == RelayConsultationOutcome::Match {
-                relay_output_value_valid(output, &value)
-            } else {
-                matches!(value, ProjectedJsonScalar::Null)
-            };
-            if !valid {
-                return Err(RelayClientError::InvalidResult);
-            }
-            Ok((name.clone().into_boxed_str(), value))
-        })
-        .collect::<Result<BTreeMap<_, _>, RelayClientError>>()?;
-    let outputs_present = fields.boolean()?;
-    let match_data = match (outcome, outputs_present) {
-        (RelayConsultationOutcome::Match, true) => {
-            Some(RelayMatchData::OutputMap(RelayOutputMap {
-                fields: projected,
-            }))
-        }
-        (RelayConsultationOutcome::NoMatch | RelayConsultationOutcome::Ambiguous, false)
-            if projected
-                .values()
-                .all(|value| matches!(value, ProjectedJsonScalar::Null)) =>
-        {
-            None
-        }
-        _ => return Err(RelayClientError::InvalidResult),
-    };
-    let snapshot_present = fields.boolean()?;
-    match (acquisition_class, snapshot_present, snapshot.is_some()) {
-        (RelayAcquisitionClass::MaterializedSnapshot, true, true)
-        | (
-            RelayAcquisitionClass::SourceProjectedExact | RelayAcquisitionClass::BoundedFullRecord,
-            false,
-            false,
-        ) => {}
-        _ => return Err(RelayClientError::InvalidResult),
-    }
-    let expected_acquisition = match profile.semantics.acquisition_class {
-        VerifiedAcquisitionClass::SourceProjectedExact => {
-            RelayAcquisitionClass::SourceProjectedExact
-        }
-        VerifiedAcquisitionClass::BoundedFullRecord => RelayAcquisitionClass::BoundedFullRecord,
-        VerifiedAcquisitionClass::MaterializedSnapshot => {
-            RelayAcquisitionClass::MaterializedSnapshot
-        }
-    };
-    if acquisition_class != expected_acquisition
-        || !source_field_matches(
-            &profile.semantics.source_observed_at,
-            source_observed_at.is_some(),
-        )
-        || !source_field_matches(&profile.semantics.source_revision, source_revision_present)
-    {
-        return Err(RelayClientError::InvalidResult);
-    }
-    if !fields.exhausted() {
-        return Err(RelayClientError::InvalidResult);
-    }
-
-    Ok(RelayConsultationResult {
-        consultation_id,
-        outcome,
-        match_data,
-        provenance: RelayConsultationProvenance { acquired_at },
-    })
-}
-
-fn source_field_matches(expected: &VerifiedSourceField, present: bool) -> bool {
-    matches!(
-        (expected, present),
-        (VerifiedSourceField::Absent, false) | (VerifiedSourceField::Required, true)
-    )
-}
-
-fn relay_output_value_valid(
-    output: &NotaryRelayOutputContract,
-    value: &ProjectedJsonScalar,
-) -> bool {
-    match (output, value) {
-        (NotaryRelayOutputContract::Boolean { .. }, ProjectedJsonScalar::Boolean(_))
-        | (NotaryRelayOutputContract::Integer { .. }, ProjectedJsonScalar::Integer(_))
-        | (NotaryRelayOutputContract::String { .. }, ProjectedJsonScalar::String(_)) => true,
-        (NotaryRelayOutputContract::Date { .. }, ProjectedJsonScalar::String(value)) => {
-            is_rfc3339_full_date(value)
-        }
-        (
-            output @ (NotaryRelayOutputContract::Object { max_bytes, .. }
-            | NotaryRelayOutputContract::Array { max_bytes, .. }),
-            ProjectedJsonScalar::CanonicalJson(value),
-        ) => {
-            value.len() <= *max_bytes as usize
-                && serde_json::from_slice::<Value>(value)
-                    .is_ok_and(|value| output.validates_value(&value))
-        }
-        (output, ProjectedJsonScalar::Null) => output.nullable(),
-        _ => false,
-    }
-}
-
-struct FieldCursor {
-    fields: std::vec::IntoIter<ProjectedJsonField>,
-    error: RelayClientError,
-}
-
-impl FieldCursor {
-    fn new(fields: Box<[ProjectedJsonField]>, error: RelayClientError) -> Self {
-        Self {
-            fields: Vec::from(fields).into_iter(),
-            error,
-        }
-    }
-
-    fn scalar(&mut self) -> Result<ProjectedJsonScalar, RelayClientError> {
-        let (_, value) = self
-            .fields
-            .next()
-            .map(ProjectedJsonField::into_parts)
-            .ok_or(self.error)?;
-        Ok(value)
-    }
-
-    fn string(&mut self) -> Result<Zeroizing<String>, RelayClientError> {
-        match self.scalar()? {
-            ProjectedJsonScalar::String(value) => Ok(value),
-            _ => Err(self.error),
-        }
-    }
-
-    fn boolean(&mut self) -> Result<bool, RelayClientError> {
-        match self.scalar()? {
-            ProjectedJsonScalar::Boolean(value) => Ok(value),
-            _ => Err(self.error),
-        }
-    }
-
-    fn integer(&mut self) -> Result<i64, RelayClientError> {
-        match self.scalar()? {
-            ProjectedJsonScalar::Integer(value) => Ok(value),
-            _ => Err(self.error),
-        }
-    }
-
-    fn require_string(&mut self, expected: &str) -> Result<(), RelayClientError> {
-        (self.string()?.as_str() == expected)
-            .then_some(())
-            .ok_or(self.error)
-    }
-
-    fn exhausted(&self) -> bool {
-        self.fields.as_slice().is_empty()
-    }
-}
-
-fn object(
-    nullable: bool,
-    fields: Vec<ClosedJsonField>,
-) -> Result<ClosedJsonSchema, RelayClientError> {
-    ClosedJsonSchema::object(nullable, fields).map_err(|_| RelayClientError::InvalidConfiguration)
-}
-
-fn string(nullable: bool, max_bytes: u32) -> Result<ClosedJsonSchema, RelayClientError> {
-    ClosedJsonSchema::string(nullable, max_bytes)
-        .map_err(|_| RelayClientError::InvalidConfiguration)
-}
-
-fn field(
-    name: &str,
-    required: bool,
-    schema: ClosedJsonSchema,
-) -> Result<ClosedJsonField, RelayClientError> {
-    ClosedJsonField::new(name, required, schema).map_err(|_| RelayClientError::InvalidConfiguration)
-}
-
-fn projection(name: &str, tokens: &[&str]) -> Result<ClosedJsonScalarProjection, RelayClientError> {
-    ClosedJsonScalarProjection::new(name, tokens.iter().copied())
-        .map_err(|_| RelayClientError::InvalidConfiguration)
-}
-
-async fn read_token_file(
-    path: PathBuf,
-    permit: OwnedSemaphorePermit,
-) -> Result<Zeroizing<Vec<u8>>, RelayClientError> {
-    tokio::task::spawn_blocking(move || {
-        let _permit = permit;
-        read_token_file_blocking(&path)
-    })
-    .await
-    .map_err(|_| RelayClientError::CredentialUnavailable)?
-}
-
-fn read_token_file_blocking(path: &Path) -> Result<Zeroizing<Vec<u8>>, RelayClientError> {
-    let file = open_token_file(path).map_err(|_| RelayClientError::CredentialUnavailable)?;
-    let metadata = file
-        .metadata()
-        .map_err(|_| RelayClientError::CredentialUnavailable)?;
-    if !metadata.is_file() {
-        return Err(RelayClientError::CredentialUnavailable);
-    }
-    if metadata.len() > MAX_TOKEN_FILE_BYTES as u64 {
-        return Err(RelayClientError::InvalidCredentials);
-    }
-    let mut token = Zeroizing::new(Vec::with_capacity(
-        usize::try_from(metadata.len()).unwrap_or(MAX_TOKEN_FILE_BYTES),
-    ));
-    file.take((MAX_TOKEN_FILE_BYTES + 1) as u64)
-        .read_to_end(&mut token)
-        .map_err(|_| RelayClientError::CredentialUnavailable)?;
-    if token.len() > MAX_TOKEN_FILE_BYTES {
-        return Err(RelayClientError::InvalidCredentials);
-    }
-    trim_one_line_ending(&mut token);
-    if token.is_empty() || token.len() > TOKEN_MAX_BYTES {
-        return Err(RelayClientError::InvalidCredentials);
-    }
-    Ok(token)
-}
-
-#[cfg(unix)]
-fn open_token_file(path: &Path) -> std::io::Result<File> {
-    use rustix::fs::{Mode, OFlags};
-
-    // O_NONBLOCK makes opening a FIFO or device return promptly. We follow
-    // symlinks so the conventional `..data`/atomic-symlink secret rotation
-    // pattern remains supported, then fstat the opened descriptor and reject
-    // every non-regular target before reading it.
-    let descriptor = rustix::fs::open(
-        path,
-        OFlags::RDONLY | OFlags::CLOEXEC | OFlags::NONBLOCK,
-        Mode::empty(),
-    )
-    .map_err(std::io::Error::from)?;
-    Ok(File::from(descriptor))
-}
-
-#[cfg(not(unix))]
-fn open_token_file(path: &Path) -> std::io::Result<File> {
-    // Supported production targets use the nonblocking Unix path. Other
-    // targets still perform the same post-open regular-file and size checks.
-    File::open(path)
-}
-
-fn trim_one_line_ending(value: &mut Vec<u8>) {
-    if value.ends_with(b"\r\n") {
-        value.truncate(value.len() - 2);
-    } else if value.ends_with(b"\n") || value.ends_with(b"\r") {
-        value.truncate(value.len() - 1);
-    }
-}
-
-fn validate_compact_jws(token: &[u8]) -> Result<(), RelayClientError> {
-    let mut segments = token.split(|byte| *byte == b'.');
-    let header = segments
-        .next()
-        .ok_or(RelayClientError::InvalidCredentials)?;
-    let claims = segments
-        .next()
-        .ok_or(RelayClientError::InvalidCredentials)?;
-    let signature = segments
-        .next()
-        .ok_or(RelayClientError::InvalidCredentials)?;
-    if segments.next().is_some()
-        || !valid_base64url_segment(header)
-        || !valid_base64url_segment(claims)
-        || !valid_base64url_segment(signature)
-    {
-        return Err(RelayClientError::InvalidCredentials);
-    }
-    Ok(())
-}
-
-fn valid_base64url_segment(segment: &[u8]) -> bool {
-    !segment.is_empty()
-        && segment.len() % 4 != 1
-        && segment
-            .iter()
-            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
-}
-
-async fn authorization_before_deadline(
-    credential: &RelayWorkloadCredentialFile,
-    deadline: Instant,
-) -> Result<DestinationAuthorizationValue, RelayClientError> {
-    timeout_at(deadline, credential.authorization())
-        .await
-        .map_err(|_| RelayClientError::Unavailable)?
-}
-
-fn operation_deadline() -> Result<Instant, RelayClientError> {
-    Instant::now()
-        .checked_add(MAX_SERVICE_HOP_OPERATION_TIMEOUT)
-        .ok_or(RelayClientError::InvalidConfiguration)
-}
-
-fn require_deadline(deadline: Instant) -> Result<(), RelayClientError> {
-    if Instant::now() >= deadline {
-        Err(RelayClientError::Unavailable)
-    } else {
-        Ok(())
-    }
-}
-
-fn map_send_error(error: DestinationSendError) -> RelayClientError {
-    match error {
-        DestinationSendError::DeadlineExceeded => RelayClientError::Unavailable,
-        _ => RelayClientError::TransportUnavailable,
-    }
-}
-
-fn map_response_error(
-    error: DestinationResponseError,
-    otherwise: RelayClientError,
-) -> RelayClientError {
-    match error {
-        DestinationResponseError::DeadlineExceeded => RelayClientError::Unavailable,
-        _ => otherwise,
-    }
-}
-
-fn require_success(status: StatusCode) -> Result<(), RelayClientError> {
-    match status {
-        StatusCode::OK => Ok(()),
-        StatusCode::BAD_REQUEST => Err(RelayClientError::InvalidRequest),
-        StatusCode::UNAUTHORIZED => Err(RelayClientError::InvalidCredentials),
-        StatusCode::FORBIDDEN => Err(RelayClientError::Denied),
-        StatusCode::NOT_FOUND => Err(RelayClientError::ProfileNotFound),
-        StatusCode::CONFLICT => Err(RelayClientError::ContractMismatch),
-        StatusCode::TOO_MANY_REQUESTS => Err(RelayClientError::RateLimited),
-        StatusCode::SERVICE_UNAVAILABLE => Err(RelayClientError::Unavailable),
-        _ => Err(RelayClientError::UnexpectedStatus),
-    }
-}
-
-fn stable_id(value: &str, max_bytes: usize) -> bool {
-    let mut bytes = value.bytes();
-    matches!(bytes.next(), Some(b'a'..=b'z'))
-        && value.len() <= max_bytes
-        && bytes.all(|byte| matches!(byte, b'a'..=b'z' | b'0'..=b'9' | b'.' | b'_' | b'-'))
-}
-
-fn output_name(value: &str, max_bytes: usize) -> bool {
-    let mut bytes = value.bytes();
-    matches!(bytes.next(), Some(b'a'..=b'z'))
-        && value.len() <= max_bytes
-        && bytes.all(|byte| matches!(byte, b'a'..=b'z' | b'0'..=b'9' | b'_'))
-}
-
-fn sha256_uri(value: &str) -> bool {
-    value.len() == HASH_BYTES
-        && value.starts_with("sha256:")
-        && value[7..]
-            .bytes()
-            .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
-}
-
-fn valid_purpose(value: &str) -> bool {
-    !value.is_empty()
-        && value.len() <= PURPOSE_MAX_BYTES
-        && !value.contains(',')
-        && value
-            .chars()
-            .all(|character| !character.is_control() && !character.is_whitespace())
-}
-
-fn valid_token_file_path(path: &Path) -> bool {
-    let Some(text) = path.to_str() else {
-        return false;
-    };
-    !text.is_empty()
-        && text.len() <= MAX_TOKEN_FILE_PATH_BYTES
-        && path.is_absolute()
-        && path.file_name().is_some()
-        && path.components().all(|component| {
-            matches!(
-                component,
-                Component::Prefix(_) | Component::RootDir | Component::Normal(_)
-            )
-        })
-}
-
-fn canonical_ulid(value: &str) -> bool {
-    Ulid::from_string(value).is_ok_and(|id| id.to_string() == value)
-}
-
-#[cfg(test)]
-mod tests;
diff --git a/crates/registry-notary-server/src/relay_client/tests.rs b/crates/registry-notary-server/src/relay_client/tests.rs
deleted file mode 100644
index a5fb87866..000000000
--- a/crates/registry-notary-server/src/relay_client/tests.rs
+++ /dev/null
@@ -1,2493 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-use super::*;
-use std::path::PathBuf;
-use std::process::{Command, Output};
-use std::sync::atomic::{AtomicUsize, Ordering};
-use std::sync::Arc;
-use std::time::Duration;
-
-use axum::body::{to_bytes, Body};
-use axum::extract::{Request, State};
-use axum::http::{header, Response, StatusCode};
-use axum::routing::{get, post};
-use axum::Router;
-use axum_test::TestServer;
-use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-use base64::Engine as _;
-use registry_notary_core::StandaloneRegistryNotaryConfig;
-use registry_platform_authcommon::fingerprint_api_key;
-use registry_platform_crypto::canonicalize_json;
-use registry_platform_httputil::destination::{
-    DestinationProfile, ServiceHopDataDestinationPolicy,
-};
-use serde_json::{json, Value};
-use sha2::{Digest, Sha256};
-use tokio::net::TcpListener;
-use tokio::sync::{oneshot, Mutex};
-use tokio::task::JoinHandle;
-use zeroize::Zeroizing;
-
-const PROFILE_ID: &str = "dhis2.tracker.enrollment-status.exact";
-const PURPOSE: &str = "program-enrollment-verification";
-const INPUT_NAME: &str = "tracked_entity";
-const INPUT_VALUE: &str = "PQfMcpmXeFE";
-const OUTPUT_NAME: &str = "status";
-const EXPECTED_ISSUER: &str = "https://issuer.example.test";
-const EXPECTED_AUDIENCE: &str = "registry-relay";
-const EXPECTED_SUBJECT: &str = "registry-notary";
-const EXPECTED_CLIENT_ID: &str = "registry-notary";
-const EXPECTED_SCOPE: &str = "registry:consult:dhis2-enrollment-status";
-const RESULT_SCHEMA: &str = "registry.relay.consultation-result.v1";
-const CONTRACT_DOMAIN: &[u8] = b"registry.relay.consultation-contract.v1\0";
-const MAX_RESULT_BYTES: usize = 64 * 1024;
-const EVALUATION_ID: &str = "01JYZZZZZZZZZZZZZZZZZZZZZZ";
-const CONSULTATION_ID: &str = "01K05H0JKP4VSQNYCZ0TN4D87R";
-const SNAPSHOT_GENERATION_ID: &str = "01K05H0JKP4VSQNYCZ0TN4D87S";
-const PROFILE_ROUTE: &str = "/v1/consultations/dhis2.tracker.enrollment-status.exact";
-const EXECUTE_ROUTE: &str = "/v1/consultations/dhis2.tracker.enrollment-status.exact/execute";
-const NOTARY_API_KEY: &str = "notary-relay-vertical-api-key";
-const NOTARY_API_KEY_HASH_ENV: &str = "REGISTRY_NOTARY_RELAY_VERTICAL_API_KEY_HASH";
-const NOTARY_AUDIT_SECRET_ENV: &str = "REGISTRY_NOTARY_RELAY_VERTICAL_AUDIT_SECRET";
-const TRANSITION_API_KEY_HASH_ENV: &str = "REGISTRY_NOTARY_TRANSITION_API_KEY_HASH";
-const TRANSITION_AUDIT_SECRET_ENV: &str = "REGISTRY_NOTARY_TRANSITION_AUDIT_SECRET";
-const RESTART_API_KEY_HASH_ENV: &str = "REGISTRY_NOTARY_RESTART_API_KEY_HASH";
-const RESTART_AUDIT_SECRET_ENV: &str = "REGISTRY_NOTARY_RESTART_AUDIT_SECRET";
-const ISOLATED_TEST_KIND_ENV: &str = "REGISTRY_NOTARY_RELAY_CLIENT_ISOLATED_TEST_KIND";
-const ASSEMBLED_JOURNEY_KIND: &str = "assembled-notary-relay-journey";
-const BLUE_GREEN_JOURNEY_KIND: &str = "coordinated-blue-green-journey";
-const RESTART_JOURNEY_KIND: &str = "coordinated-restart-journey";
-const ASSEMBLED_JOURNEY_CHILD: &str = "relay_client::tests::assembled_notary_relay_journey_child";
-const BLUE_GREEN_JOURNEY_CHILD: &str = "relay_client::tests::coordinated_blue_green_journey_child";
-const RESTART_JOURNEY_CHILD: &str =
-    "relay_client::tests::coordinated_drain_and_restart_journey_child";
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-enum EvaluationIdMode {
-    Fixed,
-    EchoCanonical,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-enum ObservedOperation {
-    Metadata,
-    Execute,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-struct Observation {
-    operation: ObservedOperation,
-    exact_authorization: bool,
-    exact_accept: bool,
-    exact_content_type: bool,
-    exact_purpose: bool,
-    exact_evaluation_id: bool,
-    has_valid_batch_child_identity: bool,
-    batch_child_identity_absent: bool,
-    exact_body: bool,
-    forbidden_ambient_headers_absent: bool,
-}
-
-#[derive(Clone)]
-struct FakeState {
-    inner: Arc<FakeStateInner>,
-}
-
-struct FakeStateInner {
-    metadata: Mutex<WireResponse>,
-    execute: Mutex<WireResponse>,
-    expected_token: Mutex<String>,
-    observations: Mutex<Vec<Observation>>,
-    metadata_calls: AtomicUsize,
-    execute_calls: AtomicUsize,
-    evaluation_id_mode: EvaluationIdMode,
-}
-
-#[derive(Clone)]
-struct WireResponse {
-    status: StatusCode,
-    body: Vec<u8>,
-    location: Option<&'static str>,
-    content_types: Vec<&'static str>,
-}
-
-impl WireResponse {
-    fn ok(body: Vec<u8>) -> Self {
-        Self {
-            status: StatusCode::OK,
-            body,
-            location: None,
-            content_types: vec!["application/json"],
-        }
-    }
-
-    fn with_content_types(mut self, content_types: Vec<&'static str>) -> Self {
-        self.content_types = content_types;
-        self
-    }
-}
-
-struct FakeRelay {
-    origin: String,
-    state: FakeState,
-    shutdown: Option<oneshot::Sender<()>>,
-    task: JoinHandle<()>,
-}
-
-impl FakeRelay {
-    async fn start(metadata: WireResponse, execute: WireResponse) -> Self {
-        Self::start_with_evaluation_id_mode(metadata, execute, EvaluationIdMode::Fixed).await
-    }
-
-    async fn start_echoing_evaluation_id(metadata: WireResponse, execute: WireResponse) -> Self {
-        Self::start_with_evaluation_id_mode(metadata, execute, EvaluationIdMode::EchoCanonical)
-            .await
-    }
-
-    async fn start_with_evaluation_id_mode(
-        metadata: WireResponse,
-        execute: WireResponse,
-        evaluation_id_mode: EvaluationIdMode,
-    ) -> Self {
-        let state = FakeState {
-            inner: Arc::new(FakeStateInner {
-                metadata: Mutex::new(metadata),
-                execute: Mutex::new(execute),
-                expected_token: Mutex::new(test_token()),
-                observations: Mutex::new(Vec::new()),
-                metadata_calls: AtomicUsize::new(0),
-                execute_calls: AtomicUsize::new(0),
-                evaluation_id_mode,
-            }),
-        };
-        let app = Router::new()
-            .route(PROFILE_ROUTE, get(metadata_handler))
-            .route(EXECUTE_ROUTE, post(execute_handler))
-            .with_state(state.clone());
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let address = listener.local_addr().unwrap();
-        let (shutdown, receiver) = oneshot::channel();
-        let task = tokio::spawn(async move {
-            axum::serve(listener, app)
-                .with_graceful_shutdown(async {
-                    let _ = receiver.await;
-                })
-                .await
-                .unwrap();
-        });
-        Self {
-            origin: format!("http://{address}/"),
-            state,
-            shutdown: Some(shutdown),
-            task,
-        }
-    }
-
-    async fn set_execute(&self, response: WireResponse) {
-        *self.state.inner.execute.lock().await = response;
-    }
-
-    async fn set_metadata(&self, response: WireResponse) {
-        *self.state.inner.metadata.lock().await = response;
-    }
-
-    async fn set_expected_token(&self, token: &str) {
-        *self.state.inner.expected_token.lock().await = token.to_owned();
-    }
-
-    async fn observations(&self) -> Vec<Observation> {
-        self.state.inner.observations.lock().await.clone()
-    }
-
-    fn execute_calls(&self) -> usize {
-        self.state.inner.execute_calls.load(Ordering::SeqCst)
-    }
-
-    fn metadata_calls(&self) -> usize {
-        self.state.inner.metadata_calls.load(Ordering::SeqCst)
-    }
-
-    async fn shutdown(mut self) {
-        if let Some(shutdown) = self.shutdown.take() {
-            let _ = shutdown.send(());
-        }
-        self.task.await.unwrap();
-    }
-}
-
-async fn metadata_handler(State(state): State<FakeState>, request: Request) -> Response<Body> {
-    state.inner.metadata_calls.fetch_add(1, Ordering::SeqCst);
-    let expected_token = state.inner.expected_token.lock().await.clone();
-    let observation =
-        observe_request(ObservedOperation::Metadata, request, &expected_token, None).await;
-    state.inner.observations.lock().await.push(observation);
-    wire_response(state.inner.metadata.lock().await.clone())
-}
-
-async fn execute_handler(State(state): State<FakeState>, request: Request) -> Response<Body> {
-    state.inner.execute_calls.fetch_add(1, Ordering::SeqCst);
-    let expected_token = state.inner.expected_token.lock().await.clone();
-    let evaluation_id = request
-        .headers()
-        .get("registry-notary-evaluation-id")
-        .and_then(|value| value.to_str().ok())
-        .map(str::to_string);
-    let expected_evaluation_id = match state.inner.evaluation_id_mode {
-        EvaluationIdMode::Fixed => Some(EVALUATION_ID),
-        EvaluationIdMode::EchoCanonical => evaluation_id
-            .as_deref()
-            .filter(|value| ulid::Ulid::from_string(value).is_ok()),
-    };
-    let observation = observe_request(
-        ObservedOperation::Execute,
-        request,
-        &expected_token,
-        expected_evaluation_id,
-    )
-    .await;
-    state.inner.observations.lock().await.push(observation);
-    let mut response = state.inner.execute.lock().await.clone();
-    if state.inner.evaluation_id_mode == EvaluationIdMode::EchoCanonical {
-        if let Some(evaluation_id) = expected_evaluation_id {
-            let mut body: Value = serde_json::from_slice(&response.body)
-                .expect("echoing fake Relay result must contain JSON");
-            body["notary_evaluation_id"] = json!(evaluation_id);
-            response.body = serde_json::to_vec(&body).expect("echoed Relay result serializes");
-        }
-    }
-    wire_response(response)
-}
-
-async fn observe_request(
-    operation: ObservedOperation,
-    request: Request,
-    expected_token: &str,
-    expected_evaluation_id: Option<&str>,
-) -> Observation {
-    let headers = request.headers();
-    let exact_authorization = headers
-        .get(header::AUTHORIZATION)
-        .is_some_and(|value| value.as_bytes() == format!("Bearer {expected_token}").as_bytes());
-    let exact_accept = headers
-        .get(header::ACCEPT)
-        .is_some_and(|value| value == "application/json");
-    let exact_content_type = match operation {
-        ObservedOperation::Metadata => !headers.contains_key(header::CONTENT_TYPE),
-        ObservedOperation::Execute => headers
-            .get(header::CONTENT_TYPE)
-            .is_some_and(|value| value == "application/json"),
-    };
-    let exact_purpose = match operation {
-        ObservedOperation::Metadata => !headers.contains_key("data-purpose"),
-        ObservedOperation::Execute => headers
-            .get("data-purpose")
-            .is_some_and(|value| value == PURPOSE),
-    };
-    let exact_evaluation_id = match operation {
-        ObservedOperation::Metadata => !headers.contains_key("registry-notary-evaluation-id"),
-        ObservedOperation::Execute => headers
-            .get("registry-notary-evaluation-id")
-            .is_some_and(|value| expected_evaluation_id.is_some_and(|expected| value == expected)),
-    };
-    let has_valid_batch_child_identity = headers
-        .get("registry-notary-batch-child-id")
-        .and_then(|value| value.to_str().ok())
-        .is_some_and(|value| {
-            value.len() == 43
-                && value
-                    .bytes()
-                    .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
-        });
-    let batch_child_identity_absent = !headers.contains_key("registry-notary-batch-child-id");
-    let forbidden_ambient_headers_absent = [
-        header::COOKIE.as_str(),
-        "forwarded",
-        "x-forwarded-for",
-        "proxy-authorization",
-    ]
-    .iter()
-    .all(|name| !headers.contains_key(*name));
-    let body = to_bytes(request.into_body(), 8 * 1024).await.unwrap();
-    let exact_body = match operation {
-        ObservedOperation::Metadata => body.is_empty(),
-        ObservedOperation::Execute => {
-            let expected = format!(
-                r#"{{"contract_hash":"{}","inputs":{{"tracked_entity":"PQfMcpmXeFE"}}}}"#,
-                contract_hash()
-            );
-            body.as_ref() == expected.as_bytes()
-        }
-    };
-    Observation {
-        operation,
-        exact_authorization,
-        exact_accept,
-        exact_content_type,
-        exact_purpose,
-        exact_evaluation_id,
-        has_valid_batch_child_identity,
-        batch_child_identity_absent,
-        exact_body,
-        forbidden_ambient_headers_absent,
-    }
-}
-
-fn wire_response(response: WireResponse) -> Response<Body> {
-    let mut builder = Response::builder().status(response.status);
-    for content_type in response.content_types {
-        builder = builder.header(header::CONTENT_TYPE, content_type);
-    }
-    if let Some(location) = response.location {
-        builder = builder.header(header::LOCATION, location);
-    }
-    builder.body(Body::from(response.body)).unwrap()
-}
-
-fn contract_value() -> Value {
-    serde_json::from_str(include_str!(
-        "../../../registry-relay/profiles/dhis2-2.41.9-enrollment-status/public-contract.json"
-    ))
-    .unwrap()
-}
-
-fn typed_output_contract_value() -> Value {
-    let mut contract = contract_value();
-    contract["spec"]["output"] = json!({
-        "active": { "type": "boolean", "nullable": false },
-        "birth_date": { "type": "date", "nullable": true },
-        "exists": { "type": "boolean", "nullable": false },
-        "sequence": {
-            "type": "integer",
-            "nullable": false,
-            "minimum": 0,
-            "maximum": 9_007_199_254_740_991_i64
-        },
-        "status": { "type": "string", "nullable": false, "max_bytes": 64 }
-    });
-    contract["spec"]["acquisition"]["fields"] = json!({
-        "active": { "type": "boolean", "nullable": false },
-        "birth_date": { "type": "date", "nullable": true },
-        "sequence": {
-            "type": "integer",
-            "nullable": false,
-            "minimum": 0,
-            "maximum": 9_007_199_254_740_991_i64
-        },
-        "status": { "type": "string", "nullable": false, "max_bytes": 64 }
-    });
-    contract
-}
-
-fn typed_output_expectation() -> RelayExpectedResult {
-    RelayExpectedResult::output_map(BTreeMap::from([
-        (
-            "active".to_string(),
-            NotaryRelayOutputContract::Boolean { nullable: false },
-        ),
-        (
-            "birth_date".to_string(),
-            NotaryRelayOutputContract::Date { nullable: true },
-        ),
-        (
-            "exists".to_string(),
-            NotaryRelayOutputContract::Boolean { nullable: false },
-        ),
-        (
-            "sequence".to_string(),
-            NotaryRelayOutputContract::Integer {
-                nullable: false,
-                minimum: 0,
-                maximum: 9_007_199_254_740_991,
-            },
-        ),
-        (
-            "status".to_string(),
-            NotaryRelayOutputContract::String {
-                nullable: false,
-                max_bytes: 64,
-            },
-        ),
-    ]))
-    .expect("valid typed output expectation")
-}
-
-fn structured_output_contracts() -> BTreeMap<String, NotaryRelayOutputContract> {
-    use registry_notary_core::RelayOutputObjectFieldContract;
-
-    let parent = NotaryRelayOutputContract::Object {
-        nullable: false,
-        max_bytes: 512,
-        fields: BTreeMap::from([
-            (
-                "identifier".to_string(),
-                RelayOutputObjectFieldContract {
-                    required: true,
-                    schema: Box::new(NotaryRelayOutputContract::String {
-                        nullable: false,
-                        max_bytes: 64,
-                    }),
-                },
-            ),
-            (
-                "name".to_string(),
-                RelayOutputObjectFieldContract {
-                    required: true,
-                    schema: Box::new(NotaryRelayOutputContract::String {
-                        nullable: false,
-                        max_bytes: 128,
-                    }),
-                },
-            ),
-            (
-                "type".to_string(),
-                RelayOutputObjectFieldContract {
-                    required: true,
-                    schema: Box::new(NotaryRelayOutputContract::String {
-                        nullable: false,
-                        max_bytes: 32,
-                    }),
-                },
-            ),
-        ]),
-    };
-    BTreeMap::from([
-        (
-            "parents".to_string(),
-            NotaryRelayOutputContract::Array {
-                nullable: false,
-                max_bytes: 2_048,
-                max_items: 4,
-                items: Box::new(parent),
-            },
-        ),
-        (
-            "person".to_string(),
-            NotaryRelayOutputContract::Object {
-                nullable: false,
-                max_bytes: 1_024,
-                fields: BTreeMap::from([
-                    (
-                        "active".to_string(),
-                        RelayOutputObjectFieldContract {
-                            required: true,
-                            schema: Box::new(NotaryRelayOutputContract::Boolean {
-                                nullable: false,
-                            }),
-                        },
-                    ),
-                    (
-                        "name".to_string(),
-                        RelayOutputObjectFieldContract {
-                            required: true,
-                            schema: Box::new(NotaryRelayOutputContract::String {
-                                nullable: false,
-                                max_bytes: 128,
-                            }),
-                        },
-                    ),
-                    (
-                        "tags".to_string(),
-                        RelayOutputObjectFieldContract {
-                            required: false,
-                            schema: Box::new(NotaryRelayOutputContract::Array {
-                                nullable: false,
-                                max_bytes: 256,
-                                max_items: 3,
-                                items: Box::new(NotaryRelayOutputContract::String {
-                                    nullable: false,
-                                    max_bytes: 32,
-                                }),
-                            }),
-                        },
-                    ),
-                ]),
-            },
-        ),
-    ])
-}
-
-fn structured_contract_value() -> Value {
-    let mut contract = contract_value();
-    contract["spec"]["output"] = json!({
-        "parents": {
-            "type": "array",
-            "nullable": false,
-            "max_bytes": 2_048,
-            "max_items": 4,
-            "items": {
-                "type": "object",
-                "nullable": false,
-                "max_bytes": 512,
-                "fields": {
-                    "identifier": {
-                        "required": true,
-                        "schema": { "type": "string", "nullable": false, "max_bytes": 64 }
-                    },
-                    "name": {
-                        "required": true,
-                        "schema": { "type": "string", "nullable": false, "max_bytes": 128 }
-                    },
-                    "type": {
-                        "required": true,
-                        "schema": { "type": "string", "nullable": false, "max_bytes": 32 }
-                    }
-                }
-            }
-        },
-        "person": {
-            "type": "object",
-            "nullable": false,
-            "max_bytes": 1_024,
-            "fields": {
-                "active": {
-                    "required": true,
-                    "schema": { "type": "boolean", "nullable": false }
-                },
-                "name": {
-                    "required": true,
-                    "schema": { "type": "string", "nullable": false, "max_bytes": 128 }
-                },
-                "tags": {
-                    "required": false,
-                    "schema": {
-                        "type": "array",
-                        "nullable": false,
-                        "max_bytes": 256,
-                        "max_items": 3,
-                        "items": { "type": "string", "nullable": false, "max_bytes": 32 }
-                    }
-                }
-            }
-        }
-    });
-    contract
-}
-
-fn structured_result_value(contract_hash: &str) -> Value {
-    let mut result = result_value();
-    result["profile"]["contract_hash"] = json!(contract_hash);
-    result["outputs"] = json!({
-        "parents": [
-            { "type": "mother", "name": "Grace", "identifier": "PARENT-2" },
-            { "identifier": "PARENT-1", "name": "Charles", "type": "father" }
-        ],
-        "person": {
-            "tags": ["citizen", "verified"],
-            "name": "Ada",
-            "active": true
-        }
-    });
-    result
-}
-
-#[test]
-fn output_contract_rejects_reserved_notary_view_names() {
-    for name in ["matched", "outcome", "status.code"] {
-        assert!(matches!(
-            RelayExpectedResult::output_map(BTreeMap::from([(
-                name.to_string(),
-                NotaryRelayOutputContract::Boolean { nullable: false },
-            )])),
-            Err(RelayClientError::InvalidConfiguration)
-        ));
-    }
-}
-
-#[test]
-fn execute_request_serializes_verified_scalar_input_types() {
-    let inputs = BTreeMap::from([
-        ("active".to_string(), Zeroizing::new("true".to_string())),
-        ("name".to_string(), Zeroizing::new("Ada".to_string())),
-        ("sequence".to_string(), Zeroizing::new("42".to_string())),
-    ]);
-    let input_types = BTreeMap::from([
-        (
-            "active".to_string(),
-            crate::relay_contract::VerifiedInputType::Boolean,
-        ),
-        (
-            "name".to_string(),
-            crate::relay_contract::VerifiedInputType::String,
-        ),
-        (
-            "sequence".to_string(),
-            crate::relay_contract::VerifiedInputType::Integer,
-        ),
-    ]);
-    let body = serde_json::to_value(ExecuteRequestBody {
-        contract_hash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        inputs: &inputs,
-        input_types: &input_types,
-    })
-    .expect("verified typed inputs serialize");
-
-    assert_eq!(
-        body["inputs"],
-        json!({ "active": true, "name": "Ada", "sequence": 42 })
-    );
-    assert!(valid_wire_input(
-        "-7",
-        crate::relay_contract::VerifiedInputType::Integer
-    ));
-    assert!(!valid_wire_input(
-        "01",
-        crate::relay_contract::VerifiedInputType::Integer
-    ));
-    assert!(!valid_wire_input(
-        "TRUE",
-        crate::relay_contract::VerifiedInputType::Boolean
-    ));
-}
-
-fn snapshot_contract_value() -> Value {
-    let mut contract = contract_value();
-    contract["spec"]["acquisition"]["class"] = json!("materialized_snapshot");
-    contract["spec"]["bounds"]["max_data_exchanges"] = json!(0);
-    contract["spec"]["bounds"]["max_credential_exchanges"] = json!(0);
-    contract["spec"]["bounds"]["max_data_destinations"] = json!(0);
-    contract["spec"]["materialization"] = json!({
-        "max_snapshot_age_ms": 86_400_000,
-        "stale_behavior": "unavailable",
-        "footprint": {
-            "fields": ["status"],
-            "max_source_records": 1000,
-            "max_source_bytes": 256 * 1_024 * 1_024,
-            "max_data_exchanges": 2,
-            "max_credential_exchanges": 1,
-            "max_data_destinations": 1
-        },
-        "refresh_class": "operator_triggered",
-        "snapshot_retention_generations": 3,
-        "immutable_generation": true,
-        "digest_bound_active_pointer": true
-    });
-    contract["spec"]["runtime"] = json!({
-        "platform_profile": "registry-stack.consultation.v1",
-        "source_capability": "snapshot",
-        "script_abi": null
-    });
-    contract
-}
-
-fn metadata_value_for_contract(contract: &Value, contract_hash: &str) -> Value {
-    json!({
-        "contract_hash": contract_hash,
-        "contract": contract,
-    })
-}
-
-fn metadata_value() -> Value {
-    let contract = contract_value();
-    let contract_hash = typed_hash(CONTRACT_DOMAIN, &contract);
-    metadata_value_for_contract(&contract, &contract_hash)
-}
-
-fn metadata_response() -> WireResponse {
-    WireResponse::ok(serde_json::to_vec(&metadata_value()).unwrap())
-}
-
-fn typed_hash(domain: &[u8], value: &Value) -> String {
-    let canonical = canonicalize_json(value).unwrap();
-    let mut hasher = Sha256::new();
-    hasher.update(domain);
-    hasher.update(canonical);
-    let mut encoded = String::from("sha256:");
-    for byte in hasher.finalize() {
-        use std::fmt::Write as _;
-        write!(&mut encoded, "{byte:02x}").unwrap();
-    }
-    encoded
-}
-
-fn contract_hash() -> String {
-    typed_hash(CONTRACT_DOMAIN, &contract_value())
-}
-
-fn result_value() -> Value {
-    let contract_hash = contract_hash();
-    json!({
-        "schema": RESULT_SCHEMA,
-        "consultation_id": CONSULTATION_ID,
-        "notary_evaluation_id": EVALUATION_ID,
-        "profile": {
-            "id": PROFILE_ID,
-            "contract_hash": contract_hash,
-        },
-        "outcome": "match",
-        "outputs": { "status": "ACTIVE" },
-        "provenance": {
-            "acquired_at": "2026-07-12T00:00:00Z",
-            "source_observed_at": null,
-            "source_revision": null,
-            "acquisition_class": "source_projected_exact",
-            "integration": {
-                "id": "dhis2.tracker.enrollment-status",
-                "revision": 1
-            }
-        }
-    })
-}
-
-fn snapshot_result_value(contract_hash: &str) -> Value {
-    let mut result = result_value();
-    result["profile"]["contract_hash"] = json!(contract_hash);
-    result["provenance"]["acquisition_class"] = json!("materialized_snapshot");
-    result["provenance"]["snapshot"] = json!({
-        "generation_id": SNAPSHOT_GENERATION_ID,
-        "published_at": "2026-07-11T23:59:00Z"
-    });
-    result
-}
-
-fn result_response() -> WireResponse {
-    WireResponse::ok(serde_json::to_vec(&result_value()).unwrap())
-}
-
-fn result_response_for_contract_hash(contract_hash: &str) -> WireResponse {
-    let mut result = result_value();
-    result["profile"]["contract_hash"] = json!(contract_hash);
-    WireResponse::ok(serde_json::to_vec(&result).unwrap())
-}
-
-fn successor_contract_value() -> Value {
-    let mut contract = contract_value();
-    contract["spec"]["bounds"]["timeout_ms"] = json!(4_999);
-    contract
-}
-
-fn metadata_response_for_contract(contract: &Value, contract_hash: &str) -> WireResponse {
-    WireResponse::ok(
-        serde_json::to_vec(&metadata_value_for_contract(contract, contract_hash)).unwrap(),
-    )
-}
-
-fn test_claims() -> Value {
-    json!({
-        "iss": EXPECTED_ISSUER,
-        "aud": [EXPECTED_AUDIENCE, "registry-operations"],
-        "sub": EXPECTED_SUBJECT,
-        "azp": EXPECTED_CLIENT_ID,
-        "client_id": EXPECTED_CLIENT_ID,
-        "scope": format!("registry:read {EXPECTED_SCOPE} registry:audit"),
-        "iat": 1_700_000_000_i64,
-        "nbf": 1_700_000_000_i64,
-        "exp": 4_102_444_800_i64,
-        "jti": "relay-test-token-1",
-        "tenant": { "id": "test-project" },
-    })
-}
-
-fn token_for_claims(claims: &Value) -> String {
-    token_for_claims_and_signature(claims, b"relay-test-signature-SENSITIVE")
-}
-
-fn token_for_claims_and_signature(claims: &Value, signature: &[u8]) -> String {
-    let header = json!({
-        "alg": "RS256",
-        "kid": "relay-test-key",
-        "typ": "at+jwt",
-        "x5t": "relay-test-thumbprint",
-    });
-    format!(
-        "{}.{}.{}",
-        URL_SAFE_NO_PAD.encode(serde_json::to_vec(&header).unwrap()),
-        URL_SAFE_NO_PAD.encode(serde_json::to_vec(claims).unwrap()),
-        URL_SAFE_NO_PAD.encode(signature),
-    )
-}
-
-fn test_token() -> String {
-    token_for_claims(&test_claims())
-}
-
-struct TestTokenFile {
-    _directory: tempfile::TempDir,
-    path: PathBuf,
-}
-
-impl TestTokenFile {
-    fn new(token: &str) -> Self {
-        let directory = tempfile::tempdir().unwrap();
-        let path = directory.path().join("relay.jwt");
-        std::fs::write(&path, token.as_bytes()).unwrap();
-        Self {
-            _directory: directory,
-            path,
-        }
-    }
-
-    fn replace(&self, token: &str) {
-        let replacement = self.path.with_extension("jwt.next");
-        std::fs::write(&replacement, token.as_bytes()).unwrap();
-        std::fs::rename(replacement, &self.path).unwrap();
-    }
-
-    fn remove(&self) {
-        std::fs::remove_file(&self.path).unwrap();
-    }
-
-    fn credential(&self) -> RelayWorkloadCredentialFile {
-        RelayWorkloadCredentialFile::new(self.path.clone()).unwrap()
-    }
-}
-
-fn client_with_hash(
-    server: &FakeRelay,
-    token_file: &TestTokenFile,
-    contract_hash: &str,
-) -> RelayConsultationClient {
-    client_with_result(
-        server,
-        token_file,
-        contract_hash,
-        RelayExpectedResult::output_map(BTreeMap::from([(
-            OUTPUT_NAME.to_string(),
-            NotaryRelayOutputContract::String {
-                nullable: false,
-                max_bytes: 32,
-            },
-        )]))
-        .unwrap(),
-    )
-}
-
-fn client_with_result(
-    server: &FakeRelay,
-    token_file: &TestTokenFile,
-    contract_hash: &str,
-    expected_result: RelayExpectedResult,
-) -> RelayConsultationClient {
-    let destination = ServiceHopDataDestinationPolicy::new(
-        "registry-notary-relay",
-        &server.origin,
-        DestinationProfile::LoopbackDevelopmentHttp,
-        &[],
-    )
-    .unwrap();
-    RelayConsultationClient::new(
-        destination,
-        token_file.credential(),
-        EXPECTED_CLIENT_ID,
-        RelayProfilePin::new(PROFILE_ID, contract_hash).unwrap(),
-        PURPOSE,
-        INPUT_NAME,
-        expected_result,
-    )
-    .unwrap()
-}
-
-fn client(server: &FakeRelay, token_file: &TestTokenFile) -> RelayConsultationClient {
-    client_with_hash(server, token_file, &contract_hash())
-}
-
-async fn verified(server: &FakeRelay, token_file: &TestTokenFile) -> VerifiedRelayClient {
-    client(server, token_file).verify_profile().await.unwrap()
-}
-
-fn credential_for_path(path: PathBuf) -> Result<RelayWorkloadCredentialFile, RelayClientError> {
-    RelayWorkloadCredentialFile::new(path)
-}
-
-fn all_shape_checks_pass(observation: &Observation) -> bool {
-    observation.exact_authorization
-        && observation.exact_accept
-        && observation.exact_content_type
-        && observation.exact_purpose
-        && observation.exact_evaluation_id
-        && observation.exact_body
-        && observation.forbidden_ambient_headers_absent
-}
-
-fn isolated_test_requested(kind: &str) -> bool {
-    std::env::var(ISOLATED_TEST_KIND_ENV).is_ok_and(|value| value == kind)
-}
-
-async fn run_isolated_test(
-    exact_test_name: &'static str,
-    kind: &'static str,
-    environment: Vec<(&'static str, String)>,
-) -> Output {
-    tokio::task::spawn_blocking(move || {
-        let mut command = Command::new(std::env::current_exe().expect("test executable resolves"));
-        command
-            .arg(exact_test_name)
-            .arg("--exact")
-            .arg("--ignored")
-            .env(ISOLATED_TEST_KIND_ENV, kind)
-            .envs(environment);
-        command.output().expect("isolated test process starts")
-    })
-    .await
-    .expect("isolated test process join succeeds")
-}
-
-fn assert_isolated_test_passed(output: Output, exact_test_name: &str) {
-    assert!(output.status.success(), "isolated test process passes");
-    let stdout = String::from_utf8(output.stdout).expect("isolated test output is UTF-8");
-    assert!(
-        stdout
-            .lines()
-            .any(|line| line == format!("test {exact_test_name} ... ok")),
-        "isolated test process ran the exact expected child"
-    );
-}
-
-fn assembled_notary_config(
-    relay: &FakeRelay,
-    token_file: &TestTokenFile,
-    audit_path: &std::path::Path,
-) -> StandaloneRegistryNotaryConfig {
-    assembled_notary_config_for_generation(
-        relay,
-        token_file,
-        audit_path,
-        &contract_hash(),
-        NOTARY_API_KEY_HASH_ENV,
-        NOTARY_AUDIT_SECRET_ENV,
-    )
-}
-
-fn assembled_notary_config_for_generation(
-    relay: &FakeRelay,
-    token_file: &TestTokenFile,
-    audit_path: &std::path::Path,
-    contract_hash: &str,
-    api_key_hash_env: &str,
-    audit_secret_env: &str,
-) -> StandaloneRegistryNotaryConfig {
-    let relay_origin = serde_json::to_string(&relay.origin).expect("Relay origin serializes");
-    let token_path =
-        serde_json::to_string(&token_file.path.to_string_lossy()).expect("token path serializes");
-    let audit_path =
-        serde_json::to_string(&audit_path.to_string_lossy()).expect("audit path serializes");
-    serde_norway::from_str(&format!(
-        r#"
-deployment:
-  profile: local
-state:
-  storage: in_memory
-server:
-  bind: 127.0.0.1:0
-auth:
-  api_keys:
-    - id: relay-vertical-verifier
-      fingerprint:
-        provider: env
-        name: {api_key_hash_env}
-      scopes: [registry:evidence:dhis2-enrollment-status]
-audit:
-  sink: file
-  path: {audit_path}
-  hash_secret_env: {audit_secret_env}
-evidence:
-  enabled: true
-  service_id: notary-relay-vertical.test
-  allowed_purposes: [{PURPOSE}]
-  relay:
-    base_url: {relay_origin}
-    workload_client_id: {EXPECTED_CLIENT_ID}
-    token_file: {token_path}
-    allow_insecure_localhost: true
-  claims:
-    - id: dhis2-enrollment-known
-      title: DHIS2 enrollment exists
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          enrollment:
-            profile:
-              id: {PROFILE_ID}
-              contract_hash: {contract_hash}
-            inputs:
-              {INPUT_NAME}: target.id
-            outputs:
-              {OUTPUT_NAME}: {{ type: string, nullable: false, max_bytes: 32 }}
-      value:
-        type: boolean
-      purpose: {PURPOSE}
-      required_scopes: [registry:evidence:dhis2-enrollment-status]
-      rule:
-        type: consultation_matched
-        consultation: enrollment
-      disclosure:
-        default: value
-        allowed: [value, redacted]
-      formats: [application/vnd.registry-notary.claim-result+json]
-    - id: dhis2-enrollment-status
-      title: DHIS2 enrollment status
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          enrollment:
-            profile:
-              id: {PROFILE_ID}
-              contract_hash: {contract_hash}
-            inputs:
-              {INPUT_NAME}: target.id
-            outputs:
-              {OUTPUT_NAME}: {{ type: string, nullable: false, max_bytes: 32 }}
-      value:
-        type: string
-        nullable: true
-      purpose: {PURPOSE}
-      required_scopes: [registry:evidence:dhis2-enrollment-status]
-      rule:
-        type: consultation_output
-        consultation: enrollment
-        output: {OUTPUT_NAME}
-      disclosure:
-        default: value
-        allowed: [value, redacted]
-      formats: [application/vnd.registry-notary.claim-result+json]
-"#,
-    ))
-    .expect("assembled Notary configuration parses")
-}
-
-#[tokio::test]
-async fn assembled_notary_relay_journey_activates_and_coalesces_two_claims() {
-    let status = run_isolated_test(
-        ASSEMBLED_JOURNEY_CHILD,
-        ASSEMBLED_JOURNEY_KIND,
-        vec![
-            (NOTARY_API_KEY_HASH_ENV, fingerprint_api_key(NOTARY_API_KEY)),
-            (
-                NOTARY_AUDIT_SECRET_ENV,
-                "0123456789abcdef0123456789abcdef".to_string(),
-            ),
-        ],
-    )
-    .await;
-    assert_isolated_test_passed(status, ASSEMBLED_JOURNEY_CHILD);
-}
-
-#[tokio::test]
-#[ignore = "invoked by the isolated parent journey"]
-async fn assembled_notary_relay_journey_child() {
-    if !isolated_test_requested(ASSEMBLED_JOURNEY_KIND) {
-        return;
-    }
-    let api_key_fingerprint = fingerprint_api_key(NOTARY_API_KEY);
-    assert_eq!(
-        std::env::var(NOTARY_API_KEY_HASH_ENV).as_deref(),
-        Ok(api_key_fingerprint.as_str()),
-        "isolated child receives the expected synthetic API-key fingerprint"
-    );
-    let token_file = TestTokenFile::new(&test_token());
-    let relay =
-        FakeRelay::start_echoing_evaluation_id(metadata_response(), result_response()).await;
-    let directory = tempfile::tempdir().expect("temporary Notary directory");
-    let audit_path = directory.path().join("notary-audit.jsonl");
-    let config = assembled_notary_config(&relay, &token_file, &audit_path);
-
-    let runtime = crate::compile_notary_runtime(config).expect("Notary runtime compiles");
-    assert_eq!(relay.metadata_calls(), 0);
-    assert_eq!(relay.execute_calls(), 0);
-    let runtime = runtime
-        .activate()
-        .await
-        .expect("Notary activates the pinned Relay profile before serving");
-    assert_eq!(relay.metadata_calls(), 1);
-    assert_eq!(relay.execute_calls(), 0);
-    let app = crate::notary_shared_router_from_runtime(runtime)
-        .expect("activated Registry-backed runtime is serve-ready");
-    let notary = TestServer::builder().http_transport().build(app);
-
-    let response = notary
-        .post("/v1/evaluations")
-        .add_header("x-api-key", NOTARY_API_KEY)
-        .json(&json!({
-            "target": { "type": "Person", "id": INPUT_VALUE },
-            "claims": ["dhis2-enrollment-known", "dhis2-enrollment-status"],
-            "disclosure": "value",
-            "purpose": PURPOSE,
-        }))
-        .await;
-    response.assert_status_ok();
-    let public: Value = response.json();
-    let results = public["results"]
-        .as_array()
-        .expect("public response contains claim results");
-    assert_eq!(results.len(), 2);
-    let known = results
-        .iter()
-        .find(|result| result["claim_id"] == "dhis2-enrollment-known")
-        .expect("existence claim is returned");
-    let status = results
-        .iter()
-        .find(|result| result["claim_id"] == "dhis2-enrollment-status")
-        .expect("status claim is returned");
-    assert_eq!(known["value"], json!(true));
-    assert_eq!(status["value"], json!("ACTIVE"));
-    assert!(results
-        .iter()
-        .all(|result| result["provenance"]["used"]["relay_consultation_count"] == json!(1)));
-    let evaluation_id = results[0]["evaluation_id"]
-        .as_str()
-        .expect("public Notary evaluation id is present");
-    assert!(ulid::Ulid::from_string(evaluation_id).is_ok());
-    assert!(results
-        .iter()
-        .all(|result| result["evaluation_id"] == evaluation_id));
-
-    assert_eq!(relay.metadata_calls(), 1);
-    assert_eq!(relay.execute_calls(), 1);
-    let observations = relay.observations().await;
-    assert_eq!(observations.len(), 2);
-    assert_eq!(observations[0].operation, ObservedOperation::Metadata);
-    assert_eq!(observations[1].operation, ObservedOperation::Execute);
-    assert!(observations[0].batch_child_identity_absent);
-    assert!(observations[1].batch_child_identity_absent);
-    assert!(observations.iter().all(all_shape_checks_pass));
-
-    let public_wire = serde_json::to_string(&public).expect("public response serializes");
-    assert!(!public_wire.contains(CONSULTATION_ID));
-    assert!(!public_wire.contains("relay_consultation_ids"));
-    assert!(!public_wire.contains("consultation_id"));
-
-    let audit = std::fs::read_to_string(&audit_path).expect("restricted Notary audit is durable");
-    let audit_record = audit
-        .lines()
-        .map(|line| serde_json::from_str::<Value>(line).expect("audit envelope parses"))
-        .find_map(|envelope| {
-            (envelope["record"]["path"] == "/v1/evaluations").then(|| envelope["record"].clone())
-        })
-        .expect("evaluation audit record exists");
-    assert_eq!(audit_record["status"], json!(200));
-    assert_eq!(audit_record["verification_id"], evaluation_id);
-    assert_eq!(
-        audit_record["relay_consultation_ids"],
-        json!([CONSULTATION_ID])
-    );
-    assert_eq!(audit_record["relay_consultation_count"], json!(1));
-    assert_eq!(audit_record["forwarded"], json!(true));
-
-    drop(notary);
-    relay.shutdown().await;
-}
-
-async fn assert_generation_ready_and_serving(notary: &TestServer) {
-    let readiness = notary.get("/ready").await;
-    readiness.assert_status_ok();
-    let readiness: Value = readiness.json();
-    assert_eq!(readiness["checks"]["relay"]["total"], json!(1));
-    assert_eq!(readiness["checks"]["relay"]["ok"], json!(1));
-    assert_eq!(readiness["checks"]["relay"]["failed"], json!(0));
-    notary
-        .post("/v1/evaluations")
-        .add_header("x-api-key", NOTARY_API_KEY)
-        .json(&json!({
-            "target": { "type": "Person", "id": INPUT_VALUE },
-            "claims": ["dhis2-enrollment-known"],
-            "disclosure": "value",
-            "purpose": PURPOSE,
-        }))
-        .await
-        .assert_status_ok();
-}
-
-#[tokio::test]
-async fn coordinated_blue_green_never_serves_mixed_contract_generations() {
-    let status = run_isolated_test(
-        BLUE_GREEN_JOURNEY_CHILD,
-        BLUE_GREEN_JOURNEY_KIND,
-        vec![
-            (
-                TRANSITION_API_KEY_HASH_ENV,
-                fingerprint_api_key(NOTARY_API_KEY),
-            ),
-            (
-                TRANSITION_AUDIT_SECRET_ENV,
-                "abcdef0123456789abcdef0123456789".to_string(),
-            ),
-        ],
-    )
-    .await;
-    assert_isolated_test_passed(status, BLUE_GREEN_JOURNEY_CHILD);
-}
-
-#[tokio::test]
-#[ignore = "invoked by the isolated parent journey"]
-async fn coordinated_blue_green_journey_child() {
-    if !isolated_test_requested(BLUE_GREEN_JOURNEY_KIND) {
-        return;
-    }
-    let api_key_fingerprint = fingerprint_api_key(NOTARY_API_KEY);
-    assert_eq!(
-        std::env::var(TRANSITION_API_KEY_HASH_ENV).as_deref(),
-        Ok(api_key_fingerprint.as_str()),
-        "isolated child receives the expected synthetic API-key fingerprint"
-    );
-    let token_file = TestTokenFile::new(&test_token());
-    let old_contract = contract_value();
-    let old_hash = typed_hash(CONTRACT_DOMAIN, &old_contract);
-    let successor_contract = successor_contract_value();
-    let successor_hash = typed_hash(CONTRACT_DOMAIN, &successor_contract);
-    assert_ne!(old_hash, successor_hash, "a semantic change moves the hash");
-    let directory = tempfile::tempdir().expect("temporary transition directory");
-
-    // A blue/green switch admits only two complete generations. Either mixed
-    // pairing fails during Notary activation, before a serving router exists
-    // and before any Relay execution request can be made.
-    let blue = FakeRelay::start_echoing_evaluation_id(
-        metadata_response_for_contract(&old_contract, &old_hash),
-        result_response_for_contract_hash(&old_hash),
-    )
-    .await;
-    let green = FakeRelay::start_echoing_evaluation_id(
-        metadata_response_for_contract(&successor_contract, &successor_hash),
-        result_response_for_contract_hash(&successor_hash),
-    )
-    .await;
-
-    let old_notary = crate::compile_notary_runtime(assembled_notary_config_for_generation(
-        &blue,
-        &token_file,
-        &directory.path().join("blue-notary-audit.jsonl"),
-        &old_hash,
-        TRANSITION_API_KEY_HASH_ENV,
-        TRANSITION_AUDIT_SECRET_ENV,
-    ))
-    .expect("blue Notary compiles")
-    .activate()
-    .await
-    .expect("blue Notary activates against blue Relay");
-    let blue_notary = TestServer::builder().http_transport().build(
-        crate::notary_shared_router_from_runtime(old_notary)
-            .expect("the complete blue generation has a serving router"),
-    );
-    assert_generation_ready_and_serving(&blue_notary).await;
-    assert_eq!(blue.execute_calls(), 1);
-
-    let old_notary_green_relay =
-        crate::compile_notary_runtime(assembled_notary_config_for_generation(
-            &green,
-            &token_file,
-            &directory.path().join("mixed-old-notary-audit.jsonl"),
-            &old_hash,
-            TRANSITION_API_KEY_HASH_ENV,
-            TRANSITION_AUDIT_SECRET_ENV,
-        ))
-        .expect("mixed old Notary configuration compiles")
-        .activate()
-        .await;
-    assert!(
-        old_notary_green_relay.is_err(),
-        "old Notary must not activate against green Relay"
-    );
-    assert_eq!(green.execute_calls(), 0);
-
-    let new_notary_blue_relay =
-        crate::compile_notary_runtime(assembled_notary_config_for_generation(
-            &blue,
-            &token_file,
-            &directory.path().join("mixed-new-notary-audit.jsonl"),
-            &successor_hash,
-            TRANSITION_API_KEY_HASH_ENV,
-            TRANSITION_AUDIT_SECRET_ENV,
-        ))
-        .expect("mixed successor Notary configuration compiles")
-        .activate()
-        .await;
-    assert!(
-        new_notary_blue_relay.is_err(),
-        "green Notary must not activate against blue Relay"
-    );
-    assert_eq!(blue.execute_calls(), 1);
-
-    let successor_notary = crate::compile_notary_runtime(assembled_notary_config_for_generation(
-        &green,
-        &token_file,
-        &directory.path().join("green-notary-audit.jsonl"),
-        &successor_hash,
-        TRANSITION_API_KEY_HASH_ENV,
-        TRANSITION_AUDIT_SECRET_ENV,
-    ))
-    .expect("green Notary compiles")
-    .activate()
-    .await
-    .expect("green Notary activates against green Relay");
-    let green_notary = TestServer::builder().http_transport().build(
-        crate::notary_shared_router_from_runtime(successor_notary)
-            .expect("the complete green generation has a serving router"),
-    );
-    assert_generation_ready_and_serving(&green_notary).await;
-    assert_eq!(green.execute_calls(), 1);
-
-    drop(blue_notary);
-    drop(green_notary);
-    blue.shutdown().await;
-    green.shutdown().await;
-}
-
-#[tokio::test]
-async fn coordinated_drain_and_restart_keeps_partial_generation_unavailable() {
-    let status = run_isolated_test(
-        RESTART_JOURNEY_CHILD,
-        RESTART_JOURNEY_KIND,
-        vec![
-            (
-                RESTART_API_KEY_HASH_ENV,
-                fingerprint_api_key(NOTARY_API_KEY),
-            ),
-            (
-                RESTART_AUDIT_SECRET_ENV,
-                "fedcba9876543210fedcba9876543210".to_string(),
-            ),
-        ],
-    )
-    .await;
-    assert_isolated_test_passed(status, RESTART_JOURNEY_CHILD);
-}
-
-#[tokio::test]
-#[ignore = "invoked by the isolated parent journey"]
-async fn coordinated_drain_and_restart_journey_child() {
-    if !isolated_test_requested(RESTART_JOURNEY_KIND) {
-        return;
-    }
-    let api_key_fingerprint = fingerprint_api_key(NOTARY_API_KEY);
-    assert_eq!(
-        std::env::var(RESTART_API_KEY_HASH_ENV).as_deref(),
-        Ok(api_key_fingerprint.as_str()),
-        "isolated child receives the expected synthetic API-key fingerprint"
-    );
-    let token_file = TestTokenFile::new(&test_token());
-    let old_contract = contract_value();
-    let old_hash = typed_hash(CONTRACT_DOMAIN, &old_contract);
-    let successor_contract = successor_contract_value();
-    let successor_hash = typed_hash(CONTRACT_DOMAIN, &successor_contract);
-    assert_ne!(old_hash, successor_hash, "a semantic change moves the hash");
-    let directory = tempfile::tempdir().expect("temporary restart directory");
-
-    // A smaller deployment drains the old serving process before replacing
-    // Relay. During the partial restart, the old Notary pin cannot activate
-    // and no execution reaches Relay. Traffic resumes only after successor
-    // Notary activation and readiness succeed against successor Relay.
-    let relay = FakeRelay::start_echoing_evaluation_id(
-        metadata_response_for_contract(&old_contract, &old_hash),
-        result_response_for_contract_hash(&old_hash),
-    )
-    .await;
-    let old_notary = crate::compile_notary_runtime(assembled_notary_config_for_generation(
-        &relay,
-        &token_file,
-        &directory.path().join("restart-old-notary-audit.jsonl"),
-        &old_hash,
-        RESTART_API_KEY_HASH_ENV,
-        RESTART_AUDIT_SECRET_ENV,
-    ))
-    .expect("old restart Notary compiles")
-    .activate()
-    .await
-    .expect("old restart generation activates");
-    let old_notary = TestServer::builder().http_transport().build(
-        crate::notary_shared_router_from_runtime(old_notary)
-            .expect("old restart generation has a serving router"),
-    );
-    assert_generation_ready_and_serving(&old_notary).await;
-    assert_eq!(relay.execute_calls(), 1);
-
-    drop(old_notary);
-    relay
-        .set_metadata(metadata_response_for_contract(
-            &successor_contract,
-            &successor_hash,
-        ))
-        .await;
-    relay
-        .set_execute(result_response_for_contract_hash(&successor_hash))
-        .await;
-
-    let partial_restart = crate::compile_notary_runtime(assembled_notary_config_for_generation(
-        &relay,
-        &token_file,
-        &directory.path().join("restart-partial-notary-audit.jsonl"),
-        &old_hash,
-        RESTART_API_KEY_HASH_ENV,
-        RESTART_AUDIT_SECRET_ENV,
-    ))
-    .expect("partially restarted Notary configuration compiles")
-    .activate()
-    .await;
-    assert!(
-        partial_restart.is_err(),
-        "partially restarted generation remains unavailable"
-    );
-    assert_eq!(
-        relay.execute_calls(),
-        1,
-        "the partial generation never receives source traffic"
-    );
-
-    let successor_notary = crate::compile_notary_runtime(assembled_notary_config_for_generation(
-        &relay,
-        &token_file,
-        &directory.path().join("restart-green-notary-audit.jsonl"),
-        &successor_hash,
-        RESTART_API_KEY_HASH_ENV,
-        RESTART_AUDIT_SECRET_ENV,
-    ))
-    .expect("successor restart Notary compiles")
-    .activate()
-    .await
-    .expect("successor restart Notary activates");
-    let successor_notary = TestServer::builder().http_transport().build(
-        crate::notary_shared_router_from_runtime(successor_notary)
-            .expect("complete successor restart has a serving router"),
-    );
-    assert_generation_ready_and_serving(&successor_notary).await;
-    assert_eq!(relay.execute_calls(), 2);
-
-    drop(successor_notary);
-    relay.shutdown().await;
-}
-
-#[tokio::test]
-async fn exact_profile_and_execute_journey_is_strict_and_bounded() {
-    let token_file = TestTokenFile::new(&test_token());
-    let server = FakeRelay::start(metadata_response(), result_response()).await;
-    let client = verified(&server, &token_file).await;
-    assert_eq!(client.profile().pin().id(), PROFILE_ID);
-    assert_eq!(client.profile().pin().contract_hash(), contract_hash());
-    assert_eq!(client.profile().input_names(), [INPUT_NAME]);
-
-    let result = client
-        .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-        .await
-        .unwrap();
-    assert_eq!(result.consultation_id().to_string(), CONSULTATION_ID);
-    assert_eq!(result.outcome(), RelayConsultationOutcome::Match);
-    let Some(RelayMatchData::OutputMap(outputs)) = result.match_data() else {
-        panic!("match exposes the declared output map")
-    };
-    let fields = outputs.fields().collect::<Vec<_>>();
-    assert_eq!(fields.len(), 1);
-    assert_eq!(fields[0].0, OUTPUT_NAME);
-    assert!(matches!(
-        fields[0].1,
-        ProjectedJsonScalar::String(value) if value.as_str() == "ACTIVE"
-    ));
-    let observations = server.observations().await;
-    assert_eq!(observations.len(), 2);
-    assert_eq!(observations[0].operation, ObservedOperation::Metadata);
-    assert_eq!(observations[1].operation, ObservedOperation::Execute);
-    assert!(observations.iter().all(all_shape_checks_pass));
-    server.shutdown().await;
-}
-
-#[tokio::test]
-async fn structured_object_and_array_outputs_preserve_exact_nested_json() {
-    let token_file = TestTokenFile::new(&test_token());
-    let contract = structured_contract_value();
-    let contract_hash = typed_hash(CONTRACT_DOMAIN, &contract);
-    let result = structured_result_value(&contract_hash);
-    let server = FakeRelay::start(
-        metadata_response_for_contract(&contract, &contract_hash),
-        WireResponse::ok(serde_json::to_vec(&result).unwrap()),
-    )
-    .await;
-    let client = client_with_result(
-        &server,
-        &token_file,
-        &contract_hash,
-        RelayExpectedResult::output_map(structured_output_contracts()).unwrap(),
-    )
-    .verify_profile()
-    .await
-    .expect("recursive output contract verifies");
-
-    let result = client
-        .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-        .await
-        .expect("closed recursive result executes");
-    let Some(RelayMatchData::OutputMap(outputs)) = result.match_data() else {
-        panic!("match exposes the declared structured output map")
-    };
-    let outputs = outputs.fields().collect::<BTreeMap<_, _>>();
-    let expected = structured_result_value(&contract_hash);
-    for name in ["parents", "person"] {
-        let ProjectedJsonScalar::CanonicalJson(actual) = outputs[name] else {
-            panic!("{name} is retained as one canonical JSON value")
-        };
-        let canonical =
-            canonicalize_json(&expected["outputs"][name]).expect("expected value canonicalizes");
-        assert_eq!(
-            actual.as_slice(),
-            canonical.as_slice(),
-            "{name} preserves every nested value and array position"
-        );
-    }
-    server.shutdown().await;
-}
-
-#[tokio::test]
-async fn structured_outputs_reject_nested_shape_and_scalar_composite_mismatches() {
-    let token_file = TestTokenFile::new(&test_token());
-    let contract = structured_contract_value();
-    let contract_hash = typed_hash(CONTRACT_DOMAIN, &contract);
-    let server = FakeRelay::start(
-        metadata_response_for_contract(&contract, &contract_hash),
-        WireResponse::ok(serde_json::to_vec(&structured_result_value(&contract_hash)).unwrap()),
-    )
-    .await;
-    let client = client_with_result(
-        &server,
-        &token_file,
-        &contract_hash,
-        RelayExpectedResult::output_map(structured_output_contracts()).unwrap(),
-    )
-    .verify_profile()
-    .await
-    .expect("recursive output contract verifies");
-
-    let mut cases = Vec::new();
-
-    let mut extra_nested_key = structured_result_value(&contract_hash);
-    extra_nested_key["outputs"]["person"]["undeclared"] = json!("must fail closed");
-    cases.push(("extra nested object key", extra_nested_key));
-
-    let mut wrong_nested_type = structured_result_value(&contract_hash);
-    wrong_nested_type["outputs"]["person"]["active"] = json!("true");
-    cases.push(("wrong nested scalar type", wrong_nested_type));
-
-    let mut malformed_array_item = structured_result_value(&contract_hash);
-    malformed_array_item["outputs"]["parents"][1] = json!("not-an-object");
-    cases.push(("malformed array item", malformed_array_item));
-
-    let mut object_as_scalar = structured_result_value(&contract_hash);
-    object_as_scalar["outputs"]["person"] = json!("Ada");
-    cases.push(("object output returned as scalar", object_as_scalar));
-
-    let mut array_as_object = structured_result_value(&contract_hash);
-    array_as_object["outputs"]["parents"] = json!({
-        "identifier": "PARENT-1",
-        "name": "Charles",
-        "type": "father"
-    });
-    cases.push(("array output returned as object", array_as_object));
-
-    for (label, result) in cases {
-        server
-            .set_execute(WireResponse::ok(serde_json::to_vec(&result).unwrap()))
-            .await;
-        assert_eq!(
-            client
-                .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-                .await
-                .expect_err(label),
-            RelayClientError::InvalidResult,
-            "{label}"
-        );
-    }
-    server.shutdown().await;
-}
-
-#[tokio::test]
-async fn result_union_requires_outputs_only_for_match() {
-    let token_file = TestTokenFile::new(&test_token());
-    let server = FakeRelay::start(metadata_response(), result_response()).await;
-    let client = verified(&server, &token_file).await;
-
-    for (wire_outcome, expected) in [
-        ("no_match", RelayConsultationOutcome::NoMatch),
-        ("ambiguous", RelayConsultationOutcome::Ambiguous),
-    ] {
-        let mut value = result_value();
-        value["outcome"] = json!(wire_outcome);
-        value
-            .as_object_mut()
-            .expect("result is an object")
-            .remove("outputs");
-        server
-            .set_execute(WireResponse::ok(serde_json::to_vec(&value).unwrap()))
-            .await;
-        let result = client
-            .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-            .await
-            .expect("non-match outcome without outputs is valid");
-        assert_eq!(result.outcome(), expected);
-        assert!(result.match_data().is_none());
-    }
-
-    let mut match_without_outputs = result_value();
-    match_without_outputs
-        .as_object_mut()
-        .expect("result is an object")
-        .remove("outputs");
-    server
-        .set_execute(WireResponse::ok(
-            serde_json::to_vec(&match_without_outputs).unwrap(),
-        ))
-        .await;
-    assert_eq!(
-        client
-            .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-            .await
-            .expect_err("match without outputs fails closed"),
-        RelayClientError::InvalidResult
-    );
-
-    let mut no_match_with_outputs = result_value();
-    no_match_with_outputs["outcome"] = json!("no_match");
-    server
-        .set_execute(WireResponse::ok(
-            serde_json::to_vec(&no_match_with_outputs).unwrap(),
-        ))
-        .await;
-    assert_eq!(
-        client
-            .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-            .await
-            .expect_err("no_match with outputs fails closed"),
-        RelayClientError::InvalidResult
-    );
-    server.shutdown().await;
-}
-
-#[tokio::test]
-async fn result_rejects_retired_provenance_consent_member() {
-    let token_file = TestTokenFile::new(&test_token());
-    let mut result = result_value();
-    assert!(result["provenance"].get("consent").is_none());
-    result["provenance"]["consent"] = json!({
-        "outcome": "not_required",
-        "verifier_id": null,
-        "verifier_revision": null,
-        "checked_at": null,
-        "expires_at": null,
-        "revocation_status": "not_applicable"
-    });
-    let server = FakeRelay::start(
-        metadata_response(),
-        WireResponse::ok(serde_json::to_vec(&result).unwrap()),
-    )
-    .await;
-    let client = verified(&server, &token_file).await;
-
-    assert_eq!(
-        client
-            .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-            .await
-            .expect_err("retired consent member fails closed"),
-        RelayClientError::InvalidResult
-    );
-    server.shutdown().await;
-}
-
-#[tokio::test]
-async fn batch_execute_propagates_one_bounded_opaque_child_identity() {
-    let token_file = TestTokenFile::new(&test_token());
-    let server = FakeRelay::start(metadata_response(), result_response()).await;
-    let client = verified(&server, &token_file).await;
-    client
-        .execute_batch_inputs(
-            EVALUATION_ID,
-            BTreeMap::from([(
-                INPUT_NAME.to_string(),
-                Zeroizing::new(INPUT_VALUE.to_string()),
-            )]),
-            "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
-        )
-        .await
-        .unwrap();
-    let observations = server.observations().await;
-    assert!(observations[0].batch_child_identity_absent);
-    assert!(!observations[1].batch_child_identity_absent);
-    assert!(observations[1].has_valid_batch_child_identity);
-    server.shutdown().await;
-}
-
-#[tokio::test]
-async fn batch_child_terminal_replay_accepts_a_fresh_notary_evaluation_id() {
-    let token_file = TestTokenFile::new(&test_token());
-    let server =
-        FakeRelay::start_echoing_evaluation_id(metadata_response(), result_response()).await;
-    let client = verified(&server, &token_file).await;
-    let child_identity = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
-    let fresh_evaluation_id = ulid::Ulid::from_parts(3, 7).to_string();
-
-    let first = client
-        .execute_batch_inputs(
-            EVALUATION_ID,
-            BTreeMap::from([(
-                INPUT_NAME.to_string(),
-                Zeroizing::new(INPUT_VALUE.to_string()),
-            )]),
-            child_identity,
-        )
-        .await
-        .expect("first batch child result validates");
-    let replay = client
-        .execute_batch_inputs(
-            &fresh_evaluation_id,
-            BTreeMap::from([(
-                INPUT_NAME.to_string(),
-                Zeroizing::new(INPUT_VALUE.to_string()),
-            )]),
-            child_identity,
-        )
-        .await
-        .expect("terminal child replay validates against the fresh evaluation id");
-
-    assert_eq!(first.consultation_id(), replay.consultation_id());
-    let observations = server.observations().await;
-    assert_eq!(observations.len(), 3);
-    assert!(observations[0].batch_child_identity_absent);
-    assert!(observations[1..]
-        .iter()
-        .all(|observation| observation.has_valid_batch_child_identity
-            && !observation.batch_child_identity_absent
-            && observation.exact_evaluation_id));
-    server.shutdown().await;
-}
-
-#[tokio::test]
-async fn multi_input_profile_forwards_bounded_inputs_and_rejects_partial_maps() {
-    let token_file = TestTokenFile::new(&test_token());
-    let mut contract = contract_value();
-    contract["spec"]["inputs"] = json!({
-        "birth_date": {
-            "role": "selector",
-            "type": "string",
-            "format": "date",
-            "maxLength": 10,
-            "x-registry-max-bytes": 40,
-            "pattern": "^[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$",
-            "x-registry-canonicalization": "identity"
-        },
-        "country_code": {
-            "role": "selector",
-            "type": "string",
-            "maxLength": 2,
-            "x-registry-max-bytes": 8,
-            "pattern": "^[a-z][a-z]$",
-            "x-registry-canonicalization": "ascii_lowercase"
-        },
-        "tracked_entity": contract["spec"]["inputs"]["tracked_entity"].clone()
-    });
-    let contract_hash = typed_hash(CONTRACT_DOMAIN, &contract);
-    let metadata = WireResponse::ok(
-        serde_json::to_vec(&metadata_value_for_contract(&contract, &contract_hash)).unwrap(),
-    );
-    let server = FakeRelay::start(metadata, result_response()).await;
-    let destination = ServiceHopDataDestinationPolicy::new(
-        "registry-notary-relay",
-        &server.origin,
-        DestinationProfile::LoopbackDevelopmentHttp,
-        &[],
-    )
-    .unwrap();
-    let client = RelayConsultationClient::new(
-        destination,
-        token_file.credential(),
-        EXPECTED_CLIENT_ID,
-        RelayProfilePin::new(PROFILE_ID, contract_hash.as_str()).unwrap(),
-        PURPOSE,
-        vec![
-            "tracked_entity".to_string(),
-            "country_code".to_string(),
-            "birth_date".to_string(),
-        ],
-        RelayExpectedResult::output_map(BTreeMap::from([(
-            OUTPUT_NAME.to_string(),
-            NotaryRelayOutputContract::String {
-                nullable: false,
-                max_bytes: 32,
-            },
-        )]))
-        .unwrap(),
-    )
-    .unwrap()
-    .verify_profile()
-    .await
-    .expect("the exact three-input profile activates");
-
-    let canonical = client
-        .canonicalize_execute_inputs(
-            EVALUATION_ID,
-            &BTreeMap::from([
-                (
-                    "tracked_entity".to_string(),
-                    Zeroizing::new(INPUT_VALUE.to_string()),
-                ),
-                ("country_code".to_string(), Zeroizing::new("TH".to_string())),
-                (
-                    "birth_date".to_string(),
-                    Zeroizing::new("2000-01-02".to_string()),
-                ),
-            ]),
-        )
-        .expect("all bounded values pass to Relay for contract-defined canonicalization");
-    assert_eq!(canonical["country_code"].as_str(), "TH");
-    assert_eq!(canonical["birth_date"].as_str(), "2000-01-02");
-
-    assert!(matches!(
-        client.canonicalize_execute_inputs(
-            EVALUATION_ID,
-            &BTreeMap::from([(
-                "tracked_entity".to_string(),
-                Zeroizing::new(INPUT_VALUE.to_string()),
-            )]),
-        ),
-        Err(RelayClientError::InvalidRequest)
-    ));
-    assert!(matches!(
-        client.canonicalize_execute_inputs(
-            EVALUATION_ID,
-            &BTreeMap::from([
-                (
-                    "tracked_entity".to_string(),
-                    Zeroizing::new("x".repeat(INPUT_VALUE_MAX_BYTES + 1)),
-                ),
-                ("country_code".to_string(), Zeroizing::new("TH".to_string())),
-                (
-                    "birth_date".to_string(),
-                    Zeroizing::new("2000-01-02".to_string()),
-                ),
-            ]),
-        ),
-        Err(RelayClientError::InvalidRequest)
-    ));
-    server.shutdown().await;
-}
-
-#[tokio::test]
-async fn typed_output_map_verifies_exact_schema_and_rejects_bad_date() {
-    let token_file = TestTokenFile::new(&test_token());
-    let contract = typed_output_contract_value();
-    let contract_hash = typed_hash(CONTRACT_DOMAIN, &contract);
-    let mut result = result_value();
-    result["profile"]["contract_hash"] = json!(contract_hash);
-    result["outputs"] = json!({
-        "active": true,
-        "birth_date": "2010-06-15",
-        "exists": true,
-        "sequence": 42,
-        "status": "ACTIVE"
-    });
-    let server = FakeRelay::start(
-        WireResponse::ok(
-            serde_json::to_vec(&metadata_value_for_contract(&contract, &contract_hash)).unwrap(),
-        ),
-        WireResponse::ok(serde_json::to_vec(&result).unwrap()),
-    )
-    .await;
-    let client = client_with_result(
-        &server,
-        &token_file,
-        &contract_hash,
-        typed_output_expectation(),
-    )
-    .verify_profile()
-    .await
-    .expect("typed output profile verifies");
-    let executed = client
-        .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-        .await
-        .expect("typed output result verifies");
-    let Some(RelayMatchData::OutputMap(outputs)) = executed.match_data() else {
-        panic!("typed output map is released")
-    };
-    assert_eq!(outputs.fields().len(), 5);
-
-    let mut bad_date = result_value();
-    bad_date["profile"]["contract_hash"] = json!(contract_hash);
-    bad_date["outputs"] = json!({
-        "active": true,
-        "birth_date": "2010-02-30",
-        "exists": true,
-        "sequence": 42,
-        "status": "ACTIVE"
-    });
-    server
-        .set_execute(WireResponse::ok(serde_json::to_vec(&bad_date).unwrap()))
-        .await;
-    assert_eq!(
-        client
-            .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-            .await
-            .expect_err("invalid full-date fails closed"),
-        RelayClientError::InvalidResult
-    );
-    server.shutdown().await;
-}
-
-#[tokio::test]
-async fn metadata_pin_and_strict_json_fail_closed() {
-    let token_file = TestTokenFile::new(&test_token());
-    let mut cases = Vec::new();
-    let mut wrong_hash = metadata_value();
-    wrong_hash["contract_hash"] =
-        json!("sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
-    cases.push(serde_json::to_vec(&wrong_hash).unwrap());
-    let mut unknown = metadata_value();
-    unknown["unexpected"] = json!(true);
-    cases.push(serde_json::to_vec(&unknown).unwrap());
-    let valid = serde_json::to_string(&metadata_value()).unwrap();
-    cases.push(
-        valid
-            .replacen("{", "{\"contract_hash\":\"duplicate-secret\",", 1)
-            .into_bytes(),
-    );
-    cases.push(format!("{valid} true").into_bytes());
-
-    for body in cases {
-        let server = FakeRelay::start(WireResponse::ok(body), result_response()).await;
-        let error = client(&server, &token_file)
-            .verify_profile()
-            .await
-            .unwrap_err();
-        assert_eq!(error, RelayClientError::InvalidProfileMetadata);
-        server.shutdown().await;
-    }
-}
-
-#[tokio::test]
-async fn contract_digest_must_match_canonical_contract_returned_and_configured_hashes() {
-    let token_file = TestTokenFile::new(&test_token());
-    let mut contract = contract_value();
-    contract["spec"]["bounds"]["timeout_ms"] = json!(4_999);
-    let recomputed = typed_hash(b"registry.relay.consultation-contract.v1\0", &contract);
-    let contract_hash = contract_hash();
-    for (returned_hash, configured_hash) in [
-        (contract_hash.clone(), contract_hash.clone()),
-        (recomputed.clone(), contract_hash.clone()),
-        (contract_hash, recomputed.clone()),
-    ] {
-        let metadata = metadata_value_for_contract(&contract, &returned_hash);
-        let server = FakeRelay::start(
-            WireResponse::ok(serde_json::to_vec(&metadata).unwrap()),
-            result_response(),
-        )
-        .await;
-        assert_eq!(
-            client_with_hash(&server, &token_file, &configured_hash)
-                .verify_profile()
-                .await
-                .unwrap_err(),
-            RelayClientError::InvalidProfileMetadata
-        );
-        server.shutdown().await;
-    }
-}
-
-#[tokio::test]
-async fn readiness_rejects_each_semantic_contract_mismatch_before_execution() {
-    let token_file = TestTokenFile::new(&test_token());
-    let mut cases = Vec::<(&str, Value)>::new();
-
-    let mut identity = contract_value();
-    identity["id"] = json!("different.profile");
-    cases.push(("profile identity", identity));
-
-    let mut purpose = contract_value();
-    purpose["spec"]["authorization"]["purposes"] = json!(["different-purpose"]);
-    cases.push(("purpose", purpose));
-
-    let mut workload = contract_value();
-    workload["spec"]["authorization"]["workload"] = json!("different-workload");
-    cases.push(("configured workload identity", workload));
-
-    let mut retired_selector_provenance = contract_value();
-    retired_selector_provenance["spec"]["subject"]["selector_provenance"] = json!({
-        "type": "trusted_notary_assertion",
-        "assertion_contract": {
-            "id": "retired.notary.assertion",
-            "hash": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-        }
-    });
-    cases.push((
-        "retired trusted Notary assertion provenance",
-        retired_selector_provenance,
-    ));
-
-    let mut integration_revision = contract_value();
-    integration_revision["spec"]["integration"]["revision"] = json!(0);
-    cases.push(("integration revision", integration_revision));
-
-    let mut retired_integration_pack = contract_value();
-    retired_integration_pack["spec"]["integration_pack"] = json!({
-        "id": "dhis2.tracker.enrollment-status",
-        "version": "1",
-        "hash": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-    });
-    retired_integration_pack["spec"]
-        .as_object_mut()
-        .expect("contract spec is an object")
-        .remove("integration");
-    cases.push(("retired integration_pack alias", retired_integration_pack));
-
-    let mut input = contract_value();
-    input["spec"]["inputs"][INPUT_NAME]["role"] = json!("parameter");
-    cases.push(("input role", input));
-
-    let mut output = contract_value();
-    output["spec"]["output"][OUTPUT_NAME]["max_bytes"] = json!(31);
-    cases.push(("output bounds", output));
-
-    let mut outcome = contract_value();
-    outcome["spec"]["public_behavior"]["outcomes"] = json!(["match", "no_match"]);
-    cases.push(("closed outcome union", outcome));
-
-    let mut provenance = contract_value();
-    provenance["spec"]["source_provenance"]["source_observed_at"] = json!({
-        "type": "acquired_rfc3339",
-        "field": "missing_observation"
-    });
-    cases.push(("provenance", provenance));
-
-    let mut runtime = contract_value();
-    runtime["spec"]["runtime"]["source_capability"] = json!("script");
-    cases.push(("runtime ABI", runtime));
-
-    let mut platform = contract_value();
-    platform["spec"]["runtime"]["platform_profile"] = json!("registry-stack.consultation.v2");
-    cases.push(("platform profile", platform));
-
-    for (label, contract) in cases {
-        let contract_hash = typed_hash(CONTRACT_DOMAIN, &contract);
-        let server = FakeRelay::start(
-            WireResponse::ok(
-                serde_json::to_vec(&metadata_value_for_contract(&contract, &contract_hash))
-                    .unwrap(),
-            ),
-            result_response(),
-        )
-        .await;
-        assert_eq!(
-            client_with_hash(&server, &token_file, &contract_hash)
-                .verify_profile()
-                .await
-                .expect_err(label),
-            RelayClientError::InvalidProfileMetadata,
-            "{label}"
-        );
-        assert_eq!(server.execute_calls(), 0, "{label}");
-        server.shutdown().await;
-    }
-}
-
-#[tokio::test]
-async fn materialized_snapshot_contract_and_result_are_strictly_verified() {
-    let token_file = TestTokenFile::new(&test_token());
-    let contract = snapshot_contract_value();
-    let contract_hash = typed_hash(CONTRACT_DOMAIN, &contract);
-    let metadata = metadata_value_for_contract(&contract, &contract_hash);
-    let result = snapshot_result_value(&contract_hash);
-    let server = FakeRelay::start(
-        WireResponse::ok(serde_json::to_vec(&metadata).unwrap()),
-        WireResponse::ok(serde_json::to_vec(&result).unwrap()),
-    )
-    .await;
-    let client = client_with_hash(&server, &token_file, &contract_hash)
-        .verify_profile()
-        .await
-        .expect("closed materialized snapshot metadata verifies");
-    let result = client
-        .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-        .await
-        .expect("closed materialized snapshot result verifies");
-    assert_eq!(
-        result.provenance().acquired_at(),
-        OffsetDateTime::parse("2026-07-12T00:00:00Z", &Rfc3339).unwrap()
-    );
-
-    for (field, invalid) in [
-        ("generation_id", ""),
-        ("published_at", "not-a-timestamp"),
-        ("published_at", "2026-07-13T00:00:00Z"),
-    ] {
-        let mut invalid_result = snapshot_result_value(&contract_hash);
-        invalid_result["provenance"]["snapshot"][field] = json!(invalid);
-        server
-            .set_execute(WireResponse::ok(
-                serde_json::to_vec(&invalid_result).unwrap(),
-            ))
-            .await;
-        assert_eq!(
-            client
-                .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-                .await
-                .expect_err("invalid snapshot provenance fails closed"),
-            RelayClientError::InvalidResult
-        );
-    }
-    server.shutdown().await;
-}
-
-#[tokio::test]
-async fn materialized_snapshot_footprint_uses_the_relay_public_bound() {
-    let token_file = TestTokenFile::new(&test_token());
-    for max_source_bytes in [
-        16 * 1_024 * 1_024 + 1,
-        1_024 * 1_024 * 1_024,
-        9_007_199_254_740_991_u64,
-    ] {
-        let mut contract = snapshot_contract_value();
-        contract["spec"]["materialization"]["footprint"]["max_source_bytes"] =
-            json!(max_source_bytes);
-        let contract_hash = typed_hash(CONTRACT_DOMAIN, &contract);
-        let server = FakeRelay::start(
-            metadata_response_for_contract(&contract, &contract_hash),
-            result_response_for_contract_hash(&contract_hash),
-        )
-        .await;
-        client_with_hash(&server, &token_file, &contract_hash)
-            .verify_profile()
-            .await
-            .expect(
-                "reviewed materialization footprint activates independently of operation bytes",
-            );
-        server.shutdown().await;
-    }
-
-    for (label, pointer, value) in [
-        (
-            "materialization footprint above the Relay public ceiling",
-            "/spec/materialization/footprint/max_source_bytes",
-            9_007_199_254_740_992_u64,
-        ),
-        (
-            "consultation operation above the live response ceiling",
-            "/spec/bounds/max_source_bytes",
-            16 * 1_024 * 1_024 + 1,
-        ),
-    ] {
-        let mut contract = snapshot_contract_value();
-        *contract
-            .pointer_mut(pointer)
-            .expect("contract pointer exists") = json!(value);
-        let contract_hash = typed_hash(CONTRACT_DOMAIN, &contract);
-        let server = FakeRelay::start(
-            metadata_response_for_contract(&contract, &contract_hash),
-            result_response_for_contract_hash(&contract_hash),
-        )
-        .await;
-        assert_eq!(
-            client_with_hash(&server, &token_file, &contract_hash)
-                .verify_profile()
-                .await
-                .expect_err(label),
-            RelayClientError::InvalidProfileMetadata,
-            "{label}"
-        );
-        server.shutdown().await;
-    }
-}
-
-#[tokio::test]
-async fn malformed_compact_credentials_fail_before_network() {
-    let server = FakeRelay::start(metadata_response(), result_response()).await;
-    for token in [
-        "relay-test-token-SENSITIVE",
-        "e30.e30",
-        "e30.e30.c2lnbmF0dXJl.extra",
-        "e30..c2lnbmF0dXJl",
-        "e30.e30.c2ln=bmF0dXJl",
-        "e30.e30.c2ln\nbmF0dXJl",
-        "a.e30.c2lnbmF0dXJl",
-    ] {
-        let token_file = TestTokenFile::new(token);
-        let error = client(&server, &token_file)
-            .verify_profile()
-            .await
-            .unwrap_err();
-        assert_eq!(error, RelayClientError::InvalidCredentials);
-        assert!(!format!("{error:?} {error}").contains("SENSITIVE"));
-    }
-    assert_eq!(server.metadata_calls(), 0);
-
-    assert_eq!(
-        credential_for_path(PathBuf::from("relative.jwt")).unwrap_err(),
-        RelayClientError::InvalidConfiguration
-    );
-    server.shutdown().await;
-}
-
-#[tokio::test]
-async fn compact_credential_is_forwarded_and_relay_owns_semantic_rejection() {
-    let compact = "e30.e30.c2lnbmF0dXJl";
-    let token_file = TestTokenFile::new(compact);
-    let server = FakeRelay::start(
-        WireResponse {
-            status: StatusCode::UNAUTHORIZED,
-            body: b"credential-rejected-SENSITIVE".to_vec(),
-            location: None,
-            content_types: vec!["application/json"],
-        },
-        result_response(),
-    )
-    .await;
-    server.set_expected_token(compact).await;
-
-    let error = client(&server, &token_file)
-        .verify_profile()
-        .await
-        .unwrap_err();
-
-    assert_eq!(error, RelayClientError::InvalidCredentials);
-    assert_eq!(server.metadata_calls(), 1);
-    let observations = server.observations().await;
-    assert_eq!(observations.len(), 1);
-    assert!(observations[0].exact_authorization);
-    assert!(!format!("{error:?} {error}").contains("SENSITIVE"));
-    server.shutdown().await;
-}
-
-#[tokio::test]
-async fn credential_file_rotation_and_unavailability_apply_without_restart() {
-    let token_file = TestTokenFile::new(&test_token());
-    let server = FakeRelay::start(metadata_response(), result_response()).await;
-    let client = verified(&server, &token_file).await;
-
-    let mut rotated_claims = test_claims();
-    rotated_claims["jti"] = json!("relay-test-token-2");
-    let rotated =
-        token_for_claims_and_signature(&rotated_claims, b"relay-rotated-test-signature-SENSITIVE");
-    token_file.replace(&format!("{rotated}\n"));
-    server.set_expected_token(&rotated).await;
-
-    client.verify_current_profile().await.unwrap();
-    client
-        .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-        .await
-        .unwrap();
-    assert_eq!(server.metadata_calls(), 2);
-    assert_eq!(server.execute_calls(), 1);
-    assert!(server
-        .observations()
-        .await
-        .iter()
-        .all(all_shape_checks_pass));
-
-    token_file.replace("invalid-rotated-token-SENSITIVE");
-    assert_eq!(
-        client
-            .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-            .await
-            .unwrap_err(),
-        RelayClientError::InvalidCredentials
-    );
-    assert_eq!(server.execute_calls(), 1);
-
-    token_file.remove();
-    assert_eq!(
-        client.verify_current_profile().await.unwrap_err(),
-        RelayClientError::CredentialUnavailable
-    );
-    assert_eq!(server.metadata_calls(), 2);
-    token_file.replace(&rotated);
-    client.verify_current_profile().await.unwrap();
-    assert_eq!(server.metadata_calls(), 3);
-    server.shutdown().await;
-}
-
-#[tokio::test]
-async fn credential_file_is_bounded_and_must_remain_a_regular_file() {
-    let oversized = TestTokenFile::new(&"x".repeat(MAX_TOKEN_FILE_BYTES + 1));
-    assert_eq!(
-        oversized.credential().authorization().await.unwrap_err(),
-        RelayClientError::InvalidCredentials
-    );
-
-    let directory = tempfile::tempdir().unwrap();
-    let credential = credential_for_path(directory.path().to_path_buf()).unwrap();
-    assert_eq!(
-        credential.authorization().await.unwrap_err(),
-        RelayClientError::CredentialUnavailable
-    );
-}
-
-#[tokio::test]
-async fn cancelled_credential_reads_share_one_blocking_worker_gate() {
-    let token_file = TestTokenFile::new(&test_token());
-    let credential = token_file.credential();
-    let held = Arc::clone(&credential.read_permit)
-        .acquire_owned()
-        .await
-        .expect("test holds the one credential-read permit");
-
-    for _ in 0..2 {
-        assert!(
-            tokio::time::timeout(Duration::from_millis(10), credential.authorization())
-                .await
-                .is_err(),
-            "a cancelled retry waits behind the original read instead of spawning another worker"
-        );
-    }
-    assert_eq!(credential.read_permit.available_permits(), 0);
-
-    drop(held);
-    credential
-        .authorization()
-        .await
-        .expect("credential reload resumes after the original worker gate releases");
-}
-
-#[tokio::test]
-async fn credential_fifo_is_rejected_promptly_without_a_blocked_reader() {
-    let directory = tempfile::tempdir().unwrap();
-    let path = directory.path().join("relay.jwt");
-    let status = std::process::Command::new("mkfifo")
-        .arg(&path)
-        .status()
-        .expect("mkfifo command runs");
-    assert!(status.success());
-    let credential = credential_for_path(path).unwrap();
-
-    let result = tokio::time::timeout(Duration::from_secs(1), credential.authorization())
-        .await
-        .expect("nonblocking FIFO inspection returns promptly");
-
-    assert_eq!(result.unwrap_err(), RelayClientError::CredentialUnavailable);
-}
-
-#[tokio::test]
-async fn metadata_and_result_require_one_exact_json_media_type() {
-    let token_file = TestTokenFile::new(&test_token());
-    for content_types in [
-        Vec::new(),
-        vec!["application/problem+json"],
-        vec!["application/json", "application/json"],
-    ] {
-        let server = FakeRelay::start(
-            metadata_response().with_content_types(content_types),
-            result_response(),
-        )
-        .await;
-        assert_eq!(
-            client(&server, &token_file)
-                .verify_profile()
-                .await
-                .unwrap_err(),
-            RelayClientError::InvalidProfileMetadata
-        );
-        server.shutdown().await;
-    }
-
-    let server = FakeRelay::start(metadata_response(), result_response()).await;
-    let client = verified(&server, &token_file).await;
-    for content_types in [
-        Vec::new(),
-        vec!["application/json; charset=utf-8"],
-        vec!["application/json", "application/json"],
-    ] {
-        server
-            .set_execute(result_response().with_content_types(content_types))
-            .await;
-        assert_eq!(
-            client
-                .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-                .await
-                .unwrap_err(),
-            RelayClientError::InvalidResult
-        );
-    }
-    server.shutdown().await;
-}
-
-#[tokio::test]
-async fn status_size_redirect_and_retry_behavior_is_closed() {
-    let token_file = TestTokenFile::new(&test_token());
-    let server = FakeRelay::start(metadata_response(), result_response()).await;
-    let client = verified(&server, &token_file).await;
-    for (status, expected) in [
-        (StatusCode::BAD_REQUEST, RelayClientError::InvalidRequest),
-        (
-            StatusCode::UNAUTHORIZED,
-            RelayClientError::InvalidCredentials,
-        ),
-        (StatusCode::FORBIDDEN, RelayClientError::Denied),
-        (StatusCode::NOT_FOUND, RelayClientError::ProfileNotFound),
-        (StatusCode::CONFLICT, RelayClientError::ContractMismatch),
-        (StatusCode::TOO_MANY_REQUESTS, RelayClientError::RateLimited),
-        (
-            StatusCode::SERVICE_UNAVAILABLE,
-            RelayClientError::Unavailable,
-        ),
-    ] {
-        server
-            .set_execute(WireResponse {
-                status,
-                body: b"arbitrary-SENSITIVE-error-body".to_vec(),
-                location: None,
-                content_types: vec!["application/json"],
-            })
-            .await;
-        let error = client
-            .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-            .await
-            .unwrap_err();
-        assert_eq!(error, expected);
-        assert!(!format!("{error:?} {error}").contains("SENSITIVE"));
-    }
-
-    server
-        .set_execute(WireResponse::ok(vec![b' '; MAX_RESULT_BYTES + 1]))
-        .await;
-    assert_eq!(
-        client
-            .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-            .await
-            .unwrap_err(),
-        RelayClientError::InvalidResult
-    );
-
-    let calls_before_redirect = server.execute_calls();
-    server
-        .set_execute(WireResponse {
-            status: StatusCode::TEMPORARY_REDIRECT,
-            body: b"redirect-SENSITIVE".to_vec(),
-            location: Some(EXECUTE_ROUTE),
-            content_types: vec!["application/json"],
-        })
-        .await;
-    assert_eq!(
-        client
-            .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-            .await
-            .unwrap_err(),
-        RelayClientError::UnexpectedStatus
-    );
-    assert_eq!(server.execute_calls(), calls_before_redirect + 1);
-    server.shutdown().await;
-}
-
-#[tokio::test]
-async fn debug_and_errors_never_expose_transport_or_consultation_values() {
-    let token_file = TestTokenFile::new(&test_token());
-    let server = FakeRelay::start(metadata_response(), result_response()).await;
-    let unverified = client(&server, &token_file);
-    let unverified_debug = format!("{unverified:?}");
-    let client = unverified.verify_profile().await.unwrap();
-    let verified_debug = format!("{client:?} {:?}", client.profile());
-    let result = client
-        .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
-        .await
-        .unwrap();
-    let result_debug = format!("{result:?} {:?}", result.match_data().unwrap());
-    let token = test_token();
-    let contract_hash = contract_hash();
-    for diagnostic in [unverified_debug, verified_debug, result_debug] {
-        for forbidden in [
-            token.as_str(),
-            &server.origin,
-            PROFILE_ID,
-            &contract_hash,
-            PURPOSE,
-            INPUT_NAME,
-            INPUT_VALUE,
-            OUTPUT_NAME,
-            EVALUATION_ID,
-            CONSULTATION_ID,
-            "ACTIVE",
-        ] {
-            assert!(!diagnostic.contains(forbidden), "leaked {forbidden}");
-        }
-    }
-    server.shutdown().await;
-}
diff --git a/crates/registry-notary-server/src/relay_contract.rs b/crates/registry-notary-server/src/relay_contract.rs
deleted file mode 100644
index e4f4e834d..000000000
--- a/crates/registry-notary-server/src/relay_contract.rs
+++ /dev/null
@@ -1,1048 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Independent Notary validation of Relay's canonical public contract.
-//!
-//! These types are a closed verification boundary, not a second compiler
-//! model. Relay remains the contract producer. Notary decodes the authenticated
-//! compiler output and checks only the semantics it must understand before it
-//! can become ready or make registry-backed source requests.
-
-use std::collections::{BTreeMap, BTreeSet};
-
-use registry_notary_core::RelayOutputContract;
-use registry_platform_httputil::destination::MAX_SERVICE_HOP_OPERATION_TIMEOUT;
-use serde::Deserialize;
-
-const CONTRACT_SCHEMA: &str = "registry.relay.consultation-contract.v1";
-const CONTRACT_VERSION: &str = "1";
-pub(crate) const CONTRACT_HASH_DOMAIN: &[u8] = b"registry.relay.consultation-contract.v1\0";
-const MAX_ID_BYTES: usize = 96;
-const MAX_INPUTS: usize = 16;
-const MAX_SELECTORS: usize = 8;
-const MAX_INPUT_BYTES: u32 = 4_096;
-const MAX_INPUT_PATTERN_BYTES: usize = 1_024;
-const MAX_OUTPUTS: usize = 64;
-const MAX_OUTPUT_STRING_BYTES: u32 = 64 * 1_024;
-const MAX_JSON_INTEGER: i64 = 9_007_199_254_740_991;
-// A consultation reads one bounded response. A materialization refresh may
-// ingest the larger, separately reviewed Relay public-contract footprint.
-const MAX_OPERATION_SOURCE_BYTES: u64 = 16 * 1_024 * 1_024;
-const MAX_MATERIALIZATION_SOURCE_BYTES: u64 = MAX_JSON_INTEGER as u64;
-const MAX_SCHEMA_DEPTH: usize = 8;
-const MAX_SCHEMA_FIELDS: usize = 256;
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub(crate) struct RelayPublicContract {
-    schema: String,
-    id: String,
-    version: String,
-    spec: ContractSpec,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct ContractSpec {
-    subject: Subject,
-    inputs: BTreeMap<String, Input>,
-    integration: IntegrationReference,
-    acquisition: Acquisition,
-    source_provenance: SourceProvenance,
-    output: BTreeMap<String, Output>,
-    authorization: Authorization,
-    bounds: Bounds,
-    public_behavior: PublicBehavior,
-    runtime: RuntimeRequirements,
-    #[serde(default)]
-    materialization: Option<Materialization>,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct Subject {
-    mode: SubjectMode,
-    selector_provenance: SelectorProvenance,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "snake_case")]
-enum SubjectMode {
-    SingleSubject,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
-enum SelectorProvenance {
-    WorkloadSelected,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct IntegrationReference {
-    id: String,
-    revision: i64,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
-#[serde(rename_all = "snake_case")]
-enum InputRole {
-    Selector,
-    Parameter,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
-#[serde(rename_all = "snake_case")]
-enum InputScalarType {
-    String,
-    Boolean,
-    Integer,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
-#[serde(rename_all = "snake_case")]
-enum InputTypeMember {
-    String,
-    Boolean,
-    Integer,
-    Null,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(untagged)]
-enum InputSchemaType {
-    Scalar(InputScalarType),
-    Nullable(Vec<InputTypeMember>),
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
-#[serde(rename_all = "snake_case")]
-enum StringFormat {
-    Date,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
-#[serde(rename_all = "snake_case")]
-enum Canonicalization {
-    Identity,
-    AsciiLowercase,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct Input {
-    role: InputRole,
-    #[serde(rename = "type")]
-    schema_type: InputSchemaType,
-    #[serde(default)]
-    format: Option<StringFormat>,
-    #[serde(rename = "maxLength", default)]
-    max_length: Option<u32>,
-    #[serde(rename = "minLength", default)]
-    min_length: Option<u32>,
-    #[serde(rename = "x-registry-max-bytes", default)]
-    max_bytes: Option<u32>,
-    #[serde(default)]
-    pattern: Option<String>,
-    #[serde(rename = "x-registry-canonicalization")]
-    canonicalization: Canonicalization,
-    #[serde(default)]
-    minimum: Option<i64>,
-    #[serde(default)]
-    maximum: Option<i64>,
-    #[serde(rename = "enum", default)]
-    allowed_values: Vec<serde_json::Value>,
-    #[serde(rename = "const", default)]
-    constant: Option<serde_json::Value>,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
-#[serde(rename_all = "snake_case")]
-enum AcquisitionClass {
-    SourceProjectedExact,
-    BoundedFullRecord,
-    MaterializedSnapshot,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct Acquisition {
-    class: AcquisitionClass,
-    fields: BTreeMap<String, ResponseSchema>,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
-enum ResponseSchema {
-    ScriptBody,
-    Object {
-        nullable: bool,
-        reject_unknown_fields: bool,
-        fields: BTreeMap<String, ResponseField>,
-    },
-    Array {
-        nullable: bool,
-        max_items: u16,
-        items: Box<ResponseSchema>,
-    },
-    String {
-        nullable: bool,
-        max_bytes: u32,
-    },
-    Date {
-        nullable: bool,
-    },
-    Boolean {
-        nullable: bool,
-    },
-    Integer {
-        nullable: bool,
-        minimum: i64,
-        maximum: i64,
-    },
-    Number {
-        nullable: bool,
-        minimum: i64,
-        maximum: i64,
-    },
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct ResponseField {
-    required: bool,
-    schema: Box<ResponseSchema>,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct SourceProvenance {
-    source_observed_at: SourceObservedAt,
-    source_revision: SourceRevision,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
-enum SourceObservedAt {
-    Absent,
-    AcquiredRfc3339 { field: String },
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
-enum SourceRevision {
-    Absent,
-    AcquiredString { field: String, max_bytes: u16 },
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
-enum Output {
-    String {
-        nullable: bool,
-        max_bytes: u32,
-    },
-    Boolean {
-        nullable: bool,
-    },
-    Integer {
-        nullable: bool,
-        minimum: i64,
-        maximum: i64,
-    },
-    Date {
-        nullable: bool,
-        #[serde(default)]
-        max_bytes: Option<u32>,
-    },
-    Object {
-        nullable: bool,
-        max_bytes: u32,
-        fields: BTreeMap<String, OutputObjectField>,
-    },
-    Array {
-        nullable: bool,
-        max_bytes: u32,
-        max_items: u16,
-        items: Box<Output>,
-    },
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct OutputObjectField {
-    required: bool,
-    schema: Box<Output>,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct Authorization {
-    workload: String,
-    required_scope: String,
-    purposes: Vec<String>,
-    legal_basis: String,
-    policy: Policy,
-    consent: Consent,
-    mandatory_obligations: Vec<Never>,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct Policy {
-    id: String,
-    hash: String,
-    decision_cache: PolicyCache,
-    max_decision_age_ms: u32,
-    unavailable: Unavailable,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "snake_case")]
-enum PolicyCache {
-    Disabled,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "snake_case")]
-enum Unavailable {
-    Deny,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct Consent {
-    required: bool,
-    #[serde(default)]
-    verifier: Option<Never>,
-    #[serde(default)]
-    max_age_ms: Option<u32>,
-    #[serde(default)]
-    revocation: Option<ConsentRevocation>,
-    #[serde(default)]
-    unavailable: Option<Unavailable>,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "snake_case")]
-enum ConsentRevocation {
-    OnlineRequired,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "snake_case")]
-enum Never {}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct Bounds {
-    max_source_matches: u8,
-    max_disclosed_records: u8,
-    max_data_exchanges: u8,
-    max_credential_exchanges: u8,
-    max_data_destinations: u8,
-    max_source_bytes: u64,
-    timeout_ms: u32,
-    max_in_flight: u16,
-    quota_per_minute: u32,
-    quota_burst: u16,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Deserialize)]
-#[serde(rename_all = "snake_case")]
-enum Outcome {
-    Match,
-    NoMatch,
-    Ambiguous,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct PublicBehavior {
-    outcomes: Vec<Outcome>,
-    denial_code: String,
-    denial_timing_profile: String,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct RuntimeRequirements {
-    platform_profile: String,
-    source_capability: SourceCapability,
-    script_abi: Option<String>,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
-#[serde(rename_all = "snake_case")]
-enum SourceCapability {
-    Http,
-    Script,
-    Snapshot,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct Materialization {
-    max_snapshot_age_ms: u64,
-    stale_behavior: MaterializationStaleBehavior,
-    footprint: MaterializationFootprint,
-    refresh_class: MaterializationRefreshClass,
-    snapshot_retention_generations: u16,
-    immutable_generation: bool,
-    digest_bound_active_pointer: bool,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "snake_case")]
-enum MaterializationStaleBehavior {
-    Unavailable,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "snake_case")]
-enum MaterializationRefreshClass {
-    OperatorTriggered,
-    Scheduled,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct MaterializationFootprint {
-    fields: Vec<String>,
-    max_source_records: u64,
-    max_source_bytes: u64,
-    max_data_exchanges: u8,
-    max_credential_exchanges: u8,
-    max_data_destinations: u8,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub(crate) struct VerifiedContractSemantics {
-    pub(crate) acquisition_class: VerifiedAcquisitionClass,
-    pub(crate) integration_id: Box<str>,
-    pub(crate) integration_revision: i64,
-    pub(crate) input_types: BTreeMap<String, VerifiedInputType>,
-    pub(crate) source_observed_at: VerifiedSourceField,
-    pub(crate) source_revision: VerifiedSourceField,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum VerifiedInputType {
-    String,
-    Boolean,
-    Integer,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum VerifiedAcquisitionClass {
-    SourceProjectedExact,
-    BoundedFullRecord,
-    MaterializedSnapshot,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub(crate) enum VerifiedSourceField {
-    Absent,
-    Required,
-}
-
-pub(crate) fn verify_contract(
-    contract: RelayPublicContract,
-    profile_id: &str,
-    workload_client_id: &str,
-    purpose: &str,
-    input_names: &[String],
-    expected_outputs: &BTreeMap<String, RelayOutputContract>,
-) -> Result<VerifiedContractSemantics, ()> {
-    if contract.schema != CONTRACT_SCHEMA
-        || contract.version != CONTRACT_VERSION
-        || contract.id != profile_id
-        || !stable_id(&contract.id)
-    {
-        return Err(());
-    }
-    let spec = contract.spec;
-    verify_subject(&spec.subject)?;
-    let input_types = verify_inputs(&spec.inputs, input_names)?;
-    verify_outputs(&spec.output, expected_outputs)?;
-    verify_authorization(&spec.authorization, workload_client_id, purpose)?;
-    verify_behavior(&spec.public_behavior)?;
-    verify_runtime(&spec.runtime, spec.acquisition.class)?;
-    verify_bounds(&spec.bounds, spec.acquisition.class)?;
-    verify_response_schemas(&spec.acquisition.fields)?;
-    if !stable_id(&spec.integration.id)
-        || spec.integration.revision <= 0
-        || spec.integration.revision > MAX_JSON_INTEGER
-    {
-        return Err(());
-    }
-    let source_observed_at = verify_observed_at(
-        &spec.source_provenance.source_observed_at,
-        &spec.acquisition.fields,
-    )?;
-    let source_revision = verify_source_revision(
-        &spec.source_provenance.source_revision,
-        &spec.acquisition.fields,
-    )?;
-    verify_materialization(spec.acquisition.class, spec.materialization.as_ref())?;
-
-    Ok(VerifiedContractSemantics {
-        acquisition_class: match spec.acquisition.class {
-            AcquisitionClass::SourceProjectedExact => {
-                VerifiedAcquisitionClass::SourceProjectedExact
-            }
-            AcquisitionClass::BoundedFullRecord => VerifiedAcquisitionClass::BoundedFullRecord,
-            AcquisitionClass::MaterializedSnapshot => {
-                VerifiedAcquisitionClass::MaterializedSnapshot
-            }
-        },
-        integration_id: spec.integration.id.into_boxed_str(),
-        integration_revision: spec.integration.revision,
-        input_types,
-        source_observed_at,
-        source_revision,
-    })
-}
-
-fn verify_subject(subject: &Subject) -> Result<(), ()> {
-    if !matches!(subject.mode, SubjectMode::SingleSubject) {
-        return Err(());
-    }
-    match subject.selector_provenance {
-        SelectorProvenance::WorkloadSelected => Ok(()),
-    }
-}
-
-fn verify_inputs(
-    inputs: &BTreeMap<String, Input>,
-    expected_names: &[String],
-) -> Result<BTreeMap<String, VerifiedInputType>, ()> {
-    if !(1..=MAX_INPUTS).contains(&inputs.len())
-        || inputs.keys().ne(expected_names.iter())
-        || inputs.keys().any(|name| !stable_id(name))
-    {
-        return Err(());
-    }
-    let selector_count = inputs
-        .values()
-        .filter(|input| input.role == InputRole::Selector)
-        .count();
-    if !(1..=MAX_SELECTORS).contains(&selector_count) {
-        return Err(());
-    }
-    let mut aggregate_bytes = 0_u32;
-    let mut input_types = BTreeMap::new();
-    for (name, input) in inputs {
-        let (scalar, nullable) = resolved_input_type(&input.schema_type)?;
-        if input.role == InputRole::Selector && nullable {
-            return Err(());
-        }
-        let bytes = match scalar {
-            InputScalarType::String => {
-                let max_length = input.max_length.filter(|value| *value > 0).ok_or(())?;
-                let max_bytes = input.max_bytes.filter(|value| *value > 0).ok_or(())?;
-                if input.min_length.is_some_and(|minimum| minimum > max_length)
-                    || input.pattern.as_ref().is_some_and(|pattern| {
-                        pattern.is_empty() || pattern.len() > MAX_INPUT_PATTERN_BYTES
-                    })
-                    || input.minimum.is_some()
-                    || input.maximum.is_some()
-                    || input
-                        .format
-                        .is_some_and(|format| format != StringFormat::Date)
-                {
-                    return Err(());
-                }
-                max_bytes
-            }
-            InputScalarType::Boolean => {
-                if input.format.is_some()
-                    || input.max_length.is_some()
-                    || input.min_length.is_some()
-                    || input.max_bytes.is_some()
-                    || input.pattern.is_some()
-                    || input.minimum.is_some()
-                    || input.maximum.is_some()
-                {
-                    return Err(());
-                }
-                5
-            }
-            InputScalarType::Integer => {
-                let minimum = input.minimum.ok_or(())?;
-                let maximum = input.maximum.ok_or(())?;
-                if minimum > maximum
-                    || minimum < -MAX_JSON_INTEGER
-                    || maximum > MAX_JSON_INTEGER
-                    || input.format.is_some()
-                    || input.max_length.is_some()
-                    || input.min_length.is_some()
-                    || input.max_bytes.is_some()
-                    || input.pattern.is_some()
-                {
-                    return Err(());
-                }
-                u32::try_from(minimum.to_string().len().max(maximum.to_string().len()))
-                    .map_err(|_| ())?
-            }
-        };
-        verify_allowed_values(input, scalar, nullable)?;
-        input_types.insert(
-            name.clone(),
-            match scalar {
-                InputScalarType::String => VerifiedInputType::String,
-                InputScalarType::Boolean => VerifiedInputType::Boolean,
-                InputScalarType::Integer => VerifiedInputType::Integer,
-            },
-        );
-        let _ = input.canonicalization;
-        aggregate_bytes = aggregate_bytes
-            .checked_add(if nullable { bytes.max(4) } else { bytes })
-            .ok_or(())?;
-    }
-    (aggregate_bytes <= MAX_INPUT_BYTES)
-        .then_some(input_types)
-        .ok_or(())
-}
-
-fn resolved_input_type(schema: &InputSchemaType) -> Result<(InputScalarType, bool), ()> {
-    match schema {
-        InputSchemaType::Scalar(scalar) => Ok((*scalar, false)),
-        InputSchemaType::Nullable(members) if members.len() == 2 => {
-            let mut scalar = None;
-            let mut has_null = false;
-            for member in members {
-                match member {
-                    InputTypeMember::String => set_once(&mut scalar, InputScalarType::String)?,
-                    InputTypeMember::Boolean => set_once(&mut scalar, InputScalarType::Boolean)?,
-                    InputTypeMember::Integer => set_once(&mut scalar, InputScalarType::Integer)?,
-                    InputTypeMember::Null if !has_null => has_null = true,
-                    InputTypeMember::Null => return Err(()),
-                }
-            }
-            match (scalar, has_null) {
-                (Some(scalar), true) => Ok((scalar, true)),
-                _ => Err(()),
-            }
-        }
-        InputSchemaType::Nullable(_) => Err(()),
-    }
-}
-
-fn set_once(slot: &mut Option<InputScalarType>, value: InputScalarType) -> Result<(), ()> {
-    if slot.replace(value).is_some() {
-        Err(())
-    } else {
-        Ok(())
-    }
-}
-
-fn verify_allowed_values(input: &Input, scalar: InputScalarType, nullable: bool) -> Result<(), ()> {
-    for value in input.allowed_values.iter().chain(input.constant.iter()) {
-        if value.is_null() && nullable {
-            continue;
-        }
-        let valid = match scalar {
-            InputScalarType::String => value.as_str().is_some_and(|value| {
-                input.max_length.is_some_and(|maximum| {
-                    u32::try_from(value.chars().count()).is_ok_and(|length| length <= maximum)
-                })
-            }),
-            InputScalarType::Boolean => value.is_boolean(),
-            InputScalarType::Integer => value.as_i64().is_some_and(|value| {
-                input.minimum.is_some_and(|minimum| value >= minimum)
-                    && input.maximum.is_some_and(|maximum| value <= maximum)
-            }),
-        };
-        if !valid {
-            return Err(());
-        }
-    }
-    Ok(())
-}
-
-fn verify_outputs(
-    outputs: &BTreeMap<String, Output>,
-    expected: &BTreeMap<String, RelayOutputContract>,
-) -> Result<(), ()> {
-    if outputs.len() > MAX_OUTPUTS || outputs.keys().ne(expected.keys()) {
-        return Err(());
-    }
-    for (name, output) in outputs {
-        if !stable_id(name) || matches!(name.as_str(), "matched" | "outcome") {
-            return Err(());
-        }
-        if !output_contract_matches(output, &expected[name]) {
-            return Err(());
-        }
-    }
-    Ok(())
-}
-
-fn output_contract_matches(output: &Output, expected: &RelayOutputContract) -> bool {
-    match (output, expected) {
-        (
-            Output::String {
-                nullable,
-                max_bytes,
-            },
-            RelayOutputContract::String {
-                nullable: expected_nullable,
-                max_bytes: expected_max_bytes,
-            },
-        ) => {
-            nullable == expected_nullable
-                && max_bytes == expected_max_bytes
-                && (1..=MAX_OUTPUT_STRING_BYTES).contains(max_bytes)
-        }
-        (
-            Output::Date {
-                nullable,
-                max_bytes,
-            },
-            RelayOutputContract::Date {
-                nullable: expected_nullable,
-            },
-        ) => nullable == expected_nullable && max_bytes.is_none_or(|bytes| bytes == 10),
-        (
-            Output::Boolean { nullable },
-            RelayOutputContract::Boolean {
-                nullable: expected_nullable,
-            },
-        ) => nullable == expected_nullable,
-        (
-            Output::Integer {
-                nullable,
-                minimum,
-                maximum,
-            },
-            RelayOutputContract::Integer {
-                nullable: expected_nullable,
-                minimum: expected_minimum,
-                maximum: expected_maximum,
-            },
-        ) => {
-            nullable == expected_nullable
-                && minimum == expected_minimum
-                && maximum == expected_maximum
-                && minimum <= maximum
-                && *minimum >= -MAX_JSON_INTEGER
-                && *maximum <= MAX_JSON_INTEGER
-        }
-        (
-            Output::Object {
-                nullable,
-                max_bytes,
-                fields,
-            },
-            RelayOutputContract::Object {
-                nullable: expected_nullable,
-                max_bytes: expected_max_bytes,
-                fields: expected_fields,
-            },
-        ) => {
-            nullable == expected_nullable
-                && max_bytes == expected_max_bytes
-                && fields.len() <= 32
-                && fields.keys().eq(expected_fields.keys())
-                && fields.iter().all(|(name, field)| {
-                    let expected_field = &expected_fields[name];
-                    bounded_name(name)
-                        && field.required == expected_field.required
-                        && output_contract_matches(&field.schema, &expected_field.schema)
-                })
-        }
-        (
-            Output::Array {
-                nullable,
-                max_bytes,
-                max_items,
-                items,
-            },
-            RelayOutputContract::Array {
-                nullable: expected_nullable,
-                max_bytes: expected_max_bytes,
-                max_items: expected_max_items,
-                items: expected_items,
-            },
-        ) => {
-            nullable == expected_nullable
-                && max_bytes == expected_max_bytes
-                && max_items == expected_max_items
-                && output_contract_matches(items, expected_items)
-        }
-        _ => false,
-    }
-}
-
-fn verify_authorization(
-    authorization: &Authorization,
-    workload_client_id: &str,
-    purpose: &str,
-) -> Result<(), ()> {
-    if authorization.workload != workload_client_id
-        || authorization.purposes.as_slice() != [purpose]
-        || authorization.required_scope.is_empty()
-        || authorization.required_scope.len() > 256
-        || authorization.legal_basis.is_empty()
-        || authorization.legal_basis.len() > 96
-        || !stable_id(&authorization.policy.id)
-        || !sha256_uri(&authorization.policy.hash)
-        || authorization.policy.max_decision_age_ms == 0
-        || authorization.consent.required
-        || authorization.consent.verifier.is_some()
-        || authorization.consent.max_age_ms.is_some()
-        || authorization.consent.revocation.is_some()
-        || authorization.consent.unavailable.is_some()
-        || !authorization.mandatory_obligations.is_empty()
-    {
-        return Err(());
-    }
-    let _ = (
-        &authorization.policy.decision_cache,
-        &authorization.policy.unavailable,
-    );
-    Ok(())
-}
-
-fn verify_behavior(behavior: &PublicBehavior) -> Result<(), ()> {
-    let outcomes = behavior.outcomes.iter().copied().collect::<BTreeSet<_>>();
-    (behavior.outcomes.len() == 3
-        && outcomes == BTreeSet::from([Outcome::Match, Outcome::NoMatch, Outcome::Ambiguous])
-        && behavior.denial_code == "consultation.denied"
-        && behavior.denial_timing_profile == "measured-uniform-v1")
-        .then_some(())
-        .ok_or(())
-}
-
-fn verify_runtime(runtime: &RuntimeRequirements, acquisition: AcquisitionClass) -> Result<(), ()> {
-    if runtime.platform_profile != "registry-stack.consultation.v1" {
-        return Err(());
-    }
-    match (
-        runtime.source_capability,
-        runtime.script_abi.as_deref(),
-        acquisition,
-    ) {
-        (
-            SourceCapability::Script,
-            Some("xw.v1"),
-            AcquisitionClass::SourceProjectedExact | AcquisitionClass::BoundedFullRecord,
-        )
-        | (
-            SourceCapability::Http,
-            None,
-            AcquisitionClass::SourceProjectedExact | AcquisitionClass::BoundedFullRecord,
-        )
-        | (SourceCapability::Snapshot, None, AcquisitionClass::MaterializedSnapshot) => Ok(()),
-        _ => Err(()),
-    }
-}
-
-fn verify_bounds(bounds: &Bounds, class: AcquisitionClass) -> Result<(), ()> {
-    let transport = match class {
-        AcquisitionClass::SourceProjectedExact | AcquisitionClass::BoundedFullRecord => {
-            (1..=16).contains(&bounds.max_data_exchanges)
-                && bounds.max_credential_exchanges <= 1
-                && bounds.max_data_destinations == 1
-        }
-        AcquisitionClass::MaterializedSnapshot => {
-            bounds.max_data_exchanges == 0
-                && bounds.max_credential_exchanges == 0
-                && bounds.max_data_destinations == 0
-        }
-    };
-    let compatible_timeout =
-        u128::from(bounds.timeout_ms) <= MAX_SERVICE_HOP_OPERATION_TIMEOUT.as_millis();
-    ((1..=2).contains(&bounds.max_source_matches)
-        && bounds.max_disclosed_records == 1
-        && transport
-        && (1..=MAX_OPERATION_SOURCE_BYTES).contains(&bounds.max_source_bytes)
-        && bounds.timeout_ms > 0
-        && compatible_timeout
-        && (1..=64).contains(&bounds.max_in_flight)
-        && bounds.quota_per_minute > 0
-        && bounds.quota_burst > 0
-        && u32::from(bounds.quota_burst) <= bounds.quota_per_minute)
-        .then_some(())
-        .ok_or(())
-}
-
-fn verify_response_schemas(fields: &BTreeMap<String, ResponseSchema>) -> Result<(), ()> {
-    if fields.is_empty() || fields.len() > MAX_SCHEMA_FIELDS {
-        return Err(());
-    }
-    let mut nodes = 0_usize;
-    for (name, schema) in fields {
-        if !bounded_name(name) {
-            return Err(());
-        }
-        verify_response_schema(schema, 1, &mut nodes)?;
-    }
-    Ok(())
-}
-
-fn verify_response_schema(
-    schema: &ResponseSchema,
-    depth: usize,
-    nodes: &mut usize,
-) -> Result<(), ()> {
-    *nodes = nodes.checked_add(1).ok_or(())?;
-    if depth > MAX_SCHEMA_DEPTH || *nodes > MAX_SCHEMA_FIELDS {
-        return Err(());
-    }
-    match schema {
-        ResponseSchema::ScriptBody => Ok(()),
-        ResponseSchema::Object {
-            nullable,
-            reject_unknown_fields,
-            fields,
-        } => {
-            let _ = (nullable, reject_unknown_fields);
-            if fields.is_empty() || fields.len() > 32 {
-                return Err(());
-            }
-            for (name, field) in fields {
-                if !bounded_name(name) {
-                    return Err(());
-                }
-                let _ = field.required;
-                verify_response_schema(&field.schema, depth + 1, nodes)?;
-            }
-            Ok(())
-        }
-        ResponseSchema::Array {
-            nullable,
-            max_items,
-            items,
-        } => {
-            let _ = nullable;
-            if *max_items == 0 || *max_items > 256 {
-                return Err(());
-            }
-            verify_response_schema(items, depth + 1, nodes)
-        }
-        ResponseSchema::String {
-            nullable,
-            max_bytes,
-        } => {
-            let _ = nullable;
-            (1..=MAX_OUTPUT_STRING_BYTES)
-                .contains(max_bytes)
-                .then_some(())
-                .ok_or(())
-        }
-        ResponseSchema::Date { nullable } => {
-            let _ = nullable;
-            Ok(())
-        }
-        ResponseSchema::Boolean { nullable } => {
-            let _ = nullable;
-            Ok(())
-        }
-        ResponseSchema::Integer {
-            nullable,
-            minimum,
-            maximum,
-        }
-        | ResponseSchema::Number {
-            nullable,
-            minimum,
-            maximum,
-        } => {
-            let _ = nullable;
-            (*minimum <= *maximum && *minimum >= -MAX_JSON_INTEGER && *maximum <= MAX_JSON_INTEGER)
-                .then_some(())
-                .ok_or(())
-        }
-    }
-}
-
-fn verify_observed_at(
-    observed: &SourceObservedAt,
-    fields: &BTreeMap<String, ResponseSchema>,
-) -> Result<VerifiedSourceField, ()> {
-    match observed {
-        SourceObservedAt::Absent => Ok(VerifiedSourceField::Absent),
-        SourceObservedAt::AcquiredRfc3339 { field } => match fields.get(field) {
-            Some(ResponseSchema::String {
-                nullable: false,
-                max_bytes,
-            }) if *max_bytes <= 64 => Ok(VerifiedSourceField::Required),
-            _ => Err(()),
-        },
-    }
-}
-
-fn verify_source_revision(
-    revision: &SourceRevision,
-    fields: &BTreeMap<String, ResponseSchema>,
-) -> Result<VerifiedSourceField, ()> {
-    match revision {
-        SourceRevision::Absent => Ok(VerifiedSourceField::Absent),
-        SourceRevision::AcquiredString { field, max_bytes } => match fields.get(field) {
-            Some(ResponseSchema::String {
-                nullable: false,
-                max_bytes: field_max,
-            }) if *max_bytes > 0 && *max_bytes <= 128 && u32::from(*max_bytes) == *field_max => {
-                Ok(VerifiedSourceField::Required)
-            }
-            _ => Err(()),
-        },
-    }
-}
-
-fn verify_materialization(
-    class: AcquisitionClass,
-    materialization: Option<&Materialization>,
-) -> Result<(), ()> {
-    match (class, materialization) {
-        (AcquisitionClass::MaterializedSnapshot, Some(materialization)) => {
-            let _ = (
-                &materialization.stale_behavior,
-                &materialization.refresh_class,
-            );
-            (materialization.max_snapshot_age_ms > 0
-                && !materialization.footprint.fields.is_empty()
-                && materialization
-                    .footprint
-                    .fields
-                    .iter()
-                    .all(|field| bounded_name(field))
-                && materialization.footprint.max_source_records > 0
-                && (1..=MAX_MATERIALIZATION_SOURCE_BYTES)
-                    .contains(&materialization.footprint.max_source_bytes)
-                && (1..=16).contains(&materialization.footprint.max_data_exchanges)
-                && materialization.footprint.max_credential_exchanges <= 1
-                && materialization.footprint.max_data_destinations == 1
-                && materialization.snapshot_retention_generations > 0
-                && materialization.immutable_generation
-                && materialization.digest_bound_active_pointer)
-                .then_some(())
-                .ok_or(())
-        }
-        (AcquisitionClass::SourceProjectedExact | AcquisitionClass::BoundedFullRecord, None) => {
-            Ok(())
-        }
-        _ => Err(()),
-    }
-}
-
-fn stable_id(value: &str) -> bool {
-    !value.is_empty()
-        && value.len() <= MAX_ID_BYTES
-        && value.as_bytes()[0].is_ascii_lowercase()
-        && value.bytes().all(|byte| {
-            byte.is_ascii_lowercase() || byte.is_ascii_digit() || matches!(byte, b'.' | b'-' | b'_')
-        })
-}
-
-fn bounded_name(value: &str) -> bool {
-    !value.is_empty() && value.len() <= 128 && !value.chars().any(char::is_control)
-}
-
-fn sha256_uri(value: &str) -> bool {
-    value.len() == 71
-        && value.starts_with("sha256:")
-        && value.as_bytes()[7..]
-            .iter()
-            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(byte))
-}
diff --git a/crates/registry-notary-server/src/relay_contract_test_support.rs b/crates/registry-notary-server/src/relay_contract_test_support.rs
deleted file mode 100644
index d39653d51..000000000
--- a/crates/registry-notary-server/src/relay_contract_test_support.rs
+++ /dev/null
@@ -1,52 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Cross-product test adapter for Relay consultation contracts.
-
-use std::collections::BTreeMap;
-
-use registry_notary_core::RelayOutputContract;
-use registry_platform_httputil::destination::json::decode_typed_hash_envelope_as;
-use registry_platform_httputil::destination::DataDestinationBody;
-
-use crate::relay_contract::{verify_contract, RelayPublicContract, CONTRACT_HASH_DOMAIN};
-
-/// Decode and verify one exact compiler-produced Relay contract artifact with
-/// the same closed decoder and semantic verifier used during Notary startup.
-#[must_use]
-pub fn verifies_contract_artifact(
-    contract_bytes: &[u8],
-    expected_hash: &str,
-    profile_id: &str,
-    workload_client_id: &str,
-    purpose: &str,
-    input_names: &[String],
-    expected_outputs: &BTreeMap<String, RelayOutputContract>,
-) -> bool {
-    // Production Relay serves this artifact in a typed-hash envelope. The
-    // project compiler emits the canonical contract and its independently
-    // pinned hash as separate product inputs, so this test-only adapter joins
-    // those exact inputs before exercising Notary's production decoder.
-    let mut envelope_bytes = Vec::with_capacity(contract_bytes.len().saturating_add(128));
-    envelope_bytes.extend_from_slice(b"{\"contract_hash\":\"");
-    envelope_bytes.extend_from_slice(expected_hash.as_bytes());
-    envelope_bytes.extend_from_slice(b"\",\"contract\":");
-    envelope_bytes.extend_from_slice(contract_bytes);
-    envelope_bytes.push(b'}');
-    let Ok(envelope) = decode_typed_hash_envelope_as::<RelayPublicContract>(
-        DataDestinationBody::from_test_bytes(&envelope_bytes),
-        CONTRACT_HASH_DOMAIN,
-    ) else {
-        return false;
-    };
-    if envelope.advertised_hash() != expected_hash || envelope.computed_hash() != expected_hash {
-        return false;
-    }
-    verify_contract(
-        envelope.into_contract(),
-        profile_id,
-        workload_client_id,
-        purpose,
-        input_names,
-        expected_outputs,
-    )
-    .is_ok()
-}
diff --git a/crates/registry-notary-server/src/replay.rs b/crates/registry-notary-server/src/replay.rs
deleted file mode 100644
index 66e10751d..000000000
--- a/crates/registry-notary-server/src/replay.rs
+++ /dev/null
@@ -1,384 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Replay-store wiring for Registry Notary one-time identifiers.
-
-use std::sync::Arc;
-
-use async_trait::async_trait;
-use registry_platform_replay::{
-    require_insert_once, ConsumableNonceStore, InMemoryConsumableNonceStore, InMemoryReplayStore,
-    ReplayKey, ReplayScope, ReplayStore, ReplayStoreError, RequiredReplayError,
-};
-use sha2::{Digest, Sha256};
-use time::OffsetDateTime;
-
-use crate::state_plane::{NotaryPostgresStatePlaneReadiness, NotaryStatePlaneHandle};
-
-#[derive(Clone)]
-pub(crate) struct ReplayStores {
-    store: Arc<dyn ReplayStore>,
-    nonce_store: Arc<dyn ConsumableNonceStore>,
-    state_plane: Option<Arc<NotaryStatePlaneHandle>>,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub(crate) enum ReplayReadiness {
-    Ready,
-    Degraded,
-}
-
-impl std::fmt::Debug for ReplayStores {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("ReplayStores")
-            .field("store", &"<redacted>")
-            .field("nonce_store", &"<redacted>")
-            .finish()
-    }
-}
-
-impl ReplayStores {
-    pub(crate) fn memory() -> Self {
-        let store = Arc::new(InMemoryReplayStore::new());
-        let nonce_store = Arc::new(InMemoryConsumableNonceStore::new());
-        Self {
-            store,
-            nonce_store,
-            state_plane: None,
-        }
-    }
-
-    pub(crate) fn configured_in_memory(state_plane: Arc<NotaryStatePlaneHandle>) -> Self {
-        let store = Arc::new(InMemoryReplayStore::new());
-        let nonce_store = Arc::new(InMemoryConsumableNonceStore::new());
-        Self {
-            store,
-            nonce_store,
-            state_plane: Some(state_plane),
-        }
-    }
-
-    pub(crate) fn postgres(state_plane: Arc<NotaryStatePlaneHandle>) -> Self {
-        let store = Arc::new(PostgresReplayStore {
-            state_plane: Arc::clone(&state_plane),
-        });
-        Self {
-            store: store.clone(),
-            nonce_store: store,
-            state_plane: Some(state_plane),
-        }
-    }
-
-    pub(crate) fn store(&self) -> Arc<dyn ReplayStore> {
-        Arc::clone(&self.store)
-    }
-
-    pub(crate) fn nonce_store(&self) -> Arc<dyn ConsumableNonceStore> {
-        Arc::clone(&self.nonce_store)
-    }
-
-    pub(crate) async fn check_ready(&self) -> Result<ReplayReadiness, ReplayStoreError> {
-        let Some(state_plane) = &self.state_plane else {
-            return Ok(ReplayReadiness::Degraded);
-        };
-        match state_plane.readiness().await {
-            NotaryPostgresStatePlaneReadiness::Ready => Ok(ReplayReadiness::Ready),
-            _ => Err(replay_operation_error()),
-        }
-    }
-}
-
-#[derive(Clone)]
-struct PostgresReplayStore {
-    state_plane: Arc<NotaryStatePlaneHandle>,
-}
-
-#[async_trait]
-impl ReplayStore for PostgresReplayStore {
-    async fn insert_once(
-        &self,
-        scope: &ReplayScope,
-        key: &ReplayKey,
-        expires_at: OffsetDateTime,
-    ) -> Result<registry_platform_replay::ReplayInsertOutcome, ReplayStoreError> {
-        let runtime = self
-            .state_plane
-            .runtime()
-            .map_err(|_| replay_operation_error())?;
-        let session = runtime
-            .open_domain_session()
-            .await
-            .map_err(|_| replay_operation_error())?;
-        let scope_hash = replay_scope_hash(scope);
-        let identifier_hash = replay_key_hash(key);
-        let row = session
-            .run_operation(session.client().query_one(
-                "SELECT registry_notary_api.replay_insert_v1($1, $2, $3) AS inserted",
-                &[
-                    &scope_hash.as_slice(),
-                    &identifier_hash.as_slice(),
-                    &expires_at,
-                ],
-            ))
-            .await
-            .map_err(|_| replay_operation_error())?;
-        let inserted = row
-            .try_get::<_, bool>("inserted")
-            .map_err(|_| replay_operation_error())?;
-        Ok(if inserted {
-            registry_platform_replay::ReplayInsertOutcome::Inserted
-        } else {
-            registry_platform_replay::ReplayInsertOutcome::AlreadySeen
-        })
-    }
-}
-
-#[async_trait]
-impl ConsumableNonceStore for PostgresReplayStore {
-    async fn reserve_nonce(
-        &self,
-        scope: &ReplayScope,
-        key: &ReplayKey,
-        expires_at: OffsetDateTime,
-    ) -> Result<(), ReplayStoreError> {
-        let runtime = self
-            .state_plane
-            .runtime()
-            .map_err(|_| replay_operation_error())?;
-        let session = runtime
-            .open_domain_session()
-            .await
-            .map_err(|_| replay_operation_error())?;
-        let scope_hash = replay_scope_hash(scope);
-        let nonce_hash = replay_key_hash(key);
-        let row = session
-            .run_operation(session.client().query_one(
-                "SELECT registry_notary_api.nonce_reserve_v1($1, $2, $3) AS reserved",
-                &[&scope_hash.as_slice(), &nonce_hash.as_slice(), &expires_at],
-            ))
-            .await
-            .map_err(|_| replay_operation_error())?;
-        if row
-            .try_get::<_, bool>("reserved")
-            .map_err(|_| replay_operation_error())?
-        {
-            Ok(())
-        } else {
-            Err(ReplayStoreError::Operation {
-                message: "nonce is already reserved".to_string(),
-            })
-        }
-    }
-
-    async fn consume_nonce(
-        &self,
-        scope: &ReplayScope,
-        key: &ReplayKey,
-    ) -> Result<registry_platform_replay::ReplayInsertOutcome, ReplayStoreError> {
-        let runtime = self
-            .state_plane
-            .runtime()
-            .map_err(|_| replay_operation_error())?;
-        let session = runtime
-            .open_domain_session()
-            .await
-            .map_err(|_| replay_operation_error())?;
-        let scope_hash = replay_scope_hash(scope);
-        let nonce_hash = replay_key_hash(key);
-        let generation = session
-            .run_operation(session.client().query_one(
-                "SELECT registry_notary_api.nonce_reservation_generation_v1($1, $2) AS generation",
-                &[&scope_hash.as_slice(), &nonce_hash.as_slice()],
-            ))
-            .await
-            .map_err(|_| replay_operation_error())?
-            .try_get::<_, Option<i64>>("generation")
-            .map_err(|_| replay_operation_error())?;
-        let Some(generation) = generation else {
-            return Ok(registry_platform_replay::ReplayInsertOutcome::AlreadySeen);
-        };
-        let row = session
-            .run_operation(session.client().query_one(
-                "SELECT registry_notary_api.nonce_consume_v1($1, $2, $3) AS consumed",
-                &[&scope_hash.as_slice(), &nonce_hash.as_slice(), &generation],
-            ))
-            .await
-            .map_err(|_| replay_operation_error())?;
-        let consumed = row
-            .try_get::<_, bool>("consumed")
-            .map_err(|_| replay_operation_error())?;
-        Ok(if consumed {
-            registry_platform_replay::ReplayInsertOutcome::Inserted
-        } else {
-            registry_platform_replay::ReplayInsertOutcome::AlreadySeen
-        })
-    }
-}
-
-pub(crate) fn replay_scope_hash(scope: &ReplayScope) -> [u8; 32] {
-    let mut hasher = Sha256::new();
-    hasher.update(b"registry-notary:replay-scope:v1\0");
-    for (name, value) in scope.parts() {
-        hasher.update((name.len() as u64).to_be_bytes());
-        hasher.update(name.as_bytes());
-        hasher.update((value.len() as u64).to_be_bytes());
-        hasher.update(value.as_bytes());
-    }
-    hasher.finalize().into()
-}
-
-pub(crate) fn replay_key_hash(key: &ReplayKey) -> [u8; 32] {
-    replay_identifier_hash(key.as_str())
-}
-
-/// Stable Notary replay identity for an already-validated one-time value.
-///
-/// This deliberately does not depend on an application secret. Replay rows
-/// must remain authoritative across application-key rotation, and callers only
-/// pass protocol-generated high-entropy identifiers through this boundary.
-pub(crate) fn replay_identifier_hash(identifier: &str) -> [u8; 32] {
-    let mut hasher = Sha256::new();
-    hasher.update(b"registry-notary:replay-identifier:v1\0");
-    hasher.update((identifier.len() as u64).to_be_bytes());
-    hasher.update(identifier.as_bytes());
-    hasher.finalize().into()
-}
-
-fn replay_operation_error() -> ReplayStoreError {
-    ReplayStoreError::Operation {
-        message: "Notary PostgreSQL replay operation is unavailable".to_string(),
-    }
-}
-
-pub(crate) async fn require_replay_insert(
-    store: &dyn ReplayStore,
-    scope: &ReplayScope,
-    key: &ReplayKey,
-    expires_at: OffsetDateTime,
-) -> Result<(), RequiredReplayError> {
-    require_insert_once(store, scope, key, expires_at).await
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use registry_platform_replay::{ReplayInsertOutcome, DEFAULT_IN_MEMORY_NONCE_MAX_ENTRIES};
-
-    fn oid4vci_nonce_scope() -> ReplayScope {
-        ReplayScope::oid4vci_nonce(
-            "tenant.example",
-            "https://issuer.example",
-            "person_is_alive_sd_jwt",
-        )
-        .expect("scope is valid")
-    }
-
-    #[tokio::test]
-    async fn memory_nonce_store_consumes_once_and_rejects_replay() {
-        let stores = ReplayStores::memory();
-        let scope = oid4vci_nonce_scope();
-        let key = ReplayKey::new("nonce-digest-1").expect("key is valid");
-        let wrong_scope = ReplayScope::oid4vci_nonce(
-            "tenant.example",
-            "https://issuer.example",
-            "other_credential_sd_jwt",
-        )
-        .expect("scope is valid");
-
-        stores
-            .nonce_store()
-            .reserve_nonce(
-                &scope,
-                &key,
-                OffsetDateTime::now_utc() + time::Duration::seconds(60),
-            )
-            .await
-            .expect("nonce reserves");
-
-        assert_eq!(
-            stores
-                .nonce_store()
-                .consume_nonce(&wrong_scope, &key)
-                .await
-                .expect("wrong scope checks cleanly"),
-            ReplayInsertOutcome::AlreadySeen
-        );
-        assert_eq!(
-            stores
-                .nonce_store()
-                .consume_nonce(&scope, &key)
-                .await
-                .expect("first nonce use succeeds"),
-            ReplayInsertOutcome::Inserted
-        );
-        assert_eq!(
-            stores
-                .nonce_store()
-                .consume_nonce(&scope, &key)
-                .await
-                .expect("second nonce use checks cleanly"),
-            ReplayInsertOutcome::AlreadySeen
-        );
-    }
-
-    #[tokio::test]
-    async fn memory_replay_store_rejects_holder_proof_duplicate() {
-        let stores = ReplayStores::memory();
-        let scope = ReplayScope::holder_proof_jwt(
-            "tenant.example",
-            "https://issuer.example",
-            "person_is_alive_sd_jwt",
-            "holder-thumbprint",
-        )
-        .expect("scope is valid");
-        let key = ReplayKey::new("holder-proof-jti").expect("key is valid");
-        let expires_at = OffsetDateTime::now_utc() + time::Duration::seconds(60);
-
-        require_replay_insert(stores.store().as_ref(), &scope, &key, expires_at)
-            .await
-            .expect("first proof use succeeds");
-        assert!(matches!(
-            require_replay_insert(stores.store().as_ref(), &scope, &key, expires_at).await,
-            Err(RequiredReplayError::AlreadySeen)
-        ));
-    }
-
-    #[tokio::test]
-    async fn memory_replay_store_reports_degraded_readiness() {
-        let stores = ReplayStores::memory();
-
-        assert_eq!(
-            stores.check_ready().await.expect("memory store reports"),
-            ReplayReadiness::Degraded
-        );
-    }
-
-    #[tokio::test]
-    async fn memory_nonce_store_rejects_reservations_over_cap() {
-        let store = InMemoryConsumableNonceStore::new();
-        let scope = oid4vci_nonce_scope();
-        let expires_at = OffsetDateTime::now_utc() + time::Duration::seconds(60);
-
-        for index in 0..DEFAULT_IN_MEMORY_NONCE_MAX_ENTRIES {
-            store
-                .reserve_nonce(
-                    &scope,
-                    &ReplayKey::new(format!("nonce-{index}")).expect("key is valid"),
-                    expires_at,
-                )
-                .await
-                .expect("nonce below cap reserves");
-        }
-
-        let err = store
-            .reserve_nonce(
-                &scope,
-                &ReplayKey::new("nonce-over-cap").expect("key is valid"),
-                expires_at,
-            )
-            .await
-            .expect_err("nonce over cap fails closed");
-        assert!(
-            err.to_string().contains("in-memory cache store is full"),
-            "unexpected: {err}"
-        );
-    }
-}
diff --git a/crates/registry-notary-server/src/request_context.rs b/crates/registry-notary-server/src/request_context.rs
deleted file mode 100644
index d7c248333..000000000
--- a/crates/registry-notary-server/src/request_context.rs
+++ /dev/null
@@ -1,51 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Request-scoped correlation identifiers shared across server components.
-
-use std::future::Future;
-
-use registry_notary_core::BoundedCorrelationId;
-use ulid::Ulid;
-
-tokio::task_local! {
-    static REQUEST_CORRELATION_ID: BoundedCorrelationId;
-}
-
-pub(crate) async fn with_request_correlation_id<F>(
-    correlation_id: BoundedCorrelationId,
-    future: F,
-) -> F::Output
-where
-    F: Future,
-{
-    REQUEST_CORRELATION_ID.scope(correlation_id, future).await
-}
-
-pub(crate) fn current_request_correlation_id() -> Option<BoundedCorrelationId> {
-    REQUEST_CORRELATION_ID
-        .try_with(BoundedCorrelationId::clone)
-        .ok()
-}
-
-pub(crate) fn new_request_correlation_id() -> BoundedCorrelationId {
-    BoundedCorrelationId::new(Ulid::new().to_string()).expect("generated correlation id is bounded")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[tokio::test]
-    async fn scopes_correlation_id_without_leaking_after_completion() {
-        let correlation_id =
-            BoundedCorrelationId::new("request-1").expect("test correlation id is bounded");
-
-        assert_eq!(current_request_correlation_id(), None);
-        let observed = with_request_correlation_id(correlation_id.clone(), async {
-            current_request_correlation_id()
-        })
-        .await;
-
-        assert_eq!(observed, Some(correlation_id));
-        assert_eq!(current_request_correlation_id(), None);
-    }
-}
diff --git a/crates/registry-notary-server/src/response_context.rs b/crates/registry-notary-server/src/response_context.rs
deleted file mode 100644
index 5549007be..000000000
--- a/crates/registry-notary-server/src/response_context.rs
+++ /dev/null
@@ -1,54 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Response extensions shared by handlers, middleware, audit, and metrics.
-
-use registry_notary_core::{
-    AccessMode, ConfigAuditEvent, ConfigMetadata, EvidenceBatchItemAuditEvent,
-    EvidenceEntityReference, Hashed, PolicyIdentifier, RateLimitBucket, SubjectAccessDenialCode,
-};
-
-#[derive(Clone, Default)]
-pub struct EvidenceAuditContext {
-    pub verification_id: Option<String>,
-    pub verification_decision: Option<String>,
-    pub claim_hash: Option<String>,
-    pub purposes: Option<Vec<String>>,
-    pub row_count: Option<u64>,
-    pub relay_consultation_count: Option<u64>,
-    /// Restricted cross-service correlation. Response extensions feed the
-    /// audit sink only and are never serialized into the HTTP response body.
-    pub relay_consultation_ids: Vec<String>,
-    pub forwarded: Option<bool>,
-    pub access_mode: Option<AccessMode>,
-    pub denial_code: Option<SubjectAccessDenialCode>,
-    pub token_claim_name: Option<ConfigMetadata>,
-    pub credential_profile: Option<ConfigMetadata>,
-    pub protocol: Option<ConfigMetadata>,
-    pub credential_configuration_id: Option<ConfigMetadata>,
-    pub holder_binding_mode: Option<ConfigMetadata>,
-    pub rate_limit_bucket: Option<RateLimitBucket>,
-    pub policy_hash: Option<Hashed<PolicyIdentifier>>,
-    pub target_type: Option<String>,
-    pub target_ref_hash: Option<Hashed<EvidenceEntityReference>>,
-    pub requester_type: Option<String>,
-    pub requester_ref_hash: Option<Hashed<EvidenceEntityReference>>,
-    pub redacted_fields: Option<Vec<String>>,
-    pub batch_items: Option<Vec<EvidenceBatchItemAuditEvent>>,
-    pub config: Option<ConfigAuditEvent>,
-}
-
-impl std::fmt::Debug for EvidenceAuditContext {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("EvidenceAuditContext")
-            .field("verification_id", &"[REDACTED]")
-            .field("verification_decision", &self.verification_decision)
-            .field("relay_consultation_count", &self.relay_consultation_count)
-            .field("relay_consultation_ids", &"[REDACTED]")
-            .field("forwarded", &self.forwarded)
-            .field("access_mode", &self.access_mode)
-            .finish_non_exhaustive()
-    }
-}
-
-#[derive(Debug, Clone)]
-pub struct EvidenceErrorCodeContext(pub String);
diff --git a/crates/registry-notary-server/src/runtime.rs b/crates/registry-notary-server/src/runtime.rs
deleted file mode 100644
index ae2edb2c0..000000000
--- a/crates/registry-notary-server/src/runtime.rs
+++ /dev/null
@@ -1,102 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Registry Notary evaluation runtime.
-
-use std::collections::{BTreeMap, BTreeSet};
-use std::sync::{Arc, Mutex};
-
-#[cfg(feature = "registry-notary-cel")]
-use crosswalk_core::{
-    ErrorSeverity, MappingRuntime, RuntimeOptions, SecurityLimits, StandaloneExpressionInput,
-};
-#[cfg(test)]
-use registry_notary_core::SubjectRequest;
-use registry_notary_core::{
-    is_rfc3339_full_date, AccessMode, BatchClaimResultView, BatchEvaluateRequest,
-    BatchEvaluateResponse, BatchItemError, BatchItemResponse, BatchItemStatus, BatchStatus,
-    BatchSummary, BoundedClaimId, BoundedCorrelationId, ClaimDefinition, ClaimEvidenceMode,
-    ClaimProvenance, ClaimRef, ClaimResultView, CredentialProfileConfig, DisclosureDowngrade,
-    DisclosureProfile, EvaluateRequest, EvaluationCapability, EvidenceAuthProfileId,
-    EvidenceConfig, EvidenceEntity, EvidenceEntityRef, EvidenceError, EvidenceFormat,
-    EvidencePrincipal, EvidenceRequestContext, ProvenanceUsed, RegistryNotaryCelConfig,
-    RenderRequest, RuleConfig, StoredIssuanceClaimProvenance, StoredIssuanceConsultationProvenance,
-    StoredIssuanceProvenance, StoredSubjectAccessMetadata, SubjectAccessConfig,
-    SubjectAccessDenialCode, TargetRefView, FORMAT_CCCEV_JSONLD, FORMAT_CLAIM_RESULT_JSON,
-    FORMAT_SD_JWT_VC, MAX_CLAIM_DEPENDENCY_EDGES_V1, MAX_CLAIM_DEPENDENCY_NODES_V1,
-    SD_JWT_VC_HOLDER_BINDING_METHOD, SD_JWT_VC_ISSUER_KEY_TYPE, SD_JWT_VC_JWT_TYP,
-    SD_JWT_VC_SIGNING_ALG,
-};
-#[cfg(test)]
-use registry_notary_core::{
-    RelayConsultationConfig, RelayConsultationInput, RelayConsultationProfileRef,
-    RelayOutputContract,
-};
-use registry_platform_audit::AuditKeyHasher;
-#[cfg(feature = "registry-notary-cel")]
-use serde_json::Map;
-use serde_json::{json, Value};
-use time::format_description::well_known::Rfc3339;
-use time::OffsetDateTime;
-use tokio::sync::Semaphore;
-
-const SD_JWT_VC_RSA_ISSUER_KEY_TYPE: &str = "RSA";
-const SD_JWT_VC_P256_ISSUER_KEY_TYPE: &str = "EC/P-256";
-use tokio::task::JoinSet;
-use ulid::Ulid;
-use zeroize::Zeroizing;
-
-#[cfg(feature = "registry-notary-cel")]
-use crate::cel_worker::{cel_expression_uses_regex, CelWorker, CelWorkerError};
-use crate::digest::{hex_encode, sha256_canonical_json};
-use crate::json_path::get_json_path;
-use crate::problem::evidence_title;
-use crate::request_context::with_request_correlation_id;
-use crate::subject_access_rate_limit::SubjectAccessRateLimitKeys;
-
-mod access;
-mod catalog;
-mod cel;
-pub(crate) mod consultation;
-mod disclosure;
-mod evaluation;
-mod render;
-mod store;
-mod types;
-
-use access::*;
-pub use catalog::*;
-#[cfg(feature = "registry-notary-cel")]
-pub(crate) use cel::validate_cel_claims_for_startup;
-pub(crate) use consultation::ConsultationGroupKeyV1;
-pub(crate) use consultation::{
-    ActivatedRelayClientSet, ActivatedRelayConsultations, EvaluationAuditSnapshot,
-    RelayClientSelectionV1, RelayProfileReadiness, RuntimeRelayConsultationResult,
-    RuntimeRelayExpectedResult,
-};
-use consultation::{
-    EvaluationAuditCollector, RequestScopedRelayPlan, RuntimeRelayOutcome,
-    MAX_BATCH_CONSULTATION_GROUPS_V1,
-};
-#[cfg(test)]
-use consultation::{RuntimeRelayMatchData, RuntimeRelayOutputMap};
-use disclosure::*;
-pub use evaluation::*;
-pub use render::*;
-pub use store::*;
-pub use types::*;
-
-#[cfg(test)]
-mod tests {
-    use super::cel::*;
-    use super::*;
-    use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-    use base64::Engine;
-    use std::sync::atomic::{AtomicU64, Ordering};
-
-    include!("runtime/tests/support.rs");
-    include!("runtime/tests/catalog.rs");
-    include!("runtime/tests/evaluation.rs");
-    include!("runtime/tests/render.rs");
-    include!("runtime/tests/disclosure.rs");
-    include!("runtime/tests/access.rs");
-    include!("runtime/tests/cel.rs");
-}
diff --git a/crates/registry-notary-server/src/runtime/access.rs b/crates/registry-notary-server/src/runtime/access.rs
deleted file mode 100644
index de43b9cbd..000000000
--- a/crates/registry-notary-server/src/runtime/access.rs
+++ /dev/null
@@ -1,385 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-
-pub(super) fn principal_can_see_claim(
-    principal: &EvidencePrincipal,
-    claim: &ClaimDefinition,
-) -> bool {
-    claim
-        .required_scopes
-        .iter()
-        .all(|scope| principal.has_scope(scope))
-}
-
-pub(super) fn require_claim_access(
-    principal: &EvidencePrincipal,
-    claim: &ClaimDefinition,
-) -> Result<(), EvidenceError> {
-    for scope in &claim.required_scopes {
-        if !principal.has_scope(scope) {
-            return Err(EvidenceError::ScopeDenied {
-                required: scope.clone(),
-            });
-        }
-    }
-    Ok(())
-}
-
-pub(super) fn evaluation_capability_for_principal(
-    subject_access_rate_keys: &SubjectAccessRateLimitKeys,
-    principal: &EvidencePrincipal,
-    requested_claims: &[String],
-) -> Result<EvaluationCapability, EvidenceError> {
-    match principal.access_mode() {
-        AccessMode::MachineClient => Ok(EvaluationCapability::Machine {
-            scopes: principal.scopes.iter().cloned().collect(),
-        }),
-        AccessMode::SubjectBound => {
-            if requested_claims.is_empty() {
-                return Err(EvidenceError::SubjectAccessDenied {
-                    reason: SubjectAccessDenialCode::ClaimDenied,
-                });
-            }
-            let mut allowed_claim_ids = BTreeSet::new();
-            for claim_id in requested_claims {
-                allowed_claim_ids.insert(
-                    BoundedClaimId::new(claim_id.clone())
-                        .map_err(|_| EvidenceError::InvalidRequest)?,
-                );
-            }
-            let claim_id = if requested_claims.len() == 1 {
-                allowed_claim_ids.iter().next().cloned()
-            } else {
-                None
-            };
-            let claims =
-                principal
-                    .verified_claims
-                    .as_ref()
-                    .ok_or(EvidenceError::SubjectAccessDenied {
-                        reason: SubjectAccessDenialCode::SubjectClaimMissing,
-                    })?;
-            let subject_binding_value = claims.subject_binding_value.as_ref().ok_or(
-                EvidenceError::SubjectAccessDenied {
-                    reason: SubjectAccessDenialCode::SubjectClaimMissing,
-                },
-            )?;
-            let subject_binding_hash = subject_access_rate_keys
-                .subject_binding(subject_binding_value.as_str())
-                .map_err(|error| error.evidence_error())?;
-            Ok(EvaluationCapability::SubjectBound {
-                claim_id,
-                allowed_claim_ids,
-                subject_binding_hash,
-            })
-        }
-        AccessMode::DelegatedSubjectAccess => Err(delegated_subject_access_denied()),
-        AccessMode::Unknown => Err(EvidenceError::SubjectAccessInvalidToken),
-    }
-}
-
-pub(super) fn ensure_evaluation_capability_matches_principal(
-    principal: &EvidencePrincipal,
-    capability: &EvaluationCapability,
-) -> Result<(), EvidenceError> {
-    match (principal.access_mode(), capability.access_mode()) {
-        (AccessMode::MachineClient, AccessMode::MachineClient)
-        | (AccessMode::SubjectBound, AccessMode::SubjectBound)
-        | (AccessMode::DelegatedSubjectAccess, AccessMode::DelegatedSubjectAccess) => Ok(()),
-        (AccessMode::SubjectBound, AccessMode::MachineClient) => {
-            Err(EvidenceError::SubjectAccessDenied {
-                reason: SubjectAccessDenialCode::OperationDenied,
-            })
-        }
-        (AccessMode::DelegatedSubjectAccess, AccessMode::MachineClient) => {
-            Err(delegated_subject_access_denied())
-        }
-        _ => Err(EvidenceError::SubjectAccessInvalidToken),
-    }
-}
-
-pub(super) fn require_evaluation_capability(
-    capability: &EvaluationCapability,
-    claim_id: &str,
-) -> Result<(), EvidenceError> {
-    match capability {
-        EvaluationCapability::Machine { .. } => Ok(()),
-        EvaluationCapability::SubjectBound { .. }
-            if capability.allows_subject_access_claim(claim_id) =>
-        {
-            Ok(())
-        }
-        EvaluationCapability::DelegatedSubjectAccess { .. }
-            if capability.allows_delegated_claim(claim_id) =>
-        {
-            Ok(())
-        }
-        EvaluationCapability::SubjectBound { .. } => Err(EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::ClaimDenied,
-        }),
-        EvaluationCapability::DelegatedSubjectAccess { .. } => {
-            Err(delegated_subject_access_denied())
-        }
-    }
-}
-
-pub(super) fn require_relay_consultation_capability(
-    capability: &EvaluationCapability,
-    claim_id: &str,
-) -> Result<(), EvidenceError> {
-    match capability {
-        EvaluationCapability::Machine { .. } => Ok(()),
-        EvaluationCapability::DelegatedSubjectAccess { .. }
-            if capability.allows_delegated_claim(claim_id) =>
-        {
-            Ok(())
-        }
-        EvaluationCapability::SubjectBound { .. }
-            if capability.allows_subject_access_claim(claim_id) =>
-        {
-            Ok(())
-        }
-        EvaluationCapability::DelegatedSubjectAccess { .. } => {
-            Err(delegated_subject_access_denied())
-        }
-        EvaluationCapability::SubjectBound { .. } => Err(EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::OperationDenied,
-        }),
-    }
-}
-
-pub(super) fn delegated_subject_access_denied() -> EvidenceError {
-    EvidenceError::SubjectAccessDenied {
-        reason: SubjectAccessDenialCode::DelegatedSubjectNotPermitted,
-    }
-}
-
-pub(super) fn delegated_relationship_unproven() -> EvidenceError {
-    EvidenceError::SubjectAccessDenied {
-        reason: SubjectAccessDenialCode::DelegatedRelationshipUnproven,
-    }
-}
-
-pub(super) fn delegated_proof_denied() -> EvidenceError {
-    EvidenceError::SubjectAccessDenied {
-        reason: SubjectAccessDenialCode::DelegatedProofDenied,
-    }
-}
-
-pub(super) fn ensure_delegated_capability_context_binding(
-    ctx: &ClaimEvaluationContext,
-) -> Result<(), EvidenceError> {
-    let EvaluationCapability::DelegatedSubjectAccess {
-        requester_subject_binding_hash,
-        dependent_target_hash,
-        ..
-    } = &ctx.evaluation_capability
-    else {
-        return Ok(());
-    };
-    let requester_subject = ctx
-        .context
-        .requester
-        .as_ref()
-        .and_then(EvidenceEntity::to_subject_request)
-        .ok_or_else(delegated_subject_access_denied)?;
-    let target_subject = ctx
-        .context
-        .target_subject()
-        .ok_or_else(delegated_subject_access_denied)?;
-    // Re-derive the bindings over the (id_type, id) pair so they bind the
-    // subject scheme as well as the value. The id_types are pinned upstream
-    // (requester via subject_binding.id_type, target via the relationship's
-    // delegated_target_id_type); a missing id_type fails closed.
-    let requester_id_type = requester_subject
-        .id_type
-        .as_deref()
-        .ok_or_else(delegated_subject_access_denied)?;
-    let target_id_type = target_subject
-        .id_type
-        .as_deref()
-        .ok_or_else(delegated_subject_access_denied)?;
-    let requester_hash = ctx
-        .subject_access_rate_keys
-        .delegated_subject_binding(requester_id_type, requester_subject.id.as_str())
-        .map_err(|error| error.evidence_error())?;
-    let target_hash = ctx
-        .subject_access_rate_keys
-        .delegated_subject_binding(target_id_type, target_subject.id.as_str())
-        .map_err(|error| error.evidence_error())?;
-    if &requester_hash != requester_subject_binding_hash || &target_hash != dependent_target_hash {
-        return Err(delegated_subject_access_denied());
-    }
-    Ok(())
-}
-
-pub(super) fn resolve_purpose(
-    header: Option<&str>,
-    body: Option<&str>,
-) -> Result<String, EvidenceError> {
-    match (header, body) {
-        (Some(header), Some(body)) if header != body => Err(EvidenceError::InvalidRequest),
-        (Some(header), _) if !header.trim().is_empty() => Ok(header.to_string()),
-        (_, Some(body)) if !body.trim().is_empty() => Ok(body.to_string()),
-        (Some(_), _) | (_, Some(_)) => Err(EvidenceError::InvalidRequest),
-        _ => Err(EvidenceError::PurposeRequired),
-    }
-}
-
-pub(super) fn resolve_batch_default_purpose(
-    header: Option<&str>,
-    body: Option<&str>,
-) -> Result<Option<String>, EvidenceError> {
-    match (header, body) {
-        (Some(header), Some(body)) if header != body => Err(EvidenceError::InvalidRequest),
-        (Some(header), _) if !header.trim().is_empty() => Ok(Some(header.to_string())),
-        (_, Some(body)) if !body.trim().is_empty() => Ok(Some(body.to_string())),
-        (Some(_), _) | (_, Some(_)) => Err(EvidenceError::InvalidRequest),
-        _ => Ok(None),
-    }
-}
-
-pub(super) fn resolve_batch_subject_purposes(
-    subjects: &[registry_notary_core::BatchEvaluateItemRequest],
-    batch_default: Option<&str>,
-) -> Result<Vec<String>, EvidenceError> {
-    subjects
-        .iter()
-        .map(|subject| match subject.purpose.as_deref() {
-            Some(purpose)
-                if batch_default.is_some_and(|batch_default| batch_default != purpose) =>
-            {
-                Err(EvidenceError::InvalidRequest)
-            }
-            Some(purpose) if !purpose.trim().is_empty() => Ok(purpose.to_string()),
-            Some(_) => Err(EvidenceError::InvalidRequest),
-            None => batch_default
-                .map(str::to_string)
-                .ok_or(EvidenceError::PurposeRequired),
-        })
-        .collect()
-}
-
-pub(super) fn validate_batch_inputs_and_collect_purposes<'a>(
-    subjects: &'a [registry_notary_core::BatchEvaluateItemRequest],
-    subject_purposes: &'a [String],
-) -> Result<BTreeSet<&'a str>, EvidenceError> {
-    let mut unique_purposes = BTreeSet::new();
-    for (item, purpose) in subjects.iter().zip(subject_purposes) {
-        if !item.target.has_matching_input() {
-            return Err(EvidenceError::InvalidRequest);
-        }
-        unique_purposes.insert(purpose.as_str());
-    }
-    Ok(unique_purposes)
-}
-
-pub(super) fn require_purpose_allowed(
-    config: &EvidenceConfig,
-    claims: &[ClaimRef],
-    claim_versions: &ClaimVersionSelections,
-    purpose: &str,
-) -> Result<(), EvidenceError> {
-    for claim_ref in claims {
-        let claim = find_claim_for_selection(config, claim_ref, claim_versions)?;
-        if !config.allowed_purposes.is_empty()
-            && !config
-                .allowed_purposes
-                .iter()
-                .any(|allowed| allowed == purpose)
-        {
-            return Err(EvidenceError::PurposeNotAllowed);
-        }
-        if claim
-            .purpose
-            .as_deref()
-            .is_some_and(|allowed| allowed != purpose)
-        {
-            return Err(EvidenceError::PurposeNotAllowed);
-        }
-    }
-    Ok(())
-}
-
-pub(super) fn require_claim_format(
-    claim: &ClaimDefinition,
-    format: &str,
-) -> Result<(), EvidenceError> {
-    if claim.formats.iter().any(|candidate| candidate == format) {
-        Ok(())
-    } else {
-        Err(EvidenceError::FormatUnsupported)
-    }
-}
-
-pub(super) fn requested_disclosure(
-    config: &EvidenceConfig,
-    claims: &[ClaimRef],
-    claim_versions: &ClaimVersionSelections,
-    requested: &Option<String>,
-) -> Result<DisclosureProfile, EvidenceError> {
-    let raw = requested
-        .as_deref()
-        .or_else(|| {
-            claims
-                .first()
-                .and_then(|claim| find_claim_for_selection(config, claim, claim_versions).ok())
-                .map(|claim| claim.disclosure.default.as_str())
-        })
-        .unwrap_or("redacted");
-    DisclosureProfile::parse(raw).ok_or(EvidenceError::InvalidRequest)
-}
-
-pub(super) fn validate_requested_disclosure_before_source(
-    config: &EvidenceConfig,
-    claims: &[ClaimRef],
-    claim_versions: &ClaimVersionSelections,
-    disclosure: DisclosureProfile,
-) -> Result<(), EvidenceError> {
-    for claim_ref in claims {
-        let claim = find_claim_for_selection(config, claim_ref, claim_versions)?;
-        if claim
-            .disclosure
-            .allowed
-            .iter()
-            .any(|candidate| candidate == disclosure.as_str())
-        {
-            continue;
-        }
-        let downgraded = match DisclosureDowngrade::parse(&claim.disclosure.downgrade)
-            .ok_or(EvidenceError::InvalidRequest)?
-        {
-            DisclosureDowngrade::Default => DisclosureProfile::parse(&claim.disclosure.default)
-                .ok_or(EvidenceError::InvalidRequest)?,
-            DisclosureDowngrade::Redacted => DisclosureProfile::Redacted,
-            DisclosureDowngrade::Deny => return Err(EvidenceError::DisclosureNotAllowed),
-        };
-        if !claim
-            .disclosure
-            .allowed
-            .iter()
-            .any(|candidate| candidate == downgraded.as_str())
-        {
-            return Err(EvidenceError::DisclosureNotAllowed);
-        }
-    }
-    Ok(())
-}
-
-pub(super) fn max_batch_subjects(
-    config: &EvidenceConfig,
-    claims: &[ClaimRef],
-    claim_versions: &ClaimVersionSelections,
-) -> Result<usize, EvidenceError> {
-    let mut max =
-        registry_notary_core::MAX_BATCH_EVALUATION_MEMBERS_V1.min(config.inline_batch_limit);
-    for claim_id in claims {
-        let claim = find_claim_for_selection(config, claim_id, claim_versions)?;
-        if !claim.operations.batch_evaluate.enabled {
-            return Err(EvidenceError::OperationUnsupported);
-        }
-        max = max.min(claim.operations.batch_evaluate.max_subjects);
-    }
-    Ok(max)
-}
diff --git a/crates/registry-notary-server/src/runtime/catalog.rs b/crates/registry-notary-server/src/runtime/catalog.rs
deleted file mode 100644
index d815c66c5..000000000
--- a/crates/registry-notary-server/src/runtime/catalog.rs
+++ /dev/null
@@ -1,318 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-
-pub(crate) fn claim_ids(claims: &[ClaimRef]) -> Vec<String> {
-    claims.iter().map(|claim| claim.id.clone()).collect()
-}
-
-pub(crate) fn requested_claim_versions(
-    claims: &[ClaimRef],
-) -> Result<ClaimVersionSelections, EvidenceError> {
-    let mut versions = BTreeMap::new();
-    for claim in claims {
-        if claim.id.trim().is_empty()
-            || claim
-                .version
-                .as_deref()
-                .is_some_and(|version| version.trim().is_empty())
-        {
-            return Err(EvidenceError::InvalidRequest);
-        }
-        match versions.get(&claim.id) {
-            Some(existing) => {
-                if existing != &claim.version {
-                    return Err(EvidenceError::InvalidRequest);
-                }
-            }
-            None => {
-                versions.insert(claim.id.clone(), claim.version.clone());
-            }
-        }
-    }
-    Ok(versions)
-}
-
-pub(crate) fn validate_batch_subject_limit(
-    config: &EvidenceConfig,
-    request: &BatchEvaluateRequest,
-) -> Result<(), EvidenceError> {
-    if request.claims.is_empty() || request.items.is_empty() {
-        return Err(EvidenceError::InvalidRequest);
-    }
-    if request.items.len() > registry_notary_core::MAX_BATCH_EVALUATION_MEMBERS_V1 {
-        return Err(EvidenceError::BatchTooLarge);
-    }
-    let claim_versions = requested_claim_versions(&request.claims)?;
-    let max_subjects = max_batch_subjects(config, &request.claims, &claim_versions)?;
-    if request.items.len() > max_subjects {
-        return Err(EvidenceError::BatchTooLarge);
-    }
-    Ok(())
-}
-
-pub(super) fn find_claim_for_selection<'a>(
-    config: &'a EvidenceConfig,
-    claim_id: &str,
-    versions: &ClaimVersionSelections,
-) -> Result<&'a ClaimDefinition, EvidenceError> {
-    match versions.get(claim_id).and_then(Option::as_deref) {
-        Some(version) => find_claim_version(config, claim_id, version),
-        None => find_claim(config, claim_id),
-    }
-}
-
-/// Topological levels of the DAG closure over `requested`. Each level is the
-/// set of claims whose dependencies all appear in earlier levels. Claims at
-/// the same level are independent and safe to evaluate concurrently.
-///
-/// Cycle and unknown-dep validation already happened at config load; we still
-/// guard with bounded iterations so a malformed config cannot infinite-loop.
-pub(crate) fn build_claim_levels(
-    evidence: &EvidenceConfig,
-    requested: &[ClaimRef],
-    claim_versions: &ClaimVersionSelections,
-) -> Result<Vec<Vec<String>>, EvidenceError> {
-    // Closure: starting from `requested`, accumulate every transitive dep.
-    let mut closure: BTreeSet<String> = BTreeSet::new();
-    let mut frontier: Vec<String> = claim_ids(requested);
-    let mut edge_count = 0usize;
-    while let Some(claim_id) = frontier.pop() {
-        if !closure.insert(claim_id.clone()) {
-            continue;
-        }
-        if closure.len() > MAX_CLAIM_DEPENDENCY_NODES_V1 {
-            return Err(EvidenceError::RuleEvaluationFailed);
-        }
-        let claim = find_claim_for_selection(evidence, &claim_id, claim_versions)?;
-        edge_count = edge_count
-            .checked_add(claim.depends_on.len())
-            .ok_or(EvidenceError::RuleEvaluationFailed)?;
-        if edge_count > MAX_CLAIM_DEPENDENCY_EDGES_V1 {
-            return Err(EvidenceError::RuleEvaluationFailed);
-        }
-        for dep in &claim.depends_on {
-            if !closure.contains(dep) {
-                frontier.push(dep.clone());
-            }
-        }
-    }
-    // Kahn-style level construction: a claim is ready when all its deps are
-    // already in earlier levels.
-    let mut placed: BTreeSet<String> = BTreeSet::new();
-    let mut levels: Vec<Vec<String>> = Vec::new();
-    let total = closure.len();
-    while placed.len() < total {
-        let mut next_level: Vec<String> = Vec::new();
-        for claim_id in &closure {
-            if placed.contains(claim_id) {
-                continue;
-            }
-            let claim = find_claim_for_selection(evidence, claim_id, claim_versions)?;
-            if claim.depends_on.iter().all(|dep| placed.contains(dep)) {
-                next_level.push(claim_id.clone());
-            }
-        }
-        if next_level.is_empty() {
-            // Should never happen: cycle detection runs at config load.
-            return Err(EvidenceError::RuleEvaluationFailed);
-        }
-        for claim_id in &next_level {
-            placed.insert(claim_id.clone());
-        }
-        levels.push(next_level);
-    }
-    Ok(levels)
-}
-
-pub fn find_claim<'a>(
-    config: &'a EvidenceConfig,
-    claim_id: &str,
-) -> Result<&'a ClaimDefinition, EvidenceError> {
-    config
-        .claims
-        .iter()
-        .find(|claim| claim.id == claim_id)
-        .ok_or(EvidenceError::ClaimNotFound)
-}
-
-pub fn find_claim_version<'a>(
-    config: &'a EvidenceConfig,
-    claim_id: &str,
-    version: &str,
-) -> Result<&'a ClaimDefinition, EvidenceError> {
-    let mut has_claim_id = false;
-    for claim in &config.claims {
-        if claim.id == claim_id {
-            has_claim_id = true;
-            if claim.version == version {
-                return Ok(claim);
-            }
-        }
-    }
-    if has_claim_id {
-        Err(EvidenceError::ClaimVersionNotFound)
-    } else {
-        Err(EvidenceError::ClaimNotFound)
-    }
-}
-
-pub fn claim_summary(claim: &ClaimDefinition) -> Value {
-    // Only publish the oots block when oots is explicitly enabled. When disabled,
-    // the sub-fields (requirement, LoA, etc.) are intentionally not advertised,
-    // so emitting them as null would be misleading.
-    let oots = claim
-        .oots
-        .as_ref()
-        .filter(|o| o.enabled)
-        .map(|o| serde_json::to_value(o).unwrap_or(Value::Null))
-        .unwrap_or(Value::Null);
-    let mut summary = json!({
-        "id": claim.id,
-        "title": claim.title,
-        "version": claim.version,
-        "subject_type": claim.subject_type,
-        "operations": {
-            "evaluate": claim.operations.evaluate.enabled,
-            "batch_evaluate": claim.operations.batch_evaluate.enabled,
-        },
-        "formats": claim.formats,
-        "disclosure": {
-            "default": claim.disclosure.default,
-            "allowed": claim.disclosure.allowed,
-            "downgrade": claim.disclosure.downgrade,
-        },
-        "cccev": claim.cccev,
-        "oots": oots,
-    });
-    if let Some(semantics) = claim_semantics_metadata(claim) {
-        summary["semantics"] = semantics;
-    }
-    let target_inputs = claim_target_inputs(claim);
-    if !target_inputs.is_empty() {
-        summary["target_inputs"] = json!(target_inputs);
-    }
-    if let Some(cccev) = &claim.cccev {
-        if let Some(evidence_type) = &cccev.evidence_type {
-            summary["evidence_type"] = json!(evidence_type);
-        }
-        if let Some(evidence_type_iri) = &cccev.evidence_type_iri {
-            summary["evidence_type_iri"] = json!(evidence_type_iri);
-        }
-    }
-    summary
-}
-
-pub(crate) fn claim_semantics_metadata(claim: &ClaimDefinition) -> Option<Value> {
-    let semantics = claim
-        .semantics
-        .as_ref()
-        .and_then(|semantics| serde_json::to_value(semantics).ok())
-        .and_then(|value| value.as_object().cloned())
-        .unwrap_or_default();
-
-    (!semantics.is_empty()).then_some(Value::Object(semantics))
-}
-
-pub(super) fn claim_target_inputs(claim: &ClaimDefinition) -> Vec<Value> {
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-        return Vec::new();
-    };
-    consultations
-        .values()
-        .filter_map(|consultation| {
-            let mut inputs = consultation
-                .inputs
-                .values()
-                .filter_map(|input| public_target_input(input.request_context_path()))
-                .collect::<Vec<_>>();
-            inputs.sort_by_key(ToString::to_string);
-            inputs.dedup();
-            (!inputs.is_empty()).then(|| {
-                json!({
-                    "target_type": claim.subject_type,
-                    "method": "relay_consultation",
-                    "confidence": "contract_pinned",
-                    "groups": [{ "inputs": inputs }],
-                })
-            })
-        })
-        .collect()
-}
-
-pub(super) fn public_target_input(path: &str) -> Option<Value> {
-    let (kind, name, label) = if path == "target.id" {
-        ("id", "id", "ID".to_string())
-    } else {
-        let (kind, name) = path
-            .strip_prefix("target.identifiers.")
-            .map(|name| ("identifier", name))
-            .or_else(|| {
-                path.strip_prefix("target.attributes.")
-                    .map(|name| ("attribute", name))
-            })?;
-        if name.is_empty() || name.contains('*') {
-            return None;
-        }
-        (kind, name, input_label(name))
-    };
-    Some(json!({
-        "path": path,
-        "kind": kind,
-        "name": name,
-        "label": label,
-    }))
-}
-
-pub(super) fn input_label(name: &str) -> String {
-    let mut label = String::new();
-    for (index, part) in name.split('_').filter(|part| !part.is_empty()).enumerate() {
-        if !label.is_empty() {
-            label.push(' ');
-        }
-        let mut chars = part.chars();
-        if let Some(first) = chars.next() {
-            if index == 0 {
-                label.extend(first.to_uppercase());
-            } else {
-                label.push(first);
-            }
-            label.push_str(chars.as_str());
-        }
-    }
-    if label.is_empty() {
-        name.to_string()
-    } else {
-        label
-    }
-}
-
-pub fn formats(config: &EvidenceConfig) -> Vec<EvidenceFormat> {
-    let mut seen = BTreeMap::new();
-    seen.insert(FORMAT_CLAIM_RESULT_JSON.to_string(), true);
-    seen.insert(FORMAT_CCCEV_JSONLD.to_string(), true);
-    seen.insert(
-        FORMAT_SD_JWT_VC.to_string(),
-        !config.credential_profiles.is_empty(),
-    );
-    for claim in &config.claims {
-        for format in &claim.formats {
-            seen.entry(format.clone()).or_insert(true);
-        }
-    }
-    seen.into_iter()
-        .map(|(id, enabled)| EvidenceFormat {
-            kind: format_kind(&id).to_string(),
-            status: if enabled { "enabled" } else { "disabled" }.to_string(),
-            id,
-        })
-        .collect()
-}
-
-pub(super) fn format_kind(format: &str) -> &'static str {
-    match format {
-        FORMAT_CLAIM_RESULT_JSON => "claim_result",
-        FORMAT_SD_JWT_VC => "credential",
-        _ => "renderer",
-    }
-}
diff --git a/crates/registry-notary-server/src/runtime/cel.rs b/crates/registry-notary-server/src/runtime/cel.rs
deleted file mode 100644
index a0f984825..000000000
--- a/crates/registry-notary-server/src/runtime/cel.rs
+++ /dev/null
@@ -1,694 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-
-pub(super) async fn evaluate_cel_expression(
-    ctx: &CelEvaluationContext<'_>,
-) -> Result<Value, EvidenceError> {
-    #[cfg(feature = "registry-notary-cel")]
-    let config = ctx.config;
-    #[cfg(not(feature = "registry-notary-cel"))]
-    let config = &RegistryNotaryCelConfig::default();
-    validate_cel_policy(ctx.expression, config)?;
-    #[cfg(feature = "registry-notary-cel")]
-    {
-        evaluate_with_cel(ctx).await
-    }
-    #[cfg(not(feature = "registry-notary-cel"))]
-    {
-        let _ = ctx;
-        Err(EvidenceError::OperationUnsupported)
-    }
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(crate) fn validate_cel_claims_for_startup(
-    evidence: &EvidenceConfig,
-    config: &RegistryNotaryCelConfig,
-) -> Result<(), EvidenceError> {
-    let mut runtime = MappingRuntime::new(RuntimeOptions::default());
-    runtime.limits = cel_security_limits(config);
-    for claim in &evidence.claims {
-        let RuleConfig::Cel { expression } = &claim.rule else {
-            continue;
-        };
-        validate_cel_policy(expression, config)?;
-        validate_registry_cel_expression(expression, claim)?;
-        if !config.allow_regex && cel_expression_uses_regex(expression) {
-            return Err(EvidenceError::InvalidRequest);
-        }
-        let input = StandaloneExpressionInput::new(
-            cel_preflight_root_bindings(evidence, claim)
-                .into_iter()
-                .collect(),
-        );
-        let preview = runtime.preview_cel_expression_with_input(expression, input);
-        if preview
-            .issues
-            .iter()
-            .any(|issue| issue.severity == ErrorSeverity::Error)
-        {
-            return Err(EvidenceError::InvalidRequest);
-        }
-        if let Some(value) = preview.value.as_ref() {
-            validate_claim_value_config(value, &claim.value)?;
-        }
-    }
-    Ok(())
-}
-
-pub(super) fn validate_cel_policy(
-    expression: &str,
-    _config: &RegistryNotaryCelConfig,
-) -> Result<(), EvidenceError> {
-    if expression.trim().is_empty() {
-        return Err(EvidenceError::InvalidRequest);
-    }
-    #[cfg(feature = "registry-notary-cel")]
-    {
-        cel_security_limits(_config)
-            .check_expr(expression)
-            .map_err(|_| EvidenceError::InvalidRequest)?;
-    }
-    #[cfg(not(feature = "registry-notary-cel"))]
-    {
-        let _ = expression;
-    }
-    Ok(())
-}
-
-pub(super) fn validate_claim_value_type(
-    value: &Value,
-    value_type: &str,
-) -> Result<(), EvidenceError> {
-    let valid = match value_type.trim() {
-        "" | "unknown" => true,
-        "boolean" | "bool" => value.is_boolean(),
-        "number" | "float" | "double" => value.is_number(),
-        "integer" | "int" => {
-            const MAX_SAFE_INTEGER: i64 = (1_i64 << 53) - 1;
-            value
-                .as_i64()
-                .is_some_and(|value| (-MAX_SAFE_INTEGER..=MAX_SAFE_INTEGER).contains(&value))
-                || value
-                    .as_u64()
-                    .is_some_and(|value| value <= MAX_SAFE_INTEGER as u64)
-        }
-        "date" => value.as_str().is_some_and(is_rfc3339_full_date),
-        "string" | "datetime" | "date-time" | "uri" => value.is_string(),
-        "array" | "list" => value.is_array(),
-        "object" => value.is_object(),
-        "null" => value.is_null(),
-        _ => return Err(EvidenceError::InvalidRequest),
-    };
-    if valid {
-        Ok(())
-    } else {
-        Err(EvidenceError::RuleEvaluationFailed)
-    }
-}
-
-pub(super) fn validate_claim_value_config(
-    value: &Value,
-    config: &registry_notary_core::ClaimValueConfig,
-) -> Result<(), EvidenceError> {
-    if value.is_null() {
-        return config
-            .nullable
-            .then_some(())
-            .ok_or(EvidenceError::RuleEvaluationFailed);
-    }
-    validate_claim_value_type(value, &config.value_type)?;
-    if config.max_bytes.is_some_and(|max_bytes| {
-        value
-            .as_str()
-            .is_none_or(|string| string.len() > max_bytes as usize)
-    }) {
-        return Err(EvidenceError::RuleEvaluationFailed);
-    }
-    Ok(())
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn evaluate_with_cel(
-    ctx: &CelEvaluationContext<'_>,
-) -> Result<Value, EvidenceError> {
-    let root_bindings = cel_root_bindings(ctx)?;
-    let value = if let Some(worker) = ctx.worker {
-        worker
-            .evaluate(
-                ctx.expression,
-                Value::Object(root_bindings.into_iter().collect()),
-            )
-            .await
-            .map_err(cel_worker_error)?
-    } else {
-        #[cfg(test)]
-        {
-            evaluate_cel_in_process_for_unit_tests(ctx.expression, root_bindings)?
-        }
-        #[cfg(not(test))]
-        {
-            return Err(EvidenceError::OperationUnsupported);
-        }
-    };
-    validate_cel_result_limits(&value, ctx.config)?;
-    Ok(value)
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[cfg(test)]
-pub(super) fn evaluate_cel_in_process_for_unit_tests(
-    expression: &str,
-    root_bindings: BTreeMap<String, Value>,
-) -> Result<Value, EvidenceError> {
-    MappingRuntime::new(RuntimeOptions::default())
-        .evaluate_cel_expression_with_input(
-            expression,
-            StandaloneExpressionInput::new(root_bindings.into_iter().collect()),
-        )
-        .map_err(|error| match error {
-            crosswalk_core::StandaloneEvalError::Compile(_)
-            | crosswalk_core::StandaloneEvalError::InvalidBindingName { .. } => {
-                EvidenceError::InvalidRequest
-            }
-            crosswalk_core::StandaloneEvalError::Evaluate { .. } => {
-                EvidenceError::RuleEvaluationFailed
-            }
-        })
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn cel_preflight_root_bindings(
-    evidence: &EvidenceConfig,
-    claim: &ClaimDefinition,
-) -> BTreeMap<String, Value> {
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-        return BTreeMap::new();
-    };
-    let mut roots = BTreeMap::new();
-    if let Some((name, consultation)) = consultations.first_key_value() {
-        let mut output_view = consultation
-            .outputs
-            .iter()
-            .filter(|(_, output)| output.is_scalar())
-            .map(|(name, output)| (name.clone(), registry_output_dummy_value(output)))
-            .collect::<Map<_, _>>();
-        output_view.insert("matched".to_string(), Value::Bool(true));
-        output_view.insert("outcome".to_string(), Value::String("match".to_string()));
-        roots.insert(name.clone(), Value::Object(output_view));
-    }
-    for (name, variable) in &evidence.variables {
-        let value = match variable.value_type {
-            registry_notary_core::RequestVariableType::Date => json!("2026-01-01"),
-        };
-        roots.insert(name.clone(), value);
-    }
-    roots
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn registry_output_dummy_value(output: &registry_notary_core::RelayOutputContract) -> Value {
-    match output {
-        registry_notary_core::RelayOutputContract::Boolean { .. } => Value::Bool(true),
-        registry_notary_core::RelayOutputContract::Integer { minimum, .. } => json!(minimum),
-        registry_notary_core::RelayOutputContract::String { max_bytes, .. } => {
-            bounded_string_preview(Some(*max_bytes))
-        }
-        registry_notary_core::RelayOutputContract::Date { .. } => json!("2000-01-01"),
-        registry_notary_core::RelayOutputContract::Object { fields, .. } => Value::Object(
-            fields
-                .iter()
-                .filter(|(_, field)| field.required)
-                .map(|(name, field)| {
-                    (
-                        name.clone(),
-                        registry_output_dummy_value(field.schema.as_ref()),
-                    )
-                })
-                .collect(),
-        ),
-        registry_notary_core::RelayOutputContract::Array { .. } => Value::Array(Vec::new()),
-    }
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn bounded_string_preview(max_bytes: Option<u32>) -> Value {
-    Value::String(if max_bytes == Some(0) {
-        String::new()
-    } else {
-        "x".to_string()
-    })
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn validate_registry_cel_expression(
-    expression: &str,
-    claim: &ClaimDefinition,
-) -> Result<(), EvidenceError> {
-    if contains_unquoted_bracket(expression) {
-        return Err(EvidenceError::InvalidRequest);
-    }
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-        return Err(EvidenceError::InvalidRequest);
-    };
-    let (consultation_name, consultation) = consultations
-        .first_key_value()
-        .filter(|_| consultations.len() == 1)
-        .ok_or(EvidenceError::InvalidRequest)?;
-    for root in cel_root_references(expression) {
-        if root != *consultation_name && root != "date" {
-            return Err(EvidenceError::InvalidRequest);
-        }
-    }
-    let referenced_members = cel_first_level_member_references(expression, consultation_name);
-    if referenced_members.iter().any(|member| {
-        consultation
-            .outputs
-            .get(member)
-            .is_none_or(|output| !output.is_scalar())
-            && !matches!(member.as_str(), "matched" | "outcome")
-    }) {
-        return Err(EvidenceError::InvalidRequest);
-    }
-    let compact = expression
-        .bytes()
-        .filter(|byte| !byte.is_ascii_whitespace())
-        .map(char::from)
-        .collect::<String>();
-    for (name, output) in &consultation.outputs {
-        if !output.nullable() {
-            continue;
-        }
-        let path = format!("{consultation_name}.{name}");
-        if !referenced_members.contains(name) {
-            continue;
-        }
-        let left_guard = format!("{path}!=null");
-        let right_guard = format!("null!={path}");
-        let guard_index = compact
-            .find(&left_guard)
-            .or_else(|| compact.find(&right_guard))
-            .ok_or(EvidenceError::InvalidRequest)?;
-        let question_index = compact.find('?').ok_or(EvidenceError::InvalidRequest)?;
-        if guard_index > question_index || compact[..guard_index].contains(&path) {
-            return Err(EvidenceError::InvalidRequest);
-        }
-    }
-    Ok(())
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn cel_first_level_member_references(expression: &str, root: &str) -> BTreeSet<String> {
-    let tokens = cel_tokens(expression);
-    let mut members = BTreeSet::new();
-
-    for (index, token) in tokens.iter().enumerate() {
-        let CelToken::Identifier { text } = token else {
-            continue;
-        };
-        if *text != root || matches!(previous_token(&tokens, index), Some(CelToken::Dot)) {
-            continue;
-        }
-        if let Some([CelToken::Dot, CelToken::Identifier { text: member }]) =
-            next_tokens::<2>(&tokens, index)
-        {
-            members.insert((*member).to_string());
-        }
-    }
-    members
-}
-
-pub(super) fn registry_cel_required_variables<'a>(
-    expression: &str,
-    declared: impl IntoIterator<Item = &'a str>,
-) -> BTreeSet<String> {
-    let identifiers = cel_bare_identifiers(expression);
-    declared
-        .into_iter()
-        .filter(|name| identifiers.contains(*name))
-        .map(str::to_string)
-        .collect()
-}
-
-fn cel_bare_identifiers(expression: &str) -> BTreeSet<String> {
-    let tokens = cel_tokens(expression);
-    tokens
-        .iter()
-        .enumerate()
-        .filter_map(|(index, token)| match token {
-            CelToken::Identifier { text }
-                if !matches!(previous_token(&tokens, index), Some(CelToken::Dot)) =>
-            {
-                Some((*text).to_string())
-            }
-            _ => None,
-        })
-        .collect()
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn contains_unquoted_bracket(expression: &str) -> bool {
-    cel_tokens(expression)
-        .iter()
-        .any(|token| matches!(token, CelToken::Bracket))
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn cel_root_references(expression: &str) -> BTreeSet<String> {
-    let tokens = cel_tokens(expression);
-    tokens
-        .iter()
-        .enumerate()
-        .filter_map(|(index, token)| match token {
-            CelToken::Identifier { text } => {
-                let is_root = matches!(
-                    next_token(&tokens, index),
-                    Some(CelToken::Dot | CelToken::Bracket)
-                ) && !matches!(previous_token(&tokens, index), Some(CelToken::Dot));
-                is_root.then(|| (*text).to_string())
-            }
-            CelToken::Dot | CelToken::Bracket | CelToken::Other => None,
-        })
-        .collect()
-}
-
-#[derive(Clone, Copy)]
-enum CelToken<'a> {
-    Identifier { text: &'a str },
-    Dot,
-    Bracket,
-    Other,
-}
-
-fn cel_tokens(expression: &str) -> Vec<CelToken<'_>> {
-    let bytes = expression.as_bytes();
-    let mut tokens = Vec::new();
-    let mut index = 0;
-    while index < bytes.len() {
-        if bytes.get(index..index + 2) == Some(b"//") {
-            index = skip_line_comment(bytes, index + 2);
-            continue;
-        }
-        if let Some(end) = cel_string_literal_end(bytes, index) {
-            tokens.push(CelToken::Other);
-            index = end;
-            continue;
-        }
-        if bytes[index] == b'`' {
-            tokens.push(CelToken::Other);
-            index = escaped_identifier_end(bytes, index);
-            continue;
-        }
-        if bytes[index] == b'.' {
-            tokens.push(CelToken::Dot);
-            index += 1;
-            continue;
-        }
-        if matches!(bytes[index], b'[' | b']') {
-            tokens.push(CelToken::Bracket);
-            index += 1;
-            continue;
-        }
-        if is_cel_identifier_start_byte(bytes[index]) {
-            let start = index;
-            index = identifier_end(bytes, start);
-            tokens.push(CelToken::Identifier {
-                text: &expression[start..index],
-            });
-            continue;
-        }
-        if !bytes[index].is_ascii_whitespace() {
-            tokens.push(CelToken::Other);
-        }
-        index += 1;
-    }
-    tokens
-}
-
-fn previous_token<'a>(tokens: &'a [CelToken<'a>], index: usize) -> Option<CelToken<'a>> {
-    index
-        .checked_sub(1)
-        .and_then(|previous| tokens.get(previous))
-        .copied()
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn next_token<'a>(tokens: &'a [CelToken<'a>], index: usize) -> Option<CelToken<'a>> {
-    tokens.get(index + 1).copied()
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn next_tokens<'a, const N: usize>(
-    tokens: &'a [CelToken<'a>],
-    index: usize,
-) -> Option<[CelToken<'a>; N]> {
-    tokens.get(index + 1..index + 1 + N)?.try_into().ok()
-}
-
-fn cel_string_literal_end(bytes: &[u8], index: usize) -> Option<usize> {
-    let (quote_index, raw) = if matches!(bytes.get(index), Some(b'\'' | b'"')) {
-        (index, false)
-    } else if matches!(bytes.get(index), Some(b'r' | b'R'))
-        && matches!(bytes.get(index + 1), Some(b'\'' | b'"'))
-    {
-        (index + 1, true)
-    } else if matches!(bytes.get(index), Some(b'b' | b'B'))
-        && matches!(bytes.get(index + 1), Some(b'\'' | b'"'))
-    {
-        (index + 1, false)
-    } else if matches!(bytes.get(index), Some(b'b' | b'B'))
-        && matches!(bytes.get(index + 1), Some(b'r' | b'R'))
-        && matches!(bytes.get(index + 2), Some(b'\'' | b'"'))
-    {
-        (index + 2, true)
-    } else {
-        return None;
-    };
-    let quote = bytes[quote_index];
-    let triple = bytes.get(quote_index..quote_index + 3) == Some(&[quote, quote, quote]);
-    Some(if triple {
-        skip_triple_quoted_literal(bytes, quote_index + 3, quote, raw)
-    } else {
-        skip_quoted_literal(bytes, quote_index + 1, quote, raw)
-    })
-}
-
-fn skip_quoted_literal(bytes: &[u8], mut index: usize, quote: u8, raw: bool) -> usize {
-    while index < bytes.len() {
-        if !raw && bytes[index] == b'\\' {
-            index = index.saturating_add(2);
-            continue;
-        }
-        if bytes[index] == quote {
-            return index + 1;
-        }
-        index += 1;
-    }
-    bytes.len()
-}
-
-fn skip_triple_quoted_literal(bytes: &[u8], mut index: usize, quote: u8, raw: bool) -> usize {
-    while index < bytes.len() {
-        if !raw && bytes[index] == b'\\' {
-            index = index.saturating_add(2);
-            continue;
-        }
-        if bytes.get(index..index + 3) == Some(&[quote, quote, quote]) {
-            return index + 3;
-        }
-        index += 1;
-    }
-    bytes.len()
-}
-
-fn escaped_identifier_end(bytes: &[u8], mut index: usize) -> usize {
-    index += 1;
-    while index < bytes.len() {
-        if bytes[index] == b'`' {
-            return index + 1;
-        }
-        index += 1;
-    }
-    bytes.len()
-}
-
-fn skip_line_comment(bytes: &[u8], mut index: usize) -> usize {
-    while index < bytes.len() && bytes[index] != b'\n' {
-        index += 1;
-    }
-    index
-}
-
-fn identifier_end(bytes: &[u8], mut index: usize) -> usize {
-    index += 1;
-    while index < bytes.len() && is_cel_identifier_continue_byte(bytes[index]) {
-        index += 1;
-    }
-    index
-}
-
-pub(super) fn is_cel_identifier_start_byte(byte: u8) -> bool {
-    byte == b'_' || byte.is_ascii_alphabetic()
-}
-
-pub(super) fn is_cel_identifier_continue_byte(byte: u8) -> bool {
-    byte == b'_' || byte.is_ascii_alphanumeric()
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn cel_root_bindings(
-    ctx: &CelEvaluationContext<'_>,
-) -> Result<BTreeMap<String, Value>, EvidenceError> {
-    let mut root_bindings =
-        registry_cel_scalar_consultation_outputs(ctx.claim, ctx.consultation_outputs)?;
-    for (name, declaration) in &ctx.evidence.variables {
-        let Some(value) = ctx.variables.get(name) else {
-            continue;
-        };
-        match declaration.value_type {
-            registry_notary_core::RequestVariableType::Date => {
-                root_bindings.insert(name.clone(), Value::String(value.to_string()));
-            }
-        }
-    }
-    let root_bindings = root_bindings.into_iter().collect::<BTreeMap<_, _>>();
-    validate_cel_binding_limits(
-        &Value::Object(root_bindings.clone().into_iter().collect()),
-        ctx.config,
-    )?;
-    Ok(root_bindings)
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn registry_cel_scalar_consultation_outputs(
-    claim: &ClaimDefinition,
-    consultation_outputs: &BTreeMap<String, Value>,
-) -> Result<BTreeMap<String, Value>, EvidenceError> {
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-        return Err(EvidenceError::InvalidRequest);
-    };
-    consultations
-        .iter()
-        .map(|(consultation_name, consultation)| {
-            let source = consultation_outputs
-                .get(consultation_name)
-                .and_then(Value::as_object)
-                .ok_or(EvidenceError::RuleEvaluationFailed)?;
-            let mut projected = Map::new();
-            for fixed in ["matched", "outcome"] {
-                if let Some(value) = source.get(fixed) {
-                    projected.insert(fixed.to_string(), value.clone());
-                }
-            }
-            for (name, _) in consultation
-                .outputs
-                .iter()
-                .filter(|(_, output)| output.is_scalar())
-            {
-                if let Some(value) = source.get(name) {
-                    projected.insert(name.clone(), value.clone());
-                }
-            }
-            Ok((consultation_name.clone(), Value::Object(projected)))
-        })
-        .collect()
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn cel_worker_error(error: CelWorkerError) -> EvidenceError {
-    match error {
-        CelWorkerError::Unavailable
-        | CelWorkerError::Compile
-        | CelWorkerError::Protocol
-        | CelWorkerError::Evaluate
-        | CelWorkerError::Harness(_) => EvidenceError::RuleEvaluationFailed,
-    }
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn validate_cel_binding_limits(
-    value: &Value,
-    config: &RegistryNotaryCelConfig,
-) -> Result<(), EvidenceError> {
-    if serialized_json_len(value)? > config.max_binding_json_bytes {
-        return Err(EvidenceError::RuleEvaluationFailed);
-    }
-    let mut stack = vec![(value, 0_usize)];
-    while let Some((value, depth)) = stack.pop() {
-        if depth > config.max_object_depth {
-            return Err(EvidenceError::RuleEvaluationFailed);
-        }
-        match value {
-            Value::String(value) if value.len() > config.max_string_bytes => {
-                return Err(EvidenceError::RuleEvaluationFailed);
-            }
-            Value::Array(values) => {
-                if values.len() > config.max_list_items {
-                    return Err(EvidenceError::RuleEvaluationFailed);
-                }
-                for value in values {
-                    stack.push((value, depth + 1));
-                }
-            }
-            Value::Object(values) => {
-                if values.len() > config.max_object_keys {
-                    return Err(EvidenceError::RuleEvaluationFailed);
-                }
-                for value in values.values() {
-                    stack.push((value, depth + 1));
-                }
-            }
-            _ => {}
-        }
-    }
-    Ok(())
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn validate_cel_result_limits(
-    value: &Value,
-    config: &RegistryNotaryCelConfig,
-) -> Result<(), EvidenceError> {
-    validate_cel_binding_limits(value, config)?;
-    if serialized_json_len(value)? > config.max_result_json_bytes {
-        return Err(EvidenceError::RuleEvaluationFailed);
-    }
-    Ok(())
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn serialized_json_len(value: &Value) -> Result<usize, EvidenceError> {
-    struct CountingWriter {
-        count: usize,
-    }
-
-    impl std::io::Write for CountingWriter {
-        fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
-            self.count = self
-                .count
-                .checked_add(buf.len())
-                .ok_or_else(|| std::io::Error::other("serialized JSON length overflow"))?;
-            Ok(buf.len())
-        }
-
-        fn flush(&mut self) -> std::io::Result<()> {
-            Ok(())
-        }
-    }
-
-    let mut writer = CountingWriter { count: 0 };
-    serde_json::to_writer(&mut writer, value).map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-    Ok(writer.count)
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn cel_security_limits(config: &RegistryNotaryCelConfig) -> SecurityLimits {
-    SecurityLimits {
-        max_expression_bytes: config.max_expression_bytes,
-        max_output_json_bytes: config.max_result_json_bytes,
-        max_list_len: config.max_list_items,
-        max_string_bytes: config.max_string_bytes,
-        ..SecurityLimits::default()
-    }
-}
diff --git a/crates/registry-notary-server/src/runtime/consultation.rs b/crates/registry-notary-server/src/runtime/consultation.rs
deleted file mode 100644
index 0242697e8..000000000
--- a/crates/registry-notary-server/src/runtime/consultation.rs
+++ /dev/null
@@ -1,2015 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Request-scoped Relay consultation coalescing.
-
-use std::cmp::Ordering;
-use std::collections::{BTreeMap, BTreeSet};
-use std::fmt;
-use std::sync::{Arc, Mutex, Once, OnceLock};
-
-use base64::Engine as _;
-use registry_notary_core::{EvidenceAuthProfileId, RelayOutputContract};
-use registry_platform_crypto::canonicalize_json;
-use registry_platform_httputil::destination::json::ProjectedJsonScalar;
-use serde_json::{Map, Value};
-use sha2::{Digest, Sha256};
-use time::OffsetDateTime;
-use tokio::sync::Notify;
-use ulid::Ulid;
-use zeroize::Zeroizing;
-
-use crate::relay_client::{
-    RelayClientError, RelayConsultationOutcome, RelayInputNames, RelayMatchData,
-    VerifiedRelayClient,
-};
-
-pub(crate) const MAX_CONSULTATION_GROUPS_V1: usize = 16;
-pub(crate) const MAX_BATCH_CONSULTATION_GROUPS_V1: usize = 256;
-const MAX_CHECKED_SCOPES_V1: usize = 16;
-const MAX_PRINCIPAL_ID_BYTES: usize = 256;
-const MAX_PROFILE_ID_BYTES: usize = 96;
-const MAX_PURPOSE_BYTES: usize = 256;
-const MAX_INPUT_NAME_BYTES: usize = 96;
-const MAX_INPUT_VALUE_BYTES: usize = 256;
-const MAX_CONSULTATION_INPUTS_V1: usize = 16;
-
-#[derive(Clone, PartialEq, Eq, PartialOrd, Ord)]
-pub(crate) enum RuntimeRelayExpectedResult {
-    OutputMap(BTreeMap<String, RelayOutputContract>),
-}
-
-impl RuntimeRelayExpectedResult {
-    pub(crate) fn output_map(
-        outputs: BTreeMap<String, RelayOutputContract>,
-    ) -> Result<Self, ConsultationPlanError> {
-        if outputs.is_empty()
-            || outputs.len() > 32
-            || outputs.keys().any(|name| {
-                !input_name(name, MAX_INPUT_NAME_BYTES)
-                    || matches!(name.as_str(), "matched" | "outcome")
-            })
-        {
-            return Err(ConsultationPlanError::InvalidGroupKey);
-        }
-        Ok(Self::OutputMap(outputs))
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    pub(crate) const fn output_contracts(&self) -> Option<&BTreeMap<String, RelayOutputContract>> {
-        let Self::OutputMap(outputs) = self;
-        Some(outputs)
-    }
-}
-
-impl fmt::Debug for RuntimeRelayExpectedResult {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str("RuntimeRelayExpectedResult([REDACTED])")
-    }
-}
-
-#[derive(Clone, PartialEq, Eq, PartialOrd, Ord)]
-pub(crate) struct RelayClientSelectionV1 {
-    profile_id: Box<str>,
-    profile_contract_hash: Box<str>,
-    purpose: Box<str>,
-    input_names: Box<[String]>,
-    expected_result: RuntimeRelayExpectedResult,
-}
-
-impl RelayClientSelectionV1 {
-    #[allow(clippy::too_many_arguments)]
-    pub(crate) fn new(
-        profile_id: impl Into<Box<str>>,
-        profile_contract_hash: impl Into<Box<str>>,
-        purpose: impl Into<Box<str>>,
-        input_names: impl Into<RelayInputNames>,
-        expected_result: RuntimeRelayExpectedResult,
-    ) -> Result<Self, ConsultationPlanError> {
-        let profile_id = profile_id.into();
-        let profile_contract_hash = profile_contract_hash.into();
-        let purpose = purpose.into();
-        let mut input_names = input_names.into().into_vec();
-        input_names.sort();
-        input_names.dedup();
-        if !stable_id(&profile_id, MAX_PROFILE_ID_BYTES)
-            || !sha256_uri(&profile_contract_hash)
-            || !valid_purpose(&purpose)
-            || !(1..=16).contains(&input_names.len())
-            || input_names
-                .iter()
-                .any(|name| !input_name(name, MAX_INPUT_NAME_BYTES))
-        {
-            return Err(ConsultationPlanError::InvalidGroupKey);
-        }
-        Ok(Self {
-            profile_id,
-            profile_contract_hash,
-            purpose,
-            input_names: input_names.into_boxed_slice(),
-            expected_result,
-        })
-    }
-
-    fn from_key(key: &ConsultationGroupKeyV1) -> Self {
-        Self {
-            profile_id: key.profile_id.clone(),
-            profile_contract_hash: key.profile_contract_hash.clone(),
-            purpose: key.canonical_purpose.clone(),
-            input_names: key.canonical_inputs.keys().cloned().collect(),
-            expected_result: key.expected_result.clone(),
-        }
-    }
-}
-
-impl fmt::Debug for RelayClientSelectionV1 {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str("RelayClientSelectionV1([REDACTED])")
-    }
-}
-
-/// The complete typed equality boundary for request-scoped consultation reuse.
-///
-/// This type deliberately implements neither `Debug` nor `Serialize`. It can
-/// contain authenticated principal and subject-selector material and must
-/// remain request-scoped memory only.
-#[derive(Clone)]
-pub(crate) struct ConsultationGroupKeyV1 {
-    evaluation_id: Ulid,
-    auth_profile_id: EvidenceAuthProfileId,
-    principal_id: Zeroizing<String>,
-    checked_scopes_sorted: Box<[String]>,
-    profile_id: Box<str>,
-    profile_contract_hash: Box<str>,
-    canonical_purpose: Box<str>,
-    canonical_inputs: BTreeMap<String, Zeroizing<String>>,
-    expected_result: RuntimeRelayExpectedResult,
-}
-
-impl ConsultationGroupKeyV1 {
-    /// Build one canonical key after Notary has completed all
-    /// pre-consultation gates.
-    #[cfg(test)]
-    #[allow(clippy::too_many_arguments)]
-    pub(crate) fn new(
-        evaluation_id: Ulid,
-        auth_profile_id: EvidenceAuthProfileId,
-        principal_id: String,
-        checked_scopes: Vec<String>,
-        profile_id: impl Into<Box<str>>,
-        profile_contract_hash: impl Into<Box<str>>,
-        canonical_purpose: impl Into<Box<str>>,
-        canonical_inputs: BTreeMap<String, Zeroizing<String>>,
-    ) -> Result<Self, ConsultationPlanError> {
-        Self::new_with_expected_result(
-            evaluation_id,
-            auth_profile_id,
-            principal_id,
-            checked_scopes,
-            profile_id,
-            profile_contract_hash,
-            canonical_purpose,
-            canonical_inputs,
-            RuntimeRelayExpectedResult::output_map(BTreeMap::from([(
-                "registration_status".to_string(),
-                RelayOutputContract::String {
-                    nullable: true,
-                    max_bytes: 64,
-                },
-            )]))?,
-        )
-    }
-
-    #[allow(clippy::too_many_arguments)]
-    pub(crate) fn new_with_expected_result(
-        evaluation_id: Ulid,
-        auth_profile_id: EvidenceAuthProfileId,
-        principal_id: String,
-        mut checked_scopes: Vec<String>,
-        profile_id: impl Into<Box<str>>,
-        profile_contract_hash: impl Into<Box<str>>,
-        canonical_purpose: impl Into<Box<str>>,
-        canonical_inputs: BTreeMap<String, Zeroizing<String>>,
-        expected_result: RuntimeRelayExpectedResult,
-    ) -> Result<Self, ConsultationPlanError> {
-        let profile_id = profile_id.into();
-        let profile_contract_hash = profile_contract_hash.into();
-        let canonical_purpose = canonical_purpose.into();
-        if !valid_principal_id(&principal_id)
-            || checked_scopes.is_empty()
-            || checked_scopes.iter().any(|scope| !valid_scope(scope))
-            || !stable_id(&profile_id, MAX_PROFILE_ID_BYTES)
-            || !sha256_uri(&profile_contract_hash)
-            || !valid_purpose(&canonical_purpose)
-            || !valid_canonical_inputs(&canonical_inputs)
-        {
-            return Err(ConsultationPlanError::InvalidGroupKey);
-        }
-        checked_scopes.sort_unstable();
-        checked_scopes.dedup();
-        if checked_scopes.len() > MAX_CHECKED_SCOPES_V1 {
-            return Err(ConsultationPlanError::InvalidGroupKey);
-        }
-        Ok(Self {
-            evaluation_id,
-            auth_profile_id,
-            principal_id: Zeroizing::new(principal_id),
-            checked_scopes_sorted: checked_scopes.into_boxed_slice(),
-            profile_id,
-            profile_contract_hash,
-            canonical_purpose,
-            canonical_inputs,
-            expected_result,
-        })
-    }
-
-    #[must_use]
-    pub(crate) const fn evaluation_id(&self) -> Ulid {
-        self.evaluation_id
-    }
-
-    #[must_use]
-    #[cfg(test)]
-    pub(crate) const fn auth_profile_id(&self) -> EvidenceAuthProfileId {
-        self.auth_profile_id
-    }
-
-    #[must_use]
-    #[cfg(test)]
-    pub(crate) fn principal_id(&self) -> &str {
-        self.principal_id.as_str()
-    }
-
-    #[must_use]
-    #[cfg(test)]
-    pub(crate) fn checked_scopes_sorted(&self) -> &[String] {
-        &self.checked_scopes_sorted
-    }
-
-    #[must_use]
-    pub(crate) fn profile_id(&self) -> &str {
-        &self.profile_id
-    }
-
-    #[must_use]
-    pub(crate) fn profile_contract_hash(&self) -> &str {
-        &self.profile_contract_hash
-    }
-
-    #[must_use]
-    pub(crate) fn canonical_purpose(&self) -> &str {
-        &self.canonical_purpose
-    }
-
-    /// Return the canonical profile inputs in bytewise key order. Values
-    /// remain owned by zeroizing allocations for the request lifetime.
-    #[must_use]
-    pub(crate) const fn canonical_inputs(&self) -> &BTreeMap<String, Zeroizing<String>> {
-        &self.canonical_inputs
-    }
-
-    fn with_canonical_inputs(
-        mut self,
-        inputs: BTreeMap<String, Zeroizing<String>>,
-    ) -> Result<Self, RelayClientError> {
-        if !valid_canonical_inputs(&inputs) {
-            return Err(RelayClientError::InvalidRequest);
-        }
-        self.canonical_inputs = inputs;
-        Ok(self)
-    }
-
-    #[must_use]
-    #[cfg(feature = "registry-notary-cel")]
-    pub(crate) const fn expected_output_contracts(
-        &self,
-    ) -> Option<&BTreeMap<String, RelayOutputContract>> {
-        self.expected_result.output_contracts()
-    }
-}
-
-impl Ord for ConsultationGroupKeyV1 {
-    fn cmp(&self, other: &Self) -> Ordering {
-        self.evaluation_id
-            .cmp(&other.evaluation_id)
-            .then_with(|| self.auth_profile_id.cmp(&other.auth_profile_id))
-            .then_with(|| self.principal_id.as_str().cmp(other.principal_id.as_str()))
-            .then_with(|| self.checked_scopes_sorted.cmp(&other.checked_scopes_sorted))
-            .then_with(|| self.profile_id.cmp(&other.profile_id))
-            .then_with(|| self.profile_contract_hash.cmp(&other.profile_contract_hash))
-            .then_with(|| self.canonical_purpose.cmp(&other.canonical_purpose))
-            .then_with(|| compare_canonical_inputs(&self.canonical_inputs, &other.canonical_inputs))
-    }
-}
-
-impl PartialEq for ConsultationGroupKeyV1 {
-    fn eq(&self, other: &Self) -> bool {
-        self.cmp(other) == Ordering::Equal
-    }
-}
-
-impl Eq for ConsultationGroupKeyV1 {}
-
-/// Opaque restart-stable identity for one item-local Relay consultation.
-///
-/// The type deliberately exposes neither its preimage nor `Display`. Its
-/// redacted `Debug` implementation is safe for error paths.
-#[derive(Clone, PartialEq, Eq)]
-pub(crate) struct BatchChildIdentityV1(Box<str>);
-
-/// Canonical, value-bearing preimage used only while deriving an opaque child
-/// identity. It is deliberately not serializable through a general-purpose
-/// interface and its diagnostics are value-free.
-struct BatchConsultationGroupCommitmentV1<'a> {
-    key: &'a ConsultationGroupKeyV1,
-}
-
-impl BatchConsultationGroupCommitmentV1<'_> {
-    fn canonical_json(&self) -> Result<Vec<u8>, ConsultationPlanError> {
-        let key = self.key;
-        let caller = serde_json::json!({
-            "auth_profile_id": key.auth_profile_id.as_str(),
-            "principal_id": key.principal_id.as_str(),
-            "checked_scopes_sorted": key.checked_scopes_sorted,
-        });
-        let commitment = serde_json::json!({
-            "authenticated_evaluation_caller_binding": caller,
-            "profile": {
-                "id": key.profile_id.as_ref(),
-                "contract_hash": key.profile_contract_hash.as_ref(),
-            },
-            "canonical_purpose": key.canonical_purpose.as_ref(),
-            "canonical_inputs": key.canonical_inputs.iter().map(|(name, value)| {
-                (name.clone(), Value::String(value.as_str().to_string()))
-            }).collect::<Map<String, Value>>(),
-        });
-        canonicalize_json(&commitment).map_err(|_| ConsultationPlanError::InvalidGroupKey)
-    }
-}
-
-impl fmt::Debug for BatchConsultationGroupCommitmentV1<'_> {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str("BatchConsultationGroupCommitmentV1([REDACTED])")
-    }
-}
-
-impl BatchChildIdentityV1 {
-    pub(crate) fn derive(
-        outer_key: &str,
-        item_position: usize,
-        key: &ConsultationGroupKeyV1,
-    ) -> Result<Self, ConsultationPlanError> {
-        if outer_key.is_empty() || outer_key.len() > 256 {
-            return Err(ConsultationPlanError::InvalidGroupKey);
-        }
-        let item_position =
-            u64::try_from(item_position).map_err(|_| ConsultationPlanError::InvalidGroupKey)?;
-        let commitment = BatchConsultationGroupCommitmentV1 { key }.canonical_json()?;
-
-        let mut outer = Sha256::new();
-        frame_hash(&mut outer, b"registry.notary.batch-outer.v1");
-        frame_hash(&mut outer, key.auth_profile_id.as_str().as_bytes());
-        frame_hash(&mut outer, key.principal_id.as_bytes());
-        for scope in &key.checked_scopes_sorted {
-            frame_hash(&mut outer, scope.as_bytes());
-        }
-        frame_hash(&mut outer, outer_key.as_bytes());
-        let outer = outer.finalize();
-
-        let mut child = Sha256::new();
-        frame_hash(&mut child, b"registry.notary.relay-batch-child.v1");
-        frame_hash(&mut child, &outer);
-        frame_hash(&mut child, &item_position.to_be_bytes());
-        frame_hash(&mut child, &commitment);
-        let encoded = base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(child.finalize());
-        Ok(Self(encoded.into_boxed_str()))
-    }
-
-    pub(crate) fn as_str(&self) -> &str {
-        &self.0
-    }
-}
-
-impl fmt::Debug for BatchChildIdentityV1 {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str("BatchChildIdentityV1([REDACTED])")
-    }
-}
-
-fn frame_hash(hash: &mut Sha256, bytes: &[u8]) {
-    hash.update(u64::try_from(bytes.len()).unwrap_or(u64::MAX).to_be_bytes());
-    hash.update(bytes);
-}
-
-impl PartialOrd for ConsultationGroupKeyV1 {
-    fn partial_cmp(&self, other: &Self) -> Option<Ordering> {
-        Some(self.cmp(other))
-    }
-}
-
-fn compare_canonical_inputs(
-    left: &BTreeMap<String, Zeroizing<String>>,
-    right: &BTreeMap<String, Zeroizing<String>>,
-) -> Ordering {
-    let mut left = left.iter();
-    let mut right = right.iter();
-    loop {
-        match (left.next(), right.next()) {
-            (Some((left_name, left_value)), Some((right_name, right_value))) => {
-                let ordering = left_name
-                    .cmp(right_name)
-                    .then_with(|| left_value.as_str().cmp(right_value.as_str()));
-                if ordering != Ordering::Equal {
-                    return ordering;
-                }
-            }
-            (Some(_), None) => return Ordering::Greater,
-            (None, Some(_)) => return Ordering::Less,
-            (None, None) => return Ordering::Equal,
-        }
-    }
-}
-
-/// Value-free planning failures for the request-scoped grouping boundary.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error)]
-pub(crate) enum ConsultationPlanError {
-    #[error("consultation group key is invalid")]
-    InvalidGroupKey,
-    #[error("an evaluation cannot contain more than 16 consultation groups")]
-    TooManyGroups,
-}
-
-/// Private request-scoped correlation retained across successful and failed
-/// claim evaluation. The collector is neither serializable nor publicly
-/// exposed, and its diagnostics never reveal correlation values.
-pub(crate) struct EvaluationAuditCollector {
-    state: Mutex<EvaluationAuditState>,
-}
-
-#[derive(Default)]
-struct EvaluationAuditState {
-    evaluation_id: Option<Ulid>,
-    relay_forwarded_count: u64,
-    relay_consultation_ids: BTreeSet<Ulid>,
-}
-
-pub(crate) struct EvaluationAuditSnapshot {
-    evaluation_id: Option<String>,
-    relay_forwarded_count: u64,
-    relay_consultation_ids: Vec<String>,
-}
-
-impl EvaluationAuditCollector {
-    pub(crate) fn new() -> Self {
-        Self {
-            state: Mutex::new(EvaluationAuditState::default()),
-        }
-    }
-
-    pub(crate) fn begin_evaluation(&self) -> Ulid {
-        let evaluation_id = Ulid::new();
-        let mut state = self
-            .state
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        assert!(
-            state.evaluation_id.replace(evaluation_id).is_none(),
-            "an evaluation audit collector cannot be reused"
-        );
-        evaluation_id
-    }
-
-    fn record_relay_consultation(&self, consultation_id: Ulid) {
-        let mut state = self
-            .state
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        assert!(
-            state.evaluation_id.is_some(),
-            "a Relay consultation cannot precede its Notary evaluation"
-        );
-        state.relay_consultation_ids.insert(consultation_id);
-    }
-
-    fn record_relay_forwarded(&self) {
-        let mut state = self
-            .state
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        assert!(
-            state.evaluation_id.is_some(),
-            "a Relay consultation cannot be forwarded before its Notary evaluation"
-        );
-        state.relay_forwarded_count = state.relay_forwarded_count.saturating_add(1);
-    }
-
-    pub(crate) fn snapshot(&self) -> EvaluationAuditSnapshot {
-        let state = self
-            .state
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        EvaluationAuditSnapshot {
-            evaluation_id: state.evaluation_id.map(|id| id.to_string()),
-            relay_forwarded_count: state.relay_forwarded_count,
-            relay_consultation_ids: state
-                .relay_consultation_ids
-                .iter()
-                .map(ToString::to_string)
-                .collect(),
-        }
-    }
-}
-
-impl fmt::Debug for EvaluationAuditCollector {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str("EvaluationAuditCollector([REDACTED])")
-    }
-}
-
-impl EvaluationAuditSnapshot {
-    pub(crate) fn evaluation_id(&self) -> Option<&str> {
-        self.evaluation_id.as_deref()
-    }
-
-    pub(crate) const fn relay_forwarded_count(&self) -> u64 {
-        self.relay_forwarded_count
-    }
-
-    pub(crate) fn into_parts(self) -> (Option<String>, Vec<String>) {
-        (self.evaluation_id, self.relay_consultation_ids)
-    }
-}
-
-/// Runtime-neutral closed consultation outcome.
-#[derive(Clone, Copy, PartialEq, Eq)]
-pub(crate) enum RuntimeRelayOutcome {
-    Match,
-    NoMatch,
-    Ambiguous,
-}
-
-impl fmt::Debug for RuntimeRelayOutcome {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str("RuntimeRelayOutcome([REDACTED])")
-    }
-}
-
-/// Match-only data released by the verified Relay client.
-pub(crate) enum RuntimeRelayMatchData {
-    OutputMap(RuntimeRelayOutputMap),
-}
-
-pub(crate) struct RuntimeRelayOutputMap {
-    fields: BTreeMap<Box<str>, RuntimeRelayOutputValue>,
-}
-
-enum RuntimeRelayOutputValue {
-    Null,
-    Boolean(bool),
-    Integer(i64),
-    String(Zeroizing<String>),
-    CanonicalJson(Zeroizing<Vec<u8>>),
-}
-
-impl RuntimeRelayOutputMap {
-    #[cfg(any(test, feature = "registry-notary-cel"))]
-    pub(crate) fn from_json(fields: BTreeMap<String, Value>) -> Result<Self, RelayClientError> {
-        let fields = fields
-            .into_iter()
-            .map(|(name, value)| {
-                let value = match value {
-                    Value::Null => RuntimeRelayOutputValue::Null,
-                    Value::Bool(value) => RuntimeRelayOutputValue::Boolean(value),
-                    Value::Number(value) => value
-                        .as_i64()
-                        .map(RuntimeRelayOutputValue::Integer)
-                        .ok_or(RelayClientError::InvalidResult)?,
-                    Value::String(value) => RuntimeRelayOutputValue::String(Zeroizing::new(value)),
-                    value @ (Value::Array(_) | Value::Object(_)) => {
-                        RuntimeRelayOutputValue::CanonicalJson(Zeroizing::new(
-                            canonicalize_json(&value)
-                                .map_err(|_| RelayClientError::InvalidResult)?,
-                        ))
-                    }
-                };
-                Ok((name.into_boxed_str(), value))
-            })
-            .collect::<Result<BTreeMap<_, _>, RelayClientError>>()?;
-        Ok(Self { fields })
-    }
-
-    fn from_relay(outputs: &crate::relay_client::RelayOutputMap) -> Result<Self, RelayClientError> {
-        let fields = outputs
-            .fields()
-            .map(|(name, value)| {
-                let value = match value {
-                    ProjectedJsonScalar::Null => RuntimeRelayOutputValue::Null,
-                    ProjectedJsonScalar::Boolean(value) => RuntimeRelayOutputValue::Boolean(*value),
-                    ProjectedJsonScalar::Integer(value) => RuntimeRelayOutputValue::Integer(*value),
-                    ProjectedJsonScalar::String(value) => {
-                        RuntimeRelayOutputValue::String(Zeroizing::new(value.to_string()))
-                    }
-                    ProjectedJsonScalar::CanonicalJson(value) => {
-                        RuntimeRelayOutputValue::CanonicalJson(Zeroizing::new(value.to_vec()))
-                    }
-                    ProjectedJsonScalar::Number(_) => return Err(RelayClientError::InvalidResult),
-                };
-                Ok((name.into(), value))
-            })
-            .collect::<Result<BTreeMap<_, _>, RelayClientError>>()?;
-        Ok(Self { fields })
-    }
-
-    pub(crate) fn to_json_object(&self) -> Map<String, Value> {
-        self.fields
-            .iter()
-            .map(|(name, value)| {
-                let value = match value {
-                    RuntimeRelayOutputValue::Null => Value::Null,
-                    RuntimeRelayOutputValue::Boolean(value) => Value::Bool(*value),
-                    RuntimeRelayOutputValue::Integer(value) => Value::Number((*value).into()),
-                    RuntimeRelayOutputValue::String(value) => Value::String(value.to_string()),
-                    RuntimeRelayOutputValue::CanonicalJson(value) => serde_json::from_slice(value)
-                        .expect("verified canonical Relay output remains valid JSON"),
-                };
-                (name.to_string(), value)
-            })
-            .collect()
-    }
-}
-
-impl fmt::Debug for RuntimeRelayOutputMap {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("RuntimeRelayOutputMap")
-            .field("fields", &"[REDACTED]")
-            .finish()
-    }
-}
-
-impl fmt::Debug for RuntimeRelayMatchData {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str("RuntimeRelayMatchData([REDACTED])")
-    }
-}
-
-/// The only Relay result shape visible to the evaluation runtime.
-pub(crate) struct RuntimeRelayConsultationResult {
-    consultation_id: Ulid,
-    outcome: RuntimeRelayOutcome,
-    match_data: Option<RuntimeRelayMatchData>,
-    acquired_at: OffsetDateTime,
-}
-
-impl RuntimeRelayConsultationResult {
-    pub(crate) fn new(
-        consultation_id: Ulid,
-        outcome: RuntimeRelayOutcome,
-        match_data: Option<RuntimeRelayMatchData>,
-        acquired_at: OffsetDateTime,
-    ) -> Result<Self, RelayClientError> {
-        let output_shape_valid = match outcome {
-            RuntimeRelayOutcome::Match => match_data.is_some(),
-            RuntimeRelayOutcome::NoMatch | RuntimeRelayOutcome::Ambiguous => match_data.is_none(),
-        };
-        if !output_shape_valid {
-            return Err(RelayClientError::InvalidResult);
-        }
-        Ok(Self {
-            consultation_id,
-            outcome,
-            match_data,
-            acquired_at,
-        })
-    }
-
-    #[must_use]
-    pub(crate) const fn consultation_id(&self) -> Ulid {
-        self.consultation_id
-    }
-
-    #[must_use]
-    pub(crate) const fn outcome(&self) -> RuntimeRelayOutcome {
-        self.outcome
-    }
-
-    #[must_use]
-    pub(crate) const fn outputs(&self) -> Option<&RuntimeRelayOutputMap> {
-        match self.match_data.as_ref() {
-            Some(RuntimeRelayMatchData::OutputMap(outputs)) => Some(outputs),
-            None => None,
-        }
-    }
-
-    #[must_use]
-    pub(crate) const fn acquired_at(&self) -> OffsetDateTime {
-        self.acquired_at
-    }
-}
-
-impl fmt::Debug for RuntimeRelayConsultationResult {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("RuntimeRelayConsultationResult")
-            .field("consultation_id", &"[REDACTED]")
-            .field("outcome", &"[REDACTED]")
-            .field("output", &"[REDACTED]")
-            .field("acquired_at", &"[REDACTED]")
-            .finish()
-    }
-}
-
-/// Activated, startup-verified Relay consultations available to one runtime.
-/// The trait is dyn-safe and releases only the runtime-neutral closed result.
-#[async_trait::async_trait]
-pub(crate) trait ActivatedRelayConsultations: Send + Sync + fmt::Debug {
-    async fn check_ready(&self) -> Result<(), RelayClientError>;
-
-    async fn readiness(&self) -> RelayProfileReadiness {
-        RelayProfileReadiness::single(self.check_ready().await.is_ok())
-    }
-
-    fn profile_count(&self) -> usize {
-        1
-    }
-
-    fn validate(&self, key: &ConsultationGroupKeyV1) -> Result<(), RelayClientError>;
-
-    fn canonicalize(
-        &self,
-        key: ConsultationGroupKeyV1,
-    ) -> Result<ConsultationGroupKeyV1, RelayClientError> {
-        self.validate(&key)?;
-        Ok(key)
-    }
-
-    async fn execute(
-        &self,
-        key: &ConsultationGroupKeyV1,
-    ) -> Result<RuntimeRelayConsultationResult, RelayClientError>;
-
-    async fn execute_batch(
-        &self,
-        key: &ConsultationGroupKeyV1,
-        _child_identity: &BatchChildIdentityV1,
-    ) -> Result<RuntimeRelayConsultationResult, RelayClientError> {
-        self.execute(key).await
-    }
-}
-
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
-pub(crate) struct RelayProfileReadiness {
-    total: usize,
-    ready: usize,
-}
-
-impl RelayProfileReadiness {
-    const fn single(ready: bool) -> Self {
-        Self {
-            total: 1,
-            ready: ready as usize,
-        }
-    }
-
-    pub(crate) const fn all_failed(total: usize) -> Self {
-        Self { total, ready: 0 }
-    }
-
-    fn add(&mut self, other: Self) {
-        self.total += other.total;
-        self.ready += other.ready;
-    }
-
-    pub(crate) const fn total(self) -> usize {
-        self.total
-    }
-
-    pub(crate) const fn ready(self) -> usize {
-        self.ready
-    }
-
-    pub(crate) const fn failed(self) -> usize {
-        self.total - self.ready
-    }
-
-    pub(crate) const fn is_ready(self) -> bool {
-        self.total > 0 && self.ready == self.total
-    }
-}
-
-pub(crate) struct ActivatedRelayClientSet {
-    clients: BTreeMap<RelayClientSelectionV1, Arc<dyn ActivatedRelayConsultations>>,
-}
-
-impl ActivatedRelayClientSet {
-    pub(crate) fn new(
-        entries: impl IntoIterator<
-            Item = (RelayClientSelectionV1, Arc<dyn ActivatedRelayConsultations>),
-        >,
-    ) -> Result<Self, ConsultationPlanError> {
-        let mut clients = BTreeMap::new();
-        for (selection, client) in entries {
-            if clients.insert(selection, client).is_some() {
-                return Err(ConsultationPlanError::InvalidGroupKey);
-            }
-        }
-        if clients.is_empty() {
-            return Err(ConsultationPlanError::InvalidGroupKey);
-        }
-        Ok(Self { clients })
-    }
-
-    fn client_for(
-        &self,
-        key: &ConsultationGroupKeyV1,
-    ) -> Result<&Arc<dyn ActivatedRelayConsultations>, RelayClientError> {
-        self.clients
-            .get(&RelayClientSelectionV1::from_key(key))
-            .ok_or(RelayClientError::InvalidRequest)
-    }
-}
-
-impl fmt::Debug for ActivatedRelayClientSet {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("ActivatedRelayClientSet")
-            .field("clients", &"[REDACTED]")
-            .finish()
-    }
-}
-
-#[async_trait::async_trait]
-impl ActivatedRelayConsultations for ActivatedRelayClientSet {
-    async fn check_ready(&self) -> Result<(), RelayClientError> {
-        if self.readiness().await.is_ready() {
-            Ok(())
-        } else {
-            Err(RelayClientError::Unavailable)
-        }
-    }
-
-    async fn readiness(&self) -> RelayProfileReadiness {
-        let mut readiness = RelayProfileReadiness::default();
-        for client in self.clients.values() {
-            readiness.add(client.readiness().await);
-        }
-        readiness
-    }
-
-    fn profile_count(&self) -> usize {
-        self.clients.len()
-    }
-
-    fn validate(&self, key: &ConsultationGroupKeyV1) -> Result<(), RelayClientError> {
-        self.client_for(key)?.validate(key)
-    }
-
-    fn canonicalize(
-        &self,
-        key: ConsultationGroupKeyV1,
-    ) -> Result<ConsultationGroupKeyV1, RelayClientError> {
-        self.client_for(&key)?.canonicalize(key)
-    }
-
-    async fn execute(
-        &self,
-        key: &ConsultationGroupKeyV1,
-    ) -> Result<RuntimeRelayConsultationResult, RelayClientError> {
-        self.client_for(key)?.execute(key).await
-    }
-
-    async fn execute_batch(
-        &self,
-        key: &ConsultationGroupKeyV1,
-        child_identity: &BatchChildIdentityV1,
-    ) -> Result<RuntimeRelayConsultationResult, RelayClientError> {
-        self.client_for(key)?
-            .execute_batch(key, child_identity)
-            .await
-    }
-}
-
-#[async_trait::async_trait]
-impl ActivatedRelayConsultations for VerifiedRelayClient {
-    async fn check_ready(&self) -> Result<(), RelayClientError> {
-        self.verify_current_profile().await
-    }
-
-    fn validate(&self, key: &ConsultationGroupKeyV1) -> Result<(), RelayClientError> {
-        let profile = self.profile();
-        if profile.pin().id() != key.profile_id()
-            || profile.pin().contract_hash() != key.profile_contract_hash()
-            || profile.purpose() != key.canonical_purpose()
-            || profile
-                .input_names()
-                .iter()
-                .ne(key.canonical_inputs().keys())
-        {
-            return Err(RelayClientError::InvalidRequest);
-        }
-        self.canonicalize_execute_inputs(&key.evaluation_id().to_string(), key.canonical_inputs())
-            .map(|_| ())
-    }
-
-    fn canonicalize(
-        &self,
-        key: ConsultationGroupKeyV1,
-    ) -> Result<ConsultationGroupKeyV1, RelayClientError> {
-        let inputs = self.canonicalize_execute_inputs(
-            &key.evaluation_id().to_string(),
-            key.canonical_inputs(),
-        )?;
-        key.with_canonical_inputs(inputs)
-    }
-
-    async fn execute(
-        &self,
-        key: &ConsultationGroupKeyV1,
-    ) -> Result<RuntimeRelayConsultationResult, RelayClientError> {
-        self.validate(key)?;
-        let result = self
-            .execute_inputs(
-                &key.evaluation_id().to_string(),
-                key.canonical_inputs().clone(),
-            )
-            .await?;
-        relay_result_to_runtime(result)
-    }
-
-    async fn execute_batch(
-        &self,
-        key: &ConsultationGroupKeyV1,
-        child_identity: &BatchChildIdentityV1,
-    ) -> Result<RuntimeRelayConsultationResult, RelayClientError> {
-        self.validate(key)?;
-        let result = self
-            .execute_batch_inputs(
-                &key.evaluation_id().to_string(),
-                key.canonical_inputs().clone(),
-                child_identity.as_str(),
-            )
-            .await?;
-        relay_result_to_runtime(result)
-    }
-}
-
-fn relay_result_to_runtime(
-    result: crate::relay_client::RelayConsultationResult,
-) -> Result<RuntimeRelayConsultationResult, RelayClientError> {
-    let outcome = match result.outcome() {
-        RelayConsultationOutcome::Match => RuntimeRelayOutcome::Match,
-        RelayConsultationOutcome::NoMatch => RuntimeRelayOutcome::NoMatch,
-        RelayConsultationOutcome::Ambiguous => RuntimeRelayOutcome::Ambiguous,
-    };
-    let match_data = match result.match_data() {
-        Some(RelayMatchData::OutputMap(outputs)) => Some(RuntimeRelayMatchData::OutputMap(
-            RuntimeRelayOutputMap::from_relay(outputs)?,
-        )),
-        None => None,
-    };
-    RuntimeRelayConsultationResult::new(
-        result.consultation_id(),
-        outcome,
-        match_data,
-        result.provenance().acquired_at(),
-    )
-}
-
-type SharedConsultationResult = Result<Arc<RuntimeRelayConsultationResult>, RelayClientError>;
-
-/// One cancellation-safe execution slot.
-///
-/// The outbound operation runs in a detached task after `started` is sealed.
-/// Cancelling the first request waiter therefore cannot cause a later waiter
-/// to dispatch the same consultation again.
-struct CoalescedConsultation {
-    started: Once,
-    result: OnceLock<SharedConsultationResult>,
-    completed: Notify,
-}
-
-impl CoalescedConsultation {
-    fn new() -> Self {
-        Self {
-            started: Once::new(),
-            result: OnceLock::new(),
-            completed: Notify::new(),
-        }
-    }
-
-    fn start(
-        self: &Arc<Self>,
-        activated: Arc<dyn ActivatedRelayConsultations>,
-        audit: Arc<EvaluationAuditCollector>,
-        key: ConsultationGroupKeyV1,
-        child_identity: Option<BatchChildIdentityV1>,
-    ) {
-        let state = Arc::clone(self);
-        self.started.call_once(move || {
-            // Seal a conservative dispatch-attempt marker into the request
-            // audit before permit acquisition, credential loading, or network
-            // I/O. It means the operation may reach Relay, not that Relay
-            // received it. Recording here prevents cancellation from creating
-            // a false negative after the detached task outlives an early
-            // sibling failure. Relay also receives the Notary evaluation id,
-            // so an audit can reconcile a late Relay completion when present.
-            audit.record_relay_forwarded();
-            tokio::spawn(async move {
-                let execution = tokio::spawn(async move {
-                    match child_identity.as_ref() {
-                        Some(identity) => activated.execute_batch(&key, identity).await,
-                        None => activated.execute(&key).await,
-                    }
-                });
-                let result = match execution.await {
-                    Ok(result) => result.map(Arc::new),
-                    Err(_) => Err(RelayClientError::Unavailable),
-                };
-                let _ = state.result.set(result);
-                state.completed.notify_waiters();
-            });
-        });
-    }
-
-    async fn wait(&self) -> SharedConsultationResult {
-        loop {
-            let completed = self.completed.notified();
-            if let Some(result) = self.result.get() {
-                return match result {
-                    Ok(result) => Ok(Arc::clone(result)),
-                    Err(error) => Err(*error),
-                };
-            }
-            completed.await;
-        }
-    }
-}
-
-/// Fresh per-evaluation coordination state. Groups must be fully planned
-/// before construction; execution can never insert a new group dynamically.
-pub(crate) struct RequestScopedConsultationCoordinator {
-    groups: BTreeMap<ConsultationGroupKeyV1, Arc<CoalescedConsultation>>,
-    activated: Arc<dyn ActivatedRelayConsultations>,
-    audit: Arc<EvaluationAuditCollector>,
-}
-
-impl RequestScopedConsultationCoordinator {
-    pub(crate) fn new(
-        keys: impl IntoIterator<Item = ConsultationGroupKeyV1>,
-        activated: Arc<dyn ActivatedRelayConsultations>,
-        audit: Arc<EvaluationAuditCollector>,
-    ) -> Result<Self, ConsultationPlanError> {
-        let mut groups = BTreeMap::new();
-        for key in keys {
-            groups
-                .entry(key)
-                .or_insert_with(|| Arc::new(CoalescedConsultation::new()));
-            if groups.len() > MAX_CONSULTATION_GROUPS_V1 {
-                return Err(ConsultationPlanError::TooManyGroups);
-            }
-        }
-        Ok(Self {
-            groups,
-            activated,
-            audit,
-        })
-    }
-
-    #[must_use]
-    #[cfg(test)]
-    pub(crate) fn len(&self) -> usize {
-        self.groups.len()
-    }
-
-    #[must_use]
-    #[cfg(test)]
-    pub(crate) fn is_empty(&self) -> bool {
-        self.groups.is_empty()
-    }
-
-    #[allow(dead_code)]
-    pub(crate) async fn consult(
-        &self,
-        key: &ConsultationGroupKeyV1,
-    ) -> Result<Arc<RuntimeRelayConsultationResult>, RelayClientError> {
-        self.consult_with_child(key, None).await
-    }
-
-    async fn consult_with_child(
-        &self,
-        key: &ConsultationGroupKeyV1,
-        child_identity: Option<&BatchChildIdentityV1>,
-    ) -> Result<Arc<RuntimeRelayConsultationResult>, RelayClientError> {
-        let cell = self
-            .groups
-            .get(key)
-            .ok_or(RelayClientError::InvalidRequest)?;
-        cell.start(
-            Arc::clone(&self.activated),
-            Arc::clone(&self.audit),
-            key.clone(),
-            child_identity.cloned(),
-        );
-        cell.wait().await
-    }
-}
-
-impl fmt::Debug for RequestScopedConsultationCoordinator {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("RequestScopedConsultationCoordinator")
-            .field("groups", &"[REDACTED]")
-            .field("activated", &"[REDACTED]")
-            .field("audit", &"[REDACTED]")
-            .finish()
-    }
-}
-
-/// Fully planned Registry-backed consultations for one evaluation.
-///
-/// Claim ids are non-secret configuration identifiers. Group keys remain
-/// private because they contain caller and subject-selector material.
-pub(crate) struct RequestScopedRelayPlan {
-    keys_by_claim: BTreeMap<String, ConsultationGroupKeyV1>,
-    coordinator: RequestScopedConsultationCoordinator,
-    audit: Arc<EvaluationAuditCollector>,
-    child_identities: BTreeMap<ConsultationGroupKeyV1, BatchChildIdentityV1>,
-}
-
-impl RequestScopedRelayPlan {
-    pub(crate) fn new(
-        entries: impl IntoIterator<Item = (String, ConsultationGroupKeyV1)>,
-        activated: Arc<dyn ActivatedRelayConsultations>,
-        audit: Arc<EvaluationAuditCollector>,
-    ) -> Result<Self, ConsultationPlanError> {
-        Self::new_internal(
-            entries.into_iter().map(|(claim, key)| (claim, key, None)),
-            activated,
-            audit,
-        )
-    }
-
-    pub(crate) fn new_batch(
-        entries: impl IntoIterator<Item = (String, ConsultationGroupKeyV1)>,
-        outer_key: &str,
-        item_position: usize,
-        activated: Arc<dyn ActivatedRelayConsultations>,
-        audit: Arc<EvaluationAuditCollector>,
-    ) -> Result<Self, ConsultationPlanError> {
-        Self::new_internal(
-            entries
-                .into_iter()
-                .map(|(claim, key)| (claim, key, Some((outer_key, item_position)))),
-            activated,
-            audit,
-        )
-    }
-
-    fn new_internal<'a>(
-        entries: impl IntoIterator<Item = (String, ConsultationGroupKeyV1, Option<(&'a str, usize)>)>,
-        activated: Arc<dyn ActivatedRelayConsultations>,
-        audit: Arc<EvaluationAuditCollector>,
-    ) -> Result<Self, ConsultationPlanError> {
-        let mut keys_by_claim = BTreeMap::new();
-        let mut child_identities = BTreeMap::new();
-        for (claim_id, key, child_context) in entries {
-            let key = activated
-                .canonicalize(key)
-                .map_err(|_| ConsultationPlanError::InvalidGroupKey)?;
-            if let Some((outer_key, item_position)) = child_context {
-                let child_identity = BatchChildIdentityV1::derive(outer_key, item_position, &key)?;
-                match child_identities.entry(key.clone()) {
-                    std::collections::btree_map::Entry::Vacant(entry) => {
-                        entry.insert(child_identity);
-                    }
-                    std::collections::btree_map::Entry::Occupied(entry)
-                        if entry.get() == &child_identity => {}
-                    std::collections::btree_map::Entry::Occupied(_) => {
-                        return Err(ConsultationPlanError::InvalidGroupKey);
-                    }
-                }
-            }
-            if claim_id.is_empty()
-                || activated.validate(&key).is_err()
-                || keys_by_claim.insert(claim_id, key).is_some()
-            {
-                return Err(ConsultationPlanError::InvalidGroupKey);
-            }
-        }
-        let coordinator = RequestScopedConsultationCoordinator::new(
-            keys_by_claim.values().cloned(),
-            activated,
-            Arc::clone(&audit),
-        )?;
-        Ok(Self {
-            keys_by_claim,
-            coordinator,
-            audit,
-            child_identities,
-        })
-    }
-
-    pub(crate) fn group_count(&self) -> usize {
-        self.coordinator.groups.len()
-    }
-
-    pub(crate) async fn consult(
-        &self,
-        claim_id: &str,
-    ) -> Result<Arc<RuntimeRelayConsultationResult>, RelayClientError> {
-        let key = self
-            .keys_by_claim
-            .get(claim_id)
-            .ok_or(RelayClientError::InvalidRequest)?;
-        let result = self
-            .coordinator
-            .consult_with_child(key, self.child_identities.get(key))
-            .await?;
-        self.audit
-            .record_relay_consultation(result.consultation_id());
-        Ok(result)
-    }
-}
-
-impl fmt::Debug for RequestScopedRelayPlan {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("RequestScopedRelayPlan")
-            .field("keys_by_claim", &"[REDACTED]")
-            .field("coordinator", &self.coordinator)
-            .field("audit", &"[REDACTED]")
-            .finish()
-    }
-}
-
-fn valid_principal_id(value: &str) -> bool {
-    !value.is_empty()
-        && value.len() <= MAX_PRINCIPAL_ID_BYTES
-        && value.chars().all(|character| !character.is_control())
-}
-
-fn valid_scope(value: &str) -> bool {
-    !value.is_empty()
-        && value.len() <= 128
-        && value
-            .bytes()
-            .all(|byte| matches!(byte, b'!' | b'#'..=b'[' | b']'..=b'~'))
-}
-
-fn stable_id(value: &str, max_bytes: usize) -> bool {
-    let mut bytes = value.bytes();
-    matches!(bytes.next(), Some(b'a'..=b'z'))
-        && value.len() <= max_bytes
-        && bytes.all(|byte| matches!(byte, b'a'..=b'z' | b'0'..=b'9' | b'.' | b'_' | b'-'))
-}
-
-fn input_name(value: &str, max_bytes: usize) -> bool {
-    let mut bytes = value.bytes();
-    matches!(bytes.next(), Some(b'a'..=b'z'))
-        && value.len() <= max_bytes
-        && bytes.all(|byte| matches!(byte, b'a'..=b'z' | b'0'..=b'9' | b'_'))
-}
-
-fn sha256_uri(value: &str) -> bool {
-    value.strip_prefix("sha256:").is_some_and(|digest| {
-        digest.len() == 64
-            && digest
-                .bytes()
-                .all(|byte| byte.is_ascii_digit() || matches!(byte, b'a'..=b'f'))
-    })
-}
-
-fn valid_purpose(value: &str) -> bool {
-    !value.is_empty()
-        && value.len() <= MAX_PURPOSE_BYTES
-        && !value.contains(',')
-        && value
-            .chars()
-            .all(|character| !character.is_control() && !character.is_whitespace())
-}
-
-fn valid_canonical_inputs(inputs: &BTreeMap<String, Zeroizing<String>>) -> bool {
-    (1..=MAX_CONSULTATION_INPUTS_V1).contains(&inputs.len())
-        && inputs.iter().all(|(name, value)| {
-            input_name(name, MAX_INPUT_NAME_BYTES)
-                && !value.is_empty()
-                && value.len() <= MAX_INPUT_VALUE_BYTES
-                && value.chars().all(|character| !character.is_control())
-        })
-}
-
-#[cfg(test)]
-mod tests {
-    use std::sync::atomic::{AtomicUsize, Ordering};
-    use std::time::Duration;
-
-    use super::*;
-
-    const CONTRACT_HASH: &str =
-        "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
-    const OTHER_CONTRACT_HASH: &str =
-        "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
-    const TARGET_VALUE: &str = "target-value-SENSITIVE";
-    const OUTPUT_VALUE: &str = "registry-value-SENSITIVE";
-
-    fn canonical_inputs(name: &str, value: &str) -> BTreeMap<String, Zeroizing<String>> {
-        BTreeMap::from([(name.to_string(), Zeroizing::new(value.to_string()))])
-    }
-
-    fn canonical_inputs_with_count(count: usize) -> BTreeMap<String, Zeroizing<String>> {
-        (0..count)
-            .map(|index| {
-                (
-                    format!("input_{index}"),
-                    Zeroizing::new(format!("value-{index}")),
-                )
-            })
-            .collect()
-    }
-
-    #[test]
-    fn canonical_inputs_accept_sixteen_and_reject_seventeen() {
-        assert!(valid_canonical_inputs(&canonical_inputs_with_count(16)));
-        assert!(!valid_canonical_inputs(&canonical_inputs_with_count(17)));
-    }
-
-    fn group_key(evaluation_random: u128) -> ConsultationGroupKeyV1 {
-        group_key_with_scopes(
-            evaluation_random,
-            vec![
-                "registry:scope:z".to_string(),
-                "registry:scope:a".to_string(),
-            ],
-        )
-    }
-
-    fn group_key_with_scopes(
-        evaluation_random: u128,
-        scopes: Vec<String>,
-    ) -> ConsultationGroupKeyV1 {
-        ConsultationGroupKeyV1::new(
-            Ulid::from_parts(1, evaluation_random),
-            EvidenceAuthProfileId::StaticApiKey,
-            "principal-SENSITIVE".to_string(),
-            scopes,
-            "example.person-status.exact",
-            CONTRACT_HASH,
-            "benefit-verification",
-            canonical_inputs("subject_id", TARGET_VALUE),
-        )
-        .expect("valid group key")
-    }
-
-    fn success_result() -> RuntimeRelayConsultationResult {
-        RuntimeRelayConsultationResult::new(
-            Ulid::from_parts(2, 1),
-            RuntimeRelayOutcome::Match,
-            Some(RuntimeRelayMatchData::OutputMap(
-                RuntimeRelayOutputMap::from_json(BTreeMap::from([(
-                    "registration_status".to_string(),
-                    Value::String(OUTPUT_VALUE.to_string()),
-                )]))
-                .expect("valid output map"),
-            )),
-            OffsetDateTime::UNIX_EPOCH,
-        )
-        .expect("valid result")
-    }
-
-    #[derive(Debug)]
-    struct CountingActivated {
-        calls: AtomicUsize,
-        readiness_checks: AtomicUsize,
-        failure: Option<RelayClientError>,
-        delay: Duration,
-    }
-
-    impl CountingActivated {
-        fn success() -> Self {
-            Self {
-                calls: AtomicUsize::new(0),
-                readiness_checks: AtomicUsize::new(0),
-                failure: None,
-                delay: Duration::from_millis(20),
-            }
-        }
-
-        fn failure(error: RelayClientError) -> Self {
-            Self {
-                calls: AtomicUsize::new(0),
-                readiness_checks: AtomicUsize::new(0),
-                failure: Some(error),
-                delay: Duration::from_millis(20),
-            }
-        }
-
-        fn calls(&self) -> usize {
-            self.calls.load(Ordering::SeqCst)
-        }
-
-        fn readiness_checks(&self) -> usize {
-            self.readiness_checks.load(Ordering::SeqCst)
-        }
-    }
-
-    #[async_trait::async_trait]
-    impl ActivatedRelayConsultations for CountingActivated {
-        async fn check_ready(&self) -> Result<(), RelayClientError> {
-            self.readiness_checks.fetch_add(1, Ordering::SeqCst);
-            self.failure.map_or(Ok(()), Err)
-        }
-
-        fn validate(&self, _key: &ConsultationGroupKeyV1) -> Result<(), RelayClientError> {
-            Ok(())
-        }
-
-        async fn execute(
-            &self,
-            _key: &ConsultationGroupKeyV1,
-        ) -> Result<RuntimeRelayConsultationResult, RelayClientError> {
-            self.calls.fetch_add(1, Ordering::SeqCst);
-            tokio::time::sleep(self.delay).await;
-            match self.failure {
-                Some(error) => Err(error),
-                None => Ok(success_result()),
-            }
-        }
-    }
-
-    #[derive(Debug)]
-    struct RejectingActivated;
-
-    #[async_trait::async_trait]
-    impl ActivatedRelayConsultations for RejectingActivated {
-        async fn check_ready(&self) -> Result<(), RelayClientError> {
-            Ok(())
-        }
-
-        fn validate(&self, _key: &ConsultationGroupKeyV1) -> Result<(), RelayClientError> {
-            Err(RelayClientError::InvalidRequest)
-        }
-
-        async fn execute(
-            &self,
-            _key: &ConsultationGroupKeyV1,
-        ) -> Result<RuntimeRelayConsultationResult, RelayClientError> {
-            panic!("a locally invalid consultation must never execute")
-        }
-    }
-
-    fn coordinator(
-        keys: Vec<ConsultationGroupKeyV1>,
-        activated: &Arc<CountingActivated>,
-    ) -> RequestScopedConsultationCoordinator {
-        let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-        let audit = Arc::new(EvaluationAuditCollector::new());
-        audit.begin_evaluation();
-        RequestScopedConsultationCoordinator::new(keys, bound, audit).expect("valid coordinator")
-    }
-
-    #[test]
-    fn local_profile_input_rejection_precedes_forward_audit_and_execution() {
-        let audit = Arc::new(EvaluationAuditCollector::new());
-        audit.begin_evaluation();
-        let activated: Arc<dyn ActivatedRelayConsultations> = Arc::new(RejectingActivated);
-
-        let error = RequestScopedRelayPlan::new(
-            [("claim".to_string(), group_key(1))],
-            activated,
-            Arc::clone(&audit),
-        )
-        .expect_err("profile-specific input rejection must fail during request planning");
-
-        assert_eq!(error, ConsultationPlanError::InvalidGroupKey);
-        assert_eq!(audit.snapshot().relay_forwarded_count(), 0);
-    }
-
-    #[tokio::test]
-    async fn concurrent_identical_keys_execute_once_and_share_success() {
-        let key = group_key(1);
-        assert_eq!(key.auth_profile_id(), EvidenceAuthProfileId::StaticApiKey);
-        assert_eq!(key.principal_id(), "principal-SENSITIVE");
-        assert_eq!(
-            key.checked_scopes_sorted(),
-            ["registry:scope:a", "registry:scope:z"]
-        );
-        assert_eq!(key.profile_id(), "example.person-status.exact");
-        assert_eq!(key.profile_contract_hash(), CONTRACT_HASH);
-        assert_eq!(key.canonical_purpose(), "benefit-verification");
-        assert_eq!(key.canonical_inputs()["subject_id"].as_str(), TARGET_VALUE);
-        let activated = Arc::new(CountingActivated::success());
-        let coordinator = coordinator(vec![key.clone()], &activated);
-
-        let (left, right) = tokio::join!(coordinator.consult(&key), coordinator.consult(&key));
-        let left = left.expect("first consultation succeeds");
-        let right = right.expect("second consultation succeeds");
-
-        assert_eq!(activated.calls(), 1);
-        assert!(Arc::ptr_eq(&left, &right));
-        assert_eq!(left.outcome(), RuntimeRelayOutcome::Match);
-        assert_eq!(
-            left.outputs().expect("match outputs").to_json_object(),
-            serde_json::json!({"registration_status": OUTPUT_VALUE})
-                .as_object()
-                .unwrap()
-                .clone()
-        );
-    }
-
-    #[tokio::test]
-    async fn concurrent_identical_keys_execute_once_and_share_failure() {
-        let key = group_key(1);
-        let activated = Arc::new(CountingActivated::failure(RelayClientError::Denied));
-        let coordinator = coordinator(vec![key.clone()], &activated);
-
-        let (left, right) = tokio::join!(coordinator.consult(&key), coordinator.consult(&key));
-
-        assert!(matches!(left, Err(RelayClientError::Denied)));
-        assert!(matches!(right, Err(RelayClientError::Denied)));
-        assert_eq!(activated.calls(), 1);
-    }
-
-    #[tokio::test]
-    async fn cancelling_first_waiter_does_not_repeat_dispatched_consultation() {
-        let key = group_key(1);
-        let activated = Arc::new(CountingActivated {
-            calls: AtomicUsize::new(0),
-            readiness_checks: AtomicUsize::new(0),
-            failure: None,
-            delay: Duration::from_millis(100),
-        });
-        let coordinator = Arc::new(coordinator(vec![key.clone()], &activated));
-        let first = tokio::spawn({
-            let coordinator = Arc::clone(&coordinator);
-            let key = key.clone();
-            async move { coordinator.consult(&key).await }
-        });
-
-        tokio::time::timeout(Duration::from_secs(1), async {
-            while activated.calls() == 0 {
-                tokio::task::yield_now().await;
-            }
-        })
-        .await
-        .expect("the first consultation is dispatched");
-        first.abort();
-        let _ = first.await;
-
-        coordinator
-            .consult(&key)
-            .await
-            .expect("a later waiter receives the original result");
-        assert_eq!(activated.calls(), 1);
-    }
-
-    #[tokio::test]
-    async fn later_waiter_records_original_id_after_first_waiter_is_cancelled() {
-        let audit = Arc::new(EvaluationAuditCollector::new());
-        let evaluation_id = audit.begin_evaluation();
-        let mut key = group_key(1);
-        key.evaluation_id = evaluation_id;
-        let activated = Arc::new(CountingActivated {
-            calls: AtomicUsize::new(0),
-            readiness_checks: AtomicUsize::new(0),
-            failure: None,
-            delay: Duration::from_millis(100),
-        });
-        let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-        let plan = Arc::new(
-            RequestScopedRelayPlan::new([("claim".to_string(), key)], bound, Arc::clone(&audit))
-                .expect("valid Relay plan"),
-        );
-        let first = tokio::spawn({
-            let plan = Arc::clone(&plan);
-            async move { plan.consult("claim").await }
-        });
-
-        tokio::time::timeout(Duration::from_secs(1), async {
-            while activated.calls() == 0 {
-                tokio::task::yield_now().await;
-            }
-        })
-        .await
-        .expect("the first consultation is dispatched");
-        let in_flight = audit.snapshot();
-        assert_eq!(in_flight.relay_forwarded_count(), 1);
-        assert!(in_flight.relay_consultation_ids.is_empty());
-        first.abort();
-        let _ = first.await;
-
-        plan.consult("claim")
-            .await
-            .expect("a later waiter receives the original result");
-        let completed = audit.snapshot();
-        assert_eq!(completed.relay_forwarded_count(), 1);
-        let (recorded_evaluation_id, consultation_ids) = completed.into_parts();
-        assert_eq!(recorded_evaluation_id, Some(evaluation_id.to_string()));
-        assert_eq!(consultation_ids, vec![Ulid::from_parts(2, 1).to_string()]);
-        assert_eq!(activated.calls(), 1);
-    }
-
-    #[tokio::test]
-    async fn new_coordinator_and_new_evaluation_execute_again() {
-        let key = group_key(1);
-        let activated = Arc::new(CountingActivated::success());
-        let first = coordinator(vec![key.clone()], &activated);
-        first.consult(&key).await.expect("first request succeeds");
-
-        let second = coordinator(vec![key.clone()], &activated);
-        second.consult(&key).await.expect("second request succeeds");
-
-        let next_evaluation = group_key(2);
-        let third = coordinator(vec![next_evaluation.clone()], &activated);
-        third
-            .consult(&next_evaluation)
-            .await
-            .expect("next evaluation succeeds");
-
-        assert_eq!(activated.calls(), 3);
-    }
-
-    #[tokio::test]
-    async fn every_group_key_field_mismatch_executes_separately() {
-        let base = group_key(1);
-        let mut keys = vec![base.clone()];
-
-        let mut mismatch = base.clone();
-        mismatch.evaluation_id = Ulid::from_parts(1, 2);
-        keys.push(mismatch);
-
-        let mut mismatch = base.clone();
-        mismatch.auth_profile_id = EvidenceAuthProfileId::ExternalOidc;
-        keys.push(mismatch);
-
-        let mut mismatch = base.clone();
-        mismatch.principal_id = Zeroizing::new("other-principal".to_string());
-        keys.push(mismatch);
-
-        let mut mismatch = base.clone();
-        mismatch.checked_scopes_sorted =
-            vec!["registry:scope:other".to_string()].into_boxed_slice();
-        keys.push(mismatch);
-
-        let mut mismatch = base.clone();
-        mismatch.profile_id = "other.person-status.exact".into();
-        keys.push(mismatch);
-
-        let mut mismatch = base.clone();
-        mismatch.profile_contract_hash = OTHER_CONTRACT_HASH.into();
-        keys.push(mismatch);
-
-        let mut mismatch = base.clone();
-        mismatch.canonical_purpose = "other-verification".into();
-        keys.push(mismatch);
-
-        let mut mismatch = base.clone();
-        mismatch.canonical_inputs = canonical_inputs("person_id", TARGET_VALUE);
-        keys.push(mismatch);
-
-        let mut mismatch = base.clone();
-        mismatch.canonical_inputs = canonical_inputs("subject_id", "different-target");
-        keys.push(mismatch);
-
-        let mut mismatch = base.clone();
-        mismatch.expected_result = RuntimeRelayExpectedResult::output_map(BTreeMap::from([(
-            "other_registration_status".to_string(),
-            RelayOutputContract::String {
-                nullable: true,
-                max_bytes: 64,
-            },
-        )]))
-        .unwrap();
-        assert!(base == mismatch, "result decoding is not a group-key field");
-
-        let mut mismatch = base.clone();
-        mismatch.canonical_inputs.insert(
-            "birth_date".to_string(),
-            Zeroizing::new("2000-01-02".to_string()),
-        );
-        keys.push(mismatch);
-
-        let canonical_scope_order = group_key_with_scopes(
-            1,
-            vec![
-                "registry:scope:a".to_string(),
-                "registry:scope:z".to_string(),
-            ],
-        );
-        assert!(base == canonical_scope_order);
-
-        let activated = Arc::new(CountingActivated::success());
-        let coordinator = coordinator(keys.clone(), &activated);
-        for key in &keys {
-            coordinator
-                .consult(key)
-                .await
-                .expect("consultation succeeds");
-        }
-        assert_eq!(activated.calls(), keys.len());
-
-        coordinator
-            .consult(&base)
-            .await
-            .expect("base result remains coalesced");
-        assert_eq!(activated.calls(), keys.len());
-    }
-
-    #[test]
-    fn batch_child_identity_is_canonical_position_bound_and_redacted() {
-        let base = group_key_with_scopes(
-            1,
-            vec![
-                "registry:scope:z".to_string(),
-                "registry:scope:a".to_string(),
-            ],
-        );
-        let reordered = group_key_with_scopes(
-            2,
-            vec![
-                "registry:scope:a".to_string(),
-                "registry:scope:z".to_string(),
-            ],
-        );
-        let first = BatchChildIdentityV1::derive("outer-key", 3, &base)
-            .expect("first child identity derives");
-        let canonical_repeat = BatchChildIdentityV1::derive("outer-key", 3, &reordered)
-            .expect("canonical repeat derives");
-        let next_position = BatchChildIdentityV1::derive("outer-key", 4, &base)
-            .expect("next-position child identity derives");
-        let next_outer = BatchChildIdentityV1::derive("other-outer-key", 3, &base)
-            .expect("next-outer child identity derives");
-
-        assert_eq!(first, canonical_repeat);
-        assert_ne!(first, next_position);
-        assert_ne!(first, next_outer);
-        assert_eq!(first.as_str().len(), 43);
-        let debug = format!("{first:?}");
-        assert_eq!(debug, "BatchChildIdentityV1([REDACTED])");
-        assert!(!debug.contains(TARGET_VALUE));
-        assert_eq!(
-            format!("{:?}", BatchConsultationGroupCommitmentV1 { key: &base }),
-            "BatchConsultationGroupCommitmentV1([REDACTED])"
-        );
-    }
-
-    #[test]
-    fn batch_child_identity_changes_for_each_canonical_input_field() {
-        let base = group_key(1);
-        let base_child = BatchChildIdentityV1::derive("outer-key", 0, &base)
-            .expect("base child identity derives");
-        let mut changed_name = base.clone();
-        changed_name.canonical_inputs = canonical_inputs("person_id", TARGET_VALUE);
-        let mut changed_value = base.clone();
-        changed_value.canonical_inputs = canonical_inputs("subject_id", "other-target");
-        let mut added_input = base.clone();
-        added_input.canonical_inputs.insert(
-            "birth_date".to_string(),
-            Zeroizing::new("2000-01-02".to_string()),
-        );
-
-        for changed in [changed_name, changed_value, added_input] {
-            assert_ne!(
-                base_child,
-                BatchChildIdentityV1::derive("outer-key", 0, &changed)
-                    .expect("changed child identity derives")
-            );
-        }
-    }
-
-    #[tokio::test]
-    async fn activated_client_set_dispatches_each_exact_selection_independently() {
-        let first_key = group_key(1);
-        let mut second_key = group_key(1);
-        second_key.profile_id = "example.other-status.exact".into();
-        second_key.canonical_purpose = "other-verification".into();
-
-        let first = Arc::new(CountingActivated::success());
-        let second = Arc::new(CountingActivated::success());
-        let first_bound: Arc<dyn ActivatedRelayConsultations> = first.clone();
-        let second_bound: Arc<dyn ActivatedRelayConsultations> = second.clone();
-        let clients = Arc::new(
-            ActivatedRelayClientSet::new([
-                (RelayClientSelectionV1::from_key(&first_key), first_bound),
-                (RelayClientSelectionV1::from_key(&second_key), second_bound),
-            ])
-            .expect("two exact clients activate"),
-        );
-        let bound: Arc<dyn ActivatedRelayConsultations> = clients;
-        bound
-            .check_ready()
-            .await
-            .expect("every exact client remains ready");
-        let audit = Arc::new(EvaluationAuditCollector::new());
-        audit.begin_evaluation();
-        let coordinator = RequestScopedConsultationCoordinator::new(
-            [first_key.clone(), second_key.clone()],
-            bound,
-            audit,
-        )
-        .expect("both selections are preplanned");
-
-        coordinator
-            .consult(&first_key)
-            .await
-            .expect("first selection executes");
-        coordinator
-            .consult(&second_key)
-            .await
-            .expect("second selection executes");
-
-        assert_eq!(first.calls(), 1);
-        assert_eq!(second.calls(), 1);
-        assert_eq!(first.readiness_checks(), 1);
-        assert_eq!(second.readiness_checks(), 1);
-    }
-
-    #[tokio::test]
-    async fn activated_client_set_keeps_readiness_and_dispatch_per_profile() {
-        let ready_key = group_key(1);
-        let mut unavailable_key = group_key(2);
-        unavailable_key.profile_id = "example.snapshot-status.exact".into();
-
-        let ready = Arc::new(CountingActivated::success());
-        let unavailable = Arc::new(CountingActivated::failure(RelayClientError::Unavailable));
-        let ready_bound: Arc<dyn ActivatedRelayConsultations> = ready.clone();
-        let unavailable_bound: Arc<dyn ActivatedRelayConsultations> = unavailable.clone();
-        let clients = ActivatedRelayClientSet::new([
-            (RelayClientSelectionV1::from_key(&ready_key), ready_bound),
-            (
-                RelayClientSelectionV1::from_key(&unavailable_key),
-                unavailable_bound,
-            ),
-        ])
-        .expect("two exact clients remain independently addressable");
-
-        let readiness = clients.readiness().await;
-        assert_eq!(readiness.total(), 2);
-        assert_eq!(readiness.ready(), 1);
-        assert_eq!(readiness.failed(), 1);
-        assert!(!readiness.is_ready());
-
-        clients
-            .execute(&ready_key)
-            .await
-            .expect("the unrelated ready profile still executes");
-        assert_eq!(ready.calls(), 1);
-        assert_eq!(
-            clients
-                .execute(&unavailable_key)
-                .await
-                .expect_err("the unavailable profile fails closed"),
-            RelayClientError::Unavailable
-        );
-        assert_eq!(unavailable.calls(), 1);
-    }
-
-    #[test]
-    fn more_than_sixteen_preplanned_groups_is_rejected() {
-        let base = group_key(1);
-        let keys = (0..=MAX_CONSULTATION_GROUPS_V1)
-            .map(|index| {
-                let mut key = base.clone();
-                key.profile_id = format!("example.profile-{index}").into();
-                key
-            })
-            .collect::<Vec<_>>();
-        let activated: Arc<dyn ActivatedRelayConsultations> =
-            Arc::new(CountingActivated::success());
-        let audit = Arc::new(EvaluationAuditCollector::new());
-        audit.begin_evaluation();
-
-        let error = RequestScopedConsultationCoordinator::new(keys, activated, audit)
-            .expect_err("17 distinct groups must be rejected");
-
-        assert_eq!(error, ConsultationPlanError::TooManyGroups);
-    }
-
-    #[test]
-    fn checked_scope_bound_applies_after_canonical_deduplication() {
-        let duplicates = vec!["registry:scope:a".to_string(); MAX_CHECKED_SCOPES_V1 + 1];
-        let canonical = group_key_with_scopes(1, duplicates);
-        assert_eq!(canonical.checked_scopes_sorted(), ["registry:scope:a"]);
-
-        let distinct = (0..=MAX_CHECKED_SCOPES_V1)
-            .map(|index| format!("registry:scope:{index}"))
-            .collect();
-        let error = match ConsultationGroupKeyV1::new(
-            Ulid::from_parts(1, 1),
-            EvidenceAuthProfileId::StaticApiKey,
-            "principal-SENSITIVE".to_string(),
-            distinct,
-            "example.person-status.exact",
-            CONTRACT_HASH,
-            "benefit-verification",
-            canonical_inputs("subject_id", TARGET_VALUE),
-        ) {
-            Ok(_) => panic!("more than sixteen distinct scopes must be rejected"),
-            Err(error) => error,
-        };
-        assert_eq!(error, ConsultationPlanError::InvalidGroupKey);
-    }
-
-    #[tokio::test]
-    async fn execution_cannot_insert_an_unplanned_group() {
-        let planned = group_key(1);
-        let unplanned = group_key(2);
-        let activated = Arc::new(CountingActivated::success());
-        let coordinator = coordinator(vec![planned], &activated);
-
-        let error = coordinator
-            .consult(&unplanned)
-            .await
-            .expect_err("unplanned keys cannot be inserted dynamically");
-
-        assert_eq!(error, RelayClientError::InvalidRequest);
-        assert_eq!(activated.calls(), 0);
-        assert_eq!(coordinator.len(), 1);
-        assert!(!coordinator.is_empty());
-    }
-
-    #[test]
-    fn result_shape_is_sealed_output_map_or_no_match_data() {
-        RuntimeRelayConsultationResult::new(
-            Ulid::from_parts(2, 1),
-            RuntimeRelayOutcome::Match,
-            None,
-            OffsetDateTime::UNIX_EPOCH,
-        )
-        .expect_err("match requires one output");
-
-        let outputs = RuntimeRelayConsultationResult::new(
-            Ulid::from_parts(2, 1),
-            RuntimeRelayOutcome::Match,
-            Some(RuntimeRelayMatchData::OutputMap(RuntimeRelayOutputMap {
-                fields: BTreeMap::from([("exists".into(), RuntimeRelayOutputValue::Boolean(true))]),
-            })),
-            OffsetDateTime::UNIX_EPOCH,
-        )
-        .expect("typed output map is explicit match data");
-        assert_eq!(
-            Value::Object(outputs.outputs().unwrap().to_json_object()),
-            serde_json::json!({"exists": true})
-        );
-
-        RuntimeRelayConsultationResult::new(
-            Ulid::from_parts(2, 1),
-            RuntimeRelayOutcome::NoMatch,
-            Some(RuntimeRelayMatchData::OutputMap(RuntimeRelayOutputMap {
-                fields: BTreeMap::from([(
-                    "status".into(),
-                    RuntimeRelayOutputValue::String(Zeroizing::new("value".to_string())),
-                )]),
-            })),
-            OffsetDateTime::UNIX_EPOCH,
-        )
-        .expect_err("no_match cannot release output");
-
-        let no_match = RuntimeRelayConsultationResult::new(
-            Ulid::from_parts(2, 1),
-            RuntimeRelayOutcome::NoMatch,
-            None,
-            OffsetDateTime::UNIX_EPOCH,
-        )
-        .expect("no_match without output is valid");
-        assert!(no_match.outputs().is_none());
-
-        let ambiguous = RuntimeRelayConsultationResult::new(
-            Ulid::from_parts(2, 1),
-            RuntimeRelayOutcome::Ambiguous,
-            None,
-            OffsetDateTime::UNIX_EPOCH,
-        )
-        .expect("ambiguous without output is valid");
-        assert_eq!(ambiguous.outcome(), RuntimeRelayOutcome::Ambiguous);
-    }
-
-    #[test]
-    fn debug_output_is_value_free_and_redacted() {
-        let key = group_key(1);
-        let activated = Arc::new(CountingActivated::success());
-        let coordinator = coordinator(vec![key.clone()], &activated);
-        let result = success_result();
-        let outputs = result.outputs().expect("match outputs");
-
-        let rendered = format!(
-            "{coordinator:?} {result:?} {outputs:?} {:?}",
-            RuntimeRelayOutcome::Match
-        );
-        let evaluation_id = key.evaluation_id().to_string();
-        let consultation_id = result.consultation_id().to_string();
-        let acquired_at = result.acquired_at().to_string();
-        for sensitive in [
-            "principal-SENSITIVE",
-            TARGET_VALUE,
-            OUTPUT_VALUE,
-            "registration_status",
-            CONTRACT_HASH,
-            "benefit-verification",
-            evaluation_id.as_str(),
-            consultation_id.as_str(),
-            acquired_at.as_str(),
-        ] {
-            assert!(!rendered.contains(sensitive), "leaked debug value");
-        }
-        assert!(!rendered.contains("Match"));
-        assert!(rendered.contains("[REDACTED]"));
-    }
-}
diff --git a/crates/registry-notary-server/src/runtime/disclosure.rs b/crates/registry-notary-server/src/runtime/disclosure.rs
deleted file mode 100644
index b85eeb997..000000000
--- a/crates/registry-notary-server/src/runtime/disclosure.rs
+++ /dev/null
@@ -1,126 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-
-pub(super) fn supports_object_field_redaction(
-    claim_value_type: &str,
-    redaction_fields: &BTreeSet<String>,
-) -> bool {
-    claim_value_type == "object"
-        && !redaction_fields.is_empty()
-        && redaction_fields
-            .iter()
-            .all(|field| is_top_level_redaction_field(field))
-}
-
-pub(super) fn is_top_level_redaction_field(field: &str) -> bool {
-    !field.is_empty()
-        && field != "value"
-        && !field.contains('.')
-        && !field.contains('[')
-        && !field.contains(']')
-}
-
-pub(super) fn redact_object_fields(
-    value: &Value,
-    redaction_fields: &BTreeSet<String>,
-) -> Result<Option<Value>, EvidenceError> {
-    let Some(mut object) = value.as_object().cloned() else {
-        return Ok(None);
-    };
-    for field in redaction_fields {
-        if object.remove(field).is_none() {
-            return Err(EvidenceError::DisclosureNotAllowed);
-        }
-    }
-    Ok(Some(Value::Object(object)))
-}
-
-pub(super) fn view_claim(
-    subject_access_rate_keys: &SubjectAccessRateLimitKeys,
-    result: &ClaimResultInternal,
-    claim: &ClaimDefinition,
-    disclosure: DisclosureProfile,
-    format: &str,
-) -> Result<ClaimResultView, EvidenceError> {
-    let mut effective_disclosure = disclosure;
-    let field_redaction =
-        supports_object_field_redaction(claim.value.value_type.as_str(), &result.redaction_fields);
-    let forced_redaction = !result.redaction_fields.is_empty()
-        && effective_disclosure == DisclosureProfile::Value
-        && !field_redaction;
-    if forced_redaction {
-        effective_disclosure = DisclosureProfile::Redacted;
-    }
-    let allowed = claim
-        .disclosure
-        .allowed
-        .iter()
-        .any(|candidate| candidate == effective_disclosure.as_str());
-    if !allowed {
-        if forced_redaction {
-            return Err(EvidenceError::DisclosureNotAllowed);
-        }
-        effective_disclosure = match DisclosureDowngrade::parse(&claim.disclosure.downgrade)
-            .ok_or(EvidenceError::InvalidRequest)?
-        {
-            DisclosureDowngrade::Default => DisclosureProfile::parse(&claim.disclosure.default)
-                .ok_or(EvidenceError::InvalidRequest)?,
-            DisclosureDowngrade::Redacted => DisclosureProfile::Redacted,
-            DisclosureDowngrade::Deny => return Err(EvidenceError::DisclosureNotAllowed),
-        };
-        if !claim
-            .disclosure
-            .allowed
-            .iter()
-            .any(|candidate| candidate == effective_disclosure.as_str())
-        {
-            return Err(EvidenceError::DisclosureNotAllowed);
-        }
-    }
-    if effective_disclosure == DisclosureProfile::Predicate && !result.redaction_fields.is_empty() {
-        return Err(EvidenceError::DisclosureNotAllowed);
-    }
-    let value = match effective_disclosure {
-        DisclosureProfile::Value if field_redaction => {
-            redact_object_fields(&result.value, &result.redaction_fields)?
-        }
-        DisclosureProfile::Value => Some(result.value.clone()),
-        DisclosureProfile::Predicate => result.value.as_bool().map(Value::Bool),
-        DisclosureProfile::Redacted => None,
-    };
-    let satisfied = match effective_disclosure {
-        DisclosureProfile::Value | DisclosureProfile::Predicate => result.value.as_bool(),
-        DisclosureProfile::Redacted => None,
-    };
-    Ok(ClaimResultView {
-        evaluation_id: result.evaluation_id.clone(),
-        claim_id: result.claim_id.clone(),
-        claim_version: result.claim_version.clone(),
-        subject_type: result.subject_type.clone(),
-        requester_ref: result
-            .requester
-            .as_ref()
-            .map(|requester| entity_ref_view(subject_access_rate_keys, "requester", requester))
-            .transpose()?,
-        target_ref: target_ref_view(subject_access_rate_keys, &result.target)?,
-        value,
-        satisfied,
-        disclosure: effective_disclosure.as_str().to_string(),
-        redacted_fields: if field_redaction {
-            result.redaction_fields.iter().cloned().collect()
-        } else if effective_disclosure == DisclosureProfile::Redacted {
-            if result.redaction_fields.is_empty() {
-                vec![result.claim_id.clone()]
-            } else {
-                result.redaction_fields.iter().cloned().collect()
-            }
-        } else {
-            Vec::new()
-        },
-        format: format.to_string(),
-        issued_at: format_time(result.issued_at),
-        expires_at: result.expires_at.map(format_time),
-        provenance: result.provenance.clone(),
-    })
-}
diff --git a/crates/registry-notary-server/src/runtime/evaluation.rs b/crates/registry-notary-server/src/runtime/evaluation.rs
deleted file mode 100644
index f530180e8..000000000
--- a/crates/registry-notary-server/src/runtime/evaluation.rs
+++ /dev/null
@@ -1,1799 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::cel::*;
-use super::*;
-
-#[derive(Debug, Clone)]
-pub struct RegistryNotaryRuntime {
-    subject_access_rate_keys: Arc<SubjectAccessRateLimitKeys>,
-    activated_relay: Option<Arc<dyn ActivatedRelayConsultations>>,
-    #[cfg(feature = "registry-notary-cel")]
-    cel_worker: Option<Arc<CelWorker>>,
-    #[cfg(feature = "registry-notary-cel")]
-    cel_config: Arc<RegistryNotaryCelConfig>,
-}
-
-struct PreparedRegistryBatchItem {
-    input_index: usize,
-    request: EvaluateRequest,
-    context: EvidenceRequestContext,
-    purpose: String,
-    claim_versions: ClaimVersionSelections,
-    levels: Vec<Vec<String>>,
-    disclosure: DisclosureProfile,
-    format: String,
-    evaluation_id: String,
-    relay_plan: Arc<RequestScopedRelayPlan>,
-    audit: Arc<EvaluationAuditCollector>,
-    evaluation_capability: EvaluationCapability,
-}
-
-struct EvaluatedRegistryClaims {
-    views: Vec<ClaimResultView>,
-    issuance_provenance: Option<StoredIssuanceProvenance>,
-}
-
-fn clear_batch_runtime_audit(response: &mut BatchEvaluateResponse) {
-    for item in &mut response.items {
-        item.runtime_audit = Default::default();
-    }
-}
-
-impl Default for RegistryNotaryRuntime {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl RegistryNotaryRuntime {
-    #[must_use]
-    pub fn new() -> Self {
-        Self::new_with_audit_hasher(AuditKeyHasher::unkeyed_dev_only())
-    }
-
-    #[must_use]
-    pub fn new_with_audit_hasher(audit_hasher: AuditKeyHasher) -> Self {
-        Self::new_with_subject_access_rate_keys(Arc::new(SubjectAccessRateLimitKeys::new(
-            audit_hasher,
-        )))
-    }
-
-    #[must_use]
-    pub fn new_with_subject_access_rate_keys(
-        subject_access_rate_keys: Arc<SubjectAccessRateLimitKeys>,
-    ) -> Self {
-        Self {
-            subject_access_rate_keys,
-            activated_relay: None,
-            #[cfg(feature = "registry-notary-cel")]
-            cel_worker: None,
-            #[cfg(feature = "registry-notary-cel")]
-            cel_config: Arc::new(RegistryNotaryCelConfig::default()),
-        }
-    }
-
-    #[must_use]
-    pub(crate) fn with_activated_relay(
-        mut self,
-        activated_relay: Option<Arc<dyn ActivatedRelayConsultations>>,
-    ) -> Self {
-        self.activated_relay = activated_relay;
-        self
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    #[must_use]
-    pub fn with_cel_worker(mut self, cel_worker: Option<Arc<CelWorker>>) -> Self {
-        self.cel_worker = cel_worker;
-        self
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    #[must_use]
-    pub fn with_cel_config(mut self, cel_config: Arc<RegistryNotaryCelConfig>) -> Self {
-        self.cel_config = cel_config;
-        self
-    }
-
-    pub fn service_document(evidence: &EvidenceConfig) -> Value {
-        let issuer = evidence
-            .credential_profiles
-            .values()
-            .next()
-            .map(|profile| profile.issuer.as_str())
-            .unwrap_or(evidence.service_id.as_str());
-        json!({
-            "service_id": evidence.service_id,
-            "api_version": evidence.api_version,
-            "base_url": evidence.api_base_url,
-            "issuer": {
-                "id": issuer,
-                "name": evidence.service_id,
-            },
-            "auth": {
-                "methods": ["api_key", "bearer"],
-                "api_key": {
-                    "header": "X-Api-Key",
-                },
-                "bearer": {
-                    "header": "Authorization",
-                    "scheme": "bearer",
-                    "format": "Bearer <token>",
-                },
-                "audience": evidence.service_id,
-            },
-            "operations": {
-                "evaluate": true,
-                "batch_evaluate": true,
-                "render": true,
-                "credential_issue": !evidence.credential_profiles.is_empty()
-            },
-            "claims_url": evidence.claims_url,
-            "formats_url": evidence.formats_url,
-            "credential_capabilities": Self::credential_capabilities(evidence),
-            "batch": {
-                "max_inline_subjects": evidence.inline_batch_limit,
-                "idempotency_window": "PT15M",
-            },
-            "identity": {
-                "mapper": "common_subject_id",
-                "production_mapper": false
-            },
-            "formats": formats(evidence),
-        })
-    }
-
-    fn credential_capabilities(evidence: &EvidenceConfig) -> Value {
-        let signing_algs = Self::credential_signing_algs(evidence);
-        let issuer_key_types = Self::credential_issuer_key_types(&signing_algs);
-        json!({
-            "formats": [FORMAT_SD_JWT_VC],
-            "sd_jwt_vc": {
-                "media_type": FORMAT_SD_JWT_VC,
-                "jwt_typ": SD_JWT_VC_JWT_TYP,
-                "signing_algs": signing_algs,
-                "issuer_key_types": issuer_key_types,
-                "holder_binding_methods": [SD_JWT_VC_HOLDER_BINDING_METHOD],
-                "status_methods": [],
-                "credential_profiles": Self::credential_profile_capabilities(evidence),
-                "openid4vci": {
-                    "support": "not_full_issuer"
-                }
-            },
-            "unsupported_features": [
-                "application/vc+sd-jwt",
-                "json_ld_vc_issuance",
-                "data_integrity_proofs",
-                "credential_status",
-                "delegated_credential_issuance",
-                "mso_mdoc",
-                "openid4vci_full_issuer"
-            ]
-        })
-    }
-
-    fn credential_signing_algs(evidence: &EvidenceConfig) -> Vec<String> {
-        let mut algs = BTreeSet::new();
-        for profile in evidence.credential_profiles.values() {
-            if profile.format != FORMAT_SD_JWT_VC {
-                continue;
-            }
-            if let Some(key) = evidence.signing_keys.get(&profile.signing_key) {
-                algs.insert(key.alg.clone());
-            }
-        }
-        if algs.is_empty() {
-            algs.insert(SD_JWT_VC_SIGNING_ALG.to_string());
-        }
-        algs.into_iter().collect()
-    }
-
-    fn credential_issuer_key_types(signing_algs: &[String]) -> Vec<String> {
-        let mut key_types = BTreeSet::new();
-        for alg in signing_algs {
-            match alg.as_str() {
-                "ES256" => {
-                    key_types.insert(SD_JWT_VC_P256_ISSUER_KEY_TYPE.to_string());
-                }
-                "RS256" => {
-                    key_types.insert(SD_JWT_VC_RSA_ISSUER_KEY_TYPE.to_string());
-                }
-                _ => {
-                    key_types.insert(SD_JWT_VC_ISSUER_KEY_TYPE.to_string());
-                }
-            }
-        }
-        key_types.into_iter().collect()
-    }
-
-    fn credential_profile_capabilities(evidence: &EvidenceConfig) -> Vec<Value> {
-        evidence
-            .credential_profiles
-            .iter()
-            .map(|(profile_id, profile)| {
-                json!({
-                    "id": profile_id,
-                    "format": profile.format.as_str(),
-                    "issuer": profile.issuer.as_str(),
-                    "vct": profile.vct.as_str(),
-                    "validity_seconds": profile.validity_seconds,
-                    "holder_binding": {
-                        "mode": profile.holder_binding.mode.as_str(),
-                        "proof_of_possession": profile.holder_binding.proof_of_possession.as_deref(),
-                        "allowed_did_methods": &profile.holder_binding.allowed_did_methods
-                    },
-                    "allowed_claims": &profile.allowed_claims,
-                    "disclosure": {
-                        "allowed": &profile.disclosure.allowed
-                    },
-                })
-            })
-            .collect()
-    }
-
-    pub fn service_document_with_subject_access(
-        evidence: &EvidenceConfig,
-        subject_access: &SubjectAccessConfig,
-        include_subject_access_details: bool,
-    ) -> Value {
-        let mut document = Self::service_document(evidence);
-        if subject_access.enabled {
-            let mut subject_access_document = json!({
-                "enabled": true,
-            });
-            if include_subject_access_details {
-                subject_access_document = json!({
-                    "enabled": true,
-                    "allowed_operations": subject_access.allowed_operations,
-                    "allowed_claim_ids": subject_access.allowed_claims,
-                    "allowed_formats": subject_access.allowed_formats,
-                    "allowed_disclosures": subject_access.allowed_disclosures,
-                    "credential_profile_ids": subject_access.credential_profiles,
-                    "subject_id_type": subject_access.subject_binding.id_type,
-                    "token_claim_name": subject_access.subject_binding.token_claim,
-                    "scope_policy": subject_access.scope_policy,
-                    "required_scopes": subject_access.required_scopes,
-                    "max_evaluation_age_seconds": subject_access
-                        .token_policy
-                        .max_evaluation_age_seconds,
-                    "max_credential_validity_seconds": subject_access
-                        .token_policy
-                        .max_credential_validity_seconds,
-                });
-            }
-            document["subject_access"] = subject_access_document;
-        }
-        document
-    }
-
-    pub fn list_claims(evidence: &EvidenceConfig, principal: &EvidencePrincipal) -> Vec<Value> {
-        evidence
-            .claims
-            .iter()
-            .filter(|claim| principal_can_see_claim(principal, claim))
-            .map(claim_summary)
-            .collect()
-    }
-
-    pub fn get_claim(
-        evidence: &EvidenceConfig,
-        principal: &EvidencePrincipal,
-        claim_id: &str,
-    ) -> Result<Value, EvidenceError> {
-        let claim = find_claim(evidence, claim_id)?;
-        if !principal_can_see_claim(principal, claim) {
-            return Err(EvidenceError::ClaimNotFound);
-        }
-        Ok(claim_summary(claim))
-    }
-
-    pub fn list_formats(evidence: &EvidenceConfig) -> Vec<EvidenceFormat> {
-        formats(evidence)
-    }
-
-    pub async fn evaluate(
-        &self,
-        evidence: Arc<EvidenceConfig>,
-        store: &EvidenceStore,
-        principal: &EvidencePrincipal,
-        request: EvaluateRequest,
-        header_purpose: Option<&str>,
-    ) -> Result<Vec<ClaimResultView>, EvidenceError> {
-        self.evaluate_with_audit_collector(
-            evidence,
-            store,
-            principal,
-            request,
-            header_purpose,
-            Arc::new(EvaluationAuditCollector::new()),
-        )
-        .await
-    }
-
-    pub(crate) async fn evaluate_for_api(
-        &self,
-        evidence: Arc<EvidenceConfig>,
-        store: &EvidenceStore,
-        principal: &EvidencePrincipal,
-        request: EvaluateRequest,
-        header_purpose: Option<&str>,
-    ) -> (
-        Result<Vec<ClaimResultView>, EvidenceError>,
-        EvaluationAuditSnapshot,
-    ) {
-        let audit = Arc::new(EvaluationAuditCollector::new());
-        let result = self
-            .evaluate_with_audit_collector(
-                evidence,
-                store,
-                principal,
-                request,
-                header_purpose,
-                Arc::clone(&audit),
-            )
-            .await;
-        (result, audit.snapshot())
-    }
-
-    #[allow(clippy::too_many_arguments)]
-    async fn evaluate_with_audit_collector(
-        &self,
-        evidence: Arc<EvidenceConfig>,
-        store: &EvidenceStore,
-        principal: &EvidencePrincipal,
-        request: EvaluateRequest,
-        header_purpose: Option<&str>,
-        audit: Arc<EvaluationAuditCollector>,
-    ) -> Result<Vec<ClaimResultView>, EvidenceError> {
-        let request_claim_ids = claim_ids(&request.claims);
-        let evaluation_capability = evaluation_capability_for_principal(
-            &self.subject_access_rate_keys,
-            principal,
-            &request_claim_ids,
-        )?;
-        self.evaluate_with_capability_and_audit(
-            evidence,
-            store,
-            principal,
-            evaluation_capability,
-            request,
-            header_purpose,
-            None,
-            None,
-            audit,
-        )
-        .await
-    }
-
-    #[allow(clippy::too_many_arguments)]
-    pub async fn evaluate_with_capability(
-        &self,
-        evidence: Arc<EvidenceConfig>,
-        store: &EvidenceStore,
-        principal: &EvidencePrincipal,
-        evaluation_capability: EvaluationCapability,
-        request: EvaluateRequest,
-        header_purpose: Option<&str>,
-        subject_access: Option<StoredSubjectAccessMetadata>,
-        correlation_id: Option<BoundedCorrelationId>,
-    ) -> Result<Vec<ClaimResultView>, EvidenceError> {
-        self.evaluate_with_capability_and_audit(
-            evidence,
-            store,
-            principal,
-            evaluation_capability,
-            request,
-            header_purpose,
-            subject_access,
-            correlation_id,
-            Arc::new(EvaluationAuditCollector::new()),
-        )
-        .await
-    }
-
-    #[allow(clippy::too_many_arguments)]
-    pub(crate) async fn evaluate_with_capability_for_api(
-        &self,
-        evidence: Arc<EvidenceConfig>,
-        store: &EvidenceStore,
-        principal: &EvidencePrincipal,
-        evaluation_capability: EvaluationCapability,
-        request: EvaluateRequest,
-        header_purpose: Option<&str>,
-        subject_access: Option<StoredSubjectAccessMetadata>,
-        correlation_id: Option<BoundedCorrelationId>,
-    ) -> (
-        Result<Vec<ClaimResultView>, EvidenceError>,
-        EvaluationAuditSnapshot,
-    ) {
-        let audit = Arc::new(EvaluationAuditCollector::new());
-        let result = self
-            .evaluate_with_capability_and_audit(
-                evidence,
-                store,
-                principal,
-                evaluation_capability,
-                request,
-                header_purpose,
-                subject_access,
-                correlation_id,
-                Arc::clone(&audit),
-            )
-            .await;
-        (result, audit.snapshot())
-    }
-
-    #[allow(clippy::too_many_arguments)]
-    async fn evaluate_with_capability_and_audit(
-        &self,
-        evidence: Arc<EvidenceConfig>,
-        store: &EvidenceStore,
-        principal: &EvidencePrincipal,
-        evaluation_capability: EvaluationCapability,
-        request: EvaluateRequest,
-        header_purpose: Option<&str>,
-        subject_access: Option<StoredSubjectAccessMetadata>,
-        correlation_id: Option<BoundedCorrelationId>,
-        audit: Arc<EvaluationAuditCollector>,
-    ) -> Result<Vec<ClaimResultView>, EvidenceError> {
-        ensure_evaluation_capability_matches_principal(principal, &evaluation_capability)?;
-        if request.claims.is_empty() {
-            return Err(EvidenceError::InvalidRequest);
-        }
-        let target = request
-            .target
-            .as_ref()
-            .ok_or(EvidenceError::InvalidRequest)?;
-        if !target.has_matching_input() {
-            return Err(EvidenceError::InvalidRequest);
-        }
-        let claim_versions = requested_claim_versions(&request.claims)?;
-        let request_claim_ids = claim_ids(&request.claims);
-        for claim_id in &request.claims {
-            require_evaluation_capability(&evaluation_capability, claim_id)?;
-        }
-        let purpose = resolve_purpose(header_purpose, request.purpose.as_deref())?;
-        require_purpose_allowed(
-            &evidence,
-            &request.claims,
-            &claim_versions,
-            purpose.as_str(),
-        )?;
-        let format = request
-            .format
-            .clone()
-            .unwrap_or_else(|| FORMAT_CLAIM_RESULT_JSON.to_string());
-        for claim_ref in &request.claims {
-            require_claim_format(
-                find_claim_for_selection(&evidence, claim_ref, &claim_versions)?,
-                &format,
-            )?;
-        }
-        let disclosure = requested_disclosure(
-            &evidence,
-            &request.claims,
-            &claim_versions,
-            &request.disclosure,
-        )?;
-        validate_requested_disclosure_before_source(
-            &evidence,
-            &request.claims,
-            &claim_versions,
-            disclosure,
-        )?;
-        let context = request
-            .request_context()
-            .ok_or(EvidenceError::InvalidRequest)?;
-        let levels = delegated_proof_first_levels(
-            build_claim_levels(&evidence, &request.claims, &claim_versions)?,
-            &evaluation_capability,
-        )?;
-        validate_request_variables_before_relay(&evidence, &context, &claim_versions, &levels)?;
-        preflight_claim_closure(
-            &evidence,
-            principal,
-            &evaluation_capability,
-            &claim_versions,
-            &levels,
-            &purpose,
-            self.activated_relay.is_some(),
-        )?;
-        let request_hash = hash_json(&request)?;
-        let evaluation_ulid = audit.begin_evaluation();
-        let evaluation_id = evaluation_ulid.to_string();
-        let relay_evaluation_id =
-            relay_evaluation_id(principal, correlation_id.as_ref(), evaluation_ulid)?;
-        let relay_plan = plan_relay_consultations(
-            &evidence,
-            principal,
-            &context,
-            &claim_versions,
-            &levels,
-            &purpose,
-            relay_evaluation_id,
-            self.activated_relay.as_ref(),
-            Arc::clone(&audit),
-            None,
-            &evaluation_capability,
-        )?;
-        let evaluation_access_mode = evaluation_capability.access_mode();
-        let now = OffsetDateTime::now_utc();
-        #[cfg(feature = "registry-notary-cel")]
-        let cel_concurrency = self
-            .cel_worker
-            .as_ref()
-            .map(|_| Arc::new(Semaphore::new(self.cel_config.worker_count.max(1))));
-        let policy = evaluation_policy_from_subject_access(subject_access.as_ref());
-        let internal = self
-            .evaluate_claims_dag(
-                Arc::clone(&evidence),
-                context,
-                purpose.clone(),
-                evaluation_id.clone(),
-                now,
-                claim_versions.clone(),
-                levels,
-                evaluation_capability,
-                relay_plan,
-                #[cfg(feature = "registry-notary-cel")]
-                cel_concurrency,
-                correlation_id,
-                policy,
-            )
-            .await?;
-        if evaluation_access_mode == AccessMode::DelegatedSubjectAccess {
-            // Relay completion cannot extend the proof-authority window. Re-read
-            // the clock before any claim value is rendered or persisted.
-            let evaluation_expires_at = subject_access
-                .as_ref()
-                .and_then(|metadata| metadata.evaluation_expires_at.as_deref())
-                .and_then(|value| OffsetDateTime::parse(value, &Rfc3339).ok())
-                .ok_or_else(delegated_proof_denied)?;
-            require_fresh_delegated_evaluation(evaluation_expires_at, OffsetDateTime::now_utc())?;
-        }
-        let views = request
-            .claims
-            .iter()
-            .map(|claim_id| {
-                let claim = find_claim_for_selection(&evidence, claim_id, &claim_versions)?;
-                let result = internal
-                    .get(claim_id.id.as_str())
-                    .ok_or(EvidenceError::RuleEvaluationFailed)?;
-                view_claim(
-                    &self.subject_access_rate_keys,
-                    result,
-                    claim,
-                    disclosure,
-                    &format,
-                )
-            })
-            .collect::<Result<Vec<_>, EvidenceError>>()?;
-        let issuance_provenance = stored_issuance_provenance(
-            &evidence,
-            &self.subject_access_rate_keys,
-            target,
-            &request.claims,
-            &claim_versions,
-            &internal,
-            &views,
-        )?;
-        let expires_at = subject_access
-            .as_ref()
-            .and_then(|metadata| metadata.evaluation_expires_at.as_deref())
-            .and_then(|value| OffsetDateTime::parse(value, &Rfc3339).ok())
-            .unwrap_or_else(|| default_stored_evaluation_expires_at(now));
-        let client_id = stored_evaluation_client_id(principal, subject_access.as_ref());
-        store
-            .insert(registry_notary_core::StoredEvaluation {
-                client_id,
-                purpose,
-                claim_ids: request_claim_ids,
-                claim_refs: request.claims.clone(),
-                disclosure: stored_disclosure(&views),
-                format,
-                results: views.clone(),
-                created_at: format_time(now),
-                expires_at: format_time(expires_at),
-                request_hash,
-                issuance_provenance,
-                subject_access,
-            })
-            .await?;
-        Ok(views)
-    }
-
-    pub async fn batch_evaluate(
-        &self,
-        evidence: Arc<EvidenceConfig>,
-        store: &EvidenceStore,
-        principal: &EvidencePrincipal,
-        request: BatchEvaluateRequest,
-        options: BatchEvaluateOptions<'_>,
-    ) -> Result<BatchEvaluateResponse, EvidenceError> {
-        if principal.is_subject_access() {
-            return Err(EvidenceError::SubjectAccessDenied {
-                reason: SubjectAccessDenialCode::BatchDenied,
-            });
-        }
-        if request.claims.is_empty() || request.items.is_empty() {
-            return Err(EvidenceError::InvalidRequest);
-        }
-        if request.items.len() > registry_notary_core::MAX_BATCH_EVALUATION_MEMBERS_V1 {
-            return Err(EvidenceError::BatchTooLarge);
-        }
-        let claim_versions = requested_claim_versions(&request.claims)?;
-        let max_subjects = max_batch_subjects(&evidence, &request.claims, &claim_versions)?;
-        if request.items.len() > max_subjects {
-            return Err(EvidenceError::BatchTooLarge);
-        }
-        if options
-            .idempotency_key
-            .is_none_or(|key| key.is_empty() || key.len() > 256)
-        {
-            return Err(EvidenceError::ConsultationInvalidRequest);
-        }
-        let request_claim_ids = claim_ids(&request.claims);
-        let scoped_key = options
-            .idempotency_key
-            .map(|key| batch_idempotency_key(&principal.principal_id, key));
-        let evaluation_capability = evaluation_capability_for_principal(
-            &self.subject_access_rate_keys,
-            principal,
-            &request_claim_ids,
-        )?;
-        let batch_purpose =
-            resolve_batch_default_purpose(options.header_purpose, request.purpose.as_deref())?;
-        let subject_purposes =
-            resolve_batch_subject_purposes(&request.items, batch_purpose.as_deref())?;
-        let unique_purposes =
-            validate_batch_inputs_and_collect_purposes(&request.items, &subject_purposes)?;
-        for purpose in unique_purposes {
-            require_purpose_allowed(&evidence, &request.claims, &claim_versions, purpose)?;
-        }
-        let request_hash = batch_request_binding_hash(
-            &evidence,
-            &request,
-            principal,
-            &subject_purposes,
-            &claim_versions,
-        )?;
-        self.batch_evaluate_registry_backed(
-            evidence,
-            store,
-            principal,
-            request,
-            options
-                .idempotency_key
-                .ok_or(EvidenceError::ConsultationInvalidRequest)?,
-            request_hash,
-            scoped_key.ok_or(EvidenceError::ConsultationInvalidRequest)?,
-            evaluation_capability,
-            subject_purposes,
-            claim_versions,
-            options.owner_quota,
-        )
-        .await
-    }
-
-    // These values are validated and derived together before any Relay or
-    // state-plane side effects. Keeping them explicit makes that boundary
-    // visible at the handoff to registry-backed batch execution.
-    #[allow(clippy::too_many_arguments)]
-    async fn batch_evaluate_registry_backed(
-        &self,
-        evidence: Arc<EvidenceConfig>,
-        store: &EvidenceStore,
-        principal: &EvidencePrincipal,
-        request: BatchEvaluateRequest,
-        outer_idempotency_key: &str,
-        request_hash: String,
-        scoped_key: String,
-        evaluation_capability: EvaluationCapability,
-        subject_purposes: Vec<String>,
-        claim_versions: ClaimVersionSelections,
-        owner_quota: Option<(&crate::MachineQuotaLimiter, u32)>,
-    ) -> Result<BatchEvaluateResponse, EvidenceError> {
-        ensure_evaluation_capability_matches_principal(principal, &evaluation_capability)?;
-        let format = request
-            .format
-            .clone()
-            .unwrap_or_else(|| FORMAT_CLAIM_RESULT_JSON.to_string());
-        let disclosure = requested_disclosure(
-            &evidence,
-            &request.claims,
-            &claim_versions,
-            &request.disclosure,
-        )?;
-        validate_requested_disclosure_before_source(
-            &evidence,
-            &request.claims,
-            &claim_versions,
-            disclosure,
-        )?;
-        let levels = build_claim_levels(&evidence, &request.claims, &claim_versions)?;
-        // This loop is intentionally pure with respect to Relay
-        // execution. Every item must pass the complete authorization and
-        // request-shape preflight before any item can be forwarded.
-        let mut prepared = Vec::with_capacity(request.items.len());
-        let mut total_groups = 0usize;
-        for (input_index, (item, purpose)) in request
-            .items
-            .iter()
-            .zip(subject_purposes.iter())
-            .enumerate()
-        {
-            if !item.target.has_matching_input() {
-                return Err(EvidenceError::InvalidRequest);
-            }
-            for claim_ref in &request.claims {
-                require_evaluation_capability(&evaluation_capability, claim_ref)?;
-                let claim = find_claim_for_selection(&evidence, claim_ref, &claim_versions)?;
-                require_claim_access(principal, claim)?;
-                require_claim_format(claim, &format)?;
-            }
-            let context = item.request_context();
-            validate_request_variables_before_relay(&evidence, &context, &claim_versions, &levels)?;
-            preflight_claim_closure(
-                &evidence,
-                principal,
-                &evaluation_capability,
-                &claim_versions,
-                &levels,
-                purpose,
-                self.activated_relay.is_some(),
-            )?;
-            let audit = Arc::new(EvaluationAuditCollector::new());
-            let evaluation_ulid = audit.begin_evaluation();
-            let relay_plan = plan_relay_consultations(
-                &evidence,
-                principal,
-                &context,
-                &claim_versions,
-                &levels,
-                purpose,
-                evaluation_ulid,
-                self.activated_relay.as_ref(),
-                Arc::clone(&audit),
-                Some((outer_idempotency_key, input_index)),
-                &evaluation_capability,
-            )?
-            .ok_or(EvidenceError::ConsultationInvalidRequest)?;
-            total_groups = total_groups
-                .checked_add(relay_plan.group_count())
-                .ok_or(EvidenceError::ConsultationInvalidRequest)?;
-            if total_groups > MAX_BATCH_CONSULTATION_GROUPS_V1 {
-                return Err(EvidenceError::ConsultationInvalidRequest);
-            }
-            prepared.push(PreparedRegistryBatchItem {
-                input_index,
-                request: EvaluateRequest {
-                    requester: item.requester.clone(),
-                    target: Some(item.target.clone()),
-                    relationship: item.relationship.clone(),
-                    on_behalf_of: item.on_behalf_of.clone(),
-                    variables: Default::default(),
-                    claims: request.claims.clone(),
-                    disclosure: request.disclosure.clone(),
-                    format: request.format.clone(),
-                    purpose: Some(purpose.clone()),
-                },
-                context,
-                purpose: purpose.clone(),
-                claim_versions: claim_versions.clone(),
-                levels: levels.clone(),
-                disclosure,
-                format: format.clone(),
-                evaluation_id: evaluation_ulid.to_string(),
-                relay_plan,
-                audit,
-                evaluation_capability: evaluation_capability.clone(),
-            });
-        }
-
-        let mut idempotency_owner = match store
-            .reserve_idempotent_batch(
-                scoped_key,
-                request_hash.clone(),
-                &principal.principal_id,
-                owner_quota,
-            )
-            .await?
-        {
-            BatchIdempotencyReservation::Replay(mut response) => {
-                clear_batch_runtime_audit(&mut response);
-                return Ok(response);
-            }
-            BatchIdempotencyReservation::Owner(owner) => owner,
-        };
-        let quota_charged_by_reservation = idempotency_owner.quota_charged();
-        if let Some((quota, cost)) = owner_quota.filter(|_| !quota_charged_by_reservation) {
-            let quota_enabled = quota.is_enabled();
-            if let Err(error) = quota.check_and_consume(&principal.principal_id, cost).await {
-                idempotency_owner.abandon_uncharged()?;
-                return Err(EvidenceError::MachineQuotaExceeded {
-                    retry_after_seconds: error.retry_after_seconds,
-                });
-            }
-            if quota_enabled {
-                idempotency_owner.mark_quota_charged()?;
-            }
-        }
-
-        let subject_concurrency = Arc::new(Semaphore::new(evidence.concurrency.subjects));
-        #[cfg(feature = "registry-notary-cel")]
-        let cel_concurrency = self
-            .cel_worker
-            .as_ref()
-            .map(|_| Arc::new(Semaphore::new(self.cel_config.worker_count.max(1))));
-        let mut join_set = JoinSet::new();
-        for item in prepared {
-            let runtime = self.clone();
-            let evidence = Arc::clone(&evidence);
-            let permit_semaphore = Arc::clone(&subject_concurrency);
-            #[cfg(feature = "registry-notary-cel")]
-            let cel_concurrency = cel_concurrency.as_ref().map(Arc::clone);
-            join_set.spawn(async move {
-                let input_index = item.input_index;
-                let audit = Arc::clone(&item.audit);
-                let _permit = permit_semaphore
-                    .acquire_owned()
-                    .await
-                    .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-                let result = runtime
-                    .evaluate_prepared_registry_batch_item(
-                        evidence,
-                        item,
-                        #[cfg(feature = "registry-notary-cel")]
-                        cel_concurrency,
-                    )
-                    .await;
-                Ok::<_, EvidenceError>((input_index, result, audit.snapshot()))
-            });
-        }
-
-        let subject_count = request.items.len();
-        let mut items: Vec<Option<BatchItemResponse>> = (0..subject_count).map(|_| None).collect();
-        let mut succeeded = 0usize;
-        let mut failed = 0usize;
-        let mut retained_evaluations = Vec::new();
-        while let Some(joined) = join_set.join_next().await {
-            let (input_index, result, runtime_audit) = match joined {
-                Ok(Ok(item_result)) => item_result,
-                Ok(Err(error)) => return Err(error),
-                Err(join_error) if join_error.is_panic() => {
-                    tracing::error!(
-                        target: "registry_notary_server::runtime",
-                        error = %join_error,
-                        "registry-backed batch subject task panicked",
-                    );
-                    return Err(EvidenceError::RuleEvaluationFailed);
-                }
-                Err(_) => return Err(EvidenceError::RuleEvaluationFailed),
-            };
-            let batch_item = &request.items[input_index];
-            let target_ref = target_ref_view(&self.subject_access_rate_keys, &batch_item.target)?;
-            let requester_ref = batch_item
-                .requester
-                .as_ref()
-                .map(|requester| {
-                    entity_ref_view(&self.subject_access_rate_keys, "requester", requester)
-                })
-                .transpose()?;
-            let relay_forwarded_count = runtime_audit.relay_forwarded_count();
-            let (_, relay_consultation_ids) = runtime_audit.into_parts();
-            let runtime_audit = registry_notary_core::BatchItemRuntimeAudit {
-                relay_forwarded_count,
-                relay_consultation_ids,
-            };
-            match result {
-                Ok(evaluated) => {
-                    let results = evaluated.views;
-                    succeeded += 1;
-                    let evaluation_id = results.first().map(|result| result.evaluation_id.clone());
-                    let claim_results = results
-                        .iter()
-                        .map(|result| batch_claim_result(&evidence, result))
-                        .collect::<Result<Vec<_>, EvidenceError>>()?;
-                    if let Some(first) = results.first() {
-                        // Relay acquisition time belongs to claim provenance;
-                        // evaluation retention starts when Notary stores it.
-                        let stored_at = OffsetDateTime::now_utc();
-                        retained_evaluations.push(registry_notary_core::StoredEvaluation {
-                            client_id: principal.principal_id.clone(),
-                            purpose: subject_purposes[input_index].clone(),
-                            claim_ids: claim_ids(&request.claims),
-                            claim_refs: request.claims.clone(),
-                            disclosure: stored_disclosure(&results),
-                            format: first.format.clone(),
-                            results: results.clone(),
-                            created_at: format_time(stored_at),
-                            expires_at: format_time(default_stored_evaluation_expires_at(
-                                stored_at,
-                            )),
-                            request_hash: request_hash.clone(),
-                            issuance_provenance: evaluated.issuance_provenance,
-                            subject_access: None,
-                        });
-                    }
-                    items[input_index] = Some(BatchItemResponse {
-                        input_index,
-                        target_ref,
-                        requester_ref,
-                        evaluation_id,
-                        status: BatchItemStatus::Succeeded,
-                        claim_results,
-                        errors: Vec::new(),
-                        runtime_audit,
-                    });
-                }
-                Err(error) => {
-                    failed += 1;
-                    items[input_index] = Some(BatchItemResponse {
-                        input_index,
-                        target_ref,
-                        requester_ref,
-                        evaluation_id: None,
-                        status: BatchItemStatus::Failed,
-                        claim_results: Vec::new(),
-                        errors: vec![batch_item_error(&error)],
-                        runtime_audit,
-                    });
-                }
-            }
-        }
-        let response = BatchEvaluateResponse {
-            batch_id: Ulid::new().to_string(),
-            status: BatchStatus::Completed,
-            claims: claim_ids(&request.claims),
-            items: items
-                .into_iter()
-                .map(|item| item.ok_or(EvidenceError::RuleEvaluationFailed))
-                .collect::<Result<Vec<_>, _>>()?,
-            summary: BatchSummary { succeeded, failed },
-        };
-        idempotency_owner
-            .complete(response, retained_evaluations)
-            .await
-    }
-
-    async fn evaluate_prepared_registry_batch_item(
-        &self,
-        evidence: Arc<EvidenceConfig>,
-        item: PreparedRegistryBatchItem,
-        #[cfg(feature = "registry-notary-cel")] cel_concurrency: Option<Arc<Semaphore>>,
-    ) -> Result<EvaluatedRegistryClaims, EvidenceError> {
-        let now = OffsetDateTime::now_utc();
-        let internal = self
-            .evaluate_claims_dag(
-                Arc::clone(&evidence),
-                item.context,
-                item.purpose,
-                item.evaluation_id,
-                now,
-                item.claim_versions.clone(),
-                item.levels,
-                item.evaluation_capability,
-                Some(item.relay_plan),
-                #[cfg(feature = "registry-notary-cel")]
-                cel_concurrency,
-                None,
-                EvaluationPolicy::default(),
-            )
-            .await?;
-        let views = item
-            .request
-            .claims
-            .iter()
-            .map(|claim_ref| {
-                let claim = find_claim_for_selection(&evidence, claim_ref, &item.claim_versions)?;
-                let result = internal
-                    .get(claim_ref.id.as_str())
-                    .ok_or(EvidenceError::RuleEvaluationFailed)?;
-                view_claim(
-                    &self.subject_access_rate_keys,
-                    result,
-                    claim,
-                    item.disclosure,
-                    &item.format,
-                )
-            })
-            .collect::<Result<Vec<_>, EvidenceError>>()?;
-        let issuance_provenance = stored_issuance_provenance(
-            &evidence,
-            &self.subject_access_rate_keys,
-            item.request
-                .target
-                .as_ref()
-                .ok_or(EvidenceError::InvalidRequest)?,
-            &item.request.claims,
-            &item.claim_versions,
-            &internal,
-            &views,
-        )?;
-        Ok(EvaluatedRegistryClaims {
-            views,
-            issuance_provenance,
-        })
-    }
-
-    /// Walk the claim `depends_on` DAG in topological levels, running all
-    /// sibling claims at one level concurrently bounded by
-    /// `concurrency.bindings`. Returns the populated `prior` map.
-    #[allow(clippy::too_many_arguments)]
-    async fn evaluate_claims_dag(
-        &self,
-        evidence: Arc<EvidenceConfig>,
-        context: EvidenceRequestContext,
-        purpose: String,
-        evaluation_id: String,
-        now: OffsetDateTime,
-        claim_versions: ClaimVersionSelections,
-        levels: Vec<Vec<String>>,
-        evaluation_capability: EvaluationCapability,
-        relay_plan: Option<Arc<RequestScopedRelayPlan>>,
-        #[cfg(feature = "registry-notary-cel")] cel_concurrency: Option<Arc<Semaphore>>,
-        correlation_id: Option<BoundedCorrelationId>,
-        policy: EvaluationPolicy,
-    ) -> Result<BTreeMap<String, ClaimResultInternal>, EvidenceError> {
-        let prior: Arc<Mutex<BTreeMap<String, ClaimResultInternal>>> =
-            Arc::new(Mutex::new(BTreeMap::new()));
-        for level in levels {
-            // Spawn one task per claim in this level. All deps are already in
-            // `prior` because previous levels finished.
-            let mut tasks: JoinSet<(String, Result<ClaimResultInternal, EvidenceError>)> =
-                JoinSet::new();
-            for claim_id in level {
-                if prior
-                    .lock()
-                    .expect("prior mutex is not poisoned")
-                    .contains_key(&claim_id)
-                {
-                    continue;
-                }
-                let ctx = ClaimEvaluationContext {
-                    evidence: Arc::clone(&evidence),
-                    subject_access_rate_keys: Arc::clone(&self.subject_access_rate_keys),
-                    evaluation_capability: evaluation_capability.clone(),
-                    relay_plan: relay_plan.as_ref().map(Arc::clone),
-                    context: context.clone(),
-                    purpose: purpose.clone(),
-                    correlation_id: correlation_id.clone(),
-                    evaluation_id: evaluation_id.clone(),
-                    policy: policy.clone(),
-                    now,
-                    claim_versions: claim_versions.clone(),
-                    #[cfg(feature = "registry-notary-cel")]
-                    cel_worker: self.cel_worker.as_ref().map(Arc::clone),
-                    #[cfg(feature = "registry-notary-cel")]
-                    cel_concurrency: cel_concurrency.as_ref().map(Arc::clone),
-                    #[cfg(feature = "registry-notary-cel")]
-                    cel_config: Arc::clone(&self.cel_config),
-                };
-                let prior_for_task = Arc::clone(&prior);
-                tasks.spawn(async move {
-                    let correlation_id = ctx.correlation_id.clone();
-                    let evaluation = evaluate_claim_task(ctx, &claim_id, prior_for_task);
-                    let result = if let Some(correlation_id) = correlation_id {
-                        with_request_correlation_id(correlation_id, evaluation).await
-                    } else {
-                        evaluation.await
-                    };
-                    (claim_id, result)
-                });
-            }
-            while let Some(joined) = tasks.join_next().await {
-                let (claim_id, result) = match joined {
-                    Ok(pair) => pair,
-                    Err(join_error) if join_error.is_panic() => {
-                        tracing::error!(
-                            target: "registry_notary_server::runtime",
-                            error = %join_error,
-                            "claim task panicked",
-                        );
-                        return Err(EvidenceError::RuleEvaluationFailed);
-                    }
-                    Err(_) => return Err(EvidenceError::RuleEvaluationFailed),
-                };
-                let value = result?;
-                prior
-                    .lock()
-                    .expect("prior mutex is not poisoned")
-                    .insert(claim_id, value);
-            }
-        }
-        let map = Arc::try_unwrap(prior)
-            .map_err(|_| EvidenceError::RuleEvaluationFailed)?
-            .into_inner()
-            .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-        Ok(map)
-    }
-
-    pub async fn render(
-        &self,
-        evidence: &EvidenceConfig,
-        store: &EvidenceStore,
-        principal: &EvidencePrincipal,
-        request: RenderRequest,
-    ) -> Result<Value, EvidenceError> {
-        let evaluation = store
-            .get(&request.evaluation_id, &principal.principal_id)
-            .await?
-            .ok_or(EvidenceError::EvaluationNotFound)?;
-        if evaluation.client_id != principal.principal_id {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-        if request.format != evaluation.format {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-        let requested = request
-            .disclosure
-            .as_deref()
-            .unwrap_or(evaluation.disclosure.as_str());
-        if requested != evaluation.disclosure {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-        if let Some(claims) = &request.claims {
-            if claims != &evaluation.claim_ids {
-                return Err(EvidenceError::EvaluationBindingMismatch);
-            }
-        }
-        if let Some(purpose) = request.purpose.as_deref() {
-            if purpose != evaluation.purpose {
-                return Err(EvidenceError::EvaluationBindingMismatch);
-            }
-        }
-        render_results(evidence, &evaluation.results, &request.format)
-    }
-}
-
-fn delegated_proof_first_levels(
-    mut levels: Vec<Vec<String>>,
-    capability: &EvaluationCapability,
-) -> Result<Vec<Vec<String>>, EvidenceError> {
-    let EvaluationCapability::DelegatedSubjectAccess { proof_claim_id, .. } = capability else {
-        return Ok(levels);
-    };
-    let proof_claim_id = proof_claim_id.as_str();
-    let mut found = false;
-    for level in &mut levels {
-        let previous_len = level.len();
-        level.retain(|claim_id| claim_id != proof_claim_id);
-        found |= level.len() != previous_len;
-    }
-    if !found {
-        return Err(delegated_proof_denied());
-    }
-    levels.retain(|level| !level.is_empty());
-    levels.insert(0, vec![proof_claim_id.to_string()]);
-    Ok(levels)
-}
-
-fn validate_request_variables_before_relay(
-    evidence: &EvidenceConfig,
-    context: &EvidenceRequestContext,
-    claim_versions: &ClaimVersionSelections,
-    levels: &[Vec<String>],
-) -> Result<(), EvidenceError> {
-    if context
-        .variables
-        .iter()
-        .any(|(name, _)| !evidence.variables.contains_key(name))
-    {
-        return Err(EvidenceError::InvalidRequest);
-    }
-    for claim_id in levels.iter().flatten() {
-        let claim = find_claim_for_selection(evidence, claim_id, claim_versions)?;
-        let RuleConfig::Cel { expression, .. } = &claim.rule else {
-            continue;
-        };
-        let required = registry_cel_required_variables(
-            expression,
-            evidence.variables.keys().map(String::as_str),
-        );
-        if required
-            .iter()
-            .any(|name| context.variables.get(name).is_none())
-        {
-            return Err(EvidenceError::InvalidRequest);
-        }
-    }
-    Ok(())
-}
-
-#[allow(clippy::too_many_arguments)]
-fn preflight_claim_closure(
-    evidence: &EvidenceConfig,
-    principal: &EvidencePrincipal,
-    evaluation_capability: &EvaluationCapability,
-    claim_versions: &ClaimVersionSelections,
-    levels: &[Vec<String>],
-    purpose: &str,
-    relay_is_activated: bool,
-) -> Result<(), EvidenceError> {
-    for claim_id in levels.iter().flatten() {
-        let claim = find_claim_for_selection(evidence, claim_id, claim_versions)?;
-        if !claim.operations.evaluate.enabled {
-            return Err(EvidenceError::OperationUnsupported);
-        }
-        require_claim_access(principal, claim)?;
-        require_relay_consultation_capability(evaluation_capability, &claim.id)?;
-        if !relay_is_activated {
-            return Err(EvidenceError::EvidenceNotAvailable);
-        }
-        if claim.purpose.as_deref() != Some(purpose) {
-            return Err(EvidenceError::PurposeNotAllowed);
-        }
-    }
-    Ok(())
-}
-
-#[allow(clippy::too_many_arguments)]
-fn plan_relay_consultations(
-    evidence: &EvidenceConfig,
-    principal: &EvidencePrincipal,
-    context: &EvidenceRequestContext,
-    claim_versions: &ClaimVersionSelections,
-    levels: &[Vec<String>],
-    purpose: &str,
-    evaluation_id: Ulid,
-    activated_relay: Option<&Arc<dyn ActivatedRelayConsultations>>,
-    audit: Arc<EvaluationAuditCollector>,
-    batch: Option<(&str, usize)>,
-    evaluation_capability: &EvaluationCapability,
-) -> Result<Option<Arc<RequestScopedRelayPlan>>, EvidenceError> {
-    let mut entries = Vec::new();
-    for claim_id in levels.iter().flatten() {
-        let claim = find_claim_for_selection(evidence, claim_id, claim_versions)?;
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-            continue;
-        };
-        let (_, consultation) = consultations
-            .first_key_value()
-            .filter(|_| consultations.len() == 1)
-            .ok_or(EvidenceError::RuleEvaluationFailed)?;
-        if !(1..=16).contains(&consultation.inputs.len()) {
-            return Err(EvidenceError::RuleEvaluationFailed);
-        }
-        let inputs = consultation
-            .inputs
-            .iter()
-            .map(|(input_name, input_mapping)| {
-                context
-                    .lookup_value(input_mapping.request_context_path())
-                    .and_then(|value| canonical_request_scalar(&value))
-                    .map(|value| (input_name.clone(), Zeroizing::new(value)))
-                    .ok_or(EvidenceError::InvalidRequest)
-            })
-            .collect::<Result<BTreeMap<_, _>, _>>()?;
-        let input_names = consultation.inputs.keys().cloned().collect::<Vec<_>>();
-        let expected_result = relay_expected_result(
-            evidence,
-            consultation,
-            claim
-                .purpose
-                .as_deref()
-                .ok_or(EvidenceError::InvalidRequest)?,
-            &input_names,
-        )?;
-        let key = ConsultationGroupKeyV1::new_with_expected_result(
-            evaluation_id,
-            principal.auth_profile_id,
-            principal.principal_id.clone(),
-            claim.required_scopes.clone(),
-            consultation.profile.id.as_str(),
-            consultation.profile.contract_hash.as_str(),
-            purpose,
-            inputs,
-            expected_result,
-        )
-        .map_err(|_| EvidenceError::InvalidRequest)?;
-        entries.push((claim.id.clone(), key));
-    }
-    if entries.is_empty() {
-        return Ok(None);
-    }
-    let activated = activated_relay
-        .map(Arc::clone)
-        .ok_or(EvidenceError::EvidenceNotAvailable)?;
-    let plan = match batch {
-        Some((outer_key, item_position)) => {
-            RequestScopedRelayPlan::new_batch(entries, outer_key, item_position, activated, audit)
-        }
-        None => RequestScopedRelayPlan::new(entries, activated, audit),
-    };
-    plan.map(Arc::new).map(Some).map_err(|_| {
-        if matches!(
-            evaluation_capability,
-            EvaluationCapability::DelegatedSubjectAccess { .. }
-        ) {
-            delegated_proof_denied()
-        } else {
-            EvidenceError::InvalidRequest
-        }
-    })
-}
-
-fn relay_evaluation_id(
-    principal: &EvidencePrincipal,
-    correlation_id: Option<&BoundedCorrelationId>,
-    generated: Ulid,
-) -> Result<Ulid, EvidenceError> {
-    if principal.auth_profile_id != EvidenceAuthProfileId::Federation {
-        return Ok(generated);
-    }
-    let correlation_id = correlation_id.ok_or(EvidenceError::RuleEvaluationFailed)?;
-    Ulid::from_string(correlation_id.as_str())
-        .ok()
-        .filter(|candidate| candidate.to_string() == correlation_id.as_str())
-        .ok_or(EvidenceError::RuleEvaluationFailed)
-}
-
-pub(super) fn canonical_request_scalar(value: &Value) -> Option<String> {
-    match value {
-        Value::String(value) => Some(value.clone()),
-        Value::Bool(value) => Some(value.to_string()),
-        Value::Number(value) => value.as_i64().map(|value| value.to_string()),
-        Value::Null | Value::Array(_) | Value::Object(_) => None,
-    }
-}
-
-fn relay_expected_result(
-    _evidence: &EvidenceConfig,
-    selected: &registry_notary_core::RelayConsultationConfig,
-    _purpose: &str,
-    _input_names: &[String],
-) -> Result<RuntimeRelayExpectedResult, EvidenceError> {
-    RuntimeRelayExpectedResult::output_map(selected.outputs.clone())
-        .map_err(|_| EvidenceError::InvalidRequest)
-}
-
-fn stored_issuance_provenance(
-    evidence: &EvidenceConfig,
-    subject_access_rate_keys: &SubjectAccessRateLimitKeys,
-    target: &EvidenceEntity,
-    selected_claims: &[ClaimRef],
-    claim_versions: &ClaimVersionSelections,
-    internal: &BTreeMap<String, ClaimResultInternal>,
-    selected_views: &[ClaimResultView],
-) -> Result<Option<StoredIssuanceProvenance>, EvidenceError> {
-    // Retain restricted Relay identifiers only when the selected roots share
-    // an actual credential profile. Root configuration validation closes both
-    // sides of these bindings and validates the registry-backed dependency
-    // closure. OID4VCI configurations use the same profile binding.
-    let credential_capable = evidence
-        .credential_profiles
-        .iter()
-        .any(|(profile_id, profile)| {
-            selected_claims.iter().all(|claim_ref| {
-                find_claim_for_selection(evidence, claim_ref, claim_versions).is_ok_and(|claim| {
-                    claim
-                        .credential_profiles
-                        .iter()
-                        .any(|candidate| candidate == profile_id)
-                        && profile
-                            .allowed_claims
-                            .iter()
-                            .any(|candidate| candidate == &claim.id)
-                })
-            })
-        });
-    if !credential_capable {
-        return Ok(None);
-    }
-
-    let levels = build_claim_levels(evidence, selected_claims, claim_versions)?;
-    let closure = levels.iter().flatten().collect::<Vec<_>>();
-    if closure.len() > MAX_CLAIM_DEPENDENCY_NODES_V1 {
-        return Err(EvidenceError::RuleEvaluationFailed);
-    }
-    let mut claims = Vec::with_capacity(closure.len());
-    let mut consultations: BTreeMap<String, StoredIssuanceConsultationProvenance> = BTreeMap::new();
-    for claim_id in closure {
-        let provenance = internal
-            .get(claim_id.as_str())
-            .and_then(|result| result.own_issuance_provenance.clone())
-            .ok_or(EvidenceError::RuleEvaluationFailed)?;
-        match consultations.get(&provenance.consultation.consultation_id) {
-            Some(existing) if existing.acquired_at != provenance.consultation.acquired_at => {
-                return Err(EvidenceError::RuleEvaluationFailed);
-            }
-            Some(_) => {}
-            None => {
-                consultations.insert(
-                    provenance.consultation.consultation_id.clone(),
-                    provenance.consultation.clone(),
-                );
-            }
-        }
-        let result = internal
-            .get(claim_id.as_str())
-            .ok_or(EvidenceError::RuleEvaluationFailed)?;
-        let mut claim = provenance.claim;
-        claim.result_content_binding = match selected_views
-            .iter()
-            .find(|view| view.claim_id == result.claim_id)
-        {
-            Some(view) => issuance_result_content_binding(view)?,
-            None => sha256_canonical_json(&json!({
-                "schema": "registry.notary.private-dependency-result-content/v1",
-                "result": {
-                    "evaluation_id": result.evaluation_id,
-                    "claim_id": result.claim_id,
-                    "claim_version": result.claim_version,
-                    "subject_type": result.subject_type,
-                    "value": result.value,
-                    "issued_at": format_time(result.issued_at),
-                    "expires_at": result.expires_at.map(format_time),
-                    "provenance": result.provenance,
-                },
-            }))?,
-        };
-        claim.execution_binding = issuance_execution_binding(
-            &claim,
-            &provenance.consultation,
-            &result.evaluation_id,
-            &format_time(result.issued_at),
-            &result.provenance,
-        )?;
-        claims.push(claim);
-    }
-    let target_ref = target_ref_view(subject_access_rate_keys, target)?;
-    let authorization_target_binding = match target.to_subject_request() {
-        Some(primary_identity) => {
-            let primary_id_type = match primary_identity.id_type.as_deref() {
-                Some("id") => return Err(EvidenceError::InvalidRequest),
-                Some(id_type) => id_type,
-                None => "id",
-            };
-            issuance_authorization_target_binding(
-                subject_access_rate_keys,
-                &target_ref,
-                primary_id_type,
-                &primary_identity.id,
-            )?
-        }
-        None => String::new(),
-    };
-    Ok(Some(StoredIssuanceProvenance {
-        claims,
-        consultations: consultations.into_values().collect(),
-        authorization_target_binding,
-    }))
-}
-
-fn default_stored_evaluation_expires_at(stored_at: OffsetDateTime) -> OffsetDateTime {
-    stored_at + time::Duration::minutes(15)
-}
-
-pub(super) fn require_fresh_delegated_evaluation(
-    evaluation_expires_at: OffsetDateTime,
-    now: OffsetDateTime,
-) -> Result<(), EvidenceError> {
-    if now >= evaluation_expires_at {
-        return Err(delegated_proof_denied());
-    }
-    Ok(())
-}
-
-/// Derive the evaluation policy identity for provenance from stored
-/// subject-access metadata. Subject-bound results use the canonical
-/// `subject-access` evaluation policy; the version and hash come
-/// from the metadata when present. Non-subject-access flows pass `None` and
-/// receive an empty policy.
-pub(super) fn evaluation_policy_from_subject_access(
-    subject_access: Option<&StoredSubjectAccessMetadata>,
-) -> EvaluationPolicy {
-    match subject_access {
-        Some(metadata) => EvaluationPolicy {
-            policy_id: Some(SUBJECT_ACCESS_POLICY_ID.to_string()),
-            policy_version: metadata
-                .policy_version
-                .as_ref()
-                .map(|version| version.as_str().to_string()),
-            policy_hash: metadata
-                .policy_hash
-                .as_ref()
-                .map(|hash| hash.as_str().to_string()),
-        },
-        None => EvaluationPolicy::default(),
-    }
-}
-
-/// Canonical evaluation `policy_id` for subject-access flows (D3).
-pub(super) const SUBJECT_ACCESS_POLICY_ID: &str = "subject-access";
-
-pub(super) fn stored_evaluation_client_id(
-    principal: &EvidencePrincipal,
-    subject_access: Option<&StoredSubjectAccessMetadata>,
-) -> String {
-    subject_access
-        .map(|metadata| metadata.principal_hash.as_str().to_string())
-        .unwrap_or_else(|| principal.principal_id.clone())
-}
-
-pub(super) async fn evaluate_claim_task(
-    ctx: ClaimEvaluationContext,
-    claim_id: &str,
-    prior: Arc<Mutex<BTreeMap<String, ClaimResultInternal>>>,
-) -> Result<ClaimResultInternal, EvidenceError> {
-    if let Some(existing) = prior
-        .lock()
-        .expect("prior mutex is not poisoned")
-        .get(claim_id)
-        .cloned()
-    {
-        return Ok(existing);
-    }
-    let claim = find_claim_for_selection(&ctx.evidence, claim_id, &ctx.claim_versions)?.clone();
-    if !claim.operations.evaluate.enabled {
-        return Err(EvidenceError::OperationUnsupported);
-    }
-    ensure_delegated_capability_context_binding(&ctx)?;
-    if let Some(proof_claim_id) = ctx
-        .evaluation_capability
-        .required_delegated_proof_for_claim(claim_id)
-    {
-        let proof_satisfied = prior
-            .lock()
-            .expect("prior mutex is not poisoned")
-            .get(proof_claim_id)
-            .and_then(|proof| proof.value.as_bool())
-            .unwrap_or(false);
-        if !proof_satisfied {
-            return Err(delegated_relationship_unproven());
-        }
-    }
-    let delegated_proof_claim = ctx.evaluation_capability.is_delegated_proof_claim(claim_id);
-    let (
-        consultation_outputs,
-        observed_at,
-        mut relay_consultation_ids,
-        own_issuance_provenance,
-        relay_matched,
-    ) = match &claim.evidence_mode {
-        ClaimEvidenceMode::RegistryBacked { consultations } => {
-            require_relay_consultation_capability(&ctx.evaluation_capability, &claim.id)?;
-            let (_, consultation) = consultations
-                .first_key_value()
-                .filter(|_| consultations.len() == 1)
-                .ok_or(EvidenceError::RuleEvaluationFailed)?;
-            let plan = ctx
-                .relay_plan
-                .as_ref()
-                .ok_or(EvidenceError::EvidenceNotAvailable)?;
-            let result = plan.consult(&claim.id).await.map_err(|_| {
-                if delegated_proof_claim {
-                    delegated_proof_denied()
-                } else {
-                    EvidenceError::EvidenceNotAvailable
-                }
-            })?;
-            let relay_outcome = result.outcome();
-            let consultation_outputs_result = match relay_outcome {
-                RuntimeRelayOutcome::Match => materialize_relay_match(&claim, &result),
-                RuntimeRelayOutcome::NoMatch
-                    if matches!(&claim.rule, RuleConfig::ConsultationOutput { .. })
-                        && registry_claim_has_typed_outputs(&claim) =>
-                {
-                    materialize_relay_absence(&claim)
-                }
-                RuntimeRelayOutcome::NoMatch
-                    if matches!(&claim.rule, RuleConfig::ConsultationOutput { .. }) =>
-                {
-                    Err(EvidenceError::EvidenceNotAvailable)
-                }
-                RuntimeRelayOutcome::NoMatch if matches!(&claim.rule, RuleConfig::Cel { .. }) => {
-                    materialize_relay_absence(&claim)
-                }
-                RuntimeRelayOutcome::NoMatch => Ok(BTreeMap::new()),
-                RuntimeRelayOutcome::Ambiguous => Err(EvidenceError::EvidenceNotAvailable),
-            };
-            let consultation_outputs = consultation_outputs_result.map_err(|error| {
-                if delegated_proof_claim {
-                    if relay_outcome == RuntimeRelayOutcome::NoMatch {
-                        delegated_relationship_unproven()
-                    } else {
-                        delegated_proof_denied()
-                    }
-                } else {
-                    error
-                }
-            })?;
-            let acquired_at = result.acquired_at();
-            let consultation_id = result.consultation_id().to_string();
-            (
-                consultation_outputs,
-                Some(acquired_at),
-                BTreeSet::from([consultation_id.clone()]),
-                Some(ClaimIssuanceProvenanceInternal {
-                    claim: StoredIssuanceClaimProvenance {
-                        claim_id: claim.id.clone(),
-                        claim_version: claim.version.clone(),
-                        relay_profile_id: consultation.profile.id.clone(),
-                        relay_contract_hash: consultation.profile.contract_hash.clone(),
-                        canonical_purpose: ctx.purpose.clone(),
-                        consultation_id: consultation_id.clone(),
-                        execution_binding: String::new(),
-                        result_content_binding: String::new(),
-                    },
-                    consultation: StoredIssuanceConsultationProvenance {
-                        consultation_id,
-                        acquired_at: format_time(acquired_at),
-                    },
-                }),
-                relay_outcome == RuntimeRelayOutcome::Match,
-            )
-        }
-        ClaimEvidenceMode::Impossible { impossible } => match *impossible {},
-    };
-    // Relay acquisition time pins the result to the consultation evidence.
-    let issued_at = observed_at.unwrap_or(ctx.now);
-    let value_result = match &claim.rule {
-        RuleConfig::ConsultationOutput {
-            consultation,
-            output,
-        } => {
-            let record = consultation_outputs
-                .get(consultation)
-                .ok_or(EvidenceError::EvidenceNotAvailable)?;
-            let value = get_json_path(record, output)
-                .cloned()
-                .ok_or(EvidenceError::RuleEvaluationFailed)?;
-            if relay_matched {
-                let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode
-                else {
-                    return Err(EvidenceError::RuleEvaluationFailed);
-                };
-                if let Some(output_contract) = consultations
-                    .get(consultation)
-                    .and_then(|consultation| consultation.outputs.get(output))
-                {
-                    if !output_contract.validates_value(&value) {
-                        return Err(EvidenceError::RuleEvaluationFailed);
-                    }
-                }
-            }
-            validate_claim_value_config(&value, &claim.value)?;
-            Ok(value)
-        }
-        RuleConfig::ConsultationMatched { consultation } => {
-            let value = Value::Bool(consultation_outputs.contains_key(consultation));
-            validate_claim_value_config(&value, &claim.value)?;
-            Ok(value)
-        }
-        RuleConfig::Cel { expression } => {
-            #[cfg(feature = "registry-notary-cel")]
-            let _cel_permit = if let Some(cel_concurrency) = ctx.cel_concurrency.as_ref() {
-                Some(
-                    Arc::clone(cel_concurrency)
-                        .acquire_owned()
-                        .await
-                        .map_err(|_| EvidenceError::RuleEvaluationFailed)?,
-                )
-            } else {
-                None
-            };
-            let value = evaluate_cel_expression(&CelEvaluationContext {
-                evidence: &ctx.evidence,
-                claim: &claim,
-                expression,
-                consultation_outputs: &consultation_outputs,
-                variables: &ctx.context.variables,
-                #[cfg(feature = "registry-notary-cel")]
-                worker: ctx.cel_worker.as_deref(),
-                #[cfg(feature = "registry-notary-cel")]
-                config: &ctx.cel_config,
-            })
-            .await?;
-            validate_claim_value_config(&value, &claim.value)?;
-            Ok(value)
-        }
-    };
-    let value = match value_result {
-        Ok(value) => value,
-        Err(_) if delegated_proof_claim => return Err(delegated_proof_denied()),
-        Err(error) => return Err(error),
-    };
-    if delegated_proof_claim && value.as_bool() != Some(true) {
-        return Err(delegated_relationship_unproven());
-    }
-    {
-        let snapshot = prior.lock().expect("prior mutex is not poisoned");
-        for dep in claim
-            .depends_on
-            .iter()
-            .filter_map(|dep_id| snapshot.get(dep_id))
-        {
-            relay_consultation_ids.extend(dep.relay_consultation_ids.iter().cloned());
-        }
-    }
-    let mut provenance = ClaimProvenance::new(
-        ctx.evidence.service_id.clone(),
-        ctx.evaluation_id.clone(),
-        claim.id.clone(),
-        claim.version.clone(),
-        ProvenanceUsed {
-            relay_consultation_count: relay_consultation_ids.len(),
-        },
-    );
-    provenance.generated_by.policy_id = ctx.policy.policy_id.clone();
-    provenance.generated_by.policy_version = ctx.policy.policy_version.clone();
-    provenance.generated_by.policy_hash = ctx.policy.policy_hash.clone();
-    Ok(ClaimResultInternal {
-        evaluation_id: ctx.evaluation_id.clone(),
-        claim_id: claim.id.clone(),
-        claim_version: claim.version.clone(),
-        subject_type: claim.subject_type.clone(),
-        target: ctx.context.target.clone(),
-        requester: ctx.context.requester.clone(),
-        value,
-        redaction_fields: BTreeSet::new(),
-        issued_at,
-        expires_at: None,
-        provenance,
-        relay_consultation_ids,
-        own_issuance_provenance,
-    })
-}
-
-pub(super) fn materialize_relay_match(
-    claim: &ClaimDefinition,
-    result: &RuntimeRelayConsultationResult,
-) -> Result<BTreeMap<String, Value>, EvidenceError> {
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-        return Err(EvidenceError::RuleEvaluationFailed);
-    };
-    let (consultation_name, _) = consultations
-        .first_key_value()
-        .filter(|_| consultations.len() == 1)
-        .ok_or(EvidenceError::RuleEvaluationFailed)?;
-    let (_, consultation) = consultations
-        .first_key_value()
-        .filter(|_| consultations.len() == 1)
-        .ok_or(EvidenceError::RuleEvaluationFailed)?;
-    if consultation.outputs.is_empty() {
-        return Err(EvidenceError::RuleEvaluationFailed);
-    }
-    let mut record = result
-        .outputs()
-        .ok_or(EvidenceError::RuleEvaluationFailed)?
-        .to_json_object();
-    record.insert("matched".to_string(), Value::Bool(true));
-    record.insert("outcome".to_string(), Value::String("match".to_string()));
-    Ok(BTreeMap::from([(
-        consultation_name.clone(),
-        Value::Object(record),
-    )]))
-}
-
-pub(super) fn materialize_relay_absence(
-    claim: &ClaimDefinition,
-) -> Result<BTreeMap<String, Value>, EvidenceError> {
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-        return Err(EvidenceError::RuleEvaluationFailed);
-    };
-    let (consultation_name, consultation) = consultations
-        .first_key_value()
-        .filter(|_| consultations.len() == 1 && !consultations.is_empty())
-        .ok_or(EvidenceError::RuleEvaluationFailed)?;
-    let mut record: serde_json::Map<String, Value> = consultation
-        .outputs
-        .keys()
-        .map(|name| (name.clone(), Value::Null))
-        .collect();
-    record.insert("matched".to_string(), Value::Bool(false));
-    record.insert("outcome".to_string(), Value::String("no_match".to_string()));
-    Ok(BTreeMap::from([(
-        consultation_name.clone(),
-        Value::Object(record),
-    )]))
-}
-
-fn registry_claim_has_typed_outputs(claim: &ClaimDefinition) -> bool {
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-        return false;
-    };
-    consultations
-        .first_key_value()
-        .is_some_and(|(_, consultation)| !consultation.outputs.is_empty())
-}
diff --git a/crates/registry-notary-server/src/runtime/render.rs b/crates/registry-notary-server/src/runtime/render.rs
deleted file mode 100644
index 678060796..000000000
--- a/crates/registry-notary-server/src/runtime/render.rs
+++ /dev/null
@@ -1,694 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-
-pub(super) fn render_results(
-    evidence: &EvidenceConfig,
-    results: &[ClaimResultView],
-    format: &str,
-) -> Result<Value, EvidenceError> {
-    match format {
-        FORMAT_CLAIM_RESULT_JSON => Ok(json!({ "results": results })),
-        FORMAT_CCCEV_JSONLD => Ok(render_cccev(evidence, results)),
-        FORMAT_SD_JWT_VC => Err(EvidenceError::FormatUnsupported),
-        _ => Err(EvidenceError::FormatUnsupported),
-    }
-}
-
-pub(super) fn render_cccev(config: &EvidenceConfig, results: &[ClaimResultView]) -> Value {
-    let evidence_nodes = results
-        .iter()
-        .map(|result| render_cccev_evidence_node(config, result))
-        .collect::<Vec<_>>();
-    json!({
-        "@context": {
-            "cccev": "http://data.europa.eu/m8g/",
-            "dcterms": "http://purl.org/dc/terms/",
-            "foaf": "http://xmlns.com/foaf/0.1/",
-            "time": "http://www.w3.org/2006/time#",
-            "xsd": "http://www.w3.org/2001/XMLSchema#",
-            "cccev:isProvidedBy": { "@type": "@id" },
-            "cccev:supportsRequirement": { "@type": "@id" },
-            "cccev:supportsValue": { "@type": "@id" },
-            "cccev:providesValueFor": { "@type": "@id" },
-            "cccev:validityPeriod": { "@type": "@id" },
-            "time:hasBeginning": { "@type": "xsd:dateTime" },
-            "time:hasEnd": { "@type": "xsd:dateTime" }
-        },
-        "@graph": evidence_nodes
-    })
-}
-
-pub(super) fn render_cccev_evidence_node(
-    config: &EvidenceConfig,
-    result: &ClaimResultView,
-) -> Value {
-    let evidence_id = format!(
-        "urn:registry-notary:evidence-render:{}:{}",
-        result.evaluation_id, result.claim_id
-    );
-    let value_id = format!("{evidence_id}#value");
-    let period_id = format!("{evidence_id}#validity");
-
-    // Look up the requirement IRI from the claim's oots config when present.
-    // Fall back to a urn: reference so the output is always valid JSON-LD.
-    let requirement_iri = config
-        .claims
-        .iter()
-        .find(|claim| claim.id == result.claim_id && claim.version == result.claim_version)
-        .and_then(|c| c.oots.as_ref())
-        .and_then(|o| o.requirement.as_deref())
-        .map(|iri| json!({ "@id": iri }))
-        .unwrap_or_else(|| json!({ "@id": format!("urn:claim:{}", result.claim_id) }));
-
-    // Build the issuing authority as an Agent node using the service_id from
-    // the provenance `generated_by` block (which replaced `computed_by`).
-    let provided_by = json!({
-        "@type": "foaf:Agent",
-        "dcterms:identifier": result.provenance.generated_by.service_id,
-    });
-
-    // Build the validity period from issued_at / expires_at.
-    let mut validity_period = json!({
-        "@id": period_id,
-        "@type": "time:ProperInterval",
-        "time:hasBeginning": { "@value": result.issued_at, "@type": "xsd:dateTime" },
-    });
-    if let Some(expires_at) = result.expires_at.as_deref() {
-        validity_period["time:hasEnd"] = json!({ "@value": expires_at, "@type": "xsd:dateTime" });
-    }
-
-    // Build the SupportedValue node with the claim's value.
-    let concept_iri = format!("urn:claim-concept:{}", result.claim_id);
-    let supports_value = json!({
-        "@id": value_id,
-        "@type": "cccev:SupportedValue",
-        "cccev:providesValueFor": {
-            "@id": concept_iri,
-            "@type": "cccev:InformationConcept",
-            "dcterms:identifier": result.claim_id,
-        },
-        "cccev:value": result.value,
-    });
-
-    let mut evidence_node = json!({
-        "@id": evidence_id,
-        "@type": "cccev:Evidence",
-        "dcterms:identifier": result.evaluation_id,
-        "cccev:isProvidedBy": provided_by,
-        "cccev:supportsRequirement": requirement_iri,
-        "cccev:supportsValue": supports_value,
-        "cccev:validityPeriod": validity_period,
-    });
-    if let Some(satisfied) = result.satisfied {
-        evidence_node["cccev:isConformantTo"] = json!(satisfied);
-    }
-    evidence_node
-}
-
-pub fn credential_profile_for<'a>(
-    config: &'a EvidenceConfig,
-    evaluation: &registry_notary_core::StoredEvaluation,
-    requested_profile: Option<&'a str>,
-) -> Result<(&'a str, &'a CredentialProfileConfig), EvidenceError> {
-    let claim_refs = evaluation.selected_claim_refs();
-    let claim_versions = requested_claim_versions(&claim_refs)?;
-    if let Some(profile_id) = requested_profile {
-        let profile = config
-            .credential_profiles
-            .get(profile_id)
-            .ok_or(EvidenceError::CredentialIssuerNotConfigured)?;
-        // The caller-supplied profile must also be on the allow-list of at
-        // least one claim in the evaluation. Without this check a client
-        // could mint a credential against a profile the claim never opted
-        // in to, bypassing per-claim policy.
-        let allowed = claim_refs
-            .iter()
-            .filter_map(|claim_ref| {
-                find_claim_for_selection(config, claim_ref, &claim_versions).ok()
-            })
-            .any(|claim| {
-                claim
-                    .credential_profiles
-                    .iter()
-                    .any(|allowed| allowed == profile_id)
-            });
-        if !allowed {
-            return Err(EvidenceError::CredentialIssuerNotConfigured);
-        }
-        return Ok((profile_id, profile));
-    }
-    for claim_ref in &claim_refs {
-        let claim = find_claim_for_selection(config, claim_ref, &claim_versions)?;
-        for profile_id in &claim.credential_profiles {
-            if let Some(profile) = config.credential_profiles.get(profile_id) {
-                return Ok((profile_id, profile));
-            }
-        }
-    }
-    Err(EvidenceError::CredentialIssuerNotConfigured)
-}
-
-/// Fail closed unless every credential fact currently resolves to one
-/// registry-backed claim. OID4VCI uses this before issuer or nonce access so a
-/// config assembled without the shared loader cannot recover a signing path.
-pub(crate) fn require_registry_backed_credential_claims(
-    evidence: &EvidenceConfig,
-    claim_ids: &[String],
-) -> Result<(), EvidenceError> {
-    if claim_ids.is_empty() || claim_ids.len() > MAX_CLAIM_DEPENDENCY_NODES_V1 {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    let mut seen = BTreeSet::new();
-    for claim_id in claim_ids {
-        if !seen.insert(claim_id.as_str()) {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-    }
-    let selected = claim_ids
-        .iter()
-        .map(|claim_id| ClaimRef::from(claim_id.as_str()))
-        .collect::<Vec<_>>();
-    let versions = requested_claim_versions(&selected)?;
-    let levels = build_claim_levels(evidence, &selected, &versions)
-        .map_err(|_| EvidenceError::EvaluationBindingMismatch)?;
-    for claim_id in levels.iter().flatten() {
-        if evidence
-            .claims
-            .iter()
-            .filter(|candidate| candidate.id.as_str() == claim_id.as_str())
-            .count()
-            != 1
-        {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-        let claim = find_claim_for_selection(evidence, claim_id.as_str(), &versions)
-            .map_err(|_| EvidenceError::EvaluationBindingMismatch)?;
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        };
-        if consultations.len() != 1 || claim.purpose.as_deref().is_none() {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-    }
-    Ok(())
-}
-
-/// Commit one compiler pin to the exact Relay execution and claim provenance
-/// observed during evaluation. This is an unkeyed integrity cross-binding for
-/// detecting partial stored-record mutation. It is not an authenticity anchor
-/// against an operator able to rewrite every committed field and the digest.
-pub(crate) fn issuance_execution_binding(
-    claim: &StoredIssuanceClaimProvenance,
-    consultation: &StoredIssuanceConsultationProvenance,
-    evaluation_id: &str,
-    issued_at: &str,
-    provenance: &ClaimProvenance,
-) -> Result<String, EvidenceError> {
-    sha256_canonical_json(&json!({
-        "schema": "registry.notary.issuance-execution-binding/v2",
-        "claim": {
-            "id": claim.claim_id,
-            "version": claim.claim_version,
-            "relay_profile_id": claim.relay_profile_id,
-            "relay_contract_hash": claim.relay_contract_hash,
-            "canonical_purpose": claim.canonical_purpose,
-            "result_content_binding": claim.result_content_binding,
-        },
-        "execution": {
-            "consultation_id": consultation.consultation_id,
-            "acquired_at": consultation.acquired_at,
-        },
-        "result": {
-            "evaluation_id": evaluation_id,
-            "issued_at": issued_at,
-            "provenance": provenance,
-        },
-    }))
-}
-
-/// Commit the complete issuance-facing result without copying its value into
-/// restricted provenance. Canonical JSON makes object member order irrelevant
-/// while preserving every nested value, array position, disclosure decision,
-/// target handle, and public provenance field.
-pub(crate) fn issuance_result_content_binding(
-    result: &ClaimResultView,
-) -> Result<String, EvidenceError> {
-    sha256_canonical_json(&json!({
-        "schema": "registry.notary.issuance-result-content/v1",
-        "result": result,
-    }))
-}
-
-fn valid_sha256_binding(value: &str) -> bool {
-    value.strip_prefix("sha256:").is_some_and(|hex| {
-        hex.len() == 64
-            && hex
-                .bytes()
-                .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
-    })
-}
-
-fn expected_issuance_claim_provenance(
-    evidence: &EvidenceConfig,
-    evaluation: &registry_notary_core::StoredEvaluation,
-    evaluation_id: &str,
-    claim_id: &str,
-    claim_version: &str,
-    relay_consultation_count: usize,
-) -> ClaimProvenance {
-    let mut provenance = ClaimProvenance::new(
-        evidence.service_id.clone(),
-        evaluation_id.to_string(),
-        claim_id.to_string(),
-        claim_version.to_string(),
-        ProvenanceUsed {
-            relay_consultation_count,
-        },
-    );
-    let policy = evaluation_policy_from_subject_access(evaluation.subject_access.as_ref());
-    provenance.generated_by.policy_id = policy.policy_id;
-    provenance.generated_by.policy_version = policy.policy_version;
-    provenance.generated_by.policy_hash = policy.policy_hash;
-    provenance
-}
-
-/// Verify the restricted Relay execution record before credential signing.
-///
-/// Public result provenance intentionally exposes only a consultation count.
-/// This verifier joins it to the private dependency-closure compiler pins and rejects
-/// legacy, incomplete, duplicated, extra, or tampered state before a signer,
-/// holder-proof replay store, credential id, or status store is touched.
-pub(crate) fn require_issuable_evaluation_provenance(
-    evidence: &EvidenceConfig,
-    evaluation_id: &str,
-    evaluation: &registry_notary_core::StoredEvaluation,
-) -> Result<(), EvidenceError> {
-    let selected = evaluation.selected_claim_refs();
-    let selected_ids = selected
-        .iter()
-        .map(|claim_ref| claim_ref.id.clone())
-        .collect::<Vec<_>>();
-    let result_ids = evaluation
-        .results
-        .iter()
-        .map(|result| result.claim_id.clone())
-        .collect::<Vec<_>>();
-    if selected.is_empty()
-        || selected.len() > MAX_CLAIM_DEPENDENCY_NODES_V1
-        || evaluation.claim_ids.len() != selected.len()
-        || evaluation.results.len() != selected.len()
-        || !crate::authz_details::exact_unique_string_set(&evaluation.claim_ids, &selected_ids)
-        || !crate::authz_details::exact_unique_string_set(&result_ids, &selected_ids)
-    {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    let stored = evaluation
-        .issuance_provenance
-        .as_ref()
-        .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-    if stored.claims.is_empty()
-        || stored.claims.len() > MAX_CLAIM_DEPENDENCY_NODES_V1
-        || stored.consultations.is_empty()
-        || stored.consultations.len() > MAX_CLAIM_DEPENDENCY_NODES_V1
-    {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-
-    let versions = requested_claim_versions(&selected)?;
-    let levels = build_claim_levels(evidence, &selected, &versions)
-        .map_err(|_| EvidenceError::EvaluationBindingMismatch)?;
-    let expected_claim_ids = levels.iter().flatten().collect::<BTreeSet<_>>();
-    if expected_claim_ids.len() != stored.claims.len() {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-
-    let mut private_claims = BTreeMap::new();
-    let mut private_consultations = BTreeMap::new();
-    for provenance in &stored.claims {
-        if private_claims
-            .insert(provenance.claim_id.as_str(), provenance)
-            .is_some()
-        {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-    }
-    for consultation in &stored.consultations {
-        let consultation_id = Ulid::from_string(&consultation.consultation_id)
-            .map_err(|_| EvidenceError::EvaluationBindingMismatch)?;
-        let acquired_at = OffsetDateTime::parse(&consultation.acquired_at, &Rfc3339)
-            .map_err(|_| EvidenceError::EvaluationBindingMismatch)?;
-        if consultation_id.to_string() != consultation.consultation_id
-            || format_time(acquired_at) != consultation.acquired_at
-            || private_consultations
-                .insert(
-                    consultation.consultation_id.as_str(),
-                    (consultation, acquired_at),
-                )
-                .is_some()
-        {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-    }
-
-    let mut referenced_consultations = BTreeSet::new();
-    for claim_id in &expected_claim_ids {
-        if evidence
-            .claims
-            .iter()
-            .filter(|candidate| candidate.id.as_str() == claim_id.as_str())
-            .count()
-            != 1
-        {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-        let claim = find_claim_for_selection(evidence, claim_id.as_str(), &versions)
-            .map_err(|_| EvidenceError::EvaluationBindingMismatch)?;
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        };
-        let (_, consultation) = consultations
-            .first_key_value()
-            .filter(|_| consultations.len() == 1)
-            .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-        if claim.purpose.as_deref() != Some(evaluation.purpose.as_str()) {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-        let private = private_claims
-            .get(claim_id.as_str())
-            .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-        let (private_consultation, _) = private_consultations
-            .get(private.consultation_id.as_str())
-            .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-        if private.claim_version != claim.version
-            || private.relay_profile_id != consultation.profile.id
-            || private.relay_contract_hash != consultation.profile.contract_hash
-            || private.canonical_purpose != evaluation.purpose
-            || !valid_sha256_binding(&private.result_content_binding)
-        {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-        let claim_levels =
-            build_claim_levels(evidence, &[ClaimRef::from(claim_id.as_str())], &versions)
-                .map_err(|_| EvidenceError::EvaluationBindingMismatch)?;
-        let claim_consultations = claim_levels
-            .iter()
-            .flatten()
-            .map(|dependency_id| {
-                private_claims
-                    .get(dependency_id.as_str())
-                    .map(|dependency| dependency.consultation_id.as_str())
-                    .ok_or(EvidenceError::EvaluationBindingMismatch)
-            })
-            .collect::<Result<BTreeSet<_>, _>>()?;
-        let expected_provenance = expected_issuance_claim_provenance(
-            evidence,
-            evaluation,
-            evaluation_id,
-            claim_id,
-            &claim.version,
-            claim_consultations.len(),
-        );
-        let expected_binding = issuance_execution_binding(
-            private,
-            private_consultation,
-            evaluation_id,
-            &private_consultation.acquired_at,
-            &expected_provenance,
-        )?;
-        if private.execution_binding != expected_binding {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-        referenced_consultations.insert(private.consultation_id.as_str());
-    }
-    if referenced_consultations.len() != private_consultations.len() {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-
-    for claim_ref in &selected {
-        let selected_claim = find_claim_for_selection(evidence, claim_ref, &versions)
-            .map_err(|_| EvidenceError::EvaluationBindingMismatch)?;
-        let root_private = private_claims
-            .get(claim_ref.id.as_str())
-            .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-        let (_, root_acquired_at) = private_consultations
-            .get(root_private.consultation_id.as_str())
-            .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-        let (root_consultation, _) = private_consultations
-            .get(root_private.consultation_id.as_str())
-            .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-        let root_levels = build_claim_levels(evidence, std::slice::from_ref(claim_ref), &versions)
-            .map_err(|_| EvidenceError::EvaluationBindingMismatch)?;
-        let root_consultations = root_levels
-            .iter()
-            .flatten()
-            .map(|claim_id| {
-                private_claims
-                    .get(claim_id.as_str())
-                    .map(|private| private.consultation_id.as_str())
-                    .ok_or(EvidenceError::EvaluationBindingMismatch)
-            })
-            .collect::<Result<BTreeSet<_>, _>>()?;
-
-        let result = evaluation
-            .results
-            .iter()
-            .find(|result| result.claim_id == claim_ref.id)
-            .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-        if let RuleConfig::ConsultationOutput { output, .. } = &selected_claim.rule {
-            let ClaimEvidenceMode::RegistryBacked { consultations } = &selected_claim.evidence_mode
-            else {
-                return Err(EvidenceError::EvaluationBindingMismatch);
-            };
-            let output_contract = consultations
-                .first_key_value()
-                .filter(|_| consultations.len() == 1)
-                .and_then(|(_, consultation)| consultation.outputs.get(output))
-                .ok_or(EvidenceError::EvaluationBindingMismatch)?;
-            if matches!(
-                output_contract,
-                registry_notary_core::RelayOutputContract::Object { .. }
-                    | registry_notary_core::RelayOutputContract::Array { .. }
-            ) && (result
-                .value
-                .as_ref()
-                .is_none_or(|value| !output_contract.validates_value(value))
-                || !result.redacted_fields.is_empty())
-            {
-                return Err(EvidenceError::EvaluationBindingMismatch);
-            }
-        }
-        let generated = &result.provenance.generated_by;
-        let result_issued_at = OffsetDateTime::parse(&result.issued_at, &Rfc3339)
-            .map_err(|_| EvidenceError::EvaluationBindingMismatch)?;
-        let result_binding = issuance_execution_binding(
-            root_private,
-            root_consultation,
-            evaluation_id,
-            &result.issued_at,
-            &result.provenance,
-        )?;
-        let result_content_binding = issuance_result_content_binding(result)?;
-        if result.evaluation_id != evaluation_id
-            || result.claim_version != selected_claim.version
-            || result_issued_at != *root_acquired_at
-            || result.provenance.schema_version
-                != registry_notary_core::CLAIM_PROVENANCE_SCHEMA_VERSION
-            || generated.entry_type
-                != registry_notary_core::PROVENANCE_GENERATED_BY_CLAIM_EVALUATION
-            || generated.service_id != evidence.service_id
-            || generated.evaluation_id != evaluation_id
-            || generated.claim_id != claim_ref.id
-            || generated.claim_version != selected_claim.version
-            || result.provenance.used.relay_consultation_count != root_consultations.len()
-            || result_content_binding != root_private.result_content_binding
-            || result_binding != root_private.execution_binding
-        {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-    }
-
-    Ok(())
-}
-
-pub fn format_time(value: OffsetDateTime) -> String {
-    value
-        .format(&Rfc3339)
-        .expect("OffsetDateTime within supported RFC3339 range")
-}
-
-pub(crate) fn target_ref_view(
-    subject_access_rate_keys: &SubjectAccessRateLimitKeys,
-    target: &EvidenceEntity,
-) -> Result<TargetRefView, EvidenceError> {
-    let entity_ref = entity_ref_view(subject_access_rate_keys, "target", target)?;
-    Ok(TargetRefView {
-        entity_type: entity_ref.entity_type,
-        handle: entity_ref.handle,
-        identifier_schemes: entity_ref.identifier_schemes,
-        profile: entity_ref.profile,
-    })
-}
-
-/// Commit the complete opaque target reference together with the canonical
-/// identity used by authorization details. `id` is reserved for the
-/// top-level `EvidenceEntity.id`; identifier schemes must use their real
-/// scheme names so the two representations cannot alias.
-pub(crate) fn issuance_authorization_target_binding(
-    subject_access_rate_keys: &SubjectAccessRateLimitKeys,
-    target_ref: &TargetRefView,
-    id_type: &str,
-    id: &str,
-) -> Result<String, EvidenceError> {
-    if id_type.trim().is_empty() || id.trim().is_empty() {
-        return Err(EvidenceError::EvaluationBindingMismatch);
-    }
-    let canonical_input = serde_json::to_string(&json!({
-        "schema": "registry.notary.private-issuance-authorization-target/v1",
-        "target_ref": target_ref,
-        "primary_identity": {
-            "id_type": id_type,
-            "id": id,
-        },
-    }))
-    .map_err(|_| EvidenceError::EvaluationBindingMismatch)?;
-    subject_access_rate_keys
-        .audit_pseudonym_ref(
-            "oid4vci-issuance-authorization-target-binding-v1",
-            &canonical_input,
-        )
-        .map(|binding| binding.as_str().to_string())
-        .map_err(|error| error.evidence_error())
-}
-
-pub(super) fn entity_ref_view(
-    subject_access_rate_keys: &SubjectAccessRateLimitKeys,
-    role: &str,
-    entity: &EvidenceEntity,
-) -> Result<EvidenceEntityRef, EvidenceError> {
-    let stable_input = serde_json::json!({
-        "role": role,
-        "type": entity.entity_type,
-        "id": entity.id,
-        "identifiers": entity.identifiers,
-        "attributes": entity.attributes,
-    })
-    .to_string();
-    let hash = subject_access_rate_keys
-        .subject_ref(role, &stable_input)
-        .map_err(|error| error.evidence_error())?;
-    let mut identifier_schemes: Vec<String> = entity
-        .identifiers
-        .iter()
-        .map(|identifier| identifier.scheme.clone())
-        .collect();
-    identifier_schemes.sort();
-    identifier_schemes.dedup();
-    Ok(EvidenceEntityRef {
-        entity_type: entity.entity_type.clone(),
-        handle: format!("rnref:v1:{}", hash.as_str()),
-        identifier_schemes,
-        profile: None,
-    })
-}
-
-pub(super) fn batch_claim_result(
-    evidence: &EvidenceConfig,
-    result: &ClaimResultView,
-) -> Result<BatchClaimResultView, EvidenceError> {
-    let claim = find_claim(evidence, &result.claim_id)?;
-    Ok(BatchClaimResultView {
-        result_id: Ulid::new().to_string(),
-        claim_id: result.claim_id.clone(),
-        claim_version: result.claim_version.clone(),
-        value_type: batch_value_type(claim, result),
-        value: result.value.clone(),
-        satisfied: result.satisfied,
-        disclosure: result.disclosure.clone(),
-        provenance: result.provenance.clone(),
-    })
-}
-
-pub(super) fn batch_value_type(claim: &ClaimDefinition, result: &ClaimResultView) -> String {
-    if !claim.value.value_type.is_empty() {
-        return claim.value.value_type.clone();
-    }
-    match result.value.as_ref() {
-        Some(Value::Bool(_)) => "boolean",
-        Some(Value::Number(_)) => "number",
-        Some(Value::String(_)) => "string",
-        Some(Value::Array(_)) => "array",
-        Some(Value::Object(_)) => "object",
-        Some(Value::Null) | None => "unknown",
-    }
-    .to_string()
-}
-
-pub(super) fn batch_item_error(error: &EvidenceError) -> BatchItemError {
-    BatchItemError {
-        code: error.code().to_string(),
-        title: evidence_title(error).to_string(),
-        retryable: false,
-        audit_code: Some(error.audit_code().to_string()),
-    }
-}
-
-pub(super) fn stored_disclosure(results: &[ClaimResultView]) -> String {
-    let Some(first) = results.first() else {
-        return "redacted".to_string();
-    };
-    if results
-        .iter()
-        .all(|result| result.disclosure == first.disclosure)
-    {
-        first.disclosure.clone()
-    } else {
-        "mixed".to_string()
-    }
-}
-
-pub(super) fn hash_json<T: serde::Serialize>(value: &T) -> Result<String, EvidenceError> {
-    let bytes = serde_json::to_vec(value).map_err(|_| EvidenceError::InvalidRequest)?;
-    Ok(sha256_hex(&bytes))
-}
-
-pub(crate) fn batch_request_binding_hash(
-    evidence: &EvidenceConfig,
-    request: &BatchEvaluateRequest,
-    principal: &EvidencePrincipal,
-    effective_item_purposes: &[String],
-    claim_versions: &ClaimVersionSelections,
-) -> Result<String, EvidenceError> {
-    let checked_scopes = principal
-        .scopes
-        .iter()
-        .cloned()
-        .collect::<BTreeSet<_>>()
-        .into_iter()
-        .collect::<Vec<_>>();
-    hash_json(&json!({
-        "schema": "registry.notary.batch-idempotency-binding/v1",
-        "evidence_config": evidence,
-        "request": request,
-        "authentication": {
-            "auth_profile_id": principal.auth_profile_id.as_str(),
-            "principal_id": principal.principal_id.as_str(),
-            "checked_scopes": checked_scopes,
-        },
-        "effective_item_purposes": effective_item_purposes,
-        "claim_versions": claim_versions,
-    }))
-}
-
-pub(crate) fn batch_idempotency_key(principal_id: &str, key: &str) -> String {
-    format!(
-        "{}:/v1/batch-evaluations:{}",
-        principal_id,
-        sha256_hex(key.as_bytes())
-    )
-}
-
-pub(super) fn sha256_hex(bytes: &[u8]) -> String {
-    use sha2::{Digest, Sha256};
-    hex_encode(&Sha256::digest(bytes))
-}
diff --git a/crates/registry-notary-server/src/runtime/store.rs b/crates/registry-notary-server/src/runtime/store.rs
deleted file mode 100644
index c9a246939..000000000
--- a/crates/registry-notary-server/src/runtime/store.rs
+++ /dev/null
@@ -1,1309 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use std::{collections::HashMap, fmt, sync::Arc};
-
-use sha2::{Digest, Sha256};
-
-use super::*;
-use crate::state_plane::NotaryStatePlaneHandle;
-
-const BATCH_IDEMPOTENCY_RETENTION: time::Duration = time::Duration::minutes(15);
-const BATCH_OWNER_LEASE_SECONDS: i32 = 30;
-const BATCH_OWNER_HEARTBEAT_SECONDS: u64 = 10;
-const BATCH_WAIT_INITIAL_MILLIS: u64 = 50;
-const BATCH_WAIT_MAX_MILLIS: u64 = 1_000;
-// Version 2 adopts the pre-1.0 subject-access vocabulary in persisted
-// evaluation and idempotency response envelopes. Records written before the
-// delegated-subject-access terminology change remain version 2, so reads
-// normalize that one retired access-mode spelling before strict decoding.
-// Version 1 used the removed subject-access field and is intentionally not
-// accepted by the clean 1.0 storage contract.
-const STORED_RECORD_VERSION: i16 = 2;
-const LEGACY_DELEGATED_ACCESS_MODE: &str = "delegated_attestation";
-const DELEGATED_SUBJECT_ACCESS_MODE: &str = "delegated_subject_access";
-
-#[cfg(all(test, feature = "registry-notary-cel"))]
-type EvaluationReadTamper =
-    Box<dyn FnOnce(&mut registry_notary_core::StoredEvaluation) + Send + 'static>;
-
-enum IdempotencyRecord {
-    InFlight {
-        request_hash: String,
-        quota_charged: bool,
-        wake: tokio::sync::watch::Sender<bool>,
-    },
-    Completed {
-        request_hash: String,
-        response: BatchEvaluateResponse,
-        expires_at: OffsetDateTime,
-    },
-    Failed {
-        request_hash: String,
-        quota_charged: bool,
-        expires_at: OffsetDateTime,
-    },
-}
-
-impl IdempotencyRecord {
-    fn request_hash(&self) -> &str {
-        match self {
-            Self::InFlight { request_hash, .. }
-            | Self::Completed { request_hash, .. }
-            | Self::Failed { request_hash, .. } => request_hash,
-        }
-    }
-
-    fn retained_at(&self, now: OffsetDateTime) -> bool {
-        match self {
-            Self::InFlight { .. } => true,
-            Self::Completed { expires_at, .. } | Self::Failed { expires_at, .. } => {
-                *expires_at > now
-            }
-        }
-    }
-}
-
-pub struct EvidenceStore {
-    state_plane: Option<Arc<NotaryStatePlaneHandle>>,
-    evaluations: Mutex<HashMap<String, registry_notary_core::StoredEvaluation>>,
-    idempotency: Mutex<HashMap<String, IdempotencyRecord>>,
-    #[cfg(all(test, feature = "registry-notary-cel"))]
-    next_read_tamper: Mutex<Option<EvaluationReadTamper>>,
-}
-
-impl Default for EvidenceStore {
-    fn default() -> Self {
-        Self {
-            state_plane: None,
-            evaluations: Mutex::new(HashMap::new()),
-            idempotency: Mutex::new(HashMap::new()),
-            #[cfg(all(test, feature = "registry-notary-cel"))]
-            next_read_tamper: Mutex::new(None),
-        }
-    }
-}
-
-impl fmt::Debug for EvidenceStore {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("EvidenceStore")
-            .field("postgresql", &self.postgres_state_plane().is_some())
-            .finish_non_exhaustive()
-    }
-}
-
-pub(super) enum BatchIdempotencyReservation<'a> {
-    Owner(BatchIdempotencyOwner<'a>),
-    Replay(BatchEvaluateResponse),
-}
-
-enum BatchIdempotencyOwnerBackend<'a> {
-    InMemory {
-        store: &'a EvidenceStore,
-        key: String,
-        request_hash: String,
-        wake: tokio::sync::watch::Sender<bool>,
-    },
-    Postgresql {
-        state_plane: Arc<NotaryStatePlaneHandle>,
-        key_hash: Vec<u8>,
-        request_hash: Vec<u8>,
-        owner_token: Vec<u8>,
-        heartbeat: tokio::task::JoinHandle<()>,
-    },
-}
-
-pub(super) struct BatchIdempotencyOwner<'a> {
-    backend: Option<BatchIdempotencyOwnerBackend<'a>>,
-    quota_charged: bool,
-    completed: bool,
-}
-
-impl BatchIdempotencyOwner<'_> {
-    pub(super) fn quota_charged(&self) -> bool {
-        self.quota_charged
-    }
-
-    pub(super) fn mark_quota_charged(&mut self) -> Result<(), EvidenceError> {
-        if self.quota_charged {
-            return Ok(());
-        }
-        let Some(backend) = self.backend.as_ref() else {
-            return Err(EvidenceError::RuleEvaluationFailed);
-        };
-        let BatchIdempotencyOwnerBackend::InMemory {
-            store,
-            key,
-            request_hash,
-            wake,
-        } = backend
-        else {
-            return Err(EvidenceError::RuleEvaluationFailed);
-        };
-        let mut records = store
-            .idempotency
-            .lock()
-            .expect("evidence idempotency mutex is not poisoned");
-        match records.get_mut(key) {
-            Some(IdempotencyRecord::InFlight {
-                request_hash: current_hash,
-                quota_charged,
-                wake: current_wake,
-            }) if current_hash == request_hash && current_wake.same_channel(wake) => {
-                *quota_charged = true;
-            }
-            _ => return Err(EvidenceError::RuleEvaluationFailed),
-        }
-        self.quota_charged = true;
-        Ok(())
-    }
-
-    pub(super) fn abandon_uncharged(mut self) -> Result<(), EvidenceError> {
-        if self.quota_charged {
-            return Err(EvidenceError::RuleEvaluationFailed);
-        }
-        let wake = {
-            let Some(BatchIdempotencyOwnerBackend::InMemory {
-                store,
-                key,
-                request_hash,
-                wake,
-            }) = self.backend.as_ref()
-            else {
-                return Err(EvidenceError::RuleEvaluationFailed);
-            };
-            let mut records = store
-                .idempotency
-                .lock()
-                .expect("evidence idempotency mutex is not poisoned");
-            let matches_owner = matches!(
-                records.get(key),
-                Some(IdempotencyRecord::InFlight {
-                    request_hash: current_hash,
-                    quota_charged: false,
-                    wake: current_wake,
-                }) if current_hash == request_hash && current_wake.same_channel(wake)
-            );
-            if !matches_owner {
-                return Err(EvidenceError::RuleEvaluationFailed);
-            }
-            records.remove(key);
-            wake.clone()
-        };
-        self.backend.take();
-        self.completed = true;
-        wake.send_replace(true);
-        Ok(())
-    }
-
-    pub(super) async fn complete(
-        mut self,
-        response: BatchEvaluateResponse,
-        evaluations: Vec<registry_notary_core::StoredEvaluation>,
-    ) -> Result<BatchEvaluateResponse, EvidenceError> {
-        let backend = self
-            .backend
-            .take()
-            .ok_or(EvidenceError::RuleEvaluationFailed)?;
-        let result = match backend {
-            BatchIdempotencyOwnerBackend::InMemory {
-                store,
-                key,
-                request_hash,
-                wake,
-            } => {
-                let mut records = store
-                    .idempotency
-                    .lock()
-                    .expect("evidence idempotency mutex is not poisoned");
-                let matches_owner = matches!(
-                    records.get(&key),
-                    Some(IdempotencyRecord::InFlight {
-                        request_hash: current_hash,
-                        wake: current_wake,
-                        ..
-                    }) if current_hash == &request_hash && current_wake.same_channel(&wake)
-                );
-                if !matches_owner {
-                    Err(EvidenceError::RuleEvaluationFailed)
-                } else {
-                    for evaluation in evaluations {
-                        store.insert_in_memory(evaluation);
-                    }
-                    records.insert(
-                        key,
-                        IdempotencyRecord::Completed {
-                            request_hash,
-                            response: response.clone(),
-                            expires_at: OffsetDateTime::now_utc() + BATCH_IDEMPOTENCY_RETENTION,
-                        },
-                    );
-                    drop(records);
-                    wake.send_replace(true);
-                    Ok(response)
-                }
-            }
-            BatchIdempotencyOwnerBackend::Postgresql {
-                state_plane,
-                key_hash,
-                request_hash,
-                owner_token,
-                heartbeat,
-            } => {
-                heartbeat.abort();
-                let completion = complete_postgres_batch(
-                    &state_plane,
-                    &key_hash,
-                    &request_hash,
-                    &owner_token,
-                    &evaluations,
-                    &response,
-                )
-                .await;
-                if completion.is_err() {
-                    spawn_postgres_batch_failure(state_plane, key_hash, request_hash, owner_token);
-                }
-                completion.map(|()| response)
-            }
-        };
-        if result.is_ok() {
-            self.completed = true;
-        }
-        result
-    }
-}
-
-impl Drop for BatchIdempotencyOwner<'_> {
-    fn drop(&mut self) {
-        if self.completed {
-            return;
-        }
-        let Some(backend) = self.backend.take() else {
-            return;
-        };
-        match backend {
-            BatchIdempotencyOwnerBackend::InMemory {
-                store,
-                key,
-                request_hash,
-                wake,
-            } => {
-                let mut records = store
-                    .idempotency
-                    .lock()
-                    .expect("evidence idempotency mutex is not poisoned");
-                let matches_owner = matches!(
-                    records.get(&key),
-                    Some(IdempotencyRecord::InFlight {
-                        request_hash: current_hash,
-                        wake: current_wake,
-                        ..
-                    }) if current_hash == &request_hash && current_wake.same_channel(&wake)
-                );
-                if matches_owner {
-                    records.insert(
-                        key,
-                        IdempotencyRecord::Failed {
-                            request_hash,
-                            quota_charged: self.quota_charged,
-                            expires_at: OffsetDateTime::now_utc() + BATCH_IDEMPOTENCY_RETENTION,
-                        },
-                    );
-                }
-                drop(records);
-                wake.send_replace(true);
-            }
-            BatchIdempotencyOwnerBackend::Postgresql {
-                state_plane,
-                key_hash,
-                request_hash,
-                owner_token,
-                heartbeat,
-            } => {
-                heartbeat.abort();
-                spawn_postgres_batch_failure(state_plane, key_hash, request_hash, owner_token);
-            }
-        }
-    }
-}
-
-impl EvidenceStore {
-    #[cfg(test)]
-    pub(super) fn in_memory_evaluation_count(&self) -> usize {
-        self.evaluations
-            .lock()
-            .expect("evidence store mutex is not poisoned")
-            .len()
-    }
-
-    #[must_use]
-    pub(crate) fn with_state_plane(state_plane: Arc<NotaryStatePlaneHandle>) -> Self {
-        Self {
-            state_plane: Some(state_plane),
-            ..Self::default()
-        }
-    }
-
-    pub async fn insert(
-        &self,
-        evaluation: registry_notary_core::StoredEvaluation,
-    ) -> Result<(), EvidenceError> {
-        let Some(state_plane) = self.postgres_state_plane() else {
-            self.insert_in_memory(evaluation);
-            return Ok(());
-        };
-        insert_postgres_evaluation(state_plane, &evaluation).await
-    }
-
-    pub async fn get(
-        &self,
-        evaluation_id: &str,
-        client_id: &str,
-    ) -> Result<Option<registry_notary_core::StoredEvaluation>, EvidenceError> {
-        let Some(state_plane) = self.postgres_state_plane() else {
-            return Ok(self.get_in_memory(evaluation_id, client_id));
-        };
-        get_postgres_evaluation(state_plane, evaluation_id, client_id).await
-    }
-
-    /// Install a one-shot in-memory read mutation for issuance tamper tests.
-    /// Production builds have no corresponding hook.
-    #[cfg(all(test, feature = "registry-notary-cel"))]
-    pub(crate) fn tamper_next_read(
-        &self,
-        tamper: impl FnOnce(&mut registry_notary_core::StoredEvaluation) + Send + 'static,
-    ) {
-        *self
-            .next_read_tamper
-            .lock()
-            .expect("evidence read-tamper mutex is not poisoned") = Some(Box::new(tamper));
-    }
-
-    pub(super) async fn reserve_idempotent_batch(
-        &self,
-        key: String,
-        request_hash: String,
-        principal_id: &str,
-        quota: Option<(&crate::MachineQuotaLimiter, u32)>,
-    ) -> Result<BatchIdempotencyReservation<'_>, EvidenceError> {
-        let Some(state_plane) = self.postgres_state_plane() else {
-            return self.reserve_in_memory_batch(key, request_hash).await;
-        };
-        reserve_postgres_batch(state_plane, key, request_hash, principal_id, quota).await
-    }
-
-    fn postgres_state_plane(&self) -> Option<&Arc<NotaryStatePlaneHandle>> {
-        self.state_plane
-            .as_ref()
-            .filter(|state_plane| !state_plane.is_in_memory())
-    }
-
-    fn insert_in_memory(&self, evaluation: registry_notary_core::StoredEvaluation) {
-        let now = OffsetDateTime::now_utc();
-        let mut evaluations = self
-            .evaluations
-            .lock()
-            .expect("evidence store mutex is not poisoned");
-        evaluations.retain(|_, evaluation| {
-            OffsetDateTime::parse(&evaluation.expires_at, &Rfc3339)
-                .is_ok_and(|expires_at| expires_at > now)
-        });
-        let Some(first) = evaluation.results.first() else {
-            return;
-        };
-        evaluations.insert(first.evaluation_id.clone(), evaluation);
-    }
-
-    fn get_in_memory(
-        &self,
-        evaluation_id: &str,
-        client_id: &str,
-    ) -> Option<registry_notary_core::StoredEvaluation> {
-        let evaluation = self
-            .evaluations
-            .lock()
-            .expect("evidence store mutex is not poisoned")
-            .get(evaluation_id)
-            .filter(|evaluation| evaluation.client_id == client_id)
-            .cloned()?;
-        #[cfg(all(test, feature = "registry-notary-cel"))]
-        let mut evaluation = evaluation;
-        #[cfg(all(test, feature = "registry-notary-cel"))]
-        if let Some(tamper) = self
-            .next_read_tamper
-            .lock()
-            .expect("evidence read-tamper mutex is not poisoned")
-            .take()
-        {
-            tamper(&mut evaluation);
-        }
-        let expires_at = OffsetDateTime::parse(&evaluation.expires_at, &Rfc3339).ok()?;
-        (expires_at > OffsetDateTime::now_utc()).then_some(evaluation)
-    }
-
-    async fn reserve_in_memory_batch(
-        &self,
-        key: String,
-        request_hash: String,
-    ) -> Result<BatchIdempotencyReservation<'_>, EvidenceError> {
-        loop {
-            let mut notification = {
-                let now = OffsetDateTime::now_utc();
-                let mut records = self
-                    .idempotency
-                    .lock()
-                    .expect("evidence idempotency mutex is not poisoned");
-                records.retain(|_, record| record.retained_at(now));
-                match records.get(&key) {
-                    None => {
-                        let (wake, _) = tokio::sync::watch::channel(false);
-                        records.insert(
-                            key.clone(),
-                            IdempotencyRecord::InFlight {
-                                request_hash: request_hash.clone(),
-                                quota_charged: false,
-                                wake: wake.clone(),
-                            },
-                        );
-                        return Ok(BatchIdempotencyReservation::Owner(BatchIdempotencyOwner {
-                            backend: Some(BatchIdempotencyOwnerBackend::InMemory {
-                                store: self,
-                                key,
-                                request_hash,
-                                wake,
-                            }),
-                            quota_charged: false,
-                            completed: false,
-                        }));
-                    }
-                    Some(record) if record.request_hash() != request_hash => {
-                        return Err(EvidenceError::IdempotencyConflict);
-                    }
-                    Some(IdempotencyRecord::Completed { response, .. }) => {
-                        return Ok(BatchIdempotencyReservation::Replay(response.clone()));
-                    }
-                    Some(IdempotencyRecord::Failed { quota_charged, .. }) => {
-                        let quota_charged = *quota_charged;
-                        let (wake, _) = tokio::sync::watch::channel(false);
-                        records.insert(
-                            key.clone(),
-                            IdempotencyRecord::InFlight {
-                                request_hash: request_hash.clone(),
-                                quota_charged,
-                                wake: wake.clone(),
-                            },
-                        );
-                        return Ok(BatchIdempotencyReservation::Owner(BatchIdempotencyOwner {
-                            backend: Some(BatchIdempotencyOwnerBackend::InMemory {
-                                store: self,
-                                key,
-                                request_hash,
-                                wake,
-                            }),
-                            quota_charged,
-                            completed: false,
-                        }));
-                    }
-                    Some(IdempotencyRecord::InFlight { wake, .. }) => wake.subscribe(),
-                }
-            };
-            notification
-                .changed()
-                .await
-                .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-        }
-    }
-}
-
-async fn insert_postgres_evaluation(
-    state_plane: &NotaryStatePlaneHandle,
-    evaluation: &registry_notary_core::StoredEvaluation,
-) -> Result<(), EvidenceError> {
-    let evaluation_id = evaluation
-        .results
-        .first()
-        .map(|result| result.evaluation_id.as_str())
-        .ok_or(EvidenceError::RuleEvaluationFailed)?;
-    let created_at = parse_stored_time(&evaluation.created_at)?;
-    let expires_at = parse_stored_time(&evaluation.expires_at)?;
-    let record_json = postgres_evaluation_record_json(evaluation)?;
-    let client_id_hash = state_hash("evaluation-client", &evaluation.client_id);
-    let request_hash = state_hash("evaluation-request", &evaluation.request_hash);
-    let runtime = state_plane
-        .runtime()
-        .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-    let session = runtime
-        .open_domain_session()
-        .await
-        .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-    let row = session
-        .run_operation(session.client().query_one(
-            concat!(
-                "SELECT registry_notary_api.evaluation_insert_v1(",
-                "$1, $2, $3, $4, $5, $6::text::jsonb, $7, $8) AS inserted"
-            ),
-            &[
-                &evaluation_id,
-                &client_id_hash,
-                &request_hash,
-                &evaluation.purpose,
-                &STORED_RECORD_VERSION,
-                &record_json,
-                &created_at,
-                &expires_at,
-            ],
-        ))
-        .await
-        .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-    match row.try_get::<_, bool>("inserted") {
-        Ok(true) => Ok(()),
-        _ => Err(EvidenceError::RuleEvaluationFailed),
-    }
-}
-
-async fn get_postgres_evaluation(
-    state_plane: &NotaryStatePlaneHandle,
-    evaluation_id: &str,
-    client_id: &str,
-) -> Result<Option<registry_notary_core::StoredEvaluation>, EvidenceError> {
-    let client_id_hash = state_hash("evaluation-client", client_id);
-    let runtime = state_plane
-        .runtime()
-        .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-    let session = runtime
-        .open_domain_session()
-        .await
-        .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-    let row = session
-        .run_operation(session.client().query_opt(
-            concat!(
-                "SELECT record_version, record_json::text AS record_json ",
-                "FROM registry_notary_api.evaluation_get_v1($1, $2)"
-            ),
-            &[&evaluation_id, &client_id_hash],
-        ))
-        .await
-        .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-    let Some(row) = row else {
-        return Ok(None);
-    };
-    let version: i16 = row
-        .try_get("record_version")
-        .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-    if version != STORED_RECORD_VERSION {
-        return Err(EvidenceError::RuleEvaluationFailed);
-    }
-    let record_json: String = row
-        .try_get("record_json")
-        .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-    let mut evaluation = deserialize_stored_evaluation_v2(&record_json)?;
-    evaluation.client_id = client_id.to_owned();
-    Ok(Some(evaluation))
-}
-
-fn deserialize_stored_evaluation_v2(
-    record_json: &str,
-) -> Result<registry_notary_core::StoredEvaluation, EvidenceError> {
-    let mut record: serde_json::Value =
-        serde_json::from_str(record_json).map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-    if let Some(access_mode) = record
-        .get_mut("subject_access")
-        .and_then(serde_json::Value::as_object_mut)
-        .and_then(|subject_access| subject_access.get_mut("access_mode"))
-    {
-        if access_mode.as_str() == Some(LEGACY_DELEGATED_ACCESS_MODE) {
-            *access_mode = serde_json::Value::String(DELEGATED_SUBJECT_ACCESS_MODE.to_owned());
-        }
-    }
-    serde_json::from_value(record).map_err(|_| EvidenceError::RuleEvaluationFailed)
-}
-
-async fn reserve_postgres_batch<'a>(
-    state_plane: &Arc<NotaryStatePlaneHandle>,
-    key: String,
-    request_hash: String,
-    principal_id: &str,
-    quota: Option<(&crate::MachineQuotaLimiter, u32)>,
-) -> Result<BatchIdempotencyReservation<'a>, EvidenceError> {
-    let key_hash = state_hash("batch-idempotency-key", &key);
-    let request_hash = state_hash("batch-idempotency-request", &request_hash);
-    let owner_token = random_owner_token()?;
-    let (principal_hash, quota_limit, quota_cost) =
-        postgres_batch_quota_parameters(&key, principal_id, quota)?;
-    let mut wait_attempt = 0_u32;
-
-    loop {
-        let runtime = state_plane
-            .runtime()
-            .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-        let session = runtime
-            .open_domain_session()
-            .await
-            .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-        let row = session
-            .run_operation(session.client().query_one(
-                concat!(
-                    "SELECT outcome, retry_after_seconds, response_version, ",
-                    "response_json::text AS response_json ",
-                    "FROM registry_notary_api.batch_reserve_v1(",
-                    "$1, $2, $3, $4, $5, $6, $7)"
-                ),
-                &[
-                    &key_hash,
-                    &request_hash,
-                    &principal_hash,
-                    &owner_token,
-                    &BATCH_OWNER_LEASE_SECONDS,
-                    &quota_limit,
-                    &quota_cost,
-                ],
-            ))
-            .await
-            .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-        let outcome: String = row
-            .try_get("outcome")
-            .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-        match outcome.as_str() {
-            "owner" => {
-                let heartbeat = spawn_postgres_batch_heartbeat(
-                    Arc::clone(state_plane),
-                    key_hash.clone(),
-                    request_hash.clone(),
-                    owner_token.clone(),
-                );
-                return Ok(BatchIdempotencyReservation::Owner(BatchIdempotencyOwner {
-                    backend: Some(BatchIdempotencyOwnerBackend::Postgresql {
-                        state_plane: Arc::clone(state_plane),
-                        key_hash,
-                        request_hash,
-                        owner_token,
-                        heartbeat,
-                    }),
-                    quota_charged: quota_limit.is_some(),
-                    completed: false,
-                }));
-            }
-            "replay" => {
-                let response_version: Option<i16> = row
-                    .try_get("response_version")
-                    .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-                let response_json: Option<String> = row
-                    .try_get("response_json")
-                    .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-                if response_version != Some(STORED_RECORD_VERSION) {
-                    return Err(EvidenceError::RuleEvaluationFailed);
-                }
-                let response = serde_json::from_str(
-                    response_json
-                        .as_deref()
-                        .ok_or(EvidenceError::RuleEvaluationFailed)?,
-                )
-                .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-                return Ok(BatchIdempotencyReservation::Replay(response));
-            }
-            "conflict" => return Err(EvidenceError::IdempotencyConflict),
-            "quota_exceeded" => {
-                let retry_after_seconds: i64 = row
-                    .try_get("retry_after_seconds")
-                    .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-                return Err(EvidenceError::MachineQuotaExceeded {
-                    retry_after_seconds: retry_after_seconds.max(1) as u64,
-                });
-            }
-            "wait" => {
-                wait_for_postgres_batch_retry(
-                    session,
-                    postgres_batch_wait_delay(wait_attempt, &owner_token),
-                )
-                .await;
-                wait_attempt = wait_attempt.saturating_add(1);
-            }
-            _ => return Err(EvidenceError::RuleEvaluationFailed),
-        }
-    }
-}
-
-fn postgres_batch_quota_parameters(
-    key: &str,
-    principal_id: &str,
-    quota: Option<(&crate::MachineQuotaLimiter, u32)>,
-) -> Result<(Vec<u8>, Option<i32>, i32), EvidenceError> {
-    let Some((limiter, cost)) = quota.filter(|(limiter, _)| limiter.is_enabled()) else {
-        return Ok((
-            state_hash(
-                "batch-principal-fallback",
-                &format!("{key}\0{principal_id}"),
-            ),
-            None,
-            1,
-        ));
-    };
-    limiter
-        .batch_reservation_parameters(principal_id, cost)
-        .map_err(|error| EvidenceError::MachineQuotaExceeded {
-            retry_after_seconds: error.retry_after_seconds,
-        })
-}
-
-async fn wait_for_postgres_batch_retry<Session>(session: Session, delay: std::time::Duration) {
-    drop(session);
-    tokio::time::sleep(delay).await;
-}
-
-fn postgres_batch_wait_delay(attempt: u32, jitter_seed: &[u8]) -> std::time::Duration {
-    let mut hasher = Sha256::new();
-    hasher.update(b"batch-idempotency-wait");
-    hasher.update([0]);
-    hasher.update(jitter_seed);
-    hasher.update(attempt.to_le_bytes());
-    let digest = hasher.finalize();
-    let sample = u64::from_le_bytes(
-        digest[..8]
-            .try_into()
-            .expect("SHA-256 digest prefix is eight bytes"),
-    );
-    postgres_batch_wait_delay_from_sample(attempt, sample)
-}
-
-fn postgres_batch_wait_delay_from_sample(attempt: u32, sample: u64) -> std::time::Duration {
-    let multiplier = 1_u64 << attempt.min(63);
-    let ceiling_millis = BATCH_WAIT_INITIAL_MILLIS
-        .saturating_mul(multiplier)
-        .min(BATCH_WAIT_MAX_MILLIS);
-    let floor_millis = (ceiling_millis / 2).max(1);
-    let span = ceiling_millis - floor_millis + 1;
-    let jitter_millis = ((u128::from(sample) * u128::from(span)) >> 64) as u64;
-    std::time::Duration::from_millis(floor_millis + jitter_millis)
-}
-
-fn spawn_postgres_batch_heartbeat(
-    state_plane: Arc<NotaryStatePlaneHandle>,
-    key_hash: Vec<u8>,
-    request_hash: Vec<u8>,
-    owner_token: Vec<u8>,
-) -> tokio::task::JoinHandle<()> {
-    tokio::spawn(async move {
-        loop {
-            tokio::time::sleep(std::time::Duration::from_secs(
-                BATCH_OWNER_HEARTBEAT_SECONDS,
-            ))
-            .await;
-            let Ok(runtime) = state_plane.runtime() else {
-                return;
-            };
-            let Ok(session) = runtime.open_domain_session().await else {
-                return;
-            };
-            let Ok(row) = session
-                .run_operation(session.client().query_one(
-                    concat!(
-                        "SELECT registry_notary_api.batch_heartbeat_v1(",
-                        "$1, $2, $3, $4) AS renewed"
-                    ),
-                    &[
-                        &key_hash,
-                        &request_hash,
-                        &owner_token,
-                        &BATCH_OWNER_LEASE_SECONDS,
-                    ],
-                ))
-                .await
-            else {
-                return;
-            };
-            if !matches!(row.try_get::<_, bool>("renewed"), Ok(true)) {
-                return;
-            }
-        }
-    })
-}
-
-fn spawn_postgres_batch_failure(
-    state_plane: Arc<NotaryStatePlaneHandle>,
-    key_hash: Vec<u8>,
-    request_hash: Vec<u8>,
-    owner_token: Vec<u8>,
-) {
-    let Ok(runtime_handle) = tokio::runtime::Handle::try_current() else {
-        return;
-    };
-    runtime_handle.spawn(async move {
-        let Ok(runtime) = state_plane.runtime() else {
-            return;
-        };
-        let Ok(session) = runtime.open_domain_session().await else {
-            return;
-        };
-        let _ = session
-            .run_operation(session.client().query_one(
-                "SELECT registry_notary_api.batch_fail_v1($1, $2, $3) AS failed",
-                &[&key_hash, &request_hash, &owner_token],
-            ))
-            .await;
-    });
-}
-
-async fn complete_postgres_batch(
-    state_plane: &NotaryStatePlaneHandle,
-    key_hash: &[u8],
-    request_hash: &[u8],
-    owner_token: &[u8],
-    evaluations: &[registry_notary_core::StoredEvaluation],
-    response: &BatchEvaluateResponse,
-) -> Result<(), EvidenceError> {
-    let evaluation_json = postgres_batch_evaluations(evaluations)?;
-    let response_json =
-        serde_json::to_string(response).map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-    let runtime = state_plane
-        .runtime()
-        .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-    let session = runtime
-        .open_domain_session()
-        .await
-        .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-    let row = session
-        .run_operation(session.client().query_one(
-            concat!(
-                "SELECT registry_notary_api.batch_complete_v1(",
-                "$1, $2, $3, $4::text::jsonb, $5, $6::text::jsonb) AS completed"
-            ),
-            &[
-                &key_hash,
-                &request_hash,
-                &owner_token,
-                &evaluation_json,
-                &STORED_RECORD_VERSION,
-                &response_json,
-            ],
-        ))
-        .await
-        .map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-    if !matches!(row.try_get::<_, bool>("completed"), Ok(true)) {
-        return Err(EvidenceError::RuleEvaluationFailed);
-    }
-    Ok(())
-}
-
-fn postgres_batch_evaluations(
-    evaluations: &[registry_notary_core::StoredEvaluation],
-) -> Result<String, EvidenceError> {
-    let mut records = Vec::with_capacity(evaluations.len());
-    for evaluation in evaluations {
-        let evaluation_id = evaluation
-            .results
-            .first()
-            .map(|result| result.evaluation_id.as_str())
-            .ok_or(EvidenceError::RuleEvaluationFailed)?;
-        parse_stored_time(&evaluation.created_at)?;
-        parse_stored_time(&evaluation.expires_at)?;
-        let record_json = postgres_evaluation_record_json(evaluation)?;
-        let record: serde_json::Value =
-            serde_json::from_str(&record_json).map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-        records.push(serde_json::json!({
-            "evaluation_id": evaluation_id,
-            "client_id_hash_hex": hex_lower(&state_hash(
-                "evaluation-client",
-                &evaluation.client_id,
-            )),
-            "purpose": evaluation.purpose,
-            "record_version": STORED_RECORD_VERSION,
-            "record": record,
-            "created_at": evaluation.created_at,
-            "expires_at": evaluation.expires_at,
-        }));
-    }
-    serde_json::to_string(&records).map_err(|_| EvidenceError::RuleEvaluationFailed)
-}
-
-fn postgres_evaluation_record_json(
-    evaluation: &registry_notary_core::StoredEvaluation,
-) -> Result<String, EvidenceError> {
-    let mut record =
-        serde_json::to_value(evaluation).map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-    let object = record
-        .as_object_mut()
-        .ok_or(EvidenceError::RuleEvaluationFailed)?;
-    object.insert(
-        "client_id".to_owned(),
-        serde_json::Value::String(String::new()),
-    );
-    serde_json::to_string(&record).map_err(|_| EvidenceError::RuleEvaluationFailed)
-}
-
-fn parse_stored_time(value: &str) -> Result<OffsetDateTime, EvidenceError> {
-    OffsetDateTime::parse(value, &Rfc3339).map_err(|_| EvidenceError::RuleEvaluationFailed)
-}
-
-fn random_owner_token() -> Result<Vec<u8>, EvidenceError> {
-    let mut token = [0_u8; 32];
-    getrandom::fill(&mut token).map_err(|_| EvidenceError::RuleEvaluationFailed)?;
-    Ok(token.to_vec())
-}
-
-fn state_hash(domain: &str, value: &str) -> Vec<u8> {
-    let mut hasher = Sha256::new();
-    hasher.update(domain.as_bytes());
-    hasher.update([0]);
-    hasher.update(value.as_bytes());
-    hasher.finalize().to_vec()
-}
-
-fn hex_lower(bytes: &[u8]) -> String {
-    const HEX: &[u8; 16] = b"0123456789abcdef";
-    let mut output = String::with_capacity(bytes.len() * 2);
-    for byte in bytes {
-        output.push(HEX[(byte >> 4) as usize] as char);
-        output.push(HEX[(byte & 0x0f) as usize] as char);
-    }
-    output
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn response(batch_id: &str) -> BatchEvaluateResponse {
-        BatchEvaluateResponse {
-            batch_id: batch_id.to_owned(),
-            status: BatchStatus::Completed,
-            claims: Vec::new(),
-            items: Vec::new(),
-            summary: BatchSummary {
-                succeeded: 0,
-                failed: 0,
-            },
-        }
-    }
-
-    #[test]
-    fn postgres_evaluation_record_does_not_duplicate_raw_client_id() {
-        let evaluation: registry_notary_core::StoredEvaluation =
-            serde_json::from_value(serde_json::json!({
-                "client_id": "sensitive-machine-client",
-                "purpose": "test",
-                "claim_ids": [],
-                "disclosure": "predicate",
-                "format": "application/json",
-                "results": [],
-                "created_at": "2026-07-14T00:00:00Z",
-                "expires_at": "2026-07-14T00:15:00Z",
-                "request_hash": "request-hash"
-            }))
-            .unwrap();
-
-        let record = postgres_evaluation_record_json(&evaluation).unwrap();
-
-        assert!(!record.contains("sensitive-machine-client"));
-        assert_eq!(
-            serde_json::from_str::<serde_json::Value>(&record).unwrap()["client_id"],
-            ""
-        );
-    }
-
-    #[test]
-    fn stored_version_two_delegated_access_mode_remains_readable() {
-        let record = serde_json::json!({
-            "client_id": "",
-            "purpose": "test",
-            "claim_ids": ["person-is-alive"],
-            "disclosure": "predicate",
-            "format": "application/json",
-            "results": [],
-            "created_at": "2026-07-14T00:00:00Z",
-            "expires_at": "2026-07-14T00:15:00Z",
-            "request_hash": "request-hash",
-            "subject_access": {
-                "access_mode": LEGACY_DELEGATED_ACCESS_MODE,
-                "issuer": "https://idp.example.test",
-                "principal_hash": "hmac-sha256:principal",
-                "subject_id_type": "national_id",
-                "subject_binding_claim": "national_id",
-                "subject_binding_hash": "hmac-sha256:requester",
-                "dependent_target_hash": "hmac-sha256:dependent",
-                "relationship_type": "guardian",
-                "proof_claim_id": "guardian-link",
-                "requested_claims_hash": "sha256:claims",
-                "disclosure": "predicate",
-                "result_format": "application/json"
-            }
-        });
-
-        let decoded = deserialize_stored_evaluation_v2(
-            &serde_json::to_string(&record).expect("stored record serializes"),
-        )
-        .expect("legacy version-2 access mode remains readable");
-
-        assert_eq!(
-            decoded.access_mode(),
-            registry_notary_core::AccessMode::DelegatedSubjectAccess
-        );
-        assert_eq!(
-            serde_json::to_value(decoded).expect("normalized record serializes")["subject_access"]
-                ["access_mode"],
-            serde_json::json!(DELEGATED_SUBJECT_ACCESS_MODE)
-        );
-    }
-
-    #[test]
-    fn postgres_batch_wait_backoff_is_exponential_jittered_and_bounded() {
-        let ceilings = [50, 100, 200, 400, 800, 1_000, 1_000, 1_000];
-        for (attempt, ceiling) in ceilings.into_iter().enumerate() {
-            let minimum = postgres_batch_wait_delay_from_sample(attempt as u32, 0);
-            let maximum = postgres_batch_wait_delay_from_sample(attempt as u32, u64::MAX);
-            assert_eq!(minimum, std::time::Duration::from_millis(ceiling / 2));
-            assert_eq!(maximum, std::time::Duration::from_millis(ceiling));
-        }
-    }
-
-    #[tokio::test]
-    async fn postgres_waiter_releases_pool_session_before_backoff_for_peer() {
-        let pool = Arc::new(tokio::sync::Semaphore::new(1));
-        let waiter_session = Arc::clone(&pool).acquire_owned().await.unwrap();
-        let waiter = tokio::spawn(wait_for_postgres_batch_retry(
-            waiter_session,
-            std::time::Duration::from_secs(30),
-        ));
-
-        let peer_session = tokio::time::timeout(
-            std::time::Duration::from_millis(100),
-            Arc::clone(&pool).acquire_owned(),
-        )
-        .await
-        .expect("a waiting reservation must not pin the only pool session")
-        .unwrap();
-
-        drop(peer_session);
-        waiter.abort();
-        let _ = waiter.await;
-    }
-
-    #[test]
-    fn disabled_postgres_batch_quota_skips_bounded_principal_parameters() {
-        let limiter = crate::MachineQuotaLimiter::new(registry_notary_core::MachineQuotaConfig {
-            enabled: false,
-            subjects_per_minute: 1,
-        });
-        let principal_id = "unbounded-oidc-subject".repeat(32);
-
-        let parameters =
-            postgres_batch_quota_parameters("batch-key", &principal_id, Some((&limiter, u32::MAX)))
-                .expect("disabled quota does not validate or hash quota principal parameters");
-
-        assert_eq!(
-            parameters,
-            (
-                state_hash(
-                    "batch-principal-fallback",
-                    &format!("batch-key\0{principal_id}"),
-                ),
-                None,
-                1,
-            )
-        );
-    }
-
-    #[tokio::test]
-    async fn completion_before_first_waiter_poll_is_not_lost() {
-        let store = EvidenceStore::default();
-        let owner = match store
-            .reserve_idempotent_batch("key".to_owned(), "hash".to_owned(), "principal", None)
-            .await
-            .unwrap()
-        {
-            BatchIdempotencyReservation::Owner(owner) => owner,
-            BatchIdempotencyReservation::Replay(_) => panic!("first request owns reservation"),
-        };
-        let mut receiver = {
-            let records = store.idempotency.lock().unwrap();
-            match records.get("key").unwrap() {
-                IdempotencyRecord::InFlight { wake, .. } => wake.subscribe(),
-                _ => panic!("reservation is in flight"),
-            }
-        };
-        owner
-            .complete(response("batch-1"), Vec::new())
-            .await
-            .unwrap();
-        receiver.changed().await.unwrap();
-        assert!(*receiver.borrow());
-    }
-
-    #[tokio::test]
-    async fn one_owner_wakes_all_identical_waiters_to_the_same_replay() {
-        let store = Arc::new(EvidenceStore::default());
-        let owner = match store
-            .reserve_idempotent_batch("key".to_owned(), "hash".to_owned(), "principal", None)
-            .await
-            .unwrap()
-        {
-            BatchIdempotencyReservation::Owner(owner) => owner,
-            BatchIdempotencyReservation::Replay(_) => panic!("first request owns reservation"),
-        };
-        let waiters = (0..4)
-            .map(|_| {
-                let store = Arc::clone(&store);
-                tokio::spawn(async move {
-                    match store
-                        .reserve_idempotent_batch(
-                            "key".to_owned(),
-                            "hash".to_owned(),
-                            "principal",
-                            None,
-                        )
-                        .await?
-                    {
-                        BatchIdempotencyReservation::Replay(replay) => Ok(replay.batch_id),
-                        BatchIdempotencyReservation::Owner(_) => {
-                            Err(EvidenceError::RuleEvaluationFailed)
-                        }
-                    }
-                })
-            })
-            .collect::<Vec<_>>();
-        tokio::task::yield_now().await;
-        owner
-            .complete(response("batch-1"), Vec::new())
-            .await
-            .unwrap();
-        for waiter in waiters {
-            assert_eq!(waiter.await.unwrap().unwrap(), "batch-1");
-        }
-    }
-
-    #[tokio::test]
-    async fn cancelled_owner_allows_one_same_hash_takeover_and_conflicts_other_hashes() {
-        let store = EvidenceStore::default();
-        let owner = match store
-            .reserve_idempotent_batch("key".to_owned(), "hash".to_owned(), "principal", None)
-            .await
-            .unwrap()
-        {
-            BatchIdempotencyReservation::Owner(owner) => owner,
-            BatchIdempotencyReservation::Replay(_) => panic!("first request owns reservation"),
-        };
-        assert!(!owner.quota_charged());
-        drop(owner);
-        let takeover = match store
-            .reserve_idempotent_batch("key".to_owned(), "hash".to_owned(), "principal", None)
-            .await
-            .unwrap()
-        {
-            BatchIdempotencyReservation::Owner(owner) => owner,
-            BatchIdempotencyReservation::Replay(_) => panic!("failed owner is not replayable"),
-        };
-        assert!(!takeover.quota_charged());
-        assert!(matches!(
-            store
-                .reserve_idempotent_batch(
-                    "key".to_owned(),
-                    "different".to_owned(),
-                    "principal",
-                    None,
-                )
-                .await,
-            Err(EvidenceError::IdempotencyConflict)
-        ));
-        takeover
-            .complete(response("batch-2"), Vec::new())
-            .await
-            .unwrap();
-    }
-
-    #[tokio::test]
-    async fn uncharged_abandonment_removes_key_and_wakes_waiters() {
-        let store = EvidenceStore::default();
-        let owner = match store
-            .reserve_idempotent_batch("key".to_owned(), "hash".to_owned(), "principal", None)
-            .await
-            .unwrap()
-        {
-            BatchIdempotencyReservation::Owner(owner) => owner,
-            BatchIdempotencyReservation::Replay(_) => panic!("first request owns reservation"),
-        };
-        let mut waiter = {
-            let records = store.idempotency.lock().unwrap();
-            match records.get("key").unwrap() {
-                IdempotencyRecord::InFlight { wake, .. } => wake.subscribe(),
-                _ => panic!("reservation is in flight"),
-            }
-        };
-
-        owner.abandon_uncharged().unwrap();
-
-        waiter.changed().await.unwrap();
-        assert!(*waiter.borrow());
-        assert!(!store.idempotency.lock().unwrap().contains_key("key"));
-        let replacement = match store
-            .reserve_idempotent_batch(
-                "key".to_owned(),
-                "different-hash".to_owned(),
-                "principal",
-                None,
-            )
-            .await
-            .unwrap()
-        {
-            BatchIdempotencyReservation::Owner(owner) => owner,
-            BatchIdempotencyReservation::Replay(_) => {
-                panic!("an abandoned reservation is not replayable")
-            }
-        };
-        replacement
-            .complete(response("batch-2"), Vec::new())
-            .await
-            .unwrap();
-    }
-
-    #[tokio::test]
-    async fn failed_owner_preserves_quota_charge_for_takeover_completion_and_replay() {
-        let store = EvidenceStore::default();
-        let mut owner = match store
-            .reserve_idempotent_batch("key".to_owned(), "hash".to_owned(), "principal", None)
-            .await
-            .unwrap()
-        {
-            BatchIdempotencyReservation::Owner(owner) => owner,
-            BatchIdempotencyReservation::Replay(_) => panic!("first request owns reservation"),
-        };
-        assert!(!owner.quota_charged());
-        owner.mark_quota_charged().unwrap();
-        assert!(owner.quota_charged());
-        drop(owner);
-        assert!(matches!(
-            store.idempotency.lock().unwrap().get("key"),
-            Some(IdempotencyRecord::Failed {
-                quota_charged: true,
-                ..
-            })
-        ));
-
-        let takeover = match store
-            .reserve_idempotent_batch("key".to_owned(), "hash".to_owned(), "principal", None)
-            .await
-            .unwrap()
-        {
-            BatchIdempotencyReservation::Owner(owner) => owner,
-            BatchIdempotencyReservation::Replay(_) => panic!("failed owner is not replayable"),
-        };
-        assert!(takeover.quota_charged());
-        takeover
-            .complete(response("batch-2"), Vec::new())
-            .await
-            .unwrap();
-        assert!(matches!(
-            store.idempotency.lock().unwrap().get("key"),
-            Some(IdempotencyRecord::Completed { .. })
-        ));
-
-        match store
-            .reserve_idempotent_batch("key".to_owned(), "hash".to_owned(), "principal", None)
-            .await
-            .unwrap()
-        {
-            BatchIdempotencyReservation::Replay(replay) => {
-                assert_eq!(replay.batch_id, "batch-2");
-            }
-            BatchIdempotencyReservation::Owner(_) => panic!("completed request is replayed"),
-        };
-    }
-}
diff --git a/crates/registry-notary-server/src/runtime/tests/access.rs b/crates/registry-notary-server/src/runtime/tests/access.rs
deleted file mode 100644
index 4ddba8251..000000000
--- a/crates/registry-notary-server/src/runtime/tests/access.rs
+++ /dev/null
@@ -1,69 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-#[test]
-fn claim_scopes_are_enforced_by_notary() {
-    let mut claim = test_claim("selected", Vec::new());
-    claim.required_scopes = vec!["registry:consult:dhis2".to_string()];
-    let denied = machine_principal();
-
-    assert!(!principal_can_see_claim(&denied, &claim));
-    assert!(matches!(
-        require_claim_access(&denied, &claim),
-        Err(EvidenceError::ScopeDenied { required })
-            if required == "registry:consult:dhis2"
-    ));
-
-    let mut allowed = denied;
-    allowed.scopes.push("registry:consult:dhis2".to_string());
-    assert!(principal_can_see_claim(&allowed, &claim));
-    require_claim_access(&allowed, &claim).expect("claim scope grants access");
-}
-
-#[tokio::test]
-async fn batch_subject_purpose_conflict_rejects_batch_default() {
-    let mut claim = test_claim("selected", Vec::new());
-    claim.operations.batch_evaluate.enabled = true;
-    claim.operations.batch_evaluate.max_subjects = 2;
-    let mut evidence_config = (*test_evidence(vec![claim])).clone();
-    evidence_config.inline_batch_limit = 2;
-    let evidence = Arc::new(evidence_config);
-    let store = EvidenceStore::default();
-    let request = BatchEvaluateRequest {
-        items: vec![
-            registry_notary_core::BatchEvaluateItemRequest::from(
-                registry_notary_core::BatchSubjectRequest {
-                    id: "person-1".to_string(),
-                    id_type: None,
-                    purpose: Some("program-a".to_string()),
-                },
-            ),
-            registry_notary_core::BatchEvaluateItemRequest::from(
-                registry_notary_core::BatchSubjectRequest {
-                    id: "person-2".to_string(),
-                    id_type: None,
-                    purpose: None,
-                },
-            ),
-        ],
-        claims: vec![ClaimRef::from("selected")],
-        disclosure: Some("value".to_string()),
-        format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-        purpose: Some("program-b".to_string()),
-    };
-
-    let error = RegistryNotaryRuntime::new()
-        .batch_evaluate(
-            evidence,
-            &store,
-            &machine_principal(),
-            request,
-            BatchEvaluateOptions {
-                idempotency_key: Some("purpose-conflict"),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await
-        .expect_err("batch item purpose must not conflict with batch default");
-
-    assert_eq!(error.code(), "request.invalid");
-}
diff --git a/crates/registry-notary-server/src/runtime/tests/catalog.rs b/crates/registry-notary-server/src/runtime/tests/catalog.rs
deleted file mode 100644
index 047940071..000000000
--- a/crates/registry-notary-server/src/runtime/tests/catalog.rs
+++ /dev/null
@@ -1,440 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-    #[test]
-    fn runtime_claim_closure_defends_v1_node_and_edge_bounds() {
-        let mut node_claims = Vec::new();
-        for index in 0..=MAX_CLAIM_DEPENDENCY_NODES_V1 {
-            let dependency = (index > 0).then(|| format!("claim-{}", index - 1));
-            let mut claim = test_claim(&format!("claim-{index}"), Vec::new());
-            claim.depends_on = dependency.into_iter().collect();
-            node_claims.push(claim);
-        }
-        let node_evidence = test_evidence(node_claims);
-        let requested = vec![ClaimRef::from(format!(
-            "claim-{}",
-            MAX_CLAIM_DEPENDENCY_NODES_V1
-        ))];
-        let versions = requested_claim_versions(&requested).expect("selection is valid");
-        assert!(matches!(
-            build_claim_levels(&node_evidence, &requested, &versions),
-            Err(EvidenceError::RuleEvaluationFailed)
-        ));
-
-        let mut edge_claims = Vec::new();
-        for index in 0..24 {
-            let mut claim = test_claim(&format!("edge-{index}"), Vec::new());
-            claim.depends_on = (0..index)
-                .map(|dependency| format!("edge-{dependency}"))
-                .collect();
-            edge_claims.push(claim);
-        }
-        let edge_evidence = test_evidence(edge_claims);
-        let requested = vec![ClaimRef::from("edge-23")];
-        let versions = requested_claim_versions(&requested).expect("selection is valid");
-        assert!(matches!(
-            build_claim_levels(&edge_evidence, &requested, &versions),
-            Err(EvidenceError::RuleEvaluationFailed)
-        ));
-    }
-
-    #[test]
-    fn claim_summary_advertises_cccev_evidence_type_metadata() {
-        let mut claim = test_claim("civil-child-status", Vec::new());
-        claim.cccev = Some(registry_notary_core::CccevConfig {
-            requirement_type: Some("InformationRequirement".to_string()),
-            evidence_type: Some("civil_child_status_evidence".to_string()),
-            evidence_type_iri: Some(
-                "https://demo.example.gov/evidence-types/civil-child-status".to_string(),
-            ),
-        });
-
-        let summary = claim_summary(&claim);
-
-        assert_eq!(summary["evidence_type"], "civil_child_status_evidence");
-        assert_eq!(
-            summary["evidence_type_iri"],
-            "https://demo.example.gov/evidence-types/civil-child-status"
-        );
-        assert_eq!(
-            summary["cccev"]["evidence_type_iri"],
-            "https://demo.example.gov/evidence-types/civil-child-status"
-        );
-    }
-
-    #[test]
-    fn claim_summary_advertises_safe_target_inputs_from_relay_consultation() {
-        let mut claim = registry_claim(
-            "birth-record-exists",
-            RuleConfig::ConsultationMatched {
-                consultation: "enrollment".to_string(),
-            },
-            "boolean",
-        );
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-            panic!("claim is registry-backed")
-        };
-        let consultation = consultations
-            .get_mut("enrollment")
-            .expect("consultation exists");
-        consultation.inputs = BTreeMap::from([(
-            "national_id".to_string(),
-            RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.national_id".to_string(),
-            ),
-        )]);
-
-        let summary = claim_summary(&claim);
-
-        let target_inputs = summary["target_inputs"]
-            .as_array()
-            .expect("target inputs are advertised");
-        assert_eq!(target_inputs.len(), 1);
-        let method = &target_inputs[0];
-        assert_eq!(method["method"], "relay_consultation");
-        assert_eq!(method["target_type"], "person");
-        assert_eq!(method["confidence"], "contract_pinned");
-        assert_eq!(
-            method["groups"][0]["inputs"],
-            json!([
-                {
-                    "path": "target.identifiers.national_id",
-                    "kind": "identifier",
-                    "name": "national_id",
-                    "label": "National id",
-                }
-            ])
-        );
-    }
-
-    #[test]
-    fn subject_access_evaluation_capability_uses_keyed_subject_binding_hash() {
-        const ENV: &str = "TEST_RUNTIME_AUDIT_HASH_SECRET";
-        std::env::set_var(ENV, "0123456789abcdef0123456789abcdef");
-        let keys = SubjectAccessRateLimitKeys::new(
-            AuditKeyHasher::from_env(ENV).expect("test audit hasher loads"),
-        );
-        let mut principal = subject_access_principal();
-        principal.verified_claims = Some(
-            serde_json::from_value(json!({
-                "issuer": "https://id.example.gov",
-                "audiences": ["registry-notary"],
-                "subject_binding_claim": "national_id",
-                "subject_binding_value": "12345678901"
-            }))
-            .expect("verified claims parse"),
-        );
-
-        let capability =
-            evaluation_capability_for_principal(&keys, &principal, &["selected".to_string()])
-                .expect("evaluation capability builds");
-        let EvaluationCapability::SubjectBound {
-            subject_binding_hash,
-            ..
-        } = capability
-        else {
-            panic!("expected subject-access capability");
-        };
-
-        assert!(subject_binding_hash.as_str().starts_with("hmac-sha256:"));
-        assert!(!subject_binding_hash.as_str().contains("12345678901"));
-    }
-
-    #[test]
-    fn service_document_advertises_api_key_and_bearer_auth() {
-        let evidence = EvidenceConfig {
-            enabled: true,
-            service_id: "evidence.test".to_string(),
-            ..EvidenceConfig::default()
-        };
-
-        let document = RegistryNotaryRuntime::service_document(&evidence);
-
-        assert_eq!(document["auth"]["methods"], json!(["api_key", "bearer"]));
-        assert_eq!(document["auth"]["api_key"]["header"], json!("X-Api-Key"));
-        assert_eq!(document["auth"]["bearer"]["header"], json!("Authorization"));
-        assert_eq!(document["auth"]["bearer"]["scheme"], json!("bearer"));
-        assert_eq!(
-            document["auth"]["bearer"]["format"],
-            json!("Bearer <token>")
-        );
-        assert_eq!(document["auth"]["audience"], json!("evidence.test"));
-    }
-
-    #[test]
-    fn service_document_advertises_sd_jwt_vc_conformance_capabilities() {
-        let mut credential_profiles = BTreeMap::new();
-        credential_profiles.insert(
-            "profile-a".to_string(),
-            CredentialProfileConfig {
-                format: FORMAT_SD_JWT_VC.to_string(),
-                issuer: "did:web:issuer.test".to_string(),
-                signing_key: "issuer-key".to_string(),
-                vct: "https://issuer.test/credentials/profile-a".to_string(),
-                validity_seconds: 600,
-                holder_binding: registry_notary_core::HolderBindingConfig {
-                    mode: "did".to_string(),
-                    proof_of_possession: Some("required".to_string()),
-                    allowed_did_methods: vec![SD_JWT_VC_HOLDER_BINDING_METHOD.to_string()],
-                },
-                allowed_claims: vec!["claim-a".to_string()],
-                disclosure: registry_notary_core::CredentialDisclosureConfig {
-                    allowed: vec!["predicate".to_string()],
-                },
-            },
-        );
-        let evidence = EvidenceConfig {
-            enabled: true,
-            service_id: "evidence.test".to_string(),
-            credential_profiles,
-            signing_keys: BTreeMap::from([(
-                "issuer-key".to_string(),
-                serde_json::from_value(json!({
-                    "provider": "local_jwk_env",
-                    "private_jwk_env": "ISSUER_KEY",
-                    "alg": "ES256",
-                    "kid": "did:web:issuer.test#key-1",
-                    "status": "active"
-                }))
-                .expect("signing key parses"),
-            )]),
-            ..EvidenceConfig::default()
-        };
-
-        let document = RegistryNotaryRuntime::service_document(&evidence);
-        let capabilities = &document["credential_capabilities"]["sd_jwt_vc"];
-
-        assert_eq!(capabilities["media_type"], json!(FORMAT_SD_JWT_VC));
-        assert_eq!(capabilities["jwt_typ"], json!(SD_JWT_VC_JWT_TYP));
-        assert_eq!(capabilities["signing_algs"], json!(["ES256"]));
-        assert_eq!(
-            capabilities["issuer_key_types"],
-            json!([SD_JWT_VC_P256_ISSUER_KEY_TYPE])
-        );
-        assert_eq!(
-            capabilities["holder_binding_methods"],
-            json!([SD_JWT_VC_HOLDER_BINDING_METHOD])
-        );
-        assert_eq!(capabilities["status_methods"], json!([]));
-        assert_eq!(capabilities["openid4vci"]["support"], "not_full_issuer");
-        assert_eq!(capabilities["credential_profiles"][0]["id"], "profile-a");
-        assert_eq!(
-            capabilities["credential_profiles"][0]["format"],
-            FORMAT_SD_JWT_VC
-        );
-        assert_eq!(
-            document["credential_capabilities"]["unsupported_features"],
-            json!([
-                "application/vc+sd-jwt",
-                "json_ld_vc_issuance",
-                "data_integrity_proofs",
-                "credential_status",
-                "delegated_credential_issuance",
-                "mso_mdoc",
-                "openid4vci_full_issuer"
-            ])
-        );
-    }
-
-    #[test]
-    fn service_document_preserves_output_when_subject_access_disabled() {
-        let evidence = EvidenceConfig {
-            enabled: true,
-            service_id: "evidence.test".to_string(),
-            ..EvidenceConfig::default()
-        };
-
-        assert_eq!(
-            RegistryNotaryRuntime::service_document_with_subject_access(
-                &evidence,
-                &SubjectAccessConfig::default(),
-                false,
-            ),
-            RegistryNotaryRuntime::service_document(&evidence),
-        );
-    }
-
-    #[test]
-    fn claim_summary_exposes_claim_and_consultation_output_semantics() {
-        let mut claim = test_claim("date-of-birth", Vec::new());
-        claim.semantics = Some(registry_notary_core::ClaimSemanticConfig {
-            concept: Some("https://publicschema.org/Person".to_string()),
-            property: Some("https://publicschema.org/date_of_birth".to_string()),
-            vocabulary: None,
-            predicate: None,
-            derived_from: Vec::new(),
-            value_mapping: Some("publicschema".to_string()),
-        });
-        let summary = claim_summary(&claim);
-        assert_eq!(
-            summary["semantics"]["concept"],
-            json!("https://publicschema.org/Person")
-        );
-        assert_eq!(
-            summary["semantics"]["property"],
-            json!("https://publicschema.org/date_of_birth")
-        );
-        assert_eq!(summary["semantics"]["value_mapping"], json!("publicschema"));
-
-    }
-
-    #[test]
-    fn service_document_redacts_subject_access_details_when_not_authorized() {
-        let evidence = EvidenceConfig {
-            enabled: true,
-            service_id: "evidence.test".to_string(),
-            ..EvidenceConfig::default()
-        };
-        let subject_access: SubjectAccessConfig = serde_json::from_value(json!({
-            "enabled": true,
-            "subject_binding": {
-                "token_claim": "https://id.example.gov/claims/national_id",
-                "request_field": "SubjectId",
-                "id_type": "national_id",
-                "normalize": "exact"
-            },
-            "token_policy": {
-                "max_auth_age_seconds": 900,
-                "max_access_token_lifetime_seconds": 900,
-                "max_evaluation_age_seconds": 600,
-                "max_credential_validity_seconds": 300,
-                "max_clock_leeway_seconds": 60
-            },
-            "allowed_operations": {
-                "evaluate": true,
-                "render": true,
-                "issue_credential": false,
-                "batch_evaluate": false
-            },
-            "allowed_claims": ["person-is-alive"],
-            "allowed_formats": [FORMAT_CLAIM_RESULT_JSON],
-            "allowed_disclosures": ["predicate"],
-            "required_scopes": ["subject_access"],
-            "credential_profiles": ["civil_status_sd_jwt"],
-            "rate_limits": {
-                "invalid_token_per_client_address_per_minute": 20,
-                "per_principal_per_minute": 10,
-                "subject_mismatch_per_principal_per_hour": 5,
-                "per_holder_per_hour": 10,
-                "credential_issuance_per_principal_per_hour": 5
-            }
-        }))
-        .expect("subject-access config parses");
-
-        let document = RegistryNotaryRuntime::service_document_with_subject_access(
-            &evidence,
-            &subject_access,
-            false,
-        );
-
-        assert_eq!(document["subject_access"]["enabled"], json!(true));
-        assert!(document["subject_access"]["subject_id_type"].is_null());
-        assert!(document["subject_access"]["token_claim_name"].is_null());
-        assert!(document["subject_access"]["allowed_claim_ids"].is_null());
-        assert!(document["subject_access"]["credential_profile_ids"].is_null());
-    }
-
-    #[test]
-    fn service_document_advertises_enabled_subject_access_capabilities() {
-        let evidence = EvidenceConfig {
-            enabled: true,
-            service_id: "evidence.test".to_string(),
-            ..EvidenceConfig::default()
-        };
-        let subject_access: SubjectAccessConfig = serde_json::from_value(json!({
-            "enabled": true,
-            "subject_binding": {
-                "token_claim": "https://id.example.gov/claims/national_id",
-                "request_field": "SubjectId",
-                "id_type": "national_id",
-                "normalize": "exact"
-            },
-            "token_policy": {
-                "max_auth_age_seconds": 900,
-                "max_access_token_lifetime_seconds": 900,
-                "max_evaluation_age_seconds": 600,
-                "max_credential_validity_seconds": 300,
-                "max_clock_leeway_seconds": 60
-            },
-            "allowed_operations": {
-                "evaluate": true,
-                "render": true,
-                "issue_credential": false,
-                "batch_evaluate": false
-            },
-            "allowed_claims": ["person-is-alive"],
-            "allowed_formats": [FORMAT_CLAIM_RESULT_JSON],
-            "allowed_disclosures": ["predicate"],
-            "required_scopes": ["subject_access"],
-            "credential_profiles": ["civil_status_sd_jwt"],
-            "rate_limits": {
-                "invalid_token_per_client_address_per_minute": 20,
-                "per_principal_per_minute": 10,
-                "subject_mismatch_per_principal_per_hour": 5,
-                "per_holder_per_hour": 10,
-                "credential_issuance_per_principal_per_hour": 5
-            }
-        }))
-        .expect("subject-access config parses");
-
-        let document = RegistryNotaryRuntime::service_document_with_subject_access(
-            &evidence,
-            &subject_access,
-            true,
-        );
-
-        assert_eq!(document["subject_access"]["enabled"], json!(true));
-        assert_eq!(
-            document["subject_access"]["allowed_operations"],
-            json!({
-                "evaluate": true,
-                "render": true,
-                "issue_credential": false,
-                "batch_evaluate": false
-            })
-        );
-        assert_eq!(
-            document["subject_access"]["allowed_claim_ids"],
-            json!(["person-is-alive"])
-        );
-        assert_eq!(
-            document["subject_access"]["allowed_formats"],
-            json!([FORMAT_CLAIM_RESULT_JSON])
-        );
-        assert_eq!(
-            document["subject_access"]["allowed_disclosures"],
-            json!(["predicate"])
-        );
-        assert_eq!(
-            document["subject_access"]["credential_profile_ids"],
-            json!(["civil_status_sd_jwt"])
-        );
-        assert_eq!(
-            document["subject_access"]["subject_id_type"],
-            json!("national_id")
-        );
-        assert_eq!(
-            document["subject_access"]["token_claim_name"],
-            json!("https://id.example.gov/claims/national_id")
-        );
-        assert_eq!(
-            document["subject_access"]["required_scopes"],
-            json!(["subject_access"])
-        );
-        assert_eq!(
-            document["subject_access"]["scope_policy"],
-            json!("required")
-        );
-        assert_eq!(
-            document["subject_access"]["max_evaluation_age_seconds"],
-            json!(600)
-        );
-        assert_eq!(
-            document["subject_access"]["max_credential_validity_seconds"],
-            json!(300)
-        );
-        assert!(document["subject_access"]["rate_limit_mode"].is_null());
-        assert!(document["subject_access"]["rate_limits"].is_null());
-        assert!(document["subject_access"]["allowed_wallet_origins"].is_null());
-        assert!(document["subject_access"]["citizen_clients"].is_null());
-        assert!(document["subject_access"]["token_policy"].is_null());
-    }
diff --git a/crates/registry-notary-server/src/runtime/tests/cel.rs b/crates/registry-notary-server/src/runtime/tests/cel.rs
deleted file mode 100644
index c05da7179..000000000
--- a/crates/registry-notary-server/src/runtime/tests/cel.rs
+++ /dev/null
@@ -1,472 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-#[tokio::test]
-async fn subject_access_batch_is_denied_before_evaluation() {
-    let evidence = test_evidence(vec![test_claim("selected", Vec::new())]);
-    let store = EvidenceStore::default();
-    let request = BatchEvaluateRequest {
-        items: vec![registry_notary_core::BatchEvaluateItemRequest::from(
-            registry_notary_core::BatchSubjectRequest {
-                id: "person-1".to_string(),
-                id_type: None,
-                purpose: None,
-            },
-        )],
-        claims: vec![ClaimRef::from("selected")],
-        disclosure: Some("value".to_string()),
-        format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-        purpose: Some("test".to_string()),
-    };
-
-    let err = RegistryNotaryRuntime::new()
-        .batch_evaluate(
-            evidence,
-            &store,
-            &subject_access_principal(),
-            request,
-            BatchEvaluateOptions::default(),
-        )
-        .await
-        .expect_err("subject-access batch is not supported");
-
-    assert!(matches!(
-        err,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::BatchDenied
-        }
-    ));
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[test]
-fn cel_binding_limits_reject_large_strings_and_lists() {
-    let config = RegistryNotaryCelConfig {
-        max_string_bytes: 4,
-        max_list_items: 2,
-        ..RegistryNotaryCelConfig::default()
-    };
-
-    assert!(validate_cel_binding_limits(&json!({ "value": "abcd" }), &config).is_ok());
-    assert!(matches!(
-        validate_cel_binding_limits(&json!({ "value": "abcde" }), &config),
-        Err(EvidenceError::RuleEvaluationFailed)
-    ));
-    assert!(matches!(
-        validate_cel_binding_limits(&json!({ "items": [1, 2, 3] }), &config),
-        Err(EvidenceError::RuleEvaluationFailed)
-    ));
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[test]
-fn cel_reference_scanners_ignore_literal_and_comment_decoys() {
-    for literal in [
-        "'enrollment.parents'",
-        "\"enrollment.parents\"",
-        "'''enrollment.parents'''",
-        r###""""enrollment.parents "" decoy""""###,
-        r"r'enrollment.parents \x'",
-        "r\"enrollment.parents ' decoy\"",
-        "r'''enrollment.parents ' decoy'''",
-        r###"r"""enrollment.parents " decoy""""###,
-        "b'enrollment.parents'",
-        "br'''enrollment.parents ' decoy'''",
-        r###"br"""enrollment.parents " decoy""""###,
-    ] {
-        let expression = format!("{literal} == {literal} && enrollment.matched");
-        assert_eq!(
-            cel_first_level_member_references(&expression, "enrollment"),
-            BTreeSet::from(["matched".to_string()]),
-            "first-level scanner must ignore decoys in {literal}"
-        );
-        assert_eq!(
-            cel_root_references(&expression),
-            BTreeSet::from(["enrollment".to_string()]),
-            "root scanner must ignore decoys in {literal}"
-        );
-        assert!(
-            !contains_unquoted_bracket(&format!("{literal} == {literal}")),
-            "bracket scanner must ignore brackets in {literal}"
-        );
-    }
-
-    let after_raw_triple =
-        r#"r"""embedded " quote""" != "x" || enrollment.parents.size() > 0"#;
-    assert!(
-        cel_first_level_member_references(after_raw_triple, "enrollment").contains("parents"),
-        "raw triple literals with embedded quotes must not hide later composite references"
-    );
-    let after_triple = r#""""embedded " quote""" != "x" || enrollment.parents.size() > 0"#;
-    assert!(
-        cel_first_level_member_references(after_triple, "enrollment").contains("parents"),
-        "triple literals with embedded quotes must not hide later composite references"
-    );
-    let comment_separated = "enrollment // hidden trivia\n . parents.size() > 0";
-    assert!(
-        cel_first_level_member_references(comment_separated, "enrollment").contains("parents"),
-        "line comments between root, dot, and member are trivia"
-    );
-    assert_eq!(
-        registry_cel_required_variables(
-            "r'''as_of_date''' == 'x' || as_of_date < ctx.today",
-            ["as_of_date"]
-        ),
-        BTreeSet::from(["as_of_date".to_string()]),
-        "bare identifier scanner must ignore raw string decoys"
-    );
-    assert!(
-        contains_unquoted_bracket("r'''[not real]''' == 'x' || enrollment[0]"),
-        "bracket scanner must ignore literal brackets and catch real brackets"
-    );
-    let separated_by_punctuation = "(enrollment).date_of_birth";
-    let preview = MappingRuntime::new(RuntimeOptions::default()).preview_cel_expression_with_input(
-        separated_by_punctuation,
-        StandaloneExpressionInput::new(
-            BTreeMap::from([(
-                "enrollment".to_string(),
-                json!({ "date_of_birth": "2000-01-01" }),
-            )])
-            .into_iter()
-            .collect(),
-        ),
-    );
-    assert!(
-        !preview
-            .issues
-            .iter()
-            .any(|issue| issue.severity == ErrorSeverity::Error),
-        "control expression must compile as CEL"
-    );
-    assert!(
-        !cel_first_level_member_references(separated_by_punctuation, "enrollment")
-            .contains("date_of_birth"),
-        "punctuation must prevent synthetic root.member matches"
-    );
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[test]
-fn registry_cel_startup_is_limited_to_one_output_root_and_declared_variables() {
-    let mut claim = typed_registry_claim(
-        "age-band",
-        RuleConfig::Cel {
-            expression: "enrollment.matched && enrollment.date_of_birth != null ? date.age_on(enrollment.date_of_birth, as_of_date) : null".to_string(),
-        },
-        "integer",
-    );
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-        panic!("registry-backed claim");
-    };
-    consultations
-        .get_mut("enrollment")
-        .expect("consultation exists")
-        .outputs
-        .insert(
-            "parents".to_string(),
-            registry_notary_core::RelayOutputContract::Array {
-                nullable: false,
-                max_bytes: 4_096,
-                max_items: 4,
-                items: Box::new(registry_notary_core::RelayOutputContract::Object {
-                    nullable: false,
-                    max_bytes: 1_024,
-                    fields: BTreeMap::from([(
-                        "name".to_string(),
-                        registry_notary_core::RelayOutputObjectFieldContract {
-                            required: true,
-                            schema: Box::new(
-                                registry_notary_core::RelayOutputContract::String {
-                                    nullable: false,
-                                    max_bytes: 128,
-                                },
-                            ),
-                        },
-                    )]),
-                }),
-            },
-        );
-    let mut evidence = EvidenceConfig {
-        enabled: true,
-        service_id: "runtime.test".to_string(),
-        claims: vec![claim.clone()],
-        ..EvidenceConfig::default()
-    };
-    evidence.variables.insert(
-        "as_of_date".to_string(),
-        registry_notary_core::RequestVariableConfig {
-            from: "request.variables.as_of_date".to_string(),
-            value_type: registry_notary_core::RequestVariableType::Date,
-        },
-    );
-    validate_cel_claims_for_startup(&evidence, &RegistryNotaryCelConfig::default())
-        .expect("OpenCRVS-style full-date derivation preflights");
-    let projected = registry_cel_scalar_consultation_outputs(
-        &claim,
-        &BTreeMap::from([(
-            "enrollment".to_string(),
-            json!({
-                "matched": true,
-                "outcome": "match",
-                "date_of_birth": "2000-01-01",
-                "parents": [{"name": "Ada"}]
-            }),
-        )]),
-    )
-    .expect("scalar CEL view projects");
-    assert_eq!(projected["enrollment"]["date_of_birth"], "2000-01-01");
-    assert!(
-        projected["enrollment"].get("parents").is_none(),
-        "composite outputs never enter the CEL binding surface"
-    );
-
-    for expression in [
-        "enrollment.matched && 'enrollment.parents' == 'enrollment.parents' ? 1 : 0",
-        "enrollment.matched && \"enrollment.parents\" == \"enrollment.parents\" ? 1 : 0",
-        "enrollment.matched && '''enrollment.parents''' == '''enrollment.parents''' ? 1 : 0",
-        r#"enrollment.matched && """enrollment.parents""" == """enrollment.parents""" ? 1 : 0"#,
-        r"enrollment.matched && r'enrollment.parents \x' == r'enrollment.parents \x' ? 1 : 0",
-        "enrollment.matched && r\"enrollment.parents ' decoy\" == r\"enrollment.parents ' decoy\" ? 1 : 0",
-        "enrollment.matched && b'enrollment.parents' == b'enrollment.parents' ? 1 : 0",
-    ] {
-        claim.rule = RuleConfig::Cel {
-            expression: expression.to_string(),
-        };
-        evidence.claims[0] = claim.clone();
-        validate_cel_claims_for_startup(&evidence, &RegistryNotaryCelConfig::default())
-            .unwrap_or_else(|error| {
-                panic!("literal decoy references must not trip registry CEL validation: {expression}: {error:?}")
-            });
-    }
-
-    for expression in [
-        "caller.scopes.contains('admin')",
-        "capability == 'snapshot_exact'",
-        "purpose == 'other-purpose'",
-        "format == 'application/dc+sd-jwt'",
-        "disclosure == 'value'",
-        "consultation == 'other-profile'",
-        "enrollment.secret == 'x'",
-        "enrollment.parents.size() > 0",
-        "enrollment['date_of_birth'] != null",
-        "date.age_on(enrollment.date_of_birth, as_of_date)",
-        r#""""embedded " quote""" != "x" || enrollment.parents.size() > 0 ? 1 : 0"#,
-        r#"r"""embedded " quote""" != "x" || enrollment.parents.size() > 0 ? 1 : 0"#,
-        "'''embedded ' quote''' != \"x\" || enrollment.parents.size() > 0 ? 1 : 0",
-        "r'''embedded ' quote''' != \"x\" || enrollment.parents.size() > 0 ? 1 : 0",
-        "enrollment // comment hides trivia\n . parents.size() > 0 ? 1 : 0",
-    ] {
-        claim.rule = RuleConfig::Cel {
-            expression: expression.to_string(),
-        };
-        evidence.claims[0] = claim.clone();
-        assert!(matches!(
-            validate_cel_claims_for_startup(&evidence, &RegistryNotaryCelConfig::default()),
-            Err(EvidenceError::InvalidRequest)
-        ));
-    }
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[test]
-fn registry_cel_startup_accepts_a_bounded_string_output_below_nine_bytes() {
-    let mut claim = registry_claim(
-        "short-code",
-        RuleConfig::Cel {
-            expression: "enrollment.registration_status".to_string(),
-        },
-        "string",
-    );
-    claim.value.max_bytes = Some(1);
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-        panic!("registry-backed claim")
-    };
-    consultations
-        .get_mut("enrollment")
-        .expect("consultation exists")
-        .outputs
-        .insert(
-            "registration_status".to_string(),
-            registry_notary_core::RelayOutputContract::String {
-                nullable: false,
-                max_bytes: 1,
-            },
-        );
-    let evidence = EvidenceConfig {
-        enabled: true,
-        service_id: "runtime.test".to_string(),
-        claims: vec![claim],
-        ..EvidenceConfig::default()
-    };
-
-    validate_cel_claims_for_startup(&evidence, &RegistryNotaryCelConfig::default())
-        .expect("a type-correct one-byte Relay preview satisfies the claim bound");
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[test]
-fn cel_regex_usage_scanner_ignores_literal_decoys() {
-    assert!(cel_expression_uses_regex(
-        "enrollment.name.matches('^A')"
-    ));
-    assert!(cel_expression_uses_regex(
-        "text.regex_replace(enrollment.name, '^A', 'B')"
-    ));
-    assert!(cel_expression_uses_regex(
-        "text . regex_replace(enrollment.name, '^A', 'B')"
-    ));
-    assert!(cel_expression_uses_regex(
-        "text. regex_extract(enrollment.name, '^(.+)$', 1)"
-    ));
-    assert!(cel_expression_uses_regex(
-        "text_regex_extract(enrollment.name, '^(.+)$', 1)"
-    ));
-    assert!(cel_expression_uses_regex(
-        "validate.matches(enrollment.name, '^A', 'bad')"
-    ));
-    assert!(!cel_expression_uses_regex(
-        "'text.regex_replace(enrollment.name, pattern)'"
-    ));
-}
-
-#[test]
-fn claim_value_type_validation_matches_declared_json_shape() {
-    assert!(validate_claim_value_type(&json!(true), "boolean").is_ok());
-    assert!(validate_claim_value_type(&json!(1.5), "number").is_ok());
-    assert!(validate_claim_value_type(&json!(1), "integer").is_ok());
-    assert!(validate_claim_value_type(&json!("value"), "string").is_ok());
-    assert!(validate_claim_value_type(&json!("2026-06-03"), "date").is_ok());
-    assert!(validate_claim_value_type(&json!([1]), "array").is_ok());
-    assert!(validate_claim_value_type(&json!({ "k": "v" }), "object").is_ok());
-    assert!(validate_claim_value_type(&Value::Null, "null").is_ok());
-    assert!(validate_claim_value_type(&json!("value"), "").is_ok());
-
-    assert!(matches!(
-        validate_claim_value_type(&json!("value"), "boolean"),
-        Err(EvidenceError::RuleEvaluationFailed)
-    ));
-    assert!(matches!(
-        validate_claim_value_type(&json!(1.5), "integer"),
-        Err(EvidenceError::RuleEvaluationFailed)
-    ));
-    assert!(matches!(
-        validate_claim_value_type(&json!(9_007_199_254_740_992_i64), "integer"),
-        Err(EvidenceError::RuleEvaluationFailed)
-    ));
-    assert!(matches!(
-        validate_claim_value_type(&json!("2026-02-30"), "date"),
-        Err(EvidenceError::RuleEvaluationFailed)
-    ));
-    assert!(matches!(
-        validate_claim_value_type(&json!(true), "unsupported"),
-        Err(EvidenceError::InvalidRequest)
-    ));
-}
-
-#[test]
-fn claim_value_max_bytes_enforces_utf8_bytes_and_preserves_null_and_absence() {
-    let config = |max_bytes, nullable| registry_notary_core::ClaimValueConfig {
-        value_type: "string".to_string(),
-        nullable,
-        max_bytes,
-        unit: None,
-    };
-
-    assert!(validate_claim_value_config(&json!("ABCD"), &config(Some(4), false)).is_ok());
-    assert!(matches!(
-        validate_claim_value_config(&json!("ABCDE"), &config(Some(4), false)),
-        Err(EvidenceError::RuleEvaluationFailed)
-    ));
-    assert!(
-        validate_claim_value_config(&json!("éé"), &config(Some(4), false)).is_ok(),
-        "two two-byte UTF-8 scalars exactly meet a four-byte bound"
-    );
-    assert!(matches!(
-        validate_claim_value_config(&json!("éé"), &config(Some(3), false)),
-        Err(EvidenceError::RuleEvaluationFailed)
-    ));
-
-    let unbounded = "s".repeat(
-        usize::try_from(registry_notary_core::MAX_CLAIM_VALUE_STRING_BYTES_V1)
-            .expect("claim byte ceiling fits usize")
-            + 1,
-    );
-    assert!(validate_claim_value_config(&json!(unbounded), &config(None, false)).is_ok());
-    assert!(validate_claim_value_config(&Value::Null, &config(Some(1), true)).is_ok());
-    assert!(matches!(
-        validate_claim_value_config(&Value::Null, &config(Some(1), false)),
-        Err(EvidenceError::RuleEvaluationFailed)
-    ));
-}
-
-#[test]
-fn claim_value_max_bytes_failure_classification_does_not_retain_the_value() {
-    let sensitive = "DO-NOT-EXPOSE";
-    let config = registry_notary_core::ClaimValueConfig {
-        value_type: "string".to_string(),
-        nullable: false,
-        max_bytes: Some(1),
-        unit: None,
-    };
-    let error = validate_claim_value_config(&json!(sensitive), &config)
-        .expect_err("over-bound value must fail");
-
-    assert!(matches!(error, EvidenceError::RuleEvaluationFailed));
-    assert!(!format!("{error:?}").contains(sensitive));
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[test]
-fn cel_binding_limits_reject_deep_json_without_recursive_walk() {
-    let config = RegistryNotaryCelConfig::default();
-    let mut value = json!(true);
-    for _ in 0..=config.max_object_depth {
-        value = json!({ "nested": value });
-    }
-
-    assert!(matches!(
-        validate_cel_binding_limits(&value, &config),
-        Err(EvidenceError::RuleEvaluationFailed)
-    ));
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[test]
-fn cel_result_limits_reject_oversized_serialized_output() {
-    let config = RegistryNotaryCelConfig {
-        max_result_json_bytes: 4,
-        ..RegistryNotaryCelConfig::default()
-    };
-
-    assert!(matches!(
-        validate_cel_result_limits(&json!("12345"), &config),
-        Err(EvidenceError::RuleEvaluationFailed)
-    ));
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[test]
-fn cel_result_limits_reject_deep_worker_output_without_recursive_walk() {
-    let config = RegistryNotaryCelConfig::default();
-    let mut value = json!(true);
-    for _ in 0..=config.max_object_depth {
-        value = json!({ "nested": value });
-    }
-
-    assert!(matches!(
-        validate_cel_result_limits(&value, &config),
-        Err(EvidenceError::RuleEvaluationFailed)
-    ));
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[test]
-fn configured_cel_worker_failures_are_server_side_rule_failures() {
-    assert!(matches!(
-        cel_worker_error(CelWorkerError::Compile),
-        EvidenceError::RuleEvaluationFailed
-    ));
-    assert!(matches!(
-        cel_worker_error(CelWorkerError::Protocol),
-        EvidenceError::RuleEvaluationFailed
-    ));
-}
diff --git a/crates/registry-notary-server/src/runtime/tests/disclosure.rs b/crates/registry-notary-server/src/runtime/tests/disclosure.rs
deleted file mode 100644
index e3845408e..000000000
--- a/crates/registry-notary-server/src/runtime/tests/disclosure.rs
+++ /dev/null
@@ -1,179 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-    #[test]
-    fn value_disclosure_rejects_object_redaction_when_configured_field_is_absent() {
-        let keys = SubjectAccessRateLimitKeys::new(AuditKeyHasher::unkeyed_dev_only());
-        let mut claim = test_claim("selected", Vec::new());
-        claim.value.value_type = "object".to_string();
-        let result = test_claim_result(
-            "selected",
-            json!({"name": "Ada"}),
-            BTreeSet::from(["ssn".to_string()]),
-        );
-
-        let err = view_claim(
-            &keys,
-            &result,
-            &claim,
-            DisclosureProfile::Value,
-            FORMAT_CLAIM_RESULT_JSON,
-        )
-        .expect_err("missing redaction field must fail value disclosure");
-
-        assert!(matches!(err, EvidenceError::DisclosureNotAllowed));
-    }
-
-    #[test]
-    fn value_disclosure_removes_every_configured_object_redaction_field() {
-        let keys = SubjectAccessRateLimitKeys::new(AuditKeyHasher::unkeyed_dev_only());
-        let mut claim = test_claim("selected", Vec::new());
-        claim.value.value_type = "object".to_string();
-        let result = test_claim_result(
-            "selected",
-            json!({"name": "Ada", "ssn": "123", "case_id": "c-1"}),
-            BTreeSet::from(["case_id".to_string(), "ssn".to_string()]),
-        );
-
-        let view = view_claim(
-            &keys,
-            &result,
-            &claim,
-            DisclosureProfile::Value,
-            FORMAT_CLAIM_RESULT_JSON,
-        )
-        .expect("configured fields are redacted");
-
-        assert_eq!(view.value, Some(json!({"name": "Ada"})));
-    }
-
-    #[test]
-    fn predicate_disclosure_rejects_redacted_claim_result() {
-        let keys = SubjectAccessRateLimitKeys::new(AuditKeyHasher::unkeyed_dev_only());
-        let mut claim = test_claim("selected", Vec::new());
-        claim.disclosure.allowed.push("predicate".to_string());
-        let result = test_claim_result(
-            "selected",
-            json!(true),
-            BTreeSet::from(["value".to_string()]),
-        );
-
-        let err = view_claim(
-            &keys,
-            &result,
-            &claim,
-            DisclosureProfile::Predicate,
-            FORMAT_CLAIM_RESULT_JSON,
-        )
-        .expect_err("predicate disclosure must not bypass redaction");
-
-        assert!(matches!(err, EvidenceError::DisclosureNotAllowed));
-    }
-
-    #[test]
-    fn redacted_scalar_disclosure_reports_redacted_claim_id() {
-        let keys = SubjectAccessRateLimitKeys::new(AuditKeyHasher::unkeyed_dev_only());
-        let claim = test_claim("opencrvs-age-band", Vec::new());
-        let result = test_claim_result("opencrvs-age-band", json!("child"), BTreeSet::new());
-
-        let view = view_claim(
-            &keys,
-            &result,
-            &claim,
-            DisclosureProfile::Redacted,
-            FORMAT_CLAIM_RESULT_JSON,
-        )
-        .expect("scalar claim can be redacted");
-
-        assert_eq!(view.value, None);
-        assert_eq!(view.redacted_fields, vec!["opencrvs-age-band".to_string()]);
-    }
-
-    #[tokio::test]
-    async fn issued_sd_jwt_disclosure_uses_view_claim_redacted_object_value() {
-        const RAW_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA"}"#;
-
-        let keys = SubjectAccessRateLimitKeys::new(AuditKeyHasher::unkeyed_dev_only());
-        let mut claim = test_claim("household-summary", Vec::new());
-        claim.value.value_type = "object".to_string();
-        let result = test_claim_result(
-            "household-summary",
-            json!({
-                "name": "Ada",
-                "household_id": "hh-1",
-                "ssn": "123-45-6789"
-            }),
-            BTreeSet::from(["ssn".to_string()]),
-        );
-        let view = view_claim(
-            &keys,
-            &result,
-            &claim,
-            DisclosureProfile::Value,
-            FORMAT_CLAIM_RESULT_JSON,
-        )
-        .expect("configured object field is redacted before issuance");
-        assert_eq!(
-            view.value,
-            Some(json!({
-                "name": "Ada",
-                "household_id": "hh-1"
-            }))
-        );
-
-        let issuer = registry_notary_core::sd_jwt::EvidenceIssuer::from_jwk_str(
-            RAW_JWK,
-            "did:web:issuer.test#key-1".to_string(),
-        )
-        .expect("test issuer builds");
-        let profile = CredentialProfileConfig {
-            format: FORMAT_SD_JWT_VC.to_string(),
-            issuer: "did:web:issuer.test".to_string(),
-            signing_key: "issuer-key".to_string(),
-            vct: "https://vct.example/test".to_string(),
-            validity_seconds: 60,
-            holder_binding: registry_notary_core::HolderBindingConfig {
-                mode: "none".to_string(),
-                proof_of_possession: None,
-                allowed_did_methods: Vec::new(),
-            },
-            allowed_claims: Vec::new(),
-            disclosure: Default::default(),
-        };
-        let signed = registry_notary_core::sd_jwt::issue(
-            &profile,
-            &issuer,
-            &[view],
-            "subject-ref",
-            None,
-            OffsetDateTime::UNIX_EPOCH,
-            registry_notary_core::sd_jwt::IssueOptions::default(),
-        )
-        .await
-        .expect("credential issues");
-        let disclosures = signed
-            .disclosures
-            .iter()
-            .map(|disclosure| {
-                serde_json::from_slice::<Value>(
-                    &URL_SAFE_NO_PAD
-                        .decode(disclosure)
-                        .expect("disclosure decodes as base64url"),
-                )
-                .expect("disclosure decodes as JSON")
-            })
-            .collect::<Vec<_>>();
-        let disclosure = disclosures
-            .iter()
-            .find(|disclosure| disclosure.get(1) == Some(&json!("household-summary")))
-            .expect("household-summary disclosure exists");
-        let disclosure_json = serde_json::to_string(&disclosures).expect("disclosures serialize");
-
-        assert_eq!(disclosure[2]["value"]["name"], json!("Ada"));
-        assert_eq!(disclosure[2]["value"]["household_id"], json!("hh-1"));
-        assert!(disclosure[2]["value"].get("ssn").is_none());
-        assert!(!disclosure_json.contains("ssn"), "{disclosure_json}");
-        assert!(
-            !disclosure_json.contains("123-45-6789"),
-            "{disclosure_json}"
-        );
-    }
diff --git a/crates/registry-notary-server/src/runtime/tests/evaluation.rs b/crates/registry-notary-server/src/runtime/tests/evaluation.rs
deleted file mode 100644
index 34e29d912..000000000
--- a/crates/registry-notary-server/src/runtime/tests/evaluation.rs
+++ /dev/null
@@ -1,3617 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-#[test]
-fn request_context_scalars_preserve_supported_types() {
-    assert_eq!(canonical_request_scalar(&json!("Ada")), Some("Ada".to_string()));
-    assert_eq!(canonical_request_scalar(&json!(true)), Some("true".to_string()));
-    assert_eq!(canonical_request_scalar(&json!(-42)), Some("-42".to_string()));
-    assert_eq!(canonical_request_scalar(&json!(1.5)), None);
-    assert_eq!(canonical_request_scalar(&Value::Null), None);
-    assert_eq!(canonical_request_scalar(&json!(["Ada"])), None);
-    assert_eq!(canonical_request_scalar(&json!({ "name": "Ada" })), None);
-    assert_eq!(canonical_request_scalar(&json!(u64::MAX)), None);
-}
-
-#[derive(Debug)]
-struct FixedRelayConsultation {
-    calls: AtomicU64,
-    outcome: RuntimeRelayOutcome,
-}
-
-#[derive(Debug, Default)]
-struct FederationCorrelationRelay {
-    evaluation_ids: Mutex<Vec<String>>,
-}
-
-#[async_trait::async_trait]
-impl ActivatedRelayConsultations for FederationCorrelationRelay {
-    async fn check_ready(&self) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    fn validate(
-        &self,
-        _key: &ConsultationGroupKeyV1,
-    ) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    async fn execute(
-        &self,
-        key: &ConsultationGroupKeyV1,
-    ) -> Result<RuntimeRelayConsultationResult, crate::relay_client::RelayClientError> {
-        self.evaluation_ids
-            .lock()
-            .expect("federation correlation lock is not poisoned")
-            .push(key.evaluation_id().to_string());
-        RuntimeRelayConsultationResult::new(
-            Ulid::from_parts(2, 1),
-            RuntimeRelayOutcome::Match,
-            Some(status_match_data()?),
-            OffsetDateTime::UNIX_EPOCH,
-        )
-    }
-}
-
-fn status_match_data() -> Result<RuntimeRelayMatchData, crate::relay_client::RelayClientError> {
-    RuntimeRelayOutputMap::from_json(BTreeMap::from([(
-        "registration_status".to_string(),
-        json!("ACTIVE"),
-    )]))
-    .map(RuntimeRelayMatchData::OutputMap)
-}
-
-#[async_trait::async_trait]
-impl ActivatedRelayConsultations for FixedRelayConsultation {
-    async fn check_ready(&self) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    fn validate(
-        &self,
-        _key: &ConsultationGroupKeyV1,
-    ) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    async fn execute(
-        &self,
-        _key: &ConsultationGroupKeyV1,
-    ) -> Result<RuntimeRelayConsultationResult, crate::relay_client::RelayClientError> {
-        self.calls.fetch_add(1, Ordering::SeqCst);
-        let match_data = matches!(self.outcome, RuntimeRelayOutcome::Match)
-            .then(status_match_data)
-            .transpose()?;
-        RuntimeRelayConsultationResult::new(
-            Ulid::from_parts(2, 1),
-            self.outcome,
-            match_data,
-            OffsetDateTime::UNIX_EPOCH,
-        )
-    }
-}
-
-#[tokio::test]
-async fn federation_request_jti_becomes_the_relay_evaluation_id() {
-    const REQUEST_JTI: &str = "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6";
-    let claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    let mut evidence = (*test_evidence(vec![claim])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    let relay = Arc::new(FederationCorrelationRelay::default());
-    let bound: Arc<dyn ActivatedRelayConsultations> = relay.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let mut principal = machine_principal();
-    principal.auth_profile_id = EvidenceAuthProfileId::Federation;
-    let evaluation_capability = EvaluationCapability::Machine {
-        scopes: BTreeSet::from(["registry:evidence".to_string()]),
-    };
-    let correlation_id =
-        BoundedCorrelationId::new(REQUEST_JTI).expect("request jti is a bounded correlation id");
-
-    let results = runtime
-        .evaluate_with_capability(
-            Arc::new(evidence),
-            &EvidenceStore::default(),
-            &principal,
-            evaluation_capability,
-            test_request("enrollment-status"),
-            None,
-            None,
-            Some(correlation_id),
-        )
-        .await
-        .expect("federated registry-backed evaluation succeeds");
-
-    assert_ne!(results[0].evaluation_id, REQUEST_JTI);
-    assert_eq!(
-        relay
-            .evaluation_ids
-            .lock()
-            .expect("federation correlation lock is not poisoned")
-            .as_slice(),
-        [REQUEST_JTI]
-    );
-}
-
-#[derive(Debug)]
-struct MixedCompletionRelay {
-    calls: AtomicU64,
-    failed_target: &'static str,
-    error: crate::relay_client::RelayClientError,
-}
-
-#[async_trait::async_trait]
-impl ActivatedRelayConsultations for MixedCompletionRelay {
-    async fn check_ready(&self) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    fn validate(
-        &self,
-        _key: &ConsultationGroupKeyV1,
-    ) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    async fn execute(
-        &self,
-        key: &ConsultationGroupKeyV1,
-    ) -> Result<RuntimeRelayConsultationResult, crate::relay_client::RelayClientError> {
-        self.calls.fetch_add(1, Ordering::SeqCst);
-        let target = key
-            .canonical_inputs()
-            .get("tracked_entity")
-            .map(|value| value.as_str())
-            .ok_or(crate::relay_client::RelayClientError::InvalidRequest)?;
-        if target == self.failed_target {
-            return Err(self.error);
-        }
-        tokio::time::sleep(std::time::Duration::from_millis(20)).await;
-        RuntimeRelayConsultationResult::new(
-            Ulid::from_parts(2, 2),
-            RuntimeRelayOutcome::Match,
-            Some(status_match_data()?),
-            OffsetDateTime::UNIX_EPOCH,
-        )
-    }
-}
-
-#[derive(Debug, Default)]
-struct UniqueRelayConsultation {
-    calls: AtomicU64,
-}
-
-#[async_trait::async_trait]
-impl ActivatedRelayConsultations for UniqueRelayConsultation {
-    async fn check_ready(&self) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    fn validate(
-        &self,
-        _key: &ConsultationGroupKeyV1,
-    ) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    async fn execute(
-        &self,
-        _key: &ConsultationGroupKeyV1,
-    ) -> Result<RuntimeRelayConsultationResult, crate::relay_client::RelayClientError> {
-        let call = self.calls.fetch_add(1, Ordering::SeqCst) + 1;
-        RuntimeRelayConsultationResult::new(
-            Ulid::from_parts(call, 1),
-            RuntimeRelayOutcome::Match,
-            Some(status_match_data()?),
-            OffsetDateTime::UNIX_EPOCH,
-        )
-    }
-}
-
-#[derive(Debug)]
-struct DelegatedRelayConsultation {
-    calls: AtomicU64,
-    outcome: RuntimeRelayOutcome,
-    proof_value: bool,
-    validation_error: Option<crate::relay_client::RelayClientError>,
-    execution_error: Option<crate::relay_client::RelayClientError>,
-}
-
-#[async_trait::async_trait]
-impl ActivatedRelayConsultations for DelegatedRelayConsultation {
-    async fn check_ready(&self) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    fn validate(
-        &self,
-        _key: &ConsultationGroupKeyV1,
-    ) -> Result<(), crate::relay_client::RelayClientError> {
-        self.validation_error.map_or(Ok(()), Err)
-    }
-
-    async fn execute(
-        &self,
-        _key: &ConsultationGroupKeyV1,
-    ) -> Result<RuntimeRelayConsultationResult, crate::relay_client::RelayClientError> {
-        self.calls.fetch_add(1, Ordering::SeqCst);
-        if let Some(error) = self.execution_error {
-            return Err(error);
-        }
-        let match_data = matches!(self.outcome, RuntimeRelayOutcome::Match)
-            .then(|| {
-                RuntimeRelayOutputMap::from_json(BTreeMap::from([(
-                    "relationship_proven".to_string(),
-                    Value::Bool(self.proof_value),
-                )]))
-                .map(RuntimeRelayMatchData::OutputMap)
-            })
-            .transpose()?;
-        RuntimeRelayConsultationResult::new(
-            Ulid::from_parts(7, 1),
-            self.outcome,
-            match_data,
-            OffsetDateTime::UNIX_EPOCH,
-        )
-    }
-}
-
-#[derive(Debug, Default)]
-struct BatchIdentityRelay {
-    child_identities: Mutex<Vec<String>>,
-}
-
-#[async_trait::async_trait]
-impl ActivatedRelayConsultations for BatchIdentityRelay {
-    async fn check_ready(&self) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    fn validate(
-        &self,
-        _key: &ConsultationGroupKeyV1,
-    ) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    async fn execute(
-        &self,
-        _key: &ConsultationGroupKeyV1,
-    ) -> Result<RuntimeRelayConsultationResult, crate::relay_client::RelayClientError> {
-        panic!("registry-backed batch must use the child-identity execution boundary")
-    }
-
-    async fn execute_batch(
-        &self,
-        _key: &ConsultationGroupKeyV1,
-        child_identity: &consultation::BatchChildIdentityV1,
-    ) -> Result<RuntimeRelayConsultationResult, crate::relay_client::RelayClientError> {
-        self.child_identities
-            .lock()
-            .expect("child identity lock is not poisoned")
-            .push(child_identity.as_str().to_string());
-        RuntimeRelayConsultationResult::new(
-            Ulid::new(),
-            RuntimeRelayOutcome::Match,
-            Some(status_match_data()?),
-            OffsetDateTime::UNIX_EPOCH,
-        )
-    }
-}
-
-#[derive(Debug, Default)]
-struct TypedInputRelay {
-    single_inputs: Mutex<Vec<BTreeMap<String, String>>>,
-    batch_inputs: Mutex<Vec<BTreeMap<String, String>>>,
-}
-
-fn observed_inputs(key: &ConsultationGroupKeyV1) -> BTreeMap<String, String> {
-    key.canonical_inputs()
-        .iter()
-        .map(|(name, value)| (name.clone(), value.to_string()))
-        .collect()
-}
-
-#[async_trait::async_trait]
-impl ActivatedRelayConsultations for TypedInputRelay {
-    async fn check_ready(&self) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    fn validate(
-        &self,
-        _key: &ConsultationGroupKeyV1,
-    ) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    async fn execute(
-        &self,
-        key: &ConsultationGroupKeyV1,
-    ) -> Result<RuntimeRelayConsultationResult, crate::relay_client::RelayClientError> {
-        self.single_inputs
-            .lock()
-            .expect("single input lock is not poisoned")
-            .push(observed_inputs(key));
-        RuntimeRelayConsultationResult::new(
-            Ulid::new(),
-            RuntimeRelayOutcome::Match,
-            Some(status_match_data()?),
-            OffsetDateTime::UNIX_EPOCH,
-        )
-    }
-
-    async fn execute_batch(
-        &self,
-        key: &ConsultationGroupKeyV1,
-        _child_identity: &consultation::BatchChildIdentityV1,
-    ) -> Result<RuntimeRelayConsultationResult, crate::relay_client::RelayClientError> {
-        self.batch_inputs
-            .lock()
-            .expect("batch input lock is not poisoned")
-            .push(observed_inputs(key));
-        RuntimeRelayConsultationResult::new(
-            Ulid::new(),
-            RuntimeRelayOutcome::Match,
-            Some(status_match_data()?),
-            OffsetDateTime::UNIX_EPOCH,
-        )
-    }
-}
-
-#[derive(Debug, Default)]
-struct CrashRetryBatchRelay {
-    attempts: AtomicU64,
-    observations: Mutex<Vec<(String, String)>>,
-    first_dispatch: tokio::sync::Notify,
-}
-
-#[async_trait::async_trait]
-impl ActivatedRelayConsultations for CrashRetryBatchRelay {
-    async fn check_ready(&self) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    fn validate(
-        &self,
-        _key: &ConsultationGroupKeyV1,
-    ) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    async fn execute(
-        &self,
-        _key: &ConsultationGroupKeyV1,
-    ) -> Result<RuntimeRelayConsultationResult, crate::relay_client::RelayClientError> {
-        panic!("registry-backed batch must use the child-identity execution boundary")
-    }
-
-    async fn execute_batch(
-        &self,
-        key: &ConsultationGroupKeyV1,
-        child_identity: &consultation::BatchChildIdentityV1,
-    ) -> Result<RuntimeRelayConsultationResult, crate::relay_client::RelayClientError> {
-        let attempt = self.attempts.fetch_add(1, Ordering::SeqCst);
-        self.observations
-            .lock()
-            .expect("retry observation lock is not poisoned")
-            .push((
-                child_identity.as_str().to_string(),
-                key.evaluation_id().to_string(),
-            ));
-        if attempt == 0 {
-            self.first_dispatch.notify_one();
-            std::future::pending::<()>().await;
-        }
-        RuntimeRelayConsultationResult::new(
-            Ulid::from_parts(5, 1),
-            RuntimeRelayOutcome::Match,
-            Some(status_match_data()?),
-            OffsetDateTime::UNIX_EPOCH,
-        )
-    }
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[derive(Debug)]
-struct TypedOutputRelay {
-    calls: AtomicU64,
-    outcome: RuntimeRelayOutcome,
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[async_trait::async_trait]
-impl ActivatedRelayConsultations for TypedOutputRelay {
-    async fn check_ready(&self) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    fn validate(
-        &self,
-        _key: &ConsultationGroupKeyV1,
-    ) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    async fn execute(
-        &self,
-        _key: &ConsultationGroupKeyV1,
-    ) -> Result<RuntimeRelayConsultationResult, crate::relay_client::RelayClientError> {
-        self.calls.fetch_add(1, Ordering::SeqCst);
-        let match_data = (self.outcome == RuntimeRelayOutcome::Match)
-            .then(|| {
-                RuntimeRelayOutputMap::from_json(BTreeMap::from([(
-                    "date_of_birth".to_string(),
-                    json!("2010-06-15"),
-                )]))
-                .map(RuntimeRelayMatchData::OutputMap)
-            })
-            .transpose()?;
-        RuntimeRelayConsultationResult::new(
-            Ulid::from_parts(3, 1),
-            self.outcome,
-            match_data,
-            OffsetDateTime::UNIX_EPOCH,
-        )
-    }
-}
-
-fn registry_claim(id: &str, rule: RuleConfig, value_type: &str) -> ClaimDefinition {
-    let nullable = matches!(&rule, RuleConfig::ConsultationOutput { .. });
-    let mut claim = test_claim(id, Vec::new());
-    claim.evidence_mode = ClaimEvidenceMode::RegistryBacked {
-        consultations: BTreeMap::from([(
-            "enrollment".to_string(),
-            registry_notary_core::RelayConsultationConfig {
-                profile: registry_notary_core::RelayConsultationProfileRef {
-                    id: "dhis2.tracker.enrollment-status.exact".to_string(),
-                    contract_hash:
-                        "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-                            .to_string(),
-                },
-                inputs: BTreeMap::from([(
-                    "tracked_entity".to_string(),
-                    RelayConsultationInput::TargetId,
-                )]),
-                outputs: BTreeMap::from([(
-                    "registration_status".to_string(),
-                    registry_notary_core::RelayOutputContract::String {
-                        nullable: true,
-                        max_bytes: 64,
-                    },
-                )]),
-            },
-        )]),
-    };
-    claim.purpose = Some("test".to_string());
-    claim.required_scopes = vec!["registry:evidence".to_string()];
-    claim.rule = rule;
-    claim.value.value_type = value_type.to_string();
-    claim.value.nullable = nullable;
-    claim
-}
-
-fn delegated_relay_proof_claim() -> ClaimDefinition {
-    let mut claim = registry_claim(
-        "guardian-link",
-        RuleConfig::ConsultationOutput {
-            consultation: "relationship".to_string(),
-            output: "relationship_proven".to_string(),
-        },
-        "boolean",
-    );
-    claim.required_scopes = vec!["subject_access".to_string()];
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-        panic!("delegated proof claim is Registry-backed")
-    };
-    let mut consultation = consultations
-        .remove("enrollment")
-        .expect("proof consultation exists");
-    consultation.profile.id = "example.guardian-link.exact".to_string();
-    consultation.inputs = BTreeMap::from([
-        (
-            "requester_id".to_string(),
-            RelayConsultationInput::RequesterIdentifier(
-                "request.requester.identifiers.national_id".to_string(),
-            ),
-        ),
-        (
-            "target_id".to_string(),
-            RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.civil_registration_id".to_string(),
-            ),
-        ),
-    ]);
-    consultation.outputs = BTreeMap::from([(
-        "relationship_proven".to_string(),
-        registry_notary_core::RelayOutputContract::Boolean { nullable: false },
-    )]);
-    consultations.insert("relationship".to_string(), consultation);
-    claim
-}
-
-fn delegated_selected_claim(dependencies: Vec<&str>) -> ClaimDefinition {
-    let mut claim = delegated_relay_proof_claim();
-    claim.id = "selected".to_string();
-    claim.depends_on = dependencies.into_iter().map(str::to_string).collect();
-    claim.rule = RuleConfig::ConsultationMatched {
-        consultation: "relationship".to_string(),
-    };
-    claim
-}
-
-fn delegated_relay_principal() -> EvidencePrincipal {
-    let mut principal = delegated_principal();
-    principal.scopes = vec!["subject_access".to_string()];
-    principal
-}
-
-fn delegated_evidence(claims: Vec<ClaimDefinition>) -> Arc<EvidenceConfig> {
-    let mut evidence = (*test_evidence(claims)).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    Arc::new(evidence)
-}
-
-fn delegated_runtime_with_relay(
-    keys: &Arc<SubjectAccessRateLimitKeys>,
-    outcome: RuntimeRelayOutcome,
-    proof_value: bool,
-    validation_error: Option<crate::relay_client::RelayClientError>,
-    execution_error: Option<crate::relay_client::RelayClientError>,
-) -> (RegistryNotaryRuntime, Arc<DelegatedRelayConsultation>) {
-    let activated = Arc::new(DelegatedRelayConsultation {
-        calls: AtomicU64::new(0),
-        outcome,
-        proof_value,
-        validation_error,
-        execution_error,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    (
-        RegistryNotaryRuntime::new_with_subject_access_rate_keys(Arc::clone(keys))
-            .with_activated_relay(Some(bound)),
-        activated,
-    )
-}
-
-#[test]
-fn delegated_evaluation_freshness_denies_at_and_after_expiry() {
-    let evaluation_expires_at = OffsetDateTime::UNIX_EPOCH + time::Duration::seconds(10);
-
-    require_fresh_delegated_evaluation(
-        evaluation_expires_at,
-        evaluation_expires_at - time::Duration::nanoseconds(1),
-    )
-    .expect("a delegated evaluation inside its committed window remains fresh");
-
-    for now in [
-        evaluation_expires_at,
-        evaluation_expires_at + time::Duration::nanoseconds(1),
-    ] {
-        let error = require_fresh_delegated_evaluation(evaluation_expires_at, now)
-            .expect_err("a delegated evaluation at or after expiry must fail closed");
-        assert!(matches!(
-            error,
-            EvidenceError::SubjectAccessDenied {
-                reason: SubjectAccessDenialCode::DelegatedProofDenied
-            }
-        ));
-    }
-}
-
-fn subject_bound_capability(
-    keys: &SubjectAccessRateLimitKeys,
-    claim_id: &str,
-) -> EvaluationCapability {
-    let claim_id = BoundedClaimId::new(claim_id).expect("claim id is bounded");
-    EvaluationCapability::SubjectBound {
-        claim_id: Some(claim_id.clone()),
-        allowed_claim_ids: BTreeSet::from([claim_id]),
-        subject_binding_hash: keys
-            .subject_binding("person-1")
-            .expect("subject binding hashes"),
-    }
-}
-
-#[tokio::test]
-async fn subject_bound_capability_consults_only_its_exact_registry_claim() {
-    let mut claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    claim.required_scopes = vec!["subject_access".to_string()];
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-        panic!("subject-bound claim is registry backed")
-    };
-    consultations
-        .get_mut("enrollment")
-        .expect("subject-bound consultation exists")
-        .inputs
-        .insert(
-            "tracked_entity".to_string(),
-            RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.national_id".to_string(),
-            ),
-        );
-    let mut evidence = (*test_evidence(vec![claim])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    let relay = Arc::new(FixedRelayConsultation {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::Match,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = relay.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let keys = SubjectAccessRateLimitKeys::new(AuditKeyHasher::unkeyed_dev_only());
-
-    let results = runtime
-        .evaluate_with_capability(
-            Arc::new(evidence),
-            &EvidenceStore::default(),
-            &subject_access_principal(),
-            subject_bound_capability(&keys, "enrollment-status"),
-            {
-                let mut request = test_request("enrollment-status");
-                request.target = Some(EvidenceEntity::with_identifier(
-                    "Person",
-                    "national_id",
-                    "person-1",
-                ));
-                request
-            },
-            None,
-            None,
-            None,
-        )
-        .await
-        .expect("the exact subject-bound registry claim evaluates");
-
-    assert_eq!(results[0].value, Some(Value::String("ACTIVE".to_string())));
-    assert_eq!(relay.calls.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn subject_bound_capability_denies_an_unlisted_registry_claim_before_relay() {
-    let mut claim = registry_claim(
-        "other-registry-claim",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    claim.required_scopes.clear();
-    let mut evidence = (*test_evidence(vec![claim])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    let relay = Arc::new(FixedRelayConsultation {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::Match,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = relay.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let keys = SubjectAccessRateLimitKeys::new(AuditKeyHasher::unkeyed_dev_only());
-
-    let error = runtime
-        .evaluate_with_capability(
-            Arc::new(evidence),
-            &EvidenceStore::default(),
-            &subject_access_principal(),
-            subject_bound_capability(&keys, "allowed-registry-claim"),
-            test_request("other-registry-claim"),
-            None,
-            None,
-            None,
-        )
-        .await
-        .expect_err("an unlisted registry claim must fail before Relay");
-
-    assert!(matches!(
-        error,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::ClaimDenied
-        }
-    ));
-    assert_eq!(relay.calls.load(Ordering::SeqCst), 0);
-}
-
-#[tokio::test]
-async fn delegated_exact_relay_proof_runs_once_before_the_dependent_claim() {
-    let evidence = delegated_evidence(vec![
-        delegated_relay_proof_claim(),
-        delegated_selected_claim(vec!["guardian-link"]),
-    ]);
-    let keys = Arc::new(SubjectAccessRateLimitKeys::new(
-        AuditKeyHasher::unkeyed_dev_only(),
-    ));
-    let (runtime, relay) = delegated_runtime_with_relay(
-        &keys,
-        RuntimeRelayOutcome::Match,
-        true,
-        None,
-        None,
-    );
-
-    let results = runtime
-        .evaluate_with_capability(
-            evidence,
-            &EvidenceStore::default(),
-            &delegated_relay_principal(),
-            delegated_subject_access_capability(&keys, "NAT-123", "CHILD-123"),
-            delegated_runtime_request(),
-            None,
-            Some(delegated_subject_access_metadata(
-                OffsetDateTime::now_utc() + time::Duration::hours(1),
-            )),
-            None,
-        )
-        .await
-        .expect("the exact Relay proof permits its configured delegated claim");
-
-    assert_eq!(results.len(), 1);
-    assert_eq!(results[0].claim_id, "selected");
-    assert_eq!(relay.calls.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn delegated_capability_denies_a_registry_dependency_omitted_from_the_committed_closure() {
-    let mut unrelated = delegated_relay_proof_claim();
-    unrelated.id = "unrelated-registry-claim".to_string();
-    let evidence = delegated_evidence(vec![
-        delegated_relay_proof_claim(),
-        unrelated,
-        delegated_selected_claim(vec!["guardian-link", "unrelated-registry-claim"]),
-    ]);
-    let keys = Arc::new(SubjectAccessRateLimitKeys::new(
-        AuditKeyHasher::unkeyed_dev_only(),
-    ));
-    let (runtime, relay) = delegated_runtime_with_relay(
-        &keys,
-        RuntimeRelayOutcome::Match,
-        true,
-        None,
-        None,
-    );
-
-    let error = runtime
-        .evaluate_with_capability(
-            evidence,
-            &EvidenceStore::default(),
-            &delegated_relay_principal(),
-            delegated_subject_access_capability(&keys, "NAT-123", "CHILD-123"),
-            delegated_runtime_request(),
-            None,
-            None,
-            None,
-        )
-        .await
-        .expect_err("delegation grants only the exact committed dependency closure");
-
-    assert!(matches!(
-        error,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::DelegatedSubjectNotPermitted
-        }
-    ));
-    assert_eq!(relay.calls.load(Ordering::SeqCst), 0);
-}
-
-#[tokio::test]
-async fn delegated_capability_allows_the_exact_committed_registry_dependency_closure() {
-    let mut dependency = delegated_relay_proof_claim();
-    dependency.id = "registry-dependent-fact".to_string();
-    let evidence = delegated_evidence(vec![
-        delegated_relay_proof_claim(),
-        dependency,
-        delegated_selected_claim(vec!["guardian-link", "registry-dependent-fact"]),
-    ]);
-    let keys = Arc::new(SubjectAccessRateLimitKeys::new(
-        AuditKeyHasher::unkeyed_dev_only(),
-    ));
-    let (runtime, relay) = delegated_runtime_with_relay(
-        &keys,
-        RuntimeRelayOutcome::Match,
-        true,
-        None,
-        None,
-    );
-
-    let results = runtime
-        .evaluate_with_capability(
-            evidence,
-            &EvidenceStore::default(),
-            &delegated_relay_principal(),
-            delegated_subject_access_capability_with_allowed_claims(
-                &keys,
-                "NAT-123",
-                "CHILD-123",
-                &["selected", "registry-dependent-fact"],
-            ),
-            delegated_runtime_request(),
-            None,
-            Some(delegated_subject_access_metadata(
-                OffsetDateTime::now_utc() + time::Duration::hours(1),
-            )),
-            None,
-        )
-        .await
-        .expect("the committed registry-backed dependency closure evaluates");
-
-    assert_eq!(results.len(), 1);
-    assert_eq!(results[0].claim_id, "selected");
-    // The proof and dependent fact share one compiler-identical Relay group,
-    // so the exact two-claim closure is intentionally coalesced to one call.
-    assert_eq!(relay.calls.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn delegated_post_relay_expiry_denies_values_and_skips_storage() {
-    let evidence = delegated_evidence(vec![
-        delegated_relay_proof_claim(),
-        delegated_selected_claim(vec!["guardian-link"]),
-    ]);
-    let keys = Arc::new(SubjectAccessRateLimitKeys::new(
-        AuditKeyHasher::unkeyed_dev_only(),
-    ));
-    let (runtime, relay) = delegated_runtime_with_relay(
-        &keys,
-        RuntimeRelayOutcome::Match,
-        true,
-        None,
-        None,
-    );
-    let store = EvidenceStore::default();
-
-    let (result, audit) = runtime
-        .evaluate_with_capability_for_api(
-            evidence,
-            &store,
-            &delegated_relay_principal(),
-            delegated_subject_access_capability(&keys, "NAT-123", "CHILD-123"),
-            delegated_runtime_request(),
-            None,
-            Some(delegated_subject_access_metadata(
-                OffsetDateTime::UNIX_EPOCH,
-            )),
-            None,
-        )
-        .await;
-
-    let error = result.expect_err("an expired delegated result must not disclose claim values");
-    assert_eq!(error.audit_code(), "delegated.proof_denied");
-    assert!(matches!(
-        &error,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::DelegatedProofDenied
-        }
-    ));
-    assert_eq!(relay.calls.load(Ordering::SeqCst), 1);
-    let (evaluation_id, relay_consultation_ids) = audit.into_parts();
-    assert!(evaluation_id.is_some());
-    let denial_audit = json!({
-        "error_code": error.audit_code(),
-        "verification_id": evaluation_id,
-        "relay_consultation_ids": relay_consultation_ids,
-    });
-    let denial_audit_wire = denial_audit.to_string();
-    assert!(denial_audit.get("results").is_none());
-    assert!(denial_audit.get("value").is_none());
-    for undisclosed in ["NAT-123", "CHILD-123", "\"value\":true"] {
-        assert!(!denial_audit_wire.contains(undisclosed));
-    }
-    assert_eq!(store.in_memory_evaluation_count(), 0);
-}
-
-#[tokio::test]
-async fn delegated_proof_claim_scope_denial_makes_zero_relay_calls() {
-    let evidence = delegated_evidence(vec![
-        delegated_relay_proof_claim(),
-        delegated_selected_claim(vec!["guardian-link"]),
-    ]);
-    let keys = Arc::new(SubjectAccessRateLimitKeys::new(
-        AuditKeyHasher::unkeyed_dev_only(),
-    ));
-    let (runtime, relay) = delegated_runtime_with_relay(
-        &keys,
-        RuntimeRelayOutcome::Match,
-        true,
-        None,
-        None,
-    );
-
-    let error = runtime
-        .evaluate_with_capability(
-            evidence,
-            &EvidenceStore::default(),
-            &delegated_principal(),
-            delegated_subject_access_capability(&keys, "NAT-123", "CHILD-123"),
-            delegated_runtime_request(),
-            None,
-            None,
-            None,
-        )
-        .await
-        .expect_err("the delegated caller must satisfy the proof claim scope gate");
-
-    assert!(matches!(
-        error,
-        EvidenceError::ScopeDenied { required } if required == "subject_access"
-    ));
-    assert_eq!(relay.calls.load(Ordering::SeqCst), 0);
-}
-
-#[tokio::test]
-async fn delegated_requester_or_target_binding_mismatch_makes_zero_relay_calls() {
-    for (requester, target) in [
-        ("OTHER-REQUESTER", "CHILD-123"),
-        ("NAT-123", "OTHER-TARGET"),
-    ] {
-        let evidence = delegated_evidence(vec![
-            delegated_relay_proof_claim(),
-            delegated_selected_claim(vec!["guardian-link"]),
-        ]);
-        let keys = Arc::new(SubjectAccessRateLimitKeys::new(
-            AuditKeyHasher::unkeyed_dev_only(),
-        ));
-        let (runtime, relay) = delegated_runtime_with_relay(
-            &keys,
-            RuntimeRelayOutcome::Match,
-            true,
-            None,
-            None,
-        );
-
-        let error = runtime
-            .evaluate_with_capability(
-                evidence,
-                &EvidenceStore::default(),
-                &delegated_relay_principal(),
-                delegated_subject_access_capability(&keys, requester, target),
-                delegated_runtime_request(),
-                None,
-                None,
-                None,
-            )
-            .await
-            .expect_err("delegated requester and target bindings fail closed before Relay");
-
-        assert!(matches!(
-            error,
-            EvidenceError::SubjectAccessDenied {
-                reason: SubjectAccessDenialCode::DelegatedSubjectNotPermitted
-            }
-        ));
-        assert_eq!(relay.calls.load(Ordering::SeqCst), 0);
-    }
-}
-
-#[tokio::test]
-async fn delegated_false_or_no_match_relay_proof_is_relationship_unproven() {
-    for (outcome, proof_value) in [
-        (RuntimeRelayOutcome::Match, false),
-        (RuntimeRelayOutcome::NoMatch, false),
-    ] {
-        let evidence = delegated_evidence(vec![
-            delegated_relay_proof_claim(),
-            delegated_selected_claim(vec!["guardian-link"]),
-        ]);
-        let keys = Arc::new(SubjectAccessRateLimitKeys::new(
-            AuditKeyHasher::unkeyed_dev_only(),
-        ));
-        let (runtime, relay) =
-            delegated_runtime_with_relay(&keys, outcome, proof_value, None, None);
-
-        let error = runtime
-            .evaluate_with_capability(
-                evidence,
-                &EvidenceStore::default(),
-                &delegated_relay_principal(),
-                delegated_subject_access_capability(&keys, "NAT-123", "CHILD-123"),
-                delegated_runtime_request(),
-                None,
-                None,
-                None,
-            )
-            .await
-            .expect_err("a false or absent relationship proof denies its dependent claim");
-
-        assert!(matches!(
-            error,
-            EvidenceError::SubjectAccessDenied {
-                reason: SubjectAccessDenialCode::DelegatedRelationshipUnproven
-            }
-        ));
-        assert_eq!(relay.calls.load(Ordering::SeqCst), 1);
-    }
-}
-
-#[tokio::test]
-async fn delegated_relay_execution_failure_is_proof_denied() {
-    let evidence = delegated_evidence(vec![
-        delegated_relay_proof_claim(),
-        delegated_selected_claim(vec!["guardian-link"]),
-    ]);
-    let keys = Arc::new(SubjectAccessRateLimitKeys::new(
-        AuditKeyHasher::unkeyed_dev_only(),
-    ));
-    let (runtime, relay) = delegated_runtime_with_relay(
-        &keys,
-        RuntimeRelayOutcome::Match,
-        true,
-        None,
-        Some(crate::relay_client::RelayClientError::TransportUnavailable),
-    );
-
-    let error = runtime
-        .evaluate_with_capability(
-            evidence,
-            &EvidenceStore::default(),
-            &delegated_relay_principal(),
-            delegated_subject_access_capability(&keys, "NAT-123", "CHILD-123"),
-            delegated_runtime_request(),
-            None,
-            None,
-            None,
-        )
-        .await
-        .expect_err("Relay execution failure fails closed as delegated proof denial");
-
-    assert!(matches!(
-        error,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::DelegatedProofDenied
-        }
-    ));
-    assert_eq!(relay.calls.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn delegated_relay_contract_mismatch_is_proof_denied_before_execution() {
-    let evidence = delegated_evidence(vec![
-        delegated_relay_proof_claim(),
-        delegated_selected_claim(vec!["guardian-link"]),
-    ]);
-    let keys = Arc::new(SubjectAccessRateLimitKeys::new(
-        AuditKeyHasher::unkeyed_dev_only(),
-    ));
-    let (runtime, relay) = delegated_runtime_with_relay(
-        &keys,
-        RuntimeRelayOutcome::Match,
-        true,
-        Some(crate::relay_client::RelayClientError::ContractMismatch),
-        None,
-    );
-
-    let error = runtime
-        .evaluate_with_capability(
-            evidence,
-            &EvidenceStore::default(),
-            &delegated_relay_principal(),
-            delegated_subject_access_capability(&keys, "NAT-123", "CHILD-123"),
-            delegated_runtime_request(),
-            None,
-            None,
-            None,
-        )
-        .await
-        .expect_err("pinned Relay contract mismatch fails closed as proof denial");
-
-    assert!(matches!(
-        error,
-        EvidenceError::SubjectAccessDenied {
-            reason: SubjectAccessDenialCode::DelegatedProofDenied
-        }
-    ));
-    assert_eq!(relay.calls.load(Ordering::SeqCst), 0);
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn typed_registry_claim(id: &str, rule: RuleConfig, value_type: &str) -> ClaimDefinition {
-    let mut claim = registry_claim(id, rule, value_type);
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-        panic!("registry-backed claim")
-    };
-    consultations
-        .get_mut("enrollment")
-        .expect("consultation exists")
-        .outputs = BTreeMap::from([(
-        "date_of_birth".to_string(),
-        registry_notary_core::RelayOutputContract::Date { nullable: true },
-    )]);
-    claim.value.nullable = true;
-    claim
-}
-
-async fn audited_registry_evaluation(
-    claim: ClaimDefinition,
-    outcome: RuntimeRelayOutcome,
-) -> (
-    Result<Vec<ClaimResultView>, EvidenceError>,
-    EvaluationAuditSnapshot,
-    Arc<FixedRelayConsultation>,
-) {
-    let mut evidence = (*test_evidence(vec![claim])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    let activated = Arc::new(FixedRelayConsultation {
-        calls: AtomicU64::new(0),
-        outcome,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-    let result = runtime
-        .evaluate_for_api(
-            Arc::new(evidence),
-            &EvidenceStore::default(),
-            &principal,
-            test_request("enrollment-status"),
-            None,
-        )
-        .await;
-    (result.0, result.1, activated)
-}
-
-fn assert_relay_audit(snapshot: EvaluationAuditSnapshot) -> String {
-    let (evaluation_id, consultation_ids) = snapshot.into_parts();
-    let evaluation_id = evaluation_id.expect("post-preflight evaluation id is retained");
-    assert!(Ulid::from_string(&evaluation_id).is_ok());
-    assert_eq!(consultation_ids, vec![Ulid::from_parts(2, 1).to_string()]);
-    evaluation_id
-}
-
-#[tokio::test]
-async fn relay_match_correlation_survives_success_without_public_relay_ids() {
-    let claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    let (result, audit, activated) =
-        audited_registry_evaluation(claim, RuntimeRelayOutcome::Match).await;
-    let results = result.expect("match evaluates");
-    let evaluation_id = assert_relay_audit(audit);
-
-    assert_eq!(results[0].evaluation_id, evaluation_id);
-    assert_eq!(results[0].value, Some(Value::String("ACTIVE".to_string())));
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 1);
-    let public = serde_json::to_string(&results).expect("public results serialize");
-    assert!(!public.contains(&Ulid::from_parts(2, 1).to_string()));
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn typed_output_map_is_reused_for_direct_output_and_date_age_claims() {
-    let date = typed_registry_claim(
-        "date-of-birth",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "date_of_birth".to_string(),
-        },
-        "date",
-    );
-    let age_band = typed_registry_claim(
-            "age-band",
-            RuleConfig::Cel {
-                expression: "enrollment.matched && enrollment.date_of_birth != null ? (date.age_on(enrollment.date_of_birth, as_of_date) < 18 ? \"child\" : \"adult\") : null".to_string(),
-            },
-            "string",
-        );
-    let mut evidence = (*test_evidence(vec![date, age_band])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    evidence.variables.insert(
-        "as_of_date".to_string(),
-        registry_notary_core::RequestVariableConfig {
-            from: "request.variables.as_of_date".to_string(),
-            value_type: registry_notary_core::RequestVariableType::Date,
-        },
-    );
-    let activated = Arc::new(TypedOutputRelay {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::Match,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-    let mut request = test_request("date-of-birth");
-    request.claims.push(ClaimRef::from("age-band"));
-    request.variables = registry_notary_core::RequestVariables::try_new(BTreeMap::from([(
-        "as_of_date".to_string(),
-        "2026-01-01".to_string(),
-    )]))
-    .expect("valid full-date variable");
-
-    let results = runtime
-        .evaluate_for_api(
-            Arc::new(evidence),
-            &EvidenceStore::default(),
-            &principal,
-            request,
-            None,
-        )
-        .await
-        .0
-        .expect("typed outputs evaluate");
-
-    assert_eq!(results.len(), 2);
-    assert_eq!(results[0].value, Some(json!("2010-06-15")));
-    assert_eq!(results[1].value, Some(json!("child")));
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 1);
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn missing_declared_cel_variable_is_denied_before_relay() {
-    let age_band = typed_registry_claim(
-            "age-band",
-            RuleConfig::Cel {
-                expression: "enrollment.matched && enrollment.date_of_birth != null ? date.age_on(enrollment.date_of_birth, as_of_date) : null".to_string(),
-            },
-            "integer",
-        );
-    let mut evidence = (*test_evidence(vec![age_band])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    evidence.variables.insert(
-        "as_of_date".to_string(),
-        registry_notary_core::RequestVariableConfig {
-            from: "request.variables.as_of_date".to_string(),
-            value_type: registry_notary_core::RequestVariableType::Date,
-        },
-    );
-    let activated = Arc::new(TypedOutputRelay {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::Match,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-
-    let (result, audit) = runtime
-        .evaluate_for_api(
-            Arc::new(evidence),
-            &EvidenceStore::default(),
-            &principal,
-            test_request("age-band"),
-            None,
-        )
-        .await;
-
-    assert!(matches!(result, Err(EvidenceError::InvalidRequest)));
-    let (evaluation_id, consultation_ids) = audit.into_parts();
-    assert!(evaluation_id.is_none());
-    assert!(consultation_ids.is_empty());
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 0);
-
-    let mut request = test_request("age-band");
-    request.variables = registry_notary_core::RequestVariables::try_new(BTreeMap::from([(
-        "attacker_selected".to_string(),
-        "2026-01-01".to_string(),
-    )]))
-    .expect("generic request-variable bounds accept the name");
-    let (result, audit) = runtime
-        .evaluate_for_api(
-            test_evidence(vec![typed_registry_claim(
-                "age-band",
-                RuleConfig::Cel {
-                    expression: "enrollment.matched".to_string(),
-                },
-                "boolean",
-            )]),
-            &EvidenceStore::default(),
-            &principal,
-            request,
-            None,
-        )
-        .await;
-    assert!(matches!(result, Err(EvidenceError::InvalidRequest)));
-    let (evaluation_id, consultation_ids) = audit.into_parts();
-    assert!(evaluation_id.is_none());
-    assert!(consultation_ids.is_empty());
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 0);
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[test]
-fn no_match_builds_only_presence_and_nullable_absence_outputs() {
-    let claim = typed_registry_claim(
-        "age-band",
-        RuleConfig::Cel {
-            expression: "enrollment.matched ? \"known\" : null".to_string(),
-        },
-        "string",
-    );
-    let sources = materialize_relay_absence(&claim).expect("absence map materializes");
-    assert_eq!(
-        sources.get("enrollment"),
-        Some(&json!({
-            "date_of_birth": null,
-            "matched": false,
-            "outcome": "no_match"
-        }))
-    );
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn no_match_reuses_typed_absence_for_presence_and_nullable_direct_claims() {
-    let mut exists = typed_registry_claim(
-        "birth-record-exists",
-        RuleConfig::ConsultationMatched {
-            consultation: "enrollment".to_string(),
-        },
-        "boolean",
-    );
-    exists.value.nullable = false;
-    let date = typed_registry_claim(
-        "date-of-birth",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "date_of_birth".to_string(),
-        },
-        "date",
-    );
-    let mut evidence = (*test_evidence(vec![exists, date])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    let activated = Arc::new(TypedOutputRelay {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::NoMatch,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-    let mut request = test_request("birth-record-exists");
-    request.claims.push(ClaimRef::from("date-of-birth"));
-
-    let results = runtime
-        .evaluate_for_api(
-            Arc::new(evidence),
-            &EvidenceStore::default(),
-            &principal,
-            request,
-            None,
-        )
-        .await
-        .0
-        .expect("typed absence claims evaluate");
-
-    assert_eq!(results[0].value, Some(json!(false)));
-    assert_eq!(results[1].value, Some(Value::Null));
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 1);
-}
-
-#[test]
-fn relay_consultation_matched_materializes_declared_outputs_and_outcome() {
-    let claim = registry_claim(
-        "enrollment-known",
-        RuleConfig::ConsultationMatched {
-            consultation: "enrollment".to_string(),
-        },
-        "boolean",
-    );
-    let result = RuntimeRelayConsultationResult::new(
-        Ulid::from_parts(2, 1),
-        RuntimeRelayOutcome::Match,
-        Some(RuntimeRelayMatchData::OutputMap(
-            RuntimeRelayOutputMap::from_json(BTreeMap::from([(
-                "registration_status".to_string(),
-                json!("ACTIVE"),
-            )]))
-            .expect("valid output map"),
-        )),
-        OffsetDateTime::UNIX_EPOCH,
-    )
-    .expect("valid Relay match");
-
-    let sources = materialize_relay_match(&claim, &result)
-        .expect("exists match materializes the declared output namespace");
-
-    assert_eq!(
-        sources.get("enrollment"),
-        Some(&json!({
-            "registration_status": "ACTIVE",
-            "matched": true,
-            "outcome": "match"
-        }))
-    );
-}
-
-#[tokio::test]
-async fn relay_no_match_consultation_output_materializes_null_with_restricted_correlation() {
-    let claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    let (result, audit, activated) =
-        audited_registry_evaluation(claim, RuntimeRelayOutcome::NoMatch).await;
-
-    let results = result.expect("no-match extraction evaluates to its explicit null view");
-    assert_eq!(results[0].value, Some(Value::Null));
-    assert_relay_audit(audit);
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn relay_no_match_consultation_matched_remains_false_with_restricted_correlation() {
-    let claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationMatched {
-            consultation: "enrollment".to_string(),
-        },
-        "boolean",
-    );
-    let (result, audit, activated) =
-        audited_registry_evaluation(claim, RuntimeRelayOutcome::NoMatch).await;
-    let results = result.expect("no-match existence evaluates to false");
-
-    assert_eq!(results[0].value, Some(Value::Bool(false)));
-    assert_relay_audit(audit);
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn relay_ambiguous_failure_retains_restricted_correlation() {
-    let claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    let (result, audit, activated) =
-        audited_registry_evaluation(claim, RuntimeRelayOutcome::Ambiguous).await;
-
-    assert!(matches!(result, Err(EvidenceError::EvidenceNotAvailable)));
-    assert_relay_audit(audit);
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn relay_ambiguous_consultation_matched_remains_fail_closed() {
-    let claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationMatched {
-            consultation: "enrollment".to_string(),
-        },
-        "boolean",
-    );
-    let (result, audit, activated) =
-        audited_registry_evaluation(claim, RuntimeRelayOutcome::Ambiguous).await;
-
-    assert!(matches!(result, Err(EvidenceError::EvidenceNotAvailable)));
-    assert_relay_audit(audit);
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn post_relay_type_failure_retains_restricted_correlation() {
-    let claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "boolean",
-    );
-    let (result, audit, activated) =
-        audited_registry_evaluation(claim, RuntimeRelayOutcome::Match).await;
-
-    assert!(matches!(result, Err(EvidenceError::RuleEvaluationFailed)));
-    assert_relay_audit(audit);
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn registry_backed_claims_share_one_relay_consultation_without_fallback() {
-    let exists = registry_claim(
-        "enrollment-known",
-        RuleConfig::ConsultationMatched {
-            consultation: "enrollment".to_string(),
-        },
-        "boolean",
-    );
-    let extract = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    let mut evidence = (*test_evidence(vec![exists, extract])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    let evidence = Arc::new(evidence);
-    let activated = Arc::new(FixedRelayConsultation {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::Match,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let store = EvidenceStore::default();
-    let mut request = test_request("enrollment-known");
-    request.claims.push(ClaimRef::from("enrollment-status"));
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-
-    let results = runtime
-        .evaluate(
-            Arc::clone(&evidence),
-            &store,
-            &principal,
-            request.clone(),
-            None,
-        )
-        .await
-        .expect("the coalesced Registry-backed evaluation succeeds");
-
-    assert_eq!(results.len(), 2);
-    assert_eq!(results[0].value, Some(Value::Bool(true)));
-    assert_eq!(results[1].value, Some(Value::String("ACTIVE".to_string())));
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 1);
-    assert!(results
-        .iter()
-        .all(|result| result.provenance.used.relay_consultation_count == 1));
-    let stored = store
-        .get(&results[0].evaluation_id, &principal.principal_id)
-        .await
-        .expect("stored evaluation read succeeds")
-        .expect("restricted evaluation record is stored");
-    assert!(
-        stored.issuance_provenance.is_none(),
-        "registry-backed evaluation-only claims must not retain private Relay identifiers"
-    );
-    let stored_wire = serde_json::to_string(&stored).expect("stored evaluation serializes");
-    assert!(!stored_wire.contains("relay_consultation_ids"));
-    assert!(!stored_wire.contains(&Ulid::from_parts(2, 1).to_string()));
-    let public_wire = serde_json::to_string(&results).expect("public results serialize");
-    assert!(!public_wire.contains("relay_consultation_ids"));
-
-    runtime
-        .evaluate(
-            evidence,
-            &store,
-            &principal,
-            request,
-            None,
-        )
-        .await
-        .expect("a new evaluation performs a new consultation");
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 2);
-}
-
-#[tokio::test]
-async fn registry_credential_root_persists_exact_dependency_execution_closure() {
-    let mut dependency = registry_claim(
-        "civil-record-active",
-        RuleConfig::ConsultationMatched {
-            consultation: "enrollment".to_string(),
-        },
-        "boolean",
-    );
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut dependency.evidence_mode else {
-        panic!("dependency is registry backed");
-    };
-    consultations
-        .get_mut("enrollment")
-        .expect("dependency consultation exists")
-        .profile
-        .id = "dhis2.tracker.civil-record.exact".to_string();
-    let mut root = registry_claim(
-        "credential-eligible",
-        RuleConfig::ConsultationMatched {
-            consultation: "enrollment".to_string(),
-        },
-        "boolean",
-    );
-    root.depends_on = vec![dependency.id.clone()];
-    root.credential_profiles = vec!["credential-profile".to_string()];
-    let mut evidence = (*test_evidence(vec![dependency, root])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    evidence.credential_profiles.insert(
-        "credential-profile".to_string(),
-        serde_json::from_value(json!({
-            "format": FORMAT_SD_JWT_VC,
-            "issuer": "did:web:issuer.example",
-            "signing_key": "issuer-key",
-            "vct": "https://issuer.example/credentials/test",
-            "allowed_claims": ["credential-eligible"]
-        }))
-        .expect("credential profile parses"),
-    );
-    let evidence = Arc::new(evidence);
-    let activated = Arc::new(UniqueRelayConsultation::default());
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let store = EvidenceStore::default();
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-
-    let results = runtime
-        .evaluate(
-            Arc::clone(&evidence),
-            &store,
-            &principal,
-            test_request("credential-eligible"),
-            None,
-        )
-        .await
-        .expect("root and dependency execute");
-
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 2);
-    assert_eq!(results.len(), 1);
-    assert_eq!(results[0].provenance.used.relay_consultation_count, 2);
-    let stored = store
-        .get(&results[0].evaluation_id, &principal.principal_id)
-        .await
-        .expect("stored evaluation reads")
-        .expect("stored evaluation exists");
-    let issuance = stored
-        .issuance_provenance
-        .as_ref()
-        .expect("registry closure provenance is retained");
-    assert_eq!(
-        issuance
-            .claims
-            .iter()
-            .map(|claim| claim.claim_id.as_str())
-            .collect::<BTreeSet<_>>(),
-        BTreeSet::from(["civil-record-active", "credential-eligible"])
-    );
-    assert_eq!(issuance.consultations.len(), 2);
-    assert!(issuance
-        .claims
-        .iter()
-        .all(|claim| claim.execution_binding.starts_with("sha256:")));
-    require_issuable_evaluation_provenance(&evidence, &results[0].evaluation_id, &stored)
-        .expect("the exact dependency closure is issuable");
-}
-
-fn registry_batch_request(claims: Vec<ClaimRef>) -> BatchEvaluateRequest {
-    BatchEvaluateRequest {
-        items: ["person-1", "person-1"]
-            .into_iter()
-            .map(|id| {
-                registry_notary_core::BatchEvaluateItemRequest::from(
-                    registry_notary_core::BatchSubjectRequest {
-                        id: id.to_string(),
-                        id_type: None,
-                        purpose: None,
-                    },
-                )
-            })
-            .collect(),
-        claims,
-        disclosure: Some("value".to_string()),
-        format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-        purpose: Some("test".to_string()),
-    }
-}
-
-fn enable_registry_batch(claim: &mut ClaimDefinition) {
-    claim.operations.batch_evaluate.enabled = true;
-    claim.operations.batch_evaluate.max_subjects = 4;
-}
-
-fn enrollment_status_batch_evidence() -> Arc<EvidenceConfig> {
-    let mut claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    enable_registry_batch(&mut claim);
-    let mut evidence = (*test_evidence(vec![claim])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    evidence.inline_batch_limit = 4;
-    Arc::new(evidence)
-}
-
-fn registry_evidence_principal() -> EvidencePrincipal {
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-    principal
-}
-
-fn runtime_with_test_relay<T>(relay: Arc<T>) -> RegistryNotaryRuntime
-where
-    T: ActivatedRelayConsultations + 'static,
-{
-    let relay: Arc<dyn ActivatedRelayConsultations> = relay;
-    RegistryNotaryRuntime::new().with_activated_relay(Some(relay))
-}
-
-#[tokio::test]
-async fn typed_target_attributes_are_canonical_in_single_and_batch_plans() {
-    let mut claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    enable_registry_batch(&mut claim);
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-        panic!("claim is registry backed")
-    };
-    let inputs = &mut consultations
-        .get_mut("enrollment")
-        .expect("consultation exists")
-        .inputs;
-    inputs.insert(
-        "include_inactive".to_string(),
-        RelayConsultationInput::TargetAttribute(
-            "request.target.attributes.include_inactive".to_string(),
-        ),
-    );
-    inputs.insert(
-        "person_sequence".to_string(),
-        RelayConsultationInput::TargetAttribute(
-            "request.target.attributes.person_sequence".to_string(),
-        ),
-    );
-
-    let mut evidence = (*test_evidence(vec![claim])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    evidence.inline_batch_limit = 4;
-    let evidence = Arc::new(evidence);
-    let activated = Arc::new(TypedInputRelay::default());
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-
-    let mut single = test_request("enrollment-status");
-    let single_target = single.target.as_mut().expect("single target exists");
-    single_target
-        .attributes
-        .insert("include_inactive".to_string(), json!(true));
-    single_target
-        .attributes
-        .insert("person_sequence".to_string(), json!(42));
-    runtime
-        .evaluate(
-            Arc::clone(&evidence),
-            &EvidenceStore::default(),
-            &principal,
-            single,
-            None,
-        )
-        .await
-        .expect("single evaluation preserves typed target scalars");
-
-    let mut batch = registry_batch_request(vec![ClaimRef::from("enrollment-status")]);
-    for (index, item) in batch.items.iter_mut().enumerate() {
-        item.target
-            .attributes
-            .insert("include_inactive".to_string(), json!(index == 0));
-        item.target
-            .attributes
-            .insert("person_sequence".to_string(), json!(index + 1));
-    }
-    runtime
-        .batch_evaluate(
-            evidence,
-            &EvidenceStore::default(),
-            &principal,
-            batch,
-            BatchEvaluateOptions {
-                idempotency_key: Some("typed-target-attributes"),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await
-        .expect("batch evaluation preserves typed target scalars");
-
-    assert_eq!(
-        *activated
-            .single_inputs
-            .lock()
-            .expect("single input lock is not poisoned"),
-        vec![BTreeMap::from([
-            ("include_inactive".to_string(), "true".to_string()),
-            ("person_sequence".to_string(), "42".to_string()),
-            ("tracked_entity".to_string(), "person-1".to_string()),
-        ])]
-    );
-    let mut batch_inputs = activated
-        .batch_inputs
-        .lock()
-        .expect("batch input lock is not poisoned")
-        .clone();
-    batch_inputs.sort_by(|left, right| left["person_sequence"].cmp(&right["person_sequence"]));
-    assert_eq!(
-        batch_inputs,
-        vec![
-            BTreeMap::from([
-                ("include_inactive".to_string(), "true".to_string()),
-                ("person_sequence".to_string(), "1".to_string()),
-                ("tracked_entity".to_string(), "person-1".to_string()),
-            ]),
-            BTreeMap::from([
-                ("include_inactive".to_string(), "false".to_string()),
-                ("person_sequence".to_string(), "2".to_string()),
-                ("tracked_entity".to_string(), "person-1".to_string()),
-            ]),
-        ]
-    );
-}
-
-#[tokio::test]
-async fn registry_batch_requires_outer_key_before_relay_work() {
-    let mut claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    enable_registry_batch(&mut claim);
-    let mut evidence = (*test_evidence(vec![claim])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    evidence.inline_batch_limit = 4;
-    let activated = Arc::new(FixedRelayConsultation {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::Match,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-
-    let error = runtime
-        .batch_evaluate(
-            Arc::new(evidence),
-            &EvidenceStore::default(),
-            &principal,
-            registry_batch_request(vec![ClaimRef::from("enrollment-status")]),
-            BatchEvaluateOptions::default(),
-        )
-        .await
-        .expect_err("registry batch without an outer idempotency key is rejected");
-
-    assert!(matches!(error, EvidenceError::ConsultationInvalidRequest));
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 0);
-}
-
-#[tokio::test]
-async fn registry_batch_hard_ceiling_rejects_before_quota_idempotency_relay_or_state() {
-    let mut claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    enable_registry_batch(&mut claim);
-    // Bypass the config loader deliberately. The runtime ceiling must still be
-    // authoritative if an EvidenceConfig is assembled directly in-process.
-    claim.operations.batch_evaluate.max_subjects =
-        registry_notary_core::MAX_BATCH_EVALUATION_MEMBERS_V1 + 1;
-    let disabled_claim = registry_claim(
-        "disabled-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    let mut evidence = (*test_evidence(vec![claim, disabled_claim])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    evidence.inline_batch_limit = registry_notary_core::MAX_BATCH_EVALUATION_MEMBERS_V1 + 1;
-    let evidence = Arc::new(evidence);
-    let activated = Arc::new(FixedRelayConsultation {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::Match,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let store = EvidenceStore::default();
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-    let quota = crate::MachineQuotaLimiter::new(registry_notary_core::MachineQuotaConfig {
-        enabled: true,
-        subjects_per_minute: 1,
-    });
-    let mut request = registry_batch_request(vec![ClaimRef::from("enrollment-status")]);
-    request.items = vec![
-        request.items[0].clone();
-        registry_notary_core::MAX_BATCH_EVALUATION_MEMBERS_V1 + 1
-    ];
-
-    for claim in ["missing-claim", "disabled-status"] {
-        let mut invalid_claim_request = request.clone();
-        invalid_claim_request.claims = vec![ClaimRef::from(claim)];
-        let error = runtime
-            .batch_evaluate(
-                Arc::clone(&evidence),
-                &store,
-                &principal,
-                invalid_claim_request,
-                BatchEvaluateOptions::default(),
-            )
-            .await
-            .expect_err("the hard ceiling precedes claim lookup and operation checks");
-        assert!(matches!(error, EvidenceError::BatchTooLarge));
-    }
-
-    let error_without_key = runtime
-        .batch_evaluate(
-            Arc::clone(&evidence),
-            &store,
-            &principal,
-            request.clone(),
-            BatchEvaluateOptions {
-                owner_quota: Some((&quota, request.items.len() as u32)),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await
-        .expect_err("the size rejection precedes registry idempotency-key validation");
-    assert!(matches!(error_without_key, EvidenceError::BatchTooLarge));
-
-    let error = runtime
-        .batch_evaluate(
-            Arc::clone(&evidence),
-            &store,
-            &principal,
-            request.clone(),
-            BatchEvaluateOptions {
-                idempotency_key: Some("hard-ceiling-key"),
-                owner_quota: Some((&quota, request.items.len() as u32)),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await
-        .expect_err("the platform ceiling cannot be raised by runtime config");
-
-    assert!(matches!(error, EvidenceError::BatchTooLarge));
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 0);
-
-    request.items.truncate(1);
-    let response = runtime
-        .batch_evaluate(
-            evidence,
-            &store,
-            &principal,
-            request,
-            BatchEvaluateOptions {
-                idempotency_key: Some("hard-ceiling-key"),
-                owner_quota: Some((&quota, 1)),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await
-        .expect("rejection neither consumes quota nor binds the idempotency key");
-
-    assert!(matches!(response.items[0].status, BatchItemStatus::Succeeded));
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn registry_batch_effective_limit_uses_the_lowest_operator_override() {
-    for (inline_limit, claim_limit) in [(2, 4), (4, 2)] {
-        let mut claim = registry_claim(
-            "enrollment-status",
-            RuleConfig::ConsultationOutput {
-                consultation: "enrollment".to_string(),
-                output: "registration_status".to_string(),
-            },
-            "string",
-        );
-        enable_registry_batch(&mut claim);
-        claim.operations.batch_evaluate.max_subjects = claim_limit;
-        let mut evidence = (*test_evidence(vec![claim])).clone();
-        evidence.allowed_purposes = vec!["test".to_string()];
-        evidence.inline_batch_limit = inline_limit;
-        let activated = Arc::new(FixedRelayConsultation {
-            calls: AtomicU64::new(0),
-            outcome: RuntimeRelayOutcome::Match,
-        });
-        let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-        let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-        let mut principal = machine_principal();
-        principal.scopes = vec!["registry:evidence".to_string()];
-        let mut request = registry_batch_request(vec![ClaimRef::from("enrollment-status")]);
-        request.items.push(request.items[0].clone());
-
-        let error = runtime
-            .batch_evaluate(
-                Arc::new(evidence),
-                &EvidenceStore::default(),
-                &principal,
-                request,
-                BatchEvaluateOptions::default(),
-            )
-            .await
-            .expect_err("the lowest configured limit rejects three members");
-
-        assert!(matches!(error, EvidenceError::BatchTooLarge));
-        assert_eq!(activated.calls.load(Ordering::SeqCst), 0);
-    }
-}
-
-#[tokio::test]
-async fn registry_batch_preflights_every_item_before_first_relay_call() {
-    let mut claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    enable_registry_batch(&mut claim);
-    let mut evidence = (*test_evidence(vec![claim])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    evidence.inline_batch_limit = 4;
-    let activated = Arc::new(FixedRelayConsultation {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::Match,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-    let mut request = registry_batch_request(vec![ClaimRef::from("enrollment-status")]);
-    request.items[1].target = EvidenceEntity::new("Person");
-
-    let error = runtime
-        .batch_evaluate(
-            Arc::new(evidence),
-            &EvidenceStore::default(),
-            &principal,
-            request,
-            BatchEvaluateOptions {
-                idempotency_key: Some("batch-key"),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await
-        .expect_err("an invalid later item fails the whole pure preflight");
-
-    assert!(matches!(error, EvidenceError::InvalidRequest));
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 0);
-}
-
-#[tokio::test]
-async fn registry_batch_rejects_more_than_256_aggregate_groups_before_dispatch() {
-    let mut claims = Vec::new();
-    let mut claim_refs = Vec::new();
-    for index in 0..16 {
-        let claim_id = format!("grouped-claim-{index}");
-        let mut claim = registry_claim(
-            &claim_id,
-            RuleConfig::ConsultationOutput {
-                consultation: "enrollment".to_string(),
-                output: "registration_status".to_string(),
-            },
-            "string",
-        );
-        enable_registry_batch(&mut claim);
-        claim.operations.batch_evaluate.max_subjects = 17;
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-            panic!("claim is registry backed")
-        };
-        consultations
-            .get_mut("enrollment")
-            .expect("consultation exists")
-            .profile
-            .id = format!("test.batch.profile-{index}");
-        claim_refs.push(ClaimRef::from(claim_id.as_str()));
-        claims.push(claim);
-    }
-    let mut evidence = (*test_evidence(claims)).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    evidence.inline_batch_limit = 17;
-    let activated = Arc::new(FixedRelayConsultation {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::Match,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-    let mut request = registry_batch_request(claim_refs);
-    request.items = vec![request.items[0].clone(); 17];
-
-    let error = runtime
-        .batch_evaluate(
-            Arc::new(evidence),
-            &EvidenceStore::default(),
-            &principal,
-            request,
-            BatchEvaluateOptions {
-                idempotency_key: Some("too-many-aggregate-groups"),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await
-        .expect_err("17 items with 16 groups each exceed the aggregate bound");
-
-    assert!(matches!(error, EvidenceError::ConsultationInvalidRequest));
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 0);
-}
-
-#[tokio::test]
-async fn registry_batch_returns_ordered_mixed_member_outcomes_after_admission() {
-    let mut claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    enable_registry_batch(&mut claim);
-    let mut evidence = (*test_evidence(vec![claim])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    evidence.inline_batch_limit = 4;
-    let activated = Arc::new(MixedCompletionRelay {
-        calls: AtomicU64::new(0),
-        failed_target: "person-2",
-        error: crate::relay_client::RelayClientError::TransportUnavailable,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-    let mut request = registry_batch_request(vec![ClaimRef::from("enrollment-status")]);
-    request.items[1] = registry_notary_core::BatchEvaluateItemRequest::from(
-        registry_notary_core::BatchSubjectRequest {
-            id: "person-2".to_string(),
-            id_type: None,
-            purpose: None,
-        },
-    );
-
-    let response = runtime
-        .batch_evaluate(
-            Arc::new(evidence),
-            &EvidenceStore::default(),
-            &principal,
-            request,
-            BatchEvaluateOptions {
-                idempotency_key: Some("mixed-completion-key"),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await
-        .expect("admitted member failures stay in the ordered response");
-
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 2);
-    assert_eq!(response.summary.succeeded, 1);
-    assert_eq!(response.summary.failed, 1);
-    assert_eq!(response.items[0].input_index, 0);
-    assert!(matches!(
-        response.items[0].status,
-        BatchItemStatus::Succeeded
-    ));
-    assert_eq!(response.items[1].input_index, 1);
-    assert!(matches!(
-        response.items[1].status,
-        BatchItemStatus::Failed
-    ));
-    assert_eq!(response.items[1].errors.len(), 1);
-    assert_eq!(response.items[1].errors[0].code, "evidence.not_available");
-    assert!(response.items[1].claim_results.is_empty());
-    assert_eq!(
-        response.items[1].runtime_audit.relay_forwarded_count,
-        1
-    );
-    assert!(response.items[1]
-        .runtime_audit
-        .relay_consultation_ids
-        .is_empty());
-}
-
-async fn assert_registry_batch_mixed_closed_failure(
-    failed_target: &'static str,
-    relay_error: crate::relay_client::RelayClientError,
-    idempotency_key: &'static str,
-) {
-    let evidence = enrollment_status_batch_evidence();
-    let activated = Arc::new(MixedCompletionRelay {
-        calls: AtomicU64::new(0),
-        failed_target,
-        error: relay_error,
-    });
-    let runtime = runtime_with_test_relay(Arc::clone(&activated));
-    let principal = registry_evidence_principal();
-    let mut request = registry_batch_request(vec![ClaimRef::from("enrollment-status")]);
-    request.items[1] = registry_notary_core::BatchEvaluateItemRequest::from(
-        registry_notary_core::BatchSubjectRequest {
-            id: failed_target.to_string(),
-            id_type: None,
-            purpose: None,
-        },
-    );
-
-    let response = runtime
-        .batch_evaluate(
-            evidence,
-            &EvidenceStore::default(),
-            &principal,
-            request,
-            BatchEvaluateOptions {
-                idempotency_key: Some(idempotency_key),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await
-        .expect("an admitted Relay failure remains a member-level outcome");
-
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 2);
-    assert_eq!(response.summary.succeeded, 1);
-    assert_eq!(response.summary.failed, 1);
-    assert_eq!(response.items[0].input_index, 0);
-    assert!(matches!(
-        response.items[0].status,
-        BatchItemStatus::Succeeded
-    ));
-    assert_eq!(response.items[1].input_index, 1);
-    assert!(matches!(
-        response.items[1].status,
-        BatchItemStatus::Failed
-    ));
-    assert_eq!(response.items[1].errors.len(), 1);
-    assert_eq!(response.items[1].errors[0].code, "evidence.not_available");
-    assert_eq!(
-        response.items[1].errors[0].audit_code.as_deref(),
-        Some("evidence.not_available")
-    );
-    assert!(!response.items[1].errors[0].retryable);
-    assert!(response.items[1].claim_results.is_empty());
-    assert_eq!(
-        response.items[1].runtime_audit.relay_forwarded_count,
-        1
-    );
-    assert!(response.items[1]
-        .runtime_audit
-        .relay_consultation_ids
-        .is_empty());
-
-    let public_response = serde_json::to_string(&response).expect("batch response serializes");
-    assert!(!public_response.contains(failed_target));
-    assert!(!public_response.contains("runtime_audit"));
-}
-
-#[tokio::test]
-async fn registry_batch_preserves_mixed_policy_denial_as_ordered_value_free_item_error() {
-    assert_registry_batch_mixed_closed_failure(
-        "person-policy-denied",
-        crate::relay_client::RelayClientError::Denied,
-        "mixed-policy-denial-key",
-    )
-    .await;
-}
-
-#[tokio::test]
-async fn registry_batch_preserves_mixed_relay_timeout_as_ordered_value_free_item_error() {
-    assert_registry_batch_mixed_closed_failure(
-        "person-relay-timeout",
-        crate::relay_client::RelayClientError::TransportUnavailable,
-        "mixed-relay-timeout-key",
-    )
-    .await;
-}
-
-#[tokio::test]
-async fn single_and_batch_equivalence_matrix_pins_security_and_disclosure_surfaces() {
-    let evidence = enrollment_status_batch_evidence();
-    let authorization_relay = Arc::new(FixedRelayConsultation {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::Match,
-    });
-    let authorization_runtime = runtime_with_test_relay(Arc::clone(&authorization_relay));
-    let mut unauthorized_principal = machine_principal();
-    unauthorized_principal.scopes.clear();
-    let single_authorization = authorization_runtime
-        .evaluate(
-            Arc::clone(&evidence),
-            &EvidenceStore::default(),
-            &unauthorized_principal,
-            test_request("enrollment-status"),
-            None,
-        )
-        .await;
-    let mut authorization_batch =
-        registry_batch_request(vec![ClaimRef::from("enrollment-status")]);
-    authorization_batch.items.truncate(1);
-    let batch_authorization = authorization_runtime
-        .batch_evaluate(
-            Arc::clone(&evidence),
-            &EvidenceStore::default(),
-            &unauthorized_principal,
-            authorization_batch,
-            BatchEvaluateOptions {
-                idempotency_key: Some("equivalence-authorization"),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await;
-    let authorization_equivalent = matches!(
-        single_authorization,
-        Err(EvidenceError::ScopeDenied { required }) if required == "registry:evidence"
-    ) && matches!(
-        batch_authorization,
-        Err(EvidenceError::ScopeDenied { required }) if required == "registry:evidence"
-    ) && authorization_relay.calls.load(Ordering::SeqCst) == 0;
-
-    // Consent and policy enforcement remain Relay-owned. Notary must preserve
-    // the same closed denial boundary in single and batch transport shapes.
-    let consent_relay = Arc::new(MixedCompletionRelay {
-        calls: AtomicU64::new(0),
-        failed_target: "person-1",
-        error: crate::relay_client::RelayClientError::Denied,
-    });
-    let consent_runtime = runtime_with_test_relay(Arc::clone(&consent_relay));
-    let authorized_principal = registry_evidence_principal();
-    let (single_consent, single_consent_audit) = consent_runtime
-        .evaluate_for_api(
-            Arc::clone(&evidence),
-            &EvidenceStore::default(),
-            &authorized_principal,
-            test_request("enrollment-status"),
-            None,
-        )
-        .await;
-    let mut consent_batch = registry_batch_request(vec![ClaimRef::from("enrollment-status")]);
-    consent_batch.items.truncate(1);
-    let batch_consent = consent_runtime
-        .batch_evaluate(
-            Arc::clone(&evidence),
-            &EvidenceStore::default(),
-            &authorized_principal,
-            consent_batch,
-            BatchEvaluateOptions {
-                idempotency_key: Some("equivalence-consent"),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await
-        .expect("Relay policy or consent denial is a closed batch member outcome");
-    let consent_equivalent = matches!(
-        single_consent,
-        Err(EvidenceError::EvidenceNotAvailable)
-    ) && matches!(batch_consent.items[0].status, BatchItemStatus::Failed)
-        && batch_consent.items[0].errors[0].code == "evidence.not_available"
-        && single_consent_audit.relay_forwarded_count() == 1
-        && batch_consent.items[0]
-            .runtime_audit
-            .relay_forwarded_count
-            == 1
-        && consent_relay.calls.load(Ordering::SeqCst) == 2;
-
-    let success_relay = Arc::new(UniqueRelayConsultation::default());
-    let success_runtime = runtime_with_test_relay(Arc::clone(&success_relay));
-    let (single_result, single_audit) = success_runtime
-        .evaluate_for_api(
-            Arc::clone(&evidence),
-            &EvidenceStore::default(),
-            &authorized_principal,
-            test_request("enrollment-status"),
-            None,
-        )
-        .await;
-    let single_result = single_result.expect("single evaluation succeeds");
-    let mut success_batch = registry_batch_request(vec![ClaimRef::from("enrollment-status")]);
-    success_batch.items.truncate(1);
-    let batch_result = success_runtime
-        .batch_evaluate(
-            Arc::clone(&evidence),
-            &EvidenceStore::default(),
-            &authorized_principal,
-            success_batch,
-            BatchEvaluateOptions {
-                idempotency_key: Some("equivalence-success"),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await
-        .expect("batch evaluation succeeds");
-    let single_claim = &single_result[0];
-    let batch_claim = &batch_result.items[0].claim_results[0];
-
-    let mut single_provenance =
-        serde_json::to_value(&single_claim.provenance).expect("single provenance serializes");
-    let mut batch_provenance =
-        serde_json::to_value(&batch_claim.provenance).expect("batch provenance serializes");
-    single_provenance["generated_by"]
-        .as_object_mut()
-        .expect("single generated_by is an object")
-        .remove("evaluation_id");
-    batch_provenance["generated_by"]
-        .as_object_mut()
-        .expect("batch generated_by is an object")
-        .remove("evaluation_id");
-    let provenance_equivalent = single_provenance == batch_provenance
-        && single_claim.provenance.used.relay_consultation_count == 1
-        && batch_claim.provenance.used.relay_consultation_count == 1;
-
-    let public_single =
-        serde_json::to_string(&single_result).expect("single response serializes");
-    let public_batch = serde_json::to_string(&batch_result).expect("batch response serializes");
-    let minimization_equivalent = single_claim.value == batch_claim.value
-        && single_claim.satisfied == batch_claim.satisfied
-        && single_claim.disclosure == batch_claim.disclosure
-        && !public_single.contains("person-1")
-        && !public_single.contains("tracked_entity")
-        && !public_batch.contains("person-1")
-        && !public_batch.contains("tracked_entity")
-        && !public_batch.contains("runtime_audit")
-        && !public_batch.contains("relay_consultation_ids");
-
-    let single_forwarded_count = single_audit.relay_forwarded_count();
-    let (_, single_consultation_ids) = single_audit.into_parts();
-    let batch_runtime_audit = &batch_result.items[0].runtime_audit;
-    let audit_equivalent = single_forwarded_count == 1
-        && single_consultation_ids.len() == 1
-        && batch_runtime_audit.relay_consultation_ids.len() == 1
-        && batch_runtime_audit.relay_forwarded_count == 1
-        && success_relay.calls.load(Ordering::SeqCst) == 2;
-
-    let equivalence_matrix = BTreeMap::from([
-        ("authorization", authorization_equivalent),
-        ("consent", consent_equivalent),
-        ("provenance", provenance_equivalent),
-        ("minimization", minimization_equivalent),
-        ("audit", audit_equivalent),
-    ]);
-    assert!(
-        equivalence_matrix.values().all(|equivalent| *equivalent),
-        "single/batch equivalence matrix failed: {equivalence_matrix:?}"
-    );
-}
-
-#[tokio::test]
-async fn registry_batch_quota_denial_does_not_bind_a_fresh_idempotency_key() {
-    let mut claim = registry_claim(
-        "enrollment-known",
-        RuleConfig::ConsultationMatched {
-            consultation: "enrollment".to_string(),
-        },
-        "boolean",
-    );
-    enable_registry_batch(&mut claim);
-    let mut evidence = (*test_evidence(vec![claim])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    evidence.inline_batch_limit = 4;
-    let evidence = Arc::new(evidence);
-    let activated = Arc::new(BatchIdentityRelay::default());
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let store = EvidenceStore::default();
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-    let mut request = registry_batch_request(vec![ClaimRef::from("enrollment-known")]);
-    request.items.truncate(1);
-    let exhausted_quota = crate::MachineQuotaLimiter::new(
-        registry_notary_core::MachineQuotaConfig {
-            enabled: true,
-            subjects_per_minute: 1,
-        },
-    );
-    exhausted_quota
-        .check_and_consume(&principal.principal_id, 1)
-        .await
-        .unwrap();
-
-    assert!(matches!(
-        runtime
-            .batch_evaluate(
-                Arc::clone(&evidence),
-                &store,
-                &principal,
-                request.clone(),
-                BatchEvaluateOptions {
-                    idempotency_key: Some("quota-denied-key"),
-                    owner_quota: Some((&exhausted_quota, 1)),
-                    ..BatchEvaluateOptions::default()
-                },
-            )
-            .await,
-        Err(EvidenceError::MachineQuotaExceeded { .. })
-    ));
-
-    let disabled_quota = crate::MachineQuotaLimiter::new(
-        registry_notary_core::MachineQuotaConfig {
-            enabled: false,
-            subjects_per_minute: 1,
-        },
-    );
-    let mut changed_scope_principal = principal;
-    changed_scope_principal
-        .scopes
-        .push("registry:catalog".to_string());
-    let retry = runtime
-        .batch_evaluate(
-            evidence,
-            &store,
-            &changed_scope_principal,
-            request,
-            BatchEvaluateOptions {
-                idempotency_key: Some("quota-denied-key"),
-                owner_quota: Some((&disabled_quota, 1)),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await
-        .expect("an uncharged quota denial does not bind the idempotency key");
-
-    assert!(matches!(retry.items[0].status, BatchItemStatus::Succeeded));
-    assert_eq!(
-        activated
-            .child_identities
-            .lock()
-            .expect("child identity lock is not poisoned")
-            .len(),
-        1
-    );
-}
-
-#[tokio::test]
-async fn registry_batch_disabled_quota_accepts_an_unbounded_oidc_subject() {
-    let mut claim = registry_claim(
-        "enrollment-known",
-        RuleConfig::ConsultationMatched {
-            consultation: "enrollment".to_string(),
-        },
-        "boolean",
-    );
-    enable_registry_batch(&mut claim);
-    let mut evidence = (*test_evidence(vec![claim])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    evidence.inline_batch_limit = 4;
-    let activated = Arc::new(BatchIdentityRelay::default());
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let mut principal = machine_principal();
-    principal.auth_profile_id = registry_notary_core::EvidenceAuthProfileId::ExternalOidc;
-    principal.principal_id = "s".repeat(129);
-    principal.scopes = vec!["registry:evidence".to_string()];
-    let mut request = registry_batch_request(vec![ClaimRef::from("enrollment-known")]);
-    request.items.truncate(1);
-    let disabled_quota = crate::MachineQuotaLimiter::new(
-        registry_notary_core::MachineQuotaConfig {
-            enabled: false,
-            subjects_per_minute: 1,
-        },
-    );
-
-    let response = runtime
-        .batch_evaluate(
-            Arc::new(evidence),
-            &EvidenceStore::default(),
-            &principal,
-            request,
-            BatchEvaluateOptions {
-                idempotency_key: Some("disabled-quota-key"),
-                owner_quota: Some((&disabled_quota, u32::MAX)),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await
-        .expect("disabled quota performs no principal validation or quota hashing");
-
-    assert!(matches!(response.items[0].status, BatchItemStatus::Succeeded));
-    assert_eq!(
-        activated
-            .child_identities
-            .lock()
-            .expect("child identity lock is not poisoned")
-            .len(),
-        1
-    );
-}
-
-#[tokio::test]
-async fn registry_batch_coalesces_within_items_never_across_duplicates_and_replays_outer_key() {
-    let mut exists = registry_claim(
-        "enrollment-known",
-        RuleConfig::ConsultationMatched {
-            consultation: "enrollment".to_string(),
-        },
-        "boolean",
-    );
-    let mut extract = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    enable_registry_batch(&mut exists);
-    enable_registry_batch(&mut extract);
-    let mut evidence = (*test_evidence(vec![exists, extract])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    evidence.inline_batch_limit = 4;
-    let evidence = Arc::new(evidence);
-    let activated = Arc::new(BatchIdentityRelay::default());
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let store = EvidenceStore::default();
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-    let request = registry_batch_request(vec![
-        ClaimRef::from("enrollment-known"),
-        ClaimRef::from("enrollment-status"),
-    ]);
-    let quota = crate::MachineQuotaLimiter::new(registry_notary_core::MachineQuotaConfig {
-        enabled: true,
-        subjects_per_minute: 2,
-    });
-    let options = BatchEvaluateOptions {
-        idempotency_key: Some("batch-key"),
-        owner_quota: Some((&quota, 2)),
-        ..BatchEvaluateOptions::default()
-    };
-
-    let first = runtime
-        .batch_evaluate(
-            Arc::clone(&evidence),
-            &store,
-            &principal,
-            request.clone(),
-            options,
-        )
-        .await
-        .expect("duplicate subjects complete independently");
-    assert_eq!(first.items.len(), 2);
-    assert!(first
-        .items
-        .iter()
-        .all(|item| matches!(item.status, BatchItemStatus::Succeeded)));
-    assert!(first.items.iter().all(|item| {
-        item.runtime_audit.relay_forwarded_count == 1
-            && item.runtime_audit.relay_consultation_ids.len() == 1
-    }));
-    let public_response = serde_json::to_string(&first).expect("batch response serializes");
-    assert!(!public_response.contains("runtime_audit"));
-    assert!(!first.items[0]
-        .runtime_audit
-        .relay_consultation_ids
-        .iter()
-        .any(|id| public_response.contains(id)));
-    assert_ne!(first.items[0].evaluation_id, first.items[1].evaluation_id);
-    for item in &first.items {
-        let evaluation_id = item
-            .evaluation_id
-            .as_deref()
-            .expect("successful registry batch item has an evaluation id");
-        let stored = store
-            .get(evaluation_id, &principal.principal_id)
-            .await
-            .expect("batch evaluation store read succeeds")
-            .expect("batch evaluation is stored");
-        let stored_at = OffsetDateTime::parse(&stored.created_at, &Rfc3339)
-            .expect("stored_at is canonical RFC3339");
-        let expires_at = OffsetDateTime::parse(&stored.expires_at, &Rfc3339)
-            .expect("expires_at is canonical RFC3339");
-        assert_eq!(
-            expires_at - stored_at,
-            time::Duration::minutes(15),
-            "registry batch retention starts when Notary stores the evaluation"
-        );
-        assert_ne!(
-            stored.created_at, "1970-01-01T00:00:00Z",
-            "Relay acquisition time must not become Notary storage time"
-        );
-        assert!(
-            stored.issuance_provenance.is_none(),
-            "evaluation-only registry batch claims must not retain private Relay identifiers"
-        );
-    }
-    let first_children = activated
-        .child_identities
-        .lock()
-        .expect("child identity lock is not poisoned")
-        .clone();
-    assert_eq!(first_children.len(), 2);
-    assert_ne!(first_children[0], first_children[1]);
-
-    assert!(matches!(
-        runtime
-            .batch_evaluate(
-                Arc::clone(&evidence),
-                &store,
-                &principal,
-                request.clone(),
-                BatchEvaluateOptions {
-                    idempotency_key: Some("new-batch-key"),
-                    owner_quota: Some((&quota, 2)),
-                    ..BatchEvaluateOptions::default()
-                },
-            )
-            .await,
-        Err(EvidenceError::MachineQuotaExceeded { .. })
-    ));
-
-    let replay = runtime
-        .batch_evaluate(
-            Arc::clone(&evidence),
-            &store,
-            &principal,
-            request.clone(),
-            options,
-        )
-        .await
-        .expect("the exact outer-key replay returns the stored response");
-    assert_eq!(replay.batch_id, first.batch_id);
-    assert!(replay.items.iter().all(|item| {
-        item.runtime_audit.relay_forwarded_count == 0
-            && item.runtime_audit.relay_consultation_ids.is_empty()
-    }));
-    assert_eq!(
-        activated
-            .child_identities
-            .lock()
-            .expect("child identity lock is not poisoned")
-            .len(),
-        2
-    );
-
-    let mut changed_scope_principal = principal.clone();
-    changed_scope_principal
-        .scopes
-        .push("registry:catalog".to_string());
-    assert!(matches!(
-        runtime
-            .batch_evaluate(
-                Arc::clone(&evidence),
-                &store,
-                &changed_scope_principal,
-                request.clone(),
-                options,
-            )
-            .await,
-        Err(EvidenceError::IdempotencyConflict)
-    ));
-
-    let mut changed_config = (*evidence).clone();
-    changed_config.concurrency.subjects = changed_config.concurrency.subjects.saturating_add(1);
-    assert!(matches!(
-        runtime
-            .batch_evaluate(
-                Arc::new(changed_config),
-                &store,
-                &principal,
-                request,
-                options,
-            )
-            .await,
-        Err(EvidenceError::IdempotencyConflict)
-    ));
-}
-
-#[tokio::test]
-async fn registry_batch_retry_after_ambiguous_dispatch_reuses_identity_and_quota_charge()
-{
-    let mut claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    enable_registry_batch(&mut claim);
-    let mut evidence = (*test_evidence(vec![claim])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    evidence.inline_batch_limit = 4;
-    let evidence = Arc::new(evidence);
-    let activated = Arc::new(CrashRetryBatchRelay::default());
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let store = Arc::new(EvidenceStore::default());
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-    let mut request = registry_batch_request(vec![ClaimRef::from("enrollment-status")]);
-    request.items.truncate(1);
-    let quota = Arc::new(crate::MachineQuotaLimiter::new(
-        registry_notary_core::MachineQuotaConfig {
-            enabled: true,
-            subjects_per_minute: 1,
-        },
-    ));
-
-    let first = {
-        let runtime = runtime.clone();
-        let evidence = Arc::clone(&evidence);
-        let store = Arc::clone(&store);
-        let principal = principal.clone();
-        let request = request.clone();
-        let quota = Arc::clone(&quota);
-        tokio::spawn(async move {
-            runtime
-                .batch_evaluate(
-                    evidence,
-                    store.as_ref(),
-                    &principal,
-                    request,
-                    BatchEvaluateOptions {
-                        idempotency_key: Some("crash-retry-key"),
-                        owner_quota: Some((quota.as_ref(), 1)),
-                        ..BatchEvaluateOptions::default()
-                    },
-                )
-                .await
-        })
-    };
-    activated.first_dispatch.notified().await;
-    first.abort();
-    assert!(first
-        .await
-        .expect_err("first owner is cancelled")
-        .is_cancelled());
-
-    let retry = runtime
-        .batch_evaluate(
-            Arc::clone(&evidence),
-            store.as_ref(),
-            &principal,
-            request.clone(),
-            BatchEvaluateOptions {
-                idempotency_key: Some("crash-retry-key"),
-                owner_quota: Some((quota.as_ref(), 1)),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await
-        .expect("same outer request takes over after the ambiguous dispatch");
-    assert!(matches!(retry.items[0].status, BatchItemStatus::Succeeded));
-
-    let observations = activated
-        .observations
-        .lock()
-        .expect("retry observation lock is not poisoned")
-        .clone();
-    assert_eq!(observations.len(), 2);
-    assert_eq!(observations[0].0, observations[1].0);
-    assert_ne!(observations[0].1, observations[1].1);
-    assert!(observations
-        .iter()
-        .all(|(_, evaluation_id)| Ulid::from_string(evaluation_id).is_ok()));
-    assert_eq!(
-        retry.items[0].evaluation_id.as_deref(),
-        Some(observations[1].1.as_str())
-    );
-
-    let replay = runtime
-        .batch_evaluate(
-            Arc::clone(&evidence),
-            store.as_ref(),
-            &principal,
-            request,
-            BatchEvaluateOptions {
-                idempotency_key: Some("crash-retry-key"),
-                owner_quota: Some((quota.as_ref(), 1)),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await
-        .expect("completed outer request replays without another child dispatch");
-    assert_eq!(replay.batch_id, retry.batch_id);
-    assert_eq!(replay.items[0].evaluation_id, retry.items[0].evaluation_id);
-    assert_eq!(activated.attempts.load(Ordering::SeqCst), 2);
-}
-
-#[tokio::test]
-async fn registry_backed_consultation_reads_a_named_target_identifier() {
-    let mut claim = registry_claim(
-        "birth-record-known",
-        RuleConfig::ConsultationMatched {
-            consultation: "enrollment".to_string(),
-        },
-        "boolean",
-    );
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-        panic!("registry-backed mode")
-    };
-    consultations
-        .get_mut("enrollment")
-        .expect("consultation")
-        .inputs = BTreeMap::from([(
-        "uin".to_string(),
-        RelayConsultationInput::TargetIdentifier("request.target.identifiers.UIN".to_string()),
-    )]);
-    let mut evidence = (*test_evidence(vec![claim])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    let activated = Arc::new(FixedRelayConsultation {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::Match,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-    let mut request = test_request("birth-record-known");
-    request.target = Some(registry_notary_core::EvidenceEntity::with_identifier(
-        "Person",
-        "UIN",
-        "1234567890",
-    ));
-
-    let results = runtime
-        .evaluate(
-            Arc::new(evidence),
-            &EvidenceStore::default(),
-            &principal,
-            request,
-            None,
-        )
-        .await
-        .expect("named target identifier plans the consultation");
-
-    assert_eq!(results[0].value, Some(Value::Bool(true)));
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn registry_backed_profiles_enforce_purpose_and_scope_independently() {
-    let mut first = registry_claim(
-        "programme-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    first.purpose = Some("programme-verification".to_string());
-    first.required_scopes = vec!["registry:programme".to_string()];
-    let mut second = registry_claim(
-        "civil-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    second.purpose = Some("civil-verification".to_string());
-    second.required_scopes = vec!["registry:civil".to_string()];
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut second.evidence_mode else {
-        panic!("registry-backed mode")
-    };
-    consultations
-        .get_mut("enrollment")
-        .expect("consultation")
-        .profile
-        .id = "opencrvs.birth-record.exact".to_string();
-    let mut evidence = (*test_evidence(vec![first, second])).clone();
-    evidence.allowed_purposes = vec![
-        "programme-verification".to_string(),
-        "civil-verification".to_string(),
-    ];
-    let evidence = Arc::new(evidence);
-    let activated = Arc::new(FixedRelayConsultation {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::Match,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:programme".to_string()];
-    let mut request = test_request("programme-status");
-    request.purpose = Some("programme-verification".to_string());
-
-    runtime
-        .evaluate(
-            Arc::clone(&evidence),
-            &EvidenceStore::default(),
-            &principal,
-            request,
-            None,
-        )
-        .await
-        .expect("the independently authorized profile evaluates");
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 1);
-
-    let mut denied = test_request("civil-status");
-    denied.purpose = Some("civil-verification".to_string());
-    let error = runtime
-        .evaluate(
-            evidence,
-            &EvidenceStore::default(),
-            &principal,
-            denied,
-            None,
-        )
-        .await
-        .expect_err("the other profile's scope is not inherited");
-
-    assert!(matches!(error, EvidenceError::ScopeDenied { .. }));
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn relay_group_key_ignores_unrelated_principal_scopes() {
-    let claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    let mut evidence = (*test_evidence(vec![claim])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    let activated = Arc::new(FixedRelayConsultation {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::Match,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let mut principal = machine_principal();
-    principal.scopes = std::iter::once("registry:evidence".to_string())
-        .chain((0..32).map(|index| format!("unrelated:{index}")))
-        .collect();
-
-    let results = runtime
-        .evaluate(
-            Arc::new(evidence),
-            &EvidenceStore::default(),
-            &principal,
-            test_request("enrollment-status"),
-            None,
-        )
-        .await
-        .expect("unrelated principal scopes do not widen the consultation key");
-
-    assert_eq!(results[0].value, Some(Value::String("ACTIVE".to_string())));
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn relay_plan_uses_the_explicitly_selected_claim_version() {
-    let mut transitional = test_claim("enrollment-status", Vec::new());
-    transitional.version = "1".to_string();
-    let mut registry = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    registry.version = "2".to_string();
-    let mut evidence = (*test_evidence(vec![transitional, registry])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    let activated = Arc::new(FixedRelayConsultation {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::Match,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-    let mut request = test_request("enrollment-status");
-    request.claims = vec![ClaimRef::with_version("enrollment-status", "2")];
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-
-    let results = runtime
-        .evaluate(
-            Arc::new(evidence),
-            &EvidenceStore::default(),
-            &principal,
-            request,
-            None,
-        )
-        .await
-        .expect("the selected Registry-backed version is planned and evaluated");
-
-    assert_eq!(results.len(), 1);
-    assert_eq!(results[0].claim_version, "2");
-    assert_eq!(results[0].value, Some(Value::String("ACTIVE".to_string())));
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test]
-async fn registry_backed_preflight_denial_makes_zero_relay_calls() {
-    let claim = registry_claim(
-        "enrollment-status",
-        RuleConfig::ConsultationOutput {
-            consultation: "enrollment".to_string(),
-            output: "registration_status".to_string(),
-        },
-        "string",
-    );
-    let mut evidence = (*test_evidence(vec![claim])).clone();
-    evidence.allowed_purposes = vec!["test".to_string()];
-    let activated = Arc::new(FixedRelayConsultation {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::Match,
-    });
-    let bound: Arc<dyn ActivatedRelayConsultations> = activated.clone();
-    let runtime = RegistryNotaryRuntime::new().with_activated_relay(Some(bound));
-
-    let evidence = Arc::new(evidence);
-    let mut missing_scope_principal = machine_principal();
-    missing_scope_principal.scopes.clear();
-    let (result, audit) = runtime
-        .evaluate_for_api(
-            Arc::clone(&evidence),
-            &EvidenceStore::default(),
-            &missing_scope_principal,
-            test_request("enrollment-status"),
-            None,
-        )
-        .await;
-    let error = result.expect_err("missing required scope is denied before Relay");
-
-    assert!(matches!(error, EvidenceError::ScopeDenied { .. }));
-    let (evaluation_id, consultation_ids) = audit.into_parts();
-    assert!(evaluation_id.is_none());
-    assert!(consultation_ids.is_empty());
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 0);
-
-    let mut principal = machine_principal();
-    principal.scopes = vec!["registry:evidence".to_string()];
-    let mut request = test_request("enrollment-status");
-    request.purpose = Some("wrong-purpose".to_string());
-    let (result, audit) = runtime
-        .evaluate_for_api(
-            evidence,
-            &EvidenceStore::default(),
-            &principal,
-            request,
-            None,
-        )
-        .await;
-    assert!(matches!(result, Err(EvidenceError::PurposeNotAllowed)));
-    let (evaluation_id, consultation_ids) = audit.into_parts();
-    assert!(evaluation_id.is_none());
-    assert!(consultation_ids.is_empty());
-    assert_eq!(activated.calls.load(Ordering::SeqCst), 0);
-}
-
-#[tokio::test]
-async fn evaluate_refuses_consultation_matched_result_with_wrong_value_type() {
-    let mut claim = test_claim("selected", Vec::new());
-    claim.rule = RuleConfig::ConsultationMatched {
-        consultation: "src".to_string(),
-    };
-    claim.value.value_type = "string".to_string();
-    let mut evidence_config = (*test_evidence(vec![claim])).clone();
-    evidence_config.allowed_purposes = vec!["test".to_string()];
-    let evidence = Arc::new(evidence_config);
-    let store = EvidenceStore::default();
-    let request = test_request("selected");
-
-    let err = matched_relay_runtime()
-        .evaluate(
-            evidence,
-            &store,
-            &machine_principal(),
-            request,
-            None,
-        )
-        .await
-        .expect_err(
-            "exists result of boolean shape must be refused against a declared string type",
-        );
-
-    assert!(matches!(err, EvidenceError::RuleEvaluationFailed));
-}
-
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-async fn registry_backed_string_evaluation_enforces_max_bytes_after_cel() {
-    let string_claim = |id: &str, expression: &str, max_bytes: u32, nullable: bool| {
-        let mut claim = test_claim(id, Vec::new());
-        claim.value.value_type = "string".to_string();
-        claim.value.nullable = nullable;
-        claim.value.max_bytes = Some(max_bytes);
-        claim.rule = RuleConfig::Cel {
-            expression: expression.to_string(),
-        };
-        claim
-    };
-
-    let exact = string_claim("exact", r#""éé""#, 4, false);
-    let exact_results = matched_relay_runtime()
-        .evaluate(
-            test_evidence(vec![exact]),
-            &EvidenceStore::default(),
-            &machine_principal(),
-            test_request("exact"),
-            None,
-        )
-        .await
-        .expect("a four-byte UTF-8 result exactly meets the bound");
-    assert_eq!(exact_results[0].value, Some(json!("éé")));
-
-    let nullable = string_claim("nullable", "null", 1, true);
-    let null_results = matched_relay_runtime()
-        .evaluate(
-            test_evidence(vec![nullable]),
-            &EvidenceStore::default(),
-            &machine_principal(),
-            test_request("nullable"),
-            None,
-        )
-        .await
-        .expect("a nullable string claim preserves null independently of its byte bound");
-    assert_eq!(null_results[0].value, Some(Value::Null));
-
-    let sensitive = "DO-NOT-EXPOSE";
-    let over_bound = string_claim("over-bound", &format!(r#""{sensitive}""#), 4, false);
-    let error = matched_relay_runtime()
-        .evaluate(
-            test_evidence(vec![over_bound]),
-            &EvidenceStore::default(),
-            &machine_principal(),
-            test_request("over-bound"),
-            None,
-        )
-        .await
-        .expect_err("an over-bound evaluated claim value must fail");
-    assert!(matches!(error, EvidenceError::RuleEvaluationFailed));
-    assert!(!format!("{error:?}").contains(sensitive));
-}
-
-#[tokio::test]
-async fn evaluate_target_ref_serializes_as_opaque_handle() {
-    let mut claim = test_claim("selected", Vec::new());
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-        panic!("test claim is registry backed")
-    };
-    consultations
-        .get_mut("src")
-        .expect("test consultation exists")
-        .inputs
-        .insert(
-            "subject_id".to_string(),
-            RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.national_id".to_string(),
-            ),
-        );
-    let mut evidence_config = (*test_evidence(vec![claim])).clone();
-    evidence_config.allowed_purposes = vec!["test".to_string()];
-    let evidence = Arc::new(evidence_config);
-    let store = EvidenceStore::default();
-    let mut request = test_request("selected");
-    request.target = Some(registry_notary_core::EvidenceEntity::with_identifier(
-        "Person",
-        "national_id",
-        "person-1",
-    ));
-
-    let results = matched_relay_runtime()
-        .evaluate(
-            evidence,
-            &store,
-            &machine_principal(),
-            request,
-            None,
-        )
-        .await
-        .expect("evaluate succeeds");
-    let target_ref = serde_json::to_value(&results[0].target_ref).expect("target_ref serializes");
-
-    assert!(target_ref["handle"].as_str().is_some());
-    assert!(target_ref["handle"]
-        .as_str()
-        .unwrap()
-        .starts_with("rnref:v1:"));
-    assert!(target_ref.get("id_type").is_none());
-    assert!(!target_ref.to_string().contains("person-1"));
-}
-
-#[tokio::test]
-async fn batch_item_target_ref_serializes_as_opaque_handle() {
-    let mut claim = test_claim("selected", Vec::new());
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-        panic!("test claim is registry backed")
-    };
-    consultations
-        .get_mut("src")
-        .expect("test consultation exists")
-        .inputs
-        .insert(
-            "subject_id".to_string(),
-            RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.national_id".to_string(),
-            ),
-        );
-    claim.operations.batch_evaluate.enabled = true;
-    claim.operations.batch_evaluate.max_subjects = 1;
-    let mut evidence_config = (*test_evidence(vec![claim])).clone();
-    evidence_config.inline_batch_limit = 1;
-    let evidence = Arc::new(evidence_config);
-    let store = EvidenceStore::default();
-    let principal = machine_principal();
-    let request = BatchEvaluateRequest {
-        items: vec![registry_notary_core::BatchEvaluateItemRequest::from(
-            registry_notary_core::BatchSubjectRequest {
-                id: "person-1".to_string(),
-                id_type: Some("national_id".to_string()),
-                purpose: None,
-            },
-        )],
-        claims: vec![ClaimRef::from("selected")],
-        disclosure: Some("value".to_string()),
-        format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-        purpose: Some("test".to_string()),
-    };
-
-    let response = matched_relay_runtime()
-        .batch_evaluate(
-            evidence,
-            &store,
-            &principal,
-            request,
-            BatchEvaluateOptions {
-                idempotency_key: Some("retained-batch"),
-                ..BatchEvaluateOptions::default()
-            },
-        )
-        .await
-        .expect("batch evaluate succeeds");
-    let target_ref =
-        serde_json::to_value(&response.items[0].target_ref).expect("target_ref serializes");
-
-    assert!(target_ref["handle"].as_str().is_some());
-    assert!(target_ref["handle"]
-        .as_str()
-        .unwrap()
-        .starts_with("rnref:v1:"));
-    assert!(target_ref.get("id_type").is_none());
-    assert!(!target_ref.to_string().contains("person-1"));
-    let evaluation_id = response.items[0]
-        .evaluation_id
-        .as_deref()
-        .expect("successful item has an evaluation id");
-    let stored = store
-        .get(evaluation_id, &principal.principal_id)
-        .await
-        .expect("completed batch evaluation read succeeds")
-        .expect("completed registry-backed batch evaluation is retained");
-    assert!(stored.issuance_provenance.is_none());
-    let stored_at = OffsetDateTime::parse(&stored.created_at, &Rfc3339)
-        .expect("stored_at is canonical RFC3339");
-    let expires_at = OffsetDateTime::parse(&stored.expires_at, &Rfc3339)
-        .expect("expires_at is canonical RFC3339");
-    assert_eq!(expires_at - stored_at, time::Duration::minutes(15));
-}
-
-#[tokio::test]
-async fn evaluate_uses_requested_claim_version() {
-    let older_claim = test_claim("selected", Vec::new());
-    let mut newer_claim = test_claim("selected", Vec::new());
-    newer_claim.version = "2.0".to_string();
-    let mut evidence_config = (*test_evidence(vec![older_claim, newer_claim])).clone();
-    evidence_config.allowed_purposes = vec!["test".to_string()];
-    let evidence = Arc::new(evidence_config);
-    let store = EvidenceStore::default();
-    let mut request = test_request("selected");
-    request.claims = vec![ClaimRef::with_version("selected", "2.0")];
-
-    let results = matched_relay_runtime()
-        .evaluate(
-            evidence,
-            &store,
-            &machine_principal(),
-            request,
-            None,
-        )
-        .await
-        .expect("versioned evaluate succeeds");
-
-    assert_eq!(results[0].claim_version, "2.0");
-}
-
-/// REQ-SEC-G-005: the direct `evaluate` path must refuse a principal that
-/// lacks a claim's required scope.
-#[tokio::test]
-async fn evaluate_denies_missing_scope() {
-    let mut claim = test_claim("selected", Vec::new());
-    claim.required_scopes = vec!["selected:1.0".to_string()];
-    let mut evidence_config = (*test_evidence(vec![claim])).clone();
-    evidence_config.allowed_purposes = vec!["test".to_string()];
-    let evidence = Arc::new(evidence_config);
-    let store = EvidenceStore::default();
-    let request = test_request("selected");
-    let principal = EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
-        principal_id: "machine".to_string(),
-        scopes: Vec::new(),
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: None,
-    };
-
-    let err = RegistryNotaryRuntime::new()
-        .evaluate(
-            evidence,
-            &store,
-            &principal,
-            request,
-            None,
-        )
-        .await
-        .expect_err("principal without the claim's required scope must be denied");
-
-    assert!(matches!(
-        err,
-        EvidenceError::ScopeDenied { required } if required == "selected:1.0"
-    ));
-}
-
-#[tokio::test]
-async fn evaluate_authorizes_required_scope_from_requested_claim_version() {
-    let mut older_claim = test_claim("selected", Vec::new());
-    older_claim.required_scopes = vec!["selected:1.0".to_string()];
-    let mut newer_claim = test_claim("selected", Vec::new());
-    newer_claim.version = "2.0".to_string();
-    newer_claim.required_scopes = vec!["selected:2.0".to_string()];
-    let mut evidence_config = (*test_evidence(vec![older_claim, newer_claim])).clone();
-    evidence_config.allowed_purposes = vec!["test".to_string()];
-    let evidence = Arc::new(evidence_config);
-    let store = EvidenceStore::default();
-    let mut request = test_request("selected");
-    request.claims = vec![ClaimRef::with_version("selected", "2.0")];
-    let principal = EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
-        principal_id: "machine".to_string(),
-        scopes: vec!["selected:1.0".to_string()],
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: None,
-    };
-
-    let err = RegistryNotaryRuntime::new()
-        .evaluate(
-            Arc::clone(&evidence),
-            &store,
-            &principal,
-            request.clone(),
-            None,
-        )
-        .await
-        .expect_err("version 1 scope must not authorize version 2");
-
-    assert!(matches!(
-        err,
-        EvidenceError::ScopeDenied { required } if required == "selected:2.0"
-    ));
-
-    let principal = EvidencePrincipal {
-        scopes: vec!["selected:2.0".to_string()],
-        ..principal
-    };
-    let results = matched_relay_runtime()
-        .evaluate(
-            evidence,
-            &store,
-            &principal,
-            request,
-            None,
-        )
-        .await
-        .expect("version 2 scope authorizes version 2");
-
-    assert_eq!(results[0].claim_version, "2.0");
-}
-
-#[tokio::test]
-async fn evaluate_rejects_missing_claim_version() {
-    let evidence = test_evidence(vec![test_claim("selected", Vec::new())]);
-    let store = EvidenceStore::default();
-    let mut request = test_request("selected");
-    request.claims = vec![ClaimRef::with_version("selected", "2.0")];
-
-    let err = RegistryNotaryRuntime::new()
-        .evaluate(
-            evidence,
-            &store,
-            &machine_principal(),
-            request,
-            None,
-        )
-        .await
-        .expect_err("unknown version is rejected");
-
-    assert!(matches!(err, EvidenceError::ClaimVersionNotFound));
-}
-
-#[test]
-fn requested_claim_versions_accepts_duplicate_same_version() {
-    let versions = requested_claim_versions(&[
-        ClaimRef::with_version("selected", "2.0"),
-        ClaimRef::with_version("selected", "2.0"),
-    ])
-    .expect("duplicate matching version is accepted");
-
-    assert_eq!(
-        versions.get("selected").and_then(Option::as_deref),
-        Some("2.0")
-    );
-}
-
-#[test]
-fn requested_claim_versions_rejects_duplicate_conflicting_version() {
-    let err = requested_claim_versions(&[
-        ClaimRef::with_version("selected", "1.0"),
-        ClaimRef::with_version("selected", "2.0"),
-    ])
-    .expect_err("conflicting versions are rejected");
-
-    assert!(matches!(err, EvidenceError::InvalidRequest));
-}
-
-#[test]
-fn batch_input_validation_deduplicates_purposes() {
-    let subjects = vec![
-        registry_notary_core::BatchEvaluateItemRequest::from(
-            registry_notary_core::BatchSubjectRequest {
-                id: "person-1".to_string(),
-                id_type: None,
-                purpose: None,
-            },
-        ),
-        registry_notary_core::BatchEvaluateItemRequest::from(
-            registry_notary_core::BatchSubjectRequest {
-                id: "person-2".to_string(),
-                id_type: None,
-                purpose: None,
-            },
-        ),
-        registry_notary_core::BatchEvaluateItemRequest::from(
-            registry_notary_core::BatchSubjectRequest {
-                id: "person-3".to_string(),
-                id_type: None,
-                purpose: None,
-            },
-        ),
-    ];
-    let purposes = vec![
-        "benefits".to_string(),
-        "benefits".to_string(),
-        "appeals".to_string(),
-    ];
-
-    let unique = validate_batch_inputs_and_collect_purposes(&subjects, &purposes)
-        .expect("batch inputs are valid");
-
-    assert_eq!(unique, BTreeSet::from(["appeals", "benefits"]));
-}
-#[test]
-fn internal_claim_result_debug_redacts_relay_correlation_and_value() {
-    let mut result = test_claim_result(
-        "registry-backed-claim",
-        serde_json::json!("registry-value-SENSITIVE"),
-        BTreeSet::new(),
-    );
-    result
-        .relay_consultation_ids
-        .insert("01JRELAYCORRELATIONSENSITIVE".to_string());
-
-    let rendered = format!("{result:?}");
-
-    assert!(!rendered.contains("01JRELAYCORRELATIONSENSITIVE"));
-    assert!(!rendered.contains("registry-value-SENSITIVE"));
-    assert!(rendered.contains("relay_consultation_ids: \"[REDACTED]\""));
-}
diff --git a/crates/registry-notary-server/src/runtime/tests/render.rs b/crates/registry-notary-server/src/runtime/tests/render.rs
deleted file mode 100644
index 28a9f8cd4..000000000
--- a/crates/registry-notary-server/src/runtime/tests/render.rs
+++ /dev/null
@@ -1,622 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-    #[test]
-    fn top_level_target_id_uses_reserved_authorization_id_type() {
-        let keys = SubjectAccessRateLimitKeys::new(AuditKeyHasher::unkeyed_dev_only());
-        let mut target = EvidenceEntity::new("Person");
-        target.id = Some("registry-person-42".to_string());
-        target
-            .attributes
-            .insert("region".to_string(), json!("central"));
-        let target_ref = target_ref_view(&keys, &target).expect("target reference hashes");
-        let evaluated = issuance_authorization_target_binding(
-            &keys,
-            &target_ref,
-            "id",
-            "registry-person-42",
-        )
-        .expect("top-level id binding hashes");
-        assert_eq!(
-            evaluated,
-            issuance_authorization_target_binding(
-                &keys,
-                &target_ref,
-                "id",
-                "registry-person-42",
-            )
-            .expect("matching RAR binding hashes"),
-        );
-        assert_ne!(
-            evaluated,
-            issuance_authorization_target_binding(
-                &keys,
-                &target_ref,
-                "national_id",
-                "registry-person-42",
-            )
-            .expect("wrong-scheme comparison hashes"),
-            "top-level target.id cannot alias a named identifier scheme",
-        );
-    }
-
-    #[test]
-    fn render_cccev_uses_result_claim_version_for_requirement() {
-        let mut older_claim = test_claim("selected", Vec::new());
-        older_claim.oots = Some(registry_notary_core::OotsConfig {
-            enabled: true,
-            requirement: Some("https://requirements.example/v1".to_string()),
-            ..registry_notary_core::OotsConfig::default()
-        });
-        let mut newer_claim = test_claim("selected", Vec::new());
-        newer_claim.version = "2.0".to_string();
-        newer_claim.oots = Some(registry_notary_core::OotsConfig {
-            enabled: true,
-            requirement: Some("https://requirements.example/v2".to_string()),
-            ..registry_notary_core::OotsConfig::default()
-        });
-        let evidence = test_evidence(vec![older_claim, newer_claim]);
-        let result = ClaimResultView {
-            evaluation_id: "evaluation".to_string(),
-            claim_id: "selected".to_string(),
-            claim_version: "2.0".to_string(),
-            subject_type: "person".to_string(),
-            requester_ref: None,
-            target_ref: TargetRefView {
-                entity_type: "Person".to_string(),
-                handle: "rnref:v1:target".to_string(),
-                identifier_schemes: Vec::new(),
-                profile: None,
-            },
-            value: Some(json!(true)),
-            satisfied: Some(true),
-            disclosure: "value".to_string(),
-            redacted_fields: Vec::new(),
-            format: FORMAT_CCCEV_JSONLD.to_string(),
-            issued_at: "2026-06-08T00:00:00Z".to_string(),
-            expires_at: None,
-            provenance: ClaimProvenance::new(
-                "runtime.test".to_string(),
-                "eval-test".to_string(),
-                "selected".to_string(),
-                "2.0".to_string(),
-                ProvenanceUsed {
-                    relay_consultation_count: 0,
-                },
-            ),
-        };
-
-        let rendered =
-            render_results(&evidence, &[result], FORMAT_CCCEV_JSONLD).expect("CCCEV renders");
-
-        assert_eq!(
-            rendered["@graph"][0]["cccev:supportsRequirement"]["@id"],
-            json!("https://requirements.example/v2")
-        );
-    }
-
-    #[test]
-    fn render_cccev_maps_provider_agent_from_generated_by_service_id() {
-        let evidence = test_evidence(vec![test_claim("selected", Vec::new())]);
-        let result = ClaimResultView {
-            evaluation_id: "eval-test".to_string(),
-            claim_id: "selected".to_string(),
-            claim_version: "1".to_string(),
-            subject_type: "Person".to_string(),
-            requester_ref: None,
-            target_ref: TargetRefView {
-                entity_type: "Person".to_string(),
-                handle: "rnref:v1:test".to_string(),
-                identifier_schemes: Vec::new(),
-                profile: None,
-            },
-            value: Some(json!(true)),
-            satisfied: Some(true),
-            disclosure: "predicate".to_string(),
-            redacted_fields: Vec::new(),
-            format: FORMAT_CCCEV_JSONLD.to_string(),
-            issued_at: "2026-06-08T00:00:00Z".to_string(),
-            expires_at: None,
-            provenance: ClaimProvenance::new(
-                "registry-notary".to_string(),
-                "eval-test".to_string(),
-                "selected".to_string(),
-                "1".to_string(),
-                ProvenanceUsed {
-                    relay_consultation_count: 0,
-                },
-            ),
-        };
-
-        let rendered =
-            render_results(&evidence, &[result], FORMAT_CCCEV_JSONLD).expect("CCCEV renders");
-
-        assert_eq!(
-            rendered["@graph"][0]["cccev:isProvidedBy"]["dcterms:identifier"],
-            json!("registry-notary"),
-            "CCCEV provider agent must map from generated_by.service_id"
-        );
-    }
-
-    #[test]
-    fn render_cccev_omits_conformance_for_redacted_result() {
-        let evidence = test_evidence(vec![test_claim("selected", Vec::new())]);
-        let result = ClaimResultView {
-            evaluation_id: "eval-test".to_string(),
-            claim_id: "selected".to_string(),
-            claim_version: "1".to_string(),
-            subject_type: "Person".to_string(),
-            requester_ref: None,
-            target_ref: TargetRefView {
-                entity_type: "Person".to_string(),
-                handle: "rnref:v1:test".to_string(),
-                identifier_schemes: Vec::new(),
-                profile: None,
-            },
-            value: None,
-            satisfied: None,
-            disclosure: "redacted".to_string(),
-            redacted_fields: vec!["selected".to_string()],
-            format: FORMAT_CCCEV_JSONLD.to_string(),
-            issued_at: "2026-06-08T00:00:00Z".to_string(),
-            expires_at: None,
-            provenance: ClaimProvenance::new(
-                "registry-notary".to_string(),
-                "eval-test".to_string(),
-                "selected".to_string(),
-                "1".to_string(),
-                ProvenanceUsed {
-                    relay_consultation_count: 0,
-                },
-            ),
-        };
-
-        let rendered =
-            render_results(&evidence, &[result], FORMAT_CCCEV_JSONLD).expect("CCCEV renders");
-
-        assert!(
-            rendered["@graph"][0].get("cccev:isConformantTo").is_none(),
-            "redacted CCCEV evidence must not reveal a false outcome"
-        );
-    }
-
-    #[test]
-    fn credential_profile_for_rejects_profile_not_listed_in_claim() {
-        // A caller-supplied credential_profile must be in the requested claim's
-        // own credential_profiles allow-list. Otherwise a client could mint a
-        // credential against a profile the claim never opted in to.
-        let evidence: EvidenceConfig = serde_norway::from_str(
-            r#"
-enabled: true
-service_id: test.notary
-claims:
-  - id: claim-a
-    title: A
-    version: "1.0"
-    subject_type: person
-    evidence_mode:
-      type: registry_backed
-      consultations:
-        civil_status:
-          profile:
-            id: example.civil-status.exact
-            contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-          inputs:
-            subject_id: target.id
-    rule:
-      type: consultation_matched
-      consultation: civil_status
-    credential_profiles:
-      - profile_a
-signing_keys:
-  issuer-key:
-    provider: local_jwk_env
-    private_jwk_env: ISSUER_KEY
-    alg: EdDSA
-    kid: did:web:issuer.example#key-1
-    status: active
-  issuer-key-b:
-    provider: local_jwk_env
-    private_jwk_env: ISSUER_KEY_B
-    alg: EdDSA
-    kid: did:web:issuer.example#key-2
-    status: active
-credential_profiles:
-  profile_a:
-    format: application/dc+sd-jwt
-    issuer: https://issuer.example
-    signing_key: issuer-key
-    vct: https://vct.example/a
-    allowed_claims:
-      - claim-a
-  profile_b:
-    format: application/dc+sd-jwt
-    issuer: https://issuer.example
-    signing_key: issuer-key-b
-    vct: https://vct.example/b
-    allowed_claims:
-      - claim-a
-"#,
-        )
-        .expect("evidence config is valid YAML");
-
-        let evaluation = registry_notary_core::StoredEvaluation {
-            client_id: "client".to_string(),
-            purpose: "test".to_string(),
-            claim_ids: vec!["claim-a".to_string()],
-            claim_refs: Vec::new(),
-            disclosure: "redacted".to_string(),
-            format: FORMAT_SD_JWT_VC.to_string(),
-            results: Vec::new(),
-            created_at: "1970-01-01T00:00:00Z".to_string(),
-            expires_at: "1970-01-01T00:00:00Z".to_string(),
-            request_hash: "h".to_string(),
-            issuance_provenance: None,
-            subject_access: None,
-        };
-
-        let err = credential_profile_for(&evidence, &evaluation, Some("profile_b"))
-            .expect_err("profile_b is not listed on claim-a");
-        assert!(matches!(err, EvidenceError::CredentialIssuerNotConfigured));
-
-        let (profile_id, _) = credential_profile_for(&evidence, &evaluation, Some("profile_a"))
-            .expect("profile_a is listed on claim-a");
-        assert_eq!(profile_id, "profile_a");
-    }
-
-    #[test]
-    fn credential_profile_for_uses_stored_claim_version() {
-        let mut older_claim = test_claim("claim-a", Vec::new());
-        older_claim.credential_profiles = vec!["profile_a".to_string()];
-        let mut newer_claim = test_claim("claim-a", Vec::new());
-        newer_claim.version = "2.0".to_string();
-        newer_claim.credential_profiles = vec!["profile_b".to_string()];
-        let mut evidence = (*test_evidence(vec![older_claim, newer_claim])).clone();
-        evidence.credential_profiles = serde_norway::from_str(
-            r#"
-profile_a:
-  format: application/dc+sd-jwt
-  issuer: https://issuer.example
-  signing_key: issuer-key
-  vct: https://vct.example/a
-  allowed_claims: [claim-a]
-profile_b:
-  format: application/dc+sd-jwt
-  issuer: https://issuer.example
-  signing_key: issuer-key
-  vct: https://vct.example/b
-  allowed_claims: [claim-a]
-"#,
-        )
-        .expect("credential profiles parse");
-        let evaluation = registry_notary_core::StoredEvaluation {
-            client_id: "client".to_string(),
-            purpose: "test".to_string(),
-            claim_ids: vec!["claim-a".to_string()],
-            claim_refs: vec![ClaimRef::with_version("claim-a", "2.0")],
-            disclosure: "redacted".to_string(),
-            format: FORMAT_SD_JWT_VC.to_string(),
-            results: Vec::new(),
-            created_at: "1970-01-01T00:00:00Z".to_string(),
-            expires_at: "1970-01-01T00:00:00Z".to_string(),
-            request_hash: "h".to_string(),
-            issuance_provenance: None,
-            subject_access: None,
-        };
-
-        let err = credential_profile_for(&evidence, &evaluation, Some("profile_a"))
-            .expect_err("profile_a is not listed on claim-a version 2.0");
-        assert!(matches!(err, EvidenceError::CredentialIssuerNotConfigured));
-
-        let (profile_id, _) = credential_profile_for(&evidence, &evaluation, Some("profile_b"))
-            .expect("profile_b is listed on claim-a version 2.0");
-        assert_eq!(profile_id, "profile_b");
-        let (profile_id, _) =
-            credential_profile_for(&evidence, &evaluation, None).expect("default profile resolves");
-        assert_eq!(profile_id, "profile_b");
-    }
-
-    fn issuable_registry_evaluation() -> (Arc<EvidenceConfig>, registry_notary_core::StoredEvaluation) {
-        let mut claim = test_claim("registry-fact", Vec::new());
-        claim.version = "1".to_string();
-        claim.purpose = Some("credential-purpose".to_string());
-        claim.value = registry_notary_core::ClaimValueConfig {
-            value_type: "object".to_string(),
-            nullable: true,
-            max_bytes: None,
-            unit: None,
-        };
-        claim.evidence_mode = ClaimEvidenceMode::RegistryBacked {
-            consultations: BTreeMap::from([(
-                "registry".to_string(),
-                registry_notary_core::RelayConsultationConfig {
-                    profile: registry_notary_core::RelayConsultationProfileRef {
-                        id: "example.registry-fact.exact".to_string(),
-                        contract_hash:
-                            "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-                                .to_string(),
-                    },
-                    inputs: BTreeMap::from([(
-                        "subject_id".to_string(),
-                        RelayConsultationInput::TargetId,
-                    )]),
-                    outputs: BTreeMap::from([(
-                        "record".to_string(),
-                        registry_notary_core::RelayOutputContract::Object {
-                            nullable: false,
-                            max_bytes: 4_096,
-                            fields: BTreeMap::from([
-                                (
-                                    "name".to_string(),
-                                    registry_notary_core::RelayOutputObjectFieldContract {
-                                        required: true,
-                                        schema: Box::new(
-                                            registry_notary_core::RelayOutputContract::String {
-                                                nullable: false,
-                                                max_bytes: 128,
-                                            },
-                                        ),
-                                    },
-                                ),
-                                (
-                                    "parents".to_string(),
-                                    registry_notary_core::RelayOutputObjectFieldContract {
-                                        required: true,
-                                        schema: Box::new(
-                                            registry_notary_core::RelayOutputContract::Array {
-                                                nullable: false,
-                                                max_bytes: 2_048,
-                                                max_items: 4,
-                                                items: Box::new(
-                                                    registry_notary_core::RelayOutputContract::Object {
-                                                        nullable: false,
-                                                        max_bytes: 512,
-                                                        fields: BTreeMap::from([(
-                                                            "name".to_string(),
-                                                            registry_notary_core::RelayOutputObjectFieldContract {
-                                                                required: true,
-                                                                schema: Box::new(
-                                                                    registry_notary_core::RelayOutputContract::String {
-                                                                        nullable: false,
-                                                                        max_bytes: 128,
-                                                                    },
-                                                                ),
-                                                            },
-                                                        )]),
-                                                    },
-                                                ),
-                                            },
-                                        ),
-                                    },
-                                ),
-                            ]),
-                        },
-                    )]),
-                },
-            )]),
-        };
-        claim.rule = RuleConfig::ConsultationOutput {
-            consultation: "registry".to_string(),
-            output: "record".to_string(),
-        };
-        let evidence = test_evidence(vec![claim]);
-        let evaluation_id = "01J00000000000000000000001";
-        let issued_at = "2026-07-17T00:00:00Z";
-        let result = ClaimResultView {
-            evaluation_id: evaluation_id.to_string(),
-            claim_id: "registry-fact".to_string(),
-            claim_version: "1".to_string(),
-            subject_type: "person".to_string(),
-            requester_ref: None,
-            target_ref: TargetRefView {
-                entity_type: "Person".to_string(),
-                handle: "rnref:v1:target".to_string(),
-                identifier_schemes: Vec::new(),
-                profile: None,
-            },
-            value: Some(json!({
-                "name": "Ada",
-                "parents": [
-                    { "name": "Grace" },
-                    { "name": "Charles" }
-                ]
-            })),
-            satisfied: None,
-            disclosure: "value".to_string(),
-            redacted_fields: Vec::new(),
-            format: FORMAT_CLAIM_RESULT_JSON.to_string(),
-            issued_at: issued_at.to_string(),
-            expires_at: None,
-            provenance: ClaimProvenance::new(
-                "runtime.test".to_string(),
-                evaluation_id.to_string(),
-                "registry-fact".to_string(),
-                "1".to_string(),
-                ProvenanceUsed {
-                    relay_consultation_count: 1,
-                },
-            ),
-        };
-        let mut evaluation = registry_notary_core::StoredEvaluation {
-            client_id: "client".to_string(),
-            purpose: "credential-purpose".to_string(),
-            claim_ids: vec!["registry-fact".to_string()],
-            claim_refs: vec![ClaimRef::with_version("registry-fact", "1")],
-            disclosure: "value".to_string(),
-            format: FORMAT_CLAIM_RESULT_JSON.to_string(),
-            results: vec![result],
-            created_at: issued_at.to_string(),
-            expires_at: "2026-07-17T00:10:00Z".to_string(),
-            request_hash: "request-hash".to_string(),
-            issuance_provenance: Some(StoredIssuanceProvenance {
-                claims: vec![StoredIssuanceClaimProvenance {
-                    claim_id: "registry-fact".to_string(),
-                    claim_version: "1".to_string(),
-                    relay_profile_id: "example.registry-fact.exact".to_string(),
-                    relay_contract_hash:
-                        "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-                            .to_string(),
-                    canonical_purpose: "credential-purpose".to_string(),
-                    consultation_id: "01J00000000000000000000000".to_string(),
-                    execution_binding: String::new(),
-                    result_content_binding: String::new(),
-                }],
-                consultations: vec![StoredIssuanceConsultationProvenance {
-                    consultation_id: "01J00000000000000000000000".to_string(),
-                    acquired_at: issued_at.to_string(),
-                }],
-                authorization_target_binding: String::new(),
-            }),
-            subject_access: None,
-        };
-        let result_content_binding = issuance_result_content_binding(&evaluation.results[0])
-            .expect("result content binding hashes");
-        let issuance = evaluation
-            .issuance_provenance
-            .as_mut()
-            .expect("private issuance provenance exists");
-        issuance.claims[0].result_content_binding = result_content_binding;
-        issuance.claims[0].execution_binding = issuance_execution_binding(
-            &issuance.claims[0],
-            &issuance.consultations[0],
-            evaluation_id,
-            issued_at,
-            &evaluation.results[0].provenance,
-        )
-        .expect("execution binding hashes");
-        (evidence, evaluation)
-    }
-
-    fn assert_not_issuable(
-        evidence: &EvidenceConfig,
-        evaluation: &registry_notary_core::StoredEvaluation,
-    ) {
-        assert!(matches!(
-            require_issuable_evaluation_provenance(
-                evidence,
-                "01J00000000000000000000001",
-                evaluation,
-            ),
-            Err(EvidenceError::EvaluationBindingMismatch)
-        ));
-    }
-
-    #[test]
-    fn issuance_provenance_verifier_accepts_only_the_exact_registry_execution_record() {
-        let (evidence, evaluation) = issuable_registry_evaluation();
-        require_issuable_evaluation_provenance(
-            &evidence,
-            "01J00000000000000000000001",
-            &evaluation,
-        )
-        .expect("the exact registry execution record is issuable");
-
-        let mut tampered = evaluation.clone();
-        tampered.issuance_provenance = None;
-        assert_not_issuable(&evidence, &tampered);
-
-        let mut legacy_wire = serde_json::to_value(&evaluation).expect("evaluation serializes");
-        legacy_wire["issuance_provenance"]["claims"][0]
-            .as_object_mut()
-            .expect("legacy claim provenance is an object")
-            .remove("execution_binding");
-        let legacy: registry_notary_core::StoredEvaluation =
-            serde_json::from_value(legacy_wire).expect("legacy evaluation remains readable");
-        assert_eq!(
-            legacy
-                .issuance_provenance
-                .as_ref()
-                .expect("legacy private provenance remains readable")
-                .claims[0]
-                .execution_binding,
-            ""
-        );
-        assert_not_issuable(&evidence, &legacy);
-
-        let mut tampered = evaluation.clone();
-        tampered.issuance_provenance.as_mut().unwrap().claims[0].claim_id =
-            "other-fact".to_string();
-        assert_not_issuable(&evidence, &tampered);
-
-        let mut tampered = evaluation.clone();
-        tampered.issuance_provenance.as_mut().unwrap().claims[0].claim_version =
-            "2".to_string();
-        assert_not_issuable(&evidence, &tampered);
-
-        let mut tampered = evaluation.clone();
-        tampered.issuance_provenance.as_mut().unwrap().claims[0].relay_profile_id =
-            "example.other.exact".to_string();
-        assert_not_issuable(&evidence, &tampered);
-
-        let mut tampered = evaluation.clone();
-        tampered.issuance_provenance.as_mut().unwrap().claims[0].relay_contract_hash =
-            "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
-                .to_string();
-        assert_not_issuable(&evidence, &tampered);
-
-        let mut tampered = evaluation.clone();
-        tampered.issuance_provenance.as_mut().unwrap().claims[0].canonical_purpose =
-            "other-purpose".to_string();
-        assert_not_issuable(&evidence, &tampered);
-
-        let mut tampered = evaluation.clone();
-        tampered.issuance_provenance.as_mut().unwrap().claims[0].consultation_id =
-            "not-a-ulid".to_string();
-        assert_not_issuable(&evidence, &tampered);
-
-        let mut tampered = evaluation.clone();
-        tampered
-            .issuance_provenance
-            .as_mut()
-            .unwrap()
-            .consultations[0]
-            .acquired_at = "2026-07-17T00:00:01Z".to_string();
-        assert_not_issuable(&evidence, &tampered);
-
-        let mut tampered = evaluation.clone();
-        tampered.results[0].evaluation_id = "01J00000000000000000000002".to_string();
-        assert_not_issuable(&evidence, &tampered);
-
-        let mut tampered = evaluation.clone();
-        tampered.results[0].provenance.used.relay_consultation_count = 0;
-        assert_not_issuable(&evidence, &tampered);
-
-        let mut tampered = evaluation.clone();
-        tampered.results[0].value.as_mut().unwrap()["parents"][0]["name"] = json!("Mallory");
-        assert_not_issuable(&evidence, &tampered);
-
-        let mut tampered = evaluation.clone();
-        let duplicate = tampered
-            .issuance_provenance
-            .as_ref()
-            .unwrap()
-            .claims[0]
-            .clone();
-        tampered
-            .issuance_provenance
-            .as_mut()
-            .unwrap()
-            .claims
-            .push(duplicate);
-        assert_not_issuable(&evidence, &tampered);
-    }
-
-    #[test]
-    fn structured_claim_values_are_absent_from_result_and_stored_evaluation_debug() {
-        let (_, evaluation) = issuable_registry_evaluation();
-        let result_debug = format!("{:?}", evaluation.results[0]);
-        let evaluation_debug = format!("{evaluation:?}");
-
-        for secret in ["Ada", "Grace", "Charles", "Mallory"] {
-            assert!(
-                !result_debug.contains(secret),
-                "claim-result Debug must not expose structured value member {secret}"
-            );
-            assert!(
-                !evaluation_debug.contains(secret),
-                "stored-evaluation Debug must not expose structured value member {secret}"
-            );
-        }
-        assert!(result_debug.contains("value: \"[REDACTED]\""));
-        assert!(evaluation_debug.contains("result_count: 1"));
-        assert!(!evaluation_debug.contains("request-hash"));
-    }
diff --git a/crates/registry-notary-server/src/runtime/tests/support.rs b/crates/registry-notary-server/src/runtime/tests/support.rs
deleted file mode 100644
index ebcf82785..000000000
--- a/crates/registry-notary-server/src/runtime/tests/support.rs
+++ /dev/null
@@ -1,243 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-fn test_claim(id: &str, depends_on: Vec<&str>) -> ClaimDefinition {
-    ClaimDefinition {
-        id: id.to_string(),
-        title: id.to_string(),
-        version: "1.0".to_string(),
-        subject_type: "person".to_string(),
-        evidence_mode: ClaimEvidenceMode::RegistryBacked {
-            consultations: BTreeMap::from([(
-                "src".to_string(),
-                RelayConsultationConfig {
-                    profile: RelayConsultationProfileRef {
-                        id: "example.test-source.exact".to_string(),
-                        contract_hash:
-                            "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-                                .to_string(),
-                    },
-                    inputs: BTreeMap::from([(
-                        "subject_id".to_string(),
-                        RelayConsultationInput::TargetId,
-                    )]),
-                    outputs: BTreeMap::from([(
-                        "registration_status".to_string(),
-                        RelayOutputContract::String {
-                            nullable: true,
-                            max_bytes: 64,
-                        },
-                    )]),
-                },
-            )]),
-        },
-        value: registry_notary_core::ClaimValueConfig {
-            value_type: "boolean".to_string(),
-            nullable: false,
-            max_bytes: None,
-            unit: None,
-        },
-        semantics: None,
-        inputs: Vec::new(),
-        depends_on: depends_on.into_iter().map(str::to_string).collect(),
-        purpose: Some("test".to_string()),
-        required_scopes: vec!["registry:evidence".to_string()],
-        rule: RuleConfig::ConsultationMatched {
-            consultation: "src".to_string(),
-        },
-        operations: registry_notary_core::ClaimOperationsConfig::default(),
-        disclosure: registry_notary_core::DisclosureConfig {
-            default: "value".to_string(),
-            allowed: vec!["value".to_string(), "redacted".to_string()],
-            downgrade: "redacted".to_string(),
-        },
-        formats: vec![FORMAT_CLAIM_RESULT_JSON.to_string()],
-        credential_profiles: Vec::new(),
-        cccev: None,
-        oots: None,
-    }
-}
-
-fn matched_relay_runtime() -> RegistryNotaryRuntime {
-    RegistryNotaryRuntime::new().with_activated_relay(Some(Arc::new(FixedRelayConsultation {
-        calls: AtomicU64::new(0),
-        outcome: RuntimeRelayOutcome::Match,
-    })))
-}
-
-fn test_evidence(claims: Vec<ClaimDefinition>) -> Arc<EvidenceConfig> {
-    Arc::new(EvidenceConfig {
-        enabled: true,
-        service_id: "runtime.test".to_string(),
-        claims,
-        ..EvidenceConfig::default()
-    })
-}
-
-fn test_claim_result(
-    claim_id: &str,
-    value: Value,
-    redaction_fields: BTreeSet<String>,
-) -> ClaimResultInternal {
-    ClaimResultInternal {
-        evaluation_id: "eval-test".to_string(),
-        claim_id: claim_id.to_string(),
-        claim_version: "1.0".to_string(),
-        subject_type: "person".to_string(),
-        target: EvidenceEntity::new("Person"),
-        requester: None,
-        value,
-        redaction_fields,
-        issued_at: OffsetDateTime::UNIX_EPOCH,
-        expires_at: None,
-        provenance: ClaimProvenance::new(
-            "runtime.test".to_string(),
-            "eval-test".to_string(),
-            claim_id.to_string(),
-            "1.0".to_string(),
-            ProvenanceUsed {
-                relay_consultation_count: 0,
-            },
-        ),
-        relay_consultation_ids: BTreeSet::new(),
-        own_issuance_provenance: None,
-    }
-}
-
-fn test_request(claim: &str) -> EvaluateRequest {
-    EvaluateRequest {
-        requester: None,
-        target: Some(EvidenceEntity::from_subject_request(
-            "Person",
-            SubjectRequest {
-                id: "person-1".to_string(),
-                id_type: None,
-            },
-        )),
-        relationship: None,
-        on_behalf_of: None,
-        variables: Default::default(),
-        claims: vec![ClaimRef::from(claim)],
-        disclosure: Some("value".to_string()),
-        format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-        purpose: Some("test".to_string()),
-    }
-}
-
-fn machine_principal() -> EvidencePrincipal {
-    EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
-        principal_id: "machine".to_string(),
-        scopes: vec!["registry:evidence".to_string()],
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: None,
-    }
-}
-
-fn subject_access_principal() -> EvidencePrincipal {
-    EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::ExternalOidc,
-        principal_id: "citizen".to_string(),
-        scopes: vec!["subject_access".to_string()],
-        access_mode: AccessMode::SubjectBound,
-        verified_claims: None,
-        authorization_details: None,
-    }
-}
-
-fn delegated_subject_access_capability(
-    keys: &SubjectAccessRateLimitKeys,
-    requester_subject: &str,
-    dependent_subject: &str,
-) -> EvaluationCapability {
-    delegated_subject_access_capability_with_allowed_claims(
-        keys,
-        requester_subject,
-        dependent_subject,
-        &["selected"],
-    )
-}
-
-fn delegated_subject_access_capability_with_allowed_claims(
-    keys: &SubjectAccessRateLimitKeys,
-    requester_subject: &str,
-    dependent_subject: &str,
-    allowed_claim_ids: &[&str],
-) -> EvaluationCapability {
-    EvaluationCapability::DelegatedSubjectAccess {
-        proof_claim_id: BoundedClaimId::new("guardian-link").expect("proof claim id is bounded"),
-        allowed_claim_ids: allowed_claim_ids
-            .iter()
-            .map(|claim_id| BoundedClaimId::new(*claim_id).expect("claim id is bounded"))
-            .collect(),
-        requester_subject_binding_hash: keys
-            .delegated_subject_binding("national_id", requester_subject)
-            .expect("requester hashes"),
-        dependent_target_hash: keys
-            .delegated_subject_binding("civil_registration_id", dependent_subject)
-            .expect("dependent hashes"),
-        relationship_type: registry_notary_core::ConfigMetadata::new("guardian")
-            .expect("relationship type is bounded"),
-    }
-}
-
-fn delegated_principal() -> EvidencePrincipal {
-    EvidencePrincipal {
-        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::ExternalOidc,
-        principal_id: "guardian".to_string(),
-        scopes: Vec::new(),
-        access_mode: AccessMode::DelegatedSubjectAccess,
-        verified_claims: None,
-        authorization_details: None,
-    }
-}
-
-fn delegated_runtime_request() -> EvaluateRequest {
-    EvaluateRequest {
-        requester: Some(EvidenceEntity::from_subject_request(
-            "Person",
-            SubjectRequest {
-                id: "NAT-123".to_string(),
-                id_type: Some("national_id".to_string()),
-            },
-        )),
-        target: Some(EvidenceEntity::from_subject_request(
-            "Person",
-            SubjectRequest {
-                id: "CHILD-123".to_string(),
-                id_type: Some("civil_registration_id".to_string()),
-            },
-        )),
-        relationship: Some(registry_notary_core::EvidenceRelationship {
-            relationship_type: "guardian".to_string(),
-            attributes: BTreeMap::new(),
-        }),
-        on_behalf_of: None,
-        variables: Default::default(),
-        claims: vec![ClaimRef::from("selected")],
-        disclosure: Some("value".to_string()),
-        format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-        purpose: Some("test".to_string()),
-    }
-}
-
-fn delegated_subject_access_metadata(
-    evaluation_expires_at: OffsetDateTime,
-) -> StoredSubjectAccessMetadata {
-    serde_json::from_value(json!({
-        "access_mode": "delegated_subject_access",
-        "issuer": "https://issuer.example",
-        "principal_hash": "principal-hash",
-        "subject_id_type": "civil_registration_id",
-        "subject_binding_claim": "sub",
-        "subject_binding_hash": "requester-subject-hash",
-        "dependent_target_hash": "dependent-target-hash",
-        "relationship_type": "guardian",
-        "proof_claim_id": "guardian-link",
-        "requested_claims_hash": "requested-claims-hash",
-        "disclosure": "value",
-        "result_format": FORMAT_CLAIM_RESULT_JSON,
-        "evaluation_expires_at": format_time(evaluation_expires_at),
-    }))
-    .expect("delegated subject-access metadata parses")
-}
diff --git a/crates/registry-notary-server/src/runtime/types.rs b/crates/registry-notary-server/src/runtime/types.rs
deleted file mode 100644
index 698fdf43e..000000000
--- a/crates/registry-notary-server/src/runtime/types.rs
+++ /dev/null
@@ -1,109 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-
-pub(super) type ClaimVersionSelections = BTreeMap<String, Option<String>>;
-#[derive(Clone)]
-pub(super) struct ClaimResultInternal {
-    pub(super) evaluation_id: String,
-    pub(super) claim_id: String,
-    pub(super) claim_version: String,
-    pub(super) subject_type: String,
-    pub(super) target: EvidenceEntity,
-    pub(super) requester: Option<EvidenceEntity>,
-    pub(super) value: Value,
-    pub(super) redaction_fields: BTreeSet<String>,
-    pub(super) issued_at: OffsetDateTime,
-    pub(super) expires_at: Option<OffsetDateTime>,
-    pub(super) provenance: ClaimProvenance,
-    pub(super) relay_consultation_ids: BTreeSet<String>,
-    pub(super) own_issuance_provenance: Option<ClaimIssuanceProvenanceInternal>,
-}
-
-impl std::fmt::Debug for ClaimResultInternal {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("ClaimResultInternal")
-            .field("evaluation_id", &"[REDACTED]")
-            .field("claim_id", &self.claim_id)
-            .field("claim_version", &self.claim_version)
-            .field("subject_type", &self.subject_type)
-            .field("target", &"[REDACTED]")
-            .field("requester", &"[REDACTED]")
-            .field("value", &"[REDACTED]")
-            .field("redaction_fields", &self.redaction_fields)
-            .field("issued_at", &self.issued_at)
-            .field("expires_at", &self.expires_at)
-            .field("provenance", &self.provenance)
-            .field("relay_consultation_ids", &"[REDACTED]")
-            .field("own_issuance_provenance", &self.own_issuance_provenance)
-            .finish()
-    }
-}
-
-#[derive(Clone)]
-pub(super) struct ClaimIssuanceProvenanceInternal {
-    pub(super) claim: StoredIssuanceClaimProvenance,
-    pub(super) consultation: StoredIssuanceConsultationProvenance,
-}
-
-impl std::fmt::Debug for ClaimIssuanceProvenanceInternal {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("ClaimIssuanceProvenanceInternal")
-            .field("claim", &self.claim)
-            .field("consultation", &self.consultation)
-            .finish()
-    }
-}
-
-#[derive(Debug, Clone, Copy, Default)]
-pub struct BatchEvaluateOptions<'a> {
-    pub header_purpose: Option<&'a str>,
-    pub idempotency_key: Option<&'a str>,
-    pub owner_quota: Option<(&'a crate::MachineQuotaLimiter, u32)>,
-}
-
-/// Evaluation policy identity threaded into per-claim provenance
-/// (`generated_by.policy_id` / `policy_version` / `policy_hash`). All optional:
-/// machine-client flows evaluate under no named policy and leave these unset,
-/// while subject-access flows carry the policy that authorized the result.
-#[derive(Clone, Default)]
-pub(super) struct EvaluationPolicy {
-    pub(super) policy_id: Option<String>,
-    pub(super) policy_version: Option<String>,
-    pub(super) policy_hash: Option<String>,
-}
-
-pub(super) struct ClaimEvaluationContext {
-    pub(super) evidence: Arc<EvidenceConfig>,
-    pub(super) subject_access_rate_keys: Arc<SubjectAccessRateLimitKeys>,
-    pub(super) evaluation_capability: EvaluationCapability,
-    pub(super) relay_plan: Option<Arc<RequestScopedRelayPlan>>,
-    pub(super) context: EvidenceRequestContext,
-    pub(super) purpose: String,
-    pub(super) correlation_id: Option<BoundedCorrelationId>,
-    pub(super) evaluation_id: String,
-    pub(super) policy: EvaluationPolicy,
-    pub(super) now: OffsetDateTime,
-    pub(super) claim_versions: ClaimVersionSelections,
-    #[cfg(feature = "registry-notary-cel")]
-    pub(super) cel_worker: Option<Arc<CelWorker>>,
-    #[cfg(feature = "registry-notary-cel")]
-    pub(super) cel_concurrency: Option<Arc<Semaphore>>,
-    #[cfg(feature = "registry-notary-cel")]
-    pub(super) cel_config: Arc<RegistryNotaryCelConfig>,
-}
-
-#[cfg_attr(not(feature = "registry-notary-cel"), allow(dead_code))]
-pub(super) struct CelEvaluationContext<'a> {
-    pub(super) evidence: &'a EvidenceConfig,
-    pub(super) claim: &'a ClaimDefinition,
-    pub(super) expression: &'a str,
-    pub(super) consultation_outputs: &'a BTreeMap<String, Value>,
-    pub(super) variables: &'a registry_notary_core::RequestVariables,
-    #[cfg(feature = "registry-notary-cel")]
-    pub(super) worker: Option<&'a CelWorker>,
-    #[cfg(feature = "registry-notary-cel")]
-    pub(super) config: &'a RegistryNotaryCelConfig,
-}
diff --git a/crates/registry-notary-server/src/standalone.rs b/crates/registry-notary-server/src/standalone.rs
deleted file mode 100644
index 9b9c71f45..000000000
--- a/crates/registry-notary-server/src/standalone.rs
+++ /dev/null
@@ -1,29 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Standalone Registry Notary assembly, auth, audit, and Relay activation.
-
-mod runtime;
-
-pub use runtime::{
-    compile_notary_runtime, compile_notary_runtime_with_provenance,
-    emit_prepare_state_store_mutation_intent_audit, emit_product_action_mutation_intent_audit,
-    find_credential, notary_admin_router_from_runtime, notary_public_router_from_runtime,
-    notary_routers_from_runtime, notary_shared_router_from_runtime, standalone_router,
-    verify_relay_from_config, EvidenceIssuerRegistry, NotaryActivationCode,
-    NotaryActivationCodeDefinition, NotaryActivationCodeLifecycle, NotaryActivationFailure,
-    NotaryRouters, NotaryRuntimeSnapshot, PrepareStateStoreAuditEvidence, ResolvedCredential,
-    StandaloneServerError, NOTARY_ACTIVATION_CODE_DEFINITIONS,
-};
-
-#[cfg(feature = "registry-notary-cel")]
-pub use runtime::{
-    OfflineAuthentication, OfflineClaimView, OfflineNotaryErrorClass, OfflineNotaryEvidence,
-    OfflineNotaryHarness, OfflineNotaryHarnessError, OfflineNotaryRequest,
-    OfflineRelayConsultation, OfflineRelayOutcome,
-};
-
-pub(crate) use runtime::{
-    audit_error_response, current_request_correlation_id, generate_numeric_tx_code,
-    generate_opaque_token, new_request_correlation_id, pkce_s256_challenge, pre_auth_audit_event,
-    with_request_correlation_id, AuditPipeline, AuthAuditState, DeploymentGateState,
-    PreAuthAuditFields, PreAuthRuntime, SignerReadiness,
-};
diff --git a/crates/registry-notary-server/src/standalone/activation.rs b/crates/registry-notary-server/src/standalone/activation.rs
deleted file mode 100644
index 66370c285..000000000
--- a/crates/registry-notary-server/src/standalone/activation.rs
+++ /dev/null
@@ -1,942 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Stable, value-free Registry Notary runtime activation codes.
-
-use std::fmt;
-
-use super::assembly::StandaloneServerError;
-use crate::state_plane::{NotaryPostgresStatePlaneReadiness, SensitiveStateError};
-
-const VALUE_FREE_EVIDENCE_POLICY: &str = "Emit only this code and static definition. Do not emit inner errors, paths, URLs, hashes, credentials, identifiers, parser text, or country values.";
-const ACTIVATION_EVIDENCE_LIMITATION: &str = "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values.";
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
-#[repr(u8)]
-enum NotaryActivationCodeKind {
-    CelWorkerUnavailable,
-    ConfigurationInvalid,
-    DeploymentGateFailed,
-    RelayActivationFailed,
-    RelayConfigurationInvalid,
-    RelayCredentialUnavailable,
-    RelayCredentialsRejected,
-    RelayProfileMismatch,
-    RelayProfileNotFound,
-    RelayUnavailable,
-    RuntimeActivationFailed,
-    RuntimeActivationRequired,
-    PostgresqlDatabaseReadOnly,
-    PostgresqlDatabaseUnavailable,
-    PostgresqlDatabaseUnsupported,
-    PostgresqlDurabilityUnsafe,
-    PostgresqlRoleIncompatible,
-    PostgresqlSchemaIncompatible,
-}
-
-/// Closed, product-owned code for a Registry Notary runtime activation failure.
-///
-/// The representation is private so callers cannot invent codes. Use the
-/// named constants or [`Self::ALL`] when building operator references.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
-pub struct NotaryActivationCode(NotaryActivationCodeKind);
-
-impl NotaryActivationCode {
-    pub const CEL_WORKER_UNAVAILABLE: Self = Self(NotaryActivationCodeKind::CelWorkerUnavailable);
-    pub const CONFIGURATION_INVALID: Self = Self(NotaryActivationCodeKind::ConfigurationInvalid);
-    pub const DEPLOYMENT_GATE_FAILED: Self = Self(NotaryActivationCodeKind::DeploymentGateFailed);
-    pub const RELAY_ACTIVATION_FAILED: Self = Self(NotaryActivationCodeKind::RelayActivationFailed);
-    pub const RELAY_CONFIGURATION_INVALID: Self =
-        Self(NotaryActivationCodeKind::RelayConfigurationInvalid);
-    pub const RELAY_CREDENTIAL_UNAVAILABLE: Self =
-        Self(NotaryActivationCodeKind::RelayCredentialUnavailable);
-    pub const RELAY_CREDENTIALS_REJECTED: Self =
-        Self(NotaryActivationCodeKind::RelayCredentialsRejected);
-    pub const RELAY_PROFILE_MISMATCH: Self = Self(NotaryActivationCodeKind::RelayProfileMismatch);
-    pub const RELAY_PROFILE_NOT_FOUND: Self = Self(NotaryActivationCodeKind::RelayProfileNotFound);
-    pub const RELAY_UNAVAILABLE: Self = Self(NotaryActivationCodeKind::RelayUnavailable);
-    pub const RUNTIME_ACTIVATION_FAILED: Self =
-        Self(NotaryActivationCodeKind::RuntimeActivationFailed);
-    pub const RUNTIME_ACTIVATION_REQUIRED: Self =
-        Self(NotaryActivationCodeKind::RuntimeActivationRequired);
-    pub const POSTGRESQL_DATABASE_READ_ONLY: Self =
-        Self(NotaryActivationCodeKind::PostgresqlDatabaseReadOnly);
-    pub const POSTGRESQL_DATABASE_UNAVAILABLE: Self =
-        Self(NotaryActivationCodeKind::PostgresqlDatabaseUnavailable);
-    pub const POSTGRESQL_DATABASE_UNSUPPORTED: Self =
-        Self(NotaryActivationCodeKind::PostgresqlDatabaseUnsupported);
-    pub const POSTGRESQL_DURABILITY_UNSAFE: Self =
-        Self(NotaryActivationCodeKind::PostgresqlDurabilityUnsafe);
-    pub const POSTGRESQL_ROLE_INCOMPATIBLE: Self =
-        Self(NotaryActivationCodeKind::PostgresqlRoleIncompatible);
-    pub const POSTGRESQL_SCHEMA_INCOMPATIBLE: Self =
-        Self(NotaryActivationCodeKind::PostgresqlSchemaIncompatible);
-
-    /// Every published code in stable lexical order.
-    pub const ALL: &'static [Self] = &[
-        Self::CEL_WORKER_UNAVAILABLE,
-        Self::CONFIGURATION_INVALID,
-        Self::DEPLOYMENT_GATE_FAILED,
-        Self::RELAY_ACTIVATION_FAILED,
-        Self::RELAY_CONFIGURATION_INVALID,
-        Self::RELAY_CREDENTIAL_UNAVAILABLE,
-        Self::RELAY_CREDENTIALS_REJECTED,
-        Self::RELAY_PROFILE_MISMATCH,
-        Self::RELAY_PROFILE_NOT_FOUND,
-        Self::RELAY_UNAVAILABLE,
-        Self::RUNTIME_ACTIVATION_FAILED,
-        Self::RUNTIME_ACTIVATION_REQUIRED,
-        Self::POSTGRESQL_DATABASE_READ_ONLY,
-        Self::POSTGRESQL_DATABASE_UNAVAILABLE,
-        Self::POSTGRESQL_DATABASE_UNSUPPORTED,
-        Self::POSTGRESQL_DURABILITY_UNSAFE,
-        Self::POSTGRESQL_ROLE_INCOMPATIBLE,
-        Self::POSTGRESQL_SCHEMA_INCOMPATIBLE,
-    ];
-
-    #[must_use]
-    pub const fn as_str(self) -> &'static str {
-        match self.0 {
-            NotaryActivationCodeKind::CelWorkerUnavailable => "notary.cel.worker_unavailable",
-            NotaryActivationCodeKind::ConfigurationInvalid => "notary.configuration.invalid",
-            NotaryActivationCodeKind::DeploymentGateFailed => "notary.deployment.gate_failed",
-            NotaryActivationCodeKind::RelayActivationFailed => "notary.relay.activation_failed",
-            NotaryActivationCodeKind::RelayConfigurationInvalid => {
-                "notary.relay.configuration_invalid"
-            }
-            NotaryActivationCodeKind::RelayCredentialUnavailable => {
-                "notary.relay.credential_unavailable"
-            }
-            NotaryActivationCodeKind::RelayCredentialsRejected => {
-                "notary.relay.credentials_rejected"
-            }
-            NotaryActivationCodeKind::RelayProfileMismatch => "notary.relay.profile_mismatch",
-            NotaryActivationCodeKind::RelayProfileNotFound => "notary.relay.profile_not_found",
-            NotaryActivationCodeKind::RelayUnavailable => "notary.relay.unavailable",
-            NotaryActivationCodeKind::RuntimeActivationFailed => "notary.runtime.activation_failed",
-            NotaryActivationCodeKind::RuntimeActivationRequired => {
-                "notary.runtime.activation_required"
-            }
-            NotaryActivationCodeKind::PostgresqlDatabaseReadOnly => {
-                "notary.state.postgresql.database_read_only"
-            }
-            NotaryActivationCodeKind::PostgresqlDatabaseUnavailable => {
-                "notary.state.postgresql.database_unavailable"
-            }
-            NotaryActivationCodeKind::PostgresqlDatabaseUnsupported => {
-                "notary.state.postgresql.database_unsupported"
-            }
-            NotaryActivationCodeKind::PostgresqlDurabilityUnsafe => {
-                "notary.state.postgresql.durability_unsafe"
-            }
-            NotaryActivationCodeKind::PostgresqlRoleIncompatible => {
-                "notary.state.postgresql.role_incompatible"
-            }
-            NotaryActivationCodeKind::PostgresqlSchemaIncompatible => {
-                "notary.state.postgresql.schema_incompatible"
-            }
-        }
-    }
-
-    /// Static value-free operator guidance for this code.
-    #[must_use]
-    pub fn definition(self) -> &'static NotaryActivationCodeDefinition {
-        &NOTARY_ACTIVATION_CODE_DEFINITIONS[self.0 as usize]
-    }
-}
-
-impl fmt::Display for NotaryActivationCode {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str(self.as_str())
-    }
-}
-
-/// Publication state for a product-owned activation code definition.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum NotaryActivationCodeLifecycle {
-    /// The catalog contract has not shipped in a tagged release.
-    Unreleased,
-    /// The catalog contract shipped in the named release.
-    Released { introduced_version: &'static str },
-}
-
-impl NotaryActivationCodeLifecycle {
-    #[must_use]
-    pub const fn as_str(self) -> &'static str {
-        match self {
-            Self::Unreleased => "unreleased",
-            Self::Released { .. } => "released",
-        }
-    }
-
-    #[must_use]
-    pub const fn introduced_version(self) -> Option<&'static str> {
-        match self {
-            Self::Unreleased => None,
-            Self::Released { introduced_version } => Some(introduced_version),
-        }
-    }
-}
-
-/// Static, value-free meaning and recovery guidance for an activation code.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct NotaryActivationCodeDefinition {
-    pub code: NotaryActivationCode,
-    pub lifecycle: NotaryActivationCodeLifecycle,
-    pub phase: &'static str,
-    pub meaning: &'static str,
-    pub rule: &'static str,
-    pub remediation: &'static str,
-    pub evidence_scope: &'static str,
-    pub evidence_policy: &'static str,
-    pub evidence_limitation: &'static str,
-    pub docs_slug: &'static str,
-}
-
-/// Product-owned source for generated operator references.
-pub static NOTARY_ACTIVATION_CODE_DEFINITIONS: [NotaryActivationCodeDefinition; 18] = [
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::CEL_WORKER_UNAVAILABLE,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "runtime_activation",
-        meaning: "Registry Notary CEL worker is unavailable",
-        rule: "Every configured CEL worker must complete the bounded product protocol probe before listeners serve",
-        remediation: "verify that the adjacent CEL worker artifact is present and executable, confirm the supported platform and configured resource ceilings, then retry activation",
-        evidence_scope: "CEL worker packaging, protocol responsiveness, supported platform, and bounded startup capacity",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "cel-worker-unavailable",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::CONFIGURATION_INVALID,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "configuration_activation",
-        meaning: "Registry Notary runtime configuration is invalid",
-        rule: "Runtime activation requires valid product configuration, supported features, and resolvable secret and provider bindings",
-        remediation: "run registry-notary doctor, correct the reviewed configuration or binding, and retry activation",
-        evidence_scope: "Notary configuration, provider bindings, and compiled feature support",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "configuration-invalid",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::DEPLOYMENT_GATE_FAILED,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "deployment_activation",
-        meaning: "Registry Notary deployment gates refused startup",
-        rule: "Every startup-failing deployment gate must pass before activation",
-        remediation: "run registry-notary doctor for the selected deployment profile and resolve its startup-failing findings",
-        evidence_scope: "selected deployment profile and startup-failing gate results",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "deployment-gate-failed",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::RELAY_ACTIVATION_FAILED,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "relay_activation",
-        meaning: "Relay consultation activation failed",
-        rule: "Registry-backed claims require the reviewed Relay consultation client to activate before Notary serves",
-        remediation: "check the Notary configuration and startup environment",
-        evidence_scope: "Notary Relay consultation client activation lifecycle",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "relay-activation-failed",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::RELAY_CONFIGURATION_INVALID,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "relay_activation",
-        meaning: "Relay consultation configuration is invalid",
-        rule: "The Relay destination, activation plan, and activation lifecycle must form one valid reviewed configuration",
-        remediation: "check the evidence.relay connection and Registry-backed consultation configuration",
-        evidence_scope: "Relay destination, activation plan, and consultation configuration",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "relay-configuration-invalid",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::RELAY_CREDENTIAL_UNAVAILABLE,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "relay_activation",
-        meaning: "Relay workload credential is unavailable",
-        rule: "A current non-empty workload credential must be available before a live Relay consultation",
-        remediation: "mount a current readable workload JWT at evidence.relay.token_file",
-        evidence_scope: "configured Relay workload credential availability",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "relay-credential-unavailable",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::RELAY_CREDENTIALS_REJECTED,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "relay_activation",
-        meaning: "Relay rejected the configured workload credential",
-        rule: "Relay must accept the configured Notary workload binding, scope, and validity window",
-        remediation: "rotate the workload JWT and verify that Relay recognizes its workload binding, required scope, and validity window",
-        evidence_scope: "Relay workload binding, scope, and validity acceptance",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "relay-credentials-rejected",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::RELAY_PROFILE_MISMATCH,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "relay_activation",
-        meaning: "Relay consultation profile does not match the configured contract pin",
-        rule: "The active Relay profile must match the reviewed Notary consultation contract pin",
-        remediation: "reconcile the Notary profile id and contract hash with the reviewed Relay consultation contract",
-        evidence_scope: "reviewed Notary profile pin and active Relay consultation contract",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "relay-profile-mismatch",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::RELAY_PROFILE_NOT_FOUND,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "relay_activation",
-        meaning: "Relay consultation profile was not found",
-        rule: "Every Registry-backed Notary consultation must resolve to an active Relay profile",
-        remediation: "deploy the configured Relay profile id, then retry the live check",
-        evidence_scope: "configured consultation profile resolution in Relay",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "relay-profile-not-found",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::RELAY_UNAVAILABLE,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "relay_activation",
-        meaning: "Relay consultation service is unavailable",
-        rule: "The reviewed Relay destination must be reachable through the configured transport policy",
-        remediation: "check Relay reachability, TLS, destination policy, and service health",
-        evidence_scope: "reviewed Relay destination, transport policy, and service availability",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "relay-unavailable",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::RUNTIME_ACTIVATION_FAILED,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "runtime_activation",
-        meaning: "Registry Notary runtime activation failed",
-        rule: "Audit, state, sensitive-state, and other runtime dependencies must activate successfully before listeners serve",
-        remediation: "restore the governed runtime dependency or integrity condition, then retry activation",
-        evidence_scope: "governed audit, state, sensitive-state, and runtime dependencies",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "runtime-activation-failed",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::RUNTIME_ACTIVATION_REQUIRED,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "runtime_activation",
-        meaning: "Registry Notary runtime activation is required before serving",
-        rule: "Routers may be built only after the governed audit and state activation lifecycle completes",
-        remediation: "run the compiled Registry Notary runtime activation step before building or serving routers",
-        evidence_scope: "router assembly and governed audit and state activation lifecycle",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "runtime-activation-required",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::POSTGRESQL_DATABASE_READ_ONLY,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "runtime_activation",
-        meaning: "Registry Notary PostgreSQL state database is read-only or recovering",
-        rule: "Serving requires a writable PostgreSQL primary for correctness-state transactions",
-        remediation: "restore a writable PostgreSQL primary, run registry-notary state doctor, and retry activation",
-        evidence_scope: "PostgreSQL writeability and recovery posture",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "postgresql-database-read-only",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::POSTGRESQL_DATABASE_UNAVAILABLE,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "runtime_activation",
-        meaning: "Registry Notary PostgreSQL state database is unavailable",
-        rule: "Serving requires a reachable PostgreSQL service with an accepted TLS trust chain",
-        remediation: "check PostgreSQL reachability, TLS trust, and service health, then run registry-notary state doctor",
-        evidence_scope: "PostgreSQL transport, TLS trust, and service availability",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "postgresql-database-unavailable",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::POSTGRESQL_DATABASE_UNSUPPORTED,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "runtime_activation",
-        meaning: "Registry Notary PostgreSQL server major is unsupported",
-        rule: "Serving requires a PostgreSQL major covered by the Registry Notary compatibility contract",
-        remediation: "move the state database to a supported PostgreSQL major, run registry-notary state doctor, and retry activation",
-        evidence_scope: "PostgreSQL server-major compatibility",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "postgresql-database-unsupported",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::POSTGRESQL_DURABILITY_UNSAFE,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "runtime_activation",
-        meaning: "Registry Notary PostgreSQL durability settings are unsafe",
-        rule: "Serving requires the documented PostgreSQL durability settings for correctness state",
-        remediation: "restore the required PostgreSQL durability settings, run registry-notary state doctor, and retry activation",
-        evidence_scope: "PostgreSQL durability posture",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "postgresql-durability-unsafe",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::POSTGRESQL_ROLE_INCOMPATIBLE,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "runtime_activation",
-        meaning: "Registry Notary PostgreSQL runtime role contract is incompatible",
-        rule: "Serving requires the documented restricted runtime role and its attested schema binding",
-        remediation: "restore the documented runtime grants and role binding, run registry-notary state doctor, and retry activation",
-        evidence_scope: "PostgreSQL runtime-role attributes, grants, and schema binding",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "postgresql-role-incompatible",
-    },
-    NotaryActivationCodeDefinition {
-        code: NotaryActivationCode::POSTGRESQL_SCHEMA_INCOMPATIBLE,
-        lifecycle: NotaryActivationCodeLifecycle::Unreleased,
-        phase: "runtime_activation",
-        meaning: "Registry Notary PostgreSQL state schema contract is incompatible",
-        rule: "Serving requires the exact product-owned schema, catalog, fingerprint, and privilege contract",
-        remediation: "restore or install the matching Registry Notary state schema, run registry-notary state doctor, and retry activation",
-        evidence_scope: "PostgreSQL state schema, catalog, fingerprint, and privilege contract",
-        evidence_policy: VALUE_FREE_EVIDENCE_POLICY,
-        evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION,
-        docs_slug: "postgresql-schema-incompatible",
-    },
-];
-
-impl NotaryPostgresStatePlaneReadiness {
-    /// Map a value-free PostgreSQL readiness classification to its public
-    /// activation code and static operator guidance.
-    #[must_use]
-    pub const fn activation_code(self) -> NotaryActivationCode {
-        match self {
-            Self::ConfigurationInvalid => NotaryActivationCode::CONFIGURATION_INVALID,
-            Self::DatabaseUnavailable | Self::Shutdown => {
-                NotaryActivationCode::POSTGRESQL_DATABASE_UNAVAILABLE
-            }
-            Self::UnsupportedServerMajor => NotaryActivationCode::POSTGRESQL_DATABASE_UNSUPPORTED,
-            Self::DatabaseNotWritable => NotaryActivationCode::POSTGRESQL_DATABASE_READ_ONLY,
-            Self::UnsafeDurability => NotaryActivationCode::POSTGRESQL_DURABILITY_UNSAFE,
-            Self::SchemaIncompatible => NotaryActivationCode::POSTGRESQL_SCHEMA_INCOMPATIBLE,
-            Self::RoleIncompatible => NotaryActivationCode::POSTGRESQL_ROLE_INCOMPATIBLE,
-            Self::Ready => NotaryActivationCode::RUNTIME_ACTIVATION_FAILED,
-        }
-    }
-}
-
-/// Redacted process-boundary error that deliberately retains no inner error.
-#[derive(Clone, Copy, PartialEq, Eq)]
-pub struct NotaryActivationFailure {
-    code: NotaryActivationCode,
-}
-
-impl NotaryActivationFailure {
-    #[must_use]
-    pub const fn code(self) -> NotaryActivationCode {
-        self.code
-    }
-
-    #[must_use]
-    pub fn definition(self) -> &'static NotaryActivationCodeDefinition {
-        self.code.definition()
-    }
-}
-
-impl fmt::Debug for NotaryActivationFailure {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("NotaryActivationFailure")
-            .field("code", &self.code.as_str())
-            .finish()
-    }
-}
-
-impl fmt::Display for NotaryActivationFailure {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        let definition = self.definition();
-        write!(
-            formatter,
-            "{}: {}; next action: {}",
-            definition.code, definition.meaning, definition.remediation
-        )
-    }
-}
-
-impl std::error::Error for NotaryActivationFailure {}
-
-impl From<NotaryActivationCode> for NotaryActivationFailure {
-    fn from(code: NotaryActivationCode) -> Self {
-        Self { code }
-    }
-}
-
-impl From<StandaloneServerError> for NotaryActivationFailure {
-    fn from(error: StandaloneServerError) -> Self {
-        error.activation_code().into()
-    }
-}
-
-impl StandaloneServerError {
-    /// Map every internal startup failure to a closed, value-free public code.
-    #[must_use]
-    pub const fn activation_code(&self) -> NotaryActivationCode {
-        match self {
-            Self::Config(_)
-            | Self::MissingCredentialEnv(_)
-            | Self::InvalidCredentialHash(_, _)
-            | Self::InvalidSigningKey { .. }
-            | Self::SigningKeyProviderUnavailable { .. }
-            | Self::MissingFederationSecretEnv(_)
-            | Self::MissingAuditPath
-            | Self::MissingAuditHashSecretEnv
-            | Self::Cors(_)
-            | Self::InvalidAuditSink(_)
-            | Self::InvalidAuditConfig(_)
-            | Self::InvalidOidcConfig(_)
-            | Self::InvalidFederationConfig(_) => NotaryActivationCode::CONFIGURATION_INVALID,
-            Self::InvalidRelayDestination
-            | Self::InvalidRelayActivationPlan
-            | Self::RelayAlreadyActivated
-            | Self::RelayNotActivated => NotaryActivationCode::RELAY_CONFIGURATION_INVALID,
-            Self::RelayActivation => NotaryActivationCode::RELAY_ACTIVATION_FAILED,
-            Self::RelayCredentialUnavailable => NotaryActivationCode::RELAY_CREDENTIAL_UNAVAILABLE,
-            Self::RelayCredentialsRejected => NotaryActivationCode::RELAY_CREDENTIALS_REJECTED,
-            Self::RelayProfileNotFound => NotaryActivationCode::RELAY_PROFILE_NOT_FOUND,
-            Self::RelayProfileMismatch => NotaryActivationCode::RELAY_PROFILE_MISMATCH,
-            Self::RelayUnavailable => NotaryActivationCode::RELAY_UNAVAILABLE,
-            Self::AuditChainVerificationRequired | Self::PostgresqlStateActivationRequired => {
-                NotaryActivationCode::RUNTIME_ACTIVATION_REQUIRED
-            }
-            Self::StatePlane(error) => {
-                NotaryPostgresStatePlaneReadiness::from_error(*error).activation_code()
-            }
-            Self::SensitiveState(SensitiveStateError::StatePlane(error)) => {
-                NotaryPostgresStatePlaneReadiness::from_error(*error).activation_code()
-            }
-            Self::Audit(_) | Self::SensitiveState(_) => {
-                NotaryActivationCode::RUNTIME_ACTIVATION_FAILED
-            }
-            #[cfg(feature = "registry-notary-cel")]
-            Self::InvalidCelConfig(_) => NotaryActivationCode::CONFIGURATION_INVALID,
-            #[cfg(feature = "registry-notary-cel")]
-            Self::CelWorkerUnavailable => NotaryActivationCode::CEL_WORKER_UNAVAILABLE,
-            Self::DeploymentGateStartupFailure { .. } => {
-                NotaryActivationCode::DEPLOYMENT_GATE_FAILED
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    use std::collections::BTreeSet;
-
-    use registry_notary_core::EvidenceConfigError;
-    use registry_platform_audit::AuditError;
-    use registry_platform_authcommon::FingerprintFormatError;
-    use registry_platform_httpsec::CorsValidationError;
-
-    use crate::state_plane::{NotaryPostgresStatePlaneError, SensitiveStateError};
-
-    const SENTINEL: &str = "SENTINEL_PATH_URL_HASH_CREDENTIAL_IDENTIFIER_COUNTRY_PARSER_VALUE";
-
-    fn representative_errors() -> Vec<(StandaloneServerError, NotaryActivationCode)> {
-        let errors = vec![
-            (
-                StandaloneServerError::Config(EvidenceConfigError::InvalidAuthConfig {
-                    reason: SENTINEL.to_string(),
-                }),
-                NotaryActivationCode::CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::MissingCredentialEnv(SENTINEL.to_string()),
-                NotaryActivationCode::CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::InvalidCredentialHash(
-                    SENTINEL.to_string(),
-                    FingerprintFormatError::InvalidHex,
-                ),
-                NotaryActivationCode::CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::InvalidRelayDestination,
-                NotaryActivationCode::RELAY_CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::InvalidRelayActivationPlan,
-                NotaryActivationCode::RELAY_CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::RelayActivation,
-                NotaryActivationCode::RELAY_ACTIVATION_FAILED,
-            ),
-            (
-                StandaloneServerError::RelayAlreadyActivated,
-                NotaryActivationCode::RELAY_CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::RelayNotActivated,
-                NotaryActivationCode::RELAY_CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::AuditChainVerificationRequired,
-                NotaryActivationCode::RUNTIME_ACTIVATION_REQUIRED,
-            ),
-            (
-                StandaloneServerError::PostgresqlStateActivationRequired,
-                NotaryActivationCode::RUNTIME_ACTIVATION_REQUIRED,
-            ),
-            (
-                StandaloneServerError::RelayCredentialUnavailable,
-                NotaryActivationCode::RELAY_CREDENTIAL_UNAVAILABLE,
-            ),
-            (
-                StandaloneServerError::RelayCredentialsRejected,
-                NotaryActivationCode::RELAY_CREDENTIALS_REJECTED,
-            ),
-            (
-                StandaloneServerError::RelayProfileNotFound,
-                NotaryActivationCode::RELAY_PROFILE_NOT_FOUND,
-            ),
-            (
-                StandaloneServerError::RelayProfileMismatch,
-                NotaryActivationCode::RELAY_PROFILE_MISMATCH,
-            ),
-            (
-                StandaloneServerError::RelayUnavailable,
-                NotaryActivationCode::RELAY_UNAVAILABLE,
-            ),
-            (
-                StandaloneServerError::InvalidSigningKey {
-                    key: SENTINEL.to_string(),
-                    reason: SENTINEL.to_string(),
-                },
-                NotaryActivationCode::CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::SigningKeyProviderUnavailable {
-                    provider: SENTINEL.to_string(),
-                },
-                NotaryActivationCode::CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::MissingFederationSecretEnv(SENTINEL.to_string()),
-                NotaryActivationCode::CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::MissingAuditPath,
-                NotaryActivationCode::CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::MissingAuditHashSecretEnv,
-                NotaryActivationCode::CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::Audit(AuditError::EnvVarUnavailable {
-                    name: SENTINEL.to_string(),
-                }),
-                NotaryActivationCode::RUNTIME_ACTIVATION_FAILED,
-            ),
-            (
-                StandaloneServerError::Cors(CorsValidationError::MalformedOrigin(
-                    SENTINEL.to_string(),
-                )),
-                NotaryActivationCode::CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::InvalidAuditSink(SENTINEL.to_string()),
-                NotaryActivationCode::CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::InvalidAuditConfig(SENTINEL.to_string()),
-                NotaryActivationCode::CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::InvalidOidcConfig(SENTINEL.to_string()),
-                NotaryActivationCode::CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::InvalidFederationConfig(SENTINEL.to_string()),
-                NotaryActivationCode::CONFIGURATION_INVALID,
-            ),
-            (
-                StandaloneServerError::StatePlane(
-                    NotaryPostgresStatePlaneError::DatabaseUrlUnavailable,
-                ),
-                NotaryActivationCode::POSTGRESQL_DATABASE_UNAVAILABLE,
-            ),
-            (
-                StandaloneServerError::SensitiveState(
-                    SensitiveStateError::KeyEnvironmentUnavailable,
-                ),
-                NotaryActivationCode::RUNTIME_ACTIVATION_FAILED,
-            ),
-            (
-                StandaloneServerError::DeploymentGateStartupFailure {
-                    profile: SENTINEL.to_string(),
-                    findings: SENTINEL.to_string(),
-                },
-                NotaryActivationCode::DEPLOYMENT_GATE_FAILED,
-            ),
-        ];
-        #[cfg(feature = "registry-notary-cel")]
-        let errors = {
-            let mut errors = errors;
-            errors.push((
-                StandaloneServerError::InvalidCelConfig(SENTINEL.to_string()),
-                NotaryActivationCode::CONFIGURATION_INVALID,
-            ));
-            errors.push((
-                StandaloneServerError::CelWorkerUnavailable,
-                NotaryActivationCode::CEL_WORKER_UNAVAILABLE,
-            ));
-            errors
-        };
-        errors
-    }
-
-    #[test]
-    fn activation_codes_are_unique_ordered_and_definition_complete() {
-        assert_eq!(
-            NotaryActivationCode::ALL.len(),
-            NOTARY_ACTIVATION_CODE_DEFINITIONS.len()
-        );
-        let mut docs_slugs = BTreeSet::new();
-        for pair in NotaryActivationCode::ALL.windows(2) {
-            assert!(
-                pair[0].as_str() < pair[1].as_str(),
-                "activation codes must remain unique and lexically ordered"
-            );
-        }
-        for (index, code) in NotaryActivationCode::ALL.iter().copied().enumerate() {
-            let definition = code.definition();
-            assert_eq!(definition, &NOTARY_ACTIVATION_CODE_DEFINITIONS[index]);
-            assert_eq!(definition.code, code);
-            assert_eq!(
-                definition.lifecycle,
-                NotaryActivationCodeLifecycle::Unreleased
-            );
-            assert_eq!(definition.lifecycle.as_str(), "unreleased");
-            assert_eq!(definition.lifecycle.introduced_version(), None);
-            assert!(matches!(
-                definition.phase,
-                "configuration_activation"
-                    | "deployment_activation"
-                    | "relay_activation"
-                    | "runtime_activation"
-            ));
-            assert!(!definition.meaning.is_empty());
-            assert!(!definition.rule.is_empty());
-            assert!(!definition.remediation.is_empty());
-            assert!(!definition.evidence_scope.is_empty());
-            assert_eq!(definition.evidence_policy, VALUE_FREE_EVIDENCE_POLICY);
-            assert_eq!(
-                definition.evidence_limitation,
-                ACTIVATION_EVIDENCE_LIMITATION
-            );
-            assert!(
-                !definition.docs_slug.is_empty()
-                    && !definition.docs_slug.starts_with('-')
-                    && !definition.docs_slug.ends_with('-')
-                    && definition
-                        .docs_slug
-                        .bytes()
-                        .all(|byte| byte.is_ascii_lowercase()
-                            || byte.is_ascii_digit()
-                            || byte == b'-'),
-                "documentation slugs must be stable lowercase anchor components"
-            );
-            assert!(
-                docs_slugs.insert(definition.docs_slug),
-                "documentation slugs must be unique"
-            );
-            for value in [
-                definition.phase,
-                definition.meaning,
-                definition.rule,
-                definition.remediation,
-                definition.evidence_scope,
-                definition.evidence_policy,
-                definition.evidence_limitation,
-                definition.docs_slug,
-            ] {
-                assert!(
-                    !value.contains(SENTINEL),
-                    "static activation metadata must not carry runtime values"
-                );
-            }
-        }
-    }
-
-    #[test]
-    fn every_standalone_error_maps_to_a_published_value_free_code() {
-        let cases = representative_errors();
-        #[cfg(not(feature = "registry-notary-cel"))]
-        assert_eq!(cases.len(), 29);
-        #[cfg(feature = "registry-notary-cel")]
-        assert_eq!(cases.len(), 31);
-
-        for (error, expected) in cases {
-            assert_eq!(error.activation_code(), expected);
-            assert!(NotaryActivationCode::ALL.contains(&expected));
-            let failure = NotaryActivationFailure::from(error);
-            assert_eq!(failure.code(), expected);
-            let display = failure.to_string();
-            let debug = format!("{failure:?}");
-            assert!(display.contains(expected.as_str()));
-            assert!(!display.contains(SENTINEL));
-            assert!(!debug.contains(SENTINEL));
-        }
-    }
-
-    #[test]
-    fn postgresql_failures_keep_cause_specific_public_classification() {
-        let cases = [
-            (
-                NotaryPostgresStatePlaneError::DatabaseUnavailable,
-                NotaryActivationCode::POSTGRESQL_DATABASE_UNAVAILABLE,
-            ),
-            (
-                NotaryPostgresStatePlaneError::DatabaseNotWritable,
-                NotaryActivationCode::POSTGRESQL_DATABASE_READ_ONLY,
-            ),
-            (
-                NotaryPostgresStatePlaneError::UnsupportedServerMajor,
-                NotaryActivationCode::POSTGRESQL_DATABASE_UNSUPPORTED,
-            ),
-            (
-                NotaryPostgresStatePlaneError::UnsafeDurability,
-                NotaryActivationCode::POSTGRESQL_DURABILITY_UNSAFE,
-            ),
-            (
-                NotaryPostgresStatePlaneError::SchemaIncompatible,
-                NotaryActivationCode::POSTGRESQL_SCHEMA_INCOMPATIBLE,
-            ),
-            (
-                NotaryPostgresStatePlaneError::RoleIncompatible,
-                NotaryActivationCode::POSTGRESQL_ROLE_INCOMPATIBLE,
-            ),
-        ];
-
-        for (error, expected) in cases {
-            let direct = StandaloneServerError::StatePlane(error);
-            let sensitive =
-                StandaloneServerError::SensitiveState(SensitiveStateError::StatePlane(error));
-            assert_eq!(direct.activation_code(), expected);
-            assert_eq!(sensitive.activation_code(), expected);
-
-            let failure = NotaryActivationFailure::from(direct);
-            let rendered = format!("{failure:?} {failure}");
-            assert!(rendered.contains(expected.as_str()));
-            assert!(!rendered.contains(SENTINEL));
-            assert!(!rendered.contains("postgresql://"));
-        }
-    }
-
-    #[test]
-    fn postgresql_public_diagnostics_have_static_meaning_and_remediation() {
-        let codes = [
-            NotaryActivationCode::POSTGRESQL_DATABASE_READ_ONLY,
-            NotaryActivationCode::POSTGRESQL_DATABASE_UNAVAILABLE,
-            NotaryActivationCode::POSTGRESQL_DATABASE_UNSUPPORTED,
-            NotaryActivationCode::POSTGRESQL_DURABILITY_UNSAFE,
-            NotaryActivationCode::POSTGRESQL_ROLE_INCOMPATIBLE,
-            NotaryActivationCode::POSTGRESQL_SCHEMA_INCOMPATIBLE,
-        ];
-
-        for code in codes {
-            let definition = code.definition();
-            let failure = NotaryActivationFailure::from(code);
-            let display = failure.to_string();
-            assert!(display.contains(code.as_str()));
-            assert!(display.contains(definition.meaning));
-            assert!(display.contains(definition.remediation));
-            for forbidden in [SENTINEL, "postgresql://", "/run/", "registry_notary_"] {
-                assert!(
-                    !display.contains(forbidden),
-                    "public PostgreSQL diagnostic exposed forbidden value {forbidden:?}: {display}"
-                );
-            }
-        }
-    }
-
-    #[test]
-    fn established_doctor_code_strings_remain_exact() {
-        assert_eq!(
-            NotaryActivationCode::RELAY_CREDENTIAL_UNAVAILABLE.as_str(),
-            "notary.relay.credential_unavailable"
-        );
-        assert_eq!(
-            NotaryActivationCode::RELAY_CREDENTIALS_REJECTED.as_str(),
-            "notary.relay.credentials_rejected"
-        );
-        assert_eq!(
-            NotaryActivationCode::RELAY_PROFILE_NOT_FOUND.as_str(),
-            "notary.relay.profile_not_found"
-        );
-        assert_eq!(
-            NotaryActivationCode::RELAY_PROFILE_MISMATCH.as_str(),
-            "notary.relay.profile_mismatch"
-        );
-        assert_eq!(
-            NotaryActivationCode::RELAY_UNAVAILABLE.as_str(),
-            "notary.relay.unavailable"
-        );
-        assert_eq!(
-            NotaryActivationCode::RELAY_CONFIGURATION_INVALID.as_str(),
-            "notary.relay.configuration_invalid"
-        );
-        assert_eq!(
-            NotaryActivationCode::RELAY_ACTIVATION_FAILED.as_str(),
-            "notary.relay.activation_failed"
-        );
-        assert_eq!(
-            NotaryActivationCode::POSTGRESQL_DATABASE_READ_ONLY.as_str(),
-            "notary.state.postgresql.database_read_only"
-        );
-        assert_eq!(
-            NotaryActivationCode::POSTGRESQL_DATABASE_UNAVAILABLE.as_str(),
-            "notary.state.postgresql.database_unavailable"
-        );
-        assert_eq!(
-            NotaryActivationCode::POSTGRESQL_DATABASE_UNSUPPORTED.as_str(),
-            "notary.state.postgresql.database_unsupported"
-        );
-        assert_eq!(
-            NotaryActivationCode::POSTGRESQL_ROLE_INCOMPATIBLE.as_str(),
-            "notary.state.postgresql.role_incompatible"
-        );
-        assert_eq!(
-            NotaryActivationCode::POSTGRESQL_SCHEMA_INCOMPATIBLE.as_str(),
-            "notary.state.postgresql.schema_incompatible"
-        );
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    #[test]
-    fn cel_startup_errors_keep_configuration_and_runtime_codes_separate() {
-        let invalid = NotaryActivationFailure::from(StandaloneServerError::InvalidCelConfig(
-            SENTINEL.to_string(),
-        ));
-        assert_eq!(invalid.code(), NotaryActivationCode::CONFIGURATION_INVALID);
-        assert!(!invalid.to_string().contains(SENTINEL));
-
-        let unavailable =
-            NotaryActivationFailure::from(StandaloneServerError::CelWorkerUnavailable);
-        assert_eq!(
-            unavailable.code(),
-            NotaryActivationCode::CEL_WORKER_UNAVAILABLE
-        );
-        assert!(!unavailable.to_string().contains(SENTINEL));
-    }
-}
diff --git a/crates/registry-notary-server/src/standalone/assembly.rs b/crates/registry-notary-server/src/standalone/assembly.rs
deleted file mode 100644
index 684e9cf6a..000000000
--- a/crates/registry-notary-server/src/standalone/assembly.rs
+++ /dev/null
@@ -1,798 +0,0 @@
-use super::*;
-
-/// Build an explicitly in-memory Notary router.
-///
-/// PostgreSQL configurations require asynchronous state-plane activation and
-/// return [`StandaloneServerError::PostgresqlStateActivationRequired`].
-/// Registry-backed in-memory configurations return
-/// [`StandaloneServerError::RelayNotActivated`]. Processes serving either
-/// configuration must compile the runtime, await
-/// [`NotaryRuntimeSnapshot::activate`], and only then build listeners.
-pub async fn standalone_router(
-    config: StandaloneRegistryNotaryConfig,
-) -> Result<Router, StandaloneServerError> {
-    if config.state.storage == STATE_STORAGE_POSTGRESQL {
-        return Err(StandaloneServerError::PostgresqlStateActivationRequired);
-    }
-    let admin_listener_mode = config.server.admin_listener.mode;
-    let mut runtime = compile_notary_runtime(config)?;
-    runtime.verify_retained_audit_chain().await;
-    runtime.activate_cel_worker().await?;
-    match admin_listener_mode {
-        RegistryNotaryAdminListenerMode::SharedWithPublic => {
-            notary_shared_router_from_runtime(runtime)
-        }
-        RegistryNotaryAdminListenerMode::Dedicated | RegistryNotaryAdminListenerMode::Disabled => {
-            Ok(notary_routers_from_runtime(runtime)?.public)
-        }
-    }
-}
-
-pub struct NotaryRuntimeSnapshot {
-    state_plane: Arc<NotaryStatePlaneHandle>,
-    metrics: Arc<AppMetrics>,
-    auth_state: Arc<AuthAuditState>,
-    api_state: Arc<RegistryNotaryApiState>,
-    cors_policy: registry_platform_httpsec::CorsPolicy,
-    wallet_cors_policy: SubjectAccessWalletCorsPolicy,
-    http_limits: NotaryHttpLimits,
-    federation_enabled: bool,
-    audit_chain_verification_attempted: bool,
-}
-
-impl NotaryRuntimeSnapshot {
-    /// Activate PostgreSQL state and any configured Relay consultations.
-    ///
-    /// In-memory runtimes activate their configured Relay consultations before
-    /// serving requests.
-    pub async fn activate(mut self) -> Result<Self, StandaloneServerError> {
-        self.verify_retained_audit_chain().await;
-        self.state_plane.activate().await?;
-        let config = self
-            .api_state
-            .runtime_config()
-            .ok_or(StandaloneServerError::InvalidRelayActivationPlan)?;
-        if let Some(activated) = activate_relay_from_config(&config).await? {
-            self.api_state
-                .install_activated_relay(activated)
-                .map_err(|_| StandaloneServerError::RelayAlreadyActivated)?;
-        }
-        self.activate_cel_worker().await?;
-        self.state_plane.start_retention_maintenance()?;
-        self.ensure_ready_to_serve()?;
-        Ok(self)
-    }
-
-    #[cfg(feature = "registry-notary-cel")]
-    async fn activate_cel_worker(&self) -> Result<(), StandaloneServerError> {
-        activate_configured_cel_worker(self.api_state.cel_worker.as_ref()).await
-    }
-
-    #[cfg(not(feature = "registry-notary-cel"))]
-    async fn activate_cel_worker(&self) -> Result<(), StandaloneServerError> {
-        Ok(())
-    }
-
-    async fn verify_retained_audit_chain(&mut self) {
-        // Verify the retained chain before dependency activation or listener
-        // binding. Integrity failures are surfaced through readiness and remain
-        // available for offline operator recovery. Operational failures remain
-        // retryable and do not poison readiness.
-        if let Err(error) = self.auth_state.audit.verify_chain_eager().await {
-            if matches!(
-                &error,
-                AuditError::ChainForkDetected { .. } | AuditError::ChainVerification(_)
-            ) {
-                tracing::error!(
-                    code = crate::AUDIT_CHAIN_INCONSISTENT_CODE,
-                    "audit chain failed eager integrity verification"
-                );
-            } else {
-                tracing::warn!(
-                    "audit chain eager verification encountered a retryable operational failure"
-                );
-            }
-        }
-        self.audit_chain_verification_attempted = true;
-    }
-
-    fn ensure_ready_to_serve(&self) -> Result<(), StandaloneServerError> {
-        if !self.audit_chain_verification_attempted {
-            return Err(StandaloneServerError::AuditChainVerificationRequired);
-        }
-        if !self.state_plane.is_activated() {
-            return Err(StandaloneServerError::StatePlane(
-                NotaryPostgresStatePlaneError::DatabaseUnavailable,
-            ));
-        }
-        if self.api_state.relay_required() && !self.api_state.relay_activated() {
-            return Err(StandaloneServerError::RelayNotActivated);
-        }
-        #[cfg(feature = "registry-notary-cel")]
-        if self
-            .api_state
-            .cel_worker
-            .as_ref()
-            .is_some_and(|worker| !worker.is_activated())
-        {
-            return Err(StandaloneServerError::CelWorkerUnavailable);
-        }
-        Ok(())
-    }
-
-    pub async fn emit_config_boot_audit(
-        &self,
-        event: &'static str,
-        audit: ConfigAuditEvent,
-    ) -> Result<(), AuditError> {
-        self.auth_state
-            .audit
-            .emit(&config_boot_audit_event(event, audit))
-            .await
-    }
-}
-
-#[cfg(feature = "registry-notary-cel")]
-async fn activate_configured_cel_worker(
-    worker: Option<&Arc<CelWorker>>,
-) -> Result<(), StandaloneServerError> {
-    let Some(worker) = worker else {
-        return Ok(());
-    };
-    if worker.activate().await.is_err() {
-        tracing::error!(
-            code = "notary.cel.worker_unavailable",
-            "CEL worker failed protocol activation"
-        );
-        return Err(StandaloneServerError::CelWorkerUnavailable);
-    }
-    Ok(())
-}
-
-#[derive(Debug, Clone, Copy)]
-struct NotaryHttpLimits {
-    request_timeout: Duration,
-    request_body_timeout: Duration,
-}
-
-pub struct NotaryRouters {
-    pub public: Router,
-    pub admin: Router,
-}
-
-pub fn compile_notary_runtime(
-    config: StandaloneRegistryNotaryConfig,
-) -> Result<NotaryRuntimeSnapshot, StandaloneServerError> {
-    compile_notary_runtime_with_provenance(config, ConfigSource::LocalFile, None)
-}
-
-/// Perform the same authenticated, hash-pinned Relay metadata verification
-/// used during startup without constructing the rest of the Notary runtime.
-/// Returns `false` only when the configuration has no Registry-backed claims.
-pub async fn verify_relay_from_config(
-    config: &StandaloneRegistryNotaryConfig,
-) -> Result<bool, StandaloneServerError> {
-    config.validate()?;
-    Ok(activate_relay_from_config(config).await?.is_some())
-}
-
-/// Value-free signed-bundle evidence for the closed state-store preparation action.
-pub struct PrepareStateStoreAuditEvidence {
-    pub acceptance_identity: registry_platform_config::ProductAcceptanceIdentityV1,
-    pub bundle_id: String,
-    pub bundle_manifest_hash: String,
-    pub sequence: u64,
-    pub signer_kids: Vec<String>,
-    pub previous_config_hash: Option<String>,
-    pub config_hash: String,
-    pub anchor_digest: String,
-    pub anchor_version: u64,
-}
-
-/// Write the checked mutation intent for the closed state-store preparation action.
-///
-/// Product preparation cannot compile the full runtime because it must not
-/// resolve issuer, signer, source, or serving credentials. This narrow path
-/// reuses the Notary-owned audit pipeline and owns the fixed event taxonomy,
-/// action, and pending/unapplied semantics.
-pub async fn emit_prepare_state_store_mutation_intent_audit(
-    config: &registry_notary_core::EvidenceAuditConfig,
-    evidence: PrepareStateStoreAuditEvidence,
-) -> Result<(), StandaloneServerError> {
-    emit_product_action_mutation_intent_audit(config, "prepare_state_store", evidence).await
-}
-
-/// Write the checked mutation intent for a closed product action without
-/// constructing issuer, signer, source, or serving capabilities.
-pub async fn emit_product_action_mutation_intent_audit(
-    config: &registry_notary_core::EvidenceAuditConfig,
-    action: &'static str,
-    evidence: PrepareStateStoreAuditEvidence,
-) -> Result<(), StandaloneServerError> {
-    let audit = ConfigAuditEvent {
-        action: action.to_string(),
-        source: ConfigSource::SignedBundleFile.as_posture_str().to_string(),
-        acceptance_identity: Some(evidence.acceptance_identity),
-        bundle_id: Some(evidence.bundle_id),
-        bundle_manifest_hash: Some(evidence.bundle_manifest_hash),
-        sequence: Some(evidence.sequence),
-        signer_kids: evidence.signer_kids,
-        previous_config_hash: evidence.previous_config_hash,
-        previous_hash_matched: None,
-        config_hash: Some(evidence.config_hash),
-        anchor_digest: Some(evidence.anchor_digest),
-        anchor_version: Some(evidence.anchor_version),
-        product_validation_result: "accepted".to_string(),
-        apply_result: "pending".to_string(),
-        posture_result: "accepted".to_string(),
-        applied: false,
-        restart_required: false,
-        change_classes: Vec::new(),
-        break_glass: false,
-        break_glass_approval_reference: None,
-        break_glass_approved_by: None,
-        break_glass_reason_hash: None,
-        break_glass_emergency_change_class: None,
-        break_glass_expires_at_unix_seconds: None,
-        break_glass_rate_limit_identity: None,
-        local_approval_reference: None,
-        local_approval_approved_by: None,
-        local_approval_reason_hash: None,
-        local_approval_change_class: None,
-        local_approval_expires_at_unix_seconds: None,
-        local_approval_rate_limit_identity: None,
-    };
-    let pipeline = AuditPipeline::from_config(config)?;
-    pipeline
-        .emit(&config_boot_audit_event(
-            "product_action.mutation_intent",
-            audit,
-        ))
-        .await?;
-    Ok(())
-}
-
-pub fn compile_notary_runtime_with_provenance(
-    config: StandaloneRegistryNotaryConfig,
-    config_source: ConfigSource,
-    config_provenance: Option<ConfigProvenance>,
-) -> Result<NotaryRuntimeSnapshot, StandaloneServerError> {
-    compile_notary_runtime_with_state_override(config, config_source, config_provenance, None)
-}
-
-#[cfg(test)]
-pub(super) fn compile_notary_runtime_for_gate_test(
-    config: StandaloneRegistryNotaryConfig,
-) -> Result<NotaryRuntimeSnapshot, StandaloneServerError> {
-    compile_notary_runtime_with_provenance_for_gate_test(config, ConfigSource::LocalFile, None)
-}
-
-#[cfg(test)]
-pub(super) async fn standalone_router_for_gate_test(
-    config: StandaloneRegistryNotaryConfig,
-) -> Result<Router, StandaloneServerError> {
-    let admin_listener_mode = config.server.admin_listener.mode;
-    let mut runtime = compile_notary_runtime_for_gate_test(config)?;
-    runtime.verify_retained_audit_chain().await;
-    runtime.activate_cel_worker().await?;
-    match admin_listener_mode {
-        RegistryNotaryAdminListenerMode::SharedWithPublic => {
-            notary_shared_router_from_runtime(runtime)
-        }
-        RegistryNotaryAdminListenerMode::Dedicated | RegistryNotaryAdminListenerMode::Disabled => {
-            Ok(notary_routers_from_runtime(runtime)?.public)
-        }
-    }
-}
-
-#[cfg(test)]
-pub(super) async fn standalone_router_with_ready_relay_for_gate_test(
-    config: StandaloneRegistryNotaryConfig,
-    activated: Arc<dyn crate::runtime::ActivatedRelayConsultations>,
-) -> Result<Router, StandaloneServerError> {
-    let admin_listener_mode = config.server.admin_listener.mode;
-    let mut runtime = compile_notary_runtime_for_gate_test(config)?;
-    runtime
-        .api_state
-        .install_activated_relay(activated)
-        .map_err(|_| StandaloneServerError::RelayAlreadyActivated)?;
-    runtime.verify_retained_audit_chain().await;
-    runtime.activate_cel_worker().await?;
-    match admin_listener_mode {
-        RegistryNotaryAdminListenerMode::SharedWithPublic => {
-            notary_shared_router_from_runtime(runtime)
-        }
-        RegistryNotaryAdminListenerMode::Dedicated | RegistryNotaryAdminListenerMode::Disabled => {
-            Ok(notary_routers_from_runtime(runtime)?.public)
-        }
-    }
-}
-
-#[cfg(test)]
-pub(super) fn compile_notary_runtime_with_provenance_for_gate_test(
-    config: StandaloneRegistryNotaryConfig,
-    config_source: ConfigSource,
-    config_provenance: Option<ConfigProvenance>,
-) -> Result<NotaryRuntimeSnapshot, StandaloneServerError> {
-    let mut state = config.state.clone();
-    state.storage = registry_notary_core::STATE_STORAGE_IN_MEMORY.to_string();
-    compile_notary_runtime_with_state_override(
-        config,
-        config_source,
-        config_provenance,
-        Some(state),
-    )
-}
-
-fn compile_notary_runtime_with_state_override(
-    config: StandaloneRegistryNotaryConfig,
-    config_source: ConfigSource,
-    config_provenance: Option<ConfigProvenance>,
-    state_override: Option<registry_notary_core::StateConfig>,
-) -> Result<NotaryRuntimeSnapshot, StandaloneServerError> {
-    config.validate()?;
-    let deployment_gates = DeploymentGateState::evaluate_with_config_source(&config, config_source);
-    deployment_gates.log_boot_waivers();
-    deployment_gates.fail_startup_if_blocked()?;
-    let federation_enabled = config.federation.enabled;
-    let http_limits = NotaryHttpLimits {
-        request_timeout: config.server.request_timeout,
-        request_body_timeout: config.server.request_body_timeout,
-    };
-    let evidence = Arc::new(config.evidence.clone());
-    let subject_access = Arc::new(config.subject_access.clone());
-    let oid4vci = Arc::new(config.oid4vci.clone());
-    let federation = Arc::new(config.federation.clone());
-    let metrics = Arc::new(AppMetrics::default());
-    let preauthorization_enabled =
-        config.oid4vci.enabled && config.oid4vci.pre_authorized_code.enabled;
-    let state_config = state_override.as_ref().unwrap_or(&config.state);
-    let state_plane = Arc::new(NotaryStatePlaneHandle::from_config(
-        state_config,
-        preauthorization_enabled,
-    )?);
-    let replay = if state_plane.is_in_memory() {
-        ReplayStores::configured_in_memory(Arc::clone(&state_plane))
-    } else {
-        ReplayStores::postgres(Arc::clone(&state_plane))
-    };
-    let credential_status = if state_plane.is_in_memory() {
-        CredentialStatusStore::from_config(&config.credential_status)
-    } else {
-        CredentialStatusStore::postgres(&config.credential_status, Arc::clone(&state_plane))
-    };
-    let gate_input = config.gate_input();
-    if gate_input.state_in_memory && gate_input.requires_shared_state() {
-        tracing::warn!(
-            target: "registry_notary::replay",
-            "correctness state is in-memory single-instance only; a mode \
-             (federation, OID4VCI pre-authorized code, holder proof, wallet traffic, \
-             or declared multi-instance) is active. Do not run active-active without \
-             shared correctness state."
-        );
-    }
-    let store = Arc::new(if state_plane.is_in_memory() {
-        EvidenceStore::default()
-    } else {
-        EvidenceStore::with_state_plane(Arc::clone(&state_plane))
-    });
-    let reuse_scoped_key_ids = config.reuse_scoped_signing_key_ids();
-    let signing_keys = Arc::new(SigningKeyRegistry::from_config(
-        &config.evidence,
-        &reuse_scoped_key_ids,
-    )?);
-    let signer_readiness = signing_keys.signer_readiness();
-    let issuers = Arc::new(EvidenceIssuerRegistry::from_signing_keys(
-        &config.evidence,
-        &signing_keys,
-    )?);
-    let federation_signing_provider = if config.federation.enabled {
-        Some(
-            signing_keys
-                .signing_provider(config.federation.signing.signing_key.as_str())
-                .ok_or_else(|| {
-                    invalid_signing_key(
-                        config.federation.signing.signing_key.as_str(),
-                        "active federation signing key was not built",
-                    )
-                })?,
-        )
-    } else {
-        None
-    };
-    let cors_policy = registry_platform_httpsec::CorsPolicy {
-        allowed_origins: config.server.cors.allowed_origins.clone(),
-        allowed_methods: Vec::new(),
-        allowed_headers: Vec::new(),
-        allow_credentials: false,
-    };
-    cors_policy.validate()?;
-    let wallet_cors_policy = SubjectAccessWalletCorsPolicy::from_config(&config);
-    let auth_state = AuthAuditState::from_config(&config, Arc::clone(&metrics), replay.clone())?;
-    let auth_state = Arc::new(if state_plane.is_in_memory() {
-        auth_state
-    } else {
-        auth_state.with_postgres_state_plane(
-            Arc::clone(&state_plane),
-            config.subject_access.rate_limits.clone(),
-        )
-    });
-    let posture_context =
-        PostureContext::from_config(&config, &auth_state.audit).map_err(|error| {
-            StandaloneServerError::InvalidSigningKey {
-                key: error.key_id().to_string(),
-                reason: "unsupported signing key status".to_string(),
-            }
-        })?;
-    #[cfg(feature = "registry-notary-cel")]
-    let cel_worker = build_cel_worker(&config, Arc::clone(&metrics))?;
-    let preauth_runtime = PreAuthRuntime::from_config(
-        &config,
-        &signing_keys,
-        auth_state.audit.clone(),
-        Arc::clone(&state_plane),
-    )?
-    .map(Arc::new);
-    let api_state = RegistryNotaryApiState::new_with_federation(
-        evidence,
-        subject_access,
-        oid4vci,
-        federation,
-        auth_state.audit.profile.key_hasher(),
-        config.federation.enabled.then(|| auth_state.audit.clone()),
-        replay,
-        credential_status,
-        Arc::clone(&metrics),
-        store,
-        issuers,
-        federation_signing_provider,
-    )?;
-    let api_state = if state_plane.is_in_memory() {
-        api_state
-    } else {
-        api_state.with_postgres_state_plane(
-            Arc::clone(&state_plane),
-            auth_state.audit.profile.key_hasher(),
-        )
-    };
-    let api_state = api_state
-        .with_auth_state(Arc::clone(&auth_state))
-        .with_audit_pipeline(auth_state.audit.clone())
-        .with_preauth_runtime(preauth_runtime)
-        .with_signer_readiness(signer_readiness)
-        .with_posture_context(posture_context)
-        .with_deployment_gates(deployment_gates)
-        .with_config_governance(ConfigGovernanceContext::from_config(&config))
-        .with_runtime_config(Arc::new(config.clone()));
-    if let Some(provenance) = config_provenance {
-        api_state.record_config_apply(crate::api::ConfigApplyPosture::from_provenance(provenance));
-    }
-    #[cfg(feature = "registry-notary-cel")]
-    let api_state = api_state
-        .with_cel_worker(cel_worker)
-        .with_cel_config(Arc::new(config.cel.clone()));
-    let api_state = Arc::new(api_state);
-    Ok(NotaryRuntimeSnapshot {
-        state_plane,
-        metrics,
-        auth_state,
-        api_state,
-        cors_policy,
-        wallet_cors_policy,
-        http_limits,
-        federation_enabled,
-        audit_chain_verification_attempted: false,
-    })
-}
-
-pub fn notary_shared_router_from_runtime(
-    snapshot: NotaryRuntimeSnapshot,
-) -> Result<Router, StandaloneServerError> {
-    snapshot.ensure_ready_to_serve()?;
-    let NotaryRuntimeSnapshot {
-        state_plane: _,
-        metrics,
-        auth_state,
-        api_state,
-        cors_policy,
-        wallet_cors_policy,
-        http_limits,
-        federation_enabled,
-        audit_chain_verification_attempted: _,
-    } = snapshot;
-    let mut routes = router();
-    if federation_enabled {
-        routes = routes.merge(crate::api::federation_router());
-    }
-    routes = routes.route(
-        "/metrics",
-        get(admin_metrics_handler).with_state(Arc::clone(&metrics)),
-    );
-
-    Ok(layer_notary_routes(
-        routes,
-        metrics,
-        auth_state,
-        api_state,
-        cors_policy,
-        wallet_cors_policy,
-        http_limits,
-    ))
-}
-
-pub fn notary_routers_from_runtime(
-    snapshot: NotaryRuntimeSnapshot,
-) -> Result<NotaryRouters, StandaloneServerError> {
-    snapshot.ensure_ready_to_serve()?;
-    let NotaryRuntimeSnapshot {
-        state_plane: _,
-        metrics,
-        auth_state,
-        api_state,
-        cors_policy,
-        wallet_cors_policy,
-        http_limits,
-        federation_enabled,
-        audit_chain_verification_attempted: _,
-    } = snapshot;
-    let mut public_routes = crate::api::public_router();
-    if federation_enabled {
-        public_routes = public_routes.merge(crate::api::federation_router());
-    }
-    let admin_routes = crate::api::admin_router().route(
-        "/metrics",
-        get(admin_metrics_handler).with_state(Arc::clone(&metrics)),
-    );
-
-    Ok(NotaryRouters {
-        public: layer_notary_routes(
-            public_routes,
-            Arc::clone(&metrics),
-            Arc::clone(&auth_state),
-            Arc::clone(&api_state),
-            cors_policy.clone(),
-            wallet_cors_policy.clone(),
-            http_limits,
-        ),
-        admin: layer_notary_routes(
-            admin_routes,
-            metrics,
-            auth_state,
-            api_state,
-            cors_policy,
-            wallet_cors_policy,
-            http_limits,
-        ),
-    })
-}
-
-/// Build the router mounted on the public listener.
-///
-/// The returned router is still wrapped in auth/audit middleware; only explicit
-/// probe and public protocol routes are exempted from authentication.
-pub fn notary_public_router_from_runtime(
-    snapshot: NotaryRuntimeSnapshot,
-) -> Result<Router, StandaloneServerError> {
-    Ok(notary_routers_from_runtime(snapshot)?.public)
-}
-
-pub fn notary_admin_router_from_runtime(
-    snapshot: NotaryRuntimeSnapshot,
-) -> Result<Router, StandaloneServerError> {
-    Ok(notary_routers_from_runtime(snapshot)?.admin)
-}
-
-fn layer_notary_routes(
-    routes: Router,
-    metrics: Arc<AppMetrics>,
-    auth_state: Arc<AuthAuditState>,
-    api_state: Arc<RegistryNotaryApiState>,
-    cors_policy: registry_platform_httpsec::CorsPolicy,
-    wallet_cors_policy: SubjectAccessWalletCorsPolicy,
-    http_limits: NotaryHttpLimits,
-) -> Router {
-    let cors_layer = match cors_policy.try_layer() {
-        Ok(layer) => layer,
-        Err(err) => {
-            tracing::error!(
-                error = %err,
-                "cors policy failed platform validation; falling back to deny-all"
-            );
-            tower_http::cors::CorsLayer::new()
-        }
-    };
-    routes
-        .layer(TimeoutLayer::with_status_code(
-            StatusCode::REQUEST_TIMEOUT,
-            http_limits.request_timeout,
-        ))
-        .layer(from_fn_with_state(Arc::clone(&metrics), metrics_middleware))
-        .layer(axum::Extension(Arc::clone(&api_state)))
-        .layer(from_fn_with_state(auth_state, auth_audit_middleware))
-        // Axum executes later layers first. Keep the proof precheck here so a
-        // malformed OID4VCI proof is rejected before authentication side effects.
-        .layer(from_fn_with_state(
-            api_state,
-            crate::api::oid4vci_proof_precheck_middleware,
-        ))
-        .layer(registry_platform_httpsec::security_headers(
-            registry_platform_httpsec::CspBuilder::restrictive(),
-        ))
-        .layer(cors_layer)
-        .layer(from_fn_with_state(
-            wallet_cors_policy,
-            subject_access_wallet_cors_middleware,
-        ))
-        .layer(registry_platform_httpsec::corp_conditional())
-        .layer(registry_platform_httpsec::request_body_limit(
-            MAX_INBOUND_REQUEST_BODY_BYTES,
-        ))
-        .layer(RequestBodyTimeoutLayer::new(
-            http_limits.request_body_timeout,
-        ))
-        .layer(axum::middleware::from_fn(rewrite_payload_too_large_problem))
-        .layer(axum::middleware::from_fn(reject_oversized_request_uri))
-        .layer(axum::middleware::from_fn(
-            attach_request_id_to_problem_response,
-        ))
-}
-
-#[derive(Debug, thiserror::Error)]
-pub enum StandaloneServerError {
-    #[error(transparent)]
-    Config(#[from] registry_notary_core::EvidenceConfigError),
-    #[error("configured credential environment variable is missing or empty: {0}")]
-    MissingCredentialEnv(String),
-    #[error(
-        "configured credential hash environment variable contains an invalid fingerprint: {0}"
-    )]
-    InvalidCredentialHash(String, #[source] FingerprintFormatError),
-    #[error("configured Relay destination is invalid")]
-    InvalidRelayDestination,
-    #[error("configured Relay consultation activation plan is invalid")]
-    InvalidRelayActivationPlan,
-    #[error("Relay consultation activation failed")]
-    RelayActivation,
-    #[error("Relay consultation client was already activated")]
-    RelayAlreadyActivated,
-    #[error("Relay consultation client was not activated before serving")]
-    RelayNotActivated,
-    #[error(
-        "the retained audit chain was not verified before serving; call activate().await or use standalone_router(config).await"
-    )]
-    AuditChainVerificationRequired,
-    #[error(
-        "standalone_router supports only explicit local in-memory state; PostgreSQL requires compile_notary_runtime(config)?.activate().await before building routers"
-    )]
-    PostgresqlStateActivationRequired,
-    #[error("Relay workload credential is unavailable")]
-    RelayCredentialUnavailable,
-    #[error("Relay rejected the configured workload credential")]
-    RelayCredentialsRejected,
-    #[error("Relay consultation profile was not found")]
-    RelayProfileNotFound,
-    #[error("Relay consultation profile does not match its configured pin")]
-    RelayProfileMismatch,
-    #[error("Relay consultation service is unavailable")]
-    RelayUnavailable,
-    #[error("signing key '{key}' is invalid: {reason}")]
-    InvalidSigningKey { key: String, reason: String },
-    #[error("signing key provider '{provider}' is not enabled")]
-    SigningKeyProviderUnavailable { provider: String },
-    #[error("federation secret environment variable is missing or empty: {0}")]
-    MissingFederationSecretEnv(String),
-    #[error("audit sink path is required when sink=file or sink=jsonl")]
-    MissingAuditPath,
-    #[error("audit.hash_secret_env is required")]
-    MissingAuditHashSecretEnv,
-    #[error(transparent)]
-    Audit(#[from] AuditError),
-    #[error(transparent)]
-    Cors(#[from] registry_platform_httpsec::CorsValidationError),
-    #[error("unsupported audit sink: {0}")]
-    InvalidAuditSink(String),
-    #[error("invalid audit configuration: {0}")]
-    InvalidAuditConfig(String),
-    #[error("invalid OIDC auth configuration: {0}")]
-    InvalidOidcConfig(String),
-    #[error("invalid federation configuration: {0}")]
-    InvalidFederationConfig(String),
-    #[error(transparent)]
-    StatePlane(#[from] NotaryPostgresStatePlaneError),
-    #[error(transparent)]
-    SensitiveState(#[from] crate::state_plane::SensitiveStateError),
-    #[cfg(feature = "registry-notary-cel")]
-    #[error("invalid CEL worker configuration: {0}")]
-    InvalidCelConfig(String),
-    #[cfg(feature = "registry-notary-cel")]
-    #[error("configured CEL worker is unavailable")]
-    CelWorkerUnavailable,
-    #[error(
-        "deployment profile '{profile}' refuses startup; failing gates: {findings}; {DEPLOYMENT_PROFILE_REQUIRED_ACTION}"
-    )]
-    DeploymentGateStartupFailure { profile: String, findings: String },
-}
-#[cfg(feature = "registry-notary-cel")]
-fn build_cel_worker(
-    config: &StandaloneRegistryNotaryConfig,
-    metrics: Arc<AppMetrics>,
-) -> Result<Option<Arc<CelWorker>>, StandaloneServerError> {
-    let evidence = &config.evidence;
-    if !evidence_uses_cel(evidence) {
-        return Ok(None);
-    }
-    if config.cel.mode == "disabled" {
-        return Err(StandaloneServerError::InvalidCelConfig(
-            "CEL claims require cel.mode = worker".to_string(),
-        ));
-    }
-    validate_cel_claims_for_startup(evidence, &config.cel)
-        .map_err(|_| StandaloneServerError::InvalidCelConfig("invalid CEL policy".to_string()))?;
-    let worker =
-        CelWorker::lazy(CelWorkerConfig::from_standalone_config(&config.cel)).with_metrics(metrics);
-    worker
-        .validate_config()
-        .map_err(|error| StandaloneServerError::InvalidCelConfig(error.to_string()))?;
-    Ok(Some(Arc::new(worker)))
-}
-
-#[cfg(feature = "registry-notary-cel")]
-fn evidence_uses_cel(evidence: &EvidenceConfig) -> bool {
-    evidence
-        .claims
-        .iter()
-        .any(|claim| matches!(&claim.rule, registry_notary_core::RuleConfig::Cel { .. }))
-}
-
-#[cfg(all(test, feature = "registry-notary-cel"))]
-mod cel_activation_tests {
-    use super::*;
-    use std::path::PathBuf;
-
-    fn worker_with_command(command: &str) -> Arc<CelWorker> {
-        let mut config = CelWorkerConfig::for_current_exe_subcommand();
-        config.command = PathBuf::from(command);
-        config.command_args.clear();
-        config.command_envs.clear();
-        config.max_workers = 1;
-        config.startup_timeout = Duration::from_millis(250);
-        config.max_memory_bytes = None;
-        Arc::new(CelWorker::lazy(config))
-    }
-
-    #[tokio::test]
-    async fn cel_free_activation_does_not_require_a_worker() {
-        activate_configured_cel_worker(None)
-            .await
-            .expect("CEL-free activation completes without a worker");
-    }
-
-    #[tokio::test]
-    async fn missing_cel_worker_fails_with_the_closed_activation_code() {
-        const MISSING_WORKER: &str = "/registry-notary-test/missing-cel-worker";
-        let worker = worker_with_command(MISSING_WORKER);
-
-        let error = activate_configured_cel_worker(Some(&worker))
-            .await
-            .expect_err("missing worker must fail activation");
-        assert!(matches!(error, StandaloneServerError::CelWorkerUnavailable));
-        let failure = NotaryActivationFailure::from(error);
-        assert_eq!(failure.code(), NotaryActivationCode::CEL_WORKER_UNAVAILABLE);
-        assert!(!failure.to_string().contains(MISSING_WORKER));
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn non_protocol_cel_worker_fails_with_the_closed_activation_code() {
-        const NON_PROTOCOL_WORKER: &str = "/usr/bin/true";
-        let worker = worker_with_command(NON_PROTOCOL_WORKER);
-
-        let error = activate_configured_cel_worker(Some(&worker))
-            .await
-            .expect_err("non-protocol worker must fail activation");
-        assert!(matches!(error, StandaloneServerError::CelWorkerUnavailable));
-        let failure = NotaryActivationFailure::from(error);
-        assert_eq!(failure.code(), NotaryActivationCode::CEL_WORKER_UNAVAILABLE);
-        assert!(!failure.to_string().contains(NON_PROTOCOL_WORKER));
-    }
-}
diff --git a/crates/registry-notary-server/src/standalone/auth/audit.rs b/crates/registry-notary-server/src/standalone/auth/audit.rs
deleted file mode 100644
index 0ebe5db9e..000000000
--- a/crates/registry-notary-server/src/standalone/auth/audit.rs
+++ /dev/null
@@ -1,278 +0,0 @@
-use super::*;
-
-pub(in super::super) fn config_boot_audit_event(
-    event: &'static str,
-    audit: ConfigAuditEvent,
-) -> EvidenceAuditEvent {
-    let occurred_at = OffsetDateTime::now_utc()
-        .format(&Rfc3339)
-        .unwrap_or_else(|_| "1970-01-01T00:00:00Z".to_string());
-    EvidenceAuditEvent {
-        event_id: Ulid::new().to_string(),
-        occurred_at,
-        principal_id_hash: None,
-        scopes_used: Vec::new(),
-        decision: "accepted".to_string(),
-        method: "BACKGROUND".to_string(),
-        path: format!("/__events/{event}"),
-        status: 200,
-        verification_id: None,
-        claim_hash: None,
-        purposes: None,
-        row_count: None,
-        relay_consultation_count: None,
-        relay_consultation_ids: Vec::new(),
-        forwarded: None,
-        error_code: None,
-        access_mode: None,
-        federation_peer_id_hash: None,
-        federation_issuer: None,
-        federation_profile: None,
-        federation_purpose: None,
-        federation_request_jti_hash: None,
-        federation_subject_ref_hash: None,
-        denial_code: None,
-        token_claim_name: None,
-        correlation_id_hash: None,
-        credential_profile: None,
-        protocol: None,
-        credential_configuration_id: None,
-        holder_binding_mode: None,
-        rate_limit_bucket: None,
-        policy_version: None,
-        policy_hash: None,
-        target_type: None,
-        target_ref_hash: None,
-        requester_type: None,
-        requester_ref_hash: None,
-        redacted_fields: None,
-        batch_items: None,
-        config: Some(audit),
-    }
-}
-
-#[derive(Clone)]
-pub(crate) struct AuditPipeline {
-    pub(in super::super) sink: Arc<dyn PlatformAuditSink>,
-    pub(in super::super) chain: Arc<OnceCell<ChainState>>,
-    pub(in super::super) profile: AuditProfile,
-    pub(in super::super) tail_init_in_progress: Arc<AtomicBool>,
-    /// Process-lifetime retained-chain integrity latch. Only confirmed chain
-    /// integrity failures flip this to false; transient operational failures
-    /// remain retryable and do not poison readiness.
-    pub(in super::super) chain_healthy: Arc<AtomicBool>,
-}
-
-pub(in super::super) struct TailInitReset(Arc<AtomicBool>);
-
-impl Drop for TailInitReset {
-    fn drop(&mut self) {
-        self.0.store(false, Ordering::Release);
-    }
-}
-
-impl std::fmt::Debug for AuditPipeline {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("AuditPipeline")
-            .field("sink", &"<redacted>")
-            .field("profile", &self.profile)
-            .finish()
-    }
-}
-
-impl AuditPipeline {
-    pub(in super::super) fn from_config(
-        config: &registry_notary_core::EvidenceAuditConfig,
-    ) -> Result<Self, StandaloneServerError> {
-        let hash_secret_env = config
-            .hash_secret_env
-            .as_deref()
-            .ok_or(StandaloneServerError::MissingAuditHashSecretEnv)?;
-        let profile = AuditProfile::registry_notary_from_env(hash_secret_env)?;
-        let sink: Arc<dyn PlatformAuditSink> = match config.sink.as_str() {
-            "stdout" => {
-                validate_no_file_audit_fields(config, "stdout")?;
-                validate_no_syslog_audit_fields(config, "stdout")?;
-                Arc::new(JsonlStdoutSink::new())
-            }
-            "file" | "jsonl" => {
-                validate_no_syslog_audit_fields(config, config.sink.as_str())?;
-                if config.max_files == Some(0) {
-                    return Err(StandaloneServerError::InvalidAuditConfig(
-                        "audit.max_files must be at least 1 when set".to_string(),
-                    ));
-                }
-                let path = config
-                    .path
-                    .as_deref()
-                    .ok_or(StandaloneServerError::MissingAuditPath)?;
-                // Single-writer advisory lock (#211): a second notary process
-                // sharing this audit volume (or an overlapping container during
-                // a restart/recreate) fails loudly with AuditError::SinkLocked
-                // instead of silently forking the audit chain.
-                Arc::new(JsonlFileSink::with_rotation_single_writer(
-                    path,
-                    config.max_size_bytes(),
-                    config.max_files(),
-                )?)
-            }
-            "syslog" => {
-                validate_no_file_audit_fields(config, "syslog")?;
-                let sink = match config.syslog_socket_path.as_deref() {
-                    Some(path) => SyslogSink::with_socket_path(path),
-                    None => SyslogSink::new(),
-                };
-                Arc::new(sink)
-            }
-            sink => return Err(StandaloneServerError::InvalidAuditSink(sink.to_string())),
-        };
-        Ok(Self {
-            sink,
-            chain: Arc::new(OnceCell::new()),
-            profile,
-            tail_init_in_progress: Arc::new(AtomicBool::new(false)),
-            chain_healthy: Arc::new(AtomicBool::new(true)),
-        })
-    }
-
-    #[cfg(test)]
-    pub(crate) fn for_sink_dev_only(sink: Arc<dyn PlatformAuditSink>) -> Self {
-        Self {
-            sink,
-            chain: Arc::new(OnceCell::new()),
-            profile: AuditProfile::unkeyed_dev_only(),
-            tail_init_in_progress: Arc::new(AtomicBool::new(false)),
-            chain_healthy: Arc::new(AtomicBool::new(true)),
-        }
-    }
-
-    pub(crate) fn hash_principal(&self, value: &str) -> Hashed<PrincipalIdentifier> {
-        Hashed::from_hash(self.profile.key_hasher().hash(value))
-    }
-
-    pub(crate) fn hash_request_identifier(&self, value: &str) -> Hashed<RequestIdentifier> {
-        Hashed::from_hash(self.profile.key_hasher().hash(value))
-    }
-
-    pub(crate) async fn emit(&self, event: &EvidenceAuditEvent) -> Result<(), AuditError> {
-        let result = async {
-            let chain = self
-                .chain
-                .get_or_try_init(|| async {
-                    self.profile
-                        .bootstrap_or_start_empty(self.sink.as_ref())
-                        .await
-                })
-                .await?;
-            let record = serde_json::to_value(event).map_err(AuditError::Json)?;
-            chain.append(self.sink.as_ref(), record).await?;
-            Ok(())
-        }
-        .await;
-        self.mark_chain_unhealthy_on_integrity_error(&result);
-        result
-    }
-
-    /// Eagerly verify the retained chain before the runtime can be served.
-    ///
-    /// Integrity failures latch readiness unhealthy for the process lifetime.
-    /// I/O, JSON, secret-loading, and other operational errors remain retryable
-    /// and do not change readiness.
-    pub(crate) async fn verify_chain_eager(&self) -> Result<(), AuditError> {
-        let result = self
-            .chain
-            .get_or_try_init(|| async {
-                self.profile
-                    .bootstrap_or_start_empty(self.sink.as_ref())
-                    .await
-            })
-            .await
-            .map(|_| ());
-        self.mark_chain_unhealthy_on_integrity_error(&result);
-        result
-    }
-
-    fn mark_chain_unhealthy_on_integrity_error<T>(&self, result: &Result<T, AuditError>) {
-        if matches!(
-            result,
-            Err(AuditError::ChainForkDetected { .. } | AuditError::ChainVerification(_))
-        ) {
-            self.chain_healthy.store(false, Ordering::SeqCst);
-        }
-    }
-
-    pub(crate) fn chain_healthy(&self) -> bool {
-        self.chain_healthy.load(Ordering::SeqCst)
-    }
-
-    pub(crate) async fn current_tail_hash_bounded(&self) -> Option<[u8; 32]> {
-        const DEADLINE: Duration = Duration::from_millis(500);
-        if let Some(chain) = self.chain.get() {
-            return chain.try_last_hash().flatten();
-        }
-        if self
-            .tail_init_in_progress
-            .compare_exchange(false, true, Ordering::AcqRel, Ordering::Acquire)
-            .is_err()
-        {
-            return None;
-        }
-        let pipeline = self.clone();
-        let worker = tokio::spawn(async move {
-            let _reset = TailInitReset(Arc::clone(&pipeline.tail_init_in_progress));
-            let result = pipeline
-                .chain
-                .get_or_try_init(|| async {
-                    pipeline
-                        .profile
-                        .bootstrap_or_start_empty(pipeline.sink.as_ref())
-                        .await
-                })
-                .await
-                .map(|chain| chain.try_last_hash().flatten());
-            pipeline.mark_chain_unhealthy_on_integrity_error(&result);
-            result
-        });
-        match tokio::time::timeout(DEADLINE, worker).await {
-            Ok(Ok(Ok(tail))) => tail,
-            Ok(Ok(Err(error))) => {
-                tracing::error!(error = %error, "failed to read current audit chain tail");
-                None
-            }
-            Ok(Err(error)) => {
-                tracing::error!(error = %error, "audit chain tail worker failed");
-                None
-            }
-            Err(_) => None,
-        }
-    }
-}
-
-pub(in super::super) fn validate_no_file_audit_fields(
-    config: &registry_notary_core::EvidenceAuditConfig,
-    sink: &str,
-) -> Result<(), StandaloneServerError> {
-    if config.path.is_some() {
-        return Err(StandaloneServerError::InvalidAuditConfig(format!(
-            "audit.path is only valid when audit.sink is file or jsonl, not {sink}"
-        )));
-    }
-    if config.max_size_mb.is_some() || config.max_files.is_some() {
-        return Err(StandaloneServerError::InvalidAuditConfig(format!(
-            "audit.max_size_mb and audit.max_files are only valid when audit.sink is file or jsonl, not {sink}"
-        )));
-    }
-    Ok(())
-}
-
-pub(in super::super) fn validate_no_syslog_audit_fields(
-    config: &registry_notary_core::EvidenceAuditConfig,
-    sink: &str,
-) -> Result<(), StandaloneServerError> {
-    if config.syslog_socket_path.is_some() {
-        return Err(StandaloneServerError::InvalidAuditConfig(format!(
-            "audit.syslog_socket_path is only valid when audit.sink is syslog, not {sink}"
-        )));
-    }
-    Ok(())
-}
diff --git a/crates/registry-notary-server/src/standalone/auth/credentials.rs b/crates/registry-notary-server/src/standalone/auth/credentials.rs
deleted file mode 100644
index 190e15314..000000000
--- a/crates/registry-notary-server/src/standalone/auth/credentials.rs
+++ /dev/null
@@ -1,197 +0,0 @@
-use super::*;
-
-/// Bench-internal: exposed only so `benches/auth_bench.rs` can construct
-/// fixtures. Production code goes through `resolve_credentials`, which reads
-/// the fingerprint from `EvidenceCredentialConfig::fingerprint`. Not part of the
-/// public API; do not depend on this shape from outside the workspace.
-#[doc(hidden)]
-#[derive(Clone)]
-pub struct ResolvedCredential {
-    pub id: String,
-    pub fingerprint: String,
-    pub scopes: Vec<String>,
-    pub authorization_details: Option<EvidenceAuthorizationDetails>,
-}
-
-impl std::fmt::Debug for ResolvedCredential {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("ResolvedCredential")
-            .field("id", &self.id)
-            .field("fingerprint", &"<redacted>")
-            .field("scopes", &self.scopes)
-            .field(
-                "authorization_details",
-                &self.authorization_details.as_ref().map(|_| "<configured>"),
-            )
-            .finish()
-    }
-}
-
-#[derive(Debug, Clone, Default)]
-pub(in super::super) struct RequestCredentials {
-    pub(in super::super) api_key: Option<String>,
-    pub(in super::super) api_key_present: bool,
-    pub(in super::super) authorization_present: bool,
-    pub(in super::super) bearer_token: Option<String>,
-    pub(in super::super) id_token: Option<String>,
-}
-
-impl RequestCredentials {
-    pub(in super::super) fn credential_type_count(&self) -> usize {
-        usize::from(self.api_key_present || self.api_key.is_some())
-            + usize::from(self.authorization_present || self.bearer_token.is_some())
-    }
-
-    pub(in super::super) fn are_absent(&self) -> bool {
-        self.api_key.is_none()
-            && !self.api_key_present
-            && !self.authorization_present
-            && self.bearer_token.is_none()
-            && self.id_token.is_none()
-    }
-}
-
-pub(in super::super) fn resolve_credentials(
-    credentials: &[EvidenceCredentialConfig],
-) -> Result<Vec<ResolvedCredential>, StandaloneServerError> {
-    credentials
-        .iter()
-        .map(|credential| {
-            let secret_ref = credential
-                .fingerprint
-                .name
-                .clone()
-                .or_else(|| {
-                    credential
-                        .fingerprint
-                        .path
-                        .as_ref()
-                        .map(|path| path.display().to_string())
-                })
-                .unwrap_or_else(|| credential.id.clone());
-            let fingerprint = credential
-                .fingerprint
-                .resolve()
-                .map_err(|error| match error {
-                    CredentialFingerprintRefError::MissingSecret => {
-                        StandaloneServerError::MissingCredentialEnv(secret_ref.clone())
-                    }
-                    CredentialFingerprintRefError::InvalidFingerprint(format_error) => {
-                        StandaloneServerError::InvalidCredentialHash(
-                            secret_ref.clone(),
-                            format_error,
-                        )
-                    }
-                    CredentialFingerprintRefError::EmptySecret => {
-                        StandaloneServerError::MissingCredentialEnv(secret_ref.clone())
-                    }
-                    CredentialFingerprintRefError::InvalidShape => {
-                        StandaloneServerError::InvalidCredentialHash(
-                            secret_ref.clone(),
-                            FingerprintFormatError::InvalidHex,
-                        )
-                    }
-                    _ => StandaloneServerError::InvalidCredentialHash(
-                        secret_ref.clone(),
-                        FingerprintFormatError::InvalidHex,
-                    ),
-                })?;
-            Ok(ResolvedCredential {
-                id: credential.id.clone(),
-                fingerprint,
-                scopes: credential.scopes.clone(),
-                authorization_details: credential.authorization_details.clone(),
-            })
-        })
-        .collect()
-}
-
-pub(in super::super) fn request_credentials(request: &Request) -> RequestCredentials {
-    let headers = request.headers();
-    let authorization = headers.get(header::AUTHORIZATION).and_then(header_str);
-    RequestCredentials {
-        api_key: headers
-            .get("x-api-key")
-            .and_then(header_str)
-            .map(ToOwned::to_owned),
-        api_key_present: headers.contains_key("x-api-key"),
-        authorization_present: headers.contains_key(header::AUTHORIZATION),
-        bearer_token: authorization
-            .and_then(|raw| parse_bearer_token(raw).ok())
-            .map(ToOwned::to_owned),
-        id_token: headers
-            .get(OIDC_ID_TOKEN_HEADER)
-            .and_then(header_str)
-            .map(ToOwned::to_owned),
-    }
-}
-
-#[cfg(test)]
-pub(in super::super) fn authenticate_static(
-    credentials: &RequestCredentials,
-    api_keys: &[ResolvedCredential],
-    bearer_tokens: &[ResolvedCredential],
-) -> Result<EvidencePrincipal, EvidenceError> {
-    authenticate_api_key(credentials, api_keys)
-        .or_else(|_| authenticate_static_bearer(credentials, bearer_tokens))
-}
-
-pub(in super::super) fn authenticate_api_key(
-    credentials: &RequestCredentials,
-    api_keys: &[ResolvedCredential],
-) -> Result<EvidencePrincipal, EvidenceError> {
-    if let Some(value) = credentials.api_key.as_deref() {
-        if let Some(credential) = find_credential(api_keys, value) {
-            return Ok(principal_from_credential(
-                credential,
-                EvidenceAuthProfileId::StaticApiKey,
-            ));
-        }
-    }
-    Err(EvidenceError::MissingCredential)
-}
-
-pub(in super::super) fn authenticate_static_bearer(
-    credentials: &RequestCredentials,
-    bearer_tokens: &[ResolvedCredential],
-) -> Result<EvidencePrincipal, EvidenceError> {
-    if let Some(value) = credentials.bearer_token.as_deref() {
-        if let Some(credential) = find_credential(bearer_tokens, value) {
-            return Ok(principal_from_credential(
-                credential,
-                EvidenceAuthProfileId::StaticBearer,
-            ));
-        }
-    }
-    Err(EvidenceError::MissingCredential)
-}
-
-/// Bench-internal: exposed only for `benches/auth_bench.rs`. Not part of the
-/// public API.
-#[doc(hidden)]
-pub fn find_credential<'a>(
-    credentials: &'a [ResolvedCredential],
-    token: &str,
-) -> Option<&'a ResolvedCredential> {
-    credentials
-        .iter()
-        .find(|credential| verify_api_key(token, &credential.fingerprint).unwrap_or(false))
-}
-
-pub(in super::super) fn principal_from_credential(
-    credential: &ResolvedCredential,
-    auth_profile_id: EvidenceAuthProfileId,
-) -> EvidencePrincipal {
-    EvidencePrincipal {
-        auth_profile_id,
-        principal_id: credential.id.clone(),
-        scopes: credential.scopes.clone(),
-        access_mode: AccessMode::MachineClient,
-        verified_claims: None,
-        authorization_details: credential.authorization_details.clone(),
-    }
-}
-
-pub(in super::super) fn header_str(value: &axum::http::HeaderValue) -> Option<&str> {
-    value.to_str().ok()
-}
diff --git a/crates/registry-notary-server/src/standalone/auth/middleware.rs b/crates/registry-notary-server/src/standalone/auth/middleware.rs
deleted file mode 100644
index dceb1c32a..000000000
--- a/crates/registry-notary-server/src/standalone/auth/middleware.rs
+++ /dev/null
@@ -1,360 +0,0 @@
-use super::*;
-
-pub(in super::super) async fn auth_audit_middleware(
-    State(state): State<Arc<AuthAuditState>>,
-    mut request: Request,
-    next: Next,
-) -> Response {
-    let method = request.method().to_string();
-    let path = audit_path(&request);
-    let correlation_id = new_request_correlation_id();
-    if is_auth_exempt_path(&path, state.auth_exemption_policy()) {
-        request.extensions_mut().insert(correlation_id.clone());
-        return with_request_correlation_id(correlation_id, next.run(request)).await;
-    }
-    let credentials = request_credentials(&request);
-    let client_address = client_address_identifier(&request);
-    if let Err(rate_error) =
-        maybe_rate_limit_auth_rejection_before_auth(&state, &credentials, client_address.as_str())
-            .await
-    {
-        let mut response = crate::api::evidence_error_response_with_request_id(
-            rate_error.evidence_error(),
-            Some(&correlation_id),
-        );
-        response.extensions_mut().insert(EvidenceAuditContext {
-            verification_id: None,
-            verification_decision: Some("auth_rate_limited".to_string()),
-            claim_hash: None,
-            purposes: None,
-            row_count: None,
-            access_mode: Some(AccessMode::Unknown),
-            denial_code: Some(SubjectAccessDenialCode::RateLimited),
-            token_claim_name: None,
-            credential_profile: None,
-            protocol: None,
-            credential_configuration_id: None,
-            holder_binding_mode: None,
-            rate_limit_bucket: rate_error
-                .bucket()
-                .and_then(|bucket| RateLimitBucket::new(bucket.as_str()).ok()),
-            policy_hash: None,
-            target_type: None,
-            target_ref_hash: None,
-            requester_type: None,
-            requester_ref_hash: None,
-            redacted_fields: None,
-            batch_items: None,
-            ..EvidenceAuditContext::default()
-        });
-        let audit_event = build_audit_event(
-            None,
-            &state.audit.profile.key_hasher(),
-            &method,
-            &path,
-            correlation_id.clone(),
-            &response,
-        );
-        return emit_audit_or_error(&state, audit_event, response).await;
-    }
-    let principal = match state.authenticate(credentials.clone()).await {
-        Ok(principal) => principal,
-        Err(error) => {
-            if let Err(rate_error) =
-                consume_auth_rejection_after_auth_failure(&state, client_address.as_str()).await
-            {
-                let mut response = crate::api::evidence_error_response_with_request_id(
-                    rate_error.evidence_error(),
-                    Some(&correlation_id),
-                );
-                response.extensions_mut().insert(EvidenceAuditContext {
-                    verification_id: None,
-                    verification_decision: Some("auth_rate_limited".to_string()),
-                    claim_hash: None,
-                    purposes: None,
-                    row_count: None,
-                    access_mode: Some(AccessMode::Unknown),
-                    denial_code: Some(SubjectAccessDenialCode::RateLimited),
-                    token_claim_name: None,
-                    credential_profile: None,
-                    protocol: None,
-                    credential_configuration_id: None,
-                    holder_binding_mode: None,
-                    rate_limit_bucket: rate_error
-                        .bucket()
-                        .and_then(|bucket| RateLimitBucket::new(bucket.as_str()).ok()),
-                    policy_hash: None,
-                    target_type: None,
-                    target_ref_hash: None,
-                    requester_type: None,
-                    requester_ref_hash: None,
-                    batch_items: None,
-                    ..EvidenceAuditContext::default()
-                });
-                let audit_event = build_audit_event(
-                    None,
-                    &state.audit.profile.key_hasher(),
-                    &method,
-                    &path,
-                    correlation_id.clone(),
-                    &response,
-                );
-                return emit_audit_or_error(&state, audit_event, response).await;
-            }
-            let response =
-                crate::api::evidence_error_response_with_request_id(error, Some(&correlation_id));
-            let audit_event = build_audit_event(
-                None,
-                &state.audit.profile.key_hasher(),
-                &method,
-                &path,
-                correlation_id.clone(),
-                &response,
-            );
-            return emit_audit_or_error(&state, audit_event, response).await;
-        }
-    };
-    request.extensions_mut().insert(principal.clone());
-    request.extensions_mut().insert(correlation_id.clone());
-    let response = with_request_correlation_id(correlation_id.clone(), next.run(request)).await;
-    let audit_event = build_audit_event(
-        Some(&principal),
-        &state.audit.profile.key_hasher(),
-        &method,
-        &path,
-        correlation_id,
-        &response,
-    );
-    emit_audit_or_error(&state, audit_event, response).await
-}
-
-pub(in super::super) async fn emit_audit_or_error(
-    state: &AuthAuditState,
-    audit_event: EvidenceAuditEvent,
-    response: Response,
-) -> Response {
-    match state.audit.emit(&audit_event).await {
-        Ok(()) => {
-            state.metrics.record_audit_event("success");
-            response
-        }
-        Err(error) => {
-            state.metrics.record_audit_event("failure");
-            if response.status() == StatusCode::SERVICE_UNAVAILABLE
-                && response
-                    .extensions()
-                    .get::<EvidenceErrorCodeContext>()
-                    .is_some_and(|context| context.0 == "audit.write_failed")
-            {
-                tracing::error!(
-                    target: "registry_notary_server::audit",
-                    error = %error,
-                    "audit event write failed while preserving prior audit failure response"
-                );
-                return response;
-            }
-            audit_error_response(error)
-        }
-    }
-}
-
-pub(in super::super) fn audit_path(request: &Request) -> String {
-    request
-        .extensions()
-        .get::<MatchedPath>()
-        .map(|matched| matched.as_str().to_string())
-        .unwrap_or_else(|| request.uri().path().to_string())
-}
-
-pub(in super::super) fn client_address_identifier(request: &Request) -> String {
-    request
-        .extensions()
-        .get::<ConnectInfo<SocketAddr>>()
-        .map(|ConnectInfo(addr)| addr.ip().to_string())
-        .unwrap_or_else(|| "unknown-client-address".to_string())
-}
-
-pub(in super::super) async fn maybe_rate_limit_auth_rejection_before_auth(
-    state: &AuthAuditState,
-    credentials: &RequestCredentials,
-    client_address: &str,
-) -> Result<(), crate::SubjectAccessRateLimitError> {
-    if credentials.bearer_token.is_none() && !credentials.are_absent() {
-        return Ok(());
-    }
-    let (Some(limiter), Some(keys)) = (
-        state.subject_access_invalid_token_limiter.as_ref(),
-        state.subject_access_rate_keys.as_ref(),
-    ) else {
-        return Ok(());
-    };
-    let client_address = keys.client_address(client_address)?;
-    limiter
-        .check_invalid_token_for_client_address_available(&client_address)
-        .await
-}
-
-pub(in super::super) async fn consume_auth_rejection_after_auth_failure(
-    state: &AuthAuditState,
-    client_address: &str,
-) -> Result<(), crate::SubjectAccessRateLimitError> {
-    let (Some(limiter), Some(keys)) = (
-        state.subject_access_invalid_token_limiter.as_ref(),
-        state.subject_access_rate_keys.as_ref(),
-    ) else {
-        return Ok(());
-    };
-    let client_address = keys.client_address(client_address)?;
-    limiter
-        .check_invalid_token_for_client_address(&client_address)
-        .await
-}
-
-#[derive(Debug, Clone, Copy)]
-pub(in super::super) struct AuthExemptionPolicy {
-    pub(in super::super) openapi_requires_auth: bool,
-}
-
-impl AuthAuditState {
-    fn auth_exemption_policy(&self) -> AuthExemptionPolicy {
-        AuthExemptionPolicy {
-            openapi_requires_auth: self.openapi_requires_auth(),
-        }
-    }
-}
-
-pub(in super::super) fn is_auth_exempt_path(path: &str, policy: AuthExemptionPolicy) -> bool {
-    matches!(
-        path,
-        "/healthz"
-            | "/ready"
-            | "/.well-known/evidence/jwks.json"
-            | "/.well-known/openid-credential-issuer"
-            | "/oid4vci/offer/start"
-            | "/oid4vci/offer/callback"
-            | "/oid4vci/offer/representative"
-            | "/oid4vci/token"
-            // Auth-exempt only from API-key/OIDC middleware. The federation
-            // handler still requires and verifies the peer-signed JWS.
-            | "/federation/v1/evaluations"
-            | "/docs"
-            | "/docs/scalar.js"
-            | "/credentials/{*vct_path}"
-            | "/v1/credentials/{credential_id}/status"
-    ) || (!policy.openapi_requires_auth && path == "/openapi.json")
-        || path.starts_with("/.well-known/vct/")
-}
-
-pub(in super::super) async fn admin_metrics_handler(
-    State(metrics): State<Arc<AppMetrics>>,
-    principal: Option<axum::Extension<EvidencePrincipal>>,
-) -> Response {
-    let Some(axum::Extension(principal)) = principal else {
-        return crate::api::evidence_error_response(EvidenceError::MissingCredential);
-    };
-    if !principal.has_scope(METRICS_SCOPE) {
-        return crate::api::evidence_error_response(EvidenceError::ScopeDenied {
-            required: METRICS_SCOPE.to_string(),
-        });
-    }
-    metrics_handler(State(metrics)).await
-}
-
-pub(in super::super) fn build_audit_event(
-    principal: Option<&EvidencePrincipal>,
-    hasher: &AuditKeyHasher,
-    method: &str,
-    path: &str,
-    correlation_id: BoundedCorrelationId,
-    response: &Response,
-) -> EvidenceAuditEvent {
-    let audit = response.extensions().get::<EvidenceAuditContext>();
-    let error = response.extensions().get::<EvidenceErrorCodeContext>();
-    let verification_id = audit.and_then(|context| context.verification_id.clone());
-    let claim_hash = audit.and_then(|context| context.claim_hash.clone());
-    let purposes = audit.and_then(|context| context.purposes.clone());
-    let row_count = audit.and_then(|context| context.row_count);
-    let relay_consultation_count = audit.and_then(|context| context.relay_consultation_count);
-    let relay_consultation_ids = audit
-        .map(|context| context.relay_consultation_ids.clone())
-        .unwrap_or_default();
-    let forwarded = audit.and_then(|context| context.forwarded);
-    let access_mode = audit
-        .and_then(|context| context.access_mode)
-        .or_else(|| principal.map(EvidencePrincipal::access_mode));
-    let denial_code = audit.and_then(|context| context.denial_code);
-    let token_claim_name = audit.and_then(|context| context.token_claim_name.clone());
-    let credential_profile = audit.and_then(|context| context.credential_profile.clone());
-    let protocol = audit.and_then(|context| context.protocol.clone());
-    let credential_configuration_id =
-        audit.and_then(|context| context.credential_configuration_id.clone());
-    let holder_binding_mode = audit.and_then(|context| context.holder_binding_mode.clone());
-    let rate_limit_bucket = audit.and_then(|context| context.rate_limit_bucket.clone());
-    let policy_hash = audit.and_then(|context| context.policy_hash.clone());
-    let target_type = audit.and_then(|context| context.target_type.clone());
-    let target_ref_hash = audit.and_then(|context| context.target_ref_hash.clone());
-    let requester_type = audit.and_then(|context| context.requester_type.clone());
-    let requester_ref_hash = audit.and_then(|context| context.requester_ref_hash.clone());
-    let redacted_fields = audit.and_then(|context| context.redacted_fields.clone());
-    let batch_items = audit.and_then(|context| context.batch_items.clone());
-    let config = audit.and_then(|context| context.config.clone());
-    let error_code = error.map(|context| context.0.clone());
-    let decision = audit
-        .and_then(|context| context.verification_decision.clone())
-        .unwrap_or_else(|| {
-            if response.status().is_success() {
-                "allowed".to_string()
-            } else {
-                "denied".to_string()
-            }
-        });
-    let occurred_at = OffsetDateTime::now_utc()
-        .format(&Rfc3339)
-        .unwrap_or_else(|_| "1970-01-01T00:00:00Z".to_string());
-    EvidenceAuditEvent {
-        event_id: Ulid::new().to_string(),
-        occurred_at,
-        principal_id_hash: principal.map(|principal| {
-            Hashed::<PrincipalIdentifier>::from_hash(hasher.hash(&principal.principal_id))
-        }),
-        scopes_used: principal.map_or_else(Vec::new, |principal| principal.scopes.clone()),
-        decision,
-        method: method.to_string(),
-        path: path.to_string(),
-        status: response.status().as_u16(),
-        verification_id,
-        claim_hash,
-        purposes,
-        row_count,
-        relay_consultation_count,
-        relay_consultation_ids,
-        forwarded,
-        error_code,
-        access_mode,
-        federation_peer_id_hash: None,
-        federation_issuer: None,
-        federation_profile: None,
-        federation_purpose: None,
-        federation_request_jti_hash: None,
-        federation_subject_ref_hash: None,
-        denial_code,
-        token_claim_name,
-        correlation_id_hash: Some(Hashed::<RequestIdentifier>::from_hash(
-            hasher.hash(correlation_id.as_str()),
-        )),
-        credential_profile,
-        protocol,
-        credential_configuration_id,
-        holder_binding_mode,
-        rate_limit_bucket,
-        policy_version: None,
-        policy_hash,
-        target_type,
-        target_ref_hash,
-        requester_type,
-        requester_ref_hash,
-        redacted_fields,
-        batch_items,
-        config,
-    }
-}
diff --git a/crates/registry-notary-server/src/standalone/auth/mod.rs b/crates/registry-notary-server/src/standalone/auth/mod.rs
deleted file mode 100644
index d0354862c..000000000
--- a/crates/registry-notary-server/src/standalone/auth/mod.rs
+++ /dev/null
@@ -1,309 +0,0 @@
-use super::*;
-
-mod audit;
-mod credentials;
-mod middleware;
-mod notary_tokens;
-mod oidc;
-
-pub(super) use audit::config_boot_audit_event;
-pub(crate) use audit::AuditPipeline;
-pub(super) use credentials::*;
-pub use credentials::{find_credential, ResolvedCredential};
-pub(super) use middleware::*;
-pub(crate) use notary_tokens::NotaryTokenAnchor;
-pub(super) use notary_tokens::*;
-pub(super) use oidc::*;
-
-#[derive(Debug)]
-pub(crate) struct AuthAuditState {
-    pub(super) authenticator: RwLock<Arc<Authenticator>>,
-    pub(super) audit: AuditPipeline,
-    pub(super) replay: ReplayStores,
-    pub(super) metrics: Arc<AppMetrics>,
-    pub(super) openapi_requires_auth: AtomicBool,
-    pub(super) subject_access_invalid_token_limiter: Option<Arc<SubjectAccessRateLimiter>>,
-    pub(super) subject_access_rate_keys: Option<Arc<SubjectAccessRateLimitKeys>>,
-}
-
-#[derive(Debug, Clone)]
-pub(super) struct Authenticator {
-    pub(super) api_keys: Vec<ResolvedCredential>,
-    pub(super) bearer_tokens: Vec<ResolvedCredential>,
-    pub(super) oidc: Option<OidcAuthenticator>,
-}
-
-#[derive(Debug, Clone)]
-pub(super) struct OidcAuthenticator {
-    verifier: Arc<TokenVerifier>,
-    fetch_url_policy: FetchUrlPolicy,
-    principal_claim: String,
-    subject_binding_claim: Option<String>,
-    subject_binding_claim_source: SubjectAccessClaimSource,
-    assurance_claim_source: SubjectAccessAssuranceClaimSource,
-    userinfo_endpoint: Option<String>,
-    userinfo_issuers: Vec<String>,
-    citizen_client_ids: Vec<String>,
-    citizen_audiences: Vec<String>,
-    /// Second, separately-keyed trust anchor for the Notary's own issuer
-    /// (the pre-authorized-code access tokens). `None` unless self-issuance
-    /// is enabled. The unverified issuer is used only to select this verifier;
-    /// the selected anchor performs complete signature and claim validation.
-    notary_anchor: Option<Arc<RwLock<NotaryTokenAnchor>>>,
-}
-
-impl AuthAuditState {
-    pub(super) fn from_config(
-        config: &StandaloneRegistryNotaryConfig,
-        metrics: Arc<AppMetrics>,
-        replay: ReplayStores,
-    ) -> Result<Self, StandaloneServerError> {
-        let audit = AuditPipeline::from_config(&config.audit)?;
-        let subject_access_invalid_token_limiter = config.subject_access.enabled.then(|| {
-            Arc::new(SubjectAccessRateLimiter::new(
-                config.subject_access.rate_limits.clone(),
-            ))
-        });
-        let subject_access_rate_keys = config
-            .subject_access
-            .enabled
-            .then(|| Arc::new(SubjectAccessRateLimitKeys::new(audit.profile.key_hasher())));
-        Ok(Self {
-            authenticator: RwLock::new(Arc::new(Authenticator::from_config(config)?)),
-            audit,
-            replay,
-            metrics,
-            openapi_requires_auth: AtomicBool::new(config.server.openapi_requires_auth),
-            subject_access_invalid_token_limiter,
-            subject_access_rate_keys,
-        })
-    }
-
-    #[must_use]
-    pub(super) fn with_postgres_state_plane(
-        mut self,
-        state_plane: Arc<crate::state_plane::NotaryStatePlaneHandle>,
-        rate_limits: registry_notary_core::SubjectAccessRateLimitsConfig,
-    ) -> Self {
-        if self.subject_access_invalid_token_limiter.is_some() {
-            self.subject_access_invalid_token_limiter = Some(Arc::new(
-                SubjectAccessRateLimiter::with_state_plane(rate_limits, state_plane),
-            ));
-        }
-        self
-    }
-
-    pub(super) async fn authenticate(
-        &self,
-        credentials: RequestCredentials,
-    ) -> Result<EvidencePrincipal, EvidenceError> {
-        let authenticator = self
-            .authenticator
-            .read()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-            .clone();
-        authenticator.authenticate(credentials, &self.replay).await
-    }
-
-    pub(crate) fn openapi_requires_auth(&self) -> bool {
-        self.openapi_requires_auth.load(Ordering::Relaxed)
-    }
-}
-
-impl Authenticator {
-    fn from_config(config: &StandaloneRegistryNotaryConfig) -> Result<Self, StandaloneServerError> {
-        Ok(Self {
-            api_keys: resolve_credentials(&config.auth.api_keys)?,
-            bearer_tokens: resolve_credentials(&config.auth.bearer_tokens)?,
-            oidc: config
-                .auth
-                .oidc
-                .as_ref()
-                .map(|_| OidcAuthenticator::from_config(config))
-                .transpose()?,
-        })
-    }
-
-    pub(super) async fn authenticate(
-        &self,
-        credentials: RequestCredentials,
-        replay: &ReplayStores,
-    ) -> Result<EvidencePrincipal, EvidenceError> {
-        if credentials.credential_type_count() > 1 {
-            return Err(EvidenceError::MultipleCredentials);
-        }
-        if credentials.api_key.is_some() {
-            return authenticate_api_key(&credentials, &self.api_keys);
-        }
-        if let Some(oidc) = &self.oidc {
-            return oidc.authenticate(&credentials, replay).await;
-        }
-        authenticate_static_bearer(&credentials, &self.bearer_tokens)
-    }
-
-    /// Build the Notary self-issuance anchor from the access-token signing
-    /// config and the dedicated signing key's public JWK.
-    fn build_notary_anchor(
-        config: &StandaloneRegistryNotaryConfig,
-        principal_claim: String,
-        subject_binding_claim: Option<String>,
-    ) -> Result<Option<Arc<RwLock<NotaryTokenAnchor>>>, StandaloneServerError> {
-        Ok(
-            Self::build_notary_anchor_value(config, principal_claim, subject_binding_claim)?
-                .map(|anchor| Arc::new(RwLock::new(anchor))),
-        )
-    }
-
-    fn build_notary_anchor_value(
-        config: &StandaloneRegistryNotaryConfig,
-        principal_claim: String,
-        subject_binding_claim: Option<String>,
-    ) -> Result<Option<NotaryTokenAnchor>, StandaloneServerError> {
-        let signing = &config.auth.access_token_signing;
-        if !signing.enabled {
-            return Ok(None);
-        }
-        Ok(Some(NotaryTokenAnchor {
-            verification_keys: access_token_verification_keys(config)?,
-            issuer: signing.issuer.clone(),
-            token_typ: signing.token_typ.clone(),
-            audiences: signing.audiences.clone(),
-            principal_claim,
-            subject_binding_claim,
-        }))
-    }
-}
-
-impl OidcAuthenticator {
-    fn from_config(config: &StandaloneRegistryNotaryConfig) -> Result<Self, StandaloneServerError> {
-        let oidc = config.auth.oidc.as_ref().ok_or_else(|| {
-            StandaloneServerError::InvalidOidcConfig("auth.oidc is required".to_string())
-        })?;
-        let allowed_algorithms = oidc
-            .allowed_algorithms
-            .iter()
-            .map(|algorithm| parse_oidc_algorithm(algorithm))
-            .collect::<Result<Vec<_>, _>>()?;
-        let scope_separator = oidc.scope_separator.chars().next().ok_or_else(|| {
-            StandaloneServerError::InvalidOidcConfig(
-                "scope_separator must be exactly one character".to_string(),
-            )
-        })?;
-        let fetch_url_policy = if oidc.allow_insecure_localhost {
-            FetchUrlPolicy::dev()
-        } else {
-            FetchUrlPolicy::strict()
-        };
-        let fetcher = Arc::new(JwksFetcher::new_with_fetch_url_policy(
-            oidc.jwks_url.clone(),
-            JwksFetcherConfig::defaults(),
-            fetch_url_policy.clone(),
-        ));
-        let userinfo_requires_exp = !(config.subject_access.enabled
-            && config.subject_access.subject_binding.claim_source
-                == SubjectAccessClaimSource::Userinfo);
-        let verifier = TokenVerifier::new(
-            TokenVerifierConfig::registry_notary_access_profile(
-                oidc.issuer.clone(),
-                oidc.audiences.clone(),
-                allowed_algorithms,
-                oidc.allowed_token_types.clone(),
-            )
-            .with_scope_claim(oidc.scope_claim.clone())
-            .with_scope_separator(scope_separator)
-            .with_scope_map(
-                Some(
-                    oidc.scope_map
-                        .iter()
-                        .map(|(from, to)| (from.clone(), to.clone()))
-                        .collect::<HashMap<_, _>>(),
-                )
-                .filter(|scope_map| !scope_map.is_empty()),
-            )
-            .with_allowed_clients(oidc.allowed_clients.clone())
-            .with_leeway(oidc.leeway)
-            .with_userinfo_requires_exp(userinfo_requires_exp),
-            fetcher,
-        );
-        let userinfo_issuers = if oidc.userinfo_issuers.is_empty() {
-            vec![oidc.issuer.clone()]
-        } else {
-            oidc.userinfo_issuers.clone()
-        };
-        let subject_binding_claim = config
-            .subject_access
-            .enabled
-            .then(|| config.subject_access.subject_binding.token_claim.clone())
-            .filter(|claim| !claim.is_empty());
-        let (citizen_client_ids, citizen_audiences) = if config.subject_access.enabled {
-            (
-                config
-                    .subject_access
-                    .citizen_clients
-                    .allowed_client_ids
-                    .clone(),
-                config
-                    .subject_access
-                    .citizen_clients
-                    .allowed_audiences
-                    .clone(),
-            )
-        } else {
-            (Vec::new(), Vec::new())
-        };
-        let notary_anchor = Authenticator::build_notary_anchor(
-            config,
-            oidc.principal_claim.clone(),
-            subject_binding_claim.clone(),
-        )?;
-        Ok(Self {
-            verifier: Arc::new(verifier),
-            fetch_url_policy,
-            principal_claim: oidc.principal_claim.clone(),
-            subject_binding_claim,
-            subject_binding_claim_source: config.subject_access.subject_binding.claim_source,
-            assurance_claim_source: config.subject_access.token_policy.assurance_claim_source,
-            userinfo_endpoint: oidc.userinfo_endpoint.clone(),
-            userinfo_issuers,
-            citizen_client_ids,
-            citizen_audiences,
-            notary_anchor,
-        })
-    }
-
-    async fn authenticate(
-        &self,
-        credentials: &RequestCredentials,
-        replay: &ReplayStores,
-    ) -> Result<EvidencePrincipal, EvidenceError> {
-        // Route by the unverified issuer only to select a verifier. The chosen
-        // verifier still validates signature, algorithm, type, issuer,
-        // audience, and lifetime, and failure never falls back to another
-        // bearer-token verifier.
-        if let Some(anchor) = &self.notary_anchor {
-            if let Some(token) = credentials.bearer_token.as_deref() {
-                let anchor = anchor
-                    .read()
-                    .map_err(|_| EvidenceError::MissingCredential)?
-                    .clone();
-                if unverified_issuer(token).as_deref() == Some(anchor.issuer.as_str()) {
-                    return authenticate_notary_token(token, &anchor, replay).await;
-                }
-            }
-        }
-        authenticate_oidc(
-            credentials,
-            &self.verifier,
-            &self.fetch_url_policy,
-            &self.principal_claim,
-            self.subject_binding_claim.as_deref(),
-            self.subject_binding_claim_source,
-            self.assurance_claim_source,
-            self.userinfo_endpoint.as_deref(),
-            &self.userinfo_issuers,
-            &self.citizen_client_ids,
-            &self.citizen_audiences,
-        )
-        .await
-    }
-}
diff --git a/crates/registry-notary-server/src/standalone/auth/notary_tokens.rs b/crates/registry-notary-server/src/standalone/auth/notary_tokens.rs
deleted file mode 100644
index d58758df1..000000000
--- a/crates/registry-notary-server/src/standalone/auth/notary_tokens.rs
+++ /dev/null
@@ -1,145 +0,0 @@
-use super::*;
-
-/// The Notary's own self-issuance trust anchor: its access-token public key,
-/// pinned issuer, header `typ`, and accepted audiences. Verification is fully
-/// in-process (no self-HTTP-call to a JWKS endpoint).
-#[derive(Clone)]
-pub(crate) struct NotaryTokenAnchor {
-    pub(in super::super) verification_keys: Vec<AccessTokenVerificationKey>,
-    pub(in super::super) issuer: String,
-    pub(in super::super) token_typ: String,
-    pub(in super::super) audiences: Vec<String>,
-    pub(in super::super) principal_claim: String,
-    pub(in super::super) subject_binding_claim: Option<String>,
-}
-
-impl std::fmt::Debug for NotaryTokenAnchor {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("NotaryTokenAnchor")
-            .field("issuer", &self.issuer)
-            .field("token_typ", &self.token_typ)
-            .field("audiences", &self.audiences)
-            .finish_non_exhaustive()
-    }
-}
-
-pub(in super::super) fn unverified_issuer(token: &str) -> Option<String> {
-    let payload_b64 = token.split('.').nth(1)?;
-    let bytes = BASE64_URL_SAFE_NO_PAD.decode(payload_b64).ok()?;
-    let payload: Value = serde_json::from_slice(&bytes).ok()?;
-    payload
-        .get("iss")
-        .and_then(Value::as_str)
-        .map(ToString::to_string)
-}
-
-/// Verify a Notary-issued access token against the separate, separately-keyed
-/// Notary anchor and map it to an `EvidencePrincipal` via `principal_from_oidc`,
-/// identically to an eSignet token.
-///
-/// Verification pins alg (EdDSA), the access-token `typ`, the Notary `iss`, the
-/// configured audiences, the signature against the dedicated access-token key,
-/// and `exp`/`nbf`. Every failure collapses to `EvidenceError::MissingCredential`,
-/// matching `oidc_auth_error` (no info leak).
-pub(in super::super) async fn authenticate_notary_token(
-    token: &str,
-    anchor: &NotaryTokenAnchor,
-    replay: &ReplayStores,
-) -> Result<EvidencePrincipal, EvidenceError> {
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let verified_notary = anchor
-        .verification_keys
-        .iter()
-        .filter(|key| key.may_verify_at(now))
-        .find_map(|key| {
-            registry_notary_core::tokens::verify_notary_token(
-                token,
-                key.public_jwk(),
-                &anchor.token_typ,
-                &anchor.issuer,
-                &anchor.audiences,
-                now,
-            )
-            .ok()
-        })
-        .ok_or(EvidenceError::MissingCredential)?;
-    consume_notary_token_jti(&verified_notary.payload, anchor, replay).await?;
-    let verified = verified_token_from_notary_payload(&verified_notary.payload)
-        .ok_or(EvidenceError::MissingCredential)?;
-    // Notary tokens carry the assurance and subject-binding claims in the access
-    // token itself, so both claim sources are AccessToken. This mirrors what an
-    // eSignet access token would provide and reuses the consumption path
-    // unchanged.
-    principal_from_oidc(
-        &verified,
-        EvidenceAuthProfileId::NotaryAccessToken,
-        None,
-        None,
-        verified_claim_value(&anchor.token_typ),
-        &anchor.principal_claim,
-        anchor.subject_binding_claim.as_deref(),
-        SubjectAccessClaimSource::AccessToken,
-        SubjectAccessAssuranceClaimSource::AccessToken,
-    )
-}
-
-pub(in super::super) async fn consume_notary_token_jti(
-    payload: &Value,
-    anchor: &NotaryTokenAnchor,
-    replay: &ReplayStores,
-) -> Result<(), EvidenceError> {
-    let Some(jti) = payload.get("jti").and_then(Value::as_str) else {
-        // Single-use tokens carry replay protection via `jti`. The transaction
-        // token typ is required to be single-use, so a missing `jti` for that
-        // typ must fail closed rather than silently skip replay protection.
-        // Other typs are not single-use and legitimately have no `jti`.
-        if anchor.token_typ == registry_notary_core::tokens::NOTARY_TRANSACTION_TOKEN_JWT_TYP {
-            return Err(EvidenceError::MissingCredential);
-        }
-        return Ok(());
-    };
-    if jti.trim().is_empty() {
-        return Err(EvidenceError::MissingCredential);
-    }
-    let exp = payload
-        .get("exp")
-        .and_then(Value::as_i64)
-        .ok_or(EvidenceError::MissingCredential)?;
-    let expires_at =
-        OffsetDateTime::from_unix_timestamp(exp).map_err(|_| EvidenceError::MissingCredential)?;
-    let scope = ReplayScope::new([
-        ("protocol", "registry-notary"),
-        ("flow", "notary-token-jti"),
-        ("issuer", anchor.issuer.as_str()),
-        ("typ", anchor.token_typ.as_str()),
-    ])
-    .map_err(|_| EvidenceError::MissingCredential)?;
-    let key = ReplayKey::new(jti).map_err(|_| EvidenceError::MissingCredential)?;
-    require_replay_insert(replay.store().as_ref(), &scope, &key, expires_at)
-        .await
-        .map_err(|_| EvidenceError::MissingCredential)
-}
-
-/// Adapt a verified Notary token payload into the platform `VerifiedToken` the
-/// `principal_from_oidc` mapping consumes.
-pub(in super::super) fn verified_token_from_notary_payload(
-    payload: &Value,
-) -> Option<registry_platform_oidc::VerifiedToken> {
-    let claims: registry_platform_oidc::Claims = serde_json::from_value(payload.clone()).ok()?;
-    let scopes = payload
-        .get("scope")
-        .and_then(Value::as_str)
-        .map(|scope| {
-            scope
-                .split(' ')
-                .filter(|s| !s.is_empty())
-                .map(ToString::to_string)
-                .collect()
-        })
-        .unwrap_or_default();
-    Some(registry_platform_oidc::VerifiedToken {
-        claims,
-        matched_client: None,
-        scopes,
-    })
-}
diff --git a/crates/registry-notary-server/src/standalone/auth/oidc.rs b/crates/registry-notary-server/src/standalone/auth/oidc.rs
deleted file mode 100644
index 709f6a033..000000000
--- a/crates/registry-notary-server/src/standalone/auth/oidc.rs
+++ /dev/null
@@ -1,435 +0,0 @@
-use super::*;
-
-#[allow(clippy::too_many_arguments)]
-pub(in super::super) async fn authenticate_oidc(
-    credentials: &RequestCredentials,
-    verifier: &TokenVerifier,
-    fetch_url_policy: &FetchUrlPolicy,
-    principal_claim: &str,
-    subject_binding_claim: Option<&str>,
-    subject_binding_claim_source: SubjectAccessClaimSource,
-    assurance_claim_source: SubjectAccessAssuranceClaimSource,
-    userinfo_endpoint: Option<&str>,
-    userinfo_issuers: &[String],
-    citizen_client_ids: &[String],
-    citizen_audiences: &[String],
-) -> Result<EvidencePrincipal, EvidenceError> {
-    let Some(token) = credentials.bearer_token.as_deref() else {
-        return Err(EvidenceError::MissingCredential);
-    };
-    let verified = verifier.verify(token).await.map_err(oidc_auth_error)?;
-    if !oidc_citizen_candidate(&verified, citizen_client_ids, citizen_audiences) {
-        return principal_from_machine_oidc(
-            &verified,
-            EvidenceAuthProfileId::ExternalOidc,
-            token_type_from_compact_jwt(token),
-            principal_claim,
-        );
-    }
-    let verified_userinfo = match (subject_binding_claim, subject_binding_claim_source) {
-        (Some(_), SubjectAccessClaimSource::Userinfo) => {
-            let endpoint = userinfo_endpoint.ok_or(EvidenceError::MissingCredential)?;
-            let userinfo_jwt = fetch_userinfo_jwt_with_policy(
-                endpoint,
-                token,
-                fetch_url_policy,
-                Duration::from_secs(5),
-                64 * 1024,
-            )
-            .await
-            .map_err(oidc_auth_error)?;
-            let accepted_issuers = userinfo_issuers
-                .iter()
-                .map(String::as_str)
-                .collect::<Vec<_>>();
-            let accepted_audiences = verified
-                .matched_client
-                .as_ref()
-                .and_then(|matched| matched.split_once(':'))
-                .map(|(_, client)| vec![client.to_string()])
-                .unwrap_or_default();
-            Some(
-                verifier
-                    .verify_userinfo_jwt_with_claims_policy(
-                        &userinfo_jwt,
-                        &verified,
-                        &accepted_issuers,
-                        &accepted_audiences,
-                    )
-                    .await
-                    .map_err(oidc_auth_error)?,
-            )
-        }
-        _ => None,
-    };
-    let verified_id_token = match assurance_claim_source {
-        SubjectAccessAssuranceClaimSource::AccessToken => None,
-        SubjectAccessAssuranceClaimSource::IdToken => {
-            let Some(id_token) = credentials.id_token.as_deref() else {
-                return Err(EvidenceError::MissingCredential);
-            };
-            let id_token = verifier
-                .verify_related_token(id_token)
-                .await
-                .map_err(oidc_auth_error)?;
-            if id_token.claims.sub != verified.claims.sub {
-                return Err(EvidenceError::MissingCredential);
-            }
-            Some(id_token)
-        }
-    };
-    principal_from_oidc(
-        &verified,
-        EvidenceAuthProfileId::ExternalOidc,
-        verified_userinfo.as_ref(),
-        verified_id_token.as_ref(),
-        token_type_from_compact_jwt(token),
-        principal_claim,
-        subject_binding_claim,
-        subject_binding_claim_source,
-        assurance_claim_source,
-    )
-}
-
-fn token_type_from_compact_jwt(token: &str) -> Option<VerifiedClaimValue> {
-    jsonwebtoken::decode_header(token)
-        .ok()
-        .and_then(|header| header.typ)
-        .and_then(|typ| verified_claim_value(&typ))
-}
-
-pub(in super::super) fn oidc_citizen_candidate(
-    verified: &VerifiedToken,
-    citizen_client_ids: &[String],
-    citizen_audiences: &[String],
-) -> bool {
-    let client_matches = [
-        verified.claims.azp.as_deref(),
-        verified.claims.client_id.as_deref(),
-    ]
-    .into_iter()
-    .flatten()
-    .any(|candidate| {
-        citizen_client_ids
-            .iter()
-            .any(|allowed| candidate == allowed)
-    });
-    let audience_matches = match verified.claims.aud.as_ref() {
-        Some(Audience::One(audience)) => citizen_audiences.contains(audience),
-        Some(Audience::Many(audiences)) => audiences
-            .iter()
-            .any(|audience| citizen_audiences.contains(audience)),
-        None => false,
-    };
-    client_matches || audience_matches
-}
-
-/// Read the `iss` claim from a JWT WITHOUT verifying the signature. Used only to
-/// ROUTE to the correct verifier; the value is never trusted before the chosen
-/// anchor fully verifies the token (signature, alg, typ, iss, aud, exp/nbf).
-#[allow(clippy::too_many_arguments)]
-pub(in super::super) fn principal_from_oidc(
-    verified: &VerifiedToken,
-    auth_profile_id: EvidenceAuthProfileId,
-    userinfo: Option<&registry_platform_oidc::Claims>,
-    id_token: Option<&VerifiedToken>,
-    token_type: Option<VerifiedClaimValue>,
-    principal_claim: &str,
-    subject_binding_claim: Option<&str>,
-    subject_binding_claim_source: SubjectAccessClaimSource,
-    assurance_claim_source: SubjectAccessAssuranceClaimSource,
-) -> Result<EvidencePrincipal, EvidenceError> {
-    principal_from_oidc_inner(
-        verified,
-        auth_profile_id,
-        userinfo,
-        id_token,
-        token_type,
-        principal_claim,
-        subject_binding_claim,
-        subject_binding_claim_source,
-        Some(assurance_claim_source),
-    )
-}
-
-pub(in super::super) fn principal_from_machine_oidc(
-    verified: &VerifiedToken,
-    auth_profile_id: EvidenceAuthProfileId,
-    token_type: Option<VerifiedClaimValue>,
-    principal_claim: &str,
-) -> Result<EvidencePrincipal, EvidenceError> {
-    principal_from_oidc_inner(
-        verified,
-        auth_profile_id,
-        None,
-        None,
-        token_type,
-        principal_claim,
-        None,
-        SubjectAccessClaimSource::AccessToken,
-        None,
-    )
-}
-
-#[allow(clippy::too_many_arguments)]
-fn principal_from_oidc_inner(
-    verified: &VerifiedToken,
-    auth_profile_id: EvidenceAuthProfileId,
-    userinfo: Option<&registry_platform_oidc::Claims>,
-    id_token: Option<&VerifiedToken>,
-    token_type: Option<VerifiedClaimValue>,
-    principal_claim: &str,
-    subject_binding_claim: Option<&str>,
-    subject_binding_claim_source: SubjectAccessClaimSource,
-    assurance_claim_source: Option<SubjectAccessAssuranceClaimSource>,
-) -> Result<EvidencePrincipal, EvidenceError> {
-    let principal_id = if principal_claim == "sub" {
-        verified.claims.sub.clone()
-    } else {
-        verified
-            .claims
-            .extra
-            .get(principal_claim)
-            .and_then(Value::as_str)
-            .map(ToOwned::to_owned)
-    }
-    .ok_or(EvidenceError::MissingCredential)?;
-    let authorization_details = authorization_details_from_oidc(verified)?;
-    Ok(EvidencePrincipal {
-        auth_profile_id,
-        principal_id,
-        scopes: verified.scopes.clone(),
-        access_mode: AccessMode::MachineClient,
-        verified_claims: bounded_verified_claims_from_oidc_inner(
-            verified,
-            userinfo,
-            id_token,
-            token_type,
-            subject_binding_claim,
-            subject_binding_claim_source,
-            assurance_claim_source,
-        ),
-        authorization_details,
-    })
-}
-
-pub(in super::super) fn authorization_details_from_oidc(
-    verified: &VerifiedToken,
-) -> Result<Option<EvidenceAuthorizationDetails>, EvidenceError> {
-    let Some(details) = verified.claims.extra.get("authorization_details") else {
-        return Ok(None);
-    };
-    let details = crate::authz_details::extract_notary_transaction_authorization_details(details)?;
-    Ok(details.filter(crate::authz_details::has_transaction_scope))
-}
-
-#[cfg(test)]
-pub(in super::super) fn bounded_verified_claims_from_oidc(
-    verified: &VerifiedToken,
-    userinfo: Option<&registry_platform_oidc::Claims>,
-    id_token: Option<&VerifiedToken>,
-    token_type: Option<VerifiedClaimValue>,
-    subject_binding_claim: Option<&str>,
-    subject_binding_claim_source: SubjectAccessClaimSource,
-    assurance_claim_source: SubjectAccessAssuranceClaimSource,
-) -> Option<BoundedVerifiedClaims> {
-    bounded_verified_claims_from_oidc_inner(
-        verified,
-        userinfo,
-        id_token,
-        token_type,
-        subject_binding_claim,
-        subject_binding_claim_source,
-        Some(assurance_claim_source),
-    )
-}
-
-#[allow(clippy::too_many_arguments)]
-fn bounded_verified_claims_from_oidc_inner(
-    verified: &VerifiedToken,
-    userinfo: Option<&registry_platform_oidc::Claims>,
-    id_token: Option<&VerifiedToken>,
-    token_type: Option<VerifiedClaimValue>,
-    subject_binding_claim: Option<&str>,
-    subject_binding_claim_source: SubjectAccessClaimSource,
-    assurance_claim_source: Option<SubjectAccessAssuranceClaimSource>,
-) -> Option<BoundedVerifiedClaims> {
-    let issuer = verified
-        .claims
-        .iss
-        .as_deref()
-        .and_then(verified_claim_value)?;
-    let (subject_binding_claim, subject_binding_value) = if let Some(subject_binding_claim) =
-        subject_binding_claim
-    {
-        let claim_name = VerifiedClaimName::new(subject_binding_claim).ok()?;
-        let claim_value = match subject_binding_claim_source {
-            SubjectAccessClaimSource::AccessToken => claim_string(verified, claim_name.as_str()),
-            SubjectAccessClaimSource::Userinfo => {
-                userinfo.and_then(|claims| claim_string_from_claims(claims, claim_name.as_str()))
-            }
-        }
-        .and_then(verified_claim_value)?;
-        (Some(claim_name), Some(claim_value))
-    } else {
-        (None, None)
-    };
-    let assurance_claims = match assurance_claim_source {
-        Some(SubjectAccessAssuranceClaimSource::AccessToken) => Some(&verified.claims),
-        Some(SubjectAccessAssuranceClaimSource::IdToken) => Some(&id_token?.claims),
-        None => None,
-    };
-    Some(BoundedVerifiedClaims {
-        issuer,
-        audiences: bounded_audience(verified.claims.aud.as_ref()),
-        client_id: verified_client(verified),
-        token_type,
-        credential_configuration_id: verified
-            .claims
-            .extra
-            .get("credential_configuration_id")
-            .and_then(Value::as_str)
-            .and_then(verified_claim_value),
-        issuance_transaction_id: verified
-            .claims
-            .extra
-            .get("issuance_transaction_id")
-            .and_then(Value::as_str)
-            .and_then(verified_claim_value),
-        issuance_transaction_commitment: verified
-            .claims
-            .extra
-            .get("issuance_transaction_commitment")
-            .and_then(Value::as_str)
-            .and_then(verified_claim_value),
-        scopes: bounded_scopes(&verified.scopes),
-        subject: verified
-            .claims
-            .sub
-            .as_deref()
-            .and_then(verified_claim_value),
-        subject_binding_claim,
-        subject_binding_value,
-        acr: assurance_claims
-            .and_then(|claims| claims.extra.get("acr"))
-            .and_then(Value::as_str)
-            .and_then(verified_claim_value),
-        auth_time: assurance_claims.and_then(|claims| numeric_claim(&claims.extra, "auth_time")),
-        exp: verified.claims.exp,
-        iat: verified.claims.iat,
-        nbf: verified.claims.nbf,
-    })
-}
-
-pub(in super::super) fn claim_string<'a>(
-    verified: &'a VerifiedToken,
-    claim: &str,
-) -> Option<&'a str> {
-    if claim == "sub" {
-        return verified.claims.sub.as_deref();
-    }
-    claim_string_from_claims(&verified.claims, claim)
-}
-
-pub(in super::super) fn claim_string_from_claims<'a>(
-    claims: &'a registry_platform_oidc::Claims,
-    claim: &str,
-) -> Option<&'a str> {
-    if claim == "sub" {
-        return claims.sub.as_deref();
-    }
-    claims.extra.get(claim).and_then(Value::as_str)
-}
-
-pub(in super::super) fn verified_claim_value(value: &str) -> Option<VerifiedClaimValue> {
-    VerifiedClaimValue::new(value).ok()
-}
-
-pub(in super::super) fn bounded_audience(audience: Option<&Audience>) -> Vec<VerifiedClaimValue> {
-    let values: Vec<&str> = match audience {
-        Some(Audience::One(value)) => vec![value.as_str()],
-        Some(Audience::Many(values)) => values.iter().map(String::as_str).collect(),
-        None => Vec::new(),
-    };
-    values
-        .into_iter()
-        .filter_map(verified_claim_value)
-        .collect()
-}
-
-pub(in super::super) fn verified_client(verified: &VerifiedToken) -> Option<VerifiedClaimValue> {
-    let client = verified
-        .claims
-        .azp
-        .as_deref()
-        .map(|azp| format!("azp:{azp}"))
-        .or_else(|| {
-            verified
-                .claims
-                .client_id
-                .as_deref()
-                .map(|client_id| format!("client_id:{client_id}"))
-        })
-        .or_else(|| verified.matched_client.clone())?;
-    verified_claim_value(&client)
-}
-
-pub(in super::super) fn bounded_scopes(scopes: &[String]) -> Vec<VerifiedClaimValue> {
-    scopes
-        .iter()
-        .filter_map(|scope| verified_claim_value(scope))
-        .collect()
-}
-
-pub(in super::super) fn numeric_claim(extra: &Map<String, Value>, claim: &str) -> Option<i64> {
-    extra.get(claim).and_then(Value::as_i64)
-}
-
-pub(in super::super) fn oidc_auth_error(error: OidcError) -> EvidenceError {
-    tracing::debug!(
-        target: "registry_notary_server::auth",
-        error_code = oidc_internal_error_code(&error),
-        error = ?error,
-        "OIDC token verification failed"
-    );
-    EvidenceError::MissingCredential
-}
-
-pub(in super::super) fn oidc_internal_error_code(error: &OidcError) -> &'static str {
-    match error {
-        OidcError::Transport(_)
-        | OidcError::BoundedRead(_)
-        | OidcError::FetchUrl(_)
-        | OidcError::HttpStatus(_)
-        | OidcError::InvalidUrl
-        | OidcError::Parse
-        | OidcError::InvalidJwk => "auth.oidc_unavailable",
-        OidcError::IssuerMismatch { .. }
-        | OidcError::MalformedToken
-        | OidcError::AlgorithmNotAllowed
-        | OidcError::TokenTypeNotAllowed
-        | OidcError::MissingKid
-        | OidcError::KidTooLong
-        | OidcError::UnknownKid
-        | OidcError::TokenExpired
-        | OidcError::TokenNotYetValid
-        | OidcError::AudienceMismatch
-        | OidcError::SignatureInvalid
-        | OidcError::InvalidToken
-        | OidcError::ClientNotAllowed => "auth.invalid_token",
-        _ => "auth.invalid_token",
-    }
-}
-
-pub(in super::super) fn parse_oidc_algorithm(
-    algorithm: &str,
-) -> Result<Algorithm, StandaloneServerError> {
-    match algorithm {
-        "EdDSA" => Ok(Algorithm::EdDSA),
-        "RS256" => Ok(Algorithm::RS256),
-        "PS256" => Ok(Algorithm::PS256),
-        other => Err(StandaloneServerError::InvalidOidcConfig(format!(
-            "unsupported OIDC signing algorithm '{other}'"
-        ))),
-    }
-}
diff --git a/crates/registry-notary-server/src/standalone/compat.rs b/crates/registry-notary-server/src/standalone/compat.rs
deleted file mode 100644
index 5602d42e3..000000000
--- a/crates/registry-notary-server/src/standalone/compat.rs
+++ /dev/null
@@ -1,5 +0,0 @@
-//! Compatibility exports backed by the neutral request-context module.
-
-pub(crate) use crate::request_context::{
-    current_request_correlation_id, new_request_correlation_id, with_request_correlation_id,
-};
diff --git a/crates/registry-notary-server/src/standalone/cors.rs b/crates/registry-notary-server/src/standalone/cors.rs
deleted file mode 100644
index b8445f19a..000000000
--- a/crates/registry-notary-server/src/standalone/cors.rs
+++ /dev/null
@@ -1,135 +0,0 @@
-use super::*;
-
-#[derive(Debug, Clone)]
-pub(super) struct SubjectAccessWalletCorsPolicy {
-    enabled: bool,
-    allowed_origins: Vec<String>,
-    allow_credentials: bool,
-}
-
-impl SubjectAccessWalletCorsPolicy {
-    pub(super) fn from_config(config: &StandaloneRegistryNotaryConfig) -> Self {
-        Self {
-            enabled: config.subject_access.enabled,
-            allowed_origins: config.subject_access.allowed_wallet_origins.clone(),
-            allow_credentials: false,
-        }
-    }
-
-    fn allows_origin(&self, origin: &str) -> bool {
-        self.allowed_origins
-            .iter()
-            .any(|allowed| allowed.as_str() == origin)
-    }
-}
-
-pub(super) async fn subject_access_wallet_cors_middleware(
-    State(policy): State<SubjectAccessWalletCorsPolicy>,
-    request: Request,
-    next: Next,
-) -> Response {
-    if !policy.enabled || !is_subject_access_wallet_cors_path(request.uri().path()) {
-        return next.run(request).await;
-    }
-
-    let origin = request.headers().get(header::ORIGIN).cloned();
-    let Some(origin) = origin else {
-        return next.run(request).await;
-    };
-    let origin_allowed = origin
-        .to_str()
-        .is_ok_and(|origin| policy.allows_origin(origin));
-    let requested_headers = request
-        .headers()
-        .get(header::ACCESS_CONTROL_REQUEST_HEADERS)
-        .cloned();
-    let is_preflight = request.method() == Method::OPTIONS
-        && request
-            .headers()
-            .contains_key(header::ACCESS_CONTROL_REQUEST_METHOD);
-
-    if is_preflight {
-        let mut response = StatusCode::NO_CONTENT.into_response();
-        if origin_allowed {
-            apply_subject_access_wallet_cors_headers(
-                response.headers_mut(),
-                origin,
-                requested_headers.as_ref(),
-                policy.allow_credentials,
-            );
-        }
-        return response;
-    }
-
-    let mut response = next.run(request).await;
-    if origin_allowed {
-        apply_subject_access_wallet_cors_headers(
-            response.headers_mut(),
-            origin,
-            requested_headers.as_ref(),
-            policy.allow_credentials,
-        );
-    } else {
-        remove_access_control_headers(response.headers_mut());
-    }
-    response
-}
-
-pub(super) fn is_subject_access_wallet_cors_path(path: &str) -> bool {
-    matches!(
-        path,
-        "/.well-known/evidence-service"
-            | "/.well-known/evidence/jwks.json"
-            | "/.well-known/openid-credential-issuer"
-            | "/oid4vci/credential"
-            | "/v1/formats"
-            | "/v1/evaluations"
-            | "/v1/batch-evaluations"
-            | "/v1/credentials"
-    ) || path == "/v1/claims"
-        || path.starts_with("/v1/claims/")
-        || path == "/credentials/{*vct_path}"
-        || path.starts_with("/credentials/")
-        || path.starts_with("/.well-known/vct/")
-        || path.starts_with("/v1/evaluations/")
-        || path.starts_with("/v1/credentials/")
-}
-
-fn apply_subject_access_wallet_cors_headers(
-    headers: &mut HeaderMap,
-    origin: HeaderValue,
-    requested_headers: Option<&HeaderValue>,
-    allow_credentials: bool,
-) {
-    remove_access_control_headers(headers);
-    headers.insert(header::ACCESS_CONTROL_ALLOW_ORIGIN, origin);
-    headers.insert(
-        header::ACCESS_CONTROL_ALLOW_METHODS,
-        HeaderValue::from_static(SUBJECT_ACCESS_CORS_METHODS),
-    );
-    headers.insert(
-        header::ACCESS_CONTROL_ALLOW_HEADERS,
-        requested_headers
-            .cloned()
-            .unwrap_or_else(|| HeaderValue::from_static(SUBJECT_ACCESS_CORS_DEFAULT_HEADERS)),
-    );
-    if allow_credentials {
-        headers.insert(
-            header::ACCESS_CONTROL_ALLOW_CREDENTIALS,
-            HeaderValue::from_static("true"),
-        );
-    }
-    headers.insert(
-        header::VARY,
-        HeaderValue::from_static(
-            "origin, access-control-request-method, access-control-request-headers",
-        ),
-    );
-}
-
-fn remove_access_control_headers(headers: &mut HeaderMap) {
-    headers.remove(header::ACCESS_CONTROL_ALLOW_ORIGIN);
-    headers.remove(header::ACCESS_CONTROL_ALLOW_METHODS);
-    headers.remove(header::ACCESS_CONTROL_ALLOW_HEADERS);
-    headers.remove(header::ACCESS_CONTROL_ALLOW_CREDENTIALS);
-}
diff --git a/crates/registry-notary-server/src/standalone/deployment.rs b/crates/registry-notary-server/src/standalone/deployment.rs
deleted file mode 100644
index 6b9a9a808..000000000
--- a/crates/registry-notary-server/src/standalone/deployment.rs
+++ /dev/null
@@ -1,143 +0,0 @@
-use super::*;
-
-/// Deployment gate evaluation result carried through runtime assembly.
-///
-/// `startup_fail` gates abort assembly. The startup config source is retained so
-/// readiness and posture can safely re-evaluate time-varying facts without
-/// weakening signed-config provenance.
-#[derive(Debug, Clone)]
-pub(crate) struct DeploymentGateState {
-    config_source: ConfigSource,
-    pub(crate) profile: Option<&'static str>,
-    pub(crate) startup_failures: Vec<String>,
-    pub(crate) readiness_failures: Vec<String>,
-    pub(crate) findings: Vec<EvaluatedFinding>,
-    pub(crate) active_waivers: Vec<EvaluatedWaiver>,
-}
-
-impl Default for DeploymentGateState {
-    fn default() -> Self {
-        Self {
-            config_source: ConfigSource::Unknown,
-            profile: None,
-            startup_failures: Vec::new(),
-            readiness_failures: Vec::new(),
-            findings: Vec::new(),
-            active_waivers: Vec::new(),
-        }
-    }
-}
-
-impl DeploymentGateState {
-    pub(crate) fn evaluate_with_config_source(
-        config: &StandaloneRegistryNotaryConfig,
-        config_source: ConfigSource,
-    ) -> Self {
-        // Startup evaluates the configured observation capability only. Live
-        // cursor I/O is bounded and performed by readiness/posture handlers.
-        let observation = AckObservation::unverified();
-        Self::evaluate_with_observation(config, config_source, &observation)
-    }
-
-    pub(crate) fn evaluate_current(
-        &self,
-        config: &StandaloneRegistryNotaryConfig,
-        observation: &AckObservation,
-    ) -> Self {
-        Self::evaluate_with_observation(config, self.config_source, observation)
-    }
-
-    fn evaluate_with_observation(
-        config: &StandaloneRegistryNotaryConfig,
-        config_source: ConfigSource,
-        observation: &AckObservation,
-    ) -> Self {
-        let mut input = config.gate_input_with_ack_observation(observation);
-        input.config_unsigned = !matches!(
-            config_source,
-            ConfigSource::SignedBundleFile | ConfigSource::SignedBundleEndpoint
-        );
-        let evaluation = evaluate_gates(
-            config.deployment.profile,
-            &input,
-            &config.deployment.waivers,
-            &today_utc_date(),
-        );
-        let GateEvaluation {
-            startup_failures,
-            readiness_failures,
-            findings,
-            active_waivers,
-        } = evaluation;
-        Self {
-            config_source,
-            profile: config.deployment.profile.map(|profile| profile.as_str()),
-            startup_failures,
-            readiness_failures,
-            findings,
-            active_waivers,
-        }
-    }
-
-    pub(super) fn fail_startup_if_blocked(&self) -> Result<(), StandaloneServerError> {
-        if self.startup_failures.is_empty() {
-            return Ok(());
-        }
-        Err(StandaloneServerError::DeploymentGateStartupFailure {
-            profile: self.profile.unwrap_or("undeclared").to_string(),
-            findings: self.startup_failures.join(", "),
-        })
-    }
-
-    /// Emit one boot warning for every active or expired waiver. Metadata has
-    /// already passed the shared operations validator, so logs expose only the
-    /// required reference, optional summary, and expiry.
-    pub(super) fn log_boot_waivers(&self) {
-        for finding in &self.findings {
-            let Some(waiver) = &finding.waiver else {
-                continue;
-            };
-            if finding.status == DeploymentFindingStatus::Waived {
-                tracing::warn!(
-                    code = "deployment.gate_waived",
-                    finding = %finding.id,
-                    reference = %waiver.reference,
-                    summary = ?waiver.summary,
-                    expires = %waiver.expires,
-                    "deployment gate finding is suppressed by an active waiver"
-                );
-            } else if finding.id == FINDING_WAIVER_EXPIRED {
-                tracing::warn!(
-                    code = "deployment.waiver_expired",
-                    finding = %waiver.finding,
-                    reference = %waiver.reference,
-                    summary = ?waiver.summary,
-                    expires = %waiver.expires,
-                    "deployment waiver is expired; its gate binds again"
-                );
-            }
-        }
-    }
-
-    /// True when a profile is declared, so its gates participate in readiness.
-    /// Runtime compilation refuses undeclared profiles before readiness is served.
-    pub(crate) fn is_bound(&self) -> bool {
-        self.profile.is_some()
-    }
-
-    /// True when at least one bound gate reports a readiness failure.
-    pub(crate) fn has_readiness_failure(&self) -> bool {
-        !self.readiness_failures.is_empty()
-    }
-}
-
-/// Today's date in UTC as a `YYYY-MM-DD` string, for waiver-expiry comparison.
-fn today_utc_date() -> String {
-    let now = OffsetDateTime::now_utc().date();
-    format!(
-        "{:04}-{:02}-{:02}",
-        now.year(),
-        u8::from(now.month()),
-        now.day()
-    )
-}
diff --git a/crates/registry-notary-server/src/standalone/offline_fixture.rs b/crates/registry-notary-server/src/standalone/offline_fixture.rs
deleted file mode 100644
index 49ccec21e..000000000
--- a/crates/registry-notary-server/src/standalone/offline_fixture.rs
+++ /dev/null
@@ -1,721 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Product-owned Notary evidence path for environment-free authoring fixtures.
-
-use std::collections::{BTreeMap, BTreeSet};
-use std::sync::{Arc, Mutex};
-
-use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-use base64::Engine as _;
-use registry_notary_core::{
-    ClaimEvidenceMode, ClaimRef, ClaimResultView, EvaluateRequest, EvidenceConfig,
-    EvidenceConfigError, EvidenceError, RelayOutputContract, StandaloneRegistryNotaryConfig,
-};
-use registry_platform_audit::AuditKeyHasher;
-use registry_platform_authcommon::fingerprint_api_key;
-use serde_json::Value;
-use time::OffsetDateTime;
-use zeroize::Zeroizing;
-
-use crate::cel_worker::{CelWorker, CelWorkerConfig, CelWorkerError};
-use crate::relay_client::RelayClientError;
-use crate::runtime::consultation::{
-    ActivatedRelayConsultations, ConsultationGroupKeyV1, RuntimeRelayConsultationResult,
-    RuntimeRelayMatchData, RuntimeRelayOutcome, RuntimeRelayOutputMap,
-};
-use crate::runtime::validate_cel_claims_for_startup;
-use crate::{EvidenceStore, RegistryNotaryRuntime};
-
-use super::{authenticate_api_key, RequestCredentials, ResolvedCredential};
-
-/// Closed authentication states accepted by the offline authoring harness.
-///
-/// Fixture-authored caller names, tokens, and scope strings never enter this
-/// boundary. `Valid` receives the exact scope closure derived from the
-/// production Notary config. Negative cases use fixed internal credentials.
-#[doc(hidden)]
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum OfflineAuthentication {
-    Valid,
-    Missing,
-    WrongCredential,
-    InsufficientScope,
-}
-
-/// Closed Relay outcomes accepted after Relay's product-owned offline decoder
-/// has validated the response bytes.
-#[doc(hidden)]
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum OfflineRelayOutcome {
-    Match,
-    NoMatch,
-    Ambiguous,
-}
-
-/// One exact, decoder-validated Relay result for an offline authoring run.
-///
-/// This is not a runtime output injection interface. It is accepted only by the
-/// environment-free harness, must bind to a compiled Notary profile, contract,
-/// purpose, complete input-name set, and canonical input values, and is
-/// released through the same
-/// request-scoped consultation planner used by production evaluation.
-#[doc(hidden)]
-pub struct OfflineRelayConsultation {
-    profile_id: String,
-    profile_contract_hash: String,
-    purpose: String,
-    inputs: BTreeMap<String, Zeroizing<String>>,
-    outcome: OfflineRelayOutcome,
-    outputs: BTreeMap<String, Value>,
-}
-
-impl OfflineRelayConsultation {
-    #[allow(clippy::too_many_arguments)]
-    #[must_use]
-    pub fn decoded(
-        profile_id: impl Into<String>,
-        profile_contract_hash: impl Into<String>,
-        purpose: impl Into<String>,
-        input_name: impl Into<String>,
-        input_value: impl Into<String>,
-        outcome: OfflineRelayOutcome,
-        outputs: BTreeMap<String, Value>,
-    ) -> Self {
-        Self::decoded_inputs(
-            profile_id,
-            profile_contract_hash,
-            purpose,
-            BTreeMap::from([(input_name.into(), input_value.into())]),
-            outcome,
-            outputs,
-        )
-    }
-
-    /// Build a decoder-validated composite consultation fixture.
-    #[allow(clippy::too_many_arguments)]
-    #[must_use]
-    pub fn decoded_inputs(
-        profile_id: impl Into<String>,
-        profile_contract_hash: impl Into<String>,
-        purpose: impl Into<String>,
-        inputs: BTreeMap<String, String>,
-        outcome: OfflineRelayOutcome,
-        outputs: BTreeMap<String, Value>,
-    ) -> Self {
-        Self {
-            profile_id: profile_id.into(),
-            profile_contract_hash: profile_contract_hash.into(),
-            purpose: purpose.into(),
-            inputs: inputs
-                .into_iter()
-                .map(|(name, value)| (name, Zeroizing::new(value)))
-                .collect(),
-            outcome,
-            outputs,
-        }
-    }
-}
-
-impl std::fmt::Debug for OfflineRelayConsultation {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("OfflineRelayConsultation")
-            .field("profile_id", &self.profile_id)
-            .field("profile_contract_hash", &self.profile_contract_hash)
-            .field("purpose", &self.purpose)
-            .field("input_names", &self.inputs.keys().collect::<Vec<_>>())
-            .field("input_values", &"[REDACTED]")
-            .field("outcome", &self.outcome)
-            .field("outputs", &"[REDACTED]")
-            .finish()
-    }
-}
-
-/// One closed Notary evaluation request for the authoring harness.
-#[doc(hidden)]
-pub struct OfflineNotaryRequest {
-    authentication: OfflineAuthentication,
-    request: EvaluateRequest,
-    header_purpose: Option<String>,
-}
-
-impl OfflineNotaryRequest {
-    #[must_use]
-    pub fn new(authentication: OfflineAuthentication, request: EvaluateRequest) -> Self {
-        Self {
-            authentication,
-            request,
-            header_purpose: None,
-        }
-    }
-
-    #[must_use]
-    pub fn with_header_purpose(mut self, purpose: impl Into<String>) -> Self {
-        self.header_purpose = Some(purpose.into());
-        self
-    }
-}
-
-impl std::fmt::Debug for OfflineNotaryRequest {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("OfflineNotaryRequest")
-            .field("authentication", &self.authentication)
-            .field("request", &"[REDACTED]")
-            .field("header_purpose", &self.header_purpose)
-            .finish()
-    }
-}
-
-/// Value-free stable error classes emitted by the offline Notary evidence path.
-#[doc(hidden)]
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum OfflineNotaryErrorClass {
-    AuthorizationDenied,
-    PurposeDenied,
-    InvalidInput,
-    DisclosureDenied,
-    EvaluationFailed,
-}
-
-impl OfflineNotaryErrorClass {
-    #[must_use]
-    pub const fn as_str(self) -> &'static str {
-        match self {
-            Self::AuthorizationDenied => "authorization.denied",
-            Self::PurposeDenied => "authorization.purpose_denied",
-            Self::InvalidInput => "request.invalid",
-            Self::DisclosureDenied => "disclosure.denied",
-            Self::EvaluationFailed => "evaluation.failed",
-        }
-    }
-}
-
-/// Stable claim projection returned by the offline product evidence path.
-#[doc(hidden)]
-#[derive(Clone, PartialEq)]
-pub struct OfflineClaimView {
-    claim_id: String,
-    value: Option<Value>,
-    satisfied: Option<bool>,
-    disclosure: String,
-    redacted_fields: Vec<String>,
-}
-
-impl OfflineClaimView {
-    #[must_use]
-    pub fn claim_id(&self) -> &str {
-        &self.claim_id
-    }
-
-    #[must_use]
-    pub const fn value(&self) -> Option<&Value> {
-        self.value.as_ref()
-    }
-
-    #[must_use]
-    pub const fn satisfied(&self) -> Option<bool> {
-        self.satisfied
-    }
-
-    #[must_use]
-    pub fn disclosure(&self) -> &str {
-        &self.disclosure
-    }
-
-    #[must_use]
-    pub fn redacted_fields(&self) -> &[String] {
-        &self.redacted_fields
-    }
-}
-
-impl From<ClaimResultView> for OfflineClaimView {
-    fn from(claim: ClaimResultView) -> Self {
-        Self {
-            claim_id: claim.claim_id,
-            value: claim.value,
-            satisfied: claim.satisfied,
-            disclosure: claim.disclosure,
-            redacted_fields: claim.redacted_fields,
-        }
-    }
-}
-
-impl std::fmt::Debug for OfflineClaimView {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("OfflineClaimView")
-            .field("claim_id", &self.claim_id)
-            .field("value", &"[REDACTED]")
-            .field("satisfied", &self.satisfied)
-            .field("disclosure", &self.disclosure)
-            .field("redacted_fields", &self.redacted_fields)
-            .finish()
-    }
-}
-
-/// Result and value-free execution evidence for one offline evaluation.
-#[doc(hidden)]
-pub struct OfflineNotaryEvidence {
-    claims: Vec<OfflineClaimView>,
-    error_class: Option<OfflineNotaryErrorClass>,
-    product_error_code: Option<&'static str>,
-    relay_calls: u64,
-    consultation_count: usize,
-    relay_profile_ids: Vec<String>,
-}
-
-impl OfflineNotaryEvidence {
-    #[must_use]
-    pub fn claims(&self) -> &[OfflineClaimView] {
-        &self.claims
-    }
-
-    #[must_use]
-    pub const fn error_class(&self) -> Option<OfflineNotaryErrorClass> {
-        self.error_class
-    }
-
-    #[must_use]
-    pub const fn product_error_code(&self) -> Option<&'static str> {
-        self.product_error_code
-    }
-
-    #[must_use]
-    pub const fn relay_calls(&self) -> u64 {
-        self.relay_calls
-    }
-
-    #[must_use]
-    pub const fn consultation_count(&self) -> usize {
-        self.consultation_count
-    }
-
-    /// Compiled Relay profile identities selected by the production request
-    /// planner. These are value-free configuration identities, not request
-    /// values or runtime consultation ULIDs.
-    #[must_use]
-    pub fn relay_profile_ids(&self) -> &[String] {
-        &self.relay_profile_ids
-    }
-}
-
-impl std::fmt::Debug for OfflineNotaryEvidence {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("OfflineNotaryEvidence")
-            .field(
-                "claim_ids",
-                &self
-                    .claims
-                    .iter()
-                    .map(|claim| claim.claim_id.as_str())
-                    .collect::<Vec<_>>(),
-            )
-            .field("error_class", &self.error_class)
-            .field("product_error_code", &self.product_error_code)
-            .field("relay_calls", &self.relay_calls)
-            .field("consultation_count", &self.consultation_count)
-            .field("relay_profile_ids", &self.relay_profile_ids)
-            .finish()
-    }
-}
-
-#[doc(hidden)]
-#[derive(Debug, thiserror::Error)]
-pub enum OfflineNotaryHarnessError {
-    #[error("Notary config failed production validation")]
-    InvalidConfig(#[source] EvidenceConfigError),
-    #[error("Notary CEL policy failed production startup validation")]
-    InvalidCelPolicy(#[source] EvidenceError),
-    #[error("offline Notary evaluation requires static API-key authentication")]
-    UnsupportedAuthentication,
-    #[error("offline Notary evaluation requires one configured API-key principal")]
-    MissingConfiguredPrincipal,
-    #[error("offline Relay evidence does not bind to the compiled Notary contract")]
-    InvalidRelayEvidence,
-    #[error("offline CEL worker configuration is invalid")]
-    InvalidCelWorker(#[source] CelWorkerError),
-    #[error("OS randomness is unavailable")]
-    RandomUnavailable,
-}
-
-/// Environment-free production Notary evaluation harness for project authoring.
-#[doc(hidden)]
-pub struct OfflineNotaryHarness {
-    evidence: Arc<EvidenceConfig>,
-    runtime: RegistryNotaryRuntime,
-    relay: Arc<OfflineActivatedRelay>,
-    store: EvidenceStore,
-    principal_id: String,
-    api_key: Zeroizing<String>,
-}
-
-impl OfflineNotaryHarness {
-    pub fn compile(
-        config: StandaloneRegistryNotaryConfig,
-        relay_evidence: Vec<OfflineRelayConsultation>,
-        cel_worker_config: CelWorkerConfig,
-    ) -> Result<Self, OfflineNotaryHarnessError> {
-        config
-            .validate()
-            .map_err(OfflineNotaryHarnessError::InvalidConfig)?;
-        let principal_id = config
-            .auth
-            .api_keys
-            .first()
-            .map(|credential| credential.id.clone())
-            .ok_or(OfflineNotaryHarnessError::MissingConfiguredPrincipal)?;
-        validate_cel_claims_for_startup(&config.evidence, &config.cel)
-            .map_err(OfflineNotaryHarnessError::InvalidCelPolicy)?;
-        let cel_worker = CelWorker::lazy(cel_worker_config);
-        cel_worker
-            .validate_config()
-            .map_err(OfflineNotaryHarnessError::InvalidCelWorker)?;
-        let relay = Arc::new(OfflineActivatedRelay::new(
-            &config.evidence,
-            relay_evidence,
-        )?);
-        let mut random = [0_u8; 48];
-        getrandom::fill(&mut random).map_err(|_| OfflineNotaryHarnessError::RandomUnavailable)?;
-        let api_key = Zeroizing::new(URL_SAFE_NO_PAD.encode(random));
-        let runtime =
-            RegistryNotaryRuntime::new_with_audit_hasher(AuditKeyHasher::unkeyed_dev_only())
-                .with_activated_relay(Some(
-                    Arc::clone(&relay) as Arc<dyn ActivatedRelayConsultations>
-                ))
-                .with_cel_worker(Some(Arc::new(cel_worker)))
-                .with_cel_config(Arc::new(config.cel));
-        Ok(Self {
-            evidence: Arc::new(config.evidence),
-            runtime,
-            relay,
-            store: EvidenceStore::default(),
-            principal_id,
-            api_key,
-        })
-    }
-
-    pub async fn evaluate(&self, offline: OfflineNotaryRequest) -> OfflineNotaryEvidence {
-        let scopes = match offline.authentication {
-            OfflineAuthentication::Valid => required_scopes(&self.evidence, &offline.request),
-            OfflineAuthentication::InsufficientScope => {
-                Ok(vec!["offline:insufficient-scope".to_string()])
-            }
-            OfflineAuthentication::Missing | OfflineAuthentication::WrongCredential => {
-                Ok(Vec::new())
-            }
-        };
-        let scopes = match scopes {
-            Ok(scopes) => scopes,
-            Err(error) => return self.evidence_from_error(error, &[]),
-        };
-        let fingerprint = fingerprint_api_key(self.api_key.as_str());
-        let credential = ResolvedCredential {
-            id: self.principal_id.clone(),
-            fingerprint,
-            scopes,
-            authorization_details: None,
-        };
-        let api_key = match offline.authentication {
-            OfflineAuthentication::Valid | OfflineAuthentication::InsufficientScope => {
-                Some(self.api_key.to_string())
-            }
-            OfflineAuthentication::WrongCredential => {
-                Some("offline-invalid-credential-value".to_string())
-            }
-            OfflineAuthentication::Missing => None,
-        };
-        let principal = authenticate_api_key(
-            &RequestCredentials {
-                api_key_present: api_key.is_some(),
-                api_key,
-                authorization_present: false,
-                bearer_token: None,
-                id_token: None,
-            },
-            &[credential],
-        );
-        let principal = match principal {
-            Ok(principal) => principal,
-            Err(error) => return self.evidence_from_error(error, &[]),
-        };
-        let (result, audit) = self
-            .runtime
-            .evaluate_for_api(
-                Arc::clone(&self.evidence),
-                &self.store,
-                &principal,
-                offline.request,
-                offline.header_purpose.as_deref(),
-            )
-            .await;
-        let (_, consultation_ids) = audit.into_parts();
-        match result {
-            Ok(claims) => OfflineNotaryEvidence {
-                claims: claims.into_iter().map(OfflineClaimView::from).collect(),
-                error_class: None,
-                product_error_code: None,
-                relay_calls: u64::try_from(consultation_ids.len()).unwrap_or(u64::MAX),
-                consultation_count: consultation_ids.len(),
-                relay_profile_ids: self.relay.take_profile_ids_for(&consultation_ids),
-            },
-            Err(error) => self.evidence_from_error(error, &consultation_ids),
-        }
-    }
-
-    fn evidence_from_error(
-        &self,
-        error: EvidenceError,
-        consultation_ids: &[String],
-    ) -> OfflineNotaryEvidence {
-        OfflineNotaryEvidence {
-            claims: Vec::new(),
-            error_class: Some(error_class(&error)),
-            product_error_code: Some(error.code()),
-            relay_calls: u64::try_from(consultation_ids.len()).unwrap_or(u64::MAX),
-            consultation_count: consultation_ids.len(),
-            relay_profile_ids: self.relay.take_profile_ids_for(consultation_ids),
-        }
-    }
-}
-
-impl std::fmt::Debug for OfflineNotaryHarness {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("OfflineNotaryHarness")
-            .field("evidence", &"[COMPILED]")
-            .field("runtime", &"[COMPILED]")
-            .field("relay", &self.relay)
-            .field("principal_id", &self.principal_id)
-            .field("api_key", &"[REDACTED]")
-            .finish_non_exhaustive()
-    }
-}
-
-fn required_scopes(
-    evidence: &EvidenceConfig,
-    request: &EvaluateRequest,
-) -> Result<Vec<String>, EvidenceError> {
-    let mut scopes = BTreeSet::new();
-    let mut visited = BTreeSet::new();
-    for claim in &request.claims {
-        collect_required_scopes(evidence, claim, &mut visited, &mut scopes)?;
-    }
-    Ok(scopes.into_iter().collect())
-}
-
-fn collect_required_scopes(
-    evidence: &EvidenceConfig,
-    claim_ref: &ClaimRef,
-    visited: &mut BTreeSet<String>,
-    scopes: &mut BTreeSet<String>,
-) -> Result<(), EvidenceError> {
-    if !visited.insert(claim_ref.id.clone()) {
-        return Ok(());
-    }
-    let claim = crate::find_claim(evidence, claim_ref.id.as_str())?;
-    scopes.extend(claim.required_scopes.iter().cloned());
-    for dependency in &claim.depends_on {
-        collect_required_scopes(
-            evidence,
-            &ClaimRef::from(dependency.as_str()),
-            visited,
-            scopes,
-        )?;
-    }
-    Ok(())
-}
-
-fn error_class(error: &EvidenceError) -> OfflineNotaryErrorClass {
-    match error {
-        EvidenceError::MissingCredential
-        | EvidenceError::MultipleCredentials
-        | EvidenceError::ScopeDenied { .. } => OfflineNotaryErrorClass::AuthorizationDenied,
-        EvidenceError::PurposeNotAllowed | EvidenceError::PurposeRequired => {
-            OfflineNotaryErrorClass::PurposeDenied
-        }
-        EvidenceError::InvalidRequest | EvidenceError::ProfileUnsupported => {
-            OfflineNotaryErrorClass::InvalidInput
-        }
-        EvidenceError::DisclosureNotAllowed => OfflineNotaryErrorClass::DisclosureDenied,
-        _ => OfflineNotaryErrorClass::EvaluationFailed,
-    }
-}
-
-#[derive(Clone, PartialEq, Eq, PartialOrd, Ord)]
-struct OfflineRelayKey {
-    profile_id: String,
-    profile_contract_hash: String,
-    purpose: String,
-    inputs: BTreeMap<String, String>,
-}
-
-struct OfflineRelayEntry {
-    outcome: OfflineRelayOutcome,
-    outputs: BTreeMap<String, Value>,
-    output_contracts: BTreeMap<String, RelayOutputContract>,
-}
-
-struct OfflineActivatedRelay {
-    entries: BTreeMap<OfflineRelayKey, OfflineRelayEntry>,
-    profile_by_consultation_id: Mutex<BTreeMap<String, String>>,
-}
-
-impl OfflineActivatedRelay {
-    fn new(
-        evidence: &EvidenceConfig,
-        consultations: Vec<OfflineRelayConsultation>,
-    ) -> Result<Self, OfflineNotaryHarnessError> {
-        let mut entries = BTreeMap::new();
-        for consultation in consultations {
-            if consultation.outcome != OfflineRelayOutcome::Match
-                && !consultation.outputs.is_empty()
-            {
-                return Err(OfflineNotaryHarnessError::InvalidRelayEvidence);
-            }
-            if consultation.outcome == OfflineRelayOutcome::Match {
-                RuntimeRelayOutputMap::from_json(consultation.outputs.clone())
-                    .map_err(|_| OfflineNotaryHarnessError::InvalidRelayEvidence)?;
-            }
-            let output_contracts = configured_output_contracts(evidence, &consultation)
-                .ok_or(OfflineNotaryHarnessError::InvalidRelayEvidence)?;
-            let key = OfflineRelayKey {
-                profile_id: consultation.profile_id,
-                profile_contract_hash: consultation.profile_contract_hash,
-                purpose: consultation.purpose,
-                inputs: consultation
-                    .inputs
-                    .into_iter()
-                    .map(|(name, value)| (name, value.to_string()))
-                    .collect(),
-            };
-            if entries
-                .insert(
-                    key,
-                    OfflineRelayEntry {
-                        outcome: consultation.outcome,
-                        outputs: consultation.outputs,
-                        output_contracts,
-                    },
-                )
-                .is_some()
-            {
-                return Err(OfflineNotaryHarnessError::InvalidRelayEvidence);
-            }
-        }
-        if entries.is_empty() {
-            return Err(OfflineNotaryHarnessError::InvalidRelayEvidence);
-        }
-        Ok(Self {
-            entries,
-            profile_by_consultation_id: Mutex::new(BTreeMap::new()),
-        })
-    }
-
-    fn take_profile_ids_for(&self, consultation_ids: &[String]) -> Vec<String> {
-        let mut profile_by_consultation_id = self
-            .profile_by_consultation_id
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        consultation_ids
-            .iter()
-            .filter_map(|id| profile_by_consultation_id.remove(id))
-            .collect::<BTreeSet<_>>()
-            .into_iter()
-            .collect()
-    }
-
-    fn entry_for(
-        &self,
-        key: &ConsultationGroupKeyV1,
-    ) -> Result<&OfflineRelayEntry, RelayClientError> {
-        self.entries
-            .get(&OfflineRelayKey {
-                profile_id: key.profile_id().to_string(),
-                profile_contract_hash: key.profile_contract_hash().to_string(),
-                purpose: key.canonical_purpose().to_string(),
-                inputs: key
-                    .canonical_inputs()
-                    .iter()
-                    .map(|(name, value)| (name.clone(), value.as_str().to_string()))
-                    .collect(),
-            })
-            .filter(|entry| {
-                key.expected_output_contracts()
-                    .is_some_and(|contracts| contracts == &entry.output_contracts)
-            })
-            .ok_or(RelayClientError::InvalidRequest)
-    }
-}
-
-impl std::fmt::Debug for OfflineActivatedRelay {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("OfflineActivatedRelay")
-            .field("entries", &"[REDACTED]")
-            .field("profile_by_consultation_id", &"[REDACTED]")
-            .finish()
-    }
-}
-
-#[async_trait::async_trait]
-impl ActivatedRelayConsultations for OfflineActivatedRelay {
-    async fn check_ready(&self) -> Result<(), RelayClientError> {
-        Ok(())
-    }
-
-    fn profile_count(&self) -> usize {
-        self.entries.len()
-    }
-
-    fn validate(&self, key: &ConsultationGroupKeyV1) -> Result<(), RelayClientError> {
-        self.entry_for(key).map(|_| ())
-    }
-
-    async fn execute(
-        &self,
-        key: &ConsultationGroupKeyV1,
-    ) -> Result<RuntimeRelayConsultationResult, RelayClientError> {
-        let entry = self.entry_for(key)?;
-        let (outcome, match_data) = match entry.outcome {
-            OfflineRelayOutcome::Match => (
-                RuntimeRelayOutcome::Match,
-                Some(RuntimeRelayMatchData::OutputMap(
-                    RuntimeRelayOutputMap::from_json(entry.outputs.clone())?,
-                )),
-            ),
-            OfflineRelayOutcome::NoMatch => (RuntimeRelayOutcome::NoMatch, None),
-            OfflineRelayOutcome::Ambiguous => (RuntimeRelayOutcome::Ambiguous, None),
-        };
-        let consultation_id = ulid::Ulid::new();
-        let result = RuntimeRelayConsultationResult::new(
-            consultation_id,
-            outcome,
-            match_data,
-            OffsetDateTime::now_utc(),
-        )?;
-        self.profile_by_consultation_id
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner)
-            .insert(consultation_id.to_string(), key.profile_id().to_owned());
-        Ok(result)
-    }
-}
-
-fn configured_output_contracts(
-    evidence: &EvidenceConfig,
-    offline: &OfflineRelayConsultation,
-) -> Option<BTreeMap<String, RelayOutputContract>> {
-    evidence.claims.iter().find_map(|claim| {
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-            return None;
-        };
-        let (_, consultation) = consultations.first_key_value()?;
-        (claim.purpose.as_deref() == Some(offline.purpose.as_str())
-            && consultation.profile.id == offline.profile_id
-            && consultation.profile.contract_hash == offline.profile_contract_hash
-            && consultation.inputs.keys().eq(offline.inputs.keys())
-            && !consultation.outputs.is_empty())
-        .then(|| consultation.outputs.clone())
-    })
-}
diff --git a/crates/registry-notary-server/src/standalone/preauth.rs b/crates/registry-notary-server/src/standalone/preauth.rs
deleted file mode 100644
index 7424c8128..000000000
--- a/crates/registry-notary-server/src/standalone/preauth.rs
+++ /dev/null
@@ -1,916 +0,0 @@
-use super::*;
-
-/// The eSignet-verified subject extracted at the offer callback.
-///
-/// `subject_binding_value` (the civil ID) is load-bearing; `Debug` redacts the
-/// civil ID and the eSignet subject so they never reach logs.
-pub(crate) struct EsignetSubject {
-    pub(crate) subject: String,
-    pub(crate) subject_binding_value: String,
-    pub(crate) client_id: String,
-    pub(crate) scopes: Vec<String>,
-    pub(crate) acr: Option<String>,
-    pub(crate) auth_time: Option<i64>,
-}
-
-impl std::fmt::Debug for EsignetSubject {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("EsignetSubject")
-            .field("subject", &"[redacted]")
-            .field("subject_binding_value", &"[redacted]")
-            .field("client_id", &self.client_id)
-            .field("scopes", &self.scopes)
-            .field("acr", &self.acr)
-            .field("auth_time", &self.auth_time)
-            .finish()
-    }
-}
-
-/// Runtime for the pre-authorized-code flow: the dedicated access-token signer
-/// (never the credential key), the eSignet RP credentials and verifier for the
-/// citizen login leg, and the short-lived login-state store.
-///
-/// Built only when both `oid4vci.pre_authorized_code.enabled` and
-/// `auth.access_token_signing.enabled` are set; otherwise the flow's endpoints
-/// stay `404`.
-pub(crate) struct PreAuthRuntime {
-    /// Dedicated access-token signing key (mints the pre-authorized code and
-    /// the access token). Distinct from the SD-JWT VC credential key (enforced
-    /// by config validation).
-    access_token_signer: Arc<dyn SigningProvider>,
-    /// Public keys accepted by the in-process second verifier, with rotation
-    /// expiry metadata preserved for runtime checks.
-    access_token_verification_keys: Vec<AccessTokenVerificationKey>,
-    /// Notary issuer stamped into and pinned for Notary-minted tokens.
-    notary_issuer: String,
-    /// Audiences stamped into Notary access tokens.
-    notary_audiences: Vec<String>,
-    /// Header `typ` for the Notary access token.
-    access_token_typ: String,
-    /// Pre-authorized code lifetime, seconds.
-    pre_authorized_code_ttl_seconds: u64,
-    /// Access-token lifetime, seconds.
-    access_token_ttl_seconds: u64,
-    /// Whether the offer includes a wallet-entered `tx_code` PIN.
-    tx_code_required: bool,
-    /// `tx_code` length (numeric PIN).
-    tx_code_length: u64,
-    /// eSignet confidential client id presented by the Notary RP.
-    esignet_client_id: String,
-    /// eSignet RP signer for the `private_key_jwt` client assertion.
-    esignet_client_signer: Arc<dyn SigningProvider>,
-    esignet_authorize_url: String,
-    esignet_token_url: String,
-    esignet_redirect_uri: String,
-    esignet_scopes: Vec<String>,
-    /// eSignet issuer, accepted as the userinfo JWS `iss` when the subject
-    /// binding is userinfo-sourced.
-    esignet_issuer: String,
-    /// eSignet userinfo endpoint. `Some` only when the subject-binding claim is
-    /// userinfo-sourced; the callback fetches the userinfo JWS from here.
-    esignet_userinfo_url: Option<String>,
-    /// How the subject-binding claim is sourced. `Userinfo` makes the callback
-    /// fetch the eSignet userinfo JWS; otherwise the binding value is read from
-    /// the `id_token`.
-    subject_binding_claim_source: SubjectAccessClaimSource,
-    /// Claim name that must bind the credential subject during the citizen
-    /// login leg.
-    subject_binding_claim: String,
-    /// eSignet `id_token` verifier (pins eSignet `iss`, `aud`=RP client_id,
-    /// signature via the eSignet JWKS, `exp`/`nbf`). Also verifies the userinfo
-    /// JWS (same eSignet signing keys) when the binding is userinfo-sourced.
-    esignet_id_token_verifier: Arc<TokenVerifier>,
-    fetch_url_policy: FetchUrlPolicy,
-    login_state_ttl_seconds: u64,
-    /// Typed state contract for login-state and code-redemption transactions.
-    preauthorization_state: Arc<crate::preauth_state::PreauthorizationState>,
-    /// Audit pipeline so the callback and token endpoints (public, so not
-    /// covered by the auth-audit middleware) can emit hashed audit events.
-    audit: AuditPipeline,
-}
-
-impl std::fmt::Debug for PreAuthRuntime {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("PreAuthRuntime")
-            .field("notary_issuer", &self.notary_issuer)
-            .field("notary_audiences", &self.notary_audiences)
-            .field("access_token_typ", &self.access_token_typ)
-            .field("esignet_client_id", &self.esignet_client_id)
-            .field("esignet_authorize_url", &self.esignet_authorize_url)
-            .field("esignet_token_url", &self.esignet_token_url)
-            .finish_non_exhaustive()
-    }
-}
-
-pub(super) const ESIGNET_REQUEST_TIMEOUT: Duration = Duration::from_secs(10);
-pub(super) const ESIGNET_MAX_RESPONSE_BYTES: u64 = 64 * 1024;
-pub(super) const PRIVATE_KEY_JWT_CLIENT_ASSERTION_TYPE: &str =
-    "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
-
-/// The eSignet token-endpoint response material the callback needs: the
-/// `id_token` (always) and the `access_token` (used to fetch userinfo when the
-/// subject binding is userinfo-sourced).
-pub(super) struct EsignetTokenResponse {
-    id_token: String,
-    access_token: Option<String>,
-}
-
-/// Read the subject-binding claim value from verified OIDC claims (the
-/// `id_token` or the userinfo JWS).
-pub(super) fn subject_binding_value_from_claims(
-    claims: &registry_platform_oidc::Claims,
-    subject_binding_claim: &str,
-) -> Result<String, EvidenceError> {
-    let value = if subject_binding_claim == "sub" {
-        claims.sub.clone().ok_or(EvidenceError::MissingCredential)?
-    } else {
-        claims
-            .extra
-            .get(subject_binding_claim)
-            .and_then(Value::as_str)
-            .ok_or(EvidenceError::MissingCredential)?
-            .to_string()
-    };
-    if value.trim().is_empty() {
-        return Err(EvidenceError::MissingCredential);
-    }
-    Ok(value)
-}
-
-/// Read the subject-binding claim from a verified `id_token`.
-pub(super) fn subject_binding_value_from_id_token(
-    verified: &VerifiedToken,
-    subject_binding_claim: &str,
-) -> Result<String, EvidenceError> {
-    subject_binding_value_from_claims(&verified.claims, subject_binding_claim)
-}
-
-/// Build the verifier config for eSignet `id_token`s and userinfo JWS.
-///
-/// The `id_token`'s `aud` is the RP client_id, so eSignet's issuer is pinned and
-/// the RP client_id is the only accepted audience. MOSIP eSignet signs its
-/// userinfo JWS without an `exp` claim (OpenID Connect Core makes `exp` optional
-/// for UserInfo responses), so this verifier must not require one; requiring it
-/// would reject every eSignet userinfo response and fail userinfo-sourced
-/// subject binding.
-pub(super) fn esignet_token_verifier_config(issuer: &str, client_id: &str) -> TokenVerifierConfig {
-    TokenVerifierConfig::access_token_profile(
-        issuer.to_string(),
-        vec![client_id.to_string()],
-        vec![
-            Algorithm::EdDSA,
-            Algorithm::RS256,
-            Algorithm::PS256,
-            Algorithm::ES256,
-        ],
-        vec!["JWT".to_string()],
-    )
-    .with_userinfo_requires_exp(false)
-}
-
-impl PreAuthRuntime {
-    pub(super) fn from_config(
-        config: &StandaloneRegistryNotaryConfig,
-        signing_keys: &SigningKeyRegistry,
-        audit: AuditPipeline,
-        state_plane: Arc<NotaryStatePlaneHandle>,
-    ) -> Result<Option<Self>, StandaloneServerError> {
-        let pre_auth = &config.oid4vci.pre_authorized_code;
-        let signing = &config.auth.access_token_signing;
-        if !pre_auth.enabled {
-            return Ok(None);
-        }
-        if !signing.enabled {
-            return Err(StandaloneServerError::InvalidOidcConfig(
-                "oid4vci.pre_authorized_code.enabled requires auth.access_token_signing.enabled"
-                    .to_string(),
-            ));
-        }
-        let access_token_signer = signing_keys
-            .signing_provider(signing.signing_key_id.as_str())
-            .ok_or_else(|| {
-                invalid_signing_key(
-                    signing.signing_key_id.as_str(),
-                    "active access-token signing key was not built",
-                )
-            })?;
-        let access_token_verification_keys = access_token_verification_keys(config)?;
-        let esignet = &pre_auth.esignet;
-        let esignet_client_signer = signing_keys
-            .signing_provider(esignet.client_signing_key_id.as_str())
-            .ok_or_else(|| {
-                invalid_signing_key(
-                    esignet.client_signing_key_id.as_str(),
-                    "active eSignet RP client signing key was not built",
-                )
-            })?;
-        let fetch_url_policy = if esignet.allow_insecure_localhost {
-            FetchUrlPolicy::dev()
-        } else {
-            FetchUrlPolicy::strict()
-        };
-        let id_token_fetcher = Arc::new(JwksFetcher::new_with_fetch_url_policy(
-            esignet.jwks_uri.clone(),
-            JwksFetcherConfig::defaults(),
-            fetch_url_policy.clone(),
-        ));
-        let esignet_id_token_verifier = Arc::new(TokenVerifier::new(
-            esignet_token_verifier_config(&esignet.issuer, &esignet.client_id),
-            id_token_fetcher,
-        ));
-        Ok(Some(Self {
-            access_token_signer,
-            access_token_verification_keys,
-            notary_issuer: signing.issuer.clone(),
-            notary_audiences: signing.audiences.clone(),
-            access_token_typ: signing.token_typ.clone(),
-            pre_authorized_code_ttl_seconds: pre_auth.pre_authorized_code_ttl_seconds,
-            access_token_ttl_seconds: signing.access_token_ttl_seconds,
-            tx_code_required: pre_auth.tx_code.required,
-            tx_code_length: pre_auth.tx_code.length,
-            esignet_client_id: esignet.client_id.clone(),
-            esignet_client_signer,
-            esignet_authorize_url: esignet.authorize_url.clone(),
-            esignet_token_url: esignet.token_url.clone(),
-            esignet_redirect_uri: esignet.redirect_uri.clone(),
-            esignet_scopes: esignet.scopes.clone(),
-            esignet_issuer: esignet.issuer.clone(),
-            esignet_userinfo_url: {
-                let url = esignet.userinfo_url.trim();
-                (!url.is_empty()).then(|| url.to_string())
-            },
-            subject_binding_claim_source: config.subject_access.subject_binding.claim_source,
-            subject_binding_claim: config.subject_access.subject_binding.token_claim.clone(),
-            esignet_id_token_verifier,
-            fetch_url_policy,
-            login_state_ttl_seconds: esignet.login_state_ttl_seconds,
-            preauthorization_state: Arc::new(
-                crate::preauth_state::PreauthorizationState::from_state_plane(state_plane)
-                    .map_err(|_| {
-                        StandaloneServerError::InvalidOidcConfig(
-                            "preauthorization state could not initialize its process-local key"
-                                .to_string(),
-                        )
-                    })?,
-            ),
-            audit,
-        }))
-    }
-
-    #[cfg(test)]
-    pub(crate) fn for_api_tests(access_token_typ: &str) -> Self {
-        let signer = Arc::new(
-            LocalJwkSigner::new(
-                PrivateJwk::parse(
-                    &json!({
-                        "kty": "OKP",
-                        "crv": "Ed25519",
-                        "d": "2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw",
-                        "x": "1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc",
-                        "alg": "EdDSA",
-                        "kid": "did:web:notary.example#access"
-                    })
-                    .to_string(),
-                )
-                .expect("test access-token JWK parses"),
-            )
-            .expect("test access-token signer builds"),
-        );
-        let public_jwk = signer.public_jwk();
-        let fetch_url_policy = FetchUrlPolicy::strict();
-        let esignet_issuer = "https://id.example.gov".to_string();
-        let esignet_client_id = "citizen-portal".to_string();
-        let esignet_id_token_verifier = Arc::new(TokenVerifier::new(
-            esignet_token_verifier_config(&esignet_issuer, &esignet_client_id),
-            Arc::new(JwksFetcher::new_with_fetch_url_policy(
-                "https://id.example.gov/jwks".to_string(),
-                JwksFetcherConfig::defaults(),
-                fetch_url_policy.clone(),
-            )),
-        ));
-        let state_plane = Arc::new(
-            NotaryStatePlaneHandle::from_config(
-                &registry_notary_core::StateConfig {
-                    storage: registry_notary_core::STATE_STORAGE_IN_MEMORY.to_string(),
-                    ..registry_notary_core::StateConfig::default()
-                },
-                true,
-            )
-            .expect("test in-memory state plane builds"),
-        );
-
-        Self {
-            access_token_signer: signer.clone(),
-            access_token_verification_keys: vec![AccessTokenVerificationKey {
-                public_jwk,
-                publish_until_unix_seconds: None,
-            }],
-            notary_issuer: "http://127.0.0.1:4325".to_string(),
-            notary_audiences: vec!["registry-notary-citizen".to_string()],
-            access_token_typ: access_token_typ.to_string(),
-            pre_authorized_code_ttl_seconds: 300,
-            access_token_ttl_seconds: 300,
-            tx_code_required: true,
-            tx_code_length: 6,
-            esignet_client_id,
-            esignet_client_signer: signer,
-            esignet_authorize_url: "https://id.example.gov/authorize".to_string(),
-            esignet_token_url: "https://id.example.gov/token".to_string(),
-            esignet_redirect_uri: "http://127.0.0.1:4325/oid4vci/offer/callback".to_string(),
-            esignet_scopes: vec!["openid".to_string()],
-            esignet_issuer,
-            esignet_userinfo_url: None,
-            subject_binding_claim_source: SubjectAccessClaimSource::AccessToken,
-            subject_binding_claim: "https://id.example.gov/claims/national_id".to_string(),
-            esignet_id_token_verifier,
-            fetch_url_policy,
-            login_state_ttl_seconds: 300,
-            preauthorization_state: Arc::new(
-                crate::preauth_state::PreauthorizationState::from_state_plane(state_plane)
-                    .expect("test preauthorization state builds"),
-            ),
-            audit: AuditPipeline::for_sink_dev_only(Arc::new(JsonlStdoutSink::new())),
-        }
-    }
-
-    #[cfg(all(test, feature = "registry-notary-cel"))]
-    pub(crate) fn with_access_token_signer_for_tests(
-        mut self,
-        signer: Arc<dyn SigningProvider>,
-    ) -> Self {
-        self.access_token_signer = signer;
-        self
-    }
-
-    /// Emit a hashed pre-auth audit event. Returns an error if emission fails so
-    /// callers fail closed rather than silently dropping the audit trail.
-    pub(crate) async fn emit_audit(&self, event: &EvidenceAuditEvent) -> Result<(), AuditError> {
-        self.audit.emit(event).await
-    }
-
-    pub(crate) fn access_token_signer(&self) -> &dyn SigningProvider {
-        self.access_token_signer.as_ref()
-    }
-
-    pub(crate) fn access_token_verification_keys(&self) -> &[AccessTokenVerificationKey] {
-        &self.access_token_verification_keys
-    }
-
-    pub(crate) fn notary_issuer(&self) -> &str {
-        &self.notary_issuer
-    }
-
-    pub(crate) fn notary_audiences(&self) -> &[String] {
-        &self.notary_audiences
-    }
-
-    pub(crate) fn access_token_typ(&self) -> &str {
-        &self.access_token_typ
-    }
-
-    pub(crate) fn pre_authorized_code_ttl_seconds(&self) -> u64 {
-        self.pre_authorized_code_ttl_seconds
-    }
-
-    pub(crate) fn access_token_ttl_seconds(&self) -> u64 {
-        self.access_token_ttl_seconds
-    }
-
-    pub(crate) fn tx_code_required(&self) -> bool {
-        self.tx_code_required
-    }
-
-    pub(crate) fn tx_code_length(&self) -> u64 {
-        self.tx_code_length
-    }
-
-    pub(crate) fn login_state_ttl_seconds(&self) -> u64 {
-        self.login_state_ttl_seconds
-    }
-
-    pub(crate) fn preauthorization_state(&self) -> &crate::preauth_state::PreauthorizationState {
-        self.preauthorization_state.as_ref()
-    }
-
-    /// Adapt the eSignet-verified callback subject into the same bounded
-    /// principal shape used by the normal subject-access policy path. Only
-    /// modeled, verified fields are carried forward; arbitrary authorization
-    /// response extensions never enter the issuance transaction.
-    pub(crate) fn principal_for_subject(
-        &self,
-        subject: &registry_notary_core::tokens::BoundSubject,
-    ) -> Result<EvidencePrincipal, EvidenceError> {
-        let now = OffsetDateTime::now_utc().unix_timestamp();
-        let mut payload = json!({
-            "iss": self.esignet_issuer,
-            "aud": self.notary_audiences,
-            "sub": subject.subject,
-            "client_id": subject.client_id,
-            "scope": subject.scopes.join(" "),
-            "iat": now,
-            "nbf": now,
-            "exp": now + self.access_token_ttl_seconds as i64,
-        });
-        payload[subject.subject_binding_claim.as_str()] =
-            Value::String(subject.subject_binding_value.clone());
-        if let Some(acr) = subject.acr.as_deref() {
-            payload["acr"] = Value::String(acr.to_string());
-        }
-        if let Some(auth_time) = subject.auth_time {
-            payload["auth_time"] = Value::from(auth_time);
-        }
-        let verified =
-            verified_token_from_notary_payload(&payload).ok_or(EvidenceError::MissingCredential)?;
-        principal_from_oidc(
-            &verified,
-            EvidenceAuthProfileId::ExternalOidc,
-            None,
-            None,
-            None,
-            "sub",
-            Some(subject.subject_binding_claim.as_str()),
-            SubjectAccessClaimSource::AccessToken,
-            SubjectAccessAssuranceClaimSource::AccessToken,
-        )
-    }
-
-    /// Build the eSignet authorization redirect URL for the citizen browser.
-    ///
-    /// PKCE S256, the confidential RP `client_id`, the configured redirect URI
-    /// and scopes, plus the caller-provided `state` and `nonce`.
-    pub(crate) fn authorize_redirect_url(
-        &self,
-        state: &str,
-        nonce: &str,
-        pkce_challenge: &str,
-    ) -> Result<String, EvidenceError> {
-        let scope = if self.esignet_scopes.is_empty() {
-            "openid".to_string()
-        } else {
-            self.esignet_scopes.join(" ")
-        };
-        let mut url = reqwest::Url::parse(&self.esignet_authorize_url)
-            .map_err(|_| EvidenceError::CredentialIssuanceFailed)?;
-        url.query_pairs_mut()
-            .append_pair("response_type", "code")
-            .append_pair("client_id", &self.esignet_client_id)
-            .append_pair("redirect_uri", &self.esignet_redirect_uri)
-            .append_pair("scope", &scope)
-            .append_pair("state", state)
-            .append_pair("nonce", nonce)
-            .append_pair("code_challenge", pkce_challenge)
-            .append_pair("code_challenge_method", "S256");
-        if let Some(claims) = self.authorization_claims_param() {
-            url.query_pairs_mut().append_pair("claims", &claims);
-        }
-        Ok(url.to_string())
-    }
-
-    fn authorization_claims_param(&self) -> Option<String> {
-        if !matches!(
-            self.subject_binding_claim_source,
-            SubjectAccessClaimSource::Userinfo
-        ) {
-            return None;
-        }
-        let claim = self.subject_binding_claim.trim();
-        if claim.is_empty() {
-            return None;
-        }
-        let mut userinfo = Map::new();
-        userinfo.insert(claim.to_string(), json!({ "essential": true }));
-        Some(json!({ "userinfo": Value::Object(userinfo) }).to_string())
-    }
-
-    /// Exchange the eSignet authorization `code` for an `id_token` (and
-    /// `access_token`) using `private_key_jwt` client authentication, validate
-    /// the `id_token` (signature against the eSignet JWKS, `iss`, `aud`==RP
-    /// client_id, `exp`, `nonce`==`expected_nonce`), then extract the subject
-    /// claims. The subject-binding value is read from the `id_token` or, when
-    /// the binding is userinfo-sourced, fetched from the eSignet userinfo JWS.
-    ///
-    /// Every failure maps to `EvidenceError::MissingCredential` so the callback
-    /// leaks no detail about why the login failed.
-    pub(crate) async fn exchange_code_for_subject(
-        &self,
-        code: &str,
-        pkce_verifier: &str,
-        expected_nonce: &str,
-        subject_binding_claim: &str,
-    ) -> Result<EsignetSubject, EvidenceError> {
-        let tokens = self
-            .esignet_token_exchange(code, pkce_verifier)
-            .await
-            .map_err(|_| EvidenceError::MissingCredential)?;
-        let verified = self
-            .esignet_id_token_verifier
-            .verify_related_token(&tokens.id_token)
-            .await
-            .map_err(|err| {
-                tracing::warn!(error = %err, "eSignet id_token verification failed");
-                EvidenceError::MissingCredential
-            })?;
-        // Bind the id_token to this login: the nonce must equal the one this
-        // Notary generated at offer/start. This is the CSRF/replay guard.
-        let nonce = verified
-            .claims
-            .extra
-            .get("nonce")
-            .and_then(Value::as_str)
-            .ok_or_else(|| {
-                tracing::warn!("eSignet id_token missing nonce claim");
-                EvidenceError::MissingCredential
-            })?;
-        if !constant_time_eq(nonce.as_bytes(), expected_nonce.as_bytes()) {
-            tracing::warn!("eSignet id_token nonce did not match the offer nonce");
-            return Err(EvidenceError::MissingCredential);
-        }
-        let subject_binding_value = match self.subject_binding_claim_source {
-            SubjectAccessClaimSource::Userinfo => {
-                self.subject_binding_value_from_userinfo(
-                    &verified,
-                    subject_binding_claim,
-                    tokens.access_token.as_deref(),
-                )
-                .await?
-            }
-            SubjectAccessClaimSource::AccessToken => {
-                subject_binding_value_from_id_token(&verified, subject_binding_claim)?
-            }
-        };
-        self.esignet_subject(&verified, subject_binding_value)
-    }
-
-    /// Resolve the subject-binding claim from the eSignet userinfo JWS. The
-    /// callback fetches userinfo with the eSignet access token, verifies the JWS
-    /// against the eSignet signing keys, binds it to the `id_token` subject, and
-    /// reads the configured binding claim from it.
-    async fn subject_binding_value_from_userinfo(
-        &self,
-        verified_id_token: &VerifiedToken,
-        subject_binding_claim: &str,
-        access_token: Option<&str>,
-    ) -> Result<String, EvidenceError> {
-        let userinfo_url = self
-            .esignet_userinfo_url
-            .as_deref()
-            .ok_or(EvidenceError::MissingCredential)?;
-        let access_token = access_token.ok_or(EvidenceError::MissingCredential)?;
-        let userinfo_jwt = fetch_userinfo_jwt_with_policy(
-            userinfo_url,
-            access_token,
-            &self.fetch_url_policy,
-            ESIGNET_REQUEST_TIMEOUT,
-            ESIGNET_MAX_RESPONSE_BYTES,
-        )
-        .await
-        .map_err(|err| {
-            tracing::warn!(error = %err, "eSignet userinfo fetch failed");
-            EvidenceError::MissingCredential
-        })?;
-        let userinfo = self
-            .esignet_id_token_verifier
-            .verify_userinfo_jwt_with_claims_policy(
-                &userinfo_jwt,
-                verified_id_token,
-                &[self.esignet_issuer.as_str()],
-                std::slice::from_ref(&self.esignet_client_id),
-            )
-            .await
-            .map_err(|err| {
-                tracing::warn!(error = %err, "eSignet userinfo verification failed");
-                EvidenceError::MissingCredential
-            })?;
-        subject_binding_value_from_claims(&userinfo, subject_binding_claim)
-    }
-
-    /// Build the `EsignetSubject` from the verified `id_token`, carrying the
-    /// already-resolved subject-binding value (from the `id_token` or userinfo).
-    fn esignet_subject(
-        &self,
-        verified: &VerifiedToken,
-        subject_binding_value: String,
-    ) -> Result<EsignetSubject, EvidenceError> {
-        let subject = verified
-            .claims
-            .sub
-            .clone()
-            .ok_or(EvidenceError::MissingCredential)?;
-        let scopes = if verified.scopes.is_empty() {
-            verified
-                .claims
-                .extra
-                .get("scope")
-                .and_then(Value::as_str)
-                .map(|scope| {
-                    scope
-                        .split(' ')
-                        .filter(|s| !s.is_empty())
-                        .map(ToString::to_string)
-                        .collect()
-                })
-                .unwrap_or_default()
-        } else {
-            verified.scopes.clone()
-        };
-        let acr = verified
-            .claims
-            .extra
-            .get("acr")
-            .and_then(Value::as_str)
-            .map(ToString::to_string);
-        let auth_time = verified
-            .claims
-            .extra
-            .get("auth_time")
-            .and_then(Value::as_i64);
-        Ok(EsignetSubject {
-            subject,
-            subject_binding_value,
-            // The credential's citizen client is the Notary RP client that
-            // authenticated the citizen at eSignet.
-            client_id: self.esignet_client_id.clone(),
-            scopes,
-            acr,
-            auth_time,
-        })
-    }
-
-    async fn esignet_token_exchange(
-        &self,
-        code: &str,
-        pkce_verifier: &str,
-    ) -> Result<EsignetTokenResponse, EvidenceError> {
-        let token_url = reqwest::Url::parse(&self.esignet_token_url)
-            .map_err(|_| EvidenceError::MissingCredential)?;
-        let validated_url = self
-            .fetch_url_policy
-            .validate_for_immediate_fetch_with_timeout(&token_url, ESIGNET_REQUEST_TIMEOUT)
-            .await
-            .map_err(|_| EvidenceError::MissingCredential)?;
-        if validated_url.url() != &token_url {
-            return Err(EvidenceError::MissingCredential);
-        }
-        // Authorization codes are single-use. Keep this client short-lived so a
-        // pooled connection cannot cross validated endpoint lifecycles, and do
-        // not transparently retry the non-idempotent token exchange.
-        let request = validated_url
-            .immediate_post_with_timeout(ESIGNET_REQUEST_TIMEOUT)
-            .map_err(|_| EvidenceError::MissingCredential)?
-            .header("user-agent", "registry-notary/0.2")
-            .header("accept", "application/json");
-        let client_assertion = self.client_assertion_jwt().await?;
-        let mut params: BTreeMap<&str, &str> = BTreeMap::new();
-        params.insert("grant_type", "authorization_code");
-        params.insert("code", code);
-        params.insert("redirect_uri", self.esignet_redirect_uri.as_str());
-        params.insert("client_id", self.esignet_client_id.as_str());
-        params.insert("code_verifier", pkce_verifier);
-        params.insert(
-            "client_assertion_type",
-            PRIVATE_KEY_JWT_CLIENT_ASSERTION_TYPE,
-        );
-        params.insert("client_assertion", client_assertion.as_str());
-        let response = request
-            .form(&params)
-            .send()
-            .await
-            .map_err(|_| EvidenceError::MissingCredential)?;
-        if !response.status().is_success() {
-            return Err(EvidenceError::MissingCredential);
-        }
-        let body = read_bounded(response, ESIGNET_MAX_RESPONSE_BYTES)
-            .await
-            .map_err(|_| EvidenceError::MissingCredential)?;
-        let body: Value =
-            serde_json::from_slice(&body).map_err(|_| EvidenceError::MissingCredential)?;
-        let id_token = body
-            .get("id_token")
-            .and_then(Value::as_str)
-            .filter(|id_token| !id_token.is_empty())
-            .map(ToString::to_string)
-            .ok_or(EvidenceError::MissingCredential)?;
-        let access_token = body
-            .get("access_token")
-            .and_then(Value::as_str)
-            .filter(|access_token| !access_token.is_empty())
-            .map(ToString::to_string);
-        Ok(EsignetTokenResponse {
-            id_token,
-            access_token,
-        })
-    }
-
-    /// Build the `private_key_jwt` client assertion the eSignet token endpoint
-    /// requires (`aud`==token endpoint, `iss`/`sub`==RP client_id, short-lived,
-    /// unique `jti`), signed with the RP client signing key.
-    async fn client_assertion_jwt(&self) -> Result<String, EvidenceError> {
-        let now = OffsetDateTime::now_utc().unix_timestamp();
-        let jti = generate_opaque_token().map_err(|_| EvidenceError::MissingCredential)?;
-        let payload = json!({
-            "iss": self.esignet_client_id,
-            "sub": self.esignet_client_id,
-            "aud": self.esignet_token_url,
-            "iat": now,
-            "exp": now + 120,
-            "jti": jti,
-        });
-        let public_jwk = self.esignet_client_signer.public_jwk();
-        let kid = public_jwk
-            .kid
-            .clone()
-            .filter(|kid| kid == self.esignet_client_signer.key_id())
-            .ok_or(EvidenceError::MissingCredential)?;
-        let alg = public_jwk
-            .alg
-            .clone()
-            .unwrap_or_else(|| "EdDSA".to_string());
-        let header = json!({ "alg": alg, "typ": "JWT", "kid": kid });
-        let header_b64 = base64_url_no_pad(
-            &serde_json::to_vec(&header).map_err(|_| EvidenceError::MissingCredential)?,
-        );
-        let payload_b64 = base64_url_no_pad(
-            &serde_json::to_vec(&payload).map_err(|_| EvidenceError::MissingCredential)?,
-        );
-        let signing_input = format!("{header_b64}.{payload_b64}");
-        let signature = self
-            .esignet_client_signer
-            .sign(signing_input.as_bytes())
-            .await
-            .map_err(|_| EvidenceError::MissingCredential)?;
-        Ok(format!("{signing_input}.{}", base64_url_no_pad(&signature)))
-    }
-}
-
-#[derive(Clone)]
-pub(crate) struct AccessTokenVerificationKey {
-    pub(super) public_jwk: PublicJwk,
-    pub(super) publish_until_unix_seconds: Option<u64>,
-}
-
-impl AccessTokenVerificationKey {
-    pub(crate) fn public_jwk(&self) -> &PublicJwk {
-        &self.public_jwk
-    }
-
-    pub(crate) fn may_verify_at(&self, now_unix_seconds: i64) -> bool {
-        let Some(publish_until) = self.publish_until_unix_seconds else {
-            return true;
-        };
-        let Ok(now) = u64::try_from(now_unix_seconds) else {
-            return false;
-        };
-        now <= publish_until
-    }
-}
-
-pub(super) fn access_token_verification_keys(
-    config: &StandaloneRegistryNotaryConfig,
-) -> Result<Vec<AccessTokenVerificationKey>, StandaloneServerError> {
-    let signing = &config.auth.access_token_signing;
-    let mut jwks = Vec::with_capacity(1 + signing.verification_key_ids.len());
-    let public_jwk =
-        signing_key_public_jwk_from_config(&config.evidence, signing.signing_key_id.as_str())?
-            .ok_or_else(|| {
-                invalid_signing_key(
-                    signing.signing_key_id.as_str(),
-                    "access-token signing key public JWK was not built",
-                )
-            })?;
-    jwks.push(AccessTokenVerificationKey {
-        public_jwk,
-        publish_until_unix_seconds: None,
-    });
-    let now = current_unix_timestamp_seconds();
-    for key_id in &signing.verification_key_ids {
-        let Some(key) = config.evidence.signing_keys.get(key_id) else {
-            continue;
-        };
-        if !key.may_publish_at(now) {
-            continue;
-        }
-        if let Some(public_jwk) = signing_key_public_jwk_from_config(&config.evidence, key_id)? {
-            jwks.push(AccessTokenVerificationKey {
-                public_jwk,
-                publish_until_unix_seconds: key.publish_until_unix_seconds,
-            });
-        }
-    }
-    Ok(jwks)
-}
-
-/// Constant-time byte comparison so secret comparisons (nonce, `tx_code`) do
-/// not leak length-prefix timing.
-pub(crate) fn constant_time_eq(left: &[u8], right: &[u8]) -> bool {
-    left.ct_eq(right).into()
-}
-
-pub(super) fn base64_url_no_pad(bytes: &[u8]) -> String {
-    BASE64_URL_SAFE_NO_PAD.encode(bytes)
-}
-
-/// 32 bytes of randomness, base64url-encoded; used for opaque `state`, PKCE
-/// verifier, and `jti` values.
-pub(crate) fn generate_opaque_token() -> Result<String, EvidenceError> {
-    let mut bytes = [0_u8; 32];
-    getrandom::fill(&mut bytes).map_err(|_| EvidenceError::CredentialIssuanceFailed)?;
-    Ok(base64_url_no_pad(&bytes))
-}
-
-/// Derive the PKCE S256 challenge from a verifier.
-pub(crate) fn pkce_s256_challenge(verifier: &str) -> String {
-    let digest = <sha2::Sha256 as sha2::Digest>::digest(verifier.as_bytes());
-    base64_url_no_pad(&digest)
-}
-
-/// Generate a numeric `tx_code` (PIN) of the requested length.
-///
-/// Uses rejection sampling (discarding bytes >= 250) so each digit 0-9 is
-/// uniformly likely; `byte % 10` alone would bias toward 0-5 since 256 is not a
-/// multiple of 10.
-pub(crate) fn generate_numeric_tx_code(length: u64) -> Result<String, EvidenceError> {
-    let length = usize::try_from(length).map_err(|_| EvidenceError::CredentialIssuanceFailed)?;
-    let mut pin = String::with_capacity(length);
-    while pin.len() < length {
-        let mut buf = [0_u8; 32];
-        getrandom::fill(&mut buf).map_err(|_| EvidenceError::CredentialIssuanceFailed)?;
-        for byte in buf {
-            if byte < 250 {
-                pin.push((b'0' + (byte % 10)) as char);
-                if pin.len() == length {
-                    break;
-                }
-            }
-        }
-    }
-    Ok(pin)
-}
-
-/// Hashed/metadata-only fields for a pre-auth audit event. Carries no raw code,
-/// PIN, or token; only hashes and config metadata.
-#[derive(Debug, Default)]
-pub(crate) struct PreAuthAuditFields {
-    pub(crate) principal_id_hash: Option<Hashed<PrincipalIdentifier>>,
-    pub(crate) correlation_id_hash: Option<Hashed<RequestIdentifier>>,
-    pub(crate) credential_configuration_id: Option<registry_notary_core::ConfigMetadata>,
-    pub(crate) denial_code: Option<SubjectAccessDenialCode>,
-    pub(crate) rate_limit_bucket: Option<RateLimitBucket>,
-    pub(crate) access_mode: Option<AccessMode>,
-}
-
-/// Build a hashed pre-auth audit event for a public endpoint. The pre-auth
-/// `offer/callback` and `/oid4vci/token` paths skip the auth-audit middleware
-/// (they are public), so they emit their own audit events.
-pub(crate) fn pre_auth_audit_event(
-    method: &str,
-    path: &str,
-    status: u16,
-    decision: &str,
-    fields: PreAuthAuditFields,
-) -> EvidenceAuditEvent {
-    let occurred_at = OffsetDateTime::now_utc()
-        .format(&Rfc3339)
-        .unwrap_or_else(|_| "1970-01-01T00:00:00Z".to_string());
-    EvidenceAuditEvent {
-        event_id: Ulid::new().to_string(),
-        occurred_at,
-        principal_id_hash: fields.principal_id_hash,
-        scopes_used: Vec::new(),
-        decision: decision.to_string(),
-        method: method.to_string(),
-        path: path.to_string(),
-        status,
-        verification_id: None,
-        claim_hash: None,
-        purposes: None,
-        row_count: None,
-        relay_consultation_count: None,
-        relay_consultation_ids: Vec::new(),
-        forwarded: None,
-        error_code: None,
-        access_mode: Some(fields.access_mode.unwrap_or(AccessMode::SubjectBound)),
-        federation_peer_id_hash: None,
-        federation_issuer: None,
-        federation_profile: None,
-        federation_purpose: None,
-        federation_request_jti_hash: None,
-        federation_subject_ref_hash: None,
-        denial_code: fields.denial_code,
-        token_claim_name: None,
-        correlation_id_hash: fields.correlation_id_hash,
-        credential_profile: None,
-        protocol: registry_notary_core::ConfigMetadata::new("openid4vci").ok(),
-        credential_configuration_id: fields.credential_configuration_id,
-        holder_binding_mode: None,
-        rate_limit_bucket: fields.rate_limit_bucket,
-        policy_version: None,
-        policy_hash: None,
-        target_type: None,
-        target_ref_hash: None,
-        requester_type: None,
-        requester_ref_hash: None,
-        redacted_fields: None,
-        batch_items: None,
-        config: None,
-    }
-}
diff --git a/crates/registry-notary-server/src/standalone/relay.rs b/crates/registry-notary-server/src/standalone/relay.rs
deleted file mode 100644
index 98abd2cd6..000000000
--- a/crates/registry-notary-server/src/standalone/relay.rs
+++ /dev/null
@@ -1,801 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Restart-only activation of configured Notary-to-Relay journeys.
-
-use std::collections::btree_map::Entry;
-use std::collections::BTreeMap;
-use std::fs::{self, File};
-use std::io::Read as _;
-use std::path::Path;
-use std::sync::Arc;
-
-use crate::relay_client::{
-    RelayClientError, RelayConsultationClient, RelayExpectedResult, RelayProfilePin,
-    RelayWorkloadCredentialFile,
-};
-use crate::runtime::{
-    ActivatedRelayClientSet, ActivatedRelayConsultations, RelayClientSelectionV1,
-    RuntimeRelayConsultationResult, RuntimeRelayExpectedResult,
-};
-use registry_notary_core::{ClaimEvidenceMode, DeploymentProfile, StandaloneRegistryNotaryConfig};
-use registry_platform_httputil::destination::{
-    DestinationProfile, DestinationTlsMaterial, ServiceHopDataDestinationPolicy,
-    MAX_DESTINATION_CA_BUNDLE_BYTES,
-};
-
-use super::StandaloneServerError;
-
-pub(super) async fn activate_relay_from_config(
-    config: &StandaloneRegistryNotaryConfig,
-) -> Result<Option<Arc<dyn ActivatedRelayConsultations>>, StandaloneServerError> {
-    let Some(plans) = activation_plans(config)? else {
-        return Ok(None);
-    };
-    let root_certificate = plans
-        .connection
-        .root_certificate_path
-        .as_deref()
-        .map(read_relay_root_certificate)
-        .transpose()
-        .map_err(|_| StandaloneServerError::RelayActivation)?
-        .map(Arc::<[u8]>::from);
-    let mut activated = Vec::with_capacity(plans.clients.len());
-    for plan in plans.clients {
-        let credential = RelayWorkloadCredentialFile::new(plans.connection.token_file.clone())
-            .map_err(map_relay_client_error)?;
-        let destination = relay_destination(
-            plans.connection,
-            root_certificate.as_deref(),
-            config.deployment.profile,
-        )
-        .map_err(|_| StandaloneServerError::InvalidRelayDestination)?;
-        let expected_result = plan.expected_result.relay()?;
-        let selection = RelayClientSelectionV1::new(
-            plan.profile.id.as_str(),
-            plan.profile.contract_hash.as_str(),
-            plan.purpose.as_str(),
-            plan.input_names.clone(),
-            plan.expected_result.runtime()?,
-        )
-        .map_err(|_| StandaloneServerError::InvalidRelayActivationPlan)?;
-        let retry_plan = RelayRetryPlan {
-            connection: plans.connection.clone(),
-            root_certificate: root_certificate.clone(),
-            deployment_profile: config.deployment.profile,
-            pin: RelayProfilePin::new(
-                plan.profile.id.as_str(),
-                plan.profile.contract_hash.as_str(),
-            )
-            .map_err(|_| StandaloneServerError::RelayActivation)?,
-            purpose: plan.purpose.clone().into_boxed_str(),
-            input_names: plan.input_names.clone(),
-            expected_result: expected_result.clone(),
-        };
-        let client = RelayConsultationClient::new(
-            destination,
-            credential,
-            plans.connection.workload_client_id.as_str(),
-            RelayProfilePin::new(
-                plan.profile.id.as_str(),
-                plan.profile.contract_hash.as_str(),
-            )
-            .map_err(|_| StandaloneServerError::RelayActivation)?,
-            plan.purpose.as_str(),
-            plan.input_names,
-            expected_result,
-        )
-        .and_then(|client| client.with_max_in_flight(plans.connection.max_in_flight))
-        .map_err(map_relay_client_error)?;
-        let activated_client =
-            retain_profile_activation(client.verify_profile().await, retry_plan)?;
-        activated.push((selection, activated_client));
-    }
-    ActivatedRelayClientSet::new(activated)
-        .map(|clients| Some(Arc::new(clients) as Arc<dyn ActivatedRelayConsultations>))
-        .map_err(|_| StandaloneServerError::InvalidRelayActivationPlan)
-}
-
-fn retain_profile_activation(
-    result: Result<crate::relay_client::VerifiedRelayClient, RelayClientError>,
-    retry_plan: RelayRetryPlan,
-) -> Result<Arc<dyn ActivatedRelayConsultations>, StandaloneServerError> {
-    match result {
-        Ok(verified) => Ok(Arc::new(verified)),
-        Err(RelayClientError::Unavailable) => Ok(Arc::new(PendingRelayProfile::new(retry_plan))),
-        Err(error) => Err(map_relay_client_error(error)),
-    }
-}
-
-#[derive(Clone)]
-struct RelayRetryPlan {
-    connection: registry_notary_core::RelayConnectionConfig,
-    root_certificate: Option<Arc<[u8]>>,
-    deployment_profile: Option<DeploymentProfile>,
-    pin: RelayProfilePin,
-    purpose: Box<str>,
-    input_names: Vec<String>,
-    expected_result: RelayExpectedResult,
-}
-
-impl RelayRetryPlan {
-    fn client(&self) -> Result<RelayConsultationClient, RelayClientError> {
-        let destination = relay_destination(
-            &self.connection,
-            self.root_certificate.as_deref(),
-            self.deployment_profile,
-        )
-        .map_err(|_| RelayClientError::InvalidConfiguration)?;
-        RelayConsultationClient::new(
-            destination,
-            RelayWorkloadCredentialFile::new(self.connection.token_file.clone())?,
-            self.connection.workload_client_id.as_str(),
-            self.pin.clone(),
-            self.purpose.clone(),
-            self.input_names.clone(),
-            self.expected_result.clone(),
-        )
-        .and_then(|client| client.with_max_in_flight(self.connection.max_in_flight))
-    }
-}
-
-fn relay_destination(
-    connection: &registry_notary_core::RelayConnectionConfig,
-    root_certificate: Option<&[u8]>,
-    deployment_profile: Option<DeploymentProfile>,
-) -> Result<ServiceHopDataDestinationPolicy, ()> {
-    let destination_profile = if !connection.uses_insecure_url() {
-        DestinationProfile::ProductionHttps
-    } else if connection.uses_insecure_loopback_url() {
-        DestinationProfile::LoopbackDevelopmentHttp
-    } else if connection.uses_insecure_private_network_url() {
-        DestinationProfile::PrivateServiceHttp
-    } else if deployment_profile == Some(DeploymentProfile::Local) {
-        DestinationProfile::LocalPrivateDevelopmentHttp
-    } else {
-        return Err(());
-    };
-    let mut destination = ServiceHopDataDestinationPolicy::new(
-        "registry-notary-relay",
-        &connection.base_url,
-        destination_profile,
-        &connection.allowed_private_cidrs,
-    )
-    .map_err(|_| ())?;
-    if let Some(root_certificate) = root_certificate {
-        destination = destination.require_configured_tls();
-        let material =
-            DestinationTlsMaterial::from_pem(Some(root_certificate), None).map_err(|_| ())?;
-        destination
-            .install_configured_tls(material)
-            .map_err(|_| ())?;
-    }
-    Ok(destination)
-}
-
-fn read_relay_root_certificate(path: &Path) -> Result<Vec<u8>, ()> {
-    let mut file = open_relay_root_certificate(path)?;
-    let metadata = file.metadata().map_err(|_| ())?;
-    if !metadata.is_file() {
-        return Err(());
-    }
-    validate_relay_root_certificate_metadata(&metadata)?;
-    let maximum = u64::try_from(MAX_DESTINATION_CA_BUNDLE_BYTES).map_err(|_| ())?;
-    if metadata.len() == 0 || metadata.len() > maximum {
-        return Err(());
-    }
-    let mut bytes = Vec::with_capacity(usize::try_from(metadata.len()).map_err(|_| ())?);
-    file.by_ref()
-        .take(maximum.checked_add(1).ok_or(())?)
-        .read_to_end(&mut bytes)
-        .map_err(|_| ())?;
-    if bytes.is_empty() || bytes.len() > MAX_DESTINATION_CA_BUNDLE_BYTES {
-        return Err(());
-    }
-    Ok(bytes)
-}
-
-#[cfg(unix)]
-fn open_relay_root_certificate(path: &Path) -> Result<File, ()> {
-    use rustix::fs::{Mode, OFlags};
-
-    let descriptor = rustix::fs::open(
-        path,
-        OFlags::RDONLY | OFlags::CLOEXEC | OFlags::NOFOLLOW | OFlags::NONBLOCK,
-        Mode::empty(),
-    )
-    .map_err(|_| ())?;
-    Ok(File::from(descriptor))
-}
-
-#[cfg(not(unix))]
-fn open_relay_root_certificate(path: &Path) -> Result<File, ()> {
-    let metadata = fs::symlink_metadata(path).map_err(|_| ())?;
-    if metadata.file_type().is_symlink() {
-        return Err(());
-    }
-    File::open(path).map_err(|_| ())
-}
-
-#[cfg(unix)]
-fn validate_relay_root_certificate_metadata(metadata: &fs::Metadata) -> Result<(), ()> {
-    use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _};
-
-    let mode = metadata.permissions().mode();
-    let owner = metadata.uid();
-    let effective_user = rustix::process::geteuid().as_raw();
-    if mode & 0o177 != 0 || mode & 0o400 == 0 || (owner != 0 && owner != effective_user) {
-        return Err(());
-    }
-    Ok(())
-}
-
-#[cfg(not(unix))]
-fn validate_relay_root_certificate_metadata(_metadata: &fs::Metadata) -> Result<(), ()> {
-    Ok(())
-}
-
-struct PendingRelayProfile {
-    retry_plan: RelayRetryPlan,
-    verified: std::sync::RwLock<Option<Arc<crate::relay_client::VerifiedRelayClient>>>,
-    activation: tokio::sync::Mutex<()>,
-}
-
-impl PendingRelayProfile {
-    fn new(retry_plan: RelayRetryPlan) -> Self {
-        Self {
-            retry_plan,
-            verified: std::sync::RwLock::new(None),
-            activation: tokio::sync::Mutex::new(()),
-        }
-    }
-
-    fn verified(&self) -> Option<Arc<crate::relay_client::VerifiedRelayClient>> {
-        self.verified
-            .read()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-            .clone()
-    }
-}
-
-impl std::fmt::Debug for PendingRelayProfile {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("PendingRelayProfile")
-            .field("client", &"[REDACTED]")
-            .field("verified", &self.verified().is_some())
-            .finish()
-    }
-}
-
-#[async_trait::async_trait]
-impl ActivatedRelayConsultations for PendingRelayProfile {
-    async fn check_ready(&self) -> Result<(), RelayClientError> {
-        if let Some(verified) = self.verified() {
-            return verified.verify_current_profile().await;
-        }
-        let _activation = self.activation.lock().await;
-        if let Some(verified) = self.verified() {
-            return verified.verify_current_profile().await;
-        }
-        let verified = Arc::new(self.retry_plan.client()?.verify_profile().await?);
-        *self
-            .verified
-            .write()
-            .unwrap_or_else(|poisoned| poisoned.into_inner()) = Some(verified);
-        Ok(())
-    }
-
-    fn validate(
-        &self,
-        key: &crate::runtime::ConsultationGroupKeyV1,
-    ) -> Result<(), RelayClientError> {
-        self.verified()
-            .ok_or(RelayClientError::Unavailable)?
-            .validate(key)
-    }
-
-    fn canonicalize(
-        &self,
-        key: crate::runtime::ConsultationGroupKeyV1,
-    ) -> Result<crate::runtime::ConsultationGroupKeyV1, RelayClientError> {
-        self.verified()
-            .ok_or(RelayClientError::Unavailable)?
-            .canonicalize(key)
-    }
-
-    async fn execute(
-        &self,
-        key: &crate::runtime::ConsultationGroupKeyV1,
-    ) -> Result<RuntimeRelayConsultationResult, RelayClientError> {
-        let verified = self.verified().ok_or(RelayClientError::Unavailable)?;
-        ActivatedRelayConsultations::execute(verified.as_ref(), key).await
-    }
-}
-
-fn map_relay_client_error(error: RelayClientError) -> StandaloneServerError {
-    match error {
-        RelayClientError::CredentialUnavailable => {
-            StandaloneServerError::RelayCredentialUnavailable
-        }
-        RelayClientError::InvalidCredentials | RelayClientError::Denied => {
-            StandaloneServerError::RelayCredentialsRejected
-        }
-        RelayClientError::ProfileNotFound => StandaloneServerError::RelayProfileNotFound,
-        RelayClientError::ContractMismatch
-        | RelayClientError::InvalidProfileMetadata
-        | RelayClientError::InvalidResult => StandaloneServerError::RelayProfileMismatch,
-        RelayClientError::TransportUnavailable
-        | RelayClientError::CapacityUnavailable
-        | RelayClientError::RateLimited
-        | RelayClientError::Unavailable
-        | RelayClientError::UnexpectedStatus => StandaloneServerError::RelayUnavailable,
-        RelayClientError::InvalidConfiguration | RelayClientError::InvalidRequest => {
-            StandaloneServerError::InvalidRelayActivationPlan
-        }
-    }
-}
-
-struct RelayActivationPlans<'a> {
-    connection: &'a registry_notary_core::RelayConnectionConfig,
-    clients: Vec<RelayActivationPlan>,
-}
-
-struct RelayActivationPlan {
-    profile: registry_notary_core::RelayConsultationProfileRef,
-    purpose: String,
-    input_names: Vec<String>,
-    expected_result: PlannedRelayExpectedResult,
-}
-
-#[derive(Clone, PartialEq, Eq, PartialOrd, Ord)]
-struct RelayActivationBaseKey {
-    profile: registry_notary_core::RelayConsultationProfileRef,
-    purpose: String,
-    input_names: Vec<String>,
-}
-
-#[derive(Clone, PartialEq, Eq)]
-enum PlannedRelayExpectedResult {
-    OutputMap(BTreeMap<String, registry_notary_core::RelayOutputContract>),
-}
-
-impl PlannedRelayExpectedResult {
-    fn relay(&self) -> Result<RelayExpectedResult, StandaloneServerError> {
-        match self {
-            Self::OutputMap(outputs) => {
-                RelayExpectedResult::output_map(outputs.clone()).map_err(map_relay_client_error)
-            }
-        }
-    }
-
-    fn runtime(&self) -> Result<RuntimeRelayExpectedResult, StandaloneServerError> {
-        match self {
-            Self::OutputMap(outputs) => RuntimeRelayExpectedResult::output_map(outputs.clone())
-                .map_err(|_| StandaloneServerError::InvalidRelayActivationPlan),
-        }
-    }
-}
-
-fn activation_plans(
-    config: &StandaloneRegistryNotaryConfig,
-) -> Result<Option<RelayActivationPlans<'_>>, StandaloneServerError> {
-    let connection = config.evidence.relay.as_ref();
-    let mut registry_claims = config.evidence.claims.iter();
-    let first = registry_claims.next();
-    let (connection, first) = match (connection, first) {
-        (None, None) => return Ok(None),
-        (Some(_), None) | (None, Some(_)) => {
-            return Err(StandaloneServerError::InvalidRelayActivationPlan)
-        }
-        (Some(connection), Some(first)) => (connection, first),
-    };
-    let mut clients = BTreeMap::<RelayActivationBaseKey, PlannedRelayExpectedResult>::new();
-    for claim in std::iter::once(first).chain(registry_claims) {
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-            return Err(StandaloneServerError::InvalidRelayActivationPlan);
-        };
-        let (_, consultation) = consultations
-            .first_key_value()
-            .filter(|_| consultations.len() == 1)
-            .ok_or(StandaloneServerError::InvalidRelayActivationPlan)?;
-        let input_names = consultation.inputs.keys().cloned().collect::<Vec<_>>();
-        if !(1..=16).contains(&input_names.len()) {
-            return Err(StandaloneServerError::InvalidRelayActivationPlan);
-        }
-        let key = RelayActivationBaseKey {
-            profile: consultation.profile.clone(),
-            purpose: claim
-                .purpose
-                .clone()
-                .ok_or(StandaloneServerError::InvalidRelayActivationPlan)?,
-            input_names,
-        };
-        if consultation.outputs.is_empty() {
-            return Err(StandaloneServerError::InvalidRelayActivationPlan);
-        }
-        let expected_result = PlannedRelayExpectedResult::OutputMap(consultation.outputs.clone());
-        match clients.entry(key) {
-            Entry::Vacant(entry) => {
-                entry.insert(expected_result);
-            }
-            Entry::Occupied(entry) => match (entry.get(), &expected_result) {
-                (existing, candidate) if existing == candidate => {}
-                _ => return Err(StandaloneServerError::InvalidRelayActivationPlan),
-            },
-        }
-    }
-    let clients = clients
-        .into_iter()
-        .map(|(key, expected_result)| RelayActivationPlan {
-            profile: key.profile,
-            purpose: key.purpose,
-            input_names: key.input_names,
-            expected_result,
-        })
-        .collect();
-    Ok(Some(RelayActivationPlans {
-        connection,
-        clients,
-    }))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn local_private_connection(
-        base_url: &str,
-        allowed_private_cidrs: &[&str],
-    ) -> registry_notary_core::RelayConnectionConfig {
-        let mut connection: registry_notary_core::RelayConnectionConfig =
-            serde_norway::from_str(&format!(
-                "base_url: {base_url}\nworkload_client_id: registry-notary\ntoken_file: /run/secrets/relay.jwt\n"
-            ))
-            .expect("test Relay connection parses");
-        connection.allowed_private_cidrs = allowed_private_cidrs
-            .iter()
-            .map(|cidr| cidr.parse().expect("test CIDR parses"))
-            .collect();
-        connection
-    }
-
-    #[test]
-    fn local_private_relay_destination_is_exact_and_profile_bound() {
-        let connection = local_private_connection("http://10.89.0.4:8080", &["10.89.0.4/32"]);
-        relay_destination(&connection, None, Some(DeploymentProfile::Local))
-            .expect("local exact private HTTP destination activates");
-
-        for profile in [
-            None,
-            Some(DeploymentProfile::HostedLab),
-            Some(DeploymentProfile::Production),
-            Some(DeploymentProfile::EvidenceGrade),
-        ] {
-            assert!(relay_destination(&connection, None, profile).is_err());
-        }
-
-        for (base_url, cidrs) in [
-            ("http://10.89.0.4:8080", vec![]),
-            ("http://10.89.0.4:8080", vec!["10.89.0.0/24"]),
-            ("http://10.89.0.4:8080", vec!["10.89.0.5/32"]),
-            ("http://relay.internal.example:8080", vec!["10.89.0.4/32"]),
-            ("http://169.254.169.254:8080", vec!["169.254.169.254/32"]),
-            ("http://100.100.100.200:8080", vec!["100.100.100.200/32"]),
-            ("http://0.0.0.0:8080", vec!["0.0.0.0/32"]),
-        ] {
-            let connection = local_private_connection(base_url, &cidrs);
-            assert!(
-                relay_destination(&connection, None, Some(DeploymentProfile::Local)).is_err(),
-                "unexpectedly activated {base_url} with {cidrs:?}"
-            );
-        }
-    }
-
-    #[test]
-    fn private_service_relay_destination_activates_without_transport_ceremony() {
-        let mut connection =
-            local_private_connection("http://registry-relay-consultation:8080", &[]);
-        connection.allow_insecure_private_network = true;
-        for profile in [
-            DeploymentProfile::Local,
-            DeploymentProfile::HostedLab,
-            DeploymentProfile::Production,
-            DeploymentProfile::EvidenceGrade,
-        ] {
-            relay_destination(&connection, None, Some(profile))
-                .expect("signed private service HTTP destination activates");
-        }
-    }
-
-    #[cfg(unix)]
-    #[test]
-    fn relay_root_certificate_loader_requires_owner_only_regular_file() {
-        use std::os::unix::fs::{symlink, PermissionsExt as _};
-
-        let directory = tempfile::tempdir().expect("temporary directory");
-        let root = directory.path().join("relay-ca.pem");
-        std::fs::write(&root, b"bounded-public-root").expect("root writes");
-        std::fs::set_permissions(&root, std::fs::Permissions::from_mode(0o600))
-            .expect("permissions set");
-        assert_eq!(
-            read_relay_root_certificate(&root).expect("owner-only root loads"),
-            b"bounded-public-root"
-        );
-
-        std::fs::set_permissions(&root, std::fs::Permissions::from_mode(0o644))
-            .expect("permissions widen");
-        assert!(read_relay_root_certificate(&root).is_err());
-        std::fs::set_permissions(&root, std::fs::Permissions::from_mode(0o600))
-            .expect("permissions restore");
-        let link = directory.path().join("relay-ca-link.pem");
-        symlink(&root, &link).expect("symlink creates");
-        assert!(read_relay_root_certificate(&link).is_err());
-    }
-
-    fn config_with_claim(
-        claim: &str,
-        token_file: &std::path::Path,
-    ) -> StandaloneRegistryNotaryConfig {
-        serde_norway::from_str(&format!(
-            r#"
-deployment:
-  profile: local
-server:
-  bind: 127.0.0.1:0
-auth:
-  api_keys: []
-evidence:
-  enabled: true
-  relay:
-    base_url: http://127.0.0.1:1
-    workload_client_id: registry-notary
-    allow_insecure_localhost: true
-    token_file: {}
-    allowed_private_cidrs: [10.42.0.0/16]
-  claims:
-{claim}
-"#,
-            token_file.display(),
-        ))
-        .expect("test Notary config parses")
-    }
-
-    #[tokio::test]
-    async fn registry_backed_config_requires_token_file_before_network() {
-        let directory = tempfile::tempdir().expect("temporary directory");
-        let token_file = directory.path().join("relay.jwt");
-        let config = config_with_claim(
-            r#"    - id: enrollment-status
-      title: Enrollment status
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          enrollment:
-            profile:
-              id: dhis2.tracker.enrollment-status.exact
-              contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-            inputs:
-              tracked_entity: target.id
-            outputs:
-              registration_status: { type: string, nullable: true, max_bytes: 64 }
-      purpose: benefit-verification
-      required_scopes: [registry:consult:dhis2]
-      value:
-        type: string
-        nullable: true
-      rule:
-        type: consultation_output
-        consultation: enrollment
-        output: registration_status"#,
-            &token_file,
-        );
-
-        let error = activate_relay_from_config(&config)
-            .await
-            .expect_err("missing token file must fail before attempting the Relay destination");
-
-        assert!(matches!(
-            error,
-            StandaloneServerError::RelayCredentialUnavailable
-        ));
-
-        std::fs::write(&token_file, b"opaque-token-SENSITIVE")
-            .expect("invalid token fixture writes");
-        let error = activate_relay_from_config(&config)
-            .await
-            .expect_err("invalid token must fail before attempting the Relay destination");
-        assert!(matches!(
-            error,
-            StandaloneServerError::RelayCredentialsRejected
-        ));
-    }
-
-    #[tokio::test]
-    async fn unavailable_profile_is_retained_but_auth_and_contract_failures_abort() {
-        let directory = tempfile::tempdir().expect("temporary directory");
-        let token_file = directory.path().join("relay.jwt");
-        std::fs::write(&token_file, b"opaque-token-SENSITIVE")
-            .expect("invalid token fixture writes");
-        let connection: registry_notary_core::RelayConnectionConfig =
-            serde_norway::from_str(&format!(
-                "base_url: http://127.0.0.1:1\nworkload_client_id: registry-notary\nallow_insecure_localhost: true\ntoken_file: {}\n",
-                token_file.display()
-            ))
-            .expect("retry connection parses");
-        let retry_plan = RelayRetryPlan {
-            connection,
-            root_certificate: None,
-            deployment_profile: Some(DeploymentProfile::Local),
-            pin: RelayProfilePin::new(
-                "example.snapshot-status.exact",
-                "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-            )
-            .expect("profile pin is valid"),
-            purpose: "benefit-verification".into(),
-            input_names: vec!["subject_id".into()],
-            expected_result: RelayExpectedResult::output_map(BTreeMap::from([(
-                "status".to_string(),
-                registry_notary_core::RelayOutputContract::String {
-                    nullable: false,
-                    max_bytes: 64,
-                },
-            )]))
-            .expect("output contract is valid"),
-        };
-        let unavailable =
-            retain_profile_activation(Err(RelayClientError::Unavailable), retry_plan.clone())
-                .expect("a profile-level 503 is retained as unavailable");
-        assert_eq!(
-            unavailable
-                .check_ready()
-                .await
-                .expect_err("the retained profile re-verifies through the safe client boundary"),
-            RelayClientError::InvalidCredentials
-        );
-
-        for (error, expected) in [
-            (
-                RelayClientError::InvalidCredentials,
-                StandaloneServerError::RelayCredentialsRejected,
-            ),
-            (
-                RelayClientError::InvalidProfileMetadata,
-                StandaloneServerError::RelayProfileMismatch,
-            ),
-        ] {
-            let actual = retain_profile_activation(Err(error), retry_plan.clone())
-                .expect_err("security and contract failures abort activation");
-            assert_eq!(
-                std::mem::discriminant(&actual),
-                std::mem::discriminant(&expected)
-            );
-        }
-    }
-
-    #[test]
-    fn consultation_matched_config_selects_the_declared_output_contract() {
-        let directory = tempfile::tempdir().expect("temporary directory");
-        let config = config_with_claim(
-            r#"    - id: birth-record-exists
-      title: Birth record exists
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          birth_record:
-            profile:
-              id: opencrvs.birth-record-exists.exact
-              contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-            inputs:
-              uin: target.id
-            outputs:
-              record_type: { type: string, nullable: false, max_bytes: 64 }
-      purpose: civil-registration-verification
-      required_scopes: [registry:consult:opencrvs]
-      value:
-        type: boolean
-      rule:
-        type: consultation_matched
-        consultation: birth_record"#,
-            &directory.path().join("relay.jwt"),
-        );
-
-        let plans = activation_plans(&config)
-            .expect("activation plans are valid")
-            .expect("Registry-backed activation is present");
-        assert!(matches!(
-            plans.clients[0].expected_result,
-            PlannedRelayExpectedResult::OutputMap(ref outputs)
-                if matches!(outputs.get("record_type"), Some(registry_notary_core::RelayOutputContract::String { nullable: false, max_bytes: 64 }))
-        ));
-    }
-
-    #[test]
-    fn activation_plans_deduplicate_shared_clients_and_keep_independent_profiles() {
-        let directory = tempfile::tempdir().expect("temporary directory");
-        let config = config_with_claim(
-            r#"    - id: enrollment-status
-      title: Enrollment status
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          enrollment:
-            profile:
-              id: dhis2.tracker.enrollment-status.exact
-              contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-            inputs:
-              tracked_entity: request.target.identifiers.dhis2_tracked_entity
-            outputs:
-              status: { type: string, nullable: true, max_bytes: 64 }
-      purpose: programme-verification
-      required_scopes: [registry:programme]
-      value: { type: string }
-      rule: { type: consultation_output, consultation: enrollment, output: status }
-    - id: enrollment-known
-      title: Enrollment known
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          enrollment:
-            profile:
-              id: dhis2.tracker.enrollment-status.exact
-              contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-            inputs:
-              tracked_entity: request.target.identifiers.dhis2_tracked_entity
-            outputs:
-              status: { type: string, nullable: true, max_bytes: 64 }
-      purpose: programme-verification
-      required_scopes: [registry:programme]
-      value: { type: boolean }
-      rule: { type: consultation_matched, consultation: enrollment }
-    - id: birth-record-known
-      title: Birth record known
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          birth_record:
-            profile:
-              id: opencrvs.birth-record.exact
-              contract_hash: sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
-            inputs:
-              uin: request.target.identifiers.UIN
-            outputs:
-              record_type: { type: string, nullable: false, max_bytes: 64 }
-      purpose: civil-verification
-      required_scopes: [registry:civil]
-      value: { type: boolean }
-      rule: { type: consultation_matched, consultation: birth_record }"#,
-            &directory.path().join("relay.jwt"),
-        );
-
-        let plans = activation_plans(&config)
-            .expect("activation plans are valid")
-            .expect("Registry-backed activation is present");
-
-        assert_eq!(plans.clients.len(), 2);
-        assert!(plans.clients.iter().any(|plan| {
-            plan.profile.id == "dhis2.tracker.enrollment-status.exact"
-                && plan.purpose == "programme-verification"
-                && matches!(
-                    plan.expected_result,
-                    PlannedRelayExpectedResult::OutputMap(_)
-                )
-        }));
-        assert!(plans.clients.iter().any(|plan| {
-            plan.profile.id == "opencrvs.birth-record.exact"
-                && plan.purpose == "civil-verification"
-                && matches!(
-                    plan.expected_result,
-                    PlannedRelayExpectedResult::OutputMap(_)
-                )
-        }));
-    }
-}
diff --git a/crates/registry-notary-server/src/standalone/runtime.rs b/crates/registry-notary-server/src/standalone/runtime.rs
deleted file mode 100644
index fdb39516a..000000000
--- a/crates/registry-notary-server/src/standalone/runtime.rs
+++ /dev/null
@@ -1,144 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Standalone Registry Notary assembly, auth, audit, and Relay activation.
-#[path = "signing/mod.rs"]
-mod signing;
-
-use std::collections::{BTreeMap, HashMap, HashSet};
-use std::env;
-use std::net::SocketAddr;
-use std::sync::atomic::{AtomicBool, AtomicU8, Ordering};
-use std::sync::{Arc, Mutex as StdMutex, RwLock};
-use std::time::{Duration, Instant, SystemTime};
-
-use tokio::sync::OnceCell;
-
-use async_trait::async_trait;
-use axum::body::Body;
-use axum::extract::{ConnectInfo, MatchedPath, Request, State};
-use axum::http::{header, HeaderMap, HeaderValue, Method, StatusCode};
-use axum::middleware::{from_fn_with_state, Next};
-use axum::response::{IntoResponse, Response};
-use axum::routing::get;
-use axum::{Json, Router};
-use base64::engine::general_purpose::URL_SAFE_NO_PAD as BASE64_URL_SAFE_NO_PAD;
-use base64::Engine as _;
-use jsonwebtoken::Algorithm;
-use registry_notary_core::deployment::{
-    evaluate_gates, DeploymentFindingStatus, EvaluatedFinding, EvaluatedWaiver, GateEvaluation,
-    FINDING_WAIVER_EXPIRED,
-};
-use registry_notary_core::sd_jwt::EvidenceIssuer;
-use registry_notary_core::{
-    AccessMode, BoundedCorrelationId, BoundedVerifiedClaims, ConfigAuditEvent, EvidenceAuditEvent,
-    EvidenceAuthProfileId, EvidenceAuthorizationDetails, EvidenceConfig, EvidenceCredentialConfig,
-    EvidenceError, EvidencePrincipal, Hashed, PrincipalIdentifier, RateLimitBucket,
-    RegistryNotaryAdminListenerMode, RequestIdentifier, SigningKeyConfig, SigningKeyProviderConfig,
-    StandaloneRegistryNotaryConfig, SubjectAccessAssuranceClaimSource, SubjectAccessClaimSource,
-    SubjectAccessDenialCode, VerifiedClaimName, VerifiedClaimValue, STATE_STORAGE_POSTGRESQL,
-};
-use registry_platform_audit::{
-    AuditError, AuditKeyHasher, AuditProfile, AuditSink as PlatformAuditSink, ChainState,
-    JsonlFileSink, JsonlStdoutSink, SyslogSink,
-};
-use registry_platform_authcommon::{
-    parse_bearer_token, verify_api_key, CredentialFingerprintRefError, FingerprintFormatError,
-};
-use registry_platform_crypto::{
-    sign, verify, KeyReadiness, LocalJwkSigner, PrivateJwk, PublicJwk, SigningProvider,
-};
-use registry_platform_httputil::{read_bounded, FetchUrlPolicy};
-use registry_platform_oidc::{
-    fetch_userinfo_jwt_with_policy, Audience, JwksFetcher, JwksFetcherConfig, OidcError,
-    TokenVerifier, TokenVerifierConfig, VerifiedToken,
-};
-use registry_platform_ops::{AckObservation, ConfigProvenance, ConfigSource};
-use registry_platform_replay::{ReplayKey, ReplayScope};
-use serde_json::{json, Map, Value};
-use subtle::ConstantTimeEq;
-use time::format_description::well_known::Rfc3339;
-use time::OffsetDateTime;
-use tower_http::timeout::{RequestBodyTimeoutLayer, TimeoutLayer};
-use ulid::Ulid;
-use zeroize::Zeroizing;
-
-#[cfg(feature = "registry-notary-cel")]
-use crate::cel_worker::{CelWorker, CelWorkerConfig};
-#[cfg(feature = "registry-notary-cel")]
-use crate::runtime::validate_cel_claims_for_startup;
-use crate::state_plane::{NotaryPostgresStatePlaneError, NotaryStatePlaneHandle};
-use crate::{
-    api::METRICS_SCOPE,
-    config_governed::ConfigGovernanceContext,
-    credential_status::CredentialStatusStore,
-    metrics::{metrics_handler, metrics_middleware, AppMetrics},
-    posture::PostureContext,
-    replay::{require_replay_insert, ReplayStores},
-    router, EvidenceAuditContext, EvidenceErrorCodeContext, EvidenceIssuerResolver, EvidenceStore,
-    RegistryNotaryApiState, SubjectAccessRateLimitKeys, SubjectAccessRateLimiter,
-};
-
-#[path = "activation.rs"]
-mod activation;
-#[path = "assembly.rs"]
-mod assembly;
-#[path = "auth/mod.rs"]
-mod auth;
-#[path = "compat.rs"]
-mod compat;
-#[path = "cors.rs"]
-mod cors;
-#[path = "deployment.rs"]
-mod deployment;
-#[cfg(feature = "registry-notary-cel")]
-#[path = "offline_fixture.rs"]
-mod offline_fixture;
-#[path = "preauth.rs"]
-mod preauth;
-#[path = "relay.rs"]
-mod relay;
-#[path = "transport/mod.rs"]
-mod transport;
-
-pub use activation::*;
-pub use assembly::*;
-use auth::*;
-pub use auth::{find_credential, ResolvedCredential};
-pub(crate) use auth::{AuditPipeline, AuthAuditState};
-pub(crate) use compat::*;
-use cors::*;
-pub(crate) use deployment::*;
-#[cfg(feature = "registry-notary-cel")]
-pub use offline_fixture::*;
-use preauth::*;
-pub(crate) use preauth::{
-    generate_numeric_tx_code, generate_opaque_token, pkce_s256_challenge, pre_auth_audit_event,
-    PreAuthAuditFields, PreAuthRuntime,
-};
-use relay::*;
-pub use signing::providers::EvidenceIssuerRegistry;
-use signing::providers::*;
-pub(crate) use signing::providers::{signing_key_public_jwk_from_config, SignerReadiness};
-pub(crate) use transport::audit_error_response;
-use transport::*;
-
-const FILE_WATCH_METADATA_CHECK_INTERVAL: Duration = Duration::from_millis(250);
-const MAX_REQUEST_URI_BYTES: usize = 8 * 1024;
-const MAX_INBOUND_REQUEST_BODY_BYTES: usize = 1024 * 1024;
-const SUBJECT_ACCESS_CORS_METHODS: &str = "GET,POST,OPTIONS";
-const OIDC_ID_TOKEN_HEADER: &str = "x-registry-notary-oidc-id-token";
-const SUBJECT_ACCESS_CORS_DEFAULT_HEADERS: &str =
-    "authorization,content-type,x-registry-notary-oidc-id-token";
-const DEPLOYMENT_PROFILE_REQUIRED_ACTION: &str =
-    "set deployment.profile: local for development, or production/evidence_grade for deployment";
-#[cfg(test)]
-mod tests {
-    include!("tests/support.inc");
-    include!("tests/assembly.inc");
-    include!("tests/auth.inc");
-    include!("tests/audit.inc");
-    include!("tests/preauth.inc");
-    include!("tests/signing.inc");
-    mod deployment_gates {
-        include!("tests/deployment_gates.rs");
-    }
-}
diff --git a/crates/registry-notary-server/src/standalone/signing/mod.rs b/crates/registry-notary-server/src/standalone/signing/mod.rs
deleted file mode 100644
index 2444ac2be..000000000
--- a/crates/registry-notary-server/src/standalone/signing/mod.rs
+++ /dev/null
@@ -1,10 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Signing-provider implementations used by the standalone server.
-
-pub(super) mod providers;
-
-#[cfg(feature = "pkcs11")]
-mod pkcs11;
-
-#[cfg(feature = "pkcs11")]
-pub(in crate::standalone) use pkcs11::Pkcs11SigningProvider;
diff --git a/crates/registry-notary-server/src/standalone/signing/pkcs11.rs b/crates/registry-notary-server/src/standalone/signing/pkcs11.rs
deleted file mode 100644
index f64009bfc..000000000
--- a/crates/registry-notary-server/src/standalone/signing/pkcs11.rs
+++ /dev/null
@@ -1,422 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! PKCS#11 signing provider implementation.
-
-use std::fmt;
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::Arc;
-use std::time::{Duration, Instant};
-
-use async_trait::async_trait;
-use cryptoki::context::{CInitializeArgs, CInitializeFlags, Pkcs11};
-use cryptoki::error::{Error as CryptokiError, RvError};
-use cryptoki::mechanism::eddsa::{EddsaParams, EddsaSignatureScheme};
-use cryptoki::mechanism::{Mechanism, MechanismType};
-use cryptoki::object::{Attribute, ObjectClass, ObjectHandle};
-use cryptoki::session::{Session, UserType};
-use cryptoki::slot::Slot;
-use cryptoki::types::AuthPin;
-use registry_notary_core::SigningKeyConfig;
-use registry_platform_crypto::{
-    verify, KeyReadiness, PublicJwk, SigningAlgorithm, SigningError, SigningProvider,
-};
-use tokio::sync::Semaphore;
-use zeroize::Zeroizing;
-
-use super::super::{invalid_signing_key, StandaloneServerError};
-
-const SELF_TEST_PAYLOAD: &[u8] = b"registry-notary pkcs11 signing self-test";
-const SIGN_TIMEOUT: Duration = Duration::from_secs(5);
-
-#[derive(Clone)]
-pub(in crate::standalone) struct Pkcs11SigningProvider {
-    key_id: String,
-    public_jwk: PublicJwk,
-    context: Arc<Pkcs11>,
-    slot: Slot,
-    pin: Arc<Zeroizing<String>>,
-    session: Arc<std::sync::Mutex<Pkcs11SessionState>>,
-    sign_permit: Arc<Semaphore>,
-    ready: Arc<AtomicBool>,
-    key_label: String,
-    key_id_bytes: Vec<u8>,
-}
-
-struct Pkcs11SessionState {
-    session: Session,
-    private_key: ObjectHandle,
-}
-
-impl Pkcs11SigningProvider {
-    pub(in crate::standalone) fn from_config(
-        config_key_id: &str,
-        config: &SigningKeyConfig,
-    ) -> Result<Self, StandaloneServerError> {
-        let public_raw = Zeroizing::new(read_required_env(
-            config_key_id,
-            &config.public_jwk_env,
-            "public_jwk_env",
-        )?);
-        let public_jwk = PublicJwk::parse(public_raw.as_str()).map_err(|_| {
-            invalid_signing_key(config_key_id, "public_jwk_env is not a valid public JWK")
-        })?;
-        if public_jwk.kid.as_deref() != Some(config.kid.as_str()) {
-            return Err(invalid_signing_key(
-                config_key_id,
-                "public JWK kid does not match configured kid",
-            ));
-        }
-        if public_jwk.alg.as_deref() != Some(config.alg.as_str()) {
-            return Err(invalid_signing_key(
-                config_key_id,
-                "public JWK alg does not match configured alg",
-            ));
-        }
-
-        let pin = Arc::new(Zeroizing::new(read_required_env(
-            config_key_id,
-            &config.pin_env,
-            "pin_env",
-        )?));
-        let key_id_bytes = hex::decode(&config.key_id_hex)
-            .map_err(|_| invalid_signing_key(config_key_id, "key_id_hex is not valid hex"))?;
-        let context = Pkcs11::new(&config.module_path)
-            .map_err(|_| invalid_signing_key(config_key_id, "could not load PKCS#11 module"))?;
-        match context.initialize(CInitializeArgs::new(CInitializeFlags::OS_LOCKING_OK)) {
-            Ok(()) | Err(CryptokiError::Pkcs11(RvError::CryptokiAlreadyInitialized, _)) => {}
-            Err(_) => {
-                return Err(invalid_signing_key(
-                    config_key_id,
-                    "could not initialize PKCS#11 module",
-                ));
-            }
-        }
-        let slot = find_token_slot(&context, config_key_id, &config.token_label)?;
-        ensure_eddsa_mechanism(&context, slot, config_key_id)?;
-        let session = open_logged_in_session(&context, slot, &pin, config_key_id)?;
-        let private_key =
-            find_private_key(&session, &config.key_label, &key_id_bytes, config_key_id)?;
-
-        let provider = Self {
-            key_id: config.kid.clone(),
-            public_jwk,
-            context: Arc::new(context),
-            slot,
-            pin,
-            session: Arc::new(std::sync::Mutex::new(Pkcs11SessionState {
-                session,
-                private_key,
-            })),
-            sign_permit: Arc::new(Semaphore::new(1)),
-            ready: Arc::new(AtomicBool::new(true)),
-            key_label: config.key_label.clone(),
-            key_id_bytes,
-        };
-        provider.self_test(config_key_id)?;
-        Ok(provider)
-    }
-
-    fn self_test(&self, config_key_id: &str) -> Result<(), StandaloneServerError> {
-        let provider = self.clone();
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let _ = tx.send(provider.sign_sync(SELF_TEST_PAYLOAD));
-        });
-        let signature = rx
-            .recv_timeout(SIGN_TIMEOUT)
-            .map_err(|_| {
-                self.mark_unhealthy();
-                invalid_signing_key(config_key_id, "PKCS#11 signer self-test timed out")
-            })?
-            .map_err(|_| invalid_signing_key(config_key_id, "PKCS#11 signer self-test failed"))?;
-        verify(SELF_TEST_PAYLOAD, &signature, &self.public_jwk).map_err(|_| {
-            invalid_signing_key(
-                config_key_id,
-                "PKCS#11 signer self-test verification failed",
-            )
-        })
-    }
-
-    fn mark_unhealthy(&self) {
-        self.ready.store(false, Ordering::SeqCst);
-    }
-
-    fn sign_sync(&self, payload: &[u8]) -> Result<Vec<u8>, SigningError> {
-        if let Ok(signature) = self.sign_with_current_session(payload) {
-            return Ok(signature);
-        }
-
-        tracing::warn!(
-            provider = "pkcs11",
-            key_id = %self.key_id,
-            "PKCS#11 sign failed with current session; reopening session"
-        );
-        let session = open_logged_in_session_for_signing(&self.context, self.slot, &self.pin)?;
-        let private_key =
-            find_private_key_for_signing(&session, &self.key_label, &self.key_id_bytes)?;
-        {
-            let mut state = self
-                .session
-                .lock()
-                .map_err(|_| SigningError::external("PKCS#11 session lock poisoned"))?;
-            state.session = session;
-            state.private_key = private_key;
-        }
-        let result = self.sign_with_current_session(payload);
-        if result.is_ok() {
-            tracing::info!(
-                provider = "pkcs11",
-                key_id = %self.key_id,
-                "PKCS#11 sign succeeded after session reopen"
-            );
-        }
-        result
-    }
-
-    fn sign_with_current_session(&self, payload: &[u8]) -> Result<Vec<u8>, SigningError> {
-        let session = self
-            .session
-            .lock()
-            .map_err(|_| SigningError::external("PKCS#11 session lock poisoned"))?;
-        let mechanism = eddsa_mechanism();
-        session
-            .session
-            .sign(&mechanism, session.private_key, payload)
-            .map_err(|_| SigningError::external("PKCS#11 sign failed"))
-    }
-}
-
-impl fmt::Debug for Pkcs11SigningProvider {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("Pkcs11SigningProvider")
-            .field("kid", &self.key_id)
-            .field("key_label", &self.key_label)
-            .finish_non_exhaustive()
-    }
-}
-
-#[async_trait]
-impl SigningProvider for Pkcs11SigningProvider {
-    fn algorithm(&self) -> SigningAlgorithm {
-        SigningAlgorithm::EdDsa
-    }
-
-    fn key_id(&self) -> &str {
-        &self.key_id
-    }
-
-    fn public_jwk(&self) -> PublicJwk {
-        self.public_jwk.clone()
-    }
-
-    async fn sign(&self, payload: &[u8]) -> Result<Vec<u8>, SigningError> {
-        if !self.ready.load(Ordering::SeqCst) {
-            tracing::warn!(
-                provider = "pkcs11",
-                key_id = %self.key_id,
-                "PKCS#11 signer is unhealthy"
-            );
-            return Err(SigningError::external("PKCS#11 signer is unhealthy"));
-        }
-        let started_at = Instant::now();
-        let permit = tokio::time::timeout(SIGN_TIMEOUT, self.sign_permit.clone().acquire_owned())
-            .await
-            .map_err(|_| {
-                tracing::warn!(
-                    provider = "pkcs11",
-                    key_id = %self.key_id,
-                    "PKCS#11 sign timed out while waiting for signing permit"
-                );
-                SigningError::external("PKCS#11 sign timed out")
-            })?
-            .map_err(|_| SigningError::external("PKCS#11 signing gate was closed"))?;
-        let remaining = SIGN_TIMEOUT.saturating_sub(started_at.elapsed());
-        if remaining.is_zero() {
-            return Err(SigningError::external("PKCS#11 sign timed out"));
-        }
-        let provider = self.clone();
-        let payload = payload.to_vec();
-        let task = tokio::task::spawn_blocking(move || {
-            let _permit = permit;
-            provider.sign_sync(&payload)
-        });
-        let result = tokio::time::timeout(remaining, task)
-            .await
-            .map_err(|_| {
-                self.mark_unhealthy();
-                tracing::error!(
-                    provider = "pkcs11",
-                    key_id = %self.key_id,
-                    "PKCS#11 sign timed out and signer was marked unhealthy"
-                );
-                SigningError::external("PKCS#11 sign timed out")
-            })?
-            .map_err(|_| SigningError::external("PKCS#11 sign task failed"))?;
-        match &result {
-            Ok(_) => tracing::debug!(
-                provider = "pkcs11",
-                key_id = %self.key_id,
-                duration_ms = started_at.elapsed().as_millis() as u64,
-                "PKCS#11 sign succeeded"
-            ),
-            Err(_) => tracing::warn!(
-                provider = "pkcs11",
-                key_id = %self.key_id,
-                duration_ms = started_at.elapsed().as_millis() as u64,
-                "PKCS#11 sign failed"
-            ),
-        }
-        result
-    }
-
-    fn readiness(&self) -> KeyReadiness {
-        if self.ready.load(Ordering::SeqCst) {
-            KeyReadiness::Ready
-        } else {
-            KeyReadiness::NotReady
-        }
-    }
-}
-
-fn read_required_env(
-    config_key_id: &str,
-    env_name: &str,
-    field: &str,
-) -> Result<String, StandaloneServerError> {
-    std::env::var(env_name)
-        .ok()
-        .filter(|value| !value.trim().is_empty())
-        .ok_or_else(|| invalid_signing_key(config_key_id, &format!("{field} is missing or empty")))
-}
-
-fn find_token_slot(
-    context: &Pkcs11,
-    config_key_id: &str,
-    token_label: &str,
-) -> Result<Slot, StandaloneServerError> {
-    let matches = context
-        .get_slots_with_token()
-        .map_err(|_| invalid_signing_key(config_key_id, "could not list PKCS#11 slots"))?
-        .into_iter()
-        .filter(|slot| {
-            context
-                .get_token_info(*slot)
-                .map(|info| info.label().trim() == token_label)
-                .unwrap_or(false)
-        })
-        .collect::<Vec<_>>();
-    match matches.as_slice() {
-        [slot] => Ok(*slot),
-        [] => Err(invalid_signing_key(
-            config_key_id,
-            "PKCS#11 token was not found",
-        )),
-        _ => Err(invalid_signing_key(
-            config_key_id,
-            "multiple PKCS#11 tokens matched token_label",
-        )),
-    }
-}
-
-fn ensure_eddsa_mechanism(
-    context: &Pkcs11,
-    slot: Slot,
-    config_key_id: &str,
-) -> Result<(), StandaloneServerError> {
-    let supported = context
-        .get_mechanism_list(slot)
-        .map_err(|_| invalid_signing_key(config_key_id, "could not list PKCS#11 mechanisms"))?;
-    if supported.contains(&MechanismType::EDDSA) {
-        Ok(())
-    } else {
-        Err(invalid_signing_key(
-            config_key_id,
-            "PKCS#11 token does not support CKM_EDDSA",
-        ))
-    }
-}
-
-fn open_logged_in_session(
-    context: &Pkcs11,
-    slot: Slot,
-    pin: &Zeroizing<String>,
-    config_key_id: &str,
-) -> Result<Session, StandaloneServerError> {
-    let session = context
-        .open_ro_session(slot)
-        .map_err(|_| invalid_signing_key(config_key_id, "PKCS#11 session open failed"))?;
-    let auth_pin = AuthPin::new(pin.as_str().to_string().into_boxed_str());
-    match session.login(UserType::User, Some(&auth_pin)) {
-        Ok(()) => Ok(session),
-        Err(CryptokiError::Pkcs11(RvError::UserAlreadyLoggedIn, _)) => Ok(session),
-        Err(_) => Err(invalid_signing_key(config_key_id, "PKCS#11 login failed")),
-    }
-}
-
-fn find_private_key(
-    session: &Session,
-    key_label: &str,
-    key_id_bytes: &[u8],
-    config_key_id: &str,
-) -> Result<ObjectHandle, StandaloneServerError> {
-    let template = vec![
-        Attribute::Class(ObjectClass::PRIVATE_KEY),
-        Attribute::Label(key_label.as_bytes().to_vec()),
-        Attribute::Id(key_id_bytes.to_vec()),
-    ];
-    let matches = session
-        .find_objects(&template)
-        .map_err(|_| invalid_signing_key(config_key_id, "PKCS#11 private-key lookup failed"))?;
-    match matches.as_slice() {
-        [handle] => Ok(*handle),
-        [] => Err(invalid_signing_key(
-            config_key_id,
-            "PKCS#11 private key was not found",
-        )),
-        _ => Err(invalid_signing_key(
-            config_key_id,
-            "multiple PKCS#11 private keys matched lookup",
-        )),
-    }
-}
-
-fn open_logged_in_session_for_signing(
-    context: &Pkcs11,
-    slot: Slot,
-    pin: &Zeroizing<String>,
-) -> Result<Session, SigningError> {
-    let session = context
-        .open_ro_session(slot)
-        .map_err(|_| SigningError::external("PKCS#11 session open failed"))?;
-    let auth_pin = AuthPin::new(pin.as_str().to_string().into_boxed_str());
-    match session.login(UserType::User, Some(&auth_pin)) {
-        Ok(()) => Ok(session),
-        Err(CryptokiError::Pkcs11(RvError::UserAlreadyLoggedIn, _)) => Ok(session),
-        Err(_) => Err(SigningError::external("PKCS#11 login failed")),
-    }
-}
-
-fn find_private_key_for_signing(
-    session: &Session,
-    key_label: &str,
-    key_id_bytes: &[u8],
-) -> Result<ObjectHandle, SigningError> {
-    let template = vec![
-        Attribute::Class(ObjectClass::PRIVATE_KEY),
-        Attribute::Label(key_label.as_bytes().to_vec()),
-        Attribute::Id(key_id_bytes.to_vec()),
-    ];
-    let matches = session
-        .find_objects(&template)
-        .map_err(|_| SigningError::external("PKCS#11 private-key lookup failed"))?;
-    match matches.as_slice() {
-        [handle] => Ok(*handle),
-        [] => Err(SigningError::external("PKCS#11 private key was not found")),
-        _ => Err(SigningError::external(
-            "multiple PKCS#11 private keys matched lookup",
-        )),
-    }
-}
-
-fn eddsa_mechanism() -> Mechanism<'static> {
-    Mechanism::Eddsa(EddsaParams::new(EddsaSignatureScheme::Ed25519))
-}
diff --git a/crates/registry-notary-server/src/standalone/signing/providers.rs b/crates/registry-notary-server/src/standalone/signing/providers.rs
deleted file mode 100644
index 407481247..000000000
--- a/crates/registry-notary-server/src/standalone/signing/providers.rs
+++ /dev/null
@@ -1,813 +0,0 @@
-use super::super::*;
-
-#[derive(Debug, Clone)]
-pub(in super::super) struct PublishedJwk {
-    public_jwk: Value,
-    publish_until_unix_seconds: Option<u64>,
-}
-
-impl PublishedJwk {
-    fn is_published_at(&self, now_unix_seconds: u64) -> bool {
-        self.publish_until_unix_seconds
-            .is_none_or(|publish_until| now_unix_seconds <= publish_until)
-    }
-}
-
-#[derive(Debug, Clone, Default)]
-pub struct EvidenceIssuerRegistry {
-    issuers: BTreeMap<String, EvidenceIssuer>,
-    public_jwks: Vec<PublishedJwk>,
-}
-
-impl EvidenceIssuerRegistry {
-    pub fn from_config(config: &EvidenceConfig) -> Result<Self, StandaloneServerError> {
-        // Without the surrounding `StandaloneRegistryNotaryConfig` this builder
-        // only sees credential-profile signing roles, so the resolved-material
-        // reuse check (#173) is confined to those here. The access-token and
-        // federation roles are checked on the real startup/apply paths
-        // (`compile_notary_runtime`, signing-key rotation), which thread the
-        // full role set through `SigningKeyRegistry::from_config`.
-        let reuse_scoped_key_ids: HashSet<&str> = config
-            .credential_profiles
-            .values()
-            .map(|profile| profile.signing_key.as_str())
-            .collect();
-        let signing_keys = SigningKeyRegistry::from_config(config, &reuse_scoped_key_ids)?;
-        Self::from_signing_keys(config, &signing_keys)
-    }
-
-    pub(in super::super) fn from_signing_keys(
-        config: &EvidenceConfig,
-        signing_keys: &SigningKeyRegistry,
-    ) -> Result<Self, StandaloneServerError> {
-        let mut issuers = BTreeMap::new();
-        for (profile_id, profile) in &config.credential_profiles {
-            let issuer = signing_keys
-                .issuer(profile.signing_key.as_str())
-                .ok_or_else(|| {
-                    invalid_signing_key(
-                        profile.signing_key.as_str(),
-                        "active signing key was not built",
-                    )
-                })?;
-            issuers.insert(profile_id.clone(), issuer.clone());
-        }
-        Ok(Self {
-            issuers,
-            public_jwks: signing_keys.public_jwks(),
-        })
-    }
-}
-
-impl EvidenceIssuerResolver for EvidenceIssuerRegistry {
-    fn issuer(&self, profile_id: &str) -> Result<EvidenceIssuer, EvidenceError> {
-        self.issuers
-            .get(profile_id)
-            .cloned()
-            .ok_or(EvidenceError::CredentialIssuerNotConfigured)
-    }
-
-    fn public_jwks(&self, _evidence: &EvidenceConfig) -> Result<Vec<Value>, EvidenceError> {
-        Ok(published_jwks_at(
-            &self.public_jwks,
-            current_unix_timestamp_seconds(),
-        ))
-    }
-}
-
-#[derive(Debug, Clone, Default)]
-pub(crate) struct SignerReadiness {
-    entries: Arc<Vec<SignerReadinessEntry>>,
-}
-
-#[derive(Debug, Clone)]
-pub(crate) struct SignerReadinessSnapshot {
-    pub(crate) kid: String,
-    pub(crate) readiness: KeyReadiness,
-}
-
-#[derive(Debug, Clone)]
-pub(in super::super) struct SignerReadinessEntry {
-    kid: String,
-    provider: SigningKeyProviderConfig,
-    required_for_signing: bool,
-    state: SignerReadinessState,
-}
-
-#[derive(Clone)]
-pub(in super::super) enum SignerReadinessState {
-    Static(KeyReadiness),
-    #[cfg_attr(not(feature = "pkcs11"), allow(dead_code))]
-    Flag(Arc<AtomicBool>),
-    Provider(Arc<dyn SigningProvider>),
-}
-
-impl std::fmt::Debug for SignerReadinessState {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Static(readiness) => f.debug_tuple("Static").field(readiness).finish(),
-            Self::Flag(_) => f.write_str("Flag(..)"),
-            Self::Provider(provider) => f
-                .debug_struct("Provider")
-                .field("kid", &provider.key_id())
-                .field("readiness", &provider.readiness())
-                .finish(),
-        }
-    }
-}
-
-impl SignerReadinessEntry {
-    fn readiness(&self) -> KeyReadiness {
-        match &self.state {
-            SignerReadinessState::Static(readiness) => *readiness,
-            SignerReadinessState::Flag(flag) if flag.load(Ordering::SeqCst) => KeyReadiness::Ready,
-            SignerReadinessState::Flag(_) => KeyReadiness::NotReady,
-            SignerReadinessState::Provider(provider) => provider.readiness(),
-        }
-    }
-}
-
-pub(in super::super) const KEY_READINESS_READY: u8 = 0;
-pub(in super::super) const KEY_READINESS_DEGRADED: u8 = 1;
-pub(in super::super) const KEY_READINESS_NOT_READY: u8 = 2;
-pub(in super::super) const KEY_READINESS_UNKNOWN: u8 = 3;
-
-pub(in super::super) fn key_readiness_to_u8(readiness: KeyReadiness) -> u8 {
-    match readiness {
-        KeyReadiness::Ready => KEY_READINESS_READY,
-        KeyReadiness::Degraded => KEY_READINESS_DEGRADED,
-        KeyReadiness::NotReady => KEY_READINESS_NOT_READY,
-        KeyReadiness::Unknown => KEY_READINESS_UNKNOWN,
-        _ => KEY_READINESS_UNKNOWN,
-    }
-}
-
-pub(in super::super) fn key_readiness_from_u8(value: u8) -> KeyReadiness {
-    match value {
-        KEY_READINESS_READY => KeyReadiness::Ready,
-        KEY_READINESS_DEGRADED => KeyReadiness::Degraded,
-        KEY_READINESS_NOT_READY => KeyReadiness::NotReady,
-        _ => KeyReadiness::Unknown,
-    }
-}
-
-impl SignerReadiness {
-    #[allow(dead_code)]
-    pub(crate) fn from_provider_flags(providers: Vec<Arc<AtomicBool>>) -> Self {
-        Self {
-            entries: Arc::new(
-                providers
-                    .into_iter()
-                    .enumerate()
-                    .map(|(index, flag)| SignerReadinessEntry {
-                        kid: format!("provider-{}", index + 1),
-                        provider: SigningKeyProviderConfig::LocalJwkEnv,
-                        required_for_signing: true,
-                        state: SignerReadinessState::Flag(flag),
-                    })
-                    .collect(),
-            ),
-        }
-    }
-
-    pub(in super::super) fn from_entries(entries: Vec<SignerReadinessEntry>) -> Self {
-        Self {
-            entries: Arc::new(entries),
-        }
-    }
-
-    pub(crate) fn total(&self) -> usize {
-        self.entries
-            .iter()
-            .filter(|entry| entry.required_for_signing)
-            .count()
-    }
-
-    pub(crate) fn ready_count(&self) -> usize {
-        self.entries
-            .iter()
-            .filter(|entry| entry.required_for_signing && entry.readiness().is_ready())
-            .count()
-    }
-
-    pub(crate) fn failed_count(&self) -> usize {
-        self.total().saturating_sub(self.ready_count())
-    }
-
-    pub(crate) fn is_ready(&self) -> bool {
-        self.failed_count() == 0
-    }
-
-    pub(crate) fn by_kid(&self) -> Vec<SignerReadinessSnapshot> {
-        self.entries
-            .iter()
-            .map(|entry| SignerReadinessSnapshot {
-                kid: entry.kid.clone(),
-                readiness: entry.readiness(),
-            })
-            .collect()
-    }
-
-    pub(crate) fn provider_counts(&self) -> BTreeMap<String, usize> {
-        let mut counts = BTreeMap::new();
-        for entry in self
-            .entries
-            .iter()
-            .filter(|entry| entry.required_for_signing)
-        {
-            *counts
-                .entry(entry.provider.as_str().to_string())
-                .or_insert(0) += 1;
-        }
-        counts
-    }
-}
-
-#[derive(Clone, Default)]
-pub(in super::super) struct SigningKeyRegistry {
-    issuers: BTreeMap<String, EvidenceIssuer>,
-    providers: BTreeMap<String, Arc<dyn SigningProvider>>,
-    public_jwks: Vec<PublishedJwk>,
-    readiness_entries: Vec<SignerReadinessEntry>,
-}
-
-impl SigningKeyRegistry {
-    pub(in super::super) fn from_config(
-        config: &EvidenceConfig,
-        reuse_scoped_key_ids: &HashSet<&str>,
-    ) -> Result<Self, StandaloneServerError> {
-        let mut issuers = BTreeMap::new();
-        let mut providers = BTreeMap::new();
-        let mut public_jwks_by_kid = BTreeMap::new();
-        let mut resolved_public_jwks = Vec::new();
-        #[cfg_attr(not(feature = "pkcs11"), allow(unused_mut))]
-        let mut readiness_entries = Vec::new();
-        for (key_id, key) in &config.signing_keys {
-            if !key.status.may_publish() {
-                continue;
-            }
-            let (public_jwk, public_jwk_for_validation) = match key.provider {
-                SigningKeyProviderConfig::LocalJwkEnv => {
-                    if key.status.may_sign() {
-                        let provider: Arc<dyn SigningProvider> =
-                            Arc::new(build_local_jwk_signer(key_id, key)?);
-                        readiness_entries.push(provider_key_readiness(
-                            key.kid.clone(),
-                            key.provider,
-                            true,
-                            Arc::clone(&provider),
-                        ));
-                        let issuer = EvidenceIssuer::from_signing_provider(Arc::clone(&provider))
-                            .map_err(|_| {
-                            invalid_signing_key(key_id, "local signer failed self-test")
-                        })?;
-                        let public_jwk = issuer.public_jwk();
-                        let public_jwk_for_validation = provider.public_jwk();
-                        issuers.insert(key_id.clone(), issuer);
-                        providers.insert(key_id.clone(), provider);
-                        (public_jwk, public_jwk_for_validation)
-                    } else {
-                        readiness_entries.push(static_key_readiness(
-                            key.kid.clone(),
-                            key.provider,
-                            false,
-                            KeyReadiness::Ready,
-                        ));
-                        let public_jwk_for_validation = build_public_jwk(key_id, key)?;
-                        let public_jwk = serde_json::to_value(public_jwk_for_validation.clone())
-                            .map_err(|_| {
-                                invalid_signing_key(key_id, "public JWK could not be serialized")
-                            })?;
-                        (public_jwk, public_jwk_for_validation)
-                    }
-                }
-                SigningKeyProviderConfig::Pkcs11 => {
-                    if key.status.may_sign() {
-                        #[cfg(feature = "pkcs11")]
-                        {
-                            let provider = super::Pkcs11SigningProvider::from_config(key_id, key)?;
-                            let provider: Arc<dyn SigningProvider> = Arc::new(provider);
-                            readiness_entries.push(provider_key_readiness(
-                                key.kid.clone(),
-                                key.provider,
-                                true,
-                                Arc::clone(&provider),
-                            ));
-                            let issuer =
-                                EvidenceIssuer::from_signing_provider(Arc::clone(&provider))
-                                    .map_err(|_| {
-                                        invalid_signing_key(
-                                            key_id,
-                                            "PKCS#11 signer failed self-test",
-                                        )
-                                    })?;
-                            let public_jwk = issuer.public_jwk();
-                            let public_jwk_for_validation = provider.public_jwk();
-                            issuers.insert(key_id.clone(), issuer);
-                            providers.insert(key_id.clone(), provider);
-                            (public_jwk, public_jwk_for_validation)
-                        }
-                        #[cfg(not(feature = "pkcs11"))]
-                        {
-                            return Err(StandaloneServerError::SigningKeyProviderUnavailable {
-                                provider: "pkcs11".to_string(),
-                            });
-                        }
-                    } else {
-                        readiness_entries.push(static_key_readiness(
-                            key.kid.clone(),
-                            key.provider,
-                            false,
-                            KeyReadiness::Ready,
-                        ));
-                        let public_jwk_for_validation = build_public_jwk(key_id, key)?;
-                        let public_jwk = serde_json::to_value(public_jwk_for_validation.clone())
-                            .map_err(|_| {
-                                invalid_signing_key(key_id, "public JWK could not be serialized")
-                            })?;
-                        (public_jwk, public_jwk_for_validation)
-                    }
-                }
-                SigningKeyProviderConfig::FileWatch => {
-                    if key.status.may_sign() {
-                        let provider = FileWatchSigningProvider::from_config(key_id, key)?;
-                        let provider: Arc<dyn SigningProvider> = Arc::new(provider);
-                        readiness_entries.push(provider_key_readiness(
-                            key.kid.clone(),
-                            key.provider,
-                            true,
-                            Arc::clone(&provider),
-                        ));
-                        let issuer = EvidenceIssuer::from_signing_provider(Arc::clone(&provider))
-                            .map_err(|_| {
-                            invalid_signing_key(key_id, "file-watch signer failed self-test")
-                        })?;
-                        let public_jwk = issuer.public_jwk();
-                        let public_jwk_for_validation = provider.public_jwk();
-                        issuers.insert(key_id.clone(), issuer);
-                        providers.insert(key_id.clone(), provider);
-                        (public_jwk, public_jwk_for_validation)
-                    } else {
-                        continue;
-                    }
-                }
-                SigningKeyProviderConfig::LocalPkcs12File => {
-                    return Err(StandaloneServerError::SigningKeyProviderUnavailable {
-                        provider: "local_pkcs12_file".to_string(),
-                    });
-                }
-                _ => {
-                    return Err(StandaloneServerError::SigningKeyProviderUnavailable {
-                        provider: "unsupported".to_string(),
-                    });
-                }
-            };
-            resolved_public_jwks.push((key_id.clone(), public_jwk_for_validation));
-            public_jwks_by_kid.insert(
-                key.kid.clone(),
-                PublishedJwk {
-                    public_jwk,
-                    publish_until_unix_seconds: key.publish_until_unix_seconds,
-                },
-            );
-        }
-        config.validate_resolved_signing_key_material(
-            resolved_public_jwks
-                .iter()
-                .map(|(key_id, public_jwk)| (key_id.as_str(), public_jwk)),
-            reuse_scoped_key_ids,
-        )?;
-        Ok(Self {
-            issuers,
-            providers,
-            public_jwks: public_jwks_by_kid.into_values().collect(),
-            readiness_entries,
-        })
-    }
-
-    pub(in super::super) fn issuer(&self, key_id: &str) -> Option<&EvidenceIssuer> {
-        self.issuers.get(key_id)
-    }
-
-    pub(in super::super) fn public_jwks(&self) -> Vec<PublishedJwk> {
-        self.public_jwks.clone()
-    }
-
-    pub(in super::super) fn signing_provider(
-        &self,
-        key_id: &str,
-    ) -> Option<Arc<dyn SigningProvider>> {
-        self.providers.get(key_id).cloned()
-    }
-
-    /// The public JWK for an active signing key, resolved by its config
-    /// `key_id`. Used to seed the in-process Notary token verifier without an
-    /// HTTP JWKS round-trip.
-    pub(in super::super) fn signer_readiness(&self) -> SignerReadiness {
-        SignerReadiness::from_entries(self.readiness_entries.clone())
-    }
-}
-
-pub(crate) fn signing_key_public_jwk_from_config(
-    config: &EvidenceConfig,
-    key_id: &str,
-) -> Result<Option<PublicJwk>, StandaloneServerError> {
-    let Some(key) = config.signing_keys.get(key_id) else {
-        return Ok(None);
-    };
-    if !key.status.may_publish() {
-        return Ok(None);
-    }
-    if key.status.may_sign() {
-        return match key.provider {
-            SigningKeyProviderConfig::LocalJwkEnv => {
-                Ok(Some(build_local_jwk_signer(key_id, key)?.public_jwk()))
-            }
-            SigningKeyProviderConfig::FileWatch => Ok(Some(
-                load_file_watch_jwk_signer(key_id, key, std::path::Path::new(&key.path))?
-                    .public_jwk(),
-            )),
-            SigningKeyProviderConfig::Pkcs11 => {
-                #[cfg(feature = "pkcs11")]
-                {
-                    Ok(Some(
-                        super::Pkcs11SigningProvider::from_config(key_id, key)?.public_jwk(),
-                    ))
-                }
-                #[cfg(not(feature = "pkcs11"))]
-                {
-                    Err(StandaloneServerError::SigningKeyProviderUnavailable {
-                        provider: "pkcs11".to_string(),
-                    })
-                }
-            }
-            SigningKeyProviderConfig::LocalPkcs12File => {
-                Err(StandaloneServerError::SigningKeyProviderUnavailable {
-                    provider: "local_pkcs12_file".to_string(),
-                })
-            }
-            _ => Err(StandaloneServerError::SigningKeyProviderUnavailable {
-                provider: "unsupported".to_string(),
-            }),
-        };
-    }
-    let value = build_public_jwk_value(key_id, key)?;
-    serde_json::from_value(value)
-        .map(Some)
-        .map_err(|_| invalid_signing_key(key_id, "public JWK could not be deserialized"))
-}
-
-pub(in super::super) fn published_jwks_at(
-    public_jwks: &[PublishedJwk],
-    now_unix_seconds: u64,
-) -> Vec<Value> {
-    public_jwks
-        .iter()
-        .filter(|entry| entry.is_published_at(now_unix_seconds))
-        .map(|entry| entry.public_jwk.clone())
-        .collect()
-}
-
-pub(in super::super) fn current_unix_timestamp_seconds() -> u64 {
-    u64::try_from(OffsetDateTime::now_utc().unix_timestamp()).unwrap_or(0)
-}
-
-pub(in super::super) fn static_key_readiness(
-    kid: String,
-    provider: SigningKeyProviderConfig,
-    required_for_signing: bool,
-    readiness: KeyReadiness,
-) -> SignerReadinessEntry {
-    SignerReadinessEntry {
-        kid,
-        provider,
-        required_for_signing,
-        state: SignerReadinessState::Static(readiness),
-    }
-}
-
-pub(in super::super) fn provider_key_readiness(
-    kid: String,
-    provider_kind: SigningKeyProviderConfig,
-    required_for_signing: bool,
-    provider: Arc<dyn SigningProvider>,
-) -> SignerReadinessEntry {
-    SignerReadinessEntry {
-        kid,
-        provider: provider_kind,
-        required_for_signing,
-        state: SignerReadinessState::Provider(provider),
-    }
-}
-
-pub(in super::super) fn build_local_jwk_signer(
-    key_id: &str,
-    key: &SigningKeyConfig,
-) -> Result<LocalJwkSigner, StandaloneServerError> {
-    let raw = Zeroizing::new(
-        env::var(&key.private_jwk_env)
-            .ok()
-            .filter(|value| !value.is_empty())
-            .ok_or_else(|| invalid_signing_key(key_id, "private_jwk_env is missing or empty"))?,
-    );
-    build_private_jwk_signer_from_raw(key_id, key, raw.as_str(), "private_jwk_env")
-}
-
-pub(in super::super) fn build_private_jwk_signer_from_raw(
-    key_id: &str,
-    key: &SigningKeyConfig,
-    raw: &str,
-    source: &str,
-) -> Result<LocalJwkSigner, StandaloneServerError> {
-    let mut jwk = PrivateJwk::parse(raw).map_err(|_| {
-        invalid_signing_key(
-            key_id,
-            &format!("{source} does not contain a valid private JWK"),
-        )
-    })?;
-    if jwk.kid.as_deref().is_some_and(|kid| kid != key.kid) {
-        return Err(invalid_signing_key(
-            key_id,
-            "private JWK kid does not match configured kid",
-        ));
-    }
-    if jwk.alg.as_deref().is_some_and(|alg| alg != key.alg) {
-        return Err(invalid_signing_key(
-            key_id,
-            "private JWK alg does not match configured alg",
-        ));
-    }
-    jwk.kid = Some(key.kid.clone());
-    jwk.alg = Some(key.alg.clone());
-    let public = jwk.public();
-    let signature = sign(b"registry-notary signing self-test", &jwk)
-        .map_err(|_| invalid_signing_key(key_id, "local signer self-test failed"))?;
-    verify(b"registry-notary signing self-test", &signature, &public)
-        .map_err(|_| invalid_signing_key(key_id, "local signer self-test verification failed"))?;
-    LocalJwkSigner::new(jwk)
-        .map_err(|_| invalid_signing_key(key_id, "local signer could not be constructed"))
-}
-
-#[derive(Clone)]
-pub(in super::super) struct FileWatchSigningProvider {
-    config_key_id: String,
-    key_config: SigningKeyConfig,
-    path: std::path::PathBuf,
-    expected_public_jwk: PublicJwk,
-    signer: Arc<StdMutex<LocalJwkSigner>>,
-    pub(in super::super) file_state: Arc<StdMutex<FileWatchFileState>>,
-    readiness: Arc<AtomicU8>,
-    algorithm: registry_platform_crypto::SigningAlgorithm,
-}
-
-#[derive(Clone, Debug)]
-pub(in super::super) struct FileWatchFileState {
-    last_modified: Option<SystemTime>,
-    last_content_digest: Option<[u8; 32]>,
-    pub(in super::super) last_checked: Instant,
-    metadata_missing: bool,
-}
-
-impl FileWatchSigningProvider {
-    pub(in super::super) fn from_config(
-        key_id: &str,
-        key: &SigningKeyConfig,
-    ) -> Result<Self, StandaloneServerError> {
-        let path = std::path::PathBuf::from(&key.path);
-        let signer = load_file_watch_jwk_signer(key_id, key, &path)?;
-        let last_modified = file_watch_key_file_modified(key_id, &path)?;
-        let last_content_digest = file_watch_key_file_content_digest(key_id, &path).ok();
-        Ok(Self {
-            config_key_id: key_id.to_string(),
-            key_config: key.clone(),
-            path,
-            expected_public_jwk: signer.public_jwk(),
-            algorithm: signer.algorithm(),
-            signer: Arc::new(StdMutex::new(signer)),
-            file_state: Arc::new(StdMutex::new(FileWatchFileState {
-                last_modified: Some(last_modified),
-                last_content_digest,
-                last_checked: Instant::now(),
-                metadata_missing: false,
-            })),
-            readiness: Arc::new(AtomicU8::new(key_readiness_to_u8(KeyReadiness::Ready))),
-        })
-    }
-
-    fn readiness(&self) -> KeyReadiness {
-        self.refresh();
-        key_readiness_from_u8(self.readiness.load(Ordering::SeqCst))
-    }
-
-    fn current_signer(&self) -> LocalJwkSigner {
-        self.refresh();
-        self.signer
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-            .clone()
-    }
-
-    fn refresh(&self) {
-        let now = Instant::now();
-        {
-            let mut state = self
-                .file_state
-                .lock()
-                .unwrap_or_else(|poisoned| poisoned.into_inner());
-            if now.duration_since(state.last_checked) < FILE_WATCH_METADATA_CHECK_INTERVAL {
-                return;
-            }
-            state.last_checked = now;
-        }
-
-        let modified = match file_watch_key_file_modified(&self.config_key_id, &self.path) {
-            Ok(modified) => modified,
-            Err(err) => {
-                let mut state = self
-                    .file_state
-                    .lock()
-                    .unwrap_or_else(|poisoned| poisoned.into_inner());
-                if !state.metadata_missing {
-                    tracing::warn!(
-                        key_id = %self.config_key_id,
-                        kid = %self.key_config.kid,
-                        error = %err,
-                        "file_watch signing key metadata refresh failed; keeping last good signer"
-                    );
-                }
-                state.last_modified = None;
-                state.metadata_missing = true;
-                self.readiness.store(
-                    key_readiness_to_u8(KeyReadiness::Degraded),
-                    Ordering::SeqCst,
-                );
-                return;
-            }
-        };
-
-        // Compute a content digest to detect same-mtime replacements (e.g. cp -p,
-        // snapshot restore, coarse filesystem timestamp resolution). This read
-        // happens at most once per debounce window, so for tiny key files it is
-        // effectively free.
-        let content_digest =
-            file_watch_key_file_content_digest(&self.config_key_id, &self.path).ok();
-
-        {
-            let mut state = self
-                .file_state
-                .lock()
-                .unwrap_or_else(|poisoned| poisoned.into_inner());
-            let mtime_unchanged = !state.metadata_missing && state.last_modified == Some(modified);
-            let digest_unchanged =
-                content_digest.is_some() && state.last_content_digest == content_digest;
-            if mtime_unchanged && digest_unchanged {
-                return;
-            }
-            state.last_modified = Some(modified);
-            state.last_content_digest = content_digest;
-            state.metadata_missing = false;
-        }
-
-        match load_file_watch_jwk_signer(&self.config_key_id, &self.key_config, &self.path) {
-            Ok(signer) if signer.public_jwk() == self.expected_public_jwk => {
-                *self
-                    .signer
-                    .lock()
-                    .unwrap_or_else(|poisoned| poisoned.into_inner()) = signer;
-                self.readiness
-                    .store(key_readiness_to_u8(KeyReadiness::Ready), Ordering::SeqCst);
-            }
-            Ok(_) => {
-                tracing::warn!(
-                    key_id = %self.config_key_id,
-                    kid = %self.key_config.kid,
-                    "file_watch signing key reload produced a different public key; keeping last good signer"
-                );
-                self.readiness.store(
-                    key_readiness_to_u8(KeyReadiness::Degraded),
-                    Ordering::SeqCst,
-                );
-            }
-            Err(err) => {
-                tracing::warn!(
-                    key_id = %self.config_key_id,
-                    kid = %self.key_config.kid,
-                    error = %err,
-                    "file_watch signing key reload failed; keeping last good signer"
-                );
-                self.readiness.store(
-                    key_readiness_to_u8(KeyReadiness::Degraded),
-                    Ordering::SeqCst,
-                );
-            }
-        }
-    }
-}
-
-impl std::fmt::Debug for FileWatchSigningProvider {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("FileWatchSigningProvider")
-            .field("kid", &self.key_config.kid)
-            .field("alg", &self.algorithm)
-            .field("readiness", &self.readiness())
-            .finish_non_exhaustive()
-    }
-}
-
-#[async_trait]
-impl SigningProvider for FileWatchSigningProvider {
-    fn algorithm(&self) -> registry_platform_crypto::SigningAlgorithm {
-        self.algorithm
-    }
-
-    fn key_id(&self) -> &str {
-        &self.key_config.kid
-    }
-
-    fn public_jwk(&self) -> PublicJwk {
-        self.current_signer().public_jwk()
-    }
-
-    async fn sign(
-        &self,
-        payload: &[u8],
-    ) -> Result<Vec<u8>, registry_platform_crypto::SigningError> {
-        self.current_signer().sign(payload).await
-    }
-
-    fn readiness(&self) -> KeyReadiness {
-        self.readiness()
-    }
-}
-
-pub(in super::super) fn file_watch_key_file_modified(
-    key_id: &str,
-    path: &std::path::Path,
-) -> Result<SystemTime, StandaloneServerError> {
-    std::fs::metadata(path)
-        .and_then(|metadata| metadata.modified())
-        .map_err(|_| invalid_signing_key(key_id, "file_watch key file metadata could not be read"))
-}
-
-pub(in super::super) fn file_watch_key_file_content_digest(
-    key_id: &str,
-    path: &std::path::Path,
-) -> Result<[u8; 32], StandaloneServerError> {
-    let bytes = std::fs::read(path)
-        .map_err(|_| invalid_signing_key(key_id, "file_watch key file could not be read"))?;
-    Ok(<sha2::Sha256 as sha2::Digest>::digest(&bytes).into())
-}
-
-pub(in super::super) fn load_file_watch_jwk_signer(
-    key_id: &str,
-    key: &SigningKeyConfig,
-    path: &std::path::Path,
-) -> Result<LocalJwkSigner, StandaloneServerError> {
-    let raw = Zeroizing::new(
-        std::fs::read_to_string(path)
-            .map_err(|_| invalid_signing_key(key_id, "file_watch key file could not be read"))?,
-    );
-    build_private_jwk_signer_from_raw(key_id, key, raw.as_str(), "file_watch key file")
-}
-
-pub(in super::super) fn build_public_jwk_value(
-    key_id: &str,
-    key: &SigningKeyConfig,
-) -> Result<Value, StandaloneServerError> {
-    let public = build_public_jwk(key_id, key)?;
-    serde_json::to_value(public)
-        .map_err(|_| invalid_signing_key(key_id, "public JWK could not be serialized"))
-}
-
-pub(in super::super) fn build_public_jwk(
-    key_id: &str,
-    key: &SigningKeyConfig,
-) -> Result<PublicJwk, StandaloneServerError> {
-    let raw = env::var(&key.public_jwk_env)
-        .ok()
-        .filter(|value| !value.is_empty())
-        .ok_or_else(|| invalid_signing_key(key_id, "public_jwk_env is missing or empty"))?;
-    let public = PublicJwk::parse(&raw).map_err(|_| {
-        invalid_signing_key(key_id, "public_jwk_env does not contain a valid public JWK")
-    })?;
-    if public.kid.as_deref() != Some(key.kid.as_str()) {
-        return Err(invalid_signing_key(
-            key_id,
-            "public JWK kid does not match configured kid",
-        ));
-    }
-    if public.alg.as_deref() != Some(key.alg.as_str()) {
-        return Err(invalid_signing_key(
-            key_id,
-            "public JWK alg does not match configured alg",
-        ));
-    }
-    Ok(public)
-}
-
-pub(in super::super) fn invalid_signing_key(key: &str, reason: &str) -> StandaloneServerError {
-    StandaloneServerError::InvalidSigningKey {
-        key: key.to_string(),
-        reason: reason.to_string(),
-    }
-}
diff --git a/crates/registry-notary-server/src/standalone/tests/assembly.inc b/crates/registry-notary-server/src/standalone/tests/assembly.inc
deleted file mode 100644
index 71d104aee..000000000
--- a/crates/registry-notary-server/src/standalone/tests/assembly.inc
+++ /dev/null
@@ -1,348 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Characterization coverage for static Notary route security policy.
-
-#[derive(Clone, Copy, Debug)]
-enum CharacterizedListener {
-    Public,
-    Admin,
-}
-
-#[derive(Clone, Copy, Debug)]
-enum CharacterizedMethod {
-    Get,
-    Post,
-}
-
-impl CharacterizedMethod {
-    fn unsupported_method(self) -> Method {
-        match self {
-            Self::Get => Method::POST,
-            Self::Post => Method::GET,
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug)]
-enum CharacterizedAuth {
-    Exempt,
-    Protected,
-    ConfigurableOpenApi,
-}
-
-#[derive(Clone, Copy, Debug)]
-struct RouteSecurityCharacterization {
-    matched_path: &'static str,
-    sample_path: &'static str,
-    listener: CharacterizedListener,
-    method: CharacterizedMethod,
-    auth: CharacterizedAuth,
-    wallet_cors: bool,
-    proof_precheck_before_auth: bool,
-}
-
-#[tokio::test]
-async fn static_api_routes_preserve_listener_and_middleware_security_policy() {
-    use CharacterizedAuth::{ConfigurableOpenApi, Exempt, Protected};
-    use CharacterizedListener::{Admin, Public};
-    use CharacterizedMethod::{Get, Post};
-
-    let routes = [
-        RouteSecurityCharacterization {
-            matched_path: "/healthz",
-            sample_path: "/healthz",
-            listener: Public,
-            method: Get,
-            auth: Exempt,
-            wallet_cors: false,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/ready",
-            sample_path: "/ready",
-            listener: Public,
-            method: Get,
-            auth: Exempt,
-            wallet_cors: false,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/openapi.json",
-            sample_path: "/openapi.json",
-            listener: Public,
-            method: Get,
-            auth: ConfigurableOpenApi,
-            wallet_cors: false,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/docs",
-            sample_path: "/docs",
-            listener: Public,
-            method: Get,
-            auth: Exempt,
-            wallet_cors: false,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/docs/scalar.js",
-            sample_path: "/docs/scalar.js",
-            listener: Public,
-            method: Get,
-            auth: Exempt,
-            wallet_cors: false,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/.well-known/evidence-service",
-            sample_path: "/.well-known/evidence-service",
-            listener: Public,
-            method: Get,
-            auth: Protected,
-            wallet_cors: true,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/.well-known/evidence/jwks.json",
-            sample_path: "/.well-known/evidence/jwks.json",
-            listener: Public,
-            method: Get,
-            auth: Exempt,
-            wallet_cors: true,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/.well-known/openid-credential-issuer",
-            sample_path: "/.well-known/openid-credential-issuer",
-            listener: Public,
-            method: Get,
-            auth: Exempt,
-            wallet_cors: true,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/credentials/{*vct_path}",
-            sample_path: "/credentials/person-is-alive",
-            listener: Public,
-            method: Get,
-            auth: Exempt,
-            wallet_cors: true,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/.well-known/vct/{*vct_path}",
-            sample_path: "/.well-known/vct/person-is-alive",
-            listener: Public,
-            method: Get,
-            auth: Exempt,
-            wallet_cors: true,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/oid4vci/offer/start",
-            sample_path: "/oid4vci/offer/start",
-            listener: Public,
-            method: Get,
-            auth: Exempt,
-            wallet_cors: false,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/oid4vci/offer/callback",
-            sample_path: "/oid4vci/offer/callback",
-            listener: Public,
-            method: Get,
-            auth: Exempt,
-            wallet_cors: false,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/oid4vci/token",
-            sample_path: "/oid4vci/token",
-            listener: Public,
-            method: Post,
-            auth: Exempt,
-            wallet_cors: false,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/oid4vci/credential",
-            sample_path: "/oid4vci/credential",
-            listener: Public,
-            method: Post,
-            auth: Protected,
-            wallet_cors: true,
-            proof_precheck_before_auth: true,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/v1/claims",
-            sample_path: "/v1/claims",
-            listener: Public,
-            method: Get,
-            auth: Protected,
-            wallet_cors: true,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/v1/claims/{claim_id}",
-            sample_path: "/v1/claims/person-is-alive",
-            listener: Public,
-            method: Get,
-            auth: Protected,
-            wallet_cors: true,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/v1/formats",
-            sample_path: "/v1/formats",
-            listener: Public,
-            method: Get,
-            auth: Protected,
-            wallet_cors: true,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/v1/evaluations",
-            sample_path: "/v1/evaluations",
-            listener: Public,
-            method: Post,
-            auth: Protected,
-            wallet_cors: true,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/v1/batch-evaluations",
-            sample_path: "/v1/batch-evaluations",
-            listener: Public,
-            method: Post,
-            auth: Protected,
-            wallet_cors: true,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/v1/evaluations/{evaluation_id}/render",
-            sample_path: "/v1/evaluations/evaluation-1/render",
-            listener: Public,
-            method: Post,
-            auth: Protected,
-            wallet_cors: true,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/v1/credentials",
-            sample_path: "/v1/credentials",
-            listener: Public,
-            method: Post,
-            auth: Protected,
-            wallet_cors: true,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/v1/credentials/{credential_id}/status",
-            sample_path: "/v1/credentials/credential-1/status",
-            listener: Public,
-            method: Get,
-            auth: Exempt,
-            wallet_cors: true,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/admin/v1/capabilities",
-            sample_path: "/admin/v1/capabilities",
-            listener: Admin,
-            method: Get,
-            auth: Protected,
-            wallet_cors: false,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/admin/v1/posture",
-            sample_path: "/admin/v1/posture",
-            listener: Admin,
-            method: Get,
-            auth: Protected,
-            wallet_cors: false,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/admin/v1/reload",
-            sample_path: "/admin/v1/reload",
-            listener: Admin,
-            method: Post,
-            auth: Protected,
-            wallet_cors: false,
-            proof_precheck_before_auth: false,
-        },
-        RouteSecurityCharacterization {
-            matched_path: "/admin/v1/credentials/{credential_id}/status",
-            sample_path: "/admin/v1/credentials/credential-1/status",
-            listener: Admin,
-            method: Post,
-            auth: Protected,
-            wallet_cors: false,
-            proof_precheck_before_auth: false,
-        },
-    ];
-
-    let public = TestServer::new(crate::api::public_router());
-    let admin = TestServer::new(crate::api::admin_router());
-    let protected_openapi = AuthExemptionPolicy {
-        openapi_requires_auth: true,
-    };
-    let public_openapi = AuthExemptionPolicy {
-        openapi_requires_auth: false,
-    };
-
-    for route in routes {
-        let (mounted, other) = match route.listener {
-            Public => (&public, &admin),
-            Admin => (&admin, &public),
-        };
-        let unsupported_method = route.method.unsupported_method();
-        assert_eq!(
-            mounted
-                .method(unsupported_method.clone(), route.sample_path)
-                .await
-                .status_code(),
-            StatusCode::METHOD_NOT_ALLOWED,
-            "{} must be mounted on its characterized {:?} listener",
-            route.matched_path,
-            route.listener
-        );
-        assert_eq!(
-            other
-                .method(unsupported_method, route.sample_path)
-                .await
-                .status_code(),
-            StatusCode::NOT_FOUND,
-            "{} must not be mounted on the other listener",
-            route.matched_path
-        );
-
-        let expected_auth = match route.auth {
-            Exempt => (true, true),
-            Protected => (false, false),
-            ConfigurableOpenApi => (false, true),
-        };
-        assert_eq!(
-            (
-                is_auth_exempt_path(route.matched_path, protected_openapi),
-                is_auth_exempt_path(route.matched_path, public_openapi),
-            ),
-            expected_auth,
-            "{} auth-exemption policy changed",
-            route.matched_path
-        );
-        assert_eq!(
-            is_subject_access_wallet_cors_path(route.sample_path),
-            route.wallet_cors,
-            "{} wallet CORS classification changed",
-            route.matched_path
-        );
-        assert_eq!(
-            crate::api::oid4vci_proof_precheck_applies(route.sample_path),
-            route.proof_precheck_before_auth,
-            "{} proof-precheck classification changed",
-            route.matched_path
-        );
-    }
-}
diff --git a/crates/registry-notary-server/src/standalone/tests/audit.inc b/crates/registry-notary-server/src/standalone/tests/audit.inc
deleted file mode 100644
index ef0580428..000000000
--- a/crates/registry-notary-server/src/standalone/tests/audit.inc
+++ /dev/null
@@ -1,563 +0,0 @@
-    // SPDX-License-Identifier: Apache-2.0
-
-    #[test]
-    fn request_identifier_hashes_are_deterministic_and_non_raw() {
-        let hasher = AuditKeyHasher::unkeyed_dev_only();
-
-        let first = Hashed::<RequestIdentifier>::from_hash(hasher.hash("request-jti-1"));
-        let again = Hashed::<RequestIdentifier>::from_hash(hasher.hash("request-jti-1"));
-        let other = Hashed::<RequestIdentifier>::from_hash(hasher.hash("request-jti-2"));
-
-        assert_eq!(first, again);
-        assert_ne!(first, other);
-        assert_ne!(first.as_str(), "request-jti-1");
-    }
-
-    #[test]
-    fn relay_consultation_ids_are_preserved_in_restricted_audit() {
-        let consultation_id = "01HX0000000000000000000001".to_string();
-        let mut response = StatusCode::OK.into_response();
-        response.extensions_mut().insert(EvidenceAuditContext {
-            verification_decision: Some("evaluate".to_string()),
-            relay_consultation_count: Some(1),
-            relay_consultation_ids: vec![consultation_id.clone()],
-            forwarded: Some(true),
-            ..EvidenceAuditContext::default()
-        });
-
-        let event = build_audit_event(
-            None,
-            &AuditKeyHasher::unkeyed_dev_only(),
-            "POST",
-            "/v1/evaluations",
-            BoundedCorrelationId::new("req-relay-1")
-                .expect("test correlation id is bounded"),
-            &response,
-        );
-
-        assert_eq!(event.relay_consultation_ids, vec![consultation_id]);
-        assert_eq!(event.relay_consultation_count, Some(1));
-        assert_eq!(event.forwarded, Some(true));
-    }
-
-    fn audit_event() -> EvidenceAuditEvent {
-        EvidenceAuditEvent {
-            event_id: "01HX0000000000000000000000".to_string(),
-            occurred_at: "2026-05-22T00:00:00Z".to_string(),
-            principal_id_hash: Some(Hashed::from_hash("sha256:caseworker")),
-            scopes_used: vec!["registry_notary:admin".to_string()],
-            decision: "allowed".to_string(),
-            method: "GET".to_string(),
-            path: "/v1/claims".to_string(),
-            status: 200,
-            verification_id: None,
-            claim_hash: None,
-            purposes: None,
-            row_count: None,
-            relay_consultation_count: None,
-            relay_consultation_ids: Vec::new(),
-            forwarded: None,
-            error_code: None,
-            access_mode: Some(AccessMode::MachineClient),
-            federation_peer_id_hash: None,
-            federation_issuer: None,
-            federation_profile: None,
-            federation_purpose: None,
-            federation_request_jti_hash: None,
-            federation_subject_ref_hash: None,
-            denial_code: None,
-            token_claim_name: None,
-            correlation_id_hash: None,
-            credential_profile: None,
-            protocol: None,
-            credential_configuration_id: None,
-            holder_binding_mode: None,
-            rate_limit_bucket: None,
-            policy_version: None,
-            policy_hash: None,
-            target_type: None,
-            target_ref_hash: None,
-            requester_type: None,
-            requester_ref_hash: None,
-            redacted_fields: None,
-            batch_items: None,
-            config: None,
-        }
-    }
-
-    fn test_audit_config(sink: &str) -> registry_notary_core::EvidenceAuditConfig {
-        std::env::set_var(
-            TEST_AUDIT_HASH_SECRET_ENV,
-            "0123456789abcdef0123456789abcdef",
-        );
-        registry_notary_core::EvidenceAuditConfig {
-            sink: sink.to_string(),
-            hash_secret_env: Some(TEST_AUDIT_HASH_SECRET_ENV.to_string()),
-            ..registry_notary_core::EvidenceAuditConfig::default()
-        }
-    }
-
-    #[test]
-    fn audit_event_carries_subject_access_context_fields() {
-        let principal = EvidencePrincipal {
-            auth_profile_id: EvidenceAuthProfileId::ExternalOidc,
-            principal_id: "citizen".to_string(),
-            scopes: vec!["subject_access".to_string()],
-            access_mode: AccessMode::MachineClient,
-            verified_claims: None,
-            authorization_details: None,
-        };
-        let mut response = StatusCode::FORBIDDEN.into_response();
-        response.extensions_mut().insert(EvidenceAuditContext {
-            verification_id: None,
-            verification_decision: Some("evaluate_denied".to_string()),
-            claim_hash: Some("sha256:claim-hash".to_string()),
-            purposes: None,
-            row_count: None,
-            relay_consultation_count: None,
-            relay_consultation_ids: Vec::new(),
-            forwarded: None,
-            access_mode: Some(AccessMode::SubjectBound),
-            denial_code: Some(SubjectAccessDenialCode::SubjectMismatch),
-            token_claim_name: Some(
-                registry_notary_core::ConfigMetadata::new("national_id").expect("bounded"),
-            ),
-            credential_profile: None,
-            protocol: Some(
-                registry_notary_core::ConfigMetadata::new("openid4vci").expect("bounded"),
-            ),
-            credential_configuration_id: Some(
-                registry_notary_core::ConfigMetadata::new("person_is_alive_sd_jwt")
-                    .expect("bounded"),
-            ),
-            holder_binding_mode: None,
-            rate_limit_bucket: None,
-            policy_hash: None,
-            target_type: Some("person".to_string()),
-            target_ref_hash: Some(Hashed::from_hash("sha256:target")),
-            requester_type: Some("person".to_string()),
-            requester_ref_hash: Some(Hashed::from_hash("sha256:requester")),
-            batch_items: None,
-            ..EvidenceAuditContext::default()
-        });
-
-        let event = build_audit_event(
-            Some(&principal),
-            &AuditKeyHasher::unkeyed_dev_only(),
-            "POST",
-            "/v1/evaluations",
-            BoundedCorrelationId::new("req-123").expect("test correlation id is bounded"),
-            &response,
-        );
-
-        assert_eq!(event.decision, "evaluate_denied");
-        assert_eq!(event.claim_hash.as_deref(), Some("sha256:claim-hash"));
-        assert_eq!(event.access_mode, Some(AccessMode::SubjectBound));
-        assert!(event.principal_id_hash.is_some());
-        let expected_correlation_hash = AuditKeyHasher::unkeyed_dev_only().hash("req-123");
-        assert_eq!(
-            event.correlation_id_hash.as_ref().map(Hashed::as_str),
-            Some(expected_correlation_hash.as_str())
-        );
-        assert_eq!(
-            event.denial_code,
-            Some(SubjectAccessDenialCode::SubjectMismatch)
-        );
-        assert_eq!(
-            event.protocol.as_ref().map(|value| value.as_str()),
-            Some("openid4vci")
-        );
-        assert_eq!(
-            event
-                .credential_configuration_id
-                .as_ref()
-                .map(|value| value.as_str()),
-            Some("person_is_alive_sd_jwt")
-        );
-        assert_eq!(event.target_type.as_deref(), Some("person"));
-        assert_eq!(
-            event.target_ref_hash.as_ref().map(Hashed::as_str),
-            Some("sha256:target")
-        );
-        assert_eq!(event.requester_type.as_deref(), Some("person"));
-        assert_eq!(
-            event.requester_ref_hash.as_ref().map(Hashed::as_str),
-            Some("sha256:requester")
-        );
-    }
-
-    #[tokio::test]
-    async fn audit_pipeline_emits_chained_jsonl() {
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let path = tmp.path().join("audit.jsonl");
-        let audit = AuditPipeline::for_sink_dev_only(Arc::new(JsonlFileSink::new(&path)));
-
-        audit
-            .emit(&audit_event())
-            .await
-            .expect("audit write succeeds");
-
-        let output = std::fs::read_to_string(path).expect("audit output is readable");
-        assert!(output.ends_with('\n'));
-        assert_eq!(output.lines().count(), 1);
-
-        let line: Value = serde_json::from_str(output.trim_end()).expect("audit line is JSON");
-        assert!(line["envelope_id"].as_str().is_some());
-        assert_eq!(
-            line["record"]["event_id"],
-            json!("01HX0000000000000000000000")
-        );
-        assert!(line["record"]["principal_id_hash"]
-            .as_str()
-            .is_some_and(|value| value.starts_with("sha256:")));
-        assert!(line["record"].get("principal_id").is_none());
-        assert!(line["record"].get("fields").is_none());
-        assert!(line["record"].get("audit").is_none());
-    }
-
-    #[tokio::test]
-    async fn eager_audit_verification_accepts_valid_retained_chain() {
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let path = tmp.path().join("audit.jsonl");
-        {
-            let audit = AuditPipeline::for_sink_dev_only(Arc::new(JsonlFileSink::new(&path)));
-            audit.emit(&audit_event()).await.expect("audit write succeeds");
-        }
-
-        let audit = AuditPipeline::for_sink_dev_only(Arc::new(JsonlFileSink::new(&path)));
-        audit
-            .verify_chain_eager()
-            .await
-            .expect("valid retained chain verifies");
-        assert!(audit.chain_healthy());
-    }
-
-    #[tokio::test]
-    async fn integrity_failure_latches_audit_readiness_monotonically() {
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let path = tmp.path().join("audit.jsonl");
-        {
-            let audit = AuditPipeline::for_sink_dev_only(Arc::new(JsonlFileSink::new(&path)));
-            audit.emit(&audit_event()).await.expect("audit write succeeds");
-        }
-        let original = std::fs::read_to_string(&path).expect("audit reads");
-        std::fs::write(&path, original.replace("allowed", "tampered"))
-            .expect("audit is tampered");
-
-        let audit = AuditPipeline::for_sink_dev_only(Arc::new(JsonlFileSink::new(&path)));
-        let error = audit
-            .verify_chain_eager()
-            .await
-            .expect_err("tampered chain fails verification");
-        assert!(matches!(error, AuditError::ChainVerification(_)));
-        assert!(!audit.chain_healthy());
-
-        std::fs::write(&path, original).expect("valid retained chain is restored");
-        audit
-            .verify_chain_eager()
-            .await
-            .expect("restored chain verifies");
-        assert!(
-            !audit.chain_healthy(),
-            "integrity failure remains latched until process restart"
-        );
-    }
-
-    #[derive(Default)]
-    struct TransientTailFailureSink {
-        calls: std::sync::atomic::AtomicUsize,
-    }
-
-    #[async_trait]
-    impl PlatformAuditSink for TransientTailFailureSink {
-        async fn write(
-            &self,
-            _envelope: &registry_platform_audit::AuditEnvelope,
-        ) -> Result<(), AuditError> {
-            Ok(())
-        }
-
-        async fn tail_hash(&self) -> Result<Option<[u8; 32]>, AuditError> {
-            Ok(None)
-        }
-
-        async fn tail_hash_with_hasher(
-            &self,
-            _hasher: &registry_platform_audit::AuditChainHasher,
-        ) -> Result<Option<[u8; 32]>, AuditError> {
-            if self.calls.fetch_add(1, Ordering::SeqCst) == 0 {
-                return Err(AuditError::Io(std::io::Error::other(
-                    "transient retained-chain read failure",
-                )));
-            }
-            Ok(None)
-        }
-    }
-
-    #[tokio::test]
-    async fn transient_eager_verification_failure_recovers_without_poisoning_readiness() {
-        let audit = AuditPipeline::for_sink_dev_only(Arc::new(TransientTailFailureSink::default()));
-
-        let error = audit
-            .verify_chain_eager()
-            .await
-            .expect_err("first retained-chain read fails");
-        assert!(matches!(error, AuditError::Io(_)));
-        assert!(
-            audit.chain_healthy(),
-            "I/O failure must not poison audit readiness"
-        );
-
-        audit
-            .verify_chain_eager()
-            .await
-            .expect("later retained-chain read recovers");
-        assert!(audit.chain_healthy());
-    }
-
-    #[derive(Default)]
-    struct TransientJsonWriteFailureSink {
-        writes: std::sync::atomic::AtomicUsize,
-    }
-
-    #[async_trait]
-    impl PlatformAuditSink for TransientJsonWriteFailureSink {
-        async fn write(
-            &self,
-            _envelope: &registry_platform_audit::AuditEnvelope,
-        ) -> Result<(), AuditError> {
-            if self.writes.fetch_add(1, Ordering::SeqCst) == 0 {
-                let error = serde_json::from_str::<Value>("{")
-                    .expect_err("malformed JSON creates a test error");
-                return Err(AuditError::Json(error));
-            }
-            Ok(())
-        }
-
-        async fn tail_hash(&self) -> Result<Option<[u8; 32]>, AuditError> {
-            Ok(None)
-        }
-
-        async fn tail_hash_with_hasher(
-            &self,
-            _hasher: &registry_platform_audit::AuditChainHasher,
-        ) -> Result<Option<[u8; 32]>, AuditError> {
-            Ok(None)
-        }
-    }
-
-    #[tokio::test]
-    async fn transient_json_audit_failure_recovers_without_poisoning_readiness() {
-        let audit =
-            AuditPipeline::for_sink_dev_only(Arc::new(TransientJsonWriteFailureSink::default()));
-
-        let error = audit
-            .emit(&audit_event())
-            .await
-            .expect_err("first audit write reports a JSON failure");
-        assert!(matches!(error, AuditError::Json(_)));
-        assert!(audit.chain_healthy());
-
-        audit
-            .emit(&audit_event())
-            .await
-            .expect("later audit write recovers");
-        assert!(audit.chain_healthy());
-    }
-
-    struct ForkFailureSink;
-
-    #[async_trait]
-    impl PlatformAuditSink for ForkFailureSink {
-        async fn write(
-            &self,
-            _envelope: &registry_platform_audit::AuditEnvelope,
-        ) -> Result<(), AuditError> {
-            Err(AuditError::ChainForkDetected {
-                expected: registry_platform_audit::OptionalHashHex(None),
-                found: registry_platform_audit::OptionalHashHex(Some([7; 32])),
-            })
-        }
-
-        async fn tail_hash(&self) -> Result<Option<[u8; 32]>, AuditError> {
-            Ok(None)
-        }
-
-        async fn tail_hash_with_hasher(
-            &self,
-            _hasher: &registry_platform_audit::AuditChainHasher,
-        ) -> Result<Option<[u8; 32]>, AuditError> {
-            Ok(None)
-        }
-    }
-
-    #[tokio::test]
-    async fn write_time_chain_fork_latches_audit_readiness() {
-        let audit = AuditPipeline::for_sink_dev_only(Arc::new(ForkFailureSink));
-        audit
-            .emit(&audit_event())
-            .await
-            .expect_err("forked append is rejected");
-        assert!(!audit.chain_healthy());
-    }
-
-    #[tokio::test]
-    async fn audit_pipeline_file_sink_uses_configured_rotation() {
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let path = tmp.path().join("audit.jsonl");
-        let mut config = test_audit_config("file");
-        config.path = Some(path.display().to_string());
-        config.max_size_mb = Some(1);
-        config.max_files = Some(2);
-        let audit = AuditPipeline::from_config(&config).expect("audit config builds");
-
-        for _ in 0..2_500 {
-            audit
-                .emit(&audit_event())
-                .await
-                .expect("audit write succeeds");
-        }
-
-        assert!(path.exists(), "active audit file should exist");
-        assert!(
-            tmp.path().join("audit.jsonl.1").exists(),
-            "rotated audit file should exist"
-        );
-        assert!(
-            !tmp.path().join("audit.jsonl.2").exists(),
-            "rotation should retain only the configured number of files"
-        );
-    }
-
-    #[test]
-    fn audit_pipeline_file_sink_is_single_writer() {
-        // #211: a second notary audit pipeline over the same file path must fail
-        // loudly at construction (the single-writer advisory lock) rather than
-        // silently forking the audit chain.
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let path = tmp.path().join("audit.jsonl");
-        let mut config = test_audit_config("file");
-        config.path = Some(path.display().to_string());
-
-        let _first = AuditPipeline::from_config(&config).expect("first audit pipeline builds");
-        let second = AuditPipeline::from_config(&config);
-        assert!(
-            matches!(
-                second,
-                Err(StandaloneServerError::Audit(AuditError::SinkLocked { .. }))
-            ),
-            "second writer must be rejected, got {second:?}"
-        );
-    }
-
-    #[test]
-    fn audit_pipeline_accepts_syslog_sink_config() {
-        let mut config = test_audit_config("syslog");
-        config.syslog_socket_path = Some("/tmp/registry-notary-test-syslog.sock".to_string());
-
-        AuditPipeline::from_config(&config).expect("syslog audit config builds");
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn audit_pipeline_syslog_sink_writes_to_configured_socket() {
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let socket_path = tmp.path().join("audit.sock");
-        let socket = tokio::net::UnixDatagram::bind(&socket_path).expect("bind syslog socket");
-        let mut config = test_audit_config("syslog");
-        config.syslog_socket_path = Some(socket_path.display().to_string());
-        let audit = AuditPipeline::from_config(&config).expect("syslog audit config builds");
-
-        audit
-            .emit(&audit_event())
-            .await
-            .expect("audit write succeeds");
-
-        let mut buffer = vec![0; 8192];
-        let bytes = tokio::time::timeout(Duration::from_secs(2), socket.recv(&mut buffer))
-            .await
-            .expect("syslog datagram is received")
-            .expect("syslog socket receives datagram");
-        let frame = std::str::from_utf8(&buffer[..bytes]).expect("syslog frame is UTF-8");
-        assert!(frame.starts_with("<134>1 "));
-        assert!(frame.contains("registry-platform-audit"));
-        assert!(frame.contains(r#""event_id":"01HX0000000000000000000000""#));
-    }
-
-    #[test]
-    fn audit_pipeline_rejects_zero_file_retention() {
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let mut config = test_audit_config("file");
-        config.path = Some(tmp.path().join("audit.jsonl").display().to_string());
-        config.max_files = Some(0);
-
-        let error = AuditPipeline::from_config(&config).expect_err("zero retention is rejected");
-
-        assert!(matches!(
-            error,
-            StandaloneServerError::InvalidAuditConfig(_)
-        ));
-        assert!(
-            error.to_string().contains("max_files"),
-            "error should name the invalid field"
-        );
-    }
-
-    #[test]
-    fn audit_pipeline_rejects_sink_specific_fields_on_wrong_sink() {
-        let mut stdout_config = test_audit_config("stdout");
-        stdout_config.max_size_mb = Some(1);
-        let stdout_error = AuditPipeline::from_config(&stdout_config)
-            .expect_err("stdout cannot accept file rotation");
-        assert!(matches!(
-            stdout_error,
-            StandaloneServerError::InvalidAuditConfig(_)
-        ));
-
-        let mut file_config = test_audit_config("file");
-        file_config.path = Some("/tmp/audit.jsonl".to_string());
-        file_config.syslog_socket_path = Some("/tmp/syslog.sock".to_string());
-        let file_error =
-            AuditPipeline::from_config(&file_config).expect_err("file cannot accept syslog path");
-        assert!(matches!(
-            file_error,
-            StandaloneServerError::InvalidAuditConfig(_)
-        ));
-    }
-
-    #[tokio::test]
-    async fn audit_sink_emit_surfaces_file_write_errors() {
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let blocked_parent = tmp.path().join("blocked");
-        std::fs::write(&blocked_parent, b"not a directory").expect("blocked parent is file");
-        let audit = AuditPipeline::for_sink_dev_only(Arc::new(JsonlFileSink::new(
-            blocked_parent.join("audit.jsonl"),
-        )));
-
-        let error = audit
-            .emit(&audit_event())
-            .await
-            .expect_err("file write error is returned");
-
-        assert!(matches!(error, AuditError::Io(_)));
-    }
-
-    #[tokio::test]
-    async fn audit_write_failure_replaces_authorized_response_with_request_error() {
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let blocked_parent = tmp.path().join("blocked");
-        std::fs::write(&blocked_parent, b"not a directory").expect("blocked parent is file");
-        let audit = AuditPipeline::for_sink_dev_only(Arc::new(JsonlFileSink::new(
-            blocked_parent.join("audit.jsonl"),
-        )));
-        let app = Router::new()
-            .route("/ok", get(|| async { StatusCode::OK }))
-            .layer(from_fn_with_state(auth_state(audit), auth_audit_middleware));
-        let server = TestServer::builder().http_transport().build(app);
-
-        let response = server.get("/ok").add_header("x-api-key", "api-token").await;
-
-        response.assert_status(StatusCode::INTERNAL_SERVER_ERROR);
-        let body: Value = response.json();
-        assert_eq!(body["code"], json!("audit.write_failed"));
-    }
diff --git a/crates/registry-notary-server/src/standalone/tests/auth.inc b/crates/registry-notary-server/src/standalone/tests/auth.inc
deleted file mode 100644
index f087a37a6..000000000
--- a/crates/registry-notary-server/src/standalone/tests/auth.inc
+++ /dev/null
@@ -1,1288 +0,0 @@
-    // SPDX-License-Identifier: Apache-2.0
-
-    #[tokio::test]
-    async fn notary_token_auth_rejects_expired_verification_key() {
-        let signer =
-            LocalJwkSigner::new(PrivateJwk::parse(TEST_ISSUER_JWK_WITH_KID).expect("private jwk"))
-                .expect("local signer builds");
-        let public_jwk = PublicJwk::parse(TEST_OLD_ISSUER_PUBLIC_JWK).expect("public jwk parses");
-        let now = OffsetDateTime::now_utc().unix_timestamp();
-        let token = mint_access_token(
-            &signer,
-            "registry-notary-access+jwt",
-            &AccessTokenClaims {
-                issuer: "https://notary.example".to_string(),
-                jti: None,
-                audiences: vec!["registry-notary".to_string()],
-                token_type: "Bearer".to_string(),
-                credential_configuration_id: "identity_credential".to_string(),
-                issuance_transaction_id: "transaction-1".to_string(),
-                issuance_transaction_commitment: "commitment-1".to_string(),
-                subject: BoundSubject {
-                    subject: "subject-1".to_string(),
-                    subject_binding_claim: "civil_id".to_string(),
-                    subject_binding_value: "civil-1".to_string(),
-                    client_id: "wallet-demo".to_string(),
-                    scopes: vec!["openid".to_string()],
-                    acr: None,
-                    auth_time: None,
-                },
-                authorization_details: Vec::new(),
-                confirmation: None,
-                actor: None,
-                iat: now - 1,
-                exp: now + 300,
-            },
-        )
-        .await
-        .expect("token mints");
-
-        let mut anchor = NotaryTokenAnchor {
-            verification_keys: vec![AccessTokenVerificationKey {
-                public_jwk: public_jwk.clone(),
-                publish_until_unix_seconds: Some(1),
-            }],
-            issuer: "https://notary.example".to_string(),
-            token_typ: "registry-notary-access+jwt".to_string(),
-            audiences: vec!["registry-notary".to_string()],
-            principal_claim: "sub".to_string(),
-            subject_binding_claim: Some("civil_id".to_string()),
-        };
-        assert!(matches!(
-            authenticate_notary_token(&token.compact, &anchor, &ReplayStores::memory()).await,
-            Err(EvidenceError::MissingCredential)
-        ));
-
-        anchor.verification_keys[0] = AccessTokenVerificationKey {
-            public_jwk,
-            publish_until_unix_seconds: Some(u64::try_from(now + 300).expect("future is positive")),
-        };
-        let principal = authenticate_notary_token(
-            &token.compact,
-            &anchor,
-            &ReplayStores::memory(),
-        )
-        .await
-        .expect("current verification key succeeds");
-        assert_eq!(
-            principal.auth_profile_id,
-            EvidenceAuthProfileId::NotaryAccessToken
-        );
-    }
-
-    #[tokio::test]
-    async fn notary_transaction_token_auth_consumes_jti_once() {
-        let signer =
-            LocalJwkSigner::new(PrivateJwk::parse(TEST_ISSUER_JWK_WITH_KID).expect("private jwk"))
-                .expect("local signer builds");
-        let now = OffsetDateTime::now_utc().unix_timestamp();
-        let token = mint_access_token(
-            &signer,
-            NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-            &AccessTokenClaims {
-                issuer: "https://notary.example".to_string(),
-                jti: Some("txn-jti-1".to_string()),
-                audiences: vec!["registry-notary".to_string()],
-                token_type: "Bearer".to_string(),
-                credential_configuration_id: "identity_credential".to_string(),
-                issuance_transaction_id: "transaction-2".to_string(),
-                issuance_transaction_commitment: "commitment-2".to_string(),
-                subject: BoundSubject {
-                    subject: "subject-1".to_string(),
-                    subject_binding_claim: "civil_id".to_string(),
-                    subject_binding_value: "civil-1".to_string(),
-                    client_id: "assisted-access".to_string(),
-                    scopes: vec!["registry_notary:subject_access".to_string()],
-                    acr: None,
-                    auth_time: None,
-                },
-                authorization_details: vec![json!({
-                    "type": NOTARY_AUTHORIZATION_DETAILS_TYPE,
-                    "schema_version": NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION,
-                    "actions": ["evaluate"],
-                    "locations": ["registry-notary"],
-                })],
-                confirmation: None,
-                actor: Some(json!({"actor_id_hash": "hmac-sha256:actor"})),
-                iat: now - 1,
-                exp: now + 300,
-            },
-        )
-        .await
-        .expect("transaction token mints");
-        let anchor = NotaryTokenAnchor {
-            verification_keys: vec![AccessTokenVerificationKey {
-                public_jwk: signer.public_jwk(),
-                publish_until_unix_seconds: None,
-            }],
-            issuer: "https://notary.example".to_string(),
-            token_typ: NOTARY_TRANSACTION_TOKEN_JWT_TYP.to_string(),
-            audiences: vec!["registry-notary".to_string()],
-            principal_claim: "sub".to_string(),
-            subject_binding_claim: Some("civil_id".to_string()),
-        };
-        let replay = ReplayStores::memory();
-
-        authenticate_notary_token(&token.compact, &anchor, &replay)
-            .await
-            .expect("first token use succeeds");
-        let replay_error = authenticate_notary_token(&token.compact, &anchor, &replay)
-            .await
-            .expect_err("second token use is replay");
-
-        assert!(matches!(replay_error, EvidenceError::MissingCredential));
-    }
-
-    #[tokio::test]
-    async fn consume_notary_token_jti_rejects_missing_jti_for_transaction_typ() {
-        let now = OffsetDateTime::now_utc().unix_timestamp();
-        let payload = json!({
-            "iss": "https://notary.example",
-            "exp": now + 300,
-        });
-        let anchor = NotaryTokenAnchor {
-            verification_keys: Vec::new(),
-            issuer: "https://notary.example".to_string(),
-            token_typ: NOTARY_TRANSACTION_TOKEN_JWT_TYP.to_string(),
-            audiences: vec!["registry-notary".to_string()],
-            principal_claim: "sub".to_string(),
-            subject_binding_claim: Some("civil_id".to_string()),
-        };
-        let replay = ReplayStores::memory();
-
-        // A single-use transaction-typ token without `jti` must fail closed
-        // rather than silently skip replay protection.
-        let error = consume_notary_token_jti(&payload, &anchor, &replay)
-            .await
-            .expect_err("missing jti for single-use typ fails closed");
-        assert!(matches!(error, EvidenceError::MissingCredential));
-
-        // A non-single-use typ legitimately has no `jti` and is accepted.
-        let other_anchor = NotaryTokenAnchor {
-            token_typ: "registry-notary-access+jwt".to_string(),
-            ..anchor
-        };
-        consume_notary_token_jti(&payload, &other_anchor, &replay)
-            .await
-            .expect("missing jti for non-single-use typ is accepted");
-    }
-    fn auth_state(audit: AuditPipeline) -> Arc<AuthAuditState> {
-        Arc::new(AuthAuditState {
-            authenticator: RwLock::new(Arc::new(Authenticator {
-                api_keys: vec![ResolvedCredential {
-                    id: "caseworker".to_string(),
-                    fingerprint: registry_platform_authcommon::fingerprint_api_key("api-token"),
-                    scopes: Vec::new(),
-                    authorization_details: None,
-                }],
-                bearer_tokens: Vec::new(),
-                oidc: None,
-            })),
-            audit,
-            replay: ReplayStores::memory(),
-            metrics: Arc::new(AppMetrics::default()),
-            openapi_requires_auth: AtomicBool::new(true),
-            subject_access_invalid_token_limiter: None,
-            subject_access_rate_keys: None,
-        })
-    }
-
-    #[test]
-    fn evidence_service_discovery_is_not_auth_exempt() {
-        let protected_openapi = AuthExemptionPolicy {
-            openapi_requires_auth: true,
-        };
-        assert!(
-            !is_auth_exempt_path("/.well-known/evidence-service", protected_openapi),
-            "service discovery exposes configured capability metadata and must stay authenticated"
-        );
-        assert!(is_auth_exempt_path("/healthz", protected_openapi));
-        assert!(is_auth_exempt_path(
-            "/.well-known/evidence/jwks.json",
-            protected_openapi
-        ));
-        assert!(!is_auth_exempt_path("/openapi.json", protected_openapi));
-
-        let public_openapi = AuthExemptionPolicy {
-            openapi_requires_auth: false,
-        };
-        assert!(is_auth_exempt_path("/openapi.json", public_openapi));
-        assert!(
-            !is_auth_exempt_path("/.well-known/evidence-service", public_openapi),
-            "server.openapi_requires_auth only affects /openapi.json"
-        );
-    }
-
-    #[test]
-    fn registrar_offer_creation_is_not_auth_exempt() {
-        for openapi_requires_auth in [true, false] {
-            assert!(
-                !is_auth_exempt_path(
-                    "/oid4vci/offers",
-                    AuthExemptionPolicy {
-                        openapi_requires_auth,
-                    },
-                ),
-                "registrar offer creation must always pass through authentication middleware"
-            );
-        }
-    }
-
-    #[tokio::test]
-    async fn invalid_bearer_tokens_are_rate_limited_when_subject_access_is_enabled() {
-        let rate_limits = SubjectAccessRateLimitsConfig {
-            invalid_token_per_client_address_per_minute: 1,
-            per_principal_per_minute: 1,
-            subject_mismatch_per_principal_per_hour: 1,
-            per_holder_per_hour: 1,
-            credential_issuance_per_principal_per_hour: 1,
-            ..SubjectAccessRateLimitsConfig::default()
-        };
-        let audit = AuditPipeline::for_sink_dev_only(Arc::new(JsonlStdoutSink::new()));
-        let state = Arc::new(AuthAuditState {
-            authenticator: RwLock::new(Arc::new(Authenticator {
-                api_keys: Vec::new(),
-                bearer_tokens: Vec::new(),
-                oidc: None,
-            })),
-            audit: audit.clone(),
-            replay: ReplayStores::memory(),
-            metrics: Arc::new(AppMetrics::default()),
-            openapi_requires_auth: AtomicBool::new(true),
-            subject_access_invalid_token_limiter: Some(Arc::new(
-                SubjectAccessRateLimiter::new(rate_limits),
-            )),
-            subject_access_rate_keys: Some(Arc::new(SubjectAccessRateLimitKeys::new(
-                audit.profile.key_hasher(),
-            ))),
-        });
-        let app = Router::new()
-            .route("/ok", get(|| async { StatusCode::OK }))
-            .layer(from_fn_with_state(state, auth_audit_middleware));
-        let server = TestServer::builder().http_transport().build(app);
-
-        let first = server
-            .get("/ok")
-            .add_header(header::AUTHORIZATION, "Bearer invalid-token")
-            .await;
-        first.assert_status(StatusCode::UNAUTHORIZED);
-
-        let second = server
-            .get("/ok")
-            .add_header(header::AUTHORIZATION, "Bearer invalid-token")
-            .await;
-        second.assert_status(StatusCode::TOO_MANY_REQUESTS);
-        let body: Value = second.json();
-        assert_eq!(body["code"], json!("subject_access.rate_limited"));
-    }
-
-    #[tokio::test]
-    async fn missing_credentials_are_rate_limited_when_subject_access_is_enabled() {
-        let rate_limits = SubjectAccessRateLimitsConfig {
-            invalid_token_per_client_address_per_minute: 1,
-            per_principal_per_minute: 1,
-            subject_mismatch_per_principal_per_hour: 1,
-            per_holder_per_hour: 1,
-            credential_issuance_per_principal_per_hour: 1,
-            ..SubjectAccessRateLimitsConfig::default()
-        };
-        let audit = AuditPipeline::for_sink_dev_only(Arc::new(JsonlStdoutSink::new()));
-        let state = Arc::new(AuthAuditState {
-            authenticator: RwLock::new(Arc::new(Authenticator {
-                api_keys: Vec::new(),
-                bearer_tokens: Vec::new(),
-                oidc: None,
-            })),
-            audit: audit.clone(),
-            replay: ReplayStores::memory(),
-            metrics: Arc::new(AppMetrics::default()),
-            openapi_requires_auth: AtomicBool::new(true),
-            subject_access_invalid_token_limiter: Some(Arc::new(
-                SubjectAccessRateLimiter::new(rate_limits),
-            )),
-            subject_access_rate_keys: Some(Arc::new(SubjectAccessRateLimitKeys::new(
-                audit.profile.key_hasher(),
-            ))),
-        });
-        let app = Router::new()
-            .route("/ok", get(|| async { StatusCode::OK }))
-            .layer(from_fn_with_state(state, auth_audit_middleware));
-        let server = TestServer::builder().http_transport().build(app);
-
-        let first = server.get("/ok").await;
-        first.assert_status(StatusCode::UNAUTHORIZED);
-
-        let second = server.get("/ok").await;
-        second.assert_status(StatusCode::TOO_MANY_REQUESTS);
-        let body: Value = second.json();
-        assert_eq!(body["code"], json!("subject_access.rate_limited"));
-    }
-
-    #[tokio::test]
-    async fn auth_state_accepts_case_insensitive_bearer_scheme() {
-        let state = AuthAuditState {
-            authenticator: RwLock::new(Arc::new(Authenticator {
-                api_keys: Vec::new(),
-                bearer_tokens: vec![ResolvedCredential {
-                    id: "caseworker".to_string(),
-                    fingerprint: registry_platform_authcommon::fingerprint_api_key("api-token"),
-                    scopes: vec!["farmer_registry:evidence_verification".to_string()],
-                    authorization_details: None,
-                }],
-                oidc: None,
-            })),
-            audit: AuditPipeline::for_sink_dev_only(Arc::new(JsonlStdoutSink::new())),
-            replay: ReplayStores::memory(),
-            metrics: Arc::new(AppMetrics::default()),
-            openapi_requires_auth: AtomicBool::new(true),
-            subject_access_invalid_token_limiter: None,
-            subject_access_rate_keys: None,
-        };
-        let request = Request::builder()
-            .uri("/v1/claims")
-            .header(header::AUTHORIZATION, "BEARER api-token")
-            .body(Body::empty())
-            .expect("request builds");
-
-        let principal = state
-            .authenticate(request_credentials(&request))
-            .await
-            .expect("bearer auth succeeds");
-
-        assert_eq!(
-            principal.auth_profile_id,
-            EvidenceAuthProfileId::StaticBearer
-        );
-        assert_eq!(principal.principal_id, "caseworker");
-    }
-
-    #[tokio::test]
-    async fn static_auth_rejects_multiple_credential_headers() {
-        let authenticator = Authenticator {
-            api_keys: vec![ResolvedCredential {
-                id: "api-client".to_string(),
-                fingerprint: registry_platform_authcommon::fingerprint_api_key("api-token"),
-                scopes: vec!["farmer_registry:evidence_verification".to_string()],
-                authorization_details: None,
-            }],
-            bearer_tokens: vec![ResolvedCredential {
-                id: "bearer-client".to_string(),
-                fingerprint: registry_platform_authcommon::fingerprint_api_key("bearer-token"),
-                scopes: vec!["farmer_registry:evidence_verification".to_string()],
-                authorization_details: None,
-            }],
-            oidc: None,
-        };
-        let request = RequestCredentials {
-            api_key: Some("api-token".to_string()),
-            api_key_present: true,
-            authorization_present: true,
-            bearer_token: Some("bearer-token".to_string()),
-            id_token: None,
-        };
-
-        let err = authenticator
-            .authenticate(request, &ReplayStores::memory())
-            .await
-            .expect_err("multiple credentials must fail");
-
-        assert!(matches!(err, EvidenceError::MultipleCredentials));
-    }
-
-    #[tokio::test]
-    async fn static_auth_rejects_api_key_with_malformed_authorization_header() {
-        let authenticator = Authenticator {
-            api_keys: vec![ResolvedCredential {
-                id: "api-client".to_string(),
-                fingerprint: registry_platform_authcommon::fingerprint_api_key("api-token"),
-                scopes: vec!["farmer_registry:evidence_verification".to_string()],
-                authorization_details: None,
-            }],
-            bearer_tokens: Vec::new(),
-            oidc: None,
-        };
-        let request = RequestCredentials {
-            api_key: Some("api-token".to_string()),
-            api_key_present: true,
-            authorization_present: true,
-            bearer_token: None,
-            id_token: None,
-        };
-
-        let err = authenticator
-            .authenticate(request, &ReplayStores::memory())
-            .await
-            .expect_err("ambiguous credentials must not fall back to api key");
-
-        assert!(matches!(err, EvidenceError::MultipleCredentials));
-    }
-
-    #[tokio::test]
-    async fn request_credentials_counts_non_utf8_authorization_header_presence() {
-        let authenticator = Authenticator {
-            api_keys: vec![ResolvedCredential {
-                id: "api-client".to_string(),
-                fingerprint: registry_platform_authcommon::fingerprint_api_key("api-token"),
-                scopes: vec!["farmer_registry:evidence_verification".to_string()],
-                authorization_details: None,
-            }],
-            bearer_tokens: Vec::new(),
-            oidc: None,
-        };
-        let mut request = Request::builder()
-            .uri("/v1/claims")
-            .header("x-api-key", "api-token")
-            .body(Body::empty())
-            .expect("request builds");
-        request.headers_mut().insert(
-            header::AUTHORIZATION,
-            axum::http::HeaderValue::from_bytes(b"\xff").expect("opaque header value is valid"),
-        );
-
-        let credentials = request_credentials(&request);
-        assert!(credentials.authorization_present);
-        assert!(credentials.api_key_present);
-        assert!(credentials.bearer_token.is_none());
-        assert_eq!(credentials.api_key.as_deref(), Some("api-token"));
-        assert_eq!(credentials.credential_type_count(), 2);
-
-        let err = authenticator
-            .authenticate(credentials, &ReplayStores::memory())
-            .await
-            .expect_err("raw credential channel presence must reject ambiguity");
-        assert!(matches!(err, EvidenceError::MultipleCredentials));
-    }
-
-    #[tokio::test]
-    async fn request_credentials_counts_non_utf8_api_key_header_presence() {
-        let authenticator = Authenticator {
-            api_keys: Vec::new(),
-            bearer_tokens: vec![ResolvedCredential {
-                id: "bearer-client".to_string(),
-                fingerprint: registry_platform_authcommon::fingerprint_api_key("bearer-token"),
-                scopes: vec!["farmer_registry:evidence_verification".to_string()],
-                authorization_details: None,
-            }],
-            oidc: None,
-        };
-        let mut request = Request::builder()
-            .uri("/v1/claims")
-            .header(header::AUTHORIZATION, "Bearer bearer-token")
-            .body(Body::empty())
-            .expect("request builds");
-        request.headers_mut().insert(
-            "x-api-key",
-            axum::http::HeaderValue::from_bytes(b"\xff").expect("opaque header value is valid"),
-        );
-
-        let credentials = request_credentials(&request);
-        assert!(credentials.api_key_present);
-        assert!(credentials.api_key.is_none());
-        assert!(credentials.authorization_present);
-        assert_eq!(credentials.bearer_token.as_deref(), Some("bearer-token"));
-        assert_eq!(credentials.credential_type_count(), 2);
-
-        let err = authenticator
-            .authenticate(credentials, &ReplayStores::memory())
-            .await
-            .expect_err("raw credential channel presence must reject ambiguity");
-        assert!(matches!(err, EvidenceError::MultipleCredentials));
-    }
-
-    #[test]
-    fn oidc_id_token_is_supplemental_not_a_separate_auth_mode() {
-        let oidc_request = RequestCredentials {
-            api_key: None,
-            api_key_present: false,
-            authorization_present: true,
-            bearer_token: Some("access-token".to_string()),
-            id_token: Some("id-token".to_string()),
-        };
-        let api_key_and_bearer = RequestCredentials {
-            api_key: Some("api-token".to_string()),
-            api_key_present: true,
-            authorization_present: true,
-            bearer_token: Some("bearer-token".to_string()),
-            id_token: None,
-        };
-        let api_key_and_malformed_authorization = RequestCredentials {
-            api_key: Some("api-token".to_string()),
-            api_key_present: true,
-            authorization_present: true,
-            bearer_token: None,
-            id_token: None,
-        };
-
-        assert_eq!(oidc_request.credential_type_count(), 1);
-        assert_eq!(api_key_and_bearer.credential_type_count(), 2);
-        assert_eq!(
-            api_key_and_malformed_authorization.credential_type_count(),
-            2
-        );
-    }
-
-    #[test]
-    fn static_credentials_have_machine_access_and_no_verified_claims() {
-        let credential = ResolvedCredential {
-            id: "caseworker".to_string(),
-            fingerprint: registry_platform_authcommon::fingerprint_api_key("api-token"),
-            scopes: vec!["farmer_registry:evidence_verification".to_string()],
-            authorization_details: None,
-        };
-        let request = RequestCredentials {
-            api_key: Some("api-token".to_string()),
-            api_key_present: true,
-            authorization_present: false,
-            bearer_token: None,
-            id_token: None,
-        };
-
-        let authenticated =
-            authenticate_static(&request, &[credential], &[]).expect("static auth succeeds");
-
-        assert_eq!(
-            authenticated.auth_profile_id,
-            EvidenceAuthProfileId::StaticApiKey
-        );
-        assert_eq!(authenticated.access_mode, AccessMode::MachineClient);
-        assert_eq!(authenticated.principal_id, "caseworker");
-        assert_eq!(
-            authenticated.scopes,
-            vec!["farmer_registry:evidence_verification".to_string()]
-        );
-        assert!(authenticated.verified_claims.is_none());
-        assert!(authenticated.authorization_details.is_none());
-    }
-
-    #[test]
-    fn static_credentials_can_carry_configured_authorization_details() {
-        let credential = ResolvedCredential {
-            id: "caseworker".to_string(),
-            fingerprint: registry_platform_authcommon::fingerprint_api_key("api-token"),
-            scopes: vec!["farmer_registry:evidence_verification".to_string()],
-            authorization_details: Some(EvidenceAuthorizationDetails {
-                detail_type: "registry-notary/evidence-authorization/v1".to_string(),
-                schema_version: "v1".to_string(),
-                legal_basis_ref: Some("demo:casework".to_string()),
-                consent_ref: Some("demo:consent".to_string()),
-                jurisdiction: Some("ZZ".to_string()),
-                assurance_level: Some("substantial".to_string()),
-                ..EvidenceAuthorizationDetails::default()
-            }),
-        };
-        let request = RequestCredentials {
-            api_key: Some("api-token".to_string()),
-            api_key_present: true,
-            authorization_present: false,
-            bearer_token: None,
-            id_token: None,
-        };
-
-        let authenticated =
-            authenticate_static(&request, &[credential], &[]).expect("static auth succeeds");
-        let details = authenticated
-            .authorization_details
-            .expect("configured authorization details are trusted context");
-
-        assert_eq!(details.legal_basis_ref.as_deref(), Some("demo:casework"));
-        assert_eq!(details.consent_ref.as_deref(), Some("demo:consent"));
-        assert_eq!(details.jurisdiction.as_deref(), Some("ZZ"));
-        assert_eq!(details.assurance_level.as_deref(), Some("substantial"));
-    }
-
-    fn verified_token_with_extra(extra: Map<String, Value>) -> VerifiedToken {
-        VerifiedToken {
-            claims: registry_platform_oidc::Claims {
-                sub: Some("login-subject-123".to_string()),
-                iss: Some("https://issuer.example.test".to_string()),
-                aud: Some(Audience::One("registry-notary".to_string())),
-                exp: Some(1_700_003_600),
-                iat: Some(1_700_000_000),
-                nbf: Some(1_699_999_900),
-                azp: Some("citizen-client".to_string()),
-                client_id: Some("fallback-client".to_string()),
-                extra,
-            },
-            matched_client: Some("azp:citizen-client".to_string()),
-            scopes: vec!["openid".to_string(), "evidence:subject_access".to_string()],
-        }
-    }
-
-    #[test]
-    fn oidc_citizen_candidate_uses_any_configured_client_or_audience_signal() {
-        let citizen_client_ids = vec!["citizen-client".to_string()];
-        let citizen_audiences = vec!["citizen-portal".to_string()];
-        let mut machine = verified_token_with_extra(Map::new());
-        machine.claims.azp = Some("registrar-client".to_string());
-        machine.claims.client_id = Some("registrar-client".to_string());
-        machine.claims.aud = Some(Audience::One(
-            "https://notary.example.invalid".to_string(),
-        ));
-        machine.matched_client = Some("azp:registrar-client".to_string());
-
-        assert!(!oidc_citizen_candidate(
-            &machine,
-            &citizen_client_ids,
-            &citizen_audiences,
-        ));
-
-        let mut citizen_client_with_resource_audience = machine.clone();
-        citizen_client_with_resource_audience.claims.azp = Some("citizen-client".to_string());
-        citizen_client_with_resource_audience.matched_client =
-            Some("azp:citizen-client".to_string());
-        assert!(oidc_citizen_candidate(
-            &citizen_client_with_resource_audience,
-            &citizen_client_ids,
-            &citizen_audiences,
-        ));
-
-        let mut registrar_client_with_citizen_audience = machine.clone();
-        registrar_client_with_citizen_audience.claims.aud =
-            Some(Audience::One("citizen-portal".to_string()));
-        assert!(oidc_citizen_candidate(
-            &registrar_client_with_citizen_audience,
-            &citizen_client_ids,
-            &citizen_audiences,
-        ));
-
-        let mut mixed_clients = machine;
-        mixed_clients.claims.client_id = Some("citizen-client".to_string());
-        assert!(
-            oidc_citizen_candidate(
-                &mixed_clients,
-                &citizen_client_ids,
-                &citizen_audiences,
-            ),
-            "any citizen identity signal must select the subject-bound authentication path"
-        );
-    }
-
-    #[tokio::test]
-    async fn signed_registrar_oidc_token_authenticates_without_citizen_credentials() {
-        let idp = registry_platform_testing::MockIdp::start().await;
-        let notary_audience = "https://notary.example.invalid";
-        let citizen_client = "citizen-client";
-        let registrar_client = "registrar-client";
-        let verifier = TokenVerifier::new(
-            TokenVerifierConfig::registry_notary_access_profile(
-                idp.issuer(),
-                vec![citizen_client.to_string(), notary_audience.to_string()],
-                vec![Algorithm::EdDSA],
-                vec!["JWT".to_string()],
-            )
-            .with_allowed_clients(vec![
-                citizen_client.to_string(),
-                registrar_client.to_string(),
-            ]),
-            Arc::new(JwksFetcher::new_with_fetch_url_policy(
-                idp.jwks_uri(),
-                JwksFetcherConfig::defaults(),
-                FetchUrlPolicy::dev(),
-            )),
-        );
-        let machine_token = idp.mint_token(json!({
-            "aud": notary_audience,
-            "sub": "opencrvs-machine-1",
-            "azp": registrar_client,
-            "client_id": registrar_client,
-            "scope": "registry_notary:credential_offer_create birth_certificate",
-            "authorization_details": [{
-                "type": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE,
-                "schema_version": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION,
-                "actions": ["create_credential_offer"],
-                "locations": [notary_audience]
-            }]
-        }));
-        let machine_credentials = RequestCredentials {
-            authorization_present: true,
-            bearer_token: Some(machine_token),
-            ..RequestCredentials::default()
-        };
-
-        let principal = authenticate_oidc(
-            &machine_credentials,
-            &verifier,
-            &FetchUrlPolicy::dev(),
-            "sub",
-            Some("civil_id"),
-            SubjectAccessClaimSource::Userinfo,
-            SubjectAccessAssuranceClaimSource::IdToken,
-            None,
-            &[idp.issuer()],
-            &[citizen_client.to_string()],
-            &[citizen_client.to_string()],
-        )
-        .await
-        .expect("signed registrar access token needs neither userinfo nor an ID token");
-        assert_eq!(principal.principal_id, "opencrvs-machine-1");
-        assert_eq!(principal.access_mode(), AccessMode::MachineClient);
-        assert_eq!(
-            principal
-                .authorization_details
-                .as_ref()
-                .and_then(|details| details.actions.first())
-                .map(String::as_str),
-            Some("create_credential_offer")
-        );
-
-        let cross_pair_token = idp.mint_token(json!({
-            "aud": citizen_client,
-            "sub": "opencrvs-machine-1",
-            "azp": registrar_client,
-            "client_id": registrar_client,
-            "scope": "registry_notary:credential_offer_create birth_certificate"
-        }));
-        let cross_pair_credentials = RequestCredentials {
-            authorization_present: true,
-            bearer_token: Some(cross_pair_token),
-            ..RequestCredentials::default()
-        };
-        assert!(matches!(
-            authenticate_oidc(
-                &cross_pair_credentials,
-                &verifier,
-                &FetchUrlPolicy::dev(),
-                "sub",
-                Some("civil_id"),
-                SubjectAccessClaimSource::Userinfo,
-                SubjectAccessAssuranceClaimSource::IdToken,
-                None,
-                &[idp.issuer()],
-                &[citizen_client.to_string()],
-                &[citizen_client.to_string()],
-            )
-            .await,
-            Err(EvidenceError::MissingCredential)
-        ));
-
-        idp.stop().await;
-    }
-
-    #[test]
-    fn oidc_machine_principal_needs_no_userinfo_or_id_token_assurance() {
-        let mut extra = Map::new();
-        extra.insert("acr".to_string(), json!("untrusted-machine-acr"));
-        extra.insert("auth_time".to_string(), json!(1_700_000_000_i64));
-        extra.insert(
-            "authorization_details".to_string(),
-            json!([{
-                "type": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE,
-                "schema_version": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION,
-                "actions": ["create_credential_offer"],
-                "locations": ["https://notary.example.invalid"]
-            }]),
-        );
-        let mut verified = verified_token_with_extra(extra);
-        verified.claims.azp = Some("registrar-client".to_string());
-        verified.claims.client_id = Some("registrar-client".to_string());
-        verified.claims.aud = Some(Audience::One(
-            "https://notary.example.invalid".to_string(),
-        ));
-        verified.matched_client = Some("azp:registrar-client".to_string());
-        verified.scopes = vec![
-            "registry_notary:credential_offer_create".to_string(),
-            "evidence:birth:read".to_string(),
-        ];
-
-        let principal = principal_from_machine_oidc(
-            &verified,
-            EvidenceAuthProfileId::ExternalOidc,
-            verified_claim_value("at+jwt"),
-            "sub",
-        )
-        .expect("verified registrar token authenticates without citizen credentials");
-        let claims = principal
-            .verified_claims
-            .as_ref()
-            .expect("verified machine claims are retained");
-
-        assert_eq!(principal.access_mode(), AccessMode::MachineClient);
-        assert_eq!(principal.principal_id, "login-subject-123");
-        assert_eq!(
-            claims.client_id.as_ref().map(VerifiedClaimValue::as_str),
-            Some("azp:registrar-client")
-        );
-        assert_eq!(
-            claims
-                .audiences
-                .iter()
-                .map(VerifiedClaimValue::as_str)
-                .collect::<Vec<_>>(),
-            vec!["https://notary.example.invalid"]
-        );
-        assert!(claims.subject_binding_claim.is_none());
-        assert!(claims.subject_binding_value.is_none());
-        assert!(
-            claims.acr.is_none() && claims.auth_time.is_none(),
-            "machine access-token assurance must not be reinterpreted as citizen assurance"
-        );
-        assert_eq!(
-            principal
-                .authorization_details
-                .as_ref()
-                .and_then(|details| details.actions.first())
-                .map(String::as_str),
-            Some("create_credential_offer")
-        );
-    }
-
-    #[test]
-    fn oidc_principal_carries_bounded_verified_claims() {
-        let subject_binding_claim = "https://id.example.gov/claims/national_id";
-        let mut extra = Map::new();
-        extra.insert("scope".to_string(), json!("openid evidence:subject_access"));
-        extra.insert(subject_binding_claim.to_string(), json!("NAT-123"));
-        extra.insert("acr".to_string(), json!("loa3"));
-        extra.insert("auth_time".to_string(), json!(1_700_000_000_i64));
-        extra.insert("auth_profile_id".to_string(), json!("static_api_key"));
-        let verified = VerifiedToken {
-            claims: registry_platform_oidc::Claims {
-                sub: Some("login-subject-123".to_string()),
-                iss: Some("https://issuer.example.test".to_string()),
-                aud: Some(Audience::Many(vec![
-                    "registry-notary".to_string(),
-                    "citizen-portal".to_string(),
-                ])),
-                exp: Some(1_700_003_600),
-                iat: Some(1_700_000_000),
-                nbf: Some(1_699_999_900),
-                azp: Some("citizen-client".to_string()),
-                client_id: Some("fallback-client".to_string()),
-                extra,
-            },
-            matched_client: Some("azp:citizen-client".to_string()),
-            scopes: vec!["openid".to_string(), "evidence:subject_access".to_string()],
-        };
-
-        let authenticated = principal_from_oidc(
-            &verified,
-            EvidenceAuthProfileId::ExternalOidc,
-            None,
-            None,
-            verified_claim_value("JWT"),
-            subject_binding_claim,
-            Some(subject_binding_claim),
-            SubjectAccessClaimSource::AccessToken,
-            SubjectAccessAssuranceClaimSource::AccessToken,
-        )
-        .expect("OIDC principal is derived");
-        let verified_claims = authenticated
-            .verified_claims
-            .expect("verified claims are transported");
-
-        assert_eq!(
-            authenticated.auth_profile_id,
-            EvidenceAuthProfileId::ExternalOidc,
-            "attacker-controlled claims cannot choose the authentication profile"
-        );
-        assert_eq!(authenticated.access_mode, AccessMode::MachineClient);
-        assert_eq!(authenticated.principal_id, "NAT-123");
-        assert_eq!(
-            verified_claims.issuer.as_str(),
-            "https://issuer.example.test"
-        );
-        assert_eq!(
-            verified_claims
-                .audiences
-                .iter()
-                .map(VerifiedClaimValue::as_str)
-                .collect::<Vec<_>>(),
-            vec!["registry-notary", "citizen-portal"]
-        );
-        assert_eq!(
-            verified_claims
-                .client_id
-                .as_ref()
-                .map(VerifiedClaimValue::as_str),
-            Some("azp:citizen-client")
-        );
-        assert_eq!(
-            verified_claims
-                .token_type
-                .as_ref()
-                .map(VerifiedClaimValue::as_str),
-            Some("JWT")
-        );
-        assert_eq!(
-            verified_claims
-                .scopes
-                .iter()
-                .map(VerifiedClaimValue::as_str)
-                .collect::<Vec<_>>(),
-            vec!["openid", "evidence:subject_access"]
-        );
-        assert_eq!(
-            verified_claims
-                .subject
-                .as_ref()
-                .map(VerifiedClaimValue::as_str),
-            Some("login-subject-123")
-        );
-        assert_eq!(
-            verified_claims
-                .subject_binding_claim
-                .as_ref()
-                .map(VerifiedClaimName::as_str),
-            Some(subject_binding_claim)
-        );
-        assert_eq!(
-            verified_claims
-                .subject_binding_value
-                .as_ref()
-                .map(VerifiedClaimValue::as_str),
-            Some("NAT-123")
-        );
-        assert_eq!(
-            verified_claims.acr.as_ref().map(VerifiedClaimValue::as_str),
-            Some("loa3")
-        );
-        assert_eq!(verified_claims.auth_time, Some(1_700_000_000));
-        assert_eq!(verified_claims.exp, Some(1_700_003_600));
-        assert_eq!(verified_claims.iat, Some(1_700_000_000));
-        assert_eq!(verified_claims.nbf, Some(1_699_999_900));
-    }
-
-    #[test]
-    fn oidc_principal_requires_configured_principal_claim() {
-        let verified = verified_token_with_extra(Map::new());
-
-        let error = principal_from_oidc(
-            &verified,
-            EvidenceAuthProfileId::ExternalOidc,
-            None,
-            None,
-            verified_claim_value("JWT"),
-            "national_id",
-            None,
-            SubjectAccessClaimSource::AccessToken,
-            SubjectAccessAssuranceClaimSource::AccessToken,
-        )
-        .expect_err("missing configured principal claim must not fall back to matched client");
-
-        assert!(matches!(error, EvidenceError::MissingCredential));
-    }
-
-    #[test]
-    fn oidc_principal_rejects_matched_client_id_when_default_sub_is_missing() {
-        let mut verified = verified_token_with_extra(Map::new());
-        verified.claims.sub = None;
-        verified.claims.azp = None;
-        verified.claims.client_id = Some("service-client".to_string());
-        verified.matched_client = Some("client_id:service-client".to_string());
-
-        let error = principal_from_oidc(
-            &verified,
-            EvidenceAuthProfileId::ExternalOidc,
-            None,
-            None,
-            verified_claim_value("JWT"),
-            "sub",
-            None,
-            SubjectAccessClaimSource::AccessToken,
-            SubjectAccessAssuranceClaimSource::AccessToken,
-        )
-        .expect_err("matched client_id must not replace a missing sub principal");
-
-        assert!(matches!(error, EvidenceError::MissingCredential));
-    }
-
-    #[test]
-    fn oidc_principal_rejects_matched_azp_when_default_sub_is_missing() {
-        let mut verified = verified_token_with_extra(Map::new());
-        verified.claims.sub = None;
-        verified.claims.azp = Some("service-client".to_string());
-        verified.claims.client_id = None;
-        verified.matched_client = Some("azp:service-client".to_string());
-
-        let error = principal_from_oidc(
-            &verified,
-            EvidenceAuthProfileId::ExternalOidc,
-            None,
-            None,
-            verified_claim_value("JWT"),
-            "sub",
-            None,
-            SubjectAccessClaimSource::AccessToken,
-            SubjectAccessAssuranceClaimSource::AccessToken,
-        )
-        .expect_err("matched azp alone is not a client-credentials principal");
-
-        assert!(matches!(error, EvidenceError::MissingCredential));
-    }
-
-    #[test]
-    fn oidc_principal_rejects_malformed_matching_authorization_details() {
-        let mut extra = Map::new();
-        extra.insert(
-            "authorization_details".to_string(),
-            json!([{
-                "type": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE,
-                "schema_version": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION,
-                "actions": "evaluate"
-            }]),
-        );
-        let verified = verified_token_with_extra(extra);
-
-        let error = principal_from_oidc(
-            &verified,
-            EvidenceAuthProfileId::ExternalOidc,
-            None,
-            None,
-            verified_claim_value("JWT"),
-            "sub",
-            None,
-            SubjectAccessClaimSource::AccessToken,
-            SubjectAccessAssuranceClaimSource::AccessToken,
-        )
-        .expect_err("malformed matching authorization_details must fail auth");
-
-        assert!(matches!(error, EvidenceError::MissingCredential));
-    }
-
-    #[test]
-    fn oidc_principal_rejects_duplicate_matching_authorization_details() {
-        let detail = json!({
-            "type": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE,
-            "schema_version": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION,
-            "actions": ["evaluate"],
-            "locations": ["registry-notary"]
-        });
-        let mut extra = Map::new();
-        extra.insert(
-            "authorization_details".to_string(),
-            json!([detail.clone(), detail]),
-        );
-        let verified = verified_token_with_extra(extra);
-
-        let error = principal_from_oidc(
-            &verified,
-            EvidenceAuthProfileId::ExternalOidc,
-            None,
-            None,
-            verified_claim_value("JWT"),
-            "sub",
-            None,
-            SubjectAccessClaimSource::AccessToken,
-            SubjectAccessAssuranceClaimSource::AccessToken,
-        )
-        .expect_err("duplicate matching authorization_details must fail auth");
-
-        assert!(matches!(error, EvidenceError::MissingCredential));
-    }
-
-    #[test]
-    fn oidc_principal_ignores_context_only_matching_authorization_details() {
-        let mut extra = Map::new();
-        extra.insert(
-            "authorization_details".to_string(),
-            json!([{
-                "type": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE,
-                "schema_version": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION,
-                "legal_basis_ref": "demo:casework",
-                "consent_ref": "demo:consent",
-                "jurisdiction": "ZZ",
-                "assurance_level": "substantial"
-            }]),
-        );
-        let verified = verified_token_with_extra(extra);
-
-        let principal = principal_from_oidc(
-            &verified,
-            EvidenceAuthProfileId::ExternalOidc,
-            None,
-            None,
-            verified_claim_value("JWT"),
-            "sub",
-            None,
-            SubjectAccessClaimSource::AccessToken,
-            SubjectAccessAssuranceClaimSource::AccessToken,
-        )
-        .expect("context-only OIDC authorization_details fall back to scope checks");
-
-        assert!(principal.authorization_details.is_none());
-    }
-
-    #[test]
-    fn oidc_principal_can_bind_userinfo_claims_and_id_token_assurance() {
-        let mut access_extra = Map::new();
-        access_extra.insert("scope".to_string(), json!("openid subject_access"));
-        let access_token = VerifiedToken {
-            claims: registry_platform_oidc::Claims {
-                sub: Some("pairwise-subject".to_string()),
-                iss: Some("https://issuer.example.test".to_string()),
-                aud: Some(Audience::One("citizen-client".to_string())),
-                exp: Some(1_700_003_600),
-                iat: Some(1_700_000_000),
-                nbf: None,
-                azp: Some("citizen-client".to_string()),
-                client_id: Some("citizen-client".to_string()),
-                extra: access_extra,
-            },
-            matched_client: Some("azp:citizen-client".to_string()),
-            scopes: vec!["openid".to_string(), "subject_access".to_string()],
-        };
-        let mut userinfo_extra = Map::new();
-        userinfo_extra.insert("individual_id".to_string(), json!("NID-1001"));
-        let userinfo = registry_platform_oidc::Claims {
-            sub: Some("pairwise-subject".to_string()),
-            iss: Some("https://issuer.example.test".to_string()),
-            aud: None,
-            exp: None,
-            iat: None,
-            nbf: None,
-            azp: None,
-            client_id: None,
-            extra: userinfo_extra,
-        };
-        let mut id_token_extra = Map::new();
-        id_token_extra.insert("acr".to_string(), json!("mosip:idp:acr:generated-code"));
-        id_token_extra.insert("auth_time".to_string(), json!(1_700_000_010_i64));
-        let id_token = VerifiedToken {
-            claims: registry_platform_oidc::Claims {
-                sub: Some("pairwise-subject".to_string()),
-                iss: Some("https://issuer.example.test".to_string()),
-                aud: Some(Audience::One("citizen-client".to_string())),
-                exp: Some(1_700_003_600),
-                iat: Some(1_700_000_010),
-                nbf: None,
-                azp: None,
-                client_id: None,
-                extra: id_token_extra,
-            },
-            matched_client: None,
-            scopes: Vec::new(),
-        };
-
-        let authenticated = principal_from_oidc(
-            &access_token,
-            EvidenceAuthProfileId::ExternalOidc,
-            Some(&userinfo),
-            Some(&id_token),
-            verified_claim_value("JWT"),
-            "sub",
-            Some("individual_id"),
-            SubjectAccessClaimSource::Userinfo,
-            SubjectAccessAssuranceClaimSource::IdToken,
-        )
-        .expect("OIDC principal is derived");
-        let verified_claims = authenticated
-            .verified_claims
-            .expect("verified claims are transported");
-
-        assert_eq!(authenticated.principal_id, "pairwise-subject");
-        assert_eq!(
-            verified_claims.subject_binding_value("individual_id"),
-            Some("NID-1001")
-        );
-        assert_eq!(
-            verified_claims.acr.as_ref().map(VerifiedClaimValue::as_str),
-            Some("mosip:idp:acr:generated-code")
-        );
-        assert_eq!(verified_claims.auth_time, Some(1_700_000_010));
-    }
-
-    #[test]
-    fn oidc_verified_claims_fail_closed_without_string_subject_binding_claim() {
-        let subject_binding_claim = "https://id.example.gov/claims/national_id";
-        let verified = VerifiedToken {
-            claims: registry_platform_oidc::Claims {
-                sub: Some("login-subject-123".to_string()),
-                iss: Some("https://issuer.example.test".to_string()),
-                aud: Some(Audience::One("registry-notary".to_string())),
-                exp: Some(1_700_003_600),
-                iat: Some(1_700_000_000),
-                nbf: Some(1_699_999_900),
-                azp: Some("citizen-client".to_string()),
-                client_id: None,
-                extra: Map::new(),
-            },
-            matched_client: Some("azp:citizen-client".to_string()),
-            scopes: vec!["evidence:subject_access".to_string()],
-        };
-
-        assert!(bounded_verified_claims_from_oidc(
-            &verified,
-            None,
-            None,
-            verified_claim_value("JWT"),
-            Some(subject_binding_claim),
-            SubjectAccessClaimSource::AccessToken,
-            SubjectAccessAssuranceClaimSource::AccessToken,
-        )
-        .is_none());
-
-        let mut verified = verified;
-        verified
-            .claims
-            .extra
-            .insert(subject_binding_claim.to_string(), json!(12345));
-
-        assert!(bounded_verified_claims_from_oidc(
-            &verified,
-            None,
-            None,
-            verified_claim_value("JWT"),
-            Some(subject_binding_claim),
-            SubjectAccessClaimSource::AccessToken,
-            SubjectAccessAssuranceClaimSource::AccessToken,
-        )
-        .is_none());
-    }
-
-    #[test]
-    fn oidc_validation_errors_are_internal_invalid_token_auth_failures() {
-        assert_eq!(
-            oidc_internal_error_code(&OidcError::TokenExpired),
-            "auth.invalid_token"
-        );
-        assert!(matches!(
-            oidc_auth_error(OidcError::TokenExpired),
-            EvidenceError::MissingCredential
-        ));
-    }
-
-    #[test]
-    fn credential_principal_debug_and_auth_errors_do_not_expose_secrets() {
-        let credential = ResolvedCredential {
-            id: "caseworker".to_string(),
-            fingerprint: registry_platform_authcommon::fingerprint_api_key("api-token"),
-            scopes: vec!["farmer_registry:evidence_verification".to_string()],
-            authorization_details: Some(EvidenceAuthorizationDetails {
-                detail_type: "registry-notary/evidence-authorization/v1".to_string(),
-                schema_version: "v1".to_string(),
-                legal_basis_ref: Some("demo:casework".to_string()),
-                consent_ref: Some("demo:consent".to_string()),
-                jurisdiction: Some("ZZ".to_string()),
-                assurance_level: Some("substantial".to_string()),
-                ..EvidenceAuthorizationDetails::default()
-            }),
-        };
-        let request = RequestCredentials {
-            api_key: Some("api-token".to_string()),
-            api_key_present: true,
-            authorization_present: false,
-            bearer_token: None,
-            id_token: None,
-        };
-        let principal = authenticate_static(&request, std::slice::from_ref(&credential), &[])
-            .expect("static auth succeeds");
-        let rejected_secret = "rejected-api-token";
-        let error = authenticate_static(
-            &RequestCredentials {
-                api_key: Some(rejected_secret.to_string()),
-                api_key_present: true,
-                authorization_present: false,
-                bearer_token: None,
-                id_token: None,
-            },
-            std::slice::from_ref(&credential),
-            &[],
-        )
-        .expect_err("unknown API key is rejected");
-        let debug = format!("{credential:?} {principal:?}");
-        let error_output = format!("{error:?} {error}");
-
-        assert!(debug.contains("<redacted>"));
-        assert!(!debug.contains("api-token"));
-        assert!(!error_output.contains(rejected_secret));
-    }
diff --git a/crates/registry-notary-server/src/standalone/tests/deployment_gates.rs b/crates/registry-notary-server/src/standalone/tests/deployment_gates.rs
deleted file mode 100644
index 6aa68d467..000000000
--- a/crates/registry-notary-server/src/standalone/tests/deployment_gates.rs
+++ /dev/null
@@ -1,1677 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Crate-internal tests for the operator-declared deployment profile gates.
-//
-// These exercise the gate framework end to end: startup failures, readiness
-// failures, posture rendering of the `deployment` and `audit` objects, and
-// waiver behaviour. They build their own minimal config so they stay
-// independent of the broader standalone HTTP test fixtures.
-
-use super::super::{
-    compile_notary_runtime_for_gate_test as compile_notary_runtime,
-    compile_notary_runtime_with_provenance_for_gate_test as compile_notary_runtime_with_provenance,
-    notary_routers_from_runtime, notary_shared_router_from_runtime,
-    standalone_router_for_gate_test as standalone_router, StandaloneServerError,
-    standalone_router_with_ready_relay_for_gate_test,
-};
-use axum::http::StatusCode;
-use axum_test::TestServer;
-use registry_notary_core::{
-    EvidenceCredentialConfig, RegistryNotaryAdminListenerMode, StandaloneRegistryNotaryConfig,
-};
-use registry_platform_audit::{AuditProfile, JsonlFileSink};
-use registry_platform_authcommon::{CredentialFingerprintProvider, CredentialFingerprintRef};
-use registry_platform_ops::ConfigSource;
-use registry_platform_testing::fixtures::ED25519_PRIVATE_JWK;
-use serde_json::{json, Value};
-use std::{path::Path, sync::Arc};
-
-#[derive(Debug)]
-struct GateReadyRelay;
-
-#[async_trait::async_trait]
-impl crate::runtime::ActivatedRelayConsultations for GateReadyRelay {
-    async fn check_ready(&self) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    fn validate(
-        &self,
-        _key: &crate::runtime::consultation::ConsultationGroupKeyV1,
-    ) -> Result<(), crate::relay_client::RelayClientError> {
-        Ok(())
-    }
-
-    async fn execute(
-        &self,
-        _key: &crate::runtime::consultation::ConsultationGroupKeyV1,
-    ) -> Result<
-        crate::runtime::consultation::RuntimeRelayConsultationResult,
-        crate::relay_client::RelayClientError,
-    > {
-        Err(crate::relay_client::RelayClientError::TransportUnavailable)
-    }
-}
-
-const AUDIT_SECRET: &str = "0123456789abcdef0123456789abcdef";
-static SHIPPING_CURSOR_TEST_LOCK: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
-// The raw caseworker API-key fingerprint env value. The tests here never
-// present the credential; they exercise startup, readiness, and posture only.
-const CASEWORKER_KEY_HASH: &str =
-    "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51";
-
-fn set_env() {
-    // SAFETY: the integration test binary is single-threaded at setup time.
-    unsafe {
-        std::env::set_var("REGISTRY_NOTARY_GATES_AUDIT_HASH_SECRET", AUDIT_SECRET);
-        std::env::set_var("REGISTRY_NOTARY_GATES_ISSUER_JWK", ED25519_PRIVATE_JWK);
-        std::env::set_var(
-            "REGISTRY_NOTARY_GATES_FEDERATION_SECRET",
-            "gates-federation-pairwise-secret",
-        );
-    }
-}
-
-#[derive(Clone, Copy)]
-enum TestSignerProvider {
-    LocalJwkEnv,
-    FileWatch,
-}
-
-/// A minimal but complete config skeleton, parameterised by the knobs the gates
-/// read: whether the audit sink is durable and a YAML `deployment:` block.
-/// Serving-state dependencies use the crate-internal in-memory harness. The
-/// operator config itself retains the clean PostgreSQL default so gate and
-/// posture projections exercise deployable configuration.
-struct ConfigBuilder {
-    durable_audit: bool,
-    /// Overrides `durable_audit` with a specific sink kind ("jsonl" or
-    /// "syslog") for the retention-local-only gate tests, which need sink
-    /// kinds beyond the plain durable/stdout split.
-    audit_sink_kind: Option<&'static str>,
-    audit_path: String,
-    deployment_block: String,
-    /// Disable OpenAPI auth (triggers openapi_public gate).
-    openapi_public: bool,
-    /// Provider for the active test signing key.
-    signer_provider: Option<TestSignerProvider>,
-    /// Bind the test signing key to a credential profile.
-    credential_signer: bool,
-    /// Bind the test signing key to federation response signing.
-    federation_signer: bool,
-    signer_path: String,
-}
-
-impl ConfigBuilder {
-    fn new(audit_path: &str) -> Self {
-        Self {
-            durable_audit: true,
-            audit_sink_kind: None,
-            audit_path: audit_path.to_string(),
-            deployment_block: String::new(),
-            openapi_public: false,
-            signer_provider: None,
-            credential_signer: false,
-            federation_signer: false,
-            signer_path: Path::new(audit_path)
-                .with_file_name("gates-signer.jwk")
-                .display()
-                .to_string(),
-        }
-    }
-
-    fn durable_audit(mut self, durable: bool) -> Self {
-        self.durable_audit = durable;
-        self
-    }
-
-    fn audit_sink_kind(mut self, kind: &'static str) -> Self {
-        self.audit_sink_kind = Some(kind);
-        self
-    }
-
-    fn deployment(mut self, block: &str) -> Self {
-        self.deployment_block = block.to_string();
-        self
-    }
-
-    fn openapi_public(mut self, enable: bool) -> Self {
-        self.openapi_public = enable;
-        self
-    }
-
-    fn local_software_signer(mut self, enable: bool) -> Self {
-        self.signer_provider = enable.then_some(TestSignerProvider::LocalJwkEnv);
-        self.credential_signer = enable;
-        self
-    }
-
-    fn file_watch_signer(mut self) -> Self {
-        self.signer_provider = Some(TestSignerProvider::FileWatch);
-        self.credential_signer = true;
-        self
-    }
-
-    fn federation_local_software_signer(mut self) -> Self {
-        self.signer_provider = Some(TestSignerProvider::LocalJwkEnv);
-        self.federation_signer = true;
-        self
-    }
-
-    fn audit_section(&self) -> String {
-        match self.audit_sink_kind {
-            Some("jsonl") => format!(
-                "audit:\n  sink: jsonl\n  path: \"{}\"\n  hash_secret_env: REGISTRY_NOTARY_GATES_AUDIT_HASH_SECRET\n",
-                self.audit_path
-            ),
-            Some("syslog") => format!(
-                "audit:\n  sink: syslog\n  syslog_socket_path: \"{}\"\n  hash_secret_env: REGISTRY_NOTARY_GATES_AUDIT_HASH_SECRET\n",
-                self.audit_path
-            ),
-            Some(other) => panic!("unsupported audit_sink_kind in test builder: {other}"),
-            None if self.durable_audit => format!(
-                "audit:\n  sink: file\n  path: \"{}\"\n  hash_secret_env: REGISTRY_NOTARY_GATES_AUDIT_HASH_SECRET\n",
-                self.audit_path
-            ),
-            None => {
-                "audit:\n  sink: stdout\n  hash_secret_env: REGISTRY_NOTARY_GATES_AUDIT_HASH_SECRET\n"
-                    .to_string()
-            }
-        }
-    }
-
-    fn server_section(&self) -> String {
-        if self.openapi_public {
-            "server:\n  bind: 127.0.0.1:0\n  openapi_requires_auth: false\n".to_string()
-        } else {
-            "server:\n  bind: 127.0.0.1:0\n".to_string()
-        }
-    }
-
-    fn signing_section(&self) -> String {
-        let provider = match self.signer_provider {
-            Some(TestSignerProvider::LocalJwkEnv) => concat!(
-                "  signing_keys:\n",
-                "    issuer-key:\n",
-                "      provider: local_jwk_env\n",
-                "      private_jwk_env: REGISTRY_NOTARY_GATES_ISSUER_JWK\n",
-                "      alg: EdDSA\n",
-                "      kid: registry-platform-testing-ed25519-1\n",
-                "      status: active\n",
-            )
-            .to_string(),
-            Some(TestSignerProvider::FileWatch) => format!(
-                concat!(
-                    "  signing_keys:\n",
-                    "    issuer-key:\n",
-                    "      provider: file_watch\n",
-                    "      path: \"{}\"\n",
-                    "      alg: EdDSA\n",
-                    "      kid: registry-platform-testing-ed25519-1\n",
-                    "      status: active\n",
-                ),
-                self.signer_path,
-            ),
-            None => return String::new(),
-        };
-        if self.credential_signer {
-            format!(
-                "{provider}{}",
-                concat!(
-                    "  credential_profiles:\n",
-                    "    gates_sd_jwt:\n",
-                    "      format: application/dc+sd-jwt\n",
-                    "      issuer: did:web:evidence.example.test\n",
-                    "      signing_key: issuer-key\n",
-                    "      vct: https://evidence.example.test/credentials/gates\n",
-                    "      holder_binding:\n",
-                    "        mode: none\n",
-                    "      allowed_claims:\n",
-                    "        - farmed-land-size\n",
-                    "      disclosure:\n",
-                    "        allowed: [value, redacted]\n",
-                )
-            )
-        } else {
-            provider
-        }
-    }
-
-    fn relay_section(&self) -> String {
-        if !self.credential_signer && !self.federation_signer {
-            return String::new();
-        }
-        let token_path = Path::new(&self.audit_path)
-            .with_file_name("gates-relay.jwt")
-            .display()
-            .to_string();
-        format!(
-            concat!(
-                "  relay:\n",
-                "    base_url: http://127.0.0.1:1\n",
-                "    workload_client_id: registry-notary\n",
-                "    token_file: \"{}\"\n",
-                "    allow_insecure_localhost: true\n",
-            ),
-            token_path,
-        )
-    }
-
-    fn claim_section(&self) -> String {
-        if !self.credential_signer && !self.federation_signer {
-            return String::new();
-        }
-        let mut claim = concat!(
-                "    - id: farmed-land-size\n",
-                "      title: Farmed land size\n",
-                "      version: 2026-05\n",
-                "      subject_type: person\n",
-                "      evidence_mode:\n",
-                "        type: registry_backed\n",
-                "        consultations:\n",
-                "          farmed_land:\n",
-                "            profile:\n",
-                "              id: example.farmed-land-size.exact\n",
-                "              contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n",
-                "            inputs:\n",
-                "              subject_id: target.id\n",
-                "            outputs:\n",
-                "              active: { type: boolean, nullable: false }\n",
-                "      purpose: test\n",
-                "      required_scopes: [farmer_registry:evidence_verification]\n",
-                "      value:\n",
-                "        type: boolean\n",
-                "      rule:\n",
-                "        type: consultation_matched\n",
-                "        consultation: farmed_land\n",
-                "      disclosure:\n",
-                "        default: value\n",
-                "        allowed: [value, redacted]\n",
-                "      formats:\n",
-                "        - application/vnd.registry-notary.claim-result+json\n",
-        )
-        .to_string();
-        if self.federation_signer {
-            claim = claim.replace(
-                "subject_id: target.id",
-                "subject_id: request.target.identifiers.national_id",
-            );
-        }
-        if self.credential_signer {
-            claim.push_str(concat!(
-                "      credential_profiles:\n",
-                "        - gates_sd_jwt\n",
-            ));
-        }
-        claim
-    }
-
-    fn federation_section(&self) -> &'static str {
-        if !self.federation_signer {
-            return "";
-        }
-        concat!(
-            "federation:\n",
-            "  enabled: true\n",
-            "  node_id: did:web:evidence.example.test\n",
-            "  issuer: https://evidence.example.test\n",
-            "  jwks_uri: https://evidence.example.test/federation/jwks.json\n",
-            "  federation_api: https://evidence.example.test/federation/v1\n",
-            "  supported_protocol_versions: [registry-notary-federation/v0.1]\n",
-            "  signing:\n",
-            "    signing_key: issuer-key\n",
-            "  pairwise_subject_hash:\n",
-            "    secret_env: REGISTRY_NOTARY_GATES_FEDERATION_SECRET\n",
-            "  peers:\n",
-            "    - node_id: did:web:peer.example.test\n",
-            "      issuer: https://peer.example.test\n",
-            "      jwks_uri: https://peer.example.test/federation/jwks.json\n",
-            "      allowed_protocol_versions: [registry-notary-federation/v0.1]\n",
-            "      allowed_purposes: [https://purpose.example.test/eligibility]\n",
-            "      allowed_profiles: [gates]\n",
-            "      evaluation_scopes: [farmer_registry:evidence_verification]\n",
-            "  evaluation_profiles:\n",
-            "    - id: gates\n",
-            "      ruleset: gates-v1\n",
-            "      claim_id: farmed-land-size\n",
-            "      subject_id_type: national_id\n",
-        )
-    }
-
-    fn build(&self) -> StandaloneRegistryNotaryConfig {
-        set_env();
-        if matches!(self.signer_provider, Some(TestSignerProvider::FileWatch)) {
-            std::fs::write(&self.signer_path, ED25519_PRIVATE_JWK)
-                .expect("file-watch signer fixture writes");
-        }
-        let state = if self.deployment_block.contains("profile: local")
-            && !self.deployment_block.contains("multi_instance: true")
-        {
-            "state:\n  storage: in_memory\n"
-        } else {
-            ""
-        };
-        let raw = format!(
-            r#"
-{server}{state}auth:
-  api_keys:
-    - id: caseworker
-      fingerprint:
-        provider: env
-        name: TEST_GATES_API_KEY_HASH
-      scopes: [farmer_registry:evidence_verification]
-{audit}evidence:
-  enabled: true
-  service_id: evidence.test
-  api_base_url: https://evidence.example.test
-{relay}{signing}
-  claims:
-{claim}
-{deployment}{federation}"#,
-            server = self.server_section(),
-            state = state,
-            audit = self.audit_section(),
-            relay = self.relay_section(),
-            signing = self.signing_section(),
-            claim = self.claim_section(),
-            deployment = self.deployment_block,
-            federation = self.federation_section(),
-        );
-        // The caseworker fingerprint env var must resolve at runtime.
-        // SAFETY: see set_env.
-        unsafe {
-            std::env::set_var("TEST_GATES_API_KEY_HASH", CASEWORKER_KEY_HASH);
-        }
-        serde_norway::from_str(&raw).expect("gates config deserializes")
-    }
-}
-
-fn env_fingerprint_ref(_id: &str, env_name: &str, _fingerprint: &str) -> CredentialFingerprintRef {
-    CredentialFingerprintRef {
-        provider: CredentialFingerprintProvider::Env,
-        name: Some(env_name.to_string()),
-        path: None,
-    }
-}
-
-fn add_ops_read_api_key(config: &mut StandaloneRegistryNotaryConfig) {
-    let fingerprint = "sha256:d9310c002af91822beb0b3487d8b04f85bf6bf1f8a5496bff7d35fc7c5a29def";
-    // SAFETY: see set_env.
-    unsafe {
-        std::env::set_var("TEST_GATES_OPS_KEY_HASH", fingerprint);
-    }
-    config.auth.api_keys.push(EvidenceCredentialConfig {
-        id: "ops".to_string(),
-        fingerprint: env_fingerprint_ref("ops", "TEST_GATES_OPS_KEY_HASH", fingerprint),
-        scopes: vec!["registry_notary:ops_read".to_string()],
-        authorization_details: None,
-    });
-}
-
-fn assert_matches_posture_schema(body: &Value) {
-    let schema: Value = serde_json::from_str(registry_platform_ops::POSTURE_SCHEMA_V1)
-        .expect("posture schema parses");
-    let compiled = jsonschema::JSONSchema::compile(&schema).expect("posture schema compiles");
-    let errors = compiled
-        .validate(body)
-        .err()
-        .map(|errors| errors.map(|error| error.to_string()).collect::<Vec<_>>())
-        .unwrap_or_default();
-    assert!(
-        errors.is_empty(),
-        "posture did not match registry.ops.posture.v1: {errors:?}\n{body:#}"
-    );
-}
-
-async fn fetch_posture(config: StandaloneRegistryNotaryConfig) -> Value {
-    fetch_posture_for_tier(config, "restricted").await
-}
-
-async fn fetch_posture_for_tier(config: StandaloneRegistryNotaryConfig, tier: &str) -> Value {
-    let mut config = config;
-    config.server.admin_listener.mode = RegistryNotaryAdminListenerMode::SharedWithPublic;
-    add_ops_read_api_key(&mut config);
-    let runtime = compile_notary_runtime(config)
-        .expect("runtime compiles for posture")
-        .activate()
-        .await
-        .expect("runtime without claims activates");
-    let app = notary_shared_router_from_runtime(runtime).expect("activated runtime is serve-ready");
-    let server = TestServer::builder().http_transport().build(app);
-    let response = server
-        .get(&format!("/admin/v1/posture?tier={tier}"))
-        .add_header("x-api-key", "ops-token")
-        .await;
-    response.assert_status_ok();
-    response.json()
-}
-
-async fn fetch_default_and_restricted_posture(
-    config: StandaloneRegistryNotaryConfig,
-) -> (Value, Value) {
-    let mut config = config;
-    config.server.admin_listener.mode = RegistryNotaryAdminListenerMode::SharedWithPublic;
-    add_ops_read_api_key(&mut config);
-    let runtime = compile_notary_runtime(config)
-        .expect("runtime compiles for posture")
-        .activate()
-        .await
-        .expect("runtime without claims activates");
-    let app = notary_shared_router_from_runtime(runtime).expect("activated runtime is serve-ready");
-    let server = TestServer::builder().http_transport().build(app);
-    let default = server
-        .get("/admin/v1/posture?tier=default")
-        .add_header("x-api-key", "ops-token")
-        .await;
-    default.assert_status_ok();
-    let restricted = server
-        .get("/admin/v1/posture?tier=restricted")
-        .add_header("x-api-key", "ops-token")
-        .await;
-    restricted.assert_status_ok();
-    (default.json(), restricted.json())
-}
-
-fn audit_path(tmp: &tempfile::TempDir) -> String {
-    tmp.path()
-        .join("audit.jsonl")
-        .to_string_lossy()
-        .into_owned()
-}
-
-fn registry_backed_config(tmp: &tempfile::TempDir) -> StandaloneRegistryNotaryConfig {
-    let mut config = ConfigBuilder::new(&audit_path(tmp))
-        .deployment("deployment:\n  profile: local\n")
-        .build();
-    config.evidence.relay = Some(registry_notary_core::RelayConnectionConfig {
-        base_url: "http://127.0.0.1:1".to_string(),
-        workload_client_id: "registry-notary".to_string(),
-        token_file: tmp.path().join("relay-workload.jwt"),
-        root_certificate_path: None,
-        allowed_private_cidrs: Vec::new(),
-        allow_insecure_localhost: true,
-        allow_insecure_private_network: false,
-        max_in_flight: 8,
-    });
-    config.evidence.claims = vec![serde_norway::from_str(
-        r#"
-id: farmed-land-size
-title: Farmed land size
-version: "1"
-subject_type: person
-evidence_mode:
-  type: registry_backed
-  consultations:
-    farmer:
-      profile:
-        id: example.farmed-land-size.exact
-        contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-      inputs:
-        subject_id: target.id
-      outputs:
-        total_farmed_area: { type: string, nullable: true, max_bytes: 64 }
-value:
-  type: string
-  nullable: true
-purpose: benefit-verification
-required_scopes: [farmer_registry:evidence_verification]
-rule:
-  type: consultation_output
-  consultation: farmer
-  output: total_farmed_area
-disclosure:
-  default: value
-  allowed: [value, redacted]
-formats:
-  - application/vnd.registry-notary.claim-result+json
-"#,
-    )
-    .expect("Registry-backed claim parses")];
-    config
-}
-
-/// Compile a config expecting it to be rejected, returning the error.
-///
-/// `NotaryRuntimeSnapshot` does not implement `Debug`, so `expect_err` cannot be
-/// used directly on the compile result.
-fn expect_compile_rejected(
-    config: StandaloneRegistryNotaryConfig,
-    context: &str,
-) -> StandaloneServerError {
-    match compile_notary_runtime(config) {
-        Ok(_) => panic!("expected compile to be rejected: {context}"),
-        Err(error) => error,
-    }
-}
-
-#[tokio::test]
-async fn standalone_router_builds_without_claims_or_relay_activation() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment("deployment:\n  profile: local\n")
-        .build();
-
-    let _router = standalone_router(config)
-        .await
-        .expect("router without claims verifies its audit chain and builds");
-}
-
-#[tokio::test]
-async fn standalone_router_requires_full_activation_for_postgresql() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment("deployment:\n  profile: production\n  multi_instance: true\n")
-        .build();
-
-    let error = match super::super::standalone_router(config).await {
-        Ok(_) => panic!("standalone_router must reject PostgreSQL state"),
-        Err(error) => error,
-    };
-    assert!(matches!(
-        &error,
-        StandaloneServerError::PostgresqlStateActivationRequired
-    ));
-    assert!(error.to_string().contains("activate().await"));
-}
-
-#[tokio::test]
-async fn registry_backed_standalone_router_refuses_to_serve_before_activation() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = registry_backed_config(&tmp);
-
-    let error = match standalone_router(config).await {
-        Ok(_) => panic!("Registry-backed standalone router must require Relay activation"),
-        Err(error) => error,
-    };
-    assert!(matches!(error, StandaloneServerError::RelayNotActivated));
-}
-
-#[test]
-fn compiled_runtime_cannot_be_routed_before_audit_verification() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let runtime = compile_notary_runtime(registry_backed_config(&tmp))
-        .expect("Registry-backed runtime compiles before activation");
-
-    let error = match notary_shared_router_from_runtime(runtime) {
-        Ok(_) => panic!("compiled runtime must not be served before audit verification"),
-        Err(error) => error,
-    };
-    assert!(matches!(
-        error,
-        StandaloneServerError::AuditChainVerificationRequired
-    ));
-}
-
-#[test]
-fn evidence_grade_postgresql_default_does_not_trigger_in_memory_gate() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment("deployment:\n  profile: evidence_grade\n  multi_instance: true\n")
-        .build();
-
-    let error = expect_compile_rejected(config, "evidence_grade unsigned config must refuse");
-    match error {
-        StandaloneServerError::DeploymentGateStartupFailure { profile, findings } => {
-            assert_eq!(profile, "evidence_grade");
-            assert!(!findings.contains("notary.state.in_memory_high_risk"));
-        }
-        other => panic!("expected a deployment gate startup failure, got: {other:?}"),
-    }
-}
-
-#[test]
-fn production_without_audit_sink_refuses_startup() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .durable_audit(false)
-        .deployment("deployment:\n  profile: production\n")
-        .build();
-
-    let error = expect_compile_rejected(config, "production without durable sink must refuse");
-    match error {
-        StandaloneServerError::DeploymentGateStartupFailure { profile, findings } => {
-            assert_eq!(profile, "production");
-            assert!(
-                findings.contains("notary.audit.sink_missing"),
-                "expected the audit sink gate in: {findings}"
-            );
-        }
-        other => panic!("expected a deployment gate startup failure, got: {other:?}"),
-    }
-}
-
-#[test]
-fn local_profile_binds_no_gates_with_postgresql_default() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .durable_audit(false)
-        .deployment("deployment:\n  profile: local\n  multi_instance: true\n")
-        .build();
-
-    // Local binds no deployment gates. Multi-instance uses the PostgreSQL
-    // default rather than an impossible in-memory fixture.
-    compile_notary_runtime(config).expect("local profile binds no gates");
-}
-
-#[test]
-fn undeclared_profile_refuses_startup_with_actionable_error() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .durable_audit(false)
-        .build();
-
-    let error = expect_compile_rejected(config, "undeclared profile must refuse startup");
-    let rendered = error.to_string();
-    match error {
-        StandaloneServerError::DeploymentGateStartupFailure { profile, findings } => {
-            assert_eq!(profile, "undeclared");
-            assert!(
-                findings.contains("deployment.profile_undeclared"),
-                "expected the undeclared-profile gate in: {findings}"
-            );
-        }
-        other => panic!("expected a deployment gate startup failure, got: {other:?}"),
-    }
-    assert!(
-        rendered.contains("set deployment.profile: local for development"),
-        "startup error must be actionable: {rendered}"
-    );
-}
-
-#[test]
-fn invalid_profile_value_fails_config_load() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let result = std::panic::catch_unwind(|| {
-        ConfigBuilder::new(&audit_path(&tmp))
-            .deployment("deployment:\n  profile: prod\n")
-            .build()
-    });
-    assert!(
-        result.is_err(),
-        "an unknown profile value must fail deserialization"
-    );
-}
-
-#[test]
-fn waiver_for_startup_fail_gate_is_rejected_at_load() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .durable_audit(false)
-        .deployment(
-            "deployment:\n  profile: production\n  waivers:\n    - finding: notary.audit.sink_missing\n      reference: OPS-TEST-HARD-GATE\n      expires: 2999-01-01\n",
-        )
-        .build();
-
-    let error = expect_compile_rejected(config, "a startup_fail gate must never be waivable");
-    assert!(
-        matches!(error, StandaloneServerError::Config(_)),
-        "expected a config validation error, got: {error:?}"
-    );
-}
-
-#[tokio::test]
-async fn production_multi_instance_postgresql_default_is_state_ready() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let mut config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment("deployment:\n  profile: production\n  multi_instance: true\n")
-        .build();
-    config.server.admin_listener.mode = RegistryNotaryAdminListenerMode::Dedicated;
-
-    let app = standalone_router(config).await.expect("production PostgreSQL config starts in harness");
-    let server = TestServer::builder().http_transport().build(app);
-    let ready = server.get("/ready").await;
-    ready.assert_status_ok();
-    let body: Value = ready.json();
-    assert_eq!(body["status"], "ready");
-}
-
-#[tokio::test]
-async fn production_declared_external_without_cursor_reports_shipping_unverified() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    // A file sink with attested off-host shipping is declared_external; with no
-    // ack cursor the completeness is unobserved, so shipping_unverified binds.
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment(
-            "deployment:\n  profile: production\n  evidence:\n    audit_offhost_shipping: true\n",
-        )
-        .build();
-
-    let posture = fetch_posture(config).await;
-    assert_matches_posture_schema(&posture);
-
-    let findings = posture["deployment"]["findings"]
-        .as_array()
-        .expect("deployment findings is an array");
-    let finding = findings
-        .iter()
-        .find(|f| f["id"] == "notary.audit.shipping_unverified")
-        .expect("shipping_unverified finding present under production");
-    assert_eq!(finding["severity"], "finding_warn");
-    assert_eq!(finding["status"], "active");
-
-    let posture_audit = &posture["posture"]["audit"];
-    assert_eq!(posture_audit["shipping_target"], "declared_external");
-    assert_eq!(posture_audit["shipping_health"], "unverified");
-}
-
-#[tokio::test]
-async fn production_stale_cursor_reports_shipping_stale_finding() {
-    let _guard = SHIPPING_CURSOR_TEST_LOCK.lock().await;
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    // A cursor stale against the default 900s window, on an attested file sink.
-    let cursor = write_ack_cursor(&tmp, "2026-06-04T09:59:00Z");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment(&format!(
-            "deployment:\n  profile: production\n  evidence:\n    audit_offhost_shipping: true\n    audit_ack_cursor_path: \"{cursor}\"\n"
-        ))
-        .build();
-
-    let posture = fetch_posture(config).await;
-    assert_matches_posture_schema(&posture);
-
-    let findings = posture["deployment"]["findings"]
-        .as_array()
-        .expect("deployment findings is an array");
-    let finding = findings
-        .iter()
-        .find(|f| f["id"] == "notary.audit.shipping_stale")
-        .expect("shipping_stale finding present under production");
-    assert_eq!(finding["severity"], "finding_error");
-    assert_eq!(finding["status"], "active");
-
-    let posture_audit = &posture["posture"]["audit"];
-    assert_eq!(posture_audit["shipping_health"], "stale");
-    assert_eq!(
-        posture_audit["shipping_observed_at"],
-        "2026-06-04T09:59:00Z"
-    );
-}
-
-#[tokio::test]
-async fn production_unapproved_local_signer_reports_readiness_failure() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .local_software_signer(true)
-        .deployment("deployment:\n  profile: production\n")
-        .build();
-
-    let app = standalone_router_with_ready_relay_for_gate_test(config, Arc::new(GateReadyRelay))
-        .await
-        .expect("production local signer config still starts");
-    let server = TestServer::builder().http_transport().build(app);
-    let ready = server.get("/ready").await;
-    ready.assert_status(StatusCode::SERVICE_UNAVAILABLE);
-    let body: Value = ready.json();
-    assert_eq!(body["readiness_status"], "not_ready");
-    let header_request_id = ready
-        .headers()
-        .get("x-request-id")
-        .and_then(|value| value.to_str().ok())
-        .expect("readiness failure carries x-request-id");
-    assert_eq!(body["request_id"], header_request_id);
-    assert_eq!(body["checks"]["failed"], 1);
-    assert!(body["checks"].get("deployment").is_none());
-    let custody = &body["checks"]["signing_providers"]["custody"];
-    assert_eq!(custody["custody_approval_required"], true);
-    assert_eq!(custody["custody_approved"], false);
-    assert_eq!(custody["signing_provider_count"], 1);
-    assert_eq!(custody["local_software_signing_provider_count"], 1);
-    assert_eq!(custody["unapproved_signing_provider_count"], 1);
-    assert_eq!(custody["active_provider_counts"]["local_jwk_env"], 1);
-    assert_eq!(
-        custody["surfaces"]["credential_issuance"]["signing_provider_count"],
-        1
-    );
-    assert_eq!(
-        custody["surfaces"]["credential_issuance"]["unapproved_signing_provider_count"],
-        1
-    );
-}
-
-#[tokio::test]
-async fn production_file_watch_signer_requires_custody_approval() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .file_watch_signer()
-        .deployment("deployment:\n  profile: production\n")
-        .build();
-
-    let app = standalone_router_with_ready_relay_for_gate_test(config, Arc::new(GateReadyRelay))
-        .await
-        .expect("production file-watch signer config starts");
-    let server = TestServer::builder().http_transport().build(app);
-    let ready = server.get("/ready").await;
-    ready.assert_status(StatusCode::SERVICE_UNAVAILABLE);
-    let body: Value = ready.json();
-    let custody = &body["checks"]["signing_providers"]["custody"];
-    assert_eq!(custody["active_provider_counts"]["file_watch"], 1);
-    assert_eq!(custody["local_software_signing_provider_count"], 1);
-    assert_eq!(custody["unapproved_signing_provider_count"], 1);
-}
-
-#[tokio::test]
-async fn production_federation_signer_is_reported_by_surface() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .federation_local_software_signer()
-        .deployment("deployment:\n  profile: production\n")
-        .build();
-
-    let app = standalone_router_with_ready_relay_for_gate_test(config, Arc::new(GateReadyRelay))
-        .await
-        .expect("production federation signer config starts");
-    let server = TestServer::builder().http_transport().build(app);
-    let ready = server.get("/ready").await;
-    ready.assert_status(StatusCode::SERVICE_UNAVAILABLE);
-    let body: Value = ready.json();
-    let custody = &body["checks"]["signing_providers"]["custody"];
-    assert_eq!(
-        custody["surfaces"]["credential_issuance"]["signing_provider_count"],
-        0
-    );
-    assert_eq!(custody["surfaces"]["federation"]["enabled"], true);
-    assert_eq!(
-        custody["surfaces"]["federation"]["signing_provider_count"],
-        1
-    );
-    assert_eq!(
-        custody["surfaces"]["federation"]["local_software_signing_provider_count"],
-        1
-    );
-    assert_eq!(
-        custody["surfaces"]["federation"]["unapproved_signing_provider_count"],
-        1
-    );
-}
-
-#[tokio::test]
-async fn production_signer_custody_approval_is_visible_in_readiness() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .local_software_signer(true)
-        .deployment(
-            "deployment:\n  profile: production\n  evidence:\n    signer_custody_approved: true\n",
-        )
-        .build();
-
-    let app = standalone_router_with_ready_relay_for_gate_test(config, Arc::new(GateReadyRelay))
-        .await
-        .expect("approved local signer config starts");
-    let server = TestServer::builder().http_transport().build(app);
-    let ready = server.get("/ready").await;
-    ready.assert_status_ok();
-    let body: Value = ready.json();
-    assert_eq!(body["status"], "ready");
-    assert_eq!(body["checks"]["failed"], 0);
-    let custody = &body["checks"]["signing_providers"]["custody"];
-    assert_eq!(custody["custody_approval_required"], true);
-    assert_eq!(custody["custody_approved"], true);
-    assert_eq!(custody["signing_provider_count"], 1);
-    assert_eq!(custody["local_software_signing_provider_count"], 1);
-    assert_eq!(custody["unapproved_signing_provider_count"], 0);
-}
-
-#[test]
-fn evidence_grade_unapproved_signer_fails_startup() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .local_software_signer(true)
-        .deployment("deployment:\n  profile: evidence_grade\n")
-        .build();
-
-    match compile_notary_runtime_with_provenance(config, ConfigSource::SignedBundleFile, None) {
-        Err(StandaloneServerError::DeploymentGateStartupFailure { findings, .. }) => {
-            assert!(
-                findings.contains("notary.signer_custody.unapproved"),
-                "signer-custody gate should be the startup blocker: {findings}"
-            );
-        }
-        Ok(_) => panic!("expected signer-custody deployment gate startup failure, got success"),
-        Err(other) => {
-            panic!("expected signer-custody deployment gate startup failure, got {other}")
-        }
-    }
-}
-
-#[tokio::test]
-async fn posture_renders_deployment_and_audit_assurance() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment("deployment:\n  profile: production\n")
-        .build();
-
-    let posture = fetch_posture(config).await;
-    assert_matches_posture_schema(&posture);
-
-    assert_eq!(posture["deployment"]["profile"], "production");
-
-    let audit = &posture["audit"];
-    assert_eq!(audit["keyed_integrity"], "hmac");
-    assert_eq!(audit["write_policy"], "fail_closed_route_families");
-    assert_eq!(audit["redaction_mode"], "redacted");
-    assert_eq!(audit["sink_class"], "file");
-    assert_eq!(audit["retention_owner"], "operator");
-    // All eight assurance fields are present.
-    for field in [
-        "write_policy",
-        "redaction_mode",
-        "hash_chain",
-        "keyed_integrity",
-        "sink_class",
-        "retention_owner",
-        "checkpoints",
-        "anchoring",
-    ] {
-        assert!(
-            audit.get(field).is_some(),
-            "audit assurance is missing {field}"
-        );
-    }
-
-    let posture_audit = &posture["posture"]["audit"];
-    assert_eq!(posture_audit["shipping_target_configured"], false);
-    assert_eq!(posture_audit["shipping_target"], "none");
-    // No shipping target is configured, so health and observed_at are null.
-    assert_eq!(posture_audit["shipping_health"], Value::Null);
-    assert_eq!(posture_audit["shipping_observed_at"], Value::Null);
-}
-
-/// Write a `registry.audit.ack_cursor.v1` file with the given `acked_at` and
-/// return its path as a string for embedding in a `deployment` block.
-fn write_ack_cursor(tmp: &tempfile::TempDir, acked_at: &str) -> String {
-    write_ack_cursor_with_hash(tmp, acked_at, &"4".repeat(64))
-}
-
-fn write_ack_cursor_with_hash(
-    tmp: &tempfile::TempDir,
-    acked_at: &str,
-    last_acked_hash: &str,
-) -> String {
-    let path = tmp.path().join("ack-cursor.json");
-    let body = format!(
-        r#"{{"schema":"registry.audit.ack_cursor.v1","acked_at":"{acked_at}","last_acked_hash":"sha256:{last_acked_hash}","writer":"test-shipper"}}"#
-    );
-    std::fs::write(&path, body).expect("ack cursor writes");
-    path.display().to_string()
-}
-
-async fn seed_audit_tail(audit_path: &str) -> String {
-    set_env();
-    let sink = JsonlFileSink::new(audit_path);
-    let profile = AuditProfile::registry_notary_from_env("REGISTRY_NOTARY_GATES_AUDIT_HASH_SECRET")
-        .expect("test audit profile builds");
-    let chain = profile
-        .bootstrap_or_start_empty(&sink)
-        .await
-        .expect("test audit chain starts");
-    let envelope = chain
-        .append(&sink, json!({"event": "shipping-readiness-test"}))
-        .await
-        .expect("test audit record appends");
-    envelope
-        .record_hash
-        .iter()
-        .map(|byte| format!("{byte:02x}"))
-        .collect()
-}
-
-fn read_audit_tail(audit_path: &str) -> String {
-    let contents = std::fs::read_to_string(audit_path).expect("audit file reads");
-    let envelope: Value = serde_json::from_str(
-        contents
-            .lines()
-            .last()
-            .expect("audit file contains an envelope"),
-    )
-    .expect("audit envelope parses");
-    envelope["record_hash"]
-        .as_str()
-        .expect("audit envelope has a record hash")
-        .to_string()
-}
-
-fn rfc3339_now() -> String {
-    time::OffsetDateTime::now_utc()
-        .format(&time::format_description::well_known::Rfc3339)
-        .expect("now formats as RFC3339")
-}
-
-#[tokio::test]
-async fn posture_reports_shipping_health_ok_for_fresh_cursor() {
-    let _guard = SHIPPING_CURSOR_TEST_LOCK.lock().await;
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let audit_path = audit_path(&tmp);
-    let tail_hash = seed_audit_tail(&audit_path).await;
-    let acked_at = rfc3339_now();
-    let cursor = write_ack_cursor_with_hash(&tmp, &acked_at, &tail_hash);
-    // A durable file sink with attested off-host shipping is declared_external,
-    // so shipping_target_configured is true and audit stays off stdout. local
-    // binds no gates, so the posture emission is isolated.
-    let config = ConfigBuilder::new(&audit_path)
-        .deployment(&format!(
-            "deployment:\n  profile: local\n  evidence:\n    audit_offhost_shipping: true\n    audit_ack_cursor_path: \"{cursor}\"\n"
-        ))
-        .build();
-
-    let posture = fetch_posture(config).await;
-    assert_matches_posture_schema(&posture);
-
-    let posture_audit = &posture["posture"]["audit"];
-    assert_eq!(posture_audit["shipping_target_configured"], true);
-    assert_eq!(posture_audit["shipping_target"], "declared_external");
-    assert_eq!(posture_audit["shipping_health"], "ok");
-    assert_eq!(posture_audit["shipping_observed_at"], acked_at);
-}
-
-#[tokio::test]
-async fn evidence_grade_readiness_rechecks_cursor_binding_and_recovers() {
-    let _guard = SHIPPING_CURSOR_TEST_LOCK.lock().await;
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let audit_path = audit_path(&tmp);
-    let tail_hash = seed_audit_tail(&audit_path).await;
-    let acked_at = rfc3339_now();
-    let cursor = write_ack_cursor_with_hash(&tmp, &acked_at, &tail_hash);
-    let mut config = ConfigBuilder::new(&audit_path)
-        .deployment(&format!(
-            "deployment:\n  profile: evidence_grade\n  evidence:\n    audit_offhost_shipping: true\n    audit_ack_cursor_path: \"{cursor}\"\n"
-        ))
-        .build();
-    config.server.admin_listener.mode = RegistryNotaryAdminListenerMode::Dedicated;
-    add_ops_read_api_key(&mut config);
-    let runtime =
-        compile_notary_runtime_with_provenance(config, ConfigSource::SignedBundleFile, None)
-            .expect("signed evidence-grade runtime compiles")
-            .activate()
-            .await
-            .expect("signed evidence-grade runtime activates");
-    let routers =
-        notary_routers_from_runtime(runtime).expect("runtime without claims is serve-ready");
-    let server = TestServer::builder().http_transport().build(routers.public);
-    let admin_server = TestServer::builder().http_transport().build(routers.admin);
-
-    let ready = server.get("/ready").await;
-    ready.assert_status_ok();
-    let body: Value = ready.json();
-    assert_eq!(body["status"], "ready");
-
-    let healthy_posture: Value = admin_server
-        .get("/admin/v1/posture?tier=restricted")
-        .add_header("x-api-key", "ops-token")
-        .await
-        .json();
-    assert_eq!(healthy_posture["posture"]["audit"]["shipping_health"], "ok");
-    assert!(!healthy_posture["deployment"]["findings"]
-        .as_array()
-        .expect("deployment findings")
-        .iter()
-        .any(|finding| finding["id"] == "notary.audit.shipping_stale"));
-    // The protected posture request is itself audited after its response, so
-    // let the shipper catch up before testing a different audited request.
-    let posture_tail = read_audit_tail(&audit_path);
-    write_ack_cursor_with_hash(&tmp, &rfc3339_now(), &posture_tail);
-
-    server
-        .get("/v1/claims")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-    let lagging: Value = server.get("/ready").await.json();
-    assert_eq!(lagging["checks"]["failed"], 1);
-
-    let lagging_posture: Value = admin_server
-        .get("/admin/v1/posture?tier=restricted")
-        .add_header("x-api-key", "ops-token")
-        .await
-        .json();
-    assert_eq!(
-        lagging_posture["posture"]["audit"]["shipping_health"],
-        "invalid"
-    );
-    assert!(lagging_posture["deployment"]["findings"]
-        .as_array()
-        .expect("deployment findings")
-        .iter()
-        .any(|finding| finding["id"] == "notary.audit.shipping_stale"));
-    let advanced_tail = read_audit_tail(&audit_path);
-
-    write_ack_cursor_with_hash(&tmp, &rfc3339_now(), &advanced_tail);
-    let caught_up: Value = server.get("/ready").await.json();
-    assert_eq!(caught_up["checks"]["failed"], 0);
-
-    write_ack_cursor_with_hash(&tmp, "2026-06-04T09:59:00Z", &advanced_tail);
-    let stale: Value = server.get("/ready").await.json();
-    assert_eq!(stale["checks"]["failed"], 1);
-
-    write_ack_cursor_with_hash(&tmp, &rfc3339_now(), &"5".repeat(64));
-    let mismatched: Value = server.get("/ready").await.json();
-    assert_eq!(mismatched["checks"]["failed"], 1);
-
-    write_ack_cursor_with_hash(&tmp, &rfc3339_now(), &advanced_tail);
-    let recovered: Value = server.get("/ready").await.json();
-    assert_eq!(recovered["checks"]["failed"], 0);
-
-    std::fs::remove_file(tmp.path().join("ack-cursor.json")).expect("cursor removed");
-    let missing: Value = server.get("/ready").await.json();
-    assert_eq!(missing["checks"]["failed"], 1);
-
-    write_ack_cursor_with_hash(&tmp, &rfc3339_now(), &advanced_tail);
-    let restored: Value = server.get("/ready").await.json();
-    assert_eq!(restored["checks"]["failed"], 0);
-}
-
-#[tokio::test]
-async fn posture_reports_shipping_health_stale_for_old_cursor() {
-    let _guard = SHIPPING_CURSOR_TEST_LOCK.lock().await;
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    // Far in the past relative to the default 900s window.
-    let cursor = write_ack_cursor(&tmp, "2026-06-04T09:59:00Z");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment(&format!(
-            "deployment:\n  profile: local\n  evidence:\n    audit_offhost_shipping: true\n    audit_ack_cursor_path: \"{cursor}\"\n"
-        ))
-        .build();
-
-    let posture = fetch_posture(config).await;
-    assert_matches_posture_schema(&posture);
-
-    let posture_audit = &posture["posture"]["audit"];
-    assert_eq!(posture_audit["shipping_health"], "stale");
-    assert_eq!(
-        posture_audit["shipping_observed_at"],
-        "2026-06-04T09:59:00Z"
-    );
-}
-
-#[tokio::test]
-async fn posture_reports_shipping_health_unverified_without_cursor() {
-    let _guard = SHIPPING_CURSOR_TEST_LOCK.lock().await;
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    // A declared_external sink (file + attested shipping) with no ack cursor.
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment(
-            "deployment:\n  profile: local\n  evidence:\n    audit_offhost_shipping: true\n",
-        )
-        .build();
-
-    let posture = fetch_posture(config).await;
-    assert_matches_posture_schema(&posture);
-
-    let posture_audit = &posture["posture"]["audit"];
-    assert_eq!(posture_audit["shipping_target_configured"], true);
-    assert_eq!(posture_audit["shipping_target"], "declared_external");
-    assert_eq!(posture_audit["shipping_health"], "unverified");
-    assert_eq!(posture_audit["shipping_observed_at"], Value::Null);
-}
-
-#[tokio::test]
-async fn posture_reports_local_profile_without_findings() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment("deployment:\n  profile: local\n")
-        .build();
-
-    let posture = fetch_posture(config).await;
-    assert_matches_posture_schema(&posture);
-
-    assert_eq!(posture["deployment"]["profile"], "local");
-    let findings = posture["deployment"]["findings"]
-        .as_array()
-        .expect("deployment findings is an array");
-    assert!(
-        findings.is_empty(),
-        "local profile should not bind findings"
-    );
-}
-
-#[tokio::test]
-async fn posture_reports_waived_finding_with_active_waiver() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .openapi_public(true)
-        .deployment(
-            "deployment:\n  profile: hosted_lab\n  waivers:\n    - finding: notary.openapi.public\n      reference: OPS-TEST-POSTURE\n      summary: \"Synthetic single-node lab\"\n      expires: 2999-01-01\n",
-        )
-        .build();
-
-    let (default, posture) = fetch_default_and_restricted_posture(config).await;
-    let default_rendered = default.to_string();
-    assert!(!default_rendered.contains("OPS-TEST-POSTURE"));
-    assert!(!default_rendered.contains("Synthetic single-node lab"));
-    assert!(default["deployment"].get("waivers").is_none());
-
-    assert_matches_posture_schema(&posture);
-
-    let findings = posture["deployment"]["findings"]
-        .as_array()
-        .expect("deployment findings is an array");
-    let waived = findings
-        .iter()
-        .find(|finding| finding["id"] == "notary.openapi.public")
-        .expect("public OpenAPI finding is present");
-    assert_eq!(waived["status"], "waived");
-    assert_eq!(waived["waiver"]["reference"], "OPS-TEST-POSTURE");
-    assert_eq!(waived["waiver"]["summary"], "Synthetic single-node lab");
-    assert_eq!(waived["waiver"]["expires"], "2999-01-01");
-    assert!(waived["waiver"].get("reason").is_none());
-
-    let waivers = posture["deployment"]["waivers"]
-        .as_array()
-        .expect("deployment waivers is an array");
-    let active = waivers
-        .iter()
-        .find(|waiver| waiver["finding"] == "notary.openapi.public")
-        .unwrap_or_else(|| panic!("active waiver must be echoed in: {waivers:#?}"));
-    assert_eq!(active["reference"], "OPS-TEST-POSTURE");
-    assert_eq!(active["summary"], "Synthetic single-node lab");
-    assert!(active.get("reason").is_none());
-}
-
-#[tokio::test]
-async fn posture_re_triggers_expired_waiver() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .openapi_public(true)
-        .deployment(
-            "deployment:\n  profile: hosted_lab\n  waivers:\n    - finding: notary.openapi.public\n      reference: OPS-TEST-EXPIRED\n      expires: 2000-01-01\n",
-        )
-        .build();
-
-    let posture = fetch_posture(config).await;
-    assert_matches_posture_schema(&posture);
-
-    let findings = posture["deployment"]["findings"]
-        .as_array()
-        .expect("deployment findings is an array");
-    let openapi = findings
-        .iter()
-        .find(|finding| finding["id"] == "notary.openapi.public")
-        .expect("public OpenAPI finding is present");
-    // An expired waiver stops suppressing the finding: it is active again.
-    assert_eq!(openapi["status"], "active");
-    assert!(
-        findings
-            .iter()
-            .any(|finding| finding["id"] == "deployment.waiver_expired"),
-        "expected deployment.waiver_expired in: {findings:#?}"
-    );
-}
-
-#[tokio::test]
-async fn hosted_lab_openapi_public_reports_finding_warn() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .openapi_public(true)
-        .deployment("deployment:\n  profile: hosted_lab\n")
-        .build();
-
-    let posture = fetch_posture(config).await;
-    assert_matches_posture_schema(&posture);
-
-    let findings = posture["deployment"]["findings"]
-        .as_array()
-        .expect("deployment findings is an array");
-    let found = findings
-        .iter()
-        .find(|f| f["id"] == "notary.openapi.public")
-        .expect("notary.openapi.public present under hosted_lab");
-    assert_eq!(
-        found["severity"], "finding_warn",
-        "hosted_lab openapi_public must be finding_warn"
-    );
-}
-
-#[tokio::test]
-async fn production_openapi_public_reports_finding_error() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .openapi_public(true)
-        .deployment("deployment:\n  profile: production\n")
-        .build();
-
-    let posture = fetch_posture(config).await;
-    assert_matches_posture_schema(&posture);
-
-    let findings = posture["deployment"]["findings"]
-        .as_array()
-        .expect("deployment findings is an array");
-    let found = findings
-        .iter()
-        .find(|f| f["id"] == "notary.openapi.public")
-        .expect("notary.openapi.public present under production");
-    assert_eq!(
-        found["severity"], "finding_error",
-        "production openapi_public must be finding_error"
-    );
-}
-
-#[tokio::test]
-async fn openapi_with_auth_required_clears_the_gate() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment("deployment:\n  profile: production\n")
-        .build();
-
-    let posture = fetch_posture(config).await;
-    assert_matches_posture_schema(&posture);
-
-    let findings = posture["deployment"]["findings"]
-        .as_array()
-        .expect("deployment findings is an array");
-    assert!(
-        !findings.iter().any(|f| f["id"] == "notary.openapi.public"),
-        "notary.openapi.public must be absent when openapi_requires_auth = true"
-    );
-}
-
-#[tokio::test]
-async fn config_unsigned_reports_finding_under_hosted_lab() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    // A minimal config has no config_trust block and therefore config_unsigned = true.
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment("deployment:\n  profile: hosted_lab\n")
-        .build();
-
-    let posture = fetch_posture(config).await;
-    assert_matches_posture_schema(&posture);
-
-    let findings = posture["deployment"]["findings"]
-        .as_array()
-        .expect("deployment findings is an array");
-    let found = findings
-        .iter()
-        .find(|f| f["id"] == "notary.config.unsigned")
-        .expect("notary.config.unsigned present under hosted_lab (no config_trust)");
-    assert_eq!(
-        found["severity"], "finding_warn",
-        "hosted_lab config_unsigned must be finding_warn"
-    );
-}
-
-#[tokio::test]
-async fn config_unsigned_reports_finding_error_under_production() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment("deployment:\n  profile: production\n")
-        .build();
-
-    let posture = fetch_posture(config).await;
-    assert_matches_posture_schema(&posture);
-
-    let findings = posture["deployment"]["findings"]
-        .as_array()
-        .expect("deployment findings is an array");
-    let found = findings
-        .iter()
-        .find(|f| f["id"] == "notary.config.unsigned")
-        .expect("notary.config.unsigned present under production (no config_trust)");
-    assert_eq!(
-        found["severity"], "finding_error",
-        "production config_unsigned must be finding_error"
-    );
-}
-
-#[test]
-fn evidence_grade_config_unsigned_refuses_startup() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    // evidence_grade + config_unsigned = startup_fail.
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment("deployment:\n  profile: evidence_grade\n")
-        .build();
-
-    let error =
-        expect_compile_rejected(config, "evidence_grade config_unsigned must refuse startup");
-    match error {
-        StandaloneServerError::DeploymentGateStartupFailure { profile, findings } => {
-            assert_eq!(profile, "evidence_grade");
-            assert!(
-                findings.contains("notary.config.unsigned"),
-                "expected notary.config.unsigned in startup failures: {findings}"
-            );
-        }
-        other => panic!("expected a deployment gate startup failure, got: {other:?}"),
-    }
-}
-
-#[test]
-fn admin_shared_exposure_refuses_startup_under_evidence_grade() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    // fetch_posture sets SharedWithPublic on the compiled config, but here we
-    // set it before compile to test the startup gate.
-    let mut config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment("deployment:\n  profile: evidence_grade\n")
-        .build();
-    config.server.admin_listener.mode =
-        registry_notary_core::RegistryNotaryAdminListenerMode::SharedWithPublic;
-
-    let error = expect_compile_rejected(
-        config,
-        "evidence_grade admin_shared_exposure must refuse startup",
-    );
-    match error {
-        StandaloneServerError::DeploymentGateStartupFailure { profile, findings } => {
-            assert_eq!(profile, "evidence_grade");
-            assert!(
-                findings.contains("notary.admin.shared_exposure"),
-                "expected notary.admin.shared_exposure in startup failures: {findings}"
-            );
-        }
-        other => panic!("expected a deployment gate startup failure, got: {other:?}"),
-    }
-}
-
-#[test]
-fn admin_dedicated_or_disabled_clears_shared_exposure_gate() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    // Default admin listener mode is Disabled; no admin_shared_exposure.
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment("deployment:\n  profile: evidence_grade\n")
-        .build();
-
-    // Evidence grade with config_unsigned is a startup_fail, but we're only
-    // checking that admin_shared_exposure is not among the reasons. So we
-    // can check via compile that the admin exposure gate is not the trigger.
-    // (The test ensures the gate logic for the non-triggering path is exercised
-    // end-to-end; config_unsigned startup_fail is a separate gate.)
-    let error = expect_compile_rejected(
-        config,
-        "evidence_grade still refuses due to config_unsigned, not admin_shared_exposure",
-    );
-    match error {
-        StandaloneServerError::DeploymentGateStartupFailure { findings, .. } => {
-            assert!(
-                !findings.contains("notary.admin.shared_exposure"),
-                "notary.admin.shared_exposure must not appear when listener is disabled: {findings}"
-            );
-        }
-        other => panic!("expected a deployment gate startup failure, got: {other:?}"),
-    }
-}
-
-// Integration tests for notary.audit.retention_local_only: a local file sink
-// caps retention and an attacker with host access can destroy it, unless the
-// operator attests logs are shipped off-host. stdout and syslog are exempt.
-
-#[tokio::test]
-async fn production_file_sink_without_attestation_reports_finding_warn() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment("deployment:\n  profile: production\n")
-        .build();
-
-    // Startup is unaffected: finding_warn is not a hard gate.
-    let posture = fetch_posture(config).await;
-    assert_matches_posture_schema(&posture);
-
-    let findings = posture["deployment"]["findings"]
-        .as_array()
-        .expect("deployment findings is an array");
-    let found = findings
-        .iter()
-        .find(|f| f["id"] == "notary.audit.retention_local_only")
-        .expect("notary.audit.retention_local_only finding present under production");
-    assert_eq!(found["severity"], "finding_warn");
-    assert_eq!(found["status"], "active");
-}
-
-#[tokio::test]
-async fn production_file_sink_with_offhost_attestation_is_clean() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment(
-            "deployment:\n  profile: production\n  evidence:\n    audit_offhost_shipping: true\n",
-        )
-        .build();
-
-    let posture = fetch_posture(config).await;
-    assert_matches_posture_schema(&posture);
-
-    let findings = posture["deployment"]["findings"]
-        .as_array()
-        .expect("deployment findings is an array");
-    assert!(
-        !findings
-            .iter()
-            .any(|f| f["id"] == "notary.audit.retention_local_only"),
-        "attested off-host shipping must clear the gate: {findings:#?}"
-    );
-}
-
-#[tokio::test]
-async fn production_stdout_sink_is_exempt_from_retention_local_only() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .durable_audit(false)
-        .deployment("deployment:\n  profile: production\n")
-        .build();
-
-    // A stdout sink also triggers notary.audit.sink_missing (not durable),
-    // so this exercises compile directly rather than the posture route.
-    let error = expect_compile_rejected(config, "stdout sink is not durable under production");
-    match error {
-        StandaloneServerError::DeploymentGateStartupFailure { findings, .. } => {
-            assert!(
-                !findings.contains("notary.audit.retention_local_only"),
-                "stdout sink must be exempt from retention_local_only: {findings}"
-            );
-        }
-        other => panic!("expected a deployment gate startup failure, got: {other:?}"),
-    }
-}
-
-#[tokio::test]
-async fn production_syslog_sink_is_exempt_from_retention_local_only() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let socket_path = tmp.path().join("audit.sock");
-    // Fetching posture emits an audit event through the syslog sink, so a
-    // real datagram socket must be listening or the write fails closed.
-    let _socket = tokio::net::UnixDatagram::bind(&socket_path).expect("bind syslog socket");
-    let config = ConfigBuilder::new(&socket_path.to_string_lossy())
-        .audit_sink_kind("syslog")
-        .deployment("deployment:\n  profile: production\n")
-        .build();
-
-    let posture = fetch_posture(config).await;
-    assert_matches_posture_schema(&posture);
-
-    let findings = posture["deployment"]["findings"]
-        .as_array()
-        .expect("deployment findings is an array");
-    assert!(
-        !findings
-            .iter()
-            .any(|f| f["id"] == "notary.audit.retention_local_only"),
-        "syslog sink must be exempt from retention_local_only: {findings:#?}"
-    );
-}
-
-#[test]
-fn jsonl_sink_without_attestation_is_startup_gate_binding_under_evidence_grade() {
-    // evidence_grade + jsonl sink without attestation is a startup gate. The
-    // minimal config also triggers notary.config.unsigned under evidence_grade,
-    // so verify the audit gate binding directly.
-    use registry_notary_core::deployment::{
-        evaluate_gates, DeploymentProfile, GateInput, GateSeverity,
-        FINDING_AUDIT_RETENTION_LOCAL_ONLY,
-    };
-    let input = GateInput {
-        audit_sink_class_durable: true,
-        audit_retention_local_only: true,
-        ..GateInput::default()
-    };
-    let evaluation = evaluate_gates(
-        Some(DeploymentProfile::EvidenceGrade),
-        &input,
-        &[],
-        "2026-06-13",
-    );
-    let found = evaluation
-        .findings
-        .iter()
-        .find(|f| f.id == FINDING_AUDIT_RETENTION_LOCAL_ONLY)
-        .expect("notary.audit.retention_local_only present under evidence_grade");
-    assert_eq!(
-        found.severity,
-        GateSeverity::StartupFail,
-        "evidence_grade retention_local_only must be startup_fail"
-    );
-    assert!(evaluation
-        .startup_failures
-        .contains(&FINDING_AUDIT_RETENTION_LOCAL_ONLY.to_string()));
-    assert!(!evaluation
-        .readiness_failures
-        .contains(&FINDING_AUDIT_RETENTION_LOCAL_ONLY.to_string()));
-}
-
-#[test]
-fn evidence_grade_file_sink_without_attestation_refuses_startup() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let config = ConfigBuilder::new(&audit_path(&tmp))
-        .deployment("deployment:\n  profile: evidence_grade\n")
-        .build();
-
-    let error = match compile_notary_runtime_with_provenance(
-        config,
-        ConfigSource::SignedBundleFile,
-        None,
-    ) {
-        Ok(_) => panic!("evidence_grade local-only audit retention must refuse startup"),
-        Err(error) => error,
-    };
-    match error {
-        StandaloneServerError::DeploymentGateStartupFailure { findings, .. } => assert!(
-            findings.contains("notary.audit.retention_local_only"),
-            "startup failure must name the audit retention gate: {findings}"
-        ),
-        other => panic!("expected a deployment gate startup failure, got: {other:?}"),
-    }
-}
-
-#[test]
-fn retention_local_only_waiver_is_honored_under_production() {
-    use registry_notary_core::deployment::{
-        evaluate_gates, DeploymentFindingStatus, DeploymentProfile, DeploymentWaiverConfig,
-        GateInput, FINDING_AUDIT_RETENTION_LOCAL_ONLY,
-    };
-    let input = GateInput {
-        audit_sink_class_durable: true,
-        audit_retention_local_only: true,
-        ..GateInput::default()
-    };
-    let waiver = DeploymentWaiverConfig {
-        finding: FINDING_AUDIT_RETENTION_LOCAL_ONLY.to_string(),
-        reference: "OPS-TEST-RETENTION".to_string(),
-        summary: Some("Synthetic test waiver".to_string()),
-        expires: "2999-01-01".to_string(),
-    };
-    let evaluation = evaluate_gates(
-        Some(DeploymentProfile::Production),
-        &input,
-        &[waiver],
-        "2026-06-13",
-    );
-    let found = evaluation
-        .findings
-        .iter()
-        .find(|f| f.id == FINDING_AUDIT_RETENTION_LOCAL_ONLY)
-        .expect("waived retention_local_only finding present");
-    assert_eq!(found.status, DeploymentFindingStatus::Waived);
-    assert!(found.waiver.is_some());
-}
diff --git a/crates/registry-notary-server/src/standalone/tests/preauth.inc b/crates/registry-notary-server/src/standalone/tests/preauth.inc
deleted file mode 100644
index 62afe368e..000000000
--- a/crates/registry-notary-server/src/standalone/tests/preauth.inc
+++ /dev/null
@@ -1,33 +0,0 @@
-    // SPDX-License-Identifier: Apache-2.0
-
-    #[test]
-    fn access_token_verification_key_enforces_publish_until_boundary() {
-        let public_jwk = PublicJwk::parse(TEST_OLD_ISSUER_PUBLIC_JWK).expect("public jwk parses");
-        let active_key = AccessTokenVerificationKey {
-            public_jwk: public_jwk.clone(),
-            publish_until_unix_seconds: None,
-        };
-        assert!(active_key.may_verify_at(i64::MAX));
-
-        let expiring_key = AccessTokenVerificationKey {
-            public_jwk,
-            publish_until_unix_seconds: Some(1_000),
-        };
-        assert!(expiring_key.may_verify_at(999));
-        assert!(expiring_key.may_verify_at(1_000));
-        assert!(!expiring_key.may_verify_at(1_001));
-        assert!(!expiring_key.may_verify_at(-1));
-    }
-
-    #[test]
-    fn esignet_verifier_config_does_not_require_userinfo_exp() {
-        // MOSIP eSignet signs its userinfo JWS without an `exp` claim, which the
-        // OpenID Connect Core spec permits for UserInfo responses. The RP verifier
-        // must therefore not require one, or every userinfo-sourced binding fails.
-        let config = esignet_token_verifier_config("https://esignet.example", "rp-client");
-
-        assert!(!config.userinfo_requires_exp);
-        assert_eq!(config.issuer, "https://esignet.example");
-        assert_eq!(config.audiences, vec!["rp-client".to_string()]);
-        assert_eq!(config.allowed_userinfo_typ, vec!["JWT".to_string()]);
-    }
diff --git a/crates/registry-notary-server/src/standalone/tests/signing.inc b/crates/registry-notary-server/src/standalone/tests/signing.inc
deleted file mode 100644
index 844bcaf0e..000000000
--- a/crates/registry-notary-server/src/standalone/tests/signing.inc
+++ /dev/null
@@ -1,932 +0,0 @@
-    // SPDX-License-Identifier: Apache-2.0
-
-    #[derive(Debug)]
-    struct TestReadinessProvider {
-        signer: LocalJwkSigner,
-        readiness: Arc<AtomicU8>,
-    }
-
-    #[async_trait]
-    impl SigningProvider for TestReadinessProvider {
-        fn algorithm(&self) -> registry_platform_crypto::SigningAlgorithm {
-            self.signer.algorithm()
-        }
-
-        fn key_id(&self) -> &str {
-            self.signer.key_id()
-        }
-
-        fn public_jwk(&self) -> PublicJwk {
-            self.signer.public_jwk()
-        }
-
-        fn readiness(&self) -> KeyReadiness {
-            key_readiness_from_u8(self.readiness.load(Ordering::SeqCst))
-        }
-
-        async fn sign(
-            &self,
-            payload: &[u8],
-        ) -> Result<Vec<u8>, registry_platform_crypto::SigningError> {
-            self.signer.sign(payload).await
-        }
-    }
-
-    #[test]
-    fn signer_readiness_tracks_status_by_kid_and_counts_required_keys() {
-        let provider_readiness =
-            Arc::new(AtomicU8::new(key_readiness_to_u8(KeyReadiness::NotReady)));
-        let provider: Arc<dyn SigningProvider> = Arc::new(TestReadinessProvider {
-            signer: LocalJwkSigner::new(PrivateJwk::parse(TEST_ISSUER_JWK_WITH_KID).expect("jwk"))
-                .expect("local signer builds"),
-            readiness: Arc::clone(&provider_readiness),
-        });
-        let readiness = SignerReadiness::from_entries(vec![
-            static_key_readiness(
-                "did:web:notary.example#local".to_string(),
-                SigningKeyProviderConfig::LocalJwkEnv,
-                true,
-                KeyReadiness::Ready,
-            ),
-            provider_key_readiness(
-                "did:web:notary.example#hsm".to_string(),
-                SigningKeyProviderConfig::Pkcs11,
-                true,
-                Arc::clone(&provider),
-            ),
-            static_key_readiness(
-                "did:web:notary.example#publish-only".to_string(),
-                SigningKeyProviderConfig::LocalJwkEnv,
-                false,
-                KeyReadiness::Ready,
-            ),
-        ]);
-
-        assert_eq!(readiness.total(), 2);
-        assert_eq!(readiness.ready_count(), 1);
-        assert_eq!(readiness.failed_count(), 1);
-        assert_eq!(
-            readiness.provider_counts(),
-            BTreeMap::from([("local_jwk_env".to_string(), 1), ("pkcs11".to_string(), 1)])
-        );
-        let by_kid = readiness
-            .by_kid()
-            .into_iter()
-            .map(|entry| (entry.kid, entry.readiness))
-            .collect::<BTreeMap<_, _>>();
-        assert_eq!(by_kid["did:web:notary.example#local"], KeyReadiness::Ready);
-        assert_eq!(by_kid["did:web:notary.example#hsm"], KeyReadiness::NotReady);
-        assert_eq!(
-            by_kid["did:web:notary.example#publish-only"],
-            KeyReadiness::Ready
-        );
-
-        provider_readiness.store(key_readiness_to_u8(KeyReadiness::Ready), Ordering::SeqCst);
-        assert!(readiness.is_ready());
-        assert_eq!(readiness.ready_count(), 2);
-    }
-    fn file_watch_key(path: &std::path::Path) -> SigningKeyConfig {
-        SigningKeyConfig {
-            provider: SigningKeyProviderConfig::FileWatch,
-            alg: "EdDSA".to_string(),
-            kid: "did:web:issuer.example#file-watch".to_string(),
-            status: registry_notary_core::SigningKeyStatus::Active,
-            publish_until_unix_seconds: None,
-            private_jwk_env: String::new(),
-            public_jwk_env: String::new(),
-            module_path: String::new(),
-            token_label: String::new(),
-            pin_env: String::new(),
-            key_label: String::new(),
-            key_id_hex: String::new(),
-            path: path.to_string_lossy().into_owned(),
-            password_env: String::new(),
-        }
-    }
-
-    fn test_file_modified(path: &std::path::Path) -> SystemTime {
-        std::fs::metadata(path)
-            .expect("test key metadata reads")
-            .modified()
-            .expect("test key modified time reads")
-    }
-
-    fn set_test_file_modified(path: &std::path::Path, modified: SystemTime) {
-        std::fs::File::options()
-            .write(true)
-            .open(path)
-            .expect("test key opens")
-            .set_modified(modified)
-            .expect("test key modified time sets");
-        assert_eq!(
-            test_file_modified(path),
-            modified,
-            "test filesystem preserved the requested modified time"
-        );
-    }
-
-    fn bump_test_file_modified(path: &std::path::Path, previous: SystemTime) -> SystemTime {
-        let modified = previous + Duration::from_secs(2);
-        set_test_file_modified(path, modified);
-        modified
-    }
-
-    async fn wait_for_file_watch_metadata_check() {
-        tokio::time::sleep(FILE_WATCH_METADATA_CHECK_INTERVAL + Duration::from_millis(25)).await;
-    }
-
-    fn mark_file_watch_checked_now(provider: &FileWatchSigningProvider) {
-        provider
-            .file_state
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-            .last_checked = Instant::now();
-    }
-
-    #[tokio::test]
-    async fn file_watch_signing_key_reloads_valid_same_key_replacement_without_restart() {
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let key_path = tmp.path().join("issuer.jwk");
-        std::fs::write(&key_path, TEST_ISSUER_JWK).expect("initial key writes");
-        let key = file_watch_key(&key_path);
-        let provider =
-            FileWatchSigningProvider::from_config("file-watch", &key).expect("provider builds");
-        let payload = b"registry-notary file-watch signer test";
-
-        let old_public = provider.public_jwk();
-        let old_signature = provider.sign(payload).await.expect("old signer signs");
-        verify(payload, &old_signature, &old_public).expect("old signature verifies");
-
-        std::fs::write(&key_path, TEST_ISSUER_JWK_WITH_KID).expect("replacement key writes");
-        wait_for_file_watch_metadata_check().await;
-        let replacement_signature = provider
-            .sign(payload)
-            .await
-            .expect("replacement signer signs");
-        let replacement_public = provider.public_jwk();
-
-        assert_eq!(old_signature, replacement_signature);
-        assert_eq!(old_public, replacement_public);
-        assert_eq!(provider.readiness(), KeyReadiness::Ready);
-        verify(payload, &replacement_signature, &replacement_public)
-            .expect("replacement signature verifies");
-    }
-
-    #[tokio::test]
-    async fn file_watch_signing_key_debounces_metadata_checks_between_signatures() {
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let key_path = tmp.path().join("issuer.jwk");
-        std::fs::write(&key_path, TEST_ISSUER_JWK).expect("initial key writes");
-        let key = file_watch_key(&key_path);
-        let provider =
-            FileWatchSigningProvider::from_config("file-watch", &key).expect("provider builds");
-        let payload = b"registry-notary file-watch debounce";
-        let old_public = provider.public_jwk();
-        let initial_modified = test_file_modified(&key_path);
-
-        wait_for_file_watch_metadata_check().await;
-        assert_eq!(provider.readiness(), KeyReadiness::Ready);
-        mark_file_watch_checked_now(&provider);
-
-        std::fs::write(&key_path, "{ not valid jwk").expect("malformed replacement writes");
-        bump_test_file_modified(&key_path, initial_modified);
-        let immediate_signature = provider
-            .sign(payload)
-            .await
-            .expect("debounced signer still signs");
-        assert_eq!(
-            provider.readiness(),
-            KeyReadiness::Ready,
-            "metadata is not checked again during the debounce interval"
-        );
-        verify(payload, &immediate_signature, &old_public)
-            .expect("debounced signature still verifies with the last good key");
-
-        wait_for_file_watch_metadata_check().await;
-        let delayed_signature = provider
-            .sign(payload)
-            .await
-            .expect("last good signer still signs after refresh failure");
-        assert_eq!(provider.readiness(), KeyReadiness::Degraded);
-        verify(payload, &delayed_signature, &old_public)
-            .expect("last good signature verifies after refresh failure");
-    }
-
-    #[test]
-    fn file_watch_signing_key_missing_initial_file_fails_closed_without_path_leak() {
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let key_path = tmp.path().join("missing-issuer.jwk");
-        let key = file_watch_key(&key_path);
-
-        let err = FileWatchSigningProvider::from_config("file-watch", &key)
-            .expect_err("missing watched key file fails startup");
-        let err = err.to_string();
-
-        assert!(err.contains("signing key 'file-watch' is invalid"));
-        assert!(err.contains("file_watch key file could not be read"));
-        let key_path_text = key_path.to_string_lossy();
-        assert!(!err.contains(key_path_text.as_ref() as &str));
-    }
-
-    #[tokio::test]
-    async fn file_watch_signing_key_keeps_last_good_signer_when_replacement_is_malformed() {
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let key_path = tmp.path().join("issuer.jwk");
-        std::fs::write(&key_path, TEST_ISSUER_JWK).expect("initial key writes");
-        let key = file_watch_key(&key_path);
-        let provider =
-            FileWatchSigningProvider::from_config("file-watch", &key).expect("provider builds");
-        let payload = b"registry-notary file-watch malformed replacement";
-        let old_public = provider.public_jwk();
-        let initial_modified = test_file_modified(&key_path);
-
-        std::fs::write(&key_path, "{ not valid jwk").expect("malformed replacement writes");
-        set_test_file_modified(&key_path, initial_modified);
-        let signature = provider
-            .sign(payload)
-            .await
-            .expect("unchanged mtime keeps last good signer ready");
-        assert_eq!(provider.readiness(), KeyReadiness::Ready);
-        assert_eq!(provider.public_jwk(), old_public);
-        verify(payload, &signature, &old_public)
-            .expect("unchanged-mtime malformed replacement was not reloaded");
-
-        let malformed_modified = bump_test_file_modified(&key_path, initial_modified);
-        wait_for_file_watch_metadata_check().await;
-        let signature = provider
-            .sign(payload)
-            .await
-            .expect("last good signer still signs");
-
-        assert_eq!(provider.readiness(), KeyReadiness::Degraded);
-        assert_eq!(provider.public_jwk(), old_public);
-        verify(payload, &signature, &old_public).expect("last good signature verifies");
-        let debug = format!("{provider:?}");
-        assert!(debug.contains("FileWatchSigningProvider"));
-        let key_path_text = key_path.to_string_lossy();
-        assert!(!debug.contains(key_path_text.as_ref() as &str));
-        assert!(!debug.contains("2oPoxdKu"));
-
-        std::fs::write(&key_path, TEST_ROTATED_ISSUER_JWK)
-            .expect("wrong public-key replacement writes");
-        bump_test_file_modified(&key_path, malformed_modified);
-        wait_for_file_watch_metadata_check().await;
-        let signature = provider
-            .sign(payload)
-            .await
-            .expect("last good signer still signs after wrong-key replacement");
-        assert_eq!(provider.readiness(), KeyReadiness::Degraded);
-        assert_eq!(provider.public_jwk(), old_public);
-        verify(payload, &signature, &old_public).expect("wrong-key replacement was not swapped in");
-    }
-
-    #[tokio::test]
-    async fn file_watch_signing_provider_reports_readiness_through_shared_trait() {
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let key_path = tmp.path().join("issuer.jwk");
-        std::fs::write(&key_path, TEST_ISSUER_JWK).expect("initial key writes");
-        let key = file_watch_key(&key_path);
-        let provider =
-            FileWatchSigningProvider::from_config("file-watch", &key).expect("provider builds");
-        let provider: Arc<dyn SigningProvider> = Arc::new(provider);
-
-        assert_eq!(provider.readiness(), KeyReadiness::Ready);
-        let initial_modified = test_file_modified(&key_path);
-
-        std::fs::write(&key_path, "{ not valid jwk").expect("malformed replacement writes");
-        bump_test_file_modified(&key_path, initial_modified);
-        wait_for_file_watch_metadata_check().await;
-        provider
-            .sign(b"registry-notary shared readiness")
-            .await
-            .expect("last good signer still signs");
-
-        assert_eq!(provider.readiness(), KeyReadiness::Degraded);
-    }
-
-    #[tokio::test]
-    async fn file_watch_signing_key_readiness_is_reported_by_kid() {
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let key_path = tmp.path().join("issuer.jwk");
-        std::fs::write(&key_path, TEST_ISSUER_JWK).expect("initial key writes");
-        let key_path_text = key_path.to_string_lossy();
-        let evidence: EvidenceConfig = serde_norway::from_str(&format!(
-            r#"
-signing_keys:
-  active-key:
-    provider: file_watch
-    path: "{key_path_text}"
-    alg: EdDSA
-    kid: did:web:issuer.example#file-watch
-    status: active
-credential_profiles:
-  profile-a:
-    format: application/dc+sd-jwt
-    issuer: did:web:issuer.example
-    signing_key: active-key
-    vct: https://issuer.example/credentials/a
-    allowed_claims: [claim-a]
-"#
-        ))
-        .expect("evidence config parses");
-        let reuse_scoped_key_ids: HashSet<&str> = evidence
-            .credential_profiles
-            .values()
-            .map(|profile| profile.signing_key.as_str())
-            .collect();
-        let registry = SigningKeyRegistry::from_config(&evidence, &reuse_scoped_key_ids)
-            .expect("registry builds");
-        let readiness = registry.signer_readiness();
-        assert_eq!(
-            readiness.by_kid()[0].readiness,
-            KeyReadiness::Ready,
-            "initial file-watch key is ready"
-        );
-        let initial_modified = test_file_modified(&key_path);
-
-        std::fs::write(&key_path, "{ not valid jwk").expect("malformed replacement writes");
-        bump_test_file_modified(&key_path, initial_modified);
-        wait_for_file_watch_metadata_check().await;
-        let provider = registry
-            .signing_provider("active-key")
-            .expect("active provider exists");
-        provider
-            .sign(b"registry-notary readiness refresh")
-            .await
-            .expect("last good signer still signs");
-
-        let by_kid = readiness
-            .by_kid()
-            .into_iter()
-            .map(|entry| (entry.kid, entry.readiness))
-            .collect::<BTreeMap<_, _>>();
-        assert_eq!(
-            by_kid["did:web:issuer.example#file-watch"],
-            KeyReadiness::Degraded
-        );
-    }
-
-    #[tokio::test]
-    async fn file_watch_signing_key_detects_same_mtime_content_change_after_debounce() {
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let key_path = tmp.path().join("issuer.jwk");
-        std::fs::write(&key_path, TEST_ISSUER_JWK).expect("initial key writes");
-        let key = file_watch_key(&key_path);
-        let provider =
-            FileWatchSigningProvider::from_config("file-watch", &key).expect("provider builds");
-        let payload = b"registry-notary file-watch same-mtime content detection";
-        let old_public = provider.public_jwk();
-        let initial_modified = test_file_modified(&key_path);
-
-        // Replace the file with same-key content but a different byte representation,
-        // then restore mtime so it is identical to what was recorded at provider creation.
-        std::fs::write(&key_path, TEST_ISSUER_JWK_WITH_KID).expect("same-key replacement writes");
-        set_test_file_modified(&key_path, initial_modified);
-
-        wait_for_file_watch_metadata_check().await;
-
-        // After the debounce window, the content digest reveals the change even though
-        // mtime is identical. The replacement is a valid same-public-key file, so
-        // the provider should remain Ready with the refreshed signer.
-        let signature = provider
-            .sign(payload)
-            .await
-            .expect("provider signs after same-mtime reload");
-        assert_eq!(
-            provider.readiness(),
-            KeyReadiness::Ready,
-            "valid same-key same-mtime replacement keeps provider Ready"
-        );
-        assert_eq!(
-            provider.public_jwk(),
-            old_public,
-            "public key is unchanged after same-key reload"
-        );
-        verify(payload, &signature, &old_public)
-            .expect("signature from same-mtime refreshed signer verifies");
-    }
-
-    #[tokio::test]
-    async fn file_watch_signing_key_detects_same_mtime_malformed_replacement_after_debounce() {
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let key_path = tmp.path().join("issuer.jwk");
-        std::fs::write(&key_path, TEST_ISSUER_JWK).expect("initial key writes");
-        let key = file_watch_key(&key_path);
-        let provider =
-            FileWatchSigningProvider::from_config("file-watch", &key).expect("provider builds");
-        let payload = b"registry-notary file-watch same-mtime malformed detection";
-        let old_public = provider.public_jwk();
-        let initial_modified = test_file_modified(&key_path);
-
-        // Replace with malformed content but restore mtime to the original value.
-        std::fs::write(&key_path, "{ not valid jwk }").expect("malformed replacement writes");
-        set_test_file_modified(&key_path, initial_modified);
-
-        wait_for_file_watch_metadata_check().await;
-
-        // After the debounce window the digest reveals the malformed replacement.
-        // The provider must degrade but keep the last good signer.
-        let signature = provider
-            .sign(payload)
-            .await
-            .expect("last good signer still signs after same-mtime malformed replacement");
-        assert_eq!(
-            provider.readiness(),
-            KeyReadiness::Degraded,
-            "malformed same-mtime replacement degrades readiness after debounce"
-        );
-        assert_eq!(
-            provider.public_jwk(),
-            old_public,
-            "last good public key is kept"
-        );
-        verify(payload, &signature, &old_public)
-            .expect("last good signer signature verifies after same-mtime malformed replacement");
-    }
-
-    fn public_jwk_with_kid(public_jwk: &str, kid: &str) -> String {
-        let mut value: Value = serde_json::from_str(public_jwk).expect("public JWK parses");
-        value["kid"] = json!(kid);
-        serde_json::to_string(&value).expect("public JWK serializes")
-    }
-
-    #[test]
-    fn issuer_registry_uses_active_key_and_publishes_rotated_keys_once() {
-        unsafe {
-            std::env::set_var("TEST_ACTIVE_SIGNING_JWK", TEST_ISSUER_JWK);
-            std::env::set_var("TEST_OLD_SIGNING_PUBLIC_JWK", TEST_OLD_ISSUER_PUBLIC_JWK);
-            std::env::set_var(
-                "TEST_EXPIRED_OLD_SIGNING_PUBLIC_JWK",
-                public_jwk_with_kid(
-                    TEST_OLD_ISSUER_PUBLIC_JWK,
-                    "did:web:issuer.example#expired-old",
-                ),
-            );
-            std::env::set_var("TEST_OLD_HSM_PUBLIC_JWK", TEST_OLD_HSM_PUBLIC_JWK);
-            std::env::set_var("TEST_DISABLED_SIGNING_JWK", TEST_ISSUER_JWK);
-        }
-        let evidence: EvidenceConfig = serde_norway::from_str(
-            r#"
-enabled: true
-signing_keys:
-  active-key:
-    provider: local_jwk_env
-    private_jwk_env: TEST_ACTIVE_SIGNING_JWK
-    alg: EdDSA
-    kid: did:web:issuer.example#active
-    status: active
-  old-key:
-    provider: local_jwk_env
-    public_jwk_env: TEST_OLD_SIGNING_PUBLIC_JWK
-    alg: EdDSA
-    kid: did:web:issuer.example#old
-    status: publish_only
-  old-hsm-key:
-    provider: pkcs11
-    public_jwk_env: TEST_OLD_HSM_PUBLIC_JWK
-    alg: EdDSA
-    kid: did:web:issuer.example#hsm-old
-    status: publish_only
-  expired-old-key:
-    provider: local_jwk_env
-    public_jwk_env: TEST_EXPIRED_OLD_SIGNING_PUBLIC_JWK
-    alg: EdDSA
-    kid: did:web:issuer.example#expired-old
-    status: publish_only
-    publish_until_unix_seconds: 1
-  disabled-key:
-    provider: local_jwk_env
-    private_jwk_env: TEST_DISABLED_SIGNING_JWK
-    alg: EdDSA
-    kid: did:web:issuer.example#disabled
-    status: disabled
-credential_profiles:
-  profile-a:
-    format: application/dc+sd-jwt
-    issuer: did:web:issuer.example
-    signing_key: active-key
-    vct: https://issuer.example/credentials/a
-    allowed_claims: [claim-a]
-  profile-b:
-    format: application/dc+sd-jwt
-    issuer: did:web:issuer.example
-    signing_key: active-key
-    vct: https://issuer.example/credentials/b
-    allowed_claims: [claim-b]
-"#,
-        )
-        .expect("evidence config parses");
-        let registry = EvidenceIssuerRegistry::from_config(&evidence).expect("registry builds");
-
-        assert!(registry.issuer("profile-a").is_ok());
-        assert!(registry.issuer("profile-b").is_ok());
-        let jwks = registry.public_jwks(&evidence).expect("JWKS builds");
-        assert_eq!(jwks.len(), 3);
-        assert!(jwks.iter().all(|jwk| jwk.get("d").is_none()));
-        assert!(jwks
-            .iter()
-            .any(|jwk| jwk["kid"] == "did:web:issuer.example#active"));
-        assert!(jwks
-            .iter()
-            .any(|jwk| jwk["kid"] == "did:web:issuer.example#old"));
-        assert!(jwks
-            .iter()
-            .any(|jwk| jwk["kid"] == "did:web:issuer.example#hsm-old"));
-        assert!(!jwks
-            .iter()
-            .any(|jwk| jwk["kid"] == "did:web:issuer.example#expired-old"));
-        assert!(!jwks
-            .iter()
-            .any(|jwk| jwk["kid"] == "did:web:issuer.example#disabled"));
-    }
-
-    #[test]
-    fn local_jwk_signing_key_rejects_mismatched_embedded_kid() {
-        let jwk = r#"{"kty":"OKP","crv":"Ed25519","kid":"did:web:issuer.example#wrong","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA"}"#;
-        unsafe {
-            std::env::set_var("TEST_MISMATCHED_SIGNING_JWK", jwk);
-        }
-        let evidence: EvidenceConfig = serde_norway::from_str(
-            r#"
-enabled: true
-signing_keys:
-  active-key:
-    provider: local_jwk_env
-    private_jwk_env: TEST_MISMATCHED_SIGNING_JWK
-    alg: EdDSA
-    kid: did:web:issuer.example#active
-    status: active
-credential_profiles:
-  profile-a:
-    format: application/dc+sd-jwt
-    issuer: did:web:issuer.example
-    signing_key: active-key
-    vct: https://issuer.example/credentials/a
-    allowed_claims: [claim-a]
-"#,
-        )
-        .expect("evidence config parses");
-
-        let err = EvidenceIssuerRegistry::from_config(&evidence)
-            .expect_err("mismatched key id must fail startup");
-        assert!(
-            err.to_string().contains("kid does not match"),
-            "unexpected error: {err}"
-        );
-    }
-
-    #[cfg(not(feature = "pkcs11"))]
-    #[test]
-    fn pkcs11_signing_key_fails_closed_when_feature_is_disabled() {
-        unsafe {
-            std::env::set_var(
-                "TEST_PKCS11_PUBLIC_JWK",
-                r#"{"kty":"OKP","crv":"Ed25519","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"did:web:issuer.example#hsm"}"#,
-            );
-            std::env::set_var("TEST_PKCS11_PIN", "1234");
-        }
-        let evidence: EvidenceConfig = serde_norway::from_str(
-            r#"
-enabled: true
-signing_keys:
-  hsm-key:
-    provider: pkcs11
-    module_path: /usr/lib/softhsm/libsofthsm2.so
-    token_label: registry-notary
-    pin_env: TEST_PKCS11_PIN
-    key_label: issuer-signing-key
-    key_id_hex: 01ab23cd
-    public_jwk_env: TEST_PKCS11_PUBLIC_JWK
-    alg: EdDSA
-    kid: did:web:issuer.example#hsm
-    status: active
-credential_profiles:
-  profile-a:
-    format: application/dc+sd-jwt
-    issuer: did:web:issuer.example
-    signing_key: hsm-key
-    vct: https://issuer.example/credentials/a
-    allowed_claims: [claim-a]
-"#,
-        )
-        .expect("evidence config parses");
-
-        let err = EvidenceIssuerRegistry::from_config(&evidence)
-            .expect_err("PKCS#11 must fail closed without feature");
-        assert!(
-            err.to_string().contains("provider 'pkcs11' is not enabled"),
-            "unexpected error: {err}"
-        );
-    }
-
-    #[cfg(feature = "pkcs11")]
-    #[tokio::test]
-    async fn pkcs11_signing_key_signs_with_softhsm_when_available() {
-        let _guard = SOFTHSM_ENV_LOCK.lock().await;
-        let Some(module_path) = softhsm_module_path() else {
-            assert!(
-                !require_softhsm(),
-                "REGISTRY_NOTARY_REQUIRE_SOFTHSM=1 but softhsm2-util is not available"
-            );
-            eprintln!("skipping SoftHSM signing test: softhsm2-util is not available");
-            return;
-        };
-        if command_output(std::process::Command::new("openssl").arg("version")).is_none() {
-            assert!(
-                !require_softhsm(),
-                "REGISTRY_NOTARY_REQUIRE_SOFTHSM=1 but openssl is not available"
-            );
-            eprintln!("skipping SoftHSM signing test: openssl is not available");
-            return;
-        }
-
-        let tmp = tempfile::TempDir::new().expect("tempdir");
-        let token_dir = tmp.path().join("tokens");
-        std::fs::create_dir(&token_dir).expect("token dir is created");
-        let softhsm_conf = tmp.path().join("softhsm2.conf");
-        std::fs::write(
-            &softhsm_conf,
-            format!(
-                "directories.tokendir = {}\nobjectstore.backend = file\nlog.level = ERROR\nslots.removable = false\n",
-                token_dir.display()
-            ),
-        )
-        .expect("SoftHSM config is written");
-
-        let token_label = format!("registry-notary-test-{}", std::process::id());
-        let pin = "1234";
-        unsafe {
-            std::env::set_var("SOFTHSM2_CONF", &softhsm_conf);
-        }
-        run_command(
-            std::process::Command::new("softhsm2-util")
-                .arg("--init-token")
-                .arg("--free")
-                .arg("--label")
-                .arg(&token_label)
-                .arg("--so-pin")
-                .arg("123456")
-                .arg("--pin")
-                .arg(pin),
-        );
-
-        let key_path = tmp.path().join("issuer-ed25519.pem");
-        let secondary_key_path = tmp.path().join("issuer-ed25519-secondary.pem");
-        run_command(
-            std::process::Command::new("openssl")
-                .arg("genpkey")
-                .arg("-algorithm")
-                .arg("ED25519")
-                .arg("-out")
-                .arg(&key_path),
-        );
-        run_command(
-            std::process::Command::new("openssl")
-                .arg("genpkey")
-                .arg("-algorithm")
-                .arg("ED25519")
-                .arg("-out")
-                .arg(&secondary_key_path),
-        );
-        run_command(
-            std::process::Command::new("softhsm2-util")
-                .arg("--import")
-                .arg(&key_path)
-                .arg("--token")
-                .arg(&token_label)
-                .arg("--pin")
-                .arg(pin)
-                .arg("--label")
-                .arg("issuer-signing-key")
-                .arg("--id")
-                .arg("01ab23cd")
-                .arg("--force"),
-        );
-        run_command(
-            std::process::Command::new("softhsm2-util")
-                .arg("--import")
-                .arg(&secondary_key_path)
-                .arg("--token")
-                .arg(&token_label)
-                .arg("--pin")
-                .arg(pin)
-                .arg("--label")
-                .arg("issuer-signing-key-secondary")
-                .arg("--id")
-                .arg("02ab23cd")
-                .arg("--force"),
-        );
-
-        let public_der = command_output(
-            std::process::Command::new("openssl")
-                .arg("pkey")
-                .arg("-in")
-                .arg(&key_path)
-                .arg("-pubout")
-                .arg("-outform")
-                .arg("DER"),
-        )
-        .expect("openssl exports public key");
-        assert!(
-            public_der.len() >= 32,
-            "Ed25519 SubjectPublicKeyInfo has key bytes"
-        );
-        let x = URL_SAFE_NO_PAD.encode(&public_der[public_der.len() - 32..]);
-        let secondary_public_der = command_output(
-            std::process::Command::new("openssl")
-                .arg("pkey")
-                .arg("-in")
-                .arg(&secondary_key_path)
-                .arg("-pubout")
-                .arg("-outform")
-                .arg("DER"),
-        )
-        .expect("openssl exports secondary public key");
-        assert!(
-            secondary_public_der.len() >= 32,
-            "secondary Ed25519 SubjectPublicKeyInfo has key bytes"
-        );
-        let secondary_x =
-            URL_SAFE_NO_PAD.encode(&secondary_public_der[secondary_public_der.len() - 32..]);
-        let public_jwk_primary = serde_json::json!({
-            "kty": "OKP",
-            "crv": "Ed25519",
-            "x": x,
-            "alg": "EdDSA",
-            "kid": "did:web:issuer.example#softhsm"
-        })
-        .to_string();
-        let public_jwk_secondary = serde_json::json!({
-            "kty": "OKP",
-            "crv": "Ed25519",
-            "x": secondary_x,
-            "alg": "EdDSA",
-            "kid": "did:web:issuer.example#softhsm-secondary"
-        })
-        .to_string();
-        unsafe {
-            std::env::set_var("TEST_SOFTHSM_PIN", pin);
-            std::env::set_var("TEST_SOFTHSM_PUBLIC_JWK", public_jwk_primary);
-            std::env::set_var("TEST_SOFTHSM_PUBLIC_JWK_SECONDARY", public_jwk_secondary);
-        }
-
-        let evidence: EvidenceConfig = serde_norway::from_str(&format!(
-            r#"
-enabled: true
-signing_keys:
-  hsm-key:
-    provider: pkcs11
-    module_path: {module_path}
-    token_label: {token_label}
-    pin_env: TEST_SOFTHSM_PIN
-    key_label: issuer-signing-key
-    key_id_hex: 01ab23cd
-    public_jwk_env: TEST_SOFTHSM_PUBLIC_JWK
-    alg: EdDSA
-    kid: did:web:issuer.example#softhsm
-    status: active
-  hsm-key-secondary:
-    provider: pkcs11
-    module_path: {module_path}
-    token_label: {token_label}
-    pin_env: TEST_SOFTHSM_PIN
-    key_label: issuer-signing-key-secondary
-    key_id_hex: 02ab23cd
-    public_jwk_env: TEST_SOFTHSM_PUBLIC_JWK_SECONDARY
-    alg: EdDSA
-    kid: did:web:issuer.example#softhsm-secondary
-    status: active
-credential_profiles:
-  profile-a:
-    format: application/dc+sd-jwt
-    issuer: did:web:issuer.example
-    signing_key: hsm-key
-    vct: https://issuer.example/credentials/a
-    allowed_claims: [claim-a]
-    holder_binding:
-      mode: none
-  profile-b:
-    format: application/dc+sd-jwt
-    issuer: did:web:issuer.example
-    signing_key: hsm-key-secondary
-    vct: https://issuer.example/credentials/b
-    allowed_claims: [claim-b]
-    holder_binding:
-      mode: none
-"#,
-        ))
-        .expect("evidence config parses");
-
-        let registry =
-            EvidenceIssuerRegistry::from_config(&evidence).expect("SoftHSM signer builds");
-        let jwks = registry.public_jwks(&evidence).expect("JWKS builds");
-        assert_eq!(jwks.len(), 2);
-        assert!(jwks
-            .iter()
-            .any(|jwk| jwk["kid"] == "did:web:issuer.example#softhsm"));
-        assert!(jwks
-            .iter()
-            .any(|jwk| jwk["kid"] == "did:web:issuer.example#softhsm-secondary"));
-        let issuer = registry
-            .issuer("profile-a")
-            .expect("profile-a issuer resolves");
-        assert!(registry.issuer("profile-b").is_ok());
-        let profile = evidence
-            .credential_profiles
-            .get("profile-a")
-            .expect("profile-a exists");
-        let results = vec![ClaimResultView {
-            evaluation_id: "eval-softhsm".to_string(),
-            claim_id: "claim-a".to_string(),
-            claim_version: "1.0.0".to_string(),
-            subject_type: "person".to_string(),
-            requester_ref: None,
-            target_ref: TargetRefView {
-                entity_type: "person".to_string(),
-                handle: "subject-ref".to_string(),
-                identifier_schemes: vec!["registry-subject-ref".to_string()],
-                profile: None,
-            },
-            value: Some(serde_json::json!({ "verified": true })),
-            satisfied: Some(true),
-            disclosure: "value".to_string(),
-            redacted_fields: Vec::new(),
-            format: registry_notary_core::FORMAT_CLAIM_RESULT_JSON.to_string(),
-            issued_at: "2026-05-23T00:00:00Z".to_string(),
-            expires_at: None,
-            provenance: ClaimProvenance::new(
-                "softhsm-test".to_string(),
-                "eval-test".to_string(),
-                "claim".to_string(),
-                "1".to_string(),
-                registry_notary_core::ProvenanceUsed {
-                    relay_consultation_count: 0,
-                },
-            ),
-        }];
-        let signed = registry_notary_core::sd_jwt::issue(
-            profile,
-            &issuer,
-            &results,
-            "subject-ref",
-            None,
-            time::OffsetDateTime::now_utc(),
-            registry_notary_core::sd_jwt::IssueOptions::default(),
-        )
-        .await
-        .expect("SoftHSM-backed credential issues");
-        assert!(
-            signed.compact.contains('~'),
-            "issued credential includes SD-JWT disclosure separators"
-        );
-    }
-
-    #[cfg(feature = "pkcs11")]
-    fn softhsm_module_path() -> Option<String> {
-        if let Some(path) = command_output(
-            std::process::Command::new("softhsm2-util")
-                .arg("--show-config")
-                .arg("default-pkcs11-lib"),
-        )
-        .and_then(|output| String::from_utf8(output).ok())
-        .map(|path| path.trim().to_string())
-        .filter(|path| !path.is_empty() && std::path::Path::new(path).is_absolute())
-        {
-            return Some(path);
-        }
-
-        [
-            "/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so",
-            "/usr/lib/softhsm/libsofthsm2.so",
-            "/usr/local/lib/softhsm/libsofthsm2.so",
-            "/opt/homebrew/opt/softhsm/lib/softhsm/libsofthsm2.so",
-            "/usr/local/opt/softhsm/lib/softhsm/libsofthsm2.so",
-        ]
-        .into_iter()
-        .find(|path| std::path::Path::new(path).is_file())
-        .map(str::to_string)
-    }
-
-    #[cfg(feature = "pkcs11")]
-    fn require_softhsm() -> bool {
-        std::env::var("REGISTRY_NOTARY_REQUIRE_SOFTHSM")
-            .map(|value| value == "1" || value.eq_ignore_ascii_case("true"))
-            .unwrap_or(false)
-    }
-
-    #[cfg(feature = "pkcs11")]
-    fn command_output(command: &mut std::process::Command) -> Option<Vec<u8>> {
-        let output = command.output().ok()?;
-        output.status.success().then_some(output.stdout)
-    }
-
-    #[cfg(feature = "pkcs11")]
-    fn run_command(command: &mut std::process::Command) {
-        let output = command.output().expect("command starts");
-        assert!(
-            output.status.success(),
-            "command failed: stdout={}\nstderr={}",
-            String::from_utf8_lossy(&output.stdout),
-            String::from_utf8_lossy(&output.stderr)
-        );
-    }
diff --git a/crates/registry-notary-server/src/standalone/tests/support.inc b/crates/registry-notary-server/src/standalone/tests/support.inc
deleted file mode 100644
index 55501c54a..000000000
--- a/crates/registry-notary-server/src/standalone/tests/support.inc
+++ /dev/null
@@ -1,29 +0,0 @@
-    // SPDX-License-Identifier: Apache-2.0
-
-    use super::*;
-
-    use axum::body::Body;
-    use axum::routing::get;
-    use axum_test::TestServer;
-    #[cfg(feature = "pkcs11")]
-    use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-    #[cfg(feature = "pkcs11")]
-    use base64::Engine;
-    use registry_notary_core::{
-        tokens::{
-            mint_access_token, AccessTokenClaims, BoundSubject,
-            NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION, NOTARY_AUTHORIZATION_DETAILS_TYPE,
-            NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-        },
-        SubjectAccessDenialCode, SubjectAccessRateLimitsConfig,
-    };
-    #[cfg(feature = "pkcs11")]
-    use registry_notary_core::{ClaimProvenance, ClaimResultView, TargetRefView};
-    const TEST_AUDIT_HASH_SECRET_ENV: &str = "REGISTRY_NOTARY_TEST_AUDIT_HASH_SECRET";
-    const TEST_ISSUER_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA"}"#;
-    const TEST_ISSUER_JWK_WITH_KID: &str = r##"{"kty":"OKP","crv":"Ed25519","kid":"did:web:issuer.example#file-watch","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA"}"##;
-    const TEST_ROTATED_ISSUER_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"8jFBgUJxaaQimd4NjzxhvPYyNbcOnnZsqOntZbpP3Xk","x":"XvW-aWwJCWSYoYudTB9OZqNHURKElnnyGNa6DQNjzZk","alg":"EdDSA"}"#;
-    const TEST_OLD_ISSUER_PUBLIC_JWK: &str = r##"{"kty":"OKP","crv":"Ed25519","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"did:web:issuer.example#old"}"##;
-    const TEST_OLD_HSM_PUBLIC_JWK: &str = r##"{"kty":"OKP","crv":"Ed25519","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"did:web:issuer.example#hsm-old"}"##;
-    #[cfg(feature = "pkcs11")]
-    static SOFTHSM_ENV_LOCK: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
diff --git a/crates/registry-notary-server/src/standalone/transport/mod.rs b/crates/registry-notary-server/src/standalone/transport/mod.rs
deleted file mode 100644
index 110c4c905..000000000
--- a/crates/registry-notary-server/src/standalone/transport/mod.rs
+++ /dev/null
@@ -1,140 +0,0 @@
-use super::*;
-
-/// Outermost response middleware: injects `request_id` into any
-/// `application/problem+json` body and sets the `x-request-id` response header.
-///
-/// Mints a server-owned ULID before running the inner stack so that
-/// early-boundary rejections (414, 413) receive a correlation identifier even
-/// when the inner auth/audit layer has not yet run. For responses produced
-/// by inner handlers that already carry `x-request-id`, the existing header
-/// value is used and the body field is inserted only when absent (idempotent
-/// when the inner response already has both).
-pub(super) async fn attach_request_id_to_problem_response(
-    request: Request,
-    next: Next,
-) -> Response {
-    // Mint a server-owned ULID for this request.  Early-boundary middlewares
-    // (reject_oversized_request_uri, rewrite_payload_too_large_problem) run
-    // inside this layer; they do not have access to auth_audit_middleware's
-    // task-local, so this is the only opportunity to assign them an id.
-    let minted = Ulid::new().to_string();
-
-    let response = next.run(request).await;
-
-    let is_problem = response
-        .headers()
-        .get(header::CONTENT_TYPE)
-        .and_then(|value| value.to_str().ok())
-        .is_some_and(|value| value.starts_with("application/problem+json"));
-    if !is_problem {
-        return response;
-    }
-
-    // Prefer a request_id already set by an inner layer (auth_audit_middleware
-    // sets x-request-id on authenticated-path responses); fall back to the
-    // minted value for early-boundary responses.
-    let request_id = response
-        .headers()
-        .get("x-request-id")
-        .and_then(|value| value.to_str().ok())
-        .filter(|value| !value.is_empty())
-        .map(str::to_string)
-        .unwrap_or(minted);
-
-    let (mut parts, body) = response.into_parts();
-    let Ok(bytes) = axum::body::to_bytes(body, 64 * 1024).await else {
-        // Body too large or read error; the body is consumed and cannot be
-        // restored, so return an empty body with corrected framing.
-        parts.headers.remove(header::CONTENT_LENGTH);
-        return Response::from_parts(parts, Body::empty());
-    };
-    let Ok(Value::Object(mut problem)) = serde_json::from_slice::<Value>(&bytes) else {
-        // Non-object or non-JSON body; pass through unchanged.
-        return Response::from_parts(parts, Body::from(bytes));
-    };
-    // Insert only when absent so existing per-handler injection is idempotent.
-    problem
-        .entry("request_id")
-        .or_insert_with(|| Value::String(request_id.clone()));
-    let Ok(body) = serde_json::to_vec(&Value::Object(problem)) else {
-        // Serialization failed (should not happen); pass through original bytes.
-        return Response::from_parts(parts, Body::from(bytes));
-    };
-    parts.headers.remove(header::CONTENT_LENGTH);
-    if let Ok(value) = HeaderValue::from_str(&request_id) {
-        parts.headers.insert("x-request-id", value);
-    }
-    Response::from_parts(parts, Body::from(body))
-}
-
-pub(super) async fn reject_oversized_request_uri(request: Request, next: Next) -> Response {
-    let uri_len = request
-        .uri()
-        .path_and_query()
-        .map(|value| value.as_str().len())
-        .unwrap_or_else(|| request.uri().path().len());
-    if uri_len <= MAX_REQUEST_URI_BYTES {
-        return next.run(request).await;
-    }
-    request_uri_too_long_problem()
-}
-
-pub(super) fn request_uri_too_long_problem() -> Response {
-    let status = StatusCode::URI_TOO_LONG;
-    let mut response = (
-        status,
-        Json(json!({
-            "type": format!("{}/request/uri-too-long", crate::PROBLEM_TYPE_BASE_URL),
-            "title": "URI too long",
-            "status": status.as_u16(),
-            "detail": "request URI exceeds the configured 8 KiB limit",
-            "code": "request.uri_too_long",
-        })),
-    )
-        .into_response();
-    response.headers_mut().insert(
-        header::CONTENT_TYPE,
-        HeaderValue::from_static("application/problem+json"),
-    );
-    response
-}
-
-pub(super) async fn rewrite_payload_too_large_problem(request: Request, next: Next) -> Response {
-    let response = next.run(request).await;
-    if response.status() != StatusCode::PAYLOAD_TOO_LARGE {
-        return response;
-    }
-    let is_problem_json = response
-        .headers()
-        .get(header::CONTENT_TYPE)
-        .and_then(|value| value.to_str().ok())
-        .is_some_and(|value| value.starts_with("application/problem+json"));
-    if is_problem_json {
-        return response;
-    }
-    registry_platform_httpsec::body_limit_problem_response(Request::new(Body::empty())).await
-}
-
-pub(crate) fn audit_error_response(error: AuditError) -> Response {
-    tracing::error!(target: "registry_notary_server::audit", error = %error, "audit event write failed");
-    let status = StatusCode::INTERNAL_SERVER_ERROR;
-    let mut response = (
-        status,
-        Json(json!({
-            "type": format!("{}/audit/write_failed", crate::PROBLEM_TYPE_BASE_URL),
-            "title": "Audit write failed",
-            "status": status.as_u16(),
-            "detail": "audit event could not be written",
-            "code": "audit.write_failed",
-        })),
-    )
-        .into_response();
-    response.headers_mut().insert(
-        header::CONTENT_TYPE,
-        "application/problem+json".parse().unwrap(),
-    );
-    response
-        .extensions_mut()
-        .insert(EvidenceErrorCodeContext("audit.write_failed".to_string()));
-    response
-}
diff --git a/crates/registry-notary-server/src/state_plane/handle.rs b/crates/registry-notary-server/src/state_plane/handle.rs
deleted file mode 100644
index 91bd7abc1..000000000
--- a/crates/registry-notary-server/src/state_plane/handle.rs
+++ /dev/null
@@ -1,269 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Activation boundary for Notary correctness state.
-//!
-//! This handle owns only storage-mode selection and PostgreSQL lifecycle. The
-//! domain modules retain their typed transaction APIs and never route through
-//! an opaque key-value interface.
-
-use std::sync::{Arc, OnceLock};
-
-use registry_notary_core::{StateConfig, STATE_STORAGE_IN_MEMORY};
-
-use super::{
-    runtime::{start_postgres_retention_maintenance, PostgresRetentionMaintenance},
-    NotaryPostgresStatePlaneError, NotaryPostgresStatePlaneReadiness,
-    NotaryPostgresStatePlaneRuntime, PostgresSensitiveState, PostgresStatePlaneAttestation,
-    PostgresStatePlaneConfig, SensitiveStateError, SensitiveStateKeyConfig,
-};
-
-#[derive(Clone)]
-enum StatePlaneMode {
-    InMemory,
-    Postgresql(PostgresStatePlaneConfig),
-}
-
-/// Shared activation state used by the typed Notary domain adapters.
-pub(crate) struct NotaryStatePlaneHandle {
-    mode: StatePlaneMode,
-    runtime: OnceLock<Arc<NotaryPostgresStatePlaneRuntime>>,
-    retention_maintenance: OnceLock<PostgresRetentionMaintenance>,
-    sensitive_key: Option<SensitiveStateKeyConfig>,
-    sensitive: OnceLock<Arc<PostgresSensitiveState>>,
-}
-
-impl NotaryStatePlaneHandle {
-    pub(crate) fn from_config(
-        config: &StateConfig,
-        preauthorization_enabled: bool,
-    ) -> Result<Self, SensitiveStateError> {
-        let mode = if config.storage == STATE_STORAGE_IN_MEMORY {
-            StatePlaneMode::InMemory
-        } else {
-            StatePlaneMode::Postgresql(PostgresStatePlaneConfig::try_from(&config.postgresql)?)
-        };
-        let sensitive_key = (!matches!(mode, StatePlaneMode::InMemory) && preauthorization_enabled)
-            .then(|| {
-                SensitiveStateKeyConfig::new(config.postgresql.sensitive_state_key_env.clone())
-            })
-            .transpose()?;
-        Ok(Self {
-            mode,
-            runtime: OnceLock::new(),
-            retention_maintenance: OnceLock::new(),
-            sensitive_key,
-            sensitive: OnceLock::new(),
-        })
-    }
-
-    #[must_use]
-    pub(crate) fn is_in_memory(&self) -> bool {
-        matches!(self.mode, StatePlaneMode::InMemory)
-    }
-
-    #[must_use]
-    pub(crate) fn is_activated(&self) -> bool {
-        self.is_in_memory()
-            || (self.runtime.get().is_some()
-                && (self.sensitive_key.is_none() || self.sensitive.get().is_some()))
-    }
-
-    pub(crate) async fn activate(&self) -> Result<(), SensitiveStateError> {
-        let StatePlaneMode::Postgresql(config) = &self.mode else {
-            return Ok(());
-        };
-        if self.is_activated() {
-            return Ok(());
-        }
-        let runtime = Arc::new(NotaryPostgresStatePlaneRuntime::connect(config).await?);
-        let sensitive = match &self.sensitive_key {
-            Some(key) => Some(Arc::new(
-                PostgresSensitiveState::activate(Arc::clone(&runtime), key).await?,
-            )),
-            None => None,
-        };
-        if let Some(sensitive) = sensitive {
-            let _ = self.sensitive.set(sensitive);
-        }
-        let _ = self.runtime.set(runtime);
-        if self.is_activated() {
-            Ok(())
-        } else {
-            Err(SensitiveStateError::NotActivated)
-        }
-    }
-
-    pub(crate) fn runtime(
-        &self,
-    ) -> Result<Arc<NotaryPostgresStatePlaneRuntime>, NotaryPostgresStatePlaneError> {
-        self.runtime
-            .get()
-            .cloned()
-            .ok_or(NotaryPostgresStatePlaneError::DatabaseUnavailable)
-    }
-
-    /// Start the PostgreSQL retention worker only at the serving activation
-    /// boundary. Operator state checks activate and attest without calling it.
-    pub(crate) fn start_retention_maintenance(&self) -> Result<(), NotaryPostgresStatePlaneError> {
-        if self.is_in_memory() {
-            return Ok(());
-        }
-        let runtime = self.runtime()?;
-        self.retention_maintenance
-            .get_or_init(|| start_postgres_retention_maintenance(runtime));
-        Ok(())
-    }
-
-    pub(crate) fn sensitive_state(
-        &self,
-    ) -> Result<Arc<PostgresSensitiveState>, SensitiveStateError> {
-        self.sensitive
-            .get()
-            .cloned()
-            .ok_or(SensitiveStateError::NotActivated)
-    }
-
-    pub(crate) async fn readiness(&self) -> NotaryPostgresStatePlaneReadiness {
-        match &self.mode {
-            StatePlaneMode::InMemory => NotaryPostgresStatePlaneReadiness::Ready,
-            StatePlaneMode::Postgresql(_) => match self.runtime.get() {
-                Some(_) if self.sensitive_key.is_some() && self.sensitive.get().is_none() => {
-                    NotaryPostgresStatePlaneReadiness::ConfigurationInvalid
-                }
-                Some(runtime) => {
-                    let readiness = runtime.readiness().await;
-                    if readiness != NotaryPostgresStatePlaneReadiness::Ready {
-                        return readiness;
-                    }
-                    match self.sensitive.get() {
-                        Some(sensitive) => sensitive
-                            .attest_key_generation()
-                            .await
-                            .map_or_else(readiness_from_sensitive_error, |_| readiness),
-                        None => readiness,
-                    }
-                }
-                None => NotaryPostgresStatePlaneReadiness::DatabaseUnavailable,
-            },
-        }
-    }
-}
-
-impl std::fmt::Debug for NotaryStatePlaneHandle {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("NotaryStatePlaneHandle")
-            .field("in_memory", &self.is_in_memory())
-            .field("activated", &self.is_activated())
-            .field(
-                "retention_maintenance",
-                &self.retention_maintenance.get().is_some(),
-            )
-            .field("sensitive_state_required", &self.sensitive_key.is_some())
-            .finish()
-    }
-}
-
-impl Drop for NotaryStatePlaneHandle {
-    fn drop(&mut self) {
-        if let Some(maintenance) = self.retention_maintenance.get() {
-            maintenance.shutdown();
-        }
-        if let Some(runtime) = self.runtime.get() {
-            runtime.shutdown();
-        }
-    }
-}
-
-/// Activate the same PostgreSQL and sensitive-state boundary used by serving
-/// startup, then return a fresh runtime attestation for operator diagnostics.
-pub async fn attest_postgres_state_plane_runtime(
-    config: &StateConfig,
-    preauthorization_enabled: bool,
-) -> Result<PostgresStatePlaneAttestation, NotaryPostgresStatePlaneReadiness> {
-    let handle = NotaryStatePlaneHandle::from_config(config, preauthorization_enabled)
-        .map_err(readiness_from_sensitive_error)?;
-    handle
-        .activate()
-        .await
-        .map_err(readiness_from_sensitive_error)?;
-    let runtime = handle
-        .runtime()
-        .map_err(NotaryPostgresStatePlaneReadiness::from_error)?;
-    let attestation = runtime
-        .attestation()
-        .await
-        .map_err(NotaryPostgresStatePlaneReadiness::from_error);
-    runtime.shutdown();
-    attestation
-}
-
-const fn readiness_from_sensitive_error(
-    error: SensitiveStateError,
-) -> NotaryPostgresStatePlaneReadiness {
-    match error {
-        SensitiveStateError::StatePlane(error) => {
-            NotaryPostgresStatePlaneReadiness::from_error(error)
-        }
-        SensitiveStateError::InvalidKeyConfiguration
-        | SensitiveStateError::KeyEnvironmentUnavailable
-        | SensitiveStateError::InvalidKeyEncoding
-        | SensitiveStateError::InvalidKeyLength
-        | SensitiveStateError::CryptographyUnavailable
-        | SensitiveStateError::NotActivated
-        | SensitiveStateError::InvalidStoredRecord => {
-            NotaryPostgresStatePlaneReadiness::ConfigurationInvalid
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[tokio::test]
-    async fn in_memory_serving_activation_does_not_start_postgres_maintenance() {
-        let config = StateConfig {
-            storage: STATE_STORAGE_IN_MEMORY.to_string(),
-            ..StateConfig::default()
-        };
-        let handle = NotaryStatePlaneHandle::from_config(&config, false)
-            .expect("in-memory state handle is valid");
-
-        handle
-            .activate()
-            .await
-            .expect("in-memory activation succeeds");
-        handle
-            .start_retention_maintenance()
-            .expect("in-memory serving activation is a no-op");
-
-        assert!(handle.runtime.get().is_none());
-        assert!(handle.retention_maintenance.get().is_none());
-    }
-
-    #[test]
-    fn sensitive_activation_errors_map_to_value_free_doctor_components() {
-        let configuration_errors = [
-            SensitiveStateError::InvalidKeyConfiguration,
-            SensitiveStateError::KeyEnvironmentUnavailable,
-            SensitiveStateError::InvalidKeyEncoding,
-            SensitiveStateError::InvalidKeyLength,
-            SensitiveStateError::CryptographyUnavailable,
-            SensitiveStateError::NotActivated,
-            SensitiveStateError::InvalidStoredRecord,
-        ];
-        for error in configuration_errors {
-            assert_eq!(
-                readiness_from_sensitive_error(error).doctor_component_code(),
-                "configuration_invalid"
-            );
-        }
-        assert_eq!(
-            readiness_from_sensitive_error(SensitiveStateError::StatePlane(
-                NotaryPostgresStatePlaneError::SchemaIncompatible,
-            ))
-            .doctor_component_code(),
-            "schema_incompatible"
-        );
-    }
-}
diff --git a/crates/registry-notary-server/src/state_plane/migration.rs b/crates/registry-notary-server/src/state_plane/migration.rs
deleted file mode 100644
index d04616224..000000000
--- a/crates/registry-notary-server/src/state_plane/migration.rs
+++ /dev/null
@@ -1,1058 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Forward-only installation and attestation for Notary PostgreSQL state v1.
-//!
-//! The owner connection applies this migration explicitly. Normal Notary
-//! startup uses only the separately attested runtime role and never applies
-//! DDL. Relay schemas, roles, migrations, and advisory locks are intentionally
-//! not reused.
-
-use std::fmt;
-
-use sha2::{Digest, Sha256};
-use thiserror::Error;
-use tokio_postgres::{Client, GenericClient, Row, Transaction};
-
-pub const STATE_PLANE_CAPABILITY_V1: &str = "registry.notary.postgresql-state/v1";
-pub const STATE_PLANE_SCHEMA_VERSION_V1: i32 = 1;
-// This semantic identity changes when a typed state domain or a cross-runtime
-// correctness invariant changes. Exact PostgreSQL structure and executable
-// bodies are attested separately by the per-major catalog fingerprints.
-#[cfg(test)]
-const STATE_PLANE_SCHEMA_IDENTITY_PREIMAGE_V1: &str = concat!(
-    "registry.notary.postgresql-state.semantic-identity.v1\0",
-    "schema-version=1\0",
-    "schema=notary-owned-private-tables-fixed-typed-api-functions-v1\0",
-    "roles=owner-nologin-migration-assumption-runtime-execute-only-no-private-access-v1\0",
-    "database=postgresql-16-17-18-writable-safe-durability-database-clock-v1\0",
-    "replay=keyed-scope-identifier-one-winner-expiry-replacement-v1\0",
-    "nonce=keyed-generation-reserve-compare-consume-sixty-second-tombstone-v2\0",
-    "evaluation=client-bound-stored-record-v2-atomic-publication-expiry-v1\0",
-    "batch=keyed-request-owner-lease-quota-once-takeover-atomic-completion-stored-response-v2-fifteen-minute-retention-v1\0",
-    "credential-status=insert-only-locked-transition-terminal-revocation-database-clock-effective-expiry-before-suspension-retention-monotonic-updated-at-v2\0",
-    "machine-quota=keyed-principal-fixed-minute-whole-cost-atomic-quota-independent-idempotency-request-conflict-owner-sixty-second-lease-renewal-bounded-completion-final-owner-fence-evaluation-retention-takeover-v4\0",
-    "subject-access-quota=keyed-pseudonym-six-closed-buckets-fixed-windows-canonical-lock-order-caller-denial-order-atomic-all-or-none-check-only-no-mutation-v1\0",
-    "preauthorization-login=keyed-state-capacity-4096-encrypted-single-consume-expiry-live-key-attestation-v2\0",
-    "preauthorization-tx-code=verified-notary-issuer-stable-scope-jti-keyed-pin-verifier-peek-redeem-one-winner-expiry-live-key-attestation-v3\0",
-    "oid4vci-issuance-transaction=keyed-id-encrypted-immutable-record-sha256-uri-commitment-token-nonce-bind-holder-and-request-atomic-one-materialization-encrypted-response-terminal-failure-expiry-v2\0",
-    "issuance-evaluation-consumption=keyed-owner-evaluation-single-lineage-shared-direct-and-offer-expiry-capacity-v1\0",
-    "registry-client-offer=hashed-idempotency-exact-encrypted-response-read-only-preflight-before-side-effects-shared-evaluation-consumption-atomic-client-quota-transaction-and-optional-pin-expiry-capacity-v3\0",
-    "retention=thirteen-fixed-groups-bounded-expiry-prune-skip-locked-saturation-catch-up-v3\0",
-);
-pub const STATE_PLANE_SCHEMA_FINGERPRINT_V1: &str =
-    "5d18c2de416906b0c40bf8abdd7c7d7b9a1ddad1c21cb90dba50d24112e4f94b";
-// The immediately preceding v1 contract is the only supported in-place
-// upgrade source. Its exact catalog is attested before any DDL runs.
-const PREVIOUS_STATE_PLANE_SCHEMA_FINGERPRINT_V1: &str =
-    "f08bb0bc9b927b534ce736c640d43e3c7f898bd110616f92a60857c5fd1323fd";
-
-const MIGRATION_ADVISORY_LOCK_KEY_V1: i64 = 0x4e4f_5441_5259_0001;
-const EXPECTED_PRIVATE_TABLE_COUNT_V1: i64 = 14;
-const EXPECTED_API_FUNCTION_COUNT_V1: i64 = 36;
-
-/// The `NOLOGIN` role that owns the Notary schemas and fixed functions.
-#[derive(Clone, PartialEq, Eq)]
-pub struct OwnerDatabaseRole(String);
-
-impl OwnerDatabaseRole {
-    pub fn parse(value: impl Into<String>) -> Result<Self, StatePlaneMigrationError> {
-        parse_role_name(value.into())
-            .map(Self)
-            .map_err(|()| StatePlaneMigrationError::InvalidOwnerRole)
-    }
-
-    pub fn as_str(&self) -> &str {
-        &self.0
-    }
-}
-
-impl fmt::Debug for OwnerDatabaseRole {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("OwnerDatabaseRole")
-            .field("name", &"<redacted>")
-            .finish()
-    }
-}
-
-/// A pre-provisioned login role used only by the Notary runtime.
-///
-/// Role names are deliberately restricted to unquoted PostgreSQL identifiers.
-/// This makes the small DCL fragment non-injectable without adding a general
-/// SQL identifier-quoting abstraction to a security-sensitive installer.
-#[derive(Clone, PartialEq, Eq)]
-pub struct RuntimeDatabaseRole(String);
-
-impl RuntimeDatabaseRole {
-    pub fn parse(value: impl Into<String>) -> Result<Self, StatePlaneMigrationError> {
-        parse_role_name(value.into())
-            .map(Self)
-            .map_err(|()| StatePlaneMigrationError::InvalidRuntimeRole)
-    }
-
-    pub fn as_str(&self) -> &str {
-        &self.0
-    }
-}
-
-fn parse_role_name(value: String) -> Result<String, ()> {
-    let mut chars = value.chars();
-    let valid_first = chars
-        .next()
-        .is_some_and(|character| character == '_' || character.is_ascii_lowercase());
-    let valid_rest = chars.all(|character| {
-        character == '_' || character.is_ascii_lowercase() || character.is_ascii_digit()
-    });
-    if value.len() > 63 || !valid_first || !valid_rest {
-        return Err(());
-    }
-    Ok(value)
-}
-
-impl fmt::Debug for RuntimeDatabaseRole {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("RuntimeDatabaseRole")
-            .field("name", &"<redacted>")
-            .finish()
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
-pub enum StatePlaneMigrationError {
-    #[error("Notary PostgreSQL runtime role is invalid")]
-    InvalidRuntimeRole,
-    #[error("Notary PostgreSQL owner role is invalid")]
-    InvalidOwnerRole,
-    #[error("Notary PostgreSQL migration role cannot assume the owner role")]
-    OwnerRoleUnavailable,
-    #[error("Notary PostgreSQL runtime role is unavailable or unsafe")]
-    InvalidRuntimeRoleContract,
-    #[error("Notary PostgreSQL owner and runtime roles must be distinct")]
-    RoleCollision,
-    #[error("Notary PostgreSQL server major is unsupported")]
-    UnsupportedServerMajor,
-    #[error("Notary PostgreSQL database is read-only or recovering")]
-    DatabaseNotWritable,
-    #[error("Notary PostgreSQL durability settings are unsafe")]
-    UnsafeDurability,
-    #[error("Notary PostgreSQL state schema is partially installed")]
-    PartialInstallation,
-    #[error("Notary PostgreSQL state capability has drifted")]
-    CapabilityDrift,
-    #[error("Notary PostgreSQL state operation is unavailable")]
-    Unavailable,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct PostgresStatePlaneAttestation {
-    pub server_major: i32,
-    pub schema_version: i32,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-struct BoundRoleOids {
-    owner: i64,
-    runtime: i64,
-}
-
-#[derive(Debug, Clone)]
-struct CapabilityBinding {
-    roles: BoundRoleOids,
-    server_major: i32,
-}
-
-pub async fn install_postgres_state_plane_v1(
-    client: &mut Client,
-    owner_role: &OwnerDatabaseRole,
-    runtime_role: &RuntimeDatabaseRole,
-) -> Result<PostgresStatePlaneAttestation, StatePlaneMigrationError> {
-    let transaction = client
-        .transaction()
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-    transaction
-        .batch_execute(
-            "SET LOCAL lock_timeout = '5s';\n\
-             SET LOCAL statement_timeout = '30s';\n\
-             SET LOCAL idle_in_transaction_session_timeout = '30s'",
-        )
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-    transaction
-        .query_one(
-            "SELECT pg_catalog.pg_advisory_xact_lock($1)",
-            &[&MIGRATION_ADVISORY_LOCK_KEY_V1],
-        )
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-
-    let server_major = attest_server(&transaction).await?;
-    let role_oids =
-        validate_and_assume_install_roles(&transaction, owner_role, runtime_role).await?;
-    let schema_count = schema_count(&transaction).await?;
-    match schema_count {
-        0 => {
-            transaction
-                .batch_execute(POSTGRES_STATE_PLANE_MIGRATION_V1)
-                .await
-                .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-            bind_metadata(&transaction, role_oids).await?;
-            transaction
-                .batch_execute(&state_plane_acl_sql(runtime_role))
-                .await
-                .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-        }
-        2 => {
-            // Prove ownership and the complete catalog through public catalog
-            // data before inspecting private metadata. A wrong owner or an
-            // unknown catalog must fail closed as drift without gaining access
-            // to restored state.
-            attest_catalog_ownership(&transaction, role_oids.owner).await?;
-            let observed_catalog = catalog_definition_fingerprint(&transaction).await?;
-            if observed_catalog == expected_catalog_definition_fingerprint(server_major)? {
-                if installed_schema_fingerprint(&transaction).await?
-                    != STATE_PLANE_SCHEMA_FINGERPRINT_V1
-                {
-                    return Err(StatePlaneMigrationError::CapabilityDrift);
-                }
-                rebind_restored_metadata(&transaction, role_oids, runtime_role, server_major)
-                    .await?;
-            } else if observed_catalog
-                == expected_previous_catalog_definition_fingerprint(server_major)?
-            {
-                if installed_schema_fingerprint(&transaction).await?
-                    != PREVIOUS_STATE_PLANE_SCHEMA_FINGERPRINT_V1
-                {
-                    return Err(StatePlaneMigrationError::CapabilityDrift);
-                }
-                upgrade_previous_state_plane(&transaction, role_oids, runtime_role, server_major)
-                    .await?;
-            } else {
-                return Err(StatePlaneMigrationError::CapabilityDrift);
-            }
-        }
-        _ => return Err(StatePlaneMigrationError::PartialInstallation),
-    }
-    attest_owner_metadata(&transaction, role_oids).await?;
-    attest_catalog_shape(&transaction, role_oids, server_major).await?;
-    transaction
-        .commit()
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-    Ok(PostgresStatePlaneAttestation {
-        server_major,
-        schema_version: STATE_PLANE_SCHEMA_VERSION_V1,
-    })
-}
-
-pub async fn attest_postgres_state_plane_v1(
-    client: &Client,
-) -> Result<PostgresStatePlaneAttestation, StatePlaneMigrationError> {
-    let server_major = attest_server(client).await?;
-    let binding = runtime_capability_binding(client).await?;
-    if binding.server_major != server_major {
-        return Err(StatePlaneMigrationError::CapabilityDrift);
-    }
-    attest_catalog_shape(client, binding.roles, server_major).await?;
-    Ok(PostgresStatePlaneAttestation {
-        server_major,
-        schema_version: STATE_PLANE_SCHEMA_VERSION_V1,
-    })
-}
-
-async fn runtime_capability_binding(
-    client: &Client,
-) -> Result<CapabilityBinding, StatePlaneMigrationError> {
-    let row = client
-        .query_opt("SELECT * FROM registry_notary_api.attest_v1()", &[])
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?
-        .ok_or(StatePlaneMigrationError::CapabilityDrift)?;
-    let capability: String = row
-        .try_get("capability_id")
-        .map_err(|_| StatePlaneMigrationError::CapabilityDrift)?;
-    let fingerprint: String = row
-        .try_get("schema_fingerprint")
-        .map_err(|_| StatePlaneMigrationError::CapabilityDrift)?;
-    let schema_version = row_i32(&row, "schema_version")?;
-    let roles = BoundRoleOids {
-        owner: row_i64(&row, "owner_role_oid")?,
-        runtime: row_i64(&row, "runtime_role_oid")?,
-    };
-    if row_i64(&row, "caller_role_oid")? != roles.runtime {
-        return Err(StatePlaneMigrationError::InvalidRuntimeRoleContract);
-    }
-    if capability != STATE_PLANE_CAPABILITY_V1
-        || schema_version != STATE_PLANE_SCHEMA_VERSION_V1
-        || fingerprint != STATE_PLANE_SCHEMA_FINGERPRINT_V1
-        || !row_bool(&row, "database_writable")?
-        || !row_bool(&row, "durability_safe")?
-    {
-        return Err(StatePlaneMigrationError::CapabilityDrift);
-    }
-    Ok(CapabilityBinding {
-        roles,
-        server_major: row_i32(&row, "server_major")?,
-    })
-}
-
-async fn attest_server(client: &impl GenericClient) -> Result<i32, StatePlaneMigrationError> {
-    let row = client
-        .query_one(
-            "SELECT current_setting('server_version_num')::integer / 10000 AS server_major,\n\
-                    NOT pg_catalog.pg_is_in_recovery()\n\
-                      AND NOT current_setting('transaction_read_only')::boolean AS writable,\n\
-                    current_setting('fsync') = 'on'\n\
-                      AND current_setting('synchronous_commit') = 'on'\n\
-                      AND current_setting('full_page_writes') = 'on' AS durable",
-            &[],
-        )
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-    let server_major = row_i32(&row, "server_major")?;
-    if !(16..=18).contains(&server_major) {
-        return Err(StatePlaneMigrationError::UnsupportedServerMajor);
-    }
-    if !row_bool(&row, "writable")? {
-        return Err(StatePlaneMigrationError::DatabaseNotWritable);
-    }
-    if !row_bool(&row, "durable")? {
-        return Err(StatePlaneMigrationError::UnsafeDurability);
-    }
-    Ok(server_major)
-}
-
-async fn validate_and_assume_install_roles(
-    transaction: &Transaction<'_>,
-    owner_role: &OwnerDatabaseRole,
-    runtime_role: &RuntimeDatabaseRole,
-) -> Result<BoundRoleOids, StatePlaneMigrationError> {
-    let row = transaction
-        .query_opt(
-            "SELECT owner_role.oid::bigint AS owner_oid,\n\
-                    runtime_role.oid::bigint AS runtime_oid,\n\
-                    migration_role.rolcanlogin\n\
-                      AND NOT migration_role.rolsuper\n\
-                      AND NOT migration_role.rolcreaterole\n\
-                      AND NOT migration_role.rolcreatedb\n\
-                      AND NOT migration_role.rolreplication\n\
-                      AND NOT migration_role.rolbypassrls AS migration_safe,\n\
-                    NOT owner_role.rolcanlogin\n\
-                      AND NOT owner_role.rolsuper\n\
-                      AND NOT owner_role.rolcreaterole\n\
-                      AND NOT owner_role.rolcreatedb\n\
-                      AND NOT owner_role.rolreplication\n\
-                      AND NOT owner_role.rolbypassrls AS owner_safe,\n\
-                    runtime_role.rolcanlogin\n\
-                      AND NOT runtime_role.rolsuper\n\
-                      AND NOT runtime_role.rolcreaterole\n\
-                      AND NOT runtime_role.rolcreatedb\n\
-                      AND NOT runtime_role.rolreplication\n\
-                      AND NOT runtime_role.rolbypassrls AS runtime_safe,\n\
-                    NOT pg_catalog.pg_has_role(runtime_role.oid, owner_role.oid, 'MEMBER')\n\
-                      AS runtime_not_owner_member,\n\
-                    pg_catalog.pg_has_role(migration_role.oid, owner_role.oid, 'MEMBER')\n\
-                      AS migration_may_assume_owner,\n\
-                    migration_role.oid <> owner_role.oid AS migration_is_distinct\n\
-               FROM pg_catalog.pg_roles AS migration_role\n\
-               JOIN pg_catalog.pg_roles AS owner_role ON owner_role.rolname = $1\n\
-               JOIN pg_catalog.pg_roles AS runtime_role ON runtime_role.rolname = $2\n\
-              WHERE migration_role.rolname = session_user\n\
-                AND current_user = session_user",
-            &[&owner_role.as_str(), &runtime_role.as_str()],
-        )
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?
-        .ok_or(StatePlaneMigrationError::InvalidRuntimeRoleContract)?;
-    if !row_bool(&row, "migration_safe")?
-        || !row_bool(&row, "migration_may_assume_owner")?
-        || !row_bool(&row, "migration_is_distinct")?
-    {
-        return Err(StatePlaneMigrationError::OwnerRoleUnavailable);
-    }
-    if !row_bool(&row, "owner_safe")? {
-        return Err(StatePlaneMigrationError::InvalidOwnerRole);
-    }
-    if !row_bool(&row, "runtime_safe")? || !row_bool(&row, "runtime_not_owner_member")? {
-        return Err(StatePlaneMigrationError::InvalidRuntimeRoleContract);
-    }
-    let oids = BoundRoleOids {
-        owner: row_i64(&row, "owner_oid")?,
-        runtime: row_i64(&row, "runtime_oid")?,
-    };
-    if oids.owner == oids.runtime {
-        return Err(StatePlaneMigrationError::RoleCollision);
-    }
-    transaction
-        .batch_execute(&format!("SET LOCAL ROLE {}", owner_role.as_str()))
-        .await
-        .map_err(|_| StatePlaneMigrationError::OwnerRoleUnavailable)?;
-    let assumed = transaction
-        .query_one(
-            "SELECT current_role = $1 AND session_user <> current_user AS assumed",
-            &[&owner_role.as_str()],
-        )
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-    if !row_bool(&assumed, "assumed")? {
-        return Err(StatePlaneMigrationError::OwnerRoleUnavailable);
-    }
-    Ok(oids)
-}
-
-async fn schema_count(client: &impl GenericClient) -> Result<i64, StatePlaneMigrationError> {
-    let row = client
-        .query_one(
-            "SELECT count(*)::bigint AS schema_count\n\
-               FROM pg_catalog.pg_namespace\n\
-              WHERE nspname IN ('registry_notary_private', 'registry_notary_api')",
-            &[],
-        )
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-    row_i64(&row, "schema_count")
-}
-
-async fn installed_schema_fingerprint(
-    client: &impl GenericClient,
-) -> Result<String, StatePlaneMigrationError> {
-    let row = client
-        .query_opt(
-            "SELECT capability_id, schema_version, schema_fingerprint\n\
-               FROM registry_notary_private.schema_metadata\n\
-              WHERE singleton\n\
-              FOR UPDATE",
-            &[],
-        )
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?
-        .ok_or(StatePlaneMigrationError::CapabilityDrift)?;
-    let capability: String = row
-        .try_get("capability_id")
-        .map_err(|_| StatePlaneMigrationError::CapabilityDrift)?;
-    if capability != STATE_PLANE_CAPABILITY_V1
-        || row_i32(&row, "schema_version")? != STATE_PLANE_SCHEMA_VERSION_V1
-    {
-        return Err(StatePlaneMigrationError::CapabilityDrift);
-    }
-    row.try_get("schema_fingerprint")
-        .map_err(|_| StatePlaneMigrationError::CapabilityDrift)
-}
-
-async fn bind_metadata(
-    transaction: &Transaction<'_>,
-    roles: BoundRoleOids,
-) -> Result<(), StatePlaneMigrationError> {
-    transaction
-        .execute(
-            "INSERT INTO registry_notary_private.schema_metadata (\n\
-                 singleton, capability_id, schema_version, schema_fingerprint,\n\
-                 owner_role_oid, runtime_role_oid\n\
-             ) VALUES (TRUE, $1, $2, $3, $4::bigint::oid, $5::bigint::oid)",
-            &[
-                &STATE_PLANE_CAPABILITY_V1,
-                &STATE_PLANE_SCHEMA_VERSION_V1,
-                &STATE_PLANE_SCHEMA_FINGERPRINT_V1,
-                &roles.owner,
-                &roles.runtime,
-            ],
-        )
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-    Ok(())
-}
-
-fn state_plane_acl_sql(runtime_role: &RuntimeDatabaseRole) -> String {
-    let role = runtime_role.as_str();
-    format!(
-        "REVOKE ALL ON SCHEMA registry_notary_private FROM PUBLIC;\n\
-         REVOKE ALL ON SCHEMA registry_notary_api FROM PUBLIC;\n\
-         REVOKE ALL ON ALL TABLES IN SCHEMA registry_notary_private FROM PUBLIC;\n\
-         REVOKE ALL ON ALL SEQUENCES IN SCHEMA registry_notary_private FROM PUBLIC;\n\
-         REVOKE EXECUTE ON ALL FUNCTIONS IN SCHEMA registry_notary_private FROM PUBLIC;\n\
-         REVOKE EXECUTE ON ALL FUNCTIONS IN SCHEMA registry_notary_api FROM PUBLIC;\n\
-         REVOKE ALL ON SCHEMA registry_notary_private FROM {role};\n\
-         REVOKE ALL ON ALL TABLES IN SCHEMA registry_notary_private FROM {role};\n\
-         REVOKE ALL ON ALL SEQUENCES IN SCHEMA registry_notary_private FROM {role};\n\
-         REVOKE ALL ON ALL FUNCTIONS IN SCHEMA registry_notary_private FROM {role};\n\
-         REVOKE ALL ON SCHEMA registry_notary_api FROM {role};\n\
-         REVOKE ALL ON ALL FUNCTIONS IN SCHEMA registry_notary_api FROM {role};\n\
-         GRANT USAGE ON SCHEMA registry_notary_api TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.attest_v1() TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.readiness_v1() TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.replay_insert_v1(bytea, bytea, timestamptz) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.nonce_reserve_v1(bytea, bytea, timestamptz) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.nonce_reservation_generation_v1(bytea, bytea) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.nonce_consume_v1(bytea, bytea, bigint) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.evaluation_insert_v1(text, bytea, bytea, text, smallint, jsonb, timestamptz, timestamptz) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.evaluation_get_v1(text, bytea) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.batch_reserve_v1(bytea, bytea, bytea, bytea, integer, integer, integer) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.batch_heartbeat_v1(bytea, bytea, bytea, integer) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.batch_complete_v1(bytea, bytea, bytea, jsonb, smallint, jsonb) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.batch_fail_v1(bytea, bytea, bytea) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.credential_status_insert_v1(text, text, text, timestamptz, timestamptz, integer) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.credential_status_get_v1(text) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.credential_status_update_v1(text, text) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.machine_quota_debit_v1(bytea, integer, integer) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.machine_quota_debit_once_v1(bytea, bytea, bytea, bytea, integer, integer, integer, timestamptz) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.machine_quota_operation_release_v1(bytea, bytea, bytea) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.subject_access_quota_debit_v1(text[], bytea[], integer[], integer[]) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.subject_access_quota_check_v1(text[], bytea[], integer[], integer[]) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.preauthorization_login_reserve_v1(bytea, text, bytea, bytea, bytea, timestamptz) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.preauthorization_login_consume_v1(bytea) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.preauthorization_tx_code_reserve_v1(bytea, bytea, bytea, smallint, timestamptz) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.preauthorization_tx_code_peek_v1(bytea) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.preauthorization_key_attest_v1(bytea) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.preauthorization_redeem_v1(bytea, bytea, timestamptz, boolean, bytea) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.evaluation_issuance_consume_v1(bytea, bytea, timestamptz) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.registry_client_offer_preflight_v1(bytea, bytea, bytea, bytea) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.registry_client_offer_reserve_v1(bytea, bytea, bytea, bytea, bytea, bytea, text, text, bytea, bytea, timestamptz, bytea, smallint, timestamptz, bytea, bytea, timestamptz, timestamptz, bytea, integer, integer, bytea, bytea) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.oid4vci_transaction_reserve_v1(bytea, bytea, text, text, bytea, bytea, timestamptz) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.oid4vci_transaction_get_v1(bytea) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.oid4vci_transaction_bind_nonce_v1(bytea, text, bytea) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.oid4vci_transaction_begin_v1(bytea, text, text, bytea, bytea, bytea) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.oid4vci_transaction_complete_v1(bytea, bytea, bytea, bytea, bytea) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.oid4vci_transaction_fail_v1(bytea, bytea) TO {role};\n\
-         GRANT EXECUTE ON FUNCTION registry_notary_api.retention_prune_v1(integer) TO {role};"
-    )
-}
-
-async fn rebind_restored_metadata(
-    transaction: &Transaction<'_>,
-    roles: BoundRoleOids,
-    runtime_role: &RuntimeDatabaseRole,
-    server_major: i32,
-) -> Result<(), StatePlaneMigrationError> {
-    // The candidate owner must already own the complete exact v1 catalog.
-    // Check this through pg_catalog before reading private metadata so a wrong
-    // owner is rejected as drift rather than gaining enough access to inspect
-    // or repair the restored schema.
-    attest_catalog_ownership_and_definition(
-        transaction,
-        roles.owner,
-        expected_catalog_definition_fingerprint(server_major)?,
-    )
-    .await?;
-    let observed_roles = metadata_roles_for_exact_v1(transaction).await?;
-    if observed_roles == roles {
-        transaction
-            .batch_execute(&state_plane_acl_sql(runtime_role))
-            .await
-            .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-        return Ok(());
-    }
-
-    // A logical restore may preserve the exact schema and rows while role OIDs
-    // change across clusters. Rebind only after proving that every restored
-    // object is already owned by the newly provisioned owner and that the live
-    // catalog is the compiled v1 contract. This never changes object ownership.
-    let updated = transaction
-        .execute(
-            "UPDATE registry_notary_private.schema_metadata\n\
-                SET owner_role_oid = $1::bigint::oid,\n\
-                    runtime_role_oid = $2::bigint::oid\n\
-              WHERE singleton\n\
-                AND capability_id = $3\n\
-                AND schema_version = $4\n\
-                AND schema_fingerprint = $5",
-            &[
-                &roles.owner,
-                &roles.runtime,
-                &STATE_PLANE_CAPABILITY_V1,
-                &STATE_PLANE_SCHEMA_VERSION_V1,
-                &STATE_PLANE_SCHEMA_FINGERPRINT_V1,
-            ],
-        )
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-    if updated != 1 {
-        return Err(StatePlaneMigrationError::CapabilityDrift);
-    }
-    transaction
-        .batch_execute(&state_plane_acl_sql(runtime_role))
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-    Ok(())
-}
-
-async fn upgrade_previous_state_plane(
-    transaction: &Transaction<'_>,
-    roles: BoundRoleOids,
-    runtime_role: &RuntimeDatabaseRole,
-    server_major: i32,
-) -> Result<(), StatePlaneMigrationError> {
-    // An upgrade is allowed only from the exact previously released catalog,
-    // already wholly owned by the candidate owner. This keeps the idempotent
-    // DDL below from accepting or concealing arbitrary catalog drift.
-    attest_catalog_ownership_and_definition(
-        transaction,
-        roles.owner,
-        expected_previous_catalog_definition_fingerprint(server_major)?,
-    )
-    .await?;
-    transaction
-        .batch_execute(POSTGRES_STATE_PLANE_MIGRATION_V1)
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-    let updated = transaction
-        .execute(
-            "UPDATE registry_notary_private.schema_metadata\n\
-                SET schema_fingerprint = $1,\n\
-                    owner_role_oid = $2::bigint::oid,\n\
-                    runtime_role_oid = $3::bigint::oid\n\
-              WHERE singleton\n\
-                AND capability_id = $4\n\
-                AND schema_version = $5\n\
-                AND schema_fingerprint = $6",
-            &[
-                &STATE_PLANE_SCHEMA_FINGERPRINT_V1,
-                &roles.owner,
-                &roles.runtime,
-                &STATE_PLANE_CAPABILITY_V1,
-                &STATE_PLANE_SCHEMA_VERSION_V1,
-                &PREVIOUS_STATE_PLANE_SCHEMA_FINGERPRINT_V1,
-            ],
-        )
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-    if updated != 1 {
-        return Err(StatePlaneMigrationError::CapabilityDrift);
-    }
-    transaction
-        .batch_execute(&state_plane_acl_sql(runtime_role))
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-    Ok(())
-}
-
-async fn metadata_roles_for_exact_v1(
-    client: &impl GenericClient,
-) -> Result<BoundRoleOids, StatePlaneMigrationError> {
-    let row = client
-        .query_opt(
-            "SELECT metadata.capability_id, metadata.schema_version,\n\
-                    metadata.schema_fingerprint, metadata.owner_role_oid::bigint AS owner_oid,\n\
-                    metadata.runtime_role_oid::bigint AS runtime_oid\n\
-               FROM registry_notary_private.schema_metadata AS metadata\n\
-              WHERE metadata.singleton",
-            &[],
-        )
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?
-        .ok_or(StatePlaneMigrationError::CapabilityDrift)?;
-    let capability: String = row
-        .try_get("capability_id")
-        .map_err(|_| StatePlaneMigrationError::CapabilityDrift)?;
-    let fingerprint: String = row
-        .try_get("schema_fingerprint")
-        .map_err(|_| StatePlaneMigrationError::CapabilityDrift)?;
-    if capability != STATE_PLANE_CAPABILITY_V1
-        || row_i32(&row, "schema_version")? != STATE_PLANE_SCHEMA_VERSION_V1
-        || fingerprint != STATE_PLANE_SCHEMA_FINGERPRINT_V1
-    {
-        return Err(StatePlaneMigrationError::CapabilityDrift);
-    }
-    Ok(BoundRoleOids {
-        owner: row_i64(&row, "owner_oid")?,
-        runtime: row_i64(&row, "runtime_oid")?,
-    })
-}
-
-async fn attest_catalog_ownership_and_definition(
-    client: &impl GenericClient,
-    owner_oid: i64,
-    expected_fingerprint: &str,
-) -> Result<(), StatePlaneMigrationError> {
-    attest_catalog_ownership(client, owner_oid).await?;
-    let observed = catalog_definition_fingerprint(client).await?;
-    if observed != expected_fingerprint {
-        return Err(StatePlaneMigrationError::CapabilityDrift);
-    }
-    Ok(())
-}
-
-async fn attest_catalog_ownership(
-    client: &impl GenericClient,
-    owner_oid: i64,
-) -> Result<(), StatePlaneMigrationError> {
-    let ownership = client
-        .query_one(
-            "SELECT (SELECT count(*) = 2 AND bool_and(namespace.nspowner = $1::bigint::oid)\n\
-                       FROM pg_catalog.pg_namespace AS namespace\n\
-                      WHERE namespace.nspname IN ('registry_notary_private',\n\
-                                                   'registry_notary_api')) AS schemas_owned,\n\
-                    NOT EXISTS (\n\
-                      SELECT 1 FROM pg_catalog.pg_class AS relation\n\
-                      JOIN pg_catalog.pg_namespace AS namespace\n\
-                        ON namespace.oid = relation.relnamespace\n\
-                     WHERE namespace.nspname IN ('registry_notary_private',\n\
-                                                  'registry_notary_api')\n\
-                       AND relation.relowner <> $1::bigint::oid\n\
-                    ) AS relations_owned,\n\
-                    NOT EXISTS (\n\
-                      SELECT 1 FROM pg_catalog.pg_proc AS function\n\
-                      JOIN pg_catalog.pg_namespace AS namespace\n\
-                        ON namespace.oid = function.pronamespace\n\
-                     WHERE namespace.nspname IN ('registry_notary_private',\n\
-                                                  'registry_notary_api')\n\
-                       AND function.proowner <> $1::bigint::oid\n\
-                    ) AS functions_owned",
-            &[&owner_oid],
-        )
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-    if !row_bool(&ownership, "schemas_owned")?
-        || !row_bool(&ownership, "relations_owned")?
-        || !row_bool(&ownership, "functions_owned")?
-    {
-        return Err(StatePlaneMigrationError::CapabilityDrift);
-    }
-    Ok(())
-}
-
-async fn attest_owner_metadata(
-    client: &impl GenericClient,
-    expected_roles: BoundRoleOids,
-) -> Result<(), StatePlaneMigrationError> {
-    if metadata_roles_for_exact_v1(client).await? != expected_roles {
-        return Err(StatePlaneMigrationError::CapabilityDrift);
-    }
-    Ok(())
-}
-
-async fn attest_catalog_shape(
-    client: &impl GenericClient,
-    roles: BoundRoleOids,
-    server_major: i32,
-) -> Result<(), StatePlaneMigrationError> {
-    let shape = client
-        .query_one(
-            "SELECT (\n\
-                 SELECT count(*)::bigint\n\
-                   FROM pg_catalog.pg_class AS relation\n\
-                   JOIN pg_catalog.pg_namespace AS namespace\n\
-                     ON namespace.oid = relation.relnamespace\n\
-                  WHERE namespace.nspname = 'registry_notary_private'\n\
-                    AND relation.relkind IN ('r', 'p')\n\
-               ) AS private_table_count,\n\
-               (\n\
-                 SELECT count(*)::bigint\n\
-                   FROM pg_catalog.pg_proc AS function\n\
-                   JOIN pg_catalog.pg_namespace AS namespace\n\
-                     ON namespace.oid = function.pronamespace\n\
-                  WHERE namespace.nspname = 'registry_notary_api'\n\
-               ) AS api_function_count,\n\
-               (SELECT count(*) = 2 AND bool_and(namespace.nspowner = $1::bigint::oid)\n\
-                  FROM pg_catalog.pg_namespace AS namespace\n\
-                 WHERE namespace.nspname IN ('registry_notary_private',\n\
-                                              'registry_notary_api')) AS schemas_owned,\n\
-               NOT EXISTS (\n\
-                 SELECT 1 FROM pg_catalog.pg_class AS relation\n\
-                 JOIN pg_catalog.pg_namespace AS namespace\n\
-                   ON namespace.oid = relation.relnamespace\n\
-                WHERE namespace.nspname IN ('registry_notary_private',\n\
-                                             'registry_notary_api')\n\
-                  AND relation.relowner <> $1::bigint::oid\n\
-               ) AS relations_owned,\n\
-               NOT EXISTS (\n\
-                 SELECT 1 FROM pg_catalog.pg_proc AS function\n\
-                 JOIN pg_catalog.pg_namespace AS namespace\n\
-                   ON namespace.oid = function.pronamespace\n\
-                WHERE namespace.nspname IN ('registry_notary_private',\n\
-                                             'registry_notary_api')\n\
-                  AND function.proowner <> $1::bigint::oid\n\
-               ) AS functions_owned,\n\
-               NOT EXISTS (\n\
-                 SELECT 1\n\
-                   FROM pg_catalog.pg_namespace AS namespace\n\
-                   CROSS JOIN LATERAL pg_catalog.aclexplode(\n\
-                     COALESCE(namespace.nspacl,\n\
-                       pg_catalog.acldefault('n', namespace.nspowner))) AS acl\n\
-                  WHERE namespace.nspname IN ('registry_notary_private',\n\
-                                               'registry_notary_api')\n\
-                    AND acl.grantee = 0\n\
-               ) AS public_schemas_denied,\n\
-               (NOT EXISTS (\n\
-                 SELECT 1\n\
-                   FROM pg_catalog.pg_class AS relation\n\
-                   JOIN pg_catalog.pg_namespace AS namespace\n\
-                     ON namespace.oid = relation.relnamespace\n\
-                   CROSS JOIN LATERAL pg_catalog.aclexplode(\n\
-                     COALESCE(relation.relacl,\n\
-                       pg_catalog.acldefault('r', relation.relowner))) AS acl\n\
-                  WHERE namespace.nspname = 'registry_notary_private'\n\
-                    AND relation.relkind IN ('r', 'p')\n\
-                    AND acl.grantee = 0\n\
-               ) AND NOT EXISTS (\n\
-                 SELECT 1\n\
-                   FROM pg_catalog.pg_class AS relation\n\
-                   JOIN pg_catalog.pg_namespace AS namespace\n\
-                     ON namespace.oid = relation.relnamespace\n\
-                   CROSS JOIN LATERAL pg_catalog.aclexplode(\n\
-                     COALESCE(relation.relacl,\n\
-                       pg_catalog.acldefault('S', relation.relowner))) AS acl\n\
-                  WHERE namespace.nspname = 'registry_notary_private'\n\
-                    AND relation.relkind = 'S'\n\
-                    AND acl.grantee = 0\n\
-               )) AS public_relations_denied,\n\
-               NOT pg_catalog.has_schema_privilege($2::bigint::oid,\n\
-                   'registry_notary_private', 'USAGE')\n\
-                 AND NOT pg_catalog.has_schema_privilege($2::bigint::oid,\n\
-                   'registry_notary_private', 'CREATE') AS runtime_private_denied,\n\
-               pg_catalog.has_schema_privilege($2::bigint::oid,\n\
-                   'registry_notary_api', 'USAGE')\n\
-                 AND NOT pg_catalog.has_schema_privilege($2::bigint::oid,\n\
-                   'registry_notary_api', 'CREATE') AS runtime_api_allowed,\n\
-               NOT EXISTS (\n\
-                 SELECT 1\n\
-                   FROM pg_catalog.pg_class AS relation\n\
-                   JOIN pg_catalog.pg_namespace AS namespace\n\
-                     ON namespace.oid = relation.relnamespace\n\
-                  WHERE namespace.nspname = 'registry_notary_private'\n\
-                    AND pg_catalog.has_table_privilege($2::bigint::oid, relation.oid,\n\
-                        'SELECT,INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n\
-               ) AS runtime_tables_denied,\n\
-               (SELECT count(*) = $3\n\
-                  FROM pg_catalog.pg_proc AS function\n\
-                  JOIN pg_catalog.pg_namespace AS namespace\n\
-                    ON namespace.oid = function.pronamespace\n\
-                 WHERE namespace.nspname = 'registry_notary_api'\n\
-                   AND pg_catalog.has_function_privilege($2::bigint::oid, function.oid, 'EXECUTE'))\n\
-                 AS runtime_functions_exact,\n\
-               NOT EXISTS (\n\
-                 SELECT 1\n\
-                   FROM pg_catalog.pg_proc AS function\n\
-                   JOIN pg_catalog.pg_namespace AS namespace\n\
-                     ON namespace.oid = function.pronamespace\n\
-                   CROSS JOIN LATERAL pg_catalog.aclexplode(\n\
-                     COALESCE(function.proacl,\n\
-                       pg_catalog.acldefault('f', function.proowner))) AS acl\n\
-                  WHERE namespace.nspname IN ('registry_notary_private',\n\
-                                               'registry_notary_api')\n\
-                    AND acl.grantee = 0\n\
-                    AND acl.privilege_type = 'EXECUTE'\n\
-               ) AS public_functions_denied,\n\
-               (SELECT NOT owner.rolcanlogin AND NOT owner.rolsuper\n\
-                         AND NOT owner.rolcreaterole AND NOT owner.rolcreatedb\n\
-                         AND NOT owner.rolreplication AND NOT owner.rolbypassrls\n\
-                  FROM pg_catalog.pg_roles AS owner\n\
-                 WHERE owner.oid = $1::bigint::oid) AS owner_safe,\n\
-               (SELECT runtime.rolcanlogin AND NOT runtime.rolsuper\n\
-                         AND NOT runtime.rolcreaterole AND NOT runtime.rolcreatedb\n\
-                         AND NOT runtime.rolreplication AND NOT runtime.rolbypassrls\n\
-                         AND NOT pg_catalog.pg_has_role(runtime.oid,\n\
-                             $1::bigint::oid, 'MEMBER')\n\
-                  FROM pg_catalog.pg_roles AS runtime\n\
-                 WHERE runtime.oid = $2::bigint::oid) AS runtime_safe",
-            &[&roles.owner, &roles.runtime, &EXPECTED_API_FUNCTION_COUNT_V1],
-        )
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-    if row_i64(&shape, "private_table_count")? != EXPECTED_PRIVATE_TABLE_COUNT_V1
-        || row_i64(&shape, "api_function_count")? != EXPECTED_API_FUNCTION_COUNT_V1
-        || !row_bool(&shape, "schemas_owned")?
-        || !row_bool(&shape, "relations_owned")?
-        || !row_bool(&shape, "functions_owned")?
-        || !row_bool(&shape, "public_schemas_denied")?
-        || !row_bool(&shape, "public_relations_denied")?
-        || !row_bool(&shape, "runtime_private_denied")?
-        || !row_bool(&shape, "runtime_api_allowed")?
-        || !row_bool(&shape, "runtime_tables_denied")?
-        || !row_bool(&shape, "runtime_functions_exact")?
-        || !row_bool(&shape, "public_functions_denied")?
-        || !row_bool(&shape, "owner_safe")?
-        || !row_bool(&shape, "runtime_safe")?
-    {
-        return Err(StatePlaneMigrationError::CapabilityDrift);
-    }
-    let observed = catalog_definition_fingerprint(client).await?;
-    if observed != expected_catalog_definition_fingerprint(server_major)? {
-        return Err(StatePlaneMigrationError::CapabilityDrift);
-    }
-    Ok(())
-}
-
-async fn catalog_definition_fingerprint(
-    client: &impl GenericClient,
-) -> Result<String, StatePlaneMigrationError> {
-    let row = client
-        .query_one(CATALOG_DEFINITION_QUERY_V1, &[])
-        .await
-        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
-    let mut hasher = Sha256::new();
-    for field in ["columns", "constraints", "indexes", "functions"] {
-        let contract: String = row
-            .try_get(field)
-            .map_err(|_| StatePlaneMigrationError::CapabilityDrift)?;
-        hasher.update(field.as_bytes());
-        hasher.update([0]);
-        hasher.update(contract.as_bytes());
-        hasher.update([0]);
-    }
-    let digest = hasher.finalize();
-    const HEX: &[u8; 16] = b"0123456789abcdef";
-    let mut encoded = String::with_capacity(64);
-    for byte in digest {
-        encoded.push(char::from(HEX[usize::from(byte >> 4)]));
-        encoded.push(char::from(HEX[usize::from(byte & 0x0f)]));
-    }
-    Ok(encoded)
-}
-
-fn expected_catalog_definition_fingerprint(
-    server_major: i32,
-) -> Result<&'static str, StatePlaneMigrationError> {
-    match server_major {
-        16 => Ok(EXPECTED_CATALOG_DEFINITION_FINGERPRINT_PG16_V1),
-        17 => Ok(EXPECTED_CATALOG_DEFINITION_FINGERPRINT_PG17_V1),
-        18 => Ok(EXPECTED_CATALOG_DEFINITION_FINGERPRINT_PG18_V1),
-        _ => Err(StatePlaneMigrationError::UnsupportedServerMajor),
-    }
-}
-
-fn expected_previous_catalog_definition_fingerprint(
-    server_major: i32,
-) -> Result<&'static str, StatePlaneMigrationError> {
-    match server_major {
-        16 => Ok(PREVIOUS_CATALOG_DEFINITION_FINGERPRINT_PG16_V1),
-        17 => Ok(PREVIOUS_CATALOG_DEFINITION_FINGERPRINT_PG17_V1),
-        18 => Ok(PREVIOUS_CATALOG_DEFINITION_FINGERPRINT_PG18_V1),
-        _ => Err(StatePlaneMigrationError::UnsupportedServerMajor),
-    }
-}
-
-// These fingerprints are derived from the deterministic catalog projection
-// below and are pinned separately for every supported PostgreSQL major.
-const EXPECTED_CATALOG_DEFINITION_FINGERPRINT_PG16_V1: &str =
-    "459c0604fa2711af2704f8307577ea03df374a067f494abf34411e7c1cd2b621";
-const EXPECTED_CATALOG_DEFINITION_FINGERPRINT_PG17_V1: &str =
-    "459c0604fa2711af2704f8307577ea03df374a067f494abf34411e7c1cd2b621";
-const EXPECTED_CATALOG_DEFINITION_FINGERPRINT_PG18_V1: &str =
-    "495041552db166b39a794e051b43a8a45da657270bca244ed1f6df884a303edf";
-const PREVIOUS_CATALOG_DEFINITION_FINGERPRINT_PG16_V1: &str =
-    "cf45576aced8a825cd2891800f2636ec1ca0dd0959b81f3a787cc0ed36ea09a5";
-const PREVIOUS_CATALOG_DEFINITION_FINGERPRINT_PG17_V1: &str =
-    "cf45576aced8a825cd2891800f2636ec1ca0dd0959b81f3a787cc0ed36ea09a5";
-const PREVIOUS_CATALOG_DEFINITION_FINGERPRINT_PG18_V1: &str =
-    "81760fbb2d3839783503774b3e6b436187c1969a154a331929d097e0e654eea2";
-
-const CATALOG_DEFINITION_QUERY_V1: &str = r#"
-SELECT COALESCE((
-         SELECT pg_catalog.jsonb_agg(
-                    pg_catalog.jsonb_build_array(
-                        namespace.nspname,
-                        relation.relname,
-                        relation.relkind,
-                        relation.relpersistence,
-                        attribute.attnum,
-                        attribute.attname,
-                        pg_catalog.format_type(attribute.atttypid, attribute.atttypmod),
-                        attribute.attnotnull,
-                        attribute.attidentity,
-                        attribute.attgenerated,
-                        COALESCE(collation_record.collname, ''),
-                        COALESCE(pg_catalog.pg_get_expr(default_value.adbin,
-                            default_value.adrelid, FALSE), '')
-                    ) ORDER BY namespace.nspname, relation.relname, attribute.attnum
-                )::text
-           FROM pg_catalog.pg_class AS relation
-           JOIN pg_catalog.pg_namespace AS namespace
-             ON namespace.oid = relation.relnamespace
-           JOIN pg_catalog.pg_attribute AS attribute
-             ON attribute.attrelid = relation.oid
-            AND attribute.attnum > 0
-            AND NOT attribute.attisdropped
-           LEFT JOIN pg_catalog.pg_attrdef AS default_value
-             ON default_value.adrelid = relation.oid
-            AND default_value.adnum = attribute.attnum
-           LEFT JOIN pg_catalog.pg_collation AS collation_record
-             ON collation_record.oid = attribute.attcollation
-          WHERE namespace.nspname = 'registry_notary_private'
-            AND relation.relkind IN ('r', 'p')
-       ), '[]') AS columns,
-       COALESCE((
-         SELECT pg_catalog.jsonb_agg(
-                    pg_catalog.jsonb_build_array(
-                        namespace.nspname,
-                        relation.relname,
-                        constraint_record.conname,
-                        constraint_record.contype,
-                        constraint_record.condeferrable,
-                        constraint_record.condeferred,
-                        constraint_record.convalidated,
-                        pg_catalog.pg_get_constraintdef(constraint_record.oid, FALSE)
-                    ) ORDER BY namespace.nspname, relation.relname,
-                               constraint_record.conname
-                )::text
-           FROM pg_catalog.pg_constraint AS constraint_record
-           JOIN pg_catalog.pg_class AS relation
-             ON relation.oid = constraint_record.conrelid
-           JOIN pg_catalog.pg_namespace AS namespace
-             ON namespace.oid = relation.relnamespace
-          WHERE namespace.nspname = 'registry_notary_private'
-       ), '[]') AS constraints,
-       COALESCE((
-         SELECT pg_catalog.jsonb_agg(
-                    pg_catalog.jsonb_build_array(
-                        namespace.nspname,
-                        relation.relname,
-                        index_relation.relname,
-                        pg_catalog.pg_get_indexdef(index_record.indexrelid, 0, FALSE)
-                    ) ORDER BY namespace.nspname, relation.relname,
-                               index_relation.relname
-                )::text
-           FROM pg_catalog.pg_index AS index_record
-           JOIN pg_catalog.pg_class AS relation
-             ON relation.oid = index_record.indrelid
-           JOIN pg_catalog.pg_class AS index_relation
-             ON index_relation.oid = index_record.indexrelid
-           JOIN pg_catalog.pg_namespace AS namespace
-             ON namespace.oid = relation.relnamespace
-          WHERE namespace.nspname = 'registry_notary_private'
-       ), '[]') AS indexes,
-       COALESCE((
-         SELECT pg_catalog.jsonb_agg(
-                    pg_catalog.jsonb_build_array(
-                        namespace.nspname,
-                        function_record.proname,
-                        pg_catalog.pg_get_function_identity_arguments(function_record.oid),
-                        pg_catalog.pg_get_function_result(function_record.oid),
-                        language.lanname,
-                        function_record.prosecdef,
-                        function_record.provolatile,
-                        function_record.proisstrict,
-                        COALESCE(function_record.proconfig::text, ''),
-                        function_record.prosrc
-                    ) ORDER BY namespace.nspname, function_record.proname,
-                               pg_catalog.pg_get_function_identity_arguments(function_record.oid)
-                )::text
-           FROM pg_catalog.pg_proc AS function_record
-           JOIN pg_catalog.pg_namespace AS namespace
-             ON namespace.oid = function_record.pronamespace
-           JOIN pg_catalog.pg_language AS language
-             ON language.oid = function_record.prolang
-          WHERE namespace.nspname IN ('registry_notary_private', 'registry_notary_api')
-       ), '[]') AS functions
-"#;
-
-fn row_bool(row: &Row, name: &'static str) -> Result<bool, StatePlaneMigrationError> {
-    row.try_get(name)
-        .map_err(|_| StatePlaneMigrationError::CapabilityDrift)
-}
-
-fn row_i32(row: &Row, name: &'static str) -> Result<i32, StatePlaneMigrationError> {
-    row.try_get(name)
-        .map_err(|_| StatePlaneMigrationError::CapabilityDrift)
-}
-
-fn row_i64(row: &Row, name: &'static str) -> Result<i64, StatePlaneMigrationError> {
-    row.try_get(name)
-        .map_err(|_| StatePlaneMigrationError::CapabilityDrift)
-}
-
-pub const POSTGRES_STATE_PLANE_MIGRATION_V1: &str =
-    concat!("\n", include_str!("migration/postgres_state_plane_v1.sql"));
-
-#[cfg(test)]
-#[path = "migration/tests.rs"]
-mod tests;
diff --git a/crates/registry-notary-server/src/state_plane/migration/postgres_state_plane_v1.sql b/crates/registry-notary-server/src/state_plane/migration/postgres_state_plane_v1.sql
deleted file mode 100644
index d82e9e91c..000000000
--- a/crates/registry-notary-server/src/state_plane/migration/postgres_state_plane_v1.sql
+++ /dev/null
@@ -1,2391 +0,0 @@
-CREATE SCHEMA IF NOT EXISTS registry_notary_private AUTHORIZATION CURRENT_USER;
-CREATE SCHEMA IF NOT EXISTS registry_notary_api AUTHORIZATION CURRENT_USER;
-
-REVOKE ALL ON SCHEMA registry_notary_private FROM PUBLIC;
-REVOKE ALL ON SCHEMA registry_notary_api FROM PUBLIC;
-
-CREATE TABLE IF NOT EXISTS registry_notary_private.schema_metadata (
-    singleton boolean PRIMARY KEY DEFAULT TRUE CHECK (singleton),
-    capability_id text NOT NULL,
-    schema_version integer NOT NULL CHECK (schema_version > 0),
-    schema_fingerprint text NOT NULL CHECK (schema_fingerprint ~ '^[0-9a-f]{64}$'),
-    owner_role_oid oid NOT NULL,
-    runtime_role_oid oid NOT NULL,
-    installed_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
-    CHECK (owner_role_oid <> runtime_role_oid)
-);
-
-CREATE TABLE IF NOT EXISTS registry_notary_private.replay_identifier (
-    scope_hash bytea NOT NULL CHECK (pg_catalog.octet_length(scope_hash) = 32),
-    identifier_hash bytea NOT NULL CHECK (pg_catalog.octet_length(identifier_hash) = 32),
-    created_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
-    expires_at timestamptz NOT NULL,
-    PRIMARY KEY (scope_hash, identifier_hash),
-    CHECK (expires_at > created_at)
-);
-CREATE INDEX IF NOT EXISTS replay_identifier_expiry_idx
-    ON registry_notary_private.replay_identifier (expires_at);
-
-CREATE TABLE IF NOT EXISTS registry_notary_private.consumable_nonce (
-    scope_hash bytea NOT NULL CHECK (pg_catalog.octet_length(scope_hash) = 32),
-    nonce_hash bytea NOT NULL CHECK (pg_catalog.octet_length(nonce_hash) = 32),
-    generation bigint NOT NULL CHECK (generation > 0),
-    state text NOT NULL CHECK (state IN ('reserved', 'consumed')),
-    reservation_expires_at timestamptz NOT NULL,
-    tombstone_expires_at timestamptz,
-    created_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
-    updated_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
-    PRIMARY KEY (scope_hash, nonce_hash),
-    CHECK (
-        (state = 'reserved' AND tombstone_expires_at IS NULL)
-        OR (state = 'consumed' AND tombstone_expires_at IS NOT NULL)
-    )
-);
-CREATE INDEX IF NOT EXISTS consumable_nonce_retention_idx
-    ON registry_notary_private.consumable_nonce (
-        (CASE WHEN state = 'reserved' THEN reservation_expires_at ELSE tombstone_expires_at END)
-    );
-
-CREATE TABLE IF NOT EXISTS registry_notary_private.evaluation (
-    evaluation_id text PRIMARY KEY CHECK (pg_catalog.length(evaluation_id) BETWEEN 1 AND 256),
-    client_id_hash bytea NOT NULL CHECK (pg_catalog.octet_length(client_id_hash) = 32),
-    request_hash bytea NOT NULL CHECK (pg_catalog.octet_length(request_hash) = 32),
-    purpose text NOT NULL CHECK (pg_catalog.length(purpose) BETWEEN 1 AND 256),
-    record_version smallint NOT NULL CHECK (record_version = 2),
-    record_json jsonb NOT NULL CHECK (pg_catalog.jsonb_typeof(record_json) = 'object'),
-    created_at timestamptz NOT NULL,
-    expires_at timestamptz NOT NULL,
-    CHECK (expires_at > created_at)
-);
-CREATE INDEX IF NOT EXISTS evaluation_client_expiry_idx
-    ON registry_notary_private.evaluation (client_id_hash, expires_at);
-CREATE INDEX IF NOT EXISTS evaluation_expiry_idx
-    ON registry_notary_private.evaluation (expires_at);
-
-CREATE TABLE IF NOT EXISTS registry_notary_private.batch_idempotency (
-    key_hash bytea PRIMARY KEY CHECK (pg_catalog.octet_length(key_hash) = 32),
-    request_hash bytea NOT NULL CHECK (pg_catalog.octet_length(request_hash) = 32),
-    principal_hash bytea NOT NULL CHECK (pg_catalog.octet_length(principal_hash) = 32),
-    state text NOT NULL CHECK (state IN ('in_flight', 'completed', 'failed')),
-    owner_token bytea CHECK (owner_token IS NULL OR pg_catalog.octet_length(owner_token) = 32),
-    lease_expires_at timestamptz,
-    quota_charged boolean NOT NULL,
-    response_version smallint,
-    response_json jsonb,
-    created_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
-    updated_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
-    retention_expires_at timestamptz NOT NULL,
-    CHECK (
-        (state = 'in_flight' AND owner_token IS NOT NULL AND lease_expires_at IS NOT NULL
-            AND response_version IS NULL AND response_json IS NULL)
-        OR (state = 'completed' AND owner_token IS NULL AND lease_expires_at IS NULL
-            AND response_version = 2 AND pg_catalog.jsonb_typeof(response_json) = 'object')
-        OR (state = 'failed' AND owner_token IS NULL AND lease_expires_at IS NULL
-            AND response_version IS NULL AND response_json IS NULL)
-    )
-);
-CREATE INDEX IF NOT EXISTS batch_idempotency_retention_idx
-    ON registry_notary_private.batch_idempotency (retention_expires_at);
-CREATE INDEX IF NOT EXISTS batch_idempotency_lease_idx
-    ON registry_notary_private.batch_idempotency (lease_expires_at)
-    WHERE state = 'in_flight';
-
-CREATE TABLE IF NOT EXISTS registry_notary_private.credential_status (
-    credential_id text PRIMARY KEY CHECK (pg_catalog.length(credential_id) BETWEEN 1 AND 512),
-    issuer text NOT NULL CHECK (pg_catalog.length(issuer) BETWEEN 1 AND 2048),
-    profile text NOT NULL CHECK (pg_catalog.length(profile) BETWEEN 1 AND 256),
-    status text NOT NULL CHECK (status IN ('valid', 'suspended', 'revoked')),
-    issued_at timestamptz NOT NULL,
-    credential_expires_at timestamptz NOT NULL,
-    updated_at timestamptz NOT NULL,
-    purge_after timestamptz NOT NULL,
-    CHECK (credential_expires_at > issued_at),
-    CHECK (purge_after > credential_expires_at),
-    CHECK (updated_at >= issued_at)
-);
-CREATE INDEX IF NOT EXISTS credential_status_purge_idx
-    ON registry_notary_private.credential_status (purge_after);
-
-CREATE TABLE IF NOT EXISTS registry_notary_private.machine_quota (
-    principal_hash bytea PRIMARY KEY CHECK (pg_catalog.octet_length(principal_hash) = 32),
-    window_started_at timestamptz NOT NULL,
-    window_expires_at timestamptz NOT NULL,
-    used integer NOT NULL CHECK (used >= 0),
-    CHECK (window_expires_at > window_started_at)
-);
-CREATE INDEX IF NOT EXISTS machine_quota_expiry_idx
-    ON registry_notary_private.machine_quota (window_expires_at);
-
-CREATE TABLE IF NOT EXISTS registry_notary_private.machine_quota_operation (
-    principal_hash bytea NOT NULL CHECK (pg_catalog.octet_length(principal_hash) = 32),
-    operation_hash bytea NOT NULL CHECK (pg_catalog.octet_length(operation_hash) = 32),
-    request_hash bytea NOT NULL CHECK (pg_catalog.octet_length(request_hash) = 32),
-    lease_owner_hash bytea NOT NULL CHECK (pg_catalog.octet_length(lease_owner_hash) = 32),
-    lease_expires_at timestamptz NOT NULL,
-    created_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
-    expires_at timestamptz NOT NULL,
-    PRIMARY KEY (principal_hash, operation_hash),
-    CHECK (expires_at > created_at),
-    CHECK (lease_expires_at <= expires_at)
-);
-CREATE INDEX IF NOT EXISTS machine_quota_operation_expiry_idx
-    ON registry_notary_private.machine_quota_operation (expires_at);
-
-CREATE TABLE IF NOT EXISTS registry_notary_private.subject_access_quota (
-    bucket_kind text NOT NULL CHECK (bucket_kind IN (
-        'invalid_token_per_client_address',
-        'per_principal',
-        'subject_mismatch_per_principal',
-        'per_holder_issuance',
-        'credential_issuance_per_principal',
-        'tx_code_attempt_per_code'
-    )),
-    key_hash bytea NOT NULL CHECK (pg_catalog.octet_length(key_hash) = 32),
-    window_started_at timestamptz NOT NULL,
-    window_expires_at timestamptz NOT NULL,
-    used integer NOT NULL CHECK (used >= 0),
-    PRIMARY KEY (bucket_kind, key_hash),
-    CHECK (window_expires_at > window_started_at)
-);
-CREATE INDEX IF NOT EXISTS subject_access_quota_expiry_idx
-    ON registry_notary_private.subject_access_quota (window_expires_at);
-
-CREATE TABLE IF NOT EXISTS registry_notary_private.preauthorization_login_state (
-    state_hash bytea PRIMARY KEY CHECK (pg_catalog.octet_length(state_hash) = 32),
-    credential_configuration_id text NOT NULL
-        CHECK (pg_catalog.length(credential_configuration_id) BETWEEN 1 AND 256),
-    key_id bytea NOT NULL CHECK (pg_catalog.octet_length(key_id) = 32),
-    aead_nonce bytea NOT NULL CHECK (pg_catalog.octet_length(aead_nonce) BETWEEN 12 AND 24),
-    ciphertext bytea NOT NULL CHECK (pg_catalog.octet_length(ciphertext) BETWEEN 17 AND 8192),
-    created_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
-    expires_at timestamptz NOT NULL,
-    CHECK (expires_at > created_at)
-);
-CREATE INDEX IF NOT EXISTS preauthorization_login_state_expiry_idx
-    ON registry_notary_private.preauthorization_login_state (expires_at);
-
-CREATE TABLE IF NOT EXISTS registry_notary_private.preauthorization_tx_code (
-    jti_hash bytea PRIMARY KEY CHECK (pg_catalog.octet_length(jti_hash) = 32),
-    key_id bytea NOT NULL CHECK (pg_catalog.octet_length(key_id) = 32),
-    pin_verifier bytea NOT NULL CHECK (pg_catalog.octet_length(pin_verifier) = 32),
-    pin_length smallint NOT NULL CHECK (pin_length BETWEEN 4 AND 12),
-    created_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
-    expires_at timestamptz NOT NULL,
-    CHECK (expires_at > created_at)
-);
-CREATE INDEX IF NOT EXISTS preauthorization_tx_code_expiry_idx
-    ON registry_notary_private.preauthorization_tx_code (expires_at);
-
-CREATE TABLE IF NOT EXISTS registry_notary_private.oid4vci_issuance_transaction (
-    transaction_hash bytea PRIMARY KEY CHECK (pg_catalog.octet_length(transaction_hash) = 32),
-    key_id bytea NOT NULL CHECK (pg_catalog.octet_length(key_id) = 32),
-    credential_configuration_id text NOT NULL
-        CHECK (pg_catalog.length(credential_configuration_id) BETWEEN 1 AND 256),
-    commitment text NOT NULL CHECK (commitment ~ '^sha256:[0-9a-f]{64}$'),
-    record_aead_nonce bytea NOT NULL
-        CHECK (pg_catalog.octet_length(record_aead_nonce) BETWEEN 12 AND 24),
-    record_ciphertext bytea NOT NULL
-        CHECK (pg_catalog.octet_length(record_ciphertext) BETWEEN 17 AND 16384),
-    token_nonce_hash bytea CHECK (
-        token_nonce_hash IS NULL OR pg_catalog.octet_length(token_nonce_hash) = 32
-    ),
-    state text NOT NULL CHECK (state IN ('ready', 'issuing', 'completed', 'failed')),
-    holder_thumbprint_hash bytea CHECK (
-        holder_thumbprint_hash IS NULL OR pg_catalog.octet_length(holder_thumbprint_hash) = 32
-    ),
-    request_hash bytea CHECK (
-        request_hash IS NULL OR pg_catalog.octet_length(request_hash) = 32
-    ),
-    response_aead_nonce bytea CHECK (
-        response_aead_nonce IS NULL
-        OR pg_catalog.octet_length(response_aead_nonce) BETWEEN 12 AND 24
-    ),
-    response_ciphertext bytea CHECK (
-        response_ciphertext IS NULL
-        OR pg_catalog.octet_length(response_ciphertext) BETWEEN 17 AND 65536
-    ),
-    created_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
-    updated_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
-    expires_at timestamptz NOT NULL,
-    CHECK (expires_at > created_at),
-    CHECK (
-        (state = 'ready' AND holder_thumbprint_hash IS NULL AND request_hash IS NULL
-            AND response_aead_nonce IS NULL AND response_ciphertext IS NULL)
-        OR (state = 'issuing' AND holder_thumbprint_hash IS NOT NULL AND request_hash IS NOT NULL
-            AND response_aead_nonce IS NULL AND response_ciphertext IS NULL)
-        OR (state = 'completed' AND holder_thumbprint_hash IS NOT NULL AND request_hash IS NOT NULL
-            AND response_aead_nonce IS NOT NULL AND response_ciphertext IS NOT NULL)
-        OR (state = 'failed' AND holder_thumbprint_hash IS NOT NULL AND request_hash IS NOT NULL
-            AND response_aead_nonce IS NULL AND response_ciphertext IS NULL)
-    )
-);
-CREATE INDEX IF NOT EXISTS oid4vci_issuance_transaction_expiry_idx
-    ON registry_notary_private.oid4vci_issuance_transaction (expires_at);
-
-CREATE TABLE IF NOT EXISTS registry_notary_private.issuance_evaluation_consumption (
-    evaluation_hash bytea PRIMARY KEY
-        CHECK (pg_catalog.octet_length(evaluation_hash) = 32),
-    key_id bytea NOT NULL CHECK (pg_catalog.octet_length(key_id) = 32),
-    created_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
-    expires_at timestamptz NOT NULL,
-    CHECK (expires_at > created_at)
-);
-CREATE INDEX IF NOT EXISTS issuance_evaluation_consumption_expiry_idx
-    ON registry_notary_private.issuance_evaluation_consumption (expires_at);
-
-CREATE TABLE IF NOT EXISTS registry_notary_private.registry_client_offer (
-    idempotency_key_hash bytea PRIMARY KEY
-        CHECK (pg_catalog.octet_length(idempotency_key_hash) = 32),
-    request_hash bytea NOT NULL CHECK (pg_catalog.octet_length(request_hash) = 32),
-    evaluation_hash bytea NOT NULL UNIQUE
-        CHECK (pg_catalog.octet_length(evaluation_hash) = 32),
-    transaction_hash bytea NOT NULL UNIQUE
-        CHECK (pg_catalog.octet_length(transaction_hash) = 32),
-    key_id bytea NOT NULL CHECK (pg_catalog.octet_length(key_id) = 32),
-    response_aead_nonce bytea NOT NULL
-        CHECK (pg_catalog.octet_length(response_aead_nonce) BETWEEN 12 AND 24),
-    response_ciphertext bytea NOT NULL
-        CHECK (pg_catalog.octet_length(response_ciphertext) BETWEEN 17 AND 65536),
-    retention_expires_at timestamptz NOT NULL,
-    evaluation_expires_at timestamptz NOT NULL,
-    purge_after timestamptz NOT NULL,
-    created_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
-    CHECK (retention_expires_at > created_at),
-    CHECK (evaluation_expires_at > created_at),
-    CHECK (purge_after = GREATEST(retention_expires_at, evaluation_expires_at))
-);
-CREATE INDEX IF NOT EXISTS registry_client_offer_purge_idx
-    ON registry_notary_private.registry_client_offer (purge_after);
-
-ALTER DEFAULT PRIVILEGES IN SCHEMA registry_notary_private
-    REVOKE ALL ON TABLES FROM PUBLIC;
-ALTER DEFAULT PRIVILEGES IN SCHEMA registry_notary_private
-    REVOKE ALL ON SEQUENCES FROM PUBLIC;
-ALTER DEFAULT PRIVILEGES IN SCHEMA registry_notary_api
-    REVOKE EXECUTE ON FUNCTIONS FROM PUBLIC;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.attest_v1()
-RETURNS TABLE (
-    capability_id text,
-    schema_version integer,
-    schema_fingerprint text,
-    owner_role_oid bigint,
-    runtime_role_oid bigint,
-    caller_role_oid bigint,
-    server_major integer,
-    database_writable boolean,
-    durability_safe boolean
-)
-LANGUAGE sql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-    SELECT metadata.capability_id,
-           metadata.schema_version,
-           metadata.schema_fingerprint,
-           metadata.owner_role_oid::bigint,
-           metadata.runtime_role_oid::bigint,
-           caller.oid::bigint,
-           current_setting('server_version_num')::integer / 10000,
-           NOT pg_catalog.pg_is_in_recovery()
-             AND NOT current_setting('transaction_read_only')::boolean,
-           current_setting('fsync') = 'on'
-             AND current_setting('synchronous_commit') = 'on'
-             AND current_setting('full_page_writes') = 'on'
-      FROM registry_notary_private.schema_metadata AS metadata
-      JOIN pg_catalog.pg_roles AS caller ON caller.rolname = session_user
-     WHERE metadata.singleton
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.readiness_v1()
-RETURNS TABLE (
-    capability_id text,
-    schema_version integer,
-    schema_fingerprint text,
-    owner_role_oid bigint,
-    runtime_role_oid bigint,
-    caller_role_oid bigint,
-    server_major integer,
-    database_writable boolean,
-    durability_safe boolean
-)
-LANGUAGE sql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-    SELECT * FROM registry_notary_api.attest_v1()
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.replay_insert_v1(
-    p_scope_hash bytea,
-    p_identifier_hash bytea,
-    p_expires_at timestamptz
-)
-RETURNS boolean
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_count bigint;
-BEGIN
-    IF pg_catalog.octet_length(p_scope_hash) <> 32
-       OR pg_catalog.octet_length(p_identifier_hash) <> 32
-       OR p_expires_at <= v_now THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid replay input';
-    END IF;
-
-    INSERT INTO registry_notary_private.replay_identifier (
-        scope_hash, identifier_hash, created_at, expires_at
-    ) VALUES (p_scope_hash, p_identifier_hash, v_now, p_expires_at)
-    ON CONFLICT (scope_hash, identifier_hash) DO UPDATE
-       SET created_at = EXCLUDED.created_at,
-           expires_at = EXCLUDED.expires_at
-     WHERE registry_notary_private.replay_identifier.expires_at <= v_now;
-    GET DIAGNOSTICS v_count = ROW_COUNT;
-    RETURN v_count = 1;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.nonce_reserve_v1(
-    p_scope_hash bytea,
-    p_nonce_hash bytea,
-    p_expires_at timestamptz
-)
-RETURNS boolean
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_count bigint;
-BEGIN
-    IF pg_catalog.octet_length(p_scope_hash) <> 32
-       OR pg_catalog.octet_length(p_nonce_hash) <> 32
-       OR p_expires_at <= v_now THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid nonce input';
-    END IF;
-
-    INSERT INTO registry_notary_private.consumable_nonce (
-        scope_hash, nonce_hash, generation, state, reservation_expires_at,
-        tombstone_expires_at, created_at, updated_at
-    ) VALUES (
-        p_scope_hash, p_nonce_hash, 1, 'reserved', p_expires_at,
-        NULL, v_now, v_now
-    )
-    ON CONFLICT (scope_hash, nonce_hash) DO UPDATE
-       SET generation = registry_notary_private.consumable_nonce.generation + 1,
-           state = 'reserved',
-           reservation_expires_at = EXCLUDED.reservation_expires_at,
-           tombstone_expires_at = NULL,
-           created_at = EXCLUDED.created_at,
-           updated_at = EXCLUDED.updated_at
-     WHERE (
-         registry_notary_private.consumable_nonce.state = 'reserved'
-         AND registry_notary_private.consumable_nonce.reservation_expires_at <= v_now
-     ) OR (
-         registry_notary_private.consumable_nonce.state = 'consumed'
-         AND registry_notary_private.consumable_nonce.tombstone_expires_at <= v_now
-     );
-    GET DIAGNOSTICS v_count = ROW_COUNT;
-    RETURN v_count = 1;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.nonce_reservation_generation_v1(
-    p_scope_hash bytea,
-    p_nonce_hash bytea
-)
-RETURNS bigint
-LANGUAGE sql
-STABLE
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-    SELECT stored.generation
-      FROM registry_notary_private.consumable_nonce AS stored
-     WHERE stored.scope_hash = p_scope_hash
-       AND stored.nonce_hash = p_nonce_hash
-       AND stored.state = 'reserved'
-       AND stored.reservation_expires_at > pg_catalog.statement_timestamp()
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.nonce_consume_v1(
-    p_scope_hash bytea,
-    p_nonce_hash bytea,
-    p_generation bigint
-)
-RETURNS boolean
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_count bigint;
-BEGIN
-    IF pg_catalog.octet_length(p_scope_hash) <> 32
-       OR pg_catalog.octet_length(p_nonce_hash) <> 32
-       OR p_generation <= 0 THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid nonce input';
-    END IF;
-
-    UPDATE registry_notary_private.consumable_nonce
-       SET state = 'consumed',
-           tombstone_expires_at = v_now + interval '60 seconds',
-           updated_at = v_now
-     WHERE scope_hash = p_scope_hash
-       AND nonce_hash = p_nonce_hash
-       AND generation = p_generation
-       AND state = 'reserved'
-       AND reservation_expires_at > v_now;
-    GET DIAGNOSTICS v_count = ROW_COUNT;
-    RETURN v_count = 1;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.evaluation_insert_v1(
-    p_evaluation_id text,
-    p_client_id_hash bytea,
-    p_request_hash bytea,
-    p_purpose text,
-    p_record_version smallint,
-    p_record_json jsonb,
-    p_created_at timestamptz,
-    p_expires_at timestamptz
-)
-RETURNS boolean
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_count bigint;
-BEGIN
-    INSERT INTO registry_notary_private.evaluation (
-        evaluation_id, client_id_hash, request_hash, purpose, record_version,
-        record_json, created_at, expires_at
-    ) VALUES (
-        p_evaluation_id, p_client_id_hash, p_request_hash, p_purpose,
-        p_record_version, p_record_json, p_created_at, p_expires_at
-    ) ON CONFLICT (evaluation_id) DO NOTHING;
-    GET DIAGNOSTICS v_count = ROW_COUNT;
-    RETURN v_count = 1;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.evaluation_get_v1(
-    p_evaluation_id text,
-    p_client_id_hash bytea
-)
-RETURNS TABLE (
-    record_version smallint,
-    record_json jsonb,
-    created_at timestamptz,
-    expires_at timestamptz
-)
-LANGUAGE sql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-    SELECT evaluation.record_version,
-           evaluation.record_json,
-           evaluation.created_at,
-           evaluation.expires_at
-      FROM registry_notary_private.evaluation AS evaluation
-     WHERE evaluation.evaluation_id = p_evaluation_id
-       AND evaluation.client_id_hash = p_client_id_hash
-       AND evaluation.expires_at > pg_catalog.clock_timestamp()
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.batch_reserve_v1(
-    p_key_hash bytea,
-    p_request_hash bytea,
-    p_principal_hash bytea,
-    p_owner_token bytea,
-    p_lease_seconds integer,
-    p_quota_limit integer,
-    p_quota_cost integer
-)
-RETURNS TABLE (
-    outcome text,
-    retry_after_seconds bigint,
-    lease_expires_at timestamptz,
-    response_version smallint,
-    response_json jsonb
-)
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_inserted bigint;
-    v_fresh boolean;
-    v_idempotency registry_notary_private.batch_idempotency%ROWTYPE;
-    v_quota registry_notary_private.machine_quota%ROWTYPE;
-BEGIN
-    IF pg_catalog.octet_length(p_key_hash) <> 32
-       OR pg_catalog.octet_length(p_request_hash) <> 32
-       OR pg_catalog.octet_length(p_principal_hash) <> 32
-       OR pg_catalog.octet_length(p_owner_token) <> 32
-       OR p_lease_seconds NOT BETWEEN 1 AND 300
-       OR p_quota_cost <= 0
-       OR (p_quota_limit IS NOT NULL AND p_quota_limit <= 0) THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid idempotency input';
-    END IF;
-
-    INSERT INTO registry_notary_private.batch_idempotency (
-        key_hash, request_hash, principal_hash, state, owner_token,
-        lease_expires_at, quota_charged, created_at, updated_at,
-        retention_expires_at
-    ) VALUES (
-        p_key_hash, p_request_hash, p_principal_hash, 'in_flight', p_owner_token,
-        v_now + pg_catalog.make_interval(secs => p_lease_seconds), FALSE,
-        v_now, v_now, v_now + interval '15 minutes'
-    ) ON CONFLICT (key_hash) DO NOTHING;
-    GET DIAGNOSTICS v_inserted = ROW_COUNT;
-    v_fresh := v_inserted = 1;
-
-    SELECT * INTO STRICT v_idempotency
-      FROM registry_notary_private.batch_idempotency
-     WHERE key_hash = p_key_hash
-     FOR UPDATE;
-
-    IF NOT v_fresh AND v_idempotency.retention_expires_at <= v_now THEN
-        v_fresh := TRUE;
-    ELSIF NOT v_fresh AND v_idempotency.request_hash <> p_request_hash THEN
-        RETURN QUERY SELECT 'conflict'::text, NULL::bigint, NULL::timestamptz,
-                            NULL::smallint, NULL::jsonb;
-        RETURN;
-    ELSIF NOT v_fresh AND v_idempotency.state = 'completed' THEN
-        RETURN QUERY SELECT 'replay'::text, 0::bigint, NULL::timestamptz,
-                            v_idempotency.response_version, v_idempotency.response_json;
-        RETURN;
-    ELSIF NOT v_fresh AND v_idempotency.state = 'in_flight'
-          AND v_idempotency.lease_expires_at > v_now THEN
-        RETURN QUERY SELECT 'wait'::text,
-            GREATEST(1::bigint, CEIL(EXTRACT(EPOCH FROM
-                (v_idempotency.lease_expires_at - v_now)))::bigint),
-            v_idempotency.lease_expires_at, NULL::smallint, NULL::jsonb;
-        RETURN;
-    ELSIF NOT v_fresh THEN
-        UPDATE registry_notary_private.batch_idempotency
-           SET state = 'in_flight',
-               owner_token = p_owner_token,
-               lease_expires_at = v_now + pg_catalog.make_interval(secs => p_lease_seconds),
-               response_version = NULL,
-               response_json = NULL,
-               updated_at = v_now,
-               retention_expires_at = v_now + interval '15 minutes'
-         WHERE key_hash = p_key_hash;
-        RETURN QUERY SELECT 'owner'::text, 0::bigint,
-            v_now + pg_catalog.make_interval(secs => p_lease_seconds),
-            NULL::smallint, NULL::jsonb;
-        RETURN;
-    END IF;
-
-    IF p_quota_limit IS NOT NULL THEN
-        INSERT INTO registry_notary_private.machine_quota (
-            principal_hash, window_started_at, window_expires_at, used
-        ) VALUES (p_principal_hash, v_now, v_now + interval '1 minute', 0)
-        ON CONFLICT (principal_hash) DO NOTHING;
-
-        SELECT * INTO STRICT v_quota
-          FROM registry_notary_private.machine_quota
-         WHERE principal_hash = p_principal_hash
-         FOR UPDATE;
-        IF v_quota.window_expires_at <= v_now THEN
-            UPDATE registry_notary_private.machine_quota
-               SET window_started_at = v_now,
-                   window_expires_at = v_now + interval '1 minute',
-                   used = 0
-             WHERE principal_hash = p_principal_hash;
-            v_quota.window_expires_at := v_now + interval '1 minute';
-            v_quota.used := 0;
-        END IF;
-        IF p_quota_cost > p_quota_limit - v_quota.used THEN
-            DELETE FROM registry_notary_private.batch_idempotency
-             WHERE key_hash = p_key_hash;
-            RETURN QUERY SELECT 'quota_exceeded'::text,
-                GREATEST(1::bigint, CEIL(EXTRACT(EPOCH FROM
-                    (v_quota.window_expires_at - v_now)))::bigint),
-                NULL::timestamptz, NULL::smallint, NULL::jsonb;
-            RETURN;
-        END IF;
-        UPDATE registry_notary_private.machine_quota
-           SET used = used + p_quota_cost
-         WHERE principal_hash = p_principal_hash;
-    END IF;
-
-    UPDATE registry_notary_private.batch_idempotency
-       SET request_hash = p_request_hash,
-           principal_hash = p_principal_hash,
-           state = 'in_flight',
-           owner_token = p_owner_token,
-           lease_expires_at = v_now + pg_catalog.make_interval(secs => p_lease_seconds),
-           quota_charged = p_quota_limit IS NOT NULL,
-           response_version = NULL,
-           response_json = NULL,
-           created_at = v_now,
-           updated_at = v_now,
-           retention_expires_at = v_now + interval '15 minutes'
-     WHERE key_hash = p_key_hash;
-
-    RETURN QUERY SELECT 'owner'::text, 0::bigint,
-        v_now + pg_catalog.make_interval(secs => p_lease_seconds),
-        NULL::smallint, NULL::jsonb;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.batch_heartbeat_v1(
-    p_key_hash bytea,
-    p_request_hash bytea,
-    p_owner_token bytea,
-    p_lease_seconds integer
-)
-RETURNS boolean
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_count bigint;
-BEGIN
-    IF p_lease_seconds NOT BETWEEN 1 AND 300 THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid lease';
-    END IF;
-    UPDATE registry_notary_private.batch_idempotency
-       SET lease_expires_at = pg_catalog.clock_timestamp()
-                              + pg_catalog.make_interval(secs => p_lease_seconds),
-           updated_at = pg_catalog.clock_timestamp()
-     WHERE key_hash = p_key_hash
-       AND request_hash = p_request_hash
-       AND state = 'in_flight'
-       AND owner_token = p_owner_token;
-    GET DIAGNOSTICS v_count = ROW_COUNT;
-    RETURN v_count = 1;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.batch_complete_v1(
-    p_key_hash bytea,
-    p_request_hash bytea,
-    p_owner_token bytea,
-    p_evaluations jsonb,
-    p_response_version smallint,
-    p_response_json jsonb
-)
-RETURNS boolean
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_idempotency registry_notary_private.batch_idempotency%ROWTYPE;
-BEGIN
-    IF p_response_version <> 2
-       OR pg_catalog.jsonb_typeof(p_response_json) <> 'object'
-       OR pg_catalog.jsonb_typeof(p_evaluations) <> 'array'
-       OR pg_catalog.jsonb_array_length(p_evaluations) > 1024 THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid completion';
-    END IF;
-    SELECT * INTO v_idempotency
-      FROM registry_notary_private.batch_idempotency
-     WHERE key_hash = p_key_hash
-     FOR UPDATE;
-    IF NOT FOUND
-       OR v_idempotency.request_hash <> p_request_hash
-       OR v_idempotency.state <> 'in_flight'
-       OR v_idempotency.owner_token <> p_owner_token THEN
-        RETURN FALSE;
-    END IF;
-
-    INSERT INTO registry_notary_private.evaluation (
-        evaluation_id, client_id_hash, request_hash, purpose, record_version,
-        record_json, created_at, expires_at
-    )
-    SELECT item->>'evaluation_id',
-           pg_catalog.decode(item->>'client_id_hash_hex', 'hex'),
-           p_request_hash,
-           item->>'purpose',
-           (item->>'record_version')::smallint,
-           item->'record',
-           (item->>'created_at')::timestamptz,
-           (item->>'expires_at')::timestamptz
-      FROM pg_catalog.jsonb_array_elements(p_evaluations) AS item;
-
-    UPDATE registry_notary_private.batch_idempotency
-       SET state = 'completed',
-           owner_token = NULL,
-           lease_expires_at = NULL,
-           response_version = p_response_version,
-           response_json = p_response_json,
-           updated_at = v_now,
-           retention_expires_at = v_now + interval '15 minutes'
-     WHERE key_hash = p_key_hash;
-    RETURN TRUE;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.batch_fail_v1(
-    p_key_hash bytea,
-    p_request_hash bytea,
-    p_owner_token bytea
-)
-RETURNS boolean
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_count bigint;
-    v_now timestamptz := pg_catalog.clock_timestamp();
-BEGIN
-    UPDATE registry_notary_private.batch_idempotency
-       SET state = 'failed',
-           owner_token = NULL,
-           lease_expires_at = NULL,
-           updated_at = v_now,
-           retention_expires_at = v_now + interval '15 minutes'
-     WHERE key_hash = p_key_hash
-       AND request_hash = p_request_hash
-       AND state = 'in_flight'
-       AND owner_token = p_owner_token;
-    GET DIAGNOSTICS v_count = ROW_COUNT;
-    RETURN v_count = 1;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.credential_status_insert_v1(
-    p_credential_id text,
-    p_issuer text,
-    p_profile text,
-    p_issued_at timestamptz,
-    p_credential_expires_at timestamptz,
-    p_retention_seconds integer
-)
-RETURNS boolean
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_count bigint;
-BEGIN
-    IF p_retention_seconds <= 0 THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid status retention';
-    END IF;
-    INSERT INTO registry_notary_private.credential_status (
-        credential_id, issuer, profile, status, issued_at,
-        credential_expires_at, updated_at, purge_after
-    ) VALUES (
-        p_credential_id, p_issuer, p_profile, 'valid', p_issued_at,
-        p_credential_expires_at, p_issued_at,
-        p_credential_expires_at + pg_catalog.make_interval(secs => p_retention_seconds)
-    ) ON CONFLICT (credential_id) DO NOTHING;
-    GET DIAGNOSTICS v_count = ROW_COUNT;
-    RETURN v_count = 1;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.credential_status_get_v1(
-    p_credential_id text
-)
-RETURNS TABLE (
-    credential_id text,
-    issuer text,
-    profile text,
-    status text,
-    effective_status text,
-    issued_at timestamptz,
-    credential_expires_at timestamptz,
-    updated_at timestamptz,
-    purge_after timestamptz
-)
-LANGUAGE sql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-    SELECT stored.credential_id,
-           stored.issuer,
-           stored.profile,
-           stored.status,
-           CASE
-               WHEN stored.status = 'revoked' THEN stored.status
-               WHEN stored.credential_expires_at <= pg_catalog.clock_timestamp() THEN 'expired'
-               ELSE stored.status
-           END,
-           stored.issued_at,
-           stored.credential_expires_at,
-           stored.updated_at,
-           stored.purge_after
-      FROM registry_notary_private.credential_status AS stored
-     WHERE stored.credential_id = p_credential_id
-       AND stored.purge_after > pg_catalog.clock_timestamp()
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.credential_status_update_v1(
-    p_credential_id text,
-    p_status text
-)
-RETURNS TABLE (
-    outcome text,
-    credential_id text,
-    issuer text,
-    profile text,
-    status text,
-    effective_status text,
-    issued_at timestamptz,
-    credential_expires_at timestamptz,
-    updated_at timestamptz,
-    purge_after timestamptz
-)
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_stored registry_notary_private.credential_status%ROWTYPE;
-BEGIN
-    IF p_status NOT IN ('valid', 'suspended', 'revoked') THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid credential status';
-    END IF;
-    SELECT * INTO v_stored
-      FROM registry_notary_private.credential_status AS stored
-     WHERE stored.credential_id = p_credential_id
-       AND stored.purge_after > v_now
-     FOR UPDATE;
-    IF NOT FOUND THEN
-        RETURN QUERY SELECT 'not_found'::text, NULL::text, NULL::text, NULL::text,
-                            NULL::text, NULL::text, NULL::timestamptz, NULL::timestamptz,
-                            NULL::timestamptz, NULL::timestamptz;
-        RETURN;
-    END IF;
-    IF v_stored.status = 'revoked' AND p_status <> 'revoked' THEN
-        RETURN QUERY SELECT 'invalid_transition'::text,
-            v_stored.credential_id, v_stored.issuer, v_stored.profile,
-            v_stored.status,
-            CASE
-                WHEN v_stored.status = 'revoked' THEN v_stored.status
-                WHEN v_stored.credential_expires_at <= v_now THEN 'expired'
-                ELSE v_stored.status
-            END,
-            v_stored.issued_at, v_stored.credential_expires_at,
-            v_stored.updated_at, v_stored.purge_after;
-        RETURN;
-    END IF;
-    UPDATE registry_notary_private.credential_status AS stored
-       SET status = p_status,
-           updated_at = CASE
-               WHEN v_now > stored.updated_at THEN v_now
-               ELSE stored.updated_at
-           END
-     WHERE stored.credential_id = p_credential_id
-     RETURNING stored.* INTO v_stored;
-    RETURN QUERY SELECT 'updated'::text,
-        v_stored.credential_id, v_stored.issuer, v_stored.profile,
-        v_stored.status,
-        CASE
-            WHEN v_stored.status = 'revoked' THEN v_stored.status
-            WHEN v_stored.credential_expires_at <= v_now THEN 'expired'
-            ELSE v_stored.status
-        END,
-        v_stored.issued_at, v_stored.credential_expires_at,
-        v_stored.updated_at, v_stored.purge_after;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.machine_quota_debit_v1(
-    p_principal_hash bytea,
-    p_limit integer,
-    p_cost integer
-)
-RETURNS TABLE (
-    allowed boolean,
-    remaining integer,
-    retry_after_seconds bigint
-)
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_quota registry_notary_private.machine_quota%ROWTYPE;
-BEGIN
-    IF pg_catalog.octet_length(p_principal_hash) <> 32
-       OR p_limit <= 0 OR p_cost <= 0 THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid machine quota input';
-    END IF;
-    INSERT INTO registry_notary_private.machine_quota (
-        principal_hash, window_started_at, window_expires_at, used
-    ) VALUES (p_principal_hash, v_now, v_now + interval '1 minute', 0)
-    ON CONFLICT (principal_hash) DO NOTHING;
-    SELECT * INTO STRICT v_quota
-      FROM registry_notary_private.machine_quota
-     WHERE principal_hash = p_principal_hash
-     FOR UPDATE;
-    IF v_quota.window_expires_at <= v_now THEN
-        UPDATE registry_notary_private.machine_quota
-           SET window_started_at = v_now,
-               window_expires_at = v_now + interval '1 minute',
-               used = 0
-         WHERE principal_hash = p_principal_hash;
-        v_quota.window_expires_at := v_now + interval '1 minute';
-        v_quota.used := 0;
-    END IF;
-    IF p_cost > p_limit - v_quota.used THEN
-        RETURN QUERY SELECT FALSE, GREATEST(0, p_limit - v_quota.used),
-            GREATEST(1::bigint, CEIL(EXTRACT(EPOCH FROM
-                (v_quota.window_expires_at - v_now)))::bigint);
-        RETURN;
-    END IF;
-    UPDATE registry_notary_private.machine_quota
-       SET used = used + p_cost
-     WHERE principal_hash = p_principal_hash;
-    RETURN QUERY SELECT TRUE, p_limit - v_quota.used - p_cost, 0::bigint;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.machine_quota_debit_once_v1(
-    p_principal_hash bytea,
-    p_operation_hash bytea,
-    p_request_hash bytea,
-    p_lease_owner_hash bytea,
-    p_limit integer,
-    p_cost integer,
-    p_lease_seconds integer,
-    p_operation_expires_at timestamptz
-)
-RETURNS TABLE (
-    allowed boolean,
-    acquired boolean,
-    conflict boolean,
-    remaining integer,
-    retry_after_seconds bigint
-)
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_quota registry_notary_private.machine_quota%ROWTYPE;
-    v_operation registry_notary_private.machine_quota_operation%ROWTYPE;
-BEGIN
-    IF pg_catalog.octet_length(p_principal_hash) <> 32
-       OR pg_catalog.octet_length(p_operation_hash) <> 32
-       OR pg_catalog.octet_length(p_request_hash) <> 32
-       OR pg_catalog.octet_length(p_lease_owner_hash) <> 32
-       OR (p_limit IS NOT NULL AND p_limit <= 0) OR p_cost <= 0
-       OR p_lease_seconds NOT BETWEEN 1 AND 60
-       OR p_operation_expires_at <= v_now THEN
-        RAISE EXCEPTION USING ERRCODE = '22023',
-            MESSAGE = 'invalid idempotent machine quota input';
-    END IF;
-    INSERT INTO registry_notary_private.machine_quota (
-        principal_hash, window_started_at, window_expires_at, used
-    ) VALUES (p_principal_hash, v_now, v_now + interval '1 minute', 0)
-    ON CONFLICT (principal_hash) DO NOTHING;
-    SELECT * INTO STRICT v_quota
-      FROM registry_notary_private.machine_quota AS quota
-     WHERE quota.principal_hash = p_principal_hash
-     FOR UPDATE;
-    v_now := pg_catalog.clock_timestamp();
-    IF p_operation_expires_at <= v_now THEN
-        RAISE EXCEPTION USING ERRCODE = '22023',
-            MESSAGE = 'expired idempotent machine quota operation';
-    END IF;
-    IF v_quota.window_expires_at <= v_now THEN
-        UPDATE registry_notary_private.machine_quota AS quota
-           SET window_started_at = v_now,
-               window_expires_at = v_now + interval '1 minute',
-               used = 0
-         WHERE quota.principal_hash = p_principal_hash;
-        v_quota.window_expires_at := v_now + interval '1 minute';
-        v_quota.used := 0;
-    END IF;
-    DELETE FROM registry_notary_private.machine_quota_operation AS operation
-     WHERE operation.principal_hash = p_principal_hash
-       AND operation.operation_hash = p_operation_hash
-       AND operation.expires_at <= v_now;
-    SELECT * INTO v_operation
-      FROM registry_notary_private.machine_quota_operation AS operation
-     WHERE operation.principal_hash = p_principal_hash
-       AND operation.operation_hash = p_operation_hash
-       AND operation.expires_at > v_now
-     FOR UPDATE;
-    v_now := pg_catalog.clock_timestamp();
-    IF FOUND THEN
-        IF v_operation.expires_at <= v_now THEN
-            RAISE EXCEPTION USING ERRCODE = '22023',
-                MESSAGE = 'expired idempotent machine quota operation';
-        END IF;
-        IF v_operation.request_hash <> p_request_hash THEN
-            RETURN QUERY SELECT TRUE, FALSE, TRUE,
-                CASE WHEN p_limit IS NULL THEN 0
-                     ELSE GREATEST(0, p_limit - v_quota.used) END,
-                0::bigint;
-        ELSIF v_operation.lease_owner_hash = p_lease_owner_hash
-           OR v_operation.lease_expires_at <= v_now THEN
-            UPDATE registry_notary_private.machine_quota_operation AS operation
-               SET lease_owner_hash = p_lease_owner_hash,
-                   lease_expires_at = LEAST(
-                       v_now + pg_catalog.make_interval(secs => p_lease_seconds),
-                       operation.expires_at
-                   )
-             WHERE operation.principal_hash = p_principal_hash
-               AND operation.operation_hash = p_operation_hash;
-            RETURN QUERY SELECT TRUE, TRUE, FALSE,
-                CASE WHEN p_limit IS NULL THEN 0
-                     ELSE GREATEST(0, p_limit - v_quota.used) END,
-                0::bigint;
-        ELSE
-            RETURN QUERY SELECT TRUE, FALSE, FALSE,
-                CASE WHEN p_limit IS NULL THEN 0
-                     ELSE GREATEST(0, p_limit - v_quota.used) END,
-                0::bigint;
-        END IF;
-        RETURN;
-    END IF;
-    IF p_limit IS NOT NULL AND p_cost > p_limit - v_quota.used THEN
-        RETURN QUERY SELECT FALSE, FALSE, FALSE,
-            GREATEST(0, p_limit - v_quota.used),
-            GREATEST(1::bigint, CEIL(EXTRACT(EPOCH FROM
-                (v_quota.window_expires_at - v_now)))::bigint);
-        RETURN;
-    END IF;
-    IF p_limit IS NOT NULL THEN
-        UPDATE registry_notary_private.machine_quota AS quota
-           SET used = quota.used + p_cost
-         WHERE quota.principal_hash = p_principal_hash;
-    END IF;
-    INSERT INTO registry_notary_private.machine_quota_operation (
-        principal_hash, operation_hash, request_hash, lease_owner_hash, lease_expires_at,
-        created_at, expires_at
-    ) VALUES (
-        p_principal_hash, p_operation_hash, p_request_hash, p_lease_owner_hash,
-        LEAST(
-            v_now + pg_catalog.make_interval(secs => p_lease_seconds),
-            p_operation_expires_at
-        ),
-        v_now, p_operation_expires_at
-    );
-    RETURN QUERY SELECT TRUE, TRUE, FALSE,
-        CASE WHEN p_limit IS NULL THEN 0
-             ELSE p_limit - (v_quota.used + p_cost) END,
-        0::bigint;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.machine_quota_operation_release_v1(
-    p_principal_hash bytea,
-    p_operation_hash bytea,
-    p_lease_owner_hash bytea
-)
-RETURNS boolean
-LANGUAGE sql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-    UPDATE registry_notary_private.machine_quota_operation AS operation
-       SET lease_expires_at = pg_catalog.clock_timestamp()
-     WHERE operation.principal_hash = p_principal_hash
-       AND operation.operation_hash = p_operation_hash
-       AND operation.lease_owner_hash = p_lease_owner_hash
-    RETURNING TRUE
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.subject_access_quota_debit_v1(
-    p_bucket_kinds text[],
-    p_key_hashes bytea[],
-    p_limits integer[],
-    p_window_seconds integer[]
-)
-RETURNS TABLE (
-    allowed boolean,
-    denied_bucket text,
-    retry_after_seconds bigint
-)
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_size integer := pg_catalog.cardinality(p_bucket_kinds);
-    v_index integer;
-    v_other integer;
-    v_quota registry_notary_private.subject_access_quota%ROWTYPE;
-BEGIN
-    IF v_size IS NULL OR v_size < 1 OR v_size > 8
-       OR pg_catalog.array_ndims(p_bucket_kinds) <> 1
-       OR pg_catalog.array_ndims(p_key_hashes) <> 1
-       OR pg_catalog.array_ndims(p_limits) <> 1
-       OR pg_catalog.array_ndims(p_window_seconds) <> 1
-       OR pg_catalog.array_lower(p_bucket_kinds, 1) <> 1
-       OR pg_catalog.array_lower(p_key_hashes, 1) <> 1
-       OR pg_catalog.array_lower(p_limits, 1) <> 1
-       OR pg_catalog.array_lower(p_window_seconds, 1) <> 1
-       OR pg_catalog.cardinality(p_key_hashes) <> v_size
-       OR pg_catalog.cardinality(p_limits) <> v_size
-       OR pg_catalog.cardinality(p_window_seconds) <> v_size THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid quota group';
-    END IF;
-    FOR v_index IN 1..v_size LOOP
-        IF p_bucket_kinds[v_index] IS NULL
-           OR p_key_hashes[v_index] IS NULL
-           OR p_limits[v_index] IS NULL
-           OR p_window_seconds[v_index] IS NULL
-           OR pg_catalog.octet_length(p_key_hashes[v_index]) <> 32
-           OR p_limits[v_index] < 0
-           OR p_window_seconds[v_index] NOT IN (60, 3600)
-           OR p_bucket_kinds[v_index] NOT IN (
-               'invalid_token_per_client_address',
-               'per_principal',
-               'subject_mismatch_per_principal',
-               'per_holder_issuance',
-               'credential_issuance_per_principal',
-               'tx_code_attempt_per_code'
-           ) THEN
-            RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid quota bucket';
-        END IF;
-        IF v_index > 1 THEN
-            FOR v_other IN 1..(v_index - 1) LOOP
-                IF p_bucket_kinds[v_other] = p_bucket_kinds[v_index]
-                   AND p_key_hashes[v_other] = p_key_hashes[v_index] THEN
-                    RAISE EXCEPTION USING ERRCODE = '22023',
-                        MESSAGE = 'duplicate quota bucket';
-                END IF;
-            END LOOP;
-        END IF;
-    END LOOP;
-
-    -- Insert and lock in canonical order, independent of caller denial order.
-    FOR v_index IN
-        SELECT requested.ordinality::integer
-          FROM pg_catalog.unnest(p_bucket_kinds) WITH ORDINALITY AS requested(bucket, ordinality)
-         ORDER BY requested.bucket,
-                  pg_catalog.encode(p_key_hashes[requested.ordinality::integer], 'hex')
-    LOOP
-        INSERT INTO registry_notary_private.subject_access_quota (
-            bucket_kind, key_hash, window_started_at, window_expires_at, used
-        ) VALUES (
-            p_bucket_kinds[v_index], p_key_hashes[v_index], v_now,
-            v_now + pg_catalog.make_interval(secs => p_window_seconds[v_index]), 0
-        ) ON CONFLICT (bucket_kind, key_hash) DO NOTHING;
-        SELECT * INTO STRICT v_quota
-          FROM registry_notary_private.subject_access_quota
-         WHERE bucket_kind = p_bucket_kinds[v_index]
-           AND key_hash = p_key_hashes[v_index]
-         FOR UPDATE;
-        IF v_quota.window_expires_at <= v_now THEN
-            UPDATE registry_notary_private.subject_access_quota
-               SET window_started_at = v_now,
-                   window_expires_at = v_now
-                       + pg_catalog.make_interval(secs => p_window_seconds[v_index]),
-                   used = 0
-             WHERE bucket_kind = p_bucket_kinds[v_index]
-               AND key_hash = p_key_hashes[v_index];
-        END IF;
-    END LOOP;
-
-    -- Preserve caller order when selecting the denial bucket.
-    FOR v_index IN 1..v_size LOOP
-        SELECT * INTO STRICT v_quota
-          FROM registry_notary_private.subject_access_quota
-         WHERE bucket_kind = p_bucket_kinds[v_index]
-           AND key_hash = p_key_hashes[v_index];
-        IF p_limits[v_index] = 0 OR v_quota.used >= p_limits[v_index] THEN
-            RETURN QUERY SELECT FALSE, p_bucket_kinds[v_index],
-                GREATEST(1::bigint, CEIL(EXTRACT(EPOCH FROM
-                    (v_quota.window_expires_at - v_now)))::bigint);
-            RETURN;
-        END IF;
-    END LOOP;
-
-    FOR v_index IN 1..v_size LOOP
-        UPDATE registry_notary_private.subject_access_quota
-           SET used = used + 1
-         WHERE bucket_kind = p_bucket_kinds[v_index]
-           AND key_hash = p_key_hashes[v_index];
-    END LOOP;
-    RETURN QUERY SELECT TRUE, NULL::text, 0::bigint;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.subject_access_quota_check_v1(
-    p_bucket_kinds text[],
-    p_key_hashes bytea[],
-    p_limits integer[],
-    p_window_seconds integer[]
-)
-RETURNS TABLE (
-    allowed boolean,
-    denied_bucket text,
-    retry_after_seconds bigint
-)
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_size integer := pg_catalog.cardinality(p_bucket_kinds);
-    v_index integer;
-    v_other integer;
-    v_quota registry_notary_private.subject_access_quota%ROWTYPE;
-BEGIN
-    IF v_size IS NULL OR v_size < 1 OR v_size > 8
-       OR pg_catalog.array_ndims(p_bucket_kinds) <> 1
-       OR pg_catalog.array_ndims(p_key_hashes) <> 1
-       OR pg_catalog.array_ndims(p_limits) <> 1
-       OR pg_catalog.array_ndims(p_window_seconds) <> 1
-       OR pg_catalog.array_lower(p_bucket_kinds, 1) <> 1
-       OR pg_catalog.array_lower(p_key_hashes, 1) <> 1
-       OR pg_catalog.array_lower(p_limits, 1) <> 1
-       OR pg_catalog.array_lower(p_window_seconds, 1) <> 1
-       OR pg_catalog.cardinality(p_key_hashes) <> v_size
-       OR pg_catalog.cardinality(p_limits) <> v_size
-       OR pg_catalog.cardinality(p_window_seconds) <> v_size THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid quota group';
-    END IF;
-    FOR v_index IN 1..v_size LOOP
-        IF p_bucket_kinds[v_index] IS NULL
-           OR p_key_hashes[v_index] IS NULL
-           OR p_limits[v_index] IS NULL
-           OR p_window_seconds[v_index] IS NULL
-           OR pg_catalog.octet_length(p_key_hashes[v_index]) <> 32
-           OR p_limits[v_index] < 0
-           OR p_window_seconds[v_index] NOT IN (60, 3600)
-           OR p_bucket_kinds[v_index] NOT IN (
-               'invalid_token_per_client_address',
-               'per_principal',
-               'subject_mismatch_per_principal',
-               'per_holder_issuance',
-               'credential_issuance_per_principal',
-               'tx_code_attempt_per_code'
-           ) THEN
-            RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid quota bucket';
-        END IF;
-        IF v_index > 1 THEN
-            FOR v_other IN 1..(v_index - 1) LOOP
-                IF p_bucket_kinds[v_other] = p_bucket_kinds[v_index]
-                   AND p_key_hashes[v_other] = p_key_hashes[v_index] THEN
-                    RAISE EXCEPTION USING ERRCODE = '22023',
-                        MESSAGE = 'duplicate quota bucket';
-                END IF;
-            END LOOP;
-        END IF;
-    END LOOP;
-
-    -- This precheck deliberately does not insert, reset, lock, or debit rows.
-    -- A later debit performs its own atomic decision against current state.
-    FOR v_index IN 1..v_size LOOP
-        IF p_limits[v_index] = 0 THEN
-            RETURN QUERY SELECT FALSE, p_bucket_kinds[v_index],
-                p_window_seconds[v_index]::bigint;
-            RETURN;
-        END IF;
-        SELECT * INTO v_quota
-          FROM registry_notary_private.subject_access_quota
-         WHERE bucket_kind = p_bucket_kinds[v_index]
-           AND key_hash = p_key_hashes[v_index];
-        IF FOUND
-           AND v_quota.window_expires_at > v_now
-           AND v_quota.used >= p_limits[v_index] THEN
-            RETURN QUERY SELECT FALSE, p_bucket_kinds[v_index],
-                GREATEST(1::bigint, CEIL(EXTRACT(EPOCH FROM
-                    (v_quota.window_expires_at - v_now)))::bigint);
-            RETURN;
-        END IF;
-    END LOOP;
-    RETURN QUERY SELECT TRUE, NULL::text, 0::bigint;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.preauthorization_login_reserve_v1(
-    p_state_hash bytea,
-    p_credential_configuration_id text,
-    p_key_id bytea,
-    p_aead_nonce bytea,
-    p_ciphertext bytea,
-    p_expires_at timestamptz
-)
-RETURNS smallint
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_count bigint;
-BEGIN
-    IF pg_catalog.octet_length(p_key_id) <> 32 OR p_expires_at <= v_now THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid login state expiry';
-    END IF;
-    -- One domain-specific lock serializes the live sensitive-key generation
-    -- decision across both preauthorization tables and all Notary replicas.
-    PERFORM pg_catalog.pg_advisory_xact_lock(5642808141211099137);
-    IF EXISTS (
-        SELECT 1 FROM registry_notary_private.preauthorization_login_state
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.preauthorization_tx_code
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.oid4vci_issuance_transaction
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.registry_client_offer
-         WHERE purge_after > v_now AND key_id <> p_key_id
-    ) THEN
-        RAISE EXCEPTION USING ERRCODE = '55000',
-            MESSAGE = 'sensitive-state key generation mismatch';
-    END IF;
-    -- The table lock serializes the exact 4,096-row capacity decision across
-    -- replicas. It is bounded because this table cannot exceed that capacity.
-    LOCK TABLE registry_notary_private.preauthorization_login_state
-        IN SHARE ROW EXCLUSIVE MODE;
-    DELETE FROM registry_notary_private.preauthorization_login_state
-     WHERE expires_at <= v_now;
-    IF EXISTS (
-        SELECT 1 FROM registry_notary_private.preauthorization_login_state
-         WHERE state_hash = p_state_hash
-    ) THEN
-        RETURN 0;
-    END IF;
-    SELECT pg_catalog.count(*) INTO v_count
-      FROM registry_notary_private.preauthorization_login_state;
-    IF v_count >= 4096 THEN
-        RETURN -1;
-    END IF;
-    INSERT INTO registry_notary_private.preauthorization_login_state (
-        state_hash, credential_configuration_id, key_id, aead_nonce,
-        ciphertext, created_at, expires_at
-    ) VALUES (
-        p_state_hash, p_credential_configuration_id, p_key_id, p_aead_nonce,
-        p_ciphertext, v_now, p_expires_at
-    );
-    RETURN 1;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.preauthorization_login_consume_v1(
-    p_state_hash bytea
-)
-RETURNS TABLE (
-    credential_configuration_id text,
-    key_id bytea,
-    aead_nonce bytea,
-    ciphertext bytea,
-    expires_at timestamptz
-)
-LANGUAGE sql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-    DELETE FROM registry_notary_private.preauthorization_login_state AS stored
-     WHERE stored.state_hash = p_state_hash
-       AND stored.expires_at > pg_catalog.clock_timestamp()
-    RETURNING stored.credential_configuration_id,
-              stored.key_id,
-              stored.aead_nonce,
-              stored.ciphertext,
-              stored.expires_at
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.preauthorization_tx_code_reserve_v1(
-    p_jti_hash bytea,
-    p_key_id bytea,
-    p_pin_verifier bytea,
-    p_pin_length smallint,
-    p_expires_at timestamptz
-)
-RETURNS boolean
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_count bigint;
-BEGIN
-    IF pg_catalog.octet_length(p_key_id) <> 32 OR p_expires_at <= v_now THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid transaction code expiry';
-    END IF;
-    PERFORM pg_catalog.pg_advisory_xact_lock(5642808141211099137);
-    IF EXISTS (
-        SELECT 1 FROM registry_notary_private.preauthorization_login_state
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.preauthorization_tx_code
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.oid4vci_issuance_transaction
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.registry_client_offer
-         WHERE purge_after > v_now AND key_id <> p_key_id
-    ) THEN
-        RAISE EXCEPTION USING ERRCODE = '55000',
-            MESSAGE = 'sensitive-state key generation mismatch';
-    END IF;
-    DELETE FROM registry_notary_private.preauthorization_tx_code
-     WHERE jti_hash = p_jti_hash AND expires_at <= v_now;
-    INSERT INTO registry_notary_private.preauthorization_tx_code (
-        jti_hash, key_id, pin_verifier, pin_length, created_at, expires_at
-    ) VALUES (
-        p_jti_hash, p_key_id, p_pin_verifier, p_pin_length, v_now, p_expires_at
-    ) ON CONFLICT (jti_hash) DO NOTHING;
-    GET DIAGNOSTICS v_count = ROW_COUNT;
-    RETURN v_count = 1;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.preauthorization_key_attest_v1(
-    p_key_id bytea
-)
-RETURNS boolean
-LANGUAGE sql
-STABLE
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-    SELECT pg_catalog.octet_length(p_key_id) = 32
-       AND NOT EXISTS (
-            SELECT 1 FROM registry_notary_private.preauthorization_login_state
-             WHERE expires_at > pg_catalog.statement_timestamp() AND key_id <> p_key_id
-            UNION ALL
-            SELECT 1 FROM registry_notary_private.preauthorization_tx_code
-             WHERE expires_at > pg_catalog.statement_timestamp() AND key_id <> p_key_id
-            UNION ALL
-            SELECT 1 FROM registry_notary_private.oid4vci_issuance_transaction
-             WHERE expires_at > pg_catalog.statement_timestamp() AND key_id <> p_key_id
-            UNION ALL
-            SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
-             WHERE expires_at > pg_catalog.statement_timestamp() AND key_id <> p_key_id
-            UNION ALL
-            SELECT 1 FROM registry_notary_private.registry_client_offer
-             WHERE purge_after > pg_catalog.statement_timestamp() AND key_id <> p_key_id
-       )
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.preauthorization_tx_code_peek_v1(
-    p_jti_hash bytea
-)
-RETURNS TABLE (
-    key_id bytea,
-    pin_verifier bytea,
-    pin_length smallint,
-    expires_at timestamptz
-)
-LANGUAGE sql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-    SELECT stored.key_id,
-           stored.pin_verifier,
-           stored.pin_length,
-           stored.expires_at
-      FROM registry_notary_private.preauthorization_tx_code AS stored
-     WHERE stored.jti_hash = p_jti_hash
-       AND stored.expires_at > pg_catalog.clock_timestamp()
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.preauthorization_redeem_v1(
-    p_replay_scope_hash bytea,
-    p_jti_hash bytea,
-    p_code_expires_at timestamptz,
-    p_pin_required boolean,
-    p_expected_pin_verifier bytea
-)
-RETURNS boolean
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_count bigint;
-    v_tx_code registry_notary_private.preauthorization_tx_code%ROWTYPE;
-BEGIN
-    IF pg_catalog.octet_length(p_replay_scope_hash) <> 32
-       OR pg_catalog.octet_length(p_jti_hash) <> 32
-       OR p_code_expires_at <= v_now
-       OR (p_pin_required AND pg_catalog.octet_length(p_expected_pin_verifier) <> 32)
-       OR (NOT p_pin_required AND p_expected_pin_verifier IS NOT NULL) THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid redemption input';
-    END IF;
-    IF p_pin_required THEN
-        SELECT * INTO v_tx_code
-          FROM registry_notary_private.preauthorization_tx_code
-         WHERE jti_hash = p_jti_hash
-         FOR UPDATE;
-        IF NOT FOUND
-           OR v_tx_code.expires_at <= v_now
-           OR v_tx_code.pin_verifier <> p_expected_pin_verifier THEN
-            RETURN FALSE;
-        END IF;
-    END IF;
-
-    INSERT INTO registry_notary_private.replay_identifier (
-        scope_hash, identifier_hash, created_at, expires_at
-    ) VALUES (p_replay_scope_hash, p_jti_hash, v_now, p_code_expires_at)
-    ON CONFLICT (scope_hash, identifier_hash) DO UPDATE
-       SET created_at = EXCLUDED.created_at,
-           expires_at = EXCLUDED.expires_at
-     WHERE registry_notary_private.replay_identifier.expires_at <= v_now;
-    GET DIAGNOSTICS v_count = ROW_COUNT;
-    IF v_count <> 1 THEN
-        RETURN FALSE;
-    END IF;
-    IF p_pin_required THEN
-        DELETE FROM registry_notary_private.preauthorization_tx_code
-         WHERE jti_hash = p_jti_hash;
-    END IF;
-    RETURN TRUE;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.evaluation_issuance_consume_v1(
-    p_evaluation_hash bytea,
-    p_key_id bytea,
-    p_expires_at timestamptz
-)
-RETURNS smallint
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_count bigint;
-BEGIN
-    IF pg_catalog.octet_length(p_evaluation_hash) <> 32
-       OR pg_catalog.octet_length(p_key_id) <> 32
-       OR p_expires_at <= v_now THEN
-        RAISE EXCEPTION USING ERRCODE = '22023',
-            MESSAGE = 'invalid evaluation issuance consumption';
-    END IF;
-    PERFORM pg_catalog.pg_advisory_xact_lock(5642808141211099137);
-    IF EXISTS (
-        SELECT 1 FROM registry_notary_private.preauthorization_login_state
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.preauthorization_tx_code
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.oid4vci_issuance_transaction
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.registry_client_offer
-         WHERE purge_after > v_now AND key_id <> p_key_id
-    ) THEN
-        RAISE EXCEPTION USING ERRCODE = '55000',
-            MESSAGE = 'sensitive-state key generation mismatch';
-    END IF;
-    LOCK TABLE registry_notary_private.issuance_evaluation_consumption
-        IN SHARE ROW EXCLUSIVE MODE;
-    DELETE FROM registry_notary_private.issuance_evaluation_consumption
-     WHERE expires_at <= v_now;
-    IF EXISTS (
-        SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
-         WHERE evaluation_hash = p_evaluation_hash
-    ) THEN
-        RETURN 0;
-    END IF;
-    SELECT pg_catalog.count(*) INTO v_count
-      FROM registry_notary_private.issuance_evaluation_consumption;
-    IF v_count >= 4096 THEN
-        RETURN -1;
-    END IF;
-    INSERT INTO registry_notary_private.issuance_evaluation_consumption (
-        evaluation_hash, key_id, created_at, expires_at
-    ) VALUES (p_evaluation_hash, p_key_id, v_now, p_expires_at);
-    RETURN 1;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.registry_client_offer_preflight_v1(
-    p_idempotency_key_hash bytea,
-    p_request_hash bytea,
-    p_evaluation_hash bytea,
-    p_key_id bytea
-)
-RETURNS TABLE (
-    outcome smallint,
-    key_id bytea,
-    response_aead_nonce bytea,
-    response_ciphertext bytea,
-    retention_expires_at timestamptz
-)
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_stored registry_notary_private.registry_client_offer%ROWTYPE;
-BEGIN
-    IF pg_catalog.octet_length(p_idempotency_key_hash) <> 32
-       OR pg_catalog.octet_length(p_request_hash) <> 32
-       OR pg_catalog.octet_length(p_evaluation_hash) <> 32
-       OR pg_catalog.octet_length(p_key_id) <> 32 THEN
-        RAISE EXCEPTION USING ERRCODE = '22023',
-            MESSAGE = 'invalid registry-client offer preflight';
-    END IF;
-    SELECT offer.* INTO v_stored
-      FROM registry_notary_private.registry_client_offer AS offer
-     WHERE offer.idempotency_key_hash = p_idempotency_key_hash
-       AND offer.purge_after > v_now;
-    IF FOUND THEN
-        IF v_stored.key_id <> p_key_id THEN
-            RAISE EXCEPTION USING ERRCODE = '55000',
-                MESSAGE = 'sensitive-state key generation mismatch';
-        ELSIF v_stored.request_hash <> p_request_hash THEN
-            RETURN QUERY SELECT 0::smallint, NULL::bytea, NULL::bytea,
-                NULL::bytea, NULL::timestamptz;
-        ELSIF v_stored.retention_expires_at > v_now THEN
-            RETURN QUERY SELECT 2::smallint, v_stored.key_id,
-                v_stored.response_aead_nonce, v_stored.response_ciphertext,
-                v_stored.retention_expires_at;
-        ELSE
-            RETURN QUERY SELECT -2::smallint, NULL::bytea, NULL::bytea,
-                NULL::bytea, NULL::timestamptz;
-        END IF;
-        RETURN;
-    END IF;
-    IF EXISTS (
-        SELECT 1
-          FROM registry_notary_private.issuance_evaluation_consumption AS consumption
-         WHERE consumption.evaluation_hash = p_evaluation_hash
-           AND consumption.expires_at > v_now
-           AND consumption.key_id <> p_key_id
-    ) THEN
-        RAISE EXCEPTION USING ERRCODE = '55000',
-            MESSAGE = 'sensitive-state key generation mismatch';
-    END IF;
-    IF EXISTS (
-        SELECT 1
-          FROM registry_notary_private.issuance_evaluation_consumption AS consumption
-         WHERE consumption.evaluation_hash = p_evaluation_hash
-           AND consumption.expires_at > v_now
-    ) THEN
-        RETURN QUERY SELECT -2::smallint, NULL::bytea, NULL::bytea,
-            NULL::bytea, NULL::timestamptz;
-        RETURN;
-    END IF;
-    RETURN QUERY SELECT 1::smallint, NULL::bytea, NULL::bytea,
-        NULL::bytea, NULL::timestamptz;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.registry_client_offer_reserve_v1(
-    p_idempotency_key_hash bytea,
-    p_request_hash bytea,
-    p_evaluation_hash bytea,
-    p_transaction_hash bytea,
-    p_jti_hash bytea,
-    p_key_id bytea,
-    p_configuration_id text,
-    p_commitment text,
-    p_record_aead_nonce bytea,
-    p_record_ciphertext bytea,
-    p_transaction_expires_at timestamptz,
-    p_pin_verifier bytea,
-    p_pin_length smallint,
-    p_code_expires_at timestamptz,
-    p_response_aead_nonce bytea,
-    p_response_ciphertext bytea,
-    p_retention_expires_at timestamptz,
-    p_evaluation_expires_at timestamptz,
-    p_quota_principal_hash bytea,
-    p_quota_limit integer,
-    p_quota_cost integer,
-    p_quota_operation_hash bytea,
-    p_quota_lease_owner_hash bytea
-)
-RETURNS TABLE (
-    outcome smallint,
-    key_id bytea,
-    response_aead_nonce bytea,
-    response_ciphertext bytea,
-    retention_expires_at timestamptz,
-    retry_after_seconds bigint
-)
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_count bigint;
-    v_stored registry_notary_private.registry_client_offer%ROWTYPE;
-    v_quota registry_notary_private.machine_quota%ROWTYPE;
-    v_quota_operation registry_notary_private.machine_quota_operation%ROWTYPE;
-BEGIN
-    IF pg_catalog.octet_length(p_idempotency_key_hash) <> 32
-       OR pg_catalog.octet_length(p_request_hash) <> 32
-       OR pg_catalog.octet_length(p_quota_principal_hash) <> 32
-       OR (p_quota_operation_hash IS NULL)
-          <> (p_quota_lease_owner_hash IS NULL)
-       OR (p_quota_operation_hash IS NOT NULL
-           AND (pg_catalog.octet_length(p_quota_operation_hash) <> 32
-                OR pg_catalog.octet_length(p_quota_lease_owner_hash) <> 32)) THEN
-        RAISE EXCEPTION USING ERRCODE = '22023',
-            MESSAGE = 'invalid registry-client idempotency binding';
-    END IF;
-    PERFORM pg_catalog.pg_advisory_xact_lock(5642808141211099137);
-    v_now := pg_catalog.clock_timestamp();
-    IF p_quota_limit IS NOT NULL THEN
-        INSERT INTO registry_notary_private.machine_quota (
-            principal_hash, window_started_at, window_expires_at, used
-        ) VALUES (
-            p_quota_principal_hash, v_now, v_now + interval '1 minute', 0
-        ) ON CONFLICT (principal_hash) DO NOTHING;
-        SELECT * INTO STRICT v_quota
-          FROM registry_notary_private.machine_quota
-         WHERE principal_hash = p_quota_principal_hash
-         FOR UPDATE;
-        v_now := pg_catalog.clock_timestamp();
-        IF v_quota.window_expires_at <= v_now THEN
-            UPDATE registry_notary_private.machine_quota
-               SET window_started_at = v_now,
-                   window_expires_at = v_now + interval '1 minute',
-                   used = 0
-             WHERE principal_hash = p_quota_principal_hash;
-            v_quota.window_expires_at := v_now + interval '1 minute';
-            v_quota.used := 0;
-        END IF;
-    END IF;
-    IF p_quota_operation_hash IS NOT NULL THEN
-        SELECT * INTO v_quota_operation
-          FROM registry_notary_private.machine_quota_operation AS operation
-         WHERE operation.principal_hash = p_quota_principal_hash
-           AND operation.operation_hash = p_quota_operation_hash
-         FOR UPDATE;
-        v_now := pg_catalog.clock_timestamp();
-        IF NOT FOUND
-           OR v_quota_operation.request_hash <> p_request_hash
-           OR v_quota_operation.lease_owner_hash <> p_quota_lease_owner_hash
-           OR v_quota_operation.lease_expires_at <= v_now
-           OR v_quota_operation.expires_at <= v_now THEN
-            RETURN QUERY SELECT -6::smallint, NULL::bytea, NULL::bytea,
-                NULL::bytea, NULL::timestamptz, NULL::bigint;
-            RETURN;
-        END IF;
-    END IF;
-    IF EXISTS (
-        SELECT 1 FROM registry_notary_private.preauthorization_login_state AS login
-         WHERE login.expires_at > v_now AND login.key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.preauthorization_tx_code AS tx_code
-         WHERE tx_code.expires_at > v_now AND tx_code.key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.oid4vci_issuance_transaction AS transaction
-         WHERE transaction.expires_at > v_now AND transaction.key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption AS consumption
-         WHERE consumption.expires_at > v_now AND consumption.key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.registry_client_offer AS offer
-         WHERE offer.purge_after > v_now AND offer.key_id <> p_key_id
-    ) THEN
-        RAISE EXCEPTION USING ERRCODE = '55000',
-            MESSAGE = 'sensitive-state key generation mismatch';
-    END IF;
-    LOCK TABLE registry_notary_private.oid4vci_issuance_transaction,
-               registry_notary_private.preauthorization_tx_code,
-               registry_notary_private.issuance_evaluation_consumption,
-               registry_notary_private.registry_client_offer
-        IN SHARE ROW EXCLUSIVE MODE;
-    DELETE FROM registry_notary_private.oid4vci_issuance_transaction
-     WHERE expires_at <= v_now;
-    DELETE FROM registry_notary_private.preauthorization_tx_code
-     WHERE expires_at <= v_now;
-    DELETE FROM registry_notary_private.issuance_evaluation_consumption
-     WHERE expires_at <= v_now;
-    DELETE FROM registry_notary_private.registry_client_offer
-     WHERE purge_after <= v_now;
-
-    SELECT * INTO v_stored
-      FROM registry_notary_private.registry_client_offer
-     WHERE idempotency_key_hash = p_idempotency_key_hash
-     FOR UPDATE;
-    IF FOUND THEN
-        IF v_stored.request_hash <> p_request_hash THEN
-            RETURN QUERY SELECT 0::smallint, NULL::bytea, NULL::bytea,
-                NULL::bytea, NULL::timestamptz, NULL::bigint;
-        ELSIF v_stored.retention_expires_at > v_now THEN
-            RETURN QUERY SELECT 2::smallint, v_stored.key_id,
-                v_stored.response_aead_nonce, v_stored.response_ciphertext,
-                v_stored.retention_expires_at, 0::bigint;
-        ELSE
-            RETURN QUERY SELECT -2::smallint, NULL::bytea, NULL::bytea,
-                NULL::bytea, NULL::timestamptz, NULL::bigint;
-        END IF;
-        RETURN;
-    END IF;
-
-    IF pg_catalog.octet_length(p_evaluation_hash) <> 32
-       OR pg_catalog.octet_length(p_transaction_hash) <> 32
-       OR pg_catalog.octet_length(p_jti_hash) <> 32
-       OR pg_catalog.octet_length(p_key_id) <> 32
-       OR p_quota_cost <= 0
-       OR (p_quota_limit IS NOT NULL AND p_quota_limit <= 0)
-       OR p_commitment !~ '^sha256:[0-9a-f]{64}$'
-       OR (p_pin_verifier IS NULL) <> (p_pin_length IS NULL)
-       OR (p_pin_verifier IS NOT NULL
-           AND (pg_catalog.octet_length(p_pin_verifier) <> 32
-                OR p_pin_length NOT BETWEEN 4 AND 12)) THEN
-        RAISE EXCEPTION USING ERRCODE = '22023',
-            MESSAGE = 'invalid registry-client offer reservation';
-    END IF;
-    IF p_code_expires_at <= v_now
-       OR p_transaction_expires_at < p_code_expires_at
-       OR p_evaluation_expires_at <= v_now
-       OR p_retention_expires_at < p_code_expires_at THEN
-        RETURN QUERY SELECT -4::smallint, NULL::bytea, NULL::bytea,
-            NULL::bytea, NULL::timestamptz, NULL::bigint;
-        RETURN;
-    END IF;
-    IF EXISTS (
-        SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
-         WHERE evaluation_hash = p_evaluation_hash
-           AND expires_at > v_now
-    ) THEN
-        RETURN QUERY SELECT -2::smallint, NULL::bytea, NULL::bytea,
-            NULL::bytea, NULL::timestamptz, NULL::bigint;
-        RETURN;
-    END IF;
-    IF EXISTS (
-        SELECT 1 FROM registry_notary_private.oid4vci_issuance_transaction
-         WHERE transaction_hash = p_transaction_hash
-    ) OR EXISTS (
-        SELECT 1 FROM registry_notary_private.preauthorization_tx_code
-         WHERE jti_hash = p_jti_hash
-    ) THEN
-        RETURN QUERY SELECT -3::smallint, NULL::bytea, NULL::bytea,
-            NULL::bytea, NULL::timestamptz, NULL::bigint;
-        RETURN;
-    END IF;
-    SELECT pg_catalog.count(*) INTO v_count
-      FROM registry_notary_private.oid4vci_issuance_transaction;
-    IF v_count >= 4096 THEN
-        RETURN QUERY SELECT -1::smallint, NULL::bytea, NULL::bytea,
-            NULL::bytea, NULL::timestamptz, NULL::bigint;
-        RETURN;
-    END IF;
-    SELECT pg_catalog.count(*) INTO v_count
-      FROM registry_notary_private.registry_client_offer;
-    IF v_count >= 4096 THEN
-        RETURN QUERY SELECT -1::smallint, NULL::bytea, NULL::bytea,
-            NULL::bytea, NULL::timestamptz, NULL::bigint;
-        RETURN;
-    END IF;
-    SELECT pg_catalog.count(*) INTO v_count
-      FROM registry_notary_private.issuance_evaluation_consumption;
-    IF v_count >= 4096 THEN
-        RETURN QUERY SELECT -1::smallint, NULL::bytea, NULL::bytea,
-            NULL::bytea, NULL::timestamptz, NULL::bigint;
-        RETURN;
-    END IF;
-
-    IF p_quota_limit IS NOT NULL THEN
-        IF p_quota_cost > p_quota_limit - v_quota.used THEN
-            RETURN QUERY SELECT -5::smallint, NULL::bytea, NULL::bytea,
-                NULL::bytea, NULL::timestamptz,
-                GREATEST(1::bigint, CEIL(EXTRACT(EPOCH FROM
-                    (v_quota.window_expires_at - v_now)))::bigint);
-            RETURN;
-        END IF;
-        UPDATE registry_notary_private.machine_quota
-           SET used = used + p_quota_cost
-         WHERE principal_hash = p_quota_principal_hash;
-    END IF;
-
-    INSERT INTO registry_notary_private.oid4vci_issuance_transaction (
-        transaction_hash, key_id, credential_configuration_id, commitment,
-        record_aead_nonce, record_ciphertext, state, created_at, updated_at, expires_at
-    ) VALUES (
-        p_transaction_hash, p_key_id, p_configuration_id, p_commitment,
-        p_record_aead_nonce, p_record_ciphertext, 'ready', v_now, v_now,
-        p_transaction_expires_at
-    );
-    IF p_pin_verifier IS NOT NULL THEN
-        INSERT INTO registry_notary_private.preauthorization_tx_code (
-            jti_hash, key_id, pin_verifier, pin_length, created_at, expires_at
-        ) VALUES (
-            p_jti_hash, p_key_id, p_pin_verifier, p_pin_length, v_now,
-            p_code_expires_at
-        );
-    END IF;
-    INSERT INTO registry_notary_private.issuance_evaluation_consumption (
-        evaluation_hash, key_id, created_at, expires_at
-    ) VALUES (p_evaluation_hash, p_key_id, v_now, p_evaluation_expires_at);
-    INSERT INTO registry_notary_private.registry_client_offer (
-        idempotency_key_hash, request_hash, evaluation_hash, transaction_hash,
-        key_id, response_aead_nonce, response_ciphertext, retention_expires_at,
-        evaluation_expires_at, purge_after, created_at
-    ) VALUES (
-        p_idempotency_key_hash, p_request_hash, p_evaluation_hash,
-        p_transaction_hash, p_key_id, p_response_aead_nonce,
-        p_response_ciphertext, p_retention_expires_at,
-        p_evaluation_expires_at,
-        GREATEST(p_retention_expires_at, p_evaluation_expires_at), v_now
-    );
-    RETURN QUERY SELECT 1::smallint, NULL::bytea, NULL::bytea,
-        NULL::bytea, NULL::timestamptz, 0::bigint;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.oid4vci_transaction_reserve_v1(
-    p_transaction_hash bytea,
-    p_key_id bytea,
-    p_configuration_id text,
-    p_commitment text,
-    p_record_aead_nonce bytea,
-    p_record_ciphertext bytea,
-    p_expires_at timestamptz
-)
-RETURNS smallint
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_count bigint;
-BEGIN
-    IF pg_catalog.octet_length(p_transaction_hash) <> 32
-       OR pg_catalog.octet_length(p_key_id) <> 32
-       OR p_commitment !~ '^sha256:[0-9a-f]{64}$'
-       OR p_expires_at <= v_now THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid issuance transaction';
-    END IF;
-    PERFORM pg_catalog.pg_advisory_xact_lock(5642808141211099137);
-    IF EXISTS (
-        SELECT 1 FROM registry_notary_private.preauthorization_login_state
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.preauthorization_tx_code
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.oid4vci_issuance_transaction
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.registry_client_offer
-         WHERE purge_after > v_now AND key_id <> p_key_id
-    ) THEN
-        RAISE EXCEPTION USING ERRCODE = '55000',
-            MESSAGE = 'sensitive-state key generation mismatch';
-    END IF;
-    LOCK TABLE registry_notary_private.oid4vci_issuance_transaction
-        IN SHARE ROW EXCLUSIVE MODE;
-    DELETE FROM registry_notary_private.oid4vci_issuance_transaction
-     WHERE expires_at <= v_now;
-    IF EXISTS (
-        SELECT 1 FROM registry_notary_private.oid4vci_issuance_transaction
-         WHERE transaction_hash = p_transaction_hash
-    ) THEN
-        RETURN 0;
-    END IF;
-    SELECT pg_catalog.count(*) INTO v_count
-      FROM registry_notary_private.oid4vci_issuance_transaction;
-    IF v_count >= 4096 THEN
-        RETURN -1;
-    END IF;
-    INSERT INTO registry_notary_private.oid4vci_issuance_transaction (
-        transaction_hash, key_id, credential_configuration_id, commitment,
-        record_aead_nonce, record_ciphertext, state, created_at, updated_at, expires_at
-    ) VALUES (
-        p_transaction_hash, p_key_id, p_configuration_id, p_commitment,
-        p_record_aead_nonce, p_record_ciphertext, 'ready', v_now, v_now, p_expires_at
-    );
-    RETURN 1;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.oid4vci_transaction_get_v1(p_transaction_hash bytea)
-RETURNS TABLE (
-    key_id bytea,
-    credential_configuration_id text,
-    commitment text,
-    record_aead_nonce bytea,
-    record_ciphertext bytea,
-    expires_at timestamptz
-)
-LANGUAGE sql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-    SELECT stored.key_id, stored.credential_configuration_id, stored.commitment,
-           stored.record_aead_nonce, stored.record_ciphertext, stored.expires_at
-      FROM registry_notary_private.oid4vci_issuance_transaction AS stored
-     WHERE stored.transaction_hash = p_transaction_hash
-       AND stored.expires_at > pg_catalog.clock_timestamp()
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.oid4vci_transaction_bind_nonce_v1(
-    p_transaction_hash bytea,
-    p_commitment text,
-    p_token_nonce_hash bytea
-)
-RETURNS boolean
-LANGUAGE sql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-    UPDATE registry_notary_private.oid4vci_issuance_transaction AS stored
-       SET token_nonce_hash = p_token_nonce_hash,
-           updated_at = pg_catalog.clock_timestamp()
-     WHERE stored.transaction_hash = p_transaction_hash
-       AND stored.commitment = p_commitment
-       AND stored.state = 'ready'
-       AND stored.token_nonce_hash IS NULL
-       AND stored.expires_at > pg_catalog.clock_timestamp()
-       AND pg_catalog.octet_length(p_token_nonce_hash) = 32
-    RETURNING TRUE
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.oid4vci_transaction_begin_v1(
-    p_transaction_hash bytea,
-    p_commitment text,
-    p_configuration_id text,
-    p_token_nonce_hash bytea,
-    p_holder_thumbprint_hash bytea,
-    p_request_hash bytea
-)
-RETURNS TABLE (
-    outcome smallint,
-    key_id bytea,
-    credential_configuration_id text,
-    commitment text,
-    record_aead_nonce bytea,
-    record_ciphertext bytea,
-    response_aead_nonce bytea,
-    response_ciphertext bytea,
-    expires_at timestamptz
-)
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_stored registry_notary_private.oid4vci_issuance_transaction%ROWTYPE;
-BEGIN
-    IF pg_catalog.octet_length(p_token_nonce_hash) <> 32
-       OR pg_catalog.octet_length(p_holder_thumbprint_hash) <> 32
-       OR pg_catalog.octet_length(p_request_hash) <> 32 THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid materialization binding';
-    END IF;
-    SELECT * INTO v_stored
-      FROM registry_notary_private.oid4vci_issuance_transaction
-     WHERE transaction_hash = p_transaction_hash
-     FOR UPDATE;
-    IF NOT FOUND OR v_stored.expires_at <= pg_catalog.clock_timestamp()
-       OR v_stored.commitment <> p_commitment
-       OR v_stored.credential_configuration_id <> p_configuration_id
-       OR v_stored.token_nonce_hash IS DISTINCT FROM p_token_nonce_hash THEN
-        RETURN QUERY SELECT -1::smallint, NULL::bytea, NULL::text, NULL::text,
-            NULL::bytea, NULL::bytea, NULL::bytea, NULL::bytea, NULL::timestamptz;
-        RETURN;
-    END IF;
-    IF v_stored.state = 'ready' THEN
-        UPDATE registry_notary_private.oid4vci_issuance_transaction
-           SET state = 'issuing', holder_thumbprint_hash = p_holder_thumbprint_hash,
-               request_hash = p_request_hash, updated_at = pg_catalog.clock_timestamp()
-         WHERE transaction_hash = p_transaction_hash;
-        RETURN QUERY SELECT 1::smallint, v_stored.key_id,
-            v_stored.credential_configuration_id, v_stored.commitment,
-            v_stored.record_aead_nonce, v_stored.record_ciphertext,
-            NULL::bytea, NULL::bytea, v_stored.expires_at;
-    ELSIF v_stored.state = 'issuing'
-       AND v_stored.holder_thumbprint_hash = p_holder_thumbprint_hash
-       AND v_stored.request_hash = p_request_hash THEN
-        RETURN QUERY SELECT 0::smallint, NULL::bytea, NULL::text, NULL::text,
-            NULL::bytea, NULL::bytea, NULL::bytea, NULL::bytea, NULL::timestamptz;
-    ELSIF v_stored.state = 'completed'
-       AND v_stored.holder_thumbprint_hash = p_holder_thumbprint_hash
-       AND v_stored.request_hash = p_request_hash THEN
-        RETURN QUERY SELECT 2::smallint, v_stored.key_id,
-            v_stored.credential_configuration_id, v_stored.commitment,
-            v_stored.record_aead_nonce, v_stored.record_ciphertext,
-            v_stored.response_aead_nonce, v_stored.response_ciphertext, v_stored.expires_at;
-    ELSE
-        RETURN QUERY SELECT -1::smallint, NULL::bytea, NULL::text, NULL::text,
-            NULL::bytea, NULL::bytea, NULL::bytea, NULL::bytea, NULL::timestamptz;
-    END IF;
-END
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.oid4vci_transaction_complete_v1(
-    p_transaction_hash bytea,
-    p_holder_thumbprint_hash bytea,
-    p_request_hash bytea,
-    p_response_aead_nonce bytea,
-    p_response_ciphertext bytea
-)
-RETURNS boolean
-LANGUAGE sql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-    UPDATE registry_notary_private.oid4vci_issuance_transaction AS stored
-       SET state = 'completed', response_aead_nonce = p_response_aead_nonce,
-           response_ciphertext = p_response_ciphertext,
-           updated_at = pg_catalog.clock_timestamp()
-     WHERE stored.transaction_hash = p_transaction_hash
-       AND stored.state = 'issuing'
-       AND stored.holder_thumbprint_hash = p_holder_thumbprint_hash
-       AND stored.request_hash = p_request_hash
-       AND stored.expires_at > pg_catalog.clock_timestamp()
-    RETURNING TRUE
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.oid4vci_transaction_fail_v1(
-    p_transaction_hash bytea,
-    p_holder_thumbprint_hash bytea
-)
-RETURNS boolean
-LANGUAGE sql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-    UPDATE registry_notary_private.oid4vci_issuance_transaction AS stored
-       SET state = 'failed', response_aead_nonce = NULL, response_ciphertext = NULL,
-           updated_at = pg_catalog.clock_timestamp()
-     WHERE stored.transaction_hash = p_transaction_hash
-       AND stored.state = 'issuing'
-       AND stored.holder_thumbprint_hash = p_holder_thumbprint_hash
-    RETURNING TRUE
-$function$;
-
-CREATE OR REPLACE FUNCTION registry_notary_api.retention_prune_v1(p_batch_size integer)
-RETURNS TABLE (deleted_count bigint, batch_saturated boolean)
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog
-AS $function$
-DECLARE
-    v_now timestamptz := pg_catalog.clock_timestamp();
-    v_count bigint;
-    v_total bigint := 0;
-    v_saturated boolean := FALSE;
-BEGIN
-    IF p_batch_size NOT BETWEEN 1 AND 1000 THEN
-        RAISE EXCEPTION USING ERRCODE = '22023', MESSAGE = 'invalid retention batch';
-    END IF;
-
-    WITH candidates AS (
-        SELECT scope_hash, identifier_hash
-          FROM registry_notary_private.replay_identifier
-         WHERE expires_at <= v_now
-         ORDER BY expires_at, scope_hash, identifier_hash
-         LIMIT p_batch_size FOR UPDATE SKIP LOCKED
-    ), deleted AS (
-        DELETE FROM registry_notary_private.replay_identifier AS stored
-         USING candidates
-         WHERE stored.scope_hash = candidates.scope_hash
-           AND stored.identifier_hash = candidates.identifier_hash
-        RETURNING 1
-    ) SELECT pg_catalog.count(*) INTO v_count FROM deleted;
-    v_total := v_total + v_count;
-    v_saturated := v_saturated OR v_count = p_batch_size;
-
-    WITH candidates AS (
-        SELECT scope_hash, nonce_hash
-          FROM registry_notary_private.consumable_nonce
-         WHERE (state = 'reserved' AND reservation_expires_at <= v_now)
-            OR (state = 'consumed' AND tombstone_expires_at <= v_now)
-         ORDER BY updated_at, scope_hash, nonce_hash
-         LIMIT p_batch_size FOR UPDATE SKIP LOCKED
-    ), deleted AS (
-        DELETE FROM registry_notary_private.consumable_nonce AS stored
-         USING candidates
-         WHERE stored.scope_hash = candidates.scope_hash
-           AND stored.nonce_hash = candidates.nonce_hash
-        RETURNING 1
-    ) SELECT pg_catalog.count(*) INTO v_count FROM deleted;
-    v_total := v_total + v_count;
-    v_saturated := v_saturated OR v_count = p_batch_size;
-
-    WITH candidates AS (
-        SELECT evaluation_id FROM registry_notary_private.evaluation
-         WHERE expires_at <= v_now
-         ORDER BY expires_at, evaluation_id
-         LIMIT p_batch_size FOR UPDATE SKIP LOCKED
-    ), deleted AS (
-        DELETE FROM registry_notary_private.evaluation AS stored
-         USING candidates WHERE stored.evaluation_id = candidates.evaluation_id
-        RETURNING 1
-    ) SELECT pg_catalog.count(*) INTO v_count FROM deleted;
-    v_total := v_total + v_count;
-    v_saturated := v_saturated OR v_count = p_batch_size;
-
-    WITH candidates AS (
-        SELECT key_hash FROM registry_notary_private.batch_idempotency
-         WHERE retention_expires_at <= v_now
-         ORDER BY retention_expires_at, key_hash
-         LIMIT p_batch_size FOR UPDATE SKIP LOCKED
-    ), deleted AS (
-        DELETE FROM registry_notary_private.batch_idempotency AS stored
-         USING candidates WHERE stored.key_hash = candidates.key_hash
-        RETURNING 1
-    ) SELECT pg_catalog.count(*) INTO v_count FROM deleted;
-    v_total := v_total + v_count;
-    v_saturated := v_saturated OR v_count = p_batch_size;
-
-    WITH candidates AS (
-        SELECT credential_id FROM registry_notary_private.credential_status
-         WHERE purge_after <= v_now
-         ORDER BY purge_after, credential_id
-         LIMIT p_batch_size FOR UPDATE SKIP LOCKED
-    ), deleted AS (
-        DELETE FROM registry_notary_private.credential_status AS stored
-         USING candidates WHERE stored.credential_id = candidates.credential_id
-        RETURNING 1
-    ) SELECT pg_catalog.count(*) INTO v_count FROM deleted;
-    v_total := v_total + v_count;
-    v_saturated := v_saturated OR v_count = p_batch_size;
-
-    WITH candidates AS (
-        SELECT principal_hash FROM registry_notary_private.machine_quota
-         WHERE window_expires_at <= v_now
-         ORDER BY window_expires_at, principal_hash
-         LIMIT p_batch_size FOR UPDATE SKIP LOCKED
-    ), deleted AS (
-        DELETE FROM registry_notary_private.machine_quota AS stored
-         USING candidates WHERE stored.principal_hash = candidates.principal_hash
-        RETURNING 1
-    ) SELECT pg_catalog.count(*) INTO v_count FROM deleted;
-    v_total := v_total + v_count;
-    v_saturated := v_saturated OR v_count = p_batch_size;
-
-    WITH candidates AS (
-        SELECT principal_hash, operation_hash
-          FROM registry_notary_private.machine_quota_operation
-         WHERE expires_at <= v_now
-         ORDER BY expires_at, principal_hash, operation_hash
-         LIMIT p_batch_size FOR UPDATE SKIP LOCKED
-    ), deleted AS (
-        DELETE FROM registry_notary_private.machine_quota_operation AS stored
-         USING candidates
-         WHERE stored.principal_hash = candidates.principal_hash
-           AND stored.operation_hash = candidates.operation_hash
-        RETURNING 1
-    ) SELECT pg_catalog.count(*) INTO v_count FROM deleted;
-    v_total := v_total + v_count;
-    v_saturated := v_saturated OR v_count = p_batch_size;
-
-    WITH candidates AS (
-        SELECT bucket_kind, key_hash
-          FROM registry_notary_private.subject_access_quota
-         WHERE window_expires_at <= v_now
-         ORDER BY window_expires_at, bucket_kind, key_hash
-         LIMIT p_batch_size FOR UPDATE SKIP LOCKED
-    ), deleted AS (
-        DELETE FROM registry_notary_private.subject_access_quota AS stored
-         USING candidates
-         WHERE stored.bucket_kind = candidates.bucket_kind
-           AND stored.key_hash = candidates.key_hash
-        RETURNING 1
-    ) SELECT pg_catalog.count(*) INTO v_count FROM deleted;
-    v_total := v_total + v_count;
-    v_saturated := v_saturated OR v_count = p_batch_size;
-
-    WITH candidates AS (
-        SELECT state_hash FROM registry_notary_private.preauthorization_login_state
-         WHERE expires_at <= v_now
-         ORDER BY expires_at, state_hash
-         LIMIT p_batch_size FOR UPDATE SKIP LOCKED
-    ), deleted AS (
-        DELETE FROM registry_notary_private.preauthorization_login_state AS stored
-         USING candidates WHERE stored.state_hash = candidates.state_hash
-        RETURNING 1
-    ) SELECT pg_catalog.count(*) INTO v_count FROM deleted;
-    v_total := v_total + v_count;
-    v_saturated := v_saturated OR v_count = p_batch_size;
-
-    WITH candidates AS (
-        SELECT jti_hash FROM registry_notary_private.preauthorization_tx_code
-         WHERE expires_at <= v_now
-         ORDER BY expires_at, jti_hash
-         LIMIT p_batch_size FOR UPDATE SKIP LOCKED
-    ), deleted AS (
-        DELETE FROM registry_notary_private.preauthorization_tx_code AS stored
-         USING candidates WHERE stored.jti_hash = candidates.jti_hash
-        RETURNING 1
-    ) SELECT pg_catalog.count(*) INTO v_count FROM deleted;
-    v_total := v_total + v_count;
-    v_saturated := v_saturated OR v_count = p_batch_size;
-
-    WITH candidates AS (
-        SELECT transaction_hash
-          FROM registry_notary_private.oid4vci_issuance_transaction
-         WHERE expires_at <= v_now
-         ORDER BY expires_at, transaction_hash
-         LIMIT p_batch_size FOR UPDATE SKIP LOCKED
-    ), deleted AS (
-        DELETE FROM registry_notary_private.oid4vci_issuance_transaction AS stored
-         USING candidates WHERE stored.transaction_hash = candidates.transaction_hash
-        RETURNING 1
-    ) SELECT pg_catalog.count(*) INTO v_count FROM deleted;
-    v_total := v_total + v_count;
-    v_saturated := v_saturated OR v_count = p_batch_size;
-
-    WITH candidates AS (
-        SELECT evaluation_hash
-          FROM registry_notary_private.issuance_evaluation_consumption
-         WHERE expires_at <= v_now
-         ORDER BY expires_at, evaluation_hash
-         LIMIT p_batch_size FOR UPDATE SKIP LOCKED
-    ), deleted AS (
-        DELETE FROM registry_notary_private.issuance_evaluation_consumption AS stored
-         USING candidates
-         WHERE stored.evaluation_hash = candidates.evaluation_hash
-        RETURNING 1
-    ) SELECT pg_catalog.count(*) INTO v_count FROM deleted;
-    v_total := v_total + v_count;
-    v_saturated := v_saturated OR v_count = p_batch_size;
-
-    WITH candidates AS (
-        SELECT idempotency_key_hash
-          FROM registry_notary_private.registry_client_offer
-         WHERE purge_after <= v_now
-         ORDER BY purge_after, idempotency_key_hash
-         LIMIT p_batch_size FOR UPDATE SKIP LOCKED
-    ), deleted AS (
-        DELETE FROM registry_notary_private.registry_client_offer AS stored
-         USING candidates
-         WHERE stored.idempotency_key_hash = candidates.idempotency_key_hash
-        RETURNING 1
-    ) SELECT pg_catalog.count(*) INTO v_count FROM deleted;
-    v_total := v_total + v_count;
-    v_saturated := v_saturated OR v_count = p_batch_size;
-
-    RETURN QUERY SELECT v_total, v_saturated;
-END
-$function$;
-
-REVOKE ALL ON ALL TABLES IN SCHEMA registry_notary_private FROM PUBLIC;
-REVOKE ALL ON ALL SEQUENCES IN SCHEMA registry_notary_private FROM PUBLIC;
-REVOKE EXECUTE ON ALL FUNCTIONS IN SCHEMA registry_notary_api FROM PUBLIC;
diff --git a/crates/registry-notary-server/src/state_plane/migration/tests.rs b/crates/registry-notary-server/src/state_plane/migration/tests.rs
deleted file mode 100644
index a7e280cd5..000000000
--- a/crates/registry-notary-server/src/state_plane/migration/tests.rs
+++ /dev/null
@@ -1,3401 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use std::{path::PathBuf, sync::Arc, time::Duration};
-
-use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
-use registry_notary_core::{StateConfig, StatePostgresqlConfig, STATE_STORAGE_POSTGRESQL};
-
-use crate::machine_quota::{MachineQuotaLimiter, MachineQuotaOperationOutcome};
-use crate::preauth_state::{
-    CredentialMaterialization, IssuanceAuthority, IssuanceTransaction, LoginState,
-    PreauthorizationState, PreauthorizationStateError, RegistryClientOfferPreflightOutcome,
-    RegistryClientOfferReservation, RegistryClientOfferReservationOutcome,
-    RegistryClientOfferResponse, RegistryClientTransactionCode,
-};
-use crate::state_plane::{
-    attest_postgres_state_plane_runtime, LoginReserveOutcome, NotaryPostgresStatePlaneError,
-    NotaryPostgresStatePlaneReadiness, NotaryPostgresStatePlaneRuntime, NotaryStatePlaneHandle,
-    PostgresSensitiveState, PostgresStatePlaneConfig, SensitiveStateError, SensitiveStateKeyConfig,
-};
-
-use super::*;
-
-const DATABASE_URL_ENV: &str = "REGISTRY_NOTARY_STATE_POSTGRES_TEST_URL";
-const DATABASE_CA_ENV: &str = "REGISTRY_NOTARY_STATE_POSTGRES_TEST_CA";
-const POOL_DATABASE_URL_ENV: &str = "REGISTRY_NOTARY_STATE_POOL_TEST_URL";
-const SENSITIVE_DATABASE_URL_ENV: &str = "REGISTRY_NOTARY_STATE_SENSITIVE_TEST_URL";
-const SENSITIVE_KEY_ENV: &str = "REGISTRY_NOTARY_STATE_SENSITIVE_TEST_KEY";
-const SENSITIVE_PROBE_MODE_ENV: &str = "REGISTRY_NOTARY_STATE_SENSITIVE_PROBE_MODE";
-const SENSITIVE_PROBE_PIN_ENV: &str = "REGISTRY_NOTARY_STATE_SENSITIVE_PROBE_PIN";
-const OWNER_ROLE: &str = "registry_notary_owner_test";
-const RUNTIME_ROLE: &str = "registry_notary_runtime_test";
-const MIGRATION_ROLE: &str = "registry_notary_migration_test";
-const UPGRADE_OWNER_ROLE: &str = "registry_notary_upgrade_owner_test";
-const UPGRADE_RUNTIME_ROLE: &str = "registry_notary_upgrade_runtime_test";
-const UPGRADE_MIGRATION_ROLE: &str = "registry_notary_upgrade_migration_test";
-const RESTORE_SOURCE_OWNER_ROLE: &str = "registry_notary_restore_source_owner";
-const RESTORE_SOURCE_RUNTIME_ROLE: &str = "registry_notary_restore_source_runtime";
-const RESTORE_SOURCE_MIGRATION_ROLE: &str = "registry_notary_restore_source_migration";
-const RESTORE_TARGET_OWNER_ROLE: &str = "registry_notary_restore_target_owner";
-const RESTORE_TARGET_RUNTIME_ROLE: &str = "registry_notary_restore_target_runtime";
-const RESTORE_TARGET_MIGRATION_ROLE: &str = "registry_notary_restore_target_migration";
-const RESTORE_WRONG_OWNER_ROLE: &str = "registry_notary_restore_wrong_owner";
-const RESTORE_WRONG_RUNTIME_ROLE: &str = "registry_notary_restore_wrong_runtime";
-const RESTORE_WRONG_MIGRATION_ROLE: &str = "registry_notary_restore_wrong_migration";
-
-#[test]
-fn schema_fingerprint_is_the_framed_semantic_identity() {
-    assert!(STATE_PLANE_SCHEMA_IDENTITY_PREIMAGE_V1.ends_with('\0'));
-    for semantic_revision in [
-        "schema=notary-owned-private-tables-fixed-typed-api-functions-v1",
-        "roles=owner-nologin-migration-assumption-runtime-execute-only-no-private-access-v1",
-        "database=postgresql-16-17-18-writable-safe-durability-database-clock-v1",
-        "replay=keyed-scope-identifier-one-winner-expiry-replacement-v1",
-        "nonce=keyed-generation-reserve-compare-consume-sixty-second-tombstone-v2",
-        "evaluation=client-bound-stored-record-v2-atomic-publication-expiry-v1",
-        "batch=keyed-request-owner-lease-quota-once-takeover-atomic-completion-stored-response-v2-fifteen-minute-retention-v1",
-        "credential-status=insert-only-locked-transition-terminal-revocation-database-clock-effective-expiry-before-suspension-retention-monotonic-updated-at-v2",
-        "machine-quota=keyed-principal-fixed-minute-whole-cost-atomic-quota-independent-idempotency-request-conflict-owner-sixty-second-lease-renewal-bounded-completion-final-owner-fence-evaluation-retention-takeover-v4",
-        "subject-access-quota=keyed-pseudonym-six-closed-buckets-fixed-windows-canonical-lock-order-caller-denial-order-atomic-all-or-none-check-only-no-mutation-v1",
-        "preauthorization-login=keyed-state-capacity-4096-encrypted-single-consume-expiry-live-key-attestation-v2",
-        "preauthorization-tx-code=verified-notary-issuer-stable-scope-jti-keyed-pin-verifier-peek-redeem-one-winner-expiry-live-key-attestation-v3",
-        "oid4vci-issuance-transaction=keyed-id-encrypted-immutable-record-sha256-uri-commitment-token-nonce-bind-holder-and-request-atomic-one-materialization-encrypted-response-terminal-failure-expiry-v2",
-        "issuance-evaluation-consumption=keyed-owner-evaluation-single-lineage-shared-direct-and-offer-expiry-capacity-v1",
-        "registry-client-offer=hashed-idempotency-exact-encrypted-response-read-only-preflight-before-side-effects-shared-evaluation-consumption-atomic-client-quota-transaction-and-optional-pin-expiry-capacity-v3",
-        "retention=thirteen-fixed-groups-bounded-expiry-prune-skip-locked-saturation-catch-up-v3",
-    ] {
-        assert!(
-            STATE_PLANE_SCHEMA_IDENTITY_PREIMAGE_V1.contains(semantic_revision),
-            "semantic fingerprint preimage omitted {semantic_revision}"
-        );
-    }
-    let calculated = Sha256::digest(STATE_PLANE_SCHEMA_IDENTITY_PREIMAGE_V1.as_bytes())
-        .iter()
-        .map(|byte| format!("{byte:02x}"))
-        .collect::<String>();
-    assert_eq!(calculated, STATE_PLANE_SCHEMA_FINGERPRINT_V1);
-}
-
-#[test]
-fn database_roles_accept_only_safe_unquoted_identifiers() {
-    assert!(OwnerDatabaseRole::parse("registry_notary_owner").is_ok());
-    assert!(RuntimeDatabaseRole::parse("registry_notary_runtime_1").is_ok());
-    for invalid in [
-        "",
-        "1owner",
-        "Owner",
-        "owner-role",
-        "owner;select",
-        "role name",
-    ] {
-        assert!(OwnerDatabaseRole::parse(invalid).is_err());
-        assert!(RuntimeDatabaseRole::parse(invalid).is_err());
-    }
-}
-
-#[test]
-fn migration_uses_fixed_security_definer_api_without_generic_grants() {
-    assert_eq!(
-        POSTGRES_STATE_PLANE_MIGRATION_V1
-            .matches("SECURITY DEFINER")
-            .count(),
-        EXPECTED_API_FUNCTION_COUNT_V1 as usize
-    );
-    let acl = state_plane_acl_sql(
-        &RuntimeDatabaseRole::parse("registry_notary_runtime").expect("valid role"),
-    );
-    assert!(!acl.contains("GRANT EXECUTE ON ALL FUNCTIONS"));
-    assert!(
-        acl.contains("REVOKE EXECUTE ON ALL FUNCTIONS IN SCHEMA registry_notary_api FROM PUBLIC")
-    );
-    for table in [
-        "replay_identifier",
-        "consumable_nonce",
-        "evaluation",
-        "batch_idempotency",
-        "credential_status",
-        "machine_quota",
-        "machine_quota_operation",
-        "subject_access_quota",
-        "preauthorization_login_state",
-        "preauthorization_tx_code",
-        "oid4vci_issuance_transaction",
-        "issuance_evaluation_consumption",
-        "registry_client_offer",
-    ] {
-        assert!(POSTGRES_STATE_PLANE_MIGRATION_V1.contains(table));
-    }
-}
-
-fn previous_state_plane_migration_v1() -> String {
-    fn remove_unique_range(sql: &mut String, start: &str, end: &str) {
-        assert_eq!(
-            sql.matches(start).count(),
-            1,
-            "previous migration start marker must be unique"
-        );
-        let start_offset = sql.find(start).expect("checked start marker");
-        let end_offset = sql[start_offset..]
-            .find(end)
-            .map(|offset| start_offset + offset)
-            .expect("previous migration end marker");
-        sql.replace_range(start_offset..end_offset, "");
-    }
-
-    let mut sql = POSTGRES_STATE_PLANE_MIGRATION_V1.to_string();
-    remove_unique_range(
-        &mut sql,
-        "CREATE TABLE IF NOT EXISTS registry_notary_private.machine_quota_operation",
-        "CREATE TABLE IF NOT EXISTS registry_notary_private.subject_access_quota",
-    );
-    remove_unique_range(
-        &mut sql,
-        "CREATE TABLE IF NOT EXISTS registry_notary_private.issuance_evaluation_consumption",
-        "ALTER DEFAULT PRIVILEGES IN SCHEMA registry_notary_private",
-    );
-    remove_unique_range(
-        &mut sql,
-        "CREATE OR REPLACE FUNCTION registry_notary_api.evaluation_issuance_consume_v1",
-        "CREATE OR REPLACE FUNCTION registry_notary_api.oid4vci_transaction_reserve_v1",
-    );
-    remove_unique_range(
-        &mut sql,
-        "CREATE OR REPLACE FUNCTION registry_notary_api.machine_quota_debit_once_v1",
-        "CREATE OR REPLACE FUNCTION registry_notary_api.subject_access_quota_debit_v1",
-    );
-
-    let v_now_key_extension = r#"        UNION ALL
-        SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
-         WHERE expires_at > v_now AND key_id <> p_key_id
-        UNION ALL
-        SELECT 1 FROM registry_notary_private.registry_client_offer
-         WHERE purge_after > v_now AND key_id <> p_key_id
-"#;
-    assert_eq!(sql.matches(v_now_key_extension).count(), 3);
-    sql = sql.replace(v_now_key_extension, "");
-    let statement_key_extension = r#"            UNION ALL
-            SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
-             WHERE expires_at > pg_catalog.statement_timestamp() AND key_id <> p_key_id
-            UNION ALL
-            SELECT 1 FROM registry_notary_private.registry_client_offer
-             WHERE purge_after > pg_catalog.statement_timestamp() AND key_id <> p_key_id
-"#;
-    assert_eq!(sql.matches(statement_key_extension).count(), 1);
-    sql = sql.replace(statement_key_extension, "");
-    remove_unique_range(
-        &mut sql,
-        r#"    WITH candidates AS (
-        SELECT principal_hash, operation_hash
-          FROM registry_notary_private.machine_quota_operation"#,
-        r#"    WITH candidates AS (
-        SELECT bucket_kind, key_hash
-          FROM registry_notary_private.subject_access_quota"#,
-    );
-    remove_unique_range(
-        &mut sql,
-        r#"    WITH candidates AS (
-        SELECT evaluation_hash
-          FROM registry_notary_private.issuance_evaluation_consumption"#,
-        "    RETURN QUERY SELECT v_total, v_saturated;",
-    );
-    assert_eq!(sql.matches("SECURITY DEFINER").count(), 31);
-    assert!(!sql.contains("issuance_evaluation_consumption"));
-    assert!(!sql.contains("registry_client_offer"));
-    assert!(!sql.contains("machine_quota_operation"));
-    sql
-}
-
-#[test]
-fn preceding_migration_fixture_is_exactly_narrowed() {
-    previous_state_plane_migration_v1();
-}
-
-async fn assert_previous_state_plane_upgrade_contract(
-    database_url: &str,
-    admin: &Client,
-) -> Result<(), Box<dyn std::error::Error>> {
-    admin
-        .batch_execute(&format!(
-            "CREATE ROLE {UPGRADE_OWNER_ROLE} NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE \
-                 NOREPLICATION NOBYPASSRLS;\n\
-             CREATE ROLE {UPGRADE_RUNTIME_ROLE} LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE \
-                 NOREPLICATION NOBYPASSRLS;\n\
-             CREATE ROLE {UPGRADE_MIGRATION_ROLE} LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE \
-                 NOREPLICATION NOBYPASSRLS;\n\
-             GRANT {UPGRADE_OWNER_ROLE} TO {UPGRADE_MIGRATION_ROLE};\n\
-             GRANT CREATE ON DATABASE postgres TO {UPGRADE_OWNER_ROLE};"
-        ))
-        .await?;
-    let (mut migration, migration_driver) =
-        connect_as(database_url, UPGRADE_MIGRATION_ROLE).await?;
-    let transaction = migration.transaction().await?;
-    transaction
-        .batch_execute(&format!(
-            "SET LOCAL ROLE {UPGRADE_OWNER_ROLE};\n{}",
-            previous_state_plane_migration_v1()
-        ))
-        .await?;
-    let roles = transaction
-        .query_one(
-            "SELECT owner.oid::bigint, runtime.oid::bigint\n\
-               FROM pg_catalog.pg_roles AS owner\n\
-               JOIN pg_catalog.pg_roles AS runtime ON runtime.rolname = $2\n\
-              WHERE owner.rolname = $1",
-            &[&UPGRADE_OWNER_ROLE, &UPGRADE_RUNTIME_ROLE],
-        )
-        .await?;
-    let owner_oid: i64 = roles.get(0);
-    let runtime_oid: i64 = roles.get(1);
-    transaction
-        .execute(
-            "INSERT INTO registry_notary_private.schema_metadata (\n\
-                 singleton, capability_id, schema_version, schema_fingerprint,\n\
-                 owner_role_oid, runtime_role_oid\n\
-             ) VALUES (TRUE, $1, $2, $3, $4::bigint::oid, $5::bigint::oid)",
-            &[
-                &STATE_PLANE_CAPABILITY_V1,
-                &STATE_PLANE_SCHEMA_VERSION_V1,
-                &PREVIOUS_STATE_PLANE_SCHEMA_FINGERPRINT_V1,
-                &owner_oid,
-                &runtime_oid,
-            ],
-        )
-        .await?;
-    let live_scope = vec![0xa1_u8; 32];
-    let live_identifier = vec![0xa2_u8; 32];
-    let live_state = vec![0xa3_u8; 32];
-    let live_key = vec![0xa4_u8; 32];
-    transaction
-        .execute(
-            "INSERT INTO registry_notary_private.replay_identifier (\n\
-                 scope_hash, identifier_hash, expires_at\n\
-             ) VALUES ($1, $2, pg_catalog.clock_timestamp() + interval '1 hour')",
-            &[&live_scope, &live_identifier],
-        )
-        .await?;
-    transaction
-        .execute(
-            "INSERT INTO registry_notary_private.preauthorization_login_state (\n\
-                 state_hash, credential_configuration_id, key_id, aead_nonce,\n\
-                 ciphertext, expires_at\n\
-             ) VALUES ($1, 'upgrade-live-state', $2, $3, $4,\n\
-                 pg_catalog.clock_timestamp() + interval '1 hour')",
-            &[
-                &live_state,
-                &live_key,
-                &vec![0xa5_u8; 12],
-                &vec![0xa6_u8; 17],
-            ],
-        )
-        .await?;
-    transaction.commit().await?;
-
-    let server_major = attest_server(admin).await?;
-    assert_eq!(
-        catalog_definition_fingerprint(admin).await?,
-        expected_previous_catalog_definition_fingerprint(server_major)?,
-        "the upgrade fixture must exactly reproduce the preceding catalog"
-    );
-    let installed = install_postgres_state_plane_v1(
-        &mut migration,
-        &OwnerDatabaseRole::parse(UPGRADE_OWNER_ROLE)?,
-        &RuntimeDatabaseRole::parse(UPGRADE_RUNTIME_ROLE)?,
-    )
-    .await?;
-    assert_eq!(installed.server_major, server_major);
-    assert_eq!(
-        admin
-            .query_one(
-                "SELECT schema_fingerprint FROM registry_notary_private.schema_metadata",
-                &[],
-            )
-            .await?
-            .get::<_, String>(0),
-        STATE_PLANE_SCHEMA_FINGERPRINT_V1
-    );
-    assert_eq!(
-        admin
-            .query_one(
-                "SELECT count(*)::bigint FROM registry_notary_private.replay_identifier\n\
-                  WHERE scope_hash = $1 AND identifier_hash = $2",
-                &[&live_scope, &live_identifier],
-            )
-            .await?
-            .get::<_, i64>(0),
-        1,
-        "forward migration must preserve preceding live rows"
-    );
-    assert_eq!(
-        admin
-            .query_one(
-                "SELECT count(*)::bigint\n\
-                   FROM registry_notary_private.preauthorization_login_state\n\
-                  WHERE state_hash = $1 AND key_id = $2",
-                &[&live_state, &live_key],
-            )
-            .await?
-            .get::<_, i64>(0),
-        1,
-        "forward migration must preserve preceding live sensitive rows"
-    );
-    let new_table_counts = admin
-        .query_one(
-            "SELECT\n\
-                 (SELECT count(*)::bigint FROM \
-                    registry_notary_private.issuance_evaluation_consumption),\n\
-                 (SELECT count(*)::bigint FROM \
-                    registry_notary_private.registry_client_offer),\n\
-                 (SELECT count(*)::bigint FROM \
-                    registry_notary_private.machine_quota_operation)",
-            &[],
-        )
-        .await?;
-    assert_eq!(new_table_counts.get::<_, i64>(0), 0);
-    assert_eq!(new_table_counts.get::<_, i64>(1), 0);
-    assert_eq!(new_table_counts.get::<_, i64>(2), 0);
-
-    let (runtime, runtime_driver) = connect_as(database_url, UPGRADE_RUNTIME_ROLE).await?;
-    assert_eq!(attest_postgres_state_plane_v1(&runtime).await?, installed);
-    assert_eq!(
-        runtime
-            .query_one(
-                "SELECT registry_notary_api.evaluation_issuance_consume_v1(\n\
-                     $1, $2, pg_catalog.clock_timestamp() + interval '1 hour')",
-                &[&vec![0xa7_u8; 32], &live_key],
-            )
-            .await?
-            .get::<_, i16>(0),
-        1
-    );
-    install_postgres_state_plane_v1(
-        &mut migration,
-        &OwnerDatabaseRole::parse(UPGRADE_OWNER_ROLE)?,
-        &RuntimeDatabaseRole::parse(UPGRADE_RUNTIME_ROLE)?,
-    )
-    .await?;
-
-    drop(runtime);
-    runtime_driver.abort();
-    drop(migration);
-    migration_driver.abort();
-    admin
-        .batch_execute(&format!(
-            "DROP SCHEMA registry_notary_api CASCADE;\n\
-             DROP SCHEMA registry_notary_private CASCADE;\n\
-             DROP ROLE {UPGRADE_RUNTIME_ROLE};\n\
-             DROP ROLE {UPGRADE_MIGRATION_ROLE};\n\
-             REVOKE CREATE ON DATABASE postgres FROM {UPGRADE_OWNER_ROLE};\n\
-             DROP ROLE {UPGRADE_OWNER_ROLE};"
-        ))
-        .await?;
-    Ok(())
-}
-
-#[tokio::test]
-#[ignore = "requires a dedicated REGISTRY_NOTARY_STATE_POSTGRES_TEST_URL"]
-async fn postgres_v1_logical_restore_rebind_requires_exact_owner_and_catalog(
-) -> Result<(), Box<dyn std::error::Error>> {
-    let database_url = std::env::var(DATABASE_URL_ENV)?;
-    let (admin, admin_driver) = connect_as(&database_url, "postgres").await?;
-    let database_name: String = admin
-        .query_one("SELECT current_database()", &[])
-        .await?
-        .get(0);
-    if database_name != "postgres" {
-        return Err("the dedicated conformance database must be named postgres".into());
-    }
-    let occupied: bool = admin
-        .query_one(
-            "SELECT EXISTS (SELECT 1 FROM pg_catalog.pg_namespace\n\
-               WHERE nspname IN ('registry_notary_private', 'registry_notary_api'))",
-            &[],
-        )
-        .await?
-        .get(0);
-    if occupied {
-        return Err("the dedicated conformance database is not empty".into());
-    }
-    admin
-        .batch_execute(&format!(
-            "CREATE ROLE {RESTORE_SOURCE_OWNER_ROLE} NOLOGIN NOSUPERUSER NOCREATEDB \
-                 NOCREATEROLE NOREPLICATION NOBYPASSRLS;\n\
-             CREATE ROLE {RESTORE_SOURCE_RUNTIME_ROLE} LOGIN NOSUPERUSER NOCREATEDB \
-                 NOCREATEROLE NOREPLICATION NOBYPASSRLS;\n\
-             CREATE ROLE {RESTORE_SOURCE_MIGRATION_ROLE} LOGIN NOSUPERUSER NOCREATEDB \
-                 NOCREATEROLE NOREPLICATION NOBYPASSRLS;\n\
-             GRANT {RESTORE_SOURCE_OWNER_ROLE} TO {RESTORE_SOURCE_MIGRATION_ROLE};\n\
-             GRANT CREATE ON DATABASE postgres TO {RESTORE_SOURCE_OWNER_ROLE};"
-        ))
-        .await?;
-    let (mut source_migration, source_migration_driver) =
-        connect_as(&database_url, RESTORE_SOURCE_MIGRATION_ROLE).await?;
-    install_postgres_state_plane_v1(
-        &mut source_migration,
-        &OwnerDatabaseRole::parse(RESTORE_SOURCE_OWNER_ROLE)?,
-        &RuntimeDatabaseRole::parse(RESTORE_SOURCE_RUNTIME_ROLE)?,
-    )
-    .await?;
-    let source_roles = metadata_roles_for_exact_v1(&admin).await?;
-    drop(source_migration);
-    source_migration_driver.abort();
-
-    admin
-        .batch_execute(&format!(
-            "CREATE ROLE {RESTORE_TARGET_OWNER_ROLE} NOLOGIN NOSUPERUSER NOCREATEDB \
-                 NOCREATEROLE NOREPLICATION NOBYPASSRLS;\n\
-             CREATE ROLE {RESTORE_TARGET_RUNTIME_ROLE} LOGIN NOSUPERUSER NOCREATEDB \
-                 NOCREATEROLE NOREPLICATION NOBYPASSRLS;\n\
-             CREATE ROLE {RESTORE_TARGET_MIGRATION_ROLE} LOGIN NOSUPERUSER NOCREATEDB \
-                 NOCREATEROLE NOREPLICATION NOBYPASSRLS;\n\
-             GRANT {RESTORE_TARGET_OWNER_ROLE} TO {RESTORE_TARGET_MIGRATION_ROLE};\n\
-             GRANT CREATE ON DATABASE postgres TO {RESTORE_TARGET_OWNER_ROLE};\n\
-             CREATE ROLE {RESTORE_WRONG_OWNER_ROLE} NOLOGIN NOSUPERUSER NOCREATEDB \
-                 NOCREATEROLE NOREPLICATION NOBYPASSRLS;\n\
-             CREATE ROLE {RESTORE_WRONG_RUNTIME_ROLE} LOGIN NOSUPERUSER NOCREATEDB \
-                 NOCREATEROLE NOREPLICATION NOBYPASSRLS;\n\
-             CREATE ROLE {RESTORE_WRONG_MIGRATION_ROLE} LOGIN NOSUPERUSER NOCREATEDB \
-                 NOCREATEROLE NOREPLICATION NOBYPASSRLS;\n\
-             GRANT {RESTORE_WRONG_OWNER_ROLE} TO {RESTORE_WRONG_MIGRATION_ROLE};\n\
-             REASSIGN OWNED BY {RESTORE_SOURCE_OWNER_ROLE} \
-                 TO {RESTORE_TARGET_OWNER_ROLE};\n\
-             DROP OWNED BY {RESTORE_SOURCE_RUNTIME_ROLE};\n\
-             GRANT ALL ON SCHEMA registry_notary_private TO PUBLIC;\n\
-             GRANT ALL ON SCHEMA registry_notary_api TO PUBLIC;\n\
-             GRANT ALL ON ALL TABLES IN SCHEMA registry_notary_private TO PUBLIC;\n\
-             GRANT ALL ON ALL SEQUENCES IN SCHEMA registry_notary_private TO PUBLIC;\n\
-             GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA registry_notary_private TO PUBLIC;\n\
-             GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA registry_notary_api TO PUBLIC;\n\
-             REVOKE CREATE ON DATABASE postgres FROM {RESTORE_SOURCE_OWNER_ROLE};\n\
-             REVOKE {RESTORE_SOURCE_OWNER_ROLE} FROM {RESTORE_SOURCE_MIGRATION_ROLE};\n\
-             DROP ROLE {RESTORE_SOURCE_RUNTIME_ROLE};\n\
-             DROP ROLE {RESTORE_SOURCE_MIGRATION_ROLE};\n\
-             DROP ROLE {RESTORE_SOURCE_OWNER_ROLE};"
-        ))
-        .await?;
-
-    let target_owner_oid: i64 = admin
-        .query_one(
-            "SELECT oid::bigint FROM pg_catalog.pg_roles WHERE rolname = $1",
-            &[&RESTORE_TARGET_OWNER_ROLE],
-        )
-        .await?
-        .get(0);
-    let target_runtime_oid: i64 = admin
-        .query_one(
-            "SELECT oid::bigint FROM pg_catalog.pg_roles WHERE rolname = $1",
-            &[&RESTORE_TARGET_RUNTIME_ROLE],
-        )
-        .await?
-        .get(0);
-    let target_roles = BoundRoleOids {
-        owner: target_owner_oid,
-        runtime: target_runtime_oid,
-    };
-    assert_ne!(source_roles, target_roles, "fresh roles must shift OIDs");
-    assert_eq!(
-        metadata_roles_for_exact_v1(&admin).await?,
-        source_roles,
-        "logical restore preserves the source metadata OIDs"
-    );
-    let target_runtime_had_execute: bool = admin
-        .query_one(
-            "SELECT pg_catalog.has_function_privilege(\n\
-                 $1, 'registry_notary_api.attest_v1()', 'EXECUTE')",
-            &[&RESTORE_TARGET_RUNTIME_ROLE],
-        )
-        .await?
-        .get(0);
-    assert!(
-        target_runtime_had_execute,
-        "ACL-stripped restore exposes default PUBLIC function execution before repair"
-    );
-
-    let (mut target_migration, target_migration_driver) =
-        connect_as(&database_url, RESTORE_TARGET_MIGRATION_ROLE).await?;
-    let rebound = install_postgres_state_plane_v1(
-        &mut target_migration,
-        &OwnerDatabaseRole::parse(RESTORE_TARGET_OWNER_ROLE)?,
-        &RuntimeDatabaseRole::parse(RESTORE_TARGET_RUNTIME_ROLE)?,
-    )
-    .await?;
-    assert_eq!(metadata_roles_for_exact_v1(&admin).await?, target_roles);
-    let (target_runtime, target_runtime_driver) =
-        connect_as(&database_url, RESTORE_TARGET_RUNTIME_ROLE).await?;
-    assert_eq!(
-        attest_postgres_state_plane_v1(&target_runtime).await?,
-        rebound
-    );
-    let public_acl_repaired: bool = admin
-        .query_one(
-            "SELECT NOT pg_catalog.has_schema_privilege(\n\
-                 $1, 'registry_notary_private', 'USAGE')\n\
-               AND NOT pg_catalog.has_schema_privilege(\n\
-                 $1, 'registry_notary_api', 'USAGE')\n\
-               AND NOT pg_catalog.has_table_privilege(\n\
-                 $1, 'registry_notary_private.schema_metadata', 'SELECT')",
-            &[&RESTORE_WRONG_RUNTIME_ROLE],
-        )
-        .await?
-        .get(0);
-    assert!(
-        public_acl_repaired,
-        "restore rebind must remove PUBLIC schema and private-table privileges"
-    );
-
-    let metadata_before_rejected_rebind = metadata_roles_for_exact_v1(&admin).await?;
-    let (mut wrong_migration, wrong_migration_driver) =
-        connect_as(&database_url, RESTORE_WRONG_MIGRATION_ROLE).await?;
-    assert_eq!(
-        install_postgres_state_plane_v1(
-            &mut wrong_migration,
-            &OwnerDatabaseRole::parse(RESTORE_WRONG_OWNER_ROLE)?,
-            &RuntimeDatabaseRole::parse(RESTORE_WRONG_RUNTIME_ROLE)?,
-        )
-        .await,
-        Err(StatePlaneMigrationError::CapabilityDrift)
-    );
-    assert_eq!(
-        metadata_roles_for_exact_v1(&admin).await?,
-        metadata_before_rejected_rebind,
-        "wrong-owner rebind must roll back metadata changes"
-    );
-    let wrong_runtime_gained_execute: bool = admin
-        .query_one(
-            "SELECT pg_catalog.has_function_privilege(\n\
-                 $1, 'registry_notary_api.attest_v1()', 'EXECUTE')",
-            &[&RESTORE_WRONG_RUNTIME_ROLE],
-        )
-        .await?
-        .get(0);
-    assert!(
-        !wrong_runtime_gained_execute,
-        "rejected ownership rebind must not grant runtime execution"
-    );
-
-    admin
-        .batch_execute(
-            "ALTER FUNCTION registry_notary_api.replay_insert_v1(\n\
-                 bytea, bytea, timestamptz) IMMUTABLE",
-        )
-        .await?;
-    assert_eq!(
-        install_postgres_state_plane_v1(
-            &mut target_migration,
-            &OwnerDatabaseRole::parse(RESTORE_TARGET_OWNER_ROLE)?,
-            &RuntimeDatabaseRole::parse(RESTORE_TARGET_RUNTIME_ROLE)?,
-        )
-        .await,
-        Err(StatePlaneMigrationError::CapabilityDrift)
-    );
-    assert_eq!(metadata_roles_for_exact_v1(&admin).await?, target_roles);
-    let drift_remains: bool = admin
-        .query_one(
-            "SELECT function.provolatile = 'i'\n\
-               FROM pg_catalog.pg_proc AS function\n\
-               JOIN pg_catalog.pg_namespace AS namespace\n\
-                 ON namespace.oid = function.pronamespace\n\
-              WHERE namespace.nspname = 'registry_notary_api'\n\
-                AND function.proname = 'replay_insert_v1'",
-            &[],
-        )
-        .await?
-        .get(0);
-    assert!(
-        drift_remains,
-        "rejected install must not repair catalog drift"
-    );
-
-    drop(target_runtime);
-    target_runtime_driver.abort();
-    drop(target_migration);
-    target_migration_driver.abort();
-    drop(wrong_migration);
-    wrong_migration_driver.abort();
-    admin
-        .batch_execute(&format!(
-            "DROP SCHEMA registry_notary_api CASCADE;\n\
-             DROP SCHEMA registry_notary_private CASCADE;\n\
-             REVOKE {RESTORE_TARGET_OWNER_ROLE} FROM {RESTORE_TARGET_MIGRATION_ROLE};\n\
-             REVOKE CREATE ON DATABASE postgres FROM {RESTORE_TARGET_OWNER_ROLE};\n\
-             DROP ROLE {RESTORE_TARGET_RUNTIME_ROLE};\n\
-             DROP ROLE {RESTORE_TARGET_MIGRATION_ROLE};\n\
-             DROP ROLE {RESTORE_TARGET_OWNER_ROLE};\n\
-             REVOKE {RESTORE_WRONG_OWNER_ROLE} FROM {RESTORE_WRONG_MIGRATION_ROLE};\n\
-             DROP ROLE {RESTORE_WRONG_RUNTIME_ROLE};\n\
-             DROP ROLE {RESTORE_WRONG_MIGRATION_ROLE};\n\
-             DROP ROLE {RESTORE_WRONG_OWNER_ROLE};"
-        ))
-        .await?;
-    drop(admin);
-    admin_driver.abort();
-    Ok(())
-}
-
-#[tokio::test]
-#[ignore = "requires a dedicated REGISTRY_NOTARY_STATE_POSTGRES_TEST_URL"]
-async fn postgres_v1_typed_state_contracts_and_drift_rejection(
-) -> Result<(), Box<dyn std::error::Error>> {
-    let database_url = std::env::var(DATABASE_URL_ENV)?;
-    let (admin, admin_driver) = connect_as(&database_url, "postgres").await?;
-    let database_name: String = admin
-        .query_one("SELECT current_database()", &[])
-        .await?
-        .get(0);
-    if database_name != "postgres" {
-        return Err("the dedicated conformance database must be named postgres".into());
-    }
-    let occupied: bool = admin
-        .query_one(
-            "SELECT EXISTS (SELECT 1 FROM pg_catalog.pg_namespace\n\
-               WHERE nspname IN ('registry_notary_private', 'registry_notary_api'))\n\
-             OR EXISTS (SELECT 1 FROM pg_catalog.pg_roles\n\
-               WHERE rolname IN ($1, $2, $3, $4, $5, $6))",
-            &[
-                &OWNER_ROLE,
-                &RUNTIME_ROLE,
-                &MIGRATION_ROLE,
-                &UPGRADE_OWNER_ROLE,
-                &UPGRADE_RUNTIME_ROLE,
-                &UPGRADE_MIGRATION_ROLE,
-            ],
-        )
-        .await?
-        .get(0);
-    if occupied {
-        return Err("the dedicated conformance database is not empty".into());
-    }
-    assert_previous_state_plane_upgrade_contract(&database_url, &admin).await?;
-    admin
-        .batch_execute(&format!(
-            "CREATE ROLE {OWNER_ROLE} NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE \
-                 NOREPLICATION NOBYPASSRLS;\n\
-             CREATE ROLE {RUNTIME_ROLE} LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE \
-                 NOREPLICATION NOBYPASSRLS;\n\
-             CREATE ROLE {MIGRATION_ROLE} LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE \
-                 NOREPLICATION NOBYPASSRLS;\n\
-             GRANT {OWNER_ROLE} TO {MIGRATION_ROLE};\n\
-             GRANT CREATE ON DATABASE postgres TO {OWNER_ROLE};"
-        ))
-        .await?;
-
-    let (mut migration, migration_driver) = connect_as(&database_url, MIGRATION_ROLE).await?;
-    let installed = install_postgres_state_plane_v1(
-        &mut migration,
-        &OwnerDatabaseRole::parse(OWNER_ROLE)?,
-        &RuntimeDatabaseRole::parse(RUNTIME_ROLE)?,
-    )
-    .await?;
-    assert!((16..=18).contains(&installed.server_major));
-
-    let (runtime, runtime_driver) = connect_as(&database_url, RUNTIME_ROLE).await?;
-    let attested = attest_postgres_state_plane_v1(&runtime).await?;
-    assert_eq!(attested, installed);
-
-    let invalid_token_buckets = vec!["invalid_token_per_client_address".to_string()];
-    let invalid_token_hashes = vec![vec![0x11; 32]];
-    let invalid_token_limits = vec![2];
-    let invalid_token_windows = vec![60];
-    assert_eq!(
-        subject_access_quota_decision(
-            &runtime,
-            SUBJECT_ACCESS_QUOTA_CHECK_SQL,
-            &invalid_token_buckets,
-            &invalid_token_hashes,
-            &invalid_token_limits,
-            &invalid_token_windows,
-        )
-        .await?,
-        (true, None)
-    );
-    assert_eq!(
-        subject_access_quota_decision(
-            &runtime,
-            SUBJECT_ACCESS_QUOTA_CHECK_SQL,
-            &invalid_token_buckets,
-            &invalid_token_hashes,
-            &invalid_token_limits,
-            &invalid_token_windows,
-        )
-        .await?,
-        (true, None),
-        "availability checks must not consume invalid-token quota"
-    );
-
-    let (runtime_peer, runtime_peer_driver) = connect_as(&database_url, RUNTIME_ROLE).await?;
-    let concurrent_buckets = vec!["per_principal".to_string()];
-    let concurrent_hashes = vec![vec![0x55; 32]];
-    let concurrent_limits = vec![1];
-    let concurrent_windows = vec![60];
-    let (first_instance, second_instance) = tokio::join!(
-        subject_access_quota_decision(
-            &runtime,
-            SUBJECT_ACCESS_QUOTA_DEBIT_SQL,
-            &concurrent_buckets,
-            &concurrent_hashes,
-            &concurrent_limits,
-            &concurrent_windows,
-        ),
-        subject_access_quota_decision(
-            &runtime_peer,
-            SUBJECT_ACCESS_QUOTA_DEBIT_SQL,
-            &concurrent_buckets,
-            &concurrent_hashes,
-            &concurrent_limits,
-            &concurrent_windows,
-        )
-    );
-    let first_instance = first_instance?;
-    let second_instance = second_instance?;
-    assert_ne!(
-        first_instance.0, second_instance.0,
-        "exactly one concurrent runtime may consume the last unit"
-    );
-    assert_eq!(
-        [first_instance, second_instance]
-            .into_iter()
-            .filter(|decision| decision.0)
-            .count(),
-        1
-    );
-
-    assert_eq!(
-        subject_access_quota_decision(
-            &runtime_peer,
-            SUBJECT_ACCESS_QUOTA_DEBIT_SQL,
-            &invalid_token_buckets,
-            &invalid_token_hashes,
-            &invalid_token_limits,
-            &invalid_token_windows,
-        )
-        .await?,
-        (true, None)
-    );
-    drop(runtime_peer);
-    runtime_peer_driver.abort();
-
-    let (runtime_restarted, runtime_restarted_driver) =
-        connect_as(&database_url, RUNTIME_ROLE).await?;
-    assert_eq!(
-        subject_access_quota_decision(
-            &runtime_restarted,
-            SUBJECT_ACCESS_QUOTA_DEBIT_SQL,
-            &invalid_token_buckets,
-            &invalid_token_hashes,
-            &invalid_token_limits,
-            &invalid_token_windows,
-        )
-        .await?,
-        (true, None),
-        "a restarted runtime must observe and continue the shared bucket"
-    );
-    drop(runtime_restarted);
-    runtime_restarted_driver.abort();
-    assert_eq!(
-        subject_access_quota_decision(
-            &runtime,
-            SUBJECT_ACCESS_QUOTA_CHECK_SQL,
-            &invalid_token_buckets,
-            &invalid_token_hashes,
-            &invalid_token_limits,
-            &invalid_token_windows,
-        )
-        .await?,
-        (false, Some("invalid_token_per_client_address".to_string())),
-        "the original runtime must observe debits made by peer and restarted runtimes"
-    );
-
-    let grouped_buckets = vec![
-        "per_principal".to_string(),
-        "per_holder_issuance".to_string(),
-    ];
-    let grouped_hashes = vec![vec![0x22; 32], vec![0x33; 32]];
-    let grouped_limits = vec![1, 0];
-    let grouped_windows = vec![60, 3600];
-    assert_eq!(
-        subject_access_quota_decision(
-            &runtime,
-            SUBJECT_ACCESS_QUOTA_DEBIT_SQL,
-            &grouped_buckets,
-            &grouped_hashes,
-            &grouped_limits,
-            &grouped_windows,
-        )
-        .await?,
-        (false, Some("per_holder_issuance".to_string()))
-    );
-    assert_eq!(
-        subject_access_quota_decision(
-            &runtime,
-            SUBJECT_ACCESS_QUOTA_DEBIT_SQL,
-            &["per_principal".to_string()],
-            &[vec![0x22; 32]],
-            &[1],
-            &[60],
-        )
-        .await?,
-        (true, None),
-        "a denied grouped debit must not partially consume an allowed bucket"
-    );
-
-    assert_replay_and_nonce_contracts(&database_url, &runtime, &admin).await?;
-    assert_evaluation_and_batch_contracts(&database_url, &runtime, &admin).await?;
-    assert_credential_status_and_machine_quota_contracts(&database_url, &runtime, &admin).await?;
-    assert_preauthorization_contracts(&database_url, &runtime, &admin).await?;
-    assert_sensitive_adapter_contract(&database_url, &admin).await?;
-    assert_retention_contract(&runtime, &admin).await?;
-    assert_runtime_pool_contract(&database_url).await?;
-
-    admin
-        .batch_execute(
-            "ALTER FUNCTION registry_notary_api.replay_insert_v1(\n\
-                 bytea, bytea, timestamptz) IMMUTABLE",
-        )
-        .await?;
-    assert_eq!(
-        attest_postgres_state_plane_v1(&runtime).await,
-        Err(StatePlaneMigrationError::CapabilityDrift)
-    );
-
-    drop(runtime);
-    runtime_driver.abort();
-    drop(migration);
-    migration_driver.abort();
-    admin
-        .batch_execute(&format!(
-            "DROP SCHEMA registry_notary_api CASCADE;\n\
-             DROP SCHEMA registry_notary_private CASCADE;\n\
-             DROP ROLE {RUNTIME_ROLE};\n\
-             DROP ROLE {MIGRATION_ROLE};\n\
-             REVOKE CREATE ON DATABASE postgres FROM {OWNER_ROLE};\n\
-             DROP ROLE {OWNER_ROLE};"
-        ))
-        .await?;
-    drop(admin);
-    admin_driver.abort();
-    Ok(())
-}
-
-async fn assert_runtime_pool_contract(
-    database_url: &str,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let runtime_url = database_url.replacen("postgres@", &format!("{RUNTIME_ROLE}@"), 1);
-    if runtime_url == database_url {
-        return Err("pool test URL does not contain the expected dedicated admin role".into());
-    }
-    // SAFETY: the conformance harness runs this ignored test by exact name
-    // in its own process, so no concurrent test reads this unique variable.
-    unsafe { std::env::set_var(POOL_DATABASE_URL_ENV, &runtime_url) };
-    let config = PostgresStatePlaneConfig::new(
-        POOL_DATABASE_URL_ENV,
-        Some(PathBuf::from(std::env::var(DATABASE_CA_ENV)?)),
-        // Exercise the pool contract with the implementer-facing defaults.
-        // Artificially short activation deadlines are unreliable on hosted
-        // runners and do not represent the production readiness boundary.
-        Duration::from_secs(5),
-        Duration::from_secs(2),
-        1,
-    )?;
-    let pooled = Arc::new(NotaryPostgresStatePlaneRuntime::connect(&config).await?);
-    assert_eq!(pooled.created_session_count(), 1);
-
-    for _ in 0..3 {
-        let session = pooled.open_domain_session().await?;
-        session
-            .run_operation(session.client().simple_query("SELECT 1"))
-            .await?;
-    }
-    assert_eq!(
-        pooled.created_session_count(),
-        1,
-        "sequential state operations must reuse one physical session"
-    );
-
-    let held = pooled.open_domain_session().await?;
-    let wait_started = tokio::time::Instant::now();
-    assert!(matches!(
-        pooled.open_domain_session().await,
-        Err(NotaryPostgresStatePlaneError::OperationUnavailable)
-    ));
-    let waited = wait_started.elapsed();
-    assert!(
-        waited >= Duration::from_secs(1) && waited < Duration::from_secs(5),
-        "saturated pool admission must honor the configured operation deadline"
-    );
-    assert_eq!(pooled.pool_status().max_size, 1);
-    drop(held);
-
-    let poisoned = pooled.open_domain_session().await?;
-    assert!(matches!(
-        poisoned
-            .run_operation(
-                poisoned
-                    .client()
-                    .simple_query("SELECT registry_notary_api.pool_test_missing_function_v1()")
-            )
-            .await,
-        Err(NotaryPostgresStatePlaneError::OperationUnavailable)
-    ));
-    drop(poisoned);
-    drop(pooled.open_domain_session().await?);
-    assert_eq!(
-        pooled.created_session_count(),
-        2,
-        "a failed state operation must replace its physical session"
-    );
-
-    let rotated_url =
-        format!("{runtime_url}&application_name=registry-notary-pool-generation-test");
-    // SAFETY: this exact ignored test has exclusive process access to the
-    // unique environment variable, as above.
-    unsafe { std::env::set_var(POOL_DATABASE_URL_ENV, &rotated_url) };
-    drop(pooled.open_domain_session().await?);
-    assert_eq!(
-        pooled.created_session_count(),
-        3,
-        "a URL generation change must evict and fully replace the old session"
-    );
-
-    let held = pooled.open_domain_session().await?;
-    let waiter_runtime = Arc::clone(&pooled);
-    let waiter =
-        tokio::spawn(async move { waiter_runtime.open_domain_session().await.map(|_| ()) });
-    tokio::time::timeout(Duration::from_secs(1), async {
-        while pooled.pool_status().waiting != 1 {
-            tokio::task::yield_now().await;
-        }
-    })
-    .await?;
-    pooled.shutdown();
-    assert!(matches!(
-        waiter.await?,
-        Err(NotaryPostgresStatePlaneError::Shutdown)
-    ));
-    drop(held);
-    assert_eq!(
-        pooled.readiness().await,
-        NotaryPostgresStatePlaneReadiness::Shutdown
-    );
-    drop(pooled);
-    // SAFETY: no runtime or concurrent test can read the unique variable
-    // after the exact conformance test completes.
-    unsafe { std::env::remove_var(POOL_DATABASE_URL_ENV) };
-    Ok(())
-}
-
-const SUBJECT_ACCESS_QUOTA_CHECK_SQL: &str = "SELECT allowed, denied_bucket FROM \
-     registry_notary_api.subject_access_quota_check_v1($1, $2, $3, $4)";
-const SUBJECT_ACCESS_QUOTA_DEBIT_SQL: &str = "SELECT allowed, denied_bucket FROM \
-     registry_notary_api.subject_access_quota_debit_v1($1, $2, $3, $4)";
-
-async fn assert_replay_and_nonce_contracts(
-    database_url: &str,
-    runtime: &Client,
-    admin: &Client,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let scope = vec![0x61_u8; 32];
-    let replay_id = vec![0x62_u8; 32];
-    let expires_at = time::OffsetDateTime::now_utc() + time::Duration::minutes(5);
-    let (peer, peer_driver) = connect_as(database_url, RUNTIME_ROLE).await?;
-    let (left, right) = tokio::join!(
-        async {
-            runtime
-                .query_one(
-                    "SELECT registry_notary_api.replay_insert_v1($1, $2, $3)",
-                    &[&scope, &replay_id, &expires_at],
-                )
-                .await
-        },
-        async {
-            peer.query_one(
-                "SELECT registry_notary_api.replay_insert_v1($1, $2, $3)",
-                &[&scope, &replay_id, &expires_at],
-            )
-            .await
-        }
-    );
-    assert_eq!(
-        [left?.get::<_, bool>(0), right?.get::<_, bool>(0)]
-            .into_iter()
-            .filter(|inserted| *inserted)
-            .count(),
-        1,
-        "exactly one runtime may accept a replay identifier"
-    );
-    drop(peer);
-    peer_driver.abort();
-
-    let (restarted, restarted_driver) = connect_as(database_url, RUNTIME_ROLE).await?;
-    assert!(!restarted
-        .query_one(
-            "SELECT registry_notary_api.replay_insert_v1($1, $2, $3)",
-            &[&scope, &replay_id, &expires_at],
-        )
-        .await?
-        .get::<_, bool>(0));
-    admin
-        .execute(
-            "UPDATE registry_notary_private.replay_identifier SET \
-             created_at = pg_catalog.clock_timestamp() - interval '2 seconds', \
-             expires_at = \
-             pg_catalog.clock_timestamp() - interval '1 second' \
-             WHERE scope_hash = $1 AND identifier_hash = $2",
-            &[&scope, &replay_id],
-        )
-        .await?;
-    assert!(restarted
-        .query_one(
-            "SELECT registry_notary_api.replay_insert_v1($1, $2, $3)",
-            &[&scope, &replay_id, &expires_at],
-        )
-        .await?
-        .get::<_, bool>(0));
-    drop(restarted);
-    restarted_driver.abort();
-
-    let nonce_scope = vec![0x63_u8; 32];
-    let nonce = vec![0x64_u8; 32];
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.nonce_reserve_v1($1, $2, $3)",
-            &[&nonce_scope, &nonce, &expires_at],
-        )
-        .await?
-        .get::<_, bool>(0));
-    let generation: i64 = runtime
-        .query_one(
-            "SELECT registry_notary_api.nonce_reservation_generation_v1($1, $2)",
-            &[&nonce_scope, &nonce],
-        )
-        .await?
-        .get(0);
-    assert_eq!(generation, 1);
-    let (peer, peer_driver) = connect_as(database_url, RUNTIME_ROLE).await?;
-    let (left, right) = tokio::join!(
-        async {
-            runtime
-                .query_one(
-                    "SELECT registry_notary_api.nonce_consume_v1($1, $2, $3)",
-                    &[&nonce_scope, &nonce, &generation],
-                )
-                .await
-        },
-        async {
-            peer.query_one(
-                "SELECT registry_notary_api.nonce_consume_v1($1, $2, $3)",
-                &[&nonce_scope, &nonce, &generation],
-            )
-            .await
-        }
-    );
-    assert_eq!(
-        [left?.get::<_, bool>(0), right?.get::<_, bool>(0)]
-            .into_iter()
-            .filter(|consumed| *consumed)
-            .count(),
-        1,
-        "a consumable nonce must have one winner"
-    );
-    let tombstone_seconds: f64 = admin
-        .query_one(
-            "SELECT EXTRACT(EPOCH FROM (tombstone_expires_at - updated_at))::double precision \
-             FROM registry_notary_private.consumable_nonce \
-             WHERE scope_hash = $1 AND nonce_hash = $2 AND state = 'consumed'",
-            &[&nonce_scope, &nonce],
-        )
-        .await?
-        .get(0);
-    assert!((59.0..=61.0).contains(&tombstone_seconds));
-    assert!(!runtime
-        .query_one(
-            "SELECT registry_notary_api.nonce_reserve_v1($1, $2, $3)",
-            &[&nonce_scope, &nonce, &expires_at],
-        )
-        .await?
-        .get::<_, bool>(0));
-    admin
-        .execute(
-            "UPDATE registry_notary_private.consumable_nonce SET tombstone_expires_at = \
-             pg_catalog.clock_timestamp() - interval '1 second' \
-             WHERE scope_hash = $1 AND nonce_hash = $2",
-            &[&nonce_scope, &nonce],
-        )
-        .await?;
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.nonce_reserve_v1($1, $2, $3)",
-            &[&nonce_scope, &nonce, &expires_at],
-        )
-        .await?
-        .get::<_, bool>(0));
-    let replacement_generation: i64 = runtime
-        .query_one(
-            "SELECT registry_notary_api.nonce_reservation_generation_v1($1, $2)",
-            &[&nonce_scope, &nonce],
-        )
-        .await?
-        .get(0);
-    assert_eq!(replacement_generation, generation + 1);
-    assert!(!runtime
-        .query_one(
-            "SELECT registry_notary_api.nonce_consume_v1($1, $2, $3)",
-            &[&nonce_scope, &nonce, &generation],
-        )
-        .await?
-        .get::<_, bool>(0));
-    admin
-        .execute(
-            "UPDATE registry_notary_private.consumable_nonce SET reservation_expires_at = \
-             pg_catalog.clock_timestamp() - interval '1 second' \
-             WHERE scope_hash = $1 AND nonce_hash = $2",
-            &[&nonce_scope, &nonce],
-        )
-        .await?;
-    assert!(!runtime
-        .query_one(
-            "SELECT registry_notary_api.nonce_consume_v1($1, $2, $3)",
-            &[&nonce_scope, &nonce, &replacement_generation],
-        )
-        .await?
-        .get::<_, bool>(0));
-    drop(peer);
-    peer_driver.abort();
-    Ok(())
-}
-
-#[derive(Debug)]
-struct BatchDecision {
-    outcome: String,
-    response_version: Option<i16>,
-    response_json: Option<String>,
-}
-
-async fn batch_reserve(
-    client: &Client,
-    key: &[u8],
-    request: &[u8],
-    principal: &[u8],
-    owner: &[u8],
-    quota_limit: Option<i32>,
-) -> Result<BatchDecision, tokio_postgres::Error> {
-    let row = client
-        .query_one(
-            "SELECT outcome, response_version, response_json::text AS response_json FROM \
-             registry_notary_api.batch_reserve_v1($1, $2, $3, $4, 30, $5, 1)",
-            &[&key, &request, &principal, &owner, &quota_limit],
-        )
-        .await?;
-    Ok(BatchDecision {
-        outcome: row.get("outcome"),
-        response_version: row.get("response_version"),
-        response_json: row.get("response_json"),
-    })
-}
-
-async fn assert_evaluation_and_batch_contracts(
-    database_url: &str,
-    runtime: &Client,
-    admin: &Client,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let client_hash = vec![0x70_u8; 32];
-    let request_hash = vec![0x71_u8; 32];
-    let created_at = time::OffsetDateTime::now_utc();
-    let expires_at = created_at + time::Duration::minutes(5);
-    let created_at_json = created_at.format(&time::format_description::well_known::Rfc3339)?;
-    let expires_at_json = expires_at.format(&time::format_description::well_known::Rfc3339)?;
-    let record = serde_json::json!({"decision": "allow"});
-    let record_json = record.to_string();
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.evaluation_insert_v1(\
-             'evaluation-v1-rejected', $1, $2, 'conformance', 1::smallint, \
-             $3::text::jsonb, $4, $5)",
-            &[
-                &client_hash,
-                &request_hash,
-                &record_json,
-                &created_at,
-                &expires_at
-            ],
-        )
-        .await
-        .is_err());
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.evaluation_insert_v1(\
-             'evaluation-direct', $1, $2, 'conformance', 2::smallint, \
-             $3::text::jsonb, $4, $5)",
-            &[
-                &client_hash,
-                &request_hash,
-                &record_json,
-                &created_at,
-                &expires_at
-            ],
-        )
-        .await?
-        .get::<_, bool>(0));
-    assert!(!runtime
-        .query_one(
-            "SELECT registry_notary_api.evaluation_insert_v1(\
-             'evaluation-direct', $1, $2, 'conformance', 2::smallint, \
-             $3::text::jsonb, $4, $5)",
-            &[
-                &client_hash,
-                &request_hash,
-                &record_json,
-                &created_at,
-                &expires_at
-            ],
-        )
-        .await?
-        .get::<_, bool>(0));
-    assert!(runtime
-        .query_opt(
-            "SELECT * FROM registry_notary_api.evaluation_get_v1('evaluation-direct', $1)",
-            &[&client_hash],
-        )
-        .await?
-        .is_some());
-    assert!(runtime
-        .query_opt(
-            "SELECT * FROM registry_notary_api.evaluation_get_v1('evaluation-direct', $1)",
-            &[&vec![0x72_u8; 32]],
-        )
-        .await?
-        .is_none());
-    admin
-        .execute(
-            "UPDATE registry_notary_private.evaluation SET expires_at = \
-             pg_catalog.clock_timestamp() - interval '1 second', created_at = \
-             pg_catalog.clock_timestamp() - interval '2 seconds' \
-             WHERE evaluation_id = 'evaluation-direct'",
-            &[],
-        )
-        .await?;
-    assert!(runtime
-        .query_opt(
-            "SELECT * FROM registry_notary_api.evaluation_get_v1('evaluation-direct', $1)",
-            &[&client_hash],
-        )
-        .await?
-        .is_none());
-
-    let key = vec![0x73_u8; 32];
-    let request = vec![0x74_u8; 32];
-    let other_request = vec![0x75_u8; 32];
-    let principal = vec![0x76_u8; 32];
-    let owner_a = vec![0x77_u8; 32];
-    let owner_b = vec![0x78_u8; 32];
-    assert_eq!(
-        batch_reserve(runtime, &key, &request, &principal, &owner_a, Some(2))
-            .await?
-            .outcome,
-        "owner"
-    );
-    assert_eq!(
-        batch_reserve(runtime, &key, &request, &principal, &owner_b, Some(2))
-            .await?
-            .outcome,
-        "wait"
-    );
-    assert_eq!(
-        batch_reserve(runtime, &key, &other_request, &principal, &owner_b, Some(2),)
-            .await?
-            .outcome,
-        "conflict"
-    );
-    assert!(!runtime
-        .query_one(
-            "SELECT registry_notary_api.batch_heartbeat_v1($1, $2, $3, 30)",
-            &[&key, &request, &owner_b],
-        )
-        .await?
-        .get::<_, bool>(0));
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.batch_heartbeat_v1($1, $2, $3, 30)",
-            &[&key, &request, &owner_a],
-        )
-        .await?
-        .get::<_, bool>(0));
-    admin
-        .execute(
-            "UPDATE registry_notary_private.batch_idempotency SET lease_expires_at = \
-             pg_catalog.clock_timestamp() - interval '1 second' WHERE key_hash = $1",
-            &[&key],
-        )
-        .await?;
-    assert_eq!(
-        batch_reserve(runtime, &key, &request, &principal, &owner_b, Some(2))
-            .await?
-            .outcome,
-        "owner"
-    );
-    let quota_row = runtime
-        .query_one(
-            "SELECT allowed, remaining FROM \
-             registry_notary_api.machine_quota_debit_v1($1, 2, 1)",
-            &[&principal],
-        )
-        .await?;
-    assert!(quota_row.get::<_, bool>("allowed"));
-    assert_eq!(quota_row.get::<_, i32>("remaining"), 0);
-    assert!(!runtime
-        .query_one(
-            "SELECT allowed FROM registry_notary_api.machine_quota_debit_v1($1, 2, 1)",
-            &[&principal],
-        )
-        .await?
-        .get::<_, bool>(0));
-
-    let evaluations = serde_json::json!([{
-        "evaluation_id": "evaluation-batch",
-        "client_id_hash_hex": "7979797979797979797979797979797979797979797979797979797979797979",
-        "purpose": "conformance",
-        "record_version": 2,
-        "record": {"decision": "allow"},
-        "created_at": created_at_json,
-        "expires_at": expires_at_json
-    }]);
-    let invalid_evaluations = serde_json::json!([
-        evaluations[0].clone(),
-        {
-            "evaluation_id": "evaluation-batch-invalid",
-            "client_id_hash_hex": "7979797979797979797979797979797979797979797979797979797979797979",
-            "purpose": "conformance",
-            "record_version": 1,
-            "record": {"decision": "deny"},
-            "created_at": created_at_json,
-            "expires_at": expires_at_json
-        }
-    ]);
-    let response = serde_json::json!({"batch_id": "batch-conformance"});
-    let evaluations_json = evaluations.to_string();
-    let invalid_evaluations_json = invalid_evaluations.to_string();
-    let response_json = response.to_string();
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.batch_complete_v1(\
-             $1, $2, $3, $4::text::jsonb, 1::smallint, $5::text::jsonb)",
-            &[&key, &request, &owner_b, &evaluations_json, &response_json],
-        )
-        .await
-        .is_err());
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.batch_complete_v1(\
-             $1, $2, $3, $4::text::jsonb, 2::smallint, $5::text::jsonb)",
-            &[
-                &key,
-                &request,
-                &owner_b,
-                &invalid_evaluations_json,
-                &response_json
-            ],
-        )
-        .await
-        .is_err());
-    assert!(runtime
-        .query_opt(
-            "SELECT * FROM registry_notary_api.evaluation_get_v1('evaluation-batch', $1)",
-            &[&vec![0x79_u8; 32]],
-        )
-        .await?
-        .is_none());
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.batch_complete_v1(\
-             $1, $2, $3, $4::text::jsonb, 2::smallint, $5::text::jsonb)",
-            &[&key, &request, &owner_b, &evaluations_json, &response_json],
-        )
-        .await?
-        .get::<_, bool>(0));
-    assert!(runtime
-        .query_opt(
-            "SELECT * FROM registry_notary_api.evaluation_get_v1('evaluation-batch', $1)",
-            &[&vec![0x79_u8; 32]],
-        )
-        .await?
-        .is_some());
-    let replay = batch_reserve(runtime, &key, &request, &principal, &owner_a, Some(2)).await?;
-    assert_eq!(replay.outcome, "replay");
-    assert_eq!(replay.response_version, Some(2));
-    assert_eq!(
-        replay
-            .response_json
-            .as_deref()
-            .map(serde_json::from_str::<serde_json::Value>)
-            .transpose()?,
-        Some(response)
-    );
-
-    let failed_key = vec![0x7a_u8; 32];
-    assert_eq!(
-        batch_reserve(runtime, &failed_key, &request, &principal, &owner_a, None,)
-            .await?
-            .outcome,
-        "owner"
-    );
-    assert!(!runtime
-        .query_one(
-            "SELECT registry_notary_api.batch_fail_v1($1, $2, $3)",
-            &[&failed_key, &request, &owner_b],
-        )
-        .await?
-        .get::<_, bool>(0));
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.batch_fail_v1($1, $2, $3)",
-            &[&failed_key, &request, &owner_a],
-        )
-        .await?
-        .get::<_, bool>(0));
-    let (peer, peer_driver) = connect_as(database_url, RUNTIME_ROLE).await?;
-    assert_eq!(
-        batch_reserve(&peer, &failed_key, &request, &principal, &owner_b, None)
-            .await?
-            .outcome,
-        "owner"
-    );
-    drop(peer);
-    peer_driver.abort();
-    Ok(())
-}
-
-async fn assert_credential_status_and_machine_quota_contracts(
-    database_url: &str,
-    runtime: &Client,
-    admin: &Client,
-) -> Result<(), Box<dyn std::error::Error>> {
-    // A Notary instance clock may lead the database clock slightly. Status
-    // transitions must remain valid and monotonic across that skew.
-    let issued_at = time::OffsetDateTime::now_utc() + time::Duration::seconds(5);
-    let credential_expires_at = issued_at + time::Duration::hours(1);
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.credential_status_insert_v1(\
-             'credential-concurrent', 'issuer', 'profile', $1, $2, 3600)",
-            &[&issued_at, &credential_expires_at],
-        )
-        .await?
-        .get::<_, bool>(0));
-    assert!(!runtime
-        .query_one(
-            "SELECT registry_notary_api.credential_status_insert_v1(\
-             'credential-concurrent', 'issuer', 'profile', $1, $2, 3600)",
-            &[&issued_at, &credential_expires_at],
-        )
-        .await?
-        .get::<_, bool>(0));
-    assert_eq!(
-        runtime
-            .query_one(
-                "SELECT status FROM registry_notary_api.credential_status_get_v1(\
-                 'credential-concurrent')",
-                &[],
-            )
-            .await?
-            .get::<_, String>(0),
-        "valid"
-    );
-    let (peer, peer_driver) = connect_as(database_url, RUNTIME_ROLE).await?;
-    let (suspended, revoked) = tokio::join!(
-        runtime.query_one(
-            "SELECT outcome FROM registry_notary_api.credential_status_update_v1(\
-             'credential-concurrent', 'suspended')",
-            &[],
-        ),
-        peer.query_one(
-            "SELECT outcome FROM registry_notary_api.credential_status_update_v1(\
-             'credential-concurrent', 'revoked')",
-            &[],
-        )
-    );
-    let suspended = suspended?.get::<_, String>(0);
-    let revoked = revoked?.get::<_, String>(0);
-    assert_eq!(revoked, "updated");
-    assert!(matches!(
-        suspended.as_str(),
-        "updated" | "invalid_transition"
-    ));
-    assert_eq!(
-        runtime
-            .query_one(
-                "SELECT status FROM registry_notary_api.credential_status_get_v1(\
-                 'credential-concurrent')",
-                &[],
-            )
-            .await?
-            .get::<_, String>(0),
-        "revoked"
-    );
-    assert_eq!(
-        runtime
-            .query_one(
-                "SELECT outcome FROM registry_notary_api.credential_status_update_v1(\
-                 'credential-concurrent', 'valid')",
-                &[],
-            )
-            .await?
-            .get::<_, String>(0),
-        "invalid_transition"
-    );
-    drop(peer);
-    peer_driver.abort();
-
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.credential_status_insert_v1(\
-             'credential-expired', 'issuer', 'profile', \
-             pg_catalog.clock_timestamp() - interval '2 hours', \
-             pg_catalog.clock_timestamp() - interval '1 hour', 7200)",
-            &[],
-        )
-        .await?
-        .get::<_, bool>(0));
-    let expired_row = runtime
-        .query_one(
-            "SELECT * FROM registry_notary_api.credential_status_get_v1('credential-expired')",
-            &[],
-        )
-        .await?;
-    assert_eq!(expired_row.get::<_, String>("status"), "valid");
-    assert_eq!(
-        expired_row.get::<_, String>("effective_status"),
-        "expired",
-        "PostgreSQL time must derive expiry independently of replica clocks"
-    );
-    let expired_record = crate::credential_status::postgres_status_record(&expired_row)?;
-    assert_eq!(
-        expired_record.effective_status(time::OffsetDateTime::UNIX_EPOCH),
-        registry_notary_core::CREDENTIAL_STATUS_EXPIRED,
-        "a replica clock far behind PostgreSQL must not reopen an expired credential"
-    );
-    let expired_suspended_row = runtime
-        .query_one(
-            "SELECT * FROM registry_notary_api.credential_status_update_v1(\
-             'credential-expired', 'suspended')",
-            &[],
-        )
-        .await?;
-    assert_eq!(expired_suspended_row.get::<_, String>("outcome"), "updated");
-    assert_eq!(
-        expired_suspended_row.get::<_, String>("status"),
-        "suspended"
-    );
-    assert_eq!(
-        expired_suspended_row.get::<_, String>("effective_status"),
-        "expired",
-        "credential expiry must supersede a stored suspension"
-    );
-    let expired_suspended_record =
-        crate::credential_status::postgres_status_record(&expired_suspended_row)?;
-    assert_eq!(
-        expired_suspended_record.effective_status(time::OffsetDateTime::UNIX_EPOCH),
-        registry_notary_core::CREDENTIAL_STATUS_EXPIRED
-    );
-    admin
-        .execute(
-            "UPDATE registry_notary_private.credential_status SET \
-             issued_at = pg_catalog.clock_timestamp() - interval '3 hours', \
-             credential_expires_at = pg_catalog.clock_timestamp() - interval '2 hours', \
-             updated_at = pg_catalog.clock_timestamp() - interval '2 hours', \
-             purge_after = pg_catalog.clock_timestamp() - interval '1 hour' \
-             WHERE credential_id = 'credential-expired'",
-            &[],
-        )
-        .await?;
-    assert!(runtime
-        .query_opt(
-            "SELECT * FROM registry_notary_api.credential_status_get_v1('credential-expired')",
-            &[],
-        )
-        .await?
-        .is_none());
-
-    let principal = vec![0x80_u8; 32];
-    let first = runtime
-        .query_one(
-            "SELECT allowed, remaining, retry_after_seconds FROM \
-             registry_notary_api.machine_quota_debit_v1($1, 3, 2)",
-            &[&principal],
-        )
-        .await?;
-    assert!(first.get::<_, bool>("allowed"));
-    assert_eq!(first.get::<_, i32>("remaining"), 1);
-    assert_eq!(first.get::<_, i64>("retry_after_seconds"), 0);
-    let boundary = runtime
-        .query_one(
-            "SELECT allowed, remaining FROM \
-             registry_notary_api.machine_quota_debit_v1($1, 3, 1)",
-            &[&principal],
-        )
-        .await?;
-    assert!(boundary.get::<_, bool>("allowed"));
-    assert_eq!(boundary.get::<_, i32>("remaining"), 0);
-    let denied = runtime
-        .query_one(
-            "SELECT allowed, remaining, retry_after_seconds FROM \
-             registry_notary_api.machine_quota_debit_v1($1, 3, 1)",
-            &[&principal],
-        )
-        .await?;
-    assert!(!denied.get::<_, bool>("allowed"));
-    assert_eq!(denied.get::<_, i32>("remaining"), 0);
-    assert!(denied.get::<_, i64>("retry_after_seconds") >= 1);
-
-    let once_principal = vec![0x86_u8; 32];
-    let exact_operation = vec![0x87_u8; 32];
-    let distinct_operation = vec![0x88_u8; 32];
-    let exact_request = vec![0x8b_u8; 32];
-    let first_owner = vec![0x89_u8; 32];
-    let takeover_owner = vec![0x8a_u8; 32];
-    let operation_expires_at = time::OffsetDateTime::now_utc() + time::Duration::minutes(10);
-    let (quota_peer, quota_peer_driver) = connect_as(database_url, RUNTIME_ROLE).await?;
-    let first_args: [&(dyn tokio_postgres::types::ToSql + Sync); 5] = [
-        &once_principal,
-        &exact_operation,
-        &exact_request,
-        &first_owner,
-        &operation_expires_at,
-    ];
-    let retry_args: [&(dyn tokio_postgres::types::ToSql + Sync); 5] = [
-        &once_principal,
-        &exact_operation,
-        &exact_request,
-        &takeover_owner,
-        &operation_expires_at,
-    ];
-    let (first, exact_retry) = tokio::join!(
-        runtime.query_one(
-            "SELECT allowed, acquired, remaining FROM \
-             registry_notary_api.machine_quota_debit_once_v1(\
-                 $1, $2, $3, $4, 1, 1, 60, $5)",
-            &first_args,
-        ),
-        quota_peer.query_one(
-            "SELECT allowed, acquired, remaining FROM \
-             registry_notary_api.machine_quota_debit_once_v1(\
-                 $1, $2, $3, $4, 1, 1, 60, $5)",
-            &retry_args,
-        ),
-    );
-    let first = first?;
-    let exact_retry = exact_retry?;
-    assert!(first.get::<_, bool>("allowed"));
-    assert_eq!(first.get::<_, i32>("remaining"), 0);
-    assert!(exact_retry.get::<_, bool>("allowed"));
-    assert_eq!(exact_retry.get::<_, i32>("remaining"), 0);
-    let first_acquired = first.get::<_, bool>("acquired");
-    let retry_acquired = exact_retry.get::<_, bool>("acquired");
-    assert_ne!(
-        first_acquired, retry_acquired,
-        "exact operations racing on separate connections have one lease owner"
-    );
-    let (acquired_owner, waiting_owner) = if first_acquired {
-        (&first_owner, &takeover_owner)
-    } else {
-        (&takeover_owner, &first_owner)
-    };
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.machine_quota_operation_release_v1($1, $2, $3)",
-            &[&once_principal, &exact_operation, acquired_owner],
-        )
-        .await?
-        .get::<_, bool>(0));
-    let takeover = runtime
-        .query_one(
-            "SELECT allowed, acquired, remaining FROM \
-             registry_notary_api.machine_quota_debit_once_v1(\
-                 $1, $2, $3, $4, 1, 1, 60, $5)",
-            &[
-                &once_principal,
-                &exact_operation,
-                &exact_request,
-                waiting_owner,
-                &operation_expires_at,
-            ],
-        )
-        .await?;
-    assert!(takeover.get::<_, bool>("allowed"));
-    assert!(takeover.get::<_, bool>("acquired"));
-    assert_eq!(takeover.get::<_, i32>("remaining"), 0);
-    assert!(!runtime
-        .query_one(
-            "SELECT allowed FROM \
-             registry_notary_api.machine_quota_debit_once_v1(\
-                 $1, $2, $3, $4, 1, 1, 60, $5)",
-            &[
-                &once_principal,
-                &distinct_operation,
-                &exact_request,
-                &takeover_owner,
-                &operation_expires_at,
-            ],
-        )
-        .await?
-        .get::<_, bool>("allowed"));
-
-    let conflict_principal = vec![0x8c_u8; 32];
-    let conflict_operation = vec![0x8d_u8; 32];
-    let request_a = vec![0x8e_u8; 32];
-    let request_b = vec![0x8f_u8; 32];
-    let conflict_a_args: [&(dyn tokio_postgres::types::ToSql + Sync); 5] = [
-        &conflict_principal,
-        &conflict_operation,
-        &request_a,
-        &first_owner,
-        &operation_expires_at,
-    ];
-    let conflict_b_args: [&(dyn tokio_postgres::types::ToSql + Sync); 5] = [
-        &conflict_principal,
-        &conflict_operation,
-        &request_b,
-        &takeover_owner,
-        &operation_expires_at,
-    ];
-    let conflict_a = runtime.query_one(
-        "SELECT allowed, acquired, conflict FROM \
-         registry_notary_api.machine_quota_debit_once_v1(\
-             $1, $2, $3, $4, 2, 1, 60, $5)",
-        &conflict_a_args,
-    );
-    let conflict_b = quota_peer.query_one(
-        "SELECT allowed, acquired, conflict FROM \
-         registry_notary_api.machine_quota_debit_once_v1(\
-             $1, $2, $3, $4, 2, 1, 60, $5)",
-        &conflict_b_args,
-    );
-    let (conflict_a, conflict_b) = tokio::join!(conflict_a, conflict_b);
-    let conflict_a = conflict_a?;
-    let conflict_b = conflict_b?;
-    assert!(conflict_a.get::<_, bool>("allowed"));
-    assert!(conflict_b.get::<_, bool>("allowed"));
-    assert_eq!(
-        [
-            conflict_a.get::<_, bool>("acquired"),
-            conflict_b.get::<_, bool>("acquired"),
-        ]
-        .into_iter()
-        .filter(|acquired| *acquired)
-        .count(),
-        1,
-    );
-    assert_eq!(
-        [
-            conflict_a.get::<_, bool>("conflict"),
-            conflict_b.get::<_, bool>("conflict"),
-        ]
-        .into_iter()
-        .filter(|conflict| *conflict)
-        .count(),
-        1,
-    );
-    assert_eq!(
-        admin
-            .query_one(
-                "SELECT used FROM registry_notary_private.machine_quota \
-                 WHERE principal_hash = $1",
-                &[&conflict_principal],
-            )
-            .await?
-            .get::<_, i32>("used"),
-        1,
-        "request-shape conflict must not debit the idempotency operation twice",
-    );
-
-    let disabled_principal = vec![0x90_u8; 32];
-    let disabled_operation = vec![0x91_u8; 32];
-    let disabled_request = vec![0x92_u8; 32];
-    let disabled_first = runtime
-        .query_one(
-            "SELECT acquired FROM registry_notary_api.machine_quota_debit_once_v1(\
-                 $1, $2, $3, $4, NULL::integer, 1, 60, $5)",
-            &[
-                &disabled_principal,
-                &disabled_operation,
-                &disabled_request,
-                &first_owner,
-                &operation_expires_at,
-            ],
-        )
-        .await?;
-    assert!(disabled_first.get::<_, bool>("acquired"));
-    let disabled_retry = quota_peer
-        .query_one(
-            "SELECT acquired, conflict FROM \
-             registry_notary_api.machine_quota_debit_once_v1(\
-                 $1, $2, $3, $4, NULL::integer, 1, 60, $5)",
-            &[
-                &disabled_principal,
-                &disabled_operation,
-                &disabled_request,
-                &takeover_owner,
-                &operation_expires_at,
-            ],
-        )
-        .await?;
-    assert!(!disabled_retry.get::<_, bool>("acquired"));
-    assert!(!disabled_retry.get::<_, bool>("conflict"));
-    assert_eq!(
-        admin
-            .query_one(
-                "SELECT used FROM registry_notary_private.machine_quota \
-                 WHERE principal_hash = $1",
-                &[&disabled_principal],
-            )
-            .await?
-            .get::<_, i32>("used"),
-        0,
-        "disabled quota retains ownership without charging budget",
-    );
-    drop(quota_peer);
-    quota_peer_driver.abort();
-    Ok(())
-}
-
-async fn assert_preauthorization_contracts(
-    database_url: &str,
-    runtime: &Client,
-    admin: &Client,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let state = vec![0x81_u8; 32];
-    let key_id = vec![0x82_u8; 32];
-    let nonce = vec![0x83_u8; 12];
-    let ciphertext = vec![0x84_u8; 17];
-    let expires_at = time::OffsetDateTime::now_utc() + time::Duration::days(1);
-    let reserve_login_sql = "SELECT registry_notary_api.\
-         preauthorization_login_reserve_v1($1, 'credential-config', $2, $3, $4, $5)";
-    assert_eq!(
-        runtime
-            .query_one(
-                reserve_login_sql,
-                &[&state, &key_id, &nonce, &ciphertext, &expires_at],
-            )
-            .await?
-            .get::<_, i16>(0),
-        1
-    );
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.preauthorization_key_attest_v1($1)",
-            &[&key_id],
-        )
-        .await?
-        .get::<_, bool>(0));
-    assert!(!runtime
-        .query_one(
-            "SELECT registry_notary_api.preauthorization_key_attest_v1($1)",
-            &[&vec![0x8f_u8; 32]],
-        )
-        .await?
-        .get::<_, bool>(0));
-    assert_eq!(
-        runtime
-            .query_one(
-                reserve_login_sql,
-                &[&state, &key_id, &nonce, &ciphertext, &expires_at],
-            )
-            .await?
-            .get::<_, i16>(0),
-        0
-    );
-    let (peer, peer_driver) = connect_as(database_url, RUNTIME_ROLE).await?;
-    let (left, right) = tokio::join!(
-        async {
-            runtime
-                .query_opt(
-                    "SELECT * FROM registry_notary_api.\
-                     preauthorization_login_consume_v1($1)",
-                    &[&state],
-                )
-                .await
-        },
-        async {
-            peer.query_opt(
-                "SELECT * FROM registry_notary_api.\
-                 preauthorization_login_consume_v1($1)",
-                &[&state],
-            )
-            .await
-        }
-    );
-    assert_eq!(
-        [left?.is_some(), right?.is_some()]
-            .into_iter()
-            .filter(|consumed| *consumed)
-            .count(),
-        1
-    );
-    assert_eq!(
-        runtime
-            .query_one(
-                reserve_login_sql,
-                &[&state, &key_id, &nonce, &ciphertext, &expires_at],
-            )
-            .await?
-            .get::<_, i16>(0),
-        1
-    );
-    admin
-        .execute(
-            "UPDATE registry_notary_private.preauthorization_login_state SET \
-             created_at = pg_catalog.clock_timestamp() - interval '2 seconds', \
-             expires_at = pg_catalog.clock_timestamp() - interval '1 second' \
-             WHERE state_hash = $1",
-            &[&state],
-        )
-        .await?;
-    assert!(runtime
-        .query_opt(
-            "SELECT * FROM registry_notary_api.preauthorization_login_consume_v1($1)",
-            &[&state],
-        )
-        .await?
-        .is_none());
-
-    admin
-        .execute(
-            "DELETE FROM registry_notary_private.preauthorization_login_state",
-            &[],
-        )
-        .await?;
-    admin
-        .execute(
-            "INSERT INTO registry_notary_private.preauthorization_login_state (\
-             state_hash, credential_configuration_id, key_id, aead_nonce, ciphertext, \
-             created_at, expires_at) SELECT pg_catalog.decode(\
-             pg_catalog.lpad(pg_catalog.to_hex(value), 64, '0'), 'hex'), \
-             'credential-config', $1, $2, $3, pg_catalog.clock_timestamp(), \
-             pg_catalog.clock_timestamp() + interval '5 minutes' \
-             FROM pg_catalog.generate_series(1, 4096) AS value",
-            &[&key_id, &nonce, &ciphertext],
-        )
-        .await?;
-    let capacity_state = vec![0xfe_u8; 32];
-    assert_eq!(
-        runtime
-            .query_one(
-                reserve_login_sql,
-                &[&capacity_state, &key_id, &nonce, &ciphertext, &expires_at],
-            )
-            .await?
-            .get::<_, i16>(0),
-        -1
-    );
-    admin
-        .execute(
-            "UPDATE registry_notary_private.preauthorization_login_state SET \
-             created_at = pg_catalog.clock_timestamp() - interval '2 seconds', \
-             expires_at = pg_catalog.clock_timestamp() - interval '1 second' \
-             WHERE state_hash = pg_catalog.decode(\
-             pg_catalog.lpad(pg_catalog.to_hex(1), 64, '0'), 'hex')",
-            &[],
-        )
-        .await?;
-    assert_eq!(
-        runtime
-            .query_one(
-                reserve_login_sql,
-                &[&capacity_state, &key_id, &nonce, &ciphertext, &expires_at],
-            )
-            .await?
-            .get::<_, i16>(0),
-        1
-    );
-    admin
-        .execute(
-            "DELETE FROM registry_notary_private.preauthorization_login_state",
-            &[],
-        )
-        .await?;
-
-    let competing_key_id = vec![0x8f_u8; 32];
-    let competing_state = vec![0x8d_u8; 32];
-    let competing_jti = vec![0x8e_u8; 32];
-    let competing_pin = vec![0x8c_u8; 32];
-    let (first_generation, second_generation) = tokio::join!(
-        async {
-            runtime
-                .query_one(
-                    reserve_login_sql,
-                    &[&competing_state, &key_id, &nonce, &ciphertext, &expires_at],
-                )
-                .await
-        },
-        async {
-            peer.query_one(
-                "SELECT registry_notary_api.preauthorization_tx_code_reserve_v1(\
-                 $1, $2, $3, 6::smallint, $4)",
-                &[
-                    &competing_jti,
-                    &competing_key_id,
-                    &competing_pin,
-                    &expires_at,
-                ],
-            )
-            .await
-        }
-    );
-    assert_eq!(
-        [first_generation.is_ok(), second_generation.is_ok()]
-            .into_iter()
-            .filter(|accepted| *accepted)
-            .count(),
-        1,
-        "different sensitive-key generations must not create mixed live state"
-    );
-    let live_key_generations: i64 = admin
-        .query_one(
-            "SELECT count(DISTINCT encode(key_id, 'hex')) FROM ( \
-               SELECT key_id FROM registry_notary_private.preauthorization_login_state \
-                WHERE expires_at > pg_catalog.clock_timestamp() \
-               UNION ALL \
-               SELECT key_id FROM registry_notary_private.preauthorization_tx_code \
-                WHERE expires_at > pg_catalog.clock_timestamp() \
-             ) AS live_sensitive_state",
-            &[],
-        )
-        .await?
-        .get(0);
-    assert_eq!(live_key_generations, 1);
-    admin
-        .batch_execute(
-            "UPDATE registry_notary_private.preauthorization_login_state \
-                SET created_at = pg_catalog.clock_timestamp() - interval '2 seconds', \
-                    expires_at = pg_catalog.clock_timestamp() - interval '1 second'; \
-             UPDATE registry_notary_private.preauthorization_tx_code \
-                SET created_at = pg_catalog.clock_timestamp() - interval '2 seconds', \
-                    expires_at = pg_catalog.clock_timestamp() - interval '1 second';",
-        )
-        .await?;
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.preauthorization_tx_code_reserve_v1(\
-             $1, $2, $3, 6::smallint, $4)",
-            &[
-                &competing_jti,
-                &competing_key_id,
-                &competing_pin,
-                &expires_at,
-            ],
-        )
-        .await?
-        .get::<_, bool>(0));
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.preauthorization_key_attest_v1($1)",
-            &[&competing_key_id],
-        )
-        .await?
-        .get::<_, bool>(0));
-    admin
-        .batch_execute(
-            "DELETE FROM registry_notary_private.preauthorization_login_state; \
-             DELETE FROM registry_notary_private.preauthorization_tx_code;",
-        )
-        .await?;
-
-    let jti = vec![0x85_u8; 32];
-    let pin = vec![0x86_u8; 32];
-    let wrong_pin = vec![0x87_u8; 32];
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.preauthorization_tx_code_reserve_v1(\
-             $1, $2, $3, 6::smallint, $4)",
-            &[&jti, &key_id, &pin, &expires_at],
-        )
-        .await?
-        .get::<_, bool>(0));
-    assert!(!runtime
-        .query_one(
-            "SELECT registry_notary_api.preauthorization_tx_code_reserve_v1(\
-             $1, $2, $3, 6::smallint, $4)",
-            &[&jti, &key_id, &pin, &expires_at],
-        )
-        .await?
-        .get::<_, bool>(0));
-    let peek = runtime
-        .query_one(
-            "SELECT key_id, pin_verifier, pin_length FROM \
-             registry_notary_api.preauthorization_tx_code_peek_v1($1)",
-            &[&jti],
-        )
-        .await?;
-    assert_eq!(peek.get::<_, Vec<u8>>("key_id"), key_id);
-    assert_eq!(peek.get::<_, Vec<u8>>("pin_verifier"), pin);
-    assert_eq!(peek.get::<_, i16>("pin_length"), 6);
-    let replay_scope = vec![0x88_u8; 32];
-    assert!(!runtime
-        .query_one(
-            "SELECT registry_notary_api.preauthorization_redeem_v1(\
-             $1, $2, $3, TRUE, $4)",
-            &[&replay_scope, &jti, &expires_at, &wrong_pin],
-        )
-        .await?
-        .get::<_, bool>(0));
-    assert!(runtime
-        .query_opt(
-            "SELECT * FROM registry_notary_api.preauthorization_tx_code_peek_v1($1)",
-            &[&jti],
-        )
-        .await?
-        .is_some());
-    let (left, right) = tokio::join!(
-        async {
-            runtime
-                .query_one(
-                    "SELECT registry_notary_api.preauthorization_redeem_v1(\
-                     $1, $2, $3, TRUE, $4)",
-                    &[&replay_scope, &jti, &expires_at, &pin],
-                )
-                .await
-        },
-        async {
-            peer.query_one(
-                "SELECT registry_notary_api.preauthorization_redeem_v1(\
-                 $1, $2, $3, TRUE, $4)",
-                &[&replay_scope, &jti, &expires_at, &pin],
-            )
-            .await
-        }
-    );
-    assert_eq!(
-        [left?.get::<_, bool>(0), right?.get::<_, bool>(0)]
-            .into_iter()
-            .filter(|redeemed| *redeemed)
-            .count(),
-        1
-    );
-    assert!(runtime
-        .query_opt(
-            "SELECT * FROM registry_notary_api.preauthorization_tx_code_peek_v1($1)",
-            &[&jti],
-        )
-        .await?
-        .is_none());
-    assert!(!runtime
-        .query_one(
-            "SELECT registry_notary_api.preauthorization_redeem_v1(\
-             $1, $2, $3, TRUE, $4)",
-            &[&replay_scope, &jti, &expires_at, &pin],
-        )
-        .await?
-        .get::<_, bool>(0));
-
-    let expired_jti = vec![0x89_u8; 32];
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.preauthorization_tx_code_reserve_v1(\
-             $1, $2, $3, 6::smallint, $4)",
-            &[&expired_jti, &key_id, &pin, &expires_at],
-        )
-        .await?
-        .get::<_, bool>(0));
-    admin
-        .execute(
-            "UPDATE registry_notary_private.preauthorization_tx_code SET \
-             created_at = pg_catalog.clock_timestamp() - interval '2 seconds', \
-             expires_at = pg_catalog.clock_timestamp() - interval '1 second' \
-             WHERE jti_hash = $1",
-            &[&expired_jti],
-        )
-        .await?;
-    assert!(runtime
-        .query_opt(
-            "SELECT * FROM registry_notary_api.preauthorization_tx_code_peek_v1($1)",
-            &[&expired_jti],
-        )
-        .await?
-        .is_none());
-    assert!(!runtime
-        .query_one(
-            "SELECT registry_notary_api.preauthorization_redeem_v1(\
-             $1, $2, $3, TRUE, $4)",
-            &[&replay_scope, &expired_jti, &expires_at, &pin],
-        )
-        .await?
-        .get::<_, bool>(0));
-    assert!(runtime
-        .query_one(
-            "SELECT registry_notary_api.preauthorization_tx_code_reserve_v1(\
-             $1, $2, $3, 6::smallint, $4)",
-            &[&expired_jti, &key_id, &pin, &expires_at],
-        )
-        .await?
-        .get::<_, bool>(0));
-    admin
-        .batch_execute(
-            "DELETE FROM registry_notary_private.preauthorization_login_state; \
-             DELETE FROM registry_notary_private.preauthorization_tx_code;",
-        )
-        .await?;
-    drop(peer);
-    peer_driver.abort();
-    Ok(())
-}
-
-#[tokio::test]
-#[ignore = "requires an installed Notary PostgreSQL state plane"]
-async fn postgres_v1_sensitive_restart_restore_probe() -> Result<(), Box<dyn std::error::Error>> {
-    let mode = std::env::var(SENSITIVE_PROBE_MODE_ENV)?;
-    let probe_pin = std::env::var(SENSITIVE_PROBE_PIN_ENV)?;
-    if probe_pin.len() != 6 || !probe_pin.bytes().all(|value| value.is_ascii_uppercase()) {
-        return Err("restart probe PIN is invalid".into());
-    }
-    let config = PostgresStatePlaneConfig::new(
-        SENSITIVE_DATABASE_URL_ENV,
-        Some(PathBuf::from(std::env::var(DATABASE_CA_ENV)?)),
-        Duration::from_secs(2),
-        Duration::from_secs(2),
-        1,
-    )?;
-    let runtime = Arc::new(NotaryPostgresStatePlaneRuntime::connect(&config).await?);
-    let sensitive = PostgresSensitiveState::activate(
-        Arc::clone(&runtime),
-        &SensitiveStateKeyConfig::new(SENSITIVE_KEY_ENV)?,
-    )
-    .await?;
-    let expires_at = time::OffsetDateTime::now_utc() + time::Duration::minutes(9);
-
-    if mode == "seed" {
-        for phase in ["process", "database", "restore"] {
-            let login = LoginState {
-                pkce_verifier: format!("restart-{phase}-pkce-secret"),
-                nonce: format!("restart-{phase}-login-nonce"),
-                credential_configuration_id: format!("restart-{phase}-config"),
-                representative: None,
-                csrf_token: None,
-            };
-            assert_eq!(
-                sensitive
-                    .reserve_login(&format!("restart-{phase}-opaque-state"), &login, expires_at)
-                    .await?,
-                LoginReserveOutcome::Reserved
-            );
-            assert!(
-                sensitive
-                    .reserve_transaction_code(
-                        &format!("restart-{phase}-jti"),
-                        &probe_pin,
-                        6,
-                        expires_at,
-                    )
-                    .await?
-            );
-            let replay_scope = registry_platform_replay::ReplayScope::new([(
-                "flow",
-                format!("restart-{phase}-spent-preauthorization"),
-            )])?;
-            assert!(
-                sensitive
-                    .redeem(
-                        &replay_scope,
-                        &format!("restart-{phase}-spent-jti"),
-                        expires_at,
-                        None,
-                    )
-                    .await?,
-                "seed must persist a spent no-PIN preauthorization code"
-            );
-        }
-    } else if matches!(mode.as_str(), "process" | "database" | "restore") {
-        let login = sensitive
-            .consume_login(&format!("restart-{mode}-opaque-state"))
-            .await?
-            .ok_or("restart probe login state is unavailable")?;
-        if login.pkce_verifier != format!("restart-{mode}-pkce-secret")
-            || login.nonce != format!("restart-{mode}-login-nonce")
-            || login.credential_configuration_id != format!("restart-{mode}-config")
-        {
-            return Err("restart probe login state did not decrypt exactly".into());
-        }
-        let jti = format!("restart-{mode}-jti");
-        let proof = sensitive
-            .verify_transaction_code(&jti, &probe_pin)
-            .await?
-            .ok_or("restart probe transaction-code verifier is unavailable")?;
-        let scope = registry_platform_replay::ReplayScope::new([("flow", mode.as_str())])?;
-        if !sensitive
-            .redeem(&scope, &jti, expires_at, Some(proof))
-            .await?
-        {
-            return Err("restart probe transaction code was not redeemable".into());
-        }
-        let replay_scope = registry_platform_replay::ReplayScope::new([(
-            "flow",
-            format!("restart-{mode}-spent-preauthorization"),
-        )])?;
-        if sensitive
-            .redeem(
-                &replay_scope,
-                &format!("restart-{mode}-spent-jti"),
-                expires_at,
-                None,
-            )
-            .await?
-        {
-            return Err("restart or restore reopened a spent no-PIN preauthorization code".into());
-        }
-    } else {
-        return Err("restart probe mode is invalid".into());
-    }
-
-    runtime.shutdown();
-    Ok(())
-}
-
-async fn assert_sensitive_adapter_contract(
-    database_url: &str,
-    admin: &Client,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let runtime_url = database_url.replacen("postgres@", &format!("{RUNTIME_ROLE}@"), 1);
-    if runtime_url == database_url {
-        return Err("sensitive adapter URL does not contain the dedicated admin role".into());
-    }
-    let primary_key = URL_SAFE_NO_PAD.encode([0xa1_u8; 32]);
-    let wrong_key = URL_SAFE_NO_PAD.encode([0xb2_u8; 32]);
-    // SAFETY: the conformance harness runs this ignored test by exact name
-    // in an isolated process, so these dedicated variables have no readers.
-    unsafe {
-        std::env::set_var(SENSITIVE_DATABASE_URL_ENV, &runtime_url);
-        std::env::remove_var(SENSITIVE_KEY_ENV);
-    }
-    let config = PostgresStatePlaneConfig::new(
-        SENSITIVE_DATABASE_URL_ENV,
-        Some(PathBuf::from(std::env::var(DATABASE_CA_ENV)?)),
-        Duration::from_secs(2),
-        Duration::from_secs(2),
-        2,
-    )?;
-    let runtime = Arc::new(NotaryPostgresStatePlaneRuntime::connect(&config).await?);
-    let key_config = SensitiveStateKeyConfig::new(SENSITIVE_KEY_ENV)?;
-    let missing_key_error = PostgresSensitiveState::activate(Arc::clone(&runtime), &key_config)
-        .await
-        .expect_err("an absent sensitive-state key must fail activation");
-    assert_eq!(
-        missing_key_error,
-        SensitiveStateError::KeyEnvironmentUnavailable
-    );
-    assert_eq!(
-        missing_key_error.to_string(),
-        "Notary sensitive-state key environment variable is unavailable"
-    );
-    let rendered_error = format!("{missing_key_error:?}");
-    assert!(!rendered_error.contains(SENSITIVE_KEY_ENV));
-    assert!(!rendered_error.contains(&primary_key));
-    assert!(!rendered_error.contains(&wrong_key));
-
-    // SAFETY: this exact-name live test remains isolated from other
-    // environment readers for its entire process lifetime.
-    unsafe { std::env::set_var(SENSITIVE_KEY_ENV, &primary_key) };
-    let sensitive = PostgresSensitiveState::activate(Arc::clone(&runtime), &key_config).await?;
-    let expires_at = time::OffsetDateTime::now_utc() + time::Duration::hours(1);
-    let login = LoginState {
-        pkce_verifier: "adapter-pkce-secret".to_string(),
-        nonce: "adapter-login-nonce".to_string(),
-        credential_configuration_id: "adapter-config".to_string(),
-        representative: None,
-        csrf_token: None,
-    };
-    assert_eq!(
-        sensitive
-            .reserve_login("adapter-opaque-state", &login, expires_at)
-            .await?,
-        LoginReserveOutcome::Reserved
-    );
-    let stored = admin
-        .query_one(
-            "SELECT key_id, ciphertext FROM \
-             registry_notary_private.preauthorization_login_state \
-             WHERE credential_configuration_id = 'adapter-config'",
-            &[],
-        )
-        .await?;
-    let original_key_id: Vec<u8> = stored.get("key_id");
-    let stored_ciphertext: Vec<u8> = stored.get("ciphertext");
-    for secret in [login.pkce_verifier.as_bytes(), login.nonce.as_bytes()] {
-        assert!(
-            !stored_ciphertext
-                .windows(secret.len())
-                .any(|window| window == secret),
-            "sensitive login plaintext must not be stored"
-        );
-    }
-
-    unsafe { std::env::set_var(SENSITIVE_KEY_ENV, &wrong_key) };
-    let wrong_key_error = PostgresSensitiveState::activate(
-        Arc::clone(&runtime),
-        &SensitiveStateKeyConfig::new(SENSITIVE_KEY_ENV)?,
-    )
-    .await
-    .expect_err("a restored wrong key must fail activation");
-    assert_eq!(wrong_key_error, SensitiveStateError::InvalidStoredRecord);
-    let rendered_error = wrong_key_error.to_string();
-    assert!(!rendered_error.contains("adapter-pkce-secret"));
-    assert!(!rendered_error.contains("adapter-login-nonce"));
-    assert!(!rendered_error.contains(&primary_key));
-    assert!(!rendered_error.contains(&wrong_key));
-    let state_config = StateConfig {
-        storage: STATE_STORAGE_POSTGRESQL.to_string(),
-        postgresql: StatePostgresqlConfig {
-            url_env: SENSITIVE_DATABASE_URL_ENV.to_string(),
-            root_certificate_path: Some(PathBuf::from(std::env::var(DATABASE_CA_ENV)?)),
-            connect_timeout_ms: 2_000,
-            operation_timeout_ms: 2_000,
-            max_connections: 1,
-            sensitive_state_key_env: SENSITIVE_KEY_ENV.to_string(),
-        },
-    };
-    assert_eq!(
-        attest_postgres_state_plane_runtime(&state_config, true).await,
-        Err(NotaryPostgresStatePlaneReadiness::ConfigurationInvalid),
-        "the operator attestation boundary must reject the wrong restored key"
-    );
-    unsafe { std::env::set_var(SENSITIVE_KEY_ENV, &primary_key) };
-    assert!(attest_postgres_state_plane_runtime(&state_config, true)
-        .await
-        .is_ok());
-    let readiness_handle = Arc::new(NotaryStatePlaneHandle::from_config(&state_config, true)?);
-    readiness_handle.activate().await?;
-    assert_eq!(
-        readiness_handle.readiness().await,
-        NotaryPostgresStatePlaneReadiness::Ready
-    );
-
-    admin
-        .execute(
-            "UPDATE registry_notary_private.preauthorization_login_state \
-             SET key_id = decode(repeat('ff', 32), 'hex') \
-             WHERE credential_configuration_id = 'adapter-config'",
-            &[],
-        )
-        .await?;
-    assert_eq!(
-        sensitive.attest_key_generation().await,
-        Err(SensitiveStateError::InvalidStoredRecord),
-        "readiness key attestation must fail after live-row key tampering"
-    );
-    assert_eq!(
-        readiness_handle.readiness().await,
-        NotaryPostgresStatePlaneReadiness::ConfigurationInvalid,
-        "every serving readiness probe must re-attest the sensitive key"
-    );
-    admin
-        .execute(
-            "UPDATE registry_notary_private.preauthorization_login_state \
-             SET key_id = $1 WHERE credential_configuration_id = 'adapter-config'",
-            &[&original_key_id],
-        )
-        .await?;
-    sensitive.attest_key_generation().await?;
-    assert_eq!(
-        readiness_handle.readiness().await,
-        NotaryPostgresStatePlaneReadiness::Ready
-    );
-    let consumed = sensitive
-        .consume_login("adapter-opaque-state")
-        .await?
-        .expect("the encrypted login must survive a fresh PostgreSQL session");
-    assert_eq!(consumed.pkce_verifier, login.pkce_verifier);
-    assert_eq!(consumed.nonce, login.nonce);
-    assert_eq!(
-        consumed.credential_configuration_id,
-        login.credential_configuration_id
-    );
-
-    assert_eq!(
-        sensitive
-            .reserve_login("adapter-tampered-state", &login, expires_at)
-            .await?,
-        LoginReserveOutcome::Reserved
-    );
-    admin
-        .execute(
-            "UPDATE registry_notary_private.preauthorization_login_state \
-             SET ciphertext = set_byte(ciphertext, 0, get_byte(ciphertext, 0) # 1) \
-             WHERE credential_configuration_id = 'adapter-config'",
-            &[],
-        )
-        .await?;
-    assert!(
-        matches!(
-            sensitive.consume_login("adapter-tampered-state").await,
-            Err(SensitiveStateError::InvalidStoredRecord)
-        ),
-        "authenticated login ciphertext tampering must fail closed"
-    );
-
-    assert!(
-        sensitive
-            .reserve_transaction_code("adapter-jti", "123456", 6, expires_at)
-            .await?
-    );
-    assert!(sensitive
-        .verify_transaction_code("adapter-jti", "000000")
-        .await?
-        .is_none());
-    let proof = sensitive
-        .verify_transaction_code("adapter-jti", "123456")
-        .await?
-        .expect("the keyed transaction-code verifier must round trip");
-    let scope = registry_platform_replay::ReplayScope::new([("flow", "adapter")])?;
-    assert!(
-        sensitive
-            .redeem(&scope, "adapter-jti", expires_at, Some(proof))
-            .await?
-    );
-
-    let preauthorization_state = Arc::new(PreauthorizationState::from_state_plane(Arc::clone(
-        &readiness_handle,
-    ))?);
-    let mismatch_jti = "adapter-policy-mismatch-jti";
-    assert!(
-        preauthorization_state
-            .reserve_transaction_code(mismatch_jti, "654321", 6, expires_at)
-            .await?
-    );
-    let mismatch_scope =
-        registry_platform_replay::ReplayScope::new([("flow", "adapter-policy-mismatch")])?;
-    assert!(
-        !preauthorization_state
-            .redeem(&mismatch_scope, mismatch_jti, expires_at, false, None)
-            .await?,
-        "a signed no-PIN requirement must reject a contradictory live verifier"
-    );
-    let proof = preauthorization_state
-        .verify_transaction_code(mismatch_jti, "654321")
-        .await?
-        .expect("the rejected policy mismatch must preserve the verifier");
-    assert!(
-        preauthorization_state
-            .redeem(&mismatch_scope, mismatch_jti, expires_at, true, Some(proof),)
-            .await?,
-        "the rejected policy mismatch must not consume the replay claim"
-    );
-    assert!(preauthorization_state
-        .verify_transaction_code(mismatch_jti, "654321")
-        .await?
-        .is_none());
-    assert!(
-        !preauthorization_state
-            .redeem(&mismatch_scope, mismatch_jti, expires_at, false, None)
-            .await?
-    );
-
-    let transaction_id = "adapter-issuance-transaction";
-    let transaction = IssuanceTransaction {
-        transaction_id: transaction_id.to_string(),
-        evaluation_id: "adapter-evaluation".to_string(),
-        evaluation_client_id: "hmac-sha256:adapter-client".to_string(),
-        credential_configuration_id: "adapter-config".to_string(),
-        commitment: format!("sha256:{}", "c".repeat(64)),
-        authority: IssuanceAuthority::SubjectAccess,
-    };
-    preauthorization_state
-        .reserve_issuance_transaction(transaction_id, transaction.clone(), expires_at)
-        .await?;
-    assert_eq!(
-        preauthorization_state
-            .transaction(transaction_id)
-            .await?
-            .expect("encrypted transaction must round trip")
-            .transaction
-            .evaluation_id,
-        transaction.evaluation_id.as_str()
-    );
-    assert!(
-        !preauthorization_state
-            .bind_transaction_nonce(
-                transaction_id,
-                &format!("sha256:{}", "d".repeat(64)),
-                "adapter-token-nonce".to_string(),
-            )
-            .await?,
-        "a mismatched commitment must not bind the token nonce"
-    );
-    assert!(
-        preauthorization_state
-            .bind_transaction_nonce(
-                transaction_id,
-                &transaction.commitment,
-                "adapter-token-nonce".to_string(),
-            )
-            .await?
-    );
-    let acquired = preauthorization_state
-        .begin_credential_materialization(
-            transaction_id,
-            &transaction.commitment,
-            &transaction.credential_configuration_id,
-            "adapter-token-nonce",
-            "adapter-holder-thumbprint",
-            "adapter-request-hash",
-        )
-        .await?;
-    assert!(matches!(acquired, CredentialMaterialization::Acquired(_)));
-    assert!(matches!(
-        preauthorization_state
-            .begin_credential_materialization(
-                transaction_id,
-                &transaction.commitment,
-                &transaction.credential_configuration_id,
-                "adapter-token-nonce",
-                "adapter-holder-thumbprint",
-                "adapter-request-hash",
-            )
-            .await?,
-        CredentialMaterialization::Busy
-    ));
-    assert!(matches!(
-        preauthorization_state
-            .begin_credential_materialization(
-                transaction_id,
-                &transaction.commitment,
-                &transaction.credential_configuration_id,
-                "adapter-token-nonce",
-                "different-holder",
-                "adapter-request-hash",
-            )
-            .await?,
-        CredentialMaterialization::Denied
-    ));
-    let cached_response = serde_json::json!({
-        "format": "dc+sd-jwt",
-        "credential": "adapter-signed-credential",
-    });
-    assert!(
-        preauthorization_state
-            .complete_credential_materialization(
-                transaction_id,
-                "adapter-holder-thumbprint",
-                "adapter-request-hash",
-                cached_response.clone(),
-            )
-            .await?
-    );
-    match preauthorization_state
-        .begin_credential_materialization(
-            transaction_id,
-            &transaction.commitment,
-            &transaction.credential_configuration_id,
-            "adapter-token-nonce",
-            "adapter-holder-thumbprint",
-            "adapter-request-hash",
-        )
-        .await?
-    {
-        CredentialMaterialization::Cached(response) => {
-            assert_eq!(response, cached_response);
-        }
-        _ => panic!("an exact PostgreSQL retry must return the cached response"),
-    }
-    let stored_transaction = admin
-        .query_one(
-            "SELECT record_ciphertext, response_ciphertext FROM \
-             registry_notary_private.oid4vci_issuance_transaction",
-            &[],
-        )
-        .await?;
-    let record_ciphertext: Vec<u8> = stored_transaction.get("record_ciphertext");
-    let response_ciphertext: Vec<u8> = stored_transaction.get("response_ciphertext");
-    for secret in [
-        transaction.evaluation_id.as_bytes(),
-        transaction.evaluation_client_id.as_bytes(),
-        b"adapter-signed-credential".as_slice(),
-    ] {
-        assert!(
-            !record_ciphertext
-                .windows(secret.len())
-                .any(|window| window == secret)
-                && !response_ciphertext
-                    .windows(secret.len())
-                    .any(|window| window == secret),
-            "issuance transaction plaintext must not be stored"
-        );
-    }
-
-    let offer_now = time::OffsetDateTime::now_utc();
-    let offer_transaction = IssuanceTransaction {
-        transaction_id: "adapter-registry-offer-transaction".to_string(),
-        evaluation_id: "adapter-registry-offer-evaluation".to_string(),
-        evaluation_client_id: "adapter-registry-client".to_string(),
-        credential_configuration_id: "adapter-config".to_string(),
-        commitment: format!("sha256:{}", "e".repeat(64)),
-        authority: IssuanceAuthority::RegistryClient {
-            initiating_client_id: "adapter-registry-client".to_string(),
-            initiating_client_id_hash: format!("hmac-sha256:{}", "f".repeat(64)),
-            auth_profile_id: registry_notary_core::EvidenceAuthProfileId::ExternalOidc,
-            authorized_scopes: vec!["registry:evidence".to_string()],
-            target_ref: registry_notary_core::TargetRefView {
-                entity_type: "Person".to_string(),
-                handle: "adapter-target-handle".to_string(),
-                identifier_schemes: Vec::new(),
-                profile: None,
-            },
-            service_id: "adapter.notary".to_string(),
-            purpose: "civil-registration".to_string(),
-        },
-    };
-    let offer_response = RegistryClientOfferResponse {
-        credential_offer_uri: "openid-credential-offer://adapter-secret-offer".to_string(),
-        tx_code: Some("246810".to_string()),
-        expires_at: "2030-01-01T00:00:00Z".to_string(),
-    };
-    let offer_reservation = |idempotency: char, request: char, transaction: IssuanceTransaction| {
-        RegistryClientOfferReservation {
-            transaction_id: transaction.transaction_id.clone(),
-            evaluation_id: transaction.evaluation_id.clone(),
-            evaluation_expires_at: offer_now + time::Duration::minutes(20),
-            idempotency_key_hash: format!("hmac-sha256:{}", idempotency.to_string().repeat(64)),
-            canonical_request_hash: format!("sha256:{}", request.to_string().repeat(64)),
-            transaction,
-            transaction_code: Some(RegistryClientTransactionCode {
-                pin: "246810".to_string(),
-                pin_length: 6,
-            }),
-            code_expires_at: offer_now + time::Duration::minutes(5),
-            transaction_expires_at: offer_now + time::Duration::minutes(15),
-            response: offer_response.clone(),
-            retention_expires_at: offer_now + time::Duration::minutes(10),
-            quota_principal_hash: vec![0x71; 32],
-            quota_limit: None,
-            quota_cost: 1,
-        }
-    };
-    let before_preflight_rows: i64 = admin
-        .query_one(
-            "SELECT (SELECT count(*) FROM registry_notary_private.registry_client_offer) + \
-                    (SELECT count(*) FROM registry_notary_private.issuance_evaluation_consumption)",
-            &[],
-        )
-        .await?
-        .get(0);
-    assert!(matches!(
-        preauthorization_state
-            .registry_client_offer_preflight(
-                "adapter-registry-offer-evaluation",
-                "adapter-registry-client",
-                &format!("hmac-sha256:{}", "1".repeat(64)),
-                &format!("sha256:{}", "a".repeat(64)),
-            )
-            .await?,
-        RegistryClientOfferPreflightOutcome::Available
-    ));
-    let after_preflight_rows: i64 = admin
-        .query_one(
-            "SELECT (SELECT count(*) FROM registry_notary_private.registry_client_offer) + \
-                    (SELECT count(*) FROM registry_notary_private.issuance_evaluation_consumption)",
-            &[],
-        )
-        .await?
-        .get(0);
-    assert_eq!(
-        after_preflight_rows, before_preflight_rows,
-        "PostgreSQL preflight must not mutate offer or evaluation state",
-    );
-    assert_eq!(
-        preauthorization_state
-            .reserve_registry_client_offer(offer_reservation('1', 'a', offer_transaction.clone(),))
-            .await?,
-        RegistryClientOfferReservationOutcome::Created(offer_response.clone())
-    );
-    assert_eq!(
-        preauthorization_state
-            .registry_client_offer_preflight(
-                "adapter-registry-offer-evaluation",
-                "adapter-registry-client",
-                &format!("hmac-sha256:{}", "1".repeat(64)),
-                &format!("sha256:{}", "a".repeat(64)),
-            )
-            .await?,
-        RegistryClientOfferPreflightOutcome::Replayed(offer_response.clone())
-    );
-    assert!(matches!(
-        preauthorization_state
-            .registry_client_offer_preflight(
-                "adapter-registry-offer-evaluation",
-                "adapter-registry-client",
-                &format!("hmac-sha256:{}", "1".repeat(64)),
-                &format!("sha256:{}", "b".repeat(64)),
-            )
-            .await?,
-        RegistryClientOfferPreflightOutcome::IdempotencyConflict
-    ));
-    assert!(matches!(
-        preauthorization_state
-            .registry_client_offer_preflight(
-                "adapter-registry-offer-evaluation",
-                "adapter-registry-client",
-                &format!("hmac-sha256:{}", "2".repeat(64)),
-                &format!("sha256:{}", "a".repeat(64)),
-            )
-            .await?,
-        RegistryClientOfferPreflightOutcome::EvaluationConsumed
-    ));
-    assert_eq!(
-        preauthorization_state
-            .reserve_registry_client_offer(offer_reservation('1', 'a', offer_transaction.clone(),))
-            .await?,
-        RegistryClientOfferReservationOutcome::Replayed(offer_response.clone())
-    );
-    assert!(matches!(
-        preauthorization_state
-            .reserve_registry_client_offer(offer_reservation('1', 'b', offer_transaction.clone(),))
-            .await,
-        Err(PreauthorizationStateError::IdempotencyConflict)
-    ));
-    let mut other_transaction = offer_transaction.clone();
-    other_transaction.transaction_id = "adapter-other-offer-transaction".to_string();
-    assert!(matches!(
-        preauthorization_state
-            .reserve_registry_client_offer(offer_reservation('2', 'a', other_transaction,))
-            .await,
-        Err(PreauthorizationStateError::EvaluationConsumed)
-    ));
-    assert!(matches!(
-        preauthorization_state
-            .reserve_evaluation_issuance(
-                "adapter-registry-offer-evaluation",
-                "adapter-registry-client",
-                offer_now + time::Duration::minutes(20),
-            )
-            .await,
-        Err(PreauthorizationStateError::EvaluationConsumed)
-    ));
-    preauthorization_state
-        .reserve_evaluation_issuance(
-            "adapter-direct-first-evaluation",
-            "adapter-registry-client",
-            offer_now + time::Duration::minutes(20),
-        )
-        .await?;
-    let mut direct_first_offer = offer_transaction.clone();
-    direct_first_offer.transaction_id = "adapter-direct-first-offer".to_string();
-    direct_first_offer.evaluation_id = "adapter-direct-first-evaluation".to_string();
-    assert!(matches!(
-        preauthorization_state
-            .reserve_registry_client_offer(offer_reservation('3', 'a', direct_first_offer,))
-            .await,
-        Err(PreauthorizationStateError::EvaluationConsumed)
-    ));
-
-    let race_barrier = Arc::new(tokio::sync::Barrier::new(3));
-    let direct_state = Arc::clone(&preauthorization_state);
-    let direct_barrier = Arc::clone(&race_barrier);
-    let direct_race = tokio::spawn(async move {
-        direct_barrier.wait().await;
-        direct_state
-            .reserve_evaluation_issuance(
-                "adapter-raced-evaluation",
-                "adapter-registry-client",
-                offer_now + time::Duration::minutes(20),
-            )
-            .await
-            .map(|()| "direct")
-    });
-    let mut raced_transaction = offer_transaction.clone();
-    raced_transaction.transaction_id = "adapter-raced-offer".to_string();
-    raced_transaction.evaluation_id = "adapter-raced-evaluation".to_string();
-    let raced_offer = offer_reservation('6', 'a', raced_transaction);
-    let offer_state = Arc::clone(&preauthorization_state);
-    let offer_barrier = Arc::clone(&race_barrier);
-    let offer_race = tokio::spawn(async move {
-        offer_barrier.wait().await;
-        offer_state
-            .reserve_registry_client_offer(raced_offer)
-            .await
-            .map(|_| "offer")
-    });
-    race_barrier.wait().await;
-    let race_outcomes = [direct_race.await?, offer_race.await?];
-    assert_eq!(
-        race_outcomes
-            .iter()
-            .filter(|outcome| outcome.is_ok())
-            .count(),
-        1
-    );
-    assert_eq!(
-        race_outcomes
-            .iter()
-            .filter(|outcome| matches!(
-                outcome,
-                Err(PreauthorizationStateError::EvaluationConsumed)
-            ))
-            .count(),
-        1
-    );
-
-    let mut quota_transaction = offer_transaction.clone();
-    quota_transaction.transaction_id = "adapter-quota-offer-one".to_string();
-    quota_transaction.evaluation_id = "adapter-quota-evaluation-one".to_string();
-    let mut quota_offer = offer_reservation('4', 'a', quota_transaction.clone());
-    quota_offer.quota_principal_hash = vec![0xd1; 32];
-    quota_offer.quota_limit = Some(1);
-    assert!(matches!(
-        preauthorization_state
-            .reserve_registry_client_offer(quota_offer)
-            .await?,
-        RegistryClientOfferReservationOutcome::Created(_)
-    ));
-    let mut quota_replay = offer_reservation('4', 'a', quota_transaction);
-    quota_replay.quota_principal_hash = vec![0xd1; 32];
-    quota_replay.quota_limit = Some(1);
-    assert!(matches!(
-        preauthorization_state
-            .reserve_registry_client_offer(quota_replay)
-            .await?,
-        RegistryClientOfferReservationOutcome::Replayed(_)
-    ));
-    let mut quota_denied_transaction = offer_transaction.clone();
-    quota_denied_transaction.transaction_id = "adapter-quota-offer-two".to_string();
-    quota_denied_transaction.evaluation_id = "adapter-quota-evaluation-two".to_string();
-    let mut quota_denied = offer_reservation('5', 'a', quota_denied_transaction);
-    quota_denied.quota_principal_hash = vec![0xd1; 32];
-    quota_denied.quota_limit = Some(1);
-    assert!(matches!(
-        preauthorization_state
-            .reserve_registry_client_offer(quota_denied)
-            .await,
-        Err(PreauthorizationStateError::MachineQuotaExceeded {
-            retry_after_seconds: 1..=60
-        })
-    ));
-
-    let quota_limiter = MachineQuotaLimiter::with_state_plane(
-        registry_notary_core::MachineQuotaConfig {
-            enabled: false,
-            subjects_per_minute: 1,
-        },
-        Arc::clone(&readiness_handle),
-        registry_platform_audit::AuditKeyHasher::unkeyed_dev_only(),
-    );
-    let fenced_request_hash = format!("sha256:{}", "d".repeat(64));
-    let fenced_operation_id = format!("hmac-sha256:{}", "8".repeat(64));
-    let fenced_expires_at = offer_now + time::Duration::minutes(20);
-    let stale_fence = match quota_limiter
-        .check_and_consume_once(
-            "adapter-registry-client",
-            1,
-            &fenced_operation_id,
-            &fenced_request_hash,
-            "adapter-fenced-owner-a",
-            fenced_expires_at,
-        )
-        .await
-        .expect("initial fenced operation succeeds")
-    {
-        MachineQuotaOperationOutcome::Acquired(fence) => fence,
-        outcome => panic!("expected initial fenced owner, got {outcome:?}"),
-    };
-    quota_limiter
-        .release_operation(
-            "adapter-registry-client",
-            &fenced_operation_id,
-            "adapter-fenced-owner-a",
-        )
-        .await
-        .expect("fenced owner release succeeds");
-    let current_fence = match quota_limiter
-        .check_and_consume_once(
-            "adapter-registry-client",
-            1,
-            &fenced_operation_id,
-            &fenced_request_hash,
-            "adapter-fenced-owner-b",
-            fenced_expires_at,
-        )
-        .await
-        .expect("fenced takeover succeeds")
-    {
-        MachineQuotaOperationOutcome::Acquired(fence) => fence,
-        outcome => panic!("expected takeover owner, got {outcome:?}"),
-    };
-    let mut fenced_transaction = offer_transaction.clone();
-    fenced_transaction.transaction_id = "adapter-fenced-offer".to_string();
-    fenced_transaction.evaluation_id = "adapter-fenced-evaluation".to_string();
-    let mut stale_reservation = offer_reservation('8', 'd', fenced_transaction.clone());
-    stale_reservation.quota_principal_hash = stale_fence.principal_hash().to_vec();
-    assert!(matches!(
-        preauthorization_state
-            .reserve_registry_client_offer_fenced(stale_reservation, &stale_fence)
-            .await,
-        Err(PreauthorizationStateError::OperationLeaseLost)
-    ));
-    let mut current_reservation = offer_reservation('8', 'd', fenced_transaction);
-    current_reservation.quota_principal_hash = current_fence.principal_hash().to_vec();
-    assert!(matches!(
-        preauthorization_state
-            .reserve_registry_client_offer_fenced(current_reservation, &current_fence)
-            .await?,
-        RegistryClientOfferReservationOutcome::Created(_)
-    ));
-
-    preauthorization_state
-        .reserve_evaluation_issuance(
-            "adapter-quota-evaluation-two",
-            "adapter-registry-client",
-            offer_now + time::Duration::minutes(20),
-        )
-        .await?;
-    assert!(preauthorization_state
-        .verify_transaction_code("adapter-registry-offer-transaction", "246810")
-        .await?
-        .is_some());
-    let stored_offers = admin
-        .query(
-            "SELECT offer.response_ciphertext, transaction.record_ciphertext \
-               FROM registry_notary_private.registry_client_offer AS offer \
-               JOIN registry_notary_private.oid4vci_issuance_transaction AS transaction \
-                 ON transaction.transaction_hash = offer.transaction_hash",
-            &[],
-        )
-        .await?;
-    assert!(
-        !stored_offers.is_empty(),
-        "registry-client offer ciphertext must be persisted"
-    );
-    for stored_offer in stored_offers {
-        let offer_ciphertext: Vec<u8> = stored_offer.get(0);
-        let transaction_ciphertext: Vec<u8> = stored_offer.get(1);
-        for secret in [
-            b"openid-credential-offer://adapter-secret-offer".as_slice(),
-            b"246810".as_slice(),
-            b"adapter-registry-client".as_slice(),
-            b"adapter-target-handle".as_slice(),
-        ] {
-            assert!(
-                !offer_ciphertext
-                    .windows(secret.len())
-                    .any(|window| window == secret)
-                    && !transaction_ciphertext
-                        .windows(secret.len())
-                        .any(|window| window == secret),
-                "registry-client offer plaintext must not be stored"
-            );
-        }
-    }
-
-    admin
-        .batch_execute(
-            "DELETE FROM registry_notary_private.preauthorization_login_state; \
-             DELETE FROM registry_notary_private.preauthorization_tx_code; \
-             DELETE FROM registry_notary_private.oid4vci_issuance_transaction; \
-             DELETE FROM registry_notary_private.issuance_evaluation_consumption; \
-             DELETE FROM registry_notary_private.registry_client_offer;",
-        )
-        .await?;
-
-    let rotation_scope =
-        registry_platform_replay::ReplayScope::new([("flow", "adapter-sensitive-key-rotation")])?;
-    let rotation_jti = "adapter-sensitive-key-rotation-jti";
-    assert!(
-        sensitive
-            .redeem(&rotation_scope, rotation_jti, expires_at, None)
-            .await?,
-        "the first no-PIN redemption must claim its replay identity"
-    );
-    // No live encrypted or PIN-verifier row remains, so rotating the
-    // sensitive-state key is allowed. The replay decision must still be
-    // found through its stable Notary replay hashes.
-    unsafe { std::env::set_var(SENSITIVE_KEY_ENV, &wrong_key) };
-    let rotated_sensitive =
-        PostgresSensitiveState::activate(Arc::clone(&runtime), &key_config).await?;
-    assert!(
-        !rotated_sensitive
-            .redeem(&rotation_scope, rotation_jti, expires_at, None)
-            .await?,
-        "sensitive-key rotation must not reopen a redeemed no-PIN code"
-    );
-    unsafe { std::env::set_var(SENSITIVE_KEY_ENV, &primary_key) };
-    runtime.shutdown();
-    unsafe {
-        std::env::remove_var(SENSITIVE_DATABASE_URL_ENV);
-        std::env::remove_var(SENSITIVE_KEY_ENV);
-    }
-    Ok(())
-}
-
-async fn assert_retention_contract(
-    runtime: &Client,
-    admin: &Client,
-) -> Result<(), Box<dyn std::error::Error>> {
-    admin
-        .batch_execute(
-            "TRUNCATE registry_notary_private.replay_identifier,
-                      registry_notary_private.consumable_nonce,
-                      registry_notary_private.evaluation,
-                      registry_notary_private.batch_idempotency,
-                      registry_notary_private.credential_status,
-                      registry_notary_private.machine_quota,
-                      registry_notary_private.machine_quota_operation,
-                      registry_notary_private.subject_access_quota,
-                      registry_notary_private.preauthorization_login_state,
-                      registry_notary_private.preauthorization_tx_code,
-                      registry_notary_private.oid4vci_issuance_transaction,
-                      registry_notary_private.issuance_evaluation_consumption,
-                      registry_notary_private.registry_client_offer;
-             INSERT INTO registry_notary_private.replay_identifier
-                (scope_hash, identifier_hash, created_at, expires_at)
-             SELECT decode(repeat('90', 32), 'hex'), decode(repeat(marker, 32), 'hex'),
-                    clock_timestamp() - interval '2 seconds',
-                    clock_timestamp() + lifetime
-               FROM (VALUES ('91', interval '-1 second'),
-                            ('92', interval '5 minutes')) AS rows(marker, lifetime);
-             INSERT INTO registry_notary_private.consumable_nonce
-                (scope_hash, nonce_hash, generation, state, reservation_expires_at,
-                 tombstone_expires_at, created_at, updated_at)
-             SELECT decode(repeat('93', 32), 'hex'), decode(repeat(marker, 32), 'hex'),
-                    1, 'reserved', clock_timestamp() + lifetime, NULL,
-                    clock_timestamp() - interval '2 seconds', clock_timestamp()
-               FROM (VALUES ('94', interval '-1 second'),
-                            ('95', interval '5 minutes')) AS rows(marker, lifetime);
-             INSERT INTO registry_notary_private.evaluation
-                (evaluation_id, client_id_hash, request_hash, purpose, record_version,
-                 record_json, created_at, expires_at)
-             SELECT 'retention-evaluation-' || label, decode(repeat(hex_marker, 32), 'hex'),
-                    decode(repeat('96', 32), 'hex'), 'retention', 2, '{}'::jsonb,
-                    clock_timestamp() - interval '2 seconds', clock_timestamp() + lifetime
-               FROM (VALUES ('expired', '97', interval '-1 second'),
-                            ('live', '98', interval '5 minutes'))
-                    AS rows(label, hex_marker, lifetime);
-             INSERT INTO registry_notary_private.batch_idempotency
-                (key_hash, request_hash, principal_hash, state, owner_token,
-                 lease_expires_at, quota_charged, created_at, updated_at,
-                 retention_expires_at)
-             SELECT decode(repeat(marker, 32), 'hex'), decode(repeat('99', 32), 'hex'),
-                    decode(repeat('9a', 32), 'hex'), 'failed', NULL, NULL, FALSE,
-                    clock_timestamp() - interval '2 seconds', clock_timestamp(),
-                    clock_timestamp() + lifetime
-               FROM (VALUES ('9b', interval '-1 second'),
-                            ('9c', interval '5 minutes')) AS rows(marker, lifetime);
-             INSERT INTO registry_notary_private.credential_status
-                (credential_id, issuer, profile, status, issued_at,
-                 credential_expires_at, updated_at, purge_after)
-             SELECT 'retention-credential-' || marker, 'issuer', 'profile', 'valid',
-                    clock_timestamp() - interval '3 hours',
-                    clock_timestamp() - interval '2 hours',
-                    clock_timestamp() - interval '2 hours', clock_timestamp() + lifetime
-               FROM (VALUES ('expired', interval '-1 second'),
-                            ('live', interval '5 minutes')) AS rows(marker, lifetime);
-             INSERT INTO registry_notary_private.machine_quota
-                (principal_hash, window_started_at, window_expires_at, used)
-             SELECT decode(repeat(marker, 32), 'hex'),
-                    clock_timestamp() - interval '2 minutes', clock_timestamp() + lifetime, 1
-               FROM (VALUES ('9d', interval '-1 second'),
-                            ('9e', interval '5 minutes')) AS rows(marker, lifetime);
-             INSERT INTO registry_notary_private.machine_quota_operation
-                (principal_hash, operation_hash, request_hash, lease_owner_hash,
-                 lease_expires_at, created_at, expires_at)
-             SELECT decode(repeat(principal_marker, 32), 'hex'),
-                    decode(repeat(operation_marker, 32), 'hex'),
-                    decode(repeat(request_marker, 32), 'hex'),
-                    decode(repeat(owner_marker, 32), 'hex'),
-                    clock_timestamp() + lifetime,
-                    clock_timestamp() - interval '2 seconds',
-                    clock_timestamp() + lifetime
-               FROM (VALUES
-                    ('d0', 'd1', 'd2', 'd3', interval '-1 second'),
-                    ('d4', 'd5', 'd6', 'd7', interval '5 minutes'))
-                    AS rows(principal_marker, operation_marker, request_marker,
-                            owner_marker, lifetime);
-             INSERT INTO registry_notary_private.subject_access_quota
-                (bucket_kind, key_hash, window_started_at, window_expires_at, used)
-             SELECT 'per_principal', decode(repeat(marker, 32), 'hex'),
-                    clock_timestamp() - interval '2 minutes', clock_timestamp() + lifetime, 1
-               FROM (VALUES ('9f', interval '-1 second'),
-                            ('a0', interval '5 minutes')) AS rows(marker, lifetime);
-             INSERT INTO registry_notary_private.preauthorization_login_state
-                (state_hash, credential_configuration_id, key_id, aead_nonce,
-                 ciphertext, created_at, expires_at)
-             SELECT decode(repeat(marker, 32), 'hex'), 'retention',
-                    decode(repeat('a1', 32), 'hex'), decode(repeat('a2', 12), 'hex'),
-                    decode(repeat('a3', 17), 'hex'), clock_timestamp() - interval '2 seconds',
-                    clock_timestamp() + lifetime
-               FROM (VALUES ('a4', interval '-1 second'),
-                            ('a5', interval '5 minutes')) AS rows(marker, lifetime);
-             INSERT INTO registry_notary_private.preauthorization_tx_code
-                (jti_hash, key_id, pin_verifier, pin_length, created_at, expires_at)
-             SELECT decode(repeat(marker, 32), 'hex'), decode(repeat('a6', 32), 'hex'),
-                    decode(repeat('a7', 32), 'hex'), 6,
-                    clock_timestamp() - interval '2 seconds', clock_timestamp() + lifetime
-               FROM (VALUES ('a8', interval '-1 second'),
-                            ('a9', interval '5 minutes')) AS rows(marker, lifetime);
-             INSERT INTO registry_notary_private.oid4vci_issuance_transaction
-                (transaction_hash, key_id, credential_configuration_id, commitment,
-                 record_aead_nonce, record_ciphertext, state, created_at, updated_at,
-                 expires_at)
-             SELECT decode(repeat(marker, 32), 'hex'), decode(repeat('b2', 32), 'hex'),
-                    'retention', 'sha256:' || repeat('c', 64),
-                    decode(repeat('b3', 12), 'hex'),
-                    decode(repeat('b4', 17), 'hex'), 'ready',
-                    clock_timestamp() - interval '2 seconds', clock_timestamp(),
-                    clock_timestamp() + lifetime
-               FROM (VALUES ('b0', interval '-1 second'),
-                            ('b1', interval '5 minutes')) AS rows(marker, lifetime);
-             INSERT INTO registry_notary_private.issuance_evaluation_consumption
-                (evaluation_hash, key_id, created_at, expires_at)
-             SELECT decode(repeat(marker, 32), 'hex'),
-                    decode(repeat('c8', 32), 'hex'),
-                    clock_timestamp() - interval '2 seconds',
-                    clock_timestamp() + lifetime
-               FROM (VALUES ('cc', interval '-1 second'),
-                            ('cd', interval '5 minutes')) AS rows(marker, lifetime);
-             INSERT INTO registry_notary_private.registry_client_offer
-                (idempotency_key_hash, request_hash, evaluation_hash,
-                 transaction_hash, key_id, response_aead_nonce,
-                 response_ciphertext, retention_expires_at,
-                 evaluation_expires_at, purge_after, created_at)
-             SELECT decode(repeat(marker, 32), 'hex'),
-                    decode(repeat(request_marker, 32), 'hex'),
-                    decode(repeat(evaluation_marker, 32), 'hex'),
-                    decode(repeat(transaction_marker, 32), 'hex'),
-                    decode(repeat('c9', 32), 'hex'),
-                    decode(repeat('ca', 12), 'hex'),
-                    decode(repeat('cb', 17), 'hex'),
-                    pg_catalog.statement_timestamp() + lifetime,
-                    pg_catalog.statement_timestamp() + lifetime,
-                    pg_catalog.statement_timestamp() + lifetime,
-                    clock_timestamp() - interval '2 seconds'
-               FROM (VALUES
-                    ('c0', 'c1', 'c2', 'c3', interval '-1 second'),
-                    ('c4', 'c5', 'c6', 'c7', interval '5 minutes'))
-                    AS rows(marker, request_marker, evaluation_marker,
-                            transaction_marker, lifetime);",
-        )
-        .await?;
-    let prune = runtime
-        .query_one(
-            "SELECT deleted_count, batch_saturated \
-               FROM registry_notary_api.retention_prune_v1(1000)",
-            &[],
-        )
-        .await?;
-    let pruned: i64 = prune.get("deleted_count");
-    assert_eq!(
-        pruned, 13,
-        "each typed state table must prune its expired row"
-    );
-    assert!(
-        !prune.get::<_, bool>("batch_saturated"),
-        "a short per-table pass must report that catch-up is complete"
-    );
-    let remaining: i64 = admin
-        .query_one(
-            "SELECT
-                (SELECT count(*) FROM registry_notary_private.replay_identifier) +
-                (SELECT count(*) FROM registry_notary_private.consumable_nonce) +
-                (SELECT count(*) FROM registry_notary_private.evaluation) +
-                (SELECT count(*) FROM registry_notary_private.batch_idempotency) +
-                (SELECT count(*) FROM registry_notary_private.credential_status) +
-                (SELECT count(*) FROM registry_notary_private.machine_quota) +
-                (SELECT count(*) FROM registry_notary_private.machine_quota_operation) +
-                (SELECT count(*) FROM registry_notary_private.subject_access_quota) +
-                (SELECT count(*) FROM registry_notary_private.preauthorization_login_state) +
-                (SELECT count(*) FROM registry_notary_private.preauthorization_tx_code) +
-                (SELECT count(*) FROM registry_notary_private.oid4vci_issuance_transaction) +
-                (SELECT count(*) FROM registry_notary_private.issuance_evaluation_consumption) +
-                (SELECT count(*) FROM registry_notary_private.registry_client_offer)",
-            &[],
-        )
-        .await?
-        .get(0);
-    assert_eq!(remaining, 13, "retention must preserve every live row");
-
-    admin
-        .batch_execute(
-            "INSERT INTO registry_notary_private.evaluation
-                (evaluation_id, client_id_hash, request_hash, purpose, record_version,
-                 record_json, created_at, expires_at)
-             SELECT 'retention-backlog-' || sequence,
-                    decode(repeat('aa', 32), 'hex'),
-                    decode(repeat('ab', 32), 'hex'),
-                    'retention-backlog', 2, '{}'::jsonb,
-                    clock_timestamp() - interval '2 minutes',
-                    clock_timestamp() - interval '1 minute'
-               FROM pg_catalog.generate_series(1, 1001) AS sequence;",
-        )
-        .await?;
-    let saturated = runtime
-        .query_one(
-            "SELECT deleted_count, batch_saturated \
-               FROM registry_notary_api.retention_prune_v1(1000)",
-            &[],
-        )
-        .await?;
-    assert_eq!(saturated.get::<_, i64>("deleted_count"), 1_000);
-    assert!(
-        saturated.get::<_, bool>("batch_saturated"),
-        "a full batch from any one table must request another transaction"
-    );
-    let caught_up = runtime
-        .query_one(
-            "SELECT deleted_count, batch_saturated \
-               FROM registry_notary_api.retention_prune_v1(1000)",
-            &[],
-        )
-        .await?;
-    assert_eq!(caught_up.get::<_, i64>("deleted_count"), 1);
-    assert!(
-        !caught_up.get::<_, bool>("batch_saturated"),
-        "the short follow-up batch must terminate catch-up"
-    );
-    let expired_backlog: i64 = admin
-        .query_one(
-            "SELECT count(*) FROM registry_notary_private.evaluation \
-              WHERE expires_at <= clock_timestamp()",
-            &[],
-        )
-        .await?
-        .get(0);
-    assert_eq!(
-        expired_backlog, 0,
-        "catch-up must drain the expired backlog"
-    );
-    Ok(())
-}
-
-async fn subject_access_quota_decision(
-    client: &Client,
-    statement: &'static str,
-    bucket_kinds: &[String],
-    key_hashes: &[Vec<u8>],
-    limits: &[i32],
-    window_seconds: &[i32],
-) -> Result<(bool, Option<String>), tokio_postgres::Error> {
-    let row = client
-        .query_one(
-            statement,
-            &[&bucket_kinds, &key_hashes, &limits, &window_seconds],
-        )
-        .await?;
-    Ok((row.try_get("allowed")?, row.try_get("denied_bucket")?))
-}
-
-async fn connect_as(
-    database_url: &str,
-    role: &str,
-) -> Result<
-    (
-        Client,
-        tokio::task::JoinHandle<Result<(), tokio_postgres::Error>>,
-    ),
-    Box<dyn std::error::Error>,
-> {
-    let mut config: tokio_postgres::Config = database_url.parse()?;
-    config.user(role);
-    if config.get_ssl_mode() == tokio_postgres::config::SslMode::Disable {
-        let (client, connection) = config.connect(tokio_postgres::NoTls).await?;
-        return Ok((client, tokio::spawn(connection)));
-    }
-    let ca_path = std::env::var(DATABASE_CA_ENV)?;
-    let ca_pem = std::fs::read(ca_path)?;
-    let ca = native_tls::Certificate::from_pem(&ca_pem)?;
-    let mut tls = native_tls::TlsConnector::builder();
-    tls.add_root_certificate(ca);
-    let tls = postgres_native_tls::MakeTlsConnector::new(tls.build()?);
-    let (client, connection) = config.connect(tls).await?;
-    Ok((client, tokio::spawn(connection)))
-}
diff --git a/crates/registry-notary-server/src/state_plane/mod.rs b/crates/registry-notary-server/src/state_plane/mod.rs
deleted file mode 100644
index 02cfbb02d..000000000
--- a/crates/registry-notary-server/src/state_plane/mod.rs
+++ /dev/null
@@ -1,30 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Notary-owned PostgreSQL correctness state.
-//!
-//! This module deliberately exposes only the installation and attestation
-//! contract needed by the `registry-notary` operator CLI. Runtime domain
-//! queries remain private to the server crate when they are integrated.
-
-mod handle;
-mod migration;
-mod runtime;
-mod sensitive;
-
-pub use handle::attest_postgres_state_plane_runtime;
-pub(crate) use handle::NotaryStatePlaneHandle;
-pub(crate) use sensitive::{
-    IssuanceReserveOutcome, LoginReserveOutcome, PostgresSensitiveState, SensitiveStateKeyConfig,
-    SensitiveStateKeys,
-};
-
-pub use migration::{
-    attest_postgres_state_plane_v1, install_postgres_state_plane_v1, OwnerDatabaseRole,
-    PostgresStatePlaneAttestation, RuntimeDatabaseRole, StatePlaneMigrationError,
-    POSTGRES_STATE_PLANE_MIGRATION_V1, STATE_PLANE_CAPABILITY_V1,
-    STATE_PLANE_SCHEMA_FINGERPRINT_V1, STATE_PLANE_SCHEMA_VERSION_V1,
-};
-pub use runtime::{
-    NotaryPostgresOperatorConnection, NotaryPostgresStatePlaneError,
-    NotaryPostgresStatePlaneReadiness, NotaryPostgresStatePlaneRuntime, PostgresStatePlaneConfig,
-};
-pub use sensitive::SensitiveStateError;
diff --git a/crates/registry-notary-server/src/state_plane/runtime.rs b/crates/registry-notary-server/src/state_plane/runtime.rs
deleted file mode 100644
index 4e512effa..000000000
--- a/crates/registry-notary-server/src/state_plane/runtime.rs
+++ /dev/null
@@ -1,1486 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Bounded PostgreSQL connection and session lifecycle for Notary state.
-//!
-//! Schema installation and domain transactions live in sibling modules. This
-//! module owns only TLS-required connection setup, runtime attestation, bounded
-//! execution, reconnectable sessions, and driver shutdown.
-
-use std::{
-    collections::HashMap,
-    env,
-    error::Error as StdError,
-    fmt,
-    fs::File,
-    future::Future,
-    io::{self, Read},
-    path::{Path, PathBuf},
-    sync::{
-        atomic::{AtomicBool, AtomicU64, Ordering},
-        Arc, Mutex,
-    },
-    time::Duration,
-};
-
-use deadpool::managed::{Manager, Metrics, Object, Pool, PoolError, RecycleError, RecycleResult};
-use hmac::{Hmac, KeyInit, Mac};
-use native_tls::TlsConnector;
-use postgres_native_tls::MakeTlsConnector;
-use registry_notary_core::{StatePostgresqlConfig, STATE_POSTGRESQL_MAX_CONNECTIONS};
-use sha2::Sha256;
-use subtle::ConstantTimeEq;
-use thiserror::Error;
-use tokio::sync::watch;
-use tokio::task::{AbortHandle, JoinHandle};
-use tokio::time::MissedTickBehavior;
-use tokio_postgres::{
-    config::{SslMode, TargetSessionAttrs},
-    error::SqlState,
-    Client, Config as TokioPostgresConfig,
-};
-use zeroize::Zeroizing;
-
-use super::{
-    attest_postgres_state_plane_v1, PostgresStatePlaneAttestation, StatePlaneMigrationError,
-};
-
-const MAX_ROOT_CERTIFICATE_PATH_BYTES: usize = 4 * 1024;
-const MAX_ROOT_CERTIFICATE_BYTES: usize = 64 * 1024;
-/// Each serving replica prunes at most this many expired rows per state table
-/// per pass. The fixed database function rejects larger batches.
-const RETENTION_MAINTENANCE_BATCH_SIZE: i32 = 1_000;
-/// `retention_prune_v1` independently bounds one delete group per private
-/// state table. Keep this synchronized with that fixed SQL contract.
-const RETENTION_PRUNE_GROUP_COUNT: i64 = 13;
-/// Cleanup is deliberately less frequent than request-path state operations;
-/// expiry checks remain authoritative even between maintenance passes.
-const RETENTION_MAINTENANCE_CADENCE: Duration = Duration::from_secs(60);
-/// A catch-up sequence releases its pooled session between transactions and
-/// backs off before the next batch so request traffic retains pool access.
-const RETENTION_CATCH_UP_INITIAL_BACKOFF: Duration = Duration::from_millis(10);
-const RETENTION_CATCH_UP_MAX_BACKOFF: Duration = Duration::from_millis(100);
-const RETENTION_PRUNE_QUERY: &str =
-    "SELECT deleted_count, batch_saturated FROM registry_notary_api.retention_prune_v1($1)";
-// tokio-postgres uses this closed driver-owned cause when
-// `target_session_attrs=read-write` reaches a read-only server. Match it only
-// to classify the posture. Never expose the cause or any driver error text.
-const TARGET_SESSION_READ_ONLY_CAUSE: &str = "database does not allow writes";
-
-type ConnectionDriver = JoinHandle<Result<(), tokio_postgres::Error>>;
-type CredentialGeneration = [u8; 32];
-type PostgresSessionPool = Pool<ConnectionFactory>;
-type PooledPostgresSession = Object<ConnectionFactory>;
-
-/// TLS and timeout policy for the Notary-owned PostgreSQL state plane.
-///
-/// The environment variable name and root-certificate path are redacted from
-/// `Debug`. The URL value is loaded only while opening a session.
-#[derive(Clone, PartialEq, Eq)]
-pub struct PostgresStatePlaneConfig {
-    database_url_env: String,
-    root_certificate_path: Option<PathBuf>,
-    connect_timeout: Duration,
-    operation_timeout: Duration,
-    max_connections: usize,
-}
-
-impl PostgresStatePlaneConfig {
-    pub fn new(
-        database_url_env: impl Into<String>,
-        root_certificate_path: Option<PathBuf>,
-        connect_timeout: Duration,
-        operation_timeout: Duration,
-        max_connections: usize,
-    ) -> Result<Self, NotaryPostgresStatePlaneError> {
-        let database_url_env = database_url_env.into();
-        if database_url_env.trim().is_empty() {
-            return Err(NotaryPostgresStatePlaneError::InvalidConfiguration);
-        }
-        if connect_timeout.is_zero() || operation_timeout.is_zero() {
-            return Err(NotaryPostgresStatePlaneError::InvalidTimeout);
-        }
-        if !(1..=STATE_POSTGRESQL_MAX_CONNECTIONS).contains(&max_connections) {
-            return Err(NotaryPostgresStatePlaneError::InvalidConfiguration);
-        }
-        if root_certificate_path.as_ref().is_some_and(|path| {
-            path.as_os_str().is_empty()
-                || path.as_os_str().as_encoded_bytes().len() > MAX_ROOT_CERTIFICATE_PATH_BYTES
-        }) {
-            return Err(NotaryPostgresStatePlaneError::InvalidRootCertificatePath);
-        }
-        Ok(Self {
-            database_url_env,
-            root_certificate_path,
-            connect_timeout,
-            operation_timeout,
-            max_connections,
-        })
-    }
-
-    #[must_use]
-    pub fn connect_timeout(&self) -> Duration {
-        self.connect_timeout
-    }
-
-    #[must_use]
-    pub fn operation_timeout(&self) -> Duration {
-        self.operation_timeout
-    }
-
-    #[must_use]
-    pub fn max_connections(&self) -> usize {
-        self.max_connections
-    }
-}
-
-impl TryFrom<&StatePostgresqlConfig> for PostgresStatePlaneConfig {
-    type Error = NotaryPostgresStatePlaneError;
-
-    fn try_from(config: &StatePostgresqlConfig) -> Result<Self, Self::Error> {
-        Self::new(
-            config.url_env.clone(),
-            config.root_certificate_path.clone(),
-            Duration::from_millis(config.connect_timeout_ms),
-            Duration::from_millis(config.operation_timeout_ms),
-            config.max_connections,
-        )
-    }
-}
-
-impl fmt::Debug for PostgresStatePlaneConfig {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("PostgresStatePlaneConfig")
-            .field("database_url_env", &"<redacted>")
-            .field(
-                "custom_root_certificate",
-                &self.root_certificate_path.is_some(),
-            )
-            .field("connect_timeout", &self.connect_timeout)
-            .field("operation_timeout", &self.operation_timeout)
-            .field("max_connections", &self.max_connections)
-            .finish()
-    }
-}
-
-/// Closed runtime failures. No variant retains a URL, path, role, SQL text,
-/// driver error, or stored identifier.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
-pub enum NotaryPostgresStatePlaneError {
-    #[error("Notary PostgreSQL state configuration is invalid")]
-    InvalidConfiguration,
-    #[error("Notary PostgreSQL state timeout is invalid")]
-    InvalidTimeout,
-    #[error("Notary PostgreSQL database URL is unavailable")]
-    DatabaseUrlUnavailable,
-    #[error("Notary PostgreSQL database URL is invalid")]
-    InvalidDatabaseUrl,
-    #[error("Notary PostgreSQL database must require TLS")]
-    TlsRequired,
-    #[error("Notary PostgreSQL root-certificate path is invalid")]
-    InvalidRootCertificatePath,
-    #[error("Notary PostgreSQL root certificate is unavailable")]
-    RootCertificateUnavailable,
-    #[error("Notary PostgreSQL root certificate exceeds its size bound")]
-    RootCertificateTooLarge,
-    #[error("Notary PostgreSQL root certificate is invalid")]
-    InvalidRootCertificate,
-    #[error("Notary PostgreSQL TLS configuration is invalid")]
-    InvalidTlsConfiguration,
-    #[error("Notary PostgreSQL database is unavailable")]
-    DatabaseUnavailable,
-    #[error("Notary PostgreSQL server major is unsupported")]
-    UnsupportedServerMajor,
-    #[error("Notary PostgreSQL database is read-only or recovering")]
-    DatabaseNotWritable,
-    #[error("Notary PostgreSQL durability settings are unsafe")]
-    UnsafeDurability,
-    #[error("Notary PostgreSQL state schema is incompatible")]
-    SchemaIncompatible,
-    #[error("Notary PostgreSQL runtime role is incompatible")]
-    RoleIncompatible,
-    #[error("Notary PostgreSQL state operation is unavailable")]
-    OperationUnavailable,
-    #[error("Notary PostgreSQL state runtime is shut down")]
-    Shutdown,
-}
-
-/// Stable, value-free readiness result suitable for probe and posture mapping.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum NotaryPostgresStatePlaneReadiness {
-    Ready,
-    ConfigurationInvalid,
-    DatabaseUnavailable,
-    UnsupportedServerMajor,
-    DatabaseNotWritable,
-    UnsafeDurability,
-    SchemaIncompatible,
-    RoleIncompatible,
-    Shutdown,
-}
-
-impl NotaryPostgresStatePlaneReadiness {
-    #[must_use]
-    pub const fn from_error(error: NotaryPostgresStatePlaneError) -> Self {
-        readiness_from_error(error)
-    }
-
-    #[must_use]
-    pub const fn code(self) -> &'static str {
-        match self {
-            Self::Ready => "ready",
-            Self::ConfigurationInvalid => "configuration_invalid",
-            Self::DatabaseUnavailable => "database_unavailable",
-            Self::UnsupportedServerMajor => "database_unsupported",
-            Self::DatabaseNotWritable => "database_read_only",
-            Self::UnsafeDurability => "database_durability_unsafe",
-            Self::SchemaIncompatible => "schema_incompatible",
-            Self::RoleIncompatible => "role_incompatible",
-            Self::Shutdown => "shutdown",
-        }
-    }
-
-    /// Coarse, value-free component code used by the operator CLI. Detailed
-    /// database posture remains available through [`Self::code`] without
-    /// widening the command's stable error contract.
-    #[must_use]
-    pub const fn doctor_component_code(self) -> &'static str {
-        match self {
-            Self::ConfigurationInvalid => "configuration_invalid",
-            Self::SchemaIncompatible => "schema_incompatible",
-            Self::RoleIncompatible => "role_incompatible",
-            Self::Ready
-            | Self::DatabaseUnavailable
-            | Self::UnsupportedServerMajor
-            | Self::DatabaseNotWritable
-            | Self::UnsafeDurability
-            | Self::Shutdown => "database_unavailable",
-        }
-    }
-}
-
-/// Reconnectable PostgreSQL runtime for Notary-owned correctness state.
-///
-/// Each domain obtains a bounded lease from a Notary-specific physical session
-/// pool. Physical connections reload the named URL environment variable and
-/// enter the pool only after complete attestation. A process-keyed generation
-/// tag evicts old connections when the URL changes without retaining its value.
-pub struct NotaryPostgresStatePlaneRuntime {
-    connections: PostgresSessionPool,
-    sessions: Arc<SessionRegistry>,
-    #[cfg(test)]
-    retention_attempts: AtomicU64,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-struct RetentionPruneOutcome {
-    batch_saturated: bool,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-enum RetentionCatchUpOutcome {
-    CaughtUp,
-    Shutdown,
-}
-
-/// One PostgreSQL-serving retention worker. It owns no state values and is
-/// stopped by the serving state-plane handle before runtime connections close.
-pub(crate) struct PostgresRetentionMaintenance {
-    shutdown: watch::Sender<bool>,
-    task: JoinHandle<()>,
-}
-
-/// TLS-required owner connection used only by the explicit state installer.
-pub struct NotaryPostgresOperatorConnection {
-    client: Client,
-    driver: Option<ConnectionDriver>,
-}
-
-impl NotaryPostgresOperatorConnection {
-    pub async fn connect(
-        runtime_config: &PostgresStatePlaneConfig,
-        database_url_env: &str,
-    ) -> Result<Self, NotaryPostgresStatePlaneError> {
-        if database_url_env.trim().is_empty() {
-            return Err(NotaryPostgresStatePlaneError::InvalidConfiguration);
-        }
-        let database_url = load_database_url(database_url_env)?;
-        let postgres_config = parse_database_config(database_url.as_str())?;
-        let tls_connector = build_tls_connector(runtime_config.root_certificate_path.as_deref())?;
-        let (client, connection) = tokio::time::timeout(
-            runtime_config.connect_timeout,
-            postgres_config.connect(MakeTlsConnector::new(tls_connector)),
-        )
-        .await
-        .map_err(|_| NotaryPostgresStatePlaneError::DatabaseUnavailable)?
-        .map_err(map_connection_error)?;
-        Ok(Self {
-            client,
-            driver: Some(tokio::spawn(connection)),
-        })
-    }
-
-    pub fn client_mut(&mut self) -> &mut Client {
-        &mut self.client
-    }
-}
-
-impl fmt::Debug for NotaryPostgresOperatorConnection {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("NotaryPostgresOperatorConnection")
-            .finish_non_exhaustive()
-    }
-}
-
-impl Drop for NotaryPostgresOperatorConnection {
-    fn drop(&mut self) {
-        if let Some(driver) = self.driver.take() {
-            driver.abort();
-        }
-    }
-}
-
-impl NotaryPostgresStatePlaneRuntime {
-    /// Activate the state plane and prove a fully attested runtime session can
-    /// be opened before the caller binds a listener.
-    pub async fn connect(
-        config: &PostgresStatePlaneConfig,
-    ) -> Result<Self, NotaryPostgresStatePlaneError> {
-        let sessions = Arc::new(SessionRegistry::default());
-        let manager = ConnectionFactory::new(config, Arc::clone(&sessions))?;
-        let connections = PostgresSessionPool::builder(manager)
-            .max_size(config.max_connections)
-            .wait_timeout(Some(config.operation_timeout))
-            .runtime(deadpool::Runtime::Tokio1)
-            .build()
-            .map_err(|_| NotaryPostgresStatePlaneError::InvalidConfiguration)?;
-        let runtime = Self {
-            connections,
-            sessions,
-            #[cfg(test)]
-            retention_attempts: AtomicU64::new(0),
-        };
-        drop(runtime.open_domain_session().await?);
-        Ok(runtime)
-    }
-
-    /// Lease a bounded, fully attested session for one typed state-domain
-    /// adapter. Pool wait time is bounded by the operation timeout.
-    pub(crate) async fn open_domain_session(
-        &self,
-    ) -> Result<NotaryPostgresSession, NotaryPostgresStatePlaneError> {
-        if self.sessions.is_shutdown() {
-            return Err(NotaryPostgresStatePlaneError::Shutdown);
-        }
-        let session = self.connections.get().await.map_err(map_pool_error)?;
-        if self.sessions.is_shutdown() || self.connections.is_closed() {
-            session.poisoned.store(true, Ordering::Release);
-            drop(session);
-            return Err(NotaryPostgresStatePlaneError::Shutdown);
-        }
-        Ok(NotaryPostgresSession { session })
-    }
-
-    /// Re-attest a pooled runtime session and return bounded version
-    /// information suitable for operator diagnostics.
-    pub async fn attestation(
-        &self,
-    ) -> Result<PostgresStatePlaneAttestation, NotaryPostgresStatePlaneError> {
-        let session = self.open_domain_session().await?;
-        session.attest().await
-    }
-
-    /// Probe the complete schema and role contract. A failed probe poisons its
-    /// physical session, so recovery must reconnect and re-attest before the
-    /// next probe can report ready.
-    pub async fn readiness(&self) -> NotaryPostgresStatePlaneReadiness {
-        match self.open_domain_session().await {
-            Ok(session) => match session.attest().await {
-                Ok(_) => NotaryPostgresStatePlaneReadiness::Ready,
-                Err(error) => readiness_from_error(error),
-            },
-            Err(error) => readiness_from_error(error),
-        }
-    }
-
-    /// Invoke one fixed, bounded retention transaction. Maintenance errors use
-    /// the same value-free state-plane error contract as requests and are not
-    /// retained as readiness state.
-    async fn prune_expired_rows(
-        &self,
-    ) -> Result<RetentionPruneOutcome, NotaryPostgresStatePlaneError> {
-        #[cfg(test)]
-        self.retention_attempts.fetch_add(1, Ordering::Relaxed);
-        let session = self.open_domain_session().await?;
-        let row = session
-            .run_operation(
-                session
-                    .client()
-                    .query_one(RETENTION_PRUNE_QUERY, &[&RETENTION_MAINTENANCE_BATCH_SIZE]),
-            )
-            .await?;
-        let deleted_count: i64 = row
-            .try_get("deleted_count")
-            .map_err(|_| NotaryPostgresStatePlaneError::OperationUnavailable)?;
-        let batch_saturated: bool = row
-            .try_get("batch_saturated")
-            .map_err(|_| NotaryPostgresStatePlaneError::OperationUnavailable)?;
-        let maximum_deleted =
-            i64::from(RETENTION_MAINTENANCE_BATCH_SIZE) * RETENTION_PRUNE_GROUP_COUNT;
-        if !(0..=maximum_deleted).contains(&deleted_count)
-            || (batch_saturated && deleted_count < i64::from(RETENTION_MAINTENANCE_BATCH_SIZE))
-        {
-            return Err(NotaryPostgresStatePlaneError::OperationUnavailable);
-        }
-        Ok(RetentionPruneOutcome { batch_saturated })
-    }
-
-    /// Stop admission of new sessions and abort every active connection
-    /// driver. Repeated shutdown calls are safe.
-    pub fn shutdown(&self) {
-        self.connections.close();
-        self.sessions.shutdown();
-    }
-
-    #[must_use]
-    pub fn is_shutdown(&self) -> bool {
-        self.sessions.is_shutdown()
-    }
-
-    #[cfg(test)]
-    pub(crate) fn pool_status(&self) -> deadpool::Status {
-        self.connections.status()
-    }
-
-    #[cfg(test)]
-    pub(crate) fn created_session_count(&self) -> u64 {
-        self.sessions.next_session_id.load(Ordering::Acquire)
-    }
-}
-
-pub(crate) fn start_postgres_retention_maintenance(
-    runtime: Arc<NotaryPostgresStatePlaneRuntime>,
-) -> PostgresRetentionMaintenance {
-    start_postgres_retention_maintenance_with_cadence(runtime, RETENTION_MAINTENANCE_CADENCE)
-}
-
-fn start_postgres_retention_maintenance_with_cadence(
-    runtime: Arc<NotaryPostgresStatePlaneRuntime>,
-    cadence: Duration,
-) -> PostgresRetentionMaintenance {
-    let (shutdown, shutdown_rx) = watch::channel(false);
-    let task = tokio::spawn(run_postgres_retention_maintenance(
-        runtime,
-        shutdown_rx,
-        cadence,
-    ));
-    PostgresRetentionMaintenance { shutdown, task }
-}
-
-async fn run_postgres_retention_maintenance(
-    runtime: Arc<NotaryPostgresStatePlaneRuntime>,
-    mut shutdown: watch::Receiver<bool>,
-    cadence: Duration,
-) {
-    let first_pass = tokio::time::Instant::now() + cadence;
-    let mut interval = tokio::time::interval_at(first_pass, cadence);
-    interval.set_missed_tick_behavior(MissedTickBehavior::Skip);
-    loop {
-        tokio::select! {
-            changed = shutdown.changed() => {
-                if changed.is_err() || *shutdown.borrow() {
-                    return;
-                }
-            }
-            _ = interval.tick() => {
-                let prune_runtime = Arc::clone(&runtime);
-                let result = catch_up_postgres_retention(
-                    &mut shutdown,
-                    RETENTION_CATCH_UP_INITIAL_BACKOFF,
-                    RETENTION_CATCH_UP_MAX_BACKOFF,
-                    move || {
-                        let runtime = Arc::clone(&prune_runtime);
-                        async move { runtime.prune_expired_rows().await }
-                    },
-                )
-                .await;
-                match result {
-                    Ok(RetentionCatchUpOutcome::CaughtUp) => {}
-                    Ok(RetentionCatchUpOutcome::Shutdown) => return,
-                    Err(NotaryPostgresStatePlaneError::Shutdown) => return,
-                    Err(_) => tracing::warn!(
-                        target: "registry_notary::state_plane",
-                        "PostgreSQL retention maintenance was unavailable; serving continues"
-                    ),
-                }
-            }
-        }
-    }
-}
-
-async fn catch_up_postgres_retention<Prune, PruneFuture>(
-    shutdown: &mut watch::Receiver<bool>,
-    initial_backoff: Duration,
-    maximum_backoff: Duration,
-    mut prune: Prune,
-) -> Result<RetentionCatchUpOutcome, NotaryPostgresStatePlaneError>
-where
-    Prune: FnMut() -> PruneFuture,
-    PruneFuture: Future<Output = Result<RetentionPruneOutcome, NotaryPostgresStatePlaneError>>,
-{
-    let mut backoff = initial_backoff;
-    loop {
-        if *shutdown.borrow() {
-            return Ok(RetentionCatchUpOutcome::Shutdown);
-        }
-        let outcome = tokio::select! {
-            changed = shutdown.changed() => {
-                if changed.is_err() || *shutdown.borrow() {
-                    return Ok(RetentionCatchUpOutcome::Shutdown);
-                }
-                continue;
-            }
-            outcome = prune() => outcome?,
-        };
-        if !outcome.batch_saturated {
-            return Ok(RetentionCatchUpOutcome::CaughtUp);
-        }
-
-        tokio::select! {
-            changed = shutdown.changed() => {
-                if changed.is_err() || *shutdown.borrow() {
-                    return Ok(RetentionCatchUpOutcome::Shutdown);
-                }
-            }
-            () = tokio::time::sleep(backoff) => {}
-        }
-        backoff = backoff.saturating_mul(2).min(maximum_backoff);
-    }
-}
-
-impl PostgresRetentionMaintenance {
-    /// Signal cooperative shutdown and abort the task without blocking. The
-    /// owning handle's synchronous `Drop` cannot await a join; aborting drops
-    /// any in-flight prune future, after which runtime shutdown closes every
-    /// registered connection driver.
-    pub(crate) fn shutdown(&self) {
-        let _ = self.shutdown.send(true);
-        self.task.abort();
-    }
-}
-
-impl Drop for PostgresRetentionMaintenance {
-    fn drop(&mut self) {
-        self.shutdown();
-    }
-}
-
-impl fmt::Debug for NotaryPostgresStatePlaneRuntime {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("NotaryPostgresStatePlaneRuntime")
-            .field("shutdown", &self.is_shutdown())
-            .finish_non_exhaustive()
-    }
-}
-
-impl Drop for NotaryPostgresStatePlaneRuntime {
-    fn drop(&mut self) {
-        self.connections.close();
-        self.sessions.shutdown();
-    }
-}
-
-/// One independently driven, attested PostgreSQL session.
-///
-/// Domain modules use the typed `Client` interface to invoke their fixed API
-/// functions. This wrapper intentionally offers no key-value operations.
-pub(crate) struct NotaryPostgresSession {
-    session: PooledPostgresSession,
-}
-
-/// One physical PostgreSQL connection. It enters the pool only after complete
-/// configuration and attestation, and is discarded after any operation error.
-struct PhysicalPostgresSession {
-    client: Client,
-    driver: Option<ConnectionDriver>,
-    session_id: u64,
-    sessions: Arc<SessionRegistry>,
-    operation_timeout: Duration,
-    credential_generation: CredentialGeneration,
-    poisoned: AtomicBool,
-}
-
-/// A cancelled adapter future must not return a connection with an in-flight
-/// PostgreSQL request to the pool. Successful completion explicitly disarms
-/// this guard; every other drop path poisons the physical session.
-struct PoisonSessionOnDrop<'a> {
-    poisoned: &'a AtomicBool,
-    armed: bool,
-}
-
-impl<'a> PoisonSessionOnDrop<'a> {
-    fn new(poisoned: &'a AtomicBool) -> Self {
-        Self {
-            poisoned,
-            armed: true,
-        }
-    }
-
-    fn disarm(&mut self) {
-        self.armed = false;
-    }
-}
-
-impl Drop for PoisonSessionOnDrop<'_> {
-    fn drop(&mut self) {
-        if self.armed {
-            self.poisoned.store(true, Ordering::Release);
-        }
-    }
-}
-
-impl NotaryPostgresSession {
-    pub(crate) fn client(&self) -> &Client {
-        &self.session.client
-    }
-
-    /// Apply the runtime operation deadline to a typed client or transaction
-    /// future without accepting an untyped storage operation.
-    pub(crate) async fn run_operation<T>(
-        &self,
-        operation: impl Future<Output = Result<T, tokio_postgres::Error>>,
-    ) -> Result<T, NotaryPostgresStatePlaneError> {
-        let mut poison_on_drop = PoisonSessionOnDrop::new(&self.session.poisoned);
-        match tokio::time::timeout(self.session.operation_timeout, operation).await {
-            Ok(Ok(value)) => {
-                poison_on_drop.disarm();
-                Ok(value)
-            }
-            Ok(Err(_)) | Err(_) => Err(NotaryPostgresStatePlaneError::OperationUnavailable),
-        }
-    }
-
-    async fn attest(&self) -> Result<PostgresStatePlaneAttestation, NotaryPostgresStatePlaneError> {
-        let mut poison_on_drop = PoisonSessionOnDrop::new(&self.session.poisoned);
-        match self.session.attest().await {
-            Ok(attestation) => {
-                poison_on_drop.disarm();
-                Ok(attestation)
-            }
-            Err(error) => Err(error),
-        }
-    }
-}
-
-impl PhysicalPostgresSession {
-    async fn configure(&self) -> Result<(), NotaryPostgresStatePlaneError> {
-        let timeout = duration_as_postgres_milliseconds(self.operation_timeout);
-        tokio::time::timeout(
-            self.operation_timeout,
-            self.client.query_one(
-                "SELECT pg_catalog.set_config('statement_timeout', $1, false),\n\
-                        pg_catalog.set_config('lock_timeout', $1, false),\n\
-                        pg_catalog.set_config('idle_in_transaction_session_timeout', $1, false),\n\
-                        pg_catalog.set_config('synchronous_commit', 'on', false),\n\
-                        pg_catalog.set_config('search_path', 'pg_catalog', false),\n\
-                        pg_catalog.set_config('client_encoding', 'UTF8', false),\n\
-                        pg_catalog.set_config('standard_conforming_strings', 'on', false),\n\
-                        pg_catalog.set_config(\n\
-                            'default_transaction_isolation', 'read committed', false\n\
-                        )",
-                &[&timeout],
-            ),
-        )
-        .await
-        .map_err(|_| NotaryPostgresStatePlaneError::DatabaseUnavailable)?
-        .map_err(map_connection_error)?;
-        Ok(())
-    }
-
-    async fn attest(&self) -> Result<PostgresStatePlaneAttestation, NotaryPostgresStatePlaneError> {
-        tokio::time::timeout(
-            self.operation_timeout,
-            attest_postgres_state_plane_v1(&self.client),
-        )
-        .await
-        .map_err(|_| NotaryPostgresStatePlaneError::DatabaseUnavailable)?
-        .map_err(map_attestation_error)
-    }
-}
-
-impl fmt::Debug for NotaryPostgresSession {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("NotaryPostgresSession")
-            .finish_non_exhaustive()
-    }
-}
-
-impl Drop for PhysicalPostgresSession {
-    fn drop(&mut self) {
-        self.sessions.unregister(self.session_id);
-        if let Some(driver) = self.driver.take() {
-            driver.abort();
-        }
-    }
-}
-
-struct ConnectionFactory {
-    database_url_env: String,
-    tls_connector: TlsConnector,
-    connect_timeout: Duration,
-    operation_timeout: Duration,
-    credential_tag_key: Zeroizing<[u8; 32]>,
-    sessions: Arc<SessionRegistry>,
-}
-
-impl ConnectionFactory {
-    fn new(
-        config: &PostgresStatePlaneConfig,
-        sessions: Arc<SessionRegistry>,
-    ) -> Result<Self, NotaryPostgresStatePlaneError> {
-        let mut credential_tag_key = Zeroizing::new([0_u8; 32]);
-        getrandom::fill(credential_tag_key.as_mut())
-            .map_err(|_| NotaryPostgresStatePlaneError::InvalidConfiguration)?;
-        Ok(Self {
-            database_url_env: config.database_url_env.clone(),
-            tls_connector: build_tls_connector(config.root_certificate_path.as_deref())?,
-            connect_timeout: config.connect_timeout,
-            operation_timeout: config.operation_timeout,
-            credential_tag_key,
-            sessions,
-        })
-    }
-
-    fn credential_generation(
-        &self,
-        database_url: &str,
-    ) -> Result<CredentialGeneration, NotaryPostgresStatePlaneError> {
-        let mut mac = <Hmac<Sha256> as KeyInit>::new_from_slice(self.credential_tag_key.as_ref())
-            .map_err(|_| NotaryPostgresStatePlaneError::InvalidConfiguration)?;
-        mac.update(b"registry-notary-postgresql-credential-generation-v1\0");
-        mac.update(database_url.as_bytes());
-        let mut generation = [0_u8; 32];
-        generation.copy_from_slice(&mac.finalize().into_bytes());
-        Ok(generation)
-    }
-
-    async fn open_physical_session(
-        &self,
-    ) -> Result<PhysicalPostgresSession, NotaryPostgresStatePlaneError> {
-        if self.sessions.is_shutdown() {
-            return Err(NotaryPostgresStatePlaneError::Shutdown);
-        }
-        let database_url = load_database_url(&self.database_url_env)?;
-        let credential_generation = self.credential_generation(database_url.as_str())?;
-        let postgres_config = parse_database_config(database_url.as_str())?;
-        drop(database_url);
-        let connector = MakeTlsConnector::new(self.tls_connector.clone());
-        let (client, connection) =
-            tokio::time::timeout(self.connect_timeout, postgres_config.connect(connector))
-                .await
-                .map_err(|_| NotaryPostgresStatePlaneError::DatabaseUnavailable)?
-                .map_err(map_connection_error)?;
-        drop(postgres_config);
-
-        let driver = tokio::spawn(connection);
-        let session_id = self.sessions.register(driver.abort_handle())?;
-        let session = PhysicalPostgresSession {
-            client,
-            driver: Some(driver),
-            session_id,
-            sessions: Arc::clone(&self.sessions),
-            operation_timeout: self.operation_timeout,
-            credential_generation,
-            poisoned: AtomicBool::new(false),
-        };
-        session.configure().await?;
-        session.attest().await?;
-        if self.sessions.is_shutdown() {
-            return Err(NotaryPostgresStatePlaneError::Shutdown);
-        }
-        if session
-            .driver
-            .as_ref()
-            .is_none_or(tokio::task::JoinHandle::is_finished)
-        {
-            return Err(NotaryPostgresStatePlaneError::DatabaseUnavailable);
-        }
-        Ok(session)
-    }
-}
-
-impl Manager for ConnectionFactory {
-    type Type = PhysicalPostgresSession;
-    type Error = NotaryPostgresStatePlaneError;
-
-    async fn create(&self) -> Result<Self::Type, Self::Error> {
-        self.open_physical_session().await
-    }
-
-    async fn recycle(
-        &self,
-        session: &mut Self::Type,
-        _metrics: &Metrics,
-    ) -> RecycleResult<Self::Error> {
-        if self.sessions.is_shutdown() {
-            return Err(RecycleError::Backend(
-                NotaryPostgresStatePlaneError::Shutdown,
-            ));
-        }
-        if session.poisoned.load(Ordering::Acquire)
-            || session.client.is_closed()
-            || session
-                .driver
-                .as_ref()
-                .is_none_or(tokio::task::JoinHandle::is_finished)
-        {
-            return Err(RecycleError::Backend(
-                NotaryPostgresStatePlaneError::DatabaseUnavailable,
-            ));
-        }
-        let database_url = load_database_url(&self.database_url_env)?;
-        let current_generation = self.credential_generation(database_url.as_str())?;
-        drop(database_url);
-        if !bool::from(session.credential_generation.ct_eq(&current_generation)) {
-            return Err(RecycleError::Backend(
-                NotaryPostgresStatePlaneError::DatabaseUnavailable,
-            ));
-        }
-        Ok(())
-    }
-}
-
-#[derive(Default)]
-struct SessionRegistry {
-    shutdown: AtomicBool,
-    next_session_id: AtomicU64,
-    drivers: Mutex<HashMap<u64, AbortHandle>>,
-}
-
-impl SessionRegistry {
-    fn register(&self, driver: AbortHandle) -> Result<u64, NotaryPostgresStatePlaneError> {
-        if self.is_shutdown() {
-            driver.abort();
-            return Err(NotaryPostgresStatePlaneError::Shutdown);
-        }
-        let session_id = self.next_session_id.fetch_add(1, Ordering::Relaxed);
-        let mut drivers = self
-            .drivers
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner());
-        if self.is_shutdown() {
-            driver.abort();
-            return Err(NotaryPostgresStatePlaneError::Shutdown);
-        }
-        drivers.insert(session_id, driver);
-        Ok(session_id)
-    }
-
-    fn unregister(&self, session_id: u64) {
-        self.drivers
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-            .remove(&session_id);
-    }
-
-    fn shutdown(&self) {
-        if self.shutdown.swap(true, Ordering::AcqRel) {
-            return;
-        }
-        let drivers = {
-            let mut registered = self
-                .drivers
-                .lock()
-                .unwrap_or_else(|poisoned| poisoned.into_inner());
-            std::mem::take(&mut *registered)
-        };
-        for driver in drivers.into_values() {
-            driver.abort();
-        }
-    }
-
-    fn is_shutdown(&self) -> bool {
-        self.shutdown.load(Ordering::Acquire)
-    }
-}
-
-fn load_database_url(
-    database_url_env: &str,
-) -> Result<Zeroizing<String>, NotaryPostgresStatePlaneError> {
-    let value = Zeroizing::new(
-        env::var(database_url_env)
-            .map_err(|_| NotaryPostgresStatePlaneError::DatabaseUrlUnavailable)?,
-    );
-    if value.trim().is_empty() {
-        return Err(NotaryPostgresStatePlaneError::DatabaseUrlUnavailable);
-    }
-    Ok(value)
-}
-
-fn parse_database_config(
-    database_url: &str,
-) -> Result<TokioPostgresConfig, NotaryPostgresStatePlaneError> {
-    let mut config = database_url
-        .parse::<TokioPostgresConfig>()
-        .map_err(|_| NotaryPostgresStatePlaneError::InvalidDatabaseUrl)?;
-    if config.get_ssl_mode() != SslMode::Require {
-        return Err(NotaryPostgresStatePlaneError::TlsRequired);
-    }
-    config.target_session_attrs(TargetSessionAttrs::ReadWrite);
-    Ok(config)
-}
-
-fn build_tls_connector(
-    root_certificate_path: Option<&Path>,
-) -> Result<TlsConnector, NotaryPostgresStatePlaneError> {
-    let mut builder = TlsConnector::builder();
-    if let Some(path) = root_certificate_path {
-        let certificate_bytes = read_bounded_root_certificate(path)?;
-        let certificate = native_tls::Certificate::from_pem(&certificate_bytes)
-            .map_err(|_| NotaryPostgresStatePlaneError::InvalidRootCertificate)?;
-        builder.add_root_certificate(certificate);
-    }
-    builder
-        .build()
-        .map_err(|_| NotaryPostgresStatePlaneError::InvalidTlsConfiguration)
-}
-
-fn read_bounded_root_certificate(path: &Path) -> Result<Vec<u8>, NotaryPostgresStatePlaneError> {
-    if path.as_os_str().is_empty()
-        || path.as_os_str().as_encoded_bytes().len() > MAX_ROOT_CERTIFICATE_PATH_BYTES
-    {
-        return Err(NotaryPostgresStatePlaneError::InvalidRootCertificatePath);
-    }
-    let file =
-        File::open(path).map_err(|_| NotaryPostgresStatePlaneError::RootCertificateUnavailable)?;
-    let mut limited = file.take((MAX_ROOT_CERTIFICATE_BYTES + 1) as u64);
-    let mut bytes = Vec::new();
-    limited
-        .read_to_end(&mut bytes)
-        .map_err(|_| NotaryPostgresStatePlaneError::RootCertificateUnavailable)?;
-    if bytes.len() > MAX_ROOT_CERTIFICATE_BYTES {
-        return Err(NotaryPostgresStatePlaneError::RootCertificateTooLarge);
-    }
-    Ok(bytes)
-}
-
-fn duration_as_postgres_milliseconds(duration: Duration) -> String {
-    format!("{}ms", duration.as_millis())
-}
-
-fn map_pool_error(
-    error: PoolError<NotaryPostgresStatePlaneError>,
-) -> NotaryPostgresStatePlaneError {
-    match error {
-        PoolError::Backend(error) => error,
-        PoolError::Closed => NotaryPostgresStatePlaneError::Shutdown,
-        PoolError::Timeout(_) => NotaryPostgresStatePlaneError::OperationUnavailable,
-        PoolError::NoRuntimeSpecified | PoolError::PostCreateHook(_) => {
-            NotaryPostgresStatePlaneError::InvalidConfiguration
-        }
-    }
-}
-
-fn map_connection_error(error: tokio_postgres::Error) -> NotaryPostgresStatePlaneError {
-    classify_connection_failure(error.code(), StdError::source(&error))
-}
-
-fn classify_connection_failure(
-    sqlstate: Option<&SqlState>,
-    cause: Option<&(dyn StdError + 'static)>,
-) -> NotaryPostgresStatePlaneError {
-    if sqlstate == Some(&SqlState::READ_ONLY_SQL_TRANSACTION)
-        || is_target_session_read_only_cause(cause)
-    {
-        NotaryPostgresStatePlaneError::DatabaseNotWritable
-    } else {
-        NotaryPostgresStatePlaneError::DatabaseUnavailable
-    }
-}
-
-fn is_target_session_read_only_cause(cause: Option<&(dyn StdError + 'static)>) -> bool {
-    cause
-        .and_then(|cause| cause.downcast_ref::<io::Error>())
-        .is_some_and(|cause| {
-            cause.kind() == io::ErrorKind::PermissionDenied
-                && cause.to_string() == TARGET_SESSION_READ_ONLY_CAUSE
-        })
-}
-
-const fn map_attestation_error(error: StatePlaneMigrationError) -> NotaryPostgresStatePlaneError {
-    match error {
-        StatePlaneMigrationError::UnsupportedServerMajor => {
-            NotaryPostgresStatePlaneError::UnsupportedServerMajor
-        }
-        StatePlaneMigrationError::DatabaseNotWritable => {
-            NotaryPostgresStatePlaneError::DatabaseNotWritable
-        }
-        StatePlaneMigrationError::UnsafeDurability => {
-            NotaryPostgresStatePlaneError::UnsafeDurability
-        }
-        StatePlaneMigrationError::PartialInstallation
-        | StatePlaneMigrationError::CapabilityDrift => {
-            NotaryPostgresStatePlaneError::SchemaIncompatible
-        }
-        StatePlaneMigrationError::InvalidRuntimeRole
-        | StatePlaneMigrationError::InvalidOwnerRole
-        | StatePlaneMigrationError::OwnerRoleUnavailable
-        | StatePlaneMigrationError::InvalidRuntimeRoleContract
-        | StatePlaneMigrationError::RoleCollision => {
-            NotaryPostgresStatePlaneError::RoleIncompatible
-        }
-        StatePlaneMigrationError::Unavailable => NotaryPostgresStatePlaneError::DatabaseUnavailable,
-    }
-}
-
-const fn readiness_from_error(
-    error: NotaryPostgresStatePlaneError,
-) -> NotaryPostgresStatePlaneReadiness {
-    match error {
-        NotaryPostgresStatePlaneError::InvalidConfiguration
-        | NotaryPostgresStatePlaneError::InvalidTimeout
-        | NotaryPostgresStatePlaneError::InvalidRootCertificatePath
-        | NotaryPostgresStatePlaneError::RootCertificateUnavailable
-        | NotaryPostgresStatePlaneError::RootCertificateTooLarge
-        | NotaryPostgresStatePlaneError::InvalidRootCertificate
-        | NotaryPostgresStatePlaneError::InvalidTlsConfiguration => {
-            NotaryPostgresStatePlaneReadiness::ConfigurationInvalid
-        }
-        NotaryPostgresStatePlaneError::DatabaseUrlUnavailable
-        | NotaryPostgresStatePlaneError::InvalidDatabaseUrl
-        | NotaryPostgresStatePlaneError::TlsRequired
-        | NotaryPostgresStatePlaneError::DatabaseUnavailable
-        | NotaryPostgresStatePlaneError::OperationUnavailable => {
-            NotaryPostgresStatePlaneReadiness::DatabaseUnavailable
-        }
-        NotaryPostgresStatePlaneError::UnsupportedServerMajor => {
-            NotaryPostgresStatePlaneReadiness::UnsupportedServerMajor
-        }
-        NotaryPostgresStatePlaneError::DatabaseNotWritable => {
-            NotaryPostgresStatePlaneReadiness::DatabaseNotWritable
-        }
-        NotaryPostgresStatePlaneError::UnsafeDurability => {
-            NotaryPostgresStatePlaneReadiness::UnsafeDurability
-        }
-        NotaryPostgresStatePlaneError::SchemaIncompatible => {
-            NotaryPostgresStatePlaneReadiness::SchemaIncompatible
-        }
-        NotaryPostgresStatePlaneError::RoleIncompatible => {
-            NotaryPostgresStatePlaneReadiness::RoleIncompatible
-        }
-        NotaryPostgresStatePlaneError::Shutdown => NotaryPostgresStatePlaneReadiness::Shutdown,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use std::{fs::OpenOptions, future::pending};
-
-    use super::*;
-
-    const SECRET_URL: &str =
-        "postgresql://sentinel-user:sentinel-password@sentinel-host/state?sslmode=disable";
-
-    fn config() -> PostgresStatePlaneConfig {
-        PostgresStatePlaneConfig::new(
-            "SENTINEL_DATABASE_URL",
-            Some(PathBuf::from("/sentinel/root.pem")),
-            Duration::from_secs(5),
-            Duration::from_secs(2),
-            16,
-        )
-        .expect("test configuration is valid")
-    }
-
-    #[test]
-    fn database_url_policy_requires_tls_and_primary_selection() {
-        let error = parse_database_config(SECRET_URL).expect_err("plaintext fallback is rejected");
-        assert_eq!(error, NotaryPostgresStatePlaneError::TlsRequired);
-        let rendered = format!("{error:?} {error}");
-        assert!(!rendered.contains("sentinel"));
-
-        let invalid = parse_database_config("sentinel-not-a-database-url")
-            .expect_err("invalid URL is rejected");
-        let rendered = format!("{invalid:?} {invalid}");
-        assert!(!rendered.contains("sentinel"));
-
-        let secure = parse_database_config(
-            "postgresql://sentinel-user:sentinel-password@sentinel-host/state?sslmode=require",
-        )
-        .expect("TLS-required URL parses");
-        assert_eq!(
-            secure.get_target_session_attrs(),
-            TargetSessionAttrs::ReadWrite
-        );
-    }
-
-    #[test]
-    fn connection_failures_preserve_only_the_safe_read_only_classification() {
-        assert_eq!(
-            classify_connection_failure(Some(&SqlState::READ_ONLY_SQL_TRANSACTION), None),
-            NotaryPostgresStatePlaneError::DatabaseNotWritable
-        );
-
-        let target_session_cause = io::Error::new(
-            io::ErrorKind::PermissionDenied,
-            TARGET_SESSION_READ_ONLY_CAUSE,
-        );
-        assert_eq!(
-            classify_connection_failure(None, Some(&target_session_cause)),
-            NotaryPostgresStatePlaneError::DatabaseNotWritable
-        );
-
-        let unrelated = io::Error::new(
-            io::ErrorKind::PermissionDenied,
-            "SENTINEL_DATABASE_PATH_OR_DRIVER_VALUE",
-        );
-        let classified = classify_connection_failure(None, Some(&unrelated));
-        assert_eq!(
-            classified,
-            NotaryPostgresStatePlaneError::DatabaseUnavailable
-        );
-        let rendered = format!("{classified:?} {classified}");
-        assert!(!rendered.contains("SENTINEL"));
-        assert!(!rendered.contains("driver"));
-    }
-
-    #[test]
-    fn runtime_configuration_debug_redacts_environment_and_path() {
-        let rendered = format!("{:?}", config());
-        assert!(!rendered.contains("SENTINEL_DATABASE_URL"));
-        assert!(!rendered.contains("/sentinel/root.pem"));
-        assert!(rendered.contains("custom_root_certificate"));
-    }
-
-    #[test]
-    fn credential_generation_changes_without_retaining_url_material() {
-        let config = PostgresStatePlaneConfig::new(
-            "SENTINEL_DATABASE_URL",
-            None,
-            Duration::from_secs(5),
-            Duration::from_secs(2),
-            16,
-        )
-        .expect("test configuration is valid");
-        let factory = ConnectionFactory::new(&config, Arc::new(SessionRegistry::default()))
-            .expect("connection factory is valid");
-        let first = factory
-            .credential_generation("postgresql://sentinel:first@localhost/state?sslmode=require")
-            .expect("first generation is available");
-        let second = factory
-            .credential_generation("postgresql://sentinel:second@localhost/state?sslmode=require")
-            .expect("second generation is available");
-        assert_ne!(first, second);
-        let rendered = format!("{first:?} {second:?}");
-        assert!(!rendered.contains("sentinel"));
-        assert!(!rendered.contains("postgresql://"));
-    }
-
-    #[test]
-    fn cancelled_operation_guard_poisons_only_armed_sessions() {
-        let cancelled = AtomicBool::new(false);
-        drop(PoisonSessionOnDrop::new(&cancelled));
-        assert!(cancelled.load(Ordering::Acquire));
-
-        let completed = AtomicBool::new(false);
-        {
-            let mut guard = PoisonSessionOnDrop::new(&completed);
-            guard.disarm();
-        }
-        assert!(!completed.load(Ordering::Acquire));
-    }
-
-    #[test]
-    fn zero_timeouts_fail_closed() {
-        assert_eq!(
-            PostgresStatePlaneConfig::new(
-                "DATABASE_URL",
-                None,
-                Duration::ZERO,
-                Duration::from_secs(1),
-                16,
-            ),
-            Err(NotaryPostgresStatePlaneError::InvalidTimeout)
-        );
-        assert_eq!(
-            PostgresStatePlaneConfig::new(
-                "DATABASE_URL",
-                None,
-                Duration::from_secs(1),
-                Duration::from_secs(1),
-                0,
-            ),
-            Err(NotaryPostgresStatePlaneError::InvalidConfiguration)
-        );
-    }
-
-    #[test]
-    fn root_certificate_read_is_bounded_and_path_is_not_disclosed() {
-        let path = env::temp_dir().join(format!(
-            "registry-notary-state-plane-sentinel-{}.pem",
-            ulid::Ulid::new()
-        ));
-        let file = OpenOptions::new()
-            .create_new(true)
-            .write(true)
-            .open(&path)
-            .expect("unique temporary file opens");
-        file.set_len((MAX_ROOT_CERTIFICATE_BYTES + 1) as u64)
-            .expect("temporary file is extended");
-
-        let error = read_bounded_root_certificate(&path)
-            .expect_err("oversized root certificate is rejected");
-        std::fs::remove_file(&path).expect("temporary file is removed");
-        assert_eq!(
-            error,
-            NotaryPostgresStatePlaneError::RootCertificateTooLarge
-        );
-        let rendered = format!("{error:?} {error}");
-        assert!(!rendered.contains("sentinel"));
-        assert!(!rendered.contains(path.to_string_lossy().as_ref()));
-    }
-
-    #[test]
-    fn retention_maintenance_uses_the_fixed_bounded_contract() {
-        assert_eq!(RETENTION_MAINTENANCE_BATCH_SIZE, 1_000);
-        assert_eq!(RETENTION_PRUNE_GROUP_COUNT, 13);
-        assert_eq!(RETENTION_MAINTENANCE_CADENCE, Duration::from_secs(60));
-        assert_eq!(
-            RETENTION_CATCH_UP_INITIAL_BACKOFF,
-            Duration::from_millis(10)
-        );
-        assert_eq!(RETENTION_CATCH_UP_MAX_BACKOFF, Duration::from_millis(100));
-        assert_eq!(
-            RETENTION_PRUNE_QUERY,
-            "SELECT deleted_count, batch_saturated FROM registry_notary_api.retention_prune_v1($1)"
-        );
-    }
-
-    #[tokio::test]
-    async fn retention_catch_up_repeats_saturated_batches_until_short() {
-        let attempts = Arc::new(AtomicU64::new(0));
-        let prune_attempts = Arc::clone(&attempts);
-        let (_shutdown, mut shutdown_rx) = watch::channel(false);
-
-        let outcome = catch_up_postgres_retention(
-            &mut shutdown_rx,
-            Duration::ZERO,
-            Duration::ZERO,
-            move || {
-                let attempt = prune_attempts.fetch_add(1, Ordering::Relaxed);
-                async move {
-                    Ok(RetentionPruneOutcome {
-                        batch_saturated: attempt < 2,
-                    })
-                }
-            },
-        )
-        .await
-        .expect("successful retention batches catch up");
-
-        assert_eq!(outcome, RetentionCatchUpOutcome::CaughtUp);
-        assert_eq!(attempts.load(Ordering::Relaxed), 3);
-    }
-
-    #[tokio::test]
-    async fn retention_catch_up_observes_shutdown_already_signaled() {
-        let attempts = Arc::new(AtomicU64::new(0));
-        let prune_attempts = Arc::clone(&attempts);
-        let (shutdown, mut shutdown_rx) = watch::channel(false);
-        shutdown.send(true).expect("shutdown receiver remains open");
-
-        let outcome = catch_up_postgres_retention(
-            &mut shutdown_rx,
-            RETENTION_CATCH_UP_INITIAL_BACKOFF,
-            RETENTION_CATCH_UP_MAX_BACKOFF,
-            move || {
-                prune_attempts.fetch_add(1, Ordering::Relaxed);
-                async move {
-                    Ok(RetentionPruneOutcome {
-                        batch_saturated: true,
-                    })
-                }
-            },
-        )
-        .await
-        .expect("shutdown is not a maintenance failure");
-
-        assert_eq!(outcome, RetentionCatchUpOutcome::Shutdown);
-        assert_eq!(attempts.load(Ordering::Relaxed), 0);
-    }
-
-    #[tokio::test]
-    async fn retention_maintenance_retries_value_free_failures_and_stops_cleanly() {
-        let config = PostgresStatePlaneConfig::new(
-            "REGISTRY_NOTARY_RETENTION_TEST_DATABASE_URL_MUST_BE_UNSET",
-            None,
-            Duration::from_millis(10),
-            Duration::from_millis(10),
-            1,
-        )
-        .expect("test configuration is valid");
-        let sessions = Arc::new(SessionRegistry::default());
-        let manager = ConnectionFactory::new(&config, Arc::clone(&sessions))
-            .expect("test connection policy is valid");
-        let connections = PostgresSessionPool::builder(manager)
-            .max_size(config.max_connections())
-            .wait_timeout(Some(config.operation_timeout()))
-            .runtime(deadpool::Runtime::Tokio1)
-            .build()
-            .expect("test connection pool is valid");
-        let runtime = Arc::new(NotaryPostgresStatePlaneRuntime {
-            connections,
-            sessions,
-            retention_attempts: AtomicU64::new(0),
-        });
-        let maintenance = start_postgres_retention_maintenance_with_cadence(
-            Arc::clone(&runtime),
-            Duration::from_millis(5),
-        );
-
-        tokio::time::timeout(Duration::from_secs(1), async {
-            while runtime.retention_attempts.load(Ordering::Relaxed) < 2 {
-                tokio::time::sleep(Duration::from_millis(1)).await;
-            }
-        })
-        .await
-        .expect("maintenance retries after a value-free transient failure");
-        assert!(
-            !maintenance.task.is_finished(),
-            "maintenance failure must not stop the serving worker"
-        );
-        assert!(
-            !runtime.is_shutdown(),
-            "maintenance failure must not poison the request runtime"
-        );
-        assert_eq!(
-            runtime.readiness().await,
-            NotaryPostgresStatePlaneReadiness::DatabaseUnavailable,
-            "readiness must still perform its own database attestation"
-        );
-
-        maintenance.shutdown();
-        tokio::task::yield_now().await;
-        assert!(maintenance.task.is_finished());
-        let attempts_after_shutdown = runtime.retention_attempts.load(Ordering::Relaxed);
-        tokio::time::sleep(Duration::from_millis(20)).await;
-        assert_eq!(
-            runtime.retention_attempts.load(Ordering::Relaxed),
-            attempts_after_shutdown,
-            "stopped maintenance must not retry or open another connection"
-        );
-        drop(maintenance);
-        tokio::task::yield_now().await;
-        assert_eq!(Arc::strong_count(&runtime), 1);
-        runtime.shutdown();
-    }
-
-    #[tokio::test]
-    async fn shutdown_aborts_registered_drivers_and_rejects_registration() {
-        let registry = SessionRegistry::default();
-        let driver = tokio::spawn(async {
-            pending::<()>().await;
-            Ok::<(), tokio_postgres::Error>(())
-        });
-        let abort = driver.abort_handle();
-        let session_id = registry
-            .register(abort.clone())
-            .expect("driver registers before shutdown");
-        assert_eq!(session_id, 0);
-
-        registry.shutdown();
-        tokio::task::yield_now().await;
-        assert!(abort.is_finished());
-
-        let late_driver = tokio::spawn(async {
-            pending::<()>().await;
-            Ok::<(), tokio_postgres::Error>(())
-        });
-        let late_abort = late_driver.abort_handle();
-        assert_eq!(
-            registry.register(late_abort.clone()),
-            Err(NotaryPostgresStatePlaneError::Shutdown)
-        );
-        tokio::task::yield_now().await;
-        assert!(late_abort.is_finished());
-
-        driver.abort();
-        late_driver.abort();
-    }
-
-    #[test]
-    fn readiness_codes_and_errors_are_value_free() {
-        let readiness = [
-            NotaryPostgresStatePlaneReadiness::Ready,
-            NotaryPostgresStatePlaneReadiness::ConfigurationInvalid,
-            NotaryPostgresStatePlaneReadiness::DatabaseUnavailable,
-            NotaryPostgresStatePlaneReadiness::UnsupportedServerMajor,
-            NotaryPostgresStatePlaneReadiness::DatabaseNotWritable,
-            NotaryPostgresStatePlaneReadiness::UnsafeDurability,
-            NotaryPostgresStatePlaneReadiness::SchemaIncompatible,
-            NotaryPostgresStatePlaneReadiness::RoleIncompatible,
-            NotaryPostgresStatePlaneReadiness::Shutdown,
-        ];
-        for state in readiness {
-            let rendered = format!("{state:?} {}", state.code());
-            assert!(!rendered.contains("sentinel"));
-            assert!(!rendered.contains("postgresql://"));
-        }
-
-        let errors = [
-            NotaryPostgresStatePlaneError::InvalidConfiguration,
-            NotaryPostgresStatePlaneError::InvalidTimeout,
-            NotaryPostgresStatePlaneError::DatabaseUrlUnavailable,
-            NotaryPostgresStatePlaneError::InvalidDatabaseUrl,
-            NotaryPostgresStatePlaneError::TlsRequired,
-            NotaryPostgresStatePlaneError::InvalidRootCertificatePath,
-            NotaryPostgresStatePlaneError::RootCertificateUnavailable,
-            NotaryPostgresStatePlaneError::RootCertificateTooLarge,
-            NotaryPostgresStatePlaneError::InvalidRootCertificate,
-            NotaryPostgresStatePlaneError::InvalidTlsConfiguration,
-            NotaryPostgresStatePlaneError::DatabaseUnavailable,
-            NotaryPostgresStatePlaneError::UnsupportedServerMajor,
-            NotaryPostgresStatePlaneError::DatabaseNotWritable,
-            NotaryPostgresStatePlaneError::UnsafeDurability,
-            NotaryPostgresStatePlaneError::SchemaIncompatible,
-            NotaryPostgresStatePlaneError::RoleIncompatible,
-            NotaryPostgresStatePlaneError::OperationUnavailable,
-            NotaryPostgresStatePlaneError::Shutdown,
-        ];
-        for error in errors {
-            let rendered = format!("{error:?} {error}");
-            assert!(!rendered.contains("sentinel"));
-            assert!(!rendered.contains("postgresql://"));
-        }
-    }
-
-    #[test]
-    fn runtime_errors_map_to_closed_doctor_component_codes() {
-        let cases = [
-            (
-                NotaryPostgresStatePlaneError::InvalidConfiguration,
-                "configuration_invalid",
-            ),
-            (
-                NotaryPostgresStatePlaneError::DatabaseUnavailable,
-                "database_unavailable",
-            ),
-            (
-                NotaryPostgresStatePlaneError::SchemaIncompatible,
-                "schema_incompatible",
-            ),
-            (
-                NotaryPostgresStatePlaneError::RoleIncompatible,
-                "role_incompatible",
-            ),
-        ];
-        for (error, expected) in cases {
-            assert_eq!(
-                NotaryPostgresStatePlaneReadiness::from_error(error).doctor_component_code(),
-                expected
-            );
-        }
-    }
-}
diff --git a/crates/registry-notary-server/src/state_plane/sensitive.rs b/crates/registry-notary-server/src/state_plane/sensitive.rs
deleted file mode 100644
index d868b0aa1..000000000
--- a/crates/registry-notary-server/src/state_plane/sensitive.rs
+++ /dev/null
@@ -1,1381 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Encrypted PostgreSQL state for the OID4VCI pre-authorized-code flow.
-//!
-//! The database sees a keyed login identifier, an authenticated ciphertext for
-//! the eSignet login state, a keyed transaction-code verifier, and stable
-//! one-way replay identifiers. The master key is read only at the asynchronous
-//! state-plane activation boundary and is never retained as text.
-
-use std::{env, sync::Arc};
-
-use aws_lc_rs::{
-    aead::{Aad, Nonce, RandomizedNonceKey, AES_256_GCM},
-    hmac,
-};
-use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
-use registry_platform_replay::ReplayScope;
-use serde::{Deserialize, Serialize};
-use serde_json::Value;
-use subtle::ConstantTimeEq;
-use thiserror::Error;
-use time::OffsetDateTime;
-use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};
-
-use super::{NotaryPostgresStatePlaneError, NotaryPostgresStatePlaneRuntime};
-use crate::{
-    machine_quota::MachineQuotaOperationFence,
-    preauth_state::{
-        decode_hash_uri, validate_registry_client_offer_structure, CredentialMaterialization,
-        IssuanceTransaction, LiveIssuanceTransaction, LoginState, PreauthorizationStateError,
-        RegistryClientOfferPreflightOutcome, RegistryClientOfferReservation,
-        RegistryClientOfferReservationOutcome, RegistryClientOfferResponse,
-        VerifiedTransactionCode,
-    },
-    replay::{replay_identifier_hash, replay_scope_hash},
-};
-
-const KEY_BYTES: usize = 32;
-const LOGIN_RECORD_VERSION: u8 = 1;
-const ISSUANCE_RECORD_VERSION: u8 = 1;
-const KDF_CONTEXT: &[u8] = b"registry-notary/preauthorization/kdf/v1";
-const LOGIN_AAD_CONTEXT: &[u8] = b"registry-notary/preauthorization/login-aad/v1";
-const STATE_IDENTIFIER_CONTEXT: &[u8] = b"login-state";
-const PIN_VERIFIER_CONTEXT: &[u8] = b"transaction-code";
-const ISSUANCE_TRANSACTION_CONTEXT: &[u8] = b"oid4vci-issuance-transaction";
-const ISSUANCE_NONCE_CONTEXT: &[u8] = b"oid4vci-token-nonce";
-const ISSUANCE_HOLDER_CONTEXT: &[u8] = b"oid4vci-holder-thumbprint";
-const ISSUANCE_REQUEST_CONTEXT: &[u8] = b"oid4vci-credential-request";
-const ISSUANCE_RECORD_AAD_CONTEXT: &[u8] = b"registry-notary/oid4vci/transaction-aad/v1";
-const ISSUANCE_RESPONSE_AAD_CONTEXT: &[u8] = b"registry-notary/oid4vci/response-aad/v1";
-const EVALUATION_ISSUANCE_CONTEXT: &[u8] = b"oid4vci-evaluation-issuance";
-const REGISTRY_CLIENT_OFFER_RESPONSE_AAD_CONTEXT: &[u8] =
-    b"registry-notary/oid4vci/registry-client-offer-response-aad/v1";
-
-/// The configured environment variable name is retained, but its value is
-/// read only by [`PostgresSensitiveState::activate`].
-#[derive(Clone)]
-pub(crate) struct SensitiveStateKeyConfig {
-    environment: String,
-}
-
-impl SensitiveStateKeyConfig {
-    pub(crate) fn new(environment: impl Into<String>) -> Result<Self, SensitiveStateError> {
-        let environment = environment.into();
-        if environment.trim().is_empty() {
-            return Err(SensitiveStateError::InvalidKeyConfiguration);
-        }
-        Ok(Self { environment })
-    }
-}
-
-impl std::fmt::Debug for SensitiveStateKeyConfig {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("SensitiveStateKeyConfig")
-            .field("environment", &"<redacted>")
-            .finish()
-    }
-}
-
-/// Closed, value-free failures for sensitive state activation and operations.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
-pub enum SensitiveStateError {
-    #[error("Notary sensitive-state key configuration is invalid")]
-    InvalidKeyConfiguration,
-    #[error("Notary sensitive-state key environment variable is unavailable")]
-    KeyEnvironmentUnavailable,
-    #[error("Notary sensitive-state key must be unpadded base64url")]
-    InvalidKeyEncoding,
-    #[error("Notary sensitive-state key must decode to exactly 32 bytes")]
-    InvalidKeyLength,
-    #[error("Notary sensitive-state cryptographic operation is unavailable")]
-    CryptographyUnavailable,
-    #[error("Notary sensitive state was not activated before use")]
-    NotActivated,
-    #[error("Notary sensitive-state record is invalid or cannot be decrypted")]
-    InvalidStoredRecord,
-    #[error(transparent)]
-    StatePlane(#[from] NotaryPostgresStatePlaneError),
-}
-
-/// Typed adapter for Notary-owned preauthorization PostgreSQL transactions.
-pub(crate) struct PostgresSensitiveState {
-    runtime: Arc<NotaryPostgresStatePlaneRuntime>,
-    keys: Arc<SensitiveStateKeys>,
-}
-
-impl PostgresSensitiveState {
-    /// Load and derive sensitive state keys at the asynchronous activation
-    /// boundary. No caller can perform a PostgreSQL preauthorization operation
-    /// before this succeeds.
-    pub(crate) async fn activate(
-        runtime: Arc<NotaryPostgresStatePlaneRuntime>,
-        config: &SensitiveStateKeyConfig,
-    ) -> Result<Self, SensitiveStateError> {
-        let encoded = Zeroizing::new(
-            env::var(&config.environment)
-                .map_err(|_| SensitiveStateError::KeyEnvironmentUnavailable)?,
-        );
-        if encoded.trim().is_empty() {
-            return Err(SensitiveStateError::KeyEnvironmentUnavailable);
-        }
-        let master = decode_master_key(&encoded)?;
-        let keys = SensitiveStateKeys::derive(&master);
-        let state = Self {
-            runtime,
-            keys: Arc::new(keys),
-        };
-        state.attest_key_generation().await?;
-        Ok(state)
-    }
-
-    /// Re-attest that every live encrypted or keyed preauthorization record
-    /// belongs to this process key generation. This is intentionally checked
-    /// during activation and on every readiness probe so a restore with the
-    /// wrong operator key cannot become ready.
-    pub(crate) async fn attest_key_generation(&self) -> Result<(), SensitiveStateError> {
-        let session = self.runtime.open_domain_session().await?;
-        let row = session
-            .run_operation(session.client().query_one(
-                "SELECT registry_notary_api.preauthorization_key_attest_v1($1::bytea) AS attested",
-                &[&&self.keys.key_id[..]],
-            ))
-            .await?;
-        if row
-            .try_get::<_, bool>("attested")
-            .map_err(|_| SensitiveStateError::InvalidStoredRecord)?
-        {
-            Ok(())
-        } else {
-            Err(SensitiveStateError::InvalidStoredRecord)
-        }
-    }
-
-    pub(crate) async fn reserve_login(
-        &self,
-        opaque_state: &str,
-        login: &LoginState,
-        expires_at: OffsetDateTime,
-    ) -> Result<LoginReserveOutcome, SensitiveStateError> {
-        let expires_at = normalize_expiry(expires_at)?;
-        let state_hash = self
-            .keys
-            .identifier_hash(STATE_IDENTIFIER_CONTEXT, opaque_state);
-        let aad = login_aad(
-            &state_hash,
-            &self.keys.key_id,
-            &login.credential_configuration_id,
-            expires_at,
-        )?;
-        let plaintext = EncryptedLoginState {
-            version: LOGIN_RECORD_VERSION,
-            pkce_verifier: &login.pkce_verifier,
-            nonce: &login.nonce,
-            representative: login.representative.as_ref(),
-            csrf_token: login.csrf_token.as_deref(),
-        };
-        let mut ciphertext = Zeroizing::new(
-            serde_json::to_vec(&plaintext)
-                .map_err(|_| SensitiveStateError::CryptographyUnavailable)?,
-        );
-        let aead = RandomizedNonceKey::new(&AES_256_GCM, &self.keys.aead)
-            .map_err(|_| SensitiveStateError::CryptographyUnavailable)?;
-        let nonce = aead
-            .seal_in_place_append_tag(Aad::from(aad.as_slice()), &mut *ciphertext)
-            .map_err(|_| SensitiveStateError::CryptographyUnavailable)?;
-        let nonce = nonce.as_ref().as_slice();
-        let session = self.runtime.open_domain_session().await?;
-        let row = session
-            .run_operation(session.client().query_one(
-                "SELECT registry_notary_api.preauthorization_login_reserve_v1(\
-                     $1::bytea, $2::text, $3::bytea, $4::bytea, $5::bytea, $6::timestamptz)",
-                &[
-                    &&state_hash[..],
-                    &login.credential_configuration_id,
-                    &&self.keys.key_id[..],
-                    &nonce,
-                    &&ciphertext[..],
-                    &expires_at,
-                ],
-            ))
-            .await?;
-        match row.get::<_, i16>(0) {
-            1 => Ok(LoginReserveOutcome::Reserved),
-            0 => Ok(LoginReserveOutcome::Duplicate),
-            -1 => Ok(LoginReserveOutcome::Capacity),
-            _ => Err(SensitiveStateError::InvalidStoredRecord),
-        }
-    }
-
-    pub(crate) async fn consume_login(
-        &self,
-        opaque_state: &str,
-    ) -> Result<Option<LoginState>, SensitiveStateError> {
-        let state_hash = self
-            .keys
-            .identifier_hash(STATE_IDENTIFIER_CONTEXT, opaque_state);
-        let session = self.runtime.open_domain_session().await?;
-        let row = session
-            .run_operation(session.client().query_opt(
-                "SELECT credential_configuration_id, key_id, aead_nonce, ciphertext, expires_at \
-                   FROM registry_notary_api.preauthorization_login_consume_v1($1::bytea)",
-                &[&&state_hash[..]],
-            ))
-            .await?;
-        let Some(row) = row else {
-            return Ok(None);
-        };
-        let configuration_id: String = row.get(0);
-        let key_id: Vec<u8> = row.get(1);
-        let nonce: Vec<u8> = row.get(2);
-        let mut ciphertext = Zeroizing::new(row.get::<_, Vec<u8>>(3));
-        let expires_at: OffsetDateTime = row.get(4);
-        if key_id.ct_eq(&self.keys.key_id).unwrap_u8() != 1 {
-            return Err(SensitiveStateError::InvalidStoredRecord);
-        }
-        let nonce = Nonce::try_assume_unique_for_key(&nonce)
-            .map_err(|_| SensitiveStateError::InvalidStoredRecord)?;
-        let aad = login_aad(
-            &state_hash,
-            &self.keys.key_id,
-            &configuration_id,
-            expires_at,
-        )?;
-        let aead = RandomizedNonceKey::new(&AES_256_GCM, &self.keys.aead)
-            .map_err(|_| SensitiveStateError::CryptographyUnavailable)?;
-        let plaintext = aead
-            .open_in_place(nonce, Aad::from(aad.as_slice()), &mut ciphertext)
-            .map_err(|_| SensitiveStateError::InvalidStoredRecord)?;
-        let mut decrypted = Zeroizing::new(
-            serde_json::from_slice::<DecryptedLoginState>(plaintext)
-                .map_err(|_| SensitiveStateError::InvalidStoredRecord)?,
-        );
-        if decrypted.version != LOGIN_RECORD_VERSION {
-            return Err(SensitiveStateError::InvalidStoredRecord);
-        }
-        Ok(Some(LoginState {
-            pkce_verifier: std::mem::take(&mut decrypted.pkce_verifier),
-            nonce: std::mem::take(&mut decrypted.nonce),
-            credential_configuration_id: configuration_id,
-            representative: decrypted.representative.take(),
-            csrf_token: decrypted.csrf_token.take(),
-        }))
-    }
-
-    pub(crate) async fn reserve_issuance_transaction(
-        &self,
-        transaction_id: &str,
-        transaction: &IssuanceTransaction,
-        expires_at: OffsetDateTime,
-    ) -> Result<IssuanceReserveOutcome, SensitiveStateError> {
-        let expires_at = normalize_expiry(expires_at)?;
-        let transaction_hash = self
-            .keys
-            .identifier_hash(ISSUANCE_TRANSACTION_CONTEXT, transaction_id);
-        let aad = issuance_record_aad(
-            &transaction_hash,
-            &self.keys.key_id,
-            &transaction.credential_configuration_id,
-            &transaction.commitment,
-            expires_at,
-        )?;
-        let plaintext = EncryptedIssuanceTransaction {
-            version: ISSUANCE_RECORD_VERSION,
-            transaction,
-        };
-        let plaintext = serde_json::to_vec(&plaintext)
-            .map_err(|_| SensitiveStateError::CryptographyUnavailable)?;
-        let (nonce, ciphertext) = seal(&self.keys.aead, &aad, &plaintext)?;
-        let session = self.runtime.open_domain_session().await?;
-        let row = session
-            .run_operation(session.client().query_one(
-                "SELECT registry_notary_api.oid4vci_transaction_reserve_v1(\
-                     $1::bytea, $2::bytea, $3::text, $4::text, $5::bytea, $6::bytea, $7::timestamptz)",
-                &[
-                    &&transaction_hash[..],
-                    &&self.keys.key_id[..],
-                    &transaction.credential_configuration_id,
-                    &transaction.commitment,
-                    &nonce,
-                    &ciphertext,
-                    &expires_at,
-                ],
-            ))
-            .await?;
-        match row.get::<_, i16>(0) {
-            1 => Ok(IssuanceReserveOutcome::Reserved),
-            0 => Ok(IssuanceReserveOutcome::Duplicate),
-            -1 => Ok(IssuanceReserveOutcome::Capacity),
-            _ => Err(SensitiveStateError::InvalidStoredRecord),
-        }
-    }
-
-    #[cfg(test)]
-    pub(crate) async fn reserve_registry_client_offer(
-        &self,
-        reservation: RegistryClientOfferReservation,
-    ) -> Result<RegistryClientOfferReservationOutcome, PreauthorizationStateError> {
-        self.reserve_registry_client_offer_with_fence(reservation, None)
-            .await
-    }
-
-    pub(crate) async fn reserve_registry_client_offer_fenced(
-        &self,
-        reservation: RegistryClientOfferReservation,
-        fence: &MachineQuotaOperationFence,
-    ) -> Result<RegistryClientOfferReservationOutcome, PreauthorizationStateError> {
-        self.reserve_registry_client_offer_with_fence(reservation, Some(fence))
-            .await
-    }
-
-    async fn reserve_registry_client_offer_with_fence(
-        &self,
-        reservation: RegistryClientOfferReservation,
-        fence: Option<&MachineQuotaOperationFence>,
-    ) -> Result<RegistryClientOfferReservationOutcome, PreauthorizationStateError> {
-        validate_registry_client_offer_structure(&reservation)?;
-        if fence.is_some_and(|fence| {
-            reservation.quota_principal_hash.as_slice() != fence.principal_hash()
-        }) {
-            return Err(PreauthorizationStateError::OperationLeaseLost);
-        }
-        let idempotency_hash = decode_hash_uri(&reservation.idempotency_key_hash, "hmac-sha256:")?;
-        let request_hash = decode_hash_uri(&reservation.canonical_request_hash, "sha256:")?;
-        let evaluation_hash = self.keys.identifier_hash_fields(
-            EVALUATION_ISSUANCE_CONTEXT,
-            &[
-                reservation.evaluation_id.as_bytes(),
-                reservation.transaction.evaluation_client_id.as_bytes(),
-            ],
-        );
-        let transaction_hash = self
-            .keys
-            .identifier_hash(ISSUANCE_TRANSACTION_CONTEXT, &reservation.transaction_id);
-        let jti_hash = replay_identifier_hash(&reservation.transaction_id);
-        let transaction_expires_at = normalize_expiry(reservation.transaction_expires_at)?;
-        let code_expires_at = normalize_expiry(reservation.code_expires_at)?;
-        let retention_expires_at = normalize_expiry(reservation.retention_expires_at)?;
-        let evaluation_expires_at = normalize_expiry(reservation.evaluation_expires_at)?;
-
-        let record_aad = issuance_record_aad(
-            &transaction_hash,
-            &self.keys.key_id,
-            &reservation.transaction.credential_configuration_id,
-            &reservation.transaction.commitment,
-            transaction_expires_at,
-        )?;
-        let record_plaintext = Zeroizing::new(
-            serde_json::to_vec(&EncryptedIssuanceTransaction {
-                version: ISSUANCE_RECORD_VERSION,
-                transaction: &reservation.transaction,
-            })
-            .map_err(|_| SensitiveStateError::CryptographyUnavailable)?,
-        );
-        let (record_nonce, record_ciphertext) =
-            seal(&self.keys.aead, &record_aad, &record_plaintext)?;
-
-        let response_aad = registry_client_offer_response_aad(
-            &idempotency_hash,
-            &request_hash,
-            &self.keys.key_id,
-            retention_expires_at,
-        )?;
-        let response_plaintext = Zeroizing::new(
-            serde_json::to_vec(&reservation.response)
-                .map_err(|_| SensitiveStateError::CryptographyUnavailable)?,
-        );
-        let (response_nonce, response_ciphertext) =
-            seal(&self.keys.aead, &response_aad, &response_plaintext)?;
-
-        let pin_length = reservation
-            .transaction_code
-            .as_ref()
-            .map(|code| {
-                i16::try_from(code.pin_length).map_err(|_| PreauthorizationStateError::Unavailable)
-            })
-            .transpose()?;
-        let pin_verifier = reservation
-            .transaction_code
-            .as_ref()
-            .map(|code| self.keys.pin_verifier(&jti_hash, &code.pin));
-        let pin_verifier_parameter = pin_verifier.as_ref().map(<[u8; KEY_BYTES]>::as_slice);
-        let quota_operation_hash = fence.map(|fence| &fence.operation_hash()[..]);
-        let quota_lease_owner_hash = fence.map(|fence| &fence.lease_owner_hash()[..]);
-
-        let session = self
-            .runtime
-            .open_domain_session()
-            .await
-            .map_err(SensitiveStateError::from)?;
-        let row = session
-            .run_operation(session.client().query_one(
-                "SELECT * FROM registry_notary_api.registry_client_offer_reserve_v1(\
-                     $1::bytea, $2::bytea, $3::bytea, $4::bytea, $5::bytea, $6::bytea, \
-                     $7::text, $8::text, $9::bytea, $10::bytea, $11::timestamptz, \
-                     $12::bytea, $13::smallint, $14::timestamptz, $15::bytea, \
-                     $16::bytea, $17::timestamptz, $18::timestamptz, $19::bytea, \
-                     $20::integer, $21::integer, $22::bytea, $23::bytea)",
-                &[
-                    &&idempotency_hash[..],
-                    &&request_hash[..],
-                    &&evaluation_hash[..],
-                    &&transaction_hash[..],
-                    &&jti_hash[..],
-                    &&self.keys.key_id[..],
-                    &reservation.transaction.credential_configuration_id,
-                    &reservation.transaction.commitment,
-                    &record_nonce,
-                    &record_ciphertext,
-                    &transaction_expires_at,
-                    &pin_verifier_parameter,
-                    &pin_length,
-                    &code_expires_at,
-                    &response_nonce,
-                    &response_ciphertext,
-                    &retention_expires_at,
-                    &evaluation_expires_at,
-                    &reservation.quota_principal_hash,
-                    &reservation.quota_limit,
-                    &reservation.quota_cost,
-                    &quota_operation_hash,
-                    &quota_lease_owner_hash,
-                ],
-            ))
-            .await
-            .map_err(SensitiveStateError::from)?;
-        match row.get::<_, i16>("outcome") {
-            1 => Ok(RegistryClientOfferReservationOutcome::Created(
-                reservation.response,
-            )),
-            2 => {
-                let key_id: Vec<u8> = row.get("key_id");
-                if key_id.ct_eq(&self.keys.key_id).unwrap_u8() != 1 {
-                    return Err(SensitiveStateError::InvalidStoredRecord.into());
-                }
-                let stored_retention_expires_at: OffsetDateTime = row.get("retention_expires_at");
-                let nonce: Vec<u8> = row.get("response_aead_nonce");
-                let mut ciphertext = Zeroizing::new(row.get::<_, Vec<u8>>("response_ciphertext"));
-                let aad = registry_client_offer_response_aad(
-                    &idempotency_hash,
-                    &request_hash,
-                    &key_id,
-                    stored_retention_expires_at,
-                )?;
-                let plaintext = open(&self.keys.aead, &aad, &nonce, &mut ciphertext)?;
-                let response: RegistryClientOfferResponse = serde_json::from_slice(plaintext)
-                    .map_err(|_| SensitiveStateError::InvalidStoredRecord)?;
-                Ok(RegistryClientOfferReservationOutcome::Replayed(response))
-            }
-            0 => Err(PreauthorizationStateError::IdempotencyConflict),
-            -1 => Err(PreauthorizationStateError::IssuanceTransactionCapacity),
-            -2 => Err(PreauthorizationStateError::EvaluationConsumed),
-            -3 => Err(PreauthorizationStateError::DuplicateIssuanceTransaction),
-            -4 => Err(PreauthorizationStateError::InvalidExpiry),
-            -5 => {
-                let retry_after_seconds: i64 = row
-                    .try_get("retry_after_seconds")
-                    .map_err(|_| SensitiveStateError::InvalidStoredRecord)?;
-                Err(PreauthorizationStateError::MachineQuotaExceeded {
-                    retry_after_seconds: retry_after_seconds.max(1) as u64,
-                })
-            }
-            -6 => Err(PreauthorizationStateError::OperationLeaseLost),
-            _ => Err(SensitiveStateError::InvalidStoredRecord.into()),
-        }
-    }
-
-    pub(crate) async fn registry_client_offer_preflight(
-        &self,
-        evaluation_id: &str,
-        evaluation_client_id: &str,
-        idempotency_key_hash: &str,
-        canonical_request_hash: &str,
-    ) -> Result<RegistryClientOfferPreflightOutcome, PreauthorizationStateError> {
-        if evaluation_id.is_empty() || evaluation_client_id.is_empty() {
-            return Err(PreauthorizationStateError::Unavailable);
-        }
-        let idempotency_hash = decode_hash_uri(idempotency_key_hash, "hmac-sha256:")?;
-        let request_hash = decode_hash_uri(canonical_request_hash, "sha256:")?;
-        let evaluation_hash = self.keys.identifier_hash_fields(
-            EVALUATION_ISSUANCE_CONTEXT,
-            &[evaluation_id.as_bytes(), evaluation_client_id.as_bytes()],
-        );
-        let session = self
-            .runtime
-            .open_domain_session()
-            .await
-            .map_err(SensitiveStateError::from)?;
-        let row = session
-            .run_operation(session.client().query_one(
-                "SELECT * FROM registry_notary_api.registry_client_offer_preflight_v1(\
-                     $1::bytea, $2::bytea, $3::bytea, $4::bytea)",
-                &[
-                    &&idempotency_hash[..],
-                    &&request_hash[..],
-                    &&evaluation_hash[..],
-                    &&self.keys.key_id[..],
-                ],
-            ))
-            .await
-            .map_err(SensitiveStateError::from)?;
-        match row.get::<_, i16>("outcome") {
-            1 => Ok(RegistryClientOfferPreflightOutcome::Available),
-            2 => {
-                let key_id: Vec<u8> = row.get("key_id");
-                if key_id.ct_eq(&self.keys.key_id).unwrap_u8() != 1 {
-                    return Err(SensitiveStateError::InvalidStoredRecord.into());
-                }
-                let retention_expires_at: OffsetDateTime = row.get("retention_expires_at");
-                let nonce: Vec<u8> = row.get("response_aead_nonce");
-                let mut ciphertext = Zeroizing::new(row.get::<_, Vec<u8>>("response_ciphertext"));
-                let aad = registry_client_offer_response_aad(
-                    &idempotency_hash,
-                    &request_hash,
-                    &key_id,
-                    retention_expires_at,
-                )?;
-                let plaintext = open(&self.keys.aead, &aad, &nonce, &mut ciphertext)?;
-                let response: RegistryClientOfferResponse = serde_json::from_slice(plaintext)
-                    .map_err(|_| SensitiveStateError::InvalidStoredRecord)?;
-                Ok(RegistryClientOfferPreflightOutcome::Replayed(response))
-            }
-            0 => Ok(RegistryClientOfferPreflightOutcome::IdempotencyConflict),
-            -2 => Ok(RegistryClientOfferPreflightOutcome::EvaluationConsumed),
-            _ => Err(SensitiveStateError::InvalidStoredRecord.into()),
-        }
-    }
-
-    pub(crate) async fn reserve_evaluation_issuance(
-        &self,
-        evaluation_id: &str,
-        evaluation_client_id: &str,
-        evaluation_expires_at: OffsetDateTime,
-    ) -> Result<(), PreauthorizationStateError> {
-        if evaluation_id.is_empty() || evaluation_client_id.is_empty() {
-            return Err(PreauthorizationStateError::Unavailable);
-        }
-        if evaluation_expires_at <= OffsetDateTime::now_utc() {
-            return Err(PreauthorizationStateError::InvalidExpiry);
-        }
-        let evaluation_hash = self.keys.identifier_hash_fields(
-            EVALUATION_ISSUANCE_CONTEXT,
-            &[evaluation_id.as_bytes(), evaluation_client_id.as_bytes()],
-        );
-        let evaluation_expires_at = normalize_expiry(evaluation_expires_at)?;
-        let session = self
-            .runtime
-            .open_domain_session()
-            .await
-            .map_err(SensitiveStateError::from)?;
-        let row = session
-            .run_operation(session.client().query_one(
-                "SELECT registry_notary_api.evaluation_issuance_consume_v1(\
-                     $1::bytea, $2::bytea, $3::timestamptz)",
-                &[
-                    &&evaluation_hash[..],
-                    &&self.keys.key_id[..],
-                    &evaluation_expires_at,
-                ],
-            ))
-            .await
-            .map_err(SensitiveStateError::from)?;
-        match row.get::<_, i16>(0) {
-            1 => Ok(()),
-            0 => Err(PreauthorizationStateError::EvaluationConsumed),
-            -1 => Err(PreauthorizationStateError::IssuanceTransactionCapacity),
-            _ => Err(SensitiveStateError::InvalidStoredRecord.into()),
-        }
-    }
-
-    pub(crate) async fn issuance_transaction(
-        &self,
-        transaction_id: &str,
-    ) -> Result<Option<LiveIssuanceTransaction>, SensitiveStateError> {
-        let transaction_hash = self
-            .keys
-            .identifier_hash(ISSUANCE_TRANSACTION_CONTEXT, transaction_id);
-        let session = self.runtime.open_domain_session().await?;
-        let row = session
-            .run_operation(session.client().query_opt(
-                "SELECT * FROM registry_notary_api.oid4vci_transaction_get_v1($1::bytea)",
-                &[&&transaction_hash[..]],
-            ))
-            .await?;
-        row.map(|row| {
-            Ok(LiveIssuanceTransaction {
-                transaction: self.decrypt_issuance_transaction(&transaction_hash, &row)?,
-                expires_at: row.get("expires_at"),
-            })
-        })
-        .transpose()
-    }
-
-    pub(crate) async fn bind_issuance_nonce(
-        &self,
-        transaction_id: &str,
-        commitment: &str,
-        nonce: &str,
-    ) -> Result<bool, SensitiveStateError> {
-        let transaction_hash = self
-            .keys
-            .identifier_hash(ISSUANCE_TRANSACTION_CONTEXT, transaction_id);
-        let nonce_hash = self.keys.identifier_hash(ISSUANCE_NONCE_CONTEXT, nonce);
-        let session = self.runtime.open_domain_session().await?;
-        let row = session
-            .run_operation(session.client().query_one(
-                "SELECT registry_notary_api.oid4vci_transaction_bind_nonce_v1(\
-                     $1::bytea, $2::text, $3::bytea)",
-                &[&&transaction_hash[..], &commitment, &&nonce_hash[..]],
-            ))
-            .await?;
-        Ok(row.try_get::<_, Option<bool>>(0).ok().flatten() == Some(true))
-    }
-
-    pub(crate) async fn begin_issuance_materialization(
-        &self,
-        transaction_id: &str,
-        commitment: &str,
-        configuration_id: &str,
-        nonce: &str,
-        holder_thumbprint: &str,
-        request_hash: &str,
-    ) -> Result<CredentialMaterialization, SensitiveStateError> {
-        let transaction_hash = self
-            .keys
-            .identifier_hash(ISSUANCE_TRANSACTION_CONTEXT, transaction_id);
-        let nonce_hash = self.keys.identifier_hash(ISSUANCE_NONCE_CONTEXT, nonce);
-        let holder_hash = self
-            .keys
-            .identifier_hash(ISSUANCE_HOLDER_CONTEXT, holder_thumbprint);
-        let request_hash = self
-            .keys
-            .identifier_hash(ISSUANCE_REQUEST_CONTEXT, request_hash);
-        let session = self.runtime.open_domain_session().await?;
-        let row = session
-            .run_operation(session.client().query_one(
-                "SELECT * FROM registry_notary_api.oid4vci_transaction_begin_v1(\
-                     $1::bytea, $2::text, $3::text, $4::bytea, $5::bytea, $6::bytea)",
-                &[
-                    &&transaction_hash[..],
-                    &commitment,
-                    &configuration_id,
-                    &&nonce_hash[..],
-                    &&holder_hash[..],
-                    &&request_hash[..],
-                ],
-            ))
-            .await?;
-        match row.get::<_, i16>("outcome") {
-            1 => self
-                .decrypt_issuance_transaction(&transaction_hash, &row)
-                .map(CredentialMaterialization::Acquired),
-            2 => {
-                let transaction = self.decrypt_issuance_transaction(&transaction_hash, &row)?;
-                let key_id: Vec<u8> = row.get("key_id");
-                let expires_at: OffsetDateTime = row.get("expires_at");
-                let response_nonce: Vec<u8> = row.get("response_aead_nonce");
-                let mut response_ciphertext: Vec<u8> = row.get("response_ciphertext");
-                let aad = issuance_response_aad(
-                    &transaction_hash,
-                    &key_id,
-                    &holder_hash,
-                    &request_hash,
-                    expires_at,
-                )?;
-                let plaintext = open(
-                    &self.keys.aead,
-                    &aad,
-                    &response_nonce,
-                    &mut response_ciphertext,
-                )?;
-                let response: Value = serde_json::from_slice(plaintext)
-                    .map_err(|_| SensitiveStateError::InvalidStoredRecord)?;
-                if transaction.transaction_id != transaction_id {
-                    return Err(SensitiveStateError::InvalidStoredRecord);
-                }
-                Ok(CredentialMaterialization::Cached(response))
-            }
-            0 => Ok(CredentialMaterialization::Busy),
-            -1 => Ok(CredentialMaterialization::Denied),
-            _ => Err(SensitiveStateError::InvalidStoredRecord),
-        }
-    }
-
-    pub(crate) async fn complete_issuance_materialization(
-        &self,
-        transaction_id: &str,
-        holder_thumbprint: &str,
-        request_hash: &str,
-        response: &Value,
-    ) -> Result<bool, SensitiveStateError> {
-        let transaction_hash = self
-            .keys
-            .identifier_hash(ISSUANCE_TRANSACTION_CONTEXT, transaction_id);
-        let holder_hash = self
-            .keys
-            .identifier_hash(ISSUANCE_HOLDER_CONTEXT, holder_thumbprint);
-        let request_hash = self
-            .keys
-            .identifier_hash(ISSUANCE_REQUEST_CONTEXT, request_hash);
-        let session = self.runtime.open_domain_session().await?;
-        let record = session
-            .run_operation(session.client().query_opt(
-                "SELECT * FROM registry_notary_api.oid4vci_transaction_get_v1($1::bytea)",
-                &[&&transaction_hash[..]],
-            ))
-            .await?
-            .ok_or(SensitiveStateError::InvalidStoredRecord)?;
-        let key_id: Vec<u8> = record.get("key_id");
-        if key_id.ct_eq(&self.keys.key_id).unwrap_u8() != 1 {
-            return Err(SensitiveStateError::InvalidStoredRecord);
-        }
-        let expires_at: OffsetDateTime = record.get("expires_at");
-        let aad = issuance_response_aad(
-            &transaction_hash,
-            &key_id,
-            &holder_hash,
-            &request_hash,
-            expires_at,
-        )?;
-        let plaintext = serde_json::to_vec(response)
-            .map_err(|_| SensitiveStateError::CryptographyUnavailable)?;
-        let (nonce, ciphertext) = seal(&self.keys.aead, &aad, &plaintext)?;
-        let row = session
-            .run_operation(session.client().query_one(
-                "SELECT registry_notary_api.oid4vci_transaction_complete_v1(\
-                     $1::bytea, $2::bytea, $3::bytea, $4::bytea, $5::bytea)",
-                &[
-                    &&transaction_hash[..],
-                    &&holder_hash[..],
-                    &&request_hash[..],
-                    &nonce,
-                    &ciphertext,
-                ],
-            ))
-            .await?;
-        Ok(row.try_get::<_, Option<bool>>(0).ok().flatten() == Some(true))
-    }
-
-    pub(crate) async fn fail_issuance_materialization(
-        &self,
-        transaction_id: &str,
-        holder_thumbprint: &str,
-    ) -> Result<(), SensitiveStateError> {
-        let transaction_hash = self
-            .keys
-            .identifier_hash(ISSUANCE_TRANSACTION_CONTEXT, transaction_id);
-        let holder_hash = self
-            .keys
-            .identifier_hash(ISSUANCE_HOLDER_CONTEXT, holder_thumbprint);
-        let session = self.runtime.open_domain_session().await?;
-        session
-            .run_operation(session.client().query_opt(
-                "SELECT registry_notary_api.oid4vci_transaction_fail_v1($1::bytea, $2::bytea)",
-                &[&&transaction_hash[..], &&holder_hash[..]],
-            ))
-            .await?;
-        Ok(())
-    }
-
-    fn decrypt_issuance_transaction(
-        &self,
-        transaction_hash: &[u8; KEY_BYTES],
-        row: &tokio_postgres::Row,
-    ) -> Result<IssuanceTransaction, SensitiveStateError> {
-        let key_id: Vec<u8> = row.get("key_id");
-        let configuration_id: String = row.get("credential_configuration_id");
-        let commitment: String = row.get("commitment");
-        let nonce: Vec<u8> = row.get("record_aead_nonce");
-        let mut ciphertext: Vec<u8> = row.get("record_ciphertext");
-        let expires_at: OffsetDateTime = row.get("expires_at");
-        if key_id.ct_eq(&self.keys.key_id).unwrap_u8() != 1 {
-            return Err(SensitiveStateError::InvalidStoredRecord);
-        }
-        let aad = issuance_record_aad(
-            transaction_hash,
-            &self.keys.key_id,
-            &configuration_id,
-            &commitment,
-            expires_at,
-        )?;
-        let plaintext = open(&self.keys.aead, &aad, &nonce, &mut ciphertext)?;
-        let decrypted: DecryptedIssuanceTransaction = serde_json::from_slice(plaintext)
-            .map_err(|_| SensitiveStateError::InvalidStoredRecord)?;
-        if decrypted.version != ISSUANCE_RECORD_VERSION
-            || decrypted.transaction.credential_configuration_id != configuration_id
-            || decrypted.transaction.commitment != commitment
-        {
-            return Err(SensitiveStateError::InvalidStoredRecord);
-        }
-        Ok(decrypted.transaction)
-    }
-
-    pub(crate) async fn reserve_transaction_code(
-        &self,
-        jti: &str,
-        pin: &str,
-        pin_length: u64,
-        expires_at: OffsetDateTime,
-    ) -> Result<bool, SensitiveStateError> {
-        let expires_at = normalize_expiry(expires_at)?;
-        let pin_length =
-            i16::try_from(pin_length).map_err(|_| SensitiveStateError::InvalidStoredRecord)?;
-        let jti_hash = replay_identifier_hash(jti);
-        let verifier = self.keys.pin_verifier(&jti_hash, pin);
-        let session = self.runtime.open_domain_session().await?;
-        let row = session
-            .run_operation(session.client().query_one(
-                "SELECT registry_notary_api.preauthorization_tx_code_reserve_v1(\
-                     $1::bytea, $2::bytea, $3::bytea, $4::smallint, $5::timestamptz)",
-                &[
-                    &&jti_hash[..],
-                    &&self.keys.key_id[..],
-                    &&verifier[..],
-                    &pin_length,
-                    &expires_at,
-                ],
-            ))
-            .await?;
-        Ok(row.get(0))
-    }
-
-    /// Verify without mutating the transaction-code row. A wrong PIN returns
-    /// `None`, leaving the offer available for a bounded retry.
-    pub(crate) async fn verify_transaction_code(
-        &self,
-        jti: &str,
-        presented_pin: &str,
-    ) -> Result<Option<VerifiedTransactionCode>, SensitiveStateError> {
-        let jti_hash = replay_identifier_hash(jti);
-        let session = self.runtime.open_domain_session().await?;
-        let row = session
-            .run_operation(session.client().query_opt(
-                "SELECT key_id, pin_verifier, pin_length, expires_at \
-                   FROM registry_notary_api.preauthorization_tx_code_peek_v1($1::bytea)",
-                &[&&jti_hash[..]],
-            ))
-            .await?;
-        let Some(row) = row else {
-            return Ok(None);
-        };
-        let key_id: Vec<u8> = row.get(0);
-        let stored_verifier: Vec<u8> = row.get(1);
-        let pin_length: i16 = row.get(2);
-        let _expires_at: OffsetDateTime = row.get(3);
-        if key_id.ct_eq(&self.keys.key_id).unwrap_u8() != 1 || stored_verifier.len() != KEY_BYTES {
-            return Err(SensitiveStateError::InvalidStoredRecord);
-        }
-        let expected = self.keys.pin_verifier(&jti_hash, presented_pin);
-        let correct_length = usize::try_from(pin_length)
-            .ok()
-            .is_some_and(|length| presented_pin.len() == length);
-        if !correct_length || expected.ct_eq(stored_verifier.as_slice()).unwrap_u8() != 1 {
-            return Ok(None);
-        }
-        Ok(Some(VerifiedTransactionCode::new(jti_hash, expected)))
-    }
-
-    /// Return whether a live transaction-code verifier exists for this JTI.
-    /// This lets the typed redemption boundary reject a signed no-PIN policy
-    /// if storage contains a contradictory live PIN row.
-    pub(crate) async fn has_live_transaction_code(
-        &self,
-        jti: &str,
-    ) -> Result<bool, SensitiveStateError> {
-        let jti_hash = replay_identifier_hash(jti);
-        let session = self.runtime.open_domain_session().await?;
-        let row = session
-            .run_operation(session.client().query_opt(
-                "SELECT key_id \
-                   FROM registry_notary_api.preauthorization_tx_code_peek_v1($1::bytea)",
-                &[&&jti_hash[..]],
-            ))
-            .await?;
-        let Some(row) = row else {
-            return Ok(false);
-        };
-        let key_id: Vec<u8> = row.get(0);
-        if key_id.ct_eq(&self.keys.key_id).unwrap_u8() != 1 {
-            return Err(SensitiveStateError::InvalidStoredRecord);
-        }
-        Ok(true)
-    }
-
-    /// Atomically claim the stable replay identifier and remove the
-    /// transaction-code verifier. The proof is bound to the same JTI hash,
-    /// while the PIN verifier remains keyed independently.
-    pub(crate) async fn redeem(
-        &self,
-        scope: &ReplayScope,
-        jti: &str,
-        code_expires_at: OffsetDateTime,
-        transaction_code: Option<VerifiedTransactionCode>,
-    ) -> Result<bool, SensitiveStateError> {
-        let code_expires_at = normalize_expiry(code_expires_at)?;
-        let scope_hash = replay_scope_hash(scope);
-        let jti_hash = replay_identifier_hash(jti);
-        let expected_verifier = match transaction_code {
-            Some(proof) => Some(
-                proof
-                    .into_verifier_for(&jti_hash)
-                    .ok_or(SensitiveStateError::InvalidStoredRecord)?,
-            ),
-            None => None,
-        };
-        let pin_required = expected_verifier.is_some();
-        let expected_parameter = expected_verifier.as_ref().map(<[u8; KEY_BYTES]>::as_slice);
-        let session = self.runtime.open_domain_session().await?;
-        let row = session
-            .run_operation(session.client().query_one(
-                "SELECT registry_notary_api.preauthorization_redeem_v1(\
-                     $1::bytea, $2::bytea, $3::timestamptz, $4::boolean, $5::bytea)",
-                &[
-                    &&scope_hash[..],
-                    &&jti_hash[..],
-                    &code_expires_at,
-                    &pin_required,
-                    &expected_parameter,
-                ],
-            ))
-            .await?;
-        Ok(row.get(0))
-    }
-}
-
-impl std::fmt::Debug for PostgresSensitiveState {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("PostgresSensitiveState")
-            .finish_non_exhaustive()
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum LoginReserveOutcome {
-    Reserved,
-    Duplicate,
-    Capacity,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum IssuanceReserveOutcome {
-    Reserved,
-    Duplicate,
-    Capacity,
-}
-
-#[derive(Zeroize, ZeroizeOnDrop)]
-pub(crate) struct SensitiveStateKeys {
-    aead: [u8; KEY_BYTES],
-    pin_mac: [u8; KEY_BYTES],
-    identifier: [u8; KEY_BYTES],
-    key_id: [u8; KEY_BYTES],
-}
-
-impl SensitiveStateKeys {
-    pub(crate) fn random() -> Result<Self, SensitiveStateError> {
-        let mut master = Zeroizing::new([0_u8; KEY_BYTES]);
-        getrandom::fill(master.as_mut_slice())
-            .map_err(|_| SensitiveStateError::CryptographyUnavailable)?;
-        Ok(Self::derive(&master))
-    }
-
-    fn derive(master: &[u8; KEY_BYTES]) -> Self {
-        Self {
-            aead: derive_key(master, b"login-aead"),
-            pin_mac: derive_key(master, b"pin-mac"),
-            identifier: derive_key(master, b"identifier-mac"),
-            key_id: derive_key(master, b"key-id"),
-        }
-    }
-
-    pub(crate) fn identifier_hash(&self, domain: &[u8], value: &str) -> [u8; KEY_BYTES] {
-        hmac_framed(&self.identifier, &[domain, value.as_bytes()])
-    }
-
-    pub(crate) fn identifier_hash_fields(
-        &self,
-        domain: &[u8],
-        fields: &[&[u8]],
-    ) -> [u8; KEY_BYTES] {
-        let mut framed = Vec::with_capacity(fields.len() + 1);
-        framed.push(domain);
-        framed.extend_from_slice(fields);
-        hmac_framed(&self.identifier, &framed)
-    }
-
-    pub(crate) fn login_state_hash(&self, opaque_state: &str) -> [u8; KEY_BYTES] {
-        self.identifier_hash(STATE_IDENTIFIER_CONTEXT, opaque_state)
-    }
-
-    pub(crate) fn pin_verifier(&self, jti_hash: &[u8; KEY_BYTES], pin: &str) -> [u8; KEY_BYTES] {
-        hmac_framed(
-            &self.pin_mac,
-            &[PIN_VERIFIER_CONTEXT, jti_hash, pin.as_bytes()],
-        )
-    }
-}
-
-impl std::fmt::Debug for SensitiveStateKeys {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter
-            .debug_struct("SensitiveStateKeys")
-            .finish_non_exhaustive()
-    }
-}
-
-#[derive(Serialize)]
-struct EncryptedLoginState<'a> {
-    version: u8,
-    pkce_verifier: &'a str,
-    nonce: &'a str,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    representative: Option<&'a crate::preauth_state::AuthenticatedRepresentative>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    csrf_token: Option<&'a str>,
-}
-
-#[derive(Deserialize, Zeroize, ZeroizeOnDrop)]
-struct DecryptedLoginState {
-    version: u8,
-    pkce_verifier: String,
-    nonce: String,
-    #[serde(default)]
-    representative: Option<crate::preauth_state::AuthenticatedRepresentative>,
-    #[serde(default)]
-    csrf_token: Option<String>,
-}
-
-#[derive(Serialize)]
-struct EncryptedIssuanceTransaction<'a> {
-    version: u8,
-    transaction: &'a IssuanceTransaction,
-}
-
-#[derive(Deserialize)]
-struct DecryptedIssuanceTransaction {
-    version: u8,
-    transaction: IssuanceTransaction,
-}
-
-fn derive_key(master: &[u8; KEY_BYTES], label: &[u8]) -> [u8; KEY_BYTES] {
-    hmac_framed(master, &[KDF_CONTEXT, label])
-}
-
-fn hmac_framed(key_bytes: &[u8], fields: &[&[u8]]) -> [u8; KEY_BYTES] {
-    let key = hmac::Key::new(hmac::HMAC_SHA256, key_bytes);
-    let mut context = hmac::Context::with_key(&key);
-    for field in fields {
-        update_frame(&mut context, field);
-    }
-    tag_bytes(context.sign())
-}
-
-fn update_frame(context: &mut hmac::Context, value: &[u8]) {
-    context.update(&(value.len() as u64).to_be_bytes());
-    context.update(value);
-}
-
-fn tag_bytes(tag: hmac::Tag) -> [u8; KEY_BYTES] {
-    let mut bytes = [0_u8; KEY_BYTES];
-    bytes.copy_from_slice(tag.as_ref());
-    bytes
-}
-
-fn login_aad(
-    state_hash: &[u8; KEY_BYTES],
-    key_id: &[u8; KEY_BYTES],
-    configuration_id: &str,
-    expires_at: OffsetDateTime,
-) -> Result<Vec<u8>, SensitiveStateError> {
-    let mut aad = Vec::with_capacity(128 + configuration_id.len());
-    aad.extend_from_slice(LOGIN_AAD_CONTEXT);
-    aad.push(LOGIN_RECORD_VERSION);
-    aad.extend_from_slice(state_hash);
-    aad.extend_from_slice(key_id);
-    aad.extend_from_slice(&expires_at.unix_timestamp().to_be_bytes());
-    let length = u32::try_from(configuration_id.len())
-        .map_err(|_| SensitiveStateError::InvalidStoredRecord)?;
-    aad.extend_from_slice(&length.to_be_bytes());
-    aad.extend_from_slice(configuration_id.as_bytes());
-    Ok(aad)
-}
-
-fn issuance_record_aad(
-    transaction_hash: &[u8; KEY_BYTES],
-    key_id: &[u8],
-    configuration_id: &str,
-    commitment: &str,
-    expires_at: OffsetDateTime,
-) -> Result<Vec<u8>, SensitiveStateError> {
-    if key_id.len() != KEY_BYTES || !sha256_uri(commitment) {
-        return Err(SensitiveStateError::InvalidStoredRecord);
-    }
-    let mut aad = Vec::with_capacity(192 + configuration_id.len());
-    aad.extend_from_slice(ISSUANCE_RECORD_AAD_CONTEXT);
-    aad.push(ISSUANCE_RECORD_VERSION);
-    aad.extend_from_slice(transaction_hash);
-    aad.extend_from_slice(key_id);
-    aad.extend_from_slice(&expires_at.unix_timestamp().to_be_bytes());
-    append_aad_text(&mut aad, configuration_id)?;
-    append_aad_text(&mut aad, commitment)?;
-    Ok(aad)
-}
-
-fn sha256_uri(value: &str) -> bool {
-    value.strip_prefix("sha256:").is_some_and(|digest| {
-        digest.len() == 64
-            && digest
-                .bytes()
-                .all(|byte| byte.is_ascii_digit() || matches!(byte, b'a'..=b'f'))
-    })
-}
-
-fn issuance_response_aad(
-    transaction_hash: &[u8; KEY_BYTES],
-    key_id: &[u8],
-    holder_hash: &[u8; KEY_BYTES],
-    request_hash: &[u8; KEY_BYTES],
-    expires_at: OffsetDateTime,
-) -> Result<Vec<u8>, SensitiveStateError> {
-    if key_id.len() != KEY_BYTES {
-        return Err(SensitiveStateError::InvalidStoredRecord);
-    }
-    let mut aad = Vec::with_capacity(160);
-    aad.extend_from_slice(ISSUANCE_RESPONSE_AAD_CONTEXT);
-    aad.push(ISSUANCE_RECORD_VERSION);
-    aad.extend_from_slice(transaction_hash);
-    aad.extend_from_slice(key_id);
-    aad.extend_from_slice(holder_hash);
-    aad.extend_from_slice(request_hash);
-    aad.extend_from_slice(&expires_at.unix_timestamp().to_be_bytes());
-    Ok(aad)
-}
-
-fn registry_client_offer_response_aad(
-    idempotency_hash: &[u8; KEY_BYTES],
-    request_hash: &[u8; KEY_BYTES],
-    key_id: &[u8],
-    retention_expires_at: OffsetDateTime,
-) -> Result<Vec<u8>, SensitiveStateError> {
-    if key_id.len() != KEY_BYTES {
-        return Err(SensitiveStateError::InvalidStoredRecord);
-    }
-    let mut aad = Vec::with_capacity(144);
-    aad.extend_from_slice(REGISTRY_CLIENT_OFFER_RESPONSE_AAD_CONTEXT);
-    aad.push(ISSUANCE_RECORD_VERSION);
-    aad.extend_from_slice(idempotency_hash);
-    aad.extend_from_slice(request_hash);
-    aad.extend_from_slice(key_id);
-    aad.extend_from_slice(&retention_expires_at.unix_timestamp().to_be_bytes());
-    Ok(aad)
-}
-
-fn append_aad_text(aad: &mut Vec<u8>, value: &str) -> Result<(), SensitiveStateError> {
-    let length =
-        u32::try_from(value.len()).map_err(|_| SensitiveStateError::InvalidStoredRecord)?;
-    aad.extend_from_slice(&length.to_be_bytes());
-    aad.extend_from_slice(value.as_bytes());
-    Ok(())
-}
-
-fn seal(
-    key_bytes: &[u8; KEY_BYTES],
-    aad: &[u8],
-    plaintext: &[u8],
-) -> Result<(Vec<u8>, Vec<u8>), SensitiveStateError> {
-    let mut ciphertext = plaintext.to_vec();
-    let aead = RandomizedNonceKey::new(&AES_256_GCM, key_bytes)
-        .map_err(|_| SensitiveStateError::CryptographyUnavailable)?;
-    let nonce = aead
-        .seal_in_place_append_tag(Aad::from(aad), &mut ciphertext)
-        .map_err(|_| SensitiveStateError::CryptographyUnavailable)?;
-    Ok((nonce.as_ref().as_slice().to_vec(), ciphertext))
-}
-
-fn open<'a>(
-    key_bytes: &[u8; KEY_BYTES],
-    aad: &[u8],
-    nonce: &[u8],
-    ciphertext: &'a mut [u8],
-) -> Result<&'a [u8], SensitiveStateError> {
-    let nonce = Nonce::try_assume_unique_for_key(nonce)
-        .map_err(|_| SensitiveStateError::InvalidStoredRecord)?;
-    let aead = RandomizedNonceKey::new(&AES_256_GCM, key_bytes)
-        .map_err(|_| SensitiveStateError::CryptographyUnavailable)?;
-    aead.open_in_place(nonce, Aad::from(aad), ciphertext)
-        .map(|plaintext| &*plaintext)
-        .map_err(|_| SensitiveStateError::InvalidStoredRecord)
-}
-
-fn normalize_expiry(expires_at: OffsetDateTime) -> Result<OffsetDateTime, SensitiveStateError> {
-    OffsetDateTime::from_unix_timestamp(expires_at.unix_timestamp())
-        .map_err(|_| SensitiveStateError::InvalidStoredRecord)
-}
-
-fn decode_master_key(encoded: &str) -> Result<Zeroizing<[u8; KEY_BYTES]>, SensitiveStateError> {
-    let decoded = Zeroizing::new(
-        URL_SAFE_NO_PAD
-            .decode(encoded.as_bytes())
-            .map_err(|_| SensitiveStateError::InvalidKeyEncoding)?,
-    );
-    if decoded.len() != KEY_BYTES {
-        return Err(SensitiveStateError::InvalidKeyLength);
-    }
-    let mut master = Zeroizing::new([0_u8; KEY_BYTES]);
-    master.copy_from_slice(&decoded);
-    Ok(master)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn test_keys(byte: u8) -> SensitiveStateKeys {
-        SensitiveStateKeys::derive(&[byte; KEY_BYTES])
-    }
-
-    #[test]
-    fn subkeys_and_identifier_domains_are_separate_and_stable() {
-        let keys = test_keys(7);
-        assert_ne!(keys.aead, keys.pin_mac);
-        assert_ne!(keys.pin_mac, keys.identifier);
-        assert_ne!(keys.identifier, keys.key_id);
-        assert_ne!(
-            keys.login_state_hash("same"),
-            replay_identifier_hash("same")
-        );
-        assert_ne!(
-            keys.identifier_hash_fields(
-                EVALUATION_ISSUANCE_CONTEXT,
-                &[b"evaluation", b"client-one"],
-            ),
-            keys.identifier_hash_fields(
-                EVALUATION_ISSUANCE_CONTEXT,
-                &[b"evaluation", b"client-two"],
-            )
-        );
-        assert_ne!(test_keys(7).key_id, test_keys(8).key_id);
-    }
-
-    #[test]
-    fn login_aad_binds_identifier_configuration_and_expiry() {
-        let keys = test_keys(9);
-        let first_hash = keys.identifier_hash(STATE_IDENTIFIER_CONTEXT, "first");
-        let other_hash = keys.identifier_hash(STATE_IDENTIFIER_CONTEXT, "other");
-        let expiry = OffsetDateTime::from_unix_timestamp(1_900_000_000).unwrap();
-        let aad = login_aad(&first_hash, &keys.key_id, "person", expiry).unwrap();
-        assert_ne!(
-            aad,
-            login_aad(&other_hash, &keys.key_id, "person", expiry).unwrap()
-        );
-        assert_ne!(
-            aad,
-            login_aad(&first_hash, &keys.key_id, "other", expiry).unwrap()
-        );
-        assert_ne!(
-            aad,
-            login_aad(
-                &first_hash,
-                &keys.key_id,
-                "person",
-                expiry + time::Duration::seconds(1)
-            )
-            .unwrap()
-        );
-    }
-
-    #[test]
-    fn issuance_aad_requires_the_canonical_sha256_uri_commitment() {
-        let keys = test_keys(10);
-        let transaction_hash = keys.identifier_hash(ISSUANCE_TRANSACTION_CONTEXT, "transaction");
-        let expiry = OffsetDateTime::from_unix_timestamp(1_900_000_000).unwrap();
-        let commitment = format!("sha256:{}", "a".repeat(64));
-
-        assert!(issuance_record_aad(
-            &transaction_hash,
-            &keys.key_id,
-            "person",
-            &commitment,
-            expiry,
-        )
-        .is_ok());
-        for invalid in [
-            "a".repeat(64),
-            format!("sha256:{}", "A".repeat(64)),
-            format!("sha256:{}", "a".repeat(63)),
-        ] {
-            assert_eq!(
-                issuance_record_aad(&transaction_hash, &keys.key_id, "person", &invalid, expiry,)
-                    .unwrap_err(),
-                SensitiveStateError::InvalidStoredRecord
-            );
-        }
-    }
-
-    #[test]
-    fn registry_client_offer_aad_binds_key_request_and_retention() {
-        let keys = test_keys(9);
-        let expiry = OffsetDateTime::from_unix_timestamp(1_900_000_000).unwrap();
-        let first =
-            registry_client_offer_response_aad(&[1; 32], &[2; 32], &keys.key_id, expiry).unwrap();
-        assert_ne!(
-            first,
-            registry_client_offer_response_aad(&[3; 32], &[2; 32], &keys.key_id, expiry).unwrap()
-        );
-        assert_ne!(
-            first,
-            registry_client_offer_response_aad(&[1; 32], &[4; 32], &keys.key_id, expiry).unwrap()
-        );
-        assert_ne!(
-            first,
-            registry_client_offer_response_aad(
-                &[1; 32],
-                &[2; 32],
-                &keys.key_id,
-                expiry + time::Duration::seconds(1),
-            )
-            .unwrap()
-        );
-    }
-
-    #[test]
-    fn debug_and_errors_do_not_disclose_sensitive_values() {
-        let config = SensitiveStateKeyConfig::new("SENTINEL_SECRET_ENV").unwrap();
-        let rendered = format!("{config:?}");
-        assert!(!rendered.contains("SENTINEL"));
-        let keys = test_keys(11);
-        let rendered = format!("{keys:?}");
-        assert!(!rendered.contains("11"));
-    }
-
-    #[test]
-    fn master_key_requires_unpadded_base64url_and_exactly_32_bytes() {
-        let encoded = URL_SAFE_NO_PAD.encode([42_u8; KEY_BYTES]);
-        assert_eq!(&*decode_master_key(&encoded).unwrap(), &[42_u8; KEY_BYTES]);
-        assert_eq!(
-            decode_master_key(&format!("{encoded}=")).unwrap_err(),
-            SensitiveStateError::InvalidKeyEncoding
-        );
-        let short = URL_SAFE_NO_PAD.encode([42_u8; KEY_BYTES - 1]);
-        assert_eq!(
-            decode_master_key(&short).unwrap_err(),
-            SensitiveStateError::InvalidKeyLength
-        );
-    }
-
-    #[test]
-    fn login_encryption_uses_fresh_nonces() {
-        let keys = test_keys(13);
-        let aead = RandomizedNonceKey::new(&AES_256_GCM, &keys.aead).unwrap();
-        let mut first = b"sensitive-login-state".to_vec();
-        let mut second = first.clone();
-        let first_nonce = aead
-            .seal_in_place_append_tag(Aad::from(LOGIN_AAD_CONTEXT), &mut first)
-            .unwrap();
-        let second_nonce = aead
-            .seal_in_place_append_tag(Aad::from(LOGIN_AAD_CONTEXT), &mut second)
-            .unwrap();
-        assert_ne!(first_nonce.as_ref(), second_nonce.as_ref());
-    }
-}
diff --git a/crates/registry-notary-server/src/subject_access_rate_limit.rs b/crates/registry-notary-server/src/subject_access_rate_limit.rs
deleted file mode 100644
index b5648c99a..000000000
--- a/crates/registry-notary-server/src/subject_access_rate_limit.rs
+++ /dev/null
@@ -1,1253 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Rate limiting for citizen subject-access paths. Local/test runtimes keep
-//! the existing in-process counters; PostgreSQL runtimes use typed Notary
-//! state-plane operations over already-keyed pseudonyms.
-
-use std::collections::HashMap;
-use std::sync::{Arc, Mutex};
-
-use registry_notary_core::{
-    Bounded, EvidenceEntityReference, EvidenceError, Hashed, HolderIdentifier,
-    PreAuthorizedCodeIdentifier, PrincipalIdentifier, SubjectAccessDenialCode,
-    SubjectAccessRateLimitsConfig, SubjectBinding,
-};
-use registry_platform_audit::AuditKeyHasher;
-use time::{Duration, OffsetDateTime};
-
-use crate::state_plane::NotaryStatePlaneHandle;
-
-const MAX_RATE_LIMIT_KEY_LEN: usize = 128;
-
-type RateLimitKey = Bounded<MAX_RATE_LIMIT_KEY_LEN>;
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
-pub enum SubjectAccessRateLimitBucket {
-    InvalidTokenPerClientAddress,
-    PerPrincipal,
-    SubjectMismatchPerPrincipal,
-    PerHolderIssuance,
-    CredentialIssuancePerPrincipal,
-    TxCodeAttemptPerCode,
-}
-
-impl SubjectAccessRateLimitBucket {
-    #[must_use]
-    pub const fn as_str(self) -> &'static str {
-        match self {
-            Self::InvalidTokenPerClientAddress => "invalid_token_per_client_address",
-            Self::PerPrincipal => "per_principal",
-            Self::SubjectMismatchPerPrincipal => "subject_mismatch_per_principal",
-            Self::PerHolderIssuance => "per_holder_issuance",
-            Self::CredentialIssuancePerPrincipal => "credential_issuance_per_principal",
-            Self::TxCodeAttemptPerCode => "tx_code_attempt_per_code",
-        }
-    }
-
-    const fn key_prefix(self) -> &'static str {
-        match self {
-            Self::InvalidTokenPerClientAddress => "it",
-            Self::PerPrincipal => "pp",
-            Self::SubjectMismatchPerPrincipal => "sm",
-            Self::PerHolderIssuance => "hi",
-            Self::CredentialIssuancePerPrincipal => "ci",
-            Self::TxCodeAttemptPerCode => "tx",
-        }
-    }
-
-    const fn window(self) -> Duration {
-        match self {
-            Self::InvalidTokenPerClientAddress
-            | Self::PerPrincipal
-            | Self::TxCodeAttemptPerCode => Duration::minutes(1),
-            Self::SubjectMismatchPerPrincipal
-            | Self::PerHolderIssuance
-            | Self::CredentialIssuancePerPrincipal => Duration::hours(1),
-        }
-    }
-
-    fn parse(value: &str) -> Option<Self> {
-        match value {
-            "invalid_token_per_client_address" => Some(Self::InvalidTokenPerClientAddress),
-            "per_principal" => Some(Self::PerPrincipal),
-            "subject_mismatch_per_principal" => Some(Self::SubjectMismatchPerPrincipal),
-            "per_holder_issuance" => Some(Self::PerHolderIssuance),
-            "credential_issuance_per_principal" => Some(Self::CredentialIssuancePerPrincipal),
-            "tx_code_attempt_per_code" => Some(Self::TxCodeAttemptPerCode),
-            _ => None,
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum ClientAddressIdentifier {}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum SubjectAccessRateLimitError {
-    Limited {
-        bucket: SubjectAccessRateLimitBucket,
-    },
-    Unavailable {
-        reason: String,
-    },
-}
-
-impl SubjectAccessRateLimitError {
-    #[must_use]
-    pub fn evidence_error(&self) -> EvidenceError {
-        match self {
-            Self::Limited { .. } => EvidenceError::SubjectAccessRateLimited,
-            Self::Unavailable { .. } => EvidenceError::SubjectAccessDenied {
-                reason: SubjectAccessDenialCode::RateLimited,
-            },
-        }
-    }
-
-    #[must_use]
-    pub const fn bucket(&self) -> Option<SubjectAccessRateLimitBucket> {
-        match self {
-            Self::Limited { bucket } => Some(*bucket),
-            Self::Unavailable { .. } => None,
-        }
-    }
-}
-
-impl std::fmt::Display for SubjectAccessRateLimitError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Limited { bucket } => {
-                write!(f, "subject-access rate limit exceeded: {}", bucket.as_str())
-            }
-            Self::Unavailable { reason } => {
-                write!(f, "subject-access rate limiter unavailable: {reason}")
-            }
-        }
-    }
-}
-
-impl std::error::Error for SubjectAccessRateLimitError {}
-
-pub type SubjectAccessRateLimitResult<T> = Result<T, SubjectAccessRateLimitError>;
-
-#[derive(Debug, Clone)]
-pub struct SubjectAccessRateLimitKeys {
-    hasher: AuditKeyHasher,
-}
-
-impl SubjectAccessRateLimitKeys {
-    #[must_use]
-    pub fn new(hasher: AuditKeyHasher) -> Self {
-        Self { hasher }
-    }
-
-    pub fn principal(
-        &self,
-        principal_id: &str,
-    ) -> SubjectAccessRateLimitResult<Hashed<PrincipalIdentifier>> {
-        self.hash_identifier("principal", principal_id)
-    }
-
-    pub fn client_address(
-        &self,
-        client_address: &str,
-    ) -> SubjectAccessRateLimitResult<Hashed<ClientAddressIdentifier>> {
-        self.hash_identifier("client_address", client_address)
-    }
-
-    pub fn holder(
-        &self,
-        holder_id: &str,
-    ) -> SubjectAccessRateLimitResult<Hashed<HolderIdentifier>> {
-        self.hash_identifier("holder", holder_id)
-    }
-
-    pub fn subject_binding(
-        &self,
-        subject_binding: &str,
-    ) -> SubjectAccessRateLimitResult<Hashed<SubjectBinding>> {
-        self.hash_identifier("subject_binding", subject_binding)
-    }
-
-    /// Hash a delegated subject binding over the `(id_type, id)` pair rather than
-    /// the bare value. Used only for the delegated requester and dependent target
-    /// bindings so the hash distinguishes subjects that share an id value across
-    /// different id-type schemes. Keyed under a dedicated domain class so it never
-    /// collides with the value-only [`Self::subject_binding`] keyspace, and the
-    /// non-delegated subject-access hashing stays byte-for-byte unchanged.
-    pub fn delegated_subject_binding(
-        &self,
-        id_type: &str,
-        id: &str,
-    ) -> SubjectAccessRateLimitResult<Hashed<SubjectBinding>> {
-        if id_type.is_empty() || id.is_empty() {
-            return Err(SubjectAccessRateLimitError::Unavailable {
-                reason: "delegated subject binding identifier is empty".to_string(),
-            });
-        }
-        let canonical_input = format!(
-            "id_type\0{}\0{id_type}\0id\0{}\0{id}",
-            id_type.len(),
-            id.len()
-        );
-        let hashed = self.audit_reference_hash("delegated-subject-binding-v1", &canonical_input)?;
-        ensure_bounded(&hashed)?;
-        Ok(Hashed::from_hash(hashed))
-    }
-
-    /// Hash a raw `pre-authorized_code` for use as a rate-limit key. The raw
-    /// code is brute-forceable via its `tx_code` PIN, so the limiter must key
-    /// by this hash and never by the raw code.
-    pub fn pre_authorized_code(
-        &self,
-        pre_authorized_code: &str,
-    ) -> SubjectAccessRateLimitResult<Hashed<PreAuthorizedCodeIdentifier>> {
-        self.hash_identifier("pre_authorized_code", pre_authorized_code)
-    }
-
-    pub fn subject_ref(
-        &self,
-        id_type: &str,
-        subject_ref: &str,
-    ) -> SubjectAccessRateLimitResult<Hashed<SubjectBinding>> {
-        if subject_ref.is_empty() {
-            return Err(SubjectAccessRateLimitError::Unavailable {
-                reason: "subject_ref identifier is empty".to_string(),
-            });
-        }
-        let canonical_input = format!(
-            "id_type\0{}\0{id_type}\0subject_ref\0{}\0{subject_ref}",
-            id_type.len(),
-            subject_ref.len()
-        );
-        let hashed =
-            self.audit_reference_hash("subject-access-subject-ref-v1", &canonical_input)?;
-        ensure_bounded(&hashed)?;
-        Ok(Hashed::from_hash(hashed))
-    }
-
-    pub fn audit_pseudonym_ref(
-        &self,
-        class: &str,
-        canonical_input: &str,
-    ) -> SubjectAccessRateLimitResult<Hashed<EvidenceEntityReference>> {
-        if class.is_empty() || canonical_input.is_empty() {
-            return Err(SubjectAccessRateLimitError::Unavailable {
-                reason: "audit pseudonym input is empty".to_string(),
-            });
-        }
-        let hashed = self.audit_reference_hash(class, canonical_input)?;
-        ensure_bounded(&hashed)?;
-        Ok(Hashed::from_hash(hashed))
-    }
-
-    pub fn oid4vci_nonce(
-        &self,
-        issuer: &str,
-        credential_configuration_id: &str,
-        nonce: &str,
-    ) -> SubjectAccessRateLimitResult<String> {
-        if issuer.is_empty() || credential_configuration_id.is_empty() || nonce.is_empty() {
-            return Err(SubjectAccessRateLimitError::Unavailable {
-                reason: "oid4vci nonce identifier is empty".to_string(),
-            });
-        }
-        let hashed = self.hasher.hash(&format!(
-            "registry-notary:oid4vci:nonce:{issuer}:{credential_configuration_id}:{nonce}"
-        ));
-        ensure_bounded(&hashed)?;
-        Ok(hashed)
-    }
-
-    fn hash_identifier<T>(&self, kind: &str, raw: &str) -> SubjectAccessRateLimitResult<Hashed<T>> {
-        if raw.is_empty() {
-            return Err(SubjectAccessRateLimitError::Unavailable {
-                reason: format!("{kind} rate-limit identifier is empty"),
-            });
-        }
-        let canonical_input = format!("value\0{}\0{raw}", raw.len());
-        let class = format!("subject-access-{kind}-v1");
-        let hashed = self.audit_reference_hash(&class, &canonical_input)?;
-        ensure_bounded(&hashed)?;
-        Ok(Hashed::from_hash(hashed))
-    }
-
-    fn audit_reference_hash(
-        &self,
-        class: &str,
-        canonical_input: &str,
-    ) -> SubjectAccessRateLimitResult<String> {
-        self.hasher
-            .audit_reference_hash(class, "", canonical_input)
-            .map_err(|error| SubjectAccessRateLimitError::Unavailable {
-                reason: error.to_string(),
-            })
-    }
-}
-
-#[derive(Debug)]
-pub struct SubjectAccessRateLimiter {
-    config: SubjectAccessRateLimitsConfig,
-    state_plane: Option<Arc<NotaryStatePlaneHandle>>,
-    counters: Mutex<HashMap<RateLimitKey, Counter>>,
-}
-
-impl SubjectAccessRateLimiter {
-    #[must_use]
-    pub fn new(config: SubjectAccessRateLimitsConfig) -> Self {
-        Self {
-            config,
-            state_plane: None,
-            counters: Mutex::new(HashMap::new()),
-        }
-    }
-
-    #[must_use]
-    pub(crate) fn with_state_plane(
-        config: SubjectAccessRateLimitsConfig,
-        state_plane: Arc<NotaryStatePlaneHandle>,
-    ) -> Self {
-        Self {
-            config,
-            state_plane: Some(state_plane),
-            counters: Mutex::new(HashMap::new()),
-        }
-    }
-
-    pub async fn check_invalid_token_for_client_address(
-        &self,
-        client_address: &Hashed<ClientAddressIdentifier>,
-    ) -> SubjectAccessRateLimitResult<()> {
-        let denial = BucketCheck::new(
-            SubjectAccessRateLimitBucket::InvalidTokenPerClientAddress,
-            client_address.as_str(),
-        )?;
-        self.check_and_consume_current(Vec::new(), Some(denial))
-            .await
-    }
-
-    pub async fn check_invalid_token_for_client_address_available(
-        &self,
-        client_address: &Hashed<ClientAddressIdentifier>,
-    ) -> SubjectAccessRateLimitResult<()> {
-        let check = BucketCheck::new(
-            SubjectAccessRateLimitBucket::InvalidTokenPerClientAddress,
-            client_address.as_str(),
-        )?;
-        self.check_only_current(&[check]).await
-    }
-
-    pub async fn check_authenticated_request(
-        &self,
-        principal: &Hashed<PrincipalIdentifier>,
-    ) -> SubjectAccessRateLimitResult<()> {
-        let checks = vec![BucketCheck::new(
-            SubjectAccessRateLimitBucket::PerPrincipal,
-            principal.as_str(),
-        )?];
-        self.check_and_consume_current(checks, None).await
-    }
-
-    pub async fn consume_subject_mismatch_denial(
-        &self,
-        principal: &Hashed<PrincipalIdentifier>,
-    ) -> SubjectAccessRateLimitResult<()> {
-        let checks = vec![BucketCheck::new(
-            SubjectAccessRateLimitBucket::PerPrincipal,
-            principal.as_str(),
-        )?];
-        let denial = BucketCheck::new(
-            SubjectAccessRateLimitBucket::SubjectMismatchPerPrincipal,
-            principal.as_str(),
-        )?;
-        self.check_and_consume_current(checks, Some(denial)).await
-    }
-
-    pub async fn consume_subject_mismatch_denial_only(
-        &self,
-        principal: &Hashed<PrincipalIdentifier>,
-    ) -> SubjectAccessRateLimitResult<()> {
-        let denial = BucketCheck::new(
-            SubjectAccessRateLimitBucket::SubjectMismatchPerPrincipal,
-            principal.as_str(),
-        )?;
-        self.check_and_consume_current(Vec::new(), Some(denial))
-            .await
-    }
-
-    pub async fn check_credential_issuance(
-        &self,
-        principal: &Hashed<PrincipalIdentifier>,
-        holder: Option<&Hashed<HolderIdentifier>>,
-    ) -> SubjectAccessRateLimitResult<()> {
-        let checks = self.credential_issuance_checks(principal, holder)?;
-        self.check_and_consume_current(checks, None).await
-    }
-
-    /// Record one `tx_code` attempt against a single (hashed)
-    /// `pre-authorized_code`. After `tx_code_attempts_per_code_per_minute`
-    /// attempts in the window the code is locked.
-    pub async fn check_tx_code_attempt(
-        &self,
-        pre_authorized_code: &Hashed<PreAuthorizedCodeIdentifier>,
-    ) -> SubjectAccessRateLimitResult<()> {
-        let checks = vec![BucketCheck::new(
-            SubjectAccessRateLimitBucket::TxCodeAttemptPerCode,
-            pre_authorized_code.as_str(),
-        )?];
-        self.check_and_consume_current(checks, None).await
-    }
-
-    async fn check_and_consume_current(
-        &self,
-        checks: Vec<BucketCheck>,
-        denial: Option<BucketCheck>,
-    ) -> SubjectAccessRateLimitResult<()> {
-        let Some(state_plane) = self
-            .state_plane
-            .as_ref()
-            .filter(|state_plane| !state_plane.is_in_memory())
-        else {
-            return self.check_and_consume(checks, denial, OffsetDateTime::now_utc());
-        };
-        let applicable = if let Some(denial) = denial {
-            let mut applicable = Vec::with_capacity(checks.len() + 1);
-            applicable.push(denial);
-            applicable.extend(checks);
-            applicable
-        } else {
-            checks
-        };
-        self.run_postgres_quota_operation(state_plane, &applicable, true)
-            .await
-    }
-
-    async fn check_only_current(&self, checks: &[BucketCheck]) -> SubjectAccessRateLimitResult<()> {
-        let Some(state_plane) = self
-            .state_plane
-            .as_ref()
-            .filter(|state_plane| !state_plane.is_in_memory())
-        else {
-            return self.check_only(checks, OffsetDateTime::now_utc());
-        };
-        self.run_postgres_quota_operation(state_plane, checks, false)
-            .await
-    }
-
-    async fn run_postgres_quota_operation(
-        &self,
-        state_plane: &NotaryStatePlaneHandle,
-        checks: &[BucketCheck],
-        consume: bool,
-    ) -> SubjectAccessRateLimitResult<()> {
-        let bucket_kinds = checks
-            .iter()
-            .map(|check| check.bucket.as_str())
-            .collect::<Vec<_>>();
-        let key_hashes = checks
-            .iter()
-            .map(|check| decode_keyed_pseudonym_hash(&check.pseudonym))
-            .collect::<Result<Vec<_>, _>>()?;
-        let limits = checks
-            .iter()
-            .map(|check| {
-                i32::try_from(self.limit_for(check.bucket)).map_err(|_| postgres_unavailable())
-            })
-            .collect::<Result<Vec<_>, _>>()?;
-        let window_seconds = checks
-            .iter()
-            .map(|check| {
-                i32::try_from(check.bucket.window().whole_seconds())
-                    .map_err(|_| postgres_unavailable())
-            })
-            .collect::<Result<Vec<_>, _>>()?;
-        let runtime = state_plane.runtime().map_err(|_| postgres_unavailable())?;
-        let session = runtime
-            .open_domain_session()
-            .await
-            .map_err(|_| postgres_unavailable())?;
-        let statement = if consume {
-            "SELECT allowed, denied_bucket, retry_after_seconds \
-               FROM registry_notary_api.subject_access_quota_debit_v1($1, $2, $3, $4)"
-        } else {
-            "SELECT allowed, denied_bucket, retry_after_seconds \
-               FROM registry_notary_api.subject_access_quota_check_v1($1, $2, $3, $4)"
-        };
-        let row = session
-            .run_operation(session.client().query_one(
-                statement,
-                &[&bucket_kinds, &key_hashes, &limits, &window_seconds],
-            ))
-            .await
-            .map_err(|_| postgres_unavailable())?;
-        let allowed: bool = row.try_get("allowed").map_err(|_| postgres_unavailable())?;
-        if allowed {
-            return Ok(());
-        }
-        let denied_bucket: Option<String> = row
-            .try_get("denied_bucket")
-            .map_err(|_| postgres_unavailable())?;
-        let bucket = denied_bucket
-            .as_deref()
-            .and_then(SubjectAccessRateLimitBucket::parse)
-            .ok_or_else(postgres_unavailable)?;
-        Err(SubjectAccessRateLimitError::Limited { bucket })
-    }
-
-    #[cfg(test)]
-    fn check_invalid_token_for_client_address_at(
-        &self,
-        client_address: &Hashed<ClientAddressIdentifier>,
-        now: OffsetDateTime,
-    ) -> SubjectAccessRateLimitResult<()> {
-        let denial = BucketCheck::new(
-            SubjectAccessRateLimitBucket::InvalidTokenPerClientAddress,
-            client_address.as_str(),
-        )?;
-        self.check_and_consume(Vec::new(), Some(denial), now)
-    }
-
-    #[cfg(test)]
-    fn check_authenticated_request_at(
-        &self,
-        principal: &Hashed<PrincipalIdentifier>,
-        now: OffsetDateTime,
-    ) -> SubjectAccessRateLimitResult<()> {
-        let checks = vec![BucketCheck::new(
-            SubjectAccessRateLimitBucket::PerPrincipal,
-            principal.as_str(),
-        )?];
-        self.check_and_consume(checks, None, now)
-    }
-
-    #[cfg(test)]
-    fn consume_subject_mismatch_denial_at(
-        &self,
-        principal: &Hashed<PrincipalIdentifier>,
-        now: OffsetDateTime,
-    ) -> SubjectAccessRateLimitResult<()> {
-        let checks = vec![BucketCheck::new(
-            SubjectAccessRateLimitBucket::PerPrincipal,
-            principal.as_str(),
-        )?];
-        let denial = BucketCheck::new(
-            SubjectAccessRateLimitBucket::SubjectMismatchPerPrincipal,
-            principal.as_str(),
-        )?;
-        self.check_and_consume(checks, Some(denial), now)
-    }
-
-    #[cfg(test)]
-    fn check_credential_issuance_at(
-        &self,
-        principal: &Hashed<PrincipalIdentifier>,
-        holder: Option<&Hashed<HolderIdentifier>>,
-        now: OffsetDateTime,
-    ) -> SubjectAccessRateLimitResult<()> {
-        let checks = self.credential_issuance_checks(principal, holder)?;
-        self.check_and_consume(checks, None, now)
-    }
-
-    fn credential_issuance_checks(
-        &self,
-        principal: &Hashed<PrincipalIdentifier>,
-        holder: Option<&Hashed<HolderIdentifier>>,
-    ) -> SubjectAccessRateLimitResult<Vec<BucketCheck>> {
-        let mut checks = vec![
-            BucketCheck::new(
-                SubjectAccessRateLimitBucket::PerPrincipal,
-                principal.as_str(),
-            )?,
-            BucketCheck::new(
-                SubjectAccessRateLimitBucket::CredentialIssuancePerPrincipal,
-                principal.as_str(),
-            )?,
-        ];
-        if let Some(holder) = holder {
-            checks.push(BucketCheck::new(
-                SubjectAccessRateLimitBucket::PerHolderIssuance,
-                holder.as_str(),
-            )?);
-        }
-        Ok(checks)
-    }
-
-    #[cfg(test)]
-    fn check_tx_code_attempt_at(
-        &self,
-        pre_authorized_code: &Hashed<PreAuthorizedCodeIdentifier>,
-        now: OffsetDateTime,
-    ) -> SubjectAccessRateLimitResult<()> {
-        let checks = vec![BucketCheck::new(
-            SubjectAccessRateLimitBucket::TxCodeAttemptPerCode,
-            pre_authorized_code.as_str(),
-        )?];
-        self.check_and_consume(checks, None, now)
-    }
-
-    fn check_and_consume(
-        &self,
-        checks: Vec<BucketCheck>,
-        denial: Option<BucketCheck>,
-        now: OffsetDateTime,
-    ) -> SubjectAccessRateLimitResult<()> {
-        let mut counters =
-            self.counters
-                .lock()
-                .map_err(|_| SubjectAccessRateLimitError::Unavailable {
-                    reason: "counter mutex is poisoned".to_string(),
-                })?;
-        prune_expired(&mut counters, now);
-
-        if let Some(denial) = &denial {
-            let mut applicable = vec![denial.clone()];
-            applicable.extend(checks.clone());
-            if let Some(over_limit) = applicable
-                .iter()
-                .find(|check| !self.bucket_allows(&counters, check, now))
-                .cloned()
-            {
-                return Err(SubjectAccessRateLimitError::Limited {
-                    bucket: over_limit.bucket,
-                });
-            }
-        } else if let Some(over_limit) = checks
-            .iter()
-            .find(|check| !self.bucket_allows(&counters, check, now))
-            .cloned()
-        {
-            return Err(SubjectAccessRateLimitError::Limited {
-                bucket: over_limit.bucket,
-            });
-        }
-
-        if let Some(denial) = denial {
-            for check in &checks {
-                consume_bucket(&mut counters, check, now);
-            }
-            consume_bucket(&mut counters, &denial, now);
-        } else {
-            for check in &checks {
-                consume_bucket(&mut counters, check, now);
-            }
-        }
-        Ok(())
-    }
-
-    fn check_only(
-        &self,
-        checks: &[BucketCheck],
-        now: OffsetDateTime,
-    ) -> SubjectAccessRateLimitResult<()> {
-        let mut counters =
-            self.counters
-                .lock()
-                .map_err(|_| SubjectAccessRateLimitError::Unavailable {
-                    reason: "counter mutex is poisoned".to_string(),
-                })?;
-        prune_expired(&mut counters, now);
-        if let Some(over_limit) = checks
-            .iter()
-            .find(|check| !self.bucket_allows(&counters, check, now))
-        {
-            return Err(SubjectAccessRateLimitError::Limited {
-                bucket: over_limit.bucket,
-            });
-        }
-        Ok(())
-    }
-
-    fn bucket_allows(
-        &self,
-        counters: &HashMap<RateLimitKey, Counter>,
-        check: &BucketCheck,
-        now: OffsetDateTime,
-    ) -> bool {
-        let limit = self.limit_for(check.bucket);
-        if limit == 0 {
-            return false;
-        }
-        match counters.get(&check.key) {
-            Some(counter) if counter.in_window(now) => counter.used < limit,
-            _ => true,
-        }
-    }
-
-    const fn limit_for(&self, bucket: SubjectAccessRateLimitBucket) -> u32 {
-        match bucket {
-            SubjectAccessRateLimitBucket::InvalidTokenPerClientAddress => {
-                self.config.invalid_token_per_client_address_per_minute
-            }
-            SubjectAccessRateLimitBucket::PerPrincipal => self.config.per_principal_per_minute,
-            SubjectAccessRateLimitBucket::SubjectMismatchPerPrincipal => {
-                self.config.subject_mismatch_per_principal_per_hour
-            }
-            SubjectAccessRateLimitBucket::PerHolderIssuance => self.config.per_holder_per_hour,
-            SubjectAccessRateLimitBucket::CredentialIssuancePerPrincipal => {
-                self.config.credential_issuance_per_principal_per_hour
-            }
-            SubjectAccessRateLimitBucket::TxCodeAttemptPerCode => {
-                self.config.tx_code_attempts_per_code_per_minute
-            }
-        }
-    }
-
-    #[cfg(test)]
-    fn count_for(
-        &self,
-        bucket: SubjectAccessRateLimitBucket,
-        hashed_id: &str,
-    ) -> SubjectAccessRateLimitResult<u32> {
-        let key = bucket_key(bucket, hashed_id)?;
-        Ok(self
-            .counters
-            .lock()
-            .expect("counter mutex is not poisoned")
-            .get(&key)
-            .map(|counter| counter.used)
-            .unwrap_or(0))
-    }
-
-    #[cfg(test)]
-    fn stored_keys(&self) -> Vec<String> {
-        self.counters
-            .lock()
-            .expect("counter mutex is not poisoned")
-            .keys()
-            .map(|key| key.as_str().to_string())
-            .collect()
-    }
-}
-
-#[derive(Debug, Clone)]
-struct BucketCheck {
-    bucket: SubjectAccessRateLimitBucket,
-    key: RateLimitKey,
-    pseudonym: String,
-}
-
-impl BucketCheck {
-    fn new(
-        bucket: SubjectAccessRateLimitBucket,
-        hashed_id: &str,
-    ) -> SubjectAccessRateLimitResult<Self> {
-        Ok(Self {
-            bucket,
-            key: bucket_key(bucket, hashed_id)?,
-            pseudonym: hashed_id.to_string(),
-        })
-    }
-}
-
-#[derive(Debug, Clone)]
-struct Counter {
-    bucket: SubjectAccessRateLimitBucket,
-    window_start: OffsetDateTime,
-    used: u32,
-}
-
-impl Counter {
-    fn in_window(&self, now: OffsetDateTime) -> bool {
-        now < self.window_start + self.bucket.window()
-    }
-}
-
-fn bucket_key(
-    bucket: SubjectAccessRateLimitBucket,
-    hashed_id: &str,
-) -> SubjectAccessRateLimitResult<RateLimitKey> {
-    ensure_bounded(hashed_id)?;
-    RateLimitKey::new(format!("{}:{hashed_id}", bucket.key_prefix())).map_err(|error| {
-        SubjectAccessRateLimitError::Unavailable {
-            reason: error.to_string(),
-        }
-    })
-}
-
-fn consume_bucket(
-    counters: &mut HashMap<RateLimitKey, Counter>,
-    check: &BucketCheck,
-    now: OffsetDateTime,
-) {
-    let counter = counters.entry(check.key.clone()).or_insert(Counter {
-        bucket: check.bucket,
-        window_start: now,
-        used: 0,
-    });
-    if !counter.in_window(now) {
-        counter.window_start = now;
-        counter.used = 0;
-    }
-    counter.used = counter.used.saturating_add(1);
-}
-
-fn prune_expired(counters: &mut HashMap<RateLimitKey, Counter>, now: OffsetDateTime) {
-    counters.retain(|_, counter| counter.in_window(now));
-}
-
-fn ensure_bounded(value: &str) -> SubjectAccessRateLimitResult<()> {
-    RateLimitKey::new(value)
-        .map(|_| ())
-        .map_err(|error| SubjectAccessRateLimitError::Unavailable {
-            reason: error.to_string(),
-        })
-}
-
-fn decode_keyed_pseudonym_hash(value: &str) -> SubjectAccessRateLimitResult<Vec<u8>> {
-    let encoded = value
-        .strip_prefix("hmac-sha256:")
-        .ok_or_else(postgres_unavailable)?;
-    if encoded.len() != 64 {
-        return Err(postgres_unavailable());
-    }
-    encoded
-        .as_bytes()
-        .chunks_exact(2)
-        .map(|pair| {
-            let high = hex_nibble(pair[0]).ok_or_else(postgres_unavailable)?;
-            let low = hex_nibble(pair[1]).ok_or_else(postgres_unavailable)?;
-            Ok((high << 4) | low)
-        })
-        .collect()
-}
-
-fn hex_nibble(value: u8) -> Option<u8> {
-    match value {
-        b'0'..=b'9' => Some(value - b'0'),
-        b'a'..=b'f' => Some(value - b'a' + 10),
-        _ => None,
-    }
-}
-
-fn postgres_unavailable() -> SubjectAccessRateLimitError {
-    SubjectAccessRateLimitError::Unavailable {
-        reason: "PostgreSQL subject-access quota operation failed".to_string(),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn config() -> SubjectAccessRateLimitsConfig {
-        SubjectAccessRateLimitsConfig {
-            invalid_token_per_client_address_per_minute: 2,
-            per_principal_per_minute: 2,
-            subject_mismatch_per_principal_per_hour: 2,
-            per_holder_per_hour: 1,
-            credential_issuance_per_principal_per_hour: 2,
-            tx_code_attempts_per_code_per_minute: 2,
-        }
-    }
-
-    fn keys() -> SubjectAccessRateLimitKeys {
-        SubjectAccessRateLimitKeys::new(AuditKeyHasher::unkeyed_dev_only())
-    }
-
-    fn now() -> OffsetDateTime {
-        OffsetDateTime::from_unix_timestamp(1_700_000_000).expect("valid timestamp")
-    }
-
-    #[test]
-    fn invalid_token_bucket_is_keyed_by_hashed_client_address() {
-        let limiter = SubjectAccessRateLimiter::new(config());
-        let client = keys()
-            .client_address("203.0.113.10")
-            .expect("client address hashes");
-
-        limiter
-            .check_invalid_token_for_client_address_at(&client, now())
-            .expect("first invalid-token attempt is recorded");
-        limiter
-            .check_invalid_token_for_client_address_at(&client, now())
-            .expect("second invalid-token attempt is recorded");
-        let error = limiter
-            .check_invalid_token_for_client_address_at(&client, now())
-            .expect_err("third invalid-token attempt is limited");
-
-        assert_eq!(
-            error,
-            SubjectAccessRateLimitError::Limited {
-                bucket: SubjectAccessRateLimitBucket::InvalidTokenPerClientAddress,
-            }
-        );
-        assert!(
-            limiter
-                .stored_keys()
-                .iter()
-                .all(|key| !key.contains("203.0.113.10")),
-            "raw client address must not be stored in limiter keys"
-        );
-    }
-
-    #[tokio::test]
-    async fn invalid_token_availability_precheck_does_not_consume_quota() {
-        let limiter = SubjectAccessRateLimiter::new(config());
-        let client = keys()
-            .client_address("203.0.113.10")
-            .expect("client address hashes");
-
-        for _ in 0..3 {
-            limiter
-                .check_invalid_token_for_client_address_available(&client)
-                .await
-                .expect("availability precheck does not debit quota");
-        }
-        limiter
-            .check_invalid_token_for_client_address(&client)
-            .await
-            .expect("first rejected token is recorded");
-        limiter
-            .check_invalid_token_for_client_address(&client)
-            .await
-            .expect("second rejected token is recorded");
-        let error = limiter
-            .check_invalid_token_for_client_address_available(&client)
-            .await
-            .expect_err("precheck observes the exhausted bucket");
-
-        assert_eq!(
-            error.bucket(),
-            Some(SubjectAccessRateLimitBucket::InvalidTokenPerClientAddress)
-        );
-    }
-
-    #[test]
-    fn postgres_key_decoder_accepts_only_keyed_32_byte_pseudonym_encodings() {
-        let keyed = format!("hmac-sha256:{}", "cd".repeat(32));
-
-        assert_eq!(decode_keyed_pseudonym_hash(&keyed), Ok(vec![0xcd; 32]));
-        assert!(decode_keyed_pseudonym_hash(&format!("hmac-sha256:{}", "ab".repeat(31))).is_err());
-        assert!(decode_keyed_pseudonym_hash(&format!("hmac-sha256:{}", "ag".repeat(32))).is_err());
-        assert!(decode_keyed_pseudonym_hash(&format!("hmac-sha256:{}", "CD".repeat(32))).is_err());
-        assert!(decode_keyed_pseudonym_hash(&format!("sha256:{}", "ab".repeat(32))).is_err());
-    }
-
-    #[test]
-    fn subject_ref_hash_is_delimiter_collision_resistant() {
-        let key_builder = keys();
-        let first = key_builder
-            .subject_ref("national_id", "123:456")
-            .expect("first subject ref hashes");
-        let second = key_builder
-            .subject_ref("national_id:123", "456")
-            .expect("second subject ref hashes");
-
-        assert_ne!(
-            first, second,
-            "id_type and subject_ref must be encoded unambiguously before hashing"
-        );
-    }
-
-    #[test]
-    fn delegated_subject_binding_distinguishes_id_type_for_same_value() {
-        let key_builder = keys();
-        let national = key_builder
-            .delegated_subject_binding("national_id", "CHILD-123")
-            .expect("national_id binding hashes");
-        let civil = key_builder
-            .delegated_subject_binding("civil_registration_id", "CHILD-123")
-            .expect("civil_registration_id binding hashes");
-
-        assert_ne!(
-            national, civil,
-            "delegated binding must distinguish the same id value across id-type schemes"
-        );
-        // The composition must be delimiter-collision resistant.
-        let split_value = key_builder
-            .delegated_subject_binding("national_id", "x:CHILD-123")
-            .expect("hashes");
-        let split_type = key_builder
-            .delegated_subject_binding("national_id:x", "CHILD-123")
-            .expect("hashes");
-        assert_ne!(
-            split_value, split_type,
-            "id_type and id must be encoded unambiguously before hashing"
-        );
-    }
-
-    #[test]
-    fn delegated_subject_binding_uses_separate_keyspace_from_subject_binding() {
-        let key_builder = keys();
-        let value_only = key_builder
-            .subject_binding("CHILD-123")
-            .expect("value-only binding hashes");
-        let composed = key_builder
-            .delegated_subject_binding("civil_registration_id", "CHILD-123")
-            .expect("composed binding hashes");
-
-        assert_ne!(
-            value_only, composed,
-            "delegated composition must not collide with the value-only subject_binding keyspace"
-        );
-    }
-
-    #[test]
-    fn delegated_subject_binding_rejects_empty_inputs() {
-        let key_builder = keys();
-        assert!(key_builder
-            .delegated_subject_binding("", "CHILD-123")
-            .is_err());
-        assert!(key_builder
-            .delegated_subject_binding("civil_registration_id", "")
-            .is_err());
-    }
-
-    #[test]
-    fn identity_keys_use_platform_audit_reference_domain() {
-        let hasher = AuditKeyHasher::unkeyed_dev_only();
-        let key_builder = SubjectAccessRateLimitKeys::new(hasher.clone());
-        let principal = key_builder
-            .principal("citizen-123")
-            .expect("principal hashes");
-        let expected = hasher
-            .audit_reference_hash(
-                "subject-access-principal-v1",
-                "",
-                &format!("value\0{}\0citizen-123", "citizen-123".len()),
-            )
-            .expect("reference hash");
-        let legacy = hasher.hash("registry-notary:subject-access:principal:citizen-123");
-
-        assert_eq!(principal.as_str(), expected);
-        assert_ne!(principal.as_str(), legacy);
-    }
-
-    #[test]
-    fn audit_pseudonym_ref_uses_separate_domain_from_subject_ref() {
-        let key_builder = keys();
-        let subject_ref = key_builder
-            .subject_ref("national_id", "rnref:v1:target")
-            .expect("subject ref hashes");
-        let audit_ref = key_builder
-            .audit_pseudonym_ref(
-                "matched-reference-v1",
-                r#"{"class":"matched-reference-v1","handle":"rnref:v1:target"}"#,
-            )
-            .expect("audit pseudonym hashes");
-
-        assert_ne!(
-            subject_ref.as_str(),
-            audit_ref.as_str(),
-            "audit pseudonyms must not be interchangeable with legacy subject refs"
-        );
-    }
-
-    #[test]
-    fn authenticated_request_consumes_per_principal_bucket() {
-        let mut config = config();
-        config.per_principal_per_minute = 1;
-        let limiter = SubjectAccessRateLimiter::new(config);
-        let principal = keys().principal("citizen-123").expect("principal hashes");
-
-        limiter
-            .check_authenticated_request_at(&principal, now())
-            .expect("first authenticated request is allowed");
-        let error = limiter
-            .check_authenticated_request_at(&principal, now())
-            .expect_err("second authenticated request is limited");
-
-        assert_eq!(
-            error.bucket(),
-            Some(SubjectAccessRateLimitBucket::PerPrincipal)
-        );
-    }
-
-    #[test]
-    fn subject_mismatch_denial_consumes_principal_and_denial_buckets() {
-        let mut config = config();
-        config.per_principal_per_minute = 2;
-        config.subject_mismatch_per_principal_per_hour = 1;
-        let limiter = SubjectAccessRateLimiter::new(config);
-        let principal = keys().principal("citizen-123").expect("principal hashes");
-
-        limiter
-            .consume_subject_mismatch_denial_at(&principal, now())
-            .expect("subject mismatch is recorded");
-        assert_eq!(
-            limiter
-                .count_for(
-                    SubjectAccessRateLimitBucket::SubjectMismatchPerPrincipal,
-                    principal.as_str()
-                )
-                .expect("counter can be read"),
-            1
-        );
-        assert_eq!(
-            limiter
-                .count_for(
-                    SubjectAccessRateLimitBucket::PerPrincipal,
-                    principal.as_str()
-                )
-                .expect("counter can be read"),
-            1
-        );
-
-        limiter
-            .check_authenticated_request_at(&principal, now())
-            .expect("principal bucket has one remaining request");
-        let error = limiter
-            .consume_subject_mismatch_denial_at(&principal, now())
-            .expect_err("second subject mismatch is limited");
-        assert_eq!(
-            error.bucket(),
-            Some(SubjectAccessRateLimitBucket::SubjectMismatchPerPrincipal)
-        );
-    }
-
-    #[test]
-    fn subject_mismatch_denial_is_atomic_when_principal_bucket_is_over_limit() {
-        let mut config = config();
-        config.per_principal_per_minute = 1;
-        config.subject_mismatch_per_principal_per_hour = 2;
-        let limiter = SubjectAccessRateLimiter::new(config);
-        let principal = keys().principal("citizen-123").expect("principal hashes");
-
-        limiter
-            .check_authenticated_request_at(&principal, now())
-            .expect("principal bucket is consumed");
-        let error = limiter
-            .consume_subject_mismatch_denial_at(&principal, now())
-            .expect_err("principal bucket is over limit");
-
-        assert_eq!(
-            error.bucket(),
-            Some(SubjectAccessRateLimitBucket::PerPrincipal)
-        );
-        assert_eq!(
-            limiter
-                .count_for(
-                    SubjectAccessRateLimitBucket::SubjectMismatchPerPrincipal,
-                    principal.as_str()
-                )
-                .expect("counter can be read"),
-            0
-        );
-    }
-
-    #[test]
-    fn credential_issuance_is_atomic_across_holder_and_principal_buckets() {
-        let limiter = SubjectAccessRateLimiter::new(config());
-        let key_builder = keys();
-        let principal = key_builder
-            .principal("citizen-123")
-            .expect("principal hashes");
-        let holder_one = key_builder
-            .holder("did:jwk:holder-one")
-            .expect("holder hashes");
-        let holder_two = key_builder
-            .holder("did:jwk:holder-two")
-            .expect("holder hashes");
-
-        limiter
-            .check_credential_issuance_at(&principal, Some(&holder_one), now())
-            .expect("first issuance is allowed");
-        let error = limiter
-            .check_credential_issuance_at(&principal, Some(&holder_one), now())
-            .expect_err("same holder is limited");
-        assert_eq!(
-            error.bucket(),
-            Some(SubjectAccessRateLimitBucket::PerHolderIssuance)
-        );
-
-        limiter
-            .check_credential_issuance_at(&principal, Some(&holder_two), now())
-            .expect("failed holder attempt did not consume principal issuance bucket");
-        assert_eq!(
-            limiter
-                .count_for(
-                    SubjectAccessRateLimitBucket::CredentialIssuancePerPrincipal,
-                    principal.as_str()
-                )
-                .expect("counter can be read"),
-            2
-        );
-    }
-
-    #[test]
-    fn tx_code_attempts_lock_a_single_pre_authorized_code() {
-        let mut config = config();
-        config.tx_code_attempts_per_code_per_minute = 2;
-        let limiter = SubjectAccessRateLimiter::new(config);
-        let code = keys()
-            .pre_authorized_code("pre-auth-code-secret")
-            .expect("pre-authorized code hashes");
-
-        limiter
-            .check_tx_code_attempt_at(&code, now())
-            .expect("first tx_code attempt is recorded");
-        limiter
-            .check_tx_code_attempt_at(&code, now())
-            .expect("second tx_code attempt is recorded");
-        let error = limiter
-            .check_tx_code_attempt_at(&code, now())
-            .expect_err("third tx_code attempt is limited");
-
-        assert_eq!(
-            error.bucket(),
-            Some(SubjectAccessRateLimitBucket::TxCodeAttemptPerCode)
-        );
-    }
-
-    #[test]
-    fn tx_code_bucket_is_keyed_by_hashed_code_not_the_raw_code() {
-        let limiter = SubjectAccessRateLimiter::new(config());
-        let raw_code = "pre-auth-code-secret";
-        let code = keys()
-            .pre_authorized_code(raw_code)
-            .expect("pre-authorized code hashes");
-
-        limiter
-            .check_tx_code_attempt_at(&code, now())
-            .expect("tx_code attempt is recorded");
-
-        assert!(
-            limiter
-                .stored_keys()
-                .iter()
-                .all(|key| !key.contains(raw_code)),
-            "raw pre-authorized_code must not be stored in limiter keys"
-        );
-    }
-
-    #[test]
-    fn tx_code_attempts_are_isolated_per_code() {
-        let mut config = config();
-        config.tx_code_attempts_per_code_per_minute = 1;
-        let limiter = SubjectAccessRateLimiter::new(config);
-        let key_builder = keys();
-        let code_one = key_builder
-            .pre_authorized_code("code-one")
-            .expect("first code hashes");
-        let code_two = key_builder
-            .pre_authorized_code("code-two")
-            .expect("second code hashes");
-
-        limiter
-            .check_tx_code_attempt_at(&code_one, now())
-            .expect("first attempt on code-one is allowed");
-        let error = limiter
-            .check_tx_code_attempt_at(&code_one, now())
-            .expect_err("second attempt on code-one is limited");
-        assert_eq!(
-            error.bucket(),
-            Some(SubjectAccessRateLimitBucket::TxCodeAttemptPerCode)
-        );
-        limiter
-            .check_tx_code_attempt_at(&code_two, now())
-            .expect("a different code is tracked independently");
-    }
-
-    #[test]
-    fn windows_expire_and_reset() {
-        let mut config = config();
-        config.per_principal_per_minute = 1;
-        let limiter = SubjectAccessRateLimiter::new(config);
-        let principal = keys().principal("citizen-123").expect("principal hashes");
-
-        limiter
-            .check_authenticated_request_at(&principal, now())
-            .expect("first request is allowed");
-        limiter
-            .check_authenticated_request_at(&principal, now() + Duration::minutes(1))
-            .expect("next minute resets the bucket");
-    }
-}
diff --git a/crates/registry-notary-server/tests/cel_worker.rs b/crates/registry-notary-server/tests/cel_worker.rs
deleted file mode 100644
index be788cddc..000000000
--- a/crates/registry-notary-server/tests/cel_worker.rs
+++ /dev/null
@@ -1,646 +0,0 @@
-#![cfg(feature = "registry-notary-cel")]
-
-use std::collections::BTreeSet;
-use std::ffi::OsString;
-use std::path::PathBuf;
-use std::time::Duration;
-
-use registry_notary_core::RegistryNotaryCelConfig;
-use registry_notary_server::cel_worker::{
-    cel_policy_hash, CelWorker, CelWorkerConfig, CelWorkerError, CelWorkerLimits,
-    CEL_WORKER_MAX_STDIN_BYTES,
-};
-use registry_notary_worker_harness::WorkerError;
-use serde_json::json;
-use tokio::io::AsyncWriteExt;
-use tokio::process::Command;
-
-#[cfg(feature = "cel-worker-fixture")]
-static CEL_WORKER_TEST_LOCK: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
-
-fn cel_worker_bin() -> PathBuf {
-    let env_path = PathBuf::from(env!("CARGO_BIN_EXE_registry-notary-cel-worker"));
-    if env_path
-        .parent()
-        .and_then(|parent| parent.file_name())
-        .is_some_and(|file_name| file_name == "deps")
-    {
-        let candidate = env_path
-            .parent()
-            .and_then(|parent| parent.parent())
-            .expect("target debug dir")
-            .join("registry-notary-cel-worker");
-        if candidate.is_file() {
-            return candidate;
-        }
-    }
-    env_path
-}
-
-#[cfg(feature = "cel-worker-fixture")]
-fn cel_worker_fixture_bin() -> PathBuf {
-    PathBuf::from(env!("CARGO_BIN_EXE_registry-notary-cel-worker-fixture"))
-}
-
-fn config() -> CelWorkerConfig {
-    CelWorkerConfig {
-        command: cel_worker_bin(),
-        command_args: Vec::new(),
-        command_envs: Vec::new(),
-        current_dir: None,
-        max_workers: 1,
-        startup_timeout: Duration::from_secs(10),
-        request_timeout: Duration::from_secs(5),
-        max_request_bytes: 8192,
-        max_response_bytes: 8192,
-        max_stderr_bytes: 128,
-        max_memory_bytes: None,
-        allow_regex: false,
-        limits: CelWorkerLimits::default(),
-        forbidden_env_names: BTreeSet::from([
-            OsString::from("REGISTRY_NOTARY_TEST_HSM_PIN"),
-            OsString::from("REGISTRY_NOTARY_TEST_UNRELATED_SECRET"),
-        ]),
-    }
-}
-
-#[test]
-fn cel_worker_default_standalone_request_size_fits_stdio_frame() {
-    let worker = CelWorkerConfig::from_standalone_config(&RegistryNotaryCelConfig::default());
-
-    assert!(
-        worker.max_request_bytes <= CEL_WORKER_MAX_STDIN_BYTES,
-        "default standalone CEL request cap {} exceeds worker stdin cap {}",
-        worker.max_request_bytes,
-        CEL_WORKER_MAX_STDIN_BYTES
-    );
-}
-
-#[test]
-fn cel_worker_max_standalone_request_size_fits_stdio_frame() {
-    let config = RegistryNotaryCelConfig {
-        max_binding_json_bytes: 1024 * 1024,
-        max_expression_bytes: 256 * 1024,
-        ..RegistryNotaryCelConfig::default()
-    };
-    let worker = CelWorkerConfig::from_standalone_config(&config);
-
-    assert!(
-        worker.max_request_bytes <= CEL_WORKER_MAX_STDIN_BYTES,
-        "maximum standalone CEL request cap {} exceeds worker stdin cap {}",
-        worker.max_request_bytes,
-        CEL_WORKER_MAX_STDIN_BYTES
-    );
-}
-
-#[cfg(feature = "cel-worker-fixture")]
-fn fixture_config() -> CelWorkerConfig {
-    CelWorkerConfig {
-        command: cel_worker_fixture_bin(),
-        command_args: Vec::new(),
-        command_envs: Vec::new(),
-        current_dir: None,
-        max_workers: 1,
-        startup_timeout: Duration::from_secs(10),
-        request_timeout: Duration::from_secs(5),
-        max_request_bytes: 8192,
-        max_response_bytes: 8192,
-        max_stderr_bytes: 128,
-        max_memory_bytes: None,
-        allow_regex: false,
-        limits: CelWorkerLimits::default(),
-        forbidden_env_names: BTreeSet::from([
-            OsString::from("REGISTRY_NOTARY_TEST_HSM_PIN"),
-            OsString::from("REGISTRY_NOTARY_TEST_UNRELATED_SECRET"),
-        ]),
-    }
-}
-
-#[tokio::test]
-async fn cel_worker_evaluates_through_bounded_process_protocol() {
-    let worker = CelWorker::new(config()).await.expect("worker starts");
-
-    let value = worker
-        .evaluate(
-            "source.birth.age >= vars.minimum_age",
-            json!({
-                "source": { "birth": { "age": 21 } },
-                "vars": { "minimum_age": 18 },
-                "claims": {},
-                "ctx": { "purpose": "test" },
-                "meta": {}
-            }),
-        )
-        .await
-        .expect("CEL evaluates");
-
-    assert_eq!(value, json!(true));
-}
-
-#[tokio::test]
-async fn cel_worker_protocol_accepts_json_escaped_multiline_expression() {
-    let worker = CelWorker::new(config()).await.expect("worker starts");
-    let expression = "health.exists && health.date_of_birth != null\n  ? date.age_on(health.date_of_birth, as_of_date)\n  : null";
-
-    let value = worker
-        .evaluate(
-            expression,
-            json!({
-                "health": {
-                    "exists": true,
-                    "date_of_birth": "2017-06-15",
-                },
-                "as_of_date": "2026-01-01",
-            }),
-        )
-        .await
-        .expect("escaped newlines survive the worker request envelope");
-
-    assert_eq!(value, json!(8));
-}
-
-#[tokio::test]
-async fn cel_worker_protocol_preserves_successful_null_result() {
-    let worker = CelWorker::new(config()).await.expect("worker starts");
-
-    let value = worker
-        .evaluate("null", json!({}))
-        .await
-        .expect("CEL null is a successful result");
-
-    assert_eq!(value, serde_json::Value::Null);
-}
-
-#[tokio::test]
-async fn cel_worker_evaluates_date_age_against_context_today() {
-    let worker = CelWorker::new(config()).await.expect("worker starts");
-
-    let value = worker
-        .evaluate(
-            "date.age_on(source.patient.birth_date, ctx.today) >= 18",
-            json!({
-                "source": { "patient": { "birth_date": "2000-06-16" } },
-                "vars": {},
-                "claims": {},
-                "ctx": {
-                    "purpose": "test",
-                    "today": "2026-06-16"
-                },
-                "meta": {}
-            }),
-        )
-        .await
-        .expect("CEL evaluates");
-
-    assert_eq!(value, json!(true));
-}
-
-#[tokio::test]
-async fn cel_worker_snapshot_reports_ready_capacity() {
-    let worker = CelWorker::new(CelWorkerConfig {
-        max_workers: 2,
-        ..config()
-    })
-    .await
-    .expect("worker starts");
-
-    let snapshot = worker.snapshot().await.expect("snapshot succeeds");
-
-    assert_eq!(snapshot.max_workers, 2);
-    assert_eq!(snapshot.idle_workers, 2);
-    assert_eq!(snapshot.in_flight, 0);
-    assert!(worker.check_ready().await);
-}
-
-#[tokio::test]
-#[cfg(feature = "cel-worker-fixture")]
-async fn cel_worker_rejects_sleeping_process_before_it_can_be_ready() {
-    let _guard = CEL_WORKER_TEST_LOCK.lock().await;
-    let mut config = fixture_config();
-    config.startup_timeout = Duration::from_millis(100);
-    config.command_envs.push((
-        OsString::from("REGISTRY_NOTARY_CEL_WORKER_FIXTURE_STARTUP_MODE"),
-        OsString::from("sleep"),
-    ));
-
-    let error = CelWorker::new(config)
-        .await
-        .expect_err("sleeping process never proves the CEL protocol");
-
-    assert!(matches!(error, CelWorkerError::Unavailable));
-    assert_eq!(error.to_string(), "CEL worker is unavailable");
-}
-
-#[tokio::test]
-#[cfg(feature = "cel-worker-fixture")]
-async fn cel_worker_rejects_wrong_protocol_before_it_can_be_ready() {
-    let _guard = CEL_WORKER_TEST_LOCK.lock().await;
-    let mut config = fixture_config();
-    config.command_envs.push((
-        OsString::from("REGISTRY_NOTARY_CEL_WORKER_FIXTURE_STARTUP_MODE"),
-        OsString::from("wrong_protocol"),
-    ));
-
-    let error = CelWorker::new(config)
-        .await
-        .expect_err("wrong protocol process is never admitted");
-
-    assert!(matches!(error, CelWorkerError::Unavailable));
-    assert_eq!(error.to_string(), "CEL worker is unavailable");
-}
-
-#[tokio::test]
-#[cfg(feature = "cel-worker-fixture")]
-async fn cel_worker_activation_rejects_a_worker_that_replies_then_exits() {
-    let _guard = CEL_WORKER_TEST_LOCK.lock().await;
-    let mut config = fixture_config();
-    config.command_envs.push((
-        OsString::from("REGISTRY_NOTARY_CEL_WORKER_FIXTURE_STARTUP_MODE"),
-        OsString::from("reply_then_exit"),
-    ));
-
-    let error = CelWorker::new(config)
-        .await
-        .expect_err("a startup reply without live capacity must fail activation");
-
-    assert!(matches!(error, CelWorkerError::Unavailable), "{error:?}");
-    assert_eq!(error.to_string(), "CEL worker is unavailable");
-}
-
-#[tokio::test]
-#[cfg(feature = "cel-worker-fixture")]
-async fn cel_worker_activation_probes_each_process_once() {
-    let _guard = CEL_WORKER_TEST_LOCK.lock().await;
-    let mut config = fixture_config();
-    config.command_envs.push((
-        OsString::from("REGISTRY_NOTARY_CEL_WORKER_FIXTURE_STARTUP_MODE"),
-        OsString::from("reject_repeated_probe"),
-    ));
-
-    let worker = CelWorker::new(config)
-        .await
-        .expect("one protocol probe per process completes activation");
-
-    assert!(worker.is_activated());
-    assert!(worker.check_ready().await);
-}
-
-#[tokio::test]
-#[cfg(feature = "cel-worker-fixture")]
-async fn lazy_cel_worker_is_not_ready_until_protocol_activation_completes() {
-    let _guard = CEL_WORKER_TEST_LOCK.lock().await;
-    let worker = CelWorker::lazy(fixture_config());
-
-    assert!(!worker.is_activated());
-    assert!(!worker.check_ready().await);
-    assert!(!worker.is_activated(), "readiness must not trigger startup");
-
-    worker
-        .activate()
-        .await
-        .expect("protocol activation succeeds");
-    assert!(worker.is_activated());
-    assert!(worker.check_ready().await);
-}
-
-#[tokio::test]
-async fn cel_worker_request_size_cap_applies_before_worker_dispatch() {
-    let worker = CelWorker::new(CelWorkerConfig {
-        max_request_bytes: 512,
-        ..config()
-    })
-    .await
-    .expect("worker starts");
-
-    let error = worker
-        .evaluate(
-            "true",
-            json!({
-                "source": { "value": "x".repeat(256) },
-                "vars": {},
-                "claims": {},
-                "ctx": {},
-                "meta": {}
-            }),
-        )
-        .await
-        .expect_err("oversized request fails before dispatch");
-
-    assert!(matches!(
-        error,
-        CelWorkerError::Harness(WorkerError::RequestTooLarge { limit: 512, .. })
-    ));
-    let snapshot = worker.snapshot().await.expect("snapshot succeeds");
-    assert_eq!(snapshot.idle_workers, 1);
-    assert_eq!(snapshot.in_flight, 0);
-}
-
-#[tokio::test]
-async fn cel_worker_errors_do_not_disclose_expression_or_bindings() {
-    let worker = CelWorker::new(config()).await.expect("worker starts");
-    let secret = "secret-source-value";
-    let expression = "source.birth.value == 'secret-source-value' && unknown(";
-
-    let error = worker
-        .evaluate(
-            expression,
-            json!({
-                "source": { "birth": { "value": secret } },
-                "vars": {},
-                "claims": {},
-                "ctx": {},
-                "meta": {}
-            }),
-        )
-        .await
-        .expect_err("invalid expression fails");
-
-    let debug = format!("{error:?}");
-    let display = error.to_string();
-    assert!(matches!(error, CelWorkerError::Compile));
-    assert!(!debug.contains(expression));
-    assert!(!display.contains(expression));
-    assert!(!debug.contains(secret));
-    assert!(!display.contains(secret));
-}
-
-#[tokio::test]
-#[cfg(feature = "cel-worker-fixture")]
-async fn cel_worker_timeout_kills_and_replaces_fixture_worker() {
-    let _guard = CEL_WORKER_TEST_LOCK.lock().await;
-    let worker = CelWorker::new(fixture_config())
-        .await
-        .expect("worker starts");
-
-    let error = worker
-        .evaluate("fixture.hang", json!({}))
-        .await
-        .expect_err("hung worker times out");
-
-    assert!(matches!(
-        error,
-        CelWorkerError::Harness(WorkerError::Timeout { .. })
-    ));
-    wait_for_cel_ready(&worker).await;
-    let restarted = worker
-        .evaluate("fixture.value", json!({ "value": "after-timeout" }))
-        .await
-        .expect("replacement worker answers");
-    assert_eq!(restarted, json!("after-timeout"));
-}
-
-#[tokio::test]
-#[cfg(feature = "cel-worker-fixture")]
-async fn cel_worker_stdout_cap_kills_and_replaces_fixture_worker() {
-    let _guard = CEL_WORKER_TEST_LOCK.lock().await;
-    let worker = CelWorker::new(CelWorkerConfig {
-        max_response_bytes: 256,
-        ..fixture_config()
-    })
-    .await
-    .expect("worker starts");
-
-    let error = worker
-        .evaluate("fixture.big_stdout", json!({ "stdout_bytes": 512 }))
-        .await
-        .expect_err("oversized worker stdout fails");
-
-    assert!(
-        matches!(
-            error,
-            CelWorkerError::Harness(WorkerError::StdoutTooLarge { limit: 256, .. })
-        ),
-        "{error:?}"
-    );
-    wait_for_cel_ready(&worker).await;
-    let restarted = worker
-        .evaluate("fixture.value", json!({ "value": "ok" }))
-        .await
-        .expect("replacement worker answers");
-    assert_eq!(restarted, json!("ok"));
-}
-
-#[tokio::test]
-#[cfg(feature = "cel-worker-fixture")]
-async fn cel_worker_stderr_cap_does_not_disclose_fixture_stderr() {
-    let _guard = CEL_WORKER_TEST_LOCK.lock().await;
-    let worker = CelWorker::new(CelWorkerConfig {
-        max_stderr_bytes: 8,
-        ..fixture_config()
-    })
-    .await
-    .expect("worker starts");
-    let secret = "stderr-secret-value";
-
-    let error = worker
-        .evaluate(
-            "fixture.stderr_then_crash",
-            json!({ "stderr_bytes": 128, "secret": secret }),
-        )
-        .await
-        .expect_err("fixture exits after writing stderr");
-
-    assert!(
-        matches!(
-            error,
-            CelWorkerError::Harness(WorkerError::WorkerExited { .. })
-        ),
-        "{error:?}"
-    );
-    let debug = format!("{error:?}");
-    let display = error.to_string();
-    assert!(!debug.contains(secret));
-    assert!(!display.contains(secret));
-}
-
-#[cfg(feature = "cel-worker-fixture")]
-async fn wait_for_cel_ready(worker: &CelWorker) {
-    let deadline = tokio::time::Instant::now() + Duration::from_secs(5);
-    loop {
-        if worker.check_ready().await {
-            return;
-        }
-        assert!(
-            tokio::time::Instant::now() < deadline,
-            "CEL worker did not become ready"
-        );
-        tokio::time::sleep(Duration::from_millis(10)).await;
-    }
-}
-
-#[tokio::test]
-async fn cel_stdio_worker_rejects_oversized_stdin_frame() {
-    let mut child = Command::new(cel_worker_bin())
-        .stdin(std::process::Stdio::piped())
-        .stdout(std::process::Stdio::null())
-        .stderr(std::process::Stdio::null())
-        .spawn()
-        .expect("worker process starts");
-    let mut stdin = child.stdin.take().expect("worker stdin is piped");
-    let oversized = format!("{}\n", "x".repeat(CEL_WORKER_MAX_STDIN_BYTES + 1));
-
-    if let Err(error) = stdin.write_all(oversized.as_bytes()).await {
-        assert_eq!(error.kind(), std::io::ErrorKind::BrokenPipe);
-    }
-    drop(stdin);
-    let status = tokio::time::timeout(Duration::from_secs(5), child.wait())
-        .await
-        .expect("worker exits after oversized frame")
-        .expect("worker status");
-
-    assert!(!status.success());
-}
-
-#[tokio::test]
-async fn cel_stdio_worker_echoes_policy_hash() {
-    let expression = "source.age >= 18";
-    let policy_hash = cel_policy_hash(expression);
-    let mut child = Command::new(cel_worker_bin())
-        .stdin(std::process::Stdio::piped())
-        .stdout(std::process::Stdio::piped())
-        .spawn()
-        .expect("worker starts");
-    let mut stdin = child.stdin.take().expect("stdin is piped");
-    stdin
-        .write_all(
-            serde_json::to_string(&json!({
-                "protocol": "registry-notary-cel-worker/v1",
-                "policy_hash": policy_hash,
-                "expression": expression,
-                "root_bindings": {
-                    "source": { "age": 21 },
-                    "claims": {},
-                    "ctx": {},
-                    "vars": {},
-                    "meta": {}
-                }
-            }))
-            .expect("request serializes")
-            .as_bytes(),
-        )
-        .await
-        .expect("write request");
-    stdin.write_all(b"\n").await.expect("write newline");
-    drop(stdin);
-
-    let output = child
-        .wait_with_output()
-        .await
-        .expect("worker exits after stdin closes");
-    assert!(output.status.success());
-    let response: serde_json::Value =
-        serde_json::from_slice(&output.stdout).expect("worker emits JSON");
-    assert_eq!(response["policy_hash"], json!(cel_policy_hash(expression)));
-    assert_eq!(response["status"], json!("success"));
-    assert_eq!(response["value"], json!(true));
-}
-
-#[tokio::test]
-async fn cel_stdio_worker_rejects_regex_helpers_by_default() {
-    let expression = "text.regex_extract(source.name, '^A(.+)$', 1)";
-    let mut child = Command::new(cel_worker_bin())
-        .stdin(std::process::Stdio::piped())
-        .stdout(std::process::Stdio::piped())
-        .spawn()
-        .expect("worker starts");
-    let mut stdin = child.stdin.take().expect("stdin is piped");
-    stdin
-        .write_all(
-            serde_json::to_string(&json!({
-                "protocol": "registry-notary-cel-worker/v1",
-                "policy_hash": cel_policy_hash(expression),
-                "expression": expression,
-                "root_bindings": {
-                    "source": { "name": "Amina" },
-                    "claims": {},
-                    "ctx": {},
-                    "vars": {},
-                    "meta": {}
-                }
-            }))
-            .expect("request serializes")
-            .as_bytes(),
-        )
-        .await
-        .expect("write request");
-    stdin.write_all(b"\n").await.expect("write newline");
-    drop(stdin);
-
-    let output = child
-        .wait_with_output()
-        .await
-        .expect("worker exits after stdin closes");
-    assert!(output.status.success());
-    let response: serde_json::Value =
-        serde_json::from_slice(&output.stdout).expect("worker emits JSON");
-    assert_eq!(response["policy_hash"], json!(cel_policy_hash(expression)));
-    assert_eq!(response["status"], json!("error"));
-    assert_eq!(response["error"], json!("compile"));
-    assert!(response.get("value").is_none());
-}
-
-#[tokio::test]
-#[cfg(feature = "cel-worker-fixture")]
-async fn cel_worker_env_is_cleared_except_explicit_allow_list() {
-    let _guard = CEL_WORKER_TEST_LOCK.lock().await;
-    std::env::set_var("REGISTRY_NOTARY_TEST_UNRELATED_SECRET", "unrelated-secret");
-    std::env::set_var("REGISTRY_NOTARY_TEST_HSM_PIN", "1234");
-    let mut config = fixture_config();
-    config.command_envs.push((
-        OsString::from("REGISTRY_NOTARY_TEST_ALLOWED"),
-        OsString::from("benign"),
-    ));
-    let worker = CelWorker::new(config).await.expect("worker starts");
-
-    let value = worker
-        .evaluate(
-            "fixture.env",
-            json!({
-                "env_keys": [
-                    "REGISTRY_NOTARY_TEST_UNRELATED_SECRET",
-                    "REGISTRY_NOTARY_TEST_HSM_PIN",
-                    "REGISTRY_NOTARY_TEST_ALLOWED"
-                ]
-            }),
-        )
-        .await
-        .expect("fixture reads env");
-
-    assert!(value["REGISTRY_NOTARY_TEST_UNRELATED_SECRET"].is_null());
-    assert!(value["REGISTRY_NOTARY_TEST_HSM_PIN"].is_null());
-    assert_eq!(value["REGISTRY_NOTARY_TEST_ALLOWED"], "benign");
-    std::env::remove_var("REGISTRY_NOTARY_TEST_UNRELATED_SECRET");
-    std::env::remove_var("REGISTRY_NOTARY_TEST_HSM_PIN");
-}
-
-#[tokio::test]
-async fn cel_worker_rejects_forbidden_explicit_env_names() {
-    let mut config = config();
-    config.command_envs.push((
-        OsString::from("REGISTRY_NOTARY_TEST_HSM_PIN"),
-        OsString::from("1234"),
-    ));
-
-    let error = CelWorker::new(config)
-        .await
-        .expect_err("forbidden explicit worker env fails validation");
-
-    assert!(matches!(error, CelWorkerError::Unavailable));
-    assert_eq!(error.to_string(), "CEL worker is unavailable");
-}
-
-#[test]
-fn cel_worker_validate_config_rejects_missing_explicit_command_path() {
-    let worker = CelWorker::lazy(CelWorkerConfig {
-        command: PathBuf::from("/registry-notary-test/missing-cel-worker"),
-        ..config()
-    });
-
-    let error = worker
-        .validate_config()
-        .expect_err("missing explicit command path fails validation");
-
-    assert!(matches!(error, CelWorkerError::Harness { .. }));
-    let text = error.to_string();
-    assert!(!text.contains("missing-cel-worker"));
-}
diff --git a/crates/registry-notary-server/tests/offline_fixture.rs b/crates/registry-notary-server/tests/offline_fixture.rs
deleted file mode 100644
index ee67fa585..000000000
--- a/crates/registry-notary-server/tests/offline_fixture.rs
+++ /dev/null
@@ -1,693 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-#![cfg(feature = "registry-notary-cel")]
-
-use std::collections::{BTreeMap, BTreeSet};
-use std::ffi::OsString;
-use std::path::PathBuf;
-use std::time::Duration;
-
-use registry_notary_core::{EvaluateRequest, StandaloneRegistryNotaryConfig};
-use registry_notary_server::cel_worker::{CelWorkerConfig, CelWorkerLimits};
-use registry_notary_server::standalone::{
-    OfflineAuthentication, OfflineNotaryErrorClass, OfflineNotaryHarness,
-    OfflineNotaryHarnessError, OfflineNotaryRequest, OfflineRelayConsultation, OfflineRelayOutcome,
-};
-use serde_json::{json, Value};
-
-const CONTRACT_HASH: &str =
-    "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
-const OTHER_CONTRACT_HASH: &str =
-    "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
-
-fn config() -> StandaloneRegistryNotaryConfig {
-    serde_norway::from_str(
-        r#"
-evidence:
-  enabled: true
-  service_id: offline-notary-test
-  allowed_purposes: [benefit-verification, other-verification]
-  variables:
-    as_of_date: { from: request.variables.as_of_date, type: date }
-  relay:
-    base_url: https://relay.internal.example
-    workload_client_id: registry-notary
-    token_file: /run/secrets/registry-notary-relay.jwt
-  signing_keys:
-    issuer-key:
-      provider: local_jwk_env
-      private_jwk_env: OFFLINE_UNUSED_ISSUER_KEY
-      alg: EdDSA
-      kid: did:web:issuer.example#key-1
-      status: active
-  claims:
-    - id: record-exists
-      title: Record exists
-      version: "1"
-      subject_type: person
-      evidence_mode: &person_evidence
-        type: registry_backed
-        consultations:
-          enrollment:
-            profile: &person_profile
-              id: example.person.exact
-              contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-            inputs: { subject_id: target.id }
-            outputs: &person_outputs
-              active: { type: boolean, nullable: true }
-              birth_date: { type: date, nullable: true }
-              category: { type: string, nullable: true, max_bytes: 32 }
-      value: { type: boolean, nullable: false }
-      purpose: benefit-verification
-      required_scopes: [registry:person:read]
-      rule: { type: consultation_matched, consultation: enrollment }
-      formats: &formats [application/vnd.registry-notary.claim-result+json]
-      disclosure: &disclosure
-        default: value
-        allowed: [value, predicate, redacted]
-        downgrade: deny
-    - id: active
-      title: Active
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          enrollment:
-            profile: *person_profile
-            inputs: { subject_id: target.id }
-            outputs: *person_outputs
-      value: { type: boolean, nullable: true }
-      purpose: benefit-verification
-      required_scopes: [registry:person:read]
-      rule: { type: consultation_output, consultation: enrollment, output: active }
-      formats: *formats
-      disclosure: *disclosure
-    - id: birth-date
-      title: Birth date
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          enrollment:
-            profile: *person_profile
-            inputs: { subject_id: target.id }
-            outputs: *person_outputs
-      value: { type: date, nullable: true }
-      purpose: benefit-verification
-      required_scopes: [registry:person:read]
-      rule: { type: consultation_output, consultation: enrollment, output: birth_date }
-      formats: *formats
-      disclosure: *disclosure
-    - id: category
-      title: Category
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          enrollment:
-            profile: *person_profile
-            inputs: { subject_id: target.id }
-            outputs: *person_outputs
-      value: { type: string, nullable: true }
-      purpose: benefit-verification
-      required_scopes: [registry:person:read]
-      rule: { type: consultation_output, consultation: enrollment, output: category }
-      formats: *formats
-      disclosure: *disclosure
-    - id: eligible
-      title: Eligible
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          enrollment:
-            profile: *person_profile
-            inputs: { subject_id: target.id }
-            outputs: *person_outputs
-      value: { type: boolean, nullable: false }
-      purpose: benefit-verification
-      required_scopes: [registry:person:read]
-      rule:
-        type: cel
-        expression: enrollment.matched
-      formats: *formats
-      disclosure: *disclosure
-    - id: age-years
-      title: Age years
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          enrollment:
-            profile: *person_profile
-            inputs: { subject_id: target.id }
-            outputs: *person_outputs
-      value: { type: integer, nullable: true }
-      purpose: benefit-verification
-      required_scopes: [registry:person:read]
-      rule:
-        type: cel
-        expression: >-
-          enrollment.matched && enrollment.birth_date != null
-            ? date.age_on(enrollment.birth_date, as_of_date)
-            : null
-      formats: *formats
-      disclosure: *disclosure
-    - id: other-status
-      title: Other status
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          other:
-            profile:
-              id: example.other.exact
-              contract_hash: sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
-            inputs: { subject_id: target.id }
-            outputs:
-              status: { type: string, nullable: true, max_bytes: 16 }
-      value: { type: string, nullable: true }
-      purpose: other-verification
-      required_scopes: [registry:other:read]
-      rule: { type: consultation_output, consultation: other, output: status }
-      formats: *formats
-      disclosure: *disclosure
-auth:
-  api_keys:
-    - id: authoring-test-principal
-      fingerprint:
-        provider: env
-        name: OFFLINE_UNUSED_API_KEY_HASH
-      scopes: [registry:person:read, registry:other:read]
-"#,
-    )
-    .expect("offline Notary config parses")
-}
-
-fn cel_worker_bin() -> PathBuf {
-    let env_path = PathBuf::from(env!("CARGO_BIN_EXE_registry-notary-cel-worker"));
-    if env_path
-        .parent()
-        .and_then(|parent| parent.file_name())
-        .is_some_and(|file_name| file_name == "deps")
-    {
-        let candidate = env_path
-            .parent()
-            .and_then(|parent| parent.parent())
-            .expect("target debug dir")
-            .join("registry-notary-cel-worker");
-        if candidate.is_file() {
-            return candidate;
-        }
-    }
-    env_path
-}
-
-fn worker_config() -> CelWorkerConfig {
-    CelWorkerConfig {
-        command: cel_worker_bin(),
-        command_args: Vec::new(),
-        command_envs: Vec::new(),
-        current_dir: None,
-        forbidden_env_names: BTreeSet::from([
-            OsString::from("REGISTRY_NOTARY_AUDIT_HASH_SECRET"),
-            OsString::from("OFFLINE_UNUSED_API_KEY_HASH"),
-            OsString::from("OFFLINE_UNUSED_ISSUER_KEY"),
-        ]),
-        max_workers: 1,
-        startup_timeout: Duration::from_secs(10),
-        request_timeout: Duration::from_secs(5),
-        max_request_bytes: 64 * 1024,
-        max_response_bytes: 16 * 1024,
-        max_stderr_bytes: 1024,
-        max_memory_bytes: None,
-        allow_regex: false,
-        limits: CelWorkerLimits::default(),
-    }
-}
-
-fn relay(
-    profile_id: &str,
-    contract_hash: &str,
-    purpose: &str,
-    input: &str,
-    outcome: OfflineRelayOutcome,
-    outputs: BTreeMap<String, Value>,
-) -> OfflineRelayConsultation {
-    OfflineRelayConsultation::decoded(
-        profile_id,
-        contract_hash,
-        purpose,
-        "subject_id",
-        input,
-        outcome,
-        outputs,
-    )
-}
-
-fn person_relay(
-    input: &str,
-    outcome: OfflineRelayOutcome,
-    outputs: BTreeMap<String, Value>,
-) -> OfflineRelayConsultation {
-    relay(
-        "example.person.exact",
-        CONTRACT_HASH,
-        "benefit-verification",
-        input,
-        outcome,
-        outputs,
-    )
-}
-
-fn harness() -> OfflineNotaryHarness {
-    OfflineNotaryHarness::compile(
-        config(),
-        vec![
-            person_relay(
-                "person-1",
-                OfflineRelayOutcome::Match,
-                BTreeMap::from([
-                    ("active".to_string(), json!(true)),
-                    ("birth_date".to_string(), json!("2000-02-29")),
-                    ("category".to_string(), Value::Null),
-                ]),
-            ),
-            person_relay("person-none", OfflineRelayOutcome::NoMatch, BTreeMap::new()),
-            person_relay(
-                "person-ambiguous",
-                OfflineRelayOutcome::Ambiguous,
-                BTreeMap::new(),
-            ),
-            relay(
-                "example.other.exact",
-                OTHER_CONTRACT_HASH,
-                "other-verification",
-                "person-2",
-                OfflineRelayOutcome::Match,
-                BTreeMap::from([("status".to_string(), json!("CURRENT"))]),
-            ),
-        ],
-        worker_config(),
-    )
-    .expect("offline harness compiles")
-}
-
-fn request(input: Option<&str>, claims: &[&str], purpose: &str) -> EvaluateRequest {
-    let target = input.map_or_else(
-        || json!({"type": "person"}),
-        |input| json!({"type": "person", "id": input}),
-    );
-    serde_json::from_value(json!({
-        "target": target,
-        "claims": claims,
-        "disclosure": "value",
-        "purpose": purpose,
-    }))
-    .expect("evaluation request parses")
-}
-
-fn claim_value<'a>(
-    evidence: &'a registry_notary_server::standalone::OfflineNotaryEvidence,
-    claim_id: &str,
-) -> Option<&'a Value> {
-    evidence
-        .claims()
-        .iter()
-        .find(|claim| claim.claim_id() == claim_id)
-        .and_then(|claim| claim.value())
-}
-
-#[tokio::test]
-async fn composite_consultation_fixture_binds_the_complete_input_map() {
-    let mut configured = config();
-    for claim in &mut configured.evidence.claims {
-        let registry_notary_core::ClaimEvidenceMode::RegistryBacked { consultations } =
-            &mut claim.evidence_mode
-        else {
-            continue;
-        };
-        let Some(consultation) = consultations.get_mut("enrollment") else {
-            continue;
-        };
-        consultation.inputs.insert(
-            "country_code".to_string(),
-            registry_notary_core::RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.country_code".to_string(),
-            ),
-        );
-    }
-    let fixture = OfflineRelayConsultation::decoded_inputs(
-        "example.person.exact",
-        CONTRACT_HASH,
-        "benefit-verification",
-        BTreeMap::from([
-            ("country_code".to_string(), "TH".to_string()),
-            ("subject_id".to_string(), "person-1".to_string()),
-        ]),
-        OfflineRelayOutcome::Match,
-        BTreeMap::from([
-            ("active".to_string(), json!(true)),
-            ("birth_date".to_string(), json!("2000-02-29")),
-            ("category".to_string(), Value::Null),
-        ]),
-    );
-    let debug = format!("{fixture:?}");
-    assert!(debug.contains("country_code"));
-    assert!(!debug.contains("person-1"));
-    assert!(!debug.contains("TH"));
-    let harness = OfflineNotaryHarness::compile(configured, vec![fixture], worker_config())
-        .expect("composite offline harness compiles");
-    let evaluation: EvaluateRequest = serde_json::from_value(json!({
-        "target": {
-            "type": "person",
-            "id": "person-1",
-            "identifiers": [{"scheme": "country_code", "value": "TH"}]
-        },
-        "claims": ["active"],
-        "disclosure": "value",
-        "purpose": "benefit-verification"
-    }))
-    .expect("composite evaluation request parses");
-
-    let evidence = harness
-        .evaluate(OfflineNotaryRequest::new(
-            OfflineAuthentication::Valid,
-            evaluation,
-        ))
-        .await;
-
-    assert_eq!(evidence.error_class(), None, "{evidence:?}");
-    assert_eq!(claim_value(&evidence, "active"), Some(&json!(true)));
-    assert_eq!(evidence.relay_calls(), 1);
-}
-
-#[tokio::test]
-async fn production_runtime_evaluates_consultation_rules_cel_date_nullable_and_reuses_consultation()
-{
-    let mut evaluation = request(
-        Some("person-1"),
-        &[
-            "record-exists",
-            "active",
-            "birth-date",
-            "category",
-            "eligible",
-        ],
-        "benefit-verification",
-    );
-    evaluation.variables = registry_notary_core::RequestVariables::try_new(BTreeMap::from([(
-        "as_of_date".to_string(),
-        "2026-01-01".to_string(),
-    )]))
-    .expect("date request variable is bounded");
-    let harness = harness();
-    let evidence = harness
-        .evaluate(OfflineNotaryRequest::new(
-            OfflineAuthentication::Valid,
-            evaluation,
-        ))
-        .await;
-
-    assert_eq!(evidence.error_class(), None, "{evidence:?}");
-    assert_eq!(evidence.relay_calls(), 1);
-    assert_eq!(evidence.consultation_count(), 1);
-    assert_eq!(claim_value(&evidence, "record-exists"), Some(&json!(true)));
-    assert_eq!(claim_value(&evidence, "active"), Some(&json!(true)));
-    assert_eq!(
-        claim_value(&evidence, "birth-date"),
-        Some(&json!("2000-02-29"))
-    );
-    assert_eq!(claim_value(&evidence, "category"), Some(&Value::Null));
-    assert_eq!(claim_value(&evidence, "eligible"), Some(&json!(true)));
-}
-
-#[tokio::test]
-async fn guarded_date_age_policy_receives_compiled_request_variable_after_relay() {
-    let configured = config();
-    let configured_expression = configured
-        .evidence
-        .claims
-        .iter()
-        .find(|claim| claim.id == "age-years")
-        .and_then(|claim| match &claim.rule {
-            registry_notary_core::RuleConfig::Cel { expression, .. } => Some(expression.as_str()),
-            _ => None,
-        })
-        .expect("age policy is configured as CEL");
-    assert!(configured_expression.contains('\n'));
-    let direct = registry_notary_server::cel_worker::CelWorker::lazy(worker_config())
-        .evaluate(
-            configured_expression,
-            json!({
-                "enrollment": {
-                    "matched": true,
-                    "outcome": "match",
-                    "active": true,
-                    "birth_date": "2000-02-29",
-                    "category": null,
-                },
-                "as_of_date": "2026-01-01",
-            }),
-        )
-        .await;
-    assert_eq!(direct.expect("direct worker policy evaluates"), json!(25));
-    let mut evaluation = request(Some("person-1"), &["age-years"], "benefit-verification");
-    evaluation.variables = registry_notary_core::RequestVariables::try_new(BTreeMap::from([(
-        "as_of_date".to_string(),
-        "2026-01-01".to_string(),
-    )]))
-    .expect("date request variable is bounded");
-    let harness = harness();
-    let evidence = harness
-        .evaluate(OfflineNotaryRequest::new(
-            OfflineAuthentication::Valid,
-            evaluation,
-        ))
-        .await;
-
-    assert_eq!(evidence.error_class(), None, "{evidence:?}");
-    assert_eq!(claim_value(&evidence, "age-years"), Some(&json!(25)));
-    assert_eq!(evidence.relay_calls(), 1);
-
-    let mut absent_evaluation =
-        request(Some("person-none"), &["age-years"], "benefit-verification");
-    absent_evaluation.variables = registry_notary_core::RequestVariables::try_new(BTreeMap::from(
-        [("as_of_date".to_string(), "2026-01-01".to_string())],
-    ))
-    .expect("date request variable is bounded");
-    let absent = harness
-        .evaluate(OfflineNotaryRequest::new(
-            OfflineAuthentication::Valid,
-            absent_evaluation,
-        ))
-        .await;
-    assert_eq!(absent.error_class(), None, "{absent:?}");
-    assert_eq!(claim_value(&absent, "age-years"), Some(&Value::Null));
-    assert_eq!(absent.relay_calls(), 1);
-}
-
-#[tokio::test]
-async fn authentication_scope_purpose_and_input_denials_are_before_all_source_access() {
-    let harness = harness();
-    for authentication in [
-        OfflineAuthentication::Missing,
-        OfflineAuthentication::WrongCredential,
-        OfflineAuthentication::InsufficientScope,
-    ] {
-        let evidence = harness
-            .evaluate(OfflineNotaryRequest::new(
-                authentication,
-                request(Some("person-1"), &["active"], "benefit-verification"),
-            ))
-            .await;
-        assert_eq!(
-            evidence.error_class(),
-            Some(OfflineNotaryErrorClass::AuthorizationDenied),
-            "{evidence:?}"
-        );
-        assert_eq!(evidence.relay_calls(), 0);
-    }
-
-    let wrong_purpose = harness
-        .evaluate(OfflineNotaryRequest::new(
-            OfflineAuthentication::Valid,
-            request(Some("person-1"), &["active"], "unrelated-purpose"),
-        ))
-        .await;
-    assert_eq!(
-        wrong_purpose.error_class(),
-        Some(OfflineNotaryErrorClass::PurposeDenied)
-    );
-    assert_eq!(wrong_purpose.relay_calls(), 0);
-
-    let malformed = harness
-        .evaluate(OfflineNotaryRequest::new(
-            OfflineAuthentication::Valid,
-            request(None, &["active"], "benefit-verification"),
-        ))
-        .await;
-    assert_eq!(
-        malformed.error_class(),
-        Some(OfflineNotaryErrorClass::InvalidInput)
-    );
-    assert_eq!(malformed.relay_calls(), 0);
-
-    let mut forbidden_disclosure_request =
-        request(Some("person-1"), &["active"], "benefit-verification");
-    forbidden_disclosure_request.disclosure = Some("unsupported".to_string());
-    let forbidden_disclosure = harness
-        .evaluate(OfflineNotaryRequest::new(
-            OfflineAuthentication::Valid,
-            forbidden_disclosure_request,
-        ))
-        .await;
-    assert_eq!(
-        forbidden_disclosure.error_class(),
-        Some(OfflineNotaryErrorClass::InvalidInput)
-    );
-    assert_eq!(forbidden_disclosure.relay_calls(), 0);
-}
-
-#[tokio::test]
-async fn exact_profiles_are_isolated_and_missing_input_or_ambiguous_results_fail_closed() {
-    let harness = harness();
-    let other = harness
-        .evaluate(OfflineNotaryRequest::new(
-            OfflineAuthentication::Valid,
-            request(Some("person-2"), &["other-status"], "other-verification"),
-        ))
-        .await;
-    assert_eq!(other.error_class(), None, "{other:?}");
-    assert_eq!(claim_value(&other, "other-status"), Some(&json!("CURRENT")));
-    assert_eq!(other.relay_calls(), 1);
-
-    let missing_exact_input = harness
-        .evaluate(OfflineNotaryRequest::new(
-            OfflineAuthentication::Valid,
-            request(
-                Some("person-not-installed"),
-                &["active"],
-                "benefit-verification",
-            ),
-        ))
-        .await;
-    assert_eq!(
-        missing_exact_input.error_class(),
-        Some(OfflineNotaryErrorClass::InvalidInput)
-    );
-    assert_eq!(missing_exact_input.relay_calls(), 0);
-
-    let ambiguous = harness
-        .evaluate(OfflineNotaryRequest::new(
-            OfflineAuthentication::Valid,
-            request(
-                Some("person-ambiguous"),
-                &["active"],
-                "benefit-verification",
-            ),
-        ))
-        .await;
-    assert_eq!(
-        ambiguous.error_class(),
-        Some(OfflineNotaryErrorClass::EvaluationFailed)
-    );
-    assert_eq!(
-        ambiguous.product_error_code(),
-        Some("evidence.not_available")
-    );
-    assert_eq!(ambiguous.relay_calls(), 1);
-}
-
-#[tokio::test]
-async fn no_match_nullable_and_redacted_disclosure_use_production_views() {
-    let harness = harness();
-    let absent = harness
-        .evaluate(OfflineNotaryRequest::new(
-            OfflineAuthentication::Valid,
-            request(
-                Some("person-none"),
-                &["record-exists", "category"],
-                "benefit-verification",
-            ),
-        ))
-        .await;
-    assert_eq!(absent.error_class(), None, "{absent:?}");
-    assert_eq!(claim_value(&absent, "record-exists"), Some(&json!(false)));
-    assert_eq!(claim_value(&absent, "category"), Some(&Value::Null));
-    assert_eq!(absent.relay_calls(), 1);
-    assert_eq!(absent.consultation_count(), 1);
-
-    let mut redacted_request = request(Some("person-1"), &["birth-date"], "benefit-verification");
-    redacted_request.disclosure = Some("redacted".to_string());
-    let redacted = harness
-        .evaluate(OfflineNotaryRequest::new(
-            OfflineAuthentication::Valid,
-            redacted_request,
-        ))
-        .await;
-    assert_eq!(redacted.error_class(), None, "{redacted:?}");
-    assert_eq!(redacted.claims()[0].value(), None);
-    assert_eq!(redacted.claims()[0].disclosure(), "redacted");
-    assert_eq!(
-        redacted.claims()[0].redacted_fields(),
-        &["birth-date".to_string()]
-    );
-
-    let mut predicate_request = request(Some("person-1"), &["active"], "benefit-verification");
-    predicate_request.disclosure = Some("predicate".to_string());
-    let predicate = harness
-        .evaluate(OfflineNotaryRequest::new(
-            OfflineAuthentication::Valid,
-            predicate_request,
-        ))
-        .await;
-    assert_eq!(predicate.error_class(), None, "{predicate:?}");
-    assert_eq!(predicate.claims()[0].value(), Some(&json!(true)));
-    assert_eq!(predicate.claims()[0].satisfied(), Some(true));
-    assert_eq!(predicate.claims()[0].disclosure(), "predicate");
-}
-
-#[test]
-fn decoder_evidence_must_bind_to_a_compiled_profile_contract() {
-    let result = OfflineNotaryHarness::compile(
-        config(),
-        vec![person_relay(
-            "person-1",
-            OfflineRelayOutcome::Match,
-            BTreeMap::from([
-                ("active".to_string(), json!(true)),
-                ("birth_date".to_string(), json!("2000-02-29")),
-                ("category".to_string(), json!("CURRENT")),
-            ]),
-        )],
-        worker_config(),
-    );
-    assert!(result.is_ok());
-
-    let wrong_contract = OfflineNotaryHarness::compile(
-        config(),
-        vec![relay(
-            "example.person.exact",
-            OTHER_CONTRACT_HASH,
-            "benefit-verification",
-            "person-1",
-            OfflineRelayOutcome::Match,
-            BTreeMap::from([
-                ("active".to_string(), json!(true)),
-                ("birth_date".to_string(), json!("2000-02-29")),
-                ("category".to_string(), json!("CURRENT")),
-            ]),
-        )],
-        worker_config(),
-    );
-    assert!(matches!(
-        wrong_contract,
-        Err(OfflineNotaryHarnessError::InvalidRelayEvidence)
-    ));
-}
diff --git a/crates/registry-notary-server/tests/sd_jwt_vc_verifier_compat.rs b/crates/registry-notary-server/tests/sd_jwt_vc_verifier_compat.rs
deleted file mode 100644
index acdc02d71..000000000
--- a/crates/registry-notary-server/tests/sd_jwt_vc_verifier_compat.rs
+++ /dev/null
@@ -1,419 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! SD-JWT VC verifier compatibility harness.
-//!
-//! Verifies committed golden fixtures against the `verify_sd_jwt_vc` path in
-//! `registry-notary-client`. Each test is self-contained: it reads a fixture
-//! file and the issuer JWKS from `tests/fixtures/sd_jwt_vc/`, then calls the
-//! verifier with a deterministic clock that matches the fixture timestamps.
-//!
-//! Run the harness with:
-//!   cargo nextest run -p registry-notary-server sd_jwt_vc_verifier_compat
-//! or:
-//!   cargo test -p registry-notary-server --test sd_jwt_vc_verifier_compat
-//!
-//! The harness requires no secret material and no network access.
-//! Fixtures are pre-generated synthetic material. Regenerate them with:
-//!   cargo run -p xtask -- gen-sd-jwt-vc-fixtures
-//! or regenerate only the deterministic 1.0 algorithm fixtures with:
-//!   cargo run -p xtask -- gen-oid4vci-algorithm-fixtures
-
-use std::path::Path;
-use std::time::Duration;
-
-use registry_notary_client::verifier::verify_sd_jwt_vc;
-use registry_notary_client::{HolderBindingPolicy, VerifyOptions};
-use registry_platform_crypto::{did_jwk_from_public_jwk, PrivateJwk};
-use registry_platform_oid4vci::{
-    validate_proof_jwt, ProofError, ProofIssuerPolicy, ProofValidationPolicy,
-};
-use serde_json::Value;
-
-// ---------------------------------------------------------------------------
-// Constants that match the fixture generator in xtask/src/main.rs.
-// If you change the generator, update these constants too.
-// ---------------------------------------------------------------------------
-
-const ISSUER: &str = "did:web:fixture.test";
-const VCT: &str = "https://fixture.test/credentials/registry-witness/v1";
-// Fixed clock: 2024-01-15T00:00:10Z (10 seconds after IAT so exp check passes).
-const NOW_UNIX: i64 = 1_705_276_810;
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-fn fixture_dir() -> std::path::PathBuf {
-    // CARGO_MANIFEST_DIR is crates/registry-notary-server/
-    let manifest = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
-    manifest
-        .parent() // crates/
-        .and_then(Path::parent) // workspace root
-        .expect("workspace root exists")
-        .join("products/notary/tests/fixtures/sd_jwt_vc")
-}
-
-fn read_fixture(name: &str) -> String {
-    let path = fixture_dir().join(name);
-    std::fs::read_to_string(&path)
-        .unwrap_or_else(|e| panic!("fixture {name} unreadable at {}: {e}", path.display()))
-        .trim()
-        .to_string()
-}
-
-fn read_fixture_json(name: &str) -> Value {
-    let content = read_fixture(name);
-    serde_json::from_str(&content)
-        .unwrap_or_else(|e| panic!("fixture {name} is not valid JSON: {e}"))
-}
-
-fn jwks() -> Value {
-    read_fixture_json("issuer-jwks.json")
-}
-
-fn meta() -> Value {
-    read_fixture_json("meta.json")
-}
-
-fn now() -> time::OffsetDateTime {
-    time::OffsetDateTime::from_unix_timestamp(NOW_UNIX).expect("test timestamp")
-}
-
-fn base_options() -> VerifyOptions {
-    VerifyOptions::new(ISSUER).expected_vct(VCT).now(now())
-}
-
-// ---------------------------------------------------------------------------
-// Positive fixtures
-// ---------------------------------------------------------------------------
-
-#[test]
-fn valid_credential_verifies_end_to_end() {
-    let compact = read_fixture("valid.sd-jwt");
-    let result =
-        verify_sd_jwt_vc(&compact, &jwks(), &base_options()).expect("valid fixture must verify");
-
-    let meta = meta();
-    assert_eq!(result.issuer, ISSUER);
-    assert_eq!(result.vct, VCT);
-    assert_eq!(result.algorithm, "EdDSA");
-    assert_eq!(
-        result.key_id,
-        meta["key_id"].as_str().expect("key_id in meta")
-    );
-    // valid.sd-jwt was issued with claim_a and claim_b.
-    assert_eq!(result.disclosure_count, 2);
-    assert!(
-        result.holder_key_id.is_none(),
-        "no holder binding in valid.sd-jwt"
-    );
-    assert!(result.expires_at > result.issued_at);
-}
-
-#[test]
-fn valid_holder_bound_credential_verifies_with_required_kid_policy() {
-    let compact = read_fixture("valid-holder-bound.sd-jwt");
-    let meta = meta();
-    let holder_did = meta["holder_did"]
-        .as_str()
-        .expect("holder_did in meta")
-        .to_string();
-
-    let options =
-        base_options().holder_binding(HolderBindingPolicy::RequiredKid(holder_did.clone()));
-    let result = verify_sd_jwt_vc(&compact, &jwks(), &options)
-        .expect("holder-bound fixture must verify with RequiredKid policy");
-
-    assert_eq!(result.issuer, ISSUER);
-    assert_eq!(result.vct, VCT);
-    assert_eq!(
-        result.holder_key_id.as_deref(),
-        Some(holder_did.as_str()),
-        "holder_key_id must match the cnf.kid in the credential"
-    );
-}
-
-#[test]
-fn es256_credential_verifies_end_to_end_with_explicit_algorithm_policy() {
-    let compact = read_fixture("valid-es256.sd-jwt");
-    let meta = meta();
-    let holder_did = meta["holder_did"]
-        .as_str()
-        .expect("holder_did in meta")
-        .to_string();
-    let options = base_options()
-        .accepted_algorithms(["ES256"])
-        .holder_binding(HolderBindingPolicy::RequiredKid(holder_did.clone()));
-
-    let result = verify_sd_jwt_vc(&compact, &jwks(), &options)
-        .expect("ES256 issuer fixture must verify when explicitly accepted");
-
-    assert_eq!(result.algorithm, "ES256");
-    assert_eq!(
-        result.key_id,
-        meta["es256_key_id"].as_str().expect("es256_key_id in meta")
-    );
-    assert_eq!(result.holder_key_id.as_deref(), Some(holder_did.as_str()));
-    assert_eq!(result.disclosure_count, 0);
-}
-
-#[test]
-fn es256_credential_is_not_silently_enabled_by_the_default_verifier_policy() {
-    let err = verify_sd_jwt_vc(
-        &read_fixture("valid-es256.sd-jwt"),
-        &jwks(),
-        &base_options(),
-    )
-    .expect_err("ES256 must require an explicit verifier allow-list");
-
-    assert_eq!(err.code(), "algorithm.disallowed");
-}
-
-#[test]
-fn oid4vci_algorithm_profile_is_exact_and_narrow() {
-    let profile = read_fixture_json("algorithm-profile.json");
-    let configurations = &profile["credential_configurations"];
-
-    assert_eq!(
-        configurations["fixture_eddsa"],
-        serde_json::json!({
-            "credential_signing_alg_values_supported": ["EdDSA"],
-            "proof_signing_alg_values_supported": ["EdDSA"],
-            "cryptographic_binding_methods_supported": ["did:jwk"],
-            "fixture": "valid-holder-bound.sd-jwt",
-            "private_jwk_fixture": "issuer-eddsa-private.test.jwk.json"
-        })
-    );
-    assert_eq!(
-        configurations["fixture_es256"],
-        serde_json::json!({
-            "credential_signing_alg_values_supported": ["ES256"],
-            "proof_signing_alg_values_supported": ["EdDSA"],
-            "cryptographic_binding_methods_supported": ["did:jwk"],
-            "fixture": "valid-es256.sd-jwt",
-            "private_jwk_fixture": "issuer-es256-private.test.jwk.json"
-        })
-    );
-    assert_eq!(
-        profile["holder_proof"],
-        serde_json::json!({
-            "signing_alg_values_supported": ["EdDSA"],
-            "cryptographic_binding_methods_supported": ["did:jwk"],
-            "fixture": "holder-proof-eddsa.jwt",
-            "private_jwk_fixture": "holder-eddsa-private.test.jwk.json",
-            "unsupported_fixture": "holder-proof-es256-unsupported.jwt"
-        })
-    );
-    assert_eq!(
-        configurations
-            .as_object()
-            .expect("credential_configurations is an object")
-            .len(),
-        2,
-        "fixture profile must not imply additional credential algorithms"
-    );
-}
-
-#[test]
-fn algorithm_private_key_fixtures_match_public_metadata() {
-    let profile = read_fixture_json("algorithm-profile.json");
-    let jwks = jwks();
-    let public_keys = jwks["keys"].as_array().expect("JWKS keys is an array");
-
-    for configuration_id in ["fixture_eddsa", "fixture_es256"] {
-        let configuration = &profile["credential_configurations"][configuration_id];
-        let private_jwk = PrivateJwk::parse(&read_fixture(
-            configuration["private_jwk_fixture"]
-                .as_str()
-                .expect("private_jwk_fixture is configured"),
-        ))
-        .expect("private issuer fixture parses");
-        let public_jwk = serde_json::to_value(private_jwk.public()).expect("public JWK serialises");
-        let key_id = public_jwk["kid"].as_str().expect("public JWK has kid");
-        let published = public_keys
-            .iter()
-            .find(|key| key["kid"] == key_id)
-            .expect("issuer public JWK is published");
-
-        assert_eq!(&public_jwk, published);
-        assert!(
-            published.get("d").is_none(),
-            "JWKS must not expose private key material"
-        );
-    }
-
-    let holder_private = PrivateJwk::parse(&read_fixture(
-        profile["holder_proof"]["private_jwk_fixture"]
-            .as_str()
-            .expect("holder private_jwk_fixture is configured"),
-    ))
-    .expect("holder private fixture parses");
-    assert_eq!(
-        did_jwk_from_public_jwk(&holder_private.public()).expect("holder did:jwk encodes"),
-        meta()["holder_did"].as_str().expect("holder_did in meta")
-    );
-}
-
-#[test]
-fn eddsa_did_jwk_holder_proof_validates_and_es256_holder_proof_is_rejected() {
-    let profile = read_fixture_json("algorithm-profile.json");
-    let audience = profile["proof_audience"]
-        .as_str()
-        .expect("proof_audience in profile");
-    let nonce = profile["proof_nonce"]
-        .as_str()
-        .expect("proof_nonce in profile");
-    let policy = ProofValidationPolicy {
-        audience,
-        expected_nonce: Some(nonce),
-        issuer: ProofIssuerPolicy::Optional,
-        max_lifetime: Duration::from_secs(300),
-        future_skew: Duration::from_secs(30),
-        forbidden_holder_keys: &[],
-    };
-
-    let proof = validate_proof_jwt(&read_fixture("holder-proof-eddsa.jwt"), &policy, NOW_UNIX)
-        .expect("EdDSA did:jwk holder proof must validate");
-    assert_eq!(
-        proof.holder_id,
-        meta()["holder_did"].as_str().expect("holder_did in meta")
-    );
-    assert_eq!(proof.nonce.as_deref(), Some(nonce));
-
-    assert_eq!(
-        validate_proof_jwt(
-            &read_fixture("holder-proof-es256-unsupported.jwt"),
-            &policy,
-            NOW_UNIX,
-        ),
-        Err(ProofError::InvalidHeader),
-        "Registry Stack 1.0 must not accept ES256 holder proof"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Negative fixtures: each must fail with the exact error code documented in
-// the conformance profile and verifier API.
-// ---------------------------------------------------------------------------
-
-#[test]
-fn wrong_vct_fails_with_vct_mismatch() {
-    let compact = read_fixture("wrong-vct.sd-jwt");
-    let err = verify_sd_jwt_vc(&compact, &jwks(), &base_options())
-        .expect_err("wrong-vct fixture must fail");
-
-    assert_eq!(
-        err.code(),
-        "claim.vct_mismatch",
-        "wrong-vct must fail with claim.vct_mismatch, got {err:?}"
-    );
-}
-
-#[test]
-fn expired_credential_fails_with_time_invalid() {
-    let compact = read_fixture("expired.sd-jwt");
-    let err = verify_sd_jwt_vc(&compact, &jwks(), &base_options())
-        .expect_err("expired fixture must fail");
-
-    assert_eq!(
-        err.code(),
-        "claim.time_invalid",
-        "expired credential must fail with claim.time_invalid, got {err:?}"
-    );
-}
-
-#[test]
-fn unsupported_alg_fails_with_algorithm_disallowed() {
-    let compact = read_fixture("unsupported-alg.sd-jwt");
-    let err = verify_sd_jwt_vc(&compact, &jwks(), &base_options())
-        .expect_err("unsupported-alg fixture must fail");
-
-    assert_eq!(
-        err.code(),
-        "algorithm.disallowed",
-        "unsupported alg must fail with algorithm.disallowed, got {err:?}"
-    );
-}
-
-#[test]
-fn wrong_kid_fails_with_key_unknown() {
-    let compact = read_fixture("wrong-kid.sd-jwt");
-    let err = verify_sd_jwt_vc(&compact, &jwks(), &base_options())
-        .expect_err("wrong-kid fixture must fail");
-
-    assert_eq!(
-        err.code(),
-        "key.unknown",
-        "wrong kid must fail with key.unknown, got {err:?}"
-    );
-}
-
-#[test]
-fn missing_cnf_when_holder_binding_required_fails_with_holder_binding_required() {
-    // The fixture credential was issued without holder binding. The policy
-    // requires it. The verifier should fail before reaching the signature check.
-    let compact = read_fixture("missing-cnf-when-binding-required.sd-jwt");
-    let options = base_options().holder_binding(HolderBindingPolicy::Required);
-    let err = verify_sd_jwt_vc(&compact, &jwks(), &options)
-        .expect_err("missing-cnf fixture must fail when binding is required");
-
-    assert_eq!(
-        err.code(),
-        "holder_binding.required",
-        "missing cnf must fail with holder_binding.required, got {err:?}"
-    );
-}
-
-#[test]
-fn malformed_disclosure_fails_with_disclosure_digest_mismatch() {
-    // The fixture has a corrupted base64url disclosure. The verifier fails at
-    // the base64 decode step and maps that parse failure to
-    // disclosure.digest_mismatch. The hash-comparison branch is not reached.
-    let compact = read_fixture("malformed-disclosure.sd-jwt");
-    let err = verify_sd_jwt_vc(&compact, &jwks(), &base_options())
-        .expect_err("malformed-disclosure fixture must fail");
-
-    assert_eq!(
-        err.code(),
-        "disclosure.digest_mismatch",
-        "malformed disclosure must fail with disclosure.digest_mismatch, got {err:?}"
-    );
-}
-
-#[test]
-fn tampered_disclosure_fails_with_disclosure_digest_mismatch() {
-    // The fixture disclosure is valid base64url-encoded JSON with three elements
-    // (salt, claim name, value), so it passes the parse and structure checks.
-    // The claim value has been altered, making its SHA-256 digest different from
-    // every entry in the payload _sd array. The verifier reaches the
-    // hash-comparison branch and returns disclosure.digest_mismatch.
-    let compact = read_fixture("tampered-disclosure.sd-jwt");
-    let err = verify_sd_jwt_vc(&compact, &jwks(), &base_options())
-        .expect_err("tampered-disclosure fixture must fail");
-
-    assert_eq!(
-        err.code(),
-        "disclosure.digest_mismatch",
-        "tampered disclosure must fail with disclosure.digest_mismatch, got {err:?}"
-    );
-}
-
-#[test]
-fn holder_proof_mismatch_fails_with_holder_binding_proof_invalid() {
-    // The credential has a valid cnf but the appended key-binding JWT was
-    // signed by the wrong key (issuer key instead of holder key).
-    let compact = read_fixture("holder-proof-mismatch.sd-jwt");
-    let meta = meta();
-    let holder_did = meta["holder_did"]
-        .as_str()
-        .expect("holder_did in meta")
-        .to_string();
-    let options = base_options().holder_binding(HolderBindingPolicy::RequiredKid(holder_did));
-    let err = verify_sd_jwt_vc(&compact, &jwks(), &options)
-        .expect_err("holder-proof-mismatch fixture must fail");
-
-    assert_eq!(
-        err.code(),
-        "holder_binding.proof_invalid",
-        "wrong holder proof must fail with holder_binding.proof_invalid, got {err:?}"
-    );
-}
diff --git a/crates/registry-notary-server/tests/standalone_http.rs b/crates/registry-notary-server/tests/standalone_http.rs
deleted file mode 100644
index c5d8dbfa5..000000000
--- a/crates/registry-notary-server/tests/standalone_http.rs
+++ /dev/null
@@ -1,23 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Standalone Registry Notary tests that do not link Registry Relay.
-
-#[path = "standalone_http/admin.rs"]
-mod admin;
-#[path = "standalone_http/audit.rs"]
-mod audit;
-#[path = "standalone_http/auth.rs"]
-mod auth;
-#[path = "standalone_http/credentials.rs"]
-mod credentials;
-#[path = "standalone_http/federation.rs"]
-mod federation;
-#[path = "standalone_http/http_contracts.rs"]
-mod http_contracts;
-#[path = "standalone_http/oid4vci.rs"]
-mod oid4vci;
-#[path = "standalone_http/preauth.rs"]
-mod preauth;
-#[path = "standalone_http/preauth_support.rs"]
-mod preauth_support;
-#[path = "standalone_http/support.rs"]
-mod support;
diff --git a/crates/registry-notary-server/tests/standalone_http/admin.rs b/crates/registry-notary-server/tests/standalone_http/admin.rs
deleted file mode 100644
index 6ac3bc8ad..000000000
--- a/crates/registry-notary-server/tests/standalone_http/admin.rs
+++ /dev/null
@@ -1,919 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::preauth_support::*;
-use super::support::*;
-#[allow(unused_imports)]
-use super::{
-    audit::*, auth::*, credentials::*, federation::*, http_contracts::*, oid4vci::*, preauth::*,
-};
-
-#[tokio::test]
-pub(super) async fn admin_reload_401_unauth_403_wrong_scope_501_admin() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-    std::env::set_var(
-        "TEST_EVIDENCE_WRONG_SCOPE_KEY_HASH",
-        "sha256:ac3dced2bcf7d2cb4166747790d67437b5cc5314ed33e01d06b274a7fe0c3b3c",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    config.auth.api_keys.push(EvidenceCredentialConfig {
-        id: "wrong-scope".to_string(),
-        fingerprint: env_fingerprint_ref("TEST_EVIDENCE_WRONG_SCOPE_KEY_HASH"),
-        scopes: vec!["farmer_registry:evidence_verification".to_string()],
-        authorization_details: None,
-    });
-    add_admin_api_key(&mut config);
-    enable_shared_admin_listener(&mut config);
-
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let unauthenticated = server.post("/admin/v1/reload").await;
-    unauthenticated.assert_status(StatusCode::UNAUTHORIZED);
-
-    let wrong_scope = server
-        .post("/admin/v1/reload")
-        .add_header("x-api-key", "wrong-scope-token")
-        .await;
-    wrong_scope.assert_status(StatusCode::FORBIDDEN);
-
-    let admin = server
-        .post("/admin/v1/reload")
-        .add_header("x-api-key", "admin-token")
-        .await;
-    admin.assert_status(StatusCode::NOT_IMPLEMENTED);
-    let admin_body: Value = admin.json();
-    assert_eq!(admin_body["schema"], json!("registry.admin.error.v1"));
-    assert_eq!(
-        admin_body["code"],
-        json!("registry.admin.capability.not_supported")
-    );
-    assert_eq!(admin_body["capability"], json!("reload.config_reload"));
-}
-
-#[test]
-pub(super) fn admin_reload_openapi_says_runtime_config_reload_is_not_supported() {
-    let document = serde_json::to_value(openapi_document()).expect("OpenAPI serializes");
-    let operation = &document["paths"]["/admin/v1/reload"]["post"];
-    let rendered = serde_json::to_string(operation).expect("operation serializes");
-
-    assert!(rendered.contains("unsupported"));
-    assert!(rendered.contains("does not support runtime configuration reload"));
-    assert!(operation["responses"].get("501").is_some());
-    assert!(operation["responses"].get("200").is_none());
-    assert!(!rendered.contains("Request a standalone config reload"));
-
-    let capabilities = &document["paths"]["/admin/v1/capabilities"]["get"];
-    assert_eq!(
-        capabilities["responses"]["403"]["description"],
-        "Caller lacks registry_notary:ops_read scope"
-    );
-
-    assert!(
-        document["paths"].get("/admin/v1/config/verify").is_none(),
-        "admin config verify route is removed"
-    );
-    assert!(
-        document["paths"].get("/admin/v1/config/dry-run").is_none(),
-        "admin config dry-run route is removed"
-    );
-    assert!(
-        document["paths"].get("/admin/v1/config/apply").is_none(),
-        "admin config apply route is removed"
-    );
-}
-
-#[tokio::test]
-pub(super) async fn admin_posture_requires_ops_read_not_admin_and_ops_cannot_reload() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    enable_shared_admin_listener(&mut config);
-    add_admin_api_key(&mut config);
-    add_ops_read_api_key(&mut config);
-
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    server
-        .get("/admin/v1/posture")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-    server
-        .get("/admin/v1/posture")
-        .add_header("x-api-key", "admin-token")
-        .await
-        .assert_status(StatusCode::FORBIDDEN);
-    server
-        .post("/admin/v1/reload")
-        .add_header("x-api-key", "ops-token")
-        .await
-        .assert_status(StatusCode::FORBIDDEN);
-    let unsupported_reload = server
-        .post("/admin/v1/reload")
-        .add_header("x-api-key", "admin-token")
-        .await;
-    unsupported_reload.assert_status(StatusCode::NOT_IMPLEMENTED);
-    let unsupported_reload_body: Value = unsupported_reload.json();
-    assert_eq!(
-        unsupported_reload_body["code"],
-        json!("registry.admin.capability.not_supported")
-    );
-    server
-        .post("/admin/v1/credentials/urn:ulid:01HX0000000000000000000000/status")
-        .add_header("x-api-key", "ops-token")
-        .json(&json!({ "status": "revoked" }))
-        .await
-        .assert_status(StatusCode::FORBIDDEN);
-
-    let posture = server
-        .get("/admin/v1/posture")
-        .add_header("x-api-key", "ops-token")
-        .await;
-    posture.assert_status_ok();
-    let body: Value = posture.json();
-    assert_matches_posture_schema(&body);
-    assert_eq!(body["schema"], json!("registry.ops.posture.v1"));
-    assert_eq!(body["component"], json!("registry-notary"));
-    assert_eq!(body["instance"]["id"], json!("registry-notary-standalone"));
-    assert_eq!(body["instance"]["environment"], json!("development"));
-    assert_eq!(body["build"]["package"], json!("registry-notary"));
-    assert_eq!(body["build"]["version"], json!(env!("CARGO_PKG_VERSION")));
-    assert!(body["build"].get("git_sha").is_none());
-    assert!(body["build"].get("features").is_none());
-}
-
-#[tokio::test]
-pub(super) async fn admin_capabilities_requires_ops_read_and_reports_notary_surface() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    config.server.admin_listener.mode = RegistryNotaryAdminListenerMode::SharedWithPublic;
-    add_admin_api_key(&mut config);
-    add_ops_read_api_key(&mut config);
-
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    server
-        .get("/admin/v1/capabilities")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-    server
-        .get("/admin/v1/capabilities")
-        .add_header("x-api-key", "admin-token")
-        .await
-        .assert_status(StatusCode::FORBIDDEN);
-
-    let response = server
-        .get("/admin/v1/capabilities")
-        .add_header("x-api-key", "ops-token")
-        .await;
-    response.assert_status_ok();
-    assert_eq!(
-        response
-            .header("cache-control")
-            .to_str()
-            .expect("cache-control is ASCII"),
-        "no-store"
-    );
-    let body: Value = response.json();
-    assert_matches_admin_capabilities_schema(&body);
-    assert_eq!(body["schema"], json!("registry.admin.capabilities.v1"));
-    assert_eq!(body["product"], json!("registry-notary"));
-    assert_eq!(
-        body["supported_posture_tiers"],
-        json!(["default", "restricted"])
-    );
-    assert_eq!(body.get("scopes"), None);
-    assert_eq!(
-        body["config"]["verify"],
-        json!({
-            "supported": false,
-            "currently_available": false
-        })
-    );
-    assert_eq!(
-        body["config"]["dry_run"],
-        json!({
-            "supported": false,
-            "currently_available": false
-        })
-    );
-    assert_eq!(
-        body["config"]["apply"],
-        json!({
-            "supported": false,
-            "currently_available": false,
-            "requires_signed_input": true,
-            "supported_sources": []
-        })
-    );
-    assert_eq!(
-        body["break_glass"],
-        json!({
-            "supported": false,
-            "currently_available": false,
-            "rate_limit_scope": "none"
-        })
-    );
-    assert_eq!(
-        body["listeners"],
-        json!({
-            "admin": {
-                "mode": "shared_with_public",
-                "public_admin_routes": true
-            },
-            "metrics": {
-                "mode": "shared_with_public",
-                "requires_admin_scope": false,
-                "required_scope": "registry_notary:metrics_read"
-            }
-        })
-    );
-    assert!(!serde_json::to_string(&body["listeners"])
-        .expect("listeners serialize")
-        .contains("127.0.0.1"));
-    assert_eq!(body["root_transition"]["supported"], json!(false));
-    assert_eq!(
-        body["hot_swap"],
-        json!({
-            "supported": false,
-            "currently_available": false,
-            "components": []
-        })
-    );
-    assert_eq!(body["reload"]["resource_reload"]["supported"], json!(false));
-    assert_eq!(body["reload"]["table_reload"]["supported"], json!(false));
-    assert_eq!(body["reload"]["config_reload"]["supported"], json!(false));
-}
-
-#[tokio::test]
-pub(super) async fn dedicated_topology_splits_admin_routes_and_reports_capabilities() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    config.server.admin_listener.mode = RegistryNotaryAdminListenerMode::Dedicated;
-    add_ops_read_api_key(&mut config);
-
-    let runtime = activate_test_runtime(config)
-        .await
-        .expect("runtime activates for dedicated topology");
-    let routers = notary_routers_from_runtime(runtime).expect("Notary-only runtime is serve-ready");
-    let public = TestServer::builder().mock_transport().build(routers.public);
-    let admin = TestServer::builder().mock_transport().build(routers.admin);
-
-    public.get("/healthz").await.assert_status_ok();
-    public
-        .get("/admin/v1/capabilities")
-        .add_header("x-api-key", "ops-token")
-        .await
-        .assert_status(StatusCode::NOT_FOUND);
-    public
-        .get("/metrics")
-        .add_header("x-api-key", "ops-token")
-        .await
-        .assert_status(StatusCode::NOT_FOUND);
-
-    let response = admin
-        .get("/admin/v1/capabilities")
-        .add_header("x-api-key", "ops-token")
-        .await;
-    response.assert_status_ok();
-    let body: Value = response.json();
-    assert_matches_admin_capabilities_schema(&body);
-    assert_eq!(
-        body["listeners"],
-        json!({
-            "admin": {
-                "mode": "dedicated",
-                "public_admin_routes": false
-            },
-            "metrics": {
-                "mode": "admin",
-                "requires_admin_scope": false,
-                "required_scope": "registry_notary:metrics_read"
-            }
-        })
-    );
-    assert!(!serde_json::to_string(&body["listeners"])
-        .expect("listeners serialize")
-        .contains("127.0.0.1"));
-}
-
-#[tokio::test]
-pub(super) async fn governed_config_rejects_shared_admin_listener_topology() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    config.config_trust = Some(ConfigTrustConfig {
-        trust_anchor_path: tmp.path().join("config-anchor.json"),
-        bundle_path: tmp.path().join("config-bundle"),
-        antirollback_state_path: tmp.path().join("config-antirollback.json"),
-        break_glass_override_path: None,
-    });
-
-    let error = match compile_notary_runtime(config) {
-        Ok(_) => panic!("shared governed topology is rejected"),
-        Err(error) => error,
-    };
-    let message = error.to_string();
-    assert!(
-        message.contains("server.admin_listener.mode = dedicated"),
-        "unexpected error: {message}"
-    );
-}
-
-#[tokio::test]
-pub(super) async fn admin_posture_rejects_unknown_tier_with_shared_error_code() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    enable_shared_admin_listener(&mut config);
-    add_ops_read_api_key(&mut config);
-
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let response = server
-        .get("/admin/v1/posture?tier=complete")
-        .add_header("x-api-key", "ops-token")
-        .await;
-    response.assert_status(StatusCode::BAD_REQUEST);
-    let body: Value = response.json();
-    assert_eq!(body["schema"], json!("registry.admin.error.v1"));
-    assert_eq!(body["code"], json!("registry.admin.posture.invalid_tier"));
-    assert_eq!(
-        body["detail"],
-        json!("posture tier must be default or restricted")
-    );
-}
-
-#[tokio::test]
-pub(super) async fn admin_posture_reports_configured_instance_override() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    enable_shared_admin_listener(&mut config);
-    config.instance.id = "notary-prod-a".to_string();
-    config.instance.environment = "production".to_string();
-    config.instance.owner = Some("trust-ops".to_string());
-    config.instance.jurisdiction = Some("TH".to_string());
-    config.instance.public_base_url = Some("https://notary.example.test".to_string());
-    add_ops_read_api_key(&mut config);
-
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let posture = server
-        .get("/admin/v1/posture")
-        .add_header("x-api-key", "ops-token")
-        .await;
-    posture.assert_status_ok();
-    let body: Value = posture.json();
-    assert_matches_posture_schema(&body);
-    assert_eq!(body["instance"]["id"], json!("notary-prod-a"));
-    assert_eq!(body["instance"]["environment"], json!("production"));
-    assert_eq!(body["instance"]["owner"], json!("trust-ops"));
-    assert_eq!(body["instance"]["jurisdiction"], json!("TH"));
-    assert!(body["instance"].get("public_base_url").is_none());
-}
-
-#[tokio::test]
-pub(super) async fn admin_posture_top_level_keys_match_documented_example() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    enable_shared_admin_listener(&mut config);
-    add_ops_read_api_key(&mut config);
-
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let default_posture = server
-        .get("/admin/v1/posture")
-        .add_header("x-api-key", "ops-token")
-        .await;
-    default_posture.assert_status_ok();
-    let default_body: Value = default_posture.json();
-    assert_matches_posture_schema(&default_body);
-
-    let default_live_keys = default_body
-        .as_object()
-        .expect("posture is object")
-        .keys()
-        .cloned()
-        .collect::<BTreeSet<_>>();
-    let default_example: Value =
-        serde_json::from_str(registry_platform_ops::NOTARY_POSTURE_EXAMPLE_V1)
-            .expect("notary posture example parses");
-    assert_standards_artifacts_omit_sha256(&default_body, "live default posture");
-    assert_standards_artifacts_omit_sha256(&default_example, "NOTARY_POSTURE_EXAMPLE_V1");
-    let default_example_keys = default_example
-        .as_object()
-        .expect("example posture is object")
-        .keys()
-        .cloned()
-        .collect::<BTreeSet<_>>();
-    assert_eq!(
-        default_example_keys, default_live_keys,
-        "NOTARY_POSTURE_EXAMPLE_V1 top-level keys drifted from the live default-tier posture document \
-         (missing from example: {:?}, extra in example: {:?})",
-        default_live_keys.difference(&default_example_keys).collect::<Vec<_>>(),
-        default_example_keys.difference(&default_live_keys).collect::<Vec<_>>(),
-    );
-
-    let restricted_posture = server
-        .get("/admin/v1/posture?tier=restricted")
-        .add_header("x-api-key", "ops-token")
-        .await;
-    restricted_posture.assert_status_ok();
-    let restricted_body: Value = restricted_posture.json();
-    assert_matches_posture_schema(&restricted_body);
-
-    let restricted_live_keys = restricted_body
-        .as_object()
-        .expect("posture is object")
-        .keys()
-        .cloned()
-        .collect::<BTreeSet<_>>();
-    let restricted_fixture: Value =
-        serde_json::from_str(registry_platform_ops::RESTRICTED_POSTURE_FIXTURE_V1)
-            .expect("restricted posture fixture parses");
-    let restricted_fixture_keys = restricted_fixture
-        .as_object()
-        .expect("restricted fixture posture is object")
-        .keys()
-        .cloned()
-        .collect::<BTreeSet<_>>();
-    assert_eq!(
-        restricted_fixture_keys, restricted_live_keys,
-        "RESTRICTED_POSTURE_FIXTURE_V1 top-level keys drifted from the live restricted-tier posture document \
-         (missing from fixture: {:?}, extra in fixture: {:?})",
-        restricted_live_keys.difference(&restricted_fixture_keys).collect::<Vec<_>>(),
-        restricted_fixture_keys.difference(&restricted_live_keys).collect::<Vec<_>>(),
-    );
-}
-
-#[tokio::test]
-pub(super) async fn admin_posture_reports_subject_access_summary_and_redacts_signing_key_ids() {
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let issuer = MockIdp::start().await;
-    let issuer_url = issuer.issuer();
-    let jwks_uri = issuer.jwks_uri();
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &issuer_url,
-        &jwks_uri,
-    );
-    enable_shared_admin_listener(&mut config);
-    config
-        .auth
-        .oidc
-        .as_mut()
-        .expect("oidc config exists")
-        .scope_map
-        .insert(
-            "ops_read".to_string(),
-            vec!["registry_notary:ops_read".to_string()],
-        );
-    let ops_token = issuer.mint_token(json!({
-        "sub": "trust-ops",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "ops_read",
-    }));
-
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let posture = server
-        .get("/admin/v1/posture")
-        .add_header("authorization", format!("Bearer {ops_token}"))
-        .await;
-    posture.assert_status_ok();
-    let body: Value = posture.json();
-    assert_matches_posture_schema(&body);
-    assert_eq!(body["notary"]["subject_access"]["enabled"], json!(true));
-    assert_eq!(
-        body["notary"]["subject_access"]["allowed_claim_count"],
-        json!(1)
-    );
-    assert_eq!(
-        body["notary"]["subject_access"]["allowed_purpose_count"],
-        json!(1)
-    );
-    assert_eq!(
-        body["notary"]["subject_access"]["credential_profile_count"],
-        json!(1)
-    );
-    assert_eq!(
-        body["notary"]["subject_access"]["wallet_origin_count"],
-        json!(1)
-    );
-    assert_eq!(
-        body["notary"]["subject_access"]["rate_limit_mode"],
-        json!("in_memory")
-    );
-    assert!(body["notary"].get("signing_keys").is_none());
-
-    let rendered = serde_json::to_string(&body).expect("posture serializes");
-    assert!(!rendered.contains("issuer-key"));
-    assert!(!rendered.contains("did:web:issuer.example#key-1"));
-}
-
-#[tokio::test]
-pub(super) async fn admin_posture_reports_oid4vci_bearer_offer_mode() {
-    set_preauth_env();
-    let issuer = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &issuer.issuer(),
-        &issuer.jwks_uri(),
-        &format!("{}/authorize", issuer.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    );
-    enable_shared_admin_listener(&mut config);
-    config.oid4vci.pre_authorized_code.tx_code.required = false;
-    config
-        .oid4vci
-        .pre_authorized_code
-        .pre_authorized_code_ttl_seconds = 120;
-    config
-        .auth
-        .oidc
-        .as_mut()
-        .expect("oidc config exists")
-        .scope_map
-        .insert(
-            "ops_read".to_string(),
-            vec!["registry_notary:ops_read".to_string()],
-        );
-    let ops_token = issuer.mint_token(json!({
-        "sub": "trust-ops",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "ops_read",
-    }));
-
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let posture = server
-        .get("/admin/v1/posture")
-        .add_header("authorization", format!("Bearer {ops_token}"))
-        .await;
-    posture.assert_status_ok();
-    let body: Value = posture.json();
-    assert_matches_posture_schema(&body);
-    assert!(body["posture"]["warnings"]
-        .as_array()
-        .expect("warnings is an array")
-        .iter()
-        .any(|warning| warning == "notary.oid4vci.bearer_offer"));
-    let finding = body["posture"]["findings"]
-        .as_array()
-        .expect("findings is an array")
-        .iter()
-        .find(|finding| finding["id"] == "notary.oid4vci.bearer_offer")
-        .expect("bearer-offer finding is reported");
-    assert!(finding["evidence"]
-        .as_array()
-        .expect("finding evidence is an array")
-        .iter()
-        .any(|entry| entry["value"] == json!("bearer_offer")));
-
-    issuer.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn admin_posture_redacts_runtime_config_signing_secrets() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-    std::env::set_var("TEST_POSTURE_PRIVATE_JWK", TEST_ISSUER_JWK);
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1/private-source?token=source-url-secret",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    enable_shared_admin_listener(&mut config);
-    config.evidence.signing_keys.insert(
-        "issuer".to_string(),
-        SigningKeyConfig {
-            provider: SigningKeyProviderConfig::LocalJwkEnv,
-            alg: SD_JWT_VC_SIGNING_ALG.to_string(),
-            kid: "did:web:evidence.example.test#issuer".to_string(),
-            status: SigningKeyStatus::Active,
-            publish_until_unix_seconds: None,
-            private_jwk_env: "TEST_POSTURE_PRIVATE_JWK".to_string(),
-            public_jwk_env: String::new(),
-            module_path: String::new(),
-            token_label: String::new(),
-            pin_env: String::new(),
-            key_label: String::new(),
-            key_id_hex: String::new(),
-            path: String::new(),
-            password_env: String::new(),
-        },
-    );
-    add_ops_read_api_key(&mut config);
-
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let posture = server
-        .get("/admin/v1/posture")
-        .add_header("x-api-key", "ops-token")
-        .await;
-    posture.assert_status_ok();
-    let text = posture.text();
-
-    assert!(!text.contains("TEST_EVIDENCE_API_KEY_HASH"));
-    assert!(!text.contains("TEST_POSTURE_PRIVATE_JWK"));
-    assert!(
-        !text.contains("sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51")
-    );
-    assert!(!text.contains("2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw"));
-    assert!(!text.contains("private_jwk"));
-    assert!(!text.contains("\"d\""));
-    assert!(!text.contains("disclosure"));
-    assert!(!text.contains("predicate"));
-    // The disclosure config must not leak. `audit.redaction_mode: "redacted"` is
-    // a legitimate posture vocabulary value, so guard against the disclosure
-    // list shape rather than the bare word.
-    assert!(!text.contains("[value, redacted]"));
-    assert!(!text.contains("\"value\",\"redacted\""));
-}
-
-#[tokio::test]
-pub(super) async fn admin_posture_classifies_in_memory_state_storage() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    enable_shared_admin_listener(&mut config);
-    add_ops_read_api_key(&mut config);
-
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let posture = server
-        .get("/admin/v1/posture")
-        .add_header("x-api-key", "ops-token")
-        .await;
-    posture.assert_status_ok();
-    let body: Value = posture.json();
-    assert_matches_posture_schema(&body);
-    assert_eq!(body["notary"]["state"]["storage"], json!("in_memory"));
-}
-
-#[tokio::test]
-pub(super) async fn admin_posture_warns_for_production_like_in_memory_state() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    enable_shared_admin_listener(&mut config);
-    config.instance.environment = "production".to_string();
-    add_ops_read_api_key(&mut config);
-
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let posture = server
-        .get("/admin/v1/posture")
-        .add_header("x-api-key", "ops-token")
-        .await;
-    posture.assert_status_ok();
-    let body: Value = posture.json();
-    assert_matches_posture_schema(&body);
-    assert_eq!(
-        body["posture"]["warnings"][0],
-        json!("notary.state.in_memory.production")
-    );
-    assert_eq!(
-        body["posture"]["findings"][0]["id"],
-        json!("notary.state.in_memory.production")
-    );
-    assert_eq!(body["runtime"]["readiness"], json!("ready"));
-}
-
-#[tokio::test]
-pub(super) async fn admin_posture_federation_summary_omits_peer_private_data() {
-    set_federation_env();
-    let peer_jwks = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = federation_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &format!("{}/jwks/private", peer_jwks.url()),
-    );
-    enable_shared_admin_listener(&mut config);
-    add_ops_read_api_key(&mut config);
-
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let posture = server
-        .get("/admin/v1/posture")
-        .add_header("x-api-key", "ops-token")
-        .await;
-    posture.assert_status_ok();
-    let body: Value = posture.json();
-    assert_matches_posture_schema(&body);
-    assert_eq!(body["notary"]["federation"]["enabled"], json!(true));
-    assert!(body["notary"]["federation"].get("node_id").is_none());
-    assert_eq!(body["notary"]["federation"]["peer_count"], json!(1));
-    assert!(body["notary"]["federation"].get("peers").is_none());
-
-    let text = serde_json::to_string(&body).expect("posture serializes");
-    assert!(!text.contains("agency-b.example.gov"));
-    assert!(!text.contains("/jwks/private"));
-}
-
-#[tokio::test]
-pub(super) async fn metrics_requires_metrics_scope_and_keeps_health_public() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-    std::env::set_var(
-        "TEST_EVIDENCE_ADMIN_KEY_HASH",
-        "sha256:10a4c7c9fc5206d6f36dc6944a81bb6f4a3cb0e25014ae3b12e6c3e52712292a",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    config.server.admin_listener.mode = RegistryNotaryAdminListenerMode::SharedWithPublic;
-    add_admin_api_key(&mut config);
-    add_metrics_read_api_key(&mut config);
-
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let health = server.get("/healthz").await;
-    health.assert_status_ok();
-
-    let unauthenticated = server.get("/metrics").await;
-    unauthenticated.assert_status(StatusCode::UNAUTHORIZED);
-    assert!(!unauthenticated
-        .text()
-        .contains("registry_notary_http_requests_total"));
-
-    let non_metrics = server
-        .get("/metrics")
-        .add_header("x-api-key", "api-token")
-        .await;
-    non_metrics.assert_status(StatusCode::FORBIDDEN);
-    assert!(!non_metrics
-        .text()
-        .contains("registry_notary_http_requests_total"));
-
-    let admin = server
-        .get("/metrics")
-        .add_header("x-api-key", "admin-token")
-        .await;
-    admin.assert_status(StatusCode::FORBIDDEN);
-    assert!(!admin.text().contains("registry_notary_http_requests_total"));
-
-    let metrics = server
-        .get("/metrics")
-        .add_header("x-api-key", "metrics-token")
-        .await;
-    metrics.assert_status_ok();
-    let content_type = metrics
-        .headers()
-        .get("content-type")
-        .expect("content-type header")
-        .to_str()
-        .expect("content-type is valid");
-    assert!(content_type.starts_with("text/plain; version=0.0.4"));
-    assert!(metrics
-        .text()
-        .contains("registry_notary_http_requests_total"));
-}
diff --git a/crates/registry-notary-server/tests/standalone_http/audit.rs b/crates/registry-notary-server/tests/standalone_http/audit.rs
deleted file mode 100644
index 78985177d..000000000
--- a/crates/registry-notary-server/tests/standalone_http/audit.rs
+++ /dev/null
@@ -1,287 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::support::*;
-#[allow(unused_imports)]
-use super::{
-    admin::*, auth::*, credentials::*, federation::*, http_contracts::*, oid4vci::*, preauth::*,
-};
-use registry_platform_audit::{AuditError, JsonlFileSink};
-
-async fn wait_for_audit_writer_shutdown(audit_path: &std::path::Path) {
-    const ATTEMPTS: usize = 100;
-    const RETRY_DELAY: Duration = Duration::from_millis(10);
-
-    for attempt in 1..=ATTEMPTS {
-        match JsonlFileSink::with_rotation_single_writer(audit_path, 0, 1) {
-            Ok(probe) => {
-                drop(probe);
-                return;
-            }
-            Err(AuditError::SinkLocked { .. }) if attempt < ATTEMPTS => {
-                tokio::time::sleep(RETRY_DELAY).await;
-            }
-            Err(error) => panic!("audit writer did not shut down cleanly: {error}"),
-        }
-    }
-}
-
-#[tokio::test]
-#[cfg(not(feature = "registry-notary-cel"))]
-pub(super) async fn standalone_server_authenticates_and_audits_registry_evaluation() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    add_admin_api_key(&mut config);
-    add_metrics_read_api_key(&mut config);
-    config.server.admin_listener.mode = RegistryNotaryAdminListenerMode::SharedWithPublic;
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let denied = server.get("/v1/claims").await;
-    denied.assert_status(StatusCode::UNAUTHORIZED);
-
-    let denied_openapi = server.get("/openapi.json").await;
-    denied_openapi.assert_status(StatusCode::UNAUTHORIZED);
-
-    let openapi = server
-        .get("/openapi.json")
-        .add_header("x-api-key", "api-token")
-        .await;
-    openapi.assert_status_ok();
-    let openapi_body: Value = openapi.json();
-    assert_eq!(openapi_body["openapi"], json!("3.1.0"));
-    assert!(openapi_body["paths"]["/v1/evaluations"].is_object());
-
-    let discovery = server
-        .get("/.well-known/evidence-service")
-        .add_header("x-api-key", "api-token")
-        .await;
-    discovery.assert_status_ok();
-    let discovery_body: Value = discovery.json();
-    assert_eq!(
-        discovery_body["base_url"],
-        json!("https://evidence.example.test")
-    );
-
-    let response = server
-        .post("/v1/evaluations")
-        .add_header("x-api-key", "api-token")
-        .add_header("data-purpose", "https://purpose.example.test/eligibility")
-        .json(&json!({
-            "target": person_target("person-1"),
-            "claims": ["farmer-under-4ha"],
-            "disclosure": "predicate"
-        }))
-        .await;
-    response.assert_status_ok();
-
-    let audit = std::fs::read_to_string(&audit_path).expect("audit was written");
-    let envelopes = audit_envelopes(&audit_path);
-    assert!(envelopes
-        .iter()
-        .any(|envelope| envelope.record.get("principal_id_hash").is_some()));
-    assert!(envelopes
-        .iter()
-        .all(|envelope| envelope.record.get("principal_id").is_none()));
-    assert!(audit.contains("\"decision\":\"evaluate\""));
-    assert!(audit.contains("\"claim_hash\":\"sha256:"));
-    assert!(!audit.contains("api-token"));
-    assert!(!audit.contains("person-1"));
-    let metrics = server
-        .get("/metrics")
-        .add_header("x-api-key", "metrics-token")
-        .await;
-    metrics.assert_status_ok();
-    let metrics_body = metrics.text();
-    assert!(metrics_body.contains("registry_notary_http_requests_total"));
-    assert!(metrics_body.contains(
-        "registry_notary_http_requests_total{method=\"POST\",endpoint_kind=\"evaluation\",status_code=\"200\",status_class=\"2xx\",error_code=\"none\"}"
-    ));
-    assert!(metrics_body.contains("# TYPE registry_notary_http_request_duration_seconds histogram"));
-    assert!(metrics_body.contains(
-        "registry_notary_http_request_duration_seconds_bucket{method=\"POST\",endpoint_kind=\"evaluation\",status_code=\"200\",status_class=\"2xx\",error_code=\"none\",le=\"+Inf\"}"
-    ));
-    assert!(metrics_body.contains(
-        "registry_notary_http_request_duration_seconds_sum{method=\"POST\",endpoint_kind=\"evaluation\",status_code=\"200\",status_class=\"2xx\",error_code=\"none\"}"
-    ));
-    assert!(metrics_body.contains(
-        "registry_notary_http_request_duration_seconds_count{method=\"POST\",endpoint_kind=\"evaluation\",status_code=\"200\",status_class=\"2xx\",error_code=\"none\"}"
-    ));
-    assert!(!metrics_body.contains("registry_notary_http_request_duration_ms_total"));
-    assert!(!metrics_body.contains("route="));
-    assert!(metrics_body.contains("registry_notary_audit_events_total{outcome=\"success\"}"));
-    assert!(!metrics_body.contains("api-token"));
-    assert!(!metrics_body.contains("person-1"));
-    assert!(!metrics_body.contains("farmer-under-4ha"));
-    assert!(!metrics_body.contains("purpose.example.test"));
-}
-
-#[tokio::test]
-pub(super) async fn audit_chain_bootstraps_from_sink_tail() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-
-    let first = TestServer::builder().mock_transport().build(
-        standalone_router(config.clone())
-            .await
-            .expect("first router builds"),
-    );
-    first
-        .get("/v1/claims")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-
-    // A restart releases the single-writer audit lock: the first instance must
-    // be fully torn down before the replacement acquires the lock (#211).
-    drop(first);
-    wait_for_audit_writer_shutdown(&audit_path).await;
-
-    let second = TestServer::builder().mock_transport().build(
-        standalone_router(config)
-            .await
-            .expect("second router builds"),
-    );
-    second
-        .get("/v1/claims")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-
-    let contents = std::fs::read_to_string(&audit_path).expect("audit was written");
-    assert!(
-        verify_jsonl_lines_with_hasher(contents.lines(), &AuditChainHasher::unkeyed_dev_only())
-            .is_err(),
-        "runtime audit chain must not verify with the dev-only unkeyed hasher"
-    );
-    let hasher = AuditChainHasher::from_env_derived("REGISTRY_NOTARY_AUDIT_HASH_SECRET")
-        .expect("configured audit chain secret loads");
-    verify_jsonl_lines_with_hasher(contents.lines(), &hasher).expect("audit chain verifies");
-    let envelopes = audit_envelopes(&audit_path);
-    assert_eq!(envelopes.len(), 2);
-    assert_eq!(envelopes[1].prev_hash, Some(envelopes[0].record_hash));
-}
-
-#[tokio::test]
-pub(super) async fn audit_chain_detects_inserted_envelope() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    let first = TestServer::builder().mock_transport().build(
-        standalone_router(config.clone())
-            .await
-            .expect("first router builds"),
-    );
-    first
-        .get("/v1/claims")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-    first
-        .get("/v1/claims")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-
-    // A restart releases the single-writer audit lock before the replacement
-    // instance acquires it (#211).
-    drop(first);
-    wait_for_audit_writer_shutdown(&audit_path).await;
-
-    let contents = std::fs::read_to_string(&audit_path).expect("audit was written");
-    let mut lines = contents.lines().collect::<Vec<_>>();
-    lines.insert(1, lines[0]);
-    std::fs::write(&audit_path, format!("{}\n", lines.join("\n"))).expect("tampered audit write");
-
-    let second = TestServer::builder().mock_transport().build(
-        standalone_router(config)
-            .await
-            .expect("second router builds"),
-    );
-    let response = second
-        .get("/v1/claims")
-        .add_header("x-api-key", "api-token")
-        .await;
-
-    response.assert_status(StatusCode::INTERNAL_SERVER_ERROR);
-    let body: Value = response.json();
-    assert_eq!(body["code"], json!("audit.write_failed"));
-}
-
-#[tokio::test]
-pub(super) async fn standalone_router_verifies_audit_before_returning_readiness() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    let first = TestServer::builder().mock_transport().build(
-        standalone_router(config.clone())
-            .await
-            .expect("first router builds"),
-    );
-    first
-        .get("/v1/claims")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-    drop(first);
-    wait_for_audit_writer_shutdown(&audit_path).await;
-
-    let contents = std::fs::read_to_string(&audit_path).expect("audit was written");
-    std::fs::write(
-        &audit_path,
-        contents.replace("\"status\":401", "\"status\":402"),
-    )
-    .expect("audit is tampered");
-
-    let app = standalone_router(config)
-        .await
-        .expect("public helper returns a router with integrity failure latched");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let ready = server.get("/ready").await;
-    ready.assert_status(StatusCode::SERVICE_UNAVAILABLE);
-    let body: Value = ready.json();
-    assert_eq!(body["code"], json!("audit.chain.inconsistent"));
-    assert_eq!(body["status"], json!(503));
-    assert!(body["request_id"].is_string());
-    assert!(body.get("checks").is_none());
-    assert!(body.get("readiness_status").is_none());
-    let rendered = serde_json::to_string(&body).expect("readiness problem serializes");
-    assert!(!rendered.contains("\"status\":402"));
-    assert!(!rendered.contains(&audit_path.to_string_lossy().to_string()));
-    server.get("/healthz").await.assert_status_ok();
-}
diff --git a/crates/registry-notary-server/tests/standalone_http/auth.rs b/crates/registry-notary-server/tests/standalone_http/auth.rs
deleted file mode 100644
index dbc17cbf5..000000000
--- a/crates/registry-notary-server/tests/standalone_http/auth.rs
+++ /dev/null
@@ -1,460 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::support::*;
-#[allow(unused_imports)]
-use super::{
-    admin::*, audit::*, credentials::*, federation::*, http_contracts::*, oid4vci::*, preauth::*,
-};
-
-#[tokio::test]
-pub(super) async fn malformed_authorization_with_valid_api_key_is_candidate_neutral() {
-    assert_ambiguous_primary_headers_are_candidate_neutral(
-        axum::http::HeaderValue::from_bytes(b"\xff").expect("opaque header value is valid"),
-        axum::http::HeaderValue::from_static("api-token"),
-    )
-    .await;
-}
-
-#[tokio::test]
-pub(super) async fn valid_authorization_with_non_utf8_api_key_is_candidate_neutral() {
-    assert_ambiguous_primary_headers_are_candidate_neutral(
-        axum::http::HeaderValue::from_static("Bearer api-token"),
-        axum::http::HeaderValue::from_bytes(b"\xff").expect("opaque header value is valid"),
-    )
-    .await;
-}
-
-async fn assert_ambiguous_primary_headers_are_candidate_neutral(
-    authorization: axum::http::HeaderValue,
-    api_key: axum::http::HeaderValue,
-) {
-    const API_KEY_MARKER: &str = "api-token";
-    const PRINCIPAL_MARKER: &str = "caseworker";
-    const BEARER_PRINCIPAL_MARKER: &str = "bearer-caseworker";
-    const SCOPE_MARKER: &str = "farmer_registry:evidence_verification";
-
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    config.auth.bearer_tokens.push(EvidenceCredentialConfig {
-        id: BEARER_PRINCIPAL_MARKER.to_string(),
-        fingerprint: env_fingerprint_ref("TEST_EVIDENCE_API_KEY_HASH"),
-        scopes: vec![SCOPE_MARKER.to_string()],
-        authorization_details: None,
-    });
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let response = server
-        .get("/v1/claims")
-        .add_header("x-api-key", api_key)
-        .add_header("authorization", authorization)
-        .await;
-
-    response.assert_status(StatusCode::BAD_REQUEST);
-    let problem: Value = response.json();
-    assert_eq!(problem["code"], json!("auth.multiple_credentials"));
-    assert_eq!(
-        problem["detail"],
-        json!("provide exactly one authentication credential")
-    );
-    assert!(problem.get("data").is_none());
-    let rendered = problem.to_string();
-    for marker in [
-        API_KEY_MARKER,
-        PRINCIPAL_MARKER,
-        BEARER_PRINCIPAL_MARKER,
-        SCOPE_MARKER,
-    ] {
-        assert!(
-            !rendered.contains(marker),
-            "problem body leaked marker {marker}"
-        );
-    }
-
-    let audit = std::fs::read_to_string(&audit_path).expect("audit was written");
-    for marker in [
-        API_KEY_MARKER,
-        PRINCIPAL_MARKER,
-        BEARER_PRINCIPAL_MARKER,
-        SCOPE_MARKER,
-    ] {
-        assert!(!audit.contains(marker), "audit leaked marker {marker}");
-    }
-    let records = audit_envelopes(&audit_path)
-        .into_iter()
-        .map(|envelope| envelope.record)
-        .filter(|record| record["path"] == json!("/v1/claims"))
-        .collect::<Vec<_>>();
-    assert_eq!(records.len(), 1, "one request must emit one audit record");
-    let record = &records[0];
-    assert_eq!(record["status"], json!(400));
-    assert_eq!(record["decision"], json!("denied"));
-    assert_eq!(record["error_code"], json!("auth.multiple_credentials"));
-    assert!(record.get("principal_id").is_none());
-    assert!(record.get("principal_id_hash").is_none());
-    assert_eq!(record["scopes_used"], json!([]));
-    assert!(record.get("relay_consultation_count").is_none());
-    assert!(record.get("relay_consultation_ids").is_none());
-}
-
-#[tokio::test]
-pub(super) async fn additive_api_key_and_oidc_authenticate_on_the_same_router() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    config.auth.bearer_tokens.clear();
-    config.auth.oidc = Some(EvidenceOidcAuthConfig {
-        issuer: idp.issuer(),
-        jwks_url: idp.jwks_uri(),
-        userinfo_endpoint: None,
-        userinfo_issuers: Vec::new(),
-        audiences: vec!["registry-notary".to_string()],
-        allowed_clients: vec!["registry-client".to_string()],
-        allowed_algorithms: vec!["EdDSA".to_string()],
-        allowed_token_types: vec!["JWT".to_string()],
-        scope_claim: "scope".to_string(),
-        scope_separator: " ".to_string(),
-        scope_map: BTreeMap::new(),
-        principal_claim: "sub".to_string(),
-        leeway: Duration::from_secs(60),
-        allow_insecure_localhost: true,
-    });
-    let token = idp.mint_token(json!({
-        "sub": "caseworker",
-        "aud": "registry-notary",
-        "azp": "registry-client",
-        "scope": "farmer_registry:evidence_verification",
-    }));
-
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let denied = server.get("/v1/claims").await;
-    denied.assert_status(StatusCode::UNAUTHORIZED);
-
-    let response = server
-        .get("/v1/claims")
-        .add_header("authorization", format!("Bearer {token}"))
-        .await;
-    response.assert_status_ok();
-    let body: Value = response.json();
-    assert_eq!(body["data"][0]["id"], json!("farmer-under-4ha"));
-
-    let api_key_response = server
-        .get("/v1/claims")
-        .add_header("x-api-key", "api-token")
-        .await;
-    api_key_response.assert_status_ok();
-
-    let ambiguous = server
-        .get("/v1/claims")
-        .add_header("x-api-key", "api-token")
-        .add_header("authorization", format!("Bearer {token}"))
-        .await;
-    ambiguous.assert_status(StatusCode::BAD_REQUEST);
-
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let id_token_typ = sign_ed25519_compact_jwt(
-        fixtures::ED25519_PRIVATE_JWK,
-        "id_token",
-        "registry-platform-testing-ed25519-1",
-        json!({
-            "iss": idp.issuer(),
-            "sub": "caseworker",
-            "aud": "registry-notary",
-            "azp": "registry-client",
-            "scope": "farmer_registry:evidence_verification",
-            "iat": now,
-            "nbf": now,
-            "exp": now + 300,
-        }),
-    );
-    let wrong_typ = server
-        .get("/v1/claims")
-        .add_header("authorization", format!("Bearer {id_token_typ}"))
-        .await;
-    wrong_typ.assert_status(StatusCode::UNAUTHORIZED);
-
-    let audit = std::fs::read_to_string(&audit_path).expect("audit was written");
-    let envelopes = audit_envelopes(&audit_path);
-    assert!(envelopes
-        .iter()
-        .any(|envelope| envelope.record.get("principal_id_hash").is_some()));
-    assert!(envelopes
-        .iter()
-        .all(|envelope| envelope.record.get("principal_id").is_none()));
-    let claims_audit = envelopes
-        .iter()
-        .map(|envelope| &envelope.record)
-        .find(|record| record["path"] == json!("/v1/claims") && record["status"] == json!(200))
-        .expect("claims audit record exists");
-    assert_eq!(
-        claims_audit["scopes_used"],
-        json!(["farmer_registry:evidence_verification"])
-    );
-    assert!(!audit.contains(&token));
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn oidc_metrics_scope_can_scrape_metrics_but_non_metrics_cannot() {
-    set_audit_secret();
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    config.server.admin_listener.mode = RegistryNotaryAdminListenerMode::SharedWithPublic;
-    config.auth.api_keys.clear();
-    config.auth.bearer_tokens.clear();
-    config.auth.oidc = Some(EvidenceOidcAuthConfig {
-        issuer: idp.issuer(),
-        jwks_url: idp.jwks_uri(),
-        userinfo_endpoint: None,
-        userinfo_issuers: Vec::new(),
-        audiences: vec!["registry-notary".to_string()],
-        allowed_clients: vec!["registry-client".to_string()],
-        allowed_algorithms: vec!["EdDSA".to_string()],
-        allowed_token_types: vec!["JWT".to_string()],
-        scope_claim: "scope".to_string(),
-        scope_separator: " ".to_string(),
-        scope_map: [(
-            "metrics_read".to_string(),
-            vec!["registry_notary:metrics_read".to_string()],
-        )]
-        .into_iter()
-        .collect(),
-        principal_claim: "sub".to_string(),
-        leeway: Duration::from_secs(60),
-        allow_insecure_localhost: true,
-    });
-    let non_admin_token = idp.mint_token(json!({
-        "sub": "caseworker",
-        "aud": "registry-notary",
-        "azp": "registry-client",
-        "scope": "farmer_registry:evidence_verification",
-    }));
-    let metrics_token = idp.mint_token(json!({
-        "sub": "metrics-reader",
-        "aud": "registry-notary",
-        "azp": "registry-client",
-        "scope": "metrics_read",
-    }));
-
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let non_metrics = server
-        .get("/metrics")
-        .add_header("authorization", format!("Bearer {non_admin_token}"))
-        .await;
-    non_metrics.assert_status(StatusCode::FORBIDDEN);
-    assert!(!non_metrics
-        .text()
-        .contains("registry_notary_http_requests_total"));
-
-    let metrics = server
-        .get("/metrics")
-        .add_header("authorization", format!("Bearer {metrics_token}"))
-        .await;
-    metrics.assert_status_ok();
-    assert!(metrics
-        .text()
-        .contains("registry_notary_http_requests_total"));
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn jwks_is_public_and_contains_no_private_members() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_oidc_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let jwks = server.get("/.well-known/evidence/jwks.json").await;
-
-    jwks.assert_status_ok();
-    let jwks_body: Value = jwks.json();
-    let keys = jwks_body["keys"].as_array().expect("JWKS keys");
-    assert_eq!(keys.len(), 1);
-    assert_eq!(keys[0]["kid"], json!("did:web:issuer.example#key-1"));
-    assert!(keys[0].get("d").is_none());
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn oidc_subject_access_evaluates_renders_and_audits_access_mode() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_oidc_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "subject_access",
-        "national_id": "person-1",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    let authorization = format!("Bearer {token}");
-
-    let jwks = server.get("/.well-known/evidence/jwks.json").await;
-    jwks.assert_status_ok();
-    let jwks_body: Value = jwks.json();
-    assert_eq!(jwks_body["keys"].as_array().expect("JWKS keys").len(), 1);
-    assert_eq!(
-        jwks_body["keys"][0]["kid"],
-        json!("did:web:issuer.example#key-1")
-    );
-    assert!(jwks_body["keys"][0].get("d").is_none());
-
-    let evaluate = server
-        .post("/v1/evaluations")
-        .add_header("authorization", authorization.clone())
-        .add_header("x-request-id", "req-subject-access-1")
-        .json(&json!({
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "format": "application/vnd.registry-notary.claim-result+json"
-        }))
-        .await;
-    evaluate.assert_status_ok();
-    let evaluate_body: Value = evaluate.json();
-    assert_eq!(evaluate_body["results"][0]["value"], json!(true));
-    // Subject-access flows produce results under the canonical evaluation
-    // policy, so generated_by carries the policy triple.
-    let generated_by = &evaluate_body["results"][0]["provenance"]["generated_by"];
-    assert_eq!(generated_by["policy_id"], json!("subject-access"));
-    assert!(
-        generated_by["policy_hash"]
-            .as_str()
-            .expect("subject-access provenance carries policy_hash")
-            .starts_with("sha256:"),
-        "policy_hash must use the sha256:<hex> prefixed format"
-    );
-    let evaluation_id = evaluate_body["results"][0]["evaluation_id"]
-        .as_str()
-        .expect("evaluation id returned")
-        .to_string();
-
-    let render = server
-        .post(&format!("/v1/evaluations/{evaluation_id}/render"))
-        .add_header("authorization", authorization)
-        .add_header("x-request-id", "req-subject-access-1")
-        .json(&json!({
-            "disclosure": "value",
-            "format": "application/vnd.registry-notary.claim-result+json"
-        }))
-        .await;
-    render.assert_status_ok();
-    let render_body: Value = render.json();
-    assert_eq!(render_body["results"][0]["value"], json!(true));
-
-    let audit = std::fs::read_to_string(&audit_path).expect("audit was written");
-    assert!(!audit.contains(&token));
-    assert!(!audit.contains("person-1"));
-    assert!(!audit.contains("citizen-subject"));
-    let records = audit_envelopes(&audit_path)
-        .into_iter()
-        .map(|envelope| envelope.record)
-        .collect::<Vec<_>>();
-    let evaluate_audit = records
-        .iter()
-        .find(|record| {
-            record["path"] == json!("/v1/evaluations")
-                && record["decision"] == json!("evaluate")
-                && record["status"] == json!(200)
-        })
-        .expect("evaluate audit record exists");
-    assert_eq!(
-        evaluate_audit["access_mode"],
-        json!("subject_bound"),
-        "{evaluate_audit}"
-    );
-    assert!(evaluate_audit["policy_hash"].is_string());
-    assert!(evaluate_audit.get("correlation_id").is_none());
-    assert!(evaluate_audit["correlation_id_hash"]
-        .as_str()
-        .expect("correlation id hash is string")
-        .starts_with("hmac-sha256:"));
-    assert!(evaluate_audit.get("principal_id").is_none());
-    assert!(evaluate_audit.get("principal_id_hash").is_some());
-    assert_eq!(evaluate_audit["scopes_used"], json!(["subject_access"]));
-
-    let render_audit = records
-        .iter()
-        .find(|record| {
-            record["path"] == json!("/v1/evaluations/{evaluation_id}/render")
-                && record["decision"] == json!("render")
-                && record["status"] == json!(200)
-        })
-        .expect("render audit record exists");
-    assert_eq!(render_audit["access_mode"], json!("subject_bound"));
-    assert_eq!(render_audit["scopes_used"], json!(["subject_access"]));
-    assert_eq!(render_audit["purposes"], json!(["citizen_subject_access"]));
-    assert!(render_audit["policy_hash"].is_string());
-    assert!(render_audit.get("correlation_id").is_none());
-    assert!(render_audit["correlation_id_hash"]
-        .as_str()
-        .expect("correlation id hash is string")
-        .starts_with("hmac-sha256:"));
-
-    idp.stop().await;
-}
diff --git a/crates/registry-notary-server/tests/standalone_http/credentials.rs b/crates/registry-notary-server/tests/standalone_http/credentials.rs
deleted file mode 100644
index a7cb09d0f..000000000
--- a/crates/registry-notary-server/tests/standalone_http/credentials.rs
+++ /dev/null
@@ -1,1625 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::support::*;
-#[allow(unused_imports)]
-use super::{
-    admin::*, audit::*, auth::*, federation::*, http_contracts::*, oid4vci::*, preauth::*,
-};
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn direct_registry_dependency_journey_evaluates_and_issues_over_http() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oidc_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    config.subject_access.allowed_operations.issue_credential = true;
-    let mut dependency = config.evidence.claims[0].clone();
-    dependency.id = "civil-record-active".to_string();
-    dependency.title = "Civil record active".to_string();
-    dependency.depends_on.clear();
-    dependency.credential_profiles.clear();
-    config.evidence.claims[0].depends_on = vec![dependency.id.clone()];
-    config.evidence.claims.push(dependency);
-
-    let app = standalone_router(config)
-        .await
-        .expect("validated config activates the HTTP Relay adapter");
-    let server = TestServer::builder().mock_transport().build(app);
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "subject_access",
-        "national_id": "person-1",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    let authorization = format!("Bearer {token}");
-    let evaluate = server
-        .post("/v1/evaluations")
-        .add_header("authorization", authorization.clone())
-        .json(&json!({
-            "target": person_identifier_target("national_id", "person-1"),
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "format": "application/vnd.registry-notary.claim-result+json"
-        }))
-        .await;
-    evaluate.assert_status_ok();
-    let evaluated: Value = evaluate.json();
-    assert_eq!(evaluated["results"][0]["value"], json!(true));
-    assert_eq!(
-        evaluated["results"][0]["provenance"]["used"]["relay_consultation_count"],
-        json!(1),
-        "the root and dependency share one exact Relay execution"
-    );
-    let evaluation_id = evaluated["results"][0]["evaluation_id"]
-        .as_str()
-        .expect("evaluation id returned")
-        .to_string();
-    let holder_id = holder_did_jwk();
-    let proof =
-        sign_direct_holder_proof(&holder_id, &evaluation_id, "registry-dependency-http-jti-1");
-    let issue = server
-        .post("/v1/credentials")
-        .add_header("authorization", authorization)
-        .json(&json!({
-            "evaluation_id": evaluation_id,
-            "credential_profile": "civil_status_sd_jwt",
-            "format": "application/dc+sd-jwt",
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "holder": {
-                "binding": "did",
-                "id": holder_id,
-                "proof": proof
-            }
-        }))
-        .await;
-    issue.assert_status_ok();
-    let issued: Value = issue.json();
-    assert_eq!(issued["credential_profile"], json!("civil_status_sd_jwt"));
-    assert!(issued["credential"]
-        .as_str()
-        .is_some_and(|credential| credential.contains('~')));
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn direct_credential_pre_evaluation_denials_are_audited_and_redacted() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_oidc_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "subject_access",
-        "national_id": "person-1",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    let authorization = format!("Bearer {token}");
-    let invalid_classification_token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "openid",
-        "national_id": "person-1",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    let invalid_classification_authorization = format!("Bearer {invalid_classification_token}");
-    const UNKNOWN_EVALUATION_ID: &str = "attacker-controlled-unknown-evaluation";
-    const IDEMPOTENCY_EVALUATION_ID: &str = "idempotency-evaluation-not-read";
-    const CLASSIFICATION_EVALUATION_ID: &str = "classification-evaluation-not-read";
-    let cases = vec![
-        (
-            "malformed JSON",
-            authorization.clone(),
-            None,
-            false,
-            StatusCode::BAD_REQUEST,
-            "request.invalid",
-            "request.invalid",
-            None,
-            None,
-        ),
-        (
-            "missing evaluation id",
-            authorization.clone(),
-            Some(json!({})),
-            false,
-            StatusCode::BAD_REQUEST,
-            "request.invalid",
-            "request.invalid",
-            None,
-            None,
-        ),
-        (
-            "unsupported idempotency key",
-            authorization.clone(),
-            Some(json!({"evaluation_id": IDEMPOTENCY_EVALUATION_ID})),
-            true,
-            StatusCode::BAD_REQUEST,
-            "request.invalid",
-            "request.invalid",
-            None,
-            None,
-        ),
-        (
-            "unknown evaluation id",
-            authorization.clone(),
-            Some(json!({"evaluation_id": UNKNOWN_EVALUATION_ID})),
-            false,
-            StatusCode::NOT_FOUND,
-            "evaluation.not_found",
-            "evaluation.not_found",
-            None,
-            None,
-        ),
-        (
-            "subject-access classification denial",
-            invalid_classification_authorization.clone(),
-            Some(json!({"evaluation_id": CLASSIFICATION_EVALUATION_ID})),
-            false,
-            StatusCode::FORBIDDEN,
-            "subject_access.denied",
-            "subject_access.invalid_token",
-            Some("subject_access.invalid_token"),
-            Some(("subject_bound", "national_id")),
-        ),
-    ];
-
-    for (
-        index,
-        (
-            name,
-            case_authorization,
-            payload,
-            idempotency_key,
-            status,
-            code,
-            audit_code,
-            denial_code,
-            attestation_context,
-        ),
-    ) in cases.into_iter().enumerate()
-    {
-        let request = server
-            .post("/v1/credentials")
-            .add_header("authorization", case_authorization);
-        let request = if idempotency_key {
-            request.add_header("idempotency-key", "unsupported-idempotency-key")
-        } else {
-            request
-        };
-        let response = match payload {
-            Some(payload) => request.json(&payload).await,
-            None => {
-                request
-                    .add_header(header::CONTENT_TYPE, "application/json")
-                    .text("{")
-                    .await
-            }
-        };
-        response.assert_status(status);
-        assert_eq!(
-            response
-                .headers()
-                .get(header::CONTENT_TYPE)
-                .and_then(|value| value.to_str().ok()),
-            Some("application/problem+json"),
-            "{name} returns problem+json"
-        );
-        let body: Value = response.json();
-        assert_problem_identity(&body, status, code);
-        for field in [
-            "credential",
-            "credential_id",
-            "issuer_signed_jwt",
-            "disclosures",
-        ] {
-            assert!(body.get(field).is_none(), "{name} has no {field}");
-        }
-        let body_text = serde_json::to_string(&body).expect("problem body serializes");
-        assert!(!body_text.contains(&token), "{name} does not echo token");
-        for evaluation_id in [
-            UNKNOWN_EVALUATION_ID,
-            IDEMPOTENCY_EVALUATION_ID,
-            CLASSIFICATION_EVALUATION_ID,
-        ] {
-            assert!(
-                !body_text.contains(evaluation_id),
-                "{name} does not echo an untrusted evaluation id"
-            );
-        }
-
-        let records = audit_records_from_envelopes(&audit_path);
-        let credential_records = records
-            .iter()
-            .filter(|record| record["path"] == json!("/v1/credentials"))
-            .collect::<Vec<_>>();
-        assert_eq!(
-            credential_records.len(),
-            index + 1,
-            "{name} writes one credential audit record"
-        );
-        let denied = credential_records
-            .last()
-            .expect("new credential denial audit record exists");
-        assert_eq!(denied["decision"], json!("credential_denied"), "{name}");
-        assert_eq!(denied["status"], json!(status.as_u16()), "{name}");
-        assert_eq!(denied["error_code"], json!(audit_code), "{name}");
-        assert_eq!(denied["relay_consultation_count"], json!(0), "{name}");
-        assert_eq!(denied["forwarded"], json!(false), "{name}");
-        match denial_code {
-            Some(denial_code) => assert_eq!(denied["denial_code"], json!(denial_code), "{name}"),
-            None => assert!(denied.get("denial_code").is_none(), "{name}"),
-        }
-        if let Some((access_mode, token_claim_name)) = attestation_context {
-            assert_eq!(denied["access_mode"], json!(access_mode), "{name}");
-            assert_eq!(
-                denied["token_claim_name"],
-                json!(token_claim_name),
-                "{name}"
-            );
-        }
-        assert!(
-            denied.get("verification_id").is_none(),
-            "{name} has no untrusted verification id"
-        );
-        for field in [
-            "credential",
-            "credential_id",
-            "issuer_signed_jwt",
-            "disclosures",
-        ] {
-            assert!(denied.get(field).is_none(), "{name} audit has no {field}");
-        }
-        assert!(
-            !audit_record_contains_text(denied, &token),
-            "{name} audit does not contain the token"
-        );
-        assert!(
-            !audit_record_contains_text(denied, UNKNOWN_EVALUATION_ID),
-            "{name} audit does not contain the unknown evaluation id"
-        );
-        assert!(!records.iter().any(|record| {
-            record["path"] == json!("/v1/credentials")
-                && record["decision"] == json!("credential_issued")
-        }));
-    }
-    let records = audit_records_from_envelopes(&audit_path);
-    assert_audit_records_do_not_contain(
-        &records,
-        &[
-            &token,
-            &authorization,
-            &invalid_classification_token,
-            &invalid_classification_authorization,
-            UNKNOWN_EVALUATION_ID,
-            IDEMPOTENCY_EVALUATION_ID,
-            CLASSIFICATION_EVALUATION_ID,
-            "unsupported-idempotency-key",
-            "person-1",
-            "citizen-subject",
-        ],
-    );
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn direct_credentials_issue_creates_retrievable_status_record() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oidc_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    enable_credential_status(&mut config);
-    config.subject_access.allowed_operations.issue_credential = true;
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "subject_access",
-        "national_id": "person-1",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    let authorization = format!("Bearer {token}");
-
-    let evaluate = server
-        .post("/v1/evaluations")
-        .add_header("authorization", authorization.clone())
-        .json(&json!({
-            "target": person_identifier_target("national_id", "person-1"),
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "format": "application/vnd.registry-notary.claim-result+json"
-        }))
-        .await;
-    evaluate.assert_status_ok();
-    let evaluate_body: Value = evaluate.json();
-    assert_eq!(
-        evaluate_body["results"][0]["format"],
-        json!("application/vnd.registry-notary.claim-result+json")
-    );
-    let evaluation_id = evaluate_body["results"][0]["evaluation_id"]
-        .as_str()
-        .expect("evaluation id returned")
-        .to_string();
-    let holder_id = holder_did_jwk();
-    let proof =
-        sign_direct_holder_proof(&holder_id, &evaluation_id, "direct-credential-status-jti-1");
-
-    let issue = server
-        .post("/v1/credentials")
-        .add_header("authorization", authorization)
-        .json(&json!({
-            "evaluation_id": evaluation_id,
-            "credential_profile": "civil_status_sd_jwt",
-            "format": "application/dc+sd-jwt",
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "holder": {
-                "binding": "did",
-                "id": holder_id,
-                "proof": proof
-            }
-        }))
-        .await;
-    issue.assert_status_ok();
-    let issue_body: Value = issue.json();
-    assert_eq!(
-        issue_body["credential_profile"],
-        json!("civil_status_sd_jwt")
-    );
-    assert_eq!(issue_body["format"], json!("application/dc+sd-jwt"));
-    let issuer_signed_jwt = issue_body["issuer_signed_jwt"]
-        .as_str()
-        .expect("issuer signed JWT returned");
-    let header_segment = issuer_signed_jwt
-        .split('.')
-        .next()
-        .expect("issuer signed JWT has protected header");
-    let header: Value = serde_json::from_slice(
-        &URL_SAFE_NO_PAD
-            .decode(header_segment)
-            .expect("issuer signed JWT header is base64url"),
-    )
-    .expect("issuer signed JWT header is JSON");
-    assert_eq!(header["alg"], json!("EdDSA"));
-    assert_eq!(header["typ"], json!("dc+sd-jwt"));
-    assert_eq!(header["kid"], json!("did:web:issuer.example#key-1"));
-    let credential_id = issue_body["credential_id"]
-        .as_str()
-        .expect("credential id returned");
-
-    let status = server
-        .get(&format!("/v1/credentials/{credential_id}/status"))
-        .await;
-    status.assert_status_ok();
-    let status_body: Value = status.json();
-    assert_eq!(status_body["credential_id"], json!(credential_id));
-    assert_eq!(status_body["status"], json!("valid"));
-    assert_eq!(
-        status_body["credential_profile"],
-        json!("civil_status_sd_jwt")
-    );
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn direct_credential_operation_denial_is_audited_and_preserves_denial_code() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let config = subject_access_oidc_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    assert!(config.subject_access.allowed_operations.evaluate);
-    assert!(!config.subject_access.allowed_operations.issue_credential);
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "subject_access",
-        "national_id": "person-1",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    let authorization = format!("Bearer {token}");
-
-    let evaluate = server
-        .post("/v1/evaluations")
-        .add_header("authorization", authorization.clone())
-        .json(&json!({
-            "target": person_identifier_target("national_id", "person-1"),
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "format": "application/vnd.registry-notary.claim-result+json"
-        }))
-        .await;
-    evaluate.assert_status_ok();
-    let evaluate_body: Value = evaluate.json();
-    let evaluation_id = evaluate_body["results"][0]["evaluation_id"]
-        .as_str()
-        .expect("evaluation id returned")
-        .to_string();
-    let holder_id = holder_did_jwk();
-    let proof = sign_direct_holder_proof(&holder_id, &evaluation_id, "operation-denied-jti-1");
-
-    let issue = server
-        .post("/v1/credentials")
-        .add_header("authorization", authorization.clone())
-        .json(&json!({
-            "evaluation_id": evaluation_id,
-            "credential_profile": "civil_status_sd_jwt",
-            "format": "application/dc+sd-jwt",
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "holder": {
-                "binding": "did",
-                "id": holder_id,
-                "proof": proof
-            }
-        }))
-        .await;
-    issue.assert_status(StatusCode::FORBIDDEN);
-    assert_eq!(
-        issue
-            .headers()
-            .get(header::CONTENT_TYPE)
-            .and_then(|value| value.to_str().ok()),
-        Some("application/problem+json")
-    );
-    let body: Value = issue.json();
-    assert_problem_identity(&body, StatusCode::FORBIDDEN, "subject_access.denied");
-    for field in [
-        "credential",
-        "credential_id",
-        "issuer_signed_jwt",
-        "disclosures",
-    ] {
-        assert!(body.get(field).is_none(), "denial has no {field}");
-    }
-
-    let records = audit_records_from_envelopes(&audit_path);
-    let denied = audit_record_with(
-        &records,
-        "/v1/credentials",
-        "credential_denied",
-        StatusCode::FORBIDDEN,
-        "subject_access.operation_denied",
-    );
-    assert_eq!(
-        denied["denial_code"],
-        json!("subject_access.operation_denied")
-    );
-    assert_eq!(denied["verification_id"], json!(evaluation_id));
-    assert_eq!(denied["access_mode"], json!("subject_bound"));
-    assert_eq!(denied["scopes_used"], json!(["subject_access"]));
-    assert_eq!(denied["credential_profile"], json!("civil_status_sd_jwt"));
-    assert_eq!(denied["holder_binding_mode"], json!("did"));
-    assert_eq!(denied["relay_consultation_count"], json!(0));
-    assert_eq!(denied["forwarded"], json!(false));
-    for field in [
-        "credential",
-        "credential_id",
-        "issuer_signed_jwt",
-        "disclosures",
-    ] {
-        assert!(denied.get(field).is_none(), "audit has no {field}");
-    }
-    assert!(!records.iter().any(|record| {
-        record["path"] == json!("/v1/credentials")
-            && record["decision"] == json!("credential_issued")
-    }));
-    assert_audit_records_do_not_contain(
-        &records,
-        &[
-            &token,
-            &authorization,
-            &proof,
-            &holder_id,
-            "operation-denied-jti-1",
-            "person-1",
-            "citizen-subject",
-        ],
-    );
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn direct_credential_disallowed_profile_preserves_profile_denial() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oidc_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    config.subject_access.allowed_operations.issue_credential = true;
-    let machine_profile = config
-        .evidence
-        .credential_profiles
-        .get("civil_status_sd_jwt")
-        .expect("civil status profile exists")
-        .clone();
-    config
-        .evidence
-        .credential_profiles
-        .insert("machine_only_sd_jwt".to_string(), machine_profile);
-    config.evidence.claims[0]
-        .credential_profiles
-        .push("machine_only_sd_jwt".to_string());
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "subject_access",
-        "national_id": "person-1",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    let authorization = format!("Bearer {token}");
-
-    let evaluate = server
-        .post("/v1/evaluations")
-        .add_header("authorization", authorization.clone())
-        .json(&json!({
-            "target": person_identifier_target("national_id", "person-1"),
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "format": "application/vnd.registry-notary.claim-result+json"
-        }))
-        .await;
-    evaluate.assert_status_ok();
-    let evaluate_body: Value = evaluate.json();
-    let evaluation_id = evaluate_body["results"][0]["evaluation_id"]
-        .as_str()
-        .expect("evaluation id returned")
-        .to_string();
-
-    let issue = server
-        .post("/v1/credentials")
-        .add_header("authorization", authorization.clone())
-        .json(&json!({
-            "evaluation_id": evaluation_id,
-            "credential_profile": "machine_only_sd_jwt",
-            "format": "application/dc+sd-jwt",
-            "claims": ["person-is-alive"],
-            "disclosure": "value"
-        }))
-        .await;
-    issue.assert_status(StatusCode::FORBIDDEN);
-    let body: Value = issue.json();
-    assert_problem_identity(&body, StatusCode::FORBIDDEN, "subject_access.denied");
-    assert!(body.get("credential").is_none());
-
-    let records = audit_records_from_envelopes(&audit_path);
-    let denied = audit_record_with(
-        &records,
-        "/v1/credentials",
-        "credential_denied",
-        StatusCode::FORBIDDEN,
-        "subject_access.profile_denied",
-    );
-    assert_eq!(
-        denied["denial_code"],
-        json!("subject_access.profile_denied")
-    );
-    assert_eq!(denied["verification_id"], json!(evaluation_id));
-    assert_eq!(denied["credential_profile"], json!("machine_only_sd_jwt"));
-    assert_eq!(denied["relay_consultation_count"], json!(0));
-    assert_eq!(denied["forwarded"], json!(false));
-    assert!(!records.iter().any(|record| {
-        record["path"] == json!("/v1/credentials")
-            && record["decision"] == json!("credential_issued")
-    }));
-    assert_audit_records_do_not_contain(
-        &records,
-        &[&token, &authorization, "person-1", "citizen-subject"],
-    );
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn direct_credential_rate_limit_is_audited_with_stored_context() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oidc_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    config.subject_access.allowed_operations.issue_credential = true;
-    config
-        .subject_access
-        .rate_limits
-        .credential_issuance_per_principal_per_hour = 1;
-    config.subject_access.token_policy.max_auth_age_seconds = 60;
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "subject_access",
-        "national_id": "person-1",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    let authorization = format!("Bearer {token}");
-    let stale_token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "subject_access",
-        "national_id": "person-1",
-        "auth_time": now - 3600,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    let stale_authorization = format!("Bearer {stale_token}");
-
-    let evaluate = server
-        .post("/v1/evaluations")
-        .add_header("authorization", authorization.clone())
-        .json(&json!({
-            "target": person_identifier_target("national_id", "person-1"),
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "format": "application/vnd.registry-notary.claim-result+json"
-        }))
-        .await;
-    evaluate.assert_status_ok();
-    let evaluate_body: Value = evaluate.json();
-    let evaluation_id = evaluate_body["results"][0]["evaluation_id"]
-        .as_str()
-        .expect("evaluation id returned")
-        .to_string();
-    let holder_id = holder_did_jwk();
-    let first_proof = sign_direct_holder_proof(&holder_id, &evaluation_id, "rate-limit-first-jti");
-    let second_proof =
-        sign_direct_holder_proof(&holder_id, &evaluation_id, "rate-limit-second-jti");
-
-    let stale = server
-        .post("/v1/credentials")
-        .add_header("authorization", stale_authorization.clone())
-        .json(&json!({
-            "evaluation_id": evaluation_id,
-            "credential_profile": "civil_status_sd_jwt",
-            "format": "application/dc+sd-jwt",
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "holder": {
-                "binding": "did",
-                "id": holder_id,
-                "proof": first_proof.clone()
-            }
-        }))
-        .await;
-    stale.assert_status(StatusCode::FORBIDDEN);
-    let stale_body: Value = stale.json();
-    assert_problem_identity(&stale_body, StatusCode::FORBIDDEN, "subject_access.denied");
-    for field in [
-        "credential",
-        "credential_id",
-        "issuer_signed_jwt",
-        "disclosures",
-    ] {
-        assert!(
-            stale_body.get(field).is_none(),
-            "stale token has no {field}"
-        );
-    }
-    let records = audit_records_from_envelopes(&audit_path);
-    let assurance_denied = audit_record_with(
-        &records,
-        "/v1/credentials",
-        "credential_denied",
-        StatusCode::FORBIDDEN,
-        "subject_access.assurance_denied",
-    );
-    assert_eq!(
-        assurance_denied["denial_code"],
-        json!("subject_access.assurance_denied")
-    );
-    assert_eq!(assurance_denied["relay_consultation_count"], json!(0));
-    assert_eq!(assurance_denied["forwarded"], json!(false));
-    assert!(!records.iter().any(|record| {
-        record["path"] == json!("/v1/credentials")
-            && record["decision"] == json!("credential_issued")
-    }));
-
-    let first = server
-        .post("/v1/credentials")
-        .add_header("authorization", authorization.clone())
-        .json(&json!({
-            "evaluation_id": evaluation_id,
-            "credential_profile": "civil_status_sd_jwt",
-            "format": "application/dc+sd-jwt",
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "holder": {
-                "binding": "did",
-                "id": holder_id,
-                "proof": first_proof
-            }
-        }))
-        .await;
-    first.assert_status_ok();
-    let first_body: Value = first.json();
-    let issued_credential = first_body["credential"]
-        .as_str()
-        .expect("first credential is returned")
-        .to_string();
-
-    let limited = server
-        .post("/v1/credentials")
-        .add_header("authorization", authorization.clone())
-        .json(&json!({
-            "evaluation_id": evaluation_id,
-            "credential_profile": "civil_status_sd_jwt",
-            "format": "application/dc+sd-jwt",
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "holder": {
-                "binding": "did",
-                "id": holder_id,
-                "proof": second_proof
-            }
-        }))
-        .await;
-    limited.assert_status(StatusCode::TOO_MANY_REQUESTS);
-    assert_eq!(
-        limited
-            .headers()
-            .get(header::CONTENT_TYPE)
-            .and_then(|value| value.to_str().ok()),
-        Some("application/problem+json")
-    );
-    let limited_body: Value = limited.json();
-    assert_problem_identity(
-        &limited_body,
-        StatusCode::TOO_MANY_REQUESTS,
-        "subject_access.rate_limited",
-    );
-    for field in [
-        "credential",
-        "credential_id",
-        "issuer_signed_jwt",
-        "disclosures",
-    ] {
-        assert!(
-            limited_body.get(field).is_none(),
-            "rate limit has no {field}"
-        );
-    }
-
-    let records = audit_records_from_envelopes(&audit_path);
-    let denied = audit_record_with(
-        &records,
-        "/v1/credentials",
-        "credential_issue_rate_limited",
-        StatusCode::TOO_MANY_REQUESTS,
-        "subject_access.rate_limited",
-    );
-    assert_eq!(denied["denial_code"], json!("subject_access.rate_limited"));
-    assert_eq!(
-        denied["rate_limit_bucket"],
-        json!("credential_issuance_per_principal")
-    );
-    assert_eq!(denied["verification_id"], json!(evaluation_id));
-    assert_eq!(denied["credential_profile"], json!("civil_status_sd_jwt"));
-    assert_eq!(denied["holder_binding_mode"], json!("did"));
-    assert_eq!(denied["access_mode"], json!("subject_bound"));
-    assert_eq!(denied["scopes_used"], json!(["subject_access"]));
-    assert_eq!(denied["purposes"], json!(["citizen_subject_access"]));
-    assert!(denied["claim_hash"].as_str().is_some());
-    assert_eq!(denied["target_type"], json!("Person"));
-    assert!(denied["target_ref_hash"].as_str().is_some());
-    assert_eq!(denied["relay_consultation_count"], json!(0));
-    assert_eq!(denied["forwarded"], json!(false));
-    for field in [
-        "credential",
-        "credential_id",
-        "issuer_signed_jwt",
-        "disclosures",
-    ] {
-        assert!(denied.get(field).is_none(), "audit has no {field}");
-    }
-    assert_eq!(
-        records
-            .iter()
-            .filter(|record| {
-                record["path"] == json!("/v1/credentials")
-                    && record["decision"] == json!("credential_issued")
-            })
-            .count(),
-        1,
-        "only the first request issues a credential"
-    );
-    assert_audit_records_do_not_contain(
-        &records,
-        &[
-            &token,
-            &authorization,
-            &stale_token,
-            &stale_authorization,
-            &first_proof,
-            &second_proof,
-            &holder_id,
-            &issued_credential,
-            "rate-limit-first-jti",
-            "rate-limit-second-jti",
-            "person-1",
-            "citizen-subject",
-        ],
-    );
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn direct_credential_holder_proof_replay_is_audited_and_redacted() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oidc_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    config.subject_access.allowed_operations.issue_credential = true;
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "subject_access",
-        "national_id": "person-1",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    let authorization = format!("Bearer {token}");
-
-    let evaluate = server
-        .post("/v1/evaluations")
-        .add_header("authorization", authorization.clone())
-        .json(&json!({
-            "target": person_identifier_target("national_id", "person-1"),
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "format": "application/vnd.registry-notary.claim-result+json"
-        }))
-        .await;
-    evaluate.assert_status_ok();
-    let evaluate_body: Value = evaluate.json();
-    let evaluation_id = evaluate_body["results"][0]["evaluation_id"]
-        .as_str()
-        .expect("evaluation id returned")
-        .to_string();
-    let holder_id = holder_did_jwk();
-    let proof = sign_direct_holder_proof(&holder_id, &evaluation_id, "direct-replay-jti-1");
-    let credential_request = json!({
-        "evaluation_id": evaluation_id,
-        "credential_profile": "civil_status_sd_jwt",
-        "format": "application/dc+sd-jwt",
-        "claims": ["person-is-alive"],
-        "disclosure": "value",
-        "holder": {
-            "binding": "did",
-            "id": holder_id,
-            "proof": proof
-        }
-    });
-
-    let first = server
-        .post("/v1/credentials")
-        .add_header("authorization", authorization.clone())
-        .json(&credential_request)
-        .await;
-    first.assert_status_ok();
-    let first_body: Value = first.json();
-    assert!(first_body["credential"].is_string());
-
-    let replay = server
-        .post("/v1/credentials")
-        .add_header("authorization", authorization.clone())
-        .json(&credential_request)
-        .await;
-    replay.assert_status(StatusCode::CONFLICT);
-    assert_eq!(
-        replay
-            .headers()
-            .get(header::CONTENT_TYPE)
-            .and_then(|value| value.to_str().ok()),
-        Some("application/problem+json")
-    );
-    let replay_body: Value = replay.json();
-    assert_problem_identity(
-        &replay_body,
-        StatusCode::CONFLICT,
-        "credential.holder_proof_replay",
-    );
-    assert!(replay_body.get("credential").is_none());
-    assert!(replay_body.get("credential_id").is_none());
-    assert!(replay_body.get("issuer_signed_jwt").is_none());
-    assert!(replay_body.get("disclosures").is_none());
-    let replay_body_text = serde_json::to_string(&replay_body).expect("problem body serializes");
-    assert!(!replay_body_text.contains(&token));
-    assert!(!replay_body_text.contains("person-1"));
-    assert!(!replay_body_text.contains("direct-replay-jti-1"));
-
-    let records = audit_records_from_envelopes(&audit_path);
-    let denied = audit_record_with(
-        &records,
-        "/v1/credentials",
-        "credential_denied",
-        StatusCode::CONFLICT,
-        "credential.holder_proof_replay",
-    );
-    assert_eq!(denied["access_mode"], json!("subject_bound"));
-    assert_eq!(denied["scopes_used"], json!(["subject_access"]));
-    assert_eq!(denied["credential_profile"], json!("civil_status_sd_jwt"));
-    assert_eq!(denied["holder_binding_mode"], json!("did"));
-    assert_eq!(denied["relay_consultation_count"], json!(0));
-    assert_eq!(denied["forwarded"], json!(false));
-    assert!(denied.get("principal_id").is_none());
-    assert!(denied["principal_id_hash"]
-        .as_str()
-        .expect("principal id hash is present")
-        .starts_with("hmac-sha256:"));
-    assert!(denied.get("correlation_id").is_none());
-    assert!(denied["correlation_id_hash"]
-        .as_str()
-        .expect("correlation id hash is present")
-        .starts_with("hmac-sha256:"));
-    assert_eq!(
-        records
-            .iter()
-            .filter(|record| {
-                record["path"] == json!("/v1/credentials")
-                    && record["decision"] == json!("credential_issued")
-            })
-            .count(),
-        1,
-        "first use should issue exactly one credential"
-    );
-    assert_audit_records_do_not_contain(
-        &records,
-        &[
-            &token,
-            &authorization,
-            &proof,
-            "direct-replay-jti-1",
-            "person-1",
-            "citizen-subject",
-        ],
-    );
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn strict_credentials_issue_rejects_oid4vci_proof_at_http_boundary() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oidc_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    config.subject_access.allowed_operations.issue_credential = true;
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "subject_access",
-        "national_id": "person-1",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    let authorization = format!("Bearer {token}");
-
-    let evaluate = server
-        .post("/v1/evaluations")
-        .add_header("authorization", authorization.clone())
-        .json(&json!({
-            "target": person_identifier_target("national_id", "person-1"),
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "format": "application/vnd.registry-notary.claim-result+json"
-        }))
-        .await;
-    evaluate.assert_status_ok();
-    let evaluate_body: Value = evaluate.json();
-    let evaluation_id = evaluate_body["results"][0]["evaluation_id"]
-        .as_str()
-        .expect("evaluation id returned");
-    let proof = sign_oid4vci_proof("registry-notary", "nonce-1");
-
-    let issue = server
-        .post("/v1/credentials")
-        .add_header("authorization", authorization.clone())
-        .json(&json!({
-            "evaluation_id": evaluation_id,
-            "credential_profile": "civil_status_sd_jwt",
-            "format": "application/dc+sd-jwt",
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "holder": {
-                "binding": "did",
-                "id": holder_did_jwk(),
-                "proof": proof.clone()
-            }
-        }))
-        .await;
-    issue.assert_status(StatusCode::BAD_REQUEST);
-    assert_eq!(
-        issue
-            .headers()
-            .get(header::CONTENT_TYPE)
-            .and_then(|value| value.to_str().ok()),
-        Some("application/problem+json")
-    );
-    let body: Value = issue.json();
-    assert_problem_identity(
-        &body,
-        StatusCode::BAD_REQUEST,
-        "credential.holder_proof_required",
-    );
-    assert!(body.get("credential").is_none());
-    assert!(body.get("issuer_signed_jwt").is_none());
-    assert!(body.get("disclosures").is_none());
-    let body_text = serde_json::to_string(&body).expect("problem body serializes");
-    assert!(!body_text.contains(&proof));
-    assert!(!body_text.contains(&token));
-    assert!(!body_text.contains("person-1"));
-
-    let records = audit_records_from_envelopes(&audit_path);
-    let denied = audit_record_with(
-        &records,
-        "/v1/credentials",
-        "credential_denied",
-        StatusCode::BAD_REQUEST,
-        "credential.holder_proof_required",
-    );
-    assert_eq!(denied["access_mode"], json!("subject_bound"));
-    assert_eq!(denied["scopes_used"], json!(["subject_access"]));
-    assert_eq!(denied["credential_profile"], json!("civil_status_sd_jwt"));
-    assert_eq!(denied["holder_binding_mode"], json!("did"));
-    assert_eq!(denied["relay_consultation_count"], json!(0));
-    assert_eq!(denied["forwarded"], json!(false));
-    assert!(denied.get("principal_id").is_none());
-    assert!(denied["principal_id_hash"]
-        .as_str()
-        .expect("principal id hash is present")
-        .starts_with("hmac-sha256:"));
-    assert!(denied.get("correlation_id").is_none());
-    assert!(denied["correlation_id_hash"]
-        .as_str()
-        .expect("correlation id hash is present")
-        .starts_with("hmac-sha256:"));
-    assert_audit_records_do_not_contain(
-        &records,
-        &[
-            &token,
-            &authorization,
-            &proof,
-            "person-1",
-            "citizen-subject",
-            "issuer_signed_jwt",
-            "disclosures",
-        ],
-    );
-    assert!(!records.iter().any(|record| {
-        record["path"] == json!("/v1/credentials")
-            && record["decision"] == json!("credential_issued")
-    }));
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn direct_credential_purpose_mismatch_denial_is_audited_and_redacted() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oidc_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    config.subject_access.allowed_operations.issue_credential = true;
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "subject_access",
-        "national_id": "person-1",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    let authorization = format!("Bearer {token}");
-
-    let evaluate = server
-        .post("/v1/evaluations")
-        .add_header("authorization", authorization.clone())
-        .json(&json!({
-            "target": person_identifier_target("national_id", "person-1"),
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "format": "application/vnd.registry-notary.claim-result+json"
-        }))
-        .await;
-    evaluate.assert_status_ok();
-    let evaluate_body: Value = evaluate.json();
-    let evaluation_id = evaluate_body["results"][0]["evaluation_id"]
-        .as_str()
-        .expect("evaluation id returned");
-
-    let issue = server
-        .post("/v1/credentials")
-        .add_header("authorization", authorization.clone())
-        .json(&json!({
-            "evaluation_id": evaluation_id,
-            "credential_profile": "civil_status_sd_jwt",
-            "format": "application/dc+sd-jwt",
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "purpose": "appeals"
-        }))
-        .await;
-    issue.assert_status(StatusCode::FORBIDDEN);
-    assert_eq!(
-        issue
-            .headers()
-            .get(header::CONTENT_TYPE)
-            .and_then(|value| value.to_str().ok()),
-        Some("application/problem+json")
-    );
-    let body: Value = issue.json();
-    assert_problem_identity(&body, StatusCode::FORBIDDEN, "evaluation.binding_mismatch");
-    assert!(body.get("credential").is_none());
-    assert!(body.get("credential_id").is_none());
-    assert!(body.get("issuer_signed_jwt").is_none());
-    assert!(body.get("disclosures").is_none());
-    let body_text = serde_json::to_string(&body).expect("problem body serializes");
-    assert!(!body_text.contains(&token));
-    assert!(!body_text.contains("person-1"));
-
-    let records = audit_records_from_envelopes(&audit_path);
-    let denied = audit_record_with(
-        &records,
-        "/v1/credentials",
-        "credential_denied",
-        StatusCode::FORBIDDEN,
-        "evaluation.binding_mismatch",
-    );
-    assert_eq!(denied["access_mode"], json!("subject_bound"));
-    assert_eq!(denied["scopes_used"], json!(["subject_access"]));
-    assert_eq!(denied["relay_consultation_count"], json!(0));
-    assert_eq!(denied["forwarded"], json!(false));
-    assert!(denied.get("principal_id").is_none());
-    assert!(denied["principal_id_hash"]
-        .as_str()
-        .expect("principal id hash is present")
-        .starts_with("hmac-sha256:"));
-    assert!(denied.get("correlation_id").is_none());
-    assert!(denied["correlation_id_hash"]
-        .as_str()
-        .expect("correlation id hash is present")
-        .starts_with("hmac-sha256:"));
-    assert_audit_records_do_not_contain(
-        &records,
-        &[
-            &token,
-            &authorization,
-            "person-1",
-            "citizen-subject",
-            "issuer_signed_jwt",
-            "disclosures",
-        ],
-    );
-    assert!(!records.iter().any(|record| {
-        record["path"] == json!("/v1/credentials")
-            && record["decision"] == json!("credential_issued")
-    }));
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn direct_credential_binding_denials_are_audited_and_redacted() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oidc_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    config.subject_access.allowed_operations.issue_credential = true;
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "subject_access",
-        "national_id": "person-1",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    let authorization = format!("Bearer {token}");
-
-    let evaluate = server
-        .post("/v1/evaluations")
-        .add_header("authorization", authorization.clone())
-        .json(&json!({
-            "target": person_identifier_target("national_id", "person-1"),
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "format": "application/vnd.registry-notary.claim-result+json"
-        }))
-        .await;
-    evaluate.assert_status_ok();
-    let evaluate_body: Value = evaluate.json();
-    let evaluation_id = evaluate_body["results"][0]["evaluation_id"]
-        .as_str()
-        .expect("evaluation id returned");
-
-    let cases = [
-        (
-            "unsupported format",
-            json!({
-                "evaluation_id": evaluation_id,
-                "credential_profile": "civil_status_sd_jwt",
-                "format": "application/json",
-                "claims": ["person-is-alive"],
-                "disclosure": "value"
-            }),
-            StatusCode::NOT_ACCEPTABLE,
-            "claim.format_not_supported",
-        ),
-        (
-            "disclosure mismatch",
-            json!({
-                "evaluation_id": evaluation_id,
-                "credential_profile": "civil_status_sd_jwt",
-                "format": "application/dc+sd-jwt",
-                "claims": ["person-is-alive"],
-                "disclosure": "predicate"
-            }),
-            StatusCode::FORBIDDEN,
-            "evaluation.binding_mismatch",
-        ),
-        (
-            "claim-set mismatch",
-            json!({
-                "evaluation_id": evaluation_id,
-                "credential_profile": "civil_status_sd_jwt",
-                "format": "application/dc+sd-jwt",
-                "claims": ["person-is-dead"],
-                "disclosure": "value"
-            }),
-            StatusCode::FORBIDDEN,
-            "evaluation.binding_mismatch",
-        ),
-    ];
-
-    for (name, payload, status, code) in &cases {
-        let issue = server
-            .post("/v1/credentials")
-            .add_header("authorization", authorization.clone())
-            .json(&payload)
-            .await;
-        issue.assert_status(*status);
-        assert_eq!(
-            issue
-                .headers()
-                .get(header::CONTENT_TYPE)
-                .and_then(|value| value.to_str().ok()),
-            Some("application/problem+json"),
-            "{name} returns problem+json"
-        );
-        let body: Value = issue.json();
-        assert_problem_identity(&body, *status, code);
-        assert!(body.get("credential").is_none(), "{name} has no credential");
-        assert!(
-            body.get("credential_id").is_none(),
-            "{name} has no credential id"
-        );
-        assert!(
-            body.get("issuer_signed_jwt").is_none(),
-            "{name} has no issuer JWT"
-        );
-        assert!(
-            body.get("disclosures").is_none(),
-            "{name} has no disclosures"
-        );
-        let body_text = serde_json::to_string(&body).expect("problem body serializes");
-        assert!(!body_text.contains(&token), "{name} does not echo token");
-        assert!(
-            !body_text.contains("person-1"),
-            "{name} does not echo subject"
-        );
-    }
-
-    let records = audit_records_from_envelopes(&audit_path);
-    let denied_records = records
-        .iter()
-        .filter(|record| {
-            record["path"] == json!("/v1/credentials")
-                && record["decision"] == json!("credential_denied")
-        })
-        .collect::<Vec<_>>();
-    assert_eq!(
-        denied_records.len(),
-        cases.len(),
-        "every binding denial should emit credential_denied audit"
-    );
-    for ((name, _, status, code), denied) in cases.iter().zip(denied_records.iter()) {
-        assert_eq!(
-            denied["status"],
-            json!(status.as_u16()),
-            "{name} audit status"
-        );
-        assert_eq!(
-            denied["error_code"],
-            json!(*code),
-            "{name} audit error code"
-        );
-        assert_eq!(denied["access_mode"], json!("subject_bound"));
-        assert_eq!(denied["scopes_used"], json!(["subject_access"]));
-        assert_eq!(denied["relay_consultation_count"], json!(0));
-        assert_eq!(denied["forwarded"], json!(false));
-        assert!(denied.get("principal_id").is_none());
-        assert!(denied["principal_id_hash"]
-            .as_str()
-            .expect("principal id hash is present")
-            .starts_with("hmac-sha256:"));
-        assert!(denied.get("correlation_id").is_none());
-        assert!(denied["correlation_id_hash"]
-            .as_str()
-            .expect("correlation id hash is present")
-            .starts_with("hmac-sha256:"));
-    }
-    assert_audit_records_do_not_contain(
-        &records,
-        &[
-            &token,
-            &authorization,
-            "person-1",
-            "citizen-subject",
-            "issuer_signed_jwt",
-            "disclosures",
-        ],
-    );
-    assert!(!records.iter().any(|record| {
-        record["path"] == json!("/v1/credentials")
-            && record["decision"] == json!("credential_issued")
-    }));
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn subject_access_subject_mismatch_audit_names_token_claim_not_value() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_oidc_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "subject_access",
-        "national_id": "person-1",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-
-    let response = server
-        .post("/v1/evaluations")
-        .add_header("authorization", format!("Bearer {token}"))
-        .add_header("x-request-id", "bad value")
-        .json(&json!({
-            "target": person_identifier_target("national_id", "person-2"),
-            "claims": ["person-is-alive"],
-            "disclosure": "value",
-            "format": "application/vnd.registry-notary.claim-result+json"
-        }))
-        .await;
-    response.assert_status(StatusCode::FORBIDDEN);
-    let body: Value = response.json();
-    assert_eq!(body["code"], json!("subject_access.denied"));
-    assert_eq!(
-        body["type"],
-        json!("https://id.registrystack.org/problems/registry-notary/subject_access/denied")
-    );
-
-    let audit = std::fs::read_to_string(&audit_path).expect("audit was written");
-    assert!(!audit.contains("person-1"));
-    assert!(!audit.contains("person-2"));
-    assert!(!audit.contains("citizen-subject"));
-    let records = audit_envelopes(&audit_path)
-        .into_iter()
-        .map(|envelope| envelope.record)
-        .collect::<Vec<_>>();
-    let denied = records
-        .iter()
-        .find(|record| {
-            record["path"] == json!("/v1/evaluations")
-                && record["decision"] == json!("evaluate_denied")
-                && record["status"] == json!(403)
-        })
-        .expect("denial audit record exists");
-    assert_eq!(denied["access_mode"], json!("subject_bound"));
-    assert_eq!(
-        denied["denial_code"],
-        json!("subject_access.subject_mismatch")
-    );
-    assert_eq!(
-        denied["error_code"],
-        json!("subject_access.subject_mismatch")
-    );
-    assert_eq!(denied["token_claim_name"], json!("national_id"));
-    assert!(denied.get("correlation_id").is_none());
-    assert!(denied["correlation_id_hash"].is_string());
-    assert_ne!(denied["correlation_id_hash"], json!("bad value"));
-
-    idp.stop().await;
-}
diff --git a/crates/registry-notary-server/tests/standalone_http/federation.rs b/crates/registry-notary-server/tests/standalone_http/federation.rs
deleted file mode 100644
index 20af292de..000000000
--- a/crates/registry-notary-server/tests/standalone_http/federation.rs
+++ /dev/null
@@ -1,1418 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::support::*;
-#[allow(unused_imports)]
-use super::{
-    admin::*, audit::*, auth::*, credentials::*, http_contracts::*, oid4vci::*, preauth::*,
-};
-
-pub(super) fn set_federation_env() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-    std::env::set_var("TEST_FEDERATION_SIGNING_KEY", TEST_ISSUER_JWK);
-    std::env::set_var(
-        "TEST_FEDERATION_PAIRWISE_SECRET",
-        "federation-pairwise-secret",
-    );
-}
-
-pub(super) fn federation_config(
-    base_url: &str,
-    audit_path: &str,
-    peer_jwks_uri: &str,
-) -> StandaloneRegistryNotaryConfig {
-    federation_config_for(
-        base_url,
-        audit_path,
-        "did:web:agency-a.example.gov",
-        "https://agency-a.example.gov",
-        "did:web:agency-b.example.gov",
-        "https://agency-b.example.gov",
-        peer_jwks_uri,
-    )
-}
-
-#[allow(clippy::too_many_arguments)]
-pub(super) fn federation_config_for(
-    base_url: &str,
-    audit_path: &str,
-    node_id: &str,
-    issuer: &str,
-    peer_node_id: &str,
-    peer_issuer: &str,
-    peer_jwks_uri: &str,
-) -> StandaloneRegistryNotaryConfig {
-    let mut config = registry_backed_config(base_url, audit_path);
-    let claim = config
-        .evidence
-        .claims
-        .first_mut()
-        .expect("federation test claim exists");
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-        panic!("federation test claim is registry backed")
-    };
-    consultations
-        .get_mut("person_status")
-        .expect("federation test consultation exists")
-        .inputs
-        .insert(
-            "subject_id".to_string(),
-            RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.national_id".to_string(),
-            ),
-        );
-    config.evidence.signing_keys.insert(
-        "federation-key".to_string(),
-        SigningKeyConfig {
-            provider: SigningKeyProviderConfig::LocalJwkEnv,
-            alg: SD_JWT_VC_SIGNING_ALG.to_string(),
-            kid: "agency-a-fed-1".to_string(),
-            status: SigningKeyStatus::Active,
-            publish_until_unix_seconds: None,
-            private_jwk_env: "TEST_FEDERATION_SIGNING_KEY".to_string(),
-            public_jwk_env: String::new(),
-            module_path: String::new(),
-            token_label: String::new(),
-            pin_env: String::new(),
-            key_label: String::new(),
-            key_id_hex: String::new(),
-            path: String::new(),
-            password_env: String::new(),
-        },
-    );
-    config.federation = serde_norway::from_str(&format!(
-        r#"
-enabled: true
-node_id: {node_id}
-issuer: {issuer}
-jwks_uri: {issuer}/federation/jwks.json
-federation_api: {issuer}/federation/v1
-supported_protocol_versions:
-  - registry-notary-federation/v0.1
-signing:
-  signing_key: federation-key
-pairwise_subject_hash:
-  secret_env: TEST_FEDERATION_PAIRWISE_SECRET
-response_shaping:
-  minimum_denial_latency_ms: 1
-peers:
-  - node_id: {peer_node_id}
-    issuer: {peer_issuer}
-    jwks_uri: "{peer_jwks_uri}"
-    allow_insecure_localhost: true
-    allowed_protocol_versions:
-      - registry-notary-federation/v0.1
-    allowed_purposes:
-      - https://purpose.example.test/eligibility
-    allowed_profiles:
-      - farmer_under_4ha
-    evaluation_scopes:
-      - farmer_registry:evidence_verification
-evaluation_profiles:
-  - id: farmer_under_4ha
-    ruleset: farmer-under-4ha-v1
-    claim_id: farmer-under-4ha
-    subject_id_type: national_id
-"#
-    ))
-    .expect("federation config deserializes");
-    config
-}
-
-pub(super) fn federation_request_jwt(jti: &str, purpose: &str) -> String {
-    federation_request_jwt_with_claims(jti, purpose, json!(["farmer-under-4ha"]))
-}
-
-pub(super) fn federation_request_jwt_with_claims(
-    jti: &str,
-    purpose: &str,
-    claims: Value,
-) -> String {
-    let mut payload = federation_request_payload(jti);
-    payload["purpose"] = json!(purpose);
-    payload["request"]["claims"] = claims;
-    federation_request_jwt_from_payload(payload)
-}
-
-pub(super) fn federation_request_jwt_with_audience(jti: &str, audience: &str) -> String {
-    let mut payload = federation_request_payload(jti);
-    payload["aud"] = json!(audience);
-    federation_request_jwt_from_payload(payload)
-}
-
-pub(super) fn federation_request_jwt_with_kid(jti: &str, kid: &str) -> String {
-    sign_ed25519_compact_jwt(
-        fixtures::ED25519_PRIVATE_JWK,
-        FEDERATION_REQUEST_JWT_TYPE,
-        kid,
-        federation_request_payload(jti),
-    )
-}
-
-pub(super) fn federation_request_jwt_with_times(jti: &str, iat: i64, nbf: i64, exp: i64) -> String {
-    let mut payload = federation_request_payload(jti);
-    payload["iat"] = json!(iat);
-    payload["nbf"] = json!(nbf);
-    payload["exp"] = json!(exp);
-    federation_request_jwt_from_payload(payload)
-}
-
-pub(super) fn federation_request_jwt_with_subject(jti: &str, subject: &str) -> String {
-    let mut payload = federation_request_payload(jti);
-    payload["sub"] = json!(subject);
-    federation_request_jwt_from_payload(payload)
-}
-
-pub(super) fn federation_request_payload(jti: &str) -> Value {
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    json!({
-        "iss": "https://agency-b.example.gov",
-        "sub": "did:web:agency-b.example.gov",
-        "aud": "did:web:agency-a.example.gov",
-        "iat": now,
-        "nbf": now,
-        "exp": now + 300,
-        "jti": jti,
-        "protocol": FEDERATION_PROTOCOL,
-        "action": "evaluate",
-        "profile": "farmer_under_4ha",
-        "purpose": "https://purpose.example.test/eligibility",
-        "request": {
-            "subject": {
-                "id": "person-1",
-                "id_type": "national_id"
-            },
-            "claims": ["farmer-under-4ha"]
-        }
-    })
-}
-
-pub(super) fn federation_request_jwt_from_payload(payload: Value) -> String {
-    sign_ed25519_compact_jwt(
-        fixtures::ED25519_PRIVATE_JWK,
-        FEDERATION_REQUEST_JWT_TYPE,
-        "registry-platform-testing-ed25519-1",
-        payload,
-    )
-}
-
-pub(super) fn federation_jwt_with_header(header: Value, payload: Value) -> String {
-    format!(
-        "{}.{}.{}",
-        URL_SAFE_NO_PAD.encode(serde_json::to_vec(&header).expect("header encodes")),
-        URL_SAFE_NO_PAD.encode(serde_json::to_vec(&payload).expect("payload encodes")),
-        URL_SAFE_NO_PAD.encode(b"invalid-signature")
-    )
-}
-
-pub(super) fn tamper_jwt_signature(jwt: &str) -> String {
-    let mut parts = jwt.split('.').collect::<Vec<_>>();
-    assert_eq!(parts.len(), 3, "compact jwt has three parts");
-    parts[2] = "AA";
-    parts.join(".")
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn verified_federation_response_claims(jwt: &str) -> Value {
-    verified_federation_response_claims_with_key(jwt, "agency-a-fed-1", TEST_ISSUER_JWK)
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn verified_federation_response_claims_with_key(
-    jwt: &str,
-    expected_kid: &str,
-    private_jwk: &str,
-) -> Value {
-    let parts = jwt.split('.').collect::<Vec<_>>();
-    assert_eq!(parts.len(), 3, "compact JWT response has three segments");
-    let header: Value = serde_json::from_slice(
-        &URL_SAFE_NO_PAD
-            .decode(parts[0])
-            .expect("response header is base64url"),
-    )
-    .expect("response header is JSON");
-    assert_eq!(header["alg"], json!("EdDSA"));
-    assert_eq!(header["typ"], json!(FEDERATION_RESPONSE_JWT_TYP));
-    assert_eq!(header["kid"], json!(expected_kid));
-    let signing_input = format!("{}.{}", parts[0], parts[1]);
-    let signature = URL_SAFE_NO_PAD
-        .decode(parts[2])
-        .expect("response signature is base64url");
-    let public = PrivateJwk::parse(private_jwk)
-        .expect("private JWK parses")
-        .public();
-    verify(signing_input.as_bytes(), &signature, &public).expect("response signature verifies");
-    let payload = URL_SAFE_NO_PAD
-        .decode(parts[1])
-        .expect("response payload is base64url");
-    serde_json::from_slice(&payload).expect("response payload is JSON")
-}
-
-pub(super) fn audit_records(path: &std::path::Path) -> Vec<Value> {
-    std::fs::read_to_string(path)
-        .expect("audit was written")
-        .lines()
-        .map(|line| serde_json::from_str::<Value>(line).expect("audit line is JSON"))
-        .map(|envelope| envelope["record"].clone())
-        .collect()
-}
-
-pub(super) fn subject_access_oidc_config(
-    base_url: &str,
-    audit_path: &str,
-    issuer: &str,
-    jwks_uri: &str,
-) -> StandaloneRegistryNotaryConfig {
-    set_audit_secret();
-    let raw = format!(
-        r#"
-deployment:
-  profile: local
-state:
-  storage: in_memory
-
-server:
-  bind: 127.0.0.1:0
-  request_timeout: 30s
-auth:
-  oidc:
-    issuer: "{issuer}"
-    jwks_url: "{jwks_uri}"
-    audiences:
-      - registry-notary-citizen
-    allowed_clients:
-      - citizen-portal
-    allowed_algorithms:
-      - EdDSA
-    allowed_token_types:
-      - JWT
-    scope_claim: scope
-    scope_separator: " "
-    principal_claim: sub
-    leeway: 60s
-    allow_insecure_localhost: true
-    scope_map:
-      subject_access:
-        - subject_access
-audit:
-  sink: file
-  path: "{audit_path}"
-  hash_secret_env: REGISTRY_NOTARY_AUDIT_HASH_SECRET
-evidence:
-  enabled: true
-  service_id: evidence.test
-  api_base_url: https://evidence.example.test
-  relay:
-    base_url: "{base_url}"
-    workload_client_id: registry-notary
-    token_file: "{audit_path}.relay-token"
-    allow_insecure_localhost: true
-  signing_keys:
-    issuer-key:
-      provider: local_jwk_env
-      private_jwk_env: TEST_CREDENTIAL_ISSUER_JWK
-      alg: EdDSA
-      kid: did:web:issuer.example#key-1
-      status: active
-  credential_profiles:
-    civil_status_sd_jwt:
-      format: application/dc+sd-jwt
-      issuer: did:web:issuer.example
-      signing_key: issuer-key
-      vct: http://127.0.0.1:4325/credentials/civil-status
-      validity_seconds: 600
-      holder_binding:
-        mode: did
-        proof_of_possession: required
-        allowed_did_methods:
-          - did:jwk
-      allowed_claims:
-        - person-is-alive
-      disclosure:
-        allowed:
-          - value
-  claims:
-    - id: person-is-alive
-      title: Person is alive
-      version: 2026-05
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          person_status:
-            profile:
-              id: {TEST_RELAY_PROFILE_ID}
-              contract_hash: {contract_hash}
-            inputs:
-              subject_id: request.target.identifiers.national_id
-            outputs:
-              active: {{ type: boolean, nullable: true }}
-              birth_date: {{ type: date, nullable: true }}
-              given_name: {{ type: string, nullable: true, max_bytes: 64 }}
-      purpose: citizen_subject_access
-      required_scopes:
-        - subject_access
-      value:
-        type: boolean
-      rule:
-        type: consultation_matched
-        consultation: person_status
-      disclosure:
-        default: value
-        allowed: [value, redacted]
-      formats:
-        - application/vnd.registry-notary.claim-result+json
-      credential_profiles:
-        - civil_status_sd_jwt
-subject_access:
-  enabled: true
-  subject_binding:
-    token_claim: national_id
-    id_type: national_id
-  citizen_clients:
-    allowed_client_ids:
-      - citizen-portal
-    allowed_audiences:
-      - registry-notary-citizen
-  token_policy:
-    max_auth_age_seconds: 900
-    max_access_token_lifetime_seconds: 900
-    max_evaluation_age_seconds: 600
-    max_credential_validity_seconds: 600
-    max_clock_leeway_seconds: 60
-  allowed_operations:
-    evaluate: true
-    render: true
-    issue_credential: false
-    batch_evaluate: false
-  allowed_purposes:
-    - citizen_subject_access
-  allowed_claims:
-    - person-is-alive
-  allowed_formats:
-    - application/vnd.registry-notary.claim-result+json
-  allowed_disclosures:
-    - value
-    - redacted
-  required_scopes:
-    - subject_access
-  credential_profiles:
-    - civil_status_sd_jwt
-  allowed_wallet_origins:
-    - https://wallet.example.gov
-  rate_limits:
-    invalid_token_per_client_address_per_minute: 20
-    per_principal_per_minute: 10
-    subject_mismatch_per_principal_per_hour: 5
-    per_holder_per_hour: 10
-    credential_issuance_per_principal_per_hour: 5
-"#,
-        contract_hash = test_relay_contract_hash(),
-    );
-    serde_norway::from_str(&raw).expect("subject-access config deserializes")
-}
-
-pub(super) fn subject_access_oid4vci_config(
-    base_url: &str,
-    audit_path: &str,
-    issuer: &str,
-    jwks_uri: &str,
-) -> StandaloneRegistryNotaryConfig {
-    let mut config = subject_access_oidc_config(base_url, audit_path, issuer, jwks_uri);
-    std::env::set_var("TEST_ACCESS_TOKEN_JWK", TEST_ACCESS_TOKEN_JWK);
-    std::env::set_var("TEST_ESIGNET_RP_JWK", TEST_ESIGNET_RP_JWK);
-    config
-        .subject_access
-        .rate_limits
-        .tx_code_attempts_per_code_per_minute = 3;
-    config
-        .subject_access
-        .citizen_clients
-        .allowed_client_ids
-        .push("registry-lab-live-client".to_string());
-    if let Some(oidc) = config.auth.oidc.as_mut() {
-        oidc.allowed_clients
-            .push("registry-lab-live-client".to_string());
-    }
-    config.evidence.signing_keys.insert(
-        "access-token-key".to_string(),
-        local_jwk_signing_key(
-            "TEST_ACCESS_TOKEN_JWK",
-            "did:web:issuer.example#access-token-key",
-        ),
-    );
-    config.evidence.signing_keys.insert(
-        "esignet-rp-key".to_string(),
-        local_jwk_signing_key("TEST_ESIGNET_RP_JWK", "did:web:rp.example#esignet-rp-key"),
-    );
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("civil status credential profile exists")
-        .vct = "http://127.0.0.1:4325/credentials/civil-status".to_string();
-    config.oid4vci = serde_norway::from_str::<Oid4vciConfig>(&format!(
-        r#"
-enabled: true
-credential_issuer: http://127.0.0.1:4325
-authorization_servers:
-  - http://127.0.0.1:4325
-accepted_token_audiences:
-  - registry-notary-citizen
-credential_endpoint: http://127.0.0.1:4325/oid4vci/credential
-nonce:
-  enabled: true
-  ttl_seconds: 300
-authorization:
-  require_pkce_method: S256
-proof:
-  max_age_seconds: 300
-  max_clock_skew_seconds: 30
-credential_configurations:
-  person_is_alive_sd_jwt:
-    claim_id: person-is-alive
-    credential_profile: civil_status_sd_jwt
-    format: dc+sd-jwt
-    scope: person-is-alive
-    vct: http://127.0.0.1:4325/credentials/civil-status
-    display_name: Person is alive
-pre_authorized_code:
-  enabled: true
-  tx_code:
-    required: true
-    input_mode: numeric
-    length: 6
-  esignet:
-    client_id: registry-lab-live-client
-    client_signing_key_id: esignet-rp-key
-    redirect_uri: http://127.0.0.1:4325/oid4vci/offer/callback
-    authorize_url: {issuer}/authorize
-    token_url: {issuer}/token
-    issuer: {issuer}
-    jwks_uri: {jwks_uri}
-    scopes:
-      - openid
-    login_state_ttl_seconds: 300
-    allow_insecure_localhost: true
-  pre_authorized_code_ttl_seconds: 300
-"#
-    ))
-    .expect("oid4vci config deserializes");
-    config.auth.access_token_signing = serde_norway::from_str(
-        r#"
-enabled: true
-issuer: http://127.0.0.1:4325
-audiences:
-  - registry-notary-citizen
-allowed_algorithms:
-  - EdDSA
-token_typ: registry-notary-access+jwt
-signing_key_id: access-token-key
-access_token_ttl_seconds: 300
-"#,
-    )
-    .expect("access-token signing config parses");
-    config
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn add_subject_access_projection_claim(
-    config: &mut StandaloneRegistryNotaryConfig,
-    claim_id: &str,
-    title: &str,
-    output_name: &str,
-    value_type: &str,
-) {
-    let mut claim = config
-        .evidence
-        .claims
-        .iter()
-        .find(|claim| claim.id == "person-is-alive")
-        .expect("base subject-access claim exists")
-        .clone();
-    claim.id = claim_id.to_string();
-    claim.title = title.to_string();
-    claim.value.value_type = value_type.to_string();
-    claim.value.nullable = true;
-    claim.rule = RuleConfig::ConsultationOutput {
-        consultation: "person_status".to_string(),
-        output: output_name.to_string(),
-    };
-    claim.formats = vec!["application/vnd.registry-notary.claim-result+json".to_string()];
-    claim.credential_profiles = vec!["civil_status_sd_jwt".to_string()];
-    config.evidence.claims.push(claim);
-    config
-        .subject_access
-        .allowed_claims
-        .push(claim_id.to_string());
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("civil status profile exists")
-        .allowed_claims
-        .push(claim_id.to_string());
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn enable_oid4vci_field_projection(config: &mut StandaloneRegistryNotaryConfig) {
-    add_subject_access_projection_claim(
-        config,
-        "person-given-name",
-        "Given name",
-        "given_name",
-        "string",
-    );
-    add_subject_access_projection_claim(
-        config,
-        "person-birth-date",
-        "Birth date",
-        "birth_date",
-        "date",
-    );
-    config.subject_access.allowed_operations.issue_credential = true;
-    let credential = config
-        .oid4vci
-        .credential_configurations
-        .get_mut("person_is_alive_sd_jwt")
-        .expect("OID4VCI credential configuration exists");
-    credential.claim_id = None;
-    credential.display_name = "Civil identity fields".to_string();
-    credential.claims = vec![
-        Oid4vciCredentialClaimConfig {
-            id: "person-given-name".to_string(),
-            output_path: vec!["given_name".to_string()],
-            display_name: "Given name".to_string(),
-            sd: "always".to_string(),
-        },
-        Oid4vciCredentialClaimConfig {
-            id: "person-birth-date".to_string(),
-            output_path: vec!["birth_date".to_string()],
-            display_name: "Birth date".to_string(),
-            sd: "always".to_string(),
-        },
-    ];
-}
-
-pub(super) fn audit_envelopes(path: &std::path::Path) -> Vec<AuditEnvelope> {
-    std::fs::read_to_string(path)
-        .expect("audit jsonl is readable")
-        .lines()
-        .map(|line| serde_json::from_str(line).expect("audit line is an envelope"))
-        .collect()
-}
-
-pub(super) fn audit_record_contains_text(value: &Value, needle: &str) -> bool {
-    match value {
-        Value::String(value) => value.contains(needle),
-        Value::Number(value) => value.to_string().contains(needle),
-        Value::Array(values) => values
-            .iter()
-            .any(|value| audit_record_contains_text(value, needle)),
-        Value::Object(values) => values
-            .iter()
-            .any(|(key, value)| key != "occurred_at" && audit_record_contains_text(value, needle)),
-        Value::Bool(_) | Value::Null => false,
-    }
-}
-
-pub(super) fn audit_records_from_envelopes(path: &std::path::Path) -> Vec<Value> {
-    audit_envelopes(path)
-        .into_iter()
-        .map(|envelope| envelope.record)
-        .collect()
-}
-
-pub(super) fn audit_record_with<'a>(
-    records: &'a [Value],
-    path: &str,
-    decision: &str,
-    status: StatusCode,
-    error_code: &str,
-) -> &'a Value {
-    records
-        .iter()
-        .find(|record| {
-            record["path"] == json!(path)
-                && record["decision"] == json!(decision)
-                && record["status"] == json!(status.as_u16())
-                && record["error_code"] == json!(error_code)
-        })
-        .unwrap_or_else(|| {
-            panic!(
-                "audit record missing path={path} decision={decision} status={} error_code={error_code}",
-                status.as_u16()
-            )
-        })
-}
-
-pub(super) fn assert_problem_identity(body: &Value, status: StatusCode, code: &str) {
-    assert_eq!(body["status"], json!(status.as_u16()));
-    assert_eq!(body["code"], json!(code));
-    assert_eq!(
-        body["type"],
-        json!(format!(
-            "https://id.registrystack.org/problems/registry-notary/{}",
-            code.replace('.', "/")
-        ))
-    );
-}
-
-pub(super) fn assert_audit_records_do_not_contain(records: &[Value], forbidden: &[&str]) {
-    for needle in forbidden {
-        assert!(
-            !records
-                .iter()
-                .any(|record| audit_record_contains_text(record, needle)),
-            "audit records leaked forbidden text: {needle}"
-        );
-    }
-}
-
-pub(super) fn assert_hmac_audit_field(record: &Value, field: &str) {
-    assert!(
-        record[field]
-            .as_str()
-            .unwrap_or_else(|| panic!("{field} is a string"))
-            .starts_with("hmac-sha256:"),
-        "{field} is a keyed HMAC handle"
-    );
-}
-
-pub(super) fn assert_verified_federation_audit_context(
-    record: &Value,
-    profile: &str,
-    purpose: &str,
-    includes_subject_hash: bool,
-) {
-    assert_eq!(
-        record["scopes_used"],
-        json!(["farmer_registry:evidence_verification"])
-    );
-    assert_hmac_audit_field(record, "federation_peer_id_hash");
-    assert_eq!(
-        record["federation_issuer"],
-        json!("https://agency-b.example.gov")
-    );
-    assert_eq!(record["federation_profile"], json!(profile));
-    assert_eq!(record["federation_purpose"], json!(purpose));
-    assert_hmac_audit_field(record, "federation_request_jti_hash");
-    if includes_subject_hash {
-        assert_hmac_audit_field(record, "federation_subject_ref_hash");
-    } else {
-        assert!(record.get("federation_subject_ref_hash").is_none());
-    }
-}
-
-pub(super) fn assert_federation_request_context_is_absent(record: &Value) {
-    assert_eq!(record["scopes_used"], json!([]));
-    for field in [
-        "federation_peer_id_hash",
-        "federation_issuer",
-        "federation_profile",
-        "federation_purpose",
-        "federation_request_jti_hash",
-        "federation_subject_ref_hash",
-    ] {
-        assert!(
-            record.get(field).is_none(),
-            "pre-verification denial unexpectedly recorded {field}"
-        );
-    }
-}
-
-#[tokio::test]
-pub(super) async fn healthz_ready_opaque_counters_in_503_body() {
-    let server = TestServer::builder()
-        .mock_transport()
-        .build(registry_notary_server::router::<()>());
-
-    let healthz = server.get("/healthz").await;
-    healthz.assert_status_ok();
-    let healthz_body: Value = healthz.json();
-    assert_eq!(healthz_body["status"], json!("ok"));
-    assert_eq!(healthz_body["checks"]["total"], json!(1));
-    assert_eq!(healthz_body["checks"]["failed"], json!(0));
-
-    let ready = server.get("/ready").await;
-    ready.assert_status(StatusCode::SERVICE_UNAVAILABLE);
-    let ready_content_type = ready
-        .headers()
-        .get("content-type")
-        .and_then(|value| value.to_str().ok())
-        .expect("ready content-type is present");
-    assert!(ready_content_type.starts_with("application/problem+json"));
-    let ready_body: Value = ready.json();
-    assert_eq!(ready_body["code"], json!("readiness.not_ready"));
-    assert_eq!(ready_body["readiness_status"], json!("not_ready"));
-    assert_eq!(ready_body["checks"]["total"], json!(1));
-    assert_eq!(ready_body["checks"]["ok"], json!(0));
-    assert_eq!(ready_body["checks"]["failed"], json!(1));
-    let ready_text = ready.text();
-    assert!(!ready_text.contains("farmer_registry"));
-    assert!(!ready_text.contains("source_connections"));
-    assert!(!ready_text.contains("evaluations"));
-}
-
-#[tokio::test]
-pub(super) async fn federation_route_is_not_mounted_until_enabled() {
-    set_federation_env();
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let response = server
-        .post("/federation/v1/evaluations")
-        .bytes(Bytes::from_static(b"not-mounted"))
-        .await;
-
-    response.assert_status(StatusCode::NOT_FOUND);
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn federation_evaluation_returns_signed_response_and_rejects_replay() {
-    set_federation_env();
-    let peer_jwks = MockHttpUpstream::start().await;
-    let (peer_private, _) = fixtures::ed25519_pair();
-    peer_jwks
-        .expect("GET", "/jwks")
-        .respond_json(200, jwks_from_private_jwk(&peer_private))
-        .await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = federation_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &format!("{}/jwks", peer_jwks.url()),
-    );
-    add_admin_api_key(&mut config);
-    add_metrics_read_api_key(&mut config);
-    enable_shared_admin_listener(&mut config);
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let token = federation_request_jwt(
-        "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6",
-        "https://purpose.example.test/eligibility",
-    );
-
-    let response = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(token.clone()))
-        .await;
-    response.assert_status_ok();
-    let claims = verified_federation_response_claims(&response.text());
-    assert_eq!(claims["iss"], json!("https://agency-a.example.gov"));
-    assert_eq!(claims["sub"], json!("did:web:agency-a.example.gov"));
-    assert_eq!(claims["aud"], json!("did:web:agency-b.example.gov"));
-    assert_eq!(
-        claims["result"]["subject_ref"]["id_type"],
-        json!("national_id")
-    );
-    assert!(claims["result"]["subject_ref"]["hash"]
-        .as_str()
-        .expect("subject hash is string")
-        .starts_with("hmac-sha256:"));
-    assert_eq!(
-        claims["result"]["claims"]["farmer-under-4ha"]["disclosure"],
-        json!("redacted")
-    );
-    assert!(claims["result"]["claims"]["farmer-under-4ha"]["satisfied"].is_null());
-    assert!(claims["result"]["evaluation_id"]
-        .as_str()
-        .expect("evaluation id is string")
-        .starts_with("eval_"));
-    assert!(claims["result"]["claim_result_issued_at"].is_string());
-    assert!(claims["result"].get("source_observed_at").is_none());
-
-    let replay = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(token))
-        .await;
-    replay.assert_status(StatusCode::CONFLICT);
-
-    let audit = std::fs::read_to_string(&audit_path).expect("audit was written");
-    let records = audit_records(&audit_path);
-    let allowed = records
-        .iter()
-        .find(|record| record["decision"] == json!("federated_evaluate"))
-        .expect("allowed federation audit record exists");
-    assert_eq!(
-        allowed["federation_issuer"],
-        json!("https://agency-b.example.gov")
-    );
-    assert_eq!(allowed["federation_profile"], json!("farmer_under_4ha"));
-    assert_eq!(
-        allowed["scopes_used"],
-        json!(["farmer_registry:evidence_verification"])
-    );
-    assert_eq!(
-        allowed["federation_purpose"],
-        json!("https://purpose.example.test/eligibility")
-    );
-    assert!(allowed.get("federation_request_jti").is_none());
-    assert!(allowed["federation_request_jti_hash"]
-        .as_str()
-        .expect("request jti hash is string")
-        .starts_with("hmac-sha256:"));
-    assert!(allowed["federation_subject_ref_hash"]
-        .as_str()
-        .expect("subject ref hash is string")
-        .starts_with("hmac-sha256:"));
-    assert!(allowed["federation_peer_id_hash"]
-        .as_str()
-        .expect("peer id hash is string")
-        .starts_with("hmac-sha256:"));
-    assert!(records
-        .iter()
-        .any(|record| record["decision"] == json!("federated_evaluate_denied")));
-    let replay_denied = audit_record_with(
-        &records,
-        "/federation/v1/evaluations",
-        "federated_evaluate_denied",
-        StatusCode::CONFLICT,
-        "federation.replay",
-    );
-    assert_verified_federation_audit_context(
-        replay_denied,
-        "farmer_under_4ha",
-        "https://purpose.example.test/eligibility",
-        true,
-    );
-    assert!(!audit.contains("person-1"));
-    assert!(!audit.contains("01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6"));
-
-    let metrics = server
-        .get("/metrics")
-        .add_header("x-api-key", "metrics-token")
-        .await;
-    metrics.assert_status_ok();
-    let metrics_body = metrics.text();
-    assert!(metrics_body.contains(
-        "registry_notary_replay_events_total{flow=\"federation_request\",outcome=\"accepted\"} 1"
-    ));
-    assert!(metrics_body.contains(
-        "registry_notary_replay_events_total{flow=\"federation_request\",outcome=\"replayed\"} 1"
-    ));
-    assert!(!metrics_body.contains("01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6"));
-    assert!(!metrics_body.contains("person-1"));
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn federation_stale_claim_result_returns_signed_evaluation_error() {
-    set_federation_env();
-    let peer_jwks = MockHttpUpstream::start().await;
-    let (peer_private, _) = fixtures::ed25519_pair();
-    peer_jwks
-        .expect("GET", "/jwks")
-        .respond_json(200, jwks_from_private_jwk(&peer_private))
-        .await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = federation_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &format!("{}/jwks", peer_jwks.url()),
-    );
-    config.federation.evaluation_profiles[0].max_claim_result_age_seconds = Some(0);
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let response = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(federation_request_jwt(
-            "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q6R0",
-            "https://purpose.example.test/eligibility",
-        )))
-        .await;
-
-    response.assert_status_ok();
-    let claims = verified_federation_response_claims(&response.text());
-    assert_eq!(
-        claims["error"]["type"],
-        json!("urn:registry-notary:problem:federation:stale-claim-result")
-    );
-    assert_eq!(claims["error"]["title"], json!("Claim result is stale"));
-    assert_eq!(
-        claims["error"]["code"],
-        json!("federation.stale_claim_result")
-    );
-    let records = audit_records(&audit_path);
-    assert!(records.iter().any(|record| {
-        record["decision"] == json!("federated_evaluate_error")
-            && record["error_code"] == json!("federation.stale_claim_result")
-    }));
-    assert_audit_records_do_not_contain(&records, &["person-1"]);
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn federation_auth_exempt_route_still_requires_valid_jws() {
-    set_federation_env();
-    let peer_jwks = MockHttpUpstream::start().await;
-    let (peer_private, _) = fixtures::ed25519_pair();
-    peer_jwks
-        .expect("GET", "/jwks")
-        .respond_json(200, jwks_from_private_jwk(&peer_private))
-        .await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let config = federation_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &format!("{}/jwks", peer_jwks.url()),
-    );
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let response = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from_static(b"not.a.valid-jws"))
-        .await;
-
-    response.assert_status(StatusCode::UNAUTHORIZED);
-    let body: Value = response.json();
-    assert_eq!(body["code"], json!("federation.invalid_token"));
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn federation_two_standalone_notaries_smoke() {
-    set_federation_env();
-    let agency_b_jwks = MockHttpUpstream::start().await;
-    let (agency_b_private, _) = fixtures::ed25519_pair();
-    agency_b_jwks
-        .expect("GET", "/jwks")
-        .respond_json(200, jwks_from_private_jwk(&agency_b_private))
-        .await;
-    let agency_a_jwks = MockHttpUpstream::start().await;
-    let (agency_a_private, _) = fixtures::ed25519_pair();
-    agency_a_jwks
-        .expect("GET", "/jwks")
-        .respond_json(200, jwks_from_private_jwk(&agency_a_private))
-        .await;
-    let tmp = TempDir::new().expect("tempdir");
-    let agency_a_audit = tmp.path().join("agency-a-audit.jsonl");
-    let agency_b_audit = tmp.path().join("agency-b-audit.jsonl");
-    let agency_a = TestServer::builder().mock_transport().build(
-        standalone_router(federation_config_for(
-            "http://127.0.0.1:1",
-            agency_a_audit.to_str().expect("audit path is UTF-8"),
-            "did:web:agency-a.example.gov",
-            "https://agency-a.example.gov",
-            "did:web:agency-b.example.gov",
-            "https://agency-b.example.gov",
-            &format!("{}/jwks", agency_b_jwks.url()),
-        ))
-        .await
-        .expect("agency A standalone router builds"),
-    );
-    let agency_b = TestServer::builder().mock_transport().build(
-        standalone_router(federation_config_for(
-            "http://127.0.0.1:1",
-            agency_b_audit.to_str().expect("audit path is UTF-8"),
-            "did:web:agency-b.example.gov",
-            "https://agency-b.example.gov",
-            "did:web:agency-a.example.gov",
-            "https://agency-a.example.gov",
-            &format!("{}/jwks", agency_a_jwks.url()),
-        ))
-        .await
-        .expect("agency B standalone router builds"),
-    );
-    agency_b.get("/healthz").await.assert_status_ok();
-
-    let token = federation_request_jwt(
-        "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q6S0",
-        "https://purpose.example.test/eligibility",
-    );
-    let response = agency_a
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(token))
-        .await;
-
-    response.assert_status_ok();
-    let claims = verified_federation_response_claims(&response.text());
-    assert_eq!(claims["iss"], json!("https://agency-a.example.gov"));
-    assert_eq!(claims["aud"], json!("did:web:agency-b.example.gov"));
-    assert_eq!(
-        claims["result"]["claims"]["farmer-under-4ha"]["disclosure"],
-        json!("redacted")
-    );
-    assert!(claims["result"]["claims"]["farmer-under-4ha"]["satisfied"].is_null());
-    let records = audit_records(&agency_a_audit);
-    assert!(records
-        .iter()
-        .any(|record| record["decision"] == json!("federated_evaluate")));
-}
-
-#[tokio::test]
-pub(super) async fn federation_denial_happens_before_claim_evaluation() {
-    set_federation_env();
-    let peer_jwks = MockHttpUpstream::start().await;
-    let (peer_private, _) = fixtures::ed25519_pair();
-    peer_jwks
-        .expect("GET", "/jwks")
-        .respond_json(200, jwks_from_private_jwk(&peer_private))
-        .await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(federation_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &format!("{}/jwks", peer_jwks.url()),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let token = federation_request_jwt(
-        "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q7",
-        "https://purpose.example.test/not-allowed",
-    );
-
-    let response = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(token))
-        .await;
-
-    response.assert_status(StatusCode::FORBIDDEN);
-    let records = audit_records(&audit_path);
-    let denied = audit_record_with(
-        &records,
-        "/federation/v1/evaluations",
-        "federated_evaluate_denied",
-        StatusCode::FORBIDDEN,
-        "federation.forbidden",
-    );
-    assert_verified_federation_audit_context(
-        denied,
-        "farmer_under_4ha",
-        "https://purpose.example.test/not-allowed",
-        true,
-    );
-    assert_audit_records_do_not_contain(&records, &["person-1", "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q7"]);
-
-    let unsupported_media_type = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/json")
-        .bytes(Bytes::from("{}"))
-        .await;
-    unsupported_media_type.assert_status(StatusCode::UNSUPPORTED_MEDIA_TYPE);
-
-    let oversized_body = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(vec![b'a'; 16 * 1024 + 1]))
-        .await;
-    oversized_body.assert_status(StatusCode::PAYLOAD_TOO_LARGE);
-
-    let bad_audience = federation_request_jwt_with_audience(
-        "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q7Q1",
-        "did:web:other-agency.example.gov",
-    );
-    let bad_audience_response = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(bad_audience))
-        .await;
-    bad_audience_response.assert_status(StatusCode::UNAUTHORIZED);
-
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let expired = federation_request_jwt_with_times(
-        "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q7Q2",
-        now - 600,
-        now - 600,
-        now - 300,
-    );
-    let expired_response = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(expired))
-        .await;
-    expired_response.assert_status(StatusCode::UNAUTHORIZED);
-
-    let future_nbf =
-        federation_request_jwt_with_times("01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q7Q3", now, now + 600, now + 900);
-    let future_nbf_response = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(future_nbf))
-        .await;
-    future_nbf_response.assert_status(StatusCode::UNAUTHORIZED);
-
-    let long_lived =
-        federation_request_jwt_with_times("01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q7Q4", now, now, now + 301);
-    let long_lived_response = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(long_lived))
-        .await;
-    long_lived_response.assert_status(StatusCode::UNAUTHORIZED);
-
-    let bad_subject = federation_request_jwt_with_subject(
-        "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q7Q5",
-        "did:web:other-peer.example.gov",
-    );
-    let bad_subject_response = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(bad_subject))
-        .await;
-    bad_subject_response.assert_status(StatusCode::UNAUTHORIZED);
-
-    let unknown_kid = federation_request_jwt_with_kid("01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q7Q6", "unknown-key");
-    let unknown_kid_response = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(unknown_kid))
-        .await;
-    unknown_kid_response.assert_status(StatusCode::UNAUTHORIZED);
-    let records = audit_records(&audit_path);
-    let unknown_key_audit = records.last().expect("unknown-key audit record exists");
-    assert_eq!(
-        unknown_key_audit["error_code"],
-        json!("federation.invalid_token")
-    );
-    assert_federation_request_context_is_absent(unknown_key_audit);
-    assert!(!audit_record_contains_text(
-        unknown_key_audit,
-        "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q7Q6"
-    ));
-    assert!(!audit_record_contains_text(unknown_key_audit, "person-1"));
-
-    let audit_count_before_bad_signature = records.len();
-    let bad_signature = tamper_jwt_signature(&federation_request_jwt(
-        "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q7Q7",
-        "https://purpose.example.test/eligibility",
-    ));
-    let bad_signature_response = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(bad_signature))
-        .await;
-    bad_signature_response.assert_status(StatusCode::UNAUTHORIZED);
-    let records = audit_records(&audit_path);
-    assert_eq!(records.len(), audit_count_before_bad_signature + 1);
-    let bad_signature_audit = &records[audit_count_before_bad_signature];
-    assert_eq!(
-        bad_signature_audit["error_code"],
-        json!("federation.invalid_token")
-    );
-    assert_federation_request_context_is_absent(bad_signature_audit);
-    assert!(!audit_record_contains_text(
-        bad_signature_audit,
-        "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q7Q7"
-    ));
-    assert!(!audit_record_contains_text(bad_signature_audit, "person-1"));
-
-    let bad_alg = federation_jwt_with_header(
-        json!({
-            "alg": "HS256",
-            "typ": FEDERATION_REQUEST_JWT_TYPE,
-            "kid": "registry-platform-testing-ed25519-1"
-        }),
-        federation_request_payload("01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q7Q8"),
-    );
-    let bad_alg_response = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(bad_alg))
-        .await;
-    bad_alg_response.assert_status(StatusCode::UNAUTHORIZED);
-
-    let bad_typ = federation_jwt_with_header(
-        json!({
-            "alg": "EdDSA",
-            "typ": "JWT",
-            "kid": "registry-platform-testing-ed25519-1"
-        }),
-        federation_request_payload("01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q7Q9"),
-    );
-    let bad_typ_response = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(bad_typ))
-        .await;
-    bad_typ_response.assert_status(StatusCode::UNAUTHORIZED);
-}
-
-#[tokio::test]
-pub(super) async fn federation_emergency_kid_denylist_blocks_before_claim_evaluation() {
-    assert_federation_emergency_denylist_blocks_before_claim_evaluation(true).await;
-}
-
-#[tokio::test]
-pub(super) async fn federation_emergency_node_id_denylist_blocks_before_claim_evaluation() {
-    assert_federation_emergency_denylist_blocks_before_claim_evaluation(false).await;
-}
-
-pub(super) async fn assert_federation_emergency_denylist_blocks_before_claim_evaluation(
-    deny_kid: bool,
-) {
-    set_federation_env();
-    let peer_jwks = MockHttpUpstream::start().await;
-    let (peer_private, _) = fixtures::ed25519_pair();
-    peer_jwks
-        .expect("GET", "/jwks")
-        .respond_json(200, jwks_from_private_jwk(&peer_private))
-        .await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = federation_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &format!("{}/jwks", peer_jwks.url()),
-    );
-    if deny_kid {
-        config
-            .federation
-            .emergency_denylist
-            .kids
-            .push("registry-platform-testing-ed25519-1".to_string());
-    } else {
-        config
-            .federation
-            .emergency_denylist
-            .node_ids
-            .push("did:web:agency-b.example.gov".to_string());
-    }
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let request_jti = if deny_kid {
-        "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q7R0"
-    } else {
-        "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q7R1"
-    };
-    let token = federation_request_jwt(request_jti, "https://purpose.example.test/eligibility");
-
-    let response = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(token))
-        .await;
-
-    response.assert_status(StatusCode::FORBIDDEN);
-    let records = audit_records(&audit_path);
-    let denied = audit_record_with(
-        &records,
-        "/federation/v1/evaluations",
-        "federated_evaluate_denied",
-        StatusCode::FORBIDDEN,
-        "federation.forbidden",
-    );
-    assert_federation_request_context_is_absent(denied);
-    assert_audit_records_do_not_contain(&records, &["person-1", request_jti]);
-}
-
-#[tokio::test]
-pub(super) async fn federation_request_claims_must_match_profile_before_claim_evaluation() {
-    set_federation_env();
-    let peer_jwks = MockHttpUpstream::start().await;
-    let (peer_private, _) = fixtures::ed25519_pair();
-    peer_jwks
-        .expect("GET", "/jwks")
-        .respond_json(200, jwks_from_private_jwk(&peer_private))
-        .await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(federation_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &format!("{}/jwks", peer_jwks.url()),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let token = federation_request_jwt_with_claims(
-        "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q9",
-        "https://purpose.example.test/eligibility",
-        json!(["farmed-land-size"]),
-    );
-
-    let response = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(token))
-        .await;
-
-    response.assert_status(StatusCode::FORBIDDEN);
-    let records = audit_records(&audit_path);
-    let denied = audit_record_with(
-        &records,
-        "/federation/v1/evaluations",
-        "federated_evaluate_denied",
-        StatusCode::FORBIDDEN,
-        "federation.forbidden",
-    );
-    assert_verified_federation_audit_context(
-        denied,
-        "farmer_under_4ha",
-        "https://purpose.example.test/eligibility",
-        true,
-    );
-    assert!(denied["claim_hash"].is_string());
-    assert_audit_records_do_not_contain(&records, &["person-1", "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q9"]);
-}
-
-#[tokio::test]
-pub(super) async fn federation_audit_write_failure_replaces_signed_success() {
-    set_federation_env();
-    let peer_jwks = MockHttpUpstream::start().await;
-    let (peer_private, _) = fixtures::ed25519_pair();
-    peer_jwks
-        .expect("GET", "/jwks")
-        .respond_json(200, jwks_from_private_jwk(&peer_private))
-        .await;
-    let tmp = TempDir::new().expect("tempdir");
-    // Make the audit target itself a directory: the single-writer sink still
-    // constructs (its `.lock` sentinel is a sibling in the real tmp dir), but
-    // every audit WRITE fails, which is exactly what this test exercises (#211).
-    let audit_path = tmp.path().join("audit.jsonl");
-    std::fs::create_dir(&audit_path).expect("audit target is a directory");
-    let app = standalone_router(federation_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &format!("{}/jwks", peer_jwks.url()),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let token = federation_request_jwt(
-        "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q7Q0",
-        "https://purpose.example.test/eligibility",
-    );
-
-    let response = server
-        .post("/federation/v1/evaluations")
-        .add_header("content-type", "application/jwt")
-        .bytes(Bytes::from(token))
-        .await;
-
-    response.assert_status(StatusCode::INTERNAL_SERVER_ERROR);
-    let body: Value = response.json();
-    assert_eq!(body["code"], json!("audit.write_failed"));
-}
diff --git a/crates/registry-notary-server/tests/standalone_http/http_contracts.rs b/crates/registry-notary-server/tests/standalone_http/http_contracts.rs
deleted file mode 100644
index 2fed2fddd..000000000
--- a/crates/registry-notary-server/tests/standalone_http/http_contracts.rs
+++ /dev/null
@@ -1,712 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::support::*;
-#[allow(unused_imports)]
-use super::{admin::*, audit::*, auth::*, credentials::*, federation::*, oid4vci::*, preauth::*};
-
-#[tokio::test]
-pub(super) async fn request_body_limit_returns_413_above_threshold() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::new(app);
-
-    let response = server
-        .post("/v1/evaluations")
-        .add_header("x-api-key", "api-token")
-        .add_header("content-type", "application/json")
-        .add_header(header::CONTENT_LENGTH, "1048577")
-        .await;
-
-    response.assert_status(StatusCode::PAYLOAD_TOO_LARGE);
-    let content_type = response
-        .headers()
-        .get("content-type")
-        .expect("content-type header")
-        .to_str()
-        .expect("content-type is valid");
-    assert!(content_type.starts_with("application/problem+json"));
-    let body: Value = response.json();
-    assert_eq!(body["status"], json!(413));
-    assert_eq!(
-        body["type"],
-        json!("https://id.registrystack.org/problems/registry-platform/request/body-too-large")
-    );
-    let body_text = serde_json::to_string(&body).expect("problem body serializes");
-    assert!(
-        !body_text.contains("api-token"),
-        "oversized-body problem response must not echo credential material"
-    );
-    assert!(
-        !body_text.contains("1048577"),
-        "oversized-body problem response must not echo the supplied content length"
-    );
-}
-
-#[tokio::test]
-pub(super) async fn request_uri_limit_returns_414_problem_details() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let long_path = format!("/{}", "a".repeat(8 * 1024 + 1));
-
-    let response = server
-        .get(&long_path)
-        .add_header("x-api-key", "api-token")
-        .await;
-
-    response.assert_status(StatusCode::URI_TOO_LONG);
-    let content_type = response
-        .headers()
-        .get("content-type")
-        .expect("content-type header")
-        .to_str()
-        .expect("content-type is valid");
-    assert!(content_type.starts_with("application/problem+json"));
-    let body: Value = response.json();
-    assert_eq!(body["status"], json!(414));
-    assert_eq!(
-        body["type"],
-        json!("https://id.registrystack.org/problems/registry-notary/request/uri-too-long")
-    );
-    assert_eq!(body["code"], json!("request.uri_too_long"));
-    let body_text = serde_json::to_string(&body).expect("problem body serializes");
-    assert!(
-        !body_text.contains(&long_path),
-        "overlong-URI problem response must not echo the submitted URI"
-    );
-}
-
-#[tokio::test]
-pub(super) async fn error_responses_match_rfc_9457_problem_details_shape() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let response = server
-        .get("/v1/claims")
-        .add_header("x-request-id", "req-auth-1")
-        .await;
-
-    response.assert_status(StatusCode::UNAUTHORIZED);
-    let content_type = response
-        .headers()
-        .get("content-type")
-        .expect("content-type header")
-        .to_str()
-        .expect("content-type is valid");
-    assert!(content_type.starts_with("application/problem+json"));
-    let body: Value = response.json();
-    assert_server_owned_request_id(&response, &body, "req-auth-1");
-    assert_eq!(body["status"], json!(401));
-    assert_eq!(body["title"], json!("Missing credential"));
-    assert_eq!(body["code"], json!("auth.missing_credential"));
-    assert!(body["type"].as_str().is_some_and(
-        |value| value.starts_with("https://id.registrystack.org/problems/registry-notary/")
-    ));
-    assert!(body["detail"].as_str().is_some());
-}
-
-#[tokio::test]
-pub(super) async fn evaluation_json_rejections_and_unsupported_idempotency_are_problem_details() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let old_shape = server
-        .post("/v1/evaluations")
-        .add_header("x-api-key", "api-token")
-        .add_header("x-request-id", "req-problem-1")
-        .add_header("content-type", "application/json")
-        .bytes(Bytes::from_static(
-            br#"{"subject":{"id":"person-1","id_type":"national_id"},"claims":["farmed-land-size"]}"#,
-        ))
-        .await;
-    let old_shape_body: Value = old_shape.json();
-    assert_server_owned_request_id(&old_shape, &old_shape_body, "req-problem-1");
-    assert_eq!(old_shape_body["code"], json!("request.invalid"));
-
-    let old_shape = server
-        .post("/v1/evaluations")
-        .add_header("x-api-key", "api-token")
-        .add_header("content-type", "application/json")
-        .bytes(Bytes::from_static(
-            br#"{"subject":{"id":"person-1","id_type":"national_id"},"claims":["farmed-land-size"]}"#,
-        ))
-        .await;
-    assert_request_invalid_problem(old_shape);
-
-    let malformed_json = server
-        .post("/v1/evaluations")
-        .add_header("x-api-key", "api-token")
-        .add_header("content-type", "application/json")
-        .text("{")
-        .await;
-    assert_request_invalid_problem(malformed_json);
-
-    let wrong_content_type = server
-        .post("/v1/evaluations")
-        .add_header("x-api-key", "api-token")
-        .add_header("content-type", "text/plain")
-        .text("{}")
-        .await;
-    assert_request_invalid_problem(wrong_content_type);
-
-    for route in [
-        "/v1/evaluations",
-        "/v1/evaluations/eval-1/render",
-        "/v1/credentials",
-    ] {
-        let response = server
-            .post(route)
-            .add_header("x-api-key", "api-token")
-            .add_header("idempotency-key", "unsupported-key")
-            .add_header("content-type", "application/json")
-            .text("{}")
-            .await;
-        assert_request_invalid_problem(response);
-    }
-}
-
-pub(super) fn assert_server_owned_request_id(
-    response: &axum_test::TestResponse,
-    body: &Value,
-    inbound_request_id: &str,
-) {
-    let header_request_id = response
-        .headers()
-        .get("x-request-id")
-        .and_then(|value| value.to_str().ok())
-        .expect("x-request-id response header is present");
-    let body_request_id = body["request_id"]
-        .as_str()
-        .expect("ProblemDetails request_id is present");
-
-    assert_eq!(header_request_id, body_request_id);
-    assert_ne!(body_request_id, inbound_request_id);
-    Ulid::from_string(body_request_id).expect("request_id is a server-minted ULID");
-}
-
-pub(super) fn assert_request_invalid_problem(response: axum_test::TestResponse) {
-    response.assert_status(StatusCode::BAD_REQUEST);
-    let content_type = response
-        .headers()
-        .get("content-type")
-        .expect("content-type header")
-        .to_str()
-        .expect("content-type is valid");
-    assert!(content_type.starts_with("application/problem+json"));
-    let body: Value = response.json();
-    assert_eq!(body["status"], json!(400));
-    assert_eq!(body["code"], json!("request.invalid"));
-    assert!(body["type"]
-        .as_str()
-        .is_some_and(|value| value.ends_with("/request/invalid")));
-}
-
-#[tokio::test]
-pub(super) async fn cors_csp_corp_headers_present_and_corp_conditional() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    config.server.cors.allowed_origins = vec!["https://client.example.test".to_string()];
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let response = server
-        .get("/healthz")
-        .add_header("origin", "https://client.example.test")
-        .await;
-
-    response.assert_status_ok();
-    assert_eq!(
-        response
-            .headers()
-            .get("access-control-allow-origin")
-            .and_then(|value| value.to_str().ok()),
-        Some("https://client.example.test")
-    );
-    assert_eq!(
-        response
-            .headers()
-            .get("content-security-policy")
-            .and_then(|value| value.to_str().ok()),
-        Some("default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; object-src 'none'; frame-ancestors 'none'")
-    );
-    assert_eq!(
-        response
-            .headers()
-            .get("x-content-type-options")
-            .and_then(|value| value.to_str().ok()),
-        Some("nosniff")
-    );
-    assert_eq!(
-        response
-            .headers()
-            .get("referrer-policy")
-            .and_then(|value| value.to_str().ok()),
-        Some("no-referrer")
-    );
-    assert_eq!(
-        response
-            .headers()
-            .get("x-frame-options")
-            .and_then(|value| value.to_str().ok()),
-        Some("DENY")
-    );
-    assert_eq!(
-        response
-            .headers()
-            .get("permissions-policy")
-            .and_then(|value| value.to_str().ok()),
-        Some("camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()")
-    );
-    assert_eq!(
-        response
-            .headers()
-            .get("cross-origin-opener-policy")
-            .and_then(|value| value.to_str().ok()),
-        Some("same-origin")
-    );
-    assert_eq!(
-        response
-            .headers()
-            .get("cross-origin-resource-policy")
-            .and_then(|value| value.to_str().ok()),
-        Some("cross-origin")
-    );
-}
-
-#[tokio::test]
-pub(super) async fn subject_access_cors_uses_wallet_origins_on_browser_paths() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    config.server.cors.allowed_origins = vec!["https://ops.example.test".to_string()];
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let wallet = server
-        .get("/.well-known/evidence-service")
-        .add_header("origin", "https://wallet.example.gov")
-        .await;
-    wallet.assert_status(StatusCode::UNAUTHORIZED);
-    assert_eq!(
-        wallet
-            .headers()
-            .get("access-control-allow-origin")
-            .and_then(|value| value.to_str().ok()),
-        Some("https://wallet.example.gov")
-    );
-
-    let type_metadata = server
-        .get("/credentials/civil-status")
-        .add_header("host", "127.0.0.1:4325")
-        .add_header("x-forwarded-proto", "http")
-        .add_header("origin", "https://wallet.example.gov")
-        .await;
-    type_metadata.assert_status_ok();
-    assert_eq!(
-        type_metadata
-            .headers()
-            .get("access-control-allow-origin")
-            .and_then(|value| value.to_str().ok()),
-        Some("https://wallet.example.gov")
-    );
-
-    let ops = server
-        .get("/.well-known/evidence-service")
-        .add_header("origin", "https://ops.example.test")
-        .await;
-    ops.assert_status(StatusCode::UNAUTHORIZED);
-    assert!(ops.headers().get("access-control-allow-origin").is_none());
-
-    let healthz = server
-        .get("/healthz")
-        .add_header("origin", "https://ops.example.test")
-        .await;
-    healthz.assert_status_ok();
-    assert_eq!(
-        healthz
-            .headers()
-            .get("access-control-allow-origin")
-            .and_then(|value| value.to_str().ok()),
-        Some("https://ops.example.test")
-    );
-}
-
-#[tokio::test]
-pub(super) async fn subject_access_preflight_uses_wallet_origin_allow_list() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    config.server.cors.allowed_origins = vec!["https://ops.example.test".to_string()];
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let wallet = server
-        .method(Method::OPTIONS, "/v1/evaluations")
-        .add_header("origin", "https://wallet.example.gov")
-        .add_header("access-control-request-method", "POST")
-        .add_header(
-            "access-control-request-headers",
-            "authorization, content-type",
-        )
-        .await;
-    wallet.assert_status(StatusCode::NO_CONTENT);
-    assert_eq!(
-        wallet
-            .headers()
-            .get("access-control-allow-origin")
-            .and_then(|value| value.to_str().ok()),
-        Some("https://wallet.example.gov")
-    );
-    assert_eq!(
-        wallet
-            .headers()
-            .get("access-control-allow-headers")
-            .and_then(|value| value.to_str().ok()),
-        Some("authorization, content-type")
-    );
-
-    let type_metadata = server
-        .method(Method::OPTIONS, "/credentials/civil-status")
-        .add_header("origin", "https://wallet.example.gov")
-        .add_header("access-control-request-method", "GET")
-        .await;
-    type_metadata.assert_status(StatusCode::NO_CONTENT);
-    assert_eq!(
-        type_metadata
-            .headers()
-            .get("access-control-allow-origin")
-            .and_then(|value| value.to_str().ok()),
-        Some("https://wallet.example.gov")
-    );
-    assert!(
-        type_metadata
-            .headers()
-            .get("access-control-allow-methods")
-            .and_then(|value| value.to_str().ok())
-            .is_some_and(|methods| methods.split(',').any(|method| method.trim() == "GET")),
-        "preflight response should allow GET"
-    );
-
-    let ops = server
-        .method(Method::OPTIONS, "/v1/evaluations")
-        .add_header("origin", "https://ops.example.test")
-        .add_header("access-control-request-method", "POST")
-        .await;
-    ops.assert_status(StatusCode::NO_CONTENT);
-    assert!(ops.headers().get("access-control-allow-origin").is_none());
-}
-
-#[tokio::test]
-pub(super) async fn standalone_router_hides_admin_and_metrics_when_admin_listener_is_not_shared() {
-    for mode in [
-        RegistryNotaryAdminListenerMode::Dedicated,
-        RegistryNotaryAdminListenerMode::Disabled,
-    ] {
-        set_audit_secret();
-        std::env::set_var(
-            "TEST_EVIDENCE_API_KEY_HASH",
-            "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-        );
-
-        let tmp = TempDir::new().expect("tempdir");
-        let audit_path = tmp.path().join("audit.jsonl");
-        let mut config = registry_backed_config(
-            "http://127.0.0.1:1",
-            audit_path.to_str().expect("audit path is UTF-8"),
-        );
-        add_admin_api_key(&mut config);
-        config.server.admin_listener.mode = mode;
-        config.server.admin_listener.bind = "127.0.0.1:19091".parse().expect("valid admin bind");
-
-        let app = standalone_router(config)
-            .await
-            .expect("standalone router builds");
-        let server = TestServer::builder().mock_transport().build(app);
-
-        server.get("/healthz").await.assert_status_ok();
-        server
-            .post("/admin/v1/reload")
-            .add_header("x-api-key", "admin-token")
-            .await
-            .assert_status(StatusCode::NOT_FOUND);
-        server
-            .get("/metrics")
-            .add_header("x-api-key", "admin-token")
-            .await
-            .assert_status(StatusCode::NOT_FOUND);
-    }
-}
-
-#[tokio::test]
-pub(super) async fn standalone_router_default_config_hides_admin_and_metrics() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    add_admin_api_key(&mut config);
-
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    server.get("/healthz").await.assert_status_ok();
-    server
-        .post("/admin/v1/reload")
-        .add_header("x-api-key", "admin-token")
-        .await
-        .assert_status(StatusCode::NOT_FOUND);
-    server
-        .get("/metrics")
-        .add_header("x-api-key", "admin-token")
-        .await
-        .assert_status(StatusCode::NOT_FOUND);
-}
-
-#[tokio::test]
-pub(super) async fn standalone_server_can_serve_openapi_without_auth_when_configured() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    config.server.openapi_requires_auth = false;
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let openapi = server.get("/openapi.json").await;
-    openapi.assert_status_ok();
-    let openapi_body: Value = openapi.json();
-    assert_eq!(openapi_body["openapi"], json!("3.1.0"));
-    assert!(openapi_body["paths"]["/v1/evaluations"].is_object());
-}
-
-#[tokio::test]
-pub(super) async fn openapi_json_handler_denies_without_runtime_state_by_default() {
-    let server = TestServer::new(registry_notary_server::api::public_router());
-
-    server
-        .get("/openapi.json")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-}
-
-#[tokio::test]
-pub(super) async fn public_router_exposes_no_batch_credential_or_oid4vci_route() {
-    let server = TestServer::new(registry_notary_server::api::public_router());
-
-    for route in [
-        "/v1/batch-credentials",
-        "/v1/credentials/batch",
-        "/oid4vci/batch-credential",
-        "/oid4vci/batch-credentials",
-    ] {
-        server
-            .post(route)
-            .await
-            .assert_status(StatusCode::NOT_FOUND);
-    }
-}
-
-#[tokio::test]
-pub(super) async fn standalone_server_serves_docs_shell_without_auth() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-
-    let config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let docs = server.get("/docs").await;
-    docs.assert_status_ok();
-    let docs_body = docs.text();
-    assert!(docs_body.contains("Registry Notary API"));
-    assert!(docs_body.contains("/openapi.json"));
-    assert!(docs_body.contains("/docs/scalar.js"));
-    assert!(docs_body.contains("X-Api-Key"));
-
-    let bundle = server.get("/docs/scalar.js").await;
-    bundle.assert_status_ok();
-    let content_type = bundle
-        .headers()
-        .get(header::CONTENT_TYPE)
-        .and_then(|value| value.to_str().ok())
-        .expect("bundle content type");
-    assert!(content_type.starts_with("application/javascript"));
-
-    let denied_openapi = server.get("/openapi.json").await;
-    denied_openapi.assert_status(StatusCode::UNAUTHORIZED);
-}
-
-#[tokio::test]
-pub(super) async fn request_uri_limit_414_carries_server_owned_request_id() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let long_path = format!("/{}", "a".repeat(8 * 1024 + 1));
-
-    let response = server
-        .get(&long_path)
-        .add_header("x-request-id", "client-supplied-id")
-        .await;
-
-    response.assert_status(StatusCode::URI_TOO_LONG);
-    let body: Value = response.json();
-    assert_server_owned_request_id(&response, &body, "client-supplied-id");
-}
-
-#[tokio::test]
-pub(super) async fn request_body_limit_413_carries_server_owned_request_id() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::new(app);
-
-    let response = server
-        .post("/v1/evaluations")
-        .add_header("x-api-key", "api-token")
-        .add_header("content-type", "application/json")
-        .add_header(header::CONTENT_LENGTH, "1048577")
-        .add_header("x-request-id", "client-supplied-id")
-        .await;
-
-    response.assert_status(StatusCode::PAYLOAD_TOO_LARGE);
-    let body: Value = response.json();
-    assert_server_owned_request_id(&response, &body, "client-supplied-id");
-}
diff --git a/crates/registry-notary-server/tests/standalone_http/oid4vci.rs b/crates/registry-notary-server/tests/standalone_http/oid4vci.rs
deleted file mode 100644
index 8b0efe2b0..000000000
--- a/crates/registry-notary-server/tests/standalone_http/oid4vci.rs
+++ /dev/null
@@ -1,1497 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-#[cfg(feature = "registry-notary-cel")]
-use super::preauth_support::*;
-use super::support::*;
-#[allow(unused_imports)]
-use super::{
-    admin::*, audit::*, auth::*, credentials::*, federation::*, http_contracts::*, preauth::*,
-};
-
-#[tokio::test]
-pub(super) async fn oid4vci_metadata_is_public_but_legacy_offer_and_nonce_are_not() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let metadata = server.get("/.well-known/openid-credential-issuer").await;
-    metadata.assert_status_ok();
-    let metadata_body: Value = metadata.json();
-    assert_eq!(
-        metadata_body["credential_configurations_supported"]["person_is_alive_sd_jwt"]["display"]
-            [0]["name"],
-        json!("Person is alive")
-    );
-    let metadata_text = metadata_body.to_string();
-    assert!(!metadata_text.contains("source_connections"));
-
-    server
-        .get("/oid4vci/credential-offer")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-    server
-        .post("/oid4vci/nonce")
-        .json(&json!({}))
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "subject_access",
-        "national_id": "person-1",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    server
-        .get("/oid4vci/credential-offer")
-        .add_header("authorization", format!("Bearer {token}"))
-        .await
-        .assert_status(StatusCode::NOT_FOUND);
-    server
-        .post("/oid4vci/nonce")
-        .add_header("authorization", format!("Bearer {token}"))
-        .json(&json!({}))
-        .await
-        .assert_status(StatusCode::NOT_FOUND);
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn oid4vci_type_metadata_is_public_and_matches_configured_vct() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    // Forwarded host/proto are honored only from trusted proxies; the
-    // axum-test client connects over loopback, so trust the loopback peer.
-    config.server.trusted_proxy_ips = vec![
-        "127.0.0.1".parse().expect("ipv4 loopback parses"),
-        "::1".parse().expect("ipv6 loopback parses"),
-    ];
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    // Serve with connect-info so the forwarded-host trust gate can see the
-    // loopback peer; a plain `Router` over http_transport injects no
-    // `ConnectInfo`, which would make the trust gate reject every request.
-    let server = TestServer::builder()
-        .http_transport()
-        .build(app.into_make_service_with_connect_info::<std::net::SocketAddr>());
-
-    let response = server
-        .get("/credentials/civil-status")
-        .add_header("host", "internal-notary:8080")
-        .add_header("x-forwarded-host", "127.0.0.1:4325")
-        .add_header("x-forwarded-proto", "http")
-        .await;
-    response.assert_status_ok();
-    assert_eq!(
-        response
-            .headers()
-            .get("content-type")
-            .and_then(|value| value.to_str().ok()),
-        Some("application/json")
-    );
-    let body: Value = response.json();
-    assert_eq!(
-        body["vct"],
-        json!("http://127.0.0.1:4325/credentials/civil-status")
-    );
-    assert_eq!(body["name"], json!("Person is alive"));
-    assert_eq!(body["display"][0]["locale"], json!("en-US"));
-    assert_eq!(body["display"][0]["name"], json!("Person is alive"));
-    assert_eq!(body["claims"][0]["path"], json!(["person-is-alive"]));
-    assert_eq!(body["claims"][0]["display"][0]["locale"], json!("en-US"));
-    assert_eq!(
-        body["claims"][0]["display"][0]["label"],
-        json!("Person is alive")
-    );
-    assert_eq!(body["claims"][0]["sd"], json!("always"));
-    assert_eq!(body["claims"][0]["mandatory"], json!(true));
-
-    let query_response = server
-        .get("/credentials/civil-status?cache_bust=1")
-        .add_header("host", "internal-notary:8080")
-        .add_header("x-forwarded-host", "127.0.0.1:4325")
-        .add_header("x-forwarded-proto", "http")
-        .await;
-    query_response.assert_status_ok();
-    let query_body: Value = query_response.json();
-    assert_eq!(
-        query_body["vct"],
-        json!("http://127.0.0.1:4325/credentials/civil-status")
-    );
-
-    let head = server
-        .method(Method::HEAD, "/credentials/civil-status")
-        .add_header("host", "internal-notary:8080")
-        .add_header("x-forwarded-host", "127.0.0.1:4325")
-        .add_header("x-forwarded-proto", "http")
-        .await;
-    head.assert_status_ok();
-    assert_eq!(
-        head.headers()
-            .get("content-type")
-            .and_then(|value| value.to_str().ok()),
-        Some("application/json")
-    );
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn oid4vci_type_metadata_normalizes_forwarded_scheme_and_host_case() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    let vct = "https://issuer.example.test/credentials/civil-status";
-    config.oid4vci.credential_issuer = "https://issuer.example.test".to_string();
-    config.oid4vci.credential_endpoint =
-        "https://issuer.example.test/oid4vci/credential".to_string();
-    config.oid4vci.offer_endpoint.clear();
-    config.oid4vci.nonce_endpoint = None;
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("credential profile exists")
-        .vct = vct.to_string();
-    config
-        .oid4vci
-        .credential_configurations
-        .get_mut("person_is_alive_sd_jwt")
-        .expect("credential configuration exists")
-        .vct = vct.to_string();
-    // Forwarded host/proto are honored only from trusted proxies; the
-    // axum-test client connects over loopback, so trust the loopback peer.
-    config.server.trusted_proxy_ips = vec![
-        "127.0.0.1".parse().expect("ipv4 loopback parses"),
-        "::1".parse().expect("ipv6 loopback parses"),
-    ];
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    // Serve with connect-info so the forwarded-host trust gate can see the
-    // loopback peer; a plain `Router` over http_transport injects no
-    // `ConnectInfo`, which would make the trust gate reject every request.
-    let server = TestServer::builder()
-        .http_transport()
-        .build(app.into_make_service_with_connect_info::<std::net::SocketAddr>());
-
-    let response = server
-        .get("/credentials/civil-status")
-        .add_header("host", "internal-notary:8080")
-        .add_header("x-forwarded-host", "ISSUER.EXAMPLE.TEST")
-        .add_header("x-forwarded-proto", "HTTPS")
-        .await;
-    response.assert_status_ok();
-    let body: Value = response.json();
-    assert_eq!(body["vct"], json!(vct));
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn oid4vci_type_metadata_supports_nested_paths_and_public_404s() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    let nested_vct = "http://127.0.0.1:4325/credentials/dhis2/health-status/v1";
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("credential profile exists")
-        .vct = nested_vct.to_string();
-    config
-        .oid4vci
-        .credential_configurations
-        .get_mut("person_is_alive_sd_jwt")
-        .expect("credential configuration exists")
-        .vct = nested_vct.to_string();
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let nested = server
-        .get("/credentials/dhis2/health-status/v1")
-        .add_header("host", "127.0.0.1:4325")
-        .add_header("x-forwarded-proto", "http")
-        .await;
-    nested.assert_status_ok();
-    let body: Value = nested.json();
-    assert_eq!(body["vct"], json!(nested_vct));
-
-    let unknown = server
-        .get("/credentials/dhis2/unknown/v1")
-        .add_header("host", "127.0.0.1:4325")
-        .add_header("x-forwarded-proto", "http")
-        .await;
-    unknown.assert_status(StatusCode::NOT_FOUND);
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn oid4vci_type_metadata_supports_path_prefixed_issuer_behind_stripping_proxy() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    let prefixed_vct = "http://127.0.0.1:4325/notary/credentials/civil-status";
-    config.oid4vci.credential_issuer = "http://127.0.0.1:4325/notary".to_string();
-    config.oid4vci.credential_endpoint =
-        "http://127.0.0.1:4325/notary/oid4vci/credential".to_string();
-    config.oid4vci.offer_endpoint.clear();
-    config.oid4vci.nonce_endpoint = None;
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("credential profile exists")
-        .vct = prefixed_vct.to_string();
-    config
-        .oid4vci
-        .credential_configurations
-        .get_mut("person_is_alive_sd_jwt")
-        .expect("credential configuration exists")
-        .vct = prefixed_vct.to_string();
-    // Forwarded host/proto are honored only from trusted proxies; the
-    // axum-test client connects over loopback, so trust the loopback peer.
-    config.server.trusted_proxy_ips = vec![
-        "127.0.0.1".parse().expect("ipv4 loopback parses"),
-        "::1".parse().expect("ipv6 loopback parses"),
-    ];
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    // Serve with connect-info so the forwarded-host trust gate can see the
-    // loopback peer; a plain `Router` over http_transport injects no
-    // `ConnectInfo`, which would make the trust gate reject every request.
-    let server = TestServer::builder()
-        .http_transport()
-        .build(app.into_make_service_with_connect_info::<std::net::SocketAddr>());
-
-    let response = server
-        .get("/credentials/civil-status")
-        .add_header("host", "internal-notary:8080")
-        .add_header("x-forwarded-host", "127.0.0.1:4325")
-        .add_header("x-forwarded-proto", "http")
-        .await;
-    response.assert_status_ok();
-    let body: Value = response.json();
-    assert_eq!(body["vct"], json!(prefixed_vct));
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn oid4vci_type_metadata_is_not_served_when_oid4vci_is_disabled() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    config.oid4vci.enabled = false;
-    config.oid4vci.pre_authorized_code = Default::default();
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    server
-        .get("/credentials/civil-status")
-        .add_header("host", "127.0.0.1:4325")
-        .add_header("x-forwarded-proto", "http")
-        .await
-        .assert_status(StatusCode::NOT_FOUND);
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn oid4vci_type_metadata_well_known_is_public_and_matches_configured_vct() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    // Forwarded host/proto are honored only from trusted proxies; the
-    // axum-test client connects over loopback, so trust the loopback peer.
-    config.server.trusted_proxy_ips = vec![
-        "127.0.0.1".parse().expect("ipv4 loopback parses"),
-        "::1".parse().expect("ipv6 loopback parses"),
-    ];
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    // Serve with connect-info so the forwarded-host trust gate can see the
-    // loopback peer; a plain `Router` over http_transport injects no
-    // `ConnectInfo`, which would make the trust gate reject every request.
-    let server = TestServer::builder()
-        .http_transport()
-        .build(app.into_make_service_with_connect_info::<std::net::SocketAddr>());
-
-    let response = server
-        .get("/.well-known/vct/credentials/civil-status")
-        .add_header("host", "internal-notary:8080")
-        .add_header("x-forwarded-host", "127.0.0.1:4325")
-        .add_header("x-forwarded-proto", "http")
-        .await;
-    response.assert_status_ok();
-    assert_eq!(
-        response
-            .headers()
-            .get("content-type")
-            .and_then(|value| value.to_str().ok()),
-        Some("application/json")
-    );
-    let body: Value = response.json();
-    assert_eq!(
-        body["vct"],
-        json!("http://127.0.0.1:4325/credentials/civil-status")
-    );
-    assert_eq!(body["name"], json!("Person is alive"));
-    assert_eq!(body["display"][0]["locale"], json!("en-US"));
-    assert_eq!(body["display"][0]["name"], json!("Person is alive"));
-    assert_eq!(body["claims"][0]["path"], json!(["person-is-alive"]));
-    assert_eq!(body["claims"][0]["display"][0]["locale"], json!("en-US"));
-    assert_eq!(
-        body["claims"][0]["display"][0]["label"],
-        json!("Person is alive")
-    );
-    assert_eq!(body["claims"][0]["sd"], json!("always"));
-    assert_eq!(body["claims"][0]["mandatory"], json!(true));
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn oid4vci_type_metadata_well_known_supports_nested_paths_and_public_404s() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    let nested_vct = "http://127.0.0.1:4325/credentials/dhis2/health-status/v1";
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("credential profile exists")
-        .vct = nested_vct.to_string();
-    config
-        .oid4vci
-        .credential_configurations
-        .get_mut("person_is_alive_sd_jwt")
-        .expect("credential configuration exists")
-        .vct = nested_vct.to_string();
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let nested = server
-        .get("/.well-known/vct/credentials/dhis2/health-status/v1")
-        .add_header("host", "127.0.0.1:4325")
-        .add_header("x-forwarded-proto", "http")
-        .await;
-    nested.assert_status_ok();
-    let body: Value = nested.json();
-    assert_eq!(body["vct"], json!(nested_vct));
-
-    let unknown = server
-        .get("/.well-known/vct/credentials/dhis2/unknown/v1")
-        .add_header("host", "127.0.0.1:4325")
-        .add_header("x-forwarded-proto", "http")
-        .await;
-    unknown.assert_status(StatusCode::NOT_FOUND);
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn oid4vci_type_metadata_well_known_is_not_served_when_oid4vci_is_disabled() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    config.oid4vci.enabled = false;
-    config.oid4vci.pre_authorized_code = Default::default();
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    server
-        .get("/.well-known/vct/credentials/civil-status")
-        .add_header("host", "127.0.0.1:4325")
-        .add_header("x-forwarded-proto", "http")
-        .await
-        .assert_status(StatusCode::NOT_FOUND);
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn oid4vci_type_metadata_well_known_keeps_protected_routes_authenticated() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    enable_credential_status(&mut config);
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    server
-        .get("/.well-known/vct/credentials/civil-status")
-        .add_header("host", "127.0.0.1:4325")
-        .add_header("x-forwarded-proto", "http")
-        .await
-        .assert_status_ok();
-    server
-        .post("/v1/credentials")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-    server
-        .post("/admin/v1/credentials/urn:ulid:01HX0000000000000000000000/status")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn oid4vci_type_metadata_well_known_serves_wallet_cors() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    config.server.cors.allowed_origins = vec!["https://ops.example.test".to_string()];
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let type_metadata = server
-        .get("/.well-known/vct/credentials/civil-status")
-        .add_header("host", "127.0.0.1:4325")
-        .add_header("x-forwarded-proto", "http")
-        .add_header("origin", "https://wallet.example.gov")
-        .await;
-    type_metadata.assert_status_ok();
-    assert_eq!(
-        type_metadata
-            .headers()
-            .get("access-control-allow-origin")
-            .and_then(|value| value.to_str().ok()),
-        Some("https://wallet.example.gov")
-    );
-
-    let preflight = server
-        .method(Method::OPTIONS, "/.well-known/vct/credentials/civil-status")
-        .add_header("origin", "https://wallet.example.gov")
-        .add_header("access-control-request-method", "GET")
-        .await;
-    preflight.assert_status(StatusCode::NO_CONTENT);
-    assert_eq!(
-        preflight
-            .headers()
-            .get("access-control-allow-origin")
-            .and_then(|value| value.to_str().ok()),
-        Some("https://wallet.example.gov")
-    );
-    assert!(
-        preflight
-            .headers()
-            .get("access-control-allow-methods")
-            .and_then(|value| value.to_str().ok())
-            .is_some_and(|methods| methods.split(',').any(|method| method.trim() == "GET")),
-        "preflight response should allow GET"
-    );
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn public_probe_routes_remain_public_except_metrics() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    enable_credential_status(&mut config);
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    server.get("/healthz").await.assert_status_ok();
-    let ready = server.get("/ready").await;
-    ready.assert_status_ok();
-    let ready_body: Value = ready.json();
-    assert_eq!(ready_body["status"], json!("ready"));
-    assert_eq!(ready_body["checks"]["degraded"], json!(0));
-    server
-        .get("/.well-known/openid-credential-issuer")
-        .await
-        .assert_status_ok();
-    server
-        .get("/oid4vci/credential-offer")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-    server
-        .post("/oid4vci/nonce")
-        .json(&json!({}))
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-    server
-        .get("/v1/credentials/urn:ulid:01HX0000000000000000000000/status")
-        .await
-        .assert_status(StatusCode::NOT_FOUND);
-    server
-        .get("/v1/credentials/urn:ulid:01HX0000000000000000000000/history")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-    server
-        .post("/federation/v1/evaluations")
-        .bytes(Bytes::from_static(b"not-mounted"))
-        .await
-        .assert_status(StatusCode::NOT_FOUND);
-
-    server
-        .get("/metrics")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-    server
-        .get("/credentials")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-    server
-        .post("/v1/credentials")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn manifest_public_protected_routes_are_mounted_behind_auth() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let manifest: ExposureManifest = serde_json::from_str(include_str!(
-        "../../../../products/notary/security/exposure-manifest.json"
-    ))
-    .expect("security exposure manifest parses");
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    enable_credential_status(&mut config);
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    for endpoint in manifest.endpoints.iter().filter(|endpoint| {
-        endpoint.listener == "public" && endpoint.auth != "none" && endpoint.feature.is_none()
-    }) {
-        let method = Method::from_bytes(endpoint.method.as_bytes()).expect("method parses");
-        let path = sample_manifest_path(&endpoint.path);
-        let request = server.method(method, &path);
-        let response = if endpoint.auth == "bearer" && endpoint.path == "/oid4vci/credential" {
-            request
-                .json(&json!({
-                    "format": "dc+sd-jwt",
-                    "credential_configuration_id": "person_is_alive_sd_jwt",
-                    "proof": {
-                        "proof_type": "jwt",
-                        "jwt": sign_oid4vci_proof("http://127.0.0.1:4325", "nonce-1")
-                    }
-                }))
-                .await
-        } else {
-            request.await
-        };
-        assert_eq!(
-            response.status_code(),
-            StatusCode::UNAUTHORIZED,
-            "{} {} must be mounted behind auth on the public listener",
-            endpoint.method,
-            endpoint.path
-        );
-    }
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn service_document_advertises_credential_status_when_enabled() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = registry_backed_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-    );
-    enable_credential_status(&mut config);
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let response = server
-        .get("/.well-known/evidence-service")
-        .add_header("x-api-key", "api-token")
-        .await;
-
-    response.assert_status_ok();
-    let body: Value = response.json();
-    assert_eq!(
-        body["credential_capabilities"]["sd_jwt_vc"]["status_methods"],
-        json!(["status_list"])
-    );
-    assert_eq!(
-        body["credential_capabilities"]["sd_jwt_vc"]["credential_status_url"],
-        json!("/v1/credentials/{credential_id}/status")
-    );
-    assert_eq!(
-        body["credential_capabilities"]["sd_jwt_vc"]["credential_status_media_type"],
-        json!("application/statuslist+jwt")
-    );
-    assert!(!body["credential_capabilities"]["unsupported_features"]
-        .as_array()
-        .expect("unsupported features is an array")
-        .iter()
-        .any(|feature| feature.as_str() == Some("credential_status")));
-}
-
-#[tokio::test]
-pub(super) async fn credential_status_admin_edges_return_expected_http_statuses() {
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-    std::env::set_var(
-        "TEST_EVIDENCE_ADMIN_KEY_HASH",
-        "sha256:10a4c7c9fc5206d6f36dc6944a81bb6f4a3cb0e25014ae3b12e6c3e52712292a",
-    );
-
-    let tmp = TempDir::new().expect("tempdir");
-    let enabled_audit_path = tmp.path().join("enabled-audit.jsonl");
-    let mut enabled_config = registry_backed_config(
-        "http://127.0.0.1:1",
-        enabled_audit_path
-            .to_str()
-            .expect("enabled audit path is UTF-8"),
-    );
-    enable_shared_admin_listener(&mut enabled_config);
-    enable_credential_status(&mut enabled_config);
-    enabled_config.auth.api_keys.push(EvidenceCredentialConfig {
-        id: "admin".to_string(),
-        fingerprint: env_fingerprint_ref("TEST_EVIDENCE_ADMIN_KEY_HASH"),
-        scopes: vec!["registry_notary:admin".to_string()],
-        authorization_details: None,
-    });
-    let enabled_server = TestServer::builder().mock_transport().build(
-        standalone_router(enabled_config)
-            .await
-            .expect("enabled router builds"),
-    );
-
-    let invalid_status = enabled_server
-        .post("/admin/v1/credentials/urn:ulid:01HX0000000000000000000000/status")
-        .add_header("x-api-key", "admin-token")
-        .json(&json!({ "status": "deleted" }))
-        .await;
-    invalid_status.assert_status(StatusCode::BAD_REQUEST);
-    let invalid_body: Value = invalid_status.json();
-    assert_eq!(
-        invalid_body["code"],
-        json!("credential_status.invalid_status")
-    );
-
-    let missing_admin_scope = enabled_server
-        .post("/admin/v1/credentials/urn:ulid:01HX0000000000000000000000/status")
-        .add_header("x-api-key", "api-token")
-        .json(&json!({ "status": "revoked" }))
-        .await;
-    missing_admin_scope.assert_status(StatusCode::FORBIDDEN);
-
-    let disabled_audit_path = tmp.path().join("disabled-audit.jsonl");
-    let mut disabled_config = registry_backed_config(
-        "http://127.0.0.1:1",
-        disabled_audit_path
-            .to_str()
-            .expect("disabled audit path is UTF-8"),
-    );
-    enable_shared_admin_listener(&mut disabled_config);
-    disabled_config
-        .auth
-        .api_keys
-        .push(EvidenceCredentialConfig {
-            id: "admin".to_string(),
-            fingerprint: env_fingerprint_ref("TEST_EVIDENCE_ADMIN_KEY_HASH"),
-            scopes: vec!["registry_notary:admin".to_string()],
-            authorization_details: None,
-        });
-    let disabled_server = TestServer::builder().mock_transport().build(
-        standalone_router(disabled_config)
-            .await
-            .expect("disabled router builds"),
-    );
-
-    let disabled = disabled_server
-        .post("/admin/v1/credentials/urn:ulid:01HX0000000000000000000000/status")
-        .add_header("x-api-key", "admin-token")
-        .json(&json!({ "status": "revoked" }))
-        .await;
-    disabled.assert_status(StatusCode::NOT_FOUND);
-    let disabled_body: Value = disabled.json();
-    assert_eq!(disabled_body["code"], json!("credential_status.disabled"));
-
-    let disabled_public = disabled_server
-        .get("/v1/credentials/urn:ulid:01HX0000000000000000000000/status")
-        .await;
-    disabled_public.assert_status(StatusCode::NOT_FOUND);
-}
-
-#[tokio::test]
-pub(super) async fn admin_scope_is_instance_global_across_credential_profiles() {
-    // Pins the documented instance-global admin model (issue #58): the same
-    // registry_notary:admin-scoped credential authorizes admin operations
-    // against every credential profile hosted by this instance. Registry
-    // Notary does not partition admin authority per credential profile /
-    // issuer; the supported isolation boundary for separate administrative
-    // domains is one Registry Notary instance per issuing authority.
-    set_audit_secret();
-    std::env::set_var(
-        "TEST_EVIDENCE_API_KEY_HASH",
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51",
-    );
-    std::env::set_var(
-        "TEST_EVIDENCE_ADMIN_KEY_HASH",
-        "sha256:10a4c7c9fc5206d6f36dc6944a81bb6f4a3cb0e25014ae3b12e6c3e52712292a",
-    );
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK_2", TEST_HOLDER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oidc_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    enable_shared_admin_listener(&mut config);
-    enable_credential_status(&mut config);
-    config.auth.api_keys.push(EvidenceCredentialConfig {
-        id: "caseworker".to_string(),
-        fingerprint: env_fingerprint_ref("TEST_EVIDENCE_API_KEY_HASH"),
-        scopes: vec!["farmer_registry:evidence_verification".to_string()],
-        authorization_details: None,
-    });
-    let subject_access_holder_binding = config
-        .evidence
-        .credential_profiles
-        .get("civil_status_sd_jwt")
-        .expect("subject-access credential profile exists")
-        .holder_binding
-        .clone();
-    config.evidence.credential_profiles.clear();
-    config.evidence.signing_keys.remove("issuer-key");
-    config.subject_access.credential_profiles = vec![
-        "issuer_one_sd_jwt".to_string(),
-        "issuer_two_sd_jwt".to_string(),
-    ];
-    config.auth.api_keys.push(EvidenceCredentialConfig {
-        id: "admin".to_string(),
-        fingerprint: env_fingerprint_ref("TEST_EVIDENCE_ADMIN_KEY_HASH"),
-        scopes: vec!["registry_notary:admin".to_string()],
-        authorization_details: None,
-    });
-
-    // Two credential profiles standing in for two distinct issuing
-    // authorities hosted by this single instance.
-    config.evidence.signing_keys.insert(
-        "issuer-one-key".to_string(),
-        local_jwk_signing_key(
-            "TEST_CREDENTIAL_ISSUER_JWK",
-            "did:web:issuer-one.example#key-1",
-        ),
-    );
-    config.evidence.signing_keys.insert(
-        "issuer-two-key".to_string(),
-        local_jwk_signing_key(
-            "TEST_CREDENTIAL_ISSUER_JWK_2",
-            "did:web:issuer-two.example#key-1",
-        ),
-    );
-    config.evidence.credential_profiles.insert(
-        "issuer_one_sd_jwt".to_string(),
-        CredentialProfileConfig {
-            format: "application/dc+sd-jwt".to_string(),
-            issuer: "did:web:issuer-one.example".to_string(),
-            signing_key: "issuer-one-key".to_string(),
-            vct: "http://127.0.0.1:4325/credentials/issuer-one".to_string(),
-            validity_seconds: 600,
-            holder_binding: subject_access_holder_binding.clone(),
-            allowed_claims: vec!["person-is-alive".to_string()],
-            disclosure: Default::default(),
-        },
-    );
-    config.evidence.credential_profiles.insert(
-        "issuer_two_sd_jwt".to_string(),
-        CredentialProfileConfig {
-            format: "application/dc+sd-jwt".to_string(),
-            issuer: "did:web:issuer-two.example".to_string(),
-            signing_key: "issuer-two-key".to_string(),
-            vct: "http://127.0.0.1:4325/credentials/issuer-two".to_string(),
-            validity_seconds: 600,
-            holder_binding: subject_access_holder_binding,
-            allowed_claims: vec!["person-is-alive".to_string()],
-            disclosure: Default::default(),
-        },
-    );
-    config
-        .evidence
-        .claims
-        .iter_mut()
-        .find(|claim| claim.id == "person-is-alive")
-        .expect("registry-backed credential claim exists")
-        .credential_profiles = vec![
-        "issuer_one_sd_jwt".to_string(),
-        "issuer_two_sd_jwt".to_string(),
-    ];
-
-    let server = TestServer::builder().mock_transport().build(
-        standalone_router(config)
-            .await
-            .expect("standalone router builds"),
-    );
-
-    // Credential ids standing in for credentials issued under each profile.
-    // The admin credential-status route takes no profile parameter, so this
-    // exercises the same route and token pair against resources nominally
-    // tied to two different issuers hosted by the instance.
-    let issuer_one_credential_id = "urn:ulid:01HX0000000000000000000AA1";
-    let issuer_two_credential_id = "urn:ulid:01HX0000000000000000000AA2";
-
-    for credential_id in [issuer_one_credential_id, issuer_two_credential_id] {
-        let path = format!("/admin/v1/credentials/{credential_id}/status");
-
-        // The non-admin caseworker key is denied for both profiles' credentials.
-        let missing_admin_scope = server
-            .post(&path)
-            .add_header("x-api-key", "api-token")
-            .json(&json!({ "status": "revoked" }))
-            .await;
-        missing_admin_scope.assert_status(StatusCode::FORBIDDEN);
-
-        // The single admin-scoped key clears the scope check for both
-        // profiles' credentials; the deliberately invalid status value below
-        // proves the request reached past authorization (400, not 403).
-        let admin_authorized = server
-            .post(&path)
-            .add_header("x-api-key", "admin-token")
-            .json(&json!({ "status": "deleted" }))
-            .await;
-        admin_authorized.assert_status(StatusCode::BAD_REQUEST);
-        let admin_authorized_body: Value = admin_authorized.json();
-        assert_eq!(
-            admin_authorized_body["code"],
-            json!("credential_status.invalid_status")
-        );
-    }
-}
-
-#[tokio::test]
-pub(super) async fn disabled_oid4vci_credential_route_stays_hidden_for_malformed_body() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_oidc_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let response = server
-        .post("/oid4vci/credential")
-        .add_header("content-type", "application/json")
-        .text("{")
-        .await;
-    response.assert_status(StatusCode::NOT_FOUND);
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn oid4vci_credential_route_issues_holder_bound_sd_jwt() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    );
-    enable_shared_admin_listener(&mut config);
-    enable_credential_status(&mut config);
-    config
-        .auth
-        .oidc
-        .as_mut()
-        .expect("OIDC auth is configured")
-        .scope_map
-        .insert(
-            "status_admin".to_string(),
-            vec!["registry_notary:admin".to_string()],
-        );
-    config.subject_access.allowed_operations.issue_credential = true;
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let missing_status = server
-        .get("/v1/credentials/urn:ulid:01HX0000000000000000000000/status")
-        .await;
-    missing_status.assert_status(StatusCode::NOT_FOUND);
-    let missing_status_body: Value = missing_status.json();
-    assert_eq!(
-        missing_status_body["code"],
-        json!("credential_status.not_found")
-    );
-
-    let (code, pin) = drive_offer_to_code(&server, &token_upstream, &idp, "person-1").await;
-    let token = redeem_token(&server, &code, &pin).await;
-    token.assert_status_ok();
-    let token_body: Value = token.json();
-    let access_token = token_body["access_token"]
-        .as_str()
-        .expect("access token is returned")
-        .to_string();
-    let nonce = token_body["c_nonce"]
-        .as_str()
-        .expect("nonce is returned")
-        .to_string();
-    let proof = sign_oid4vci_proof("http://127.0.0.1:4325", &nonce);
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-
-    let response = server
-        .post("/oid4vci/credential")
-        .add_header("authorization", format!("Bearer {access_token}"))
-        .json(&json!({
-            "format": "dc+sd-jwt",
-            "credential_configuration_id": "person_is_alive_sd_jwt",
-            "proof": {
-                "proof_type": "jwt",
-                "jwt": proof
-            }
-        }))
-        .await;
-    response.assert_status_ok();
-    let body: Value = response.json();
-    assert_eq!(body["format"], json!("dc+sd-jwt"));
-    let credential = body["credential"].as_str().expect("credential is a string");
-    assert!(credential.contains('~'));
-    let issuer_jws = credential
-        .split('~')
-        .next()
-        .expect("SD-JWT contains an issuer JWS");
-    let payload_segment = issuer_jws
-        .split('.')
-        .nth(1)
-        .expect("issuer JWS contains a payload segment");
-    let payload: Value = serde_json::from_slice(
-        &URL_SAFE_NO_PAD
-            .decode(payload_segment)
-            .expect("issuer JWS payload is base64url"),
-    )
-    .expect("issuer JWS payload is JSON");
-    assert_eq!(
-        payload["exp"].as_i64().expect("credential has exp")
-            - payload["iat"].as_i64().expect("credential has iat"),
-        600
-    );
-    let credential_id = payload["jti"]
-        .as_str()
-        .expect("credential has jti")
-        .to_string();
-    assert_eq!(payload["id"], json!(credential_id));
-    assert_eq!(
-        payload["status"],
-        json!({
-            "status_list": {
-                "idx": 0,
-                "uri": format!("http://127.0.0.1:4325/v1/credentials/{credential_id}/status")
-            }
-        })
-    );
-    assert!(body.get("c_nonce").is_none());
-
-    let status = server
-        .get(&format!("/v1/credentials/{credential_id}/status"))
-        .await;
-    status.assert_status_ok();
-    let status_body: Value = status.json();
-    assert_eq!(status_body["credential_id"], json!(credential_id));
-    assert_eq!(status_body["status"], json!("valid"));
-    assert_eq!(
-        status_body["credential_profile"],
-        json!("civil_status_sd_jwt")
-    );
-    let status_list = server
-        .get(&format!("/v1/credentials/{credential_id}/status"))
-        .add_header(header::ACCEPT, "application/statuslist+jwt")
-        .await;
-    status_list.assert_status_ok();
-    assert_eq!(
-        status_list
-            .headers()
-            .get(header::CONTENT_TYPE)
-            .and_then(|value| value.to_str().ok()),
-        Some("application/statuslist+jwt")
-    );
-    let status_list_jwt = status_list.text();
-    assert_eq!(jwt_header(&status_list_jwt)["typ"], json!("statuslist+jwt"));
-    let status_list_payload = jwt_payload(&status_list_jwt);
-    assert_eq!(
-        status_list_payload["sub"],
-        json!(format!(
-            "http://127.0.0.1:4325/v1/credentials/{credential_id}/status"
-        ))
-    );
-    assert_eq!(status_list_payload["ttl"], json!(300));
-    assert_eq!(status_list_payload["status_list"]["bits"], json!(8));
-    assert_eq!(
-        status_list_payload["status_list"]["lst"],
-        json!("eJxjAAAAAQAB")
-    );
-
-    let admin_token = idp.mint_token(json!({
-        "sub": "status-admin",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "status_admin",
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    let revoked = server
-        .post(&format!("/admin/v1/credentials/{credential_id}/status"))
-        .add_header("authorization", format!("Bearer {admin_token}"))
-        .json(&json!({ "status": "revoked" }))
-        .await;
-    revoked.assert_status_ok();
-    let revoked_body: Value = revoked.json();
-    assert_eq!(revoked_body["status"], json!("revoked"));
-
-    let status_after_revoke = server
-        .get(&format!("/v1/credentials/{credential_id}/status"))
-        .await;
-    status_after_revoke.assert_status_ok();
-    let status_after_revoke_body: Value = status_after_revoke.json();
-    assert_eq!(status_after_revoke_body["status"], json!("revoked"));
-    let revoked_status_list = server
-        .get(&format!("/v1/credentials/{credential_id}/status"))
-        .add_header(header::ACCEPT, "application/statuslist+jwt")
-        .await;
-    revoked_status_list.assert_status_ok();
-    let revoked_status_list_payload = jwt_payload(&revoked_status_list.text());
-    assert_eq!(
-        revoked_status_list_payload["status_list"]["lst"],
-        json!("eJxjBAAAAgAC")
-    );
-
-    for attempted_status in ["valid", "suspended"] {
-        let rejected = server
-            .post(&format!("/admin/v1/credentials/{credential_id}/status"))
-            .add_header("authorization", format!("Bearer {admin_token}"))
-            .json(&json!({ "status": attempted_status }))
-            .await;
-        rejected.assert_status(StatusCode::CONFLICT);
-        let rejected_body: Value = rejected.json();
-        assert_eq!(
-            rejected_body["code"],
-            json!("credential_status.invalid_transition")
-        );
-    }
-
-    let status_after_rejected_mutations = server
-        .get(&format!("/v1/credentials/{credential_id}/status"))
-        .await;
-    status_after_rejected_mutations.assert_status_ok();
-    let status_after_rejected_mutations_body: Value = status_after_rejected_mutations.json();
-    assert_eq!(
-        status_after_rejected_mutations_body["status"],
-        json!("revoked")
-    );
-
-    let records = audit_envelopes(&audit_path)
-        .into_iter()
-        .map(|envelope| envelope.record)
-        .collect::<Vec<_>>();
-    let credential_audit = records
-        .iter()
-        .find(|record| {
-            record["path"] == json!("/oid4vci/credential")
-                && record["decision"] == json!("credential_issued")
-                && record["status"] == json!(200)
-        })
-        .expect("OID4VCI credential audit record exists");
-    assert_eq!(credential_audit["access_mode"], json!("subject_bound"));
-    assert_eq!(
-        credential_audit["purposes"],
-        json!(["citizen_subject_access"])
-    );
-    assert_eq!(credential_audit["protocol"], json!("openid4vci"));
-    assert_eq!(
-        credential_audit["credential_configuration_id"],
-        json!("person_is_alive_sd_jwt")
-    );
-    assert_eq!(
-        credential_audit["credential_profile"],
-        json!("civil_status_sd_jwt")
-    );
-    assert_eq!(credential_audit["target_type"], json!("Person"));
-    assert!(credential_audit["target_ref_hash"].as_str().is_some());
-    assert_eq!(credential_audit["requester_type"], json!("Person"));
-    assert!(credential_audit["requester_ref_hash"].as_str().is_some());
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn oid4vci_field_projection_issues_separate_disclosures() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    );
-    enable_oid4vci_field_projection(&mut config);
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let metadata = server
-        .get("/credentials/civil-status")
-        .add_header("host", "127.0.0.1:4325")
-        .add_header("x-forwarded-proto", "http")
-        .await;
-    metadata.assert_status_ok();
-    let metadata_body: Value = metadata.json();
-    assert_eq!(metadata_body["claims"][0]["path"], json!(["given_name"]));
-    assert_eq!(
-        metadata_body["claims"][0]["display"][0]["label"],
-        json!("Given name")
-    );
-    assert_eq!(metadata_body["claims"][0]["sd"], json!("always"));
-    assert_eq!(metadata_body["claims"][0]["mandatory"], json!(true));
-    assert_eq!(metadata_body["claims"][1]["path"], json!(["birth_date"]));
-    assert_eq!(
-        metadata_body["claims"][1]["display"][0]["label"],
-        json!("Birth date")
-    );
-    assert_eq!(metadata_body["claims"][1]["mandatory"], json!(true));
-
-    let (code, pin) = drive_offer_to_code(&server, &token_upstream, &idp, "person-1").await;
-    let token = redeem_token(&server, &code, &pin).await;
-    token.assert_status_ok();
-    let token_body: Value = token.json();
-    let access_token = token_body["access_token"]
-        .as_str()
-        .expect("access token is returned")
-        .to_string();
-    let nonce = token_body["c_nonce"]
-        .as_str()
-        .expect("nonce is returned")
-        .to_string();
-    let proof = sign_oid4vci_proof("http://127.0.0.1:4325", &nonce);
-
-    let response = server
-        .post("/oid4vci/credential")
-        .add_header("authorization", format!("Bearer {access_token}"))
-        .json(&json!({
-            "format": "dc+sd-jwt",
-            "credential_configuration_id": "person_is_alive_sd_jwt",
-            "proof": {
-                "proof_type": "jwt",
-                "jwt": proof
-            }
-        }))
-        .await;
-    response.assert_status_ok();
-    let body: Value = response.json();
-    let credential = body["credential"].as_str().expect("credential issued");
-    let payload = decode_sd_jwt_payload(credential);
-    assert_eq!(
-        payload["vct"],
-        json!("http://127.0.0.1:4325/credentials/civil-status")
-    );
-    assert_eq!(
-        payload["_sd"]
-            .as_array()
-            .expect("_sd digests are present")
-            .len(),
-        2
-    );
-    let payload_text = payload.to_string();
-    assert!(!payload_text.contains("Miguel"));
-    assert!(!payload_text.contains("2016-01-15"));
-
-    assert_eq!(
-        decode_disclosed_claim(credential, "given_name"),
-        json!("Miguel")
-    );
-    assert_eq!(
-        decode_disclosed_claim(credential, "birth_date"),
-        json!("2016-01-15")
-    );
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn oid4vci_malformed_proof_is_rejected_before_oidc_auth() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-
-    let idp = MockIdp::start().await;
-    let userinfo_hits = Arc::new(AtomicUsize::new(0));
-    let userinfo_hits_for_route = Arc::clone(&userinfo_hits);
-    let userinfo_app = Router::new().route(
-        "/userinfo",
-        get(move || {
-            let userinfo_hits = Arc::clone(&userinfo_hits_for_route);
-            async move {
-                userinfo_hits.fetch_add(1, Ordering::SeqCst);
-                StatusCode::NO_CONTENT
-            }
-        }),
-    );
-    let userinfo_server = TestServer::builder().http_transport().build(userinfo_app);
-    let userinfo_endpoint = userinfo_server
-        .server_url("/userinfo")
-        .expect("userinfo URL builds")
-        .to_string();
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    config.subject_access.subject_binding.claim_source = SubjectAccessClaimSource::Userinfo;
-    config
-        .auth
-        .oidc
-        .as_mut()
-        .expect("oidc config exists")
-        .userinfo_endpoint = Some(userinfo_endpoint.clone());
-    config.oid4vci.pre_authorized_code.esignet.userinfo_url = userinfo_endpoint;
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": "registry-notary-citizen",
-        "azp": "citizen-portal",
-        "scope": "subject_access",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-
-    let response = server
-        .post("/oid4vci/credential")
-        .add_header("authorization", format!("Bearer {token}"))
-        .json(&json!({
-            "format": "dc+sd-jwt",
-            "credential_configuration_id": "person_is_alive_sd_jwt",
-            "proof": {
-                "proof_type": "jwt",
-                "jwt": "not-a-compact-jwt"
-            }
-        }))
-        .await;
-    response.assert_status(StatusCode::BAD_REQUEST);
-    let body: Value = response.json();
-    assert_eq!(body["error"], json!("invalid_proof"));
-    assert!(body.get("code").is_none());
-    assert_eq!(
-        userinfo_hits.load(Ordering::SeqCst),
-        0,
-        "malformed proof must be rejected before the live UserInfo fetch"
-    );
-
-    let response = server
-        .post("/oid4vci/credential")
-        .json(&json!({
-            "format": "dc+sd-jwt",
-            "credential_configuration_id": "person_is_alive_sd_jwt",
-            "target": person_target("person-2"),
-            "proof": {
-                "proof_type": "jwt",
-                "jwt": "not-a-compact-jwt"
-            }
-        }))
-        .await;
-    response.assert_status(StatusCode::BAD_REQUEST);
-    let body: Value = response.json();
-    assert_eq!(body["error"], json!("invalid_proof"));
-
-    idp.stop().await;
-}
diff --git a/crates/registry-notary-server/tests/standalone_http/preauth.rs b/crates/registry-notary-server/tests/standalone_http/preauth.rs
deleted file mode 100644
index 4b23b4ba2..000000000
--- a/crates/registry-notary-server/tests/standalone_http/preauth.rs
+++ /dev/null
@@ -1,2473 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::preauth_support::*;
-use super::support::*;
-#[allow(unused_imports)]
-use super::{
-    admin::*, audit::*, auth::*, credentials::*, federation::*, http_contracts::*, oid4vci::*,
-};
-#[cfg(feature = "registry-notary-cel")]
-use registry_notary_client::verifier::verify_sd_jwt_vc;
-#[cfg(feature = "registry-notary-cel")]
-use registry_notary_client::{
-    HolderBindingPolicy, RegistryNotaryClient, StatusListPolicy, VerifyOptions,
-};
-#[cfg(feature = "registry-notary-cel")]
-use wiremock::ResponseTemplate;
-
-#[tokio::test]
-pub(super) async fn preauth_offer_start_redirects_to_esignet_and_mints_nothing() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let start = server
-        .get("/oid4vci/offer/start?credential_configuration_id=person_is_alive_sd_jwt")
-        .await;
-    start.assert_status(StatusCode::SEE_OTHER);
-    let location = start
-        .headers()
-        .get("location")
-        .expect("redirect location")
-        .to_str()
-        .expect("location is valid")
-        .to_string();
-    assert!(location.starts_with(&format!("{}/authorize", idp.issuer())));
-    assert_eq!(
-        query_param(&location, "response_type").as_deref(),
-        Some("code")
-    );
-    assert_eq!(
-        query_param(&location, "client_id").as_deref(),
-        Some(ESIGNET_RP_CLIENT_ID)
-    );
-    assert_eq!(
-        query_param(&location, "code_challenge_method").as_deref(),
-        Some("S256")
-    );
-    assert!(query_param(&location, "state").is_some());
-    assert!(query_param(&location, "nonce").is_some());
-    assert!(query_param(&location, "claims").is_none());
-    // No code or PIN is in the redirect; nothing is minted.
-    assert!(!location.contains("pre-authorized_code"));
-
-    // The audit log carries no minted material from a start.
-    let audit = std::fs::read_to_string(&audit_path).unwrap_or_default();
-    assert!(!audit.contains("pre-authorized_code"));
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_offer_start_returns_429_when_login_state_store_is_full() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    for _ in 0..4096 {
-        server
-            .get("/oid4vci/offer/start?credential_configuration_id=person_is_alive_sd_jwt")
-            .await
-            .assert_status(StatusCode::SEE_OTHER);
-    }
-
-    let limited = server
-        .get("/oid4vci/offer/start?credential_configuration_id=person_is_alive_sd_jwt")
-        .await;
-    limited.assert_status(StatusCode::TOO_MANY_REQUESTS);
-    assert_eq!(
-        limited.json::<Value>()["error"],
-        json!("temporarily_unavailable")
-    );
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_offer_start_requests_userinfo_subject_binding_claim_when_required() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    );
-    config.subject_access.subject_binding.claim_source = SubjectAccessClaimSource::Userinfo;
-    config.subject_access.subject_binding.token_claim = "individual_id".to_string();
-    config.oid4vci.pre_authorized_code.esignet.userinfo_url =
-        format!("{}/userinfo", token_upstream.url());
-    config
-        .auth
-        .oidc
-        .as_mut()
-        .expect("oidc config exists")
-        .userinfo_endpoint = Some(format!("{}/userinfo", token_upstream.url()));
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let start = server
-        .get("/oid4vci/offer/start?credential_configuration_id=person_is_alive_sd_jwt")
-        .await;
-    start.assert_status(StatusCode::SEE_OTHER);
-    let location = start
-        .headers()
-        .get("location")
-        .expect("redirect location")
-        .to_str()
-        .expect("location is valid")
-        .to_string();
-    let claims =
-        query_param(&location, "claims").expect("redirect requests required userinfo claim");
-    let claims: Value = serde_json::from_str(&claims).expect("claims param is JSON");
-    assert_eq!(
-        claims,
-        json!({
-            "userinfo": {
-                "individual_id": {
-                    "essential": true
-                }
-            }
-        })
-    );
-    assert!(!location.contains("pre-authorized_code"));
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_offer_start_rejects_unknown_configuration_id() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let start = server
-        .get("/oid4vci/offer/start?credential_configuration_id=unknown_config")
-        .await;
-    start.assert_status(StatusCode::BAD_REQUEST);
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_credential_rejects_inline_jwk_holder_proof_before_auth() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let response = server
-        .post("/oid4vci/credential")
-        .json(&json!({
-            "format": "dc+sd-jwt",
-            "credential_configuration_id": "person_is_alive_sd_jwt",
-            "proof": {
-                "proof_type": "jwt",
-                "jwt": sign_oid4vci_inline_jwk_proof(NOTARY_ISSUER, "transaction-nonce")
-            }
-        }))
-        .await;
-    response.assert_status(StatusCode::BAD_REQUEST);
-    let body: Value = response.json();
-    assert_eq!(body["error"], json!("invalid_proof"));
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_callback_mints_pre_authorized_offer_with_tx_code() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let (code, pin) = drive_offer_to_code(&server, &token_upstream, &idp, "person-1").await;
-    assert!(!code.is_empty(), "callback mints a pre-authorized_code");
-    assert_eq!(
-        jwt_payload(&code)["tx_code_required"],
-        json!(true),
-        "the signed offer code binds its PIN requirement"
-    );
-    assert_eq!(pin.len(), 6, "tx_code is a 6-digit PIN");
-    assert!(pin.chars().all(|c| c.is_ascii_digit()));
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_callback_omits_tx_code_when_optional() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    );
-    config.oid4vci.pre_authorized_code.tx_code.required = false;
-    config
-        .oid4vci
-        .pre_authorized_code
-        .pre_authorized_code_ttl_seconds = 120;
-    config
-        .subject_access
-        .rate_limits
-        .tx_code_attempts_per_code_per_minute = 0;
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let page = drive_offer_to_page(&server, &token_upstream, &idp, "person-1").await;
-    assert!(
-        !page.code.is_empty(),
-        "callback mints a pre-authorized_code"
-    );
-    assert!(page.pin.is_none(), "offer page does not show a PIN");
-    assert!(
-        !page.html.contains("id=\"tx-code\""),
-        "optional tx_code mode omits the PIN block"
-    );
-    assert!(
-        page.offer["grants"]["urn:ietf:params:oauth:grant-type:pre-authorized_code"]["tx_code"]
-            .is_null(),
-        "credential offer omits the tx_code object"
-    );
-    idp.stop().await;
-}
-
-/// eSignet signs ID Tokens with a JOSE header that omits the optional `typ`
-/// member (observed live: `{"alg":"PS256","kid":...}`). The pre-auth callback
-/// must accept such an id_token and mint the offer. Regression guard for the
-/// Wave 5 hosted blocker where a typ-less id_token was rejected as
-/// `invalid_token` before the nonce/userinfo checks ran.
-#[tokio::test]
-pub(super) async fn preauth_callback_accepts_esignet_id_token_without_typ_header() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let start = server
-        .get("/oid4vci/offer/start?credential_configuration_id=person_is_alive_sd_jwt")
-        .await;
-    start.assert_status(StatusCode::SEE_OTHER);
-    let location = start
-        .headers()
-        .get("location")
-        .expect("offer start redirects")
-        .to_str()
-        .expect("location is valid")
-        .to_string();
-    let state = query_param(&location, "state").expect("redirect carries state");
-    let nonce = query_param(&location, "nonce").expect("redirect carries nonce");
-
-    // Mint the eSignet id_token WITHOUT a `typ` header, as eSignet does.
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let id_token = idp.mint_token_without_typ(json!({
-        "sub": "esignet-citizen-subject",
-        "aud": ESIGNET_RP_CLIENT_ID,
-        "nonce": nonce,
-        "national_id": "person-1",
-        "scope": "openid subject_access",
-        "acr": "urn:example:loa:substantial",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    // The test id_token must genuinely omit `typ` for this to exercise the fix.
-    let header_b64 = id_token
-        .split('.')
-        .next()
-        .expect("jwt has a header segment");
-    let header: Value = serde_json::from_slice(
-        &URL_SAFE_NO_PAD
-            .decode(header_b64)
-            .expect("header is base64url"),
-    )
-    .expect("header is JSON");
-    assert!(
-        header.get("typ").is_none(),
-        "test id_token must omit the typ header"
-    );
-
-    token_upstream
-        .expect("POST", "/token")
-        .respond_json(
-            200,
-            json!({
-                "access_token": "esignet-access-token",
-                "token_type": "Bearer",
-                "id_token": id_token,
-                "expires_in": 300,
-            }),
-        )
-        .await;
-
-    let callback = server
-        .get(&format!(
-            "/oid4vci/offer/callback?code=esignet-code-123&state={state}"
-        ))
-        .await;
-    callback.assert_status_ok();
-    let html = callback.text();
-    let offer_uri = extract_between(&html, "href=\"", "\"").expect("offer href present");
-    let offer_json =
-        query_param(&offer_uri, "credential_offer").expect("offer carries credential_offer");
-    let offer: Value = serde_json::from_str(&offer_json).expect("offer is JSON");
-    let code = offer["grants"]["urn:ietf:params:oauth:grant-type:pre-authorized_code"]
-        ["pre-authorized_code"]
-        .as_str()
-        .expect("offer carries pre-authorized_code");
-    assert!(
-        !code.is_empty(),
-        "a typ-less eSignet id_token still mints a pre-authorized_code"
-    );
-    idp.stop().await;
-}
-
-/// When the eSignet RP client signing key is RS256, the `private_key_jwt`
-/// client assertion the Notary sends to the eSignet token endpoint must carry
-/// header `alg: RS256` and verify against the RP RSA public key. This proves the
-/// RS256 RP key path end to end: the callback exchanges the eSignet code, which
-/// signs the assertion with the configured RS256 key.
-#[cfg(feature = "registry-notary-cel")]
-#[tokio::test]
-pub(super) async fn preauth_client_assertion_is_rs256_signed_when_rp_key_is_rsa() {
-    set_preauth_env();
-    std::env::set_var("TEST_ESIGNET_RP_RSA_JWK", TEST_ESIGNET_RP_RSA_JWK);
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    );
-    // Swap the eSignet RP client signing key for an RSA/RS256 key.
-    config.evidence.signing_keys.insert(
-        "esignet-rp-key".to_string(),
-        SigningKeyConfig {
-            provider: SigningKeyProviderConfig::LocalJwkEnv,
-            alg: "RS256".to_string(),
-            kid: "did:web:rp.example#esignet-rp-rsa-key".to_string(),
-            status: SigningKeyStatus::Active,
-            publish_until_unix_seconds: None,
-            private_jwk_env: "TEST_ESIGNET_RP_RSA_JWK".to_string(),
-            public_jwk_env: String::new(),
-            module_path: String::new(),
-            token_label: String::new(),
-            pin_env: String::new(),
-            key_label: String::new(),
-            key_id_hex: String::new(),
-            path: String::new(),
-            password_env: String::new(),
-        },
-    );
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let (code, _pin) = drive_offer_to_code(&server, &token_upstream, &idp, "person-1").await;
-    assert!(!code.is_empty(), "callback mints a pre-authorized_code");
-
-    // Capture the token-endpoint POST the Notary sent and pull out the
-    // client_assertion form field.
-    let requests = token_upstream
-        .wiremock_server()
-        .received_requests()
-        .await
-        .expect("wiremock records requests");
-    let token_request = requests
-        .iter()
-        .find(|request| request.url.path() == "/token")
-        .expect("the Notary posts to the eSignet token endpoint");
-    let body = String::from_utf8(token_request.body.clone()).expect("token request body is UTF-8");
-    let client_assertion = form_field(&body, "client_assertion")
-        .expect("the token request carries a client_assertion");
-
-    // The JOSE header alg must be RS256 (derived from the RP RSA key).
-    let header = jwt_header(&client_assertion);
-    assert_eq!(
-        header["alg"], "RS256",
-        "the client assertion is signed with the RP key's RS256 algorithm"
-    );
-    assert_eq!(header["typ"], "JWT");
-    assert_eq!(header["kid"], "did:web:rp.example#esignet-rp-rsa-key");
-
-    // The signature must verify against the RP RSA public key.
-    let rp_private = PrivateJwk::parse(TEST_ESIGNET_RP_RSA_JWK).expect("RP RSA JWK parses");
-    let rp_public = rp_private.public();
-    let mut segments = client_assertion.split('.');
-    let header_b64 = segments.next().expect("assertion has a header segment");
-    let payload_b64 = segments.next().expect("assertion has a payload segment");
-    let signature_b64 = segments.next().expect("assertion has a signature segment");
-    let signing_input = format!("{header_b64}.{payload_b64}");
-    let signature = URL_SAFE_NO_PAD
-        .decode(signature_b64)
-        .expect("signature is base64url");
-    verify(signing_input.as_bytes(), &signature, &rp_public)
-        .expect("the RS256 client assertion verifies against the RP RSA public key");
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_token_endpoint_issues_access_token_and_c_nonce() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let (code, pin) = drive_offer_to_code(&server, &token_upstream, &idp, "person-1").await;
-    let token = redeem_token(&server, &code, &pin).await;
-    token.assert_status_ok();
-    let body: Value = token.json();
-    assert!(body["access_token"].is_string());
-    assert_eq!(body["token_type"], json!("Bearer"));
-    assert!(body["c_nonce"].is_string());
-    assert_eq!(body["expires_in"], json!(300));
-
-    let access_token = body["access_token"].as_str().expect("access token minted");
-    let claims = jwt_payload(access_token);
-    assert_eq!(
-        claims["credential_configuration_id"],
-        json!("person_is_alive_sd_jwt")
-    );
-    let scopes: BTreeSet<&str> = claims["scope"]
-        .as_str()
-        .expect("scope claim is present")
-        .split(' ')
-        .collect();
-    assert!(scopes.contains("subject_access"));
-    assert!(scopes.contains("person-is-alive"));
-    assert_eq!(
-        claims["authorization_details"][0]["type"],
-        json!("registry_notary_evidence_transaction")
-    );
-    assert_eq!(
-        claims["authorization_details"][0]["schema_version"],
-        json!("registry-notary-authorization-details/v1")
-    );
-    assert_eq!(
-        claims["authorization_details"][0]["actions"],
-        json!(["evaluate"])
-    );
-    assert_eq!(
-        claims["authorization_details"][0]["locations"],
-        json!(["evidence.test"])
-    );
-    assert_eq!(
-        claims["authorization_details"][0]["claims"][0]["id"],
-        json!("person-is-alive")
-    );
-    assert_eq!(
-        claims["authorization_details"][0]["disclosure"],
-        json!("value")
-    );
-    assert_eq!(
-        claims["authorization_details"][0]["format"],
-        json!("application/vnd.registry-notary.claim-result+json")
-    );
-    assert_eq!(
-        claims["authorization_details"][0]["purpose"],
-        json!("citizen_subject_access")
-    );
-    assert_eq!(
-        claims["authorization_details"][0]["access_mode"],
-        json!("subject_bound")
-    );
-    assert_eq!(
-        claims["authorization_details"][0]["subject"],
-        json!({
-            "binding_claim": "national_id",
-            "id_type": "national_id"
-        })
-    );
-    idp.stop().await;
-}
-
-/// Issue #173: when the access-token signing key and a credential-profile
-/// signing key resolve to the same Ed25519 material under distinct ids and
-/// kids, server startup must fail through the real build path
-/// (`compile_notary_runtime` -> `SigningKeyRegistry::from_config`), not just the
-/// in-isolation helper. The eSignet RP client key is excluded from this scope by
-/// `admin_config_apply_signed_preauth_signing_rotation_preserves_inflight_tokens`.
-#[tokio::test]
-pub(super) async fn compile_rejects_access_token_key_reusing_credential_key_material() {
-    set_preauth_env();
-    // A dedicated env var bound to the credential issuer's material. The
-    // credential `issuer-key` resolves from `TEST_CREDENTIAL_ISSUER_JWK`,
-    // which `set_preauth_env` also sets to `TEST_ISSUER_JWK`, so the new
-    // access-token key reuses the credential key material under a distinct
-    // id/kid.
-    std::env::set_var("TEST_ACCESS_TOKEN_REUSES_CREDENTIAL_JWK", TEST_ISSUER_JWK);
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = preauth_test_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp,
-        &token_upstream,
-    );
-    config.evidence.signing_keys.insert(
-        "access-token-key-reuses-credential".to_string(),
-        local_jwk_signing_key(
-            "TEST_ACCESS_TOKEN_REUSES_CREDENTIAL_JWK",
-            "did:web:issuer.example#access-token-key-reuses-credential",
-        ),
-    );
-    config.auth.access_token_signing.signing_key_id =
-        "access-token-key-reuses-credential".to_string();
-
-    let error = match compile_notary_runtime(config) {
-        Ok(_) => panic!("reused signing key material must fail startup"),
-        Err(error) => error,
-    };
-    let message = error.to_string();
-    assert!(
-        message.contains("reuses public key material"),
-        "unexpected error: {message}"
-    );
-    assert!(
-        message.contains("access-token-key-reuses-credential") || message.contains("issuer-key"),
-        "error must name the colliding signing key ids: {message}"
-    );
-    // The error must never leak key material (thumbprint or raw JWK coordinate).
-    assert!(
-        !message.contains(TEST_ISSUER_JWK),
-        "error must not contain raw key material"
-    );
-    idp.stop().await;
-}
-
-/// A userinfo-sourced subject binding (`claim_source = userinfo`) reads the
-/// binding claim from the eSignet userinfo JWS, not the `id_token`. This mirrors
-/// the hosted lab, where eSignet delivers `individual_id` only via userinfo.
-#[tokio::test]
-pub(super) async fn preauth_callback_binds_subject_from_userinfo_when_claim_source_is_userinfo() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    );
-    config.subject_access.subject_binding.claim_source = SubjectAccessClaimSource::Userinfo;
-    config.subject_access.subject_binding.token_claim = "individual_id".to_string();
-    config.oid4vci.pre_authorized_code.esignet.userinfo_url =
-        format!("{}/userinfo", token_upstream.url());
-    config
-        .auth
-        .oidc
-        .as_mut()
-        .expect("oidc config exists")
-        .userinfo_endpoint = Some(format!("{}/userinfo", token_upstream.url()));
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    // The id_token (minted by drive_offer_to_code) carries no individual_id;
-    // the userinfo JWS supplies it, bound to the same subject.
-    let userinfo = idp.mint_token(json!({
-        "sub": "esignet-citizen-subject",
-        "aud": ESIGNET_RP_CLIENT_ID,
-        "individual_id": "civil-id-9001",
-    }));
-    token_upstream
-        .expect("GET", "/userinfo")
-        .respond_body(200, userinfo)
-        .await;
-
-    let (code, pin) = drive_offer_to_code(&server, &token_upstream, &idp, "person-1").await;
-    let token = redeem_token(&server, &code, &pin).await;
-    token.assert_status_ok();
-    let body: Value = token.json();
-    let access_token = body["access_token"].as_str().expect("access token minted");
-    let claims = jwt_payload(access_token);
-    assert_eq!(
-        claims["individual_id"],
-        json!("civil-id-9001"),
-        "subject binding must come from the userinfo JWS, not the id_token"
-    );
-    idp.stop().await;
-}
-
-/// When the subject binding is userinfo-sourced but the userinfo JWS omits the
-/// binding claim, the callback denies the login and mints no code.
-#[tokio::test]
-pub(super) async fn preauth_callback_denies_when_userinfo_lacks_subject_binding_claim() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    );
-    config.subject_access.subject_binding.claim_source = SubjectAccessClaimSource::Userinfo;
-    config.subject_access.subject_binding.token_claim = "individual_id".to_string();
-    config.oid4vci.pre_authorized_code.esignet.userinfo_url =
-        format!("{}/userinfo", token_upstream.url());
-    config
-        .auth
-        .oidc
-        .as_mut()
-        .expect("oidc config exists")
-        .userinfo_endpoint = Some(format!("{}/userinfo", token_upstream.url()));
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    // userinfo JWS bound to the subject but without the binding claim.
-    let userinfo = idp.mint_token(json!({
-        "sub": "esignet-citizen-subject",
-        "aud": ESIGNET_RP_CLIENT_ID,
-    }));
-    token_upstream
-        .expect("GET", "/userinfo")
-        .respond_body(200, userinfo)
-        .await;
-
-    let start = server
-        .get("/oid4vci/offer/start?credential_configuration_id=person_is_alive_sd_jwt")
-        .await;
-    start.assert_status(StatusCode::SEE_OTHER);
-    let location = start
-        .headers()
-        .get("location")
-        .expect("offer start redirects")
-        .to_str()
-        .expect("location is valid")
-        .to_string();
-    let state = query_param(&location, "state").expect("redirect carries state");
-    let nonce = query_param(&location, "nonce").expect("redirect carries nonce");
-    let id_token = esignet_id_token(&idp, &nonce, "person-1");
-    token_upstream
-        .expect("POST", "/token")
-        .respond_json(
-            200,
-            json!({
-                "access_token": "esignet-access-token",
-                "token_type": "Bearer",
-                "id_token": id_token,
-                "expires_in": 300,
-            }),
-        )
-        .await;
-    let callback = server
-        .get(&format!(
-            "/oid4vci/offer/callback?code=esignet-code-123&state={state}"
-        ))
-        .await;
-    assert_ne!(
-        callback.status_code(),
-        StatusCode::OK,
-        "a userinfo response missing the binding claim must deny the callback"
-    );
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_code_is_single_use() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let (code, pin) = drive_offer_to_code(&server, &token_upstream, &idp, "person-1").await;
-    redeem_token(&server, &code, &pin).await.assert_status_ok();
-    let second = redeem_token(&server, &code, &pin).await;
-    second.assert_status(StatusCode::BAD_REQUEST);
-    let body: Value = second.json();
-    assert_eq!(body["error"], json!("invalid_grant"));
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_token_rejects_wrong_and_missing_tx_code() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let (code, _pin) = drive_offer_to_code(&server, &token_upstream, &idp, "person-1").await;
-
-    let wrong_pin = redeem_token(&server, &code, "000000").await;
-    wrong_pin.assert_status(StatusCode::BAD_REQUEST);
-    assert_eq!(
-        wrong_pin.json::<Value>()["error"],
-        json!("invalid_grant"),
-        "a wrong tx_code is rejected"
-    );
-
-    let missing_pin = server
-        .post("/oid4vci/token")
-        .add_header("content-type", "application/x-www-form-urlencoded")
-        .text(format!(
-            "grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code&pre-authorized_code={}",
-            urlencode(&code)
-        ))
-        .await;
-    missing_pin.assert_status(StatusCode::BAD_REQUEST);
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_token_accepts_missing_tx_code_when_optional() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    );
-    config.oid4vci.pre_authorized_code.tx_code.required = false;
-    config
-        .oid4vci
-        .pre_authorized_code
-        .pre_authorized_code_ttl_seconds = 120;
-    config
-        .subject_access
-        .rate_limits
-        .tx_code_attempts_per_code_per_minute = 0;
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let page = drive_offer_to_page(&server, &token_upstream, &idp, "person-1").await;
-    assert!(
-        page.pin.is_none(),
-        "optional tx_code mode does not mint a PIN"
-    );
-    assert_eq!(
-        jwt_payload(&page.code)["tx_code_required"],
-        json!(false),
-        "the signed offer code binds its no-PIN policy"
-    );
-    redeem_token_without_pin(&server, &page.code)
-        .await
-        .assert_status_ok();
-
-    let second = redeem_token_without_pin(&server, &page.code).await;
-    second.assert_status(StatusCode::BAD_REQUEST);
-    assert_eq!(second.json::<Value>()["error"], json!("invalid_grant"));
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_signed_required_policy_and_lockout_survive_optional_runtime_config() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    );
-    config.oid4vci.pre_authorized_code.tx_code.required = false;
-    config
-        .oid4vci
-        .pre_authorized_code
-        .pre_authorized_code_ttl_seconds = 120;
-    config
-        .subject_access
-        .rate_limits
-        .tx_code_attempts_per_code_per_minute = 2;
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let issued = drive_offer_to_page(&server, &token_upstream, &idp, "person-1").await;
-    let mut payload = jwt_payload(&issued.code);
-    payload["jti"] = json!(Ulid::new().to_string());
-    payload["tx_code_required"] = json!(true);
-    let signed_required_code = sign_test_preauthorized_code(payload);
-
-    for wrong_pin in ["111111", "222222"] {
-        let response = redeem_token(&server, &signed_required_code, wrong_pin).await;
-        response.assert_status(StatusCode::BAD_REQUEST);
-        assert_eq!(response.json::<Value>()["error"], json!("invalid_grant"));
-    }
-    let locked = redeem_token(&server, &signed_required_code, "333333").await;
-    locked.assert_status(StatusCode::TOO_MANY_REQUESTS);
-    assert_eq!(locked.json::<Value>()["error"], json!("slow_down"));
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_forged_optional_code_without_reserved_transaction_is_rejected() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let issued = drive_offer_to_page(&server, &token_upstream, &idp, "person-1").await;
-    let mut payload = jwt_payload(&issued.code);
-    payload["jti"] = json!(Ulid::new().to_string());
-    payload["tx_code_required"] = json!(false);
-    let signed_optional_code = sign_test_preauthorized_code(payload);
-
-    let response = redeem_token_without_pin(&server, &signed_optional_code).await;
-    response.assert_status(StatusCode::BAD_REQUEST);
-    assert_eq!(response.json::<Value>()["error"], json!("invalid_grant"));
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_token_rejects_missing_or_non_boolean_signed_tx_code_policy() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let issued = drive_offer_to_page(&server, &token_upstream, &idp, "person-1").await;
-    let baseline = jwt_payload(&issued.code);
-    for malformed_policy in [None, Some(json!("true"))] {
-        let mut payload = baseline.clone();
-        payload["jti"] = json!(Ulid::new().to_string());
-        match malformed_policy {
-            Some(value) => payload["tx_code_required"] = value,
-            None => {
-                payload
-                    .as_object_mut()
-                    .expect("JWT payload is an object")
-                    .remove("tx_code_required");
-            }
-        }
-        let response =
-            redeem_token_without_pin(&server, &sign_test_preauthorized_code(payload)).await;
-        response.assert_status(StatusCode::BAD_REQUEST);
-        assert_eq!(response.json::<Value>()["error"], json!("invalid_grant"));
-    }
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_repeated_wrong_pins_lock_the_code() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    );
-    config
-        .subject_access
-        .rate_limits
-        .tx_code_attempts_per_code_per_minute = 2;
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let (code, pin) = drive_offer_to_code(&server, &token_upstream, &idp, "person-1").await;
-
-    // Two wrong attempts are within the cap; the third trips the limiter and the
-    // code is locked, so even the correct PIN now fails.
-    redeem_token(&server, &code, "111111")
-        .await
-        .assert_status(StatusCode::BAD_REQUEST);
-    redeem_token(&server, &code, "222222")
-        .await
-        .assert_status(StatusCode::BAD_REQUEST);
-    let locked = redeem_token(&server, &code, &pin).await;
-    locked.assert_status(StatusCode::TOO_MANY_REQUESTS);
-    let body: Value = locked.json();
-    assert_eq!(body["error"], json!("slow_down"));
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_token_rejects_wrong_and_missing_grant_cleanly() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let other_grant = server
-        .post("/oid4vci/token")
-        .add_header("content-type", "application/x-www-form-urlencoded")
-        .text("grant_type=authorization_code&code=abc")
-        .await;
-    other_grant.assert_status(StatusCode::BAD_REQUEST);
-    assert_eq!(
-        other_grant.json::<Value>()["error"],
-        json!("unsupported_grant_type")
-    );
-
-    let missing_grant = server
-        .post("/oid4vci/token")
-        .add_header("content-type", "application/x-www-form-urlencoded")
-        .text("foo=bar")
-        .await;
-    missing_grant.assert_status(StatusCode::BAD_REQUEST);
-    assert_eq!(
-        missing_grant.json::<Value>()["error"],
-        json!("invalid_request")
-    );
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_random_code_flood_is_throttled_per_client_address() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = subject_access_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    );
-    config
-        .subject_access
-        .rate_limits
-        .invalid_token_per_client_address_per_minute = 2;
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().http_transport().build(app);
-
-    // Random codes from one socket peer: caller-supplied forwarding headers do
-    // not create fresh buckets.
-    let flood = |code: &str, forwarded_for: &str| {
-        server
-            .post("/oid4vci/token")
-            .add_header("content-type", "application/x-www-form-urlencoded")
-            .add_header("x-forwarded-for", forwarded_for)
-            .text(format!(
-                "grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code&pre-authorized_code={code}&tx_code=000000"
-            ))
-    };
-    flood("random-a", "203.0.113.50")
-        .await
-        .assert_status(StatusCode::BAD_REQUEST);
-    flood("random-b", "203.0.113.51")
-        .await
-        .assert_status(StatusCode::BAD_REQUEST);
-    let throttled = flood("random-c", "203.0.113.52").await;
-    throttled.assert_status(StatusCode::TOO_MANY_REQUESTS);
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_disabled_exposes_no_wallet_issuance_grant() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    // Default config: pre-auth disabled.
-    let mut config = subject_access_oid4vci_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-    );
-    config.oid4vci.enabled = false;
-    config.oid4vci.pre_authorized_code = Default::default();
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    server
-        .get("/oid4vci/offer/start?credential_configuration_id=person_is_alive_sd_jwt")
-        .await
-        .assert_status(StatusCode::NOT_FOUND);
-    server
-        .get("/oid4vci/offer/callback?code=x&state=y")
-        .await
-        .assert_status(StatusCode::NOT_FOUND);
-    server
-        .post("/oid4vci/token")
-        .add_header("content-type", "application/x-www-form-urlencoded")
-        .text("grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code&pre-authorized_code=x&tx_code=1")
-        .await
-        .assert_status(StatusCode::NOT_FOUND);
-
-    server
-        .get("/oid4vci/credential-offer")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-    server
-        .post("/oid4vci/nonce")
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-
-    // Disabling the only supported issuance grant disables issuer metadata.
-    let metadata = server.get("/.well-known/openid-credential-issuer").await;
-    metadata.assert_status(StatusCode::NOT_FOUND);
-    idp.stop().await;
-}
-
-/// Manually mint a Notary access token (header.payload.signature) so trust-anchor
-/// tests can sign with the access-token key, the credential key, or a wrong key.
-pub(super) fn mint_notary_access_token(
-    private_jwk: &str,
-    kid: &str,
-    typ: &str,
-    issuer: &str,
-    national_id: &str,
-) -> String {
-    mint_notary_access_token_with_scope_and_authorization_details(
-        private_jwk,
-        kid,
-        typ,
-        issuer,
-        national_id,
-        "subject_access",
-        None,
-    )
-}
-
-pub(super) fn mint_notary_access_token_with_scope_and_authorization_details(
-    private_jwk: &str,
-    kid: &str,
-    typ: &str,
-    issuer: &str,
-    national_id: &str,
-    scope: &str,
-    authorization_details: Option<Value>,
-) -> String {
-    mint_notary_access_token_with_jti_scope_and_authorization_details(
-        private_jwk,
-        kid,
-        typ,
-        issuer,
-        national_id,
-        None,
-        scope,
-        authorization_details,
-    )
-}
-
-#[allow(clippy::too_many_arguments)]
-pub(super) fn mint_notary_access_token_with_jti_scope_and_authorization_details(
-    private_jwk: &str,
-    kid: &str,
-    typ: &str,
-    issuer: &str,
-    national_id: &str,
-    jti: Option<&str>,
-    scope: &str,
-    authorization_details: Option<Value>,
-) -> String {
-    let key = PrivateJwk::parse(private_jwk).expect("test JWK parses");
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let header = json!({ "alg": "EdDSA", "typ": typ, "kid": kid });
-    let mut payload = json!({
-        "iss": issuer,
-        "aud": NOTARY_AUDIENCE,
-        "sub": "esignet-citizen-subject",
-        "client_id": ESIGNET_RP_CLIENT_ID,
-        "scope": scope,
-        "national_id": national_id,
-        "token_type": "Bearer",
-        "credential_configuration_id": "person_is_alive_sd_jwt",
-        "iat": now,
-        "nbf": now,
-        "exp": now + 300,
-    });
-    if let Some(jti) = jti {
-        payload
-            .as_object_mut()
-            .expect("payload is an object")
-            .insert("jti".to_string(), json!(jti));
-    }
-    if let Some(authorization_details) = authorization_details {
-        payload
-            .as_object_mut()
-            .expect("payload is an object")
-            .insert("authorization_details".to_string(), authorization_details);
-    }
-    let header_b64 = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&header).expect("header"));
-    let payload_b64 = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&payload).expect("payload"));
-    let signing_input = format!("{header_b64}.{payload_b64}");
-    let signature = sign(signing_input.as_bytes(), &key).expect("token signs");
-    format!("{signing_input}.{}", URL_SAFE_NO_PAD.encode(signature))
-}
-
-pub(super) fn preauth_test_config(
-    base_url: &str,
-    audit_path: &str,
-    idp: &MockIdp,
-    token_upstream: &MockHttpUpstream,
-) -> StandaloneRegistryNotaryConfig {
-    subject_access_preauth_config(
-        base_url,
-        audit_path,
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    )
-}
-
-#[tokio::test]
-pub(super) async fn preauth_trust_anchor_rejects_wrong_key_and_credential_key_notary_tokens() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(preauth_test_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp,
-        &token_upstream,
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    // Use a protected route without a proof precheck, so the trust-anchor
-    // verification alone decides the outcome.
-    // A Notary-issuer token signed by the WRONG key (the holder key) is rejected.
-    let wrong_key_token = mint_notary_access_token(
-        TEST_HOLDER_JWK,
-        "did:web:issuer.example#access-token-key",
-        "registry-notary-access+jwt",
-        NOTARY_ISSUER,
-        "person-1",
-    );
-    server
-        .get("/v1/claims")
-        .add_header("authorization", format!("Bearer {wrong_key_token}"))
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-
-    // A Notary-issuer token signed by the CREDENTIAL key is rejected (the second
-    // anchor verifies only against the dedicated access-token key).
-    let credential_key_token = mint_notary_access_token(
-        TEST_ISSUER_JWK,
-        "did:web:issuer.example#access-token-key",
-        "registry-notary-access+jwt",
-        NOTARY_ISSUER,
-        "person-1",
-    );
-    server
-        .get("/v1/claims")
-        .add_header("authorization", format!("Bearer {credential_key_token}"))
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_transaction_token_jti_denials_are_stable_and_redacted() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = preauth_test_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp,
-        &token_upstream,
-    );
-    config.auth.access_token_signing.token_typ = NOTARY_TRANSACTION_TOKEN_JWT_TYP.to_string();
-    let app = standalone_router(config)
-        .await
-        .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let missing_jti_token = mint_notary_access_token(
-        TEST_ACCESS_TOKEN_JWK,
-        "did:web:issuer.example#access-token-key",
-        NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-        NOTARY_ISSUER,
-        "person-1",
-    );
-    let missing_jti = server
-        .get("/v1/claims")
-        .add_header("authorization", format!("Bearer {missing_jti_token}"))
-        .await;
-    missing_jti.assert_status(StatusCode::UNAUTHORIZED);
-    let missing_jti_body: Value = missing_jti.json();
-    assert_eq!(missing_jti_body["code"], json!("auth.missing_credential"));
-    assert!(missing_jti_body.get("data").is_none());
-    assert!(!missing_jti_body.to_string().contains(&missing_jti_token));
-
-    let replay_token = mint_notary_access_token_with_jti_scope_and_authorization_details(
-        TEST_ACCESS_TOKEN_JWK,
-        "did:web:issuer.example#access-token-key",
-        NOTARY_TRANSACTION_TOKEN_JWT_TYP,
-        NOTARY_ISSUER,
-        "person-1",
-        Some("txn-jti-http-replay-1"),
-        "subject_access",
-        Some(json!([{
-            "type": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE,
-            "schema_version": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION,
-            "actions": ["evaluate"],
-            "locations": ["evidence.test"]
-        }])),
-    );
-    let first_use = server
-        .get("/v1/claims")
-        .add_header("authorization", format!("Bearer {replay_token}"))
-        .await;
-    first_use.assert_status_ok();
-    let first_use_body: Value = first_use.json();
-    assert!(first_use_body["data"].is_array());
-
-    let replay = server
-        .get("/v1/claims")
-        .add_header("authorization", format!("Bearer {replay_token}"))
-        .await;
-    replay.assert_status(StatusCode::UNAUTHORIZED);
-    let replay_body: Value = replay.json();
-    assert_eq!(replay_body["code"], json!("auth.missing_credential"));
-    assert!(replay_body.get("data").is_none());
-    assert!(!replay_body.to_string().contains(&replay_token));
-    assert!(!replay_body.to_string().contains("txn-jti-http-replay-1"));
-
-    let multi_auth = server
-        .get("/v1/claims")
-        .add_header("x-api-key", "api-token")
-        .add_header("authorization", format!("Bearer {replay_token}"))
-        .await;
-    multi_auth.assert_status(StatusCode::BAD_REQUEST);
-    let multi_auth_body: Value = multi_auth.json();
-    assert_eq!(multi_auth_body["code"], json!("auth.multiple_credentials"));
-    assert!(multi_auth_body.get("data").is_none());
-    assert!(!multi_auth_body.to_string().contains(&replay_token));
-    assert!(!multi_auth_body.to_string().contains("api-token"));
-    assert!(!multi_auth_body
-        .to_string()
-        .contains("txn-jti-http-replay-1"));
-
-    let audit = std::fs::read_to_string(&audit_path).expect("audit was written");
-    assert!(!audit.contains(&missing_jti_token));
-    assert!(!audit.contains(&replay_token));
-    assert!(!audit.contains("api-token"));
-    assert!(!audit.contains("txn-jti-http-replay-1"));
-    assert!(!audit.contains("person-1"));
-    let records = audit_envelopes(&audit_path)
-        .into_iter()
-        .map(|envelope| envelope.record)
-        .collect::<Vec<_>>();
-    assert!(records
-        .iter()
-        .any(|record| record["path"] == json!("/v1/claims") && record["status"] == json!(200)));
-    let missing_credential_denials = records
-        .iter()
-        .filter(|record| {
-            record["path"] == json!("/v1/claims")
-                && record["status"] == json!(401)
-                && record["error_code"] == json!("auth.missing_credential")
-        })
-        .count();
-    assert!(
-        missing_credential_denials >= 2,
-        "missing-jti and replay denials should both be audited: {records:?}"
-    );
-    assert!(records.iter().any(|record| {
-        record["path"] == json!("/v1/claims")
-            && record["status"] == json!(400)
-            && record["error_code"] == json!("auth.multiple_credentials")
-    }));
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_trust_anchor_isolates_esignet_and_notary_paths() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(preauth_test_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp,
-        &token_upstream,
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    // A token claiming the Notary issuer but actually an eSignet-minted token
-    // fails: the Notary anchor verifies it against the access-token key only.
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let esignet_token_claiming_notary_iss = idp.mint_token(json!({
-        "iss": NOTARY_ISSUER,
-        "sub": "esignet-citizen-subject",
-        "aud": NOTARY_AUDIENCE,
-        "azp": ESIGNET_RP_CLIENT_ID,
-        "scope": "subject_access",
-        "national_id": "person-1",
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    server
-        .get("/v1/claims")
-        .add_header(
-            "authorization",
-            format!("Bearer {esignet_token_claiming_notary_iss}"),
-        )
-        .await
-        .assert_status(StatusCode::UNAUTHORIZED);
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_existing_esignet_token_still_authenticates_credential_endpoint() {
-    // The unchanged eSignet single-issuer path still accepts an eSignet token.
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(preauth_test_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp,
-        &token_upstream,
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    // An eSignet-issued token (issuer == eSignet) on the unchanged path.
-    let esignet_token = idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": NOTARY_AUDIENCE,
-        "azp": "citizen-portal",
-        "scope": "subject_access",
-        "national_id": "person-1",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    // It passes the protected JWKS route (auth succeeds) on the eSignet path.
-    let jwks = server
-        .get("/.well-known/evidence/jwks.json")
-        .add_header("authorization", format!("Bearer {esignet_token}"))
-        .await;
-    jwks.assert_status_ok();
-    idp.stop().await;
-}
-
-#[tokio::test]
-pub(super) async fn preauth_notary_access_token_with_empty_authorization_details_cannot_issue_credential(
-) {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(preauth_test_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp,
-        &token_upstream,
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let old_shape_token = mint_notary_access_token_with_scope_and_authorization_details(
-        TEST_ACCESS_TOKEN_JWK,
-        "did:web:issuer.example#access-token-key",
-        "registry-notary-access+jwt",
-        NOTARY_ISSUER,
-        "person-1",
-        "subject_access person-is-alive",
-        Some(json!([])),
-    );
-    let proof = sign_oid4vci_proof(NOTARY_ISSUER, "unbound-legacy-nonce");
-
-    let credential = server
-        .post("/oid4vci/credential")
-        .add_header("authorization", format!("Bearer {old_shape_token}"))
-        .json(&json!({
-            "format": "dc+sd-jwt",
-            "credential_configuration_id": "person_is_alive_sd_jwt",
-            "proof": { "proof_type": "jwt", "jwt": proof }
-        }))
-        .await;
-
-    credential.assert_status(StatusCode::FORBIDDEN);
-    assert_eq!(credential.json::<Value>()["error"], json!("access_denied"));
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn preauth_end_to_end_issues_sd_jwt_vc_bound_to_holder() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(preauth_test_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp,
-        &token_upstream,
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    // Issuer metadata advertises the Notary token endpoint when pre-auth is
-    // enabled, so a wallet discovers it can redeem the pre-authorized_code grant.
-    let metadata = server.get("/.well-known/openid-credential-issuer").await;
-    metadata.assert_status_ok();
-    let metadata_body: Value = metadata.json();
-    assert_eq!(
-        metadata_body["token_endpoint"],
-        json!("http://127.0.0.1:4325/oid4vci/token"),
-        "enabled pre-auth advertises the Notary token endpoint"
-    );
-
-    let (code, pin) = drive_offer_to_code(&server, &token_upstream, &idp, "person-1").await;
-    let token = redeem_token(&server, &code, &pin).await;
-    token.assert_status_ok();
-    let token_body: Value = token.json();
-    let access_token = token_body["access_token"]
-        .as_str()
-        .expect("access token issued")
-        .to_string();
-    let c_nonce = token_body["c_nonce"]
-        .as_str()
-        .expect("c_nonce issued")
-        .to_string();
-
-    // The Notary-minted token is accepted at the credential endpoint and issues
-    // an SD-JWT VC bound to the holder's did:jwk proof.
-    let proof = sign_oid4vci_proof(NOTARY_ISSUER, &c_nonce);
-    let credential_request = json!({
-        "format": "dc+sd-jwt",
-        "credential_configuration_id": "person_is_alive_sd_jwt",
-        "proof": { "proof_type": "jwt", "jwt": proof }
-    });
-    let credential = server
-        .post("/oid4vci/credential")
-        .add_header("authorization", format!("Bearer {access_token}"))
-        .json(&credential_request)
-        .await;
-    credential.assert_status_ok();
-    let credential_body: Value = credential.json();
-    assert_eq!(credential_body["format"], json!("dc+sd-jwt"));
-    assert!(credential_body.get("c_nonce").is_none());
-    assert!(credential_body.get("c_nonce_expires_in").is_none());
-    let sd_jwt = credential_body["credential"]
-        .as_str()
-        .expect("credential issued");
-    assert!(sd_jwt.contains('~'), "an SD-JWT VC carries disclosures");
-    let payload = decode_sd_jwt_payload(sd_jwt);
-    assert!(
-        payload["issuanceDate"].as_str().is_some(),
-        "wallet-compatible issuance date alias is present"
-    );
-    assert!(
-        payload["expirationDate"].as_str().is_some(),
-        "wallet-compatible expiration date alias is present"
-    );
-    let retry = server
-        .post("/oid4vci/credential")
-        .add_header("authorization", format!("Bearer {access_token}"))
-        .json(&credential_request)
-        .await;
-    retry.assert_status_ok();
-    assert_eq!(
-        retry.json::<Value>(),
-        credential_body,
-        "an exact retry receives the verbatim cached credential response"
-    );
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn representative_preauth_end_to_end_separates_representative_subject_and_holder()
-{
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let verifier_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = representative_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    );
-    config.credential_status.base_url = verifier_upstream.url();
-    enable_shared_admin_listener(&mut config);
-    config
-        .auth
-        .oidc
-        .as_mut()
-        .expect("OIDC auth is configured")
-        .scope_map
-        .insert(
-            "status_admin".to_string(),
-            vec!["registry_notary:admin".to_string()],
-        );
-    let app = standalone_router(config)
-        .await
-        .expect("representative standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let page = drive_representative_offer_to_page(
-        &server,
-        &token_upstream,
-        &idp,
-        "representative-1",
-        "represented-subject-1",
-    )
-    .await;
-    let code_payload = jwt_payload(&page.code);
-    let pin = page.pin.expect("representative offer includes a PIN");
-    let token = redeem_token(&server, &page.code, &pin).await;
-    token.assert_status_ok();
-    let token_body: Value = token.json();
-    let access_token = token_body["access_token"]
-        .as_str()
-        .expect("access token issued");
-    let access_payload = jwt_payload(access_token);
-    for payload in [&code_payload, &access_payload] {
-        assert!(
-            !payload.to_string().contains("representative-1")
-                && !payload.to_string().contains("esignet-citizen-subject"),
-            "representative identifiers must not cross the wallet boundary"
-        );
-        assert!(payload["sub"]
-            .as_str()
-            .is_some_and(|value| value.starts_with("hmac-sha256:")));
-        assert!(payload["national_id"]
-            .as_str()
-            .is_some_and(|value| value.starts_with("hmac-sha256:")));
-    }
-    let target_handle = access_payload["authorization_details"][0]["target"]["id"]
-        .as_str()
-        .expect("representative access token carries a target handle");
-    assert!(target_handle.starts_with("hmac-sha256:"));
-    assert!(
-        !access_payload.to_string().contains("represented-subject-1"),
-        "the represented subject identifier must not cross the wallet boundary"
-    );
-    assert_eq!(
-        access_payload["authorization_details"][0]["relationship"]["relationship_type"],
-        json!("authorized-representative")
-    );
-
-    let c_nonce = token_body["c_nonce"]
-        .as_str()
-        .expect("transaction-scoped nonce is issued");
-    let proof = sign_oid4vci_proof(NOTARY_ISSUER, c_nonce);
-    let credential = server
-        .post("/oid4vci/credential")
-        .add_header("authorization", format!("Bearer {access_token}"))
-        .json(&json!({
-            "format": "dc+sd-jwt",
-            "credential_configuration_id": "represented_person_is_alive_sd_jwt",
-            "proof": { "proof_type": "jwt", "jwt": proof }
-        }))
-        .await;
-    credential.assert_status_ok();
-    let compact = credential.json::<Value>()["credential"]
-        .as_str()
-        .expect("representative credential is issued")
-        .to_string();
-    let payload = decode_sd_jwt_payload(&compact);
-    let subject = payload["sub"]
-        .as_str()
-        .expect("credential subject pseudonym is present");
-    assert!(subject.starts_with("rnref:v1:hmac-sha256:"));
-    assert_ne!(subject, holder_did_jwk());
-    assert_eq!(payload["cnf"]["kid"], json!(holder_did_jwk()));
-    let credential_id = payload["jti"]
-        .as_str()
-        .expect("representative credential id is present");
-    let status_path = format!("/v1/credentials/{credential_id}/status");
-    assert_eq!(
-        payload["status"]["status_list"]["uri"],
-        json!(format!("{}{status_path}", verifier_upstream.url())),
-        "representative credentials carry verifier-resolvable status"
-    );
-
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let admin_token = idp.mint_token(json!({
-        "sub": "status-admin",
-        "aud": NOTARY_AUDIENCE,
-        "azp": "citizen-portal",
-        "scope": "status_admin",
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    let revoked = server
-        .post(&format!("/admin{status_path}"))
-        .add_header("authorization", format!("Bearer {admin_token}"))
-        .json(&json!({ "status": "revoked" }))
-        .await;
-    revoked.assert_status_ok();
-    assert_eq!(revoked.json::<Value>()["status"], json!("revoked"));
-
-    let status_list = server
-        .get(&status_path)
-        .add_header(header::ACCEPT, "application/statuslist+jwt")
-        .await;
-    status_list.assert_status_ok();
-    let status_list_jwt = status_list.text();
-    let jwks = server
-        .get("/.well-known/evidence/jwks.json")
-        .await
-        .json::<Value>();
-    verifier_upstream
-        .expect("GET", "/.well-known/evidence/jwks.json")
-        .respond_json(200, jwks)
-        .await;
-    verifier_upstream
-        .expect("GET", &status_path)
-        .respond(
-            ResponseTemplate::new(200).set_body_raw(status_list_jwt, "application/statuslist+jwt"),
-        )
-        .await;
-    let verifier = RegistryNotaryClient::builder(verifier_upstream.url())
-        .build()
-        .expect("verifier client builds");
-    let verifier_error = verifier
-        .verify_sd_jwt_vc(
-            &compact,
-            VerifyOptions::new("did:web:issuer.example")
-                .holder_binding(HolderBindingPolicy::RequiredKid(holder_did_jwk()))
-                .status_list(
-                    StatusListPolicy::loopback_for_testing(
-                        "did:web:issuer.example",
-                        verifier_upstream.url(),
-                    )
-                    .expect("loopback verifier policy is valid"),
-                ),
-        )
-        .await
-        .expect_err("verifier observes representative credential revocation");
-    assert_eq!(verifier_error.code(), "status.revoked");
-
-    let audit = std::fs::read_to_string(&audit_path).expect("audit was written");
-    assert!(!audit.contains("representative-1"));
-    assert!(!audit.contains("represented-subject-1"));
-    let records = audit_envelopes(&audit_path)
-        .into_iter()
-        .map(|envelope| envelope.record)
-        .collect::<Vec<_>>();
-    for decision in [
-        "representative_target_selection_started",
-        "preauth_offer_minted",
-        "preauth_token_issued",
-    ] {
-        let event = records
-            .iter()
-            .find(|record| record["decision"] == json!(decision))
-            .unwrap_or_else(|| panic!("{decision} audit event exists"));
-        assert_eq!(event["access_mode"], json!("delegated_subject_access"));
-    }
-    let credential_audit = credential_issued_audit(&audit_path);
-    assert_eq!(
-        credential_audit["access_mode"],
-        json!("delegated_subject_access")
-    );
-    assert_eq!(
-        credential_audit["credential_configuration_id"],
-        json!("represented_person_is_alive_sd_jwt")
-    );
-    assert_eq!(credential_audit["holder_binding_mode"], json!("did"));
-    assert!(credential_audit["target_ref_hash"]
-        .as_str()
-        .is_some_and(|value| value.starts_with("hmac-sha256:")));
-    assert!(credential_audit["requester_ref_hash"]
-        .as_str()
-        .is_some_and(|value| value.starts_with("hmac-sha256:")));
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn representative_invalid_state_is_throttled_before_repeated_store_lookups() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let mut config = representative_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    );
-    config
-        .subject_access
-        .rate_limits
-        .invalid_token_per_client_address_per_minute = 1;
-    let app = standalone_router(config)
-        .await
-        .expect("representative standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let invalid_body = "selection_state=unknown-state&csrf_token=unknown-csrf&target_id=SUBJECT-1";
-
-    server
-        .post("/oid4vci/offer/representative")
-        .add_header("content-type", "application/x-www-form-urlencoded")
-        .text(invalid_body)
-        .await
-        .assert_status(StatusCode::BAD_REQUEST);
-    server
-        .post("/oid4vci/offer/representative")
-        .add_header("content-type", "application/x-www-form-urlencoded")
-        .text(invalid_body)
-        .await
-        .assert_status(StatusCode::TOO_MANY_REQUESTS);
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn representative_selection_rejects_a_valid_state_with_the_wrong_csrf_token() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(representative_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    ))
-    .await
-    .expect("representative standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let selection =
-        drive_representative_offer_to_selection(&server, &token_upstream, &idp, "representative-1")
-            .await;
-
-    server
-        .post("/oid4vci/offer/representative")
-        .add_header("content-type", "application/x-www-form-urlencoded")
-        .bytes(Bytes::from(format!(
-            "selection_state={}&csrf_token=wrong-csrf&target_id=SUBJECT-1",
-            urlencode(&selection.selection_state),
-        )))
-        .await
-        .assert_status(StatusCode::BAD_REQUEST);
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn offer_callback_rejects_representative_selection_state_before_code_exchange() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(representative_preauth_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp.issuer(),
-        &idp.jwks_uri(),
-        &format!("{}/authorize", idp.issuer()),
-        &format!("{}/token", token_upstream.url()),
-    ))
-    .await
-    .expect("representative standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-    let selection =
-        drive_representative_offer_to_selection(&server, &token_upstream, &idp, "representative-1")
-            .await;
-
-    server
-        .get(&format!(
-            "/oid4vci/offer/callback?code=second-code&state={}",
-            urlencode(&selection.selection_state),
-        ))
-        .await
-        .assert_status(StatusCode::BAD_REQUEST);
-    let token_requests = token_upstream
-        .wiremock_server()
-        .received_requests()
-        .await
-        .expect("token upstream records requests")
-        .into_iter()
-        .filter(|request| request.url.path() == "/token")
-        .count();
-    assert_eq!(
-        token_requests, 1,
-        "selection state must be rejected before another token exchange"
-    );
-
-    idp.stop().await;
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn preauth_end_to_end_issuer_algorithms_match_metadata_and_client_verification() {
-    set_preauth_env();
-    std::env::set_var("TEST_ISSUER_ES256_JWK", TEST_ISSUER_ES256_JWK);
-
-    for (algorithm, key_env, key_id, key_material) in [
-        (
-            "EdDSA",
-            "TEST_CREDENTIAL_ISSUER_JWK",
-            "issuer-key",
-            TEST_ISSUER_JWK,
-        ),
-        (
-            "ES256",
-            "TEST_ISSUER_ES256_JWK",
-            "issuer-es256-key",
-            TEST_ISSUER_ES256_JWK,
-        ),
-    ] {
-        let idp = MockIdp::start().await;
-        let token_upstream = MockHttpUpstream::start().await;
-        let tmp = TempDir::new().expect("tempdir");
-        let audit_path = tmp.path().join("audit.jsonl");
-        let mut config = preauth_test_config(
-            "http://127.0.0.1:1",
-            audit_path.to_str().expect("audit path is UTF-8"),
-            &idp,
-            &token_upstream,
-        );
-        let configured_kid = if algorithm == "EdDSA" {
-            "did:web:issuer.example#key-1"
-        } else {
-            "did:web:issuer.example#p256-key-1"
-        };
-        if algorithm == "ES256" {
-            let mut key = local_jwk_signing_key(key_env, configured_kid);
-            key.alg = algorithm.to_string();
-            config.evidence.signing_keys.insert(key_id.to_string(), key);
-            config
-                .evidence
-                .credential_profiles
-                .get_mut("civil_status_sd_jwt")
-                .expect("credential profile exists")
-                .signing_key = key_id.to_string();
-        }
-        let app = standalone_router(config)
-            .await
-            .expect("standalone router builds");
-        let server = TestServer::builder().mock_transport().build(app);
-
-        let metadata = server.get("/.well-known/openid-credential-issuer").await;
-        metadata.assert_status_ok();
-        let metadata: Value = metadata.json();
-        let advertised = &metadata["credential_configurations_supported"]["person_is_alive_sd_jwt"];
-        assert_eq!(
-            advertised["credential_signing_alg_values_supported"],
-            json!([algorithm]),
-            "issuer metadata advertises exactly the configured credential algorithm"
-        );
-        assert_eq!(
-            advertised["proof_types_supported"]["jwt"]["proof_signing_alg_values_supported"],
-            json!(["EdDSA"]),
-            "holder proof stays EdDSA for both issuer algorithms"
-        );
-        assert_eq!(
-            advertised["cryptographic_binding_methods_supported"],
-            json!(["did:jwk"])
-        );
-        assert!(metadata.get("nonce_endpoint").is_none());
-
-        let page = drive_offer_to_page(&server, &token_upstream, &idp, "person-1").await;
-        let grants = page.offer["grants"]
-            .as_object()
-            .expect("offer grants are an object");
-        assert_eq!(
-            grants.keys().map(String::as_str).collect::<Vec<_>>(),
-            vec!["urn:ietf:params:oauth:grant-type:pre-authorized_code"],
-            "the wallet-facing offer has only the pre-authorized-code grant"
-        );
-        let pin = page.pin.expect("secure-default offer includes tx_code");
-        let token = redeem_token(&server, &page.code, &pin).await;
-        token.assert_status_ok();
-        let token_body: Value = token.json();
-        let access_token = token_body["access_token"]
-            .as_str()
-            .expect("access token issued");
-        let c_nonce = token_body["c_nonce"]
-            .as_str()
-            .expect("transaction-scoped nonce issued");
-        let proof = sign_oid4vci_proof(NOTARY_ISSUER, c_nonce);
-        let credential = server
-            .post("/oid4vci/credential")
-            .add_header("authorization", format!("Bearer {access_token}"))
-            .json(&json!({
-                "format": "dc+sd-jwt",
-                "credential_configuration_id": "person_is_alive_sd_jwt",
-                "proof": { "proof_type": "jwt", "jwt": proof }
-            }))
-            .await;
-        credential.assert_status_ok();
-        let credential_body: Value = credential.json();
-        assert!(credential_body.get("c_nonce").is_none());
-        assert!(credential_body.get("c_nonce_expires_in").is_none());
-        let compact = credential_body["credential"]
-            .as_str()
-            .expect("credential issued");
-
-        let mut private = PrivateJwk::parse(key_material).expect("issuer key parses");
-        private.alg = Some(algorithm.to_string());
-        private.kid = Some(configured_kid.to_string());
-        let holder_id = holder_did_jwk();
-        let options = VerifyOptions::new("did:web:issuer.example")
-            .expected_vct("http://127.0.0.1:4325/credentials/civil-status")
-            .accepted_algorithms([algorithm])
-            .holder_binding(HolderBindingPolicy::RequiredKid(holder_id.clone()));
-        let verified = verify_sd_jwt_vc(compact, &jwks_from_private_jwk(&private), &options)
-            .expect("the Registry Notary client verifies the issued credential");
-        assert_eq!(verified.algorithm, algorithm);
-        assert_eq!(verified.key_id, configured_kid);
-        assert_eq!(verified.holder_key_id.as_deref(), Some(holder_id.as_str()));
-
-        idp.stop().await;
-    }
-}
-
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn preauth_cached_retry_cannot_escape_failed_credential_audit() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let audit_backup_path = tmp.path().join("audit.backup.jsonl");
-    let app = standalone_router(preauth_test_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp,
-        &token_upstream,
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let (code, pin) = drive_offer_to_code(&server, &token_upstream, &idp, "person-1").await;
-    let token = redeem_token(&server, &code, &pin).await;
-    token.assert_status_ok();
-    let token_body: Value = token.json();
-    let access_token = token_body["access_token"]
-        .as_str()
-        .expect("access token issued")
-        .to_string();
-    let nonce = token_body["c_nonce"]
-        .as_str()
-        .expect("transaction nonce issued");
-    let credential_request = json!({
-        "format": "dc+sd-jwt",
-        "credential_configuration_id": "person_is_alive_sd_jwt",
-        "proof": {
-            "proof_type": "jwt",
-            "jwt": sign_oid4vci_proof(NOTARY_ISSUER, nonce),
-        }
-    });
-
-    // Preserve the valid retained chain, but temporarily replace its active
-    // path with a directory so the first credential-issued append fails.
-    std::fs::rename(&audit_path, &audit_backup_path).expect("audit file moves aside");
-    std::fs::create_dir(&audit_path).expect("audit path becomes unwritable");
-    let failed = server
-        .post("/oid4vci/credential")
-        .add_header("authorization", format!("Bearer {access_token}"))
-        .json(&credential_request)
-        .await;
-    failed.assert_status(StatusCode::INTERNAL_SERVER_ERROR);
-    assert_eq!(failed.json::<Value>()["code"], json!("audit.write_failed"));
-
-    std::fs::remove_dir(&audit_path).expect("temporary audit directory is removed");
-    std::fs::rename(&audit_backup_path, &audit_path).expect("audit chain is restored");
-    let recovered = server
-        .post("/oid4vci/credential")
-        .add_header("authorization", format!("Bearer {access_token}"))
-        .json(&credential_request)
-        .await;
-    recovered.assert_status_ok();
-    let recovered_body: Value = recovered.json();
-    let exact_retry = server
-        .post("/oid4vci/credential")
-        .add_header("authorization", format!("Bearer {access_token}"))
-        .json(&credential_request)
-        .await;
-    exact_retry.assert_status_ok();
-    assert_eq!(
-        exact_retry.json::<Value>(),
-        recovered_body,
-        "recovery and later exact retries use the one cached signature"
-    );
-    let issued_audits = audit_envelopes(&audit_path)
-        .into_iter()
-        .filter(|envelope| {
-            envelope.record["path"] == json!("/oid4vci/credential")
-                && envelope.record["decision"] == json!("credential_issued")
-                && envelope.record["status"] == json!(200)
-        })
-        .count();
-    assert_eq!(
-        issued_audits, 2,
-        "each released cached response must pass credential-issued audit emission"
-    );
-    idp.stop().await;
-}
-
-/// Decode the SD-JWT VC issuer JWS payload (the segment before the first `~`).
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn decode_sd_jwt_payload(sd_jwt: &str) -> Value {
-    let issuer_jws = sd_jwt
-        .split('~')
-        .next()
-        .expect("SD-JWT contains an issuer JWS");
-    let payload_segment = issuer_jws
-        .split('.')
-        .nth(1)
-        .expect("issuer JWS contains a payload segment");
-    serde_json::from_slice(
-        &URL_SAFE_NO_PAD
-            .decode(payload_segment)
-            .expect("issuer JWS payload is base64url"),
-    )
-    .expect("issuer JWS payload is JSON")
-}
-
-/// Decode the SD-JWT VC disclosure for `claim_name` and return its value object.
-/// A disclosure is `base64url([salt, name, value])`; the value is the evaluated
-/// claim result.
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn decode_disclosed_claim(sd_jwt: &str, claim_name: &str) -> Value {
-    sd_jwt
-        .split('~')
-        .skip(1)
-        .filter(|part| !part.is_empty())
-        .find_map(|part| {
-            let decoded = URL_SAFE_NO_PAD.decode(part).ok()?;
-            let triple: Value = serde_json::from_slice(&decoded).ok()?;
-            (triple.get(1).and_then(Value::as_str) == Some(claim_name))
-                .then(|| triple.get(2).cloned())
-                .flatten()
-        })
-        .unwrap_or_else(|| panic!("disclosure for {claim_name} is present"))
-}
-
-/// Find the single `credential_issued` audit record for the OID4VCI credential
-/// endpoint. Its `target_ref_hash`/`requester_ref_hash` are HMACs over the
-/// bound subject reference, deterministic for a fixed audit secret, so two paths
-/// that bind the same eSignet subject produce identical hashes.
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn credential_issued_audit(audit_path: &std::path::Path) -> Value {
-    audit_envelopes(audit_path)
-        .into_iter()
-        .map(|envelope| envelope.record)
-        .find(|record| {
-            record["path"] == json!("/oid4vci/credential")
-                && record["decision"] == json!("credential_issued")
-                && record["status"] == json!(200)
-        })
-        .expect("credential_issued audit record exists")
-}
-
-/// A wallet-issued eSignet bearer token cannot bypass the issuer-initiated
-/// transaction, while the approved pre-authorized-code path binds and issues.
-#[tokio::test]
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn preauth_transaction_cannot_be_bypassed_with_esignet_wallet_token() {
-    set_preauth_env();
-
-    // The eSignet-token (auth-code) baseline: an eSignet token whose
-    // subject-binding claim is the same civil id the pre-auth login carries.
-    let baseline_idp = MockIdp::start().await;
-    let baseline_token_upstream = MockHttpUpstream::start().await;
-    let baseline_tmp = TempDir::new().expect("tempdir");
-    let baseline_audit_path = baseline_tmp.path().join("audit.jsonl");
-    let baseline_app = standalone_router(preauth_test_config(
-        "http://127.0.0.1:1",
-        baseline_audit_path.to_str().expect("audit path is UTF-8"),
-        &baseline_idp,
-        &baseline_token_upstream,
-    ))
-    .await
-    .expect("baseline router builds");
-    let baseline_server = TestServer::builder().mock_transport().build(baseline_app);
-
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    // An eSignet-issued token bound to civil id "person-1" via national_id.
-    let esignet_token = baseline_idp.mint_token(json!({
-        "sub": "citizen-subject",
-        "aud": NOTARY_AUDIENCE,
-        "azp": "citizen-portal",
-        "scope": "subject_access person-is-alive",
-        "national_id": "person-1",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }));
-    let baseline_proof = sign_oid4vci_proof(NOTARY_ISSUER, "unbound-wallet-nonce");
-    let baseline_credential = baseline_server
-        .post("/oid4vci/credential")
-        .add_header("authorization", format!("Bearer {esignet_token}"))
-        .json(&json!({
-            "format": "dc+sd-jwt",
-            "credential_configuration_id": "person_is_alive_sd_jwt",
-            "proof": { "proof_type": "jwt", "jwt": baseline_proof }
-        }))
-        .await;
-    baseline_credential.assert_status(StatusCode::UNAUTHORIZED);
-    assert_eq!(
-        baseline_credential.json::<Value>()["error"],
-        json!("invalid_token")
-    );
-    baseline_idp.stop().await;
-
-    // The pre-authorized-code path: the same civil id arrives through the eSignet
-    // login leg (the offer/start -> callback -> token chain).
-    let preauth_idp = MockIdp::start().await;
-    let preauth_token_upstream = MockHttpUpstream::start().await;
-    let preauth_tmp = TempDir::new().expect("tempdir");
-    let preauth_audit_path = preauth_tmp.path().join("audit.jsonl");
-    let preauth_app = standalone_router(preauth_test_config(
-        "http://127.0.0.1:1",
-        preauth_audit_path.to_str().expect("audit path is UTF-8"),
-        &preauth_idp,
-        &preauth_token_upstream,
-    ))
-    .await
-    .expect("preauth router builds");
-    let preauth_server = TestServer::builder().mock_transport().build(preauth_app);
-
-    let (code, pin) = drive_offer_to_code(
-        &preauth_server,
-        &preauth_token_upstream,
-        &preauth_idp,
-        "person-1",
-    )
-    .await;
-    let token = redeem_token(&preauth_server, &code, &pin).await;
-    token.assert_status_ok();
-    let token_body: Value = token.json();
-    let access_token = token_body["access_token"]
-        .as_str()
-        .expect("access token issued")
-        .to_string();
-    let c_nonce = token_body["c_nonce"]
-        .as_str()
-        .expect("c_nonce issued")
-        .to_string();
-    let preauth_proof = sign_oid4vci_proof_without_iss(NOTARY_ISSUER, &c_nonce);
-    let preauth_credential = preauth_server
-        .post("/oid4vci/credential")
-        .add_header("authorization", format!("Bearer {access_token}"))
-        .json(&json!({
-            "format": "dc+sd-jwt",
-            "credential_configuration_id": "person_is_alive_sd_jwt",
-            "vct": "http://127.0.0.1:4325/credentials/civil-status",
-            "display": [{ "name": "Person is alive" }],
-            "credential_signing_alg_values_supported": ["EdDSA"],
-            "proof": {
-                "proof_type": "jwt",
-                "jwt": preauth_proof,
-                "subject": "person-1"
-            }
-        }))
-        .await;
-    preauth_credential.assert_status_ok();
-    let preauth_sd_jwt = preauth_credential.json::<Value>()["credential"]
-        .as_str()
-        .expect("preauth credential issued")
-        .to_string();
-    let preauth_audit = credential_issued_audit(&preauth_audit_path);
-    assert_eq!(preauth_audit["purposes"], json!(["citizen_subject_access"]));
-    preauth_idp.stop().await;
-
-    assert!(
-        preauth_audit["target_ref_hash"]
-            .as_str()
-            .is_some_and(|hash| hash.starts_with("hmac-sha256:")),
-        "the transaction audit uses only a keyed subject handle"
-    );
-    let preauth_payload = decode_sd_jwt_payload(&preauth_sd_jwt);
-    assert!(
-        !preauth_payload.to_string().contains("person-1"),
-        "the raw civil id must not appear in the credential payload"
-    );
-    let preauth_claim = decode_disclosed_claim(&preauth_sd_jwt, "person-is-alive");
-    assert_eq!(preauth_claim["claim_id"], json!("person-is-alive"));
-    assert_eq!(preauth_claim["value"], json!(true));
-    assert_eq!(preauth_claim["satisfied"], json!(true));
-}
-
-#[tokio::test]
-pub(super) async fn preauth_callback_and_token_audit_events_carry_only_hashes() {
-    set_preauth_env();
-    let idp = MockIdp::start().await;
-    let token_upstream = MockHttpUpstream::start().await;
-    let tmp = TempDir::new().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let app = standalone_router(preauth_test_config(
-        "http://127.0.0.1:1",
-        audit_path.to_str().expect("audit path is UTF-8"),
-        &idp,
-        &token_upstream,
-    ))
-    .await
-    .expect("standalone router builds");
-    let server = TestServer::builder().mock_transport().build(app);
-
-    let (code, pin) = drive_offer_to_code(&server, &token_upstream, &idp, "person-1").await;
-    redeem_token(&server, &code, &pin).await.assert_status_ok();
-
-    let audit = std::fs::read_to_string(&audit_path).expect("audit written");
-    // The raw code, PIN, civil id, and eSignet code never appear in the audit.
-    assert!(
-        !audit.contains(&code),
-        "raw pre-authorized_code must not be logged"
-    );
-    assert!(!audit.contains(&pin), "raw tx_code must not be logged");
-    assert!(!audit.contains("person-1"), "civil id must not be logged");
-    assert!(
-        !audit.contains("esignet-code-123"),
-        "eSignet code must not be logged"
-    );
-
-    // The callback and token audit events are present, hashed-only.
-    let records = audit_envelopes(&audit_path)
-        .into_iter()
-        .map(|envelope| envelope.record)
-        .collect::<Vec<_>>();
-    let callback = records
-        .iter()
-        .find(|record| {
-            record["path"] == json!("/oid4vci/offer/callback")
-                && record["decision"] == json!("preauth_offer_minted")
-        })
-        .expect("callback audit event exists");
-    assert_eq!(callback["status"], json!(200));
-    assert_eq!(
-        callback["credential_configuration_id"],
-        json!("person_is_alive_sd_jwt")
-    );
-    let token_event = records
-        .iter()
-        .find(|record| {
-            record["path"] == json!("/oid4vci/token")
-                && record["decision"] == json!("preauth_token_issued")
-        })
-        .expect("token audit event exists");
-    assert_eq!(token_event["status"], json!(200));
-    idp.stop().await;
-}
diff --git a/crates/registry-notary-server/tests/standalone_http/preauth_support.rs b/crates/registry-notary-server/tests/standalone_http/preauth_support.rs
deleted file mode 100644
index 88aa1764c..000000000
--- a/crates/registry-notary-server/tests/standalone_http/preauth_support.rs
+++ /dev/null
@@ -1,548 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::federation::subject_access_oid4vci_config;
-use super::support::*;
-
-// Test-only 2048-bit RSA private JWK (kty=RSA, alg=RS256) for the eSignet RP
-// client when the lab registers the Notary's RP client with an RSA key.
-// Generated once with openssl and converted to a JWK; not a production key.
-#[cfg(feature = "registry-notary-cel")]
-pub(super) const TEST_ESIGNET_RP_RSA_JWK: &str = r#"{"kty":"RSA","kid":"did:web:rp.example#esignet-rp-rsa-key","alg":"RS256","n":"uujuLM_PhTFXueBzTafeFW7O4kJgQnLIzuoHJQgaYDkCBbUYAznt-IZvGkyTTkg4mfolJj47HDlBsSNzzx7bYcFDKdBMoZQwukVX9bhkXVUPT9-fot1jfW0EPrvdJdDQ-5LjQYfk2a2OpKtV5hmBIxoHm_JRU3QOmKU0h1_vKjwStMO0ntaitIL7pSIE0X7Ht4P3edhBc5Vxf_-Ui7wSaN-jAjHCk6HYRY4BTODI-zo5K8yB5JERBqcawsuAIDPTjQ1eIOHxIQsTlsdbmSgqnMldoyZAkjxCyOm9Ad_rpbJ04WDaIhFxyaqHTVUD32cufcZFYxkSJ35zuIlJYgoebw","e":"AQAB","d":"EEvSyFFuFHzS2z_4jaK_ODsrCosi_WgonfHFobLtKcqOpJS_fTiFyQ9fjHl0tnSRistGhekTGkjbs2gV5s8X7ZP-GR0yMTxMa1E0dBYZmhGafipPLtICpKLmpdmXVH66WdTav5HroBcDwtO1b5R1r-vLEgu0j4Qk6aYtyEfTAGmKRzH9fk7crZwaM2MiklIWLaK6Gfior5KDrQhIMGfKZzu78naJ5FyFSHBUW0VvikTg0C8QbRgBuFbQCuOceu4UZhjySJUhugdgzlbnteVRc_VvSvusLL4i7fSeecRIXURSexUjraLifeh1lM_jrD8ZM-o_2Qop2ada12Asll4gkQ","p":"4QhhINnwbq_vuFTQL3Wx980l2eg8yocFS5hsmk7vbqAUbAZVSVOGW_y6ip-uG_c9xpYBvTyZAANUZHpqDyu0frPDdZplJZX2FTMkiHTg4RJQfj8OD0tmL370cGv3RRfO4md4-0E0wxl8Zsv4-PSVrMZCFyIk8TLgLZs1w7bpg0U","q":"1KGH6VP7TkA3hDXTlSL2GPShsGY0Y9P1Kn6mMA8aHIZ690QmeJU2j91oWcCP1AG6LnAp5pvxT0XJJu3OVsQs7OZPiUwAf_RoSdlMtm6xll1FkBKC3AtTLYn0vgHwFPeXa29wZM1khFv_vBdhk47ZgZT0G3f4Y88FHh5EM5EFPCM","dp":"0D332_WyWEu5c4QQ74pjuaP_XgpajzSpgs432ggn6-B5ZYnqzKNdl6xlV7jy3vBKG4Zfb6YvE-MA6saZdRaFviZOP3s0FLcUdYPRT_GQ1Nck498n_KFSm6tJOuu-dBLXIY6NVz19PPpNs7cX3BJCnBMPv-aZ9xaUe7_A3i9bIl0","dq":"gDDudp5aGSAgGEY3TGdqhTsfK_FCTpkf6sG2Qa0pKd9tzRs6MmKLJYrveYTdcYylCZA3wr9raUaCckTWrHrTNvPXKcg3WO0p3rPySt5LlIKhCK4QVMdDG2Zbth4G9y0aDfx-f1dQ7Xdlo6lY-5QYz8XUsabPiqTpyfGnXotk448","qi":"XlLiaiQDLYZXtyR1ixq3dJ1EqnBtHtx75VjpQydmb4yQMtzsQ1JS5xyRgv1gws8u5KVaF3h3CUo6wBrtKBFGIhL9WFnym_8DEECgVF7eLHZ6WNtnIv6Vs7vjO3CAPKG3TrIuaHhY5KXQf0za7criZ9Euai41_ky9_iU6j0Lw5CY"}"#;
-
-pub(super) const NOTARY_ISSUER: &str = "http://127.0.0.1:4325";
-pub(super) const NOTARY_AUDIENCE: &str = "registry-notary-citizen";
-pub(super) const ESIGNET_RP_CLIENT_ID: &str = "registry-lab-live-client";
-
-pub(super) fn set_preauth_env() {
-    set_audit_secret();
-    std::env::set_var("TEST_CREDENTIAL_ISSUER_JWK", TEST_ISSUER_JWK);
-    std::env::set_var("TEST_ACCESS_TOKEN_JWK", TEST_ACCESS_TOKEN_JWK);
-    std::env::set_var("TEST_ESIGNET_RP_JWK", TEST_ESIGNET_RP_JWK);
-}
-
-/// A pre-auth-enabled config. eSignet `issuer`/`jwks_uri` point at the MockIdp;
-/// the token endpoint points at `token_url` (a wiremock upstream). The
-/// access-token signing key is dedicated (distinct from the credential key).
-pub(super) fn subject_access_preauth_config(
-    base_url: &str,
-    audit_path: &str,
-    esignet_issuer: &str,
-    esignet_jwks_uri: &str,
-    esignet_authorize_url: &str,
-    esignet_token_url: &str,
-) -> StandaloneRegistryNotaryConfig {
-    // Reuse the eSignet issuer/jwks as the primary OIDC auth issuer so the
-    // credential endpoint still accepts eSignet tokens on the unchanged path.
-    let mut config =
-        subject_access_oid4vci_config(base_url, audit_path, esignet_issuer, esignet_jwks_uri);
-    config.oid4vci.offer_endpoint.clear();
-    config.oid4vci.nonce_endpoint = None;
-    config.state.storage = registry_notary_core::STATE_STORAGE_IN_MEMORY.to_string();
-    // The credential endpoint must be allowed to issue credentials for the
-    // pre-auth happy path.
-    config.subject_access.allowed_operations.issue_credential = true;
-    config
-        .subject_access
-        .rate_limits
-        .tx_code_attempts_per_code_per_minute = 3;
-    config
-        .subject_access
-        .rate_limits
-        .invalid_token_per_client_address_per_minute = 50;
-    // The Notary RP client id must be an accepted citizen client + audience so a
-    // Notary-minted token classifies as subject-access.
-    // Dedicated access-token signing key.
-    config.evidence.signing_keys.insert(
-        "access-token-key".to_string(),
-        local_jwk_signing_key(
-            "TEST_ACCESS_TOKEN_JWK",
-            "did:web:issuer.example#access-token-key",
-        ),
-    );
-    // eSignet RP client signing key.
-    config.evidence.signing_keys.insert(
-        "esignet-rp-key".to_string(),
-        local_jwk_signing_key("TEST_ESIGNET_RP_JWK", "did:web:rp.example#esignet-rp-key"),
-    );
-
-    config.auth.access_token_signing = serde_norway::from_str(&format!(
-        r#"
-enabled: true
-issuer: {NOTARY_ISSUER}
-audiences:
-  - {NOTARY_AUDIENCE}
-allowed_algorithms:
-  - EdDSA
-token_typ: registry-notary-access+jwt
-signing_key_id: access-token-key
-access_token_ttl_seconds: 300
-"#
-    ))
-    .expect("access-token signing config parses");
-
-    config.oid4vci.pre_authorized_code = serde_norway::from_str(&format!(
-        r#"
-enabled: true
-tx_code:
-  required: true
-  input_mode: numeric
-  length: 6
-esignet:
-  client_id: {ESIGNET_RP_CLIENT_ID}
-  client_signing_key_id: esignet-rp-key
-  redirect_uri: http://127.0.0.1:4325/oid4vci/offer/callback
-  authorize_url: {esignet_authorize_url}
-  token_url: {esignet_token_url}
-  issuer: {esignet_issuer}
-  jwks_uri: {esignet_jwks_uri}
-  scopes:
-    - openid
-  login_state_ttl_seconds: 300
-  allow_insecure_localhost: true
-pre_authorized_code_ttl_seconds: 300
-"#
-    ))
-    .expect("pre-auth config parses");
-    config
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn representative_preauth_config(
-    base_url: &str,
-    audit_path: &str,
-    esignet_issuer: &str,
-    esignet_jwks_uri: &str,
-    esignet_authorize_url: &str,
-    esignet_token_url: &str,
-) -> StandaloneRegistryNotaryConfig {
-    let mut config = subject_access_preauth_config(
-        base_url,
-        audit_path,
-        esignet_issuer,
-        esignet_jwks_uri,
-        esignet_authorize_url,
-        esignet_token_url,
-    );
-    let mut proof = config
-        .evidence
-        .claims
-        .pop()
-        .expect("base registry-backed claim exists");
-    proof.id = "authorized-representative".to_string();
-    proof.title = "Authorized representative".to_string();
-    proof.credential_profiles.clear();
-    let registry_notary_core::ClaimEvidenceMode::RegistryBacked { consultations } =
-        &mut proof.evidence_mode
-    else {
-        panic!("base claim is registry-backed");
-    };
-    for consultation in consultations.values_mut() {
-        consultation.profile.contract_hash = representative_test_relay_contract_hash();
-        consultation.inputs.insert(
-            "subject_id".to_string(),
-            registry_notary_core::RelayConsultationInput::TargetIdentifier(
-                "request.target.identifiers.civil_registration_id".to_string(),
-            ),
-        );
-        consultation.inputs.insert(
-            "representative_id".to_string(),
-            registry_notary_core::RelayConsultationInput::RequesterIdentifier(
-                "request.requester.identifiers.national_id".to_string(),
-            ),
-        );
-    }
-    let mut credential_claim = proof.clone();
-    credential_claim.id = "represented-person-is-alive".to_string();
-    credential_claim.title = "Represented person is alive".to_string();
-    credential_claim.depends_on = vec![proof.id.clone()];
-    credential_claim.credential_profiles = vec!["civil_status_sd_jwt".to_string()];
-    config.evidence.claims = vec![proof, credential_claim];
-    config
-        .evidence
-        .credential_profiles
-        .get_mut("civil_status_sd_jwt")
-        .expect("credential profile exists")
-        .allowed_claims = vec!["represented-person-is-alive".to_string()];
-    config.subject_access.allowed_claims.clear();
-    config.subject_access.allowed_purposes.clear();
-    config.subject_access.allowed_formats.clear();
-    config.subject_access.allowed_disclosures.clear();
-    config.subject_access.delegation = serde_norway::from_str(
-        r#"
-enabled: true
-allowed_relationships:
-  - relationship_type: authorized-representative
-    proof_claim: authorized-representative
-    target_id_type: civil_registration_id
-    max_proof_age_seconds: 300
-    allowed_claims: [represented-person-is-alive]
-    allowed_purposes: [citizen_subject_access]
-    allowed_formats: [application/vnd.registry-notary.claim-result+json]
-    allowed_disclosures: [value]
-"#,
-    )
-    .expect("representative delegation policy parses");
-    let credential = config
-        .oid4vci
-        .credential_configurations
-        .remove("person_is_alive_sd_jwt")
-        .expect("base credential configuration exists");
-    let mut credential = credential;
-    credential.claim_id = Some("represented-person-is-alive".to_string());
-    credential.representative_issuance =
-        Some(registry_notary_core::Oid4vciRepresentativeIssuanceConfig {
-            ceremony: registry_notary_core::Oid4vciRepresentativeIssuanceCeremony::DigitallyAuthenticatedRepresentative,
-            relationship: "authorized-representative".to_string(),
-        });
-    config
-        .oid4vci
-        .credential_configurations
-        .insert("represented_person_is_alive_sd_jwt".to_string(), credential);
-    config.credential_status = registry_notary_core::CredentialStatusConfig {
-        enabled: true,
-        base_url: NOTARY_ISSUER.to_string(),
-        ..registry_notary_core::CredentialStatusConfig::default()
-    };
-    config
-}
-
-/// Extract a query parameter from a URL.
-pub(super) fn query_param(url: &str, name: &str) -> Option<String> {
-    let query = url.split_once('?')?.1;
-    for pair in query.split('&') {
-        let (key, value) = pair.split_once('=').unwrap_or((pair, ""));
-        if key == name {
-            return Some(percent_decode(value));
-        }
-    }
-    None
-}
-
-pub(super) fn percent_decode(value: &str) -> String {
-    let bytes = value.as_bytes();
-    let mut out = Vec::with_capacity(bytes.len());
-    let mut index = 0;
-    while index < bytes.len() {
-        match bytes[index] {
-            b'+' => {
-                out.push(b' ');
-                index += 1;
-            }
-            b'%' if index + 2 < bytes.len() => {
-                let hex = &value[index + 1..index + 3];
-                if let Ok(byte) = u8::from_str_radix(hex, 16) {
-                    out.push(byte);
-                    index += 3;
-                } else {
-                    out.push(bytes[index]);
-                    index += 1;
-                }
-            }
-            other => {
-                out.push(other);
-                index += 1;
-            }
-        }
-    }
-    String::from_utf8(out).unwrap_or_default()
-}
-
-/// Mint an eSignet id_token bound to the login nonce, with the civil-id claim.
-pub(super) fn esignet_id_token(idp: &MockIdp, nonce: &str, national_id: &str) -> String {
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    idp.mint_token(json!({
-        "sub": "esignet-citizen-subject",
-        "aud": ESIGNET_RP_CLIENT_ID,
-        "nonce": nonce,
-        "national_id": national_id,
-        "scope": "openid subject_access",
-        "acr": "urn:example:loa:substantial",
-        "auth_time": now,
-        "iat": now,
-        "exp": now + 300,
-        "nbf": now,
-    }))
-}
-
-pub(super) struct PreauthOfferPage {
-    pub(super) code: String,
-    pub(super) pin: Option<String>,
-    pub(super) offer: Value,
-    pub(super) html: String,
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) struct RepresentativeSelectionPage {
-    pub(super) selection_state: String,
-    pub(super) csrf_token: String,
-}
-
-/// Drive offer/start + offer/callback, returning the rendered offer details.
-pub(super) async fn drive_offer_to_page(
-    server: &TestServer,
-    token_upstream: &MockHttpUpstream,
-    idp: &MockIdp,
-    national_id: &str,
-) -> PreauthOfferPage {
-    let start = server
-        .get("/oid4vci/offer/start?credential_configuration_id=person_is_alive_sd_jwt")
-        .await;
-    start.assert_status(StatusCode::SEE_OTHER);
-    let location = start
-        .headers()
-        .get("location")
-        .expect("offer start redirects")
-        .to_str()
-        .expect("location is valid")
-        .to_string();
-    let state = query_param(&location, "state").expect("redirect carries state");
-    let nonce = query_param(&location, "nonce").expect("redirect carries nonce");
-
-    let id_token = esignet_id_token(idp, &nonce, national_id);
-    token_upstream
-        .expect("POST", "/token")
-        .respond_json(
-            200,
-            json!({
-                "access_token": "esignet-access-token",
-                "token_type": "Bearer",
-                "id_token": id_token,
-                "expires_in": 300,
-            }),
-        )
-        .await;
-
-    let callback = server
-        .get(&format!(
-            "/oid4vci/offer/callback?code=esignet-code-123&state={state}"
-        ))
-        .await;
-    callback.assert_status_ok();
-    let html = callback.text();
-    let offer_uri = extract_between(&html, "href=\"", "\"").expect("offer href present");
-    let offer_json =
-        query_param(&offer_uri, "credential_offer").expect("offer carries credential_offer");
-    let offer: Value = serde_json::from_str(&offer_json).expect("offer is JSON");
-    let code = offer["grants"]["urn:ietf:params:oauth:grant-type:pre-authorized_code"]
-        ["pre-authorized_code"]
-        .as_str()
-        .expect("offer carries pre-authorized_code")
-        .to_string();
-    let pin = extract_between(&html, "id=\"tx-code\">", "<");
-    PreauthOfferPage {
-        code,
-        pin,
-        offer,
-        html,
-    }
-}
-
-/// Drive the authenticated representative ceremony through authentication,
-/// returning the single-use target-selection state.
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn drive_representative_offer_to_selection(
-    server: &TestServer,
-    token_upstream: &MockHttpUpstream,
-    idp: &MockIdp,
-    representative_id: &str,
-) -> RepresentativeSelectionPage {
-    let start = server
-        .get("/oid4vci/offer/start?credential_configuration_id=represented_person_is_alive_sd_jwt")
-        .await;
-    start.assert_status(StatusCode::SEE_OTHER);
-    let location = start
-        .headers()
-        .get("location")
-        .expect("offer start redirects")
-        .to_str()
-        .expect("location is valid")
-        .to_string();
-    let state = query_param(&location, "state").expect("redirect carries state");
-    let nonce = query_param(&location, "nonce").expect("redirect carries nonce");
-
-    token_upstream
-        .expect("POST", "/token")
-        .respond_json(
-            200,
-            json!({
-                "access_token": "esignet-access-token",
-                "token_type": "Bearer",
-                "id_token": esignet_id_token(idp, &nonce, representative_id),
-                "expires_in": 300,
-            }),
-        )
-        .await;
-    let callback = server
-        .get(&format!(
-            "/oid4vci/offer/callback?code=esignet-code-123&state={state}"
-        ))
-        .await;
-    callback.assert_status_ok();
-    assert_eq!(
-        callback
-            .headers()
-            .get("cache-control")
-            .and_then(|value| value.to_str().ok()),
-        Some("no-store")
-    );
-    let selection_html = callback.text();
-    let selection_state =
-        extract_between(&selection_html, "name=\"selection_state\" value=\"", "\"")
-            .expect("selection state is present");
-    let csrf_token = extract_between(&selection_html, "name=\"csrf_token\" value=\"", "\"")
-        .expect("CSRF token is present");
-    assert!(
-        !selection_html.contains("openid-credential-offer"),
-        "the callback must not mint an offer before target selection and proof"
-    );
-
-    RepresentativeSelectionPage {
-        selection_state,
-        csrf_token,
-    }
-}
-
-/// Drive the authenticated representative ceremony through target selection.
-#[cfg(feature = "registry-notary-cel")]
-pub(super) async fn drive_representative_offer_to_page(
-    server: &TestServer,
-    token_upstream: &MockHttpUpstream,
-    idp: &MockIdp,
-    representative_id: &str,
-    target_id: &str,
-) -> PreauthOfferPage {
-    let selection =
-        drive_representative_offer_to_selection(server, token_upstream, idp, representative_id)
-            .await;
-    let selected = server
-        .post("/oid4vci/offer/representative")
-        .add_header("content-type", "application/x-www-form-urlencoded")
-        .bytes(Bytes::from(format!(
-            "selection_state={}&csrf_token={}&target_id={}",
-            urlencode(&selection.selection_state),
-            urlencode(&selection.csrf_token),
-            urlencode(target_id),
-        )))
-        .await;
-    selected.assert_status_ok();
-    let html = selected.text();
-    let offer_uri = extract_between(&html, "href=\"", "\"").expect("offer href present");
-    let offer_json =
-        query_param(&offer_uri, "credential_offer").expect("offer carries credential_offer");
-    let offer: Value = serde_json::from_str(&offer_json).expect("offer is JSON");
-    let code = offer["grants"]["urn:ietf:params:oauth:grant-type:pre-authorized_code"]
-        ["pre-authorized_code"]
-        .as_str()
-        .expect("offer carries pre-authorized_code")
-        .to_string();
-    let pin = extract_between(&html, "id=\"tx-code\">", "<");
-    PreauthOfferPage {
-        code,
-        pin,
-        offer,
-        html,
-    }
-}
-
-/// Drive offer/start + offer/callback, returning (pre_authorized_code, tx_code).
-pub(super) async fn drive_offer_to_code(
-    server: &TestServer,
-    token_upstream: &MockHttpUpstream,
-    idp: &MockIdp,
-    national_id: &str,
-) -> (String, String) {
-    let page = drive_offer_to_page(server, token_upstream, idp, national_id).await;
-    let pin = page.pin.expect("offer page shows PIN");
-    (page.code, pin)
-}
-
-pub(super) fn extract_between(haystack: &str, start: &str, end: &str) -> Option<String> {
-    let after = haystack.split_once(start)?.1;
-    let value = after.split_once(end)?.0;
-    Some(value.to_string())
-}
-
-pub(super) async fn redeem_token(
-    server: &TestServer,
-    code: &str,
-    pin: &str,
-) -> axum_test::TestResponse {
-    server
-        .post("/oid4vci/token")
-        .add_header("content-type", "application/x-www-form-urlencoded")
-        .text(format!(
-            "grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code&pre-authorized_code={}&tx_code={}",
-            urlencode(code),
-            urlencode(pin),
-        ))
-        .await
-}
-
-pub(super) async fn redeem_token_without_pin(
-    server: &TestServer,
-    code: &str,
-) -> axum_test::TestResponse {
-    server
-        .post("/oid4vci/token")
-        .add_header("content-type", "application/x-www-form-urlencoded")
-        .text(format!(
-            "grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code&pre-authorized_code={}",
-            urlencode(code)
-        ))
-        .await
-}
-
-pub(super) fn urlencode(value: &str) -> String {
-    let mut out = String::new();
-    for byte in value.as_bytes() {
-        match byte {
-            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
-                out.push(*byte as char)
-            }
-            other => out.push_str(&format!("%{other:02X}")),
-        }
-    }
-    out
-}
-
-/// Decode (without verifying) the JSON claims of a compact JWT's payload.
-pub(super) fn jwt_payload(jwt: &str) -> Value {
-    let payload_b64 = jwt.split('.').nth(1).expect("jwt has a payload segment");
-    let bytes = URL_SAFE_NO_PAD
-        .decode(payload_b64)
-        .expect("payload is base64url");
-    serde_json::from_slice(&bytes).expect("payload is JSON")
-}
-
-/// Re-sign a pre-authorized-code payload with the configured test access-token
-/// key so endpoint tests can exercise authenticated claim-shape variations.
-pub(super) fn sign_test_preauthorized_code(payload: Value) -> String {
-    sign_ed25519_compact_jwt(
-        TEST_ACCESS_TOKEN_JWK,
-        registry_notary_core::tokens::PRE_AUTHORIZED_CODE_JWT_TYP,
-        "did:web:issuer.example#access-token-key",
-        payload,
-    )
-}
-
-/// Decode (without verifying) the JOSE header of a compact JWT.
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn jwt_header(jwt: &str) -> Value {
-    let header_b64 = jwt.split('.').next().expect("jwt has a header segment");
-    let bytes = URL_SAFE_NO_PAD
-        .decode(header_b64)
-        .expect("header is base64url");
-    serde_json::from_slice(&bytes).expect("header is JSON")
-}
-
-/// Extract a field from an `application/x-www-form-urlencoded` body.
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn form_field(body: &str, name: &str) -> Option<String> {
-    for pair in body.split('&') {
-        let (key, value) = pair.split_once('=').unwrap_or((pair, ""));
-        if key == name {
-            return Some(percent_decode(value));
-        }
-    }
-    None
-}
diff --git a/crates/registry-notary-server/tests/standalone_http/support.rs b/crates/registry-notary-server/tests/standalone_http/support.rs
deleted file mode 100644
index aa2528580..000000000
--- a/crates/registry-notary-server/tests/standalone_http/support.rs
+++ /dev/null
@@ -1,686 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Standalone Registry Notary HTTP test support.
-
-pub(super) use axum::body::Bytes;
-pub(super) use axum::extract::{Request, State};
-pub(super) use axum::http::{header, Method, StatusCode};
-pub(super) use axum::routing::get;
-pub(super) use axum::{Json, Router};
-pub(super) use axum_test::TestServer;
-pub(super) use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-pub(super) use base64::Engine;
-pub(super) use registry_notary_core::tokens::NOTARY_TRANSACTION_TOKEN_JWT_TYP;
-#[cfg(feature = "registry-notary-cel")]
-pub(super) use registry_notary_core::FEDERATION_RESPONSE_JWT_TYP;
-pub(super) use registry_notary_core::{
-    ClaimEvidenceMode, ConfigTrustConfig, CredentialProfileConfig, EvidenceCredentialConfig,
-    EvidenceOidcAuthConfig, Oid4vciConfig, RegistryNotaryAdminListenerMode, RelayConsultationInput,
-    SigningKeyConfig, SigningKeyProviderConfig, SigningKeyStatus, StandaloneRegistryNotaryConfig,
-    SubjectAccessClaimSource, SD_JWT_VC_SIGNING_ALG,
-};
-#[cfg(feature = "registry-notary-cel")]
-pub(super) use registry_notary_core::{Oid4vciCredentialClaimConfig, RuleConfig};
-pub(super) use registry_notary_server::{
-    compile_notary_runtime, notary_routers_from_runtime, notary_shared_router_from_runtime,
-    openapi_document, NotaryRuntimeSnapshot, StandaloneServerError,
-};
-pub(super) use registry_platform_audit::{
-    verify_jsonl_lines_with_hasher, AuditChainHasher, AuditEnvelope,
-};
-pub(super) use registry_platform_authcommon::{
-    CredentialFingerprintProvider, CredentialFingerprintRef,
-};
-#[cfg(feature = "registry-notary-cel")]
-pub(super) use registry_platform_crypto::verify;
-pub(super) use registry_platform_crypto::{
-    canonicalize_json, did_jwk_from_public_jwk, sign, PrivateJwk,
-};
-pub(super) use registry_platform_testing::{
-    fixtures, jwks_from_private_jwk, sign_ed25519_compact_jwt, MockHttpUpstream, MockIdp,
-    FEDERATION_PROTOCOL, FEDERATION_REQUEST_JWT_TYPE,
-};
-pub(super) use serde::Deserialize;
-pub(super) use serde_json::{json, Value};
-pub(super) use sha2::{Digest, Sha256};
-pub(super) use std::collections::BTreeMap;
-pub(super) use std::collections::BTreeSet;
-#[cfg(feature = "registry-notary-cel")]
-pub(super) use std::path::PathBuf;
-pub(super) use std::sync::atomic::{AtomicUsize, Ordering};
-pub(super) use std::sync::Arc;
-pub(super) use std::time::Duration;
-pub(super) use tempfile::TempDir;
-pub(super) use time::OffsetDateTime;
-pub(super) use ulid::Ulid;
-
-pub(super) const TEST_AUDIT_SECRET: &str = "0123456789abcdef0123456789abcdef";
-pub(super) const TEST_ISSUER_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA"}"#;
-#[cfg(feature = "registry-notary-cel")]
-pub(super) const TEST_ISSUER_ES256_JWK: &str = r#"{"kty":"EC","crv":"P-256","d":"MInq88dvxx-e1-MEfmdes4I6Gt2QbsKoEmYyk2j0Oj4","x":"3kpzAK6fK6xyfqbdp0HvfZCqfgz7MajMviKyM6bsNE4","y":"GkSdSn8xqge52rp9Sv-4qPaw1Q9TJ2eMUyY22flavLU","alg":"ES256"}"#;
-pub(super) const TEST_ACCESS_TOKEN_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"8jFBgUJxaaQimd4NjzxhvPYyNbcOnnZsqOntZbpP3Xk","x":"XvW-aWwJCWSYoYudTB9OZqNHURKElnnyGNa6DQNjzZk","alg":"EdDSA"}"#;
-pub(super) const TEST_ESIGNET_RP_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"EOLPz23yGd5Ju5e-PYybLE-YyvjgXLhGzS6XgmszzXs","x":"3v5jZ5rAf7KGvcC3zuKh6-ujgtA0ABa4jqmAWXq-S_c","alg":"EdDSA"}"#;
-pub(super) const TEST_HOLDER_JWK: &str = r#"{"crv":"Ed25519","d":"f4QIxnAyRWzhuBOmNRgvBTE56mWePdsPL0mvCtl8Gys","x":"pv4e_hXHBLN27rcs6VDFV1ED0TiU8M3xy9vsuWFEsec","kty":"OKP","alg":"EdDSA"}"#;
-pub(super) const TEST_RELAY_PROFILE_ID: &str = "example.person-status.exact";
-pub(super) const TEST_RELAY_CONTRACT_DOMAIN: &[u8] = b"registry.relay.consultation-contract.v1\0";
-
-pub(super) fn local_jwk_signing_key(private_jwk_env: &str, kid: &str) -> SigningKeyConfig {
-    SigningKeyConfig {
-        provider: SigningKeyProviderConfig::LocalJwkEnv,
-        alg: SD_JWT_VC_SIGNING_ALG.to_string(),
-        kid: kid.to_string(),
-        status: SigningKeyStatus::Active,
-        publish_until_unix_seconds: None,
-        private_jwk_env: private_jwk_env.to_string(),
-        public_jwk_env: String::new(),
-        module_path: String::new(),
-        token_label: String::new(),
-        pin_env: String::new(),
-        key_label: String::new(),
-        key_id_hex: String::new(),
-        path: String::new(),
-        password_env: String::new(),
-    }
-}
-
-#[derive(Clone)]
-struct TestRelayState {
-    contract: Value,
-    contract_hash: String,
-}
-
-pub(super) fn test_relay_contract() -> Value {
-    let mut contract: Value = serde_json::from_str(include_str!(
-        "../../../registry-relay/profiles/dhis2-2.41.9-enrollment-status/public-contract.json"
-    ))
-    .expect("test Relay contract parses");
-    contract["id"] = json!(TEST_RELAY_PROFILE_ID);
-    contract["spec"]["inputs"] = json!({
-        "subject_id": {
-            "role": "selector",
-            "type": "string",
-            "maxLength": 256,
-            "x-registry-max-bytes": 256,
-            "x-registry-canonicalization": "identity"
-        }
-    });
-    contract["spec"]["authorization"]["required_scope"] = json!("subject_access");
-    contract["spec"]["authorization"]["purposes"] = json!(["citizen_subject_access"]);
-    contract["spec"]["acquisition"]["fields"] = json!({
-        "active": { "type": "boolean", "nullable": true },
-        "birth_date": { "type": "date", "nullable": true },
-        "given_name": { "type": "string", "nullable": true, "max_bytes": 64 }
-    });
-    contract["spec"]["output"] = json!({
-        "active": { "type": "boolean", "nullable": true },
-        "birth_date": { "type": "date", "nullable": true },
-        "given_name": { "type": "string", "nullable": true, "max_bytes": 64 }
-    });
-    contract
-}
-
-pub(super) fn test_relay_contract_hash() -> String {
-    relay_contract_hash(&test_relay_contract())
-}
-
-pub(super) fn representative_test_relay_contract() -> Value {
-    let mut contract = test_relay_contract();
-    contract["spec"]["inputs"]["representative_id"] = json!({
-        "role": "selector",
-        "type": "string",
-        "maxLength": 256,
-        "x-registry-max-bytes": 256,
-        "x-registry-canonicalization": "identity"
-    });
-    contract
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn representative_test_relay_contract_hash() -> String {
-    relay_contract_hash(&representative_test_relay_contract())
-}
-
-fn relay_contract_hash(contract: &Value) -> String {
-    let canonical = canonicalize_json(contract).expect("contract canonicalizes");
-    let mut hasher = Sha256::new();
-    hasher.update(TEST_RELAY_CONTRACT_DOMAIN);
-    hasher.update(canonical);
-    let mut encoded = String::from("sha256:");
-    for byte in hasher.finalize() {
-        use std::fmt::Write as _;
-        write!(&mut encoded, "{byte:02x}").expect("hash encoding cannot fail");
-    }
-    encoded
-}
-
-async fn test_relay_metadata(State(state): State<TestRelayState>) -> Json<Value> {
-    Json(json!({
-        "contract_hash": state.contract_hash,
-        "contract": state.contract,
-    }))
-}
-
-async fn test_relay_execute(State(state): State<TestRelayState>, request: Request) -> Json<Value> {
-    let evaluation_id = request
-        .headers()
-        .get("registry-notary-evaluation-id")
-        .and_then(|value| value.to_str().ok())
-        .expect("Notary sends a canonical evaluation id")
-        .to_string();
-    let acquired_at = registry_notary_server::format_time(OffsetDateTime::now_utc());
-    let outputs = state.contract["spec"]["output"]
-        .as_object()
-        .expect("test Relay output contract is an object")
-        .iter()
-        .map(|(name, contract)| {
-            let value = match contract["type"].as_str() {
-                Some("boolean") => json!(true),
-                Some("date") => json!("2016-01-15"),
-                Some("integer") => json!(1),
-                Some("string") if name == "given_name" => json!("Miguel"),
-                Some("string") => json!("ACTIVE"),
-                Some("object") => json!({}),
-                Some("array") => json!([]),
-                _ => Value::Null,
-            };
-            (name.clone(), value)
-        })
-        .collect::<serde_json::Map<_, _>>();
-    Json(json!({
-        "schema": "registry.relay.consultation-result.v1",
-        "consultation_id": Ulid::new().to_string(),
-        "notary_evaluation_id": evaluation_id,
-        "profile": {
-            "id": TEST_RELAY_PROFILE_ID,
-            "contract_hash": state.contract_hash,
-        },
-        "outcome": "match",
-        "outputs": outputs,
-        "provenance": {
-            "acquired_at": acquired_at,
-            "source_observed_at": null,
-            "source_revision": null,
-            "acquisition_class": "source_projected_exact",
-            "integration": {
-                "id": "dhis2.tracker.enrollment-status",
-                "revision": 1
-            }
-        }
-    }))
-}
-
-async fn start_test_relay(contract: Value) -> String {
-    let state = TestRelayState {
-        contract_hash: relay_contract_hash(&contract),
-        contract,
-    };
-    let app = Router::new()
-        .route(
-            "/v1/consultations/example.person-status.exact",
-            get(test_relay_metadata),
-        )
-        .route(
-            "/v1/consultations/example.person-status.exact/execute",
-            axum::routing::post(test_relay_execute),
-        )
-        .with_state(state);
-    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
-        .await
-        .expect("test Relay binds");
-    let address = listener.local_addr().expect("test Relay has an address");
-    tokio::spawn(async move {
-        axum::serve(listener, app).await.expect("test Relay serves");
-    });
-    format!("http://{address}/")
-}
-
-fn test_relay_token() -> String {
-    let header = json!({
-        "alg": "RS256",
-        "kid": "relay-test-key",
-        "typ": "at+jwt",
-        "x5t": "relay-test-thumbprint",
-    });
-    let claims = json!({
-        "iss": "https://issuer.example.test",
-        "aud": ["registry-relay"],
-        "sub": "registry-notary",
-        "azp": "registry-notary",
-        "client_id": "registry-notary",
-        "scope": "subject_access",
-        "iat": 1_700_000_000_i64,
-        "nbf": 1_700_000_000_i64,
-        "exp": 4_102_444_800_i64,
-        "jti": "standalone-http-relay-test-token",
-    });
-    format!(
-        "{}.{}.{}",
-        URL_SAFE_NO_PAD.encode(serde_json::to_vec(&header).expect("header serializes")),
-        URL_SAFE_NO_PAD.encode(serde_json::to_vec(&claims).expect("claims serialize")),
-        URL_SAFE_NO_PAD.encode(b"relay-test-signature")
-    )
-}
-
-pub(super) async fn standalone_router(
-    config: StandaloneRegistryNotaryConfig,
-) -> Result<Router, StandaloneServerError> {
-    let admin_listener_mode = config.server.admin_listener.mode;
-    let runtime = activate_test_runtime(config).await?;
-    match admin_listener_mode {
-        RegistryNotaryAdminListenerMode::SharedWithPublic => {
-            notary_shared_router_from_runtime(runtime)
-        }
-        RegistryNotaryAdminListenerMode::Dedicated | RegistryNotaryAdminListenerMode::Disabled => {
-            Ok(notary_routers_from_runtime(runtime)?.public)
-        }
-    }
-}
-
-pub(super) async fn activate_test_runtime(
-    mut config: StandaloneRegistryNotaryConfig,
-) -> Result<NotaryRuntimeSnapshot, StandaloneServerError> {
-    let relay_contract = if config.subject_access.delegation.enabled {
-        representative_test_relay_contract()
-    } else {
-        test_relay_contract()
-    };
-    let mut relay_contract = relay_contract_for_config(&config, relay_contract);
-    let contract_hash = relay_contract_hash(&relay_contract);
-    for claim in &mut config.evidence.claims {
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
-            continue;
-        };
-        for consultation in consultations.values_mut() {
-            if consultation.profile.id == TEST_RELAY_PROFILE_ID {
-                consultation
-                    .profile
-                    .contract_hash
-                    .clone_from(&contract_hash);
-            }
-        }
-    }
-    if let Some(relay) = config.evidence.relay.as_mut() {
-        std::fs::write(&relay.token_file, test_relay_token())
-            .expect("test Relay workload token writes");
-        relay.base_url = start_test_relay(std::mem::take(&mut relay_contract)).await;
-    }
-    compile_notary_runtime(config)?.activate().await
-}
-
-fn relay_contract_for_config(
-    config: &StandaloneRegistryNotaryConfig,
-    mut contract: Value,
-) -> Value {
-    let Some((purpose, inputs, outputs)) = config.evidence.claims.iter().find_map(|claim| {
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-            return None;
-        };
-        consultations
-            .values()
-            .find(|consultation| consultation.profile.id == TEST_RELAY_PROFILE_ID)
-            .and_then(|consultation| {
-                Some((
-                    claim.purpose.clone()?,
-                    consultation.inputs.keys().cloned().collect::<Vec<_>>(),
-                    consultation.outputs.clone(),
-                ))
-            })
-    }) else {
-        return contract;
-    };
-
-    contract["spec"]["authorization"]["purposes"] = json!([purpose]);
-    contract["spec"]["inputs"] = Value::Object(
-        inputs
-            .into_iter()
-            .map(|name| {
-                (
-                    name,
-                    json!({
-                        "role": "selector",
-                        "type": "string",
-                        "maxLength": 256,
-                        "x-registry-max-bytes": 256,
-                        "x-registry-canonicalization": "identity"
-                    }),
-                )
-            })
-            .collect(),
-    );
-    contract["spec"]["output"] =
-        serde_json::to_value(outputs).expect("test Relay outputs serialize");
-    contract
-}
-
-#[derive(Debug, Deserialize)]
-pub(super) struct ExposureManifest {
-    pub(super) endpoints: Vec<ExposureEndpoint>,
-}
-
-#[derive(Debug, Deserialize)]
-pub(super) struct ExposureEndpoint {
-    pub(super) listener: String,
-    pub(super) method: String,
-    pub(super) path: String,
-    pub(super) feature: Option<String>,
-    pub(super) auth: String,
-}
-
-pub(super) fn person_target(id: &str) -> Value {
-    json!({
-        "type": "Person",
-        "id": id,
-    })
-}
-
-pub(super) fn person_identifier_target(scheme: &str, value: &str) -> Value {
-    json!({
-        "type": "Person",
-        "identifiers": [
-            { "scheme": scheme, "value": value }
-        ],
-    })
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn cel_worker_bin() -> PathBuf {
-    let env_path = PathBuf::from(env!("CARGO_BIN_EXE_registry-notary-cel-worker"));
-    if env_path
-        .parent()
-        .and_then(|parent| parent.file_name())
-        .is_some_and(|file_name| file_name == "deps")
-    {
-        let candidate = env_path
-            .parent()
-            .and_then(|parent| parent.parent())
-            .expect("target debug dir")
-            .join("registry-notary-cel-worker");
-        if candidate.is_file() {
-            return candidate;
-        }
-    }
-    env_path
-}
-
-pub(super) fn set_audit_secret() {
-    std::env::set_var("REGISTRY_NOTARY_AUDIT_HASH_SECRET", TEST_AUDIT_SECRET);
-    #[cfg(feature = "registry-notary-cel")]
-    std::env::set_var("REGISTRY_NOTARY_CEL_WORKER_COMMAND", cel_worker_bin());
-}
-
-pub(super) fn sign_oid4vci_proof(audience: &str, nonce: &str) -> String {
-    sign_oid4vci_did_jwk_proof(audience, Some(nonce), true)
-}
-
-fn sign_oid4vci_did_jwk_proof(audience: &str, nonce: Option<&str>, include_iss: bool) -> String {
-    let holder = PrivateJwk::parse(TEST_HOLDER_JWK).expect("holder JWK parses");
-    let holder_id = did_jwk_from_public_jwk(&holder.public()).expect("holder did:jwk encodes");
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let header_b64 = URL_SAFE_NO_PAD.encode(
-        serde_json::to_vec(&json!({
-            "alg": "EdDSA",
-            "typ": "openid4vci-proof+jwt",
-            "kid": holder_id,
-        }))
-        .expect("header serializes"),
-    );
-    let mut payload = serde_json::Map::from_iter([
-        ("aud".to_string(), json!(audience)),
-        ("iat".to_string(), json!(now)),
-        ("exp".to_string(), json!(now + 60)),
-    ]);
-    if include_iss {
-        payload.insert("iss".to_string(), json!(holder_id));
-    }
-    if let Some(nonce) = nonce {
-        payload.insert("nonce".to_string(), json!(nonce));
-    }
-    let payload_b64 = URL_SAFE_NO_PAD
-        .encode(serde_json::to_vec(&Value::Object(payload)).expect("payload serializes"));
-    let signing_input = format!("{header_b64}.{payload_b64}");
-    let signature = sign(signing_input.as_bytes(), &holder).expect("holder signs proof");
-    format!("{signing_input}.{}", URL_SAFE_NO_PAD.encode(signature))
-}
-
-pub(super) fn sign_oid4vci_inline_jwk_proof(audience: &str, nonce: &str) -> String {
-    let holder = PrivateJwk::parse(TEST_HOLDER_JWK).expect("holder JWK parses");
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let header_b64 = URL_SAFE_NO_PAD.encode(
-        serde_json::to_vec(&json!({
-            "alg": "EdDSA",
-            "typ": "openid4vci-proof+jwt",
-            "jwk": holder.public(),
-        }))
-        .expect("header serializes"),
-    );
-    let payload_b64 = URL_SAFE_NO_PAD.encode(
-        serde_json::to_vec(&json!({
-            "aud": audience,
-            "iat": now,
-            "exp": now + 60,
-            "nonce": nonce,
-        }))
-        .expect("payload serializes"),
-    );
-    let signing_input = format!("{header_b64}.{payload_b64}");
-    let signature = sign(signing_input.as_bytes(), &holder).expect("holder signs proof");
-    format!("{signing_input}.{}", URL_SAFE_NO_PAD.encode(signature))
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn sign_oid4vci_proof_without_iss(audience: &str, nonce: &str) -> String {
-    sign_oid4vci_did_jwk_proof(audience, Some(nonce), false)
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn sign_direct_holder_proof(holder_id: &str, evaluation_id: &str, jti: &str) -> String {
-    let holder = PrivateJwk::parse(TEST_HOLDER_JWK).expect("holder JWK parses");
-    let now = OffsetDateTime::now_utc().unix_timestamp();
-    let payload = json!({
-        "sub": holder_id,
-        "aud": "evidence.test",
-        "iat": now,
-        "exp": now + 60,
-        "jti": jti,
-        "evaluation_id": evaluation_id,
-        "credential_profile": "civil_status_sd_jwt",
-        "disclosure": URL_SAFE_NO_PAD.encode(Sha256::digest("value".as_bytes())),
-        "claims": ["person-is-alive"],
-    });
-    let header_b64 = URL_SAFE_NO_PAD.encode(
-        serde_json::to_vec(&json!({
-            "alg": "EdDSA",
-            "typ": "kb+jwt",
-            "kid": holder_id,
-        }))
-        .expect("header serializes"),
-    );
-    let payload_b64 =
-        URL_SAFE_NO_PAD.encode(serde_json::to_vec(&payload).expect("payload serializes"));
-    let signing_input = format!("{header_b64}.{payload_b64}");
-    let signature = sign(signing_input.as_bytes(), &holder).expect("holder proof signs");
-    format!("{signing_input}.{}", URL_SAFE_NO_PAD.encode(signature))
-}
-
-#[cfg(feature = "registry-notary-cel")]
-pub(super) fn holder_did_jwk() -> String {
-    let holder = PrivateJwk::parse(TEST_HOLDER_JWK).expect("holder JWK parses");
-    did_jwk_from_public_jwk(&holder.public()).expect("holder did:jwk encodes")
-}
-
-pub(super) fn enable_credential_status(config: &mut StandaloneRegistryNotaryConfig) {
-    config.credential_status = serde_norway::from_str(
-        r#"
-enabled: true
-base_url: http://127.0.0.1:4325
-retention_seconds: 3600
-"#,
-    )
-    .expect("credential status config parses");
-}
-
-pub(super) fn env_fingerprint_ref(env_name: &str) -> CredentialFingerprintRef {
-    CredentialFingerprintRef {
-        provider: CredentialFingerprintProvider::Env,
-        name: Some(env_name.to_string()),
-        path: None,
-    }
-}
-
-pub(super) fn add_admin_api_key(config: &mut StandaloneRegistryNotaryConfig) {
-    let fingerprint = "sha256:10a4c7c9fc5206d6f36dc6944a81bb6f4a3cb0e25014ae3b12e6c3e52712292a";
-    std::env::set_var("TEST_EVIDENCE_ADMIN_KEY_HASH", fingerprint);
-    config.auth.api_keys.push(EvidenceCredentialConfig {
-        id: "admin".to_string(),
-        fingerprint: env_fingerprint_ref("TEST_EVIDENCE_ADMIN_KEY_HASH"),
-        scopes: vec!["registry_notary:admin".to_string()],
-        authorization_details: None,
-    });
-}
-
-pub(super) fn add_ops_read_api_key(config: &mut StandaloneRegistryNotaryConfig) {
-    let fingerprint = "sha256:d9310c002af91822beb0b3487d8b04f85bf6bf1f8a5496bff7d35fc7c5a29def";
-    std::env::set_var("TEST_EVIDENCE_OPS_KEY_HASH", fingerprint);
-    config.auth.api_keys.push(EvidenceCredentialConfig {
-        id: "ops".to_string(),
-        fingerprint: env_fingerprint_ref("TEST_EVIDENCE_OPS_KEY_HASH"),
-        scopes: vec!["registry_notary:ops_read".to_string()],
-        authorization_details: None,
-    });
-}
-
-pub(super) fn add_metrics_read_api_key(config: &mut StandaloneRegistryNotaryConfig) {
-    let fingerprint = "sha256:eb5a63e42b6b498364b3f10d5c3bb71cd8c7a7a9ad16524875557fa2e52f5d41";
-    std::env::set_var("TEST_EVIDENCE_METRICS_KEY_HASH", fingerprint);
-    config.auth.api_keys.push(EvidenceCredentialConfig {
-        id: "metrics".to_string(),
-        fingerprint: env_fingerprint_ref("TEST_EVIDENCE_METRICS_KEY_HASH"),
-        scopes: vec!["registry_notary:metrics_read".to_string()],
-        authorization_details: None,
-    });
-}
-
-pub(super) fn enable_shared_admin_listener(config: &mut StandaloneRegistryNotaryConfig) {
-    config.server.admin_listener.mode = RegistryNotaryAdminListenerMode::SharedWithPublic;
-}
-
-pub(super) fn assert_matches_posture_schema(body: &Value) {
-    let schema: Value = serde_json::from_str(registry_platform_ops::POSTURE_SCHEMA_V1)
-        .expect("posture schema parses");
-    let compiled = jsonschema::JSONSchema::compile(&schema).expect("posture schema compiles");
-    let errors = compiled
-        .validate(body)
-        .err()
-        .map(|errors| errors.map(|error| error.to_string()).collect::<Vec<_>>())
-        .unwrap_or_default();
-    assert!(
-        errors.is_empty(),
-        "posture response did not match registry.ops.posture.v1: {errors:?}\n{body:#}"
-    );
-}
-
-pub(super) fn assert_standards_artifacts_omit_sha256(body: &Value, label: &str) {
-    let artifacts = body["standards_artifacts"]
-        .as_object()
-        .expect("posture standards_artifacts is object");
-    for (name, artifact) in artifacts {
-        assert!(
-            artifact.get("sha256").is_none(),
-            "{label} standards_artifacts.{name} includes sha256, but live Notary posture no longer emits it"
-        );
-    }
-}
-
-pub(super) fn assert_matches_admin_capabilities_schema(body: &Value) {
-    let schema: Value = serde_json::from_str(registry_platform_ops::ADMIN_CAPABILITIES_SCHEMA_V1)
-        .expect("admin capabilities schema parses");
-    let compiled =
-        jsonschema::JSONSchema::compile(&schema).expect("admin capabilities schema compiles");
-    let errors = compiled
-        .validate(body)
-        .err()
-        .map(|errors| errors.map(|error| error.to_string()).collect::<Vec<_>>())
-        .unwrap_or_default();
-    assert!(
-        errors.is_empty(),
-        "capabilities response did not match registry.admin.capabilities.v1: {errors:?}\n{body:#}"
-    );
-}
-
-pub(super) fn sample_manifest_path(path: &str) -> String {
-    path.replace("{claim_id}", "farmed-land-size")
-        .replace("{evaluation_id}", "eval-1")
-        .replace("{credential_id}", "urn:ulid:01HX0000000000000000000000")
-        .replace("{*vct_path}", "civil-status")
-}
-
-pub(super) fn registry_backed_config(
-    _base_url: &str,
-    audit_path: &str,
-) -> StandaloneRegistryNotaryConfig {
-    set_audit_secret();
-    let contract_hash = test_relay_contract_hash();
-    let raw = format!(
-        r#"
-deployment:
-  profile: local
-state:
-  storage: in_memory
-server:
-  bind: 127.0.0.1:0
-auth:
-  api_keys:
-    - id: caseworker
-      fingerprint:
-        provider: env
-        name: TEST_EVIDENCE_API_KEY_HASH
-      scopes: [farmer_registry:evidence_verification]
-audit:
-  sink: file
-  path: "{audit_path}"
-  hash_secret_env: REGISTRY_NOTARY_AUDIT_HASH_SECRET
-evidence:
-  enabled: true
-  service_id: evidence.test
-  api_base_url: https://evidence.example.test
-  relay:
-    base_url: http://127.0.0.1:1
-    workload_client_id: registry-notary
-    token_file: "{audit_path}.relay-token"
-    allow_insecure_localhost: true
-  allowed_purposes:
-    - https://purpose.example.test/eligibility
-  claims:
-    - id: farmer-under-4ha
-      title: Farmer under four hectares
-      version: 2026-05
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          person_status:
-            profile:
-              id: {TEST_RELAY_PROFILE_ID}
-              contract_hash: {contract_hash}
-            inputs:
-              subject_id: target.id
-            outputs:
-              active: {{ type: boolean, nullable: true }}
-      value:
-        type: boolean
-        nullable: true
-      purpose: https://purpose.example.test/eligibility
-      required_scopes:
-        - farmer_registry:evidence_verification
-      rule:
-        type: consultation_output
-        consultation: person_status
-        output: active
-      disclosure:
-        default: predicate
-        allowed: [predicate, redacted]
-      formats:
-        - application/vnd.registry-notary.claim-result+json
-"#
-    );
-    serde_norway::from_str(&raw).expect("registry-backed Notary config deserializes")
-}
diff --git a/crates/registry-notary-worker-harness/Cargo.toml b/crates/registry-notary-worker-harness/Cargo.toml
deleted file mode 100644
index 4591f20df..000000000
--- a/crates/registry-notary-worker-harness/Cargo.toml
+++ /dev/null
@@ -1,27 +0,0 @@
-[package]
-name = "registry-notary-worker-harness"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Registry Notary hardened JSON-line worker process pool."
-readme = "README.md"
-repository.workspace = true
-publish = false
-
-# not opted into [workspace.lints]: uses unsafe (libc setrlimit, `unsafe
-# extern "C"` in src/lib.rs)
-
-[dependencies]
-serde.workspace = true
-serde_json.workspace = true
-thiserror.workspace = true
-tokio = { workspace = true, features = ["io-util", "process"] }
-tracing.workspace = true
-
-[target.'cfg(unix)'.dependencies]
-libc = { version = "0.2" }
-
-[[bin]]
-name = "registry-notary-worker-harness-fixture"
-path = "src/bin/worker_harness_fixture.rs"
-test = false
diff --git a/crates/registry-notary-worker-harness/README.md b/crates/registry-notary-worker-harness/README.md
deleted file mode 100644
index c24d1a53c..000000000
--- a/crates/registry-notary-worker-harness/README.md
+++ /dev/null
@@ -1,6 +0,0 @@
-# Registry Notary Worker Harness
-
-Generic hardened JSON-line worker process pool used by Registry Notary worker
-integrations. The harness owns process spawning, environment scrubbing,
-resource limits, bounded request and response IO, timeout kill, replacement,
-and pool snapshots. Protocol semantics stay with the caller.
diff --git a/crates/registry-notary-worker-harness/src/bin/worker_harness_fixture.rs b/crates/registry-notary-worker-harness/src/bin/worker_harness_fixture.rs
deleted file mode 100644
index 35b86b267..000000000
--- a/crates/registry-notary-worker-harness/src/bin/worker_harness_fixture.rs
+++ /dev/null
@@ -1,205 +0,0 @@
-use serde::Deserialize;
-use serde_json::{json, Value};
-use std::{
-    env, fs,
-    io::{self, BufRead, Write},
-    process, thread,
-    time::Duration,
-};
-
-#[derive(Deserialize)]
-struct FixtureRequest {
-    mode: Option<String>,
-    sleep_ms: Option<u64>,
-    stdout_bytes: Option<usize>,
-    stderr_bytes: Option<usize>,
-    stderr_payload: Option<String>,
-    env_keys: Option<Vec<String>>,
-    value: Option<Value>,
-}
-
-fn main() {
-    let start_ordinal = claim_start_ordinal_if_configured();
-    fail_start_ordinal_if_configured(start_ordinal);
-    exit_once_on_start_if_configured();
-    fail_after_first_start_if_configured();
-
-    let stdin = io::stdin();
-    let mut stdout = io::stdout();
-    let mut stderr = io::stderr();
-    prewrite_stdout_if_configured(&mut stdout);
-
-    for line in stdin.lock().lines() {
-        let line = match line {
-            Ok(line) => line,
-            Err(_) => process::exit(2),
-        };
-        let request = match serde_json::from_str::<FixtureRequest>(&line) {
-            Ok(request) => request,
-            Err(error) => {
-                let _ = writeln!(stderr, "invalid request: {error}");
-                process::exit(2);
-            }
-        };
-
-        match request.mode.as_deref() {
-            Some("startup") => {
-                write_json(&mut stdout, json!({ "ready": true }));
-                exit_initial_workers_after_startup_if_configured(start_ordinal);
-            }
-            Some("startup-sleep") => {
-                thread::sleep(Duration::from_millis(request.sleep_ms.unwrap_or(100)));
-                write_json(&mut stdout, json!({ "ready": true }));
-            }
-            Some("sleep") => {
-                thread::sleep(Duration::from_millis(request.sleep_ms.unwrap_or(100)));
-                write_json(&mut stdout, json!({ "ok": true, "pid": process::id() }));
-            }
-            Some("hang") => loop {
-                thread::sleep(Duration::from_secs(60));
-            },
-            Some("big-stdout") => {
-                let bytes = request.stdout_bytes.unwrap_or(1024);
-                let _ = stdout.write_all(vec![b'x'; bytes].as_slice());
-                let _ = stdout.write_all(b"\n");
-                let _ = stdout.flush();
-            }
-            Some("stderr-then-crash") => {
-                let bytes = request.stderr_bytes.unwrap_or(1024);
-                let payload = request.stderr_payload.unwrap_or_else(|| "e".to_string());
-                write_repeated(&mut stderr, payload.as_bytes(), bytes);
-                let _ = stderr.flush();
-                process::exit(7);
-            }
-            Some("env") => {
-                let mut values = serde_json::Map::new();
-                for key in request.env_keys.unwrap_or_default() {
-                    values.insert(
-                        key.clone(),
-                        env::var(&key).map_or(Value::Null, Value::String),
-                    );
-                }
-                write_json(
-                    &mut stdout,
-                    json!({ "ok": true, "pid": process::id(), "env": values }),
-                );
-            }
-            Some("exit") => {
-                process::exit(6);
-            }
-            _ => {
-                write_json(
-                    &mut stdout,
-                    json!({
-                        "ok": true,
-                        "pid": process::id(),
-                        "value": request.value,
-                    }),
-                );
-            }
-        }
-    }
-}
-
-fn claim_start_ordinal_if_configured() -> Option<usize> {
-    let directory = env::var_os("WORKER_HARNESS_START_ORDINAL_DIR")?;
-    for ordinal in 1..=1024 {
-        match fs::create_dir(std::path::Path::new(&directory).join(ordinal.to_string())) {
-            Ok(()) => return Some(ordinal),
-            Err(error) if error.kind() == io::ErrorKind::AlreadyExists => {}
-            Err(_) => process::exit(8),
-        }
-    }
-    process::exit(8);
-}
-
-fn fail_start_ordinal_if_configured(start_ordinal: Option<usize>) {
-    let Some(fail_ordinal) = env::var("WORKER_HARNESS_FAIL_START_ORDINAL")
-        .ok()
-        .and_then(|value| value.parse::<usize>().ok())
-    else {
-        return;
-    };
-    if start_ordinal == Some(fail_ordinal) {
-        process::exit(7);
-    }
-}
-
-fn exit_initial_workers_after_startup_if_configured(start_ordinal: Option<usize>) {
-    let Some(exit_through) = env::var("WORKER_HARNESS_EXIT_START_ORDINALS_THROUGH")
-        .ok()
-        .and_then(|value| value.parse::<usize>().ok())
-    else {
-        return;
-    };
-    if start_ordinal.is_none_or(|ordinal| ordinal > exit_through) {
-        return;
-    }
-    let delay = env::var("WORKER_HARNESS_EXIT_AFTER_STARTUP_MS")
-        .ok()
-        .and_then(|value| value.parse::<u64>().ok())
-        .unwrap_or(100);
-    thread::sleep(Duration::from_millis(delay));
-    process::exit(0);
-}
-
-fn fail_after_first_start_if_configured() {
-    let Some(path) = env::var_os("WORKER_HARNESS_FAIL_AFTER_FIRST_START_STATE") else {
-        return;
-    };
-    match fs::read_to_string(&path) {
-        Ok(contents) if contents.trim() == "started" => process::exit(7),
-        _ => fs::write(path, "started\n").expect("write fixture first-start state"),
-    }
-}
-
-fn prewrite_stdout_if_configured(stdout: &mut io::Stdout) {
-    let Some(bytes) = env::var("WORKER_HARNESS_PREWRITE_STDOUT_BYTES")
-        .ok()
-        .and_then(|value| value.parse::<usize>().ok())
-    else {
-        return;
-    };
-    write_json(
-        stdout,
-        json!({
-            "ok": true,
-            "pid": process::id(),
-            "prewritten": "x".repeat(bytes),
-        }),
-    );
-}
-
-fn exit_once_on_start_if_configured() {
-    let Some(path) = env::var_os("WORKER_HARNESS_EXIT_ONCE_STATE") else {
-        return;
-    };
-    match fs::read_to_string(&path) {
-        Ok(contents) if contents.trim() == "exited" => {}
-        _ => {
-            fs::write(path, "exited\n").expect("write fixture state");
-            process::exit(7);
-        }
-    }
-}
-
-fn write_json(stdout: &mut io::Stdout, value: Value) {
-    serde_json::to_writer(&mut *stdout, &value).expect("write fixture response");
-    stdout.write_all(b"\n").expect("write fixture newline");
-    stdout.flush().expect("flush fixture response");
-}
-
-fn write_repeated(stderr: &mut io::Stderr, payload: &[u8], bytes: usize) {
-    if payload.is_empty() {
-        let _ = stderr.write_all(vec![b'e'; bytes].as_slice());
-        return;
-    }
-
-    let mut written = 0;
-    while written < bytes {
-        let remaining = bytes - written;
-        let chunk_len = remaining.min(payload.len());
-        let _ = stderr.write_all(&payload[..chunk_len]);
-        written += chunk_len;
-    }
-}
diff --git a/crates/registry-notary-worker-harness/src/lib.rs b/crates/registry-notary-worker-harness/src/lib.rs
deleted file mode 100644
index fe6679d7f..000000000
--- a/crates/registry-notary-worker-harness/src/lib.rs
+++ /dev/null
@@ -1,1353 +0,0 @@
-use serde::Serialize;
-use serde_json::Value;
-use std::{
-    collections::BTreeSet,
-    collections::VecDeque,
-    ffi::OsString,
-    fmt,
-    path::PathBuf,
-    process::ExitStatus,
-    sync::{
-        atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering},
-        Arc,
-    },
-    time::{Duration, Instant},
-};
-use thiserror::Error;
-use tokio::{
-    io::{self, AsyncBufRead, AsyncBufReadExt, AsyncReadExt, AsyncWriteExt, BufReader},
-    process::{Child, ChildStderr, ChildStdin, ChildStdout, Command},
-    sync::Mutex,
-    task::{JoinHandle, JoinSet},
-    time,
-};
-use tracing::error;
-
-// A protocol reply alone does not prove usable capacity when the process exits
-// immediately after flushing it. Observe one short, value-free liveness window
-// without sending a second protocol request.
-const POST_PROBE_LIVENESS_WINDOW: Duration = Duration::from_millis(25);
-const MINIMUM_NONZERO_TIMEOUT: Duration = Duration::from_nanos(1);
-
-#[derive(Clone, Eq, PartialEq)]
-pub struct WorkerCommand {
-    pub program: PathBuf,
-    pub args: Vec<OsString>,
-    pub envs: Vec<(OsString, OsString)>,
-    pub current_dir: Option<PathBuf>,
-}
-
-impl fmt::Debug for WorkerCommand {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("WorkerCommand")
-            .field("program", &self.program)
-            .field("args", &self.args)
-            .field("env_count", &self.envs.len())
-            .field("current_dir", &self.current_dir)
-            .finish()
-    }
-}
-
-impl WorkerCommand {
-    pub fn new(program: impl Into<PathBuf>) -> Self {
-        Self {
-            program: program.into(),
-            args: Vec::new(),
-            envs: Vec::new(),
-            current_dir: None,
-        }
-    }
-
-    pub fn arg(mut self, arg: impl Into<OsString>) -> Self {
-        self.args.push(arg.into());
-        self
-    }
-
-    pub fn env(mut self, key: impl Into<OsString>, value: impl Into<OsString>) -> Self {
-        self.envs.push((key.into(), value.into()));
-        self
-    }
-
-    pub fn current_dir(mut self, current_dir: impl Into<PathBuf>) -> Self {
-        self.current_dir = Some(current_dir.into());
-        self
-    }
-}
-
-#[derive(Clone, Debug)]
-pub struct WorkerStartupProbe {
-    pub request: Value,
-    pub expected_response: Value,
-}
-
-#[derive(Clone, Debug)]
-pub struct WorkerPoolConfig {
-    pub command: WorkerCommand,
-    pub forbidden_env_names: BTreeSet<OsString>,
-    pub max_workers: usize,
-    pub startup_probe: Option<WorkerStartupProbe>,
-    /// Pool-wide spawn-and-probe deadline. When a startup probe is configured,
-    /// this must exceed the fixed post-probe liveness window.
-    pub startup_timeout: Duration,
-    pub request_timeout: Duration,
-    pub max_request_bytes: usize,
-    pub max_stdout_bytes: usize,
-    pub max_stderr_bytes: usize,
-    pub max_memory_bytes: Option<u64>,
-    pub replacement_window: Duration,
-    pub max_replacements_per_window: usize,
-    pub circuit_breaker_cooldown: Duration,
-}
-
-impl WorkerPoolConfig {
-    /// Return the smallest structurally valid pool-wide startup deadline.
-    ///
-    /// The worker still has to spawn and answer its protocol probe inside the
-    /// time left before the post-probe liveness window.
-    #[must_use]
-    pub const fn required_startup_timeout(&self) -> Duration {
-        if self.startup_probe.is_some() {
-            POST_PROBE_LIVENESS_WINDOW.saturating_add(MINIMUM_NONZERO_TIMEOUT)
-        } else {
-            MINIMUM_NONZERO_TIMEOUT
-        }
-    }
-
-    pub fn validate(&self) -> Result<(), WorkerError> {
-        if self.max_workers == 0 {
-            return Err(WorkerError::InvalidConfig {
-                reason: "max_workers must be greater than zero",
-            });
-        }
-        if self.startup_timeout < self.required_startup_timeout() {
-            let reason = if self.startup_probe.is_some() {
-                "startup_timeout must exceed the post-probe liveness window when startup_probe is configured"
-            } else {
-                "startup_timeout must be greater than zero"
-            };
-            return Err(WorkerError::InvalidConfig { reason });
-        }
-        if self.request_timeout.is_zero() {
-            return Err(WorkerError::InvalidConfig {
-                reason: "request_timeout must be greater than zero",
-            });
-        }
-        if self.max_request_bytes == 0 {
-            return Err(WorkerError::InvalidConfig {
-                reason: "max_request_bytes must be greater than zero",
-            });
-        }
-        if self.max_stdout_bytes == 0 {
-            return Err(WorkerError::InvalidConfig {
-                reason: "max_stdout_bytes must be greater than zero",
-            });
-        }
-        if self.replacement_window.is_zero() {
-            return Err(WorkerError::InvalidConfig {
-                reason: "replacement_window must be greater than zero",
-            });
-        }
-        if self.max_replacements_per_window == 0 {
-            return Err(WorkerError::InvalidConfig {
-                reason: "max_replacements_per_window must be greater than zero",
-            });
-        }
-        if self.circuit_breaker_cooldown.is_zero() {
-            return Err(WorkerError::InvalidConfig {
-                reason: "circuit_breaker_cooldown must be greater than zero",
-            });
-        }
-        if self
-            .command
-            .envs
-            .iter()
-            .any(|(key, _)| self.forbidden_env_names.contains(key))
-        {
-            return Err(WorkerError::InvalidConfig {
-                reason: "worker command env must not include credential or token env names",
-            });
-        }
-        Ok(())
-    }
-}
-
-#[derive(Clone, Eq, PartialEq)]
-pub struct CapturedOutput {
-    bytes: Vec<u8>,
-    truncated: bool,
-}
-
-impl CapturedOutput {
-    fn empty() -> Self {
-        Self {
-            bytes: Vec::new(),
-            truncated: false,
-        }
-    }
-
-    pub fn as_bytes(&self) -> &[u8] {
-        &self.bytes
-    }
-
-    pub fn len(&self) -> usize {
-        self.bytes.len()
-    }
-
-    pub fn is_empty(&self) -> bool {
-        self.bytes.is_empty()
-    }
-
-    pub fn is_truncated(&self) -> bool {
-        self.truncated
-    }
-
-    pub fn to_string_lossy(&self) -> String {
-        String::from_utf8_lossy(&self.bytes).into_owned()
-    }
-}
-
-impl fmt::Debug for CapturedOutput {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("CapturedOutput")
-            .field("bytes_len", &self.bytes.len())
-            .field("truncated", &self.truncated)
-            .finish()
-    }
-}
-
-#[derive(Error)]
-pub enum WorkerError {
-    #[error("invalid worker pool config: {reason}")]
-    InvalidConfig { reason: &'static str },
-    #[error("worker pool saturated: all {max_workers} workers are busy")]
-    Saturated { max_workers: usize },
-    #[error("worker replacement circuit breaker is open; retry after {retry_after:?}")]
-    CircuitOpen { retry_after: Duration },
-    #[error("worker request too large: {bytes} bytes exceeds limit {limit}")]
-    RequestTooLarge { bytes: usize, limit: usize },
-    #[error("failed to encode worker request: {source}")]
-    Encode {
-        #[source]
-        source: serde_json::Error,
-    },
-    #[error("failed to spawn worker: {source}")]
-    Spawn {
-        #[source]
-        source: io::Error,
-    },
-    #[error("worker pool startup timed out after {timeout:?}")]
-    StartupTimeout { timeout: Duration },
-    #[error("worker {worker_id} failed its startup protocol probe; stderr bytes captured: {stderr_len}, truncated: {stderr_truncated}")]
-    StartupProbeFailed {
-        worker_id: u64,
-        stderr_len: usize,
-        stderr_truncated: bool,
-        stderr: CapturedOutput,
-    },
-    #[error("worker {worker_id} timed out after {timeout:?}; stderr bytes captured: {stderr_len}, truncated: {stderr_truncated}")]
-    Timeout {
-        worker_id: u64,
-        timeout: Duration,
-        stderr_len: usize,
-        stderr_truncated: bool,
-        stderr: CapturedOutput,
-    },
-    #[error("worker {worker_id} stdout exceeded limit {limit}; stderr bytes captured: {stderr_len}, truncated: {stderr_truncated}")]
-    StdoutTooLarge {
-        worker_id: u64,
-        limit: usize,
-        stderr_len: usize,
-        stderr_truncated: bool,
-        stderr: CapturedOutput,
-    },
-    #[error("worker {worker_id} returned invalid JSON: {source}; stderr bytes captured: {stderr_len}, truncated: {stderr_truncated}")]
-    InvalidOutput {
-        worker_id: u64,
-        #[source]
-        source: serde_json::Error,
-        stderr_len: usize,
-        stderr_truncated: bool,
-        stderr: CapturedOutput,
-    },
-    #[error("worker {worker_id} exited before returning a response with status {status:?}; stderr bytes captured: {stderr_len}, truncated: {stderr_truncated}")]
-    WorkerExited {
-        worker_id: u64,
-        status: Option<ExitStatus>,
-        stderr_len: usize,
-        stderr_truncated: bool,
-        stderr: CapturedOutput,
-    },
-    #[error("worker {worker_id} IO failure: {source}; stderr bytes captured: {stderr_len}, truncated: {stderr_truncated}")]
-    Io {
-        worker_id: u64,
-        #[source]
-        source: io::Error,
-        stderr_len: usize,
-        stderr_truncated: bool,
-        stderr: CapturedOutput,
-    },
-}
-
-impl fmt::Debug for WorkerError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::InvalidConfig { reason } => f
-                .debug_struct("InvalidConfig")
-                .field("reason", reason)
-                .finish(),
-            Self::Saturated { max_workers } => f
-                .debug_struct("Saturated")
-                .field("max_workers", max_workers)
-                .finish(),
-            Self::CircuitOpen { retry_after } => f
-                .debug_struct("CircuitOpen")
-                .field("retry_after", retry_after)
-                .finish(),
-            Self::RequestTooLarge { bytes, limit } => f
-                .debug_struct("RequestTooLarge")
-                .field("bytes", bytes)
-                .field("limit", limit)
-                .finish(),
-            Self::Encode { source } => f.debug_struct("Encode").field("source", source).finish(),
-            Self::Spawn { source } => f.debug_struct("Spawn").field("source", source).finish(),
-            Self::StartupTimeout { timeout } => f
-                .debug_struct("StartupTimeout")
-                .field("timeout", timeout)
-                .finish(),
-            Self::StartupProbeFailed {
-                worker_id,
-                stderr_len,
-                stderr_truncated,
-                ..
-            } => f
-                .debug_struct("StartupProbeFailed")
-                .field("worker_id", worker_id)
-                .field("stderr_len", stderr_len)
-                .field("stderr_truncated", stderr_truncated)
-                .finish(),
-            Self::Timeout {
-                worker_id,
-                timeout,
-                stderr_len,
-                stderr_truncated,
-                ..
-            } => f
-                .debug_struct("Timeout")
-                .field("worker_id", worker_id)
-                .field("timeout", timeout)
-                .field("stderr_len", stderr_len)
-                .field("stderr_truncated", stderr_truncated)
-                .finish(),
-            Self::StdoutTooLarge {
-                worker_id,
-                limit,
-                stderr_len,
-                stderr_truncated,
-                ..
-            } => f
-                .debug_struct("StdoutTooLarge")
-                .field("worker_id", worker_id)
-                .field("limit", limit)
-                .field("stderr_len", stderr_len)
-                .field("stderr_truncated", stderr_truncated)
-                .finish(),
-            Self::InvalidOutput {
-                worker_id,
-                source,
-                stderr_len,
-                stderr_truncated,
-                ..
-            } => f
-                .debug_struct("InvalidOutput")
-                .field("worker_id", worker_id)
-                .field("source", source)
-                .field("stderr_len", stderr_len)
-                .field("stderr_truncated", stderr_truncated)
-                .finish(),
-            Self::WorkerExited {
-                worker_id,
-                status,
-                stderr_len,
-                stderr_truncated,
-                ..
-            } => f
-                .debug_struct("WorkerExited")
-                .field("worker_id", worker_id)
-                .field("status", status)
-                .field("stderr_len", stderr_len)
-                .field("stderr_truncated", stderr_truncated)
-                .finish(),
-            Self::Io {
-                worker_id,
-                source,
-                stderr_len,
-                stderr_truncated,
-                ..
-            } => f
-                .debug_struct("Io")
-                .field("worker_id", worker_id)
-                .field("source", source)
-                .field("stderr_len", stderr_len)
-                .field("stderr_truncated", stderr_truncated)
-                .finish(),
-        }
-    }
-}
-
-impl WorkerError {
-    pub fn worker_id(&self) -> Option<u64> {
-        match self {
-            Self::Timeout { worker_id, .. }
-            | Self::StartupProbeFailed { worker_id, .. }
-            | Self::StdoutTooLarge { worker_id, .. }
-            | Self::InvalidOutput { worker_id, .. }
-            | Self::WorkerExited { worker_id, .. }
-            | Self::Io { worker_id, .. } => Some(*worker_id),
-            _ => None,
-        }
-    }
-
-    pub fn stderr(&self) -> Option<&CapturedOutput> {
-        match self {
-            Self::Timeout { stderr, .. }
-            | Self::StartupProbeFailed { stderr, .. }
-            | Self::StdoutTooLarge { stderr, .. }
-            | Self::InvalidOutput { stderr, .. }
-            | Self::WorkerExited { stderr, .. }
-            | Self::Io { stderr, .. } => Some(stderr),
-            _ => None,
-        }
-    }
-
-    fn timeout(worker_id: u64, timeout: Duration, stderr: CapturedOutput) -> Self {
-        Self::Timeout {
-            worker_id,
-            timeout,
-            stderr_len: stderr.len(),
-            stderr_truncated: stderr.is_truncated(),
-            stderr,
-        }
-    }
-
-    fn with_stderr(self, stderr: CapturedOutput) -> Self {
-        match self {
-            Self::Timeout {
-                worker_id, timeout, ..
-            } => Self::Timeout {
-                worker_id,
-                timeout,
-                stderr_len: stderr.len(),
-                stderr_truncated: stderr.is_truncated(),
-                stderr,
-            },
-            Self::StartupProbeFailed { worker_id, .. } => Self::StartupProbeFailed {
-                worker_id,
-                stderr_len: stderr.len(),
-                stderr_truncated: stderr.is_truncated(),
-                stderr,
-            },
-            Self::StdoutTooLarge {
-                worker_id, limit, ..
-            } => Self::StdoutTooLarge {
-                worker_id,
-                limit,
-                stderr_len: stderr.len(),
-                stderr_truncated: stderr.is_truncated(),
-                stderr,
-            },
-            Self::InvalidOutput {
-                worker_id, source, ..
-            } => Self::InvalidOutput {
-                worker_id,
-                source,
-                stderr_len: stderr.len(),
-                stderr_truncated: stderr.is_truncated(),
-                stderr,
-            },
-            Self::WorkerExited {
-                worker_id, status, ..
-            } => Self::WorkerExited {
-                worker_id,
-                status,
-                stderr_len: stderr.len(),
-                stderr_truncated: stderr.is_truncated(),
-                stderr,
-            },
-            Self::Io {
-                worker_id, source, ..
-            } => Self::Io {
-                worker_id,
-                source,
-                stderr_len: stderr.len(),
-                stderr_truncated: stderr.is_truncated(),
-                stderr,
-            },
-            error => error,
-        }
-    }
-}
-
-#[derive(Clone)]
-pub struct WorkerPool {
-    inner: Arc<WorkerPoolInner>,
-}
-
-struct WorkerPoolInner {
-    config: WorkerPoolConfig,
-    idle: Mutex<VecDeque<Worker>>,
-    replenishing: AtomicBool,
-    warming_workers: AtomicUsize,
-    next_worker_id: AtomicU64,
-    in_flight: AtomicUsize,
-    completed_total: AtomicU64,
-    replacements_total: AtomicU64,
-    started_at: Instant,
-    active_since: Mutex<Option<Instant>>,
-    last_completed: Mutex<Option<Instant>>,
-    replacement_events: Mutex<VecDeque<Instant>>,
-    circuit_open_until: Mutex<Option<Instant>>,
-}
-
-#[derive(Clone, Debug, Eq, PartialEq)]
-pub struct WorkerPoolSnapshot {
-    pub max_workers: usize,
-    pub idle_workers: usize,
-    pub warming_workers: usize,
-    pub in_flight: usize,
-    pub completed_total: u64,
-    pub replacements_total: u64,
-    pub circuit_open: bool,
-    pub active_for: Option<Duration>,
-    pub completed_within: Option<Duration>,
-    pub pool_age: Duration,
-}
-
-#[derive(Debug)]
-pub struct WorkerExecution {
-    pub value: Value,
-    pub worker_id: u64,
-}
-
-impl WorkerPool {
-    pub async fn new(config: WorkerPoolConfig) -> Result<Self, WorkerError> {
-        config.validate()?;
-
-        let inner = Arc::new(WorkerPoolInner {
-            config,
-            idle: Mutex::new(VecDeque::new()),
-            replenishing: AtomicBool::new(false),
-            warming_workers: AtomicUsize::new(0),
-            next_worker_id: AtomicU64::new(1),
-            in_flight: AtomicUsize::new(0),
-            completed_total: AtomicU64::new(0),
-            replacements_total: AtomicU64::new(0),
-            started_at: Instant::now(),
-            active_since: Mutex::new(None),
-            last_completed: Mutex::new(None),
-            replacement_events: Mutex::new(VecDeque::new()),
-            circuit_open_until: Mutex::new(None),
-        });
-
-        let startup_deadline =
-            time::Instant::from_std(inner.started_at + inner.config.startup_timeout);
-        let batch = WorkerPoolInner::spawn_worker_batch_until(
-            Arc::clone(&inner),
-            inner.config.max_workers,
-            startup_deadline,
-        )
-        .await;
-        if let Some(error) = batch.first_error {
-            return Err(error);
-        }
-        inner.idle.lock().await.extend(batch.ready);
-
-        Ok(Self { inner })
-    }
-
-    pub async fn execute_json(&self, request: impl Serialize) -> Result<Value, WorkerError> {
-        self.execute_json_with_metadata(request)
-            .await
-            .map(|execution| execution.value)
-    }
-
-    pub async fn execute_json_with_metadata(
-        &self,
-        request: impl Serialize,
-    ) -> Result<WorkerExecution, WorkerError> {
-        if let Some(retry_after) = self.inner.circuit_retry_after().await {
-            return Err(WorkerError::CircuitOpen { retry_after });
-        }
-        let request_line = encode_request(request, self.inner.config.max_request_bytes)?;
-        let Some((mut worker, in_flight)) = self.inner.take_idle_worker().await else {
-            self.inner.schedule_replenish();
-            return Err(WorkerError::Saturated {
-                max_workers: self.inner.config.max_workers,
-            });
-        };
-        let worker_id = worker.id;
-
-        let result = worker
-            .request(
-                &request_line,
-                self.inner.config.request_timeout,
-                self.inner.config.max_stdout_bytes,
-            )
-            .await;
-
-        match result {
-            Ok(response) => {
-                self.inner.mark_completed().await;
-                if worker.is_running().unwrap_or(false) {
-                    self.inner.idle.lock().await.push_back(worker);
-                } else {
-                    drop(in_flight);
-                    self.inner.schedule_replenish();
-                }
-                Ok(WorkerExecution {
-                    value: response,
-                    worker_id,
-                })
-            }
-            Err(error) => {
-                self.inner.mark_completed().await;
-                drop(in_flight);
-                self.inner.schedule_replenish();
-                Err(error)
-            }
-        }
-    }
-
-    pub async fn snapshot(&self) -> WorkerPoolSnapshot {
-        self.inner.snapshot().await
-    }
-
-    pub async fn check_ready(&self) -> bool {
-        if self.inner.circuit_retry_after().await.is_some() {
-            return false;
-        }
-        let mut missing_workers = 0_usize;
-        let mut running_workers = VecDeque::new();
-        {
-            let mut idle = self.inner.idle.lock().await;
-            while let Some(mut worker) = idle.pop_front() {
-                match worker.is_running() {
-                    Ok(true) => running_workers.push_back(worker),
-                    Ok(false) | Err(_) => {
-                        missing_workers = missing_workers.saturating_add(1);
-                        tokio::spawn(async move {
-                            let _ = worker.finish_failed_worker().await;
-                        });
-                    }
-                }
-            }
-            *idle = running_workers;
-        }
-
-        if missing_workers > 0 {
-            self.inner.schedule_replenish();
-            return false;
-        }
-        let snapshot = self.snapshot().await;
-        let current_workers = snapshot.idle_workers + snapshot.in_flight + snapshot.warming_workers;
-        if current_workers < snapshot.max_workers {
-            self.inner.schedule_replenish();
-            return false;
-        }
-        snapshot.warming_workers == 0 && current_workers == snapshot.max_workers
-    }
-}
-
-impl WorkerPoolInner {
-    async fn spawn_worker(&self) -> Result<Worker, WorkerError> {
-        let worker_id = self.next_worker_id.fetch_add(1, Ordering::Relaxed);
-        let worker = Worker::spawn(worker_id, &self.config).await?;
-        self.probe_worker(worker).await
-    }
-
-    async fn probe_worker(&self, mut worker: Worker) -> Result<Worker, WorkerError> {
-        let Some(probe) = &self.config.startup_probe else {
-            return Ok(worker);
-        };
-        let worker_id = worker.id;
-        let request_line = encode_request(&probe.request, self.config.max_request_bytes)?;
-        let actual = worker
-            .request(
-                &request_line,
-                self.config.startup_timeout,
-                self.config.max_stdout_bytes,
-            )
-            .await?;
-        if actual != probe.expected_response {
-            let stderr = worker.kill_failed_worker().await;
-            return Err(WorkerError::StartupProbeFailed {
-                worker_id,
-                stderr_len: stderr.len(),
-                stderr_truncated: stderr.is_truncated(),
-                stderr,
-            });
-        }
-        time::sleep(POST_PROBE_LIVENESS_WINDOW).await;
-        match worker.child.try_wait() {
-            Ok(None) => Ok(worker),
-            Ok(Some(status)) => {
-                let stderr = worker.finish_failed_worker().await;
-                Err(worker_exited(worker_id, Some(status), stderr))
-            }
-            Err(source) => {
-                let stderr = worker.kill_failed_worker().await;
-                Err(worker_io_error(worker_id, source, stderr))
-            }
-        }
-    }
-
-    async fn spawn_worker_batch(inner: Arc<Self>, count: usize) -> WorkerBatch {
-        let deadline = time::Instant::now() + inner.config.startup_timeout;
-        Self::spawn_worker_batch_until(inner, count, deadline).await
-    }
-
-    async fn spawn_worker_batch_until(
-        inner: Arc<Self>,
-        count: usize,
-        deadline: time::Instant,
-    ) -> WorkerBatch {
-        let startup_timeout = inner.config.startup_timeout;
-        let mut workers = JoinSet::new();
-        for _ in 0..count {
-            let inner = Arc::clone(&inner);
-            workers.spawn(async move {
-                match time::timeout_at(deadline, inner.spawn_worker()).await {
-                    Ok(Err(WorkerError::Timeout { .. })) | Err(_) => {
-                        Err(WorkerError::StartupTimeout {
-                            timeout: startup_timeout,
-                        })
-                    }
-                    Ok(result) => result,
-                }
-            });
-        }
-        collect_worker_batch(workers).await
-    }
-
-    fn schedule_replenish(self: &Arc<Self>) {
-        if self
-            .replenishing
-            .compare_exchange(false, true, Ordering::AcqRel, Ordering::Relaxed)
-            .is_err()
-        {
-            return;
-        }
-        let inner = Arc::clone(self);
-        tokio::spawn(async move {
-            loop {
-                inner.replenish_to_capacity().await;
-                inner.replenishing.store(false, Ordering::Release);
-                if !inner.needs_replenishment().await
-                    || inner
-                        .replenishing
-                        .compare_exchange(false, true, Ordering::AcqRel, Ordering::Relaxed)
-                        .is_err()
-                {
-                    break;
-                }
-            }
-        });
-    }
-
-    async fn needs_replenishment(&self) -> bool {
-        if self.circuit_retry_after().await.is_some() {
-            return false;
-        }
-        let current_workers = self.idle.lock().await.len()
-            + self.in_flight.load(Ordering::Relaxed)
-            + self.warming_workers.load(Ordering::Relaxed);
-        current_workers < self.config.max_workers
-    }
-
-    async fn replenish_to_capacity(self: &Arc<Self>) {
-        if self.circuit_retry_after().await.is_some() {
-            return;
-        }
-        let current_workers = self.idle.lock().await.len() + self.in_flight.load(Ordering::Relaxed);
-        let missing_workers = self.config.max_workers.saturating_sub(current_workers);
-        if missing_workers == 0 {
-            return;
-        }
-
-        let mut permitted = 0;
-        for _ in 0..missing_workers {
-            if self.record_replacement_and_maybe_open_circuit().await {
-                break;
-            }
-            permitted += 1;
-        }
-        if permitted == 0 {
-            return;
-        }
-
-        self.warming_workers.store(permitted, Ordering::Release);
-        let batch = Self::spawn_worker_batch(Arc::clone(self), permitted).await;
-        self.replacements_total
-            .fetch_add(batch.ready.len() as u64, Ordering::Relaxed);
-        self.idle.lock().await.extend(batch.ready);
-        if let Some(error) = batch.first_error {
-            error!(error = ?error, "failed to replace worker process");
-        }
-        self.warming_workers.store(0, Ordering::Release);
-    }
-
-    async fn take_idle_worker(self: &Arc<Self>) -> Option<(Worker, InFlightGuard)> {
-        let worker = self.idle.lock().await.pop_front()?;
-        let in_flight = InFlightGuard::new(self.clone()).await;
-        Some((worker, in_flight))
-    }
-
-    async fn circuit_retry_after(&self) -> Option<Duration> {
-        let now = Instant::now();
-        let mut open_until = self.circuit_open_until.lock().await;
-        match *open_until {
-            Some(until) if until > now => Some(until.saturating_duration_since(now)),
-            Some(_) => {
-                *open_until = None;
-                None
-            }
-            None => None,
-        }
-    }
-
-    async fn record_replacement_and_maybe_open_circuit(&self) -> bool {
-        let now = Instant::now();
-        let cutoff = now
-            .checked_sub(self.config.replacement_window)
-            .unwrap_or(now);
-        let mut events = self.replacement_events.lock().await;
-        while events.front().is_some_and(|instant| *instant <= cutoff) {
-            events.pop_front();
-        }
-        events.push_back(now);
-        if events.len() > self.config.max_replacements_per_window {
-            *self.circuit_open_until.lock().await =
-                Some(now + self.config.circuit_breaker_cooldown);
-            events.clear();
-            true
-        } else {
-            false
-        }
-    }
-
-    async fn mark_completed(&self) {
-        self.completed_total.fetch_add(1, Ordering::Relaxed);
-        *self.last_completed.lock().await = Some(Instant::now());
-    }
-
-    async fn snapshot(&self) -> WorkerPoolSnapshot {
-        let now = Instant::now();
-        let idle_workers = self.idle.lock().await.len();
-        let active_since = *self.active_since.lock().await;
-        let last_completed = *self.last_completed.lock().await;
-        let circuit_open = self.circuit_retry_after().await.is_some();
-        WorkerPoolSnapshot {
-            max_workers: self.config.max_workers,
-            idle_workers,
-            warming_workers: self.warming_workers.load(Ordering::Relaxed),
-            in_flight: self.in_flight.load(Ordering::Relaxed),
-            completed_total: self.completed_total.load(Ordering::Relaxed),
-            replacements_total: self.replacements_total.load(Ordering::Relaxed),
-            circuit_open,
-            active_for: active_since.map(|instant| now.saturating_duration_since(instant)),
-            completed_within: last_completed.map(|instant| now.saturating_duration_since(instant)),
-            pool_age: now.saturating_duration_since(self.started_at),
-        }
-    }
-}
-
-struct WorkerBatch {
-    ready: Vec<Worker>,
-    first_error: Option<WorkerError>,
-}
-
-async fn collect_worker_batch(mut workers: JoinSet<Result<Worker, WorkerError>>) -> WorkerBatch {
-    let mut ready = Vec::with_capacity(workers.len());
-    let mut first_error = None;
-    while let Some(result) = workers.join_next().await {
-        match result {
-            Ok(Ok(worker)) => ready.push(worker),
-            Ok(Err(error)) if first_error.is_none() => first_error = Some(error),
-            Ok(Err(_)) => {}
-            Err(_) if first_error.is_none() => {
-                first_error = Some(WorkerError::Spawn {
-                    source: io::Error::other("worker startup task failed"),
-                });
-            }
-            Err(_) => {}
-        }
-    }
-    WorkerBatch { ready, first_error }
-}
-
-struct InFlightGuard {
-    inner: Arc<WorkerPoolInner>,
-}
-
-impl InFlightGuard {
-    async fn new(inner: Arc<WorkerPoolInner>) -> Self {
-        if inner.in_flight.fetch_add(1, Ordering::Relaxed) == 0 {
-            *inner.active_since.lock().await = Some(Instant::now());
-        }
-        Self { inner }
-    }
-}
-
-impl Drop for InFlightGuard {
-    fn drop(&mut self) {
-        if self.inner.in_flight.fetch_sub(1, Ordering::Relaxed) == 1 {
-            let inner = self.inner.clone();
-            tokio::spawn(async move {
-                *inner.active_since.lock().await = None;
-            });
-        }
-    }
-}
-
-struct Worker {
-    id: u64,
-    child: Child,
-    stdin: ChildStdin,
-    stdout: BufReader<ChildStdout>,
-    stderr: SharedStderrCapture,
-    stderr_task: JoinHandle<io::Result<()>>,
-}
-
-impl Drop for Worker {
-    fn drop(&mut self) {
-        #[cfg(unix)]
-        if let Some(pid) = self.child.id() {
-            unsafe {
-                let _ = kill(-(pid as i32), SIGKILL);
-            }
-        }
-        let _ = self.child.start_kill();
-        self.stderr_task.abort();
-    }
-}
-
-impl Worker {
-    async fn spawn(id: u64, config: &WorkerPoolConfig) -> Result<Self, WorkerError> {
-        let mut command = Command::new(&config.command.program);
-        command
-            .args(&config.command.args)
-            .env_clear()
-            .envs(minimal_worker_env())
-            .envs(config.command.envs.iter().cloned())
-            .stdin(std::process::Stdio::piped())
-            .stdout(std::process::Stdio::piped())
-            .stderr(std::process::Stdio::piped())
-            .kill_on_drop(true);
-        #[cfg(unix)]
-        {
-            let max_memory_bytes = config.max_memory_bytes;
-            command.process_group(0);
-            unsafe {
-                command.pre_exec(move || {
-                    if let Some(bytes) = max_memory_bytes {
-                        apply_memory_limit(bytes)?;
-                    }
-                    apply_worker_resource_limits()?;
-                    Ok(())
-                });
-            }
-        }
-
-        if let Some(current_dir) = &config.command.current_dir {
-            command.current_dir(current_dir);
-        }
-
-        let mut child = command
-            .spawn()
-            .map_err(|source| WorkerError::Spawn { source })?;
-        let stdin = child.stdin.take().ok_or_else(|| WorkerError::Spawn {
-            source: io::Error::other("worker stdin was not piped"),
-        })?;
-        let stdout = child.stdout.take().ok_or_else(|| WorkerError::Spawn {
-            source: io::Error::other("worker stdout was not piped"),
-        })?;
-        let stderr_pipe = child.stderr.take().ok_or_else(|| WorkerError::Spawn {
-            source: io::Error::other("worker stderr was not piped"),
-        })?;
-
-        let stderr = SharedStderrCapture::new(config.max_stderr_bytes);
-        let stderr_task = tokio::spawn(capture_stderr(stderr.clone(), stderr_pipe));
-
-        Ok(Self {
-            id,
-            child,
-            stdin,
-            stdout: BufReader::new(stdout),
-            stderr,
-            stderr_task,
-        })
-    }
-
-    async fn request(
-        &mut self,
-        request_line: &[u8],
-        timeout: Duration,
-        stdout_limit: usize,
-    ) -> Result<Value, WorkerError> {
-        self.stderr.reset().await;
-
-        let response = time::timeout(timeout, async {
-            let worker_id = self.id;
-            let stdin = &mut self.stdin;
-            let stdout = &mut self.stdout;
-            let write_request = async {
-                stdin.write_all(request_line).await?;
-                stdin.flush().await
-            };
-            let read_response = async {
-                read_line_capped(stdout, stdout_limit)
-                    .await
-                    .map_err(|error| match error {
-                        ReadLineError::TooLarge => worker_stdout_too_large(
-                            worker_id,
-                            stdout_limit,
-                            CapturedOutput::empty(),
-                        ),
-                        ReadLineError::Io(source) => {
-                            worker_io_error(worker_id, source, CapturedOutput::empty())
-                        }
-                    })
-            };
-            let (_, line) = tokio::try_join!(
-                async {
-                    write_request.await.map_err(|source| {
-                        worker_io_error(worker_id, source, CapturedOutput::empty())
-                    })
-                },
-                read_response,
-            )?;
-
-            match line {
-                Some(line) => serde_json::from_slice(line.trim_ascii_end()).map_err(|source| {
-                    worker_invalid_output(worker_id, source, CapturedOutput::empty())
-                }),
-                None => {
-                    let status = self.child.wait().await.ok();
-                    Err(worker_exited(worker_id, status, CapturedOutput::empty()))
-                }
-            }
-        })
-        .await;
-
-        match response {
-            Ok(Ok(value)) => Ok(value),
-            Ok(Err(error @ WorkerError::WorkerExited { .. })) => {
-                let stderr = self.finish_failed_worker().await;
-                Err(error.with_stderr(stderr))
-            }
-            Ok(Err(error @ WorkerError::StdoutTooLarge { .. })) => {
-                let stderr = self.kill_failed_worker().await;
-                Err(error.with_stderr(stderr))
-            }
-            Ok(Err(error @ WorkerError::InvalidOutput { .. })) => {
-                let stderr = self.kill_failed_worker().await;
-                Err(error.with_stderr(stderr))
-            }
-            Ok(Err(error @ WorkerError::Io { .. })) => {
-                let stderr = self.kill_failed_worker().await;
-                Err(error.with_stderr(stderr))
-            }
-            Ok(Err(error)) => Err(error),
-            Err(_) => {
-                let stderr = self.kill_failed_worker().await;
-                Err(WorkerError::timeout(self.id, timeout, stderr))
-            }
-        }
-    }
-
-    fn is_running(&mut self) -> io::Result<bool> {
-        self.child.try_wait().map(|status| status.is_none())
-    }
-
-    async fn kill_failed_worker(&mut self) -> CapturedOutput {
-        kill_worker_process(&mut self.child).await;
-        self.finish_failed_worker().await
-    }
-
-    async fn finish_failed_worker(&mut self) -> CapturedOutput {
-        let _ = self.child.wait().await;
-        let _ = (&mut self.stderr_task).await;
-        self.stderr.snapshot().await
-    }
-}
-
-fn worker_stdout_too_large(worker_id: u64, limit: usize, stderr: CapturedOutput) -> WorkerError {
-    WorkerError::StdoutTooLarge {
-        worker_id,
-        limit,
-        stderr_len: stderr.len(),
-        stderr_truncated: stderr.is_truncated(),
-        stderr,
-    }
-}
-
-fn worker_invalid_output(
-    worker_id: u64,
-    source: serde_json::Error,
-    stderr: CapturedOutput,
-) -> WorkerError {
-    WorkerError::InvalidOutput {
-        worker_id,
-        source,
-        stderr_len: stderr.len(),
-        stderr_truncated: stderr.is_truncated(),
-        stderr,
-    }
-}
-
-fn worker_exited(
-    worker_id: u64,
-    status: Option<ExitStatus>,
-    stderr: CapturedOutput,
-) -> WorkerError {
-    WorkerError::WorkerExited {
-        worker_id,
-        status,
-        stderr_len: stderr.len(),
-        stderr_truncated: stderr.is_truncated(),
-        stderr,
-    }
-}
-
-fn worker_io_error(worker_id: u64, source: io::Error, stderr: CapturedOutput) -> WorkerError {
-    WorkerError::Io {
-        worker_id,
-        source,
-        stderr_len: stderr.len(),
-        stderr_truncated: stderr.is_truncated(),
-        stderr,
-    }
-}
-
-#[cfg(unix)]
-#[cfg(target_os = "linux")]
-fn apply_memory_limit(bytes: u64) -> io::Result<()> {
-    apply_resource_limit(libc::RLIMIT_DATA, bytes).or_else(|error| {
-        if error.raw_os_error() == Some(libc::EINVAL) {
-            apply_resource_limit(libc::RLIMIT_AS, bytes)
-        } else {
-            Err(error)
-        }
-    })
-}
-
-#[cfg(unix)]
-#[cfg(not(target_os = "linux"))]
-fn apply_memory_limit(bytes: u64) -> io::Result<()> {
-    apply_resource_limit(libc::RLIMIT_AS, bytes).or_else(|error| {
-        if error.raw_os_error() == Some(libc::EINVAL) {
-            apply_resource_limit(libc::RLIMIT_DATA, bytes).or_else(|data_error| {
-                if data_error.raw_os_error() == Some(libc::EINVAL) {
-                    Ok(())
-                } else {
-                    Err(data_error)
-                }
-            })
-        } else {
-            Err(error)
-        }
-    })
-}
-
-#[cfg(unix)]
-fn apply_worker_resource_limits() -> io::Result<()> {
-    apply_resource_limit(libc::RLIMIT_CPU, 60 * 60)?;
-    apply_resource_limit(libc::RLIMIT_FSIZE, 1024 * 1024)?;
-    apply_resource_limit(libc::RLIMIT_NOFILE, 64)?;
-    apply_resource_limit(libc::RLIMIT_CORE, 0)?;
-    #[cfg(target_os = "linux")]
-    {
-        apply_resource_limit(libc::RLIMIT_NPROC, 1024)?;
-    }
-    Ok(())
-}
-
-#[cfg(unix)]
-#[cfg(target_os = "linux")]
-type RlimitResource = libc::__rlimit_resource_t;
-
-#[cfg(unix)]
-#[cfg(not(target_os = "linux"))]
-type RlimitResource = libc::c_int;
-
-#[cfg(unix)]
-fn apply_resource_limit(resource: RlimitResource, bytes: u64) -> io::Result<()> {
-    let limit = libc::rlimit {
-        rlim_cur: bytes as libc::rlim_t,
-        rlim_max: bytes as libc::rlim_t,
-    };
-    let result = unsafe { libc::setrlimit(resource, &limit) };
-    if result == 0 {
-        Ok(())
-    } else {
-        Err(io::Error::last_os_error())
-    }
-}
-
-fn minimal_worker_env() -> Vec<(OsString, OsString)> {
-    const ALLOWED: &[&str] = &["PATH", "HOME", "TMPDIR", "TEMP", "TMP"];
-    ALLOWED
-        .iter()
-        .filter_map(|key| std::env::var_os(key).map(|value| (OsString::from(key), value)))
-        .collect()
-}
-
-async fn kill_worker_process(child: &mut Child) {
-    #[cfg(unix)]
-    {
-        if let Some(pid) = child.id() {
-            unsafe {
-                let _ = kill(-(pid as i32), SIGKILL);
-            }
-        }
-        let _ = child.kill().await;
-    }
-    #[cfg(not(unix))]
-    {
-        let _ = child.kill().await;
-    }
-}
-
-#[cfg(unix)]
-const SIGKILL: i32 = 9;
-
-#[cfg(unix)]
-unsafe extern "C" {
-    fn kill(pid: i32, sig: i32) -> i32;
-}
-
-#[derive(Clone)]
-struct SharedStderrCapture {
-    limit: usize,
-    inner: Arc<Mutex<CapturedOutput>>,
-}
-
-impl SharedStderrCapture {
-    fn new(limit: usize) -> Self {
-        Self {
-            limit,
-            inner: Arc::new(Mutex::new(CapturedOutput::empty())),
-        }
-    }
-
-    async fn reset(&self) {
-        *self.inner.lock().await = CapturedOutput::empty();
-    }
-
-    async fn append(&self, chunk: &[u8]) {
-        let mut output = self.inner.lock().await;
-        let remaining = self.limit.saturating_sub(output.bytes.len());
-        let retained = remaining.min(chunk.len());
-        output.bytes.extend_from_slice(&chunk[..retained]);
-        if retained < chunk.len() {
-            output.truncated = true;
-        }
-    }
-
-    async fn snapshot(&self) -> CapturedOutput {
-        self.inner.lock().await.clone()
-    }
-}
-
-async fn capture_stderr(capture: SharedStderrCapture, mut stderr: ChildStderr) -> io::Result<()> {
-    let mut buffer = [0_u8; 8192];
-    loop {
-        let bytes_read = stderr.read(&mut buffer).await?;
-        if bytes_read == 0 {
-            return Ok(());
-        }
-        capture.append(&buffer[..bytes_read]).await;
-    }
-}
-
-fn encode_request(
-    request: impl Serialize,
-    max_request_bytes: usize,
-) -> Result<Vec<u8>, WorkerError> {
-    let mut line = serde_json::to_vec(&request).map_err(|source| WorkerError::Encode { source })?;
-    let bytes = line.len();
-    if bytes > max_request_bytes {
-        return Err(WorkerError::RequestTooLarge {
-            bytes,
-            limit: max_request_bytes,
-        });
-    }
-    line.push(b'\n');
-    Ok(line)
-}
-
-#[derive(Debug)]
-enum ReadLineError {
-    TooLarge,
-    Io(io::Error),
-}
-
-async fn read_line_capped(
-    stdout: &mut (impl AsyncBufRead + Unpin),
-    limit: usize,
-) -> Result<Option<Vec<u8>>, ReadLineError> {
-    let mut line = Vec::new();
-
-    loop {
-        let buffer = stdout.fill_buf().await.map_err(ReadLineError::Io)?;
-        if buffer.is_empty() {
-            return if line.is_empty() {
-                Ok(None)
-            } else {
-                Ok(Some(line))
-            };
-        }
-
-        let (consumed, payload_bytes) =
-            if let Some(newline) = buffer.iter().position(|byte| *byte == b'\n') {
-                (newline + 1, newline)
-            } else {
-                (buffer.len(), buffer.len())
-            };
-
-        if line.len() + payload_bytes > limit {
-            return Err(ReadLineError::TooLarge);
-        }
-
-        line.extend_from_slice(&buffer[..consumed]);
-        stdout.consume(consumed);
-
-        if line.last() == Some(&b'\n') {
-            return Ok(Some(line));
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::io::BufReader;
-
-    #[tokio::test]
-    async fn read_line_capped_allows_newline_after_exact_payload_limit() {
-        let mut reader = BufReader::new(&b"abcd\n"[..]);
-        let line = read_line_capped(&mut reader, 4)
-            .await
-            .expect("line read succeeds")
-            .expect("line exists");
-        assert_eq!(line, b"abcd\n");
-    }
-
-    #[tokio::test]
-    async fn read_line_capped_rejects_payload_over_limit() {
-        let mut reader = BufReader::new(&b"abcde\n"[..]);
-        assert!(matches!(
-            read_line_capped(&mut reader, 4).await,
-            Err(ReadLineError::TooLarge)
-        ));
-    }
-}
diff --git a/crates/registry-notary-worker-harness/tests/worker_pool.rs b/crates/registry-notary-worker-harness/tests/worker_pool.rs
deleted file mode 100644
index 6ee4d8c71..000000000
--- a/crates/registry-notary-worker-harness/tests/worker_pool.rs
+++ /dev/null
@@ -1,793 +0,0 @@
-use registry_notary_worker_harness::{
-    WorkerCommand, WorkerError, WorkerPool, WorkerPoolConfig, WorkerStartupProbe,
-};
-use serde_json::json;
-use std::{
-    collections::BTreeSet,
-    ffi::OsString,
-    fs,
-    path::{Path, PathBuf},
-    sync::Arc,
-    time::{Duration, Instant, SystemTime, UNIX_EPOCH},
-};
-
-struct WorkerPoolTestLock {
-    path: PathBuf,
-}
-
-impl Drop for WorkerPoolTestLock {
-    fn drop(&mut self) {
-        let _ = fs::remove_dir(&self.path);
-    }
-}
-
-fn fixture_command() -> WorkerCommand {
-    WorkerCommand::new(cargo_bin("registry-notary-worker-harness-fixture"))
-}
-
-fn pool_config(max_workers: usize) -> WorkerPoolConfig {
-    WorkerPoolConfig {
-        command: fixture_command(),
-        forbidden_env_names: BTreeSet::new(),
-        max_workers,
-        startup_probe: Some(WorkerStartupProbe {
-            request: json!({ "mode": "startup" }),
-            expected_response: json!({ "ready": true }),
-        }),
-        startup_timeout: Duration::from_secs(30),
-        request_timeout: Duration::from_millis(30_000),
-        max_request_bytes: 4096,
-        max_stdout_bytes: 4096,
-        max_stderr_bytes: 128,
-        max_memory_bytes: None,
-        replacement_window: Duration::from_secs(60),
-        max_replacements_per_window: 64,
-        circuit_breaker_cooldown: Duration::from_secs(30),
-    }
-}
-
-#[tokio::test]
-async fn worker_env_is_cleared_except_allow_list_and_explicit_envs() {
-    let _guard = worker_pool_test_lock().await;
-    std::env::set_var("REGISTRY_NOTARY_HARNESS_SECRET", "source-secret");
-    std::env::set_var("REGISTRY_NOTARY_HARNESS_BEARER", "bearer-secret");
-    let command = fixture_command().env("REGISTRY_NOTARY_HARNESS_ALLOWED", "benign");
-    let mut config = pool_config(1);
-    config.command = command;
-    let pool = WorkerPool::new(config).await.unwrap();
-
-    let response = pool
-        .execute_json(json!({
-            "mode": "env",
-            "env_keys": [
-                "REGISTRY_NOTARY_HARNESS_SECRET",
-                "REGISTRY_NOTARY_HARNESS_BEARER",
-                "REGISTRY_NOTARY_HARNESS_ALLOWED",
-                "PATH"
-            ]
-        }))
-        .await
-        .unwrap();
-
-    assert!(response["env"]["REGISTRY_NOTARY_HARNESS_SECRET"].is_null());
-    assert!(response["env"]["REGISTRY_NOTARY_HARNESS_BEARER"].is_null());
-    assert_eq!(response["env"]["REGISTRY_NOTARY_HARNESS_ALLOWED"], "benign");
-    assert_eq!(
-        response["env"]["PATH"],
-        std::env::var("PATH").unwrap_or_default()
-    );
-    std::env::remove_var("REGISTRY_NOTARY_HARNESS_SECRET");
-    std::env::remove_var("REGISTRY_NOTARY_HARNESS_BEARER");
-}
-
-#[tokio::test]
-async fn worker_config_rejects_forbidden_explicit_envs() {
-    let _guard = worker_pool_test_lock().await;
-    let mut config = pool_config(1);
-    config
-        .forbidden_env_names
-        .insert(OsString::from("REGISTRY_NOTARY_HARNESS_SECRET"));
-    config.command = fixture_command().env("REGISTRY_NOTARY_HARNESS_SECRET", "source-secret");
-
-    let error = match WorkerPool::new(config).await {
-        Ok(_) => panic!("forbidden explicit worker env must fail validation"),
-        Err(error) => error,
-    };
-    assert!(matches!(error, WorkerError::InvalidConfig { .. }));
-}
-
-#[test]
-fn startup_probe_timeout_validation_has_an_exact_liveness_boundary() {
-    let mut config = pool_config(1);
-    let required = Duration::from_millis(25) + Duration::from_nanos(1);
-
-    assert_eq!(config.required_startup_timeout(), required);
-    config.startup_timeout = required - Duration::from_nanos(1);
-    let error = config
-        .validate()
-        .expect_err("the liveness window alone leaves no time for spawn and probe");
-    assert!(matches!(
-        error,
-        WorkerError::InvalidConfig {
-            reason: "startup_timeout must exceed the post-probe liveness window when startup_probe is configured"
-        }
-    ));
-
-    config.startup_timeout = required;
-    config
-        .validate()
-        .expect("one nanosecond beyond the liveness window is structurally valid");
-}
-
-#[test]
-fn no_probe_timeout_validation_preserves_the_nonzero_boundary() {
-    let mut config = pool_config(1);
-    config.startup_probe = None;
-
-    assert_eq!(config.required_startup_timeout(), Duration::from_nanos(1));
-    config.startup_timeout = Duration::ZERO;
-    let error = config
-        .validate()
-        .expect_err("a zero startup timeout remains invalid without a probe");
-    assert!(matches!(
-        error,
-        WorkerError::InvalidConfig {
-            reason: "startup_timeout must be greater than zero"
-        }
-    ));
-
-    config.startup_timeout = Duration::from_nanos(1);
-    config
-        .validate()
-        .expect("the smallest nonzero no-probe timeout remains valid");
-}
-
-#[tokio::test]
-async fn startup_probe_requires_the_exact_response_before_admission() {
-    let _guard = worker_pool_test_lock().await;
-    let mut config = pool_config(1);
-    config.startup_probe = Some(WorkerStartupProbe {
-        request: json!({ "mode": "startup" }),
-        expected_response: json!({ "ready": false }),
-    });
-
-    let error = match WorkerPool::new(config).await {
-        Ok(_) => panic!("mismatched startup response must fail pool construction"),
-        Err(error) => error,
-    };
-
-    assert!(matches!(error, WorkerError::StartupProbeFailed { .. }));
-}
-
-#[tokio::test]
-async fn startup_probe_rejects_a_worker_that_exits_before_the_protocol_response() {
-    let _guard = worker_pool_test_lock().await;
-    let state_path = unique_state_path();
-    let mut config = pool_config(1);
-    config.command = fixture_command().env(
-        OsString::from("WORKER_HARNESS_EXIT_ONCE_STATE"),
-        state_path.as_os_str().to_os_string(),
-    );
-
-    let error = match WorkerPool::new(config.clone()).await {
-        Ok(_) => panic!("worker exiting during startup must not be admitted"),
-        Err(error) => error,
-    };
-    assert!(matches!(error, WorkerError::WorkerExited { .. }));
-    wait_for_path(&state_path).await;
-
-    let recovered = WorkerPool::new(config)
-        .await
-        .expect("a later process that passes the probe is admitted");
-    assert!(recovered.check_ready().await);
-}
-
-#[tokio::test]
-async fn startup_probe_rejects_a_worker_that_replies_then_exits() {
-    let _guard = worker_pool_test_lock().await;
-    let state_dir = unique_state_path();
-    fs::create_dir(&state_dir).expect("create fixture start-ordinal directory");
-    let mut config = pool_config(1);
-    config.command = fixture_command()
-        .env(
-            OsString::from("WORKER_HARNESS_START_ORDINAL_DIR"),
-            state_dir.as_os_str().to_os_string(),
-        )
-        .env("WORKER_HARNESS_EXIT_START_ORDINALS_THROUGH", "1")
-        .env("WORKER_HARNESS_EXIT_AFTER_STARTUP_MS", "0");
-
-    let error = match WorkerPool::new(config).await {
-        Ok(_) => panic!("a startup reply without live capacity must not be admitted"),
-        Err(error) => error,
-    };
-
-    assert!(matches!(error, WorkerError::WorkerExited { .. }));
-    fs::remove_dir_all(&state_dir).expect("remove fixture start-ordinal directory");
-}
-
-#[tokio::test]
-async fn startup_probe_failure_does_not_disclose_captured_stderr() {
-    let _guard = worker_pool_test_lock().await;
-    let secret = "STARTUP_PROBE_SECRET";
-    let mut config = pool_config(1);
-    config.startup_probe = Some(WorkerStartupProbe {
-        request: json!({
-            "mode": "stderr-then-crash",
-            "stderr_bytes": 256,
-            "stderr_payload": secret,
-        }),
-        expected_response: json!({ "ready": true }),
-    });
-    config.max_stderr_bytes = 32;
-
-    let error = match WorkerPool::new(config).await {
-        Ok(_) => panic!("crashing startup probe must fail pool construction"),
-        Err(error) => error,
-    };
-
-    assert!(matches!(error, WorkerError::WorkerExited { .. }));
-    assert!(!format!("{error:?}").contains(secret));
-    assert!(!error.to_string().contains(secret));
-}
-
-#[tokio::test]
-async fn startup_and_request_timeouts_are_independent() {
-    let _guard = worker_pool_test_lock().await;
-    let mut config = pool_config(1);
-    config.startup_probe = Some(WorkerStartupProbe {
-        request: json!({ "mode": "startup-sleep", "sleep_ms": 100 }),
-        expected_response: json!({ "ready": true }),
-    });
-    config.startup_timeout = Duration::from_secs(1);
-    config.request_timeout = Duration::from_millis(50);
-
-    let pool = WorkerPool::new(config)
-        .await
-        .expect("slow startup probe fits its independent bound");
-    let started = Instant::now();
-    let error = pool
-        .execute_json(json!({ "mode": "hang" }))
-        .await
-        .expect_err("request uses the shorter evaluation bound");
-    assert!(matches!(error, WorkerError::Timeout { .. }));
-    assert!(
-        started.elapsed() < Duration::from_millis(500),
-        "request timeout must not inherit the startup bound"
-    );
-}
-
-#[tokio::test]
-async fn pool_startup_has_one_wall_clock_deadline_for_the_concurrent_batch() {
-    let _guard = worker_pool_test_lock().await;
-    let mut config = pool_config(3);
-    config.startup_probe = Some(WorkerStartupProbe {
-        request: json!({ "mode": "startup-sleep", "sleep_ms": 1_000 }),
-        expected_response: json!({ "ready": true }),
-    });
-    config.startup_timeout = Duration::from_millis(100);
-
-    let started = Instant::now();
-    let error = match WorkerPool::new(config).await {
-        Ok(_) => panic!("the whole startup batch must stop at the common deadline"),
-        Err(error) => error,
-    };
-    let elapsed = started.elapsed();
-
-    assert!(matches!(
-        error,
-        WorkerError::StartupTimeout { timeout }
-            if timeout == Duration::from_millis(100)
-    ));
-    assert!(
-        elapsed >= Duration::from_millis(75),
-        "startup failed before the configured wall-clock deadline: {elapsed:?}"
-    );
-    assert!(
-        elapsed < Duration::from_millis(750),
-        "pool startup exceeded its common wall-clock deadline: {elapsed:?}"
-    );
-}
-
-#[tokio::test]
-async fn request_size_is_checked_before_worker_acquisition() {
-    let _guard = worker_pool_test_lock().await;
-    let mut config = pool_config(1);
-    config.max_request_bytes = 64;
-    let pool = Arc::new(WorkerPool::new(config).await.unwrap());
-    let busy_pool = pool.clone();
-    let busy = tokio::spawn(async move {
-        busy_pool
-            .execute_json(json!({ "mode": "sleep", "sleep_ms": 300 }))
-            .await
-            .unwrap()
-    });
-
-    wait_for_in_flight(&pool, 1).await;
-    assert_eq!(pool.snapshot().await.idle_workers, 0);
-    let error = pool
-        .execute_json(json!({
-            "value": "this request is too large for the configured cap and must be rejected before worker acquisition"
-        }))
-        .await
-        .unwrap_err();
-
-    assert!(matches!(
-        error,
-        WorkerError::RequestTooLarge {
-            bytes,
-            limit: 64
-        } if bytes > 64
-    ));
-    let _ = busy.await.unwrap();
-}
-
-#[tokio::test]
-async fn returns_saturated_when_all_workers_are_busy() {
-    let _guard = worker_pool_test_lock().await;
-    let pool = Arc::new(WorkerPool::new(pool_config(1)).await.unwrap());
-    let busy_pool = pool.clone();
-    let busy = tokio::spawn(async move {
-        busy_pool
-            .execute_json(json!({ "mode": "sleep", "sleep_ms": 300 }))
-            .await
-            .unwrap()
-    });
-
-    wait_for_in_flight(&pool, 1).await;
-    let error = pool
-        .execute_json(json!({ "value": "small" }))
-        .await
-        .unwrap_err();
-
-    assert!(matches!(error, WorkerError::Saturated { max_workers: 1 }));
-    let _ = busy.await.unwrap();
-}
-
-#[tokio::test]
-async fn timeout_kills_worker_and_replaces_it_without_retrying_request() {
-    let _guard = worker_pool_test_lock().await;
-    let mut config = pool_config(1);
-    config.request_timeout = Duration::from_secs(2);
-    let pool = WorkerPool::new(config).await.unwrap();
-
-    let error = pool
-        .execute_json(json!({ "mode": "hang" }))
-        .await
-        .unwrap_err();
-    let failed_worker_id = error.worker_id().expect("timeout worker id");
-
-    assert!(matches!(error, WorkerError::Timeout { .. }));
-    wait_for_ready(&pool).await;
-    let restarted = pool
-        .execute_json_with_metadata(json!({ "value": "after" }))
-        .await
-        .unwrap();
-    assert_ne!(failed_worker_id, restarted.worker_id);
-    assert_eq!(restarted.value["ok"], true);
-    assert_eq!(restarted.value["value"], "after");
-    assert_eq!(pool.snapshot().await.completed_total, 2);
-}
-
-#[tokio::test]
-async fn oversized_stdout_kills_worker_and_replaces_it() {
-    let _guard = worker_pool_test_lock().await;
-    let mut config = pool_config(1);
-    config.max_stdout_bytes = 64;
-    let pool = WorkerPool::new(config).await.unwrap();
-
-    let error = pool
-        .execute_json(json!({ "mode": "big-stdout", "stdout_bytes": 128 }))
-        .await
-        .unwrap_err();
-    let failed_worker_id = error.worker_id().expect("stdout worker id");
-
-    assert!(matches!(
-        error,
-        WorkerError::StdoutTooLarge { limit: 64, .. }
-    ));
-    wait_for_ready(&pool).await;
-    let restarted = pool
-        .execute_json_with_metadata(json!({ "value": "after" }))
-        .await
-        .unwrap();
-    assert_ne!(failed_worker_id, restarted.worker_id);
-    assert_eq!(restarted.value["value"], "after");
-}
-
-#[tokio::test]
-async fn stderr_is_capped_and_not_disclosed_by_error_formatting() {
-    let _guard = worker_pool_test_lock().await;
-    let mut config = pool_config(1);
-    config.max_stderr_bytes = 32;
-    let pool = WorkerPool::new(config).await.unwrap();
-    let secret = "HARNESS_SECRET";
-
-    let error = pool
-        .execute_json(json!({
-            "mode": "stderr-then-crash",
-            "stderr_bytes": 256,
-            "stderr_payload": secret
-        }))
-        .await
-        .unwrap_err();
-    let stderr = error.stderr().expect("stderr capture");
-
-    assert!(matches!(error, WorkerError::WorkerExited { .. }));
-    assert_eq!(stderr.len(), 32);
-    assert!(stderr.is_truncated());
-    assert!(stderr.to_string_lossy().starts_with(secret));
-    assert!(!format!("{error:?}").contains(secret));
-    assert!(!error.to_string().contains(secret));
-}
-
-#[tokio::test]
-async fn snapshot_counters_track_idle_busy_and_completed_workers() {
-    let _guard = worker_pool_test_lock().await;
-    let pool = Arc::new(WorkerPool::new(pool_config(1)).await.unwrap());
-    let initial = pool.snapshot().await;
-    assert_eq!(initial.max_workers, 1);
-    assert_eq!(initial.idle_workers, 1);
-    assert_eq!(initial.in_flight, 0);
-    assert_eq!(initial.completed_total, 0);
-    assert!(initial.active_for.is_none());
-    assert!(initial.completed_within.is_none());
-
-    let busy_pool = pool.clone();
-    let busy = tokio::spawn(async move {
-        busy_pool
-            .execute_json(json!({ "mode": "sleep", "sleep_ms": 150 }))
-            .await
-            .unwrap()
-    });
-    wait_for_in_flight(&pool, 1).await;
-    let active = pool.snapshot().await;
-    assert_eq!(active.idle_workers, 0);
-    assert_eq!(active.in_flight, 1);
-    assert_eq!(active.completed_total, 0);
-    assert!(active.active_for.is_some());
-
-    let _ = busy.await.unwrap();
-    wait_for_in_flight(&pool, 0).await;
-    let completed = pool.snapshot().await;
-    assert_eq!(completed.idle_workers, 1);
-    assert_eq!(completed.in_flight, 0);
-    assert_eq!(completed.completed_total, 1);
-    assert!(completed.active_for.is_none());
-    assert!(completed.completed_within.is_some());
-}
-
-#[tokio::test]
-async fn check_ready_detects_replaces_and_fails_current_check_for_dead_idle_worker() {
-    let _guard = worker_pool_test_lock().await;
-    let pool = WorkerPool::new(pool_config(1)).await.unwrap();
-    pool.execute_json(json!({ "mode": "exit" }))
-        .await
-        .expect_err("exited worker fails the request");
-
-    wait_for_not_ready(&pool).await;
-    wait_for_ready(&pool).await;
-    let response = pool
-        .execute_json(json!({ "value": "after-replacement" }))
-        .await
-        .unwrap();
-    assert_eq!(response["value"], "after-replacement");
-}
-
-#[tokio::test]
-async fn repeated_worker_failures_open_circuit_and_recover_after_cooldown() {
-    let _guard = worker_pool_test_lock().await;
-    let mut config = pool_config(1);
-    config.request_timeout = Duration::from_secs(1);
-    config.max_replacements_per_window = 1;
-    config.replacement_window = Duration::from_secs(60);
-    config.circuit_breaker_cooldown = Duration::from_millis(100);
-    let pool = WorkerPool::new(config).await.unwrap();
-
-    let first = pool
-        .execute_json(json!({ "mode": "hang" }))
-        .await
-        .unwrap_err();
-    assert!(matches!(first, WorkerError::Timeout { .. }));
-    wait_for_ready(&pool).await;
-    let snapshot = pool.snapshot().await;
-    assert!(!snapshot.circuit_open);
-    assert_eq!(snapshot.replacements_total, 1);
-
-    let opens = pool
-        .execute_json(json!({ "mode": "hang" }))
-        .await
-        .unwrap_err();
-    assert!(matches!(opens, WorkerError::Timeout { .. }));
-    wait_for_circuit(&pool).await;
-    let snapshot = pool.snapshot().await;
-    assert!(snapshot.circuit_open);
-    assert_eq!(snapshot.replacements_total, 1);
-    assert!(!pool.check_ready().await);
-
-    let second = pool
-        .execute_json(json!({ "value": "blocked" }))
-        .await
-        .unwrap_err();
-    assert!(matches!(second, WorkerError::CircuitOpen { .. }));
-
-    tokio::time::sleep(Duration::from_millis(150)).await;
-    assert!(!pool.check_ready().await);
-    wait_for_ready(&pool).await;
-    let response = pool
-        .execute_json(json!({ "value": "after-cooldown" }))
-        .await
-        .unwrap();
-    assert_eq!(response["value"], "after-cooldown");
-}
-
-#[tokio::test]
-async fn repeated_replacement_probe_failures_open_the_circuit() {
-    let _guard = worker_pool_test_lock().await;
-    let state_path = unique_state_path();
-    let mut config = pool_config(1);
-    config.command = fixture_command().env(
-        OsString::from("WORKER_HARNESS_FAIL_AFTER_FIRST_START_STATE"),
-        state_path.as_os_str().to_os_string(),
-    );
-    config.request_timeout = Duration::from_millis(50);
-    config.max_replacements_per_window = 1;
-    config.replacement_window = Duration::from_secs(60);
-    let pool = WorkerPool::new(config)
-        .await
-        .expect("initial worker passes its startup probe");
-    wait_for_path(&state_path).await;
-
-    let error = pool
-        .execute_json(json!({ "mode": "hang" }))
-        .await
-        .expect_err("request failure starts replacement recovery");
-    assert!(matches!(error, WorkerError::Timeout { .. }));
-
-    wait_for_background_circuit(&pool).await;
-    assert!(!pool.check_ready().await);
-    assert!(pool.snapshot().await.circuit_open);
-}
-
-#[tokio::test]
-async fn replacement_batch_installs_healthy_worker_when_its_sibling_fails() {
-    let _guard = worker_pool_test_lock().await;
-    let state_dir = unique_state_path();
-    fs::create_dir(&state_dir).expect("create fixture start-ordinal directory");
-    let mut config = pool_config(2);
-    config.command = fixture_command()
-        .env(
-            OsString::from("WORKER_HARNESS_START_ORDINAL_DIR"),
-            state_dir.as_os_str().to_os_string(),
-        )
-        .env("WORKER_HARNESS_FAIL_START_ORDINAL", "3")
-        .env("WORKER_HARNESS_EXIT_START_ORDINALS_THROUGH", "2")
-        .env("WORKER_HARNESS_EXIT_AFTER_STARTUP_MS", "100");
-    config.startup_timeout = Duration::from_secs(1);
-    config.max_replacements_per_window = 2;
-    config.replacement_window = Duration::from_secs(60);
-
-    let pool = WorkerPool::new(config)
-        .await
-        .expect("both initial workers pass the startup probe");
-    wait_for_start_ordinal(&state_dir, 2).await;
-    tokio::time::sleep(Duration::from_millis(200)).await;
-    assert!(
-        !pool.check_ready().await,
-        "dead initial workers must make readiness false"
-    );
-
-    wait_for_background_circuit(&pool).await;
-    let snapshot = pool.snapshot().await;
-    assert_eq!(
-        snapshot.idle_workers, 1,
-        "the healthy member of the mixed replacement batch must be installed"
-    );
-    assert_eq!(snapshot.replacements_total, 1);
-    assert!(snapshot.circuit_open);
-    assert!(
-        !state_dir.join("5").exists(),
-        "the circuit must open before another worker process is spawned"
-    );
-    fs::remove_dir_all(&state_dir).expect("remove fixture start-ordinal directory");
-}
-
-#[tokio::test]
-async fn execute_does_not_wait_for_replenishment_after_circuit_cooldown() {
-    let _guard = worker_pool_test_lock().await;
-    let mut config = pool_config(1);
-    config.request_timeout = Duration::from_secs(2);
-    config.max_replacements_per_window = 1;
-    config.replacement_window = Duration::from_secs(60);
-    config.circuit_breaker_cooldown = Duration::from_millis(100);
-    let pool = WorkerPool::new(config).await.unwrap();
-
-    pool.execute_json(json!({ "mode": "hang" }))
-        .await
-        .expect_err("first timeout fails");
-    wait_for_ready(&pool).await;
-    pool.execute_json(json!({ "mode": "hang" }))
-        .await
-        .expect_err("second timeout opens circuit");
-    wait_for_circuit(&pool).await;
-    assert!(pool.snapshot().await.circuit_open);
-
-    tokio::time::sleep(Duration::from_millis(150)).await;
-    let error = pool
-        .execute_json(json!({ "value": "after-direct-execute" }))
-        .await
-        .expect_err("request does not wait for a replacement startup");
-    assert!(matches!(error, WorkerError::Saturated { max_workers: 1 }));
-    wait_for_ready(&pool).await;
-    let response = pool
-        .execute_json(json!({ "value": "after-direct-execute" }))
-        .await
-        .expect("replacement serves a later request");
-    assert_eq!(response["value"], "after-direct-execute");
-}
-
-#[tokio::test]
-async fn worker_stdout_is_drained_while_large_stdin_request_is_written() {
-    let _guard = worker_pool_test_lock().await;
-    let mut config = pool_config(1);
-    config.command = fixture_command().env("WORKER_HARNESS_PREWRITE_STDOUT_BYTES", "131072");
-    config.startup_probe = None;
-    config.request_timeout = Duration::from_secs(5);
-    config.max_request_bytes = 192 * 1024;
-    config.max_stdout_bytes = 192 * 1024;
-    let pool = WorkerPool::new(config).await.unwrap();
-
-    let response = pool
-        .execute_json(json!({ "value": "x".repeat(128 * 1024) }))
-        .await
-        .expect("duplex request avoids pipe-buffer deadlock");
-
-    assert_eq!(response["ok"], true);
-    assert_eq!(
-        response["prewritten"]
-            .as_str()
-            .expect("prewritten payload is string")
-            .len(),
-        131072
-    );
-}
-
-fn cargo_bin(name: &str) -> PathBuf {
-    let env_path = PathBuf::from(env!("CARGO_BIN_EXE_registry-notary-worker-harness-fixture"));
-    if env_path
-        .parent()
-        .and_then(|parent| parent.file_name())
-        .is_some_and(|file_name| file_name == "deps")
-    {
-        let candidate = env_path
-            .parent()
-            .and_then(|parent| parent.parent())
-            .expect("target debug dir")
-            .join(name);
-        if candidate.is_file() {
-            return candidate;
-        }
-    }
-    env_path
-}
-
-fn unique_state_path() -> PathBuf {
-    let nanos = SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .unwrap()
-        .as_nanos();
-    std::env::temp_dir().join(format!(
-        "registry-notary-worker-harness-fixture-{nanos}.state"
-    ))
-}
-
-async fn worker_pool_test_lock() -> WorkerPoolTestLock {
-    let path = std::env::temp_dir().join("registry-notary-worker-pool-tests.lock");
-    let deadline = tokio::time::Instant::now() + Duration::from_secs(30);
-    loop {
-        match fs::create_dir(&path) {
-            Ok(()) => return WorkerPoolTestLock { path },
-            Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => {
-                assert!(
-                    tokio::time::Instant::now() < deadline,
-                    "timed out waiting for worker pool test lock: {}",
-                    path.display()
-                );
-                tokio::time::sleep(Duration::from_millis(10)).await;
-            }
-            Err(error) => panic!(
-                "failed to create worker pool test lock {}: {error}",
-                path.display()
-            ),
-        }
-    }
-}
-
-async fn wait_for_in_flight(pool: &WorkerPool, expected: usize) {
-    let deadline = tokio::time::Instant::now() + Duration::from_secs(5);
-    loop {
-        if pool.snapshot().await.in_flight == expected {
-            return;
-        }
-        assert!(
-            tokio::time::Instant::now() < deadline,
-            "worker pool did not reach in_flight={expected}"
-        );
-        tokio::time::sleep(Duration::from_millis(10)).await;
-    }
-}
-
-async fn wait_for_path(path: &Path) {
-    let deadline = tokio::time::Instant::now() + Duration::from_secs(5);
-    loop {
-        if path.exists() {
-            return;
-        }
-        assert!(
-            tokio::time::Instant::now() < deadline,
-            "fixture state path was not created: {}",
-            path.display()
-        );
-        tokio::time::sleep(Duration::from_millis(10)).await;
-    }
-}
-
-async fn wait_for_start_ordinal(directory: &Path, ordinal: usize) {
-    wait_for_path(&directory.join(ordinal.to_string())).await;
-}
-
-async fn wait_for_not_ready(pool: &WorkerPool) {
-    let deadline = tokio::time::Instant::now() + Duration::from_secs(5);
-    loop {
-        if !pool.check_ready().await {
-            return;
-        }
-        assert!(
-            tokio::time::Instant::now() < deadline,
-            "worker pool did not observe an unready worker"
-        );
-        tokio::time::sleep(Duration::from_millis(10)).await;
-    }
-}
-
-async fn wait_for_ready(pool: &WorkerPool) {
-    let deadline = tokio::time::Instant::now() + Duration::from_secs(5);
-    loop {
-        if pool.check_ready().await {
-            return;
-        }
-        assert!(
-            tokio::time::Instant::now() < deadline,
-            "worker pool did not become ready"
-        );
-        tokio::time::sleep(Duration::from_millis(10)).await;
-    }
-}
-
-async fn wait_for_circuit(pool: &WorkerPool) {
-    let deadline = tokio::time::Instant::now() + Duration::from_secs(5);
-    loop {
-        let _ = pool.check_ready().await;
-        if pool.snapshot().await.circuit_open {
-            return;
-        }
-        assert!(
-            tokio::time::Instant::now() < deadline,
-            "worker pool circuit did not open"
-        );
-        tokio::time::sleep(Duration::from_millis(10)).await;
-    }
-}
-
-async fn wait_for_background_circuit(pool: &WorkerPool) {
-    let deadline = tokio::time::Instant::now() + Duration::from_secs(5);
-    loop {
-        if pool.snapshot().await.circuit_open {
-            return;
-        }
-        assert!(
-            tokio::time::Instant::now() < deadline,
-            "background replenishment did not open the worker pool circuit"
-        );
-        tokio::time::sleep(Duration::from_millis(10)).await;
-    }
-}
diff --git a/crates/registry-notary/Cargo.toml b/crates/registry-notary/Cargo.toml
deleted file mode 100644
index 3129efc76..000000000
--- a/crates/registry-notary/Cargo.toml
+++ /dev/null
@@ -1,56 +0,0 @@
-[package]
-name = "registry-notary"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Standalone Registry Notary process entrypoint."
-readme = "README.md"
-repository.workspace = true
-publish = false
-
-# not opted into [workspace.lints]: unsafe std::env::set_var/remove_var in
-# #[cfg(test)] code (src/main.rs)
-
-[[bin]]
-name = "registry-notary"
-path = "src/main.rs"
-
-[features]
-default = []
-pkcs11 = ["registry-notary-server/pkcs11"]
-registry-notary-cel = ["registry-notary-server/registry-notary-cel"]
-
-[dependencies]
-axum.workspace = true
-base64.workspace = true
-clap.workspace = true
-ed25519-dalek = { version = "2" }
-getrandom.workspace = true
-hyper.workspace = true
-hyper-util.workspace = true
-registry-notary-core.workspace = true
-registry-notary-server = { workspace = true, default-features = false }
-registry-config-report.workspace = true
-registry-platform-audit.workspace = true
-registry-platform-config.workspace = true
-registry-platform-crypto.workspace = true
-registry-platform-ops.workspace = true
-reqwest.workspace = true
-serde_json.workspace = true
-serde_norway.workspace = true
-sha2.workspace = true
-time.workspace = true
-tokio = { workspace = true, features = ["io-util"] }
-tower.workspace = true
-tower-http.workspace = true
-tracing.workspace = true
-tracing-subscriber.workspace = true
-ulid.workspace = true
-
-[dev-dependencies]
-axum-test = { version = "20" }
-chrono = { version = "0.4" }
-jsonschema.workspace = true
-registry-platform-authcommon.workspace = true
-tempfile = { version = "3" }
-wiremock = { version = "0.6" }
diff --git a/crates/registry-notary/README.md b/crates/registry-notary/README.md
deleted file mode 100644
index 90d74dfd9..000000000
--- a/crates/registry-notary/README.md
+++ /dev/null
@@ -1,94 +0,0 @@
-# registry-notary
-
-Process entrypoint for the standalone Registry Notary service.
-
-The crate builds the `registry-notary` binary.
-
-## What It Provides
-
-- CLI parsing for local `--config`, direct signed-bundle startup, and
-  subcommands.
-- YAML config loading and validation.
-- Tracing initialization.
-- Axum listener startup and graceful shutdown.
-- OpenAPI document printing through `registry-notary openapi`.
-- Container liveness probing through `registry-notary healthcheck`.
-- Machine-readable build capability reporting through `registry-notary build-info`.
-
-## Subcommands
-
-| Subcommand | Purpose |
-|---|---|
-| `openapi` | Print the OpenAPI document as JSON. |
-| `build-info` | Print package, version, compiled features, and runtime capabilities as JSON. |
-| `doctor` | Validate config, env-backed secrets, source auth, and VC wiring. |
-| `explain-config` | Print resolved config and required env vars. |
-| `init dci` | Generate a generic DCI source starter skeleton. |
-| `hash-api-key` | Generate or hash a Registry Notary API key. |
-| `demo-issuer-key` | Generate a demo Ed25519 issuer JWK for local VC smoke tests. |
-| `healthcheck` | Probe the local HTTP health endpoint and exit non-zero when unhealthy. |
-| `schema` | Print the complete Draft 2020-12 standalone configuration schema. |
-
-## Typical Use
-
-Run the service:
-
-```sh
-cargo run -p registry-notary -- --config demo/config/registry-notary.yaml
-```
-
-Start from a signed Config Bundle without an unsigned bootstrap document:
-
-```sh
-registry-notary \
-  --bundle-dir /run/registry-notary/bundle \
-  --anchor-path /run/registry-notary/trust-anchor.json \
-  --state-path /var/lib/registry-notary/antirollback.json \
-  --initialize-state
-```
-
-Omit `--initialize-state` after first acceptance. Direct bundle startup rejects
-partial or mixed local inputs and has no unsigned or break-glass fallback. The
-signed manifest must include an `instance_id` that matches the trust anchor so
-each runtime instance has a distinct anti-rollback lane.
-
-Print the OpenAPI document:
-
-```sh
-cargo run -p registry-notary -- openapi > target/registry-notary.openapi.json
-```
-
-Probe the container health endpoint without requiring curl in the image:
-
-```sh
-cargo run -p registry-notary -- healthcheck --url http://127.0.0.1:8080/healthz
-```
-
-Print the committed configuration contract:
-
-```sh
-cargo run -p registry-notary -- schema > schemas/registry-notary.config.schema.json
-```
-
-The repository artifact is regenerated and checked with
-`cd products/notary && just config-schema-check`. The schema covers YAML
-structure and scalar types. `registry-notary doctor` remains authoritative
-for environment and secret availability, filesystem and Relay access,
-deployment gates, and cross-field validation.
-
-## Features
-
-- Default: no CEL runtime.
-- `pkcs11`: enables the server crate's PKCS#11 signing provider.
-- `registry-notary-cel`: enables the server crate's CEL runtime feature.
-
-## Testing
-
-```sh
-cargo test -p registry-notary
-cargo run -p registry-notary -- openapi > target/registry-notary.openapi.json
-```
-
-## License
-
-Apache-2.0.
diff --git a/crates/registry-notary/src/boot.rs b/crates/registry-notary/src/boot.rs
deleted file mode 100644
index 62bc934db..000000000
--- a/crates/registry-notary/src/boot.rs
+++ /dev/null
@@ -1,527 +0,0 @@
-use crate::*;
-
-pub(crate) fn value_free_configuration_failure<E>(
-    _: E,
-) -> registry_notary_server::NotaryActivationFailure {
-    registry_notary_server::NotaryActivationCode::CONFIGURATION_INVALID.into()
-}
-
-fn value_free_runtime_activation_failure<E>(
-    _: E,
-) -> registry_notary_server::NotaryActivationFailure {
-    registry_notary_server::NotaryActivationCode::RUNTIME_ACTIVATION_FAILED.into()
-}
-
-pub(crate) async fn run_server(
-    config_input: impl Into<ServerConfigInput>,
-    bind_override: Option<SocketAddr>,
-    initialize_state: bool,
-) -> Result<(), Box<dyn std::error::Error>> {
-    run_server_with_acceptance(
-        config_input.into(),
-        bind_override,
-        initialize_state,
-        ServerAcceptanceMode::Legacy,
-    )
-    .await
-}
-
-pub(crate) async fn run_governed_server(
-    verified: VerifiedConfigBundle,
-    state_path: &Path,
-    trust_domain: ProductTrustDomainV1,
-) -> Result<(), Box<dyn std::error::Error>> {
-    init_tracing().map_err(value_free_configuration_failure)?;
-    let loaded = load_verified_product_server_config(state_path, verified, trust_domain)?;
-    run_loaded_server(loaded, None, ServerAcceptanceMode::Governed).await
-}
-
-enum ServerAcceptanceMode {
-    Legacy,
-    Governed,
-}
-
-enum PreparedServerAcceptance {
-    Legacy(Option<PendingBundleAcceptance>),
-    GovernedExact {
-        acceptance: PendingBundleAcceptance,
-        audit_evidence: GovernedAcceptanceAuditEvidence,
-    },
-}
-
-struct GovernedAcceptanceAuditEvidence {
-    acceptance_identity: registry_platform_config::ProductAcceptanceIdentityV1,
-    bundle_manifest_hash: String,
-    anchor_digest: String,
-    anchor_version: u64,
-}
-
-impl GovernedAcceptanceAuditEvidence {
-    #[cfg(test)]
-    fn from_intent(intent: &registry_platform_ops::AcceptanceAuditIntentV1) -> Self {
-        Self {
-            acceptance_identity: intent.key.acceptance_identity.clone(),
-            bundle_manifest_hash: intent.bundle_manifest_hash.clone(),
-            anchor_digest: intent.anchor_digest.clone(),
-            anchor_version: intent.anchor_version,
-        }
-    }
-
-    fn from_exact_acceptance(
-        acceptance: &PendingBundleAcceptance,
-    ) -> Result<Self, BundleVerificationFailure> {
-        Ok(Self {
-            acceptance_identity: acceptance.key.acceptance_identity.clone(),
-            bundle_manifest_hash: acceptance.bundle_manifest_hash.clone().ok_or_else(|| {
-                BundleVerificationFailure::from(BundleVerificationCode::REJECTED_VALIDATION)
-            })?,
-            anchor_digest: acceptance.accepted_anchor.digest.clone(),
-            anchor_version: acceptance.accepted_anchor.version,
-        })
-    }
-}
-
-async fn run_server_with_acceptance(
-    config_input: ServerConfigInput,
-    bind_override: Option<SocketAddr>,
-    initialize_state: bool,
-    acceptance_mode: ServerAcceptanceMode,
-) -> Result<(), Box<dyn std::error::Error>> {
-    init_tracing().map_err(value_free_configuration_failure)?;
-
-    let loaded = load_server_config_input(&config_input, initialize_state)?;
-    run_loaded_server(loaded, bind_override, acceptance_mode).await
-}
-
-async fn run_loaded_server(
-    loaded: LoadedServerConfig,
-    bind_override: Option<SocketAddr>,
-    acceptance_mode: ServerAcceptanceMode,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let prepared_acceptance = prepare_server_acceptance(&loaded, acceptance_mode)?;
-    let mut config = loaded.config;
-    apply_bind_override(&mut config, bind_override);
-    let bind = config.server.bind;
-    let admin_mode = config.server.admin_listener.mode;
-    let admin_bind = config.server.admin_listener.bind;
-    let serve_limits = ServeLimits::from_config(&config.server);
-    let runtime = compile_notary_runtime_with_provenance(
-        config,
-        loaded.config_source,
-        loaded.config_provenance.clone(),
-    )
-    .map_err(registry_notary_server::NotaryActivationFailure::from)?
-    .activate()
-    .await
-    .map_err(registry_notary_server::NotaryActivationFailure::from)?;
-    match admin_mode {
-        RegistryNotaryAdminListenerMode::Dedicated => {
-            let public_listener = tokio::net::TcpListener::bind(bind).await?;
-            let public_addr: SocketAddr = public_listener.local_addr()?;
-            let admin_listener = tokio::net::TcpListener::bind(admin_bind).await?;
-            let admin_addr: SocketAddr = admin_listener.local_addr()?;
-            finalize_server_acceptance(&runtime, prepared_acceptance)
-                .await
-                .map_err(value_free_runtime_activation_failure)?;
-            let routers = notary_routers_from_runtime(runtime)
-                .map_err(registry_notary_server::NotaryActivationFailure::from)?;
-            tracing::info!(
-                %public_addr,
-                %admin_addr,
-                build_features = ?compiled_build_features(),
-                "registry notary listening with dedicated admin listener"
-            );
-
-            let (shutdown_tx, shutdown_rx) = tokio::sync::watch::channel(false);
-            tokio::spawn(async move {
-                shutdown_signal().await;
-                let _ = shutdown_tx.send(true);
-            });
-            let public_shutdown = shutdown_when_signaled(shutdown_rx.clone());
-            let admin_shutdown = shutdown_when_signaled(shutdown_rx);
-            let public = serve_listener(
-                public_listener,
-                routers
-                    .public
-                    .layer(TraceLayer::new_for_http().make_span_with(http_trace_span)),
-                serve_limits,
-                public_shutdown,
-            );
-            let admin = serve_listener(
-                admin_listener,
-                routers
-                    .admin
-                    .layer(TraceLayer::new_for_http().make_span_with(http_trace_span)),
-                serve_limits,
-                admin_shutdown,
-            );
-            tokio::try_join!(public, admin)?;
-        }
-        RegistryNotaryAdminListenerMode::SharedWithPublic => {
-            let listener = tokio::net::TcpListener::bind(bind).await?;
-            let local_addr: SocketAddr = listener.local_addr()?;
-            finalize_server_acceptance(&runtime, prepared_acceptance)
-                .await
-                .map_err(value_free_runtime_activation_failure)?;
-            let app = notary_shared_router_from_runtime(runtime)
-                .map_err(registry_notary_server::NotaryActivationFailure::from)?
-                .layer(TraceLayer::new_for_http().make_span_with(http_trace_span));
-            tracing::info!(
-                %local_addr,
-                build_features = ?compiled_build_features(),
-                "registry notary listening"
-            );
-
-            serve_listener(listener, app, serve_limits, shutdown_signal()).await?;
-        }
-        RegistryNotaryAdminListenerMode::Disabled => {
-            let listener = tokio::net::TcpListener::bind(bind).await?;
-            let local_addr: SocketAddr = listener.local_addr()?;
-            finalize_server_acceptance(&runtime, prepared_acceptance)
-                .await
-                .map_err(value_free_runtime_activation_failure)?;
-            let app = notary_routers_from_runtime(runtime)
-                .map_err(registry_notary_server::NotaryActivationFailure::from)?
-                .public
-                .layer(TraceLayer::new_for_http().make_span_with(http_trace_span));
-            tracing::info!(
-                %local_addr,
-                build_features = ?compiled_build_features(),
-                "registry notary listening without admin listener"
-            );
-
-            serve_listener(listener, app, serve_limits, shutdown_signal()).await?;
-        }
-    }
-    Ok(())
-}
-
-fn prepare_server_acceptance(
-    loaded: &LoadedServerConfig,
-    mode: ServerAcceptanceMode,
-) -> Result<PreparedServerAcceptance, Box<dyn std::error::Error>> {
-    match mode {
-        ServerAcceptanceMode::Legacy => Ok(PreparedServerAcceptance::Legacy(
-            loaded.pending_bundle_acceptance.clone(),
-        )),
-        ServerAcceptanceMode::Governed => {
-            let acceptance = loaded.pending_bundle_acceptance.clone().ok_or_else(|| {
-                Box::new(BundleVerificationFailure::from(
-                    BundleVerificationCode::REJECTED_VALIDATION,
-                )) as Box<dyn std::error::Error>
-            })?;
-            let candidate = loaded.verified_acceptance_state.as_ref().ok_or_else(|| {
-                Box::new(BundleVerificationFailure::from(
-                    BundleVerificationCode::REJECTED_VALIDATION,
-                )) as Box<dyn std::error::Error>
-            })?;
-            let store = registry_platform_ops::FileAntiRollbackStore::new(&acceptance.state_path);
-            store
-                .verify_state(candidate.expectation())
-                .map_err(|error| map_config_boot_error(ConfigBootError::Store(error)))?;
-            let audit_evidence =
-                GovernedAcceptanceAuditEvidence::from_exact_acceptance(&acceptance)?;
-            Ok(PreparedServerAcceptance::GovernedExact {
-                acceptance,
-                audit_evidence,
-            })
-        }
-    }
-}
-
-async fn finalize_server_acceptance(
-    runtime: &registry_notary_server::NotaryRuntimeSnapshot,
-    prepared: PreparedServerAcceptance,
-) -> Result<(), Box<dyn std::error::Error>> {
-    match prepared {
-        PreparedServerAcceptance::Legacy(acceptance) => {
-            emit_and_persist_boot_acceptance(runtime, acceptance.as_ref()).await
-        }
-        PreparedServerAcceptance::GovernedExact {
-            acceptance,
-            audit_evidence,
-        } => {
-            emit_boot_config_audits_for_action(runtime, &acceptance, "serve", Some(&audit_evidence))
-                .await
-        }
-    }
-}
-
-#[cfg(test)]
-pub(crate) async fn initialize_state_once(
-    config_input: impl Into<ServerConfigInput>,
-) -> Result<(), Box<dyn std::error::Error>> {
-    init_tracing().map_err(value_free_configuration_failure)?;
-
-    let config_input = config_input.into();
-    let loaded = load_server_config_input(&config_input, true)?;
-    let acceptance = loaded.pending_bundle_acceptance.clone().ok_or_else(|| {
-        Box::new(BundleVerificationFailure::from(
-            BundleVerificationCode::REJECTED_VALIDATION,
-        )) as Box<dyn std::error::Error>
-    })?;
-    let verified_acceptance_state = loaded.verified_acceptance_state.clone().ok_or_else(|| {
-        Box::new(BundleVerificationFailure::from(
-            BundleVerificationCode::REJECTED_VALIDATION,
-        )) as Box<dyn std::error::Error>
-    })?;
-    if acceptance.source != ConfigSource::SignedBundleFile
-        || acceptance.sequence != Some(1)
-        || acceptance.state_action != BundleStateAction::Initialize
-    {
-        return Err(Box::new(BundleVerificationFailure::from(
-            BundleVerificationCode::REJECTED_ROLLBACK,
-        )));
-    }
-    let store = registry_platform_ops::FileAntiRollbackStore::new(&acceptance.state_path);
-    let plan = store
-        .plan_initialize(&verified_acceptance_state)
-        .map_err(|error| map_config_boot_error(ConfigBootError::Store(error)))?;
-    ensure_acceptance_audit_matches_plan(&acceptance, plan.audit_intent())?;
-
-    let runtime = compile_notary_runtime_with_provenance(
-        loaded.config,
-        loaded.config_source,
-        loaded.config_provenance,
-    )
-    .map_err(registry_notary_server::NotaryActivationFailure::from)?
-    .activate()
-    .await
-    .map_err(registry_notary_server::NotaryActivationFailure::from)?;
-
-    store
-        .commit_acceptance(plan, |intent| async move {
-            ensure_acceptance_audit_matches_plan(&acceptance, &intent)?;
-            let audit_evidence = GovernedAcceptanceAuditEvidence::from_intent(&intent);
-            emit_boot_config_audits_for_action(
-                &runtime,
-                &acceptance,
-                "initialize_state",
-                Some(&audit_evidence),
-            )
-            .await
-        })
-        .await
-        .map_err(|error| value_free_runtime_activation_failure(ConfigBootError::Store(error)))?;
-    Ok(())
-}
-
-#[cfg(test)]
-fn ensure_acceptance_audit_matches_plan(
-    acceptance: &PendingBundleAcceptance,
-    intent: &registry_platform_ops::AcceptanceAuditIntentV1,
-) -> Result<(), Box<dyn std::error::Error>> {
-    if acceptance.key == intent.key
-        && acceptance.sequence == Some(intent.sequence)
-        && acceptance.config_hash == intent.config_hash
-        && acceptance.bundle_manifest_hash.as_deref() == Some(&intent.bundle_manifest_hash)
-        && acceptance.bundle_id.as_deref() == Some(&intent.bundle_id)
-        && acceptance.accepted_anchor.digest == intent.anchor_digest
-        && acceptance.accepted_anchor.version == intent.anchor_version
-    {
-        return Ok(());
-    }
-    Err(Box::new(BundleVerificationFailure::from(
-        BundleVerificationCode::REJECTED_VALIDATION,
-    )))
-}
-
-#[cfg(test)]
-pub(crate) fn bundle_acceptance_audit(acceptance: &PendingBundleAcceptance) -> ConfigAuditEvent {
-    bundle_acceptance_audit_for_action(acceptance, "boot", None)
-}
-
-#[cfg(test)]
-pub(crate) fn governed_bundle_acceptance_audit(
-    acceptance: &PendingBundleAcceptance,
-    intent: &registry_platform_ops::AcceptanceAuditIntentV1,
-) -> Result<ConfigAuditEvent, Box<dyn std::error::Error>> {
-    ensure_acceptance_audit_matches_plan(acceptance, intent)?;
-    let audit_evidence = GovernedAcceptanceAuditEvidence::from_intent(intent);
-    Ok(bundle_acceptance_audit_for_action(
-        acceptance,
-        "initialize_state",
-        Some(&audit_evidence),
-    ))
-}
-
-fn bundle_acceptance_audit_for_action(
-    acceptance: &PendingBundleAcceptance,
-    action: &str,
-    governed_evidence: Option<&GovernedAcceptanceAuditEvidence>,
-) -> ConfigAuditEvent {
-    ConfigAuditEvent {
-        action: action.to_string(),
-        source: acceptance.source.as_posture_str().to_string(),
-        acceptance_identity: governed_evidence.map(|evidence| evidence.acceptance_identity.clone()),
-        bundle_id: acceptance.bundle_id.clone(),
-        bundle_manifest_hash: governed_evidence
-            .map(|evidence| evidence.bundle_manifest_hash.clone()),
-        sequence: acceptance.sequence,
-        signer_kids: acceptance.signer_kids.clone(),
-        previous_config_hash: acceptance.previous_config_hash.clone(),
-        previous_hash_matched: acceptance.previous_hash_matched,
-        config_hash: Some(acceptance.config_hash.clone()),
-        anchor_digest: governed_evidence.map(|evidence| evidence.anchor_digest.clone()),
-        anchor_version: governed_evidence.map(|evidence| evidence.anchor_version),
-        product_validation_result: "accepted".to_string(),
-        apply_result: "pending".to_string(),
-        posture_result: "accepted".to_string(),
-        applied: false,
-        restart_required: false,
-        change_classes: Vec::new(),
-        break_glass: acceptance.break_glass,
-        break_glass_approval_reference: None,
-        break_glass_approved_by: None,
-        break_glass_reason_hash: None,
-        break_glass_emergency_change_class: None,
-        break_glass_expires_at_unix_seconds: None,
-        break_glass_rate_limit_identity: None,
-        local_approval_reference: None,
-        local_approval_approved_by: None,
-        local_approval_reason_hash: None,
-        local_approval_change_class: None,
-        local_approval_expires_at_unix_seconds: None,
-        local_approval_rate_limit_identity: None,
-    }
-}
-
-pub(crate) async fn emit_boot_config_audits(
-    runtime: &registry_notary_server::NotaryRuntimeSnapshot,
-    acceptance: &PendingBundleAcceptance,
-) -> Result<(), Box<dyn std::error::Error>> {
-    emit_boot_config_audits_for_action(runtime, acceptance, "boot", None).await
-}
-
-async fn emit_boot_config_audits_for_action(
-    runtime: &registry_notary_server::NotaryRuntimeSnapshot,
-    acceptance: &PendingBundleAcceptance,
-    action: &str,
-    governed_evidence: Option<&GovernedAcceptanceAuditEvidence>,
-) -> Result<(), Box<dyn std::error::Error>> {
-    if acceptance.emits_break_glass_used_audit() {
-        runtime
-            .emit_config_boot_audit(
-                "config.break_glass_used",
-                break_glass_used_audit(acceptance)?,
-            )
-            .await?;
-    }
-    if acceptance.source == ConfigSource::SignedBundleFile {
-        runtime
-            .emit_config_boot_audit(
-                "config.bundle_accepted",
-                bundle_acceptance_audit_for_action(acceptance, action, governed_evidence),
-            )
-            .await?;
-    }
-    Ok(())
-}
-
-pub(crate) fn break_glass_used_audit(
-    acceptance: &PendingBundleAcceptance,
-) -> Result<ConfigAuditEvent, Box<dyn std::error::Error>> {
-    let pin = acceptance
-        .override_pin
-        .as_ref()
-        .ok_or("break-glass acceptance is missing override pin")?;
-    Ok(ConfigAuditEvent {
-        action: "boot".to_string(),
-        source: acceptance.source.as_posture_str().to_string(),
-        acceptance_identity: None,
-        bundle_id: acceptance.bundle_id.clone(),
-        bundle_manifest_hash: None,
-        sequence: acceptance.sequence,
-        signer_kids: acceptance.signer_kids.clone(),
-        previous_config_hash: acceptance.previous_config_hash.clone(),
-        previous_hash_matched: acceptance.previous_hash_matched,
-        config_hash: Some(acceptance.config_hash.clone()),
-        anchor_digest: None,
-        anchor_version: None,
-        product_validation_result: "accepted".to_string(),
-        apply_result: "applied".to_string(),
-        posture_result: "accepted".to_string(),
-        applied: true,
-        restart_required: false,
-        change_classes: Vec::new(),
-        break_glass: true,
-        break_glass_approval_reference: None,
-        break_glass_approved_by: Some(pin.operator.clone()),
-        break_glass_reason_hash: Some(sha256_hash(&pin.reason)),
-        break_glass_emergency_change_class: Some(match pin.mode {
-            ConfigOverrideMode::AcceptRollback => "accept_rollback".to_string(),
-            ConfigOverrideMode::AcceptUnsigned => "accept_unsigned".to_string(),
-        }),
-        break_glass_expires_at_unix_seconds: pin.expires_at.as_deref().and_then(rfc3339_unix),
-        break_glass_rate_limit_identity: None,
-        local_approval_reference: None,
-        local_approval_approved_by: None,
-        local_approval_reason_hash: None,
-        local_approval_change_class: None,
-        local_approval_expires_at_unix_seconds: None,
-        local_approval_rate_limit_identity: None,
-    })
-}
-
-pub(crate) fn rfc3339_unix(value: &str) -> Option<u64> {
-    OffsetDateTime::parse(value, &Rfc3339)
-        .ok()
-        .and_then(|time| u64::try_from(time.unix_timestamp()).ok())
-}
-
-pub(crate) fn persist_bundle_acceptance(
-    acceptance: &PendingBundleAcceptance,
-) -> Result<(), Box<dyn std::error::Error>> {
-    persist_config_bundle_acceptance(acceptance)?;
-    Ok(())
-}
-
-pub(crate) fn persist_after_successful_boot_audit(
-    acceptance: &PendingBundleAcceptance,
-    audit_result: Result<(), Box<dyn std::error::Error>>,
-) -> Result<(), Box<dyn std::error::Error>> {
-    audit_result?;
-    persist_bundle_acceptance(acceptance)
-}
-
-pub(crate) async fn emit_and_persist_boot_acceptance(
-    runtime: &registry_notary_server::NotaryRuntimeSnapshot,
-    acceptance: Option<&PendingBundleAcceptance>,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let Some(acceptance) = acceptance else {
-        return Ok(());
-    };
-    let audit_result = emit_boot_config_audits(runtime, acceptance).await;
-    persist_after_successful_boot_audit(acceptance, audit_result)
-}
-
-pub(crate) async fn shutdown_when_signaled(mut shutdown_rx: tokio::sync::watch::Receiver<bool>) {
-    let _ = shutdown_rx.wait_for(|shutdown| *shutdown).await;
-}
-
-pub(crate) async fn shutdown_signal() {
-    let ctrl_c = async {
-        tokio::signal::ctrl_c()
-            .await
-            .expect("failed to install Ctrl+C handler");
-    };
-
-    #[cfg(unix)]
-    let terminate = async {
-        tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate())
-            .expect("failed to install SIGTERM handler")
-            .recv()
-            .await;
-    };
-
-    #[cfg(not(unix))]
-    let terminate = std::future::pending::<()>();
-
-    tokio::select! {
-        () = ctrl_c => {},
-        () = terminate => {},
-    }
-}
-#[cfg(test)]
-#[path = "boot/tests.rs"]
-mod tests;
diff --git a/crates/registry-notary/src/boot/tests.rs b/crates/registry-notary/src/boot/tests.rs
deleted file mode 100644
index 0ed025975..000000000
--- a/crates/registry-notary/src/boot/tests.rs
+++ /dev/null
@@ -1,818 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-use crate::test_support::*;
-use registry_notary_server::{NotaryActivationCode, NotaryActivationFailure};
-use registry_platform_ops::{BundleVerificationCode, BundleVerificationFailure};
-
-fn assert_value_free_activation_failure(
-    error: &(dyn std::error::Error + 'static),
-    expected_code: NotaryActivationCode,
-    forbidden_values: &[&str],
-) {
-    let failure = error
-        .downcast_ref::<NotaryActivationFailure>()
-        .expect("runtime activation errors use the redacted process boundary");
-    assert_eq!(failure.code(), expected_code);
-    assert!(
-        std::error::Error::source(failure).is_none(),
-        "the public failure must not retain an inner error"
-    );
-    let rendered = failure.to_string();
-    assert!(rendered.contains(expected_code.as_str()));
-    for forbidden in forbidden_values {
-        assert!(
-            !rendered.contains(forbidden),
-            "activation boundary exposed forbidden value {forbidden:?}: {rendered}"
-        );
-    }
-}
-
-#[test]
-fn top_level_server_error_renderer_drops_unknown_error_values() {
-    const SENTINEL: &str = "SENTINEL_PRIVATE_USERNAME_COUNTRY_SECRET_PATH_AND_DIGEST";
-    let unknown = std::io::Error::other(SENTINEL);
-
-    let rendered = crate::top_level_error_message(&unknown, true);
-
-    assert!(rendered.contains(NotaryActivationCode::RUNTIME_ACTIVATION_FAILED.as_str()));
-    assert!(!rendered.contains(SENTINEL));
-}
-
-#[test]
-fn top_level_server_error_renderer_preserves_safe_activation_code() {
-    let failure = NotaryActivationFailure::from(NotaryActivationCode::CONFIGURATION_INVALID);
-
-    let rendered = crate::top_level_error_message(&failure, true);
-
-    assert!(rendered.contains(NotaryActivationCode::CONFIGURATION_INVALID.as_str()));
-    assert!(!rendered.contains("SENTINEL"));
-}
-
-#[test]
-fn top_level_server_error_renderer_preserves_safe_bundle_verification_code() {
-    let failure = BundleVerificationFailure::from(BundleVerificationCode::REJECTED_SIGNATURE);
-
-    let rendered = crate::top_level_error_message(&failure, true);
-
-    assert_eq!(rendered, failure.to_string());
-    assert!(rendered.contains(BundleVerificationCode::REJECTED_SIGNATURE.as_str()));
-    assert!(!rendered.contains("SENTINEL"));
-}
-
-#[test]
-fn boot_bundle_acceptance_audit_failure_aborts_before_antirollback_persist() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let state_path = tmp.path().join("antirollback.json");
-    let acceptance = PendingBundleAcceptance {
-        state_path: state_path.clone(),
-        key: registry_platform_ops::AntiRollbackKey {
-            acceptance_identity: notary_acceptance_identity(),
-        },
-        accepted_anchor: notary_accepted_anchor_pin(),
-        source: ConfigSource::SignedBundleFile,
-        bundle_id: Some("notary-loader-bundle".to_string()),
-        bundle_manifest_hash: Some(
-            "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee".to_string(),
-        ),
-        sequence: Some(1),
-        config_hash: "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
-            .to_string(),
-        previous_config_hash: None,
-        previous_hash_matched: None,
-        signer_kids: vec!["kid-1".to_string()],
-        break_glass: false,
-        state_action: BundleStateAction::Initialize,
-        override_pin: None,
-        override_path: None,
-    };
-    let audit_result: Result<(), Box<dyn std::error::Error>> =
-        Err(Box::new(std::io::Error::other("boot audit write failed")));
-
-    let result = persist_after_successful_boot_audit(&acceptance, audit_result);
-
-    assert!(result.is_err());
-    let err = registry_platform_ops::FileAntiRollbackStore::new(&state_path)
-        .load(&acceptance.key)
-        .expect_err("state remains absent");
-    assert_eq!(
-        err,
-        registry_platform_ops::AntiRollbackStoreError::MissingState
-    );
-}
-
-#[test]
-fn governed_acceptance_audit_persists_complete_validated_recovery_evidence() {
-    let acceptance_identity = notary_acceptance_identity();
-    let acceptance = PendingBundleAcceptance {
-        state_path: PathBuf::from("/var/lib/registry/state/antirollback.json"),
-        key: registry_platform_ops::AntiRollbackKey {
-            acceptance_identity: acceptance_identity.clone(),
-        },
-        accepted_anchor: notary_accepted_anchor_pin(),
-        source: ConfigSource::SignedBundleFile,
-        bundle_id: Some("notary-loader-bundle".to_string()),
-        bundle_manifest_hash: Some(
-            "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee".to_string(),
-        ),
-        sequence: Some(1),
-        config_hash: "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
-            .to_string(),
-        previous_config_hash: None,
-        previous_hash_matched: None,
-        signer_kids: vec!["kid-1".to_string()],
-        break_glass: false,
-        state_action: BundleStateAction::Initialize,
-        override_pin: None,
-        override_path: None,
-    };
-    let intent = registry_platform_ops::AcceptanceAuditIntentV1 {
-        mutation: registry_platform_ops::AcceptanceMutationKindV1::Initialize,
-        key: acceptance.key.clone(),
-        sequence: acceptance.sequence.expect("governed sequence"),
-        config_hash: acceptance.config_hash.clone(),
-        bundle_manifest_hash: acceptance
-            .bundle_manifest_hash
-            .clone()
-            .expect("governed manifest hash"),
-        bundle_id: acceptance.bundle_id.clone().expect("governed bundle id"),
-        anchor_digest: acceptance.accepted_anchor.digest.clone(),
-        anchor_version: acceptance.accepted_anchor.version,
-    };
-
-    let audit =
-        governed_bundle_acceptance_audit(&acceptance, &intent).expect("validated audit evidence");
-
-    assert_eq!(audit.acceptance_identity, Some(acceptance_identity));
-    assert_eq!(
-        audit.bundle_manifest_hash.as_deref(),
-        Some(intent.bundle_manifest_hash.as_str())
-    );
-    assert_eq!(
-        audit.anchor_digest.as_deref(),
-        Some(intent.anchor_digest.as_str())
-    );
-    assert_eq!(audit.anchor_version, Some(intent.anchor_version));
-    assert_eq!(audit.apply_result, "pending");
-    assert!(!audit.applied);
-}
-
-#[tokio::test]
-async fn governed_acceptance_commit_failure_never_records_applied_audit() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_signed_notary_bundle(&tmp);
-    let loaded = load_direct_signed_bundle_server_config(
-        &fixture.bundle_dir,
-        &fixture.anchor_path,
-        &fixture.state_path,
-        true,
-    )
-    .expect("governed bundle prepares without mutating state");
-    let acceptance = loaded
-        .pending_bundle_acceptance
-        .expect("pending acceptance is available");
-    let candidate = loaded
-        .verified_acceptance_state
-        .expect("verified acceptance state is available");
-    let store = registry_platform_ops::FileAntiRollbackStore::new(&fixture.state_path);
-    let plan = store
-        .plan_initialize(&candidate)
-        .expect("initialization plan is read-only");
-    let mut observed = None;
-
-    let error = store
-        .commit_acceptance(plan, |intent| {
-            observed = Some(
-                governed_bundle_acceptance_audit(&acceptance, &intent)
-                    .expect("checked intent audit builds"),
-            );
-            std::fs::write(&fixture.state_path, b"concurrent-state")
-                .expect("concurrent state creation forces commit failure");
-            async { Ok::<(), std::convert::Infallible>(()) }
-        })
-        .await
-        .expect_err("state commit fails after the checked audit callback");
-
-    assert!(matches!(
-        error,
-        registry_platform_ops::AntiRollbackStoreError::InvalidState(_)
-    ));
-    let audit = observed.expect("the pre-mutation audit was recorded");
-    assert_eq!(audit.apply_result, "pending");
-    assert!(
-        !audit.applied,
-        "failed state commit must have no applied audit"
-    );
-}
-
-#[test]
-fn legacy_acceptance_audit_omits_governed_recovery_evidence() {
-    let acceptance = PendingBundleAcceptance {
-        state_path: PathBuf::from("/tmp/legacy-antirollback.json"),
-        key: registry_platform_ops::AntiRollbackKey {
-            acceptance_identity: notary_acceptance_identity(),
-        },
-        accepted_anchor: notary_accepted_anchor_pin(),
-        source: ConfigSource::SignedBundleFile,
-        bundle_id: Some("legacy-bundle".to_string()),
-        bundle_manifest_hash: Some(
-            "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee".to_string(),
-        ),
-        sequence: Some(1),
-        config_hash: "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
-            .to_string(),
-        previous_config_hash: None,
-        previous_hash_matched: None,
-        signer_kids: vec!["kid-1".to_string()],
-        break_glass: false,
-        state_action: BundleStateAction::Initialize,
-        override_pin: None,
-        override_path: None,
-    };
-
-    let audit = bundle_acceptance_audit(&acceptance);
-    let serialized = serde_json::to_value(audit).expect("legacy audit serializes");
-
-    for field in [
-        "acceptance_identity",
-        "bundle_manifest_hash",
-        "anchor_digest",
-        "anchor_version",
-    ] {
-        assert!(
-            serialized.get(field).is_none(),
-            "legacy audit unexpectedly retained {field}"
-        );
-    }
-}
-
-#[tokio::test]
-async fn boot_configuration_boundary_redacts_paths_and_parser_values() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let config_path = tmp.path().join("SENTINEL_PRIVATE_CONFIG_PATH.yaml");
-    fs::write(
-        &config_path,
-        "SENTINEL_COUNTRY_IDENTIFIER: [invalid parser value",
-    )
-    .expect("invalid startup config writes");
-
-    let error = run_server(&config_path, None, false)
-        .await
-        .expect_err("invalid startup config fails closed");
-
-    assert_value_free_activation_failure(
-        error.as_ref(),
-        NotaryActivationCode::CONFIGURATION_INVALID,
-        &[
-            "SENTINEL_PRIVATE_CONFIG_PATH",
-            "SENTINEL_COUNTRY_IDENTIFIER",
-            "invalid parser value",
-            config_path.to_str().expect("config path is UTF-8"),
-        ],
-    );
-}
-
-#[tokio::test]
-async fn direct_signed_bundle_without_instance_id_cannot_start_or_initialize_state() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_signed_notary_bundle(&tmp);
-    rewrite_signed_bundle_instance_id(&fixture, None);
-    let input = ServerConfigInput::SignedBundle {
-        bundle_dir: fixture.bundle_dir.clone(),
-        anchor_path: fixture.anchor_path.clone(),
-        state_path: fixture.state_path.clone(),
-    };
-
-    let error = run_server(input, None, true)
-        .await
-        .expect_err("instance-unbound direct bundle must not start");
-
-    let failure = error
-        .downcast_ref::<BundleVerificationFailure>()
-        .expect("missing instance binding failure is typed");
-    assert_eq!(failure.code(), BundleVerificationCode::REJECTED_BINDING);
-    let rendered = format!("{failure} {failure:?}");
-    assert!(!rendered.contains(fixture.bundle_dir.to_string_lossy().as_ref()));
-    assert!(!rendered.contains(fixture.anchor_path.to_string_lossy().as_ref()));
-    assert!(!rendered.contains(fixture.state_path.to_string_lossy().as_ref()));
-    assert!(
-        !fixture.state_path.exists(),
-        "failed startup must not initialize anti-rollback state"
-    );
-}
-
-#[tokio::test]
-#[allow(clippy::await_holding_lock)]
-async fn explicit_initialization_is_sequence_one_one_shot_and_never_serves() {
-    let _guard = ENV_LOCK.lock().expect("env lock");
-    std::env::set_var("TEST_NOTARY_LOADER_API_HASH", sha256_hash("api-token"));
-    std::env::set_var(
-        "TEST_NOTARY_LOADER_AUDIT_HASH_SECRET",
-        "registry-notary-loader-audit-secret-32-bytes",
-    );
-    std::env::set_var(
-        "TEST_NOTARY_LOADER_ISSUER_JWK",
-        demo_issuer_jwk("did:web:issuer.example#key-1").expect("issuer key generates"),
-    );
-    let public_listener = std::net::TcpListener::bind("127.0.0.1:0").expect("public port binds");
-    let admin_listener = std::net::TcpListener::bind("127.0.0.1:0").expect("admin port binds");
-    let runtime_config = notary_bundle_runtime_config()
-        .replace(
-            "127.0.0.1:4255",
-            &public_listener
-                .local_addr()
-                .expect("public address")
-                .to_string(),
-        )
-        .replace(
-            "127.0.0.1:4256",
-            &admin_listener
-                .local_addr()
-                .expect("admin address")
-                .to_string(),
-        );
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_signed_notary_bundle_with_config(&tmp, runtime_config);
-    let input = ServerConfigInput::SignedBundle {
-        bundle_dir: fixture.bundle_dir.clone(),
-        anchor_path: fixture.anchor_path.clone(),
-        state_path: fixture.state_path.clone(),
-    };
-
-    initialize_state_once(input.clone())
-        .await
-        .expect("first initialization succeeds without binding listeners");
-
-    let verified = verify_notary_product_bundle(&fixture.bundle_dir, &fixture.anchor_path)
-        .expect("bundle remains verified");
-    let expected =
-        registry_platform_ops::VerifiedAcceptanceStateV1::from_verified_bundle(&verified)
-            .expect("acceptance expectation builds");
-    let record = registry_platform_ops::FileAntiRollbackStore::new(&fixture.state_path)
-        .verify_state(expected.expectation())
-        .expect("sequence-1 state is exact");
-    assert_eq!(record.last_sequence, 1);
-
-    let second = initialize_state_once(input)
-        .await
-        .expect_err("initialization is one shot");
-    assert_eq!(
-        second
-            .downcast_ref::<BundleVerificationFailure>()
-            .expect("repeat initialization is a typed rollback rejection")
-            .code(),
-        BundleVerificationCode::REJECTED_ROLLBACK
-    );
-
-    drop(public_listener);
-    drop(admin_listener);
-    std::env::remove_var("TEST_NOTARY_LOADER_API_HASH");
-    std::env::remove_var("TEST_NOTARY_LOADER_AUDIT_HASH_SECRET");
-    std::env::remove_var("TEST_NOTARY_LOADER_ISSUER_JWK");
-}
-
-#[tokio::test]
-#[allow(clippy::await_holding_lock)]
-async fn governed_boot_integrity_failure_persists_nothing_and_serves_nothing() {
-    let _guard = ENV_LOCK.lock().expect("env lock");
-    std::env::set_var("TEST_NOTARY_LOADER_API_HASH", sha256_hash("api-token"));
-    std::env::set_var(
-        "TEST_NOTARY_LOADER_AUDIT_HASH_SECRET",
-        "registry-notary-loader-audit-secret-32-bytes",
-    );
-    std::env::set_var(
-        "TEST_NOTARY_LOADER_ISSUER_JWK",
-        demo_issuer_jwk("did:web:issuer.example#key-1").expect("issuer key generates"),
-    );
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let public_probe = std::net::TcpListener::bind("127.0.0.1:0").expect("probe binds");
-    let public_addr = public_probe.local_addr().expect("probe address");
-    let admin_probe = std::net::TcpListener::bind("127.0.0.1:0").expect("probe binds");
-    let admin_addr = admin_probe.local_addr().expect("probe address");
-    drop(public_probe);
-    drop(admin_probe);
-
-    let profile = registry_platform_audit::AuditProfile::registry_notary_from_env(
-        "TEST_NOTARY_LOADER_AUDIT_HASH_SECRET",
-    )
-    .expect("audit profile loads");
-    {
-        let sink = registry_platform_audit::JsonlFileSink::new(&audit_path);
-        let chain = registry_platform_audit::ChainState::bootstrap_or_start_empty(
-            &sink,
-            profile.chain_hasher(),
-        )
-        .await
-        .expect("audit chain starts");
-        chain
-            .append(&sink, json!({ "event": "governed.boot.preexisting" }))
-            .await
-            .expect("audit event writes");
-    }
-    let contents = std::fs::read_to_string(&audit_path).expect("audit reads");
-    std::fs::write(
-        &audit_path,
-        contents.replace("governed.boot.preexisting", "governed.boot.tampered"),
-    )
-    .expect("audit is tampered");
-
-    let runtime_config = notary_bundle_runtime_config()
-        .replace("127.0.0.1:4255", &public_addr.to_string())
-        .replace("127.0.0.1:4256", &admin_addr.to_string())
-        .replace(
-            "audit:\n  sink: stdout\n  hash_secret_env: TEST_NOTARY_LOADER_AUDIT_HASH_SECRET",
-            &format!(
-                "audit:\n  sink: file\n  path: {}\n  hash_secret_env: TEST_NOTARY_LOADER_AUDIT_HASH_SECRET",
-                audit_path.display()
-            ),
-        );
-    let fixture = write_signed_notary_bundle_with_config(&tmp, runtime_config);
-    let config_path = tmp.path().join("bootstrap.yaml");
-    std::fs::write(&config_path, notary_bootstrap_config(&fixture)).expect("bootstrap writes");
-
-    let error = run_server(&config_path, None, true)
-        .await
-        .expect_err("governed boot audit failure aborts startup");
-    assert_value_free_activation_failure(
-        error.as_ref(),
-        NotaryActivationCode::RUNTIME_ACTIVATION_FAILED,
-        &[
-            "audit chain verification failed",
-            audit_path.to_str().expect("audit path is UTF-8"),
-            "governed.boot.tampered",
-        ],
-    );
-    let key = registry_platform_ops::AntiRollbackKey {
-        acceptance_identity: notary_acceptance_identity(),
-    };
-    let state_error = registry_platform_ops::FileAntiRollbackStore::new(&fixture.state_path)
-        .load(&key)
-        .expect_err("bundle acceptance state remains absent");
-    assert_eq!(
-        state_error,
-        registry_platform_ops::AntiRollbackStoreError::MissingState
-    );
-    let rebound_public = std::net::TcpListener::bind(public_addr)
-        .expect("public listener was released before any serving loop");
-    let rebound_admin = std::net::TcpListener::bind(admin_addr)
-        .expect("admin listener was released before any serving loop");
-    drop(rebound_public);
-    drop(rebound_admin);
-
-    audit_quarantine(
-        &config_path,
-        AuditQuarantineArgs {
-            reason: "recover governed first boot".to_string(),
-            operator: Some("ci".to_string()),
-        },
-    )
-    .expect("offline recovery can read the verified pending bundle");
-    let state_after_recovery =
-        registry_platform_ops::FileAntiRollbackStore::new(&fixture.state_path)
-            .load(&key)
-            .expect_err("offline audit recovery does not accept the bundle");
-    assert_eq!(
-        state_after_recovery,
-        registry_platform_ops::AntiRollbackStoreError::MissingState
-    );
-
-    std::env::remove_var("TEST_NOTARY_LOADER_API_HASH");
-    std::env::remove_var("TEST_NOTARY_LOADER_AUDIT_HASH_SECRET");
-    std::env::remove_var("TEST_NOTARY_LOADER_ISSUER_JWK");
-}
-
-#[tokio::test]
-#[allow(clippy::await_holding_lock)]
-async fn boot_listener_bind_failure_aborts_before_antirollback_persist() {
-    let _guard = ENV_LOCK.lock().expect("env lock");
-    std::env::set_var("TEST_NOTARY_LOADER_API_HASH", sha256_hash("api-token"));
-    std::env::set_var(
-        "TEST_NOTARY_LOADER_AUDIT_HASH_SECRET",
-        "registry-notary-loader-audit-secret-32-bytes",
-    );
-    std::env::set_var(
-        "TEST_NOTARY_LOADER_ISSUER_JWK",
-        demo_issuer_jwk("did:web:issuer.example#key-1").expect("issuer key generates"),
-    );
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_signed_notary_bundle(&tmp);
-    let config_path = tmp.path().join("bootstrap.yaml");
-    std::fs::write(&config_path, notary_bootstrap_config(&fixture)).expect("bootstrap writes");
-    let held_listener = std::net::TcpListener::bind("127.0.0.1:0").expect("test listener binds");
-    let held_addr = held_listener
-        .local_addr()
-        .expect("test listener exposes local addr");
-
-    let error = run_server(&config_path, Some(held_addr), true)
-        .await
-        .expect_err("occupied listener rejects startup");
-
-    assert!(
-        error.to_string().contains("Address already in use"),
-        "unexpected error: {error}"
-    );
-    let key = registry_platform_ops::AntiRollbackKey {
-        acceptance_identity: notary_acceptance_identity(),
-    };
-    let err = registry_platform_ops::FileAntiRollbackStore::new(&fixture.state_path)
-        .load(&key)
-        .expect_err("state remains absent");
-    assert_eq!(
-        err,
-        registry_platform_ops::AntiRollbackStoreError::MissingState
-    );
-
-    drop(held_listener);
-    std::env::remove_var("TEST_NOTARY_LOADER_API_HASH");
-    std::env::remove_var("TEST_NOTARY_LOADER_AUDIT_HASH_SECRET");
-    std::env::remove_var("TEST_NOTARY_LOADER_ISSUER_JWK");
-}
-
-#[tokio::test]
-async fn run_server_compiles_runtime_before_binding_listener() {
-    let held_listener = std::net::TcpListener::bind("127.0.0.1:0").expect("test listener binds");
-    let held_addr = held_listener
-        .local_addr()
-        .expect("test listener exposes local addr");
-    let config_path = std::env::temp_dir().join(format!(
-        "registry-notary-invalid-startup-{}.yaml",
-        Ulid::new()
-    ));
-    let config = notary_test_config();
-    fs::write(
-        &config_path,
-        serde_norway::to_string(&config).expect("startup config serializes"),
-    )
-    .expect("invalid startup config writes");
-
-    let error = run_server(&config_path, Some(held_addr), false)
-        .await
-        .expect_err("invalid runtime config fails before serving");
-    let message = error.to_string();
-
-    assert_value_free_activation_failure(
-        error.as_ref(),
-        NotaryActivationCode::CONFIGURATION_INVALID,
-        &[
-            "TEST_DOCTOR_OAUTH_CLIENT_ID",
-            "TEST_DOCTOR_OAUTH_CLIENT_SECRET",
-            "audit.hash_secret_env",
-        ],
-    );
-    assert!(
-        !message.contains("Address already in use"),
-        "server bound before compile failure: {message}"
-    );
-
-    let _ = fs::remove_file(config_path);
-    drop(held_listener);
-}
-
-#[tokio::test]
-#[allow(clippy::await_holding_lock)]
-async fn run_server_fails_fast_when_active_signing_key_env_is_missing() {
-    let _guard = ENV_LOCK.lock().expect("env lock is not poisoned");
-    std::env::set_var(
-        "TEST_STARTUP_API_HASH",
-        "sha256:31f2999a69fa6301763a9f61eea44388a13318ce8b80a16a115a9efdb62b883b",
-    );
-    std::env::set_var(
-        "TEST_STARTUP_AUDIT_HASH_SECRET",
-        "registry-notary-startup-audit-secret-32-bytes",
-    );
-    std::env::remove_var("TEST_STARTUP_ISSUER_JWK");
-
-    let held_listener = std::net::TcpListener::bind("127.0.0.1:0").expect("test listener binds");
-    let held_addr = held_listener
-        .local_addr()
-        .expect("test listener exposes local addr");
-    let config_path = std::env::temp_dir().join(format!(
-        "registry-notary-missing-signing-env-{}.yaml",
-        Ulid::new()
-    ));
-    fs::write(
-        &config_path,
-        r#"
-deployment:
-  profile: local
-server:
-  bind: 127.0.0.1:0
-auth:
-  api_keys:
-    - id: local
-      fingerprint:
-        provider: env
-        name: TEST_STARTUP_API_HASH
-      scopes: [registry_notary:credential_issue]
-audit:
-  sink: stdout
-  hash_secret_env: TEST_STARTUP_AUDIT_HASH_SECRET
-evidence:
-  enabled: true
-  signing_keys:
-    issuer:
-      provider: local_jwk_env
-      private_jwk_env: TEST_STARTUP_ISSUER_JWK
-      alg: EdDSA
-      kid: did:web:issuer.example#key-1
-      status: active
-"#,
-    )
-    .expect("startup config writes");
-
-    let error = run_server(&config_path, Some(held_addr), false)
-        .await
-        .expect_err("missing signing key env fails before serving");
-    let message = error.to_string();
-
-    assert_value_free_activation_failure(
-        error.as_ref(),
-        NotaryActivationCode::CONFIGURATION_INVALID,
-        &[
-            "signing key 'issuer'",
-            "private_jwk_env",
-            "TEST_STARTUP_ISSUER_JWK",
-        ],
-    );
-    assert!(
-        !message.contains("Address already in use"),
-        "server bound before signing key validation failed: {message}"
-    );
-
-    let _ = fs::remove_file(config_path);
-    drop(held_listener);
-    std::env::remove_var("TEST_STARTUP_API_HASH");
-    std::env::remove_var("TEST_STARTUP_AUDIT_HASH_SECRET");
-}
-
-#[test]
-fn bind_cli_override_wins_over_env() {
-    let _guard = ENV_LOCK.lock().expect("env lock is not poisoned");
-    std::env::set_var("REGISTRY_NOTARY_BIND", "0.0.0.0:8080");
-    let args = Args::try_parse_from([
-        "registry-notary",
-        "--bind",
-        "127.0.0.1:9000",
-        "explain-config",
-    ])
-    .expect("args parse");
-    std::env::remove_var("REGISTRY_NOTARY_BIND");
-
-    assert_eq!(
-        args.bind,
-        Some("127.0.0.1:9000".parse().expect("socket addr parses"))
-    );
-}
-
-#[test]
-fn env_bind_override_is_loaded_by_cli() {
-    let _guard = ENV_LOCK.lock().expect("env lock is not poisoned");
-    std::env::set_var("REGISTRY_NOTARY_BIND", "0.0.0.0:8080");
-    let args = Args::try_parse_from(["registry-notary", "explain-config"]).expect("args parse");
-    std::env::remove_var("REGISTRY_NOTARY_BIND");
-
-    assert_eq!(
-        args.bind,
-        Some("0.0.0.0:8080".parse().expect("socket addr parses"))
-    );
-}
-
-#[test]
-fn direct_signed_bundle_startup_arguments_resolve_as_one_closed_input() {
-    let _guard = ENV_LOCK.lock().expect("env lock is not poisoned");
-    std::env::remove_var("REGISTRY_NOTARY_CONFIG");
-    let args = Args::try_parse_from([
-        "registry-notary",
-        "--bundle-dir",
-        "operator-inputs/notary-bundle",
-        "--anchor-path",
-        "operator-inputs/notary-trust-anchor.json",
-        "--state-path",
-        "runtime-state/notary-antirollback.json",
-        "--initialize-state",
-    ])
-    .expect("complete direct bundle arguments parse");
-
-    assert_eq!(
-        server_config_input(&args).expect("server input resolves"),
-        ServerConfigInput::SignedBundle {
-            bundle_dir: PathBuf::from("operator-inputs/notary-bundle"),
-            anchor_path: PathBuf::from("operator-inputs/notary-trust-anchor.json"),
-            state_path: PathBuf::from("runtime-state/notary-antirollback.json"),
-        }
-    );
-    assert!(args.initialize_state);
-}
-
-#[test]
-fn direct_signed_bundle_startup_rejects_every_partial_argument_set() {
-    let _guard = ENV_LOCK.lock().expect("env lock is not poisoned");
-    std::env::remove_var("REGISTRY_NOTARY_CONFIG");
-    for partial in [
-        vec!["--bundle-dir", "bundle"],
-        vec!["--anchor-path", "anchor.json"],
-        vec!["--state-path", "state.json"],
-        vec!["--bundle-dir", "bundle", "--anchor-path", "anchor.json"],
-        vec!["--bundle-dir", "bundle", "--state-path", "state.json"],
-        vec!["--anchor-path", "anchor.json", "--state-path", "state.json"],
-    ] {
-        let mut argv = vec!["registry-notary"];
-        argv.extend(partial);
-        let error = Args::try_parse_from(argv).expect_err("partial bundle input must not parse");
-        assert_eq!(
-            error.kind(),
-            clap::error::ErrorKind::MissingRequiredArgument
-        );
-    }
-}
-
-#[test]
-fn local_and_direct_signed_bundle_startup_inputs_are_mutually_exclusive() {
-    let _guard = ENV_LOCK.lock().expect("env lock is not poisoned");
-    std::env::remove_var("REGISTRY_NOTARY_CONFIG");
-    let error = Args::try_parse_from([
-        "registry-notary",
-        "--config",
-        "/private/SENTINEL_LOCAL_CONFIG.yaml",
-        "--bundle-dir",
-        "bundle",
-        "--anchor-path",
-        "anchor.json",
-        "--state-path",
-        "state.json",
-    ])
-    .expect_err("mixed local and signed-bundle inputs must not parse");
-
-    assert_eq!(error.kind(), clap::error::ErrorKind::ArgumentConflict);
-    assert!(!error.to_string().contains("SENTINEL_LOCAL_CONFIG"));
-}
-
-#[test]
-fn environment_local_config_cannot_silently_mix_with_direct_bundle_startup() {
-    let _guard = ENV_LOCK.lock().expect("env lock is not poisoned");
-    std::env::set_var(
-        "REGISTRY_NOTARY_CONFIG",
-        "/private/SENTINEL_LOCAL_BOOTSTRAP_CONFIG.yaml",
-    );
-    let error = Args::try_parse_from([
-        "registry-notary",
-        "--bundle-dir",
-        "bundle",
-        "--anchor-path",
-        "anchor.json",
-        "--state-path",
-        "state.json",
-    ])
-    .expect_err("environment config must conflict with direct bundle input");
-    std::env::remove_var("REGISTRY_NOTARY_CONFIG");
-
-    assert_eq!(error.kind(), clap::error::ErrorKind::ArgumentConflict);
-    assert!(
-        !error
-            .to_string()
-            .contains("SENTINEL_LOCAL_BOOTSTRAP_CONFIG"),
-        "clap conflict diagnostics must not disclose the environment config path"
-    );
-}
-
-#[tokio::test]
-#[allow(clippy::await_holding_lock)]
-async fn env_file_local_config_cannot_silently_mix_with_direct_bundle_startup() {
-    let _guard = ENV_LOCK.lock().expect("env lock is not poisoned");
-    std::env::remove_var("REGISTRY_NOTARY_CONFIG");
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let env_path = tmp.path().join("SENTINEL_PRIVATE_STARTUP.env");
-    std::fs::write(
-        &env_path,
-        "REGISTRY_NOTARY_CONFIG=/private/SENTINEL_LOCAL_BOOTSTRAP_CONFIG.yaml\n",
-    )
-    .expect("env file writes");
-    let args = Args::try_parse_from([
-        "registry-notary",
-        "--bundle-dir",
-        "bundle",
-        "--anchor-path",
-        "anchor.json",
-        "--state-path",
-        "state.json",
-        "--env-file",
-        env_path.to_str().expect("env path is UTF-8"),
-    ])
-    .expect("arguments parse before the env file is loaded");
-
-    let error = run(args)
-        .await
-        .expect_err("env-file local config must reject direct bundle startup");
-    std::env::remove_var("REGISTRY_NOTARY_CONFIG");
-
-    assert_value_free_activation_failure(
-        error.as_ref(),
-        NotaryActivationCode::CONFIGURATION_INVALID,
-        &[
-            "SENTINEL_PRIVATE_STARTUP",
-            "SENTINEL_LOCAL_BOOTSTRAP_CONFIG",
-            env_path.to_str().expect("env path is UTF-8"),
-        ],
-    );
-}
diff --git a/crates/registry-notary/src/commands/api_key.rs b/crates/registry-notary/src/commands/api_key.rs
deleted file mode 100644
index 0cef9c1c5..000000000
--- a/crates/registry-notary/src/commands/api_key.rs
+++ /dev/null
@@ -1,70 +0,0 @@
-use crate::*;
-
-pub(crate) fn hash_api_key(
-    stdin: bool,
-    hash_only: bool,
-    print_secret: bool,
-    api_key: Option<String>,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let api_key = if stdin {
-        let mut input = String::new();
-        io::stdin().read_line(&mut input)?;
-        input.trim_end_matches(['\r', '\n']).to_string()
-    } else {
-        api_key.unwrap_or_else(|| random_secret("rn_api"))
-    };
-    if api_key.trim().is_empty() {
-        return Err("api key must not be empty".into());
-    }
-    let hash = sha256_hash(&api_key);
-    if hash_only {
-        println!("{hash}");
-    } else if print_secret {
-        println!("api_key={api_key}");
-        println!("hash={hash}");
-    } else if stdin {
-        println!("{hash}");
-    } else {
-        println!("hash={hash}");
-        println!("plaintext key generated; rerun with --print-secret to display it");
-    }
-    Ok(())
-}
-
-pub(crate) fn random_secret(prefix: &str) -> String {
-    let mut bytes = [0_u8; 32];
-    getrandom::fill(&mut bytes).expect("OS randomness is available");
-    format!("{prefix}_{}", URL_SAFE_NO_PAD.encode(bytes))
-}
-
-pub(crate) fn sha256_hash(value: &str) -> String {
-    let digest = Sha256::digest(value.as_bytes());
-    let mut hash = String::with_capacity("sha256:".len() + digest.len() * 2);
-    hash.push_str("sha256:");
-    for byte in digest {
-        use std::fmt::Write as _;
-        write!(&mut hash, "{byte:02x}").expect("writing to string cannot fail");
-    }
-    hash
-}
-
-pub(crate) fn demo_issuer_jwk(kid: &str) -> Result<String, Box<dyn std::error::Error>> {
-    let mut secret = [0_u8; 32];
-    getrandom::fill(&mut secret)?;
-    let signing_key = SigningKey::from_bytes(&secret);
-    let verifying_key = signing_key.verifying_key();
-    let jwk = json!({
-        "kty": "OKP",
-        "crv": "Ed25519",
-        "alg": "EdDSA",
-        "kid": kid,
-        "d": URL_SAFE_NO_PAD.encode(signing_key.to_bytes()),
-        "x": URL_SAFE_NO_PAD.encode(verifying_key.to_bytes()),
-    });
-    let serialized = serde_json::to_string(&jwk)?;
-    PrivateJwk::parse(&serialized)?;
-    Ok(serialized)
-}
-#[cfg(test)]
-#[path = "api_key/tests.rs"]
-mod tests;
diff --git a/crates/registry-notary/src/commands/api_key/tests.rs b/crates/registry-notary/src/commands/api_key/tests.rs
deleted file mode 100644
index f88e35207..000000000
--- a/crates/registry-notary/src/commands/api_key/tests.rs
+++ /dev/null
@@ -1,18 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-
-#[test]
-fn hash_api_key_uses_runtime_sha256_shape() {
-    assert_eq!(
-        sha256_hash("api-token"),
-        "sha256:a00cf33cd46d9ef96c1eff33df1c9cca20b1a02468cd78ec6a4b2887d1640b51"
-    );
-}
-
-#[test]
-fn generated_demo_issuer_key_is_parseable() {
-    let jwk = demo_issuer_jwk("did:web:localhost#demo").expect("jwk generated");
-    PrivateJwk::parse(&jwk).expect("generated JWK parses");
-    assert!(!format!("{jwk:?}").contains("[redacted]"));
-}
diff --git a/crates/registry-notary/src/commands/audit.rs b/crates/registry-notary/src/commands/audit.rs
deleted file mode 100644
index a08e4b851..000000000
--- a/crates/registry-notary/src/commands/audit.rs
+++ /dev/null
@@ -1,63 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Offline audit-chain recovery.
-
-use crate::*;
-
-pub(crate) fn audit_quarantine(
-    config_path: &Path,
-    args: AuditQuarantineArgs,
-) -> Result<(), Box<dyn std::error::Error>> {
-    // Recovery must also work after the first governed boot verified a signed
-    // bundle but could not persist acceptance because its audit write failed.
-    // Preparing initialization here is read-only: bundle acceptance state is
-    // still persisted only by the governed boot path after its audit succeeds.
-    let loaded = load_server_config(config_path, true)?;
-    let config = &loaded.config.audit;
-    if !matches!(config.sink.as_str(), "file" | "jsonl") {
-        return Err("audit quarantine requires audit.sink = file or jsonl".into());
-    }
-    let path = PathBuf::from(
-        config
-            .path
-            .as_deref()
-            .ok_or("audit quarantine requires audit.path")?,
-    );
-    let hash_secret_env = config
-        .hash_secret_env
-        .as_deref()
-        .ok_or("audit quarantine requires audit.hash_secret_env")?;
-    let profile = registry_platform_audit::AuditProfile::registry_notary_from_env(hash_secret_env)?;
-    let now_unix_ms = i64::try_from(OffsetDateTime::now_utc().unix_timestamp_nanos() / 1_000_000)
-        .unwrap_or(i64::MAX);
-    let outcome = registry_platform_audit::quarantine_and_recover_chain(
-        &path,
-        config.max_files(),
-        &profile.chain_hasher(),
-        &args.reason,
-        args.operator.as_deref(),
-        now_unix_ms,
-    )?;
-    println!(
-        "{}",
-        serde_json::to_string_pretty(&json!({
-            "schema_version": "registry.audit.recovery.v1",
-            "product": "registry-notary",
-            "audit_path": path_for_json(&path),
-            "already_consistent": outcome.already_consistent,
-            "first_bad_line": outcome.first_bad_line,
-            "last_good_hash": outcome.last_good_hash.map(|hash| {
-                registry_platform_audit::OptionalHashHex(Some(hash)).to_string()
-            }),
-            "break_event_hash": outcome.break_event_hash.map(|hash| {
-                registry_platform_audit::OptionalHashHex(Some(hash)).to_string()
-            }),
-            "records_before_break": outcome.records_before_break,
-            "quarantine_suffix": outcome.quarantine_suffix,
-        }))?
-    );
-    Ok(())
-}
-
-#[cfg(test)]
-#[path = "audit/tests.rs"]
-mod tests;
diff --git a/crates/registry-notary/src/commands/audit/tests.rs b/crates/registry-notary/src/commands/audit/tests.rs
deleted file mode 100644
index 8fd2a6bb5..000000000
--- a/crates/registry-notary/src/commands/audit/tests.rs
+++ /dev/null
@@ -1,161 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-use crate::test_support::{notary_test_config, ENV_LOCK};
-use registry_platform_audit::{
-    verify_jsonl_lines_with_hasher, AuditProfile, ChainState, JsonlFileSink,
-};
-
-const SECRET_ENV: &str = "TEST_NOTARY_AUDIT_QUARANTINE_SECRET";
-
-#[test]
-fn audit_quarantine_cli_parses_required_and_optional_fields() {
-    let args = Args::try_parse_from([
-        "registry-notary",
-        "--config",
-        "/etc/registry-notary.yaml",
-        "audit",
-        "quarantine",
-        "--reason",
-        "retained chain verification failed",
-        "--operator",
-        "operator-1",
-    ])
-    .expect("audit quarantine parses");
-
-    match args.command {
-        Some(Command::Audit {
-            command: AuditCommand::Quarantine(quarantine),
-        }) => {
-            assert_eq!(
-                args.config,
-                Some(PathBuf::from("/etc/registry-notary.yaml"))
-            );
-            assert_eq!(quarantine.reason, "retained chain verification failed");
-            assert_eq!(quarantine.operator.as_deref(), Some("operator-1"));
-        }
-        command => panic!("unexpected command: {command:?}"),
-    }
-}
-
-#[test]
-fn audit_quarantine_cli_requires_reason() {
-    let error = Args::try_parse_from([
-        "registry-notary",
-        "--config",
-        "/etc/registry-notary.yaml",
-        "audit",
-        "quarantine",
-    ])
-    .expect_err("missing reason is rejected");
-
-    assert!(error.to_string().contains("--reason"));
-}
-
-#[tokio::test]
-#[allow(clippy::await_holding_lock)]
-async fn audit_quarantine_recovers_tampered_chain_and_preserves_break() {
-    let _guard = ENV_LOCK.lock().expect("env lock");
-    std::env::set_var(SECRET_ENV, "0123456789abcdef0123456789abcdef");
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let config_path = tmp.path().join("notary.yaml");
-    let profile = AuditProfile::registry_notary_from_env(SECRET_ENV).expect("profile loads");
-
-    {
-        let sink = JsonlFileSink::with_rotation_single_writer(&audit_path, 1024 * 1024, 2)
-            .expect("audit sink builds");
-        let chain = ChainState::bootstrap_or_start_empty(&sink, profile.chain_hasher())
-            .await
-            .expect("chain starts");
-        chain
-            .append(&sink, json!({ "event": "test.one" }))
-            .await
-            .expect("first event writes");
-        chain
-            .append(&sink, json!({ "event": "test.two" }))
-            .await
-            .expect("second event writes");
-    }
-
-    let contents = std::fs::read_to_string(&audit_path).expect("audit reads");
-    std::fs::write(&audit_path, contents.replace("test.two", "tampered"))
-        .expect("audit is tampered");
-    let mut config = notary_test_config();
-    config.audit.sink = "file".to_string();
-    config.audit.path = Some(path_for_json(&audit_path));
-    config.audit.hash_secret_env = Some(SECRET_ENV.to_string());
-    config.audit.max_files = Some(2);
-    std::fs::write(
-        &config_path,
-        serde_norway::to_string(&config).expect("config serializes"),
-    )
-    .expect("config writes");
-
-    audit_quarantine(
-        &config_path,
-        AuditQuarantineArgs {
-            reason: "unit recovery".to_string(),
-            operator: Some("ci".to_string()),
-        },
-    )
-    .expect("quarantine succeeds");
-
-    let archive_count = std::fs::read_dir(tmp.path())
-        .expect("audit directory reads")
-        .filter_map(Result::ok)
-        .filter(|entry| {
-            entry
-                .file_name()
-                .to_string_lossy()
-                .starts_with("audit.jsonl.corrupt-")
-        })
-        .count();
-    assert_eq!(archive_count, 1);
-    let recovered = std::fs::read_to_string(&audit_path).expect("recovered chain reads");
-    verify_jsonl_lines_with_hasher(recovered.lines(), &profile.chain_hasher())
-        .expect("recovered chain verifies");
-    let envelope: Value = serde_json::from_str(recovered.trim()).expect("envelope parses");
-    assert_eq!(envelope["record"]["event"], "audit.chain.break");
-    assert_eq!(envelope["record"]["reason"], "unit recovery");
-    assert_eq!(envelope["record"]["operator"], "ci");
-
-    std::env::remove_var(SECRET_ENV);
-}
-
-#[test]
-fn audit_quarantine_refuses_to_run_while_server_lock_is_held() {
-    let _guard = ENV_LOCK.lock().expect("env lock");
-    std::env::set_var(SECRET_ENV, "0123456789abcdef0123456789abcdef");
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let audit_path = tmp.path().join("audit.jsonl");
-    let config_path = tmp.path().join("notary.yaml");
-    let mut config = notary_test_config();
-    config.audit.sink = "file".to_string();
-    config.audit.path = Some(path_for_json(&audit_path));
-    config.audit.hash_secret_env = Some(SECRET_ENV.to_string());
-    std::fs::write(
-        &config_path,
-        serde_norway::to_string(&config).expect("config serializes"),
-    )
-    .expect("config writes");
-    let _live_writer = JsonlFileSink::with_rotation_single_writer(&audit_path, 1024 * 1024, 2)
-        .expect("server writer lock is held");
-
-    let error = audit_quarantine(
-        &config_path,
-        AuditQuarantineArgs {
-            reason: "must stop server".to_string(),
-            operator: None,
-        },
-    )
-    .expect_err("online recovery is rejected");
-    assert!(
-        error
-            .to_string()
-            .contains("single-writer lock is already held"),
-        "unexpected error: {error}"
-    );
-
-    std::env::remove_var(SECRET_ENV);
-}
diff --git a/crates/registry-notary/src/commands/config_bundle.rs b/crates/registry-notary/src/commands/config_bundle.rs
deleted file mode 100644
index 37ba1f50f..000000000
--- a/crates/registry-notary/src/commands/config_bundle.rs
+++ /dev/null
@@ -1,165 +0,0 @@
-use crate::*;
-use registry_platform_ops::{ApplyReportResult, BundleVerificationCode, BundleVerificationFailure};
-
-pub(crate) async fn config_verify_bundle(
-    args: ConfigVerifyBundleArgs,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let verified = match verify_notary_product_bundle(&args.bundle_dir, &args.anchor_path) {
-        Ok(verified) => verified,
-        Err(error) => {
-            let code = error
-                .downcast_ref::<BundleVerificationFailure>()
-                .map_or(BundleVerificationCode::REJECTED_VALIDATION, |failure| {
-                    failure.code()
-                });
-            return reject_config_verify_bundle(code);
-        }
-    };
-    let candidate =
-        match registry_platform_ops::VerifiedAcceptanceStateV1::from_verified_bundle(&verified) {
-            Ok(candidate) => candidate,
-            Err(_) => {
-                return reject_config_verify_bundle(BundleVerificationCode::REJECTED_BINDING);
-            }
-        };
-    if let Err(error) = registry_platform_ops::FileAntiRollbackStore::new(&args.state_path)
-        .verify_state(candidate.expectation())
-    {
-        let code = ConfigBootError::Store(error).bundle_rejection_code();
-        return reject_config_verify_bundle(code);
-    }
-    let config_text = match std::str::from_utf8(&verified.config_bytes) {
-        Ok(config_text) => config_text,
-        Err(_) => {
-            return reject_config_verify_bundle(BundleVerificationCode::REJECTED_VALIDATION);
-        }
-    };
-    let parsed = match parse_config_document(config_text).and_then(|parsed| {
-        validate_signed_bundle_config_document(&parsed)?;
-        Ok(parsed)
-    }) {
-        Ok(parsed) => parsed,
-        Err(_) => {
-            return reject_config_verify_bundle(BundleVerificationCode::REJECTED_VALIDATION);
-        }
-    };
-    if compile_notary_runtime_with_provenance(parsed.config, ConfigSource::SignedBundleFile, None)
-        .is_err()
-    {
-        return reject_config_verify_bundle(BundleVerificationCode::REJECTED_VALIDATION);
-    }
-    print_config_verify_bundle_report(config_verify_bundle_report(
-        ApplyReportResult::Verified,
-        &verified.manifest.acceptance_identity.stream,
-        Some(verified.manifest.bundle_id),
-        Some(verified.manifest.sequence),
-        verified.manifest.previous_config_hash,
-        Some(verified.manifest.config_hash),
-        None,
-    ))?;
-    Ok(())
-}
-
-fn reject_config_verify_bundle(
-    code: BundleVerificationCode,
-) -> Result<(), Box<dyn std::error::Error>> {
-    print_config_verify_bundle_report(config_verify_bundle_report(
-        ApplyReportResult::from(code),
-        "unknown",
-        None,
-        None,
-        None,
-        None,
-        Some(code),
-    ))?;
-    Err(Box::new(BundleVerificationFailure::from(code)))
-}
-
-pub(crate) fn print_config_verify_bundle_report(
-    report: Value,
-) -> Result<(), Box<dyn std::error::Error>> {
-    println!("{}", serde_json::to_string_pretty(&report)?);
-    Ok(())
-}
-
-pub(crate) fn config_verify_bundle_report(
-    result: ApplyReportResult,
-    stream_id: &str,
-    bundle_id: Option<String>,
-    bundle_sequence: Option<u64>,
-    previous_config_hash: Option<String>,
-    config_hash: Option<String>,
-    error: Option<BundleVerificationCode>,
-) -> Value {
-    let rejected = error.is_some();
-    let stream_id = if rejected { "unknown" } else { stream_id };
-    let bundle_id = if rejected { None } else { bundle_id };
-    let bundle_sequence = if rejected { None } else { bundle_sequence };
-    let previous_config_hash = if rejected { None } else { previous_config_hash };
-    let config_hash = if rejected { None } else { config_hash };
-    let errors = error
-        .map(|code| {
-            let definition = code.definition();
-            vec![json!({
-                "code": code.as_str(),
-                "message": definition.safe_report_message,
-            })]
-        })
-        .unwrap_or_default();
-    json!({
-        "schema": "registry.platform.config_apply_report.v1",
-        "attempt_id": Ulid::new().to_string(),
-        "component": "registry-notary",
-        "stream_id": stream_id,
-        "source": ConfigSource::SignedBundleFile.as_posture_str(),
-        "bundle_id": bundle_id,
-        "bundle_sequence": bundle_sequence,
-        "previous_config_hash": previous_config_hash,
-        "config_hash": config_hash,
-        "result": result.as_str(),
-        "restart_required": false,
-        "change_classes": [],
-        "affected_components": [],
-        "warnings": [],
-        "errors": errors,
-    })
-}
-
-pub(crate) fn path_for_json(path: &Path) -> String {
-    path.to_string_lossy().into_owned()
-}
-
-pub(crate) fn required_config_path(
-    path: Option<&Path>,
-) -> Result<&Path, Box<dyn std::error::Error>> {
-    path.ok_or_else(|| "--config is required for this command".into())
-}
-
-pub(crate) fn compiled_build_features() -> Vec<&'static str> {
-    let mut features = Vec::new();
-    if cfg!(feature = "pkcs11") {
-        features.push("pkcs11");
-    }
-    if cfg!(feature = "registry-notary-cel") {
-        features.push("registry-notary-cel");
-    }
-    features
-}
-
-pub(crate) fn build_info() -> Value {
-    json!({
-        "package": env!("CARGO_PKG_NAME"),
-        "version": env!("CARGO_PKG_VERSION"),
-        "build_features": compiled_build_features(),
-        "capabilities": {
-            "signing_providers": {
-                "local_jwk_env": true,
-                "pkcs11": cfg!(feature = "pkcs11"),
-            },
-            "cel": cfg!(feature = "registry-notary-cel"),
-        },
-    })
-}
-#[cfg(test)]
-#[path = "config_bundle/tests.rs"]
-mod tests;
diff --git a/crates/registry-notary/src/commands/config_bundle/tests.rs b/crates/registry-notary/src/commands/config_bundle/tests.rs
deleted file mode 100644
index e078da994..000000000
--- a/crates/registry-notary/src/commands/config_bundle/tests.rs
+++ /dev/null
@@ -1,65 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-
-#[test]
-fn config_verify_bundle_cli_accepts_bundle_flags() {
-    let args = Args::try_parse_from([
-        "registry-notary",
-        "config",
-        "verify-bundle",
-        "--bundle-dir",
-        "/etc/registry-notary/bundle",
-        "--anchor-path",
-        "/etc/registry-notary/trust_anchor.json",
-        "--state-path",
-        "/var/lib/registry-notary/config-state/antirollback.json",
-    ])
-    .expect("args parse");
-
-    let Some(Command::Config {
-        command: ConfigCommand::VerifyBundle(command),
-    }) = args.command
-    else {
-        panic!("expected config verify-bundle command");
-    };
-    assert_eq!(
-        command.bundle_dir,
-        PathBuf::from("/etc/registry-notary/bundle")
-    );
-    assert_eq!(
-        command.anchor_path,
-        PathBuf::from("/etc/registry-notary/trust_anchor.json")
-    );
-    assert_eq!(
-        command.state_path,
-        PathBuf::from("/var/lib/registry-notary/config-state/antirollback.json")
-    );
-}
-
-#[test]
-fn config_verify_bundle_cli_requires_state_path() {
-    let err = Args::try_parse_from([
-        "registry-notary",
-        "config",
-        "verify-bundle",
-        "--bundle-dir",
-        "/etc/registry-notary/bundle",
-        "--anchor-path",
-        "/etc/registry-notary/trust_anchor.json",
-    ])
-    .expect_err("missing state-path is rejected");
-
-    assert!(err.to_string().contains("--state-path"));
-}
-
-#[test]
-fn config_apply_bundle_cli_is_removed() {
-    let err = Args::try_parse_from(["registry-notary", "config", "apply-bundle"])
-        .expect_err("apply-bundle is no longer a supported config subcommand");
-
-    assert!(
-        err.to_string().contains("unrecognized subcommand"),
-        "unexpected error: {err}"
-    );
-}
diff --git a/crates/registry-notary/src/commands/healthcheck.rs b/crates/registry-notary/src/commands/healthcheck.rs
deleted file mode 100644
index 9199ecc13..000000000
--- a/crates/registry-notary/src/commands/healthcheck.rs
+++ /dev/null
@@ -1,22 +0,0 @@
-use crate::*;
-
-pub(crate) async fn run_healthcheck(
-    url: &str,
-    timeout: Duration,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let response = reqwest::Client::builder()
-        .timeout(timeout)
-        .build()?
-        .get(url)
-        .send()
-        .await?;
-    if response.status().is_success() {
-        Ok(())
-    } else {
-        Err(format!("health endpoint returned HTTP {}", response.status()).into())
-    }
-}
-
-#[cfg(test)]
-#[path = "healthcheck/tests.rs"]
-mod tests;
diff --git a/crates/registry-notary/src/commands/healthcheck/tests.rs b/crates/registry-notary/src/commands/healthcheck/tests.rs
deleted file mode 100644
index 9b51043b6..000000000
--- a/crates/registry-notary/src/commands/healthcheck/tests.rs
+++ /dev/null
@@ -1,95 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-use crate::test_support::*;
-
-#[test]
-fn healthcheck_cli_defaults_to_container_health_endpoint() {
-    let args = Args::try_parse_from(["registry-notary", "healthcheck"]).expect("args parse");
-    let Some(Command::Healthcheck { url, timeout_ms }) = args.command else {
-        panic!("expected healthcheck command");
-    };
-
-    assert_eq!(url, "http://127.0.0.1:8080/healthz");
-    assert_eq!(timeout_ms, 5000);
-}
-
-#[test]
-fn healthcheck_cli_accepts_url_and_timeout_overrides() {
-    let args = Args::try_parse_from([
-        "registry-notary",
-        "healthcheck",
-        "--url",
-        "http://127.0.0.1:9000/ready",
-        "--timeout-ms",
-        "250",
-    ])
-    .expect("args parse");
-    let Some(Command::Healthcheck { url, timeout_ms }) = args.command else {
-        panic!("expected healthcheck command");
-    };
-
-    assert_eq!(url, "http://127.0.0.1:9000/ready");
-    assert_eq!(timeout_ms, 250);
-}
-
-#[test]
-fn healthcheck_cli_rejects_zero_timeout() {
-    let err = Args::try_parse_from(["registry-notary", "healthcheck", "--timeout-ms", "0"])
-        .expect_err("zero timeout is rejected");
-
-    assert!(err.to_string().contains("invalid value"));
-}
-
-#[test]
-fn build_info_cli_parses() {
-    let args = Args::try_parse_from(["registry-notary", "build-info"]).expect("args parse");
-    assert!(matches!(args.command, Some(Command::BuildInfo)));
-}
-
-#[test]
-fn build_info_reports_compiled_pkcs11_capability() {
-    let info = build_info();
-    assert_eq!(info["package"], "registry-notary");
-    assert_eq!(
-        info["capabilities"]["signing_providers"]["pkcs11"],
-        json!(cfg!(feature = "pkcs11"))
-    );
-    let features = info["build_features"]
-        .as_array()
-        .expect("build_features is an array");
-    assert_eq!(
-        features.iter().any(|feature| feature == "pkcs11"),
-        cfg!(feature = "pkcs11")
-    );
-}
-
-#[tokio::test]
-async fn healthcheck_succeeds_for_success_status() {
-    let upstream = TestServer::builder()
-        .http_transport()
-        .build(Router::new().route("/healthz", get(|| async { StatusCode::OK })));
-    let base_url = upstream.server_address().expect("upstream address");
-    let url = format!("{}/healthz", base_url.as_str().trim_end_matches('/'));
-
-    run_healthcheck(&url, Duration::from_secs(1))
-        .await
-        .expect("healthcheck succeeds");
-}
-
-#[tokio::test]
-async fn healthcheck_fails_for_non_success_status() {
-    let upstream = TestServer::builder()
-        .http_transport()
-        .build(Router::new().route(
-            "/healthz",
-            get(|| async { StatusCode::SERVICE_UNAVAILABLE }),
-        ));
-    let base_url = upstream.server_address().expect("upstream address");
-    let url = format!("{}/healthz", base_url.as_str().trim_end_matches('/'));
-
-    let err = run_healthcheck(&url, Duration::from_secs(1))
-        .await
-        .expect_err("healthcheck fails");
-    assert!(err.to_string().contains("HTTP 503"));
-}
diff --git a/crates/registry-notary/src/commands/mod.rs b/crates/registry-notary/src/commands/mod.rs
deleted file mode 100644
index d23617b75..000000000
--- a/crates/registry-notary/src/commands/mod.rs
+++ /dev/null
@@ -1,11 +0,0 @@
-mod api_key;
-mod audit;
-mod config_bundle;
-mod healthcheck;
-mod state;
-
-pub(crate) use api_key::*;
-pub(crate) use audit::*;
-pub(crate) use config_bundle::*;
-pub(crate) use healthcheck::*;
-pub(crate) use state::*;
diff --git a/crates/registry-notary/src/commands/state.rs b/crates/registry-notary/src/commands/state.rs
deleted file mode 100644
index 92f85ef37..000000000
--- a/crates/registry-notary/src/commands/state.rs
+++ /dev/null
@@ -1,94 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Explicit PostgreSQL correctness-state installation and attestation.
-
-use crate::*;
-
-pub(crate) async fn state_install(
-    config_path: &Path,
-    args: StateInstallArgs,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let loaded = load_server_config(config_path, false)?;
-    prepare_postgres_state_store(&loaded.config.state, args).await
-}
-
-pub(crate) async fn prepare_postgres_state_store(
-    state: &registry_notary_core::StateConfig,
-    args: StateInstallArgs,
-) -> Result<(), Box<dyn std::error::Error>> {
-    if state.storage != STATE_STORAGE_POSTGRESQL {
-        return Err("state install requires state.storage = postgresql".into());
-    }
-    let state_config =
-        registry_notary_server::state_plane::PostgresStatePlaneConfig::try_from(&state.postgresql)?;
-    let owner_role =
-        registry_notary_server::state_plane::OwnerDatabaseRole::parse(args.owner_role)?;
-    let runtime_role =
-        registry_notary_server::state_plane::RuntimeDatabaseRole::parse(args.runtime_role)?;
-    let mut connection =
-        registry_notary_server::state_plane::NotaryPostgresOperatorConnection::connect(
-            &state_config,
-            &args.migration_url_env,
-        )
-        .await?;
-    let attestation = registry_notary_server::state_plane::install_postgres_state_plane_v1(
-        connection.client_mut(),
-        &owner_role,
-        &runtime_role,
-    )
-    .await?;
-    println!("{}", state_install_completion(attestation));
-    Ok(())
-}
-
-pub(crate) async fn state_doctor(config_path: &Path) -> Result<(), Box<dyn std::error::Error>> {
-    let loaded = load_server_config(config_path, false).map_err(|_| {
-        state_doctor_error(
-            registry_notary_server::state_plane::NotaryPostgresStatePlaneReadiness::ConfigurationInvalid,
-        )
-    })?;
-    if loaded.config.state.storage != STATE_STORAGE_POSTGRESQL {
-        return Err(state_doctor_error(
-            registry_notary_server::state_plane::NotaryPostgresStatePlaneReadiness::ConfigurationInvalid,
-        ));
-    }
-    let preauthorization_enabled =
-        loaded.config.oid4vci.enabled && loaded.config.oid4vci.pre_authorized_code.enabled;
-    let attestation = registry_notary_server::state_plane::attest_postgres_state_plane_runtime(
-        &loaded.config.state,
-        preauthorization_enabled,
-    )
-    .await
-    .map_err(state_doctor_error)?;
-    println!("{}", state_doctor_completion(attestation));
-    Ok(())
-}
-
-fn state_install_completion(
-    attestation: registry_notary_server::state_plane::PostgresStatePlaneAttestation,
-) -> String {
-    format!(
-        "registry-notary PostgreSQL state installation or attestation complete: schema_version={} postgres_major={}",
-        attestation.schema_version, attestation.server_major
-    )
-}
-
-fn state_doctor_completion(
-    attestation: registry_notary_server::state_plane::PostgresStatePlaneAttestation,
-) -> String {
-    format!(
-        "registry-notary PostgreSQL state ready: schema_version={} postgres_major={}",
-        attestation.schema_version, attestation.server_major
-    )
-}
-
-fn state_doctor_error(
-    readiness: registry_notary_server::state_plane::NotaryPostgresStatePlaneReadiness,
-) -> Box<dyn std::error::Error> {
-    Box::new(registry_notary_server::NotaryActivationFailure::from(
-        readiness.activation_code(),
-    ))
-}
-
-#[cfg(test)]
-#[path = "state/tests.rs"]
-mod tests;
diff --git a/crates/registry-notary/src/commands/state/tests.rs b/crates/registry-notary/src/commands/state/tests.rs
deleted file mode 100644
index 96e1ad653..000000000
--- a/crates/registry-notary/src/commands/state/tests.rs
+++ /dev/null
@@ -1,115 +0,0 @@
-use super::*;
-
-#[test]
-fn state_install_cli_requires_explicit_roles_and_migration_url_env() {
-    let args = Args::try_parse_from([
-        "registry-notary",
-        "--config",
-        "notary.yaml",
-        "state",
-        "install",
-        "--migration-url-env",
-        "REGISTRY_NOTARY_POSTGRES_MIGRATOR_URL",
-        "--owner-role",
-        "registry_notary_owner",
-        "--runtime-role",
-        "registry_notary_runtime",
-    ])
-    .expect("state install arguments parse");
-    let Some(Command::State {
-        command: StateCommand::Install(install),
-    }) = args.command
-    else {
-        panic!("expected state install command");
-    };
-    assert_eq!(
-        install.migration_url_env,
-        "REGISTRY_NOTARY_POSTGRES_MIGRATOR_URL"
-    );
-    assert_eq!(install.owner_role, "registry_notary_owner");
-    assert_eq!(install.runtime_role, "registry_notary_runtime");
-}
-
-#[test]
-fn state_doctor_cli_parses() {
-    let args = Args::try_parse_from([
-        "registry-notary",
-        "--config",
-        "notary.yaml",
-        "state",
-        "doctor",
-    ])
-    .expect("state doctor arguments parse");
-    assert!(matches!(
-        args.command,
-        Some(Command::State {
-            command: StateCommand::Doctor
-        })
-    ));
-}
-
-#[test]
-fn state_command_output_reports_attested_versions_without_claiming_every_install_mutates() {
-    let attestation = registry_notary_server::state_plane::PostgresStatePlaneAttestation {
-        server_major: 18,
-        schema_version: 1,
-    };
-    assert_eq!(
-        state_install_completion(attestation),
-        "registry-notary PostgreSQL state installation or attestation complete: schema_version=1 postgres_major=18"
-    );
-    assert_eq!(
-        state_doctor_completion(attestation),
-        "registry-notary PostgreSQL state ready: schema_version=1 postgres_major=18"
-    );
-}
-
-#[test]
-fn state_doctor_failures_use_cause_specific_value_free_operator_diagnostics() {
-    use registry_notary_server::state_plane::NotaryPostgresStatePlaneReadiness as Readiness;
-
-    let cases = [
-        (
-            Readiness::ConfigurationInvalid,
-            NotaryActivationCode::CONFIGURATION_INVALID,
-        ),
-        (
-            Readiness::DatabaseUnavailable,
-            NotaryActivationCode::POSTGRESQL_DATABASE_UNAVAILABLE,
-        ),
-        (
-            Readiness::UnsupportedServerMajor,
-            NotaryActivationCode::POSTGRESQL_DATABASE_UNSUPPORTED,
-        ),
-        (
-            Readiness::DatabaseNotWritable,
-            NotaryActivationCode::POSTGRESQL_DATABASE_READ_ONLY,
-        ),
-        (
-            Readiness::UnsafeDurability,
-            NotaryActivationCode::POSTGRESQL_DURABILITY_UNSAFE,
-        ),
-        (
-            Readiness::SchemaIncompatible,
-            NotaryActivationCode::POSTGRESQL_SCHEMA_INCOMPATIBLE,
-        ),
-        (
-            Readiness::RoleIncompatible,
-            NotaryActivationCode::POSTGRESQL_ROLE_INCOMPATIBLE,
-        ),
-        (
-            Readiness::Shutdown,
-            NotaryActivationCode::POSTGRESQL_DATABASE_UNAVAILABLE,
-        ),
-    ];
-    for (readiness, code) in cases {
-        let definition = code.definition();
-        assert_eq!(
-            state_doctor_error(readiness).to_string(),
-            format!(
-                "{}: {}; next action: {}",
-                code, definition.meaning, definition.remediation
-            )
-        );
-    }
-}
diff --git a/crates/registry-notary/src/config_loader.rs b/crates/registry-notary/src/config_loader.rs
deleted file mode 100644
index fcd55fff6..000000000
--- a/crates/registry-notary/src/config_loader.rs
+++ /dev/null
@@ -1,644 +0,0 @@
-use crate::*;
-
-use registry_notary_server::{NotaryActivationCode, NotaryActivationFailure};
-
-#[derive(Clone, PartialEq, Eq)]
-pub(crate) enum ServerConfigInput {
-    LocalFile(PathBuf),
-    SignedBundle {
-        bundle_dir: PathBuf,
-        anchor_path: PathBuf,
-        state_path: PathBuf,
-    },
-}
-
-impl fmt::Debug for ServerConfigInput {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::LocalFile(_) => formatter.write_str("ServerConfigInput::LocalFile(<redacted>)"),
-            Self::SignedBundle { .. } => {
-                formatter.write_str("ServerConfigInput::SignedBundle(<redacted>)")
-            }
-        }
-    }
-}
-
-impl From<&Path> for ServerConfigInput {
-    fn from(config_path: &Path) -> Self {
-        Self::LocalFile(config_path.to_path_buf())
-    }
-}
-
-impl From<&PathBuf> for ServerConfigInput {
-    fn from(config_path: &PathBuf) -> Self {
-        Self::from(config_path.as_path())
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct LoadedServerConfig {
-    pub(crate) config: StandaloneRegistryNotaryConfig,
-    pub(crate) config_source: ConfigSource,
-    pub(crate) config_provenance: Option<ConfigProvenance>,
-    pub(crate) pending_bundle_acceptance: Option<PendingBundleAcceptance>,
-    pub(crate) verified_acceptance_state: Option<registry_platform_ops::VerifiedAcceptanceStateV1>,
-}
-
-#[derive(Debug)]
-pub(crate) struct ParsedConfigDocument {
-    pub(crate) config: StandaloneRegistryNotaryConfig,
-    pub(crate) value: Value,
-    pub(crate) admin_listener_present: bool,
-}
-
-pub(crate) fn parse_expanded_config(
-    raw: &str,
-) -> Result<StandaloneRegistryNotaryConfig, Box<dyn std::error::Error>> {
-    let parsed = parse_config_document(raw)?;
-    validate_config_document(&parsed)?;
-    Ok(parsed.config)
-}
-
-pub(crate) fn parse_config_document(
-    raw: &str,
-) -> Result<ParsedConfigDocument, Box<dyn std::error::Error>> {
-    let expanded = expand_config_env_vars(raw)?;
-    let parsed_value = parse_config_value(&expanded)?;
-    validate_admin_listener_shape(&parsed_value)?;
-    reject_deprecated_config_fields(&parsed_value, &deprecated_config_fields())?;
-    let admin_listener_present = server_admin_listener_block_present(&parsed_value);
-    let config: StandaloneRegistryNotaryConfig = serde_norway::from_str(&expanded)?;
-    Ok(ParsedConfigDocument {
-        config,
-        value: parsed_value,
-        admin_listener_present,
-    })
-}
-
-pub(crate) fn validate_config_document(
-    parsed: &ParsedConfigDocument,
-) -> Result<(), Box<dyn std::error::Error>> {
-    validate_config_document_with_mode(parsed, false)
-}
-
-pub(crate) fn validate_signed_bundle_config_document(
-    parsed: &ParsedConfigDocument,
-) -> Result<(), Box<dyn std::error::Error>> {
-    validate_config_document_with_mode(parsed, true)
-}
-
-pub(crate) fn validate_config_document_with_mode(
-    parsed: &ParsedConfigDocument,
-    governed_runtime: bool,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let config = &parsed.config;
-    if governed_runtime {
-        config.validate_governed_runtime()?;
-    } else {
-        config.validate()?;
-    }
-    if admin_listener_default_warning_needed(config, parsed.admin_listener_present) {
-        tracing::warn!(
-            restore_key = "server.admin_listener.mode",
-            "server.admin_listener is absent; admin listener defaults to disabled; set server.admin_listener.mode to shared_with_public or dedicated to enable the admin surface"
-        );
-    }
-    Ok(())
-}
-
-pub(crate) fn load_server_config(
-    config_path: &Path,
-    initialize_state: bool,
-) -> Result<LoadedServerConfig, Box<dyn std::error::Error>> {
-    let raw = fs::read_to_string(config_path).map_err(|_| {
-        log_safe_configuration_rejection(
-            NotaryActivationCode::CONFIGURATION_INVALID.as_str(),
-            "rejected_validation",
-            None,
-        );
-        configuration_failure()
-    })?;
-    let bootstrap = parse_config_document(&raw).map_err(|_| {
-        log_safe_configuration_rejection(
-            NotaryActivationCode::CONFIGURATION_INVALID.as_str(),
-            "rejected_validation",
-            None,
-        );
-        configuration_failure()
-    })?;
-    let Some(config_trust) = bootstrap.config.config_trust.as_ref() else {
-        validate_config_document(&bootstrap).map_err(|_| {
-            log_safe_configuration_rejection(
-                NotaryActivationCode::CONFIGURATION_INVALID.as_str(),
-                "rejected_validation",
-                None,
-            );
-            configuration_failure()
-        })?;
-        return Ok(LoadedServerConfig {
-            config: bootstrap.config,
-            config_source: ConfigSource::LocalFile,
-            config_provenance: None,
-            pending_bundle_acceptance: None,
-            verified_acceptance_state: None,
-        });
-    };
-
-    let verified =
-        match verify_config_bundle(&config_trust.bundle_path, &config_trust.trust_anchor_path) {
-            Ok(verified) => verified,
-            Err(error) => {
-                if let Some(loaded) = load_unsigned_break_glass_or_pin_server_config(
-                    config_trust,
-                    config_trust.break_glass_override_path.as_deref(),
-                )? {
-                    return Ok(loaded);
-                }
-                let code = log_bundle_verification_error(&error);
-                return Err(bundle_verification_failure(code));
-            }
-        };
-    // A bundle and anchor can be internally consistent while belonging to a
-    // different product. Bind the verified manifest to this binary before the
-    // legacy loader may consider any local recovery selection.
-    ensure_notary_acceptance_identity(&verified)?;
-    match load_verified_bundle_server_config(config_trust, initialize_state, verified) {
-        Ok(loaded) => Ok(loaded),
-        Err(error) => {
-            if let Some(loaded) = load_unsigned_break_glass_or_pin_server_config(
-                config_trust,
-                config_trust.break_glass_override_path.as_deref(),
-            )? {
-                return Ok(loaded);
-            }
-            Err(error)
-        }
-    }
-}
-
-pub(crate) fn load_server_config_input(
-    input: &ServerConfigInput,
-    initialize_state: bool,
-) -> Result<LoadedServerConfig, Box<dyn std::error::Error>> {
-    match input {
-        ServerConfigInput::LocalFile(config_path) => {
-            load_server_config(config_path, initialize_state)
-        }
-        ServerConfigInput::SignedBundle {
-            bundle_dir,
-            anchor_path,
-            state_path,
-        } => load_direct_signed_bundle_server_config(
-            bundle_dir,
-            anchor_path,
-            state_path,
-            initialize_state,
-        ),
-    }
-}
-
-pub(crate) fn load_direct_signed_bundle_server_config(
-    bundle_dir: &Path,
-    anchor_path: &Path,
-    state_path: &Path,
-    initialize_state: bool,
-) -> Result<LoadedServerConfig, Box<dyn std::error::Error>> {
-    // These operator-selected paths are the complete trust input for direct
-    // startup. Do not consult config_trust from another file or fall back to an
-    // unsigned selection when verification or anti-rollback checks fail.
-    let verified = verify_notary_product_bundle(bundle_dir, anchor_path)?;
-    load_verified_bundle_server_config_with_state(
-        state_path,
-        None,
-        initialize_state,
-        verified,
-        ProductTrustDomainV1::Governed,
-    )
-}
-
-pub(crate) fn verify_notary_product_bundle(
-    bundle_dir: &Path,
-    anchor_path: &Path,
-) -> Result<VerifiedConfigBundle, Box<dyn std::error::Error>> {
-    verify_notary_product_bundle_for_domain(bundle_dir, anchor_path, ProductTrustDomainV1::Governed)
-}
-
-pub(crate) fn verify_notary_product_bundle_for_domain(
-    bundle_dir: &Path,
-    anchor_path: &Path,
-    trust_domain: ProductTrustDomainV1,
-) -> Result<VerifiedConfigBundle, Box<dyn std::error::Error>> {
-    let verified = verify_config_bundle(bundle_dir, anchor_path).map_err(|error| {
-        let code = log_bundle_verification_error(&error);
-        bundle_verification_failure(code)
-    })?;
-    ensure_notary_acceptance_identity_for_domain(&verified, trust_domain)?;
-    Ok(verified)
-}
-
-pub(crate) fn load_verified_notary_config_read_only_for_domain(
-    verified: &VerifiedConfigBundle,
-    trust_domain: ProductTrustDomainV1,
-) -> Result<StandaloneRegistryNotaryConfig, Box<dyn std::error::Error>> {
-    ensure_notary_acceptance_identity_for_domain(verified, trust_domain)?;
-    let config_text = std::str::from_utf8(&verified.config_bytes).map_err(|_| {
-        log_safe_bundle_rejection(
-            "config.bundle_rejected",
-            BundleVerificationCode::REJECTED_VALIDATION,
-            None,
-        );
-        bundle_verification_failure(BundleVerificationCode::REJECTED_VALIDATION)
-    })?;
-    let parsed = parse_config_document(config_text).map_err(|_| {
-        log_safe_bundle_rejection(
-            "config.bundle_rejected",
-            BundleVerificationCode::REJECTED_VALIDATION,
-            None,
-        );
-        bundle_verification_failure(BundleVerificationCode::REJECTED_VALIDATION)
-    })?;
-    validate_signed_bundle_config_document(&parsed).map_err(|_| {
-        log_safe_bundle_rejection(
-            "config.bundle_rejected",
-            BundleVerificationCode::REJECTED_VALIDATION,
-            None,
-        );
-        bundle_verification_failure(BundleVerificationCode::REJECTED_VALIDATION)
-    })?;
-    Ok(parsed.config)
-}
-
-pub(crate) fn load_verified_bundle_server_config(
-    config_trust: &ConfigTrustConfig,
-    initialize_state: bool,
-    verified: VerifiedConfigBundle,
-) -> Result<LoadedServerConfig, Box<dyn std::error::Error>> {
-    load_verified_bundle_server_config_with_state(
-        &config_trust.antirollback_state_path,
-        config_trust.break_glass_override_path.as_deref(),
-        initialize_state,
-        verified,
-        ProductTrustDomainV1::Governed,
-    )
-}
-
-fn load_verified_bundle_server_config_with_state(
-    state_path: &Path,
-    rollback_override_path: Option<&Path>,
-    initialize_state: bool,
-    verified: VerifiedConfigBundle,
-    trust_domain: ProductTrustDomainV1,
-) -> Result<LoadedServerConfig, Box<dyn std::error::Error>> {
-    ensure_notary_acceptance_identity_for_domain(&verified, trust_domain)?;
-    let verified_acceptance_state =
-        registry_platform_ops::VerifiedAcceptanceStateV1::from_verified_bundle(&verified)
-            .map_err(|error| map_config_boot_error(ConfigBootError::Store(error)))?;
-    let accepted_anchor =
-        registry_platform_ops::AcceptedAnchorPinV1::from_trust_anchor(&verified.trust_anchor)
-            .map_err(|error| map_config_boot_error(ConfigBootError::Bundle(error)))?;
-    let key = antirollback_key_from_verified_bundle(&verified);
-    let state_decision = resolve_bundle_state_action(BundleStateRequest {
-        state_path,
-        key: &key,
-        sequence: verified.manifest.sequence,
-        config_hash: &verified.manifest.config_hash,
-        bundle_manifest_hash: &verified.manifest_hash,
-        previous_config_hash: verified.manifest.previous_config_hash.as_deref(),
-        rollback_override_path,
-        initialize_state,
-    })
-    .map_err(map_config_boot_error)?;
-    let config_text = std::str::from_utf8(&verified.config_bytes).map_err(|_| {
-        log_safe_bundle_rejection(
-            "config.bundle_rejected",
-            BundleVerificationCode::REJECTED_VALIDATION,
-            None,
-        );
-        bundle_verification_failure(BundleVerificationCode::REJECTED_VALIDATION)
-    })?;
-    let parsed = parse_config_document(config_text).map_err(|_| {
-        log_safe_bundle_rejection(
-            "config.bundle_rejected",
-            BundleVerificationCode::REJECTED_VALIDATION,
-            None,
-        );
-        bundle_verification_failure(BundleVerificationCode::REJECTED_VALIDATION)
-    })?;
-    validate_signed_bundle_config_document(&parsed).map_err(|_| {
-        log_safe_bundle_rejection(
-            "config.bundle_rejected",
-            BundleVerificationCode::REJECTED_VALIDATION,
-            None,
-        );
-        bundle_verification_failure(BundleVerificationCode::REJECTED_VALIDATION)
-    })?;
-    let provenance = ConfigProvenance {
-        source: ConfigSource::SignedBundleFile,
-        internal_config_hash: verified.manifest.config_hash.clone(),
-        posture_config_hash: posture_safe_runtime_config_hash(&parsed.value),
-        dynamic_reload_supported: false,
-        last_bundle_id: Some(verified.manifest.bundle_id.clone()),
-        last_bundle_sequence: Some(verified.manifest.sequence),
-        last_bundle_signer_kids: verified.signer_kids.clone(),
-        override_pin: state_decision.override_pin.clone(),
-        last_apply_result: None,
-        last_apply_at: None,
-        restart_required: false,
-    };
-    Ok(LoadedServerConfig {
-        config: parsed.config,
-        config_source: ConfigSource::SignedBundleFile,
-        config_provenance: Some(provenance),
-        pending_bundle_acceptance: Some(PendingBundleAcceptance {
-            state_path: state_path.to_path_buf(),
-            key,
-            accepted_anchor,
-            source: ConfigSource::SignedBundleFile,
-            bundle_id: Some(verified.manifest.bundle_id),
-            bundle_manifest_hash: Some(verified.manifest_hash),
-            sequence: Some(verified.manifest.sequence),
-            config_hash: verified.manifest.config_hash,
-            previous_config_hash: verified.manifest.previous_config_hash,
-            previous_hash_matched: state_decision.previous_hash_matched,
-            signer_kids: verified.signer_kids,
-            break_glass: matches!(
-                state_decision.state_action,
-                BundleStateAction::PersistOverridePin
-            ),
-            state_action: state_decision.state_action,
-            override_pin: state_decision.override_pin,
-            override_path: state_decision.override_path,
-        }),
-        verified_acceptance_state: Some(verified_acceptance_state),
-    })
-}
-
-pub(crate) fn load_verified_product_server_config(
-    state_path: &Path,
-    verified: VerifiedConfigBundle,
-    trust_domain: ProductTrustDomainV1,
-) -> Result<LoadedServerConfig, Box<dyn std::error::Error>> {
-    load_verified_bundle_server_config_with_state(state_path, None, false, verified, trust_domain)
-}
-
-fn ensure_notary_acceptance_identity(
-    verified: &VerifiedConfigBundle,
-) -> Result<(), Box<dyn std::error::Error>> {
-    ensure_notary_acceptance_identity_for_domain(verified, ProductTrustDomainV1::Governed)
-}
-
-fn ensure_notary_acceptance_identity_for_domain(
-    verified: &VerifiedConfigBundle,
-    trust_domain: ProductTrustDomainV1,
-) -> Result<(), Box<dyn std::error::Error>> {
-    use registry_platform_config::{ProductAcceptanceLaneV1, ProductAcceptanceProductV1};
-
-    let identity = &verified.manifest.acceptance_identity;
-    if identity.trust_domain == trust_domain
-        && identity.lane == ProductAcceptanceLaneV1::Notary
-        && identity.product == ProductAcceptanceProductV1::RegistryNotary
-    {
-        return Ok(());
-    }
-    log_safe_bundle_rejection(
-        "config.bundle_rejected",
-        BundleVerificationCode::REJECTED_BINDING,
-        None,
-    );
-    Err(bundle_verification_failure(
-        BundleVerificationCode::REJECTED_BINDING,
-    ))
-}
-
-pub(crate) fn load_unsigned_break_glass_or_pin_server_config(
-    config_trust: &ConfigTrustConfig,
-    override_path: Option<&Path>,
-) -> Result<Option<LoadedServerConfig>, Box<dyn std::error::Error>> {
-    let Some(selection) = load_unsigned_break_glass_or_pin(
-        &config_trust.trust_anchor_path,
-        &config_trust.antirollback_state_path,
-        override_path,
-    )
-    .map_err(map_config_boot_error)?
-    else {
-        return Ok(None);
-    };
-    load_unsigned_pin_server_config(config_trust, selection).map(Some)
-}
-
-pub(crate) fn load_unsigned_pin_server_config(
-    config_trust: &ConfigTrustConfig,
-    selection: UnsignedConfigSelection,
-) -> Result<LoadedServerConfig, Box<dyn std::error::Error>> {
-    let config_text = std::str::from_utf8(&selection.config_bytes).map_err(|_| {
-        log_safe_bundle_rejection(
-            "config.bundle_rejected",
-            BundleVerificationCode::REJECTED_VALIDATION,
-            None,
-        );
-        bundle_verification_failure(BundleVerificationCode::REJECTED_VALIDATION)
-    })?;
-    let parsed = parse_config_document(config_text).map_err(|_| {
-        log_safe_bundle_rejection(
-            "config.bundle_rejected",
-            BundleVerificationCode::REJECTED_VALIDATION,
-            None,
-        );
-        bundle_verification_failure(BundleVerificationCode::REJECTED_VALIDATION)
-    })?;
-    validate_config_document(&parsed).map_err(|_| {
-        log_safe_bundle_rejection(
-            "config.bundle_rejected",
-            BundleVerificationCode::REJECTED_VALIDATION,
-            None,
-        );
-        bundle_verification_failure(BundleVerificationCode::REJECTED_VALIDATION)
-    })?;
-    let override_pin = Some(selection.pin.clone());
-    Ok(LoadedServerConfig {
-        config: parsed.config,
-        config_source: ConfigSource::LocalFile,
-        config_provenance: Some(ConfigProvenance {
-            source: ConfigSource::LocalFile,
-            internal_config_hash: selection.pin.config_hash.clone(),
-            posture_config_hash: posture_safe_runtime_config_hash(&parsed.value),
-            dynamic_reload_supported: false,
-            last_bundle_id: Some(selection.record.last_bundle_id),
-            last_bundle_sequence: Some(selection.record.last_sequence),
-            last_bundle_signer_kids: Vec::new(),
-            override_pin: override_pin.clone(),
-            last_apply_result: None,
-            last_apply_at: None,
-            restart_required: false,
-        }),
-        pending_bundle_acceptance: Some(PendingBundleAcceptance {
-            state_path: config_trust.antirollback_state_path.clone(),
-            key: selection.key,
-            accepted_anchor: selection.record.accepted_anchor,
-            source: ConfigSource::LocalFile,
-            bundle_id: None,
-            bundle_manifest_hash: None,
-            sequence: None,
-            config_hash: selection.pin.config_hash,
-            previous_config_hash: None,
-            previous_hash_matched: None,
-            signer_kids: Vec::new(),
-            break_glass: matches!(
-                selection.state_action,
-                BundleStateAction::PersistOverridePin
-            ),
-            state_action: selection.state_action,
-            override_pin,
-            override_path: selection.override_path,
-        }),
-        verified_acceptance_state: None,
-    })
-}
-
-pub(crate) fn log_bundle_verification_error(error: &ConfigBundleError) -> BundleVerificationCode {
-    let code = bundle_verify_rejection_code(error);
-    log_safe_bundle_rejection("config.bundle_rejected", code, None);
-    code
-}
-
-pub(crate) fn map_config_boot_error(error: ConfigBootError) -> Box<dyn std::error::Error> {
-    let code = error.bundle_rejection_code();
-    if let Some(reason) = error.break_glass_invalid_reason() {
-        log_safe_bundle_rejection("config.break_glass_invalid", code, Some(reason));
-    }
-    log_safe_bundle_rejection("config.bundle_rejected", code, None);
-    bundle_verification_failure(code)
-}
-
-fn configuration_failure() -> Box<dyn std::error::Error> {
-    Box::new(NotaryActivationFailure::from(
-        NotaryActivationCode::CONFIGURATION_INVALID,
-    ))
-}
-
-fn bundle_verification_failure(code: BundleVerificationCode) -> Box<dyn std::error::Error> {
-    Box::new(BundleVerificationFailure::from(code))
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-struct SafeStartupRejection {
-    classification_code: &'static str,
-    result: &'static str,
-    reason: &'static str,
-    activation_code: &'static str,
-    safe_meaning: &'static str,
-    safe_remediation: &'static str,
-}
-
-fn safe_configuration_rejection(
-    classification_code: &'static str,
-    result: &'static str,
-    reason: Option<&'static str>,
-) -> SafeStartupRejection {
-    let definition = NotaryActivationCode::CONFIGURATION_INVALID.definition();
-    SafeStartupRejection {
-        classification_code,
-        result,
-        reason: reason.unwrap_or("none"),
-        activation_code: definition.code.as_str(),
-        safe_meaning: definition.meaning,
-        safe_remediation: definition.remediation,
-    }
-}
-
-fn safe_bundle_rejection(
-    classification_code: &'static str,
-    code: BundleVerificationCode,
-    reason: Option<&'static str>,
-) -> SafeStartupRejection {
-    let definition = code.definition();
-    SafeStartupRejection {
-        classification_code,
-        result: code.as_str(),
-        reason: reason.unwrap_or("none"),
-        activation_code: NotaryActivationCode::CONFIGURATION_INVALID.as_str(),
-        safe_meaning: definition.safe_meaning,
-        safe_remediation: definition.safe_remediation,
-    }
-}
-
-fn log_safe_configuration_rejection(
-    classification_code: &'static str,
-    result: &'static str,
-    reason: Option<&'static str>,
-) {
-    log_safe_startup_rejection(safe_configuration_rejection(
-        classification_code,
-        result,
-        reason,
-    ));
-}
-
-fn log_safe_bundle_rejection(
-    classification_code: &'static str,
-    code: BundleVerificationCode,
-    reason: Option<&'static str>,
-) {
-    log_safe_startup_rejection(safe_bundle_rejection(classification_code, code, reason));
-}
-
-fn log_safe_startup_rejection(rejection: SafeStartupRejection) {
-    tracing::error!(
-        code = rejection.classification_code,
-        result = rejection.result,
-        reason = rejection.reason,
-        activation_code = rejection.activation_code,
-        safe_meaning = rejection.safe_meaning,
-        safe_remediation = rejection.safe_remediation,
-        "registry notary startup configuration rejected"
-    );
-}
-
-#[derive(Debug)]
-pub(crate) struct ConfigShapeError(String);
-
-impl fmt::Display for ConfigShapeError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str(&self.0)
-    }
-}
-
-impl std::error::Error for ConfigShapeError {}
-
-pub(crate) fn parse_config_value(raw: &str) -> Result<Value, serde_norway::Error> {
-    serde_norway::from_str(raw)
-}
-
-pub(crate) fn validate_admin_listener_shape(value: &Value) -> Result<(), ConfigShapeError> {
-    let Some(admin_listener) = value
-        .get("server")
-        .and_then(Value::as_object)
-        .and_then(|server| server.get("admin_listener"))
-    else {
-        return Ok(());
-    };
-    if admin_listener.is_object() {
-        return Ok(());
-    }
-    Err(ConfigShapeError(
-        "server.admin_listener must be a mapping with accepted mode values: disabled, dedicated, shared_with_public; use server.admin_listener.mode to restore the admin surface".to_string(),
-    ))
-}
-
-pub(crate) fn server_admin_listener_block_present(value: &Value) -> bool {
-    value
-        .get("server")
-        .and_then(Value::as_object)
-        .is_some_and(|server| server.contains_key("admin_listener"))
-}
-
-pub(crate) fn admin_listener_default_warning_needed(
-    config: &StandaloneRegistryNotaryConfig,
-    admin_listener_present: bool,
-) -> bool {
-    !admin_listener_present
-        && config.server.admin_listener.mode == RegistryNotaryAdminListenerMode::Disabled
-}
-#[cfg(test)]
-#[path = "config_loader/tests.rs"]
-mod tests;
diff --git a/crates/registry-notary/src/config_loader/tests.rs b/crates/registry-notary/src/config_loader/tests.rs
deleted file mode 100644
index 483533e75..000000000
--- a/crates/registry-notary/src/config_loader/tests.rs
+++ /dev/null
@@ -1,996 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-use crate::test_support::*;
-
-const PATH_SENTINEL: &str = "/private/SENTINEL_COUNTRY_CONFIG_PATH";
-const HASH_SENTINEL: &str =
-    "sha256:SENTINEL_EXPECTED_COUNTRY_DIGEST_11111111111111111111111111111111";
-const OTHER_HASH_SENTINEL: &str =
-    "sha256:SENTINEL_ACTUAL_COUNTRY_DIGEST_2222222222222222222222222222222222";
-const PARSER_SENTINEL: &str = "SENTINEL_PRIVATE_PARSER_TEXT";
-const SECRET_SENTINEL: &str = "SENTINEL_PRIVATE_SECRET";
-const COUNTRY_SENTINEL: &str = "SENTINEL_PRIVATE_COUNTRY_VALUE";
-
-fn rewrite_signed_bundle_product(fixture: &SignedBundleFixture, product: &str) {
-    let mut manifest: ConfigBundleManifest = serde_json::from_slice(
-        &std::fs::read(fixture.bundle_dir.join("manifest.json")).expect("manifest reads"),
-    )
-    .expect("manifest parses");
-    assert_eq!(product, "registry-relay");
-    manifest.acceptance_identity.product = ProductAcceptanceProductV1::RegistryRelay;
-    manifest.acceptance_identity.lane = ProductAcceptanceLaneV1::RelayConsultation;
-    let private = PrivateJwk::parse(CONFIG_BUNDLE_PRIVATE_JWK).expect("private JWK parses");
-    let kid = private.public().jkt().expect("signer thumbprint");
-    write_manifest_and_signature(&fixture.bundle_dir, &manifest, &private, &kid);
-
-    let mut anchor: ConfigTrustAnchor =
-        serde_json::from_slice(&std::fs::read(&fixture.anchor_path).expect("anchor reads"))
-            .expect("anchor parses");
-    anchor.acceptance_identity = manifest.acceptance_identity;
-    std::fs::write(
-        &fixture.anchor_path,
-        serde_json::to_vec_pretty(&anchor).expect("anchor serializes"),
-    )
-    .expect("anchor writes");
-}
-
-fn config_bundle_error_cases() -> Vec<(ConfigBundleError, BundleVerificationCode)> {
-    vec![
-        (
-            ConfigBundleError::Io(PATH_SENTINEL.to_string()),
-            BundleVerificationCode::REJECTED_VALIDATION,
-        ),
-        (
-            ConfigBundleError::Json(PARSER_SENTINEL.to_string()),
-            BundleVerificationCode::REJECTED_VALIDATION,
-        ),
-        (
-            ConfigBundleError::InvalidManifest(COUNTRY_SENTINEL),
-            BundleVerificationCode::REJECTED_VALIDATION,
-        ),
-        (
-            ConfigBundleError::InvalidAcceptanceIdentity(COUNTRY_SENTINEL),
-            BundleVerificationCode::REJECTED_BINDING,
-        ),
-        (
-            ConfigBundleError::InvalidTrustAnchor(SECRET_SENTINEL),
-            BundleVerificationCode::REJECTED_SIGNATURE,
-        ),
-        (
-            ConfigBundleError::InvalidPermissions(PATH_SENTINEL),
-            BundleVerificationCode::REJECTED_SIGNATURE,
-        ),
-        (
-            ConfigBundleError::InvalidBreakGlass(SECRET_SENTINEL),
-            BundleVerificationCode::REJECTED_VALIDATION,
-        ),
-        (
-            ConfigBundleError::InvalidSignatureEnvelope(SECRET_SENTINEL),
-            BundleVerificationCode::REJECTED_SIGNATURE,
-        ),
-        (
-            ConfigBundleError::InvalidAnchorTransition(SECRET_SENTINEL),
-            BundleVerificationCode::REJECTED_SIGNATURE,
-        ),
-        (
-            ConfigBundleError::AnchorTransitionRejected(SECRET_SENTINEL),
-            BundleVerificationCode::REJECTED_SIGNATURE,
-        ),
-        (
-            ConfigBundleError::BindingMismatch(COUNTRY_SENTINEL),
-            BundleVerificationCode::REJECTED_BINDING,
-        ),
-        (
-            ConfigBundleError::SignatureRejected,
-            BundleVerificationCode::REJECTED_SIGNATURE,
-        ),
-        (
-            ConfigBundleError::FileClosure(PATH_SENTINEL.to_string()),
-            BundleVerificationCode::REJECTED_SIGNATURE,
-        ),
-        (
-            ConfigBundleError::HashMismatch {
-                path: PATH_SENTINEL.to_string(),
-                expected: HASH_SENTINEL.to_string(),
-                actual: OTHER_HASH_SENTINEL.to_string(),
-            },
-            BundleVerificationCode::REJECTED_SIGNATURE,
-        ),
-    ]
-}
-
-fn config_boot_error_cases() -> Vec<(ConfigBootError, BundleVerificationCode)> {
-    vec![
-        (
-            ConfigBootError::Store(registry_platform_ops::AntiRollbackStoreError::InvalidState(
-                SECRET_SENTINEL.to_string(),
-            )),
-            BundleVerificationCode::REJECTED_ROLLBACK,
-        ),
-        (
-            ConfigBootError::Bundle(ConfigBundleError::BindingMismatch(COUNTRY_SENTINEL)),
-            BundleVerificationCode::REJECTED_BINDING,
-        ),
-        (
-            ConfigBootError::NonMonotonicSequence,
-            BundleVerificationCode::REJECTED_ROLLBACK,
-        ),
-        (
-            ConfigBootError::OverrideHashMismatch,
-            BundleVerificationCode::REJECTED_ROLLBACK,
-        ),
-        (
-            ConfigBootError::MissingUnsignedConfigPath,
-            BundleVerificationCode::REJECTED_ROLLBACK,
-        ),
-        (
-            ConfigBootError::UnsignedConfigHashMismatch {
-                expected: HASH_SENTINEL.to_string(),
-                actual: OTHER_HASH_SENTINEL.to_string(),
-            },
-            BundleVerificationCode::REJECTED_ROLLBACK,
-        ),
-        (
-            ConfigBootError::MissingSignedBundleId,
-            BundleVerificationCode::REJECTED_VALIDATION,
-        ),
-        (
-            ConfigBootError::MissingSignedBundleManifestHash,
-            BundleVerificationCode::REJECTED_VALIDATION,
-        ),
-        (
-            ConfigBootError::MissingSignedBundleSequence,
-            BundleVerificationCode::REJECTED_VALIDATION,
-        ),
-        (
-            ConfigBootError::MissingOverridePin,
-            BundleVerificationCode::REJECTED_VALIDATION,
-        ),
-        (
-            ConfigBootError::InvalidOverridePath,
-            BundleVerificationCode::REJECTED_VALIDATION,
-        ),
-    ]
-}
-
-#[test]
-fn config_env_expansion_replaces_required_and_default_values() {
-    let _guard = ENV_LOCK.lock().expect("env lock");
-    std::env::set_var("RN_CONFIG_EXPAND_REQUIRED", "https://upstream.example");
-    std::env::remove_var("RN_CONFIG_EXPAND_DEFAULT");
-
-    let expanded = expand_config_env_vars(
-            "base_url: ${RN_CONFIG_EXPAND_REQUIRED:?missing upstream}\noptional: ${RN_CONFIG_EXPAND_DEFAULT:-fallback}\n",
-        )
-        .expect("config expands");
-
-    assert!(expanded.contains("base_url: \"https://upstream.example\""));
-    assert!(expanded.contains("optional: \"fallback\""));
-    std::env::remove_var("RN_CONFIG_EXPAND_REQUIRED");
-}
-
-#[test]
-fn config_env_expansion_rejects_missing_required_values() {
-    let _guard = ENV_LOCK.lock().expect("env lock");
-    std::env::remove_var("RN_CONFIG_EXPAND_MISSING");
-
-    let err = expand_config_env_vars("${RN_CONFIG_EXPAND_MISSING:?missing configured URL}")
-        .expect_err("missing env var fails");
-
-    assert!(err.to_string().contains("missing configured URL"));
-}
-
-#[test]
-fn config_env_expansion_rejects_invalid_variable_names() {
-    let err =
-        expand_config_env_vars("${NOT-A-VALID-NAME:-fallback}").expect_err("invalid var fails");
-
-    assert!(err.to_string().contains("invalid env var name"));
-}
-
-#[test]
-fn bundle_startup_rejections_use_every_exact_static_catalog_definition() {
-    for code in BundleVerificationCode::ALL {
-        let definition = code.definition();
-        let rejection = safe_bundle_rejection("config.bundle_rejected", *code, None);
-
-        assert_eq!(rejection.classification_code, "config.bundle_rejected");
-        assert_eq!(rejection.result, code.as_str());
-        assert_eq!(rejection.reason, "none");
-        assert_eq!(
-            rejection.activation_code,
-            NotaryActivationCode::CONFIGURATION_INVALID.as_str()
-        );
-        assert_eq!(rejection.safe_meaning, definition.safe_meaning);
-        assert_eq!(rejection.safe_remediation, definition.safe_remediation);
-    }
-}
-
-#[test]
-fn typed_bundle_failures_map_to_exact_value_free_startup_definitions() {
-    let forbidden = [
-        PATH_SENTINEL,
-        HASH_SENTINEL,
-        OTHER_HASH_SENTINEL,
-        PARSER_SENTINEL,
-        SECRET_SENTINEL,
-        COUNTRY_SENTINEL,
-    ];
-
-    for (error, expected) in config_bundle_error_cases() {
-        let code = bundle_verify_rejection_code(&error);
-        assert_eq!(code, expected);
-        let rejection = safe_bundle_rejection("config.bundle_rejected", code, None);
-        assert_eq!(rejection.result, expected.as_str());
-        assert_eq!(rejection.safe_meaning, expected.definition().safe_meaning);
-        assert_eq!(
-            rejection.safe_remediation,
-            expected.definition().safe_remediation
-        );
-        let rendered = format!("{rejection:?}");
-        for sentinel in forbidden {
-            assert!(
-                !rendered.contains(sentinel),
-                "safe startup rejection exposed {sentinel:?}: {rendered}"
-            );
-        }
-    }
-}
-
-#[test]
-fn typed_boot_failures_preserve_binding_rollback_and_validation_definitions() {
-    for (error, expected) in config_boot_error_cases() {
-        let code = error.bundle_rejection_code();
-        assert_eq!(code, expected);
-        let rejection = safe_bundle_rejection("config.bundle_rejected", code, None);
-        assert_eq!(rejection.result, expected.as_str());
-        assert_eq!(rejection.safe_meaning, expected.definition().safe_meaning);
-        assert_eq!(
-            rejection.safe_remediation,
-            expected.definition().safe_remediation
-        );
-    }
-}
-
-#[test]
-fn local_configuration_rejection_uses_notary_configuration_definition() {
-    let definition = NotaryActivationCode::CONFIGURATION_INVALID.definition();
-    let rejection = safe_configuration_rejection(
-        NotaryActivationCode::CONFIGURATION_INVALID.as_str(),
-        BundleVerificationCode::REJECTED_VALIDATION.as_str(),
-        None,
-    );
-
-    assert_eq!(rejection.activation_code, definition.code.as_str());
-    assert_eq!(rejection.safe_meaning, definition.meaning);
-    assert_eq!(rejection.safe_remediation, definition.remediation);
-}
-
-#[test]
-fn config_boot_error_mapping_preserves_static_bundle_code_and_drops_hash_values() {
-    let error = map_config_boot_error(ConfigBootError::UnsignedConfigHashMismatch {
-        expected: HASH_SENTINEL.to_string(),
-        actual: OTHER_HASH_SENTINEL.to_string(),
-    });
-    let failure = error
-        .downcast_ref::<BundleVerificationFailure>()
-        .expect("config boot errors retain only the typed bundle rejection");
-
-    assert_eq!(failure.code(), BundleVerificationCode::REJECTED_ROLLBACK);
-    assert!(std::error::Error::source(failure).is_none());
-    let rendered = format!("{failure} {failure:?}");
-    assert!(rendered.contains(BundleVerificationCode::REJECTED_ROLLBACK.as_str()));
-    assert!(!rendered.contains(HASH_SENTINEL));
-    assert!(!rendered.contains(OTHER_HASH_SENTINEL));
-}
-
-#[test]
-fn verified_bundle_parse_failure_returns_static_validation_failure() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_signed_notary_bundle(&tmp);
-    let mut verified =
-        verify_config_bundle(&fixture.bundle_dir, &fixture.anchor_path).expect("bundle verifies");
-    verified.config_bytes = b"SENTINEL_PRIVATE_COUNTRY_VALUE: [invalid parser text".to_vec();
-    let bootstrap =
-        parse_config_document(&notary_bootstrap_config(&fixture)).expect("bootstrap config parses");
-    let config_trust = bootstrap
-        .config
-        .config_trust
-        .expect("bootstrap config has trust settings");
-
-    let error = load_verified_bundle_server_config(&config_trust, true, verified)
-        .expect_err("verified bundle parser failure rejects startup");
-    let failure = error
-        .downcast_ref::<BundleVerificationFailure>()
-        .expect("verified bundle parser failures retain a validation category");
-
-    assert_eq!(failure.code(), BundleVerificationCode::REJECTED_VALIDATION);
-    let rendered = format!("{failure} {failure:?}");
-    assert!(!rendered.contains("SENTINEL_PRIVATE_COUNTRY_VALUE"));
-    assert!(!rendered.contains("invalid parser text"));
-}
-
-#[test]
-fn verified_bundle_product_validation_failure_returns_static_validation_failure() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let governed_invalid =
-        notary_bundle_runtime_config().replace("mode: dedicated", "mode: shared_with_public");
-    let fixture = write_signed_notary_bundle_with_config(&tmp, governed_invalid);
-    let verified =
-        verify_config_bundle(&fixture.bundle_dir, &fixture.anchor_path).expect("bundle verifies");
-    let bootstrap =
-        parse_config_document(&notary_bootstrap_config(&fixture)).expect("bootstrap config parses");
-    let config_trust = bootstrap
-        .config
-        .config_trust
-        .expect("bootstrap config has trust settings");
-
-    let error = load_verified_bundle_server_config(&config_trust, true, verified)
-        .expect_err("verified bundle product validation failure rejects startup");
-    let failure = error
-        .downcast_ref::<BundleVerificationFailure>()
-        .expect("verified bundle validation failures retain a validation category");
-
-    assert_eq!(failure.code(), BundleVerificationCode::REJECTED_VALIDATION);
-}
-
-#[test]
-fn missing_startup_config_path_returns_value_free_failure() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let sentinel = "SENTINEL_PRIVATE_COUNTRY_CONFIG_PATH";
-    let config_path = tmp.path().join(sentinel).join("notary.yaml");
-
-    let error = load_server_config(&config_path, false)
-        .expect_err("missing startup config must fail closed");
-    let failure = error
-        .downcast_ref::<NotaryActivationFailure>()
-        .expect("missing startup config uses the redacted activation boundary");
-
-    assert_eq!(failure.code(), NotaryActivationCode::CONFIGURATION_INVALID);
-    let rendered = format!("{failure} {failure:?}");
-    assert!(!rendered.contains(sentinel));
-    assert!(!rendered.contains(config_path.to_string_lossy().as_ref()));
-}
-
-#[test]
-fn signed_bundle_server_config_loads_with_pending_acceptance() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_signed_notary_bundle(&tmp);
-    let config_path = tmp.path().join("bootstrap.yaml");
-    std::fs::write(&config_path, notary_bootstrap_config(&fixture)).expect("bootstrap writes");
-
-    let loaded = load_server_config(&config_path, true).expect("signed bundle config loads");
-
-    assert_eq!(loaded.config_source, ConfigSource::SignedBundleFile);
-    let provenance = loaded.config_provenance.expect("provenance");
-    assert_eq!(provenance.source, ConfigSource::SignedBundleFile);
-    assert_eq!(provenance.internal_config_hash, fixture.config_hash);
-    let acceptance = loaded
-        .pending_bundle_acceptance
-        .expect("pending acceptance");
-    assert_eq!(acceptance.source, ConfigSource::SignedBundleFile);
-    assert_eq!(
-        acceptance.bundle_id.as_deref(),
-        Some("notary-loader-bundle")
-    );
-    assert_eq!(acceptance.sequence, Some(1));
-    assert_eq!(acceptance.config_hash, fixture.config_hash);
-    assert!(matches!(
-        acceptance.state_action,
-        BundleStateAction::Initialize
-    ));
-}
-
-#[test]
-fn direct_signed_bundle_server_config_loads_without_bootstrap_config() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_signed_notary_bundle(&tmp);
-
-    let loaded = load_direct_signed_bundle_server_config(
-        &fixture.bundle_dir,
-        &fixture.anchor_path,
-        &fixture.state_path,
-        true,
-    )
-    .expect("direct signed bundle config loads");
-
-    assert_eq!(loaded.config_source, ConfigSource::SignedBundleFile);
-    assert!(
-        loaded.config.config_trust.is_none(),
-        "direct startup must not inject bootstrap trust configuration into the signed document"
-    );
-    let provenance = loaded.config_provenance.expect("provenance");
-    assert_eq!(provenance.source, ConfigSource::SignedBundleFile);
-    assert_eq!(provenance.internal_config_hash, fixture.config_hash);
-    let acceptance = loaded
-        .pending_bundle_acceptance
-        .expect("pending acceptance");
-    assert_eq!(acceptance.state_path, fixture.state_path);
-    assert_eq!(
-        acceptance.bundle_id.as_deref(),
-        Some("notary-loader-bundle")
-    );
-    assert!(matches!(
-        acceptance.state_action,
-        BundleStateAction::Initialize
-    ));
-}
-
-#[test]
-fn direct_signed_serve_rejects_absent_state_without_initializing() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_signed_notary_bundle(&tmp);
-
-    let error = load_direct_signed_bundle_server_config(
-        &fixture.bundle_dir,
-        &fixture.anchor_path,
-        &fixture.state_path,
-        false,
-    )
-    .expect_err("ordinary serve requires existing acceptance state");
-
-    assert_eq!(
-        error
-            .downcast_ref::<BundleVerificationFailure>()
-            .expect("missing-state failure is typed")
-            .code(),
-        BundleVerificationCode::REJECTED_ROLLBACK
-    );
-    assert!(
-        !fixture.state_path.exists(),
-        "ordinary serve must never initialize absent state"
-    );
-}
-
-#[test]
-fn direct_startup_rejects_missing_instance_id_before_state_resolution() {
-    const STATE_SENTINEL: &str = "SENTINEL_PRIVATE_ANTIROLLBACK_STATE";
-
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_signed_notary_bundle(&tmp);
-    rewrite_signed_bundle_instance_id(&fixture, None);
-    std::fs::write(&fixture.state_path, STATE_SENTINEL).expect("malformed state writes");
-
-    let error = load_direct_signed_bundle_server_config(
-        &fixture.bundle_dir,
-        &fixture.anchor_path,
-        &fixture.state_path,
-        true,
-    )
-    .expect_err("instance-unbound bundle must reject before reading direct startup state");
-
-    let failure = error
-        .downcast_ref::<BundleVerificationFailure>()
-        .expect("missing instance binding failure is typed");
-    assert_eq!(failure.code(), BundleVerificationCode::REJECTED_BINDING);
-    let rendered = format!("{failure} {failure:?}");
-    assert!(!rendered.contains(fixture.bundle_dir.to_string_lossy().as_ref()));
-    assert!(!rendered.contains(fixture.anchor_path.to_string_lossy().as_ref()));
-    assert!(!rendered.contains(fixture.state_path.to_string_lossy().as_ref()));
-    assert!(!rendered.contains(STATE_SENTINEL));
-    assert_eq!(
-        std::fs::read_to_string(&fixture.state_path).expect("state remains readable"),
-        STATE_SENTINEL,
-        "missing instance binding must reject without consulting or changing anti-rollback state"
-    );
-}
-
-#[test]
-fn direct_startup_missing_instance_id_cannot_share_state_across_instance_anchors() {
-    const FIRST_INSTANCE_SENTINEL: &str = "SENTINEL_PRIVATE_NOTARY_INSTANCE_ALPHA";
-    const SECOND_INSTANCE_SENTINEL: &str = "SENTINEL_PRIVATE_NOTARY_INSTANCE_BRAVO";
-
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_signed_notary_bundle(&tmp);
-    rewrite_signed_bundle_instance_id(&fixture, None);
-    let anchor: ConfigTrustAnchor =
-        serde_json::from_slice(&std::fs::read(&fixture.anchor_path).expect("anchor reads"))
-            .expect("anchor parses");
-    let first_anchor_path = tmp.path().join("first-trust-anchor.json");
-    let second_anchor_path = tmp.path().join("second-trust-anchor.json");
-    for (path, instance_id) in [
-        (&first_anchor_path, FIRST_INSTANCE_SENTINEL),
-        (&second_anchor_path, SECOND_INSTANCE_SENTINEL),
-    ] {
-        let mut instance_anchor = anchor.clone();
-        instance_anchor.acceptance_identity.instance = instance_id.to_string();
-        std::fs::write(
-            path,
-            serde_json::to_vec_pretty(&instance_anchor).expect("anchor serializes"),
-        )
-        .expect("anchor writes");
-    }
-
-    for anchor_path in [&first_anchor_path, &second_anchor_path] {
-        let error = load_direct_signed_bundle_server_config(
-            &fixture.bundle_dir,
-            anchor_path,
-            &fixture.state_path,
-            true,
-        )
-        .expect_err("instance-unbound bundle must reject every direct instance anchor");
-        let failure = error
-            .downcast_ref::<BundleVerificationFailure>()
-            .expect("missing instance binding failure is typed");
-        assert_eq!(failure.code(), BundleVerificationCode::REJECTED_BINDING);
-        let rendered = format!("{failure} {failure:?}");
-        assert!(!rendered.contains(FIRST_INSTANCE_SENTINEL));
-        assert!(!rendered.contains(SECOND_INSTANCE_SENTINEL));
-    }
-    assert!(
-        !fixture.state_path.exists(),
-        "different anchors must not converge on an empty-instance anti-rollback lane"
-    );
-}
-
-#[test]
-fn direct_startup_rejects_verified_cross_product_bundle_before_state_resolution() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_signed_notary_bundle(&tmp);
-    rewrite_signed_bundle_product(&fixture, "registry-relay");
-
-    let error = load_direct_signed_bundle_server_config(
-        &fixture.bundle_dir,
-        &fixture.anchor_path,
-        &fixture.state_path,
-        true,
-    )
-    .expect_err("verified Relay bundle must not start the Notary");
-
-    let failure = error
-        .downcast_ref::<BundleVerificationFailure>()
-        .expect("cross-product failure is typed");
-    assert_eq!(failure.code(), BundleVerificationCode::REJECTED_BINDING);
-    let rendered = format!("{failure} {failure:?}");
-    assert!(!rendered.contains("registry-relay"));
-    assert!(!rendered.contains(fixture.bundle_dir.to_string_lossy().as_ref()));
-    assert!(!rendered.contains(fixture.anchor_path.to_string_lossy().as_ref()));
-    assert!(
-        !fixture.state_path.exists(),
-        "product binding must reject before anti-rollback state mutation"
-    );
-}
-
-#[tokio::test]
-async fn product_serve_loader_uses_the_verified_bundle_after_its_path_changes() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_signed_notary_bundle(&tmp);
-    let verified =
-        verify_notary_product_bundle(&fixture.bundle_dir, &fixture.anchor_path).expect("verifies");
-    let candidate =
-        registry_platform_ops::VerifiedAcceptanceStateV1::from_verified_bundle(&verified)
-            .expect("acceptance candidate");
-    let store = registry_platform_ops::FileAntiRollbackStore::new(&fixture.state_path);
-    let plan = store.plan_initialize(&candidate).expect("initial plan");
-    store
-        .commit_acceptance(plan, |_| async { Ok::<(), std::convert::Infallible>(()) })
-        .await
-        .expect("state initializes");
-    let moved_bundle = tmp.path().join("bundle-after-verification");
-    std::fs::rename(&fixture.bundle_dir, &moved_bundle)
-        .expect("verified bundle path becomes unavailable");
-
-    let loaded = load_verified_product_server_config(
-        &fixture.state_path,
-        verified,
-        ProductTrustDomainV1::Governed,
-    )
-    .expect("preverified product input loads without reopening the bundle");
-
-    assert_eq!(loaded.config_source, ConfigSource::SignedBundleFile);
-    assert_eq!(
-        loaded
-            .verified_acceptance_state
-            .expect("verified acceptance state")
-            .expectation(),
-        candidate.expectation()
-    );
-}
-
-#[test]
-fn direct_startup_rejects_every_acceptance_identity_mismatch_before_state_access() {
-    const STATE_SENTINEL: &str = "SENTINEL_PRIVATE_ACCEPTANCE_STATE";
-
-    for dimension in [
-        "trust_domain",
-        "project",
-        "environment",
-        "lane",
-        "product",
-        "stream",
-        "instance",
-    ] {
-        let tmp = tempfile::tempdir().expect("tempdir");
-        let fixture = write_signed_notary_bundle(&tmp);
-        let mut manifest: ConfigBundleManifest = serde_json::from_slice(
-            &std::fs::read(fixture.bundle_dir.join("manifest.json")).expect("manifest reads"),
-        )
-        .expect("manifest parses");
-        match dimension {
-            "trust_domain" => {
-                manifest.acceptance_identity.trust_domain = ProductTrustDomainV1::Development;
-            }
-            "project" => {
-                manifest.acceptance_identity.project = "other-project".to_string();
-            }
-            "environment" => {
-                manifest.acceptance_identity.environment = "other-environment".to_string();
-            }
-            "lane" => {
-                manifest.acceptance_identity.lane = ProductAcceptanceLaneV1::RelayConsultation;
-            }
-            "product" => {
-                manifest.acceptance_identity.product = ProductAcceptanceProductV1::RegistryRelay;
-            }
-            "stream" => {
-                manifest.acceptance_identity.stream = "other-stream".to_string();
-            }
-            "instance" => {
-                manifest.acceptance_identity.instance = "other-instance".to_string();
-            }
-            _ => unreachable!(),
-        }
-        let private = PrivateJwk::parse(CONFIG_BUNDLE_PRIVATE_JWK).expect("private JWK parses");
-        let kid = private.public().jkt().expect("signer thumbprint");
-        write_manifest_and_signature(&fixture.bundle_dir, &manifest, &private, &kid);
-        std::fs::write(&fixture.state_path, STATE_SENTINEL).expect("state sentinel writes");
-
-        let error = load_direct_signed_bundle_server_config(
-            &fixture.bundle_dir,
-            &fixture.anchor_path,
-            &fixture.state_path,
-            false,
-        )
-        .expect_err("identity mismatch rejects direct startup");
-        let failure = error
-            .downcast_ref::<BundleVerificationFailure>()
-            .expect("identity mismatch failure is typed");
-        assert!(
-            [
-                BundleVerificationCode::REJECTED_BINDING,
-                BundleVerificationCode::REJECTED_VALIDATION,
-            ]
-            .contains(&failure.code()),
-            "unexpected {dimension} failure: {failure}"
-        );
-        assert_eq!(
-            std::fs::read_to_string(&fixture.state_path).expect("state remains readable"),
-            STATE_SENTINEL,
-            "{dimension} mismatch accessed or changed state"
-        );
-    }
-}
-
-#[test]
-fn direct_startup_rejects_a_valid_relay_lane_swap_before_state_access() {
-    const STATE_SENTINEL: &str = "SENTINEL_PRIVATE_LANE_SWAP_STATE";
-
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_signed_notary_bundle(&tmp);
-    let mut manifest: ConfigBundleManifest = serde_json::from_slice(
-        &std::fs::read(fixture.bundle_dir.join("manifest.json")).expect("manifest reads"),
-    )
-    .expect("manifest parses");
-    manifest.acceptance_identity.lane = ProductAcceptanceLaneV1::RelayConsultation;
-    manifest.acceptance_identity.product = ProductAcceptanceProductV1::RegistryRelay;
-    let private = PrivateJwk::parse(CONFIG_BUNDLE_PRIVATE_JWK).expect("private JWK parses");
-    let kid = private.public().jkt().expect("signer thumbprint");
-    write_manifest_and_signature(&fixture.bundle_dir, &manifest, &private, &kid);
-    let mut anchor: ConfigTrustAnchor =
-        serde_json::from_slice(&std::fs::read(&fixture.anchor_path).expect("anchor reads"))
-            .expect("anchor parses");
-    anchor.acceptance_identity = manifest.acceptance_identity;
-    std::fs::write(
-        &fixture.anchor_path,
-        serde_json::to_vec_pretty(&anchor).expect("anchor serializes"),
-    )
-    .expect("anchor writes");
-    std::fs::write(&fixture.state_path, STATE_SENTINEL).expect("state sentinel writes");
-
-    let error = load_direct_signed_bundle_server_config(
-        &fixture.bundle_dir,
-        &fixture.anchor_path,
-        &fixture.state_path,
-        false,
-    )
-    .expect_err("Relay lane swap rejects Notary startup");
-    assert_eq!(
-        error
-            .downcast_ref::<BundleVerificationFailure>()
-            .expect("lane-swap failure is typed")
-            .code(),
-        BundleVerificationCode::REJECTED_BINDING
-    );
-    assert_eq!(
-        std::fs::read_to_string(&fixture.state_path).expect("state remains readable"),
-        STATE_SENTINEL
-    );
-}
-
-#[test]
-fn bootstrap_startup_rejects_verified_cross_product_bundle_without_fallback() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_signed_notary_bundle(&tmp);
-    rewrite_signed_bundle_product(&fixture, "registry-relay");
-    let unsigned_path = tmp.path().join("authorized-unsigned-notary.yaml");
-    let unsigned_config = notary_bundle_runtime_config();
-    std::fs::write(&unsigned_path, unsigned_config.as_bytes()).expect("unsigned config writes");
-    let mut relay_identity = notary_acceptance_identity();
-    relay_identity.lane = ProductAcceptanceLaneV1::RelayConsultation;
-    relay_identity.product = ProductAcceptanceProductV1::RegistryRelay;
-    let key = registry_platform_ops::AntiRollbackKey {
-        acceptance_identity: relay_identity,
-    };
-    let fallback_state = registry_platform_ops::AntiRollbackRecord {
-        key: key.clone(),
-        last_sequence: 2,
-        last_config_hash: sha256_uri(b"newer-cross-product-config"),
-        last_bundle_manifest_hash:
-            "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb".to_string(),
-        last_bundle_id: "newer-cross-product-bundle".to_string(),
-        accepted_anchor: notary_accepted_anchor_pin(),
-        override_pin: Some(registry_platform_ops::ConfigOverridePin {
-            active: true,
-            mode: ConfigOverrideMode::AcceptUnsigned,
-            config_hash: sha256_uri(unsigned_config.as_bytes()),
-            config_path: Some(unsigned_path.to_string_lossy().into_owned()),
-            expires_at: Some("2099-01-01T00:00:00Z".to_string()),
-            used_at: "2026-07-30T00:00:00Z".to_string(),
-            operator: "security-review".to_string(),
-            reason: "pin fallback regression".to_string(),
-        }),
-        break_glass: Default::default(),
-        local_approvals: Default::default(),
-    };
-    std::fs::write(
-        &fixture.state_path,
-        serde_json::to_vec_pretty(&fallback_state).expect("fallback state serializes"),
-    )
-    .expect("pre-existing fallback state writes");
-    let config_path = tmp.path().join("bootstrap.yaml");
-    std::fs::write(&config_path, notary_bootstrap_config(&fixture)).expect("bootstrap writes");
-
-    let error = load_server_config(&config_path, false)
-        .expect_err("verified Relay bundle must not select Notary bootstrap fallback");
-
-    let failure = error
-        .downcast_ref::<BundleVerificationFailure>()
-        .expect("cross-product failure is typed");
-    assert_eq!(failure.code(), BundleVerificationCode::REJECTED_BINDING);
-    let rendered = format!("{failure} {failure:?}");
-    assert!(!rendered.contains("registry-relay"));
-    let retained = registry_platform_ops::FileAntiRollbackStore::new(&fixture.state_path)
-        .load(&key)
-        .expect("existing fallback state remains readable");
-    assert_eq!(
-        retained.last_sequence, 2,
-        "product binding must reject before bootstrap fallback or state mutation"
-    );
-}
-
-#[test]
-fn server_config_input_debug_is_value_free() {
-    let signed = ServerConfigInput::SignedBundle {
-        bundle_dir: PathBuf::from("/private/SENTINEL_BUNDLE_PATH"),
-        anchor_path: PathBuf::from("/private/SENTINEL_ANCHOR_PATH"),
-        state_path: PathBuf::from("/private/SENTINEL_STATE_PATH"),
-    };
-    let local = ServerConfigInput::LocalFile(PathBuf::from("/private/SENTINEL_LOCAL_PATH"));
-
-    let rendered = format!("{signed:?} {local:?}");
-
-    assert!(rendered.contains("SignedBundle"));
-    assert!(rendered.contains("LocalFile"));
-    assert!(!rendered.contains("SENTINEL"));
-    assert!(!rendered.contains("/private"));
-}
-
-#[test]
-fn direct_signed_bundle_rejects_signature_and_binding_failures_exactly() {
-    let signature_tmp = tempfile::tempdir().expect("tempdir");
-    let signature_fixture = write_signed_notary_bundle(&signature_tmp);
-    std::fs::write(
-        signature_fixture.bundle_dir.join("manifest.sig.json"),
-        r#"{"schema":"registry.platform.config_bundle_signatures.v1","signatures":[]}"#,
-    )
-    .expect("invalid signature envelope writes");
-
-    let signature_error = load_direct_signed_bundle_server_config(
-        &signature_fixture.bundle_dir,
-        &signature_fixture.anchor_path,
-        &signature_fixture.state_path,
-        true,
-    )
-    .expect_err("invalid signature rejects direct startup");
-    assert_eq!(
-        signature_error
-            .downcast_ref::<BundleVerificationFailure>()
-            .expect("signature failure is typed")
-            .code(),
-        BundleVerificationCode::REJECTED_SIGNATURE
-    );
-
-    let binding_tmp = tempfile::tempdir().expect("tempdir");
-    let binding_fixture = write_signed_notary_bundle(&binding_tmp);
-    let mut anchor: ConfigTrustAnchor =
-        serde_json::from_slice(&std::fs::read(&binding_fixture.anchor_path).expect("anchor reads"))
-            .expect("anchor parses");
-    anchor.acceptance_identity.instance = "SENTINEL_WRONG_PRIVATE_INSTANCE".to_string();
-    std::fs::write(
-        &binding_fixture.anchor_path,
-        serde_json::to_vec_pretty(&anchor).expect("anchor serializes"),
-    )
-    .expect("mismatched anchor writes");
-
-    let binding_error = load_direct_signed_bundle_server_config(
-        &binding_fixture.bundle_dir,
-        &binding_fixture.anchor_path,
-        &binding_fixture.state_path,
-        true,
-    )
-    .expect_err("binding mismatch rejects direct startup");
-    assert_eq!(
-        binding_error
-            .downcast_ref::<BundleVerificationFailure>()
-            .expect("binding failure is typed")
-            .code(),
-        BundleVerificationCode::REJECTED_BINDING
-    );
-    assert!(
-        !format!("{binding_error} {binding_error:?}").contains("SENTINEL_WRONG_PRIVATE_INSTANCE")
-    );
-}
-
-#[test]
-fn direct_signed_bundle_rejects_stale_antirollback_state() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_signed_notary_bundle(&tmp);
-    let loaded = load_direct_signed_bundle_server_config(
-        &fixture.bundle_dir,
-        &fixture.anchor_path,
-        &fixture.state_path,
-        true,
-    )
-    .expect("first direct load resolves initialization");
-    let acceptance = loaded
-        .pending_bundle_acceptance
-        .expect("pending acceptance");
-    let mut newer_record = acceptance.initial_record();
-    newer_record.last_sequence += 1;
-    std::fs::write(
-        &fixture.state_path,
-        serde_json::to_vec_pretty(&newer_record).expect("newer state serializes"),
-    )
-    .expect("pre-existing newer state writes");
-
-    let error = load_direct_signed_bundle_server_config(
-        &fixture.bundle_dir,
-        &fixture.anchor_path,
-        &fixture.state_path,
-        false,
-    )
-    .expect_err("stale direct bundle rejects startup");
-    assert_eq!(
-        error
-            .downcast_ref::<BundleVerificationFailure>()
-            .expect("rollback failure is typed")
-            .code(),
-        BundleVerificationCode::REJECTED_ROLLBACK
-    );
-}
-
-#[test]
-fn direct_signed_bundle_diagnostics_do_not_disclose_paths_or_verifier_values() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let sentinel = "SENTINEL_PRIVATE_COUNTRY_BUNDLE_PATH_AND_SECRET";
-    let bundle_path = tmp.path().join(sentinel);
-    let anchor_path = tmp.path().join("SENTINEL_PRIVATE_TRUST_ANCHOR.json");
-    let state_path = tmp.path().join("SENTINEL_PRIVATE_ANTIROLLBACK_STATE.json");
-
-    let error =
-        load_direct_signed_bundle_server_config(&bundle_path, &anchor_path, &state_path, false)
-            .expect_err("missing direct bundle rejects startup");
-    let failure = error
-        .downcast_ref::<BundleVerificationFailure>()
-        .expect("direct verification failure is typed");
-    assert_eq!(failure.code(), BundleVerificationCode::REJECTED_VALIDATION);
-    let rendered = format!("{failure} {failure:?}");
-    for forbidden in [
-        sentinel,
-        bundle_path.to_str().expect("bundle path is UTF-8"),
-        anchor_path.to_str().expect("anchor path is UTF-8"),
-        state_path.to_str().expect("state path is UTF-8"),
-    ] {
-        assert!(
-            !rendered.contains(forbidden),
-            "direct startup diagnostic exposed {forbidden:?}: {rendered}"
-        );
-    }
-}
-
-#[test]
-fn scalar_admin_listener_shape_names_accepted_modes() {
-    let value = parse_config_value(
-        r#"
-server:
-  admin_listener: shared_with_public
-"#,
-    )
-    .expect("config shape parses");
-    let err = validate_admin_listener_shape(&value)
-        .expect_err("legacy scalar admin listener shape is rejected");
-
-    let message = err.to_string();
-    assert!(message.contains("server.admin_listener.mode"));
-    assert!(message.contains("disabled"));
-    assert!(message.contains("dedicated"));
-    assert!(message.contains("shared_with_public"));
-}
-
-#[test]
-fn deprecated_config_fields_name_replacements_and_removed_cors_credentials() {
-    for (raw, expected) in [
-        (
-            "auth:\n  oidc:\n    jwks_uri: https://id.example.gov/keys\n",
-            "auth.oidc.jwks_url",
-        ),
-        (
-            "auth:\n  oidc:\n    leeway_seconds: 60\n",
-            "auth.oidc.leeway",
-        ),
-        (
-            "auth:\n  oidc:\n    allowed_typ:\n      - JWT\n",
-            "auth.oidc.allowed_token_types",
-        ),
-        (
-            "server:\n  cors:\n    allow_credentials: true\n",
-            "always disables credentialed CORS",
-        ),
-        ("audit:\n  max_size_bytes: 10485760\n", "audit.max_size_mb"),
-    ] {
-        let value = parse_config_value(raw).expect("deprecated-field fixture parses");
-        let err = reject_deprecated_config_fields(&value, &deprecated_config_fields())
-            .expect_err("deprecated field is rejected before deserialization");
-
-        assert!(err.to_string().contains(expected), "unexpected: {err}");
-    }
-}
-
-#[test]
-fn absent_admin_listener_block_requests_restore_key_warning() {
-    let config: StandaloneRegistryNotaryConfig = serde_norway::from_str(
-        r#"
-server:
-  bind: 127.0.0.1:0
-auth:
-  api_keys:
-    - id: local
-      fingerprint:
-        provider: env
-        name: TEST_ADMIN_WARNING_API_HASH
-      scopes: [registry_notary:credential_issue]
-audit:
-  sink: stdout
-evidence:
-  enabled: true
-  signing_keys:
-    issuer:
-      provider: local_jwk_env
-      private_jwk_env: TEST_ADMIN_WARNING_ISSUER_JWK
-      alg: EdDSA
-      kid: did:web:issuer.example#key-1
-      status: active
-  credential_profiles:
-    civil-status:
-      format: application/dc+sd-jwt
-      issuer: did:web:issuer.example
-      signing_key: issuer
-      vct: https://issuer.example/credentials/civil-status
-"#,
-    )
-    .expect("config parses");
-
-    assert!(admin_listener_default_warning_needed(&config, false));
-    assert!(!admin_listener_default_warning_needed(&config, true));
-}
diff --git a/crates/registry-notary/src/doctor.rs b/crates/registry-notary/src/doctor.rs
deleted file mode 100644
index b8b0f582b..000000000
--- a/crates/registry-notary/src/doctor.rs
+++ /dev/null
@@ -1,907 +0,0 @@
-use crate::*;
-
-use registry_notary_server::NotaryActivationCode;
-
-#[cfg(unix)]
-use std::os::unix::fs::PermissionsExt as _;
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, ValueEnum)]
-pub(crate) enum DoctorOutputFormat {
-    Text,
-    Json,
-}
-
-impl fmt::Display for DoctorOutputFormat {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::Text => f.write_str("text"),
-            Self::Json => f.write_str("json"),
-        }
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct Diagnostic {
-    pub(crate) ok: bool,
-    pub(crate) warning: bool,
-    pub(crate) label: String,
-    pub(crate) action: Option<String>,
-    pub(crate) report_code: Option<String>,
-    pub(crate) report_severity: Option<&'static str>,
-}
-
-impl Diagnostic {
-    fn ok(label: impl Into<String>) -> Self {
-        Self {
-            ok: true,
-            warning: false,
-            label: label.into(),
-            action: None,
-            report_code: None,
-            report_severity: None,
-        }
-    }
-
-    fn warn(label: impl Into<String>, action: impl Into<String>) -> Self {
-        Self {
-            ok: true,
-            warning: true,
-            label: label.into(),
-            action: Some(action.into()),
-            report_code: None,
-            report_severity: None,
-        }
-    }
-
-    fn warn_with_code(
-        label: impl Into<String>,
-        action: impl Into<String>,
-        code: impl Into<String>,
-    ) -> Self {
-        Self {
-            ok: true,
-            warning: true,
-            label: label.into(),
-            action: Some(action.into()),
-            report_code: Some(code.into()),
-            report_severity: Some("warning"),
-        }
-    }
-
-    fn fail(label: impl Into<String>, action: impl Into<String>) -> Self {
-        Self {
-            ok: false,
-            warning: false,
-            label: label.into(),
-            action: Some(action.into()),
-            report_code: None,
-            report_severity: None,
-        }
-    }
-
-    fn fail_with_code(
-        label: impl Into<String>,
-        action: impl Into<String>,
-        code: impl Into<String>,
-    ) -> Self {
-        Self {
-            ok: false,
-            warning: false,
-            label: label.into(),
-            action: Some(action.into()),
-            report_code: Some(code.into()),
-            report_severity: Some("error"),
-        }
-    }
-
-    fn deployment_finding(finding: &EvaluatedFinding, profile: Option<DeploymentProfile>) -> Self {
-        let severity = finding.severity.as_str();
-        let label = deployment_finding_label(finding, profile);
-        let action = deployment_finding_action(finding);
-        Self {
-            ok: !matches!(severity, "startup_fail" | "readiness_fail")
-                || finding.status == DeploymentFindingStatus::Waived,
-            warning: !matches!(severity, "startup_fail" | "readiness_fail")
-                || finding.status == DeploymentFindingStatus::Waived,
-            label,
-            action: Some(action),
-            report_code: Some(finding.id.clone()),
-            report_severity: Some(severity),
-        }
-    }
-}
-
-struct DoctorDiagnosticView<'a> {
-    severity: &'static str,
-    code: &'a str,
-    label: &'a str,
-    action: Option<&'a str>,
-}
-
-fn doctor_diagnostic_view(diagnostic: &Diagnostic) -> DoctorDiagnosticView<'_> {
-    let (severity, code) = if let (Some(severity), Some(code)) = (
-        diagnostic.report_severity,
-        diagnostic.report_code.as_deref(),
-    ) {
-        (shared_severity(severity), code)
-    } else if diagnostic.warning {
-        ("warning", "warning")
-    } else if diagnostic.ok {
-        ("info", "ok")
-    } else {
-        ("error", "failed")
-    };
-    if let Some(definition) = NotaryActivationCode::ALL
-        .iter()
-        .copied()
-        .find(|activation_code| activation_code.as_str() == code)
-        .map(NotaryActivationCode::definition)
-    {
-        return DoctorDiagnosticView {
-            severity,
-            code: definition.code.as_str(),
-            label: definition.meaning,
-            action: Some(definition.remediation),
-        };
-    }
-    DoctorDiagnosticView {
-        severity,
-        code,
-        label: &diagnostic.label,
-        action: diagnostic.action.as_deref(),
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct DoctorOptions {
-    pub(crate) live: bool,
-    pub(crate) issue_demo_vc: bool,
-    pub(crate) show_expanded_config: bool,
-    pub(crate) profile_override: Option<String>,
-    pub(crate) format: DoctorOutputFormat,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub(crate) struct DeploymentProfileReport {
-    value: Option<String>,
-    source: &'static str,
-}
-
-pub(crate) async fn doctor(
-    config_path: &Path,
-    env_report: &EnvFileReport,
-    bind_override: Option<SocketAddr>,
-    options: DoctorOptions,
-) -> Result<bool, Box<dyn std::error::Error>> {
-    let mut diagnostics = Vec::new();
-    let mut expanded_config = None;
-    let mut deployment_profile = DeploymentProfileReport {
-        value: options.profile_override.clone(),
-        source: if options.profile_override.is_some() {
-            "override"
-        } else {
-            "undeclared"
-        },
-    };
-    let raw = match fs::read_to_string(config_path) {
-        Ok(raw) => {
-            diagnostics.push(Diagnostic::ok("config file read"));
-            raw
-        }
-        Err(err) => {
-            diagnostics.push(Diagnostic::fail_with_code(
-                format!("config file read failed: {err}"),
-                "check --config points to a readable YAML file",
-                NotaryActivationCode::CONFIGURATION_INVALID.as_str(),
-            ));
-            render_doctor_output(&diagnostics, options.format, None, None, env_report)?;
-            return Ok(false);
-        }
-    };
-    let parsed = match parse_expanded_config(&raw) {
-        Ok(config) => {
-            diagnostics.push(Diagnostic::ok("config YAML parsed and validated"));
-            let mut config = config;
-            apply_bind_override(&mut config, bind_override);
-            Some(config)
-        }
-        Err(err) => {
-            diagnostics.push(Diagnostic::fail_with_code(
-                format!("config YAML parse or validation failed: {err}"),
-                "fix the YAML syntax and field names",
-                NotaryActivationCode::CONFIGURATION_INVALID.as_str(),
-            ));
-            None
-        }
-    };
-    let config = match parsed {
-        Some(config) => {
-            diagnostics.push(Diagnostic::ok("config semantics validated"));
-            Some(config)
-        }
-        None => None,
-    };
-    if let Some(config) = &config {
-        if options.profile_override.is_none() {
-            if let Some(profile) = config.deployment.profile {
-                deployment_profile = DeploymentProfileReport {
-                    value: Some(profile.as_str().to_string()),
-                    source: "config",
-                };
-            }
-        }
-        let profile_value = deployment_profile
-            .value
-            .as_deref()
-            .and_then(deployment_profile_from_str);
-        diagnostics.extend(deployment_profile_diagnostics(config, profile_value));
-        diagnostics.extend(local_env_diagnostics(config, env_report));
-        diagnostics.extend(holder_binding_diagnostics(config));
-        if let Some(diagnostic) = pkcs11_preflight_diagnostic(config) {
-            diagnostics.push(diagnostic);
-        }
-        diagnostics.extend(vc_diagnostics(config, options.issue_demo_vc));
-        if options.live {
-            diagnostics.extend(live_diagnostics(config).await);
-        }
-        if options.show_expanded_config {
-            expanded_config = Some(redacted_config(config));
-        }
-    }
-    render_doctor_output(
-        &diagnostics,
-        options.format,
-        expanded_config.as_ref(),
-        config.as_ref(),
-        env_report,
-    )?;
-    Ok(diagnostics.iter().all(|diag| diag.ok))
-}
-
-pub(crate) fn deployment_profile_diagnostics(
-    config: &StandaloneRegistryNotaryConfig,
-    profile_value: Option<DeploymentProfile>,
-) -> Vec<Diagnostic> {
-    let input = config.gate_input();
-    let evaluation = evaluate_gates(
-        profile_value,
-        &input,
-        &config.deployment.waivers,
-        &today_utc_date(),
-    );
-    evaluation
-        .findings
-        .iter()
-        .map(|finding| Diagnostic::deployment_finding(finding, profile_value))
-        .collect()
-}
-
-pub(crate) fn deployment_profile_from_str(value: &str) -> Option<DeploymentProfile> {
-    match value {
-        "local" => Some(DeploymentProfile::Local),
-        "hosted_lab" => Some(DeploymentProfile::HostedLab),
-        "production" => Some(DeploymentProfile::Production),
-        "evidence_grade" => Some(DeploymentProfile::EvidenceGrade),
-        _ => None,
-    }
-}
-
-pub(crate) fn deployment_finding_label(
-    finding: &EvaluatedFinding,
-    profile: Option<DeploymentProfile>,
-) -> String {
-    if finding.id == "deployment.profile_undeclared" {
-        return "deployment profile is undeclared".to_string();
-    }
-    if finding.id == "deployment.waiver_expired" {
-        if let Some(waiver) = &finding.waiver {
-            return format!(
-                "deployment waiver for '{}' expired on {}",
-                waiver.finding, waiver.expires
-            );
-        }
-        return "deployment waiver expired".to_string();
-    }
-    let profile = profile
-        .map(DeploymentProfile::as_str)
-        .unwrap_or("undeclared");
-    let status = match finding.status {
-        DeploymentFindingStatus::Active => "active",
-        DeploymentFindingStatus::Waived => "waived",
-    };
-    format!(
-        "{profile} deployment gate '{}' is {status} at severity {}",
-        finding.id,
-        finding.severity.as_str()
-    )
-}
-
-pub(crate) fn deployment_finding_action(finding: &EvaluatedFinding) -> String {
-    if finding.id == "deployment.profile_undeclared" {
-        return "set deployment.profile or pass --profile for review-only doctor output"
-            .to_string();
-    }
-    if finding.id == "deployment.waiver_expired" {
-        return "renew the waiver only after review, or remove it and fix the deployment condition"
-            .to_string();
-    }
-    if finding.status == DeploymentFindingStatus::Waived {
-        return "review the active deployment waiver and expiry".to_string();
-    }
-    "update deployment config or runtime settings to clear the gate".to_string()
-}
-
-pub(crate) fn holder_binding_diagnostics(
-    config: &StandaloneRegistryNotaryConfig,
-) -> Vec<Diagnostic> {
-    let unbound_profiles = config
-        .evidence
-        .credential_profiles
-        .iter()
-        .filter(|(_, profile)| profile.holder_binding.mode == "none")
-        .map(|(profile_id, _)| profile_id.as_str())
-        .collect::<Vec<_>>();
-    if unbound_profiles.is_empty() {
-        return Vec::new();
-    }
-    vec![Diagnostic::warn_with_code(
-        format!(
-            "credential profile(s) issue unbound SD-JWT VC credentials: {}",
-            unbound_profiles.join(", ")
-        ),
-        "set holder_binding.mode: did with allowed_did_methods: [did:jwk], or keep mode: none only for an explicit bearer-style credential profile",
-        "notary.credential_profile.unbound_holder_binding",
-    )]
-}
-
-/// Today's date in UTC as a `YYYY-MM-DD` string, for waiver-expiry comparison.
-pub(crate) fn today_utc_date() -> String {
-    let now = OffsetDateTime::now_utc().date();
-    format!(
-        "{:04}-{:02}-{:02}",
-        now.year(),
-        u8::from(now.month()),
-        now.day()
-    )
-}
-
-pub(crate) fn pkcs11_preflight_diagnostic(
-    config: &StandaloneRegistryNotaryConfig,
-) -> Option<Diagnostic> {
-    let has_active_pkcs11 = config.evidence.signing_keys.values().any(|key| {
-        matches!(key.provider, SigningKeyProviderConfig::Pkcs11) && key.status.may_sign()
-    });
-    if !has_active_pkcs11 {
-        return None;
-    }
-    match EvidenceIssuerRegistry::from_config(&config.evidence) {
-        Ok(_) => Some(Diagnostic::ok(
-            "PKCS#11 signing providers loaded and self-tested",
-        )),
-        Err(err) => Some(Diagnostic::fail_with_code(
-            format!("PKCS#11 signing preflight failed: {err}"),
-            "check module_path, token_label, pin_env, key_label, key_id_hex, public_jwk_env, and whether this binary was built with pkcs11",
-            NotaryActivationCode::CONFIGURATION_INVALID.as_str(),
-        )),
-    }
-}
-
-pub(crate) fn print_diagnostics(diagnostics: &[Diagnostic]) {
-    for diag in diagnostics {
-        let status = if diag.warning {
-            "WARN"
-        } else if diag.ok {
-            "OK  "
-        } else {
-            "FAIL"
-        };
-        let view = doctor_diagnostic_view(diag);
-        println!("{status}  {} [{}]", view.label, view.code);
-        if let Some(action) = view.action {
-            println!("     Next action: {action}");
-        }
-    }
-}
-
-pub(crate) fn render_doctor_output(
-    diagnostics: &[Diagnostic],
-    format: DoctorOutputFormat,
-    expanded_config: Option<&Value>,
-    config: Option<&StandaloneRegistryNotaryConfig>,
-    env_report: &EnvFileReport,
-) -> Result<(), Box<dyn std::error::Error>> {
-    match format {
-        DoctorOutputFormat::Text => {
-            if let Some(config) = expanded_config {
-                println!("{}", serde_json::to_string_pretty(config)?);
-            }
-            print_diagnostics(diagnostics);
-        }
-        DoctorOutputFormat::Json => {
-            println!(
-                "{}",
-                serde_json::to_string_pretty(&doctor_json_report(diagnostics, config, env_report))?
-            );
-        }
-    }
-    Ok(())
-}
-
-pub(crate) fn doctor_json_report(
-    diagnostics: &[Diagnostic],
-    config: Option<&StandaloneRegistryNotaryConfig>,
-    env_report: &EnvFileReport,
-) -> Value {
-    let diagnostics_json = diagnostics
-        .iter()
-        .map(doctor_json_diagnostic)
-        .collect::<Vec<_>>();
-    let error_count = diagnostics_json
-        .iter()
-        .filter(|diag| diag["severity"] == "error")
-        .count();
-    let warning_count = diagnostics_json
-        .iter()
-        .filter(|diag| diag["severity"] == "warning")
-        .count();
-    let mut report = json!({
-        "schema_version": "registry.config.diagnostic_report.v1",
-        "product": "registry-notary",
-        "config_schema_version": NOTARY_CONFIG_SCHEMA_VERSION,
-        "source": {
-            "kind": "local_file",
-        },
-        "status": if error_count > 0 {
-            ReportStatus::Error.as_str()
-        } else if warning_count > 0 {
-            ReportStatus::Warning.as_str()
-        } else {
-            ReportStatus::Ok.as_str()
-        },
-        "summary": {
-            "error_count": error_count,
-            "warning_count": warning_count,
-        },
-        "diagnostics": diagnostics_json,
-        "required_env": required_env_report(
-            config.map(required_env_vars).unwrap_or_default(),
-            env_report,
-        ),
-        "context_constraints": [],
-        "generated_at": now_rfc3339(),
-    });
-    if let Some(config) = config {
-        report["audit_shipping"] = notary_audit_shipping(config);
-    }
-    report
-}
-
-/// Report the audit shipping posture for the doctor diagnostic report. This
-/// mirrors the `posture.audit` shipping fields (`sink_type`,
-/// `shipping_target_configured`, `shipping_target`, `shipping_health`,
-/// `shipping_observed_at`). The target is declared state derived from config via
-/// the shared classifier. Doctor is offline, so a fresh cursor remains
-/// `unverified` until a live runtime can bind it to the keyed chain tail.
-/// Unmapped sink strings fall back to
-/// [`AuditSinkKind::Unknown`] rather than a silent wildcard.
-pub(crate) fn notary_audit_shipping(config: &StandaloneRegistryNotaryConfig) -> Value {
-    let (sink_kind, sink_type) = match config.audit.sink.as_str() {
-        "stdout" => (AuditSinkKind::Stdout, "stdout"),
-        "syslog" => (AuditSinkKind::Syslog, "syslog"),
-        "file" | "jsonl" => (AuditSinkKind::LocalFile, "file"),
-        _ => (AuditSinkKind::Unknown, "unknown"),
-    };
-    let (shipping_target_configured, shipping_target) =
-        audit_shipping_target(sink_kind, config.deployment.evidence.audit_offhost_shipping);
-    // Read the local cursor safely, but never promote freshness to ok without a
-    // live AuditPipeline and its keyed chain tail.
-    let observation = evaluate_ack_health(
-        config.deployment.evidence.audit_ack_cursor_path(),
-        SystemTime::now(),
-        config.deployment.evidence.audit_ack_max_age(),
-    );
-    let shipping_health = if shipping_target_configured {
-        Value::from(observation.health.as_str())
-    } else {
-        Value::Null
-    };
-    let shipping_observed_at = if shipping_target_configured {
-        observation.acked_at.map_or(Value::Null, Value::from)
-    } else {
-        Value::Null
-    };
-    json!({
-        "sink_type": sink_type,
-        "shipping_target_configured": shipping_target_configured,
-        "shipping_target": shipping_target,
-        "shipping_health": shipping_health,
-        "shipping_observed_at": shipping_observed_at,
-    })
-}
-
-pub(crate) fn doctor_json_diagnostic(diagnostic: &Diagnostic) -> Value {
-    let view = doctor_diagnostic_view(diagnostic);
-    let message = if let Some(action) = view.action {
-        format!("{} Next action: {action}", view.label)
-    } else {
-        view.label.to_string()
-    };
-    let value = json!({
-        "severity": view.severity,
-        "code": view.code,
-        "message": message,
-    });
-    value
-}
-
-pub(crate) fn shared_severity(severity: &str) -> &'static str {
-    match severity {
-        "startup_fail" | "readiness_fail" | "finding_error" | "error" => "error",
-        "finding_warn" | "warning" => "warning",
-        _ => "info",
-    }
-}
-
-pub(crate) fn required_env_report(
-    vars: BTreeSet<String>,
-    env_report: &EnvFileReport,
-) -> Vec<Value> {
-    vars.into_iter()
-        .map(|name| {
-            let status = if std::env::var_os(&name).is_some() || env_report.contains(&name) {
-                RequiredEnvStatus::Present
-            } else {
-                RequiredEnvStatus::Missing
-            };
-            json!({
-                "name": name,
-                "classification": env_classification(&name).as_str(),
-                "status": status.as_str(),
-            })
-        })
-        .collect()
-}
-
-pub(crate) fn env_classification(name: &str) -> ConfigValueClassification {
-    if name.to_ascii_uppercase().contains("PUBLIC") {
-        ConfigValueClassification::Public
-    } else {
-        ConfigValueClassification::Secret
-    }
-}
-
-pub(crate) fn now_rfc3339() -> String {
-    OffsetDateTime::now_utc()
-        .format(&Rfc3339)
-        .expect("UTC timestamp formats as RFC3339")
-}
-
-pub(crate) fn local_env_diagnostics(
-    config: &StandaloneRegistryNotaryConfig,
-    env_report: &EnvFileReport,
-) -> Vec<Diagnostic> {
-    let mut diagnostics = Vec::new();
-    if !config.evidence.claims.is_empty() {
-        diagnostics.push(relay_token_file_diagnostic(config));
-    }
-    for credential in config
-        .auth
-        .api_keys
-        .iter()
-        .chain(config.auth.bearer_tokens.iter())
-    {
-        if let Some(env) = credential.fingerprint.name.as_deref() {
-            diagnostics.push(check_fingerprint_env(env, env_report));
-        }
-    }
-    if let Some(secret_env) = &config.audit.hash_secret_env {
-        diagnostics.push(check_present_env(
-            secret_env,
-            env_report,
-            "audit hash secret",
-        ));
-    }
-    if matches!(config.audit.sink.as_str(), "file" | "jsonl")
-        && !config.deployment.evidence.audit_offhost_shipping
-    {
-        // Once the operator declares off-host shipping over the local file sink,
-        // the deployment gate is cleared and the declared state is visible in
-        // the report's audit_shipping section, so this warning is silenced.
-        diagnostics.push(Diagnostic::warn(
-            "audit file/jsonl sink is local-chain-only",
-            "for beta tamper-evidence, ship audit envelopes off-host via stdout/syslog or declare deployment.evidence.audit_offhost_shipping after external shipping is in place",
-        ));
-    }
-    if config.state.storage == STATE_STORAGE_POSTGRESQL {
-        diagnostics.push(check_present_env(
-            &config.state.postgresql.url_env,
-            env_report,
-            "Notary PostgreSQL URL",
-        ));
-        if config.oid4vci.pre_authorized_code.enabled {
-            diagnostics.push(check_present_env(
-                &config.state.postgresql.sensitive_state_key_env,
-                env_report,
-                "Notary sensitive-state key",
-            ));
-        }
-    }
-    if config.federation.enabled {
-        diagnostics.push(check_present_env(
-            &config.federation.pairwise_subject_hash.secret_env,
-            env_report,
-            "federation pairwise subject hash secret",
-        ));
-    }
-    for (key_id, key) in &config.evidence.signing_keys {
-        if matches!(key.provider, SigningKeyProviderConfig::LocalJwkEnv) && key.status.may_sign() {
-            diagnostics.push(check_local_jwk_env(
-                &key.private_jwk_env,
-                key_id,
-                &key.kid,
-                &key.alg,
-                env_report,
-            ));
-        }
-        if matches!(key.provider, SigningKeyProviderConfig::LocalJwkEnv)
-            && key.status.may_publish()
-            && !key.status.may_sign()
-        {
-            diagnostics.push(check_public_jwk_env(
-                &key.public_jwk_env,
-                key_id,
-                &key.kid,
-                &key.alg,
-                env_report,
-            ));
-        }
-        if matches!(key.provider, SigningKeyProviderConfig::Pkcs11) && key.status.may_sign() {
-            diagnostics.push(check_present_env(
-                &key.pin_env,
-                env_report,
-                &format!("PKCS#11 PIN for signing key {key_id}"),
-            ));
-        }
-        if matches!(key.provider, SigningKeyProviderConfig::Pkcs11) && key.status.may_publish() {
-            diagnostics.push(check_public_jwk_env(
-                &key.public_jwk_env,
-                key_id,
-                &key.kid,
-                &key.alg,
-                env_report,
-            ));
-        }
-    }
-    diagnostics
-}
-
-fn relay_token_file_diagnostic(config: &StandaloneRegistryNotaryConfig) -> Diagnostic {
-    let Some(relay) = config.evidence.relay.as_ref() else {
-        return Diagnostic::fail_with_code(
-            "Relay connection is not configured for Registry-backed claims",
-            "configure evidence.relay before serving Registry-backed claims",
-            NotaryActivationCode::RELAY_CONFIGURATION_INVALID.as_str(),
-        );
-    };
-    match fs::metadata(&relay.token_file) {
-        Ok(metadata) if metadata.is_file() && metadata.len() > 0 => {
-            #[cfg(unix)]
-            if metadata.permissions().mode() & 0o077 != 0 {
-                return Diagnostic::warn_with_code(
-                    "Relay workload token file permits group or other access",
-                    "restrict the mounted workload token to the Notary service account, for example mode 0600",
-                    "notary.relay.credential_permissions",
-                );
-            }
-            Diagnostic::ok("Relay workload token file is present and non-empty")
-        }
-        Ok(_) => Diagnostic::fail_with_code(
-            "Relay workload token file is not a non-empty regular file",
-            "mount a non-empty workload JWT at the configured evidence.relay.token_file path",
-            NotaryActivationCode::RELAY_CREDENTIAL_UNAVAILABLE.as_str(),
-        ),
-        Err(_) => Diagnostic::fail_with_code(
-            "Relay workload token file is unavailable",
-            "mount a readable workload JWT at the configured evidence.relay.token_file path",
-            NotaryActivationCode::RELAY_CREDENTIAL_UNAVAILABLE.as_str(),
-        ),
-    }
-}
-
-pub(crate) fn check_fingerprint_env(env: &str, env_report: &EnvFileReport) -> Diagnostic {
-    match std::env::var(env) {
-        Ok(value) if valid_sha256_hash(&value) => {
-            Diagnostic::ok(format!("{env} is present and valid"))
-        }
-        Ok(_) => Diagnostic::fail(
-            format!("{env} is present but not a sha256:<64 hex> fingerprint"),
-            format!("set {env} using `registry-notary hash-api-key --hash-only`"),
-        ),
-        Err(_) => missing_env_diag(env, env_report, "fingerprint env var"),
-    }
-}
-
-pub(crate) fn check_present_env(env: &str, env_report: &EnvFileReport, label: &str) -> Diagnostic {
-    match std::env::var(env) {
-        Ok(value) if !value.trim().is_empty() => {
-            Diagnostic::ok(format!("{env} is present for {label}"))
-        }
-        Ok(_) => Diagnostic::fail(
-            format!("{env} is present but empty for {label}"),
-            format!("set {env} to a non-empty value"),
-        ),
-        Err(_) => missing_env_diag(env, env_report, label),
-    }
-}
-
-pub(crate) fn check_local_jwk_env(
-    env: &str,
-    key_id: &str,
-    expected_kid: &str,
-    expected_alg: &str,
-    env_report: &EnvFileReport,
-) -> Diagnostic {
-    match std::env::var(env) {
-        Ok(value) => {
-            let result = PrivateJwk::parse(&value)
-                .and_then(|mut jwk| {
-                    if jwk.kid.as_deref().is_some_and(|kid| kid != expected_kid) {
-                        return Err(registry_platform_crypto::JwkError::Invalid("kid mismatch"));
-                    }
-                    if jwk.alg.as_deref().is_some_and(|alg| alg != expected_alg) {
-                        return Err(registry_platform_crypto::JwkError::Invalid("alg mismatch"));
-                    }
-                    jwk.kid = Some(expected_kid.to_string());
-                    jwk.alg = Some(expected_alg.to_string());
-                    Ok(jwk)
-                })
-                .map_err(|err| err.to_string())
-                .and_then(|jwk| LocalJwkSigner::new(jwk).map_err(|err| err.to_string()));
-            match result {
-                Ok(_) => Diagnostic::ok(format!("{env} is a usable local JWK for {key_id}")),
-                Err(err) => Diagnostic::fail_with_code(
-                    format!("{env} is not a usable local JWK for {key_id}: {err}"),
-                    "generate a local demo key with `registry-notary demo-issuer-key`",
-                    NotaryActivationCode::CONFIGURATION_INVALID.as_str(),
-                ),
-            }
-        }
-        Err(_) => missing_env_diag(env, env_report, &format!("local JWK for {key_id}")),
-    }
-}
-
-pub(crate) fn check_public_jwk_env(
-    env: &str,
-    key_id: &str,
-    expected_kid: &str,
-    expected_alg: &str,
-    env_report: &EnvFileReport,
-) -> Diagnostic {
-    match std::env::var(env) {
-        Ok(value) => {
-            let result = PublicJwk::parse(&value).and_then(|jwk| {
-                if jwk.kid.as_deref() != Some(expected_kid) {
-                    return Err(registry_platform_crypto::JwkError::Invalid("kid mismatch"));
-                }
-                if jwk.alg.as_deref() != Some(expected_alg) {
-                    return Err(registry_platform_crypto::JwkError::Invalid("alg mismatch"));
-                }
-                Ok(jwk)
-            });
-            match result {
-                Ok(_) => Diagnostic::ok(format!("{env} is a usable public JWK for {key_id}")),
-                Err(err) => Diagnostic::fail_with_code(
-                    format!("{env} is not a usable public JWK for {key_id}: {err}"),
-                    "set it to a public JWK with the configured kid",
-                    NotaryActivationCode::CONFIGURATION_INVALID.as_str(),
-                ),
-            }
-        }
-        Err(_) => missing_env_diag(env, env_report, &format!("public JWK for {key_id}")),
-    }
-}
-
-pub(crate) fn missing_env_diag(env: &str, env_report: &EnvFileReport, label: &str) -> Diagnostic {
-    let source_hint = if env_report.contains(env) {
-        "it was named in --env-file but not loaded because the process value was absent or empty"
-    } else {
-        "it was absent from the process and not present in --env-file"
-    };
-    Diagnostic::fail(
-        format!("{env} is missing for {label}"),
-        format!("set {env}; {source_hint}"),
-    )
-}
-
-pub(crate) fn valid_sha256_hash(value: &str) -> bool {
-    let Some(hex) = value.strip_prefix("sha256:") else {
-        return false;
-    };
-    hex.len() == 64 && hex.chars().all(|ch| ch.is_ascii_hexdigit())
-}
-
-pub(crate) fn vc_diagnostics(
-    config: &StandaloneRegistryNotaryConfig,
-    issue_demo_vc: bool,
-) -> Vec<Diagnostic> {
-    let claim_ids: BTreeSet<&str> = config
-        .evidence
-        .claims
-        .iter()
-        .map(|claim| claim.id.as_str())
-        .collect();
-    let mut diagnostics = Vec::new();
-    for (profile_id, profile) in &config.evidence.credential_profiles {
-        for claim_id in &profile.allowed_claims {
-            if !claim_ids.contains(claim_id.as_str()) {
-                diagnostics.push(Diagnostic::fail(
-                    format!("{profile_id} allows unknown claim {claim_id}"),
-                    "remove the claim id or add the claim definition",
-                ));
-                continue;
-            }
-            let claim = config
-                .evidence
-                .claims
-                .iter()
-                .find(|claim| claim.id == *claim_id)
-                .expect("claim was checked above");
-            if !claim
-                .credential_profiles
-                .iter()
-                .any(|configured| configured == profile_id)
-            {
-                diagnostics.push(Diagnostic::fail(
-                    format!("{claim_id} does not opt into credential profile {profile_id}"),
-                    "add the profile id to the claim credential_profiles list",
-                ));
-            } else {
-                diagnostics.push(Diagnostic::ok(format!(
-                    "{profile_id} can issue claim {claim_id}"
-                )));
-            }
-        }
-    }
-    if issue_demo_vc {
-        diagnostics.push(Diagnostic::ok(
-            "local VC wiring checked; demo credential issuance requires an HTTP request with a holder proof when configured",
-        ));
-    }
-    diagnostics
-}
-
-pub(crate) async fn live_diagnostics(config: &StandaloneRegistryNotaryConfig) -> Vec<Diagnostic> {
-    let mut diagnostics = Vec::new();
-    if !config.evidence.claims.is_empty() {
-        diagnostics.push(match verify_relay_from_config(config).await {
-            Ok(true) => {
-                Diagnostic::ok("Relay workload credential and pinned consultation profile verified")
-            }
-            Ok(false) => Diagnostic::fail_with_code(
-                "Relay activation plan did not include Registry-backed claims",
-                "check the Registry-backed claim and evidence.relay configuration",
-                NotaryActivationCode::RELAY_CONFIGURATION_INVALID.as_str(),
-            ),
-            Err(error) => relay_live_failure_diagnostic(&error),
-        });
-    }
-    if diagnostics.is_empty() {
-        diagnostics.push(Diagnostic::ok(
-            "live Relay probe skipped because no Registry-backed claim is configured",
-        ));
-    }
-    diagnostics
-}
-
-fn relay_live_failure_diagnostic(error: &StandaloneServerError) -> Diagnostic {
-    let definition = error.activation_code().definition();
-    Diagnostic::fail_with_code(
-        definition.meaning,
-        definition.remediation,
-        definition.code.as_str(),
-    )
-}
-
-#[cfg(test)]
-#[path = "doctor/tests.rs"]
-mod tests;
diff --git a/crates/registry-notary/src/doctor/tests.rs b/crates/registry-notary/src/doctor/tests.rs
deleted file mode 100644
index 80aadb455..000000000
--- a/crates/registry-notary/src/doctor/tests.rs
+++ /dev/null
@@ -1,574 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-use crate::test_support::*;
-
-#[test]
-fn doctor_cli_defaults_to_text_format() {
-    let args = Args::try_parse_from(["registry-notary", "doctor"]).expect("args parse");
-    let Some(Command::Doctor { format, .. }) = args.command else {
-        panic!("expected doctor command");
-    };
-
-    assert_eq!(format, DoctorOutputFormat::Text);
-}
-
-#[test]
-fn doctor_cli_accepts_json_format() {
-    let args = Args::try_parse_from(["registry-notary", "doctor", "--format", "json"])
-        .expect("args parse");
-    let Some(Command::Doctor { format, .. }) = args.command else {
-        panic!("expected doctor command");
-    };
-
-    assert_eq!(format, DoctorOutputFormat::Json);
-}
-
-#[test]
-fn doctor_cli_accepts_profile_override() {
-    let args = Args::try_parse_from(["registry-notary", "doctor", "--profile", "production"])
-        .expect("args parse");
-    let Some(Command::Doctor { profile, .. }) = args.command else {
-        panic!("expected doctor command");
-    };
-
-    assert_eq!(profile.as_deref(), Some("production"));
-}
-
-#[test]
-fn doctor_cli_rejects_unknown_format() {
-    let err = Args::try_parse_from(["registry-notary", "doctor", "--format", "pretty"])
-        .expect_err("unknown doctor format is rejected");
-
-    assert!(err.to_string().contains("text"));
-    assert!(err.to_string().contains("json"));
-}
-
-#[test]
-fn redaction_covers_pin_key_and_credential_names() {
-    let mut value = json!({
-        "pin": "1234",
-        "password_env": "PKCS12_PASSWORD_ENV_NAME",
-        "key": "plain-key",
-        "credential": "raw-credential",
-        "credential_env": "SOURCE_CREDENTIAL",
-        "api_keys": [{
-            "id": "api-key-id",
-            "scopes": ["claims:read"]
-        }],
-        "signing_keys": {
-            "active": {
-                "status": "active",
-                "public_key_id": "public-key-id"
-            }
-        },
-        "nested": {
-            "public_key": "public-material",
-            "source_credential": "source-secret",
-            "safe": "visible"
-        }
-    });
-
-    redact_value(&mut value);
-
-    assert_eq!(value["pin"], json!("[redacted]"));
-    assert_eq!(value["password_env"], json!("[redacted]"));
-    assert_eq!(value["key"], json!("[redacted]"));
-    assert_eq!(value["credential"], json!("[redacted]"));
-    assert_eq!(value["credential_env"], json!("[redacted]"));
-    assert_eq!(value["nested"]["public_key"], json!("[redacted]"));
-    assert_eq!(value["nested"]["source_credential"], json!("[redacted]"));
-    assert_eq!(value["nested"]["safe"], json!("visible"));
-    assert_eq!(value["api_keys"][0]["id"], json!("api-key-id"));
-    assert_eq!(value["api_keys"][0]["scopes"][0], json!("claims:read"));
-    assert_eq!(value["signing_keys"]["active"]["status"], json!("active"));
-    assert_eq!(
-        value["signing_keys"]["active"]["public_key_id"],
-        json!("[redacted]")
-    );
-}
-
-#[test]
-fn local_file_audit_sink_emits_beta_tamper_evidence_warning() {
-    let mut config = notary_test_config();
-    config.audit.sink = "jsonl".to_string();
-
-    let diagnostics = local_env_diagnostics(&config, &EnvFileReport::default());
-
-    let warning = diagnostics
-        .iter()
-        .find(|diagnostic| diagnostic.label.contains("local-chain-only"))
-        .expect("audit file warning exists");
-    assert!(warning.ok);
-    assert!(warning.warning);
-    assert!(warning
-        .action
-        .as_deref()
-        .expect("warning has next action")
-        .contains("off-host"));
-}
-
-#[test]
-fn attested_local_file_audit_sink_suppresses_beta_tamper_evidence_warning() {
-    let mut config = notary_test_config();
-    config.audit.sink = "jsonl".to_string();
-    config.deployment.evidence.audit_offhost_shipping = true;
-
-    let diagnostics = local_env_diagnostics(&config, &EnvFileReport::default());
-
-    assert!(
-        !diagnostics
-            .iter()
-            .any(|diagnostic| diagnostic.label.contains("local-chain-only")),
-        "declaring off-host shipping must silence the local-chain-only warning"
-    );
-}
-
-fn doctor_relay_config(token_file: PathBuf) -> StandaloneRegistryNotaryConfig {
-    let mut config = notary_test_config();
-    config.evidence.claims[0].evidence_mode =
-        registry_notary_core::ClaimEvidenceMode::RegistryBacked {
-            consultations: std::collections::BTreeMap::new(),
-        };
-    config.evidence.relay = Some(registry_notary_core::RelayConnectionConfig {
-        base_url: "http://127.0.0.1:1".to_string(),
-        root_certificate_path: None,
-        workload_client_id: "registry-notary".to_string(),
-        token_file,
-        allowed_private_cidrs: Vec::new(),
-        allow_insecure_localhost: true,
-        allow_insecure_private_network: false,
-        max_in_flight: 8,
-    });
-    config
-}
-
-#[test]
-fn relay_token_file_diagnostic_is_safe_and_requires_non_empty_regular_file() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let token_file = tmp.path().join("do-not-report-this-token-path.jwt");
-    let config = doctor_relay_config(token_file.clone());
-
-    let missing = relay_token_file_diagnostic(&config);
-    assert!(!missing.ok);
-    assert_eq!(
-        missing.report_code.as_deref(),
-        Some("notary.relay.credential_unavailable")
-    );
-    let missing_text = format!(
-        "{} {}",
-        missing.label,
-        missing.action.as_deref().unwrap_or_default()
-    );
-    assert!(!missing_text.contains("do-not-report-this-token-path"));
-
-    std::fs::write(&token_file, "").expect("empty token file writes");
-    assert!(!relay_token_file_diagnostic(&config).ok);
-
-    std::fs::write(&token_file, "header.payload.signature").expect("token file writes");
-    let permissive = relay_token_file_diagnostic(&config);
-    assert!(permissive.ok);
-    #[cfg(unix)]
-    {
-        assert!(permissive.warning);
-        assert_eq!(
-            permissive.report_code.as_deref(),
-            Some("notary.relay.credential_permissions")
-        );
-        std::fs::set_permissions(
-            &token_file,
-            <std::fs::Permissions as std::os::unix::fs::PermissionsExt>::from_mode(0o600),
-        )
-        .expect("token permissions are restricted");
-        let private = relay_token_file_diagnostic(&config);
-        assert!(private.ok);
-        assert!(!private.warning);
-    }
-}
-
-#[test]
-fn relay_live_failures_have_stable_safe_categories() {
-    let cases = [
-        (
-            StandaloneServerError::RelayCredentialUnavailable,
-            "notary.relay.credential_unavailable",
-        ),
-        (
-            StandaloneServerError::RelayCredentialsRejected,
-            "notary.relay.credentials_rejected",
-        ),
-        (
-            StandaloneServerError::RelayProfileNotFound,
-            "notary.relay.profile_not_found",
-        ),
-        (
-            StandaloneServerError::RelayProfileMismatch,
-            "notary.relay.profile_mismatch",
-        ),
-        (
-            StandaloneServerError::RelayUnavailable,
-            "notary.relay.unavailable",
-        ),
-        (
-            StandaloneServerError::InvalidRelayActivationPlan,
-            "notary.relay.configuration_invalid",
-        ),
-        (
-            StandaloneServerError::RelayActivation,
-            "notary.relay.activation_failed",
-        ),
-    ];
-
-    for (error, expected_code) in cases {
-        let diagnostic = relay_live_failure_diagnostic(&error);
-        assert!(!diagnostic.ok);
-        assert_eq!(diagnostic.report_code.as_deref(), Some(expected_code));
-        assert_eq!(diagnostic.report_severity, Some("error"));
-    }
-}
-
-#[test]
-fn notary_audit_shipping_reports_stdout_sink_as_shipped() {
-    let mut config = notary_test_config();
-    config.audit.sink = "stdout".to_string();
-
-    let shipping = notary_audit_shipping(&config);
-
-    assert_eq!(shipping["sink_type"], "stdout");
-    assert_eq!(shipping["shipping_target_configured"], true);
-    assert_eq!(shipping["shipping_target"], "stdout");
-    // A shipping target is declared but no ack cursor is configured.
-    assert_eq!(shipping["shipping_health"], "unverified");
-    assert_eq!(shipping["shipping_observed_at"], Value::Null);
-}
-
-#[test]
-fn notary_audit_shipping_reports_local_file_sink_without_attestation_as_unshipped() {
-    let mut config = notary_test_config();
-    config.audit.sink = "jsonl".to_string();
-    config.deployment.evidence.audit_offhost_shipping = false;
-
-    let shipping = notary_audit_shipping(&config);
-
-    assert_eq!(shipping["sink_type"], "file");
-    assert_eq!(shipping["shipping_target_configured"], false);
-    assert_eq!(shipping["shipping_target"], "none");
-    // No shipping target is configured, so health is null.
-    assert_eq!(shipping["shipping_health"], Value::Null);
-    assert_eq!(shipping["shipping_observed_at"], Value::Null);
-}
-
-#[test]
-fn notary_audit_shipping_reports_attested_local_file_sink_as_declared_external() {
-    let mut config = notary_test_config();
-    config.audit.sink = "file".to_string();
-    config.deployment.evidence.audit_offhost_shipping = true;
-
-    let shipping = notary_audit_shipping(&config);
-
-    assert_eq!(shipping["sink_type"], "file");
-    assert_eq!(shipping["shipping_target_configured"], true);
-    assert_eq!(shipping["shipping_target"], "declared_external");
-    // declared_external with no ack cursor: shipping is declared but unobserved.
-    assert_eq!(shipping["shipping_health"], "unverified");
-    assert_eq!(shipping["shipping_observed_at"], Value::Null);
-}
-
-#[test]
-fn notary_audit_shipping_maps_unrecognized_sink_to_unknown() {
-    let mut config = notary_test_config();
-    config.audit.sink = "s3".to_string();
-
-    let shipping = notary_audit_shipping(&config);
-
-    assert_eq!(shipping["sink_type"], "unknown");
-    assert_eq!(shipping["shipping_target_configured"], false);
-    assert_eq!(shipping["shipping_target"], "unknown");
-    assert_eq!(shipping["shipping_health"], Value::Null);
-    assert_eq!(shipping["shipping_observed_at"], Value::Null);
-}
-
-/// Write a `registry.audit.ack_cursor.v1` cursor with `acked_at` and return
-/// its path, so doctor shipping-health tests can drive each observation.
-fn write_doctor_ack_cursor(tmp: &tempfile::TempDir, acked_at: &str) -> std::path::PathBuf {
-    let path = tmp.path().join("ack-cursor.json");
-    let body = format!(
-        r#"{{"schema":"registry.audit.ack_cursor.v1","acked_at":"{acked_at}","last_acked_hash":"sha256:4444444444444444444444444444444444444444444444444444444444444444","writer":"test-shipper"}}"#
-    );
-    std::fs::write(&path, body).expect("ack cursor writes");
-    path
-}
-
-#[test]
-fn notary_audit_shipping_reports_unverified_for_fresh_offline_cursor() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let acked_at = OffsetDateTime::now_utc()
-        .format(&Rfc3339)
-        .expect("now formats");
-    let cursor = write_doctor_ack_cursor(&tmp, &acked_at);
-    let mut config = notary_test_config();
-    config.audit.sink = "stdout".to_string();
-    config.deployment.evidence.audit_ack_cursor_path = Some(cursor);
-
-    let shipping = notary_audit_shipping(&config);
-
-    assert_eq!(shipping["shipping_health"], "unverified");
-    assert_eq!(shipping["shipping_observed_at"], acked_at);
-}
-
-#[test]
-fn notary_audit_shipping_reports_stale_for_old_cursor() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    // Far past the default 900s window relative to any plausible test clock.
-    let cursor = write_doctor_ack_cursor(&tmp, "2026-06-04T09:59:00Z");
-    let mut config = notary_test_config();
-    config.audit.sink = "stdout".to_string();
-    config.deployment.evidence.audit_ack_cursor_path = Some(cursor);
-
-    let shipping = notary_audit_shipping(&config);
-
-    assert_eq!(shipping["shipping_health"], "stale");
-    assert_eq!(shipping["shipping_observed_at"], "2026-06-04T09:59:00Z");
-}
-
-#[test]
-fn notary_audit_shipping_reports_missing_for_absent_cursor_file() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let cursor = tmp.path().join("does-not-exist.json");
-    let mut config = notary_test_config();
-    config.audit.sink = "stdout".to_string();
-    config.deployment.evidence.audit_ack_cursor_path = Some(cursor);
-
-    let shipping = notary_audit_shipping(&config);
-
-    assert_eq!(shipping["shipping_health"], "missing");
-    assert_eq!(shipping["shipping_observed_at"], Value::Null);
-}
-
-#[test]
-fn notary_audit_shipping_reports_invalid_for_malformed_cursor_file() {
-    let tmp = tempfile::TempDir::new().expect("tempdir");
-    let cursor = tmp.path().join("ack-cursor.json");
-    std::fs::write(&cursor, "{ not valid json").expect("cursor writes");
-    let mut config = notary_test_config();
-    config.audit.sink = "stdout".to_string();
-    config.deployment.evidence.audit_ack_cursor_path = Some(cursor);
-
-    let shipping = notary_audit_shipping(&config);
-
-    assert_eq!(shipping["shipping_health"], "invalid");
-    assert_eq!(shipping["shipping_observed_at"], Value::Null);
-}
-
-#[test]
-fn doctor_pkcs11_preflight_attempts_module_loading() {
-    let _guard = ENV_LOCK.lock().expect("env lock is not poisoned");
-    std::env::set_var(
-        "TEST_DOCTOR_PKCS11_PUBLIC_JWK",
-        r#"{"kty":"OKP","crv":"Ed25519","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"did:web:issuer.example#hsm"}"#,
-    );
-    std::env::set_var("TEST_DOCTOR_PKCS11_PIN", "1234");
-    let mut config = notary_test_config();
-    config.evidence.signing_keys.insert(
-        "hsm-key".to_string(),
-        registry_notary_core::SigningKeyConfig {
-            provider: SigningKeyProviderConfig::Pkcs11,
-            alg: "EdDSA".to_string(),
-            kid: "did:web:issuer.example#hsm".to_string(),
-            status: registry_notary_core::SigningKeyStatus::Active,
-            publish_until_unix_seconds: None,
-            private_jwk_env: String::new(),
-            public_jwk_env: "TEST_DOCTOR_PKCS11_PUBLIC_JWK".to_string(),
-            module_path: "/definitely/missing/pkcs11.so".to_string(),
-            token_label: "registry-notary".to_string(),
-            pin_env: "TEST_DOCTOR_PKCS11_PIN".to_string(),
-            key_label: "issuer-signing-key".to_string(),
-            key_id_hex: "01ab23cd".to_string(),
-            path: String::new(),
-            password_env: String::new(),
-        },
-    );
-
-    let diagnostic =
-        pkcs11_preflight_diagnostic(&config).expect("active PKCS#11 key triggers preflight");
-
-    assert!(!diagnostic.ok);
-    assert!(diagnostic
-        .label
-        .contains("PKCS#11 signing preflight failed"));
-    assert!(
-        diagnostic.label.contains("could not load PKCS#11 module")
-            || diagnostic
-                .label
-                .contains("provider 'pkcs11' is not enabled"),
-        "unexpected diagnostic: {}",
-        diagnostic.label
-    );
-    std::env::remove_var("TEST_DOCTOR_PKCS11_PUBLIC_JWK");
-    std::env::remove_var("TEST_DOCTOR_PKCS11_PIN");
-}
-
-#[test]
-fn public_jwk_diagnostic_rejects_mismatched_kid() {
-    let env = format!("TEST_REGISTRY_NOTARY_PUBLIC_JWK_{}", Ulid::new());
-    unsafe {
-        std::env::set_var(
-            &env,
-            json!({
-                "kty": "OKP",
-                "crv": "Ed25519",
-                "x": "11qYAYdkdABYXknkTDYUs_NflZt9-QJxBWpukhfQq8Q",
-                "alg": "EdDSA",
-                "kid": "did:web:issuer.example#wrong"
-            })
-            .to_string(),
-        );
-    }
-
-    let diagnostic = check_public_jwk_env(
-        &env,
-        "hsm-key",
-        "did:web:issuer.example#expected",
-        "EdDSA",
-        &EnvFileReport::default(),
-    );
-    unsafe {
-        std::env::remove_var(&env);
-    }
-
-    assert!(!diagnostic.ok);
-    assert!(diagnostic.label.contains("kid mismatch"));
-}
-
-#[test]
-fn public_jwk_diagnostic_rejects_missing_alg() {
-    let env = format!("TEST_REGISTRY_NOTARY_PUBLIC_JWK_{}", Ulid::new());
-    unsafe {
-        std::env::set_var(
-            &env,
-            json!({
-                "kty": "OKP",
-                "crv": "Ed25519",
-                "x": "11qYAYdkdABYXknkTDYUs_NflZt9-QJxBWpukhfQq8Q",
-                "kid": "did:web:issuer.example#key-1"
-            })
-            .to_string(),
-        );
-    }
-
-    let diagnostic = check_public_jwk_env(
-        &env,
-        "hsm-key",
-        "did:web:issuer.example#key-1",
-        "EdDSA",
-        &EnvFileReport::default(),
-    );
-    unsafe {
-        std::env::remove_var(&env);
-    }
-
-    assert!(!diagnostic.ok);
-    assert!(diagnostic.label.contains("alg mismatch"));
-}
-
-#[test]
-fn local_jwk_diagnostic_rejects_mismatched_alg() {
-    let env = format!("TEST_REGISTRY_NOTARY_PRIVATE_JWK_{}", Ulid::new());
-    unsafe {
-        std::env::set_var(
-            &env,
-            json!({
-                "kty": "OKP",
-                "crv": "Ed25519",
-                "d": "2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw",
-                "x": "1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc",
-                "alg": "RS256",
-                "kid": "did:web:issuer.example#key-1"
-            })
-            .to_string(),
-        );
-    }
-
-    let diagnostic = check_local_jwk_env(
-        &env,
-        "issuer-key",
-        "did:web:issuer.example#key-1",
-        "EdDSA",
-        &EnvFileReport::default(),
-    );
-    unsafe {
-        std::env::remove_var(&env);
-    }
-
-    assert!(!diagnostic.ok);
-    assert!(
-        diagnostic.label.contains("alg mismatch") || diagnostic.label.contains("usable local JWK")
-    );
-}
-
-#[test]
-fn doctor_parse_expanded_config_surfaces_disclosure_default_violation() {
-    // GH#170 / RS-DM-CLAIM Section 10: `registry-notary doctor` calls
-    // parse_expanded_config (see the `doctor` function above), which rejects
-    // a disclosure default that is not a member of the claim's allowed set.
-    let raw = r#"
-deployment:
-  profile: local
-server:
-  bind: 127.0.0.1:0
-auth:
-  api_keys:
-    - id: local
-      fingerprint:
-        provider: env
-        name: TEST_DOCTOR_API_HASH
-      scopes: [registry_notary:credential_issue]
-audit:
-  sink: stdout
-evidence:
-  enabled: true
-  service_id: doctor-disclosure-test
-  allowed_purposes: [doctor-test]
-  relay:
-    base_url: https://relay.internal.example
-    workload_client_id: registry-notary
-    token_file: /run/secrets/registry-notary-relay.jwt
-  claims:
-    - id: registry-backed-test
-      title: Registry-backed test
-      version: 2026-05
-      subject_type: person
-      purpose: doctor-test
-      required_scopes: [registry_notary:credential_issue]
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          test_source:
-            profile:
-              id: example.test-source.exact
-              contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-            inputs:
-              subject_id: target.id
-            outputs:
-              active: { type: boolean, nullable: false }
-      value:
-        type: boolean
-        nullable: false
-      rule:
-        type: consultation_matched
-        consultation: test_source
-      disclosure:
-        default: value
-        allowed: [redacted]
-      formats:
-        - application/vnd.registry-notary.claim-result+json
-"#;
-
-    let err = parse_expanded_config(raw)
-        .expect_err("disclosure default outside allowed must fail at the doctor entrypoint");
-    let message = err.to_string();
-    assert!(
-        message.contains("registry-backed-test") && message.contains("disclosure"),
-        "doctor-facing error must name the offending claim id and field: {message}"
-    );
-}
diff --git a/crates/registry-notary/src/env_file.rs b/crates/registry-notary/src/env_file.rs
deleted file mode 100644
index 5feec0a79..000000000
--- a/crates/registry-notary/src/env_file.rs
+++ /dev/null
@@ -1,135 +0,0 @@
-use crate::*;
-
-#[derive(Debug, Default, Clone)]
-pub(crate) struct EnvFileReport {
-    pub(crate) loaded: BTreeSet<String>,
-    pub(crate) skipped_existing: BTreeSet<String>,
-}
-
-impl EnvFileReport {
-    pub(crate) fn contains(&self, key: &str) -> bool {
-        self.loaded.contains(key) || self.skipped_existing.contains(key)
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct EnvFileError {
-    pub(crate) line: usize,
-    pub(crate) reason: String,
-}
-
-impl fmt::Display for EnvFileError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "invalid env file at line {}: {}", self.line, self.reason)
-    }
-}
-
-impl std::error::Error for EnvFileError {}
-
-pub(crate) fn load_env_file_arg(
-    env_file: Option<&Path>,
-    override_existing: bool,
-) -> Result<EnvFileReport, Box<dyn std::error::Error>> {
-    let Some(path) = env_file else {
-        return Ok(EnvFileReport::default());
-    };
-    let raw = fs::read_to_string(path)?;
-    apply_env_file(&raw, override_existing).map_err(Into::into)
-}
-
-pub(crate) fn apply_env_file(
-    raw: &str,
-    override_existing: bool,
-) -> Result<EnvFileReport, EnvFileError> {
-    let mut report = EnvFileReport::default();
-    for (key, value) in parse_env_file(raw)? {
-        if std::env::var_os(&key).is_some() && !override_existing {
-            report.skipped_existing.insert(key);
-        } else {
-            std::env::set_var(&key, value);
-            report.loaded.insert(key);
-        }
-    }
-    Ok(report)
-}
-
-pub(crate) fn parse_env_file(raw: &str) -> Result<Vec<(String, String)>, EnvFileError> {
-    let mut values = Vec::new();
-    for (idx, line) in raw.lines().enumerate() {
-        let line_no = idx + 1;
-        let line = line.trim();
-        if line.is_empty() || line.starts_with('#') {
-            continue;
-        }
-        let line = line.strip_prefix("export ").unwrap_or(line).trim_start();
-        let Some((key, value)) = line.split_once('=') else {
-            return Err(env_file_error(line_no, "expected KEY=VALUE"));
-        };
-        let key = key.trim();
-        if !valid_env_key(key) {
-            return Err(env_file_error(line_no, "invalid env var name"));
-        }
-        values.push((key.to_string(), parse_env_value(value.trim(), line_no)?));
-    }
-    Ok(values)
-}
-
-pub(crate) fn parse_env_value(value: &str, line: usize) -> Result<String, EnvFileError> {
-    if let Some(rest) = value.strip_prefix('"') {
-        let Some(end) = closing_quote_index(rest, '"', true) else {
-            return Err(env_file_error(line, "unterminated double-quoted value"));
-        };
-        if !rest[end + 1..].trim().is_empty() && !rest[end + 1..].trim().starts_with('#') {
-            return Err(env_file_error(line, "unexpected text after quoted value"));
-        }
-        return Ok(rest[..end]
-            .replace("\\n", "\n")
-            .replace("\\\"", "\"")
-            .replace("\\\\", "\\"));
-    }
-    if let Some(rest) = value.strip_prefix('\'') {
-        let Some(end) = closing_quote_index(rest, '\'', false) else {
-            return Err(env_file_error(line, "unterminated single-quoted value"));
-        };
-        if !rest[end + 1..].trim().is_empty() && !rest[end + 1..].trim().starts_with('#') {
-            return Err(env_file_error(line, "unexpected text after quoted value"));
-        }
-        return Ok(rest[..end].to_string());
-    }
-    Ok(value
-        .split_once(" #")
-        .map(|(before, _)| before)
-        .unwrap_or(value)
-        .trim()
-        .to_string())
-}
-
-pub(crate) fn closing_quote_index(rest: &str, quote: char, allow_escape: bool) -> Option<usize> {
-    let mut chars = rest.char_indices();
-    while let Some((idx, ch)) = chars.next() {
-        if allow_escape && ch == '\\' {
-            let _ = chars.next();
-            continue;
-        }
-        if ch == quote {
-            return Some(idx);
-        }
-    }
-    None
-}
-
-pub(crate) fn valid_env_key(key: &str) -> bool {
-    let mut chars = key.chars();
-    matches!(chars.next(), Some('_') | Some('A'..='Z') | Some('a'..='z'))
-        && chars.all(|ch| matches!(ch, '_' | 'A'..='Z' | 'a'..='z' | '0'..='9'))
-}
-
-pub(crate) fn env_file_error(line: usize, reason: &str) -> EnvFileError {
-    EnvFileError {
-        line,
-        reason: reason.to_string(),
-    }
-}
-#[cfg(test)]
-#[path = "env_file/tests.rs"]
-mod tests;
diff --git a/crates/registry-notary/src/env_file/tests.rs b/crates/registry-notary/src/env_file/tests.rs
deleted file mode 100644
index 1833b2163..000000000
--- a/crates/registry-notary/src/env_file/tests.rs
+++ /dev/null
@@ -1,79 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-
-#[test]
-fn env_file_parses_quotes_export_and_comments() {
-    let parsed = parse_env_file(
-        r#"
-# comment
-export API_HASH=sha256:abc # inline
-CLIENT_ID="client value"
-CLIENT_SECRET='secret value'
-"#,
-    )
-    .expect("env file parses");
-    assert_eq!(
-        parsed,
-        vec![
-            ("API_HASH".to_string(), "sha256:abc".to_string()),
-            ("CLIENT_ID".to_string(), "client value".to_string()),
-            ("CLIENT_SECRET".to_string(), "secret value".to_string()),
-        ]
-    );
-}
-
-#[test]
-fn env_file_ignores_quotes_inside_trailing_comments() {
-    let parsed = parse_env_file(
-        r#"
-DOUBLE="client value" # comment with "quote"
-SINGLE='secret value' # comment with 'quote'
-ESCAPED="client \"quoted\" value" # comment with "quote"
-"#,
-    )
-    .expect("env file parses");
-    assert_eq!(
-        parsed,
-        vec![
-            ("DOUBLE".to_string(), "client value".to_string()),
-            ("SINGLE".to_string(), "secret value".to_string()),
-            ("ESCAPED".to_string(), "client \"quoted\" value".to_string()),
-        ]
-    );
-}
-
-#[test]
-fn env_file_rejects_malformed_line_with_line_number() {
-    let err = parse_env_file("GOOD=value\nnot valid\n").expect_err("line 2 fails");
-    assert_eq!(err.line, 2);
-    assert!(err.to_string().contains("line 2"));
-}
-
-#[test]
-fn env_file_does_not_overwrite_by_default() {
-    std::env::set_var("RN_ENV_FILE_NO_OVERWRITE_TEST", "process");
-    let report =
-        apply_env_file("RN_ENV_FILE_NO_OVERWRITE_TEST=file\n", false).expect("env file applies");
-    assert_eq!(
-        std::env::var("RN_ENV_FILE_NO_OVERWRITE_TEST").expect("env var exists"),
-        "process"
-    );
-    assert!(report
-        .skipped_existing
-        .contains("RN_ENV_FILE_NO_OVERWRITE_TEST"));
-    std::env::remove_var("RN_ENV_FILE_NO_OVERWRITE_TEST");
-}
-
-#[test]
-fn env_file_override_replaces_existing_process_value() {
-    std::env::set_var("RN_ENV_FILE_OVERRIDE_TEST", "process");
-    let report =
-        apply_env_file("RN_ENV_FILE_OVERRIDE_TEST=file\n", true).expect("env file applies");
-    assert_eq!(
-        std::env::var("RN_ENV_FILE_OVERRIDE_TEST").expect("env var exists"),
-        "file"
-    );
-    assert!(report.loaded.contains("RN_ENV_FILE_OVERRIDE_TEST"));
-    std::env::remove_var("RN_ENV_FILE_OVERRIDE_TEST");
-}
diff --git a/crates/registry-notary/src/explain_config.rs b/crates/registry-notary/src/explain_config.rs
deleted file mode 100644
index f9178f2e0..000000000
--- a/crates/registry-notary/src/explain_config.rs
+++ /dev/null
@@ -1,291 +0,0 @@
-use crate::*;
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, ValueEnum)]
-pub(crate) enum ExplainConfigOutputFormat {
-    Json,
-    Text,
-}
-
-impl fmt::Display for ExplainConfigOutputFormat {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::Json => f.write_str("json"),
-            Self::Text => f.write_str("text"),
-        }
-    }
-}
-
-pub(crate) fn explain_config(
-    config_path: &Path,
-    env_report: &EnvFileReport,
-    bind_override: Option<SocketAddr>,
-    format: ExplainConfigOutputFormat,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let raw = fs::read_to_string(config_path)?;
-    let mut config = parse_expanded_config(&raw)?;
-    apply_bind_override(&mut config, bind_override);
-    match format {
-        ExplainConfigOutputFormat::Json => {
-            println!(
-                "{}",
-                serde_json::to_string_pretty(&config_explanation_json(
-                    config_path,
-                    &raw,
-                    &config,
-                    env_report,
-                ))?
-            );
-        }
-        ExplainConfigOutputFormat::Text => {
-            println!(
-                "{}",
-                serde_json::to_string_pretty(&redacted_config(&config))?
-            );
-            println!();
-            println!("Required env vars:");
-            for env in required_env_vars(&config) {
-                let status = if std::env::var_os(&env).is_some() {
-                    "present"
-                } else if env_report.contains(&env) {
-                    "from env-file"
-                } else {
-                    "missing"
-                };
-                println!("- {env}: {status}");
-            }
-            println!("Relay connection:");
-            println!(
-                "- {}",
-                serde_json::to_string(&notary_relay_connection_report(&config))?
-            );
-            println!();
-            println!("Relay consultations:");
-            for consultation in notary_relay_consultations_report(&config) {
-                println!("- {}", serde_json::to_string(&consultation)?);
-            }
-        }
-    }
-    Ok(())
-}
-
-pub(crate) fn config_explanation_json(
-    config_path: &Path,
-    raw_config: &str,
-    config: &StandaloneRegistryNotaryConfig,
-    env_report: &EnvFileReport,
-) -> Value {
-    json!({
-        "schema_version": "registry.config.explanation.v1",
-        "product": "registry-notary",
-        "config_schema_version": NOTARY_CONFIG_SCHEMA_VERSION,
-        "source": {
-            "kind": "local_file",
-            "path": path_for_json(config_path),
-        },
-        "required_env": required_env_report(required_env_vars(config), env_report),
-        "defaults_applied": [],
-        "optional_sections_absent": optional_config_sections_absent(config),
-        "live_apply": notary_live_apply_classes(),
-        "context_constraints": [],
-        "relay_connection": notary_relay_connection_report(config),
-        "relay_consultations": notary_relay_consultations_report(config),
-        "resolved_config": redacted_config(config),
-        "hashes": {
-            "internal_config_hash": sha256_hash(raw_config),
-        },
-        "generated_at": now_rfc3339(),
-    })
-}
-
-pub(crate) fn notary_relay_connection_report(config: &StandaloneRegistryNotaryConfig) -> Value {
-    let Some(relay) = &config.evidence.relay else {
-        return Value::Null;
-    };
-    json!({
-        "credential": {
-            "mode": "reloadable_token_file",
-            "reload": "per_operation",
-            "offline_file_status": relay_credential_file_status(&relay.token_file),
-        },
-        "network": {
-            "transport": if relay.base_url.starts_with("https://") {
-                "https"
-            } else {
-                "loopback_http"
-            },
-            "allowed_private_cidr_count": relay.allowed_private_cidrs.len(),
-            "allow_insecure_localhost": relay.allow_insecure_localhost,
-        },
-    })
-}
-
-fn relay_credential_file_status(path: &Path) -> &'static str {
-    match std::fs::metadata(path) {
-        Ok(metadata) if metadata.is_file() => "present",
-        Ok(_) => "not_regular",
-        Err(error) if error.kind() == std::io::ErrorKind::NotFound => "missing",
-        Err(_) => "unreadable",
-    }
-}
-
-pub(crate) fn optional_config_sections_absent(
-    config: &StandaloneRegistryNotaryConfig,
-) -> Vec<Value> {
-    let mut sections = Vec::new();
-    if config.evidence.relay.is_none() {
-        sections.push(json!({
-            "path": "/evidence/relay",
-            "reason": "no Registry Relay connection configured",
-        }));
-    }
-    if !config.credential_status.enabled {
-        sections.push(json!({
-            "path": "/credential_status",
-            "reason": "credential status is disabled",
-        }));
-    }
-    sections
-}
-
-pub(crate) fn notary_relay_consultations_report(
-    config: &StandaloneRegistryNotaryConfig,
-) -> Vec<Value> {
-    let mut entries = Vec::new();
-    for (claim_index, claim) in config.evidence.claims.iter().enumerate() {
-        let registry_notary_core::ClaimEvidenceMode::RegistryBacked { consultations } =
-            &claim.evidence_mode
-        else {
-            continue;
-        };
-        for (name, consultation) in consultations {
-            entries.push(json!({
-                "container_path": format!(
-                    "/evidence/claims/{claim_index}/evidence_mode/consultations/{}",
-                    json_pointer_segment(name),
-                ),
-                "claim_id": claim.id,
-                "consultation": name,
-                "profile": {
-                    "id": consultation.profile.id,
-                    "contract_hash": consultation.profile.contract_hash,
-                },
-                "purpose": claim.purpose,
-                "required_scopes": claim.required_scopes,
-                "inputs": consultation.inputs,
-            }));
-        }
-    }
-    entries
-}
-
-pub(crate) fn json_pointer_segment(value: &str) -> String {
-    value.replace('~', "~0").replace('/', "~1")
-}
-
-pub(crate) fn notary_live_apply_classes() -> Vec<Value> {
-    vec![
-        json!({
-            "path": "/evidence/relay",
-            "class": LiveApplyClass::RestartRequired.as_str(),
-        }),
-        json!({
-            "path": "/evidence/signing_keys",
-            "class": LiveApplyClass::RestartRequired.as_str(),
-        }),
-        json!({
-            "path": "/server",
-            "class": LiveApplyClass::RestartRequired.as_str(),
-        }),
-        json!({
-            "path": "/config_trust",
-            "class": LiveApplyClass::UnsupportedLiveApply.as_str(),
-        }),
-    ]
-}
-
-pub(crate) fn apply_bind_override(
-    config: &mut StandaloneRegistryNotaryConfig,
-    bind: Option<SocketAddr>,
-) {
-    if let Some(bind) = bind {
-        config.server.bind = bind;
-    }
-}
-
-pub(crate) fn required_env_vars(config: &StandaloneRegistryNotaryConfig) -> BTreeSet<String> {
-    let mut vars = BTreeSet::new();
-    for credential in config
-        .auth
-        .api_keys
-        .iter()
-        .chain(config.auth.bearer_tokens.iter())
-    {
-        if let Some(env) = credential.fingerprint.name.clone() {
-            vars.insert(env);
-        }
-    }
-    if let Some(env) = &config.audit.hash_secret_env {
-        vars.insert(env.clone());
-    }
-    if config.state.storage == STATE_STORAGE_POSTGRESQL {
-        vars.insert(config.state.postgresql.url_env.clone());
-        if config.oid4vci.pre_authorized_code.enabled {
-            vars.insert(config.state.postgresql.sensitive_state_key_env.clone());
-        }
-    }
-    if config.federation.enabled {
-        vars.insert(config.federation.pairwise_subject_hash.secret_env.clone());
-    }
-    for key in config.evidence.signing_keys.values() {
-        if !key.private_jwk_env.trim().is_empty() {
-            vars.insert(key.private_jwk_env.clone());
-        }
-        if !key.public_jwk_env.trim().is_empty() {
-            vars.insert(key.public_jwk_env.clone());
-        }
-        if !key.pin_env.trim().is_empty() {
-            vars.insert(key.pin_env.clone());
-        }
-        if !key.password_env.trim().is_empty() {
-            vars.insert(key.password_env.clone());
-        }
-    }
-    vars
-}
-
-pub(crate) fn redacted_config(config: &StandaloneRegistryNotaryConfig) -> Value {
-    let mut value = serde_json::to_value(config).expect("config serializes");
-    redact_value(&mut value);
-    value
-}
-
-pub(crate) fn redact_value(value: &mut Value) {
-    match value {
-        Value::Object(map) => {
-            for (key, value) in map {
-                let lower = key.to_ascii_lowercase();
-                if ["secret", "token", "jwk", "pin", "password"]
-                    .iter()
-                    .any(|term| lower.contains(term))
-                    || (lower.contains("key") && lower != "signing_keys" && lower != "api_keys")
-                    || lower == "credential"
-                    || lower.ends_with("_credential")
-                    || lower == "credential_env"
-                {
-                    *value = Value::String("[redacted]".to_string());
-                } else {
-                    redact_value(value);
-                }
-            }
-        }
-        Value::Array(values) => {
-            for value in values {
-                redact_value(value);
-            }
-        }
-        _ => {}
-    }
-}
-#[cfg(test)]
-#[path = "explain_config/tests.rs"]
-mod tests;
diff --git a/crates/registry-notary/src/explain_config/tests.rs b/crates/registry-notary/src/explain_config/tests.rs
deleted file mode 100644
index dac98992d..000000000
--- a/crates/registry-notary/src/explain_config/tests.rs
+++ /dev/null
@@ -1,208 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-
-const CONTRACT_HASH: &str =
-    "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
-
-fn relay_config() -> (tempfile::TempDir, PathBuf, StandaloneRegistryNotaryConfig) {
-    let token_directory = tempfile::tempdir().expect("token directory creates");
-    let token_file = token_directory.path().join("relay.jwt");
-    std::fs::write(&token_file, b"opaque-test-token").expect("token file writes");
-    let config: StandaloneRegistryNotaryConfig = serde_norway::from_str(&format!(
-        r#"
-deployment:
-  profile: local
-auth:
-  api_keys:
-    - id: local
-      fingerprint:
-        provider: env
-        name: TEST_NOTARY_API_KEY_HASH
-      scopes: [registry:evidence]
-evidence:
-  enabled: true
-  relay:
-    base_url: https://relay.internal.example
-    workload_client_id: registry-notary
-    token_file: {}
-    allowed_private_cidrs: [10.20.0.0/16]
-  claims:
-    - id: person-status
-      title: Person status
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          person_status:
-            profile:
-              id: example.person-status.exact
-              contract_hash: {CONTRACT_HASH}
-            inputs:
-              tracked_entity: request.target.identifiers.national_id
-              subject_id: target.id
-            outputs:
-              status:
-                type: string
-                nullable: true
-                max_bytes: 64
-      value:
-        type: string
-        nullable: true
-      purpose: benefit-verification
-      required_scopes: [registry:evidence]
-      rule:
-        type: consultation_output
-        consultation: person_status
-        output: status
-"#,
-        token_file.display()
-    ))
-    .expect("Relay config parses");
-    config.validate().expect("Relay config validates");
-    (token_directory, token_file, config)
-}
-
-#[test]
-fn bind_override_replaces_config_bind() {
-    let (_token_directory, _token_file, mut config) = relay_config();
-    config.server.bind = "127.0.0.1:8081".parse().expect("socket addr parses");
-
-    apply_bind_override(
-        &mut config,
-        Some("0.0.0.0:8080".parse().expect("socket addr parses")),
-    );
-
-    assert_eq!(
-        config.server.bind,
-        "0.0.0.0:8080"
-            .parse::<SocketAddr>()
-            .expect("socket addr parses")
-    );
-}
-
-#[test]
-fn relay_configuration_reports_reloadable_credential_and_safe_network_posture() {
-    let (_token_directory, token_file, config) = relay_config();
-    let env_report = EnvFileReport::default();
-    let explanation = config_explanation_json(
-        Path::new("/etc/registry-notary/config.yaml"),
-        "redacted test config",
-        &config,
-        &env_report,
-    );
-
-    assert!(explanation["required_env"]
-        .as_array()
-        .expect("required_env is an array")
-        .iter()
-        .all(|entry| entry["name"] != "REGISTRY_NOTARY_TEST_RELAY_TOKEN"));
-    assert_eq!(
-        explanation["resolved_config"]["evidence"]["relay"]["token_file"],
-        "[redacted]"
-    );
-    assert_eq!(
-        explanation["relay_connection"],
-        json!({
-            "credential": {
-                "mode": "reloadable_token_file",
-                "reload": "per_operation",
-                "offline_file_status": "present",
-            },
-            "network": {
-                "transport": "https",
-                "allowed_private_cidr_count": 1,
-                "allow_insecure_localhost": false,
-            },
-        })
-    );
-    let rendered = serde_json::to_string(&explanation).expect("explanation renders");
-    let token_file_text = token_file.to_string_lossy();
-    assert!(!rendered.contains(token_file_text.as_ref()));
-
-    std::fs::remove_file(&token_file).expect("token file removes");
-    assert_eq!(
-        notary_relay_connection_report(&config)["credential"]["offline_file_status"],
-        "missing"
-    );
-
-    let relay_live_apply = explanation["live_apply"]
-        .as_array()
-        .expect("live_apply is an array")
-        .iter()
-        .find(|entry| entry["path"] == "/evidence/relay")
-        .expect("Relay live-apply classification is reported");
-    assert_eq!(relay_live_apply["class"], "restart_required");
-}
-
-#[test]
-fn relay_backed_explanation_satisfies_shared_schema_and_typed_contract() {
-    let (_token_directory, _token_file, config) = relay_config();
-    let explanation = config_explanation_json(
-        Path::new("/etc/registry-notary/config.yaml"),
-        "redacted test config",
-        &config,
-        &EnvFileReport::default(),
-    );
-
-    let schema: Value = serde_json::from_str(registry_config_report::CONFIG_EXPLANATION_SCHEMA_V1)
-        .expect("explanation schema parses");
-    let validator = jsonschema::JSONSchema::compile(&schema).expect("explanation schema compiles");
-    if let Err(errors) = validator.validate(&explanation) {
-        let messages = errors.map(|error| error.to_string()).collect::<Vec<_>>();
-        panic!("Relay-backed explanation should validate: {messages:?}");
-    }
-
-    let typed: registry_config_report::ConfigExplanationDocument =
-        serde_json::from_value(explanation).expect("Relay-backed explanation decodes strictly");
-    assert_eq!(
-        typed.relay_consultations[0]
-            .inputs
-            .get("tracked_entity")
-            .map(String::as_str),
-        Some("request.target.identifiers.national_id")
-    );
-}
-
-#[test]
-fn relay_consultation_report_exposes_only_pinned_operator_contract() {
-    let (_token_directory, _token_file, config) = relay_config();
-    let report = notary_relay_consultations_report(&config);
-
-    assert_eq!(
-        report,
-        vec![json!({
-            "container_path": "/evidence/claims/0/evidence_mode/consultations/person_status",
-            "claim_id": "person-status",
-            "consultation": "person_status",
-            "profile": {
-                "id": "example.person-status.exact",
-                "contract_hash": CONTRACT_HASH,
-            },
-            "purpose": "benefit-verification",
-            "required_scopes": ["registry:evidence"],
-            "inputs": {
-                "tracked_entity": "request.target.identifiers.national_id",
-                "subject_id": "target.id",
-            },
-        })]
-    );
-
-    let rendered = serde_json::to_string(&report).expect("consultation report renders");
-    assert!(!rendered.contains("relay.internal.example"));
-}
-
-#[test]
-fn absent_relay_is_reported_as_an_optional_section() {
-    let (_token_directory, _token_file, mut config) = relay_config();
-    config.evidence.relay = None;
-
-    assert!(optional_config_sections_absent(&config)
-        .iter()
-        .any(|entry| {
-            entry["path"] == "/evidence/relay"
-                && entry["reason"] == "no Registry Relay connection configured"
-        }));
-    assert_eq!(notary_relay_connection_report(&config), Value::Null);
-}
diff --git a/crates/registry-notary/src/logging.rs b/crates/registry-notary/src/logging.rs
deleted file mode 100644
index 6b6f54be8..000000000
--- a/crates/registry-notary/src/logging.rs
+++ /dev/null
@@ -1,66 +0,0 @@
-use crate::*;
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum LogFormat {
-    Text,
-    Json,
-}
-
-pub(crate) fn log_format_from_env() -> Result<LogFormat, String> {
-    match std::env::var("REGISTRY_NOTARY_LOG_FORMAT")
-        .unwrap_or_else(|_| "text".to_string())
-        .to_ascii_lowercase()
-        .as_str()
-    {
-        "text" => Ok(LogFormat::Text),
-        "json" => Ok(LogFormat::Json),
-        value => Err(format!(
-            "REGISTRY_NOTARY_LOG_FORMAT must be 'text' or 'json', got '{value}'"
-        )),
-    }
-}
-
-pub(crate) fn default_log_filter() -> &'static str {
-    DEFAULT_LOG_FILTER
-}
-
-pub(crate) fn log_env_filter() -> EnvFilter {
-    EnvFilter::try_from_default_env().unwrap_or_else(|_| EnvFilter::new(default_log_filter()))
-}
-
-pub(crate) fn init_tracing() -> Result<(), Box<dyn std::error::Error>> {
-    let result = match log_format_from_env()? {
-        LogFormat::Text => tracing_subscriber::fmt()
-            .with_ansi(false)
-            .with_env_filter(log_env_filter())
-            .try_init(),
-        LogFormat::Json => tracing_subscriber::fmt()
-            .json()
-            .with_env_filter(log_env_filter())
-            .try_init(),
-    };
-    if let Err(error) = result {
-        let message = error.to_string();
-        if message.contains("global default trace dispatcher has already been set") {
-            return Ok(());
-        }
-        return Err(std::io::Error::other(format!("failed to initialize tracing: {error}")).into());
-    };
-    Ok(())
-}
-
-pub(crate) fn http_trace_span(request: &Request<Body>) -> tracing::Span {
-    let matched_path = request
-        .extensions()
-        .get::<MatchedPath>()
-        .map(MatchedPath::as_str)
-        .unwrap_or_else(|| request.uri().path());
-    tracing::info_span!(
-        "http_request",
-        method = %request.method(),
-        matched_path,
-    )
-}
-#[cfg(test)]
-#[path = "logging/tests.rs"]
-mod tests;
diff --git a/crates/registry-notary/src/logging/tests.rs b/crates/registry-notary/src/logging/tests.rs
deleted file mode 100644
index c665d90f8..000000000
--- a/crates/registry-notary/src/logging/tests.rs
+++ /dev/null
@@ -1,39 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-use crate::test_support::*;
-
-#[test]
-fn default_log_filter_is_plain_info() {
-    assert_eq!(default_log_filter(), "info");
-    assert!(!default_log_filter().contains("debug"));
-}
-
-#[test]
-fn log_format_env_accepts_text_and_json() {
-    let _guard = ENV_LOCK.lock().expect("env lock");
-    std::env::remove_var("REGISTRY_NOTARY_LOG_FORMAT");
-    assert_eq!(
-        log_format_from_env().expect("default is text"),
-        LogFormat::Text
-    );
-
-    std::env::set_var("REGISTRY_NOTARY_LOG_FORMAT", "json");
-    assert_eq!(
-        log_format_from_env().expect("json is accepted"),
-        LogFormat::Json
-    );
-
-    std::env::set_var("REGISTRY_NOTARY_LOG_FORMAT", "text");
-    assert_eq!(
-        log_format_from_env().expect("text is accepted"),
-        LogFormat::Text
-    );
-
-    std::env::set_var("REGISTRY_NOTARY_LOG_FORMAT", "pretty");
-    let err = log_format_from_env().expect_err("unknown format fails");
-    assert!(err.contains("text"));
-    assert!(err.contains("json"));
-
-    std::env::remove_var("REGISTRY_NOTARY_LOG_FORMAT");
-}
diff --git a/crates/registry-notary/src/main.rs b/crates/registry-notary/src/main.rs
deleted file mode 100644
index 0700d0842..000000000
--- a/crates/registry-notary/src/main.rs
+++ /dev/null
@@ -1,585 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Registry Notary process entrypoint.
-
-mod boot;
-mod commands;
-mod config_loader;
-mod doctor;
-mod env_file;
-mod explain_config;
-mod logging;
-mod product_action;
-mod serve;
-
-use boot::*;
-use commands::*;
-use config_loader::*;
-use doctor::*;
-use env_file::*;
-use explain_config::*;
-use logging::*;
-use product_action::*;
-
-use std::collections::BTreeSet;
-use std::fmt;
-use std::fs;
-use std::io;
-use std::net::SocketAddr;
-use std::path::{Path, PathBuf};
-use std::process::ExitCode;
-use std::time::{Duration, SystemTime};
-
-use axum::body::Body;
-use axum::extract::MatchedPath;
-use axum::http::Request;
-use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-use base64::Engine;
-use clap::{Args as ClapArgs, Parser, Subcommand, ValueEnum};
-use ed25519_dalek::SigningKey;
-use registry_config_report::{
-    ConfigValueClassification, LiveApplyClass, ReportStatus, RequiredEnvStatus,
-};
-use registry_notary_core::deployment::{
-    evaluate_gates, DeploymentFindingStatus, DeploymentProfile, EvaluatedFinding,
-};
-use registry_notary_core::{
-    deprecated_config_fields, ConfigAuditEvent, ConfigTrustConfig, RegistryNotaryAdminListenerMode,
-    SigningKeyProviderConfig, StandaloneRegistryNotaryConfig, STATE_STORAGE_POSTGRESQL,
-};
-use registry_notary_server::{
-    compile_notary_runtime_with_provenance, notary_routers_from_runtime,
-    notary_shared_router_from_runtime, openapi_document, verify_relay_from_config,
-    EvidenceIssuerRegistry, NotaryActivationCode, NotaryActivationFailure, StandaloneServerError,
-};
-use registry_platform_config::{
-    expand_config_env_vars, reject_deprecated_config_fields, verify_config_bundle,
-    ConfigBundleError, ProductTrustDomainV1, VerifiedConfigBundle,
-};
-use registry_platform_crypto::{LocalJwkSigner, PrivateJwk, PublicJwk};
-use registry_platform_ops::{
-    antirollback_key_from_verified_bundle, audit_shipping_target, bundle_verify_rejection_code,
-    evaluate_ack_health, load_unsigned_break_glass_or_pin,
-    persist_bundle_acceptance as persist_config_bundle_acceptance,
-    posture_safe_runtime_config_hash, resolve_bundle_state_action, AcceptanceStatePreviewV1,
-    AntiRollbackStoreError, AuditSinkKind, BundleStateAction, BundleStateRequest,
-    BundleVerificationCode, BundleVerificationFailure, ConfigBootError, ConfigOverrideMode,
-    ConfigProvenance, ConfigSource, FileAntiRollbackStore, PendingBundleAcceptance,
-    UnsignedConfigSelection, VerifiedAcceptanceStateV1,
-};
-use serde_json::{json, Value};
-use serve::{serve_listener, ServeLimits};
-use sha2::{Digest, Sha256};
-use time::format_description::well_known::Rfc3339;
-use time::OffsetDateTime;
-use tower_http::trace::TraceLayer;
-use tracing_subscriber::EnvFilter;
-use ulid::Ulid;
-
-const DEFAULT_LOG_FILTER: &str = "info";
-const NOTARY_CONFIG_SCHEMA_VERSION: &str = "registry.notary.config.v1";
-
-#[derive(Debug, Parser)]
-#[command(author, version, about = "Run the standalone Registry Notary")]
-struct Args {
-    #[command(subcommand)]
-    command: Option<Command>,
-    /// YAML config path.
-    #[arg(short, long, env = "REGISTRY_NOTARY_CONFIG", global = true)]
-    config: Option<PathBuf>,
-    /// Signed Config Bundle directory used for direct server startup.
-    #[arg(
-        long,
-        requires_all = ["anchor_path", "state_path"],
-        conflicts_with = "config"
-    )]
-    bundle_dir: Option<PathBuf>,
-    /// Trust anchor JSON path used for direct signed-bundle startup.
-    #[arg(
-        long,
-        requires_all = ["bundle_dir", "state_path"],
-        conflicts_with = "config"
-    )]
-    anchor_path: Option<PathBuf>,
-    /// Anti-rollback state JSON path used for direct signed-bundle startup.
-    #[arg(
-        long,
-        requires_all = ["bundle_dir", "anchor_path"],
-        conflicts_with = "config"
-    )]
-    state_path: Option<PathBuf>,
-    /// Dotenv-style file to load before config validation resolves env vars.
-    #[arg(long, env = "REGISTRY_NOTARY_ENV_FILE", global = true)]
-    env_file: Option<PathBuf>,
-    /// Override already-set process env vars with values from --env-file.
-    #[arg(long, global = true)]
-    env_file_override: bool,
-    /// Override server.bind after config load.
-    #[arg(long, env = "REGISTRY_NOTARY_BIND", global = true)]
-    bind: Option<SocketAddr>,
-    /// Initialize signed config anti-rollback state on first boot.
-    #[arg(long, global = true)]
-    initialize_state: bool,
-}
-
-#[derive(Debug, Subcommand)]
-enum Command {
-    /// Run one closed, release-mapped product action.
-    ProductAction {
-        #[command(subcommand)]
-        action: ProductAction,
-    },
-    /// Run one closed development-package action.
-    DevelopmentAction {
-        #[command(subcommand)]
-        action: DevelopmentAction,
-    },
-    /// Print the Registry Notary OpenAPI document as JSON.
-    Openapi,
-    /// Validate config, env-backed secrets, Relay activation, and VC wiring.
-    Doctor {
-        /// Verify Relay activation for Registry-backed claims.
-        #[arg(long)]
-        live: bool,
-        /// Validate local VC issuing setup. This does not print credentials.
-        #[arg(long)]
-        issue_demo_vc: bool,
-        /// Print resolved config with no secret values in text output.
-        /// For JSON output, use `explain-config --format json`.
-        #[arg(long)]
-        show_expanded_config: bool,
-        /// Review-only deployment profile override for JSON doctor findings.
-        #[arg(
-            long,
-            value_parser = ["local", "hosted_lab", "production", "evidence_grade"]
-        )]
-        profile: Option<String>,
-        /// Output format.
-        #[arg(long, value_enum, default_value_t = DoctorOutputFormat::Text)]
-        format: DoctorOutputFormat,
-    },
-    /// Print resolved config and required env vars.
-    ExplainConfig {
-        /// Output format.
-        #[arg(long, value_enum, default_value_t = ExplainConfigOutputFormat::Json)]
-        format: ExplainConfigOutputFormat,
-    },
-    /// Verify governed runtime configuration bundles without applying them.
-    Config {
-        #[command(subcommand)]
-        command: ConfigCommand,
-    },
-    /// Inspect or recover the retained Notary audit chain.
-    Audit {
-        #[command(subcommand)]
-        command: AuditCommand,
-    },
-    /// Install or attest the Notary-owned PostgreSQL correctness state.
-    State {
-        #[command(subcommand)]
-        command: StateCommand,
-    },
-    /// Generate or hash a Registry Notary API key.
-    HashApiKey {
-        /// Read the API key from stdin.
-        #[arg(long)]
-        stdin: bool,
-        /// Print only sha256:<hex>, useful for automation.
-        #[arg(long)]
-        hash_only: bool,
-        /// Also print the plaintext key when generating one.
-        #[arg(long)]
-        print_secret: bool,
-        /// API key to hash. If omitted, a random key is generated.
-        api_key: Option<String>,
-    },
-    /// Generate a demo Ed25519 issuer JWK for local VC smoke tests.
-    DemoIssuerKey {
-        /// Key id to embed in the generated JWK.
-        #[arg(long, default_value = "did:web:localhost#registry-notary-demo")]
-        kid: String,
-    },
-    /// Probe the local HTTP health endpoint and exit non-zero when unhealthy.
-    Healthcheck {
-        /// Health endpoint URL.
-        #[arg(
-            long,
-            env = "REGISTRY_NOTARY_HEALTHCHECK_URL",
-            default_value = "http://127.0.0.1:8080/healthz"
-        )]
-        url: String,
-        /// Request timeout in milliseconds.
-        #[arg(
-            long,
-            env = "REGISTRY_NOTARY_HEALTHCHECK_TIMEOUT_MS",
-            default_value_t = 5000,
-            value_parser = clap::value_parser!(u64).range(1..)
-        )]
-        timeout_ms: u64,
-    },
-    /// Run the internal CEL worker line protocol.
-    #[cfg(feature = "registry-notary-cel")]
-    #[command(hide = true)]
-    CelWorker,
-    /// Print machine-readable build metadata and compiled capabilities.
-    BuildInfo,
-    /// Print the complete Draft 2020-12 standalone configuration schema.
-    Schema,
-}
-
-#[derive(Debug, Subcommand)]
-enum ConfigCommand {
-    /// Verify a Registry Config Bundle directory against local trust and state.
-    VerifyBundle(ConfigVerifyBundleArgs),
-}
-
-#[derive(Debug, Subcommand)]
-enum AuditCommand {
-    /// Quarantine an inconsistent file-backed chain and start a break segment.
-    Quarantine(AuditQuarantineArgs),
-}
-
-#[derive(Debug, Clone, ClapArgs)]
-struct AuditQuarantineArgs {
-    /// Operator reason recorded in the tamper-evident chain-break event.
-    #[arg(long)]
-    reason: String,
-    /// Optional operator identity recorded in the chain-break event.
-    #[arg(long)]
-    operator: Option<String>,
-}
-
-#[derive(Debug, Subcommand)]
-enum StateCommand {
-    /// Install or attest the forward-only PostgreSQL state schema.
-    Install(StateInstallArgs),
-    /// Connect as the runtime role and attest readiness without mutation.
-    Doctor,
-}
-
-#[derive(Debug, Clone, ClapArgs)]
-struct StateInstallArgs {
-    /// Environment variable containing the migration-login PostgreSQL URL.
-    #[arg(long)]
-    migration_url_env: String,
-    /// NOLOGIN role that owns the Notary schemas and functions.
-    #[arg(long)]
-    owner_role: String,
-    /// Restricted LOGIN role used by the Notary runtime.
-    #[arg(long)]
-    runtime_role: String,
-}
-
-#[derive(Debug, Clone, ClapArgs)]
-struct ConfigVerifyBundleArgs {
-    /// Bundle directory containing manifest.json, manifest.sig.json, and config files.
-    #[arg(long)]
-    bundle_dir: PathBuf,
-    /// Trust anchor JSON path.
-    #[arg(long)]
-    anchor_path: PathBuf,
-    /// Anti-rollback state JSON path.
-    #[arg(long)]
-    state_path: PathBuf,
-}
-
-#[tokio::main]
-async fn main() -> ExitCode {
-    let args = Args::parse();
-    let server_startup = args.command.is_none()
-        || matches!(
-            &args.command,
-            Some(Command::ProductAction { .. } | Command::DevelopmentAction { .. })
-        );
-    match run(args).await {
-        Ok(code) => code,
-        Err(err) => {
-            eprintln!(
-                "ERROR {}",
-                top_level_error_message(err.as_ref(), server_startup)
-            );
-            ExitCode::FAILURE
-        }
-    }
-}
-
-// Process diagnostics and governed audit records have different publication
-// boundaries. Diagnostics must be value-free. A configured stdout audit sink is
-// protected operator evidence, so accepted bundle identities, signer ids, and
-// integrity hashes intentionally remain in `config.bundle_accepted` records.
-fn top_level_error_message(
-    error: &(dyn std::error::Error + 'static),
-    server_startup: bool,
-) -> String {
-    if !server_startup {
-        return error.to_string();
-    }
-    if let Some(failure) = error.downcast_ref::<BundleVerificationFailure>() {
-        return failure.to_string();
-    }
-    error
-        .downcast_ref::<NotaryActivationFailure>()
-        .copied()
-        .unwrap_or_else(|| NotaryActivationCode::RUNTIME_ACTIVATION_FAILED.into())
-        .to_string()
-}
-
-async fn run(args: Args) -> Result<ExitCode, Box<dyn std::error::Error>> {
-    if let Some(Command::ProductAction { action }) = args.command.as_ref() {
-        ensure_closed_product_action_arguments(&args)?;
-        run_product_action(*action, ProductTrustDomainV1::Governed).await?;
-        return Ok(ExitCode::SUCCESS);
-    }
-    if let Some(Command::DevelopmentAction { action }) = args.command.as_ref() {
-        ensure_closed_product_action_arguments(&args)?;
-        run_development_action(*action).await?;
-        return Ok(ExitCode::SUCCESS);
-    }
-    let server_startup = args.command.is_none();
-    let server_config_input = if server_startup {
-        Some(server_config_input(&args).map_err(value_free_configuration_failure)?)
-    } else {
-        if args.bundle_dir.is_some() || args.anchor_path.is_some() || args.state_path.is_some() {
-            return Err(
-                "--bundle-dir, --anchor-path, and --state-path are server-startup-only arguments"
-                    .into(),
-            );
-        }
-        None
-    };
-    let doctor_command = matches!(
-        &args.command,
-        Some(Command::Doctor { .. })
-            | Some(Command::State {
-                command: StateCommand::Doctor,
-            })
-    );
-    let env_report = match load_env_file_arg(args.env_file.as_deref(), args.env_file_override) {
-        Ok(report) => report,
-        Err(error) if server_startup || doctor_command => {
-            return Err(Box::new(value_free_configuration_failure(error)));
-        }
-        Err(error) => return Err(error),
-    };
-    if matches!(
-        server_config_input.as_ref(),
-        Some(ServerConfigInput::SignedBundle { .. })
-    ) && env_report.contains("REGISTRY_NOTARY_CONFIG")
-    {
-        return Err(Box::new(value_free_configuration_failure(
-            "REGISTRY_NOTARY_CONFIG cannot be supplied by --env-file for direct bundle startup",
-        )));
-    }
-    match args.command {
-        None => {
-            run_server(
-                server_config_input.expect("server startup input was resolved"),
-                args.bind,
-                args.initialize_state,
-            )
-            .await?;
-            Ok(ExitCode::SUCCESS)
-        }
-        Some(Command::ProductAction { .. } | Command::DevelopmentAction { .. }) => {
-            unreachable!("product actions return before legacy input resolution")
-        }
-        Some(Command::Openapi) => {
-            println!("{}", serde_json::to_string_pretty(&openapi_document())?);
-            Ok(ExitCode::SUCCESS)
-        }
-        Some(Command::Doctor {
-            live,
-            issue_demo_vc,
-            show_expanded_config,
-            profile,
-            format,
-        }) => {
-            let config_path = required_config_path(args.config.as_deref())?;
-            let ok = doctor(
-                config_path,
-                &env_report,
-                args.bind,
-                DoctorOptions {
-                    live,
-                    issue_demo_vc,
-                    show_expanded_config,
-                    profile_override: profile,
-                    format,
-                },
-            )
-            .await?;
-            Ok(if ok {
-                ExitCode::SUCCESS
-            } else {
-                ExitCode::FAILURE
-            })
-        }
-        Some(Command::ExplainConfig { format }) => {
-            let config_path = required_config_path(args.config.as_deref())?;
-            explain_config(config_path, &env_report, args.bind, format)?;
-            Ok(ExitCode::SUCCESS)
-        }
-        Some(Command::Config {
-            command: ConfigCommand::VerifyBundle(verify_args),
-        }) => {
-            config_verify_bundle(verify_args).await?;
-            Ok(ExitCode::SUCCESS)
-        }
-        Some(Command::Audit {
-            command: AuditCommand::Quarantine(quarantine_args),
-        }) => {
-            let config_path = required_config_path(args.config.as_deref())?;
-            audit_quarantine(config_path, quarantine_args)?;
-            Ok(ExitCode::SUCCESS)
-        }
-        Some(Command::State {
-            command: StateCommand::Install(install),
-        }) => {
-            let config_path = required_config_path(args.config.as_deref())?;
-            state_install(config_path, install).await?;
-            Ok(ExitCode::SUCCESS)
-        }
-        Some(Command::State {
-            command: StateCommand::Doctor,
-        }) => {
-            let config_path = required_config_path(args.config.as_deref())?;
-            state_doctor(config_path).await?;
-            Ok(ExitCode::SUCCESS)
-        }
-        Some(Command::HashApiKey {
-            stdin,
-            hash_only,
-            print_secret,
-            api_key,
-        }) => {
-            hash_api_key(stdin, hash_only, print_secret, api_key)?;
-            Ok(ExitCode::SUCCESS)
-        }
-        Some(Command::DemoIssuerKey { kid }) => {
-            println!("{}", demo_issuer_jwk(&kid)?);
-            Ok(ExitCode::SUCCESS)
-        }
-        Some(Command::Healthcheck { url, timeout_ms }) => {
-            run_healthcheck(&url, Duration::from_millis(timeout_ms)).await?;
-            println!("registry-notary healthcheck ok");
-            Ok(ExitCode::SUCCESS)
-        }
-        #[cfg(feature = "registry-notary-cel")]
-        Some(Command::CelWorker) => {
-            registry_notary_server::cel_worker::run_stdio_worker();
-            Ok(ExitCode::SUCCESS)
-        }
-        Some(Command::BuildInfo) => {
-            println!("{}", serde_json::to_string_pretty(&build_info())?);
-            Ok(ExitCode::SUCCESS)
-        }
-        Some(Command::Schema) => {
-            print!("{}", registry_notary_core::config::schema::document_json());
-            Ok(ExitCode::SUCCESS)
-        }
-    }
-}
-
-fn server_config_input(args: &Args) -> Result<ServerConfigInput, &'static str> {
-    match (
-        args.config.as_ref(),
-        args.bundle_dir.as_ref(),
-        args.anchor_path.as_ref(),
-        args.state_path.as_ref(),
-    ) {
-        (Some(config_path), None, None, None) => {
-            Ok(ServerConfigInput::LocalFile(config_path.clone()))
-        }
-        (None, Some(bundle_dir), Some(anchor_path), Some(state_path)) => {
-            Ok(ServerConfigInput::SignedBundle {
-                bundle_dir: bundle_dir.clone(),
-                anchor_path: anchor_path.clone(),
-                state_path: state_path.clone(),
-            })
-        }
-        (None, None, None, None) => {
-            Err("--config or the complete signed-bundle startup arguments are required")
-        }
-        _ => Err("local config and signed-bundle startup arguments cannot be combined"),
-    }
-}
-
-#[cfg(test)]
-mod test_support;
-
-#[cfg(test)]
-mod operator_boundary_tests {
-    use super::*;
-
-    #[test]
-    fn accepted_bundle_audit_keeps_governed_identity_at_the_protected_boundary() {
-        const CONFIG_HASH: &str =
-            "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd";
-        const PREVIOUS_HASH: &str =
-            "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc";
-        let acceptance = PendingBundleAcceptance {
-            state_path: PathBuf::from(
-                "/Users/SENTINEL_USER/SENTINEL_COUNTRY/SENTINEL_SECRET_STATE.json",
-            ),
-            key: registry_platform_ops::AntiRollbackKey {
-                acceptance_identity: registry_platform_config::ProductAcceptanceIdentityV1 {
-                    trust_domain: registry_platform_config::ProductTrustDomainV1::Governed,
-                    project: "governed-project".to_string(),
-                    environment: "SENTINEL_COUNTRY".to_string(),
-                    lane: registry_platform_config::ProductAcceptanceLaneV1::Notary,
-                    product: registry_platform_config::ProductAcceptanceProductV1::RegistryNotary,
-                    stream: "governed-stream".to_string(),
-                    instance: "SENTINEL_PARSER_INSTANCE".to_string(),
-                },
-            },
-            accepted_anchor: registry_platform_ops::AcceptedAnchorPinV1 {
-                digest: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-                    .to_string(),
-                version: 1,
-                threshold: 1,
-                enabled_signers: vec!["governed-signer-kid".to_string()],
-            },
-            source: ConfigSource::SignedBundleFile,
-            bundle_id: Some("governed-bundle-42".to_string()),
-            bundle_manifest_hash: Some(
-                "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
-                    .to_string(),
-            ),
-            sequence: Some(42),
-            config_hash: CONFIG_HASH.to_string(),
-            previous_config_hash: Some(PREVIOUS_HASH.to_string()),
-            previous_hash_matched: Some(true),
-            signer_kids: vec!["governed-signer-kid".to_string()],
-            break_glass: false,
-            state_action: BundleStateAction::Accept,
-            override_pin: None,
-            override_path: None,
-        };
-
-        let rendered =
-            serde_json::to_string(&bundle_acceptance_audit(&acceptance)).expect("audit serializes");
-
-        for governed_value in [
-            "governed-bundle-42",
-            "governed-signer-kid",
-            CONFIG_HASH,
-            PREVIOUS_HASH,
-        ] {
-            assert!(
-                rendered.contains(governed_value),
-                "accepted audit lost governed identity evidence {governed_value:?}: {rendered}"
-            );
-        }
-        for raw_value in [
-            "SENTINEL_USER",
-            "SENTINEL_COUNTRY",
-            "SENTINEL_SECRET",
-            "SENTINEL_PARSER",
-            acceptance.state_path.to_str().expect("test path is UTF-8"),
-        ] {
-            assert!(
-                !rendered.contains(raw_value),
-                "accepted audit crossed its protected boundary with raw value {raw_value:?}: {rendered}"
-            );
-        }
-    }
-}
diff --git a/crates/registry-notary/src/product_action.rs b/crates/registry-notary/src/product_action.rs
deleted file mode 100644
index 8ee91c37b..000000000
--- a/crates/registry-notary/src/product_action.rs
+++ /dev/null
@@ -1,602 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Closed product actions mapped by the signed Registry Stack release lock.
-
-use crate::*;
-
-const PRODUCT_BUNDLE_DIR: &str = "/run/registry/bundle";
-const PRODUCT_ANCHOR_PATH: &str = "/run/registry/anchor/anchor.json";
-const PRODUCT_PREVIOUS_ANCHOR_PATH: &str = "/run/registry/anchor/previous-anchor.json";
-const PRODUCT_ANCHOR_TRANSITION_PATH: &str = "/run/registry/anchor/transition.json";
-const PRODUCT_STATE_PATH: &str = "/var/lib/registry/state/antirollback.json";
-const PRODUCT_MIGRATION_URL_ENV: &str = "REGISTRY_NOTARY_POSTGRES_MIGRATOR_URL";
-const PRODUCT_OWNER_ROLE: &str = "registry_notary_owner";
-const PRODUCT_RUNTIME_ROLE: &str = "registry_notary_runtime";
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq, Subcommand)]
-pub(crate) enum ProductAction {
-    /// Prepare only the Notary-owned database schema and least-privilege roles.
-    #[command(name = "prepare_state_store")]
-    PrepareStateStore,
-    /// Verify and record sequence-1 acceptance in absent product state, then exit.
-    #[command(name = "initialize_state")]
-    InitializeState,
-    /// Preview an exact, advancing, or anchor-rotating state acceptance.
-    #[command(name = "preview_state")]
-    PreviewState,
-    /// Audit and commit the previously previewable state acceptance, then exit.
-    #[command(name = "accept_state")]
-    AcceptState,
-    /// Verify exact accepted product state without changing it, then exit.
-    #[command(name = "verify_state")]
-    VerifyState,
-    /// Serve the verified product bundle; absent state is a hard failure.
-    #[command(name = "serve")]
-    Serve,
-}
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq, Subcommand)]
-pub(crate) enum DevelopmentAction {
-    #[command(name = "prepare_state_store")]
-    PrepareStateStore,
-    #[command(name = "initialize_state")]
-    InitializeState,
-    #[command(name = "serve")]
-    Serve,
-}
-
-pub(crate) fn ensure_closed_product_action_arguments(
-    args: &Args,
-) -> Result<(), Box<dyn std::error::Error>> {
-    if args.config.is_some()
-        || args.bundle_dir.is_some()
-        || args.anchor_path.is_some()
-        || args.state_path.is_some()
-        || args.env_file.is_some()
-        || args.env_file_override
-        || has_disallowed_product_action_bind(args.bind)
-        || args.initialize_state
-    {
-        return Err("product-action accepts no runtime flags".into());
-    }
-    Ok(())
-}
-
-fn has_disallowed_product_action_bind(bind: Option<SocketAddr>) -> bool {
-    let ambient = std::env::var("REGISTRY_NOTARY_BIND").ok();
-    has_disallowed_product_action_bind_with_ambient(bind, ambient.as_deref())
-}
-
-fn has_disallowed_product_action_bind_with_ambient(
-    bind: Option<SocketAddr>,
-    ambient: Option<&str>,
-) -> bool {
-    let Some(bind) = bind else {
-        return false;
-    };
-
-    // The released image sets this legacy server default globally. Closed
-    // actions load their listener from the verified bundle and never apply the
-    // parsed override, so an identical ambient value is inactive. A distinct
-    // CLI override still rejects. Clap no longer exposes the value source once
-    // `Args` has been constructed, but an explicit duplicate remains harmless
-    // because this path ignores `Args::bind` completely.
-    ambient.and_then(|value| value.parse::<SocketAddr>().ok()) != Some(bind)
-}
-
-pub(crate) async fn run_product_action(
-    action: ProductAction,
-    trust_domain: ProductTrustDomainV1,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let verified = verify_notary_product_bundle_for_domain(
-        Path::new(PRODUCT_BUNDLE_DIR),
-        Path::new(PRODUCT_ANCHOR_PATH),
-        trust_domain,
-    )?;
-    match action {
-        ProductAction::PrepareStateStore => {
-            prepare_product_state_store(verified, trust_domain).await
-        }
-        ProductAction::InitializeState => initialize_product_state(verified, trust_domain).await,
-        ProductAction::PreviewState => preview_product_state(&verified),
-        ProductAction::AcceptState => accept_product_state(verified, trust_domain).await,
-        ProductAction::VerifyState => verify_product_state(&verified),
-        ProductAction::Serve => {
-            let candidate = VerifiedAcceptanceStateV1::from_verified_bundle(&verified)
-                .map_err(map_product_state_error)?;
-            FileAntiRollbackStore::new(PRODUCT_STATE_PATH)
-                .verify_state(candidate.expectation())
-                .map_err(map_product_state_error)?;
-            run_governed_server(verified, Path::new(PRODUCT_STATE_PATH), trust_domain).await
-        }
-    }
-}
-
-pub(crate) async fn run_development_action(
-    action: DevelopmentAction,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let action = match action {
-        DevelopmentAction::PrepareStateStore => ProductAction::PrepareStateStore,
-        DevelopmentAction::InitializeState => ProductAction::InitializeState,
-        DevelopmentAction::Serve => ProductAction::Serve,
-    };
-    run_product_action(action, ProductTrustDomainV1::Development).await
-}
-
-#[cfg(test)]
-fn canonical_product_input() -> ServerConfigInput {
-    ServerConfigInput::SignedBundle {
-        bundle_dir: PathBuf::from(PRODUCT_BUNDLE_DIR),
-        anchor_path: PathBuf::from(PRODUCT_ANCHOR_PATH),
-        state_path: PathBuf::from(PRODUCT_STATE_PATH),
-    }
-}
-
-#[cfg(test)]
-async fn prepare_product_state_store_at(
-    bundle_dir: &Path,
-    anchor_path: &Path,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let verified = verify_notary_product_bundle(bundle_dir, anchor_path)?;
-    prepare_product_state_store(verified, ProductTrustDomainV1::Governed).await
-}
-
-async fn prepare_product_state_store(
-    verified: VerifiedConfigBundle,
-    trust_domain: ProductTrustDomainV1,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let config = load_verified_notary_config_read_only_for_domain(&verified, trust_domain)?;
-    let audit_evidence = prepare_state_store_audit_evidence(&verified)?;
-    registry_notary_server::emit_prepare_state_store_mutation_intent_audit(
-        &config.audit,
-        audit_evidence,
-    )
-    .await?;
-    prepare_postgres_state_store(
-        &config.state,
-        StateInstallArgs {
-            migration_url_env: PRODUCT_MIGRATION_URL_ENV.to_string(),
-            owner_role: PRODUCT_OWNER_ROLE.to_string(),
-            runtime_role: PRODUCT_RUNTIME_ROLE.to_string(),
-        },
-    )
-    .await?;
-    println!("registry-notary prepare_state_store complete");
-    Ok(())
-}
-
-fn prepare_state_store_audit_evidence(
-    verified: &VerifiedConfigBundle,
-) -> Result<registry_notary_server::PrepareStateStoreAuditEvidence, Box<dyn std::error::Error>> {
-    let anchor_digest = registry_platform_config::trust_anchor_digest(&verified.trust_anchor)
-        .map_err(|_| {
-            Box::new(BundleVerificationFailure::from(
-                BundleVerificationCode::REJECTED_VALIDATION,
-            )) as Box<dyn std::error::Error>
-        })?;
-    Ok(registry_notary_server::PrepareStateStoreAuditEvidence {
-        acceptance_identity: verified.manifest.acceptance_identity.clone(),
-        bundle_id: verified.manifest.bundle_id.clone(),
-        bundle_manifest_hash: verified.manifest_hash.clone(),
-        sequence: verified.manifest.sequence,
-        signer_kids: verified.signer_kids.clone(),
-        previous_config_hash: verified.manifest.previous_config_hash.clone(),
-        config_hash: verified.manifest.config_hash.clone(),
-        anchor_digest,
-        anchor_version: verified.trust_anchor.version,
-    })
-}
-
-async fn initialize_product_state(
-    verified: VerifiedConfigBundle,
-    trust_domain: ProductTrustDomainV1,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let config = load_verified_notary_config_read_only_for_domain(&verified, trust_domain)?;
-    let candidate = VerifiedAcceptanceStateV1::from_verified_bundle(&verified)
-        .map_err(map_product_state_error)?;
-    let store = FileAntiRollbackStore::new(PRODUCT_STATE_PATH);
-    let plan = store
-        .plan_initialize(&candidate)
-        .map_err(map_product_state_error)?;
-    let evidence = prepare_state_store_audit_evidence(&verified)?;
-    store
-        .commit_acceptance(plan, move |_| async move {
-            registry_notary_server::emit_product_action_mutation_intent_audit(
-                &config.audit,
-                "initialize_state",
-                evidence,
-            )
-            .await
-        })
-        .await
-        .map_err(map_product_state_error)?;
-    println!("registry-notary initialize_state complete");
-    Ok(())
-}
-
-fn verify_product_state(verified: &VerifiedConfigBundle) -> Result<(), Box<dyn std::error::Error>> {
-    let candidate = VerifiedAcceptanceStateV1::from_verified_bundle(verified)
-        .map_err(map_product_state_error)?;
-    FileAntiRollbackStore::new(PRODUCT_STATE_PATH)
-        .verify_state(candidate.expectation())
-        .map_err(map_product_state_error)?;
-    println!("registry-notary verify_state complete");
-    Ok(())
-}
-
-type ProductRotationInputs = (
-    AcceptanceStatePreviewV1,
-    Option<registry_platform_config::ConfigTrustAnchor>,
-    Option<registry_platform_config::AnchorTransitionV1>,
-);
-
-fn preview_product_acceptance(
-    store: &FileAntiRollbackStore,
-    candidate: &VerifiedAcceptanceStateV1,
-) -> Result<ProductRotationInputs, Box<dyn std::error::Error>> {
-    match store.preview_acceptance(candidate, None, None) {
-        Ok(preview) => Ok((preview, None, None)),
-        Err(AntiRollbackStoreError::AnchorTransitionRequired) => {
-            let previous_anchor =
-                load_optional_previous_anchor(Path::new(PRODUCT_PREVIOUS_ANCHOR_PATH))?;
-            let transition =
-                load_optional_anchor_transition(Path::new(PRODUCT_ANCHOR_TRANSITION_PATH))?;
-            if previous_anchor.is_some() != transition.is_some() {
-                return Err(map_product_state_error(
-                    AntiRollbackStoreError::UnexpectedAnchorTransition,
-                ));
-            }
-            let preview = store
-                .preview_acceptance(candidate, previous_anchor.as_ref(), transition.as_ref())
-                .map_err(map_product_state_error)?;
-            Ok((preview, previous_anchor, transition))
-        }
-        Err(error) => Err(map_product_state_error(error)),
-    }
-}
-
-fn map_product_state_error<E>(_: E) -> Box<dyn std::error::Error> {
-    Box::new(BundleVerificationFailure::from(
-        BundleVerificationCode::REJECTED_ROLLBACK,
-    ))
-}
-
-fn preview_product_state(
-    verified: &VerifiedConfigBundle,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let candidate = VerifiedAcceptanceStateV1::from_verified_bundle(verified)
-        .map_err(map_product_state_error)?;
-    let (preview, _, _) =
-        preview_product_acceptance(&FileAntiRollbackStore::new(PRODUCT_STATE_PATH), &candidate)?;
-    println!(
-        "{}",
-        serde_json::to_string(&json!({
-            "schema": "registry.notary.product-action-result.v1",
-            "action": "preview_state",
-            "status": "previewed",
-            "state": preview.as_str(),
-        }))?
-    );
-    Ok(())
-}
-
-async fn accept_product_state(
-    verified: VerifiedConfigBundle,
-    trust_domain: ProductTrustDomainV1,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let candidate = VerifiedAcceptanceStateV1::from_verified_bundle(&verified)
-        .map_err(map_product_state_error)?;
-    let store = FileAntiRollbackStore::new(PRODUCT_STATE_PATH);
-    let (preview, previous_anchor, transition) = preview_product_acceptance(&store, &candidate)?;
-    if preview != AcceptanceStatePreviewV1::Current {
-        let config = load_verified_notary_config_read_only_for_domain(&verified, trust_domain)?;
-        let plan = store
-            .plan_acceptance(&candidate, previous_anchor.as_ref(), transition.as_ref())
-            .map_err(map_product_state_error)?;
-        let evidence = prepare_state_store_audit_evidence(&verified)?;
-        store
-            .commit_acceptance(plan, move |_| async move {
-                registry_notary_server::emit_product_action_mutation_intent_audit(
-                    &config.audit,
-                    "accept_state",
-                    evidence,
-                )
-                .await
-            })
-            .await
-            .map_err(map_product_state_error)?;
-    }
-    println!(
-        "{}",
-        serde_json::to_string(&json!({
-            "schema": "registry.notary.product-action-result.v1",
-            "action": "accept_state",
-            "status": "succeeded",
-            "state": preview.as_str(),
-        }))?
-    );
-    Ok(())
-}
-
-fn load_optional_previous_anchor(
-    path: &Path,
-) -> Result<Option<registry_platform_config::ConfigTrustAnchor>, Box<dyn std::error::Error>> {
-    if !closed_artifact_exists(path)? {
-        return Ok(None);
-    }
-    registry_platform_config::load_trust_anchor(path)
-        .map(Some)
-        .map_err(|error| {
-            let code = log_bundle_verification_error(&error);
-            Box::new(BundleVerificationFailure::from(code)) as Box<dyn std::error::Error>
-        })
-}
-
-fn load_optional_anchor_transition(
-    path: &Path,
-) -> Result<Option<registry_platform_config::AnchorTransitionV1>, Box<dyn std::error::Error>> {
-    if !closed_artifact_exists(path)? {
-        return Ok(None);
-    }
-    registry_platform_config::load_anchor_transition(path)
-        .map(Some)
-        .map_err(|error| {
-            let code = log_bundle_verification_error(&error);
-            Box::new(BundleVerificationFailure::from(code)) as Box<dyn std::error::Error>
-        })
-}
-
-fn closed_artifact_exists(path: &Path) -> Result<bool, Box<dyn std::error::Error>> {
-    match fs::symlink_metadata(path) {
-        Ok(metadata) if metadata.file_type().is_file() => Ok(true),
-        Ok(_) => Err(Box::new(BundleVerificationFailure::from(
-            BundleVerificationCode::REJECTED_VALIDATION,
-        ))),
-        Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(false),
-        Err(_) => Err(Box::new(BundleVerificationFailure::from(
-            BundleVerificationCode::REJECTED_VALIDATION,
-        ))),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::test_support::*;
-
-    fn postgres_product_config(audit_path: &Path) -> String {
-        notary_bundle_runtime_config()
-            .replace("state:\n  storage: in_memory", "state:\n  storage: postgresql")
-            .replace(
-                "audit:\n  sink: stdout\n  hash_secret_env: TEST_NOTARY_LOADER_AUDIT_HASH_SECRET",
-                &format!(
-                    "audit:\n  sink: file\n  path: {}\n  hash_secret_env: TEST_NOTARY_LOADER_AUDIT_HASH_SECRET",
-                    audit_path.display()
-                ),
-            )
-    }
-
-    #[test]
-    fn closed_product_actions_parse_with_release_lock_names() {
-        for (name, expected) in [
-            ("prepare_state_store", ProductAction::PrepareStateStore),
-            ("initialize_state", ProductAction::InitializeState),
-            ("preview_state", ProductAction::PreviewState),
-            ("accept_state", ProductAction::AcceptState),
-            ("verify_state", ProductAction::VerifyState),
-            ("serve", ProductAction::Serve),
-        ] {
-            let args = Args::try_parse_from(["registry-notary", "product-action", name])
-                .expect("closed product action parses");
-            assert!(matches!(
-                args.command,
-                Some(Command::ProductAction { action }) if action == expected
-            ));
-            ensure_closed_product_action_arguments(&args)
-                .expect("closed action has no legacy runtime arguments");
-        }
-    }
-
-    #[test]
-    fn development_actions_have_a_distinct_closed_namespace() {
-        for (name, expected) in [
-            ("prepare_state_store", DevelopmentAction::PrepareStateStore),
-            ("initialize_state", DevelopmentAction::InitializeState),
-            ("serve", DevelopmentAction::Serve),
-        ] {
-            let args = Args::try_parse_from(["registry-notary", "development-action", name])
-                .expect("closed development action parses");
-            assert!(matches!(
-                args.command,
-                Some(Command::DevelopmentAction { action }) if action == expected
-            ));
-        }
-        for name in ["preview_state", "accept_state", "verify_state"] {
-            assert!(
-                Args::try_parse_from(["registry-notary", "development-action", name]).is_err(),
-                "development namespace must reject governed action {name}"
-            );
-        }
-    }
-
-    #[test]
-    fn product_actions_reject_legacy_runtime_flags() {
-        for legacy in [
-            vec!["--config", "notary.yaml"],
-            vec!["--bind", "127.0.0.1:8080"],
-            vec!["--env-file", "notary.env"],
-            vec!["--env-file-override"],
-            vec!["--initialize-state"],
-        ] {
-            let mut argv = vec!["registry-notary"];
-            argv.extend(legacy);
-            argv.extend(["product-action", "serve"]);
-            let args = Args::try_parse_from(argv).expect("legacy global argument parses");
-            let error = ensure_closed_product_action_arguments(&args)
-                .expect_err("product action rejects legacy runtime argument");
-            assert_eq!(error.to_string(), "product-action accepts no runtime flags");
-        }
-    }
-
-    #[test]
-    fn released_image_bind_is_inactive_but_distinct_overrides_reject() {
-        let image_bind = "0.0.0.0:8080".parse().expect("image bind parses");
-        let distinct_bind = "127.0.0.1:8080".parse().expect("CLI bind parses");
-
-        assert!(!has_disallowed_product_action_bind_with_ambient(
-            Some(image_bind),
-            Some("0.0.0.0:8080")
-        ));
-        assert!(has_disallowed_product_action_bind_with_ambient(
-            Some(distinct_bind),
-            Some("0.0.0.0:8080")
-        ));
-        assert!(has_disallowed_product_action_bind_with_ambient(
-            Some(image_bind),
-            None
-        ));
-        assert!(has_disallowed_product_action_bind_with_ambient(
-            Some(image_bind),
-            Some("not-a-socket")
-        ));
-    }
-
-    #[test]
-    fn product_actions_use_only_canonical_product_mounts() {
-        assert_eq!(
-            canonical_product_input(),
-            ServerConfigInput::SignedBundle {
-                bundle_dir: PathBuf::from("/run/registry/bundle"),
-                anchor_path: PathBuf::from("/run/registry/anchor/anchor.json"),
-                state_path: PathBuf::from("/var/lib/registry/state/antirollback.json"),
-            }
-        );
-    }
-
-    #[test]
-    fn preparation_authority_is_closed_to_notary_database_inputs() {
-        assert_eq!(
-            PRODUCT_MIGRATION_URL_ENV,
-            "REGISTRY_NOTARY_POSTGRES_MIGRATOR_URL"
-        );
-        assert_eq!(PRODUCT_OWNER_ROLE, "registry_notary_owner");
-        assert_eq!(PRODUCT_RUNTIME_ROLE, "registry_notary_runtime");
-        for forbidden in [
-            "ISSUER",
-            "SIGNING",
-            "SOURCE",
-            "ANTIROLLBACK",
-            "CONFIG_BUNDLE",
-        ] {
-            assert!(
-                !PRODUCT_MIGRATION_URL_ENV.contains(forbidden),
-                "preparation credential must not grant {forbidden} authority"
-            );
-        }
-    }
-
-    #[tokio::test]
-    #[allow(clippy::await_holding_lock)]
-    async fn preparation_does_not_access_acceptance_state_issuer_signer_or_source() {
-        let _guard = ENV_LOCK.lock().expect("env lock");
-        std::env::set_var(
-            "TEST_NOTARY_LOADER_AUDIT_HASH_SECRET",
-            "registry-notary-product-action-audit-secret-32-bytes",
-        );
-        let tmp = tempfile::tempdir().expect("tempdir");
-        let fixture = write_signed_notary_bundle(&tmp);
-
-        let error = prepare_product_state_store_at(&fixture.bundle_dir, &fixture.anchor_path)
-            .await
-            .expect_err("in-memory state is not a preparable database");
-
-        assert_eq!(
-            error.to_string(),
-            "state install requires state.storage = postgresql"
-        );
-        assert!(
-            !fixture.state_path.exists(),
-            "preparation must not create or read acceptance state"
-        );
-        for inaccessible in [
-            "TEST_NOTARY_LOADER_ISSUER_JWK",
-            "TEST_NOTARY_LOADER_API_HASH",
-            "TEST_NOTARY_LOADER_AUDIT_HASH_SECRET",
-        ] {
-            assert!(
-                !error.to_string().contains(inaccessible),
-                "preparation accessed a non-database input"
-            );
-        }
-        std::env::remove_var("TEST_NOTARY_LOADER_AUDIT_HASH_SECRET");
-    }
-
-    #[tokio::test]
-    #[allow(clippy::await_holding_lock)]
-    async fn preparation_writes_pending_intent_before_database_failure() {
-        let _guard = ENV_LOCK.lock().expect("env lock");
-        std::env::set_var(
-            "TEST_NOTARY_LOADER_AUDIT_HASH_SECRET",
-            "registry-notary-product-action-audit-secret-32-bytes",
-        );
-        std::env::remove_var(PRODUCT_MIGRATION_URL_ENV);
-        let tmp = tempfile::tempdir().expect("tempdir");
-        let audit_path = tmp.path().join("audit.jsonl");
-        let fixture =
-            write_signed_notary_bundle_with_config(&tmp, postgres_product_config(&audit_path));
-
-        prepare_product_state_store_at(&fixture.bundle_dir, &fixture.anchor_path)
-            .await
-            .expect_err("missing database credential fails after the checked intent audit");
-
-        let records = std::fs::read_to_string(&audit_path).expect("intent audit is retained");
-        let record: Value = serde_json::from_str(records.lines().next().expect("one audit record"))
-            .expect("audit record parses");
-        assert_eq!(
-            record["record"]["path"],
-            "/__events/product_action.mutation_intent"
-        );
-        assert_eq!(record["record"]["config"]["action"], "prepare_state_store");
-        assert_eq!(record["record"]["config"]["apply_result"], "pending");
-        assert_eq!(record["record"]["config"]["applied"], false);
-        assert!(
-            !fixture.state_path.exists(),
-            "database preparation must not acquire anti-rollback authority"
-        );
-
-        std::env::remove_var("TEST_NOTARY_LOADER_AUDIT_HASH_SECRET");
-    }
-
-    #[tokio::test]
-    #[allow(clippy::await_holding_lock)]
-    async fn preparation_audit_failure_aborts_before_database_access() {
-        let _guard = ENV_LOCK.lock().expect("env lock");
-        std::env::set_var(
-            "TEST_NOTARY_LOADER_AUDIT_HASH_SECRET",
-            "registry-notary-product-action-audit-secret-32-bytes",
-        );
-        std::env::remove_var(PRODUCT_MIGRATION_URL_ENV);
-        let tmp = tempfile::tempdir().expect("tempdir");
-        let audit_path = tmp.path().join("audit-target-is-a-directory");
-        std::fs::create_dir(&audit_path).expect("invalid audit target directory");
-        let fixture =
-            write_signed_notary_bundle_with_config(&tmp, postgres_product_config(&audit_path));
-
-        let error = prepare_product_state_store_at(&fixture.bundle_dir, &fixture.anchor_path)
-            .await
-            .expect_err("audit failure aborts preparation");
-
-        assert!(
-            matches!(
-                error.downcast_ref::<registry_notary_server::StandaloneServerError>(),
-                Some(registry_notary_server::StandaloneServerError::Audit(_))
-            ),
-            "audit failure must be returned before the missing database credential: {error}"
-        );
-        assert!(
-            !fixture.state_path.exists(),
-            "failed preparation must not mutate anti-rollback state"
-        );
-
-        std::env::remove_var("TEST_NOTARY_LOADER_AUDIT_HASH_SECRET");
-    }
-}
diff --git a/crates/registry-notary/src/serve.rs b/crates/registry-notary/src/serve.rs
deleted file mode 100644
index c8e559c40..000000000
--- a/crates/registry-notary/src/serve.rs
+++ /dev/null
@@ -1,333 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! HTTP serve boundary with transport-level limits.
-
-use std::convert::Infallible;
-use std::future::Future;
-use std::net::SocketAddr;
-use std::sync::Arc;
-use std::time::Duration;
-
-use axum::body::Body;
-use axum::extract::ConnectInfo;
-use axum::Router;
-use hyper::body::Incoming;
-use hyper::service::service_fn;
-use hyper::Request;
-use hyper_util::rt::{TokioExecutor, TokioIo, TokioTimer};
-use hyper_util::server::conn::auto;
-use registry_notary_core::RegistryNotaryHttpConfig;
-use tokio::net::{TcpListener, TcpStream};
-use tokio::sync::{watch, Semaphore};
-use tokio::task::JoinSet;
-use tower::ServiceExt;
-use tracing::{debug, warn};
-
-#[derive(Debug, Clone, Copy)]
-pub struct ServeLimits {
-    pub http1_header_read_timeout: Duration,
-    pub http2_keep_alive_interval: Duration,
-    pub max_connections: usize,
-}
-
-impl ServeLimits {
-    #[must_use]
-    pub fn from_config(config: &RegistryNotaryHttpConfig) -> Self {
-        Self {
-            http1_header_read_timeout: config.http1_header_read_timeout,
-            http2_keep_alive_interval: config.http1_header_read_timeout,
-            max_connections: config.max_connections,
-        }
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::items_after_test_module)]
-mod tests {
-    use super::*;
-
-    use axum::http::StatusCode;
-    use axum::routing::get;
-    use tokio::io::{AsyncReadExt, AsyncWriteExt};
-    use tokio::sync::Notify;
-
-    #[tokio::test]
-    async fn serve_listener_closes_slow_http1_headers() {
-        let app = Router::new().route("/healthz", get(|| async { StatusCode::NO_CONTENT }));
-        let listener = TcpListener::bind("127.0.0.1:0")
-            .await
-            .expect("listener binds");
-        let addr = listener.local_addr().expect("listener has local address");
-        let limits = ServeLimits {
-            http1_header_read_timeout: Duration::from_millis(50),
-            http2_keep_alive_interval: Duration::from_millis(50),
-            max_connections: 8,
-        };
-        let (shutdown_tx, shutdown_rx) = tokio::sync::oneshot::channel::<()>();
-        let handle = tokio::spawn(serve_listener(listener, app, limits, async move {
-            let _ = shutdown_rx.await;
-        }));
-
-        let mut stream = TcpStream::connect(addr).await.expect("connects");
-        stream
-            .write_all(b"GET /healthz HTTP/1.1\r\nHost: localhost\r\n")
-            .await
-            .expect("partial header writes");
-        tokio::time::sleep(Duration::from_millis(150)).await;
-
-        let mut byte = [0_u8; 1];
-        let read = stream.read(&mut byte).await.expect("read completes");
-        assert_eq!(read, 0, "slow header connection should be closed");
-
-        let _ = shutdown_tx.send(());
-        handle
-            .await
-            .expect("serve task joins")
-            .expect("serve exits");
-    }
-
-    #[tokio::test]
-    async fn serve_listener_max_connections_holds_excess_request_work() {
-        let app = Router::new().route("/healthz", get(|| async { StatusCode::NO_CONTENT }));
-        let listener = TcpListener::bind("127.0.0.1:0")
-            .await
-            .expect("listener binds");
-        let addr = listener.local_addr().expect("listener has local address");
-        let limits = ServeLimits {
-            http1_header_read_timeout: Duration::from_secs(5),
-            http2_keep_alive_interval: Duration::from_secs(5),
-            max_connections: 1,
-        };
-        let (shutdown_tx, shutdown_rx) = tokio::sync::oneshot::channel::<()>();
-        let handle = tokio::spawn(serve_listener(listener, app, limits, async move {
-            let _ = shutdown_rx.await;
-        }));
-
-        let mut held = TcpStream::connect(addr).await.expect("connect held");
-        held.write_all(format!("GET /healthz HTTP/1.1\r\nHost: {addr}\r\n").as_bytes())
-            .await
-            .expect("partial header writes");
-        tokio::time::sleep(Duration::from_millis(50)).await;
-
-        let mut queued = TcpStream::connect(addr).await.expect("connect queued");
-        queued
-            .write_all(
-                format!("GET /healthz HTTP/1.1\r\nHost: {addr}\r\nConnection: close\r\n\r\n")
-                    .as_bytes(),
-            )
-            .await
-            .expect("queued request writes");
-
-        let mut first_byte = [0_u8; 1];
-        let early =
-            tokio::time::timeout(Duration::from_millis(200), queued.read(&mut first_byte)).await;
-        assert!(
-            early.is_err(),
-            "queued request received response bytes while connection cap was exhausted"
-        );
-
-        drop(held);
-        let mut rest = Vec::new();
-        let read = tokio::time::timeout(Duration::from_secs(2), queued.read_to_end(&mut rest))
-            .await
-            .expect("queued request finishes after capacity frees")
-            .expect("queued response reads");
-        assert!(read > 0, "queued request received a response");
-        let response = String::from_utf8_lossy(&rest);
-        assert!(
-            response.starts_with("HTTP/1.1 204"),
-            "queued request should succeed after capacity frees, got: {response}"
-        );
-
-        let _ = shutdown_tx.send(());
-        handle
-            .await
-            .expect("serve task joins")
-            .expect("serve exits");
-    }
-
-    #[tokio::test]
-    async fn serve_listener_graceful_shutdown_allows_inflight_request_to_finish() {
-        let started = Arc::new(Notify::new());
-        let release = Arc::new(Notify::new());
-        let app = Router::new().route(
-            "/slow",
-            get({
-                let started = Arc::clone(&started);
-                let release = Arc::clone(&release);
-                move || {
-                    let started = Arc::clone(&started);
-                    let release = Arc::clone(&release);
-                    async move {
-                        started.notify_one();
-                        release.notified().await;
-                        StatusCode::NO_CONTENT
-                    }
-                }
-            }),
-        );
-        let listener = TcpListener::bind("127.0.0.1:0")
-            .await
-            .expect("listener binds");
-        let addr = listener.local_addr().expect("listener has local address");
-        let limits = ServeLimits {
-            http1_header_read_timeout: Duration::from_secs(5),
-            http2_keep_alive_interval: Duration::from_secs(5),
-            max_connections: 8,
-        };
-        let (shutdown_tx, shutdown_rx) = tokio::sync::oneshot::channel::<()>();
-        let handle = tokio::spawn(serve_listener(listener, app, limits, async move {
-            let _ = shutdown_rx.await;
-        }));
-        let request = tokio::spawn(async move {
-            let mut stream = TcpStream::connect(addr).await.expect("connects");
-            stream
-                .write_all(
-                    format!("GET /slow HTTP/1.1\r\nHost: {addr}\r\nConnection: close\r\n\r\n")
-                        .as_bytes(),
-                )
-                .await
-                .expect("request writes");
-            let mut response = Vec::new();
-            stream
-                .read_to_end(&mut response)
-                .await
-                .expect("response reads");
-            response
-        });
-
-        tokio::time::timeout(Duration::from_secs(2), started.notified())
-            .await
-            .expect("handler starts");
-        let _ = shutdown_tx.send(());
-        release.notify_one();
-
-        let response = request.await.expect("request task joins");
-        assert!(
-            response.starts_with(b"HTTP/1.1 204"),
-            "in-flight request completed successfully"
-        );
-        handle
-            .await
-            .expect("serve task joins")
-            .expect("serve exits");
-    }
-}
-
-pub async fn serve_listener<F>(
-    listener: TcpListener,
-    app: Router,
-    limits: ServeLimits,
-    shutdown: F,
-) -> std::io::Result<()>
-where
-    F: Future<Output = ()> + Send + 'static,
-{
-    let local_addr = listener.local_addr()?;
-    let (shutdown_tx, shutdown_rx) = watch::channel(());
-    let connection_cap = Arc::new(Semaphore::new(limits.max_connections));
-    let mut tasks = JoinSet::new();
-    tokio::pin!(shutdown);
-
-    loop {
-        while let Some(joined) = tasks.try_join_next() {
-            if let Err(error) = joined {
-                warn!(error = %error, bind = %local_addr, "http connection task failed");
-            }
-        }
-
-        let permit = tokio::select! {
-            biased;
-            _ = &mut shutdown => {
-                break;
-            }
-            permit = Arc::clone(&connection_cap).acquire_owned() => {
-                match permit {
-                    Ok(permit) => permit,
-                    Err(_) => break,
-                }
-            }
-        };
-        let (stream, remote_addr) = tokio::select! {
-            biased;
-            _ = &mut shutdown => {
-                break;
-            }
-            accepted = listener.accept() => {
-                match accepted {
-                    Ok(connection) => connection,
-                    Err(error) => {
-                        warn!(error = %error, bind = %local_addr, "failed to accept http connection");
-                        tokio::time::sleep(Duration::from_millis(50)).await;
-                        continue;
-                    }
-                }
-            }
-        };
-        let app = app.clone();
-        let close_rx = shutdown_rx.clone();
-        tasks.spawn(async move {
-            let _permit = permit;
-            serve_connection(stream, remote_addr, app, limits, close_rx).await;
-        });
-    }
-
-    drop(shutdown_tx);
-    while let Some(joined) = tasks.join_next().await {
-        if let Err(error) = joined {
-            warn!(error = %error, bind = %local_addr, "http connection task failed during shutdown");
-        }
-    }
-    Ok(())
-}
-
-async fn serve_connection(
-    stream: TcpStream,
-    remote_addr: SocketAddr,
-    app: Router,
-    limits: ServeLimits,
-    mut close_rx: watch::Receiver<()>,
-) {
-    let service = service_fn(move |req: Request<Incoming>| {
-        let app = app.clone();
-        async move {
-            let mut req = req.map(Body::new);
-            req.extensions_mut().insert(ConnectInfo(remote_addr));
-            match app.oneshot(req).await {
-                Ok(response) => Ok::<_, Infallible>(response),
-                Err(err) => match err {},
-            }
-        }
-    });
-
-    let mut builder = auto::Builder::new(TokioExecutor::new());
-    builder
-        .http1()
-        .timer(TokioTimer::new())
-        .header_read_timeout(limits.http1_header_read_timeout)
-        .keep_alive(false);
-    builder
-        .http2()
-        .timer(TokioTimer::new())
-        .keep_alive_interval(limits.http2_keep_alive_interval)
-        .keep_alive_timeout(limits.http2_keep_alive_interval);
-
-    let io = TokioIo::new(stream);
-    let conn = builder.serve_connection_with_upgrades(io, service);
-    tokio::pin!(conn);
-    let mut shutdown_initiated = false;
-
-    loop {
-        tokio::select! {
-            result = &mut conn => {
-                if let Err(error) = result {
-                    debug!(error = %error, peer = %remote_addr, "http connection closed with error");
-                }
-                break;
-            }
-            _ = close_rx.changed(), if !shutdown_initiated => {
-                conn.as_mut().graceful_shutdown();
-                shutdown_initiated = true;
-            }
-        }
-    }
-}
diff --git a/crates/registry-notary/src/test_support.rs b/crates/registry-notary/src/test_support.rs
deleted file mode 100644
index a88576a9d..000000000
--- a/crates/registry-notary/src/test_support.rs
+++ /dev/null
@@ -1,245 +0,0 @@
-use crate::*;
-pub(crate) use std::sync::Mutex;
-
-pub(crate) use axum::http::StatusCode;
-pub(crate) use axum::routing::get;
-pub(crate) use axum::Router;
-pub(crate) use axum_test::TestServer;
-pub(crate) use registry_platform_config::{
-    sha256_uri, ConfigBundleFile, ConfigBundleManifest, ConfigBundleSignature,
-    ConfigBundleSignatureEnvelope, ConfigTrustAnchor, ConfigTrustAnchorSigner,
-    ProductAcceptanceIdentityV1, ProductAcceptanceLaneV1, ProductAcceptanceProductV1,
-    ProductTrustDomainV1,
-};
-pub(crate) use registry_platform_crypto::{canonicalize_json, sign, PrivateJwk};
-
-pub(crate) static ENV_LOCK: Mutex<()> = Mutex::new(());
-pub(crate) const CONFIG_BUNDLE_PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA"}"#;
-
-pub(crate) struct SignedBundleFixture {
-    pub(crate) bundle_dir: PathBuf,
-    pub(crate) anchor_path: PathBuf,
-    pub(crate) state_path: PathBuf,
-    pub(crate) config_hash: String,
-}
-
-pub(crate) fn write_signed_notary_bundle(tmp: &tempfile::TempDir) -> SignedBundleFixture {
-    write_signed_notary_bundle_with_config(tmp, notary_bundle_runtime_config())
-}
-
-pub(crate) fn write_signed_notary_bundle_with_config(
-    tmp: &tempfile::TempDir,
-    config: String,
-) -> SignedBundleFixture {
-    let bundle_dir = tmp.path().join("bundle");
-    let config_dir = bundle_dir.join("config");
-    std::fs::create_dir_all(&config_dir).expect("bundle config dir");
-    std::fs::write(config_dir.join("notary.yaml"), config.as_bytes()).expect("config writes");
-    let config_hash = sha256_uri(config.as_bytes());
-    let private = PrivateJwk::parse(CONFIG_BUNDLE_PRIVATE_JWK).expect("private jwk");
-    let public = private.public();
-    let kid = public.jkt().expect("thumbprint");
-    let manifest = ConfigBundleManifest {
-        schema: "registry.platform.config_bundle.v1".to_string(),
-        acceptance_identity: notary_acceptance_identity(),
-        bundle_id: "notary-loader-bundle".to_string(),
-        sequence: 1,
-        previous_config_hash: None,
-        config_hash: config_hash.clone(),
-        files: vec![ConfigBundleFile {
-            path: "config/notary.yaml".to_string(),
-            sha256: config_hash.clone(),
-        }],
-        created_at: "2026-07-07T10:00:00Z".to_string(),
-    };
-    write_manifest_and_signature(&bundle_dir, &manifest, &private, &kid);
-    let anchor = ConfigTrustAnchor {
-        schema: "registry.platform.config_trust_anchor.v1".to_string(),
-        acceptance_identity: notary_acceptance_identity(),
-        version: 1,
-        threshold: 1,
-        enabled_signers: vec![ConfigTrustAnchorSigner { kid, jwk: public }],
-    };
-    let anchor_path = tmp.path().join("trust_anchor.json");
-    std::fs::write(
-        &anchor_path,
-        serde_json::to_vec_pretty(&anchor).expect("anchor serializes"),
-    )
-    .expect("anchor writes");
-    SignedBundleFixture {
-        bundle_dir,
-        anchor_path,
-        state_path: tmp.path().join("antirollback.json"),
-        config_hash,
-    }
-}
-
-pub(crate) fn notary_acceptance_identity() -> ProductAcceptanceIdentityV1 {
-    ProductAcceptanceIdentityV1 {
-        trust_domain: ProductTrustDomainV1::Governed,
-        project: "notary-loader-project".to_string(),
-        environment: "development".to_string(),
-        lane: ProductAcceptanceLaneV1::Notary,
-        product: ProductAcceptanceProductV1::RegistryNotary,
-        stream: "notary-loader-test".to_string(),
-        instance: "notary-loader".to_string(),
-    }
-}
-
-pub(crate) fn notary_accepted_anchor_pin() -> registry_platform_ops::AcceptedAnchorPinV1 {
-    registry_platform_ops::AcceptedAnchorPinV1 {
-        digest: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-            .to_string(),
-        version: 1,
-        threshold: 1,
-        enabled_signers: vec!["kid-1".to_string()],
-    }
-}
-
-pub(crate) fn write_manifest_and_signature(
-    bundle_dir: &Path,
-    manifest: &ConfigBundleManifest,
-    private: &PrivateJwk,
-    kid: &str,
-) {
-    let manifest_value = serde_json::to_value(manifest).expect("manifest value");
-    let canonical = canonicalize_json(&manifest_value).expect("canonical manifest");
-    let signature = sign(&canonical, private).expect("manifest signs");
-    let envelope = ConfigBundleSignatureEnvelope {
-        schema: "registry.platform.config_bundle_signatures.v1".to_string(),
-        signatures: vec![ConfigBundleSignature {
-            kid: kid.to_string(),
-            alg: "EdDSA".to_string(),
-            sig: URL_SAFE_NO_PAD.encode(signature),
-        }],
-    };
-    std::fs::write(
-        bundle_dir.join("manifest.json"),
-        serde_json::to_vec_pretty(manifest).expect("manifest serializes"),
-    )
-    .expect("manifest writes");
-    std::fs::write(
-        bundle_dir.join("manifest.sig.json"),
-        serde_json::to_vec_pretty(&envelope).expect("signature serializes"),
-    )
-    .expect("signature writes");
-}
-
-pub(crate) fn rewrite_signed_bundle_instance_id(
-    fixture: &SignedBundleFixture,
-    instance_id: Option<&str>,
-) {
-    let mut manifest: ConfigBundleManifest = serde_json::from_slice(
-        &std::fs::read(fixture.bundle_dir.join("manifest.json")).expect("manifest reads"),
-    )
-    .expect("manifest parses");
-    manifest.acceptance_identity.instance = instance_id.unwrap_or_default().to_string();
-    let private = PrivateJwk::parse(CONFIG_BUNDLE_PRIVATE_JWK).expect("private JWK parses");
-    let kid = private.public().jkt().expect("signer thumbprint");
-    write_manifest_and_signature(&fixture.bundle_dir, &manifest, &private, &kid);
-}
-
-pub(crate) fn notary_bundle_runtime_config() -> String {
-    r#"
-deployment:
-  profile: local
-state:
-  storage: in_memory
-server:
-  bind: 127.0.0.1:4255
-  admin_listener:
-    mode: dedicated
-    bind: 127.0.0.1:4256
-auth:
-  api_keys:
-    - id: local
-      fingerprint:
-        provider: env
-        name: TEST_NOTARY_LOADER_API_HASH
-      scopes: [registry_notary:credential_issue]
-audit:
-  sink: stdout
-  hash_secret_env: TEST_NOTARY_LOADER_AUDIT_HASH_SECRET
-evidence:
-  enabled: true
-  signing_keys:
-    issuer:
-      provider: local_jwk_env
-      private_jwk_env: TEST_NOTARY_LOADER_ISSUER_JWK
-      alg: EdDSA
-      kid: did:web:issuer.example#key-1
-      status: active
-"#
-    .to_string()
-}
-
-pub(crate) fn notary_bootstrap_config(fixture: &SignedBundleFixture) -> String {
-    format!(
-        r#"{}
-config_trust:
-  trust_anchor_path: {}
-  bundle_path: {}
-  antirollback_state_path: {}
-"#,
-        notary_bundle_runtime_config(),
-        fixture.anchor_path.display(),
-        fixture.bundle_dir.display(),
-        fixture.state_path.display()
-    )
-}
-
-pub(crate) fn notary_test_config() -> StandaloneRegistryNotaryConfig {
-    let raw = r#"
-deployment:
-  profile: local
-server:
-  bind: 127.0.0.1:0
-auth:
-  api_keys:
-    - id: local
-      fingerprint:
-        provider: env
-        name: TEST_DOCTOR_API_HASH
-      scopes: [registry_notary:credential_issue]
-audit:
-  sink: stdout
-evidence:
-  enabled: true
-  service_id: doctor-live-test
-  allowed_purposes: [doctor-test]
-  relay:
-    base_url: https://relay.internal.example
-    workload_client_id: registry-notary
-    token_file: /run/secrets/registry-notary-relay.jwt
-  claims:
-    - id: registry-backed-test
-      title: Registry-backed test
-      version: 2026-05
-      subject_type: person
-      purpose: doctor-test
-      required_scopes: [registry_notary:credential_issue]
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          test_source:
-            profile:
-              id: example.test-source.exact
-              contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-            inputs:
-              subject_id: target.id
-            outputs:
-              active: { type: boolean, nullable: false }
-      value:
-        type: boolean
-        nullable: false
-      rule:
-        type: consultation_matched
-        consultation: test_source
-      disclosure:
-        default: value
-        allowed: [value, redacted]
-      formats:
-        - application/vnd.registry-notary.claim-result+json
-"#;
-    serde_norway::from_str::<StandaloneRegistryNotaryConfig>(raw).expect("config parses")
-}
diff --git a/crates/registry-notary/tests/config_schema.rs b/crates/registry-notary/tests/config_schema.rs
deleted file mode 100644
index c2fa0e305..000000000
--- a/crates/registry-notary/tests/config_schema.rs
+++ /dev/null
@@ -1,826 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use std::collections::{BTreeSet, HashSet};
-use std::fs;
-use std::path::{Path, PathBuf};
-use std::process::Command;
-
-use jsonschema::{Draft, JSONSchema};
-use registry_notary_core::config::schema::{document, document_json, CONFIG_SCHEMA_ID};
-use registry_notary_core::{
-    ClaimEvidenceMode, SigningKeyProviderConfig, SigningKeyStatus, StandaloneRegistryNotaryConfig,
-};
-use registry_platform_authcommon::CredentialFingerprintProvider;
-use registry_platform_ops::{
-    deployment_waiver_reference_schema_fragment, deployment_waiver_summary_schema_fragment,
-    validate_deployment_waiver_metadata, DeploymentWaiverMetadataError,
-};
-use serde_json::{json, Value};
-
-const SCHEMA_ARTIFACT: &str = "schemas/registry-notary.config.schema.json";
-const CONFIG_REFERENCE: &str = "products/notary/docs/operator-config-reference.md";
-const DOCUMENTATION_INTENT: &str = "crates/registry-notary-core/config/documentation-intent.json";
-const KEY_PATHS_START: &str = "{/* registry-notary-config-key-paths:start */}";
-const KEY_PATHS_END: &str = "{/* registry-notary-config-key-paths:end */}";
-
-fn stack_root() -> PathBuf {
-    PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../..")
-}
-
-fn parse_yaml(path: &Path) -> Value {
-    let text = fs::read_to_string(path)
-        .unwrap_or_else(|error| panic!("failed to read {}: {error}", path.display()));
-    serde_norway::from_str(&text)
-        .unwrap_or_else(|error| panic!("failed to parse {} as YAML: {error}", path.display()))
-}
-
-fn compile_schema(schema: &Value) -> JSONSchema {
-    JSONSchema::options()
-        .with_draft(Draft::Draft202012)
-        .compile(schema)
-        .unwrap_or_else(|error| panic!("Notary schema must compile as Draft 2020-12: {error}"))
-}
-
-fn assert_valid(schema: &Value, instance: &Value, label: &str) {
-    let compiled = compile_schema(schema);
-    if let Err(errors) = compiled.validate(instance) {
-        let details = errors.map(|error| error.to_string()).collect::<Vec<_>>();
-        panic!("{label} must validate against the Notary schema: {details:#?}");
-    };
-}
-
-fn assert_invalid(schema: &Value, instance: &Value, label: &str) {
-    assert!(
-        !compile_schema(schema).is_valid(instance),
-        "{label} must be rejected by the Notary schema"
-    );
-}
-
-fn assert_runtime_deserializes(instance: &Value, label: &str) {
-    let yaml = serde_norway::to_string(instance)
-        .unwrap_or_else(|error| panic!("failed to serialize {label} as YAML: {error}"));
-    serde_norway::from_str::<StandaloneRegistryNotaryConfig>(&yaml)
-        .unwrap_or_else(|error| panic!("{label} must deserialize at runtime: {error}"));
-}
-
-fn assert_runtime_rejects(instance: &Value, label: &str) {
-    let yaml = serde_norway::to_string(instance)
-        .unwrap_or_else(|error| panic!("failed to serialize {label} as YAML: {error}"));
-    assert!(
-        serde_norway::from_str::<StandaloneRegistryNotaryConfig>(&yaml).is_err(),
-        "{label} must be rejected during runtime deserialization"
-    );
-}
-
-fn assert_runtime_load_rejects(instance: &Value, label: &str) {
-    let yaml = serde_norway::to_string(instance)
-        .unwrap_or_else(|error| panic!("failed to serialize {label} as YAML: {error}"));
-    if let Ok(config) = serde_norway::from_str::<StandaloneRegistryNotaryConfig>(&yaml) {
-        assert!(
-            config.validate().is_err(),
-            "{label} must be rejected during runtime validation"
-        );
-    }
-}
-
-fn maintained_runtime_fixtures() -> Vec<PathBuf> {
-    let profiles = stack_root().join("crates/registry-relay/profiles");
-    let mut fixtures = fs::read_dir(profiles)
-        .expect("profiles directory exists")
-        .filter_map(Result::ok)
-        .map(|entry| entry.path().join("notary-config.example.yaml"))
-        .filter(|path| path.is_file())
-        .collect::<Vec<_>>();
-    fixtures.sort();
-    fixtures
-}
-
-fn example_config() -> Value {
-    parse_yaml(&stack_root().join(
-        "crates/registry-relay/profiles/dhis2-2.41.9-enrollment-status/notary-config.example.yaml",
-    ))
-}
-
-fn config_with_deployment_waiver(reference: &str, summary: Option<&str>) -> Value {
-    let mut config = example_config();
-    let mut waiver = json!({
-        "finding": "notary.openapi.public",
-        "reference": reference,
-        "expires": "2999-01-01"
-    });
-    if let Some(summary) = summary {
-        waiver["summary"] = json!(summary);
-    }
-    config["deployment"] = json!({
-        "profile": "hosted_lab",
-        "waivers": [waiver]
-    });
-    config
-}
-
-fn with_authorization_details(mut config: Value) -> Value {
-    config["auth"]["api_keys"][0]["authorization_details"] = json!({
-        "type": "registry_notary_authorization",
-        "schema_version": "1",
-        "subject": { "binding_claim": "sub", "id_type": "person_id" },
-        "target": { "id_type": "person_id", "id": "target-123" },
-        "relationship": { "relationship_type": "guardian", "proof_claim": "guardianship" },
-        "assisted_access_context": { "channel": "service_desk" }
-    });
-    config
-}
-
-fn string_enum(schema: &Value, pointer: &str) -> BTreeSet<String> {
-    schema
-        .pointer(pointer)
-        .and_then(Value::as_array)
-        .unwrap_or_else(|| panic!("missing string enum at {pointer}"))
-        .iter()
-        .map(|value| {
-            value
-                .as_str()
-                .unwrap_or_else(|| panic!("non-string enum value at {pointer}"))
-                .to_string()
-        })
-        .collect()
-}
-
-fn collect_tag_constants(root: &Value, schema: &Value, values: &mut BTreeSet<String>) {
-    if let Some(reference) = schema.get("$ref").and_then(Value::as_str) {
-        let target = root
-            .pointer(reference.strip_prefix('#').expect("local schema reference"))
-            .unwrap_or_else(|| panic!("unresolved schema reference {reference}"));
-        collect_tag_constants(root, target, values);
-    }
-    for combinator in ["allOf", "anyOf", "oneOf"] {
-        if let Some(branches) = schema.get(combinator).and_then(Value::as_array) {
-            for branch in branches {
-                collect_tag_constants(root, branch, values);
-            }
-        }
-    }
-    if let Some(value) = schema
-        .get("properties")
-        .and_then(|properties| properties.get("type"))
-        .and_then(|tag| tag.get("const"))
-        .and_then(Value::as_str)
-    {
-        values.insert(value.to_string());
-    }
-}
-
-fn collect_key_paths(
-    root: &Value,
-    schema: &Value,
-    prefix: &str,
-    paths: &mut BTreeSet<String>,
-    visited_refs: &mut HashSet<String>,
-) {
-    if let Some(reference) = schema.get("$ref").and_then(Value::as_str) {
-        if visited_refs.insert(reference.to_string()) {
-            let target = root
-                .pointer(reference.strip_prefix('#').expect("local schema reference"))
-                .unwrap_or_else(|| panic!("unresolved schema reference {reference}"));
-            collect_key_paths(root, target, prefix, paths, visited_refs);
-            visited_refs.remove(reference);
-        }
-    }
-
-    for combinator in ["allOf", "anyOf", "oneOf"] {
-        if let Some(branches) = schema.get(combinator).and_then(Value::as_array) {
-            for branch in branches {
-                collect_key_paths(root, branch, prefix, paths, visited_refs);
-            }
-        }
-    }
-
-    if let Some(properties) = schema.get("properties").and_then(Value::as_object) {
-        for (name, property) in properties {
-            let property_path = if prefix.is_empty() {
-                name.to_string()
-            } else {
-                format!("{prefix}.{name}")
-            };
-            paths.insert(property_path.clone());
-            collect_key_paths(root, property, &property_path, paths, visited_refs);
-        }
-    }
-
-    if let Some(items) = schema.get("items").filter(|value| value.is_object()) {
-        let item_path = format!("{prefix}[]");
-        paths.insert(item_path.clone());
-        collect_key_paths(root, items, &item_path, paths, visited_refs);
-    }
-
-    if let Some(values) = schema
-        .get("additionalProperties")
-        .filter(|value| value.is_object())
-    {
-        let value_path = format!("{prefix}.*");
-        paths.insert(value_path.clone());
-        collect_key_paths(root, values, &value_path, paths, visited_refs);
-    }
-}
-
-fn documented_key_paths(reference: &str) -> BTreeSet<String> {
-    let Some((_, tail)) = reference.split_once(KEY_PATHS_START) else {
-        return BTreeSet::new();
-    };
-    let (block, _) = tail
-        .split_once(KEY_PATHS_END)
-        .unwrap_or_else(|| panic!("missing {KEY_PATHS_END}"));
-    block
-        .lines()
-        .map(str::trim)
-        .filter(|line| !line.is_empty() && *line != "```text" && *line != "```")
-        .map(str::to_string)
-        .collect()
-}
-
-#[test]
-fn generated_schema_is_draft_2020_12_with_stable_id_and_no_byte_drift() {
-    let generated = document();
-    compile_schema(&generated);
-    assert_eq!(
-        generated["$schema"],
-        "https://json-schema.org/draft/2020-12/schema"
-    );
-    assert_eq!(generated["$id"], CONFIG_SCHEMA_ID);
-
-    let artifact = fs::read_to_string(stack_root().join(SCHEMA_ARTIFACT))
-        .expect("committed Notary schema exists");
-    assert_eq!(artifact, document_json());
-    assert!(artifact.ends_with('\n'));
-    assert!(!artifact.ends_with("\n\n"));
-}
-
-#[test]
-fn schema_command_is_exactly_the_committed_artifact() {
-    let output = Command::new(env!("CARGO_BIN_EXE_registry-notary"))
-        .arg("schema")
-        .output()
-        .expect("schema command runs");
-    assert!(output.status.success());
-    assert!(output.stderr.is_empty());
-    assert_eq!(
-        output.stdout,
-        fs::read(stack_root().join(SCHEMA_ARTIFACT)).expect("committed Notary schema exists")
-    );
-}
-
-#[test]
-fn schema_command_does_not_read_config_environment_or_secret_values() {
-    let marker = "NOTARY_SCHEMA_MUST_NOT_READ_OR_EMIT_THIS_SECRET_VALUE";
-    let temp = tempfile::tempdir().expect("temporary working directory");
-    let output = Command::new(env!("CARGO_BIN_EXE_registry-notary"))
-        .arg("schema")
-        .current_dir(temp.path())
-        .env(
-            "REGISTRY_NOTARY_CONFIG",
-            temp.path().join("missing-config.yaml"),
-        )
-        .env("REGISTRY_NOTARY_SCHEMA_SECRET_SENTINEL", marker)
-        .output()
-        .expect("schema command runs without runtime inputs");
-
-    assert!(output.status.success());
-    assert!(output.stderr.is_empty());
-    assert_eq!(output.stdout, document_json().as_bytes());
-    assert!(!String::from_utf8(output.stdout).unwrap().contains(marker));
-}
-
-#[test]
-fn maintained_runtime_config_fixtures_validate_and_deserialize() {
-    let schema = document();
-    let fixtures = maintained_runtime_fixtures();
-    assert!(
-        fixtures.len() >= 2,
-        "fixture discovery unexpectedly narrowed"
-    );
-    for fixture in fixtures {
-        let instance = parse_yaml(&fixture);
-        assert_valid(&schema, &instance, &fixture.display().to_string());
-        assert_runtime_deserializes(&instance, &fixture.display().to_string());
-    }
-}
-
-#[test]
-fn strict_nested_objects_and_tagged_variants_match_runtime_deserialization() {
-    let schema = document();
-
-    let mut unknown_nested = example_config();
-    unknown_nested["evidence"]["claims"][0]["evidence_mode"]["unexpected"] = json!(true);
-    assert_invalid(&schema, &unknown_nested, "unknown evidence-mode field");
-    assert_runtime_rejects(&unknown_nested, "unknown evidence-mode field");
-
-    let mut unknown_fingerprint = example_config();
-    unknown_fingerprint["auth"]["api_keys"][0]["fingerprint"]["unexpected"] = json!(true);
-    assert_invalid(&schema, &unknown_fingerprint, "unknown fingerprint field");
-    assert_runtime_rejects(&unknown_fingerprint, "unknown fingerprint field");
-
-    let mut unknown_signing_provider = example_config();
-    unknown_signing_provider["evidence"]["signing_keys"] = json!({
-        "issuer": {
-            "provider": "not_a_provider",
-            "alg": "EdDSA",
-            "kid": "did:web:issuer.example#key",
-            "status": "active"
-        }
-    });
-    assert_invalid(
-        &schema,
-        &unknown_signing_provider,
-        "unknown signing-key provider",
-    );
-    assert_runtime_rejects(&unknown_signing_provider, "unknown signing-key provider");
-
-    let mut unknown_signing_status = example_config();
-    unknown_signing_status["evidence"]["signing_keys"] = json!({
-        "issuer": {
-            "provider": "local_jwk_env",
-            "alg": "EdDSA",
-            "kid": "did:web:issuer.example#key",
-            "status": "not_a_status"
-        }
-    });
-    assert_invalid(
-        &schema,
-        &unknown_signing_status,
-        "unknown signing-key status",
-    );
-    assert_runtime_rejects(&unknown_signing_status, "unknown signing-key status");
-}
-
-#[test]
-fn claim_value_max_bytes_schema_matches_runtime_bounds_and_compatibility() {
-    let schema = document();
-    let max_bytes_schema = schema
-        .pointer("/$defs/ClaimValueConfig/properties/max_bytes")
-        .expect("claim value max_bytes schema exists");
-    assert_eq!(max_bytes_schema["minimum"], json!(1));
-    assert_eq!(max_bytes_schema["maximum"], json!(65_536));
-
-    let mut absent = example_config();
-    absent["evidence"]["claims"][0]["value"]
-        .as_object_mut()
-        .expect("claim value is an object")
-        .remove("max_bytes");
-    assert_valid(&schema, &absent, "claim value without max_bytes");
-    assert_runtime_deserializes(&absent, "claim value without max_bytes");
-
-    for max_bytes in [1_u32, 65_536] {
-        let mut bounded = example_config();
-        bounded["evidence"]["claims"][0]["value"]["max_bytes"] = json!(max_bytes);
-        assert_valid(
-            &schema,
-            &bounded,
-            &format!("claim value max_bytes {max_bytes}"),
-        );
-        assert_runtime_deserializes(&bounded, &format!("claim value max_bytes {max_bytes}"));
-    }
-
-    for max_bytes in [0_u32, 65_537] {
-        let mut invalid = example_config();
-        invalid["evidence"]["claims"][0]["value"]["max_bytes"] = json!(max_bytes);
-        assert_invalid(
-            &schema,
-            &invalid,
-            &format!("claim value max_bytes {max_bytes}"),
-        );
-        assert_runtime_load_rejects(&invalid, &format!("claim value max_bytes {max_bytes}"));
-    }
-
-    let mut non_string = example_config();
-    non_string["evidence"]["claims"][0]["value"]["type"] = json!("boolean");
-    non_string["evidence"]["claims"][0]["value"]["max_bytes"] = json!(16);
-    assert_valid(
-        &schema,
-        &non_string,
-        "structural non-string max_bytes left to semantic validation",
-    );
-    assert_runtime_load_rejects(&non_string, "non-string claim value max_bytes");
-}
-
-#[test]
-fn deployment_waiver_schema_rejects_retired_and_noncanonical_metadata() {
-    let schema = document();
-    let mut config = example_config();
-    config["deployment"] = json!({
-        "profile": "hosted_lab",
-        "waivers": [{
-            "finding": "notary.openapi.public",
-            "reference": "OPS..42",
-            "expires": "2999-01-01"
-        }]
-    });
-    assert_invalid(&schema, &config, "waiver reference containing '..'");
-
-    config["deployment"]["waivers"][0]["reference"] = json!("OPS-42");
-    config["deployment"]["waivers"][0]["summary"] = Value::Null;
-    assert_invalid(&schema, &config, "null deployment waiver summary");
-    assert_runtime_load_rejects(&config, "null deployment waiver summary");
-
-    config["deployment"]["waivers"][0]
-        .as_object_mut()
-        .expect("waiver is an object")
-        .remove("summary");
-    config["deployment"]["waivers"][0]["reason"] = json!("retired waiver text");
-    assert_invalid(&schema, &config, "retired deployment waiver reason");
-    assert_runtime_load_rejects(&config, "retired deployment waiver reason");
-}
-
-#[test]
-fn deployment_waiver_schema_matches_shared_portable_metadata_contract() {
-    let schema = document();
-    assert_eq!(
-        schema.pointer("/$defs/DeploymentWaiverReference"),
-        Some(&deployment_waiver_reference_schema_fragment())
-    );
-    assert_eq!(
-        schema.pointer("/$defs/DeploymentWaiverSummary"),
-        Some(&deployment_waiver_summary_schema_fragment())
-    );
-
-    for reference in ["OPS-42", "Bearer:", "Authorization:Basic:"] {
-        validate_deployment_waiver_metadata(reference, None).unwrap_or_else(|error| {
-            panic!("runtime rejected valid reference {reference:?}: {error}")
-        });
-        assert_valid(
-            &schema,
-            &config_with_deployment_waiver(reference, None),
-            &format!("portable deployment waiver reference {reference:?}"),
-        );
-    }
-    for reference in ["Bearer:abcdef", "authorization:bAsIc:abc123", "Bearer::"] {
-        assert_eq!(
-            validate_deployment_waiver_metadata(reference, None),
-            Err(DeploymentWaiverMetadataError::ReferenceCredentialLiteral)
-        );
-        assert_invalid(
-            &schema,
-            &config_with_deployment_waiver(reference, None),
-            &format!("credential-shaped deployment waiver reference {reference:?}"),
-        );
-    }
-
-    for summary in [
-        "Ordinary operator summary".to_string(),
-        "\u{feff}summary\u{feff}".to_string(),
-        "summary\u{2028}continued".to_string(),
-        "é".repeat(256),
-    ] {
-        validate_deployment_waiver_metadata("OPS-42", Some(&summary))
-            .unwrap_or_else(|error| panic!("runtime rejected valid summary {summary:?}: {error}"));
-        assert_valid(
-            &schema,
-            &config_with_deployment_waiver("OPS-42", Some(&summary)),
-            "structurally valid deployment waiver summary",
-        );
-    }
-    for summary in [
-        String::new(),
-        " summary".to_string(),
-        "summary\u{3000}".to_string(),
-        "summary\u{001f}continued".to_string(),
-        "é".repeat(257),
-    ] {
-        assert!(
-            validate_deployment_waiver_metadata("OPS-42", Some(&summary)).is_err(),
-            "runtime must reject structurally invalid summary {summary:?}"
-        );
-        assert_invalid(
-            &schema,
-            &config_with_deployment_waiver("OPS-42", Some(&summary)),
-            "structurally invalid deployment waiver summary",
-        );
-    }
-
-    for summary in [
-        "Authorization: ＂Bearer abcdef＂",
-        concat!("accidentally pasted -----BEGIN PRIVATE ", "KEY-----"),
-        concat!(
-            "accidentally pasted -----BEGIN PGP PRIVATE KEY ",
-            "BLOCK-----"
-        ),
-    ] {
-        assert_eq!(
-            validate_deployment_waiver_metadata("OPS-42", Some(summary)),
-            Err(DeploymentWaiverMetadataError::SummaryCredentialLiteral)
-        );
-        let config = config_with_deployment_waiver("OPS-42", Some(summary));
-        assert_valid(
-            &schema,
-            &config,
-            "contextual waiver summary left to semantic validation",
-        );
-        assert_runtime_load_rejects(
-            &config,
-            "contextual waiver summary rejected by semantic validation",
-        );
-    }
-}
-
-#[test]
-fn authorization_details_preserve_extension_compatibility_at_every_policy_level() {
-    let schema = document();
-    let valid = with_authorization_details(example_config());
-    assert_valid(&schema, &valid, "authorization-details config");
-    assert_runtime_deserializes(&valid, "authorization-details config");
-
-    let mut root_unknown = valid.clone();
-    root_unknown["auth"]["api_keys"][0]["authorization_details"]["unexpected"] = json!(true);
-    assert_valid(
-        &schema,
-        &root_unknown,
-        "future authorization-details metadata",
-    );
-    assert_runtime_deserializes(&root_unknown, "future authorization-details metadata");
-
-    let mut subject_unknown = valid.clone();
-    subject_unknown["auth"]["api_keys"][0]["authorization_details"]["subject"]["unexpected"] =
-        json!(true);
-    assert_valid(
-        &schema,
-        &subject_unknown,
-        "future authorization subject metadata",
-    );
-    assert_runtime_deserializes(&subject_unknown, "future authorization subject metadata");
-
-    let mut target_unknown = valid.clone();
-    target_unknown["auth"]["api_keys"][0]["authorization_details"]["target"]["unexpected"] =
-        json!(true);
-    assert_valid(
-        &schema,
-        &target_unknown,
-        "future authorization target metadata",
-    );
-    assert_runtime_deserializes(&target_unknown, "future authorization target metadata");
-
-    let mut relationship_unknown = valid.clone();
-    relationship_unknown["auth"]["api_keys"][0]["authorization_details"]["relationship"]
-        ["unexpected"] = json!(true);
-    assert_valid(
-        &schema,
-        &relationship_unknown,
-        "future authorization relationship metadata",
-    );
-    assert_runtime_deserializes(
-        &relationship_unknown,
-        "future authorization relationship metadata",
-    );
-
-    let mut context_unknown = valid;
-    context_unknown["auth"]["api_keys"][0]["authorization_details"]["assisted_access_context"]
-        ["unexpected"] = json!(true);
-    assert_valid(
-        &schema,
-        &context_unknown,
-        "future assisted-access context metadata",
-    );
-    assert_runtime_deserializes(&context_unknown, "future assisted-access context metadata");
-}
-
-#[test]
-fn claim_ref_shorthand_and_object_forms_match_runtime_deserialization() {
-    let schema = document();
-    let mut valid = with_authorization_details(example_config());
-    valid["auth"]["api_keys"][0]["authorization_details"]["claims"] =
-        json!(["enrollment", { "id": "status", "version": "1" }]);
-    assert_valid(
-        &schema,
-        &valid,
-        "claim-reference shorthand and object forms",
-    );
-    assert_runtime_deserializes(&valid, "claim-reference shorthand and object forms");
-
-    let mut missing_id = valid.clone();
-    missing_id["auth"]["api_keys"][0]["authorization_details"]["claims"] =
-        json!([{ "version": "1" }]);
-    assert_invalid(&schema, &missing_id, "claim-reference object without id");
-    assert_runtime_rejects(&missing_id, "claim-reference object without id");
-
-    let mut unknown_field = valid;
-    unknown_field["auth"]["api_keys"][0]["authorization_details"]["claims"] =
-        json!([{ "id": "status", "unexpected": true }]);
-    assert_invalid(
-        &schema,
-        &unknown_field,
-        "claim-reference object with unknown field",
-    );
-    assert_runtime_rejects(&unknown_field, "claim-reference object with unknown field");
-}
-
-#[test]
-fn adapter_rosters_are_generated_from_runtime_labels() {
-    let schema = document();
-    let runtime_fingerprint_providers = CredentialFingerprintProvider::ALL
-        .iter()
-        .map(|provider| provider.as_str().to_string())
-        .collect();
-    assert_eq!(
-        string_enum(
-            &schema,
-            "/$defs/CredentialFingerprintRef/properties/provider/enum",
-        ),
-        runtime_fingerprint_providers,
-        "credential fingerprint provider schema must consume the runtime roster"
-    );
-    for provider in CredentialFingerprintProvider::ALL {
-        let label = serde_json::to_value(provider).expect("provider serializes");
-        assert_eq!(label, json!(provider.as_str()));
-        assert_eq!(
-            serde_json::from_value::<CredentialFingerprintProvider>(label)
-                .expect("provider label deserializes"),
-            *provider
-        );
-    }
-
-    let runtime_key_providers = SigningKeyProviderConfig::ALL
-        .iter()
-        .map(|provider| provider.as_str().to_string())
-        .collect();
-    assert_eq!(
-        string_enum(&schema, "/$defs/SigningKeyProviderSchema/enum"),
-        runtime_key_providers,
-        "signing-key provider schema must consume the runtime roster"
-    );
-    for provider in SigningKeyProviderConfig::ALL {
-        let label = serde_json::to_value(provider).expect("provider serializes");
-        assert_eq!(label, json!(provider.as_str()));
-        assert_eq!(
-            serde_json::from_value::<SigningKeyProviderConfig>(label)
-                .expect("provider label deserializes"),
-            *provider
-        );
-    }
-
-    let runtime_key_statuses = SigningKeyStatus::ALL
-        .iter()
-        .map(|status| status.as_str().to_string())
-        .collect();
-    assert_eq!(
-        string_enum(&schema, "/$defs/SigningKeyStatusSchema/enum"),
-        runtime_key_statuses,
-        "signing-key status schema must consume the runtime roster"
-    );
-    for status in SigningKeyStatus::ALL {
-        let label = serde_json::to_value(status).expect("status serializes");
-        assert_eq!(label, json!(status.as_str()));
-        assert_eq!(
-            serde_json::from_value::<SigningKeyStatus>(label).expect("status label deserializes"),
-            *status
-        );
-    }
-
-    let runtime_evidence_modes = [serde_json::to_value(ClaimEvidenceMode::RegistryBacked {
-        consultations: Default::default(),
-    })
-    .expect("registry-backed mode serializes")]
-    .into_iter()
-    .map(|value| value["type"].as_str().expect("mode type label").to_string())
-    .collect();
-    let mut schema_evidence_modes = BTreeSet::new();
-    collect_tag_constants(
-        &schema,
-        schema
-            .pointer("/$defs/ClaimEvidenceMode")
-            .expect("claim evidence-mode schema exists"),
-        &mut schema_evidence_modes,
-    );
-    assert_eq!(
-        schema_evidence_modes, runtime_evidence_modes,
-        "claim evidence-mode schema must share the runtime tagged contract"
-    );
-}
-
-#[test]
-fn adapter_variant_rosters_and_scalar_shapes_match_runtime_deserialization() {
-    let schema = document();
-
-    let valid = example_config();
-    assert_valid(&schema, &valid, "maintained registry-backed config");
-    assert_runtime_deserializes(&valid, "maintained registry-backed config");
-
-    let mut invalid_duration = example_config();
-    invalid_duration["server"]["request_timeout"] = json!("not-a-duration");
-    assert_valid(
-        &schema,
-        &invalid_duration,
-        "duration shape delegated to the runtime parser",
-    );
-    assert_runtime_rejects(&invalid_duration, "invalid duration");
-
-    let mut invalid_socket = example_config();
-    invalid_socket["server"]["bind"] = json!("not-a-socket");
-    assert_valid(
-        &schema,
-        &invalid_socket,
-        "socket shape delegated to the runtime parser",
-    );
-    assert_runtime_rejects(&invalid_socket, "invalid socket address");
-
-    let mut invalid_cidr = example_config();
-    invalid_cidr["evidence"]["relay"]["allowed_private_cidrs"] = json!(["not-a-cidr"]);
-    assert_valid(
-        &schema,
-        &invalid_cidr,
-        "CIDR shape delegated to the runtime parser",
-    );
-    assert_runtime_rejects(&invalid_cidr, "invalid private CIDR");
-
-    let mut deferred_fingerprint_shape = example_config();
-    deferred_fingerprint_shape["auth"]["api_keys"][0]["fingerprint"] =
-        json!({"provider": "env", "path": "/mounted/fingerprint"});
-    assert_valid(
-        &schema,
-        &deferred_fingerprint_shape,
-        "credential-fingerprint reference shape deferred to runtime validation",
-    );
-    assert_runtime_deserializes(
-        &deferred_fingerprint_shape,
-        "credential-fingerprint reference shape deferred to runtime validation",
-    );
-
-    let mut removed_evidence_mode = example_config();
-    removed_evidence_mode["evidence"]["claims"][0]["evidence_mode"] =
-        json!({"type": "self_attested"});
-    assert_invalid(
-        &schema,
-        &removed_evidence_mode,
-        "removed self_attested evidence mode",
-    );
-    assert_runtime_rejects(
-        &removed_evidence_mode,
-        "removed self_attested evidence mode",
-    );
-}
-
-#[test]
-fn schema_contains_no_concrete_secret_values() {
-    let schema = document();
-    let text = serde_json::to_string(&schema).expect("schema serializes");
-    for secret in [
-        "REGISTRY_NOTARY_DHIS2_API_KEY_HASH",
-        "REGISTRY_NOTARY_AUDIT_HASH_SECRET",
-        "/var/run/secrets/registry-notary/relay-access-token",
-    ] {
-        assert!(
-            !text.contains(secret),
-            "schema must not contain fixture secret material or paths: {secret}"
-        );
-    }
-}
-
-#[test]
-fn schema_and_configuration_reference_have_exact_bidirectional_key_path_parity() {
-    let schema = document();
-    let mut schema_paths = BTreeSet::new();
-    collect_key_paths(&schema, &schema, "", &mut schema_paths, &mut HashSet::new());
-    let reference = fs::read_to_string(stack_root().join(CONFIG_REFERENCE))
-        .expect("configuration reference exists");
-    let documented_paths = documented_key_paths(&reference);
-    assert_eq!(
-        documented_paths,
-        schema_paths,
-        "configuration key paths differ; generated schema paths follow:\n{}",
-        schema_paths.iter().cloned().collect::<Vec<_>>().join("\n")
-    );
-}
-
-#[test]
-fn product_owned_documentation_intent_has_exact_runtime_key_inventory() {
-    let schema = document();
-    let mut schema_paths = BTreeSet::new();
-    collect_key_paths(&schema, &schema, "", &mut schema_paths, &mut HashSet::new());
-    let intent: Value = serde_json::from_slice(
-        &fs::read(stack_root().join(DOCUMENTATION_INTENT))
-            .expect("Notary documentation intent exists"),
-    )
-    .expect("Notary documentation intent parses");
-    assert_eq!(intent["runtime_schema"], "notary");
-    assert_eq!(intent["schema_id"], CONFIG_SCHEMA_ID);
-    let assignments = intent["assignments"]
-        .as_array()
-        .expect("Notary intent assignments are an array");
-    assert_eq!(assignments.len(), 534);
-    let assigned_paths = assignments
-        .iter()
-        .map(|assignment| {
-            assert_eq!(assignment["schema"], "notary");
-            assert_eq!(assignment["schema_facts_reviewed"], true);
-            assignment["key_path"]
-                .as_str()
-                .expect("assignment key_path is a string")
-                .to_owned()
-        })
-        .filter(|path| !path.is_empty())
-        .collect::<BTreeSet<_>>();
-    assert_eq!(assigned_paths, schema_paths);
-    assert_eq!(
-        assignments
-            .iter()
-            .filter(|assignment| assignment["path_kind"] == "map_value")
-            .count(),
-        9
-    );
-}
diff --git a/crates/registry-notary/tests/config_verify_bundle_cli.rs b/crates/registry-notary/tests/config_verify_bundle_cli.rs
deleted file mode 100644
index a51b048c0..000000000
--- a/crates/registry-notary/tests/config_verify_bundle_cli.rs
+++ /dev/null
@@ -1,774 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Binary-level coverage for config bundle v1 verification.
-
-use std::path::PathBuf;
-use std::process::Command;
-
-use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
-use registry_platform_config::{
-    sha256_uri, ConfigBundleFile, ConfigBundleManifest, ConfigBundleSignature,
-    ConfigBundleSignatureEnvelope, ConfigTrustAnchor, ConfigTrustAnchorSigner,
-    ProductAcceptanceIdentityV1, ProductAcceptanceLaneV1, ProductAcceptanceProductV1,
-    ProductTrustDomainV1,
-};
-use registry_platform_crypto::{canonicalize_json, sign, PrivateJwk};
-use registry_platform_ops::{
-    AntiRollbackKey, AntiRollbackRecord, ConfigOverrideMode, ConfigOverridePin,
-    FileAntiRollbackStore, BUNDLE_VERIFICATION_CODE_DEFINITIONS,
-};
-use serde_json::Value;
-use tempfile::TempDir;
-
-const PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA"}"#;
-const TEST_TOKEN_HASH: &str =
-    "sha256:31f2999a69fa6301763a9f61eea44388a13318ce8b80a16a115a9efdb62b883b";
-const TEST_AUDIT_HASH_SECRET: &str = "registry-notary-cli-audit-secret-32-bytes";
-const ZERO_HASH: &str = "sha256:0000000000000000000000000000000000000000000000000000000000000000";
-const USER_SENTINEL: &str = "redaction-user@example.test";
-const COUNTRY_SENTINEL: &str = "REDACTION_COUNTRY_VALUE";
-const STREAM_ID: &str = "notary-test-stream";
-const BUNDLE_ID: &str = "notary-test-bundle";
-const ERROR_MESSAGE_SENTINELS: &[&str] = &[
-    USER_SENTINEL,
-    COUNTRY_SENTINEL,
-    TEST_AUDIT_HASH_SECRET,
-    "REDACTION_SECRET_VALUE",
-    "REDACTION_PARSER_STRING",
-    "REDACTION_LOCAL_PATH",
-    "/Users/",
-];
-
-struct BundleFixture {
-    bundle_dir: PathBuf,
-    anchor_path: PathBuf,
-    state_path: PathBuf,
-    config_path: PathBuf,
-    config_hash: String,
-    signer_kid: String,
-}
-
-#[test]
-fn config_verify_bundle_cli_reports_verified_signed_bundle() {
-    let temp = TempDir::new().expect("tempdir");
-    let fixture = write_bundle_fixture(&temp, "registry-notary", 0);
-
-    let output = verify_bundle_command(&fixture)
-        .output()
-        .expect("command runs");
-
-    assert!(
-        output.status.success(),
-        "stderr: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let report = stdout_json(&output);
-    assert_eq!(report["result"], "verified");
-    assert_eq!(report["component"], "registry-notary");
-    assert_eq!(report["stream_id"], STREAM_ID);
-    assert_eq!(report["bundle_id"], BUNDLE_ID);
-    assert_eq!(report["bundle_sequence"], 1);
-    assert_eq!(report["previous_config_hash"], ZERO_HASH);
-    assert_eq!(report["config_hash"], fixture.config_hash);
-    assert_eq!(report["errors"], serde_json::json!([]));
-    assert_eq!(
-        String::from_utf8(output.stderr).expect("stderr is UTF-8"),
-        ""
-    );
-}
-
-#[test]
-fn config_verify_bundle_cli_reports_rejected_rollback() {
-    let temp = TempDir::new().expect("tempdir");
-    let fixture = write_bundle_fixture(&temp, "registry-notary", 2);
-
-    let output = verify_bundle_command(&fixture)
-        .output()
-        .expect("command runs");
-
-    assert!(!output.status.success());
-    let report = stdout_json(&output);
-    assert_eq!(report["result"], "rejected_rollback");
-    assert_eq!(report["errors"][0]["code"], "rejected_rollback");
-    assert_rejected_output_boundary(&output, &report, "rejected_rollback", &fixture, &[]);
-}
-
-#[test]
-fn config_verify_bundle_cli_rejects_expired_override_pin() {
-    let temp = TempDir::new().expect("tempdir");
-    let fixture = write_bundle_fixture(&temp, "registry-notary", 2);
-    std::fs::write(
-        &fixture.state_path,
-        serde_json::to_vec_pretty(&AntiRollbackRecord {
-            key: AntiRollbackKey {
-                acceptance_identity: notary_acceptance_identity(),
-            },
-            last_sequence: 2,
-            last_config_hash:
-                "sha256:1111111111111111111111111111111111111111111111111111111111111111"
-                    .to_string(),
-            last_bundle_manifest_hash:
-                "sha256:2222222222222222222222222222222222222222222222222222222222222222"
-                    .to_string(),
-            last_bundle_id: "preceding-bundle".to_string(),
-            accepted_anchor: registry_platform_ops::AcceptedAnchorPinV1::from_trust_anchor(
-                &registry_platform_config::load_trust_anchor(&fixture.anchor_path)
-                    .expect("anchor loads"),
-            )
-            .expect("anchor pin derives"),
-            override_pin: Some(ConfigOverridePin {
-                active: true,
-                mode: ConfigOverrideMode::AcceptRollback,
-                config_hash: fixture.config_hash.clone(),
-                config_path: None,
-                expires_at: Some("2026-07-07T10:00:00Z".to_string()),
-                used_at: "2026-07-07T09:00:00Z".to_string(),
-                operator: USER_SENTINEL.to_string(),
-                reason: format!(
-                    "{COUNTRY_SENTINEL} REDACTION_SECRET_VALUE REDACTION_PARSER_STRING REDACTION_LOCAL_PATH"
-                ),
-            }),
-            break_glass: Default::default(),
-            local_approvals: Default::default(),
-        })
-        .expect("state serializes"),
-    )
-    .expect("state writes");
-
-    let output = verify_bundle_command(&fixture)
-        .output()
-        .expect("command runs");
-
-    assert!(!output.status.success());
-    let report = stdout_json(&output);
-    assert_eq!(report["result"], "rejected_rollback");
-    assert_eq!(report["errors"][0]["code"], "rejected_rollback");
-    assert_rejected_output_boundary(&output, &report, "rejected_rollback", &fixture, &[]);
-}
-
-#[test]
-fn config_verify_bundle_cli_reports_rejected_binding() {
-    let temp = TempDir::new().expect("tempdir");
-    let fixture = write_bundle_fixture(&temp, "registry-relay", 0);
-
-    let output = verify_bundle_command(&fixture)
-        .output()
-        .expect("command runs");
-
-    assert!(!output.status.success());
-    let report = stdout_json(&output);
-    assert_eq!(report["result"], "rejected_binding");
-    assert_eq!(report["errors"][0]["code"], "rejected_binding");
-    assert_rejected_output_boundary(&output, &report, "rejected_binding", &fixture, &[]);
-}
-
-#[test]
-fn config_verify_bundle_cli_rejects_missing_instance_binding_value_free() {
-    let temp = TempDir::new().expect("tempdir");
-    let fixture = write_bundle_fixture(&temp, "registry-notary", 0);
-    rewrite_manifest_instance_id(&fixture, None);
-
-    let output = verify_bundle_command(&fixture)
-        .output()
-        .expect("command runs");
-
-    assert!(!output.status.success());
-    let report = stdout_json(&output);
-    assert_rejected_output_boundary(&output, &report, "rejected_binding", &fixture, &[]);
-    let record = FileAntiRollbackStore::new(&fixture.state_path)
-        .load(&AntiRollbackKey {
-            acceptance_identity: notary_acceptance_identity(),
-        })
-        .expect("existing instance lane remains readable");
-    assert_eq!(record.last_sequence, 1);
-}
-
-#[test]
-fn config_verify_bundle_cli_reports_rejected_signature_for_hash_mismatch() {
-    let temp = TempDir::new().expect("tempdir");
-    let fixture = write_bundle_fixture(&temp, "registry-notary", 0);
-    let changed = b"changed config bytes";
-    let actual_hash = sha256_uri(changed);
-    std::fs::write(&fixture.config_path, changed).expect("config changes");
-
-    let output = verify_bundle_command(&fixture)
-        .output()
-        .expect("command runs");
-
-    assert!(!output.status.success());
-    let report = stdout_json(&output);
-    assert_eq!(report["result"], "rejected_signature");
-    assert_eq!(report["errors"][0]["code"], "rejected_signature");
-    assert_rejected_output_boundary(
-        &output,
-        &report,
-        "rejected_signature",
-        &fixture,
-        &[
-            "config/notary.yaml",
-            fixture.config_hash.as_str(),
-            actual_hash.as_str(),
-            fixture.config_path.to_str().expect("path is UTF-8"),
-        ],
-    );
-}
-
-#[test]
-fn config_verify_bundle_cli_malformed_anchor_has_value_free_stdout_and_stderr() {
-    let temp = TempDir::new().expect("tempdir");
-    let mut fixture = write_bundle_fixture(&temp, "registry-notary", 0);
-    let private_dir = temp
-        .path()
-        .join(format!("REDACTION_LOCAL_PATH-{USER_SENTINEL}"));
-    std::fs::create_dir_all(&private_dir).expect("private anchor dir");
-    fixture.anchor_path = private_dir.join(format!("{COUNTRY_SENTINEL}-anchor.json"));
-    std::fs::write(
-        &fixture.anchor_path,
-        "{\"secret\":\"REDACTION_SECRET_VALUE\",\"parser\":[\"REDACTION_PARSER_STRING\"",
-    )
-    .expect("malformed anchor writes");
-
-    let output = verify_bundle_command(&fixture)
-        .output()
-        .expect("command runs");
-
-    assert!(!output.status.success());
-    let report = stdout_json(&output);
-    assert_rejected_output_boundary(
-        &output,
-        &report,
-        "rejected_validation",
-        &fixture,
-        &[fixture.anchor_path.to_str().expect("path is UTF-8")],
-    );
-}
-
-#[test]
-fn config_verify_bundle_cli_file_closure_has_value_free_stdout_and_stderr() {
-    let temp = TempDir::new().expect("tempdir");
-    let fixture = write_bundle_fixture(&temp, "registry-notary", 0);
-    let unexpected_path = fixture
-        .bundle_dir
-        .join("config")
-        .join(format!("{COUNTRY_SENTINEL}-REDACTION_SECRET_VALUE.yaml"));
-    std::fs::write(
-        &unexpected_path,
-        format!("{USER_SENTINEL} REDACTION_PARSER_STRING"),
-    )
-    .expect("unexpected bundle file writes");
-
-    let output = verify_bundle_command(&fixture)
-        .output()
-        .expect("command runs");
-
-    assert!(!output.status.success());
-    let report = stdout_json(&output);
-    assert_rejected_output_boundary(
-        &output,
-        &report,
-        "rejected_signature",
-        &fixture,
-        &[unexpected_path.to_str().expect("path is UTF-8")],
-    );
-}
-
-#[test]
-fn config_verify_bundle_cli_config_parser_failure_has_value_free_stdout_and_stderr() {
-    let temp = TempDir::new().expect("tempdir");
-    let malformed_config = format!(
-        "country: {COUNTRY_SENTINEL}\nsecret: [REDACTION_SECRET_VALUE\nparser: REDACTION_PARSER_STRING\nuser: {USER_SENTINEL}\n"
-    );
-    let fixture =
-        write_bundle_fixture_with_config(&temp, "registry-notary", 0, malformed_config.clone());
-
-    let output = verify_bundle_command(&fixture)
-        .output()
-        .expect("command runs");
-
-    assert!(!output.status.success());
-    let report = stdout_json(&output);
-    assert_rejected_output_boundary(
-        &output,
-        &report,
-        "rejected_validation",
-        &fixture,
-        &[malformed_config.as_str()],
-    );
-}
-
-#[test]
-fn config_verify_bundle_cli_non_utf8_config_has_value_free_stdout_and_stderr() {
-    let temp = TempDir::new().expect("tempdir");
-    let mut fixture = write_bundle_fixture(&temp, "registry-notary", 0);
-    let invalid_utf8 = b"\xffREDACTION_SECRET_VALUE REDACTION_PARSER_STRING";
-    resign_config_bytes(&mut fixture, invalid_utf8);
-
-    let output = verify_bundle_command(&fixture)
-        .output()
-        .expect("command runs");
-
-    assert!(!output.status.success());
-    let report = stdout_json(&output);
-    assert_rejected_output_boundary(
-        &output,
-        &report,
-        "rejected_validation",
-        &fixture,
-        &["REDACTION_SECRET_VALUE", "REDACTION_PARSER_STRING"],
-    );
-}
-
-#[test]
-fn config_verify_bundle_cli_shared_parity_matrix() {
-    let cases = [
-        (
-            "valid_signed_bundle",
-            "registry-notary",
-            0,
-            false,
-            true,
-            "verified",
-        ),
-        (
-            "rollback",
-            "registry-notary",
-            2,
-            false,
-            false,
-            "rejected_rollback",
-        ),
-        (
-            "binding_mismatch",
-            "registry-relay",
-            0,
-            false,
-            false,
-            "rejected_binding",
-        ),
-        (
-            "hash_mismatch",
-            "registry-notary",
-            0,
-            true,
-            false,
-            "rejected_signature",
-        ),
-    ];
-
-    for (name, manifest_product, last_sequence, change_config, should_succeed, expected) in cases {
-        let temp = TempDir::new().expect(name);
-        let fixture = write_bundle_fixture(&temp, manifest_product, last_sequence);
-        if change_config {
-            std::fs::write(&fixture.config_path, b"changed config bytes").expect(name);
-        }
-
-        let output = verify_bundle_command(&fixture).output().expect(name);
-
-        assert_eq!(
-            output.status.success(),
-            should_succeed,
-            "{name} stderr: {}",
-            String::from_utf8_lossy(&output.stderr)
-        );
-        let report = stdout_json(&output);
-        assert_eq!(report["result"], expected, "{name}");
-        if should_succeed {
-            assert_eq!(report["component"], "registry-notary", "{name}");
-        } else {
-            assert_eq!(report["errors"][0]["code"], expected, "{name}");
-            assert_rejected_output_boundary(&output, &report, expected, &fixture, &[]);
-        }
-    }
-}
-
-#[test]
-fn config_verify_bundle_cli_runs_deployment_gates() {
-    let temp = TempDir::new().expect("tempdir");
-    let config = notary_config_yaml().replace("  profile: local", "  profile: evidence_grade");
-    let fixture = write_bundle_fixture_with_config(&temp, "registry-notary", 0, config);
-
-    let output = verify_bundle_command(&fixture)
-        .output()
-        .expect("command runs");
-
-    assert!(!output.status.success());
-    let report = stdout_json(&output);
-    assert_eq!(report["result"], "rejected_validation");
-    assert_eq!(report["errors"][0]["code"], "rejected_validation");
-    assert_rejected_output_boundary(
-        &output,
-        &report,
-        "rejected_validation",
-        &fixture,
-        &["notary.audit.sink_missing"],
-    );
-}
-
-#[test]
-fn config_verify_bundle_cli_rejects_governed_shared_admin_listener() {
-    let temp = TempDir::new().expect("tempdir");
-    let config = notary_config_yaml().replace(
-        "server:\n  bind: 127.0.0.1:0\n  admin_listener:\n    mode: dedicated\n    bind: 127.0.0.1:1\n",
-        "server:\n  bind: 127.0.0.1:0\n  admin_listener:\n    mode: shared_with_public\n",
-    );
-    let fixture = write_bundle_fixture_with_config(&temp, "registry-notary", 0, config);
-
-    let output = verify_bundle_command(&fixture)
-        .output()
-        .expect("command runs");
-
-    assert!(!output.status.success());
-    let report = stdout_json(&output);
-    assert_eq!(report["result"], "rejected_validation");
-    assert_eq!(report["errors"][0]["code"], "rejected_validation");
-    assert_rejected_output_boundary(
-        &output,
-        &report,
-        "rejected_validation",
-        &fixture,
-        &["server.admin_listener.mode = dedicated"],
-    );
-}
-
-fn bundle_code_definition(
-    expected_code: &str,
-) -> &'static registry_platform_ops::BundleVerificationCodeDefinition {
-    BUNDLE_VERIFICATION_CODE_DEFINITIONS
-        .iter()
-        .find(|definition| definition.code.as_str() == expected_code)
-        .expect("published code has a catalog definition")
-}
-
-fn assert_rejected_output_boundary(
-    output: &std::process::Output,
-    report: &Value,
-    expected_code: &str,
-    fixture: &BundleFixture,
-    extra_sentinels: &[&str],
-) {
-    assert_eq!(report["result"], expected_code);
-    assert_eq!(report["errors"][0]["code"], expected_code);
-    let definition = bundle_code_definition(expected_code);
-    assert_eq!(
-        report["errors"][0]["message"], definition.safe_report_message,
-        "public message must be the reviewed static catalog meaning and remediation"
-    );
-    assert_eq!(report["stream_id"], "unknown");
-    for field in [
-        "bundle_id",
-        "bundle_sequence",
-        "previous_config_hash",
-        "config_hash",
-    ] {
-        assert_eq!(
-            report[field],
-            Value::Null,
-            "rejected report must not publish manifest-derived {field}"
-        );
-    }
-    let stderr = String::from_utf8(output.stderr.clone()).expect("stderr is UTF-8");
-    assert_eq!(
-        stderr,
-        format!(
-            "ERROR {expected_code}: {}\n",
-            definition.safe_report_message
-        ),
-        "child stderr must contain only the stable catalog failure"
-    );
-    let full_output = format!(
-        "{}\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    for sentinel in ERROR_MESSAGE_SENTINELS
-        .iter()
-        .copied()
-        .chain([
-            STREAM_ID,
-            BUNDLE_ID,
-            ZERO_HASH,
-            fixture.config_hash.as_str(),
-            fixture.signer_kid.as_str(),
-            fixture.config_path.to_str().expect("path is UTF-8"),
-            fixture.bundle_dir.to_str().expect("path is UTF-8"),
-            fixture.state_path.to_str().expect("path is UTF-8"),
-        ])
-        .chain(extra_sentinels.iter().copied())
-    {
-        assert!(
-            !full_output.contains(sentinel),
-            "rejected command leaked sentinel {sentinel:?}: {full_output}"
-        );
-    }
-}
-
-fn verify_bundle_command(fixture: &BundleFixture) -> Command {
-    let mut command = Command::new(env!("CARGO_BIN_EXE_registry-notary"));
-    command.args([
-        "config",
-        "verify-bundle",
-        "--bundle-dir",
-        fixture.bundle_dir.to_str().expect("path is UTF-8"),
-        "--anchor-path",
-        fixture.anchor_path.to_str().expect("path is UTF-8"),
-        "--state-path",
-        fixture.state_path.to_str().expect("path is UTF-8"),
-    ]);
-    command.env("TEST_TOKEN_HASH", TEST_TOKEN_HASH);
-    command.env("TEST_AUDIT_HASH_SECRET", TEST_AUDIT_HASH_SECRET);
-    command.env("ISSUER_KEY", PRIVATE_JWK);
-    command
-}
-
-fn write_bundle_fixture(
-    temp: &TempDir,
-    manifest_product: &str,
-    last_sequence: u64,
-) -> BundleFixture {
-    write_bundle_fixture_with_config(temp, manifest_product, last_sequence, notary_config_yaml())
-}
-
-fn notary_acceptance_identity() -> ProductAcceptanceIdentityV1 {
-    ProductAcceptanceIdentityV1 {
-        trust_domain: ProductTrustDomainV1::Governed,
-        project: "notary-cli-project".to_string(),
-        environment: "development".to_string(),
-        lane: ProductAcceptanceLaneV1::Notary,
-        product: ProductAcceptanceProductV1::RegistryNotary,
-        stream: STREAM_ID.to_string(),
-        instance: "notary-cli".to_string(),
-    }
-}
-
-fn acceptance_identity_for_product(product: &str) -> ProductAcceptanceIdentityV1 {
-    let mut identity = notary_acceptance_identity();
-    if product == "registry-relay" {
-        identity.lane = ProductAcceptanceLaneV1::RelayConsultation;
-        identity.product = ProductAcceptanceProductV1::RegistryRelay;
-    } else {
-        assert_eq!(product, "registry-notary");
-    }
-    identity
-}
-
-fn write_bundle_fixture_with_config(
-    temp: &TempDir,
-    manifest_product: &str,
-    last_sequence: u64,
-    config: String,
-) -> BundleFixture {
-    let bundle_dir = temp.path().join("bundle");
-    let config_dir = bundle_dir.join("config");
-    std::fs::create_dir_all(&config_dir).expect("bundle config dir");
-    let config_path = config_dir.join("notary.yaml");
-    std::fs::write(&config_path, config.as_bytes()).expect("config writes");
-    let config_hash = sha256_uri(config.as_bytes());
-
-    let private = PrivateJwk::parse(PRIVATE_JWK).expect("private JWK parses");
-    let public = private.public();
-    let kid = public.jkt().expect("thumbprint computes");
-    let manifest = ConfigBundleManifest {
-        schema: "registry.platform.config_bundle.v1".to_string(),
-        acceptance_identity: acceptance_identity_for_product(manifest_product),
-        bundle_id: BUNDLE_ID.to_string(),
-        sequence: 1,
-        previous_config_hash: Some(ZERO_HASH.to_string()),
-        config_hash: config_hash.clone(),
-        files: vec![ConfigBundleFile {
-            path: "config/notary.yaml".to_string(),
-            sha256: config_hash.clone(),
-        }],
-        created_at: "2026-07-07T10:00:00Z".to_string(),
-    };
-    write_manifest_and_signature(&bundle_dir, &manifest, &private, &kid);
-
-    let anchor = ConfigTrustAnchor {
-        schema: "registry.platform.config_trust_anchor.v1".to_string(),
-        acceptance_identity: acceptance_identity_for_product(manifest_product),
-        version: 1,
-        threshold: 1,
-        enabled_signers: vec![ConfigTrustAnchorSigner {
-            kid: kid.clone(),
-            jwk: public,
-        }],
-    };
-    let anchor_path = temp.path().join("trust_anchor.json");
-    std::fs::write(
-        &anchor_path,
-        serde_json::to_vec_pretty(&anchor).expect("anchor serializes"),
-    )
-    .expect("anchor writes");
-
-    let state_path = temp.path().join("antirollback.json");
-    let verified = registry_platform_config::verify_config_bundle(&bundle_dir, &anchor_path)
-        .expect("fixture bundle verifies");
-    let accepted_anchor =
-        registry_platform_ops::AcceptedAnchorPinV1::from_trust_anchor(&verified.trust_anchor)
-            .expect("anchor pin derives");
-    let state = AntiRollbackRecord {
-        key: AntiRollbackKey {
-            acceptance_identity: notary_acceptance_identity(),
-        },
-        last_sequence: if last_sequence == 0 {
-            manifest.sequence
-        } else {
-            last_sequence
-        },
-        last_config_hash: if last_sequence == 0 {
-            config_hash.clone()
-        } else {
-            "sha256:1111111111111111111111111111111111111111111111111111111111111111".to_string()
-        },
-        last_bundle_manifest_hash: if last_sequence == 0 {
-            verified.manifest_hash
-        } else {
-            "sha256:2222222222222222222222222222222222222222222222222222222222222222".to_string()
-        },
-        last_bundle_id: if last_sequence == 0 {
-            BUNDLE_ID.to_string()
-        } else {
-            "preceding-bundle".to_string()
-        },
-        accepted_anchor,
-        override_pin: None,
-        break_glass: Default::default(),
-        local_approvals: Default::default(),
-    };
-    std::fs::write(
-        &state_path,
-        serde_json::to_vec_pretty(&state).expect("state serializes"),
-    )
-    .expect("pre-existing state writes");
-
-    BundleFixture {
-        bundle_dir,
-        anchor_path,
-        state_path,
-        config_path,
-        config_hash,
-        signer_kid: kid,
-    }
-}
-
-fn rewrite_manifest_instance_id(fixture: &BundleFixture, instance_id: Option<&str>) {
-    let manifest_path = fixture.bundle_dir.join("manifest.json");
-    let mut manifest: ConfigBundleManifest =
-        serde_json::from_slice(&std::fs::read(&manifest_path).expect("manifest reads"))
-            .expect("manifest parses");
-    manifest.acceptance_identity.instance = instance_id.unwrap_or_default().to_string();
-    let private = PrivateJwk::parse(PRIVATE_JWK).expect("private JWK parses");
-    write_manifest_and_signature(
-        &fixture.bundle_dir,
-        &manifest,
-        &private,
-        &fixture.signer_kid,
-    );
-}
-
-fn resign_config_bytes(fixture: &mut BundleFixture, config_bytes: &[u8]) {
-    std::fs::write(&fixture.config_path, config_bytes).expect("config bytes write");
-    let config_hash = sha256_uri(config_bytes);
-    let manifest_path = fixture.bundle_dir.join("manifest.json");
-    let mut manifest: ConfigBundleManifest =
-        serde_json::from_slice(&std::fs::read(&manifest_path).expect("manifest reads"))
-            .expect("manifest parses");
-    manifest.config_hash = config_hash.clone();
-    manifest.files[0].sha256 = config_hash.clone();
-    let private = PrivateJwk::parse(PRIVATE_JWK).expect("private JWK parses");
-    write_manifest_and_signature(
-        &fixture.bundle_dir,
-        &manifest,
-        &private,
-        &fixture.signer_kid,
-    );
-    let verified =
-        registry_platform_config::verify_config_bundle(&fixture.bundle_dir, &fixture.anchor_path)
-            .expect("resigned bundle verifies");
-    let key = AntiRollbackKey {
-        acceptance_identity: notary_acceptance_identity(),
-    };
-    let mut record = FileAntiRollbackStore::new(&fixture.state_path)
-        .load(&key)
-        .expect("acceptance state loads");
-    record.last_config_hash = config_hash.clone();
-    record.last_bundle_manifest_hash = verified.manifest_hash;
-    record.last_bundle_id = verified.manifest.bundle_id;
-    std::fs::write(
-        &fixture.state_path,
-        serde_json::to_vec_pretty(&record).expect("updated state serializes"),
-    )
-    .expect("updated state writes");
-    fixture.config_hash = config_hash;
-}
-
-fn write_manifest_and_signature(
-    bundle_dir: &std::path::Path,
-    manifest: &ConfigBundleManifest,
-    private: &PrivateJwk,
-    kid: &str,
-) {
-    let manifest_value = serde_json::to_value(manifest).expect("manifest value");
-    let canonical = canonicalize_json(&manifest_value).expect("canonical manifest");
-    let signature = sign(&canonical, private).expect("manifest signs");
-    let envelope = ConfigBundleSignatureEnvelope {
-        schema: "registry.platform.config_bundle_signatures.v1".to_string(),
-        signatures: vec![ConfigBundleSignature {
-            kid: kid.to_string(),
-            alg: "EdDSA".to_string(),
-            sig: URL_SAFE_NO_PAD.encode(signature),
-        }],
-    };
-    std::fs::write(
-        bundle_dir.join("manifest.json"),
-        serde_json::to_vec_pretty(manifest).expect("manifest serializes"),
-    )
-    .expect("manifest writes");
-    std::fs::write(
-        bundle_dir.join("manifest.sig.json"),
-        serde_json::to_vec_pretty(&envelope).expect("signature serializes"),
-    )
-    .expect("signature writes");
-}
-
-fn stdout_json(output: &std::process::Output) -> Value {
-    serde_json::from_slice(&output.stdout).unwrap_or_else(|error| {
-        panic!(
-            "stdout was not JSON: {error}\nstdout: {}\nstderr: {}",
-            String::from_utf8_lossy(&output.stdout),
-            String::from_utf8_lossy(&output.stderr)
-        )
-    })
-}
-
-fn notary_config_yaml() -> String {
-    r#"
-instance:
-  id: notary-cli
-  environment: development
-deployment:
-  profile: local
-server:
-  bind: 127.0.0.1:0
-  admin_listener:
-    mode: dedicated
-    bind: 127.0.0.1:1
-auth:
-  api_keys:
-    - id: test-key
-      fingerprint:
-        provider: env
-        name: TEST_TOKEN_HASH
-audit:
-  sink: stdout
-  hash_secret_env: TEST_AUDIT_HASH_SECRET
-evidence:
-  enabled: true
-  signing_keys:
-    issuer-key:
-      provider: local_jwk_env
-      private_jwk_env: ISSUER_KEY
-      alg: EdDSA
-      kid: did:web:issuer.example#key-1
-      status: active
-"#
-    .to_string()
-}
diff --git a/crates/registry-notary/tests/doctor_cli.rs b/crates/registry-notary/tests/doctor_cli.rs
deleted file mode 100644
index 6e9cd8b07..000000000
--- a/crates/registry-notary/tests/doctor_cli.rs
+++ /dev/null
@@ -1,1346 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Binary-level coverage for doctor output contracts.
-
-use std::path::{Path, PathBuf};
-use std::process::Command;
-
-use registry_config_report::{CONFIG_EXPLANATION_SCHEMA_V1, PRODUCT_DIAGNOSTIC_REPORT_SCHEMA_V1};
-use registry_notary_server::NotaryActivationCode;
-use serde_json::{json, Value};
-use tempfile::TempDir;
-
-const TEST_API_HASH: &str =
-    "sha256:31f2999a69fa6301763a9f61eea44388a13318ce8b80a16a115a9efdb62b883b";
-const TEST_AUDIT_SECRET: &str = "doctor-audit-secret-32-bytes-minimum";
-const TEST_ISSUER_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA"}"#;
-const DOCTOR_PATH_SENTINEL: &str = "REDACTION_DOCTOR_LOCAL_PATH";
-const DOCTOR_HASH_SENTINEL: &str =
-    "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
-const DOCTOR_PARSER_SENTINEL: &str = "REDACTION_DOCTOR_PARSER_STRING";
-const DOCTOR_COUNTRY_SENTINEL: &str = "REDACTION_DOCTOR_COUNTRY_VALUE";
-const DOCTOR_SECRET_SENTINEL: &str = "REDACTION_DOCTOR_SECRET_VALUE";
-const DOCTOR_USER_SENTINEL: &str = "redaction-doctor-user@example.test";
-
-#[derive(Default)]
-struct TestConfigOptions<'a> {
-    openapi_requires_auth: Option<bool>,
-    config_trust: bool,
-    omit_deployment_profile: bool,
-    multi_instance: bool,
-    audit_offhost_shipping: bool,
-    durable_audit: Option<bool>,
-    audit_ack_cursor_path: Option<&'a str>,
-    unbound_credential_profile: bool,
-    state_storage: Option<&'a str>,
-}
-
-fn write_config(tmp: &TempDir) -> PathBuf {
-    write_config_with_options(tmp, TestConfigOptions::default())
-}
-
-fn write_config_with_options(tmp: &TempDir, options: TestConfigOptions<'_>) -> PathBuf {
-    let path = tmp.path().join("notary.yaml");
-    let openapi_requires_auth = options
-        .openapi_requires_auth
-        .map(|value| format!("  openapi_requires_auth: {value}\n"))
-        .unwrap_or_default();
-    let admin_listener = if options.config_trust {
-        "  admin_listener:\n    mode: dedicated\n    bind: 127.0.0.1:1\n"
-    } else {
-        ""
-    };
-    let config_trust = if options.config_trust {
-        format!(
-            r#"config_trust:
-  trust_anchor_path: {}
-  bundle_path: {}
-  antirollback_state_path: {}
-  break_glass_override_path: {}
-"#,
-            tmp.path().join("trust-anchor.json").display(),
-            tmp.path().join("bundle").display(),
-            tmp.path().join("antirollback.json").display(),
-            tmp.path().join("break-glass").display()
-        )
-    } else {
-        String::new()
-    };
-    let mut evidence_lines = String::new();
-    if options.audit_offhost_shipping {
-        evidence_lines.push_str("    audit_offhost_shipping: true\n");
-    }
-    if let Some(cursor) = options.audit_ack_cursor_path {
-        evidence_lines.push_str(&format!("    audit_ack_cursor_path: \"{cursor}\"\n"));
-    }
-    let deployment_evidence = if evidence_lines.is_empty() {
-        String::new()
-    } else {
-        format!("  evidence:\n{evidence_lines}")
-    };
-    let deployment = if options.omit_deployment_profile {
-        if options.multi_instance {
-            format!("deployment:\n  multi_instance: true\n{deployment_evidence}")
-        } else if !deployment_evidence.is_empty() {
-            format!("deployment:\n{deployment_evidence}")
-        } else {
-            String::new()
-        }
-    } else if options.multi_instance {
-        format!("deployment:\n  profile: local\n  multi_instance: true\n{deployment_evidence}")
-    } else {
-        format!("deployment:\n  profile: local\n{deployment_evidence}")
-    };
-    let durable_audit = options.durable_audit.unwrap_or(options.config_trust);
-    let state = options
-        .state_storage
-        .map(|storage| format!("state:\n  storage: {storage}\n"))
-        .unwrap_or_default();
-    let audit = if durable_audit {
-        format!(
-            r#"audit:
-  sink: file
-  path: {}
-  hash_secret_env: TEST_DOCTOR_JSON_AUDIT_SECRET
-"#,
-            tmp.path().join("audit.jsonl").display()
-        )
-    } else {
-        r#"audit:
-  sink: stdout
-  hash_secret_env: TEST_DOCTOR_JSON_AUDIT_SECRET
-"#
-        .to_string()
-    };
-    let relay = if options.unbound_credential_profile {
-        let token_file = tmp.path().join("relay.jwt");
-        std::fs::write(&token_file, b"opaque-test-token").expect("Relay token file writes");
-        format!(
-            r#"  relay:
-    base_url: https://relay.internal.example
-    workload_client_id: registry-notary
-    token_file: {}
-"#,
-            token_file.display()
-        )
-    } else {
-        String::new()
-    };
-    let credential_profiles = if options.unbound_credential_profile {
-        r#"  credential_profiles:
-    unbound_sd_jwt:
-      format: application/dc+sd-jwt
-      issuer: did:web:issuer.example
-      signing_key: issuer
-      vct: https://issuer.example/credentials/unbound
-      holder_binding:
-        mode: none
-      allowed_claims:
-        - person-is-alive
-"#
-        .to_string()
-    } else {
-        String::new()
-    };
-    let mut claim_entries = String::new();
-    if options.unbound_credential_profile {
-        claim_entries.push_str(
-            r#"    - id: person-is-alive
-      title: Person is alive
-      version: "1.0"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          person_status:
-            profile:
-              id: doctor.person-status.exact
-              contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-            inputs:
-              subject_id: target.id
-            outputs:
-              active: { type: boolean, nullable: true }
-      purpose: credential-issuance-test
-      required_scopes:
-        - registry:evidence
-      value:
-        type: boolean
-      rule:
-        type: consultation_matched
-        consultation: person_status
-      formats:
-        - application/vnd.registry-notary.claim-result+json
-      credential_profiles:
-        - unbound_sd_jwt
-"#,
-        );
-    }
-    let credential_profile_claims = if claim_entries.is_empty() {
-        String::new()
-    } else {
-        format!("  claims:\n{claim_entries}")
-    };
-    std::fs::write(
-        &path,
-        format!(
-            r#"
-server:
-  bind: 127.0.0.1:0
-{openapi_requires_auth}{admin_listener}{config_trust}auth:
-  api_keys:
-    - id: local
-      fingerprint:
-        provider: env
-        name: TEST_DOCTOR_JSON_API_HASH
-      scopes: [registry_notary:credential_issue]
-{deployment}{state}{audit}evidence:
-  enabled: true
-  service_id: doctor-json-test
-{relay}  signing_keys:
-    issuer:
-      provider: local_jwk_env
-      private_jwk_env: TEST_DOCTOR_JSON_ISSUER_JWK
-      alg: EdDSA
-      kid: did:web:issuer.example#key-1
-      status: active
-{credential_profiles}{credential_profile_claims}
-"#
-        ),
-    )
-    .expect("config writes");
-    path
-}
-
-fn write_env_file(tmp: &TempDir) -> PathBuf {
-    let path = tmp.path().join(".env");
-    std::fs::write(
-        &path,
-        format!(
-            "\
-TEST_DOCTOR_JSON_API_HASH={TEST_API_HASH}
-TEST_DOCTOR_JSON_AUDIT_SECRET={TEST_AUDIT_SECRET}
-TEST_DOCTOR_JSON_ISSUER_JWK='{TEST_ISSUER_JWK}'
-REGISTRY_NOTARY_POSTGRES_URL='postgresql://registry_notary_runtime:test@127.0.0.1:1/registry_notary?sslmode=require'
-"
-        ),
-    )
-    .expect("env file writes");
-    path
-}
-
-fn write_invalid_config(tmp: &TempDir) -> PathBuf {
-    let private_dir = tmp
-        .path()
-        .join(format!("{DOCTOR_PATH_SENTINEL}-{DOCTOR_USER_SENTINEL}"));
-    std::fs::create_dir_all(&private_dir).expect("private config dir");
-    let path = private_dir.join(format!("{DOCTOR_COUNTRY_SENTINEL}.yaml"));
-    std::fs::write(
-        &path,
-        format!(
-            "country: {DOCTOR_COUNTRY_SENTINEL}\nhash: {DOCTOR_HASH_SENTINEL}\nsecret: [{DOCTOR_SECRET_SENTINEL}\nparser: {DOCTOR_PARSER_SENTINEL}\n"
-        ),
-    )
-    .expect("config writes");
-    path
-}
-
-fn write_config_with_claim_formats(tmp: &TempDir, claim_id: &str, formats: &[&str]) -> PathBuf {
-    let path = write_config(tmp);
-    let mut config: registry_notary_core::StandaloneRegistryNotaryConfig =
-        serde_norway::from_str(&std::fs::read_to_string(&path).expect("config reads"))
-            .expect("config parses");
-    config.evidence.relay = Some(
-        serde_norway::from_str(
-            r#"
-base_url: https://relay.internal.example
-workload_client_id: registry-notary
-token_file: /run/secrets/registry-notary-relay.jwt
-"#,
-        )
-        .expect("Relay config parses"),
-    );
-    let mut claim: registry_notary_core::ClaimDefinition = serde_norway::from_str(&format!(
-        r#"
-id: {claim_id}
-title: Claim format validation
-version: "1.0"
-subject_type: person
-evidence_mode:
-  type: registry_backed
-  consultations:
-    test_source:
-      profile:
-        id: example.test-source.exact
-        contract_hash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-      inputs:
-        subject_id: target.id
-rule:
-  type: consultation_matched
-  consultation: test_source
-"#,
-    ))
-    .expect("claim YAML parses");
-    claim.formats = formats.iter().map(ToString::to_string).collect();
-    config.evidence.claims = vec![claim];
-    std::fs::write(
-        &path,
-        serde_norway::to_string(&config).expect("config serializes"),
-    )
-    .expect("config writes");
-    path
-}
-
-fn write_config_with_empty_claim_formats(tmp: &TempDir) -> PathBuf {
-    write_config_with_claim_formats(tmp, "empty-format", &[])
-}
-
-fn doctor_command(config_path: &Path, env_file: Option<&Path>) -> Command {
-    let mut command = Command::new(env!("CARGO_BIN_EXE_registry-notary"));
-    command.arg("--config").arg(config_path);
-    if let Some(env_file) = env_file {
-        command.arg("--env-file").arg(env_file);
-    }
-    command.arg("doctor");
-    command
-}
-
-fn explain_command(config_path: &Path, env_file: Option<&Path>) -> Command {
-    let mut command = Command::new(env!("CARGO_BIN_EXE_registry-notary"));
-    command.arg("--config").arg(config_path);
-    if let Some(env_file) = env_file {
-        command.arg("--env-file").arg(env_file);
-    }
-    command.arg("explain-config");
-    command
-}
-
-fn diagnostic_with_code<'a>(report: &'a Value, code: &str) -> Option<&'a Value> {
-    report["diagnostics"]
-        .as_array()
-        .expect("diagnostics array")
-        .iter()
-        .find(|diagnostic| diagnostic["code"] == code)
-}
-
-fn safe_configuration_message() -> String {
-    let definition = NotaryActivationCode::CONFIGURATION_INVALID.definition();
-    format!(
-        "{} Next action: {}",
-        definition.meaning, definition.remediation
-    )
-}
-
-fn assert_safe_configuration_diagnostic(report: &Value) -> &Value {
-    let diagnostic =
-        diagnostic_with_code(report, NotaryActivationCode::CONFIGURATION_INVALID.as_str())
-            .expect("stable configuration diagnostic");
-    assert_eq!(diagnostic["severity"], "error");
-    assert_eq!(diagnostic["message"], safe_configuration_message());
-    diagnostic
-}
-
-fn assert_output_excludes(output: &std::process::Output, sentinels: &[&str]) {
-    let combined = format!(
-        "{}\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    for sentinel in sentinels {
-        assert!(
-            !combined.contains(sentinel),
-            "doctor output leaked sentinel {sentinel:?}: {combined}"
-        );
-    }
-}
-
-fn assert_no_documentation_key(diagnostic: &Value) {
-    assert!(
-        diagnostic.get("documentation_key").is_none(),
-        "documentation_key is reserved for documentation references, not deployment gate state"
-    );
-}
-
-fn assert_active_finding(diagnostic: &Value) {
-    let message = diagnostic["message"]
-        .as_str()
-        .expect("diagnostic message is a string");
-    assert!(
-        message.contains(" is active "),
-        "active deployment gate state should be visible in the message: {message}"
-    );
-    assert_no_documentation_key(diagnostic);
-}
-
-fn assert_schema_valid(schema: &str, report: &Value) {
-    let schema: Value = serde_json::from_str(schema).expect("schema parses");
-    let compiled = jsonschema::JSONSchema::compile(&schema).expect("schema compiles");
-    if let Err(errors) = compiled.validate(report) {
-        let messages = errors.map(|error| error.to_string()).collect::<Vec<_>>();
-        panic!("report should validate against schema: {messages:?}");
-    };
-}
-
-fn assert_product_diagnostic_report(report: &Value) {
-    assert_schema_valid(PRODUCT_DIAGNOSTIC_REPORT_SCHEMA_V1, report);
-    assert_eq!(
-        report["schema_version"],
-        "registry.config.diagnostic_report.v1"
-    );
-    assert_eq!(report["product"], "registry-notary");
-    assert_eq!(report["config_schema_version"], "registry.notary.config.v1");
-}
-
-fn assert_config_explanation(report: &Value) {
-    assert_schema_valid(CONFIG_EXPLANATION_SCHEMA_V1, report);
-    assert_eq!(report["schema_version"], "registry.config.explanation.v1");
-    assert_eq!(report["product"], "registry-notary");
-    assert_eq!(report["config_schema_version"], "registry.notary.config.v1");
-}
-
-#[test]
-fn doctor_defaults_to_text_output() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config(&tmp);
-    let env_file = write_env_file(&tmp);
-
-    let output = doctor_command(&config, Some(&env_file))
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        output.status.success(),
-        "doctor failed\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    assert!(stdout.contains("OK    config file read"));
-    assert!(
-        serde_json::from_str::<Value>(&stdout).is_err(),
-        "default doctor output should remain text"
-    );
-}
-
-#[test]
-fn doctor_json_reports_undeclared_deployment_profile() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_options(
-        &tmp,
-        TestConfigOptions {
-            omit_deployment_profile: true,
-            ..TestConfigOptions::default()
-        },
-    );
-    let env_file = write_env_file(&tmp);
-
-    let output = doctor_command(&config, Some(&env_file))
-        .args(["--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        !output.status.success(),
-        "undeclared profile should fail doctor\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    let report: Value = serde_json::from_str(&stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-    assert_eq!(report["status"], "error");
-
-    let diagnostic = diagnostic_with_code(&report, "deployment.profile_undeclared")
-        .expect("undeclared profile finding");
-    assert_eq!(diagnostic["severity"], "error");
-    assert_no_documentation_key(diagnostic);
-}
-
-#[test]
-fn doctor_json_profile_override_suppresses_undeclared_finding() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_options(
-        &tmp,
-        TestConfigOptions {
-            omit_deployment_profile: true,
-            ..TestConfigOptions::default()
-        },
-    );
-    let env_file = write_env_file(&tmp);
-
-    let output = doctor_command(&config, Some(&env_file))
-        .args(["--profile", "hosted_lab", "--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        output.status.success(),
-        "doctor failed\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    let report: Value = serde_json::from_str(&stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-
-    assert!(
-        diagnostic_with_code(&report, "deployment.profile_undeclared").is_none(),
-        "override must suppress undeclared profile finding"
-    );
-}
-
-#[test]
-fn doctor_json_hosted_lab_unsigned_config_warns_and_succeeds() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_options(
-        &tmp,
-        TestConfigOptions {
-            durable_audit: Some(true),
-            ..TestConfigOptions::default()
-        },
-    );
-    let env_file = write_env_file(&tmp);
-
-    let output = doctor_command(&config, Some(&env_file))
-        .args(["--profile", "hosted_lab", "--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        output.status.success(),
-        "hosted_lab unsigned config should warn only\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    let report: Value = serde_json::from_str(&stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-    assert_eq!(report["status"], "warning");
-
-    let diagnostic =
-        diagnostic_with_code(&report, "notary.config.unsigned").expect("unsigned config finding");
-    assert_eq!(diagnostic["severity"], "warning");
-    assert_active_finding(diagnostic);
-}
-
-#[test]
-fn doctor_json_evidence_grade_unsigned_config_fails() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_options(&tmp, TestConfigOptions::default());
-    let env_file = write_env_file(&tmp);
-
-    let output = doctor_command(&config, Some(&env_file))
-        .args(["--profile", "evidence_grade", "--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        !output.status.success(),
-        "doctor should fail\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    let report: Value = serde_json::from_str(&stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-    assert_eq!(report["status"], "error");
-
-    let diagnostic =
-        diagnostic_with_code(&report, "notary.config.unsigned").expect("unsigned config finding");
-    assert_eq!(diagnostic["severity"], "error");
-    assert_active_finding(diagnostic);
-}
-
-#[test]
-fn doctor_json_production_public_openapi_reports_error_but_succeeds() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_options(
-        &tmp,
-        TestConfigOptions {
-            openapi_requires_auth: Some(false),
-            config_trust: true,
-            ..TestConfigOptions::default()
-        },
-    );
-    let env_file = write_env_file(&tmp);
-
-    let output = doctor_command(&config, Some(&env_file))
-        .args(["--profile", "production", "--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        output.status.success(),
-        "production public OpenAPI should be a finding_error, not startup_fail\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    let report: Value = serde_json::from_str(&stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-    assert_eq!(report["status"], "error");
-
-    assert!(
-        diagnostic_with_code(&report, "notary.config.unsigned").is_none(),
-        "config_trust should isolate the OpenAPI finding"
-    );
-    let diagnostic =
-        diagnostic_with_code(&report, "notary.openapi.public").expect("OpenAPI public finding");
-    assert_eq!(diagnostic["severity"], "error");
-    assert_active_finding(diagnostic);
-}
-
-#[test]
-fn doctor_json_evidence_grade_public_openapi_reports_error_with_unverified_shipping() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_options(
-        &tmp,
-        TestConfigOptions {
-            openapi_requires_auth: Some(false),
-            config_trust: true,
-            audit_offhost_shipping: true,
-            ..TestConfigOptions::default()
-        },
-    );
-    let env_file = write_env_file(&tmp);
-
-    let output = doctor_command(&config, Some(&env_file))
-        .args(["--profile", "evidence_grade", "--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        !output.status.success(),
-        "evidence_grade doctor should fail closed when shipping cannot be bound to the live audit tail\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    let report: Value = serde_json::from_str(&stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-    assert_eq!(report["status"], "error");
-
-    assert!(
-        diagnostic_with_code(&report, "notary.config.unsigned").is_none(),
-        "config_trust should isolate the OpenAPI finding"
-    );
-    let shipping = diagnostic_with_code(&report, "notary.audit.shipping_unverified")
-        .expect("offline shipping remains unverified");
-    assert_eq!(shipping["severity"], "error");
-    assert_active_finding(shipping);
-    let diagnostic =
-        diagnostic_with_code(&report, "notary.openapi.public").expect("OpenAPI public finding");
-    assert_eq!(diagnostic["severity"], "error");
-    assert_active_finding(diagnostic);
-}
-
-#[test]
-fn doctor_json_production_signer_without_custody_approval_fails_readiness() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_options(
-        &tmp,
-        TestConfigOptions {
-            config_trust: true,
-            unbound_credential_profile: true,
-            ..TestConfigOptions::default()
-        },
-    );
-    let env_file = write_env_file(&tmp);
-
-    let output = doctor_command(&config, Some(&env_file))
-        .args(["--profile", "production", "--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        !output.status.success(),
-        "production signer without custody approval should fail readiness\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    let report: Value = serde_json::from_str(&stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-    assert_eq!(report["status"], "error");
-
-    let diagnostic = diagnostic_with_code(&report, "notary.signer_custody.unapproved")
-        .expect("signer custody finding");
-    assert_eq!(diagnostic["severity"], "error");
-    assert_active_finding(diagnostic);
-}
-
-#[test]
-fn doctor_json_local_public_openapi_has_no_profile_finding() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_options(
-        &tmp,
-        TestConfigOptions {
-            openapi_requires_auth: Some(false),
-            ..TestConfigOptions::default()
-        },
-    );
-    let env_file = write_env_file(&tmp);
-
-    let output = doctor_command(&config, Some(&env_file))
-        .args(["--profile", "local", "--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        output.status.success(),
-        "local public OpenAPI should not emit a profile finding\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    let report: Value = serde_json::from_str(&stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-
-    assert!(
-        diagnostic_with_code(&report, "notary.openapi.public").is_none(),
-        "local profile must allow public OpenAPI"
-    );
-}
-
-#[test]
-fn doctor_json_rejects_multi_instance_in_memory_state_before_profile_override() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_options(
-        &tmp,
-        TestConfigOptions {
-            config_trust: true,
-            multi_instance: true,
-            state_storage: Some("in_memory"),
-            ..TestConfigOptions::default()
-        },
-    );
-    let env_file = write_env_file(&tmp);
-
-    let output = doctor_command(&config, Some(&env_file))
-        .args(["--profile", "production", "--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        !output.status.success(),
-        "multi-instance in-memory correctness state should fail validation\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    let report: Value = serde_json::from_str(&stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-    assert_eq!(report["status"], "error");
-
-    assert_safe_configuration_diagnostic(&report);
-}
-
-#[test]
-fn doctor_json_production_missing_durable_audit_sink_fails_startup() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_options(
-        &tmp,
-        TestConfigOptions {
-            config_trust: true,
-            durable_audit: Some(false),
-            ..TestConfigOptions::default()
-        },
-    );
-    let env_file = write_env_file(&tmp);
-
-    let output = doctor_command(&config, Some(&env_file))
-        .args(["--profile", "production", "--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        !output.status.success(),
-        "production without durable audit sink should fail startup\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    let report: Value = serde_json::from_str(&stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-    assert_eq!(report["status"], "error");
-
-    let diagnostic =
-        diagnostic_with_code(&report, "notary.audit.sink_missing").expect("audit sink finding");
-    assert_eq!(diagnostic["severity"], "error");
-    assert_active_finding(diagnostic);
-}
-
-#[test]
-fn doctor_json_warns_on_explicit_unbound_credential_profile() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_options(
-        &tmp,
-        TestConfigOptions {
-            unbound_credential_profile: true,
-            ..TestConfigOptions::default()
-        },
-    );
-    let env_file = write_env_file(&tmp);
-
-    let output = doctor_command(&config, Some(&env_file))
-        .args(["--profile", "local", "--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        output.status.success(),
-        "explicit unbound profile should warn, not fail\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    let report: Value = serde_json::from_str(&stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-    assert_eq!(report["status"], "warning");
-
-    let diagnostic =
-        diagnostic_with_code(&report, "notary.credential_profile.unbound_holder_binding")
-            .expect("unbound holder-binding warning");
-    assert_eq!(diagnostic["severity"], "warning");
-    assert!(diagnostic["message"]
-        .as_str()
-        .expect("message string")
-        .contains("unbound_sd_jwt"));
-}
-
-#[test]
-fn doctor_json_file_sink_without_attestation_warns_and_reports_unshipped_audit() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_options(
-        &tmp,
-        TestConfigOptions {
-            durable_audit: Some(true),
-            ..TestConfigOptions::default()
-        },
-    );
-    let env_file = write_env_file(&tmp);
-
-    let output = doctor_command(&config, Some(&env_file))
-        .args(["--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        output.status.success(),
-        "a local file sink without attestation should warn, not fail\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    let report: Value = serde_json::from_str(&stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-
-    assert_eq!(report["audit_shipping"]["sink_type"], "file");
-    assert_eq!(
-        report["audit_shipping"]["shipping_target_configured"],
-        false
-    );
-    assert_eq!(report["audit_shipping"]["shipping_target"], "none");
-
-    assert!(
-        report["diagnostics"]
-            .as_array()
-            .expect("diagnostics array")
-            .iter()
-            .any(|diagnostic| diagnostic["message"]
-                .as_str()
-                .expect("message string")
-                .contains("local-chain-only")),
-        "a local file sink without attestation must warn that audit is local-chain-only"
-    );
-}
-
-#[test]
-fn doctor_json_file_sink_with_attestation_reports_declared_external_without_warning() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_options(
-        &tmp,
-        TestConfigOptions {
-            durable_audit: Some(true),
-            audit_offhost_shipping: true,
-            ..TestConfigOptions::default()
-        },
-    );
-    let env_file = write_env_file(&tmp);
-
-    let output = doctor_command(&config, Some(&env_file))
-        .args(["--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        output.status.success(),
-        "a local file sink with attestation should pass doctor\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    let report: Value = serde_json::from_str(&stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-
-    assert_eq!(report["audit_shipping"]["sink_type"], "file");
-    assert_eq!(report["audit_shipping"]["shipping_target_configured"], true);
-    assert_eq!(
-        report["audit_shipping"]["shipping_target"],
-        "declared_external"
-    );
-
-    assert!(
-        !report["diagnostics"]
-            .as_array()
-            .expect("diagnostics array")
-            .iter()
-            .any(|diagnostic| diagnostic["message"]
-                .as_str()
-                .expect("message string")
-                .contains("local-chain-only")),
-        "declaring off-host shipping must silence the local-chain-only warning"
-    );
-}
-
-/// Write a `registry.audit.ack_cursor.v1` cursor with `acked_at` under `tmp`.
-fn write_doctor_ack_cursor(tmp: &TempDir, acked_at: &str) -> PathBuf {
-    let path = tmp.path().join("ack-cursor.json");
-    std::fs::write(
-        &path,
-        format!(
-            r#"{{"schema":"registry.audit.ack_cursor.v1","acked_at":"{acked_at}","last_acked_hash":"sha256:4444444444444444444444444444444444444444444444444444444444444444","writer":"test-shipper"}}"#
-        ),
-    )
-    .expect("ack cursor writes");
-    path
-}
-
-fn run_doctor_json(config: &Path, env_file: &Path) -> Value {
-    let output = doctor_command(config, Some(env_file))
-        .args(["--format", "json"])
-        .output()
-        .expect("doctor runs");
-    assert!(
-        output.status.success(),
-        "doctor should succeed\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    let report: Value = serde_json::from_str(&stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-    report
-}
-
-#[test]
-fn doctor_json_reports_shipping_health_unverified_for_fresh_cursor() {
-    let tmp = TempDir::new().expect("tempdir");
-    let acked_at = chrono::Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Secs, true);
-    let cursor = write_doctor_ack_cursor(&tmp, &acked_at);
-    let cursor_path = cursor.to_str().expect("cursor path is utf8").to_string();
-    // Default options use the stdout sink, so a shipping target is configured.
-    let config = write_config_with_options(
-        &tmp,
-        TestConfigOptions {
-            audit_ack_cursor_path: Some(&cursor_path),
-            ..TestConfigOptions::default()
-        },
-    );
-    let env_file = write_env_file(&tmp);
-
-    let report = run_doctor_json(&config, &env_file);
-
-    assert_eq!(report["audit_shipping"]["shipping_target_configured"], true);
-    assert_eq!(report["audit_shipping"]["shipping_health"], "unverified");
-    assert_eq!(report["audit_shipping"]["shipping_observed_at"], acked_at);
-}
-
-#[test]
-fn doctor_json_reports_shipping_health_stale_for_old_cursor() {
-    let tmp = TempDir::new().expect("tempdir");
-    let cursor = write_doctor_ack_cursor(&tmp, "2026-06-04T09:59:00Z");
-    let cursor_path = cursor.to_str().expect("cursor path is utf8").to_string();
-    let config = write_config_with_options(
-        &tmp,
-        TestConfigOptions {
-            audit_ack_cursor_path: Some(&cursor_path),
-            ..TestConfigOptions::default()
-        },
-    );
-    let env_file = write_env_file(&tmp);
-
-    let report = run_doctor_json(&config, &env_file);
-
-    assert_eq!(report["audit_shipping"]["shipping_health"], "stale");
-    assert_eq!(
-        report["audit_shipping"]["shipping_observed_at"],
-        "2026-06-04T09:59:00Z"
-    );
-}
-
-#[test]
-fn doctor_json_reports_shipping_health_missing_for_absent_cursor_file() {
-    let tmp = TempDir::new().expect("tempdir");
-    let cursor_path = tmp
-        .path()
-        .join("does-not-exist.json")
-        .to_str()
-        .expect("cursor path is utf8")
-        .to_string();
-    let config = write_config_with_options(
-        &tmp,
-        TestConfigOptions {
-            audit_ack_cursor_path: Some(&cursor_path),
-            ..TestConfigOptions::default()
-        },
-    );
-    let env_file = write_env_file(&tmp);
-
-    let report = run_doctor_json(&config, &env_file);
-
-    assert_eq!(report["audit_shipping"]["shipping_health"], "missing");
-    assert_eq!(
-        report["audit_shipping"]["shipping_observed_at"],
-        Value::Null
-    );
-}
-
-#[test]
-fn doctor_json_reports_shipping_health_invalid_for_malformed_cursor_file() {
-    let tmp = TempDir::new().expect("tempdir");
-    let cursor = tmp.path().join("ack-cursor.json");
-    std::fs::write(&cursor, "{ not valid json").expect("cursor writes");
-    let cursor_path = cursor.to_str().expect("cursor path is utf8").to_string();
-    let config = write_config_with_options(
-        &tmp,
-        TestConfigOptions {
-            audit_ack_cursor_path: Some(&cursor_path),
-            ..TestConfigOptions::default()
-        },
-    );
-    let env_file = write_env_file(&tmp);
-
-    let report = run_doctor_json(&config, &env_file);
-
-    assert_eq!(report["audit_shipping"]["shipping_health"], "invalid");
-    assert_eq!(
-        report["audit_shipping"]["shipping_observed_at"],
-        Value::Null
-    );
-}
-
-#[test]
-fn doctor_json_reports_success_as_single_redacted_document() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config(&tmp);
-    let env_file = write_env_file(&tmp);
-
-    let output = doctor_command(&config, Some(&env_file))
-        .args(["--show-expanded-config", "--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        output.status.success(),
-        "doctor failed\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    let report: Value = serde_json::from_str(&stdout).expect("doctor emits one JSON document");
-
-    assert_product_diagnostic_report(&report);
-    assert_eq!(report["status"], "ok");
-    assert_eq!(report["source"], json!({ "kind": "local_file" }));
-    assert!(
-        report.get("hashes").is_none(),
-        "doctor must not publish raw internal config hashes"
-    );
-    assert!(report["diagnostics"]
-        .as_array()
-        .expect("diagnostics array")
-        .iter()
-        .all(|diagnostic| diagnostic["severity"].is_string()
-            && diagnostic["code"].is_string()
-            && diagnostic["message"].is_string()));
-    assert!(report["required_env"]
-        .as_array()
-        .expect("required_env array")
-        .iter()
-        .any(
-            |env| env["name"] == "TEST_DOCTOR_JSON_ISSUER_JWK" && env["classification"] == "secret"
-        ));
-    assert!(report.get("expanded_config").is_none());
-    assert!(!stdout.contains(TEST_ISSUER_JWK));
-    assert!(!stdout.contains(TEST_AUDIT_SECRET));
-    assert!(!stdout.contains(TEST_API_HASH));
-    assert!(!stdout.contains(config.to_string_lossy().as_ref()));
-}
-
-#[test]
-fn explain_config_json_reports_redacted_resolved_config() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config(&tmp);
-    let env_file = write_env_file(&tmp);
-
-    let output = explain_command(&config, Some(&env_file))
-        .args(["--format", "json"])
-        .output()
-        .expect("explain-config runs");
-
-    assert!(
-        output.status.success(),
-        "explain-config failed\nstdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout is utf8");
-    let report: Value = serde_json::from_str(&stdout).expect("explain-config emits JSON");
-    assert_config_explanation(&report);
-    assert!(report["resolved_config"].is_object());
-    assert_eq!(
-        report["resolved_config"]["evidence"]["signing_keys"]["issuer"]["private_jwk_env"],
-        json!("[redacted]")
-    );
-    assert!(report["live_apply"]
-        .as_array()
-        .expect("live_apply array")
-        .iter()
-        .any(|item| item["class"] == "restart_required"));
-    assert!(!stdout.contains(TEST_ISSUER_JWK));
-    assert!(!stdout.contains(TEST_AUDIT_SECRET));
-    assert!(!stdout.contains(TEST_API_HASH));
-}
-
-#[test]
-fn doctor_json_reports_config_parse_failure_without_text_preamble() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_invalid_config(&tmp);
-
-    let output = doctor_command(&config, None)
-        .args(["--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        !output.status.success(),
-        "doctor should fail for invalid config"
-    );
-    let report: Value = serde_json::from_slice(&output.stdout).expect("failure emits JSON");
-    assert_product_diagnostic_report(&report);
-    assert_eq!(report["status"], "error");
-    assert_eq!(report["source"], json!({ "kind": "local_file" }));
-    assert!(report.get("hashes").is_none());
-    assert_safe_configuration_diagnostic(&report);
-    assert_eq!(
-        String::from_utf8(output.stderr.clone()).expect("stderr is utf8"),
-        ""
-    );
-    assert_output_excludes(
-        &output,
-        &[
-            config.to_str().expect("config path is UTF-8"),
-            DOCTOR_PATH_SENTINEL,
-            DOCTOR_HASH_SENTINEL,
-            DOCTOR_PARSER_SENTINEL,
-            DOCTOR_COUNTRY_SENTINEL,
-            DOCTOR_SECRET_SENTINEL,
-            DOCTOR_USER_SENTINEL,
-        ],
-    );
-}
-
-#[test]
-fn doctor_text_reports_config_parse_failure_with_static_code_and_guidance() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_invalid_config(&tmp);
-
-    let output = doctor_command(&config, None).output().expect("doctor runs");
-
-    assert!(!output.status.success());
-    let definition = NotaryActivationCode::CONFIGURATION_INVALID.definition();
-    let stdout = String::from_utf8(output.stdout.clone()).expect("stdout is UTF-8");
-    assert!(stdout.contains(&format!(
-        "FAIL  {} [{}]",
-        definition.meaning,
-        definition.code.as_str()
-    )));
-    assert!(stdout.contains(&format!("Next action: {}", definition.remediation)));
-    assert_eq!(
-        String::from_utf8(output.stderr.clone()).expect("stderr is UTF-8"),
-        ""
-    );
-    assert_output_excludes(
-        &output,
-        &[
-            config.to_str().expect("config path is UTF-8"),
-            DOCTOR_PATH_SENTINEL,
-            DOCTOR_HASH_SENTINEL,
-            DOCTOR_PARSER_SENTINEL,
-            DOCTOR_COUNTRY_SENTINEL,
-            DOCTOR_SECRET_SENTINEL,
-            DOCTOR_USER_SENTINEL,
-        ],
-    );
-}
-
-#[test]
-fn doctor_json_missing_source_reports_classification_without_local_path() {
-    let tmp = TempDir::new().expect("tempdir");
-    let missing = tmp.path().join(format!(
-        "{DOCTOR_PATH_SENTINEL}-{DOCTOR_SECRET_SENTINEL}.yaml"
-    ));
-
-    let output = doctor_command(&missing, None)
-        .args(["--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(!output.status.success());
-    let report: Value = serde_json::from_slice(&output.stdout).expect("failure emits JSON");
-    assert_product_diagnostic_report(&report);
-    assert_eq!(report["source"], json!({ "kind": "local_file" }));
-    assert!(report.get("hashes").is_none());
-    assert_safe_configuration_diagnostic(&report);
-    assert_output_excludes(
-        &output,
-        &[
-            missing.to_str().expect("missing path is UTF-8"),
-            DOCTOR_PATH_SENTINEL,
-            DOCTOR_SECRET_SENTINEL,
-        ],
-    );
-}
-
-#[test]
-fn doctor_missing_env_file_has_value_free_stderr() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config(&tmp);
-    let missing_env = tmp.path().join(format!(
-        "{DOCTOR_PATH_SENTINEL}-{DOCTOR_COUNTRY_SENTINEL}-{DOCTOR_SECRET_SENTINEL}.env"
-    ));
-
-    let output = doctor_command(&config, Some(&missing_env))
-        .args(["--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(!output.status.success());
-    assert!(output.stdout.is_empty());
-    let failure = registry_notary_server::NotaryActivationFailure::from(
-        NotaryActivationCode::CONFIGURATION_INVALID,
-    );
-    assert_eq!(
-        String::from_utf8(output.stderr.clone()).expect("stderr is UTF-8"),
-        format!("ERROR {failure}\n")
-    );
-    assert_output_excludes(
-        &output,
-        &[
-            missing_env.to_str().expect("env path is UTF-8"),
-            DOCTOR_PATH_SENTINEL,
-            DOCTOR_COUNTRY_SENTINEL,
-            DOCTOR_SECRET_SENTINEL,
-        ],
-    );
-}
-
-#[test]
-fn doctor_json_reports_empty_claim_formats_with_remediation() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_empty_claim_formats(&tmp);
-
-    let output = doctor_command(&config, None)
-        .args(["--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(!output.status.success(), "doctor must reject empty formats");
-    let report: Value = serde_json::from_slice(&output.stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-    assert_safe_configuration_diagnostic(&report);
-    assert_output_excludes(&output, &["empty-format", "omit formats"]);
-}
-
-#[test]
-fn doctor_json_reports_sd_jwt_claim_format_with_remediation() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_claim_formats(&tmp, "sd-jwt-format", &["application/dc+sd-jwt"]);
-
-    let output = doctor_command(&config, None)
-        .args(["--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        !output.status.success(),
-        "doctor must reject SD-JWT formats"
-    );
-    let report: Value = serde_json::from_slice(&output.stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-    assert_safe_configuration_diagnostic(&report);
-    assert_output_excludes(
-        &output,
-        &[
-            "sd-jwt-format",
-            "application/dc+sd-jwt",
-            "credential_profiles",
-        ],
-    );
-}
-
-#[test]
-fn doctor_json_reports_unknown_claim_format_with_remediation() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_claim_formats(
-        &tmp,
-        "unknown-format",
-        &[
-            "application/vnd.registry-notary.claim-result+json",
-            "application/example+json",
-        ],
-    );
-
-    let output = doctor_command(&config, None)
-        .args(["--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        !output.status.success(),
-        "doctor must reject unknown formats"
-    );
-    let report: Value = serde_json::from_slice(&output.stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-    assert_safe_configuration_diagnostic(&report);
-    assert_output_excludes(&output, &["unknown-format", "application/example+json"]);
-}
-
-#[test]
-fn doctor_json_reports_missing_canonical_claim_format_with_remediation() {
-    let tmp = TempDir::new().expect("tempdir");
-    let config = write_config_with_claim_formats(
-        &tmp,
-        "missing-canonical",
-        &["application/ld+json; profile=\"cccev\""],
-    );
-
-    let output = doctor_command(&config, None)
-        .args(["--format", "json"])
-        .output()
-        .expect("doctor runs");
-
-    assert!(
-        !output.status.success(),
-        "doctor must reject formats without the canonical renderer"
-    );
-    let report: Value = serde_json::from_slice(&output.stdout).expect("doctor emits JSON");
-    assert_product_diagnostic_report(&report);
-    assert_safe_configuration_diagnostic(&report);
-    assert_output_excludes(
-        &output,
-        &[
-            "missing-canonical",
-            "application/vnd.registry-notary.claim-result+json",
-        ],
-    );
-}
diff --git a/crates/registry-notary/tests/startup_redaction.rs b/crates/registry-notary/tests/startup_redaction.rs
deleted file mode 100644
index 89f6f2757..000000000
--- a/crates/registry-notary/tests/startup_redaction.rs
+++ /dev/null
@@ -1,309 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use std::path::{Path, PathBuf};
-use std::process::{Command, Output};
-
-use registry_notary_server::NotaryActivationCode;
-use registry_platform_ops::{BundleVerificationCode, BundleVerificationFailure};
-
-const SENTINEL_COUNTRY: &str = "SENTINEL_COUNTRY_FARAJALAND";
-const SENTINEL_USERNAME: &str = "SENTINEL_USERNAME_ALICE";
-const SENTINEL_SECRET: &str = "SENTINEL_SECRET_DO_NOT_PRINT";
-const SENTINEL_DIGEST: &str = "sha256:SENTINEL_PRIVATE_DIGEST";
-
-fn registry_notary_command() -> Command {
-    registry_notary_command_with_log("info")
-}
-
-fn registry_notary_command_with_log(rust_log: &str) -> Command {
-    registry_notary_command_with_log_format(rust_log, "text")
-}
-
-fn registry_notary_command_with_log_format(rust_log: &str, log_format: &str) -> Command {
-    let mut command = Command::new(env!("CARGO_BIN_EXE_registry-notary"));
-    command
-        .env_remove("REGISTRY_NOTARY_CONFIG")
-        .env_remove("REGISTRY_NOTARY_ENV_FILE")
-        .env("REGISTRY_NOTARY_LOG_FORMAT", log_format)
-        .env("RUST_LOG", rust_log);
-    command
-}
-
-fn run_server(config_path: &Path) -> Output {
-    registry_notary_command()
-        .arg("--config")
-        .arg(config_path)
-        .output()
-        .expect("registry-notary starts")
-}
-
-fn combined_output(output: &Output) -> String {
-    format!(
-        "{}\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    )
-}
-
-fn assert_safe_configuration_failure(output: &Output, forbidden: &[&str]) {
-    assert!(!output.status.success(), "invalid startup must fail closed");
-    let combined = combined_output(output);
-    assert!(
-        combined.contains("notary.configuration.invalid"),
-        "startup output must expose the stable safe activation code: {combined}"
-    );
-    for value in forbidden {
-        assert!(
-            !combined.contains(value),
-            "startup output exposed forbidden value {value:?}: {combined}"
-        );
-    }
-}
-
-struct MissingBundleFixture {
-    config_path: PathBuf,
-    trust_path: PathBuf,
-    bundle_path: PathBuf,
-    state_path: PathBuf,
-    override_path: PathBuf,
-}
-
-fn write_missing_bundle_fixture(tmp: &tempfile::TempDir) -> MissingBundleFixture {
-    let config_path = tmp.path().join("bootstrap.yaml");
-    let trust_path = tmp.path().join(format!("{SENTINEL_USERNAME}-anchor.json"));
-    let bundle_path = tmp.path().join(format!("{SENTINEL_COUNTRY}-bundle"));
-    let state_path = tmp.path().join(format!("{SENTINEL_DIGEST}-state.json"));
-    let override_path = tmp.path().join(format!("{SENTINEL_SECRET}-override.json"));
-    std::fs::write(
-        &config_path,
-        format!(
-            r#"
-deployment:
-  profile: local
-state:
-  storage: in_memory
-server:
-  bind: 127.0.0.1:0
-auth:
-  api_keys:
-    - id: local
-      fingerprint:
-        provider: env
-        name: STARTUP_REDACTION_API_HASH
-      scopes: [registry_notary:credential_issue]
-audit:
-  sink: stdout
-evidence:
-  enabled: true
-  signing_keys:
-    issuer:
-      provider: local_jwk_env
-      private_jwk_env: STARTUP_REDACTION_ISSUER_JWK
-      alg: EdDSA
-      kid: did:web:issuer.example#key-1
-      status: active
-config_trust:
-  trust_anchor_path: {}
-  bundle_path: {}
-  antirollback_state_path: {}
-  break_glass_override_path: {}
-"#,
-            trust_path.display(),
-            bundle_path.display(),
-            state_path.display(),
-            override_path.display(),
-        ),
-    )
-    .expect("bootstrap config writes");
-    MissingBundleFixture {
-        config_path,
-        trust_path,
-        bundle_path,
-        state_path,
-        override_path,
-    }
-}
-
-#[test]
-fn rust_log_off_emits_one_static_local_configuration_failure_line() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let config_path = tmp.path().join(format!(
-        "{SENTINEL_USERNAME}-{SENTINEL_COUNTRY}-{SENTINEL_SECRET}.yaml"
-    ));
-
-    let output = registry_notary_command_with_log("off")
-        .arg("--config")
-        .arg(&config_path)
-        .output()
-        .expect("registry-notary starts");
-
-    assert!(!output.status.success(), "missing config must fail closed");
-    assert!(
-        output.stdout.is_empty(),
-        "startup failure must not emit stdout with tracing disabled: {}",
-        String::from_utf8_lossy(&output.stdout)
-    );
-    let definition = NotaryActivationCode::CONFIGURATION_INVALID.definition();
-    let expected = format!(
-        "ERROR {}: {}; next action: {}\n",
-        definition.code, definition.meaning, definition.remediation
-    );
-    let stderr = String::from_utf8_lossy(&output.stderr);
-    assert_eq!(stderr, expected);
-    assert_eq!(
-        stderr.lines().count(),
-        1,
-        "startup must render exactly one terminal failure line"
-    );
-    for forbidden in [
-        SENTINEL_COUNTRY,
-        SENTINEL_USERNAME,
-        SENTINEL_SECRET,
-        config_path.to_string_lossy().as_ref(),
-    ] {
-        assert!(
-            !stderr.contains(forbidden),
-            "terminal failure line exposed forbidden value {forbidden:?}: {stderr}"
-        );
-    }
-}
-
-#[test]
-fn rust_log_off_emits_one_exact_static_bundle_rejection_line() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_missing_bundle_fixture(&tmp);
-
-    let output = registry_notary_command_with_log("off")
-        .arg("--config")
-        .arg(&fixture.config_path)
-        .output()
-        .expect("registry-notary starts");
-
-    assert!(!output.status.success(), "missing bundle must fail closed");
-    assert!(
-        output.stdout.is_empty(),
-        "bundle startup failure must not emit stdout with tracing disabled: {}",
-        String::from_utf8_lossy(&output.stdout)
-    );
-    let failure = BundleVerificationFailure::from(BundleVerificationCode::REJECTED_VALIDATION);
-    let stderr = String::from_utf8_lossy(&output.stderr);
-    assert_eq!(stderr, format!("ERROR {failure}\n"));
-    assert_eq!(
-        stderr.lines().count(),
-        1,
-        "bundle startup must render exactly one terminal failure line"
-    );
-    for forbidden in [
-        SENTINEL_COUNTRY,
-        SENTINEL_USERNAME,
-        SENTINEL_SECRET,
-        SENTINEL_DIGEST,
-        fixture.trust_path.to_string_lossy().as_ref(),
-        fixture.bundle_path.to_string_lossy().as_ref(),
-        fixture.state_path.to_string_lossy().as_ref(),
-        fixture.override_path.to_string_lossy().as_ref(),
-    ] {
-        assert!(
-            !stderr.contains(forbidden),
-            "terminal bundle rejection exposed forbidden value {forbidden:?}: {stderr}"
-        );
-    }
-}
-
-#[test]
-fn malformed_local_config_does_not_expose_parser_input_or_path() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let private_dir = tmp
-        .path()
-        .join(format!("{SENTINEL_USERNAME}-{SENTINEL_COUNTRY}"));
-    std::fs::create_dir_all(&private_dir).expect("private config dir");
-    let config_path = private_dir.join(format!("{SENTINEL_SECRET}.yaml"));
-    std::fs::write(
-        &config_path,
-        format!("country: {SENTINEL_COUNTRY}\nsecret: [{SENTINEL_SECRET}\n"),
-    )
-    .expect("malformed config writes");
-
-    let output = run_server(&config_path);
-
-    assert_safe_configuration_failure(
-        &output,
-        &[
-            SENTINEL_COUNTRY,
-            SENTINEL_USERNAME,
-            SENTINEL_SECRET,
-            config_path.to_string_lossy().as_ref(),
-        ],
-    );
-}
-
-#[test]
-fn missing_env_file_does_not_expose_startup_path() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let env_path = tmp.path().join(format!(
-        "{SENTINEL_USERNAME}-{SENTINEL_COUNTRY}-{SENTINEL_SECRET}.env"
-    ));
-
-    let output = registry_notary_command()
-        .arg("--env-file")
-        .arg(&env_path)
-        .output()
-        .expect("registry-notary starts");
-
-    assert_safe_configuration_failure(
-        &output,
-        &[
-            SENTINEL_COUNTRY,
-            SENTINEL_USERNAME,
-            SENTINEL_SECRET,
-            env_path.to_string_lossy().as_ref(),
-        ],
-    );
-}
-
-#[test]
-fn signed_bundle_boot_failure_does_not_expose_governed_paths_or_values() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let fixture = write_missing_bundle_fixture(&tmp);
-
-    for log_format in ["text", "json"] {
-        let output = registry_notary_command_with_log_format("info", log_format)
-            .arg("--config")
-            .arg(&fixture.config_path)
-            .output()
-            .expect("registry-notary starts");
-
-        assert_safe_configuration_failure(
-            &output,
-            &[
-                SENTINEL_COUNTRY,
-                SENTINEL_USERNAME,
-                SENTINEL_SECRET,
-                SENTINEL_DIGEST,
-                fixture.trust_path.to_string_lossy().as_ref(),
-                fixture.bundle_path.to_string_lossy().as_ref(),
-                fixture.state_path.to_string_lossy().as_ref(),
-                fixture.override_path.to_string_lossy().as_ref(),
-            ],
-        );
-        let combined = combined_output(&output);
-        let code = BundleVerificationCode::REJECTED_VALIDATION;
-        let definition = code.definition();
-        assert!(
-            combined.contains(code.as_str()),
-            "{log_format} startup log omitted the stable rejection code: {combined}"
-        );
-        assert!(
-            combined.contains(definition.safe_meaning),
-            "{log_format} startup log omitted the static safe meaning: {combined}"
-        );
-        assert!(
-            combined.contains(definition.safe_remediation),
-            "{log_format} startup log omitted the static safe remediation: {combined}"
-        );
-        assert!(
-            !combined.as_bytes().contains(&0x1b),
-            "{log_format} startup log contained ANSI escape bytes: {combined:?}"
-        );
-    }
-}
diff --git a/crates/registry-notary/tests/state_cli.rs b/crates/registry-notary/tests/state_cli.rs
deleted file mode 100644
index 006da647b..000000000
--- a/crates/registry-notary/tests/state_cli.rs
+++ /dev/null
@@ -1,101 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Binary-level coverage for the PostgreSQL state command contract.
-
-use std::process::Command;
-
-fn assert_state_doctor_configuration_failure_is_value_free(
-    output: std::process::Output,
-    forbidden: &[&str],
-) {
-    assert!(!output.status.success());
-    assert!(output.stdout.is_empty());
-    let stderr = String::from_utf8(output.stderr).expect("stderr is UTF-8");
-    assert_eq!(
-        stderr,
-        "ERROR notary.configuration.invalid: Registry Notary runtime configuration is invalid; next action: run registry-notary doctor, correct the reviewed configuration or binding, and retry activation\n"
-    );
-    for forbidden in forbidden {
-        assert!(
-            !stderr.contains(forbidden),
-            "state doctor exposed forbidden value {forbidden:?}: {stderr}"
-        );
-    }
-}
-
-#[test]
-fn state_doctor_configuration_failure_is_stable_and_value_free() {
-    let temporary = tempfile::tempdir().expect("temporary directory creates");
-    let config_path = temporary.path().join("notary.yaml");
-    let sentinel = "SENTINEL_INVALID_STATE_DOCTOR_CONFIGURATION";
-    std::fs::write(&config_path, format!("auth:\n  mode: {sentinel}\n"))
-        .expect("invalid config writes");
-
-    let output = Command::new(env!("CARGO_BIN_EXE_registry-notary"))
-        .arg("--config")
-        .arg(&config_path)
-        .args(["state", "doctor"])
-        .output()
-        .expect("state doctor runs");
-
-    assert_state_doctor_configuration_failure_is_value_free(
-        output,
-        &[sentinel, &config_path.display().to_string()],
-    );
-}
-
-#[test]
-fn state_doctor_missing_env_file_is_stable_and_value_free() {
-    let temporary = tempfile::tempdir().expect("temporary directory creates");
-    let config_path = temporary.path().join("notary.yaml");
-    let env_path = temporary
-        .path()
-        .join("SENTINEL_STATE_DOCTOR_MISSING_ENV_FILE.env");
-
-    let output = Command::new(env!("CARGO_BIN_EXE_registry-notary"))
-        .arg("--config")
-        .arg(&config_path)
-        .arg("--env-file")
-        .arg(&env_path)
-        .args(["state", "doctor"])
-        .output()
-        .expect("state doctor runs");
-
-    assert_state_doctor_configuration_failure_is_value_free(
-        output,
-        &[
-            "SENTINEL_STATE_DOCTOR_MISSING_ENV_FILE",
-            &env_path.display().to_string(),
-            &config_path.display().to_string(),
-        ],
-    );
-}
-
-#[test]
-fn state_doctor_malformed_env_file_is_stable_and_value_free() {
-    let temporary = tempfile::tempdir().expect("temporary directory creates");
-    let config_path = temporary.path().join("notary.yaml");
-    std::fs::write(&config_path, "auth:\n  mode: api_key\n").expect("config writes");
-    let env_path = temporary.path().join("state-doctor.env");
-    let parser_sentinel = "SENTINEL_STATE_DOCTOR_ENV_PARSER_TEXT";
-    std::fs::write(&env_path, format!("{parser_sentinel} is not KEY=VALUE\n"))
-        .expect("malformed env file writes");
-
-    let output = Command::new(env!("CARGO_BIN_EXE_registry-notary"))
-        .arg("--config")
-        .arg(&config_path)
-        .arg("--env-file")
-        .arg(&env_path)
-        .args(["state", "doctor"])
-        .output()
-        .expect("state doctor runs");
-
-    assert_state_doctor_configuration_failure_is_value_free(
-        output,
-        &[
-            parser_sentinel,
-            "not KEY=VALUE",
-            &env_path.display().to_string(),
-            &config_path.display().to_string(),
-        ],
-    );
-}
diff --git a/crates/registry-notary/tests/version_cli.rs b/crates/registry-notary/tests/version_cli.rs
deleted file mode 100644
index a71e2614c..000000000
--- a/crates/registry-notary/tests/version_cli.rs
+++ /dev/null
@@ -1,21 +0,0 @@
-use std::process::Command;
-
-#[test]
-fn version_output_uses_user_facing_command_name() {
-    for flag in ["--version", "-V"] {
-        let output = Command::new(env!("CARGO_BIN_EXE_registry-notary"))
-            .arg(flag)
-            .output()
-            .unwrap_or_else(|err| panic!("registry-notary {flag} runs: {err}"));
-
-        assert!(
-            output.status.success(),
-            "registry-notary {flag} failed: {}",
-            String::from_utf8_lossy(&output.stderr)
-        );
-        assert_eq!(
-            String::from_utf8_lossy(&output.stdout),
-            format!("registry-notary {}\n", env!("CARGO_PKG_VERSION"))
-        );
-    }
-}
diff --git a/crates/registry-platform-audit/Cargo.toml b/crates/registry-platform-audit/Cargo.toml
index 53b046f44..0580555d6 100644
--- a/crates/registry-platform-audit/Cargo.toml
+++ b/crates/registry-platform-audit/Cargo.toml
@@ -14,6 +14,7 @@ workspace = true
 async-trait.workspace = true
 hmac.workspace = true
 registry-platform-canonical-json.workspace = true
+rustix.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 sha2.workspace = true
diff --git a/crates/registry-platform-audit/README.md b/crates/registry-platform-audit/README.md
index 407cc195d..570ee5a72 100644
--- a/crates/registry-platform-audit/README.md
+++ b/crates/registry-platform-audit/README.md
@@ -13,7 +13,10 @@ helpers for registry services.
   stream, operation ULID, and phase.
 - A `cfg(test)` in-memory conformance sink plus a public-API integration test.
   No in-memory sink exists in production builds.
-- Built-in `JsonlFileSink`, `JsonlStdoutSink`, and `SyslogSink`.
+- Built-in `JsonlFileSink`, `DurableSegmentedJsonlSink`, `JsonlStdoutSink`, and
+  `SyslogSink`.
+- `DurableSegmentedAuditLog` for keyed chain-head ownership, concurrent
+  append ordering, and group commit over `DurableSegmentedJsonlSink`.
 - `verify_chain` and `verify_jsonl_lines` for retained audit consistency
   checks.
 - `AuditChainProfile`, `AuditProfile`, `AuditKeyHasher`, and `redact` helpers
@@ -34,7 +37,7 @@ use serde_json::json;
 
 async fn write_audit_event() -> Result<(), registry_platform_audit::AuditError> {
     let sink = JsonlFileSink::new("audit.jsonl");
-    let profile = AuditProfile::registry_notary_from_env("REGISTRY_AUDIT_HASH_SECRET")?;
+    let profile = AuditProfile::registry_relay_from_env("REGISTRY_AUDIT_HASH_SECRET")?;
     let chain = profile.bootstrap_or_start_empty(&sink).await?;
 
     let envelope = chain
@@ -200,6 +203,19 @@ production use.
 
 - `JsonlFileSink::new` rotates at 10 MiB and retains 50 files by default.
 - `JsonlFileSink::with_rotation(path, 0, max_files)` disables size rotation.
+- `DurableSegmentedJsonlSink` is the parallel evidence-grade file contract. It
+  seals the active file as `<path>.<eight-digit-sequence>` when the configured
+  threshold is reached, keeps the keyed chain continuous across segments, and
+  never deletes or compacts sealed history. It requires an owner-only audit
+  directory for direct use.
+- `DurableSegmentedAuditLog` adds keyed startup verification and group commit.
+  It retains Evidence's established owner-controlled directory contract while
+  keeping active and lock files owner-only. Use this type when each append must
+  return only after its own bytes are durable.
+- Use `verify_segmented_audit_chain` for operator full-chain verification.
+  Use `visit_stopped_segmented_audit_chain` only for a bounded, caller-owned
+  projection that requires a stopped writer and the complete retained chain
+  starting at sealed segment one.
 - `AuditProfile::bootstrap_or_start_empty` and
   `AuditChainProfile::bootstrap_or_start_empty` read the sink tail hash before
   new appends, which is the normal startup path for persistent sinks.
@@ -239,8 +255,8 @@ production use.
 - `DurableAuditOperationId` validates canonical ULID syntax only. The consumer
   must enforce that the id is server-minted and is not derived from a subject
   selector, token, source identifier, or other sensitive input.
-- Use `AuditProfile::registry_relay_from_env` or
-  `AuditProfile::registry_notary_from_env` in production. `unkeyed_dev_only` is
+- Use `AuditProfile::production_from_env` or
+  `AuditProfile::registry_relay_from_env` in production. `unkeyed_dev_only` is
   for tests and local development.
 - Use `AuditKeyHasher::audit_reference_hash` for durable audit references
   instead of concatenating ad hoc hash inputs in each service. Keep service
diff --git a/crates/registry-platform-audit/src/lib.rs b/crates/registry-platform-audit/src/lib.rs
index 56402bb2f..54529fa03 100644
--- a/crates/registry-platform-audit/src/lib.rs
+++ b/crates/registry-platform-audit/src/lib.rs
@@ -2,6 +2,13 @@
 //! Tamper-evident audit envelopes, async sinks, and redaction helpers.
 
 pub mod pseudonym_keyring;
+#[cfg(unix)]
+mod segmented_jsonl;
+#[cfg(unix)]
+pub use segmented_jsonl::{
+    segmented_audit_paths, verify_segmented_audit_chain, visit_stopped_segmented_audit_chain,
+    DurableSegmentedAuditLog, DurableSegmentedJsonlSink, SegmentedAuditSummary,
+};
 
 use std::{
     collections::{BTreeMap, BTreeSet},
@@ -86,7 +93,17 @@ impl AuditEnvelope {
         Self::new_with_hasher(record, prev_hash, &AuditChainHasher::unkeyed_dev_only())
     }
 
-    fn new_with_hasher(
+    /// Build the next envelope in a chain without writing it anywhere.
+    ///
+    /// [`ChainState::append`] is the usual way to extend a chain and should be
+    /// preferred. This exists for a sink that has to own the chain head itself,
+    /// because it advances the head and claims a place in a pending batch under
+    /// one lock so that a durable write can cover many records at once. Callers
+    /// taking that route are responsible for the ordering [`ChainState`] would
+    /// otherwise guarantee: `prev_hash` must be the previous record's
+    /// `record_hash`, and `hasher` must be the same hasher for the chain's
+    /// whole life.
+    pub fn new_with_hasher(
         record: Value,
         prev_hash: Option<[u8; 32]>,
         hasher: &AuditChainHasher,
@@ -232,11 +249,6 @@ impl AuditChainProfile {
         Self::production_from_env(env_var_name)
     }
 
-    /// Registry Notary production audit-chain profile.
-    pub fn registry_notary_from_env(env_var_name: &str) -> Result<Self, AuditError> {
-        Self::production_from_env(env_var_name)
-    }
-
     /// Explicit test and local-development profile.
     #[must_use]
     pub fn dev_unkeyed() -> Self {
@@ -286,11 +298,6 @@ impl AuditProfile {
         Self::production_from_env(env_var_name)
     }
 
-    /// Registry Notary production audit profile.
-    pub fn registry_notary_from_env(env_var_name: &str) -> Result<Self, AuditError> {
-        Self::production_from_env(env_var_name)
-    }
-
     /// Explicit test and local-development profile.
     #[must_use]
     pub fn unkeyed_dev_only() -> Self {
@@ -1001,6 +1008,9 @@ pub enum AuditError {
         expected: OptionalHashHex,
         found: OptionalHashHex,
     },
+    /// A non-destructive segmented chain has a gap inside its retained range.
+    #[error("audit sealed segment {sequence} is archived or missing")]
+    SegmentMissing { sequence: u64 },
 }
 
 /// Display helper for an optional 32-byte hash rendered as lowercase hex (or
@@ -3860,7 +3870,7 @@ mod tests {
     async fn audit_profile_uses_one_secret_for_chain_and_identifier_hashing() {
         let name = "REGISTRY_PLATFORM_AUDIT_PROFILE_TEST_SECRET";
         env::set_var(name, "0123456789abcdef0123456789abcdef");
-        let profile = AuditProfile::registry_notary_from_env(name).expect("profile");
+        let profile = AuditProfile::production_from_env(name).expect("profile");
         env::remove_var(name);
         let dir = tempfile::tempdir().expect("tempdir");
         let path = dir.path().join("audit.jsonl");
diff --git a/crates/registry-platform-audit/src/segmented_jsonl.rs b/crates/registry-platform-audit/src/segmented_jsonl.rs
new file mode 100644
index 000000000..0ebdc4988
--- /dev/null
+++ b/crates/registry-platform-audit/src/segmented_jsonl.rs
@@ -0,0 +1,1445 @@
+// SPDX-License-Identifier: Apache-2.0
+//! Evidence-grade, non-destructive segmented JSONL audit storage.
+//!
+//! This lives beside the legacy rolling [`super::JsonlFileSink`] so adopters
+//! can migrate without changing that sink's retention contract. Rotation seals
+//! the active file under an ascending sequence; it never deletes history.
+
+use std::{
+    fs::{self, File, OpenOptions, TryLockError},
+    io::{self, BufRead, BufReader, ErrorKind, Read, Seek, SeekFrom, Write},
+    os::unix::fs::{MetadataExt, OpenOptionsExt},
+    path::{Path, PathBuf},
+    sync::{
+        atomic::{AtomicBool, AtomicU64, Ordering},
+        Arc,
+    },
+};
+
+use async_trait::async_trait;
+use registry_platform_canonical_json::parse_json_strict;
+
+use super::{
+    verify_jsonl_lines_with_hasher, AuditChainHasher, AuditEnvelope, AuditError, AuditSink,
+    OptionalHashHex,
+};
+
+const SEGMENT_SEQUENCE_DIGITS: usize = 8;
+const MAX_AUDIT_LINE_BYTES: usize = 1024 * 1024;
+
+/// Full-chain verification result for a non-destructive segmented JSONL sink.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct SegmentedAuditSummary {
+    pub segments: usize,
+    pub records: usize,
+    pub last_hash: Option<[u8; 32]>,
+    pub first_sequence: Option<u64>,
+    pub last_sequence: Option<u64>,
+    /// False when a live writer owns the active segment, which cannot be read
+    /// safely while an append may be in flight.
+    pub active_verified: bool,
+}
+
+/// A keyed segmented audit log with serialized chain positions and group
+/// commit for concurrent appends.
+///
+/// The file engine remains [`DurableSegmentedJsonlSink`]. This coordinator
+/// owns the keyed chain head and lets records arriving during one durable write
+/// share the next write and `fsync` without weakening per-record durability.
+pub struct DurableSegmentedAuditLog {
+    sink: DurableSegmentedJsonlSink,
+    hasher: AuditChainHasher,
+    state: tokio::sync::Mutex<LogState>,
+    flush: tokio::sync::Mutex<()>,
+    durable: AtomicU64,
+    durable_writes: AtomicU64,
+    startup_verifications: AtomicU64,
+}
+
+struct LogState {
+    verified: bool,
+    tail_hash: Option<[u8; 32]>,
+    pending: Vec<String>,
+    enqueued: u64,
+    poison: Option<String>,
+}
+
+impl LogState {
+    fn check_writable(&self) -> Result<(), AuditError> {
+        if let Some(reason) = &self.poison {
+            return Err(AuditError::Io(io::Error::other(format!(
+                "audit sink stopped after a failed durable write: {reason}"
+            ))));
+        }
+        if !self.verified {
+            return Err(AuditError::Io(io::Error::other(
+                "audit chain was not verified at startup",
+            )));
+        }
+        Ok(())
+    }
+}
+
+impl std::fmt::Debug for DurableSegmentedAuditLog {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("DurableSegmentedAuditLog")
+            .field("path", &self.sink.path)
+            .field("maximum_file_bytes", &self.sink.maximum_file_bytes)
+            .finish_non_exhaustive()
+    }
+}
+
+impl DurableSegmentedAuditLog {
+    /// Open the single-writer sink and establish the authenticated active head.
+    pub async fn initialize(
+        path: impl Into<PathBuf>,
+        maximum_file_bytes: u64,
+        hasher: AuditChainHasher,
+    ) -> Result<Self, AuditError> {
+        let sink = DurableSegmentedJsonlSink::open_with_policy(
+            path.into(),
+            maximum_file_bytes,
+            DirectoryPolicy::OwnerControlled,
+        )?;
+        let log = Self {
+            sink,
+            hasher,
+            state: tokio::sync::Mutex::new(LogState {
+                verified: false,
+                tail_hash: None,
+                pending: Vec::new(),
+                enqueued: 0,
+                poison: None,
+            }),
+            flush: tokio::sync::Mutex::new(()),
+            durable: AtomicU64::new(0),
+            durable_writes: AtomicU64::new(0),
+            startup_verifications: AtomicU64::new(0),
+        };
+        log.verify_startup().await?;
+        Ok(log)
+    }
+
+    #[must_use]
+    pub fn path(&self) -> &Path {
+        self.sink.path()
+    }
+
+    /// Build one keyed envelope, enqueue it, and return after it is durable.
+    pub async fn append_record(
+        &self,
+        record: serde_json::Value,
+    ) -> Result<AuditEnvelope, AuditError> {
+        let (envelope, position) = {
+            let mut state = self.state.lock().await;
+            state.check_writable()?;
+            let envelope = AuditEnvelope::new_with_hasher(record, state.tail_hash, &self.hasher)?;
+            let line = envelope.to_jsonl()?;
+            let incoming = u64::try_from(line.len()).map_err(|_| file_size_error())?;
+            if incoming > self.sink.maximum_file_bytes {
+                return Err(file_size_error());
+            }
+            state.pending.push(line);
+            state.enqueued = state.enqueued.saturating_add(1);
+            state.tail_hash = Some(envelope.record_hash);
+            (envelope, state.enqueued)
+        };
+        self.flush_through(position).await?;
+        Ok(envelope)
+    }
+
+    /// Report health without rescanning sealed history.
+    pub async fn ready(&self) -> bool {
+        let state = self.state.lock().await;
+        if state.check_writable().is_err() {
+            return false;
+        }
+        drop(state);
+        self.sink.ready().await
+    }
+
+    /// Number of durable writes performed by this process.
+    #[must_use]
+    pub fn durable_writes(&self) -> u64 {
+        self.durable_writes.load(Ordering::Relaxed)
+    }
+
+    /// Number of bounded startup head verifications performed by this process.
+    #[must_use]
+    pub fn startup_verifications(&self) -> u64 {
+        self.startup_verifications.load(Ordering::Relaxed)
+    }
+
+    async fn verify_startup(&self) -> Result<(), AuditError> {
+        let mut state = self.state.lock().await;
+        self.startup_verifications.fetch_add(1, Ordering::Relaxed);
+        let tail_hash = self.sink.tail_hash_with_hasher(&self.hasher).await?;
+        state.tail_hash = tail_hash;
+        state.verified = true;
+        Ok(())
+    }
+
+    async fn flush_through(&self, position: u64) -> Result<(), AuditError> {
+        loop {
+            if self.durable.load(Ordering::Acquire) >= position {
+                return Ok(());
+            }
+            let _writer = self.flush.lock().await;
+            if self.durable.load(Ordering::Acquire) >= position {
+                return Ok(());
+            }
+            self.flush_once().await?;
+        }
+    }
+
+    async fn flush_once(&self) -> Result<(), AuditError> {
+        let (lines, through) = {
+            let mut state = self.state.lock().await;
+            state.check_writable()?;
+            if state.pending.is_empty() {
+                return Ok(());
+            }
+            (std::mem::take(&mut state.pending), state.enqueued)
+        };
+        self.durable_writes.fetch_add(1, Ordering::Relaxed);
+        match self.sink.write_lines(lines).await {
+            Ok(()) => {
+                self.durable.store(through, Ordering::Release);
+                Ok(())
+            }
+            Err(error) => {
+                self.state.lock().await.poison = Some(error.to_string());
+                Err(error)
+            }
+        }
+    }
+}
+
+/// A durable single-writer sink with online, non-destructive size rotation.
+///
+/// The active file remains at `path`. Rotation renames it to
+/// `<path>.<sequence>`, using an ascending zero-padded eight-digit sequence,
+/// then opens a fresh active file. The keyed chain continues across the seam.
+/// Sealed segments are never deleted or compacted.
+pub struct DurableSegmentedJsonlSink {
+    path: PathBuf,
+    lock_path: PathBuf,
+    maximum_file_bytes: u64,
+    directory_policy: DirectoryPolicy,
+    state: tokio::sync::Mutex<SinkState>,
+    healthy: Arc<AtomicBool>,
+    lock_fingerprint: FileFingerprint,
+    _writer_lock: File,
+}
+
+struct SinkState {
+    audit_file: File,
+    fingerprint: FileFingerprint,
+    next_sequence: u64,
+}
+
+#[derive(Clone, Copy)]
+enum DirectoryPolicy {
+    OwnerOnly,
+    OwnerControlled,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+struct FileFingerprint {
+    device: u64,
+    inode: u64,
+    length: u64,
+    modified_seconds: i64,
+    modified_nanoseconds: i64,
+    changed_seconds: i64,
+    changed_nanoseconds: i64,
+}
+
+impl std::fmt::Debug for DurableSegmentedJsonlSink {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("DurableSegmentedJsonlSink")
+            .field("path", &self.path)
+            .field("maximum_file_bytes", &self.maximum_file_bytes)
+            .field("healthy", &self.healthy.load(Ordering::Relaxed))
+            .finish_non_exhaustive()
+    }
+}
+
+impl DurableSegmentedJsonlSink {
+    /// Open an active audit segment and take the process-lifetime writer lock.
+    pub fn open(path: impl Into<PathBuf>, maximum_file_bytes: u64) -> Result<Self, AuditError> {
+        Self::open_with_policy(path.into(), maximum_file_bytes, DirectoryPolicy::OwnerOnly)
+    }
+
+    fn open_with_policy(
+        path: PathBuf,
+        maximum_file_bytes: u64,
+        directory_policy: DirectoryPolicy,
+    ) -> Result<Self, AuditError> {
+        if maximum_file_bytes == 0 {
+            return Err(file_size_error());
+        }
+        super::ensure_parent_dir(&path)?;
+        let parent = parent(&path)?;
+        validate_directory(parent, directory_policy)?;
+
+        let created = !path.exists();
+        let audit_file = open_append(&path)?;
+        validate_owner_only_active_file(&audit_file)?;
+        audit_file.sync_all().map_err(AuditError::Io)?;
+        if created {
+            sync_parent(&path, directory_policy)?;
+        }
+
+        let lock_path = lock_path(&path);
+        let lock_created = !lock_path.exists();
+        let writer_lock = open_lock(&lock_path)?;
+        validate_owner_only_active_file(&writer_lock)?;
+        match writer_lock.try_lock() {
+            Ok(()) => {}
+            Err(TryLockError::WouldBlock) => {
+                return Err(AuditError::SinkLocked {
+                    path: lock_path.display().to_string(),
+                });
+            }
+            Err(TryLockError::Error(error)) => return Err(AuditError::Io(error)),
+        }
+        writer_lock.sync_all().map_err(AuditError::Io)?;
+        if lock_created {
+            sync_parent(&path, directory_policy)?;
+        }
+
+        let fingerprint = file_fingerprint(&audit_file)?;
+        let lock_fingerprint = file_fingerprint(&writer_lock)?;
+        let next_sequence =
+            newest_sealed_sequence(&path)?.map_or(1, |sequence| sequence.saturating_add(1));
+        Ok(Self {
+            path,
+            lock_path,
+            maximum_file_bytes,
+            directory_policy,
+            state: tokio::sync::Mutex::new(SinkState {
+                audit_file,
+                fingerprint,
+                next_sequence,
+            }),
+            healthy: Arc::new(AtomicBool::new(true)),
+            lock_fingerprint,
+            _writer_lock: writer_lock,
+        })
+    }
+
+    #[must_use]
+    pub fn path(&self) -> &Path {
+        &self.path
+    }
+
+    #[must_use]
+    pub fn healthy(&self) -> bool {
+        self.healthy.load(Ordering::Acquire)
+    }
+
+    /// Check that the writer is healthy and still owns the pinned active and
+    /// lock paths. This performs filesystem work and belongs on a readiness
+    /// path, not in a synchronous request admission check.
+    pub async fn ready(&self) -> bool {
+        if !self.healthy() {
+            return false;
+        }
+        let state = self.state.lock().await;
+        let Ok(audit_file) = state.audit_file.try_clone() else {
+            return false;
+        };
+        let Ok(writer_lock) = self._writer_lock.try_clone() else {
+            return false;
+        };
+        let path = self.path.clone();
+        let lock_path = self.lock_path.clone();
+        let fingerprint = state.fingerprint;
+        let lock_fingerprint = self.lock_fingerprint;
+        // Keep the state guard until the check completes so an append cannot
+        // legitimately change the active-file fingerprint mid-readiness check.
+        tokio::task::spawn_blocking(move || {
+            validate_pinned_file(&path, &audit_file, fingerprint)?;
+            validate_pinned_file(&lock_path, &writer_lock, lock_fingerprint)?;
+            audit_file.sync_all().map_err(AuditError::Io)?;
+            validate_pinned_file(&path, &audit_file, fingerprint)?;
+            validate_pinned_file(&lock_path, &writer_lock, lock_fingerprint)
+        })
+        .await
+        .ok()
+        .and_then(Result::ok)
+        .is_some()
+    }
+
+    fn poison(&self) {
+        self.healthy.store(false, Ordering::Release);
+    }
+
+    fn check_writable(&self) -> Result<(), AuditError> {
+        if !self.healthy() {
+            return Err(AuditError::Io(io::Error::other(
+                "audit sink stopped after a failed durable write",
+            )));
+        }
+        Ok(())
+    }
+
+    async fn write_lines(&self, lines: Vec<String>) -> Result<(), AuditError> {
+        self.check_writable()?;
+        if lines.is_empty() {
+            return Ok(());
+        }
+        for line in &lines {
+            let incoming = u64::try_from(line.len()).map_err(|_| file_size_error())?;
+            if incoming > self.maximum_file_bytes {
+                return Err(file_size_error());
+            }
+        }
+
+        let first = parse_envelope_strict(lines.first().expect("nonempty lines checked"))?;
+        let mut state = self.state.lock().await;
+        self.check_writable()?;
+        let request = AppendRequest {
+            path: self.path.clone(),
+            maximum_file_bytes: self.maximum_file_bytes,
+            lines,
+            expected_previous: first.prev_hash,
+            audit_file: state.audit_file.try_clone().map_err(AuditError::Io)?,
+            fingerprint: state.fingerprint,
+            lock_path: self.lock_path.clone(),
+            writer_lock: self._writer_lock.try_clone().map_err(AuditError::Io)?,
+            lock_fingerprint: self.lock_fingerprint,
+            next_sequence: state.next_sequence,
+            directory_policy: self.directory_policy,
+        };
+        match tokio::task::spawn_blocking(move || request.run()).await {
+            Ok(Ok(result)) => {
+                if let Some(active) = result.active {
+                    state.audit_file = active;
+                }
+                state.fingerprint = result.fingerprint;
+                state.next_sequence = result.next_sequence;
+                Ok(())
+            }
+            Ok(Err(error)) => {
+                self.poison();
+                Err(error)
+            }
+            Err(error) => {
+                self.poison();
+                Err(AuditError::Io(io::Error::other(error)))
+            }
+        }
+    }
+}
+
+#[async_trait]
+impl AuditSink for DurableSegmentedJsonlSink {
+    async fn write(&self, envelope: &AuditEnvelope) -> Result<(), AuditError> {
+        let line = envelope.to_jsonl()?;
+        self.write_lines(vec![line]).await
+    }
+
+    async fn tail_hash(&self) -> Result<Option<[u8; 32]>, AuditError> {
+        self.tail_hash_with_hasher(&AuditChainHasher::unkeyed_dev_only())
+            .await
+    }
+
+    async fn tail_hash_with_hasher(
+        &self,
+        hasher: &AuditChainHasher,
+    ) -> Result<Option<[u8; 32]>, AuditError> {
+        let state = self.state.lock().await;
+        self.check_writable()?;
+        let path = self.path.clone();
+        let file = state.audit_file.try_clone().map_err(AuditError::Io)?;
+        let fingerprint = state.fingerprint;
+        let lock_path = self.lock_path.clone();
+        let writer_lock = self._writer_lock.try_clone().map_err(AuditError::Io)?;
+        let lock_fingerprint = self.lock_fingerprint;
+        let hasher = hasher.clone();
+        tokio::task::spawn_blocking(move || {
+            validate_pinned_file(&path, &file, fingerprint)?;
+            validate_pinned_file(&lock_path, &writer_lock, lock_fingerprint)?;
+            let sealed_head = sealed_tail_hash(&path, &hasher)?;
+            let verification = verify_segment(file, &hasher, sealed_head)?;
+            validate_pinned_file(&path, &verification.file, fingerprint)?;
+            validate_pinned_file(&lock_path, &writer_lock, lock_fingerprint)?;
+            Ok(verification.head)
+        })
+        .await
+        .map_err(|error| AuditError::Io(io::Error::other(error)))?
+    }
+}
+
+struct AppendRequest {
+    path: PathBuf,
+    maximum_file_bytes: u64,
+    lines: Vec<String>,
+    expected_previous: Option<[u8; 32]>,
+    audit_file: File,
+    fingerprint: FileFingerprint,
+    lock_path: PathBuf,
+    writer_lock: File,
+    lock_fingerprint: FileFingerprint,
+    next_sequence: u64,
+    directory_policy: DirectoryPolicy,
+}
+
+struct AppendResult {
+    active: Option<File>,
+    fingerprint: FileFingerprint,
+    next_sequence: u64,
+}
+
+impl AppendRequest {
+    fn run(mut self) -> Result<AppendResult, AuditError> {
+        validate_pinned_file(&self.path, &self.audit_file, self.fingerprint)?;
+        validate_pinned_file(&self.lock_path, &self.writer_lock, self.lock_fingerprint)?;
+        let on_disk_tail = current_tail_hash(&self.path)?;
+        if on_disk_tail != self.expected_previous {
+            return Err(AuditError::ChainForkDetected {
+                expected: OptionalHashHex(self.expected_previous),
+                found: OptionalHashHex(on_disk_tail),
+            });
+        }
+
+        let mut current = self.audit_file.metadata().map_err(AuditError::Io)?.len();
+        let mut replacement = None;
+        let mut run = String::new();
+        for line in &self.lines {
+            let incoming = u64::try_from(line.len()).map_err(|_| file_size_error())?;
+            if incoming > self.maximum_file_bytes {
+                return Err(file_size_error());
+            }
+            if current > 0 && current.saturating_add(incoming) > self.maximum_file_bytes {
+                self.audit_file
+                    .write_all(run.as_bytes())
+                    .map_err(AuditError::Io)?;
+                self.audit_file.flush().map_err(AuditError::Io)?;
+                run.clear();
+                let sealed = seal_active_segment(
+                    &self.path,
+                    &self.audit_file,
+                    self.next_sequence,
+                    self.directory_policy,
+                )?;
+                self.audit_file = sealed.active.try_clone().map_err(AuditError::Io)?;
+                replacement = Some(sealed.active);
+                self.next_sequence = sealed.next_sequence;
+                current = 0;
+            }
+            run.push_str(line);
+            current = current.saturating_add(incoming);
+        }
+
+        self.audit_file
+            .write_all(run.as_bytes())
+            .map_err(AuditError::Io)?;
+        self.audit_file.flush().map_err(AuditError::Io)?;
+        self.audit_file.sync_all().map_err(AuditError::Io)?;
+        sync_parent(&self.path, self.directory_policy)?;
+        validate_owner_only_active_file(&self.audit_file)?;
+        let fingerprint = file_fingerprint(&self.audit_file)?;
+        validate_pinned_file(&self.path, &self.audit_file, fingerprint)?;
+        validate_pinned_file(&self.lock_path, &self.writer_lock, self.lock_fingerprint)?;
+        Ok(AppendResult {
+            active: replacement,
+            fingerprint,
+            next_sequence: self.next_sequence,
+        })
+    }
+}
+
+struct SealedSegment {
+    active: File,
+    next_sequence: u64,
+}
+
+fn seal_active_segment(
+    path: &Path,
+    active: &File,
+    sequence: u64,
+    directory_policy: DirectoryPolicy,
+) -> Result<SealedSegment, AuditError> {
+    active.sync_all().map_err(AuditError::Io)?;
+    let mut sequence = sequence;
+    let mut sealed = segment_path(path, sequence);
+    while fs::symlink_metadata(&sealed).is_ok() {
+        sequence = next_sequence(sequence)?;
+        sealed = segment_path(path, sequence);
+    }
+    fs::rename(path, &sealed).map_err(AuditError::Io)?;
+    let replacement = open_append(path)?;
+    validate_owner_only_active_file(&replacement)?;
+    if replacement.metadata().map_err(AuditError::Io)?.len() != 0 {
+        return Err(AuditError::Io(io::Error::other(
+            "replacement audit segment is not empty",
+        )));
+    }
+    replacement.sync_all().map_err(AuditError::Io)?;
+    sync_parent(path, directory_policy)?;
+    Ok(SealedSegment {
+        active: replacement,
+        next_sequence: next_sequence(sequence)?,
+    })
+}
+
+fn next_sequence(sequence: u64) -> Result<u64, AuditError> {
+    sequence
+        .checked_add(1)
+        .ok_or_else(|| AuditError::Io(io::Error::other("audit segment sequence is exhausted")))
+}
+
+/// Enumerate sealed segments oldest first, followed by the active segment.
+pub fn segmented_audit_paths(path: &Path) -> Result<Vec<PathBuf>, AuditError> {
+    let mut paths: Vec<PathBuf> = sealed_segments(path)?
+        .into_iter()
+        .map(|(_, path)| path)
+        .collect();
+    if fs::symlink_metadata(path).is_ok() {
+        paths.push(path.to_path_buf());
+    }
+    Ok(paths)
+}
+
+/// Verify all sealed history and, when no writer is running, the active segment.
+///
+/// A missing sequence inside the retained sealed range is reported distinctly.
+/// An archived prefix is allowed and identified by `first_sequence`.
+pub fn verify_segmented_audit_chain(
+    path: &Path,
+    hasher: &AuditChainHasher,
+) -> Result<SegmentedAuditSummary, AuditError> {
+    let parent = parent(path)?;
+    validate_directory(parent, DirectoryPolicy::OwnerControlled)?;
+    let guard = verification_lock(path)?;
+    let active_available = match guard.try_lock() {
+        Ok(()) => true,
+        Err(TryLockError::WouldBlock) => false,
+        Err(TryLockError::Error(error)) => return Err(AuditError::Io(error)),
+    };
+
+    let sealed = sealed_segments(path)?;
+    let first_sequence = sealed.first().map(|(sequence, _)| *sequence);
+    let last_sequence = sealed.last().map(|(sequence, _)| *sequence);
+    if let Some(first) = first_sequence {
+        for (offset, (sequence, _)) in sealed.iter().enumerate() {
+            let expected = first.saturating_add(offset as u64);
+            if *sequence != expected {
+                return Err(AuditError::SegmentMissing { sequence: expected });
+            }
+        }
+    }
+
+    let mut head = None;
+    let mut records = 0usize;
+    let mut segments = 0usize;
+    for (_, path) in &sealed {
+        let file = open_sealed(path)?;
+        let verification = verify_segment(file, hasher, head)?;
+        head = verification.head;
+        records = records.saturating_add(verification.records);
+        segments = segments.saturating_add(1);
+    }
+
+    let active_verified = active_available && path.is_file();
+    if active_verified {
+        let file = open_read(path)?;
+        validate_owner_only_active_file(&file)?;
+        let verification = verify_segment(file, hasher, head)?;
+        head = verification.head;
+        records = records.saturating_add(verification.records);
+        segments = segments.saturating_add(1);
+    }
+
+    Ok(SegmentedAuditSummary {
+        segments,
+        records,
+        last_hash: head,
+        first_sequence,
+        last_sequence,
+        active_verified,
+    })
+}
+
+/// Verify a complete stopped chain and pass each exact verified envelope to a
+/// bounded caller-owned collector.
+///
+/// Unlike [`verify_segmented_audit_chain`], this requires the sealed sequence
+/// to start at one, requires an active segment, and holds the writer lock for
+/// the whole replay. It is intended for local inspection commands that must
+/// derive a view from one stable, complete retained chain.
+pub fn visit_stopped_segmented_audit_chain(
+    path: &Path,
+    hasher: &AuditChainHasher,
+    maximum_segments: usize,
+    maximum_records: usize,
+    mut visit: impl FnMut(AuditEnvelope) -> Result<(), AuditError>,
+) -> Result<SegmentedAuditSummary, AuditError> {
+    if maximum_segments == 0 || maximum_records == 0 {
+        return Err(file_size_error());
+    }
+    let parent = parent(path)?;
+    validate_directory(parent, DirectoryPolicy::OwnerControlled)?;
+    let lock_path = lock_path(path);
+    let guard = verification_lock(path)?;
+    match guard.try_lock() {
+        Ok(()) => {}
+        Err(TryLockError::WouldBlock) => {
+            return Err(AuditError::Io(io::Error::other("audit writer is active")));
+        }
+        Err(TryLockError::Error(error)) => return Err(AuditError::Io(error)),
+    }
+    let lock_fingerprint = file_fingerprint(&guard)?;
+
+    let sealed = sealed_segments_bounded(path, maximum_segments.saturating_sub(1))?;
+    for (offset, (sequence, _)) in sealed.iter().enumerate() {
+        let expected = 1u64.saturating_add(offset as u64);
+        if *sequence != expected {
+            return Err(AuditError::SegmentMissing { sequence: expected });
+        }
+    }
+
+    let mut head = None;
+    let mut records = 0usize;
+    let mut segments = 0usize;
+    for (_, segment) in &sealed {
+        let file = open_sealed(segment)?;
+        let before = file_fingerprint(&file)?;
+        let verification = verify_segment_with(
+            file.try_clone().map_err(AuditError::Io)?,
+            hasher,
+            head,
+            &mut |envelope| {
+                records = records.checked_add(1).ok_or_else(file_size_error)?;
+                if records > maximum_records {
+                    return Err(file_size_error());
+                }
+                visit(envelope)
+            },
+        )?;
+        validate_stable_segment(segment, &file, before, false)?;
+        head = verification.head;
+        segments = segments.saturating_add(1);
+    }
+
+    if segments >= maximum_segments {
+        return Err(file_size_error());
+    }
+    let active = open_read(path)?;
+    validate_owner_only_active_file(&active)?;
+    let before = file_fingerprint(&active)?;
+    let verification = verify_segment_with(
+        active.try_clone().map_err(AuditError::Io)?,
+        hasher,
+        head,
+        &mut |envelope| {
+            records = records.checked_add(1).ok_or_else(file_size_error)?;
+            if records > maximum_records {
+                return Err(file_size_error());
+            }
+            visit(envelope)
+        },
+    )?;
+    validate_stable_segment(path, &active, before, true)?;
+    validate_pinned_file(&lock_path, &guard, lock_fingerprint)?;
+    head = verification.head;
+    segments = segments.saturating_add(1);
+
+    Ok(SegmentedAuditSummary {
+        segments,
+        records,
+        last_hash: head,
+        first_sequence: sealed.first().map(|(sequence, _)| *sequence),
+        last_sequence: sealed.last().map(|(sequence, _)| *sequence),
+        active_verified: true,
+    })
+}
+
+struct SegmentVerification {
+    file: File,
+    head: Option<[u8; 32]>,
+    records: usize,
+}
+
+fn verify_segment(
+    file: File,
+    hasher: &AuditChainHasher,
+    expected_head: Option<[u8; 32]>,
+) -> Result<SegmentVerification, AuditError> {
+    verify_segment_with(file, hasher, expected_head, &mut |_| Ok(()))
+}
+
+fn verify_segment_with(
+    file: File,
+    hasher: &AuditChainHasher,
+    expected_head: Option<[u8; 32]>,
+    visit: &mut impl FnMut(AuditEnvelope) -> Result<(), AuditError>,
+) -> Result<SegmentVerification, AuditError> {
+    let mut reader = BufReader::new(file);
+    let mut expected_previous = expected_head;
+    let mut records = 0usize;
+    while let Some(line) = read_bounded_jsonl_line(&mut reader)? {
+        let exact = line.trim_end_matches('\n');
+        let (envelope, verification) = verify_envelope_line(exact, hasher)?;
+        if verification.start_prev_hash != expected_previous {
+            return Err(AuditError::ChainForkDetected {
+                expected: OptionalHashHex(expected_previous),
+                found: OptionalHashHex(verification.start_prev_hash),
+            });
+        }
+        visit(envelope)?;
+        expected_previous = verification.last_hash;
+        records = records.saturating_add(verification.records);
+    }
+    Ok(SegmentVerification {
+        file: reader.into_inner(),
+        head: expected_previous,
+        records,
+    })
+}
+
+fn sealed_tail_hash(
+    path: &Path,
+    hasher: &AuditChainHasher,
+) -> Result<Option<[u8; 32]>, AuditError> {
+    let Some((_, newest)) = sealed_segments(path)?.pop() else {
+        return Ok(None);
+    };
+    let file = open_sealed(&newest)?;
+    let Some(line) = last_jsonl_line(file)? else {
+        return Err(AuditError::Io(io::Error::new(
+            ErrorKind::InvalidData,
+            "sealed audit segment holds no records",
+        )));
+    };
+    let verification = verify_one_line(line.trim_end_matches('\n'), hasher)?;
+    Ok(verification.last_hash)
+}
+
+fn current_tail_hash(path: &Path) -> Result<Option<[u8; 32]>, AuditError> {
+    let active = open_read(path)?;
+    if let Some(line) = last_jsonl_line(active)? {
+        let envelope = parse_envelope_strict(line.trim_end_matches('\n'))?;
+        return Ok(Some(envelope.record_hash));
+    }
+    let Some((_, newest)) = sealed_segments(path)?.pop() else {
+        return Ok(None);
+    };
+    let Some(line) = last_jsonl_line(open_sealed(&newest)?)? else {
+        return Err(AuditError::Io(io::Error::new(
+            ErrorKind::InvalidData,
+            "sealed audit segment holds no records",
+        )));
+    };
+    let envelope = parse_envelope_strict(line.trim_end_matches('\n'))?;
+    Ok(Some(envelope.record_hash))
+}
+
+fn verify_one_line(
+    line: &str,
+    hasher: &AuditChainHasher,
+) -> Result<super::ChainVerification, AuditError> {
+    verify_envelope_line(line, hasher).map(|(_, verification)| verification)
+}
+
+fn verify_envelope_line(
+    line: &str,
+    hasher: &AuditChainHasher,
+) -> Result<(AuditEnvelope, super::ChainVerification), AuditError> {
+    let envelope = parse_envelope_strict(line)?;
+    let verification =
+        verify_jsonl_lines_with_hasher([line], hasher).map_err(AuditError::ChainVerification)?;
+    Ok((envelope, verification))
+}
+
+fn parse_envelope_strict(line: &str) -> Result<AuditEnvelope, AuditError> {
+    let value = parse_json_strict(line.as_bytes()).map_err(|_| invalid_audit_data())?;
+    serde_json::from_value(value).map_err(|_| invalid_audit_data())
+}
+
+fn read_bounded_jsonl_line(reader: &mut BufReader<File>) -> Result<Option<String>, AuditError> {
+    let mut line = Vec::new();
+    loop {
+        let available = reader.fill_buf().map_err(AuditError::Io)?;
+        if available.is_empty() {
+            if line.is_empty() {
+                return Ok(None);
+            }
+            return Err(AuditError::Io(io::Error::new(
+                ErrorKind::InvalidData,
+                "audit JSONL has an incomplete final record",
+            )));
+        }
+        let take = available
+            .iter()
+            .position(|byte| *byte == b'\n')
+            .map_or(available.len(), |index| index + 1);
+        if line.len().saturating_add(take) > MAX_AUDIT_LINE_BYTES {
+            return Err(file_size_error());
+        }
+        let found_newline = available[take - 1] == b'\n';
+        line.extend_from_slice(&available[..take]);
+        reader.consume(take);
+        if found_newline {
+            return String::from_utf8(line).map(Some).map_err(|_| {
+                AuditError::Io(io::Error::new(
+                    ErrorKind::InvalidData,
+                    "audit JSONL is not UTF-8",
+                ))
+            });
+        }
+    }
+}
+
+fn last_jsonl_line(mut file: File) -> Result<Option<String>, AuditError> {
+    let length = file.metadata().map_err(AuditError::Io)?.len();
+    if length == 0 {
+        return Ok(None);
+    }
+    let bound = u64::try_from(MAX_AUDIT_LINE_BYTES.saturating_add(1)).unwrap_or(u64::MAX);
+    let window = bound.min(length);
+    file.seek(SeekFrom::Start(length - window))
+        .map_err(AuditError::Io)?;
+    let mut tail = vec![0u8; usize::try_from(window).map_err(|_| file_size_error())?];
+    file.read_exact(&mut tail).map_err(AuditError::Io)?;
+    if tail.pop() != Some(b'\n') {
+        return Err(AuditError::Io(io::Error::new(
+            ErrorKind::InvalidData,
+            "audit segment has an incomplete final record",
+        )));
+    }
+    let start = tail
+        .iter()
+        .rposition(|byte| *byte == b'\n')
+        .map_or(0, |index| index + 1);
+    if start == 0 && window < length {
+        return Err(file_size_error());
+    }
+    String::from_utf8(tail[start..].to_vec())
+        .map(Some)
+        .map_err(|_| {
+            AuditError::Io(io::Error::new(
+                ErrorKind::InvalidData,
+                "audit JSONL is not UTF-8",
+            ))
+        })
+}
+
+fn sealed_segments(path: &Path) -> Result<Vec<(u64, PathBuf)>, AuditError> {
+    sealed_segments_bounded(path, usize::MAX)
+}
+
+fn sealed_segments_bounded(
+    path: &Path,
+    maximum_segments: usize,
+) -> Result<Vec<(u64, PathBuf)>, AuditError> {
+    let mut sealed = Vec::new();
+    for entry in fs::read_dir(parent(path)?).map_err(AuditError::Io)? {
+        let candidate = entry.map_err(AuditError::Io)?.path();
+        if let Some(sequence) = segment_sequence(path, &candidate) {
+            sealed.push((sequence, candidate));
+            if sealed.len() > maximum_segments {
+                return Err(file_size_error());
+            }
+        }
+    }
+    sealed.sort_unstable_by_key(|(sequence, _)| *sequence);
+    Ok(sealed)
+}
+
+fn newest_sealed_sequence(path: &Path) -> Result<Option<u64>, AuditError> {
+    Ok(sealed_segments(path)?.pop().map(|(sequence, _)| sequence))
+}
+
+fn segment_sequence(path: &Path, candidate: &Path) -> Option<u64> {
+    let active = path.file_name()?.to_str()?;
+    let suffix = candidate
+        .file_name()?
+        .to_str()?
+        .strip_prefix(active)?
+        .strip_prefix('.')?;
+    if suffix.len() != SEGMENT_SEQUENCE_DIGITS || !suffix.bytes().all(|byte| byte.is_ascii_digit())
+    {
+        return None;
+    }
+    suffix.parse().ok()
+}
+
+fn segment_path(path: &Path, sequence: u64) -> PathBuf {
+    let mut value = path.as_os_str().to_os_string();
+    value.push(format!(".{sequence:0SEGMENT_SEQUENCE_DIGITS$}"));
+    PathBuf::from(value)
+}
+
+fn lock_path(path: &Path) -> PathBuf {
+    let mut value = path.as_os_str().to_os_string();
+    value.push(".lock");
+    PathBuf::from(value)
+}
+
+fn verification_lock(path: &Path) -> Result<File, AuditError> {
+    let path = lock_path(path);
+    let file = open_lock(&path)?;
+    validate_owner_only_active_file(&file)?;
+    Ok(file)
+}
+
+fn open_append(path: &Path) -> Result<File, AuditError> {
+    reject_symlink(path)?;
+    OpenOptions::new()
+        .create(true)
+        .read(true)
+        .append(true)
+        .mode(0o600)
+        .custom_flags(open_flags())
+        .open(path)
+        .map_err(AuditError::Io)
+}
+
+fn open_lock(path: &Path) -> Result<File, AuditError> {
+    reject_symlink(path)?;
+    OpenOptions::new()
+        .create(true)
+        .write(true)
+        .mode(0o600)
+        .custom_flags(open_flags())
+        .open(path)
+        .map_err(AuditError::Io)
+}
+
+fn open_read(path: &Path) -> Result<File, AuditError> {
+    reject_symlink(path)?;
+    OpenOptions::new()
+        .read(true)
+        .custom_flags(open_flags())
+        .open(path)
+        .map_err(AuditError::Io)
+}
+
+fn open_flags() -> i32 {
+    (rustix::fs::OFlags::NOFOLLOW | rustix::fs::OFlags::CLOEXEC).bits() as i32
+}
+
+fn open_sealed(path: &Path) -> Result<File, AuditError> {
+    let file = open_read(path)?;
+    validate_owner_only_sealed_file(&file)?;
+    Ok(file)
+}
+
+fn reject_symlink(path: &Path) -> Result<(), AuditError> {
+    match fs::symlink_metadata(path) {
+        Ok(metadata) if metadata.file_type().is_symlink() => Err(AuditError::Io(io::Error::new(
+            ErrorKind::PermissionDenied,
+            "audit paths must not be symlinks",
+        ))),
+        Ok(_) => Ok(()),
+        Err(error) if error.kind() == ErrorKind::NotFound => Ok(()),
+        Err(error) => Err(AuditError::Io(error)),
+    }
+}
+
+fn validate_directory(path: &Path, policy: DirectoryPolicy) -> Result<(), AuditError> {
+    let metadata = fs::symlink_metadata(path).map_err(AuditError::Io)?;
+    let (unsafe_mode, message) = match policy {
+        DirectoryPolicy::OwnerOnly => (
+            metadata.mode() & 0o077 != 0,
+            "audit directory must be owner-only",
+        ),
+        DirectoryPolicy::OwnerControlled => (
+            metadata.mode() & 0o022 != 0,
+            "audit directory must be owner-controlled",
+        ),
+    };
+    if !metadata.is_dir() || metadata.uid() != rustix::process::geteuid().as_raw() || unsafe_mode {
+        return Err(AuditError::Io(io::Error::new(
+            ErrorKind::PermissionDenied,
+            message,
+        )));
+    }
+    Ok(())
+}
+
+fn validate_owner_only_active_file(file: &File) -> Result<(), AuditError> {
+    let metadata = file.metadata().map_err(AuditError::Io)?;
+    if !metadata.is_file()
+        || metadata.nlink() != 1
+        || metadata.uid() != rustix::process::geteuid().as_raw()
+        || metadata.mode() & 0o077 != 0
+    {
+        return Err(AuditError::Io(io::Error::new(
+            ErrorKind::PermissionDenied,
+            "active audit files must be owner-only, singly linked regular files",
+        )));
+    }
+    Ok(())
+}
+
+fn validate_owner_only_sealed_file(file: &File) -> Result<(), AuditError> {
+    let metadata = file.metadata().map_err(AuditError::Io)?;
+    if !metadata.is_file()
+        || metadata.uid() != rustix::process::geteuid().as_raw()
+        || metadata.mode() & 0o077 != 0
+    {
+        return Err(AuditError::Io(io::Error::new(
+            ErrorKind::PermissionDenied,
+            "sealed audit files must be owner-only regular files",
+        )));
+    }
+    Ok(())
+}
+
+fn file_fingerprint(file: &File) -> Result<FileFingerprint, AuditError> {
+    let metadata = file.metadata().map_err(AuditError::Io)?;
+    Ok(FileFingerprint {
+        device: metadata.dev(),
+        inode: metadata.ino(),
+        length: metadata.len(),
+        modified_seconds: metadata.mtime(),
+        modified_nanoseconds: metadata.mtime_nsec(),
+        changed_seconds: metadata.ctime(),
+        changed_nanoseconds: metadata.ctime_nsec(),
+    })
+}
+
+fn validate_pinned_file(
+    path: &Path,
+    pinned: &File,
+    expected: FileFingerprint,
+) -> Result<(), AuditError> {
+    validate_owner_only_active_file(pinned)?;
+    let candidate = open_read(path)?;
+    validate_owner_only_active_file(&candidate)?;
+    if file_fingerprint(pinned)? != expected || file_fingerprint(&candidate)? != expected {
+        return Err(AuditError::Io(io::Error::other(
+            "audit file changed outside the initialized writer",
+        )));
+    }
+    Ok(())
+}
+
+fn validate_stable_segment(
+    path: &Path,
+    pinned: &File,
+    before: FileFingerprint,
+    active: bool,
+) -> Result<(), AuditError> {
+    let candidate = open_read(path)?;
+    if active {
+        validate_owner_only_active_file(pinned)?;
+        validate_owner_only_active_file(&candidate)?;
+    } else {
+        validate_owner_only_sealed_file(pinned)?;
+        validate_owner_only_sealed_file(&candidate)?;
+    }
+    if file_fingerprint(pinned)? != before || file_fingerprint(&candidate)? != before {
+        return Err(AuditError::Io(io::Error::other(
+            "audit segment changed during verification",
+        )));
+    }
+    Ok(())
+}
+
+fn parent(path: &Path) -> Result<&Path, AuditError> {
+    path.parent().ok_or_else(|| {
+        AuditError::Io(io::Error::new(
+            ErrorKind::InvalidInput,
+            "audit path has no parent",
+        ))
+    })
+}
+
+fn sync_parent(path: &Path, directory_policy: DirectoryPolicy) -> Result<(), AuditError> {
+    let parent = parent(path)?;
+    validate_directory(parent, directory_policy)?;
+    File::open(parent)
+        .and_then(|directory| directory.sync_all())
+        .map_err(AuditError::Io)
+}
+
+fn file_size_error() -> AuditError {
+    AuditError::Io(io::Error::other("audit file size bound exceeded"))
+}
+
+fn invalid_audit_data() -> AuditError {
+    AuditError::Io(io::Error::new(
+        ErrorKind::InvalidData,
+        "audit record is invalid",
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{AuditHashSecret, ChainState};
+    use serde_json::json;
+    use std::os::unix::fs::PermissionsExt;
+
+    fn fixture() -> (tempfile::TempDir, PathBuf, AuditChainHasher) {
+        let directory = tempfile::tempdir().expect("temp dir");
+        fs::set_permissions(directory.path(), fs::Permissions::from_mode(0o700))
+            .expect("restrict temp dir");
+        let path = directory.path().join("audit.jsonl");
+        let secret =
+            AuditHashSecret::new(b"0123456789abcdef0123456789abcdef".to_vec()).expect("secret");
+        (directory, path, AuditChainHasher::keyed(secret))
+    }
+
+    #[tokio::test]
+    async fn rotation_is_non_destructive_and_the_chain_crosses_segments() {
+        let (_directory, path, hasher) = fixture();
+        let sink = DurableSegmentedJsonlSink::open(&path, 700).expect("sink opens");
+        let chain = ChainState::bootstrap_or_start_empty(&sink, hasher.clone())
+            .await
+            .expect("chain starts");
+        for index in 0..12 {
+            chain
+                .append(&sink, json!({"index": index, "padding": "x".repeat(160)}))
+                .await
+                .expect("record appends");
+        }
+        drop(chain);
+        drop(sink);
+
+        let summary = verify_segmented_audit_chain(&path, &hasher).expect("chain verifies");
+        assert_eq!(summary.records, 12);
+        assert!(summary.segments > 1);
+        assert_eq!(summary.first_sequence, Some(1));
+        assert!(path.with_extension("jsonl.00000001").exists());
+    }
+
+    #[tokio::test]
+    async fn restart_continues_from_the_newest_sealed_tail() {
+        let (_directory, path, hasher) = fixture();
+        {
+            let sink = DurableSegmentedJsonlSink::open(&path, 500).expect("sink opens");
+            let chain = ChainState::bootstrap_or_start_empty(&sink, hasher.clone())
+                .await
+                .expect("chain starts");
+            for index in 0..6 {
+                chain
+                    .append(&sink, json!({"index": index, "padding": "x".repeat(160)}))
+                    .await
+                    .expect("record appends");
+            }
+        }
+        {
+            let sink = DurableSegmentedJsonlSink::open(&path, 500).expect("sink restarts");
+            let chain = ChainState::bootstrap_or_start_empty(&sink, hasher.clone())
+                .await
+                .expect("chain resumes");
+            chain
+                .append(&sink, json!({"after": "restart"}))
+                .await
+                .expect("post-restart record appends");
+        }
+        assert_eq!(
+            verify_segmented_audit_chain(&path, &hasher)
+                .expect("chain verifies")
+                .records,
+            7
+        );
+    }
+
+    #[tokio::test]
+    async fn a_gap_inside_retained_history_is_reported() {
+        let (_directory, path, hasher) = fixture();
+        {
+            let sink = DurableSegmentedJsonlSink::open(&path, 450).expect("sink opens");
+            let chain = ChainState::bootstrap_or_start_empty(&sink, hasher.clone())
+                .await
+                .expect("chain starts");
+            for index in 0..12 {
+                chain
+                    .append(&sink, json!({"index": index, "padding": "x".repeat(160)}))
+                    .await
+                    .expect("record appends");
+            }
+        }
+        let segments = sealed_segments(&path).expect("segments enumerate");
+        assert!(segments.len() >= 3);
+        fs::remove_file(&segments[1].1).expect("archive middle segment");
+        assert!(matches!(
+            verify_segmented_audit_chain(&path, &hasher),
+            Err(AuditError::SegmentMissing { .. })
+        ));
+    }
+
+    #[tokio::test]
+    async fn a_live_verifier_proves_only_sealed_history() {
+        let (_directory, path, hasher) = fixture();
+        let sink = DurableSegmentedJsonlSink::open(&path, 1_048_576).expect("sink opens");
+        let chain = ChainState::bootstrap_or_start_empty(&sink, hasher.clone())
+            .await
+            .expect("chain starts");
+        chain
+            .append(&sink, json!({"decision": "issued"}))
+            .await
+            .expect("record appends");
+
+        let summary = verify_segmented_audit_chain(&path, &hasher).expect("sealed history checks");
+        assert!(!summary.active_verified);
+        assert_eq!(summary.records, 0);
+        assert_eq!(summary.segments, 0);
+    }
+
+    #[test]
+    fn a_second_writer_is_rejected() {
+        let (_directory, path, _hasher) = fixture();
+        let first = DurableSegmentedJsonlSink::open(&path, 1_048_576).expect("first writer opens");
+        assert!(matches!(
+            DurableSegmentedJsonlSink::open(&path, 1_048_576),
+            Err(AuditError::SinkLocked { .. })
+        ));
+        drop(first);
+    }
+
+    #[tokio::test]
+    async fn an_oversized_record_is_rejected_without_poisoning_the_sink() {
+        let (_directory, path, hasher) = fixture();
+        let sink = DurableSegmentedJsonlSink::open(&path, 500).expect("sink opens");
+        let chain = ChainState::bootstrap_or_start_empty(&sink, hasher.clone())
+            .await
+            .expect("chain starts");
+        assert!(chain
+            .append(&sink, json!({"padding": "x".repeat(1000)}))
+            .await
+            .is_err());
+        assert!(sink.healthy());
+        chain
+            .append(&sink, json!({"decision": "rejected"}))
+            .await
+            .expect("a bounded record still appends");
+        drop(chain);
+        drop(sink);
+        assert_eq!(
+            verify_segmented_audit_chain(&path, &hasher)
+                .expect("chain verifies")
+                .records,
+            1
+        );
+    }
+
+    #[tokio::test]
+    async fn replacing_the_active_path_poisons_the_writer() {
+        let (_directory, path, hasher) = fixture();
+        let sink = DurableSegmentedJsonlSink::open(&path, 1_048_576).expect("sink opens");
+        let chain = ChainState::bootstrap_or_start_empty(&sink, hasher)
+            .await
+            .expect("chain starts");
+        let moved = path.with_extension("moved");
+        fs::rename(&path, moved).expect("move active file outside the writer");
+        fs::write(&path, []).expect("replace active path");
+        fs::set_permissions(&path, fs::Permissions::from_mode(0o600))
+            .expect("restrict replacement");
+
+        assert!(chain
+            .append(&sink, json!({"decision": "issued"}))
+            .await
+            .is_err());
+        assert!(!sink.healthy());
+    }
+
+    #[tokio::test]
+    async fn duplicate_json_members_are_rejected_during_verification() {
+        let (_directory, path, hasher) = fixture();
+        {
+            let sink = DurableSegmentedJsonlSink::open(&path, 1_048_576).expect("sink opens");
+            let chain = ChainState::bootstrap_or_start_empty(&sink, hasher.clone())
+                .await
+                .expect("chain starts");
+            chain
+                .append(&sink, json!({"decision": "issued"}))
+                .await
+                .expect("record appends");
+        }
+        let original = fs::read_to_string(&path).expect("audit reads");
+        let ambiguous = original.replacen("\"record\":", "\"record\":{},\"record\":", 1);
+        fs::write(&path, ambiguous).expect("duplicate member is planted");
+        assert!(verify_segmented_audit_chain(&path, &hasher).is_err());
+    }
+
+    #[tokio::test]
+    async fn replacing_the_lock_path_fails_readiness_and_poisons_the_writer() {
+        let (_directory, path, hasher) = fixture();
+        let sink = DurableSegmentedJsonlSink::open(&path, 1_048_576).expect("sink opens");
+        let chain = ChainState::bootstrap_or_start_empty(&sink, hasher)
+            .await
+            .expect("chain starts");
+        let lock = lock_path(&path);
+        fs::rename(&lock, lock.with_extension("moved")).expect("move writer lock");
+        fs::write(&lock, []).expect("replace writer lock");
+        fs::set_permissions(&lock, fs::Permissions::from_mode(0o600))
+            .expect("restrict replacement");
+
+        assert!(!sink.ready().await);
+        assert!(chain
+            .append(&sink, json!({"decision": "issued"}))
+            .await
+            .is_err());
+        assert!(!sink.healthy());
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn keyed_log_group_commit_rotates_and_the_stopped_visitor_replays_it() {
+        let (_directory, path, hasher) = fixture();
+        let log = Arc::new(
+            DurableSegmentedAuditLog::initialize(&path, 700, hasher.clone())
+                .await
+                .expect("log initializes"),
+        );
+        let mut appends = tokio::task::JoinSet::new();
+        for index in 0..64 {
+            let log = Arc::clone(&log);
+            appends.spawn(async move {
+                log.append_record(json!({"index": index, "padding": "x".repeat(120)}))
+                    .await
+            });
+        }
+        while let Some(result) = appends.join_next().await {
+            result.expect("append task joins").expect("record appends");
+        }
+        assert!(log.durable_writes() < 64, "concurrent records share writes");
+        assert_eq!(log.startup_verifications(), 1);
+        drop(log);
+
+        let mut visited = Vec::new();
+        let summary = visit_stopped_segmented_audit_chain(&path, &hasher, 128, 128, |envelope| {
+            visited.push(envelope.record["index"].as_u64().expect("index is present"));
+            Ok(())
+        })
+        .expect("stopped chain visits");
+        visited.sort_unstable();
+        assert_eq!(visited, (0..64).collect::<Vec<_>>());
+        assert_eq!(summary.records, 64);
+        assert!(summary.segments > 1);
+        assert!(summary.active_verified);
+    }
+
+    #[tokio::test]
+    async fn keyed_log_preserves_the_owner_controlled_directory_contract() {
+        let (directory, path, hasher) = fixture();
+        fs::set_permissions(directory.path(), fs::Permissions::from_mode(0o755))
+            .expect("make directory owner-controlled");
+        assert!(DurableSegmentedJsonlSink::open(&path, 1_048_576).is_err());
+        let log = DurableSegmentedAuditLog::initialize(&path, 1_048_576, hasher.clone())
+            .await
+            .expect("keyed log accepts an owner-controlled directory");
+        log.append_record(json!({"decision": "issued"}))
+            .await
+            .expect("record appends");
+        drop(log);
+
+        fs::set_permissions(directory.path(), fs::Permissions::from_mode(0o775))
+            .expect("make directory group-writable");
+        assert!(
+            DurableSegmentedAuditLog::initialize(&path, 1_048_576, hasher)
+                .await
+                .is_err()
+        );
+    }
+}
diff --git a/crates/registry-platform-cache/Cargo.toml b/crates/registry-platform-cache/Cargo.toml
deleted file mode 100644
index 386f022e8..000000000
--- a/crates/registry-platform-cache/Cargo.toml
+++ /dev/null
@@ -1,20 +0,0 @@
-[package]
-name = "registry-platform-cache"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-readme = "README.md"
-repository.workspace = true
-publish = false
-
-[lints]
-workspace = true
-
-[dependencies]
-async-trait.workspace = true
-sha2.workspace = true
-thiserror.workspace = true
-time.workspace = true
-
-[dev-dependencies]
-tokio.workspace = true
diff --git a/crates/registry-platform-cache/README.md b/crates/registry-platform-cache/README.md
deleted file mode 100644
index 564429dca..000000000
--- a/crates/registry-platform-cache/README.md
+++ /dev/null
@@ -1,31 +0,0 @@
-# registry-platform-cache
-
-Small cache-store primitives for registry services.
-
-## What It Provides
-
-- `CacheStore`, an async trait for `get`, `set`, `set_if_absent`,
-  `compare_and_set`, `delete`, and readiness checks.
-- `CacheKey`, a redacted-debug key wrapper with helpers for hashed keys derived
-  from sensitive scope material.
-- `InMemoryCacheStore` for tests and explicit local single-process mode.
-
-## Security Notes
-
-Prefer `CacheKey::from_hashed_parts` when a key is derived from subject ids,
-issuer ids, nonces, JWT ids, or tenant identifiers. `Debug` output redacts cache
-key values, but backend keys are still visible to operators of the backing store.
-
-This crate is mechanism only. Security contracts such as replay rejection should
-live in narrower crates, for example `registry-platform-replay`, so callers do
-not accidentally use plain `set` where `set_if_absent` is required.
-
-## Testing
-
-```sh
-cargo test -p registry-platform-cache
-```
-
-## License
-
-Apache-2.0.
diff --git a/crates/registry-platform-cache/src/lib.rs b/crates/registry-platform-cache/src/lib.rs
deleted file mode 100644
index 0fb88e360..000000000
--- a/crates/registry-platform-cache/src/lib.rs
+++ /dev/null
@@ -1,574 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Generic cache-store primitives for registry services.
-
-use std::{
-    collections::HashMap,
-    error::Error as StdError,
-    fmt,
-    sync::{Arc, Mutex},
-};
-
-use async_trait::async_trait;
-use sha2::{Digest, Sha256};
-use thiserror::Error;
-use time::OffsetDateTime;
-
-#[derive(Clone, PartialEq, Eq, Hash)]
-pub struct CacheKey {
-    value: Arc<str>,
-}
-
-impl CacheKey {
-    pub fn new(value: impl Into<String>) -> Result<Self, CacheKeyError> {
-        let value = value.into();
-        validate_key_segment("key", &value)?;
-        Ok(Self {
-            value: Arc::from(value.into_boxed_str()),
-        })
-    }
-
-    pub fn from_hashed_parts<I, K, V>(
-        prefix: &str,
-        purpose: &str,
-        parts: I,
-    ) -> Result<Self, CacheKeyError>
-    where
-        I: IntoIterator<Item = (K, V)>,
-        K: AsRef<str>,
-        V: AsRef<str>,
-    {
-        validate_key_segment("prefix", prefix)?;
-        validate_key_segment("purpose", purpose)?;
-
-        let mut hasher = Sha256::new();
-        hasher.update(purpose.as_bytes());
-        hasher.update([0]);
-        let mut seen_part = false;
-        for (name, value) in parts {
-            let name = name.as_ref();
-            let value = value.as_ref();
-            validate_hash_part("part name", name)?;
-            validate_hash_part("part value", value)?;
-            seen_part = true;
-            hasher.update((name.len() as u64).to_be_bytes());
-            hasher.update(name.as_bytes());
-            hasher.update((value.len() as u64).to_be_bytes());
-            hasher.update(value.as_bytes());
-        }
-        if !seen_part {
-            return Err(CacheKeyError::EmptyParts);
-        }
-
-        Self::new(format!(
-            "{prefix}:{purpose}:{}",
-            hex_lower(hasher.finalize())
-        ))
-    }
-
-    #[must_use]
-    pub fn as_str(&self) -> &str {
-        &self.value
-    }
-}
-
-impl fmt::Debug for CacheKey {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("CacheKey")
-            .field("len", &self.value.len())
-            .finish()
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum CacheSetOutcome {
-    Stored,
-    AlreadyExists,
-}
-
-/// Result of updating a live cache record only when its bytes match exactly.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum CacheCompareAndSetOutcome {
-    /// The current value matched `expected` and the new value was stored.
-    Stored,
-    /// The key exists and has not expired, but its bytes did not match.
-    Mismatch,
-    /// The key was absent or the stored record had expired.
-    Missing,
-}
-
-#[async_trait]
-pub trait CacheStore: Send + Sync {
-    async fn get(&self, key: &CacheKey) -> Result<Option<Vec<u8>>, CacheStoreError>;
-
-    async fn set(
-        &self,
-        key: &CacheKey,
-        value: &[u8],
-        expires_at: OffsetDateTime,
-    ) -> Result<(), CacheStoreError>;
-
-    async fn set_if_absent(
-        &self,
-        key: &CacheKey,
-        value: &[u8],
-        expires_at: OffsetDateTime,
-    ) -> Result<CacheSetOutcome, CacheStoreError>;
-
-    async fn compare_and_set(
-        &self,
-        key: &CacheKey,
-        expected: &[u8],
-        value: &[u8],
-        expires_at: OffsetDateTime,
-    ) -> Result<CacheCompareAndSetOutcome, CacheStoreError>;
-
-    async fn delete(&self, key: &CacheKey) -> Result<bool, CacheStoreError>;
-
-    async fn check_ready(&self) -> Result<(), CacheStoreError>;
-}
-
-#[derive(Debug, Clone)]
-pub struct InMemoryCacheStore {
-    records: Arc<Mutex<HashMap<CacheKey, CacheRecord>>>,
-    max_entries: Option<usize>,
-}
-
-impl InMemoryCacheStore {
-    #[must_use]
-    pub fn new() -> Self {
-        Self {
-            records: Arc::new(Mutex::new(HashMap::new())),
-            max_entries: None,
-        }
-    }
-
-    #[must_use]
-    pub fn with_max_entries(max_entries: usize) -> Self {
-        Self {
-            records: Arc::new(Mutex::new(HashMap::new())),
-            max_entries: Some(max_entries),
-        }
-    }
-
-    #[must_use]
-    pub fn len(&self) -> usize {
-        self.records
-            .lock()
-            .expect("in-memory cache store lock is healthy")
-            .len()
-    }
-
-    #[must_use]
-    pub fn is_empty(&self) -> bool {
-        self.len() == 0
-    }
-
-    pub fn purge_expired(&self, now: OffsetDateTime) -> usize {
-        let mut records = self
-            .records
-            .lock()
-            .expect("in-memory cache store lock is healthy");
-        purge_expired_locked(&mut records, now)
-    }
-
-    fn check_expiry(expires_at: OffsetDateTime) -> Result<(), CacheStoreError> {
-        if expires_at <= OffsetDateTime::now_utc() {
-            return Err(CacheStoreError::ExpiredRecord { expires_at });
-        }
-        Ok(())
-    }
-
-    fn ensure_capacity(
-        &self,
-        records: &mut HashMap<CacheKey, CacheRecord>,
-        key: &CacheKey,
-    ) -> Result<(), CacheStoreError> {
-        if records.contains_key(key) {
-            return Ok(());
-        }
-        if let Some(max_entries) = self.max_entries {
-            if records.len() >= max_entries {
-                purge_expired_locked(records, OffsetDateTime::now_utc());
-                if records.len() >= max_entries {
-                    return Err(CacheStoreError::Operation {
-                        message: "in-memory cache store is full".to_string(),
-                    });
-                }
-            }
-        }
-        Ok(())
-    }
-}
-
-impl Default for InMemoryCacheStore {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-#[async_trait]
-impl CacheStore for InMemoryCacheStore {
-    async fn get(&self, key: &CacheKey) -> Result<Option<Vec<u8>>, CacheStoreError> {
-        let now = OffsetDateTime::now_utc();
-        let mut records = self
-            .records
-            .lock()
-            .expect("in-memory cache store lock is healthy");
-        if let Some(record) = records.get(key) {
-            if record.expires_at > now {
-                return Ok(Some(record.value.clone()));
-            }
-            records.remove(key);
-        }
-        Ok(None)
-    }
-
-    async fn set(
-        &self,
-        key: &CacheKey,
-        value: &[u8],
-        expires_at: OffsetDateTime,
-    ) -> Result<(), CacheStoreError> {
-        Self::check_expiry(expires_at)?;
-        let now = OffsetDateTime::now_utc();
-        let mut records = self
-            .records
-            .lock()
-            .expect("in-memory cache store lock is healthy");
-        if let Some(record) = records.get(key) {
-            if record.expires_at <= now {
-                records.remove(key);
-            }
-        }
-        self.ensure_capacity(&mut records, key)?;
-        records.insert(
-            key.clone(),
-            CacheRecord {
-                value: value.to_vec(),
-                expires_at,
-            },
-        );
-        Ok(())
-    }
-
-    async fn set_if_absent(
-        &self,
-        key: &CacheKey,
-        value: &[u8],
-        expires_at: OffsetDateTime,
-    ) -> Result<CacheSetOutcome, CacheStoreError> {
-        Self::check_expiry(expires_at)?;
-        let now = OffsetDateTime::now_utc();
-        let mut records = self
-            .records
-            .lock()
-            .expect("in-memory cache store lock is healthy");
-        if let Some(record) = records.get(key) {
-            if record.expires_at > now {
-                return Ok(CacheSetOutcome::AlreadyExists);
-            }
-            records.remove(key);
-        }
-        self.ensure_capacity(&mut records, key)?;
-        records.insert(
-            key.clone(),
-            CacheRecord {
-                value: value.to_vec(),
-                expires_at,
-            },
-        );
-        Ok(CacheSetOutcome::Stored)
-    }
-
-    async fn compare_and_set(
-        &self,
-        key: &CacheKey,
-        expected: &[u8],
-        value: &[u8],
-        expires_at: OffsetDateTime,
-    ) -> Result<CacheCompareAndSetOutcome, CacheStoreError> {
-        Self::check_expiry(expires_at)?;
-        let now = OffsetDateTime::now_utc();
-        let mut records = self
-            .records
-            .lock()
-            .expect("in-memory cache store lock is healthy");
-        let Some(record) = records.get_mut(key) else {
-            return Ok(CacheCompareAndSetOutcome::Missing);
-        };
-        if record.expires_at <= now {
-            records.remove(key);
-            return Ok(CacheCompareAndSetOutcome::Missing);
-        }
-        if record.value != expected {
-            return Ok(CacheCompareAndSetOutcome::Mismatch);
-        }
-        record.value = value.to_vec();
-        record.expires_at = expires_at;
-        Ok(CacheCompareAndSetOutcome::Stored)
-    }
-
-    async fn delete(&self, key: &CacheKey) -> Result<bool, CacheStoreError> {
-        let now = OffsetDateTime::now_utc();
-        let mut records = self
-            .records
-            .lock()
-            .expect("in-memory cache store lock is healthy");
-        let Some(record) = records.get(key) else {
-            return Ok(false);
-        };
-        if record.expires_at <= now {
-            records.remove(key);
-            return Ok(false);
-        }
-        records.remove(key);
-        Ok(true)
-    }
-
-    async fn check_ready(&self) -> Result<(), CacheStoreError> {
-        Ok(())
-    }
-}
-
-#[derive(Debug, Clone)]
-struct CacheRecord {
-    value: Vec<u8>,
-    expires_at: OffsetDateTime,
-}
-
-fn purge_expired_locked(
-    records: &mut HashMap<CacheKey, CacheRecord>,
-    now: OffsetDateTime,
-) -> usize {
-    let before = records.len();
-    records.retain(|_, record| record.expires_at > now);
-    before - records.len()
-}
-
-#[derive(Debug, Error)]
-#[non_exhaustive]
-pub enum CacheKeyError {
-    #[error("cache {field} must not be empty")]
-    EmptyValue { field: &'static str },
-    #[error("cache {field} must not contain ASCII control characters")]
-    ControlCharacter { field: &'static str },
-    #[error("cache key hash input must contain at least one part")]
-    EmptyParts,
-}
-
-#[derive(Debug, Error)]
-#[non_exhaustive]
-pub enum CacheStoreError {
-    #[error("cache record expiry must be in the future")]
-    ExpiredRecord { expires_at: OffsetDateTime },
-    #[error("cache store is unavailable: {source}")]
-    Unavailable {
-        #[source]
-        source: Box<dyn StdError + Send + Sync>,
-    },
-    #[error("cache store operation failed: {message}")]
-    Operation { message: String },
-}
-
-fn validate_key_segment(field: &'static str, value: &str) -> Result<(), CacheKeyError> {
-    validate_hash_part(field, value)?;
-    if value.contains([' ', '\t', '\n', '\r']) {
-        return Err(CacheKeyError::ControlCharacter { field });
-    }
-    Ok(())
-}
-
-fn validate_hash_part(field: &'static str, value: &str) -> Result<(), CacheKeyError> {
-    if value.is_empty() {
-        return Err(CacheKeyError::EmptyValue { field });
-    }
-    if value.chars().any(|ch| ch.is_ascii_control()) {
-        return Err(CacheKeyError::ControlCharacter { field });
-    }
-    Ok(())
-}
-
-fn hex_lower(bytes: impl AsRef<[u8]>) -> String {
-    const HEX: &[u8; 16] = b"0123456789abcdef";
-    let bytes = bytes.as_ref();
-    let mut out = String::with_capacity(bytes.len() * 2);
-    for byte in bytes {
-        out.push(HEX[(byte >> 4) as usize] as char);
-        out.push(HEX[(byte & 0x0f) as usize] as char);
-    }
-    out
-}
-
-#[cfg(test)]
-mod tests {
-    use std::time::Duration;
-
-    use super::*;
-
-    fn future() -> OffsetDateTime {
-        OffsetDateTime::now_utc() + Duration::from_secs(60)
-    }
-
-    #[tokio::test]
-    async fn in_memory_cache_get_set_delete_round_trip() {
-        let store = InMemoryCacheStore::new();
-        let key = CacheKey::new("test:key").expect("key is valid");
-
-        assert_eq!(store.get(&key).await.expect("get succeeds"), None);
-        store
-            .set(&key, b"value", future())
-            .await
-            .expect("set succeeds");
-        assert_eq!(
-            store.get(&key).await.expect("get succeeds"),
-            Some(b"value".to_vec())
-        );
-        assert!(store.delete(&key).await.expect("delete succeeds"));
-        assert_eq!(store.get(&key).await.expect("get succeeds"), None);
-    }
-
-    #[tokio::test]
-    async fn in_memory_cache_delete_treats_expired_records_as_missing() {
-        let store = InMemoryCacheStore::new();
-        let key = CacheKey::new("test:expired-delete").expect("key is valid");
-
-        store.records.lock().unwrap().insert(
-            key.clone(),
-            CacheRecord {
-                value: b"old".to_vec(),
-                expires_at: OffsetDateTime::UNIX_EPOCH,
-            },
-        );
-
-        assert!(!store.delete(&key).await.expect("delete succeeds"));
-        assert_eq!(store.get(&key).await.expect("get succeeds"), None);
-    }
-
-    #[tokio::test]
-    async fn in_memory_set_if_absent_is_atomic_under_lock() {
-        let store = InMemoryCacheStore::new();
-        let key = CacheKey::new("test:key").expect("key is valid");
-
-        assert_eq!(
-            store
-                .set_if_absent(&key, b"one", future())
-                .await
-                .expect("first set succeeds"),
-            CacheSetOutcome::Stored
-        );
-        assert_eq!(
-            store
-                .set_if_absent(&key, b"two", future())
-                .await
-                .expect("second set succeeds"),
-            CacheSetOutcome::AlreadyExists
-        );
-        assert_eq!(
-            store.get(&key).await.expect("get succeeds"),
-            Some(b"one".to_vec())
-        );
-    }
-
-    #[tokio::test]
-    async fn in_memory_compare_and_set_distinguishes_outcomes() {
-        let store = InMemoryCacheStore::new();
-        let key = CacheKey::new("test:key").expect("key is valid");
-
-        assert_eq!(
-            store
-                .compare_and_set(&key, b"one", b"two", future())
-                .await
-                .expect("missing compare succeeds"),
-            CacheCompareAndSetOutcome::Missing
-        );
-
-        store
-            .set(&key, b"one", future())
-            .await
-            .expect("set succeeds");
-        assert_eq!(
-            store
-                .compare_and_set(&key, b"wrong", b"two", future())
-                .await
-                .expect("mismatch compare succeeds"),
-            CacheCompareAndSetOutcome::Mismatch
-        );
-        assert_eq!(
-            store.get(&key).await.expect("get succeeds"),
-            Some(b"one".to_vec())
-        );
-        assert_eq!(
-            store
-                .compare_and_set(&key, b"one", b"two", future())
-                .await
-                .expect("matching compare succeeds"),
-            CacheCompareAndSetOutcome::Stored
-        );
-        assert_eq!(
-            store.get(&key).await.expect("get succeeds"),
-            Some(b"two".to_vec())
-        );
-
-        let expired_key = CacheKey::new("test:expired").expect("key is valid");
-        store.records.lock().unwrap().insert(
-            expired_key.clone(),
-            CacheRecord {
-                value: b"old".to_vec(),
-                expires_at: OffsetDateTime::UNIX_EPOCH,
-            },
-        );
-        assert_eq!(
-            store
-                .compare_and_set(&expired_key, b"old", b"new", future())
-                .await
-                .expect("expired compare succeeds"),
-            CacheCompareAndSetOutcome::Missing
-        );
-        assert_eq!(store.get(&expired_key).await.expect("get succeeds"), None);
-    }
-
-    #[tokio::test]
-    async fn in_memory_cache_enforces_optional_capacity() {
-        let store = InMemoryCacheStore::with_max_entries(1);
-        let first = CacheKey::new("test:first").expect("key is valid");
-        let second = CacheKey::new("test:second").expect("key is valid");
-
-        store
-            .set(&first, b"one", future())
-            .await
-            .expect("first set succeeds");
-        let err = store
-            .set(&second, b"two", future())
-            .await
-            .expect_err("over capacity fails");
-        assert!(err.to_string().contains("in-memory cache store is full"));
-    }
-
-    #[test]
-    fn hashed_key_omits_sensitive_parts() {
-        let key = CacheKey::from_hashed_parts(
-            "registry-notary",
-            "one-time",
-            [
-                ("tenant", "tenant-secret"),
-                ("issuer", "https://issuer.example"),
-                ("jti", "jti-sensitive"),
-            ],
-        )
-        .expect("key hashes");
-
-        assert!(key.as_str().starts_with("registry-notary:one-time:"));
-        assert!(!key.as_str().contains("tenant-secret"));
-        assert!(!key.as_str().contains("issuer.example"));
-        assert!(!key.as_str().contains("jti-sensitive"));
-    }
-
-    #[test]
-    fn debug_output_redacts_key_value() {
-        let key = CacheKey::new("secret:key:material").expect("key is valid");
-        let debug = format!("{key:?}");
-
-        assert!(!debug.contains("secret:key:material"));
-        assert!(debug.contains("len"));
-    }
-}
diff --git a/crates/registry-platform-config/src/config_bundle.rs b/crates/registry-platform-config/src/config_bundle.rs
index fc02f8444..dde7f8574 100644
--- a/crates/registry-platform-config/src/config_bundle.rs
+++ b/crates/registry-platform-config/src/config_bundle.rs
@@ -46,6 +46,10 @@ pub enum ProductTrustDomainV1 {
     Development,
 }
 
+/// Registry Notary is retired and no maintained runtime signs its lane, but the
+/// variant stays parseable so a bundle issued before the retirement still
+/// decodes. A reader then reports that the lane belongs to a retired product
+/// instead of failing on an unknown variant it cannot explain.
 #[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
 pub enum ProductAcceptanceLaneV1 {
     #[serde(rename = "relay-public")]
@@ -56,6 +60,9 @@ pub enum ProductAcceptanceLaneV1 {
     Notary,
 }
 
+/// `RegistryNotary` is retained for the same reason as
+/// [`ProductAcceptanceLaneV1::Notary`]: it names a retired product in documents
+/// that already exist, not a product a maintained runtime can still emit.
 #[derive(Debug, Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
 pub enum ProductAcceptanceProductV1 {
     #[serde(rename = "registry-relay")]
diff --git a/crates/registry-platform-oid4vci/Cargo.toml b/crates/registry-platform-oid4vci/Cargo.toml
deleted file mode 100644
index ac8ad3134..000000000
--- a/crates/registry-platform-oid4vci/Cargo.toml
+++ /dev/null
@@ -1,24 +0,0 @@
-[package]
-name = "registry-platform-oid4vci"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-readme = "README.md"
-repository.workspace = true
-publish = false
-
-[lints]
-workspace = true
-
-[dependencies]
-base64.workspace = true
-registry-platform-crypto = { workspace = true }
-registry-platform-replay = { workspace = true }
-serde.workspace = true
-serde_json.workspace = true
-thiserror.workspace = true
-time.workspace = true
-
-[dev-dependencies]
-serde_urlencoded = "0.7"
-tokio.workspace = true
diff --git a/crates/registry-platform-oid4vci/README.md b/crates/registry-platform-oid4vci/README.md
deleted file mode 100644
index c02642db9..000000000
--- a/crates/registry-platform-oid4vci/README.md
+++ /dev/null
@@ -1,53 +0,0 @@
-# registry-platform-oid4vci
-
-OID4VCI protocol constants, metadata types, offer and token wire types, and
-holder-proof validation helpers for Registry Stack issuers.
-
-## What it provides
-
-- `CredentialIssuerMetadata` and `CredentialConfigurationMetadata` for issuer
-  discovery.
-- `CredentialConfigurationMetadata::sd_jwt_vc()` for `dc+sd-jwt` metadata.
-- `CredentialOffer::pre_authorized_code()` and the pre-authorized token request
-  wire types.
-- `validate_proof_jwt` for validating structure, `typ`, signature, audience,
-  nonce, and time bounds.
-- `ProofValidationPolicy::credential_endpoint` for configuring proof checks.
-- `consume_validated_proof_nonce_once` for binding a validated proof to a
-  required replay-store consume operation.
-- Credential and protocol error response types.
-
-The crate supplies protocol primitives. Registry Notary defines the public 1.0
-profile: registry-backed issuer-initiated pre-authorized code, `dc+sd-jwt`,
-EdDSA or ES256 issuer signing, and EdDSA `did:jwk` holder proof. It has no public
-nonce route and returns no next nonce from the credential endpoint.
-
-## Specification reference
-
-- [OpenID for Verifiable Credential Issuance](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html)
-- Proof JWT type: `openid4vci-proof+jwt`
-- Wallet grant:
-  `urn:ietf:params:oauth:grant-type:pre-authorized_code`
-- Credential format: `dc+sd-jwt`
-
-## Security notes
-
-- Proof nonce consumption is a caller responsibility. `validate_proof_jwt`
-  checks the expected nonce but does not mutate replay state. Call
-  `consume_validated_proof_nonce_once` with a correctness-state replay store.
-- Registry Notary accepts only EdDSA proof JWTs with `did:jwk` holder binding.
-  ES256 holder keys and `jku`, `x5u`, `x5c`, or `crit` headers are rejected.
-- Proof audience is validated before issuer or holder key use.
-- A transaction code is required by default. If a caller deliberately builds a
-  bearer offer without one, its lifetime must be no more than 300 seconds and
-  redemption must remain single-use and rate limited.
-
-## Testing
-
-```sh
-cargo test --locked -p registry-platform-oid4vci
-```
-
-## License
-
-Apache-2.0.
diff --git a/crates/registry-platform-oid4vci/src/lib.rs b/crates/registry-platform-oid4vci/src/lib.rs
deleted file mode 100644
index 43139907a..000000000
--- a/crates/registry-platform-oid4vci/src/lib.rs
+++ /dev/null
@@ -1,1974 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! OpenID4VCI facade helpers shared by Registry Platform consumers.
-
-use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-use base64::Engine;
-use registry_platform_crypto::{did_jwk_from_public_jwk, parse_did_jwk, verify, PublicJwk};
-use registry_platform_replay::{
-    require_consume_once, ConsumableNonceStore, ReplayKey, ReplayScope,
-};
-use serde::{de, ser::SerializeStruct, Deserialize, Serialize};
-use serde_json::Value;
-use std::collections::BTreeMap;
-use std::fmt;
-use std::time::Duration;
-use thiserror::Error;
-
-pub const PROOF_JWT_TYPE: &str = "openid4vci-proof+jwt";
-pub const PROOF_TYPE_JWT: &str = "jwt";
-pub const SD_JWT_VC_FORMAT: &str = "dc+sd-jwt";
-pub const CREDENTIAL_SIGNING_ALG_EDDSA: &str = "EdDSA";
-pub const CRYPTOGRAPHIC_BINDING_METHOD_DID_JWK: &str = "did:jwk";
-pub const AUTHORIZATION_CODE_GRANT_TYPE: &str = "authorization_code";
-pub const PRE_AUTHORIZED_CODE_GRANT_TYPE: &str =
-    "urn:ietf:params:oauth:grant-type:pre-authorized_code";
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct CredentialIssuerMetadata {
-    pub credential_issuer: String,
-    pub credential_endpoint: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub token_endpoint: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub nonce_endpoint: Option<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub authorization_servers: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub display: Vec<DisplayMetadata>,
-    pub credential_configurations_supported: BTreeMap<String, CredentialConfigurationMetadata>,
-}
-
-impl CredentialIssuerMetadata {
-    pub fn new(
-        credential_issuer: impl Into<String>,
-        credential_endpoint: impl Into<String>,
-        nonce_endpoint: Option<String>,
-        authorization_servers: Vec<String>,
-        credential_configurations_supported: BTreeMap<String, CredentialConfigurationMetadata>,
-    ) -> Self {
-        Self {
-            credential_issuer: credential_issuer.into(),
-            credential_endpoint: credential_endpoint.into(),
-            token_endpoint: None,
-            nonce_endpoint,
-            authorization_servers,
-            display: Vec::new(),
-            credential_configurations_supported,
-        }
-    }
-
-    #[must_use]
-    pub fn with_token_endpoint(mut self, token_endpoint: impl Into<String>) -> Self {
-        self.token_endpoint = Some(token_endpoint.into());
-        self
-    }
-
-    #[must_use]
-    pub fn with_display(mut self, display: Vec<DisplayMetadata>) -> Self {
-        self.display = display;
-        self
-    }
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct CredentialConfigurationMetadata {
-    pub format: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub scope: Option<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub cryptographic_binding_methods_supported: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub credential_signing_alg_values_supported: Vec<String>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub proof_types_supported: BTreeMap<String, ProofTypeMetadata>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub display: Vec<DisplayMetadata>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub vct: Option<String>,
-}
-
-impl CredentialConfigurationMetadata {
-    pub fn sd_jwt_vc(
-        scope: impl Into<String>,
-        cryptographic_binding_methods_supported: Vec<String>,
-        display_name: impl Into<String>,
-        vct: impl Into<String>,
-    ) -> Self {
-        Self::sd_jwt_vc_with_algs(
-            scope,
-            cryptographic_binding_methods_supported,
-            vec![CREDENTIAL_SIGNING_ALG_EDDSA.to_string()],
-            vec![CREDENTIAL_SIGNING_ALG_EDDSA.to_string()],
-            display_name,
-            vct,
-        )
-    }
-
-    pub fn sd_jwt_vc_with_algs(
-        scope: impl Into<String>,
-        cryptographic_binding_methods_supported: Vec<String>,
-        credential_signing_alg_values_supported: Vec<String>,
-        proof_signing_alg_values_supported: Vec<String>,
-        display_name: impl Into<String>,
-        vct: impl Into<String>,
-    ) -> Self {
-        let proof_types_supported = if proof_signing_alg_values_supported.is_empty() {
-            BTreeMap::new()
-        } else {
-            BTreeMap::from([(
-                PROOF_TYPE_JWT.to_string(),
-                ProofTypeMetadata {
-                    proof_signing_alg_values_supported,
-                },
-            )])
-        };
-        Self {
-            format: SD_JWT_VC_FORMAT.to_string(),
-            scope: Some(scope.into()),
-            cryptographic_binding_methods_supported,
-            credential_signing_alg_values_supported,
-            proof_types_supported,
-            display: vec![DisplayMetadata::new(display_name)],
-            vct: Some(vct.into()),
-        }
-    }
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct DisplayMetadata {
-    pub name: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub locale: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub logo: Option<DisplayImageMetadata>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub background_color: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub text_color: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub background_image: Option<DisplayImageMetadata>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub secondary_image: Option<DisplayImageMetadata>,
-}
-
-impl DisplayMetadata {
-    pub fn new(name: impl Into<String>) -> Self {
-        Self {
-            name: name.into(),
-            locale: None,
-            logo: None,
-            description: None,
-            background_color: None,
-            text_color: None,
-            background_image: None,
-            secondary_image: None,
-        }
-    }
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct DisplayImageMetadata {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub uri: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub url: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub alt_text: Option<String>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct ProofTypeMetadata {
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub proof_signing_alg_values_supported: Vec<String>,
-}
-
-/// Expected character set of a transaction code, per OID4VCI: `numeric` (digits
-/// only, the default) or `text` (any characters).
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum TxCodeInputMode {
-    #[default]
-    Numeric,
-    Text,
-}
-
-/// Transaction code parameters carried inside a pre-authorized-code grant.
-///
-/// See the OID4VCI pre-authorized code flow: `input_mode` is the expected
-/// character set (`numeric` by default), `length` is the number of characters,
-/// and `description` is optional guidance shown to the holder.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct TxCode {
-    #[serde(default)]
-    pub input_mode: TxCodeInputMode,
-    pub length: u64,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-}
-
-impl TxCode {
-    pub fn new(length: u64, description: Option<String>) -> Self {
-        Self {
-            input_mode: TxCodeInputMode::Numeric,
-            length,
-            description,
-        }
-    }
-}
-
-#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct CredentialOffer {
-    pub credential_issuer: String,
-    pub credential_configuration_ids: Vec<String>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub grants: BTreeMap<String, Value>,
-}
-
-impl fmt::Debug for CredentialOffer {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("CredentialOffer")
-            .field("credential_issuer", &self.credential_issuer)
-            .field(
-                "credential_configuration_ids",
-                &self.credential_configuration_ids,
-            )
-            .field("grants", &Redacted)
-            .finish()
-    }
-}
-
-impl CredentialOffer {
-    pub fn authorization_code(
-        credential_issuer: impl Into<String>,
-        credential_configuration_ids: Vec<String>,
-        issuer_state: impl Into<String>,
-        authorization_server: Option<String>,
-    ) -> Self {
-        let issuer_state = issuer_state.into();
-        let mut grant = serde_json::Map::new();
-        grant.insert("issuer_state".to_string(), Value::String(issuer_state));
-        if let Some(authorization_server) = authorization_server {
-            grant.insert(
-                "authorization_server".to_string(),
-                Value::String(authorization_server),
-            );
-        }
-        Self {
-            credential_issuer: credential_issuer.into(),
-            credential_configuration_ids,
-            grants: BTreeMap::from([(
-                AUTHORIZATION_CODE_GRANT_TYPE.to_string(),
-                Value::Object(grant),
-            )]),
-        }
-    }
-
-    pub fn pre_authorized_code(
-        credential_issuer: impl Into<String>,
-        credential_configuration_ids: Vec<String>,
-        pre_authorized_code: impl Into<String>,
-        tx_code: Option<TxCode>,
-    ) -> Self {
-        let mut grant = serde_json::Map::new();
-        grant.insert(
-            "pre-authorized_code".to_string(),
-            Value::String(pre_authorized_code.into()),
-        );
-        if let Some(tx_code) = tx_code {
-            grant.insert(
-                "tx_code".to_string(),
-                serde_json::to_value(tx_code).expect("tx_code serializes"),
-            );
-        }
-        Self {
-            credential_issuer: credential_issuer.into(),
-            credential_configuration_ids,
-            grants: BTreeMap::from([(
-                PRE_AUTHORIZED_CODE_GRANT_TYPE.to_string(),
-                Value::Object(grant),
-            )]),
-        }
-    }
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct NonceRequest {
-    #[serde(default)]
-    pub credential_configuration_id: Option<String>,
-}
-
-#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct NonceResponse {
-    pub c_nonce: String,
-    pub c_nonce_expires_in: u64,
-}
-
-impl fmt::Debug for NonceResponse {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("NonceResponse")
-            .field("c_nonce", &Redacted)
-            .field("c_nonce_expires_in", &self.c_nonce_expires_in)
-            .finish()
-    }
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub struct CredentialRequest {
-    pub format: String,
-    pub credential_identifier: Option<String>,
-    pub credential_configuration_id: Option<String>,
-    pub vct: Option<String>,
-    pub proof: CredentialRequestProof,
-    pub proofs: CredentialRequestProofs,
-}
-
-fn default_credential_request_format() -> String {
-    SD_JWT_VC_FORMAT.to_string()
-}
-
-impl CredentialRequest {
-    pub fn proof_jwts(&self) -> &[String] {
-        if self.proofs.is_empty() {
-            std::slice::from_ref(&self.proof.jwt)
-        } else {
-            &self.proofs.jwt
-        }
-    }
-}
-
-impl Serialize for CredentialRequest {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: serde::Serializer,
-    {
-        let mut state = serializer.serialize_struct("CredentialRequest", 5)?;
-        state.serialize_field("format", &self.format)?;
-        state.serialize_field("credential_identifier", &self.credential_identifier)?;
-        state.serialize_field(
-            "credential_configuration_id",
-            &self.credential_configuration_id,
-        )?;
-        state.serialize_field("vct", &self.vct)?;
-        if self.proofs.is_empty() {
-            state.serialize_field("proof", &self.proof)?;
-        } else {
-            state.serialize_field("proofs", &self.proofs)?;
-        }
-        state.end()
-    }
-}
-
-impl<'de> Deserialize<'de> for CredentialRequest {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: serde::Deserializer<'de>,
-    {
-        #[derive(Deserialize)]
-        struct WireCredentialRequest {
-            #[serde(default = "default_credential_request_format")]
-            format: String,
-            #[serde(default)]
-            credential_identifier: Option<String>,
-            #[serde(default)]
-            credential_configuration_id: Option<String>,
-            #[serde(default)]
-            vct: Option<String>,
-            #[serde(default)]
-            proof: Option<CredentialRequestProof>,
-            #[serde(default)]
-            proofs: CredentialRequestProofs,
-        }
-
-        let wire = WireCredentialRequest::deserialize(deserializer)?;
-        if wire.proof.is_some() && !wire.proofs.is_empty() {
-            return Err(de::Error::custom(
-                "credential request must not contain both proof and proofs",
-            ));
-        }
-        let proof = match wire.proof {
-            Some(proof) => proof,
-            None => wire
-                .proofs
-                .jwt
-                .first()
-                .map(|jwt| CredentialRequestProof {
-                    proof_type: PROOF_TYPE_JWT.to_string(),
-                    jwt: jwt.clone(),
-                })
-                .ok_or_else(|| de::Error::missing_field("proof"))?,
-        };
-
-        Ok(Self {
-            format: wire.format,
-            credential_identifier: wire.credential_identifier,
-            credential_configuration_id: wire.credential_configuration_id,
-            vct: wire.vct,
-            proof,
-            proofs: wire.proofs,
-        })
-    }
-}
-
-#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct CredentialRequestProof {
-    #[serde(rename = "proof_type")]
-    pub proof_type: String,
-    pub jwt: String,
-}
-
-impl fmt::Debug for CredentialRequestProof {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("CredentialRequestProof")
-            .field("proof_type", &self.proof_type)
-            .field("jwt", &Redacted)
-            .finish()
-    }
-}
-
-#[derive(Clone, PartialEq, Eq, Serialize, Deserialize, Default)]
-pub struct CredentialRequestProofs {
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub jwt: Vec<String>,
-}
-
-impl CredentialRequestProofs {
-    fn is_empty(&self) -> bool {
-        self.jwt.is_empty()
-    }
-}
-
-impl fmt::Debug for CredentialRequestProofs {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("CredentialRequestProofs")
-            .field(
-                "jwt",
-                &self.jwt.iter().map(|_| Redacted).collect::<Vec<_>>(),
-            )
-            .finish()
-    }
-}
-
-#[derive(Clone, PartialEq, Eq, Serialize)]
-pub struct CredentialResponse {
-    pub credential: CredentialValue,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub credentials: Vec<CredentialResponseCredential>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub format: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub c_nonce: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub c_nonce_expires_in: Option<u64>,
-}
-
-impl<'de> Deserialize<'de> for CredentialResponse {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: serde::Deserializer<'de>,
-    {
-        #[derive(Deserialize)]
-        struct WireCredentialResponse {
-            #[serde(default)]
-            credential: Option<CredentialValue>,
-            #[serde(default)]
-            credentials: Vec<CredentialResponseCredential>,
-            #[serde(default)]
-            format: Option<String>,
-            #[serde(default)]
-            c_nonce: Option<String>,
-            #[serde(default)]
-            c_nonce_expires_in: Option<u64>,
-        }
-
-        let wire = WireCredentialResponse::deserialize(deserializer)?;
-        let credential = match wire.credential {
-            Some(credential) => credential,
-            None => wire
-                .credentials
-                .first()
-                .map(|entry| entry.credential.clone())
-                .ok_or_else(|| de::Error::missing_field("credential"))?,
-        };
-
-        Ok(Self {
-            credential,
-            credentials: wire.credentials,
-            format: wire.format,
-            c_nonce: wire.c_nonce,
-            c_nonce_expires_in: wire.c_nonce_expires_in,
-        })
-    }
-}
-
-impl fmt::Debug for CredentialResponse {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("CredentialResponse")
-            .field("credential", &Redacted)
-            .field(
-                "credentials",
-                &self
-                    .credentials
-                    .iter()
-                    .map(|_| Redacted)
-                    .collect::<Vec<_>>(),
-            )
-            .field("format", &self.format)
-            .field("c_nonce", &self.c_nonce.as_ref().map(|_| Redacted))
-            .field("c_nonce_expires_in", &self.c_nonce_expires_in)
-            .finish()
-    }
-}
-
-#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(untagged)]
-pub enum CredentialValue {
-    String(String),
-    Object(Value),
-}
-
-impl From<String> for CredentialValue {
-    fn from(value: String) -> Self {
-        Self::String(value)
-    }
-}
-
-impl From<&str> for CredentialValue {
-    fn from(value: &str) -> Self {
-        Self::String(value.to_string())
-    }
-}
-
-impl fmt::Debug for CredentialValue {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        Redacted.fmt(f)
-    }
-}
-
-#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct CredentialResponseCredential {
-    pub credential: CredentialValue,
-}
-
-impl fmt::Debug for CredentialResponseCredential {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("CredentialResponseCredential")
-            .field("credential", &Redacted)
-            .finish()
-    }
-}
-
-#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct TokenRequest {
-    pub grant_type: String,
-    #[serde(
-        rename = "pre-authorized_code",
-        default,
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub pre_authorized_code: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub tx_code: Option<String>,
-}
-
-impl fmt::Debug for TokenRequest {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("TokenRequest")
-            .field("grant_type", &self.grant_type)
-            .field(
-                "pre_authorized_code",
-                &self.pre_authorized_code.as_ref().map(|_| Redacted),
-            )
-            .field("tx_code", &self.tx_code.as_ref().map(|_| Redacted))
-            .finish()
-    }
-}
-
-#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct TokenResponse {
-    pub access_token: String,
-    pub token_type: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub expires_in: Option<u64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub c_nonce: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub c_nonce_expires_in: Option<u64>,
-}
-
-impl fmt::Debug for TokenResponse {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("TokenResponse")
-            .field("access_token", &Redacted)
-            .field("token_type", &self.token_type)
-            .field("expires_in", &self.expires_in)
-            .field("c_nonce", &self.c_nonce.as_ref().map(|_| Redacted))
-            .field("c_nonce_expires_in", &self.c_nonce_expires_in)
-            .finish()
-    }
-}
-
-struct Redacted;
-
-impl fmt::Debug for Redacted {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str("\"<redacted>\"")
-    }
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct WireError {
-    pub error: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub error_description: Option<String>,
-}
-
-impl WireError {
-    pub fn new(error: impl Into<String>, error_description: Option<String>) -> Self {
-        Self {
-            error: error.into(),
-            error_description,
-        }
-    }
-}
-
-#[derive(Clone, Debug)]
-pub struct ProofValidationPolicy<'a> {
-    pub audience: &'a str,
-    pub expected_nonce: Option<&'a str>,
-    pub issuer: ProofIssuerPolicy<'a>,
-    pub max_lifetime: Duration,
-    pub future_skew: Duration,
-    pub forbidden_holder_keys: &'a [PublicJwk],
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum ProofIssuerPolicy<'a> {
-    /// Anonymous or pre-authorized credential flows where proof `iss`
-    /// may be omitted or may carry wallet-specific metadata.
-    Optional,
-    /// Authenticated credential flows where proof `iss` must match the
-    /// wallet OAuth client bound to the credential request.
-    Required(&'a str),
-}
-
-impl<'a> ProofValidationPolicy<'a> {
-    #[must_use]
-    pub fn credential_endpoint(
-        audience: &'a str,
-        expected_nonce: Option<&'a str>,
-        max_lifetime: Duration,
-        future_skew: Duration,
-    ) -> Self {
-        Self {
-            audience,
-            expected_nonce,
-            issuer: ProofIssuerPolicy::Optional,
-            max_lifetime,
-            future_skew,
-            forbidden_holder_keys: &[],
-        }
-    }
-
-    #[must_use]
-    pub fn with_expected_issuer(mut self, expected_issuer: &'a str) -> Self {
-        self.issuer = ProofIssuerPolicy::Required(expected_issuer);
-        self
-    }
-
-    #[must_use]
-    pub fn with_forbidden_holder_keys(mut self, forbidden_holder_keys: &'a [PublicJwk]) -> Self {
-        self.forbidden_holder_keys = forbidden_holder_keys;
-        self
-    }
-}
-
-#[derive(Clone, PartialEq)]
-pub struct ValidatedProof {
-    pub holder_jwk: PublicJwk,
-    pub holder_id: String,
-    pub kid: Option<String>,
-    pub nonce: Option<String>,
-    pub iat: i64,
-    pub exp: Option<i64>,
-    pub raw_claims: Value,
-}
-
-impl fmt::Debug for ValidatedProof {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("ValidatedProof")
-            .field("holder_jwk", &self.holder_jwk)
-            .field("holder_id", &self.holder_id)
-            .field("kid", &self.kid)
-            .field("nonce", &self.nonce.as_ref().map(|_| Redacted))
-            .field("iat", &self.iat)
-            .field("exp", &self.exp)
-            .field("raw_claims", &Redacted)
-            .finish()
-    }
-}
-
-#[derive(Debug, Error, PartialEq, Eq)]
-#[non_exhaustive]
-pub enum ProofError {
-    #[error("proof must be a compact JWT")]
-    MalformedJwt,
-    #[error("proof header is invalid")]
-    InvalidHeader,
-    #[error("proof claims are invalid")]
-    InvalidClaims,
-    #[error("proof uses an unsupported key reference")]
-    UnsupportedKeyReference,
-    #[error("proof signature is invalid")]
-    InvalidSignature,
-    #[error("proof nonce is invalid")]
-    InvalidNonce,
-    #[error("proof audience is invalid")]
-    InvalidAudience,
-    #[error("proof issuer is invalid")]
-    InvalidIssuer,
-    #[error("proof time bounds are invalid")]
-    InvalidTime,
-}
-
-/// Validate an OID4VCI proof JWT presented at the credential endpoint.
-///
-/// Validates structure, `typ` (`openid4vci-proof+jwt`), EdDSA signature,
-/// audience, optional nonce, configured issuer policy, time bounds, and
-/// holder binding (`did:jwk` or inline `jwk` header). Returns the verified
-/// holder JWK, holder DID, and raw claims on success.
-///
-/// **Nonce replay is a caller responsibility.** This function validates that the
-/// nonce in the proof matches `policy.expected_nonce`, but it does NOT track
-/// nonce usage across calls. Callers must persist and reject already-used nonces.
-/// The `ValidatedProof::nonce` field carries the nonce back for this purpose.
-pub fn validate_proof_jwt(
-    proof_jwt: &str,
-    policy: &ProofValidationPolicy<'_>,
-    now: i64,
-) -> Result<ValidatedProof, ProofError> {
-    let (header_b64, payload_b64, signature_b64) = split_compact_jwt(proof_jwt)?;
-    let header = decode_json(header_b64).map_err(|_| ProofError::InvalidHeader)?;
-    reject_header(&header)?;
-    let holder_jwk = holder_jwk_from_header(&header)?;
-    require_eddsa_holder_key(&holder_jwk)?;
-    if policy
-        .forbidden_holder_keys
-        .iter()
-        .any(|forbidden| same_public_key_material(forbidden, &holder_jwk))
-    {
-        return Err(ProofError::UnsupportedKeyReference);
-    }
-    let signature = URL_SAFE_NO_PAD
-        .decode(signature_b64)
-        .map_err(|_| ProofError::MalformedJwt)?;
-    let signing_input = format!("{header_b64}.{payload_b64}");
-    verify(signing_input.as_bytes(), &signature, &holder_jwk)
-        .map_err(|_| ProofError::InvalidSignature)?;
-
-    let claims = decode_json(payload_b64).map_err(|_| ProofError::InvalidClaims)?;
-    let aud = claims.get("aud").ok_or(ProofError::InvalidAudience)?;
-    if !audience_contains(aud, policy.audience) {
-        return Err(ProofError::InvalidAudience);
-    }
-    let nonce = claims
-        .get("nonce")
-        .and_then(Value::as_str)
-        .map(str::to_string);
-    if let Some(expected) = policy.expected_nonce {
-        if nonce.as_deref() != Some(expected) {
-            return Err(ProofError::InvalidNonce);
-        }
-    }
-    let iat = required_i64(&claims, "iat")?;
-    let exp = optional_i64(&claims, "exp")?;
-    validate_time(iat, exp, policy, now)?;
-    let kid = header
-        .get("kid")
-        .and_then(Value::as_str)
-        .map(str::to_string);
-    let holder_id = match kid
-        .as_deref()
-        .filter(|kid| kid.starts_with(CRYPTOGRAPHIC_BINDING_METHOD_DID_JWK))
-    {
-        Some(kid) => {
-            let did = strip_fragment(kid)?;
-            let kid_jwk = parse_did_jwk(did).map_err(|_| ProofError::UnsupportedKeyReference)?;
-            if !same_public_key_material(&kid_jwk, &holder_jwk) {
-                return Err(ProofError::UnsupportedKeyReference);
-            }
-            did_jwk_from_public_jwk(&kid_jwk).map_err(|_| ProofError::UnsupportedKeyReference)?
-        }
-        None => {
-            did_jwk_from_public_jwk(&holder_jwk).map_err(|_| ProofError::UnsupportedKeyReference)?
-        }
-    };
-    validate_proof_issuer(&claims, policy.issuer)?;
-
-    Ok(ValidatedProof {
-        holder_jwk,
-        holder_id,
-        kid,
-        nonce,
-        iat,
-        exp,
-        raw_claims: claims,
-    })
-}
-
-fn validate_proof_issuer(
-    claims: &Value,
-    issuer_policy: ProofIssuerPolicy<'_>,
-) -> Result<(), ProofError> {
-    let issuer = match claims.get("iss") {
-        Some(Value::String(issuer)) => Some(issuer.as_str()),
-        Some(_) => return Err(ProofError::InvalidClaims),
-        None => None,
-    };
-    match issuer_policy {
-        ProofIssuerPolicy::Optional => Ok(()),
-        ProofIssuerPolicy::Required(expected) if issuer == Some(expected) => Ok(()),
-        ProofIssuerPolicy::Required(_) => Err(ProofError::InvalidIssuer),
-    }
-}
-
-/// Validate a production credential-endpoint proof with a reserved, single-use
-/// challenge nonce.
-///
-/// The nonce must be present in `policy.expected_nonce`, the proof must carry
-/// exactly that nonce, and `nonce_store` must consume the nonce in `nonce_scope`
-/// exactly once. Missing, already-used, or store-failed nonces all fail closed
-/// as `ProofError::InvalidNonce`.
-pub async fn validate_challenged_proof_jwt(
-    proof_jwt: &str,
-    policy: &ProofValidationPolicy<'_>,
-    now: i64,
-    nonce_store: &dyn ConsumableNonceStore,
-    nonce_scope: &ReplayScope,
-) -> Result<ValidatedProof, ProofError> {
-    let expected_nonce = policy.expected_nonce.ok_or(ProofError::InvalidNonce)?;
-    let proof = validate_proof_jwt(proof_jwt, policy, now)?;
-    if proof.nonce.as_deref() != Some(expected_nonce) {
-        return Err(ProofError::InvalidNonce);
-    }
-    let nonce_key = ReplayKey::new(expected_nonce).map_err(|_| ProofError::InvalidNonce)?;
-    require_consume_once(nonce_store, nonce_scope, &nonce_key)
-        .await
-        .map_err(|_| ProofError::InvalidNonce)?;
-    Ok(proof)
-}
-
-/// Consume the nonce from an already validated credential-endpoint proof.
-///
-/// This helper supports consumers that derive their replay key from deployment
-/// context instead of using the raw nonce string as the replay key.
-pub async fn consume_validated_proof_nonce_once(
-    proof: &ValidatedProof,
-    expected_nonce: &str,
-    nonce_store: &dyn ConsumableNonceStore,
-    nonce_scope: &ReplayScope,
-    nonce_key: &ReplayKey,
-) -> Result<(), ProofError> {
-    if proof.nonce.as_deref() != Some(expected_nonce) {
-        return Err(ProofError::InvalidNonce);
-    }
-    require_consume_once(nonce_store, nonce_scope, nonce_key)
-        .await
-        .map_err(|_| ProofError::InvalidNonce)?;
-    Ok(())
-}
-
-fn reject_header(header: &Value) -> Result<(), ProofError> {
-    if header.get("alg").and_then(Value::as_str) != Some(CREDENTIAL_SIGNING_ALG_EDDSA) {
-        return Err(ProofError::InvalidHeader);
-    }
-    if header.get("typ").and_then(Value::as_str) != Some(PROOF_JWT_TYPE) {
-        return Err(ProofError::InvalidHeader);
-    }
-    for forbidden in ["jku", "x5u", "x5c"] {
-        if header.get(forbidden).is_some() {
-            return Err(ProofError::UnsupportedKeyReference);
-        }
-    }
-    if header.get("crit").is_some() {
-        return Err(ProofError::InvalidHeader);
-    }
-    Ok(())
-}
-
-fn holder_jwk_from_header(header: &Value) -> Result<PublicJwk, ProofError> {
-    if let Some(jwk) = header.get("jwk") {
-        return PublicJwk::parse(&jwk.to_string()).map_err(|_| ProofError::UnsupportedKeyReference);
-    }
-    let kid = header
-        .get("kid")
-        .and_then(Value::as_str)
-        .ok_or(ProofError::UnsupportedKeyReference)?;
-    if !kid.starts_with(CRYPTOGRAPHIC_BINDING_METHOD_DID_JWK) {
-        return Err(ProofError::UnsupportedKeyReference);
-    }
-    parse_did_jwk(kid).map_err(|_| ProofError::UnsupportedKeyReference)
-}
-
-fn require_eddsa_holder_key(jwk: &PublicJwk) -> Result<(), ProofError> {
-    if jwk.kty == "OKP" && jwk.crv.as_deref() == Some("Ed25519") {
-        return Ok(());
-    }
-    Err(ProofError::UnsupportedKeyReference)
-}
-
-fn same_public_key_material(left: &PublicJwk, right: &PublicJwk) -> bool {
-    left.kty == right.kty
-        && left.crv == right.crv
-        && left.x == right.x
-        && left.y == right.y
-        && left.n == right.n
-        && left.e == right.e
-}
-
-fn strip_fragment(kid: &str) -> Result<&str, ProofError> {
-    Ok(kid.split_once('#').map_or(kid, |(did, _)| did))
-}
-
-fn validate_time(
-    iat: i64,
-    exp: Option<i64>,
-    policy: &ProofValidationPolicy<'_>,
-    now: i64,
-) -> Result<(), ProofError> {
-    let max_lifetime = i64::try_from(policy.max_lifetime.as_secs()).unwrap_or(i64::MAX);
-    let future_skew = i64::try_from(policy.future_skew.as_secs()).unwrap_or(i64::MAX);
-    if iat > now + future_skew || iat < now - max_lifetime {
-        return Err(ProofError::InvalidTime);
-    }
-    if let Some(exp) = exp {
-        if exp <= iat || exp > iat + max_lifetime || exp <= now {
-            return Err(ProofError::InvalidTime);
-        }
-    }
-    Ok(())
-}
-
-fn audience_contains(value: &Value, expected: &str) -> bool {
-    match value {
-        Value::String(aud) => aud == expected,
-        Value::Array(items) => items.iter().any(|item| item.as_str() == Some(expected)),
-        _ => false,
-    }
-}
-
-fn required_i64(value: &Value, name: &'static str) -> Result<i64, ProofError> {
-    value
-        .get(name)
-        .and_then(Value::as_i64)
-        .ok_or(ProofError::InvalidClaims)
-}
-
-fn optional_i64(value: &Value, name: &'static str) -> Result<Option<i64>, ProofError> {
-    match value.get(name) {
-        Some(value) => value.as_i64().map(Some).ok_or(ProofError::InvalidClaims),
-        None => Ok(None),
-    }
-}
-
-fn split_compact_jwt(jwt: &str) -> Result<(&str, &str, &str), ProofError> {
-    let mut parts = jwt.split('.');
-    let header = parts.next().ok_or(ProofError::MalformedJwt)?;
-    let payload = parts.next().ok_or(ProofError::MalformedJwt)?;
-    let signature = parts.next().ok_or(ProofError::MalformedJwt)?;
-    if parts.next().is_some() || header.is_empty() || payload.is_empty() || signature.is_empty() {
-        return Err(ProofError::MalformedJwt);
-    }
-    Ok((header, payload, signature))
-}
-
-fn decode_json(segment: &str) -> Result<Value, ProofError> {
-    let bytes = URL_SAFE_NO_PAD
-        .decode(segment)
-        .map_err(|_| ProofError::MalformedJwt)?;
-    serde_json::from_slice(&bytes).map_err(|_| ProofError::MalformedJwt)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use registry_platform_crypto::{did_jwk_from_public_jwk, sign, PrivateJwk};
-    use registry_platform_replay::{InMemoryConsumableNonceStore, ReplayKey, ReplayScope};
-    use serde_json::json;
-    use time::OffsetDateTime;
-
-    const RAW_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA"}"#;
-
-    #[test]
-    fn validates_public_jwk_proof() {
-        let key = PrivateJwk::parse(RAW_JWK).expect("key parses");
-        let holder_id = did_jwk_from_public_jwk(&key.public()).expect("did:jwk encodes");
-        let proof = sign_proof(
-            json!({"alg":"EdDSA","typ":PROOF_JWT_TYPE,"jwk": key.public()}),
-            json!({"iss":holder_id,"aud":"https://issuer.example","iat":1000,"exp":1060,"nonce":"n-1"}),
-            &key,
-        );
-        let validated = validate_proof_jwt(
-            &proof,
-            &ProofValidationPolicy {
-                audience: "https://issuer.example",
-                expected_nonce: Some("n-1"),
-                issuer: ProofIssuerPolicy::Optional,
-                max_lifetime: Duration::from_secs(300),
-                future_skew: Duration::from_secs(30),
-                forbidden_holder_keys: &[],
-            },
-            1001,
-        )
-        .expect("proof validates");
-
-        assert_eq!(validated.holder_jwk, key.public());
-        assert!(validated.holder_id.starts_with("did:jwk:"));
-    }
-
-    #[test]
-    fn validates_pyjwt_public_jwk_proof_without_iss() {
-        let proof = concat!(
-            "eyJhbGciOiJFZERTQSIsImp3ayI6eyJhbGciOiJFZERTQSIsImNydiI6IkVkMjU1MT",
-            "kiLCJrdHkiOiJPS1AiLCJ4IjoiMWFqX3JMSnNHRmd3LTV2OTI1RU1tZVpqNUp",
-            "xUDQ0eGVnYWZFS2ZaYmR4YyJ9LCJ0eXAiOiJvcGVuaWQ0dmNpLXByb29",
-            "mK2p3dCJ9.eyJhdWQiOiJodHRwczovL2lzc3Vlci5leGFtcGxlIiwiaWF",
-            "0IjoxMDAwLCJub25jZSI6Im4tMSJ9.fIyoaSjcCVbtOuSql0Wj5WfmdKBzY",
-            "jIDyU26kCixkwXM2QcKiNJicQMp4yBO5mNEsSp3qiDn09Bqbrx0EhMFBg"
-        );
-
-        validate_proof_jwt(proof, &policy(Some("n-1")), 1001)
-            .expect("PyJWT EdDSA proof without iss validates");
-    }
-
-    #[test]
-    fn validates_did_jwk_kid_proof() {
-        let key = PrivateJwk::parse(RAW_JWK).expect("key parses");
-        let did = did_jwk_from_public_jwk(&key.public()).expect("did:jwk encodes");
-        let proof = sign_proof(
-            json!({"alg":"EdDSA","typ":PROOF_JWT_TYPE,"kid": format!("{did}#key-1")}),
-            json!({"iss":did,"aud":["https://other.example","https://issuer.example"],"iat":1000}),
-            &key,
-        );
-
-        let validated = validate_proof_jwt(
-            &proof,
-            &ProofValidationPolicy {
-                audience: "https://issuer.example",
-                expected_nonce: None,
-                issuer: ProofIssuerPolicy::Optional,
-                max_lifetime: Duration::from_secs(300),
-                future_skew: Duration::from_secs(30),
-                forbidden_holder_keys: &[],
-            },
-            1001,
-        )
-        .expect("proof validates");
-
-        assert_eq!(validated.holder_id, did);
-    }
-
-    #[test]
-    fn validates_did_jwk_kid_proof_with_wallet_public_metadata() {
-        let key = PrivateJwk::parse(RAW_JWK).expect("key parses");
-        let canonical_did = did_jwk_from_public_jwk(&key.public()).expect("did:jwk encodes");
-        let did = format!(
-            "did:jwk:{}",
-            URL_SAFE_NO_PAD.encode(
-                br#"{"x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","kty":"OKP","crv":"Ed25519","alg":"EdDSA","kid":"wallet-key-1"}"#
-            )
-        );
-        let proof = sign_proof(
-            json!({"alg":"EdDSA","typ":PROOF_JWT_TYPE,"kid": format!("{did}#0")}),
-            json!({"aud":"https://issuer.example","iat":1000,"nonce":"n-1"}),
-            &key,
-        );
-
-        let validated = validate_proof_jwt(&proof, &policy(Some("n-1")), 1001)
-            .expect("wallet did:jwk proof validates");
-
-        assert_ne!(did, canonical_did);
-        assert_eq!(validated.holder_id, canonical_did);
-    }
-
-    #[test]
-    fn rejects_wrong_type_remote_key_and_wrong_nonce() {
-        let key = PrivateJwk::parse(RAW_JWK).expect("key parses");
-        let holder_id = did_jwk_from_public_jwk(&key.public()).expect("did:jwk encodes");
-        let wrong_typ = sign_proof(
-            json!({"alg":"EdDSA","typ":"jwt","jwk": key.public()}),
-            json!({"iss":holder_id,"aud":"https://issuer.example","iat":1000,"nonce":"n-1"}),
-            &key,
-        );
-        assert_eq!(
-            validate_proof_jwt(&wrong_typ, &policy(Some("n-1")), 1001),
-            Err(ProofError::InvalidHeader)
-        );
-
-        let remote = sign_proof(
-            json!({"alg":"EdDSA","typ":PROOF_JWT_TYPE,"jku":"https://keys.example/jwks.json","jwk": key.public()}),
-            json!({"iss":holder_id,"aud":"https://issuer.example","iat":1000,"nonce":"n-1"}),
-            &key,
-        );
-        assert_eq!(
-            validate_proof_jwt(&remote, &policy(Some("n-1")), 1001),
-            Err(ProofError::UnsupportedKeyReference)
-        );
-
-        assert_eq!(
-            validate_proof_jwt(&valid_proof(&key, "n-2"), &policy(Some("n-1")), 1001),
-            Err(ProofError::InvalidNonce)
-        );
-    }
-
-    #[test]
-    fn rejects_conflicting_public_jwk_and_did_jwk_kid() {
-        let signing_key = PrivateJwk::parse(RAW_JWK).expect("key parses");
-        let signing_did = did_jwk_from_public_jwk(&signing_key.public()).expect("did:jwk encodes");
-        let other_key = PrivateJwk::parse(
-            r#"{"crv":"Ed25519","d":"f4QIxnAyRWzhuBOmNRgvBTE56mWePdsPL0mvCtl8Gys","x":"pv4e_hXHBLN27rcs6VDFV1ED0TiU8M3xy9vsuWFEsec","kty":"OKP","alg":"EdDSA"}"#,
-        )
-        .expect("other key parses");
-        let other_did = did_jwk_from_public_jwk(&other_key.public()).expect("did:jwk encodes");
-        let proof = sign_proof(
-            json!({
-                "alg": "EdDSA",
-                "typ": PROOF_JWT_TYPE,
-                "jwk": signing_key.public(),
-                "kid": format!("{other_did}#key-1")
-            }),
-            json!({"iss":signing_did,"aud":"https://issuer.example","iat":1000,"nonce":"n-1"}),
-            &signing_key,
-        );
-
-        assert_eq!(
-            validate_proof_jwt(&proof, &policy(Some("n-1")), 1001),
-            Err(ProofError::UnsupportedKeyReference)
-        );
-    }
-
-    #[test]
-    fn rejects_forbidden_holder_key() {
-        let key = PrivateJwk::parse(RAW_JWK).expect("key parses");
-        let mut p = policy(Some("n-1"));
-        let forbidden = [key.public()];
-        p.forbidden_holder_keys = &forbidden;
-
-        assert_eq!(
-            validate_proof_jwt(&valid_proof(&key, "n-1"), &p, 1001),
-            Err(ProofError::UnsupportedKeyReference)
-        );
-    }
-
-    #[test]
-    fn rejects_forbidden_holder_key_with_different_metadata() {
-        let key = PrivateJwk::parse(RAW_JWK).expect("key parses");
-        let mut forbidden_key = key.public();
-        forbidden_key.alg = None;
-        forbidden_key.kid = Some("did:web:issuer.test#rotated".to_string());
-        let forbidden = [forbidden_key];
-        let mut p = policy(Some("n-1"));
-        p.forbidden_holder_keys = &forbidden;
-
-        assert_eq!(
-            validate_proof_jwt(&valid_proof(&key, "n-1"), &p, 1001),
-            Err(ProofError::UnsupportedKeyReference)
-        );
-    }
-
-    #[test]
-    fn rejects_rsa_proof_jwk_before_signature_verification() {
-        let header = URL_SAFE_NO_PAD.encode(
-            br#"{"alg":"EdDSA","typ":"openid4vci-proof+jwt","jwk":{"kty":"RSA","alg":"RS256","n":"sXchDaQebHnPiGvyDOAT4saGEUetSyo9MKLOoWFsueri23bOdgWp4PBO8BxG7NXXjO4IhYGoOi0Lem4xXeUq7W57RtgGF4wSGZ4HAvY8R9H_JVU3tO7K0XG3L8m5vB2T2KQeJ0gJg9g4nG9QpXJYpJ2NmgH6L7ZqQHX7I4M","e":"AQAB"}}"#,
-        );
-        let payload =
-            URL_SAFE_NO_PAD.encode(br#"{"aud":"https://issuer.example","iat":1000,"nonce":"n-1"}"#);
-        let proof = format!("{header}.{payload}.invalid-signature");
-
-        assert_eq!(
-            validate_proof_jwt(&proof, &policy(Some("n-1")), 1001),
-            Err(ProofError::UnsupportedKeyReference)
-        );
-    }
-
-    #[test]
-    fn accepts_optional_proof_issuer_and_rejects_invalid_shape() {
-        let key = PrivateJwk::parse(RAW_JWK).expect("key parses");
-        let missing_iss = sign_proof(
-            json!({"alg":"EdDSA","typ":PROOF_JWT_TYPE,"jwk": key.public()}),
-            json!({"aud":"https://issuer.example","iat":1000,"nonce":"n-1"}),
-            &key,
-        );
-        validate_proof_jwt(&missing_iss, &policy(Some("n-1")), 1001)
-            .expect("anonymous pre-authorized-code proof accepts omitted iss");
-
-        let client_iss = sign_proof(
-            json!({"alg":"EdDSA","typ":PROOF_JWT_TYPE,"jwk": key.public()}),
-            json!({"iss":"wallet-client-1","aud":"https://issuer.example","iat":1000,"nonce":"n-1"}),
-            &key,
-        );
-        validate_proof_jwt(&client_iss, &policy(Some("n-1")), 1001)
-            .expect("proof issuer is an optional client identifier");
-
-        let invalid_iss = sign_proof(
-            json!({"alg":"EdDSA","typ":PROOF_JWT_TYPE,"jwk": key.public()}),
-            json!({"iss":{"id":"wallet-client-1"},"aud":"https://issuer.example","iat":1000,"nonce":"n-1"}),
-            &key,
-        );
-        assert_eq!(
-            validate_proof_jwt(&invalid_iss, &policy(Some("n-1")), 1001),
-            Err(ProofError::InvalidClaims)
-        );
-    }
-
-    #[test]
-    fn authenticated_proof_policy_requires_matching_issuer() {
-        let key = PrivateJwk::parse(RAW_JWK).expect("key parses");
-        let policy = policy(Some("n-1")).with_expected_issuer("wallet-client-1");
-
-        let matching = sign_proof(
-            json!({"alg":"EdDSA","typ":PROOF_JWT_TYPE,"jwk": key.public()}),
-            json!({"iss":"wallet-client-1","aud":"https://issuer.example","iat":1000,"nonce":"n-1"}),
-            &key,
-        );
-        validate_proof_jwt(&matching, &policy, 1001).expect("matching issuer validates");
-
-        let missing = sign_proof(
-            json!({"alg":"EdDSA","typ":PROOF_JWT_TYPE,"jwk": key.public()}),
-            json!({"aud":"https://issuer.example","iat":1000,"nonce":"n-1"}),
-            &key,
-        );
-        assert_eq!(
-            validate_proof_jwt(&missing, &policy, 1001),
-            Err(ProofError::InvalidIssuer)
-        );
-
-        let wrong = sign_proof(
-            json!({"alg":"EdDSA","typ":PROOF_JWT_TYPE,"jwk": key.public()}),
-            json!({"iss":"other-wallet-client","aud":"https://issuer.example","iat":1000,"nonce":"n-1"}),
-            &key,
-        );
-        assert_eq!(
-            validate_proof_jwt(&wrong, &policy, 1001),
-            Err(ProofError::InvalidIssuer)
-        );
-    }
-
-    #[test]
-    fn rejects_stale_or_future_proofs() {
-        let key = PrivateJwk::parse(RAW_JWK).expect("key parses");
-        assert_eq!(
-            validate_proof_jwt(&valid_proof(&key, "n-1"), &policy(Some("n-1")), 1400),
-            Err(ProofError::InvalidTime)
-        );
-        assert_eq!(
-            validate_proof_jwt(&valid_proof(&key, "n-1"), &policy(Some("n-1")), 900),
-            Err(ProofError::InvalidTime)
-        );
-    }
-
-    #[test]
-    fn credential_request_ignores_unknown_fields() {
-        let request = json!({
-            "format": SD_JWT_VC_FORMAT,
-            "credential_configuration_id": "person_is_alive_sd_jwt",
-            "subject": {"id": "NID-1002"},
-            "proof": {"proof_type": PROOF_TYPE_JWT, "jwt": "a.b.c"}
-        });
-        let parsed = serde_json::from_value::<CredentialRequest>(request).expect("request parses");
-        assert_eq!(
-            parsed.credential_configuration_id.as_deref(),
-            Some("person_is_alive_sd_jwt")
-        );
-
-        let request = json!({
-            "format": SD_JWT_VC_FORMAT,
-            "credential_configuration_id": "person_is_alive_sd_jwt",
-            "proof": {"proof_type": PROOF_TYPE_JWT, "jwt": "a.b.c", "subject": "NID-1002"}
-        });
-        let parsed = serde_json::from_value::<CredentialRequest>(request).expect("request parses");
-        assert_eq!(parsed.proof.jwt, "a.b.c");
-    }
-
-    #[test]
-    fn credential_request_accepts_proofs_jwt_array() {
-        let request = json!({
-            "credential_configuration_id": "person_is_alive_sd_jwt",
-            "proofs": {
-                "jwt": ["proof-1.jwt.sig", "proof-2.jwt.sig"]
-            }
-        });
-
-        let parsed = serde_json::from_value::<CredentialRequest>(request).expect("request parses");
-
-        assert_eq!(parsed.proof.proof_type, PROOF_TYPE_JWT);
-        assert_eq!(parsed.format, SD_JWT_VC_FORMAT);
-        assert_eq!(parsed.proof.jwt, "proof-1.jwt.sig");
-        assert_eq!(
-            parsed.proof_jwts(),
-            &["proof-1.jwt.sig".to_string(), "proof-2.jwt.sig".to_string()]
-        );
-    }
-
-    #[test]
-    fn credential_request_serializes_proofs_only_shape() {
-        let request = CredentialRequest {
-            format: SD_JWT_VC_FORMAT.to_string(),
-            credential_identifier: None,
-            credential_configuration_id: Some("person_is_alive_sd_jwt".to_string()),
-            vct: None,
-            proof: CredentialRequestProof {
-                proof_type: PROOF_TYPE_JWT.to_string(),
-                jwt: "proof-1.jwt.sig".to_string(),
-            },
-            proofs: CredentialRequestProofs {
-                jwt: vec!["proof-1.jwt.sig".to_string(), "proof-2.jwt.sig".to_string()],
-            },
-        };
-
-        let value = serde_json::to_value(&request).expect("request serializes");
-
-        assert!(value.get("proof").is_none());
-        assert_eq!(
-            value["proofs"],
-            json!({"jwt": ["proof-1.jwt.sig", "proof-2.jwt.sig"]})
-        );
-
-        let round_tripped =
-            serde_json::from_value::<CredentialRequest>(value).expect("request round-trips");
-        assert_eq!(
-            round_tripped.proof_jwts(),
-            &["proof-1.jwt.sig".to_string(), "proof-2.jwt.sig".to_string()]
-        );
-    }
-
-    #[test]
-    fn credential_request_serializes_legacy_proof_only_shape() {
-        let request = CredentialRequest {
-            format: SD_JWT_VC_FORMAT.to_string(),
-            credential_identifier: None,
-            credential_configuration_id: Some("person_is_alive_sd_jwt".to_string()),
-            vct: None,
-            proof: CredentialRequestProof {
-                proof_type: PROOF_TYPE_JWT.to_string(),
-                jwt: "legacy.jwt.sig".to_string(),
-            },
-            proofs: CredentialRequestProofs::default(),
-        };
-
-        let value = serde_json::to_value(&request).expect("request serializes");
-
-        assert_eq!(
-            value["proof"],
-            json!({"proof_type": PROOF_TYPE_JWT, "jwt": "legacy.jwt.sig"})
-        );
-        assert!(value.get("proofs").is_none());
-    }
-
-    #[test]
-    fn credential_request_rejects_conflicting_proof_shapes() {
-        let request = json!({
-            "credential_configuration_id": "person_is_alive_sd_jwt",
-            "proof": {"proof_type": PROOF_TYPE_JWT, "jwt": "legacy.jwt.sig"},
-            "proofs": {"jwt": ["array.jwt.sig"]}
-        });
-
-        assert!(
-            serde_json::from_value::<CredentialRequest>(request).is_err(),
-            "mixed proof and proofs must fail closed"
-        );
-    }
-
-    #[test]
-    fn nonce_request_rejects_unknown_fields() {
-        assert!(serde_json::from_value::<NonceRequest>(
-            json!({"credential_configuration_id":"person_is_alive_sd_jwt"})
-        )
-        .is_ok());
-        assert!(serde_json::from_value::<NonceRequest>(
-            json!({"credential_configuration_id":"person_is_alive_sd_jwt","subject":"NID-1002"})
-        )
-        .is_err());
-    }
-
-    #[test]
-    fn validate_proof_jwt_does_not_track_nonce_reuse_across_calls() {
-        let key = PrivateJwk::parse(RAW_JWK).expect("key parses");
-        let proof = valid_proof(&key, "n-replay");
-        let p = policy(Some("n-replay"));
-
-        let first = validate_proof_jwt(&proof, &p, 1001).expect("first call accepts the proof");
-        let second =
-            validate_proof_jwt(&proof, &p, 1001).expect("second call also accepts the proof");
-
-        assert_eq!(first.nonce, Some("n-replay".to_string()));
-        assert_eq!(second.nonce, Some("n-replay".to_string()));
-        // Both calls succeed because replay prevention is the caller's responsibility;
-        // the caller must record `ValidatedProof::nonce` and reject it if seen before.
-    }
-
-    #[tokio::test]
-    async fn challenged_proof_consumes_reserved_nonce_once() {
-        let key = PrivateJwk::parse(RAW_JWK).expect("key parses");
-        let store = InMemoryConsumableNonceStore::new();
-        let scope = ReplayScope::oid4vci_nonce("tenant-a", "issuer-a", "profile-a").expect("scope");
-        let nonce = ReplayKey::new("n-replay").expect("nonce key");
-        store
-            .reserve_nonce(
-                &scope,
-                &nonce,
-                OffsetDateTime::now_utc() + time::Duration::seconds(60),
-            )
-            .await
-            .expect("nonce reserves");
-        let proof = valid_proof(&key, "n-replay");
-        let p = policy(Some("n-replay"));
-
-        validate_challenged_proof_jwt(&proof, &p, 1001, &store, &scope)
-            .await
-            .expect("reserved nonce validates once");
-        assert_eq!(
-            validate_challenged_proof_jwt(&proof, &p, 1001, &store, &scope).await,
-            Err(ProofError::InvalidNonce)
-        );
-    }
-
-    #[tokio::test]
-    async fn challenged_proof_rejects_expired_reserved_nonce() {
-        let key = PrivateJwk::parse(RAW_JWK).expect("key parses");
-        let store = InMemoryConsumableNonceStore::new();
-        let scope = ReplayScope::oid4vci_nonce("tenant-a", "issuer-a", "profile-a").expect("scope");
-        let nonce = ReplayKey::new("n-replay").expect("nonce key");
-        store
-            .reserve_nonce(
-                &scope,
-                &nonce,
-                OffsetDateTime::now_utc() + time::Duration::milliseconds(10),
-            )
-            .await
-            .expect("nonce reserves");
-        tokio::time::sleep(Duration::from_millis(20)).await;
-        let proof = valid_proof(&key, "n-replay");
-        let p = policy(Some("n-replay"));
-
-        assert_eq!(
-            validate_challenged_proof_jwt(&proof, &p, 1001, &store, &scope).await,
-            Err(ProofError::InvalidNonce)
-        );
-    }
-
-    #[tokio::test]
-    async fn challenged_proof_requires_expected_nonce() {
-        let key = PrivateJwk::parse(RAW_JWK).expect("key parses");
-        let store = InMemoryConsumableNonceStore::new();
-        let scope = ReplayScope::oid4vci_nonce("tenant-a", "issuer-a", "profile-a").expect("scope");
-        let p = policy(None);
-
-        assert_eq!(
-            validate_challenged_proof_jwt(
-                &valid_proof(&key, "n-replay"),
-                &p,
-                1001,
-                &store,
-                &scope,
-            )
-            .await,
-            Err(ProofError::InvalidNonce)
-        );
-    }
-
-    #[tokio::test]
-    async fn credential_endpoint_policy_and_nonce_helper_consume_once() {
-        let key = PrivateJwk::parse(RAW_JWK).expect("key parses");
-        let store = InMemoryConsumableNonceStore::new();
-        let scope = ReplayScope::oid4vci_nonce("tenant-a", "issuer-a", "profile-a").expect("scope");
-        let nonce_key = ReplayKey::new("hashed-n-replay").expect("nonce key");
-        store
-            .reserve_nonce(
-                &scope,
-                &nonce_key,
-                OffsetDateTime::now_utc() + time::Duration::seconds(60),
-            )
-            .await
-            .expect("nonce reserves");
-        let policy = ProofValidationPolicy::credential_endpoint(
-            "https://issuer.example",
-            Some("n-replay"),
-            Duration::from_secs(300),
-            Duration::from_secs(30),
-        );
-        let proof = validate_proof_jwt(&valid_proof(&key, "n-replay"), &policy, 1001)
-            .expect("proof validates");
-
-        consume_validated_proof_nonce_once(&proof, "n-replay", &store, &scope, &nonce_key)
-            .await
-            .expect("reserved nonce consumes once");
-        assert_eq!(
-            consume_validated_proof_nonce_once(&proof, "n-replay", &store, &scope, &nonce_key)
-                .await,
-            Err(ProofError::InvalidNonce)
-        );
-    }
-
-    #[test]
-    fn credential_configuration_metadata_sd_jwt_vc_serialises_to_spec_shape() {
-        let metadata = CredentialConfigurationMetadata::sd_jwt_vc(
-            "identity_vc",
-            vec![CRYPTOGRAPHIC_BINDING_METHOD_DID_JWK.to_string()],
-            "Identity Credential",
-            "https://vct.example/identity",
-        );
-        let value = serde_json::to_value(&metadata).expect("serializes");
-
-        assert_eq!(value["format"], SD_JWT_VC_FORMAT);
-        assert_eq!(value["scope"], "identity_vc");
-        assert_eq!(
-            value["proof_types_supported"][PROOF_TYPE_JWT]["proof_signing_alg_values_supported"][0],
-            CREDENTIAL_SIGNING_ALG_EDDSA
-        );
-        assert_eq!(
-            value["credential_signing_alg_values_supported"][0],
-            CREDENTIAL_SIGNING_ALG_EDDSA
-        );
-        assert_eq!(value["vct"], "https://vct.example/identity");
-
-        let round_tripped: CredentialConfigurationMetadata =
-            serde_json::from_value(value).expect("round-trip deserializes");
-        assert_eq!(round_tripped.format, SD_JWT_VC_FORMAT);
-        assert_eq!(
-            round_tripped.vct.as_deref(),
-            Some("https://vct.example/identity")
-        );
-        assert!(round_tripped
-            .proof_types_supported
-            .contains_key(PROOF_TYPE_JWT));
-    }
-
-    #[test]
-    fn credential_configuration_metadata_accepts_explicit_signing_algorithms() {
-        let metadata = CredentialConfigurationMetadata::sd_jwt_vc_with_algs(
-            "identity_vc",
-            vec![CRYPTOGRAPHIC_BINDING_METHOD_DID_JWK.to_string()],
-            vec!["RS256".to_string()],
-            vec![CREDENTIAL_SIGNING_ALG_EDDSA.to_string()],
-            "Identity Credential",
-            "https://vct.example/identity",
-        );
-        let value = serde_json::to_value(&metadata).expect("serializes");
-
-        assert_eq!(
-            value["credential_signing_alg_values_supported"],
-            json!(["RS256"])
-        );
-        assert_eq!(
-            value["proof_types_supported"][PROOF_TYPE_JWT]["proof_signing_alg_values_supported"],
-            json!([CREDENTIAL_SIGNING_ALG_EDDSA])
-        );
-    }
-
-    #[test]
-    fn credential_configuration_metadata_omits_empty_proof_algorithms() {
-        let metadata = CredentialConfigurationMetadata::sd_jwt_vc_with_algs(
-            "identity_vc",
-            vec![CRYPTOGRAPHIC_BINDING_METHOD_DID_JWK.to_string()],
-            vec!["RS256".to_string()],
-            Vec::new(),
-            "Identity Credential",
-            "https://vct.example/identity",
-        );
-        let value = serde_json::to_value(&metadata).expect("serializes");
-
-        assert!(value.get("proof_types_supported").is_none());
-    }
-
-    #[test]
-    fn display_metadata_serialises_issuer_and_credential_branding_fields() {
-        let display = DisplayMetadata {
-            name: "Identity Credential".to_string(),
-            locale: Some("en-US".to_string()),
-            logo: Some(DisplayImageMetadata {
-                uri: None,
-                url: Some("https://issuer.example/logo.png".to_string()),
-                alt_text: Some("Issuer logo".to_string()),
-            }),
-            description: Some("Proof of identity".to_string()),
-            background_color: Some("#0057B8".to_string()),
-            text_color: Some("#FFFFFF".to_string()),
-            background_image: None,
-            secondary_image: None,
-        };
-        let metadata = CredentialIssuerMetadata::new(
-            "https://issuer.example",
-            "https://issuer.example/credential",
-            None,
-            Vec::new(),
-            BTreeMap::new(),
-        )
-        .with_display(vec![display.clone()]);
-        let value = serde_json::to_value(&metadata).expect("serializes");
-
-        assert_eq!(value["display"][0]["name"], "Identity Credential");
-        assert_eq!(
-            value["display"][0]["logo"]["url"],
-            "https://issuer.example/logo.png"
-        );
-        assert_eq!(value["display"][0]["background_color"], "#0057B8");
-
-        let round_tripped: CredentialIssuerMetadata =
-            serde_json::from_value(value).expect("round-trip deserializes");
-        assert_eq!(round_tripped.display, vec![display]);
-    }
-
-    #[test]
-    fn credential_offer_authorization_code_serialises_to_spec_shape() {
-        let offer = CredentialOffer::authorization_code(
-            "https://issuer.example",
-            vec!["identity_vc".to_string()],
-            "state-xyz",
-            Some("https://as.example".to_string()),
-        );
-        let value = serde_json::to_value(&offer).expect("serializes");
-
-        assert_eq!(value["credential_issuer"], "https://issuer.example");
-        assert_eq!(value["credential_configuration_ids"][0], "identity_vc");
-        assert_eq!(
-            value["grants"][AUTHORIZATION_CODE_GRANT_TYPE]["issuer_state"],
-            "state-xyz"
-        );
-        assert_eq!(
-            value["grants"][AUTHORIZATION_CODE_GRANT_TYPE]["authorization_server"],
-            "https://as.example"
-        );
-
-        let round_tripped: CredentialOffer =
-            serde_json::from_value(value).expect("round-trip deserializes");
-        assert_eq!(round_tripped.credential_issuer, "https://issuer.example");
-        assert!(round_tripped
-            .grants
-            .contains_key(AUTHORIZATION_CODE_GRANT_TYPE));
-    }
-
-    #[test]
-    fn credential_offer_authorization_code_grant_has_no_pre_authorized_fields() {
-        let offer = CredentialOffer::authorization_code(
-            "https://issuer.example",
-            vec!["identity_vc".to_string()],
-            "state-xyz",
-            Some("https://as.example".to_string()),
-        );
-        let value = serde_json::to_value(&offer).expect("serializes");
-
-        assert!(value["grants"]
-            .get(PRE_AUTHORIZED_CODE_GRANT_TYPE)
-            .is_none());
-        let grant = &value["grants"][AUTHORIZATION_CODE_GRANT_TYPE];
-        assert!(grant.get("pre-authorized_code").is_none());
-        assert!(grant.get("tx_code").is_none());
-    }
-
-    #[test]
-    fn credential_offer_pre_authorized_code_serialises_to_spec_shape() {
-        let offer = CredentialOffer::pre_authorized_code(
-            "https://issuer.example",
-            vec!["identity_vc".to_string()],
-            "pre-auth-code-123",
-            Some(TxCode::new(
-                6,
-                Some("Enter the code from the letter".to_string()),
-            )),
-        );
-        let value = serde_json::to_value(&offer).expect("serializes");
-
-        assert_eq!(value["credential_issuer"], "https://issuer.example");
-        assert_eq!(value["credential_configuration_ids"][0], "identity_vc");
-        let grant = &value["grants"][PRE_AUTHORIZED_CODE_GRANT_TYPE];
-        assert_eq!(grant["pre-authorized_code"], "pre-auth-code-123");
-        assert_eq!(grant["tx_code"]["input_mode"], "numeric");
-        assert_eq!(grant["tx_code"]["length"], 6);
-        assert_eq!(
-            grant["tx_code"]["description"],
-            "Enter the code from the letter"
-        );
-
-        let round_tripped: CredentialOffer =
-            serde_json::from_value(value).expect("round-trip deserializes");
-        assert!(round_tripped
-            .grants
-            .contains_key(PRE_AUTHORIZED_CODE_GRANT_TYPE));
-    }
-
-    #[test]
-    fn credential_offer_pre_authorized_code_omits_tx_code_when_absent() {
-        let offer = CredentialOffer::pre_authorized_code(
-            "https://issuer.example",
-            vec!["identity_vc".to_string()],
-            "pre-auth-code-123",
-            None,
-        );
-        let value = serde_json::to_value(&offer).expect("serializes");
-
-        let grant = &value["grants"][PRE_AUTHORIZED_CODE_GRANT_TYPE];
-        assert_eq!(grant["pre-authorized_code"], "pre-auth-code-123");
-        assert!(grant.get("tx_code").is_none());
-    }
-
-    #[test]
-    fn tx_code_defaults_input_mode_and_omits_description() {
-        let tx_code = TxCode::new(4, None);
-        let value = serde_json::to_value(&tx_code).expect("serializes");
-
-        assert_eq!(value["input_mode"], "numeric");
-        assert_eq!(value["length"], 4);
-        assert!(value.get("description").is_none());
-
-        let from_minimal: TxCode =
-            serde_json::from_value(json!({"length": 8})).expect("deserializes minimal tx_code");
-        assert_eq!(from_minimal.input_mode, TxCodeInputMode::Numeric);
-        assert_eq!(from_minimal.length, 8);
-        assert_eq!(from_minimal.description, None);
-    }
-
-    #[test]
-    fn token_request_deserialises_from_form_payload() {
-        let form = "grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code\
-            &pre-authorized_code=pre-auth-code-123&tx_code=123456";
-        let request: TokenRequest =
-            serde_urlencoded::from_str(form).expect("form decodes into TokenRequest");
-
-        assert_eq!(request.grant_type, PRE_AUTHORIZED_CODE_GRANT_TYPE);
-        assert_eq!(
-            request.pre_authorized_code.as_deref(),
-            Some("pre-auth-code-123")
-        );
-        assert_eq!(request.tx_code.as_deref(), Some("123456"));
-
-        let request: TokenRequest = serde_json::from_value(json!({
-            "grant_type": PRE_AUTHORIZED_CODE_GRANT_TYPE,
-            "pre-authorized_code": "pre-auth-code-123"
-        }))
-        .expect("json decodes into TokenRequest");
-        assert_eq!(
-            request.pre_authorized_code.as_deref(),
-            Some("pre-auth-code-123")
-        );
-        assert_eq!(request.tx_code, None);
-    }
-
-    #[test]
-    fn token_response_serialises_access_token_and_c_nonce() {
-        let response = TokenResponse {
-            access_token: "access-token-abc".to_string(),
-            token_type: "Bearer".to_string(),
-            expires_in: Some(300),
-            c_nonce: Some("c-nonce-xyz".to_string()),
-            c_nonce_expires_in: Some(120),
-        };
-        let value = serde_json::to_value(&response).expect("serializes");
-
-        assert_eq!(value["access_token"], "access-token-abc");
-        assert_eq!(value["token_type"], "Bearer");
-        assert_eq!(value["expires_in"], 300);
-        assert_eq!(value["c_nonce"], "c-nonce-xyz");
-        assert_eq!(value["c_nonce_expires_in"], 120);
-
-        let round_tripped: TokenResponse =
-            serde_json::from_value(value).expect("round-trip deserializes");
-        assert_eq!(round_tripped.access_token, "access-token-abc");
-        assert_eq!(round_tripped.c_nonce.as_deref(), Some("c-nonce-xyz"));
-    }
-
-    #[test]
-    fn credential_response_supports_legacy_and_credentials_shapes() {
-        let legacy = CredentialResponse {
-            credential: "credential-1".into(),
-            credentials: Vec::new(),
-            format: Some(SD_JWT_VC_FORMAT.to_string()),
-            c_nonce: None,
-            c_nonce_expires_in: None,
-        };
-        let legacy_value = serde_json::to_value(&legacy).expect("serializes");
-
-        assert_eq!(legacy_value["credential"], "credential-1");
-        assert!(legacy_value.get("credentials").is_none());
-
-        let response = CredentialResponse {
-            credential: "credential-1".into(),
-            credentials: vec![CredentialResponseCredential {
-                credential: "credential-1".into(),
-            }],
-            format: Some(SD_JWT_VC_FORMAT.to_string()),
-            c_nonce: None,
-            c_nonce_expires_in: None,
-        };
-        let value = serde_json::to_value(&response).expect("serializes");
-
-        assert_eq!(value["credential"], "credential-1");
-        assert_eq!(
-            value["credentials"],
-            json!([{"credential": "credential-1"}])
-        );
-
-        let parsed = serde_json::from_value::<CredentialResponse>(json!({
-            "credentials": [{"credential": "credential-2"}],
-            "format": SD_JWT_VC_FORMAT
-        }))
-        .expect("1.0 response parses");
-
-        assert_eq!(parsed.credential, CredentialValue::from("credential-2"));
-        assert_eq!(
-            parsed.credentials[0].credential,
-            CredentialValue::from("credential-2")
-        );
-        assert_eq!(parsed.format.as_deref(), Some(SD_JWT_VC_FORMAT));
-
-        let parsed = serde_json::from_value::<CredentialResponse>(json!({
-            "credentials": [{"credential": {"id": "credential-object"}}]
-        }))
-        .expect("1.0 object credential parses");
-        assert_eq!(
-            parsed.credentials[0].credential,
-            CredentialValue::Object(json!({"id": "credential-object"}))
-        );
-    }
-
-    #[test]
-    fn debug_redacts_oid4vci_secrets() {
-        let offer = CredentialOffer::pre_authorized_code(
-            "https://issuer.example",
-            vec!["person".to_string()],
-            "pre-auth-code-secret",
-            Some(TxCode::new(6, Some("tx-code-secret".to_string()))),
-        );
-        let token_request = TokenRequest {
-            grant_type: PRE_AUTHORIZED_CODE_GRANT_TYPE.to_string(),
-            pre_authorized_code: Some("pre-auth-code-secret".to_string()),
-            tx_code: Some("tx-code-secret".to_string()),
-        };
-        let token_response = TokenResponse {
-            access_token: "access-token-secret".to_string(),
-            token_type: "Bearer".to_string(),
-            expires_in: Some(300),
-            c_nonce: Some("c-nonce-secret".to_string()),
-            c_nonce_expires_in: Some(120),
-        };
-        let nonce_response = NonceResponse {
-            c_nonce: "nonce-secret".to_string(),
-            c_nonce_expires_in: 120,
-        };
-        let credential_response = CredentialResponse {
-            credential: "credential-secret".into(),
-            credentials: vec![CredentialResponseCredential {
-                credential: "credential-secret-2".into(),
-            }],
-            format: Some(SD_JWT_VC_FORMAT.to_string()),
-            c_nonce: Some("credential-nonce-secret".to_string()),
-            c_nonce_expires_in: Some(120),
-        };
-        let holder_jwk = PrivateJwk::parse(RAW_JWK).expect("key parses").public();
-        let validated_proof = ValidatedProof {
-            holder_jwk,
-            holder_id: "did:jwk:holder".to_string(),
-            kid: Some("kid-1".to_string()),
-            nonce: Some("validated-nonce-secret".to_string()),
-            iat: 1000,
-            exp: Some(1060),
-            raw_claims: json!({"nonce": "validated-nonce-secret"}),
-        };
-        let credential_request_proof = CredentialRequestProof {
-            proof_type: "jwt".to_string(),
-            jwt: "proof-jwt-secret".to_string(),
-        };
-
-        let debug = format!(
-            "{offer:?} {token_request:?} {token_response:?} {nonce_response:?} {credential_response:?} {validated_proof:?} {credential_request_proof:?}"
-        );
-
-        for secret in [
-            "pre-auth-code-secret",
-            "tx-code-secret",
-            "access-token-secret",
-            "c-nonce-secret",
-            "nonce-secret",
-            "credential-secret",
-            "credential-secret-2",
-            "credential-nonce-secret",
-            "validated-nonce-secret",
-            "proof-jwt-secret",
-        ] {
-            assert!(!debug.contains(secret), "debug leaked {secret}");
-        }
-        assert!(debug.contains("<redacted>"));
-        assert!(debug.contains("https://issuer.example"));
-        // Non-secret fields stay visible.
-        assert!(debug.contains("did:jwk:holder"));
-        assert!(debug.contains("kid-1"));
-    }
-
-    #[test]
-    fn token_response_omits_c_nonce_expires_in_when_absent() {
-        let response = TokenResponse {
-            access_token: "access-token-abc".to_string(),
-            token_type: "Bearer".to_string(),
-            expires_in: Some(300),
-            c_nonce: Some("c-nonce-xyz".to_string()),
-            c_nonce_expires_in: None,
-        };
-        let value = serde_json::to_value(&response).expect("serializes");
-
-        assert!(value.get("c_nonce_expires_in").is_none());
-    }
-
-    #[test]
-    fn credential_issuer_metadata_token_endpoint_serialisation() {
-        let metadata = CredentialIssuerMetadata::new(
-            "https://issuer.example",
-            "https://issuer.example/credential",
-            None,
-            Vec::new(),
-            BTreeMap::new(),
-        );
-        let value = serde_json::to_value(&metadata).expect("serializes");
-        assert!(value.get("token_endpoint").is_none());
-
-        let metadata = metadata.with_token_endpoint("https://issuer.example/token".to_string());
-        let value = serde_json::to_value(&metadata).expect("serializes");
-        assert_eq!(value["token_endpoint"], "https://issuer.example/token");
-
-        let round_tripped: CredentialIssuerMetadata =
-            serde_json::from_value(value).expect("round-trip deserializes");
-        assert_eq!(
-            round_tripped.token_endpoint.as_deref(),
-            Some("https://issuer.example/token")
-        );
-    }
-
-    fn policy(expected_nonce: Option<&str>) -> ProofValidationPolicy<'_> {
-        ProofValidationPolicy {
-            audience: "https://issuer.example",
-            expected_nonce,
-            issuer: ProofIssuerPolicy::Optional,
-            max_lifetime: Duration::from_secs(300),
-            future_skew: Duration::from_secs(30),
-            forbidden_holder_keys: &[],
-        }
-    }
-
-    fn valid_proof(key: &PrivateJwk, nonce: &str) -> String {
-        let holder_id = did_jwk_from_public_jwk(&key.public()).expect("did:jwk encodes");
-        sign_proof(
-            json!({"alg":"EdDSA","typ":PROOF_JWT_TYPE,"jwk": key.public()}),
-            json!({"iss":holder_id,"aud":"https://issuer.example","iat":1000,"exp":1060,"nonce": nonce}),
-            key,
-        )
-    }
-
-    fn sign_proof(header: Value, payload: Value, key: &PrivateJwk) -> String {
-        let header = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&header).expect("header"));
-        let payload = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&payload).expect("payload"));
-        let signing_input = format!("{header}.{payload}");
-        let signature = URL_SAFE_NO_PAD.encode(sign(signing_input.as_bytes(), key).expect("sign"));
-        format!("{signing_input}.{signature}")
-    }
-}
diff --git a/crates/registry-platform-oidc/README.md b/crates/registry-platform-oidc/README.md
index f83036412..79a638fbd 100644
--- a/crates/registry-platform-oidc/README.md
+++ b/crates/registry-platform-oidc/README.md
@@ -59,10 +59,10 @@ async fn build_verifier() -> Result<TokenVerifier, Box<dyn std::error::Error>> {
   development.
 - Discovery, returned JWKS URI validation, and JWKS refreshes are bound by the
   configured timeout, including DNS validation.
-- Use the named profiles for standard Relay and Notary flows so related ID token
-  and UserInfo JWT `typ` checks stay aligned. Allowed access-token algorithms
-  and token types remain explicit inputs; keep `allowed_algorithms` as narrow as
-  the provider allows.
+- Use the named profiles for standard Relay flows so related ID token and
+  UserInfo JWT `typ` checks stay aligned. Allowed access-token algorithms and
+  token types remain explicit inputs; keep `allowed_algorithms` as narrow as the
+  provider allows.
 - `kid` values are capped generously and unknown `kid` entries are evicted from
   the negative cache to keep issuer compatibility without unbounded memory use.
   Negative `kid` entries are retried after the forced-refresh cooldown so real
diff --git a/crates/registry-platform-oidc/src/lib.rs b/crates/registry-platform-oidc/src/lib.rs
index 102de8c66..26f5e4554 100644
--- a/crates/registry-platform-oidc/src/lib.rs
+++ b/crates/registry-platform-oidc/src/lib.rs
@@ -118,6 +118,17 @@ pub struct JwksFetcherConfig {
     pub refresh_cooldown: Duration,
     pub max_doc_bytes: u64,
     pub request_timeout: Duration,
+    /// How long past `cache_ttl` a key set already held keeps being served when
+    /// the issuer cannot be reached to replace it.
+    ///
+    /// An expired cache is not a statement that the keys in it are wrong; it is
+    /// a statement that they have not been rechecked. Discarding them because
+    /// the issuer is briefly unreachable turns an issuer blip into total
+    /// rejection here, for keys that would have verified. The allowance is
+    /// bounded rather than open-ended because it is also the window in which a
+    /// key the issuer has since withdrawn stays trusted, and an attacker who
+    /// can keep the issuer unreachable would otherwise hold that window open.
+    pub outage_tolerance: Duration,
 }
 
 impl JwksFetcherConfig {
@@ -129,6 +140,7 @@ impl JwksFetcherConfig {
             refresh_cooldown: Duration::from_secs(30),
             max_doc_bytes: DEFAULT_DOC_BYTES,
             request_timeout: Duration::from_secs(5),
+            outage_tolerance: Duration::from_secs(900),
         }
     }
 }
@@ -139,6 +151,13 @@ struct JwksState {
     fetched_at: Option<Instant>,
     last_forced_refresh: Option<Instant>,
     negative: HashMap<String, Instant>,
+    /// Since when the issuer has been unreachable while the key set already
+    /// held stood in for the replacement, if it is standing in now.
+    ///
+    /// Kept so a caller can report a deployment that is verifying tokens
+    /// against keys it can no longer confirm. Nothing else would say so: every
+    /// such request succeeds.
+    tolerating_since: Option<Instant>,
 }
 
 #[allow(clippy::large_enum_variant)]
@@ -227,6 +246,170 @@ impl JwksFetcher {
         }
     }
 
+    /// The configured key-set location, when this fetcher has one.
+    ///
+    /// A static source has none, which is the honest answer: nothing is
+    /// fetched, so there is no address for an operator to go and check.
+    #[must_use]
+    pub fn jwks_uri(&self) -> Option<&str> {
+        match &self.source {
+            JwksSource::Http { jwks_uri, .. } => Some(jwks_uri),
+            JwksSource::Static(_) => None,
+        }
+    }
+
+    /// Confirm a usable key set is in hand, fetching one if the cache is empty
+    /// or stale.
+    ///
+    /// This answers the question a resource server has before it accepts
+    /// traffic: not whether one particular key exists, but whether the issuer's
+    /// keys can be reached at all. A deployment that cannot reach them rejects
+    /// every token presented to it, and each rejection is indistinguishable
+    /// from an invalid token.
+    ///
+    /// A fresh cache is proof enough and costs no request, so a probe repeated
+    /// every few seconds fetches at most once per `cache_ttl`. A failure is
+    /// deliberately not cached: how often to retry an issuer that is down is
+    /// the caller's decision, since only the caller knows how often it probes.
+    ///
+    /// This answers the same question the verification path asks, including
+    /// outage tolerance, so it never reports unready a deployment that is in
+    /// fact still verifying tokens. Use `outage_duration` to tell the two
+    /// apart.
+    pub async fn ensure_key_set(&self) -> Result<(), OidcError> {
+        if self
+            .has_key_set_within(Instant::now(), self.config.cache_ttl)
+            .await
+        {
+            return Ok(());
+        }
+        let _guard = self.refresh_lock.lock().await;
+        if self
+            .has_key_set_within(Instant::now(), self.config.cache_ttl)
+            .await
+        {
+            return Ok(());
+        }
+        match self.refresh(false).await {
+            Ok(()) => {
+                if self
+                    .has_key_set_within(Instant::now(), self.config.cache_ttl)
+                    .await
+                {
+                    Ok(())
+                } else {
+                    Err(OidcError::EmptyKeySet)
+                }
+            }
+            Err(error) => {
+                if self
+                    .has_key_set_within(Instant::now(), self.tolerated_age())
+                    .await
+                {
+                    self.begin_tolerating(Instant::now()).await;
+                    Ok(())
+                } else {
+                    Err(error)
+                }
+            }
+        }
+    }
+
+    /// How long this fetcher has been serving a key set the issuer could not be
+    /// asked to replace, or `None` when the key set is current.
+    ///
+    /// Exposed so the deployment can say so. A tolerated outage is invisible
+    /// from every other vantage point: requests succeed, the key set verifies,
+    /// and the only thing that has changed is that nothing has confirmed those
+    /// keys for a while.
+    pub async fn outage_duration(&self) -> Option<Duration> {
+        let now = Instant::now();
+        self.state
+            .read()
+            .await
+            .tolerating_since
+            .map(|since| now.duration_since(since))
+    }
+
+    /// The oldest a key set may be and still be served during an outage.
+    fn tolerated_age(&self) -> Duration {
+        self.config.cache_ttl + self.config.outage_tolerance
+    }
+
+    /// Whether the cache holds at least one key and is no older than `allowance`.
+    ///
+    /// Emptiness matters on its own: a key set with no keys parses, so the
+    /// fetch reports success, and every token verified against it then fails
+    /// for want of a key.
+    async fn has_key_set_within(&self, now: Instant, allowance: Duration) -> bool {
+        let state = self.state.read().await;
+        !state.keys.is_empty()
+            && state
+                .fetched_at
+                .is_some_and(|fetched| now.duration_since(fetched) <= allowance)
+    }
+
+    /// Record that the key set already held is standing in for a replacement,
+    /// keeping the start of an outage already under way.
+    async fn begin_tolerating(&self, now: Instant) {
+        let mut state = self.state.write().await;
+        state.tolerating_since.get_or_insert(now);
+    }
+
+    /// Replace an aged-out key set, or keep serving the one already held when
+    /// the issuer cannot be reached to replace it.
+    ///
+    /// An expired cache means the keys have not been rechecked, not that they
+    /// are wrong. Failing every request for want of a recheck would turn a
+    /// short issuer outage into a total one here, using keys that are sitting
+    /// in the cache and would have verified.
+    async fn refresh_or_tolerate_outage(
+        &self,
+        kid: &str,
+        forced: bool,
+    ) -> Result<JwksCacheLookup, OidcError> {
+        let error = match self.refresh_and_cached_key(kid, forced).await {
+            Ok(lookup) => return Ok(lookup),
+            Err(error) => error,
+        };
+        let now = Instant::now();
+        match self.tolerated_key(kid, now).await? {
+            Some(key) => {
+                self.begin_tolerating(now).await;
+                Ok(JwksCacheLookup::Hit(key))
+            }
+            None => Err(error),
+        }
+    }
+
+    /// The key already held for `kid`, if the key set is young enough to keep
+    /// serving through an outage.
+    async fn tolerated_key(
+        &self,
+        kid: &str,
+        now: Instant,
+    ) -> Result<Option<CachedJwkKey>, OidcError> {
+        let state = self.state.read().await;
+        if state
+            .fetched_at
+            .is_none_or(|fetched| now.duration_since(fetched) > self.tolerated_age())
+        {
+            return Ok(None);
+        }
+        let Some(jwk) = state.keys.get(kid) else {
+            return Ok(None);
+        };
+        validate_jwk(jwk)?;
+        DecodingKey::from_jwk(jwk)
+            .map(|decoding_key| {
+                Some(CachedJwkKey {
+                    decoding_key,
+                    jwk: jwk.clone(),
+                })
+            })
+            .map_err(|_| OidcError::InvalidJwk)
+    }
+
     pub async fn key_for_kid(&self, kid: &str) -> Result<DecodingKey, OidcError> {
         if kid.is_empty() {
             return Err(OidcError::MissingKid);
@@ -249,14 +432,16 @@ impl JwksFetcher {
                 return Err(OidcError::UnknownKid);
             }
             JwksCacheLookup::FreshMiss => {}
-            JwksCacheLookup::StaleOrEmpty => match self.refresh_and_cached_key(kid, false).await? {
-                JwksCacheLookup::Hit(key) => return Ok(key.decoding_key),
-                JwksCacheLookup::NegativeMiss => return Err(OidcError::UnknownKid),
-                JwksCacheLookup::FreshMiss | JwksCacheLookup::StaleOrEmpty => {
-                    self.remember_unknown_kid(kid).await;
-                    return Err(OidcError::UnknownKid);
+            JwksCacheLookup::StaleOrEmpty => {
+                match self.refresh_or_tolerate_outage(kid, false).await? {
+                    JwksCacheLookup::Hit(key) => return Ok(key.decoding_key),
+                    JwksCacheLookup::NegativeMiss => return Err(OidcError::UnknownKid),
+                    JwksCacheLookup::FreshMiss | JwksCacheLookup::StaleOrEmpty => {
+                        self.remember_unknown_kid(kid).await;
+                        return Err(OidcError::UnknownKid);
+                    }
                 }
-            },
+            }
         }
 
         if self.should_force_refresh(Instant::now()).await {
@@ -302,7 +487,9 @@ impl JwksFetcher {
             }
             JwksCacheLookup::FreshMiss => {}
             JwksCacheLookup::StaleOrEmpty => {
-                if let JwksCacheLookup::Hit(key) = self.refresh_and_cached_key(kid, false).await? {
+                if let JwksCacheLookup::Hit(key) =
+                    self.refresh_or_tolerate_outage(kid, false).await?
+                {
                     return Ok(key);
                 }
                 self.remember_unknown_kid(kid).await;
@@ -429,6 +616,7 @@ impl JwksFetcher {
         state.keys = keys;
         state.fetched_at = Some(Instant::now());
         state.negative.clear();
+        state.tolerating_since = None;
         if forced {
             state.last_forced_refresh = Some(Instant::now());
         }
@@ -598,9 +786,9 @@ impl TokenVerifierConfig {
     ///
     /// Access tokens must carry one of `allowed_typ`; an empty `allowed_typ`
     /// list fails closed. Related ID tokens and UserInfo JWTs use the project
-    /// defaults accepted by Relay and Notary:
-    /// ID token `typ` values `JWT` and `id_token`, UserInfo JWT `typ` value
-    /// `JWT`, and required UserInfo expiration by default.
+    /// defaults accepted by Relay: ID token `typ` values `JWT` and `id_token`,
+    /// UserInfo JWT `typ` value `JWT`, and required UserInfo expiration by
+    /// default.
     pub fn access_token_profile(
         issuer: impl Into<String>,
         audiences: Vec<String>,
@@ -623,22 +811,6 @@ impl TokenVerifierConfig {
         }
     }
 
-    /// Build a profile for project-specific typed request JWTs such as Notary
-    /// federation requests.
-    pub fn typed_request_profile(
-        issuer: impl Into<String>,
-        audience: impl Into<String>,
-        allowed_algorithms: Vec<Algorithm>,
-        typ: impl Into<String>,
-    ) -> Self {
-        Self::access_token_profile(
-            issuer,
-            vec![audience.into()],
-            allowed_algorithms,
-            vec![typ.into()],
-        )
-    }
-
     /// Registry Relay access-token verifier profile.
     pub fn registry_relay_access_profile(
         issuer: impl Into<String>,
@@ -649,26 +821,6 @@ impl TokenVerifierConfig {
         Self::access_token_profile(issuer, audiences, allowed_algorithms, allowed_typ)
     }
 
-    /// Registry Notary subject-access token verifier profile.
-    pub fn registry_notary_access_profile(
-        issuer: impl Into<String>,
-        audiences: Vec<String>,
-        allowed_algorithms: Vec<Algorithm>,
-        allowed_typ: Vec<String>,
-    ) -> Self {
-        Self::access_token_profile(issuer, audiences, allowed_algorithms, allowed_typ)
-    }
-
-    /// Registry Notary federation request JWT verifier profile.
-    pub fn registry_notary_federation_request_profile(
-        issuer: impl Into<String>,
-        audience: impl Into<String>,
-        allowed_algorithms: Vec<Algorithm>,
-        typ: impl Into<String>,
-    ) -> Self {
-        Self::typed_request_profile(issuer, audience, allowed_algorithms, typ)
-    }
-
     #[must_use]
     pub fn with_scope_claim(mut self, scope_claim: impl Into<String>) -> Self {
         self.scope_claim = scope_claim.into();
@@ -781,6 +933,16 @@ impl TokenVerifier {
         }
     }
 
+    /// The key source this verifier resolves signing keys through.
+    ///
+    /// Exposed so a resource server can prove at readiness that the issuer's
+    /// keys are reachable, rather than discovering they are not one rejected
+    /// request at a time.
+    #[must_use]
+    pub fn key_source(&self) -> &Arc<JwksFetcher> {
+        &self.fetcher
+    }
+
     pub async fn verify(&self, token: &str) -> Result<VerifiedToken, OidcError> {
         self.verify_access_token(token, true).await
     }
@@ -1210,6 +1372,8 @@ pub enum OidcError {
     UnknownKid,
     #[error("JWK is invalid")]
     InvalidJwk,
+    #[error("key set contains no usable keys")]
+    EmptyKeySet,
     #[error("token is expired")]
     TokenExpired,
     #[error("token is not yet valid")]
@@ -1229,12 +1393,12 @@ pub enum OidcError {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use axum::{routing::get, Json, Router};
+    use axum::{http::StatusCode, response::IntoResponse, routing::get, Json, Router};
     use base64::engine::general_purpose::URL_SAFE_NO_PAD;
     use base64::Engine;
     use jsonwebtoken::{encode, EncodingKey, Header};
     use serde_json::json;
-    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
     use tokio::net::TcpListener;
 
     async fn serve_discovery(jwks_uri: &str) -> String {
@@ -1282,6 +1446,36 @@ mod tests {
         format!("http://{addr}/jwks")
     }
 
+    /// A key-set endpoint that can be made unreachable and reachable again,
+    /// standing in for an issuer that goes down while this process keeps
+    /// running.
+    async fn serve_jwks_with_outage(
+        document: Arc<RwLock<Value>>,
+        outage: Arc<AtomicBool>,
+    ) -> String {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("bind test server");
+        let addr = listener.local_addr().expect("read listener addr");
+        let app = Router::new().route(
+            "/jwks",
+            get(move || {
+                let document = Arc::clone(&document);
+                let outage = Arc::clone(&outage);
+                async move {
+                    if outage.load(Ordering::SeqCst) {
+                        return (StatusCode::SERVICE_UNAVAILABLE, Json(json!({}))).into_response();
+                    }
+                    Json(document.read().await.clone()).into_response()
+                }
+            }),
+        );
+        tokio::spawn(async move {
+            axum::serve(listener, app).await.expect("serve test app");
+        });
+        format!("http://{addr}/jwks")
+    }
+
     fn jwks_with_kids(kids: &[&str]) -> Value {
         let keys: Vec<Value> = kids
             .iter()
@@ -1305,6 +1499,7 @@ mod tests {
             refresh_cooldown: Duration::from_secs(3600),
             max_doc_bytes: DEFAULT_DOC_BYTES,
             request_timeout: Duration::from_secs(1),
+            outage_tolerance: Duration::from_secs(3600),
         }
     }
 
@@ -1331,22 +1526,6 @@ mod tests {
         assert_eq!(config.leeway, Duration::from_secs(30));
     }
 
-    #[test]
-    fn federation_request_profile_binds_single_audience_and_type() {
-        let config = TokenVerifierConfig::registry_notary_federation_request_profile(
-            "https://peer.example",
-            "did:web:agency-a.example.gov",
-            vec![Algorithm::EdDSA],
-            "registry-notary-federation+jwt",
-        );
-
-        assert_eq!(config.audiences, vec!["did:web:agency-a.example.gov"]);
-        assert_eq!(config.allowed_typ, vec!["registry-notary-federation+jwt"]);
-        assert_eq!(config.allowed_id_typ, vec!["JWT", "id_token"]);
-        assert_eq!(config.allowed_userinfo_typ, vec!["JWT"]);
-        assert!(config.userinfo_requires_exp);
-    }
-
     fn rsa_jwk_with_modulus_bytes(kid: &str, modulus_bytes: usize) -> Jwk {
         serde_json::from_value(json!({
             "kty": "RSA",
@@ -2640,6 +2819,168 @@ mod tests {
         assert!(rendered.contains("source: Static"));
     }
 
+    #[tokio::test]
+    async fn ensure_key_set_fetches_once_and_then_answers_from_cache() {
+        let document = Arc::new(RwLock::new(jwks_with_kids(&["readiness-kid"])));
+        let requests = Arc::new(AtomicUsize::new(0));
+        let jwks_uri = serve_jwks(Arc::clone(&document), Arc::clone(&requests)).await;
+        let fetcher = JwksFetcher::new_with_fetch_url_policy(
+            jwks_uri,
+            jwks_test_config(),
+            FetchUrlPolicy::dev(),
+        );
+
+        // A readiness probe repeated every few seconds must not become an
+        // outbound request every few seconds: a fresh cache is proof enough.
+        for _ in 0..5 {
+            fetcher
+                .ensure_key_set()
+                .await
+                .expect("a reachable issuer key set is ready");
+        }
+        assert_eq!(requests.load(Ordering::SeqCst), 1);
+    }
+
+    #[tokio::test]
+    async fn ensure_key_set_reports_an_unreachable_issuer() {
+        // Port 1 on the loopback interface refuses, which is the shape of the
+        // failure an operator hits: the address resolves and nothing answers.
+        let fetcher = JwksFetcher::new_with_fetch_url_policy(
+            "http://127.0.0.1:1/jwks".to_owned(),
+            jwks_test_config(),
+            FetchUrlPolicy::dev(),
+        );
+
+        let error = fetcher
+            .ensure_key_set()
+            .await
+            .expect_err("an unreachable issuer key set is not ready");
+        assert!(matches!(error, OidcError::Transport(_)));
+    }
+
+    #[tokio::test]
+    async fn ensure_key_set_rejects_a_key_set_with_no_usable_keys() {
+        // The document parses and the fetch succeeds, so nothing below this
+        // would fail: only the emptiness distinguishes it from a healthy issuer.
+        let document = Arc::new(RwLock::new(jwks_with_kids(&[])));
+        let requests = Arc::new(AtomicUsize::new(0));
+        let jwks_uri = serve_jwks(Arc::clone(&document), Arc::clone(&requests)).await;
+        let fetcher = JwksFetcher::new_with_fetch_url_policy(
+            jwks_uri,
+            jwks_test_config(),
+            FetchUrlPolicy::dev(),
+        );
+
+        let error = fetcher
+            .ensure_key_set()
+            .await
+            .expect_err("an empty key set verifies nothing");
+        assert!(matches!(error, OidcError::EmptyKeySet));
+        assert_eq!(requests.load(Ordering::SeqCst), 1);
+    }
+
+    #[tokio::test]
+    async fn ensure_key_set_is_satisfied_by_a_static_key_set_and_names_no_uri() {
+        let keys: JwkSet =
+            serde_json::from_value(jwks_with_kids(&["static-kid"])).expect("static key set parses");
+        let fetcher = JwksFetcher::new_static(keys, jwks_test_config());
+
+        fetcher
+            .ensure_key_set()
+            .await
+            .expect("a static key set is always in hand");
+        assert!(fetcher.jwks_uri().is_none());
+    }
+
+    /// An expired cache says the keys have not been rechecked, not that they are
+    /// wrong. Discarding them because the issuer is briefly unreachable would
+    /// reject every request using keys that are sitting in the cache and would
+    /// have verified: a short outage at the issuer becomes a total one here.
+    #[tokio::test]
+    async fn an_unreachable_issuer_does_not_discard_the_key_set_already_held() {
+        let outage = Arc::new(AtomicBool::new(false));
+        let jwks_uri = serve_jwks_with_outage(
+            Arc::new(RwLock::new(jwks_with_kids(&["held-kid"]))),
+            Arc::clone(&outage),
+        )
+        .await;
+        let mut config = jwks_test_config();
+        config.cache_ttl = Duration::from_millis(50);
+        config.outage_tolerance = Duration::from_secs(3600);
+        let fetcher =
+            JwksFetcher::new_with_fetch_url_policy(jwks_uri, config, FetchUrlPolicy::dev());
+
+        fetcher
+            .key_for_kid("held-kid")
+            .await
+            .expect("the key set is retrievable to begin with");
+        assert_eq!(fetcher.outage_duration().await, None);
+
+        outage.store(true, Ordering::SeqCst);
+        tokio::time::sleep(Duration::from_millis(120)).await;
+
+        fetcher
+            .key_for_kid("held-kid")
+            .await
+            .expect("a key already held still verifies while the issuer is unreachable");
+        assert!(
+            fetcher.outage_duration().await.is_some(),
+            "the deployment can say it is running on a key set it cannot confirm"
+        );
+        fetcher
+            .ensure_key_set()
+            .await
+            .expect("readiness reports what the verification path actually does");
+
+        outage.store(false, Ordering::SeqCst);
+        tokio::time::sleep(Duration::from_millis(60)).await;
+        fetcher
+            .key_for_kid("held-kid")
+            .await
+            .expect("the issuer is reachable again");
+        assert_eq!(
+            fetcher.outage_duration().await,
+            None,
+            "a reachable issuer ends the outage"
+        );
+    }
+
+    /// The allowance is bounded because it is also the window in which a key the
+    /// issuer has withdrawn stays trusted here. Left open-ended, anyone able to
+    /// keep the issuer unreachable could hold that window open.
+    #[tokio::test]
+    async fn a_key_set_past_its_outage_allowance_is_no_longer_served() {
+        let outage = Arc::new(AtomicBool::new(false));
+        let jwks_uri = serve_jwks_with_outage(
+            Arc::new(RwLock::new(jwks_with_kids(&["expiring-kid"]))),
+            Arc::clone(&outage),
+        )
+        .await;
+        let mut config = jwks_test_config();
+        config.cache_ttl = Duration::from_millis(20);
+        config.outage_tolerance = Duration::from_millis(30);
+        let fetcher =
+            JwksFetcher::new_with_fetch_url_policy(jwks_uri, config, FetchUrlPolicy::dev());
+
+        fetcher
+            .key_for_kid("expiring-kid")
+            .await
+            .expect("the key set is retrievable to begin with");
+
+        outage.store(true, Ordering::SeqCst);
+        tokio::time::sleep(Duration::from_millis(200)).await;
+
+        let error = fetcher
+            .key_for_kid("expiring-kid")
+            .await
+            .expect_err("the allowance runs out");
+        assert!(matches!(error, OidcError::HttpStatus(503)), "{error:?}");
+        assert!(
+            fetcher.ensure_key_set().await.is_err(),
+            "readiness stops vouching for it at the same moment"
+        );
+    }
+
     #[tokio::test]
     async fn jwks_fetcher_caches_keys_until_ttl() {
         let document = Arc::new(RwLock::new(jwks_with_kids(&["cached-kid"])));
diff --git a/crates/registry-platform-ops/src/lib.rs b/crates/registry-platform-ops/src/lib.rs
index b6180b7c7..f0a8b2afb 100644
--- a/crates/registry-platform-ops/src/lib.rs
+++ b/crates/registry-platform-ops/src/lib.rs
@@ -88,9 +88,6 @@ pub const CONFIG_APPLY_REPORT_SCHEMA_V1: &str =
 pub const RELAY_POSTURE_EXAMPLE_V1: &str =
     include_str!("../examples/registry-relay.posture.valid.json");
 
-pub const NOTARY_POSTURE_EXAMPLE_V1: &str =
-    include_str!("../examples/registry-notary.posture.valid.json");
-
 pub const DEFAULT_POSTURE_ALLOWLIST_FIXTURE_V1: &str =
     include_str!("../fixtures/posture/default-allowlist.json");
 
diff --git a/crates/registry-platform-ops/tests/posture_contract.rs b/crates/registry-platform-ops/tests/posture_contract.rs
index 1e382602a..d4e985706 100644
--- a/crates/registry-platform-ops/tests/posture_contract.rs
+++ b/crates/registry-platform-ops/tests/posture_contract.rs
@@ -67,7 +67,6 @@ fn posture_examples_and_redaction_fixtures_validate() {
     let validator = posture_validator();
     for fixture in [
         registry_platform_ops::RELAY_POSTURE_EXAMPLE_V1,
-        registry_platform_ops::NOTARY_POSTURE_EXAMPLE_V1,
         registry_platform_ops::DEFAULT_REDACTED_POSTURE_FIXTURE_V1,
         registry_platform_ops::RESTRICTED_POSTURE_FIXTURE_V1,
         registry_platform_ops::RELAY_RESTRICTED_POSTURE_FIXTURE_V1,
@@ -105,24 +104,19 @@ fn relay_refresh_health_is_restricted_and_schema_valid() {
 #[test]
 fn posture_audit_shipping_state_fields_round_trip() {
     let validator = posture_validator();
-    for fixture in [
-        registry_platform_ops::RELAY_POSTURE_EXAMPLE_V1,
-        registry_platform_ops::NOTARY_POSTURE_EXAMPLE_V1,
-    ] {
-        let posture = parse(fixture);
-        assert_valid(&validator, &posture);
-        let audit = &posture["posture"]["audit"];
-        assert!(audit["shipping_target_configured"].is_boolean());
-        assert!(audit["shipping_target"].is_string());
-
-        let rendered = serde_json::to_string(&posture).expect("posture renders");
-        let reparsed: serde_json::Value =
-            serde_json::from_str(&rendered).expect("rendered posture parses");
-        assert_eq!(
-            reparsed["posture"]["audit"], posture["posture"]["audit"],
-            "shipping-state posture fields must round-trip unchanged"
-        );
-    }
+    let posture = parse(registry_platform_ops::RELAY_POSTURE_EXAMPLE_V1);
+    assert_valid(&validator, &posture);
+    let audit = &posture["posture"]["audit"];
+    assert!(audit["shipping_target_configured"].is_boolean());
+    assert!(audit["shipping_target"].is_string());
+
+    let rendered = serde_json::to_string(&posture).expect("posture renders");
+    let reparsed: serde_json::Value =
+        serde_json::from_str(&rendered).expect("rendered posture parses");
+    assert_eq!(
+        reparsed["posture"]["audit"], posture["posture"]["audit"],
+        "shipping-state posture fields must round-trip unchanged"
+    );
 
     let mut missing_shipping_state = parse(registry_platform_ops::RELAY_POSTURE_EXAMPLE_V1);
     missing_shipping_state["posture"]["audit"]
@@ -139,7 +133,6 @@ fn posture_audit_shipping_health_fields_are_required_and_enumerated() {
     // Canonical examples and fixtures carry the observed shipping-health fields.
     for fixture in [
         registry_platform_ops::RELAY_POSTURE_EXAMPLE_V1,
-        registry_platform_ops::NOTARY_POSTURE_EXAMPLE_V1,
         registry_platform_ops::DEFAULT_REDACTED_POSTURE_FIXTURE_V1,
         registry_platform_ops::RESTRICTED_POSTURE_FIXTURE_V1,
     ] {
@@ -340,7 +333,7 @@ fn default_filter_preserves_emergency_configuration_block() {
 }
 
 #[test]
-fn default_examples_are_allowlist_projections() {
+fn default_example_is_an_allowlist_projection() {
     let allowlist = parse(registry_platform_ops::DEFAULT_POSTURE_ALLOWLIST_FIXTURE_V1);
     let allowed = allowlist["allowed_json_pointers"]
         .as_array()
@@ -349,18 +342,13 @@ fn default_examples_are_allowlist_projections() {
         .map(|value| value.as_str().expect("pointer is string"))
         .collect::<Vec<_>>();
 
-    for example in [
-        registry_platform_ops::RELAY_POSTURE_EXAMPLE_V1,
-        registry_platform_ops::NOTARY_POSTURE_EXAMPLE_V1,
-    ] {
-        let posture = parse(example);
-        assert_eq!(posture["tier"], "default");
-        for pointer in collect_leaf_pointers(&posture) {
-            assert!(
-                pointer_is_allowed(&pointer, &allowed),
-                "default example contains a leaf outside the default allowlist: {pointer}"
-            );
-        }
+    let posture = parse(registry_platform_ops::RELAY_POSTURE_EXAMPLE_V1);
+    assert_eq!(posture["tier"], "default");
+    for pointer in collect_leaf_pointers(&posture) {
+        assert!(
+            pointer_is_allowed(&pointer, &allowed),
+            "default example contains a leaf outside the default allowlist: {pointer}"
+        );
     }
 }
 
diff --git a/crates/registry-platform-replay/Cargo.toml b/crates/registry-platform-replay/Cargo.toml
deleted file mode 100644
index 7aef1f143..000000000
--- a/crates/registry-platform-replay/Cargo.toml
+++ /dev/null
@@ -1,21 +0,0 @@
-[package]
-name = "registry-platform-replay"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-readme = "README.md"
-repository.workspace = true
-publish = false
-
-[lints]
-workspace = true
-
-[dependencies]
-async-trait.workspace = true
-getrandom.workspace = true
-registry-platform-cache = { workspace = true }
-thiserror.workspace = true
-time.workspace = true
-
-[dev-dependencies]
-tokio.workspace = true
diff --git a/crates/registry-platform-replay/README.md b/crates/registry-platform-replay/README.md
deleted file mode 100644
index 7fe23e42c..000000000
--- a/crates/registry-platform-replay/README.md
+++ /dev/null
@@ -1,108 +0,0 @@
-# registry-platform-replay
-
-Replay-store primitives for one-time JWT ids and nonce values.
-
-## What It Provides
-
-- `ReplayStore`, an async trait for `insert_once(scope, key, expires_at)`.
-- `ReplayScope` helpers for protocol-specific replay namespaces.
-- `ReplayKey`, a redacted-debug wrapper for one-time identifiers.
-- `ReplayInsertOutcome` for `Inserted` versus `AlreadySeen`.
-- `ConsumableNonceStore` for nonce values that are issued first and consumed
-  exactly once later.
-- `require_insert_once`, a fail-closed helper for routes where replay
-  protection is mandatory.
-- `require_consume_once`, a fail-closed helper for mandatory issued-nonce
-  consumption.
-- `CacheReplayStore` and `ConsumableNonceCacheStore`, adapters over
-  `registry-platform-cache`.
-- `InMemoryReplayStore` for tests and explicit local single-process mode.
-
-## Typical Use
-
-```rust
-use std::time::Duration;
-
-use registry_platform_replay::{require_insert_once, InMemoryReplayStore, ReplayKey, ReplayScope};
-use time::OffsetDateTime;
-
-async fn consume_nonce() -> Result<(), Box<dyn std::error::Error>> {
-let store = InMemoryReplayStore::new();
-let scope = ReplayScope::oid4vci_nonce(
-    "tenant-a",
-    "https://issuer.example.gov",
-    "disability_credential",
-)?;
-let key = ReplayKey::new("nonce-id-from-request")?;
-let expires_at = OffsetDateTime::now_utc() + Duration::from_secs(300);
-
-require_insert_once(&store, &scope, &key, expires_at).await?;
-Ok(())
-}
-```
-
-For OpenID4VCI-style issued nonces, reserve the nonce when it is issued and
-consume it when the holder proof arrives:
-
-```rust
-use registry_platform_replay::{
-    require_consume_once, ConsumableNonceStore, InMemoryConsumableNonceStore, ReplayKey,
-    ReplayScope,
-};
-use time::OffsetDateTime;
-
-async fn issued_nonce_flow() -> Result<(), Box<dyn std::error::Error>> {
-let store = InMemoryConsumableNonceStore::new();
-let scope = ReplayScope::oid4vci_nonce("tenant-a", "issuer-a", "profile-a")?;
-let key = ReplayKey::new("service-owned-nonce-digest")?;
-let expires_at = OffsetDateTime::now_utc() + std::time::Duration::from_secs(300);
-
-store.reserve_nonce(&scope, &key, expires_at).await?;
-require_consume_once(&store, &scope, &key).await?;
-Ok(())
-}
-```
-
-## Recommended Scopes
-
-- Federation request JWT `jti`: include protocol, flow, tenant, issuer,
-  audience, and credential or evaluation profile.
-- OpenID4VCI `c_nonce`: include protocol, flow, tenant, credential issuer, and
-  credential configuration id.
-- Holder proof JWT `jti`: include protocol, flow, tenant, credential issuer,
-  credential configuration id, and holder binding key id or DID.
-- Future presentation-proof nonces should follow the same pattern: protocol,
-  flow, tenant, verifier, audience or relying party, and presentation profile.
-
-Scopes are ordered and structured. Do not concatenate ad hoc strings in
-application code when a structured `ReplayScope` can carry the same boundaries.
-
-## Security Notes
-
-- Every replay record requires an absolute UTC expiry.
-- `require_insert_once` and `require_consume_once` fail closed: duplicate,
-  missing, already-consumed, and store-error cases all deny the operation.
-- Use raw `consume_nonce` only for optional or diagnostic flows. Security
-  checks must require `ReplayInsertOutcome::Inserted`.
-- The in-memory stores do not provide restart or multi-instance correctness.
-  Production consumers must own durable state implementations that preserve the
-  replay and nonce contracts.
-- Prefer `ReplayStore`, `ConsumableNonceStore`, `require_insert_once`, and
-  `require_consume_once` from this crate for replay-sensitive paths. Do not
-  call a generic cache directly where security depends on one-time insertion or
-  consume-once semantics.
-- Do not store compact JWTs, raw credentials, subject identifiers, holder
-  secrets, or token bodies as replay keys. Use a one-time identifier such as a
-  `jti`, nonce, or service-owned digest.
-- `Debug` output redacts scope values and replay keys so accidental logs do not
-  expose identifier material.
-
-## Testing
-
-```sh
-cargo test -p registry-platform-replay
-```
-
-## License
-
-Apache-2.0.
diff --git a/crates/registry-platform-replay/src/lib.rs b/crates/registry-platform-replay/src/lib.rs
deleted file mode 100644
index 507fd10bf..000000000
--- a/crates/registry-platform-replay/src/lib.rs
+++ /dev/null
@@ -1,1122 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Replay-store primitives for one-time JWT ids and nonce values.
-
-use std::{error::Error as StdError, fmt, sync::Arc};
-
-use async_trait::async_trait;
-use registry_platform_cache::{
-    CacheCompareAndSetOutcome, CacheKey, CacheKeyError, CacheSetOutcome, CacheStore,
-    CacheStoreError, InMemoryCacheStore,
-};
-use thiserror::Error;
-use time::OffsetDateTime;
-
-const NONCE_RESERVATION_PREFIX: &[u8] = b"reservation:";
-const NONCE_CONSUMED_VALUE: &[u8] = b"consumed";
-const NONCE_CONSUMED_TOMBSTONE_SECONDS: i64 = 60;
-
-/// A structured namespace for replay identifiers.
-///
-/// Scopes should include every application boundary needed to keep one protocol,
-/// issuer, tenant, credential profile, or peer from colliding with another.
-#[derive(Clone, PartialEq, Eq, Hash)]
-pub struct ReplayScope {
-    parts: Arc<[(String, String)]>,
-}
-
-impl ReplayScope {
-    /// Build a scope from ordered `(name, value)` parts.
-    ///
-    /// The first part is normally the protocol or flow name. Values are stored
-    /// as provided, but `Debug` redacts them so accidental logs do not expose
-    /// tenant ids, issuer ids, or peer ids.
-    pub fn new<I, K, V>(parts: I) -> Result<Self, ReplayKeyError>
-    where
-        I: IntoIterator<Item = (K, V)>,
-        K: Into<String>,
-        V: Into<String>,
-    {
-        let parts = parts
-            .into_iter()
-            .map(|(name, value)| validate_part(name.into(), value.into()))
-            .collect::<Result<Vec<_>, _>>()?;
-
-        if parts.is_empty() {
-            return Err(ReplayKeyError::EmptyScope);
-        }
-
-        Ok(Self {
-            parts: Arc::from(parts.into_boxed_slice()),
-        })
-    }
-
-    /// Recommended scope for Registry Notary federation request JWT `jti`
-    /// values.
-    pub fn federation_request_jwt(
-        tenant: impl Into<String>,
-        issuer: impl Into<String>,
-        audience: impl Into<String>,
-        profile: impl Into<String>,
-    ) -> Result<Self, ReplayKeyError> {
-        Self::new([
-            (
-                "protocol".to_string(),
-                "registry-notary-federation/v0.1".to_string(),
-            ),
-            ("flow".to_string(), "request-jwt".to_string()),
-            ("tenant".to_string(), tenant.into()),
-            ("issuer".to_string(), issuer.into()),
-            ("audience".to_string(), audience.into()),
-            ("profile".to_string(), profile.into()),
-        ])
-    }
-
-    /// Recommended scope for OpenID4VCI `c_nonce` consumption.
-    pub fn oid4vci_nonce(
-        tenant: impl Into<String>,
-        credential_issuer: impl Into<String>,
-        credential_configuration_id: impl Into<String>,
-    ) -> Result<Self, ReplayKeyError> {
-        Self::new([
-            ("protocol".to_string(), "openid4vci".to_string()),
-            ("flow".to_string(), "c_nonce".to_string()),
-            ("tenant".to_string(), tenant.into()),
-            ("credential_issuer".to_string(), credential_issuer.into()),
-            (
-                "credential_configuration_id".to_string(),
-                credential_configuration_id.into(),
-            ),
-        ])
-    }
-
-    /// Recommended scope for OpenID4VCI holder proof JWT `jti` values.
-    pub fn holder_proof_jwt(
-        tenant: impl Into<String>,
-        credential_issuer: impl Into<String>,
-        credential_configuration_id: impl Into<String>,
-        holder_binding: impl Into<String>,
-    ) -> Result<Self, ReplayKeyError> {
-        Self::new([
-            ("protocol".to_string(), "openid4vci".to_string()),
-            ("flow".to_string(), "holder-proof-jwt".to_string()),
-            ("tenant".to_string(), tenant.into()),
-            ("credential_issuer".to_string(), credential_issuer.into()),
-            (
-                "credential_configuration_id".to_string(),
-                credential_configuration_id.into(),
-            ),
-            ("holder_binding".to_string(), holder_binding.into()),
-        ])
-    }
-
-    #[must_use]
-    pub fn parts(&self) -> &[(String, String)] {
-        &self.parts
-    }
-}
-
-impl fmt::Debug for ReplayScope {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        let parts = self
-            .parts
-            .iter()
-            .map(|(name, value)| RedactedPart {
-                name,
-                value_len: value.len(),
-            })
-            .collect::<Vec<_>>();
-        f.debug_struct("ReplayScope")
-            .field("parts", &parts)
-            .finish()
-    }
-}
-
-#[derive(Clone, PartialEq, Eq, Hash)]
-pub struct ReplayKey {
-    value: Arc<str>,
-}
-
-impl ReplayKey {
-    /// Build a replay key from a caller-owned one-time identifier.
-    ///
-    /// Pass the smallest one-time identifier needed for replay detection, such
-    /// as a JWT `jti`, nonce, or a service-generated digest. Do not pass compact
-    /// JWTs, raw credentials, subject identifiers, or holder secrets.
-    pub fn new(value: impl Into<String>) -> Result<Self, ReplayKeyError> {
-        let value = value.into();
-        validate_value("key", &value)?;
-        Ok(Self {
-            value: Arc::from(value.into_boxed_str()),
-        })
-    }
-
-    #[must_use]
-    pub fn as_str(&self) -> &str {
-        &self.value
-    }
-}
-
-impl fmt::Debug for ReplayKey {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("ReplayKey")
-            .field(
-                "value",
-                &RedactedValue {
-                    len: self.value.len(),
-                },
-            )
-            .finish()
-    }
-}
-
-/// Result of an attempt to record a one-time replay identifier.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-#[must_use = "check ReplayInsertOutcome::Inserted or use require_insert_once/require_consume_once for fail-closed replay protection"]
-pub enum ReplayInsertOutcome {
-    /// The scoped key was not already active and is now recorded until expiry.
-    Inserted,
-    /// The scoped key already exists and has not expired.
-    AlreadySeen,
-}
-
-/// Async replay store abstraction for durable or in-memory implementations.
-#[async_trait]
-pub trait ReplayStore: Send + Sync {
-    /// Insert a scoped key exactly once until `expires_at`.
-    ///
-    /// `expires_at` is an absolute UTC expiry. Stores should evict records after
-    /// this point and may reject records that are already expired.
-    async fn insert_once(
-        &self,
-        scope: &ReplayScope,
-        key: &ReplayKey,
-        expires_at: OffsetDateTime,
-    ) -> Result<ReplayInsertOutcome, ReplayStoreError>;
-}
-
-#[async_trait]
-pub trait ConsumableNonceStore: Send + Sync {
-    /// Reserve a nonce until it is consumed or expires.
-    async fn reserve_nonce(
-        &self,
-        scope: &ReplayScope,
-        key: &ReplayKey,
-        expires_at: OffsetDateTime,
-    ) -> Result<(), ReplayStoreError>;
-
-    /// Consume a nonce and report whether it existed and had not expired.
-    ///
-    /// Callers that require nonce replay protection should prefer
-    /// [`require_consume_once`] so missing, already-consumed, and store-error
-    /// cases all fail closed.
-    async fn consume_nonce(
-        &self,
-        scope: &ReplayScope,
-        key: &ReplayKey,
-    ) -> Result<ReplayInsertOutcome, ReplayStoreError>;
-}
-
-#[derive(Clone)]
-pub struct CacheReplayStore {
-    cache: Arc<dyn CacheStore>,
-    key_prefix: Arc<str>,
-}
-
-impl CacheReplayStore {
-    #[must_use]
-    pub fn new(cache: Arc<dyn CacheStore>, key_prefix: impl Into<String>) -> Self {
-        Self {
-            cache,
-            key_prefix: Arc::from(key_prefix.into().into_boxed_str()),
-        }
-    }
-
-    pub async fn check_ready(&self) -> Result<(), ReplayStoreError> {
-        self.cache.check_ready().await.map_err(Into::into)
-    }
-
-    pub fn cache_key(
-        &self,
-        flow: &str,
-        scope: &ReplayScope,
-        key: &ReplayKey,
-    ) -> Result<CacheKey, ReplayStoreError> {
-        Ok(replay_cache_key(&self.key_prefix, flow, scope, key)?)
-    }
-}
-
-impl fmt::Debug for CacheReplayStore {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("CacheReplayStore")
-            .field("key_prefix", &self.key_prefix)
-            .field("cache", &"<redacted>")
-            .finish()
-    }
-}
-
-#[async_trait]
-impl ReplayStore for CacheReplayStore {
-    async fn insert_once(
-        &self,
-        scope: &ReplayScope,
-        key: &ReplayKey,
-        expires_at: OffsetDateTime,
-    ) -> Result<ReplayInsertOutcome, ReplayStoreError> {
-        let cache_key = self.cache_key("one-time", scope, key)?;
-        let outcome = self
-            .cache
-            .set_if_absent(&cache_key, b"1", expires_at)
-            .await?;
-        Ok(match outcome {
-            CacheSetOutcome::Stored => ReplayInsertOutcome::Inserted,
-            CacheSetOutcome::AlreadyExists => ReplayInsertOutcome::AlreadySeen,
-        })
-    }
-}
-
-#[derive(Clone)]
-pub struct ConsumableNonceCacheStore {
-    cache: Arc<dyn CacheStore>,
-    key_prefix: Arc<str>,
-}
-
-impl ConsumableNonceCacheStore {
-    #[must_use]
-    pub fn new(cache: Arc<dyn CacheStore>, key_prefix: impl Into<String>) -> Self {
-        Self {
-            cache,
-            key_prefix: Arc::from(key_prefix.into().into_boxed_str()),
-        }
-    }
-
-    pub async fn check_ready(&self) -> Result<(), ReplayStoreError> {
-        self.cache.check_ready().await.map_err(Into::into)
-    }
-
-    pub fn cache_key(
-        &self,
-        scope: &ReplayScope,
-        key: &ReplayKey,
-    ) -> Result<CacheKey, ReplayStoreError> {
-        Ok(replay_cache_key(&self.key_prefix, "nonce", scope, key)?)
-    }
-}
-
-impl fmt::Debug for ConsumableNonceCacheStore {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("ConsumableNonceCacheStore")
-            .field("key_prefix", &self.key_prefix)
-            .field("cache", &"<redacted>")
-            .finish()
-    }
-}
-
-#[async_trait]
-impl ConsumableNonceStore for ConsumableNonceCacheStore {
-    async fn reserve_nonce(
-        &self,
-        scope: &ReplayScope,
-        key: &ReplayKey,
-        expires_at: OffsetDateTime,
-    ) -> Result<(), ReplayStoreError> {
-        let cache_key = self.cache_key(scope, key)?;
-        let reservation = nonce_reservation_value()?;
-        match self
-            .cache
-            .set_if_absent(&cache_key, &reservation, expires_at)
-            .await?
-        {
-            CacheSetOutcome::Stored => Ok(()),
-            CacheSetOutcome::AlreadyExists => Err(ReplayStoreError::Operation {
-                message: "nonce is already reserved".to_string(),
-            }),
-        }
-    }
-
-    async fn consume_nonce(
-        &self,
-        scope: &ReplayScope,
-        key: &ReplayKey,
-    ) -> Result<ReplayInsertOutcome, ReplayStoreError> {
-        let cache_key = self.cache_key(scope, key)?;
-        let Some(reservation) = self.cache.get(&cache_key).await? else {
-            return Ok(ReplayInsertOutcome::AlreadySeen);
-        };
-        if reservation == NONCE_CONSUMED_VALUE {
-            return Ok(ReplayInsertOutcome::AlreadySeen);
-        }
-        match self
-            .cache
-            .compare_and_set(
-                &cache_key,
-                &reservation,
-                NONCE_CONSUMED_VALUE,
-                OffsetDateTime::now_utc()
-                    + time::Duration::seconds(NONCE_CONSUMED_TOMBSTONE_SECONDS),
-            )
-            .await?
-        {
-            // Retain the consumed value so an immediate reserve or concurrent
-            // consume cannot treat the nonce as a fresh generation.
-            CacheCompareAndSetOutcome::Stored => Ok(ReplayInsertOutcome::Inserted),
-            CacheCompareAndSetOutcome::Mismatch | CacheCompareAndSetOutcome::Missing => {
-                Ok(ReplayInsertOutcome::AlreadySeen)
-            }
-        }
-    }
-}
-
-/// In-memory replay store for tests and single-process development.
-///
-/// This store does not provide cross-process or active-active protection. Use a
-/// durable shared backend for production multi-instance deployments.
-#[derive(Debug, Clone)]
-pub struct InMemoryReplayStore {
-    cache: InMemoryCacheStore,
-    replay: CacheReplayStore,
-}
-
-pub const DEFAULT_IN_MEMORY_REPLAY_MAX_ENTRIES: usize = 4096;
-
-impl InMemoryReplayStore {
-    #[must_use]
-    pub fn new() -> Self {
-        Self::with_max_entries(DEFAULT_IN_MEMORY_REPLAY_MAX_ENTRIES)
-    }
-
-    #[must_use]
-    pub fn with_max_entries(max_entries: usize) -> Self {
-        let cache = InMemoryCacheStore::with_max_entries(max_entries);
-        let replay = CacheReplayStore::new(Arc::new(cache.clone()), "registry-platform-replay");
-        Self { cache, replay }
-    }
-
-    pub fn len(&self) -> usize {
-        self.cache.len()
-    }
-
-    pub fn is_empty(&self) -> bool {
-        self.cache.is_empty()
-    }
-
-    pub fn purge_expired(&self, now: OffsetDateTime) -> usize {
-        self.cache.purge_expired(now)
-    }
-}
-
-impl Default for InMemoryReplayStore {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-#[async_trait]
-impl ReplayStore for InMemoryReplayStore {
-    async fn insert_once(
-        &self,
-        scope: &ReplayScope,
-        key: &ReplayKey,
-        expires_at: OffsetDateTime,
-    ) -> Result<ReplayInsertOutcome, ReplayStoreError> {
-        self.replay.insert_once(scope, key, expires_at).await
-    }
-}
-
-pub const DEFAULT_IN_MEMORY_NONCE_MAX_ENTRIES: usize = 4096;
-
-#[derive(Debug, Clone)]
-pub struct InMemoryConsumableNonceStore {
-    cache: InMemoryCacheStore,
-    nonces: ConsumableNonceCacheStore,
-}
-
-impl InMemoryConsumableNonceStore {
-    #[must_use]
-    pub fn new() -> Self {
-        Self::with_max_entries(DEFAULT_IN_MEMORY_NONCE_MAX_ENTRIES)
-    }
-
-    #[must_use]
-    pub fn with_max_entries(max_entries: usize) -> Self {
-        let cache = InMemoryCacheStore::with_max_entries(max_entries);
-        let nonces =
-            ConsumableNonceCacheStore::new(Arc::new(cache.clone()), "registry-platform-replay");
-        Self { cache, nonces }
-    }
-
-    #[must_use]
-    pub fn len(&self) -> usize {
-        self.cache.len()
-    }
-
-    #[must_use]
-    pub fn is_empty(&self) -> bool {
-        self.cache.is_empty()
-    }
-}
-
-impl Default for InMemoryConsumableNonceStore {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-#[async_trait]
-impl ConsumableNonceStore for InMemoryConsumableNonceStore {
-    async fn reserve_nonce(
-        &self,
-        scope: &ReplayScope,
-        key: &ReplayKey,
-        expires_at: OffsetDateTime,
-    ) -> Result<(), ReplayStoreError> {
-        self.nonces.reserve_nonce(scope, key, expires_at).await
-    }
-
-    async fn consume_nonce(
-        &self,
-        scope: &ReplayScope,
-        key: &ReplayKey,
-    ) -> Result<ReplayInsertOutcome, ReplayStoreError> {
-        self.nonces.consume_nonce(scope, key).await
-    }
-}
-
-/// Record a replay key when replay protection is required.
-///
-/// This helper is intentionally fail closed: store errors and duplicate keys are
-/// both returned as errors so callers can deny the request.
-pub async fn require_insert_once(
-    store: &dyn ReplayStore,
-    scope: &ReplayScope,
-    key: &ReplayKey,
-    expires_at: OffsetDateTime,
-) -> Result<(), RequiredReplayError> {
-    match store.insert_once(scope, key, expires_at).await {
-        Ok(ReplayInsertOutcome::Inserted) => Ok(()),
-        Ok(ReplayInsertOutcome::AlreadySeen) => Err(RequiredReplayError::AlreadySeen),
-        Err(source) => Err(RequiredReplayError::Store { source }),
-    }
-}
-
-/// Consume a pre-reserved nonce when replay protection is required.
-///
-/// This helper is intentionally fail closed: store errors and missing or
-/// already-consumed nonces are both returned as errors so callers can deny the
-/// request.
-pub async fn require_consume_once(
-    store: &dyn ConsumableNonceStore,
-    scope: &ReplayScope,
-    key: &ReplayKey,
-) -> Result<(), RequiredReplayError> {
-    match store.consume_nonce(scope, key).await {
-        Ok(ReplayInsertOutcome::Inserted) => Ok(()),
-        Ok(ReplayInsertOutcome::AlreadySeen) => Err(RequiredReplayError::AlreadySeen),
-        Err(source) => Err(RequiredReplayError::Store { source }),
-    }
-}
-
-#[derive(Debug, Error, PartialEq, Eq)]
-#[non_exhaustive]
-pub enum ReplayKeyError {
-    #[error("replay scope must contain at least one part")]
-    EmptyScope,
-    #[error("replay {field} must not be empty")]
-    EmptyValue { field: &'static str },
-    #[error("replay {field} must not contain ASCII control characters")]
-    ControlCharacter { field: &'static str },
-}
-
-#[derive(Debug, Error)]
-#[non_exhaustive]
-pub enum ReplayStoreError {
-    #[error("replay record expiry must be in the future")]
-    ExpiredRecord { expires_at: OffsetDateTime },
-    #[error("replay store is unavailable: {source}")]
-    Unavailable {
-        #[source]
-        source: Box<dyn StdError + Send + Sync>,
-    },
-    #[error("replay store operation failed: {message}")]
-    Operation { message: String },
-}
-
-impl From<CacheStoreError> for ReplayStoreError {
-    fn from(error: CacheStoreError) -> Self {
-        match error {
-            CacheStoreError::ExpiredRecord { expires_at } => Self::ExpiredRecord { expires_at },
-            CacheStoreError::Unavailable { source } => Self::Unavailable { source },
-            CacheStoreError::Operation { message } => Self::Operation { message },
-            other => Self::Operation {
-                message: other.to_string(),
-            },
-        }
-    }
-}
-
-impl From<CacheKeyError> for ReplayStoreError {
-    fn from(error: CacheKeyError) -> Self {
-        Self::Operation {
-            message: error.to_string(),
-        }
-    }
-}
-
-#[derive(Debug, Error)]
-#[non_exhaustive]
-pub enum RequiredReplayError {
-    #[error("replay key was already seen")]
-    AlreadySeen,
-    #[error("required replay protection failed closed: {source}")]
-    Store {
-        #[source]
-        source: ReplayStoreError,
-    },
-}
-
-fn replay_cache_key(
-    key_prefix: &str,
-    flow: &str,
-    scope: &ReplayScope,
-    key: &ReplayKey,
-) -> Result<CacheKey, CacheKeyError> {
-    let mut parts = Vec::with_capacity(scope.parts().len() + 1);
-    for (name, value) in scope.parts() {
-        parts.push((name.as_str(), value.as_str()));
-    }
-    parts.push(("key", key.as_str()));
-    CacheKey::from_hashed_parts(key_prefix, flow, parts)
-}
-
-fn nonce_reservation_value() -> Result<Vec<u8>, ReplayStoreError> {
-    let mut random = [0_u8; 16];
-    getrandom::fill(&mut random).map_err(|_| ReplayStoreError::Operation {
-        message: "failed to generate nonce reservation value".to_string(),
-    })?;
-    let mut value = Vec::with_capacity(NONCE_RESERVATION_PREFIX.len() + random.len());
-    value.extend_from_slice(NONCE_RESERVATION_PREFIX);
-    value.extend_from_slice(&random);
-    Ok(value)
-}
-
-struct RedactedPart<'a> {
-    name: &'a str,
-    value_len: usize,
-}
-
-impl fmt::Debug for RedactedPart<'_> {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("ReplayScopePart")
-            .field("name", &self.name)
-            .field("value_len", &self.value_len)
-            .finish()
-    }
-}
-
-struct RedactedValue {
-    len: usize,
-}
-
-impl fmt::Debug for RedactedValue {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("RedactedValue")
-            .field("len", &self.len)
-            .finish()
-    }
-}
-
-fn validate_part(name: String, value: String) -> Result<(String, String), ReplayKeyError> {
-    validate_value("scope part name", &name)?;
-    validate_value("scope part value", &value)?;
-    Ok((name, value))
-}
-
-fn validate_value(field: &'static str, value: &str) -> Result<(), ReplayKeyError> {
-    if value.is_empty() {
-        return Err(ReplayKeyError::EmptyValue { field });
-    }
-    if value.chars().any(|ch| ch.is_ascii_control()) {
-        return Err(ReplayKeyError::ControlCharacter { field });
-    }
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use std::sync::Arc;
-    use std::time::Duration;
-
-    use super::*;
-
-    fn scope(name: &str) -> ReplayScope {
-        ReplayScope::new([("protocol", name), ("issuer", "issuer-a")]).expect("valid scope")
-    }
-
-    fn key(value: &str) -> ReplayKey {
-        ReplayKey::new(value).expect("valid key")
-    }
-
-    fn future() -> OffsetDateTime {
-        OffsetDateTime::now_utc() + Duration::from_secs(60)
-    }
-
-    #[tokio::test]
-    async fn duplicate_keys_are_rejected_until_expiry() {
-        let store = InMemoryReplayStore::new();
-        let scope = scope("openid4vci");
-        let key = key("nonce-1");
-
-        assert_eq!(
-            store.insert_once(&scope, &key, future()).await.unwrap(),
-            ReplayInsertOutcome::Inserted
-        );
-        assert_eq!(
-            store.insert_once(&scope, &key, future()).await.unwrap(),
-            ReplayInsertOutcome::AlreadySeen
-        );
-    }
-
-    #[tokio::test]
-    async fn same_key_is_accepted_after_expiry() {
-        let store = InMemoryReplayStore::new();
-        let scope = scope("openid4vci");
-        let key = key("nonce-1");
-
-        assert_eq!(
-            store
-                .insert_once(
-                    &scope,
-                    &key,
-                    OffsetDateTime::now_utc() + Duration::from_millis(10),
-                )
-                .await
-                .unwrap(),
-            ReplayInsertOutcome::Inserted
-        );
-        tokio::time::sleep(Duration::from_millis(20)).await;
-        assert_eq!(
-            store.insert_once(&scope, &key, future()).await.unwrap(),
-            ReplayInsertOutcome::Inserted
-        );
-    }
-
-    #[tokio::test]
-    async fn expired_records_can_be_purged_without_insert_scan() {
-        let store = InMemoryReplayStore::new();
-        let first_scope = scope("openid4vci");
-        let second_scope = scope("federation");
-        let first_key = key("nonce-1");
-        let second_key = key("nonce-2");
-
-        let now = OffsetDateTime::now_utc();
-        assert_eq!(
-            store
-                .insert_once(&first_scope, &first_key, now + Duration::from_millis(10))
-                .await
-                .expect("first insert succeeds"),
-            ReplayInsertOutcome::Inserted
-        );
-        assert_eq!(
-            store
-                .insert_once(&second_scope, &second_key, now + Duration::from_secs(60))
-                .await
-                .expect("second insert succeeds"),
-            ReplayInsertOutcome::Inserted
-        );
-        tokio::time::sleep(Duration::from_millis(20)).await;
-
-        assert_eq!(store.len(), 2);
-        assert_eq!(store.purge_expired(OffsetDateTime::now_utc()), 1);
-        assert_eq!(store.len(), 1);
-        assert!(!store.is_empty());
-    }
-
-    #[tokio::test]
-    async fn cross_scope_keys_do_not_collide() {
-        let store = InMemoryReplayStore::new();
-        let first_scope =
-            ReplayScope::oid4vci_nonce("tenant-a", "issuer-a", "profile-a").expect("valid scope");
-        let second_scope =
-            ReplayScope::holder_proof_jwt("tenant-a", "issuer-a", "profile-a", "did:jwk:holder-a")
-                .expect("valid scope");
-        let key = key("shared-jti");
-
-        assert_eq!(
-            store
-                .insert_once(&first_scope, &key, future())
-                .await
-                .unwrap(),
-            ReplayInsertOutcome::Inserted
-        );
-        assert_eq!(
-            store
-                .insert_once(&second_scope, &key, future())
-                .await
-                .unwrap(),
-            ReplayInsertOutcome::Inserted
-        );
-    }
-
-    #[tokio::test]
-    async fn concurrent_inserts_cannot_both_succeed() {
-        let store = Arc::new(InMemoryReplayStore::new());
-        let scope = scope("openid4vci");
-        let key = key("nonce-1");
-        let mut tasks = Vec::new();
-
-        for _ in 0..16 {
-            let store = Arc::clone(&store);
-            let scope = scope.clone();
-            let key = key.clone();
-            tasks.push(tokio::spawn(async move {
-                store.insert_once(&scope, &key, future()).await.unwrap()
-            }));
-        }
-
-        let mut inserted = 0;
-        let mut already_seen = 0;
-        for task in tasks {
-            match task.await.expect("task joins") {
-                ReplayInsertOutcome::Inserted => inserted += 1,
-                ReplayInsertOutcome::AlreadySeen => already_seen += 1,
-            }
-        }
-
-        assert_eq!(inserted, 1);
-        assert_eq!(already_seen, 15);
-    }
-
-    #[tokio::test]
-    async fn in_memory_replay_store_enforces_capacity() {
-        let store = InMemoryReplayStore::with_max_entries(1);
-        let scope = scope("openid4vci");
-
-        assert_eq!(
-            store
-                .insert_once(&scope, &key("nonce-1"), future())
-                .await
-                .expect("first replay key stores"),
-            ReplayInsertOutcome::Inserted
-        );
-        let err = store
-            .insert_once(&scope, &key("nonce-2"), future())
-            .await
-            .expect_err("capacity failure is surfaced");
-        assert!(err.to_string().contains("in-memory cache store is full"));
-    }
-
-    #[tokio::test]
-    async fn in_memory_replay_capacity_purges_expired_records() {
-        let store = InMemoryReplayStore::with_max_entries(1);
-        let scope = scope("openid4vci");
-
-        assert_eq!(
-            store
-                .insert_once(
-                    &scope,
-                    &key("nonce-1"),
-                    OffsetDateTime::now_utc() + Duration::from_millis(10),
-                )
-                .await
-                .expect("first replay key stores"),
-            ReplayInsertOutcome::Inserted
-        );
-        tokio::time::sleep(Duration::from_millis(20)).await;
-        assert_eq!(
-            store
-                .insert_once(&scope, &key("nonce-2"), future())
-                .await
-                .expect("expired record is purged before capacity is enforced"),
-            ReplayInsertOutcome::Inserted
-        );
-        assert_eq!(store.len(), 1);
-    }
-
-    #[tokio::test]
-    async fn required_helper_fails_closed_on_duplicates() {
-        let store = InMemoryReplayStore::new();
-        let scope = scope("openid4vci");
-        let key = key("nonce-1");
-
-        require_insert_once(&store, &scope, &key, future())
-            .await
-            .expect("first insert succeeds");
-        assert!(matches!(
-            require_insert_once(&store, &scope, &key, future()).await,
-            Err(RequiredReplayError::AlreadySeen)
-        ));
-    }
-
-    #[tokio::test]
-    async fn required_consume_helper_fails_closed_on_missing_or_duplicate_nonce() {
-        let store = InMemoryConsumableNonceStore::new();
-        let scope =
-            ReplayScope::oid4vci_nonce("tenant-a", "issuer-a", "profile-a").expect("valid scope");
-        let key = key("nonce-1");
-
-        assert!(matches!(
-            require_consume_once(&store, &scope, &key).await,
-            Err(RequiredReplayError::AlreadySeen)
-        ));
-
-        store
-            .reserve_nonce(&scope, &key, future())
-            .await
-            .expect("nonce reserves");
-        require_consume_once(&store, &scope, &key)
-            .await
-            .expect("reserved nonce consumes once");
-        assert!(matches!(
-            require_consume_once(&store, &scope, &key).await,
-            Err(RequiredReplayError::AlreadySeen)
-        ));
-    }
-
-    #[tokio::test]
-    async fn required_consume_helper_fails_closed_on_expired_nonce() {
-        let store = InMemoryConsumableNonceStore::new();
-        let scope =
-            ReplayScope::oid4vci_nonce("tenant-a", "issuer-a", "profile-a").expect("valid scope");
-        let key = key("nonce-1");
-
-        store
-            .reserve_nonce(
-                &scope,
-                &key,
-                OffsetDateTime::now_utc() + Duration::from_millis(10),
-            )
-            .await
-            .expect("nonce reserves");
-        tokio::time::sleep(Duration::from_millis(20)).await;
-
-        assert!(matches!(
-            require_consume_once(&store, &scope, &key).await,
-            Err(RequiredReplayError::AlreadySeen)
-        ));
-    }
-
-    #[tokio::test]
-    async fn required_consume_helper_fails_closed_on_store_errors() {
-        struct FailingNonceStore;
-
-        #[async_trait]
-        impl ConsumableNonceStore for FailingNonceStore {
-            async fn reserve_nonce(
-                &self,
-                _scope: &ReplayScope,
-                _key: &ReplayKey,
-                _expires_at: OffsetDateTime,
-            ) -> Result<(), ReplayStoreError> {
-                Err(ReplayStoreError::Operation {
-                    message: "simulated reserve failure".to_string(),
-                })
-            }
-
-            async fn consume_nonce(
-                &self,
-                _scope: &ReplayScope,
-                _key: &ReplayKey,
-            ) -> Result<ReplayInsertOutcome, ReplayStoreError> {
-                Err(ReplayStoreError::Operation {
-                    message: "simulated consume failure".to_string(),
-                })
-            }
-        }
-
-        let scope =
-            ReplayScope::oid4vci_nonce("tenant-a", "issuer-a", "profile-a").expect("valid scope");
-        let key = key("nonce-1");
-
-        assert!(matches!(
-            require_consume_once(&FailingNonceStore, &scope, &key).await,
-            Err(RequiredReplayError::Store { .. })
-        ));
-    }
-
-    #[tokio::test]
-    async fn consumable_nonce_store_retains_tombstone_after_consume() {
-        let store = InMemoryConsumableNonceStore::new();
-        let scope =
-            ReplayScope::oid4vci_nonce("tenant-a", "issuer-a", "profile-a").expect("valid scope");
-        let key = key("nonce-1");
-        let wrong_scope =
-            ReplayScope::oid4vci_nonce("tenant-a", "issuer-a", "profile-b").expect("valid scope");
-
-        store
-            .reserve_nonce(&scope, &key, future())
-            .await
-            .expect("nonce reserves");
-        assert_eq!(store.len(), 1);
-        assert_eq!(
-            store
-                .consume_nonce(&wrong_scope, &key)
-                .await
-                .expect("wrong scope checks cleanly"),
-            ReplayInsertOutcome::AlreadySeen
-        );
-        assert_eq!(store.len(), 1);
-        assert_eq!(
-            store
-                .consume_nonce(&scope, &key)
-                .await
-                .expect("first consume succeeds"),
-            ReplayInsertOutcome::Inserted
-        );
-        assert_eq!(store.len(), 1);
-        let reserve_error = store
-            .reserve_nonce(&scope, &key, future())
-            .await
-            .expect_err("consumed nonce cannot be reserved while its tombstone is live");
-        assert!(reserve_error.to_string().contains("already reserved"));
-        assert_eq!(
-            store
-                .consume_nonce(&scope, &key)
-                .await
-                .expect("second consume checks cleanly"),
-            ReplayInsertOutcome::AlreadySeen
-        );
-        assert_eq!(store.len(), 1);
-    }
-
-    #[tokio::test]
-    async fn consumable_nonce_store_rejects_expired_nonce_at_consume_time() {
-        let store = InMemoryConsumableNonceStore::new();
-        let scope =
-            ReplayScope::oid4vci_nonce("tenant-a", "issuer-a", "profile-a").expect("valid scope");
-        let key = key("nonce-1");
-
-        store
-            .reserve_nonce(
-                &scope,
-                &key,
-                OffsetDateTime::now_utc() + Duration::from_millis(10),
-            )
-            .await
-            .expect("nonce reserves");
-        assert_eq!(store.len(), 1);
-        tokio::time::sleep(Duration::from_millis(20)).await;
-
-        assert_eq!(
-            store
-                .consume_nonce(&scope, &key)
-                .await
-                .expect("expired consume checks cleanly"),
-            ReplayInsertOutcome::AlreadySeen
-        );
-        assert!(store.is_empty());
-    }
-
-    #[tokio::test]
-    async fn consumable_nonce_store_stale_generation_cannot_consume_rereserved_nonce() {
-        let cache = InMemoryCacheStore::new();
-        let store =
-            ConsumableNonceCacheStore::new(Arc::new(cache.clone()), "registry-platform-replay");
-        let scope =
-            ReplayScope::oid4vci_nonce("tenant-a", "issuer-a", "profile-a").expect("valid scope");
-        let key = key("nonce-1");
-        let cache_key = store.cache_key(&scope, &key).expect("cache key builds");
-
-        store
-            .reserve_nonce(
-                &scope,
-                &key,
-                OffsetDateTime::now_utc() + Duration::from_millis(10),
-            )
-            .await
-            .expect("nonce reserves");
-        let stale_generation = cache
-            .get(&cache_key)
-            .await
-            .expect("cache get succeeds")
-            .expect("stale generation exists");
-        assert!(stale_generation.starts_with(NONCE_RESERVATION_PREFIX));
-        tokio::time::sleep(Duration::from_millis(20)).await;
-
-        store
-            .reserve_nonce(&scope, &key, future())
-            .await
-            .expect("same nonce can reserve after expiry");
-        let current_generation = cache
-            .get(&cache_key)
-            .await
-            .expect("cache get succeeds")
-            .expect("current generation exists");
-        assert_ne!(stale_generation, current_generation);
-        assert_eq!(
-            cache
-                .compare_and_set(
-                    &cache_key,
-                    &stale_generation,
-                    NONCE_CONSUMED_VALUE,
-                    OffsetDateTime::now_utc() + time::Duration::seconds(60),
-                )
-                .await
-                .expect("stale compare-and-set checks cleanly"),
-            CacheCompareAndSetOutcome::Mismatch
-        );
-        assert_eq!(
-            store
-                .consume_nonce(&scope, &key)
-                .await
-                .expect("current generation consumes"),
-            ReplayInsertOutcome::Inserted
-        );
-    }
-
-    #[tokio::test]
-    async fn consumable_nonce_store_enforces_capacity() {
-        let store = InMemoryConsumableNonceStore::with_max_entries(1);
-        let scope =
-            ReplayScope::oid4vci_nonce("tenant-a", "issuer-a", "profile-a").expect("valid scope");
-
-        store
-            .reserve_nonce(&scope, &key("nonce-1"), future())
-            .await
-            .expect("first nonce reserves");
-        let err = store
-            .reserve_nonce(&scope, &key("nonce-2"), future())
-            .await
-            .expect_err("capacity failure is surfaced");
-        assert!(err.to_string().contains("in-memory cache store is full"));
-    }
-
-    #[test]
-    fn cache_replay_keys_hash_scope_and_key_material() {
-        let cache = Arc::new(registry_platform_cache::InMemoryCacheStore::new());
-        let store = CacheReplayStore::new(cache, "registry-notary");
-        let scope = ReplayScope::federation_request_jwt(
-            "tenant-secret",
-            "https://peer.example/issuer",
-            "https://notary.example",
-            "profile-sensitive",
-        )
-        .expect("valid scope");
-        let key = key("jti-sensitive-123");
-
-        let cache_key = store
-            .cache_key("one-time", &scope, &key)
-            .expect("cache key builds");
-        let rendered = cache_key.as_str();
-
-        assert!(rendered.starts_with("registry-notary:one-time:"));
-        assert!(!rendered.contains("tenant-secret"));
-        assert!(!rendered.contains("peer.example"));
-        assert!(!rendered.contains("notary.example"));
-        assert!(!rendered.contains("profile-sensitive"));
-        assert!(!rendered.contains("jti-sensitive-123"));
-    }
-
-    #[test]
-    fn debug_output_redacts_scope_values_and_key() {
-        let scope = ReplayScope::oid4vci_nonce("tenant-secret", "issuer-secret", "profile-secret")
-            .expect("valid scope");
-        let key = key("raw-secret-token-material");
-        let debug = format!("{scope:?} {key:?}");
-
-        assert!(!debug.contains("tenant-secret"));
-        assert!(!debug.contains("issuer-secret"));
-        assert!(!debug.contains("profile-secret"));
-        assert!(!debug.contains("raw-secret-token-material"));
-        assert!(debug.contains("value_len"));
-        assert!(debug.contains("len"));
-    }
-}
diff --git a/crates/registry-platform-sdjwt/src/lib.rs b/crates/registry-platform-sdjwt/src/lib.rs
index 3b00428c7..b6aeaa05a 100644
--- a/crates/registry-platform-sdjwt/src/lib.rs
+++ b/crates/registry-platform-sdjwt/src/lib.rs
@@ -76,7 +76,12 @@ impl SdJwtIssuer {
         }
 
         let mut digests = Vec::with_capacity(input.disclosures.len());
-        let mut disclosures = Vec::with_capacity(input.disclosures.len());
+        let nested_count = input
+            .object_disclosures
+            .iter()
+            .map(|object| object.fields.len())
+            .sum::<usize>();
+        let mut disclosures = Vec::with_capacity(input.disclosures.len() + nested_count);
         for disclosure in input.disclosures {
             let issued = issue_disclosure(&disclosure.name, disclosure.value)?;
             digests.push(issued.digest);
@@ -87,6 +92,21 @@ impl SdJwtIssuer {
             "_sd".to_string(),
             Value::Array(digests.into_iter().map(Value::String).collect()),
         );
+        for object in input.object_disclosures {
+            let mut object_digests = Vec::with_capacity(object.fields.len());
+            for disclosure in object.fields {
+                let issued = issue_disclosure(&disclosure.name, disclosure.value)?;
+                object_digests.push(issued.digest);
+                disclosures.push(issued.encoded);
+            }
+            sort_sd_digests(&mut object_digests);
+            payload.insert(
+                object.name,
+                json!({
+                    "_sd": object_digests,
+                }),
+            );
+        }
 
         let header = json!({
             "alg": signing_algorithm_jwa(self.signer.algorithm()),
@@ -131,6 +151,15 @@ pub struct Disclosure {
     pub value: Value,
 }
 
+/// One always-visible object container whose direct properties are separately
+/// disclosable. Nested property values remain atomic; recursive disclosure is
+/// deliberately outside this bounded helper.
+#[derive(Clone, Debug)]
+pub struct ObjectDisclosure {
+    pub name: String,
+    pub fields: Vec<Disclosure>,
+}
+
 #[derive(Clone, Debug)]
 pub struct SdJwtIssuanceInput {
     pub iss: String,
@@ -143,6 +172,7 @@ pub struct SdJwtIssuanceInput {
     pub public_claims: BTreeMap<String, Value>,
     pub cnf: Option<HolderConfirmation>,
     pub disclosures: Vec<Disclosure>,
+    pub object_disclosures: Vec<ObjectDisclosure>,
 }
 
 impl SdJwtIssuanceInput {
@@ -175,6 +205,24 @@ impl SdJwtIssuanceInput {
                 return Err(SdJwtError::InvalidInput);
             }
         }
+        for object in &self.object_disclosures {
+            if invalid_disclosure_name(&object.name)
+                || self.public_claims.contains_key(&object.name)
+                || !names.insert(object.name.as_str())
+                || object.fields.is_empty()
+                || object.fields.len() > 64
+            {
+                return Err(SdJwtError::InvalidInput);
+            }
+            let mut fields = BTreeSet::new();
+            for disclosure in &object.fields {
+                if invalid_object_property_name(&disclosure.name)
+                    || !fields.insert(disclosure.name.as_str())
+                {
+                    return Err(SdJwtError::InvalidInput);
+                }
+            }
+        }
         Ok(())
     }
 }
@@ -197,6 +245,14 @@ fn invalid_public_claim_name(value: &str) -> bool {
     invalid_disclosure_name(value)
 }
 
+fn invalid_object_property_name(value: &str) -> bool {
+    value.is_empty()
+        || value.len() > 128
+        || value == "_sd"
+        || value == "..."
+        || value.chars().any(char::is_control)
+}
+
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct SignedSdJwt {
     pub credential_id: String,
@@ -546,6 +602,7 @@ mod tests {
                     name: "claim-a".to_string(),
                     value: json!({"ok": true}),
                 }],
+                object_disclosures: Vec::new(),
             })
             .await
             .expect("issues");
@@ -778,6 +835,53 @@ mod tests {
         assert_eq!(sd, disclosure_digests);
     }
 
+    #[tokio::test]
+    async fn object_properties_are_independent_nested_disclosures() {
+        let issuer =
+            SdJwtIssuer::from_jwk(PrivateJwk::parse(RAW_JWK).expect("jwk")).expect("issuer builds");
+        let signed = issuer
+            .issue(SdJwtIssuanceInput {
+                object_disclosures: vec![ObjectDisclosure {
+                    name: "birthCertificate".to_string(),
+                    fields: vec![
+                        Disclosure {
+                            name: "givenName".to_string(),
+                            value: json!("John"),
+                        },
+                        Disclosure {
+                            name: "placeOfBirth".to_string(),
+                            value: json!({"city": "Dusseldorf", "country": "DE"}),
+                        },
+                    ],
+                }],
+                ..issue_input(None)
+            })
+            .await
+            .expect("issues");
+
+        let payload = jwt_payload(&signed.jwt);
+        assert_eq!(payload["_sd"], json!([]));
+        let nested = payload["birthCertificate"]["_sd"]
+            .as_array()
+            .expect("nested digest array");
+        assert_eq!(nested.len(), 2);
+        let names = signed
+            .jwt
+            .split('~')
+            .skip(1)
+            .filter(|segment| !segment.is_empty())
+            .map(|segment| {
+                let decoded = URL_SAFE_NO_PAD.decode(segment).expect("disclosure decodes");
+                let disclosure: Value = serde_json::from_slice(&decoded).expect("disclosure JSON");
+                disclosure[1].as_str().expect("claim name").to_owned()
+            })
+            .collect::<BTreeSet<_>>();
+        assert_eq!(
+            names,
+            BTreeSet::from(["givenName".to_string(), "placeOfBirth".to_string()])
+        );
+    }
+
     #[tokio::test]
     async fn sd_jwt_issuer_accepts_provider_without_private_jwk_at_call_site() {
         let private = PrivateJwk::parse(RAW_JWK).expect("jwk");
@@ -1073,6 +1177,7 @@ mod tests {
             public_claims: BTreeMap::new(),
             cnf,
             disclosures: Vec::new(),
+            object_disclosures: Vec::new(),
         }
     }
 
diff --git a/crates/registry-platform-sts/Cargo.toml b/crates/registry-platform-sts/Cargo.toml
deleted file mode 100644
index b04fe58a7..000000000
--- a/crates/registry-platform-sts/Cargo.toml
+++ /dev/null
@@ -1,33 +0,0 @@
-[package]
-name = "registry-platform-sts"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-readme = "README.md"
-repository.workspace = true
-publish = false
-
-[lints]
-workspace = true
-
-[dependencies]
-async-trait.workspace = true
-axum.workspace = true
-base64.workspace = true
-http.workspace = true
-hmac.workspace = true
-jsonwebtoken.workspace = true
-registry-platform-crypto = { workspace = true }
-registry-platform-audit = { workspace = true }
-registry-platform-oidc = { workspace = true }
-serde.workspace = true
-serde_json.workspace = true
-sha2.workspace = true
-subtle.workspace = true
-thiserror.workspace = true
-time.workspace = true
-tokio.workspace = true
-ulid.workspace = true
-
-[dev-dependencies]
-tower.workspace = true
diff --git a/crates/registry-platform-sts/README.md b/crates/registry-platform-sts/README.md
deleted file mode 100644
index db5793582..000000000
--- a/crates/registry-platform-sts/README.md
+++ /dev/null
@@ -1,63 +0,0 @@
-# Registry Platform STS
-
-Status: parked. The source is retained for future Assisted Access or delegation
-profile work, but this crate is not currently a workspace member or release
-artifact. It is intentionally not supported as an isolated build while parked;
-issue #298 restores workspace membership, callers, and security coverage
-together when a named consumer is promoted.
-
-Security token service primitives for exchanging a verified subject token for a
-Notary-bound transaction token.
-
-This crate intentionally owns protocol validation, rate-limit hooks, token
-minting, and the small HTTP adapter needed by Assisted Access. Deployment
-wrappers still own process configuration, durable rate-limit stores, audit sink
-wiring, and key custody.
-
-The HTTP adapter exposes:
-
-- `POST /oauth/token` for RFC 8693-shaped token exchange.
-- `GET /.well-known/oauth-authorization-server` for authorization-server
-  metadata.
-- `GET /.well-known/jwks.json` for public signing keys.
-
-`POST /oauth/token` accepts the normal token-exchange request plus the
-RegistryStack context fields Assisted Access sends today: `client_id`,
-`tenant`, `session_id`, `correlation_id`, `subject_id_hash`, `actor_id_hash`,
-`delegation_ref`, and `session_binding`. The adapter maps those fields into
-`ExchangeContext`; the core service still validates the token profile and signs
-the Notary-bound transaction token.
-
-When `session_binding_secret` is configured, `session_binding` must be an
-`hmac-sha256:<hex>` value over the session id, correlation id, verified subject,
-subject id hash, client id, tenant, actor id hash, and delegation reference.
-This prevents a leaked subject token plus arbitrary request-body caller context
-from minting a Notary-bound token.
-
-Current limits: the bridge does not yet verify UserInfo JWT continuity and the
-binary uses local JWK signing material. Do not claim external OAuth/OIDC/FAPI
-certification or production key-custody readiness from this crate alone.
-
-The `registry-platform-sts` binary is a minimal deployment wrapper around the
-same library. Required environment variables:
-
-- `REGISTRY_PLATFORM_STS_ISSUER`
-- `REGISTRY_PLATFORM_STS_NOTARY_AUDIENCE`
-- `REGISTRY_PLATFORM_STS_SIGNING_JWK`
-- `REGISTRY_PLATFORM_STS_SUBJECT_ISSUER`
-- `REGISTRY_PLATFORM_STS_SUBJECT_AUDIENCE`
-- `REGISTRY_PLATFORM_STS_SUBJECT_JWKS_URI`
-- `REGISTRY_PLATFORM_STS_SESSION_BINDING_SECRET`
-- `REGISTRY_PLATFORM_STS_AUDIT_HASH_SECRET`, at least 32 bytes
-- `REGISTRY_PLATFORM_STS_AUDIT_LOG_PATH`
-
-Optional environment variables:
-
-- `REGISTRY_PLATFORM_STS_BIND`, default `127.0.0.1:9090`
-- `REGISTRY_PLATFORM_STS_SUBJECT_CLAIM`, default `sub`
-- `REGISTRY_PLATFORM_STS_SUBJECT_ALLOWED_TYP`, default `at+jwt,JWT`
-- `REGISTRY_PLATFORM_STS_SUBJECT_ALLOWED_ALGS`, default `EdDSA,RS256`
-
-The binary appends token-mint events to a keyed JSONL audit chain and fails the
-exchange if the audit append fails. Library callers that construct
-`TokenExchangeService` directly must still supply their own `StsAuditSink`.
diff --git a/crates/registry-platform-sts/src/bin/registry-platform-sts.rs b/crates/registry-platform-sts/src/bin/registry-platform-sts.rs
deleted file mode 100644
index 396834b4c..000000000
--- a/crates/registry-platform-sts/src/bin/registry-platform-sts.rs
+++ /dev/null
@@ -1,197 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Minimal process wrapper for the Registry Platform STS bridge.
-
-use std::{env, error::Error, io, net::SocketAddr, path::PathBuf, sync::Arc, time::Duration};
-
-#[cfg(test)]
-use std::path::Path;
-
-use async_trait::async_trait;
-use jsonwebtoken::Algorithm;
-use registry_platform_audit::{AuditProfile, ChainState, JsonlFileSink};
-use registry_platform_crypto::{LocalJwkSigner, PrivateJwk};
-use registry_platform_oidc::{JwksFetcher, JwksFetcherConfig, TokenVerifier, TokenVerifierConfig};
-use registry_platform_sts::{
-    sts_router, InMemoryRateLimitStore, OidcSubjectTokenVerifier, StsAuditError, StsAuditSink,
-    StsHttpConfig, TokenExchangeConfig, TokenExchangeService, TokenMintAuditEvent,
-};
-
-const AUDIT_HASH_SECRET_ENV: &str = "REGISTRY_PLATFORM_STS_AUDIT_HASH_SECRET";
-
-#[tokio::main]
-async fn main() -> Result<(), Box<dyn Error>> {
-    let bind: SocketAddr = env_or("REGISTRY_PLATFORM_STS_BIND", "127.0.0.1:9090").parse()?;
-    let issuer = required_env("REGISTRY_PLATFORM_STS_ISSUER")?;
-    let issuer = issuer.trim_end_matches('/').to_string();
-    let notary_audience = required_env("REGISTRY_PLATFORM_STS_NOTARY_AUDIENCE")?;
-    let signing_jwk = required_env("REGISTRY_PLATFORM_STS_SIGNING_JWK")?;
-    let subject_issuer = required_env("REGISTRY_PLATFORM_STS_SUBJECT_ISSUER")?;
-    let subject_audience = required_env("REGISTRY_PLATFORM_STS_SUBJECT_AUDIENCE")?;
-    let subject_jwks_uri = required_env("REGISTRY_PLATFORM_STS_SUBJECT_JWKS_URI")?;
-    let subject_claim = env_or("REGISTRY_PLATFORM_STS_SUBJECT_CLAIM", "sub");
-    let session_binding_secret = required_env("REGISTRY_PLATFORM_STS_SESSION_BINDING_SECRET")?;
-    let audit_hash_secret = required_env(AUDIT_HASH_SECRET_ENV)?;
-    let audit_log_path = required_env("REGISTRY_PLATFORM_STS_AUDIT_LOG_PATH")?;
-    let subject_allowed_typ = csv_env("REGISTRY_PLATFORM_STS_SUBJECT_ALLOWED_TYP", "at+jwt,JWT");
-    let subject_allowed_algorithms =
-        algorithms_env("REGISTRY_PLATFORM_STS_SUBJECT_ALLOWED_ALGS", "EdDSA,RS256")?;
-    let audit_sink =
-        Arc::new(JsonlStsAuditSink::production(audit_log_path, AUDIT_HASH_SECRET_ENV).await?);
-
-    let signer = Arc::new(LocalJwkSigner::new(PrivateJwk::parse(&signing_jwk)?)?);
-    let fetcher = Arc::new(JwksFetcher::new(
-        subject_jwks_uri,
-        JwksFetcherConfig::defaults(),
-    ));
-    let verifier = Arc::new(TokenVerifier::new(
-        TokenVerifierConfig::access_token_profile(
-            subject_issuer,
-            vec![subject_audience],
-            subject_allowed_algorithms,
-            subject_allowed_typ,
-        )
-        .with_leeway(Duration::from_secs(60)),
-        fetcher,
-    ));
-    let subject_verifier = Arc::new(OidcSubjectTokenVerifier::new(
-        verifier,
-        subject_claim.clone(),
-    ));
-    let service = Arc::new(
-        TokenExchangeService::new(
-            subject_verifier,
-            signer,
-            Arc::new(InMemoryRateLimitStore::default()),
-            TokenExchangeConfig::notary_transaction_token(&issuer, notary_audience)
-                .with_session_binding_secret(session_binding_secret)
-                .with_subject_binding_claim(subject_claim)
-                .with_audit_hash_secret(audit_hash_secret),
-        )
-        .with_audit_sink(audit_sink),
-    );
-    let app = sts_router(service, StsHttpConfig::local(&issuer));
-    let listener = tokio::net::TcpListener::bind(bind).await?;
-    axum::serve(listener, app).await?;
-    Ok(())
-}
-
-struct JsonlStsAuditSink {
-    sink: JsonlFileSink,
-    chain: ChainState,
-}
-
-impl JsonlStsAuditSink {
-    async fn production(
-        path: impl Into<PathBuf>,
-        audit_hash_secret_env: &str,
-    ) -> Result<Self, registry_platform_audit::AuditError> {
-        let sink = JsonlFileSink::new(path);
-        let profile = AuditProfile::production_from_env(audit_hash_secret_env)?;
-        Self::from_profile(sink, &profile).await
-    }
-
-    async fn from_profile(
-        sink: JsonlFileSink,
-        profile: &AuditProfile,
-    ) -> Result<Self, registry_platform_audit::AuditError> {
-        let chain = profile.bootstrap_or_start_empty(&sink).await?;
-        Ok(Self { sink, chain })
-    }
-
-    #[cfg(test)]
-    fn path(&self) -> &Path {
-        self.sink.path()
-    }
-}
-
-#[async_trait]
-impl StsAuditSink for JsonlStsAuditSink {
-    async fn record_token_mint(&self, event: TokenMintAuditEvent) -> Result<(), StsAuditError> {
-        self.chain
-            .append(&self.sink, event)
-            .await
-            .map(|_| ())
-            .map_err(|_| StsAuditError::Unavailable)
-    }
-}
-
-fn required_env(name: &str) -> Result<String, io::Error> {
-    env::var(name).map_err(|_| {
-        io::Error::new(
-            io::ErrorKind::InvalidInput,
-            format!("required environment variable {name} is missing"),
-        )
-    })
-}
-
-fn env_or(name: &str, default: &str) -> String {
-    env::var(name).unwrap_or_else(|_| default.to_string())
-}
-
-fn csv_env(name: &str, default: &str) -> Vec<String> {
-    env_or(name, default)
-        .split(',')
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-        .map(str::to_string)
-        .collect()
-}
-
-fn algorithms_env(name: &str, default: &str) -> Result<Vec<Algorithm>, io::Error> {
-    csv_env(name, default)
-        .into_iter()
-        .map(|value| match value.as_str() {
-            "EdDSA" => Ok(Algorithm::EdDSA),
-            "RS256" => Ok(Algorithm::RS256),
-            _ => Err(io::Error::new(
-                io::ErrorKind::InvalidInput,
-                format!("unsupported algorithm {value} in {name}"),
-            )),
-        })
-        .collect()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use serde_json::Value;
-    use time::OffsetDateTime;
-    use ulid::Ulid;
-
-    #[tokio::test]
-    async fn jsonl_sts_audit_sink_persists_token_mint_events() {
-        let dir = env::temp_dir().join(format!("registry-platform-sts-audit-{}", Ulid::new()));
-        std::fs::create_dir_all(&dir).expect("temp audit dir");
-        let path = dir.join("audit.jsonl");
-        let profile = AuditProfile::unkeyed_dev_only();
-        let sink = JsonlStsAuditSink::from_profile(JsonlFileSink::new(&path), &profile)
-            .await
-            .expect("audit sink");
-
-        sink.record_token_mint(TokenMintAuditEvent {
-            event_type: "registry-platform-sts.token_minted".to_string(),
-            issuer: "https://sts.example".to_string(),
-            audience: "registry-notary".to_string(),
-            client_id: Some("client-1".to_string()),
-            subject_hash: "subject-hash".to_string(),
-            jti_hash: "jti-hash".to_string(),
-            authorization_details_hash: "details-hash".to_string(),
-            session_id: Some("session-1".to_string()),
-            correlation_id: Some("corr-1".to_string()),
-            actor_id_hash: None,
-            issued_at: OffsetDateTime::now_utc().unix_timestamp(),
-            expires_at: OffsetDateTime::now_utc().unix_timestamp() + 60,
-        })
-        .await
-        .expect("audit write");
-
-        let contents = std::fs::read_to_string(sink.path()).expect("audit contents");
-        let envelope: Value = serde_json::from_str(contents.trim()).expect("audit json");
-        assert_eq!(
-            envelope["record"]["event_type"],
-            "registry-platform-sts.token_minted"
-        );
-
-        std::fs::remove_dir_all(dir).expect("remove temp audit dir");
-    }
-}
diff --git a/crates/registry-platform-sts/src/lib.rs b/crates/registry-platform-sts/src/lib.rs
deleted file mode 100644
index 12b84a68f..000000000
--- a/crates/registry-platform-sts/src/lib.rs
+++ /dev/null
@@ -1,2314 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Token-exchange primitives for minting Notary-bound transaction tokens.
-
-use std::{
-    cmp::{Ordering, Reverse},
-    collections::{BinaryHeap, HashMap, HashSet},
-    fmt,
-    sync::{Arc, Mutex},
-    time::Duration,
-};
-
-use async_trait::async_trait;
-use axum::{
-    extract::State,
-    response::{IntoResponse, Response},
-    routing::{get, post},
-    Json, Router,
-};
-use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-use base64::Engine;
-use hmac::{Hmac, KeyInit, Mac};
-use http::{header, HeaderValue, StatusCode};
-use registry_platform_crypto::{
-    verify, PublicJwk, SigningAlgorithm, SigningError, SigningProvider,
-};
-use registry_platform_oidc::{TokenVerifier, VerifiedToken};
-use serde::{Deserialize, Serialize};
-use serde_json::{json, Map, Value};
-use sha2::{Digest, Sha256};
-use subtle::ConstantTimeEq;
-use thiserror::Error;
-use time::OffsetDateTime;
-use ulid::Ulid;
-
-pub const TOKEN_EXCHANGE_GRANT_TYPE: &str = "urn:ietf:params:oauth:grant-type:token-exchange";
-pub const ACCESS_TOKEN_TYPE: &str = "urn:ietf:params:oauth:token-type:access_token";
-pub const JWT_TOKEN_TYPE: &str = "urn:ietf:params:oauth:token-type:jwt";
-pub const NOTARY_TRANSACTION_JWT_TYP: &str = "at+jwt";
-pub const NOTARY_AUTHORIZATION_DETAILS_TYPE: &str = "registry_notary_evidence_transaction";
-pub const NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION: &str =
-    "registry-notary-authorization-details/v1";
-
-#[derive(Clone, Debug)]
-pub struct TokenExchangeConfig {
-    pub issuer: String,
-    pub notary_audience: String,
-    pub allowed_subject_token_types: Vec<String>,
-    pub requested_token_type: String,
-    pub issued_token_type: String,
-    pub jwt_typ: String,
-    pub default_lifetime: Duration,
-    pub max_lifetime: Duration,
-    pub required_scopes: Vec<String>,
-    pub sender_constraint: SenderConstraintPolicy,
-    pub require_session_binding: bool,
-    pub session_binding_secret: Option<String>,
-    pub subject_binding_claim: Option<String>,
-    pub audit_hash_secret: String,
-}
-
-impl TokenExchangeConfig {
-    #[must_use]
-    pub fn notary_transaction_token(
-        issuer: impl Into<String>,
-        notary_audience: impl Into<String>,
-    ) -> Self {
-        Self {
-            issuer: issuer.into(),
-            notary_audience: notary_audience.into(),
-            allowed_subject_token_types: vec![ACCESS_TOKEN_TYPE.to_string()],
-            requested_token_type: ACCESS_TOKEN_TYPE.to_string(),
-            issued_token_type: ACCESS_TOKEN_TYPE.to_string(),
-            jwt_typ: NOTARY_TRANSACTION_JWT_TYP.to_string(),
-            default_lifetime: Duration::from_secs(300),
-            max_lifetime: Duration::from_secs(600),
-            required_scopes: vec!["registry_notary:subject_access".to_string()],
-            sender_constraint: SenderConstraintPolicy::Disabled,
-            require_session_binding: true,
-            session_binding_secret: None,
-            subject_binding_claim: None,
-            audit_hash_secret: "registry-platform-sts-local-audit".to_string(),
-        }
-    }
-
-    #[must_use]
-    pub fn with_session_binding_secret(mut self, secret: impl Into<String>) -> Self {
-        self.session_binding_secret = Some(secret.into());
-        self
-    }
-
-    #[must_use]
-    pub fn with_subject_binding_claim(mut self, claim: impl Into<String>) -> Self {
-        self.subject_binding_claim = Some(claim.into());
-        self
-    }
-
-    #[must_use]
-    pub fn with_audit_hash_secret(mut self, secret: impl Into<String>) -> Self {
-        self.audit_hash_secret = secret.into();
-        self
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum SenderConstraintPolicy {
-    Required,
-    Optional,
-    Disabled,
-}
-
-#[derive(Clone, Deserialize, Serialize)]
-pub struct TokenExchangeRequest {
-    pub grant_type: String,
-    pub subject_token: String,
-    pub subject_token_type: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub requested_token_type: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub audience: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub resource: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub scope: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub authorization_details: Option<Vec<NotaryAuthorizationDetails>>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub actor_token: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub actor_token_type: Option<String>,
-}
-
-impl fmt::Debug for TokenExchangeRequest {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("TokenExchangeRequest")
-            .field("grant_type", &self.grant_type)
-            .field("subject_token", &RedactedLen(self.subject_token.len()))
-            .field("subject_token_type", &self.subject_token_type)
-            .field("requested_token_type", &self.requested_token_type)
-            .field("audience", &self.audience)
-            .field("resource", &self.resource)
-            .field("scope", &self.scope)
-            .field("authorization_details", &self.authorization_details)
-            .field(
-                "actor_token",
-                &self.actor_token.as_ref().map(|s| RedactedLen(s.len())),
-            )
-            .field("actor_token_type", &self.actor_token_type)
-            .finish()
-    }
-}
-
-#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
-#[serde(deny_unknown_fields)]
-pub struct NotaryAuthorizationDetails {
-    #[serde(rename = "type")]
-    pub detail_type: String,
-    pub schema_version: String,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub actions: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub locations: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub claims: Vec<NotaryClaimRef>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub disclosure: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub format: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub purpose: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub subject: Option<NotaryAuthorizationSubject>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub access_mode: Option<String>,
-}
-
-#[derive(Clone, Debug, Deserialize, PartialEq, Eq, Serialize)]
-#[serde(deny_unknown_fields)]
-pub struct NotaryClaimRef {
-    pub id: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub version: Option<String>,
-}
-
-#[derive(Clone, Debug, Deserialize, PartialEq, Eq, Serialize)]
-#[serde(deny_unknown_fields)]
-pub struct NotaryAuthorizationSubject {
-    pub binding_claim: String,
-    pub id_type: String,
-}
-
-#[derive(Clone, Deserialize, Serialize)]
-pub struct TokenExchangeResponse {
-    pub access_token: String,
-    pub issued_token_type: String,
-    pub token_type: String,
-    pub expires_in: u64,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub scope: Option<String>,
-}
-
-impl fmt::Debug for TokenExchangeResponse {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("TokenExchangeResponse")
-            .field("access_token", &RedactedLen(self.access_token.len()))
-            .field("issued_token_type", &self.issued_token_type)
-            .field("token_type", &self.token_type)
-            .field("expires_in", &self.expires_in)
-            .field("scope", &self.scope)
-            .finish()
-    }
-}
-
-#[derive(Clone, Debug, Default, PartialEq, Eq)]
-pub struct ExchangeContext {
-    pub client_id: Option<String>,
-    pub tenant: Option<String>,
-    pub session_id: Option<String>,
-    pub correlation_id: Option<String>,
-    pub subject_id_hash: Option<String>,
-    pub actor_id_hash: Option<String>,
-    pub delegation_ref: Option<String>,
-    pub session_binding: Option<String>,
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub struct VerifiedSubjectToken {
-    pub subject: String,
-    pub issuer: String,
-    pub scopes: Vec<String>,
-    pub confirmation: Option<Value>,
-    pub actor: Option<TokenActor>,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize)]
-pub struct TokenActor {
-    pub actor_id_hash: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub assurance: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub delegation_ref: Option<String>,
-}
-
-#[async_trait]
-pub trait SubjectTokenVerifier: Send + Sync {
-    async fn verify_subject_token(&self, token: &str) -> Result<VerifiedSubjectToken, StsError>;
-}
-
-pub struct OidcSubjectTokenVerifier {
-    verifier: Arc<TokenVerifier>,
-    subject_claim: String,
-}
-
-impl OidcSubjectTokenVerifier {
-    #[must_use]
-    pub fn new(verifier: Arc<TokenVerifier>, subject_claim: impl Into<String>) -> Self {
-        Self {
-            verifier,
-            subject_claim: subject_claim.into(),
-        }
-    }
-}
-
-impl fmt::Debug for OidcSubjectTokenVerifier {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("OidcSubjectTokenVerifier")
-            .field("subject_claim", &self.subject_claim)
-            .finish_non_exhaustive()
-    }
-}
-
-#[async_trait]
-impl SubjectTokenVerifier for OidcSubjectTokenVerifier {
-    async fn verify_subject_token(&self, token: &str) -> Result<VerifiedSubjectToken, StsError> {
-        let verified = self
-            .verifier
-            .verify(token)
-            .await
-            .map_err(|_| StsError::SubjectTokenInvalid)?;
-        verified_subject_from_oidc(verified, &self.subject_claim)
-    }
-}
-
-fn verified_subject_from_oidc(
-    verified: VerifiedToken,
-    subject_claim: &str,
-) -> Result<VerifiedSubjectToken, StsError> {
-    let subject = if subject_claim == "sub" {
-        verified.claims.sub.clone()
-    } else {
-        verified
-            .claims
-            .extra
-            .get(subject_claim)
-            .and_then(Value::as_str)
-            .map(str::to_string)
-    }
-    .filter(|value| !value.trim().is_empty())
-    .ok_or(StsError::SubjectBindingMissing)?;
-
-    let confirmation = verified.claims.extra.get("cnf").cloned();
-    Ok(VerifiedSubjectToken {
-        subject,
-        issuer: verified.claims.iss.unwrap_or_default(),
-        scopes: verified.scopes,
-        confirmation,
-        actor: None,
-    })
-}
-
-#[async_trait]
-pub trait RateLimitStore: Send + Sync {
-    async fn check_and_increment(
-        &self,
-        scope: &RateLimitScope,
-        key: &RateLimitKey,
-        policy: RateLimitPolicy,
-        now: OffsetDateTime,
-    ) -> Result<RateLimitOutcome, RateLimitError>;
-}
-
-#[async_trait]
-pub trait StsAuditSink: Send + Sync {
-    async fn record_token_mint(&self, event: TokenMintAuditEvent) -> Result<(), StsAuditError>;
-}
-
-#[derive(Debug, Default)]
-pub struct NoopStsAuditSink;
-
-#[async_trait]
-impl StsAuditSink for NoopStsAuditSink {
-    async fn record_token_mint(&self, _event: TokenMintAuditEvent) -> Result<(), StsAuditError> {
-        Ok(())
-    }
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
-pub struct TokenMintAuditEvent {
-    pub event_type: String,
-    pub issuer: String,
-    pub audience: String,
-    pub client_id: Option<String>,
-    pub subject_hash: String,
-    pub jti_hash: String,
-    pub authorization_details_hash: String,
-    pub session_id: Option<String>,
-    pub correlation_id: Option<String>,
-    pub actor_id_hash: Option<String>,
-    pub issued_at: i64,
-    pub expires_at: i64,
-}
-
-#[derive(Debug, Error)]
-pub enum StsAuditError {
-    #[error("audit sink unavailable")]
-    Unavailable,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Hash)]
-pub struct RateLimitScope(String);
-
-impl RateLimitScope {
-    pub fn new(value: impl Into<String>) -> Result<Self, RateLimitError> {
-        let value = value.into();
-        if value.trim().is_empty() {
-            return Err(RateLimitError::InvalidKey);
-        }
-        Ok(Self(value))
-    }
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Hash)]
-pub struct RateLimitKey(String);
-
-impl RateLimitKey {
-    pub fn new(value: impl Into<String>) -> Result<Self, RateLimitError> {
-        let value = value.into();
-        if value.trim().is_empty() {
-            return Err(RateLimitError::InvalidKey);
-        }
-        Ok(Self(value))
-    }
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct RateLimitPolicy {
-    pub max_requests: u32,
-    pub window: Duration,
-}
-
-impl Default for RateLimitPolicy {
-    fn default() -> Self {
-        Self {
-            max_requests: 60,
-            window: Duration::from_secs(60),
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum RateLimitOutcome {
-    Allowed { remaining: u32 },
-    Denied { retry_after: Duration },
-}
-
-#[derive(Debug, Error, Clone, PartialEq, Eq)]
-pub enum RateLimitError {
-    #[error("rate limit key is invalid")]
-    InvalidKey,
-    #[error("rate limit store unavailable")]
-    StoreUnavailable,
-}
-
-#[derive(Debug, Default)]
-pub struct InMemoryRateLimitStore {
-    state: Mutex<RateLimitState>,
-}
-
-const RATE_LIMIT_CLEANUP_BATCH: usize = 64;
-
-#[derive(Debug, Default)]
-struct RateLimitState {
-    counters: HashMap<(RateLimitScope, RateLimitKey), WindowCounter>,
-    expirations: BinaryHeap<Reverse<WindowExpiry>>,
-}
-
-#[derive(Debug, Clone)]
-struct WindowCounter {
-    window_start: i64,
-    expires_at: i64,
-    count: u32,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-struct WindowExpiry {
-    expires_at: i64,
-    scope: RateLimitScope,
-    key: RateLimitKey,
-}
-
-impl Ord for WindowExpiry {
-    fn cmp(&self, other: &Self) -> Ordering {
-        self.expires_at
-            .cmp(&other.expires_at)
-            .then_with(|| self.scope.0.cmp(&other.scope.0))
-            .then_with(|| self.key.0.cmp(&other.key.0))
-    }
-}
-
-impl PartialOrd for WindowExpiry {
-    fn partial_cmp(&self, other: &Self) -> Option<Ordering> {
-        Some(self.cmp(other))
-    }
-}
-
-impl RateLimitState {
-    fn prune_expired(&mut self, now_unix: i64, max_popped: usize) {
-        let mut popped = 0;
-        while popped < max_popped {
-            let Some(Reverse(expiry)) = self.expirations.peek() else {
-                break;
-            };
-            if expiry.expires_at > now_unix {
-                break;
-            }
-            let Reverse(expiry) = self
-                .expirations
-                .pop()
-                .expect("peek confirmed an expiry entry");
-            popped += 1;
-            let counter_key = (expiry.scope, expiry.key);
-            if self
-                .counters
-                .get(&counter_key)
-                .is_some_and(|counter| counter.expires_at == expiry.expires_at)
-            {
-                self.counters.remove(&counter_key);
-            }
-        }
-    }
-}
-
-#[async_trait]
-impl RateLimitStore for InMemoryRateLimitStore {
-    async fn check_and_increment(
-        &self,
-        scope: &RateLimitScope,
-        key: &RateLimitKey,
-        policy: RateLimitPolicy,
-        now: OffsetDateTime,
-    ) -> Result<RateLimitOutcome, RateLimitError> {
-        let mut state = self
-            .state
-            .lock()
-            .map_err(|_| RateLimitError::StoreUnavailable)?;
-        let now_unix = now.unix_timestamp();
-        let window_secs = policy.window.as_secs().max(1) as i64;
-        state.prune_expired(now_unix, RATE_LIMIT_CLEANUP_BATCH);
-        let counter_key = (scope.clone(), key.clone());
-        let mut queue_expiry = None;
-        let outcome = {
-            let counter = state
-                .counters
-                .entry(counter_key.clone())
-                .or_insert_with(|| {
-                    let expires_at = now_unix.saturating_add(window_secs);
-                    queue_expiry = Some(expires_at);
-                    WindowCounter {
-                        window_start: now_unix,
-                        expires_at,
-                        count: 0,
-                    }
-                });
-            if now_unix >= counter.expires_at {
-                let expires_at = now_unix.saturating_add(window_secs);
-                counter.window_start = now_unix;
-                counter.expires_at = expires_at;
-                counter.count = 0;
-                queue_expiry = Some(expires_at);
-            }
-            if counter.count >= policy.max_requests {
-                let retry_after = counter.expires_at.saturating_sub(now_unix) as u64;
-                RateLimitOutcome::Denied {
-                    retry_after: Duration::from_secs(retry_after.max(1)),
-                }
-            } else {
-                counter.count += 1;
-                RateLimitOutcome::Allowed {
-                    remaining: policy.max_requests.saturating_sub(counter.count),
-                }
-            }
-        };
-        if let Some(expires_at) = queue_expiry {
-            state.expirations.push(Reverse(WindowExpiry {
-                expires_at,
-                scope: scope.clone(),
-                key: key.clone(),
-            }));
-        }
-        Ok(outcome)
-    }
-}
-
-pub struct TokenExchangeService {
-    verifier: Arc<dyn SubjectTokenVerifier>,
-    signer: Arc<dyn SigningProvider>,
-    rate_limiter: Arc<dyn RateLimitStore>,
-    audit_sink: Arc<dyn StsAuditSink>,
-    config: TokenExchangeConfig,
-    rate_limit_policy: RateLimitPolicy,
-}
-
-impl TokenExchangeService {
-    #[must_use]
-    pub fn new(
-        verifier: Arc<dyn SubjectTokenVerifier>,
-        signer: Arc<dyn SigningProvider>,
-        rate_limiter: Arc<dyn RateLimitStore>,
-        config: TokenExchangeConfig,
-    ) -> Self {
-        Self {
-            verifier,
-            signer,
-            rate_limiter,
-            audit_sink: Arc::new(NoopStsAuditSink),
-            config,
-            rate_limit_policy: RateLimitPolicy::default(),
-        }
-    }
-
-    #[must_use]
-    pub fn with_audit_sink(mut self, audit_sink: Arc<dyn StsAuditSink>) -> Self {
-        self.audit_sink = audit_sink;
-        self
-    }
-
-    #[must_use]
-    pub fn with_rate_limit_policy(mut self, policy: RateLimitPolicy) -> Self {
-        self.rate_limit_policy = policy;
-        self
-    }
-
-    pub async fn exchange(
-        &self,
-        request: TokenExchangeRequest,
-        context: ExchangeContext,
-        now: OffsetDateTime,
-    ) -> Result<TokenExchangeResponse, StsError> {
-        validate_request(&request, &self.config)?;
-        validate_exchange_context_shape(&context, &self.config)?;
-        let rate_key_material = context
-            .client_id
-            .as_deref()
-            .unwrap_or(request.subject_token.as_str());
-        self.check_rate_limit("client", rate_key_material, now)
-            .await?;
-        let subject = self
-            .verifier
-            .verify_subject_token(&request.subject_token)
-            .await?;
-        self.check_rate_limit("subject", &subject.subject, now)
-            .await?;
-        self.exchange_verified(request, context, subject, now).await
-    }
-
-    async fn exchange_verified(
-        &self,
-        request: TokenExchangeRequest,
-        context: ExchangeContext,
-        subject: VerifiedSubjectToken,
-        now: OffsetDateTime,
-    ) -> Result<TokenExchangeResponse, StsError> {
-        validate_request(&request, &self.config)?;
-        validate_exchange_context(&context, &self.config, &subject)?;
-        validate_sender_constraint(&subject, self.config.sender_constraint)?;
-        let scopes = requested_scopes(&request, &self.config, &subject)?;
-        let authorization_details = validate_authorization_details(&request, &self.config)?;
-        let authorization_details_json = serde_json::to_string(&authorization_details)?;
-        let lifetime = self.config.default_lifetime.min(self.config.max_lifetime);
-        let iat = now.unix_timestamp();
-        let exp = now
-            .checked_add(duration_to_time(lifetime)?)
-            .ok_or(StsError::ClockOverflow)?
-            .unix_timestamp();
-        let jti = Ulid::new().to_string();
-        let jwt = self
-            .sign_transaction_token(
-                &subject,
-                &context,
-                &scopes,
-                &authorization_details,
-                iat,
-                exp,
-                &jti,
-            )
-            .await?;
-        self.audit_sink
-            .record_token_mint(TokenMintAuditEvent {
-                event_type: "registry-platform-sts.token_minted".to_string(),
-                issuer: self.config.issuer.clone(),
-                audience: self.config.notary_audience.clone(),
-                client_id: context.client_id.clone(),
-                subject_hash: hmac_sha256_label(&self.config.audit_hash_secret, &subject.subject),
-                jti_hash: hmac_sha256_label(&self.config.audit_hash_secret, &jti),
-                authorization_details_hash: hmac_sha256_label(
-                    &self.config.audit_hash_secret,
-                    &authorization_details_json,
-                ),
-                session_id: context.session_id.clone(),
-                correlation_id: context.correlation_id.clone(),
-                actor_id_hash: subject
-                    .actor
-                    .as_ref()
-                    .map(|actor| actor.actor_id_hash.clone())
-                    .or_else(|| context.actor_id_hash.clone()),
-                issued_at: iat,
-                expires_at: exp,
-            })
-            .await?;
-        Ok(TokenExchangeResponse {
-            access_token: jwt,
-            issued_token_type: self.config.issued_token_type.clone(),
-            token_type: "Bearer".to_string(),
-            expires_in: lifetime.as_secs(),
-            scope: Some(scopes.join(" ")),
-        })
-    }
-
-    #[must_use]
-    pub fn public_jwks(&self) -> Value {
-        public_jwks(self.signer.as_ref())
-    }
-
-    #[must_use]
-    pub fn authorization_server_metadata(&self, token_endpoint: &str, jwks_uri: &str) -> Value {
-        authorization_server_metadata(&self.config, token_endpoint, jwks_uri)
-    }
-
-    async fn check_rate_limit(
-        &self,
-        scope_name: &str,
-        key_material: &str,
-        now: OffsetDateTime,
-    ) -> Result<(), StsError> {
-        let scope =
-            RateLimitScope::new(format!("registry-platform-sts/token-exchange/{scope_name}"))?;
-        let key = RateLimitKey::new(sha256_hex(key_material))?;
-        match self
-            .rate_limiter
-            .check_and_increment(&scope, &key, self.rate_limit_policy, now)
-            .await?
-        {
-            RateLimitOutcome::Allowed { .. } => Ok(()),
-            RateLimitOutcome::Denied { retry_after } => Err(StsError::RateLimited { retry_after }),
-        }
-    }
-
-    #[allow(clippy::too_many_arguments)]
-    async fn sign_transaction_token(
-        &self,
-        subject: &VerifiedSubjectToken,
-        context: &ExchangeContext,
-        scopes: &[String],
-        authorization_details: &[NotaryAuthorizationDetails],
-        iat: i64,
-        exp: i64,
-        jti: &str,
-    ) -> Result<String, StsError> {
-        let alg = jwt_alg(self.signer.algorithm());
-        let header = json!({
-            "alg": alg,
-            "kid": self.signer.key_id(),
-            "typ": self.config.jwt_typ,
-        });
-        let mut payload = Map::new();
-        payload.insert("iss".to_string(), json!(self.config.issuer));
-        payload.insert("aud".to_string(), json!(self.config.notary_audience));
-        payload.insert("sub".to_string(), json!(subject.subject));
-        if let Some(client_id) = context.client_id.as_ref() {
-            payload.insert("client_id".to_string(), json!(client_id));
-        }
-        if let Some(tenant) = context.tenant.as_ref() {
-            payload.insert("tenant".to_string(), json!(tenant));
-        }
-        if let Some(session_id) = context.session_id.as_ref() {
-            payload.insert("sid".to_string(), json!(session_id));
-        }
-        if let Some(correlation_id) = context.correlation_id.as_ref() {
-            payload.insert("correlation_id".to_string(), json!(correlation_id));
-        }
-        payload.insert("iat".to_string(), json!(iat));
-        payload.insert("nbf".to_string(), json!(iat));
-        payload.insert("exp".to_string(), json!(exp));
-        payload.insert("jti".to_string(), json!(jti));
-        payload.insert("scope".to_string(), json!(scopes.join(" ")));
-        payload.insert(
-            "authorization_details".to_string(),
-            serde_json::to_value(authorization_details)?,
-        );
-        if self.config.sender_constraint != SenderConstraintPolicy::Disabled {
-            if let Some(cnf) = &subject.confirmation {
-                payload.insert("cnf".to_string(), cnf.clone());
-            }
-        }
-        if let Some(actor) = subject.actor.as_ref() {
-            payload.insert("act".to_string(), serde_json::to_value(actor)?);
-        } else if let Some(actor_id_hash) = context.actor_id_hash.as_ref() {
-            let actor = TokenActor {
-                actor_id_hash: actor_id_hash.clone(),
-                assurance: None,
-                delegation_ref: context.delegation_ref.clone(),
-            };
-            payload.insert("act".to_string(), serde_json::to_value(actor)?);
-        }
-        let header_b64 = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&header)?);
-        let payload_b64 = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&payload)?);
-        let signing_input = format!("{header_b64}.{payload_b64}");
-        let public_jwk = self.signer.public_jwk();
-        if public_jwk.kid.as_deref() != Some(self.signer.key_id()) {
-            return Err(StsError::Signing(SigningError::KeyIdMismatch));
-        }
-        let signature = self.signer.sign(signing_input.as_bytes()).await?;
-        verify(signing_input.as_bytes(), &signature, &public_jwk)
-            .map_err(|err| StsError::Signing(SigningError::Crypto(err)))?;
-        Ok(format!(
-            "{}.{}",
-            signing_input,
-            URL_SAFE_NO_PAD.encode(signature)
-        ))
-    }
-}
-
-impl fmt::Debug for TokenExchangeService {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("TokenExchangeService")
-            .field("config", &self.config)
-            .field("signer_kid", &self.signer.key_id())
-            .field("signer_alg", &self.signer.algorithm())
-            .field("rate_limit_policy", &self.rate_limit_policy)
-            .finish_non_exhaustive()
-    }
-}
-
-fn validate_exchange_context_shape(
-    context: &ExchangeContext,
-    config: &TokenExchangeConfig,
-) -> Result<(), StsError> {
-    if config.require_session_binding
-        && (context
-            .session_id
-            .as_deref()
-            .is_none_or(|value| value.trim().is_empty())
-            || context
-                .correlation_id
-                .as_deref()
-                .is_none_or(|value| value.trim().is_empty()))
-    {
-        return Err(StsError::SessionBindingMissing);
-    }
-    Ok(())
-}
-
-fn validate_exchange_context(
-    context: &ExchangeContext,
-    config: &TokenExchangeConfig,
-    subject: &VerifiedSubjectToken,
-) -> Result<(), StsError> {
-    validate_exchange_context_shape(context, config)?;
-    if let Some(secret) = config.session_binding_secret.as_deref() {
-        let session_id = context
-            .session_id
-            .as_deref()
-            .ok_or(StsError::SessionBindingMissing)?;
-        let correlation_id = context
-            .correlation_id
-            .as_deref()
-            .ok_or(StsError::SessionBindingMissing)?;
-        let subject_id_hash = context
-            .subject_id_hash
-            .as_deref()
-            .ok_or(StsError::SubjectBindingMissing)?;
-        let client_id = context.client_id.as_deref().unwrap_or("");
-        let tenant = context.tenant.as_deref().unwrap_or("");
-        let actor_id_hash = effective_actor_id_hash(context, subject).unwrap_or("");
-        let delegation_ref = effective_delegation_ref(context, subject).unwrap_or("");
-        let expected = session_binding_mac(
-            secret,
-            SessionBindingMacInput {
-                session_id,
-                correlation_id,
-                verified_subject: &subject.subject,
-                subject_id_hash,
-                client_id,
-                tenant,
-                actor_id_hash,
-                delegation_ref,
-            },
-        );
-        let provided = context.session_binding.as_deref().unwrap_or("");
-        if expected.len() != provided.len()
-            || expected.as_bytes().ct_eq(provided.as_bytes()).unwrap_u8() != 1
-        {
-            return Err(StsError::SessionBindingInvalid);
-        }
-    }
-    Ok(())
-}
-
-fn validate_request(
-    request: &TokenExchangeRequest,
-    config: &TokenExchangeConfig,
-) -> Result<(), StsError> {
-    if request.grant_type != TOKEN_EXCHANGE_GRANT_TYPE {
-        return Err(StsError::InvalidGrantType);
-    }
-    if request.subject_token.trim().is_empty() {
-        return Err(StsError::SubjectTokenMissing);
-    }
-    if !config
-        .allowed_subject_token_types
-        .iter()
-        .any(|value| value == &request.subject_token_type)
-    {
-        return Err(StsError::UnsupportedSubjectTokenType);
-    }
-    if request
-        .requested_token_type
-        .as_deref()
-        .is_some_and(|value| value != config.requested_token_type)
-    {
-        return Err(StsError::UnsupportedRequestedTokenType);
-    }
-    if request
-        .audience
-        .as_deref()
-        .is_some_and(|value| value != config.notary_audience)
-        || request
-            .resource
-            .as_deref()
-            .is_some_and(|value| value != config.notary_audience)
-    {
-        return Err(StsError::AudienceMismatch);
-    }
-    Ok(())
-}
-
-fn validate_authorization_details(
-    request: &TokenExchangeRequest,
-    config: &TokenExchangeConfig,
-) -> Result<Vec<NotaryAuthorizationDetails>, StsError> {
-    let details = request
-        .authorization_details
-        .as_ref()
-        .filter(|details| !details.is_empty())
-        .ok_or(StsError::AuthorizationDetailsMissing)?;
-    if details.len() != 1 {
-        return Err(StsError::AuthorizationDetailsInvalid);
-    }
-    let detail = &details[0];
-    if detail.detail_type != NOTARY_AUTHORIZATION_DETAILS_TYPE
-        || detail.schema_version != NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION
-        || detail.actions.as_slice() != ["evaluate"]
-        || detail.locations.len() != 1
-        || detail.locations.first() != Some(&config.notary_audience)
-        || detail.claims.is_empty()
-        || detail.access_mode.as_deref() != Some("subject_bound")
-    {
-        return Err(StsError::AuthorizationDetailsInvalid);
-    }
-
-    let mut seen_claim_ids = HashSet::new();
-    let mut claims = Vec::with_capacity(detail.claims.len());
-    for claim in &detail.claims {
-        let id = canonical_claim_field(&claim.id)?;
-        if !seen_claim_ids.insert(id.clone()) {
-            return Err(StsError::AuthorizationDetailsInvalid);
-        }
-        let version = claim
-            .version
-            .as_deref()
-            .ok_or(StsError::AuthorizationDetailsInvalid)
-            .and_then(canonical_claim_field)?;
-        claims.push(NotaryClaimRef {
-            id,
-            version: Some(version),
-        });
-    }
-    claims.sort_by(|left, right| {
-        left.id
-            .cmp(&right.id)
-            .then_with(|| left.version.cmp(&right.version))
-    });
-
-    let purpose = canonical_required_text(detail.purpose.as_deref())?;
-    let disclosure = canonical_required_text(detail.disclosure.as_deref())?;
-    let format = canonical_required_text(detail.format.as_deref())?;
-    let subject = detail
-        .subject
-        .as_ref()
-        .ok_or(StsError::AuthorizationDetailsInvalid)?;
-    let binding_claim = canonical_claim_field(&subject.binding_claim)?;
-    let id_type = canonical_claim_field(&subject.id_type)?;
-    if config
-        .subject_binding_claim
-        .as_deref()
-        .is_some_and(|expected| binding_claim != expected)
-    {
-        return Err(StsError::SubjectBindingMismatch);
-    }
-    Ok(vec![NotaryAuthorizationDetails {
-        detail_type: NOTARY_AUTHORIZATION_DETAILS_TYPE.to_string(),
-        schema_version: NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION.to_string(),
-        actions: vec!["evaluate".to_string()],
-        locations: vec![config.notary_audience.clone()],
-        claims,
-        disclosure: Some(disclosure),
-        format: Some(format),
-        purpose: Some(purpose),
-        subject: Some(NotaryAuthorizationSubject {
-            binding_claim,
-            id_type,
-        }),
-        access_mode: Some("subject_bound".to_string()),
-    }])
-}
-
-fn effective_actor_id_hash<'a>(
-    context: &'a ExchangeContext,
-    subject: &'a VerifiedSubjectToken,
-) -> Option<&'a str> {
-    subject
-        .actor
-        .as_ref()
-        .map(|actor| actor.actor_id_hash.as_str())
-        .or(context.actor_id_hash.as_deref())
-}
-
-fn effective_delegation_ref<'a>(
-    context: &'a ExchangeContext,
-    subject: &'a VerifiedSubjectToken,
-) -> Option<&'a str> {
-    if let Some(actor) = subject.actor.as_ref() {
-        actor.delegation_ref.as_deref()
-    } else {
-        context.delegation_ref.as_deref()
-    }
-}
-
-fn canonical_required_text(value: Option<&str>) -> Result<String, StsError> {
-    let value = value.ok_or(StsError::AuthorizationDetailsInvalid)?.trim();
-    if value.is_empty() {
-        return Err(StsError::AuthorizationDetailsInvalid);
-    }
-    Ok(value.to_string())
-}
-
-fn canonical_claim_field(value: &str) -> Result<String, StsError> {
-    let canonical = value.trim();
-    if canonical.is_empty() || canonical != value {
-        return Err(StsError::AuthorizationDetailsInvalid);
-    }
-    Ok(canonical.to_string())
-}
-
-fn validate_sender_constraint(
-    subject: &VerifiedSubjectToken,
-    policy: SenderConstraintPolicy,
-) -> Result<(), StsError> {
-    if policy == SenderConstraintPolicy::Required && subject.confirmation.is_none() {
-        return Err(StsError::SenderConstraintMissing);
-    }
-    Ok(())
-}
-
-fn requested_scopes(
-    request: &TokenExchangeRequest,
-    config: &TokenExchangeConfig,
-    subject: &VerifiedSubjectToken,
-) -> Result<Vec<String>, StsError> {
-    let scopes = request
-        .scope
-        .as_deref()
-        .map(split_scope)
-        .unwrap_or_else(|| config.required_scopes.clone());
-    if !config
-        .required_scopes
-        .iter()
-        .all(|required| scopes.contains(required))
-    {
-        return Err(StsError::RequiredScopeMissing);
-    }
-    if !scopes.iter().all(|scope| subject.scopes.contains(scope)) {
-        return Err(StsError::ScopeNotGranted);
-    }
-    Ok(scopes)
-}
-
-fn split_scope(value: &str) -> Vec<String> {
-    value
-        .split_ascii_whitespace()
-        .filter(|scope| !scope.is_empty())
-        .map(str::to_string)
-        .collect()
-}
-
-fn duration_to_time(value: Duration) -> Result<time::Duration, StsError> {
-    time::Duration::try_from(value).map_err(|_| StsError::ClockOverflow)
-}
-
-fn jwt_alg(algorithm: SigningAlgorithm) -> &'static str {
-    match algorithm {
-        SigningAlgorithm::EdDsa => "EdDSA",
-        SigningAlgorithm::Es256 => "ES256",
-        SigningAlgorithm::Rs256 => "RS256",
-    }
-}
-
-fn sha256_hex(value: &str) -> String {
-    let digest = Sha256::digest(value.as_bytes());
-    hex_bytes(&digest)
-}
-
-type HmacSha256 = Hmac<Sha256>;
-
-#[must_use]
-pub struct SessionBindingMacInput<'a> {
-    pub session_id: &'a str,
-    pub correlation_id: &'a str,
-    pub verified_subject: &'a str,
-    pub subject_id_hash: &'a str,
-    pub client_id: &'a str,
-    pub tenant: &'a str,
-    pub actor_id_hash: &'a str,
-    pub delegation_ref: &'a str,
-}
-
-#[must_use]
-pub fn session_binding_mac(secret: &str, input: SessionBindingMacInput<'_>) -> String {
-    let mut mac = HmacSha256::new_from_slice(secret.as_bytes())
-        .expect("HMAC accepts any non-empty key length");
-    update_mac_field(&mut mac, input.session_id);
-    update_mac_field(&mut mac, input.correlation_id);
-    update_mac_field(&mut mac, input.verified_subject);
-    update_mac_field(&mut mac, input.subject_id_hash);
-    update_mac_field(&mut mac, input.client_id);
-    update_mac_field(&mut mac, input.tenant);
-    update_mac_field(&mut mac, input.actor_id_hash);
-    update_mac_field(&mut mac, input.delegation_ref);
-    format!("hmac-sha256:{}", hex_bytes(&mac.finalize().into_bytes()))
-}
-
-fn update_mac_field(mac: &mut HmacSha256, value: &str) {
-    mac.update(value.len().to_string().as_bytes());
-    mac.update(b":");
-    mac.update(value.as_bytes());
-}
-
-fn hmac_sha256_label(secret: &str, value: &str) -> String {
-    let mut mac = HmacSha256::new_from_slice(secret.as_bytes())
-        .expect("HMAC accepts any non-empty key length");
-    mac.update(value.as_bytes());
-    format!("hmac-sha256:{}", hex_bytes(&mac.finalize().into_bytes()))
-}
-
-fn hex_bytes(bytes: &[u8]) -> String {
-    let mut output = String::with_capacity(bytes.len() * 2);
-    for byte in bytes {
-        use std::fmt::Write;
-        let _ = write!(output, "{byte:02x}");
-    }
-    output
-}
-
-#[derive(Debug, Error)]
-pub enum StsError {
-    #[error("unsupported grant_type")]
-    InvalidGrantType,
-    #[error("subject_token is required")]
-    SubjectTokenMissing,
-    #[error("unsupported subject_token_type")]
-    UnsupportedSubjectTokenType,
-    #[error("unsupported requested_token_type")]
-    UnsupportedRequestedTokenType,
-    #[error("audience or resource does not match the configured Notary audience")]
-    AudienceMismatch,
-    #[error("subject token is invalid")]
-    SubjectTokenInvalid,
-    #[error("subject binding claim is missing")]
-    SubjectBindingMissing,
-    #[error("subject binding metadata does not match STS policy")]
-    SubjectBindingMismatch,
-    #[error("required scope is missing")]
-    RequiredScopeMissing,
-    #[error("requested scope was not granted to subject token")]
-    ScopeNotGranted,
-    #[error("sender constraint is required")]
-    SenderConstraintMissing,
-    #[error("authorization_details is required")]
-    AuthorizationDetailsMissing,
-    #[error("authorization_details is invalid")]
-    AuthorizationDetailsInvalid,
-    #[error("assisted access session binding is required")]
-    SessionBindingMissing,
-    #[error("assisted access session binding is invalid")]
-    SessionBindingInvalid,
-    #[error("rate limited; retry after {retry_after:?}")]
-    RateLimited { retry_after: Duration },
-    #[error("rate limit error: {0}")]
-    RateLimit(#[from] RateLimitError),
-    #[error("audit failed: {0}")]
-    Audit(#[from] StsAuditError),
-    #[error("signing failed: {0}")]
-    Signing(#[from] SigningError),
-    #[error("json serialization failed: {0}")]
-    Json(#[from] serde_json::Error),
-    #[error("token timestamp overflow")]
-    ClockOverflow,
-}
-
-#[derive(Clone, Copy)]
-struct RedactedLen(usize);
-
-impl fmt::Debug for RedactedLen {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("redacted").field("len", &self.0).finish()
-    }
-}
-
-#[must_use]
-pub fn public_jwks(signer: &dyn SigningProvider) -> Value {
-    let jwk: PublicJwk = signer.public_jwk();
-    json!({ "keys": [jwk] })
-}
-
-#[must_use]
-pub fn authorization_server_metadata(
-    config: &TokenExchangeConfig,
-    token_endpoint: &str,
-    jwks_uri: &str,
-) -> Value {
-    json!({
-        "issuer": config.issuer,
-        "token_endpoint": token_endpoint,
-        "jwks_uri": jwks_uri,
-        "grant_types_supported": [TOKEN_EXCHANGE_GRANT_TYPE],
-        "subject_token_types_supported": config.allowed_subject_token_types.clone(),
-        "requested_token_types_supported": [config.requested_token_type.clone()],
-        "issued_token_types_supported": [config.issued_token_type.clone()],
-        "authorization_details_types_supported": [NOTARY_AUTHORIZATION_DETAILS_TYPE],
-    })
-}
-
-#[derive(Clone)]
-pub struct StsHttpConfig {
-    pub token_path: String,
-    pub metadata_path: String,
-    pub jwks_path: String,
-    pub token_endpoint: String,
-    pub jwks_uri: String,
-}
-
-impl StsHttpConfig {
-    #[must_use]
-    pub fn local(issuer: &str) -> Self {
-        Self {
-            token_path: "/oauth/token".to_string(),
-            metadata_path: "/.well-known/oauth-authorization-server".to_string(),
-            jwks_path: "/.well-known/jwks.json".to_string(),
-            token_endpoint: format!("{issuer}/oauth/token"),
-            jwks_uri: format!("{issuer}/.well-known/jwks.json"),
-        }
-    }
-}
-
-#[derive(Clone)]
-struct StsHttpState {
-    service: Arc<TokenExchangeService>,
-    metadata: Value,
-    jwks: Value,
-}
-
-#[derive(Debug, Deserialize)]
-struct HttpTokenExchangeRequest {
-    #[serde(flatten)]
-    token_exchange: TokenExchangeRequest,
-    #[serde(default)]
-    client_id: Option<String>,
-    #[serde(default)]
-    tenant: Option<String>,
-    #[serde(default)]
-    session_id: Option<String>,
-    #[serde(default)]
-    correlation_id: Option<String>,
-    #[serde(default)]
-    subject_id_hash: Option<String>,
-    #[serde(default)]
-    actor_id_hash: Option<String>,
-    #[serde(default)]
-    delegation_ref: Option<String>,
-    #[serde(default)]
-    session_binding: Option<String>,
-}
-
-impl HttpTokenExchangeRequest {
-    fn into_parts(self) -> (TokenExchangeRequest, ExchangeContext) {
-        (
-            self.token_exchange,
-            ExchangeContext {
-                client_id: non_blank(self.client_id),
-                tenant: non_blank(self.tenant),
-                session_id: non_blank(self.session_id),
-                correlation_id: non_blank(self.correlation_id),
-                subject_id_hash: non_blank(self.subject_id_hash),
-                actor_id_hash: non_blank(self.actor_id_hash),
-                delegation_ref: non_blank(self.delegation_ref),
-                session_binding: non_blank(self.session_binding),
-            },
-        )
-    }
-}
-
-fn non_blank(value: Option<String>) -> Option<String> {
-    value.and_then(|value| {
-        let trimmed = value.trim();
-        if trimmed.is_empty() {
-            None
-        } else {
-            Some(trimmed.to_string())
-        }
-    })
-}
-
-pub fn sts_router(service: Arc<TokenExchangeService>, config: StsHttpConfig) -> Router {
-    let state = StsHttpState {
-        metadata: service.authorization_server_metadata(&config.token_endpoint, &config.jwks_uri),
-        jwks: service.public_jwks(),
-        service,
-    };
-    Router::new()
-        .route(&config.token_path, post(http_token_exchange))
-        .route(&config.metadata_path, get(http_metadata))
-        .route(&config.jwks_path, get(http_jwks))
-        .with_state(state)
-}
-
-async fn http_token_exchange(
-    State(state): State<StsHttpState>,
-    Json(request): Json<HttpTokenExchangeRequest>,
-) -> Response {
-    let (request, context) = request.into_parts();
-    match state
-        .service
-        .exchange(request, context, OffsetDateTime::now_utc())
-        .await
-    {
-        Ok(response) => (StatusCode::OK, Json(response)).into_response(),
-        Err(error) => sts_error_response(error),
-    }
-}
-
-async fn http_metadata(State(state): State<StsHttpState>) -> impl IntoResponse {
-    Json(state.metadata)
-}
-
-async fn http_jwks(State(state): State<StsHttpState>) -> impl IntoResponse {
-    Json(state.jwks)
-}
-
-fn sts_error_response(error: StsError) -> Response {
-    let (status, code) = match &error {
-        StsError::SubjectTokenInvalid => (StatusCode::BAD_REQUEST, "invalid_grant"),
-        StsError::RateLimited { .. } => (StatusCode::TOO_MANY_REQUESTS, "temporarily_unavailable"),
-        StsError::Audit(_)
-        | StsError::Signing(_)
-        | StsError::Json(_)
-        | StsError::ClockOverflow
-        | StsError::RateLimit(_) => (StatusCode::INTERNAL_SERVER_ERROR, "server_error"),
-        _ => (StatusCode::BAD_REQUEST, "invalid_request"),
-    };
-    let body = Json(json!({
-        "error": code,
-        "error_description": error.to_string(),
-    }));
-    if let StsError::RateLimited { retry_after } = error {
-        let retry_after = HeaderValue::from_str(&retry_after.as_secs().max(1).to_string())
-            .unwrap_or_else(|_| HeaderValue::from_static("1"));
-        return (status, [(header::RETRY_AFTER, retry_after)], body).into_response();
-    }
-    (status, body).into_response()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use async_trait::async_trait;
-    use axum::body::{to_bytes, Body};
-    use http::{Request, StatusCode};
-    use registry_platform_crypto::{LocalJwkSigner, PrivateJwk};
-    use tower::ServiceExt;
-
-    const RAW_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"did:web:sts.test#key-1"}"#;
-
-    #[derive(Debug)]
-    struct StaticVerifier {
-        subject: VerifiedSubjectToken,
-    }
-
-    #[derive(Default)]
-    struct RecordingAuditSink {
-        events: Mutex<Vec<TokenMintAuditEvent>>,
-    }
-
-    struct FailingAuditSink;
-
-    #[async_trait]
-    impl StsAuditSink for RecordingAuditSink {
-        async fn record_token_mint(&self, event: TokenMintAuditEvent) -> Result<(), StsAuditError> {
-            self.events.lock().unwrap().push(event);
-            Ok(())
-        }
-    }
-
-    #[async_trait]
-    impl StsAuditSink for FailingAuditSink {
-        async fn record_token_mint(
-            &self,
-            _event: TokenMintAuditEvent,
-        ) -> Result<(), StsAuditError> {
-            Err(StsAuditError::Unavailable)
-        }
-    }
-
-    #[async_trait]
-    impl SubjectTokenVerifier for StaticVerifier {
-        async fn verify_subject_token(
-            &self,
-            token: &str,
-        ) -> Result<VerifiedSubjectToken, StsError> {
-            if token == "invalid" {
-                return Err(StsError::SubjectTokenInvalid);
-            }
-            Ok(self.subject.clone())
-        }
-    }
-
-    fn service() -> TokenExchangeService {
-        service_with_config(TokenExchangeConfig::notary_transaction_token(
-            "https://sts.example.test",
-            "https://notary.example.test",
-        ))
-    }
-
-    fn strict_service() -> TokenExchangeService {
-        service_with_config(
-            TokenExchangeConfig::notary_transaction_token(
-                "https://sts.example.test",
-                "https://notary.example.test",
-            )
-            .with_session_binding_secret("session-binding-secret")
-            .with_subject_binding_claim("national_id")
-            .with_audit_hash_secret("audit-secret"),
-        )
-    }
-
-    fn service_with_config(config: TokenExchangeConfig) -> TokenExchangeService {
-        let signer = Arc::new(LocalJwkSigner::new(PrivateJwk::parse(RAW_JWK).unwrap()).unwrap());
-        let verifier = Arc::new(StaticVerifier {
-            subject: verified_subject(),
-        });
-        TokenExchangeService::new(
-            verifier,
-            signer,
-            Arc::new(InMemoryRateLimitStore::default()),
-            config,
-        )
-    }
-
-    fn verified_subject() -> VerifiedSubjectToken {
-        VerifiedSubjectToken {
-            subject: "hmac-sha256:subject".to_string(),
-            issuer: "https://idp.example.test".to_string(),
-            scopes: vec!["registry_notary:subject_access".to_string()],
-            confirmation: Some(json!({"jkt": "thumbprint"})),
-            actor: Some(TokenActor {
-                actor_id_hash: "hmac-sha256:actor".to_string(),
-                assurance: Some("workforce-login".to_string()),
-                delegation_ref: Some("delegation-123".to_string()),
-            }),
-        }
-    }
-
-    fn request() -> TokenExchangeRequest {
-        TokenExchangeRequest {
-            grant_type: TOKEN_EXCHANGE_GRANT_TYPE.to_string(),
-            subject_token: "subject.jwt".to_string(),
-            subject_token_type: ACCESS_TOKEN_TYPE.to_string(),
-            requested_token_type: Some(ACCESS_TOKEN_TYPE.to_string()),
-            audience: Some("https://notary.example.test".to_string()),
-            resource: None,
-            scope: Some("registry_notary:subject_access".to_string()),
-            authorization_details: Some(vec![authorization_details()]),
-            actor_token: None,
-            actor_token_type: None,
-        }
-    }
-
-    fn authorization_details() -> NotaryAuthorizationDetails {
-        NotaryAuthorizationDetails {
-            detail_type: NOTARY_AUTHORIZATION_DETAILS_TYPE.to_string(),
-            schema_version: NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION.to_string(),
-            actions: vec!["evaluate".to_string()],
-            locations: vec!["https://notary.example.test".to_string()],
-            claims: vec![NotaryClaimRef {
-                id: "person-is-alive".to_string(),
-                version: Some("1".to_string()),
-            }],
-            disclosure: Some("predicate".to_string()),
-            format: Some("application/vnd.registry-notary.claim-result+json".to_string()),
-            purpose: Some("citizen_subject_access".to_string()),
-            subject: Some(NotaryAuthorizationSubject {
-                binding_claim: "national_id".to_string(),
-                id_type: "national_id".to_string(),
-            }),
-            access_mode: Some("subject_bound".to_string()),
-        }
-    }
-
-    fn context() -> ExchangeContext {
-        ExchangeContext {
-            client_id: Some("assisted-access-client".to_string()),
-            tenant: Some("tenant-a".to_string()),
-            session_id: Some("sess_123".to_string()),
-            correlation_id: Some("corr_123".to_string()),
-            subject_id_hash: None,
-            actor_id_hash: None,
-            delegation_ref: None,
-            session_binding: None,
-        }
-    }
-
-    fn bound_context() -> ExchangeContext {
-        let mut context = context();
-        context.subject_id_hash = Some("hmac-sha256:subject-id".to_string());
-        context.session_binding = Some(session_binding_mac(
-            "session-binding-secret",
-            SessionBindingMacInput {
-                session_id: "sess_123",
-                correlation_id: "corr_123",
-                verified_subject: "hmac-sha256:subject",
-                subject_id_hash: "hmac-sha256:subject-id",
-                client_id: "assisted-access-client",
-                tenant: "tenant-a",
-                actor_id_hash: "hmac-sha256:actor",
-                delegation_ref: "delegation-123",
-            },
-        ));
-        context
-    }
-
-    #[test]
-    fn request_validation_rejects_wrong_shapes() {
-        let config = TokenExchangeConfig::notary_transaction_token(
-            "https://sts.example.test",
-            "https://notary.example.test",
-        );
-
-        let mut wrong = request();
-        wrong.grant_type = "client_credentials".to_string();
-        assert!(matches!(
-            validate_request(&wrong, &config),
-            Err(StsError::InvalidGrantType)
-        ));
-
-        let mut wrong = request();
-        wrong.subject_token_type = JWT_TOKEN_TYPE.to_string();
-        assert!(matches!(
-            validate_request(&wrong, &config),
-            Err(StsError::UnsupportedSubjectTokenType)
-        ));
-
-        let mut wrong = request();
-        wrong.audience = Some("https://other-notary.example.test".to_string());
-        assert!(matches!(
-            validate_request(&wrong, &config),
-            Err(StsError::AudienceMismatch)
-        ));
-
-        let mut wrong = request();
-        wrong.subject_token.clear();
-        assert!(matches!(
-            validate_request(&wrong, &config),
-            Err(StsError::SubjectTokenMissing)
-        ));
-    }
-
-    #[test]
-    fn authorization_details_validation_rejects_missing_or_broadened_intent() {
-        let config = TokenExchangeConfig::notary_transaction_token(
-            "https://sts.example.test",
-            "https://notary.example.test",
-        );
-
-        let mut wrong = request();
-        wrong.authorization_details = None;
-        assert!(matches!(
-            validate_authorization_details(&wrong, &config),
-            Err(StsError::AuthorizationDetailsMissing)
-        ));
-
-        let mut wrong = request();
-        wrong.authorization_details.as_mut().unwrap()[0].locations =
-            vec!["https://other-notary.example.test".to_string()];
-        assert!(matches!(
-            validate_authorization_details(&wrong, &config),
-            Err(StsError::AuthorizationDetailsInvalid)
-        ));
-
-        let mut wrong = request();
-        wrong.authorization_details.as_mut().unwrap()[0]
-            .actions
-            .push("admin".to_string());
-        assert!(matches!(
-            validate_authorization_details(&wrong, &config),
-            Err(StsError::AuthorizationDetailsInvalid)
-        ));
-
-        let mut wrong = request();
-        wrong.authorization_details.as_mut().unwrap()[0]
-            .claims
-            .clear();
-        assert!(matches!(
-            validate_authorization_details(&wrong, &config),
-            Err(StsError::AuthorizationDetailsInvalid)
-        ));
-
-        let mut wrong = request();
-        wrong.authorization_details.as_mut().unwrap()[0].claims[0].version = None;
-        assert!(matches!(
-            validate_authorization_details(&wrong, &config),
-            Err(StsError::AuthorizationDetailsInvalid)
-        ));
-
-        let mut wrong = request();
-        wrong.authorization_details.as_mut().unwrap()[0]
-            .claims
-            .push(NotaryClaimRef {
-                id: "person-is-alive".to_string(),
-                version: Some("2".to_string()),
-            });
-        assert!(matches!(
-            validate_authorization_details(&wrong, &config),
-            Err(StsError::AuthorizationDetailsInvalid)
-        ));
-    }
-
-    #[test]
-    fn authorization_details_validation_returns_canonical_details() {
-        let config = TokenExchangeConfig::notary_transaction_token(
-            "https://sts.example.test",
-            "https://notary.example.test",
-        );
-        let mut request = request();
-        let details = request.authorization_details.as_mut().unwrap();
-        details[0].claims = vec![
-            NotaryClaimRef {
-                id: "z-claim".to_string(),
-                version: Some("2".to_string()),
-            },
-            NotaryClaimRef {
-                id: "a-claim".to_string(),
-                version: Some("1".to_string()),
-            },
-        ];
-        details[0].purpose = Some(" citizen_subject_access ".to_string());
-        details[0].disclosure = Some(" predicate ".to_string());
-        details[0].format = Some(" application/vnd.registry-notary.claim-result+json ".to_string());
-
-        let canonical = validate_authorization_details(&request, &config).unwrap();
-
-        assert_eq!(canonical.len(), 1);
-        assert_eq!(canonical[0].actions, ["evaluate"]);
-        assert_eq!(canonical[0].locations, ["https://notary.example.test"]);
-        assert_eq!(canonical[0].claims[0].id, "a-claim");
-        assert_eq!(canonical[0].claims[1].id, "z-claim");
-        assert_eq!(
-            canonical[0].purpose.as_deref(),
-            Some("citizen_subject_access")
-        );
-        assert_eq!(canonical[0].disclosure.as_deref(), Some("predicate"));
-        assert_eq!(
-            canonical[0].format.as_deref(),
-            Some("application/vnd.registry-notary.claim-result+json")
-        );
-    }
-
-    #[test]
-    fn authorization_details_deserialization_rejects_extra_or_duplicate_claim_fields() {
-        let with_extra_field = json!({
-            "type": NOTARY_AUTHORIZATION_DETAILS_TYPE,
-            "schema_version": NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION,
-            "actions": ["evaluate"],
-            "locations": ["https://notary.example.test"],
-            "claims": [{
-                "id": "person-is-alive",
-                "version": "1",
-                "scope": "broadened"
-            }],
-            "disclosure": "predicate",
-            "format": "application/vnd.registry-notary.claim-result+json",
-            "purpose": "citizen_subject_access",
-            "subject": {
-                "binding_claim": "national_id",
-                "id_type": "national_id"
-            },
-            "access_mode": "subject_bound"
-        });
-        assert!(serde_json::from_value::<NotaryAuthorizationDetails>(with_extra_field).is_err());
-
-        let duplicate_field = r#"{"id":"person-is-alive","id":"other","version":"1"}"#;
-        assert!(serde_json::from_str::<NotaryClaimRef>(duplicate_field).is_err());
-    }
-
-    #[tokio::test]
-    async fn exchange_mints_exact_audience_at_jwt() {
-        let response = service()
-            .exchange(request(), context(), OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap();
-
-        assert_eq!(response.token_type, "Bearer");
-        assert_eq!(response.issued_token_type, ACCESS_TOKEN_TYPE);
-        assert_eq!(response.expires_in, 300);
-        let (header, payload) = decode_unverified(&response.access_token);
-        assert_eq!(header["alg"], "EdDSA");
-        assert_eq!(header["typ"], NOTARY_TRANSACTION_JWT_TYP);
-        assert_eq!(header["kid"], "did:web:sts.test#key-1");
-        assert_eq!(payload["iss"], "https://sts.example.test");
-        assert_eq!(payload["aud"], "https://notary.example.test");
-        assert_eq!(payload["sub"], "hmac-sha256:subject");
-        assert_eq!(payload["client_id"], "assisted-access-client");
-        assert_eq!(payload["tenant"], "tenant-a");
-        assert_eq!(payload["sid"], "sess_123");
-        assert_eq!(payload["correlation_id"], "corr_123");
-        assert_eq!(payload["iat"], 0);
-        assert_eq!(payload["nbf"], 0);
-        assert_eq!(payload["exp"], 300);
-        assert!(payload["jti"]
-            .as_str()
-            .is_some_and(|value| !value.is_empty()));
-        assert_eq!(payload["scope"], "registry_notary:subject_access");
-        assert!(payload.get("cnf").is_none());
-        assert_eq!(payload["act"]["actor_id_hash"], "hmac-sha256:actor");
-        assert_eq!(payload["act"]["delegation_ref"], "delegation-123");
-        assert_eq!(
-            payload["authorization_details"][0]["type"],
-            "registry_notary_evidence_transaction"
-        );
-        assert_eq!(
-            payload["authorization_details"][0]["schema_version"],
-            "registry-notary-authorization-details/v1"
-        );
-        assert_eq!(
-            payload["authorization_details"][0]["claims"][0]["id"],
-            "person-is-alive"
-        );
-        assert_eq!(
-            payload["authorization_details"][0]["claims"][0]["version"],
-            "1"
-        );
-        assert_eq!(
-            payload["authorization_details"][0]["access_mode"],
-            "subject_bound"
-        );
-        assert_eq!(
-            payload["authorization_details"][0]["subject"]["binding_claim"],
-            "national_id"
-        );
-    }
-
-    #[tokio::test]
-    async fn exchange_fails_closed_when_sender_constraint_missing() {
-        let mut subject = verified_subject();
-        subject.confirmation = None;
-        let mut config = TokenExchangeConfig::notary_transaction_token(
-            "https://sts.example.test",
-            "https://notary.example.test",
-        );
-        config.sender_constraint = SenderConstraintPolicy::Required;
-        let signer = Arc::new(LocalJwkSigner::new(PrivateJwk::parse(RAW_JWK).unwrap()).unwrap());
-        let service = TokenExchangeService::new(
-            Arc::new(StaticVerifier { subject }),
-            signer,
-            Arc::new(InMemoryRateLimitStore::default()),
-            config,
-        );
-
-        let err = service
-            .exchange(request(), context(), OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap_err();
-
-        assert!(matches!(err, StsError::SenderConstraintMissing));
-    }
-
-    #[tokio::test]
-    async fn exchange_rejects_wrong_resource_before_mint_audit() {
-        let audit = Arc::new(RecordingAuditSink::default());
-        let service = service().with_audit_sink(audit.clone());
-        let mut request = request();
-        request.resource = Some("https://other-notary.example.test".to_string());
-
-        let err = service
-            .exchange(request, context(), OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap_err();
-
-        assert!(matches!(err, StsError::AudienceMismatch));
-        assert!(audit.events.lock().unwrap().is_empty());
-    }
-
-    #[tokio::test]
-    async fn exchange_rejects_unsupported_requested_token_type_before_mint_audit() {
-        let audit = Arc::new(RecordingAuditSink::default());
-        let service = service().with_audit_sink(audit.clone());
-        let mut request = request();
-        request.requested_token_type = Some(JWT_TOKEN_TYPE.to_string());
-
-        let err = service
-            .exchange(request, context(), OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap_err();
-
-        assert!(matches!(err, StsError::UnsupportedRequestedTokenType));
-        assert!(audit.events.lock().unwrap().is_empty());
-    }
-
-    #[tokio::test]
-    async fn exchange_rejects_invalid_subject_token_before_mint_audit() {
-        let audit = Arc::new(RecordingAuditSink::default());
-        let service = service().with_audit_sink(audit.clone());
-        let mut request = request();
-        request.subject_token = "invalid".to_string();
-
-        let err = service
-            .exchange(request, context(), OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap_err();
-
-        assert!(matches!(err, StsError::SubjectTokenInvalid));
-        assert!(audit.events.lock().unwrap().is_empty());
-    }
-
-    #[tokio::test]
-    async fn exchange_rejects_missing_sender_constraint_before_mint_audit() {
-        let audit = Arc::new(RecordingAuditSink::default());
-        let mut subject = verified_subject();
-        subject.confirmation = None;
-        let mut config = TokenExchangeConfig::notary_transaction_token(
-            "https://sts.example.test",
-            "https://notary.example.test",
-        );
-        config.sender_constraint = SenderConstraintPolicy::Required;
-        let signer = Arc::new(LocalJwkSigner::new(PrivateJwk::parse(RAW_JWK).unwrap()).unwrap());
-        let service = TokenExchangeService::new(
-            Arc::new(StaticVerifier { subject }),
-            signer,
-            Arc::new(InMemoryRateLimitStore::default()),
-            config,
-        )
-        .with_audit_sink(audit.clone());
-
-        let err = service
-            .exchange(request(), context(), OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap_err();
-
-        assert!(matches!(err, StsError::SenderConstraintMissing));
-        assert!(audit.events.lock().unwrap().is_empty());
-    }
-
-    #[tokio::test]
-    async fn exchange_rejects_session_binding_mismatch_before_mint_audit() {
-        let audit = Arc::new(RecordingAuditSink::default());
-        let service = strict_service().with_audit_sink(audit.clone());
-        let mut context = bound_context();
-        context.session_binding = Some("hmac-sha256:wrong".to_string());
-
-        let err = service
-            .exchange(request(), context, OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap_err();
-
-        assert!(matches!(err, StsError::SessionBindingInvalid));
-        assert!(audit.events.lock().unwrap().is_empty());
-    }
-
-    #[tokio::test]
-    async fn exchange_aborts_when_audit_sink_fails() {
-        let service = strict_service().with_audit_sink(Arc::new(FailingAuditSink));
-
-        let err = service
-            .exchange(request(), bound_context(), OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap_err();
-
-        assert!(matches!(err, StsError::Audit(StsAuditError::Unavailable)));
-    }
-
-    #[tokio::test]
-    async fn in_memory_rate_limit_denies_after_threshold() {
-        let service = service().with_rate_limit_policy(RateLimitPolicy {
-            max_requests: 1,
-            window: Duration::from_secs(60),
-        });
-        service
-            .exchange(request(), context(), OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap();
-
-        let err = service
-            .exchange(request(), context(), OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap_err();
-
-        assert!(matches!(err, StsError::RateLimited { .. }));
-    }
-
-    #[tokio::test]
-    async fn in_memory_rate_limit_evicts_expired_counters() {
-        let store = InMemoryRateLimitStore::default();
-        let scope = RateLimitScope::new("client").unwrap();
-        let first_key = RateLimitKey::new("client-a").unwrap();
-        let second_key = RateLimitKey::new("client-b").unwrap();
-        let policy = RateLimitPolicy {
-            max_requests: 10,
-            window: Duration::from_secs(60),
-        };
-
-        store
-            .check_and_increment(&scope, &first_key, policy, OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap();
-        store
-            .check_and_increment(
-                &scope,
-                &second_key,
-                policy,
-                OffsetDateTime::UNIX_EPOCH + time::Duration::seconds(61),
-            )
-            .await
-            .unwrap();
-
-        let state = store.state.lock().unwrap();
-        assert!(!state.counters.contains_key(&(scope.clone(), first_key)));
-        assert!(state.counters.contains_key(&(scope, second_key)));
-    }
-
-    #[tokio::test]
-    async fn in_memory_rate_limit_cleans_stale_counters_in_bounded_batches() {
-        let store = InMemoryRateLimitStore::default();
-        let scope = RateLimitScope::new("client").unwrap();
-        let policy = RateLimitPolicy {
-            max_requests: 10,
-            window: Duration::from_secs(60),
-        };
-
-        for index in 0..(RATE_LIMIT_CLEANUP_BATCH + 2) {
-            let key = RateLimitKey::new(format!("client-{index}")).unwrap();
-            store
-                .check_and_increment(&scope, &key, policy, OffsetDateTime::UNIX_EPOCH)
-                .await
-                .unwrap();
-        }
-
-        let first_fresh_key = RateLimitKey::new("fresh-client-a").unwrap();
-        store
-            .check_and_increment(
-                &scope,
-                &first_fresh_key,
-                policy,
-                OffsetDateTime::UNIX_EPOCH + time::Duration::seconds(61),
-            )
-            .await
-            .unwrap();
-        {
-            let state = store.state.lock().unwrap();
-            assert_eq!(state.counters.len(), 3);
-            assert!(state
-                .counters
-                .contains_key(&(scope.clone(), first_fresh_key)));
-        }
-
-        let second_fresh_key = RateLimitKey::new("fresh-client-b").unwrap();
-        store
-            .check_and_increment(
-                &scope,
-                &second_fresh_key,
-                policy,
-                OffsetDateTime::UNIX_EPOCH + time::Duration::seconds(61),
-            )
-            .await
-            .unwrap();
-
-        let state = store.state.lock().unwrap();
-        assert_eq!(state.counters.len(), 2);
-        assert!(state
-            .counters
-            .contains_key(&(scope.clone(), RateLimitKey::new("fresh-client-a").unwrap())));
-        assert!(state.counters.contains_key(&(scope, second_fresh_key)));
-    }
-
-    #[tokio::test]
-    async fn exchange_emits_redacted_mint_audit_event() {
-        let audit = Arc::new(RecordingAuditSink::default());
-        let service = strict_service().with_audit_sink(audit.clone());
-
-        service
-            .exchange(request(), bound_context(), OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap();
-
-        let events = audit.events.lock().unwrap();
-        assert_eq!(events.len(), 1);
-        let event = &events[0];
-        assert_eq!(event.event_type, "registry-platform-sts.token_minted");
-        assert_eq!(event.issuer, "https://sts.example.test");
-        assert_eq!(event.audience, "https://notary.example.test");
-        assert_eq!(event.client_id.as_deref(), Some("assisted-access-client"));
-        assert_eq!(event.correlation_id.as_deref(), Some("corr_123"));
-        assert_eq!(event.session_id.as_deref(), Some("sess_123"));
-        assert!(event.subject_hash.starts_with("hmac-sha256:"));
-        assert!(event.jti_hash.starts_with("hmac-sha256:"));
-        assert!(event.authorization_details_hash.starts_with("hmac-sha256:"));
-        let serialized = serde_json::to_string(event).unwrap();
-        assert!(!serialized.contains("subject.jwt"));
-        assert!(!serialized.contains("hmac-sha256:subject"));
-    }
-
-    #[tokio::test]
-    async fn exchange_requires_valid_session_binding_mac_when_configured() {
-        let err = strict_service()
-            .exchange(request(), context(), OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap_err();
-        assert!(matches!(err, StsError::SubjectBindingMissing));
-
-        let mut wrong = bound_context();
-        wrong.session_binding = Some("hmac-sha256:wrong".to_string());
-        let err = strict_service()
-            .exchange(request(), wrong, OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap_err();
-        assert!(matches!(err, StsError::SessionBindingInvalid));
-
-        strict_service()
-            .exchange(request(), bound_context(), OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap();
-    }
-
-    #[test]
-    fn session_binding_mac_covers_signed_caller_context() {
-        let config = TokenExchangeConfig::notary_transaction_token(
-            "https://sts.example.test",
-            "https://notary.example.test",
-        )
-        .with_session_binding_secret("session-binding-secret")
-        .with_subject_binding_claim("national_id");
-        let subject = verified_subject();
-        let context = bound_context();
-
-        validate_exchange_context(&context, &config, &subject).unwrap();
-
-        let mut wrong = context.clone();
-        wrong.client_id = Some("other-client".to_string());
-        assert!(matches!(
-            validate_exchange_context(&wrong, &config, &subject),
-            Err(StsError::SessionBindingInvalid)
-        ));
-
-        let mut wrong = context.clone();
-        wrong.tenant = Some("other-tenant".to_string());
-        assert!(matches!(
-            validate_exchange_context(&wrong, &config, &subject),
-            Err(StsError::SessionBindingInvalid)
-        ));
-
-        let mut wrong_subject = subject.clone();
-        wrong_subject.actor.as_mut().unwrap().actor_id_hash = "hmac-sha256:other-actor".to_string();
-        assert!(matches!(
-            validate_exchange_context(&context, &config, &wrong_subject),
-            Err(StsError::SessionBindingInvalid)
-        ));
-
-        let mut wrong_subject = subject;
-        wrong_subject.actor.as_mut().unwrap().delegation_ref = Some("other-delegation".to_string());
-        assert!(matches!(
-            validate_exchange_context(&context, &config, &wrong_subject),
-            Err(StsError::SessionBindingInvalid)
-        ));
-    }
-
-    #[test]
-    fn session_binding_mac_matches_signed_actor_delegation_source() {
-        let config = TokenExchangeConfig::notary_transaction_token(
-            "https://sts.example.test",
-            "https://notary.example.test",
-        )
-        .with_session_binding_secret("session-binding-secret")
-        .with_subject_binding_claim("national_id");
-        let mut subject = verified_subject();
-        subject.actor.as_mut().unwrap().delegation_ref = None;
-        let mut context = bound_context();
-        context.delegation_ref = Some("context-delegation".to_string());
-        context.session_binding = Some(session_binding_mac(
-            "session-binding-secret",
-            SessionBindingMacInput {
-                session_id: "sess_123",
-                correlation_id: "corr_123",
-                verified_subject: "hmac-sha256:subject",
-                subject_id_hash: "hmac-sha256:subject-id",
-                client_id: "assisted-access-client",
-                tenant: "tenant-a",
-                actor_id_hash: "hmac-sha256:actor",
-                delegation_ref: "",
-            },
-        ));
-
-        validate_exchange_context(&context, &config, &subject).unwrap();
-
-        context.session_binding = Some(session_binding_mac(
-            "session-binding-secret",
-            SessionBindingMacInput {
-                session_id: "sess_123",
-                correlation_id: "corr_123",
-                verified_subject: "hmac-sha256:subject",
-                subject_id_hash: "hmac-sha256:subject-id",
-                client_id: "assisted-access-client",
-                tenant: "tenant-a",
-                actor_id_hash: "hmac-sha256:actor",
-                delegation_ref: "context-delegation",
-            },
-        ));
-        assert!(matches!(
-            validate_exchange_context(&context, &config, &subject),
-            Err(StsError::SessionBindingInvalid)
-        ));
-    }
-
-    #[tokio::test]
-    async fn exchange_rejects_authorization_details_with_wrong_subject_binding_claim() {
-        let mut request = request();
-        request.authorization_details.as_mut().unwrap()[0]
-            .subject
-            .as_mut()
-            .unwrap()
-            .binding_claim = "other_claim".to_string();
-
-        let err = strict_service()
-            .exchange(request, bound_context(), OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap_err();
-
-        assert!(matches!(err, StsError::SubjectBindingMismatch));
-    }
-
-    #[tokio::test]
-    async fn in_memory_rate_limit_applies_per_subject_across_clients() {
-        let service = strict_service().with_rate_limit_policy(RateLimitPolicy {
-            max_requests: 1,
-            window: Duration::from_secs(60),
-        });
-        service
-            .exchange(request(), bound_context(), OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap();
-        let mut second_context = bound_context();
-        second_context.client_id = Some("different-assisted-access-client".to_string());
-
-        let err = service
-            .exchange(request(), second_context, OffsetDateTime::UNIX_EPOCH)
-            .await
-            .unwrap_err();
-
-        assert!(matches!(err, StsError::RateLimited { .. }));
-    }
-
-    #[tokio::test]
-    async fn exchange_requires_session_binding_by_default() {
-        let err = service()
-            .exchange(
-                request(),
-                ExchangeContext::default(),
-                OffsetDateTime::UNIX_EPOCH,
-            )
-            .await
-            .unwrap_err();
-
-        assert!(matches!(err, StsError::SessionBindingMissing));
-    }
-
-    #[test]
-    fn debug_output_redacts_token_material() {
-        let request = request();
-        let debug = format!("{request:?}");
-
-        assert!(!debug.contains("subject.jwt"));
-        assert!(debug.contains("subject_token"));
-    }
-
-    #[test]
-    fn public_jwks_excludes_private_fields() {
-        let signer = LocalJwkSigner::new(PrivateJwk::parse(RAW_JWK).unwrap()).unwrap();
-        let jwks = public_jwks(&signer);
-        let text = serde_json::to_string(&jwks).unwrap();
-
-        assert!(!text.contains("\"d\""));
-        assert!(!text.contains("2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw"));
-        assert!(text.contains("did:web:sts.test#key-1"));
-    }
-
-    #[test]
-    fn metadata_advertises_token_exchange_and_authorization_details() {
-        let config = TokenExchangeConfig::notary_transaction_token(
-            "https://sts.example.test",
-            "https://notary.example.test",
-        );
-
-        let metadata = authorization_server_metadata(
-            &config,
-            "https://sts.example.test/oauth/token",
-            "https://sts.example.test/.well-known/jwks.json",
-        );
-
-        assert_eq!(metadata["issuer"], "https://sts.example.test");
-        assert_eq!(
-            metadata["grant_types_supported"][0],
-            TOKEN_EXCHANGE_GRANT_TYPE
-        );
-        assert_eq!(
-            metadata["subject_token_types_supported"][0],
-            ACCESS_TOKEN_TYPE
-        );
-        assert_eq!(
-            metadata["authorization_details_types_supported"][0],
-            NOTARY_AUTHORIZATION_DETAILS_TYPE
-        );
-    }
-
-    #[tokio::test]
-    async fn http_token_endpoint_maps_assisted_access_context_and_mints_token() {
-        let app = sts_router(
-            Arc::new(service()),
-            StsHttpConfig::local("https://sts.example.test"),
-        );
-        let mut body = serde_json::to_value(request()).unwrap();
-        body["client_id"] = json!("assisted-access-client");
-        body["tenant"] = json!("tenant-a");
-        body["session_id"] = json!("sess_http");
-        body["correlation_id"] = json!("corr_http");
-
-        let response = app
-            .oneshot(
-                Request::post("/oauth/token")
-                    .header(header::CONTENT_TYPE, "application/json")
-                    .body(Body::from(serde_json::to_vec(&body).unwrap()))
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
-
-        assert_eq!(response.status(), StatusCode::OK);
-        let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
-        let response: TokenExchangeResponse = serde_json::from_slice(&body).unwrap();
-        let (_header, payload) = decode_unverified(&response.access_token);
-        assert_eq!(payload["aud"], "https://notary.example.test");
-        assert_eq!(payload["client_id"], "assisted-access-client");
-        assert_eq!(payload["tenant"], "tenant-a");
-        assert_eq!(payload["sid"], "sess_http");
-        assert_eq!(payload["correlation_id"], "corr_http");
-        assert_eq!(
-            payload["authorization_details"][0]["locations"][0],
-            "https://notary.example.test"
-        );
-    }
-
-    #[tokio::test]
-    async fn http_token_endpoint_rejects_missing_session_binding() {
-        let app = sts_router(
-            Arc::new(service()),
-            StsHttpConfig::local("https://sts.example.test"),
-        );
-        let mut body = serde_json::to_value(request()).unwrap();
-        body["client_id"] = json!("assisted-access-client");
-
-        let response = app
-            .oneshot(
-                Request::post("/oauth/token")
-                    .header(header::CONTENT_TYPE, "application/json")
-                    .body(Body::from(serde_json::to_vec(&body).unwrap()))
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
-
-        assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-        let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
-        let problem: Value = serde_json::from_slice(&body).unwrap();
-        assert_eq!(problem["error"], "invalid_request");
-        assert!(problem["error_description"]
-            .as_str()
-            .unwrap()
-            .contains("session binding"));
-    }
-
-    #[tokio::test]
-    async fn http_metadata_and_jwks_are_served_without_private_key_material() {
-        let app = sts_router(
-            Arc::new(service()),
-            StsHttpConfig::local("https://sts.example.test"),
-        );
-
-        let metadata_response = app
-            .clone()
-            .oneshot(
-                Request::get("/.well-known/oauth-authorization-server")
-                    .body(Body::empty())
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
-        assert_eq!(metadata_response.status(), StatusCode::OK);
-        let metadata_body = to_bytes(metadata_response.into_body(), usize::MAX)
-            .await
-            .unwrap();
-        let metadata: Value = serde_json::from_slice(&metadata_body).unwrap();
-        assert_eq!(
-            metadata["token_endpoint"],
-            "https://sts.example.test/oauth/token"
-        );
-        assert_eq!(
-            metadata["jwks_uri"],
-            "https://sts.example.test/.well-known/jwks.json"
-        );
-
-        let jwks_response = app
-            .oneshot(
-                Request::get("/.well-known/jwks.json")
-                    .body(Body::empty())
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
-        assert_eq!(jwks_response.status(), StatusCode::OK);
-        let jwks_body = to_bytes(jwks_response.into_body(), usize::MAX)
-            .await
-            .unwrap();
-        let jwks_text = String::from_utf8(jwks_body.to_vec()).unwrap();
-        assert!(jwks_text.contains("did:web:sts.test#key-1"));
-        assert!(!jwks_text.contains("\"d\""));
-        assert!(!jwks_text.contains("2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw"));
-    }
-
-    fn decode_unverified(jwt: &str) -> (Value, Value) {
-        let mut parts = jwt.split('.');
-        let header = parts.next().unwrap();
-        let payload = parts.next().unwrap();
-        let header = URL_SAFE_NO_PAD.decode(header).unwrap();
-        let payload = URL_SAFE_NO_PAD.decode(payload).unwrap();
-        (
-            serde_json::from_slice(&header).unwrap(),
-            serde_json::from_slice(&payload).unwrap(),
-        )
-    }
-}
diff --git a/crates/registry-platform-testing/Cargo.toml b/crates/registry-platform-testing/Cargo.toml
index 105669a0c..7afd170d2 100644
--- a/crates/registry-platform-testing/Cargo.toml
+++ b/crates/registry-platform-testing/Cargo.toml
@@ -24,13 +24,10 @@ registry-platform-audit = { workspace = true }
 registry-platform-crypto = { workspace = true }
 registry-platform-httpsec = { workspace = true }
 registry-platform-httputil = { workspace = true }
-registry-platform-oid4vci = { workspace = true }
 registry-platform-oidc = { workspace = true }
-registry-platform-replay = { workspace = true }
 reqwest.workspace = true
 serde_json.workspace = true
 thiserror.workspace = true
-time.workspace = true
 tokio.workspace = true
 tower.workspace = true
 wiremock.workspace = true
diff --git a/crates/registry-platform-testing/README.md b/crates/registry-platform-testing/README.md
index 5e78b2361..52c42ef4f 100644
--- a/crates/registry-platform-testing/README.md
+++ b/crates/registry-platform-testing/README.md
@@ -14,12 +14,9 @@ This crate is test-only. It fails to compile unless callers enable the
 - `assert_chain_integrity` for internally consistent audit envelope assertions.
 - `assert_json_absent_strings` for focused audit non-leak checks over JSON
   records.
-- `assert_replay_duplicate_rejected` for reusable replay-store duplicate checks.
 - `oidc_verifier_config` for a standard EdDSA test verifier configuration.
-- Federation fixture helpers for building signed Notary request/response JWTs.
 - Provider-backed Ed25519 signer and JWKS helpers for tests that exercise the
   production signing abstraction.
-- `sign_openid4vci_proof_jwt` for building OID4VCI holder proof JWTs in tests.
 
 ## Typical Use
 
@@ -76,12 +73,6 @@ Also tracks request body size (used by `assert_max_request_bytes`).
 Type alias for `registry_platform_audit::ChainVerificationError`. Exported here
 so test code only needs to import from this crate.
 
-### `ReplayAssertionError`
-
-Error type returned by `assert_replay_duplicate_rejected`. It lets downstream
-integration tests assert a `ReplayStore` accepts the first scoped key and rejects
-the duplicate with `AlreadySeen`.
-
 ### JWT signing helpers
 
 - `sign_ed25519_compact_jwt(private_jwk, typ, kid, claims)` — parse a JWK
@@ -96,34 +87,6 @@ the duplicate with `AlreadySeen`.
   metadata, without private JWK members.
 - `fixtures::ed25519_signer()` — return a `LocalJwkSigner` backed by the
   primary Ed25519 fixture key.
-- `sign_openid4vci_proof_jwt(private_jwk, audience, nonce, now_unix_seconds)` —
-  build an OID4VCI holder proof JWT (`typ = openid4vci-proof+jwt`) with the
-  holder's `did:jwk` inline in the `jwk` header. For use in credential endpoint
-  tests; **not** for production.
-
-### Federation fixture helpers
-
-These helpers produce deterministic JWT claim sets matching the
-`registry-notary-federation/v0.1` protocol. They are intended for Notary federation tests only; the domain knowledge is isolated here so callers don't
-have to re-implement the claim layout.
-
-- `federation_request_fixture_claims(issuer, subject_node_id, audience_node_id, now)` —
-  claims for a federation evaluate request JWT.
-- `federation_response_fixture_claims(issuer, subject_node_id, audience_node_id, request_jti, now)` —
-  claims for a federation evaluate response JWT.
-
-### Federation constants
-
-| Constant | Value | Use |
-|---|---|---|
-| `FEDERATION_PROTOCOL` | `"registry-notary-federation/v0.1"` | `"protocol"` claim value |
-| `FEDERATION_REQUEST_JWT_TYPE` | `"registry-notary-request+jwt"` | `"typ"` header for request JWTs |
-| `FEDERATION_RESPONSE_JWT_TYPE` | `"registry-notary-response+jwt"` | `"typ"` header for response JWTs |
-| `FEDERATION_EVALUATE_ACTION` | `"evaluate"` | `"action"` claim value |
-| `FEDERATION_REQUEST_FIXTURE_JTI` | (fixed ULID string) | Deterministic `"jti"` for request fixtures |
-| `FEDERATION_RESPONSE_FIXTURE_JTI` | (fixed ULID string) | Deterministic `"jti"` for response fixtures |
-| `FEDERATION_FIXTURE_PROFILE` | `"disability_status_predicate"` | `"profile"` claim value |
-| `FEDERATION_FIXTURE_PURPOSE` | (URL string) | `"purpose"` claim value |
 
 ## Fixture Notes
 
diff --git a/crates/registry-platform-testing/src/lib.rs b/crates/registry-platform-testing/src/lib.rs
index 95acf4c70..86457aaa8 100644
--- a/crates/registry-platform-testing/src/lib.rs
+++ b/crates/registry-platform-testing/src/lib.rs
@@ -20,13 +20,8 @@ use base64::Engine;
 use jsonwebtoken::Algorithm;
 use registry_platform_audit::{verify_chain, AuditChainHasher, AuditEnvelope};
 use registry_platform_crypto::{sign, LocalJwkSigner, PrivateJwk, PublicJwk, SigningProvider};
-use registry_platform_oid4vci::{CREDENTIAL_SIGNING_ALG_EDDSA, PROOF_JWT_TYPE};
-use registry_platform_replay::{
-    ReplayInsertOutcome, ReplayKey, ReplayScope, ReplayStore, ReplayStoreError,
-};
 use serde_json::{json, Map, Value};
 use thiserror::Error;
-use time::OffsetDateTime;
 use tokio::{net::TcpListener, sync::oneshot, task::JoinHandle};
 use wiremock::{
     matchers::{method, path},
@@ -34,15 +29,6 @@ use wiremock::{
 };
 
 const TOKEN_LIFETIME: Duration = Duration::from_secs(3600);
-pub const FEDERATION_PROTOCOL: &str = "registry-notary-federation/v0.1";
-pub const FEDERATION_REQUEST_JWT_TYPE: &str = "registry-notary-request+jwt";
-pub const FEDERATION_RESPONSE_JWT_TYPE: &str = "registry-notary-response+jwt";
-pub const FEDERATION_EVALUATE_ACTION: &str = "evaluate";
-pub const FEDERATION_REQUEST_FIXTURE_JTI: &str = "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6";
-pub const FEDERATION_RESPONSE_FIXTURE_JTI: &str = "01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q7";
-pub const FEDERATION_FIXTURE_PROFILE: &str = "disability_status_predicate";
-pub const FEDERATION_FIXTURE_PURPOSE: &str =
-    "https://purpose.example.gov/social-protection/service-delivery";
 
 #[derive(Debug)]
 pub struct MockIdp {
@@ -268,104 +254,6 @@ pub fn jwks_from_signing_provider(signer: &dyn SigningProvider) -> Value {
     json!({ "keys": [signer.public_jwk()] })
 }
 
-#[must_use]
-pub fn federation_request_fixture_claims(
-    issuer: &str,
-    subject_node_id: &str,
-    audience_node_id: &str,
-    now_unix_seconds: i64,
-) -> Value {
-    json!({
-        "iss": issuer,
-        "sub": subject_node_id,
-        "aud": audience_node_id,
-        "iat": now_unix_seconds,
-        "nbf": now_unix_seconds,
-        "exp": now_unix_seconds + 300,
-        "jti": FEDERATION_REQUEST_FIXTURE_JTI,
-        "protocol": FEDERATION_PROTOCOL,
-        "action": FEDERATION_EVALUATE_ACTION,
-        "profile": FEDERATION_FIXTURE_PROFILE,
-        "purpose": FEDERATION_FIXTURE_PURPOSE,
-        "request": {
-            "subject": {
-                "id": "example-subject-id",
-                "id_type": "national_id",
-            },
-            "claims": ["disability_status"],
-        },
-    })
-}
-
-#[must_use]
-pub fn federation_response_fixture_claims(
-    issuer: &str,
-    subject_node_id: &str,
-    audience_node_id: &str,
-    request_jti: &str,
-    now_unix_seconds: i64,
-) -> Value {
-    json!({
-        "iss": issuer,
-        "sub": subject_node_id,
-        "aud": audience_node_id,
-        "iat": now_unix_seconds,
-        "nbf": now_unix_seconds,
-        "exp": now_unix_seconds + 600,
-        "jti": FEDERATION_RESPONSE_FIXTURE_JTI,
-        "request_jti": request_jti,
-        "protocol": FEDERATION_PROTOCOL,
-        "action": FEDERATION_EVALUATE_ACTION,
-        "profile": FEDERATION_FIXTURE_PROFILE,
-        "result": {
-            "evaluation_id": "eval_01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6",
-            "subject_ref": {
-                "hash": "hmac-sha256:fixture",
-                "id_type": "national_id",
-            },
-            "claims": {
-                "disability_status": {
-                    "satisfied": true,
-                    "disclosure": "predicate",
-                },
-            },
-        },
-    })
-}
-
-#[must_use]
-pub fn sign_openid4vci_proof_jwt(
-    private_jwk: &str,
-    audience: &str,
-    nonce: Option<&str>,
-    now_unix_seconds: i64,
-) -> String {
-    let holder = PrivateJwk::parse(private_jwk).expect("fixture holder JWK parses");
-    let holder_id = registry_platform_crypto::did_jwk_from_public_jwk(&holder.public())
-        .expect("fixture holder public JWK encodes as did:jwk");
-    let mut claims = Map::new();
-    claims.insert("iss".to_string(), Value::String(holder_id));
-    claims.insert("aud".to_string(), Value::String(audience.to_string()));
-    claims.insert("iat".to_string(), json!(now_unix_seconds));
-    claims.insert("exp".to_string(), json!(now_unix_seconds + 60));
-    if let Some(nonce) = nonce {
-        claims.insert("nonce".to_string(), Value::String(nonce.to_string()));
-    }
-
-    let header = json!({
-        "alg": CREDENTIAL_SIGNING_ALG_EDDSA,
-        "typ": PROOF_JWT_TYPE,
-        "jwk": holder.public(),
-    });
-    let signing_input = format!(
-        "{}.{}",
-        encode_json(&header),
-        encode_json(&Value::Object(claims))
-    );
-    let signature = sign(signing_input.as_bytes(), &holder).expect("fixture holder signs proof");
-    format!("{signing_input}.{}", URL_SAFE_NO_PAD.encode(signature))
-}
-
 fn normalize_claims(issuer: &str, claims: Value) -> Value {
     let now = now_unix_seconds();
     let mut claims = match claims {
@@ -571,34 +459,6 @@ fn json_value_contains(value: &Value, needle: &str) -> bool {
     }
 }
 
-#[derive(Debug, Error)]
-#[non_exhaustive]
-pub enum ReplayAssertionError {
-    #[error("first replay insert did not succeed; got {0:?}")]
-    FirstInsert(ReplayInsertOutcome),
-    #[error("duplicate replay insert was not rejected; got {0:?}")]
-    DuplicateInsert(ReplayInsertOutcome),
-    #[error("replay store failed: {0}")]
-    Store(#[from] ReplayStoreError),
-}
-
-pub async fn assert_replay_duplicate_rejected(
-    store: &dyn ReplayStore,
-    scope: &ReplayScope,
-    key: &ReplayKey,
-    expires_at: OffsetDateTime,
-) -> Result<(), ReplayAssertionError> {
-    match store.insert_once(scope, key, expires_at).await? {
-        ReplayInsertOutcome::Inserted => {}
-        outcome => return Err(ReplayAssertionError::FirstInsert(outcome)),
-    }
-
-    match store.insert_once(scope, key, expires_at).await? {
-        ReplayInsertOutcome::AlreadySeen => Ok(()),
-        outcome => Err(ReplayAssertionError::DuplicateInsert(outcome)),
-    }
-}
-
 #[must_use]
 pub fn oidc_verifier_config(
     issuer: String,
@@ -624,6 +484,7 @@ pub fn oidc_verifier_config(
 mod tests {
     use std::sync::Mutex;
 
+    use super::*;
     use async_trait::async_trait;
     use jsonwebtoken::decode_header;
     use registry_platform_audit::{AuditError, AuditSink, ChainState};
@@ -633,9 +494,6 @@ mod tests {
         fetch_discovery_with_policy, JwksFetcher, JwksFetcherConfig, OidcDiscoveryConfig,
         TokenVerifier,
     };
-    use registry_platform_replay::{InMemoryReplayStore, ReplayKey, ReplayScope};
-
-    use super::*;
 
     #[test]
     fn ed25519_fixture_signs_and_verifies() {
@@ -658,21 +516,17 @@ mod tests {
     #[tokio::test]
     async fn provider_backed_jwt_fixture_signs_with_provider_kid_and_jwks() {
         let signer = fixtures::ed25519_signer();
+        let typ = "registry-platform-testing+jwt";
         let token = sign_ed25519_compact_jwt_with_provider(
             &signer,
-            FEDERATION_REQUEST_JWT_TYPE,
-            federation_request_fixture_claims(
-                "https://agency-a.example.gov",
-                "did:web:agency-a.example.gov",
-                "did:web:agency-b.example.gov",
-                now_unix_seconds(),
-            ),
+            typ,
+            json!({ "sub": "fixture-subject" }),
         )
         .await;
 
         let header = decode_header(&token).expect("header decodes");
         assert_eq!(header.kid.as_deref(), Some(signer.key_id()));
-        assert_eq!(header.typ.as_deref(), Some(FEDERATION_REQUEST_JWT_TYPE));
+        assert_eq!(header.typ.as_deref(), Some(typ));
 
         let jwks = jwks_from_signing_provider(&signer);
         let keys = jwks["keys"].as_array().expect("jwks keys");
@@ -680,75 +534,6 @@ mod tests {
         assert!(keys[0].get("d").is_none());
     }
 
-    #[tokio::test]
-    async fn federation_request_jwt_signs_verifies_and_tampering_fails() {
-        let (private, _) = fixtures::ed25519_pair();
-        let issuer = "https://agency-a.example.gov";
-        let audience = "did:web:agency-b.example.gov";
-        let subject = "did:web:agency-a.example.gov";
-        let now = now_unix_seconds();
-        let claims = federation_request_fixture_claims(issuer, subject, audience, now);
-        let token = sign_ed25519_compact_jwt_with_key(
-            &private,
-            FEDERATION_REQUEST_JWT_TYPE,
-            "registry-platform-testing-ed25519-1",
-            claims,
-        );
-
-        let header = decode_header(&token).expect("header decodes");
-        assert_eq!(header.typ.as_deref(), Some(FEDERATION_REQUEST_JWT_TYPE));
-        assert_eq!(
-            jwt_claims(&token)["jti"],
-            Value::String(FEDERATION_REQUEST_FIXTURE_JTI.to_string())
-        );
-
-        let jwks = jwks_from_private_jwk(&private);
-        let upstream = MockHttpUpstream::start().await;
-        upstream
-            .expect("GET", "/jwks")
-            .respond_json(200, jwks)
-            .await;
-        let fetcher = Arc::new(JwksFetcher::new_with_fetch_url_policy(
-            format!("{}/jwks", upstream.url()),
-            JwksFetcherConfig {
-                cache_ttl: Duration::from_secs(60),
-                negative_cache_ttl: Duration::from_millis(1),
-                refresh_cooldown: Duration::from_millis(1),
-                max_doc_bytes: 16 * 1024,
-                request_timeout: Duration::from_secs(5),
-            },
-            FetchUrlPolicy::dev(),
-        ));
-        let verifier = TokenVerifier::new(
-            registry_platform_oidc::TokenVerifierConfig {
-                issuer: issuer.to_string(),
-                audiences: vec![audience.to_string()],
-                allowed_algorithms: vec![Algorithm::EdDSA],
-                allowed_typ: vec![FEDERATION_REQUEST_JWT_TYPE.to_string()],
-                allowed_id_typ: vec!["JWT".to_string(), "id_token".to_string()],
-                allowed_userinfo_typ: vec!["JWT".to_string()],
-                userinfo_requires_exp: true,
-                scope_claim: "scope".to_string(),
-                scope_separator: ' ',
-                scope_map: None,
-                allowed_clients: Vec::new(),
-                leeway: Duration::from_secs(60),
-            },
-            fetcher,
-        );
-
-        let verified = verifier.verify(&token).await.expect("request verifies");
-        assert_eq!(verified.claims.iss.as_deref(), Some(issuer));
-        assert_eq!(verified.claims.sub.as_deref(), Some(subject));
-        assert_eq!(
-            verified.claims.extra["jti"],
-            Value::String(FEDERATION_REQUEST_FIXTURE_JTI.to_string())
-        );
-
-        let tampered = tamper_payload_claim(&token, "purpose", json!("https://attacker.test"));
-        assert!(verifier.verify(&tampered).await.is_err());
-    }
-
     #[tokio::test]
     async fn mock_idp_serves_discovery_jwks_and_mints_verifiable_tokens() {
         let idp = MockIdp::start().await;
@@ -773,6 +558,7 @@ mod tests {
                 refresh_cooldown: Duration::from_millis(1),
                 max_doc_bytes: 16 * 1024,
                 request_timeout: Duration::from_secs(5),
+                outage_tolerance: Duration::from_secs(900),
             },
             FetchUrlPolicy::dev(),
         ));
@@ -908,39 +694,6 @@ mod tests {
         assert_eq!(verification.last_hash, Some(second.record_hash));
     }
 
-    #[tokio::test]
-    async fn replay_duplicate_assertion_checks_store_behavior() {
-        let store = InMemoryReplayStore::new();
-        let scope =
-            ReplayScope::oid4vci_nonce("tenant-a", "issuer-a", "profile-a").expect("valid scope");
-        let key = ReplayKey::new("nonce-1").expect("valid key");
-        let expires_at = OffsetDateTime::now_utc() + Duration::from_secs(60);
-
-        assert_replay_duplicate_rejected(&store, &scope, &key, expires_at)
-            .await
-            .expect("duplicate rejection asserted");
-    }
-
-    fn jwt_claims(token: &str) -> Value {
-        let payload = token
-            .split('.')
-            .nth(1)
-            .expect("compact JWT has a payload segment");
-        let payload = URL_SAFE_NO_PAD
-            .decode(payload)
-            .expect("payload is base64url");
-        serde_json::from_slice(&payload).expect("payload is JSON")
-    }
-
-    fn tamper_payload_claim(token: &str, claim: &str, value: Value) -> String {
-        let mut parts = token.split('.').map(str::to_string).collect::<Vec<_>>();
-        assert_eq!(parts.len(), 3, "compact JWT has three segments");
-        let mut claims = jwt_claims(token);
-        claims[claim] = value;
-        parts[1] = encode_json(&claims);
-        parts.join(".")
-    }
-
     #[derive(Default)]
     struct MemorySink {
         envelopes: Mutex<Vec<AuditEnvelope>>,
diff --git a/crates/registry-platform-testing/tests/cross_crate_integration.rs b/crates/registry-platform-testing/tests/cross_crate_integration.rs
index 833a5c95f..c4360a0ff 100644
--- a/crates/registry-platform-testing/tests/cross_crate_integration.rs
+++ b/crates/registry-platform-testing/tests/cross_crate_integration.rs
@@ -137,6 +137,7 @@ async fn sample_axum_app_wires_middleware_oidc_and_audit_chain() {
             refresh_cooldown: Duration::from_millis(10),
             max_doc_bytes: 16 * 1024,
             request_timeout: Duration::from_secs(5),
+            outage_tolerance: Duration::from_secs(900),
         },
         FetchUrlPolicy::dev(),
     ));
diff --git a/crates/registry-relay/Cargo.toml b/crates/registry-relay/Cargo.toml
index 9d015a1b8..86742a17a 100644
--- a/crates/registry-relay/Cargo.toml
+++ b/crates/registry-relay/Cargo.toml
@@ -146,8 +146,6 @@ aws-lc-rs = { version = "1" }
 axum-test = { version = "20" }
 assert-json-diff = { version = "2" }
 chrono = { version = "0.4" }
-registry-notary-core.workspace = true
-registry-notary-server.workspace = true
 registry-platform-testing = { workspace = true, features = ["test-utils"] }
 proptest = { version = "1" }
 rcgen.workspace = true
diff --git a/crates/registry-relay/demo/config/all_demos.metadata.yaml b/crates/registry-relay/demo/config/all_demos.metadata.yaml
index 1f0b6cd74..c755700c6 100644
--- a/crates/registry-relay/demo/config/all_demos.metadata.yaml
+++ b/crates/registry-relay/demo/config/all_demos.metadata.yaml
@@ -17,13 +17,6 @@ catalog:
   application_profiles:
   - id: bregdcat-ap
     version: '3.0'
-federation:
-  node_id: did:web:all-demos.demo.example.gov
-  issuer: https://all-demos.demo.example.gov
-  jwks_uri: https://all-demos.demo.example.gov/.well-known/jwks.json
-  federation_api: https://all-demos.demo.example.gov/federation
-  supported_protocol_versions:
-  - registry-notary-federation/v0.1
 evaluation_profiles:
 - id: benefits-person-v1
   ruleset: benefits-person-v1
@@ -85,10 +78,10 @@ datasets:
     lookup_keys:
     - id
     access:
-      kind: registry-notary
-      conforms_to: registry-notary-federation/v0.1
-      endpoint_url: https://benefits-notary.demo.example.gov
-      discovery_url: https://benefits-notary.demo.example.gov/.well-known/evidence-service
+      kind: registry-evidence
+      conforms_to: registry.assertion-evidence/v1
+      endpoint_url: https://benefits-evidence.demo.example.gov
+      discovery_url: https://benefits-evidence.demo.example.gov/.well-known/evidence/jwks.json
       ruleset: benefits-person-v1
     policy:
       purpose:
@@ -525,10 +518,10 @@ datasets:
     lookup_keys:
     - id
     access:
-      kind: registry-notary
-      conforms_to: registry-notary-federation/v0.1
-      endpoint_url: https://education-notary.demo.example.gov
-      discovery_url: https://education-notary.demo.example.gov/.well-known/evidence-service
+      kind: registry-evidence
+      conforms_to: registry.assertion-evidence/v1
+      endpoint_url: https://education-evidence.demo.example.gov
+      discovery_url: https://education-evidence.demo.example.gov/.well-known/evidence/jwks.json
       ruleset: education-student-v1
     policy:
       purpose:
diff --git a/crates/registry-relay/demo/config/all_standards.metadata.yaml b/crates/registry-relay/demo/config/all_standards.metadata.yaml
index 5246baa33..bf27b387b 100644
--- a/crates/registry-relay/demo/config/all_standards.metadata.yaml
+++ b/crates/registry-relay/demo/config/all_standards.metadata.yaml
@@ -17,13 +17,6 @@ catalog:
   application_profiles:
   - id: bregdcat-ap
     version: '3.0'
-federation:
-  node_id: did:web:all-standards.demo.example.gov
-  issuer: https://all-standards.demo.example.gov
-  jwks_uri: https://all-standards.demo.example.gov/.well-known/jwks.json
-  federation_api: https://all-standards.demo.example.gov/federation
-  supported_protocol_versions:
-  - registry-notary-federation/v0.1
 evaluation_profiles:
 - id: disability-status-v1
   ruleset: disability-status-v1
@@ -823,10 +816,10 @@ datasets:
     lookup_keys:
     - member_identifier
     access:
-      kind: registry-notary
-      conforms_to: registry-notary-federation/v0.1
-      endpoint_url: https://disability-notary.demo.example.gov
-      discovery_url: https://disability-notary.demo.example.gov/.well-known/evidence-service
+      kind: registry-evidence
+      conforms_to: registry.assertion-evidence/v1
+      endpoint_url: https://disability-evidence.demo.example.gov
+      discovery_url: https://disability-evidence.demo.example.gov/.well-known/evidence/jwks.json
       ruleset: disability-status-v1
     policy:
       purpose:
@@ -971,10 +964,10 @@ datasets:
     lookup_keys:
     - group_id
     access:
-      kind: registry-notary
-      conforms_to: registry-notary-federation/v0.1
-      endpoint_url: https://social-registry-notary.demo.example.gov
-      discovery_url: https://social-registry-notary.demo.example.gov/.well-known/evidence-service
+      kind: registry-evidence
+      conforms_to: registry.assertion-evidence/v1
+      endpoint_url: https://social-registry-evidence.demo.example.gov
+      discovery_url: https://social-registry-evidence.demo.example.gov/.well-known/evidence/jwks.json
       ruleset: social-group-v1
     policy:
       purpose:
@@ -1088,10 +1081,10 @@ datasets:
     lookup_keys:
     - national_id
     access:
-      kind: registry-notary
-      conforms_to: registry-notary-federation/v0.1
-      endpoint_url: https://farmer-notary.demo.example.gov
-      discovery_url: https://farmer-notary.demo.example.gov/.well-known/evidence-service
+      kind: registry-evidence
+      conforms_to: registry.assertion-evidence/v1
+      endpoint_url: https://farmer-evidence.demo.example.gov
+      discovery_url: https://farmer-evidence.demo.example.gov/.well-known/evidence/jwks.json
       ruleset: farmer-status-v1
     policy:
       purpose:
diff --git a/crates/registry-relay/demo/config/benefits_casework.metadata.yaml b/crates/registry-relay/demo/config/benefits_casework.metadata.yaml
index 8dc8f44d6..466d84438 100644
--- a/crates/registry-relay/demo/config/benefits_casework.metadata.yaml
+++ b/crates/registry-relay/demo/config/benefits_casework.metadata.yaml
@@ -15,13 +15,6 @@ catalog:
   application_profiles:
   - id: bregdcat-ap
     version: '3.0'
-federation:
-  node_id: did:web:social-affairs.demo.example.gov
-  issuer: https://social-affairs.demo.example.gov
-  jwks_uri: https://social-affairs.demo.example.gov/.well-known/jwks.json
-  federation_api: https://social-affairs.demo.example.gov/federation
-  supported_protocol_versions:
-  - registry-notary-federation/v0.1
 evaluation_profiles:
 - id: benefits-person-v1
   ruleset: benefits-person-v1
@@ -68,10 +61,10 @@ datasets:
     lookup_keys:
     - id
     access:
-      kind: registry-notary
-      conforms_to: registry-notary-federation/v0.1
-      endpoint_url: https://benefits-notary.demo.example.gov
-      discovery_url: https://benefits-notary.demo.example.gov/.well-known/evidence-service
+      kind: registry-evidence
+      conforms_to: registry.assertion-evidence/v1
+      endpoint_url: https://benefits-evidence.demo.example.gov
+      discovery_url: https://benefits-evidence.demo.example.gov/.well-known/evidence/jwks.json
       ruleset: benefits-person-v1
     policy:
       purpose:
diff --git a/crates/registry-relay/demo/config/disability_registry.metadata.yaml b/crates/registry-relay/demo/config/disability_registry.metadata.yaml
index 302d02f83..a49863b69 100644
--- a/crates/registry-relay/demo/config/disability_registry.metadata.yaml
+++ b/crates/registry-relay/demo/config/disability_registry.metadata.yaml
@@ -15,13 +15,6 @@ catalog:
   application_profiles:
   - id: bregdcat-ap
     version: '3.0'
-federation:
-  node_id: did:web:spdci-registry-gateway.demo.example.gov
-  issuer: https://spdci-registry-gateway.demo.example.gov
-  jwks_uri: https://spdci-registry-gateway.demo.example.gov/.well-known/jwks.json
-  federation_api: https://spdci-registry-gateway.demo.example.gov/federation
-  supported_protocol_versions:
-  - registry-notary-federation/v0.1
 evaluation_profiles:
 - id: disability-status-v1
   ruleset: disability-status-v1
@@ -132,10 +125,10 @@ datasets:
     lookup_keys:
     - member_identifier
     access:
-      kind: registry-notary
-      conforms_to: registry-notary-federation/v0.1
-      endpoint_url: https://disability-notary.demo.example.gov
-      discovery_url: https://disability-notary.demo.example.gov/.well-known/evidence-service
+      kind: registry-evidence
+      conforms_to: registry.assertion-evidence/v1
+      endpoint_url: https://disability-evidence.demo.example.gov
+      discovery_url: https://disability-evidence.demo.example.gov/.well-known/evidence/jwks.json
       ruleset: disability-status-v1
     policy:
       purpose:
@@ -280,10 +273,10 @@ datasets:
     lookup_keys:
     - group_id
     access:
-      kind: registry-notary
-      conforms_to: registry-notary-federation/v0.1
-      endpoint_url: https://social-registry-notary.demo.example.gov
-      discovery_url: https://social-registry-notary.demo.example.gov/.well-known/evidence-service
+      kind: registry-evidence
+      conforms_to: registry.assertion-evidence/v1
+      endpoint_url: https://social-registry-evidence.demo.example.gov
+      discovery_url: https://social-registry-evidence.demo.example.gov/.well-known/evidence/jwks.json
       ruleset: social-group-v1
     policy:
       purpose:
@@ -397,10 +390,10 @@ datasets:
     lookup_keys:
     - national_id
     access:
-      kind: registry-notary
-      conforms_to: registry-notary-federation/v0.1
-      endpoint_url: https://farmer-notary.demo.example.gov
-      discovery_url: https://farmer-notary.demo.example.gov/.well-known/evidence-service
+      kind: registry-evidence
+      conforms_to: registry.assertion-evidence/v1
+      endpoint_url: https://farmer-evidence.demo.example.gov
+      discovery_url: https://farmer-evidence.demo.example.gov/.well-known/evidence/jwks.json
       ruleset: farmer-status-v1
     policy:
       purpose:
diff --git a/crates/registry-relay/demo/config/education_registry.metadata.yaml b/crates/registry-relay/demo/config/education_registry.metadata.yaml
index 5aa1b4dae..4d946f40a 100644
--- a/crates/registry-relay/demo/config/education_registry.metadata.yaml
+++ b/crates/registry-relay/demo/config/education_registry.metadata.yaml
@@ -15,13 +15,6 @@ catalog:
   application_profiles:
   - id: bregdcat-ap
     version: '3.0'
-federation:
-  node_id: did:web:education.demo.example.gov
-  issuer: https://education.demo.example.gov
-  jwks_uri: https://education.demo.example.gov/.well-known/jwks.json
-  federation_api: https://education.demo.example.gov/federation
-  supported_protocol_versions:
-  - registry-notary-federation/v0.1
 evaluation_profiles:
 - id: education-student-v1
   ruleset: education-student-v1
@@ -69,10 +62,10 @@ datasets:
     lookup_keys:
     - id
     access:
-      kind: registry-notary
-      conforms_to: registry-notary-federation/v0.1
-      endpoint_url: https://education-notary.demo.example.gov
-      discovery_url: https://education-notary.demo.example.gov/.well-known/evidence-service
+      kind: registry-evidence
+      conforms_to: registry.assertion-evidence/v1
+      endpoint_url: https://education-evidence.demo.example.gov
+      discovery_url: https://education-evidence.demo.example.gov/.well-known/evidence/jwks.json
       ruleset: education-student-v1
     policy:
       purpose:
diff --git a/crates/registry-relay/docs/README.md b/crates/registry-relay/docs/README.md
index 57048d11e..b89a55b59 100644
--- a/crates/registry-relay/docs/README.md
+++ b/crates/registry-relay/docs/README.md
@@ -1,6 +1,6 @@
 # Registry Relay documentation
 
-Registry Relay turns registry data you already hold, in spreadsheets or PostgreSQL, into protected, scoped, read-only HTTP APIs. Authorized callers read records over purpose-bound routes, and the gateway never widens reach at request time. Relay also publishes discovery metadata that points callers to a Registry Notary for claim and evidence verification.
+Registry Relay turns registry data you already hold, in spreadsheets or PostgreSQL, into protected, scoped, read-only HTTP APIs. Authorized callers read records over purpose-bound routes, and the gateway never widens reach at request time. Relay also publishes discovery metadata that points callers to a Registry Evidence deployment when they need a signed assertion.
 
 New here? Start with the current Registry Docs project-authoring journey:
 
@@ -14,14 +14,14 @@ The references describe supported behavior. Some links open the source repositor
 ## Integrate
 
 - [API guide](api.md): auth, scopes, filters, pagination, metadata caching, Problem Details, standards surfaces, and the admin route reference. The curated public OpenAPI surface lives in [openapi/registry-relay.openapi.json](../openapi/registry-relay.openapi.json) and the served `/docs` and `/openapi.json`.
-- [Client integration guide](client-integration.md): caller behavior for auth, purpose headers, discovery, pagination, ETags, errors, retries, aggregates, and the Registry Notary handoff.
+- [Client integration guide](client-integration.md): caller behavior for auth, purpose headers, discovery, pagination, ETags, errors, retries, aggregates, and the Registry Evidence handoff.
 - [Call Relay from OpenFn](openfn-relay-adaptor-guide.md): use the Registry Stack OpenFn Relay adaptor for protected row reads, discovery, and aggregate queries.
-- [Credential issuance migration](provenance.md): legacy Relay response-credential issuer config removal and the Registry Notary handoff.
+- [Credential issuance migration](provenance.md): legacy Relay response-credential issuer config removal and where signed answers come from instead.
 
 ## Operate
 
-- [Configuration guide](configuration.md): YAML contract, auth, audit, source formats, Postgres, entities, OGC Features, SP DCI, aggregates, and Registry Notary evidence-offering discovery.
-- [Operations runbook](ops.md): deployment, production hardening checklist, build and release, secret rotation, audit handling, reloads, probes, metrics, running with Registry Notary, and troubleshooting.
+- [Configuration guide](configuration.md): YAML contract, auth, audit, source formats, Postgres, entities, OGC Features, SP DCI, aggregates, and evidence-offering discovery.
+- [Operations runbook](ops.md): deployment, production hardening checklist, build and release, secret rotation, audit handling, reloads, probes, metrics, running with a consulting workload, and troubleshooting.
 - [Portable metadata](metadata.md): manifest split, metadata CLI, static publication, ODRL policy metadata contract, Relay metadata routes, catalog validation, and boundary rules.
 - [Standards adapter operator guide](standards-adapter-operator-guide.md): rollout checklist for OGC Features, OGC Records, OGC EDR, and SP DCI sync.
 - [XLSX readiness contract](xlsx-readiness-contract.md): workbook rules for stable XLSX-backed registries.
diff --git a/crates/registry-relay/docs/api.md b/crates/registry-relay/docs/api.md
index 43f339f9c..8d1102319 100644
--- a/crates/registry-relay/docs/api.md
+++ b/crates/registry-relay/docs/api.md
@@ -127,16 +127,16 @@ Fetch the protected contract metadata before execution:
 
 ```http
 GET /v1/consultations/person-status
-Authorization: Bearer <notary-jwt>
+Authorization: Bearer <workload-jwt>
 ```
 
 The metadata response contains exactly the active `contract_hash` and its complete public
-`contract`. There is no profile-listing route or route version. Execute only after Registry Notary
-has validated and pinned that contract:
+`contract`. There is no profile-listing route or route version. Execute only after the calling
+workload has validated and pinned that contract:
 
 ```http
 POST /v1/consultations/person-status/execute
-Authorization: Bearer <notary-jwt>
+Authorization: Bearer <workload-jwt>
 Content-Type: application/json
 Data-Purpose: program-enrollment-verification
 Registry-Notary-Evaluation-Id: 01JYZZZZZZZZZZZZZZZZZZZZZZ
@@ -162,7 +162,7 @@ returns `409 consultation.contract_mismatch` before source access.
 A successful response has the closed `registry.relay.consultation-result.v1` envelope. It returns
 only `match`, `no_match`, or `ambiguous`. A `match` includes every declared typed output.
 `no_match` and `ambiguous` omit `outputs`. Every outcome includes the generated consultation id,
-required Notary evaluation id, exact profile id and `contract_hash`, acquisition time and class,
+the required `notary_evaluation_id`, exact profile id and `contract_hash`, acquisition time and class,
 integration id and revision, and snapshot evidence when applicable.
 Raw inputs, source credentials, source URLs, static policy digests, and source diagnostics are never
 returned.
@@ -238,7 +238,7 @@ These frozen semantics apply to ordinary entity and OGC feature routes:
 - When the header is present, the value is **always recorded verbatim** in the audit trail.
 - Without an entity `governed_policy`, purpose **values are not enforced** on those ordinary reads. Relay records the value but does not validate, compare, or allowlist it.
 - With an entity `governed_policy`, governed evidence-gateway routes evaluate the configured PDP purpose allowlist and return a stable `pdp.*` denial when the purpose is not permitted.
-- **Registry Notary** remains the caller-side purpose and claim-evaluation layer.
+- Purpose declaration and claim evaluation remain **caller-side**; Relay records the purpose and serves the pinned plan, and never decides a claim.
 - Value-level allowlists remain additive opt-in configuration and do not change the default `require_purpose_header` behavior.
 
 The native `/v1/consultations/.../execute` surface is stricter. It validates `Data-Purpose` against the selected hash-pinned public contract before source dispatch and returns `403 consultation.denied` when the purpose is not allowed.
@@ -388,7 +388,7 @@ GET /metadata/evidence-offerings
 GET /metadata/evidence-offerings/individual_name_evidence
 ```
 
-Metadata reads require the caller's `metadata` scope for the owning dataset. They do not execute a check or disclose row data. Relay publishes discovery records only; Registry Notary executes verification. Evidence offerings carry `access.kind: registry-notary` metadata with the advertised Notary endpoint or discovery URL; clients submit claims and evidence to Registry Notary, not Relay. For the complete client handoff sequence, see [client-integration.md](client-integration.md).
+Metadata reads require the caller's `metadata` scope for the owning dataset. They do not execute a check or disclose row data. Relay publishes discovery records only; the service named by the offering answers the evidence request. Evidence offerings carry `access.kind: registry-evidence` metadata with the advertised endpoint and discovery URLs; clients request assertions from that Evidence deployment, not from Relay. For the complete client handoff sequence, see [client-integration.md](client-integration.md).
 
 The list endpoint accepts metadata-only filters:
 
@@ -543,4 +543,4 @@ Startup-only split metadata failures use stable `metadata.manifest.*` and `runti
 
 ## Credential issuance
 
-Relay does not issue response credentials, host DID documents, or publish credential-support schemas and contexts. Use Registry Notary for credential issuance and verification workflows. See [provenance.md](provenance.md) for migration notes.
+Relay does not issue response credentials, host DID documents, or publish credential-support schemas and contexts. Use Registry Evidence when a caller needs a signed, minimum-disclosure answer it can verify later. See [provenance.md](provenance.md) for migration notes.
diff --git a/crates/registry-relay/docs/client-integration.md b/crates/registry-relay/docs/client-integration.md
index f97aeacbc..499a20d4a 100644
--- a/crates/registry-relay/docs/client-integration.md
+++ b/crates/registry-relay/docs/client-integration.md
@@ -13,7 +13,7 @@ is disabled for demos or controlled tooling.
 sequenceDiagram
   participant Client as Application client
   participant Relay as Registry Relay
-  participant Notary as Registry Notary
+  participant Evidence as Registry Evidence
 
   Client->>Relay: Authenticated discovery (OpenAPI, metadata, schemas)
   Relay-->>Client: Scoped views (ETag, 304 if unchanged)
@@ -23,16 +23,16 @@ sequenceDiagram
     Client->>Relay: Retry idempotent GET with jittered backoff
   end
   Relay-->>Client: Entity records (opaque next_cursor)
-  opt claim or evidence verification needed
+  opt a signed assertion is needed
     Client->>Relay: Discover evidence offering
-    Relay-->>Client: access.kind registry-notary endpoint
-    Client->>Notary: Follow Registry Notary client docs
+    Relay-->>Client: access.kind registry-evidence endpoint
+    Client->>Evidence: Request the assertion from that endpoint
   end
 ```
 
 *The typical client lifecycle: authenticated discovery, scoped reads with
-conservative retries, and handoff to Registry Notary for verification or
-credential issuance. Each step is detailed in the sections that follow.*
+conservative retries, and handoff to Registry Evidence when the caller needs a
+signed answer. Each step is detailed in the sections that follow.*
 
 ## Connect to an existing deployment
 
@@ -75,7 +75,8 @@ Before a client is allowed to consume Relay data, confirm:
 - The client handles RFC 9457 Problem Details instead of parsing text messages.
 - The client treats cursors and `ETags` as opaque values.
 - Logs redact bearer tokens, API keys, query values for sensitive fields, raw
-  row bodies, credential bodies from Notary workflows, and Problem Details `detail`.
+  row bodies, assertions received from an Evidence deployment, and Problem
+  Details `detail`.
 
 ## OpenFn workflows
 
@@ -89,8 +90,8 @@ evidence offering discovery:
 ```
 
 Use the adaptor when the workflow is authorized to read Relay data directly.
-Use Registry Notary when the workflow needs a governed trust decision or a
-certified value claim. The [OpenFn Relay guide](openfn-relay-adaptor-guide.md)
+Call Registry Evidence instead when the workflow needs a signed answer it can
+verify later. The [OpenFn Relay guide](openfn-relay-adaptor-guide.md)
 shows the lab-backed workflow shape and guardrails.
 
 ## Authentication
@@ -250,11 +251,11 @@ Use conservative retries:
 Relay is read-only for registry data, but retries still create extra audit
 events and may repeat costly source reads.
 
-## Registry Notary handoff
+## Registry Evidence handoff
 
-Relay publishes evidence offering metadata for discovery and delegates all claim
-and evidence verification to Registry Notary. Notary also owns credential
-issuance. The only evidence offering routes
+Relay publishes evidence offering metadata for discovery. It makes no assertion
+about a subject and signs nothing; a client that needs one asks the Evidence
+deployment the offering advertises. The only evidence offering routes
 in Relay are:
 
 ```http
@@ -271,26 +272,26 @@ issue verification receipts, or disclose row data. There is no
 sequenceDiagram
   participant Client as Service client
   participant Relay as Registry Relay
-  participant Notary as Registry Notary
+  participant Evidence as Registry Evidence
 
   Client->>Relay: GET /metadata/evidence-offerings
-  Relay-->>Client: Offering metadata with access.kind registry-notary
-  Client->>Notary: Submit claim or evidence to the advertised endpoint
-  Notary-->>Client: Verification result or credential
+  Relay-->>Client: Offering metadata with access.kind registry-evidence
+  Client->>Evidence: Request an assertion from the advertised endpoint
+  Evidence-->>Client: Signed minimum-disclosure assertion
 ```
 
-*The discovery and verification boundary. Relay publishes evidence offering
-metadata that points to a Notary; the client submits the claim or evidence to
-that Notary, which performs verification. Relay makes no verification decision.*
+*The discovery and assertion boundary. Relay publishes evidence offering
+metadata that points to an Evidence deployment; the client requests the
+assertion from that deployment. Relay makes no assertion decision.*
 
-When a client needs to verify claims or evidence:
+When a client needs a signed assertion:
 
 1. Fetch `GET /metadata/evidence-offerings` (or the single-offering route by id)
    to discover available offerings.
-2. Read the `access.kind: registry-notary` field and the advertised Notary
-   endpoint or discovery URL.
-3. Follow Registry Notary's client documentation for request shape, claim
-   semantics, presentation, result verification, and credential issuance.
+2. Read the `access.kind: registry-evidence` field, the advertised
+   `endpoint_url`, and the `discovery_url` that resolves the issuer's keys.
+3. Follow Registry Evidence's client documentation for request shape, acceptance
+   semantics, response encoding, and assertion verification.
 
 A discovery response looks like this (one offering shown; host names are
 illustrative):
@@ -302,7 +303,7 @@ illustrative):
       "id": "benefits_person_evidence",
       "title": "Benefits person status evidence",
       "iri": "https://demo.example.gov/evidence-offerings/benefits-person",
-      "description": "Registry Notary verification for submitted benefits person eligibility status and role facts.",
+      "description": "Evidence assertion for submitted benefits person eligibility status and role facts.",
       "dataset_id": "benefits_casework",
       "entity": "person",
       "evidence_type": {
@@ -328,11 +329,11 @@ illustrative):
       "information_concepts": [],
       "verification_request_schema_url": "https://relay.demo.example.gov/metadata/schema/benefits_casework/person/schema.json",
       "access": {
-        "kind": "registry-notary",
+        "kind": "registry-evidence",
         "ruleset": "benefits-person-v1",
-        "endpoint_url": "https://notary.demo.example.gov/evidence-offerings/benefits-person/verifications",
-        "discovery_url": "https://notary.demo.example.gov/.well-known/registry-notary",
-        "conforms_to": "https://demo.example.gov/standards/registry-notary/evidence-v1"
+        "endpoint_url": "https://benefits-evidence.demo.example.gov",
+        "discovery_url": "https://benefits-evidence.demo.example.gov/.well-known/evidence/jwks.json",
+        "conforms_to": "registry.assertion-evidence/v1"
       }
     }
   ]
@@ -340,22 +341,19 @@ illustrative):
 ```
 
 The `access` object is what drives the handoff: `kind` is always
-`registry-notary` in V1 (Relay does not verify the claim or evidence represented
-by this offering), `ruleset` names the Notary ruleset that governs verification
-for this offering, `endpoint_url` is
-where claims or evidence are submitted, `discovery_url` is the Notary
-well-known document for resolving endpoint details (either URL may be null
-when the other is present), and `conforms_to` identifies the evidence contract
-the offering follows.
+`registry-evidence` in V1 (Relay does not answer the evidence request
+represented by this offering), `ruleset` names the evaluation profile ruleset
+that governs the assertion for this offering, `endpoint_url` is where the
+assertion is requested, `discovery_url` resolves the issuer keys a relying party
+needs to verify the response, and `conforms_to` identifies the response profile
+the offering follows. Both URLs are required and must be HTTPS.
 
 The `evidence_verification` scope is available as a distinct label for
 standards adapters and integrations that need evidence-oriented access separate
 from row reads. It does not grant metadata, rows, aggregates, admin reload, or a
-Relay-local verification endpoint.
+Relay-local assertion endpoint.
 
-Use Registry Notary's documentation as the source of truth for verification
-semantics, claim request bodies, result interpretation, credential issuance,
-client retries, and verifier behavior:
+Use Registry Evidence's documentation as the source of truth for request bodies,
+acceptance semantics, response interpretation, and verification behavior:
 
-- [Registry Notary client SDK guide](https://docs.registrystack.org/products/registry-notary/client-sdk-guide/)
-- [Registry Notary documentation](https://docs.registrystack.org/products/registry-notary/)
+- [Registry Evidence API reference](https://docs.registrystack.org/dev/reference/apis/registry-evidence/)
diff --git a/crates/registry-relay/docs/configuration.md b/crates/registry-relay/docs/configuration.md
index ac4588fdf..c958f0308 100644
--- a/crates/registry-relay/docs/configuration.md
+++ b/crates/registry-relay/docs/configuration.md
@@ -812,9 +812,9 @@ at most two closed objects. Each object releases only `type`, `name`, and an
 optional nullable `identifier`; the reviewed Rhai adapter constructs those
 fields rather than returning the source parent record.
 
-Notary must pin the same recursive output contract. Changing a field,
-requirement, type, item limit, or byte limit changes the contract hash and
-requires a coordinated Relay and Notary generation.
+The calling workload must pin the same recursive output contract. Changing a
+field, requirement, type, item limit, or byte limit changes the contract hash
+and requires a coordinated regeneration on both sides.
 
 Each private destination binding defaults to
 `dns_family: dual_stack_strict`: Relay requires definitive A and AAAA lookup
@@ -1674,26 +1674,27 @@ Only CRS84 is accepted. `wkt` and `wkb` parse as reserved geometry kinds but are
 
 ### Evidence verification
 
-Evidence offerings expose Registry Notary discovery metadata:
+Evidence offerings expose discovery metadata for the service that answers them:
 
 ```http
 GET /metadata/evidence-offerings
 GET /metadata/evidence-offerings/{offering_id}
 ```
 
-Relay's evidence-offering routes do not verify claims or evidence.
-`registry-notary` is the verifier for those offerings. The portable metadata
-manifest declares public offerings with `access.kind: registry-notary`,
-`endpoint_url`, `discovery_url`, and `ruleset` so clients can discover the
-Notary service that owns verification. This handoff is independent of Relay's
-native, profile-bound source consultation API.
+Relay's evidence-offering routes do not answer evidence requests. The portable
+metadata manifest declares public offerings with
+`access.kind: registry-evidence`, `endpoint_url`, `discovery_url`, and `ruleset`
+so clients can discover the Evidence deployment that owns the assertion. Runtime
+binding accepts only that access kind, so a Relay deployment cannot advertise an
+offering it cannot hand off. This handoff is independent of Relay's native,
+profile-bound source consultation API.
 
 ```yaml
 access:
   evidence_verification_scope: social_registry:evidence_verification
 ```
 
-`evidence_verification_scope` remains a scope label for standards adapters and integrations that need to distinguish evidence-oriented access from row reads. It does not enable a Relay-local verification endpoint.
+`evidence_verification_scope` remains a scope label for standards adapters and integrations that need to distinguish evidence-oriented access from row reads. It does not enable a Relay-local assertion endpoint.
 
 ## Aggregates
 
@@ -1772,7 +1773,7 @@ aggregates:
 
 Relay no longer accepts `provenance` or entity `publicschema` config. Remove those blocks, Relay signer environment variables, and probes for `/.well-known/did.json`, `/schemas/{claim_type}/{version}`, and `/contexts/{vocab}/{version}` before upgrading.
 
-Use Registry Notary for credential issuance and verification. Relay metadata can advertise Notary evidence offerings with `access.kind: registry-notary`; see [provenance.md](provenance.md) for the migration note.
+Use Registry Evidence when a workflow needs a signed answer. Relay metadata can advertise Evidence offerings with `access.kind: registry-evidence`; see [provenance.md](provenance.md) for the migration note.
 
 ## Production checklist
 
diff --git a/crates/registry-relay/docs/development.md b/crates/registry-relay/docs/development.md
index 1a262561b..3e58186ad 100644
--- a/crates/registry-relay/docs/development.md
+++ b/crates/registry-relay/docs/development.md
@@ -139,9 +139,10 @@ check only. Keep the external SEMIC recipe as the release validation signal.
 ### Fixture corpus
 
 Relay-local response credential fixtures were removed with Relay credential
-issuance. Keep credential issuance fixtures in Registry Notary. Relay fixtures
-should cover ordinary data responses, metadata responses, and rejection or
-migration paths for removed credential-issuance configuration only.
+issuance. Signed-answer fixtures belong to the product that signs. Relay
+fixtures should cover ordinary data responses, metadata responses, and
+rejection or migration paths for removed credential-issuance configuration
+only.
 
 ## Coverage metrics
 
diff --git a/crates/registry-relay/docs/metadata.md b/crates/registry-relay/docs/metadata.md
index 7414755b8..e3fe7154e 100644
--- a/crates/registry-relay/docs/metadata.md
+++ b/crates/registry-relay/docs/metadata.md
@@ -55,7 +55,8 @@ The metadata manifest keeps standard-facing semantics:
 Metadata manifests must not contain runtime-only details such as source paths,
 table ids, physical columns, auth scopes, Relay runtime backend URLs, or SQL.
 Evidence offerings may still declare standards-facing `endpoint_url` and
-`discovery_url` values when the offering points to Registry Notary.
+`discovery_url` values, because those address the Evidence deployment the
+offering points to, not a Relay backend.
 
 ## Minimal manifest
 
diff --git a/crates/registry-relay/docs/openfn-relay-adaptor-guide.md b/crates/registry-relay/docs/openfn-relay-adaptor-guide.md
index 21bc1287f..54839b667 100644
--- a/crates/registry-relay/docs/openfn-relay-adaptor-guide.md
+++ b/crates/registry-relay/docs/openfn-relay-adaptor-guide.md
@@ -5,9 +5,9 @@ workflow reads protected registry records, metadata, relationships, or
 aggregate outputs through a scoped Relay credential.
 
 Use this pattern only when the workflow is authorized to read registry data
-directly. If the workflow needs a governed trust decision, such as whether a
-farmer is eligible or a certified value such as farmed land size, call Registry
-Notary instead.
+directly. If the workflow needs a signed answer it can verify later, such as
+whether a farmer meets an eligibility condition, call Registry Evidence
+instead.
 
 ## Adaptor
 
@@ -152,7 +152,7 @@ execute(
 ```
 
 Relay evidence offering routes are discovery only. They tell the workflow which
-Registry Notary endpoint to use; Relay does not evaluate a claim.
+Registry Evidence endpoint to use; Relay does not evaluate a claim.
 
 ## Guardrails
 
diff --git a/crates/registry-relay/docs/ops.md b/crates/registry-relay/docs/ops.md
index 29ee5e972..3151e95eb 100644
--- a/crates/registry-relay/docs/ops.md
+++ b/crates/registry-relay/docs/ops.md
@@ -118,17 +118,16 @@ checklist carry a one-line note.
 - [ ] Bearer tokens, raw API keys, raw query values, row bodies, VC-JWTs, and
   unreviewed `detail` text are not logged.
 
-### Metadata and Notary posture
+### Metadata and consultation posture
 
 - [ ] Portable metadata is validated before deployment (`just
   metadata-validate-profiles`). See [Build and release](#build-and-release).
 - [ ] Runtime backend URLs, source paths, scope names, and table ids are absent
   from portable metadata manifests.
 - [ ] Scoped runtime metadata is not placed in shared public caches.
-- [ ] Registry Notary claim evaluation and credential issuance stay outside
-  Relay. Relay holds no issuance signing key. Any Relay-native consultation is
-  activated only from the complete reviewed artifact closure and a dedicated
-  durable state plane.
+- [ ] Claim evaluation and credential issuance stay outside Relay. Relay holds
+  no issuance signing key. Any Relay-native consultation is activated only from
+  the complete reviewed artifact closure and a dedicated durable state plane.
 
 ### Container runtime policy
 
@@ -281,21 +280,22 @@ boot, validates anti-rollback state, and starts from the embedded config. There
 is no admin config apply route and no hot apply. Dataset reload does not reload
 startup `config.yaml`.
 
-## Operating with Registry Notary
+## Operating with a consulting workload
 
-Registry Relay is the protected registry consultation service. Registry Notary
-owns claim evaluation, credential issuance, and attestation. With a maintained
-native consultation profile, Notary sends an authenticated purpose and one
-bounded input to Relay. Relay executes only the profile's hash-pinned minimized
-source plan and returns its closed result envelope after durable completion.
-Relay can also publish metadata evidence offerings that point clients to
-Notary. Native consultation does not move claim evaluation or issuance signing
-keys into Relay.
+Registry Relay is the protected registry consultation service. Claim
+evaluation, credential issuance, and attestation belong to the workload that
+calls it, never to Relay. With a maintained native consultation profile, that
+workload sends an authenticated purpose and one bounded input to Relay. Relay
+executes only the profile's hash-pinned minimized source plan and returns its
+closed result envelope after durable completion. Relay can also publish
+metadata evidence offerings that point clients at an Evidence deployment.
+Native consultation does not move claim evaluation or issuance signing keys
+into Relay.
 
-For a combined Relay and Notary deployment, use OIDC rather than a Relay API
-key. Bind the
+When Relay and its consulting workload are deployed together, use OIDC rather
+than a Relay API key. Bind the
 `consultation.authorized_workload` audience and exact `azp` or `client_id` to the
-Notary service account, grant only the scope pinned by each public contract,
+workload's service account, grant only the scope pinned by each public contract,
 and keep the PostgreSQL URL, pseudonym material, and source credentials behind
 the environment references named by the configuration. Configuration changes,
 artifact changes, and secret generation changes require a restart.
@@ -367,7 +367,7 @@ The maintained DHIS2 profile has an end-to-end deployment checklist in its
 ### Back up and restore native consultation state
 
 The consultation database is Relay correctness state, not a registry source
-database and not Registry Notary state. Relay owns two schemas:
+database and not another product's state. Relay owns two schemas:
 
 - `relay_state_private` contains the durable audit chain, consultation attempts
   and completions, dispatch permits, quota buckets, materialization publication
@@ -378,11 +378,10 @@ database and not Registry Notary state. Relay owns two schemas:
   runtime, keyring-maintenance, and keyring-reader logins receive only the
   function execution grants required for their roles.
 
-Registry Notary owns `registry_notary_private` and `registry_notary_api` in its
-database. Do not point Notary at the Relay schemas, point Relay at the Notary
-schemas, or copy tables between the products. A deployment can use one
-PostgreSQL cluster, but each product retains its own database roles, schema
-ownership, migrations, and recovery decision.
+Both schemas belong to Relay alone. Do not point another product at them, point
+Relay at another product's schemas, or copy tables between products. A
+deployment can use one PostgreSQL cluster, but each product retains its own
+database roles, schema ownership, migrations, and recovery decision.
 
 Treat the following items as one Relay recovery set:
 
@@ -399,16 +398,16 @@ Treat the following items as one Relay recovery set:
   the database active pointer and history, exact generation, and restricted
   content digest.
 
-For a quiesced backup, remove traffic from every Notary that can call this
+For a quiesced backup, remove traffic from every workload that can call this
 Relay, stop the active Relay fence holder, and prevent another Relay process
 from acquiring the fence. Keep the source inputs and ingest cache unchanged,
 then capture them and the transactionally consistent database backup at one
-coordinated recovery point. If Relay and Notary are recovered as one service,
-either keep both products quiesced while every source, cache, and database
+coordinated recovery point. If Relay and a consulting workload are recovered as
+one service, either keep both quiesced while every source, cache, and database
 backup is taken or use a platform snapshot that gives every store one
 coordinated recovery point. Independent live backups can leave the database
-pointer, retained cache generation, source input, or Notary completion out of
-agreement.
+pointer, retained cache generation, source input, or caller-side completion out
+of agreement.
 
 A custom-format `pg_dump` is suitable for a database dedicated to Relay and for
 restoring an empty database in the same PostgreSQL cluster, where the four
@@ -437,7 +436,7 @@ their object identifiers. The state-plane metadata binds those identifiers and
 the restore will fail attestation when they differ.
 
 Restore into an empty, isolated, writable PostgreSQL 16 through 18 primary with
-no Relay or Notary traffic path. Restore the database and exact external
+no Relay or caller traffic path. Restore the database and exact external
 recovery-set items, then rerun `consultation bootstrap-state` with the same
 owner, role connections, lock keys, chain-key epoch, active key, deadline, and
 retention inputs. `installed_or_attested` plus `identical` means the command
@@ -494,10 +493,10 @@ and fix forward unless a release-specific recovery procedure proves otherwise.
 
 For side-by-side local compose stacks, keep the public host ports distinct
 while letting each container use its internal default listener. A common
-convention is Relay on host `18080` mapped to container `8080`, and Notary on
-host `18081` mapped to its container listener. Native local runs usually use
-Relay `127.0.0.1:8080` and Notary `127.0.0.1:8081`; align source `base_url`
-values with the network where Notary runs.
+convention is Relay on host `18080` mapped to container `8080`, and the service
+that calls it on host `18081` mapped to its container listener. Native local
+runs usually use Relay `127.0.0.1:8080` and the caller `127.0.0.1:8081`; align
+source `base_url` values with the network each service runs on.
 
 ## API-key provisioning and rotation
 
@@ -525,7 +524,7 @@ Never log raw keys, fingerprints, or full environment dumps. In issue reports, i
 
 Relay no longer owns response credential issuance, DID hosting, credential schemas, credential contexts, or signing-key rotation. Remove `provenance:` and entity `publicschema:` blocks from Relay config, remove Relay issuance signing secrets from the runtime secret store, and remove probes for `/.well-known/did.json`, `/schemas/{claim_type}/{version}`, and `/contexts/{vocab}/{version}`.
 
-Use Registry Notary for credential issuance, evidence verification, issuer metadata, and signing-key operations. Relay should only publish evidence offering metadata that lets clients discover the relevant Notary service.
+A signed answer about a subject comes from a separate service with its own issuer key. Registry Evidence returns signed, minimum-disclosure assertions from fixed requests to authoritative sources, and owns its issuer metadata, verification, and signing-key operations. Relay should only publish evidence offering metadata that lets clients discover that service.
 
 ## Audit sink and rotation
 
diff --git a/crates/registry-relay/docs/provenance.md b/crates/registry-relay/docs/provenance.md
index 2247fc1ef..63e15ec0f 100644
--- a/crates/registry-relay/docs/provenance.md
+++ b/crates/registry-relay/docs/provenance.md
@@ -1,6 +1,6 @@
 # Relay credential issuance migration
 
-Registry Relay no longer issues response credentials, hosts DID documents, publishes credential schemas or JSON-LD contexts, or manages issuer signing keys. Registry Notary is the sole credential issuance and verification surface.
+Registry Relay no longer issues response credentials, hosts DID documents, publishes credential schemas or JSON-LD contexts, or manages issuer signing keys. Registry Evidence is where a caller gets a signed, minimum-disclosure answer it can verify later.
 
 Remove these legacy Relay settings before upgrading:
 
@@ -10,6 +10,6 @@ Remove these legacy Relay settings before upgrading:
 - Monitoring or smoke tests that fetch `/.well-known/did.json`, `/schemas/{claim_type}/{version}`, or `/contexts/{vocab}/{version}` from Relay.
 - Client requests that send `Accept: application/vc+jwt` to Relay.
 
-Relay now returns ordinary negotiated data formats for entity and aggregate reads. If a workflow needs a signed credential, use Registry Notary and its discovery metadata. Relay can still publish evidence offerings with `access.kind: registry-notary` so clients can find the Notary endpoint that owns issuance or verification.
+Relay now returns ordinary negotiated data formats for entity and aggregate reads. If a workflow needs a signed answer, use Registry Evidence and its discovery metadata. Relay can still publish evidence offerings with `access.kind: registry-evidence` so clients can find the Evidence endpoint that owns the assertion.
 
-If signed provenance over Relay responses is required again, the design should delegate issuance to Notary rather than reintroducing Relay-local signing keys.
+If signed provenance over Relay responses is required again, the design should delegate signing to Evidence rather than reintroducing Relay-local signing keys.
diff --git a/crates/registry-relay/docs/relay-scenario-catalog.md b/crates/registry-relay/docs/relay-scenario-catalog.md
index 6b40fac20..260e7889e 100644
--- a/crates/registry-relay/docs/relay-scenario-catalog.md
+++ b/crates/registry-relay/docs/relay-scenario-catalog.md
@@ -22,7 +22,7 @@ Status labels:
 | Planning analyst | Query configured aggregates without enumerating sensitive rows |
 | Metadata consumer | Discover datasets, schemas, policies, profiles, and standards surfaces |
 | Auditor | Reconstruct who accessed what, for which purpose, and under which scope |
-| Standards integrator | Consume Relay through DCAT, OGC, SP DCI, or Registry Notary discovery contracts |
+| Standards integrator | Consume Relay through DCAT, OGC, SP DCI, or evidence offering discovery contracts |
 
 ## Systems
 
@@ -31,10 +31,10 @@ Status labels:
 | Source registry | Operational system of record, such as CSV, XLSX, Parquet, or PostgreSQL |
 | Registry Relay | Read-only gateway, metadata publisher, standards adapter, and audit emitter |
 | Registry Manifest | Portable metadata source used for static publication and runtime metadata |
-| Registry Notary | Claim evaluation, evidence verification, credential issuance, and verification semantics |
-| Service portal or case system | Calls Relay or Notary during a service workflow |
+| Registry Evidence | Signed minimum-disclosure assertions from fixed requests to authoritative sources |
+| Service portal or case system | Calls Relay or Evidence during a service workflow |
 | Audit sink | Receives chained platform audit records |
-| Standards consumer | Reads OGC, DCAT, SP DCI, Registry Notary discovery, or OpenAPI views |
+| Standards consumer | Reads OGC, DCAT, SP DCI, evidence offering discovery, or OpenAPI views |
 
 ## Reusable patterns
 
@@ -85,18 +85,18 @@ sequenceDiagram
   Consumer->>Relay: Authenticated scoped metadata discovery
 ```
 
-### Relay to Registry Notary handoff
+### Relay to Registry Evidence handoff
 
 ```mermaid
 sequenceDiagram
   participant Client as Service Client
   participant Relay as Registry Relay
-  participant Notary as Registry Notary
+  participant Evidence as Registry Evidence
 
   Client->>Relay: Discover evidence offering metadata
-  Relay-->>Client: Notary endpoint or discovery URL
-  Client->>Notary: Submit claim or evidence request
-  Notary-->>Client: Verification result or credential
+  Relay-->>Client: Evidence endpoint and discovery URL
+  Client->>Evidence: Request an assertion
+  Evidence-->>Client: Signed minimum-disclosure assertion
 ```
 
 ## Scenario matrix
@@ -109,14 +109,14 @@ sequenceDiagram
 | 4 | Operator publishes portable metadata separately from Relay runtime | Metadata publication | Supported | Static publication is manual; no managed release process yet. |
 | 5 | Metadata consumer reads DCAT and SHACL views | Metadata publication | Supported | Profile coverage depends on manifest quality |
 | 6 | Auditor traces row access through platform audit records | Governance | Supported | External audit storage is deployment-owned |
-| 7 | Client requests a signed credential from Registry Notary after Relay discovery | Notary handoff | Supported | Relay publishes evidence offering discovery only |
-| 8 | Client discovers evidence offerings and calls Registry Notary | Notary handoff | Supported | Notary request semantics live in Notary docs |
+| 7 | Client requests a signed assertion from Registry Evidence after Relay discovery | Evidence handoff | Supported | Relay publishes evidence offering discovery only |
+| 8 | Client discovers evidence offerings and calls Registry Evidence | Evidence handoff | Supported | Request semantics live in the Evidence docs |
 | 9 | GIS consumer reads spatial entities through OGC API Features | Standards adapter | Supported | Requires spatial config and feature build |
 | 10 | Catalog consumer reads metadata through OGC API Records | Standards adapter | Supported | Records surface is metadata-only |
 | 11 | EDR consumer queries admin-area aggregates | Standards adapter | Lab-supported | Requires configured spatial aggregates and feature build |
 | 12 | SP DCI sync consumer calls a configured registry adapter | Standards adapter | Lab-supported | Async DCI APIs are out of scope |
 | 14 | Program system writes registry data through Relay | Write workflow | Out of scope | Relay V1 is read-only |
-| 15 | Relay performs local evidence verification | Evidence verification | Out of scope | Registry Notary owns verification execution |
+| 15 | Relay performs local evidence verification | Evidence verification | Out of scope | Registry Evidence owns assertion execution |
 | 16 | Relay enforces row-level authorization expressions | Fine-grained auth | Planned | V1 uses scopes, filters, purpose headers, and projection |
 
 ## Demo coverage
diff --git a/crates/registry-relay/openapi/oasdiff-err-ignore.txt b/crates/registry-relay/openapi/oasdiff-err-ignore.txt
index ee56082af..e9af2102d 100644
--- a/crates/registry-relay/openapi/oasdiff-err-ignore.txt
+++ b/crates/registry-relay/openapi/oasdiff-err-ignore.txt
@@ -25,3 +25,20 @@ GET /v1/datasets/{dataset_id}/measures/{item_id} added the new path request para
 # One-time accepted diff for issue #362 on 2026-07-20: remove the inert
 # provenance.consent member from the pre-1.0 consultation result.
 POST /v1/consultations/{profile_id}/execute added `subschema #1, subschema #2, subschema #3` to the response body `oneOf` list for the response status `200`
+
+# One-time accepted diff on 2026-08-04: drop format: uri from an evidence
+# offering's access.conforms_to. The member no longer holds a URI. Retargeting
+# the offering from Notary to Evidence made conforms_to name a response
+# profile, `registry.assertion-evidence/v1`, so that the portable manifest
+# layer stays independent of any one product's contract version. The manifest
+# core validates it as present and non-blank for kind registry-evidence and as
+# a URI for every other kind, and Relay refuses at startup to serve an offering
+# of any other kind, so every value this route can return is a profile
+# identifier. Keeping the annotation would have declared a constraint the
+# server's own legitimate values fail.
+#
+# A line has to reproduce oasdiff's own rendering of the error, backticks and
+# all, and that rendering changes between oasdiff releases. Write these against
+# the version CI pins in OASDIFF_VERSION, not whatever is on your PATH.
+GET /metadata/evidence-offerings the `evidence_offerings/items/access/conforms_to` response's property `format` changed from `uri` to `none` for status `200`
+GET /metadata/evidence-offerings/{offering_id} the `access/conforms_to` response's property `format` changed from `uri` to `none` for status `200`
diff --git a/crates/registry-relay/openapi/registry-relay.openapi.json b/crates/registry-relay/openapi/registry-relay.openapi.json
index 3934e28f3..120649644 100644
--- a/crates/registry-relay/openapi/registry-relay.openapi.json
+++ b/crates/registry-relay/openapi/registry-relay.openapi.json
@@ -2236,7 +2236,6 @@
             "additionalProperties": true,
             "properties": {
               "conforms_to": {
-                "format": "uri",
                 "type": [
                   "string",
                   "null"
@@ -2261,7 +2260,7 @@
               },
               "kind": {
                 "enum": [
-                  "registry-notary"
+                  "registry-evidence"
                 ],
                 "type": "string"
               },
@@ -4548,14 +4547,14 @@
                       "evidence_offerings": [
                         {
                           "access": {
-                            "conforms_to": "https://demo.example.gov/standards/registry-notary/evidence-v1",
-                            "discovery_url": "https://notary.demo.example.gov/.well-known/registry-notary",
-                            "endpoint_url": "https://notary.demo.example.gov/evidence-offerings/benefits-person/verifications",
-                            "kind": "registry-notary",
+                            "conforms_to": "registry.assertion-evidence/v1",
+                            "discovery_url": "https://benefits-evidence.demo.example.gov/.well-known/evidence/jwks.json",
+                            "endpoint_url": "https://benefits-evidence.demo.example.gov",
+                            "kind": "registry-evidence",
                             "ruleset": "benefits-person-v1"
                           },
                           "dataset_id": "benefits_casework",
-                          "description": "Registry Notary verification for submitted benefits person eligibility status and role facts.",
+                          "description": "Evidence assertion for submitted benefits person eligibility status and role facts.",
                           "entity": "person",
                           "evidence_type": {
                             "id": "benefits_person_record_evidence",
@@ -4664,14 +4663,14 @@
                     "summary": "Evidence offering discovery record.",
                     "value": {
                       "access": {
-                        "conforms_to": "https://demo.example.gov/standards/registry-notary/evidence-v1",
-                        "discovery_url": "https://notary.demo.example.gov/.well-known/registry-notary",
-                        "endpoint_url": "https://notary.demo.example.gov/evidence-offerings/benefits-person/verifications",
-                        "kind": "registry-notary",
+                        "conforms_to": "registry.assertion-evidence/v1",
+                        "discovery_url": "https://benefits-evidence.demo.example.gov/.well-known/evidence/jwks.json",
+                        "endpoint_url": "https://benefits-evidence.demo.example.gov",
+                        "kind": "registry-evidence",
                         "ruleset": "benefits-person-v1"
                       },
                       "dataset_id": "benefits_casework",
-                      "description": "Registry Notary verification for submitted benefits person eligibility status and role facts.",
+                      "description": "Evidence assertion for submitted benefits person eligibility status and role facts.",
                       "entity": "person",
                       "evidence_type": {
                         "id": "benefits_person_record_evidence",
@@ -6315,7 +6314,7 @@
             }
           },
           {
-            "description": "Purpose-of-use IRI or controlled string. When `require_purpose_header` is set on this entity, the header must be present; a missing value returns `400 auth.purpose_required`. On ordinary entity and feature routes, the value is recorded verbatim in the audit trail but is not compared to a value allowlist; Registry Notary remains the purpose-certification layer for an offering handoff. Native `/v1/consultations/.../execute` is separate and validates `Data-Purpose` against the selected consultation profile contract. Header names are case-insensitive (`Data-Purpose` and `data-purpose` are equivalent).",
+            "description": "Purpose-of-use IRI or controlled string. When `require_purpose_header` is set on this entity, the header must be present; a missing value returns `400 auth.purpose_required`. On ordinary entity and feature routes, the value is recorded verbatim in the audit trail but is not compared to a value allowlist; certifying a purpose value is left to the layer that hands off an offering. Native `/v1/consultations/.../execute` is separate and validates `Data-Purpose` against the selected consultation profile contract. Header names are case-insensitive (`Data-Purpose` and `data-purpose` are equivalent).",
             "example": "https://demo.example.gov/purpose/demo-review",
             "in": "header",
             "name": "Data-Purpose",
@@ -6627,7 +6626,7 @@
             }
           },
           {
-            "description": "Purpose-of-use IRI or controlled string. When `require_purpose_header` is set on this entity, the header must be present; a missing value returns `400 auth.purpose_required`. On ordinary entity and feature routes, the value is recorded verbatim in the audit trail but is not compared to a value allowlist; Registry Notary remains the purpose-certification layer for an offering handoff. Native `/v1/consultations/.../execute` is separate and validates `Data-Purpose` against the selected consultation profile contract. Header names are case-insensitive (`Data-Purpose` and `data-purpose` are equivalent).",
+            "description": "Purpose-of-use IRI or controlled string. When `require_purpose_header` is set on this entity, the header must be present; a missing value returns `400 auth.purpose_required`. On ordinary entity and feature routes, the value is recorded verbatim in the audit trail but is not compared to a value allowlist; certifying a purpose value is left to the layer that hands off an offering. Native `/v1/consultations/.../execute` is separate and validates `Data-Purpose` against the selected consultation profile contract. Header names are case-insensitive (`Data-Purpose` and `data-purpose` are equivalent).",
             "example": "https://demo.example.gov/purpose/demo-review",
             "in": "header",
             "name": "Data-Purpose",
@@ -7151,7 +7150,7 @@
             }
           },
           {
-            "description": "Purpose-of-use IRI or controlled string. When `require_purpose_header` is set on this entity, the header must be present; a missing value returns `400 auth.purpose_required`. On ordinary entity and feature routes, the value is recorded verbatim in the audit trail but is not compared to a value allowlist; Registry Notary remains the purpose-certification layer for an offering handoff. Native `/v1/consultations/.../execute` is separate and validates `Data-Purpose` against the selected consultation profile contract. Header names are case-insensitive (`Data-Purpose` and `data-purpose` are equivalent).",
+            "description": "Purpose-of-use IRI or controlled string. When `require_purpose_header` is set on this entity, the header must be present; a missing value returns `400 auth.purpose_required`. On ordinary entity and feature routes, the value is recorded verbatim in the audit trail but is not compared to a value allowlist; certifying a purpose value is left to the layer that hands off an offering. Native `/v1/consultations/.../execute` is separate and validates `Data-Purpose` against the selected consultation profile contract. Header names are case-insensitive (`Data-Purpose` and `data-purpose` are equivalent).",
             "example": "https://demo.example.gov/purpose/demo-review",
             "in": "header",
             "name": "Data-Purpose",
@@ -7376,7 +7375,7 @@
             }
           },
           {
-            "description": "Purpose-of-use IRI or controlled string. When `require_purpose_header` is set on this entity, the header must be present; a missing value returns `400 auth.purpose_required`. On ordinary entity and feature routes, the value is recorded verbatim in the audit trail but is not compared to a value allowlist; Registry Notary remains the purpose-certification layer for an offering handoff. Native `/v1/consultations/.../execute` is separate and validates `Data-Purpose` against the selected consultation profile contract. Header names are case-insensitive (`Data-Purpose` and `data-purpose` are equivalent).",
+            "description": "Purpose-of-use IRI or controlled string. When `require_purpose_header` is set on this entity, the header must be present; a missing value returns `400 auth.purpose_required`. On ordinary entity and feature routes, the value is recorded verbatim in the audit trail but is not compared to a value allowlist; certifying a purpose value is left to the layer that hands off an offering. Native `/v1/consultations/.../execute` is separate and validates `Data-Purpose` against the selected consultation profile contract. Header names are case-insensitive (`Data-Purpose` and `data-purpose` are equivalent).",
             "example": "https://demo.example.gov/purpose/demo-review",
             "in": "header",
             "name": "Data-Purpose",
@@ -7615,7 +7614,7 @@
             }
           },
           {
-            "description": "Purpose-of-use IRI or controlled string. When `require_purpose_header` is set on this entity, the header must be present; a missing value returns `400 auth.purpose_required`. On ordinary entity and feature routes, the value is recorded verbatim in the audit trail but is not compared to a value allowlist; Registry Notary remains the purpose-certification layer for an offering handoff. Native `/v1/consultations/.../execute` is separate and validates `Data-Purpose` against the selected consultation profile contract. Header names are case-insensitive (`Data-Purpose` and `data-purpose` are equivalent).",
+            "description": "Purpose-of-use IRI or controlled string. When `require_purpose_header` is set on this entity, the header must be present; a missing value returns `400 auth.purpose_required`. On ordinary entity and feature routes, the value is recorded verbatim in the audit trail but is not compared to a value allowlist; certifying a purpose value is left to the layer that hands off an offering. Native `/v1/consultations/.../execute` is separate and validates `Data-Purpose` against the selected consultation profile contract. Header names are case-insensitive (`Data-Purpose` and `data-purpose` are equivalent).",
             "example": "https://demo.example.gov/purpose/demo-review",
             "in": "header",
             "name": "Data-Purpose",
diff --git a/crates/registry-relay/perf/config/clinic_capacity.metadata.yaml b/crates/registry-relay/perf/config/clinic_capacity.metadata.yaml
index d9f5524c3..ab5cdc045 100644
--- a/crates/registry-relay/perf/config/clinic_capacity.metadata.yaml
+++ b/crates/registry-relay/perf/config/clinic_capacity.metadata.yaml
@@ -8,14 +8,6 @@ catalog:
   publisher:
     name: Perf Test Harness
 
-federation:
-  node_id: did:web:perf.example.test
-  issuer: https://perf.example.test
-  jwks_uri: https://perf.example.test/.well-known/jwks.json
-  federation_api: https://perf.example.test/federation
-  supported_protocol_versions:
-    - registry-notary-federation/v0.1
-
 evaluation_profiles:
   - id: facility-identity-v1
     ruleset: facility-identity-v1
@@ -65,10 +57,10 @@ datasets:
         entity: facility
         lookup_keys: [id]
         access:
-          kind: registry-notary
-          conforms_to: registry-notary-federation/v0.1
-          endpoint_url: https://perf.example.test/notary
-          discovery_url: https://perf.example.test/.well-known/evidence-service
+          kind: registry-evidence
+          conforms_to: registry.assertion-evidence/v1
+          endpoint_url: https://perf.example.test/evidence
+          discovery_url: https://perf.example.test/.well-known/evidence/jwks.json
           ruleset: facility-identity-v1
         policy:
           purpose:
@@ -85,10 +77,10 @@ datasets:
         entity: facility
         lookup_keys: [region_code]
         access:
-          kind: registry-notary
-          conforms_to: registry-notary-federation/v0.1
-          endpoint_url: https://perf.example.test/notary
-          discovery_url: https://perf.example.test/.well-known/evidence-service
+          kind: registry-evidence
+          conforms_to: registry.assertion-evidence/v1
+          endpoint_url: https://perf.example.test/evidence
+          discovery_url: https://perf.example.test/.well-known/evidence/jwks.json
           ruleset: facility-region-v1
         policy:
           purpose:
diff --git a/crates/registry-relay/profiles/dhis2-2.41.9-enrollment-status/README.md b/crates/registry-relay/profiles/dhis2-2.41.9-enrollment-status/README.md
index af5600a50..4a46eae14 100644
--- a/crates/registry-relay/profiles/dhis2-2.41.9-enrollment-status/README.md
+++ b/crates/registry-relay/profiles/dhis2-2.41.9-enrollment-status/README.md
@@ -4,10 +4,10 @@ This directory contains a Registry Stack-maintained, unofficial consultation
 profile for one bounded journey: read the enrollment status for one exact DHIS2
 tracked-entity UID in one fixed program.
 
-The fixed `registry-notary` workload selects the exact tracked-entity UID under
-the profile's public-task legal basis. This profile does not claim an
-individual subject-binding assertion or individual consent, and its public
-contract explicitly declares consent is not required.
+The fixed consultation input selects the exact tracked-entity UID under the
+profile's public-task legal basis. This profile does not claim an individual
+subject-binding assertion or individual consent, and its public contract
+explicitly declares consent is not required.
 
 The reviewed operation is one Basic-authenticated `GET` to
 `/api/tracker/enrollments`. Its query is closed to:
@@ -55,22 +55,10 @@ closed against the authorized integration instance. The operation remains at
 Relay's hard source ceiling and still performs exactly one exchange with no
 retry.
 
-Notary wraps the complete internal service hop in one fixed, non-configurable
-25-second absolute deadline. Semaphore wait, workload-token reload, Relay
-request and response, strict decoding, and final result acceptance all consume
-that same budget. The Relay source operation's 10 seconds is nested inside it.
-There is no operator timeout knob and no retry, redirect, proxy, or result
-cache. Consultation-enabled Relay requires `server.request_timeout` greater
-than 25 seconds. Registry-backed Notary requires at least 30 seconds, retaining
-a five-second listener reserve around its service hop. The unchanged 30-second
-default used by these examples satisfies both bounds.
-
 ## Operator journey
 
-Use [`relay-config.example.yaml`](relay-config.example.yaml) for Relay and
-[`notary-config.example.yaml`](notary-config.example.yaml) for its minimized
-Notary handoff. They are complete local-profile starting points, not production
-identities or live source bindings.
+Use [`relay-config.example.yaml`](relay-config.example.yaml) as a complete
+local-profile starting point, not a production identity or live source binding.
 
 1. Review `integration-pack.json` and `public-contract.json`. If the country
    program, purpose, scope, input, projection, cardinality, or bounds differ,
@@ -80,7 +68,7 @@ identities or live source bindings.
    origin, optional application base path, tenant and registry identities, and
    bounded limits, then update its raw SHA-256 digest in the Relay config. Keep
    the credential reference and generation aligned with `source_credentials`.
-3. Replace the example OIDC issuer, JWKS URL, Relay public URL, and Notary client
+3. Replace the example OIDC issuer, JWKS URL, Relay public URL, and client
    identity. Put the runtime PostgreSQL URL, audit secrets, pseudonym material,
    and DHIS2 Basic credential values in the secret store under the environment
    references named by the config. Do not put values in YAML.
@@ -93,64 +81,13 @@ identities or live source bindings.
    Bootstrap with one declared pseudonym key id and an explicit future write
    deadline and audit-retention interval.
 6. Start Relay with only its runtime database identity. Readiness must be green
-   before activating Notary. Keep Relay's outer `server.request_timeout` above
-   25 seconds and Notary's at least 30 seconds; the examples retain the
-   30-second default.
-7. Copy the Notary example. Replace the Relay HTTPS origin and add only the
-   exact reviewed private CIDRs needed to reach an internal Relay. Notary has
-   no DHIS2 URL or credential because Relay alone owns source access.
-8. Mount the Relay workload JWT at `evidence.relay.token_file`. Rotate that file
-   atomically; Notary reloads it for every Relay operation, while Relay alone
-   verifies its signature, workload binding, time bounds, and required scope
-   on every protected request. Make the mounted regular file readable only by
-   the Notary service account, for example mode `0600`. Keep the Notary API-key
-   fingerprint and audit hash secret in the secret store named by the config,
-   never in YAML.
-9. Run `registry-notary explain-config --config <path> --format json`, then
-   `registry-notary doctor --config <path>`. Offline output reports only the
-   credential file's availability. In a controlled integration environment,
-   add `--live` to have Relay authenticate the current credential and verify
-   the exact hash-pinned profile before starting the listener.
-10. Start Notary. Startup fails closed unless the Relay credential and profile
-    verify. One `/v1/evaluations` request may ask for both
-    `dhis2-enrollment-known` and `dhis2-enrollment-status`; Notary coalesces
-    them into one Relay consultation and returns minimized claim-result
-    documents containing the boolean and status plus standard result metadata.
-
-The complete Notary request for that journey is:
-
-```http
-POST /v1/evaluations
-X-API-Key: <notary-api-key>
-Data-Purpose: program-enrollment-verification
-Content-Type: application/json
-
-{
-  "target": {"type": "person", "id": "<tracked-entity-uid>"},
-  "claims": [
-    {"id": "dhis2-enrollment-known", "version": "1"},
-    {"id": "dhis2-enrollment-status", "version": "1"}
-  ],
-  "disclosure": "value",
-  "purpose": "program-enrollment-verification"
-}
-```
-
-Notary's Relay readiness check has a separate 5-second outer bound and performs
-only authenticated profile metadata verification. It never executes a
-consultation or calls DHIS2.
-
-The local example explicitly uses Notary's single-process `in_memory` state, so
-`/ready` reports HTTP 200 after the Relay profile is verified. Its
-`checks.relay` block reports one successful check and no failure. Configure the
-typed Notary-owned PostgreSQL state plane for every production or multi-instance
-deployment.
+   before allowing authenticated consultation traffic. The example retains the
+   30-second request-timeout default.
 
 The public response releases only the closed cardinality outcome and, for one
 validated match, the DHIS2 enrollment `status`. Relay never releases the
 tracked-entity selector, source URL, Basic credentials, raw DHIS2 envelope, or
-backend diagnostic. Notary returns its evaluation id as public traceability
-metadata. The Relay consultation id remains restricted to audit records for
-cross-service investigation and never enters public claim provenance. Back up
-the PostgreSQL state plane and manage the pseudonym material under the same
+backend diagnostic. The Relay consultation id remains restricted to audit
+records for investigation and never enters the public result. Back up the
+PostgreSQL state plane and manage the pseudonym material under the same
 retention policy before treating the journey as production-ready.
diff --git a/crates/registry-relay/profiles/dhis2-2.41.9-enrollment-status/notary-config.example.yaml b/crates/registry-relay/profiles/dhis2-2.41.9-enrollment-status/notary-config.example.yaml
deleted file mode 100644
index d1b7993cd..000000000
--- a/crates/registry-relay/profiles/dhis2-2.41.9-enrollment-status/notary-config.example.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-# Local Notary example for the maintained DHIS2 2.41.9 consultation journey.
-# Production deployments distribute this through a signed configuration bundle.
-
-deployment:
-  profile: local
-
-server:
-  bind: "127.0.0.1:8081"
-
-auth:
-  api_keys:
-    - id: dhis2-verifier
-      fingerprint:
-        provider: env
-        name: REGISTRY_NOTARY_DHIS2_API_KEY_HASH
-      scopes: [registry:evidence:dhis2-enrollment-status]
-
-audit:
-  sink: stdout
-  hash_secret_env: REGISTRY_NOTARY_AUDIT_HASH_SECRET
-
-evidence:
-  enabled: true
-  service_id: registry-notary-dhis2-enrollment-status
-  allowed_purposes: [program-enrollment-verification]
-  relay:
-    base_url: "https://relay.example.gov"
-    workload_client_id: registry-notary
-    # Mount a mode-0600 Relay-issued workload JWT and replace it atomically when rotating.
-    # Relay is the sole cryptographic and semantic verifier on every request.
-    token_file: /var/run/secrets/registry-notary/relay-access-token
-    # Add only exact reviewed private networks needed to reach an internal Relay.
-    allowed_private_cidrs: []
-  claims:
-    - id: dhis2-enrollment-known
-      title: DHIS2 enrollment exists
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          enrollment:
-            profile:
-              id: dhis2.tracker.enrollment-status.exact
-              contract_hash: sha256:09d7286fdd36bb936f074454aa50fd06aa4dcbca62b45ad9d8357b082bdaa036
-            inputs:
-              tracked_entity: target.id
-            outputs:
-              status: { type: string, nullable: false, max_bytes: 32 }
-      value:
-        type: boolean
-      purpose: program-enrollment-verification
-      required_scopes: [registry:evidence:dhis2-enrollment-status]
-      rule:
-        type: consultation_matched
-        consultation: enrollment
-      disclosure:
-        default: value
-        allowed: [value, redacted]
-      formats: [application/vnd.registry-notary.claim-result+json]
-
-    - id: dhis2-enrollment-status
-      title: DHIS2 enrollment status
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          enrollment:
-            profile:
-              id: dhis2.tracker.enrollment-status.exact
-              contract_hash: sha256:09d7286fdd36bb936f074454aa50fd06aa4dcbca62b45ad9d8357b082bdaa036
-            inputs:
-              tracked_entity: target.id
-            outputs:
-              status: { type: string, nullable: false, max_bytes: 32 }
-      value:
-        type: string
-        nullable: true
-      purpose: program-enrollment-verification
-      required_scopes: [registry:evidence:dhis2-enrollment-status]
-      rule:
-        type: consultation_output
-        consultation: enrollment
-        output: status
-      disclosure:
-        default: value
-        allowed: [value, redacted]
-      formats: [application/vnd.registry-notary.claim-result+json]
diff --git a/crates/registry-relay/profiles/synthetic-snapshot-exact-person-status/notary-config.example.yaml b/crates/registry-relay/profiles/synthetic-snapshot-exact-person-status/notary-config.example.yaml
deleted file mode 100644
index 89a0e331a..000000000
--- a/crates/registry-relay/profiles/synthetic-snapshot-exact-person-status/notary-config.example.yaml
+++ /dev/null
@@ -1,92 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-# Local Notary example for the Registry Stack synthetic SnapshotExact journey.
-# Production deployments distribute this through a signed configuration bundle.
-
-deployment:
-  profile: local
-
-server:
-  bind: "127.0.0.1:8081"
-
-state:
-  storage: in_memory
-
-auth:
-  api_keys:
-    - id: synthetic-snapshot-verifier
-      fingerprint:
-        provider: env
-        name: REGISTRY_NOTARY_SYNTHETIC_SNAPSHOT_API_KEY_HASH
-      scopes: [registry:evidence:synthetic-snapshot-person-status]
-
-audit:
-  sink: stdout
-  hash_secret_env: REGISTRY_NOTARY_AUDIT_HASH_SECRET
-
-evidence:
-  enabled: true
-  service_id: registry-notary-synthetic-snapshot-person-status
-  allowed_purposes: [benefit-status-verification]
-  relay:
-    base_url: "https://relay.example.gov"
-    workload_client_id: registry-notary
-    # Mount a mode-0600 Relay-issued workload JWT and replace it atomically when rotating.
-    # Relay is the sole cryptographic and semantic verifier on every request.
-    token_file: /var/run/secrets/registry-notary/relay-access-token
-    allowed_private_cidrs: []
-  claims:
-    - id: synthetic-person-known
-      title: Synthetic person exists
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          person_status:
-            profile:
-              id: synthetic.snapshot.person-status.exact
-              contract_hash: sha256:62132bbde55fcc9885753b322b4b978cf72cd038f773906fb16b98d0c0917786
-            inputs:
-              person_id: target.id
-            outputs:
-              registration_status: { type: string, nullable: false, max_bytes: 32 }
-      value:
-        type: boolean
-      purpose: benefit-status-verification
-      required_scopes: [registry:evidence:synthetic-snapshot-person-status]
-      rule:
-        type: consultation_matched
-        consultation: person_status
-      disclosure:
-        default: value
-        allowed: [value, redacted]
-      formats: [application/vnd.registry-notary.claim-result+json]
-
-    - id: synthetic-person-status
-      title: Synthetic person registration status
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          person_status:
-            profile:
-              id: synthetic.snapshot.person-status.exact
-              contract_hash: sha256:62132bbde55fcc9885753b322b4b978cf72cd038f773906fb16b98d0c0917786
-            inputs:
-              person_id: target.id
-            outputs:
-              registration_status: { type: string, nullable: false, max_bytes: 32 }
-      value:
-        type: string
-        nullable: true
-      purpose: benefit-status-verification
-      required_scopes: [registry:evidence:synthetic-snapshot-person-status]
-      rule:
-        type: consultation_output
-        consultation: person_status
-        output: registration_status
-      disclosure:
-        default: value
-        allowed: [value, redacted]
-      formats: [application/vnd.registry-notary.claim-result+json]
diff --git a/crates/registry-relay/scripts/check_advisory_baselines.py b/crates/registry-relay/scripts/check_advisory_baselines.py
index 4a890d2a3..5061ee81b 100644
--- a/crates/registry-relay/scripts/check_advisory_baselines.py
+++ b/crates/registry-relay/scripts/check_advisory_baselines.py
@@ -458,32 +458,36 @@ def validate_v2_baseline(data: dict[str, Any]) -> None:
             fail("v2 reviewed finding expires_at must not precede reviewed_at")
 
 
+def validate_v3_baseline(data: dict[str, Any]) -> None:
+    if set(data) != V3_TOP_LEVEL_FIELDS:
+        fail("v3 baseline must have the exact top-level field set")
+    nonblank(data.get("service"), "baseline service")
+    validate_policies(data.get("policies"))
+    exceptions = data.get("exceptions")
+    if not isinstance(exceptions, list):
+        fail("v3 baseline exceptions must be a list")
+    seen: set[tuple[str, str, str]] = set()
+    for exception in exceptions:
+        validate_v3_exception(exception)
+        key = exception_key(exception)
+        if key in seen:
+            fail(f"duplicate advisory exception identity: {' '.join(key)}")
+        seen.add(key)
+
+
 def load_baseline(path: Path) -> dict[str, Any]:
     data = load_json(path)
     if not isinstance(data, dict):
         fail("baseline must be a JSON object")
     version = data.get("version")
     if version == 3:
-        if set(data) != V3_TOP_LEVEL_FIELDS:
-            fail("v3 baseline must have the exact top-level field set")
-        nonblank(data.get("service"), "baseline service")
-        validate_policies(data.get("policies"))
-        exceptions = data.get("exceptions")
-        if not isinstance(exceptions, list):
-            fail("v3 baseline exceptions must be a list")
-        seen: set[tuple[str, str, str]] = set()
-        for exception in exceptions:
-            validate_v3_exception(exception)
-            key = exception_key(exception)
-            if key in seen:
-                fail(f"duplicate advisory exception identity: {' '.join(key)}")
-            seen.add(key)
-        return data
-    if version == 2:
+        validate_v3_baseline(data)
+    elif version == 2:
         validate_policies(data.get("policies"))
         validate_v2_baseline(data)
-        return data
-    fail(f"unsupported baseline version: {version}")
+    else:
+        fail(f"unsupported baseline version: {version}")
+    return data
 
 
 def exception_key(exception: dict[str, Any]) -> tuple[str, str, str]:
diff --git a/crates/registry-relay/scripts/run-live-consultation-journey.sh b/crates/registry-relay/scripts/run-live-consultation-journey.sh
deleted file mode 100755
index 72ec2bcec..000000000
--- a/crates/registry-relay/scripts/run-live-consultation-journey.sh
+++ /dev/null
@@ -1,296 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0
-
-set +x
-set +v
-set -euo pipefail
-umask 077
-
-readonly POSTGRES_IMAGE="postgres:16"
-
-[[ "$#" -le 1 ]] || {
-  printf '%s\n' "usage: $0 [dhis2|rhai|synthetic]" >&2
-  exit 1
-}
-readonly product="${1:-dhis2}"
-case "$product" in
-  dhis2)
-    readonly test_name="live_dhis2_consultation_lifecycle"
-    readonly temporary_label="dhis2"
-    ;;
-  rhai)
-    readonly test_name="live_dhis2_script_consultation_lifecycle"
-    readonly temporary_label="dhis2-rhai"
-    ;;
-  synthetic)
-    readonly test_name="synthetic_snapshot_exact_consultation_lifecycle"
-    readonly temporary_label="synthetic-snapshot"
-    ;;
-  *)
-    printf '%s\n' "usage: $0 [dhis2|rhai|synthetic]" >&2
-    exit 1
-    ;;
-esac
-
-fail() {
-  printf '%s\n' "$1" >&2
-  exit 1
-}
-
-safe_file_mode() {
-  local path="$1"
-  local mode
-  if mode="$(stat -f '%Lp' -- "$path" 2>/dev/null)"; then
-    :
-  else
-    mode="$(stat -c '%a' -- "$path" 2>/dev/null)" || return 1
-  fi
-  case "$mode" in
-    400|600) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-owned_by_current_user() {
-  local path="$1"
-  local owner
-  if owner="$(stat -f '%u' -- "$path" 2>/dev/null)"; then
-    :
-  else
-    owner="$(stat -c '%u' -- "$path" 2>/dev/null)" || return 1
-  fi
-  [[ "$owner" == "$(id -u)" ]]
-}
-
-if [[ "$product" == "dhis2" ]]; then
-  readonly live_env_file="${REGISTRY_RELAY_LIVE_ENV_FILE:-}"
-  [[ -n "$live_env_file" ]] || fail \
-    "REGISTRY_RELAY_LIVE_ENV_FILE must name the authorized mode-0600 environment file"
-  [[ -f "$live_env_file" && ! -L "$live_env_file" ]] || fail \
-    "REGISTRY_RELAY_LIVE_ENV_FILE must be a regular non-symlink file"
-  safe_file_mode "$live_env_file" || fail \
-    "REGISTRY_RELAY_LIVE_ENV_FILE must have mode 0600 or 0400"
-  owned_by_current_user "$live_env_file" || fail \
-    "REGISTRY_RELAY_LIVE_ENV_FILE must be owned by the current user"
-
-  # shellcheck disable=SC1090
-  source "$live_env_file"
-  set +x
-  set +v
-
-  case "$product" in
-    dhis2)
-      [[ -n "${DHIS2_BASE_URL:-}" ]] || fail "DHIS2_BASE_URL is required"
-      [[ -n "${DHIS2_USERNAME:-}" ]] || fail "DHIS2_USERNAME is required"
-      [[ -n "${DHIS2_PASSWORD:-}" ]] || fail "DHIS2_PASSWORD is required"
-      selected_base_url="$DHIS2_BASE_URL"
-      selected_principal="$DHIS2_USERNAME"
-      selected_secret="$DHIS2_PASSWORD"
-      ;;
-  esac
-
-  unset DHIS2_BASE_URL DHIS2_USERNAME DHIS2_PASSWORD
-  unset OPENCRVS_DCI_BASE_URL OPENCRVS_DCI_CLIENT_ID
-  unset OPENCRVS_DCI_CLIENT_SECRET OPENCRVS_DCI_SHA_SECRET
-  case "$product" in
-    dhis2)
-      export DHIS2_BASE_URL="$selected_base_url"
-      export DHIS2_USERNAME="$selected_principal"
-      export DHIS2_PASSWORD="$selected_secret"
-      ;;
-  esac
-  unset selected_base_url selected_principal selected_secret
-fi
-
-command -v cargo >/dev/null 2>&1 || fail "cargo is required"
-command -v docker >/dev/null 2>&1 || fail "Docker is required"
-command -v openssl >/dev/null 2>&1 || fail "openssl is required"
-docker info >/dev/null 2>&1 || fail "the Docker daemon is unavailable"
-
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-readonly script_dir
-repository_root="$(cd "$script_dir/../../.." && pwd)"
-readonly repository_root
-temporary_root="$(mktemp -d "${TMPDIR:-/tmp}/registry-relay-live-${temporary_label}.XXXXXX")"
-readonly temporary_root
-readonly certificate_input="$temporary_root/certificate-input"
-readonly docker_env_file="$temporary_root/postgres.env"
-readonly rhai_test_env_file="$temporary_root/rhai-test.env"
-readonly container_name="registry-relay-live-${temporary_label}-${$}-${RANDOM}"
-readonly certificate_volume="registry-relay-live-${temporary_label}-certs-${$}-${RANDOM}"
-readonly network_name="registry-relay-live-${temporary_label}-network-${$}-${RANDOM}"
-
-container_started=0
-volume_created=0
-network_created=0
-
-cleanup() {
-  local status=$?
-  trap - EXIT INT TERM HUP
-  unset REGISTRY_RELAY_LIVE_POSTGRES_ADMIN_URL
-  unset REGISTRY_RELAY_LIVE_POSTGRES_CA_PATH
-  unset POSTGRES_PASSWORD
-  unset DHIS2_BASE_URL DHIS2_USERNAME DHIS2_PASSWORD
-  unset OPENCRVS_DCI_BASE_URL OPENCRVS_DCI_CLIENT_ID
-  unset OPENCRVS_DCI_CLIENT_SECRET OPENCRVS_DCI_SHA_SECRET
-  if [[ "$container_started" == 1 ]]; then
-    docker rm --force "$container_name" >/dev/null 2>&1 || true
-  fi
-  if [[ "$volume_created" == 1 ]]; then
-    docker volume rm "$certificate_volume" >/dev/null 2>&1 || true
-  fi
-  if [[ "$network_created" == 1 ]]; then
-    docker network rm "$network_name" >/dev/null 2>&1 || true
-  fi
-  rm -rf "$temporary_root"
-  exit "$status"
-}
-trap cleanup EXIT INT TERM HUP
-
-mkdir -m 700 "$certificate_input"
-openssl req \
-  -x509 \
-  -newkey rsa:3072 \
-  -sha256 \
-  -nodes \
-  -days 1 \
-  -subj '/CN=registry-relay-live-root' \
-  -addext 'basicConstraints=critical,CA:TRUE' \
-  -addext 'keyUsage=critical,keyCertSign,cRLSign' \
-  -keyout "$certificate_input/ca.key" \
-  -out "$certificate_input/ca.crt" \
-  >/dev/null 2>&1 || fail "could not generate the disposable TLS root"
-openssl req \
-  -new \
-  -newkey rsa:3072 \
-  -sha256 \
-  -nodes \
-  -subj '/CN=localhost' \
-  -addext 'subjectAltName=DNS:localhost,DNS:host.docker.internal,DNS:rhai-runner,IP:127.0.0.1' \
-  -keyout "$certificate_input/server.key" \
-  -out "$certificate_input/server.csr" \
-  >/dev/null 2>&1 || fail "could not generate the disposable TLS identity request"
-openssl x509 \
-  -req \
-  -in "$certificate_input/server.csr" \
-  -CA "$certificate_input/ca.crt" \
-  -CAkey "$certificate_input/ca.key" \
-  -CAcreateserial \
-  -days 1 \
-  -sha256 \
-  -copy_extensions copy \
-  -extfile <(printf 'basicConstraints=critical,CA:FALSE\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\n') \
-  -out "$certificate_input/server.crt" \
-  >/dev/null 2>&1 || fail "could not sign the disposable TLS identity"
-chmod 0600 "$certificate_input/ca.key"
-chmod 0644 "$certificate_input/ca.crt"
-chmod 0600 "$certificate_input/server.key"
-chmod 0644 "$certificate_input/server.crt"
-
-postgres_password="$(openssl rand -hex 32)" || fail \
-  "could not generate the disposable PostgreSQL password"
-{
-  printf 'POSTGRES_USER=postgres\n'
-  printf 'POSTGRES_DB=relay_live\n'
-  printf 'POSTGRES_PASSWORD=%s\n' "$postgres_password"
-} >"$docker_env_file"
-chmod 0600 "$docker_env_file"
-unset postgres_password
-
-docker volume create "$certificate_volume" >/dev/null
-volume_created=1
-docker network create "$network_name" >/dev/null
-network_created=1
-docker run --rm \
-  --user 0:0 \
-  --volume "$certificate_volume:/certificates" \
-  --volume "$certificate_input:/input:ro" \
-  "$POSTGRES_IMAGE" \
-  sh -eu -c \
-  'cp /input/server.crt /certificates/server.crt
-   cp /input/server.key /certificates/server.key
-   chown postgres:postgres /certificates/server.crt /certificates/server.key
-   chmod 0644 /certificates/server.crt
-   chmod 0600 /certificates/server.key' \
-  >/dev/null
-
-docker run --detach \
-  --name "$container_name" \
-  --env-file "$docker_env_file" \
-  --publish 127.0.0.1::5432 \
-  --volume "$certificate_volume:/certificates:ro" \
-  "$POSTGRES_IMAGE" \
-  -c ssl=on \
-  -c ssl_cert_file=/certificates/server.crt \
-  -c ssl_key_file=/certificates/server.key \
-  >/dev/null
-container_started=1
-
-ready=0
-for _ in $(seq 1 60); do
-  if docker exec "$container_name" pg_isready --username postgres --dbname relay_live \
-    >/dev/null 2>&1; then
-    ready=1
-    break
-  fi
-  sleep 1
-done
-[[ "$ready" == 1 ]] || fail "the disposable PostgreSQL 16 instance did not become ready"
-
-port_mapping="$(docker port "$container_name" 5432/tcp)" || fail \
-  "the disposable PostgreSQL port could not be resolved"
-postgres_port="${port_mapping##*:}"
-[[ "$postgres_port" =~ ^[0-9]+$ ]] || fail \
-  "the disposable PostgreSQL port mapping was invalid"
-
-# shellcheck disable=SC1090
-source "$docker_env_file"
-if [[ "$product" == "rhai" ]]; then
-  {
-    printf 'CARGO_TARGET_DIR=/target\n'
-    printf 'REGISTRY_RELAY_LIVE_POSTGRES_ADMIN_URL=postgresql://postgres:%s@host.docker.internal:%s/relay_live?sslmode=require\n' \
-      "$POSTGRES_PASSWORD" "$postgres_port"
-    printf 'REGISTRY_RELAY_LIVE_POSTGRES_CA_PATH=/live-postgres-ca/ca.crt\n'
-    printf 'REGISTRY_RELAY_LIVE_RELAY_BINARY=/target/debug/registry-relay\n'
-    printf 'REGISTRY_RELAY_LIVE_REGISTRYCTL_BINARY=/target/debug/registryctl\n'
-    printf 'REGISTRY_RELAY_LIVE_SOURCE_CERT_PATH=/live-postgres-ca/server.crt\n'
-    printf 'REGISTRY_RELAY_LIVE_SOURCE_KEY_PATH=/live-postgres-ca/server.key\n'
-  } >"$rhai_test_env_file"
-  chmod 0600 "$rhai_test_env_file"
-else
-  # shellcheck disable=SC2153
-  export REGISTRY_RELAY_LIVE_POSTGRES_ADMIN_URL="postgresql://postgres:${POSTGRES_PASSWORD}@127.0.0.1:${postgres_port}/relay_live?sslmode=require"
-  export REGISTRY_RELAY_LIVE_POSTGRES_CA_PATH="$certificate_input/ca.crt"
-fi
-unset POSTGRES_PASSWORD
-unset port_mapping
-unset postgres_port
-
-cd "$repository_root"
-if [[ "$product" == "rhai" ]]; then
-  docker run --rm \
-    --add-host host.docker.internal:host-gateway \
-    --network "$network_name" \
-    --network-alias rhai-runner \
-    --env-file "$rhai_test_env_file" \
-    --volume "$repository_root:/workspace" \
-    --volume "$certificate_input:/live-postgres-ca:ro" \
-    --volume "$HOME/.cargo/registry:/usr/local/cargo/registry" \
-    --volume "$HOME/.cargo/git:/usr/local/cargo/git" \
-    --volume registry-relay-linux-target:/target \
-    --workdir /workspace \
-    rust:1.95-trixie@sha256:f49565f188ee00bc2a18dd418183f2c5f23ef7d6e691890517ed341a598f67c3 \
-    sh -eu -c \
-    'cp /live-postgres-ca/ca.crt /usr/local/share/ca-certificates/registry-live-source.crt
-     update-ca-certificates >/dev/null 2>&1
-     cargo build --locked --package registry-relay --bin registry-relay --bin registry-relay-rhai-worker --package registryctl --bin registryctl
-     cargo test --locked --package registry-relay --test live_consultation_journeys live_dhis2_script_consultation_lifecycle -- --ignored'
-else
-  cargo test \
-    --package registry-relay \
-    --locked \
-    --test live_consultation_journeys \
-    "$test_name" \
-    -- \
-    --ignored
-fi
diff --git a/crates/registry-relay/src/api/openapi.rs b/crates/registry-relay/src/api/openapi.rs
index ebb6592e2..d51a1bd1f 100644
--- a/crates/registry-relay/src/api/openapi.rs
+++ b/crates/registry-relay/src/api/openapi.rs
@@ -2595,14 +2595,14 @@ fn evidence_offering_list_example() -> Value {
 fn evidence_offering_example() -> Value {
     json!({
         "access": {
-            "conforms_to": "https://demo.example.gov/standards/registry-notary/evidence-v1",
-            "discovery_url": "https://notary.demo.example.gov/.well-known/registry-notary",
-            "endpoint_url": "https://notary.demo.example.gov/evidence-offerings/benefits-person/verifications",
-            "kind": "registry-notary",
+            "conforms_to": "registry.assertion-evidence/v1",
+            "discovery_url": "https://benefits-evidence.demo.example.gov/.well-known/evidence/jwks.json",
+            "endpoint_url": "https://benefits-evidence.demo.example.gov",
+            "kind": "registry-evidence",
             "ruleset": "benefits-person-v1",
         },
         "dataset_id": "benefits_casework",
-        "description": "Registry Notary verification for submitted benefits person eligibility status and role facts.",
+        "description": "Evidence assertion for submitted benefits person eligibility status and role facts.",
         "entity": "person",
         "evidence_type": {
             "id": "benefits_person_record_evidence",
@@ -3428,8 +3428,8 @@ fn evidence_offering_schema() -> Value {
                 "type": "object",
                 "required": ["kind", "ruleset"],
                 "properties": {
-                    "kind": { "type": "string", "enum": ["registry-notary"] },
-                    "conforms_to": { "type": ["string", "null"], "format": "uri" },
+                    "kind": { "type": "string", "enum": ["registry-evidence"] },
+                    "conforms_to": { "type": ["string", "null"] },
                     "endpoint_url": { "type": ["string", "null"], "format": "uri" },
                     "discovery_url": { "type": ["string", "null"], "format": "uri" },
                     "ruleset": { "type": "string" },
@@ -5128,8 +5128,8 @@ fn query_parameter(name: &str, description: &str) -> Value {
 ///   (`require_purpose_header`).
 /// - When present, the value is recorded verbatim in the audit trail.
 /// - On these ordinary entity and feature routes, purpose *values* are not
-///   compared to an allowlist; Registry Notary remains the purpose-certification
-///   layer for an offering handoff.
+///   compared to an allowlist; certifying a purpose value is left to the
+///   layer that hands off an offering, not to Registry Relay.
 /// - Native `/v1/consultations/.../execute` is a separate contract and validates
 ///   `Data-Purpose` against the selected consultation profile.
 /// - Value-level allowlists, if ever added, arrive as additive opt-in config
@@ -5147,8 +5147,8 @@ fn purpose_header_parameter_with_required(required: bool) -> Value {
                         When `require_purpose_header` is set on this entity, \
                         the header must be present; a missing value returns `400 auth.purpose_required`. \
                         On ordinary entity and feature routes, the value is recorded verbatim \
-                        in the audit trail but is not compared to a value allowlist; Registry \
-                        Notary remains the purpose-certification layer for an offering handoff. \
+                        in the audit trail but is not compared to a value allowlist; certifying \
+                        a purpose value is left to the layer that hands off an offering. \
                         Native `/v1/consultations/.../execute` is separate and validates \
                         `Data-Purpose` against the selected consultation profile contract. \
                         Header names are case-insensitive (`Data-Purpose` and `data-purpose` are equivalent).",
@@ -5717,7 +5717,7 @@ mod tests {
 
         assert_eq!(
             schemas["EvidenceOffering"]["properties"]["access"]["properties"]["kind"]["enum"],
-            json!(["registry-notary"])
+            json!(["registry-evidence"])
         );
     }
 
diff --git a/crates/registry-relay/src/config/validate.rs b/crates/registry-relay/src/config/validate.rs
index f9fe18519..8ad0e686d 100644
--- a/crates/registry-relay/src/config/validate.rs
+++ b/crates/registry-relay/src/config/validate.rs
@@ -17,7 +17,7 @@ use crate::consultation::{
 use crate::error::{ConfigError, Error, RuntimeBindingError};
 use crate::state_plane::{AuditChainKeyEpochId, AuditPseudonymKeyringLockKey, ServingFenceLockKey};
 use crate::table_provider::table_name;
-use registry_manifest_core::CompiledMetadata;
+use registry_manifest_core::{CompiledMetadata, REGISTRY_EVIDENCE_ACCESS_KIND};
 use registry_platform_authcommon::CredentialFingerprintRefError;
 use registry_platform_httpsec::CorsPolicy;
 use registry_platform_httputil::destination::MAX_SERVICE_HOP_OPERATION_TIMEOUT;
@@ -790,13 +790,13 @@ pub fn validate_runtime_bindings(
                     return Err(RuntimeBindingError::FieldMissing);
                 }
             }
-            if offering.access.kind != "registry-notary" {
+            if offering.access.kind != REGISTRY_EVIDENCE_ACCESS_KIND {
                 tracing::error!(
                     code = "runtime.binding.unsupported_evidence_offering",
                     dataset_id = %dataset.id,
                     offering = %offering.id,
                     access_kind = %offering.access.kind,
-                    "Registry Relay only supports external Registry Notary evidence offerings"
+                    "Registry Relay only advertises external Evidence offerings"
                 );
                 return Err(RuntimeBindingError::UnsupportedEvidenceOffering);
             }
diff --git a/crates/registry-relay/src/metadata/core_adapter.rs b/crates/registry-relay/src/metadata/core_adapter.rs
index b08163346..61d8345a9 100644
--- a/crates/registry-relay/src/metadata/core_adapter.rs
+++ b/crates/registry-relay/src/metadata/core_adapter.rs
@@ -26,7 +26,6 @@ pub fn manifest_from_runtime(config: &Config, registry: &EntityRegistry) -> core
         catalog: catalog_manifest(config),
         vocabularies: config.vocabularies.clone(),
         profiles: Vec::new(),
-        federation: None,
         evaluation_profiles: Vec::new(),
         ecosystem_bindings: Vec::new(),
         requirements: Vec::new(),
@@ -72,7 +71,6 @@ pub fn scoped_compiled_from_runtime(
         catalog: catalog_manifest(config),
         vocabularies: config.vocabularies.clone(),
         profiles: Vec::new(),
-        federation: None,
         evaluation_profiles: Vec::new(),
         ecosystem_bindings: Vec::new(),
         requirements: Vec::new(),
diff --git a/crates/registry-relay/tests/entity_routes.rs b/crates/registry-relay/tests/entity_routes.rs
index c5fdd573c..e4d29b636 100644
--- a/crates/registry-relay/tests/entity_routes.rs
+++ b/crates/registry-relay/tests/entity_routes.rs
@@ -60,13 +60,6 @@ catalog:
   title: Test
   publisher:
     name: Test
-federation:
-  node_id: did:web:data.example.test
-  issuer: https://data.example.test
-  jwks_uri: https://data.example.test/.well-known/jwks.json
-  federation_api: https://data.example.test/federation
-  supported_protocol_versions:
-    - registry-notary-federation/v0.1
 evaluation_profiles:
   - id: exact-name
     ruleset: exact-name
@@ -221,10 +214,10 @@ datasets:
         entity: individual
         lookup_keys: [given_name]
         access:
-          kind: registry-notary
-          conforms_to: registry-notary-federation/v0.1
+          kind: registry-evidence
+          conforms_to: registry.assertion-evidence/v1
           endpoint_url: https://evidence.example.test/individual-name
-          discovery_url: https://evidence.example.test/.well-known/registry-notary
+          discovery_url: https://evidence.example.test/.well-known/evidence/jwks.json
           ruleset: exact-name
         policy:
           purpose:
@@ -241,10 +234,10 @@ datasets:
         entity: individual
         lookup_keys: [given_name]
         access:
-          kind: registry-notary
-          conforms_to: registry-notary-federation/v0.1
+          kind: registry-evidence
+          conforms_to: registry.assertion-evidence/v1
           endpoint_url: https://evidence.example.test/individual-targeted-name
-          discovery_url: https://evidence.example.test/.well-known/registry-notary
+          discovery_url: https://evidence.example.test/.well-known/evidence/jwks.json
           ruleset: exact-name-targeted
       - id: individual_alternate_name_evidence
         iri: https://data.example.test/evidence-offerings/individual-alternate-name
@@ -258,10 +251,10 @@ datasets:
         entity: individual
         lookup_keys: [given_name]
         access:
-          kind: registry-notary
-          conforms_to: registry-notary-federation/v0.1
+          kind: registry-evidence
+          conforms_to: registry.assertion-evidence/v1
           endpoint_url: https://evidence.example.test/individual-alternate-name
-          discovery_url: https://evidence.example.test/.well-known/registry-notary
+          discovery_url: https://evidence.example.test/.well-known/evidence/jwks.json
           ruleset: exact-name
       - id: individual_hidden_name_evidence
         iri: https://data.example.test/evidence-offerings/individual-hidden-name
@@ -275,10 +268,10 @@ datasets:
         entity: individual
         lookup_keys: [given_name]
         access:
-          kind: registry-notary
-          conforms_to: registry-notary-federation/v0.1
+          kind: registry-evidence
+          conforms_to: registry.assertion-evidence/v1
           endpoint_url: https://evidence.example.test/individual-hidden-name
-          discovery_url: https://evidence.example.test/.well-known/registry-notary
+          discovery_url: https://evidence.example.test/.well-known/evidence/jwks.json
           ruleset: hidden-name
       - id: external_individual_name_evidence
         iri: https://data.example.test/evidence-offerings/external-individual-name
@@ -292,8 +285,8 @@ datasets:
         entity: individual
         lookup_keys: [given_name]
         access:
-          kind: registry-notary
-          conforms_to: registry-notary-federation/v0.1
+          kind: registry-evidence
+          conforms_to: registry.assertion-evidence/v1
           endpoint_url: https://evidence.example.test
           discovery_url: https://evidence.example.test/.well-known/evidence-service
           ruleset: exact-name
@@ -2362,7 +2355,7 @@ async fn metadata_evidence_offerings_are_private_filterable_and_scope_limited()
         .iter()
         .any(
             |offering| offering["id"] == "external_individual_name_evidence"
-                && offering["access"]["kind"] == "registry-notary"
+                && offering["access"]["kind"] == "registry-evidence"
         ));
 
     let empty = server.get("/metadata/evidence-offerings?country=NO").await;
diff --git a/crates/registry-relay/tests/live_consultation_journeys.rs b/crates/registry-relay/tests/live_consultation_journeys.rs
deleted file mode 100644
index a7139c064..000000000
--- a/crates/registry-relay/tests/live_consultation_journeys.rs
+++ /dev/null
@@ -1,2596 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-#![cfg(unix)]
-//! Explicitly ignored end-to-end proofs for maintained Relay consultation journeys.
-//!
-//! The companion runner supplies a disposable TLS PostgreSQL 16 database and
-//! sources the operator-authorized product credentials. This module never prints
-//! a credential, bearer token, source URL, selector, source response, or public
-//! response body. Failures retain only the closed test-stage taxonomy below.
-
-use std::{
-    env, fs,
-    fs::OpenOptions,
-    io::Write as _,
-    os::unix::fs::OpenOptionsExt as _,
-    path::{Path, PathBuf},
-    sync::Arc,
-    time::{SystemTime, UNIX_EPOCH},
-};
-
-#[cfg(target_os = "linux")]
-use std::{
-    collections::BTreeMap,
-    io::Read as _,
-    net::{TcpListener as StdTcpListener, ToSocketAddrs as _},
-    process::Stdio,
-    sync::atomic::{AtomicBool, Ordering},
-    sync::Mutex as StdMutex,
-};
-
-use axum::{
-    body::{to_bytes, Body},
-    http::{header, HeaderValue, Method, Request, StatusCode},
-    Extension, Router,
-};
-use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
-use ed25519_dalek::{pkcs8::EncodePrivateKey, SigningKey};
-use jsonwebtoken::{encode, Algorithm, EncodingKey, Header};
-use postgres_native_tls::MakeTlsConnector;
-use rand_core::{OsRng, RngCore as _};
-use registry_notary_server::{compile_notary_runtime, notary_shared_router_from_runtime};
-use registry_platform_audit::AuditChainProfile;
-#[cfg(target_os = "linux")]
-use registry_platform_crypto::canonicalize_json;
-use reqwest::Url;
-use serde_json::{json, Map, Value};
-use sha2::{Digest, Sha256};
-use tempfile::TempDir;
-use thiserror::Error;
-use time::{format_description::well_known::Rfc3339, OffsetDateTime};
-use tokio::{
-    io::{AsyncReadExt, AsyncWriteExt},
-    net::TcpListener,
-    sync::watch,
-    task::JoinHandle,
-};
-#[cfg(target_os = "linux")]
-use tokio::{
-    process::{Child, Command},
-    time::{sleep, Duration, Instant},
-};
-use tokio_postgres::{Client, Config as PostgresConfig};
-use tower::ServiceExt;
-use ulid::Ulid;
-use zeroize::Zeroizing;
-
-use registry_relay::source_plan::authoring::compile_private_binding;
-use registry_relay::{
-    audit::{AuditPipeline, InMemorySink},
-    config,
-    consultation::{
-        operator::{
-            bootstrap_state, BootstrapKeyringStatus, BootstrapStatePlaneStatus,
-            BootstrapStateRequest,
-        },
-        ConsultationService, ConsultationServiceReadiness,
-    },
-    format::FormatRegistry,
-    ingest::IngestRegistry,
-    server,
-};
-
-const ADMIN_DATABASE_URL_ENV: &str = "REGISTRY_RELAY_LIVE_POSTGRES_ADMIN_URL";
-const POSTGRES_CA_PATH_ENV: &str = "REGISTRY_RELAY_LIVE_POSTGRES_CA_PATH";
-const RUNTIME_DATABASE_URL_ENV: &str = "REGISTRY_RELAY_CONSULTATION_DATABASE_URL";
-const MAINTENANCE_DATABASE_URL_ENV: &str = "REGISTRY_RELAY_LIVE_MAINTENANCE_DATABASE_URL";
-const READER_DATABASE_URL_ENV: &str = "REGISTRY_RELAY_LIVE_READER_DATABASE_URL";
-const AUDIT_SECRET_ENV: &str = "REGISTRY_RELAY_AUDIT_HASH_SECRET";
-const PSEUDONYM_SECRET_ENV: &str = "REGISTRY_RELAY_AUDIT_PSEUDONYM_EPOCH_1";
-const DHIS2_BASE_URL_ENV: &str = "DHIS2_BASE_URL";
-const DHIS2_USERNAME_ENV: &str = "DHIS2_USERNAME";
-const DHIS2_PASSWORD_ENV: &str = "DHIS2_PASSWORD";
-const OPENCRVS_BASE_URL_ENV: &str = "OPENCRVS_DCI_BASE_URL";
-const OPENCRVS_CLIENT_ID_ENV: &str = "OPENCRVS_DCI_CLIENT_ID";
-const OPENCRVS_CLIENT_SECRET_ENV: &str = "OPENCRVS_DCI_CLIENT_SECRET";
-const NOTARY_DHIS2_API_KEY_HASH_ENV: &str = "REGISTRY_NOTARY_DHIS2_API_KEY_HASH";
-const NOTARY_OPENCRVS_API_KEY_HASH_ENV: &str = "REGISTRY_NOTARY_OPENCRVS_API_KEY_HASH";
-const NOTARY_SYNTHETIC_API_KEY_HASH_ENV: &str = "REGISTRY_NOTARY_SYNTHETIC_SNAPSHOT_API_KEY_HASH";
-const NOTARY_AUDIT_SECRET_ENV: &str = "REGISTRY_NOTARY_AUDIT_HASH_SECRET";
-#[cfg(target_os = "linux")]
-const RHAI_RELAY_BINARY_ENV: &str = "REGISTRY_RELAY_LIVE_RELAY_BINARY";
-#[cfg(target_os = "linux")]
-const RHAI_REGISTRYCTL_BINARY_ENV: &str = "REGISTRY_RELAY_LIVE_REGISTRYCTL_BINARY";
-#[cfg(target_os = "linux")]
-const RHAI_SOURCE_USERNAME_ENV: &str = "HEALTH_REGISTRY_USERNAME";
-#[cfg(target_os = "linux")]
-const RHAI_SOURCE_PASSWORD_ENV: &str = "HEALTH_REGISTRY_PASSWORD";
-#[cfg(target_os = "linux")]
-const RHAI_ISSUER_JWK_ENV: &str = "REGISTRY_NOTARY_ISSUER_JWK";
-#[cfg(target_os = "linux")]
-const RHAI_SOURCE_CERT_PATH_ENV: &str = "REGISTRY_RELAY_LIVE_SOURCE_CERT_PATH";
-#[cfg(target_os = "linux")]
-const RHAI_SOURCE_KEY_PATH_ENV: &str = "REGISTRY_RELAY_LIVE_SOURCE_KEY_PATH";
-
-const PROFILE_VERSION: &str = "1";
-const ISSUER: &str = "https://relay-live-issuer.example.test";
-const AUDIENCE: &str = "relay-consultation";
-const NOTARY_PRINCIPAL: &str = "registry-notary";
-const JWT_KID: &str = "relay-live-consultation-ed25519";
-const PSEUDONYM_KEY_ID: &str = "epoch-1";
-
-const CONFIG_EXAMPLE_FILE: &str = "relay-config.example.yaml";
-const NOTARY_CONFIG_EXAMPLE_FILE: &str = "notary-config.example.yaml";
-const PUBLIC_CONTRACT_FILE: &str = "public-contract.json";
-const INTEGRATION_PACK_FILE: &str = "integration-pack.json";
-const CONFORMANCE_FILE: &str = "evidence/conformance.json";
-const NEGATIVE_SECURITY_FILE: &str = "evidence/negative-security.json";
-const MINIMIZATION_FILE: &str = "evidence/minimization.json";
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-enum JourneyProfile {
-    Dhis2,
-    #[cfg_attr(not(target_os = "linux"), allow(dead_code))]
-    Dhis2Script,
-    OpenCrvs,
-    SyntheticSnapshot,
-}
-
-impl JourneyProfile {
-    fn directory(self) -> &'static str {
-        match self {
-            Self::Dhis2 => "profiles/dhis2-2.41.9-enrollment-status",
-            Self::Dhis2Script => "../registryctl/tests/fixtures/project-authoring/dhis2-script",
-            Self::OpenCrvs => "profiles/opencrvs-1.9.0-rc.1-farajaland-birth-record-exists",
-            Self::SyntheticSnapshot => "profiles/synthetic-snapshot-exact-person-status",
-        }
-    }
-
-    fn profile_id(self) -> &'static str {
-        match self {
-            Self::Dhis2 => "dhis2.tracker.enrollment-status.exact",
-            Self::Dhis2Script => "fictional-health-registry.health-verification.health",
-            Self::OpenCrvs => "opencrvs.dci.farajaland.birth-record-exists.exact",
-            Self::SyntheticSnapshot => "synthetic.snapshot.person-status.exact",
-        }
-    }
-
-    fn purpose(self) -> &'static str {
-        match self {
-            Self::Dhis2 => "program-enrollment-verification",
-            Self::Dhis2Script => "programme-enrollment-verification",
-            Self::OpenCrvs => "civil-registration-verification",
-            Self::SyntheticSnapshot => "benefit-status-verification",
-        }
-    }
-
-    fn required_scope(self) -> &'static str {
-        match self {
-            Self::Dhis2 => "registry:consult:dhis2-enrollment-status",
-            Self::Dhis2Script => "registry:consult:health-verification",
-            Self::OpenCrvs => "registry:consult:opencrvs-birth-record",
-            Self::SyntheticSnapshot => "registry:consult:synthetic-snapshot-person-status",
-        }
-    }
-
-    fn notary_api_key_hash_env(self) -> &'static str {
-        match self {
-            Self::Dhis2 => NOTARY_DHIS2_API_KEY_HASH_ENV,
-            Self::Dhis2Script => "PROGRAMME_VERIFIER_TOKEN_HASH",
-            Self::OpenCrvs => NOTARY_OPENCRVS_API_KEY_HASH_ENV,
-            Self::SyntheticSnapshot => NOTARY_SYNTHETIC_API_KEY_HASH_ENV,
-        }
-    }
-
-    fn pack_id(self) -> &'static str {
-        match self {
-            Self::Dhis2 => "dhis2.tracker.enrollment-status",
-            Self::Dhis2Script => "fictional-health-registry.fictional-dhis2-health-record",
-            Self::OpenCrvs => "opencrvs.dci.farajaland.birth-record-exists",
-            Self::SyntheticSnapshot => "synthetic.snapshot.person-status",
-        }
-    }
-
-    fn pack_hash(self) -> &'static str {
-        match self {
-            Self::Dhis2 => {
-                "sha256:3ebf1e17fba13e4071101a162ad53311e1a7404bea8e2624ec8621aa9d0ac997"
-            }
-            Self::Dhis2Script => {
-                "sha256:8732042fbe873ef34d86658197673b70eab8e6e52897093d355937ef1bf51165"
-            }
-            Self::OpenCrvs => {
-                "sha256:1756f16b1c496e11be1069831ea4f54d8953466ed62bb48efc9f0c7e7def8768"
-            }
-            Self::SyntheticSnapshot => {
-                "sha256:e9f550c4d262eb4ebc9c04218851573a5bb4e2893fad0c8f7520399b02be8cc5"
-            }
-        }
-    }
-
-    fn source_environment(self) -> Option<[&'static str; 2]> {
-        match self {
-            Self::Dhis2 => Some([DHIS2_USERNAME_ENV, DHIS2_PASSWORD_ENV]),
-            Self::Dhis2Script => None,
-            Self::OpenCrvs => Some([OPENCRVS_CLIENT_ID_ENV, OPENCRVS_CLIENT_SECRET_ENV]),
-            Self::SyntheticSnapshot => None,
-        }
-    }
-
-    fn selector(self) -> Zeroizing<String> {
-        match self {
-            Self::Dhis2 => Zeroizing::new("PQfMcpmXeFE".to_string()),
-            Self::Dhis2Script => Zeroizing::new("A0000000001".to_string()),
-            Self::OpenCrvs => Zeroizing::new(format!("{:010}", OsRng.next_u64() % 10_000_000_000)),
-            Self::SyntheticSnapshot => Zeroizing::new("per-2001".to_string()),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, Error, PartialEq, Eq)]
-enum LiveJourneyError {
-    #[error("required live-test environment is unavailable: {0}")]
-    MissingEnvironment(&'static str),
-    #[error("the authorized source base URL is invalid")]
-    InvalidSourceBaseUrl,
-    #[error("the disposable PostgreSQL trust configuration is invalid")]
-    InvalidPostgresTls,
-    #[error("the disposable PostgreSQL database is unavailable")]
-    PostgresUnavailable,
-    #[error("the disposable PostgreSQL role installation failed")]
-    StatePlaneInstall,
-    #[error("the disposable PostgreSQL pseudonym epoch initialization failed")]
-    PseudonymInitialization,
-    #[error("the maintained consultation artifacts could not be staged")]
-    ArtifactStaging,
-    #[error("the governed project-authored Rhai closure could not be built")]
-    #[cfg_attr(not(target_os = "linux"), allow(dead_code))]
-    ProjectBuild,
-    #[error("the governed Rhai source fixture failed")]
-    #[cfg_attr(not(target_os = "linux"), allow(dead_code))]
-    SourceFixture,
-    #[error("the maintained consultation runtime configuration did not load")]
-    ConfigLoad,
-    #[error("the live OIDC JWKS server could not start")]
-    JwksServer,
-    #[error("the live EdDSA bearer token could not be minted")]
-    TokenMint,
-    #[error("the production OIDC provider could not be built")]
-    AuthActivation,
-    #[error("the keyed audit profile could not be activated")]
-    AuditActivation,
-    #[error("the concrete consultation service could not be activated")]
-    ConsultationActivation,
-    #[error("the concrete consultation service was not ready")]
-    ConsultationNotReady,
-    #[error("the synthetic snapshot ingest and publication failed")]
-    SnapshotIngest,
-    #[error("the production protected router could not be assembled")]
-    RouterAssembly,
-    #[error("the protected Relay listener could not be started")]
-    RelayListener,
-    #[error("the production Relay process failed")]
-    #[cfg_attr(not(target_os = "linux"), allow(dead_code))]
-    RelayProcess,
-    #[error("the reloadable Relay workload credential could not be staged")]
-    RelayCredentialStaging,
-    #[error("the maintained Notary runtime configuration did not load")]
-    NotaryConfigLoad,
-    #[error("the Notary-to-Relay consultation path could not be activated")]
-    NotaryActivation,
-    #[error("the activated Notary-to-Relay path was not ready")]
-    NotaryReadiness,
-    #[error("the Notary evaluation request failed")]
-    NotaryRequest,
-    #[error("the minimized Notary evaluation response was invalid")]
-    NotaryResponse,
-    #[error("the restricted Notary audit correlation was invalid")]
-    NotaryAudit,
-    #[error("Relay reported the live consultation unavailable")]
-    ExecuteUnavailable,
-    #[error("Relay recorded unavailable source credentials for the live consultation")]
-    ExecuteSourceCredentialsUnavailable,
-    #[error("Relay recorded the live source as unavailable")]
-    ExecuteSourceUnavailable,
-    #[error("Relay recorded a live source response-contract violation")]
-    ExecuteResponseContractViolation,
-    #[error("Relay recorded a live source cardinality violation")]
-    ExecuteCardinalityViolation,
-    #[error("Relay closed the live consultation before source dispatch")]
-    ExecuteClosedBeforeSourceDispatch,
-    #[error("Relay closed the live consultation after source dispatch without a known result")]
-    ExecuteClosedAfterSourceDispatch,
-    #[error("Relay left the live consultation without a terminal durable completion")]
-    ExecuteMissingDurableCompletion,
-    #[error("the durable consultation evidence did not match the completed journey")]
-    DurableEvidence,
-    #[error("the concrete consultation service did not shut down cleanly")]
-    ConsultationShutdown,
-    #[error("the disposable PostgreSQL state could not be cleaned up")]
-    PostgresCleanup,
-}
-
-/// Run via `scripts/run-live-consultation-journey.sh dhis2`. The test stays ignored so
-/// ordinary CI and developer test runs never contact a live registry.
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[ignore = "requires the explicit live DHIS2 runner and a disposable TLS PostgreSQL 16 instance"]
-async fn live_dhis2_consultation_lifecycle() {
-    if let Err(error) = run_live_consultation_lifecycle(JourneyProfile::Dhis2).await {
-        panic!("live DHIS2 consultation lifecycle failed: {error}");
-    }
-}
-
-/// Run via `scripts/run-live-consultation-journey.sh rhai`. The project-authored
-/// closure, loopback source, real Relay executable, isolated one-shot workers,
-/// Notary, and PostgreSQL state plane all run inside the governed Linux runner.
-#[cfg(target_os = "linux")]
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-#[ignore = "requires the explicit Linux Rhai runner and a disposable TLS PostgreSQL 16 instance"]
-async fn live_dhis2_script_consultation_lifecycle() {
-    if let Err(error) = run_live_rhai_consultation_lifecycle().await {
-        panic!("live DHIS2 script consultation lifecycle failed: {error}");
-    }
-}
-
-/// Run via `scripts/run-live-consultation-journey.sh synthetic`. The source fixture is
-/// repository-owned; only the disposable TLS PostgreSQL state plane is external.
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[ignore = "requires the explicit synthetic runner and a disposable TLS PostgreSQL 16 instance"]
-async fn synthetic_snapshot_exact_consultation_lifecycle() {
-    if let Err(error) = run_live_consultation_lifecycle(JourneyProfile::SyntheticSnapshot).await {
-        panic!("synthetic SnapshotExact consultation lifecycle failed: {error}");
-    }
-}
-
-#[test]
-fn maintained_operator_example_stages_through_real_loader() {
-    for (profile, source_url) in [
-        (
-            JourneyProfile::Dhis2,
-            "https://dhis2.example.test/stable-2-41-9",
-        ),
-        (JourneyProfile::OpenCrvs, "https://opencrvs.example.test"),
-        (JourneyProfile::SyntheticSnapshot, ""),
-    ] {
-        let staged = StagedProfile::new(
-            profile,
-            source_url,
-            Path::new("/tmp/registry-relay-live-test-ca.pem"),
-            "http://127.0.0.1:1/keys",
-        )
-        .unwrap_or_else(|error| {
-            panic!("the {profile:?} maintained operator example did not stage: {error}")
-        });
-        let loaded = config::load_with_metadata(&staged.config_path).unwrap_or_else(|error| {
-            panic!("the staged {profile:?} maintained operator example did not load: {error}")
-        });
-        assert!(loaded.runtime.consultation.is_some());
-        assert!(loaded.consultation_artifacts.is_some());
-    }
-}
-
-#[test]
-fn maintained_notary_example_loads_and_validates() {
-    for profile in [JourneyProfile::Dhis2, JourneyProfile::SyntheticSnapshot] {
-        let path = Path::new(env!("CARGO_MANIFEST_DIR"))
-            .join(profile.directory())
-            .join(NOTARY_CONFIG_EXAMPLE_FILE);
-        let yaml = fs::read_to_string(path)
-            .unwrap_or_else(|_| panic!("the maintained Notary operator example was not readable"));
-        let config: registry_notary_core::StandaloneRegistryNotaryConfig =
-            serde_norway::from_str(&yaml)
-                .unwrap_or_else(|_| panic!("the maintained Notary operator example did not parse"));
-        config.validate().unwrap_or_else(|error| {
-            panic!("the maintained Notary operator example did not validate: {error}")
-        });
-    }
-}
-
-#[test]
-fn durable_failure_diagnostics_remain_closed_and_exact() {
-    for (outcome, class, failure, expected) in [
-        (
-            Some("known_complete"),
-            Some("known_failure"),
-            Some("credential_unavailable"),
-            LiveJourneyError::ExecuteSourceCredentialsUnavailable,
-        ),
-        (
-            Some("known_complete"),
-            Some("known_failure"),
-            Some("source_unavailable"),
-            LiveJourneyError::ExecuteSourceUnavailable,
-        ),
-        (
-            Some("known_complete"),
-            Some("known_failure"),
-            Some("response_contract_violation"),
-            LiveJourneyError::ExecuteResponseContractViolation,
-        ),
-        (
-            Some("known_complete"),
-            Some("known_failure"),
-            Some("cardinality_violation"),
-            LiveJourneyError::ExecuteCardinalityViolation,
-        ),
-        (
-            Some("not_started"),
-            None,
-            None,
-            LiveJourneyError::ExecuteClosedBeforeSourceDispatch,
-        ),
-        (
-            Some("outcome_unknown"),
-            None,
-            None,
-            LiveJourneyError::ExecuteClosedAfterSourceDispatch,
-        ),
-        (
-            Some("known_complete"),
-            Some("known_failure"),
-            Some("unexpected"),
-            LiveJourneyError::ExecuteUnavailable,
-        ),
-    ] {
-        assert_eq!(
-            classify_durable_execute_failure(outcome, class, failure),
-            expected
-        );
-    }
-}
-
-async fn run_live_consultation_lifecycle(profile: JourneyProfile) -> Result<(), LiveJourneyError> {
-    let (source_principal, source_secret, source_base_url) = match profile.source_environment() {
-        Some([source_principal_env, source_secret_env]) => {
-            for name in [source_principal_env, source_secret_env] {
-                require_nonempty_environment(name)?;
-            }
-            let source_base_url = required_secret_environment(match profile {
-                JourneyProfile::Dhis2 => DHIS2_BASE_URL_ENV,
-                JourneyProfile::Dhis2Script => {
-                    unreachable!("Rhai source is owned by its governed runner")
-                }
-                JourneyProfile::OpenCrvs => OPENCRVS_BASE_URL_ENV,
-                JourneyProfile::SyntheticSnapshot => unreachable!("synthetic source is local"),
-            })?;
-            (
-                required_secret_environment(source_principal_env)?,
-                required_secret_environment(source_secret_env)?,
-                source_base_url,
-            )
-        }
-        None => (
-            Zeroizing::new("repository-owned-fixture".to_string()),
-            Zeroizing::new("no-source-credential".to_string()),
-            Zeroizing::new("local-snapshot-materialization".to_string()),
-        ),
-    };
-    let admin_database_url = required_secret_environment(ADMIN_DATABASE_URL_ENV)?;
-    let postgres_ca_path = required_path_environment(POSTGRES_CA_PATH_ENV)?;
-
-    let jwks = LiveJwksServer::start().await?;
-    let mut environment = ScopedEnvironment::default();
-    let audit_secret = random_secret();
-    let pseudonym_secret = random_secret();
-    let notary_audit_secret = random_secret();
-    let notary_api_key = random_secret();
-    let notary_api_key_hash = sha256_uri(notary_api_key.as_bytes());
-    environment.set(AUDIT_SECRET_ENV, audit_secret.as_str());
-    environment.set(PSEUDONYM_SECRET_ENV, pseudonym_secret.as_str());
-    environment.set(NOTARY_AUDIT_SECRET_ENV, notary_audit_secret.as_str());
-    environment.set(profile.notary_api_key_hash_env(), &notary_api_key_hash);
-
-    let (mut database, database_urls) =
-        LiveDatabase::provision(admin_database_url.as_str(), postgres_ca_path.as_path()).await?;
-    environment.set(RUNTIME_DATABASE_URL_ENV, database_urls.runtime.as_str());
-    environment.set(
-        MAINTENANCE_DATABASE_URL_ENV,
-        database_urls.maintenance.as_str(),
-    );
-    environment.set(READER_DATABASE_URL_ENV, database_urls.reader.as_str());
-
-    let execution = async {
-        let staged = StagedProfile::new(
-            profile,
-            source_base_url.as_str(),
-            postgres_ca_path.as_path(),
-            jwks.jwks_url(),
-        )?;
-        let mut loaded = config::load_with_metadata(&staged.config_path)
-            .map_err(|_| LiveJourneyError::ConfigLoad)?;
-        let now = current_unix_ms()?;
-        let active_write_deadline_unix_ms = now + 30 * 60 * 1_000;
-        let first_bootstrap = bootstrap_live_state(
-            &loaded.runtime,
-            database.owner_role(),
-            active_write_deadline_unix_ms,
-        )
-        .await?;
-        if first_bootstrap.state_plane != BootstrapStatePlaneStatus::InstalledOrAttested
-            || first_bootstrap.keyring != BootstrapKeyringStatus::Initialized
-        {
-            return Err(LiveJourneyError::PseudonymInitialization);
-        }
-        let identical_bootstrap = bootstrap_live_state(
-            &loaded.runtime,
-            database.owner_role(),
-            active_write_deadline_unix_ms,
-        )
-        .await?;
-        if identical_bootstrap.state_plane != BootstrapStatePlaneStatus::InstalledOrAttested
-            || identical_bootstrap.keyring != BootstrapKeyringStatus::Identical
-        {
-            return Err(LiveJourneyError::PseudonymInitialization);
-        }
-        let artifacts = loaded
-            .consultation_artifacts
-            .take()
-            .ok_or(LiveJourneyError::ConfigLoad)?;
-        let config = Arc::new(loaded.runtime);
-
-        let auth = registry_relay::auth::runtime::build_auth(config.as_ref())
-            .await
-            .map_err(|_| LiveJourneyError::AuthActivation)?;
-        let chain_profile = AuditChainProfile::registry_relay_from_env(AUDIT_SECRET_ENV)
-            .map_err(|_| LiveJourneyError::AuditActivation)?;
-        let datafusion = Arc::new(datafusion::execution::context::SessionContext::new());
-        let service = ConsultationService::activate(
-            config.as_ref(),
-            artifacts,
-            chain_profile.hasher(),
-            Arc::clone(&datafusion),
-        )
-        .await
-        .map_err(|_| LiveJourneyError::ConsultationActivation)?;
-        let ingest = Arc::new(
-            IngestRegistry::from_config(
-                config.as_ref(),
-                Arc::new(FormatRegistry::with_v1_defaults()),
-                Arc::from(config.server.cache_dir.as_path()),
-                datafusion,
-            )
-            .map_err(|_| LiveJourneyError::SnapshotIngest)?,
-        );
-        service
-            .bind_ingest_registry(ingest.as_ref())
-            .map_err(|_| LiveJourneyError::SnapshotIngest)?;
-        let (ingest_tx, _ingest_rx) = watch::channel(ingest.snapshot());
-        ingest.run_initial_ingest(ingest_tx).await;
-        if profile == JourneyProfile::SyntheticSnapshot && !ingest.snapshot().fully_ready() {
-            return Err(LiveJourneyError::SnapshotIngest);
-        }
-        if profile == JourneyProfile::SyntheticSnapshot {
-            let initial_snapshot = ingest.snapshot();
-            let initial_generation = initial_snapshot
-                .ready
-                .values()
-                .next()
-                .filter(|_| initial_snapshot.ready.len() == 1)
-                .map(|ready| ready.ingest_ulid)
-                .ok_or(LiveJourneyError::SnapshotIngest)?;
-
-            // Model a replacement Relay process: retain the PostgreSQL state
-            // plane and governed source, but start a fresh ingest registry
-            // after removing every local immutable cache generation.
-            tokio::fs::remove_dir_all(config.server.cache_dir.as_path())
-                .await
-                .map_err(|_| LiveJourneyError::SnapshotIngest)?;
-            let recovered_ingest = Arc::new(
-                IngestRegistry::from_config(
-                    config.as_ref(),
-                    Arc::new(FormatRegistry::with_v1_defaults()),
-                    Arc::from(config.server.cache_dir.as_path()),
-                    Arc::new(datafusion::execution::context::SessionContext::new()),
-                )
-                .map_err(|_| LiveJourneyError::SnapshotIngest)?,
-            );
-            service
-                .bind_ingest_registry(recovered_ingest.as_ref())
-                .map_err(|_| LiveJourneyError::SnapshotIngest)?;
-            let (recovered_tx, _recovered_rx) = watch::channel(recovered_ingest.snapshot());
-            recovered_ingest.run_initial_ingest(recovered_tx).await;
-            let recovered_snapshot = recovered_ingest.snapshot();
-            let recovered_generation = recovered_snapshot
-                .ready
-                .values()
-                .next()
-                .filter(|_| recovered_snapshot.ready.len() == 1)
-                .map(|ready| ready.ingest_ulid)
-                .ok_or(LiveJourneyError::SnapshotIngest)?;
-            if !recovered_snapshot.fully_ready() || recovered_generation <= initial_generation {
-                return Err(LiveJourneyError::SnapshotIngest);
-            }
-
-            let publication = database
-                .admin
-                .query_one(
-                    r#"
-SELECT
-    (SELECT count(*)
-       FROM relay_state_private.materialization_publication_history) AS publication_count,
-    (SELECT history.generation_id
-       FROM relay_state_private.materialization_active_publication AS active
-       JOIN relay_state_private.materialization_publication_history AS history
-         ON history.binding_id = active.binding_id
-        AND history.publication_sequence = active.publication_sequence) AS active_generation
-"#,
-                    &[],
-                )
-                .await
-                .map_err(|_| LiveJourneyError::SnapshotIngest)?;
-            let publication_count = publication
-                .try_get::<_, i64>("publication_count")
-                .map_err(|_| LiveJourneyError::SnapshotIngest)?;
-            let active_generation = publication
-                .try_get::<_, Option<String>>("active_generation")
-                .map_err(|_| LiveJourneyError::SnapshotIngest)?;
-            let recovered_generation = recovered_generation.to_string();
-            if publication_count != 2
-                || active_generation.as_deref() != Some(recovered_generation.as_str())
-            {
-                return Err(LiveJourneyError::SnapshotIngest);
-            }
-        }
-        let service_execution = async {
-            if service.readiness().await != ConsultationServiceReadiness::Ready {
-                return Err(LiveJourneyError::ConsultationNotReady);
-            }
-
-            let audit = Arc::new(AuditPipeline::new_with_chain_profile(
-                Arc::new(InMemorySink::new()),
-                chain_profile,
-            ));
-            let app = server::build_app(Arc::clone(&config), auth, audit)
-                .map_err(|_| LiveJourneyError::RouterAssembly)?
-                .layer(Extension(Arc::clone(&service)));
-            let bearer = jwks.mint_bearer(profile)?;
-            let relay_token_file = staged.stage_relay_token(bearer.as_str())?;
-            let notary_audit_path = staged.notary_audit_path();
-            let relay = LiveRelayServer::start(app).await?;
-            let notary_config = staged.load_notary_config(
-                profile,
-                relay.base_url(),
-                &relay_token_file,
-                &notary_audit_path,
-            )?;
-            let notary_runtime = compile_notary_runtime(notary_config)
-                .map_err(|_| LiveJourneyError::NotaryActivation)?
-                .activate()
-                .await
-                .map_err(|_| LiveJourneyError::NotaryActivation)?;
-            let notary_app = notary_shared_router_from_runtime(notary_runtime)
-                .map_err(|_| LiveJourneyError::NotaryActivation)?;
-            assert_notary_relay_ready(notary_app.clone()).await?;
-
-            let journey = execute_notary_journey(
-                profile,
-                notary_app,
-                &JourneySensitiveValues {
-                    source_base_url: source_base_url.as_str(),
-                    notary_api_key: notary_api_key.as_str(),
-                    relay_bearer: bearer.as_str(),
-                    source_principal: source_principal.as_str(),
-                    source_secret: source_secret.as_str(),
-                },
-                &notary_audit_path,
-            )
-            .await;
-            let closed_diagnostic = if journey.is_err() {
-                match database.classify_safe_execute_failure().await {
-                    LiveJourneyError::ExecuteMissingDurableCompletion
-                    | LiveJourneyError::ExecuteUnavailable => None,
-                    diagnostic => Some(diagnostic),
-                }
-            } else {
-                None
-            };
-            drop(relay);
-            Ok((journey, closed_diagnostic))
-        };
-        let service_execution = service_execution.await;
-        let shutdown = service
-            .shutdown()
-            .await
-            .map_err(|_| LiveJourneyError::ConsultationShutdown);
-        drop(service);
-        let (journey, closed_diagnostic) = service_execution?;
-        let durable_evidence = match (&journey, &shutdown) {
-            (Ok(correlation), Ok(())) => {
-                database
-                    .assert_safe_durable_evidence(profile, correlation)
-                    .await
-            }
-            _ => Ok(()),
-        };
-        let journey = closed_diagnostic.map_or(journey, Err);
-        journey?;
-        shutdown?;
-        durable_evidence
-    }
-    .await;
-    let cleanup = database.cleanup().await;
-    drop(jwks);
-
-    execution?;
-    cleanup
-}
-
-#[cfg(target_os = "linux")]
-async fn run_live_rhai_consultation_lifecycle() -> Result<(), LiveJourneyError> {
-    let profile = JourneyProfile::Dhis2Script;
-    let admin_database_url = required_secret_environment(ADMIN_DATABASE_URL_ENV)?;
-    let postgres_ca_path = required_path_environment(POSTGRES_CA_PATH_ENV)?;
-    let relay_binary = required_path_environment(RHAI_RELAY_BINARY_ENV)?;
-    let registryctl_binary = required_path_environment(RHAI_REGISTRYCTL_BINARY_ENV)?;
-    let source_username = random_secret();
-    let source_password = random_secret();
-    let source =
-        RhaiSourceFixture::start(source_username.as_str(), source_password.as_str()).await?;
-    let jwks = LiveJwksServer::start().await?;
-
-    let mut environment = ScopedEnvironment::default();
-    let audit_secret = random_secret();
-    let pseudonym_secret = random_secret();
-    let notary_audit_secret = random_secret();
-    let notary_api_key = random_secret();
-    let notary_api_key_hash = sha256_uri(notary_api_key.as_bytes());
-    let issuer_jwk = live_issuer_jwk()?;
-    environment.set(AUDIT_SECRET_ENV, audit_secret.as_str());
-    environment.set(PSEUDONYM_SECRET_ENV, pseudonym_secret.as_str());
-    environment.set(NOTARY_AUDIT_SECRET_ENV, notary_audit_secret.as_str());
-    environment.set(profile.notary_api_key_hash_env(), &notary_api_key_hash);
-    environment.set(RHAI_SOURCE_USERNAME_ENV, source_username.as_str());
-    environment.set(RHAI_SOURCE_PASSWORD_ENV, source_password.as_str());
-    environment.set(RHAI_ISSUER_JWK_ENV, issuer_jwk.as_str());
-
-    let (mut database, database_urls) =
-        LiveDatabase::provision(admin_database_url.as_str(), postgres_ca_path.as_path()).await?;
-    environment.set(RUNTIME_DATABASE_URL_ENV, database_urls.runtime.as_str());
-    environment.set(
-        MAINTENANCE_DATABASE_URL_ENV,
-        database_urls.maintenance.as_str(),
-    );
-    environment.set(READER_DATABASE_URL_ENV, database_urls.reader.as_str());
-
-    let execution = async {
-        let staged = GeneratedRhaiProfile::build(
-            &registryctl_binary,
-            source.base_url(),
-            source.allowed_private_cidr(),
-            postgres_ca_path.as_path(),
-            jwks.jwks_url(),
-        )
-        .await?;
-        let loaded = config::load_with_metadata(&staged.relay_config)
-            .map_err(|_| LiveJourneyError::ConfigLoad)?;
-        let now = current_unix_ms()?;
-        let active_write_deadline_unix_ms = now + 30 * 60 * 1_000;
-        let first_bootstrap = bootstrap_live_state(
-            &loaded.runtime,
-            database.owner_role(),
-            active_write_deadline_unix_ms,
-        )
-        .await?;
-        if first_bootstrap.state_plane != BootstrapStatePlaneStatus::InstalledOrAttested
-            || first_bootstrap.keyring != BootstrapKeyringStatus::Initialized
-        {
-            return Err(LiveJourneyError::PseudonymInitialization);
-        }
-
-        let bearer = jwks.mint_bearer(profile)?;
-        let relay_token_file = staged.stage_relay_token(bearer.as_str())?;
-        let notary_audit_path = staged.notary_audit_path();
-        let bind = reserve_loopback_address().await?;
-        let mut relay = LiveRelayProcess::start(&relay_binary, &staged.relay_config, bind).await?;
-        relay.wait_ready().await?;
-        let notary_config =
-            staged.load_notary_config(relay.base_url(), &relay_token_file, &notary_audit_path)?;
-        let notary_runtime = compile_notary_runtime(notary_config)
-            .map_err(|_| LiveJourneyError::NotaryActivation)?
-            .activate()
-            .await
-            .map_err(|_| LiveJourneyError::NotaryActivation)?;
-        let notary_app = notary_shared_router_from_runtime(notary_runtime)
-            .map_err(|_| LiveJourneyError::NotaryActivation)?;
-        assert_notary_relay_ready(notary_app.clone()).await?;
-
-        let journey = execute_notary_journey(
-            profile,
-            notary_app,
-            &JourneySensitiveValues {
-                source_base_url: source.base_url(),
-                notary_api_key: notary_api_key.as_str(),
-                relay_bearer: bearer.as_str(),
-                source_principal: source_username.as_str(),
-                source_secret: source_password.as_str(),
-            },
-            &notary_audit_path,
-        )
-        .await;
-        let closed_diagnostic = if journey.is_err() {
-            match database.classify_safe_execute_failure().await {
-                LiveJourneyError::ExecuteMissingDurableCompletion
-                | LiveJourneyError::ExecuteUnavailable => None,
-                diagnostic => Some(diagnostic),
-            }
-        } else {
-            None
-        };
-        let journey = closed_diagnostic.map_or(journey, Err)?;
-        database
-            .assert_safe_durable_evidence(profile, &journey)
-            .await?;
-        source.assert_complete().await?;
-        relay.shutdown().await
-    }
-    .await;
-    let cleanup = database.cleanup().await;
-    drop(jwks);
-
-    execution?;
-    cleanup
-}
-
-#[cfg(target_os = "linux")]
-fn live_issuer_jwk() -> Result<Zeroizing<String>, LiveJourneyError> {
-    let signing = SigningKey::generate(&mut OsRng);
-    let verifying = signing.verifying_key();
-    serde_json::to_string(&json!({
-        "kty": "OKP",
-        "crv": "Ed25519",
-        "alg": "EdDSA",
-        "kid": "project-issuer-key",
-        "d": URL_SAFE_NO_PAD.encode(signing.to_bytes()),
-        "x": URL_SAFE_NO_PAD.encode(verifying.as_bytes()),
-    }))
-    .map(Zeroizing::new)
-    .map_err(|_| LiveJourneyError::NotaryActivation)
-}
-
-#[cfg(target_os = "linux")]
-async fn reserve_loopback_address() -> Result<std::net::SocketAddr, LiveJourneyError> {
-    let listener = TcpListener::bind("127.0.0.1:0")
-        .await
-        .map_err(|_| LiveJourneyError::RelayListener)?;
-    let address = listener
-        .local_addr()
-        .map_err(|_| LiveJourneyError::RelayListener)?;
-    drop(listener);
-    Ok(address)
-}
-
-async fn assert_notary_relay_ready(app: Router) -> Result<(), LiveJourneyError> {
-    let request = Request::builder()
-        .method(Method::GET)
-        .uri("/ready")
-        .body(Body::empty())
-        .map_err(|_| LiveJourneyError::NotaryReadiness)?;
-    let response = app
-        .oneshot(request)
-        .await
-        .map_err(|_| LiveJourneyError::NotaryReadiness)?;
-    if response.status() != StatusCode::OK && response.status() != StatusCode::SERVICE_UNAVAILABLE {
-        return Err(LiveJourneyError::NotaryReadiness);
-    }
-    let body = to_bytes(response.into_body(), 16 * 1024)
-        .await
-        .map_err(|_| LiveJourneyError::NotaryReadiness)?;
-    let body: Value =
-        serde_json::from_slice(&body).map_err(|_| LiveJourneyError::NotaryReadiness)?;
-    let overall_usable = body.get("status").and_then(Value::as_str) == Some("ready")
-        || body.get("readiness_status").and_then(Value::as_str) == Some("degraded");
-    if !overall_usable
-        || body.pointer("/checks/failed").and_then(Value::as_u64) != Some(0)
-        || body.pointer("/checks/relay/total").and_then(Value::as_u64) != Some(1)
-        || body.pointer("/checks/relay/ok").and_then(Value::as_u64) != Some(1)
-        || body.pointer("/checks/relay/failed").and_then(Value::as_u64) != Some(0)
-    {
-        return Err(LiveJourneyError::NotaryReadiness);
-    }
-    Ok(())
-}
-
-async fn bootstrap_live_state(
-    config: &config::Config,
-    owner_role: &str,
-    active_write_deadline_unix_ms: i64,
-) -> Result<registry_relay::consultation::operator::BootstrapStateResult, LiveJourneyError> {
-    bootstrap_state(BootstrapStateRequest {
-        config,
-        migration_database_url_env: ADMIN_DATABASE_URL_ENV,
-        owner_role,
-        keyring_maintenance_database_url_env: MAINTENANCE_DATABASE_URL_ENV,
-        keyring_reader_database_url_env: READER_DATABASE_URL_ENV,
-        active_key_id: PSEUDONYM_KEY_ID,
-        active_write_deadline_unix_ms,
-        audit_event_retention_ms: 24 * 60 * 60 * 1_000,
-    })
-    .await
-    .map_err(|_| LiveJourneyError::StatePlaneInstall)
-}
-
-struct JourneyCorrelation {
-    evaluation_id: String,
-    consultation_id: String,
-    selector: Zeroizing<String>,
-    source_base_url: Zeroizing<String>,
-    notary_api_key: Zeroizing<String>,
-    relay_bearer: Zeroizing<String>,
-    source_principal: Zeroizing<String>,
-    source_secret: Zeroizing<String>,
-}
-
-struct JourneySensitiveValues<'a> {
-    source_base_url: &'a str,
-    notary_api_key: &'a str,
-    relay_bearer: &'a str,
-    source_principal: &'a str,
-    source_secret: &'a str,
-}
-
-async fn execute_notary_journey(
-    profile: JourneyProfile,
-    app: Router,
-    sensitive: &JourneySensitiveValues<'_>,
-    audit_path: &Path,
-) -> Result<JourneyCorrelation, LiveJourneyError> {
-    let selector = profile.selector();
-    let api_key_header = HeaderValue::from_str(sensitive.notary_api_key)
-        .map_err(|_| LiveJourneyError::NotaryRequest)?;
-    let request = Request::builder()
-        .method(Method::POST)
-        .uri("/v1/evaluations")
-        .header("x-api-key", api_key_header)
-        .header(header::CONTENT_TYPE, "application/json")
-        .header("data-purpose", profile.purpose())
-        .body(Body::from(
-            serde_json::to_vec(&json!({
-                "target": match profile {
-                    JourneyProfile::Dhis2Script => json!({
-                        "type": "person",
-                        "identifiers": [{
-                            "scheme": "dhis2_tracked_entity",
-                            "value": selector.as_str()
-                        }]
-                    }),
-                    _ => json!({"type": "person", "id": selector.as_str()}),
-                },
-                "claims": match profile {
-                    JourneyProfile::Dhis2 => json!([
-                        {"id": "dhis2-enrollment-known", "version": "1"},
-                        {"id": "dhis2-enrollment-status", "version": "1"}
-                    ]),
-                    JourneyProfile::Dhis2Script => json!([
-                        {"id": "tracked-entity-first-name", "version": "1"},
-                        {"id": "programme-code", "version": "1"}
-                    ]),
-                    JourneyProfile::OpenCrvs => json!([
-                        {"id": "opencrvs-birth-record-exists", "version": "1"}
-                    ]),
-                    JourneyProfile::SyntheticSnapshot => json!([
-                        {"id": "synthetic-person-known", "version": "1"},
-                        {"id": "synthetic-person-status", "version": "1"}
-                    ]),
-                },
-                "disclosure": "value",
-                "purpose": profile.purpose(),
-                "variables": match profile {
-                    JourneyProfile::Dhis2Script => json!({"as_of_date": "2026-01-01"}),
-                    _ => json!({}),
-                }
-            }))
-            .map_err(|_| LiveJourneyError::NotaryRequest)?,
-        ))
-        .map_err(|_| LiveJourneyError::NotaryRequest)?;
-    let response = app
-        .oneshot(request)
-        .await
-        .map_err(|_| LiveJourneyError::NotaryRequest)?;
-    if response.status() != StatusCode::OK {
-        return Err(LiveJourneyError::NotaryRequest);
-    }
-    let body = to_bytes(response.into_body(), 128 * 1024)
-        .await
-        .map_err(|_| LiveJourneyError::NotaryResponse)?;
-    let response: Value =
-        serde_json::from_slice(&body).map_err(|_| LiveJourneyError::NotaryResponse)?;
-    let evaluation_id =
-        validate_minimized_notary_response(profile, &response, selector.as_str(), sensitive)?;
-    validate_notary_audit(audit_path, &evaluation_id, selector.as_str(), sensitive)
-}
-
-fn validate_minimized_notary_response(
-    profile: JourneyProfile,
-    response: &Value,
-    selector: &str,
-    sensitive: &JourneySensitiveValues<'_>,
-) -> Result<String, LiveJourneyError> {
-    let expected_result_count = match profile {
-        JourneyProfile::Dhis2 => 2,
-        JourneyProfile::Dhis2Script => 2,
-        JourneyProfile::OpenCrvs => 1,
-        JourneyProfile::SyntheticSnapshot => 2,
-    };
-    let results = response
-        .get("results")
-        .and_then(Value::as_array)
-        .filter(|results| results.len() == expected_result_count)
-        .ok_or(LiveJourneyError::NotaryResponse)?;
-    let evaluation_id = results[0]
-        .get("evaluation_id")
-        .and_then(Value::as_str)
-        .filter(|value| value.parse::<Ulid>().is_ok())
-        .ok_or(LiveJourneyError::NotaryResponse)?;
-    if results.iter().any(|result| {
-        result.get("evaluation_id").and_then(Value::as_str) != Some(evaluation_id)
-            || result
-                .pointer("/provenance/used/relay_consultation_count")
-                .and_then(Value::as_u64)
-                != Some(1)
-    }) {
-        return Err(LiveJourneyError::NotaryResponse);
-    }
-    match profile {
-        JourneyProfile::Dhis2 => {
-            let known = results
-                .iter()
-                .find(|result| {
-                    result.get("claim_id").and_then(Value::as_str) == Some("dhis2-enrollment-known")
-                })
-                .ok_or(LiveJourneyError::NotaryResponse)?;
-            if known.get("value") != Some(&Value::Bool(true)) {
-                return Err(LiveJourneyError::NotaryResponse);
-            }
-            let status = results
-                .iter()
-                .find(|result| {
-                    result.get("claim_id").and_then(Value::as_str)
-                        == Some("dhis2-enrollment-status")
-                })
-                .and_then(|result| result.get("value"))
-                .and_then(Value::as_str)
-                .ok_or(LiveJourneyError::NotaryResponse)?;
-            if status.is_empty() || status.len() > 32 || status.chars().any(char::is_control) {
-                return Err(LiveJourneyError::NotaryResponse);
-            }
-        }
-        JourneyProfile::Dhis2Script => {
-            for (claim, expected) in [
-                ("tracked-entity-first-name", json!("Nia")),
-                ("programme-code", json!("CHILD")),
-            ] {
-                let actual = results
-                    .iter()
-                    .find(|result| result.get("claim_id").and_then(Value::as_str) == Some(claim))
-                    .and_then(|result| result.get("value"))
-                    .ok_or(LiveJourneyError::NotaryResponse)?;
-                if actual != &expected {
-                    return Err(LiveJourneyError::NotaryResponse);
-                }
-            }
-        }
-        JourneyProfile::OpenCrvs => {
-            let [result] = results.as_slice() else {
-                return Err(LiveJourneyError::NotaryResponse);
-            };
-            if result.get("claim_id").and_then(Value::as_str)
-                != Some("opencrvs-birth-record-exists")
-                || result.get("value") != Some(&Value::Bool(false))
-            {
-                return Err(LiveJourneyError::NotaryResponse);
-            }
-        }
-        JourneyProfile::SyntheticSnapshot => {
-            let known = results
-                .iter()
-                .find(|result| {
-                    result.get("claim_id").and_then(Value::as_str) == Some("synthetic-person-known")
-                })
-                .ok_or(LiveJourneyError::NotaryResponse)?;
-            if known.get("value") != Some(&Value::Bool(true)) {
-                return Err(LiveJourneyError::NotaryResponse);
-            }
-            let status = results
-                .iter()
-                .find(|result| {
-                    result.get("claim_id").and_then(Value::as_str)
-                        == Some("synthetic-person-status")
-                })
-                .and_then(|result| result.get("value"))
-                .and_then(Value::as_str);
-            if status != Some("ACTIVE") {
-                return Err(LiveJourneyError::NotaryResponse);
-            }
-        }
-    }
-    let public_wire =
-        serde_json::to_string(response).map_err(|_| LiveJourneyError::NotaryResponse)?;
-    if [
-        "consultation_id",
-        "\"relay_consultation\":",
-        selector,
-        sensitive.source_base_url,
-        sensitive.notary_api_key,
-        sensitive.relay_bearer,
-        sensitive.source_principal,
-        sensitive.source_secret,
-    ]
-    .into_iter()
-    .any(|sensitive| public_wire.contains(sensitive))
-    {
-        return Err(LiveJourneyError::NotaryResponse);
-    }
-    Ok(evaluation_id.to_string())
-}
-
-fn validate_notary_audit(
-    path: &Path,
-    expected_evaluation_id: &str,
-    selector: &str,
-    sensitive: &JourneySensitiveValues<'_>,
-) -> Result<JourneyCorrelation, LiveJourneyError> {
-    let file = fs::read_to_string(path).map_err(|_| LiveJourneyError::NotaryAudit)?;
-    if [
-        selector,
-        sensitive.source_base_url,
-        sensitive.notary_api_key,
-        sensitive.relay_bearer,
-        sensitive.source_principal,
-        sensitive.source_secret,
-    ]
-    .into_iter()
-    .any(|sensitive| file.contains(sensitive))
-    {
-        return Err(LiveJourneyError::NotaryAudit);
-    }
-    let mut matching = Vec::new();
-    for line in file.lines() {
-        let envelope: Value =
-            serde_json::from_str(line).map_err(|_| LiveJourneyError::NotaryAudit)?;
-        let record = envelope
-            .get("record")
-            .and_then(Value::as_object)
-            .ok_or(LiveJourneyError::NotaryAudit)?;
-        if record.get("path").and_then(Value::as_str) == Some("/v1/evaluations")
-            && record.get("status").and_then(Value::as_u64) == Some(200)
-        {
-            matching.push(record.clone());
-        }
-    }
-    let [record] = matching.as_slice() else {
-        return Err(LiveJourneyError::NotaryAudit);
-    };
-    if record.get("verification_id").and_then(Value::as_str) != Some(expected_evaluation_id)
-        || record
-            .get("relay_consultation_count")
-            .and_then(Value::as_u64)
-            != Some(1)
-        || record.get("forwarded").and_then(Value::as_bool) != Some(true)
-    {
-        return Err(LiveJourneyError::NotaryAudit);
-    };
-    let consultation_ids = record
-        .get("relay_consultation_ids")
-        .and_then(Value::as_array)
-        .filter(|values| values.len() == 1)
-        .ok_or(LiveJourneyError::NotaryAudit)?;
-    let consultation_id = consultation_ids[0]
-        .as_str()
-        .filter(|value| value.parse::<Ulid>().is_ok())
-        .ok_or(LiveJourneyError::NotaryAudit)?;
-    Ok(JourneyCorrelation {
-        evaluation_id: expected_evaluation_id.to_string(),
-        consultation_id: consultation_id.to_string(),
-        selector: Zeroizing::new(selector.to_string()),
-        source_base_url: Zeroizing::new(sensitive.source_base_url.to_string()),
-        notary_api_key: Zeroizing::new(sensitive.notary_api_key.to_string()),
-        relay_bearer: Zeroizing::new(sensitive.relay_bearer.to_string()),
-        source_principal: Zeroizing::new(sensitive.source_principal.to_string()),
-        source_secret: Zeroizing::new(sensitive.source_secret.to_string()),
-    })
-}
-
-struct LiveRelayServer {
-    base_url: String,
-    task: JoinHandle<()>,
-}
-
-impl LiveRelayServer {
-    async fn start(app: Router) -> Result<Self, LiveJourneyError> {
-        let listener = TcpListener::bind("127.0.0.1:0")
-            .await
-            .map_err(|_| LiveJourneyError::RelayListener)?;
-        let address = listener
-            .local_addr()
-            .map_err(|_| LiveJourneyError::RelayListener)?;
-        let task = tokio::spawn(async move {
-            let _ = axum::serve(listener, app).await;
-        });
-        Ok(Self {
-            base_url: format!("http://{address}"),
-            task,
-        })
-    }
-
-    fn base_url(&self) -> &str {
-        &self.base_url
-    }
-}
-
-impl Drop for LiveRelayServer {
-    fn drop(&mut self) {
-        self.task.abort();
-    }
-}
-
-#[cfg(target_os = "linux")]
-struct LiveRelayProcess {
-    base_url: String,
-    child: Child,
-}
-
-#[cfg(target_os = "linux")]
-impl LiveRelayProcess {
-    async fn start(
-        binary: &Path,
-        config: &Path,
-        bind: std::net::SocketAddr,
-    ) -> Result<Self, LiveJourneyError> {
-        let child = Command::new(binary)
-            .arg("--config")
-            .arg(config)
-            .arg("--bind")
-            .arg(bind.to_string())
-            .stdin(Stdio::null())
-            .stdout(Stdio::null())
-            .stderr(Stdio::null())
-            .kill_on_drop(true)
-            .spawn()
-            .map_err(|_| LiveJourneyError::RelayProcess)?;
-        Ok(Self {
-            base_url: format!("http://{bind}"),
-            child,
-        })
-    }
-
-    fn base_url(&self) -> &str {
-        &self.base_url
-    }
-
-    async fn wait_ready(&mut self) -> Result<(), LiveJourneyError> {
-        let deadline = Instant::now() + Duration::from_secs(30);
-        let client = reqwest::Client::builder()
-            .no_proxy()
-            .build()
-            .map_err(|_| LiveJourneyError::RelayProcess)?;
-        loop {
-            if self
-                .child
-                .try_wait()
-                .map_err(|_| LiveJourneyError::RelayProcess)?
-                .is_some()
-            {
-                return Err(LiveJourneyError::RelayProcess);
-            }
-            if let Ok(response) = client.get(format!("{}/ready", self.base_url)).send().await {
-                if response.status().is_success() {
-                    return Ok(());
-                }
-            }
-            if Instant::now() >= deadline {
-                return Err(LiveJourneyError::ConsultationNotReady);
-            }
-            sleep(Duration::from_millis(100)).await;
-        }
-    }
-
-    async fn shutdown(&mut self) -> Result<(), LiveJourneyError> {
-        self.child
-            .kill()
-            .await
-            .map_err(|_| LiveJourneyError::ConsultationShutdown)?;
-        self.child
-            .wait()
-            .await
-            .map_err(|_| LiveJourneyError::ConsultationShutdown)?;
-        Ok(())
-    }
-}
-
-#[cfg(target_os = "linux")]
-struct RhaiSourceFixture {
-    base_url: String,
-    allowed_private_cidr: String,
-    state: Arc<RhaiSourceState>,
-    task: JoinHandle<()>,
-}
-
-#[cfg(target_os = "linux")]
-struct RhaiSourceState {
-    expected_authorization_hash: [u8; 32],
-    calls: StdMutex<BTreeMap<&'static str, usize>>,
-    authorization_failed: AtomicBool,
-    shutdown: AtomicBool,
-}
-
-#[cfg(target_os = "linux")]
-impl RhaiSourceFixture {
-    async fn start(username: &str, password: &str) -> Result<Self, LiveJourneyError> {
-        let encoded =
-            base64::engine::general_purpose::STANDARD.encode(format!("{username}:{password}"));
-        let expected_authorization_hash =
-            Sha256::digest(format!("Basic {encoded}").as_bytes()).into();
-        let certificate = fs::read(required_path_environment(RHAI_SOURCE_CERT_PATH_ENV)?)
-            .map_err(|_| LiveJourneyError::SourceFixture)?;
-        let private_key = fs::read(required_path_environment(RHAI_SOURCE_KEY_PATH_ENV)?)
-            .map_err(|_| LiveJourneyError::SourceFixture)?;
-        let identity = native_tls::Identity::from_pkcs8(&certificate, &private_key)
-            .map_err(|_| LiveJourneyError::SourceFixture)?;
-        let acceptor =
-            native_tls::TlsAcceptor::new(identity).map_err(|_| LiveJourneyError::SourceFixture)?;
-        let source_ip = ("rhai-runner", 443)
-            .to_socket_addrs()
-            .map_err(|_| LiveJourneyError::SourceFixture)?
-            .find_map(|address| match address.ip() {
-                std::net::IpAddr::V4(ip) if !ip.is_loopback() => Some(ip),
-                _ => None,
-            })
-            .ok_or(LiveJourneyError::SourceFixture)?;
-        let listener =
-            StdTcpListener::bind("0.0.0.0:0").map_err(|_| LiveJourneyError::SourceFixture)?;
-        listener
-            .set_nonblocking(true)
-            .map_err(|_| LiveJourneyError::SourceFixture)?;
-        let address = listener
-            .local_addr()
-            .map_err(|_| LiveJourneyError::SourceFixture)?;
-        let state = Arc::new(RhaiSourceState {
-            expected_authorization_hash,
-            calls: StdMutex::new(BTreeMap::new()),
-            authorization_failed: AtomicBool::new(false),
-            shutdown: AtomicBool::new(false),
-        });
-        let task_state = Arc::clone(&state);
-        let task = tokio::task::spawn_blocking(move || {
-            while !task_state.shutdown.load(Ordering::SeqCst) {
-                match listener.accept() {
-                    Ok((stream, _)) => {
-                        if let Ok(mut stream) = acceptor.accept(stream) {
-                            serve_rhai_source_request(&task_state, &mut stream);
-                        }
-                    }
-                    Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => {
-                        std::thread::sleep(std::time::Duration::from_millis(10));
-                    }
-                    Err(_) => return,
-                }
-            }
-        });
-        Ok(Self {
-            base_url: format!("https://rhai-runner:{}", address.port()),
-            allowed_private_cidr: format!("{source_ip}/32"),
-            state,
-            task,
-        })
-    }
-
-    fn base_url(&self) -> &str {
-        &self.base_url
-    }
-
-    fn allowed_private_cidr(&self) -> &str {
-        &self.allowed_private_cidr
-    }
-
-    async fn assert_complete(&self) -> Result<(), LiveJourneyError> {
-        if self.state.authorization_failed.load(Ordering::SeqCst) {
-            return Err(LiveJourneyError::SourceFixture);
-        }
-        let calls = self
-            .state
-            .calls
-            .lock()
-            .map_err(|_| LiveJourneyError::SourceFixture)?;
-        let expected = BTreeMap::from([
-            ("identity", 1),
-            ("child_program", 1),
-            ("care", 1),
-            ("tb_program", 1),
-        ]);
-        if *calls != expected {
-            return Err(LiveJourneyError::SourceFixture);
-        }
-        Ok(())
-    }
-}
-
-#[cfg(target_os = "linux")]
-impl Drop for RhaiSourceFixture {
-    fn drop(&mut self) {
-        self.state.shutdown.store(true, Ordering::SeqCst);
-        self.task.abort();
-    }
-}
-
-#[cfg(target_os = "linux")]
-fn serve_rhai_source_request(
-    state: &RhaiSourceState,
-    stream: &mut native_tls::TlsStream<std::net::TcpStream>,
-) {
-    let mut request = [0_u8; 16 * 1024];
-    let Ok(read) = stream.read(&mut request) else {
-        return;
-    };
-    let request = &request[..read];
-    let header_end = request
-        .windows(4)
-        .position(|window| window == b"\r\n\r\n")
-        .unwrap_or(request.len());
-    let head = &request[..header_end];
-    let first_line_end = head
-        .windows(2)
-        .position(|window| window == b"\r\n")
-        .unwrap_or(head.len());
-    let first_line = &head[..first_line_end];
-    let operation = if first_line.starts_with(b"GET /api/tracker/trackedEntities?") {
-        Some("identity")
-    } else if first_line.starts_with(b"GET /api/tracker/enrollments/child-program?") {
-        Some("child_program")
-    } else if first_line.starts_with(b"GET /api/tracker/events/care?") {
-        Some("care")
-    } else if first_line.starts_with(b"GET /api/tracker/enrollments/tb-program?") {
-        Some("tb_program")
-    } else {
-        None
-    };
-    let authorization = head
-        .split(|byte| *byte == b'\n')
-        .map(|line| line.strip_suffix(b"\r").unwrap_or(line))
-        .find_map(|line| line.strip_prefix(b"authorization: "));
-    let observed = authorization.map(Sha256::digest).map(Into::into);
-    if observed != Some(state.expected_authorization_hash) {
-        state.authorization_failed.store(true, Ordering::SeqCst);
-        write_rhai_source_response(stream, 401, b"{}");
-        return;
-    }
-    let Some(operation) = operation else {
-        write_rhai_source_response(stream, 404, b"{}");
-        return;
-    };
-    if let Ok(mut calls) = state.calls.lock() {
-        *calls.entry(operation).or_default() += 1;
-    } else {
-        write_rhai_source_response(stream, 500, b"{}");
-        return;
-    }
-    let body: &[u8] = match operation {
-        "identity" => br#"{"trackedEntities":[{"first_name":"Nia","last_name":"Example","date_of_birth":"2017-06-15"}]}"#,
-        "child_program" => br#"{"enrollments":[{"active":true,"programme_code":"CHILD","reconciliation_reference":"REF-0001"}]}"#,
-        "care" => br#"{"maternal_postnatal_active":true,"child_health_visit_recorded":true}"#,
-        "tb_program" => br#"{"enrollments":[{"active":false}]}"#,
-        _ => b"{}",
-    };
-    write_rhai_source_response(stream, 200, body);
-}
-
-#[cfg(target_os = "linux")]
-fn write_rhai_source_response(
-    stream: &mut native_tls::TlsStream<std::net::TcpStream>,
-    status: u16,
-    body: &[u8],
-) {
-    let reason = if status == 200 { "OK" } else { "Error" };
-    let head = format!(
-        "HTTP/1.1 {status} {reason}\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
-        body.len()
-    );
-    let _ = stream.write_all(head.as_bytes());
-    let _ = stream.write_all(body);
-    let _ = stream.flush();
-}
-
-struct LiveJwksServer {
-    signing: SigningKey,
-    jwks_url: String,
-    task: JoinHandle<()>,
-}
-
-impl LiveJwksServer {
-    async fn start() -> Result<Self, LiveJourneyError> {
-        let signing = SigningKey::generate(&mut OsRng);
-        let verifying = signing.verifying_key();
-        let jwks = json!({
-            "keys": [{
-                "kty": "OKP",
-                "crv": "Ed25519",
-                "use": "sig",
-                "alg": "EdDSA",
-                "kid": JWT_KID,
-                "x": URL_SAFE_NO_PAD.encode(verifying.as_bytes())
-            }]
-        });
-        let listener = TcpListener::bind("127.0.0.1:0")
-            .await
-            .map_err(|_| LiveJourneyError::JwksServer)?;
-        let address = listener
-            .local_addr()
-            .map_err(|_| LiveJourneyError::JwksServer)?;
-        let jwks = serde_json::to_vec(&jwks).map_err(|_| LiveJourneyError::JwksServer)?;
-        let task = tokio::spawn(async move {
-            loop {
-                let Ok((mut socket, _)) = listener.accept().await else {
-                    return;
-                };
-                let mut request = [0_u8; 4096];
-                let Ok(read) = socket.read(&mut request).await else {
-                    continue;
-                };
-                if read == 0 {
-                    continue;
-                }
-                let response_head = format!(
-                    "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nCache-Control: no-store\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
-                    jwks.len()
-                );
-                if socket.write_all(response_head.as_bytes()).await.is_ok() {
-                    let _ = socket.write_all(&jwks).await;
-                }
-            }
-        });
-        Ok(Self {
-            signing,
-            jwks_url: format!("http://{address}/keys"),
-            task,
-        })
-    }
-
-    fn jwks_url(&self) -> &str {
-        &self.jwks_url
-    }
-
-    fn mint_bearer(&self, profile: JourneyProfile) -> Result<Zeroizing<String>, LiveJourneyError> {
-        let now = SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .map_err(|_| LiveJourneyError::TokenMint)?
-            .as_secs();
-        let principal = match profile {
-            JourneyProfile::Dhis2Script => "health-registry-notary",
-            _ => NOTARY_PRINCIPAL,
-        };
-        let audience = match profile {
-            JourneyProfile::Dhis2Script => "registry-relay",
-            _ => AUDIENCE,
-        };
-        let claims = json!({
-            "iss": ISSUER,
-            "aud": audience,
-            "sub": principal,
-            "azp": principal,
-            "iat": now,
-            "exp": now + 300,
-            "scope": profile.required_scope()
-        });
-        let mut header = Header::new(Algorithm::EdDSA);
-        header.kid = Some(JWT_KID.to_string());
-        header.typ = Some("at+jwt".to_string());
-        let private = self
-            .signing
-            .to_pkcs8_der()
-            .map_err(|_| LiveJourneyError::TokenMint)?;
-        let key = EncodingKey::from_ed_der(private.as_bytes());
-        encode(&header, &claims, &key)
-            .map(Zeroizing::new)
-            .map_err(|_| LiveJourneyError::TokenMint)
-    }
-}
-
-impl Drop for LiveJwksServer {
-    fn drop(&mut self) {
-        self.task.abort();
-    }
-}
-
-struct StagedProfile {
-    directory: TempDir,
-    config_path: PathBuf,
-}
-
-impl StagedProfile {
-    fn new(
-        profile: JourneyProfile,
-        source_base_url: &str,
-        postgres_ca_path: &Path,
-        jwks_url: &str,
-    ) -> Result<Self, LiveJourneyError> {
-        let directory = tempfile::tempdir().map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        let source_root = Path::new(env!("CARGO_MANIFEST_DIR")).join(profile.directory());
-        let evidence_directory = directory.path().join("evidence");
-        fs::create_dir(&evidence_directory).map_err(|_| LiveJourneyError::ArtifactStaging)?;
-
-        copy_artifact(
-            &source_root.join(PUBLIC_CONTRACT_FILE),
-            &directory.path().join("public-contract.json"),
-        )?;
-        copy_artifact(
-            &source_root.join(INTEGRATION_PACK_FILE),
-            &directory.path().join("integration-pack.json"),
-        )?;
-        copy_artifact(
-            &source_root.join(CONFORMANCE_FILE),
-            &evidence_directory.join("conformance.json"),
-        )?;
-        copy_artifact(
-            &source_root.join(NEGATIVE_SECURITY_FILE),
-            &evidence_directory.join("negative-security.json"),
-        )?;
-        copy_artifact(
-            &source_root.join(MINIMIZATION_FILE),
-            &evidence_directory.join("minimization.json"),
-        )?;
-
-        if profile == JourneyProfile::SyntheticSnapshot {
-            let fixture_directory = directory.path().join("fixtures");
-            fs::create_dir(&fixture_directory).map_err(|_| LiveJourneyError::ArtifactStaging)?;
-            let fixture_path = fixture_directory.join("people.csv");
-            copy_artifact(&source_root.join("fixtures/people.csv"), &fixture_path)?;
-            let fixture =
-                fs::read_to_string(&fixture_path).map_err(|_| LiveJourneyError::ArtifactStaging)?;
-            const FIXTURE_OBSERVED_AT: &str = "2026-07-11T12:00:00Z";
-            if fixture.matches(FIXTURE_OBSERVED_AT).count() != 4 {
-                return Err(LiveJourneyError::ArtifactStaging);
-            }
-            let observed_at = OffsetDateTime::now_utc()
-                .format(&Rfc3339)
-                .map_err(|_| LiveJourneyError::ArtifactStaging)?;
-            fs::write(
-                &fixture_path,
-                fixture.replace(FIXTURE_OBSERVED_AT, &observed_at),
-            )
-            .map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        }
-
-        let binding = if profile == JourneyProfile::SyntheticSnapshot {
-            let bytes = fs::read(source_root.join("private-binding.example.json"))
-                .map_err(|_| LiveJourneyError::ArtifactStaging)?;
-            serde_json::from_slice(&bytes).map_err(|_| LiveJourneyError::ArtifactStaging)?
-        } else {
-            live_private_binding(profile, source_base_url)?
-        };
-        let binding_bytes =
-            serde_json::to_vec_pretty(&binding).map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        let binding_path = directory.path().join("private-binding.json");
-        fs::write(&binding_path, &binding_bytes).map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        let binding_sha = sha256_uri(&binding_bytes);
-        let binding_typed_hash = compile_private_binding(&binding_bytes)
-            .map_err(|_| LiveJourneyError::ArtifactStaging)?
-            .typed_hash()
-            .to_string();
-
-        // Start from the maintained operator example, then replace only the
-        // deployment-private values needed by this disposable proof. The real
-        // loader below therefore catches drift in the documented baseline,
-        // including every maintained artifact pin.
-        let mut yaml = fs::read_to_string(source_root.join(CONFIG_EXAMPLE_FILE))
-            .map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        if profile == JourneyProfile::SyntheticSnapshot {
-            replace_once(
-                &mut yaml,
-                "          path: ./fixtures/people.csv",
-                &format!(
-                    "          path: {}",
-                    yaml_string(
-                        directory
-                            .path()
-                            .join("fixtures/people.csv")
-                            .to_str()
-                            .ok_or(LiveJourneyError::ArtifactStaging)?
-                    )?
-                ),
-            )?;
-        }
-        replace_once(
-            &mut yaml,
-            r#"    issuer: "https://identity.example.gov""#,
-            &format!("    issuer: {}", yaml_string(ISSUER)?),
-        )?;
-        replace_once(
-            &mut yaml,
-            r#"    jwks_url: "https://identity.example.gov/.well-known/jwks.json""#,
-            &format!(
-                "    jwks_url: {}\n    allow_dev_insecure_fetch_urls: true",
-                yaml_string(jwks_url)?
-            ),
-        )?;
-        replace_once(
-            &mut yaml,
-            "    database_url_env: REGISTRY_RELAY_CONSULTATION_DATABASE_URL",
-            &format!(
-                "    database_url_env: REGISTRY_RELAY_CONSULTATION_DATABASE_URL\n    root_certificate_path: {}",
-                yaml_string(
-                    postgres_ca_path
-                        .to_str()
-                        .ok_or(LiveJourneyError::ArtifactStaging)?
-                )?
-            ),
-        )?;
-        let example_binding_bytes = fs::read(source_root.join("private-binding.example.json"))
-            .map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        let example_binding_typed_hash = compile_private_binding(&example_binding_bytes)
-            .map_err(|_| LiveJourneyError::ArtifactStaging)?
-            .typed_hash()
-            .to_string();
-        replace_once(
-            &mut yaml,
-            "      - path: private-binding.example.json",
-            "      - path: private-binding.json",
-        )?;
-        replace_once(&mut yaml, &example_binding_typed_hash, &binding_typed_hash)?;
-        replace_once(&mut yaml, &sha256_uri(&example_binding_bytes), &binding_sha)?;
-
-        let config_path = directory.path().join("relay.yaml");
-        fs::write(&config_path, yaml).map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        Ok(Self {
-            directory,
-            config_path,
-        })
-    }
-
-    fn stage_relay_token(&self, token: &str) -> Result<PathBuf, LiveJourneyError> {
-        let path = self.directory.path().join("relay-workload.jwt");
-        let mut file = OpenOptions::new()
-            .write(true)
-            .create_new(true)
-            .mode(0o600)
-            .open(&path)
-            .map_err(|_| LiveJourneyError::RelayCredentialStaging)?;
-        file.write_all(token.as_bytes())
-            .and_then(|()| file.sync_all())
-            .map_err(|_| LiveJourneyError::RelayCredentialStaging)?;
-        Ok(path)
-    }
-
-    fn notary_audit_path(&self) -> PathBuf {
-        self.directory.path().join("notary-audit.jsonl")
-    }
-
-    fn load_notary_config(
-        &self,
-        profile: JourneyProfile,
-        relay_base_url: &str,
-        token_file: &Path,
-        audit_path: &Path,
-    ) -> Result<registry_notary_core::StandaloneRegistryNotaryConfig, LiveJourneyError> {
-        let source_root = Path::new(env!("CARGO_MANIFEST_DIR")).join(profile.directory());
-        let mut yaml = fs::read_to_string(source_root.join(NOTARY_CONFIG_EXAMPLE_FILE))
-            .map_err(|_| LiveJourneyError::NotaryConfigLoad)?;
-        replace_once(
-            &mut yaml,
-            r#"    base_url: "https://relay.example.gov""#,
-            &format!(
-                "    base_url: {}\n    allow_insecure_localhost: true",
-                yaml_string(relay_base_url)?
-            ),
-        )?;
-        replace_once(
-            &mut yaml,
-            "    token_file: /var/run/secrets/registry-notary/relay-access-token",
-            &format!(
-                "    token_file: {}",
-                yaml_string(
-                    token_file
-                        .to_str()
-                        .ok_or(LiveJourneyError::NotaryConfigLoad)?
-                )?
-            ),
-        )?;
-        replace_once(
-            &mut yaml,
-            "  sink: stdout",
-            &format!(
-                "  sink: file\n  path: {}",
-                yaml_string(
-                    audit_path
-                        .to_str()
-                        .ok_or(LiveJourneyError::NotaryConfigLoad)?
-                )?
-            ),
-        )?;
-        let config =
-            serde_norway::from_str(&yaml).map_err(|_| LiveJourneyError::NotaryConfigLoad)?;
-        Ok(config)
-    }
-}
-
-#[cfg(target_os = "linux")]
-struct GeneratedRhaiProfile {
-    directory: TempDir,
-    relay_config: PathBuf,
-    notary_config: PathBuf,
-}
-
-#[cfg(target_os = "linux")]
-impl GeneratedRhaiProfile {
-    async fn build(
-        registryctl: &Path,
-        source_base_url: &str,
-        source_private_cidr: &str,
-        postgres_ca_path: &Path,
-        jwks_url: &str,
-    ) -> Result<Self, LiveJourneyError> {
-        let directory = tempfile::tempdir().map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        let source =
-            Path::new(env!("CARGO_MANIFEST_DIR")).join(JourneyProfile::Dhis2Script.directory());
-        let project = directory.path().join("project");
-        copy_tree_closed(&source, &project)?;
-        let status = Command::new(registryctl)
-            .arg("build")
-            .arg("--project-dir")
-            .arg(&project)
-            .arg("--environment")
-            .arg("local")
-            .stdin(Stdio::null())
-            .stdout(Stdio::null())
-            .stderr(Stdio::null())
-            .status()
-            .await
-            .map_err(|_| LiveJourneyError::ProjectBuild)?;
-        if !status.success() {
-            return Err(LiveJourneyError::ProjectBuild);
-        }
-        let build = project.join(".registry-stack/build/local/private");
-        let relay_config = build.join("relay/config/relay.yaml");
-        let notary_config = build.join("notary/config/notary.yaml");
-        let mut relay =
-            fs::read_to_string(&relay_config).map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        let binding_path =
-            build.join("relay/config/artifacts/private-bindings/health-verification-health.json");
-        let original_binding =
-            fs::read(&binding_path).map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        let mut binding: Value = serde_json::from_slice(&original_binding)
-            .map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        let original_typed_hash = typed_private_binding_hash(&binding)?;
-        let original_raw_hash = sha256_uri(&original_binding);
-        binding["data_destination"]["origin"] = json!(source_base_url);
-        binding["data_destination"]["dns_family"] = json!("ipv4_only");
-        binding["data_destination"]["allowed_private_cidrs"] = json!([source_private_cidr]);
-        let mut binding_bytes =
-            canonicalize_json(&binding).map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        binding_bytes.push(b'\n');
-        let compiled_binding = compile_private_binding(&binding_bytes)
-            .map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        let binding_typed_hash = compiled_binding.typed_hash().to_string();
-        let binding_raw_hash = sha256_uri(&binding_bytes);
-        fs::write(&binding_path, &binding_bytes).map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        replace_once(&mut relay, &original_typed_hash, &binding_typed_hash)?;
-        replace_once(&mut relay, &original_raw_hash, &binding_raw_hash)?;
-        replace_once(
-            &mut relay,
-            "    issuer: https://workload-issuer.internal.invalid",
-            &format!("    issuer: {}", yaml_string(ISSUER)?),
-        )?;
-        replace_once(
-            &mut relay,
-            "    jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json",
-            &format!(
-                "    jwks_url: {}\n    allow_dev_insecure_fetch_urls: true",
-                yaml_string(jwks_url)?
-            ),
-        )?;
-        replace_once(
-            &mut relay,
-            "    database_url_env: REGISTRY_RELAY_CONSULTATION_DATABASE_URL",
-            &format!(
-                "    database_url_env: REGISTRY_RELAY_CONSULTATION_DATABASE_URL\n    root_certificate_path: {}",
-                yaml_string(
-                    postgres_ca_path
-                        .to_str()
-                        .ok_or(LiveJourneyError::ArtifactStaging)?
-                )?
-            ),
-        )?;
-        fs::write(&relay_config, relay).map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        Ok(Self {
-            directory,
-            relay_config,
-            notary_config,
-        })
-    }
-
-    fn stage_relay_token(&self, token: &str) -> Result<PathBuf, LiveJourneyError> {
-        let path = self.directory.path().join("relay-workload.jwt");
-        let mut file = OpenOptions::new()
-            .write(true)
-            .create_new(true)
-            .mode(0o600)
-            .open(&path)
-            .map_err(|_| LiveJourneyError::RelayCredentialStaging)?;
-        file.write_all(token.as_bytes())
-            .and_then(|()| file.sync_all())
-            .map_err(|_| LiveJourneyError::RelayCredentialStaging)?;
-        Ok(path)
-    }
-
-    fn notary_audit_path(&self) -> PathBuf {
-        self.directory.path().join("notary-audit.jsonl")
-    }
-
-    fn load_notary_config(
-        &self,
-        relay_base_url: &str,
-        token_file: &Path,
-        audit_path: &Path,
-    ) -> Result<registry_notary_core::StandaloneRegistryNotaryConfig, LiveJourneyError> {
-        let mut yaml = fs::read_to_string(&self.notary_config)
-            .map_err(|_| LiveJourneyError::NotaryConfigLoad)?;
-        replace_once(
-            &mut yaml,
-            "    base_url: https://health-relay.internal.invalid",
-            &format!(
-                "    base_url: {}\n    allow_insecure_localhost: true",
-                yaml_string(relay_base_url)?
-            ),
-        )?;
-        replace_once(
-            &mut yaml,
-            "    token_file: /run/secrets/relay-workload-token",
-            &format!(
-                "    token_file: {}",
-                yaml_string(
-                    token_file
-                        .to_str()
-                        .ok_or(LiveJourneyError::NotaryConfigLoad)?
-                )?
-            ),
-        )?;
-        replace_once(
-            &mut yaml,
-            "  sink: stdout",
-            &format!(
-                "  sink: file\n  path: {}",
-                yaml_string(
-                    audit_path
-                        .to_str()
-                        .ok_or(LiveJourneyError::NotaryConfigLoad)?
-                )?
-            ),
-        )?;
-        serde_norway::from_str(&yaml).map_err(|_| LiveJourneyError::NotaryConfigLoad)
-    }
-}
-
-#[cfg(target_os = "linux")]
-fn copy_tree_closed(source: &Path, destination: &Path) -> Result<(), LiveJourneyError> {
-    if source
-        .symlink_metadata()
-        .map_err(|_| LiveJourneyError::ArtifactStaging)?
-        .file_type()
-        .is_symlink()
-    {
-        return Err(LiveJourneyError::ArtifactStaging);
-    }
-    fs::create_dir(destination).map_err(|_| LiveJourneyError::ArtifactStaging)?;
-    for entry in fs::read_dir(source).map_err(|_| LiveJourneyError::ArtifactStaging)? {
-        let entry = entry.map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        let file_type = entry
-            .file_type()
-            .map_err(|_| LiveJourneyError::ArtifactStaging)?;
-        let target = destination.join(entry.file_name());
-        if file_type.is_symlink() {
-            return Err(LiveJourneyError::ArtifactStaging);
-        }
-        if file_type.is_dir() {
-            copy_tree_closed(&entry.path(), &target)?;
-        } else if file_type.is_file() {
-            copy_artifact(&entry.path(), &target)?;
-        } else {
-            return Err(LiveJourneyError::ArtifactStaging);
-        }
-    }
-    Ok(())
-}
-
-fn live_private_binding(
-    profile: JourneyProfile,
-    source_base_url: &str,
-) -> Result<Value, LiveJourneyError> {
-    let parsed = Url::parse(source_base_url).map_err(|_| LiveJourneyError::InvalidSourceBaseUrl)?;
-    if parsed.scheme() != "https"
-        || parsed.host_str().is_none()
-        || !parsed.username().is_empty()
-        || parsed.password().is_some()
-        || parsed.query().is_some()
-        || parsed.fragment().is_some()
-    {
-        return Err(LiveJourneyError::InvalidSourceBaseUrl);
-    }
-    let base_path = parsed.path().trim_end_matches('/');
-    let application_base_path = (!base_path.is_empty()).then(|| base_path.to_string());
-    let mut origin = parsed;
-    origin.set_path("/");
-    origin.set_query(None);
-    origin.set_fragment(None);
-
-    // The authorized public test endpoint has a usable A path but no reliable
-    // AAAA response. Make that deployment fact explicit and hash-covered;
-    // production bindings otherwise retain the strict dual-stack default.
-    let data_destination_id = match profile {
-        JourneyProfile::Dhis2 => "dhis2-live-data",
-        JourneyProfile::Dhis2Script => return Err(LiveJourneyError::InvalidSourceBaseUrl),
-        JourneyProfile::OpenCrvs => "opencrvs-live-data",
-        JourneyProfile::SyntheticSnapshot => return Err(LiveJourneyError::InvalidSourceBaseUrl),
-    };
-    let mut destination = Map::from_iter([
-        ("id".to_string(), json!(data_destination_id)),
-        ("origin".to_string(), json!(origin.as_str())),
-        ("dns_family".to_string(), json!("ipv4_only")),
-        ("allowed_private_cidrs".to_string(), json!([])),
-    ]);
-    if let Some(path) = application_base_path {
-        destination.insert("application_base_path".to_string(), json!(path));
-    }
-    let credential_destination = match profile {
-        JourneyProfile::Dhis2 => Value::Null,
-        JourneyProfile::Dhis2Script => return Err(LiveJourneyError::InvalidSourceBaseUrl),
-        JourneyProfile::OpenCrvs => {
-            let mut credential = destination.clone();
-            credential.insert("id".to_string(), json!("opencrvs-live-oauth"));
-            Value::Object(credential)
-        }
-        JourneyProfile::SyntheticSnapshot => return Err(LiveJourneyError::InvalidSourceBaseUrl),
-    };
-    let (registry_instance, source_instance, credential_ref, max_source_bytes, timeout_ms) =
-        match profile {
-            JourneyProfile::Dhis2 => (
-                "dhis2-live",
-                "tracker-api",
-                "dhis2-basic-reader",
-                8_192,
-                10_000,
-            ),
-            JourneyProfile::Dhis2Script => return Err(LiveJourneyError::InvalidSourceBaseUrl),
-            JourneyProfile::OpenCrvs => (
-                "opencrvs-live",
-                "dci-crvs-api",
-                "opencrvs-oauth-client",
-                147_456,
-                20_000,
-            ),
-            JourneyProfile::SyntheticSnapshot => {
-                return Err(LiveJourneyError::InvalidSourceBaseUrl)
-            }
-        };
-    Ok(json!({
-        "profile": {"id": profile.profile_id(), "version": PROFILE_VERSION},
-        "integration_pack": {"id": profile.pack_id(), "version": "1", "hash": profile.pack_hash()},
-        "tenant": "live-test",
-        "registry_instance": registry_instance,
-        "source_instance": source_instance,
-        "data_destination": destination,
-        "credential_destination": credential_destination,
-        "credential": {"ref": credential_ref, "generation": 1},
-        "deployment_parameters": {},
-        "limits": {
-            "max_source_bytes": max_source_bytes,
-            "timeout_ms": timeout_ms,
-            "max_in_flight": 1,
-            "quota_per_minute": 10,
-            "quota_burst": 2,
-            "max_public_response_bytes": 4096
-        },
-        "capabilities": {"allow_script": false}
-    }))
-}
-
-struct LiveDatabase {
-    admin: Client,
-    admin_driver: JoinHandle<Result<(), tokio_postgres::Error>>,
-    owner_role: String,
-    runtime_role: String,
-    maintenance_role: String,
-    reader_role: String,
-}
-
-struct ProvisionedDatabaseUrls {
-    runtime: Zeroizing<String>,
-    maintenance: Zeroizing<String>,
-    reader: Zeroizing<String>,
-}
-
-impl LiveDatabase {
-    /// Provision only the DBA-owned database identities. The public operator
-    /// workflow below remains the sole installer and keyring initializer.
-    async fn provision(
-        admin_database_url: &str,
-        postgres_ca_path: &Path,
-    ) -> Result<(Self, ProvisionedDatabaseUrls), LiveJourneyError> {
-        let admin_config: PostgresConfig = admin_database_url
-            .parse()
-            .map_err(|_| LiveJourneyError::PostgresUnavailable)?;
-        let (admin, admin_driver) = connect_postgres(admin_config, postgres_ca_path).await?;
-
-        let owner_role = role_name("owner");
-        let runtime_role = role_name("runtime");
-        let maintenance_role = role_name("maintenance");
-        let reader_role = role_name("reader");
-        let runtime_password = random_password();
-        let maintenance_password = random_password();
-        let reader_password = random_password();
-        let database_name: String = admin
-            .query_one("SELECT current_database()", &[])
-            .await
-            .map_err(|_| LiveJourneyError::PostgresUnavailable)?
-            .try_get(0)
-            .map_err(|_| LiveJourneyError::PostgresUnavailable)?;
-        let role_sql = format!(
-            "CREATE ROLE {owner} NOLOGIN NOSUPERUSER NOCREATEROLE NOCREATEDB NOREPLICATION NOBYPASSRLS;\
-             CREATE ROLE {runtime} LOGIN PASSWORD {runtime_password} NOSUPERUSER NOCREATEROLE NOCREATEDB NOREPLICATION NOBYPASSRLS;\
-             CREATE ROLE {maintenance} LOGIN PASSWORD {maintenance_password} NOSUPERUSER NOCREATEROLE NOCREATEDB NOREPLICATION NOBYPASSRLS;\
-             CREATE ROLE {reader} LOGIN PASSWORD {reader_password} NOSUPERUSER NOCREATEROLE NOCREATEDB NOREPLICATION NOBYPASSRLS;\
-             GRANT CREATE ON DATABASE {database} TO {owner};",
-            owner = quote_identifier(&owner_role),
-            runtime = quote_identifier(&runtime_role),
-            maintenance = quote_identifier(&maintenance_role),
-            reader = quote_identifier(&reader_role),
-            runtime_password = quote_literal(runtime_password.as_str()),
-            maintenance_password = quote_literal(maintenance_password.as_str()),
-            reader_password = quote_literal(reader_password.as_str()),
-            database = quote_identifier(&database_name),
-        );
-        admin
-            .batch_execute(&role_sql)
-            .await
-            .map_err(|_| LiveJourneyError::StatePlaneInstall)?;
-        let urls = ProvisionedDatabaseUrls {
-            runtime: database_url_for_role(
-                admin_database_url,
-                &runtime_role,
-                runtime_password.as_str(),
-            )?,
-            maintenance: database_url_for_role(
-                admin_database_url,
-                &maintenance_role,
-                maintenance_password.as_str(),
-            )?,
-            reader: database_url_for_role(
-                admin_database_url,
-                &reader_role,
-                reader_password.as_str(),
-            )?,
-        };
-        Ok((
-            Self {
-                admin,
-                admin_driver,
-                owner_role,
-                runtime_role,
-                maintenance_role,
-                reader_role,
-            },
-            urls,
-        ))
-    }
-
-    fn owner_role(&self) -> &str {
-        &self.owner_role
-    }
-
-    async fn classify_safe_execute_failure(&mut self) -> LiveJourneyError {
-        let rows = match self
-            .admin
-            .query(
-                r#"
-SELECT
-    record_json::jsonb #>> '{payload,outcome}' AS completion_outcome,
-    record_json::jsonb #>>
-        '{payload,completion_facts,execution_result,class}' AS result_class,
-    record_json::jsonb #>>
-        '{payload,completion_facts,execution_result,failure_class}' AS failure_class
-FROM relay_state_private.audit_phase
-WHERE stream_kind = 'consultation' AND phase = 'completion'
-"#,
-                &[],
-            )
-            .await
-        {
-            Ok(rows) => rows,
-            Err(_) => return LiveJourneyError::ExecuteUnavailable,
-        };
-        let [row] = rows.as_slice() else {
-            return if rows.is_empty() {
-                LiveJourneyError::ExecuteMissingDurableCompletion
-            } else {
-                LiveJourneyError::ExecuteUnavailable
-            };
-        };
-        let completion_outcome = match row.try_get::<_, Option<String>>("completion_outcome") {
-            Ok(completion_outcome) => completion_outcome,
-            Err(_) => return LiveJourneyError::ExecuteUnavailable,
-        };
-        let result_class = match row.try_get::<_, Option<String>>("result_class") {
-            Ok(result_class) => result_class,
-            Err(_) => return LiveJourneyError::ExecuteUnavailable,
-        };
-        let failure_class = match row.try_get::<_, Option<String>>("failure_class") {
-            Ok(failure_class) => failure_class,
-            Err(_) => return LiveJourneyError::ExecuteUnavailable,
-        };
-        classify_durable_execute_failure(
-            completion_outcome.as_deref(),
-            result_class.as_deref(),
-            failure_class.as_deref(),
-        )
-    }
-
-    async fn assert_safe_durable_evidence(
-        &mut self,
-        profile: JourneyProfile,
-        expected: &JourneyCorrelation,
-    ) -> Result<(), LiveJourneyError> {
-        let row = self
-            .admin
-            .query_one(
-                r#"
-WITH consultation_audit AS (
-    SELECT phase, operation_id::text AS operation_id, record_json::jsonb AS record
-    FROM relay_state_private.audit_phase
-    WHERE stream_kind = 'consultation'
-), permits AS (
-    SELECT kind, dispatched_at IS NOT NULL AS dispatched,
-           completion_operation_id = operation_id
-             AND completion_phase = 'completion'
-             AND completion_envelope_id IS NOT NULL
-             AND completion_record_hash IS NOT NULL AS completion_linked
-    FROM relay_state_private.dispatch_permit
-)
-SELECT
-    (SELECT count(*) FROM consultation_audit WHERE phase = 'attempt') AS attempt_count,
-    (SELECT count(*) FROM consultation_audit WHERE phase = 'completion') AS completion_count,
-    (SELECT min(operation_id)
-       FROM consultation_audit WHERE phase = 'attempt') AS consultation_id,
-    (SELECT min(record #>> '{payload,completion_seed,correlation,notary_evaluation_id}')
-       FROM consultation_audit WHERE phase = 'attempt') AS notary_evaluation_id,
-    (SELECT min(record #>> '{payload,completion_facts,execution_result,class}')
-       FROM consultation_audit WHERE phase = 'completion') AS completion_class,
-    (SELECT min(record #>> '{payload,completion_facts,execution_result,outcome}')
-       FROM consultation_audit WHERE phase = 'completion') AS completion_public_outcome,
-    (SELECT min(record #>> '{payload,outcome}')
-       FROM consultation_audit WHERE phase = 'completion') AS completion_disposition,
-    (SELECT max((record #>> '{payload,completion_facts,actual_credential_exchanges}')::bigint)
-       FROM consultation_audit WHERE phase = 'completion') AS actual_credential_exchanges,
-    (SELECT max((record #>> '{payload,completion_facts,actual_data_exchanges}')::bigint)
-       FROM consultation_audit WHERE phase = 'completion') AS actual_data_exchanges,
-    (SELECT (record #> '{payload,completion_facts,actual_path}')::text
-       FROM consultation_audit WHERE phase = 'completion' LIMIT 1) AS actual_path,
-    (SELECT count(*) = 0 FROM consultation_audit
-       WHERE strpos(record::text, $1) > 0
-          OR strpos(record::text, $2) > 0
-          OR strpos(record::text, $3) > 0
-          OR strpos(record::text, $4) > 0
-          OR strpos(record::text, $5) > 0
-          OR strpos(record::text, $6) > 0) AS sensitive_values_absent,
-    (SELECT count(*) FROM permits) AS total_permit_count,
-    (SELECT count(*) FROM permits WHERE kind = 'data') AS data_permit_count,
-    (SELECT count(*) FROM permits
-       WHERE kind = 'data' AND dispatched AND completion_linked) AS linked_dispatch_count,
-    (SELECT count(*) FROM relay_state_private.consultation_completion_intent
-       WHERE state = 'completed') AS completed_intent_count
-"#,
-                &[
-                    &expected.selector.as_str(),
-                    &expected.source_base_url.as_str(),
-                    &expected.relay_bearer.as_str(),
-                    &expected.notary_api_key.as_str(),
-                    &expected.source_principal.as_str(),
-                    &expected.source_secret.as_str(),
-                ],
-            )
-            .await
-            .map_err(|_| LiveJourneyError::DurableEvidence)?;
-        let consultation_id = row
-            .try_get::<_, Option<String>>("consultation_id")
-            .map_err(|_| LiveJourneyError::DurableEvidence)?;
-        let notary_evaluation_id = row
-            .try_get::<_, Option<String>>("notary_evaluation_id")
-            .map_err(|_| LiveJourneyError::DurableEvidence)?;
-        if consultation_id.as_deref() != Some(expected.consultation_id.as_str())
-            || notary_evaluation_id.as_deref() != Some(expected.evaluation_id.as_str())
-        {
-            return Err(LiveJourneyError::DurableEvidence);
-        }
-        let actual_path = row
-            .try_get::<_, Option<String>>("actual_path")
-            .map_err(|_| LiveJourneyError::DurableEvidence)?
-            .ok_or(LiveJourneyError::DurableEvidence)?;
-        let actual_path: Value =
-            serde_json::from_str(&actual_path).map_err(|_| LiveJourneyError::DurableEvidence)?;
-        let (expected_outcome, credential_exchanges, data_exchanges, expected_path) = match profile
-        {
-            JourneyProfile::Dhis2 => (
-                "match",
-                0,
-                1,
-                json!([{"kind": "data", "ordinal": 0, "operation_id": "lookup-enrollment-status"}]),
-            ),
-            JourneyProfile::Dhis2Script => (
-                "match",
-                0,
-                4,
-                json!([
-                    {"kind": "data", "ordinal": 0, "operation_id": "identity"},
-                    {"kind": "data", "ordinal": 1, "operation_id": "child_program"},
-                    {"kind": "data", "ordinal": 2, "operation_id": "care"},
-                    {"kind": "data", "ordinal": 3, "operation_id": "tb_program"}
-                ]),
-            ),
-            JourneyProfile::OpenCrvs => (
-                "no_match",
-                1,
-                2,
-                json!([
-                    {"kind": "credential", "ordinal": 0, "operation_id": "acquire-opencrvs-token"},
-                    {"kind": "data", "ordinal": 0, "operation_id": "fetch-signing-keys"},
-                    {"kind": "data", "ordinal": 1, "operation_id": "lookup-birth-record"}
-                ]),
-            ),
-            JourneyProfile::SyntheticSnapshot => ("match", 0, 0, json!([])),
-        };
-        let sensitive_values_absent = row
-            .try_get::<_, bool>("sensitive_values_absent")
-            .map_err(|_| LiveJourneyError::DurableEvidence)?;
-        if actual_path != expected_path || !sensitive_values_absent {
-            return Err(LiveJourneyError::DurableEvidence);
-        }
-        let evidence = (
-            row.try_get::<_, i64>("attempt_count")
-                .map_err(|_| LiveJourneyError::DurableEvidence)?,
-            row.try_get::<_, i64>("completion_count")
-                .map_err(|_| LiveJourneyError::DurableEvidence)?,
-            row.try_get::<_, Option<String>>("completion_class")
-                .map_err(|_| LiveJourneyError::DurableEvidence)?,
-            row.try_get::<_, Option<String>>("completion_public_outcome")
-                .map_err(|_| LiveJourneyError::DurableEvidence)?,
-            row.try_get::<_, Option<String>>("completion_disposition")
-                .map_err(|_| LiveJourneyError::DurableEvidence)?,
-            row.try_get::<_, Option<i64>>("actual_credential_exchanges")
-                .map_err(|_| LiveJourneyError::DurableEvidence)?,
-            row.try_get::<_, Option<i64>>("actual_data_exchanges")
-                .map_err(|_| LiveJourneyError::DurableEvidence)?,
-            row.try_get::<_, i64>("total_permit_count")
-                .map_err(|_| LiveJourneyError::DurableEvidence)?,
-            row.try_get::<_, i64>("data_permit_count")
-                .map_err(|_| LiveJourneyError::DurableEvidence)?,
-            row.try_get::<_, i64>("linked_dispatch_count")
-                .map_err(|_| LiveJourneyError::DurableEvidence)?,
-            row.try_get::<_, i64>("completed_intent_count")
-                .map_err(|_| LiveJourneyError::DurableEvidence)?,
-        );
-        if evidence
-            != (
-                1,
-                1,
-                Some("public_success".to_string()),
-                Some(expected_outcome.to_string()),
-                Some("known_complete".to_string()),
-                Some(credential_exchanges),
-                Some(data_exchanges),
-                credential_exchanges + data_exchanges,
-                data_exchanges,
-                data_exchanges,
-                1,
-            )
-        {
-            return Err(LiveJourneyError::DurableEvidence);
-        }
-        Ok(())
-    }
-
-    async fn cleanup(self) -> Result<(), LiveJourneyError> {
-        let cleanup_sql = format!(
-            "DROP SCHEMA IF EXISTS relay_state_api CASCADE;\
-             DROP SCHEMA IF EXISTS relay_state_private CASCADE;\
-             DROP OWNED BY {runtime}, {maintenance}, {reader}, {owner};\
-             DROP ROLE {runtime}, {maintenance}, {reader}, {owner};",
-            runtime = quote_identifier(&self.runtime_role),
-            maintenance = quote_identifier(&self.maintenance_role),
-            reader = quote_identifier(&self.reader_role),
-            owner = quote_identifier(&self.owner_role),
-        );
-        let result = self
-            .admin
-            .batch_execute(&cleanup_sql)
-            .await
-            .map_err(|_| LiveJourneyError::PostgresCleanup);
-        drop(self.admin);
-        self.admin_driver.abort();
-        result
-    }
-}
-
-fn classify_durable_execute_failure(
-    completion_outcome: Option<&str>,
-    result_class: Option<&str>,
-    failure_class: Option<&str>,
-) -> LiveJourneyError {
-    match (completion_outcome, result_class, failure_class) {
-        (Some("known_complete"), Some("known_failure"), Some("credential_unavailable")) => {
-            LiveJourneyError::ExecuteSourceCredentialsUnavailable
-        }
-        (Some("known_complete"), Some("known_failure"), Some("source_unavailable")) => {
-            LiveJourneyError::ExecuteSourceUnavailable
-        }
-        (Some("known_complete"), Some("known_failure"), Some("response_contract_violation")) => {
-            LiveJourneyError::ExecuteResponseContractViolation
-        }
-        (Some("known_complete"), Some("known_failure"), Some("cardinality_violation")) => {
-            LiveJourneyError::ExecuteCardinalityViolation
-        }
-        (Some("not_started"), None, None) => LiveJourneyError::ExecuteClosedBeforeSourceDispatch,
-        (Some("outcome_unknown"), None, None) => LiveJourneyError::ExecuteClosedAfterSourceDispatch,
-        _ => LiveJourneyError::ExecuteUnavailable,
-    }
-}
-
-async fn connect_postgres(
-    config: PostgresConfig,
-    ca_path: &Path,
-) -> Result<(Client, JoinHandle<Result<(), tokio_postgres::Error>>), LiveJourneyError> {
-    let pem = fs::read(ca_path).map_err(|_| LiveJourneyError::InvalidPostgresTls)?;
-    let certificate = native_tls::Certificate::from_pem(&pem)
-        .map_err(|_| LiveJourneyError::InvalidPostgresTls)?;
-    let mut builder = native_tls::TlsConnector::builder();
-    builder.add_root_certificate(certificate);
-    let connector = MakeTlsConnector::new(
-        builder
-            .build()
-            .map_err(|_| LiveJourneyError::InvalidPostgresTls)?,
-    );
-    let (client, connection) = config
-        .connect(connector)
-        .await
-        .map_err(|_| LiveJourneyError::PostgresUnavailable)?;
-    let driver = tokio::spawn(connection);
-    Ok((client, driver))
-}
-
-fn database_url_for_role(
-    admin_database_url: &str,
-    role: &str,
-    password: &str,
-) -> Result<Zeroizing<String>, LiveJourneyError> {
-    let mut url =
-        Url::parse(admin_database_url).map_err(|_| LiveJourneyError::PostgresUnavailable)?;
-    url.set_username(role)
-        .map_err(|_| LiveJourneyError::PostgresUnavailable)?;
-    url.set_password(Some(password))
-        .map_err(|_| LiveJourneyError::PostgresUnavailable)?;
-    Ok(Zeroizing::new(url.to_string()))
-}
-
-fn current_unix_ms() -> Result<i64, LiveJourneyError> {
-    i64::try_from(
-        SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .map_err(|_| LiveJourneyError::PseudonymInitialization)?
-            .as_millis(),
-    )
-    .map_err(|_| LiveJourneyError::PseudonymInitialization)
-}
-
-fn copy_artifact(source: &Path, destination: &Path) -> Result<(), LiveJourneyError> {
-    let bytes = fs::read(source).map_err(|_| LiveJourneyError::ArtifactStaging)?;
-    fs::write(destination, &bytes).map_err(|_| LiveJourneyError::ArtifactStaging)?;
-    Ok(())
-}
-
-fn sha256_uri(bytes: &[u8]) -> String {
-    use std::fmt::Write as _;
-
-    let digest = Sha256::digest(bytes);
-    let mut encoded = String::with_capacity("sha256:".len() + digest.len() * 2);
-    encoded.push_str("sha256:");
-    for byte in digest {
-        write!(&mut encoded, "{byte:02x}").expect("writing to a string cannot fail");
-    }
-    encoded
-}
-
-#[cfg(target_os = "linux")]
-fn typed_private_binding_hash(binding: &Value) -> Result<String, LiveJourneyError> {
-    use std::fmt::Write as _;
-
-    let canonical = canonicalize_json(binding).map_err(|_| LiveJourneyError::ArtifactStaging)?;
-    let mut hasher = Sha256::new();
-    hasher.update(b"registry.relay.consultation-binding.v1\0");
-    hasher.update(canonical);
-    let digest = hasher.finalize();
-    let mut encoded = String::with_capacity("sha256:".len() + digest.len() * 2);
-    encoded.push_str("sha256:");
-    for byte in digest {
-        write!(&mut encoded, "{byte:02x}").expect("writing to a string cannot fail");
-    }
-    Ok(encoded)
-}
-
-fn yaml_string(value: &str) -> Result<String, LiveJourneyError> {
-    serde_json::to_string(value).map_err(|_| LiveJourneyError::ArtifactStaging)
-}
-
-fn replace_once(
-    document: &mut String,
-    expected: &str,
-    replacement: &str,
-) -> Result<(), LiveJourneyError> {
-    if document.match_indices(expected).count() != 1 {
-        return Err(LiveJourneyError::ArtifactStaging);
-    }
-    *document = document.replacen(expected, replacement, 1);
-    Ok(())
-}
-
-fn required_secret_environment(name: &'static str) -> Result<Zeroizing<String>, LiveJourneyError> {
-    let value = env::var(name).map_err(|_| LiveJourneyError::MissingEnvironment(name))?;
-    if value.is_empty() {
-        return Err(LiveJourneyError::MissingEnvironment(name));
-    }
-    Ok(Zeroizing::new(value))
-}
-
-fn required_path_environment(name: &'static str) -> Result<PathBuf, LiveJourneyError> {
-    let value = env::var_os(name).ok_or(LiveJourneyError::MissingEnvironment(name))?;
-    if value.is_empty() {
-        return Err(LiveJourneyError::MissingEnvironment(name));
-    }
-    Ok(PathBuf::from(value))
-}
-
-fn require_nonempty_environment(name: &'static str) -> Result<(), LiveJourneyError> {
-    match env::var_os(name) {
-        Some(value) if !value.is_empty() => Ok(()),
-        _ => Err(LiveJourneyError::MissingEnvironment(name)),
-    }
-}
-
-#[derive(Default)]
-struct ScopedEnvironment {
-    previous: Vec<(&'static str, Option<std::ffi::OsString>)>,
-}
-
-impl ScopedEnvironment {
-    fn set(&mut self, name: &'static str, value: &str) {
-        self.previous.push((name, env::var_os(name)));
-        env::set_var(name, value);
-    }
-}
-
-impl Drop for ScopedEnvironment {
-    fn drop(&mut self) {
-        for (name, value) in self.previous.drain(..).rev() {
-            match value {
-                Some(value) => env::set_var(name, value),
-                None => env::remove_var(name),
-            }
-        }
-    }
-}
-
-fn role_name(kind: &str) -> String {
-    format!(
-        "relay_live_{kind}_{}",
-        Ulid::new().to_string().to_ascii_lowercase()
-    )
-}
-
-fn random_secret() -> Zeroizing<String> {
-    Zeroizing::new(format!("{}{}", Ulid::new(), Ulid::new()))
-}
-
-fn random_password() -> Zeroizing<String> {
-    Zeroizing::new(Ulid::new().to_string())
-}
-
-fn quote_identifier(value: &str) -> String {
-    format!("\"{}\"", value.replace('"', "\"\""))
-}
-
-fn quote_literal(value: &str) -> String {
-    format!("'{}'", value.replace('\'', "''"))
-}
diff --git a/crates/registry-relay/tests/maintained_profile_staging.rs b/crates/registry-relay/tests/maintained_profile_staging.rs
new file mode 100644
index 000000000..650151d20
--- /dev/null
+++ b/crates/registry-relay/tests/maintained_profile_staging.rs
@@ -0,0 +1,152 @@
+// SPDX-License-Identifier: Apache-2.0
+//! Real-loader coverage for every maintained operator example once it is staged
+//! the way an operator deploys it.
+//!
+//! `config_schema.rs` only schema-validates the maintained examples in place and
+//! `opencrvs_profile.rs` loads a single profile straight out of the repository
+//! tree. Neither proves that the pinned artifact closure still resolves once the
+//! example is copied into a deployment directory and the example private binding
+//! is renamed to the filename an operator actually ships.
+
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use registry_relay::config;
+
+/// A maintained operator example and the deployment facts it pins.
+struct MaintainedProfile {
+    directory: &'static str,
+    /// Artifacts the example pins beyond the closure every profile carries.
+    extra_artifacts: &'static [&'static str],
+    required_environment: &'static [&'static str],
+}
+
+const MAINTAINED_PROFILES: &[MaintainedProfile] = &[
+    MaintainedProfile {
+        directory: "profiles/dhis2-2.41.9-enrollment-status",
+        extra_artifacts: &[],
+        required_environment: &["DHIS2_USERNAME", "DHIS2_PASSWORD"],
+    },
+    MaintainedProfile {
+        directory: "profiles/opencrvs-1.9.0-rc.1-farajaland-birth-record-exists",
+        extra_artifacts: &[],
+        required_environment: &["OPENCRVS_DCI_CLIENT_ID", "OPENCRVS_DCI_CLIENT_SECRET"],
+    },
+    MaintainedProfile {
+        directory: "profiles/synthetic-snapshot-exact-person-status",
+        extra_artifacts: &["fixtures/people.csv"],
+        required_environment: &["REGISTRY_RELAY_CONSULTATION_DATABASE_URL"],
+    },
+];
+
+const CONFIG_EXAMPLE_FILE: &str = "relay-config.example.yaml";
+const EXAMPLE_BINDING_FILE: &str = "private-binding.example.json";
+const DEPLOYED_BINDING_FILE: &str = "private-binding.json";
+
+/// The artifact closure every maintained example pins, relative to the profile.
+const CLOSURE_ARTIFACTS: &[&str] = &[
+    "public-contract.json",
+    "integration-pack.json",
+    "evidence/conformance.json",
+    "evidence/negative-security.json",
+    "evidence/minimization.json",
+];
+
+/// A maintained operator example copied into a throwaway deployment directory.
+///
+/// Only the deployment-private binding filename changes; every hash pin in the
+/// documented example stays untouched so the loader below catches drift in the
+/// maintained baseline rather than in this staging code.
+struct StagedProfile {
+    /// Held so the staged deployment directory outlives the loader call.
+    _directory: tempfile::TempDir,
+    config_path: PathBuf,
+}
+
+impl StagedProfile {
+    fn new(profile: &MaintainedProfile) -> Self {
+        let source_root = Path::new(env!("CARGO_MANIFEST_DIR")).join(profile.directory);
+        let directory = tempfile::tempdir().expect("staging directory is creatable");
+
+        for artifact in CLOSURE_ARTIFACTS.iter().chain(profile.extra_artifacts) {
+            copy_artifact(
+                &source_root.join(artifact),
+                &directory.path().join(artifact),
+            );
+        }
+        copy_artifact(
+            &source_root.join(EXAMPLE_BINDING_FILE),
+            &directory.path().join(DEPLOYED_BINDING_FILE),
+        );
+
+        let mut yaml = fs::read_to_string(source_root.join(CONFIG_EXAMPLE_FILE))
+            .unwrap_or_else(|_| panic!("the {} example is readable", profile.directory));
+        replace_once(
+            &mut yaml,
+            &format!("path: {EXAMPLE_BINDING_FILE}"),
+            &format!("path: {DEPLOYED_BINDING_FILE}"),
+            profile.directory,
+        );
+
+        let config_path = directory.path().join("relay.yaml");
+        fs::write(&config_path, yaml).expect("staged configuration is writable");
+        Self {
+            _directory: directory,
+            config_path,
+        }
+    }
+}
+
+fn copy_artifact(source: &Path, destination: &Path) {
+    let parent = destination
+        .parent()
+        .expect("staged artifact has a parent directory");
+    fs::create_dir_all(parent).expect("staged artifact directory is creatable");
+    let bytes = fs::read(source)
+        .unwrap_or_else(|_| panic!("maintained artifact {} is readable", source.display()));
+    fs::write(destination, &bytes).expect("staged artifact is writable");
+}
+
+/// Replace `expected` when the example pins it exactly once, so a maintained
+/// example that renames or duplicates the anchor fails here instead of silently
+/// staging an unchanged document.
+fn replace_once(document: &mut String, expected: &str, replacement: &str, profile: &str) {
+    assert_eq!(
+        document.match_indices(expected).count(),
+        1,
+        "the {profile} example no longer pins `{expected}` exactly once"
+    );
+    *document = document.replacen(expected, replacement, 1);
+}
+
+#[test]
+fn maintained_operator_examples_stage_through_the_real_loader() {
+    for profile in MAINTAINED_PROFILES {
+        let staged = StagedProfile::new(profile);
+        let loaded = config::load_with_metadata(&staged.config_path).unwrap_or_else(|error| {
+            panic!(
+                "the staged {} operator example did not load: {error}",
+                profile.directory
+            )
+        });
+        let consultation = loaded.runtime.consultation.as_ref().unwrap_or_else(|| {
+            panic!(
+                "the staged {} operator example configured no consultation",
+                profile.directory
+            )
+        });
+        let required = consultation.required_environment_references();
+        for name in profile.required_environment {
+            assert!(
+                required.contains(name),
+                "the staged {} operator example dropped the {name} environment reference",
+                profile.directory
+            );
+        }
+        assert!(
+            loaded.consultation_artifacts.is_some(),
+            "the staged {} operator example produced no verified artifact closure",
+            profile.directory
+        );
+    }
+}
diff --git a/crates/registryctl/CHANGELOG.md b/crates/registryctl/CHANGELOG.md
index 21219c5e6..b1dc92456 100644
--- a/crates/registryctl/CHANGELOG.md
+++ b/crates/registryctl/CHANGELOG.md
@@ -6,6 +6,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## [Unreleased]
 
+### Changed
+
+- Approved baseline sets now carry schema version `2.0`. Registry Notary is
+  retired, so a schema version `1.0` approved set, its notary lane, and the
+  cross-lane interface digests it binds are no longer verified. Registryctl
+  refuses such a document by name instead of honoring an approval whose
+  integrity claim it no longer enforces. Re-approve the baseline to issue a
+  schema version `2.0` approved set.
+
 ## [0.16.3] - 2026-08-01
 
 - No user-visible Registryctl changes. The v0.16.2 workflow stopped at an
diff --git a/crates/registryctl/Cargo.toml b/crates/registryctl/Cargo.toml
index 017e63e7c..996458c71 100644
--- a/crates/registryctl/Cargo.toml
+++ b/crates/registryctl/Cargo.toml
@@ -10,7 +10,6 @@ workspace = true
 
 [features]
 default = []
-relay-contract-test-support = ["registry-notary-server/relay-contract-test-support"]
 
 [dependencies]
 anyhow = "1"
@@ -27,8 +26,6 @@ ipnet.workspace = true
 jsonschema.workspace = true
 registry-config-report = { workspace = true }
 registry-language-server.workspace = true
-registry-notary-core.workspace = true
-registry-notary-server = { workspace = true, features = ["registry-notary-cel"] }
 registry-platform-authcommon = { workspace = true }
 registry-platform-config = { workspace = true }
 registry-platform-crypto = { workspace = true }
diff --git a/crates/registryctl/agent-skills/registry-stack-single-node-deploy/SKILL.md b/crates/registryctl/agent-skills/registry-stack-single-node-deploy/SKILL.md
index a005f9bda..49195f4e2 100644
--- a/crates/registryctl/agent-skills/registry-stack-single-node-deploy/SKILL.md
+++ b/crates/registryctl/agent-skills/registry-stack-single-node-deploy/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: registry-stack-single-node-deploy
-description: Use when a user wants a self-hosted single-node Registry Relay, Registry Notary, or Relay plus Notary deployment using registryctl-generated project layout or equivalent local Compose wiring.
+description: Use when a user wants a self-hosted single-node Registry Relay deployment using registryctl-generated project layout or equivalent local Compose wiring.
 ---
 
 # Registry Stack Single-Node Deploy
@@ -9,7 +9,7 @@ Use this skill to help a user create, validate, and troubleshoot a single-node R
 
 ## Workflow
 
-1. Identify the mode: Relay only, Notary only, or Relay plus Notary.
+1. Identify whether the project exposes the public Relay lane, the consultation Relay lane, or both.
 2. Establish the deployment profile: `local`, `hosted_lab`, `production`, or `evidence_grade`. Prefer product configs declaring `deployment.profile`; use `registryctl doctor --profile` only as a temporary review override.
 3. Generate or edit the smallest necessary project files.
 4. Run product-owned validation through registryctl:
@@ -24,12 +24,12 @@ Use this skill to help a user create, validate, and troubleshoot a single-node R
    registryctl doctor --profile local --format json
    ```
 
-5. Treat the merged JSON report as orchestration evidence only. Relay findings belong to `registry-relay`; Notary findings belong to `registry-notary`.
+5. Treat the merged JSON report as orchestration evidence only. Relay findings belong to `registry-relay`.
 6. Start containers and run smoke checks only when the user asks for a runnable deployment or provides controlled test targets.
 
 ## Redaction Rules
 
-Never print raw env-file values, API keys, bearer tokens, source tokens, Redis URLs, private JWKs, SD-JWT disclosures, source rows, claim values, or full environment dumps.
+Never print raw env-file values, API keys, bearer tokens, source tokens, Redis URLs, private JWKs, source rows, or full environment dumps.
 
 ## Output
 
diff --git a/crates/registryctl/agent-skills/registry-stack-single-node-deploy/agents/openai.yaml b/crates/registryctl/agent-skills/registry-stack-single-node-deploy/agents/openai.yaml
index bf84217cf..31c99d864 100644
--- a/crates/registryctl/agent-skills/registry-stack-single-node-deploy/agents/openai.yaml
+++ b/crates/registryctl/agent-skills/registry-stack-single-node-deploy/agents/openai.yaml
@@ -1,6 +1,6 @@
 interface:
   display_name: "Registry Stack Single-Node Deploy"
-  short_description: "Deploy and validate a local Relay/Notary stack"
+  short_description: "Deploy and validate a local Relay stack"
   default_prompt: "Use $registry-stack-single-node-deploy to set up and validate this single-node Registry stack."
 
 policy:
diff --git a/crates/registryctl/agent-skills/registryctl-local-project-troubleshoot/SKILL.md b/crates/registryctl/agent-skills/registryctl-local-project-troubleshoot/SKILL.md
index 37c025d99..79063f00d 100644
--- a/crates/registryctl/agent-skills/registryctl-local-project-troubleshoot/SKILL.md
+++ b/crates/registryctl/agent-skills/registryctl-local-project-troubleshoot/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: registryctl-local-project-troubleshoot
-description: Use when a user has a registryctl-generated local project and doctor, dev smoke, dev status, dev logs, Relay, or Notary checks fail.
+description: Use when a user has a registryctl-generated local project and doctor, dev smoke, dev status, dev logs, or Relay checks fail.
 ---
 
 # registryctl Local Project Troubleshoot
@@ -28,7 +28,7 @@ Use this skill to troubleshoot generated local Registry projects without duplica
 
 ## Redaction Rules
 
-Do not print raw env-file values, API keys, source tokens, Redis URLs, private JWKs, request bodies, source rows, claim values, or SD-JWT disclosures. Summarize redacted stdout/stderr only.
+Do not print raw env-file values, API keys, source tokens, Redis URLs, private JWKs, request bodies, or source rows. Summarize redacted stdout/stderr only.
 
 ## Output
 
diff --git a/crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml b/crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml
index a1896cee6..58376d930 100644
--- a/crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml
+++ b/crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml
@@ -13,30 +13,14 @@ integrations:
         token: { secret: FICTIONAL_REGISTRY_TOKEN }
         generation: 1
 
-issuance:
-  issuer: did:web:notary.invalid
-  signing_kid: project-issuer-key
-  signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }
-  generation: 1
-
-callers:
-  evidence-client:
-    api_key_fingerprint: { secret: EVIDENCE_CLIENT_TOKEN_HASH }
-    scopes: ["evidence:person:read"]
-
 relay:
   origin: https://relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [fictional-relay-client]
-
-notary_relay:
-  base_url: http://registry-relay-consultation:8080
-  workload_client_id: fictional-registry-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: fictional-consultation-client, principal_id: fictional-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: fictional-registry-relay }
-  notary: { service: fictional-registry-notary }
diff --git a/crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml b/crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml
index cfb842ce4..a3b6ff675 100644
--- a/crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml
+++ b/crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml
@@ -1,13 +1,5 @@
 name: active-person
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers: [{ scheme: registry_person_id, value: AB-123456 }]
-  claims: [person-record-exists]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: public-service-person-verification
 input: { person_id: AB-123456 }
 interactions:
   - expect:
@@ -18,4 +10,3 @@ interactions:
 expect:
   outcome: match
   outputs: { active: true }
-  claims: { person-record-exists: true, person-active: true }
diff --git a/crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/no-match.yaml b/crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/no-match.yaml
index b0d12f9a0..70327997c 100644
--- a/crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/no-match.yaml
+++ b/crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/no-match.yaml
@@ -10,4 +10,3 @@ interactions:
 expect:
   outcome: no_match
   outputs: {}
-  claims: { person-record-exists: false, person-active: null }
diff --git a/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml b/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml
index 6b3812ba1..92bb91f2f 100644
--- a/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml
+++ b/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml
@@ -2,7 +2,7 @@ version: 1
 starter:
   id: http
   release: 0.16.3
-  content_digest: sha256:775d32e45c461bbe6e597434401918188832cd411dec6959517c633670087293
+  content_digest: sha256:3366a122be5007cda57217e219a7eaf62da345536251d4fad2a07dd36c39da63
 
 registry:
   id: fictional-citizen-registry
@@ -13,28 +13,13 @@ integrations:
 
 services:
   person-verification:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: public-service-person-verification
     legal_basis: public-service-delivery
     consent: not_required
-    access:
-      scopes: ["evidence:person:read"]
     consultations:
       person_record:
         integration: person-record
         input:
           person_id: request.target.identifiers.registry_person_id
-    claims:
-      person-record-exists:
-        cel: person_record.matched
-        disclosure: predicate
-      person-active:
-        output: person_record.active
-        disclosure: value
-    credential_profiles:
-      person-status:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/person-status/v1
-        validity: 10m
-        claims: [person-record-exists, person-active]
diff --git a/crates/registryctl/assets/project-starters/spreadsheet/environments/local.yaml b/crates/registryctl/assets/project-starters/spreadsheet/environments/local.yaml
index 88a41bf5e..577d7cbca 100644
--- a/crates/registryctl/assets/project-starters/spreadsheet/environments/local.yaml
+++ b/crates/registryctl/assets/project-starters/spreadsheet/environments/local.yaml
@@ -21,31 +21,18 @@ entities:
     source_revision: synthetic-public-works-v1
     generation: "1"
 
-callers:
-  public-works-service:
-    api_key_fingerprint: { secret: REGISTRYCTL_LOCAL_NOTARY_CALLER_TOKEN_HASH }
-    scopes: ["evidence:projects:read"]
-  public-works-under-scoped:
-    api_key_fingerprint: { secret: REGISTRYCTL_LOCAL_NOTARY_UNDER_SCOPED_TOKEN_HASH }
-    scopes: ["evidence:projects:metadata"]
-
 relay:
   origin: https://records-relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [public-works-casework]
+  consultation: { client_id: public-works-consultation-client, principal_id: public-works-consultation-principal }
   local_api_keys:
     match_principal: pw_001
     no_match_principal: registryctl_local_no_match
     scopes: [projects:metadata, projects:rows]
 
-notary_relay:
-  base_url: http://registry-relay-consultation:8080
-  workload_client_id: registryctl-local-notary
-  token_file: /run/secrets/relay-workload-token
-
 deployment:
   profile: local
   relay: { service: records-relay }
-  notary: { service: registryctl-local-notary }
diff --git a/crates/registryctl/assets/project-starters/spreadsheet/integrations/project-record-snapshot/fixtures/match.yaml b/crates/registryctl/assets/project-starters/spreadsheet/integrations/project-record-snapshot/fixtures/match.yaml
index b110f5a23..ee2465ee0 100644
--- a/crates/registryctl/assets/project-starters/spreadsheet/integrations/project-record-snapshot/fixtures/match.yaml
+++ b/crates/registryctl/assets/project-starters/spreadsheet/integrations/project-record-snapshot/fixtures/match.yaml
@@ -1,13 +1,5 @@
 name: match
 classification: synthetic
-request:
-  target:
-    type: Project
-    identifiers: [{ scheme: project_id, value: pw_001 }]
-  claims: [project-record-exists, project-status-accepted]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: public-works-case-management
 input: { project_id: pw_001 }
 interactions:
   - expect: { method: GET, path: /snapshot }
@@ -15,6 +7,3 @@ interactions:
 expect:
   outcome: match
   outputs: { status: active }
-  claims:
-    project-record-exists: true
-    project-status-accepted: true
diff --git a/crates/registryctl/assets/project-starters/spreadsheet/integrations/project-record-snapshot/fixtures/no-match.yaml b/crates/registryctl/assets/project-starters/spreadsheet/integrations/project-record-snapshot/fixtures/no-match.yaml
index 63da026cf..891ba57ac 100644
--- a/crates/registryctl/assets/project-starters/spreadsheet/integrations/project-record-snapshot/fixtures/no-match.yaml
+++ b/crates/registryctl/assets/project-starters/spreadsheet/integrations/project-record-snapshot/fixtures/no-match.yaml
@@ -7,6 +7,3 @@ interactions:
 expect:
   outcome: no_match
   outputs: {}
-  claims:
-    project-record-exists: false
-    project-status-accepted: false
diff --git a/crates/registryctl/assets/project-starters/spreadsheet/integrations/project-record-snapshot/fixtures/planned.yaml b/crates/registryctl/assets/project-starters/spreadsheet/integrations/project-record-snapshot/fixtures/planned.yaml
index 90236fbcf..9d5d560fc 100644
--- a/crates/registryctl/assets/project-starters/spreadsheet/integrations/project-record-snapshot/fixtures/planned.yaml
+++ b/crates/registryctl/assets/project-starters/spreadsheet/integrations/project-record-snapshot/fixtures/planned.yaml
@@ -1,13 +1,5 @@
 name: planned
 classification: synthetic
-request:
-  target:
-    type: Project
-    identifiers: [{ scheme: project_id, value: PW-002 }]
-  claims: [project-record-exists, project-status-accepted]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: public-works-case-management
 input: { project_id: PW-002 }
 interactions:
   - expect: { method: GET, path: /snapshot }
@@ -15,6 +7,3 @@ interactions:
 expect:
   outcome: match
   outputs: { status: planned }
-  claims:
-    project-record-exists: true
-    project-status-accepted: false
diff --git a/crates/registryctl/assets/project-starters/spreadsheet/registry-stack.yaml b/crates/registryctl/assets/project-starters/spreadsheet/registry-stack.yaml
index 9e9dfa47f..1fc6d876b 100644
--- a/crates/registryctl/assets/project-starters/spreadsheet/registry-stack.yaml
+++ b/crates/registryctl/assets/project-starters/spreadsheet/registry-stack.yaml
@@ -2,7 +2,7 @@ version: 1
 starter:
   id: spreadsheet
   release: 0.16.3
-  content_digest: sha256:4b9bb158081c28aecf41fb8edc4b354834b316da4ebfaec5aa61173753195b9b
+  content_digest: sha256:da9145bf0efd5918e06af3def65b0c62daf976d57e3b9d6baf0089e26c3758a0
 
 registry:
   id: fictional-public-works-registry
@@ -39,21 +39,12 @@ services:
       standards: { ogc_features: false, sp_dci: false }
 
   public-works-verification:
-    kind: evidence
+    kind: consultation_api
     version: 1
-    subject_type: project
     purpose: public-works-case-management
     legal_basis: public-service-delivery
     consent: not_required
-    access: { scopes: ["evidence:projects:read"] }
     consultations:
       project:
         integration: project-record-snapshot
         input: { project_id: request.target.identifiers.project_id }
-    claims:
-      project-record-exists:
-        cel: project.matched
-        disclosure: predicate
-      project-status-accepted:
-        cel: 'project.matched && project.status == "active"'
-        disclosure: predicate
diff --git a/crates/registryctl/docs/tutorial-standalone-notary.md b/crates/registryctl/docs/tutorial-standalone-notary.md
deleted file mode 100644
index 78cb507df..000000000
--- a/crates/registryctl/docs/tutorial-standalone-notary.md
+++ /dev/null
@@ -1,9 +0,0 @@
-# Verify a claim from your own API
-
-This tutorial is published in Registry Docs:
-
-<https://docs.registrystack.org/tutorials/run-notary-standalone-for-api/>
-
-`registry-registryctl` keeps the CLI source, installer, generated templates, and command reference.
-Registry Docs owns the beginner tutorials so the onboarding path is not split across product
-repositories.
diff --git a/crates/registryctl/schemas/project-authoring/documentation-intent.json b/crates/registryctl/schemas/project-authoring/documentation-intent.json
index 91b5a2ccf..2bb9b6188 100644
--- a/crates/registryctl/schemas/project-authoring/documentation-intent.json
+++ b/crates/registryctl/schemas/project-authoring/documentation-intent.json
@@ -76,20 +76,9 @@
     { "schema": "project", "pointer": "/$defs/recordSpatialGeometry/oneOf/1", "path_kind": "branch" },
     { "schema": "project", "pointer": "/$defs/recordFieldMap/propertyNames", "path_kind": "map_key" },
     { "schema": "project", "pointer": "/$defs/recordFieldMap/additionalProperties", "path_kind": "map_value" },
-    { "schema": "project", "pointer": "/$defs/disclosure/oneOf/0", "path_kind": "branch" },
-    { "schema": "project", "pointer": "/$defs/disclosure/oneOf/1", "path_kind": "branch" },
-    { "schema": "project", "pointer": "/$defs/disclosure/oneOf/1/properties/allowed/items", "path_kind": "array_item" },
     { "schema": "project", "pointer": "/$defs/service/oneOf/0", "path_kind": "branch" },
     { "schema": "project", "pointer": "/$defs/service/oneOf/1", "path_kind": "branch" },
     { "schema": "project", "pointer": "/$defs/recordsService/properties/conforms_to/items", "path_kind": "array_item" },
-    { "schema": "project", "pointer": "/$defs/evidenceService/properties/claims/propertyNames", "path_kind": "map_key" },
-    { "schema": "project", "pointer": "/$defs/evidenceService/properties/claims/additionalProperties", "path_kind": "map_value" },
-    { "schema": "project", "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/oneOf/0", "path_kind": "branch" },
-    { "schema": "project", "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/oneOf/1", "path_kind": "branch" },
-    { "schema": "project", "pointer": "/$defs/evidenceService/properties/credential_profiles/propertyNames", "path_kind": "map_key" },
-    { "schema": "project", "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties", "path_kind": "map_value" },
-    { "schema": "project", "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/claims/items", "path_kind": "array_item" },
-    { "schema": "project", "pointer": "/$defs/access/properties/scopes/items", "path_kind": "array_item" },
     { "schema": "project", "pointer": "/$defs/variables/propertyNames", "path_kind": "map_key" },
     { "schema": "project", "pointer": "/$defs/variables/additionalProperties", "path_kind": "map_value" },
     { "schema": "project", "pointer": "/$defs/consultations/propertyNames", "path_kind": "map_key" },
@@ -100,13 +89,8 @@
     { "schema": "environment", "pointer": "/properties/integrations/additionalProperties", "path_kind": "map_value" },
     { "schema": "environment", "pointer": "/properties/entities/propertyNames", "path_kind": "map_key" },
     { "schema": "environment", "pointer": "/properties/entities/additionalProperties", "path_kind": "map_value" },
-    { "schema": "environment", "pointer": "/properties/callers/propertyNames", "path_kind": "map_key" },
-    { "schema": "environment", "pointer": "/properties/callers/additionalProperties", "path_kind": "map_value" },
-    { "schema": "environment", "pointer": "/properties/callers/additionalProperties/properties/scopes/items", "path_kind": "array_item" },
     { "schema": "environment", "pointer": "/properties/relay/properties/allowed_clients/items", "path_kind": "array_item" },
     { "schema": "environment", "pointer": "/properties/relay/properties/local_api_keys/properties/scopes/items", "path_kind": "array_item" },
-    { "schema": "environment", "pointer": "/properties/deployment/anyOf/0", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/properties/deployment/anyOf/1", "path_kind": "branch" },
     { "schema": "environment", "pointer": "/allOf/0", "path_kind": "branch" },
     { "schema": "environment", "pointer": "/allOf/0/if", "path_kind": "branch" },
     { "schema": "environment", "pointer": "/allOf/0/then", "path_kind": "branch" },
@@ -117,30 +101,12 @@
     { "schema": "environment", "pointer": "/allOf/1/then", "path_kind": "branch" },
     { "schema": "environment", "pointer": "/allOf/2", "path_kind": "branch" },
     { "schema": "environment", "pointer": "/allOf/2/if", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/allOf/2/then", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/allOf/3", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/allOf/3/if", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/allOf/3/then", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/allOf/4", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/allOf/4/if", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/allOf/4/then", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/allOf/5", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/allOf/5/if", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/allOf/5/then", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/allOf/5/else", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/allOf/6", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/allOf/6/if", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/allOf/6/else", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/allOf/6/else/properties/relay/not", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/$defs/internalOrigin/anyOf/0", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/$defs/internalOrigin/anyOf/1", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/$defs/internalOrigin/anyOf/2", "path_kind": "branch" },
+    { "schema": "environment", "pointer": "/allOf/2/else", "path_kind": "branch" },
+    { "schema": "environment", "pointer": "/allOf/2/else/properties/relay/not", "path_kind": "branch" },
     { "schema": "environment", "pointer": "/$defs/relayOrigin/anyOf/0", "path_kind": "branch" },
     { "schema": "environment", "pointer": "/$defs/relayOrigin/anyOf/1", "path_kind": "branch" },
     { "schema": "environment", "pointer": "/$defs/relayResource/anyOf/0", "path_kind": "branch" },
     { "schema": "environment", "pointer": "/$defs/relayResource/anyOf/1", "path_kind": "branch" },
-    { "schema": "environment", "pointer": "/$defs/oid4vci/properties/allowed_wallet_origins/items", "path_kind": "array_item" },
-    { "schema": "environment", "pointer": "/$defs/oid4vci/properties/registrar_clients/items", "path_kind": "array_item" },
     { "schema": "environment", "pointer": "/$defs/privateCidrs/items", "path_kind": "array_item" },
     { "schema": "environment", "pointer": "/$defs/credential/oneOf/0", "path_kind": "branch" },
     { "schema": "environment", "pointer": "/$defs/credential/oneOf/1", "path_kind": "branch" },
@@ -214,13 +180,6 @@
     { "schema": "fixture", "pointer": "/properties/variables/propertyNames", "path_kind": "map_key" },
     { "schema": "fixture", "pointer": "/properties/variables/additionalProperties", "path_kind": "map_value" },
     { "schema": "fixture", "pointer": "/properties/interactions/items", "path_kind": "array_item" },
-    { "schema": "fixture", "pointer": "/$defs/governedRequest/properties/variables/propertyNames", "path_kind": "map_key" },
-    { "schema": "fixture", "pointer": "/$defs/governedRequest/properties/variables/additionalProperties", "path_kind": "map_value" },
-    { "schema": "fixture", "pointer": "/$defs/governedRequest/properties/claims/items", "path_kind": "array_item" },
-    { "schema": "fixture", "pointer": "/$defs/governedTarget/properties/identifiers/items", "path_kind": "array_item" },
-    { "schema": "fixture", "pointer": "/$defs/governedTarget/properties/attributes/additionalProperties", "path_kind": "map_value" },
-    { "schema": "fixture", "pointer": "/$defs/governedClaimRef/oneOf/0", "path_kind": "branch" },
-    { "schema": "fixture", "pointer": "/$defs/governedClaimRef/oneOf/1", "path_kind": "branch" },
     { "schema": "fixture", "pointer": "/$defs/request/properties/query/additionalProperties", "path_kind": "map_value" },
     { "schema": "fixture", "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/0", "path_kind": "branch" },
     { "schema": "fixture", "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1", "path_kind": "branch" },
@@ -246,7 +205,7 @@
   "domains": [
     {
       "schema": "project",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "state": "authored",
       "environment_behavior": "narrows_reviewed_authority",
       "validation_stages": [
@@ -303,7 +262,7 @@
       ],
       "diagnostic": "registryctl.authoring.fixture.invalid",
       "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "example_guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data."
+      "example_guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data."
     },
     {
       "schema": "entity",
@@ -347,41 +306,6 @@
       "pointer": "/properties/development/properties/relay_port",
       "purpose": "Overrides the loopback port exposed by the disposable local Relay runtime without changing a deployment endpoint."
     },
-    {
-      "schema": "environment",
-      "pointer": "/properties/development/properties/notary_port",
-      "purpose": "Overrides the loopback port exposed by the disposable local Notary runtime without changing a deployment endpoint."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/properties/issuance/properties/issuer",
-      "purpose": "Binds the operator-approved credential issuer identifier without granting claim or disclosure authority."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/properties/issuance/properties/signing_key",
-      "purpose": "Names the operator-managed secret reference for credential signing; the signing key value is never authored or reported."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/properties/issuance/properties/signing_kid",
-      "purpose": "Selects the reviewed signing-key identifier exposed in issued credential metadata without containing private key material."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/properties/issuance/properties/generation",
-      "purpose": "Records the operator-controlled issuance-key generation used for explicit rotation and rollback checks."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/properties/callers/additionalProperties/properties/api_key_fingerprint",
-      "purpose": "Names the secret reference used to verify one caller API key; neither the key nor fingerprint value is authored here."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/properties/callers/additionalProperties/properties/scopes",
-      "purpose": "Narrows one caller to the explicitly reviewed service scopes available in this environment."
-    },
     {
       "schema": "environment",
       "pointer": "/properties/relay/properties/origin",
@@ -427,31 +351,11 @@
       "pointer": "/properties/relay/properties/local_api_keys/properties/scopes",
       "purpose": "Limits both generated local API-key callers to the explicitly reviewed service scopes needed by the maintained checks."
     },
-    {
-      "schema": "environment",
-      "pointer": "/properties/notary_relay/properties/base_url",
-      "purpose": "Binds Notary to the operator-reviewed Relay origin used for governed evidence consultations."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/properties/notary_relay/properties/workload_client_id",
-      "purpose": "Identifies the Notary workload client authorized to request reviewed Relay consultations."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/properties/notary_relay/properties/token_file",
-      "purpose": "Selects the operator-managed token-file binding for Notary-to-Relay authentication without exposing its contents."
-    },
     {
       "schema": "environment",
       "pointer": "/properties/relay_state/properties/postgresql/properties/root_certificate_path",
       "purpose": "Binds Relay state storage to an operator-managed PostgreSQL trust root at a deployment-local path."
     },
-    {
-      "schema": "environment",
-      "pointer": "/properties/notary_state/properties/postgresql/properties/root_certificate_path",
-      "purpose": "Binds Notary state storage to an operator-managed PostgreSQL trust root at a deployment-local path."
-    },
     {
       "schema": "integration",
       "pointer": "/$defs/input/properties/role",
@@ -507,11 +411,6 @@
       "pointer": "/$defs/response/oneOf/0/properties/body",
       "purpose": "Defines the synthetic response body returned by the offline fixture harness to the integration."
     },
-    {
-      "schema": "fixture",
-      "pointer": "/$defs/expectation/properties/claims",
-      "purpose": "States the synthetic Notary claim outcomes expected after the reviewed Relay consultation behavior."
-    },
     {
       "schema": "entity",
       "pointer": "/$defs/fieldSchema/properties/type",
@@ -787,11 +686,6 @@
       "pointer": "/$defs/recordSpdci/properties/response_fields",
       "purpose": "Maps SP-DCI response names to the entity fields returned for an authorized record."
     },
-    {
-      "schema": "project",
-      "pointer": "/$defs/disclosure/oneOf/1/properties/allowed",
-      "purpose": "Lists the disclosure modes that may be selected in addition to the policy's declared default."
-    },
     {
       "schema": "project",
       "pointer": "/$defs/recordsService/properties/kind",
@@ -819,84 +713,34 @@
     },
     {
       "schema": "project",
-      "pointer": "/$defs/evidenceService/properties/kind",
-      "purpose": "Identifies this service declaration as a Notary evidence policy."
-    },
-    {
-      "schema": "project",
-      "pointer": "/$defs/evidenceService/properties/version",
-      "purpose": "Assigns the positive authored version used to track this evidence-service policy contract."
-    },
-    {
-      "schema": "project",
-      "pointer": "/$defs/evidenceService/properties/consent",
-      "purpose": "States whether evaluation of this evidence service requires consent."
-    },
-    {
-      "schema": "project",
-      "pointer": "/$defs/evidenceService/properties/claims",
-      "purpose": "Maps evidence claim identifiers to an output or CEL expression, value contract, and disclosure policy."
-    },
-    {
-      "schema": "project",
-      "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/output",
-      "purpose": "Selects the exact Relay consultation output that backs this evidence claim."
+      "pointer": "/$defs/consultationService/properties/kind",
+      "purpose": "Identifies this service declaration as a Relay consultation API backed by reviewed integrations."
     },
     {
       "schema": "project",
-      "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/cel",
-      "purpose": "Provides the CEL expression used to derive a claim from declared Relay consultation outputs."
+      "pointer": "/$defs/consultationService/properties/version",
+      "purpose": "Assigns the positive authored version used to track this Relay consultation service contract."
     },
     {
       "schema": "project",
-      "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/type",
-      "purpose": "Declares the credential type identifier emitted for this reviewed credential profile."
-    },
-    {
-      "schema": "project",
-      "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/validity",
-      "purpose": "Bounds the lifetime of credentials issued from this profile using a positive duration."
-    },
-    {
-      "schema": "project",
-      "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/claims",
-      "purpose": "Lists the registry-backed evidence claims selected into this credential profile."
-    },
-    {
-      "schema": "project",
-      "pointer": "/$defs/access/properties/scopes",
-      "purpose": "Lists the scopes a caller must hold to use the enclosing evidence service."
+      "pointer": "/$defs/consultationService/properties/consent",
+      "purpose": "States whether a caller must confirm consent before the Relay consultation is evaluated."
     },
     {
       "schema": "project",
       "pointer": "/$defs/variables/additionalProperties/properties/from",
-      "purpose": "Binds one evidence variable to its caller-supplied request variable path."
+      "purpose": "Binds one consultation variable to its caller-supplied request variable path."
     },
     {
       "schema": "project",
       "pointer": "/$defs/variables/additionalProperties/properties/type",
-      "purpose": "Declares the request variable as a date value for typed evidence evaluation."
+      "purpose": "Declares the request variable as a date value for typed consultation evaluation."
     },
     {
       "schema": "project",
       "pointer": "/$defs/consultations/additionalProperties/properties/input",
       "purpose": "Maps integration input names to reviewed target-request identifier or attribute bindings."
     },
-    {
-      "schema": "project",
-      "pointer": "/$defs/claimValue/properties/type",
-      "purpose": "Declares the boolean, integer, string, or date type of a claim value."
-    },
-    {
-      "schema": "project",
-      "pointer": "/$defs/claimValue/properties/nullable",
-      "purpose": "States whether the claim value may be null."
-    },
-    {
-      "schema": "project",
-      "pointer": "/$defs/claimValue/properties/max_bytes",
-      "purpose": "Bounds the encoded size of a claim value."
-    },
     {
       "schema": "project",
       "pointer": "/anyOf/0/properties/integrations",
@@ -917,11 +761,6 @@
       "pointer": "/$defs/secret/properties/secret",
       "purpose": "Names the operator-managed environment secret reference without containing the secret value."
     },
-    {
-      "schema": "environment",
-      "pointer": "/$defs/oid4vci/properties/tx_code/properties/required",
-      "purpose": "States whether OID4VCI authorization requires a transaction code before credential issuance."
-    },
     {
       "schema": "environment",
       "pointer": "/$defs/ca/properties/generation",
@@ -1062,16 +901,6 @@
       "pointer": "/properties/relay_state/properties/postgresql",
       "purpose": "Selects the PostgreSQL trust binding used by Relay state storage."
     },
-    {
-      "schema": "environment",
-      "pointer": "/properties/notary_state/properties/postgresql",
-      "purpose": "Selects the PostgreSQL trust binding used by Notary state storage."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/properties/notary_cel/properties/worker_memory_bytes",
-      "purpose": "Caps the memory available to one isolated Notary CEL worker."
-    },
     {
       "schema": "environment",
       "pointer": "/properties/deployment/properties/profile",
@@ -1085,61 +914,21 @@
     {
       "schema": "environment",
       "pointer": "/allOf/1/then/properties/deployment",
-      "purpose": "Requires both Relay and Notary deployment services when a Notary-to-Relay binding is present."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/allOf/2/then/properties/deployment",
       "purpose": "Requires the Relay deployment service when Relay state storage is configured."
     },
     {
       "schema": "environment",
-      "pointer": "/allOf/3/then/properties/deployment",
-      "purpose": "Requires the Notary deployment service when Notary state storage is configured."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/allOf/4/then/properties/deployment",
-      "purpose": "Requires the Notary deployment service when a Notary CEL worker memory bound is configured."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/allOf/5/else/properties/callers",
-      "purpose": "When callers are authored without OID4VCI, requires the caller map to contain at least one binding; cross-file validation separately requires callers for Notary environments and rejects them for Relay-only topology."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/allOf/5/then/properties/deployment",
-      "purpose": "Requires the Notary deployment service when OID4VCI issuance is configured."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/allOf/6/else/properties/relay",
+      "pointer": "/allOf/2/else/properties/relay",
       "purpose": "Applies non-local HTTPS constraints to the Relay origin, issuer, and key-set bindings."
     },
     {
       "schema": "environment",
-      "pointer": "/allOf/6/else/properties/oid4vci",
-      "purpose": "Applies non-local HTTPS constraints to public OID4VCI endpoints."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/allOf/6/else/properties/oid4vci/properties/representative_issuance",
-      "purpose": "Applies non-local HTTPS constraints to representative issuance."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server",
-      "purpose": "Applies non-local HTTPS constraints to all configured OID4VCI authorization-server endpoints."
-    },
-    {
-      "schema": "environment",
-      "pointer": "/allOf/6/if/properties/deployment",
+      "pointer": "/allOf/2/if/properties/deployment",
       "purpose": "Matches the local deployment profile before relaxing public endpoint transport constraints."
     },
     {
       "schema": "environment",
-      "pointer": "/allOf/6/if/properties/deployment/properties/profile",
+      "pointer": "/allOf/2/if/properties/deployment/properties/profile",
       "purpose": "Selects the local-profile condition used by the environment transport-validation branch."
     },
     {
diff --git a/crates/registryctl/schemas/project-authoring/dto-shape-contract.v1.json b/crates/registryctl/schemas/project-authoring/dto-shape-contract.v1.json
index fe8ccb96d..6f0b37d41 100644
--- a/crates/registryctl/schemas/project-authoring/dto-shape-contract.v1.json
+++ b/crates/registryctl/schemas/project-authoring/dto-shape-contract.v1.json
@@ -11,81 +11,6 @@
       "rust_type": "RegistryProject",
       "schema": {
         "$defs": {
-          "AccessDeclaration": {
-            "additionalProperties": false,
-            "properties": {
-              "scopes": {
-                "default": [],
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              }
-            },
-            "type": "object"
-          },
-          "ClaimDeclaration": {
-            "additionalProperties": false,
-            "properties": {
-              "cel": {
-                "default": null,
-                "type": [
-                  "string",
-                  "null"
-                ]
-              },
-              "disclosure": {
-                "$ref": "#/$defs/DisclosureDeclaration"
-              },
-              "output": {
-                "default": null,
-                "type": [
-                  "string",
-                  "null"
-                ]
-              },
-              "value": {
-                "anyOf": [
-                  {
-                    "$ref": "#/$defs/ClaimValueDeclaration"
-                  },
-                  {
-                    "type": "null"
-                  }
-                ],
-                "default": null
-              }
-            },
-            "required": [
-              "disclosure"
-            ],
-            "type": "object"
-          },
-          "ClaimValueDeclaration": {
-            "additionalProperties": false,
-            "properties": {
-              "max_bytes": {
-                "default": null,
-                "format": "uint32",
-                "minimum": 0,
-                "type": [
-                  "integer",
-                  "null"
-                ]
-              },
-              "nullable": {
-                "default": false,
-                "type": "boolean"
-              },
-              "type": {
-                "$ref": "#/$defs/OutputType"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "type": "object"
-          },
           "ConsentDeclaration": {
             "enum": [
               "not_required",
@@ -112,66 +37,6 @@
             ],
             "type": "object"
           },
-          "CredentialProfileDeclaration": {
-            "additionalProperties": false,
-            "properties": {
-              "claims": {
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "format": {
-                "type": "string"
-              },
-              "type": {
-                "type": "string"
-              },
-              "validity": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "format",
-              "type",
-              "validity",
-              "claims"
-            ],
-            "type": "object"
-          },
-          "DisclosureDeclaration": {
-            "anyOf": [
-              {
-                "$ref": "#/$defs/DisclosureMode"
-              },
-              {
-                "properties": {
-                  "allowed": {
-                    "items": {
-                      "$ref": "#/$defs/DisclosureMode"
-                    },
-                    "type": "array"
-                  },
-                  "default": {
-                    "$ref": "#/$defs/DisclosureMode"
-                  }
-                },
-                "required": [
-                  "default",
-                  "allowed"
-                ],
-                "type": "object"
-              }
-            ]
-          },
-          "DisclosureMode": {
-            "enum": [
-              "value",
-              "predicate",
-              "redacted"
-            ],
-            "type": "string"
-          },
           "EntityReference": {
             "additionalProperties": false,
             "properties": {
@@ -184,13 +49,6 @@
             ],
             "type": "object"
           },
-          "EvidenceSubjectType": {
-            "enum": [
-              "person",
-              "project"
-            ],
-            "type": "string"
-          },
           "IntegrationReference": {
             "additionalProperties": false,
             "properties": {
@@ -1169,12 +1027,6 @@
           "ServiceDeclaration": {
             "additionalProperties": false,
             "properties": {
-              "access": {
-                "$ref": "#/$defs/AccessDeclaration",
-                "default": {
-                  "scopes": []
-                }
-              },
               "access_rights": {
                 "anyOf": [
                   {
@@ -1197,13 +1049,6 @@
                 ],
                 "default": null
               },
-              "claims": {
-                "additionalProperties": {
-                  "$ref": "#/$defs/ClaimDeclaration"
-                },
-                "default": {},
-                "type": "object"
-              },
               "conforms_to": {
                 "default": [],
                 "items": {
@@ -1222,13 +1067,6 @@
                 "default": {},
                 "type": "object"
               },
-              "credential_profiles": {
-                "additionalProperties": {
-                  "$ref": "#/$defs/CredentialProfileDeclaration"
-                },
-                "default": {},
-                "type": "object"
-              },
               "description": {
                 "default": null,
                 "type": [
@@ -1272,17 +1110,6 @@
                 ],
                 "default": null
               },
-              "subject_type": {
-                "anyOf": [
-                  {
-                    "$ref": "#/$defs/EvidenceSubjectType"
-                  },
-                  {
-                    "type": "null"
-                  }
-                ],
-                "description": "Subject category evaluated by an evidence service. Omission is\nnormalized to `person` without erasing whether the field was authored,\nso records services cannot silently accept it."
-              },
               "title": {
                 "default": null,
                 "type": [
@@ -1322,7 +1149,7 @@
           },
           "ServiceKind": {
             "enum": [
-              "evidence",
+              "consultation_api",
               "records_api"
             ],
             "type": "string"
@@ -1406,25 +1233,6 @@
       "rust_type": "EnvironmentDocument",
       "schema": {
         "$defs": {
-          "CallerBinding": {
-            "additionalProperties": false,
-            "properties": {
-              "api_key_fingerprint": {
-                "$ref": "#/$defs/SecretReference"
-              },
-              "scopes": {
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              }
-            },
-            "required": [
-              "api_key_fingerprint",
-              "scopes"
-            ],
-            "type": "object"
-          },
           "CertificateAuthorityBinding": {
             "additionalProperties": false,
             "properties": {
@@ -1446,17 +1254,6 @@
           "DeploymentBinding": {
             "additionalProperties": false,
             "properties": {
-              "notary": {
-                "anyOf": [
-                  {
-                    "$ref": "#/$defs/ServiceBinding"
-                  },
-                  {
-                    "type": "null"
-                  }
-                ],
-                "default": null
-              },
               "profile": {
                 "$ref": "#/$defs/DeploymentProfile"
               },
@@ -1481,8 +1278,7 @@
             "enum": [
               "local",
               "hosted_lab",
-              "production",
-              "evidence_grade"
+              "production"
             ],
             "type": "string"
           },
@@ -1495,16 +1291,6 @@
               "default_integration": {
                 "type": "string"
               },
-              "notary_port": {
-                "default": null,
-                "format": "uint16",
-                "maximum": 65535,
-                "minimum": 0,
-                "type": [
-                  "integer",
-                  "null"
-                ]
-              },
               "relay_port": {
                 "default": null,
                 "format": "uint16",
@@ -1742,339 +1528,41 @@
                 ],
                 "default": null
               },
-              "timeout": {
-                "default": null,
-                "type": [
-                  "string",
-                  "null"
-                ]
-              }
-            },
-            "required": [
-              "origin"
-            ],
-            "type": "object"
-          },
-          "IssuanceBinding": {
-            "additionalProperties": false,
-            "properties": {
-              "algorithm": {
-                "$ref": "#/$defs/IssuanceSigningAlgorithm",
-                "default": "EdDSA"
-              },
-              "generation": {
-                "format": "uint64",
-                "minimum": 0,
-                "type": "integer"
-              },
-              "issuer": {
-                "type": "string"
-              },
-              "signing_key": {
-                "$ref": "#/$defs/SecretReference"
-              },
-              "signing_kid": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "issuer",
-              "signing_key",
-              "signing_kid",
-              "generation"
-            ],
-            "type": "object"
-          },
-          "IssuanceSigningAlgorithm": {
-            "enum": [
-              "EdDSA",
-              "ES256"
-            ],
-            "type": "string"
-          },
-          "MutualTlsBinding": {
-            "additionalProperties": false,
-            "properties": {
-              "certificate_file": {
-                "type": "string"
-              },
-              "generation": {
-                "format": "uint64",
-                "minimum": 0,
-                "type": "integer"
-              },
-              "private_key": {
-                "$ref": "#/$defs/SecretReference"
-              }
-            },
-            "required": [
-              "certificate_file",
-              "private_key",
-              "generation"
-            ],
-            "type": "object"
-          },
-          "NotaryCelBinding": {
-            "additionalProperties": false,
-            "properties": {
-              "worker_memory_bytes": {
-                "format": "uint64",
-                "minimum": 0,
-                "type": "integer"
-              }
-            },
-            "required": [
-              "worker_memory_bytes"
-            ],
-            "type": "object"
-          },
-          "NotaryPostgresqlBinding": {
-            "additionalProperties": false,
-            "properties": {
-              "root_certificate_path": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "root_certificate_path"
-            ],
-            "type": "object"
-          },
-          "NotaryRelayBinding": {
-            "additionalProperties": false,
-            "properties": {
-              "base_url": {
-                "type": "string"
-              },
-              "token_file": {
-                "type": "string"
-              },
-              "workload_client_id": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "base_url",
-              "workload_client_id",
-              "token_file"
-            ],
-            "type": "object"
-          },
-          "NotaryStateBinding": {
-            "additionalProperties": false,
-            "properties": {
-              "postgresql": {
-                "$ref": "#/$defs/NotaryPostgresqlBinding"
-              }
-            },
-            "required": [
-              "postgresql"
-            ],
-            "type": "object"
-          },
-          "Oid4vciAuthorizationServerBinding": {
-            "additionalProperties": false,
-            "properties": {
-              "authorize_url": {
-                "type": "string"
-              },
-              "issuer": {
-                "type": "string"
-              },
-              "jwks_url": {
-                "type": "string"
-              },
-              "token_url": {
-                "type": "string"
-              },
-              "userinfo_url": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "issuer",
-              "jwks_url",
-              "userinfo_url",
-              "authorize_url",
-              "token_url"
-            ],
-            "type": "object"
-          },
-          "Oid4vciBinding": {
-            "additionalProperties": false,
-            "properties": {
-              "access_token": {
-                "$ref": "#/$defs/Oid4vciSigningKeyBinding"
-              },
-              "allowed_wallet_origins": {
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "authorization_server": {
-                "$ref": "#/$defs/Oid4vciAuthorizationServerBinding"
-              },
-              "client": {
-                "$ref": "#/$defs/Oid4vciClientBinding"
-              },
-              "credential": {
-                "$ref": "#/$defs/Oid4vciCredentialBinding"
-              },
-              "public_base_url": {
-                "type": "string"
-              },
-              "redirect_uri": {
-                "type": "string"
-              },
-              "registrar_clients": {
-                "default": [],
-                "description": "Machine OIDC clients admitted to create registrar-initiated offers.\n\nThese clients use the pinned authorization server and the Notary public\nbase URL as their resource audience. They are deliberately separate\nfrom the citizen client so generated subject-access classification\nremains closed.",
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "representative_issuance": {
-                "anyOf": [
-                  {
-                    "$ref": "#/$defs/Oid4vciRepresentativeIssuanceBinding"
-                  },
-                  {
-                    "type": "null"
-                  }
-                ]
-              },
-              "sensitive_state_key": {
-                "$ref": "#/$defs/SecretReference"
-              },
-              "subject": {
-                "$ref": "#/$defs/Oid4vciSubjectBinding"
-              },
-              "tx_code": {
-                "$ref": "#/$defs/Oid4vciTxCodeBinding",
-                "default": {
-                  "required": true
-                }
-              }
-            },
-            "required": [
-              "public_base_url",
-              "credential",
-              "authorization_server",
-              "client",
-              "access_token",
-              "sensitive_state_key",
-              "subject",
-              "redirect_uri",
-              "allowed_wallet_origins"
-            ],
-            "type": "object"
-          },
-          "Oid4vciClientBinding": {
-            "additionalProperties": false,
-            "properties": {
-              "id": {
-                "type": "string"
-              },
-              "signing_key": {
-                "$ref": "#/$defs/SecretReference"
-              },
-              "signing_kid": {
-                "type": "string"
+              "timeout": {
+                "default": null,
+                "type": [
+                  "string",
+                  "null"
+                ]
               }
             },
             "required": [
-              "id",
-              "signing_key",
-              "signing_kid"
+              "origin"
             ],
             "type": "object"
           },
-          "Oid4vciCredentialBinding": {
+          "MutualTlsBinding": {
             "additionalProperties": false,
             "properties": {
-              "profile": {
+              "certificate_file": {
                 "type": "string"
               },
-              "service": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "service",
-              "profile"
-            ],
-            "type": "object"
-          },
-          "Oid4vciRepresentativeIssuanceBinding": {
-            "additionalProperties": false,
-            "properties": {
-              "max_proof_age_seconds": {
-                "default": 300,
+              "generation": {
                 "format": "uint64",
                 "minimum": 0,
                 "type": "integer"
               },
-              "proof_claim": {
-                "type": "string"
-              },
-              "relationship": {
-                "type": "string"
-              },
-              "target_id_type": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "relationship",
-              "proof_claim",
-              "target_id_type"
-            ],
-            "type": "object"
-          },
-          "Oid4vciSigningKeyBinding": {
-            "additionalProperties": false,
-            "properties": {
-              "signing_key": {
+              "private_key": {
                 "$ref": "#/$defs/SecretReference"
-              },
-              "signing_kid": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "signing_key",
-              "signing_kid"
-            ],
-            "type": "object"
-          },
-          "Oid4vciSubjectBinding": {
-            "additionalProperties": false,
-            "properties": {
-              "id_type": {
-                "type": "string"
-              },
-              "token_claim": {
-                "type": "string"
               }
             },
             "required": [
-              "token_claim",
-              "id_type"
+              "certificate_file",
+              "private_key",
+              "generation"
             ],
             "type": "object"
           },
-          "Oid4vciTxCodeBinding": {
-            "additionalProperties": false,
-            "properties": {
-              "required": {
-                "default": true,
-                "type": "boolean"
-              }
-            },
-            "type": "object"
-          },
           "PrivateEndpointBinding": {
             "additionalProperties": false,
             "properties": {
@@ -2271,6 +1759,17 @@
               "audience": {
                 "type": "string"
               },
+              "consultation": {
+                "anyOf": [
+                  {
+                    "$ref": "#/$defs/RelayConsultationBinding"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null
+              },
               "issuer": {
                 "type": "string"
               },
@@ -2301,6 +1800,22 @@
             ],
             "type": "object"
           },
+          "RelayConsultationBinding": {
+            "additionalProperties": false,
+            "properties": {
+              "client_id": {
+                "type": "string"
+              },
+              "principal_id": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "client_id",
+              "principal_id"
+            ],
+            "type": "object"
+          },
           "RelayLocalApiKeyBinding": {
             "additionalProperties": false,
             "properties": {
@@ -2397,13 +1912,6 @@
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "additionalProperties": false,
         "properties": {
-          "callers": {
-            "additionalProperties": {
-              "$ref": "#/$defs/CallerBinding"
-            },
-            "default": {},
-            "type": "object"
-          },
           "deployment": {
             "$ref": "#/$defs/DeploymentBinding"
           },
@@ -2432,61 +1940,6 @@
             "default": {},
             "type": "object"
           },
-          "issuance": {
-            "anyOf": [
-              {
-                "$ref": "#/$defs/IssuanceBinding"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "default": null
-          },
-          "notary_cel": {
-            "anyOf": [
-              {
-                "$ref": "#/$defs/NotaryCelBinding"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "default": null
-          },
-          "notary_relay": {
-            "anyOf": [
-              {
-                "$ref": "#/$defs/NotaryRelayBinding"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "default": null
-          },
-          "notary_state": {
-            "anyOf": [
-              {
-                "$ref": "#/$defs/NotaryStateBinding"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "default": null
-          },
-          "oid4vci": {
-            "anyOf": [
-              {
-                "$ref": "#/$defs/Oid4vciBinding"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "default": null
-          },
           "relay": {
             "anyOf": [
               {
@@ -3787,36 +3240,9 @@
             ],
             "type": "object"
           },
-          "ClaimRef": {
-            "$ref": "#/$defs/WireClaimRef"
-          },
-          "ClaimRefObject": {
-            "additionalProperties": false,
-            "properties": {
-              "id": {
-                "type": "string"
-              },
-              "version": {
-                "default": null,
-                "type": [
-                  "string",
-                  "null"
-                ]
-              }
-            },
-            "required": [
-              "id"
-            ],
-            "type": "object"
-          },
           "FixtureExpectation": {
             "additionalProperties": false,
             "properties": {
-              "claims": {
-                "additionalProperties": true,
-                "default": {},
-                "type": "object"
-              },
               "error": {
                 "default": null,
                 "type": [
@@ -3839,118 +3265,12 @@
             },
             "type": "object"
           },
-          "GovernedFixtureIdentifier": {
-            "additionalProperties": false,
-            "properties": {
-              "scheme": {
-                "type": "string"
-              },
-              "value": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "scheme",
-              "value"
-            ],
-            "type": "object"
-          },
-          "GovernedFixtureRequest": {
-            "additionalProperties": false,
-            "description": "The closed governed request accepted by an independently authored synthetic\nfixture witness.",
-            "properties": {
-              "claims": {
-                "items": {
-                  "$ref": "#/$defs/ClaimRef"
-                },
-                "type": "array"
-              },
-              "disclosure": {
-                "type": [
-                  "string",
-                  "null"
-                ]
-              },
-              "format": {
-                "type": [
-                  "string",
-                  "null"
-                ]
-              },
-              "purpose": {
-                "type": "string"
-              },
-              "requester": {
-                "anyOf": [
-                  {
-                    "$ref": "#/$defs/GovernedFixtureTarget"
-                  },
-                  {
-                    "type": "null"
-                  }
-                ]
-              },
-              "target": {
-                "$ref": "#/$defs/GovernedFixtureTarget"
-              },
-              "variables": {
-                "additionalProperties": {
-                  "type": "string"
-                },
-                "type": "object"
-              }
-            },
-            "required": [
-              "target",
-              "claims",
-              "purpose"
-            ],
-            "type": "object"
-          },
-          "GovernedFixtureTarget": {
-            "additionalProperties": false,
-            "properties": {
-              "attributes": {
-                "additionalProperties": true,
-                "type": "object"
-              },
-              "id": {
-                "type": [
-                  "string",
-                  "null"
-                ]
-              },
-              "identifiers": {
-                "items": {
-                  "$ref": "#/$defs/GovernedFixtureIdentifier"
-                },
-                "type": "array"
-              },
-              "type": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "type": "object"
-          },
           "ReadMethod": {
             "enum": [
               "GET",
               "POST"
             ],
             "type": "string"
-          },
-          "WireClaimRef": {
-            "anyOf": [
-              {
-                "type": "string"
-              },
-              {
-                "$ref": "#/$defs/ClaimRefObject"
-              }
-            ]
           }
         },
         "$schema": "https://json-schema.org/draft/2020-12/schema",
@@ -3976,17 +3296,6 @@
           "name": {
             "type": "string"
           },
-          "request": {
-            "anyOf": [
-              {
-                "$ref": "#/$defs/GovernedFixtureRequest"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "default": null
-          },
           "variables": {
             "additionalProperties": true,
             "default": {},
diff --git a/crates/registryctl/schemas/project-authoring/environment.schema.json b/crates/registryctl/schemas/project-authoring/environment.schema.json
index 4e9c3a1e6..6c39474c9 100644
--- a/crates/registryctl/schemas/project-authoring/environment.schema.json
+++ b/crates/registryctl/schemas/project-authoring/environment.schema.json
@@ -3,172 +3,329 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://registrystack.example/schemas/project-authoring/environment.v1.json",
   "title": "Registry Stack project environment v1",
-  "description": "Binds a Registry Stack project to environment-specific services, sources, credentials, and deployment topology.",
+  "description": "Binds a Registry Stack project to environment-specific Relay services, sources, credentials, and deployment topology.",
   "type": "object",
   "additionalProperties": false,
-  "required": ["version", "deployment"],
+  "required": [
+    "version",
+    "deployment"
+  ],
   "properties": {
-    "version": {"x-registry-field": "public_property", "const": 1, "description": "Environment authoring format version." },
+    "version": {
+      "x-registry-field": "public_property",
+      "const": 1,
+      "description": "Environment authoring format version."
+    },
     "development": {
       "x-registry-field": "property",
       "description": "Closed local-development selection. Registryctl uses the exact authored default and never prompts or guesses.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["source_mode", "default_integration", "default_fixture"],
+      "required": [
+        "source_mode",
+        "default_integration",
+        "default_fixture"
+      ],
       "properties": {
-        "source_mode": {"x-registry-field": "property", "enum": ["synthetic", "local_snapshot", "operator_bound"]},
-        "default_integration": {"x-registry-field": "property", "$ref": "#/$defs/stableId"},
-        "default_fixture": {"x-registry-field": "property", "$ref": "#/$defs/stableId"},
-        "relay_port": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 65535},
-        "notary_port": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 65535}
+        "source_mode": {
+          "x-registry-field": "property",
+          "enum": [
+            "synthetic",
+            "local_snapshot",
+            "operator_bound"
+          ]
+        },
+        "default_integration": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "default_fixture": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "relay_port": {
+          "x-registry-field": "property",
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 65535
+        }
       }
     },
-    "integrations": {"x-registry-field": "property", "type": "object", "maxProperties": 16, "description": "Environment bindings keyed by authored integration identifier.", "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/integration" } },
-    "entities": {"x-registry-field": "property", "type": "object", "maxProperties": 32, "description": "Environment-specific source bindings keyed by entity identifier.", "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/entity" } },
-    "issuance": {
+    "integrations": {
       "x-registry-field": "property",
-      "description": "Notary issuer and signing-key bindings for credential issuance.",
-      "type": "object", "additionalProperties": false, "required": ["issuer", "signing_key", "signing_kid", "generation"],
-      "properties": { "issuer": {"x-registry-field": "sensitive_property", "type": "string", "minLength": 1 }, "signing_key": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "signing_kid": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/token2048" }, "algorithm": {"x-registry-field": "property", "enum": ["EdDSA", "ES256"], "default": "EdDSA", "description": "Credential issuer signing algorithm. Holder proof remains EdDSA with did:jwk." }, "generation": {"x-registry-field": "sensitive_property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 } }
+      "type": "object",
+      "maxProperties": 16,
+      "description": "Environment bindings keyed by authored integration identifier.",
+      "propertyNames": {
+        "x-registry-field": "map_key",
+        "$ref": "#/$defs/stableId"
+      },
+      "additionalProperties": {
+        "x-registry-field": "map_value",
+        "$ref": "#/$defs/integration"
+      }
     },
-    "callers": {
+    "entities": {
       "x-registry-field": "property",
-      "description": "Notary API-key caller identities and the scopes each identity receives.",
-      "type": "object", "maxProperties": 64, "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" },
+      "type": "object",
+      "maxProperties": 32,
+      "description": "Environment-specific source bindings keyed by entity identifier.",
+      "propertyNames": {
+        "x-registry-field": "map_key",
+        "$ref": "#/$defs/stableId"
+      },
       "additionalProperties": {
         "x-registry-field": "map_value",
-        "type": "object", "additionalProperties": false, "required": ["api_key_fingerprint", "scopes"],
-        "properties": { "api_key_fingerprint": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "scopes": {"x-registry-field": "property", "type": "array", "minItems": 1, "maxItems": 16, "uniqueItems": true, "items": {"x-registry-field": "array_item", "type": "string", "minLength": 1, "maxLength": 128 } } }
+        "$ref": "#/$defs/entity"
       }
     },
     "relay": {
       "x-registry-field": "property",
       "description": "Public Relay identity and token-validation settings for a Relay deployment.",
-      "type": "object", "additionalProperties": false,
-      "required": ["origin", "issuer", "jwks_url", "audience", "allowed_clients"],
-      "properties": { "origin": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayOrigin" }, "issuer": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayOrigin" }, "jwks_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayResource" }, "audience": {"x-registry-field": "sensitive_property", "type": "string", "minLength": 1, "maxLength": 256 }, "allowed_clients": {"x-registry-field": "sensitive_property", "type": "array", "maxItems": 64, "uniqueItems": true, "items": {"x-registry-field": "array_item", "type": "string", "minLength": 1, "maxLength": 256 } }, "local_api_keys": {"x-registry-field": "property", "description": "Local-profile-only synthetic principals and scopes. Registryctl generates the raw keys and supplies only their fingerprints to Relay.", "type": "object", "additionalProperties": false, "required": ["match_principal", "no_match_principal", "scopes"], "properties": { "match_principal": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/token256" }, "no_match_principal": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/token256" }, "scopes": {"x-registry-field": "property", "type": "array", "minItems": 1, "maxItems": 16, "uniqueItems": true, "items": {"x-registry-field": "array_item", "type": "string", "minLength": 1, "maxLength": 128 } } } } }
-    },
-    "notary_relay": {
-      "x-registry-field": "property",
-      "description": "Deployment-internal Relay connection, Notary workload identity, and token file used only when Notary consults Relay.",
-      "type": "object", "additionalProperties": false, "required": ["base_url", "workload_client_id", "token_file"],
-      "properties": { "base_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/internalOrigin" }, "workload_client_id": {"x-registry-field": "sensitive_property", "type": "string", "minLength": 1, "maxLength": 256 }, "token_file": {"x-registry-field": "sensitive_property", "type": "string", "minLength": 2, "maxLength": 4096, "pattern": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" } }
-    },
-    "relay_state": {
-      "x-registry-field": "property",
-      "description": "Optional deployment binding for Relay-owned consultation PostgreSQL state transport trust.",
-      "type": "object", "additionalProperties": false, "required": ["postgresql"],
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "origin",
+        "issuer",
+        "jwks_url",
+        "audience",
+        "allowed_clients"
+      ],
       "properties": {
-        "postgresql": {
+        "origin": {
+          "x-registry-field": "sensitive_property",
+          "$ref": "#/$defs/relayOrigin"
+        },
+        "issuer": {
+          "x-registry-field": "sensitive_property",
+          "$ref": "#/$defs/relayOrigin"
+        },
+        "jwks_url": {
+          "x-registry-field": "sensitive_property",
+          "$ref": "#/$defs/relayResource"
+        },
+        "audience": {
+          "x-registry-field": "sensitive_property",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        },
+        "allowed_clients": {
+          "x-registry-field": "sensitive_property",
+          "type": "array",
+          "maxItems": 64,
+          "uniqueItems": true,
+          "items": {
+            "x-registry-field": "array_item",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256
+          }
+        },
+        "consultation": {
           "x-registry-field": "property",
-          "type": "object", "additionalProperties": false, "required": ["root_certificate_path"],
-          "properties": { "root_certificate_path": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/absolutePath" } }
+          "description": "Explicit Relay consultation workload identity. The client must also appear in allowed_clients; the principal is the stable authorization identity bound to that client.",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "client_id",
+            "principal_id"
+          ],
+          "properties": {
+            "client_id": {
+              "x-registry-field": "sensitive_property",
+              "description": "Token client identifier dedicated to the Relay consultation lane; it must also appear in the environment allowed-client list.",
+              "$ref": "#/$defs/token256"
+            },
+            "principal_id": {
+              "x-registry-field": "sensitive_property",
+              "description": "Stable authorization principal Relay binds to the dedicated consultation client.",
+              "$ref": "#/$defs/token256"
+            }
+          }
+        },
+        "local_api_keys": {
+          "x-registry-field": "property",
+          "description": "Local-profile-only synthetic principals and scopes. Registryctl generates the raw keys and supplies only their fingerprints to Relay.",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "match_principal",
+            "no_match_principal",
+            "scopes"
+          ],
+          "properties": {
+            "match_principal": {
+              "x-registry-field": "sensitive_property",
+              "$ref": "#/$defs/token256"
+            },
+            "no_match_principal": {
+              "x-registry-field": "sensitive_property",
+              "$ref": "#/$defs/token256"
+            },
+            "scopes": {
+              "x-registry-field": "property",
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 16,
+              "uniqueItems": true,
+              "items": {
+                "x-registry-field": "array_item",
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 128
+              }
+            }
+          }
         }
       }
     },
-    "notary_state": {
+    "relay_state": {
       "x-registry-field": "property",
-      "description": "Optional deployment binding for Notary-owned PostgreSQL state transport trust.",
-      "type": "object", "additionalProperties": false, "required": ["postgresql"],
+      "description": "Optional deployment binding for Relay-owned consultation PostgreSQL state transport trust.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "postgresql"
+      ],
       "properties": {
         "postgresql": {
           "x-registry-field": "property",
-          "type": "object", "additionalProperties": false, "required": ["root_certificate_path"],
-          "properties": { "root_certificate_path": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/absolutePath" } }
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "root_certificate_path"
+          ],
+          "properties": {
+            "root_certificate_path": {
+              "x-registry-field": "sensitive_property",
+              "$ref": "#/$defs/absolutePath"
+            }
+          }
         }
       }
     },
-    "notary_cel": {
+    "deployment": {
       "x-registry-field": "property",
-      "description": "Optional per-worker data/address-space ceiling for dedicated Notary CEL processes. The Notary default is 134217728 bytes; 1073741824 is the maximum emulation-compatible exception and remains a limit, not an allocation.",
-      "type": "object", "additionalProperties": false, "required": ["worker_memory_bytes"],
+      "description": "Relay deployed in this environment and the operational profile it uses.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "profile",
+        "relay"
+      ],
       "properties": {
-        "worker_memory_bytes": {"x-registry-field": "property", "type": "integer", "minimum": 33554432, "maximum": 1073741824 }
+        "profile": {
+          "x-registry-field": "property",
+          "enum": [
+            "local",
+            "hosted_lab",
+            "production"
+          ]
+        },
+        "relay": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/service"
+        }
       }
-    },
-    "oid4vci": {
-      "x-registry-field": "property",
-      "description": "Explicit registry-backed holder-wallet OID4VCI binding for one authored Notary credential profile.",
-      "$ref": "#/$defs/oid4vci"
-    },
-    "deployment": {
-      "x-registry-field": "property",
-      "description": "Products deployed in this environment and the operational profile they use.",
-      "type": "object", "additionalProperties": false, "required": ["profile"],
-      "properties": { "profile": {"x-registry-field": "property", "enum": ["local", "hosted_lab", "production", "evidence_grade"] }, "relay": {"x-registry-field": "property", "$ref": "#/$defs/service" }, "notary": {"x-registry-field": "property", "$ref": "#/$defs/service" } },
-      "anyOf": [{"x-registry-field": "branch", "required": ["relay"] }, {"x-registry-field": "branch", "required": ["notary"] }]
     }
   },
   "allOf": [
     {
       "x-registry-field": "branch",
-      "if": {"x-registry-field": "branch", "required": ["deployment"], "properties": { "deployment": {"x-registry-field": "property", "required": ["relay"] } } },
-      "then": {"x-registry-field": "branch", "required": ["relay"] },
-      "else": {"x-registry-field": "branch", "not": {"x-registry-field": "branch", "required": ["relay"] } }
-    },
-    {
-      "x-registry-field": "branch",
-      "if": {"x-registry-field": "branch", "required": ["notary_relay"] },
-      "then": {"x-registry-field": "branch", "properties": { "deployment": {"x-registry-field": "property", "required": ["relay", "notary"] } } }
-    },
-    {
-      "x-registry-field": "branch",
-      "if": {"x-registry-field": "branch", "required": ["relay_state"] },
-      "then": {"x-registry-field": "branch", "properties": { "deployment": {"x-registry-field": "property", "required": ["relay"] } } }
-    },
-    {
-      "x-registry-field": "branch",
-      "if": {"x-registry-field": "branch", "required": ["notary_state"] },
-      "then": {"x-registry-field": "branch", "properties": { "deployment": {"x-registry-field": "property", "required": ["notary"] } } }
-    },
-    {
-      "x-registry-field": "branch",
-      "if": {"x-registry-field": "branch", "required": ["notary_cel"] },
-      "then": {"x-registry-field": "branch", "properties": { "deployment": {"x-registry-field": "property", "required": ["notary"] } } }
+      "if": {
+        "x-registry-field": "branch",
+        "required": [
+          "deployment"
+        ],
+        "properties": {
+          "deployment": {
+            "x-registry-field": "property",
+            "required": [
+              "relay"
+            ]
+          }
+        }
+      },
+      "then": {
+        "x-registry-field": "branch",
+        "required": [
+          "relay"
+        ]
+      },
+      "else": {
+        "x-registry-field": "branch",
+        "not": {
+          "x-registry-field": "branch",
+          "required": [
+            "relay"
+          ]
+        }
+      }
     },
     {
       "x-registry-field": "branch",
-      "if": {"x-registry-field": "branch", "required": ["oid4vci"] },
+      "if": {
+        "x-registry-field": "branch",
+        "required": [
+          "relay_state"
+        ]
+      },
       "then": {
         "x-registry-field": "branch",
-        "required": ["notary_state"],
         "properties": {
-          "deployment": {"x-registry-field": "property", "required": ["notary"] }
+          "deployment": {
+            "x-registry-field": "property",
+            "required": [
+              "relay"
+            ]
+          }
         }
-      },
-      "else": {"x-registry-field": "branch", "properties": { "callers": {"x-registry-field": "property", "minProperties": 1 } } }
+      }
     },
     {
       "x-registry-field": "branch",
-      "if": {"x-registry-field": "branch", "properties": { "deployment": {"x-registry-field": "property", "required": ["profile"], "properties": { "profile": {"x-registry-field": "property", "const": "local" } } } } },
-      "else": {
+      "if": {
         "x-registry-field": "branch",
         "properties": {
-          "relay": {
+          "deployment": {
             "x-registry-field": "property",
-            "not": {"x-registry-field": "branch", "required": ["local_api_keys"] },
+            "required": [
+              "profile"
+            ],
             "properties": {
-              "origin": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/origin" },
-              "issuer": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/origin" },
-              "jwks_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/httpsResource" }
+              "profile": {
+                "x-registry-field": "property",
+                "const": "local"
+              }
             }
-          },
-          "oid4vci": {
+          }
+        }
+      },
+      "else": {
+        "x-registry-field": "branch",
+        "properties": {
+          "relay": {
             "x-registry-field": "property",
+            "not": {
+              "x-registry-field": "branch",
+              "required": [
+                "local_api_keys"
+              ]
+            },
             "properties": {
-              "public_base_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/origin" },
-              "redirect_uri": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/httpsResource" },
-              "authorization_server": {
-                "x-registry-field": "property",
-                "properties": {
-                  "issuer": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/origin" },
-                  "jwks_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/httpsResource" },
-                  "userinfo_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/httpsResource" },
-                  "authorize_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/httpsResource" },
-                  "token_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/httpsResource" }
-                }
+              "origin": {
+                "x-registry-field": "sensitive_property",
+                "$ref": "#/$defs/origin"
+              },
+              "issuer": {
+                "x-registry-field": "sensitive_property",
+                "$ref": "#/$defs/origin"
               },
-              "representative_issuance": {"x-registry-field": "property" }
+              "jwks_url": {
+                "x-registry-field": "sensitive_property",
+                "$ref": "#/$defs/httpsResource"
+              }
             }
           }
         }
@@ -178,185 +335,533 @@
   "examples": [
     {
       "version": 1,
+      "relay": {
+        "origin": "http://127.0.0.1:8080",
+        "issuer": "http://127.0.0.1:9090",
+        "jwks_url": "http://127.0.0.1:9090/.well-known/jwks.json",
+        "audience": "registry-relay",
+        "allowed_clients": [
+          "relay-client"
+        ]
+      },
       "deployment": {
         "profile": "local",
-        "notary": { "service": "notary" }
+        "relay": {
+          "service": "relay"
+        }
       }
     }
   ],
   "$defs": {
-    "stableId": { "type": "string", "pattern": "^[a-z][a-z0-9._-]{0,95}$", "description": "Lowercase stable identifier used in project references." },
-    "token2048": { "type": "string", "minLength": 1, "maxLength": 2048, "pattern": "^[!-~]+$", "description": "Bounded visible-ASCII token, including full verification-method identifiers." },
-    "secret": { "type": "object", "additionalProperties": false, "description": "Reference to a process-environment variable; secret values are never authored here.", "required": ["secret"], "properties": { "secret": {"x-registry-field": "secret_reference_property", "type": "string", "pattern": "^[A-Z_][A-Z0-9_]{0,127}$" } } },
-    "origin": { "type": "string", "format": "uri", "pattern": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$", "description": "HTTPS origin without path, query, or fragment." },
-    "httpsResource": { "type": "string", "format": "uri", "pattern": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$", "description": "Exact HTTPS resource without query or fragment." },
-    "localLoopbackOrigin": { "type": "string", "format": "uri", "pattern": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$", "description": "HTTP IP-loopback origin; public Relay and issuer fields restrict it to the local profile, while internal Notary-to-Relay connections allow it in any profile." },
-    "privateServiceOrigin": { "type": "string", "format": "uri", "pattern": "^[hH][tT][tT][pP]://[a-z][a-z0-9.-]{0,252}(?::[0-9]+)?/?$", "description": "Signed internal HTTP service origin. Runtime DNS pinning admits only eligible private addresses." },
-    "localLoopbackResource": { "type": "string", "format": "uri", "pattern": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/[^?#]+$", "description": "HTTP IP-loopback resource accepted only with the local deployment profile." },
-    "internalOrigin": { "description": "Deployment-internal HTTPS, private-service HTTP, or HTTP IP-loopback origin.", "anyOf": [{"x-registry-field": "branch", "$ref": "#/$defs/origin" }, {"x-registry-field": "branch", "$ref": "#/$defs/privateServiceOrigin" }, {"x-registry-field": "branch", "$ref": "#/$defs/localLoopbackOrigin" }] },
-    "relayOrigin": { "description": "Relay or issuer origin using HTTPS, or HTTP IP-loopback under the local profile.", "anyOf": [{"x-registry-field": "branch", "$ref": "#/$defs/origin" }, {"x-registry-field": "branch", "$ref": "#/$defs/localLoopbackOrigin" }] },
-    "relayResource": { "description": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.", "anyOf": [{"x-registry-field": "branch", "$ref": "#/$defs/httpsResource" }, {"x-registry-field": "branch", "$ref": "#/$defs/localLoopbackResource" }] },
-    "oid4vci": {
-      "description": "Closed OID4VCI trust, key, subject, wallet, and credential-profile binding.",
+    "stableId": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9._-]{0,95}$",
+      "description": "Lowercase stable identifier used in project references."
+    },
+    "secret": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["public_base_url", "credential", "authorization_server", "client", "access_token", "sensitive_state_key", "subject", "redirect_uri", "allowed_wallet_origins"],
+      "description": "Reference to a process-environment variable; secret values are never authored here.",
+      "required": [
+        "secret"
+      ],
       "properties": {
-        "public_base_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayOrigin" },
-        "credential": {
-          "x-registry-field": "property",
-          "description": "Existing project service and credential profile exposed through OID4VCI.",
-          "type": "object", "additionalProperties": false, "required": ["service", "profile"],
-          "properties": {
-            "service": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-            "profile": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }
-          }
-        },
-        "authorization_server": {
-          "x-registry-field": "property",
-          "description": "Pinned eSignet issuer and exact endpoints used for login and token validation.",
-          "type": "object", "additionalProperties": false, "required": ["issuer", "jwks_url", "userinfo_url", "authorize_url", "token_url"],
-          "properties": {
-            "issuer": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayOrigin" },
-            "jwks_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayResource" },
-            "userinfo_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayResource" },
-            "authorize_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayResource" },
-            "token_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayResource" }
-          }
-        },
-        "client": {
-          "x-registry-field": "property",
-          "description": "eSignet relying-party identity and dedicated private-key reference.",
-          "type": "object", "additionalProperties": false, "required": ["id", "signing_key", "signing_kid"],
-          "properties": {
-            "id": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/token256" },
-            "signing_key": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" },
-            "signing_kid": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/token2048" }
-          }
-        },
-        "registrar_clients": {
-          "x-registry-field": "sensitive_property",
-          "description": "Closed OIDC machine-client allow-list for registrar-created credential offers. Each client uses this authorization server and the Notary public base URL as its resource audience; citizen client classification remains separate.",
-          "type": "array", "maxItems": 64, "uniqueItems": true, "default": [],
-          "items": {"x-registry-field": "sensitive_array_item", "$ref": "#/$defs/token256" }
-        },
-        "access_token": {
-          "x-registry-field": "property",
-          "description": "Dedicated Notary access-token signing key and published key identifier.",
-          "type": "object", "additionalProperties": false, "required": ["signing_key", "signing_kid"],
-          "properties": {
-            "signing_key": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" },
-            "signing_kid": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/token2048" }
-          }
-        },
-        "sensitive_state_key": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" },
-        "subject": {
-          "x-registry-field": "property",
-          "description": "Verified eSignet userinfo claim bound exactly to the credential subject identifier.",
-          "type": "object", "additionalProperties": false, "required": ["token_claim", "id_type"],
-          "properties": {
-            "token_claim": {"x-registry-field": "property", "$ref": "#/$defs/token256" },
-            "id_type": {"x-registry-field": "property", "$ref": "#/$defs/token256" }
-          }
-        },
-        "redirect_uri": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayResource" },
-        "allowed_wallet_origins": {
-          "x-registry-field": "sensitive_property",
-          "description": "Exact HTTPS browser origins admitted to the wallet-facing Notary routes.",
-          "type": "array", "minItems": 1, "maxItems": 16, "uniqueItems": true,
-          "items": {"x-registry-field": "sensitive_array_item", "$ref": "#/$defs/origin" }
+        "secret": {
+          "x-registry-field": "secret_reference_property",
+          "type": "string",
+          "pattern": "^[A-Z_][A-Z0-9_]{0,127}$"
+        }
+      }
+    },
+    "origin": {
+      "type": "string",
+      "format": "uri",
+      "pattern": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$",
+      "description": "HTTPS origin without path, query, or fragment."
+    },
+    "httpsResource": {
+      "type": "string",
+      "format": "uri",
+      "pattern": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$",
+      "description": "Exact HTTPS resource without query or fragment."
+    },
+    "localLoopbackOrigin": {
+      "type": "string",
+      "format": "uri",
+      "pattern": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$",
+      "description": "HTTP IP-loopback origin accepted only under the local profile."
+    },
+    "localLoopbackResource": {
+      "type": "string",
+      "format": "uri",
+      "pattern": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/[^?#]+$",
+      "description": "HTTP IP-loopback resource accepted only with the local deployment profile."
+    },
+    "relayOrigin": {
+      "description": "Relay or issuer origin using HTTPS, or HTTP IP-loopback under the local profile.",
+      "anyOf": [
+        {
+          "x-registry-field": "branch",
+          "$ref": "#/$defs/origin"
         },
-        "tx_code": {
-          "x-registry-field": "property",
-          "description": "Transaction-code policy. Omit for the secure required-PIN default. Set required=false only for a bounded bearer-offer interoperability profile; the compiler fixes the offer lifetime at 300 seconds.",
-          "type": "object", "additionalProperties": false,
-          "properties": { "required": {"x-registry-field": "property", "type": "boolean", "default": true } }
+        {
+          "x-registry-field": "branch",
+          "$ref": "#/$defs/localLoopbackOrigin"
+        }
+      ]
+    },
+    "relayResource": {
+      "description": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.",
+      "anyOf": [
+        {
+          "x-registry-field": "branch",
+          "$ref": "#/$defs/httpsResource"
         },
-        "representative_issuance": {
-          "x-registry-field": "property",
-          "description": "One digitally authenticated representative ceremony bound to an exact relationship proof. Registryctl derives the credential dependency, status endpoint, and secure proof-freshness default.",
-          "type": "object",
-          "additionalProperties": false,
-          "required": ["relationship", "proof_claim", "target_id_type"],
-          "properties": {
-            "relationship": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-            "proof_claim": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-            "target_id_type": {"x-registry-field": "property", "$ref": "#/$defs/token256" },
-            "max_proof_age_seconds": {
-              "x-registry-field": "property",
-              "description": "Maximum age of the relationship proof. Omit for the secure 300-second default.",
-              "type": "integer",
-              "minimum": 1,
-              "maximum": 600,
-              "default": 300
-            }
-          }
+        {
+          "x-registry-field": "branch",
+          "$ref": "#/$defs/localLoopbackResource"
         }
-      }
+      ]
     },
     "privateCidrs": {
       "description": "Explicit private network ranges this source may resolve to.",
-      "type": "array", "maxItems": 16, "uniqueItems": true,
-      "items": {"x-registry-field": "sensitive_array_item", "type": "string", "minLength": 3, "maxLength": 64 }
+      "type": "array",
+      "maxItems": 16,
+      "uniqueItems": true,
+      "items": {
+        "x-registry-field": "sensitive_array_item",
+        "type": "string",
+        "minLength": 3,
+        "maxLength": 64
+      }
     },
     "ca": {
       "description": "Pinned certificate-authority file and its rotation generation.",
-      "type": "object", "additionalProperties": false, "required": ["file", "generation"],
-      "properties": { "file": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/absolutePath" }, "generation": {"x-registry-field": "sensitive_property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 } }
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "file",
+        "generation"
+      ],
+      "properties": {
+        "file": {
+          "x-registry-field": "sensitive_property",
+          "$ref": "#/$defs/absolutePath"
+        },
+        "generation": {
+          "x-registry-field": "sensitive_property",
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 18446744073709551615
+        }
+      }
     },
     "mtls": {
       "description": "Client certificate and private-key reference for mutual TLS.",
-      "type": "object", "additionalProperties": false, "required": ["certificate_file", "private_key", "generation"],
-      "properties": { "certificate_file": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/absolutePath" }, "private_key": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "generation": {"x-registry-field": "sensitive_property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 } }
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "certificate_file",
+        "private_key",
+        "generation"
+      ],
+      "properties": {
+        "certificate_file": {
+          "x-registry-field": "sensitive_property",
+          "$ref": "#/$defs/absolutePath"
+        },
+        "private_key": {
+          "x-registry-field": "secret_reference_property",
+          "$ref": "#/$defs/secret"
+        },
+        "generation": {
+          "x-registry-field": "sensitive_property",
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 18446744073709551615
+        }
+      }
     },
     "endpoint": {
       "description": "Security-bound HTTPS endpoint with optional private-network, CA, and mTLS policy.",
-      "type": "object", "additionalProperties": false, "required": ["origin", "path", "generation"],
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "origin",
+        "path",
+        "generation"
+      ],
       "properties": {
-        "origin": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/origin" },
-        "path": {"x-registry-field": "sensitive_property", "type": "string", "minLength": 2, "maxLength": 4096, "pattern": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//)(?!.*[?#]).+$" },
-        "allowed_private_cidrs": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/privateCidrs" },
-        "ca": {"x-registry-field": "property", "$ref": "#/$defs/ca" },
-        "mtls": {"x-registry-field": "property", "$ref": "#/$defs/mtls" },
-        "generation": {"x-registry-field": "sensitive_property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 }
+        "origin": {
+          "x-registry-field": "sensitive_property",
+          "$ref": "#/$defs/origin"
+        },
+        "path": {
+          "x-registry-field": "sensitive_property",
+          "type": "string",
+          "minLength": 2,
+          "maxLength": 4096,
+          "pattern": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//)(?!.*[?#]).+$"
+        },
+        "allowed_private_cidrs": {
+          "x-registry-field": "sensitive_property",
+          "$ref": "#/$defs/privateCidrs"
+        },
+        "ca": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/ca"
+        },
+        "mtls": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/mtls"
+        },
+        "generation": {
+          "x-registry-field": "sensitive_property",
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 18446744073709551615
+        }
       }
     },
     "credential": {
       "description": "One supported source credential shape, containing references rather than values.",
       "oneOf": [
-        {"x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["username", "password", "generation"], "properties": { "username": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "password": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "generation": {"x-registry-field": "sensitive_property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 } } },
-        {"x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["token", "generation"], "properties": { "token": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "generation": {"x-registry-field": "sensitive_property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 } } },
-        {"x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["client_id", "client_secret", "generation"], "properties": { "client_id": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "client_secret": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "generation": {"x-registry-field": "sensitive_property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 } } },
-        {"x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["value", "generation"], "properties": { "value": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "generation": {"x-registry-field": "sensitive_property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 } } }
+        {
+          "x-registry-field": "branch",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "username",
+            "password",
+            "generation"
+          ],
+          "properties": {
+            "username": {
+              "x-registry-field": "secret_reference_property",
+              "$ref": "#/$defs/secret"
+            },
+            "password": {
+              "x-registry-field": "secret_reference_property",
+              "$ref": "#/$defs/secret"
+            },
+            "generation": {
+              "x-registry-field": "sensitive_property",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 18446744073709551615
+            }
+          }
+        },
+        {
+          "x-registry-field": "branch",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "token",
+            "generation"
+          ],
+          "properties": {
+            "token": {
+              "x-registry-field": "secret_reference_property",
+              "$ref": "#/$defs/secret"
+            },
+            "generation": {
+              "x-registry-field": "sensitive_property",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 18446744073709551615
+            }
+          }
+        },
+        {
+          "x-registry-field": "branch",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "client_id",
+            "client_secret",
+            "generation"
+          ],
+          "properties": {
+            "client_id": {
+              "x-registry-field": "secret_reference_property",
+              "$ref": "#/$defs/secret"
+            },
+            "client_secret": {
+              "x-registry-field": "secret_reference_property",
+              "$ref": "#/$defs/secret"
+            },
+            "generation": {
+              "x-registry-field": "sensitive_property",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 18446744073709551615
+            }
+          }
+        },
+        {
+          "x-registry-field": "branch",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "value",
+            "generation"
+          ],
+          "properties": {
+            "value": {
+              "x-registry-field": "secret_reference_property",
+              "$ref": "#/$defs/secret"
+            },
+            "generation": {
+              "x-registry-field": "sensitive_property",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 18446744073709551615
+            }
+          }
+        }
       ]
     },
     "provider": {
       "description": "Environment-specific physical provider for a materialized entity.",
       "oneOf": [
-        {"x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["type", "path"], "properties": { "type": {"x-registry-field": "property", "const": "csv" }, "path": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/absolutePath" }, "header_row": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 4294967295 }, "delimiter": {"x-registry-field": "property", "type": "integer", "minimum": 0, "maximum": 255 }, "quote": {"x-registry-field": "property", "type": "integer", "minimum": 0, "maximum": 255 } } },
-        {"x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["type", "project_file", "path", "sheet"], "properties": { "type": {"x-registry-field": "property", "const": "xlsx" }, "project_file": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relativePath" }, "path": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/absolutePath" }, "sheet": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 256 }, "header_row": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 4294967295 }, "data_range": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 256 } } },
-        {"x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["type", "path"], "properties": { "type": {"x-registry-field": "property", "const": "parquet" }, "path": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/absolutePath" } } },
-        {"x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["type", "connection", "schema", "table"], "properties": { "type": {"x-registry-field": "property", "const": "postgres" }, "connection": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "schema": {"x-registry-field": "property", "$ref": "#/$defs/postgresIdentifier" }, "table": {"x-registry-field": "property", "$ref": "#/$defs/postgresIdentifier" } } }
+        {
+          "x-registry-field": "branch",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "type",
+            "path"
+          ],
+          "properties": {
+            "type": {
+              "x-registry-field": "property",
+              "const": "csv"
+            },
+            "path": {
+              "x-registry-field": "sensitive_property",
+              "$ref": "#/$defs/absolutePath"
+            },
+            "header_row": {
+              "x-registry-field": "property",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 4294967295
+            },
+            "delimiter": {
+              "x-registry-field": "property",
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 255
+            },
+            "quote": {
+              "x-registry-field": "property",
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 255
+            }
+          }
+        },
+        {
+          "x-registry-field": "branch",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "type",
+            "project_file",
+            "path",
+            "sheet"
+          ],
+          "properties": {
+            "type": {
+              "x-registry-field": "property",
+              "const": "xlsx"
+            },
+            "project_file": {
+              "x-registry-field": "sensitive_property",
+              "$ref": "#/$defs/relativePath"
+            },
+            "path": {
+              "x-registry-field": "sensitive_property",
+              "$ref": "#/$defs/absolutePath"
+            },
+            "sheet": {
+              "x-registry-field": "property",
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 256
+            },
+            "header_row": {
+              "x-registry-field": "property",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 4294967295
+            },
+            "data_range": {
+              "x-registry-field": "property",
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 256
+            }
+          }
+        },
+        {
+          "x-registry-field": "branch",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "type",
+            "path"
+          ],
+          "properties": {
+            "type": {
+              "x-registry-field": "property",
+              "const": "parquet"
+            },
+            "path": {
+              "x-registry-field": "sensitive_property",
+              "$ref": "#/$defs/absolutePath"
+            }
+          }
+        },
+        {
+          "x-registry-field": "branch",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "type",
+            "connection",
+            "schema",
+            "table"
+          ],
+          "properties": {
+            "type": {
+              "x-registry-field": "property",
+              "const": "postgres"
+            },
+            "connection": {
+              "x-registry-field": "secret_reference_property",
+              "$ref": "#/$defs/secret"
+            },
+            "schema": {
+              "x-registry-field": "property",
+              "$ref": "#/$defs/postgresIdentifier"
+            },
+            "table": {
+              "x-registry-field": "property",
+              "$ref": "#/$defs/postgresIdentifier"
+            }
+          }
+        }
       ]
     },
     "entity": {
       "description": "Maps an authored entity to provider columns and immutable source-generation identifiers.",
-      "type": "object", "additionalProperties": false, "required": ["provider", "columns", "source_revision", "generation"],
-      "properties": { "provider": {"x-registry-field": "property", "$ref": "#/$defs/provider" }, "columns": {"x-registry-field": "property", "type": "object", "minProperties": 1, "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/stableId" } }, "source_revision": {"x-registry-field": "sensitive_property", "type": "string", "minLength": 1, "maxLength": 256 }, "generation": {"x-registry-field": "sensitive_property", "type": "string", "minLength": 1, "maxLength": 256 } }
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "provider",
+        "columns",
+        "source_revision",
+        "generation"
+      ],
+      "properties": {
+        "provider": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/provider"
+        },
+        "columns": {
+          "x-registry-field": "property",
+          "type": "object",
+          "minProperties": 1,
+          "propertyNames": {
+            "x-registry-field": "map_key",
+            "$ref": "#/$defs/stableId"
+          },
+          "additionalProperties": {
+            "x-registry-field": "map_value",
+            "$ref": "#/$defs/stableId"
+          }
+        },
+        "source_revision": {
+          "x-registry-field": "sensitive_property",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        },
+        "generation": {
+          "x-registry-field": "sensitive_property",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        }
+      }
     },
     "source": {
       "description": "Runtime source connection policy for one authored integration.",
-      "type": "object", "additionalProperties": false, "required": ["origin"],
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "origin"
+      ],
       "properties": {
-        "origin": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/origin" },
-        "allowed_private_cidrs": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/privateCidrs" },
-        "ca": {"x-registry-field": "property", "$ref": "#/$defs/ca" },
-        "mtls": {"x-registry-field": "property", "$ref": "#/$defs/mtls" },
-        "credential": {"x-registry-field": "property", "$ref": "#/$defs/credential" },
-        "oauth": {"x-registry-field": "property", "$ref": "#/$defs/endpoint" },
-        "jwks": {"x-registry-field": "property", "$ref": "#/$defs/endpoint" },
-        "rate": {"x-registry-field": "property", "type": "object", "additionalProperties": false, "required": ["per_minute", "burst"], "properties": { "per_minute": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 60000 }, "burst": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 1024 } } },
-        "concurrency": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 64 },
+        "origin": {
+          "x-registry-field": "sensitive_property",
+          "$ref": "#/$defs/origin"
+        },
+        "allowed_private_cidrs": {
+          "x-registry-field": "sensitive_property",
+          "$ref": "#/$defs/privateCidrs"
+        },
+        "ca": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/ca"
+        },
+        "mtls": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/mtls"
+        },
+        "credential": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/credential"
+        },
+        "oauth": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/endpoint"
+        },
+        "jwks": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/endpoint"
+        },
+        "rate": {
+          "x-registry-field": "property",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "per_minute",
+            "burst"
+          ],
+          "properties": {
+            "per_minute": {
+              "x-registry-field": "property",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 60000
+            },
+            "burst": {
+              "x-registry-field": "property",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 1024
+            }
+          }
+        },
+        "concurrency": {
+          "x-registry-field": "property",
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 64
+        },
         "timeout": {
           "x-registry-field": "property",
           "description": "Optional request timeout no greater than 20 seconds; generated bindings narrow it to the integration deadline.",
@@ -367,13 +872,57 @@
     },
     "integration": {
       "description": "Environment binding for an authored source integration.",
-      "type": "object", "additionalProperties": false, "required": ["source"],
-      "properties": { "source": {"x-registry-field": "property", "$ref": "#/$defs/source" } }
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "source"
+      ],
+      "properties": {
+        "source": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/source"
+        }
+      }
     },
-    "service": { "type": "object", "additionalProperties": false, "description": "Binds an authored product role to a deployed service identifier.", "required": ["service"], "properties": { "service": {"x-registry-field": "property", "$ref": "#/$defs/stableId" } } },
-    "token256": { "type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[!-~]+$", "description": "Bounded visible-ASCII protocol token." },
-    "postgresIdentifier": { "type": "string", "pattern": "^[a-z][a-z0-9_]{0,62}$", "description": "Portable unquoted PostgreSQL schema or table identifier." },
-    "absolutePath": { "type": "string", "minLength": 2, "maxLength": 4096, "pattern": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$", "description": "Normalized absolute path without dot segments or duplicate separators." },
-    "relativePath": { "type": "string", "minLength": 1, "maxLength": 4096, "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$", "description": "Normalized project-relative path without dot segments or duplicate separators." }
+    "service": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Binds an authored product role to a deployed service identifier.",
+      "required": [
+        "service"
+      ],
+      "properties": {
+        "service": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        }
+      }
+    },
+    "token256": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "pattern": "^[!-~]+$",
+      "description": "Bounded visible-ASCII protocol token."
+    },
+    "postgresIdentifier": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9_]{0,62}$",
+      "description": "Portable unquoted PostgreSQL schema or table identifier."
+    },
+    "absolutePath": {
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 4096,
+      "pattern": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$",
+      "description": "Normalized absolute path without dot segments or duplicate separators."
+    },
+    "relativePath": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 4096,
+      "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$",
+      "description": "Normalized project-relative path without dot segments or duplicate separators."
+    }
   }
 }
diff --git a/crates/registryctl/schemas/project-authoring/fixture.schema.json b/crates/registryctl/schemas/project-authoring/fixture.schema.json
index 79b5b7c34..067e8196e 100644
--- a/crates/registryctl/schemas/project-authoring/fixture.schema.json
+++ b/crates/registryctl/schemas/project-authoring/fixture.schema.json
@@ -6,14 +6,28 @@
   "description": "Defines one synthetic, deterministic integration scenario for offline adapter verification.",
   "type": "object",
   "additionalProperties": false,
-  "required": ["name", "classification", "input", "interactions", "expect"],
+  "required": [
+    "name",
+    "classification",
+    "input",
+    "interactions",
+    "expect"
+  ],
   "properties": {
-    "name": {"x-registry-field": "public_property", "type": "string", "minLength": 1, "maxLength": 256, "description": "Human-readable scenario name shown in test output.", "examples": ["existing household matches"] },
-    "classification": {"x-registry-field": "public_property", "const": "synthetic", "description": "Declares that fixture data is synthetic and safe for offline testing." },
-    "request": {
-      "x-registry-field": "redacted_fixture_property",
-      "$ref": "#/$defs/governedRequest",
-      "description": "Optional independently authored synthetic Notary request used to prove the request-to-consultation binding before Relay access."
+    "name": {
+      "x-registry-field": "public_property",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "Human-readable scenario name shown in test output.",
+      "examples": [
+        "existing household matches"
+      ]
+    },
+    "classification": {
+      "x-registry-field": "public_property",
+      "const": "synthetic",
+      "description": "Declares that fixture data is synthetic and safe for offline testing."
     },
     "input": {
       "x-registry-field": "redacted_fixture_property",
@@ -21,10 +35,18 @@
       "type": "object",
       "minProperties": 1,
       "maxProperties": 16,
-      "propertyNames": {"x-registry-field": "redacted_fixture_map_key", "pattern": "^[a-z][a-z0-9_]{0,63}$" },
+      "propertyNames": {
+        "x-registry-field": "redacted_fixture_map_key",
+        "pattern": "^[a-z][a-z0-9_]{0,63}$"
+      },
       "additionalProperties": {
         "x-registry-field": "redacted_fixture_map_value",
-        "type": ["string", "boolean", "integer", "null"]
+        "type": [
+          "string",
+          "boolean",
+          "integer",
+          "null"
+        ]
       }
     },
     "variables": {
@@ -32,8 +54,15 @@
       "description": "Named date values available to deterministic fixture interpolation.",
       "type": "object",
       "maxProperties": 16,
-      "propertyNames": {"x-registry-field": "redacted_fixture_map_key", "pattern": "^[a-z][a-z0-9._-]{0,95}$" },
-      "additionalProperties": {"x-registry-field": "redacted_fixture_map_value", "type": "string", "format": "date" }
+      "propertyNames": {
+        "x-registry-field": "redacted_fixture_map_key",
+        "pattern": "^[a-z][a-z0-9._-]{0,95}$"
+      },
+      "additionalProperties": {
+        "x-registry-field": "redacted_fixture_map_value",
+        "type": "string",
+        "format": "date"
+      }
     },
     "interactions": {
       "x-registry-field": "redacted_fixture_property",
@@ -41,126 +70,89 @@
       "type": "array",
       "minItems": 1,
       "maxItems": 16,
-      "items": {"x-registry-field": "redacted_fixture_array_item", "$ref": "#/$defs/interaction" }
+      "items": {
+        "x-registry-field": "redacted_fixture_array_item",
+        "$ref": "#/$defs/interaction"
+      }
     },
-    "expect": {"x-registry-field": "redacted_fixture_property", "$ref": "#/$defs/expectation", "description": "Observable adapter result required for the scenario to pass." }
+    "expect": {
+      "x-registry-field": "redacted_fixture_property",
+      "$ref": "#/$defs/expectation",
+      "description": "Observable adapter result required for the scenario to pass."
+    }
   },
   "examples": [
     {
       "name": "existing household matches",
       "classification": "synthetic",
-      "input": { "household_id": "HH-1001" },
+      "input": {
+        "household_id": "HH-1001"
+      },
       "interactions": [
         {
-          "expect": { "method": "GET", "path": "/households/HH-1001" },
-          "respond": { "status": 200, "body": { "active": true } }
+          "expect": {
+            "method": "GET",
+            "path": "/households/HH-1001"
+          },
+          "respond": {
+            "status": 200,
+            "body": {
+              "active": true
+            }
+          }
         }
       ],
-      "expect": { "outcome": "match", "outputs": { "active": true } }
+      "expect": {
+        "outcome": "match",
+        "outputs": {
+          "active": true
+        }
+      }
     }
   ],
   "$defs": {
-    "governedRequest": {
-      "description": "The closed governed request shape for an independently authored synthetic fixture witness.",
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["target", "claims", "purpose"],
-      "properties": {
-        "requester": {
-          "x-registry-field": "redacted_fixture_property",
-          "$ref": "#/$defs/governedTarget",
-          "description": "Supplies a synthetic authenticated requester when selected consultation mappings read requester identifiers."
-        },
-        "target": {"x-registry-field": "redacted_fixture_property", "$ref": "#/$defs/governedTarget" },
-        "variables": {
-          "x-registry-field": "redacted_fixture_property",
-          "description": "Supplies synthetic date variables to the governed evaluation request.",
-          "type": "object",
-          "maxProperties": 16,
-          "propertyNames": {"x-registry-field": "redacted_fixture_map_key", "pattern": "^[a-z][a-z0-9._-]{0,95}$" },
-          "additionalProperties": {"x-registry-field": "redacted_fixture_map_value", "type": "string", "format": "date" }
-        },
-        "claims": {
-          "x-registry-field": "redacted_fixture_property",
-          "description": "Lists the authored claims evaluated by this synthetic request witness.",
-          "type": "array",
-          "minItems": 1,
-          "maxItems": 64,
-          "items": {"x-registry-field": "redacted_fixture_array_item", "$ref": "#/$defs/governedClaimRef" }
-        },
-        "disclosure": {"x-registry-field": "redacted_fixture_property", "type": "string", "description": "Selects the disclosure mode requested from the authored claim policy." },
-        "format": {"x-registry-field": "redacted_fixture_property", "type": "string", "description": "Selects the claim-result media type requested from the governed Notary path." },
-        "purpose": {"x-registry-field": "redacted_fixture_property", "type": "string", "minLength": 1, "maxLength": 256, "description": "Names the authored service purpose exercised by this synthetic request witness." }
-      }
-    },
-    "governedTarget": {
-      "description": "The synthetic subject target presented to the governed offline fixture boundary.",
+    "interaction": {
+      "description": "One expected upstream request paired with its synthetic response.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["type"],
+      "required": [
+        "expect",
+        "respond"
+      ],
       "properties": {
-        "type": {"x-registry-field": "redacted_fixture_property", "type": "string", "minLength": 1, "maxLength": 64, "description": "Names the authored target entity type used for claim evaluation." },
-        "id": {"x-registry-field": "redacted_fixture_property", "type": "string", "description": "Supplies an optional synthetic direct target identifier." },
-        "identifiers": {
+        "expect": {
           "x-registry-field": "redacted_fixture_property",
-          "description": "Supplies independently authored synthetic identifiers for consultation input mapping.",
-          "type": "array",
-          "maxItems": 16,
-          "items": {"x-registry-field": "redacted_fixture_array_item", "$ref": "#/$defs/governedIdentifier" }
+          "$ref": "#/$defs/request"
         },
-        "attributes": {
+        "respond": {
           "x-registry-field": "redacted_fixture_property",
-          "description": "Supplies independently authored typed target attributes for consultation input mapping.",
-          "type": "object",
-          "maxProperties": 16,
-          "additionalProperties": {"x-registry-field": "redacted_fixture_map_value", "type": ["string", "boolean", "integer", "null"] }
-        }
-      }
-    },
-    "governedIdentifier": {
-      "description": "One synthetic target identifier with an authored scheme and string value.",
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["scheme", "value"],
-      "properties": {
-        "scheme": {"x-registry-field": "redacted_fixture_property", "type": "string", "minLength": 1, "maxLength": 96, "description": "Names the authored identifier scheme selected by a consultation input mapping." },
-        "value": {"x-registry-field": "redacted_fixture_property", "type": "string", "description": "Supplies the synthetic string value bound to this identifier scheme." }
-      }
-    },
-    "governedClaimRef": {
-      "description": "A requested claim ID, optionally pinned to one authored claim version.",
-      "oneOf": [
-        {"x-registry-field": "branch", "type": "string"},
-        {
-          "x-registry-field": "branch",
-          "type": "object",
-          "additionalProperties": false,
-          "required": ["id"],
-          "properties": {
-            "id": {"x-registry-field": "redacted_fixture_property", "type": "string", "description": "Names one authored claim requested by this fixture witness."},
-            "version": {"x-registry-field": "redacted_fixture_property", "type": "string", "description": "Pins the requested claim to one authored claim-policy version."}
-          }
+          "$ref": "#/$defs/response"
         }
-      ]
-    },
-    "interaction": {
-      "description": "One expected upstream request paired with its synthetic response.",
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["expect", "respond"],
-      "properties": {
-        "expect": {"x-registry-field": "redacted_fixture_property", "$ref": "#/$defs/request" },
-        "respond": {"x-registry-field": "redacted_fixture_property", "$ref": "#/$defs/response" }
       }
     },
     "request": {
       "description": "Exact HTTP request shape the adapter must produce.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["method", "path"],
+      "required": [
+        "method",
+        "path"
+      ],
       "properties": {
-        "method": {"x-registry-field": "redacted_fixture_property", "enum": ["GET", "POST"] },
-        "path": {"x-registry-field": "redacted_fixture_property", "type": "string", "minLength": 1, "maxLength": 4096, "pattern": "^/[^?#]*$" },
+        "method": {
+          "x-registry-field": "redacted_fixture_property",
+          "enum": [
+            "GET",
+            "POST"
+          ]
+        },
+        "path": {
+          "x-registry-field": "redacted_fixture_property",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 4096,
+          "pattern": "^/[^?#]*$"
+        },
         "query": {
           "x-registry-field": "redacted_fixture_property",
           "type": "object",
@@ -168,12 +160,28 @@
           "additionalProperties": {
             "x-registry-field": "redacted_fixture_map_value",
             "oneOf": [
-              {"x-registry-field": "branch", "type": ["string", "boolean", "integer", "null"] },
+              {
+                "x-registry-field": "branch",
+                "type": [
+                  "string",
+                  "boolean",
+                  "integer",
+                  "null"
+                ]
+              },
               {
                 "x-registry-field": "branch",
                 "type": "array",
                 "maxItems": 64,
-                "items": {"x-registry-field": "redacted_fixture_array_item", "type": ["string", "boolean", "integer", "null"] }
+                "items": {
+                  "x-registry-field": "redacted_fixture_array_item",
+                  "type": [
+                    "string",
+                    "boolean",
+                    "integer",
+                    "null"
+                  ]
+                }
               }
             ]
           }
@@ -182,10 +190,20 @@
           "x-registry-field": "redacted_fixture_property",
           "type": "object",
           "maxProperties": 32,
-          "propertyNames": {"x-registry-field": "redacted_fixture_map_key", "pattern": "^[A-Za-z][A-Za-z0-9-]{0,63}$" },
-          "additionalProperties": {"x-registry-field": "redacted_fixture_map_value", "type": "string", "maxLength": 8192 }
+          "propertyNames": {
+            "x-registry-field": "redacted_fixture_map_key",
+            "pattern": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
+          },
+          "additionalProperties": {
+            "x-registry-field": "redacted_fixture_map_value",
+            "type": "string",
+            "maxLength": 8192
+          }
         },
-        "body": {"x-registry-field": "redacted_fixture_property", "$ref": "#/$defs/fixtureBody" }
+        "body": {
+          "x-registry-field": "redacted_fixture_property",
+          "$ref": "#/$defs/fixtureBody"
+        }
       }
     },
     "response": {
@@ -195,23 +213,39 @@
           "x-registry-field": "branch",
           "type": "object",
           "additionalProperties": false,
-          "required": ["status"],
+          "required": [
+            "status"
+          ],
           "properties": {
-            "status": {"x-registry-field": "redacted_fixture_property", "type": "integer", "minimum": 100, "maximum": 599 },
+            "status": {
+              "x-registry-field": "redacted_fixture_property",
+              "type": "integer",
+              "minimum": 100,
+              "maximum": 599
+            },
             "headers": {
               "x-registry-field": "redacted_fixture_property",
               "type": "object",
               "maxProperties": 32,
-              "additionalProperties": {"x-registry-field": "redacted_fixture_map_value", "type": "string", "maxLength": 8192 }
+              "additionalProperties": {
+                "x-registry-field": "redacted_fixture_map_value",
+                "type": "string",
+                "maxLength": 8192
+              }
             },
-            "body": {"x-registry-field": "redacted_fixture_property", "$ref": "#/$defs/fixtureBody" }
+            "body": {
+              "x-registry-field": "redacted_fixture_property",
+              "$ref": "#/$defs/fixtureBody"
+            }
           }
         },
         {
           "x-registry-field": "branch",
           "type": "object",
           "additionalProperties": false,
-          "required": ["timeout"],
+          "required": [
+            "timeout"
+          ],
           "properties": {
             "timeout": {
               "x-registry-field": "redacted_fixture_property",
@@ -230,7 +264,9 @@
           "x-registry-field": "branch",
           "type": "object",
           "additionalProperties": false,
-          "required": ["file"],
+          "required": [
+            "file"
+          ],
           "properties": {
             "file": {
               "x-registry-field": "redacted_fixture_property",
@@ -246,21 +282,38 @@
           "not": {
             "x-registry-field": "branch",
             "type": "object",
-            "required": ["file"]
+            "required": [
+              "file"
+            ]
           }
         }
       ]
     },
     "expectation": {
-      "description": "Expected normalized outcome, output values, claims, or error.",
+      "description": "Expected normalized Relay outcome, output values, or error.",
       "type": "object",
       "additionalProperties": false,
       "minProperties": 1,
       "properties": {
-        "outcome": {"x-registry-field": "redacted_fixture_property", "enum": ["match", "no_match", "ambiguous"] },
-        "outputs": {"x-registry-field": "redacted_fixture_property", "type": "object", "maxProperties": 64 },
-        "claims": {"x-registry-field": "redacted_fixture_property", "type": "object", "maxProperties": 64 },
-        "error": {"x-registry-field": "redacted_fixture_property", "type": "string", "minLength": 1, "maxLength": 256 }
+        "outcome": {
+          "x-registry-field": "redacted_fixture_property",
+          "enum": [
+            "match",
+            "no_match",
+            "ambiguous"
+          ]
+        },
+        "outputs": {
+          "x-registry-field": "redacted_fixture_property",
+          "type": "object",
+          "maxProperties": 64
+        },
+        "error": {
+          "x-registry-field": "redacted_fixture_property",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        }
       }
     }
   }
diff --git a/crates/registryctl/schemas/project-authoring/parity-coverage.json b/crates/registryctl/schemas/project-authoring/parity-coverage.json
index dd0f36d5f..9daf7900d 100644
--- a/crates/registryctl/schemas/project-authoring/parity-coverage.json
+++ b/crates/registryctl/schemas/project-authoring/parity-coverage.json
@@ -38,12 +38,11 @@
         "schema": "project",
         "semantic_owner": "authoring_contract",
         "human_owner": "registry_maintainers",
-        "products": ["registryctl", "relay", "notary", "editor", "docs"],
+        "products": ["registryctl", "relay", "editor", "docs"],
         "migration": "rebuild_project",
         "consumers": [
           "registryctl_authoring",
           "registry_relay",
-          "registry_notary",
           "editor_tooling",
           "docs_generator"
         ],
@@ -51,7 +50,6 @@
           "editor_schemas",
           "project_build",
           "relay_config",
-          "notary_config",
           "field_reference"
         ],
         "review_classes": [
@@ -59,7 +57,6 @@
           "security",
           "privacy",
           "relay",
-          "notary",
           "compatibility",
           "documentation"
         ]
@@ -68,12 +65,11 @@
         "schema": "environment",
         "semantic_owner": "deployment_security",
         "human_owner": "security_maintainers",
-        "products": ["registryctl", "relay", "notary", "editor", "docs"],
+        "products": ["registryctl", "relay", "editor", "docs"],
         "migration": "coordinate_deployment",
         "consumers": [
           "registryctl_authoring",
           "registry_relay",
-          "registry_notary",
           "editor_tooling",
           "docs_generator"
         ],
@@ -81,7 +77,6 @@
           "editor_schemas",
           "project_build",
           "relay_config",
-          "notary_config",
           "field_reference"
         ],
         "review_classes": [
@@ -89,7 +84,6 @@
           "security",
           "privacy",
           "relay",
-          "notary",
           "compatibility",
           "documentation"
         ]
@@ -98,12 +92,11 @@
         "schema": "integration",
         "semantic_owner": "integration_contract",
         "human_owner": "integration_maintainers",
-        "products": ["registryctl", "relay", "notary", "editor", "docs"],
+        "products": ["registryctl", "relay", "editor", "docs"],
         "migration": "rebuild_project",
         "consumers": [
           "registryctl_authoring",
           "registry_relay",
-          "registry_notary",
           "editor_tooling",
           "docs_generator"
         ],
@@ -111,7 +104,6 @@
           "editor_schemas",
           "project_build",
           "relay_config",
-          "notary_config",
           "fixture_report",
           "field_reference"
         ],
@@ -120,7 +112,6 @@
           "security",
           "privacy",
           "relay",
-          "notary",
           "compatibility",
           "documentation",
           "testing"
@@ -309,12 +300,6 @@
       "kind": "typed_map",
       "rationale": "Entity identifiers are project-defined and every value uses the closed entity binding."
     },
-    {
-      "schema": "environment",
-      "pointer": "/properties/callers",
-      "kind": "typed_map",
-      "rationale": "Caller identifiers are deployment-defined and every value uses a closed caller binding."
-    },
     {
       "schema": "environment",
       "pointer": "/$defs/entity/properties/columns",
@@ -333,18 +318,6 @@
       "kind": "typed_map",
       "rationale": "Fixture variable names are authored and values are date strings."
     },
-    {
-      "schema": "fixture",
-      "pointer": "/$defs/governedRequest/properties/variables",
-      "kind": "typed_map",
-      "rationale": "Governed request variable names are project-defined and values use the closed bounded string contract."
-    },
-    {
-      "schema": "fixture",
-      "pointer": "/$defs/governedTarget/properties/attributes",
-      "kind": "typed_map",
-      "rationale": "Governed target attribute names are project-defined and values use the closed bounded scalar contract."
-    },
     {
       "schema": "fixture",
       "pointer": "/$defs/request/properties/query",
@@ -369,12 +342,6 @@
       "kind": "extension_map",
       "rationale": "Expected adapter outputs are integration-defined JSON values checked against the integration contract at runtime."
     },
-    {
-      "schema": "fixture",
-      "pointer": "/$defs/expectation/properties/claims",
-      "kind": "extension_map",
-      "rationale": "Expected claims are service-defined JSON values checked against the project claim contract at runtime."
-    },
     {
       "schema": "fixture",
       "pointer": "/$defs/fixtureBody/oneOf/1/not",
@@ -483,18 +450,6 @@
       "kind": "typed_map",
       "rationale": "Aggregate filter field names map to bounded filter operator lists."
     },
-    {
-      "schema": "project",
-      "pointer": "/$defs/evidenceService/properties/claims",
-      "kind": "typed_map",
-      "rationale": "Claim identifiers are authored and every value uses a closed claim declaration."
-    },
-    {
-      "schema": "project",
-      "pointer": "/$defs/evidenceService/properties/credential_profiles",
-      "kind": "typed_map",
-      "rationale": "Credential profile identifiers are authored and every value uses a closed profile declaration."
-    },
     {
       "schema": "project",
       "pointer": "/$defs/variables",
@@ -719,16 +674,16 @@
       }
     },
     {
-      "id": "environment-empty-caller-scopes",
+      "id": "environment-empty-consultation-client",
       "dimension": "boundary",
-      "expected_failing_keywords": ["minItems"],
+      "expected_failing_keywords": ["minLength", "pattern"],
       "schema": "environment",
       "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system",
       "document": "environments/local.yaml",
       "mutation": {
         "operation": "set",
-        "pointer": "/callers/benefits-service/scopes",
-        "value": []
+        "pointer": "/relay/consultation/client_id",
+        "value": ""
       }
     },
     {
diff --git a/crates/registryctl/schemas/project-authoring/project.schema.json b/crates/registryctl/schemas/project-authoring/project.schema.json
index 0147c4f35..c2d001b47 100644
--- a/crates/registryctl/schemas/project-authoring/project.schema.json
+++ b/crates/registryctl/schemas/project-authoring/project.schema.json
@@ -3,22 +3,47 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://registrystack.example/schemas/project-authoring/project.v1.json",
   "title": "Registry Stack project v1",
-  "description": "Declares the product-neutral Registry Stack project graph: integrations, materialized entities, and Relay or Notary services.",
+  "description": "Declares the product-neutral Registry Stack project graph: integrations, materialized entities, and Relay services.",
   "type": "object",
   "additionalProperties": false,
-  "required": ["version", "registry", "services"],
+  "required": [
+    "version",
+    "registry",
+    "services"
+  ],
   "properties": {
-    "version": {"x-registry-field": "public_property", "const": 1, "description": "Project authoring format version." },
+    "version": {
+      "x-registry-field": "public_property",
+      "const": 1,
+      "description": "Project authoring format version."
+    },
     "starter": {
       "x-registry-field": "property",
       "description": "Immutable provenance for a workspace initialized from a Registry Stack starter. The digest excludes this content_digest field and covers the starter's authored project files.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["id", "release", "content_digest"],
+      "required": [
+        "id",
+        "release",
+        "content_digest"
+      ],
       "properties": {
-        "id": {"x-registry-field": "property", "$ref": "#/$defs/stableId", "description": "Registry Stack starter identifier." },
-        "release": {"x-registry-field": "property", "$ref": "#/$defs/token", "description": "Registry Stack release that supplied the starter." },
-        "content_digest": {"x-registry-field": "sensitive_property", "type": "string", "pattern": "^sha256:[0-9a-f]{64}$", "description": "Digest of the initialized starter authoring content, used to report later workspace divergence." }
+        "id": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId",
+          "description": "Registry Stack starter identifier."
+        },
+        "release": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/token",
+          "description": "Registry Stack release that supplied the starter."
+        },
+        "content_digest": {
+          "x-registry-field": "sensitive_property",
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$",
+          "description": "Digest of the initialized starter authoring content, used to report later workspace divergence."
+        }
       }
     },
     "registry": {
@@ -26,21 +51,38 @@
       "description": "Stable identity of the Registry Stack project.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["id"],
-      "properties": { "id": {"x-registry-field": "property", "$ref": "#/$defs/stableId" } }
+      "required": [
+        "id"
+      ],
+      "properties": {
+        "id": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        }
+      }
     },
     "integrations": {
       "x-registry-field": "property",
       "description": "Source adaptation definitions keyed by project-local integration identifier.",
       "type": "object",
       "maxProperties": 16,
-      "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" },
+      "propertyNames": {
+        "x-registry-field": "map_key",
+        "$ref": "#/$defs/stableId"
+      },
       "additionalProperties": {
         "x-registry-field": "map_value",
         "type": "object",
         "additionalProperties": false,
-        "required": ["file"],
-        "properties": { "file": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relativePath" } }
+        "required": [
+          "file"
+        ],
+        "properties": {
+          "file": {
+            "x-registry-field": "sensitive_property",
+            "$ref": "#/$defs/relativePath"
+          }
+        }
       }
     },
     "entities": {
@@ -48,98 +90,262 @@
       "description": "Materialized entity definitions keyed by project-local entity identifier.",
       "type": "object",
       "maxProperties": 32,
-      "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" },
+      "propertyNames": {
+        "x-registry-field": "map_key",
+        "$ref": "#/$defs/stableId"
+      },
       "additionalProperties": {
         "x-registry-field": "map_value",
         "type": "object",
         "additionalProperties": false,
-        "required": ["file"],
-        "properties": { "file": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relativePath" } }
+        "required": [
+          "file"
+        ],
+        "properties": {
+          "file": {
+            "x-registry-field": "sensitive_property",
+            "$ref": "#/$defs/relativePath"
+          }
+        }
       }
     },
     "services": {
       "x-registry-field": "property",
-      "description": "Relay records APIs and Notary evidence services exposed by the project.",
+      "description": "Relay records and consultation APIs exposed by the project.",
       "type": "object",
       "maxProperties": 32,
-      "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" },
-      "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/service" }
+      "propertyNames": {
+        "x-registry-field": "map_key",
+        "$ref": "#/$defs/stableId"
+      },
+      "additionalProperties": {
+        "x-registry-field": "map_value",
+        "$ref": "#/$defs/service"
+      }
     }
   },
   "anyOf": [
-    {"x-registry-field": "branch", "required": ["integrations"], "properties": { "integrations": {"x-registry-field": "property", "minProperties": 1 } } },
-    {"x-registry-field": "branch", "required": ["entities"], "properties": { "entities": {"x-registry-field": "property", "minProperties": 1 } } },
-    {"x-registry-field": "branch", "required": ["services"], "properties": { "services": {"x-registry-field": "property", "minProperties": 1 } } }
+    {
+      "x-registry-field": "branch",
+      "required": [
+        "integrations"
+      ],
+      "properties": {
+        "integrations": {
+          "x-registry-field": "property",
+          "minProperties": 1
+        }
+      }
+    },
+    {
+      "x-registry-field": "branch",
+      "required": [
+        "entities"
+      ],
+      "properties": {
+        "entities": {
+          "x-registry-field": "property",
+          "minProperties": 1
+        }
+      }
+    },
+    {
+      "x-registry-field": "branch",
+      "required": [
+        "services"
+      ],
+      "properties": {
+        "services": {
+          "x-registry-field": "property",
+          "minProperties": 1
+        }
+      }
+    }
   ],
   "examples": [
     {
       "version": 1,
-      "registry": { "id": "benefits-registry" },
+      "registry": {
+        "id": "benefits-registry"
+      },
       "integrations": {
-        "household_lookup": { "file": "integrations/household-lookup/integration.yaml" }
+        "household_lookup": {
+          "file": "integrations/household-lookup/integration.yaml"
+        }
       },
       "services": {}
     }
   ],
   "$defs": {
-    "stableId": { "type": "string", "pattern": "^[a-z][a-z0-9._-]{0,95}$", "description": "Lowercase stable identifier used in project references." },
-    "token": { "type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[^,\\s\\u0000-\\u001F\\u007F]+$", "description": "Non-empty token without commas, whitespace, or control characters." },
-    "relativePath": { "type": "string", "minLength": 1, "maxLength": 4096, "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$", "description": "Project-relative path without traversal or duplicate separators." },
-    "text": { "type": "string", "minLength": 1, "maxLength": 2048, "description": "Bounded human-readable project metadata." },
-    "scope": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[^,\\s\\u0000-\\u001F\\u007F]+$", "description": "Authorization scope token." },
+    "stableId": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9._-]{0,95}$",
+      "description": "Lowercase stable identifier used in project references."
+    },
+    "token": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "pattern": "^[^,\\s\\u0000-\\u001F\\u007F]+$",
+      "description": "Non-empty token without commas, whitespace, or control characters."
+    },
+    "relativePath": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 4096,
+      "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$",
+      "description": "Project-relative path without traversal or duplicate separators."
+    },
+    "text": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 2048,
+      "description": "Bounded human-readable project metadata."
+    },
+    "scope": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "pattern": "^[^,\\s\\u0000-\\u001F\\u007F]+$",
+      "description": "Authorization scope token."
+    },
     "recordsApi": {
       "description": "Relay records API behavior, authorization, query bounds, and standards profiles.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["scopes", "projection", "pagination", "standards"],
+      "required": [
+        "scopes",
+        "projection",
+        "pagination",
+        "standards"
+      ],
       "properties": {
         "scopes": {
           "x-registry-field": "property",
           "type": "object",
           "additionalProperties": false,
-          "required": ["metadata", "rows"],
+          "required": [
+            "metadata",
+            "rows"
+          ],
           "properties": {
-            "metadata": {"x-registry-field": "property", "$ref": "#/$defs/scope" },
-            "rows": {"x-registry-field": "property", "$ref": "#/$defs/scope" },
-            "aggregate": {"x-registry-field": "property", "$ref": "#/$defs/scope" },
-            "evidence_verification": {"x-registry-field": "property", "$ref": "#/$defs/scope" }
+            "metadata": {
+              "x-registry-field": "property",
+              "$ref": "#/$defs/scope"
+            },
+            "rows": {
+              "x-registry-field": "property",
+              "$ref": "#/$defs/scope"
+            },
+            "aggregate": {
+              "x-registry-field": "property",
+              "$ref": "#/$defs/scope"
+            },
+            "evidence_verification": {
+              "x-registry-field": "property",
+              "$ref": "#/$defs/scope"
+            }
+          }
+        },
+        "purposes": {
+          "x-registry-field": "property",
+          "type": "array",
+          "maxItems": 32,
+          "uniqueItems": true,
+          "items": {
+            "x-registry-field": "array_item",
+            "$ref": "#/$defs/token"
+          }
+        },
+        "projection": {
+          "x-registry-field": "property",
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 256,
+          "uniqueItems": true,
+          "items": {
+            "x-registry-field": "array_item",
+            "$ref": "#/$defs/stableId"
           }
         },
-        "purposes": {"x-registry-field": "property", "type": "array", "maxItems": 32, "uniqueItems": true, "items": {"x-registry-field": "array_item", "$ref": "#/$defs/token" } },
-        "projection": {"x-registry-field": "property", "type": "array", "minItems": 1, "maxItems": 256, "uniqueItems": true, "items": {"x-registry-field": "array_item", "$ref": "#/$defs/stableId" } },
         "pagination": {
           "x-registry-field": "property",
           "type": "object",
           "additionalProperties": false,
-          "required": ["default_limit", "max_limit"],
+          "required": [
+            "default_limit",
+            "max_limit"
+          ],
           "properties": {
-            "default_limit": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 10000 },
-            "max_limit": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 10000 }
+            "default_limit": {
+              "x-registry-field": "property",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 10000
+            },
+            "max_limit": {
+              "x-registry-field": "property",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 10000
+            }
           }
         },
         "filters": {
           "x-registry-field": "property",
           "type": "object",
           "maxProperties": 256,
-          "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" },
-          "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/filterOperators" }
+          "propertyNames": {
+            "x-registry-field": "map_key",
+            "$ref": "#/$defs/stableId"
+          },
+          "additionalProperties": {
+            "x-registry-field": "map_value",
+            "$ref": "#/$defs/filterOperators"
+          }
+        },
+        "required_principal_filters": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/fieldList"
         },
-        "required_principal_filters": {"x-registry-field": "property", "$ref": "#/$defs/fieldList" },
         "relationships": {
           "x-registry-field": "property",
           "type": "object",
           "maxProperties": 64,
-          "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" },
+          "propertyNames": {
+            "x-registry-field": "map_key",
+            "$ref": "#/$defs/stableId"
+          },
           "additionalProperties": {
             "x-registry-field": "map_value",
             "type": "object",
             "additionalProperties": false,
-            "required": ["kind", "target", "foreign_key"],
+            "required": [
+              "kind",
+              "target",
+              "foreign_key"
+            ],
             "properties": {
-              "kind": {"x-registry-field": "property", "enum": ["belongs_to", "has_many", "has_one"] },
-              "target": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-              "foreign_key": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-              "concept_uri": {"x-registry-field": "property", "$ref": "#/$defs/text" }
+              "kind": {
+                "x-registry-field": "property",
+                "enum": [
+                  "belongs_to",
+                  "has_many",
+                  "has_one"
+                ]
+              },
+              "target": {
+                "x-registry-field": "property",
+                "$ref": "#/$defs/stableId"
+              },
+              "foreign_key": {
+                "x-registry-field": "property",
+                "$ref": "#/$defs/stableId"
+              },
+              "concept_uri": {
+                "x-registry-field": "property",
+                "$ref": "#/$defs/text"
+              }
             }
           }
         },
@@ -147,18 +353,54 @@
           "x-registry-field": "property",
           "type": "object",
           "maxProperties": 64,
-          "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" },
-          "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/recordAggregate" }
+          "propertyNames": {
+            "x-registry-field": "map_key",
+            "$ref": "#/$defs/stableId"
+          },
+          "additionalProperties": {
+            "x-registry-field": "map_value",
+            "$ref": "#/$defs/recordAggregate"
+          }
+        },
+        "attribute_release_profiles": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/recordAttributeReleaseProfiles"
         },
-        "attribute_release_profiles": {"x-registry-field": "property", "$ref": "#/$defs/recordAttributeReleaseProfiles" },
         "standards": {
           "x-registry-field": "property",
           "type": "object",
           "additionalProperties": false,
-          "required": ["ogc_features", "sp_dci"],
+          "required": [
+            "ogc_features",
+            "sp_dci"
+          ],
           "properties": {
-            "ogc_features": {"x-registry-field": "property", "oneOf": [{"x-registry-field": "branch", "const": false }, {"x-registry-field": "branch", "$ref": "#/$defs/recordSpatial" }] },
-            "sp_dci": {"x-registry-field": "property", "oneOf": [{"x-registry-field": "branch", "const": false }, {"x-registry-field": "branch", "$ref": "#/$defs/recordSpdci" }] }
+            "ogc_features": {
+              "x-registry-field": "property",
+              "oneOf": [
+                {
+                  "x-registry-field": "branch",
+                  "const": false
+                },
+                {
+                  "x-registry-field": "branch",
+                  "$ref": "#/$defs/recordSpatial"
+                }
+              ]
+            },
+            "sp_dci": {
+              "x-registry-field": "property",
+              "oneOf": [
+                {
+                  "x-registry-field": "branch",
+                  "const": false
+                },
+                {
+                  "x-registry-field": "branch",
+                  "$ref": "#/$defs/recordSpdci"
+                }
+              ]
+            }
           }
         }
       }
@@ -167,57 +409,142 @@
       "description": "Purpose-bound, exact-one identity releases keyed by stable profile id. Generated Relay responses omit source metadata and are never cacheable.",
       "type": "object",
       "maxProperties": 16,
-      "propertyNames": {"x-registry-field": "map_key", "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,95}$" },
-      "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/recordAttributeReleaseProfile" }
+      "propertyNames": {
+        "x-registry-field": "map_key",
+        "type": "string",
+        "pattern": "^[a-z][a-z0-9_-]{0,95}$"
+      },
+      "additionalProperties": {
+        "x-registry-field": "map_value",
+        "$ref": "#/$defs/recordAttributeReleaseProfile"
+      }
     },
     "recordAttributeReleaseProfile": {
       "description": "One purpose-bound, minimized identity release compiled into the owning Relay entity.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["version", "purpose", "release_scope", "subject", "release_conditions", "claims"],
+      "required": [
+        "version",
+        "purpose",
+        "release_scope",
+        "subject",
+        "release_conditions",
+        "claims"
+      ],
       "properties": {
-        "version": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[^,\\s\\u0000-\\u001F\\u007F]+$" },
-        "title": {"x-registry-field": "property", "$ref": "#/$defs/text" },
-        "description": {"x-registry-field": "property", "$ref": "#/$defs/text" },
-        "purpose": {"x-registry-field": "property", "$ref": "#/$defs/token" },
-        "release_scope": {"x-registry-field": "property", "$ref": "#/$defs/scope" },
+        "version": {
+          "x-registry-field": "property",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 64,
+          "pattern": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+        },
+        "title": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/text"
+        },
+        "description": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/text"
+        },
+        "purpose": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/token"
+        },
+        "release_scope": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/scope"
+        },
         "subject": {
           "x-registry-field": "property",
           "type": "object",
           "additionalProperties": false,
-          "required": ["source_field", "id_type"],
+          "required": [
+            "source_field",
+            "id_type"
+          ],
           "properties": {
-            "source_field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-            "id_type": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[^,\\s\\u0000-\\u001F\\u007F]+$" }
+            "source_field": {
+              "x-registry-field": "property",
+              "$ref": "#/$defs/stableId"
+            },
+            "id_type": {
+              "x-registry-field": "property",
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 64,
+              "pattern": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+            }
           }
         },
         "release_conditions": {
           "x-registry-field": "property",
           "type": "object",
           "additionalProperties": false,
-          "required": ["expression"],
-          "properties": { "expression": {"x-registry-field": "property", "$ref": "#/$defs/recordAttributeReleaseExpression" } }
+          "required": [
+            "expression"
+          ],
+          "properties": {
+            "expression": {
+              "x-registry-field": "property",
+              "$ref": "#/$defs/recordAttributeReleaseExpression"
+            }
+          }
         },
         "claims": {
           "x-registry-field": "property",
           "type": "object",
           "minProperties": 1,
           "maxProperties": 32,
-          "propertyNames": {"x-registry-field": "map_key", "type": "string", "pattern": "^[a-z][a-z0-9_]{0,63}$" },
+          "propertyNames": {
+            "x-registry-field": "map_key",
+            "type": "string",
+            "pattern": "^[a-z][a-z0-9_]{0,63}$"
+          },
           "additionalProperties": {
             "x-registry-field": "map_value",
             "type": "object",
             "additionalProperties": false,
-            "required": ["required", "sensitivity"],
+            "required": [
+              "required",
+              "sensitivity"
+            ],
             "properties": {
-              "source_field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-              "expression": {"x-registry-field": "property", "$ref": "#/$defs/recordAttributeReleaseExpression" },
-              "required": {"x-registry-field": "property", "type": "boolean" },
-              "sensitivity": {"x-registry-field": "property", "enum": ["direct_identifier", "personal", "public", "pseudonymous"] }
+              "source_field": {
+                "x-registry-field": "property",
+                "$ref": "#/$defs/stableId"
+              },
+              "expression": {
+                "x-registry-field": "property",
+                "$ref": "#/$defs/recordAttributeReleaseExpression"
+              },
+              "required": {
+                "x-registry-field": "property",
+                "type": "boolean"
+              },
+              "sensitivity": {
+                "x-registry-field": "property",
+                "enum": [
+                  "direct_identifier",
+                  "personal",
+                  "public",
+                  "pseudonymous"
+                ]
+              }
             },
             "oneOf": [
-              {"x-registry-field": "branch", "required": ["source_field"] },
-              {"x-registry-field": "branch", "required": ["expression"] }
+              {
+                "x-registry-field": "branch",
+                "required": [
+                  "source_field"
+                ]
+              },
+              {
+                "x-registry-field": "branch",
+                "required": [
+                  "expression"
+                ]
+              }
             ]
           }
         }
@@ -227,82 +554,269 @@
       "description": "Bounded CEL evaluated only against the projected source object.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["cel"],
-      "properties": { "cel": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 4096 } }
+      "required": [
+        "cel"
+      ],
+      "properties": {
+        "cel": {
+          "x-registry-field": "property",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 4096
+        }
+      }
+    },
+    "filterOperators": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "description": "Allowed operators for one queryable field.",
+      "items": {
+        "x-registry-field": "array_item",
+        "enum": [
+          "eq",
+          "in",
+          "gte",
+          "lte",
+          "between"
+        ]
+      }
+    },
+    "fieldList": {
+      "type": "array",
+      "maxItems": 16,
+      "uniqueItems": true,
+      "description": "Bounded unique list of entity field identifiers.",
+      "items": {
+        "x-registry-field": "array_item",
+        "$ref": "#/$defs/stableId"
+      }
     },
-    "filterOperators": { "type": "array", "minItems": 1, "uniqueItems": true, "description": "Allowed operators for one queryable field.", "items": {"x-registry-field": "array_item", "enum": ["eq", "in", "gte", "lte", "between"] } },
-    "fieldList": { "type": "array", "maxItems": 16, "uniqueItems": true, "description": "Bounded unique list of entity field identifiers.", "items": {"x-registry-field": "array_item", "$ref": "#/$defs/stableId" } },
     "recordAggregate": {
       "description": "Governed aggregate definition with disclosure controls.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["description", "disclosure_control"],
+      "required": [
+        "description",
+        "disclosure_control"
+      ],
       "properties": {
-        "title": {"x-registry-field": "property", "$ref": "#/$defs/text" },
-        "description": {"x-registry-field": "property", "$ref": "#/$defs/text" },
-        "default_group_by": {"x-registry-field": "property", "$ref": "#/$defs/fieldList" },
-        "dimensions": {"x-registry-field": "property", "type": "array", "items": {"x-registry-field": "array_item", "$ref": "#/$defs/recordAggregateDimension" } },
-        "indicators": {"x-registry-field": "property", "type": "array", "items": {"x-registry-field": "array_item", "$ref": "#/$defs/recordAggregateIndicator" } },
-        "allowed_filters": {"x-registry-field": "property", "type": "object", "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/filterOperators" } },
-        "required_principal_filters": {"x-registry-field": "property", "$ref": "#/$defs/fieldList" },
-        "temporal_field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "access": {"x-registry-field": "property", "$ref": "#/$defs/recordAggregateAccess" },
-        "spatial": {"x-registry-field": "property", "$ref": "#/$defs/recordAggregateSpatial" },
-        "joins": {"x-registry-field": "property", "$ref": "#/$defs/fieldList" },
-        "group_by": {"x-registry-field": "property", "$ref": "#/$defs/fieldList" },
-        "measures": {"x-registry-field": "property", "type": "array", "minItems": 1, "items": {"x-registry-field": "array_item", "$ref": "#/$defs/recordAggregateMeasure" } },
+        "title": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/text"
+        },
+        "description": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/text"
+        },
+        "default_group_by": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/fieldList"
+        },
+        "dimensions": {
+          "x-registry-field": "property",
+          "type": "array",
+          "items": {
+            "x-registry-field": "array_item",
+            "$ref": "#/$defs/recordAggregateDimension"
+          }
+        },
+        "indicators": {
+          "x-registry-field": "property",
+          "type": "array",
+          "items": {
+            "x-registry-field": "array_item",
+            "$ref": "#/$defs/recordAggregateIndicator"
+          }
+        },
+        "allowed_filters": {
+          "x-registry-field": "property",
+          "type": "object",
+          "additionalProperties": {
+            "x-registry-field": "map_value",
+            "$ref": "#/$defs/filterOperators"
+          }
+        },
+        "required_principal_filters": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/fieldList"
+        },
+        "temporal_field": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "access": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/recordAggregateAccess"
+        },
+        "spatial": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/recordAggregateSpatial"
+        },
+        "joins": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/fieldList"
+        },
+        "group_by": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/fieldList"
+        },
+        "measures": {
+          "x-registry-field": "property",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "x-registry-field": "array_item",
+            "$ref": "#/$defs/recordAggregateMeasure"
+          }
+        },
         "disclosure_control": {
           "x-registry-field": "property",
           "type": "object",
           "additionalProperties": false,
           "properties": {
-            "min_group_size": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 4294967295 },
-            "suppression": {"x-registry-field": "property", "enum": ["omit", "mask", "null"] }
+            "min_group_size": {
+              "x-registry-field": "property",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 4294967295
+            },
+            "suppression": {
+              "x-registry-field": "property",
+              "enum": [
+                "omit",
+                "mask",
+                "null"
+              ]
+            }
           }
         }
       },
-      "anyOf": [{"x-registry-field": "branch", "required": ["measures"] }, {"x-registry-field": "branch", "required": ["indicators"] }]
+      "anyOf": [
+        {
+          "x-registry-field": "branch",
+          "required": [
+            "measures"
+          ]
+        },
+        {
+          "x-registry-field": "branch",
+          "required": [
+            "indicators"
+          ]
+        }
+      ]
     },
     "recordAggregateAccess": {
       "description": "Authorization scopes and execution policy for one governed aggregate.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "metadata_scope": {"x-registry-field": "property", "$ref": "#/$defs/scope" },
-        "aggregate_scope": {"x-registry-field": "property", "$ref": "#/$defs/scope" },
-        "aggregate_only_execution": {"x-registry-field": "property", "type": "boolean" }
+        "metadata_scope": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/scope"
+        },
+        "aggregate_scope": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/scope"
+        },
+        "aggregate_only_execution": {
+          "x-registry-field": "property",
+          "type": "boolean"
+        }
       }
     },
     "recordAggregateSpatial": {
       "description": "Administrative-area geometry join used to spatially group aggregate results.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["mode", "dimension", "geometry_entity", "geometry_id_field", "geometry_field"],
+      "required": [
+        "mode",
+        "dimension",
+        "geometry_entity",
+        "geometry_id_field",
+        "geometry_field"
+      ],
       "properties": {
-        "mode": {"x-registry-field": "property", "const": "admin_area" },
-        "collection_id": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "dimension": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "geometry_entity": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "geometry_id_field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "geometry_field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "bbox_fields": {"x-registry-field": "property", "$ref": "#/$defs/recordSpatialBbox" },
-        "max_geometry_vertices": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 4294967295 }
+        "mode": {
+          "x-registry-field": "property",
+          "const": "admin_area"
+        },
+        "collection_id": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "dimension": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "geometry_entity": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "geometry_id_field": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "geometry_field": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "bbox_fields": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/recordSpatialBbox"
+        },
+        "max_geometry_vertices": {
+          "x-registry-field": "property",
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 4294967295
+        }
       }
     },
     "recordSpatial": {
       "description": "OGC API Features collection metadata and bounded geometry mapping.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["geometry"],
+      "required": [
+        "geometry"
+      ],
       "properties": {
-        "collection_id": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "title": {"x-registry-field": "property", "$ref": "#/$defs/text" },
-        "description": {"x-registry-field": "property", "$ref": "#/$defs/text" },
-        "geometry": {"x-registry-field": "property", "$ref": "#/$defs/recordSpatialGeometry" },
-        "bbox_fields": {"x-registry-field": "property", "$ref": "#/$defs/recordSpatialBbox" },
-        "datetime_field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "max_bbox_degrees": {"x-registry-field": "property", "type": "number", "exclusiveMinimum": 0 },
-        "max_geometry_vertices": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 4294967295 }
+        "collection_id": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "title": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/text"
+        },
+        "description": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/text"
+        },
+        "geometry": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/recordSpatialGeometry"
+        },
+        "bbox_fields": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/recordSpatialBbox"
+        },
+        "datetime_field": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "max_bbox_degrees": {
+          "x-registry-field": "property",
+          "type": "number",
+          "exclusiveMinimum": 0
+        },
+        "max_geometry_vertices": {
+          "x-registry-field": "property",
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 4294967295
+        }
       }
     },
     "recordSpatialGeometry": {
@@ -312,23 +826,57 @@
           "x-registry-field": "branch",
           "type": "object",
           "additionalProperties": false,
-          "required": ["kind", "longitude_field", "latitude_field", "crs"],
+          "required": [
+            "kind",
+            "longitude_field",
+            "latitude_field",
+            "crs"
+          ],
           "properties": {
-            "kind": {"x-registry-field": "property", "const": "point" },
-            "longitude_field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-            "latitude_field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-            "crs": {"x-registry-field": "property", "$ref": "#/$defs/token" }
+            "kind": {
+              "x-registry-field": "property",
+              "const": "point"
+            },
+            "longitude_field": {
+              "x-registry-field": "property",
+              "$ref": "#/$defs/stableId"
+            },
+            "latitude_field": {
+              "x-registry-field": "property",
+              "$ref": "#/$defs/stableId"
+            },
+            "crs": {
+              "x-registry-field": "property",
+              "$ref": "#/$defs/token"
+            }
           }
         },
         {
           "x-registry-field": "branch",
           "type": "object",
           "additionalProperties": false,
-          "required": ["kind", "field", "crs"],
+          "required": [
+            "kind",
+            "field",
+            "crs"
+          ],
           "properties": {
-            "kind": {"x-registry-field": "property", "enum": ["geojson", "wkt", "wkb"] },
-            "field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-            "crs": {"x-registry-field": "property", "$ref": "#/$defs/token" }
+            "kind": {
+              "x-registry-field": "property",
+              "enum": [
+                "geojson",
+                "wkt",
+                "wkb"
+              ]
+            },
+            "field": {
+              "x-registry-field": "property",
+              "$ref": "#/$defs/stableId"
+            },
+            "crs": {
+              "x-registry-field": "property",
+              "$ref": "#/$defs/token"
+            }
           }
         }
       ]
@@ -337,195 +885,360 @@
       "description": "Record fields carrying the four coordinates of a bounding box.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["min_x", "min_y", "max_x", "max_y"],
+      "required": [
+        "min_x",
+        "min_y",
+        "max_x",
+        "max_y"
+      ],
       "properties": {
-        "min_x": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "min_y": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "max_x": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "max_y": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }
+        "min_x": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "min_y": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "max_x": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "max_y": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        }
       }
     },
     "recordSpdci": {
       "description": "SP-DCI registry identity and field mappings for a records service.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["registry", "registry_type", "record_type", "identifiers", "expression_fields"],
+      "required": [
+        "registry",
+        "registry_type",
+        "record_type",
+        "identifiers",
+        "expression_fields"
+      ],
       "properties": {
-        "registry": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "registry_type": {"x-registry-field": "property", "$ref": "#/$defs/token" },
-        "record_type": {"x-registry-field": "property", "$ref": "#/$defs/token" },
-        "identifiers": {"x-registry-field": "property", "$ref": "#/$defs/recordFieldMap" },
-        "expression_fields": {"x-registry-field": "property", "$ref": "#/$defs/recordFieldMap" },
-        "response_fields": {"x-registry-field": "property", "$ref": "#/$defs/recordFieldMap" }
+        "registry": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "registry_type": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/token"
+        },
+        "record_type": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/token"
+        },
+        "identifiers": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/recordFieldMap"
+        },
+        "expression_fields": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/recordFieldMap"
+        },
+        "response_fields": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/recordFieldMap"
+        }
       }
     },
     "recordFieldMap": {
       "description": "Bounded mapping from standard field names to entity field identifiers.",
       "type": "object",
       "maxProperties": 64,
-      "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" },
-      "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/stableId" }
+      "propertyNames": {
+        "x-registry-field": "map_key",
+        "$ref": "#/$defs/stableId"
+      },
+      "additionalProperties": {
+        "x-registry-field": "map_value",
+        "$ref": "#/$defs/stableId"
+      }
     },
     "recordAggregateDimension": {
       "description": "Named grouping dimension backed by one entity field.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["id", "label", "field"],
+      "required": [
+        "id",
+        "label",
+        "field"
+      ],
       "properties": {
-        "id": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "label": {"x-registry-field": "property", "$ref": "#/$defs/text" },
-        "field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "codelist": {"x-registry-field": "property", "$ref": "#/$defs/text" }
+        "id": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "label": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/text"
+        },
+        "field": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "codelist": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/text"
+        }
       }
     },
     "recordAggregateIndicator": {
       "description": "SDMX-style aggregate indicator with units and display metadata.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["id", "label", "function", "column", "unit_measure"],
+      "required": [
+        "id",
+        "label",
+        "function",
+        "column",
+        "unit_measure"
+      ],
       "properties": {
-        "id": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "label": {"x-registry-field": "property", "$ref": "#/$defs/text" },
-        "function": {"x-registry-field": "property", "$ref": "#/$defs/recordAggregateFunction" },
-        "column": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "unit_measure": {"x-registry-field": "property", "$ref": "#/$defs/text" },
-        "unit_mult": {"x-registry-field": "property", "type": "integer", "minimum": -2147483648, "maximum": 2147483647 },
-        "decimals": {"x-registry-field": "property", "type": "integer", "minimum": 0, "maximum": 4294967295 },
-        "frequency": {"x-registry-field": "property", "$ref": "#/$defs/text" },
-        "definition_uri": {"x-registry-field": "property", "$ref": "#/$defs/text" }
+        "id": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "label": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/text"
+        },
+        "function": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/recordAggregateFunction"
+        },
+        "column": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "unit_measure": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/text"
+        },
+        "unit_mult": {
+          "x-registry-field": "property",
+          "type": "integer",
+          "minimum": -2147483648,
+          "maximum": 2147483647
+        },
+        "decimals": {
+          "x-registry-field": "property",
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 4294967295
+        },
+        "frequency": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/text"
+        },
+        "definition_uri": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/text"
+        }
       }
     },
     "recordAggregateMeasure": {
       "description": "Named aggregate calculation over one entity column.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["name", "function", "column"],
+      "required": [
+        "name",
+        "function",
+        "column"
+      ],
       "properties": {
-        "name": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "function": {"x-registry-field": "property", "$ref": "#/$defs/recordAggregateFunction" },
-        "column": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }
+        "name": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        },
+        "function": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/recordAggregateFunction"
+        },
+        "column": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/stableId"
+        }
       }
     },
     "recordAggregateFunction": {
       "description": "Supported aggregate calculation function.",
-      "enum": ["count", "sum", "avg", "min", "max", "median", "count_distinct", "stddev"]
+      "enum": [
+        "count",
+        "sum",
+        "avg",
+        "min",
+        "max",
+        "median",
+        "count_distinct",
+        "stddev"
+      ]
     },
-    "disclosureMode": { "enum": ["value", "predicate", "redacted"], "description": "Maximum detail a claim may disclose." },
-    "disclosure": {
-      "description": "Fixed disclosure mode or a default constrained by explicitly allowed alternatives.",
+    "service": {
+      "description": "Closed choice between a Relay consultation service and a Relay records service.",
       "oneOf": [
-        {"x-registry-field": "branch", "$ref": "#/$defs/disclosureMode" },
         {
           "x-registry-field": "branch",
-          "type": "object",
-          "additionalProperties": false,
-          "required": ["default", "allowed"],
-          "properties": {
-            "default": {"x-registry-field": "property", "$ref": "#/$defs/disclosureMode" },
-            "allowed": {"x-registry-field": "property", "type": "array", "minItems": 1, "uniqueItems": true, "items": {"x-registry-field": "array_item", "$ref": "#/$defs/disclosureMode" } }
-          }
+          "$ref": "#/$defs/consultationService"
+        },
+        {
+          "x-registry-field": "branch",
+          "$ref": "#/$defs/recordsService"
         }
       ]
     },
-    "service": {
-      "description": "Closed choice between a Notary evidence service and a Relay records service.",
-      "oneOf": [
-        {"x-registry-field": "branch", "$ref": "#/$defs/evidenceService" },
-        {"x-registry-field": "branch", "$ref": "#/$defs/recordsService" }
-      ]
-    },
     "recordsService": {
       "description": "Relay records API backed by one authored materialized entity.",
       "type": "object",
       "additionalProperties": false,
-      "required": ["kind", "entity", "api"],
+      "required": [
+        "kind",
+        "entity",
+        "api"
+      ],
       "properties": {
-        "kind": {"x-registry-field": "property", "const": "records_api" },
-        "entity": {"x-registry-field": "property", "$ref": "#/$defs/stableId" },
-        "title": {"x-registry-field": "property", "$ref": "#/$defs/text" },
-        "description": {"x-registry-field": "property", "$ref": "#/$defs/text" },
-        "owner": {"x-registry-field": "property", "$ref": "#/$defs/text" },
-        "sensitivity": {"x-registry-field": "property", "enum": ["public", "internal", "personal", "confidential", "secret"] },
-        "access_rights": {"x-registry-field": "property", "enum": ["public", "restricted", "non_public"] },
-        "update_frequency": {"x-registry-field": "property", "enum": ["continuous", "daily", "weekly", "termly", "monthly", "quarterly", "annual", "irregular", "as_needed", "unknown"] },
-        "conforms_to": {"x-registry-field": "property", "type": "array", "maxItems": 32, "uniqueItems": true, "items": {"x-registry-field": "array_item", "$ref": "#/$defs/text" } },
-        "api": {"x-registry-field": "property", "$ref": "#/$defs/recordsApi" }
-      }
-    },
-    "evidenceService": {
-      "description": "Notary evidence policy, consultations, claims, and registry-backed credential profiles. Every claim derives from exactly one declared Relay consultation.",
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["kind", "version", "purpose", "legal_basis", "consent", "access", "claims"],
-      "properties": {
-        "kind": {"x-registry-field": "property", "const": "evidence" },
-        "version": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 4294967295 },
-        "subject_type": {
-          "x-registry-field": "property",
-          "description": "Subject category evaluated by this evidence service. Omission is normalized to person.",
-          "enum": ["person", "project"]
-        },
-        "purpose": {"x-registry-field": "property", "$ref": "#/$defs/token" },
-        "legal_basis": {"x-registry-field": "property", "$ref": "#/$defs/token" },
-        "consent": {"x-registry-field": "property", "enum": ["not_required", "required"] },
-        "access": {"x-registry-field": "property", "$ref": "#/$defs/access" },
-        "variables": {"x-registry-field": "property", "$ref": "#/$defs/variables" },
-        "consultations": {"x-registry-field": "property", "$ref": "#/$defs/consultations" },
-        "claims": {
+        "kind": {
           "x-registry-field": "property",
-          "type": "object",
-          "minProperties": 1,
-          "maxProperties": 64,
-          "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" },
-          "additionalProperties": {
-            "x-registry-field": "map_value",
-            "type": "object",
-            "additionalProperties": false,
-            "required": ["disclosure"],
-            "properties": {
-              "output": {"x-registry-field": "property", "type": "string" },
-              "cel": {"x-registry-field": "property", "type": "string", "minLength": 1 },
-              "value": {"x-registry-field": "property", "$ref": "#/$defs/claimValue" },
-              "disclosure": {"x-registry-field": "property", "$ref": "#/$defs/disclosure" }
-            },
-            "oneOf": [{"x-registry-field": "branch", "required": ["output"] }, {"x-registry-field": "branch", "required": ["cel"] }]
-          }
+          "const": "records_api"
         },
-        "credential_profiles": {
+        "entity": {
           "x-registry-field": "property",
-          "description": "Credential profiles may select only claims backed by an exact Relay consultation.",
-          "type": "object",
-          "maxProperties": 32,
-          "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" },
-          "additionalProperties": {
-            "x-registry-field": "map_value",
-            "type": "object",
-            "additionalProperties": false,
-            "required": ["format", "type", "validity", "claims"],
-            "properties": {
-              "format": {"x-registry-field": "property", "$ref": "#/$defs/token" },
-              "type": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 2048 },
-              "validity": {"x-registry-field": "property", "type": "string", "pattern": "^[1-9][0-9]*(?:s|m|h)$" },
-              "claims": {"x-registry-field": "property", "type": "array", "minItems": 1, "uniqueItems": true, "items": {"x-registry-field": "array_item", "$ref": "#/$defs/stableId" } }
-            }
+          "$ref": "#/$defs/stableId"
+        },
+        "title": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/text"
+        },
+        "description": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/text"
+        },
+        "owner": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/text"
+        },
+        "sensitivity": {
+          "x-registry-field": "property",
+          "enum": [
+            "public",
+            "internal",
+            "personal",
+            "confidential",
+            "secret"
+          ]
+        },
+        "access_rights": {
+          "x-registry-field": "property",
+          "enum": [
+            "public",
+            "restricted",
+            "non_public"
+          ]
+        },
+        "update_frequency": {
+          "x-registry-field": "property",
+          "enum": [
+            "continuous",
+            "daily",
+            "weekly",
+            "termly",
+            "monthly",
+            "quarterly",
+            "annual",
+            "irregular",
+            "as_needed",
+            "unknown"
+          ]
+        },
+        "conforms_to": {
+          "x-registry-field": "property",
+          "type": "array",
+          "maxItems": 32,
+          "uniqueItems": true,
+          "items": {
+            "x-registry-field": "array_item",
+            "$ref": "#/$defs/text"
           }
+        },
+        "api": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/recordsApi"
         }
       }
     },
-    "access": {
-      "description": "Scopes a caller must hold to use an evidence service.",
-      "type": "object", "additionalProperties": false, "required": ["scopes"],
-      "properties": { "scopes": {"x-registry-field": "property", "type": "array", "minItems": 1, "maxItems": 16, "uniqueItems": true, "items": {"x-registry-field": "array_item", "$ref": "#/$defs/token" } } }
-    },
     "variables": {
-      "description": "Typed request variables exposed to evidence evaluation.",
-      "type": "object", "maxProperties": 16, "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" },
-      "additionalProperties": {"x-registry-field": "map_value", "type": "object", "additionalProperties": false, "required": ["from", "type"], "properties": { "from": {"x-registry-field": "property", "type": "string", "pattern": "^request\\.variables\\.[a-z][a-z0-9._-]{0,95}$" }, "type": {"x-registry-field": "property", "const": "date" } } }
+      "description": "Typed request variables exposed to Relay consultation bindings.",
+      "type": "object",
+      "maxProperties": 16,
+      "propertyNames": {
+        "x-registry-field": "map_key",
+        "$ref": "#/$defs/stableId"
+      },
+      "additionalProperties": {
+        "x-registry-field": "map_value",
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "from",
+          "type"
+        ],
+        "properties": {
+          "from": {
+            "x-registry-field": "property",
+            "type": "string",
+            "pattern": "^request\\.variables\\.[a-z][a-z0-9._-]{0,95}$"
+          },
+          "type": {
+            "x-registry-field": "property",
+            "const": "date"
+          }
+        }
+      }
     },
     "consultations": {
       "description": "Relay consultations and their closed bindings to target request identifiers or caller-supplied target attributes.",
-      "type": "object", "minProperties": 1, "maxProperties": 16, "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" },
-      "additionalProperties": {"x-registry-field": "map_value", "type": "object", "additionalProperties": false, "required": ["integration", "input"], "properties": { "integration": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, "input": {"x-registry-field": "property", "type": "object", "minProperties": 1, "maxProperties": 16, "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/requestMapping" } } } }
+      "type": "object",
+      "minProperties": 1,
+      "maxProperties": 16,
+      "propertyNames": {
+        "x-registry-field": "map_key",
+        "$ref": "#/$defs/stableId"
+      },
+      "additionalProperties": {
+        "x-registry-field": "map_value",
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "integration",
+          "input"
+        ],
+        "properties": {
+          "integration": {
+            "x-registry-field": "property",
+            "$ref": "#/$defs/stableId"
+          },
+          "input": {
+            "x-registry-field": "property",
+            "type": "object",
+            "minProperties": 1,
+            "maxProperties": 16,
+            "propertyNames": {
+              "x-registry-field": "map_key",
+              "$ref": "#/$defs/stableId"
+            },
+            "additionalProperties": {
+              "x-registry-field": "map_value",
+              "$ref": "#/$defs/requestMapping"
+            }
+          }
+        }
+      }
     },
     "requestMapping": {
       "description": "Closed request binding. Ordinary consultations use the target; representative relationship proofs may additionally bind an authenticated requester identifier.",
@@ -533,10 +1246,54 @@
       "maxLength": 128,
       "pattern": "^request\\.(?:target\\.(?:id|identifiers\\.[A-Za-z][A-Za-z0-9._-]{0,95}|attributes\\.[a-z][a-z0-9_]{0,63})|requester\\.identifiers\\.[A-Za-z][A-Za-z0-9._-]{0,95})$"
     },
-    "claimValue": {
-      "description": "Explicit claim value type, nullability, and encoded-size bound for a claim derived from declared Relay consultation outputs.",
-      "type": "object", "additionalProperties": false, "required": ["type"],
-      "properties": { "type": {"x-registry-field": "property", "enum": ["boolean", "integer", "string", "date"] }, "nullable": {"x-registry-field": "property", "type": "boolean" }, "max_bytes": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 65536 } }
+    "consultationService": {
+      "description": "Relay consultation policy and closed bindings to authored integration packs.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "version",
+        "purpose",
+        "legal_basis",
+        "consent",
+        "consultations"
+      ],
+      "properties": {
+        "kind": {
+          "x-registry-field": "property",
+          "const": "consultation_api"
+        },
+        "version": {
+          "x-registry-field": "property",
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 4294967295
+        },
+        "purpose": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/token"
+        },
+        "legal_basis": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/token"
+        },
+        "consent": {
+          "x-registry-field": "property",
+          "enum": [
+            "not_required",
+            "required"
+          ]
+        },
+        "variables": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/variables",
+          "description": "Typed request variables available to Relay consultation bindings."
+        },
+        "consultations": {
+          "x-registry-field": "property",
+          "$ref": "#/$defs/consultations"
+        }
+      }
     }
   }
 }
diff --git a/crates/registryctl/schemas/project-documentation/registry.project.configuration_reference.v1.schema.json b/crates/registryctl/schemas/project-documentation/registry.project.configuration_reference.v1.schema.json
index a018c70e4..ce68a5c05 100644
--- a/crates/registryctl/schemas/project-documentation/registry.project.configuration_reference.v1.schema.json
+++ b/crates/registryctl/schemas/project-documentation/registry.project.configuration_reference.v1.schema.json
@@ -44,8 +44,7 @@
         "integration",
         "fixture",
         "entity",
-        "relay",
-        "notary"
+        "relay"
       ]
     },
     "pathKind": {
@@ -85,10 +84,7 @@
           "if": {
             "properties": {
               "schema": {
-                "enum": [
-                  "relay",
-                  "notary"
-                ]
+                "const": "relay"
               }
             }
           },
@@ -199,13 +195,10 @@
         "runtime_intent": {
           "type": "array",
           "minItems": 0,
-          "maxItems": 2,
+          "maxItems": 1,
           "uniqueItems": true,
           "items": {
-            "enum": [
-              "crates/registry-relay/config/documentation-intent.json",
-              "crates/registry-notary-core/config/documentation-intent.json"
-            ]
+            "const": "crates/registry-relay/config/documentation-intent.json"
           }
         },
         "reads_country_workspaces": {
@@ -365,8 +358,7 @@
             "integration_contract",
             "fixture_harness",
             "entity_contract",
-            "relay_runtime",
-            "notary_runtime"
+            "relay_runtime"
           ]
         },
         "human_owner": {
@@ -376,8 +368,7 @@
             "integration_maintainers",
             "test_maintainers",
             "data_model_maintainers",
-            "relay_maintainers",
-            "notary_maintainers"
+            "relay_maintainers"
           ]
         },
         "scope": {
@@ -508,7 +499,7 @@
           "anyOf": [
             {
               "type": "string",
-              "pattern": "^(registryctl\\.authoring|registry\\.(relay|notary)\\.config|config)\\.[a-z0-9_.]+$"
+              "pattern": "^(registryctl\\.authoring|registry\\.relay\\.config|config)\\.[a-z0-9_.]+$"
             },
             {
               "$ref": "#/$defs/prose"
@@ -614,10 +605,7 @@
                 "type": "object",
                 "properties": {
                   "schema": {
-                    "enum": [
-                      "relay",
-                      "notary"
-                    ]
+                    "const": "relay"
                   }
                 }
               }
@@ -717,59 +705,6 @@
               }
             }
           }
-        },
-        {
-          "if": {
-            "properties": {
-              "address": {
-                "type": "object",
-                "properties": {
-                  "schema": {
-                    "const": "notary"
-                  }
-                }
-              }
-            }
-          },
-          "then": {
-            "properties": {
-              "semantic_owner": {
-                "const": "notary_runtime"
-              },
-              "human_owner": {
-                "const": "notary_maintainers"
-              },
-              "products": {
-                "const": [
-                  "notary",
-                  "docs"
-                ]
-              },
-              "consumers": {
-                "const": [
-                  "registry_notary",
-                  "docs_generator"
-                ]
-              },
-              "generated_artifacts": {
-                "const": [
-                  "notary_config",
-                  "field_reference"
-                ]
-              },
-              "diagnostic": {
-                "anyOf": [
-                  {
-                    "type": "string",
-                    "pattern": "^(registry\\.notary\\.config|config)\\.[a-z0-9_.]+$"
-                  },
-                  {
-                    "$ref": "#/$defs/prose"
-                  }
-                ]
-              }
-            }
-          }
         }
       ]
     },
@@ -795,7 +730,6 @@
         "enum": [
           "registryctl",
           "relay",
-          "notary",
           "editor",
           "docs"
         ]
@@ -824,7 +758,6 @@
         "enum": [
           "registryctl_authoring",
           "registry_relay",
-          "registry_notary",
           "editor_tooling",
           "docs_generator"
         ]
@@ -839,7 +772,6 @@
           "editor_schemas",
           "project_build",
           "relay_config",
-          "notary_config",
           "fixture_report",
           "field_reference"
         ]
@@ -855,7 +787,6 @@
           "security",
           "privacy",
           "relay",
-          "notary",
           "compatibility",
           "documentation",
           "testing"
diff --git a/crates/registryctl/schemas/project-documentation/registry.project.configuration_reference_coverage.v1.schema.json b/crates/registryctl/schemas/project-documentation/registry.project.configuration_reference_coverage.v1.schema.json
index 97d013638..c7c6b322f 100644
--- a/crates/registryctl/schemas/project-documentation/registry.project.configuration_reference_coverage.v1.schema.json
+++ b/crates/registryctl/schemas/project-documentation/registry.project.configuration_reference_coverage.v1.schema.json
@@ -75,8 +75,7 @@
         "integration",
         "fixture",
         "entity",
-        "relay",
-        "notary"
+        "relay"
       ]
     },
     "pathKind": {
@@ -157,13 +156,10 @@
         "runtime_intent": {
           "type": "array",
           "minItems": 0,
-          "maxItems": 2,
+          "maxItems": 1,
           "uniqueItems": true,
           "items": {
-            "enum": [
-              "crates/registry-relay/config/documentation-intent.json",
-              "crates/registry-notary-core/config/documentation-intent.json"
-            ]
+            "const": "crates/registry-relay/config/documentation-intent.json"
           }
         },
         "reads_country_workspaces": {
@@ -289,10 +285,7 @@
           "if": {
             "properties": {
               "schema": {
-                "enum": [
-                  "relay",
-                  "notary"
-                ]
+                "const": "relay"
               }
             }
           },
diff --git a/crates/registryctl/schemas/project-documentation/registry.runtime.configuration_intent.v1.schema.json b/crates/registryctl/schemas/project-documentation/registry.runtime.configuration_intent.v1.schema.json
index 111c2df50..4ff26d472 100644
--- a/crates/registryctl/schemas/project-documentation/registry.runtime.configuration_intent.v1.schema.json
+++ b/crates/registryctl/schemas/project-documentation/registry.runtime.configuration_intent.v1.schema.json
@@ -118,77 +118,11 @@
           }
         }
       }
-    },
-    {
-      "if": {
-        "properties": {
-          "runtime_schema": {
-            "const": "notary"
-          }
-        }
-      },
-      "then": {
-        "properties": {
-          "profiles": {
-            "type": "array",
-            "items": {
-              "allOf": [
-                {
-                  "$ref": "#/$defs/profile"
-                },
-                {
-                  "type": "object",
-                  "properties": {
-                    "semantic_owner": {
-                      "const": "notary_runtime"
-                    },
-                    "human_owner": {
-                      "const": "notary_maintainers"
-                    },
-                    "products": {
-                      "const": [
-                        "notary",
-                        "docs"
-                      ]
-                    },
-                    "consumers": {
-                      "const": [
-                        "registry_notary",
-                        "docs_generator"
-                      ]
-                    },
-                    "generated_artifacts": {
-                      "const": [
-                        "notary_config",
-                        "field_reference"
-                      ]
-                    },
-                    "diagnostic": {
-                      "anyOf": [
-                        {
-                          "type": "string",
-                          "pattern": "^(registry\\.notary\\.config|config)\\.[a-z0-9_.]+$"
-                        },
-                        {
-                          "$ref": "#/$defs/prose"
-                        }
-                      ]
-                    }
-                  }
-                }
-              ]
-            }
-          }
-        }
-      }
     }
   ],
   "$defs": {
     "runtimeSchema": {
-      "enum": [
-        "relay",
-        "notary"
-      ]
+      "const": "relay"
     },
     "pathKind": {
       "enum": [
@@ -238,16 +172,10 @@
           "$ref": "#/$defs/prose"
         },
         "semantic_owner": {
-          "enum": [
-            "relay_runtime",
-            "notary_runtime"
-          ]
+          "const": "relay_runtime"
         },
         "human_owner": {
-          "enum": [
-            "relay_maintainers",
-            "notary_maintainers"
-          ]
+          "const": "relay_maintainers"
         },
         "scope": {
           "$ref": "#/$defs/prose"
@@ -277,7 +205,6 @@
           "items": {
             "enum": [
               "relay",
-              "notary",
               "docs"
             ]
           }
@@ -307,7 +234,7 @@
           "anyOf": [
             {
               "type": "string",
-              "pattern": "^(registry\\.(relay|notary)\\.config|config)\\.[a-z0-9_.]+$"
+              "pattern": "^(registry\\.relay\\.config|config)\\.[a-z0-9_.]+$"
             },
             {
               "$ref": "#/$defs/prose"
@@ -334,7 +261,6 @@
           "items": {
             "enum": [
               "registry_relay",
-              "registry_notary",
               "docs_generator"
             ]
           }
@@ -346,7 +272,6 @@
           "items": {
             "enum": [
               "relay_config",
-              "notary_config",
               "field_reference"
             ]
           }
@@ -361,7 +286,6 @@
               "security",
               "privacy",
               "relay",
-              "notary",
               "compatibility",
               "documentation"
             ]
diff --git a/crates/registryctl/schemas/project-reports/registry.project.artifact_manifest.v1.schema.json b/crates/registryctl/schemas/project-reports/registry.project.artifact_manifest.v1.schema.json
index efd0b2555..fc47705b0 100644
--- a/crates/registryctl/schemas/project-reports/registry.project.artifact_manifest.v1.schema.json
+++ b/crates/registryctl/schemas/project-reports/registry.project.artifact_manifest.v1.schema.json
@@ -126,7 +126,6 @@
               "runtime_config",
               "consultation_contract",
               "source_plan",
-              "claim_configuration",
               "deployment_input",
               "review_record",
               "documentation"
@@ -179,7 +178,6 @@
           "items": {
             "enum": [
               "registry_relay",
-              "registry_notary",
               "bundle_signer",
               "deployment_tooling",
               "project_documentation",
diff --git a/crates/registryctl/schemas/project-reports/registry.project.capability_inventory.v1.schema.json b/crates/registryctl/schemas/project-reports/registry.project.capability_inventory.v1.schema.json
index 1b7a422cd..a29d8fd18 100644
--- a/crates/registryctl/schemas/project-reports/registry.project.capability_inventory.v1.schema.json
+++ b/crates/registryctl/schemas/project-reports/registry.project.capability_inventory.v1.schema.json
@@ -26,8 +26,8 @@
     },
     "capabilities": {
       "type": "array",
-      "minItems": 12,
-      "maxItems": 12,
+      "minItems": 9,
+      "maxItems": 9,
       "items": {
         "$ref": "#/$defs/capability_record"
       },
@@ -38,18 +38,15 @@
         {"contains": {"properties": {"capability": {"const": "rhai_runtime"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1},
         {"contains": {"properties": {"capability": {"const": "rhai_abi"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1},
         {"contains": {"properties": {"capability": {"const": "registry_relay_product"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1},
-        {"contains": {"properties": {"capability": {"const": "registry_notary_product"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1},
         {"contains": {"properties": {"capability": {"const": "registry_relay_validator"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1},
-        {"contains": {"properties": {"capability": {"const": "registry_notary_validator"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1},
         {"contains": {"properties": {"capability": {"const": "project_authoring_schemas"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1},
-        {"contains": {"properties": {"capability": {"const": "registry_relay_config_schema"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1},
-        {"contains": {"properties": {"capability": {"const": "registry_notary_config_schema"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1}
+        {"contains": {"properties": {"capability": {"const": "registry_relay_config_schema"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1}
       ]
     },
     "support": {
       "type": "array",
-      "minItems": 14,
-      "maxItems": 14,
+      "minItems": 10,
+      "maxItems": 10,
       "items": {
         "$ref": "#/$defs/support_assessment"
       },
@@ -59,20 +56,16 @@
         {"contains": {"properties": {"component": {"const": "snapshot_materialization_worker"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1},
         {"contains": {"properties": {"component": {"const": "rhai_xw_protocol_helper"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1},
         {"contains": {"properties": {"component": {"const": "registry_relay_product"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1},
-        {"contains": {"properties": {"component": {"const": "registry_notary_product"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1},
         {"contains": {"properties": {"component": {"const": "registry_relay_validator"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1},
-        {"contains": {"properties": {"component": {"const": "registry_notary_validator"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1},
         {"contains": {"properties": {"component": {"const": "project_authoring_schema"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1},
         {"contains": {"properties": {"component": {"const": "registry_relay_config_schema"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1},
-        {"contains": {"properties": {"component": {"const": "registry_notary_config_schema"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1},
         {"contains": {"properties": {"component": {"const": "registryctl_distribution"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1},
-        {"contains": {"properties": {"component": {"const": "registry_relay_image"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1},
-        {"contains": {"properties": {"component": {"const": "registry_notary_image"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1}
+        {"contains": {"properties": {"component": {"const": "registry_relay_image"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1}
       ]
     },
     "missing_support": {
       "type": "array",
-      "maxItems": 14,
+      "maxItems": 10,
       "uniqueItems": true,
       "items": {
         "$ref": "#/$defs/missing_support"
@@ -80,7 +73,7 @@
     },
     "inactive_or_unused": {
       "type": "array",
-      "maxItems": 5,
+      "maxItems": 4,
       "uniqueItems": true,
       "items": {
         "$ref": "#/$defs/inactive_or_unused"
@@ -96,12 +89,9 @@
         "rhai_runtime",
         "rhai_abi",
         "registry_relay_product",
-        "registry_notary_product",
         "registry_relay_validator",
-        "registry_notary_validator",
         "project_authoring_schemas",
-        "registry_relay_config_schema",
-        "registry_notary_config_schema"
+        "registry_relay_config_schema"
       ]
     },
     "capability_version": {
@@ -110,27 +100,24 @@
         "relay_integration_pack_v1",
         "rhai_language_v1",
         "rhai_xw_v1",
-        "registry_relay_config_v1",
-        "registry_notary_config_v1"
+        "registry_relay_config_v1"
       ]
     },
     "owner": {
       "enum": [
         "registryctl",
         "registry_relay",
-        "registry_notary",
         "release_engineering"
       ]
     },
     "usage": {
-      "description": "Value-free usage counts. total is the bounded aggregate; strict typed ingress requires it to equal services + consultations + claims.",
+      "description": "Value-free usage counts. total is the bounded aggregate; strict typed ingress requires it to equal services + consultations.",
       "x-registry-aggregateMaximum": 1000000,
       "type": "object",
       "additionalProperties": false,
       "required": [
         "services",
         "consultations",
-        "claims",
         "total"
       ],
       "properties": {
@@ -144,11 +131,6 @@
           "minimum": 0,
           "maximum": 1000000
         },
-        "claims": {
-          "type": "integer",
-          "minimum": 0,
-          "maximum": 1000000
-        },
         "total": {
           "type": "integer",
           "minimum": 0,
@@ -333,15 +315,11 @@
         "snapshot_materialization_worker",
         "rhai_xw_protocol_helper",
         "registry_relay_product",
-        "registry_notary_product",
         "registry_relay_validator",
-        "registry_notary_validator",
         "project_authoring_schema",
         "registry_relay_config_schema",
-        "registry_notary_config_schema",
         "registryctl_distribution",
-        "registry_relay_image",
-        "registry_notary_image"
+        "registry_relay_image"
       ]
     },
     "support_kind": {
@@ -413,10 +391,7 @@
           "if": {
             "properties": {
               "component": {
-                "enum": [
-                  "registry_relay_image",
-                  "registry_notary_image"
-                ]
+                "const": "registry_relay_image"
               }
             },
             "required": [
@@ -558,8 +533,7 @@
             "source_http",
             "source_script",
             "source_snapshot",
-            "registry_relay_product",
-            "registry_notary_product"
+            "registry_relay_product"
           ]
         },
         "reason": {
diff --git a/crates/registryctl/schemas/project-reports/registry.project.explanation.v1.schema.json b/crates/registryctl/schemas/project-reports/registry.project.explanation.v1.schema.json
index 9e9b603df..5d38c45b7 100644
--- a/crates/registryctl/schemas/project-reports/registry.project.explanation.v1.schema.json
+++ b/crates/registryctl/schemas/project-reports/registry.project.explanation.v1.schema.json
@@ -269,7 +269,6 @@
       "enum": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ]
@@ -280,7 +279,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -314,7 +312,8 @@
             "deployment_security",
             "integration_contract",
             "fixture_harness",
-            "entity_contract"
+            "entity_contract",
+            "relay_runtime"
           ]
         },
         "human_owner": {
@@ -323,7 +322,8 @@
             "security_maintainers",
             "integration_maintainers",
             "test_maintainers",
-            "data_model_maintainers"
+            "data_model_maintainers",
+            "relay_maintainers"
           ]
         },
         "sensitivity": {
@@ -340,7 +340,7 @@
         "products": {
           "type": "array",
           "items": {
-            "enum": ["registryctl", "relay", "notary", "editor", "docs"]
+            "enum": ["registryctl", "relay", "editor", "docs"]
           }
         },
         "introduced_in": {
@@ -374,7 +374,6 @@
               "editor_schemas",
               "project_build",
               "relay_config",
-              "notary_config",
               "fixture_report",
               "field_reference"
             ]
diff --git a/crates/registryctl/schemas/project-reports/registry.project.fixture_coverage.v1.schema.json b/crates/registryctl/schemas/project-reports/registry.project.fixture_coverage.v1.schema.json
index 919f67f31..9296c1934 100644
--- a/crates/registryctl/schemas/project-reports/registry.project.fixture_coverage.v1.schema.json
+++ b/crates/registryctl/schemas/project-reports/registry.project.fixture_coverage.v1.schema.json
@@ -12,7 +12,6 @@
     "evidence_scope",
     "compatibility_claim",
     "live_compatibility",
-    "governed_request_evidence",
     "targets",
     "summary"
   ],
@@ -42,9 +41,6 @@
     "live_compatibility": {
       "const": "not_evaluated"
     },
-    "governed_request_evidence": {
-      "const": "per_consultation_authored_request_witness_evaluation"
-    },
     "targets": {
       "type": "array",
       "maxItems": 256,
@@ -81,30 +77,8 @@
         "$ref": "#/$defs/identifier"
       }
     },
-    "consultation_identity": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["service_id", "consultation_id"],
-      "properties": {
-        "service_id": {
-          "$ref": "#/$defs/identifier"
-        },
-        "consultation_id": {
-          "$ref": "#/$defs/identifier"
-        }
-      }
-    },
-    "consultation_identity_list": {
-      "type": "array",
-      "maxItems": 512,
-      "uniqueItems": true,
-      "items": {
-        "$ref": "#/$defs/consultation_identity"
-      }
-    },
     "safe_code": {
       "enum": [
-        "authorization.denied",
         "failure.subject_mismatch",
         "fixture.execution_contract_invalid",
         "fixture.profile_not_found",
@@ -218,11 +192,9 @@
         "interaction_count",
         "input_ids",
         "output_ids",
-        "claim_ids",
         "exercised_status_mappings",
         "classification",
-        "pass_state",
-        "request_to_consultation_binding"
+        "pass_state"
       ],
       "properties": {
         "evidence": {
@@ -251,9 +223,6 @@
         "output_ids": {
           "$ref": "#/$defs/identifier_list"
         },
-        "claim_ids": {
-          "$ref": "#/$defs/identifier_list"
-        },
         "exercised_status_mappings": {
           "type": "array",
           "maxItems": 2,
@@ -267,9 +236,6 @@
         },
         "pass_state": {
           "$ref": "#/$defs/pass_state"
-        },
-        "request_to_consultation_binding": {
-          "$ref": "#/$defs/request_binding"
         }
       }
     },
@@ -306,7 +272,6 @@
             "byte_ceiling",
             "timeout",
             "protocol_verification",
-            "authorization_before_source",
             "output_minimization"
           ]
         },
@@ -349,7 +314,6 @@
                 "no_distinguishable_request_pair",
                 "no_generated_request_matcher",
                 "final_response_is_not_json_object",
-                "integration_has_no_product_claims",
                 "snapshot_uses_closed_materialization",
                 "protocol_matcher_owns_response_mutation"
               ]
@@ -362,7 +326,6 @@
                 "order_mutation_requires_distinguishable_source_interactions",
                 "protocol_mutation_requires_generated_request_matcher",
                 "mutation_requires_final_json_object_response",
-                "authorization_check_requires_product_claim_evaluation",
                 "snapshot_output_uses_closed_materialization_projection",
                 "protocol_matcher_fixture_uses_protocol_verification_instead"
               ]
@@ -371,45 +334,6 @@
         }
       ]
     },
-    "source_access_assertion": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "expected_source_calls",
-        "actual_source_calls",
-        "passed"
-      ],
-      "properties": {
-        "expected_source_calls": {
-          "const": "zero"
-        },
-        "actual_source_calls": {
-          "oneOf": [
-            {
-              "type": "null"
-            },
-            {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 16
-            }
-          ]
-        },
-        "passed": {
-          "type": "boolean"
-        }
-      }
-    },
-    "nullable_source_access_assertion": {
-      "oneOf": [
-        {
-          "type": "null"
-        },
-        {
-          "$ref": "#/$defs/source_access_assertion"
-        }
-      ]
-    },
     "generated_case": {
       "type": "object",
       "additionalProperties": false,
@@ -421,8 +345,7 @@
         "mutation_target_class",
         "expected_safe_code",
         "actual_safe_code",
-        "pass_state",
-        "source_access_assertion"
+        "pass_state"
       ],
       "properties": {
         "evidence": {
@@ -446,7 +369,6 @@
             "declared_response_byte_count",
             "source_deadline",
             "protocol_response_envelope",
-            "authorization_gate",
             "unselected_response_member"
           ]
         },
@@ -456,11 +378,8 @@
         "actual_safe_code": {
           "$ref": "#/$defs/nullable_safe_code"
         },
-    "pass_state": {
+        "pass_state": {
           "$ref": "#/$defs/pass_state"
-        },
-        "source_access_assertion": {
-          "$ref": "#/$defs/nullable_source_access_assertion"
         }
       }
     },
@@ -537,8 +456,6 @@
       "required": [
         "input_ids",
         "output_ids",
-        "claim_ids",
-        "disclosure_modes",
         "status_mappings",
         "protocol_helpers",
         "limits",
@@ -551,21 +468,6 @@
         "output_ids": {
           "$ref": "#/$defs/identifier_list"
         },
-        "claim_ids": {
-          "$ref": "#/$defs/identifier_list"
-        },
-        "disclosure_modes": {
-          "type": "array",
-          "maxItems": 3,
-          "uniqueItems": true,
-          "items": {
-            "enum": [
-              "predicate",
-              "redacted",
-              "value"
-            ]
-          }
-        },
         "status_mappings": {
           "type": "array",
           "maxItems": 2,
@@ -621,7 +523,6 @@
           "enum": [
             "changed_input",
             "changed_output",
-            "changed_claim",
             "changed_source_contract"
           ]
         },
@@ -653,8 +554,8 @@
         },
         "impacts": {
           "type": "array",
-          "minItems": 4,
-          "maxItems": 4,
+          "minItems": 3,
+          "maxItems": 3,
           "items": {
             "$ref": "#/$defs/change_impact"
           }
@@ -671,61 +572,6 @@
         }
       ]
     },
-    "request_binding": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["state", "consultations", "actual_relay_consultations", "safe_error_code"],
-      "properties": {
-        "state": {
-          "enum": ["not_authored", "not_executed", "passed", "failed"]
-        },
-        "consultations": {
-          "$ref": "#/$defs/consultation_identity_list"
-        },
-        "actual_relay_consultations": {
-          "type": ["integer", "null"],
-          "minimum": 0,
-          "maximum": 4294967295
-        },
-        "safe_error_code": {
-          "$ref": "#/$defs/nullable_safe_code"
-        }
-      },
-      "oneOf": [
-        {
-          "properties": {
-            "state": { "enum": ["not_authored", "not_executed"] },
-            "consultations": { "maxItems": 0 },
-            "actual_relay_consultations": { "type": "null" },
-            "safe_error_code": { "type": "null" }
-          }
-        },
-        {
-          "properties": {
-            "state": { "const": "passed" },
-            "consultations": { "minItems": 1 },
-            "actual_relay_consultations": {
-              "type": "integer",
-              "minimum": 1,
-              "maximum": 4294967295
-            },
-            "safe_error_code": { "type": "null" }
-          }
-        },
-        {
-          "properties": {
-            "state": { "const": "failed" },
-            "consultations": { "maxItems": 0 },
-            "actual_relay_consultations": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 4294967295
-            },
-            "safe_error_code": { "$ref": "#/$defs/safe_code" }
-          }
-        }
-      ]
-    },
     "requirement_name": {
       "enum": [
         "semantic_match",
@@ -733,22 +579,16 @@
         "semantic_ambiguity",
         "subject_mismatch",
         "semantic_null",
-        "authorization_denial",
         "source_failure",
         "request_rendering",
-        "request_to_consultation_binding",
         "expected_source_interactions",
         "source_interaction_order",
         "output_fields",
-        "claims",
-        "declared_disclosure_modes",
-        "exercised_disclosure_modes",
         "script_branches",
         "pagination_and_continuation",
         "status_mappings",
         "protocol_helpers",
         "protocol_verification",
-        "authorization_before_source",
         "malformed_decoding",
         "structural_limits",
         "request_bytes",
@@ -761,7 +601,6 @@
         "output_minimization",
         "changed_input_affected_fixtures",
         "changed_output_affected_fixtures",
-        "changed_claim_affected_fixtures",
         "changed_source_contract_affected_fixtures"
       ]
     },
@@ -822,7 +661,6 @@
               "enum": [
                 "required_evidence_missing",
                 "target_has_no_fixtures",
-                "runtime_dimension_not_observed",
                 "numeric_boundary_not_exercised",
                 "script_branch_contract_not_declared"
               ]
@@ -850,7 +688,6 @@
             },
             "reason": {
               "enum": [
-                "no_product_claims_declared",
                 "no_protocol_helpers_declared",
                 "no_verification_protocol_declared",
                 "no_continuation_protocol_declared",
@@ -901,8 +738,8 @@
     },
     "requirements": {
       "type": "array",
-      "minItems": 35,
-      "maxItems": 35,
+      "minItems": 28,
+      "maxItems": 28,
       "uniqueItems": true,
       "prefixItems": [
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "semantic_match" } } },
@@ -910,22 +747,16 @@
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "semantic_ambiguity" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "subject_mismatch" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "semantic_null" } } },
-        { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "authorization_denial" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "source_failure" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "request_rendering" } } },
-        { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "request_to_consultation_binding" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "expected_source_interactions" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "source_interaction_order" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "output_fields" } } },
-        { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "claims" } } },
-        { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "declared_disclosure_modes" } } },
-        { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "exercised_disclosure_modes" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "script_branches" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "pagination_and_continuation" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "status_mappings" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "protocol_helpers" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "protocol_verification" } } },
-        { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "authorization_before_source" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "malformed_decoding" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "structural_limits" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "request_bytes" } } },
@@ -938,7 +769,6 @@
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "output_minimization" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "changed_input_affected_fixtures" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "changed_output_affected_fixtures" } } },
-        { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "changed_claim_affected_fixtures" } } },
         { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "changed_source_contract_affected_fixtures" } } }
       ],
       "items": false
@@ -985,8 +815,7 @@
           "additionalProperties": false,
           "required": [
             "source_operation_count",
-            "reviewed_not_applicable",
-            "registry_backed_consultations"
+            "reviewed_not_applicable"
           ],
           "properties": {
             "source_operation_count": {
@@ -1011,9 +840,6 @@
                   "subject_mismatch"
                 ]
               }
-            },
-            "registry_backed_consultations": {
-              "$ref": "#/$defs/consultation_identity_list"
             }
           }
         },
@@ -1035,7 +861,7 @@
         },
         "generated_cases": {
           "type": "array",
-          "maxItems": 9216,
+          "maxItems": 8192,
           "items": {
             "$ref": "#/$defs/generated_case"
           }
@@ -1107,27 +933,27 @@
             "covered": {
               "type": "integer",
               "minimum": 0,
-              "maximum": 8704
+              "maximum": 7168
             },
             "missing": {
               "type": "integer",
               "minimum": 0,
-              "maximum": 8704
+              "maximum": 7168
             },
             "not_applicable": {
               "type": "integer",
               "minimum": 0,
-              "maximum": 8704
+              "maximum": 7168
             },
             "not_evaluated": {
               "type": "integer",
               "minimum": 0,
-              "maximum": 8704
+              "maximum": 7168
             },
             "total": {
               "type": "integer",
               "minimum": 0,
-              "maximum": 8704
+              "maximum": 7168
             }
           }
         }
diff --git a/crates/registryctl/schemas/project-reports/registry.project.semantic_impact.v1.schema.json b/crates/registryctl/schemas/project-reports/registry.project.semantic_impact.v1.schema.json
index 032f8148f..87211811b 100644
--- a/crates/registryctl/schemas/project-reports/registry.project.semantic_impact.v1.schema.json
+++ b/crates/registryctl/schemas/project-reports/registry.project.semantic_impact.v1.schema.json
@@ -33,11 +33,9 @@
     },
     "dimension": {
       "enum": [
-        "claim",
         "integration",
         "service_policy",
         "operator_security",
-        "disclosure",
         "compiler"
       ]
     },
@@ -56,7 +54,6 @@
       "enum": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator",
         "bundle_signer",
@@ -73,7 +70,6 @@
         "privacy",
         "security",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing",
@@ -176,8 +172,6 @@
             "fixture",
             "service_policy",
             "consultation",
-            "claim",
-            "disclosure",
             "product_input",
             "generated_artifact"
           ]
@@ -196,7 +190,6 @@
           "enum": [
             "registryctl",
             "relay",
-            "notary",
             "editor",
             "docs"
           ]
@@ -224,10 +217,10 @@
     },
     "product_actions": {
       "type": "array",
-      "maxItems": 3,
+      "maxItems": 2,
       "uniqueItems": true,
       "items": {
-        "enum": ["relay-public", "relay-consultation", "notary"]
+        "enum": ["relay-public", "relay-consultation"]
       }
     },
     "semantic_impact": {
diff --git a/crates/registryctl/schemas/project-reports/registryctl.fixture_error_reference.v1.schema.json b/crates/registryctl/schemas/project-reports/registryctl.fixture_error_reference.v1.schema.json
index 64499435c..697b05818 100644
--- a/crates/registryctl/schemas/project-reports/registryctl.fixture_error_reference.v1.schema.json
+++ b/crates/registryctl/schemas/project-reports/registryctl.fixture_error_reference.v1.schema.json
@@ -11,8 +11,8 @@
     },
     "entries": {
       "type": "array",
-      "minItems": 16,
-      "maxItems": 16,
+      "minItems": 15,
+      "maxItems": 15,
       "uniqueItems": true,
       "items": {
         "$ref": "#/$defs/entry"
@@ -22,7 +22,6 @@
   "$defs": {
     "code": {
       "enum": [
-        "authorization.denied",
         "failure.subject_mismatch",
         "fixture.execution_contract_invalid",
         "fixture.profile_not_found",
diff --git a/crates/registryctl/schemas/project-reports/registryctl.operator_error_reference.v1.schema.json b/crates/registryctl/schemas/project-reports/registryctl.operator_error_reference.v1.schema.json
index ef6a249c9..35ddf4e19 100644
--- a/crates/registryctl/schemas/project-reports/registryctl.operator_error_reference.v1.schema.json
+++ b/crates/registryctl/schemas/project-reports/registryctl.operator_error_reference.v1.schema.json
@@ -11,8 +11,8 @@
     },
     "entries": {
       "type": "array",
-      "minItems": 60,
-      "maxItems": 60,
+      "minItems": 42,
+      "maxItems": 42,
       "uniqueItems": true,
       "items": {
         "allOf": [
@@ -56,7 +56,6 @@
         "family": {
           "enum": [
             "bundle_verification",
-            "notary_activation",
             "operator_preflight",
             "relay_activation",
             "relay_process_startup"
@@ -69,7 +68,6 @@
         },
         "owner": {
           "enum": [
-            "registry_notary",
             "registry_platform_ops",
             "registry_relay",
             "registryctl"
@@ -77,7 +75,6 @@
         },
         "product": {
           "enum": [
-            "registry_notary",
             "registry_platform_ops",
             "registry_relay",
             "registryctl"
@@ -156,44 +153,6 @@
             }
           }
         },
-        {
-          "properties": {
-            "family": {
-              "const": "notary_activation"
-            },
-            "code": {
-              "enum": [
-                "notary.cel.worker_unavailable",
-                "notary.configuration.invalid",
-                "notary.deployment.gate_failed",
-                "notary.relay.activation_failed",
-                "notary.relay.configuration_invalid",
-                "notary.relay.credential_unavailable",
-                "notary.relay.credentials_rejected",
-            "notary.relay.profile_mismatch",
-            "notary.relay.profile_not_found",
-            "notary.relay.unavailable",
-            "notary.runtime.activation_failed",
-            "notary.runtime.activation_required",
-            "notary.state.postgresql.database_read_only",
-            "notary.state.postgresql.database_unavailable",
-            "notary.state.postgresql.database_unsupported",
-            "notary.state.postgresql.durability_unsafe",
-            "notary.state.postgresql.role_incompatible",
-            "notary.state.postgresql.schema_incompatible"
-              ]
-            },
-            "owner": {
-              "const": "registry_notary"
-            },
-            "product": {
-              "const": "registry_notary"
-            },
-            "docs_anchor": {
-              "pattern": "^/reference/diagnostics/operator/#registry_notary--[a-z0-9]+(?:-[a-z0-9]+)*$"
-            }
-          }
-        },
         {
           "properties": {
             "family": {
diff --git a/crates/registryctl/schemas/project-reports/registryctl.project_command.v1.schema.json b/crates/registryctl/schemas/project-reports/registryctl.project_command.v1.schema.json
index 261ebbf4d..42b744fda 100644
--- a/crates/registryctl/schemas/project-reports/registryctl.project_command.v1.schema.json
+++ b/crates/registryctl/schemas/project-reports/registryctl.project_command.v1.schema.json
@@ -89,7 +89,6 @@
         "inputs",
         "calls",
         "outputs",
-        "claims",
         "passed"
       ],
       "additionalProperties": false,
@@ -109,9 +108,6 @@
         "outputs": {
           "$ref": "#/$defs/string_list"
         },
-        "claims": {
-          "$ref": "#/$defs/string_list"
-        },
         "outcome": {
           "$ref": "#/$defs/non_empty_string"
         },
@@ -136,11 +132,9 @@
       "properties": {
         "dimension": {
           "enum": [
-            "claim",
             "integration",
             "service_policy",
             "operator_security",
-            "disclosure",
             "compiler"
           ]
         }
diff --git a/crates/registryctl/schemas/project-reports/registryctl.project_preflight.v1.schema.json b/crates/registryctl/schemas/project-reports/registryctl.project_preflight.v1.schema.json
index c3c00dd2d..8e4835db7 100644
--- a/crates/registryctl/schemas/project-reports/registryctl.project_preflight.v1.schema.json
+++ b/crates/registryctl/schemas/project-reports/registryctl.project_preflight.v1.schema.json
@@ -47,7 +47,7 @@
     },
     "product_validators": {
       "type": "array",
-      "maxItems": 2,
+      "maxItems": 1,
       "uniqueItems": true,
       "items": {
         "$ref": "#/$defs/product_validator"
@@ -210,7 +210,7 @@
       "additionalProperties": false,
       "properties": {
         "product": {
-          "enum": ["registry_relay", "registry_notary"]
+          "const": "registry_relay"
         },
         "capability": {
           "const": "configuration_validation"
@@ -231,12 +231,7 @@
         "source_mtls_private_key",
         "source_oauth_mtls_private_key",
         "source_jwks_mtls_private_key",
-        "entity_postgres_connection",
-        "issuance_signing_key",
-        "caller_api_key_fingerprint",
-        "oid4vci_client_signing_key",
-        "oid4vci_access_token_signing_key",
-        "oid4vci_sensitive_state_key"
+        "entity_postgres_connection"
       ]
     },
     "secret_check": {
@@ -247,7 +242,7 @@
         "consumers": {
           "type": "array",
           "minItems": 1,
-          "maxItems": 15,
+          "maxItems": 10,
           "uniqueItems": true,
           "items": {
             "$ref": "#/$defs/secret_consumer"
@@ -272,9 +267,7 @@
         "entity_csv",
         "entity_xlsx",
         "entity_parquet",
-        "relay_state_root_certificate",
-        "notary_state_root_certificate",
-        "notary_to_relay_token"
+        "relay_state_root_certificate"
       ]
     },
     "runtime_file": {
@@ -308,11 +301,7 @@
           "if": {
             "properties": {
               "kind": {
-                "enum": [
-                  "relay_state_root_certificate",
-                  "notary_state_root_certificate",
-                  "notary_to_relay_token"
-                ]
+                "const": "relay_state_root_certificate"
               }
             }
           },
diff --git a/crates/registryctl/src/approved_set.rs b/crates/registryctl/src/approved_set.rs
index 5637c5e1e..56be87915 100644
--- a/crates/registryctl/src/approved_set.rs
+++ b/crates/registryctl/src/approved_set.rs
@@ -1,11 +1,11 @@
 // SPDX-License-Identifier: Apache-2.0
 
-//! Fixed three-lane approved baseline set assembly.
+//! Fixed two-lane Relay approved baseline set assembly.
 //!
 //! This module deliberately does not make an approved set a signature or an
 //! activation authority. Product-specific verification remains responsible
 //! for constructing [`VerifiedApprovedLaneV1`]. Assembly then proves that all
-//! three independently verified lanes form one compatible governed set.
+//! two independently verified lanes form one compatible governed set.
 
 use std::collections::BTreeSet;
 use std::fmt;
@@ -24,7 +24,13 @@ use registry_platform_crypto::{canonicalize_json, parse_json_strict};
 use serde::{Deserialize, Serialize};
 
 pub const APPROVED_BASELINE_SET_SCHEMA_ID: &str = "registry.stack.approved_baseline_set";
-pub const APPROVED_BASELINE_SET_SCHEMA_VERSION: &str = "1.0";
+pub const APPROVED_BASELINE_SET_SCHEMA_VERSION: &str = "2.0";
+/// The schema version issued while Registry Notary was still a governed lane.
+///
+/// Documents at this version bind a Notary lane and cross-lane interface
+/// digests that this reader no longer verifies. They are refused by name so an
+/// operator reads the retirement rather than an unknown-field decoding error.
+const PRE_NOTARY_RETIREMENT_APPROVED_BASELINE_SET_SCHEMA_VERSION: &str = "1.0";
 pub const MAX_APPROVED_BASELINE_SET_BYTES: u64 = 1024 * 1024;
 const MAX_PORTABLE_LOCATOR_BYTES: usize = 1024;
 const MAX_ANCHOR_TRANSITIONS: usize = 64;
@@ -35,18 +41,15 @@ pub enum ApprovedLaneV1 {
     RelayPublic,
     #[serde(rename = "relay-consultation")]
     RelayConsultation,
-    #[serde(rename = "notary")]
-    Notary,
 }
 
 impl ApprovedLaneV1 {
-    pub const ALL: [Self; 3] = [Self::RelayPublic, Self::RelayConsultation, Self::Notary];
+    pub const ALL: [Self; 2] = [Self::RelayPublic, Self::RelayConsultation];
 
     pub const fn acceptance_lane(self) -> ProductAcceptanceLaneV1 {
         match self {
             Self::RelayPublic => ProductAcceptanceLaneV1::RelayPublic,
             Self::RelayConsultation => ProductAcceptanceLaneV1::RelayConsultation,
-            Self::Notary => ProductAcceptanceLaneV1::Notary,
         }
     }
 
@@ -55,15 +58,14 @@ impl ApprovedLaneV1 {
             Self::RelayPublic | Self::RelayConsultation => {
                 ProductAcceptanceProductV1::RegistryRelay
             }
-            Self::Notary => ProductAcceptanceProductV1::RegistryNotary,
         }
     }
 
-    pub const fn from_acceptance_lane(lane: ProductAcceptanceLaneV1) -> Self {
+    pub fn try_from_acceptance_lane(lane: ProductAcceptanceLaneV1) -> Result<Self> {
         match lane {
-            ProductAcceptanceLaneV1::RelayPublic => Self::RelayPublic,
-            ProductAcceptanceLaneV1::RelayConsultation => Self::RelayConsultation,
-            ProductAcceptanceLaneV1::Notary => Self::Notary,
+            ProductAcceptanceLaneV1::RelayPublic => Ok(Self::RelayPublic),
+            ProductAcceptanceLaneV1::RelayConsultation => Ok(Self::RelayConsultation),
+            _ => bail!("acceptance lane is not supported by registryctl"),
         }
     }
 
@@ -71,7 +73,6 @@ impl ApprovedLaneV1 {
         match self {
             Self::RelayPublic => "relay",
             Self::RelayConsultation => "relay_consultation",
-            Self::Notary => "notary",
         }
     }
 }
@@ -81,7 +82,6 @@ impl fmt::Display for ApprovedLaneV1 {
         formatter.write_str(match self {
             Self::RelayPublic => "relay-public",
             Self::RelayConsultation => "relay-consultation",
-            Self::Notary => "notary",
         })
     }
 }
@@ -189,40 +189,15 @@ impl ApprovedLaneLocatorsV1 {
     }
 }
 
-/// The only cross-lane product contract in the 1.0 governed topology.
-///
-/// The value is the canonical digest of the complete consultation contract
-/// closure exposed by consultation Relay and pinned by Notary. Projects with
-/// no consultations use `None` in both lanes.
-#[derive(Debug, Clone, Default, Eq, PartialEq, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-pub struct CrossLaneInterfaceDigestsV1 {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub consultation_relay_notary: Option<String>,
-}
-
-impl CrossLaneInterfaceDigestsV1 {
-    fn validate_for_lane(&self, lane: ApprovedLaneV1) -> Result<()> {
-        if let Some(digest) = &self.consultation_relay_notary {
-            validate_sha256_digest(digest, "cross-lane interface digest")?;
-            if lane == ApprovedLaneV1::RelayPublic {
-                bail!("relay-public cannot bind the consultation Relay and Notary interface");
-            }
-        }
-        Ok(())
-    }
-}
-
 #[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct ReviewedLaneBindingV1 {
     pub lane_scoped_reviewed_input_digest: String,
     pub signing_input_closure_digest: String,
-    pub interfaces: CrossLaneInterfaceDigestsV1,
 }
 
 impl ReviewedLaneBindingV1 {
-    fn validate_for_lane(&self, lane: ApprovedLaneV1) -> Result<()> {
+    fn validate(&self) -> Result<()> {
         validate_sha256_digest(
             &self.lane_scoped_reviewed_input_digest,
             "lane-scoped reviewed-input digest",
@@ -231,7 +206,7 @@ impl ReviewedLaneBindingV1 {
             &self.signing_input_closure_digest,
             "signing-input closure digest",
         )?;
-        self.interfaces.validate_for_lane(lane)
+        Ok(())
     }
 }
 
@@ -244,7 +219,6 @@ pub struct ApprovedLaneEntryV1 {
     pub anchor_digest: String,
     pub lane_scoped_reviewed_input_digest: String,
     pub signing_input_closure_digest: String,
-    pub interfaces: CrossLaneInterfaceDigestsV1,
 }
 
 impl ApprovedLaneEntryV1 {
@@ -252,16 +226,15 @@ impl ApprovedLaneEntryV1 {
         ReviewedLaneBindingV1 {
             lane_scoped_reviewed_input_digest: self.lane_scoped_reviewed_input_digest.clone(),
             signing_input_closure_digest: self.signing_input_closure_digest.clone(),
-            interfaces: self.interfaces.clone(),
         }
     }
 
-    fn validate_for_lane(&self, lane: ApprovedLaneV1) -> Result<()> {
+    fn validate(&self) -> Result<()> {
         self.locators.validate()?;
         validate_sha256_digest(&self.signed_manifest_digest, "signed manifest digest")?;
         validate_sha256_digest(&self.bundle_digest, "bundle digest")?;
         validate_sha256_digest(&self.anchor_digest, "anchor digest")?;
-        self.reviewed_binding().validate_for_lane(lane)
+        self.reviewed_binding().validate()
     }
 }
 
@@ -272,7 +245,6 @@ pub struct ApprovedBaselineLanesV1 {
     pub relay_public: ApprovedLaneEntryV1,
     #[serde(rename = "relay-consultation")]
     pub relay_consultation: ApprovedLaneEntryV1,
-    pub notary: ApprovedLaneEntryV1,
 }
 
 impl ApprovedBaselineLanesV1 {
@@ -280,38 +252,27 @@ impl ApprovedBaselineLanesV1 {
         match lane {
             ApprovedLaneV1::RelayPublic => &self.relay_public,
             ApprovedLaneV1::RelayConsultation => &self.relay_consultation,
-            ApprovedLaneV1::Notary => &self.notary,
         }
     }
 
     fn validate(&self) -> Result<()> {
         for lane in ApprovedLaneV1::ALL {
-            self.get(lane).validate_for_lane(lane)?;
-        }
-
-        let consultation = self
-            .relay_consultation
-            .interfaces
-            .consultation_relay_notary
-            .as_deref();
-        let notary = self.notary.interfaces.consultation_relay_notary.as_deref();
-        if consultation != notary {
-            bail!("consultation Relay and Notary interface digests do not match");
+            self.get(lane).validate()?;
         }
 
         let bundle_locators =
             ApprovedLaneV1::ALL.map(|lane| self.get(lane).locators.bundle.as_str());
-        if bundle_locators.into_iter().collect::<BTreeSet<_>>().len() != 3 {
+        if bundle_locators.into_iter().collect::<BTreeSet<_>>().len() != 2 {
             bail!("approved set contains a duplicated lane bundle locator");
         }
         let manifest_locators =
             ApprovedLaneV1::ALL.map(|lane| self.get(lane).locators.signed_manifest.as_str());
-        if manifest_locators.into_iter().collect::<BTreeSet<_>>().len() != 3 {
+        if manifest_locators.into_iter().collect::<BTreeSet<_>>().len() != 2 {
             bail!("approved set contains a duplicated lane manifest locator");
         }
         let anchor_locators =
             ApprovedLaneV1::ALL.map(|lane| self.get(lane).locators.anchor.as_str());
-        if anchor_locators.into_iter().collect::<BTreeSet<_>>().len() != 3 {
+        if anchor_locators.into_iter().collect::<BTreeSet<_>>().len() != 2 {
             bail!("approved set contains a duplicated lane anchor locator");
         }
         Ok(())
@@ -331,6 +292,9 @@ impl ApprovedBaselineSetV1 {
         if self.schema_id != APPROVED_BASELINE_SET_SCHEMA_ID {
             bail!("approved-set schema_id is unsupported");
         }
+        if self.schema_version == PRE_NOTARY_RETIREMENT_APPROVED_BASELINE_SET_SCHEMA_VERSION {
+            return Err(pre_notary_retirement_approved_set_error());
+        }
         if self.schema_version != APPROVED_BASELINE_SET_SCHEMA_VERSION {
             bail!("approved-set schema_version is unsupported");
         }
@@ -395,7 +359,7 @@ impl VerifiedApprovedLaneV1 {
         if let Some(previous) = &previous_config_hash {
             validate_sha256_digest(previous, "verified lane previous configuration hash")?;
         }
-        entry.validate_for_lane(lane)?;
+        entry.validate()?;
         let terminal_anchor_digest = entry.anchor_digest.clone();
         Ok(Self {
             lane,
@@ -479,7 +443,6 @@ impl VerifiedApprovedLaneV1 {
 pub struct InitialApprovedSetInputs {
     pub relay_public: PathBuf,
     pub relay_consultation: PathBuf,
-    pub notary: PathBuf,
 }
 
 impl InitialApprovedSetInputs {
@@ -487,7 +450,6 @@ impl InitialApprovedSetInputs {
         match lane {
             ApprovedLaneV1::RelayPublic => &self.relay_public,
             ApprovedLaneV1::RelayConsultation => &self.relay_consultation,
-            ApprovedLaneV1::Notary => &self.notary,
         }
     }
 }
@@ -496,7 +458,6 @@ impl InitialApprovedSetInputs {
 pub struct AffectedLaneReplacements {
     pub relay_public: Option<PathBuf>,
     pub relay_consultation: Option<PathBuf>,
-    pub notary: Option<PathBuf>,
 }
 
 impl AffectedLaneReplacements {
@@ -504,7 +465,6 @@ impl AffectedLaneReplacements {
         match lane {
             ApprovedLaneV1::RelayPublic => self.relay_public.as_deref(),
             ApprovedLaneV1::RelayConsultation => self.relay_consultation.as_deref(),
-            ApprovedLaneV1::Notary => self.notary.as_deref(),
         }
     }
 }
@@ -519,7 +479,6 @@ impl AffectedLaneReplacements {
 pub struct ReviewedBuildUpdateV1 {
     pub relay_public: Option<ReviewedLaneBindingV1>,
     pub relay_consultation: Option<ReviewedLaneBindingV1>,
-    pub notary: Option<ReviewedLaneBindingV1>,
 }
 
 impl ReviewedBuildUpdateV1 {
@@ -534,14 +493,13 @@ impl ReviewedBuildUpdateV1 {
         match lane {
             ApprovedLaneV1::RelayPublic => self.relay_public.as_ref(),
             ApprovedLaneV1::RelayConsultation => self.relay_consultation.as_ref(),
-            ApprovedLaneV1::Notary => self.notary.as_ref(),
         }
     }
 
     pub(crate) fn validate_bindings(&self) -> Result<()> {
         for lane in ApprovedLaneV1::ALL {
             if let Some(binding) = self.get(lane) {
-                binding.validate_for_lane(lane)?;
+                binding.validate()?;
             }
         }
         Ok(())
@@ -586,7 +544,6 @@ pub struct ApprovedSetAssembleOptions {
     pub preceding_set: Option<PathBuf>,
     pub relay_public: Option<PathBuf>,
     pub relay_consultation: Option<PathBuf>,
-    pub notary: Option<PathBuf>,
     pub output_file: PathBuf,
 }
 
@@ -595,7 +552,6 @@ impl ApprovedSetAssembleOptions {
         match lane {
             ApprovedLaneV1::RelayPublic => self.relay_public.as_deref(),
             ApprovedLaneV1::RelayConsultation => self.relay_consultation.as_deref(),
-            ApprovedLaneV1::Notary => self.notary.as_deref(),
         }
     }
 }
@@ -640,7 +596,6 @@ pub fn assemble_approved_set(
         let replacements = AffectedLaneReplacements {
             relay_public: options.relay_public.clone(),
             relay_consultation: options.relay_consultation.clone(),
-            notary: options.notary.clone(),
         };
         return assemble_updated_approved_set(
             preceding_file,
@@ -679,7 +634,6 @@ pub fn assemble_approved_set(
             .relay_consultation
             .clone()
             .expect("all lanes checked"),
-        notary: options.notary.clone().expect("all lanes checked"),
     };
     assemble_initial_approved_set(&inputs, &options.output_file, |request| {
         let lane = request.lane;
@@ -697,7 +651,7 @@ pub fn assemble_initial_approved_set(
     mut verify: impl FnMut(LaneVerificationRequestV1) -> Result<VerifiedApprovedLaneV1>,
 ) -> Result<ApprovedSetAssemblyReportV1> {
     validate_absent_output_file(output_file)?;
-    let mut verified = Vec::with_capacity(3);
+    let mut verified = Vec::with_capacity(2);
     for lane in ApprovedLaneV1::ALL {
         let request = LaneVerificationRequestV1 {
             lane,
@@ -745,7 +699,7 @@ pub fn assemble_updated_approved_set(
     }
 
     let preceding = load_approved_baseline_set_document(preceding_set_file)?;
-    let mut verified_preceding = Vec::with_capacity(3);
+    let mut verified_preceding = Vec::with_capacity(2);
     for lane in ApprovedLaneV1::ALL {
         let entry = preceding.lanes.get(lane).clone();
         let request = LaneVerificationRequestV1 {
@@ -765,7 +719,7 @@ pub fn assemble_updated_approved_set(
     }
     validate_identity_set(&verified_preceding)?;
 
-    let mut final_lanes = Vec::with_capacity(3);
+    let mut final_lanes = Vec::with_capacity(2);
     for lane in ApprovedLaneV1::ALL {
         let preceding_lane = verified_for(&verified_preceding, lane);
         if let (Some(expected), Some(directory)) =
@@ -842,7 +796,7 @@ pub(crate) fn load_approved_baseline_set_with_root(
     let approved_set = load_approved_baseline_set_document(path)?;
     let canonical_root =
         fs::canonicalize(closure_root).context("failed to resolve approved-set closure root")?;
-    let mut verified = Vec::with_capacity(3);
+    let mut verified = Vec::with_capacity(2);
     for lane in ApprovedLaneV1::ALL {
         verified.push(verify_lane_request(
             LaneVerificationRequestV1 {
@@ -863,12 +817,52 @@ fn load_approved_baseline_set_document(path: &Path) -> Result<ApprovedBaselineSe
     let bytes = read_bounded_regular_file_no_follow(path, MAX_APPROVED_BASELINE_SET_BYTES)
         .context("failed to read bounded approved-set input")?;
     let value = parse_json_strict(&bytes).context("approved set is not strict JSON")?;
+    reject_pre_notary_retirement_approved_set(&value)?;
     let approved_set: ApprovedBaselineSetV1 =
         serde_json::from_value(value).context("approved set does not match its closed schema")?;
     approved_set.validate()?;
     Ok(approved_set)
 }
 
+/// Refuses an approved set issued before Registry Notary was retired.
+///
+/// The removed lane entry `interfaces` field carried a SHA-256 interface digest
+/// this reader verified on load. Decoding such a document now would either fail
+/// as an unknown field or, if the field were tolerated, honor a signed approval
+/// whose integrity claim is no longer enforced. Both retired shapes are named
+/// here so the refusal states the remedy instead.
+fn reject_pre_notary_retirement_approved_set(value: &serde_json::Value) -> Result<()> {
+    if value
+        .get("schema_version")
+        .and_then(serde_json::Value::as_str)
+        == Some(PRE_NOTARY_RETIREMENT_APPROVED_BASELINE_SET_SCHEMA_VERSION)
+    {
+        return Err(pre_notary_retirement_approved_set_error());
+    }
+    let Some(lanes) = value.get("lanes").and_then(serde_json::Value::as_object) else {
+        return Ok(());
+    };
+    if lanes.contains_key("notary")
+        || lanes
+            .values()
+            .any(|entry| entry.get("interfaces").is_some())
+    {
+        return Err(pre_notary_retirement_approved_set_error());
+    }
+    Ok(())
+}
+
+fn pre_notary_retirement_approved_set_error() -> anyhow::Error {
+    anyhow!(
+        "approved set predates the Registry Notary retirement: Registry Notary is retired, so a \
+         schema version {PRE_NOTARY_RETIREMENT_APPROVED_BASELINE_SET_SCHEMA_VERSION} approved \
+         set, its notary lane, and the cross-lane interface digests it binds are no longer \
+         verified; this reader refuses the document rather than honor an approval whose \
+         integrity claim is no longer enforced, so re-approve the baseline to issue a schema \
+         version {APPROVED_BASELINE_SET_SCHEMA_VERSION} approved set"
+    )
+}
+
 #[cfg(test)]
 #[allow(dead_code)]
 pub fn load_approved_baseline_set_structure(path: &Path) -> Result<ApprovedBaselineSetV1> {
@@ -1046,7 +1040,6 @@ pub(crate) fn verify_lane_request(
         anchor_digest,
         lane_scoped_reviewed_input_digest: reviewed.lane_scoped_reviewed_input_digest,
         signing_input_closure_digest: reviewed.signing_input_closure_digest,
-        interfaces: reviewed.interfaces,
     };
     if expected_entry
         .as_ref()
@@ -1210,31 +1203,9 @@ fn reviewed_binding_from_verified_bundle(
         bail!("signed lane manifest bundle_id does not match its exact input closure");
     }
 
-    let review = read_manifest_payload(bundle, manifest, "approval/review.json")?;
-    let review =
-        parse_json_strict(&review).context("signed lane review record is not strict JSON")?;
-    let consultations = review
-        .get("consultations")
-        .and_then(serde_json::Value::as_object)
-        .ok_or_else(|| anyhow!("signed lane review record lacks consultations"))?;
-    let interface = if consultations.is_empty() {
-        None
-    } else {
-        Some(sha256_uri(
-            &canonicalize_json(&serde_json::Value::Object(consultations.clone()))
-                .context("failed to canonicalize consultation interface")?,
-        ))
-    };
-    let interfaces = match lane {
-        ApprovedLaneV1::RelayPublic => CrossLaneInterfaceDigestsV1::default(),
-        ApprovedLaneV1::RelayConsultation | ApprovedLaneV1::Notary => CrossLaneInterfaceDigestsV1 {
-            consultation_relay_notary: interface,
-        },
-    };
     Ok(ReviewedLaneBindingV1 {
         lane_scoped_reviewed_input_digest: lane_digest,
         signing_input_closure_digest,
-        interfaces,
     })
 }
 
@@ -1311,7 +1282,6 @@ fn set_from_verified(verified: &[VerifiedApprovedLaneV1]) -> Result<ApprovedBase
             relay_consultation: verified_for(verified, ApprovedLaneV1::RelayConsultation)
                 .entry
                 .clone(),
-            notary: verified_for(verified, ApprovedLaneV1::Notary).entry.clone(),
         },
     };
     approved_set.validate()?;
@@ -1342,12 +1312,12 @@ fn validate_verifier_lane(
         .acceptance_identity
         .validate()
         .context("verified lane acceptance identity is invalid")?;
-    verified.entry.validate_for_lane(selected)
+    verified.entry.validate()
 }
 
 fn validate_identity_set(verified: &[VerifiedApprovedLaneV1]) -> Result<()> {
-    if verified.len() != 3 {
-        bail!("approved set requires exactly three independently verified lanes");
+    if verified.len() != 2 {
+        bail!("approved set requires exactly two independently verified Relay lanes");
     }
     let lanes = verified
         .iter()
@@ -1472,6 +1442,16 @@ mod tests {
     use super::*;
     use std::os::unix::fs::symlink;
 
+    #[test]
+    fn non_relay_acceptance_lane_fails_without_panicking() {
+        let error = ApprovedLaneV1::try_from_acceptance_lane(ProductAcceptanceLaneV1::Notary)
+            .expect_err("the retired acceptance lane must fail closed");
+        assert_eq!(
+            error.to_string(),
+            "acceptance lane is not supported by registryctl"
+        );
+    }
+
     #[test]
     fn portable_artifact_resolution_rejects_intermediate_symlink_escape() {
         let temporary = tempfile::tempdir().expect("temporary directory");
@@ -1492,11 +1472,11 @@ mod tests {
     fn portable_artifact_resolution_uses_the_verifier_selected_closure_root() {
         let temporary = tempfile::tempdir().expect("temporary directory");
         let generated = temporary.path().join("generated");
-        let artifact = generated.join("bundles/notary/manifest-digest");
+        let artifact = generated.join("bundles/relay-public/manifest-digest");
         fs::create_dir_all(&artifact).expect("package artifact");
         fs::create_dir_all(generated.join("inputs")).expect("nested set directory");
 
-        let locator = PortableArtifactLocator::new("bundles/notary/manifest-digest")
+        let locator = PortableArtifactLocator::new("bundles/relay-public/manifest-digest")
             .expect("normalized package locator");
         assert_eq!(
             resolve_portable_artifact(&generated, &locator).expect("selected root resolves"),
diff --git a/crates/registryctl/src/deployment.rs b/crates/registryctl/src/deployment.rs
index 3f613bb97..78405530d 100644
--- a/crates/registryctl/src/deployment.rs
+++ b/crates/registryctl/src/deployment.rs
@@ -18,9 +18,17 @@ use serde_json::{json, Map, Value};
 use sha2::{Digest as _, Sha256};
 
 pub const DEPLOYMENT_PLAN_SCHEMA_ID: &str = "io.registrystack.deployment_plan";
-pub const DEPLOYMENT_PLAN_SCHEMA_VERSION: &str = "1.0";
+/// Version `2.0` because the Registry Notary retirement removed the `Notary`
+/// product lane and its five initialization actions from the required plan
+/// shape. The plan is read back from a transferred package under
+/// `deny_unknown_fields`, so the declared version has to move with the shape it
+/// names.
+pub const DEPLOYMENT_PLAN_SCHEMA_VERSION: &str = "2.0";
 pub const DEPLOYMENT_BINDING_SCHEMA_ID: &str = "io.registrystack.deployment_binding";
-pub const DEPLOYMENT_BINDING_SCHEMA_VERSION: &str = "1.0";
+/// Version `2.0` for the same reason as [`DEPLOYMENT_PLAN_SCHEMA_VERSION`]: the
+/// retirement removed `ports.notary` and three `secret_files` ids from the
+/// binding an operator owns and edits on disk.
+pub const DEPLOYMENT_BINDING_SCHEMA_VERSION: &str = "2.0";
 pub const DEPLOYMENT_MANIFEST_SCHEMA_ID: &str = "io.registrystack.deployment_manifest";
 pub const DEPLOYMENT_MANIFEST_SCHEMA_VERSION: &str = "1.0";
 pub const DEPLOYMENT_OWNERSHIP_REPORT_SCHEMA_ID: &str =
@@ -35,23 +43,17 @@ const SECRET_CONSUMERS_SCHEMA: &str = "registry.project.secret-consumers.v1";
 
 const RELAY_PUBLIC: &str = "relay-public";
 const RELAY_CONSULTATION: &str = "relay-consultation";
-const NOTARY: &str = "notary";
 const POSTGRESQL: &str = "postgresql-state-plane";
 const RELAY_PUBLIC_ACTIONS: &str = "relay-public-actions";
 const RELAY_CONSULTATION_ACTIONS: &str = "relay-consultation-actions";
-const NOTARY_ACTIONS: &str = "notary-actions";
 const POSTGRESQL_ACTIONS: &str = "postgresql-actions";
 
 const SERVICE_RELAY_PUBLIC: &str = "registry-relay-public";
 const SERVICE_RELAY_CONSULTATION: &str = "registry-relay-consultation";
-const SERVICE_NOTARY: &str = "registry-notary";
 const SERVICE_POSTGRESQL: &str = "registry-postgres";
 const SECRET_STAGER_SUFFIX: &str = "-stage-secrets";
 const NETWORK_RUNTIME: &str = "registry-runtime";
-pub(crate) const OPERATOR_FILE_IDS: [&str; 9] = [
-    "notary-environment",
-    "notary-relay-workload-credential",
-    "notary-signing-key",
+pub(crate) const OPERATOR_FILE_IDS: [&str; 6] = [
     "postgresql-admin-password",
     "postgresql-bootstrap-environment",
     "postgresql-tls-certificate",
@@ -66,23 +68,18 @@ const BOUNDED_LOG_DRIVER: &str = "local";
 const BOUNDED_LOG_MAX_SIZE: &str = "10m";
 const BOUNDED_LOG_MAX_FILES: &str = "3";
 
-const INITIALIZATION_SERVICES: [&str; 16] = [
+const INITIALIZATION_SERVICES: [&str; 11] = [
     SERVICE_POSTGRESQL_BOOTSTRAP,
     "registry-relay-public-prepare-state",
     "registry-relay-consultation-prepare-state",
-    "registry-notary-prepare-state",
     "registry-relay-public-initialize",
     "registry-relay-consultation-initialize",
-    "registry-notary-initialize",
     "registry-relay-public-preview-state",
     "registry-relay-consultation-preview-state",
-    "registry-notary-preview-state",
     "registry-relay-public-accept-state",
     "registry-relay-consultation-accept-state",
-    "registry-notary-accept-state",
     "registry-relay-public-verify-state",
     "registry-relay-consultation-verify-state",
-    "registry-notary-verify-state",
 ];
 
 #[derive(Debug, Clone, Eq, Ord, PartialEq, PartialOrd, Serialize)]
@@ -126,8 +123,6 @@ impl<'de> Deserialize<'de> for ImageIdentityV1 {
 pub struct ManagedTopologyImagesV1 {
     pub relay: ImageIdentityV1,
     pub relay_platform: OciPlatformV1,
-    pub notary: ImageIdentityV1,
-    pub notary_platform: OciPlatformV1,
     pub postgresql_state_plane: ImageIdentityV1,
     pub postgresql_state_plane_platform: OciPlatformV1,
 }
@@ -137,7 +132,6 @@ pub struct ManagedTopologyImagesV1 {
 pub enum ProductLaneV1 {
     RelayPublic,
     RelayConsultation,
-    Notary,
 }
 
 impl ProductLaneV1 {
@@ -145,7 +139,6 @@ impl ProductLaneV1 {
         match lane {
             ApprovedLaneV1::RelayPublic => Self::RelayPublic,
             ApprovedLaneV1::RelayConsultation => Self::RelayConsultation,
-            ApprovedLaneV1::Notary => Self::Notary,
         }
     }
 
@@ -153,7 +146,6 @@ impl ProductLaneV1 {
         match self {
             Self::RelayPublic => RELAY_PUBLIC,
             Self::RelayConsultation => RELAY_CONSULTATION,
-            Self::Notary => NOTARY,
         }
     }
 
@@ -161,7 +153,6 @@ impl ProductLaneV1 {
         match self {
             Self::RelayPublic => SERVICE_RELAY_PUBLIC,
             Self::RelayConsultation => SERVICE_RELAY_CONSULTATION,
-            Self::Notary => SERVICE_NOTARY,
         }
     }
 }
@@ -398,28 +389,6 @@ impl DeploymentPlanV1 {
                     vec![POSTGRESQL],
                     "relay-consultation-health",
                 ),
-                product(
-                    ProductLaneV1::Notary,
-                    images.notary.clone(),
-                    images.notary_platform,
-                    vec![
-                        MountRoleV1::Bundle,
-                        MountRoleV1::Anchor,
-                        MountRoleV1::AntiRollbackState,
-                        MountRoleV1::Secret,
-                        MountRoleV1::Audit,
-                    ],
-                    vec!["notary-relay-workload-credential", "notary-signing-key"],
-                    vec!["notary-anti-rollback", "notary-audit"],
-                    vec![
-                        EndpointClassV1::PublicApplication,
-                        EndpointClassV1::Administration,
-                        EndpointClassV1::Posture,
-                    ],
-                    vec!["runtime"],
-                    vec![RELAY_CONSULTATION, POSTGRESQL],
-                    "notary-health",
-                ),
                 DeploymentWorkloadV1::Supporting(SupportingWorkloadV1 {
                     id: POSTGRESQL.to_string(),
                     recipe: SupportingWorkloadRecipeV1::PostgresqlStatePlane,
@@ -451,11 +420,6 @@ impl DeploymentPlanV1 {
                     RELAY_CONSULTATION,
                     RuntimeActionV1::PrepareStateStore,
                 ),
-                initialization(
-                    "prepare-notary-state",
-                    NOTARY,
-                    RuntimeActionV1::PrepareStateStore,
-                ),
                 initialization(
                     "initialize-relay-public",
                     RELAY_PUBLIC,
@@ -466,11 +430,6 @@ impl DeploymentPlanV1 {
                     RELAY_CONSULTATION,
                     RuntimeActionV1::InitializeState,
                 ),
-                initialization(
-                    "initialize-notary",
-                    NOTARY,
-                    RuntimeActionV1::InitializeState,
-                ),
                 initialization(
                     "preview-relay-public-state",
                     RELAY_PUBLIC,
@@ -481,11 +440,6 @@ impl DeploymentPlanV1 {
                     RELAY_CONSULTATION,
                     RuntimeActionV1::PreviewState,
                 ),
-                initialization(
-                    "preview-notary-state",
-                    NOTARY,
-                    RuntimeActionV1::PreviewState,
-                ),
                 initialization(
                     "accept-relay-public-state",
                     RELAY_PUBLIC,
@@ -496,7 +450,6 @@ impl DeploymentPlanV1 {
                     RELAY_CONSULTATION,
                     RuntimeActionV1::AcceptState,
                 ),
-                initialization("accept-notary-state", NOTARY, RuntimeActionV1::AcceptState),
                 initialization(
                     "verify-relay-public-state",
                     RELAY_PUBLIC,
@@ -507,12 +460,11 @@ impl DeploymentPlanV1 {
                     RELAY_CONSULTATION,
                     RuntimeActionV1::VerifyState,
                 ),
-                initialization("verify-notary-state", NOTARY, RuntimeActionV1::VerifyState),
             ],
             recovery_consistency_groups: vec![
                 WorkloadGroupV1 {
                     id: "consultation-state".to_string(),
-                    members: strings(vec![RELAY_CONSULTATION, NOTARY, POSTGRESQL]),
+                    members: strings(vec![RELAY_CONSULTATION, POSTGRESQL]),
                 },
                 WorkloadGroupV1 {
                     id: "relay-public-state".to_string(),
@@ -528,10 +480,6 @@ impl DeploymentPlanV1 {
                     EndpointClassV1::PrivateApplication,
                     EndpointExposureV1::PrivateNetworkOnly,
                 ),
-                exposure(
-                    EndpointClassV1::Administration,
-                    EndpointExposureV1::PrivateNetworkOnly,
-                ),
                 exposure(
                     EndpointClassV1::Posture,
                     EndpointExposureV1::PrivateNetworkOnly,
@@ -555,9 +503,9 @@ impl DeploymentPlanV1 {
             .iter()
             .map(DeploymentWorkloadV1::id)
             .collect();
-        let expected_ids = BTreeSet::from([RELAY_PUBLIC, RELAY_CONSULTATION, NOTARY, POSTGRESQL]);
+        let expected_ids = BTreeSet::from([RELAY_PUBLIC, RELAY_CONSULTATION, POSTGRESQL]);
         if ids != expected_ids || ids.len() != self.workloads.len() {
-            bail!("DeploymentPlanV1 must contain the complete closed four-workload topology");
+            bail!("DeploymentPlanV1 must contain the complete closed three-workload topology");
         }
         for workload in &self.workloads {
             if workload
@@ -606,11 +554,6 @@ impl DeploymentPlanV1 {
                 RELAY_CONSULTATION,
                 RuntimeActionV1::PrepareStateStore,
             ),
-            (
-                "prepare-notary-state",
-                NOTARY,
-                RuntimeActionV1::PrepareStateStore,
-            ),
             (
                 "initialize-relay-public",
                 RELAY_PUBLIC,
@@ -621,11 +564,6 @@ impl DeploymentPlanV1 {
                 RELAY_CONSULTATION,
                 RuntimeActionV1::InitializeState,
             ),
-            (
-                "initialize-notary",
-                NOTARY,
-                RuntimeActionV1::InitializeState,
-            ),
             (
                 "preview-relay-public-state",
                 RELAY_PUBLIC,
@@ -636,11 +574,6 @@ impl DeploymentPlanV1 {
                 RELAY_CONSULTATION,
                 RuntimeActionV1::PreviewState,
             ),
-            (
-                "preview-notary-state",
-                NOTARY,
-                RuntimeActionV1::PreviewState,
-            ),
             (
                 "accept-relay-public-state",
                 RELAY_PUBLIC,
@@ -651,7 +584,6 @@ impl DeploymentPlanV1 {
                 RELAY_CONSULTATION,
                 RuntimeActionV1::AcceptState,
             ),
-            ("accept-notary-state", NOTARY, RuntimeActionV1::AcceptState),
             (
                 "verify-relay-public-state",
                 RELAY_PUBLIC,
@@ -662,7 +594,6 @@ impl DeploymentPlanV1 {
                 RELAY_CONSULTATION,
                 RuntimeActionV1::VerifyState,
             ),
-            ("verify-notary-state", NOTARY, RuntimeActionV1::VerifyState),
         ];
         if self.initialization_actions.len() != expected_initialization.len()
             || !self
@@ -679,7 +610,7 @@ impl DeploymentPlanV1 {
             != [
                 WorkloadGroupV1 {
                     id: "consultation-state".to_string(),
-                    members: strings(vec![RELAY_CONSULTATION, NOTARY, POSTGRESQL]),
+                    members: strings(vec![RELAY_CONSULTATION, POSTGRESQL]),
                 },
                 WorkloadGroupV1 {
                     id: "relay-public-state".to_string(),
@@ -703,10 +634,6 @@ impl DeploymentPlanV1 {
                 EndpointClassV1::PrivateApplication,
                 EndpointExposureV1::PrivateNetworkOnly,
             ),
-            (
-                EndpointClassV1::Administration,
-                EndpointExposureV1::PrivateNetworkOnly,
-            ),
             (
                 EndpointClassV1::Posture,
                 EndpointExposureV1::PrivateNetworkOnly,
@@ -723,8 +650,6 @@ impl DeploymentPlanV1 {
         let expected = Self::managed_single_node(&ManagedTopologyImagesV1 {
             relay: relay_public.image_identity.clone(),
             relay_platform: relay_public.image_platform,
-            notary: self.product(ProductLaneV1::Notary)?.image_identity.clone(),
-            notary_platform: self.product(ProductLaneV1::Notary)?.image_platform,
             postgresql_state_plane: self
                 .supporting(SupportingWorkloadRecipeV1::PostgresqlStatePlane)?
                 .image_identity
@@ -768,7 +693,6 @@ impl DeploymentPlanV1 {
 #[serde(deny_unknown_fields)]
 pub struct LoopbackPortsV1 {
     pub relay_public: u16,
-    pub notary: u16,
 }
 
 #[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
@@ -795,10 +719,7 @@ impl DeploymentBindingV1 {
             package_id: package_id.into(),
             environment: environment.into(),
             loopback_address: "127.0.0.1".to_string(),
-            ports: LoopbackPortsV1 {
-                relay_public: 4242,
-                notary: 4255,
-            },
+            ports: LoopbackPortsV1 { relay_public: 4242 },
             secret_files: OPERATOR_FILE_IDS
                 .into_iter()
                 .map(|id| (id.to_string(), format!("operator/secrets/{id}")))
@@ -823,9 +744,8 @@ impl DeploymentBindingV1 {
         if self.loopback_address != "127.0.0.1" && self.loopback_address != "::1" {
             bail!("managed host publishing must use an explicit loopback address");
         }
-        let ports = [self.ports.relay_public, self.ports.notary];
-        if ports.contains(&0) || ports.iter().collect::<BTreeSet<_>>().len() != ports.len() {
-            bail!("managed loopback ports must be non-zero and distinct");
+        if self.ports.relay_public == 0 {
+            bail!("managed loopback port must be non-zero");
         }
         if self.restart_policy != "unless-stopped" || self.logging_policy != "local-bounded" {
             bail!("deployment binding selects an unsupported managed policy");
@@ -882,7 +802,6 @@ pub struct LockedPostgresqlRuntimeV1 {
 pub struct LockedRuntimeMappingV1 {
     pub relay_public: LockedProductRuntimeV1,
     pub relay_consultation: LockedProductRuntimeV1,
-    pub notary: LockedProductRuntimeV1,
     pub postgresql_state_plane: LockedPostgresqlRuntimeV1,
     pub operator_files: Vec<LockedOperatorFileV1>,
 }
@@ -940,19 +859,6 @@ impl LockedRuntimeMappingV1 {
                 "consultation Relay health",
                 &self.relay_consultation.health_probe,
             ),
-            ("Notary serve", &self.notary.serve.command),
-            (
-                "Notary prepare_state_store",
-                &self.notary.prepare_state_store.command,
-            ),
-            (
-                "Notary initialize_state",
-                &self.notary.initialize_state.command,
-            ),
-            ("Notary preview_state", &self.notary.preview_state.command),
-            ("Notary accept_state", &self.notary.accept_state.command),
-            ("Notary verify_state", &self.notary.verify_state.command),
-            ("Notary health", &self.notary.health_probe),
             (
                 "PostgreSQL state-plane recipe",
                 &self.postgresql_state_plane.serve.command,
@@ -977,7 +883,6 @@ impl LockedRuntimeMappingV1 {
         match lane {
             ProductLaneV1::RelayPublic => &self.relay_public,
             ProductLaneV1::RelayConsultation => &self.relay_consultation,
-            ProductLaneV1::Notary => &self.notary,
         }
     }
 
@@ -985,7 +890,6 @@ impl LockedRuntimeMappingV1 {
         Self {
             relay_public: LockedProductRuntimeV1::from_verified(value.relay_public()),
             relay_consultation: LockedProductRuntimeV1::from_verified(value.relay_consultation()),
-            notary: LockedProductRuntimeV1::from_verified(value.notary()),
             postgresql_state_plane: LockedPostgresqlRuntimeV1::from_verified(
                 value.postgresql_state_plane(),
             ),
@@ -1080,7 +984,6 @@ fn operator_file_inventory(
     for (lane, product) in [
         ("relay-public", &runtime.relay_public),
         ("relay-consultation", &runtime.relay_consultation),
-        ("notary", &runtime.notary),
     ] {
         for (action_name, action) in [
             ("serve", &product.serve),
@@ -1156,8 +1059,8 @@ fn operator_file_inventory(
 fn signed_environment_keys(
     lanes: &[VerifiedLanePackageSourceV1],
 ) -> Result<BTreeMap<String, BTreeSet<String>>> {
-    if lanes.len() != 3 {
-        bail!("deployment requires exactly three signed product lanes");
+    if lanes.len() != 2 {
+        bail!("deployment requires exactly two signed product lanes");
     }
     let mut keys = BTreeMap::new();
     for lane in lanes {
@@ -1166,10 +1069,7 @@ fn signed_environment_keys(
             .context("failed to read signed secret-consumer descriptor")?;
         let descriptor: SecretConsumerDescriptorV1 = serde_json::from_slice(&bytes)
             .context("signed secret-consumer descriptor is not strict JSON")?;
-        let expected_product = match lane.lane {
-            ProductLaneV1::RelayPublic | ProductLaneV1::RelayConsultation => "registry-relay",
-            ProductLaneV1::Notary => "registry-notary",
-        };
+        let expected_product = "registry-relay";
         if descriptor.schema != SECRET_CONSUMERS_SCHEMA
             || descriptor.product != expected_product
             || descriptor.consumers.len() > 256
@@ -1289,31 +1189,6 @@ fn validate_managed_bundle_compatibility(lanes: &[VerifiedLanePackageSourceV1])
                     );
                 }
             }
-            ProductLaneV1::Notary => {
-                let path = lane.bundle_dir.join("config/notary.yaml");
-                let config: Value =
-                    serde_norway::from_slice(&read_bounded(&path, MAX_PORTABLE_DOCUMENT_BYTES)?)
-                        .context("failed to parse managed Notary config")?;
-                let Some(base_url) = config
-                    .pointer("/evidence/relay/base_url")
-                    .and_then(Value::as_str)
-                else {
-                    continue;
-                };
-                let origin = url::Url::parse(base_url)
-                    .context("managed Notary Relay base URL is invalid")?;
-                if origin.scheme() == "http"
-                    && (!matches!(origin.host(), Some(url::Host::Domain(_)))
-                        || config
-                            .pointer("/evidence/relay/allow_insecure_private_network")
-                            .and_then(Value::as_bool)
-                            != Some(true))
-                {
-                    bail!(
-                        "managed deployment requires HTTPS or an explicitly enabled private-service HTTP Notary-to-Relay origin; loopback is not shared across workloads"
-                    );
-                }
-            }
         }
     }
     Ok(())
@@ -1642,8 +1517,6 @@ fn deployment_authority(
     let plan = DeploymentPlanV1::managed_single_node(&ManagedTopologyImagesV1 {
         relay: ImageIdentityV1::parse(images.relay())?,
         relay_platform: images.relay_platform(),
-        notary: ImageIdentityV1::parse(images.notary())?,
-        notary_platform: images.notary_platform(),
         postgresql_state_plane: ImageIdentityV1::parse(images.postgresql_state_plane())?,
         postgresql_state_plane_platform: images.postgresql_state_plane_platform(),
     });
@@ -2622,7 +2495,6 @@ fn render_ordinary_model(
 ) -> Result<Value> {
     let relay_public = plan.product(ProductLaneV1::RelayPublic)?;
     let relay_consultation = plan.product(ProductLaneV1::RelayConsultation)?;
-    let notary = plan.product(ProductLaneV1::Notary)?;
     let postgresql = plan.supporting(SupportingWorkloadRecipeV1::PostgresqlStatePlane)?;
 
     let mut services = Map::new();
@@ -2688,33 +2560,12 @@ fn render_ordinary_model(
             ),
         )?,
     );
-    services.insert(
-        SERVICE_NOTARY.to_string(),
-        product_service(
-            notary,
-            runtime.product(ProductLaneV1::Notary),
-            binding,
-            bundle_source(lanes, ProductLaneV1::Notary)?,
-            json!({NETWORK_RUNTIME: {}}),
-            action_dependency_map(
-                &[
-                    (SERVICE_POSTGRESQL, "service_healthy"),
-                    (SERVICE_RELAY_CONSULTATION, "service_healthy"),
-                ],
-                &runtime.notary.serve,
-                NOTARY,
-            ),
-        )?,
-    );
-
     let mut volumes = Map::from_iter([
         durable_volume(binding, "postgresql-data"),
         durable_volume(binding, "relay-public-state"),
         durable_volume(binding, "relay-public-audit"),
         durable_volume(binding, "relay-consultation-state"),
         durable_volume(binding, "relay-consultation-audit"),
-        durable_volume(binding, "notary-state"),
-        durable_volume(binding, "notary-audit"),
     ]);
     volumes.extend(secret_stage_volumes(
         serving_secret_stage_groups(runtime),
@@ -2817,7 +2668,6 @@ fn render_initialization_model(
         let lane = match action.workload.as_str() {
             RELAY_PUBLIC => ProductLaneV1::RelayPublic,
             RELAY_CONSULTATION => ProductLaneV1::RelayConsultation,
-            NOTARY => ProductLaneV1::Notary,
             _ => bail!("initialization action targets an unknown product workload"),
         };
         let product = plan.product(lane)?;
@@ -2853,7 +2703,7 @@ fn render_initialization_model(
             (
                 ProductLaneV1::RelayConsultation,
                 RuntimeActionV1::PrepareStateStore | RuntimeActionV1::InitializeState
-            ) | (ProductLaneV1::Notary, RuntimeActionV1::PrepareStateStore)
+            )
         );
         let dependencies = action_dependency_map(
             if requires_postgresql {
@@ -2949,7 +2799,6 @@ fn product_service(
     )?;
     let published_port = match lane {
         ProductLaneV1::RelayPublic => Some((binding.ports.relay_public, 8080)),
-        ProductLaneV1::Notary => Some((binding.ports.notary, 8081)),
         ProductLaneV1::RelayConsultation => None,
     };
     if let Some((host, container)) = published_port {
@@ -3083,7 +2932,6 @@ fn serving_secret_stage_groups(
                 &runtime.relay_consultation.serve,
             )],
         ),
-        (NOTARY, vec![("notary-serve", &runtime.notary.serve)]),
         (
             "postgresql",
             vec![("postgresql-serve", &runtime.postgresql_state_plane.serve)],
@@ -3136,16 +2984,6 @@ fn action_secret_stage_groups(
                 ),
             ],
         ),
-        (
-            NOTARY_ACTIONS,
-            vec![
-                ("notary-prepare", &runtime.notary.prepare_state_store),
-                ("notary-initialize", &runtime.notary.initialize_state),
-                ("notary-preview", &runtime.notary.preview_state),
-                ("notary-accept", &runtime.notary.accept_state),
-                ("notary-verify", &runtime.notary.verify_state),
-            ],
-        ),
         (
             POSTGRESQL_ACTIONS,
             vec![(
@@ -3160,7 +2998,6 @@ fn action_secret_stage_owner(lane: ProductLaneV1) -> &'static str {
     match lane {
         ProductLaneV1::RelayPublic => RELAY_PUBLIC_ACTIONS,
         ProductLaneV1::RelayConsultation => RELAY_CONSULTATION_ACTIONS,
-        ProductLaneV1::Notary => NOTARY_ACTIONS,
     }
 }
 
@@ -3477,7 +3314,6 @@ fn validate_hard_effective_model(
     for (lane, service_name) in [
         (ProductLaneV1::RelayPublic, SERVICE_RELAY_PUBLIC),
         (ProductLaneV1::RelayConsultation, SERVICE_RELAY_CONSULTATION),
-        (ProductLaneV1::Notary, SERVICE_NOTARY),
     ] {
         let Some(service) = actual_services.get(service_name) else {
             violations.push(format!("ordinary effective model omits {service_name}"));
@@ -3639,7 +3475,6 @@ fn validate_hard_effective_model(
     for (service_name, expected_networks) in [
         (SERVICE_RELAY_PUBLIC, json!({NETWORK_RUNTIME: {}})),
         (SERVICE_RELAY_CONSULTATION, json!({NETWORK_RUNTIME: {}})),
-        (SERVICE_NOTARY, json!({NETWORK_RUNTIME: {}})),
         (SERVICE_POSTGRESQL, json!({NETWORK_RUNTIME: {}})),
     ] {
         if let Some(service) = actual_services.get(service_name) {
@@ -3711,11 +3546,7 @@ fn initialization_with_effective_ordinary(
     let mut expected = canonical_initialization.clone();
     let expected_services = expected.get_mut("services")?.as_object_mut()?;
     let ordinary_services = effective_ordinary.get("services")?.as_object()?;
-    for service_name in [
-        SERVICE_RELAY_PUBLIC,
-        SERVICE_RELAY_CONSULTATION,
-        SERVICE_NOTARY,
-    ] {
+    for service_name in [SERVICE_RELAY_PUBLIC, SERVICE_RELAY_CONSULTATION] {
         expected_services.insert(
             service_name.to_string(),
             ordinary_services.get(service_name)?.clone(),
@@ -4117,7 +3948,6 @@ fn normalized_lane_mut(
     match lane {
         ApprovedLaneV1::RelayPublic => &mut approved_set.lanes.relay_public,
         ApprovedLaneV1::RelayConsultation => &mut approved_set.lanes.relay_consultation,
-        ApprovedLaneV1::Notary => &mut approved_set.lanes.notary,
     }
 }
 
@@ -4472,17 +4302,11 @@ fn runbook(package_name: &str, inventory: &DeploymentOperatorFileInventoryV1) ->
             .collect::<Vec<_>>()
             .join("\n")
     };
-    let serving_secret_staging_commands = staging_commands(
-        compose_ordinary,
-        &[RELAY_CONSULTATION, NOTARY, "postgresql"],
-    );
+    let serving_secret_staging_commands =
+        staging_commands(compose_ordinary, &[RELAY_CONSULTATION, "postgresql"]);
     let initialization_secret_staging_commands = staging_commands(
         &compose_actions,
-        &[
-            RELAY_CONSULTATION_ACTIONS,
-            NOTARY_ACTIONS,
-            POSTGRESQL_ACTIONS,
-        ],
+        &[RELAY_CONSULTATION_ACTIONS, POSTGRESQL_ACTIONS],
     );
     let operator_files = inventory
         .files
@@ -4517,11 +4341,11 @@ fn runbook(package_name: &str, inventory: &DeploymentOperatorFileInventoryV1) ->
 Package: `{package_name}`\n\n\
 Record the approved-set digest and generated closure root printed by `registryctl deploy generate` outside this package. After transfer, run `registryctl deploy verify --package . --expected-closure-sha256 <recorded-sha256>` and compare both externally recorded values before any initialization.\n\n\
 ## Required operator files\n\n\
-The signed inventory is also recorded at `generated/operator-files.v1.json`. Environment requirements below come directly from the hash-covered product `descriptors/secret-consumers.json`; Registryctl does not infer product semantics. Before any first-install command, create every owner-only regular file below, then run `registryctl deploy verify --package . --check-operator-files`. Registryctl checks only structural isolation, mode, owner, and consumer assignment; Relay and Notary remain the semantic authorities for their environment and secret values. Do not create placeholders or print file values.\n\n\
+The signed inventory is also recorded at `generated/operator-files.v1.json`. Environment requirements below come directly from the hash-covered product `descriptors/secret-consumers.json`; Registryctl does not infer product semantics. Before any first-install command, create every owner-only regular file below, then run `registryctl deploy verify --package . --check-operator-files`. Registryctl checks only structural isolation, mode, owner, and consumer assignment; Relay remains the semantic authority for its environment and secret values. Do not create placeholders or print file values.\n\n\
 | Path | Consumers and targets | Format | Required environment keys | Mode | Allowed owners |\n\
 |---|---|---|---|---|---|\n\
 {operator_files}\n\n\
-Obtain environment values from the owning secret manager and identity provider. Obtain private keys from the owning key custodian. Certificates and keys must be matching PEM material for their named service; the PostgreSQL certificate chain must validate `registry-postgres`, because bootstrap uses TLS `verify-full`. The Notary signing file must be a private JWK accepted by the signing provider in the signed Notary config. The Notary-to-Relay file must be a compact JWT issued under the signed consultation Relay workload contract, including its exact issuer, audience, client/principal binding, scope, and expiry. Inspect those value-free requirements in each copied signed bundle's `config/` and `descriptors/secret-consumers.json`; never edit them. Product startup or preparation performs the semantic checks and fails closed before its protected action.\n\n\
+Obtain environment values from the owning secret manager and identity provider. Obtain private keys from the owning key custodian. Certificates and keys must be matching PEM material for their named service; the PostgreSQL certificate chain must validate `registry-postgres`, because bootstrap uses TLS `verify-full`. Inspect those value-free requirements in each copied signed bundle's `config/` and `descriptors/secret-consumers.json`; never edit them. Product startup or preparation performs the semantic checks and fails closed before its protected action.\n\n\
 ## Compose project context\n\n\
 The generated package is standalone by default. Set `REGISTRY_STACK_COMPOSE_PROJECT` once and use the same value for every stage, preview, stop, accept, verify, and start command:\n\n\
 ```sh\n\
@@ -4535,13 +4359,10 @@ When a parent Compose application includes `generated/compose.yaml`, set this va
 {compose_actions} run --rm registry-postgres-bootstrap\n\
 {compose_actions} run --rm registry-relay-public-prepare-state\n\
 {compose_actions} run --rm registry-relay-consultation-prepare-state\n\
-{compose_actions} run --rm registry-notary-prepare-state\n\
 {compose_actions} run --rm registry-relay-public-initialize\n\
 {compose_actions} run --rm registry-relay-consultation-initialize\n\
-{compose_actions} run --rm registry-notary-initialize\n\
 {compose_actions} run --rm --no-deps registry-relay-public-verify-state\n\
 {compose_actions} run --rm --no-deps registry-relay-consultation-verify-state\n\
-{compose_actions} run --rm --no-deps registry-notary-verify-state\n\
 {serving_secret_staging_commands}\n\
 {compose_ordinary} up --detach --wait --wait-timeout 120\n\
 {compose_ordinary} ps\n\
@@ -4552,14 +4373,13 @@ Selecting `compose.initialize.yaml` is the only supported way to initialize an e
 {compose_ordinary} config --no-interpolate --no-env-resolution --quiet\n\
 {compose_actions} run --rm --no-deps registry-relay-public-verify-state\n\
 {compose_actions} run --rm --no-deps registry-relay-consultation-verify-state\n\
-{compose_actions} run --rm --no-deps registry-notary-verify-state\n\
 {serving_secret_staging_commands}\n\
 {compose_ordinary} up --detach --wait --wait-timeout 120\n\
 {compose_ordinary} ps\n\
 {compose_ordinary} down\n\
 ```\n\n\
 ## Product or image update\n\n\
-Copy the intact current package to the candidate path and regenerate that copy in place. The candidate must retain the exact current `generated/` closure as `generated.previous/` and preserve every operator-owned file. Before shutdown, verify both packages against their externally recorded closure digests and approved sets, validate both effective Compose models, and run all three current read-only state checks:\n\n\
+Copy the intact current package to the candidate path and regenerate that copy in place. The candidate must retain the exact current `generated/` closure as `generated.previous/` and preserve every operator-owned file. Before shutdown, verify both packages against their externally recorded closure digests and approved sets, validate both effective Compose models, and run both current read-only state checks:\n\n\
 ```sh\n\
 CURRENT_PACKAGE=\"<path-to-current-package>\"\n\
 CURRENT_APPROVED_SET=\"<path-to-current-approved-set.v1.json>\"\n\
@@ -4572,31 +4392,26 @@ registryctl deploy verify --package \"$CANDIDATE_PACKAGE\" --approved-set \"$CAN
 (cd \"$CURRENT_PACKAGE\" && {compose_ordinary} config --no-interpolate --no-env-resolution --quiet)\n\
 (cd \"$CURRENT_PACKAGE\" && {compose_actions} run --rm --no-deps registry-relay-public-verify-state)\n\
 (cd \"$CURRENT_PACKAGE\" && {compose_actions} run --rm --no-deps registry-relay-consultation-verify-state)\n\
-(cd \"$CURRENT_PACKAGE\" && {compose_actions} run --rm --no-deps registry-notary-verify-state)\n\
 (cd \"$CANDIDATE_PACKAGE\" && {compose_actions} config --no-interpolate --no-env-resolution --quiet)\n\
 ```\n\n\
 These package checks verify every locked bundle, anchor, deployment file, and operator-file boundary. Keep all current services running while previewing every candidate lane. Do not stop any service or accept any lane unless every preview succeeds. Run the following block from the candidate package root:\n\n\
 ```sh\n\
 {compose_actions} run --rm --no-deps registry-relay-public-preview-state\n\
 {compose_actions} run --rm --no-deps registry-relay-consultation-preview-state\n\
-{compose_actions} run --rm --no-deps registry-notary-preview-state\n\
 {compose_ordinary} stop\n\
 {compose_actions} run --rm --no-deps registry-relay-public-accept-state\n\
 {compose_actions} run --rm --no-deps registry-relay-consultation-accept-state\n\
-{compose_actions} run --rm --no-deps registry-notary-accept-state\n\
 {compose_actions} run --rm --no-deps registry-relay-public-verify-state\n\
 {compose_actions} run --rm --no-deps registry-relay-consultation-verify-state\n\
-{compose_actions} run --rm --no-deps registry-notary-verify-state\n\
 {serving_secret_staging_commands}\n\
 {compose_ordinary} up --detach --wait --wait-timeout 120\n\
 {compose_actions} run --rm --no-deps registry-relay-public-verify-state\n\
 {compose_actions} run --rm --no-deps registry-relay-consultation-verify-state\n\
-{compose_actions} run --rm --no-deps registry-notary-verify-state\n\
 {compose_ordinary} ps\n\
 ```\n\n\
-Each `accept_state` action uses the locked audit-before-mutation path. The manual abort boundary is the first successful acceptance that advances durable anti-rollback state. Before that boundary, restore the intact `generated.previous/` closure and restart it. After that boundary, only complete the forward update, restore a coherent snapshot at the same or newer accepted sequence, or replace the affected instance identity. Never start an older closure or restore a pre-update sequence. Start and verify PostgreSQL and the consultation Relay before starting Notary or any externally reachable dependant. Remove `generated.previous/` only after all affected lanes report the new accepted sequence.\n\n\
+Each `accept_state` action uses the locked audit-before-mutation path. The manual abort boundary is the first successful acceptance that advances durable anti-rollback state. Before that boundary, restore the intact `generated.previous/` closure and restart it. After that boundary, only complete the forward update, restore a coherent snapshot at the same or newer accepted sequence, or replace the affected instance identity. Never start an older closure or restore a pre-update sequence. Start and verify PostgreSQL before starting the consultation Relay. Remove `generated.previous/` only after all affected lanes report the new accepted sequence.\n\n\
 ## State recovery\n\n\
-Quiesce the complete `relay-public-state` or `consultation-state` recovery consistency group before snapshot or restore. A coherent backup includes the lane anti-rollback and audit state, PostgreSQL data where declared, this package, approved set, bundle, anchor, instance, stream, and accepted sequence identities. After restoring the exact lane, instance, and stream, run the three read-only `verify_state` commands above before ordinary startup. Partial or older recovery must be manually aborted.\n\n\
+Quiesce the complete `relay-public-state` or `consultation-state` recovery consistency group before snapshot or restore. A coherent backup includes the lane anti-rollback and audit state, PostgreSQL data where declared, this package, approved set, bundle, anchor, instance, stream, and accepted sequence identities. After restoring the exact lane, instance, and stream, run both read-only `verify_state` commands above before ordinary startup. Partial or older recovery must be manually aborted.\n\n\
 If no coherent backup exists, provision a new instance identity, review and sign every affected lane, generate a new package, and follow first installation. Reinitializing the same identity is not recovery and is unsupported. Rollback is unsupported.\n\n\
 ## Operations\n\n\
 Use `docker compose ... ps` for value-free health and `docker compose ... logs <registry-service>` for product-separated logs. Metrics, administration, and posture are not host-published. Resolve a documented readiness latch before using the product-owned clear action. Preserve signed audit retention policy, and treat storage exhaustion as a fail-closed incident requiring a coherent recovery-group snapshot or restore.\n\
@@ -4609,8 +4424,6 @@ fn operator_file_format(format: LockedOperatorFileFormatV1) -> &'static str {
         LockedOperatorFileFormatV1::Dotenv => "dotenv",
         LockedOperatorFileFormatV1::PemCertificate => "pem_certificate",
         LockedOperatorFileFormatV1::PemPrivateKey => "pem_private_key",
-        LockedOperatorFileFormatV1::JsonWebKey => "json_web_key",
-        LockedOperatorFileFormatV1::CompactJwt => "compact_jwt",
         LockedOperatorFileFormatV1::Opaque => "opaque",
     }
 }
diff --git a/crates/registryctl/src/dev_credentials.rs b/crates/registryctl/src/dev_credentials.rs
index 9c3175dc8..1e14cc2a8 100644
--- a/crates/registryctl/src/dev_credentials.rs
+++ b/crates/registryctl/src/dev_credentials.rs
@@ -9,11 +9,10 @@ use std::collections::BTreeSet;
 use std::fs::{self, File, OpenOptions};
 use std::io::Write as _;
 use std::path::{Path, PathBuf};
-use std::time::{SystemTime, UNIX_EPOCH};
 
 use anyhow::{anyhow, bail, Context, Result};
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
-use ed25519_dalek::{Signer as _, SigningKey};
+use ed25519_dalek::SigningKey;
 use registry_platform_authcommon::{fingerprint_api_key, validate_api_key_entropy};
 use registry_platform_config::ProductAcceptanceLaneV1;
 use registry_platform_crypto::PublicJwk;
@@ -22,14 +21,7 @@ use zeroize::Zeroizing;
 const DEV_SECRET_ROOT: &str = "/run/registry/dev-secrets";
 const DEV_PUBLIC_ROOT: &str = "/run/registry/dev-public";
 const SYNTHETIC_SECRET_ROOT: &str = "/run/registry/synthetic-source-secrets";
-const DEV_WORKLOAD_ISSUER: &str = "https://registryctl-local-notary.invalid";
-const DEV_WORKLOAD_KID: &str = "registryctl-local-workload";
-const DEV_NOTARY_RUNTIME_SIGNING_KID: &str = "registryctl-local-notary-runtime-issuer";
-const DEV_WORKLOAD_CLIENT: &str = "registryctl-local-notary";
-const DEV_WORKLOAD_AUDIENCE: &str = "registry-relay";
-const DEV_WORKLOAD_LIFETIME_SECONDS: u64 = 10 * 365 * 24 * 60 * 60;
 const DEV_SYNTHETIC_SOURCE_PRIVATE_CIDR: &str = "10.89.0.3/32";
-const DEV_RELAY_CONSULTATION_PRIVATE_CIDR: &str = "10.89.0.4/32";
 const DEV_SYNTHETIC_SOURCE_CA_PATH: &str = "/run/registry/dev-public/synthetic-source-tls.crt";
 
 const RELAY_PUBLIC_AUDIT_ENV: &str = "REGISTRY_RELAY_AUDIT_HASH_SECRET";
@@ -39,13 +31,6 @@ const RELAY_DATABASE_ENV: &str = "REGISTRY_RELAY_CONSULTATION_DATABASE_URL";
 const RELAY_MIGRATION_DATABASE_ENV: &str = "REGISTRY_RELAY_CONSULTATION_MIGRATION_DATABASE_URL";
 const RELAY_MAINTENANCE_DATABASE_ENV: &str = "REGISTRY_RELAY_CONSULTATION_MAINTENANCE_DATABASE_URL";
 const RELAY_READER_DATABASE_ENV: &str = "REGISTRY_RELAY_CONSULTATION_READER_DATABASE_URL";
-const NOTARY_AUDIT_ENV: &str = "REGISTRY_NOTARY_AUDIT_HASH_SECRET";
-const NOTARY_MIGRATION_DATABASE_ENV: &str = "REGISTRY_NOTARY_POSTGRES_MIGRATOR_URL";
-const NOTARY_DATABASE_ENV: &str = "REGISTRY_NOTARY_POSTGRES_RUNTIME_URL";
-const NOTARY_MAINTENANCE_DATABASE_ENV: &str = "REGISTRY_NOTARY_POSTGRES_MAINTENANCE_URL";
-const NOTARY_READER_DATABASE_ENV: &str = "REGISTRY_NOTARY_POSTGRES_READER_URL";
-const NOTARY_WORKLOAD_PUBLIC_JWK_ENV: &str = "REGISTRY_NOTARY_WORKLOAD_PUBLIC_JWK";
-
 const POSTGRES_HOST: &str = "registry-postgres";
 const POSTGRES_PORT: u16 = 5432;
 const POSTGRES_ADMIN_ROLE: &str = "registry_stack_bootstrap";
@@ -55,22 +40,10 @@ const RELAY_MIGRATOR_ROLE: &str = "registry_relay_migrator";
 const RELAY_RUNTIME_ROLE: &str = "registry_relay_runtime";
 const RELAY_MAINTENANCE_ROLE: &str = "registry_relay_maintenance";
 const RELAY_READER_ROLE: &str = "registry_relay_reader";
-const NOTARY_DATABASE: &str = "registry_notary";
-const NOTARY_OWNER_ROLE: &str = "registry_notary_owner";
-const NOTARY_MIGRATOR_ROLE: &str = "registry_notary_migrator";
-const NOTARY_RUNTIME_ROLE: &str = "registry_notary_runtime";
-const NOTARY_MAINTENANCE_ROLE: &str = "registry_notary_maintenance";
-const NOTARY_READER_ROLE: &str = "registry_notary_reader";
-
-const CALLER_TOKEN_FILE: &str = "caller-token";
 const RELAY_MATCH_TOKEN_FILE: &str = "relay-match-token";
 const RELAY_NO_MATCH_TOKEN_FILE: &str = "relay-no-match-token";
-const WORKLOAD_TOKEN_FILE: &str = "notary-relay-token";
-const WORKLOAD_PUBLIC_JWK_FILE: &str = "notary-workload-public.jwk";
-const WORKLOAD_JWKS_FILE: &str = "notary-workload-jwks.json";
 const POSTGRES_TLS_CERTIFICATE_FILE: &str = "postgres-tls.crt";
 const POSTGRES_TLS_PRIVATE_KEY_FILE: &str = "postgres-tls.key";
-const NOTARY_SIGNING_KEY_FILE: &str = "notary-signing-key.jwk";
 const POSTGRES_ADMIN_PASSWORD_FILE: &str = "postgres-admin-password";
 const SYNTHETIC_CONTROL_TOKEN_FILE: &str = "control-token";
 const SYNTHETIC_TLS_CERTIFICATE_FILE: &str = "tls.crt";
@@ -85,9 +58,6 @@ const RELAY_PUBLIC_SERVE_ENV_FILE: &str = "relay-public-serve.env";
 const RELAY_CONSULTATION_PREPARE_ENV_FILE: &str = "relay-consultation-prepare.env";
 const RELAY_CONSULTATION_INITIALIZE_ENV_FILE: &str = "relay-consultation-initialize.env";
 const RELAY_CONSULTATION_SERVE_ENV_FILE: &str = "relay-consultation-serve.env";
-const NOTARY_PREPARE_ENV_FILE: &str = "notary-prepare.env";
-const NOTARY_INITIALIZE_ENV_FILE: &str = "notary-initialize.env";
-const NOTARY_SERVE_ENV_FILE: &str = "notary-serve.env";
 const POSTGRES_BOOTSTRAP_ENV_FILE: &str = "postgres-bootstrap.env";
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
@@ -110,23 +80,12 @@ pub(crate) enum DevSourceCredentialProfile {
     },
 }
 
-#[derive(Clone, Eq, PartialEq)]
-pub(crate) struct DevIssuanceCredentialRequirement {
-    pub(crate) issuer: String,
-    pub(crate) signing_kid: String,
-    pub(crate) private_jwk_env: String,
-}
-
 #[derive(Clone, Eq, PartialEq)]
 pub(crate) struct DevCredentialRequirements {
     pub(crate) project_id: String,
     pub(crate) environment_id: String,
-    pub(crate) service_id: String,
-    pub(crate) caller_id: String,
-    pub(crate) caller_fingerprint_env: String,
     pub(crate) relay_api_keys: Option<DevRelayApiKeyRequirements>,
     pub(crate) source: DevSourceCredentialProfile,
-    pub(crate) issuance: Option<DevIssuanceCredentialRequirement>,
 }
 
 #[derive(Clone, Eq, PartialEq)]
@@ -136,13 +95,6 @@ pub(crate) struct DevRelayApiKeyRequirements {
     pub(crate) scopes: Vec<String>,
 }
 
-#[derive(Clone, Eq, PartialEq)]
-pub(crate) struct DevCallerCredentialProjection {
-    pub(crate) id: String,
-    pub(crate) fingerprint_env: String,
-    pub(crate) token_file: String,
-}
-
 #[derive(Clone, Eq, PartialEq)]
 pub(crate) struct DevRelayApiKeyProjection {
     pub(crate) match_principal: String,
@@ -154,23 +106,6 @@ pub(crate) struct DevRelayApiKeyProjection {
     pub(crate) no_match_token_file: String,
 }
 
-#[derive(Clone, Eq, PartialEq)]
-pub(crate) struct DevRelayOidcProjection {
-    pub(crate) issuer: String,
-    pub(crate) jwks_file: String,
-    pub(crate) public_jwk: String,
-    pub(crate) audience: String,
-    pub(crate) client_id: String,
-}
-
-#[derive(Clone, Eq, PartialEq)]
-pub(crate) struct DevNotaryRelayProjection {
-    pub(crate) base_url: String,
-    pub(crate) workload_client_id: String,
-    pub(crate) token_file: String,
-    pub(crate) allowed_private_cidr: String,
-}
-
 #[derive(Clone, Eq, PartialEq)]
 pub(crate) struct DevSyntheticSourceTransportProjection {
     pub(crate) root_certificate_path: String,
@@ -186,19 +121,10 @@ pub(crate) struct DevDatabaseCredentialProjection {
     pub(crate) relay_runtime_role: &'static str,
     pub(crate) relay_maintenance_role: &'static str,
     pub(crate) relay_reader_role: &'static str,
-    pub(crate) notary_owner_role: &'static str,
-    pub(crate) notary_migrator_role: &'static str,
-    pub(crate) notary_runtime_role: &'static str,
-    pub(crate) notary_maintenance_role: &'static str,
-    pub(crate) notary_reader_role: &'static str,
     pub(crate) relay_database_env: &'static str,
     pub(crate) relay_migration_database_env: &'static str,
     pub(crate) relay_maintenance_database_env: &'static str,
     pub(crate) relay_reader_database_env: &'static str,
-    pub(crate) notary_database_env: &'static str,
-    pub(crate) notary_migration_database_env: &'static str,
-    pub(crate) notary_maintenance_database_env: &'static str,
-    pub(crate) notary_reader_database_env: &'static str,
 }
 
 #[derive(Clone, Eq, PartialEq)]
@@ -228,15 +154,6 @@ pub(crate) enum DevSourceCredentialProjection {
     },
 }
 
-#[derive(Clone, Eq, PartialEq)]
-pub(crate) struct DevIssuanceCredentialProjection {
-    pub(crate) issuer: String,
-    pub(crate) signing_kid: String,
-    pub(crate) private_jwk_env: String,
-    pub(crate) public_jwk: String,
-    pub(crate) public_jwk_file: String,
-}
-
 #[derive(Clone, Eq, PartialEq)]
 pub(crate) struct DevLaneSignerProjection {
     pub(crate) lane: ProductAcceptanceLaneV1,
@@ -259,23 +176,16 @@ pub(crate) struct DevActionCredentialProjection {
     pub(crate) relay_consultation_prepare: DevActionCredentialLocator,
     pub(crate) relay_consultation_initialize: DevActionCredentialLocator,
     pub(crate) relay_consultation_serve: DevActionCredentialLocator,
-    pub(crate) notary_prepare: DevActionCredentialLocator,
-    pub(crate) notary_initialize: DevActionCredentialLocator,
-    pub(crate) notary_serve: DevActionCredentialLocator,
     pub(crate) postgres_bootstrap: DevActionCredentialLocator,
 }
 
 #[derive(Clone, Eq, PartialEq)]
 pub(crate) struct DevCredentialPublicProjection {
-    pub(crate) caller: DevCallerCredentialProjection,
     pub(crate) relay_api_keys: Option<DevRelayApiKeyProjection>,
-    pub(crate) relay_oidc: DevRelayOidcProjection,
-    pub(crate) notary_relay: DevNotaryRelayProjection,
     pub(crate) databases: DevDatabaseCredentialProjection,
     pub(crate) source: DevSourceCredentialProjection,
     pub(crate) synthetic_source_transport: Option<DevSyntheticSourceTransportProjection>,
-    pub(crate) issuance: Option<DevIssuanceCredentialProjection>,
-    pub(crate) lane_signers: [DevLaneSignerProjection; 3],
+    pub(crate) lane_signers: [DevLaneSignerProjection; 2],
     pub(crate) actions: DevActionCredentialProjection,
 }
 
@@ -285,20 +195,6 @@ struct LaneSigningCredential {
     public_jwk: String,
 }
 
-struct IssuanceCredential {
-    projection: DevIssuanceCredentialProjection,
-    private_jwk: Zeroizing<String>,
-    public_jwk: String,
-}
-
-/// Runtime-only fallback signing material for a Notary configuration that does
-/// not declare issuance. It exists for one disposable dev runtime and is never
-/// reused as product-lane trust material or exported as a public trust input.
-struct NotaryRuntimeSigningCredential {
-    private_jwk: Zeroizing<String>,
-    public_jwk: String,
-}
-
 struct DatabaseCredentialSet {
     postgres_admin: Zeroizing<String>,
     relay_owner: Zeroizing<String>,
@@ -306,11 +202,6 @@ struct DatabaseCredentialSet {
     relay_runtime: Zeroizing<String>,
     relay_maintenance: Zeroizing<String>,
     relay_reader: Zeroizing<String>,
-    notary_owner: Zeroizing<String>,
-    notary_migrator: Zeroizing<String>,
-    notary_runtime: Zeroizing<String>,
-    notary_maintenance: Zeroizing<String>,
-    notary_reader: Zeroizing<String>,
 }
 
 struct TlsCredential {
@@ -344,23 +235,15 @@ enum SourceCredential {
 /// private material.
 pub(crate) struct PreparedDevCredentialClosure {
     projection: DevCredentialPublicProjection,
-    caller_token: Zeroizing<String>,
     relay_match_token: Option<Zeroizing<String>>,
     relay_no_match_token: Option<Zeroizing<String>>,
-    workload_private_jwk: Zeroizing<String>,
-    workload_public_jwk: String,
-    workload_jwks: String,
-    workload_token: Zeroizing<String>,
     relay_public_audit: Zeroizing<String>,
     relay_consultation_audit: Zeroizing<String>,
-    notary_audit: Zeroizing<String>,
     relay_pseudonym: Zeroizing<String>,
     databases: DatabaseCredentialSet,
     postgres_tls: TlsCredential,
     source: SourceCredential,
-    issuance: Option<IssuanceCredential>,
-    notary_runtime_signing: Option<NotaryRuntimeSigningCredential>,
-    lane_signers: [LaneSigningCredential; 3],
+    lane_signers: [LaneSigningCredential; 2],
 }
 
 #[derive(Clone, Debug, Eq, PartialEq)]
@@ -383,38 +266,25 @@ pub(crate) struct PreparedDevSourceCredentialFiles {
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub(crate) struct PreparedDevCredentialFiles {
     pub(crate) root: PathBuf,
-    pub(crate) caller_token: PathBuf,
     pub(crate) relay_match_token: Option<PathBuf>,
     pub(crate) relay_no_match_token: Option<PathBuf>,
-    pub(crate) workload_token: PathBuf,
-    pub(crate) workload_public_jwk: PathBuf,
-    pub(crate) workload_jwks: PathBuf,
     pub(crate) relay_public_prepare: PreparedDevActionCredentialFile,
     pub(crate) relay_public_initialize: PreparedDevActionCredentialFile,
     pub(crate) relay_public_serve: PreparedDevActionCredentialFile,
     pub(crate) relay_consultation_prepare: PreparedDevActionCredentialFile,
     pub(crate) relay_consultation_initialize: PreparedDevActionCredentialFile,
     pub(crate) relay_consultation_serve: PreparedDevActionCredentialFile,
-    pub(crate) notary_prepare: PreparedDevActionCredentialFile,
-    pub(crate) notary_initialize: PreparedDevActionCredentialFile,
-    pub(crate) notary_serve: PreparedDevActionCredentialFile,
     pub(crate) postgres_bootstrap: PreparedDevActionCredentialFile,
     pub(crate) postgres_admin_password: PathBuf,
-    pub(crate) notary_signing_key: PathBuf,
     pub(crate) postgres_tls_certificate: PathBuf,
     pub(crate) postgres_tls_private_key: PathBuf,
     pub(crate) source: Option<PreparedDevSourceCredentialFiles>,
-    pub(crate) issuance_public_jwk: Option<PathBuf>,
-    pub(crate) lane_public_jwks: [PathBuf; 3],
+    pub(crate) lane_public_jwks: [PathBuf; 2],
 }
 
 impl PreparedDevCredentialClosure {
     pub(crate) fn generate(requirements: DevCredentialRequirements) -> Result<Self> {
         validate_requirements(&requirements)?;
-        let caller_token = secret_token(32)?;
-        validate_api_key_entropy(&caller_token)
-            .map_err(|_| anyhow!("generated development caller credential failed validation"))?;
-        let caller_fingerprint = fingerprint_api_key(&caller_token);
         let (relay_match_token, relay_no_match_token) = if requirements.relay_api_keys.is_some() {
             let match_token = secret_token(32)?;
             let no_match_token = secret_token(32)?;
@@ -429,13 +299,6 @@ impl PreparedDevCredentialClosure {
             (None, None)
         };
 
-        let (workload_private_jwk, workload_public_jwk) = generate_ed25519_jwk(DEV_WORKLOAD_KID)
-            .context("failed to generate the development workload identity")?;
-        let workload_jwks = workload_jwks_from_private(&workload_private_jwk)
-            .context("failed to project the development workload identity")?;
-        let workload_token =
-            sign_dev_workload_jwt(&workload_private_jwk, &requirements.service_id)?;
-
         let lane_signers = [
             generate_lane_signer(
                 ProductAcceptanceLaneV1::RelayPublic,
@@ -447,37 +310,16 @@ impl PreparedDevCredentialClosure {
                 &requirements.project_id,
                 &requirements.environment_id,
             )?,
-            generate_lane_signer(
-                ProductAcceptanceLaneV1::Notary,
-                &requirements.project_id,
-                &requirements.environment_id,
-            )?,
         ];
-        let issuance = requirements
-            .issuance
-            .as_ref()
-            .map(generate_issuance_credential)
-            .transpose()?;
-        let notary_runtime_signing = if issuance.is_none() {
-            Some(generate_notary_runtime_signing_credential()?)
-        } else {
-            None
-        };
         let source = generate_source_credential(&requirements.source)?;
         let postgres_tls = generate_tls_credential(POSTGRES_HOST)?;
         let databases = DatabaseCredentialSet::generate()?;
         let relay_public_audit = secret_token(48)?;
         let relay_consultation_audit = secret_token(48)?;
-        let notary_audit = secret_token(48)?;
         let relay_pseudonym = secret_token(48)?;
 
         let source_projection = source_projection(&requirements.source);
         let projection = DevCredentialPublicProjection {
-            caller: DevCallerCredentialProjection {
-                id: requirements.caller_id,
-                fingerprint_env: requirements.caller_fingerprint_env,
-                token_file: secret_container_path(CALLER_TOKEN_FILE),
-            },
             relay_api_keys: requirements
                 .relay_api_keys
                 .map(|keys| DevRelayApiKeyProjection {
@@ -490,19 +332,6 @@ impl PreparedDevCredentialClosure {
                     match_token_file: secret_container_path(RELAY_MATCH_TOKEN_FILE),
                     no_match_token_file: secret_container_path(RELAY_NO_MATCH_TOKEN_FILE),
                 }),
-            relay_oidc: DevRelayOidcProjection {
-                issuer: DEV_WORKLOAD_ISSUER.to_string(),
-                jwks_file: public_container_path(WORKLOAD_JWKS_FILE),
-                public_jwk: workload_public_jwk.clone(),
-                audience: DEV_WORKLOAD_AUDIENCE.to_string(),
-                client_id: DEV_WORKLOAD_CLIENT.to_string(),
-            },
-            notary_relay: DevNotaryRelayProjection {
-                base_url: "http://10.89.0.4:8080".to_string(),
-                workload_client_id: DEV_WORKLOAD_CLIENT.to_string(),
-                token_file: "/run/secrets/relay-workload-token".to_string(),
-                allowed_private_cidr: DEV_RELAY_CONSULTATION_PRIVATE_CIDR.to_string(),
-            },
             databases: DevDatabaseCredentialProjection {
                 root_certificate_path: "/run/secrets/postgresql-ca.pem".to_string(),
                 postgres_admin_role: POSTGRES_ADMIN_ROLE,
@@ -511,19 +340,10 @@ impl PreparedDevCredentialClosure {
                 relay_runtime_role: RELAY_RUNTIME_ROLE,
                 relay_maintenance_role: RELAY_MAINTENANCE_ROLE,
                 relay_reader_role: RELAY_READER_ROLE,
-                notary_owner_role: NOTARY_OWNER_ROLE,
-                notary_migrator_role: NOTARY_MIGRATOR_ROLE,
-                notary_runtime_role: NOTARY_RUNTIME_ROLE,
-                notary_maintenance_role: NOTARY_MAINTENANCE_ROLE,
-                notary_reader_role: NOTARY_READER_ROLE,
                 relay_database_env: RELAY_DATABASE_ENV,
                 relay_migration_database_env: RELAY_MIGRATION_DATABASE_ENV,
                 relay_maintenance_database_env: RELAY_MAINTENANCE_DATABASE_ENV,
                 relay_reader_database_env: RELAY_READER_DATABASE_ENV,
-                notary_database_env: NOTARY_DATABASE_ENV,
-                notary_migration_database_env: NOTARY_MIGRATION_DATABASE_ENV,
-                notary_maintenance_database_env: NOTARY_MAINTENANCE_DATABASE_ENV,
-                notary_reader_database_env: NOTARY_READER_DATABASE_ENV,
             },
             source: source_projection,
             synthetic_source_transport: (!matches!(
@@ -534,9 +354,6 @@ impl PreparedDevCredentialClosure {
                 root_certificate_path: DEV_SYNTHETIC_SOURCE_CA_PATH.to_string(),
                 allowed_private_cidr: DEV_SYNTHETIC_SOURCE_PRIVATE_CIDR.to_string(),
             }),
-            issuance: issuance
-                .as_ref()
-                .map(|credential| credential.projection.clone()),
             lane_signers: lane_signers
                 .each_ref()
                 .map(|credential| credential.projection.clone()),
@@ -544,26 +361,17 @@ impl PreparedDevCredentialClosure {
         };
         let closure = Self {
             projection,
-            caller_token,
             relay_match_token,
             relay_no_match_token,
-            workload_private_jwk: Zeroizing::new(workload_private_jwk),
-            workload_public_jwk,
-            workload_jwks,
-            workload_token: Zeroizing::new(workload_token),
             relay_public_audit,
             relay_consultation_audit,
-            notary_audit,
             relay_pseudonym,
             databases,
             postgres_tls,
             source,
-            issuance,
-            notary_runtime_signing,
             lane_signers,
         };
-        closure.validate_distinct_secrets(&caller_fingerprint)?;
-        closure.validate_notary_runtime_signing_separation()?;
+        closure.validate_distinct_secrets()?;
         Ok(closure)
     }
 
@@ -595,7 +403,6 @@ impl PreparedDevCredentialClosure {
 
     fn materialize_into(&self, root: &Path) -> Result<PreparedDevCredentialFiles> {
         let files = PreparedDevCredentialFiles::for_root(root, &self.projection);
-        write_new_owner_only(&files.caller_token, self.caller_token.as_bytes())?;
         if let (Some(path), Some(token)) = (&files.relay_match_token, &self.relay_match_token) {
             write_new_owner_only(path, token.as_bytes())?;
         }
@@ -603,13 +410,6 @@ impl PreparedDevCredentialClosure {
         {
             write_new_owner_only(path, token.as_bytes())?;
         }
-        write_new_owner_only(&files.workload_token, self.workload_token.as_bytes())?;
-        write_new_owner_only(
-            &files.workload_public_jwk,
-            self.workload_public_jwk.as_bytes(),
-        )?;
-        write_new_owner_only(&files.workload_jwks, self.workload_jwks.as_bytes())?;
-
         write_new_owner_only(
             &files.relay_public_prepare.host_path,
             env_file(&[(RELAY_PUBLIC_AUDIT_ENV, &self.relay_public_audit)]).as_bytes(),
@@ -707,71 +507,6 @@ impl PreparedDevCredentialClosure {
             env_file(&relay_serve).as_bytes(),
         )?;
 
-        let notary_migration_url = database_url(
-            NOTARY_MIGRATOR_ROLE,
-            &self.databases.notary_migrator,
-            NOTARY_DATABASE,
-        );
-        let notary_runtime_url = database_url(
-            NOTARY_RUNTIME_ROLE,
-            &self.databases.notary_runtime,
-            NOTARY_DATABASE,
-        );
-        let notary_maintenance_url = database_url(
-            NOTARY_MAINTENANCE_ROLE,
-            &self.databases.notary_maintenance,
-            NOTARY_DATABASE,
-        );
-        let notary_reader_url = database_url(
-            NOTARY_READER_ROLE,
-            &self.databases.notary_reader,
-            NOTARY_DATABASE,
-        );
-        write_new_owner_only(
-            &files.notary_prepare.host_path,
-            env_file(&[
-                (NOTARY_AUDIT_ENV, &self.notary_audit),
-                (NOTARY_MIGRATION_DATABASE_ENV, &notary_migration_url),
-            ])
-            .as_bytes(),
-        )?;
-        write_new_owner_only(
-            &files.notary_initialize.host_path,
-            env_file(&[
-                (NOTARY_AUDIT_ENV, &self.notary_audit),
-                (NOTARY_DATABASE_ENV, &notary_runtime_url),
-            ])
-            .as_bytes(),
-        )?;
-        let caller_fingerprint = fingerprint_api_key(&self.caller_token);
-        let mut notary_serve = vec![
-            (NOTARY_AUDIT_ENV, self.notary_audit.as_str()),
-            (NOTARY_DATABASE_ENV, notary_runtime_url.as_str()),
-            (
-                NOTARY_MAINTENANCE_DATABASE_ENV,
-                notary_maintenance_url.as_str(),
-            ),
-            (NOTARY_READER_DATABASE_ENV, notary_reader_url.as_str()),
-            (
-                NOTARY_WORKLOAD_PUBLIC_JWK_ENV,
-                self.workload_public_jwk.as_str(),
-            ),
-            (
-                self.projection.caller.fingerprint_env.as_str(),
-                caller_fingerprint.as_str(),
-            ),
-        ];
-        if let Some(issuance) = &self.issuance {
-            notary_serve.push((
-                issuance.projection.private_jwk_env.as_str(),
-                issuance.private_jwk.as_str(),
-            ));
-        }
-        write_new_owner_only(
-            &files.notary_serve.host_path,
-            env_file(&notary_serve).as_bytes(),
-        )?;
-
         let postgres_bootstrap = [
             (
                 "REGISTRY_RELAY_MIGRATOR_PASSWORD",
@@ -789,22 +524,6 @@ impl PreparedDevCredentialClosure {
                 "REGISTRY_RELAY_READER_PASSWORD",
                 self.databases.relay_reader.as_str(),
             ),
-            (
-                "REGISTRY_NOTARY_MIGRATOR_PASSWORD",
-                self.databases.notary_migrator.as_str(),
-            ),
-            (
-                "REGISTRY_NOTARY_RUNTIME_PASSWORD",
-                self.databases.notary_runtime.as_str(),
-            ),
-            (
-                "REGISTRY_NOTARY_MAINTENANCE_PASSWORD",
-                self.databases.notary_maintenance.as_str(),
-            ),
-            (
-                "REGISTRY_NOTARY_READER_PASSWORD",
-                self.databases.notary_reader.as_str(),
-            ),
         ];
         write_new_owner_only(
             &files.postgres_bootstrap.host_path,
@@ -814,13 +533,6 @@ impl PreparedDevCredentialClosure {
             &files.postgres_admin_password,
             self.databases.postgres_admin.as_bytes(),
         )?;
-        let notary_signing_key = match (&self.issuance, &self.notary_runtime_signing) {
-            (Some(credential), None) => credential.private_jwk.as_str(),
-            (None, Some(credential)) => credential.private_jwk.as_str(),
-            _ => bail!("development Notary runtime signing authority is not closed"),
-        };
-        write_new_owner_only(&files.notary_signing_key, notary_signing_key.as_bytes())?;
-
         write_tls_files(
             &files.postgres_tls_certificate,
             &files.postgres_tls_private_key,
@@ -830,24 +542,17 @@ impl PreparedDevCredentialClosure {
         if let Some(source_files) = &files.source {
             materialize_source(source_files, &self.source)?;
         }
-        if let (Some(path), Some(issuance)) = (&files.issuance_public_jwk, &self.issuance) {
-            write_new_owner_only(path, issuance.public_jwk.as_bytes())?;
-        }
         for (path, signer) in files.lane_public_jwks.iter().zip(&self.lane_signers) {
             write_new_owner_only(path, signer.public_jwk.as_bytes())?;
         }
         Ok(files)
     }
 
-    fn validate_distinct_secrets(&self, caller_fingerprint: &str) -> Result<()> {
+    fn validate_distinct_secrets(&self) -> Result<()> {
         let mut values = Vec::new();
         values.extend([
-            self.caller_token.as_str(),
-            self.workload_private_jwk.as_str(),
-            self.workload_token.as_str(),
             self.relay_public_audit.as_str(),
             self.relay_consultation_audit.as_str(),
-            self.notary_audit.as_str(),
             self.relay_pseudonym.as_str(),
             self.postgres_tls.private_key.as_str(),
         ]);
@@ -859,12 +564,6 @@ impl PreparedDevCredentialClosure {
                 .iter()
                 .map(|credential| credential.private_jwk.as_str()),
         );
-        if let Some(issuance) = &self.issuance {
-            values.push(issuance.private_jwk.as_str());
-        }
-        if let Some(runtime) = &self.notary_runtime_signing {
-            values.push(runtime.private_jwk.as_str());
-        }
         match &self.source {
             SourceCredential::OperatorBound => {}
             SourceCredential::SyntheticUnauthenticated { control_token, tls } => {
@@ -892,7 +591,6 @@ impl PreparedDevCredentialClosure {
             ]),
         }
         if values.iter().any(|value| value.is_empty())
-            || values.contains(&caller_fingerprint)
             || self
                 .relay_match_token
                 .iter()
@@ -905,25 +603,6 @@ impl PreparedDevCredentialClosure {
         }
         Ok(())
     }
-
-    fn validate_notary_runtime_signing_separation(&self) -> Result<()> {
-        let Some(runtime) = &self.notary_runtime_signing else {
-            return Ok(());
-        };
-        let runtime_kid = PublicJwk::parse(&runtime.public_jwk)
-            .and_then(|jwk| jwk.jkt())
-            .context("failed to identify the development Notary runtime signing identity")?;
-        let lane_kids = self
-            .lane_signers
-            .iter()
-            .map(|lane| PublicJwk::parse(&lane.public_jwk).and_then(|jwk| jwk.jkt()))
-            .collect::<Result<Vec<_>, _>>()
-            .context("failed to identify the development lane signing identities")?;
-        if self.issuance.is_some() || lane_kids.contains(&runtime_kid) {
-            bail!("development Notary runtime signing identity is not isolated");
-        }
-        Ok(())
-    }
 }
 
 impl DatabaseCredentialSet {
@@ -935,15 +614,10 @@ impl DatabaseCredentialSet {
             relay_runtime: secret_token(32)?,
             relay_maintenance: secret_token(32)?,
             relay_reader: secret_token(32)?,
-            notary_owner: secret_token(32)?,
-            notary_migrator: secret_token(32)?,
-            notary_runtime: secret_token(32)?,
-            notary_maintenance: secret_token(32)?,
-            notary_reader: secret_token(32)?,
         })
     }
 
-    fn values(&self) -> [&str; 11] {
+    fn values(&self) -> [&str; 6] {
         [
             &self.postgres_admin,
             &self.relay_owner,
@@ -951,11 +625,6 @@ impl DatabaseCredentialSet {
             &self.relay_runtime,
             &self.relay_maintenance,
             &self.relay_reader,
-            &self.notary_owner,
-            &self.notary_migrator,
-            &self.notary_runtime,
-            &self.notary_maintenance,
-            &self.notary_reader,
         ]
     }
 }
@@ -994,7 +663,6 @@ impl PreparedDevCredentialFiles {
         });
         Self {
             root: root.to_path_buf(),
-            caller_token: root.join(CALLER_TOKEN_FILE),
             relay_match_token: projection
                 .relay_api_keys
                 .as_ref()
@@ -1003,9 +671,6 @@ impl PreparedDevCredentialFiles {
                 .relay_api_keys
                 .as_ref()
                 .map(|_| root.join(RELAY_NO_MATCH_TOKEN_FILE)),
-            workload_token: root.join(WORKLOAD_TOKEN_FILE),
-            workload_public_jwk: root.join(WORKLOAD_PUBLIC_JWK_FILE),
-            workload_jwks: root.join(WORKLOAD_JWKS_FILE),
             relay_public_prepare: action(
                 RELAY_PUBLIC_PREPARE_ENV_FILE,
                 &projection.actions.relay_public_prepare,
@@ -1030,29 +695,17 @@ impl PreparedDevCredentialFiles {
                 RELAY_CONSULTATION_SERVE_ENV_FILE,
                 &projection.actions.relay_consultation_serve,
             ),
-            notary_prepare: action(NOTARY_PREPARE_ENV_FILE, &projection.actions.notary_prepare),
-            notary_initialize: action(
-                NOTARY_INITIALIZE_ENV_FILE,
-                &projection.actions.notary_initialize,
-            ),
-            notary_serve: action(NOTARY_SERVE_ENV_FILE, &projection.actions.notary_serve),
             postgres_bootstrap: action(
                 POSTGRES_BOOTSTRAP_ENV_FILE,
                 &projection.actions.postgres_bootstrap,
             ),
             postgres_admin_password: root.join(POSTGRES_ADMIN_PASSWORD_FILE),
-            notary_signing_key: root.join(NOTARY_SIGNING_KEY_FILE),
             postgres_tls_certificate: root.join(POSTGRES_TLS_CERTIFICATE_FILE),
             postgres_tls_private_key: root.join(POSTGRES_TLS_PRIVATE_KEY_FILE),
             source,
-            issuance_public_jwk: projection
-                .issuance
-                .as_ref()
-                .map(|_| root.join("issuance-public.jwk")),
             lane_public_jwks: [
                 root.join("relay-public-signing-public.jwk"),
                 root.join("relay-consultation-signing-public.jwk"),
-                root.join("notary-signing-public.jwk"),
             ],
         }
     }
@@ -1062,8 +715,6 @@ fn validate_requirements(requirements: &DevCredentialRequirements) -> Result<()>
     for (name, value) in [
         ("project id", requirements.project_id.as_str()),
         ("environment id", requirements.environment_id.as_str()),
-        ("service id", requirements.service_id.as_str()),
-        ("caller id", requirements.caller_id.as_str()),
     ] {
         if value.is_empty()
             || value.len() > 128
@@ -1074,7 +725,6 @@ fn validate_requirements(requirements: &DevCredentialRequirements) -> Result<()>
             bail!("development credential {name} is outside the closed identifier grammar");
         }
     }
-    validate_env_name(&requirements.caller_fingerprint_env)?;
     if let Some(keys) = &requirements.relay_api_keys {
         for (name, value) in [
             ("Relay match principal", keys.match_principal.as_str()),
@@ -1111,18 +761,6 @@ fn validate_requirements(requirements: &DevCredentialRequirements) -> Result<()>
             }
         }
     }
-    if let Some(issuance) = &requirements.issuance {
-        validate_env_name(&issuance.private_jwk_env)?;
-        if issuance.issuer.is_empty()
-            || issuance.issuer.len() > 2048
-            || issuance.issuer.chars().any(char::is_control)
-        {
-            bail!("development issuance issuer is outside the closed locator grammar");
-        }
-        if issuance.signing_kid.is_empty() || issuance.signing_kid.len() > 128 {
-            bail!("development issuance signing kid is outside the closed identifier grammar");
-        }
-    }
     Ok(())
 }
 
@@ -1144,7 +782,7 @@ fn generate_lane_signer(
     project: &str,
     environment: &str,
 ) -> Result<LaneSigningCredential> {
-    let lane_name = lane_name(lane);
+    let lane_name = lane_name(lane)?;
     let kid = format!("registryctl-dev-{project}-{environment}-{lane_name}");
     let (private_jwk, public_jwk) = generate_ed25519_jwk(&kid)
         .context("failed to generate a disposable development lane signer")?;
@@ -1162,7 +800,7 @@ fn generate_lane_signer(
                 ProductAcceptanceLaneV1::RelayConsultation => {
                     "relay-consultation-signing-public.jwk"
                 }
-                ProductAcceptanceLaneV1::Notary => "notary-signing-public.jwk",
+                _ => bail!("development signing lane is not in the Relay lane set"),
             }),
         },
         private_jwk: Zeroizing::new(private_jwk),
@@ -1170,33 +808,6 @@ fn generate_lane_signer(
     })
 }
 
-fn generate_issuance_credential(
-    requirement: &DevIssuanceCredentialRequirement,
-) -> Result<IssuanceCredential> {
-    let (private_jwk, public_jwk) = generate_ed25519_jwk(&requirement.signing_kid)
-        .context("failed to generate disposable development issuance material")?;
-    Ok(IssuanceCredential {
-        projection: DevIssuanceCredentialProjection {
-            issuer: requirement.issuer.clone(),
-            signing_kid: requirement.signing_kid.clone(),
-            private_jwk_env: requirement.private_jwk_env.clone(),
-            public_jwk: public_jwk.clone(),
-            public_jwk_file: public_container_path("issuance-public.jwk"),
-        },
-        private_jwk: Zeroizing::new(private_jwk),
-        public_jwk,
-    })
-}
-
-fn generate_notary_runtime_signing_credential() -> Result<NotaryRuntimeSigningCredential> {
-    let (private_jwk, public_jwk) = generate_ed25519_jwk(DEV_NOTARY_RUNTIME_SIGNING_KID)
-        .context("failed to generate a disposable development Notary runtime signing identity")?;
-    Ok(NotaryRuntimeSigningCredential {
-        private_jwk: Zeroizing::new(private_jwk),
-        public_jwk,
-    })
-}
-
 fn generate_source_credential(profile: &DevSourceCredentialProfile) -> Result<SourceCredential> {
     Ok(match profile {
         DevSourceCredentialProfile::OperatorBound => SourceCredential::OperatorBound,
@@ -1355,9 +966,6 @@ fn action_projection() -> DevActionCredentialProjection {
         relay_consultation_prepare: locator(RELAY_CONSULTATION_PREPARE_ENV_FILE),
         relay_consultation_initialize: locator(RELAY_CONSULTATION_INITIALIZE_ENV_FILE),
         relay_consultation_serve: locator(RELAY_CONSULTATION_SERVE_ENV_FILE),
-        notary_prepare: locator(NOTARY_PREPARE_ENV_FILE),
-        notary_initialize: locator(NOTARY_INITIALIZE_ENV_FILE),
-        notary_serve: locator(NOTARY_SERVE_ENV_FILE),
         postgres_bootstrap: locator(POSTGRES_BOOTSTRAP_ENV_FILE),
     }
 }
@@ -1402,58 +1010,6 @@ fn generate_ed25519_jwk(kid: &str) -> Result<(String, String)> {
     ))
 }
 
-fn workload_jwks_from_private(private_jwk: &str) -> Result<String> {
-    let private: serde_json::Value =
-        serde_json::from_str(private_jwk).context("failed to parse workload private JWK")?;
-    let x = private["x"]
-        .as_str()
-        .ok_or_else(|| anyhow!("workload private JWK is missing its public member"))?;
-    serde_json::to_string_pretty(&serde_json::json!({
-        "keys": [{
-            "kty": "OKP",
-            "crv": "Ed25519",
-            "x": x,
-            "alg": "EdDSA",
-            "kid": DEV_WORKLOAD_KID,
-            "use": "sig",
-        }]
-    }))
-    .context("failed to render workload JWKS")
-}
-
-fn sign_ed25519_compact_jwt(
-    private_jwk: &str,
-    header: &serde_json::Value,
-    claims: &serde_json::Value,
-) -> Result<String> {
-    let private: serde_json::Value =
-        serde_json::from_str(private_jwk).context("failed to parse private signing JWK")?;
-    let encoded_secret = private["d"]
-        .as_str()
-        .ok_or_else(|| anyhow!("private signing JWK is missing its private member"))?;
-    let secret = Zeroizing::new(
-        URL_SAFE_NO_PAD
-            .decode(encoded_secret)
-            .context("private signing JWK contains an invalid private member")?,
-    );
-    let secret: [u8; 32] = secret
-        .as_slice()
-        .try_into()
-        .map_err(|_| anyhow!("private signing JWK has the wrong private member length"))?;
-    let secret = Zeroizing::new(secret);
-    let signing_key = SigningKey::from_bytes(&secret);
-    let header =
-        URL_SAFE_NO_PAD.encode(serde_json::to_vec(header).context("failed to render JWT header")?);
-    let claims =
-        URL_SAFE_NO_PAD.encode(serde_json::to_vec(claims).context("failed to render JWT claims")?);
-    let signing_input = format!("{header}.{claims}");
-    let signature = signing_key.sign(signing_input.as_bytes());
-    Ok(format!(
-        "{signing_input}.{}",
-        URL_SAFE_NO_PAD.encode(signature.to_bytes())
-    ))
-}
-
 fn generate_self_signed_tls_identity(subject_alt_names: Vec<String>) -> Result<(String, String)> {
     let rcgen::CertifiedKey { cert, key_pair } =
         rcgen::generate_simple_self_signed(subject_alt_names)
@@ -1477,33 +1033,6 @@ fn pem_block(label: &str, der: &[u8]) -> String {
     format!("-----BEGIN {label}-----\n{body}\n-----END {label}-----\n")
 }
 
-fn sign_dev_workload_jwt(private_jwk: &str, service_id: &str) -> Result<String> {
-    let now = SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map_err(|_| anyhow!("system clock cannot issue a development workload credential"))?
-        .as_secs();
-    let header = serde_json::json!({
-        "alg": "EdDSA",
-        "kid": DEV_WORKLOAD_KID,
-        "typ": "at+jwt",
-    });
-    let scope = format!("registry:consult:{service_id}");
-    let claims = serde_json::json!({
-        "iss": DEV_WORKLOAD_ISSUER,
-        "sub": DEV_WORKLOAD_CLIENT,
-        "aud": DEV_WORKLOAD_AUDIENCE,
-        "client_id": DEV_WORKLOAD_CLIENT,
-        "azp": DEV_WORKLOAD_CLIENT,
-        "scope": scope,
-        "iat": now,
-        "nbf": now.saturating_sub(1),
-        "exp": now + DEV_WORKLOAD_LIFETIME_SECONDS,
-        "jti": secret_token(16)?.as_str(),
-    });
-    sign_ed25519_compact_jwt(private_jwk, &header, &claims)
-        .context("failed to issue the development workload credential")
-}
-
 fn generate_tls_credential(service_name: &str) -> Result<TlsCredential> {
     let mut subject_alt_names = vec![service_name.to_string()];
     if service_name == "registry-synthetic-source" {
@@ -1608,11 +1137,11 @@ fn synthetic_container_path(file: &str) -> String {
     format!("{SYNTHETIC_SECRET_ROOT}/{file}")
 }
 
-fn lane_name(lane: ProductAcceptanceLaneV1) -> &'static str {
+fn lane_name(lane: ProductAcceptanceLaneV1) -> Result<&'static str> {
     match lane {
-        ProductAcceptanceLaneV1::RelayPublic => "relay-public",
-        ProductAcceptanceLaneV1::RelayConsultation => "relay-consultation",
-        ProductAcceptanceLaneV1::Notary => "notary",
+        ProductAcceptanceLaneV1::RelayPublic => Ok("relay-public"),
+        ProductAcceptanceLaneV1::RelayConsultation => Ok("relay-consultation"),
+        _ => bail!("development signing lane is not in the Relay lane set"),
     }
 }
 
@@ -1620,11 +1149,7 @@ fn lane_name(lane: ProductAcceptanceLaneV1) -> &'static str {
 mod tests {
     use std::collections::BTreeMap;
 
-    use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-    use base64::Engine as _;
-    use ed25519_dalek::{Signature, Verifier as _, VerifyingKey};
     use registry_platform_crypto::{PrivateJwk, PublicJwk};
-    use serde_json::Value;
     use tempfile::tempdir;
 
     use super::*;
@@ -1633,16 +1158,8 @@ mod tests {
         DevCredentialRequirements {
             project_id: "example-project".to_string(),
             environment_id: "local".to_string(),
-            service_id: "example-service".to_string(),
-            caller_id: "local-developer".to_string(),
-            caller_fingerprint_env: "REGISTRY_DEV_CALLER_FINGERPRINT".to_string(),
             relay_api_keys: None,
             source,
-            issuance: Some(DevIssuanceCredentialRequirement {
-                issuer: "http://127.0.0.1:4243".to_string(),
-                signing_kid: "registry-dev-issuer".to_string(),
-                private_jwk_env: "REGISTRY_NOTARY_ISSUER_JWK".to_string(),
-            }),
         }
     }
 
@@ -1684,28 +1201,6 @@ mod tests {
                 );
             }
         }
-        assert_eq!(
-            projection.caller.token_file,
-            secret_container_path(files.caller_token.file_name().unwrap().to_str().unwrap())
-        );
-        assert_eq!(
-            projection.relay_oidc.jwks_file,
-            public_container_path(files.workload_jwks.file_name().unwrap().to_str().unwrap())
-        );
-        assert_eq!(
-            projection.relay_oidc.issuer,
-            "https://registryctl-local-notary.invalid"
-        );
-        assert_eq!(
-            projection.relay_oidc.jwks_file,
-            "/run/registry/dev-public/notary-workload-jwks.json"
-        );
-        assert_eq!(
-            projection.notary_relay.token_file,
-            "/run/secrets/relay-workload-token"
-        );
-        assert_eq!(projection.notary_relay.base_url, "http://10.89.0.4:8080");
-        assert_eq!(projection.notary_relay.allowed_private_cidr, "10.89.0.4/32");
         let source_transport = projection.synthetic_source_transport.as_ref().unwrap();
         assert_eq!(
             source_transport.root_certificate_path,
@@ -1726,9 +1221,6 @@ mod tests {
             &projection.actions.relay_consultation_prepare,
             &projection.actions.relay_consultation_initialize,
             &projection.actions.relay_consultation_serve,
-            &projection.actions.notary_prepare,
-            &projection.actions.notary_initialize,
-            &projection.actions.notary_serve,
             &projection.actions.postgres_bootstrap,
         ];
         let prepared_actions = [
@@ -1738,9 +1230,6 @@ mod tests {
             &files.relay_consultation_prepare,
             &files.relay_consultation_initialize,
             &files.relay_consultation_serve,
-            &files.notary_prepare,
-            &files.notary_initialize,
-            &files.notary_serve,
             &files.postgres_bootstrap,
         ];
         for (projected, prepared) in projected_actions.into_iter().zip(prepared_actions) {
@@ -1760,19 +1249,6 @@ mod tests {
                 public_container_path(prepared.file_name().unwrap().to_str().unwrap())
             );
         }
-        assert_eq!(
-            projection.issuance.as_ref().unwrap().public_jwk_file,
-            public_container_path(
-                files
-                    .issuance_public_jwk
-                    .as_ref()
-                    .unwrap()
-                    .file_name()
-                    .unwrap()
-                    .to_str()
-                    .unwrap()
-            )
-        );
         let DevSourceCredentialProjection::SyntheticOAuthClientCredentials {
             source_client_id_file,
             source_client_secret_file,
@@ -1881,54 +1357,6 @@ mod tests {
         }
     }
 
-    #[test]
-    fn caller_workload_and_jwks_are_internally_consistent() {
-        let closure = PreparedDevCredentialClosure::generate(requirements(
-            DevSourceCredentialProfile::SyntheticUnauthenticated,
-        ))
-        .unwrap();
-        let parent = tempdir().unwrap();
-        let files = closure
-            .materialize_owner_only(&parent.path().join("credentials"))
-            .unwrap();
-        let serve_env = fs::read_to_string(files.notary_serve.host_path).unwrap();
-        assert!(serve_env.contains(&format!(
-            "{}={}",
-            closure.projection.caller.fingerprint_env,
-            fingerprint_api_key(&closure.caller_token)
-        )));
-        let public: Value = serde_json::from_str(&closure.workload_public_jwk).unwrap();
-        let jwks: Value = serde_json::from_str(&closure.workload_jwks).unwrap();
-        assert_eq!(jwks["keys"][0], public);
-
-        let segments = closure.workload_token.split('.').collect::<Vec<_>>();
-        assert_eq!(segments.len(), 3);
-        let header: Value =
-            serde_json::from_slice(&URL_SAFE_NO_PAD.decode(segments[0]).unwrap()).unwrap();
-        let claims: Value =
-            serde_json::from_slice(&URL_SAFE_NO_PAD.decode(segments[1]).unwrap()).unwrap();
-        assert_eq!(header["kid"], DEV_WORKLOAD_KID);
-        assert_eq!(claims["iss"], closure.projection.relay_oidc.issuer);
-        assert_eq!(claims["aud"], closure.projection.relay_oidc.audience);
-        assert_eq!(claims["azp"], closure.projection.relay_oidc.client_id);
-        assert_eq!(claims["scope"], "registry:consult:example-service");
-
-        let x: [u8; 32] = URL_SAFE_NO_PAD
-            .decode(public["x"].as_str().unwrap())
-            .unwrap()
-            .try_into()
-            .unwrap();
-        let signature =
-            Signature::from_slice(&URL_SAFE_NO_PAD.decode(segments[2]).unwrap()).unwrap();
-        VerifyingKey::from_bytes(&x)
-            .unwrap()
-            .verify(
-                format!("{}.{}", segments[0], segments[1]).as_bytes(),
-                &signature,
-            )
-            .unwrap();
-    }
-
     #[test]
     fn source_profiles_are_closed_and_operator_bound_gets_no_source_secret() {
         let profiles = [
@@ -2047,29 +1475,6 @@ mod tests {
             ])
         );
 
-        let notary_prepare = parse(&files.notary_prepare.host_path);
-        let notary_initialize = parse(&files.notary_initialize.host_path);
-        let notary_serve = parse(&files.notary_serve.host_path);
-        assert_eq!(
-            keys(&notary_prepare),
-            expected(&[NOTARY_AUDIT_ENV, NOTARY_MIGRATION_DATABASE_ENV])
-        );
-        assert_eq!(
-            keys(&notary_initialize),
-            expected(&[NOTARY_AUDIT_ENV, NOTARY_DATABASE_ENV])
-        );
-        assert_eq!(
-            keys(&notary_serve),
-            expected(&[
-                NOTARY_AUDIT_ENV,
-                NOTARY_DATABASE_ENV,
-                NOTARY_MAINTENANCE_DATABASE_ENV,
-                NOTARY_READER_DATABASE_ENV,
-                NOTARY_WORKLOAD_PUBLIC_JWK_ENV,
-                "REGISTRY_DEV_CALLER_FINGERPRINT",
-                "REGISTRY_NOTARY_ISSUER_JWK",
-            ])
-        );
         assert_eq!(
             keys(&parse(&files.postgres_bootstrap.host_path)),
             expected(&[
@@ -2077,10 +1482,6 @@ mod tests {
                 "REGISTRY_RELAY_RUNTIME_PASSWORD",
                 "REGISTRY_RELAY_MAINTENANCE_PASSWORD",
                 "REGISTRY_RELAY_READER_PASSWORD",
-                "REGISTRY_NOTARY_MIGRATOR_PASSWORD",
-                "REGISTRY_NOTARY_RUNTIME_PASSWORD",
-                "REGISTRY_NOTARY_MAINTENANCE_PASSWORD",
-                "REGISTRY_NOTARY_READER_PASSWORD",
             ])
         );
     }
@@ -2102,17 +1503,12 @@ mod tests {
         let no_match_path = files.relay_no_match_token.unwrap();
         let match_token = fs::read_to_string(&match_path).unwrap();
         let no_match_token = fs::read_to_string(&no_match_path).unwrap();
-        let caller_token = fs::read_to_string(&files.caller_token).unwrap();
         assert_eq!(
-            [
-                match_token.as_str(),
-                no_match_token.as_str(),
-                caller_token.as_str()
-            ]
-            .into_iter()
-            .collect::<BTreeSet<_>>()
-            .len(),
-            3
+            [match_token.as_str(), no_match_token.as_str()]
+                .into_iter()
+                .collect::<BTreeSet<_>>()
+                .len(),
+            2
         );
         let serve_env = fs::read_to_string(&files.relay_public_serve.host_path).unwrap();
         assert!(serve_env.contains(&format!(
@@ -2125,7 +1521,7 @@ mod tests {
             crate::project_authoring::LOCAL_RELAY_NO_MATCH_KEY_HASH_ENV,
             fingerprint_api_key(&no_match_token)
         )));
-        for raw in [&match_token, &no_match_token, &caller_token] {
+        for raw in [&match_token, &no_match_token] {
             assert!(!serve_env.contains(raw));
         }
 
@@ -2152,7 +1548,6 @@ mod tests {
         for lane in [
             ProductAcceptanceLaneV1::RelayPublic,
             ProductAcceptanceLaneV1::RelayConsultation,
-            ProductAcceptanceLaneV1::Notary,
         ] {
             closure
                 .with_lane_private_jwk(lane, |text| {
@@ -2164,8 +1559,8 @@ mod tests {
                 })
                 .unwrap();
         }
-        assert_eq!(private_values.len(), 3);
-        assert_eq!(public_thumbprints.len(), 3);
+        assert_eq!(private_values.len(), 2);
+        assert_eq!(public_thumbprints.len(), 2);
         assert_eq!(
             closure
                 .projection
@@ -2174,7 +1569,7 @@ mod tests {
                 .map(|signer| signer.kid.as_str())
                 .collect::<BTreeSet<_>>()
                 .len(),
-            3
+            2
         );
         for signer in &closure.projection.lane_signers {
             assert_eq!(
@@ -2184,87 +1579,13 @@ mod tests {
         }
     }
 
-    #[test]
-    fn absent_issuance_gets_an_isolated_runtime_signer_for_one_credential_closure() {
-        let mut first_requirements = requirements(DevSourceCredentialProfile::OperatorBound);
-        first_requirements.issuance = None;
-        let closure = PreparedDevCredentialClosure::generate(first_requirements).unwrap();
-        assert!(closure.issuance.is_none());
-        let runtime = closure.notary_runtime_signing.as_ref().unwrap();
-        let runtime_private: Value = serde_json::from_str(&runtime.private_jwk).unwrap();
-        assert_eq!(runtime_private["kid"], DEV_NOTARY_RUNTIME_SIGNING_KID);
-        let runtime_kid = PublicJwk::parse(&runtime.public_jwk)
-            .unwrap()
-            .jkt()
-            .unwrap();
-        let mut lane_private_values = BTreeSet::new();
-        let mut lane_kids = BTreeSet::new();
-        for lane in [
-            ProductAcceptanceLaneV1::RelayPublic,
-            ProductAcceptanceLaneV1::RelayConsultation,
-            ProductAcceptanceLaneV1::Notary,
-        ] {
-            closure
-                .with_lane_private_jwk(lane, |text| {
-                    let private = PrivateJwk::parse(text)?;
-                    lane_private_values.insert(text.to_string());
-                    lane_kids.insert(private.public().jkt()?);
-                    Ok(())
-                })
-                .unwrap();
-        }
-        assert!(!lane_private_values.contains(runtime.private_jwk.as_str()));
-        assert!(!lane_kids.contains(&runtime_kid));
-
-        let mut second_requirements = requirements(DevSourceCredentialProfile::OperatorBound);
-        second_requirements.issuance = None;
-        let second = PreparedDevCredentialClosure::generate(second_requirements).unwrap();
-        let second_runtime = second.notary_runtime_signing.as_ref().unwrap();
-        assert_ne!(
-            runtime_kid,
-            PublicJwk::parse(&second_runtime.public_jwk)
-                .unwrap()
-                .jkt()
-                .unwrap()
-        );
-
-        let parent = tempdir().unwrap();
-        let files = closure
-            .materialize_owner_only(&parent.path().join("credentials"))
-            .unwrap();
-        assert!(files.issuance_public_jwk.is_none());
-        assert!(
-            fs::read_to_string(&files.notary_signing_key).unwrap() == runtime.private_jwk.as_str()
-        );
-        let runtime_private_member = runtime_private["d"].as_str().unwrap();
-        for path in files
-            .lane_public_jwks
-            .iter()
-            .chain([&files.workload_public_jwk])
-        {
-            let text = fs::read_to_string(path).unwrap();
-            assert!(!text.contains(runtime_private_member));
-            assert_ne!(PublicJwk::parse(&text).unwrap().jkt().unwrap(), runtime_kid);
-        }
-        assert_eq!(
-            fs::read_dir(&files.root)
-                .unwrap()
-                .filter_map(|entry| entry.ok())
-                .filter_map(|entry| fs::read_to_string(entry.path()).ok())
-                .filter(|text| text.contains(runtime_private_member))
-                .count(),
-            1
-        );
-    }
-
     #[test]
     fn all_generated_secret_values_are_distinct() {
         let closure = PreparedDevCredentialClosure::generate(requirements(oauth_profile(
             DevOAuthCredentialProfile::Oauth2Bearer,
         )))
         .unwrap();
-        let fingerprint = fingerprint_api_key(&closure.caller_token);
-        closure.validate_distinct_secrets(&fingerprint).unwrap();
+        closure.validate_distinct_secrets().unwrap();
     }
 
     #[test]
@@ -2276,7 +1597,7 @@ mod tests {
             },
         ))
         .unwrap();
-        let sentinel = closure.caller_token.to_string();
+        let sentinel = closure.relay_public_audit.to_string();
         let files = closure
             .materialize_owner_only(&parent.path().join("credentials"))
             .unwrap();
@@ -2299,12 +1620,7 @@ mod tests {
         let files = closure
             .materialize_owner_only(&parent.path().join("credentials"))
             .unwrap();
-        for path in files
-            .lane_public_jwks
-            .iter()
-            .chain(files.issuance_public_jwk.iter())
-            .chain([&files.workload_public_jwk])
-        {
+        for path in &files.lane_public_jwks {
             PublicJwk::parse(&fs::read_to_string(path).unwrap()).unwrap();
             assert!(!fs::read_to_string(path).unwrap().contains("\"d\""));
         }
diff --git a/crates/registryctl/src/dev_runtime.rs b/crates/registryctl/src/dev_runtime.rs
index 8a41cd21b..3977ad0c9 100644
--- a/crates/registryctl/src/dev_runtime.rs
+++ b/crates/registryctl/src/dev_runtime.rs
@@ -20,7 +20,6 @@ use registry_platform_config::{
     verify_config_bundle, ProductAcceptanceIdentityV1, ProductAcceptanceLaneV1,
     ProductAcceptanceProductV1, ProductTrustDomainV1, MAX_MANIFEST_BYTES,
 };
-use registry_platform_crypto::canonicalize_json;
 use serde::de::DeserializeOwned;
 use serde::{Deserialize, Serialize};
 use sha2::{Digest as _, Sha256};
@@ -48,21 +47,16 @@ pub const DEV_SYNTHETIC_SOURCE_ORIGIN: &str = "https://10.89.0.3:8099";
 const DEV_PRIVATE_SUBNET: &str = "10.89.0.0/24";
 const DEV_SYNTHETIC_SOURCE_CA_CONTAINER_PATH: &str =
     "/run/registry/dev-public/synthetic-source-tls.crt";
-const DEV_WORKLOAD_JWKS_CONTAINER_PATH: &str = "/run/registry/dev-public/notary-workload-jwks.json";
 
 const DEV_ROOT: &str = ".registry-stack/dev";
 const RUNTIME_STATE_FILE: &str = "runtime-state.json";
-const REQUEST_CONFIG_FILE: &str = "request.curl";
-const REQUEST_BODY_FILE: &str = "request.json";
 const RECORDS_REQUEST_CONFIG_FILE: &str = "records-request.curl";
 const RECORDS_DENIED_CONFIG_FILE: &str = "records-denied.curl";
-const CALLER_TOKEN_FILE: &str = "caller-token";
 const SYNTHETIC_SOURCE_PLAN_FILE: &str = "synthetic-source-plan.json";
 const SYNTHETIC_SOURCE_PLAN_SCHEMA_V1: &str = "registry.relay.synthetic-source-plan.v1";
 const SYNTHETIC_SOURCE_PLAN_CONTAINER_PATH: &str = "/run/registry/synthetic-source-plan.json";
 const SYNTHETIC_SOURCE_SECRET_ROOT: &str = "/run/registry/synthetic-source-secrets";
 const MAX_RUNTIME_STATE_BYTES: u64 = 256 * 1024;
-const MAX_REQUEST_BODY_BYTES: usize = 1024 * 1024;
 const MAX_SYNTHETIC_RESPONSE_BYTES: usize = 1024 * 1024;
 const MAX_COMPOSE_BYTES: u64 = 1024 * 1024;
 const MAX_RUNTIME_PLAN_BYTES: u64 = 2 * 1024 * 1024;
@@ -72,7 +66,6 @@ const MAX_RUNTIME_PLAN_BYTES: u64 = 2 * 1024 * 1024;
 pub(crate) const MAX_LOCAL_SNAPSHOT_BYTES: u64 = 256 * 1024 * 1024;
 const MAX_ID_BYTES: usize = 128;
 const DEFAULT_RELAY_PORT: u16 = 4242;
-const DEFAULT_NOTARY_PORT: u16 = 4243;
 const DEFAULT_SHUTDOWN_SECONDS: u16 = 15;
 const MAX_LOG_LINES_PER_PRODUCT: u16 = 500;
 
@@ -126,14 +119,7 @@ pub struct AuthoredDevScenario {
     pub oauth_profile: DevOAuthProfile,
     pub denial_scenario_id: String,
     pub authorized_scenario_id: String,
-    pub minimized_claim_ids: Vec<String>,
-    /// Binds the request-selected claim values and disclosure semantics without
-    /// persisting those values in the generated runtime plan.
-    pub expected_claim_results_sha256: String,
     pub synthetic_source: Option<AuthoredSyntheticSourcePlan>,
-    /// The compiler-produced governed request. It is intentionally private to
-    /// the owner-only request materializer and is never serialized or logged.
-    pub request_json: Vec<u8>,
 }
 
 impl fmt::Debug for AuthoredDevScenario {
@@ -148,16 +134,10 @@ impl fmt::Debug for AuthoredDevScenario {
             .field("oauth_profile", &self.oauth_profile)
             .field("denial_scenario_id", &self.denial_scenario_id)
             .field("authorized_scenario_id", &self.authorized_scenario_id)
-            .field("minimized_claim_ids", &self.minimized_claim_ids)
-            .field(
-                "expected_claim_results_sha256",
-                &self.expected_claim_results_sha256,
-            )
             .field(
                 "synthetic_source",
                 &self.synthetic_source.as_ref().map(|_| "<redacted>"),
             )
-            .field("request_json", &"<redacted>")
             .finish()
     }
 }
@@ -311,7 +291,6 @@ pub struct AuthoredDevelopment {
     /// projection.
     pub operator_source_binding_present: bool,
     pub relay_port: Option<u16>,
-    pub notary_port: Option<u16>,
 }
 
 /// One validated project-owned snapshot exposed read-only to Relay serve
@@ -340,8 +319,6 @@ pub struct DevRuntimeArtifactInputs {
     pub relay_public_anchor: PathBuf,
     pub relay_consultation_bundle: PathBuf,
     pub relay_consultation_anchor: PathBuf,
-    pub notary_bundle: PathBuf,
-    pub notary_anchor: PathBuf,
 }
 
 #[derive(Clone, Debug, Eq, PartialEq, Serialize)]
@@ -349,7 +326,6 @@ pub(crate) struct VerifiedDevReleaseProjection {
     release_id: String,
     release_tag: String,
     registry_relay_image: String,
-    registry_notary_image: String,
     postgresql_image: String,
     minimum_compose_version: String,
     relay_public_prepare: DevRuntimeActionProjection,
@@ -358,9 +334,6 @@ pub(crate) struct VerifiedDevReleaseProjection {
     relay_consultation_prepare: DevRuntimeActionProjection,
     relay_consultation_initialize: DevRuntimeActionProjection,
     relay_consultation_serve: DevRuntimeActionProjection,
-    notary_prepare: DevRuntimeActionProjection,
-    notary_initialize: DevRuntimeActionProjection,
-    notary_serve: DevRuntimeActionProjection,
     postgresql_serve: DevRuntimeActionProjection,
     postgresql_bootstrap: DevRuntimeActionProjection,
     postgresql_server_environment: Vec<String>,
@@ -368,7 +341,6 @@ pub(crate) struct VerifiedDevReleaseProjection {
     postgresql_operator_files: Vec<DevOperatorFileProjection>,
     relay_public_health_probe: Vec<String>,
     relay_consultation_health_probe: Vec<String>,
-    notary_health_probe: Vec<String>,
     postgresql_health_probe: Vec<String>,
 }
 
@@ -484,7 +456,6 @@ impl VerifiedDevReleaseProjection {
             release_id: lock.signed_payload_sha256().to_string(),
             release_tag: lock.release_tag().to_string(),
             registry_relay_image: images.relay().to_string(),
-            registry_notary_image: images.notary().to_string(),
             postgresql_image: images.postgresql_state_plane().to_string(),
             minimum_compose_version: lock.minimum_compose_version().to_string(),
             relay_public_prepare: runtime
@@ -508,15 +479,6 @@ impl VerifiedDevReleaseProjection {
                 .relay_consultation()
                 .development_serve_action()
                 .into(),
-            notary_prepare: runtime
-                .notary()
-                .development_prepare_state_store_action()
-                .into(),
-            notary_initialize: runtime
-                .notary()
-                .development_initialize_state_action()
-                .into(),
-            notary_serve: runtime.notary().development_serve_action().into(),
             postgresql_serve: runtime.postgresql_state_plane().serve().into(),
             postgresql_bootstrap: runtime.postgresql_state_plane().bootstrap().into(),
             postgresql_server_environment: runtime
@@ -537,7 +499,6 @@ impl VerifiedDevReleaseProjection {
                 .collect(),
             relay_public_health_probe: runtime.relay_public().health_probe().to_vec(),
             relay_consultation_health_probe: runtime.relay_consultation().health_probe().to_vec(),
-            notary_health_probe: runtime.notary().health_probe().to_vec(),
             postgresql_health_probe: runtime.postgresql_state_plane().health_probe().to_vec(),
         }
     }
@@ -551,7 +512,6 @@ impl VerifiedDevReleaseProjection {
         release_id: String,
         release_tag: String,
         registry_relay_image: String,
-        registry_notary_image: String,
         postgresql_image: String,
         minimum_compose_version: String,
     ) -> DevRuntimeResult<Self> {
@@ -566,16 +526,11 @@ impl VerifiedDevReleaseProjection {
             &registry_relay_image,
             "ghcr.io/registrystack/registry-relay",
         )?;
-        validate_image_ref(
-            &registry_notary_image,
-            "ghcr.io/registrystack/registry-notary",
-        )?;
         validate_image_ref(&postgresql_image, "docker.io/library/postgres")?;
         Ok(Self {
             release_id,
             release_tag,
             registry_relay_image,
-            registry_notary_image,
             postgresql_image,
             minimum_compose_version,
             relay_public_prepare: relay_development_action("relay-public", "prepare_state_store"),
@@ -590,9 +545,6 @@ impl VerifiedDevReleaseProjection {
                 "initialize_state",
             ),
             relay_consultation_serve: relay_development_action("relay-consultation", "serve"),
-            notary_prepare: notary_development_action("prepare_state_store"),
-            notary_initialize: notary_development_action("initialize_state"),
-            notary_serve: notary_development_action("serve"),
             postgresql_serve: DevRuntimeActionProjection {
                 command: vec![
                     "postgres".into(),
@@ -664,16 +616,11 @@ impl VerifiedDevReleaseProjection {
                         "REGISTRY_RELAY_RUNTIME_PASSWORD",
                         "REGISTRY_RELAY_MAINTENANCE_PASSWORD",
                         "REGISTRY_RELAY_READER_PASSWORD",
-                        "REGISTRY_NOTARY_MIGRATOR_PASSWORD",
-                        "REGISTRY_NOTARY_RUNTIME_PASSWORD",
-                        "REGISTRY_NOTARY_MAINTENANCE_PASSWORD",
-                        "REGISTRY_NOTARY_READER_PASSWORD",
                     ],
                 ),
             ],
             relay_public_health_probe: vec!["registry-relay".into(), "health".into()],
             relay_consultation_health_probe: vec!["registry-relay".into(), "health".into()],
-            notary_health_probe: vec!["registry-notary".into(), "health".into()],
             postgresql_health_probe: vec!["pg_isready".into()],
         })
     }
@@ -751,7 +698,7 @@ pub fn prepare_dev_runtime_plan(
 
     // Credentials are generated before the compiler sees any disposable
     // binding. The compiler receives only their nonsecret public projection
-    // and signs all three closed lanes before Compose is rendered.
+    // and signs both Relay lanes before Compose is rendered.
     let credentials = PreparedDevCredentialClosure::generate(authoring.credential_requirements())
         .map_err(|_| DevRuntimeError::invalid_credentials())?;
     let signed_root = generated_root.join("signed-lanes");
@@ -781,8 +728,6 @@ pub fn prepare_dev_runtime_plan(
         relay_public_anchor: signed.relay_public_anchor,
         relay_consultation_bundle: signed.relay_consultation_bundle,
         relay_consultation_anchor: signed.relay_consultation_anchor,
-        notary_bundle: signed.notary_bundle,
-        notary_anchor: signed.notary_anchor,
     };
 
     let paths = runtime_paths(&canonical_root, environment_id, &runtime_id);
@@ -799,10 +744,6 @@ pub fn prepare_dev_runtime_plan(
                 .development
                 .relay_port
                 .unwrap_or(DEFAULT_RELAY_PORT),
-            notary_port: authoring
-                .development
-                .notary_port
-                .unwrap_or(DEFAULT_NOTARY_PORT),
             synthetic: authoring.development.source_mode == DevSourceMode::Synthetic,
             local_snapshot: authoring.local_snapshot.as_ref(),
             operator_source_secret_env: &authoring.operator_source_secret_env,
@@ -870,7 +811,7 @@ pub fn load_bound_dev_runtime_plan(
     let plan_file = runtime_roots[0].join("runtime-plan.json");
     let bytes = read_owner_only_regular_file(&plan_file, MAX_RUNTIME_PLAN_BYTES)
         .map_err(|_| DevRuntimeError::project_binding())?;
-    let mut plan: DevRuntimePlan =
+    let plan: DevRuntimePlan =
         parse_json_strict(&bytes).map_err(|_| DevRuntimeError::project_binding())?;
     let expected_digest = sha256_uri(canonical_root.to_string_lossy().as_bytes());
     if plan.binding.environment != environment_id
@@ -882,15 +823,6 @@ pub fn load_bound_dev_runtime_plan(
     {
         return Err(DevRuntimeError::project_binding());
     }
-    let request_json =
-        read_owner_only_regular_file(&plan.paths.request_body, MAX_REQUEST_BODY_BYTES as u64)
-            .map_err(|_| DevRuntimeError::project_binding())?;
-    let _: serde_json::Value =
-        parse_json_strict(&request_json).map_err(|_| DevRuntimeError::project_binding())?;
-    if request_json.is_empty() || sha256_uri(&request_json) != plan.request_digest {
-        return Err(DevRuntimeError::project_binding());
-    }
-    plan.request_json = request_json;
     load_bound_state(&plan)?;
     Ok(plan)
 }
@@ -901,8 +833,6 @@ fn runtime_paths(root: &Path, environment_id: &str, runtime_id: &str) -> DevRunt
         state_file: runtime_root.join(RUNTIME_STATE_FILE),
         plan_file: runtime_root.join("runtime-plan.json"),
         credentials: runtime_root.join("credentials"),
-        request_config: runtime_root.join("credentials").join(REQUEST_CONFIG_FILE),
-        request_body: runtime_root.join("credentials").join(REQUEST_BODY_FILE),
         records_request_config: runtime_root
             .join("credentials")
             .join(RECORDS_REQUEST_CONFIG_FILE),
@@ -988,45 +918,14 @@ pub struct DevScenarioPlan {
     pub oauth_profile: DevOAuthProfile,
     pub denial_scenario_id: String,
     pub authorized_scenario_id: String,
-    pub minimized_claim_ids: Vec<String>,
-    /// Value-free commitment checked against the authorized smoke response.
-    pub expected_claim_results_sha256: String,
     pub synthetic_source_origin: Option<String>,
 }
 
-#[derive(Serialize)]
-pub(crate) struct DevClaimResultExpectation {
-    pub claim_id: String,
-    pub value: serde_json::Value,
-    pub satisfied: Option<bool>,
-    pub disclosure: String,
-}
-
-pub(crate) fn dev_claim_results_commitment(
-    mut results: Vec<DevClaimResultExpectation>,
-) -> Result<String, ()> {
-    results.sort_by(|left, right| left.claim_id.cmp(&right.claim_id));
-    if results.is_empty()
-        || results
-            .windows(2)
-            .any(|pair| pair[0].claim_id == pair[1].claim_id)
-    {
-        return Err(());
-    }
-    let canonical = canonicalize_json(&serde_json::json!({
-        "schema": "registryctl.dev_claim_results_commitment.v1",
-        "results": results,
-    }))
-    .map_err(|_| ())?;
-    Ok(sha256_uri(&canonical))
-}
-
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
 #[serde(rename_all = "kebab-case")]
 pub enum DevWorkloadId {
     RelayPublic,
     RelayConsultation,
-    Notary,
     Postgresql,
     SyntheticSource,
 }
@@ -1036,7 +935,6 @@ impl DevWorkloadId {
         match self {
             Self::RelayPublic => "registry-relay-public",
             Self::RelayConsultation => "registry-relay-consultation",
-            Self::Notary => "registry-notary",
             Self::Postgresql => "registry-postgres",
             Self::SyntheticSource => "registry-synthetic-source",
         }
@@ -1129,8 +1027,6 @@ pub struct DevRuntimePaths {
     pub state_file: PathBuf,
     pub plan_file: PathBuf,
     pub credentials: PathBuf,
-    pub request_config: PathBuf,
-    pub request_body: PathBuf,
     pub records_request_config: PathBuf,
     pub records_denied_config: PathBuf,
     pub synthetic_source_plan: PathBuf,
@@ -1145,7 +1041,6 @@ pub struct DevRuntimePlan {
     pub release_tag: String,
     pub minimum_compose_version: String,
     pub compose_digest: String,
-    pub request_digest: String,
     pub records_request_digest: Option<String>,
     pub local_snapshot_digest: Option<String>,
     pub source_mode: DevSourceMode,
@@ -1155,8 +1050,6 @@ pub struct DevRuntimePlan {
     pub paths: DevRuntimePaths,
     pub artifacts: DevRuntimeArtifactInputs,
     #[serde(skip)]
-    request_json: Vec<u8>,
-    #[serde(skip)]
     records_request: Option<AuthoredRecordsRequest>,
     #[serde(skip)]
     synthetic_source_plan: Option<SyntheticSourcePlanV1>,
@@ -1176,7 +1069,6 @@ impl fmt::Debug for DevRuntimePlan {
             .field("release_tag", &self.release_tag)
             .field("minimum_compose_version", &self.minimum_compose_version)
             .field("compose_digest", &self.compose_digest)
-            .field("request_digest", &self.request_digest)
             .field("records_request_digest", &self.records_request_digest)
             .field("local_snapshot_digest", &self.local_snapshot_digest)
             .field("source_mode", &self.source_mode)
@@ -1185,7 +1077,6 @@ impl fmt::Debug for DevRuntimePlan {
             .field("lifecycle", &self.lifecycle)
             .field("paths", &self.paths)
             .field("artifacts", &self.artifacts)
-            .field("request_json", &"<redacted>")
             .field(
                 "records_request",
                 &self.records_request.as_ref().map(|_| "<redacted>"),
@@ -1372,7 +1263,6 @@ impl DevRuntimePlan {
             validate_authored_local_snapshot(&canonical_root, snapshot)?;
         }
         let scenario = select_authored_scenario(&input.development, &input.scenarios)?;
-        let request_digest = sha256_uri(&scenario.request_json);
         let records_request_digest = input.records_request.as_ref().map(|request| {
             sha256_uri(
                 &[
@@ -1397,12 +1287,11 @@ impl DevRuntimePlan {
             ));
         }
         let relay_port = input.development.relay_port.unwrap_or(DEFAULT_RELAY_PORT);
-        let notary_port = input.development.notary_port.unwrap_or(DEFAULT_NOTARY_PORT);
-        if relay_port == 0 || notary_port == 0 || relay_port == notary_port {
+        if relay_port == 0 {
             return Err(DevRuntimeError::new(
                 DevFailureCategory::InvalidPlan,
-                "development loopback ports must be non-zero and distinct",
-                "author distinct development.relay_port and development.notary_port values",
+                "development Relay loopback port must be non-zero",
+                "author a non-zero development.relay_port value",
             ));
         }
 
@@ -1425,8 +1314,6 @@ impl DevRuntimePlan {
             state_file: runtime_root.join(RUNTIME_STATE_FILE),
             plan_file: runtime_root.join("runtime-plan.json"),
             credentials: runtime_root.join("credentials"),
-            request_config: runtime_root.join("credentials").join(REQUEST_CONFIG_FILE),
-            request_body: runtime_root.join("credentials").join(REQUEST_BODY_FILE),
             records_request_config: runtime_root
                 .join("credentials")
                 .join(RECORDS_REQUEST_CONFIG_FILE),
@@ -1464,8 +1351,6 @@ impl DevRuntimePlan {
             oauth_profile: scenario.oauth_profile,
             denial_scenario_id: scenario.denial_scenario_id.clone(),
             authorized_scenario_id: scenario.authorized_scenario_id.clone(),
-            minimized_claim_ids: scenario.minimized_claim_ids.clone(),
-            expected_claim_results_sha256: scenario.expected_claim_results_sha256.clone(),
             synthetic_source_origin: (input.development.source_mode == DevSourceMode::Synthetic)
                 .then(|| DEV_SYNTHETIC_SOURCE_ORIGIN.to_string()),
         };
@@ -1478,7 +1363,6 @@ impl DevRuntimePlan {
             &credential_files,
             DevWorkloadBuildOptions {
                 relay_port,
-                notary_port,
                 synthetic: input.development.source_mode == DevSourceMode::Synthetic,
                 local_snapshot: input.local_snapshot.as_ref(),
                 operator_source_secret_env: &input.operator_source_secret_env,
@@ -1492,7 +1376,6 @@ impl DevRuntimePlan {
             log_services: vec![
                 DevWorkloadId::RelayPublic,
                 DevWorkloadId::RelayConsultation,
-                DevWorkloadId::Notary,
                 DevWorkloadId::SyntheticSource,
             ]
             .into_iter()
@@ -1529,7 +1412,6 @@ impl DevRuntimePlan {
             lifecycle: &lifecycle,
             artifacts: &artifacts,
             compose_digest: &compose_digest,
-            request_digest: &request_digest,
             records_request_digest: records_request_digest.as_deref(),
             local_snapshot_digest: local_snapshot_digest.as_deref(),
             synthetic_source_plan: synthetic_source_plan.as_ref(),
@@ -1542,7 +1424,6 @@ impl DevRuntimePlan {
             release_tag: input.release.release_tag,
             minimum_compose_version: input.release.minimum_compose_version,
             compose_digest,
-            request_digest,
             records_request_digest,
             local_snapshot_digest,
             source_mode: input.development.source_mode,
@@ -1551,7 +1432,6 @@ impl DevRuntimePlan {
             lifecycle,
             paths,
             artifacts,
-            request_json: scenario.request_json.clone(),
             records_request: input.records_request,
             synthetic_source_plan,
             credentials: Some(input.credentials),
@@ -1573,13 +1453,6 @@ impl DevRuntimePlan {
             .collect()
     }
 
-    pub fn evidence_request_command(&self) -> String {
-        format!(
-            "curl --config {}",
-            shell_quote_path(&self.paths.request_config)
-        )
-    }
-
     pub fn records_request_command(&self) -> Option<String> {
         self.records_request_digest.as_ref().map(|_| {
             format!(
@@ -1618,20 +1491,6 @@ impl DevRuntimePlan {
         refs.into_iter().collect()
     }
 
-    fn caller_endpoint(&self) -> DevRuntimeResult<SocketAddr> {
-        self.workloads
-            .iter()
-            .find(|workload| workload.id == DevWorkloadId::Notary)
-            .and_then(|workload| workload.host_endpoint)
-            .ok_or_else(|| {
-                DevRuntimeError::new(
-                    DevFailureCategory::InvalidPlan,
-                    "development plan has no public Notary endpoint",
-                    "rebuild the development runtime plan",
-                )
-            })
-    }
-
     fn relay_public_endpoint(&self) -> DevRuntimeResult<SocketAddr> {
         self.workloads
             .iter()
@@ -1782,7 +1641,11 @@ fn validate_credential_projection(
     };
     if !source_matches
         || !file_shape_matches
-        || files.root != files.caller_token.parent().unwrap_or(Path::new(""))
+        || files.root
+            != files
+                .postgres_admin_password
+                .parent()
+                .unwrap_or(Path::new(""))
     {
         return Err(DevRuntimeError::invalid_credentials());
     }
@@ -1869,38 +1732,6 @@ fn select_authored_scenario<'a>(
             "author distinct denial and authorized smoke scenarios",
         ));
     }
-    if selected.request_json.is_empty() || selected.request_json.len() > MAX_REQUEST_BODY_BYTES {
-        return Err(DevRuntimeError::new(
-            DevFailureCategory::InvalidPlan,
-            "compiled local request exceeds its closed byte contract",
-            "reduce the authored development request and rebuild",
-        ));
-    }
-    let _: serde_json::Value = parse_json_strict(&selected.request_json).map_err(|_| {
-        DevRuntimeError::new(
-            DevFailureCategory::InvalidPlan,
-            "compiled local request is not strict JSON",
-            "fix the authored fixture request and rebuild",
-        )
-    })?;
-    let mut claims = BTreeSet::new();
-    for claim in &selected.minimized_claim_ids {
-        validate_id("minimized claim id", claim)?;
-        if !claims.insert(claim) {
-            return Err(DevRuntimeError::new(
-                DevFailureCategory::InvalidPlan,
-                "minimized claim ids must be unique",
-                "remove the duplicate expected claim id",
-            ));
-        }
-    }
-    if validate_sha256(&selected.expected_claim_results_sha256).is_err() {
-        return Err(DevRuntimeError::new(
-            DevFailureCategory::InvalidPlan,
-            "expected development claim result commitment is invalid",
-            "rebuild the development plan from a valid authored fixture",
-        ));
-    }
     Ok(selected)
 }
 
@@ -2199,7 +2030,6 @@ fn build_workloads(
 ) -> DevRuntimeResult<Vec<DevWorkloadPlan>> {
     let DevWorkloadBuildOptions {
         relay_port,
-        notary_port,
         synthetic,
         local_snapshot,
         operator_source_secret_env,
@@ -2288,46 +2118,6 @@ fn build_workloads(
             )?,
             hardening: None,
         },
-        DevWorkloadPlan {
-            id: DevWorkloadId::Notary,
-            image: release.registry_notary_image.clone(),
-            acceptance_identity: Some(identity(
-                ProductAcceptanceLaneV1::Notary,
-                ProductAcceptanceProductV1::RegistryNotary,
-                "notary",
-            )),
-            host_endpoint: Some(SocketAddr::new(
-                IpAddr::V4(Ipv4Addr::LOCALHOST),
-                notary_port,
-            )),
-            prepare_state_store: Some(product_action(
-                DevWorkloadId::Notary,
-                "prepare-state-store",
-                &release.notary_prepare,
-                artifacts,
-                paths,
-                credential_files,
-            )?),
-            initialize_state: Some(product_action(
-                DevWorkloadId::Notary,
-                "initialize-state",
-                &release.notary_initialize,
-                artifacts,
-                paths,
-                credential_files,
-            )?),
-            command: release.notary_serve.command.clone(),
-            health_probe: release.notary_health_probe.clone(),
-            environment_passthrough: Vec::new(),
-            mounts: product_action_mounts(
-                DevWorkloadId::Notary,
-                &release.notary_serve,
-                artifacts,
-                paths,
-                credential_files,
-            )?,
-            hardening: None,
-        },
         DevWorkloadPlan {
             id: DevWorkloadId::Postgresql,
             image: release.postgresql_image.clone(),
@@ -2342,14 +2132,6 @@ fn build_workloads(
             hardening: Some(release.postgresql_hardening.clone()),
         },
     ];
-    let consultation = workloads
-        .iter_mut()
-        .find(|workload| workload.id == DevWorkloadId::RelayConsultation)
-        .ok_or_else(DevRuntimeError::image_lock)?;
-    consultation.mounts.push(read_only_mount(
-        &credential_files.workload_jwks,
-        DEV_WORKLOAD_JWKS_CONTAINER_PATH,
-    ));
     if let Some(source) = &credential_files.source {
         let consultation = workloads
             .iter_mut()
@@ -2411,7 +2193,6 @@ fn build_workloads(
 
 struct DevWorkloadBuildOptions<'a> {
     relay_port: u16,
-    notary_port: u16,
     synthetic: bool,
     local_snapshot: Option<&'a AuthoredLocalSnapshot>,
     operator_source_secret_env: &'a [String],
@@ -2434,7 +2215,6 @@ fn product_environment_file<'a>(
     let expected_environment = match workload {
         DevWorkloadId::RelayPublic => "relay-public-environment",
         DevWorkloadId::RelayConsultation => "relay-consultation-environment",
-        DevWorkloadId::Notary => "notary-environment",
         DevWorkloadId::Postgresql | DevWorkloadId::SyntheticSource => {
             return Err(DevRuntimeError::image_lock());
         }
@@ -2461,9 +2241,6 @@ fn product_environment_file<'a>(
         (DevWorkloadId::RelayConsultation, Some("serve" | "verify_state")) => {
             Ok(&files.relay_consultation_serve)
         }
-        (DevWorkloadId::Notary, Some("prepare_state_store")) => Ok(&files.notary_prepare),
-        (DevWorkloadId::Notary, Some("initialize_state")) => Ok(&files.notary_initialize),
-        (DevWorkloadId::Notary, Some("serve" | "verify_state")) => Ok(&files.notary_serve),
         _ => Err(DevRuntimeError::image_lock()),
     }
 }
@@ -2474,8 +2251,6 @@ fn product_secret_path<'a>(
 ) -> DevRuntimeResult<&'a Path> {
     match file_id {
         "postgresql-tls-certificate" => Ok(&files.postgres_tls_certificate),
-        "notary-relay-workload-credential" => Ok(&files.workload_token),
-        "notary-signing-key" => Ok(&files.notary_signing_key),
         _ => Err(DevRuntimeError::image_lock()),
     }
 }
@@ -2491,7 +2266,6 @@ fn product_artifact_mount(
             let path = match workload {
                 DevWorkloadId::RelayPublic => &artifacts.relay_public_bundle,
                 DevWorkloadId::RelayConsultation => &artifacts.relay_consultation_bundle,
-                DevWorkloadId::Notary => &artifacts.notary_bundle,
                 DevWorkloadId::Postgresql | DevWorkloadId::SyntheticSource => {
                     return Err(DevRuntimeError::image_lock());
                 }
@@ -2502,7 +2276,6 @@ fn product_artifact_mount(
             let path = match workload {
                 DevWorkloadId::RelayPublic => &artifacts.relay_public_anchor,
                 DevWorkloadId::RelayConsultation => &artifacts.relay_consultation_anchor,
-                DevWorkloadId::Notary => &artifacts.notary_anchor,
                 DevWorkloadId::Postgresql | DevWorkloadId::SyntheticSource => {
                     return Err(DevRuntimeError::image_lock());
                 }
@@ -2888,7 +2661,6 @@ fn compose_service(
         }
         let container_port = match workload {
             DevWorkloadId::RelayPublic => 8080,
-            DevWorkloadId::Notary => 8081,
             DevWorkloadId::RelayConsultation
             | DevWorkloadId::Postgresql
             | DevWorkloadId::SyntheticSource => {
@@ -2936,7 +2708,6 @@ const fn private_ipv4_address(workload: DevWorkloadId) -> &'static str {
         DevWorkloadId::SyntheticSource => "10.89.0.3",
         DevWorkloadId::RelayConsultation => "10.89.0.4",
         DevWorkloadId::RelayPublic => "10.89.0.5",
-        DevWorkloadId::Notary => "10.89.0.6",
     }
 }
 
@@ -2998,15 +2769,6 @@ fn product_action(
     })
 }
 
-#[cfg(test)]
-#[cfg_attr(
-    test,
-    allow(dead_code, reason = "used by direct-module integration tests")
-)]
-fn notary_development_action(action: &str) -> DevRuntimeActionProjection {
-    test_development_action("registry-notary", "notary", action)
-}
-
 #[cfg(test)]
 #[cfg_attr(
     test,
@@ -3046,19 +2808,6 @@ fn test_development_action(binary: &str, lane: &str, action: &str) -> DevRuntime
             "/run/secrets/postgresql-ca.pem",
         ));
     }
-    if action == "serve" {
-        match lane {
-            "relay-public" | "relay-consultation" => {}
-            "notary" => secret_files.extend([
-                secret(
-                    "notary-relay-workload-credential",
-                    "/run/secrets/relay-workload-token",
-                ),
-                secret("notary-signing-key", "/run/secrets/notary-signing-key.jwk"),
-            ]),
-            _ => unreachable!(),
-        }
-    }
     DevRuntimeActionProjection {
         command,
         mounts,
@@ -3134,11 +2883,6 @@ fn validate_development_trust_material(
             &artifacts.relay_consultation_bundle,
             &artifacts.relay_consultation_anchor,
         ),
-        (
-            DevWorkloadId::Notary,
-            &artifacts.notary_bundle,
-            &artifacts.notary_anchor,
-        ),
     ];
     for (workload_id, bundle, anchor_path) in lanes {
         let expected = workloads
@@ -3200,11 +2944,9 @@ pub struct DevRuntimeStateV1 {
     pub compose_project: String,
     pub compose_file: PathBuf,
     pub compose_digest: String,
-    pub request_digest: String,
     pub generated_artifact_root: PathBuf,
     pub plan_file: PathBuf,
     pub source_mode: DevSourceMode,
-    pub request_config: PathBuf,
     pub workloads: Vec<DevWorkloadId>,
 }
 
@@ -3217,7 +2959,6 @@ impl DevRuntimeStateV1 {
             compose_project: plan.lifecycle.compose_project.clone(),
             compose_file: plan.lifecycle.compose_file.clone(),
             compose_digest: plan.compose_digest.clone(),
-            request_digest: plan.request_digest.clone(),
             generated_artifact_root: plan
                 .artifacts
                 .compose_file
@@ -3226,7 +2967,6 @@ impl DevRuntimeStateV1 {
                 .to_path_buf(),
             plan_file: plan.paths.plan_file.clone(),
             source_mode: plan.source_mode,
-            request_config: plan.paths.request_config.clone(),
             workloads: plan.lifecycle.status_services.clone(),
         }
     }
@@ -3237,10 +2977,8 @@ impl DevRuntimeStateV1 {
             || self.compose_project != plan.lifecycle.compose_project
             || self.compose_file != plan.lifecycle.compose_file
             || self.compose_digest != plan.compose_digest
-            || self.request_digest != plan.request_digest
             || self.plan_file != plan.paths.plan_file
             || self.source_mode != plan.source_mode
-            || self.request_config != plan.paths.request_config
             || self.workloads != plan.lifecycle.status_services
         {
             return Err(DevRuntimeError::project_binding());
@@ -3329,10 +3067,8 @@ pub struct DevStatusReport {
     pub workloads: Vec<DevWorkloadStatus>,
     pub source_mode: DevSourceMode,
     pub relay_api_url: String,
-    pub evidence_api_url: String,
     pub records_denied_command: Option<String>,
     pub records_request_command: Option<String>,
-    pub evidence_request_command: String,
 }
 
 #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)]
@@ -3387,10 +3123,17 @@ impl DevSmokeReportV1 {
         if self.schema_version != DEV_SMOKE_REPORT_SCHEMA_V1
             || self.project != plan.binding.project
             || self.environment != plan.binding.environment
-            || self.results.len() != 2
         {
             return Err(DevRuntimeError::smoke());
         }
+        if plan.records_request.is_none() {
+            return (self.results.is_empty() && self.passed)
+                .then_some(())
+                .ok_or_else(DevRuntimeError::smoke);
+        }
+        if self.results.len() != 2 {
+            return Err(DevRuntimeError::smoke());
+        }
         let denial = self.results.iter().find(|result| {
             result.scenario_id == plan.lifecycle.smoke_denial_scenario
                 && result.status == DevSmokeStatus::Denied
@@ -3405,28 +3148,13 @@ impl DevSmokeReportV1 {
         let Some(authorized) = authorized else {
             return Err(DevRuntimeError::smoke());
         };
-        let expected_token_delta = match plan.scenario.oauth_profile {
-            DevOAuthProfile::None => 0,
-            DevOAuthProfile::Oauth2Bearer | DevOAuthProfile::Oauth2BearerNoExpiry => 1,
-        };
-        let counters_match = match plan.source_mode {
-            DevSourceMode::Synthetic => {
-                denial.token_counter_delta == Some(0)
-                    && denial.source_counter_delta == Some(0)
-                    && authorized.token_counter_delta == Some(expected_token_delta)
-                    && authorized.source_counter_delta == Some(1)
-            }
-            DevSourceMode::OperatorBound | DevSourceMode::LocalSnapshot => {
-                denial.token_counter_delta.is_none()
-                    && denial.source_counter_delta.is_none()
-                    && authorized.token_counter_delta.is_none()
-                    && authorized.source_counter_delta.is_none()
-            }
-        };
-        if !counters_match || !denial.minimized_claim_ids.is_empty() || !denial.passed {
-            return Err(DevRuntimeError::smoke());
-        }
-        if authorized.minimized_claim_ids != plan.scenario.minimized_claim_ids
+        if denial.token_counter_delta.is_some()
+            || denial.source_counter_delta.is_some()
+            || authorized.token_counter_delta.is_some()
+            || authorized.source_counter_delta.is_some()
+            || !denial.minimized_claim_ids.is_empty()
+            || !authorized.minimized_claim_ids.is_empty()
+            || !denial.passed
             || !authorized.passed
             || !self.passed
         {
@@ -3440,11 +3168,9 @@ impl DevSmokeReportV1 {
 pub struct DevStartupReport {
     pub endpoints: Vec<SocketAddr>,
     pub relay_api_url: String,
-    pub evidence_api_url: String,
     pub source_mode: DevSourceMode,
     pub records_denied_command: Option<String>,
     pub records_request_command: Option<String>,
-    pub evidence_request_command: String,
     pub smoke_command: String,
     pub logs_command: String,
     pub down_command: String,
@@ -3595,53 +3321,37 @@ impl DockerComposeBackend {
             .filter(|workload| workload.acceptance_identity.is_some())
     }
 
-    fn synthetic_counters(state: &DevRuntimeStateV1) -> DevRuntimeResult<SyntheticSourceCounters> {
-        let output = Self::compose_success(
-            state,
-            [
-                "exec".to_string(),
-                "-T".to_string(),
-                DevWorkloadId::SyntheticSource.compose_service().to_string(),
-                "registry-relay".to_string(),
-                "synthetic-source".to_string(),
-                "probe".to_string(),
-                "--plan".to_string(),
-                SYNTHETIC_SOURCE_PLAN_CONTAINER_PATH.to_string(),
-            ],
-        )?;
-        parse_json_strict(&output.stdout).map_err(|_| DevRuntimeError::backend_contract())
-    }
-
-    fn evaluate(
+    fn request_records(
         plan: &DevRuntimePlan,
         authorized: bool,
     ) -> DevRuntimeResult<(DevSmokeStatus, Vec<String>)> {
-        let endpoint = plan.caller_endpoint()?;
-        let url = format!("http://{endpoint}/v1/evaluations");
+        let records = plan
+            .records_request
+            .as_ref()
+            .ok_or_else(DevRuntimeError::smoke)?;
+        let endpoint = plan.relay_public_endpoint()?;
+        let url = format!(
+            "http://{endpoint}/v1/datasets/{}/entities/{}/records/{}",
+            encode_path_segment(&records.dataset_id),
+            encode_path_segment(&records.entity_id),
+            encode_path_segment(&records.record_id),
+        );
         let agent = ureq::AgentBuilder::new().build();
-        let mut request = agent.post(&url).set("Content-Type", "application/json");
+        let mut request = agent.get(&url).set("Data-Purpose", &records.purpose);
         if authorized {
-            let token = read_owner_only_regular_file(
-                &plan.paths.credentials.join(CALLER_TOKEN_FILE),
-                16 * 1024,
-            )
-            .map_err(|_| DevRuntimeError::smoke())?;
+            let token_path = plan
+                .prepared_credential_files()?
+                .relay_match_token
+                .as_ref()
+                .ok_or_else(DevRuntimeError::smoke)?;
+            let token = read_owner_only_regular_file(token_path, 16 * 1024)
+                .map_err(|_| DevRuntimeError::smoke())?;
             let token = std::str::from_utf8(&token).map_err(|_| DevRuntimeError::smoke())?;
             request = request.set("Authorization", &format!("Bearer {token}"));
         }
-        match request.send_bytes(&plan.request_json) {
+        match request.call() {
             Ok(response) if authorized && (200..300).contains(&response.status()) => {
-                let mut body = Vec::new();
-                response
-                    .into_reader()
-                    .take((MAX_REQUEST_BODY_BYTES + 1) as u64)
-                    .read_to_end(&mut body)
-                    .map_err(|_| DevRuntimeError::smoke())?;
-                if body.len() > MAX_REQUEST_BODY_BYTES {
-                    return Err(DevRuntimeError::smoke());
-                }
-                let claim_ids = validate_authorized_evaluation_response(plan, &body)?;
-                Ok((DevSmokeStatus::Authorized, claim_ids))
+                Ok((DevSmokeStatus::Authorized, Vec::new()))
             }
             Err(ureq::Error::Status(status, _)) if !authorized && matches!(status, 401 | 403) => {
                 Ok((DevSmokeStatus::Denied, Vec::new()))
@@ -3651,64 +3361,6 @@ impl DockerComposeBackend {
     }
 }
 
-#[derive(Deserialize)]
-#[serde(deny_unknown_fields)]
-struct DevEvaluationResponse {
-    results: Vec<registry_notary_core::ClaimResultView>,
-}
-
-pub(crate) fn validate_authorized_evaluation_response(
-    plan: &DevRuntimePlan,
-    body: &[u8],
-) -> DevRuntimeResult<Vec<String>> {
-    let response: DevEvaluationResponse =
-        parse_json_strict(body).map_err(|_| DevRuntimeError::smoke())?;
-    // The typed response intentionally represents JSON null as None, but the
-    // wire contract requires these fields to be present even when they are null.
-    let wire: serde_json::Value = parse_json_strict(body).map_err(|_| DevRuntimeError::smoke())?;
-    let wire_results = wire
-        .get("results")
-        .and_then(serde_json::Value::as_array)
-        .ok_or_else(DevRuntimeError::smoke)?;
-    if wire_results.len() != response.results.len()
-        || wire_results.iter().any(|result| {
-            result.as_object().is_none_or(|object| {
-                !object.contains_key("value")
-                    || !object.contains_key("satisfied")
-                    || !object.contains_key("disclosure")
-            })
-        })
-    {
-        return Err(DevRuntimeError::smoke());
-    }
-    let mut claim_ids = response
-        .results
-        .iter()
-        .map(|result| result.claim_id.clone())
-        .collect::<Vec<_>>();
-    claim_ids.sort();
-    if claim_ids != plan.scenario.minimized_claim_ids {
-        return Err(DevRuntimeError::smoke());
-    }
-    let observed_commitment = dev_claim_results_commitment(
-        response
-            .results
-            .into_iter()
-            .map(|result| DevClaimResultExpectation {
-                claim_id: result.claim_id,
-                value: result.value.unwrap_or(serde_json::Value::Null),
-                satisfied: result.satisfied,
-                disclosure: result.disclosure,
-            })
-            .collect(),
-    )
-    .map_err(|_| DevRuntimeError::smoke())?;
-    if observed_commitment != plan.scenario.expected_claim_results_sha256 {
-        return Err(DevRuntimeError::smoke());
-    }
-    Ok(claim_ids)
-}
-
 pub(crate) fn supporting_up_operation(services: Vec<String>) -> Vec<String> {
     let mut operation = vec![
         "up".to_string(),
@@ -3721,13 +3373,6 @@ pub(crate) fn supporting_up_operation(services: Vec<String>) -> Vec<String> {
     operation
 }
 
-#[derive(Clone, Copy, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct SyntheticSourceCounters {
-    token_requests: u64,
-    source_requests: u64,
-}
-
 #[derive(Deserialize)]
 struct ComposePsEntry {
     #[serde(rename = "Service")]
@@ -3998,77 +3643,37 @@ impl DevRuntimeBackend for DockerComposeBackend {
     fn smoke(
         &mut self,
         plan: &DevRuntimePlan,
-        state: &DevRuntimeStateV1,
+        _state: &DevRuntimeStateV1,
     ) -> DevRuntimeResult<DevSmokeReportV1> {
-        if plan.source_mode != DevSourceMode::Synthetic {
-            let (denial_status, denial_claims) = Self::evaluate(plan, false)?;
-            let (authorized_status, authorized_claims) = Self::evaluate(plan, true)?;
-            return Ok(DevSmokeReportV1 {
-                schema_version: DEV_SMOKE_REPORT_SCHEMA_V1.to_string(),
-                project: plan.binding.project.clone(),
-                environment: plan.binding.environment.clone(),
-                results: vec![
-                    DevSmokeScenarioResult {
-                        scenario_id: plan.lifecycle.smoke_denial_scenario.clone(),
-                        status: denial_status,
-                        token_counter_delta: None,
-                        source_counter_delta: None,
-                        minimized_claim_ids: denial_claims,
-                        passed: true,
-                    },
-                    DevSmokeScenarioResult {
-                        scenario_id: plan.lifecycle.smoke_authorized_scenario.clone(),
-                        status: authorized_status,
-                        token_counter_delta: None,
-                        source_counter_delta: None,
-                        minimized_claim_ids: authorized_claims,
-                        passed: true,
-                    },
-                ],
-                passed: true,
-            });
-        }
-        let before = Self::synthetic_counters(state)?;
-        let (denial_status, denial_claims) = Self::evaluate(plan, false)?;
-        let after_denial = Self::synthetic_counters(state)?;
-        let (authorized_status, authorized_claims) = Self::evaluate(plan, true)?;
-        let after_authorized = Self::synthetic_counters(state)?;
-        let delta =
-            |after: u64, before: u64| after.checked_sub(before).ok_or_else(DevRuntimeError::smoke);
-        Ok(DevSmokeReportV1 {
-            schema_version: DEV_SMOKE_REPORT_SCHEMA_V1.to_string(),
-            project: plan.binding.project.clone(),
-            environment: plan.binding.environment.clone(),
-            results: vec![
+        let results = if plan.records_request.is_some() {
+            let (denial_status, denial_claims) = Self::request_records(plan, false)?;
+            let (authorized_status, authorized_claims) = Self::request_records(plan, true)?;
+            vec![
                 DevSmokeScenarioResult {
                     scenario_id: plan.lifecycle.smoke_denial_scenario.clone(),
                     status: denial_status,
-                    token_counter_delta: Some(delta(
-                        after_denial.token_requests,
-                        before.token_requests,
-                    )?),
-                    source_counter_delta: Some(delta(
-                        after_denial.source_requests,
-                        before.source_requests,
-                    )?),
+                    token_counter_delta: None,
+                    source_counter_delta: None,
                     minimized_claim_ids: denial_claims,
                     passed: true,
                 },
                 DevSmokeScenarioResult {
                     scenario_id: plan.lifecycle.smoke_authorized_scenario.clone(),
                     status: authorized_status,
-                    token_counter_delta: Some(delta(
-                        after_authorized.token_requests,
-                        after_denial.token_requests,
-                    )?),
-                    source_counter_delta: Some(delta(
-                        after_authorized.source_requests,
-                        after_denial.source_requests,
-                    )?),
+                    token_counter_delta: None,
+                    source_counter_delta: None,
                     minimized_claim_ids: authorized_claims,
                     passed: true,
                 },
-            ],
+            ]
+        } else {
+            Vec::new()
+        };
+        Ok(DevSmokeReportV1 {
+            schema_version: DEV_SMOKE_REPORT_SCHEMA_V1.to_string(),
+            project: plan.binding.project.clone(),
+            environment: plan.binding.environment.clone(),
+            results,
             passed: true,
         })
     }
@@ -4222,10 +3827,8 @@ impl<B: DevRuntimeBackend> DevRuntimeController<B> {
             workloads,
             source_mode: plan.source_mode,
             relay_api_url: format!("http://{}", plan.relay_public_endpoint()?),
-            evidence_api_url: format!("http://{}", plan.caller_endpoint()?),
             records_denied_command: plan.records_denied_command(),
             records_request_command: plan.records_request_command(),
-            evidence_request_command: plan.evidence_request_command(),
         })
     }
 
@@ -4262,7 +3865,6 @@ fn same_runtime_semantics(existing: &DevRuntimePlan, candidate: &DevRuntimePlan)
         && existing.local_snapshot_digest == candidate.local_snapshot_digest
         && existing.release_tag == candidate.release_tag
         && existing.minimum_compose_version == candidate.minimum_compose_version
-        && existing.request_digest == candidate.request_digest
         && existing.source_mode == candidate.source_mode
         && existing.scenario == candidate.scenario
         && existing
@@ -4411,26 +4013,6 @@ fn materialize_runtime(plan: &DevRuntimePlan) -> DevRuntimeResult<DevRuntimeStat
             source_plan_bytes.push(b'\n');
             write_owner_only(&plan.paths.synthetic_source_plan, &source_plan_bytes)?;
         }
-        write_owner_only(&plan.paths.request_body, &plan.request_json)?;
-        let caller_token = read_owner_only_regular_file(
-            &plan.prepared_credential_files()?.caller_token,
-            16 * 1024,
-        )
-        .map_err(|_| DevRuntimeError::io())?;
-        let caller_token = std::str::from_utf8(&caller_token).map_err(|_| DevRuntimeError::io())?;
-        if caller_token.is_empty()
-            || caller_token
-                .bytes()
-                .any(|byte| byte.is_ascii_control() || byte.is_ascii_whitespace())
-        {
-            return Err(DevRuntimeError::invalid_credentials());
-        }
-        let endpoint = plan.caller_endpoint()?;
-        let request_config = format!(
-            "url = \"http://{endpoint}/v1/evaluations\"\nrequest = \"POST\"\nheader = \"Authorization: Bearer {caller_token}\"\nheader = \"Content-Type: application/json\"\ndata-binary = \"@{}\"\nsilent\nshow-error\nfail\n",
-            curl_config_path(&plan.paths.request_body)?,
-        );
-        write_owner_only(&plan.paths.request_config, request_config.as_bytes())?;
         match (
             plan.records_request.as_ref(),
             &plan.prepared_credential_files()?.relay_match_token,
@@ -4724,15 +4306,9 @@ fn startup_report(plan: &DevRuntimePlan) -> DevStartupReport {
             plan.relay_public_endpoint()
                 .expect("validated development plan has a public Relay endpoint")
         ),
-        evidence_api_url: format!(
-            "http://{}",
-            plan.caller_endpoint()
-                .expect("validated development plan has a public Notary endpoint")
-        ),
         source_mode: plan.source_mode,
         records_denied_command: plan.records_denied_command(),
         records_request_command: plan.records_request_command(),
-        evidence_request_command: plan.evidence_request_command(),
         smoke_command: plan.smoke_command(),
         logs_command: plan.logs_command(),
         down_command: plan.down_command(),
@@ -4887,8 +4463,6 @@ fn validate_artifact_inputs(
         &artifacts.relay_public_anchor,
         &artifacts.relay_consultation_bundle,
         &artifacts.relay_consultation_anchor,
-        &artifacts.notary_bundle,
-        &artifacts.notary_anchor,
     ] {
         let canonical = fs::canonicalize(path).map_err(|_| {
             DevRuntimeError::new(
@@ -4945,7 +4519,6 @@ struct DevPlanDigestInput<'a> {
     lifecycle: &'a DevLifecycleBindings,
     artifacts: &'a DevRuntimeArtifactInputs,
     compose_digest: &'a str,
-    request_digest: &'a str,
     records_request_digest: Option<&'a str>,
     local_snapshot_digest: Option<&'a str>,
     synthetic_source_plan: Option<&'a SyntheticSourcePlanV1>,
@@ -4963,7 +4536,6 @@ fn plan_digest(input: DevPlanDigestInput<'_>) -> DevRuntimeResult<String> {
         lifecycle: &'a DevLifecycleBindings,
         artifacts: &'a DevRuntimeArtifactInputs,
         compose_digest: &'a str,
-        request_digest: &'a str,
         records_request_digest: Option<&'a str>,
         local_snapshot_digest: Option<&'a str>,
         synthetic_source_plan_digest: Option<String>,
@@ -4986,7 +4558,6 @@ fn plan_digest(input: DevPlanDigestInput<'_>) -> DevRuntimeResult<String> {
         lifecycle: input.lifecycle,
         artifacts: input.artifacts,
         compose_digest: input.compose_digest,
-        request_digest: input.request_digest,
         records_request_digest: input.records_request_digest,
         local_snapshot_digest: input.local_snapshot_digest,
         synthetic_source_plan_digest,
@@ -5214,24 +4785,6 @@ fn write_owner_only(path: &Path, bytes: &[u8]) -> DevRuntimeResult<()> {
     Ok(())
 }
 
-fn curl_config_path(path: &Path) -> DevRuntimeResult<String> {
-    let text = path.to_str().ok_or_else(|| {
-        DevRuntimeError::new(
-            DevFailureCategory::InvalidPlan,
-            "development request path is not UTF-8",
-            "move the project to a UTF-8 path and retry",
-        )
-    })?;
-    if text.contains(['\n', '\r', '"', '\\']) {
-        return Err(DevRuntimeError::new(
-            DevFailureCategory::InvalidPlan,
-            "development request path cannot be represented safely",
-            "move the project to a path without quotes or control characters",
-        ));
-    }
-    Ok(text.to_string())
-}
-
 fn validate_curl_literal(value: &str) -> DevRuntimeResult<()> {
     if value.is_empty()
         || value
diff --git a/crates/registryctl/src/lib.rs b/crates/registryctl/src/lib.rs
index 8f891e8a3..2d8d62ce2 100644
--- a/crates/registryctl/src/lib.rs
+++ b/crates/registryctl/src/lib.rs
@@ -38,8 +38,8 @@ pub use approved_set::{
     assemble_approved_set, load_approved_baseline_set, ApprovedAnchorTransitionLinkV1,
     ApprovedBaselineLanesV1, ApprovedBaselineSetV1, ApprovedLaneEntryV1, ApprovedLaneLocatorsV1,
     ApprovedLaneV1, ApprovedSetAssembleOptions, ApprovedSetAssemblyReportV1,
-    CrossLaneInterfaceDigestsV1, PortableArtifactLocator, ReviewedBuildUpdateV1,
-    ReviewedLaneBindingV1, APPROVED_BASELINE_SET_SCHEMA_ID, APPROVED_BASELINE_SET_SCHEMA_VERSION,
+    PortableArtifactLocator, ReviewedBuildUpdateV1, ReviewedLaneBindingV1,
+    APPROVED_BASELINE_SET_SCHEMA_ID, APPROVED_BASELINE_SET_SCHEMA_VERSION,
 };
 
 mod deployment;
@@ -114,21 +114,20 @@ pub use project_authoring::{
     FixtureCoverageRequirementState, FixtureCoverageReviewedNotApplicable,
     FixtureCoverageSemanticComparison, FixtureCoverageSummary, FixtureCoverageTarget,
     FixtureCoverageTargetComparisonInput, FixtureCoverageTargetContract,
-    FixtureCoverageTargetIdentity, FixtureCoverageTargetSetState, FixtureDisclosureMode,
-    FixtureEvidenceScope, FixtureLimit, FixtureMutationTargetClass, FixturePassState,
-    FixtureProtocolHelper, FixtureRequestBindingCoverage, FixtureRequestBindingState,
+    FixtureCoverageTargetIdentity, FixtureCoverageTargetSetState, FixtureEvidenceScope,
+    FixtureLimit, FixtureMutationTargetClass, FixturePassState, FixtureProtocolHelper,
     FixtureRequirementCoverage, FixtureSafeCode, FixtureSemanticExpectation,
     FixtureSemanticOutcome, FixtureSetState, FixtureStatusMapping, FixtureStatusOutcome,
     GeneratedFixtureCoverage, GeneratedNotApplicableReason, GeneratedRecipeApplicability,
     GeneratedSourceFixture, GeneratorRecipe, GeneratorRecipeId, GeneratorRecipeVersion,
-    GovernedRequestEvidence, HumanIntentSource, InactiveOrUnusedDeclaration,
-    InactiveOrUnusedReason, InstalledCapabilityEvidence, InstalledCapabilityState,
-    LiveCompatibilityEvaluation, MissingSupport, NullBehavior, PlatformCoverageComponent,
-    PlatformGeneratedCaseId, PlatformGeneratedFixtureCoverage, PreflightAttemptState,
-    PreflightCheckState, PreflightContact, PreflightDiagnostic, PreflightDiagnosticCode,
-    PreflightDiagnosticMessage, PreflightExecutionBoundary, PreflightFieldAddress,
-    PreflightGenerationState, PreflightJsonPointer, PreflightMode, PreflightPermissionInvariant,
-    PreflightPhase, PreflightProduct, PreflightProductCapability, PreflightProductValidatorCheck,
+    HumanIntentSource, InactiveOrUnusedDeclaration, InactiveOrUnusedReason,
+    InstalledCapabilityEvidence, InstalledCapabilityState, LiveCompatibilityEvaluation,
+    MissingSupport, NullBehavior, PlatformCoverageComponent, PlatformGeneratedCaseId,
+    PlatformGeneratedFixtureCoverage, PreflightAttemptState, PreflightCheckState, PreflightContact,
+    PreflightDiagnostic, PreflightDiagnosticCode, PreflightDiagnosticMessage,
+    PreflightExecutionBoundary, PreflightFieldAddress, PreflightGenerationState,
+    PreflightJsonPointer, PreflightMode, PreflightPermissionInvariant, PreflightPhase,
+    PreflightProduct, PreflightProductCapability, PreflightProductValidatorCheck,
     PreflightProjectRelativeFile, PreflightRemediation, PreflightReportLimits, PreflightRuleId,
     PreflightRuntimeBoundary, PreflightRuntimeFileCheck, PreflightRuntimeFileKind,
     PreflightRuntimeScope, PreflightSecretCheck, PreflightSecretConsumer, PreflightSeverity,
@@ -148,15 +147,15 @@ pub use project_authoring::{
     RequiredFixtureCoverageRequirement, RequiredProductAction, Requiredness, ReviewCompareOptions,
     ReviewComparisonReportV1, ReviewedBuildRecordV1, ReviewedProjectBuildOptions,
     ReviewedProjectBuildReportV1, RuntimeActivationEvaluation, SchemaConstraint, SemanticChange,
-    Sha256Digest, SourceAccessAssertion, SourceCallExpectation, StructuralIntent,
-    SupportAssessment, SupportComponent, SupportEvidence, SupportKind, SupportState,
-    SupportedCapabilityVersion, ValidationStage, VersionChange, VersionHistoryEntry,
-    CONFIGURATION_REFERENCE_COVERAGE_SCHEMA_ID, CONFIGURATION_REFERENCE_FORMAT_VERSION,
-    CONFIGURATION_REFERENCE_SCHEMA_ID, PROJECT_ARTIFACT_MANIFEST_FORMAT_VERSION_V1,
-    PROJECT_ARTIFACT_MANIFEST_SCHEMA_VERSION_V1, PROJECT_CAPABILITY_INVENTORY_SCHEMA_VERSION_V1,
-    PROJECT_COMMAND_REPORT_SCHEMA_VERSION_V1, PROJECT_EXPLANATION_SCHEMA_VERSION_V1,
-    PROJECT_FIXTURE_COVERAGE_SCHEMA_VERSION_V1, PROJECT_PREFLIGHT_SCHEMA_VERSION_V1,
-    PROJECT_SEMANTIC_IMPACT_SCHEMA_VERSION_V1, REVIEWED_BUILD_RECORD_FILE,
+    Sha256Digest, StructuralIntent, SupportAssessment, SupportComponent, SupportEvidence,
+    SupportKind, SupportState, SupportedCapabilityVersion, ValidationStage, VersionChange,
+    VersionHistoryEntry, CONFIGURATION_REFERENCE_COVERAGE_SCHEMA_ID,
+    CONFIGURATION_REFERENCE_FORMAT_VERSION, CONFIGURATION_REFERENCE_SCHEMA_ID,
+    PROJECT_ARTIFACT_MANIFEST_FORMAT_VERSION_V1, PROJECT_ARTIFACT_MANIFEST_SCHEMA_VERSION_V1,
+    PROJECT_CAPABILITY_INVENTORY_SCHEMA_VERSION_V1, PROJECT_COMMAND_REPORT_SCHEMA_VERSION_V1,
+    PROJECT_EXPLANATION_SCHEMA_VERSION_V1, PROJECT_FIXTURE_COVERAGE_SCHEMA_VERSION_V1,
+    PROJECT_PREFLIGHT_SCHEMA_VERSION_V1, PROJECT_SEMANTIC_IMPACT_SCHEMA_VERSION_V1,
+    REVIEWED_BUILD_RECORD_FILE,
 };
 pub use project_authoring::{build_reviewed_project, compare_reviewed_project};
 
@@ -278,6 +277,7 @@ pub fn inspect_config_bundle(artifact_root: &Path) -> Result<BundleInspectReport
     manifest
         .validate()
         .with_context(|| format!("invalid config bundle manifest {}", manifest_path.display()))?;
+    validate_relay_acceptance_identity(&manifest.acceptance_identity)?;
 
     let envelope = read_signature_envelope_if_present(&signature_path)?;
     let signature_kids: Vec<String> = envelope
@@ -309,6 +309,7 @@ pub fn verify_config_bundle_cli(
             artifact_root.display()
         )
     })?;
+    validate_relay_acceptance_identity(&verified.manifest.acceptance_identity)?;
     let config_path = verified
         .config_path
         .strip_prefix(&bundle_dir)
@@ -623,7 +624,6 @@ fn bundle_relative_path(root: &Path, path: &Path) -> Result<String> {
 
 fn primary_config_path(product: &str, files: &[BundleInputFile]) -> Result<String> {
     let expected = match product {
-        "registry-notary" => Some("config/notary.yaml"),
         "registry-relay" => Some("config/relay.yaml"),
         _ => None,
     };
@@ -864,10 +864,6 @@ fn legacy_product_acceptance_identity(
             };
             (ProductAcceptanceProductV1::RegistryRelay, lane)
         }
-        "registry-notary" => (
-            ProductAcceptanceProductV1::RegistryNotary,
-            ProductAcceptanceLaneV1::Notary,
-        ),
         _ => bail!("unsupported config bundle product"),
     };
     let identity = ProductAcceptanceIdentityV1 {
@@ -888,10 +884,22 @@ fn legacy_product_acceptance_identity(
 fn product_acceptance_product_name(product: ProductAcceptanceProductV1) -> &'static str {
     match product {
         ProductAcceptanceProductV1::RegistryRelay => "registry-relay",
-        ProductAcceptanceProductV1::RegistryNotary => "registry-notary",
+        _ => "unsupported",
     }
 }
 
+fn validate_relay_acceptance_identity(identity: &ProductAcceptanceIdentityV1) -> Result<()> {
+    if identity.product != ProductAcceptanceProductV1::RegistryRelay
+        || !matches!(
+            identity.lane,
+            ProductAcceptanceLaneV1::RelayPublic | ProductAcceptanceLaneV1::RelayConsultation
+        )
+    {
+        bail!("registryctl trust supports only Registry Relay acceptance lanes");
+    }
+    Ok(())
+}
+
 fn signing_algorithm_label(algorithm: SigningAlgorithm) -> &'static str {
     match algorithm {
         SigningAlgorithm::EdDsa => "EdDSA",
diff --git a/crates/registryctl/src/main.rs b/crates/registryctl/src/main.rs
index 2370aeac4..19c21f154 100644
--- a/crates/registryctl/src/main.rs
+++ b/crates/registryctl/src/main.rs
@@ -26,11 +26,6 @@ fn main() -> ExitCode {
     if registry_relay::rhai_worker::is_worker_invocation(std::env::args_os()) {
         return registry_relay::rhai_worker::run_worker_stdio();
     }
-    if is_exact_internal_mode("__registryctl-cel-worker-v1") {
-        registry_notary_server::cel_worker::run_stdio_worker();
-        return ExitCode::SUCCESS;
-    }
-
     let cli = match Cli::try_parse() {
         Ok(cli) => cli,
         Err(error) => {
@@ -264,7 +259,7 @@ enum DeployCommand {
         after_help = "Governed handoff:\n  Input owner: approved-set owner and installed Registry Stack release\n  Output owner: deployment operator\n  Mutation: creates or safely regenerates only the selected managed package directory; does not activate it\n  Next command: registryctl deploy verify --package <directory>"
     )]
     Generate {
-        /// Verified three-lane approved baseline set.
+        /// Verified two-lane Relay approved baseline set.
         #[arg(long)]
         approved_set: PathBuf,
         /// Absent, empty, or verified managed package directory.
@@ -334,7 +329,7 @@ enum TrustCommand {
         #[command(subcommand)]
         command: TrustBundleCommand,
     },
-    /// Assemble the exact three independently verified product lanes.
+    /// Assemble the exact two independently verified Relay lanes.
     ApprovedSet {
         #[command(subcommand)]
         command: ApprovedSetCommand,
@@ -470,9 +465,6 @@ enum ApprovedSetCommand {
         /// Verified relay-consultation signed artifact directory.
         #[arg(long, value_name = "SIGNED_ARTIFACT_DIRECTORY")]
         relay_consultation: Option<PathBuf>,
-        /// Verified notary signed artifact directory.
-        #[arg(long, value_name = "SIGNED_ARTIFACT_DIRECTORY")]
-        notary: Option<PathBuf>,
         /// New immutable approved baseline set file.
         #[arg(long, value_name = "FILE")]
         output_file: PathBuf,
@@ -563,7 +555,6 @@ enum XwFormat {
 enum Lane {
     RelayPublic,
     RelayConsultation,
-    Notary,
 }
 
 impl From<Lane> for registry_platform_config::ProductAcceptanceLaneV1 {
@@ -571,7 +562,6 @@ impl From<Lane> for registry_platform_config::ProductAcceptanceLaneV1 {
         match value {
             Lane::RelayPublic => Self::RelayPublic,
             Lane::RelayConsultation => Self::RelayConsultation,
-            Lane::Notary => Self::Notary,
         }
     }
 }
@@ -581,7 +571,6 @@ impl From<Lane> for ApprovedLaneV1 {
         match value {
             Lane::RelayPublic => Self::RelayPublic,
             Lane::RelayConsultation => Self::RelayConsultation,
-            Lane::Notary => Self::Notary,
         }
     }
 }
@@ -893,10 +882,6 @@ fn run_dev(
                 environment
             );
             println!("{}", dev_api_line("Relay API", &report.relay_api_url)?);
-            println!(
-                "{}",
-                dev_api_line("Evidence API", &report.evidence_api_url)?
-            );
             println!("Source mode: {}", json_enum(&report.source_mode)?);
             if let Some(command) = &report.records_denied_command {
                 println!("Records denied request: {command}");
@@ -904,7 +889,6 @@ fn run_dev(
             if let Some(command) = &report.records_request_command {
                 println!("Records request: {command}");
             }
-            println!("Evidence request: {}", report.evidence_request_command);
             println!("Smoke: {}", report.smoke_command);
             println!("Logs: {}", report.logs_command);
             println!("Down: {}", report.down_command);
@@ -930,17 +914,12 @@ fn run_dev(
                         );
                     }
                     println!("{}", dev_api_line("Relay API", &report.relay_api_url)?);
-                    println!(
-                        "{}",
-                        dev_api_line("Evidence API", &report.evidence_api_url)?
-                    );
                     if let Some(command) = &report.records_denied_command {
                         println!("Records denied request: {command}");
                     }
                     if let Some(command) = &report.records_request_command {
                         println!("Records request: {command}");
                     }
-                    println!("Evidence request: {}", report.evidence_request_command);
                 }
             }
         }
@@ -1228,18 +1207,14 @@ fn run_doctor(
     if let Some(lock) = release_lock.as_ref() {
         let images = lock.managed_images();
         let available = daemon_available
-            && [
-                images.relay(),
-                images.notary(),
-                images.postgresql_state_plane(),
-            ]
-            .into_iter()
-            .all(|image| {
-                Command::new("docker")
-                    .args(["image", "inspect", "--format", "{{.Id}}", image])
-                    .output()
-                    .is_ok_and(|output| output.status.success())
-            });
+            && [images.relay(), images.postgresql_state_plane()]
+                .into_iter()
+                .all(|image| {
+                    Command::new("docker")
+                        .args(["image", "inspect", "--format", "{{.Id}}", image])
+                        .output()
+                        .is_ok_and(|output| output.status.success())
+                });
         checks.push(if available {
             DoctorCheckV1::ready("locked_images")
         } else {
@@ -1656,7 +1631,6 @@ fn run_trust(project_dir: Option<&Path>, command: TrustCommand) -> CliResult {
                 preceding_set,
                 relay_public,
                 relay_consultation,
-                notary,
                 output_file,
                 format,
             } => {
@@ -1668,7 +1642,6 @@ fn run_trust(project_dir: Option<&Path>, command: TrustCommand) -> CliResult {
                     preceding_set,
                     relay_public,
                     relay_consultation,
-                    notary,
                     output_file,
                 })
                 .map_err(CliFailure::domain)?;
@@ -2028,7 +2001,6 @@ fn render_project_test_report(report: &registryctl::ProjectCommandReport, trace:
                 ("inputs", &fixture.inputs),
                 ("calls", &fixture.calls),
                 ("outputs", &fixture.outputs),
-                ("claims", &fixture.claims),
             ] {
                 if !values.is_empty() {
                     write!(output, "\n    {label}: {}", human_list(values))
@@ -2267,7 +2239,7 @@ fn render_acceptance_lane(lane: registry_platform_config::ProductAcceptanceLaneV
         registry_platform_config::ProductAcceptanceLaneV1::RelayConsultation => {
             "relay-consultation"
         }
-        registry_platform_config::ProductAcceptanceLaneV1::Notary => "notary",
+        _ => "unsupported",
     }
 }
 
@@ -2276,16 +2248,10 @@ fn render_acceptance_product(
 ) -> &'static str {
     match product {
         registry_platform_config::ProductAcceptanceProductV1::RegistryRelay => "registry-relay",
-        registry_platform_config::ProductAcceptanceProductV1::RegistryNotary => "registry-notary",
+        _ => "unsupported",
     }
 }
 
-fn is_exact_internal_mode(expected: &str) -> bool {
-    let mut args = std::env::args_os();
-    let _program = args.next();
-    args.next().as_deref() == Some(OsStr::new(expected)) && args.next().is_none()
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/registryctl/src/project_authoring.rs b/crates/registryctl/src/project_authoring.rs
index e8cd7c3a4..e5c2e4b38 100644
--- a/crates/registryctl/src/project_authoring.rs
+++ b/crates/registryctl/src/project_authoring.rs
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
-//! Deterministic Registry Stack project authoring for Relay and Notary.
+//! Deterministic Registry Stack project authoring for Relay.
 
 use std::collections::{BTreeMap, BTreeSet};
 use std::ffi::OsStr;
@@ -10,7 +10,6 @@ use std::path::{Component, Path, PathBuf};
 use anyhow::{anyhow, bail, Context, Result};
 use cel::common::ast::{EntryExpr, Expr, IdedExpr};
 use clap::ValueEnum;
-use registry_notary_core::{config::StatePostgresqlConfig, StandaloneRegistryNotaryConfig};
 use registry_platform_crypto::{canonicalize_json, parse_json_strict};
 use registry_relay::source_plan::{
     authoring::{
@@ -51,7 +50,12 @@ const MAX_FIXTURES: usize = 128;
 const MAX_ENVIRONMENTS: usize = 64;
 const MAX_OPERATIONS: usize = 16;
 const MAX_OUTPUTS: usize = 64;
-const MAX_CLAIMS: usize = 64;
+const MAX_RELAY_OUTPUT_SCHEMA_DEPTH_V1: usize = 8;
+const MAX_RELAY_OUTPUT_SCHEMA_NODES_V1: usize = 256;
+const MAX_RELAY_OUTPUT_EXPANDED_NODES_V1: usize = 4_096;
+const MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1: usize = 32;
+const MAX_RELAY_OUTPUT_ARRAY_ITEMS_V1: u16 = 256;
+const MAX_RELAY_OUTPUT_VALUE_BYTES_V1: u32 = 64 * 1024;
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum ReleasedScriptRuntime {
     RhaiV1,
@@ -95,7 +99,7 @@ include!("project_authoring/compiler/semantic_impact.rs");
 include!("project_authoring/compiler/explanation.rs");
 include!("project_authoring/compiler/artifacts.rs");
 include!("project_authoring/compiler/relay.rs");
-include!("project_authoring/compiler/notary.rs");
+include!("project_authoring/compiler/claim_semantics.rs");
 include!("project_authoring/project.rs");
 include!("project_authoring/fixtures.rs");
 include!("project_authoring/output.rs");
diff --git a/crates/registryctl/src/project_authoring/artifact_manifest.rs b/crates/registryctl/src/project_authoring/artifact_manifest.rs
index 6324adf29..506cfc41c 100644
--- a/crates/registryctl/src/project_authoring/artifact_manifest.rs
+++ b/crates/registryctl/src/project_authoring/artifact_manifest.rs
@@ -249,7 +249,6 @@ fn classify_generated_artifact(relative: &Path) -> Result<GeneratedArtifactClass
             REVIEW_ARTIFACT_ACTIONS,
             &[
                 ArtifactConsumer::RegistryRelay,
-                ArtifactConsumer::RegistryNotary,
                 ArtifactConsumer::Operator,
                 ArtifactConsumer::ProjectDocumentation,
             ],
@@ -275,8 +274,7 @@ fn classify_generated_artifact(relative: &Path) -> Result<GeneratedArtifactClass
     } else if single_json_child(
         &path,
         "private/relay-consultation/config/artifacts/integration-packs/",
-    )
-    {
+    ) {
         artifact_classification(
             "registry.relay.integration-pack.v1",
             &[ArtifactClass::SourcePlan, ArtifactClass::DeploymentInput],
@@ -315,8 +313,7 @@ fn classify_generated_artifact(relative: &Path) -> Result<GeneratedArtifactClass
     } else if single_json_child(
         &path,
         "private/relay-consultation/config/artifacts/private-bindings/",
-    )
-    {
+    ) {
         artifact_classification(
             "registry.relay.consultation-binding.v1",
             &[ArtifactClass::SourcePlan, ArtifactClass::DeploymentInput],
@@ -334,8 +331,7 @@ fn classify_generated_artifact(relative: &Path) -> Result<GeneratedArtifactClass
     } else if two_level_json_child(
         &path,
         "private/relay-consultation/config/artifacts/evidence/",
-    )
-    {
+    ) {
         artifact_classification(
             "registry.project.integration-evidence.v1",
             &[ArtifactClass::SourcePlan, ArtifactClass::DeploymentInput],
@@ -354,8 +350,7 @@ fn classify_generated_artifact(relative: &Path) -> Result<GeneratedArtifactClass
         &path,
         "private/relay-consultation/config/artifacts/rhai/",
         ".rhai",
-    )
-    {
+    ) {
         artifact_classification(
             "registry.relay.rhai-source.v1",
             &[ArtifactClass::SourcePlan, ArtifactClass::DeploymentInput],
@@ -379,13 +374,6 @@ fn classify_generated_artifact(relative: &Path) -> Result<GeneratedArtifactClass
             ArtifactConsumer::DeploymentTooling,
             ArtifactConsumer::Operator,
         ])
-    } else if path == "private/notary/descriptors/operations.json" {
-        operational_descriptor_classification(&[
-            ArtifactConsumer::RegistryNotary,
-            ArtifactConsumer::BundleSigner,
-            ArtifactConsumer::DeploymentTooling,
-            ArtifactConsumer::Operator,
-        ])
     } else if path == "private/relay-public/descriptors/secret-consumers.json"
         || path == "private/relay-consultation/descriptors/secret-consumers.json"
     {
@@ -395,13 +383,6 @@ fn classify_generated_artifact(relative: &Path) -> Result<GeneratedArtifactClass
             ArtifactConsumer::DeploymentTooling,
             ArtifactConsumer::Operator,
         ])
-    } else if path == "private/notary/descriptors/secret-consumers.json" {
-        secret_consumer_descriptor_classification(&[
-            ArtifactConsumer::RegistryNotary,
-            ArtifactConsumer::BundleSigner,
-            ArtifactConsumer::DeploymentTooling,
-            ArtifactConsumer::Operator,
-        ])
     } else if path == "private/relay-public/approval/review.json"
         || path == "private/relay-consultation/approval/review.json"
     {
@@ -410,12 +391,6 @@ fn classify_generated_artifact(relative: &Path) -> Result<GeneratedArtifactClass
             ArtifactReviewState::NeedsReview,
             ArtifactConsumer::RegistryRelay,
         )
-    } else if path == "private/notary/approval/review.json" {
-        product_review_classification(
-            "registry.project.review.v1",
-            ArtifactReviewState::NeedsReview,
-            ArtifactConsumer::RegistryNotary,
-        )
     } else if path == "private/relay-public/approval/project-state.json"
         || path == "private/relay-consultation/approval/project-state.json"
     {
@@ -424,32 +399,6 @@ fn classify_generated_artifact(relative: &Path) -> Result<GeneratedArtifactClass
             ArtifactReviewState::GeneratedCandidate,
             ArtifactConsumer::RegistryRelay,
         )
-    } else if path == "private/notary/approval/project-state.json" {
-        product_review_classification(
-            APPROVAL_STATE_SCHEMA,
-            ArtifactReviewState::GeneratedCandidate,
-            ArtifactConsumer::RegistryNotary,
-        )
-    } else if path == "private/notary/config/notary.yaml" {
-        artifact_classification(
-            "registry.notary.config.v1",
-            &[
-                ArtifactClass::RuntimeConfig,
-                ArtifactClass::ClaimConfiguration,
-                ArtifactClass::DeploymentInput,
-            ],
-            ArtifactSensitivity::TopologySensitive,
-            ArtifactPublication::NeverPublish,
-            ArtifactReviewState::GeneratedCandidate,
-            ArtifactLifecycle::UnsignedNonDeployable,
-            BUNDLE_INPUT_ACTIONS,
-            &[
-                ArtifactConsumer::RegistryNotary,
-                ArtifactConsumer::BundleSigner,
-                ArtifactConsumer::DeploymentTooling,
-                ArtifactConsumer::Operator,
-            ],
-        )
     } else {
         bail!("generated artifact has no reviewed classification: {path}");
     };
@@ -462,15 +411,12 @@ fn signing_input_marker_consumer(path: &str) -> Option<ArtifactConsumer> {
         | "signing-inputs/relay-consultation/signing-input.v1.json" => {
             Some(ArtifactConsumer::RegistryRelay)
         }
-        "signing-inputs/notary/signing-input.v1.json" => {
-            Some(ArtifactConsumer::RegistryNotary)
-        }
         _ => None,
     }
 }
 
 fn signing_input_legacy_path(path: &str) -> Option<String> {
-    for lane in ["relay-public", "relay-consultation", "notary"] {
+    for lane in ["relay-public", "relay-consultation"] {
         let prefix = format!("signing-inputs/{lane}/");
         if let Some(tail) = path.strip_prefix(&prefix) {
             return Some(format!("private/{lane}/{tail}"));
@@ -656,10 +602,8 @@ mod artifact_manifest_tests {
         for path in [
             "signing-inputs/relay-public/signing-input.v1.json",
             "signing-inputs/relay-consultation/signing-input.v1.json",
-            "signing-inputs/notary/signing-input.v1.json",
             "signing-inputs/relay-public/config/relay.yaml",
             "signing-inputs/relay-consultation/config/relay.yaml",
-            "signing-inputs/notary/config/notary.yaml",
         ] {
             classify_generated_artifact(Path::new(path))
                 .unwrap_or_else(|error| panic!("{path} should be classified: {error:#}"));
diff --git a/crates/registryctl/src/project_authoring/authoring_contract.rs b/crates/registryctl/src/project_authoring/authoring_contract.rs
index 2ebb2ef34..7a587993d 100644
--- a/crates/registryctl/src/project_authoring/authoring_contract.rs
+++ b/crates/registryctl/src/project_authoring/authoring_contract.rs
@@ -1,18 +1,13 @@
 // SPDX-License-Identifier: Apache-2.0
 
-// Generated Notary consultation outputs live under the Relay result root and
-// its closed `outputs` object. Reserve the same fixed depth and node envelope
-// here so authoring acceptance implies downstream Notary config acceptance.
+// Consultation outputs live under the Relay result root and its closed
+// `outputs` object. Reserve a fixed depth and node envelope at authoring time.
 const OUTPUT_SCHEMA_ROOT_DEPTH_V1: usize = 3;
 const OUTPUT_SCHEMA_ENVELOPE_NODES_V1: usize = 20;
-const MAX_OUTPUT_SCHEMA_DEPTH_V1: usize =
-    registry_notary_core::MAX_RELAY_OUTPUT_SCHEMA_DEPTH_V1;
-const MAX_OUTPUT_SCHEMA_NODES_V1: usize =
-    registry_notary_core::MAX_RELAY_OUTPUT_SCHEMA_NODES_V1;
-const MAX_OUTPUT_EXPANDED_NODES_V1: usize =
-    registry_notary_core::MAX_RELAY_OUTPUT_EXPANDED_NODES_V1;
-// Relay parsing and Notary recursive-schema validation accept exact JSON
-// integers only through 2^53 - 1, so authoring must enforce the same boundary.
+const MAX_OUTPUT_SCHEMA_DEPTH_V1: usize = MAX_RELAY_OUTPUT_SCHEMA_DEPTH_V1;
+const MAX_OUTPUT_SCHEMA_NODES_V1: usize = MAX_RELAY_OUTPUT_SCHEMA_NODES_V1;
+const MAX_OUTPUT_EXPANDED_NODES_V1: usize = MAX_RELAY_OUTPUT_EXPANDED_NODES_V1;
+// Relay parsing accepts exact JSON integers only through 2^53 - 1.
 const MAX_JSON_SAFE_INTEGER_V1: i64 = 9_007_199_254_740_991;
 
 /// The pre-1.0 project authoring contract. Runtime artifacts may still lower
@@ -461,8 +456,6 @@ enum AuthoredByteSize {
 struct AuthoredFixtureDocument {
     name: String,
     classification: AuthoredFixtureClassification,
-    #[serde(default)]
-    request: Option<GovernedFixtureRequest>,
     input: BTreeMap<String, Value>,
     #[serde(default)]
     variables: BTreeMap<String, Value>,
@@ -572,11 +565,8 @@ impl schemars::JsonSchema for AuthoredFixtureBody {
         "AuthoredFixtureBody".into()
     }
 
-    fn json_schema(
-        generator: &mut schemars::SchemaGenerator,
-    ) -> schemars::Schema {
-        let file_reference =
-            generator.subschema_for::<AuthoredFixtureBodyFile>();
+    fn json_schema(generator: &mut schemars::SchemaGenerator) -> schemars::Schema {
+        let file_reference = generator.subschema_for::<AuthoredFixtureBodyFile>();
         schemars::json_schema!({
             "oneOf": [
                 file_reference,
@@ -725,23 +715,23 @@ fn lower_authored_integration(
                     request_fixture: reason.request_fixture.clone(),
                 }
             }),
-            subject_mismatch: authored.not_applicable.subject_mismatch.as_ref().map(|reason| {
-                NotApplicableReason {
+            subject_mismatch: authored
+                .not_applicable
+                .subject_mismatch
+                .as_ref()
+                .map(|reason| NotApplicableReason {
                     rationale: reason.rationale.clone(),
                     request_fixture: reason.request_fixture.clone(),
-                }
-            }),
+                }),
         },
         bounds: BoundsDeclaration {
-            calls: if matches!(
-                &authored.capability,
-                AuthoredCapabilityDeclaration::Http(_)
-            ) || authored
-                .source
-                .as_ref()
-                .and_then(|source| source.protocol.as_ref())
-                .and_then(|protocol| protocol.signed_dci.as_ref())
-                .is_some()
+            calls: if matches!(&authored.capability, AuthoredCapabilityDeclaration::Http(_))
+                || authored
+                    .source
+                    .as_ref()
+                    .and_then(|source| source.protocol.as_ref())
+                    .and_then(|protocol| protocol.signed_dci.as_ref())
+                    .is_some()
             {
                 1
             } else {
@@ -760,7 +750,10 @@ fn validate_authored_integration_contract(authored: &AuthoredIntegrationDocument
     validate_stable_id(&authored.id, "integration id")?;
     for (field, reason) in [
         ("ambiguity", &authored.not_applicable.ambiguity),
-        ("subject_mismatch", &authored.not_applicable.subject_mismatch),
+        (
+            "subject_mismatch",
+            &authored.not_applicable.subject_mismatch,
+        ),
     ] {
         let Some(reason) = reason else {
             continue;
@@ -840,10 +833,7 @@ fn validate_authored_integration_contract(authored: &AuthoredIntegrationDocument
         }
     }
     if let Some(limits) = &authored.limits {
-        if limits
-            .calls
-            .is_some_and(|calls| !(1..=16).contains(&calls))
-        {
+        if limits.calls.is_some_and(|calls| !(1..=16).contains(&calls)) {
             bail!("authored limits exceed the v1 hard ceilings");
         }
         if let Some(request_bytes) = &limits.request_bytes {
@@ -965,7 +955,10 @@ fn signed_dci_pointer_segments(pointer: &str) -> Result<Vec<String>> {
     if segments.iter().any(String::is_empty) {
         bail!("signed DCI selector response pointer must be canonical");
     }
-    if segments.first().is_some_and(|segment| segment == "identifier") {
+    if segments
+        .first()
+        .is_some_and(|segment| segment == "identifier")
+    {
         let valid = matches!(
             segments.as_slice(),
             [_, index, field]
@@ -1072,24 +1065,20 @@ fn validate_authored_output(
             )?;
             Ok(1)
         }
-        AuthoredOutputDeclaration::Object(output) => {
-            validate_authored_output_object(
-                name,
-                &format!("outputs.{name}"),
-                output,
-                OUTPUT_SCHEMA_ROOT_DEPTH_V1,
-                nodes,
-            )
-        }
-        AuthoredOutputDeclaration::Array(output) => {
-            validate_authored_output_array(
-                name,
-                &format!("outputs.{name}"),
-                output,
-                OUTPUT_SCHEMA_ROOT_DEPTH_V1,
-                nodes,
-            )
-        }
+        AuthoredOutputDeclaration::Object(output) => validate_authored_output_object(
+            name,
+            &format!("outputs.{name}"),
+            output,
+            OUTPUT_SCHEMA_ROOT_DEPTH_V1,
+            nodes,
+        ),
+        AuthoredOutputDeclaration::Array(output) => validate_authored_output_array(
+            name,
+            &format!("outputs.{name}"),
+            output,
+            OUTPUT_SCHEMA_ROOT_DEPTH_V1,
+            nodes,
+        ),
     }
 }
 
@@ -1117,19 +1106,15 @@ fn validate_authored_scalar_output(
             }
         }
         AuthoredScalarType::Boolean => {
-            if format.is_some()
-                || max_length.is_some()
-                || minimum.is_some()
-                || maximum.is_some()
-            {
+            if format.is_some() || max_length.is_some() || minimum.is_some() || maximum.is_some() {
                 bail!("outputs.{name} Boolean schema has incompatible constraints");
             }
         }
         AuthoredScalarType::Integer => {
-            let minimum = minimum
-                .ok_or_else(|| anyhow!("outputs.{name}.minimum is required for Integer"))?;
-            let maximum = maximum
-                .ok_or_else(|| anyhow!("outputs.{name}.maximum is required for Integer"))?;
+            let minimum =
+                minimum.ok_or_else(|| anyhow!("outputs.{name}.minimum is required for Integer"))?;
+            let maximum =
+                maximum.ok_or_else(|| anyhow!("outputs.{name}.maximum is required for Integer"))?;
             if minimum > maximum
                 || minimum < -MAX_JSON_SAFE_INTEGER_V1
                 || maximum > MAX_JSON_SAFE_INTEGER_V1
@@ -1194,34 +1179,24 @@ fn validate_authored_output_object(
     nodes: &mut usize,
 ) -> Result<usize> {
     record_output_schema_node(name, depth, nodes)?;
-    if !(1..=registry_notary_core::MAX_RELAY_OUTPUT_VALUE_BYTES_V1)
-        .contains(&object.max_bytes)
-    {
+    if !(1..=MAX_RELAY_OUTPUT_VALUE_BYTES_V1).contains(&object.max_bytes) {
         bail!(
             "{path}.max_bytes must be between 1 and {}",
-            registry_notary_core::MAX_RELAY_OUTPUT_VALUE_BYTES_V1
+            MAX_RELAY_OUTPUT_VALUE_BYTES_V1
         );
     }
-    if object.fields.is_empty()
-        || object.fields.len() > registry_notary_core::MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1
-    {
+    if object.fields.is_empty() || object.fields.len() > MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1 {
         bail!(
             "{path}.fields must contain between 1 and {} entries",
-            registry_notary_core::MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1
+            MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1
         );
     }
     let mut expanded = 1_usize;
     for (field_name, field) in &object.fields {
-        validate_input_name(field_name)
-            .with_context(|| format!("{path}.fields.{field_name}"))?;
+        validate_input_name(field_name).with_context(|| format!("{path}.fields.{field_name}"))?;
         let child_path = format!("{path}.fields.{field_name}.schema");
-        let child = validate_authored_output_schema(
-            name,
-            &child_path,
-            &field.schema,
-            depth + 1,
-            nodes,
-        )?;
+        let child =
+            validate_authored_output_schema(name, &child_path, &field.schema, depth + 1, nodes)?;
         expanded = expanded
             .checked_add(child)
             .ok_or_else(|| anyhow!("outputs.{name} recursive expansion overflows"))?;
@@ -1243,18 +1218,16 @@ fn validate_authored_output_array(
     nodes: &mut usize,
 ) -> Result<usize> {
     record_output_schema_node(name, depth, nodes)?;
-    if !(1..=registry_notary_core::MAX_RELAY_OUTPUT_VALUE_BYTES_V1)
-        .contains(&array.max_bytes)
-    {
+    if !(1..=MAX_RELAY_OUTPUT_VALUE_BYTES_V1).contains(&array.max_bytes) {
         bail!(
             "{path}.max_bytes must be between 1 and {}",
-            registry_notary_core::MAX_RELAY_OUTPUT_VALUE_BYTES_V1
+            MAX_RELAY_OUTPUT_VALUE_BYTES_V1
         );
     }
-    if !(1..=registry_notary_core::MAX_RELAY_OUTPUT_ARRAY_ITEMS_V1).contains(&array.max_items) {
+    if !(1..=MAX_RELAY_OUTPUT_ARRAY_ITEMS_V1).contains(&array.max_items) {
         bail!(
             "{path}.max_items must be between 1 and {}",
-            registry_notary_core::MAX_RELAY_OUTPUT_ARRAY_ITEMS_V1
+            MAX_RELAY_OUTPUT_ARRAY_ITEMS_V1
         );
     }
     let child = validate_authored_output_schema(
@@ -1338,8 +1311,7 @@ fn minimum_authored_output_object_json_bytes(
         bytes = checked_minimum_json_bytes_add(path, bytes, field_name_bytes)?;
         bytes = checked_minimum_json_bytes_add(path, bytes, 3)?;
         let child_path = format!("{path}.fields.{field_name}.schema");
-        let child_bytes =
-            minimum_authored_output_schema_json_bytes(&child_path, &field.schema)?;
+        let child_bytes = minimum_authored_output_schema_json_bytes(&child_path, &field.schema)?;
         bytes = checked_minimum_json_bytes_add(path, bytes, child_bytes)?;
         required_fields = required_fields
             .checked_add(1)
@@ -1800,11 +1772,11 @@ fn lower_script_capability(
                 request_headers: source.request_headers.clone(),
                 response_headers: source.response_headers.clone(),
                 response: ScriptResponseDeclaration {
-                    format: response.map_or(AuthoredResponseFormat::Json, |response| {
-                        response.format
-                    }),
+                    format: response
+                        .map_or(AuthoredResponseFormat::Json, |response| response.format),
                     max_bytes,
-                    max_bytes_authored: response.is_some_and(|response| response.max_bytes.is_some()),
+                    max_bytes_authored: response
+                        .is_some_and(|response| response.max_bytes.is_some()),
                 },
                 signed_dci: signed_dci.cloned(),
                 script: script.file.clone(),
@@ -1905,82 +1877,75 @@ fn lower_output_map(
     authored
         .iter()
         .map(|(name, declaration)| {
-            let (
-                output_type,
-                nullable,
-                max_bytes,
-                minimum,
-                maximum,
-                structured_schema,
-                pointer,
-            ) = match declaration {
-                AuthoredOutputDeclaration::Scalar(declaration) => {
-                    let lowered = lower_authored_scalar_output(
-                        name,
-                        &declaration.output_type,
-                        declaration.format,
-                        declaration.max_length,
-                        declaration.minimum,
-                        declaration.maximum,
-                    )?;
-                    let pointer = match (&declaration.source, require_source) {
-                        (Some(pointer), true) => {
-                            pointer_segments(pointer)?;
-                            Some(pointer.clone())
+            let (output_type, nullable, max_bytes, minimum, maximum, structured_schema, pointer) =
+                match declaration {
+                    AuthoredOutputDeclaration::Scalar(declaration) => {
+                        let lowered = lower_authored_scalar_output(
+                            name,
+                            &declaration.output_type,
+                            declaration.format,
+                            declaration.max_length,
+                            declaration.minimum,
+                            declaration.maximum,
+                        )?;
+                        let pointer = match (&declaration.source, require_source) {
+                            (Some(pointer), true) => {
+                                pointer_segments(pointer)?;
+                                Some(pointer.clone())
+                            }
+                            (Some(_), false) => None,
+                            (None, true) => {
+                                bail!("outputs.{name}.x-registry-source is required for http")
+                            }
+                            (None, false) => None,
+                        };
+                        (
+                            lowered.output_type,
+                            lowered.nullable,
+                            lowered.max_bytes,
+                            lowered.minimum,
+                            lowered.maximum,
+                            None,
+                            pointer,
+                        )
+                    }
+                    AuthoredOutputDeclaration::Object(declaration) => {
+                        match declaration.output_type {
+                            AuthoredOutputObjectType::Object => {}
                         }
-                        (Some(_), false) => None,
-                        (None, true) => {
-                            bail!("outputs.{name}.x-registry-source is required for http")
+                        if require_source {
+                            bail!("outputs.{name}: structured outputs require capability.script");
                         }
-                        (None, false) => None,
-                    };
-                    (
-                        lowered.output_type,
-                        lowered.nullable,
-                        lowered.max_bytes,
-                        lowered.minimum,
-                        lowered.maximum,
-                        None,
-                        pointer,
-                    )
-                }
-                AuthoredOutputDeclaration::Object(declaration) => {
-                    match declaration.output_type {
-                        AuthoredOutputObjectType::Object => {}
-                    }
-                    if require_source {
-                        bail!("outputs.{name}: structured outputs require capability.script");
-                    }
-                    let schema = lower_authored_output_object(name, declaration)?;
-                    (
-                        OutputType::Object,
-                        declaration.nullable,
-                        Some(declaration.max_bytes),
-                        None,
-                        None,
-                        Some(schema),
-                        None,
-                    )
-                }
-                AuthoredOutputDeclaration::Array(declaration) => {
-                    match declaration.output_type {
-                        AuthoredOutputArrayType::Array => {}
+                        let schema = lower_authored_output_object(name, declaration)?;
+                        (
+                            OutputType::Object,
+                            declaration.nullable,
+                            Some(declaration.max_bytes),
+                            None,
+                            None,
+                            Some(schema),
+                            None,
+                        )
                     }
-                    if require_source {
-                        bail!("outputs.{name}: structured outputs require capability.script");
+                    AuthoredOutputDeclaration::Array(declaration) => {
+                        match declaration.output_type {
+                            AuthoredOutputArrayType::Array => {}
+                        }
+                        if require_source {
+                            bail!("outputs.{name}: structured outputs require capability.script");
+                        }
+                        let schema = lower_authored_output_array(name, declaration)?;
+                        (
+                            OutputType::Array,
+                            declaration.nullable,
+                            Some(declaration.max_bytes),
+                            None,
+                            None,
+                            Some(schema),
+                            None,
+                        )
                     }
-                    let schema = lower_authored_output_array(name, declaration)?;
-                    (
-                        OutputType::Array,
-                        declaration.nullable,
-                        Some(declaration.max_bytes),
-                        None,
-                        None,
-                        Some(schema),
-                        None,
-                    )
-                }
-            };
+                };
             Ok((
                 name.clone(),
                 OutputDeclaration {
@@ -2017,16 +1982,14 @@ fn lower_authored_scalar_output(
 ) -> Result<LoweredOutputScalar> {
     let (scalar, nullable) = schema_type_parts(output_type)?;
     match (scalar, format) {
-        (AuthoredScalarType::String, Some(AuthoredStringFormat::Date)) => {
-            Ok(LoweredOutputScalar {
-                schema: StructuredOutputSchema::Date { nullable },
-                output_type: OutputType::Date,
-                nullable,
-                max_bytes: None,
-                minimum: None,
-                maximum: None,
-            })
-        }
+        (AuthoredScalarType::String, Some(AuthoredStringFormat::Date)) => Ok(LoweredOutputScalar {
+            schema: StructuredOutputSchema::Date { nullable },
+            output_type: OutputType::Date,
+            nullable,
+            max_bytes: None,
+            minimum: None,
+            maximum: None,
+        }),
         (AuthoredScalarType::String, None) => {
             let max_bytes = max_length
                 .ok_or_else(|| anyhow!("outputs.{name}.maxLength is required"))?
@@ -2053,10 +2016,8 @@ fn lower_authored_scalar_output(
             maximum: None,
         }),
         (AuthoredScalarType::Integer, None) => {
-            let minimum =
-                minimum.ok_or_else(|| anyhow!("outputs.{name}.minimum is required"))?;
-            let maximum =
-                maximum.ok_or_else(|| anyhow!("outputs.{name}.maximum is required"))?;
+            let minimum = minimum.ok_or_else(|| anyhow!("outputs.{name}.minimum is required"))?;
+            let maximum = maximum.ok_or_else(|| anyhow!("outputs.{name}.maximum is required"))?;
             Ok(LoweredOutputScalar {
                 schema: StructuredOutputSchema::Integer {
                     nullable,
diff --git a/crates/registryctl/src/project_authoring/capability_inventory.rs b/crates/registryctl/src/project_authoring/capability_inventory.rs
index 356299f08..a462a5a49 100644
--- a/crates/registryctl/src/project_authoring/capability_inventory.rs
+++ b/crates/registryctl/src/project_authoring/capability_inventory.rs
@@ -43,28 +43,22 @@ pub enum CapabilityId {
     RhaiRuntime,
     RhaiAbi,
     RegistryRelayProduct,
-    RegistryNotaryProduct,
     RegistryRelayValidator,
-    RegistryNotaryValidator,
     ProjectAuthoringSchemas,
     RegistryRelayConfigSchema,
-    RegistryNotaryConfigSchema,
 }
 
 impl CapabilityId {
-    const ALL: [Self; 12] = [
+    const ALL: [Self; 9] = [
         Self::SourceHttp,
         Self::SourceScript,
         Self::SourceSnapshot,
         Self::RhaiRuntime,
         Self::RhaiAbi,
         Self::RegistryRelayProduct,
-        Self::RegistryNotaryProduct,
         Self::RegistryRelayValidator,
-        Self::RegistryNotaryValidator,
         Self::ProjectAuthoringSchemas,
         Self::RegistryRelayConfigSchema,
-        Self::RegistryNotaryConfigSchema,
     ];
 
     const fn project_declarable(self) -> bool {
@@ -74,7 +68,6 @@ impl CapabilityId {
                 | Self::SourceScript
                 | Self::SourceSnapshot
                 | Self::RegistryRelayProduct
-                | Self::RegistryNotaryProduct
         )
     }
 
@@ -99,7 +92,6 @@ pub enum CapabilityKind {
 pub enum CapabilityOwner {
     Registryctl,
     RegistryRelay,
-    RegistryNotary,
     ReleaseEngineering,
 }
 
@@ -117,7 +109,6 @@ pub enum SupportedCapabilityVersion {
     RhaiLanguageV1,
     RhaiXwV1,
     RegistryRelayConfigV1,
-    RegistryNotaryConfigV1,
 }
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)]
@@ -145,7 +136,7 @@ pub(crate) const COMPILED_CAPABILITY_RELEASE_FACTS: [(
     CapabilityId,
     InstalledCapabilityState,
     InstalledCapabilityEvidence,
-); 12] = [
+); 9] = [
     (
         CapabilityId::SourceHttp,
         InstalledCapabilityState::Compiled,
@@ -176,21 +167,11 @@ pub(crate) const COMPILED_CAPABILITY_RELEASE_FACTS: [(
         InstalledCapabilityState::Compiled,
         InstalledCapabilityEvidence::LinkedCrate,
     ),
-    (
-        CapabilityId::RegistryNotaryProduct,
-        InstalledCapabilityState::Compiled,
-        InstalledCapabilityEvidence::LinkedCrate,
-    ),
     (
         CapabilityId::RegistryRelayValidator,
         InstalledCapabilityState::Compiled,
         InstalledCapabilityEvidence::LinkedProductValidator,
     ),
-    (
-        CapabilityId::RegistryNotaryValidator,
-        InstalledCapabilityState::Compiled,
-        InstalledCapabilityEvidence::LinkedProductValidator,
-    ),
     (
         CapabilityId::ProjectAuthoringSchemas,
         InstalledCapabilityState::Compiled,
@@ -201,11 +182,6 @@ pub(crate) const COMPILED_CAPABILITY_RELEASE_FACTS: [(
         InstalledCapabilityState::Compiled,
         InstalledCapabilityEvidence::EmbeddedSchema,
     ),
-    (
-        CapabilityId::RegistryNotaryConfigSchema,
-        InstalledCapabilityState::Compiled,
-        InstalledCapabilityEvidence::EmbeddedSchema,
-    ),
 ];
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)]
@@ -228,14 +204,11 @@ pub enum EnvironmentEnablementState {
 pub struct CapabilityUsageCounts {
     pub services: u32,
     pub consultations: u32,
-    pub claims: u32,
 }
 
 impl CapabilityUsageCounts {
     fn total(self) -> Option<u32> {
-        self.services
-            .checked_add(self.consultations)?
-            .checked_add(self.claims)
+        self.services.checked_add(self.consultations)
     }
 
     fn is_empty(self) -> bool {
@@ -252,10 +225,9 @@ impl Serialize for CapabilityUsageCounts {
             .total()
             .filter(|total| *total <= MAX_CAPABILITY_USAGE_COUNT)
             .ok_or_else(|| serde::ser::Error::custom("capability usage exceeds the report cap"))?;
-        let mut state = serializer.serialize_struct("CapabilityUsageCounts", 4)?;
+        let mut state = serializer.serialize_struct("CapabilityUsageCounts", 3)?;
         state.serialize_field("services", &self.services)?;
         state.serialize_field("consultations", &self.consultations)?;
-        state.serialize_field("claims", &self.claims)?;
         state.serialize_field("total", &total)?;
         state.end()
     }
@@ -271,7 +243,6 @@ impl<'de> Deserialize<'de> for CapabilityUsageCounts {
         struct Wire {
             services: u32,
             consultations: u32,
-            claims: u32,
             total: u32,
         }
 
@@ -279,7 +250,6 @@ impl<'de> Deserialize<'de> for CapabilityUsageCounts {
         let usage = Self {
             services: wire.services,
             consultations: wire.consultations,
-            claims: wire.claims,
         };
         validate_usage(usage).map_err(|_| {
             de::Error::custom("capability usage total exceeds the report aggregate cap")
@@ -329,37 +299,29 @@ pub enum SupportComponent {
     SnapshotMaterializationWorker,
     RhaiXwProtocolHelper,
     RegistryRelayProduct,
-    RegistryNotaryProduct,
     RegistryRelayValidator,
-    RegistryNotaryValidator,
     ProjectAuthoringSchema,
     RegistryRelayConfigSchema,
-    RegistryNotaryConfigSchema,
     RegistryctlDistribution,
     RegistryRelayImage,
-    RegistryNotaryImage,
 }
 
 impl SupportComponent {
-    const ALL: [Self; 14] = [
+    const ALL: [Self; 10] = [
         Self::HttpSourceWorker,
         Self::RhaiScriptWorker,
         Self::SnapshotMaterializationWorker,
         Self::RhaiXwProtocolHelper,
         Self::RegistryRelayProduct,
-        Self::RegistryNotaryProduct,
         Self::RegistryRelayValidator,
-        Self::RegistryNotaryValidator,
         Self::ProjectAuthoringSchema,
         Self::RegistryRelayConfigSchema,
-        Self::RegistryNotaryConfigSchema,
         Self::RegistryctlDistribution,
         Self::RegistryRelayImage,
-        Self::RegistryNotaryImage,
     ];
 
     const fn is_image(self) -> bool {
-        matches!(self, Self::RegistryRelayImage | Self::RegistryNotaryImage)
+        matches!(self, Self::RegistryRelayImage)
     }
 }
 
@@ -915,7 +877,6 @@ fn validate_usage(usage: CapabilityUsageCounts) -> Result<(), CapabilityInventor
         .ok_or(CapabilityInventoryError::UsageCountOutOfRange)?;
     if usage.services > MAX_CAPABILITY_USAGE_COUNT
         || usage.consultations > MAX_CAPABILITY_USAGE_COUNT
-        || usage.claims > MAX_CAPABILITY_USAGE_COUNT
         || total > MAX_CAPABILITY_USAGE_COUNT
     {
         return Err(CapabilityInventoryError::UsageCountOutOfRange);
@@ -1057,21 +1018,11 @@ fn capability_metadata(capability: CapabilityId) -> CapabilityMetadata {
             owner: CapabilityOwner::RegistryRelay,
             supported_versions: &[Version::RegistryRelayConfigV1],
         },
-        CapabilityId::RegistryNotaryProduct => CapabilityMetadata {
-            kind: CapabilityKind::Product,
-            owner: CapabilityOwner::RegistryNotary,
-            supported_versions: &[Version::RegistryNotaryConfigV1],
-        },
         CapabilityId::RegistryRelayValidator => CapabilityMetadata {
             kind: CapabilityKind::ProductValidator,
             owner: CapabilityOwner::RegistryRelay,
             supported_versions: &[Version::RegistryRelayConfigV1],
         },
-        CapabilityId::RegistryNotaryValidator => CapabilityMetadata {
-            kind: CapabilityKind::ProductValidator,
-            owner: CapabilityOwner::RegistryNotary,
-            supported_versions: &[Version::RegistryNotaryConfigV1],
-        },
         CapabilityId::ProjectAuthoringSchemas => CapabilityMetadata {
             kind: CapabilityKind::Schema,
             owner: CapabilityOwner::Registryctl,
@@ -1082,11 +1033,6 @@ fn capability_metadata(capability: CapabilityId) -> CapabilityMetadata {
             owner: CapabilityOwner::RegistryRelay,
             supported_versions: &[Version::RegistryRelayConfigV1],
         },
-        CapabilityId::RegistryNotaryConfigSchema => CapabilityMetadata {
-            kind: CapabilityKind::Schema,
-            owner: CapabilityOwner::RegistryNotary,
-            supported_versions: &[Version::RegistryNotaryConfigV1],
-        },
     }
 }
 
@@ -1129,21 +1075,11 @@ fn support_metadata(component: SupportComponent) -> SupportMetadata {
                 Capability::RegistryRelayProduct,
             ],
         },
-        SupportComponent::RegistryNotaryProduct => SupportMetadata {
-            kind: SupportKind::Product,
-            owner: CapabilityOwner::RegistryNotary,
-            required_by: &[Capability::RegistryNotaryProduct],
-        },
         SupportComponent::RegistryRelayValidator => SupportMetadata {
             kind: SupportKind::ProductValidator,
             owner: CapabilityOwner::RegistryRelay,
             required_by: &[Capability::RegistryRelayProduct],
         },
-        SupportComponent::RegistryNotaryValidator => SupportMetadata {
-            kind: SupportKind::ProductValidator,
-            owner: CapabilityOwner::RegistryNotary,
-            required_by: &[Capability::RegistryNotaryProduct],
-        },
         SupportComponent::ProjectAuthoringSchema => SupportMetadata {
             kind: SupportKind::Schema,
             owner: CapabilityOwner::Registryctl,
@@ -1158,11 +1094,6 @@ fn support_metadata(component: SupportComponent) -> SupportMetadata {
             owner: CapabilityOwner::RegistryRelay,
             required_by: &[Capability::RegistryRelayProduct],
         },
-        SupportComponent::RegistryNotaryConfigSchema => SupportMetadata {
-            kind: SupportKind::Schema,
-            owner: CapabilityOwner::RegistryNotary,
-            required_by: &[Capability::RegistryNotaryProduct],
-        },
         SupportComponent::RegistryctlDistribution => SupportMetadata {
             kind: SupportKind::Distribution,
             owner: CapabilityOwner::ReleaseEngineering,
@@ -1178,10 +1109,5 @@ fn support_metadata(component: SupportComponent) -> SupportMetadata {
             owner: CapabilityOwner::ReleaseEngineering,
             required_by: &[Capability::RegistryRelayProduct],
         },
-        SupportComponent::RegistryNotaryImage => SupportMetadata {
-            kind: SupportKind::Image,
-            owner: CapabilityOwner::ReleaseEngineering,
-            required_by: &[Capability::RegistryNotaryProduct],
-        },
     }
 }
diff --git a/crates/registryctl/src/project_authoring/commands.rs b/crates/registryctl/src/project_authoring/commands.rs
index ba8d2cb8a..c96baea5b 100644
--- a/crates/registryctl/src/project_authoring/commands.rs
+++ b/crates/registryctl/src/project_authoring/commands.rs
@@ -304,7 +304,7 @@ pub fn test_registry_project_selected_with_context(
     let compiled =
         compile_project_for_environment(&loaded, "offline-fixture", &offline_environment, None)?;
     validate_generated_product_configs(&compiled)?;
-    let (reports, generated_observations, request_observations, call_budget_actual) =
+    let (reports, generated_observations, call_budget_actual) =
         execute_all_fixtures_with_coverage_observations(
             &loaded,
             &compiled,
@@ -319,7 +319,6 @@ pub fn test_registry_project_selected_with_context(
             &loaded,
             &reports,
             &generated_observations,
-            &request_observations,
             call_budget_actual,
         )?)
     } else {
@@ -342,9 +341,8 @@ pub fn test_registry_project_selected_with_context(
 }
 
 fn offline_fixture_environment(loaded: &LoadedRegistryProject) -> Result<EnvironmentDocument> {
-    let (requires_relay, requires_notary) = project_product_topology(&loaded.project);
-    let requires_issuance = project_issues_credentials(&loaded.project);
-    let requires_notary_relay = project_requires_notary_relay(&loaded.project);
+    let requires_relay = project_requires_relay(&loaded.project);
+    let requires_relay_consultation = project_requires_consultation_relay(&loaded.project);
     let mut integrations = BTreeMap::new();
     for (alias, integration) in &loaded.integrations {
         if matches!(
@@ -473,67 +471,29 @@ fn offline_fixture_environment(loaded: &LoadedRegistryProject) -> Result<Environ
             )
         })
         .collect();
-    let callers = loaded
-        .project
-        .services
-        .iter()
-        .filter(|(_, service)| service.kind == ServiceKind::Evidence)
-        .map(|(service_id, service)| {
-            (
-                service_id.clone(),
-                CallerBinding {
-                    api_key_fingerprint: SecretReference {
-                        secret: "REGISTRY_PROJECT_FIXTURE_API_KEY_HASH".to_string(),
-                    },
-                    scopes: service.access.scopes.clone(),
-                },
-            )
-        })
-        .collect();
     Ok(EnvironmentDocument {
         version: 1,
         development: None,
         integrations,
         entities,
-        issuance: requires_issuance.then(|| IssuanceBinding {
-            issuer: "did:web:notary.fixture.invalid".to_string(),
-            signing_key: SecretReference {
-                secret: "REGISTRY_PROJECT_FIXTURE_ISSUER_JWK".to_string(),
-            },
-            signing_kid: "offline-fixture-key".to_string(),
-            generation: 1,
-            algorithm: IssuanceSigningAlgorithm::default(),
-        }),
-        callers: if requires_notary {
-            callers
-        } else {
-            BTreeMap::new()
-        },
         relay: requires_relay.then(|| RelayBinding {
             origin: "https://relay.fixture.invalid".to_string(),
             issuer: "https://workload.fixture.invalid".to_string(),
             jwks_url: "https://workload.fixture.invalid/.well-known/jwks.json".to_string(),
             audience: "registry-relay".to_string(),
             allowed_clients: vec!["registry-project-fixture-client".to_string()],
+            consultation: requires_relay_consultation.then(|| RelayConsultationBinding {
+                client_id: "registry-project-fixture-consultation-client".to_string(),
+                principal_id: "registry-project-fixture-principal".to_string(),
+            }),
             local_api_keys: None,
         }),
-        notary_relay: requires_notary_relay.then(|| NotaryRelayBinding {
-            base_url: "https://relay.fixture.invalid".to_string(),
-            workload_client_id: "registry-project-fixture-notary".to_string(),
-            token_file: PathBuf::from("/run/secrets/offline-fixture-token"),
-        }),
         relay_state: None,
-        notary_state: None,
-        notary_cel: None,
-        oid4vci: None,
         deployment: DeploymentBinding {
             profile: DeploymentProfile::Local,
             relay: requires_relay.then(|| ServiceBinding {
                 service: "registry-project-fixture-relay".to_string(),
             }),
-            notary: requires_notary.then(|| ServiceBinding {
-                service: "registry-project-fixture-notary".to_string(),
-            }),
         },
     })
 }
@@ -579,380 +539,6 @@ fn offline_private_path(
         .to_owned())
 }
 
-struct GovernedFixtureInputContract<'a> {
-    name: &'a str,
-    declaration: &'a InputDeclaration,
-}
-
-fn validate_governed_fixture_request(
-    loaded: &LoadedRegistryProject,
-    outbound: &GovernedFixtureRequest,
-) -> Result<()> {
-    let purpose = outbound.purpose.as_str();
-    let services = loaded
-        .project
-        .services
-        .values()
-        .filter(|service| service.kind == ServiceKind::Evidence && service.purpose == purpose)
-        .collect::<Vec<_>>();
-    if services.is_empty() {
-        bail!("governed fixture request purpose is not declared by this project");
-    }
-    let claims = &outbound.claims;
-    if claims.is_empty() || claims.len() > MAX_CLAIMS {
-        bail!("governed fixture request claim count is outside the project bound");
-    }
-    let mut ids = Vec::with_capacity(claims.len());
-    let mut claim_versions = BTreeMap::new();
-    let mut selected_claims = Vec::with_capacity(claims.len());
-    for claim in claims {
-        let id = claim.id.as_str();
-        let service = services
-            .iter()
-            .copied()
-            .find(|service| service.claims.contains_key(id))
-            .ok_or_else(|| anyhow!("governed fixture request contains an unknown project claim"))?;
-        let authored_version = service.version.to_string();
-        if claim
-            .version
-            .as_deref()
-            .is_some_and(|version| version != authored_version)
-        {
-            bail!("governed fixture request claim version does not match the authored project");
-        }
-        if claim_versions
-            .insert(id.to_string(), authored_version)
-            .is_some()
-        {
-            bail!("governed fixture request contains an unknown or duplicate project claim");
-        }
-        ids.push(id.to_string());
-        let selected_claim = service
-            .claims
-            .get(id)
-            .ok_or_else(|| anyhow!("selected project claim is absent after claim resolution"))?;
-        selected_claims.push((service, selected_claim));
-    }
-    let first_claim = selected_claims
-        .first()
-        .map(|(_, claim)| *claim)
-        .ok_or_else(|| anyhow!("governed fixture request must select at least one project claim"))?;
-    let disclosure = outbound
-        .disclosure
-        .as_deref()
-        .unwrap_or_else(|| expanded_disclosure(&first_claim.disclosure).0);
-    if registry_notary_core::DisclosureProfile::parse(disclosure).is_none() {
-        bail!("governed fixture request disclosure profile is invalid");
-    }
-    if selected_claims.iter().any(|(_, claim)| {
-        !expanded_disclosure(&claim.disclosure)
-            .1
-            .contains(&disclosure)
-    }) {
-        bail!("governed fixture request disclosure is not allowed for every selected project claim");
-    }
-    if outbound
-        .format
-        .as_deref()
-        .is_some_and(|format| format != registry_notary_core::FORMAT_CLAIM_RESULT_JSON)
-    {
-        bail!("governed fixture request format must be the governed claim-result media type");
-    }
-    for (name, _) in outbound.variables.iter() {
-        if !selected_claims
-            .iter()
-            .any(|(service, _)| service.variables.contains_key(name))
-        {
-            bail!("governed fixture request variable is not declared by a selected project service");
-        }
-    }
-    let subject_type = selected_claim_subject_type(&selected_claims)?;
-    let mut input_claims = selected_claims.clone();
-    let representative_binding = loaded
-        .environment
-        .as_ref()
-        .and_then(|environment| environment.oid4vci.as_ref())
-        .and_then(|binding| {
-            binding
-                .representative_issuance
-                .as_ref()
-                .map(|representative| (binding, representative))
-        });
-    if let Some((binding, representative)) = representative_binding {
-        if let Some(proof_claim) = representative_proof_claim_for_selected_ids(
-            &loaded.project,
-            &binding.credential.service,
-            &binding.credential.profile,
-            &representative.proof_claim,
-            &ids,
-        )? {
-            input_claims.push(proof_claim);
-        }
-    }
-    validate_governed_fixture_target(
-        loaded,
-        &input_claims,
-        outbound.requester.as_ref(),
-        &outbound.target,
-        &outbound.variables,
-        subject_type,
-    )?;
-    Ok(())
-}
-
-fn representative_proof_claim_for_selected_ids<'a>(
-    project: &'a RegistryProject,
-    service_id: &str,
-    profile_id: &str,
-    proof_claim_id: &str,
-    selected_claim_ids: &[String],
-) -> Result<Option<(&'a ServiceDeclaration, &'a ClaimDeclaration)>> {
-    let service = project
-        .services
-        .get(service_id)
-        .ok_or_else(|| anyhow!("representative credential service is absent"))?;
-    let credential = service
-        .credential_profiles
-        .get(profile_id)
-        .ok_or_else(|| anyhow!("representative credential profile is absent"))?;
-    let selected_root = credential
-        .claims
-        .first()
-        .is_some_and(|root| selected_claim_ids.iter().any(|selected| selected == root));
-    if !selected_root
-        || selected_claim_ids
-            .iter()
-            .any(|selected| selected == proof_claim_id)
-    {
-        return Ok(None);
-    }
-    let proof_claim = service
-        .claims
-        .get(proof_claim_id)
-        .ok_or_else(|| anyhow!("representative proof claim is absent"))?;
-    Ok(Some((service, proof_claim)))
-}
-
-fn selected_claim_subject_type(
-    selected_claims: &[(&ServiceDeclaration, &ClaimDeclaration)],
-) -> Result<&'static str> {
-    let mut subject_types = selected_claims
-        .iter()
-        .map(|(service, _)| service.effective_subject_type())
-        .collect::<BTreeSet<_>>();
-    if subject_types.len() != 1 {
-        bail!("governed fixture request cannot combine evidence services with different subject types");
-    }
-    Ok(subject_types
-        .pop_first()
-        .ok_or_else(|| anyhow!("governed fixture request selected no evidence service"))?
-        .as_str())
-}
-
-fn validate_governed_fixture_target(
-    loaded: &LoadedRegistryProject,
-    selected_claims: &[(&ServiceDeclaration, &ClaimDeclaration)],
-    requester: Option<&GovernedFixtureTarget>,
-    target: &GovernedFixtureTarget,
-    variables: &registry_notary_core::RequestVariables,
-    subject_type: &str,
-) -> Result<()> {
-    if !target.entity_type.eq_ignore_ascii_case(subject_type) {
-        bail!("governed fixture request target type does not match the authored project");
-    }
-
-    let mut id_contracts = Vec::new();
-    let mut identifier_contracts = BTreeMap::<String, Vec<GovernedFixtureInputContract<'_>>>::new();
-    let mut requester_identifier_contracts =
-        BTreeMap::<String, Vec<GovernedFixtureInputContract<'_>>>::new();
-    let mut attribute_contracts = BTreeMap::<String, Vec<GovernedFixtureInputContract<'_>>>::new();
-    let mut variable_contracts = BTreeMap::<String, Vec<GovernedFixtureInputContract<'_>>>::new();
-    for (service, claim) in selected_claims {
-        if inferred_claim_evidence(service, claim)? != ClaimEvidence::RegistryBacked {
-            bail!("governed governed fixture requests require registry-backed project claims");
-        }
-        let consultation_name = claim_consultation_name(service, claim)?;
-        let consultation = service
-            .consultations
-            .get(consultation_name)
-            .ok_or_else(|| anyhow!("selected project claim has no authored consultation"))?;
-        let integration = loaded
-            .integrations
-            .get(&consultation.integration)
-            .ok_or_else(|| anyhow!("selected consultation has no authored integration"))?;
-        for (name, mapping) in &consultation.input {
-            let declaration = integration.document.input.get(name).ok_or_else(|| {
-                anyhow!("selected consultation input has no authored contract")
-            })?;
-            let contract = GovernedFixtureInputContract { name, declaration };
-            if mapping == "request.target.id" {
-                id_contracts.push(contract);
-            } else if let Some(scheme) = mapping.strip_prefix("request.target.identifiers.") {
-                identifier_contracts
-                    .entry(scheme.to_string())
-                    .or_default()
-                    .push(contract);
-            } else if let Some(scheme) = mapping.strip_prefix("request.requester.identifiers.") {
-                requester_identifier_contracts
-                    .entry(scheme.to_string())
-                    .or_default()
-                    .push(contract);
-            } else if let Some(name) = mapping.strip_prefix("request.target.attributes.") {
-                attribute_contracts
-                    .entry(name.to_string())
-                    .or_default()
-                    .push(contract);
-            } else if let Some(name) = mapping.strip_prefix("request.variables.") {
-                variable_contracts
-                    .entry(name.to_string())
-                    .or_default()
-                    .push(contract);
-            } else {
-                bail!("authored consultation uses an unsupported governed fixture input");
-            }
-        }
-    }
-
-    if id_contracts.is_empty() != target.id.is_none() {
-        bail!("governed fixture request target fields do not exactly match the selected authored inputs");
-    }
-    if requester_identifier_contracts.is_empty() != requester.is_none() {
-        bail!(
-            "governed fixture request requester must be present exactly when selected claims bind authenticated requester identifiers"
-        );
-    }
-    let mut identifiers = BTreeMap::new();
-    for identifier in &target.identifiers {
-        if identifiers
-            .insert(identifier.scheme.as_str(), identifier.value.as_str())
-            .is_some()
-        {
-            bail!("governed fixture request target contains a duplicate identifier scheme");
-        }
-    }
-    if identifiers.keys().copied().collect::<BTreeSet<_>>()
-        != identifier_contracts
-            .keys()
-            .map(String::as_str)
-            .collect::<BTreeSet<_>>()
-        || target
-            .attributes
-            .keys()
-            .map(String::as_str)
-            .collect::<BTreeSet<_>>()
-            != attribute_contracts
-                .keys()
-                .map(String::as_str)
-                .collect::<BTreeSet<_>>()
-    {
-        bail!("governed fixture request target fields do not exactly match the selected authored inputs");
-    }
-    if let Some(requester) = requester {
-        validate_governed_requester_type(requester)?;
-        if requester.id.is_some() || !requester.attributes.is_empty() {
-            bail!(
-                "governed fixture request requester must contain only the required authenticated identifiers"
-            );
-        }
-        let mut requester_identifiers = BTreeMap::new();
-        for identifier in &requester.identifiers {
-            if requester_identifiers
-                .insert(identifier.scheme.as_str(), identifier.value.as_str())
-                .is_some()
-            {
-                bail!("governed fixture request requester contains a duplicate identifier scheme");
-            }
-        }
-        if requester_identifiers
-            .keys()
-            .copied()
-            .collect::<BTreeSet<_>>()
-            != requester_identifier_contracts
-                .keys()
-                .map(String::as_str)
-                .collect::<BTreeSet<_>>()
-        {
-            bail!(
-                "governed fixture request requester identifiers do not exactly match the selected authored inputs"
-            );
-        }
-        for (scheme, contracts) in &requester_identifier_contracts {
-            let value = requester_identifiers.get(scheme.as_str()).ok_or_else(|| {
-                anyhow!("governed fixture request requester identifier is absent after exact-shape validation")
-            })?;
-            validate_governed_fixture_input(
-                &format!("requester.identifiers.{scheme}"),
-                contracts,
-                &Value::String((*value).to_string()),
-            )?;
-        }
-    }
-
-    if let Some(id) = &target.id {
-        validate_governed_fixture_input("target.id", &id_contracts, &Value::String(id.clone()))?;
-    }
-    for (scheme, contracts) in &identifier_contracts {
-        let value = identifiers.get(scheme.as_str()).ok_or_else(|| {
-            anyhow!("governed fixture request target identifier is absent after exact-shape validation")
-        })?;
-        validate_governed_fixture_input(
-            &format!("target.identifiers.{scheme}"),
-            contracts,
-            &Value::String((*value).to_string()),
-        )?;
-    }
-    for (name, contracts) in &attribute_contracts {
-        let value = target.attributes.get(name).ok_or_else(|| {
-            anyhow!("governed fixture request target attribute is absent after exact-shape validation")
-        })?;
-        validate_governed_fixture_input(&format!("target.attributes.{name}"), contracts, value)?;
-    }
-    for (name, contracts) in &variable_contracts {
-        let value = variables.get(name).ok_or_else(|| {
-            anyhow!("governed fixture request omits a variable required by the selected authored inputs")
-        })?;
-        validate_governed_fixture_input(
-            &format!("variables.{name}"),
-            contracts,
-            &Value::String(value.to_string()),
-        )?;
-    }
-    Ok(())
-}
-
-fn validate_governed_requester_type(requester: &GovernedFixtureTarget) -> Result<()> {
-    if !requester.entity_type.eq_ignore_ascii_case("person") {
-        bail!("governed fixture request requester type must be Person");
-    }
-    Ok(())
-}
-
-fn validate_governed_fixture_input(
-    path: &str,
-    contracts: &[GovernedFixtureInputContract<'_>],
-    value: &Value,
-) -> Result<()> {
-    for contract in contracts {
-        validate_fixture_input_value(contract.name, contract.declaration, value).map_err(|_| {
-            anyhow!("governed fixture request {path} violates its selected authored type or bounds")
-        })?;
-    }
-    Ok(())
-}
-
-fn contains_sensitive_request_key(value: &Value) -> bool {
-    match value {
-        Value::Object(object) => object.iter().any(|(key, value)| {
-            matches!(
-                key.to_ascii_lowercase().as_str(),
-                "credential" | "credentials" | "password" | "secret" | "token" | "api_key"
-            ) || contains_sensitive_request_key(value)
-        }),
-        Value::Array(values) => values.iter().any(contains_sensitive_request_key),
-        _ => false,
-    }
-}
-
 pub fn check_registry_project(options: &ProjectCheckOptions) -> Result<ProjectCommandReport> {
     let execution_context = ProjectExecutionContext::for_current_executable()?;
     check_registry_project_with_context(options, &execution_context)
@@ -1016,7 +602,7 @@ fn check_registry_project_internal(
     let compiled = compile_project(&loaded, (!baselines.is_empty()).then_some(&baselines))?;
     validate_generated_product_configs(&compiled)?;
     validate_project_workbook_inputs(&loaded, &compiled)?;
-    let (fixtures, generated_observations, request_observations, call_budget_actual) =
+    let (fixtures, generated_observations, call_budget_actual) =
         execute_all_fixtures_with_coverage_observations(
             &loaded,
             &compiled,
@@ -1030,7 +616,6 @@ fn check_registry_project_internal(
         &loaded,
         &fixtures,
         &generated_observations,
-        &request_observations,
         call_budget_actual,
     )?;
     let authored_values = if include_trusted_local_authored_values {
@@ -1089,15 +674,10 @@ pub fn preflight_registry_project(
         .as_ref()
         .ok_or_else(|| anyhow!("preflight requires an explicit environment"))?;
     let mut input = offline_preflight_input(&loaded, environment, &options.environment)?;
-    let (requires_relay, requires_notary) = project_product_topology(&loaded.project);
-    if requires_relay {
+    if project_requires_relay(&loaded.project) {
         input.require_product(PreflightProduct::RegistryRelay);
         input.record_product_validator_available(PreflightProduct::RegistryRelay);
     }
-    if requires_notary {
-        input.require_product(PreflightProduct::RegistryNotary);
-        input.record_product_validator_available(PreflightProduct::RegistryNotary);
-    }
     Ok(run_offline_preflight(input))
 }
 
@@ -1144,21 +724,11 @@ pub fn inspect_project_capabilities(
             SupportState::Available,
             SupportEvidence::LinkedCrate,
         ),
-        (
-            SupportComponent::RegistryNotaryProduct,
-            SupportState::Available,
-            SupportEvidence::LinkedCrate,
-        ),
         (
             SupportComponent::RegistryRelayValidator,
             SupportState::Available,
             SupportEvidence::LinkedProductValidator,
         ),
-        (
-            SupportComponent::RegistryNotaryValidator,
-            SupportState::Available,
-            SupportEvidence::LinkedProductValidator,
-        ),
         (
             SupportComponent::ProjectAuthoringSchema,
             SupportState::Available,
@@ -1169,11 +739,6 @@ pub fn inspect_project_capabilities(
             SupportState::Available,
             SupportEvidence::EmbeddedSchema,
         ),
-        (
-            SupportComponent::RegistryNotaryConfigSchema,
-            SupportState::Available,
-            SupportEvidence::EmbeddedSchema,
-        ),
         (
             SupportComponent::RegistryctlDistribution,
             SupportState::Available,
@@ -1184,11 +749,6 @@ pub fn inspect_project_capabilities(
             SupportState::NotEvaluated,
             SupportEvidence::NoEvidence,
         ),
-        (
-            SupportComponent::RegistryNotaryImage,
-            SupportState::NotEvaluated,
-            SupportEvidence::NoEvidence,
-        ),
     ] {
         input.record_support(component, state, evidence)?;
     }
@@ -1216,19 +776,12 @@ pub fn inspect_project_capabilities(
             enabled.insert(capability);
         }
     }
-    let (requires_relay, requires_notary) = project_product_topology(&loaded.project);
-    if requires_relay {
+    if project_requires_relay(&loaded.project) {
         declarations.insert(CapabilityId::RegistryRelayProduct);
     }
-    if requires_notary {
-        declarations.insert(CapabilityId::RegistryNotaryProduct);
-    }
     if environment.deployment.relay.is_some() {
         enabled.insert(CapabilityId::RegistryRelayProduct);
     }
-    if environment.deployment.notary.is_some() {
-        enabled.insert(CapabilityId::RegistryNotaryProduct);
-    }
     for capability in declarations {
         input.record_project_declaration(capability)?;
     }
@@ -1257,28 +810,7 @@ pub fn inspect_project_capabilities(
                 .checked_add(1)
                 .ok_or_else(|| anyhow!("capability service count exceeds the report cap"))?;
         }
-        for claim in service.claims.values() {
-            if inferred_claim_evidence(service, claim)? != ClaimEvidence::RegistryBacked {
-                continue;
-            }
-            let consultation_name = claim_consultation_name(service, claim)?;
-            let consultation = service
-                .consultations
-                .get(consultation_name)
-                .ok_or_else(|| anyhow!("registry-backed claim consultation is unavailable"))?;
-            let capability = *integration_capabilities
-                .get(consultation.integration.as_str())
-                .ok_or_else(|| anyhow!("consultation capability is unavailable"))?;
-            let counts = usage.entry(capability).or_default();
-            counts.claims = counts
-                .claims
-                .checked_add(1)
-                .ok_or_else(|| anyhow!("capability claim count exceeds the report cap"))?;
-        }
-        let product = match service.kind {
-            ServiceKind::RecordsApi => CapabilityId::RegistryRelayProduct,
-            ServiceKind::Evidence => CapabilityId::RegistryNotaryProduct,
-        };
+        let product = CapabilityId::RegistryRelayProduct;
         let counts = usage.entry(product).or_default();
         counts.services = counts
             .services
@@ -1288,10 +820,6 @@ pub fn inspect_project_capabilities(
             .consultations
             .checked_add(u32::try_from(service.consultations.len())?)
             .ok_or_else(|| anyhow!("product consultation count exceeds the report cap"))?;
-        counts.claims = counts
-            .claims
-            .checked_add(u32::try_from(service.claims.len())?)
-            .ok_or_else(|| anyhow!("product claim count exceeds the report cap"))?;
     }
     if let Some(script_usage) = usage.get(&CapabilityId::SourceScript).copied() {
         usage.insert(CapabilityId::RhaiRuntime, script_usage);
@@ -1451,36 +979,6 @@ fn offline_preflight_input(
             )?,
         }
     }
-    if let Some(issuance) = &environment.issuance {
-        add_preflight_secret(
-            &mut input,
-            &environment_file,
-            "/issuance/signing_key/secret",
-            &issuance.signing_key,
-            PreflightSecretConsumer::IssuanceSigningKey,
-        )?;
-    }
-    for (caller_id, caller) in &environment.callers {
-        add_preflight_secret(
-            &mut input,
-            &environment_file,
-            &format!(
-                "/callers/{}/api_key_fingerprint/secret",
-                escape_explanation_pointer_segment(caller_id)
-            ),
-            &caller.api_key_fingerprint,
-            PreflightSecretConsumer::CallerApiKeyFingerprint,
-        )?;
-    }
-    if let Some(binding) = &environment.notary_relay {
-        add_preflight_runtime_file(
-            &mut input,
-            &environment_file,
-            "/notary_relay/token_file",
-            &binding.token_file,
-            PreflightRuntimeFileKind::NotaryToRelayToken,
-        )?;
-    }
     if let Some(binding) = &environment.relay_state {
         add_preflight_runtime_file(
             &mut input,
@@ -1490,36 +988,6 @@ fn offline_preflight_input(
             PreflightRuntimeFileKind::RelayStateRootCertificate,
         )?;
     }
-    if let Some(binding) = &environment.notary_state {
-        add_preflight_runtime_file(
-            &mut input,
-            &environment_file,
-            "/notary_state/postgresql/root_certificate_path",
-            &binding.postgresql.root_certificate_path,
-            PreflightRuntimeFileKind::NotaryStateRootCertificate,
-        )?;
-    }
-    if let Some(oid4vci) = &environment.oid4vci {
-        for (reference, consumer, pointer) in [
-            (
-                &oid4vci.client.signing_key,
-                PreflightSecretConsumer::Oid4vciClientSigningKey,
-                "/oid4vci/client/signing_key/secret",
-            ),
-            (
-                &oid4vci.access_token.signing_key,
-                PreflightSecretConsumer::Oid4vciAccessTokenSigningKey,
-                "/oid4vci/access_token/signing_key/secret",
-            ),
-            (
-                &oid4vci.sensitive_state_key,
-                PreflightSecretConsumer::Oid4vciSensitiveStateKey,
-                "/oid4vci/sensitive_state_key/secret",
-            ),
-        ] {
-            add_preflight_secret(&mut input, &environment_file, pointer, reference, consumer)?;
-        }
-    }
     Ok(input)
 }
 
@@ -1642,7 +1110,7 @@ fn build_registry_project_inner(
     let compiled = compile_project(&loaded, (!baselines.is_empty()).then_some(&baselines))?;
     validate_generated_product_configs(&compiled)?;
     let artifact_inputs = validate_project_workbook_inputs(&loaded, &compiled)?;
-    let (fixtures, generated_observations, request_observations, call_budget_actual) =
+    let (fixtures, generated_observations, call_budget_actual) =
         execute_all_fixtures_with_coverage_observations(
             &loaded,
             &compiled,
@@ -1656,7 +1124,6 @@ fn build_registry_project_inner(
         &loaded,
         &fixtures,
         &generated_observations,
-        &request_observations,
         call_budget_actual,
     )?;
     let output = loaded
diff --git a/crates/registryctl/src/project_authoring/compiler/artifacts.rs b/crates/registryctl/src/project_authoring/compiler/artifacts.rs
index 1723c2b55..cb2ab4478 100644
--- a/crates/registryctl/src/project_authoring/compiler/artifacts.rs
+++ b/crates/registryctl/src/project_authoring/compiler/artifacts.rs
@@ -82,7 +82,7 @@ fn compile_project_for_environment(
 
     let mut profiles = Vec::new();
     for (service_id, service) in &loaded.project.services {
-        if service.kind != ServiceKind::Evidence {
+        if service.kind != ServiceKind::ConsultationApi {
             continue;
         }
         for (consultation_name, consultation) in &service.consultations {
@@ -155,10 +155,7 @@ fn compile_project_for_environment(
                 .into_bytes()
                 .into_boxed_slice(),
         );
-        if environment.notary_relay.is_some() {
-            if profiles.is_empty() {
-                relay_consultation_private.clear();
-            }
+        if !profiles.is_empty() {
             let consultation_relay_config = generated_relay_config(
                 loaded,
                 environment_name,
@@ -212,36 +209,6 @@ fn compile_project_for_environment(
     } else {
         relay_consultation_private.clear();
     }
-    let mut notary_private = BTreeMap::new();
-    if let Some(notary_service) = &environment.deployment.notary {
-        let notary_config =
-            generated_notary_config(loaded, environment_name, environment, &profiles)?;
-        notary_private.insert(
-            PathBuf::from("config/notary.yaml"),
-            serde_norway::to_string(&notary_config)?
-                .into_bytes()
-                .into_boxed_slice(),
-        );
-        notary_private.insert(
-            PathBuf::from("descriptors/operations.json"),
-            canonical_json_line(&operational_descriptor(
-                "registry-notary",
-                &notary_service.service,
-                environment.deployment.profile,
-                profiles.len(),
-            ))?
-            .into_boxed_slice(),
-        );
-        notary_private.insert(
-            PathBuf::from("descriptors/secret-consumers.json"),
-            canonical_json_line(&secret_consumer_descriptor(
-                "registry-notary",
-                &notary_config,
-            ))?
-            .into_boxed_slice(),
-        );
-    }
-
     let reviewable_digest = closure_digest(&reviewable)?;
     let relay_digest = (!relay_private.is_empty())
         .then(|| closure_digest(&relay_private))
@@ -249,31 +216,20 @@ fn compile_project_for_environment(
     let relay_consultation_digest = (!relay_consultation_private.is_empty())
         .then(|| closure_digest(&relay_consultation_private))
         .transpose()?;
-    let notary_digest = (!notary_private.is_empty())
-        .then(|| closure_digest(&notary_private))
-        .transpose()?;
     let closure_digests = json!({
         "reviewable": reviewable_digest,
         "relay": relay_digest,
         "relay_consultation": relay_consultation_digest,
-        "notary": notary_digest,
     });
-    let disclosure_profiles = disclosure_review_profiles(&loaded.project);
-    let disclosure_digest = digest_json(
-        &serde_json::to_value(&disclosure_profiles)
-            .context("failed to serialize disclosure review profiles")?,
-    )?;
     let baseline_state = baseline.map(|baseline| &baseline.approval_state);
-    let semantic_changes = semantic_change_records(loaded, baseline_state, &disclosure_digest);
-    let semantic_impact =
-        project_semantic_impact_report(loaded, baseline_state, &disclosure_digest);
+    let semantic_changes = semantic_change_records(loaded, baseline_state);
+    let semantic_impact = project_semantic_impact_report(loaded, baseline_state);
     let entity_materializations = generated_entity_materialization_review(loaded, environment)?;
     let review = json!({
         "schema": REVIEW_SCHEMA,
         "registry": loaded.project.registry.id,
         "compiler_version": env!("CARGO_PKG_VERSION"),
         "baseline": if baseline.is_some() { "verified_signed_bundle" } else { "initial_without_baseline" },
-        "disclosure_profiles": disclosure_profiles,
         "semantic_changes": semantic_changes,
         "environment": environment_name,
         "entity_materializations": entity_materializations,
@@ -294,7 +250,6 @@ fn compile_project_for_environment(
         "report_digest": sha256_uri(&canonical_json_line(&review)?),
         "authored_input_digest": loaded.authored_hash,
         "semantic_digests": loaded.semantic_digests,
-        "disclosure_digest": disclosure_digest,
         "promotion_projection": project_promotion_projection(loaded, environment)?,
         "generated_closure_digests": closure_digests,
         "baseline": baselines.filter(|baselines| !baselines.is_empty()).map(|baselines| json!({
@@ -306,8 +261,6 @@ fn compile_project_for_environment(
     let fixture_profiles = profiles
         .iter()
         .map(|profile| FixtureProfile {
-            service_id: profile.service_id.clone(),
-            consultation_id: profile.consultation_name.clone(),
             integration_alias: profile.integration_alias.clone(),
             id: profile.id.clone(),
             version: profile.version.clone(),
@@ -321,7 +274,6 @@ fn compile_project_for_environment(
         reviewable,
         relay_private,
         relay_consultation_private,
-        notary_private,
         review,
         approval_state,
         explanation,
@@ -339,7 +291,6 @@ fn operational_descriptor(
 ) -> Value {
     let config = match product {
         "registry-relay" => "config/relay.yaml",
-        "registry-notary" => "config/notary.yaml",
         _ => "config.yaml",
     };
     json!({
@@ -2461,10 +2412,10 @@ fn consultation_contract_document(
         "output": pack_spec.get("output"),
         "authorization": {
             "workload": environment
-                .notary_relay
+                .relay
                 .as_ref()
-                .ok_or_else(|| anyhow!("Notary-to-Relay workload binding is absent"))?
-                .workload_client_id,
+                .and_then(|relay| relay.allowed_clients.first())
+                .ok_or_else(|| anyhow!("Relay consultation client is absent"))?,
             "required_scope": bounded_scope(&["registry", "consult", service_id])?,
             "purposes": [service.purpose.as_str()],
             "legal_basis": service.legal_basis,
diff --git a/crates/registryctl/src/project_authoring/compiler/claim_semantics.rs b/crates/registryctl/src/project_authoring/compiler/claim_semantics.rs
new file mode 100644
index 000000000..21dfb347a
--- /dev/null
+++ b/crates/registryctl/src/project_authoring/compiler/claim_semantics.rs
@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: Apache-2.0
+
+// Shared CEL authoring semantics for Relay consultation and attribute-release
+// expressions.
+
+#[derive(Debug, Default, PartialEq, Eq)]
+struct CelReferences {
+    roots: BTreeSet<String>,
+    first_level_members: BTreeMap<String, BTreeSet<String>>,
+    uses_index: bool,
+}
+
+fn cel_references(expression: &str) -> Result<CelReferences> {
+    let program = cel::Program::compile(expression)
+        .map_err(|_| anyhow!("CEL expression contains invalid syntax"))?;
+    let mut references = CelReferences::default();
+    collect_cel_references(program.expression(), &BTreeSet::new(), &mut references);
+    Ok(references)
+}
+
+fn cel_member_roots(expression: &str) -> Result<BTreeSet<String>> {
+    Ok(cel_references(expression)?.roots)
+}
+
+fn collect_cel_references(
+    expression: &IdedExpr,
+    locals: &BTreeSet<String>,
+    references: &mut CelReferences,
+) {
+    match &expression.expr {
+        Expr::Unspecified | Expr::Literal(_) => {}
+        Expr::Ident(name) => {
+            if !name.starts_with('@') && !locals.contains(name) {
+                references.roots.insert(name.clone());
+            }
+        }
+        Expr::Select(select) => {
+            if let Expr::Ident(root) = &select.operand.expr {
+                if !root.starts_with('@') && !locals.contains(root) {
+                    references
+                        .first_level_members
+                        .entry(root.clone())
+                        .or_default()
+                        .insert(select.field.clone());
+                }
+            }
+            collect_cel_references(&select.operand, locals, references);
+        }
+        Expr::Call(call) => {
+            if matches!(
+                call.func_name.as_str(),
+                cel::common::ast::operators::INDEX | cel::common::ast::operators::OPT_INDEX
+            ) {
+                references.uses_index = true;
+            }
+            if let Some(target) = &call.target {
+                collect_cel_references(target, locals, references);
+            }
+            for argument in &call.args {
+                collect_cel_references(argument, locals, references);
+            }
+        }
+        Expr::List(list) => {
+            for element in &list.elements {
+                collect_cel_references(element, locals, references);
+            }
+        }
+        Expr::Map(map) => {
+            for entry in &map.entries {
+                collect_cel_entry_references(&entry.expr, locals, references);
+            }
+        }
+        Expr::Struct(value) => {
+            for entry in &value.entries {
+                collect_cel_entry_references(&entry.expr, locals, references);
+            }
+        }
+        Expr::Comprehension(comprehension) => {
+            collect_cel_references(&comprehension.iter_range, locals, references);
+            collect_cel_references(&comprehension.accu_init, locals, references);
+
+            let mut scoped_locals = locals.clone();
+            scoped_locals.insert(comprehension.iter_var.clone());
+            if let Some(iter_var) = &comprehension.iter_var2 {
+                scoped_locals.insert(iter_var.clone());
+            }
+            scoped_locals.insert(comprehension.accu_var.clone());
+            collect_cel_references(&comprehension.loop_cond, &scoped_locals, references);
+            collect_cel_references(&comprehension.loop_step, &scoped_locals, references);
+            collect_cel_references(&comprehension.result, &scoped_locals, references);
+        }
+    }
+}
+
+fn collect_cel_entry_references(
+    entry: &EntryExpr,
+    locals: &BTreeSet<String>,
+    references: &mut CelReferences,
+) {
+    match entry {
+        EntryExpr::StructField(field) => {
+            collect_cel_references(&field.value, locals, references);
+        }
+        EntryExpr::MapEntry(entry) => {
+            collect_cel_references(&entry.key, locals, references);
+            collect_cel_references(&entry.value, locals, references);
+        }
+    }
+}
diff --git a/crates/registryctl/src/project_authoring/compiler/explanation.rs b/crates/registryctl/src/project_authoring/compiler/explanation.rs
index f3aedd21b..a05b31e25 100644
--- a/crates/registryctl/src/project_authoring/compiler/explanation.rs
+++ b/crates/registryctl/src/project_authoring/compiler/explanation.rs
@@ -147,7 +147,6 @@ enum ApprovedSemanticValue {
     Capability,
     Count,
     DeclarationClass,
-    DisclosureClass,
     HumanIntent,
     Limit,
     Policy,
@@ -402,12 +401,7 @@ fn generated_explanation(
                 &environment_document,
                 ExplanationSource::EnvironmentBound,
             )?;
-            add_environment_effective_fields(
-                &mut builder,
-                environment_name,
-                environment,
-                &environment_document,
-            )?;
+            add_environment_effective_fields(&mut builder, environment_name, environment)?;
         }
     }
 
@@ -531,12 +525,10 @@ fn add_project_topology_fields(
     loaded: &LoadedRegistryProject,
 ) -> Result<()> {
     let scope = ExplanationAddressScope::Project;
-    let (requires_relay, requires_notary) = project_product_topology(&loaded.project);
-    let topology = match (requires_relay, requires_notary) {
-        (true, false) => "relay_only",
-        (false, true) => "notary_only",
-        (true, true) => "combined",
-        (false, false) => "none",
+    let requires_relay = project_has_relay_topology(&loaded.project);
+    let topology = match requires_relay {
+        true => "relay_only",
+        false => "none",
     };
     add_derived_scalar(
         builder,
@@ -574,16 +566,6 @@ fn add_project_topology_fields(
                 .filter(|service| service.kind == ServiceKind::RecordsApi)
                 .count(),
         ),
-        (
-            "/topology/evidence_service_count",
-            "/properties/services",
-            loaded
-                .project
-                .services
-                .values()
-                .filter(|service| service.kind == ServiceKind::Evidence)
-                .count(),
-        ),
     ] {
         add_derived_scalar(
             builder,
@@ -597,49 +579,19 @@ fn add_project_topology_fields(
         )?;
     }
     for (service_id, service) in &loaded.project.services {
-        for (name, count) in [
-            ("consultation_count", service.consultations.len()),
-            ("claim_count", service.claims.len()),
-            (
-                "credential_profile_count",
-                service.credential_profiles.len(),
+        add_derived_scalar(
+            builder,
+            &scope,
+            &format!(
+                "/services/{}/consultation_count",
+                escape_explanation_pointer_segment(service_id)
             ),
-        ] {
-            add_derived_scalar(
-                builder,
-                &scope,
-                &format!(
-                    "/services/{}/{name}",
-                    escape_explanation_pointer_segment(service_id)
-                ),
-                knowledge::SchemaKind::Project,
-                "/properties/services",
-                ExplanationScalar::Unsigned(count as u64),
-                ApprovedSemanticValue::Count,
-                "compiler.service_contract_count",
-            )?;
-        }
-        for (claim_id, claim) in &service.claims {
-            // This is the compiler's authored dependency classification. It
-            // does not assert live Relay activation or interoperability.
-            let evidence = match inferred_claim_evidence(service, claim)? {
-                ClaimEvidence::RegistryBacked => "registry_backed",
-            };
-            add_derived_scalar(
-                builder,
-                &scope,
-                &format!(
-                    "/services/{}/claims/{}/evidence",
-                    escape_explanation_pointer_segment(service_id),
-                    escape_explanation_pointer_segment(claim_id)
-                ),
-                knowledge::SchemaKind::Project,
-                "/$defs/evidenceService/properties/claims",
-                ExplanationScalar::Text(evidence.to_owned()),
-                ApprovedSemanticValue::DeclarationClass,
-                "compiler.claim_evidence_dependency",
-            )?;
-        }
+            knowledge::SchemaKind::Project,
+            "/properties/services",
+            ExplanationScalar::Unsigned(service.consultations.len() as u64),
+            ApprovedSemanticValue::Count,
+            "compiler.service_contract_count",
+        )?;
     }
     Ok(())
 }
@@ -864,30 +816,18 @@ fn add_environment_effective_fields(
     builder: &mut ExplanationBuilder<'_>,
     environment_name: &str,
     environment: &EnvironmentDocument,
-    authored: &Value,
 ) -> Result<()> {
     let scope = ExplanationAddressScope::Environment(environment_name.to_owned());
-    for (path, present) in [
-        (
-            "/topology/relay_bound",
-            environment.deployment.relay.is_some(),
-        ),
-        (
-            "/topology/notary_bound",
-            environment.deployment.notary.is_some(),
-        ),
-    ] {
-        add_derived_scalar(
-            builder,
-            &scope,
-            path,
-            knowledge::SchemaKind::Environment,
-            "/properties/deployment",
-            ExplanationScalar::Boolean(present),
-            ApprovedSemanticValue::ProductTopology,
-            "compiler.environment_product_binding",
-        )?;
-    }
+    add_derived_scalar(
+        builder,
+        &scope,
+        "/topology/relay_bound",
+        knowledge::SchemaKind::Environment,
+        "/properties/deployment",
+        ExplanationScalar::Boolean(environment.deployment.relay.is_some()),
+        ApprovedSemanticValue::ProductTopology,
+        "compiler.environment_product_binding",
+    )?;
     for (integration_id, integration) in &environment.integrations {
         add_derived_scalar(
             builder,
@@ -915,60 +855,9 @@ fn add_environment_effective_fields(
             "compiler.credential_class",
         )?;
     }
-    if let Some(issuance) = &environment.issuance {
-        add_effective_environment_default(
-            builder,
-            &scope,
-            "/issuance/algorithm",
-            "/properties/issuance/properties/algorithm",
-            ExplanationScalar::Text(issuance.algorithm.as_str().to_owned()),
-            ExplanationScalar::Text("EdDSA".to_owned()),
-            authored.pointer("/issuance/algorithm").is_some(),
-            ApprovedSemanticValue::DeclarationClass,
-        )?;
-    }
-    if let Some(oid4vci) = &environment.oid4vci {
-        add_effective_environment_default(
-            builder,
-            &scope,
-            "/oid4vci/tx_code/required",
-            "/$defs/oid4vci/properties/tx_code/properties/required",
-            ExplanationScalar::Boolean(oid4vci.tx_code.required),
-            ExplanationScalar::Boolean(true),
-            authored.pointer("/oid4vci/tx_code/required").is_some(),
-            ApprovedSemanticValue::Policy,
-        )?;
-    }
     Ok(())
 }
 
-#[allow(clippy::too_many_arguments)]
-fn add_effective_environment_default(
-    builder: &mut ExplanationBuilder<'_>,
-    scope: &ExplanationAddressScope,
-    data_path: &str,
-    schema_path: &str,
-    value: ExplanationScalar,
-    default: ExplanationScalar,
-    authored: bool,
-    approval: ApprovedSemanticValue,
-) -> Result<()> {
-    builder.add(PendingExplanationField {
-        scope: scope.clone(),
-        data_path: data_path.to_owned(),
-        schema_kind: knowledge::SchemaKind::Environment,
-        schema_path: schema_path.to_owned(),
-        source: if authored {
-            ExplanationSource::EnvironmentBound
-        } else {
-            ExplanationSource::Defaulted
-        },
-        value: Some(value),
-        approval: Some(approval),
-        default: Some((FieldDefaultSource::AuthoringSchema, !authored, default)),
-    })
-}
-
 #[allow(clippy::too_many_arguments)]
 fn add_derived_scalar(
     builder: &mut ExplanationBuilder<'_>,
@@ -1410,12 +1299,6 @@ fn approved_authored_semantic_value(
                 || schema_path.ends_with("/properties/value/properties/type")
             {
                 Some(ApprovedSemanticValue::DeclarationClass)
-            } else if schema_path.ends_with("/properties/disclosure")
-                || schema_path.ends_with("/properties/default")
-                || (schema_path.ends_with("/properties/allowed/items")
-                    && schema_path.contains("disclosure"))
-            {
-                Some(ApprovedSemanticValue::DisclosureClass)
             } else if schema_path.ends_with("/properties/version")
                 && !matches!(value, ExplanationScalar::Text(_))
             {
@@ -1639,27 +1522,6 @@ mod explanation_tests {
             .expect("integration explanation field exists")
     }
 
-    fn project_public_text<'a>(report: &'a ProjectExplanationReportV1, path: &str) -> &'a str {
-        let field = report
-            .fields
-            .iter()
-            .find(|field| {
-                matches!(
-                    &field.address,
-                    ProjectFieldAddress::Project { path: actual_path }
-                        if actual_path.as_str() == path
-                )
-            })
-            .expect("project explanation field exists");
-        let ClassifierSafeReportedValue::Public { value } = &field.reported_value else {
-            panic!("classifier-approved project classification is public");
-        };
-        value
-            .as_value()
-            .as_str()
-            .expect("project classification is text")
-    }
-
     #[test]
     fn trusted_local_terminal_rendering_fails_closed_for_prohibited_internal_states() {
         const SENTINEL: &str = "TRUSTED_LOCAL_PROHIBITED_SENTINEL";
@@ -1690,8 +1552,11 @@ mod explanation_tests {
         };
         let parser = ProjectTrustedLocalAuthoredValue {
             address: ProjectFieldAddress::Project {
-                path: JsonPointer::new("/services/example/claims/example/cel".to_owned())
-                    .expect("pointer is valid"),
+                path: JsonPointer::new(
+                    "/services/example/api/attribute_release_profiles/example/release_conditions/expression/cel"
+                        .to_owned(),
+                )
+                .expect("pointer is valid"),
             },
             source: FieldSourceKind::Authored,
             sensitivity: FieldSensitivity::Internal,
@@ -1753,10 +1618,6 @@ mod explanation_tests {
             .knowledge
             .generated_artifacts
             .contains(&FieldGeneratedArtifact::RelayConfig));
-        assert!(request_bytes
-            .knowledge
-            .generated_artifacts
-            .contains(&FieldGeneratedArtifact::NotaryConfig));
 
         let calls = integration_field(&report, "person-record", "/limits/calls");
         assert_eq!(calls.source.kind, FieldSourceKind::Derived);
@@ -1800,7 +1661,7 @@ mod explanation_tests {
         assert!(purpose
             .knowledge
             .consumers
-            .contains(&FieldKnowledgeConsumer::RegistryNotary));
+            .contains(&FieldKnowledgeConsumer::RegistryRelay));
         let ClassifierSafeReportedValue::Public { value } = &purpose.reported_value else {
             panic!("classifier-approved human intent is public");
         };
@@ -1808,37 +1669,6 @@ mod explanation_tests {
             value.as_value(),
             &json!("public-service-person-verification")
         );
-        assert_eq!(
-            project_public_text(
-                &report,
-                "/services/person-verification/claims/person-active/evidence"
-            ),
-            "registry_backed"
-        );
-        assert_eq!(
-            project_public_text(
-                &report,
-                "/services/person-verification/claims/person-record-exists/evidence"
-            ),
-            "registry_backed"
-        );
-        let issuance_algorithm = report
-            .fields
-            .iter()
-            .find(|field| {
-                matches!(
-                    &field.address,
-                    ProjectFieldAddress::Environment { path, .. }
-                        if path.as_str() == "/issuance/algorithm"
-                )
-            })
-            .expect("effective issuance algorithm exists");
-        assert_eq!(issuance_algorithm.source.kind, FieldSourceKind::Defaulted);
-        assert!(issuance_algorithm
-            .default
-            .as_ref()
-            .is_some_and(|default| default.applied));
-
         let serialized_once = serde_json::to_vec(&report).expect("report serializes");
         let serialized_twice = serde_json::to_vec(
             &generated_explanation(&loaded, "local")
@@ -1869,29 +1699,22 @@ integrations:
       credential:
         token: { secret: SECRET_REFERENCE_SENTINEL }
         generation: 77
-issuance:
-  issuer: did:web:ISSUER_SENTINEL.invalid
-  signing_kid: SIGNING_ID_SENTINEL
-  signing_key: { secret: SIGNING_SECRET_SENTINEL }
-  generation: 88
-callers:
-  evidence-client:
-    api_key_fingerprint: { secret: CALLER_SECRET_SENTINEL }
-    scopes: ["evidence:person:read"]
+      mtls:
+        certificate_file: /etc/registry/SOURCE_CERTIFICATE_SENTINEL.pem
+        private_key: { secret: SOURCE_PRIVATE_KEY_SENTINEL }
+        generation: 78
 relay:
   origin: https://RELAY_ORIGIN_SENTINEL.invalid
   issuer: https://ENDPOINT_SENTINEL.invalid
   jwks_url: https://ENDPOINT_SENTINEL.invalid/JWKS_PATH_SENTINEL
   audience: CLIENT_ID_SENTINEL
   allowed_clients: [CLIENT_ID_SENTINEL]
-notary_relay:
-  base_url: http://127.0.0.1:8080
-  workload_client_id: CLIENT_ID_SENTINEL
-  token_file: /ABSOLUTE/RUNTIME/FILE/PATH_SENTINEL
+  consultation:
+    client_id: CONSULTATION_CLIENT_ID_SENTINEL
+    principal_id: PRINCIPAL_ID_SENTINEL
 deployment:
   profile: local
   relay: { service: fictional-registry-relay }
-  notary: { service: fictional-registry-notary }
 "#,
         )
         .expect("sentinel environment writes");
@@ -1952,21 +1775,9 @@ interactions:
 expect:
   outcome: match
   outputs: { active: true }
-  claims: { person-record-exists: true, person-active: true }
 "#,
         )
         .expect("sentinel fixture writes");
-        let project_path = temporary.path().join(PROJECT_FILE);
-        let project = fs::read_to_string(&project_path).expect("project reads");
-        fs::write(
-            &project_path,
-            project.replace(
-                "cel: person_record.matched",
-                "cel: 'person_record.matched && \"CEL_SENTINEL\" == \"CEL_SENTINEL\"'",
-            ),
-        )
-        .expect("sentinel project writes");
-
         let loaded =
             load_registry_project(temporary.path(), Some("local")).expect("sentinel project loads");
         let report =
@@ -1976,13 +1787,13 @@ expect:
             "ORIGIN_SENTINEL",
             "10.77.0.0/16",
             "SECRET_REFERENCE_SENTINEL",
-            "SIGNING_SECRET_SENTINEL",
-            "CALLER_SECRET_SENTINEL",
-            "SIGNING_ID_SENTINEL",
+            "SOURCE_CERTIFICATE_SENTINEL",
+            "SOURCE_PRIVATE_KEY_SENTINEL",
             "ENDPOINT_SENTINEL",
             "JWKS_PATH_SENTINEL",
             "CLIENT_ID_SENTINEL",
-            "/ABSOLUTE/RUNTIME/FILE/PATH_SENTINEL",
+            "CONSULTATION_CLIENT_ID_SENTINEL",
+            "PRINCIPAL_ID_SENTINEL",
             "REQUEST/PATH/SENTINEL",
             "QUERY_SENTINEL",
             "QUERY_VALUE_SENTINEL",
@@ -1992,7 +1803,6 @@ expect:
             "SOURCE_VALUE_SENTINEL",
             "FIXTURE_INPUT_SENTINEL",
             "FIXTURE_BODY_SENTINEL",
-            "CEL_SENTINEL",
         ] {
             assert!(
                 !serialized.contains(sentinel),
@@ -2037,7 +1847,7 @@ expect:
             .map(|field| serde_json::to_string(&field.value).expect("scalar serializes"))
             .collect::<Vec<_>>()
             .join("\n");
-        for visible in ["ORIGIN_SENTINEL", "ISSUER_SENTINEL"] {
+        for visible in ["ORIGIN_SENTINEL", "SOURCE_CERTIFICATE_SENTINEL"] {
             assert!(
                 trusted_values.contains(visible),
                 "trusted-local review should expose authored non-secret metadata {visible}"
@@ -2045,14 +1855,11 @@ expect:
         }
         for hidden in [
             "SECRET_REFERENCE_SENTINEL",
-            "SIGNING_SECRET_SENTINEL",
-            "CALLER_SECRET_SENTINEL",
+            "SOURCE_PRIVATE_KEY_SENTINEL",
             "FIXTURE_INPUT_SENTINEL",
             "FIXTURE_BODY_SENTINEL",
-            "/ABSOLUTE/RUNTIME/FILE/PATH_SENTINEL",
             "REQUEST_PAYLOAD_SENTINEL",
             "SOURCE_VALUE_SENTINEL",
-            "CEL_SENTINEL",
         ] {
             assert!(
                 !trusted_values.contains(hidden),
diff --git a/crates/registryctl/src/project_authoring/compiler/notary.rs b/crates/registryctl/src/project_authoring/compiler/notary.rs
deleted file mode 100644
index 8093d8317..000000000
--- a/crates/registryctl/src/project_authoring/compiler/notary.rs
+++ /dev/null
@@ -1,1398 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-fn generated_notary_config(
-    loaded: &LoadedRegistryProject,
-    environment_name: &str,
-    environment: &EnvironmentDocument,
-    profiles: &[GeneratedProfile],
-) -> Result<Value> {
-    let notary_service = environment
-        .deployment
-        .notary
-        .as_ref()
-        .ok_or_else(|| anyhow!("Notary deployment binding is absent"))?;
-    let mut variables = Map::new();
-    let mut claims = Vec::new();
-    let mut credential_profiles = Map::new();
-    let mut allowed_purposes = BTreeSet::new();
-    let mut seen_claims = BTreeSet::new();
-    let mut max_validity_seconds = 600_u64;
-    for (service_id, service) in &loaded.project.services {
-        if service.kind != ServiceKind::Evidence {
-            continue;
-        }
-        let notary_consultation_aliases =
-            generated_notary_consultation_aliases(service.consultations.keys().map(String::as_str));
-        allowed_purposes.insert(service.purpose.clone());
-        for (name, variable) in &service.variables {
-            let declaration = json!({ "from": variable.from, "type": "date" });
-            if variables
-                .insert(name.clone(), declaration.clone())
-                .is_some_and(|prior| prior != declaration)
-            {
-                bail!("request variable has conflicting service declarations");
-            }
-        }
-        for (credential_id, credential) in &service.credential_profiles {
-            validate_compiler_credential_profile_evidence(
-                service_id,
-                credential_id,
-                service,
-                credential,
-            )?;
-            let issuance = environment
-                .issuance
-                .as_ref()
-                .ok_or_else(|| anyhow!("Notary issuance binding is absent"))?;
-            let profile_id = bounded_join_id(&[service_id, credential_id])?;
-            let validity_seconds = parse_validity_seconds(&credential.validity)?;
-            max_validity_seconds = max_validity_seconds.max(validity_seconds);
-            let mut generated_profile = json!({
-                "format": normalize_credential_format(&credential.format),
-                "issuer": issuance.issuer,
-                "signing_key": "project-issuer",
-                "vct": credential.credential_type,
-                "validity_seconds": validity_seconds,
-                "allowed_claims": credential.claims,
-                "disclosure": { "allowed": ["value", "predicate", "redacted"] },
-            });
-            if environment.oid4vci.as_ref().is_some_and(|binding| {
-                binding.credential.service == *service_id
-                    && binding.credential.profile == *credential_id
-            }) {
-                generated_profile["holder_binding"] = json!({
-                    "mode": "did",
-                    "proof_of_possession": "required",
-                    "allowed_did_methods": ["did:jwk"],
-                });
-            }
-            credential_profiles.insert(profile_id, generated_profile);
-        }
-        for (claim_id, claim) in &service.claims {
-            if !seen_claims.insert(claim_id) {
-                bail!("Notary claim ids must be unique across project services");
-            }
-            let claim_credential_profiles = service
-                .credential_profiles
-                .iter()
-                .filter(|(_, credential)| credential.claims.iter().any(|id| id == claim_id))
-                .map(|(credential, _)| bounded_join_id(&[service_id, credential]))
-                .collect::<Result<Vec<_>>>()?;
-            // Claim formats describe evaluation renderers, not credential
-            // issuance. SD-JWT VC stays on the credential profile it belongs
-            // to, so every generated claim retains the canonical evaluation
-            // response format.
-            let formats = vec!["application/vnd.registry-notary.claim-result+json".to_string()];
-            let (default_disclosure, allowed_disclosures) = expanded_disclosure(&claim.disclosure);
-            let (evidence_mode, value_type, nullable, value_max_bytes, rule) =
-                match inferred_claim_evidence(service, claim)? {
-                    ClaimEvidence::RegistryBacked => {
-                        let consultation_name = claim_consultation_name(service, claim)?;
-                        let notary_consultation_name = notary_consultation_aliases
-                            .get(consultation_name)
-                            .ok_or_else(|| {
-                                anyhow!("generated Notary consultation alias is absent")
-                            })?;
-                        let consultation = &service.consultations[consultation_name];
-                        let integration = &loaded.integrations[&consultation.integration];
-                        let profile = profiles
-                            .iter()
-                            .find(|profile| {
-                                profile.service_id == *service_id
-                                    && profile.consultation_name == consultation_name
-                            })
-                            .ok_or_else(|| anyhow!("claim consultation profile is absent"))?;
-                        let outputs = generated_notary_output_contracts(&integration.document)?;
-                        let (value_type, nullable, rule) = generated_notary_claim_rule(
-                            claim_id,
-                            claim,
-                            consultation_name,
-                            notary_consultation_name,
-                            &integration.document,
-                            integration,
-                        )?;
-                        let inputs = consultation
-                            .input
-                            .iter()
-                            .map(|(name, source)| {
-                                (
-                                    name.clone(),
-                                    Value::String(if source == "request.target.id" {
-                                        "target.id".to_string()
-                                    } else {
-                                        source.clone()
-                                    }),
-                                )
-                            })
-                            .collect::<Map<String, Value>>();
-                        let consultation_config = json!({
-                            "profile": {
-                                "id": profile.id,
-                                "contract_hash": profile.contract.artifact().typed_hash(),
-                            },
-                            "inputs": inputs,
-                            "outputs": outputs,
-                        });
-                        let consultations = Map::from_iter([(
-                            notary_consultation_name.clone(),
-                            consultation_config,
-                        )]);
-                        (
-                            json!({ "type": "registry_backed", "consultations": consultations }),
-                            value_type,
-                            nullable,
-                            None::<u32>,
-                            rule,
-                        )
-                    }
-                };
-            let mut claim_value = json!({ "type": value_type, "nullable": nullable });
-            if let Some(max_bytes) = value_max_bytes {
-                claim_value["max_bytes"] = json!(max_bytes);
-            }
-            let depends_on =
-                representative_claim_dependencies(environment, service_id, claim_id, service);
-            let mut generated_claim = json!({
-                "id": claim_id,
-                "title": claim_id.replace('-', " "),
-                "version": service.version.to_string(),
-                "subject_type": service.effective_subject_type().as_str(),
-                "evidence_mode": evidence_mode,
-                "value": claim_value,
-                "purpose": service.purpose,
-                "required_scopes": service.access.scopes,
-                "rule": rule,
-                "disclosure": {
-                    "default": default_disclosure,
-                    "allowed": allowed_disclosures,
-                    "downgrade": "deny",
-                },
-                "formats": formats,
-                "credential_profiles": claim_credential_profiles,
-            });
-            if !depends_on.is_empty() {
-                generated_claim["depends_on"] = json!(depends_on);
-            }
-            claims.push(generated_claim);
-        }
-    }
-    let api_keys = environment
-        .callers
-        .iter()
-        .map(|(id, caller)| {
-            json!({
-                "id": id,
-                "fingerprint": {
-                    "provider": "env",
-                    "name": caller.api_key_fingerprint.secret,
-                },
-                "scopes": caller.scopes,
-            })
-        })
-        .collect::<Vec<_>>();
-    let mut evidence = json!({
-        "enabled": true,
-        "service_id": notary_service.service,
-        "max_credential_validity_seconds": max_validity_seconds,
-        "allowed_purposes": allowed_purposes,
-        "variables": variables,
-        "claims": claims,
-        "credential_profiles": credential_profiles,
-    });
-    let mut signing_keys = Map::new();
-    if let Some(issuance) = &environment.issuance {
-        signing_keys.insert(
-            "project-issuer".to_string(),
-            json!({
-                "provider": "local_jwk_env",
-                "private_jwk_env": issuance.signing_key.secret,
-                "alg": issuance.algorithm.as_str(),
-                "kid": issuance.signing_kid,
-                "status": "active",
-            }),
-        );
-    }
-    if let Some(binding) = &environment.oid4vci {
-        signing_keys.insert(
-            "oid4vci-access-token".to_string(),
-            json!({
-                "provider": "local_jwk_env",
-                "private_jwk_env": binding.access_token.signing_key.secret,
-                "alg": "EdDSA",
-                "kid": binding.access_token.signing_kid,
-                "status": "active",
-            }),
-        );
-        signing_keys.insert(
-            "oid4vci-esignet-client".to_string(),
-            json!({
-                "provider": "local_jwk_env",
-                "private_jwk_env": binding.client.signing_key.secret,
-                "alg": "RS256",
-                "kid": binding.client.signing_kid,
-                "status": "active",
-            }),
-        );
-    }
-    if !signing_keys.is_empty() {
-        evidence["signing_keys"] = Value::Object(signing_keys);
-    }
-    if let Some(connection) = &environment.notary_relay {
-        let base_url = normalize_url_scheme(&connection.base_url)?;
-        let local_notary_add_on = matches!(
-            environment.deployment.profile,
-            DeploymentProfile::Local
-        ) && connection.base_url == LOCAL_NOTARY_RELAY_BASE_URL
-            && connection.workload_client_id == LOCAL_NOTARY_RELAY_CLIENT_ID
-            && connection.token_file == Path::new(LOCAL_NOTARY_RELAY_TOKEN_FILE);
-        let private_service_http = url::Url::parse(&base_url).is_ok_and(|url| {
-            url.scheme() == "http" && matches!(url.host(), Some(url::Host::Domain(_)))
-        });
-        evidence["relay"] = json!({
-            "base_url": base_url,
-            "workload_client_id": connection.workload_client_id,
-            "token_file": connection.token_file,
-            "allowed_private_cidrs": if local_notary_add_on {
-                vec![LOCAL_NOTARY_RELAY_PRIVATE_CIDR]
-            } else {
-                Vec::new()
-            },
-            "allow_insecure_localhost": !local_notary_add_on
-                && !private_service_http
-                && url_uses_http(&connection.base_url),
-            "allow_insecure_private_network": private_service_http,
-            "max_in_flight": 8,
-        });
-    }
-    let mut state = if environment.notary_state.is_some() {
-        let state_defaults = StatePostgresqlConfig::default();
-        json!({
-            "storage": "postgresql",
-            "postgresql": {
-                // Keep the environment-backed database secret discoverable in the
-                // generated consumer descriptor. Runtime policy uses Notary's
-                // authoritative defaults unless the project gains an explicit
-                // operator-facing override.
-                "url_env": state_defaults.url_env,
-            },
-        })
-    } else {
-        json!({ "storage": "in_memory" })
-    };
-    if let Some(binding) = &environment.notary_state {
-        state["postgresql"]["root_certificate_path"] = Value::String(
-            binding
-                .postgresql
-                .root_certificate_path
-                .to_string_lossy()
-                .into_owned(),
-        );
-    }
-    if state["postgresql"].is_object() {
-        if let Some(binding) = &environment.oid4vci {
-            state["postgresql"]["sensitive_state_key_env"] =
-                Value::String(binding.sensitive_state_key.secret.clone());
-        }
-    }
-
-    let mut instance = json!({
-        "id": notary_service.service,
-        "environment": environment_name,
-    });
-    let mut auth = json!({ "api_keys": api_keys });
-    if let Some(binding) = &environment.oid4vci {
-        let public_base_url = binding.public_base_url.trim_end_matches('/');
-        let allowed_clients = std::iter::once(binding.client.id.as_str())
-            .chain(binding.registrar_clients.iter().map(String::as_str))
-            .collect::<Vec<_>>();
-        instance["public_base_url"] = Value::String(public_base_url.to_string());
-        evidence["api_base_url"] = Value::String(public_base_url.to_string());
-        auth["oidc"] = json!({
-            "issuer": binding.authorization_server.issuer,
-            "jwks_url": binding.authorization_server.jwks_url,
-            "userinfo_endpoint": binding.authorization_server.userinfo_url,
-            "audiences": [binding.client.id.as_str(), public_base_url],
-            "allowed_clients": allowed_clients,
-            "allowed_algorithms": ["RS256"],
-            "allowed_token_types": ["JWT"],
-            "scope_claim": "scope",
-            "scope_separator": " ",
-            "principal_claim": "sub",
-            "leeway": "60s",
-            "allow_insecure_localhost": url_uses_http(&binding.authorization_server.issuer),
-        });
-        auth["access_token_signing"] = json!({
-            "enabled": true,
-            "issuer": public_base_url,
-            "audiences": [public_base_url],
-            "allowed_algorithms": ["EdDSA"],
-            "token_typ": "registry-notary-access+jwt",
-            "signing_key_id": "oid4vci-access-token",
-            "access_token_ttl_seconds": 300,
-        });
-    }
-    let mut generated = json!({
-        "instance": instance,
-        "server": { "bind": "0.0.0.0:8081", "request_timeout": "30s" },
-        "auth": auth,
-        "audit": {
-            "sink": "file",
-            "path": "/var/lib/registry/audit/audit.jsonl",
-            "hash_secret_env": "REGISTRY_NOTARY_AUDIT_HASH_SECRET",
-        },
-        "state": state,
-        "evidence": evidence,
-        "deployment": { "profile": environment.deployment.profile.as_str() },
-    });
-    if let Some(binding) = &environment.notary_cel {
-        generated["cel"] = json!({
-            "worker_memory_bytes": binding.worker_memory_bytes,
-        });
-    }
-    if let Some(binding) = &environment.oid4vci {
-        add_oid4vci_config(&mut generated, loaded, binding)?;
-    }
-    Ok(generated)
-}
-
-fn validate_compiler_credential_profile_evidence(
-    service_id: &str,
-    credential_id: &str,
-    service: &ServiceDeclaration,
-    credential: &CredentialProfileDeclaration,
-) -> Result<()> {
-    for claim_id in &credential.claims {
-        let claim = service.claims.get(claim_id).ok_or_else(|| {
-            anyhow!(
-                "credential profile {service_id}.{credential_id} references absent claim {claim_id}"
-            )
-        })?;
-        inferred_claim_evidence(service, claim).with_context(|| {
-            format!(
-                "credential profile {service_id}.{credential_id} requires claim {claim_id} to reference a declared Relay consultation"
-            )
-        })?;
-    }
-    Ok(())
-}
-
-fn representative_claim_dependencies(
-    environment: &EnvironmentDocument,
-    service_id: &str,
-    claim_id: &str,
-    service: &ServiceDeclaration,
-) -> Vec<String> {
-    let Some(binding) = environment.oid4vci.as_ref() else {
-        return Vec::new();
-    };
-    let Some(representative) = binding.representative_issuance.as_ref() else {
-        return Vec::new();
-    };
-    if binding.credential.service != service_id {
-        return Vec::new();
-    }
-    let Some(credential) = service.credential_profiles.get(&binding.credential.profile) else {
-        return Vec::new();
-    };
-    if credential.claims.first().is_none_or(|root| root != claim_id) {
-        return Vec::new();
-    }
-    vec![representative.proof_claim.clone()]
-}
-
-fn add_oid4vci_config(
-    generated: &mut Value,
-    loaded: &LoadedRegistryProject,
-    binding: &Oid4vciBinding,
-) -> Result<()> {
-    let service = loaded
-        .project
-        .services
-        .get(&binding.credential.service)
-        .ok_or_else(|| anyhow!("validated OID4VCI service is absent"))?;
-    let credential = service
-        .credential_profiles
-        .get(&binding.credential.profile)
-        .ok_or_else(|| anyhow!("validated OID4VCI credential profile is absent"))?;
-    let claim_id = credential
-        .claims
-        .first()
-        .ok_or_else(|| anyhow!("validated OID4VCI credential claim is absent"))?;
-    let claim = service
-        .claims
-        .get(claim_id)
-        .ok_or_else(|| anyhow!("validated OID4VCI claim is absent"))?;
-    if inferred_claim_evidence(service, claim)? != ClaimEvidence::RegistryBacked {
-        bail!(
-            "refusing to compile OID4VCI credential capability without registry-backed claim evidence"
-        );
-    }
-    let profile_id = bounded_join_id(&[
-        binding.credential.service.as_str(),
-        binding.credential.profile.as_str(),
-    ])?;
-    let validity_seconds = parse_validity_seconds(&credential.validity)?;
-    let scope = service
-        .access
-        .scopes
-        .first()
-        .ok_or_else(|| anyhow!("validated OID4VCI service access scope is absent"))?;
-    let (_, allowed_disclosures) = expanded_disclosure(&claim.disclosure);
-    let representative = binding.representative_issuance.as_ref();
-    let public_base_url = binding.public_base_url.trim_end_matches('/');
-    let insecure_esignet = [
-        binding.authorization_server.issuer.as_str(),
-        binding.authorization_server.jwks_url.as_str(),
-        binding.authorization_server.userinfo_url.as_str(),
-        binding.authorization_server.authorize_url.as_str(),
-        binding.authorization_server.token_url.as_str(),
-    ]
-    .into_iter()
-    .any(url_uses_http);
-    let mut subject_access = json!({
-        "enabled": true,
-        "subject_binding": {
-            "token_claim": binding.subject.token_claim,
-            "claim_source": "userinfo",
-            "request_field": "SubjectId",
-            "id_type": binding.subject.id_type,
-            "normalize": "exact",
-            "allow_sub_as_civil_id": false,
-        },
-        "citizen_clients": {
-            "allowed_client_ids": [binding.client.id],
-            "allowed_audiences": [binding.client.id],
-        },
-        "token_policy": {
-            "assurance_claim_source": "id_token",
-            "max_auth_age_seconds": 1_200,
-            "max_access_token_lifetime_seconds": 1_200,
-            "max_evaluation_age_seconds": representative
-                .map(|representative| representative.max_proof_age_seconds)
-                .unwrap_or(300)
-                .max(300),
-            "max_credential_validity_seconds": validity_seconds,
-            "max_clock_leeway_seconds": 60,
-        },
-        "allowed_operations": {
-            "evaluate": representative.is_some(),
-            "render": false,
-            "issue_credential": true,
-            "batch_evaluate": false,
-        },
-        "allowed_purposes": [service.purpose],
-        "allowed_claims": [claim_id],
-        "allowed_formats": ["application/vnd.registry-notary.claim-result+json"],
-        "allowed_disclosures": allowed_disclosures,
-        "scope_policy": "disabled",
-        "required_scopes": [],
-        "allowed_wallet_origins": binding.allowed_wallet_origins,
-        "credential_profiles": [profile_id],
-        "rate_limits": {
-            "invalid_token_per_client_address_per_minute": 20,
-            "per_principal_per_minute": 10,
-            "subject_mismatch_per_principal_per_hour": 5,
-            "per_holder_per_hour": 10,
-            "credential_issuance_per_principal_per_hour": 5,
-            "tx_code_attempts_per_code_per_minute": 10,
-        },
-    });
-    if let Some(representative) = representative {
-        // This binding is delegation-only. Keep the representative credential
-        // root out of the subject-bound allow-lists so it is validated and
-        // authorized solely under the relationship's requester/target
-        // contract.
-        subject_access["allowed_purposes"] = json!([]);
-        subject_access["allowed_claims"] = json!([]);
-        subject_access["allowed_formats"] = json!([]);
-        subject_access["allowed_disclosures"] = json!([]);
-        subject_access["delegation"] = json!({
-            "enabled": true,
-            "allowed_relationships": [{
-                "relationship_type": representative.relationship,
-                "proof_claim": representative.proof_claim,
-                "target_id_type": representative.target_id_type,
-                "max_proof_age_seconds": representative.max_proof_age_seconds,
-                "allowed_claims": [claim_id],
-                "allowed_purposes": [service.purpose],
-                "allowed_formats": ["application/vnd.registry-notary.claim-result+json"],
-                "allowed_disclosures": allowed_disclosures,
-            }],
-        });
-    }
-    generated["subject_access"] = subject_access;
-    let mut credential_configuration = json!({
-        "claim_id": claim_id,
-        "credential_profile": profile_id,
-        "format": "dc+sd-jwt",
-        "scope": scope,
-        "vct": credential.credential_type,
-        "display_name": binding.credential.profile.replace(['-', '_'], " "),
-        "proof_signing_alg_values_supported": ["EdDSA"],
-        "cryptographic_binding_methods_supported": ["did:jwk"],
-    });
-    if let Some(representative) = representative {
-        credential_configuration["representative_issuance"] = json!({
-            "ceremony": "digitally_authenticated_representative",
-            "relationship": representative.relationship,
-        });
-    }
-    generated["oid4vci"] = json!({
-        "enabled": true,
-        "credential_issuer": public_base_url,
-        "authorization_servers": [binding.authorization_server.issuer],
-        "accepted_token_audiences": [public_base_url, binding.client.id],
-        "credential_endpoint": format!("{public_base_url}/oid4vci/credential"),
-        "nonce": { "enabled": true, "ttl_seconds": 300 },
-        "authorization": { "require_pkce_method": "S256" },
-        "proof": { "max_age_seconds": 300, "max_clock_skew_seconds": 30 },
-        "pre_authorized_code": {
-            "enabled": true,
-            "tx_code": {
-                "required": binding.tx_code.required,
-                "input_mode": "numeric",
-                "length": 6,
-            },
-            "esignet": {
-                "client_id": binding.client.id,
-                "client_signing_key_id": "oid4vci-esignet-client",
-                "redirect_uri": binding.redirect_uri,
-                "authorize_url": binding.authorization_server.authorize_url,
-                "token_url": binding.authorization_server.token_url,
-                "issuer": binding.authorization_server.issuer,
-                "jwks_uri": binding.authorization_server.jwks_url,
-                "userinfo_url": binding.authorization_server.userinfo_url,
-                "scopes": ["openid", "profile"],
-                "login_state_ttl_seconds": 300,
-                "allow_insecure_localhost": insecure_esignet,
-            },
-            "pre_authorized_code_ttl_seconds": 300,
-        },
-        "display": [],
-        "credential_configurations": {
-            profile_id.clone(): credential_configuration,
-        },
-    });
-    if representative.is_some() {
-        generated["credential_status"] = json!({
-            "enabled": true,
-            "base_url": public_base_url,
-            "retention_seconds": 86_400,
-        });
-    }
-    Ok(())
-}
-
-fn generated_notary_output_contracts(integration: &IntegrationDocument) -> Result<Value> {
-    let outputs = integration
-        .outputs
-        .iter()
-        .map(|(name, output)| {
-            if let Some(schema) = &output.structured_schema {
-                return Ok((
-                    name.clone(),
-                    generated_notary_structured_output_contract(schema)?,
-                ));
-            }
-            let contract = match output.output_type {
-                OutputType::Boolean => {
-                    json!({ "type": "boolean", "nullable": output.nullable })
-                }
-                OutputType::Integer => {
-                    if let (Some(minimum), Some(maximum)) = (output.minimum, output.maximum) {
-                        json!({
-                            "type": "integer",
-                            "nullable": output.nullable,
-                            "minimum": minimum,
-                            "maximum": maximum,
-                        })
-                    } else {
-                        let schema = output_source_schema(integration, output)?;
-                        let SchemaNode::Integer { min, max } = schema else {
-                            bail!("integer output must resolve to an integer response field");
-                        };
-                        json!({ "type": "integer", "nullable": output.nullable, "minimum": min, "maximum": max })
-                    }
-                }
-                OutputType::String => json!({
-                    "type": "string",
-                    "nullable": output.nullable,
-                    "max_bytes": output.max_bytes.ok_or_else(|| anyhow!("string output bound is absent"))?,
-                }),
-                OutputType::Date => {
-                    json!({ "type": "date", "nullable": output.nullable })
-                }
-                OutputType::Object | OutputType::Array => {
-                    bail!("structured output schema is absent")
-                }
-                OutputType::Presence => bail!("presence is an outcome, not a declared output"),
-            };
-            Ok((name.clone(), contract))
-        })
-        .collect::<Result<Map<String, Value>>>()?;
-    Ok(Value::Object(outputs))
-}
-
-fn generated_notary_structured_output_contract(
-    schema: &StructuredOutputSchema,
-) -> Result<Value> {
-    Ok(match schema {
-        StructuredOutputSchema::String {
-            nullable,
-            max_bytes,
-        } => json!({
-            "type": "string",
-            "nullable": nullable,
-            "max_bytes": max_bytes,
-        }),
-        StructuredOutputSchema::Boolean { nullable } => json!({
-            "type": "boolean",
-            "nullable": nullable,
-        }),
-        StructuredOutputSchema::Integer {
-            nullable,
-            minimum,
-            maximum,
-        } => json!({
-            "type": "integer",
-            "nullable": nullable,
-            "minimum": minimum,
-            "maximum": maximum,
-        }),
-        StructuredOutputSchema::Date { nullable } => json!({
-            "type": "date",
-            "nullable": nullable,
-        }),
-        StructuredOutputSchema::Object {
-            nullable,
-            max_bytes,
-            fields,
-        } => {
-            let fields = fields
-                .iter()
-                .map(|(name, field)| {
-                    Ok((
-                        name.clone(),
-                        json!({
-                            "required": field.required,
-                            "schema": generated_notary_structured_output_contract(&field.schema)?,
-                        }),
-                    ))
-                })
-                .collect::<Result<Map<String, Value>>>()?;
-            json!({
-                "type": "object",
-                "nullable": nullable,
-                "max_bytes": max_bytes,
-                "fields": fields,
-            })
-        }
-        StructuredOutputSchema::Array {
-            nullable,
-            max_bytes,
-            max_items,
-            items,
-        } => json!({
-            "type": "array",
-            "nullable": nullable,
-            "max_bytes": max_bytes,
-            "max_items": max_items,
-            "items": generated_notary_structured_output_contract(items)?,
-        }),
-    })
-}
-
-fn output_source_schema<'a>(
-    integration: &'a IntegrationDocument,
-    output: &OutputDeclaration,
-) -> Result<&'a SchemaNode> {
-    let (operation, _) = output
-        .from
-        .as_deref()
-        .ok_or_else(|| anyhow!("output path is absent"))?
-        .split_once('.')
-        .ok_or_else(|| anyhow!("output path is invalid"))?;
-    let operation = integration_operations(integration)
-        .get(operation)
-        .ok_or_else(|| anyhow!("output operation is absent"))?;
-    let mut schema = operation_record_schema(operation)?;
-    let pointer = output
-        .source_pointer
-        .as_deref()
-        .ok_or_else(|| anyhow!("HTTP output pointer is absent"))?;
-    for segment in output_pointer_segments(pointer)? {
-        schema = match schema {
-            SchemaNode::Object { fields, .. } => fields
-                .get(&segment)
-                .map(|field| &field.schema)
-                .ok_or_else(|| anyhow!("output path is absent from the response schema"))?,
-            _ => bail!("output path traverses a non-object response schema"),
-        };
-    }
-    Ok(schema)
-}
-
-fn output_pointer_segments(pointer: &str) -> Result<Vec<String>> {
-    let pointer = pointer
-        .strip_prefix('/')
-        .ok_or_else(|| anyhow!("HTTP output pointer must be absolute"))?;
-    if pointer.is_empty() {
-        bail!("HTTP output pointer cannot select the root");
-    }
-    pointer
-        .split('/')
-        .map(|segment| {
-            let decoded = segment.replace("~1", "/").replace("~0", "~");
-            (!decoded.is_empty())
-                .then_some(decoded)
-                .ok_or_else(|| anyhow!("HTTP output pointer contains an empty token"))
-        })
-        .collect()
-}
-
-fn generated_notary_claim_rule(
-    claim_id: &str,
-    claim: &ClaimDeclaration,
-    consultation_name: &str,
-    notary_consultation_name: &str,
-    integration: &IntegrationDocument,
-    loaded: &LoadedIntegration,
-) -> Result<(String, bool, Value)> {
-    if let Some(fact_path) = &claim.output {
-        let (consultation, output_name) = fact_path
-            .split_once('.')
-            .ok_or_else(|| anyhow!("direct claim output path is invalid"))?;
-        if consultation != consultation_name {
-            bail!("direct claim output path names the wrong consultation");
-        }
-        let output = integration
-            .outputs
-            .get(output_name)
-            .ok_or_else(|| anyhow!("direct claim references an unknown output"))?;
-        let value_type = match output.output_type {
-            OutputType::Boolean => "boolean",
-            OutputType::Integer => "integer",
-            OutputType::String => "string",
-            OutputType::Date => "date",
-            OutputType::Object => "object",
-            OutputType::Array => "array",
-            OutputType::Presence => bail!("presence cannot be referenced as an output"),
-        };
-        let nullable = true;
-        let rule = json!({
-            "type": "consultation_output",
-            "consultation": notary_consultation_name,
-            "output": output_name
-        });
-        return Ok((value_type.to_string(), nullable, rule));
-    }
-    let expression = claim
-        .cel
-        .as_ref()
-        .ok_or_else(|| anyhow!("claim source is absent"))?;
-    let expression = rewrite_notary_consultation_root(
-        expression,
-        consultation_name,
-        notary_consultation_name,
-        integration.outputs.keys().map(String::as_str),
-    );
-    let (value_type, nullable) = infer_fixture_claim_type(claim_id, loaded)?;
-    Ok((
-        value_type,
-        nullable,
-        json!({ "type": "cel", "expression": expression }),
-    ))
-}
-
-// Crosswalk lowers these namespace-qualified helper calls before evaluating
-// CEL. Authored consultation names remain product-neutral, so collisions are
-// lowered only inside the generated Notary contract rather than rejected.
-const CROSSWALK_CEL_HELPER_NAMESPACES: &[&str] = &[
-    "address", "code", "date", "email", "geo", "id", "json", "list", "map", "name", "num",
-    "person", "phone", "privacy", "text", "type", "validate",
-];
-
-fn generated_notary_consultation_aliases<'a>(
-    names: impl IntoIterator<Item = &'a str>,
-) -> BTreeMap<String, String> {
-    let names = names.into_iter().collect::<BTreeSet<_>>();
-    let mut aliases = BTreeMap::new();
-    let mut used = BTreeSet::new();
-    for name in &names {
-        let base = if CROSSWALK_CEL_HELPER_NAMESPACES.contains(name) {
-            format!("relay_{name}")
-        } else {
-            (*name).to_string()
-        };
-        let mut alias = base.clone();
-        let mut suffix = 2_u8;
-        while used.contains(alias.as_str())
-            || (alias.as_str() != *name && names.contains(alias.as_str()))
-        {
-            alias = format!("{base}_{suffix}");
-            suffix = suffix.saturating_add(1);
-        }
-        used.insert(alias.clone());
-        aliases.insert((*name).to_string(), alias);
-    }
-    aliases
-}
-
-fn rewrite_notary_consultation_root<'a>(
-    expression: &str,
-    authored_name: &str,
-    notary_name: &str,
-    output_names: impl IntoIterator<Item = &'a str>,
-) -> String {
-    if authored_name == notary_name {
-        return expression.to_string();
-    }
-    // Only typed consultation members move to the internal alias. This keeps
-    // real helper calls such as date.age_on(...) intact when an author also
-    // chose a helper namespace as the consultation name.
-    let mut members = output_names.into_iter().collect::<BTreeSet<_>>();
-    members.extend(["matched", "outcome"]);
-    let bytes = expression.as_bytes();
-    let mut rewritten = Vec::with_capacity(expression.len() + notary_name.len());
-    let mut index = 0;
-    let mut quote = None;
-    let mut escaped = false;
-    while index < bytes.len() {
-        let byte = bytes[index];
-        if let Some(active_quote) = quote {
-            rewritten.push(byte);
-            index += 1;
-            if escaped {
-                escaped = false;
-            } else if byte == b'\\' {
-                escaped = true;
-            } else if byte == active_quote {
-                quote = None;
-            }
-            continue;
-        }
-        if matches!(byte, b'\'' | b'"' | b'`') {
-            quote = Some(byte);
-            rewritten.push(byte);
-            index += 1;
-            continue;
-        }
-        if !is_cel_identifier_start_byte(byte) {
-            rewritten.push(byte);
-            index += 1;
-            continue;
-        }
-
-        let start = index;
-        index += 1;
-        while index < bytes.len() && is_cel_identifier_continue_byte(bytes[index]) {
-            index += 1;
-        }
-        let token = &expression[start..index];
-        let previous = bytes[..start]
-            .iter()
-            .rfind(|byte| !byte.is_ascii_whitespace())
-            .copied();
-        let mut dot = index;
-        while dot < bytes.len() && bytes[dot].is_ascii_whitespace() {
-            dot += 1;
-        }
-        let mut member_start = dot.saturating_add(1);
-        while member_start < bytes.len() && bytes[member_start].is_ascii_whitespace() {
-            member_start += 1;
-        }
-        let mut member_end = member_start;
-        if bytes.get(dot) == Some(&b'.')
-            && bytes
-                .get(member_start)
-                .is_some_and(|byte| is_cel_identifier_start_byte(*byte))
-        {
-            member_end += 1;
-            while member_end < bytes.len() && is_cel_identifier_continue_byte(bytes[member_end]) {
-                member_end += 1;
-            }
-        }
-        let member = expression.get(member_start..member_end);
-        if token == authored_name
-            && previous != Some(b'.')
-            && member.is_some_and(|member| members.contains(member))
-        {
-            rewritten.extend_from_slice(notary_name.as_bytes());
-        } else {
-            rewritten.extend_from_slice(token.as_bytes());
-        }
-    }
-    String::from_utf8(rewritten).expect("CEL root rewriting preserves UTF-8")
-}
-
-fn is_cel_identifier_start_byte(byte: u8) -> bool {
-    byte == b'_' || byte.is_ascii_alphabetic()
-}
-
-fn is_cel_identifier_continue_byte(byte: u8) -> bool {
-    byte == b'_' || byte.is_ascii_alphanumeric()
-}
-
-fn infer_fixture_claim_type(
-    claim_id: &str,
-    integration: &LoadedIntegration,
-) -> Result<(String, bool)> {
-    let mut value_type = None;
-    let mut nullable = false;
-    for (_, fixture) in &integration.fixtures {
-        let Some(value) = fixture.expect.claims.get(claim_id) else {
-            continue;
-        };
-        if value.is_null() {
-            nullable = true;
-            continue;
-        }
-        let candidate = if value.is_boolean() {
-            "boolean"
-        } else if value.as_i64().is_some() {
-            "integer"
-        } else if value
-            .as_str()
-            .is_some_and(|value| validate_full_date(value).is_ok())
-        {
-            "date"
-        } else if value.is_string() {
-            "string"
-        } else {
-            bail!("CEL fixture claim must be a scalar v1 value");
-        };
-        match value_type {
-            Some(previous) if previous != candidate => {
-                bail!("CEL fixture claim has inconsistent result types")
-            }
-            None => value_type = Some(candidate),
-            Some(_) => {}
-        }
-    }
-    Ok((
-        value_type
-            .ok_or_else(|| anyhow!("CEL claim lacks a typed fixture result"))?
-            .to_string(),
-        nullable,
-    ))
-}
-
-fn claim_consultation_name<'a>(
-    service: &'a ServiceDeclaration,
-    claim: &'a ClaimDeclaration,
-) -> Result<&'a str> {
-    if let Some(output) = &claim.output {
-        let (consultation, _) = output
-            .split_once('.')
-            .ok_or_else(|| anyhow!("direct claim output path is invalid"))?;
-        if service.consultations.contains_key(consultation) {
-            return Ok(consultation);
-        }
-    }
-    let roots = claim
-        .cel
-        .as_deref()
-        .map(cel_member_roots)
-        .transpose()?
-        .unwrap_or_default();
-    let referenced = service
-        .consultations
-        .keys()
-        .filter(|name| roots.contains(name.as_str()))
-        .map(String::as_str)
-        .collect::<Vec<_>>();
-    match referenced.as_slice() {
-        [name] => Ok(name),
-        [] if service.consultations.len() == 1 => Ok(service
-            .consultations
-            .first_key_value()
-            .expect("one consultation was checked")
-            .0),
-        _ => bail!("v1 claim must depend on exactly one consultation"),
-    }
-}
-
-#[derive(Debug, Default, PartialEq, Eq)]
-struct CelReferences {
-    roots: BTreeSet<String>,
-    first_level_members: BTreeMap<String, BTreeSet<String>>,
-    uses_index: bool,
-}
-
-fn cel_references(expression: &str) -> Result<CelReferences> {
-    let program = cel::Program::compile(expression)
-        .map_err(|_| anyhow!("CEL expression contains invalid syntax"))?;
-    let mut references = CelReferences::default();
-    collect_cel_references(program.expression(), &BTreeSet::new(), &mut references);
-    Ok(references)
-}
-
-fn cel_member_roots(expression: &str) -> Result<BTreeSet<String>> {
-    Ok(cel_references(expression)?.roots)
-}
-
-fn collect_cel_references(
-    expression: &IdedExpr,
-    locals: &BTreeSet<String>,
-    references: &mut CelReferences,
-) {
-    match &expression.expr {
-        Expr::Unspecified | Expr::Literal(_) => {}
-        Expr::Ident(name) => {
-            if !name.starts_with('@') && !locals.contains(name) {
-                references.roots.insert(name.clone());
-            }
-        }
-        Expr::Select(select) => {
-            if let Expr::Ident(root) = &select.operand.expr {
-                if !root.starts_with('@') && !locals.contains(root) {
-                    references
-                        .first_level_members
-                        .entry(root.clone())
-                        .or_default()
-                        .insert(select.field.clone());
-                }
-            }
-            collect_cel_references(&select.operand, locals, references);
-        }
-        Expr::Call(call) => {
-            if matches!(
-                call.func_name.as_str(),
-                cel::common::ast::operators::INDEX | cel::common::ast::operators::OPT_INDEX
-            ) {
-                references.uses_index = true;
-            }
-            if let Some(target) = &call.target {
-                collect_cel_references(target, locals, references);
-            }
-            for argument in &call.args {
-                collect_cel_references(argument, locals, references);
-            }
-        }
-        Expr::List(list) => {
-            for element in &list.elements {
-                collect_cel_references(element, locals, references);
-            }
-        }
-        Expr::Map(map) => {
-            for entry in &map.entries {
-                collect_cel_entry_references(&entry.expr, locals, references);
-            }
-        }
-        Expr::Struct(value) => {
-            for entry in &value.entries {
-                collect_cel_entry_references(&entry.expr, locals, references);
-            }
-        }
-        Expr::Comprehension(comprehension) => {
-            collect_cel_references(&comprehension.iter_range, locals, references);
-            collect_cel_references(&comprehension.accu_init, locals, references);
-
-            let mut scoped_locals = locals.clone();
-            scoped_locals.insert(comprehension.iter_var.clone());
-            if let Some(iter_var) = &comprehension.iter_var2 {
-                scoped_locals.insert(iter_var.clone());
-            }
-            scoped_locals.insert(comprehension.accu_var.clone());
-            collect_cel_references(
-                &comprehension.loop_cond,
-                &scoped_locals,
-                references,
-            );
-            collect_cel_references(
-                &comprehension.loop_step,
-                &scoped_locals,
-                references,
-            );
-            collect_cel_references(&comprehension.result, &scoped_locals, references);
-        }
-    }
-}
-
-fn collect_cel_entry_references(
-    entry: &EntryExpr,
-    locals: &BTreeSet<String>,
-    references: &mut CelReferences,
-) {
-    match entry {
-        EntryExpr::StructField(field) => {
-            collect_cel_references(&field.value, locals, references);
-        }
-        EntryExpr::MapEntry(entry) => {
-            collect_cel_references(&entry.key, locals, references);
-            collect_cel_references(&entry.value, locals, references);
-        }
-    }
-}
-
-fn expanded_disclosure(disclosure: &DisclosureDeclaration) -> (&str, Vec<&str>) {
-    match disclosure {
-        DisclosureDeclaration::Mode(DisclosureMode::Value) => ("value", vec!["value", "redacted"]),
-        DisclosureDeclaration::Mode(DisclosureMode::Predicate) => {
-            ("predicate", vec!["predicate", "redacted"])
-        }
-        DisclosureDeclaration::Mode(DisclosureMode::Redacted) => ("redacted", vec!["redacted"]),
-        DisclosureDeclaration::Policy { default, allowed } => (
-            match default {
-                DisclosureMode::Value => "value",
-                DisclosureMode::Predicate => "predicate",
-                DisclosureMode::Redacted => "redacted",
-            },
-            allowed
-                .iter()
-                .map(|mode| match mode {
-                    DisclosureMode::Value => "value",
-                    DisclosureMode::Predicate => "predicate",
-                    DisclosureMode::Redacted => "redacted",
-                })
-                .collect(),
-        ),
-    }
-}
-
-fn disclosure_review_profiles(project: &RegistryProject) -> DisclosureReviewProfiles {
-    project
-        .services
-        .iter()
-        .filter(|(_, service)| service.kind == ServiceKind::Evidence)
-        .map(|(service_id, service)| {
-            let claims = service
-                .claims
-                .iter()
-                .map(|(claim_id, claim)| {
-                    let (default, allowed) = expanded_disclosure(&claim.disclosure);
-                    let default = match default {
-                        "value" => DisclosureMode::Value,
-                        "predicate" => DisclosureMode::Predicate,
-                        "redacted" => DisclosureMode::Redacted,
-                        _ => unreachable!("expanded disclosure uses a closed mode set"),
-                    };
-                    let allowed = allowed
-                        .into_iter()
-                        .map(|mode| match mode {
-                            "value" => DisclosureMode::Value,
-                            "predicate" => DisclosureMode::Predicate,
-                            "redacted" => DisclosureMode::Redacted,
-                            _ => unreachable!("expanded disclosure uses a closed mode set"),
-                        })
-                        .collect();
-                    (
-                        claim_id.clone(),
-                        DisclosureReviewProfile { default, allowed },
-                    )
-                })
-                .collect();
-            (service_id.clone(), claims)
-        })
-        .collect()
-}
-
-#[cfg(test)]
-fn disclosure_rank(mode: DisclosureMode) -> u8 {
-    match mode {
-        DisclosureMode::Redacted => 0,
-        DisclosureMode::Predicate => 1,
-        DisclosureMode::Value => 2,
-    }
-}
-
-#[cfg(test)]
-fn disclosure_change_classes(
-    current: &DisclosureReviewProfiles,
-    baseline: Option<&Value>,
-) -> (bool, bool) {
-    let Some(baseline) = baseline.and_then(|review| review.get("disclosure_profiles")) else {
-        return (true, true);
-    };
-    let Ok(previous) = serde_json::from_value::<DisclosureReviewProfiles>(baseline.clone()) else {
-        return (true, true);
-    };
-    let mut narrowing = false;
-    let mut widening = false;
-    let service_ids = current
-        .keys()
-        .chain(previous.keys())
-        .collect::<BTreeSet<_>>();
-    for service_id in service_ids {
-        let current_claims = current.get(service_id);
-        let previous_claims = previous.get(service_id);
-        let claim_ids = current_claims
-            .into_iter()
-            .flat_map(BTreeMap::keys)
-            .chain(previous_claims.into_iter().flat_map(BTreeMap::keys))
-            .collect::<BTreeSet<_>>();
-        for claim_id in claim_ids {
-            match (
-                current_claims.and_then(|claims| claims.get(claim_id)),
-                previous_claims.and_then(|claims| claims.get(claim_id)),
-            ) {
-                (Some(current), Some(previous)) => {
-                    let current_no_wider = disclosure_profile_no_wider(current, previous);
-                    let previous_no_wider = disclosure_profile_no_wider(previous, current);
-                    narrowing |= current_no_wider && !previous_no_wider;
-                    widening |= previous_no_wider && !current_no_wider;
-                    if !current_no_wider && !previous_no_wider {
-                        narrowing = true;
-                        widening = true;
-                    }
-                }
-                (Some(current), None) => {
-                    if current.default == DisclosureMode::Redacted
-                        && current.allowed == BTreeSet::from([DisclosureMode::Redacted])
-                    {
-                        narrowing = true;
-                    } else {
-                        widening = true;
-                    }
-                }
-                (None, Some(_)) => narrowing = true,
-                (None, None) => unreachable!("claim id came from one disclosure map"),
-            }
-        }
-    }
-    (narrowing, widening)
-}
-
-#[cfg(test)]
-fn disclosure_profile_no_wider(
-    candidate: &DisclosureReviewProfile,
-    reference: &DisclosureReviewProfile,
-) -> bool {
-    disclosure_rank(candidate.default) <= disclosure_rank(reference.default)
-        && candidate.allowed.iter().all(|candidate_mode| {
-            reference.allowed.iter().any(|reference_mode| {
-                disclosure_rank(*candidate_mode) <= disclosure_rank(*reference_mode)
-            })
-        })
-}
-
-fn normalize_credential_format(format: &str) -> String {
-    match format {
-        "dc+sd-jwt" => "application/dc+sd-jwt".to_string(),
-        value => value.to_string(),
-    }
-}
-
-fn parse_validity_seconds(value: &str) -> Result<u64> {
-    let (number, multiplier) = if let Some(value) = value.strip_suffix('s') {
-        (value, 1)
-    } else if let Some(value) = value.strip_suffix('m') {
-        (value, 60)
-    } else if let Some(value) = value.strip_suffix('h') {
-        (value, 3600)
-    } else {
-        bail!("credential validity must use s, m, or h")
-    };
-    number
-        .parse::<u64>()?
-        .checked_mul(multiplier)
-        .ok_or_else(|| anyhow!("credential validity overflows"))
-}
-
-#[cfg(test)]
-mod notary_compiler_tests {
-    use super::*;
-
-    #[test]
-    fn compiler_rejects_claims_without_relay_consultations() {
-        let project: RegistryProject = serde_norway::from_str(
-            r#"version: 1
-registry: { id: compiler-boundary-test }
-services:
-  evaluation:
-    kind: evidence
-    version: 1
-    purpose: test
-    legal_basis: test
-    consent: not_required
-    access: { scopes: [evidence:test:read] }
-    claims:
-      declaration:
-        cel: "true"
-        value: { type: boolean }
-        disclosure: predicate
-    credential_profiles:
-      declaration:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/declaration/v1
-        validity: 5m
-        claims: [declaration]
-"#,
-        )
-        .expect("compiler-boundary project deserializes");
-        let service = &project.services["evaluation"];
-        let credential = &service.credential_profiles["declaration"];
-
-        let error = validate_compiler_credential_profile_evidence(
-            "evaluation",
-            "declaration",
-            service,
-            credential,
-        )
-        .expect_err("compiler boundary must reject claims without Relay consultations");
-        assert!(format!("{error:#}").contains("must derive from one declared Relay consultation"));
-    }
-
-    #[test]
-    fn crosswalk_helper_namespaces_receive_unique_internal_aliases() {
-        let mut names = CROSSWALK_CEL_HELPER_NAMESPACES.to_vec();
-        names.extend(["relay_person", "relay_person_2", "household"]);
-        let aliases = generated_notary_consultation_aliases(names.iter().copied());
-
-        assert_eq!(aliases["person"], "relay_person_3");
-        assert_eq!(aliases["relay_person"], "relay_person");
-        assert_eq!(aliases["relay_person_2"], "relay_person_2");
-        assert_eq!(aliases["household"], "household");
-        assert!(CROSSWALK_CEL_HELPER_NAMESPACES
-            .iter()
-            .all(|name| aliases[*name] != *name));
-        assert_eq!(
-            aliases.values().collect::<BTreeSet<_>>().len(),
-            aliases.len()
-        );
-    }
-
-    #[test]
-    fn consultation_root_rewrite_is_token_and_string_literal_aware() {
-        let expression = r#"person.matched
-            && person . status == "person.status"
-            && 'escaped \' person.matched'
-            && `person.status`
-            && payload.person.status == "active"
-            && person.age(person.birth_date, today) > 17"#;
-        let rewritten = rewrite_notary_consultation_root(
-            expression,
-            "person",
-            "relay_person",
-            ["status", "birth_date"],
-        );
-
-        assert_eq!(
-            rewritten,
-            r#"relay_person.matched
-            && relay_person . status == "person.status"
-            && 'escaped \' person.matched'
-            && `person.status`
-            && payload.person.status == "active"
-            && person.age(relay_person.birth_date, today) > 17"#
-        );
-    }
-
-    #[test]
-    fn consultation_root_rewrite_leaves_unrelated_identifiers_unchanged() {
-        let expression = "person_id == 'person.matched' && other.matched";
-        assert_eq!(
-            rewrite_notary_consultation_root(expression, "person", "relay_person", ["person_id"]),
-            expression
-        );
-        assert_eq!(
-            rewrite_notary_consultation_root(
-                "household.matched",
-                "household",
-                "household",
-                std::iter::empty()
-            ),
-            "household.matched"
-        );
-    }
-}
diff --git a/crates/registryctl/src/project_authoring/compiler/relay.rs b/crates/registryctl/src/project_authoring/compiler/relay.rs
index 82d8d0bd0..58b1f93db 100644
--- a/crates/registryctl/src/project_authoring/compiler/relay.rs
+++ b/crates/registryctl/src/project_authoring/compiler/relay.rs
@@ -4,13 +4,6 @@ pub(crate) const LOCAL_RELAY_MATCH_KEY_HASH_ENV: &str =
     "REGISTRYCTL_LOCAL_RELAY_MATCH_KEY_HASH";
 pub(crate) const LOCAL_RELAY_NO_MATCH_KEY_HASH_ENV: &str =
     "REGISTRYCTL_LOCAL_RELAY_NO_MATCH_KEY_HASH";
-const LOCAL_NOTARY_WORKLOAD_ISSUER: &str = "https://registryctl-local-notary.invalid";
-const LOCAL_NOTARY_WORKLOAD_JWKS_FILE: &str =
-    "/run/registry/dev-public/notary-workload-jwks.json";
-const LOCAL_NOTARY_RELAY_BASE_URL: &str = "http://10.89.0.4:8080";
-const LOCAL_NOTARY_RELAY_CLIENT_ID: &str = "registryctl-local-notary";
-const LOCAL_NOTARY_RELAY_TOKEN_FILE: &str = "/run/secrets/relay-workload-token";
-const LOCAL_NOTARY_RELAY_PRIVATE_CIDR: &str = "10.89.0.4/32";
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 enum GeneratedRelayConfigKind {
@@ -165,26 +158,10 @@ fn generated_relay_config(
     allowed_clients.sort();
     allowed_clients.dedup();
     let relay_origin = normalize_url_scheme(&relay.origin)?;
-    let local_notary_add_on = kind == GeneratedRelayConfigKind::Consultation
-        && matches!(environment.deployment.profile, DeploymentProfile::Local)
-        && relay.issuer == LOCAL_NOTARY_WORKLOAD_ISSUER
-        && environment.notary_relay.as_ref().is_some_and(|binding| {
-            binding.base_url == LOCAL_NOTARY_RELAY_BASE_URL
-                && binding.workload_client_id == LOCAL_NOTARY_RELAY_CLIENT_ID
-                && binding.token_file == Path::new(LOCAL_NOTARY_RELAY_TOKEN_FILE)
-        });
-    let relay_issuer = if local_notary_add_on {
-        LOCAL_NOTARY_WORKLOAD_ISSUER.to_string()
-    } else {
-        normalize_url_scheme(&relay.issuer)?
-    };
-    let relay_jwks_url = if local_notary_add_on {
-        None
-    } else {
-        Some(normalize_url_scheme(&relay.jwks_url)?)
-    };
-    let allow_dev_insecure_fetch_urls = !local_notary_add_on
-        && (url_uses_http(&relay.issuer) || url_uses_http(&relay.jwks_url));
+    let relay_issuer = normalize_url_scheme(&relay.issuer)?;
+    let relay_jwks_url = normalize_url_scheme(&relay.jwks_url)?;
+    let allow_dev_insecure_fetch_urls =
+        url_uses_http(&relay.issuer) || url_uses_http(&relay.jwks_url);
     let oidc_auth = |allowed_clients: Vec<String>| {
         let mut oidc = json!({
             "issuer": relay_issuer,
@@ -195,19 +172,7 @@ fn generated_relay_config(
         let oidc = oidc
             .as_object_mut()
             .expect("compiler-owned OIDC configuration is an object");
-        if local_notary_add_on {
-            oidc.insert(
-                "development_jwks_file".to_string(),
-                json!(LOCAL_NOTARY_WORKLOAD_JWKS_FILE),
-            );
-        } else {
-            oidc.insert(
-                "jwks_url".to_string(),
-                json!(relay_jwks_url
-                    .as_deref()
-                    .expect("non-local OIDC source has a JWKS URL")),
-            );
-        }
+        oidc.insert("jwks_url".to_string(), json!(relay_jwks_url));
         json!({
             "mode": "oidc",
             "oidc": oidc,
@@ -257,11 +222,11 @@ fn generated_relay_config(
             oidc_auth(allowed_clients)
         }
     } else {
-        let Some(workload) = &environment.notary_relay else {
-            bail!("consultation Relay requires a Notary-to-Relay workload binding");
-        };
-        let allowed_clients = vec![workload.workload_client_id.clone()];
-        oidc_auth(allowed_clients)
+        let consultation = relay
+            .consultation
+            .as_ref()
+            .ok_or_else(|| anyhow!("consultation Relay identity binding is absent"))?;
+        oidc_auth(vec![consultation.client_id.clone()])
     };
     let instance_id = if kind == GeneratedRelayConfigKind::Consultation {
         format!("{}-consultation", relay_service.service)
@@ -290,16 +255,16 @@ fn generated_relay_config(
         "deployment": { "profile": environment.deployment.profile.as_str() },
     });
     if kind == GeneratedRelayConfigKind::Consultation && !profiles.is_empty() && !packs.is_empty() {
-        let workload = environment
-            .notary_relay
+        let consultation = relay
+            .consultation
             .as_ref()
-            .ok_or_else(|| anyhow!("Notary-to-Relay workload binding is absent"))?;
+            .ok_or_else(|| anyhow!("consultation Relay identity binding is absent"))?;
         config["consultation"] = json!({
             "authorized_workload": {
                 "audience": relay.audience,
                 "client_claim_selector": "azp",
-                "client_value": workload.workload_client_id,
-                "principal_id": workload.workload_client_id,
+                "client_value": consultation.client_id,
+                "principal_id": consultation.principal_id,
             },
             "state_plane": {
                 "database_url_env": "REGISTRY_RELAY_CONSULTATION_DATABASE_URL",
diff --git a/crates/registryctl/src/project_authoring/compiler/semantic_impact.rs b/crates/registryctl/src/project_authoring/compiler/semantic_impact.rs
index 6e5d2f692..8ccf02bcf 100644
--- a/crates/registryctl/src/project_authoring/compiler/semantic_impact.rs
+++ b/crates/registryctl/src/project_authoring/compiler/semantic_impact.rs
@@ -10,7 +10,6 @@
 fn project_semantic_impact_report(
     loaded: &LoadedRegistryProject,
     baseline: Option<&Value>,
-    disclosure_digest: &str,
 ) -> ProjectSemanticImpactReportV1 {
     let report_baseline = if baseline.is_some() {
         ProjectBaseline::VerifiedSignedBundle
@@ -22,11 +21,12 @@ fn project_semantic_impact_report(
     } else {
         SemanticDirection::Unbaselined
     };
-    let changes = changed_semantic_dimensions(loaded, baseline, disclosure_digest)
+    let changes = changed_semantic_dimensions(loaded, baseline)
         .into_iter()
         .filter(|dimension| {
             affected_products(loaded, baseline, *dimension).any()
-                && (baseline.is_some() || semantic_dimension_has_current_subjects(loaded, *dimension))
+                && (baseline.is_some()
+                    || semantic_dimension_has_current_subjects(loaded, *dimension))
         })
         .map(|dimension| semantic_impact_for_dimension(loaded, baseline, dimension, direction))
         .collect();
@@ -43,11 +43,6 @@ fn semantic_dimension_has_current_subjects(
     dimension: SemanticDimension,
 ) -> bool {
     match dimension {
-        SemanticDimension::Claim | SemanticDimension::Disclosure => loaded
-            .project
-            .services
-            .values()
-            .any(|service| !service.claims.is_empty()),
         SemanticDimension::Integration => {
             !loaded.project.integrations.is_empty()
                 || !loaded.project.entities.is_empty()
@@ -65,17 +60,9 @@ fn semantic_dimension_has_current_subjects(
 fn changed_semantic_dimensions(
     loaded: &LoadedRegistryProject,
     baseline: Option<&Value>,
-    disclosure_digest: &str,
 ) -> Vec<SemanticDimension> {
     let previous_digests = baseline.and_then(|state| state.get("semantic_digests"));
     let mut changes = [
-        (
-            SemanticDimension::Claim,
-            loaded.semantic_digests.claim.as_str(),
-            previous_digests
-                .and_then(|digests| digests.get("claim"))
-                .and_then(Value::as_str),
-        ),
         (
             SemanticDimension::Integration,
             loaded.semantic_digests.integration.as_str(),
@@ -97,13 +84,6 @@ fn changed_semantic_dimensions(
                 .and_then(|digests| digests.get("operator_security"))
                 .and_then(Value::as_str),
         ),
-        (
-            SemanticDimension::Disclosure,
-            disclosure_digest,
-            baseline
-                .and_then(|state| state.get("disclosure_digest"))
-                .and_then(Value::as_str),
-        ),
     ]
     .into_iter()
     .filter(|(_, current, previous)| *previous != Some(*current))
@@ -152,7 +132,10 @@ fn semantic_impact_for_dimension(
 struct AffectedProducts {
     relay_public: bool,
     relay_consultation: bool,
-    notary: bool,
+}
+
+fn project_has_relay_topology(project: &RegistryProject) -> bool {
+    !project.integrations.is_empty() || !project.entities.is_empty() || !project.services.is_empty()
 }
 
 impl AffectedProducts {
@@ -160,7 +143,6 @@ impl AffectedProducts {
         Self {
             relay_public: false,
             relay_consultation: false,
-            notary: false,
         }
     }
 
@@ -168,15 +150,10 @@ impl AffectedProducts {
         Self {
             relay_public: true,
             relay_consultation: true,
-            notary: true,
         }
     }
 
     const fn any(self) -> bool {
-        self.relay_public || self.relay_consultation || self.notary
-    }
-
-    const fn any_relay(self) -> bool {
         self.relay_public || self.relay_consultation
     }
 
@@ -184,7 +161,6 @@ impl AffectedProducts {
         Self {
             relay_public: self.relay_public || other.relay_public,
             relay_consultation: self.relay_consultation || other.relay_consultation,
-            notary: self.notary || other.notary,
         }
     }
 
@@ -192,7 +168,6 @@ impl AffectedProducts {
         Self {
             relay_public: self.relay_public && other.relay_public,
             relay_consultation: self.relay_consultation && other.relay_consultation,
-            notary: self.notary && other.notary,
         }
     }
 }
@@ -202,7 +177,7 @@ fn affected_products(
     baseline: Option<&Value>,
     dimension: SemanticDimension,
 ) -> AffectedProducts {
-    let (requires_relay, requires_notary) = project_product_topology(&loaded.project);
+    let requires_relay = project_has_relay_topology(&loaded.project);
     let current_products = AffectedProducts {
         relay_public: requires_relay,
         relay_consultation: requires_relay
@@ -211,26 +186,18 @@ fn affected_products(
                 .services
                 .values()
                 .any(|service| !service.consultations.is_empty()),
-        notary: requires_notary,
     };
     let product_topology = current_products.union(baseline_product_topology(baseline));
     let dimension_products = match dimension {
-        SemanticDimension::Claim | SemanticDimension::Disclosure => AffectedProducts {
-            relay_public: false,
-            relay_consultation: false,
-            notary: true,
-        },
         SemanticDimension::Integration => AffectedProducts {
             relay_public: !product_topology.relay_consultation,
             relay_consultation: product_topology.relay_consultation,
-            notary: true,
         },
         SemanticDimension::ServicePolicy
         | SemanticDimension::OperatorSecurity
         | SemanticDimension::Compiler => AffectedProducts {
             relay_public: true,
             relay_consultation: true,
-            notary: true,
         },
     };
     dimension_products.intersect(product_topology)
@@ -248,7 +215,6 @@ fn baseline_product_topology(baseline: Option<&Value>) -> AffectedProducts {
         for product in products {
             match product.as_str() {
                 Some("relay") => topology.relay_public = true,
-                Some("notary") => topology.notary = true,
                 _ => return AffectedProducts::both(),
             }
         }
@@ -267,15 +233,14 @@ fn baseline_product_topology(baseline: Option<&Value>) -> AffectedProducts {
             relay_consultation: digests
                 .get("relay_consultation")
                 .is_some_and(Value::is_string),
-            notary: digests.get("notary").is_some_and(Value::is_string),
         };
         if topology.any() {
             return topology;
         }
     }
 
-    // Older or malformed signed baselines do not provide enough product
-    // inventory to prove that a removed product has no retirement obligation.
+    // Older or malformed signed baselines do not distinguish the two Relay
+    // deployment lanes, so retain obligations for both.
     AffectedProducts::both()
 }
 
@@ -293,8 +258,8 @@ fn affected_subjects(
 
     // A dimension digest cannot identify the changed member. Include the full
     // authored identity closure that can feed compilation, fixture validation,
-    // policy review, or disclosure review. Only stable authored identifiers and
-    // aliases are retained, never authored values or filesystem locations.
+    // policy review, or route review. Only stable authored identifiers and aliases
+    // are retained, never authored values or filesystem locations.
     for (integration_alias, integration) in &loaded.integrations {
         add(AffectedSubjectKind::Integration, integration_alias.clone());
         for (_, fixture) in &integration.fixtures {
@@ -312,11 +277,6 @@ fn affected_subjects(
                 format!("{service_id}.{consultation_id}"),
             );
         }
-        for claim_id in service.claims.keys() {
-            let id = format!("{service_id}.{claim_id}");
-            add(AffectedSubjectKind::Claim, id.clone());
-            add(AffectedSubjectKind::Disclosure, id);
-        }
     }
 
     if products.relay_public {
@@ -331,7 +291,13 @@ fn affected_subjects(
             "registry-relay.consultation.config".to_string(),
         );
     }
-    if products.any_relay() {
+    if products.relay_public {
+        add(
+            AffectedSubjectKind::GeneratedArtifact,
+            "registry-relay.runtime-config".to_string(),
+        );
+    }
+    if products.relay_consultation {
         for artifact in [
             "registry-relay.consultation-contracts",
             "registry-relay.integration-packs",
@@ -341,19 +307,6 @@ fn affected_subjects(
             add(AffectedSubjectKind::GeneratedArtifact, artifact.to_string());
         }
     }
-    if products.notary {
-        add(
-            AffectedSubjectKind::ProductInput,
-            "registry-notary.config".to_string(),
-        );
-        for artifact in [
-            "registry-notary.claim-configuration",
-            "registry-notary.disclosure-policy",
-            "registry-notary.runtime-config",
-        ] {
-            add(AffectedSubjectKind::GeneratedArtifact, artifact.to_string());
-        }
-    }
 
     subjects
         .into_iter()
@@ -371,9 +324,7 @@ fn has_consultation_signing_input(
         .values()
         .any(|service| !service.consultations.is_empty())
         || baseline
-            .and_then(|state| {
-                state.pointer("/generated_closure_digests/relay_consultation")
-            })
+            .and_then(|state| state.pointer("/generated_closure_digests/relay_consultation"))
             .is_some_and(Value::is_string)
 }
 
@@ -383,21 +334,16 @@ const fn subject_kind_rank(kind: AffectedSubjectKind) -> u8 {
         AffectedSubjectKind::Fixture => 1,
         AffectedSubjectKind::ServicePolicy => 2,
         AffectedSubjectKind::Consultation => 3,
-        AffectedSubjectKind::Claim => 4,
-        AffectedSubjectKind::Disclosure => 5,
-        AffectedSubjectKind::ProductInput => 6,
-        AffectedSubjectKind::GeneratedArtifact => 7,
+        AffectedSubjectKind::ProductInput => 4,
+        AffectedSubjectKind::GeneratedArtifact => 5,
     }
 }
 
 fn consumers(products: AffectedProducts) -> Vec<ImpactConsumer> {
     let mut consumers = vec![ImpactConsumer::RegistryctlAuthoring];
-    if products.any_relay() {
+    if products.any() {
         consumers.push(ImpactConsumer::RegistryRelay);
     }
-    if products.notary {
-        consumers.push(ImpactConsumer::RegistryNotary);
-    }
     consumers.push(ImpactConsumer::EditorTooling);
     consumers.push(ImpactConsumer::DocsGenerator);
     consumers.push(ImpactConsumer::BundleSigner);
@@ -418,26 +364,11 @@ fn review_classes(
             ImpactReviewClass::Privacy,
             ImpactReviewClass::Security,
             ImpactReviewClass::Relay,
-            ImpactReviewClass::Notary,
             ImpactReviewClass::Compatibility,
             ImpactReviewClass::Testing,
             ImpactReviewClass::Operations,
             ImpactReviewClass::Release,
         ],
-        SemanticDimension::Claim | SemanticDimension::Disclosure => vec![
-            ImpactReviewClass::Contract,
-            ImpactReviewClass::Authoring,
-            ImpactReviewClass::Semantics,
-            ImpactReviewClass::Interoperability,
-            ImpactReviewClass::Privacy,
-            ImpactReviewClass::Security,
-            ImpactReviewClass::Notary,
-            ImpactReviewClass::Compatibility,
-            ImpactReviewClass::Documentation,
-            ImpactReviewClass::Testing,
-            ImpactReviewClass::Operations,
-            ImpactReviewClass::Release,
-        ],
         SemanticDimension::Integration
         | SemanticDimension::ServicePolicy
         | SemanticDimension::Compiler => vec![
@@ -448,7 +379,6 @@ fn review_classes(
             ImpactReviewClass::Privacy,
             ImpactReviewClass::Security,
             ImpactReviewClass::Relay,
-            ImpactReviewClass::Notary,
             ImpactReviewClass::Compatibility,
             ImpactReviewClass::Documentation,
             ImpactReviewClass::Testing,
@@ -456,19 +386,13 @@ fn review_classes(
             ImpactReviewClass::Release,
         ],
     };
-    if !products.any_relay() {
+    if !products.any() {
         classes.retain(|class| *class != ImpactReviewClass::Relay);
     }
-    if !products.notary {
-        classes.retain(|class| *class != ImpactReviewClass::Notary);
-    }
     classes
 }
 
-fn product_impacts(
-    dimension: SemanticDimension,
-    products: AffectedProducts,
-) -> Vec<ProductImpact> {
+fn product_impacts(dimension: SemanticDimension, products: AffectedProducts) -> Vec<ProductImpact> {
     let runtime_impact = if dimension == SemanticDimension::OperatorSecurity {
         ProductImpactClass::Reconfigure
     } else {
@@ -478,18 +402,12 @@ fn product_impacts(
         product: ProjectProduct::Registryctl,
         impact: ProductImpactClass::Revalidate,
     }];
-    if products.any_relay() {
+    if products.any() {
         impacts.push(ProductImpact {
             product: ProjectProduct::Relay,
             impact: runtime_impact,
         });
     }
-    if products.notary {
-        impacts.push(ProductImpact {
-            product: ProjectProduct::Notary,
-            impact: runtime_impact,
-        });
-    }
     impacts.push(ProductImpact {
         product: ProjectProduct::Docs,
         impact: ProductImpactClass::Republish,
@@ -499,15 +417,11 @@ fn product_impacts(
 
 fn requirements(products: AffectedProducts) -> ImpactRequirements {
     let actions = [
-        (
-            products.relay_public,
-            RequiredProductAction::RelayPublic,
-        ),
+        (products.relay_public, RequiredProductAction::RelayPublic),
         (
             products.relay_consultation,
             RequiredProductAction::RelayConsultation,
         ),
-        (products.notary, RequiredProductAction::Notary),
     ]
     .into_iter()
     .filter_map(|(required, action)| required.then_some(action))
@@ -541,20 +455,14 @@ mod semantic_impact_tests {
         .expect("Relay-only semantic-impact fixture loads")
     }
 
-    fn disclosure_digest() -> String {
-        format!("sha256:{}", "d".repeat(64))
-    }
-
-    fn matching_baseline(loaded: &LoadedRegistryProject, disclosure_digest: &str) -> Value {
+    fn matching_baseline(loaded: &LoadedRegistryProject) -> Value {
         json!({
             "compiler_version": env!("CARGO_PKG_VERSION"),
             "semantic_digests": {
-                "claim": loaded.semantic_digests.claim,
                 "integration": loaded.semantic_digests.integration,
                 "service_policy": loaded.semantic_digests.service_policy,
                 "operator_security": loaded.semantic_digests.operator_security,
             },
-            "disclosure_digest": disclosure_digest,
         })
     }
 
@@ -574,12 +482,11 @@ mod semantic_impact_tests {
         match consumer {
             ImpactConsumer::RegistryctlAuthoring => 0,
             ImpactConsumer::RegistryRelay => 1,
-            ImpactConsumer::RegistryNotary => 2,
-            ImpactConsumer::EditorTooling => 3,
-            ImpactConsumer::DocsGenerator => 4,
-            ImpactConsumer::BundleSigner => 5,
-            ImpactConsumer::DeploymentTooling => 6,
-            ImpactConsumer::Operator => 7,
+            ImpactConsumer::EditorTooling => 2,
+            ImpactConsumer::DocsGenerator => 3,
+            ImpactConsumer::BundleSigner => 4,
+            ImpactConsumer::DeploymentTooling => 5,
+            ImpactConsumer::Operator => 6,
         }
     }
 
@@ -592,12 +499,11 @@ mod semantic_impact_tests {
             ImpactReviewClass::Privacy => 4,
             ImpactReviewClass::Security => 5,
             ImpactReviewClass::Relay => 6,
-            ImpactReviewClass::Notary => 7,
-            ImpactReviewClass::Compatibility => 8,
-            ImpactReviewClass::Documentation => 9,
-            ImpactReviewClass::Testing => 10,
-            ImpactReviewClass::Operations => 11,
-            ImpactReviewClass::Release => 12,
+            ImpactReviewClass::Compatibility => 7,
+            ImpactReviewClass::Documentation => 8,
+            ImpactReviewClass::Testing => 9,
+            ImpactReviewClass::Operations => 10,
+            ImpactReviewClass::Release => 11,
         }
     }
 
@@ -605,27 +511,23 @@ mod semantic_impact_tests {
         match product {
             ProjectProduct::Registryctl => 0,
             ProjectProduct::Relay => 1,
-            ProjectProduct::Notary => 2,
-            ProjectProduct::Editor => 3,
-            ProjectProduct::Docs => 4,
+            ProjectProduct::Editor => 2,
+            ProjectProduct::Docs => 3,
         }
     }
 
     #[test]
-    fn initial_report_is_dimension_precise_and_preserves_legacy_projection() {
+    fn initial_report_is_dimension_precise() {
         let loaded = loaded_project();
-        let disclosure_digest = disclosure_digest();
-        let report = project_semantic_impact_report(&loaded, None, &disclosure_digest);
+        let report = project_semantic_impact_report(&loaded, None);
 
         assert_eq!(report.baseline, ProjectBaseline::InitialWithoutBaseline);
         assert_eq!(
             dimensions(&report),
             vec![
-                SemanticDimension::Claim,
                 SemanticDimension::Integration,
                 SemanticDimension::ServicePolicy,
                 SemanticDimension::OperatorSecurity,
-                SemanticDimension::Disclosure,
             ]
         );
         assert!(report.changes.iter().all(|change| {
@@ -633,30 +535,23 @@ mod semantic_impact_tests {
                 && change.direction == SemanticDirection::Unbaselined
         }));
 
-        let legacy = semantic_change_records(&loaded, None, &disclosure_digest);
-        assert_eq!(
-            serde_json::to_value(report.dimension_only_changes()).expect("projection serializes"),
-            serde_json::to_value(legacy).expect("legacy changes serialize"),
-        );
+        assert_eq!(report.dimension_only_changes().len(), report.changes.len());
     }
 
     #[test]
     fn verified_baseline_reports_each_changed_dimension_conservatively() {
         let loaded = loaded_project();
-        let disclosure_digest = disclosure_digest();
         let dimension_cases = [
-            (SemanticDimension::Claim, "claim"),
             (SemanticDimension::Integration, "integration"),
             (SemanticDimension::ServicePolicy, "service_policy"),
             (SemanticDimension::OperatorSecurity, "operator_security"),
-            (SemanticDimension::Disclosure, "disclosure_digest"),
             (SemanticDimension::Compiler, "compiler_version"),
         ];
 
         for (expected, key) in dimension_cases {
-            let mut baseline = matching_baseline(&loaded, &disclosure_digest);
+            let mut baseline = matching_baseline(&loaded);
             match key {
-                "disclosure_digest" | "compiler_version" => {
+                "compiler_version" => {
                     baseline[key] = Value::String("previous".to_string());
                 }
                 semantic_digest => {
@@ -664,8 +559,7 @@ mod semantic_impact_tests {
                         Value::String(format!("sha256:{}", "0".repeat(64)));
                 }
             }
-            let report =
-                project_semantic_impact_report(&loaded, Some(&baseline), &disclosure_digest);
+            let report = project_semantic_impact_report(&loaded, Some(&baseline));
             assert_eq!(report.baseline, ProjectBaseline::VerifiedSignedBundle);
             assert_eq!(
                 dimensions(&report),
@@ -681,9 +575,8 @@ mod semantic_impact_tests {
     #[test]
     fn matching_verified_baseline_has_no_changes() {
         let loaded = loaded_project();
-        let disclosure_digest = disclosure_digest();
-        let baseline = matching_baseline(&loaded, &disclosure_digest);
-        let report = project_semantic_impact_report(&loaded, Some(&baseline), &disclosure_digest);
+        let baseline = matching_baseline(&loaded);
+        let report = project_semantic_impact_report(&loaded, Some(&baseline));
 
         assert_eq!(report.baseline, ProjectBaseline::VerifiedSignedBundle);
         assert!(report.changes.is_empty());
@@ -691,9 +584,9 @@ mod semantic_impact_tests {
     }
 
     #[test]
-    fn relay_only_impact_never_requires_notary_review_signing_or_activation() {
+    fn relay_public_impact_uses_only_the_public_action_lane() {
         let loaded = loaded_relay_only_project();
-        let report = project_semantic_impact_report(&loaded, None, &disclosure_digest());
+        let report = project_semantic_impact_report(&loaded, None);
 
         assert_eq!(
             dimensions(&report),
@@ -704,29 +597,19 @@ mod semantic_impact_tests {
         );
         for change in report.changes {
             assert!(change.consumers.contains(&ImpactConsumer::RegistryRelay));
-            assert!(!change.consumers.contains(&ImpactConsumer::RegistryNotary));
             assert!(change.review_classes.contains(&ImpactReviewClass::Relay));
-            assert!(!change.review_classes.contains(&ImpactReviewClass::Notary));
             assert!(change
                 .product_impacts
                 .iter()
                 .any(|impact| impact.product == ProjectProduct::Relay));
-            assert!(!change
-                .product_impacts
-                .iter()
-                .any(|impact| impact.product == ProjectProduct::Notary));
             let expected = actions(&[RequiredProductAction::RelayPublic]);
             assert_eq!(change.requirements.signing, expected);
             assert_eq!(change.requirements.activation, expected);
             assert_eq!(change.requirements.restart, expected);
-            assert!(!change.affected_subjects.iter().any(|subject| {
-                subject.id.starts_with("registry-notary.")
-                    || subject.id == "registry-relay.consultation.config"
-                    || matches!(
-                        subject.kind,
-                        AffectedSubjectKind::Claim | AffectedSubjectKind::Disclosure
-                    )
-            }));
+            assert!(!change
+                .affected_subjects
+                .iter()
+                .any(|subject| { subject.id == "registry-relay.consultation.config" }));
         }
     }
 
@@ -746,102 +629,24 @@ mod semantic_impact_tests {
             .map(|subject| subject.id.as_str())
             .collect::<Vec<_>>();
 
-        assert_eq!(
-            product_inputs,
-            vec![
-                "registry-notary.config",
-                "registry-relay.consultation.config",
-            ]
-        );
-    }
-
-    #[test]
-    fn verified_baseline_product_removal_keeps_removed_product_obligations() {
-        let current = loaded_relay_only_project();
-        let previous = loaded_project();
-        let mut baseline = matching_baseline(
-            &previous,
-            &format!("sha256:{}", "b".repeat(64)),
-        );
-        for digest in [
-            "claim",
-            "integration",
-            "service_policy",
-            "operator_security",
-        ] {
-            baseline["semantic_digests"][digest] =
-                Value::String(format!("sha256:{}", "0".repeat(64)));
-        }
-        baseline["promotion_projection"] = json!({
-            "products": ["relay", "notary"],
-        });
-        baseline["generated_closure_digests"] = json!({
-            "relay_consultation": format!("sha256:{}", "c".repeat(64)),
-        });
-        let report =
-            project_semantic_impact_report(&current, Some(&baseline), &disclosure_digest());
-
-        for dimension in [SemanticDimension::Claim, SemanticDimension::Disclosure] {
-            let change = report
-                .changes
-                .iter()
-                .find(|change| change.dimension == dimension)
-                .unwrap_or_else(|| panic!("{dimension:?} product-removal impact is retained"));
-            assert!(change.consumers.contains(&ImpactConsumer::RegistryNotary));
-            assert!(!change.consumers.contains(&ImpactConsumer::RegistryRelay));
-            let expected = actions(&[RequiredProductAction::Notary]);
-            assert_eq!(change.requirements.signing, expected);
-            assert_eq!(change.requirements.activation, expected);
-            assert_eq!(change.requirements.restart, expected);
-        }
-        for dimension in [
-            SemanticDimension::Integration,
-            SemanticDimension::ServicePolicy,
-            SemanticDimension::OperatorSecurity,
-        ] {
-            let change = report
-                .changes
-                .iter()
-                .find(|change| change.dimension == dimension)
-                .unwrap_or_else(|| panic!("{dimension:?} product-removal impact is retained"));
-            let expected = if dimension == SemanticDimension::Integration {
-                actions(&[
-                    RequiredProductAction::RelayConsultation,
-                    RequiredProductAction::Notary,
-                ])
-            } else {
-                actions(&[
-                    RequiredProductAction::RelayPublic,
-                    RequiredProductAction::RelayConsultation,
-                    RequiredProductAction::Notary,
-                ])
-            };
-            assert_eq!(change.requirements.signing, expected);
-            assert_eq!(change.requirements.activation, expected);
-            assert_eq!(change.requirements.restart, expected);
-        }
+        assert_eq!(product_inputs, vec!["registry-relay.consultation.config"]);
     }
 
     #[test]
     fn legacy_baseline_without_product_inventory_stays_conservative() {
         let current = loaded_relay_only_project();
         let previous = loaded_project();
-        let mut baseline =
-            matching_baseline(&previous, &format!("sha256:{}", "b".repeat(64)));
+        let mut baseline = matching_baseline(&previous);
         baseline["semantic_digests"]["integration"] =
             Value::String(format!("sha256:{}", "0".repeat(64)));
-        let report =
-            project_semantic_impact_report(&current, Some(&baseline), &disclosure_digest());
+        let report = project_semantic_impact_report(&current, Some(&baseline));
         let integration = report
             .changes
             .iter()
             .find(|change| change.dimension == SemanticDimension::Integration)
             .expect("legacy baseline conservatively retains integration impact");
 
-        let expected = actions(&[
-            RequiredProductAction::RelayConsultation,
-            RequiredProductAction::Notary,
-        ]);
+        let expected = actions(&[RequiredProductAction::RelayConsultation]);
         assert_eq!(integration.requirements.signing, expected);
         assert_eq!(integration.requirements.activation, expected);
         assert_eq!(integration.requirements.restart, expected);
@@ -851,23 +656,15 @@ mod semantic_impact_tests {
     fn each_dimension_has_conservative_signing_activation_and_restart() {
         let loaded = loaded_project();
         let expected = [
-            (
-                SemanticDimension::Claim,
-                actions(&[RequiredProductAction::Notary]),
-            ),
             (
                 SemanticDimension::Integration,
-                actions(&[
-                    RequiredProductAction::RelayConsultation,
-                    RequiredProductAction::Notary,
-                ]),
+                actions(&[RequiredProductAction::RelayConsultation]),
             ),
             (
                 SemanticDimension::ServicePolicy,
                 actions(&[
                     RequiredProductAction::RelayPublic,
                     RequiredProductAction::RelayConsultation,
-                    RequiredProductAction::Notary,
                 ]),
             ),
             (
@@ -875,30 +672,20 @@ mod semantic_impact_tests {
                 actions(&[
                     RequiredProductAction::RelayPublic,
                     RequiredProductAction::RelayConsultation,
-                    RequiredProductAction::Notary,
                 ]),
             ),
-            (
-                SemanticDimension::Disclosure,
-                actions(&[RequiredProductAction::Notary]),
-            ),
             (
                 SemanticDimension::Compiler,
                 actions(&[
                     RequiredProductAction::RelayPublic,
                     RequiredProductAction::RelayConsultation,
-                    RequiredProductAction::Notary,
                 ]),
             ),
         ];
 
         for (dimension, expected) in expected {
-            let impact = semantic_impact_for_dimension(
-                &loaded,
-                None,
-                dimension,
-                SemanticDirection::Changed,
-            );
+            let impact =
+                semantic_impact_for_dimension(&loaded, None, dimension, SemanticDirection::Changed);
             assert_eq!(impact.requirements.signing, expected);
             assert_eq!(impact.requirements.activation, expected);
             assert_eq!(impact.requirements.restart, expected);
@@ -918,19 +705,13 @@ mod semantic_impact_tests {
     fn each_dimension_names_the_full_safe_authored_identity_closure() {
         let loaded = loaded_project();
         for dimension in [
-            SemanticDimension::Claim,
             SemanticDimension::Integration,
             SemanticDimension::ServicePolicy,
             SemanticDimension::OperatorSecurity,
-            SemanticDimension::Disclosure,
             SemanticDimension::Compiler,
         ] {
-            let impact = semantic_impact_for_dimension(
-                &loaded,
-                None,
-                dimension,
-                SemanticDirection::Changed,
-            );
+            let impact =
+                semantic_impact_for_dimension(&loaded, None, dimension, SemanticDirection::Changed);
             let subjects = impact
                 .affected_subjects
                 .iter()
@@ -974,14 +755,6 @@ mod semantic_impact_tests {
                 subject.kind == AffectedSubjectKind::Consultation
                     && subject.id == "health-verification.health"
             }));
-            assert!(impact.affected_subjects.iter().any(|subject| {
-                subject.kind == AffectedSubjectKind::Claim
-                    && subject.id == "health-verification.child-program-active"
-            }));
-            assert!(impact.affected_subjects.iter().any(|subject| {
-                subject.kind == AffectedSubjectKind::Disclosure
-                    && subject.id == "health-verification.child-program-active"
-            }));
             assert!(impact
                 .affected_subjects
                 .iter()
@@ -1000,21 +773,14 @@ mod semantic_impact_tests {
             schema_version: ProjectSemanticImpactSchemaVersion::V1,
             baseline: ProjectBaseline::VerifiedSignedBundle,
             changes: [
-                SemanticDimension::Claim,
                 SemanticDimension::Integration,
                 SemanticDimension::ServicePolicy,
                 SemanticDimension::OperatorSecurity,
-                SemanticDimension::Disclosure,
                 SemanticDimension::Compiler,
             ]
             .into_iter()
             .map(|dimension| {
-                semantic_impact_for_dimension(
-                    &loaded,
-                    None,
-                    dimension,
-                    SemanticDirection::Changed,
-                )
+                semantic_impact_for_dimension(&loaded, None, dimension, SemanticDirection::Changed)
             })
             .collect(),
         };
@@ -1025,7 +791,6 @@ mod semantic_impact_tests {
             "127.0.0.1",
             "/run/secrets/relay-workload-token",
             "HEALTH_REGISTRY_USERNAME",
-            "REGISTRY_NOTARY_ISSUER_JWK",
             "health-relay-client",
             "A0000000001",
             "Nia",
@@ -1039,18 +804,17 @@ mod semantic_impact_tests {
     }
 
     #[test]
-    fn verified_projection_matches_legacy_changes_including_compiler() {
+    fn verified_projection_includes_changed_integration_and_compiler() {
         let loaded = loaded_project();
-        let disclosure_digest = disclosure_digest();
-        let mut baseline = matching_baseline(&loaded, &disclosure_digest);
-        baseline["semantic_digests"]["claim"] = Value::String(format!("sha256:{}", "0".repeat(64)));
+        let mut baseline = matching_baseline(&loaded);
+        baseline["semantic_digests"]["integration"] =
+            Value::String(format!("sha256:{}", "0".repeat(64)));
         baseline["compiler_version"] = Value::String("previous".to_string());
 
-        let report = project_semantic_impact_report(&loaded, Some(&baseline), &disclosure_digest);
-        let legacy = semantic_change_records(&loaded, Some(&baseline), &disclosure_digest);
+        let report = project_semantic_impact_report(&loaded, Some(&baseline));
         assert_eq!(
-            serde_json::to_value(report.dimension_only_changes()).expect("projection serializes"),
-            serde_json::to_value(legacy).expect("legacy changes serialize"),
+            dimensions(&report),
+            vec![SemanticDimension::Integration, SemanticDimension::Compiler],
         );
     }
 }
diff --git a/crates/registryctl/src/project_authoring/development.rs b/crates/registryctl/src/project_authoring/development.rs
index 39a14b914..70d4f7609 100644
--- a/crates/registryctl/src/project_authoring/development.rs
+++ b/crates/registryctl/src/project_authoring/development.rs
@@ -1,14 +1,14 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::dev_credentials::{
-    DevCredentialPublicProjection, DevCredentialRequirements, DevIssuanceCredentialRequirement,
-    DevOAuthCredentialProfile, DevRelayApiKeyRequirements, DevSourceCredentialProfile,
+    DevCredentialPublicProjection, DevCredentialRequirements, DevOAuthCredentialProfile,
+    DevRelayApiKeyRequirements, DevSourceCredentialProfile,
     DevSourceCredentialProjection, PreparedDevCredentialClosure,
 };
 use crate::dev_runtime::{
-    dev_claim_results_commitment, AuthoredDevScenario, AuthoredDevelopment,
+    AuthoredDevScenario, AuthoredDevelopment,
     AuthoredLocalSnapshot, AuthoredSyntheticOauthRequest, AuthoredSyntheticSourcePlan,
-    AuthoredSyntheticSourceRequest, DevClaimResultExpectation, DevEnvironmentProfile,
+    AuthoredSyntheticSourceRequest, DevEnvironmentProfile,
     DevOAuthProfile, DevSourceMode, DevSourceProvider, SyntheticOAuthResponseCase,
     SyntheticRequestEncoding, SyntheticRequestMethod, SyntheticSourceAuth, SyntheticSourceScenario,
 };
@@ -34,8 +34,6 @@ pub(crate) struct DevAuthoringProjection {
     pub environment_id: String,
     pub environment_profile: DevEnvironmentProfile,
     pub development: AuthoredDevelopment,
-    pub caller_id: String,
-    pub caller_fingerprint_locator: String,
     /// Exact authored source credential environment locators required by an
     /// operator-bound consultation Relay. Sorted and deduplicated. Empty for
     /// synthetic development.
@@ -81,10 +79,8 @@ pub(crate) struct CompiledSignedDevLanes {
     pub relay_public_anchor: PathBuf,
     pub relay_consultation_bundle: PathBuf,
     pub relay_consultation_anchor: PathBuf,
-    pub notary_bundle: PathBuf,
-    pub notary_anchor: PathBuf,
-    /// Relay public, Relay consultation, and Notary, in that order.
-    pub lane_config_digests: [String; 3],
+    /// Relay public and Relay consultation, in that order.
+    pub lane_config_digests: [String; 2],
 }
 
 impl DevAuthoringProjection {
@@ -139,16 +135,6 @@ pub(crate) fn compile_dev_runtime_authoring(
         .unwrap_or(&fixture.0)
         .to_string_lossy();
     let fixture_document = &fixture.1;
-    let (caller_id, caller_fingerprint_locator, service_id) = select_development_caller(
-        &loaded,
-        environment_id,
-        default_integration,
-        default_fixture,
-        fixture_document,
-    )?;
-    let request = fixture_document.request.as_ref().ok_or_else(|| {
-        anyhow!("{fixture_relative}#/request is required for the default development scenario")
-    })?;
     if fixture_document.interactions.len() != 1 {
         bail!(
             "{fixture_relative}#/interactions must contain exactly one interaction for the closed development source profile"
@@ -176,12 +162,9 @@ pub(crate) fn compile_dev_runtime_authoring(
         DevelopmentCredentialRequirementsInput {
             loaded: &loaded,
             environment_id,
-            service_id: &service_id,
             integration_id: default_integration,
             source_mode,
             credential,
-            caller_id: &caller_id,
-            caller_fingerprint_env: &caller_fingerprint_locator,
             relay_api_key_scopes: records_request
                 .as_ref()
                 .map(|request| request.scopes.as_slice()),
@@ -204,10 +187,6 @@ pub(crate) fn compile_dev_runtime_authoring(
             oauth_request,
             response_body,
         });
-    let request_json =
-        serde_json::to_vec(request).context("failed to compile the local governed request")?;
-    let (minimized_claim_ids, expected_claim_results_sha256) =
-        compile_development_claim_result_expectation(&loaded, request, fixture_document)?;
     let scenario = AuthoredDevScenario {
         integration_id: default_integration.to_owned(),
         fixture_id: default_fixture.to_owned(),
@@ -217,10 +196,7 @@ pub(crate) fn compile_dev_runtime_authoring(
         oauth_profile,
         denial_scenario_id: "unauthorized".to_string(),
         authorized_scenario_id: "authorized".to_string(),
-        minimized_claim_ids,
-        expected_claim_results_sha256,
         synthetic_source,
-        request_json,
     };
 
     Ok(DevAuthoringProjection {
@@ -233,10 +209,7 @@ pub(crate) fn compile_dev_runtime_authoring(
             default_fixture: default_fixture.to_owned(),
             operator_source_binding_present,
             relay_port: development.relay_port,
-            notary_port: development.notary_port,
         },
-        caller_id,
-        caller_fingerprint_locator,
         operator_source_secret_env,
         scenarios: vec![scenario],
         records_request,
@@ -245,91 +218,6 @@ pub(crate) fn compile_dev_runtime_authoring(
     })
 }
 
-fn compile_development_claim_result_expectation(
-    loaded: &LoadedRegistryProject,
-    request: &GovernedFixtureRequest,
-    fixture: &FixtureDocument,
-) -> Result<(Vec<String>, String)> {
-    let first_claim = request
-        .claims
-        .first()
-        .ok_or_else(|| anyhow!("default development request must select at least one claim"))?;
-    let first_declaration = loaded
-        .project
-        .services
-        .values()
-        .filter(|service| service.kind == ServiceKind::Evidence)
-        .filter(|service| service.purpose == request.purpose)
-        .find_map(|service| service.claims.get(&first_claim.id))
-        .ok_or_else(|| anyhow!("default development request claim is not declared"))?;
-    let disclosure = request
-        .disclosure
-        .as_deref()
-        .unwrap_or_else(|| expanded_disclosure(&first_declaration.disclosure).0);
-    let mut minimized_claim_ids = Vec::with_capacity(request.claims.len());
-    let mut expectations = Vec::with_capacity(request.claims.len());
-    for claim in &request.claims {
-        let authored_value = fixture.expect.claims.get(&claim.id).ok_or_else(|| {
-            anyhow!(
-                "default development request claim {} has no fixture result expectation",
-                claim.id
-            )
-        })?;
-        let declaration = loaded
-            .project
-            .services
-            .values()
-            .filter(|service| service.kind == ServiceKind::Evidence)
-            .filter(|service| service.purpose == request.purpose)
-            .find_map(|service| service.claims.get(&claim.id))
-            .ok_or_else(|| anyhow!("default development request claim is not declared"))?;
-        let oracle_is_redacted =
-            expanded_disclosure(&declaration.disclosure).0 == "redacted";
-        minimized_claim_ids.push(claim.id.clone());
-        expectations.push(compile_development_claim_result(
-            &claim.id,
-            authored_value,
-            disclosure,
-            oracle_is_redacted,
-        )?);
-    }
-    minimized_claim_ids.sort();
-    let commitment = dev_claim_results_commitment(expectations)
-        .map_err(|_| anyhow!("default development claim result expectation is invalid"))?;
-    Ok((minimized_claim_ids, commitment))
-}
-
-fn compile_development_claim_result(
-    claim_id: &str,
-    authored_value: &Value,
-    disclosure: &str,
-    oracle_is_redacted: bool,
-) -> Result<DevClaimResultExpectation> {
-    if oracle_is_redacted && disclosure != "redacted" {
-        bail!(
-            "default development claim {claim_id} cannot derive {disclosure} disclosure from a redacted fixture result"
-        );
-    }
-    let (value, satisfied) = match disclosure {
-        "value" => (authored_value.clone(), authored_value.as_bool()),
-        "predicate" => (
-            authored_value
-                .as_bool()
-                .map(Value::Bool)
-                .unwrap_or(Value::Null),
-            authored_value.as_bool(),
-        ),
-        "redacted" => (Value::Null, None),
-        _ => bail!("default development request disclosure is invalid"),
-    };
-    Ok(DevClaimResultExpectation {
-        claim_id: claim_id.to_string(),
-        value,
-        satisfied,
-        disclosure: disclosure.to_string(),
-    })
-}
-
 fn select_development_records_request(
     loaded: &LoadedRegistryProject,
     environment_id: &str,
@@ -432,12 +320,9 @@ fn operator_source_secret_env(
 struct DevelopmentCredentialRequirementsInput<'a> {
     loaded: &'a LoadedRegistryProject,
     environment_id: &'a str,
-    service_id: &'a str,
     integration_id: &'a str,
     source_mode: DevelopmentSourceMode,
     credential: &'a CredentialInterface,
-    caller_id: &'a str,
-    caller_fingerprint_env: &'a str,
     relay_api_key_scopes: Option<&'a [String]>,
 }
 
@@ -447,12 +332,9 @@ fn development_credential_requirements(
     let DevelopmentCredentialRequirementsInput {
         loaded,
         environment_id,
-        service_id,
         integration_id,
         source_mode,
         credential,
-        caller_id,
-        caller_fingerprint_env,
         relay_api_key_scopes,
     } = input;
     let environment = loaded
@@ -530,20 +412,9 @@ fn development_credential_requirements(
             }
         }
     };
-    let issuance = environment
-        .issuance
-        .as_ref()
-        .map(|issuance| DevIssuanceCredentialRequirement {
-            issuer: issuance.issuer.clone(),
-            signing_kid: issuance.signing_kid.clone(),
-            private_jwk_env: issuance.signing_key.secret.clone(),
-        });
     Ok(DevCredentialRequirements {
         project_id: loaded.project.registry.id.clone(),
         environment_id: environment_id.to_owned(),
-        service_id: service_id.to_owned(),
-        caller_id: caller_id.to_owned(),
-        caller_fingerprint_env: caller_fingerprint_env.to_owned(),
         relay_api_keys: match (
             environment
                 .relay
@@ -560,7 +431,6 @@ fn development_credential_requirements(
             _ => bail!("development Relay API-key scopes do not match the selected records request"),
         },
         source,
-        issuance,
     })
 }
 
@@ -596,14 +466,6 @@ fn validate_development_ports(
     if development.relay_port == Some(0) {
         bail!("environments/{environment_id}.yaml#/development/relay_port must be non-zero");
     }
-    if development.notary_port == Some(0) {
-        bail!("environments/{environment_id}.yaml#/development/notary_port must be non-zero");
-    }
-    if development.relay_port.is_some() && development.relay_port == development.notary_port {
-        bail!(
-            "environments/{environment_id}.yaml#/development/relay_port and environments/{environment_id}.yaml#/development/notary_port must be distinct"
-        );
-    }
     Ok(())
 }
 
@@ -635,92 +497,6 @@ fn selected_development_fixture<'a>(
     Some((integration, fixture))
 }
 
-fn select_development_caller(
-    loaded: &LoadedRegistryProject,
-    environment_id: &str,
-    integration_id: &str,
-    fixture_id: &str,
-    fixture: &FixtureDocument,
-) -> Result<(String, String, String)> {
-    let environment = loaded
-        .environment
-        .as_ref()
-        .expect("selected environment was loaded");
-    let expected_claims = fixture.expect.claims.keys().collect::<BTreeSet<_>>();
-    let matching_services = loaded
-        .project
-        .services
-        .iter()
-        .filter(|(_, service)| {
-            service.kind == ServiceKind::Evidence
-                && service
-                    .consultations
-                    .values()
-                    .any(|consultation| consultation.integration == integration_id)
-                && service
-                    .claims
-                    .keys()
-                    .any(|claim| expected_claims.contains(claim))
-        })
-        .collect::<Vec<_>>();
-    if matching_services.is_empty() {
-        bail!(
-            "environments/{environment_id}.yaml#/development/default_integration and environments/{environment_id}.yaml#/development/default_fixture select {integration_id}.{fixture_id}, which has no evidence service scope contract"
-        );
-    }
-    if matching_services.len() != 1 {
-        let service_ids = matching_services
-            .iter()
-            .map(|(service_id, _)| service_id.as_str())
-            .collect::<Vec<_>>();
-        bail!(
-            "environments/{environment_id}.yaml#/development/default_integration and environments/{environment_id}.yaml#/development/default_fixture select {integration_id}.{fixture_id}, which must resolve to one exact evidence service; matching service ids: {}",
-            service_ids.join(", ")
-        );
-    }
-    let (service_id, service) = matching_services[0];
-    let required_scopes = service.access.scopes.iter().collect::<BTreeSet<_>>();
-
-    let mut candidates = environment
-        .callers
-        .iter()
-        .filter(|(_, caller)| {
-            let caller_scopes = caller.scopes.iter().collect::<BTreeSet<_>>();
-            required_scopes
-                .iter()
-                .all(|scope| caller_scopes.contains(scope))
-        })
-        .map(|(id, caller)| (id.clone(), caller.api_key_fingerprint.secret.clone()))
-        .collect::<Vec<_>>();
-    candidates.sort_by(|left, right| left.0.cmp(&right.0));
-    if candidates.len() != 1 {
-        let candidate_ids = candidates
-            .iter()
-            .map(|(id, _)| id.as_str())
-            .collect::<Vec<_>>();
-        let available_ids = environment
-            .callers
-            .keys()
-            .map(String::as_str)
-            .collect::<Vec<_>>();
-        bail!(
-            "environments/{environment_id}.yaml#/development/default_integration and environments/{environment_id}.yaml#/development/default_fixture require one exact caller for {integration_id}.{fixture_id}; matching caller ids: {}; available caller ids: {}",
-            if candidate_ids.is_empty() {
-                "<none>".to_string()
-            } else {
-                candidate_ids.join(", ")
-            },
-            if available_ids.is_empty() {
-                "<none>".to_string()
-            } else {
-                available_ids.join(", ")
-            }
-        );
-    }
-    let (caller_id, fingerprint_locator) = candidates.remove(0);
-    Ok((caller_id, fingerprint_locator, service_id.to_string()))
-}
-
 fn validate_development_source_mode(
     environment_id: &str,
     integration_id: &str,
@@ -1006,7 +782,6 @@ const fn development_environment_profile(profile: DeploymentProfile) -> DevEnvir
         DeploymentProfile::Local => DevEnvironmentProfile::Local,
         DeploymentProfile::HostedLab => DevEnvironmentProfile::HostedLab,
         DeploymentProfile::Production => DevEnvironmentProfile::Production,
-        DeploymentProfile::EvidenceGrade => DevEnvironmentProfile::EvidenceGrade,
     }
 }
 
@@ -1016,11 +791,6 @@ impl DevBindingProjection {
         credentials: &DevCredentialPublicProjection,
         entity_id: Option<String>,
     ) -> Result<Self> {
-        if credentials.caller.id != authoring.caller_id
-            || credentials.caller.fingerprint_env != authoring.caller_fingerprint_locator
-        {
-            bail!("generated development credentials do not match the validated caller binding");
-        }
         Ok(Self {
             project_id: authoring.project_id.clone(),
             environment_id: authoring.environment_id.clone(),
@@ -1047,24 +817,10 @@ impl DevBindingProjection {
             .as_mut()
             .ok_or_else(|| anyhow!("development binding projection lacks its environment"))?;
 
-        let mut selected_caller = environment
-            .callers
-            .remove(&self.credentials.caller.id)
-            .ok_or_else(|| anyhow!("development caller disappeared after validation"))?;
-        selected_caller.api_key_fingerprint.secret =
-            self.credentials.caller.fingerprint_env.clone();
-        environment.callers.clear();
-        environment
-            .callers
-            .insert(self.credentials.caller.id.clone(), selected_caller);
-
         let relay = environment
             .relay
             .as_mut()
             .ok_or_else(|| anyhow!("development Relay binding is absent"))?;
-        relay.issuer = self.credentials.relay_oidc.issuer.clone();
-        relay.audience = self.credentials.relay_oidc.audience.clone();
-        relay.allowed_clients = vec![self.credentials.relay_oidc.client_id.clone()];
         relay.local_api_keys = self.credentials.relay_api_keys.as_ref().map(|keys| {
             RelayLocalApiKeyBinding {
                 match_principal: keys.match_principal.clone(),
@@ -1073,11 +829,6 @@ impl DevBindingProjection {
             }
         });
 
-        environment.notary_relay = Some(NotaryRelayBinding {
-            base_url: self.credentials.notary_relay.base_url.clone(),
-            workload_client_id: self.credentials.notary_relay.workload_client_id.clone(),
-            token_file: PathBuf::from(&self.credentials.notary_relay.token_file),
-        });
         environment.relay_state = Some(RelayStateBinding {
             postgresql: RelayPostgresqlBinding {
                 root_certificate_path: PathBuf::from(
@@ -1085,25 +836,6 @@ impl DevBindingProjection {
                 ),
             },
         });
-        environment.notary_state = Some(NotaryStateBinding {
-            postgresql: NotaryPostgresqlBinding {
-                root_certificate_path: PathBuf::from(
-                    &self.credentials.databases.root_certificate_path,
-                ),
-            },
-        });
-
-        match (&mut environment.issuance, &self.credentials.issuance) {
-            (Some(binding), Some(issuance)) => {
-                binding.issuer = issuance.issuer.clone();
-                binding.signing_kid = issuance.signing_kid.clone();
-                binding.signing_key.secret = issuance.private_jwk_env.clone();
-                binding.algorithm = IssuanceSigningAlgorithm::EdDsa;
-            }
-            (None, None) => {}
-            _ => bail!("generated issuance credentials do not match the validated environment"),
-        }
-
         if let Some(origin) = self
             .synthetic_source_origin
             .as_ref()
@@ -1264,10 +996,6 @@ pub(crate) fn compile_and_sign_dev_lanes(
         &mut compiled.relay_consultation_private,
         &projection.credentials,
     )?;
-    inject_development_notary_relay_transport(
-        &mut compiled.notary_private,
-        &projection.credentials,
-    )?;
 
     let relative_output = output_root
         .strip_prefix(&loaded.root)
@@ -1331,37 +1059,6 @@ fn inject_development_bootstrap(
     Ok(())
 }
 
-fn inject_development_notary_relay_transport(
-    files: &mut BTreeMap<PathBuf, Box<[u8]>>,
-    credentials: &DevCredentialPublicProjection,
-) -> Result<()> {
-    let path = PathBuf::from("config/notary.yaml");
-    let bytes = files
-        .get(&path)
-        .ok_or_else(|| anyhow!("compiled Notary config is absent"))?;
-    let mut config: Value =
-        serde_norway::from_slice(bytes).context("failed to parse compiled Notary config")?;
-    let relay = config
-        .pointer_mut("/evidence/relay")
-        .and_then(Value::as_object_mut)
-        .ok_or_else(|| anyhow!("compiled Notary Relay binding is absent"))?;
-    relay.insert(
-        "allowed_private_cidrs".to_string(),
-        json!([credentials.notary_relay.allowed_private_cidr]),
-    );
-    relay.insert("allow_insecure_localhost".to_string(), json!(false));
-    relay.insert(
-        "allow_insecure_private_network".to_string(),
-        json!(false),
-    );
-    let rendered = serde_norway::to_string(&config)
-        .context("failed to render bound Notary config")?
-        .into_bytes()
-        .into_boxed_slice();
-    files.insert(path, rendered);
-    Ok(())
-}
-
 fn development_active_write_deadline_unix_ms() -> Result<i64> {
     let now_unix_ms = OffsetDateTime::now_utc()
         .unix_timestamp_nanos()
@@ -1397,23 +1094,12 @@ fn write_signed_development_lanes(
         "relay-consultation",
         &compiled.relay_consultation_private,
     )?;
-    let notary = sign_development_lane(
-        output_root,
-        projection,
-        credentials,
-        ProductAcceptanceLaneV1::Notary,
-        ProductAcceptanceProductV1::RegistryNotary,
-        "notary",
-        &compiled.notary_private,
-    )?;
     Ok(CompiledSignedDevLanes {
         relay_public_bundle: relay_public.0,
         relay_public_anchor: relay_public.1,
         relay_consultation_bundle: relay_consultation.0,
         relay_consultation_anchor: relay_consultation.1,
-        notary_bundle: notary.0,
-        notary_anchor: notary.1,
-        lane_config_digests: [relay_public.2, relay_consultation.2, notary.2],
+        lane_config_digests: [relay_public.2, relay_consultation.2],
     })
 }
 
@@ -1482,7 +1168,7 @@ fn sign_development_lane(
         ProductAcceptanceLaneV1::RelayPublic | ProductAcceptanceLaneV1::RelayConsultation => {
             "config/relay.yaml"
         }
-        ProductAcceptanceLaneV1::Notary => "config/notary.yaml",
+        _ => panic!(),
     };
     let config_hash = manifest_files
         .iter()
@@ -1584,663 +1270,6 @@ const fn development_lane_name(lane: ProductAcceptanceLaneV1) -> &'static str {
     match lane {
         ProductAcceptanceLaneV1::RelayPublic => "relay-public",
         ProductAcceptanceLaneV1::RelayConsultation => "relay-consultation",
-        ProductAcceptanceLaneV1::Notary => "notary",
+        _ => panic!(),
     }
 }
-
-#[cfg(test)]
-mod development_authoring_tests {
-    use super::*;
-
-    fn starter_path(name: &str) -> PathBuf {
-        Path::new(env!("CARGO_MANIFEST_DIR"))
-            .join("assets/project-starters")
-            .join(name)
-    }
-
-    #[test]
-    fn http_starter_compiles_one_exact_synthetic_default() {
-        let projection =
-            compile_dev_runtime_authoring(&starter_path("bounded-http"), "local").unwrap();
-        assert_eq!(projection.development.source_mode, DevSourceMode::Synthetic);
-        assert!(!projection.development.operator_source_binding_present);
-        assert_eq!(projection.caller_id, "evidence-client");
-        assert_eq!(
-            projection.caller_fingerprint_locator,
-            "EVIDENCE_CLIENT_TOKEN_HASH"
-        );
-        assert_eq!(
-            projection.credential_requirements().service_id,
-            "person-verification"
-        );
-        assert_eq!(projection.scenarios.len(), 1);
-        assert!(projection.records_request.is_none());
-        let scenario = &projection.scenarios[0];
-        assert_eq!(scenario.integration_id, "person-record");
-        assert_eq!(scenario.fixture_id, "active-person");
-        assert_eq!(scenario.source_provider, DevSourceProvider::Http);
-        assert_eq!(scenario.oauth_profile, DevOAuthProfile::None);
-        let source = scenario
-            .synthetic_source
-            .as_ref()
-            .expect("synthetic source projection");
-        assert_eq!(source.source_auth, Some(SyntheticSourceAuth::StaticBearer));
-        assert_eq!(source.source_request.method, SyntheticRequestMethod::Get);
-        assert_eq!(source.source_request.path, "/people/AB-123456");
-        assert_eq!(
-            source.source_request.query,
-            BTreeMap::from([("fields".to_string(), "active".to_string())])
-        );
-        assert!(source.source_request.headers.is_empty());
-        assert_eq!(
-            serde_json::from_slice::<Value>(
-                source.response_body.as_deref().expect("response body")
-            )
-            .unwrap(),
-            json!({"active": true})
-        );
-        let request: Value = serde_json::from_slice(&scenario.request_json).unwrap();
-        assert_eq!(
-            request.pointer("/target/identifiers/0/value"),
-            Some(&json!("AB-123456"))
-        );
-        assert_eq!(
-            scenario.minimized_claim_ids,
-            vec!["person-record-exists".to_string()]
-        );
-    }
-
-    #[test]
-    fn development_claim_commitment_does_not_invent_a_redacted_value() {
-        let error = compile_development_claim_result(
-            "redacted-claim",
-            &json!("redacted"),
-            "value",
-            true,
-        )
-        .err()
-        .expect("redacted fixture oracle cannot prove a value result");
-        assert!(error.to_string().contains("cannot derive value disclosure"));
-
-        let literal = compile_development_claim_result(
-            "literal-claim",
-            &json!("redacted"),
-            "value",
-            false,
-        )
-        .expect("a value-disclosed literal remains distinguishable from the marker");
-        assert_eq!(literal.value, json!("redacted"));
-    }
-
-    #[test]
-    fn spreadsheet_starter_uses_the_generic_typed_development_projection() {
-        let temporary = tempfile::tempdir().unwrap();
-        let embedded = PROJECT_STARTERS.get_dir("spreadsheet").unwrap();
-        copy_embedded_dir(embedded, temporary.path()).unwrap();
-        let project = temporary.path();
-        let environment_path = project.join("environments/local.yaml");
-        let environment = fs::read_to_string(&environment_path)
-            .unwrap()
-            .replace(
-                "scopes: [projects:metadata, projects:rows]",
-                "scopes: [projects:metadata, projects:rows, unrelated:admin]",
-            );
-        fs::write(&environment_path, environment).unwrap();
-        let projection = compile_dev_runtime_authoring(project, "local").unwrap();
-        assert_eq!(projection.environment_profile, DevEnvironmentProfile::Local);
-        assert_eq!(projection.caller_id, "public-works-service");
-        assert_eq!(
-            projection.credential_requirements().service_id,
-            "public-works-verification"
-        );
-        let records = projection.records_request.as_ref().unwrap();
-        assert_eq!(records.dataset_id, "projects");
-        assert_eq!(records.entity_id, "projects");
-        assert_eq!(records.record_id, "pw_001");
-        assert_eq!(records.purpose, "public-works-case-management");
-        assert_eq!(
-            projection
-                .credential_requirements()
-                .relay_api_keys
-                .unwrap()
-                .scopes,
-            ["projects:metadata", "projects:rows"]
-        );
-        let scenario = &projection.scenarios[0];
-        assert_eq!(projection.development.source_mode, DevSourceMode::LocalSnapshot);
-        assert_eq!(scenario.integration_id, "project-record-snapshot");
-        assert_eq!(scenario.fixture_id, "match");
-        assert_eq!(scenario.source_provider, DevSourceProvider::Spreadsheet);
-        assert!(scenario.synthetic_source.is_none());
-        let snapshot = projection.local_snapshot.as_ref().expect("local snapshot");
-        assert_eq!(
-            snapshot.host_path,
-            std::fs::canonicalize(project.join("data/public_works_projects.xlsx")).unwrap()
-        );
-        assert_eq!(
-            snapshot.container_path,
-            "/var/lib/registry/public_works_projects.xlsx"
-        );
-        assert!(matches!(
-            projection.credential_requirements().source,
-            DevSourceCredentialProfile::OperatorBound
-        ));
-        let credentials =
-            PreparedDevCredentialClosure::generate(projection.credential_requirements()).unwrap();
-        assert!(matches!(
-            credentials.public_projection().source,
-            DevSourceCredentialProjection::OperatorBound
-        ));
-        let signed = compile_and_sign_dev_lanes(
-            project,
-            "local",
-            &credentials,
-            &project.join(".registry-stack/dev-artifacts/test/signed-lanes"),
-        )
-        .unwrap();
-        assert_eq!(signed.lane_config_digests.len(), 3);
-        let public = registry_platform_config::verify_config_bundle(
-            &signed.relay_public_bundle,
-            &signed.relay_public_anchor,
-        )
-        .unwrap();
-        let public: Value = serde_norway::from_slice(&public.config_bytes).unwrap();
-        assert_eq!(public.pointer("/auth/mode"), Some(&json!("api_key")));
-        assert_eq!(
-            public.pointer("/auth/api_keys/0/fingerprint/name"),
-            Some(&json!(LOCAL_RELAY_MATCH_KEY_HASH_ENV))
-        );
-        assert_eq!(
-            public.pointer("/auth/api_keys/1/fingerprint/name"),
-            Some(&json!(LOCAL_RELAY_NO_MATCH_KEY_HASH_ENV))
-        );
-        assert_eq!(
-            public.pointer("/auth/api_keys/0/scopes"),
-            Some(&json!(["projects:metadata", "projects:rows"]))
-        );
-        assert_eq!(
-            public.pointer("/auth/api_keys/1/scopes"),
-            Some(&json!(["projects:metadata", "projects:rows"]))
-        );
-        assert!(!public.to_string().contains("unrelated:admin"));
-        assert!(public
-            .to_string()
-            .contains("/var/lib/registry/public_works_projects.xlsx"));
-        let consultation = registry_platform_config::verify_config_bundle(
-            &signed.relay_consultation_bundle,
-            &signed.relay_consultation_anchor,
-        )
-        .unwrap();
-        let consultation: Value =
-            serde_norway::from_slice(&consultation.config_bytes).unwrap();
-        assert_eq!(consultation.pointer("/auth/mode"), Some(&json!("oidc")));
-        assert!(consultation.pointer("/auth/api_keys").is_none());
-        assert!(consultation
-            .to_string()
-            .contains("/var/lib/registry/public_works_projects.xlsx"));
-    }
-
-    #[test]
-    fn local_snapshot_authoring_rejects_an_oversized_workbook() {
-        let temporary = tempfile::tempdir().unwrap();
-        let embedded = PROJECT_STARTERS.get_dir("spreadsheet").unwrap();
-        copy_embedded_dir(embedded, temporary.path()).unwrap();
-        std::fs::OpenOptions::new()
-            .write(true)
-            .open(temporary.path().join("data/public_works_projects.xlsx"))
-            .unwrap()
-            .set_len(crate::dev_runtime::MAX_LOCAL_SNAPSHOT_BYTES + 1)
-            .unwrap();
-
-        let error = compile_dev_runtime_authoring(temporary.path(), "local")
-            .err()
-            .expect("oversized local snapshot must fail");
-        assert!(
-            error.to_string().contains("unsafe, unreadable, or too large"),
-            "{error:#}"
-        );
-    }
-
-    #[test]
-    fn spreadsheet_integration_requires_explicit_local_snapshot_mode() {
-        let temporary = tempfile::tempdir().unwrap();
-        let embedded = PROJECT_STARTERS.get_dir("spreadsheet").unwrap();
-        copy_embedded_dir(embedded, temporary.path()).unwrap();
-        let environment = temporary.path().join("environments/local.yaml");
-        let bytes = fs::read_to_string(&environment)
-            .unwrap()
-            .replacen("source_mode: local_snapshot", "source_mode: synthetic", 1);
-        fs::write(environment, bytes).unwrap();
-
-        let error = compile_dev_runtime_authoring(temporary.path(), "local")
-            .err()
-            .expect("spreadsheet source cannot use synthetic HTTP mode");
-        assert!(error.to_string().contains("must be local_snapshot"), "{error:#}");
-    }
-
-    #[test]
-    fn records_request_rejects_ambiguous_service_or_purpose() {
-        let temporary = tempfile::tempdir().unwrap();
-        let embedded = PROJECT_STARTERS.get_dir("spreadsheet").unwrap();
-        copy_embedded_dir(embedded, temporary.path()).unwrap();
-        let mut loaded = load_registry_project(temporary.path(), Some("local")).unwrap();
-        loaded
-            .project
-            .services
-            .get_mut("projects-records")
-            .unwrap()
-            .api
-            .as_mut()
-            .unwrap()
-            .required_principal_filters = vec!["district_code".to_string()];
-        let error = select_development_records_request(&loaded, "local")
-            .err()
-            .expect("non-primary principal binding fails");
-        assert!(error.to_string().contains("entity primary key"));
-        loaded
-            .project
-            .services
-            .get_mut("projects-records")
-            .unwrap()
-            .api
-            .as_mut()
-            .unwrap()
-            .required_principal_filters = vec!["project_id".to_string()];
-        loaded
-            .project
-            .services
-            .get_mut("projects-records")
-            .unwrap()
-            .api
-            .as_mut()
-            .unwrap()
-            .purposes
-            .push("secondary-purpose".to_string());
-        let error = select_development_records_request(&loaded, "local")
-            .err()
-            .expect("ambiguous purpose fails");
-        assert!(error.to_string().contains("must contain exactly one purpose"));
-
-        loaded
-            .project
-            .services
-            .get_mut("projects-records")
-            .unwrap()
-            .api
-            .as_mut()
-            .unwrap()
-            .purposes
-            .truncate(1);
-        let second: ServiceDeclaration = serde_norway::from_str(
-            r#"
-kind: records_api
-entity: projects
-api:
-  scopes:
-    metadata: projects:metadata
-    rows: projects:rows
-    aggregate: projects:aggregate
-    evidence_verification: projects:evidence_verification
-  purposes: [public-works-case-management]
-  projection: [project_id]
-  pagination: { default_limit: 1, max_limit: 1 }
-  filters: { project_id: [eq] }
-  required_principal_filters: [project_id]
-  standards: { ogc_features: false, sp_dci: false }
-"#,
-        )
-        .unwrap();
-        loaded
-            .project
-            .services
-            .insert("projects-records-second".to_string(), second);
-        let error = select_development_records_request(&loaded, "local")
-            .err()
-            .expect("ambiguous service fails");
-        assert!(error
-            .to_string()
-            .contains("requires one exact snapshot records service"));
-    }
-
-    #[test]
-    fn opencrvs_oauth_development_scope_uses_its_compiled_service() {
-        let project = Path::new(env!("CARGO_MANIFEST_DIR"))
-            .join("tests/fixtures/project-authoring/opencrvs-events-api");
-        let loaded = load_registry_project(&project, Some("local")).unwrap();
-        let (integration, fixture) =
-            selected_development_fixture(&loaded, "birth-event-search", "birth-event-match")
-                .unwrap();
-        let (caller_id, caller_fingerprint_locator, service_id) = select_development_caller(
-            &loaded,
-            "local",
-            "birth-event-search",
-            "birth-event-match",
-            &fixture.1,
-        )
-        .unwrap();
-        let (_, credential) = development_provider_and_credential(integration);
-        let requirements = development_credential_requirements(
-            DevelopmentCredentialRequirementsInput {
-                loaded: &loaded,
-                environment_id: "local",
-                service_id: &service_id,
-                integration_id: "birth-event-search",
-                source_mode: DevelopmentSourceMode::Synthetic,
-                credential,
-                caller_id: &caller_id,
-                caller_fingerprint_env: &caller_fingerprint_locator,
-                relay_api_key_scopes: None,
-            },
-        )
-        .unwrap();
-        assert_eq!(requirements.service_id, "birth-event-verification");
-        assert!(matches!(
-            requirements.source,
-            DevSourceCredentialProfile::SyntheticOAuthClientCredentials {
-                profile: DevOAuthCredentialProfile::Oauth2BearerNoExpiry,
-                ..
-            }
-        ));
-    }
-
-    #[test]
-    fn spreadsheet_planned_fixture_is_a_complete_development_scenario() {
-        let temporary = tempfile::tempdir().unwrap();
-        let embedded = PROJECT_STARTERS.get_dir("spreadsheet").unwrap();
-        copy_embedded_dir(embedded, temporary.path()).unwrap();
-        let match_projection = compile_dev_runtime_authoring(temporary.path(), "local").unwrap();
-        let match_commitment = match_projection.scenarios[0]
-            .expected_claim_results_sha256
-            .clone();
-        let environment_path = temporary.path().join("environments/local.yaml");
-        let environment = fs::read_to_string(&environment_path)
-            .unwrap()
-            .replace("default_fixture: match", "default_fixture: planned");
-        fs::write(&environment_path, environment).unwrap();
-
-        let projection = compile_dev_runtime_authoring(temporary.path(), "local").unwrap();
-        let scenario = &projection.scenarios[0];
-        assert_eq!(scenario.fixture_id, "planned");
-        assert_ne!(scenario.expected_claim_results_sha256, match_commitment);
-        let request: Value = serde_json::from_slice(&scenario.request_json).unwrap();
-        assert_eq!(
-            request.pointer("/target/identifiers/0/scheme"),
-            Some(&json!("project_id"))
-        );
-        assert_eq!(
-            request.pointer("/target/identifiers/0/value"),
-            Some(&json!("PW-002"))
-        );
-    }
-
-    #[test]
-    fn generated_credentials_bind_and_sign_three_self_verified_development_lanes() {
-        let temporary = tempfile::tempdir().unwrap();
-        let embedded = PROJECT_STARTERS.get_dir("bounded-http").unwrap();
-        copy_embedded_dir(embedded, temporary.path()).unwrap();
-        let project = temporary.path();
-        let authoring = compile_dev_runtime_authoring(project, "local").unwrap();
-        let credentials =
-            PreparedDevCredentialClosure::generate(authoring.credential_requirements()).unwrap();
-        let output = project.join(".registry-stack/dev-artifacts/test/signed-lanes");
-        let signed = compile_and_sign_dev_lanes(project, "local", &credentials, &output).unwrap();
-
-        let lanes = [
-            (
-                &signed.relay_public_bundle,
-                &signed.relay_public_anchor,
-                ProductAcceptanceLaneV1::RelayPublic,
-            ),
-            (
-                &signed.relay_consultation_bundle,
-                &signed.relay_consultation_anchor,
-                ProductAcceptanceLaneV1::RelayConsultation,
-            ),
-            (
-                &signed.notary_bundle,
-                &signed.notary_anchor,
-                ProductAcceptanceLaneV1::Notary,
-            ),
-        ];
-        for (index, (bundle, anchor, lane)) in lanes.into_iter().enumerate() {
-            let verified = registry_platform_config::verify_config_bundle(bundle, anchor).unwrap();
-            assert_eq!(
-                verified.manifest.acceptance_identity.trust_domain,
-                ProductTrustDomainV1::Development
-            );
-            assert_eq!(verified.manifest.acceptance_identity.lane, lane);
-            assert_eq!(
-                verified.manifest.config_hash,
-                signed.lane_config_digests[index]
-            );
-        }
-
-        let verified = registry_platform_config::verify_config_bundle(
-            &signed.relay_consultation_bundle,
-            &signed.relay_consultation_anchor,
-        )
-        .unwrap();
-        let relay: Value = serde_norway::from_slice(&verified.config_bytes).unwrap();
-        assert_eq!(
-            relay.pointer("/auth/oidc/issuer"),
-            Some(&json!("https://registryctl-local-notary.invalid"))
-        );
-        assert_eq!(
-            relay.pointer("/auth/oidc/development_jwks_file"),
-            Some(&json!(
-                "/run/registry/dev-public/notary-workload-jwks.json"
-            ))
-        );
-        assert_eq!(
-            relay.pointer("/consultation/bootstrap/migration_database_url_env"),
-            Some(&json!("REGISTRY_RELAY_CONSULTATION_MIGRATION_DATABASE_URL"))
-        );
-        assert_eq!(
-            relay.pointer("/consultation/bootstrap/owner_role"),
-            Some(&json!("registry_relay_owner"))
-        );
-        let now_unix_ms =
-            i64::try_from(OffsetDateTime::now_utc().unix_timestamp_nanos() / 1_000_000).unwrap();
-        let deadline = relay
-            .pointer("/consultation/bootstrap/active_write_deadline_unix_ms")
-            .and_then(Value::as_i64)
-            .unwrap();
-        assert!(deadline > now_unix_ms);
-        assert!(deadline <= now_unix_ms + DEV_AUDIT_PSEUDONYM_WRITE_WINDOW_MS);
-        assert_eq!(
-            relay.pointer("/consultation/bootstrap/keyring_maintenance_database_url_env"),
-            Some(&json!(
-                "REGISTRY_RELAY_CONSULTATION_MAINTENANCE_DATABASE_URL"
-            ))
-        );
-        assert_eq!(
-            relay.pointer("/consultation/bootstrap/keyring_reader_database_url_env"),
-            Some(&json!("REGISTRY_RELAY_CONSULTATION_READER_DATABASE_URL"))
-        );
-
-        let binding: Value =
-            serde_json::from_slice(
-                &fs::read(signed.relay_consultation_bundle.join(
-                    "config/artifacts/private-bindings/person-verification-person_record.json",
-                ))
-                .unwrap(),
-            )
-            .unwrap();
-        assert_eq!(
-            binding.pointer("/data_destination/origin"),
-            Some(&json!(format!(
-                "{}/",
-                crate::dev_runtime::DEV_SYNTHETIC_SOURCE_ORIGIN
-            )))
-        );
-        assert_eq!(
-            binding.pointer("/data_destination/allowed_private_cidrs"),
-            Some(&json!(["10.89.0.3/32"]))
-        );
-        assert_eq!(
-            binding.pointer("/data_destination/ca/file"),
-            Some(&json!("/run/registry/dev-public/synthetic-source-tls.crt"))
-        );
-        assert_eq!(
-            binding.pointer("/credential_destination/allowed_private_cidrs"),
-            None
-        );
-        assert_eq!(binding.pointer("/credential_destination/ca/file"), None);
-        let notary = registry_platform_config::verify_config_bundle(
-            &signed.notary_bundle,
-            &signed.notary_anchor,
-        )
-        .unwrap();
-        let notary_config: Value = serde_norway::from_slice(&notary.config_bytes).unwrap();
-        let typed_notary: registry_notary_core::StandaloneRegistryNotaryConfig =
-            serde_norway::from_slice(&notary.config_bytes).unwrap();
-        typed_notary.validate().unwrap();
-        assert_eq!(
-            notary_config.pointer("/auth/api_keys/0/fingerprint/name"),
-            Some(&json!("EVIDENCE_CLIENT_TOKEN_HASH"))
-        );
-        assert_eq!(
-            notary_config.pointer("/evidence/relay/base_url"),
-            Some(&json!("http://10.89.0.4:8080"))
-        );
-        assert!(notary_config
-            .pointer("/evidence/relay/root_certificate_path")
-            .is_none());
-        assert_eq!(
-            notary_config.pointer("/evidence/relay/allowed_private_cidrs"),
-            Some(&json!(["10.89.0.4/32"]))
-        );
-        assert_eq!(
-            notary_config.pointer("/evidence/relay/allow_insecure_localhost"),
-            Some(&json!(false))
-        );
-        assert_eq!(
-            notary_config.pointer("/evidence/relay/allow_insecure_private_network"),
-            Some(&json!(false))
-        );
-    }
-
-    #[test]
-    fn invalid_default_reports_exact_fields_and_available_scenario_ids() {
-        let temporary = tempfile::tempdir().unwrap();
-        let embedded = PROJECT_STARTERS.get_dir("bounded-http").unwrap();
-        copy_embedded_dir(embedded, temporary.path()).unwrap();
-        let environment_path = temporary.path().join("environments/local.yaml");
-        let environment = fs::read_to_string(&environment_path).unwrap().replacen(
-            "default_fixture: active-person",
-            "default_fixture: missing",
-            1,
-        );
-        fs::write(environment_path, environment).unwrap();
-
-        let error = compile_dev_runtime_authoring(temporary.path(), "local")
-            .err()
-            .expect("invalid default fails")
-            .to_string();
-        assert!(error.contains(
-            "environments/local.yaml#/development/default_integration and environments/local.yaml#/development/default_fixture"
-        ));
-        assert!(error.contains(
-            "available scenario ids: person-record.active-person, person-record.ambiguous-person, person-record.no-person"
-        ), "{error}");
-    }
-
-    #[test]
-    fn missing_development_field_and_closed_unknown_field_fail_precisely() {
-        let temporary = tempfile::tempdir().unwrap();
-        let embedded = PROJECT_STARTERS.get_dir("bounded-http").unwrap();
-        copy_embedded_dir(embedded, temporary.path()).unwrap();
-        let environment_path = temporary.path().join("environments/local.yaml");
-        let environment = fs::read_to_string(&environment_path).unwrap();
-        let without_fixture = environment.replacen("  default_fixture: active-person\n", "", 1);
-        fs::write(&environment_path, without_fixture).unwrap();
-        let error = compile_dev_runtime_authoring(temporary.path(), "local")
-            .err()
-            .expect("missing default fails")
-            .to_string();
-        assert!(
-            error.contains("environments/local.yaml#/development/default_fixture is required"),
-            "{error}"
-        );
-
-        let unknown = environment.replacen(
-            "  default_fixture: active-person\n",
-            "  default_fixture: active-person\n  arbitrary: forbidden\n",
-            1,
-        );
-        fs::write(environment_path, unknown).unwrap();
-        let error = compile_dev_runtime_authoring(temporary.path(), "local")
-            .err()
-            .expect("unknown development field fails")
-            .to_string();
-        assert!(error.contains("unknown field"), "{error}");
-    }
-
-    #[test]
-    fn operator_bound_is_explicit_and_never_carries_synthetic_material() {
-        let temporary = tempfile::tempdir().unwrap();
-        let embedded = PROJECT_STARTERS.get_dir("bounded-http").unwrap();
-        copy_embedded_dir(embedded, temporary.path()).unwrap();
-        let environment_path = temporary.path().join("environments/local.yaml");
-        let environment = fs::read_to_string(&environment_path).unwrap().replacen(
-            "source_mode: synthetic",
-            "source_mode: operator_bound",
-            1,
-        );
-        fs::write(environment_path, environment).unwrap();
-
-        let projection = compile_dev_runtime_authoring(temporary.path(), "local").unwrap();
-        assert_eq!(
-            projection.development.source_mode,
-            DevSourceMode::OperatorBound
-        );
-        assert!(projection.development.operator_source_binding_present);
-        assert!(projection.scenarios[0].synthetic_source.is_none());
-        assert_eq!(
-            projection.operator_source_secret_env,
-            vec!["FICTIONAL_REGISTRY_TOKEN"]
-        );
-    }
-
-    #[test]
-    fn deployment_profile_is_exposed_for_fail_closed_runtime_rejection() {
-        let temporary = tempfile::tempdir().unwrap();
-        let embedded = PROJECT_STARTERS.get_dir("bounded-http").unwrap();
-        copy_embedded_dir(embedded, temporary.path()).unwrap();
-        let environment_path = temporary.path().join("environments/local.yaml");
-        let environment = fs::read_to_string(&environment_path).unwrap().replacen(
-            "profile: local",
-            "profile: evidence_grade",
-            1,
-        );
-        fs::write(environment_path, environment).unwrap();
-
-        let projection = compile_dev_runtime_authoring(temporary.path(), "local").unwrap();
-        assert_eq!(
-            projection.environment_profile,
-            DevEnvironmentProfile::EvidenceGrade
-        );
-    }
-}
-
-#[test]
-fn development_signing_refuses_the_runtime_secret_root() {
-    let temporary = tempfile::tempdir().unwrap();
-    let embedded = PROJECT_STARTERS.get_dir("bounded-http").unwrap();
-    copy_embedded_dir(embedded, temporary.path()).unwrap();
-    let project = temporary.path();
-    let authoring = compile_dev_runtime_authoring(project, "local").unwrap();
-    let credentials =
-        PreparedDevCredentialClosure::generate(authoring.credential_requirements()).unwrap();
-
-    let error = compile_and_sign_dev_lanes(
-        project,
-        "local",
-        &credentials,
-        &project.join(".registry-stack/dev/test/signed-lanes"),
-    )
-    .unwrap_err();
-    assert!(error
-        .to_string()
-        .contains("must remain under .registry-stack/dev-artifacts"));
-}
diff --git a/crates/registryctl/src/project_authoring/diagnostic_reference.rs b/crates/registryctl/src/project_authoring/diagnostic_reference.rs
index 2b8ccf2f9..72d9b5a30 100644
--- a/crates/registryctl/src/project_authoring/diagnostic_reference.rs
+++ b/crates/registryctl/src/project_authoring/diagnostic_reference.rs
@@ -8,9 +8,6 @@
 
 use std::collections::BTreeSet;
 
-use registry_notary_server::{
-    NotaryActivationCode, NotaryActivationCodeLifecycle, NOTARY_ACTIVATION_CODE_DEFINITIONS,
-};
 use registry_platform_ops::{
     BundleVerificationCode, BundleVerificationCodeLifecycle, BundleVerificationEvidencePolicy,
     BUNDLE_VERIFICATION_CODE_DEFINITIONS,
@@ -44,7 +41,6 @@ pub enum ErrorReferenceFamily {
     AuthoringValidation,
     BundleVerification,
     FixtureExecution,
-    NotaryActivation,
     OperatorPreflight,
     RelayActivation,
     RelayProcessStartup,
@@ -57,7 +53,6 @@ impl ErrorReferenceFamily {
             Self::AuthoringValidation => "authoring_validation",
             Self::BundleVerification => "bundle_verification",
             Self::FixtureExecution => "fixture_execution",
-            Self::NotaryActivation => "notary_activation",
             Self::OperatorPreflight => "operator_preflight",
             Self::RelayActivation => "relay_activation",
             Self::RelayProcessStartup => "relay_process_startup",
@@ -69,7 +64,6 @@ impl ErrorReferenceFamily {
             Self::AuthoringValidation => "authoring",
             Self::FixtureExecution => "fixture",
             Self::BundleVerification
-            | Self::NotaryActivation
             | Self::OperatorPreflight
             | Self::RelayActivation
             | Self::RelayProcessStartup => "operator",
@@ -80,7 +74,6 @@ impl ErrorReferenceFamily {
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
 #[serde(rename_all = "snake_case")]
 pub enum ErrorReferenceOwner {
-    RegistryNotary,
     RegistryPlatformOps,
     RegistryRelay,
     Registryctl,
@@ -90,7 +83,6 @@ impl ErrorReferenceOwner {
     #[must_use]
     pub const fn as_str(self) -> &'static str {
         match self {
-            Self::RegistryNotary => "registry_notary",
             Self::RegistryPlatformOps => "registry_platform_ops",
             Self::RegistryRelay => "registry_relay",
             Self::Registryctl => "registryctl",
@@ -101,7 +93,6 @@ impl ErrorReferenceOwner {
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
 #[serde(rename_all = "snake_case")]
 pub enum ErrorReferenceProduct {
-    RegistryNotary,
     RegistryPlatformOps,
     RegistryRelay,
     Registryctl,
@@ -112,7 +103,6 @@ impl ErrorReferenceProduct {
     #[must_use]
     pub const fn as_str(self) -> &'static str {
         match self {
-            Self::RegistryNotary => "registry_notary",
             Self::RegistryPlatformOps => "registry_platform_ops",
             Self::RegistryRelay => "registry_relay",
             Self::Registryctl => "registryctl",
@@ -183,7 +173,6 @@ pub struct FixtureErrorReferenceV1 {
 #[serde(rename_all = "snake_case")]
 pub enum OperatorErrorOmissionFamily {
     BundleVerification,
-    NotaryActivation,
     OperatorPreflight,
     RelayActivation,
     RelayProcessStartup,
@@ -193,7 +182,6 @@ impl OperatorErrorOmissionFamily {
     const fn as_str(self) -> &'static str {
         match self {
             Self::BundleVerification => "bundle_verification",
-            Self::NotaryActivation => "notary_activation",
             Self::OperatorPreflight => "operator_preflight",
             Self::RelayActivation => "relay_activation",
             Self::RelayProcessStartup => "relay_process_startup",
@@ -319,7 +307,6 @@ pub fn fixture_error_reference() -> FixtureErrorReferenceV1 {
 pub fn operator_error_reference() -> OperatorErrorReferenceV1 {
     let mut entries = preflight_reference_entries();
     entries.extend(bundle_verification_reference_entries());
-    entries.extend(notary_activation_reference_entries());
     entries.extend(relay_activation_reference_entries());
     entries.extend(relay_process_startup_reference_entries());
     entries.sort_by(|left, right| entry_key(left).cmp(&entry_key(right)));
@@ -488,44 +475,6 @@ fn relay_process_startup_reference_entries() -> Vec<ErrorReferenceEntry> {
         .collect()
 }
 
-fn notary_activation_reference_entries() -> Vec<ErrorReferenceEntry> {
-    NOTARY_ACTIVATION_CODE_DEFINITIONS
-        .iter()
-        .map(|definition| {
-            let code = definition.code.as_str().to_string();
-            let lifecycle = match definition.lifecycle {
-                NotaryActivationCodeLifecycle::Unreleased => ErrorReferenceLifecycle::Unreleased,
-                NotaryActivationCodeLifecycle::Released { .. } => ErrorReferenceLifecycle::Released,
-            };
-            ErrorReferenceEntry {
-                family: ErrorReferenceFamily::NotaryActivation,
-                code: code.clone(),
-                owner: ErrorReferenceOwner::RegistryNotary,
-                product: ErrorReferenceProduct::RegistryNotary,
-                phase: definition.phase.to_string(),
-                safe_meaning: definition.meaning.to_string(),
-                rule: definition.rule.to_string(),
-                safe_remediation: definition.remediation.to_string(),
-                field_address_pattern: None,
-                evidence_scope: definition.evidence_scope.to_string(),
-                secret_sensitive_value_policy: ErrorReferenceValuePolicy::NoRuntimeValues,
-                docs_anchor: docs_anchor(
-                    ErrorReferenceFamily::NotaryActivation,
-                    ErrorReferenceProduct::RegistryNotary,
-                    definition.docs_slug,
-                ),
-                lifecycle,
-                introduced_in: definition
-                    .lifecycle
-                    .introduced_version()
-                    .map(str::to_string),
-                stability: ErrorReferenceStability::Pre1StableCode,
-                evidence_limitation: definition.evidence_limitation.to_string(),
-            }
-        })
-        .collect()
-}
-
 fn expected_operator_omissions() -> Vec<OperatorErrorOmission> {
     Vec::new()
 }
@@ -685,28 +634,6 @@ fn validate_source_catalogs() -> Result<(), ErrorReferenceValidationError> {
     {
         return Err(ErrorReferenceValidationError::SourceCatalogMismatch);
     }
-    let mut notary_docs_slugs = BTreeSet::new();
-    if NOTARY_ACTIVATION_CODE_DEFINITIONS.len() != NotaryActivationCode::ALL.len()
-        || !NotaryActivationCode::ALL.iter().all(|code| {
-            let definition = code.definition();
-            definition.code == *code
-                && notary_lifecycle_version_is_valid(definition.lifecycle)
-                && static_metadata_is_complete(&[
-                    definition.phase,
-                    definition.meaning,
-                    definition.rule,
-                    definition.remediation,
-                    definition.evidence_scope,
-                    definition.evidence_policy,
-                    definition.evidence_limitation,
-                ])
-                && docs_slug_is_valid(definition.docs_slug)
-                && notary_docs_slugs.insert(definition.docs_slug)
-                && NOTARY_ACTIVATION_CODE_DEFINITIONS.contains(definition)
-        })
-    {
-        return Err(ErrorReferenceValidationError::SourceCatalogMismatch);
-    }
     Ok(())
 }
 
@@ -721,15 +648,6 @@ fn docs_slug_is_valid(slug: &str) -> bool {
             .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'-')
 }
 
-fn notary_lifecycle_version_is_valid(lifecycle: NotaryActivationCodeLifecycle) -> bool {
-    match lifecycle {
-        NotaryActivationCodeLifecycle::Unreleased => lifecycle.introduced_version().is_none(),
-        NotaryActivationCodeLifecycle::Released { introduced_version } => {
-            is_numeric_release_version(introduced_version)
-        }
-    }
-}
-
 fn lifecycle_version_is_valid(
     lifecycle: ErrorReferenceLifecycle,
     introduced_in: Option<&str>,
@@ -786,10 +704,6 @@ fn expected_docs_anchor(entry: &ErrorReferenceEntry) -> String {
             .iter()
             .find(|definition| definition.code.as_str() == entry.code)
             .map(|definition| definition.docs_slug),
-        ErrorReferenceFamily::NotaryActivation => NOTARY_ACTIVATION_CODE_DEFINITIONS
-            .iter()
-            .find(|definition| definition.code.as_str() == entry.code)
-            .map(|definition| definition.docs_slug),
         ErrorReferenceFamily::RelayActivation => consultation_service_activation_definitions()
             .iter()
             .find(|definition| definition.code.as_str() == entry.code)
diff --git a/crates/registryctl/src/project_authoring/diagnostics.rs b/crates/registryctl/src/project_authoring/diagnostics.rs
index 544972cd1..82f8fa8d0 100644
--- a/crates/registryctl/src/project_authoring/diagnostics.rs
+++ b/crates/registryctl/src/project_authoring/diagnostics.rs
@@ -442,10 +442,6 @@ fn collect_project_authoring_diagnostics(
             &project,
             &integrations,
         ));
-        diagnostics.extend(claim_integration_link_diagnostics(
-            &project,
-            &integrations,
-        ));
         if validate_project_entity_links(&project, &integrations, &entities).is_err() {
             if let Some(collision) = project_records_scope_collision(&project, &entities) {
                 let (field, cause, remediation) = match collision.kind {
@@ -528,7 +524,7 @@ fn project_declaration_semantic_diagnostics(
     for (service_id, service) in project
         .services
         .iter()
-        .filter(|(_, service)| service.kind == ServiceKind::Evidence)
+        .filter(|(_, service)| service.kind == ServiceKind::ConsultationApi)
     {
         for (consultation_id, consultation) in &service.consultations {
             if !project.integrations.contains_key(&consultation.integration) {
@@ -579,115 +575,6 @@ fn project_declaration_semantic_diagnostics(
             }
         }
 
-        for (claim_id, claim) in &service.claims {
-            if let Some(output) = claim.output.as_deref() {
-                let consultation = output.split_once('.').map(|(name, _)| name);
-                if consultation.is_none()
-                    || consultation.is_some_and(|name| !service.consultations.contains_key(name))
-                {
-                    diagnostics.push(cross_file_diagnostic(
-                        "registryctl.authoring.project.invalid",
-                        PROJECT_FILE,
-                        Some("services.claims.output"),
-                        "A direct claim output does not name a declared consultation.",
-                        "Use <consultation>.<output> with a consultation declared by this service.",
-                        Some(PROJECT_SCHEMA_HINT),
-                        vec![
-                            diagnostic_address(
-                                PROJECT_FILE,
-                                &["services", service_id, "claims", claim_id, "output"],
-                            ),
-                            diagnostic_address(
-                                PROJECT_FILE,
-                                &["services", service_id, "consultations"],
-                            ),
-                        ],
-                    ));
-                }
-            } else if let Some(expression) = claim.cel.as_deref() {
-                let roots = cel_member_roots(expression);
-                if roots.as_ref().is_err()
-                    || roots.is_ok_and(|roots| {
-                        !service
-                            .consultations
-                            .keys()
-                            .any(|name| roots.contains(name.as_str()))
-                    })
-                {
-                    diagnostics.push(cross_file_diagnostic(
-                        "registryctl.authoring.project.invalid",
-                        PROJECT_FILE,
-                        Some("services.claims.cel"),
-                        "A claim evaluation does not resolve to a declared consultation.",
-                        "Reference one declared Relay consultation.",
-                        Some(PROJECT_SCHEMA_HINT),
-                        vec![
-                            diagnostic_address(
-                                PROJECT_FILE,
-                                &["services", service_id, "claims", claim_id, "cel"],
-                            ),
-                            diagnostic_address(
-                                PROJECT_FILE,
-                                &["services", service_id, "consultations"],
-                            ),
-                        ],
-                    ));
-                }
-            }
-        }
-
-        for (profile_id, profile) in &service.credential_profiles {
-            for (index, claim_id) in profile.claims.iter().enumerate() {
-                if !service.claims.contains_key(claim_id) {
-                    let index = index.to_string();
-                    diagnostics.push(cross_file_diagnostic(
-                        "registryctl.authoring.project.invalid",
-                        PROJECT_FILE,
-                        Some("services.credential_profiles.claims"),
-                        "A credential profile references an unknown claim.",
-                        "Reference only claims declared by this service.",
-                        Some(PROJECT_SCHEMA_HINT),
-                        vec![
-                            diagnostic_address(
-                                PROJECT_FILE,
-                                &[
-                                    "services",
-                                    service_id,
-                                    "credential_profiles",
-                                    profile_id,
-                                    "claims",
-                                    &index,
-                                ],
-                            ),
-                            diagnostic_address(
-                                PROJECT_FILE,
-                                &["services", service_id, "claims"],
-                            ),
-                        ],
-                    ));
-                }
-            }
-            if parse_validity_seconds(&profile.validity).is_err() {
-                diagnostics.push(cross_file_diagnostic(
-                    "registryctl.authoring.project.invalid",
-                    PROJECT_FILE,
-                    Some("services.credential_profiles.validity"),
-                    "A credential profile validity is invalid.",
-                    "Use a positive bounded validity in seconds, minutes, or hours.",
-                    Some(PROJECT_SCHEMA_HINT),
-                    vec![diagnostic_address(
-                        PROJECT_FILE,
-                        &[
-                            "services",
-                            service_id,
-                            "credential_profiles",
-                            profile_id,
-                            "validity",
-                        ],
-                    )],
-                ));
-            }
-        }
     }
     diagnostics
 }
@@ -932,7 +819,7 @@ fn service_integration_link_diagnostics(
     for (service_id, service) in project
         .services
         .iter()
-        .filter(|(_, service)| service.kind == ServiceKind::Evidence)
+        .filter(|(_, service)| service.kind == ServiceKind::ConsultationApi)
     {
         for (consultation_id, consultation) in &service.consultations {
             let Some(integration) = integrations.get(&consultation.integration) else {
@@ -1020,56 +907,6 @@ fn service_integration_link_diagnostics(
     diagnostics
 }
 
-fn claim_integration_link_diagnostics(
-    project: &RegistryProject,
-    integrations: &BTreeMap<String, LoadedIntegration>,
-) -> Vec<ProjectAuthoringDiagnostic> {
-    let mut diagnostics = Vec::new();
-    for (service_id, service) in project
-        .services
-        .iter()
-        .filter(|(_, service)| service.kind == ServiceKind::Evidence)
-    {
-        for (claim_id, claim) in &service.claims {
-            let Some((consultation_id, output_id)) =
-                claim.output.as_deref().and_then(|output| output.split_once('.'))
-            else {
-                continue;
-            };
-            let Some(consultation) = service.consultations.get(consultation_id) else {
-                continue;
-            };
-            let Some(integration) = integrations.get(&consultation.integration) else {
-                continue;
-            };
-            if integration.document.outputs.contains_key(output_id) {
-                continue;
-            }
-            let Some(reference) = project.integrations.get(&consultation.integration) else {
-                continue;
-            };
-            let integration_file =
-                relative_path_string(&reference.file).unwrap_or_else(|| PROJECT_FILE.to_string());
-            diagnostics.push(cross_file_diagnostic(
-                "registryctl.authoring.project.invalid",
-                PROJECT_FILE,
-                Some("services.claims.output"),
-                "A direct claim references an unknown integration output.",
-                "Reference an output declared by the selected consultation's integration.",
-                Some(PROJECT_SCHEMA_HINT),
-                vec![
-                    diagnostic_address(
-                        PROJECT_FILE,
-                        &["services", service_id, "claims", claim_id, "output"],
-                    ),
-                    diagnostic_address(&integration_file, &["outputs"]),
-                ],
-            ));
-        }
-    }
-    diagnostics
-}
-
 fn project_entity_link_diagnostics(
     project: &RegistryProject,
     integrations: &BTreeMap<String, LoadedIntegration>,
@@ -1660,23 +1497,6 @@ fn collect_environment_semantics(
             ));
         }
     }
-    if let Some(issuance) = &environment.issuance {
-        if issuance.generation == 0
-            || validate_secret_reference(&issuance.signing_key).is_err()
-            || validate_token(&issuance.issuer, "issuance issuer", 2048).is_err()
-            || validate_token(&issuance.signing_kid, "issuance signing kid", 2048).is_err()
-        {
-            diagnostics.push(environment_invalid(
-                &file,
-                "issuance",
-                "The issuance binding is invalid.",
-                "Use bounded issuer metadata, a safe secret reference, and a positive generation.",
-            ));
-        }
-    }
-    if let Some(diagnostic) = representative_issuance_diagnostic(project, environment, &file) {
-        diagnostics.push(diagnostic);
-    }
     if environment
         .relay
         .as_ref()
@@ -1686,7 +1506,7 @@ fn collect_environment_semantics(
             &file,
             "relay.allowed_clients",
             "The public Relay has no admitted OpenID Connect client.",
-            "Add at least one intended public Relay client id. Keep the private Notary workload client only in notary_relay.",
+            "Add at least one intended Relay client id.",
         ));
     }
     if diagnostics.len() == before
@@ -1702,245 +1522,6 @@ fn collect_environment_semantics(
     }
 }
 
-fn representative_issuance_diagnostic(
-    project: &RegistryProject,
-    environment: &EnvironmentDocument,
-    file: &str,
-) -> Option<ProjectAuthoringDiagnostic> {
-    let binding = environment.oid4vci.as_ref()?;
-    let representative = binding.representative_issuance.as_ref()?;
-    if !binding.registrar_clients.is_empty() {
-        return Some(cross_file_diagnostic(
-            "registryctl.authoring.environment.invalid",
-            file,
-            Some("oid4vci.representative_issuance"),
-            "Representative issuance and registrar-created offers select incompatible authorities in Registryctl's single-credential binding.",
-            "Remove registrar_clients, or use a separate environment and Notary deployment for the registrar-created credential.",
-            Some(ENVIRONMENT_SCHEMA_HINT),
-            vec![
-                diagnostic_address(file, &["oid4vci", "registrar_clients"]),
-                diagnostic_address(file, &["oid4vci", "representative_issuance"]),
-            ],
-        ));
-    }
-    let service = project.services.get(&binding.credential.service)?;
-    let credential = service
-        .credential_profiles
-        .get(&binding.credential.profile)?;
-    let credential_claim = credential.claims.first()?;
-    let environment_proof = diagnostic_address(
-        file,
-        &["oid4vci", "representative_issuance", "proof_claim"],
-    );
-    if let Some((shared_profile, _)) =
-        service
-            .credential_profiles
-            .iter()
-            .find(|(profile_id, profile)| {
-                *profile_id != &binding.credential.profile
-                    && profile
-                        .claims
-                        .iter()
-                        .any(|claim_id| claim_id == credential_claim)
-            })
-    {
-        return Some(cross_file_diagnostic(
-            "registryctl.authoring.environment.invalid",
-            file,
-            Some("oid4vci.credential.profile"),
-            "The representative credential claim is shared by another credential profile.",
-            "Use a credential claim root that is exclusive to the representative profile, or create a separate representative-specific claim.",
-            Some(ENVIRONMENT_SCHEMA_HINT),
-            vec![
-                diagnostic_address(file, &["oid4vci", "credential", "profile"]),
-                diagnostic_address(
-                    PROJECT_FILE,
-                    &[
-                        "services",
-                        &binding.credential.service,
-                        "credential_profiles",
-                        &binding.credential.profile,
-                        "claims",
-                    ],
-                ),
-                diagnostic_address(
-                    PROJECT_FILE,
-                    &[
-                        "services",
-                        &binding.credential.service,
-                        "credential_profiles",
-                        shared_profile,
-                        "claims",
-                    ],
-                ),
-            ],
-        ));
-    }
-
-    let Some(proof) = service.claims.get(&representative.proof_claim) else {
-        return Some(cross_file_diagnostic(
-            "registryctl.authoring.environment.invalid",
-            file,
-            Some("oid4vci.representative_issuance.proof_claim"),
-            "The representative proof claim does not exist in the selected credential service.",
-            "Set proof_claim to a registry-backed claim in the same service as the credential profile.",
-            Some(ENVIRONMENT_SCHEMA_HINT),
-            vec![
-                environment_proof,
-                diagnostic_address(
-                    PROJECT_FILE,
-                    &["services", &binding.credential.service, "claims"],
-                ),
-            ],
-        ));
-    };
-    if representative.proof_claim == *credential_claim {
-        return Some(cross_file_diagnostic(
-            "registryctl.authoring.environment.invalid",
-            file,
-            Some("oid4vci.representative_issuance.proof_claim"),
-            "The representative proof claim is also the credential claim.",
-            "Use a separate registry-backed claim that proves the relationship; Registryctl will add it as a dependency of the credential claim.",
-            Some(ENVIRONMENT_SCHEMA_HINT),
-            vec![
-                environment_proof,
-                diagnostic_address(
-                    PROJECT_FILE,
-                    &[
-                        "services",
-                        &binding.credential.service,
-                        "credential_profiles",
-                        &binding.credential.profile,
-                        "claims",
-                    ],
-                ),
-            ],
-        ));
-    }
-    if inferred_claim_evidence(service, proof).ok()? != ClaimEvidence::RegistryBacked {
-        return Some(cross_file_diagnostic(
-            "registryctl.authoring.environment.invalid",
-            file,
-            Some("oid4vci.representative_issuance.proof_claim"),
-            "The representative proof claim is not backed by a registry consultation.",
-            "Bind proof_claim to a Relay consultation that verifies the relationship in an authoritative source.",
-            Some(ENVIRONMENT_SCHEMA_HINT),
-            vec![
-                environment_proof,
-                diagnostic_address(
-                    PROJECT_FILE,
-                    &[
-                        "services",
-                        &binding.credential.service,
-                        "claims",
-                        &representative.proof_claim,
-                    ],
-                ),
-            ],
-        ));
-    }
-    let consultation_name = claim_consultation_name(service, proof).ok()?;
-    let consultation = service.consultations.get(consultation_name)?;
-    let requester_mapping = format!(
-        "request.requester.identifiers.{}",
-        binding.subject.id_type
-    );
-    if !consultation
-        .input
-        .values()
-        .any(|mapping| mapping == &requester_mapping)
-    {
-        return Some(cross_file_diagnostic(
-            "registryctl.authoring.environment.invalid",
-            file,
-            Some("oid4vci.representative_issuance.proof_claim"),
-            "The relationship-proof consultation does not bind the authenticated representative.",
-            "Map one proof-claim consultation input from request.requester.identifiers.<oid4vci subject id_type>.",
-            Some(ENVIRONMENT_SCHEMA_HINT),
-            vec![
-                environment_proof,
-                diagnostic_address(
-                    file,
-                    &["oid4vci", "subject", "id_type"],
-                ),
-                diagnostic_address(
-                    PROJECT_FILE,
-                    &[
-                        "services",
-                        &binding.credential.service,
-                        "consultations",
-                        consultation_name,
-                        "input",
-                    ],
-                ),
-            ],
-        ));
-    }
-    let target_mapping = format!(
-        "request.target.identifiers.{}",
-        representative.target_id_type
-    );
-    if !consultation
-        .input
-        .values()
-        .any(|mapping| mapping == &target_mapping)
-    {
-        return Some(cross_file_diagnostic(
-            "registryctl.authoring.environment.invalid",
-            file,
-            Some("oid4vci.representative_issuance.target_id_type"),
-            "The relationship-proof consultation does not bind the represented subject.",
-            "Map one proof-claim consultation input from request.target.identifiers.<representative_issuance target_id_type>.",
-            Some(ENVIRONMENT_SCHEMA_HINT),
-            vec![
-                diagnostic_address(
-                    file,
-                    &["oid4vci", "representative_issuance", "target_id_type"],
-                ),
-                diagnostic_address(
-                    PROJECT_FILE,
-                    &[
-                        "services",
-                        &binding.credential.service,
-                        "consultations",
-                        consultation_name,
-                        "input",
-                    ],
-                ),
-            ],
-        ));
-    }
-    if let Some((input_name, _)) = consultation
-        .input
-        .iter()
-        .find(|(_, mapping)| *mapping != &requester_mapping && *mapping != &target_mapping)
-    {
-        return Some(cross_file_diagnostic(
-            "registryctl.authoring.environment.invalid",
-            file,
-            Some("oid4vci.representative_issuance.proof_claim"),
-            "The relationship-proof consultation requires an input that the target-selection ceremony cannot supply.",
-            "Keep exactly two proof-claim inputs: the authenticated requester identifier and the selected target identifier.",
-            Some(ENVIRONMENT_SCHEMA_HINT),
-            vec![
-                environment_proof,
-                diagnostic_address(
-                    PROJECT_FILE,
-                    &[
-                        "services",
-                        &binding.credential.service,
-                        "consultations",
-                        consultation_name,
-                        "input",
-                        input_name,
-                    ],
-                ),
-            ],
-        ));
-    }
-    None
-}
-
 fn environment_relationship_diagnostic(
     project: &RegistryProject,
     integrations: &BTreeMap<String, LoadedIntegration>,
diff --git a/crates/registryctl/src/project_authoring/documentation.rs b/crates/registryctl/src/project_authoring/documentation.rs
index e9b46c8f8..e139f4e87 100644
--- a/crates/registryctl/src/project_authoring/documentation.rs
+++ b/crates/registryctl/src/project_authoring/documentation.rs
@@ -37,11 +37,7 @@ const ENTITY_SCHEMA: &str = include_str!("../../schemas/project-authoring/entity
 const KNOWLEDGE_ASSET: &str = include_str!("../../schemas/project-authoring/parity-coverage.json");
 const RELAY_RUNTIME_INTENT_ASSET: &str =
     include_str!("../../../registry-relay/config/documentation-intent.json");
-const NOTARY_RUNTIME_INTENT_ASSET: &str =
-    include_str!("../../../registry-notary-core/config/documentation-intent.json");
 const RELAY_RUNTIME_INTENT_SOURCE: &str = "crates/registry-relay/config/documentation-intent.json";
-const NOTARY_RUNTIME_INTENT_SOURCE: &str =
-    "crates/registry-notary-core/config/documentation-intent.json";
 
 const CONSTRAINT_KEYWORDS: [&str; 21] = [
     "const",
@@ -270,7 +266,6 @@ pub enum ConfigurationSchemaKind {
     Fixture,
     Entity,
     Relay,
-    Notary,
 }
 
 impl fmt::Display for ConfigurationSchemaKind {
@@ -282,7 +277,6 @@ impl fmt::Display for ConfigurationSchemaKind {
             Self::Fixture => "fixture",
             Self::Entity => "entity",
             Self::Relay => "relay",
-            Self::Notary => "notary",
         })
     }
 }
@@ -1000,13 +994,8 @@ fn prepare_runtime_intent<'a>(
             "runtime intent must identify the strict v1 intent contract",
         ));
     }
-    if !matches!(
-        intent.runtime_schema,
-        ConfigurationSchemaKind::Relay | ConfigurationSchemaKind::Notary
-    ) {
-        return Err(documentation_error(
-            "runtime intent schema must be relay or notary",
-        ));
+    if !matches!(intent.runtime_schema, ConfigurationSchemaKind::Relay) {
+        return Err(documentation_error("runtime intent schema must be relay"));
     }
     if document.get("$id").and_then(Value::as_str) != Some(intent.schema_id.as_str()) {
         return Err(documentation_error(format!(
@@ -1251,15 +1240,6 @@ fn validate_runtime_profile(
                 GeneratedArtifact::RelayConfig,
                 ReviewClass::Relay,
             ),
-            ConfigurationSchemaKind::Notary => (
-                "notary_",
-                SemanticOwner::NotaryRuntime,
-                HumanOwner::NotaryMaintainers,
-                Product::Notary,
-                Consumer::RegistryNotary,
-                GeneratedArtifact::NotaryConfig,
-                ReviewClass::Notary,
-            ),
             _ => {
                 return Err(documentation_error(
                     "runtime profile validation requires a product runtime schema",
@@ -1285,7 +1265,6 @@ fn validate_runtime_profile(
     } else {
         let product_prefix = match schema {
             ConfigurationSchemaKind::Relay => "registry.relay.config.",
-            ConfigurationSchemaKind::Notary => "registry.notary.config.",
             _ => unreachable!("runtime profile schema was restricted above"),
         };
         let suffix = profile
@@ -1888,52 +1867,29 @@ fn embedded_seven_domain_fields() -> Result<
 > {
     let authored = with_embedded_inputs(generate_configuration_reference)?;
     let relay_document = registry_relay::config::schema::document();
-    let notary_document = registry_notary_core::config::schema::document();
     let relay_intent: RuntimeIntentCatalog = serde_json::from_str(RELAY_RUNTIME_INTENT_ASSET)
         .map_err(|error| documentation_error(format!("embedded Relay runtime intent: {error}")))?;
-    let notary_intent: RuntimeIntentCatalog = serde_json::from_str(NOTARY_RUNTIME_INTENT_ASSET)
-        .map_err(|error| documentation_error(format!("embedded Notary runtime intent: {error}")))?;
     validate_embedded_runtime_identity(
         &relay_intent,
         ConfigurationSchemaKind::Relay,
         "registry-relay.config.schema.json",
     )?;
-    validate_embedded_runtime_identity(
-        &notary_intent,
-        ConfigurationSchemaKind::Notary,
-        "registry-notary.config.schema.json",
-    )?;
     let relay_required =
         runtime_schema_paths(ConfigurationSchemaKind::Relay, &relay_document)?.len();
-    let notary_required =
-        runtime_schema_paths(ConfigurationSchemaKind::Notary, &notary_document)?.len();
     let mut missing = runtime_configuration_intent_gaps(&relay_document, &relay_intent)?;
-    let notary_missing = runtime_configuration_intent_gaps(&notary_document, &notary_intent)?;
     let relay_fields = if missing.is_empty() {
         generate_runtime_configuration_fields(&relay_document, &relay_intent)?
     } else {
         runtime_configuration_fields(&relay_document, &relay_intent)?.0
     };
-    let notary_fields = if notary_missing.is_empty() {
-        generate_runtime_configuration_fields(&notary_document, &notary_intent)?
-    } else {
-        runtime_configuration_fields(&notary_document, &notary_intent)?.0
-    };
     if relay_fields.len() + missing.len() != relay_required {
         return Err(documentation_error(
             "Relay runtime reference coverage does not match its authoritative schema paths",
         ));
     }
-    if notary_fields.len() + notary_missing.len() != notary_required {
-        return Err(documentation_error(
-            "Notary runtime reference coverage does not match its authoritative schema paths",
-        ));
-    }
-    missing.extend(notary_missing);
     missing.sort();
     let mut fields = authored.fields;
     fields.extend(relay_fields);
-    fields.extend(notary_fields);
     fields.sort_by(|left, right| left.address.cmp(&right.address));
     if fields
         .windows(2)
@@ -1968,7 +1924,6 @@ fn combined_source_contract() -> ReferenceSourceContract {
             ConfigurationSchemaKind::Fixture,
             ConfigurationSchemaKind::Entity,
             ConfigurationSchemaKind::Relay,
-            ConfigurationSchemaKind::Notary,
         ],
         schema_sources: vec![
             "project.schema.json".to_owned(),
@@ -1977,11 +1932,10 @@ fn combined_source_contract() -> ReferenceSourceContract {
             "fixture.schema.json".to_owned(),
             "entity.schema.json".to_owned(),
             "registry-relay.config.schema.json".to_owned(),
-            "registry-notary.config.schema.json".to_owned(),
         ],
         field_knowledge: "schemas/project-authoring/parity-coverage.json#field_knowledge",
         human_intent: "schemas/project-authoring/documentation-intent.json",
-        runtime_intent: vec![RELAY_RUNTIME_INTENT_SOURCE, NOTARY_RUNTIME_INTENT_SOURCE],
+        runtime_intent: vec![RELAY_RUNTIME_INTENT_SOURCE],
         reads_country_workspaces: false,
         reads_runtime_configuration: false,
     }
@@ -2855,7 +2809,7 @@ mod tests {
             .expect("embedded reference coverage is readable");
         assert!(!coverage.source_contract.reads_country_workspaces);
         assert!(!coverage.source_contract.reads_runtime_configuration);
-        assert_eq!(coverage.coverage.path_count, 702);
+        assert_eq!(coverage.coverage.path_count, 562);
     }
 
     #[test]
diff --git a/crates/registryctl/src/project_authoring/fixture_coverage.rs b/crates/registryctl/src/project_authoring/fixture_coverage.rs
index 19d2d8ee9..541c4f834 100644
--- a/crates/registryctl/src/project_authoring/fixture_coverage.rs
+++ b/crates/registryctl/src/project_authoring/fixture_coverage.rs
@@ -4,7 +4,7 @@
 //! Coverage is reported per integration target. Evidence contains only stable
 //! identifiers, content digests, bounded counts, closed outcomes, and closed
 //! safe error classes. Fixture values, request material, source observations,
-//! paths, origins, outputs, claims, and secrets have no representation here.
+//! paths, origins, outputs, and secrets have no representation here.
 
 use std::collections::BTreeSet;
 
@@ -19,7 +19,6 @@ pub(crate) const MAX_FIXTURE_COVERAGE_AUTHORED_RECORDS: usize = 1_024;
 pub(crate) const MAX_FIXTURE_COVERAGE_GENERATED_RECORDS: usize =
     MAX_FIXTURE_COVERAGE_AUTHORED_RECORDS * GeneratorRecipeId::ALL.len();
 pub(crate) const MAX_FIXTURE_COVERAGE_PLATFORM_RECORDS: usize = PlatformGeneratedCaseId::ALL.len();
-pub(crate) const MAX_FIXTURE_COVERAGE_CONSULTATIONS: usize = 512;
 
 const INVALID_REPORT: &str = "fixture coverage report violates the closed v1 invariants";
 const INVALID_COMPARISON: &str =
@@ -49,14 +48,6 @@ pub enum LiveCompatibilityEvaluation {
     NotEvaluated,
 }
 
-#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)]
-#[serde(rename_all = "snake_case")]
-pub enum GovernedRequestEvidence {
-    /// Proof method only. Per-target requirement state remains authoritative
-    /// about whether every reachable consultation has a passing witness.
-    PerConsultationAuthoredRequestWitnessEvaluation,
-}
-
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
 #[serde(rename_all = "snake_case")]
 pub enum FixtureCapability {
@@ -89,8 +80,6 @@ pub enum FixtureSemanticOutcome {
 
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
 pub enum FixtureSafeCode {
-    #[serde(rename = "authorization.denied")]
-    AuthorizationDenied,
     #[serde(rename = "failure.subject_mismatch")]
     FailureSubjectMismatch,
     #[serde(rename = "fixture.execution_contract_invalid")]
@@ -128,7 +117,6 @@ pub enum FixtureSafeCode {
 impl FixtureSafeCode {
     pub(crate) fn from_runtime_code(code: &str) -> Self {
         match code {
-            "authorization.denied" => Self::AuthorizationDenied,
             "failure.subject_mismatch" => Self::FailureSubjectMismatch,
             "fixture.execution_contract_invalid" => Self::FixtureExecutionContractInvalid,
             "fixture.profile_not_found" => Self::FixtureProfileNotFound,
@@ -177,14 +165,6 @@ pub enum FixturePassState {
     NotExecuted,
 }
 
-#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
-#[serde(rename_all = "snake_case")]
-pub enum FixtureDisclosureMode {
-    Predicate,
-    Redacted,
-    Value,
-}
-
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
 #[serde(rename_all = "snake_case")]
 pub enum FixtureStatusOutcome {
@@ -248,38 +228,9 @@ pub struct AuthoredSemanticFixtureCoverage {
     pub interaction_count: u32,
     pub input_ids: Vec<String>,
     pub output_ids: Vec<String>,
-    pub claim_ids: Vec<String>,
     pub exercised_status_mappings: Vec<FixtureStatusMapping>,
     pub classification: FixtureCoverageClassification,
     pub pass_state: FixturePassState,
-    pub request_to_consultation_binding: FixtureRequestBindingCoverage,
-}
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)]
-#[serde(rename_all = "snake_case")]
-pub enum FixtureRequestBindingState {
-    NotAuthored,
-    NotExecuted,
-    Passed,
-    Failed,
-}
-
-#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-pub struct FixtureRequestBindingCoverage {
-    pub state: FixtureRequestBindingState,
-    /// Safe authored identities selected by a passing production Notary plan.
-    /// Values, selectors, and rendered requests never enter this report.
-    pub consultations: Vec<FixtureConsultationIdentity>,
-    pub actual_relay_consultations: Option<u32>,
-    pub safe_error_code: Option<FixtureSafeCode>,
-}
-
-#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-pub struct FixtureConsultationIdentity {
-    pub service_id: String,
-    pub consultation_id: String,
 }
 
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
@@ -292,12 +243,11 @@ pub enum GeneratorRecipeId {
     ByteCeiling,
     Timeout,
     ProtocolVerification,
-    AuthorizationBeforeSource,
     OutputMinimization,
 }
 
 impl GeneratorRecipeId {
-    pub const ALL: [Self; 9] = [
+    pub const ALL: [Self; 8] = [
         Self::RequestAuthority,
         Self::RequestOrder,
         Self::StatusRejection,
@@ -305,7 +255,6 @@ impl GeneratorRecipeId {
         Self::ByteCeiling,
         Self::Timeout,
         Self::ProtocolVerification,
-        Self::AuthorizationBeforeSource,
         Self::OutputMinimization,
     ];
 
@@ -318,7 +267,6 @@ impl GeneratorRecipeId {
             Self::ByteCeiling => FixtureMutationTargetClass::DeclaredResponseByteCount,
             Self::Timeout => FixtureMutationTargetClass::SourceDeadline,
             Self::ProtocolVerification => FixtureMutationTargetClass::ProtocolResponseEnvelope,
-            Self::AuthorizationBeforeSource => FixtureMutationTargetClass::AuthorizationGate,
             Self::OutputMinimization => FixtureMutationTargetClass::UnselectedResponseMember,
         }
     }
@@ -334,7 +282,6 @@ impl GeneratorRecipeId {
             }
             Self::ByteCeiling => Some(FixtureSafeCode::SourceResponseTooLarge),
             Self::Timeout => Some(FixtureSafeCode::SourceDeadlineExceeded),
-            Self::AuthorizationBeforeSource => Some(FixtureSafeCode::AuthorizationDenied),
             Self::OutputMinimization => None,
         }
     }
@@ -363,7 +310,6 @@ pub enum FixtureMutationTargetClass {
     DeclaredResponseByteCount,
     SourceDeadline,
     ProtocolResponseEnvelope,
-    AuthorizationGate,
     UnselectedResponseMember,
     SourceCallBudget,
 }
@@ -377,7 +323,6 @@ pub enum GeneratedNotApplicableReason {
     NoDistinguishableRequestPair,
     NoGeneratedRequestMatcher,
     FinalResponseIsNotJsonObject,
-    IntegrationHasNoProductClaims,
     SnapshotUsesClosedMaterialization,
     ProtocolMatcherOwnsResponseMutation,
 }
@@ -391,7 +336,6 @@ pub enum CoverageInvariant {
     OrderMutationRequiresDistinguishableSourceInteractions,
     ProtocolMutationRequiresGeneratedRequestMatcher,
     MutationRequiresFinalJsonObjectResponse,
-    AuthorizationCheckRequiresProductClaimEvaluation,
     SnapshotOutputUsesClosedMaterializationProjection,
     ProtocolMatcherFixtureUsesProtocolVerificationInstead,
 }
@@ -413,20 +357,6 @@ pub struct GeneratedSourceFixture {
     pub fixture_digest: Sha256Digest,
 }
 
-#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)]
-#[serde(rename_all = "snake_case")]
-pub enum SourceCallExpectation {
-    Zero,
-}
-
-#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-pub struct SourceAccessAssertion {
-    pub expected_source_calls: SourceCallExpectation,
-    pub actual_source_calls: Option<u32>,
-    pub passed: bool,
-}
-
 #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct GeneratedFixtureCoverage {
@@ -438,7 +368,6 @@ pub struct GeneratedFixtureCoverage {
     pub expected_safe_code: Option<FixtureSafeCode>,
     pub actual_safe_code: Option<FixtureSafeCode>,
     pub pass_state: FixturePassState,
-    pub source_access_assertion: Option<SourceAccessAssertion>,
 }
 
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
@@ -475,8 +404,6 @@ pub struct PlatformGeneratedFixtureCoverage {
 pub struct FixtureCoverageDimensions {
     pub input_ids: Vec<String>,
     pub output_ids: Vec<String>,
-    pub claim_ids: Vec<String>,
-    pub disclosure_modes: Vec<FixtureDisclosureMode>,
     pub status_mappings: Vec<FixtureStatusMapping>,
     pub protocol_helpers: Vec<FixtureProtocolHelper>,
     pub limits: Vec<FixtureLimit>,
@@ -506,10 +433,6 @@ pub struct FixtureCoverageTargetContract {
     /// operation cardinality, not a source endpoint or authored path.
     pub source_operation_count: Option<u32>,
     pub reviewed_not_applicable: Vec<FixtureCoverageReviewedNotApplicable>,
-    /// Every registry-backed consultation reachable through claims for this
-    /// integration. Coverage must include an independently authored passing
-    /// request for each identity, not merely any passing fixture.
-    pub registry_backed_consultations: Vec<FixtureConsultationIdentity>,
 }
 
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
@@ -520,22 +443,16 @@ pub enum RequiredFixtureCoverageRequirement {
     SemanticAmbiguity,
     SubjectMismatch,
     SemanticNull,
-    AuthorizationDenial,
     SourceFailure,
     RequestRendering,
-    RequestToConsultationBinding,
     ExpectedSourceInteractions,
     SourceInteractionOrder,
     OutputFields,
-    Claims,
-    DeclaredDisclosureModes,
-    ExercisedDisclosureModes,
     ScriptBranches,
     PaginationAndContinuation,
     StatusMappings,
     ProtocolHelpers,
     ProtocolVerification,
-    AuthorizationBeforeSource,
     MalformedDecoding,
     StructuralLimits,
     RequestBytes,
@@ -548,33 +465,26 @@ pub enum RequiredFixtureCoverageRequirement {
     OutputMinimization,
     ChangedInputAffectedFixtures,
     ChangedOutputAffectedFixtures,
-    ChangedClaimAffectedFixtures,
     ChangedSourceContractAffectedFixtures,
 }
 
 impl RequiredFixtureCoverageRequirement {
-    pub const ALL: [Self; 35] = [
+    pub const ALL: [Self; 28] = [
         Self::SemanticMatch,
         Self::SemanticNoMatch,
         Self::SemanticAmbiguity,
         Self::SubjectMismatch,
         Self::SemanticNull,
-        Self::AuthorizationDenial,
         Self::SourceFailure,
         Self::RequestRendering,
-        Self::RequestToConsultationBinding,
         Self::ExpectedSourceInteractions,
         Self::SourceInteractionOrder,
         Self::OutputFields,
-        Self::Claims,
-        Self::DeclaredDisclosureModes,
-        Self::ExercisedDisclosureModes,
         Self::ScriptBranches,
         Self::PaginationAndContinuation,
         Self::StatusMappings,
         Self::ProtocolHelpers,
         Self::ProtocolVerification,
-        Self::AuthorizationBeforeSource,
         Self::MalformedDecoding,
         Self::StructuralLimits,
         Self::RequestBytes,
@@ -587,7 +497,6 @@ impl RequiredFixtureCoverageRequirement {
         Self::OutputMinimization,
         Self::ChangedInputAffectedFixtures,
         Self::ChangedOutputAffectedFixtures,
-        Self::ChangedClaimAffectedFixtures,
         Self::ChangedSourceContractAffectedFixtures,
     ];
 }
@@ -597,7 +506,6 @@ impl RequiredFixtureCoverageRequirement {
 pub enum FixtureCoverageGapReason {
     RequiredEvidenceMissing,
     TargetHasNoFixtures,
-    RuntimeDimensionNotObserved,
     NumericBoundaryNotExercised,
     ScriptBranchContractNotDeclared,
 }
@@ -605,7 +513,6 @@ pub enum FixtureCoverageGapReason {
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
 #[serde(rename_all = "snake_case")]
 pub enum FixtureCoverageNotApplicableReason {
-    NoProductClaimsDeclared,
     NoProtocolHelpersDeclared,
     NoVerificationProtocolDeclared,
     NoContinuationProtocolDeclared,
@@ -694,15 +601,13 @@ pub enum FixtureCoverageRequirementState {
 pub enum FixtureCoverageChangeKind {
     ChangedInput,
     ChangedOutput,
-    ChangedClaim,
     ChangedSourceContract,
 }
 
 impl FixtureCoverageChangeKind {
-    pub const ALL: [Self; 4] = [
+    pub const ALL: [Self; 3] = [
         Self::ChangedInput,
         Self::ChangedOutput,
-        Self::ChangedClaim,
         Self::ChangedSourceContract,
     ];
 
@@ -712,7 +617,6 @@ impl FixtureCoverageChangeKind {
             Self::ChangedOutput => {
                 RequiredFixtureCoverageRequirement::ChangedOutputAffectedFixtures
             }
-            Self::ChangedClaim => RequiredFixtureCoverageRequirement::ChangedClaimAffectedFixtures,
             Self::ChangedSourceContract => {
                 RequiredFixtureCoverageRequirement::ChangedSourceContractAffectedFixtures
             }
@@ -798,7 +702,6 @@ pub struct ProjectFixtureCoverageReportV1 {
     pub evidence_scope: FixtureEvidenceScope,
     pub compatibility_claim: FixtureCompatibilityClaim,
     pub live_compatibility: LiveCompatibilityEvaluation,
-    pub governed_request_evidence: GovernedRequestEvidence,
     pub targets: Vec<FixtureCoverageTarget>,
     pub summary: FixtureCoverageSummary,
 }
@@ -812,7 +715,6 @@ struct UncheckedProjectFixtureCoverageReportV1 {
     evidence_scope: FixtureEvidenceScope,
     compatibility_claim: FixtureCompatibilityClaim,
     live_compatibility: LiveCompatibilityEvaluation,
-    governed_request_evidence: GovernedRequestEvidence,
     targets: Vec<FixtureCoverageTarget>,
     summary: FixtureCoverageSummary,
 }
@@ -831,15 +733,13 @@ impl ProjectFixtureCoverageReportV1 {
             evidence_scope: FixtureEvidenceScope::OfflineSynthetic,
             compatibility_claim: FixtureCompatibilityClaim::None,
             live_compatibility: LiveCompatibilityEvaluation::NotEvaluated,
-            governed_request_evidence:
-                GovernedRequestEvidence::PerConsultationAuthoredRequestWitnessEvaluation,
             targets,
             summary,
         };
         Self::try_from(unchecked)
     }
 
-    /// Adds a closed semantic comparison and recomputes the four affected
+    /// Adds a closed semantic comparison and recomputes the three affected
     /// fixture requirements for every target. Selection is deliberately based
     /// only on declared fixture member identifiers. Generated cases are a
     /// different evidence class and can never become affected authored
@@ -880,7 +780,6 @@ impl ProjectFixtureCoverageReportV1 {
             evidence_scope: self.evidence_scope,
             compatibility_claim: self.compatibility_claim,
             live_compatibility: self.live_compatibility,
-            governed_request_evidence: self.governed_request_evidence,
             targets: self.targets,
             summary: self.summary,
         };
@@ -900,7 +799,6 @@ impl TryFrom<UncheckedProjectFixtureCoverageReportV1> for ProjectFixtureCoverage
             evidence_scope: value.evidence_scope,
             compatibility_claim: value.compatibility_claim,
             live_compatibility: value.live_compatibility,
-            governed_request_evidence: value.governed_request_evidence,
             targets: value.targets,
             summary: value.summary,
         })
@@ -922,7 +820,6 @@ pub struct FixtureCoverageTargetComparisonInput {
     pub integration: String,
     pub changed_input_ids: Vec<String>,
     pub changed_output_ids: Vec<String>,
-    pub changed_claim_ids: Vec<String>,
     pub source_contract_changed: bool,
 }
 
@@ -964,7 +861,6 @@ fn validate_comparison_input_targets(
             !is_report_identifier(&target.integration)
                 || !is_sorted_unique_identifiers(&target.changed_input_ids)
                 || !is_sorted_unique_identifiers(&target.changed_output_ids)
-                || !is_sorted_unique_identifiers(&target.changed_claim_ids)
         })
     {
         return Err(INVALID_COMPARISON);
@@ -1018,7 +914,6 @@ fn build_target_comparison(
         let changed_member_ids = match kind {
             FixtureCoverageChangeKind::ChangedInput => input.changed_input_ids.clone(),
             FixtureCoverageChangeKind::ChangedOutput => input.changed_output_ids.clone(),
-            FixtureCoverageChangeKind::ChangedClaim => input.changed_claim_ids.clone(),
             FixtureCoverageChangeKind::ChangedSourceContract if input.source_contract_changed => {
                 vec!["source-contract".to_owned()]
             }
@@ -1034,9 +929,6 @@ fn build_target_comparison(
                 FixtureCoverageChangeKind::ChangedOutput => {
                     slices_intersect(&fixture.output_ids, &changed_member_ids)
                 }
-                FixtureCoverageChangeKind::ChangedClaim => {
-                    slices_intersect(&fixture.claim_ids, &changed_member_ids)
-                }
                 FixtureCoverageChangeKind::ChangedSourceContract => input.source_contract_changed,
             })
             .map(|fixture| fixture.fixture_id.clone())
@@ -1260,7 +1152,6 @@ fn validate_authored_fixture(
         && fixture.interaction_count <= 16
         && is_sorted_unique_identifiers(&fixture.input_ids)
         && is_sorted_unique_identifiers(&fixture.output_ids)
-        && is_sorted_unique_identifiers(&fixture.claim_ids)
         && valid_status_mappings(&fixture.exercised_status_mappings)
         && fixture.exercised_status_mappings.iter().all(|mapping| {
             target.declared.status_mappings.iter().any(|declared| {
@@ -1275,10 +1166,6 @@ fn validate_authored_fixture(
                 target.identity.integration, fixture.fixture_id
             )
         && fixture.evidence.digest == fixture.fixture_digest
-        && valid_request_binding(
-            &fixture.request_to_consultation_binding,
-            &target.contract.registry_backed_consultations,
-        )
 }
 
 fn valid_target_contract(
@@ -1289,7 +1176,6 @@ fn valid_target_contract(
         .reviewed_not_applicable
         .windows(2)
         .all(|pair| pair[0] < pair[1])
-        && valid_consultation_identities(&contract.registry_backed_consultations)
         && match identity.capability {
             FixtureCapability::DeclarativeHttp => contract.source_operation_count.is_some(),
             FixtureCapability::Script | FixtureCapability::Snapshot => {
@@ -1298,42 +1184,6 @@ fn valid_target_contract(
         }
 }
 
-fn valid_request_binding(
-    binding: &FixtureRequestBindingCoverage,
-    declared: &[FixtureConsultationIdentity],
-) -> bool {
-    valid_consultation_identities(&binding.consultations)
-        && slice_is_subset(&binding.consultations, declared)
-        && match binding.state {
-            FixtureRequestBindingState::NotAuthored | FixtureRequestBindingState::NotExecuted => {
-                binding.consultations.is_empty()
-                    && binding.actual_relay_consultations.is_none()
-                    && binding.safe_error_code.is_none()
-            }
-            FixtureRequestBindingState::Passed => {
-                !binding.consultations.is_empty()
-                    && binding
-                        .actual_relay_consultations
-                        .is_some_and(|count| count > 0)
-                    && binding.safe_error_code.is_none()
-            }
-            FixtureRequestBindingState::Failed => {
-                binding.consultations.is_empty()
-                    && binding.actual_relay_consultations.is_some()
-                    && binding.safe_error_code.is_some()
-            }
-        }
-}
-
-fn valid_consultation_identities(identities: &[FixtureConsultationIdentity]) -> bool {
-    identities.len() <= MAX_FIXTURE_COVERAGE_CONSULTATIONS
-        && identities.windows(2).all(|pair| pair[0] < pair[1])
-        && identities.iter().all(|identity| {
-            is_report_identifier(&identity.service_id)
-                && is_report_identifier(&identity.consultation_id)
-        })
-}
-
 fn validate_generated_case(
     target: &FixtureCoverageTarget,
     case: &GeneratedFixtureCoverage,
@@ -1361,8 +1211,7 @@ fn validate_generated_case(
             .is_none_or(|fixture| fixture.fixture_digest != case.source_fixture.fixture_digest)
         || (!applicable
             && (case.pass_state != FixturePassState::NotExecuted
-                || case.actual_safe_code.is_some()
-                || case.source_access_assertion.is_some()))
+                || case.actual_safe_code.is_some()))
         || (applicable
             && case.pass_state == FixturePassState::Passed
             && case.actual_safe_code != case.expected_safe_code)
@@ -1374,16 +1223,7 @@ fn validate_generated_case(
             return false;
         }
     }
-    if case.recipe.id == GeneratorRecipeId::AuthorizationBeforeSource && applicable {
-        case.source_access_assertion
-            .as_ref()
-            .is_some_and(|assertion| {
-                assertion.expected_source_calls == SourceCallExpectation::Zero
-                    && assertion.passed == (assertion.actual_source_calls == Some(0))
-            })
-    } else {
-        case.source_access_assertion.is_none()
-    }
+    true
 }
 
 fn validate_platform_case(
@@ -1460,9 +1300,6 @@ fn validate_comparison(
                 FixtureCoverageChangeKind::ChangedOutput => {
                     slices_intersect(&fixture.output_ids, &impact.changed_member_ids)
                 }
-                FixtureCoverageChangeKind::ChangedClaim => {
-                    slices_intersect(&fixture.claim_ids, &impact.changed_member_ids)
-                }
                 FixtureCoverageChangeKind::ChangedSourceContract => {
                     impact.changed_member_ids == ["source-contract"]
                 }
@@ -1604,22 +1441,6 @@ fn derive_fixture_coverage_requirement(
             authored(|fixture| fixture.semantic_null),
             fixture_gap,
         ),
-        Requirement::AuthorizationDenial => {
-            if target.declared.claim_ids.is_empty() {
-                no_claims_not_applicable(target, requirement)
-            } else {
-                covered_or_missing(
-                    requirement,
-                    authored(|fixture| {
-                        fixture.expectation
-                            == FixtureSemanticExpectation::SafeErrorCode {
-                                code: FixtureSafeCode::AuthorizationDenied,
-                            }
-                    }),
-                    fixture_gap,
-                )
-            }
-        }
         Requirement::SourceFailure => {
             if target.identity.capability == FixtureCapability::Snapshot {
                 no_remote_not_applicable(target, requirement)
@@ -1649,40 +1470,6 @@ fn derive_fixture_coverage_requirement(
                 )
             }
         }
-        Requirement::RequestToConsultationBinding => {
-            let required = &target.contract.registry_backed_consultations;
-            if required.is_empty() {
-                no_claims_not_applicable(target, requirement)
-            } else {
-                let passing = target
-                    .fixture_inventory
-                    .iter()
-                    .filter(|fixture| {
-                        fixture.pass_state == FixturePassState::Passed
-                            && fixture.request_to_consultation_binding.state
-                                == FixtureRequestBindingState::Passed
-                    })
-                    .collect::<Vec<_>>();
-                let covered_consultations = passing
-                    .iter()
-                    .flat_map(|fixture| {
-                        fixture.request_to_consultation_binding.consultations.iter()
-                    })
-                    .collect::<BTreeSet<_>>();
-                let evidence = passing
-                    .into_iter()
-                    .map(|fixture| fixture.evidence.clone())
-                    .collect::<Vec<_>>();
-                if required
-                    .iter()
-                    .all(|consultation| covered_consultations.contains(consultation))
-                {
-                    covered(requirement, evidence)
-                } else {
-                    missing(requirement, fixture_gap, evidence)
-                }
-            }
-        }
         Requirement::ExpectedSourceInteractions => {
             let evidence = authored(|_| true);
             if !target.fixture_inventory.is_empty()
@@ -1726,36 +1513,6 @@ fn derive_fixture_coverage_requirement(
                 missing(requirement, fixture_gap, evidence)
             }
         }
-        Requirement::Claims => {
-            if target.declared.claim_ids.is_empty() {
-                no_claims_not_applicable(target, requirement)
-            } else {
-                let evidence = authored(|fixture| !fixture.claim_ids.is_empty());
-                if target.exercised.claim_ids == target.declared.claim_ids && !evidence.is_empty() {
-                    covered(requirement, evidence)
-                } else {
-                    missing(requirement, fixture_gap, evidence)
-                }
-            }
-        }
-        Requirement::DeclaredDisclosureModes => {
-            if target.declared.claim_ids.is_empty() {
-                no_claims_not_applicable(target, requirement)
-            } else {
-                covered(requirement, vec![target.compiled_contract.clone()])
-            }
-        }
-        Requirement::ExercisedDisclosureModes => {
-            if target.declared.claim_ids.is_empty() {
-                no_claims_not_applicable(target, requirement)
-            } else {
-                missing(
-                    requirement,
-                    FixtureCoverageGapReason::RuntimeDimensionNotObserved,
-                    Vec::new(),
-                )
-            }
-        }
         Requirement::ScriptBranches => {
             if target.identity.capability != FixtureCapability::Script {
                 not_applicable(
@@ -1841,18 +1598,6 @@ fn derive_fixture_coverage_requirement(
                 )
             }
         }
-        Requirement::AuthorizationBeforeSource => {
-            if target.declared.claim_ids.is_empty() {
-                no_claims_not_applicable(target, requirement)
-            } else {
-                generated_requirement(
-                    target,
-                    requirement,
-                    GeneratorRecipeId::AuthorizationBeforeSource,
-                    fixture_gap,
-                )
-            }
-        }
         Requirement::MalformedDecoding => {
             if target.identity.capability == FixtureCapability::Snapshot {
                 no_remote_not_applicable(target, requirement)
@@ -1973,7 +1718,6 @@ fn derive_fixture_coverage_requirement(
         }
         Requirement::ChangedInputAffectedFixtures
         | Requirement::ChangedOutputAffectedFixtures
-        | Requirement::ChangedClaimAffectedFixtures
         | Requirement::ChangedSourceContractAffectedFixtures => {
             comparison_requirement(target, requirement, comparison_reason)
         }
@@ -2020,13 +1764,7 @@ fn generated_recipe_evidence(
         .collect::<Vec<_>>();
     let evidence = applicable
         .iter()
-        .filter(|case| {
-            case.pass_state == FixturePassState::Passed
-                && case
-                    .source_access_assertion
-                    .as_ref()
-                    .is_none_or(|assertion| assertion.passed)
-        })
+        .filter(|case| case.pass_state == FixturePassState::Passed)
         .map(|case| case.evidence.clone())
         .collect::<Vec<_>>();
     (
@@ -2081,17 +1819,6 @@ fn comparison_requirement(
     }
 }
 
-fn no_claims_not_applicable(
-    target: &FixtureCoverageTarget,
-    requirement: RequiredFixtureCoverageRequirement,
-) -> FixtureRequirementCoverage {
-    not_applicable(
-        requirement,
-        FixtureCoverageNotApplicableReason::NoProductClaimsDeclared,
-        vec![target.compiled_contract.clone()],
-    )
-}
-
 fn no_remote_not_applicable(
     target: &FixtureCoverageTarget,
     requirement: RequiredFixtureCoverageRequirement,
@@ -2158,11 +1885,6 @@ fn not_applicable(
 fn valid_dimensions(dimensions: &FixtureCoverageDimensions) -> bool {
     is_sorted_unique_identifiers(&dimensions.input_ids)
         && is_sorted_unique_identifiers(&dimensions.output_ids)
-        && is_sorted_unique_identifiers(&dimensions.claim_ids)
-        && dimensions
-            .disclosure_modes
-            .windows(2)
-            .all(|pair| pair[0] < pair[1])
         && valid_status_mappings(&dimensions.status_mappings)
         && dimensions
             .protocol_helpers
@@ -2190,12 +1912,6 @@ fn dimensions_subset_error(
     if !slice_is_subset(&exercised.output_ids, &declared.output_ids) {
         return Some("fixture coverage exercised outputs exceed declarations");
     }
-    if !slice_is_subset(&exercised.claim_ids, &declared.claim_ids) {
-        return Some("fixture coverage exercised claims exceed declarations");
-    }
-    if !slice_is_subset(&exercised.disclosure_modes, &declared.disclosure_modes) {
-        return Some("fixture coverage exercised disclosure modes exceed declarations");
-    }
     if !exercised.status_mappings.iter().all(|mapping| {
         declared.status_mappings.iter().any(|declared_mapping| {
             mapping.outcome == declared_mapping.outcome
@@ -2318,10 +2034,6 @@ fn generated_not_applicable_is_valid(
             recipe,
             GeneratorRecipeId::ProtocolVerification | GeneratorRecipeId::OutputMinimization
         ),
-        (
-            GeneratedNotApplicableReason::IntegrationHasNoProductClaims,
-            CoverageInvariant::AuthorizationCheckRequiresProductClaimEvaluation,
-        ) => recipe == GeneratorRecipeId::AuthorizationBeforeSource,
         (
             GeneratedNotApplicableReason::SnapshotUsesClosedMaterialization,
             CoverageInvariant::SnapshotOutputUsesClosedMaterializationProjection,
@@ -2343,7 +2055,6 @@ pub(crate) const fn recipe_suffix(recipe: GeneratorRecipeId) -> &'static str {
         GeneratorRecipeId::ByteCeiling => "byte_ceiling",
         GeneratorRecipeId::Timeout => "timeout",
         GeneratorRecipeId::ProtocolVerification => "protocol_verification",
-        GeneratorRecipeId::AuthorizationBeforeSource => "authorization_before_source",
         GeneratorRecipeId::OutputMinimization => "output_minimization",
     }
 }
@@ -2352,7 +2063,6 @@ pub(crate) const fn change_suffix(kind: FixtureCoverageChangeKind) -> &'static s
     match kind {
         FixtureCoverageChangeKind::ChangedInput => "changed-input",
         FixtureCoverageChangeKind::ChangedOutput => "changed-output",
-        FixtureCoverageChangeKind::ChangedClaim => "changed-claim",
         FixtureCoverageChangeKind::ChangedSourceContract => "changed-source-contract",
     }
 }
@@ -2388,15 +2098,4 @@ pub(crate) struct GeneratedFixtureObservation {
     pub recipe_id: GeneratorRecipeId,
     pub actual_safe_code: Option<FixtureSafeCode>,
     pub pass_state: FixturePassState,
-    pub actual_source_calls: Option<u32>,
-}
-
-#[derive(Clone, Debug)]
-pub(crate) struct AuthoredRequestBindingObservation {
-    pub integration: String,
-    pub source_fixture_id: String,
-    pub pass_state: FixturePassState,
-    pub consultations: Vec<FixtureConsultationIdentity>,
-    pub actual_safe_code: Option<FixtureSafeCode>,
-    pub actual_relay_consultations: Option<u32>,
 }
diff --git a/crates/registryctl/src/project_authoring/fixture_diagnostics.rs b/crates/registryctl/src/project_authoring/fixture_diagnostics.rs
index ae79caee7..d7baf3f13 100644
--- a/crates/registryctl/src/project_authoring/fixture_diagnostics.rs
+++ b/crates/registryctl/src/project_authoring/fixture_diagnostics.rs
@@ -30,12 +30,6 @@ macro_rules! fixture_diagnostic {
 /// Complete Registryctl offline-fixture diagnostic catalog in lexical code
 /// order.
 pub(crate) const FIXTURE_DIAGNOSTIC_DEFINITIONS: &[FixtureDiagnosticDefinition] = &[
-    fixture_diagnostic!(
-        AuthorizationDenied,
-        "Authorization denied fixture execution before source access.",
-        "authorization_before_source",
-        "Align the fixture identity and authorization expectation with the compiled policy."
-    ),
     fixture_diagnostic!(
         FailureSubjectMismatch,
         "The source observation did not preserve the requested subject binding.",
@@ -136,21 +130,20 @@ pub(crate) const fn fixture_diagnostic_definition(
     code: FixtureSafeCode,
 ) -> &'static FixtureDiagnosticDefinition {
     match code {
-        FixtureSafeCode::AuthorizationDenied => &FIXTURE_DIAGNOSTIC_DEFINITIONS[0],
-        FixtureSafeCode::FailureSubjectMismatch => &FIXTURE_DIAGNOSTIC_DEFINITIONS[1],
-        FixtureSafeCode::FixtureExecutionContractInvalid => &FIXTURE_DIAGNOSTIC_DEFINITIONS[2],
-        FixtureSafeCode::FixtureProfileNotFound => &FIXTURE_DIAGNOSTIC_DEFINITIONS[3],
-        FixtureSafeCode::FixtureRequestMismatch => &FIXTURE_DIAGNOSTIC_DEFINITIONS[4],
-        FixtureSafeCode::FixtureSourceOperationUnknown => &FIXTURE_DIAGNOSTIC_DEFINITIONS[5],
-        FixtureSafeCode::InputPatternMismatch => &FIXTURE_DIAGNOSTIC_DEFINITIONS[6],
-        FixtureSafeCode::RedactedUnclassifiedError => &FIXTURE_DIAGNOSTIC_DEFINITIONS[7],
-        FixtureSafeCode::SourceCallBudgetExceeded => &FIXTURE_DIAGNOSTIC_DEFINITIONS[8],
-        FixtureSafeCode::SourceCardinalityViolation => &FIXTURE_DIAGNOSTIC_DEFINITIONS[9],
-        FixtureSafeCode::SourceDeadlineExceeded => &FIXTURE_DIAGNOSTIC_DEFINITIONS[10],
-        FixtureSafeCode::SourceResponseMalformed => &FIXTURE_DIAGNOSTIC_DEFINITIONS[11],
-        FixtureSafeCode::SourceResponseTooLarge => &FIXTURE_DIAGNOSTIC_DEFINITIONS[12],
-        FixtureSafeCode::SourceStatusRejected => &FIXTURE_DIAGNOSTIC_DEFINITIONS[13],
-        FixtureSafeCode::SourceUnavailable => &FIXTURE_DIAGNOSTIC_DEFINITIONS[14],
-        FixtureSafeCode::SourceUnavailableLegacy => &FIXTURE_DIAGNOSTIC_DEFINITIONS[15],
+        FixtureSafeCode::FailureSubjectMismatch => &FIXTURE_DIAGNOSTIC_DEFINITIONS[0],
+        FixtureSafeCode::FixtureExecutionContractInvalid => &FIXTURE_DIAGNOSTIC_DEFINITIONS[1],
+        FixtureSafeCode::FixtureProfileNotFound => &FIXTURE_DIAGNOSTIC_DEFINITIONS[2],
+        FixtureSafeCode::FixtureRequestMismatch => &FIXTURE_DIAGNOSTIC_DEFINITIONS[3],
+        FixtureSafeCode::FixtureSourceOperationUnknown => &FIXTURE_DIAGNOSTIC_DEFINITIONS[4],
+        FixtureSafeCode::InputPatternMismatch => &FIXTURE_DIAGNOSTIC_DEFINITIONS[5],
+        FixtureSafeCode::RedactedUnclassifiedError => &FIXTURE_DIAGNOSTIC_DEFINITIONS[6],
+        FixtureSafeCode::SourceCallBudgetExceeded => &FIXTURE_DIAGNOSTIC_DEFINITIONS[7],
+        FixtureSafeCode::SourceCardinalityViolation => &FIXTURE_DIAGNOSTIC_DEFINITIONS[8],
+        FixtureSafeCode::SourceDeadlineExceeded => &FIXTURE_DIAGNOSTIC_DEFINITIONS[9],
+        FixtureSafeCode::SourceResponseMalformed => &FIXTURE_DIAGNOSTIC_DEFINITIONS[10],
+        FixtureSafeCode::SourceResponseTooLarge => &FIXTURE_DIAGNOSTIC_DEFINITIONS[11],
+        FixtureSafeCode::SourceStatusRejected => &FIXTURE_DIAGNOSTIC_DEFINITIONS[12],
+        FixtureSafeCode::SourceUnavailable => &FIXTURE_DIAGNOSTIC_DEFINITIONS[13],
+        FixtureSafeCode::SourceUnavailableLegacy => &FIXTURE_DIAGNOSTIC_DEFINITIONS[14],
     }
 }
diff --git a/crates/registryctl/src/project_authoring/fixtures.rs b/crates/registryctl/src/project_authoring/fixtures.rs
index 830274864..79c3953ec 100644
--- a/crates/registryctl/src/project_authoring/fixtures.rs
+++ b/crates/registryctl/src/project_authoring/fixtures.rs
@@ -91,7 +91,6 @@ fn rhai_diagnostic_source(
 type FixtureExecutionObservations = (
     Vec<FixtureReport>,
     Vec<GeneratedFixtureObservation>,
-    Vec<AuthoredRequestBindingObservation>,
     Option<FixtureSafeCode>,
 );
 
@@ -106,7 +105,7 @@ fn execute_all_fixtures_with_coverage_observations(
     let call_budget_actual =
         platform_call_budget_result(loaded, compiled, execution_context.worker_program())?;
     if loaded.integrations.is_empty() {
-        return Ok((Vec::new(), Vec::new(), Vec::new(), call_budget_actual));
+        return Ok((Vec::new(), Vec::new(), call_budget_actual));
     }
     if let Some(selected) = integration_filter {
         if !loaded.integrations.contains_key(selected) {
@@ -146,8 +145,10 @@ fn execute_all_fixtures_with_coverage_observations(
                     .any(|fixture| fixture.name == selected)
             });
         if !selected_exists {
-            let selected_id = integration_filter
-                .map_or_else(|| selected.to_string(), |integration| format!("{integration}.{selected}"));
+            let selected_id = integration_filter.map_or_else(
+                || selected.to_string(),
+                |integration| format!("{integration}.{selected}"),
+            );
             bail!(
                 "selected fixture {selected_id} does not exist; available fixture ids: {}",
                 available.join(", ")
@@ -171,7 +172,6 @@ fn execute_all_fixtures_with_coverage_observations(
     )?;
     let mut reports = Vec::new();
     let mut generated_observations = Vec::new();
-    let mut request_observations = Vec::new();
     for (alias, integration) in &loaded.integrations {
         if integration_filter.is_some_and(|selected| selected != alias) {
             continue;
@@ -180,35 +180,6 @@ fn execute_all_fixtures_with_coverage_observations(
             if fixture_filter.is_some_and(|selected| selected != fixture.name) {
                 continue;
             }
-            if let Some(request) = fixture.request.as_ref() {
-                if validate_governed_fixture_request(loaded, request).is_err() {
-                    request_observations.push(AuthoredRequestBindingObservation {
-                        integration: alias.clone(),
-                        source_fixture_id: fixture.name.clone(),
-                        pass_state: FixturePassState::Failed,
-                        consultations: Vec::new(),
-                        actual_safe_code: Some(FixtureSafeCode::RedactedUnclassifiedError),
-                        actual_relay_consultations: Some(0),
-                    });
-                    reports.push(FixtureReport {
-                        integration: alias.clone(),
-                        fixture: fixture.name.clone(),
-                        inputs: fixture.input.keys().cloned().collect(),
-                        calls: Vec::new(),
-                        outputs: Vec::new(),
-                        claims: Vec::new(),
-                        outcome: None,
-                        expected_error: fixture.expect.error.clone(),
-                        source_access: Some(false),
-                        passed: false,
-                        failure: Some(
-                            "request_to_consultation_binding_invalid: relay_consultations=0"
-                                .to_owned(),
-                        ),
-                    });
-                    continue;
-                }
-            }
             let mut actual_calls = Vec::new();
             let relay = execute_fixture(
                 compiled,
@@ -218,39 +189,7 @@ fn execute_all_fixtures_with_coverage_observations(
                 &mut actual_calls,
                 trace,
             );
-            let (result, evaluated_claims) = match relay {
-                Ok((outputs, outcome))
-                    if matches!(outcome, "match" | "no_match")
-                        && !integration_has_product_claims(loaded, alias) =>
-                {
-                    (Ok((outputs, outcome)), Some(BTreeMap::new()))
-                }
-                Ok((outputs, outcome)) if matches!(outcome, "match" | "no_match") => {
-                    match evaluate_product_claims(
-                        loaded,
-                        compiled,
-                        alias,
-                        fixture,
-                        Some((&outputs, outcome)),
-                        registry_notary_server::standalone::OfflineAuthentication::Valid,
-                        false,
-                        execution_context.worker_program(),
-                    )
-                    .with_context(|| {
-                        format!(
-                            "failed to evaluate product claims for fixture {}.{}",
-                            alias, fixture.name
-                        )
-                    })?
-                    .result
-                    {
-                        Ok(claims) => (Ok((outputs, outcome)), Some(claims)),
-                        Err(error) => (Err(error), None),
-                    }
-                }
-                Ok(result) => (Ok(result), None),
-                Err(error) => (Err(error), None),
-            };
+            let result = relay;
             let passed = match (&result, &fixture.expect.error) {
                 (Ok((outputs, _)), None) => {
                     let outcome_matches =
@@ -259,15 +198,7 @@ fn execute_all_fixtures_with_coverage_observations(
                                 .as_ref()
                                 .is_ok_and(|(_, outcome)| *outcome == expected)
                         });
-                    let claims_match = if result
-                        .as_ref()
-                        .is_ok_and(|(_, outcome)| *outcome == "ambiguous")
-                    {
-                        fixture.expect.claims.is_empty()
-                    } else {
-                        evaluated_claims.as_ref() == Some(&fixture.expect.claims)
-                    };
-                    outputs == &fixture.expect.outputs && claims_match && outcome_matches
+                    outputs == &fixture.expect.outputs && outcome_matches
                 }
                 (Err(code), Some(expected)) => code == expected,
                 _ => false,
@@ -289,16 +220,6 @@ fn execute_all_fixtures_with_coverage_observations(
                         fixture.expect.outcome.as_deref().unwrap_or("unspecified")
                     )
                 }
-                (Ok(_), None) if evaluated_claims.as_ref() != Some(&fixture.expect.claims) => {
-                    format!(
-                        "claims_mismatch: claims={}",
-                        mismatched_optional_map_keys(
-                            evaluated_claims.as_ref(),
-                            &fixture.expect.claims,
-                        )
-                        .join("|")
-                    )
-                }
                 (Err(actual), Some(expected)) if actual != expected => {
                     format!("error_mismatch: expected={expected}, actual={actual}")
                 }
@@ -333,10 +254,6 @@ fn execute_all_fixtures_with_coverage_observations(
                 inputs: fixture.input.keys().cloned().collect(),
                 calls: actual_calls,
                 outputs,
-                claims: evaluated_claims
-                    .as_ref()
-                    .map(|claims| claims.keys().cloned().collect())
-                    .unwrap_or_default(),
                 outcome: result
                     .as_ref()
                     .ok()
@@ -349,87 +266,6 @@ fn execute_all_fixtures_with_coverage_observations(
                 passed,
                 failure,
             });
-            if let Some(request) = fixture.request.as_ref() {
-                let binding =
-                    result
-                        .as_ref()
-                        .map_err(|code| code.clone())
-                        .and_then(|(outputs, outcome)| {
-                            evaluate_authored_governed_request(
-                                loaded,
-                                compiled,
-                                fixture,
-                                request,
-                                outputs,
-                                outcome,
-                                execution_context.worker_program(),
-                            )
-                            .map_err(|_| "request.binding_evaluation_failed".to_owned())
-                        });
-                let (pass_state, consultations, actual_safe_code, actual_relay_consultations) =
-                    match binding {
-                        Ok(evaluation)
-                            if evaluation.result.is_ok() && evaluation.relay_calls > 0 =>
-                        {
-                            (
-                                FixturePassState::Passed,
-                                evaluation.consultations,
-                                None,
-                                Some(u32::try_from(evaluation.relay_calls).unwrap_or(u32::MAX)),
-                            )
-                        }
-                        Ok(evaluation) => (
-                            FixturePassState::Failed,
-                            Vec::new(),
-                            evaluation
-                                .result
-                                .as_ref()
-                                .err()
-                                .map(|code| FixtureSafeCode::from_runtime_code(code)),
-                            Some(u32::try_from(evaluation.relay_calls).unwrap_or(u32::MAX)),
-                        ),
-                        Err(_) => (
-                            FixturePassState::Failed,
-                            Vec::new(),
-                            Some(FixtureSafeCode::RedactedUnclassifiedError),
-                            Some(0),
-                        ),
-                    };
-                request_observations.push(AuthoredRequestBindingObservation {
-                    integration: alias.clone(),
-                    source_fixture_id: fixture.name.clone(),
-                    pass_state,
-                    consultations,
-                    actual_safe_code,
-                    actual_relay_consultations,
-                });
-                reports.push(FixtureReport {
-                    integration: alias.clone(),
-                    fixture: format!("{}::derived/request_to_consultation_binding", fixture.name),
-                    inputs: fixture.input.keys().cloned().collect(),
-                    calls: if actual_relay_consultations.unwrap_or_default() > 0 {
-                        vec!["notary-relay-consultation".to_owned()]
-                    } else {
-                        Vec::new()
-                    },
-                    outputs: Vec::new(),
-                    claims: request
-                        .claims
-                        .iter()
-                        .map(|claim| claim.id.clone())
-                        .collect(),
-                    outcome: None,
-                    expected_error: None,
-                    source_access: Some(actual_relay_consultations.unwrap_or_default() > 0),
-                    passed: pass_state == FixturePassState::Passed,
-                    failure: (pass_state != FixturePassState::Passed).then(|| {
-                        format!(
-                            "request_to_consultation_binding_failed: relay_consultations={}",
-                            actual_relay_consultations.unwrap_or_default()
-                        )
-                    }),
-                });
-            }
             reports.extend(derived_fixture_reports(
                 loaded,
                 compiled,
@@ -442,12 +278,7 @@ fn execute_all_fixtures_with_coverage_observations(
             )?);
         }
     }
-    Ok((
-        reports,
-        generated_observations,
-        request_observations,
-        call_budget_actual,
-    ))
+    Ok((reports, generated_observations, call_budget_actual))
 }
 
 // The execution seam keeps each authority and observation channel explicit.
@@ -460,7 +291,7 @@ fn derived_fixture_reports(
     fixture: &FixtureDocument,
     trace: bool,
     generated_observations: &mut Vec<GeneratedFixtureObservation>,
-    worker_program: &Path,
+    _worker_program: &Path,
 ) -> Result<Vec<FixtureReport>> {
     use registry_relay::offline_fixture::OfflineSourceResponse;
 
@@ -610,7 +441,6 @@ fn derived_fixture_reports(
                 } else {
                     FixturePassState::Failed
                 },
-                actual_source_calls: Some(u32::try_from(calls.len()).unwrap_or(u32::MAX)),
             });
             FixtureReport {
                 integration: integration_alias.to_owned(),
@@ -622,7 +452,6 @@ fn derived_fixture_reports(
                 inputs: fixture.input.keys().cloned().collect(),
                 calls,
                 outputs: Vec::new(),
-                claims: Vec::new(),
                 outcome: None,
                 expected_error: Some(expected.to_owned()),
                 source_access: Some(error_implies_source_access(expected)),
@@ -637,55 +466,6 @@ fn derived_fixture_reports(
         })
         .collect::<Vec<_>>();
 
-    if integration_has_product_claims(loaded, integration_alias) {
-        let authorization = evaluate_product_claims(
-            loaded,
-            compiled,
-            integration_alias,
-            fixture,
-            None,
-            registry_notary_server::standalone::OfflineAuthentication::WrongCredential,
-            true,
-            worker_program,
-        )?;
-        let authorization_error = authorization.result.err();
-        let authorization_passed = authorization_error.as_deref() == Some("authorization.denied");
-        let actual_source_calls = u32::try_from(authorization.relay_calls).unwrap_or(u32::MAX);
-        let passed = authorization_passed && actual_source_calls == 0;
-        generated_observations.push(GeneratedFixtureObservation {
-            integration: integration_alias.to_owned(),
-            source_fixture_id: fixture.name.clone(),
-            recipe_id: GeneratorRecipeId::AuthorizationBeforeSource,
-            actual_safe_code: authorization_error
-                .as_deref()
-                .map(FixtureSafeCode::from_runtime_code),
-            pass_state: if passed {
-                FixturePassState::Passed
-            } else {
-                FixturePassState::Failed
-            },
-            actual_source_calls: Some(actual_source_calls),
-        });
-        reports.push(FixtureReport {
-            integration: integration_alias.to_owned(),
-            fixture: format!("{}::derived/authorization_before_source", fixture.name),
-            inputs: fixture.input.keys().cloned().collect(),
-            calls: Vec::new(),
-            outputs: Vec::new(),
-            claims: Vec::new(),
-            outcome: None,
-            expected_error: Some("authorization.denied".to_owned()),
-            source_access: Some(actual_source_calls != 0),
-            passed,
-            failure: (!passed).then(|| {
-                format!(
-                    "derived_authorization_mismatch: expected=authorization.denied, actual={}, source_calls={actual_source_calls}",
-                    authorization_error.as_deref().unwrap_or("success"),
-                )
-            }),
-        });
-    }
-
     let mut minimized = base;
     // Ignoring unselected upstream members is a declarative HTTP projection
     // guarantee. Snapshot rows are the reviewed materialization contract, so
@@ -736,44 +516,18 @@ fn derived_fixture_reports(
                                 "ambiguous"
                             }
                         };
-                        let evaluated_claims = if matches!(outcome, "match" | "no_match")
-                            && integration_has_product_claims(loaded, integration_alias)
-                        {
-                            evaluate_product_claims(
-                                loaded,
-                                compiled,
-                                integration_alias,
-                                fixture,
-                                Some((&observation.outputs, outcome)),
-                                registry_notary_server::standalone::OfflineAuthentication::Valid,
-                                false,
-                                worker_program,
-                            )?
-                            .result
-                            .map(Some)
-                        } else if matches!(outcome, "match" | "no_match") {
-                            Ok(Some(BTreeMap::new()))
-                        } else {
-                            Ok(None)
-                        };
-                        evaluated_claims
-                            .map(|claims| (observation.outputs, outcome.to_owned(), claims))
+                        Ok((observation.outputs, outcome.to_owned()))
                     }
                     Err(error) => Err(error),
                 };
                 let passed = match (&evaluated, fixture.expect.error.as_deref()) {
-                    (Ok((outputs, outcome, claims)), None) => {
+                    (Ok((outputs, outcome)), None) => {
                         let outcome_matches = fixture
                             .expect
                             .outcome
                             .as_deref()
                             .is_none_or(|expected| expected == outcome);
-                        let claims_match = if outcome == "ambiguous" {
-                            fixture.expect.claims.is_empty()
-                        } else {
-                            claims.as_ref() == Some(&fixture.expect.claims)
-                        };
-                        outputs == &fixture.expect.outputs && outcome_matches && claims_match
+                        outputs == &fixture.expect.outputs && outcome_matches
                     }
                     (Err(actual), Some(expected)) => actual == expected,
                     _ => false,
@@ -785,26 +539,15 @@ fn derived_fixture_reports(
                 let outputs = evaluated
                     .as_ref()
                     .ok()
-                    .map(|(outputs, _, _)| outputs.keys().cloned().collect())
-                    .unwrap_or_default();
-                let claims = evaluated
-                    .as_ref()
-                    .ok()
-                    .and_then(|(_, _, claims)| claims.as_ref())
-                    .map(|claims| claims.keys().cloned().collect())
+                    .map(|(outputs, _)| outputs.keys().cloned().collect())
                     .unwrap_or_default();
-                let outcome = evaluated
-                    .as_ref()
-                    .ok()
-                    .map(|(_, outcome, _)| outcome.clone());
-                let actual_source_calls = u32::try_from(trace_calls.len()).unwrap_or(u32::MAX);
+                let outcome = evaluated.as_ref().ok().map(|(_, outcome)| outcome.clone());
                 reports.push(FixtureReport {
                     integration: integration_alias.to_owned(),
                     fixture: format!("{}::derived/output_minimization", fixture.name),
                     inputs: fixture.input.keys().cloned().collect(),
                     calls: trace_calls,
                     outputs,
-                    claims,
                     outcome,
                     expected_error: fixture.expect.error.clone(),
                     source_access: evaluated
@@ -826,7 +569,6 @@ fn derived_fixture_reports(
                     } else {
                         FixturePassState::Failed
                     },
-                    actual_source_calls: Some(actual_source_calls),
                 });
             }
         }
@@ -834,52 +576,6 @@ fn derived_fixture_reports(
     Ok(reports)
 }
 
-fn integration_has_product_claims(loaded: &LoadedRegistryProject, integration_alias: &str) -> bool {
-    loaded.project.services.values().any(|service| {
-        service.kind == ServiceKind::Evidence
-            && service.claims.values().any(|claim| {
-                claim_consultation_name(service, claim).is_ok_and(|consultation| {
-                    service.consultations[consultation].integration == integration_alias
-                })
-            })
-    })
-}
-
-fn fixture_subject_type(
-    loaded: &LoadedRegistryProject,
-    integration_alias: &str,
-) -> Result<EvidenceSubjectType> {
-    let mut subject_types = BTreeSet::new();
-    for service in loaded
-        .project
-        .services
-        .values()
-        .filter(|service| service.kind == ServiceKind::Evidence)
-    {
-        let selects_integration =
-            service
-                .claims
-                .values()
-                .try_fold(false, |selected, claim| -> Result<bool> {
-                    if inferred_claim_evidence(service, claim)? != ClaimEvidence::RegistryBacked {
-                        return Ok(selected);
-                    }
-                    let consultation = claim_consultation_name(service, claim)?;
-                    Ok(selected
-                        || service.consultations[consultation].integration == integration_alias)
-                })?;
-        if selects_integration {
-            subject_types.insert(service.effective_subject_type());
-        }
-    }
-    if subject_types.len() != 1 {
-        bail!("offline fixture cannot combine evidence services with different subject types");
-    }
-    subject_types
-        .pop_first()
-        .ok_or_else(|| anyhow!("offline fixture selected no evidence service"))
-}
-
 fn contains_generated_fixture_matcher(value: &Value) -> bool {
     match value {
         Value::Array(values) => values.iter().any(contains_generated_fixture_matcher),
@@ -900,7 +596,6 @@ fn generated_recipe_fixture_suffix(recipe: GeneratorRecipeId) -> &'static str {
         GeneratorRecipeId::ByteCeiling => "byte_ceiling",
         GeneratorRecipeId::Timeout => "timeout",
         GeneratorRecipeId::ProtocolVerification => "protocol_verification",
-        GeneratorRecipeId::AuthorizationBeforeSource => "authorization_before_source",
         GeneratorRecipeId::OutputMinimization => "output_minimization",
     }
 }
@@ -910,19 +605,17 @@ fn generated_recipe_fixture_suffix(recipe: GeneratorRecipeId) -> &'static str {
 ///
 /// Every integration is an isolated target with the same ordered requirement
 /// matrix. The regular command has no baseline-to-candidate comparison, so the
-/// four affected-fixture requirements remain honestly `not_evaluated`.
+/// three affected-fixture requirements remain honestly `not_evaluated`.
 fn generate_fixture_coverage_report(
     loaded: &LoadedRegistryProject,
     fixture_reports: &[FixtureReport],
     generated_observations: &[GeneratedFixtureObservation],
-    request_observations: &[AuthoredRequestBindingObservation],
     call_budget_actual: Option<FixtureSafeCode>,
 ) -> Result<ProjectFixtureCoverageReportV1> {
     generate_fixture_coverage_report_with_comparison(
         loaded,
         fixture_reports,
         generated_observations,
-        request_observations,
         call_budget_actual,
         None,
     )
@@ -932,7 +625,6 @@ fn generate_fixture_coverage_report_with_comparison(
     loaded: &LoadedRegistryProject,
     fixture_reports: &[FixtureReport],
     generated_observations: &[GeneratedFixtureObservation],
-    request_observations: &[AuthoredRequestBindingObservation],
     call_budget_actual: Option<FixtureSafeCode>,
     comparison_input: Option<&FixtureCoverageComparisonInput>,
 ) -> Result<ProjectFixtureCoverageReportV1> {
@@ -976,18 +668,6 @@ fn generate_fixture_coverage_report_with_comparison(
             bail!("fixture coverage received a duplicate generated observation");
         }
     }
-    let mut request_observation_index =
-        BTreeMap::<(&str, &str), &AuthoredRequestBindingObservation>::new();
-    for observation in request_observations {
-        let key = (
-            observation.integration.as_str(),
-            observation.source_fixture_id.as_str(),
-        );
-        if request_observation_index.insert(key, observation).is_some() {
-            bail!("fixture coverage received a duplicate governed request observation");
-        }
-    }
-
     let platform_case = call_budget_actual
         .map(build_platform_call_budget_case)
         .transpose()?;
@@ -1030,45 +710,12 @@ fn generate_fixture_coverage_report_with_comparison(
                     .map_err(|_| anyhow!("fixture interaction count exceeds the report range"))?,
                 input_ids: fixture.input.keys().cloned().collect(),
                 output_ids: fixture.expect.outputs.keys().cloned().collect(),
-                claim_ids: fixture.expect.claims.keys().cloned().collect(),
                 exercised_status_mappings: fixture_exercised_status_mappings_for_fixture(
                     &integration.document,
                     fixture,
                 ),
                 classification: FixtureCoverageClassification::Synthetic,
                 pass_state,
-                request_to_consultation_binding: match (
-                    fixture.request.is_some(),
-                    request_observation_index
-                        .get(&(integration_alias.as_str(), fixture.name.as_str()))
-                        .copied(),
-                ) {
-                    (false, None) => FixtureRequestBindingCoverage {
-                        state: FixtureRequestBindingState::NotAuthored,
-                        consultations: Vec::new(),
-                        actual_relay_consultations: None,
-                        safe_error_code: None,
-                    },
-                    (false, Some(_)) => {
-                        bail!("fixture coverage observed a governed request that was not authored")
-                    }
-                    (true, None) => FixtureRequestBindingCoverage {
-                        state: FixtureRequestBindingState::NotExecuted,
-                        consultations: Vec::new(),
-                        actual_relay_consultations: None,
-                        safe_error_code: None,
-                    },
-                    (true, Some(observation)) => FixtureRequestBindingCoverage {
-                        state: if observation.pass_state == FixturePassState::Passed {
-                            FixtureRequestBindingState::Passed
-                        } else {
-                            FixtureRequestBindingState::Failed
-                        },
-                        consultations: observation.consultations.clone(),
-                        actual_relay_consultations: observation.actual_relay_consultations,
-                        safe_error_code: observation.actual_safe_code,
-                    },
-                },
             });
 
             for recipe_id in GeneratorRecipeId::ALL {
@@ -1095,18 +742,6 @@ fn generate_fixture_coverage_report_with_comparison(
                 } else {
                     observation.map_or(FixturePassState::NotExecuted, |value| value.pass_state)
                 };
-                let source_access_assertion = (recipe_id
-                    == GeneratorRecipeId::AuthorizationBeforeSource
-                    && matches!(applicability, GeneratedRecipeApplicability::Applicable {}))
-                .then(|| {
-                    let actual_source_calls =
-                        observation.and_then(|value| value.actual_source_calls);
-                    SourceAccessAssertion {
-                        expected_source_calls: SourceCallExpectation::Zero,
-                        actual_source_calls,
-                        passed: actual_source_calls == Some(0),
-                    }
-                });
                 let actual_safe_code = if recipe_id == GeneratorRecipeId::OutputMinimization {
                     None
                 } else {
@@ -1120,7 +755,6 @@ fn generate_fixture_coverage_report_with_comparison(
                     recipe_id.expected_safe_code(),
                     actual_safe_code,
                     pass_state,
-                    &source_access_assertion,
                 ))
                 .map_err(|error| anyhow!(error))?;
                 let evidence = fixture_coverage_evidence(
@@ -1145,7 +779,6 @@ fn generate_fixture_coverage_report_with_comparison(
                     expected_safe_code: recipe_id.expected_safe_code(),
                     actual_safe_code,
                     pass_state,
-                    source_access_assertion,
                 });
             }
         }
@@ -1163,7 +796,7 @@ fn generate_fixture_coverage_report_with_comparison(
         } else {
             Vec::new()
         };
-        let declared = fixture_target_declared_dimensions(loaded, integration_alias, integration);
+        let declared = fixture_target_declared_dimensions(integration);
         let exercised = fixture_target_exercised_dimensions(
             integration,
             &fixture_inventory,
@@ -1174,7 +807,7 @@ fn generate_fixture_coverage_report_with_comparison(
             integration: integration_alias.clone(),
             capability: fixture_coverage_capability(&integration.document.capability),
         };
-        let contract = fixture_coverage_target_contract(loaded, integration_alias, integration)?;
+        let contract = fixture_coverage_target_contract(integration)?;
         let compiled_contract = target_compiled_contract_evidence(&identity, &contract, &declared)
             .map_err(|error| anyhow!(error))?;
         let mut target = FixtureCoverageTarget {
@@ -1274,8 +907,6 @@ fn fixture_coverage_capability(capability: &CapabilityDeclaration) -> FixtureCap
 }
 
 fn fixture_coverage_target_contract(
-    loaded: &LoadedRegistryProject,
-    integration_alias: &str,
     integration: &LoadedIntegration,
 ) -> Result<FixtureCoverageTargetContract> {
     let source_operation_count = match &integration.document.capability {
@@ -1300,42 +931,9 @@ fn fixture_coverage_target_contract(
     Ok(FixtureCoverageTargetContract {
         source_operation_count,
         reviewed_not_applicable,
-        registry_backed_consultations: fixture_target_registry_backed_consultations(
-            loaded,
-            integration_alias,
-        )?,
     })
 }
 
-fn fixture_target_registry_backed_consultations(
-    loaded: &LoadedRegistryProject,
-    integration_alias: &str,
-) -> Result<Vec<FixtureConsultationIdentity>> {
-    let mut identities = BTreeSet::new();
-    for (service_id, service) in &loaded.project.services {
-        if service.kind != ServiceKind::Evidence {
-            continue;
-        }
-        for claim in service.claims.values() {
-            if inferred_claim_evidence(service, claim)? != ClaimEvidence::RegistryBacked {
-                continue;
-            }
-            let consultation_id = claim_consultation_name(service, claim)?;
-            let consultation = service
-                .consultations
-                .get(consultation_id)
-                .ok_or_else(|| anyhow!("registry-backed claim consultation is absent"))?;
-            if consultation.integration == integration_alias {
-                identities.insert(FixtureConsultationIdentity {
-                    service_id: service_id.clone(),
-                    consultation_id: consultation_id.to_owned(),
-                });
-            }
-        }
-    }
-    Ok(identities.into_iter().collect())
-}
-
 fn distinguishable_request_pair(
     interactions: &[registry_relay::offline_fixture::OfflineInteraction],
 ) -> Option<(usize, usize)> {
@@ -1451,14 +1049,6 @@ fn generated_recipe_applicability(
                 invariant: CoverageInvariant::MutationRequiresFinalJsonObjectResponse,
             }
         }
-        GeneratorRecipeId::AuthorizationBeforeSource
-            if !integration_has_product_claims(loaded, integration_alias) =>
-        {
-            GeneratedRecipeApplicability::NotApplicable {
-                reason: GeneratedNotApplicableReason::IntegrationHasNoProductClaims,
-                invariant: CoverageInvariant::AuthorizationCheckRequiresProductClaimEvaluation,
-            }
-        }
         GeneratorRecipeId::OutputMinimization
             if !matches!(
                 loaded.integrations[integration_alias].document.capability,
@@ -1487,17 +1077,11 @@ fn generated_recipe_applicability(
 }
 
 fn fixture_target_declared_dimensions(
-    loaded: &LoadedRegistryProject,
-    integration_alias: &str,
     integration: &LoadedIntegration,
 ) -> FixtureCoverageDimensions {
-    let (claim_ids, disclosure_modes) =
-        fixture_target_claims_and_disclosures(loaded, integration_alias);
     FixtureCoverageDimensions {
         input_ids: integration.document.input.keys().cloned().collect(),
         output_ids: integration.document.outputs.keys().cloned().collect(),
-        claim_ids,
-        disclosure_modes,
         status_mappings: fixture_status_mappings(&integration.document),
         protocol_helpers: fixture_protocol_helpers(&integration.document),
         limits: fixture_declared_limits(&integration.document),
@@ -1527,12 +1111,6 @@ fn fixture_target_exercised_dimensions(
         .collect::<BTreeSet<_>>()
         .into_iter()
         .collect();
-    let claim_ids = passed
-        .iter()
-        .flat_map(|fixture| fixture.claim_ids.iter().cloned())
-        .collect::<BTreeSet<_>>()
-        .into_iter()
-        .collect();
     let protocol_helpers =
         if generated_recipe_complete(generated, GeneratorRecipeId::ProtocolVerification).0 {
             fixture_protocol_helpers(&integration.document)
@@ -1560,9 +1138,6 @@ fn fixture_target_exercised_dimensions(
     FixtureCoverageDimensions {
         input_ids,
         output_ids,
-        claim_ids,
-        // Claim evaluation does not exercise disclosure selection.
-        disclosure_modes: Vec::new(),
         status_mappings: fixture_exercised_status_mappings(integration, inventory),
         protocol_helpers,
         limits: limits.into_iter().collect(),
@@ -1571,47 +1146,6 @@ fn fixture_target_exercised_dimensions(
     }
 }
 
-fn fixture_target_claims_and_disclosures(
-    loaded: &LoadedRegistryProject,
-    integration_alias: &str,
-) -> (Vec<String>, Vec<FixtureDisclosureMode>) {
-    let mut claim_ids = BTreeSet::new();
-    let mut modes = BTreeSet::new();
-    for service in loaded.project.services.values() {
-        if service.kind != ServiceKind::Evidence {
-            continue;
-        }
-        for (claim_id, claim) in &service.claims {
-            let belongs_to_target = claim_consultation_name(service, claim)
-                .ok()
-                .and_then(|consultation| service.consultations.get(consultation))
-                .is_some_and(|consultation| consultation.integration == integration_alias);
-            if !belongs_to_target {
-                continue;
-            }
-            claim_ids.insert(claim_id.clone());
-            match &claim.disclosure {
-                DisclosureDeclaration::Mode(mode) => {
-                    modes.insert(fixture_disclosure_mode(*mode));
-                }
-                DisclosureDeclaration::Policy { default, allowed } => {
-                    modes.insert(fixture_disclosure_mode(*default));
-                    modes.extend(allowed.iter().copied().map(fixture_disclosure_mode));
-                }
-            }
-        }
-    }
-    (claim_ids.into_iter().collect(), modes.into_iter().collect())
-}
-
-fn fixture_disclosure_mode(mode: DisclosureMode) -> FixtureDisclosureMode {
-    match mode {
-        DisclosureMode::Value => FixtureDisclosureMode::Value,
-        DisclosureMode::Predicate => FixtureDisclosureMode::Predicate,
-        DisclosureMode::Redacted => FixtureDisclosureMode::Redacted,
-    }
-}
-
 fn fixture_status_mappings(integration: &IntegrationDocument) -> Vec<FixtureStatusMapping> {
     let CapabilityDeclaration::Http { http } = &integration.capability else {
         return Vec::new();
@@ -1758,7 +1292,6 @@ fn fixture_has_semantic_null(fixture: &FixtureDocument) -> bool {
         .input
         .values()
         .chain(fixture.expect.outputs.values())
-        .chain(fixture.expect.claims.values())
         .any(Value::is_null)
 }
 
@@ -1778,13 +1311,7 @@ fn generated_recipe_complete(
         .collect::<Vec<_>>();
     let mut evidence = applicable
         .iter()
-        .filter(|case| {
-            case.pass_state == FixturePassState::Passed
-                && case
-                    .source_access_assertion
-                    .as_ref()
-                    .is_none_or(|assertion| assertion.passed)
-        })
+        .filter(|case| case.pass_state == FixturePassState::Passed)
         .map(|case| case.evidence.clone())
         .collect::<Vec<_>>();
     evidence.sort();
@@ -1823,510 +1350,10 @@ fn mismatched_map_keys<T: PartialEq>(
         .collect()
 }
 
-fn mismatched_optional_map_keys<T: PartialEq>(
-    actual: Option<&BTreeMap<String, T>>,
-    expected: &BTreeMap<String, T>,
-) -> Vec<String> {
-    actual.map_or_else(
-        || expected.keys().cloned().collect(),
-        |actual| mismatched_map_keys(actual, expected),
-    )
-}
-
 fn error_implies_source_access(code: &str) -> bool {
     code.starts_with("source.") || code == "failure.subject_mismatch"
 }
 
-struct ProductClaimsFixtureEvaluation {
-    result: std::result::Result<BTreeMap<String, Value>, String>,
-    relay_calls: u64,
-    consultations: Vec<FixtureConsultationIdentity>,
-}
-
-/// Execute the independently authored governed request through the production
-/// Notary request planner. The fixture input remains a separate oracle for the
-/// exact Relay consultation key, so this path cannot derive a passing request
-/// from the consultation mapping it is intended to verify.
-fn evaluate_authored_governed_request(
-    loaded: &LoadedRegistryProject,
-    compiled: &CompiledProject,
-    fixture: &FixtureDocument,
-    request: &GovernedFixtureRequest,
-    outputs: &BTreeMap<String, Value>,
-    outcome: &str,
-    worker_program: &Path,
-) -> Result<ProductClaimsFixtureEvaluation> {
-    use registry_notary_server::standalone::{
-        OfflineAuthentication, OfflineNotaryHarness, OfflineNotaryRequest,
-        OfflineRelayConsultation, OfflineRelayOutcome,
-    };
-
-    let expected_consultations = governed_request_consultation_identities(loaded, request)?;
-    let relay_outcome = match outcome {
-        "match" => OfflineRelayOutcome::Match,
-        "no_match" => OfflineRelayOutcome::NoMatch,
-        "ambiguous" => OfflineRelayOutcome::Ambiguous,
-        _ => bail!("offline Relay returned an unknown product outcome"),
-    };
-    let relay_inputs = fixture
-        .input
-        .iter()
-        .map(|(name, value)| {
-            let value = match value {
-                Value::Null => "null".to_owned(),
-                Value::Bool(value) => value.to_string(),
-                Value::Number(value) => value.to_string(),
-                Value::String(value) => value.clone(),
-                Value::Array(_) | Value::Object(_) => {
-                    bail!("fixture input is not a bounded scalar")
-                }
-            };
-            Ok((name.clone(), value))
-        })
-        .collect::<Result<BTreeMap<_, _>>>()?;
-    let relay_evidence = compiled
-        .fixture_profiles
-        .iter()
-        .map(|profile| {
-            let is_selected =
-                loaded.project.services[&profile.service_id].purpose == request.purpose;
-            OfflineRelayConsultation::decoded_inputs(
-                profile.id.clone(),
-                profile.contract_hash.clone(),
-                loaded.project.services[&profile.service_id].purpose.clone(),
-                relay_inputs.clone(),
-                if is_selected {
-                    relay_outcome
-                } else {
-                    OfflineRelayOutcome::NoMatch
-                },
-                if is_selected && relay_outcome == OfflineRelayOutcome::Match {
-                    outputs.clone()
-                } else {
-                    BTreeMap::new()
-                },
-            )
-        })
-        .collect::<Vec<_>>();
-    if relay_evidence.is_empty() {
-        bail!("offline governed request has no exact Relay consultation profile");
-    }
-    let notary_config = compiled
-        .notary_private
-        .get(Path::new("config/notary.yaml"))
-        .ok_or_else(|| anyhow!("generated Notary config is absent"))?;
-    let notary_config: StandaloneRegistryNotaryConfig = serde_norway::from_slice(notary_config)
-        .context("generated Notary config did not parse for offline governed request")?;
-    let harness = OfflineNotaryHarness::compile(
-        notary_config,
-        relay_evidence,
-        project_cel_worker_config(worker_program),
-    )
-    .context("production Notary offline harness did not compile")?;
-    let runtime = tokio::runtime::Builder::new_current_thread()
-        .enable_all()
-        .build()
-        .context("failed to build the offline governed request runtime")?;
-    let evidence = runtime.block_on(
-        harness.evaluate(
-            OfflineNotaryRequest::new(OfflineAuthentication::Valid, request.to_evaluate_request())
-                .with_header_purpose(request.purpose.as_str()),
-        ),
-    );
-    let relay_calls = evidence.relay_calls();
-    if let Some(error) = evidence.error_class() {
-        return Ok(ProductClaimsFixtureEvaluation {
-            result: Err(error.as_str().to_owned()),
-            relay_calls,
-            consultations: Vec::new(),
-        });
-    }
-    let verified = (|| -> Result<_> {
-        if relay_calls != evidence.consultation_count() as u64 {
-            bail!("offline Notary did not reuse each governed consultation exactly once");
-        }
-        let consultations =
-            runtime_consultation_identities(compiled, evidence.relay_profile_ids())?;
-        if evidence.consultation_count() != consultations.len() {
-            bail!("offline Notary selected a different governed consultation cardinality");
-        }
-        if consultations != expected_consultations {
-            bail!("offline Notary selected a different governed consultation set");
-        }
-        let mut claims = BTreeMap::new();
-        for claim in evidence.claims() {
-            if claims
-                .insert(claim.claim_id().to_owned(), Value::Null)
-                .is_some()
-            {
-                bail!("offline governed request returned a duplicate claim id");
-            }
-        }
-        let requested = request
-            .claims
-            .iter()
-            .map(|claim| claim.id.as_str())
-            .collect::<BTreeSet<_>>();
-        if claims.keys().map(String::as_str).collect::<BTreeSet<_>>() != requested {
-            bail!("offline governed request did not return the exact selected claim set");
-        }
-        Ok((claims, consultations))
-    })();
-    Ok(match verified {
-        Ok((claims, consultations)) => ProductClaimsFixtureEvaluation {
-            result: Ok(claims),
-            relay_calls,
-            consultations,
-        },
-        Err(_) => ProductClaimsFixtureEvaluation {
-            result: Err("request.binding_evaluation_failed".to_owned()),
-            relay_calls,
-            consultations: Vec::new(),
-        },
-    })
-}
-
-fn runtime_consultation_identities(
-    compiled: &CompiledProject,
-    relay_profile_ids: &[String],
-) -> Result<Vec<FixtureConsultationIdentity>> {
-    let mut identities = BTreeSet::new();
-    for profile_id in relay_profile_ids {
-        let profile = compiled
-            .fixture_profiles
-            .iter()
-            .find(|profile| profile.id == *profile_id)
-            .ok_or_else(|| anyhow!("offline Notary selected an unknown Relay profile"))?;
-        if !identities.insert(FixtureConsultationIdentity {
-            service_id: profile.service_id.clone(),
-            consultation_id: profile.consultation_id.clone(),
-        }) {
-            bail!("offline Notary selected a duplicate governed consultation");
-        }
-    }
-    Ok(identities.into_iter().collect())
-}
-
-fn governed_request_consultation_identities(
-    loaded: &LoadedRegistryProject,
-    request: &GovernedFixtureRequest,
-) -> Result<Vec<FixtureConsultationIdentity>> {
-    let mut identities = BTreeSet::new();
-    for requested_claim in &request.claims {
-        let (service_id, service) = loaded
-            .project
-            .services
-            .iter()
-            .find(|(_, service)| {
-                service.kind == ServiceKind::Evidence
-                    && service.purpose == request.purpose
-                    && service.claims.contains_key(&requested_claim.id)
-            })
-            .ok_or_else(|| anyhow!("governed request claim has no selected evidence service"))?;
-        let claim = service
-            .claims
-            .get(&requested_claim.id)
-            .ok_or_else(|| anyhow!("selected governed request claim is absent"))?;
-        if inferred_claim_evidence(service, claim)? != ClaimEvidence::RegistryBacked {
-            bail!("governed request claim is not registry-backed");
-        }
-        let consultation_id = claim_consultation_name(service, claim)?;
-        identities.insert(FixtureConsultationIdentity {
-            service_id: service_id.clone(),
-            consultation_id: consultation_id.to_owned(),
-        });
-    }
-    if identities.is_empty() {
-        bail!("governed request selected no registry-backed consultation");
-    }
-    Ok(identities.into_iter().collect())
-}
-
-// Authentication and pre-source denial are independent security inputs and
-// remain explicit at this offline product boundary.
-#[allow(clippy::too_many_arguments)]
-fn evaluate_product_claims(
-    loaded: &LoadedRegistryProject,
-    compiled: &CompiledProject,
-    integration_alias: &str,
-    fixture: &FixtureDocument,
-    relay_result: Option<(&BTreeMap<String, Value>, &str)>,
-    authentication: registry_notary_server::standalone::OfflineAuthentication,
-    require_pre_source_denial: bool,
-    worker_program: &Path,
-) -> Result<ProductClaimsFixtureEvaluation> {
-    use registry_notary_core::{
-        ClaimRef, EvaluateRequest, EvidenceEntity, EvidenceIdentifier, RequestVariables,
-        FORMAT_CLAIM_RESULT_JSON,
-    };
-    use registry_notary_server::standalone::{
-        OfflineNotaryHarness, OfflineNotaryRequest, OfflineRelayConsultation, OfflineRelayOutcome,
-    };
-
-    let empty_outputs = BTreeMap::new();
-    let subject_type = fixture_subject_type(loaded, integration_alias)?;
-    let (outputs, outcome) = relay_result.unwrap_or((&empty_outputs, "no_match"));
-    let relay_outcome = match outcome {
-        "match" => OfflineRelayOutcome::Match,
-        "no_match" => OfflineRelayOutcome::NoMatch,
-        "ambiguous" => OfflineRelayOutcome::Ambiguous,
-        _ => bail!("offline Relay returned an unknown product outcome"),
-    };
-    let relay_inputs = fixture
-        .input
-        .iter()
-        .map(|(name, value)| {
-            let value = match value {
-                Value::Null => "null".to_owned(),
-                Value::Bool(value) => value.to_string(),
-                Value::Number(value) => value.to_string(),
-                Value::String(value) => value.clone(),
-                Value::Array(_) | Value::Object(_) => {
-                    bail!("fixture input is not a bounded scalar")
-                }
-            };
-            Ok((name.clone(), value))
-        })
-        .collect::<Result<BTreeMap<_, _>>>()?;
-    let relay_evidence = compiled
-        .fixture_profiles
-        .iter()
-        .map(|profile| {
-            let purpose = &loaded.project.services[&profile.service_id].purpose;
-            let is_fixture_integration = profile.integration_alias == integration_alias;
-            OfflineRelayConsultation::decoded_inputs(
-                profile.id.clone(),
-                profile.contract_hash.clone(),
-                purpose.clone(),
-                relay_inputs.clone(),
-                if is_fixture_integration {
-                    relay_outcome
-                } else {
-                    OfflineRelayOutcome::NoMatch
-                },
-                if is_fixture_integration && relay_outcome == OfflineRelayOutcome::Match {
-                    outputs.clone()
-                } else {
-                    BTreeMap::new()
-                },
-            )
-        })
-        .collect::<Vec<_>>();
-    if relay_evidence.is_empty() {
-        bail!("offline Notary fixture has no exact Relay consultation profile");
-    }
-    let notary_config = compiled
-        .notary_private
-        .get(Path::new("config/notary.yaml"))
-        .ok_or_else(|| anyhow!("generated Notary config is absent"))?;
-    let notary_config: StandaloneRegistryNotaryConfig = serde_norway::from_slice(notary_config)
-        .context("generated Notary config did not parse for offline evaluation")?;
-    let harness = OfflineNotaryHarness::compile(
-        notary_config,
-        relay_evidence,
-        project_cel_worker_config(worker_program),
-    )
-    .context("production Notary offline harness did not compile")?;
-    let runtime = tokio::runtime::Builder::new_current_thread()
-        .enable_all()
-        .build()
-        .context("failed to build the offline Notary evaluation runtime")?;
-    let mut claims = BTreeMap::new();
-    let mut evaluated_any = false;
-    let mut relay_calls = 0_u64;
-    for service in loaded.project.services.values() {
-        if service.kind != ServiceKind::Evidence {
-            continue;
-        }
-        let mut claim_groups = BTreeMap::<DisclosureMode, Vec<String>>::new();
-        for (claim_id, claim) in &service.claims {
-            let consultation = claim_consultation_name(service, claim)?;
-            if service.consultations[consultation].integration != integration_alias {
-                continue;
-            }
-            let disclosure = match &claim.disclosure {
-                DisclosureDeclaration::Mode(mode) => *mode,
-                DisclosureDeclaration::Policy { default, .. } => *default,
-            };
-            claim_groups
-                .entry(disclosure)
-                .or_default()
-                .push(claim_id.clone());
-        }
-        if claim_groups.is_empty() {
-            continue;
-        }
-        evaluated_any = true;
-        let mut target = EvidenceEntity::new(subject_type.as_str());
-        let mut identifiers = BTreeMap::new();
-        let mut requester_identifiers = BTreeMap::new();
-        let mut attributes = BTreeMap::new();
-        for consultation in service
-            .consultations
-            .values()
-            .filter(|consultation| consultation.integration == integration_alias)
-        {
-            for (name, request_path) in &consultation.input {
-                let value = fixture
-                    .input
-                    .get(name)
-                    .ok_or_else(|| anyhow!("fixture omitted a compiled consultation input"))?;
-                if request_path == "request.target.id" {
-                    target.id = Some(
-                        value
-                            .as_str()
-                            .ok_or_else(|| anyhow!("target id fixture input must be a String"))?
-                            .to_string(),
-                    );
-                } else if let Some(scheme) =
-                    request_path.strip_prefix("request.target.identifiers.")
-                {
-                    identifiers.insert(
-                        scheme.to_string(),
-                        value
-                            .as_str()
-                            .ok_or_else(|| {
-                                anyhow!("target identifier fixture input must be a String")
-                            })?
-                            .to_string(),
-                    );
-                } else if let Some(name) = request_path.strip_prefix("request.target.attributes.") {
-                    attributes.insert(name.to_string(), value.clone());
-                } else if let Some(scheme) =
-                    request_path.strip_prefix("request.requester.identifiers.")
-                {
-                    requester_identifiers.insert(
-                        scheme.to_string(),
-                        value
-                            .as_str()
-                            .ok_or_else(|| {
-                                anyhow!("requester identifier fixture input must be a String")
-                            })?
-                            .to_string(),
-                    );
-                } else {
-                    bail!("compiled consultation input uses an unsupported request path");
-                }
-            }
-        }
-        target.identifiers = identifiers
-            .into_iter()
-            .map(|(scheme, value)| EvidenceIdentifier {
-                scheme,
-                value,
-                issuer: None,
-                country: None,
-            })
-            .collect();
-        target.attributes = attributes;
-        let requester = if requester_identifiers.is_empty() {
-            None
-        } else {
-            let mut requester = EvidenceEntity::new("AuthenticatedRequester");
-            requester.identifiers = requester_identifiers
-                .into_iter()
-                .map(|(scheme, value)| EvidenceIdentifier {
-                    scheme,
-                    value,
-                    issuer: None,
-                    country: None,
-                })
-                .collect();
-            Some(requester)
-        };
-        let variables = fixture
-            .variables
-            .iter()
-            .map(|(name, value)| {
-                value
-                    .as_str()
-                    .map(|value| (name.clone(), value.to_string()))
-                    .ok_or_else(|| anyhow!("fixture variable is not a full-date string"))
-            })
-            .collect::<Result<BTreeMap<_, _>>>()?;
-        let purpose = service.purpose.as_str();
-        let variables = RequestVariables::try_new(variables).map_err(|error| anyhow!(error))?;
-        for (disclosure, claim_ids) in claim_groups {
-            let request = EvaluateRequest {
-                requester: requester.clone(),
-                target: Some(target.clone()),
-                relationship: None,
-                on_behalf_of: None,
-                variables: variables.clone(),
-                claims: claim_ids
-                    .iter()
-                    .map(|claim| ClaimRef::from(claim.as_str()))
-                    .collect(),
-                disclosure: Some(
-                    match disclosure {
-                        DisclosureMode::Value => "value",
-                        DisclosureMode::Predicate => "predicate",
-                        DisclosureMode::Redacted => "redacted",
-                    }
-                    .to_string(),
-                ),
-                format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
-                purpose: Some(purpose.to_string()),
-            };
-            let evidence = runtime.block_on(harness.evaluate(
-                OfflineNotaryRequest::new(authentication, request).with_header_purpose(purpose),
-            ));
-            relay_calls = relay_calls.saturating_add(evidence.relay_calls());
-            if let Some(error) = evidence.error_class() {
-                if require_pre_source_denial && evidence.relay_calls() != 0 {
-                    bail!("derived authorization denial occurred after Relay access");
-                }
-                return Ok(ProductClaimsFixtureEvaluation {
-                    result: Err(error.as_str().to_string()),
-                    relay_calls,
-                    consultations: Vec::new(),
-                });
-            }
-            if evidence.relay_calls() != evidence.consultation_count() as u64 {
-                bail!("offline Notary did not reuse each request-scoped consultation exactly once");
-            }
-            for claim in evidence.claims() {
-                let value = if claim.disclosure() == "redacted" {
-                    Value::String("redacted".to_string())
-                } else if claim.disclosure() == "predicate" {
-                    claim.satisfied().map_or(Value::Null, Value::Bool)
-                } else if let Some(value) = claim.value() {
-                    value.clone()
-                } else {
-                    Value::Null
-                };
-                if claims.insert(claim.claim_id().to_string(), value).is_some() {
-                    bail!("offline Notary returned a duplicate project claim id");
-                }
-            }
-        }
-    }
-    if !evaluated_any {
-        bail!("offline fixture does not select a project Notary service");
-    }
-    Ok(ProductClaimsFixtureEvaluation {
-        result: Ok(claims),
-        relay_calls,
-        consultations: Vec::new(),
-    })
-}
-
-fn project_cel_worker_config(
-    worker_program: &Path,
-) -> registry_notary_server::cel_worker::CelWorkerConfig {
-    let mut config =
-        registry_notary_server::cel_worker::CelWorkerConfig::for_current_exe_subcommand();
-    config.command = worker_program.to_path_buf();
-    config.command_args = vec![std::ffi::OsString::from("__registryctl-cel-worker-v1")];
-    config.command_envs.clear();
-    config.current_dir = None;
-    // Debug and sanitizer builds can take longer than the production worker's
-    // evaluation deadline to cold-start the isolated subprocess. Keep startup
-    // separately bounded while preserving the production evaluation deadline.
-    config.startup_timeout = std::time::Duration::from_secs(10);
-    config
-}
-
 struct CallBudgetCoverageHost;
 
 #[async_trait::async_trait]
@@ -2421,14 +1448,13 @@ fn platform_call_budget_result(
             );
             matches!(
                 runtime.block_on(
-                    WorkerProcess::with_program(worker_program)
-                        .evaluate_with_host(
-                            &request,
-                            &mut CallBudgetCoverageHost,
-                            tokio::time::Instant::now()
-                                .checked_add(std::time::Duration::from_secs(10))
-                                .expect("fixture hard deadline is representable"),
-                        ),
+                    WorkerProcess::with_program(worker_program).evaluate_with_host(
+                        &request,
+                        &mut CallBudgetCoverageHost,
+                        tokio::time::Instant::now()
+                            .checked_add(std::time::Duration::from_secs(10))
+                            .expect("fixture hard deadline is representable"),
+                    ),
                 ),
                 Err(WorkerError::BudgetExceeded)
             )
diff --git a/crates/registryctl/src/project_authoring/knowledge.rs b/crates/registryctl/src/project_authoring/knowledge.rs
index d7feefa1e..4a46f6a92 100644
--- a/crates/registryctl/src/project_authoring/knowledge.rs
+++ b/crates/registryctl/src/project_authoring/knowledge.rs
@@ -64,7 +64,6 @@ pub enum SemanticOwner {
     FixtureHarness,
     EntityContract,
     RelayRuntime,
-    NotaryRuntime,
 }
 
 #[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
@@ -79,7 +78,6 @@ pub enum HumanOwner {
     TestMaintainers,
     DataModelMaintainers,
     RelayMaintainers,
-    NotaryMaintainers,
 }
 
 #[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
@@ -118,7 +116,6 @@ impl Sensitivity {
 pub enum Product {
     Registryctl,
     Relay,
-    Notary,
     Editor,
     Docs,
 }
@@ -150,7 +147,6 @@ pub enum Migration {
 pub enum Consumer {
     RegistryctlAuthoring,
     RegistryRelay,
-    RegistryNotary,
     EditorTooling,
     DocsGenerator,
 }
@@ -161,7 +157,6 @@ pub enum GeneratedArtifact {
     EditorSchemas,
     ProjectBuild,
     RelayConfig,
-    NotaryConfig,
     FixtureReport,
     FieldReference,
 }
@@ -173,7 +168,6 @@ pub enum ReviewClass {
     Security,
     Privacy,
     Relay,
-    Notary,
     Compatibility,
     Documentation,
     Testing,
diff --git a/crates/registryctl/src/project_authoring/model.rs b/crates/registryctl/src/project_authoring/model.rs
index c541d9dc7..401770b68 100644
--- a/crates/registryctl/src/project_authoring/model.rs
+++ b/crates/registryctl/src/project_authoring/model.rs
@@ -210,12 +210,7 @@ fn trusted_local_value_path_is_prohibited(address: &ProjectFieldAddress) -> bool
     let field_name = path.rsplit('/').next().unwrap_or_default();
     matches!(
         field_name,
-        "token_file"
-            | "workload_token_file"
-            | "secret_file"
-            | "private_key_file"
-            | "cel"
-            | "x-registry-source"
+        "token_file" | "secret_file" | "private_key_file" | "cel" | "x-registry-source"
     ) || path == "/starter/content_digest"
 }
 
@@ -229,9 +224,8 @@ pub struct ProjectBuildOptions {
 
 /// Product-labelled approved baselines for a project build.
 ///
-/// Public Relay, consultation Relay, and Notary are independently signed
-/// inputs. A consultation project supplies both Relay pairs, plus Notary when
-/// that product is projected. The `against` and `anchor` fields on
+/// Public Relay and consultation Relay are independently signed inputs. The
+/// `against` and `anchor` fields on
 /// [`ProjectBuildOptions`] remain available for single-lane callers.
 #[derive(Debug, Clone, Default)]
 pub struct ProjectBuildBaselineSetOptions {
@@ -239,8 +233,6 @@ pub struct ProjectBuildBaselineSetOptions {
     pub relay_anchor: Option<PathBuf>,
     pub relay_consultation_against: Option<PathBuf>,
     pub relay_consultation_anchor: Option<PathBuf>,
-    pub notary_against: Option<PathBuf>,
-    pub notary_anchor: Option<PathBuf>,
 }
 
 #[derive(Debug, Clone)]
@@ -335,7 +327,6 @@ pub struct FixtureReport {
     pub inputs: Vec<String>,
     pub calls: Vec<String>,
     pub outputs: Vec<String>,
-    pub claims: Vec<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub outcome: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -405,11 +396,6 @@ struct ServiceDeclaration {
     kind: ServiceKind,
     #[serde(default)]
     version: u32,
-    /// Subject category evaluated by an evidence service. Omission is
-    /// normalized to `person` without erasing whether the field was authored,
-    /// so records services cannot silently accept it.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    subject_type: Option<EvidenceSubjectType>,
     #[serde(default)]
     purpose: String,
     #[serde(default)]
@@ -417,16 +403,10 @@ struct ServiceDeclaration {
     #[serde(default = "default_consent")]
     consent: ConsentDeclaration,
     #[serde(default)]
-    access: AccessDeclaration,
-    #[serde(default)]
     variables: BTreeMap<String, RequestVariable>,
     #[serde(default)]
     consultations: BTreeMap<String, ConsultationDeclaration>,
     #[serde(default)]
-    claims: BTreeMap<String, ClaimDeclaration>,
-    #[serde(default)]
-    credential_profiles: BTreeMap<String, CredentialProfileDeclaration>,
-    #[serde(default)]
     entity: Option<String>,
     #[serde(default)]
     title: Option<String>,
@@ -446,38 +426,11 @@ struct ServiceDeclaration {
     api: Option<RecordsApiDeclaration>,
 }
 
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Clone, Copy, Default, Deserialize, Serialize, Eq, PartialEq, Ord, PartialOrd)]
-#[serde(rename_all = "snake_case")]
-enum EvidenceSubjectType {
-    #[default]
-    Person,
-    Project,
-}
-
-impl EvidenceSubjectType {
-    const fn as_str(self) -> &'static str {
-        match self {
-            Self::Person => "person",
-            Self::Project => "project",
-        }
-    }
-}
-
-impl ServiceDeclaration {
-    const fn effective_subject_type(&self) -> EvidenceSubjectType {
-        match self.subject_type {
-            Some(subject_type) => subject_type,
-            None => EvidenceSubjectType::Person,
-        }
-    }
-}
-
 #[cfg_attr(test, derive(schemars::JsonSchema))]
 #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case")]
 enum ServiceKind {
-    Evidence,
+    ConsultationApi,
     RecordsApi,
 }
 
@@ -493,14 +446,6 @@ enum ConsentDeclaration {
     Required,
 }
 
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Clone, Default, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct AccessDeclaration {
-    #[serde(default)]
-    scopes: Vec<String>,
-}
-
 #[cfg_attr(test, derive(schemars::JsonSchema))]
 #[derive(Debug, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
@@ -1018,69 +963,6 @@ struct ConsultationDeclaration {
     input: BTreeMap<String, String>,
 }
 
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct ClaimDeclaration {
-    #[serde(default)]
-    output: Option<String>,
-    #[serde(default)]
-    cel: Option<String>,
-    #[serde(default)]
-    value: Option<ClaimValueDeclaration>,
-    disclosure: DisclosureDeclaration,
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)]
-#[serde(rename_all = "snake_case")]
-enum ClaimEvidence {
-    RegistryBacked,
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct ClaimValueDeclaration {
-    #[serde(rename = "type")]
-    value_type: OutputType,
-    #[serde(default)]
-    nullable: bool,
-    #[serde(default)]
-    max_bytes: Option<u32>,
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(untagged)]
-enum DisclosureDeclaration {
-    Mode(DisclosureMode),
-    Policy {
-        default: DisclosureMode,
-        allowed: Vec<DisclosureMode>,
-    },
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
-#[serde(rename_all = "snake_case")]
-enum DisclosureMode {
-    Value,
-    Predicate,
-    Redacted,
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct CredentialProfileDeclaration {
-    format: String,
-    #[serde(rename = "type")]
-    credential_type: String,
-    validity: String,
-    claims: Vec<String>,
-}
-
 #[cfg_attr(test, derive(schemars::JsonSchema))]
 #[derive(Debug, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
@@ -1691,21 +1573,9 @@ struct EnvironmentDocument {
     #[serde(default)]
     entities: BTreeMap<String, EnvironmentEntityBinding>,
     #[serde(default)]
-    issuance: Option<IssuanceBinding>,
-    #[serde(default)]
-    callers: BTreeMap<String, CallerBinding>,
-    #[serde(default)]
     relay: Option<RelayBinding>,
     #[serde(default)]
-    notary_relay: Option<NotaryRelayBinding>,
-    #[serde(default)]
     relay_state: Option<RelayStateBinding>,
-    #[serde(default)]
-    notary_state: Option<NotaryStateBinding>,
-    #[serde(default)]
-    notary_cel: Option<NotaryCelBinding>,
-    #[serde(default)]
-    oid4vci: Option<Oid4vciBinding>,
     deployment: DeploymentBinding,
 }
 
@@ -1718,8 +1588,6 @@ struct DevelopmentDeclaration {
     default_fixture: String,
     #[serde(default)]
     relay_port: Option<u16>,
-    #[serde(default)]
-    notary_port: Option<u16>,
 }
 
 #[cfg_attr(test, derive(schemars::JsonSchema))]
@@ -1871,45 +1739,6 @@ enum RecordProvider {
     },
 }
 
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct IssuanceBinding {
-    issuer: String,
-    signing_key: SecretReference,
-    signing_kid: String,
-    #[serde(default)]
-    algorithm: IssuanceSigningAlgorithm,
-    generation: u64,
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Clone, Copy, Default, Deserialize, Serialize)]
-enum IssuanceSigningAlgorithm {
-    #[default]
-    #[serde(rename = "EdDSA")]
-    EdDsa,
-    #[serde(rename = "ES256")]
-    Es256,
-}
-
-impl IssuanceSigningAlgorithm {
-    const fn as_str(self) -> &'static str {
-        match self {
-            Self::EdDsa => "EdDSA",
-            Self::Es256 => "ES256",
-        }
-    }
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct CallerBinding {
-    api_key_fingerprint: SecretReference,
-    scopes: Vec<String>,
-}
-
 #[cfg_attr(test, derive(schemars::JsonSchema))]
 #[derive(Debug, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
@@ -1920,25 +1749,26 @@ struct RelayBinding {
     audience: String,
     allowed_clients: Vec<String>,
     #[serde(default)]
+    consultation: Option<RelayConsultationBinding>,
+    #[serde(default)]
     local_api_keys: Option<RelayLocalApiKeyBinding>,
 }
 
 #[cfg_attr(test, derive(schemars::JsonSchema))]
 #[derive(Debug, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
-struct RelayLocalApiKeyBinding {
-    match_principal: String,
-    no_match_principal: String,
-    scopes: Vec<String>,
+struct RelayConsultationBinding {
+    client_id: String,
+    principal_id: String,
 }
 
 #[cfg_attr(test, derive(schemars::JsonSchema))]
 #[derive(Debug, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
-struct NotaryRelayBinding {
-    base_url: String,
-    workload_client_id: String,
-    token_file: PathBuf,
+struct RelayLocalApiKeyBinding {
+    match_principal: String,
+    no_match_principal: String,
+    scopes: Vec<String>,
 }
 
 #[cfg_attr(test, derive(schemars::JsonSchema))]
@@ -1955,133 +1785,6 @@ struct RelayPostgresqlBinding {
     root_certificate_path: PathBuf,
 }
 
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct NotaryStateBinding {
-    postgresql: NotaryPostgresqlBinding,
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct NotaryPostgresqlBinding {
-    root_certificate_path: PathBuf,
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct NotaryCelBinding {
-    worker_memory_bytes: u64,
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct Oid4vciBinding {
-    public_base_url: String,
-    credential: Oid4vciCredentialBinding,
-    authorization_server: Oid4vciAuthorizationServerBinding,
-    client: Oid4vciClientBinding,
-    /// Machine OIDC clients admitted to create registrar-initiated offers.
-    ///
-    /// These clients use the pinned authorization server and the Notary public
-    /// base URL as their resource audience. They are deliberately separate
-    /// from the citizen client so generated subject-access classification
-    /// remains closed.
-    #[serde(default)]
-    registrar_clients: Vec<String>,
-    access_token: Oid4vciSigningKeyBinding,
-    sensitive_state_key: SecretReference,
-    subject: Oid4vciSubjectBinding,
-    redirect_uri: String,
-    allowed_wallet_origins: Vec<String>,
-    #[serde(default)]
-    tx_code: Oid4vciTxCodeBinding,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    representative_issuance: Option<Oid4vciRepresentativeIssuanceBinding>,
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct Oid4vciRepresentativeIssuanceBinding {
-    relationship: String,
-    proof_claim: String,
-    target_id_type: String,
-    #[serde(default = "default_oid4vci_representative_max_proof_age_seconds")]
-    max_proof_age_seconds: u64,
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct Oid4vciTxCodeBinding {
-    #[serde(default = "default_oid4vci_tx_code_required")]
-    required: bool,
-}
-
-impl Default for Oid4vciTxCodeBinding {
-    fn default() -> Self {
-        Self {
-            required: default_oid4vci_tx_code_required(),
-        }
-    }
-}
-
-const fn default_oid4vci_tx_code_required() -> bool {
-    true
-}
-
-const fn default_oid4vci_representative_max_proof_age_seconds() -> u64 {
-    300
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct Oid4vciCredentialBinding {
-    service: String,
-    profile: String,
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct Oid4vciAuthorizationServerBinding {
-    issuer: String,
-    jwks_url: String,
-    userinfo_url: String,
-    authorize_url: String,
-    token_url: String,
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct Oid4vciClientBinding {
-    id: String,
-    signing_key: SecretReference,
-    signing_kid: String,
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct Oid4vciSigningKeyBinding {
-    signing_key: SecretReference,
-    signing_kid: String,
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct Oid4vciSubjectBinding {
-    token_claim: String,
-    id_type: String,
-}
-
 #[cfg_attr(test, derive(schemars::JsonSchema))]
 #[derive(Debug, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
@@ -2089,8 +1792,6 @@ struct DeploymentBinding {
     profile: DeploymentProfile,
     #[serde(default)]
     relay: Option<ServiceBinding>,
-    #[serde(default)]
-    notary: Option<ServiceBinding>,
 }
 
 #[cfg_attr(test, derive(schemars::JsonSchema))]
@@ -2100,7 +1801,6 @@ enum DeploymentProfile {
     Local,
     HostedLab,
     Production,
-    EvidenceGrade,
 }
 
 impl DeploymentProfile {
@@ -2109,7 +1809,6 @@ impl DeploymentProfile {
             Self::Local => "local",
             Self::HostedLab => "hosted_lab",
             Self::Production => "production",
-            Self::EvidenceGrade => "evidence_grade",
         }
     }
 }
@@ -2125,113 +1824,12 @@ struct ServiceBinding {
 struct FixtureDocument {
     name: String,
     classification: AuthoredFixtureClassification,
-    #[serde(default)]
-    request: Option<GovernedFixtureRequest>,
     input: BTreeMap<String, Value>,
     #[serde(default)]
     variables: BTreeMap<String, Value>,
     interactions: Vec<FixtureInteraction>,
     expect: FixtureExpectation,
 }
-
-/// The closed governed request accepted by an independently authored synthetic
-/// fixture witness.
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Clone, Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct GovernedFixtureRequest {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    requester: Option<GovernedFixtureTarget>,
-    target: GovernedFixtureTarget,
-    #[cfg_attr(test, schemars(with = "BTreeMap<String, String>"))]
-    #[serde(
-        default,
-        skip_serializing_if = "registry_notary_core::RequestVariables::is_empty"
-    )]
-    variables: registry_notary_core::RequestVariables,
-    claims: Vec<registry_notary_core::ClaimRef>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    disclosure: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    format: Option<String>,
-    purpose: String,
-}
-
-impl GovernedFixtureRequest {
-    fn to_evaluate_request(&self) -> registry_notary_core::EvaluateRequest {
-        registry_notary_core::EvaluateRequest {
-            requester: self.requester.as_ref().map(governed_fixture_entity),
-            target: Some(registry_notary_core::EvidenceEntity {
-                entity_type: self.target.entity_type.clone(),
-                id: self.target.id.clone(),
-                identifiers: self
-                    .target
-                    .identifiers
-                    .iter()
-                    .map(|identifier| registry_notary_core::EvidenceIdentifier {
-                        scheme: identifier.scheme.clone(),
-                        value: identifier.value.clone(),
-                        issuer: None,
-                        country: None,
-                    })
-                    .collect(),
-                attributes: self.target.attributes.clone(),
-                assurance: None,
-                profile: None,
-            }),
-            relationship: None,
-            on_behalf_of: None,
-            variables: self.variables.clone(),
-            claims: self.claims.clone(),
-            disclosure: self.disclosure.clone(),
-            format: self.format.clone(),
-            purpose: Some(self.purpose.clone()),
-        }
-    }
-}
-
-fn governed_fixture_entity(entity: &GovernedFixtureTarget) -> registry_notary_core::EvidenceEntity {
-    registry_notary_core::EvidenceEntity {
-        entity_type: entity.entity_type.clone(),
-        id: entity.id.clone(),
-        identifiers: entity
-            .identifiers
-            .iter()
-            .map(|identifier| registry_notary_core::EvidenceIdentifier {
-                scheme: identifier.scheme.clone(),
-                value: identifier.value.clone(),
-                issuer: None,
-                country: None,
-            })
-            .collect(),
-        attributes: entity.attributes.clone(),
-        assurance: None,
-        profile: None,
-    }
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Clone, Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct GovernedFixtureTarget {
-    #[serde(rename = "type")]
-    entity_type: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    id: Option<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    identifiers: Vec<GovernedFixtureIdentifier>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    attributes: BTreeMap<String, Value>,
-}
-
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Clone, Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct GovernedFixtureIdentifier {
-    scheme: String,
-    value: String,
-}
-
 #[derive(Debug, Clone, Serialize)]
 struct FixtureInteraction {
     expect: FixtureRequestExpectation,
@@ -2266,8 +1864,6 @@ struct FixtureExpectation {
     #[serde(default)]
     outputs: BTreeMap<String, Value>,
     #[serde(default)]
-    claims: BTreeMap<String, Value>,
-    #[serde(default)]
     error: Option<String>,
     #[serde(default)]
     outcome: Option<String>,
@@ -2301,7 +1897,6 @@ struct CompiledProject {
     reviewable: BTreeMap<PathBuf, Box<[u8]>>,
     relay_private: BTreeMap<PathBuf, Box<[u8]>>,
     relay_consultation_private: BTreeMap<PathBuf, Box<[u8]>>,
-    notary_private: BTreeMap<PathBuf, Box<[u8]>>,
     review: Value,
     approval_state: Value,
     explanation: ProjectExplanationReportV1,
@@ -2311,8 +1906,6 @@ struct CompiledProject {
 }
 
 struct FixtureProfile {
-    service_id: String,
-    consultation_id: String,
     integration_alias: String,
     id: String,
     version: String,
@@ -2334,35 +1927,22 @@ struct VerifiedBaseline {
 enum VerifiedBaselineLane {
     Relay,
     RelayConsultation,
-    Notary,
 }
 
 #[derive(Default)]
 struct VerifiedBaselineSet {
     relay: Option<VerifiedBaseline>,
     relay_consultation: Option<VerifiedBaseline>,
-    notary: Option<VerifiedBaseline>,
 }
 
 #[derive(Debug, Clone, Serialize)]
 #[serde(deny_unknown_fields)]
 struct SemanticDigests {
-    claim: String,
     integration: String,
     service_policy: String,
     operator_security: String,
 }
 
-#[cfg_attr(test, derive(schemars::JsonSchema))]
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
-#[serde(deny_unknown_fields)]
-struct DisclosureReviewProfile {
-    default: DisclosureMode,
-    allowed: BTreeSet<DisclosureMode>,
-}
-
-type DisclosureReviewProfiles = BTreeMap<String, BTreeMap<String, DisclosureReviewProfile>>;
-
 struct GeneratedPack {
     alias: String,
     id: String,
@@ -2387,3 +1967,28 @@ struct GeneratedProfile {
     contract: AuthoredConsultationContract,
     binding: AuthoredArtifact,
 }
+
+#[cfg(test)]
+mod relay_only_authoring_model_tests {
+    use super::*;
+
+    #[test]
+    fn consultation_api_uses_the_relay_specific_wire_value() {
+        assert_eq!(
+            serde_json::to_value(ServiceKind::ConsultationApi).expect("service kind serializes"),
+            Value::String("consultation_api".to_string())
+        );
+        assert_eq!(
+            serde_json::from_value::<ServiceKind>(Value::String("consultation_api".to_string()))
+                .expect("consultation API service kind parses"),
+            ServiceKind::ConsultationApi
+        );
+    }
+
+    #[test]
+    fn retired_evidence_service_kind_is_rejected() {
+        let error = serde_json::from_value::<ServiceKind>(Value::String("evidence".to_string()))
+            .expect_err("retired evidence service kind must be unknown");
+        assert!(error.to_string().contains("unknown variant"));
+    }
+}
diff --git a/crates/registryctl/src/project_authoring/output.rs b/crates/registryctl/src/project_authoring/output.rs
index d36854c5c..0311b0193 100644
--- a/crates/registryctl/src/project_authoring/output.rs
+++ b/crates/registryctl/src/project_authoring/output.rs
@@ -123,7 +123,7 @@ impl ProjectExecutionContext {
     ///
     /// The path must be absolute and identify an existing, non-symlink regular
     /// file with executable permissions. Validation happens before the path can
-    /// reach either Relay or Notary worker configuration.
+    /// reach Relay worker configuration.
     pub fn new(worker_program: impl AsRef<Path>) -> Result<Self> {
         let worker_program = worker_program.as_ref();
         if !worker_program.is_absolute() {
@@ -206,10 +206,7 @@ mod project_execution_context_tests {
 }
 
 fn validate_generated_product_configs(compiled: &CompiledProject) -> Result<()> {
-    if compiled.relay_private.is_empty()
-        && compiled.relay_consultation_private.is_empty()
-        && compiled.notary_private.is_empty()
-    {
+    if compiled.relay_private.is_empty() && compiled.relay_consultation_private.is_empty() {
         bail!("generated deployment has no product configuration");
     }
     if !compiled.relay_private.is_empty() {
@@ -230,9 +227,6 @@ fn validate_generated_product_configs(compiled: &CompiledProject) -> Result<()>
             "config/relay.yaml",
         )?;
     }
-    if !compiled.notary_private.is_empty() {
-        validate_generated_notary(compiled)?;
-    }
     Ok(())
 }
 
@@ -371,19 +365,6 @@ fn read_project_workbook(root: &Path, relative: &Path, byte_limit: u64) -> Resul
     Ok(bytes)
 }
 
-fn validate_generated_notary(compiled: &CompiledProject) -> Result<()> {
-    let notary_config = compiled
-        .notary_private
-        .get(Path::new("config/notary.yaml"))
-        .ok_or_else(|| anyhow!("generated Notary config is absent"))?;
-    let notary: StandaloneRegistryNotaryConfig =
-        serde_norway::from_slice(notary_config).context("generated Notary config did not parse")?;
-    notary
-        .validate()
-        .context("generated Notary config failed the production validator")?;
-    Ok(())
-}
-
 fn validate_generated_relay(
     relay_config: &[u8],
     files: &BTreeMap<PathBuf, Box<[u8]>>,
@@ -686,7 +667,7 @@ fn generated_evidence(
 struct PreparedReviewedProject {
     loaded: LoadedRegistryProject,
     compiled: CompiledProject,
-    signing_input_identities: [registry_platform_config::ProductAcceptanceIdentityV1; 3],
+    signing_input_identities: Vec<registry_platform_config::ProductAcceptanceIdentityV1>,
     preceding_approved_set_digest: Option<String>,
     anchor_rotation_lanes: Vec<crate::ApprovedLaneV1>,
     retained_rotation_evidence: BTreeMap<crate::ApprovedLaneV1, RetainedReviewedEvidence>,
@@ -735,18 +716,19 @@ pub fn build_reviewed_project(
     )?;
     preflight_project_rhai_scripts(&prepared.loaded)?;
     validate_generated_product_configs(&prepared.compiled)?;
-    let has_project_local_file_input = prepared
-        .loaded
-        .environment
-        .as_ref()
-        .is_some_and(|environment| {
-            environment
-                .entities
-                .values()
-                .any(|binding| matches!(&binding.provider, RecordProvider::Xlsx { .. }))
-        });
+    let has_project_local_file_input =
+        prepared
+            .loaded
+            .environment
+            .as_ref()
+            .is_some_and(|environment| {
+                environment
+                    .entities
+                    .values()
+                    .any(|binding| matches!(&binding.provider, RecordProvider::Xlsx { .. }))
+            });
     let artifact_inputs = validate_project_workbook_inputs(&prepared.loaded, &prepared.compiled)?;
-    let (fixtures, generated_observations, request_observations, call_budget_actual) =
+    let (fixtures, generated_observations, call_budget_actual) =
         execute_all_fixtures_with_coverage_observations(
             &prepared.loaded,
             &prepared.compiled,
@@ -760,7 +742,6 @@ pub fn build_reviewed_project(
         &prepared.loaded,
         &fixtures,
         &generated_observations,
-        &request_observations,
         call_budget_actual,
     )?;
     let output = prepared
@@ -921,7 +902,6 @@ fn prepare_reviewed_project(
             let expected = &signing_input_identities[match lane {
                 crate::ApprovedLaneV1::RelayPublic => 0,
                 crate::ApprovedLaneV1::RelayConsultation => 1,
-                crate::ApprovedLaneV1::Notary => 2,
             }];
             if verified.acceptance_identity() != expected {
                 bail!("approved set lane identity does not match the selected project environment");
@@ -940,7 +920,6 @@ fn prepare_reviewed_project(
                     crate::ApprovedLaneV1::RelayConsultation => {
                         VerifiedBaselineLane::RelayConsultation
                     }
-                    crate::ApprovedLaneV1::Notary => VerifiedBaselineLane::Notary,
                 }),
             )?
             .ok_or_else(|| anyhow!("approved set lane baseline is absent"))?;
@@ -968,7 +947,6 @@ fn prepare_reviewed_project(
                 let previous = set.lanes.get(*lane).reviewed_binding();
                 current.lane_scoped_reviewed_input_digest
                     != previous.lane_scoped_reviewed_input_digest
-                    || current.interfaces != previous.interfaces
             })
         })
         .collect::<Vec<_>>();
@@ -1014,9 +992,6 @@ fn prepare_reviewed_project(
         relay_consultation: affected_lanes
             .contains(&crate::ApprovedLaneV1::RelayConsultation)
             .then(|| selected_binding(crate::ApprovedLaneV1::RelayConsultation)),
-        notary: affected_lanes
-            .contains(&crate::ApprovedLaneV1::Notary)
-            .then(|| selected_binding(crate::ApprovedLaneV1::Notary)),
     };
     bindings.validate_bindings()?;
     Ok(PreparedReviewedProject {
@@ -1033,20 +1008,10 @@ fn prepare_reviewed_project(
 
 fn reviewed_bindings(
     compiled: &CompiledProject,
-    identities: &[registry_platform_config::ProductAcceptanceIdentityV1; 3],
+    identities: &[registry_platform_config::ProductAcceptanceIdentityV1],
 ) -> Result<crate::ReviewedBuildUpdateV1> {
     let review_bytes = canonical_json_line(&compiled.review)?;
     let state_bytes = canonical_json_line(&compiled.approval_state)?;
-    let consultation_interface = compiled
-        .review
-        .get("consultations")
-        .and_then(Value::as_object)
-        .filter(|consultations| !consultations.is_empty())
-        .map(|consultations| {
-            canonicalize_json(&Value::Object(consultations.clone())).map(|bytes| sha256_uri(&bytes))
-        })
-        .transpose()
-        .context("failed to canonicalize reviewed consultation interface")?;
     let binding = |lane: crate::ApprovedLaneV1,
                    identity: &registry_platform_config::ProductAcceptanceIdentityV1,
                    files: &BTreeMap<PathBuf, Box<[u8]>>|
@@ -1085,14 +1050,6 @@ fn reviewed_bindings(
         Ok(crate::ReviewedLaneBindingV1 {
             lane_scoped_reviewed_input_digest: lane_digest,
             signing_input_closure_digest: format!("sha256:{}", hex::encode(hasher.finalize())),
-            interfaces: match lane {
-                crate::ApprovedLaneV1::RelayPublic => crate::CrossLaneInterfaceDigestsV1::default(),
-                crate::ApprovedLaneV1::RelayConsultation | crate::ApprovedLaneV1::Notary => {
-                    crate::CrossLaneInterfaceDigestsV1 {
-                        consultation_relay_notary: consultation_interface.clone(),
-                    }
-                }
-            },
         })
     };
     Ok(crate::ReviewedBuildUpdateV1 {
@@ -1101,16 +1058,15 @@ fn reviewed_bindings(
             &identities[0],
             &compiled.relay_private,
         )?),
-        relay_consultation: Some(binding(
-            crate::ApprovedLaneV1::RelayConsultation,
-            &identities[1],
-            &compiled.relay_consultation_private,
-        )?),
-        notary: Some(binding(
-            crate::ApprovedLaneV1::Notary,
-            &identities[2],
-            &compiled.notary_private,
-        )?),
+        relay_consultation: (!compiled.relay_consultation_private.is_empty())
+            .then(|| {
+                binding(
+                    crate::ApprovedLaneV1::RelayConsultation,
+                    &identities[1],
+                    &compiled.relay_consultation_private,
+                )
+            })
+            .transpose()?,
     })
 }
 
@@ -1136,7 +1092,7 @@ fn write_compiled_project(
     project: &str,
     environment: &str,
     artifact_inputs: &[ArtifactInputDigest],
-    signing_input_identities: &[registry_platform_config::ProductAcceptanceIdentityV1; 3],
+    signing_input_identities: &[registry_platform_config::ProductAcceptanceIdentityV1],
 ) -> Result<ProjectArtifactManifestRef> {
     let emitted_lanes = signing_input_identities
         .iter()
@@ -1164,17 +1120,14 @@ fn write_compiled_project_selected(
     project: &str,
     environment: &str,
     artifact_inputs: &[ArtifactInputDigest],
-    signing_input_identities: &[registry_platform_config::ProductAcceptanceIdentityV1; 3],
+    signing_input_identities: &[registry_platform_config::ProductAcceptanceIdentityV1],
     emitted_lanes: &[registry_platform_config::ProductAcceptanceLaneV1],
     retained_rotation_evidence: &BTreeMap<crate::ApprovedLaneV1, RetainedReviewedEvidence>,
     reviewed_build: Option<&ReviewedBuildRecordV1>,
 ) -> Result<ProjectArtifactManifestRef> {
-    if compiled.relay_private.is_empty()
-        || compiled.relay_consultation_private.is_empty()
-        || compiled.notary_private.is_empty()
-    {
+    if compiled.relay_private.is_empty() {
         bail!(
-            "governed build requires complete relay-public, relay-consultation, and notary signing inputs; continue authoring with project test and project check, then add the missing product binding before project build"
+            "governed build requires Relay signing inputs; continue authoring with project test and project check, then add deployment.relay before project build"
         );
     }
     let expected_parent = root.join(BUILD_ROOT);
@@ -1218,28 +1171,23 @@ fn write_compiled_project_selected(
         write_private_file(&relay_root.join(APPROVAL_REVIEW_PATH), &review_bytes)?;
         write_private_file(&relay_root.join(APPROVAL_STATE_PATH), &approval_state_bytes)?;
     }
-    if !compiled.notary_private.is_empty() {
-        let notary_root = temporary.join("private/notary");
-        create_dir_owner_only(&notary_root)?;
-        write_file_map(&notary_root, &compiled.notary_private)?;
-        write_private_file(&notary_root.join(APPROVAL_REVIEW_PATH), &review_bytes)?;
-        write_private_file(
-            &notary_root.join(APPROVAL_STATE_PATH),
-            &approval_state_bytes,
-        )?;
-    }
-    for (identity, files) in [
-        (&signing_input_identities[0], &compiled.relay_private),
-        (
-            &signing_input_identities[1],
-            &compiled.relay_consultation_private,
-        ),
-        (&signing_input_identities[2], &compiled.notary_private),
-    ] {
+    for (identity, files) in
+        signing_input_identities
+            .iter()
+            .filter_map(|identity| match identity.lane {
+                registry_platform_config::ProductAcceptanceLaneV1::RelayPublic => {
+                    Some((identity, &compiled.relay_private))
+                }
+                registry_platform_config::ProductAcceptanceLaneV1::RelayConsultation => {
+                    Some((identity, &compiled.relay_consultation_private))
+                }
+                _ => None,
+            })
+    {
         if !emitted_lanes.contains(&identity.lane) {
             continue;
         }
-        let approved_lane = crate::ApprovedLaneV1::from_acceptance_lane(identity.lane);
+        let approved_lane = crate::ApprovedLaneV1::try_from_acceptance_lane(identity.lane)?;
         let (lane_review_bytes, lane_approval_state_bytes) = retained_rotation_evidence
             .get(&approved_lane)
             .map(|evidence| (evidence.review.as_ref(), evidence.approval_state.as_ref()))
@@ -1298,7 +1246,7 @@ fn write_compiled_project_selected(
 
 fn governed_signing_input_identities(
     loaded: &LoadedRegistryProject,
-) -> Result<[registry_platform_config::ProductAcceptanceIdentityV1; 3]> {
+) -> Result<Vec<registry_platform_config::ProductAcceptanceIdentityV1>> {
     use registry_platform_config::{
         ProductAcceptanceIdentityV1, ProductAcceptanceLaneV1, ProductAcceptanceProductV1,
         ProductTrustDomainV1,
@@ -1321,15 +1269,6 @@ fn governed_signing_input_identities(
                 "governed build requires a public and consultation Relay binding; continue authoring with project test and project check, then add deployment.relay before project build"
             )
         })?;
-    let notary = environment
-        .deployment
-        .notary
-        .as_ref()
-        .ok_or_else(|| {
-            anyhow!(
-                "governed build requires a Notary binding; continue authoring with project test and project check, then add deployment.notary before project build"
-            )
-        })?;
     let project = loaded.project.registry.id.clone();
     let identity = |lane, product, instance| ProductAcceptanceIdentityV1 {
         trust_domain: ProductTrustDomainV1::Governed,
@@ -1340,23 +1279,18 @@ fn governed_signing_input_identities(
         stream: project.clone(),
         instance,
     };
-    let identities = [
-        identity(
-            ProductAcceptanceLaneV1::RelayPublic,
-            ProductAcceptanceProductV1::RegistryRelay,
-            relay.service.clone(),
-        ),
-        identity(
+    let mut identities = vec![identity(
+        ProductAcceptanceLaneV1::RelayPublic,
+        ProductAcceptanceProductV1::RegistryRelay,
+        relay.service.clone(),
+    )];
+    if project_requires_relay_consultation_baseline(loaded) {
+        identities.push(identity(
             ProductAcceptanceLaneV1::RelayConsultation,
             ProductAcceptanceProductV1::RegistryRelay,
             format!("{}-consultation", relay.service),
-        ),
-        identity(
-            ProductAcceptanceLaneV1::Notary,
-            ProductAcceptanceProductV1::RegistryNotary,
-            notary.service.clone(),
-        ),
-    ];
+        ));
+    }
     for identity in &identities {
         identity
             .validate()
@@ -1373,7 +1307,7 @@ fn product_acceptance_lane_name(
         registry_platform_config::ProductAcceptanceLaneV1::RelayConsultation => {
             "relay-consultation"
         }
-        registry_platform_config::ProductAcceptanceLaneV1::Notary => "notary",
+        _ => unreachable!("registryctl emits Relay lanes only"),
     }
 }
 
@@ -1460,8 +1394,6 @@ struct ApprovedBaselineSetPaths<'a> {
     relay_anchor: Option<&'a Path>,
     relay_consultation_against: Option<&'a Path>,
     relay_consultation_anchor: Option<&'a Path>,
-    notary_against: Option<&'a Path>,
-    notary_anchor: Option<&'a Path>,
 }
 
 impl<'a> ApprovedBaselineSetPaths<'a> {
@@ -1473,8 +1405,6 @@ impl<'a> ApprovedBaselineSetPaths<'a> {
             relay_anchor: None,
             relay_consultation_against: None,
             relay_consultation_anchor: None,
-            notary_against: None,
-            notary_anchor: None,
         }
     }
 
@@ -1491,8 +1421,6 @@ impl<'a> ApprovedBaselineSetPaths<'a> {
                 .and_then(|set| set.relay_consultation_against.as_deref()),
             relay_consultation_anchor: baselines
                 .and_then(|set| set.relay_consultation_anchor.as_deref()),
-            notary_against: baselines.and_then(|set| set.notary_against.as_deref()),
-            notary_anchor: baselines.and_then(|set| set.notary_anchor.as_deref()),
         }
     }
 }
@@ -1509,7 +1437,6 @@ impl VerifiedBaselineLane {
             Self::Relay | Self::RelayConsultation => {
                 registry_platform_config::ProductAcceptanceProductV1::RegistryRelay
             }
-            Self::Notary => registry_platform_config::ProductAcceptanceProductV1::RegistryNotary,
         }
     }
 
@@ -1519,7 +1446,6 @@ impl VerifiedBaselineLane {
             Self::RelayConsultation => {
                 registry_platform_config::ProductAcceptanceLaneV1::RelayConsultation
             }
-            Self::Notary => registry_platform_config::ProductAcceptanceLaneV1::Notary,
         }
     }
 
@@ -1527,38 +1453,29 @@ impl VerifiedBaselineLane {
         match self {
             Self::Relay => "relay",
             Self::RelayConsultation => "relay_consultation",
-            Self::Notary => "notary",
         }
     }
 }
 
 impl VerifiedBaselineSet {
     fn is_empty(&self) -> bool {
-        self.relay.is_none() && self.relay_consultation.is_none() && self.notary.is_none()
+        self.relay.is_none() && self.relay_consultation.is_none()
     }
 
     fn iter(&self) -> impl Iterator<Item = &VerifiedBaseline> {
-        [
-            self.relay.as_ref(),
-            self.relay_consultation.as_ref(),
-            self.notary.as_ref(),
-        ]
-        .into_iter()
-        .flatten()
+        [self.relay.as_ref(), self.relay_consultation.as_ref()]
+            .into_iter()
+            .flatten()
     }
 
     fn common(&self) -> Option<&VerifiedBaseline> {
-        self.relay
-            .as_ref()
-            .or(self.relay_consultation.as_ref())
-            .or(self.notary.as_ref())
+        self.relay.as_ref().or(self.relay_consultation.as_ref())
     }
 
     fn get(&self, lane: crate::ApprovedLaneV1) -> Option<&VerifiedBaseline> {
         match lane {
             crate::ApprovedLaneV1::RelayPublic => self.relay.as_ref(),
             crate::ApprovedLaneV1::RelayConsultation => self.relay_consultation.as_ref(),
-            crate::ApprovedLaneV1::Notary => self.notary.as_ref(),
         }
     }
 
@@ -1566,7 +1483,6 @@ impl VerifiedBaselineSet {
         json!({
             "relay": self.relay.as_ref().map(|baseline| &baseline.verified_manifest),
             "relay_consultation": self.relay_consultation.as_ref().map(|baseline| &baseline.verified_manifest),
-            "notary": self.notary.as_ref().map(|baseline| &baseline.verified_manifest),
         })
     }
 
@@ -1578,12 +1494,7 @@ impl VerifiedBaselineSet {
             VerifiedBaselineLane::RelayConsultation if self.relay_consultation.is_none() => {
                 self.relay_consultation = Some(baseline);
             }
-            VerifiedBaselineLane::Notary if self.notary.is_none() => {
-                self.notary = Some(baseline);
-            }
-            VerifiedBaselineLane::Relay
-            | VerifiedBaselineLane::RelayConsultation
-            | VerifiedBaselineLane::Notary => {
+            VerifiedBaselineLane::Relay | VerifiedBaselineLane::RelayConsultation => {
                 bail!("approved baseline set contains a duplicate product lane")
             }
         }
@@ -1619,16 +1530,8 @@ fn validate_approved_baseline_set_paths(paths: ApprovedBaselineSetPaths<'_>) ->
         "--relay-consultation-anchor",
         paths.relay_consultation_anchor,
     )?;
-    validate_named_baseline_pair(
-        "--notary-against",
-        paths.notary_against,
-        "--notary-anchor",
-        paths.notary_anchor,
-    )?;
     if paths.against.is_some()
-        && (paths.relay_against.is_some()
-            || paths.relay_consultation_against.is_some()
-            || paths.notary_against.is_some())
+        && (paths.relay_against.is_some() || paths.relay_consultation_against.is_some())
     {
         bail!("--against cannot be combined with product-specific baselines");
     }
@@ -1656,11 +1559,6 @@ fn load_verified_approved_baseline_set(
                 paths.relay_consultation_anchor,
                 VerifiedBaselineLane::RelayConsultation,
             ),
-            (
-                paths.notary_against,
-                paths.notary_anchor,
-                VerifiedBaselineLane::Notary,
-            ),
         ] {
             if let Some(baseline) = load_verified_baseline(against, anchor, loaded, Some(lane))? {
                 baselines.insert(baseline)?;
@@ -1679,7 +1577,6 @@ fn load_verified_approved_baseline_set(
             .ok_or_else(|| anyhow!("approved baseline comparison requires an environment"))?;
         let products = project_promotion_products(environment);
         let requires_relay = products.contains(&PromotionProjectedProduct::Relay);
-        let requires_notary = products.contains(&PromotionProjectedProduct::Notary);
         let requires_relay_consultation = project_requires_relay_consultation_baseline(loaded)
             || baselines.common().is_some_and(|baseline| {
                 baseline
@@ -1689,7 +1586,6 @@ fn load_verified_approved_baseline_set(
             });
         if baselines.relay.is_some() != requires_relay
             || baselines.relay_consultation.is_some() != requires_relay_consultation
-            || baselines.notary.is_some() != requires_notary
         {
             bail!("approved baseline set is incomplete for the selected product topology");
         }
@@ -1728,13 +1624,12 @@ fn load_verified_baseline(
         registry_platform_config::ProductAcceptanceLaneV1::RelayConsultation => {
             VerifiedBaselineLane::RelayConsultation
         }
-        registry_platform_config::ProductAcceptanceLaneV1::Notary => VerifiedBaselineLane::Notary,
+        _ => bail!("verified baseline uses a retired non-Relay lane"),
     });
     let expected_identities = governed_signing_input_identities(loaded)?;
     let expected_identity = match lane {
         VerifiedBaselineLane::Relay => &expected_identities[0],
         VerifiedBaselineLane::RelayConsultation => &expected_identities[1],
-        VerifiedBaselineLane::Notary => &expected_identities[2],
     };
     if identity != expected_identity {
         bail!(
@@ -1802,24 +1697,6 @@ fn load_verified_baseline(
             "verified baseline review and approval state disagree on the Relay consultation input"
         );
     }
-    let disclosure_profiles: DisclosureReviewProfiles = serde_json::from_value(
-        review
-            .get("disclosure_profiles")
-            .cloned()
-            .ok_or_else(|| anyhow!("baseline review record lacks disclosure_profiles"))?,
-    )
-    .context("baseline review disclosure_profiles are invalid")?;
-    let disclosure_digest = digest_json(
-        &serde_json::to_value(&disclosure_profiles)
-            .context("failed to canonicalize baseline disclosure_profiles")?,
-    )?;
-    if approval_state
-        .get("disclosure_digest")
-        .and_then(Value::as_str)
-        != Some(disclosure_digest.as_str())
-    {
-        bail!("verified baseline approval state does not bind the review disclosure profiles");
-    }
     validate_verified_product_closure(&approval_state, &verified.manifest, lane)?;
     let approval_state_digest = sha256_uri(&approval_state_bytes);
     let review_digest = sha256_uri(&review_bytes);
@@ -1898,7 +1775,6 @@ fn validate_signed_review_record(value: &Value) -> Result<()> {
             "registry",
             "compiler_version",
             "baseline",
-            "disclosure_profiles",
             "semantic_changes",
             "environment",
             "entity_materializations",
@@ -1917,11 +1793,6 @@ fn validate_signed_review_record(value: &Value) -> Result<()> {
     ) {
         bail!("baseline review record baseline status is invalid");
     }
-    let profiles_value = review
-        .get("disclosure_profiles")
-        .ok_or_else(|| anyhow!("baseline review record lacks disclosure_profiles"))?;
-    let _: DisclosureReviewProfiles = serde_json::from_value(profiles_value.clone())
-        .context("baseline review disclosure_profiles are invalid")?;
     validate_semantic_changes(
         review
             .get("semantic_changes")
@@ -1975,7 +1846,6 @@ fn validate_signed_approval_state(value: &Value) -> Result<()> {
             "report_digest",
             "authored_input_digest",
             "semantic_digests",
-            "disclosure_digest",
             "promotion_projection",
             "generated_closure_digests",
             "baseline",
@@ -1988,31 +1858,17 @@ fn validate_signed_approval_state(value: &Value) -> Result<()> {
             bail!("baseline approval state field {field} must be a string");
         }
     }
-    for field in [
-        "report_digest",
-        "authored_input_digest",
-        "disclosure_digest",
-    ] {
+    for field in ["report_digest", "authored_input_digest"] {
         validate_review_sha256(state.get(field), field, false)?;
     }
     let semantic = exact_review_object(
         state
             .get("semantic_digests")
             .ok_or_else(|| anyhow!("baseline approval state lacks semantic_digests"))?,
-        &[
-            "claim",
-            "integration",
-            "service_policy",
-            "operator_security",
-        ],
+        &["integration", "service_policy", "operator_security"],
         "baseline approval semantic_digests",
     )?;
-    for field in [
-        "claim",
-        "integration",
-        "service_policy",
-        "operator_security",
-    ] {
+    for field in ["integration", "service_policy", "operator_security"] {
         validate_review_sha256(semantic.get(field), field, false)?;
     }
     let promotion_projection: ProjectPromotionProjectionV1 = serde_json::from_value(
@@ -2029,14 +1885,12 @@ fn validate_signed_approval_state(value: &Value) -> Result<()> {
         state
             .get("generated_closure_digests")
             .ok_or_else(|| anyhow!("baseline approval state lacks generated_closure_digests"))?,
-        &["reviewable", "relay", "relay_consultation", "notary"],
+        &["reviewable", "relay", "relay_consultation"],
         "baseline approval generated_closure_digests",
     )?;
     validate_review_sha256(closure.get("reviewable"), "reviewable", false)?;
-    for field in ["relay", "notary"] {
-        if !closure.get(field).is_some_and(Value::is_null) {
-            validate_review_sha256(closure.get(field), field, false)?;
-        }
+    if !closure.get("relay").is_some_and(Value::is_null) {
+        validate_review_sha256(closure.get("relay"), "relay", false)?;
     }
     if !closure
         .get("relay_consultation")
@@ -2055,16 +1909,11 @@ fn validate_signed_approval_state(value: &Value) -> Result<()> {
     {
         bail!("baseline approval Relay consultation closure requires the Relay product closure");
     }
-    for (field, product) in [
-        ("relay", PromotionProjectedProduct::Relay),
-        ("notary", PromotionProjectedProduct::Notary),
-    ] {
-        let has_closure = closure.get(field).is_some_and(Value::is_string);
-        if has_closure != promotion_products.contains(&product) {
-            bail!(
-                "baseline approval promotion_projection product inventory disagrees with generated_closure_digests"
-            );
-        }
+    let has_relay_closure = closure.get("relay").is_some_and(Value::is_string);
+    if has_relay_closure != promotion_products.contains(&PromotionProjectedProduct::Relay) {
+        bail!(
+            "baseline approval promotion_projection product inventory disagrees with generated_closure_digests"
+        );
     }
     validate_approval_baseline(
         state.get("baseline"),
@@ -2159,12 +2008,7 @@ fn validate_semantic_changes(value: &Value) -> Result<()> {
             .ok_or_else(|| anyhow!("baseline semantic change dimension must be a string"))?;
         if !matches!(
             dimension,
-            "compiler"
-                | "claim"
-                | "integration"
-                | "service_policy"
-                | "operator_security"
-                | "disclosure"
+            "compiler" | "integration" | "service_policy" | "operator_security"
         ) || !dimensions.insert(dimension)
         {
             bail!("baseline semantic_changes contain an unknown or duplicate dimension");
@@ -2194,7 +2038,7 @@ fn validate_approval_baseline(
         baseline
             .get("verified_manifests")
             .ok_or_else(|| anyhow!("baseline approval state lacks verified_manifests"))?,
-        &["relay", "relay_consultation", "notary"],
+        &["relay", "relay_consultation"],
         "baseline approval verified_manifests",
     )?;
     let mut present = 0_usize;
@@ -2213,13 +2057,6 @@ fn validate_approval_baseline(
             PromotionProjectedProduct::Relay,
             consultation_closure,
         ),
-        (
-            "notary",
-            registry_platform_config::ProductAcceptanceProductV1::RegistryNotary,
-            registry_platform_config::ProductAcceptanceLaneV1::Notary,
-            PromotionProjectedProduct::Notary,
-            promotion_products.contains(&PromotionProjectedProduct::Notary),
-        ),
     ] {
         let Some(value) = manifests.get(field) else {
             bail!("baseline approval state lacks a product manifest identity");
@@ -2256,17 +2093,8 @@ fn validate_approval_baseline(
 fn semantic_change_records(
     loaded: &LoadedRegistryProject,
     baseline: Option<&Value>,
-    disclosure_digest: &str,
 ) -> Vec<SemanticChange> {
     let mut changes = [
-        (
-            "claim",
-            loaded.semantic_digests.claim.as_str(),
-            baseline
-                .and_then(|review| review.get("semantic_digests"))
-                .and_then(|digests| digests.get("claim"))
-                .and_then(Value::as_str),
-        ),
         (
             "integration",
             loaded.semantic_digests.integration.as_str(),
@@ -2291,13 +2119,6 @@ fn semantic_change_records(
                 .and_then(|digests| digests.get("operator_security"))
                 .and_then(Value::as_str),
         ),
-        (
-            "disclosure",
-            disclosure_digest,
-            baseline
-                .and_then(|review| review.get("disclosure_digest"))
-                .and_then(Value::as_str),
-        ),
     ]
     .into_iter()
     .filter(|(_, current, previous)| *previous != Some(*current))
@@ -2515,16 +2336,6 @@ fn lower_authored_fixture(
     body_cache: &mut BTreeMap<PathBuf, Value>,
     max_body_bytes: u64,
 ) -> Result<FixtureDocument> {
-    if let Some(request) = authored.request.as_ref() {
-        if authored.classification != AuthoredFixtureClassification::Synthetic {
-            bail!("fixture governed requests require classification: synthetic");
-        }
-        let request = serde_json::to_value(request)
-            .context("failed to inspect the governed synthetic fixture request")?;
-        if contains_sensitive_request_key(&request) || contains_fixture_secret_reference(&request) {
-            bail!("fixture governed request contains a forbidden credential-like field");
-        }
-    }
     let interactions = authored
         .interactions
         .into_iter()
@@ -2576,7 +2387,6 @@ fn lower_authored_fixture(
     Ok(FixtureDocument {
         name: authored.name,
         classification: authored.classification,
-        request: authored.request,
         input: authored.input,
         variables: authored.variables,
         interactions,
@@ -2584,21 +2394,6 @@ fn lower_authored_fixture(
     })
 }
 
-fn contains_fixture_secret_reference(value: &Value) -> bool {
-    match value {
-        Value::String(value) => {
-            let lower = value.to_ascii_lowercase();
-            value.starts_with("${")
-                || lower.starts_with("secret://")
-                || lower.starts_with("env://")
-                || lower.starts_with("vault://")
-        }
-        Value::Array(values) => values.iter().any(contains_fixture_secret_reference),
-        Value::Object(object) => object.values().any(contains_fixture_secret_reference),
-        Value::Null | Value::Bool(_) | Value::Number(_) => false,
-    }
-}
-
 fn resolve_fixture_body(
     root: &Path,
     fixture_directory: &Path,
@@ -2789,22 +2584,6 @@ fn validate_request_mapping(mapping: &str) -> Result<()> {
     Ok(())
 }
 
-fn validate_disclosure(disclosure: &DisclosureDeclaration) -> Result<()> {
-    match disclosure {
-        DisclosureDeclaration::Mode(_) => Ok(()),
-        DisclosureDeclaration::Policy { default, allowed } => {
-            if allowed.is_empty() || !allowed.contains(default) {
-                bail!("disclosure policy must allow its default mode");
-            }
-            let unique = allowed.iter().copied().collect::<BTreeSet<_>>();
-            if unique.len() != allowed.len() {
-                bail!("disclosure allowed modes contain duplicates");
-            }
-            Ok(())
-        }
-    }
-}
-
 fn validate_secret_reference(reference: &SecretReference) -> Result<()> {
     let value = reference.secret.as_str();
     let mut bytes = value.bytes();
@@ -2857,27 +2636,6 @@ fn validate_https_or_local_loopback_origin(
     Ok(())
 }
 
-fn validate_internal_https_or_loopback_origin(value: &str, field: &str) -> Result<()> {
-    let origin = url::Url::parse(value).with_context(|| format!("{field} is not a URL"))?;
-    let secure = origin.scheme() == "https";
-    let local_loopback = origin.scheme() == "http" && url_host_is_ip_loopback(&origin);
-    let private_service = origin.scheme() == "http"
-        && matches!(origin.host(), Some(url::Host::Domain(host)) if host != "localhost" && !host.ends_with(".localhost"));
-    if (!secure && !local_loopback && !private_service)
-        || origin.host().is_none()
-        || !origin.username().is_empty()
-        || origin.password().is_some()
-        || origin.path() != "/"
-        || origin.query().is_some()
-        || origin.fragment().is_some()
-    {
-        bail!(
-            "{field} must be an exact HTTPS origin, HTTP private-service hostname origin, or HTTP IP-loopback origin"
-        );
-    }
-    Ok(())
-}
-
 fn validate_https_or_local_loopback_resource(
     value: &str,
     field: &str,
@@ -2944,29 +2702,6 @@ fn validate_absolute_runtime_path(path: &Path, field: &str) -> Result<()> {
     Ok(())
 }
 
-fn validate_full_date(value: &str) -> Result<()> {
-    if value.len() != 10
-        || value.as_bytes()[4] != b'-'
-        || value.as_bytes()[7] != b'-'
-        || !value
-            .bytes()
-            .enumerate()
-            .all(|(index, byte)| matches!(index, 4 | 7) || byte.is_ascii_digit())
-    {
-        bail!("date must use RFC 3339 full-date syntax");
-    }
-    let year = value[0..4].parse::<i32>()?;
-    let month = value[5..7].parse::<u8>()?;
-    let day = value[8..10].parse::<u8>()?;
-    time::Date::from_calendar_date(
-        year,
-        time::Month::try_from(month).map_err(|_| anyhow!("date month is invalid"))?,
-        day,
-    )
-    .context("date is invalid")?;
-    Ok(())
-}
-
 fn canonical_json_line(value: &Value) -> Result<Vec<u8>> {
     let mut bytes = canonicalize_json(value).context("failed to canonicalize generated JSON")?;
     bytes.push(b'\n');
diff --git a/crates/registryctl/src/project_authoring/preflight.rs b/crates/registryctl/src/project_authoring/preflight.rs
index 04289db77..89cf5f1b3 100644
--- a/crates/registryctl/src/project_authoring/preflight.rs
+++ b/crates/registryctl/src/project_authoring/preflight.rs
@@ -87,7 +87,6 @@ const REQUIRED_STATIC_CAPABILITIES: [PreflightStaticCapability; 4] = [
 #[serde(rename_all = "snake_case")]
 pub enum PreflightProduct {
     RegistryRelay,
-    RegistryNotary,
 }
 
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
@@ -109,11 +108,6 @@ pub enum PreflightSecretConsumer {
     SourceOauthMtlsPrivateKey,
     SourceJwksMtlsPrivateKey,
     EntityPostgresConnection,
-    IssuanceSigningKey,
-    CallerApiKeyFingerprint,
-    Oid4vciClientSigningKey,
-    Oid4vciAccessTokenSigningKey,
-    Oid4vciSensitiveStateKey,
 }
 
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
@@ -129,8 +123,6 @@ pub enum PreflightRuntimeFileKind {
     EntityXlsx,
     EntityParquet,
     RelayStateRootCertificate,
-    NotaryStateRootCertificate,
-    NotaryToRelayToken,
 }
 
 impl PreflightRuntimeFileKind {
@@ -138,7 +130,7 @@ impl PreflightRuntimeFileKind {
         match self {
             // Entity source files can contain country-held person data, so they retain the same
             // owner-only posture as private credential material.
-            Self::EntityCsv | Self::EntityXlsx | Self::EntityParquet | Self::NotaryToRelayToken => {
+            Self::EntityCsv | Self::EntityXlsx | Self::EntityParquet => {
                 RuntimeFilePosture::PrivateMaterial
             }
             Self::SourceCa
@@ -147,8 +139,7 @@ impl PreflightRuntimeFileKind {
             | Self::SourceOauthMtlsCertificate
             | Self::SourceJwksCa
             | Self::SourceJwksMtlsCertificate
-            | Self::RelayStateRootCertificate
-            | Self::NotaryStateRootCertificate => RuntimeFilePosture::PublicTrustMaterial,
+            | Self::RelayStateRootCertificate => RuntimeFilePosture::PublicTrustMaterial,
         }
     }
 
@@ -163,17 +154,13 @@ impl PreflightRuntimeFileKind {
             | Self::SourceOauthMtlsCertificate
             | Self::SourceJwksCa
             | Self::SourceJwksMtlsCertificate
-            | Self::RelayStateRootCertificate
-            | Self::NotaryStateRootCertificate
-            | Self::NotaryToRelayToken => MAX_RUNTIME_FILE_BYTES,
+            | Self::RelayStateRootCertificate => MAX_RUNTIME_FILE_BYTES,
         }
     }
 
     const fn generation(self) -> PreflightGenerationState {
         match self {
-            Self::RelayStateRootCertificate
-            | Self::NotaryStateRootCertificate
-            | Self::NotaryToRelayToken => PreflightGenerationState::NotDeclared,
+            Self::RelayStateRootCertificate => PreflightGenerationState::NotDeclared,
             Self::SourceCa
             | Self::SourceMtlsCertificate
             | Self::SourceOauthCa
diff --git a/crates/registryctl/src/project_authoring/project.rs b/crates/registryctl/src/project_authoring/project.rs
index 3f3082b5e..3cacd8d8e 100644
--- a/crates/registryctl/src/project_authoring/project.rs
+++ b/crates/registryctl/src/project_authoring/project.rs
@@ -705,35 +705,6 @@ fn semantic_digests(
     entities: &BTreeMap<String, LoadedEntityDefinition>,
     environment: Option<&EnvironmentDocument>,
 ) -> Result<SemanticDigests> {
-    let claims = project
-        .services
-        .iter()
-        .map(|(id, service)| {
-            let service_claims = service
-                .claims
-                .iter()
-                .map(|(claim_id, claim)| {
-                    Ok((
-                        claim_id,
-                        json!({
-                            "evidence": inferred_claim_evidence(service, claim)?,
-                            "output": claim.output,
-                            "cel": claim.cel,
-                            "value": claim.value,
-                        }),
-                    ))
-                })
-                .collect::<Result<BTreeMap<_, _>>>()?;
-            Ok((
-                id,
-                json!({
-                    "subject_type": service.effective_subject_type(),
-                    "variables": service.variables,
-                    "claims": service_claims,
-                }),
-            ))
-        })
-        .collect::<Result<BTreeMap<_, _>>>()?;
     let policy = project
         .services
         .iter()
@@ -744,8 +715,7 @@ fn semantic_digests(
                     "purpose": service.purpose,
                     "legal_basis": service.legal_basis,
                     "consent": service.consent,
-                    "access": service.access,
-                    "credential_profiles": service.credential_profiles,
+                    "variables": service.variables,
                 }),
             )
         })
@@ -825,13 +795,6 @@ fn semantic_digests(
         .iter()
         .map(|(service, declaration)| (service, &declaration.consultations))
         .collect::<BTreeMap<_, _>>();
-    let callers = environment.map(|environment| {
-        environment
-            .callers
-            .iter()
-            .map(|(id, caller)| (id, &caller.scopes))
-            .collect::<BTreeMap<_, _>>()
-    });
     let operator = environment.map(|environment| {
         let integrations = environment
             .integrations
@@ -845,41 +808,24 @@ fn semantic_digests(
                 )
             })
             .collect::<BTreeMap<_, _>>();
-        let caller_credentials = environment
-            .callers
-            .iter()
-            .map(|(id, caller)| (id, &caller.api_key_fingerprint))
-            .collect::<BTreeMap<_, _>>();
         let mut operator = json!({
             "integrations": integrations,
             "entities": environment.entities,
-            "caller_credentials": caller_credentials,
-            "issuance": environment.issuance,
             "relay": environment.relay,
-            "notary_relay": environment.notary_relay,
-            "notary_state": environment.notary_state,
-            "oid4vci_registrar_clients": environment.oid4vci.as_ref()
-                .map(|binding| &binding.registrar_clients),
             "deployment": environment.deployment,
         });
         if let Some(relay_state) = &environment.relay_state {
             operator["relay_state"] = json!(relay_state);
         }
-        if let Some(notary_cel) = &environment.notary_cel {
-            operator["notary_cel"] = json!(notary_cel);
-        }
         operator
     });
     Ok(SemanticDigests {
-        claim: digest_json(&json!({ "services": claims }))?,
         integration: digest_json(&json!({
             "integrations": integration,
             "service_consultations": service_consultations,
             "entities": entity_model,
         }))?,
-        service_policy: digest_json(
-            &json!({ "services": policy, "records": records_policy, "callers": callers }),
-        )?,
+        service_policy: digest_json(&json!({ "services": policy, "records": records_policy }))?,
         operator_security: digest_json(&json!({ "operator": operator }))?,
     })
 }
@@ -889,7 +835,7 @@ fn semantic_digests(
 // A schema or knowledge change must therefore be reviewed for promotion
 // semantics before a new projection can be emitted.
 const PROMOTION_FIELD_KNOWLEDGE_REVISION: &str =
-    "sha256:537dde0f120d9874e74cae1d899d7e4d86ad013a5d1b918021a73e1045f951b1";
+    "sha256:481a290b37b5c3db64dd5947a1e07e7a1293f3beb0c63dc0e1486ccca6f96620";
 
 fn project_promotion_projection(
     loaded: &LoadedRegistryProject,
@@ -958,11 +904,6 @@ fn project_promotion_projection(
     let trust_state = json!({
         "integrations": integration_trust,
         "relay": environment.relay,
-        "oid4vci_authorization_server": environment.oid4vci.as_ref().map(|binding| json!({
-            "issuer": binding.authorization_server.issuer,
-        })),
-        "oid4vci_registrar_clients": environment.oid4vci.as_ref()
-            .map(|binding| &binding.registrar_clients),
     });
     let trust_members = environment
         .integrations
@@ -996,27 +937,6 @@ fn project_promotion_projection(
                 .flat_map(|relay| relay.allowed_clients.iter())
                 .map(|client| json!(["relay_client", client])),
         )
-        .chain(
-            environment
-                .oid4vci
-                .iter()
-                .flat_map(|binding| binding.registrar_clients.iter())
-                .map(|client| json!(["oid4vci_registrar_client", client])),
-        )
-        .collect::<Vec<_>>();
-
-    let caller_state = environment.callers.iter().collect::<BTreeMap<_, _>>();
-    let caller_members = environment
-        .callers
-        .iter()
-        .flat_map(|(id, caller)| {
-            std::iter::once(json!(["caller", id])).chain(
-                caller
-                    .scopes
-                    .iter()
-                    .map(move |scope| json!(["caller_scope", id, scope])),
-            )
-        })
         .collect::<Vec<_>>();
 
     let operational_integrations = environment
@@ -1037,16 +957,8 @@ fn project_promotion_projection(
         "integrations": operational_integrations,
         "entities": environment.entities,
         "relay_state": environment.relay_state,
-        "notary_state": environment.notary_state,
-        "notary_cel": environment.notary_cel,
-        "issuance": environment.issuance,
-        "notary_relay": environment.notary_relay,
-        "oid4vci": environment.oid4vci,
         "deployment_profile": environment.deployment.profile,
         "deployment_relay_service": environment.deployment.relay.as_ref().map(|binding| &binding.service),
-        "deployment_notary_service": environment.deployment.notary.as_ref().map(|binding| &binding.service),
-        "oid4vci_subject": environment.oid4vci.as_ref().map(|binding| &binding.subject),
-        "oid4vci_tx_code": environment.oid4vci.as_ref().map(|binding| &binding.tx_code),
     });
 
     let purpose_state = loaded
@@ -1065,7 +977,6 @@ fn project_promotion_projection(
                 json!({
                     "legal_basis": service.legal_basis,
                     "consent": service.consent,
-                    "access": service.access,
                     "variables": service.variables,
                     "records": {
                         "entity": service.entity,
@@ -1086,77 +997,8 @@ fn project_promotion_projection(
         .project
         .services
         .iter()
-        .flat_map(|(id, service)| {
-            let consent = (service.consent == ConsentDeclaration::NotRequired)
-                .then(|| json!(["consent_not_required", id]));
-            service
-                .access
-                .scopes
-                .iter()
-                .map(|scope| json!(["service_scope", id, scope]))
-                .chain(consent)
-                .collect::<Vec<_>>()
-        })
-        .collect::<Vec<_>>();
-
-    let claim_state = loaded
-        .project
-        .services
-        .iter()
-        .map(|(service_id, service)| {
-            let claims = service
-                .claims
-                .iter()
-                .map(|(claim_id, claim)| {
-                    (
-                        claim_id,
-                        json!({
-                            "output": claim.output,
-                            "cel": claim.cel,
-                            "value": claim.value,
-                        }),
-                    )
-                })
-                .collect::<BTreeMap<_, _>>();
-            (
-                service_id,
-                json!({
-                    "claims": claims,
-                    "credential_profiles": service.credential_profiles,
-                }),
-            )
-        })
-        .collect::<BTreeMap<_, _>>();
-    let claim_members = loaded
-        .project
-        .services
-        .iter()
-        .flat_map(|(service_id, service)| {
-            service
-                .claims
-                .keys()
-                .map(|claim_id| json!(["claim", service_id, claim_id]))
-                .chain(
-                    service
-                        .credential_profiles
-                        .keys()
-                        .map(|profile| json!(["credential_profile", service_id, profile])),
-                )
-                .collect::<Vec<_>>()
-        })
-        .collect::<Vec<_>>();
-
-    let disclosure_state = disclosure_review_profiles(&loaded.project);
-    let disclosure_members = disclosure_state
-        .iter()
-        .flat_map(|(service_id, claims)| {
-            claims.iter().flat_map(move |(claim_id, profile)| {
-                profile
-                    .allowed
-                    .iter()
-                    .map(move |mode| json!(["disclosure", service_id, claim_id, mode]))
-            })
-        })
+        .filter(|(_, service)| service.consent == ConsentDeclaration::NotRequired)
+        .map(|(id, _)| json!(["consent_not_required", id]))
         .collect::<Vec<_>>();
 
     let product_state = json!({ "products": products });
@@ -1304,12 +1146,6 @@ fn project_promotion_projection(
             trust_state,
             trust_members,
         ),
-        (
-            PromotionChangeKind::Caller,
-            PromotionFieldClassification::Sensitive,
-            json!(caller_state),
-            caller_members,
-        ),
         (
             PromotionChangeKind::Operational,
             PromotionFieldClassification::Internal,
@@ -1328,18 +1164,6 @@ fn project_promotion_projection(
             json!(service_policy_state),
             service_policy_members,
         ),
-        (
-            PromotionChangeKind::Claim,
-            PromotionFieldClassification::Internal,
-            json!(claim_state),
-            claim_members,
-        ),
-        (
-            PromotionChangeKind::Disclosure,
-            PromotionFieldClassification::Internal,
-            json!(disclosure_state),
-            disclosure_members,
-        ),
         (
             PromotionChangeKind::ProductEnablement,
             PromotionFieldClassification::Structural,
@@ -1420,9 +1244,6 @@ fn project_promotion_products(environment: &EnvironmentDocument) -> Vec<Promotio
     if environment.deployment.relay.is_some() {
         products.push(PromotionProjectedProduct::Relay);
     }
-    if environment.deployment.notary.is_some() {
-        products.push(PromotionProjectedProduct::Notary);
-    }
     products
 }
 
@@ -1573,9 +1394,7 @@ fn promotion_kind_for_field_path(path: &knowledge::FieldPath) -> Option<Promotio
                 || pointer.contains("/$defs/mtls")
                 || pointer.contains("/$defs/privateCidrs")
                 || pointer.contains("/$defs/origin");
-            if pointer.contains("/callers") {
-                Some(Kind::Caller)
-            } else if integration_field
+            if integration_field
                 && (pointer.contains("/$defs/credential")
                     || pointer.contains("credential")
                     || pointer.contains("private_key"))
@@ -1593,13 +1412,10 @@ fn promotion_kind_for_field_path(path: &knowledge::FieldPath) -> Option<Promotio
                 || pointer.contains("/mtls")
                 || pointer.contains("audience")
                 || pointer.contains("allowed_clients")
-                || pointer.contains("registrar_clients")
                 || pointer.contains("/issuer")
             {
                 Some(Kind::Trust)
-            } else if pointer.ends_with("/properties/relay")
-                || pointer.ends_with("/properties/notary")
-            {
+            } else if pointer.ends_with("/properties/relay") {
                 Some(Kind::ProductEnablement)
             } else if integration_field {
                 Some(Kind::CapabilityEnablement)
@@ -1610,10 +1426,6 @@ fn promotion_kind_for_field_path(path: &knowledge::FieldPath) -> Option<Promotio
         SchemaKind::Project => {
             if pointer.contains("/purpose") {
                 Some(Kind::Purpose)
-            } else if pointer.contains("/disclosure") {
-                Some(Kind::Disclosure)
-            } else if pointer.contains("/claims") || pointer.contains("/credential_profiles") {
-                Some(Kind::Claim)
             } else if pointer.contains("/integrations")
                 || pointer.contains("/entities")
                 || pointer.contains("/consultations")
@@ -1674,24 +1486,19 @@ fn validate_project_shape(project: &RegistryProject) -> Result<()> {
             bail!("entity {alias} must reference entities/{alias}.yaml");
         }
     }
-    let mut project_claim_ids = BTreeSet::new();
     let mut published_entities = BTreeSet::new();
     let mut project_attribute_release_profiles = BTreeSet::new();
     for (service_id, service) in &project.services {
         validate_stable_id(service_id, "service id")?;
         match service.kind {
             ServiceKind::RecordsApi => {
-                if service.subject_type.is_some()
-                    || service.version != 0
+                if service.version != 0
                     || !service.purpose.is_empty()
                     || !service.legal_basis.is_empty()
-                    || !service.access.scopes.is_empty()
                     || !service.variables.is_empty()
                     || !service.consultations.is_empty()
-                    || !service.claims.is_empty()
-                    || !service.credential_profiles.is_empty()
                 {
-                    bail!("records_api service cannot declare evidence-service fields");
+                    bail!("records_api service cannot declare consultation_api fields");
                 }
                 let entity = service
                     .entity
@@ -1723,7 +1530,7 @@ fn validate_project_shape(project: &RegistryProject) -> Result<()> {
                 }
                 continue;
             }
-            ServiceKind::Evidence => {
+            ServiceKind::ConsultationApi => {
                 if service.entity.is_some()
                     || service.title.is_some()
                     || service.description.is_some()
@@ -1734,7 +1541,7 @@ fn validate_project_shape(project: &RegistryProject) -> Result<()> {
                     || !service.conforms_to.is_empty()
                     || service.api.is_some()
                 {
-                    bail!("evidence services cannot declare records_api fields");
+                    bail!("consultation_api services cannot declare records_api fields");
                 }
             }
         }
@@ -1746,12 +1553,11 @@ fn validate_project_shape(project: &RegistryProject) -> Result<()> {
         if service.consent == ConsentDeclaration::Required {
             bail!("consent: required is unavailable until sealed consent verification lands");
         }
-        validate_scopes(&service.access.scopes)?;
         if service.consultations.len() > 16 {
             bail!("service consultations must contain no more than 16 entries");
         }
-        if service.claims.is_empty() || service.claims.len() > MAX_CLAIMS {
-            bail!("evidence service claims must contain between one and 64 entries");
+        if service.consultations.is_empty() {
+            bail!("consultation_api service must declare at least one consultation");
         }
         for (name, consultation) in &service.consultations {
             validate_stable_id(name, "consultation name")?;
@@ -1775,85 +1581,10 @@ fn validate_project_shape(project: &RegistryProject) -> Result<()> {
                 bail!("v1 request variables must be exact declared full-date mappings");
             }
         }
-        for (claim_id, claim) in &service.claims {
-            validate_stable_id(claim_id, "claim id")?;
-            if !project_claim_ids.insert(claim_id) {
-                bail!("Notary claim ids must be unique across project services");
-            }
-            if claim.output.is_some() == claim.cel.is_some() {
-                bail!("each claim must declare exactly one of output or cel");
-            }
-            match inferred_claim_evidence(service, claim)? {
-                ClaimEvidence::RegistryBacked => {
-                    if service.consultations.is_empty() {
-                        bail!("registry-backed claims require a Relay consultation");
-                    }
-                }
-            }
-            if let Some(value) = &claim.value {
-                if value.value_type == OutputType::String {
-                    let Some(max_bytes) = value.max_bytes else {
-                        bail!("string claim value contracts require max_bytes");
-                    };
-                    if !(1..=registry_notary_core::MAX_CLAIM_VALUE_STRING_BYTES_V1)
-                        .contains(&max_bytes)
-                    {
-                        bail!(
-                            "string claim value max_bytes must be between 1 and {}",
-                            registry_notary_core::MAX_CLAIM_VALUE_STRING_BYTES_V1
-                        );
-                    }
-                }
-                if value.value_type != OutputType::String && value.max_bytes.is_some() {
-                    bail!("only string claim value contracts may declare max_bytes");
-                }
-            }
-            validate_disclosure(&claim.disclosure)?;
-        }
-        for (credential_id, credential) in &service.credential_profiles {
-            if credential.claims.is_empty() {
-                bail!("credential claim allow-list must not be empty");
-            }
-            for claim_id in &credential.claims {
-                let claim = service
-                    .claims
-                    .get(claim_id)
-                    .ok_or_else(|| anyhow!("credential references an unknown claim"))?;
-                inferred_claim_evidence(service, claim).with_context(|| {
-                    format!(
-                        "credential profile {service_id}.{credential_id} requires claim {claim_id} to reference a declared Relay consultation"
-                    )
-                })?;
-            }
-        }
     }
     Ok(())
 }
 
-fn inferred_claim_evidence(
-    service: &ServiceDeclaration,
-    claim: &ClaimDeclaration,
-) -> Result<ClaimEvidence> {
-    if claim.output.is_some() {
-        return Ok(ClaimEvidence::RegistryBacked);
-    }
-    let roots = claim
-        .cel
-        .as_deref()
-        .map(cel_member_roots)
-        .transpose()?
-        .unwrap_or_default();
-    if service
-        .consultations
-        .keys()
-        .any(|name| roots.contains(name.as_str()))
-    {
-        Ok(ClaimEvidence::RegistryBacked)
-    } else {
-        bail!("every claim must derive from one declared Relay consultation")
-    }
-}
-
 fn validate_entity_definition(entity: &EntityDefinition) -> Result<()> {
     if entity.version != 1 || entity.revision == 0 {
         bail!("entity version must be 1 and revision must be positive");
@@ -2498,16 +2229,16 @@ fn validate_service_integration_links(
     for (service_id, service) in project
         .services
         .iter()
-        .filter(|(_, service)| service.kind == ServiceKind::Evidence)
+        .filter(|(_, service)| service.kind == ServiceKind::ConsultationApi)
     {
         for (consultation_name, consultation) in &service.consultations {
             let integration = &integrations[&consultation.integration].document;
             if integration.outputs.len()
-                > registry_notary_core::MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1
+                > MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1
             {
                 bail!(
                     "service {service_id} consultation {consultation_name} integration outputs must contain no more than {} entries",
-                    registry_notary_core::MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1
+                    MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1
                 );
             }
             if consultation.input.keys().ne(integration.input.keys()) {
@@ -2519,36 +2250,6 @@ fn validate_service_integration_links(
                 bail!("consultation target mappings must be injective");
             }
         }
-        for (claim_id, claim) in &service.claims {
-            let Some(expression) = claim.cel.as_deref() else {
-                continue;
-            };
-            if inferred_claim_evidence(service, claim)? != ClaimEvidence::RegistryBacked {
-                continue;
-            }
-            let references = cel_references(expression)
-                .with_context(|| format!("invalid CEL for service {service_id} claim {claim_id}"))?;
-            if references.uses_index {
-                bail!(
-                    "service {service_id} claim {claim_id} registry-backed CEL cannot use index access"
-                );
-            }
-            for (consultation_name, consultation) in &service.consultations {
-                let Some(members) = references.first_level_members.get(consultation_name) else {
-                    continue;
-                };
-                let integration = &integrations[&consultation.integration].document;
-                for member in members {
-                    if integration.outputs.get(member).is_some_and(|output| {
-                        matches!(output.output_type, OutputType::Object | OutputType::Array)
-                    }) {
-                        bail!(
-                            "service {service_id} claim {claim_id} CEL cannot reference structured consultation output {consultation_name}.{member}"
-                        );
-                    }
-                }
-            }
-        }
     }
     Ok(())
 }
@@ -2931,25 +2632,13 @@ fn validate_environment(
     entities: &BTreeMap<String, LoadedEntityDefinition>,
     environment: &EnvironmentDocument,
 ) -> Result<()> {
-    let (requires_relay, requires_notary) = project_product_topology(project);
-    let requires_issuance = project_issues_credentials(project);
-    let requires_notary_relay = project_requires_notary_relay(project);
+    let requires_relay = project_requires_relay(project);
+    let requires_relay_consultation = project_requires_consultation_relay(project);
     if environment.deployment.relay.is_some() != requires_relay
         || environment.relay.is_some() != requires_relay
     {
         bail!("environment Relay bindings must exactly match the project topology");
     }
-    if environment.deployment.notary.is_some() != requires_notary {
-        bail!("environment Notary bindings must exactly match the project topology");
-    }
-    if environment.issuance.is_some() != requires_issuance {
-        bail!("environment issuance binding is required exactly when credential profiles exist");
-    }
-    if environment.notary_relay.is_some() != requires_notary_relay {
-        bail!(
-            "the Notary-to-Relay connection is required exactly when Relay and Notary are both deployed"
-        );
-    }
     let remote_integrations = integrations
         .values()
         .filter(|loaded| {
@@ -3011,28 +2700,6 @@ fn validate_environment(
     {
         bail!("environment contains an unknown project entity");
     }
-    if requires_notary && environment.callers.is_empty() && environment.oid4vci.is_none() {
-        bail!("a Notary environment must bind at least one authenticated caller");
-    }
-    if !requires_notary && !environment.callers.is_empty() {
-        bail!("a Relay-only environment cannot declare Notary callers");
-    }
-    if environment.callers.len() > 64 {
-        bail!("environment callers exceed the supported bound");
-    }
-    for (caller_id, caller) in &environment.callers {
-        validate_stable_id(caller_id, "caller id")?;
-        validate_secret_reference(&caller.api_key_fingerprint)?;
-        validate_scopes(&caller.scopes)?;
-    }
-    if let Some(issuance) = &environment.issuance {
-        validate_secret_reference(&issuance.signing_key)?;
-        validate_token(&issuance.issuer, "issuance issuer", 2048)?;
-        validate_token(&issuance.signing_kid, "issuance signing_kid", 2048)?;
-        if issuance.generation == 0 {
-            bail!("issuance generation must be positive");
-        }
-    }
     if let Some(relay) = &environment.relay {
         let local = matches!(environment.deployment.profile, DeploymentProfile::Local);
         validate_https_or_local_loopback_origin(&relay.origin, "Relay origin", local)?;
@@ -3048,27 +2715,33 @@ fn validate_environment(
                 bail!("Relay allowed_clients must not contain duplicates");
             }
         }
+        match (&relay.consultation, requires_relay_consultation) {
+            (Some(consultation), true) => {
+                validate_token(&consultation.client_id, "Relay consultation client id", 256)?;
+                validate_token(
+                    &consultation.principal_id,
+                    "Relay consultation principal id",
+                    256,
+                )?;
+                if allowed_clients.contains(&consultation.client_id) {
+                    bail!("Relay consultation client_id must be separate from relay.allowed_clients");
+                }
+            }
+            (None, true) => {
+                bail!("a consultation_api service requires relay.consultation")
+            }
+            (Some(_), false) => {
+                bail!("relay.consultation is valid only with a consultation_api service")
+            }
+            (None, false) => {}
+        }
         if relay.allowed_clients.is_empty() && relay.local_api_keys.is_none() {
-            bail!(
-                "a public Relay requires at least one admitted OIDC client; the Notary workload client belongs only in notary_relay"
-            );
+            bail!("a Relay requires at least one admitted OIDC client");
         }
         validate_https_or_local_loopback_resource(&relay.jwks_url, "Relay OIDC JWKS URL", local)?;
     }
-    if let Some(connection) = &environment.notary_relay {
-        validate_internal_https_or_loopback_origin(
-            &connection.base_url,
-            "Notary-to-Relay base URL",
-        )?;
-        validate_token(
-            &connection.workload_client_id,
-            "Notary-to-Relay workload client id",
-            256,
-        )?;
-        validate_absolute_runtime_path(&connection.token_file, "Relay workload token file")?;
-    }
     if let Some(state) = &environment.relay_state {
-        if !requires_notary_relay {
+        if !requires_relay_consultation {
             bail!("relay_state is valid only when Relay consultations are enabled");
         }
         validate_absolute_runtime_path(
@@ -3076,32 +2749,9 @@ fn validate_environment(
             "Relay PostgreSQL root_certificate_path",
         )?;
     }
-    if let Some(state) = &environment.notary_state {
-        if !requires_notary {
-            bail!("notary_state is valid only when the project deploys a Notary");
-        }
-        validate_absolute_runtime_path(
-            &state.postgresql.root_certificate_path,
-            "Notary PostgreSQL root_certificate_path",
-        )?;
-    }
-    if let Some(cel) = &environment.notary_cel {
-        if !requires_notary {
-            bail!("notary_cel is valid only when the project deploys a Notary");
-        }
-        if !(32 * 1024 * 1024..=1024 * 1024 * 1024).contains(&cel.worker_memory_bytes) {
-            bail!("notary_cel.worker_memory_bytes must be between 33554432 and 1073741824");
-        }
-    }
-    if let Some(oid4vci) = &environment.oid4vci {
-        validate_oid4vci_binding(project, environment, oid4vci)?;
-    }
     if let Some(relay) = &environment.deployment.relay {
         validate_stable_id(&relay.service, "Relay service id")?;
     }
-    if let Some(notary) = &environment.deployment.notary {
-        validate_stable_id(&notary.service, "Notary service id")?;
-    }
     for loaded in integrations.values() {
         if let CapabilityDeclaration::Script { script } = &loaded.document.capability {
             if script.runtime != ScriptRuntime::RhaiV1
@@ -3114,330 +2764,19 @@ fn validate_environment(
     Ok(())
 }
 
-fn validate_oid4vci_binding(
-    project: &RegistryProject,
-    environment: &EnvironmentDocument,
-    binding: &Oid4vciBinding,
-) -> Result<()> {
-    if environment.notary_state.is_none() {
-        bail!("OID4VCI requires a Notary PostgreSQL state binding");
-    }
-    let local = matches!(environment.deployment.profile, DeploymentProfile::Local);
-    validate_https_or_local_loopback_origin(
-        &binding.public_base_url,
-        "OID4VCI public base URL",
-        local,
-    )?;
-    validate_https_or_local_loopback_origin(
-        &binding.authorization_server.issuer,
-        "OID4VCI authorization server issuer",
-        local,
-    )?;
-    for (field, value) in [
-        (
-            "OID4VCI authorization server JWKS URL",
-            binding.authorization_server.jwks_url.as_str(),
-        ),
-        (
-            "OID4VCI authorization server userinfo URL",
-            binding.authorization_server.userinfo_url.as_str(),
-        ),
-        (
-            "OID4VCI authorization server authorize URL",
-            binding.authorization_server.authorize_url.as_str(),
-        ),
-        (
-            "OID4VCI authorization server token URL",
-            binding.authorization_server.token_url.as_str(),
-        ),
-        ("OID4VCI redirect URI", binding.redirect_uri.as_str()),
-    ] {
-        validate_https_or_local_loopback_resource(value, field, local)?;
-    }
-    for (field, value) in [
-        (
-            "OID4VCI authorization server JWKS URL",
-            binding.authorization_server.jwks_url.as_str(),
-        ),
-        (
-            "OID4VCI authorization server userinfo URL",
-            binding.authorization_server.userinfo_url.as_str(),
-        ),
-        (
-            "OID4VCI authorization server token URL",
-            binding.authorization_server.token_url.as_str(),
-        ),
-    ] {
-        validate_resource_origin(value, &binding.authorization_server.issuer, field)?;
-    }
-    let public_base_url = binding.public_base_url.trim_end_matches('/');
-    if binding.redirect_uri != format!("{public_base_url}/oid4vci/offer/callback") {
-        bail!("OID4VCI redirect URI must be the public Notary offer callback");
-    }
-
-    if binding.allowed_wallet_origins.is_empty() || binding.allowed_wallet_origins.len() > 16 {
-        bail!("OID4VCI allowed_wallet_origins must contain between one and 16 exact origins");
-    }
-    let mut wallet_origins = BTreeSet::new();
-    for origin in &binding.allowed_wallet_origins {
-        validate_https_origin(origin, "OID4VCI wallet origin")?;
-        if !wallet_origins.insert(origin) {
-            bail!("OID4VCI allowed_wallet_origins must not contain duplicates");
-        }
-    }
-
-    validate_stable_id(&binding.credential.service, "OID4VCI credential service")?;
-    validate_stable_id(&binding.credential.profile, "OID4VCI credential profile")?;
-    let service = project
-        .services
-        .get(&binding.credential.service)
-        .ok_or_else(|| anyhow!("OID4VCI references an unknown project service"))?;
-    if service.kind != ServiceKind::Evidence {
-        bail!("OID4VCI credential service must be an evidence service");
-    }
-    if service.access.scopes.len() != 1 {
-        bail!("OID4VCI credential service must declare exactly one access scope");
-    }
-    let credential = service
-        .credential_profiles
-        .get(&binding.credential.profile)
-        .ok_or_else(|| anyhow!("OID4VCI references an unknown credential profile"))?;
-    if credential.claims.len() != 1 {
-        bail!("OID4VCI v1 credential profiles must select exactly one claim");
-    }
-    let claim = service
-        .claims
-        .get(&credential.claims[0])
-        .ok_or_else(|| anyhow!("OID4VCI credential profile claim is absent"))?;
-    if inferred_claim_evidence(service, claim)? != ClaimEvidence::RegistryBacked {
-        bail!("OID4VCI credential profiles require registry-backed claim evidence");
-    }
-    if let Some(representative) = &binding.representative_issuance {
-        if !binding.registrar_clients.is_empty() {
-            bail!(
-                "OID4VCI representative_issuance cannot be combined with registrar_clients in Registryctl's single-credential binding"
-            );
-        }
-        validate_stable_id(
-            &representative.relationship,
-            "OID4VCI representative relationship",
-        )?;
-        validate_stable_id(
-            &representative.proof_claim,
-            "OID4VCI representative proof claim",
-        )?;
-        validate_token(
-            &representative.target_id_type,
-            "OID4VCI representative target id type",
-            256,
-        )?;
-        if representative.max_proof_age_seconds == 0
-            || representative.max_proof_age_seconds > 600
-        {
-            bail!("OID4VCI representative max_proof_age_seconds must be between one and 600");
-        }
-        let credential_claim = &credential.claims[0];
-        if let Some((shared_profile, _)) =
-            service
-                .credential_profiles
-                .iter()
-                .find(|(profile_id, profile)| {
-                    *profile_id != &binding.credential.profile
-                        && profile
-                            .claims
-                            .iter()
-                            .any(|claim_id| claim_id == credential_claim)
-                })
-        {
-            bail!(
-                "OID4VCI representative credential claim '{}' must be exclusive to credential profile '{}'; credential profile '{}' also selects it",
-                credential_claim,
-                binding.credential.profile,
-                shared_profile
-            );
-        }
-        let proof = service
-            .claims
-            .get(&representative.proof_claim)
-            .ok_or_else(|| {
-                anyhow!(
-                    "OID4VCI representative_issuance.proof_claim '{}' is not a claim in credential service '{}'",
-                    representative.proof_claim,
-                    binding.credential.service
-                )
-            })?;
-        if representative.proof_claim == credential.claims[0] {
-            bail!(
-                "OID4VCI representative_issuance.proof_claim must differ from the credential claim"
-            );
-        }
-        if inferred_claim_evidence(service, proof)? != ClaimEvidence::RegistryBacked {
-            bail!("OID4VCI representative_issuance.proof_claim must be registry-backed");
-        }
-        let consultation_name = claim_consultation_name(service, proof)?;
-        let consultation = &service.consultations[consultation_name];
-        let requester_mapping = format!(
-            "request.requester.identifiers.{}",
-            binding.subject.id_type
-        );
-        let target_mapping = format!(
-            "request.target.identifiers.{}",
-            representative.target_id_type
-        );
-        if !consultation
-            .input
-            .values()
-            .any(|mapping| mapping == &requester_mapping)
-        {
-            bail!(
-                "OID4VCI representative_issuance.proof_claim '{}' consultation '{}' must bind the authenticated representative with input mapping '{}'",
-                representative.proof_claim,
-                consultation_name,
-                requester_mapping
-            );
-        }
-        if !consultation
-            .input
-            .values()
-            .any(|mapping| mapping == &target_mapping)
-        {
-            bail!(
-                "OID4VCI representative_issuance.proof_claim '{}' consultation '{}' must bind the represented subject with input mapping '{}'",
-                representative.proof_claim,
-                consultation_name,
-                target_mapping
-            );
-        }
-        if consultation.input.len() != 2
-            || consultation
-                .input
-                .values()
-                .any(|mapping| mapping != &requester_mapping && mapping != &target_mapping)
-        {
-            bail!(
-                "OID4VCI representative_issuance.proof_claim '{}' consultation '{}' must map exactly the authenticated representative and represented subject identifiers; the target-selection ceremony cannot supply additional inputs",
-                representative.proof_claim,
-                consultation_name
-            );
-        }
-    }
-    if normalize_credential_format(&credential.format) != "application/dc+sd-jwt" {
-        bail!("OID4VCI credential profile format must be dc+sd-jwt");
-    }
-    let validity_seconds = parse_validity_seconds(&credential.validity)?;
-    if validity_seconds == 0 || validity_seconds > 600 {
-        bail!("OID4VCI credential validity must be between one and 600 seconds");
-    }
-    validate_https_or_local_loopback_resource(
-        &credential.credential_type,
-        "OID4VCI credential type",
-        local,
-    )?;
-    validate_resource_origin(
-        &credential.credential_type,
-        &binding.public_base_url,
-        "OID4VCI credential type",
-    )?;
-    let credential_path = url::Url::parse(&credential.credential_type)
-        .context("OID4VCI credential type is invalid")?
-        .path()
-        .to_string();
-    if !credential_path.starts_with("/credentials/") {
-        bail!("OID4VCI credential type path must start with /credentials/");
-    }
-
-    validate_token(&binding.client.id, "OID4VCI client id", 256)?;
-    if binding.registrar_clients.len() > 64 {
-        bail!("OID4VCI registrar_clients exceeds the supported bound");
-    }
-    let mut registrar_clients = BTreeSet::new();
-    for client in &binding.registrar_clients {
-        validate_token(client, "OID4VCI registrar client id", 256)?;
-        if client == &binding.client.id {
-            bail!("OID4VCI registrar_clients must not contain the citizen client id");
-        }
-        if !registrar_clients.insert(client) {
-            bail!("OID4VCI registrar_clients must not contain duplicates");
-        }
-    }
-    validate_secret_reference(&binding.client.signing_key)?;
-    validate_token(
-        &binding.client.signing_kid,
-        "OID4VCI client signing_kid",
-        2048,
-    )?;
-    validate_secret_reference(&binding.access_token.signing_key)?;
-    validate_token(
-        &binding.access_token.signing_kid,
-        "OID4VCI access-token signing_kid",
-        2048,
-    )?;
-    validate_secret_reference(&binding.sensitive_state_key)?;
-    validate_token(
-        &binding.subject.token_claim,
-        "OID4VCI subject token claim",
-        256,
-    )?;
-    validate_token(&binding.subject.id_type, "OID4VCI subject id type", 256)?;
-
-    let issuance = environment
-        .issuance
-        .as_ref()
-        .ok_or_else(|| anyhow!("OID4VCI requires an issuance binding"))?;
-    let secret_names = [
-        issuance.signing_key.secret.as_str(),
-        binding.client.signing_key.secret.as_str(),
-        binding.access_token.signing_key.secret.as_str(),
-    ];
-    if secret_names.into_iter().collect::<BTreeSet<_>>().len() != secret_names.len() {
-        bail!("OID4VCI issuer, client, and access-token signing keys must be distinct");
-    }
-    let signing_kids = [
-        issuance.signing_kid.as_str(),
-        binding.client.signing_kid.as_str(),
-        binding.access_token.signing_kid.as_str(),
-    ];
-    if signing_kids.into_iter().collect::<BTreeSet<_>>().len() != signing_kids.len() {
-        bail!("OID4VCI issuer, client, and access-token signing kids must be distinct");
-    }
-    Ok(())
-}
-
-fn validate_resource_origin(resource: &str, origin: &str, field: &str) -> Result<()> {
-    let resource = url::Url::parse(resource).with_context(|| format!("{field} is invalid"))?;
-    let origin = url::Url::parse(origin).with_context(|| format!("{field} origin is invalid"))?;
-    if resource.scheme() != origin.scheme()
-        || resource.host() != origin.host()
-        || resource.port_or_known_default() != origin.port_or_known_default()
-    {
-        bail!("{field} must use its bound origin");
-    }
-    Ok(())
-}
-
-fn project_product_topology(project: &RegistryProject) -> (bool, bool) {
-    let requires_notary = project
-        .services
-        .values()
-        .any(|service| service.kind == ServiceKind::Evidence);
-    let requires_relay = !project.integrations.is_empty()
+fn project_requires_relay(project: &RegistryProject) -> bool {
+    !project.integrations.is_empty()
         || !project.entities.is_empty()
         || project.services.values().any(|service| {
             service.kind == ServiceKind::RecordsApi || !service.consultations.is_empty()
-        });
-    (requires_relay, requires_notary)
+        })
 }
 
-fn project_issues_credentials(project: &RegistryProject) -> bool {
+fn project_requires_consultation_relay(project: &RegistryProject) -> bool {
     project
         .services
         .values()
-        .any(|service| !service.credential_profiles.is_empty())
-}
-
-fn project_requires_notary_relay(project: &RegistryProject) -> bool {
-    let (requires_relay, requires_notary) = project_product_topology(project);
-    requires_relay && requires_notary
+        .any(|service| service.kind == ServiceKind::ConsultationApi)
 }
 
 fn is_script_runtime_released(capability: ReleasedScriptRuntime) -> bool {
diff --git a/crates/registryctl/src/project_authoring/promotion_projection.rs b/crates/registryctl/src/project_authoring/promotion_projection.rs
index 8d71dad58..1d15260b5 100644
--- a/crates/registryctl/src/project_authoring/promotion_projection.rs
+++ b/crates/registryctl/src/project_authoring/promotion_projection.rs
@@ -24,18 +24,12 @@ pub(crate) enum PromotionFieldPath {
     IntegrationCredentials,
     #[serde(rename = "/integrations/*/trust")]
     IntegrationTrust,
-    #[serde(rename = "/notary/callers/*")]
-    NotaryCaller,
     #[serde(rename = "/operations")]
     OperationalSettings,
     #[serde(rename = "/purposes/*")]
     Purpose,
     #[serde(rename = "/service_policy")]
     ServicePolicy,
-    #[serde(rename = "/notary/claims/*")]
-    Claim,
-    #[serde(rename = "/notary/disclosures/*")]
-    Disclosure,
     #[serde(rename = "/products/*")]
     ProductEnablement,
     #[serde(rename = "/integrations/*/capabilities/*")]
@@ -57,28 +51,22 @@ pub(crate) enum PromotionChangeKind {
     Origin,
     CredentialBinding,
     Trust,
-    Caller,
     Operational,
     Purpose,
     ServicePolicy,
-    Claim,
-    Disclosure,
     ProductEnablement,
     CapabilityEnablement,
     IntegrationCeiling,
 }
 
 impl PromotionChangeKind {
-    pub(crate) const ALL: [Self; 12] = [
+    pub(crate) const ALL: [Self; 9] = [
         Self::Origin,
         Self::CredentialBinding,
         Self::Trust,
-        Self::Caller,
         Self::Operational,
         Self::Purpose,
         Self::ServicePolicy,
-        Self::Claim,
-        Self::Disclosure,
         Self::ProductEnablement,
         Self::CapabilityEnablement,
         Self::IntegrationCeiling,
@@ -98,10 +86,6 @@ impl PromotionChangeKind {
                 PromotionDocument::Environment,
                 PromotionFieldPath::IntegrationTrust,
             ),
-            Self::Caller => (
-                PromotionDocument::Environment,
-                PromotionFieldPath::NotaryCaller,
-            ),
             Self::Operational => (
                 PromotionDocument::Environment,
                 PromotionFieldPath::OperationalSettings,
@@ -123,8 +107,6 @@ impl PromotionChangeKind {
                 PromotionDocument::Project,
                 PromotionFieldPath::ServicePolicy,
             ),
-            Self::Claim => (PromotionDocument::Project, PromotionFieldPath::Claim),
-            Self::Disclosure => (PromotionDocument::Project, PromotionFieldPath::Disclosure),
         };
         PromotionFieldAddress { document, path }
     }
@@ -135,7 +117,6 @@ impl PromotionChangeKind {
             Self::Origin
                 | Self::CredentialBinding
                 | Self::Trust
-                | Self::Caller
                 | Self::Operational
                 | Self::ProductEnablement
                 | Self::CapabilityEnablement
@@ -149,12 +130,10 @@ impl PromotionChangeKind {
     pub(crate) const fn expected_classification(self) -> PromotionFieldClassification {
         match self {
             Self::CredentialBinding => PromotionFieldClassification::SecretReference,
-            Self::Origin | Self::Trust | Self::Caller => PromotionFieldClassification::Sensitive,
-            Self::Operational
-            | Self::Purpose
-            | Self::ServicePolicy
-            | Self::Claim
-            | Self::Disclosure => PromotionFieldClassification::Internal,
+            Self::Origin | Self::Trust => PromotionFieldClassification::Sensitive,
+            Self::Operational | Self::Purpose | Self::ServicePolicy => {
+                PromotionFieldClassification::Internal
+            }
             Self::ProductEnablement | Self::CapabilityEnablement | Self::IntegrationCeiling => {
                 PromotionFieldClassification::Structural
             }
@@ -189,7 +168,6 @@ pub(crate) enum ProjectPromotionProjectionSchemaVersion {
 #[serde(rename_all = "snake_case")]
 pub(crate) enum PromotionProjectedProduct {
     Relay,
-    Notary,
 }
 
 #[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
@@ -321,7 +299,7 @@ mod tests {
         assert_eq!(revision, PROMOTION_FIELD_KNOWLEDGE_REVISION);
 
         let index = knowledge::published_field_knowledge_index().expect("knowledge indexes");
-        assert_eq!(index.by_path().len(), 702);
+        assert_eq!(index.by_path().len(), 562);
         let mapped = index
             .by_path()
             .keys()
diff --git a/crates/registryctl/src/project_authoring/report_contract.rs b/crates/registryctl/src/project_authoring/report_contract.rs
index 6839edb50..416e5777f 100644
--- a/crates/registryctl/src/project_authoring/report_contract.rs
+++ b/crates/registryctl/src/project_authoring/report_contract.rs
@@ -159,7 +159,6 @@ pub struct ProjectFixtureReport {
     pub inputs: Vec<String>,
     pub calls: Vec<String>,
     pub outputs: Vec<String>,
-    pub claims: Vec<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub outcome: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -378,7 +377,6 @@ pub struct ProjectSchemaRef {
 pub enum ImpactConsumer {
     RegistryctlAuthoring,
     RegistryRelay,
-    RegistryNotary,
     EditorTooling,
     DocsGenerator,
     BundleSigner,
@@ -396,7 +394,6 @@ pub enum ImpactReviewClass {
     Privacy,
     Security,
     Relay,
-    Notary,
     Compatibility,
     Documentation,
     Testing,
@@ -501,22 +498,18 @@ impl ProjectSemanticImpactReportV1 {
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
 #[serde(rename_all = "snake_case")]
 pub enum SemanticDimension {
-    Claim,
     Integration,
     ServicePolicy,
     OperatorSecurity,
-    Disclosure,
     Compiler,
 }
 
 impl SemanticDimension {
     pub const fn as_str(self) -> &'static str {
         match self {
-            Self::Claim => "claim",
             Self::Integration => "integration",
             Self::ServicePolicy => "service_policy",
             Self::OperatorSecurity => "operator_security",
-            Self::Disclosure => "disclosure",
             Self::Compiler => "compiler",
         }
     }
@@ -670,8 +663,6 @@ pub enum AffectedSubjectKind {
     Fixture,
     ServicePolicy,
     Consultation,
-    Claim,
-    Disclosure,
     ProductInput,
     GeneratedArtifact,
 }
@@ -688,7 +679,6 @@ pub struct AffectedSubject {
 pub enum ProjectProduct {
     Registryctl,
     Relay,
-    Notary,
     Editor,
     Docs,
 }
@@ -781,7 +771,6 @@ pub enum ArtifactClass {
     RuntimeConfig,
     ConsultationContract,
     SourcePlan,
-    ClaimConfiguration,
     DeploymentInput,
     ReviewRecord,
     Documentation,
@@ -855,7 +844,6 @@ pub enum ArtifactAction {
 #[serde(rename_all = "snake_case")]
 pub enum ArtifactConsumer {
     RegistryRelay,
-    RegistryNotary,
     BundleSigner,
     DeploymentTooling,
     ProjectDocumentation,
diff --git a/crates/registryctl/src/project_authoring/required_product_action.rs b/crates/registryctl/src/project_authoring/required_product_action.rs
index cc48bef21..799a433ee 100644
--- a/crates/registryctl/src/project_authoring/required_product_action.rs
+++ b/crates/registryctl/src/project_authoring/required_product_action.rs
@@ -11,7 +11,6 @@ use serde::{Deserialize, Serialize};
 pub enum RequiredProductAction {
     RelayPublic,
     RelayConsultation,
-    Notary,
 }
 
 #[cfg(test)]
@@ -24,10 +23,9 @@ mod tests {
             serde_json::to_value([
                 RequiredProductAction::RelayPublic,
                 RequiredProductAction::RelayConsultation,
-                RequiredProductAction::Notary,
             ])
             .expect("product action lanes serialize"),
-            serde_json::json!(["relay-public", "relay-consultation", "notary"])
+            serde_json::json!(["relay-public", "relay-consultation"])
         );
     }
 }
diff --git a/crates/registryctl/src/project_authoring/schema_authority.rs b/crates/registryctl/src/project_authoring/schema_authority.rs
index f7ee8f65b..7e1343408 100644
--- a/crates/registryctl/src/project_authoring/schema_authority.rs
+++ b/crates/registryctl/src/project_authoring/schema_authority.rs
@@ -440,7 +440,7 @@ fn project_service_validation_instance_path(document: &Value) -> Option<String>
     }
     for (service_id, service) in services {
         let branch = match service.get("kind").and_then(Value::as_str) {
-            Some("evidence") => "evidenceService",
+            Some("consultation_api") => "consultationService",
             Some("records_api") => "recordsService",
             Some(_) => {
                 return Some(format!(
@@ -1980,10 +1980,6 @@ mod schema_authority_tests {
                 "/$defs/integrationRequestByteSize",
                 "/$defs/integrationResponseByteSize",
                 "/$defs/integrationSourceByteSize",
-                "/$defs/oid4vci/properties/registrar_clients",
-                "/$defs/oid4vci/properties/representative_issuance/properties/max_proof_age_seconds",
-                "/$defs/oid4vci/properties/tx_code/properties/required",
-                "/properties/issuance/properties/algorithm",
             ]
         );
         assert!(
@@ -2025,48 +2021,6 @@ mod schema_authority_tests {
             );
         }
 
-        let issuance_omitted: IssuanceBinding = serde_json::from_value(json!({
-            "issuer": "https://issuer.invalid",
-            "signing_key": {"secret": "ISSUER_KEY"},
-            "signing_kid": "issuer-key",
-            "generation": 1
-        }))
-        .expect("omitted issuance algorithm parses");
-        let issuance_explicit: IssuanceBinding = serde_json::from_value(json!({
-            "issuer": "https://issuer.invalid",
-            "signing_key": {"secret": "ISSUER_KEY"},
-            "signing_kid": "issuer-key",
-            "algorithm": "EdDSA",
-            "generation": 1
-        }))
-        .expect("explicit issuance algorithm parses");
-        assert_eq!(
-            serde_json::to_value(issuance_omitted).expect("issuance serializes"),
-            serde_json::to_value(issuance_explicit).expect("issuance serializes")
-        );
-
-        let tx_omitted: Oid4vciTxCodeBinding =
-            serde_json::from_value(json!({})).expect("omitted tx-code default parses");
-        let tx_explicit: Oid4vciTxCodeBinding = serde_json::from_value(json!({"required": true}))
-            .expect("explicit tx-code default parses");
-        assert_eq!(
-            serde_json::to_value(tx_omitted).expect("tx code serializes"),
-            serde_json::to_value(tx_explicit).expect("tx code serializes")
-        );
-
-        let environment_schema: Value =
-            serde_json::from_str(ProjectSchemaKind::Environment.document())
-                .expect("environment schema parses");
-        let registrar_clients_default: Vec<String> = serde_json::from_value(
-            environment_schema["$defs"]["oid4vci"]["properties"]["registrar_clients"]["default"]
-                .clone(),
-        )
-        .expect("registrar client default parses");
-        assert_eq!(
-            registrar_clients_default,
-            Vec::<String>::default(),
-            "schema and serde use the same empty registrar-client default"
-        );
     }
 
     fn collect_keyword_addresses(
diff --git a/crates/registryctl/src/project_authoring/tests.rs b/crates/registryctl/src/project_authoring/tests.rs
index 647e7afd5..86768fac9 100644
--- a/crates/registryctl/src/project_authoring/tests.rs
+++ b/crates/registryctl/src/project_authoring/tests.rs
@@ -75,68 +75,6 @@ mod tests {
         assert!(mismatches.is_empty(), "{}", mismatches.join("\n"));
     }
 
-    #[test]
-    fn evidence_subject_type_is_closed_and_omission_normalizes_to_person() {
-        let bytes = PROJECT_STARTERS
-            .get_file("bounded-http/registry-stack.yaml")
-            .expect("bounded HTTP project is embedded")
-            .contents();
-        let omitted =
-            parse_current_authoring_document::<RegistryProject>(bytes).expect("project parses");
-        let service = &omitted.services["person-verification"];
-        assert_eq!(service.subject_type, None);
-        assert_eq!(
-            service.effective_subject_type(),
-            EvidenceSubjectType::Person
-        );
-        assert!(
-            serde_json::to_value(&omitted)
-                .expect("project serializes")
-                .pointer("/services/person-verification/subject_type")
-                .is_none(),
-            "normalized omission must preserve authored-content serialization"
-        );
-
-        let mut invalid: Value = serde_norway::from_slice(bytes).expect("project YAML parses");
-        invalid["services"]["person-verification"]["subject_type"] = json!("organisation");
-        let invalid_bytes =
-            serde_norway::to_string(&invalid).expect("invalid subject project serializes");
-        parse_current_authoring_document::<RegistryProject>(invalid_bytes.as_bytes())
-            .expect_err("unknown evidence subject type must fail closed");
-
-        invalid["services"]["person-verification"]["subject_type"] = json!("project");
-        let project_bytes =
-            serde_norway::to_string(&invalid).expect("project subject project serializes");
-        let explicit =
-            parse_current_authoring_document::<RegistryProject>(project_bytes.as_bytes())
-                .expect("project is an allowed subject type");
-        assert_eq!(
-            explicit.services["person-verification"].subject_type,
-            Some(EvidenceSubjectType::Project)
-        );
-    }
-
-    #[test]
-    fn records_service_rejects_an_explicit_evidence_subject_type() {
-        let bytes = PROJECT_STARTERS
-            .get_file("spreadsheet/registry-stack.yaml")
-            .expect("spreadsheet project is embedded")
-            .contents();
-        let mut value: Value = serde_norway::from_slice(bytes).expect("project YAML parses");
-        value["services"]["projects-records"]["subject_type"] = json!("person");
-        let invalid = serde_norway::to_string(&value).expect("records subject project serializes");
-        parse_current_authoring_document::<RegistryProject>(invalid.as_bytes())
-            .expect_err("public schema rejects evidence fields on records services");
-
-        let typed: RegistryProject =
-            serde_norway::from_str(&invalid).expect("presence-aware typed model retains the field");
-        let error = validate_project_shape(&typed)
-            .expect_err("typed validation also rejects evidence fields on records services");
-        assert!(error
-            .to_string()
-            .contains("records_api service cannot declare evidence-service fields"));
-    }
-
     #[test]
     fn corrected_http_authoring_lowers_to_one_product_neutral_request() {
         let authored: AuthoredIntegrationDocument = serde_norway::from_str(
@@ -437,90 +375,6 @@ items:
         .contains("require capability.script"));
     }
 
-    #[test]
-    fn authored_output_count_preserves_the_generic_non_notary_limit() {
-        fn boolean_output() -> AuthoredOutputDeclaration {
-            AuthoredOutputDeclaration::Scalar(AuthoredScalarOutputDeclaration {
-                output_type: AuthoredSchemaType::Single(AuthoredScalarType::Boolean),
-                format: None,
-                max_length: None,
-                minimum: None,
-                maximum: None,
-                source: None,
-            })
-        }
-
-        const {
-            assert!(MAX_OUTPUTS > registry_notary_core::MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1);
-        }
-        let outputs = |count| {
-            (0..count)
-                .map(|index| (format!("field_{index}"), boolean_output()))
-                .collect::<BTreeMap<_, _>>()
-        };
-        validate_authored_outputs(&outputs(
-            registry_notary_core::MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1 + 1,
-        ))
-        .expect("generic authoring retains more outputs than a Notary consultation");
-        validate_authored_outputs(&outputs(MAX_OUTPUTS))
-            .expect("the generic integration output limit validates");
-        assert!(validate_authored_outputs(&outputs(MAX_OUTPUTS + 1))
-            .expect_err("one output beyond the generic integration limit rejects")
-            .to_string()
-            .contains(&format!("between one and {MAX_OUTPUTS} fields")));
-    }
-
-    #[test]
-    fn notary_output_count_applies_only_to_evidence_consultations() {
-        let mut evidence =
-            load_registry_project(&project_golden("opencrvs"), None).expect("OpenCRVS project loads");
-        let birth = evidence
-            .integrations
-            .get_mut("birth-record")
-            .expect("birth integration exists");
-        let template = serde_json::to_value(&birth.document.outputs["sex"])
-            .expect("scalar output serializes");
-        while birth.document.outputs.len()
-            <= registry_notary_core::MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1
-        {
-            let index = birth.document.outputs.len();
-            birth.document.outputs.insert(
-                format!("extra_{index}"),
-                serde_json::from_value(template.clone()).expect("scalar output clones"),
-            );
-        }
-        validate_integration("birth-record", &birth.document)
-            .expect("the generic integration contract still accepts 33 outputs");
-        let error = validate_service_integration_links(&evidence.project, &evidence.integrations)
-            .expect_err("an Evidence consultation cannot exceed the Notary output limit");
-        assert!(error.to_string().contains(&format!(
-            "integration outputs must contain no more than {} entries",
-            registry_notary_core::MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1
-        )));
-
-        let records_root = Path::new(env!("CARGO_MANIFEST_DIR"))
-            .join("assets/project-starters/spreadsheet");
-        let mut records =
-            load_registry_project(&records_root, None).expect("Records API project loads");
-        records.project.integrations.insert(
-            "wide".to_string(),
-            IntegrationReference {
-                file: PathBuf::from("integrations/wide/integration.yaml"),
-            },
-        );
-        records.integrations.insert(
-            "wide".to_string(),
-            evidence
-                .integrations
-                .remove("birth-record")
-                .expect("wide integration remains available"),
-        );
-        validate_project_shape(&records.project)
-            .expect("a Records API-only project may retain the generic integration limit");
-        validate_service_integration_links(&records.project, &records.integrations)
-            .expect("Records API-only integrations are not narrowed to the Notary limit");
-    }
-
     #[test]
     fn structured_output_byte_caps_must_encode_a_non_null_value() {
         fn validate(source: &str) -> Result<()> {
@@ -586,118 +440,6 @@ fields:
             .contains("outputs.record.fields.child.schema.max_bytes must be at least 2"));
     }
 
-    #[test]
-    fn structured_output_limits_reserve_the_notary_result_envelope() {
-        fn boolean_schema() -> AuthoredOutputSchema {
-            AuthoredOutputSchema::Scalar(AuthoredScalarOutputSchema {
-                output_type: AuthoredSchemaType::Single(AuthoredScalarType::Boolean),
-                format: None,
-                max_length: None,
-                minimum: None,
-                maximum: None,
-            })
-        }
-
-        fn boolean_output() -> AuthoredOutputDeclaration {
-            AuthoredOutputDeclaration::Scalar(AuthoredScalarOutputDeclaration {
-                output_type: AuthoredSchemaType::Single(AuthoredScalarType::Boolean),
-                format: None,
-                max_length: None,
-                minimum: None,
-                maximum: None,
-                source: None,
-            })
-        }
-
-        fn object_declaration(field_count: usize) -> AuthoredOutputObjectDeclaration {
-            AuthoredOutputObjectDeclaration {
-                output_type: AuthoredOutputObjectType::Object,
-                nullable: false,
-                max_bytes: 65_536,
-                fields: (0..field_count)
-                    .map(|index| {
-                        (
-                            format!("field_{index}"),
-                            AuthoredOutputObjectField {
-                                required: true,
-                                schema: Box::new(boolean_schema()),
-                            },
-                        )
-                    })
-                    .collect(),
-            }
-        }
-
-        fn object_output(field_count: usize) -> AuthoredOutputDeclaration {
-            AuthoredOutputDeclaration::Object(object_declaration(field_count))
-        }
-
-        fn array_output(array_nodes: usize) -> AuthoredOutputDeclaration {
-            assert!(array_nodes > 0);
-            let mut items = boolean_schema();
-            for _ in 1..array_nodes {
-                items = AuthoredOutputSchema::Array(AuthoredOutputArrayDeclaration {
-                    output_type: AuthoredOutputArrayType::Array,
-                    nullable: false,
-                    max_bytes: 65_536,
-                    max_items: 1,
-                    items: Box::new(items),
-                });
-            }
-            AuthoredOutputDeclaration::Array(AuthoredOutputArrayDeclaration {
-                output_type: AuthoredOutputArrayType::Array,
-                nullable: false,
-                max_bytes: 65_536,
-                max_items: 1,
-                items: Box::new(items),
-            })
-        }
-
-        let maximum_depth = BTreeMap::from([("nested".to_string(), array_output(5))]);
-        validate_authored_outputs(&maximum_depth)
-            .expect("five array nodes plus one leaf fit downstream depth eight");
-        let excessive_depth = BTreeMap::from([("nested".to_string(), array_output(6))]);
-        assert!(validate_authored_outputs(&excessive_depth)
-            .expect_err("one more nested node exceeds downstream depth eight")
-            .to_string()
-            .contains("maximum depth of 8"));
-
-        let node_budget = |extra_scalars| {
-            let mut outputs = (0..7)
-                .map(|index| (format!("wide_{index}"), object_output(32)))
-                .collect::<BTreeMap<_, _>>();
-            for index in 0..(5 + extra_scalars) {
-                outputs.insert(format!("scalar_{index}"), boolean_output());
-            }
-            outputs
-        };
-        validate_authored_outputs(&node_budget(0))
-            .expect("236 authored nodes plus the 20-node envelope fit exactly");
-        assert!(validate_authored_outputs(&node_budget(1))
-            .expect_err("237 authored nodes exceed the downstream node budget")
-            .to_string()
-            .contains("more than 256 nodes"));
-
-        let expanded_output = |field_count| {
-            BTreeMap::from([(
-                "expanded".to_string(),
-                AuthoredOutputDeclaration::Array(AuthoredOutputArrayDeclaration {
-                    output_type: AuthoredOutputArrayType::Array,
-                    nullable: false,
-                    max_bytes: 65_536,
-                    max_items: 255,
-                    items: Box::new(AuthoredOutputSchema::Object(object_declaration(field_count))),
-                }),
-            )])
-        };
-        validate_authored_outputs(&expanded_output(14))
-            .expect("expanded schema remains below the downstream envelope-adjusted bound");
-        assert!(validate_authored_outputs(&expanded_output(15))
-            .expect_err("the result envelope pushes expanded nodes beyond 4096")
-            .to_string()
-            .contains("recursive expansion exceeds 4096 nodes"));
-    }
-
     #[test]
     fn corrected_authoring_rejects_the_superseded_operation_graph() {
         serde_norway::from_str::<AuthoredIntegrationDocument>(
@@ -954,6 +696,164 @@ outputs:
             .join(name)
     }
 
+    fn relay_validation_project(kind: ServiceKind) -> RegistryProject {
+        let (kind, consultations) = match kind {
+            ServiceKind::ConsultationApi => (
+                "consultation_api",
+                "consultations:\n      check:\n        integration: check\n        input: {}",
+            ),
+            ServiceKind::RecordsApi => ("records_api", ""),
+        };
+        serde_norway::from_str(&format!(
+            r#"
+version: 1
+registry: {{ id: relay-validation }}
+services:
+  api:
+    kind: {kind}
+    {consultations}
+"#
+        ))
+        .expect("Relay validation project parses")
+    }
+
+    fn relay_validation_environment(
+        allowed_clients: &[&str],
+        consultation: Option<(&str, &str)>,
+        local_api_keys: bool,
+    ) -> EnvironmentDocument {
+        EnvironmentDocument {
+            version: 1,
+            development: None,
+            integrations: BTreeMap::new(),
+            entities: BTreeMap::new(),
+            relay: Some(RelayBinding {
+                origin: "https://relay.invalid".to_string(),
+                issuer: "https://issuer.invalid".to_string(),
+                jwks_url: "https://issuer.invalid/.well-known/jwks.json".to_string(),
+                audience: "registry-relay".to_string(),
+                allowed_clients: allowed_clients
+                    .iter()
+                    .map(|client| (*client).to_string())
+                    .collect(),
+                consultation: consultation.map(|(client_id, principal_id)| {
+                    RelayConsultationBinding {
+                        client_id: client_id.to_string(),
+                        principal_id: principal_id.to_string(),
+                    }
+                }),
+                local_api_keys: local_api_keys.then(|| RelayLocalApiKeyBinding {
+                    match_principal: "local-match".to_string(),
+                    no_match_principal: "local-no-match".to_string(),
+                    scopes: vec!["records:read".to_string()],
+                }),
+            }),
+            relay_state: None,
+            deployment: DeploymentBinding {
+                profile: DeploymentProfile::Local,
+                relay: Some(ServiceBinding {
+                    service: "relay-validation".to_string(),
+                }),
+            },
+        }
+    }
+
+    #[test]
+    fn consultation_relay_requires_an_explicit_identity_even_with_local_api_keys() {
+        let project = relay_validation_project(ServiceKind::ConsultationApi);
+        let environment = relay_validation_environment(&[], None, true);
+
+        let error =
+            validate_environment(&project, &BTreeMap::new(), &BTreeMap::new(), &environment)
+                .expect_err("local public API keys must not authorize consultation workloads");
+        assert_eq!(
+            error.to_string(),
+            "a consultation_api service requires relay.consultation"
+        );
+    }
+
+    #[test]
+    fn consultation_relay_client_must_be_separate_from_the_public_oidc_allowlist() {
+        let project = relay_validation_project(ServiceKind::ConsultationApi);
+        let environment = relay_validation_environment(
+            &["shared-client"],
+            Some(("shared-client", "consultation-principal")),
+            false,
+        );
+
+        let error =
+            validate_environment(&project, &BTreeMap::new(), &BTreeMap::new(), &environment)
+                .expect_err("consultation client must not be admitted by the public Relay");
+        assert_eq!(
+            error.to_string(),
+            "Relay consultation client_id must be separate from relay.allowed_clients"
+        );
+    }
+
+    #[test]
+    fn consultation_relay_accepts_a_distinct_workload_client() {
+        let project = relay_validation_project(ServiceKind::ConsultationApi);
+        let environment = relay_validation_environment(
+            &["public-client"],
+            Some(("consultation-client", "consultation-principal")),
+            false,
+        );
+
+        validate_environment(&project, &BTreeMap::new(), &BTreeMap::new(), &environment)
+            .expect("distinct public and consultation Relay clients are accepted");
+    }
+
+    #[test]
+    fn consultation_relay_validates_both_identity_tokens() {
+        let project = relay_validation_project(ServiceKind::ConsultationApi);
+        for (allowed_client, client_id, principal_id, expected_field) in [
+            (
+                "valid-client",
+                "invalid client",
+                "valid-principal",
+                "consultation client id",
+            ),
+            (
+                "valid-client",
+                "valid-client",
+                "invalid principal",
+                "consultation principal id",
+            ),
+        ] {
+            let environment = relay_validation_environment(
+                &[allowed_client],
+                Some((client_id, principal_id)),
+                false,
+            );
+
+            let error =
+                validate_environment(&project, &BTreeMap::new(), &BTreeMap::new(), &environment)
+                    .expect_err("invalid consultation identity token must fail closed");
+            assert!(
+                error.to_string().contains(expected_field),
+                "unexpected consultation token diagnostic: {error:#}"
+            );
+        }
+    }
+
+    #[test]
+    fn records_only_relay_rejects_a_consultation_identity() {
+        let project = relay_validation_project(ServiceKind::RecordsApi);
+        let environment = relay_validation_environment(
+            &["records-client"],
+            Some(("records-client", "consultation-principal")),
+            false,
+        );
+
+        let error =
+            validate_environment(&project, &BTreeMap::new(), &BTreeMap::new(), &environment)
+                .expect_err("records-only projects must not bind a consultation workload");
+        assert_eq!(
+            error.to_string(),
+            "relay.consultation is valid only with a consultation_api service"
+        );
+    }
+
     #[test]
     fn nia_userinfo_release_is_minimized_hash_covered_and_relay_valid() {
         let project = project_golden("nia-attribute-release");
@@ -1051,68 +951,6 @@ outputs:
         );
     }
 
-    #[test]
-    fn normalized_subject_type_changes_claim_semantics_and_notary_compilation() {
-        let mut loaded = load_registry_project(&project_golden("custom-system"), Some("local"))
-            .expect("golden project loads");
-        let baseline = loaded.semantic_digests.claim.clone();
-        let service = loaded
-            .project
-            .services
-            .get_mut("household-eligibility")
-            .expect("evidence service exists");
-        assert_eq!(service.subject_type, None);
-        service.subject_type = Some(EvidenceSubjectType::Person);
-        let explicit_person = semantic_digests(
-            &loaded.project,
-            &loaded.integrations,
-            &loaded.entities,
-            loaded.environment.as_ref(),
-        )
-        .expect("explicit person digest compiles");
-        assert_eq!(
-            explicit_person.claim, baseline,
-            "omitted and explicit person must share normalized Claim semantics"
-        );
-
-        loaded
-            .project
-            .services
-            .get_mut("household-eligibility")
-            .expect("evidence service exists")
-            .subject_type = Some(EvidenceSubjectType::Project);
-        let project_subject = semantic_digests(
-            &loaded.project,
-            &loaded.integrations,
-            &loaded.entities,
-            loaded.environment.as_ref(),
-        )
-        .expect("project subject digest compiles");
-        assert_ne!(
-            project_subject.claim, baseline,
-            "subject category changes must alter the Claim semantic digest"
-        );
-
-        let compiled = compile_project(&loaded, None).expect("project subject compiles");
-        let notary: Value = serde_norway::from_slice(
-            compiled
-                .notary_private
-                .get(Path::new("config/notary.yaml"))
-                .expect("Notary config exists"),
-        )
-        .expect("Notary config parses");
-        assert!(notary["evidence"]["claims"]
-            .as_array()
-            .expect("generated claims are an array")
-            .iter()
-            .all(|claim| claim["subject_type"] == "project"));
-        assert_eq!(
-            fixture_subject_type(&loaded, "eligibility")
-                .expect("offline fixture derives the project subject"),
-            EvidenceSubjectType::Project
-        );
-    }
-
     #[test]
     fn attribute_release_purpose_must_be_header_safe_during_authoring() {
         let mut loaded =
@@ -1399,122 +1237,64 @@ outputs:
     }
 
     #[test]
-    fn generated_public_and_consultation_relays_are_separate_and_production_validated() {
+    fn generated_public_and_consultation_relay_lanes_remain_separate() {
         let loaded = load_registry_project(&project_golden("custom-system"), Some("local"))
-            .expect("golden project loads");
-        let compiled = compile_project(&loaded, None).expect("golden project compiles");
-        let public_path = Path::new("config/relay.yaml");
-        let consultation_path = Path::new("config/relay.yaml");
+            .expect("Relay consultation project loads");
+        let compiled = compile_project(&loaded, None).expect("Relay project compiles");
         let public_bytes = compiled
             .relay_private
-            .get(public_path)
+            .get(Path::new("config/relay.yaml"))
             .expect("public Relay config exists");
         let consultation_bytes = compiled
             .relay_consultation_private
-            .get(consultation_path)
+            .get(Path::new("config/relay.yaml"))
             .expect("consultation Relay config exists");
         let public: Value =
             serde_norway::from_slice(public_bytes).expect("public Relay config parses");
-        let consultation: Value =
-            serde_norway::from_slice(consultation_bytes).expect("consultation Relay config parses");
-
-        assert_eq!(
-            compiled
-                .relay_private
-                .keys()
-                .map(PathBuf::as_path)
-                .collect::<BTreeSet<_>>(),
-            BTreeSet::from([
-                Path::new("config/relay.yaml"),
-                Path::new("descriptors/operations.json"),
-                Path::new("descriptors/secret-consumers.json"),
-            ]),
-            "the public Relay input contains only instance-applicable generated members"
-        );
-        let referenced_artifacts = consultation["consultation"]["artifacts"]
-            .as_object()
-            .expect("consultation artifact closure exists")
-            .values()
-            .flat_map(|entries| {
-                entries
-                    .as_array()
-                    .expect("consultation artifact class is a list")
-            })
-            .map(|entry| {
-                entry["path"]
-                    .as_str()
-                    .expect("consultation artifact has a path")
-            })
-            .collect::<BTreeSet<_>>();
-        let vendored_artifacts = compiled
-            .relay_consultation_private
-            .keys()
-            .filter_map(|path| path.strip_prefix("config").ok())
-            .filter_map(|path| path.to_str())
-            .filter(|path| path.starts_with("artifacts/"))
-            .collect::<BTreeSet<_>>();
-        assert_eq!(
-            vendored_artifacts, referenced_artifacts,
-            "the consultation Relay input vendors exactly its selected artifacts"
-        );
+        let consultation: Value = serde_norway::from_slice(consultation_bytes)
+            .expect("consultation Relay config parses");
 
         assert!(public.get("consultation").is_none());
         assert!(consultation.get("consultation").is_some());
-        assert_eq!(public["instance"]["id"], "household-relay");
-        assert_eq!(
-            consultation["instance"]["id"],
-            "household-relay-consultation"
+        assert_ne!(public["instance"]["id"], consultation["instance"]["id"]);
+        assert!(
+            public["auth"]["oidc"]["allowed_clients"]
+                .as_array()
+                .expect("public OIDC allowlist is an array")
+                .iter()
+                .any(|client| client == "household-relay-client"),
+            "the public Relay admits its public client"
         );
-        assert_eq!(
-            public["auth"]["oidc"]["allowed_clients"],
-            json!(["household-relay-client"])
+        assert!(
+            !public["auth"]["oidc"]["allowed_clients"]
+                .as_array()
+                .expect("public OIDC allowlist is an array")
+                .iter()
+                .any(|client| client == "household-consultation-client"),
+            "the public Relay must not admit the consultation workload client"
         );
         assert_eq!(
             consultation["auth"]["oidc"]["allowed_clients"],
-            json!(["household-notary"])
+            json!(["household-consultation-client"]),
+            "the consultation Relay admits only its bound workload client"
         );
         assert_eq!(
-            consultation["auth"]["oidc"]["allow_dev_insecure_fetch_urls"],
-            false
+            consultation["consultation"]["authorized_workload"]["client_claim_selector"],
+            "azp"
         );
-        let public_operations: Value = serde_json::from_slice(
-            compiled
-                .relay_private
-                .get(Path::new("descriptors/operations.json"))
-                .expect("public Relay operations descriptor exists"),
-        )
-        .expect("public Relay operations descriptor parses");
-        let consultation_operations: Value = serde_json::from_slice(
-            compiled
-                .relay_consultation_private
-                .get(Path::new("descriptors/operations.json"))
-                .expect("consultation Relay operations descriptor exists"),
-        )
-        .expect("consultation Relay operations descriptor parses");
-        assert_eq!(public_operations["service"], "household-relay");
-        assert_eq!(public_operations["consultation_profiles"], 0);
         assert_eq!(
-            consultation_operations["service"],
-            "household-relay-consultation"
+            consultation["consultation"]["authorized_workload"]["client_value"],
+            "household-consultation-client"
+        );
+        assert_eq!(
+            consultation["consultation"]["authorized_workload"]["principal_id"],
+            "household-consultation-principal"
+        );
+        assert_ne!(
+            consultation["consultation"]["authorized_workload"]["client_value"],
+            consultation["consultation"]["authorized_workload"]["principal_id"],
+            "the azp client and sub principal remain distinct identities"
         );
-        assert_eq!(consultation_operations["consultation_profiles"], 1);
-
-        for (files, config) in [
-            (&compiled.relay_private, &public),
-            (&compiled.relay_consultation_private, &consultation),
-        ] {
-            let descriptor: Value = serde_json::from_slice(
-                files
-                    .get(Path::new("descriptors/secret-consumers.json"))
-                    .expect("Relay secret-consumer descriptor exists"),
-            )
-            .expect("Relay secret-consumer descriptor parses");
-            assert_eq!(
-                descriptor,
-                secret_consumer_descriptor("registry-relay", config),
-                "each Relay instance describes only the secrets selected by its primary config"
-            );
-        }
         assert_eq!(
             compiled.approval_state["generated_closure_digests"]["relay"],
             json!(closure_digest(&compiled.relay_private).expect("public Relay closure digests"))
@@ -1524,11 +1304,6 @@ outputs:
             json!(closure_digest(&compiled.relay_consultation_private)
                 .expect("consultation Relay closure digests"))
         );
-        assert_ne!(
-            compiled.approval_state["generated_closure_digests"]["relay"],
-            compiled.approval_state["generated_closure_digests"]["relay_consultation"],
-            "the approval state independently binds both Relay instances"
-        );
         validate_generated_relay(public_bytes, &compiled.relay_private, "config/relay.yaml")
             .expect("public Relay passes production loading");
         validate_generated_relay(
@@ -1540,116 +1315,40 @@ outputs:
     }
 
     #[test]
-    fn local_notary_add_on_uses_stable_issuer_and_mounted_jwks_file() {
-        let mut loaded = load_registry_project(&project_golden("custom-system"), Some("local"))
-            .expect("golden project loads");
-        let environment = loaded.environment.as_mut().expect("environment exists");
-        environment
-            .relay
-            .as_mut()
-            .expect("Relay binding exists")
-            .local_api_keys = Some(RelayLocalApiKeyBinding {
-            match_principal: "local_match".to_string(),
-            no_match_principal: "local_no_match".to_string(),
-            scopes: vec!["registry_relay:ops_read".to_string()],
-        });
-        environment
-            .deployment
-            .notary
-            .as_mut()
-            .expect("Notary deployment exists")
-            .service = "registryctl-local-notary".to_string();
-
-        let unrelated =
-            compile_project(&loaded, None).expect("non-canonical local project compiles");
-        let unrelated_consultation: Value = serde_norway::from_slice(
-            unrelated
+    fn generated_local_api_key_validation_preserves_refs_and_rejects_malformed_or_duplicate_keys() {
+        let project =
+            Path::new(env!("CARGO_MANIFEST_DIR")).join("assets/project-starters/spreadsheet");
+        let loaded =
+            load_registry_project(&project, Some("local")).expect("spreadsheet starter loads");
+        let compiled = compile_project(&loaded, None).expect("spreadsheet starter compiles");
+        let relay = compiled
+            .relay_private
+            .get(Path::new("config/relay.yaml"))
+            .expect("Relay config exists");
+        let original: Value = serde_norway::from_slice(relay).expect("Relay config parses");
+        let consultation: Value = serde_norway::from_slice(
+            compiled
                 .relay_consultation_private
                 .get(Path::new("config/relay.yaml"))
                 .expect("consultation Relay config exists"),
         )
         .expect("consultation Relay config parses");
-        assert_eq!(
-            unrelated_consultation["auth"]["oidc"]["issuer"],
-            "https://workload-issuer.internal.invalid"
-        );
-        assert_eq!(
-            unrelated_consultation["auth"]["oidc"]["jwks_url"],
-            "https://workload-issuer.internal.invalid/.well-known/jwks.json"
-        );
-        assert_eq!(
-            unrelated_consultation["auth"]["oidc"]["allow_dev_insecure_fetch_urls"],
-            false
-        );
-
-        let binding = loaded
-            .environment
-            .as_mut()
-            .expect("environment exists")
-            .notary_relay
-            .as_mut()
-            .expect("Notary-to-Relay binding exists");
-        binding.base_url = "http://10.89.0.4:8080".to_string();
-        binding.workload_client_id = "registryctl-local-notary".to_string();
-        binding.token_file = PathBuf::from("/run/secrets/relay-workload-token");
-        loaded
-            .environment
-            .as_mut()
-            .expect("environment exists")
-            .relay
-            .as_mut()
-            .expect("Relay binding exists")
-            .issuer = "https://registryctl-local-notary.invalid".to_string();
-
-        let compiled = compile_project(&loaded, None).expect("local add-on project compiles");
-        let public: Value = serde_norway::from_slice(
-            compiled
-                .relay_private
-                .get(Path::new("config/relay.yaml"))
-                .expect("public Relay config exists"),
-        )
-        .expect("public Relay config parses");
-        let consultation_bytes = compiled
-            .relay_consultation_private
-            .get(Path::new("config/relay.yaml"))
-            .expect("consultation Relay config exists");
-        let consultation: Value =
-            serde_norway::from_slice(consultation_bytes).expect("consultation Relay config parses");
 
-        assert_eq!(public["auth"]["mode"], "api_key");
+        assert_eq!(original["auth"]["mode"], "api_key");
         assert_eq!(consultation["auth"]["mode"], "oidc");
         assert_eq!(
-            consultation["auth"]["oidc"]["issuer"],
-            "https://registryctl-local-notary.invalid"
+            consultation["auth"]["oidc"]["allowed_clients"],
+            json!(["public-works-consultation-client"]),
+            "public local API keys do not broaden consultation workload admission"
         );
         assert_eq!(
-            consultation["auth"]["oidc"]["development_jwks_file"],
-            "/run/registry/dev-public/notary-workload-jwks.json"
+            consultation["consultation"]["authorized_workload"]["client_value"],
+            "public-works-consultation-client"
         );
-        assert!(consultation["auth"]["oidc"].get("jwks_url").is_none());
-        assert!(consultation["auth"]["oidc"]
-            .get("discovery_url")
-            .is_none());
         assert_eq!(
-            consultation["auth"]["oidc"]["allow_dev_insecure_fetch_urls"],
-            false
+            consultation["consultation"]["authorized_workload"]["principal_id"],
+            "public-works-consultation-principal"
         );
-        validate_generated_product_configs(&compiled)
-            .expect("local add-on product configs pass production validation");
-    }
-
-    #[test]
-    fn generated_local_api_key_validation_preserves_refs_and_rejects_malformed_or_duplicate_keys() {
-        let project =
-            Path::new(env!("CARGO_MANIFEST_DIR")).join("assets/project-starters/spreadsheet");
-        let loaded =
-            load_registry_project(&project, Some("local")).expect("spreadsheet starter loads");
-        let compiled = compile_project(&loaded, None).expect("spreadsheet starter compiles");
-        let relay = compiled
-            .relay_private
-            .get(Path::new("config/relay.yaml"))
-            .expect("Relay config exists");
-        let original: Value = serde_norway::from_slice(relay).expect("Relay config parses");
 
         validate_generated_relay(relay, &compiled.relay_private, "config/relay.yaml")
             .expect("temporary validation credentials satisfy production loading");
@@ -1804,75 +1503,6 @@ outputs:
         assert!(cel_member_roots("person.exists && 'unterminated").is_err());
     }
 
-    #[test]
-    fn registry_cel_claims_reject_structured_members_and_constant_only_rules() {
-        let mut loaded =
-            load_registry_project(&project_golden("opencrvs"), None).expect("OpenCRVS project loads");
-        let set_claim_expression = |loaded: &mut LoadedRegistryProject, expression: &str| {
-            let claim = loaded
-                .project
-                .services
-                .get_mut("birth-verification")
-                .and_then(|service| service.claims.get_mut("parents"))
-                .expect("structured parents claim exists");
-            claim.output = None;
-            claim.cel = Some(expression.to_string());
-        };
-        set_claim_expression(
-            &mut loaded,
-            "birth.parents.exists(parent, parent.name != '')",
-        );
-
-        let error = validate_service_integration_links(&loaded.project, &loaded.integrations)
-            .expect_err("structured consultation members must not enter authored CEL claims");
-        assert!(error.to_string().contains(
-            "service birth-verification claim parents CEL cannot reference structured consultation output birth.parents"
-        ));
-
-        set_claim_expression(&mut loaded, r#"birth["parents"] != null"#);
-        let error = validate_service_integration_links(&loaded.project, &loaded.integrations)
-            .expect_err("registry-backed CEL index access must fail before generation");
-        assert!(error
-            .to_string()
-            .contains("registry-backed CEL cannot use index access"));
-
-        set_claim_expression(&mut loaded, "['literal-value'][0] == 'literal-value'");
-        let error = validate_service_integration_links(&loaded.project, &loaded.integrations)
-            .expect_err("constant-only CEL cannot replace Registry evidence");
-        assert!(error
-            .to_string()
-            .contains("every claim must derive from one declared Relay consultation"));
-    }
-
-    #[test]
-    fn secret_descriptor_includes_named_environment_providers() {
-        let descriptor = secret_consumer_descriptor(
-            "registry-notary",
-            &json!({
-                "authentication": {
-                    "fingerprint": { "provider": "env", "name": "CALLER_TOKEN_HASH" },
-                },
-                "audit": {
-                    "source": {
-                        "provider": "environment",
-                        "name": "AUDIT_PSEUDONYM_EPOCH_1",
-                    },
-                },
-            }),
-        );
-        let consumers = descriptor["consumers"]
-            .as_array()
-            .expect("descriptor consumers are present");
-        assert!(consumers.iter().any(|consumer| {
-            consumer["locator"] == "CALLER_TOKEN_HASH"
-                && consumer["config_pointer"] == "/authentication/fingerprint/name"
-        }));
-        assert!(consumers.iter().any(|consumer| {
-            consumer["locator"] == "AUDIT_PSEUDONYM_EPOCH_1"
-                && consumer["config_pointer"] == "/audit/source/name"
-        }));
-    }
-
     #[test]
     fn released_rhai_capability_identity_is_not_a_source_product() {
         assert!(is_script_runtime_released(ReleasedScriptRuntime::RhaiV1));
@@ -1882,177 +1512,21 @@ outputs:
         ));
     }
 
-    #[test]
-    fn duplicate_project_claim_ids_fail_before_generation() {
-        let project = project_golden("custom-system");
-        let mut loaded = load_registry_project(&project, None).expect("golden project loads");
-        let duplicate: ServiceDeclaration = serde_json::from_value(
-            serde_json::to_value(&loaded.project.services["household-eligibility"])
-                .expect("service serializes"),
-        )
-        .expect("service clones through its strict model");
-        loaded
-            .project
-            .services
-            .insert("duplicate-service".to_string(), duplicate);
-        let error = validate_project_shape(&loaded.project)
-            .expect_err("duplicate project claim ids must fail closed");
-        assert!(error
-            .to_string()
-            .contains("claim ids must be unique across project services"));
-    }
-
-    #[test]
-    fn generated_notary_validation_rejects_empty_claim_formats() {
-        let loaded = load_registry_project(&project_golden("custom-system"), Some("local"))
-            .expect("golden project loads");
-        let mut compiled = compile_project(&loaded, None).expect("golden project compiles");
-        let config_path = Path::new("config/notary.yaml").to_path_buf();
-        let mut notary: Value = serde_norway::from_slice(
-            compiled
-                .notary_private
-                .get(&config_path)
-                .expect("Notary config exists"),
-        )
-        .expect("generated Notary config parses");
-        notary["evidence"]["claims"][0]["formats"] = Value::Array(Vec::new());
-        compiled.notary_private.insert(
-            config_path,
-            serde_norway::to_string(&notary)
-                .expect("tampered Notary config serializes")
-                .into_bytes()
-                .into_boxed_slice(),
-        );
-
-        let error = validate_generated_notary(&compiled)
-            .expect_err("generated validation must reject an empty formats list");
-        let diagnostic = format!("{error:#}");
-        assert!(diagnostic.contains("formats must not be empty"));
-        assert!(diagnostic.contains("omit formats"));
-    }
-
-    #[test]
-    fn generated_products_persist_audit_records_to_the_managed_volume() {
-        let loaded = load_registry_project(&project_golden("custom-system"), Some("local"))
-            .expect("golden project loads");
-        let compiled = compile_project(&loaded, None).expect("golden project compiles");
-        let product_configs = [
-            (
-                "Relay",
-                compiled
-                    .relay_private
-                    .get(Path::new("config/relay.yaml"))
-                    .expect("Relay config exists"),
-            ),
-            (
-                "consultation Relay",
-                compiled
-                    .relay_consultation_private
-                    .get(Path::new("config/relay.yaml"))
-                    .expect("consultation Relay config exists"),
-            ),
-            (
-                "Notary",
-                compiled
-                    .notary_private
-                    .get(Path::new("config/notary.yaml"))
-                    .expect("Notary config exists"),
-            ),
-        ];
-
-        for (product, bytes) in product_configs {
-            let config: Value =
-                serde_norway::from_slice(bytes).expect("generated product config parses");
-            assert_eq!(
-                config.pointer("/audit/sink"),
-                Some(&json!("file")),
-                "{product} must use a durable audit sink"
-            );
-            assert_eq!(
-                config.pointer("/audit/path"),
-                Some(&json!("/var/lib/registry/audit/audit.jsonl")),
-                "{product} must write to the managed audit volume"
-            );
-        }
-    }
-
-    #[test]
-    fn disclosure_review_classes_are_directional() {
-        let loaded = load_registry_project(&project_golden("custom-system"), None)
-            .expect("golden project loads");
-        let original = disclosure_review_profiles(&loaded.project);
-        let baseline = json!({ "disclosure_profiles": original });
-
-        let mut narrowed = disclosure_review_profiles(&loaded.project);
-        narrowed
-            .get_mut("household-eligibility")
-            .expect("service profile exists")
-            .insert(
-                "household-category".to_string(),
-                DisclosureReviewProfile {
-                    default: DisclosureMode::Redacted,
-                    allowed: BTreeSet::from([DisclosureMode::Redacted]),
-                },
-            );
-        assert_eq!(
-            disclosure_change_classes(&narrowed, Some(&baseline)),
-            (true, false)
-        );
-
-        let mut widened = disclosure_review_profiles(&loaded.project);
-        widened
-            .get_mut("household-eligibility")
-            .expect("service profile exists")
-            .insert(
-                "household-record-exists".to_string(),
-                DisclosureReviewProfile {
-                    default: DisclosureMode::Value,
-                    allowed: BTreeSet::from([DisclosureMode::Value, DisclosureMode::Redacted]),
-                },
-            );
-        assert_eq!(
-            disclosure_change_classes(&widened, Some(&baseline)),
-            (false, true)
-        );
-
-        let mut mixed = narrowed;
-        mixed
-            .get_mut("household-eligibility")
-            .expect("service profile exists")
-            .insert(
-                "household-record-exists".to_string(),
-                DisclosureReviewProfile {
-                    default: DisclosureMode::Value,
-                    allowed: BTreeSet::from([DisclosureMode::Value, DisclosureMode::Redacted]),
-                },
-            );
-        assert_eq!(
-            disclosure_change_classes(&mixed, Some(&baseline)),
-            (true, true)
-        );
-    }
-
     #[test]
     fn compiler_upgrade_is_reported_independently_of_authored_semantic_changes() {
         let loaded = load_registry_project(&project_golden("custom-system"), None)
             .expect("golden project loads");
-        let disclosure_digest = format!("sha256:{}", "a".repeat(64));
         let baseline = json!({
             "compiler_version": "0.0.0",
             "semantic_digests": {
-                "claim": format!("sha256:{}", "0".repeat(64)),
                 "integration": loaded.semantic_digests.integration.as_str(),
                 "service_policy": loaded.semantic_digests.service_policy.as_str(),
                 "operator_security": loaded.semantic_digests.operator_security.as_str(),
             },
-            "disclosure_digest": disclosure_digest,
         });
         assert_eq!(
-            semantic_change_records(&loaded, Some(&baseline), &disclosure_digest)
-                .into_iter()
-                .map(|change| change.dimension)
-                .collect::<BTreeSet<_>>(),
-            BTreeSet::from(["claim", "compiler"]),
+            changed_semantic_dimensions(&loaded, Some(&baseline)),
+            vec![SemanticDimension::Compiler],
         );
     }
 
@@ -2117,13 +1591,6 @@ outputs:
             .to_string()
             .contains("missing or unknown fields"));
 
-        let mut inconsistent_products = approval_state.clone();
-        inconsistent_products["promotion_projection"]["products"] = json!(["relay"]);
-        assert!(validate_signed_approval_state(&inconsistent_products)
-            .expect_err("projection products must match signed generated closures")
-            .to_string()
-            .contains("product inventory disagrees"));
-
         let mut missing_projection = approval_state.clone();
         missing_projection
             .as_object_mut()
@@ -2342,3 +1809,23 @@ source:
         assert!(serde_norway::from_str::<EnvironmentIntegration>(legacy).is_err());
     }
 }
+
+/// `registryctl dev` compiles this projection before it reaches Docker, so an
+/// `init` template that cannot produce one has no development path at all.
+#[test]
+fn every_init_template_compiles_a_development_runtime_projection() {
+    for starter in [ProjectStarter::Http, ProjectStarter::Spreadsheet] {
+        let temporary = tempfile::tempdir().expect("temporary directory");
+        let project = temporary.path().join("registry-project");
+        init_registry_project(&ProjectInitOptions {
+            starter,
+            directory: project.clone(),
+        })
+        .expect("starter initializes");
+
+        let authoring = compile_dev_runtime_authoring(&project, "local")
+            .unwrap_or_else(|error| panic!("{starter:?} has no development plan: {error}"));
+
+        assert_eq!(authoring.scenarios.len(), 1, "{starter:?}");
+    }
+}
diff --git a/crates/registryctl/src/release_lock.rs b/crates/registryctl/src/release_lock.rs
index a90ef9750..cad42a8be 100644
--- a/crates/registryctl/src/release_lock.rs
+++ b/crates/registryctl/src/release_lock.rs
@@ -20,7 +20,11 @@ use sigstore_verify::types::Bundle;
 use sigstore_verify::{verify, VerificationPolicy};
 
 pub const RELEASE_LOCK_SCHEMA_ID: &str = "io.registrystack.registry_release_lock";
-pub const RELEASE_LOCK_SCHEMA_VERSION: &str = "1.0";
+/// Version `2.0` because the Registry Notary retirement removed the Notary
+/// image, runtime recipe, and config-schema members from the signed payload.
+/// The published schemas and `release/scripts/registry_release_lock.py`
+/// declare the same version; they are one contract in three places.
+pub const RELEASE_LOCK_SCHEMA_VERSION: &str = "2.0";
 
 const RELEASE_REPOSITORY: &str = "registrystack/registry-stack";
 const RELEASE_WORKFLOW: &str = ".github/workflows/release.yml";
@@ -37,8 +41,6 @@ const TRUST_ANCHOR_SCHEMA: &str = "registry.platform.config_trust_anchor.v1";
 const ANCHOR_TRANSITION_SCHEMA: &str = "registry.platform.anchor_transition@1.0";
 const RELAY_CONFIG_SCHEMA: &str =
     "https://id.registrystack.org/schemas/registry-relay/registry-relay.config.schema.json";
-const NOTARY_CONFIG_SCHEMA: &str =
-    "https://id.registrystack.org/schemas/registry-notary/registry-notary.config.schema.json";
 const PRODUCT_BUNDLE_TARGET: &str = "/run/registry/bundle";
 const PRODUCT_ANCHOR_TARGET: &str = "/run/registry/anchor";
 const PRODUCT_STATE_TARGET: &str = "/var/lib/registry/state";
@@ -49,16 +51,12 @@ const POSTGRESQL_DATA_TARGET: &str = "/var/lib/postgresql/data";
 // authorize the exact reviewed script, not a shell command that contains a
 // few expected fragments.
 const POSTGRESQL_BOOTSTRAP_SCRIPT_SHA256: &str =
-    "cbad443afb9700702df52be6513cf8afd95b97747d75a0a417df4fd079a2e79c";
-const POSTGRESQL_BOOTSTRAP_KEYS: [&str; 8] = [
+    "02515ab47034a241554bc13f616de00c14b42a36139d6d07a1a53e52c6c28f0e";
+const POSTGRESQL_BOOTSTRAP_KEYS: [&str; 4] = [
     "REGISTRY_RELAY_MIGRATOR_PASSWORD",
     "REGISTRY_RELAY_RUNTIME_PASSWORD",
     "REGISTRY_RELAY_MAINTENANCE_PASSWORD",
     "REGISTRY_RELAY_READER_PASSWORD",
-    "REGISTRY_NOTARY_MIGRATOR_PASSWORD",
-    "REGISTRY_NOTARY_RUNTIME_PASSWORD",
-    "REGISTRY_NOTARY_MAINTENANCE_PASSWORD",
-    "REGISTRY_NOTARY_READER_PASSWORD",
 ];
 
 /// The strict, self-contained wire envelope shipped as
@@ -163,7 +161,6 @@ pub struct LockedOciImageV1 {
 #[serde(deny_unknown_fields)]
 pub struct LockedManagedImagesV1 {
     pub relay: LockedOciImageV1,
-    pub notary: LockedOciImageV1,
     pub postgresql_state_plane: LockedOciImageV1,
 }
 
@@ -225,8 +222,6 @@ pub enum LockedOperatorFileFormatV1 {
     Dotenv,
     PemCertificate,
     PemPrivateKey,
-    JsonWebKey,
-    CompactJwt,
     Opaque,
 }
 
@@ -265,7 +260,6 @@ pub struct LockedPostgresqlRecipeV1 {
 pub struct LockedRuntimeRecipesV1 {
     pub relay_public: LockedProductRecipeV1,
     pub relay_consultation: LockedProductRecipeV1,
-    pub notary: LockedProductRecipeV1,
     pub postgresql_state_plane: LockedPostgresqlRecipeV1,
     pub operator_files: Vec<LockedOperatorFileV1>,
 }
@@ -278,7 +272,6 @@ pub struct SupportedContractsV1 {
     pub trust_anchor_schema: String,
     pub anchor_transition_schema: String,
     pub relay_config_schema: String,
-    pub notary_config_schema: String,
 }
 
 #[derive(Clone, Deserialize, Serialize)]
@@ -317,8 +310,6 @@ impl RetainedVerifiedEnvelope {
 pub struct VerifiedManagedImagesV1 {
     relay: String,
     relay_platform: OciPlatformV1,
-    notary: String,
-    notary_platform: OciPlatformV1,
     postgresql_state_plane: String,
     postgresql_state_plane_platform: OciPlatformV1,
 }
@@ -332,14 +323,6 @@ impl VerifiedManagedImagesV1 {
         self.relay_platform
     }
 
-    pub fn notary(&self) -> &str {
-        &self.notary
-    }
-
-    pub fn notary_platform(&self) -> OciPlatformV1 {
-        self.notary_platform
-    }
-
     pub fn postgresql_state_plane(&self) -> &str {
         &self.postgresql_state_plane
     }
@@ -468,7 +451,6 @@ impl VerifiedPostgresqlRuntimeV1 {
 pub struct VerifiedRuntimeMappingV1 {
     relay_public: VerifiedProductRuntimeV1,
     relay_consultation: VerifiedProductRuntimeV1,
-    notary: VerifiedProductRuntimeV1,
     postgresql_state_plane: VerifiedPostgresqlRuntimeV1,
     operator_files: Vec<LockedOperatorFileV1>,
 }
@@ -482,10 +464,6 @@ impl VerifiedRuntimeMappingV1 {
         &self.relay_consultation
     }
 
-    pub fn notary(&self) -> &VerifiedProductRuntimeV1 {
-        &self.notary
-    }
-
     pub fn postgresql_state_plane(&self) -> &VerifiedPostgresqlRuntimeV1 {
         &self.postgresql_state_plane
     }
@@ -554,8 +532,6 @@ impl VerifiedReleaseLockV1 {
         VerifiedManagedImagesV1 {
             relay: self.lock.images.relay.identity.clone(),
             relay_platform: self.lock.images.relay.platforms[0].platform,
-            notary: self.lock.images.notary.identity.clone(),
-            notary_platform: self.lock.images.notary.platforms[0].platform,
             postgresql_state_plane: self.lock.images.postgresql_state_plane.identity.clone(),
             postgresql_state_plane_platform: self.lock.images.postgresql_state_plane.platforms[0]
                 .platform,
@@ -566,7 +542,6 @@ impl VerifiedReleaseLockV1 {
         VerifiedRuntimeMappingV1 {
             relay_public: self.lock.runtime.relay_public.clone().into(),
             relay_consultation: self.lock.runtime.relay_consultation.clone().into(),
-            notary: self.lock.runtime.notary.clone().into(),
             postgresql_state_plane: self.lock.runtime.postgresql_state_plane.clone().into(),
             operator_files: self.lock.runtime.operator_files.clone(),
         }
@@ -602,9 +577,10 @@ impl From<LockedProductRecipeV1> for VerifiedProductRuntimeV1 {
     }
 }
 
-/// Verify a package lock without network access or adopter-supplied trust
-/// material. A newer Registryctl 1.x may inspect and deploy an older signed 1.x
-/// package, so this boundary intentionally does not bind the running binary.
+/// Verify a Relay-only package lock without network access or adopter-supplied
+/// trust material. This boundary intentionally does not bind the running
+/// binary, but retired Notary-bearing payloads are outside the closed schema
+/// and must be rebuilt before deployment.
 pub fn verify_release_lock_for_package(bytes: &[u8]) -> Result<VerifiedReleaseLockV1> {
     let verified = verify_release_lock_material(bytes)?;
     if release_major(verified.product_version())? != 1 {
@@ -856,7 +832,6 @@ impl LockedReleaseIdentityV1 {
 impl LockedManagedImagesV1 {
     fn validate(&self) -> Result<()> {
         self.relay.validate("Relay")?;
-        self.notary.validate("Notary")?;
         self.postgresql_state_plane
             .validate("PostgreSQL state plane")
     }
@@ -894,7 +869,6 @@ impl LockedRuntimeRecipesV1 {
     fn validate(&self) -> Result<()> {
         self.relay_public.validate("Relay public")?;
         self.relay_consultation.validate("Relay consultation")?;
-        self.notary.validate("Notary")?;
         self.postgresql_state_plane
             .validate("PostgreSQL state plane")?;
         validate_operator_files(self)?;
@@ -1041,7 +1015,6 @@ fn validate_product_recipe_shape(recipe: &LockedProductRecipeV1, label: &str) ->
     let id = match label {
         "Relay public" => "relay-public",
         "Relay consultation" => "relay-consultation",
-        "Notary" => "notary",
         _ => bail!("product runtime recipe label is unsupported"),
     };
     let environment = format!("{id}-environment");
@@ -1087,11 +1060,6 @@ fn validate_product_recipe_shape(recipe: &LockedProductRecipeV1, label: &str) ->
     let serve_secrets: &[&str] = match id {
         "relay-public" => &[],
         "relay-consultation" => &["postgresql-tls-certificate"],
-        "notary" => &[
-            "postgresql-tls-certificate",
-            "notary-relay-workload-credential",
-            "notary-signing-key",
-        ],
         _ => unreachable!(),
     };
     validate_action_shape(
@@ -1234,10 +1202,9 @@ fn validate_mount_access(
 }
 
 fn validate_product_recipe_commands(recipe: &LockedProductRecipeV1, label: &str) -> Result<()> {
-    let (product, lane) = match label {
-        "Relay public" => ("registry-relay", Some("relay-public")),
-        "Relay consultation" => ("registry-relay", Some("relay-consultation")),
-        "Notary" => ("registry-notary", None),
+    let lane = match label {
+        "Relay public" => "relay-public",
+        "Relay consultation" => "relay-consultation",
         _ => bail!("product runtime recipe label is unsupported"),
     };
     for (name, action) in [
@@ -1248,11 +1215,7 @@ fn validate_product_recipe_commands(recipe: &LockedProductRecipeV1, label: &str)
         ("accept_state", &recipe.accept_state),
         ("verify_state", &recipe.verify_state),
     ] {
-        let expected = if let Some(lane) = lane {
-            vec!["product-action", lane, name]
-        } else {
-            vec!["product-action", name]
-        };
+        let expected = ["product-action", lane, name];
         validate_exact_command(
             &action.command,
             &expected,
@@ -1267,31 +1230,21 @@ fn validate_product_recipe_commands(recipe: &LockedProductRecipeV1, label: &str)
         ("initialize_state", &recipe.development_initialize_state),
         ("serve", &recipe.development_serve),
     ] {
-        let expected = if let Some(lane) = lane {
-            vec!["development-action", lane, name]
-        } else {
-            vec!["development-action", name]
-        };
+        let expected = ["development-action", lane, name];
         validate_exact_command(
             &action.command,
             &expected,
             &format!("{label} development {name} command"),
         )?;
     }
-    let health_binary = format!("/usr/local/bin/{product}");
-    let health_url = if product == "registry-notary" {
-        "http://127.0.0.1:8081/ready"
-    } else {
-        "http://127.0.0.1:8080/ready"
-    };
     validate_exact_command(
         &recipe.health_probe,
         &[
             "CMD",
-            health_binary.as_str(),
+            "/usr/local/bin/registry-relay",
             "healthcheck",
             "--url",
-            health_url,
+            "http://127.0.0.1:8080/ready",
         ],
         &format!("{label} health probe"),
     )
@@ -1415,11 +1368,7 @@ fn validate_operator_files(runtime: &LockedRuntimeRecipesV1) -> Result<()> {
                 .map(|projection| projection.file_id.clone()),
         );
     };
-    for product in [
-        &runtime.relay_public,
-        &runtime.relay_consultation,
-        &runtime.notary,
-    ] {
+    for product in [&runtime.relay_public, &runtime.relay_consultation] {
         collect(&product.prepare_state_store);
         collect(&product.initialize_state);
         collect(&product.preview_state);
@@ -1441,23 +1390,11 @@ fn validate_operator_files(runtime: &LockedRuntimeRecipesV1) -> Result<()> {
 fn validate_operator_file_contract(file: &LockedOperatorFileV1) -> Result<()> {
     let (format, allowed_owners, required_keys): (LockedOperatorFileFormatV1, &[&str], &[&str]) =
         match file.id.as_str() {
-            "relay-public-environment"
-            | "relay-consultation-environment"
-            | "notary-environment" => (
+            "relay-public-environment" | "relay-consultation-environment" => (
                 LockedOperatorFileFormatV1::Dotenv,
                 &["root:root", "65532:65532"],
                 &[],
             ),
-            "notary-signing-key" => (
-                LockedOperatorFileFormatV1::JsonWebKey,
-                &["root:root", "65532:65532"],
-                &[],
-            ),
-            "notary-relay-workload-credential" => (
-                LockedOperatorFileFormatV1::CompactJwt,
-                &["root:root", "65532:65532"],
-                &[],
-            ),
             "postgresql-tls-certificate" => (
                 LockedOperatorFileFormatV1::PemCertificate,
                 &["root:root", "65532:65532", "999:999"],
@@ -1528,7 +1465,6 @@ impl SupportedContractsV1 {
             self.trust_anchor_schema.as_str(),
             self.anchor_transition_schema.as_str(),
             self.relay_config_schema.as_str(),
-            self.notary_config_schema.as_str(),
         ];
         let expected = [
             CONFIG_BUNDLE_SCHEMA,
@@ -1536,7 +1472,6 @@ impl SupportedContractsV1 {
             TRUST_ANCHOR_SCHEMA,
             ANCHOR_TRANSITION_SCHEMA,
             RELAY_CONFIG_SCHEMA,
-            NOTARY_CONFIG_SCHEMA,
         ];
         if actual != expected {
             bail!("release lock supported-contract roster is unsupported");
@@ -1712,11 +1647,6 @@ mod tests {
     }
 
     fn command_recipe(product: &str, lane: Option<&str>) -> LockedProductRecipeV1 {
-        let health_url = if product == "registry-notary" {
-            "http://127.0.0.1:8081/ready"
-        } else {
-            "http://127.0.0.1:8080/ready"
-        };
         let action = |name: &str| {
             let mut command = vec!["product-action"];
             if let Some(lane) = lane {
@@ -1748,7 +1678,7 @@ mod tests {
                 format!("/usr/local/bin/{product}"),
                 "healthcheck".to_string(),
                 "--url".to_string(),
-                health_url.to_string(),
+                "http://127.0.0.1:8080/ready".to_string(),
             ],
         }
     }
@@ -1762,7 +1692,6 @@ mod tests {
                 "registry-relay",
                 Some("relay-consultation"),
             ),
-            ("Notary", "registry-notary", None),
         ] {
             let recipe = command_recipe(product, lane);
             assert_eq!(
@@ -1772,11 +1701,7 @@ mod tests {
                     format!("/usr/local/bin/{product}"),
                     "healthcheck".to_string(),
                     "--url".to_string(),
-                    if product == "registry-notary" {
-                        "http://127.0.0.1:8081/ready".to_string()
-                    } else {
-                        "http://127.0.0.1:8080/ready".to_string()
-                    },
+                    "http://127.0.0.1:8080/ready".to_string(),
                 ]
             );
             validate_product_recipe_commands(&recipe, label)
@@ -1932,22 +1857,8 @@ mod tests {
         environment.required_keys.push("DATABASE_URL".to_string());
         assert!(validate_operator_file_contract(&environment).is_err());
 
-        let mut notary_signing_key = LockedOperatorFileV1 {
-            id: "notary-signing-key".to_string(),
-            format: LockedOperatorFileFormatV1::JsonWebKey,
-            mode: "0600".to_string(),
-            allowed_owners: vec!["root:root".to_string(), "65532:65532".to_string()],
-            required_keys: Vec::new(),
-        };
-        validate_operator_file_contract(&notary_signing_key)
-            .expect("the Notary-only signing-key projection is accepted");
-        notary_signing_key
-            .allowed_owners
-            .push("999:999".to_string());
-        assert!(validate_operator_file_contract(&notary_signing_key).is_err());
-
         let listener_certificate = LockedOperatorFileV1 {
-            id: "notary-tls-certificate".to_string(),
+            id: "unsupported-tls-certificate".to_string(),
             format: LockedOperatorFileFormatV1::PemCertificate,
             mode: "0600".to_string(),
             allowed_owners: vec!["root:root".to_string(), "65532:65532".to_string()],
diff --git a/crates/registryctl/src/trust.rs b/crates/registryctl/src/trust.rs
index 33011503e..a6141fa59 100644
--- a/crates/registryctl/src/trust.rs
+++ b/crates/registryctl/src/trust.rs
@@ -204,6 +204,11 @@ fn rotate_trust_anchor_with_resolver(
     mut resolve: impl FnMut(&KeyLocator) -> Result<Zeroizing<String>>,
 ) -> Result<TrustAnchorRotateReportV1> {
     let current = load_trust_anchor_input(&options.current_anchor)?;
+    validate_selected_lane(
+        &current.acceptance_identity,
+        current.acceptance_identity.lane,
+    )
+    .context("current trust anchor is not a supported Relay lane")?;
     if current.acceptance_identity.trust_domain != ProductTrustDomainV1::Governed {
         bail!("current trust anchor must use the governed trust domain");
     }
@@ -333,7 +338,7 @@ fn sign_product_bundle_with_resolver(
     let (sequence, previous_config_hash, anchor_history) = if let Some(preceding_set) =
         &options.preceding_approved_set
     {
-        let lane = crate::ApprovedLaneV1::from_acceptance_lane(options.lane);
+        let lane = crate::ApprovedLaneV1::try_from_acceptance_lane(options.lane)?;
         let preceding = crate::approved_set::verify_approved_lane_from_set(preceding_set, lane)
             .context("failed to verify preceding approved lane before signing")?;
         if preceding.acceptance_identity() != &marker.acceptance_identity {
@@ -560,13 +565,11 @@ fn validate_selected_lane(
     if identity.lane != selected {
         bail!("selected signing lane does not match the signing-input acceptance identity");
     }
-    let expected_product = match selected {
-        ProductAcceptanceLaneV1::RelayPublic | ProductAcceptanceLaneV1::RelayConsultation => {
-            ProductAcceptanceProductV1::RegistryRelay
-        }
-        ProductAcceptanceLaneV1::Notary => ProductAcceptanceProductV1::RegistryNotary,
-    };
-    if identity.product != expected_product {
+    if !matches!(
+        selected,
+        ProductAcceptanceLaneV1::RelayPublic | ProductAcceptanceLaneV1::RelayConsultation
+    ) || identity.product != ProductAcceptanceProductV1::RegistryRelay
+    {
         bail!("selected signing lane does not match the acceptance-identity product");
     }
     if identity.trust_domain != ProductTrustDomainV1::Governed {
@@ -812,12 +815,13 @@ fn primary_config_path(
     lane: ProductAcceptanceLaneV1,
     files: &[SigningInputFile],
 ) -> Result<String> {
-    let expected = match lane {
-        ProductAcceptanceLaneV1::RelayPublic | ProductAcceptanceLaneV1::RelayConsultation => {
-            "config/relay.yaml"
-        }
-        ProductAcceptanceLaneV1::Notary => "config/notary.yaml",
-    };
+    if !matches!(
+        lane,
+        ProductAcceptanceLaneV1::RelayPublic | ProductAcceptanceLaneV1::RelayConsultation
+    ) {
+        bail!("signing-input lane is not supported by registryctl");
+    }
+    let expected = "config/relay.yaml";
     if !files.iter().any(|file| file.relative_path == expected) {
         bail!("signing-input closure lacks the selected lane's primary product configuration");
     }
@@ -1192,18 +1196,12 @@ mod tests {
             project: "civil-registry".to_string(),
             environment: "production".to_string(),
             lane,
-            product: match lane {
-                ProductAcceptanceLaneV1::RelayPublic
-                | ProductAcceptanceLaneV1::RelayConsultation => {
-                    ProductAcceptanceProductV1::RegistryRelay
-                }
-                ProductAcceptanceLaneV1::Notary => ProductAcceptanceProductV1::RegistryNotary,
-            },
+            product: ProductAcceptanceProductV1::RegistryRelay,
             stream: "civil-registry".to_string(),
             instance: match lane {
                 ProductAcceptanceLaneV1::RelayPublic => "relay".to_string(),
                 ProductAcceptanceLaneV1::RelayConsultation => "relay-consultation".to_string(),
-                ProductAcceptanceLaneV1::Notary => "notary".to_string(),
+                _ => "unsupported".to_string(),
             },
         }
     }
@@ -1220,12 +1218,7 @@ mod tests {
     }
 
     fn write_signing_input(root: &Path, identity: ProductAcceptanceIdentityV1) {
-        let config = match identity.lane {
-            ProductAcceptanceLaneV1::RelayPublic | ProductAcceptanceLaneV1::RelayConsultation => {
-                "config/relay.yaml"
-            }
-            ProductAcceptanceLaneV1::Notary => "config/notary.yaml",
-        };
+        let config = "config/relay.yaml";
         fs::create_dir_all(root.join("config")).expect("config directory creates");
         fs::write(root.join(config), b"instance:\n  id: synthetic\n").expect("config writes");
         let marker = SigningInputMarkerV1::governed(identity).expect("marker is valid");
@@ -1238,12 +1231,7 @@ mod tests {
 
     fn write_review_evidence(root: &Path, lane: ProductAcceptanceLaneV1) {
         fs::create_dir_all(root.join("approval")).unwrap();
-        let config = match lane {
-            ProductAcceptanceLaneV1::RelayPublic | ProductAcceptanceLaneV1::RelayConsultation => {
-                "config/relay.yaml"
-            }
-            ProductAcceptanceLaneV1::Notary => "config/notary.yaml",
-        };
+        let config = "config/relay.yaml";
         let config_digest =
             registry_platform_config::sha256_uri(&fs::read(root.join(config)).unwrap());
         let lane_closure = serde_json::json!([{
@@ -1254,7 +1242,7 @@ mod tests {
             registry_platform_config::sha256_uri(&canonicalize_json(&lane_closure).unwrap());
         let consultations = match lane {
             ProductAcceptanceLaneV1::RelayPublic => serde_json::json!({}),
-            ProductAcceptanceLaneV1::RelayConsultation | ProductAcceptanceLaneV1::Notary => {
+            ProductAcceptanceLaneV1::RelayConsultation => {
                 serde_json::json!({
                     "evidence.lookup": {
                         "profile_id": "profile",
@@ -1263,6 +1251,7 @@ mod tests {
                     }
                 })
             }
+            _ => serde_json::json!({}),
         };
         fs::write(
             root.join("approval/review.json"),
@@ -1276,7 +1265,7 @@ mod tests {
                     (match lane {
                         ProductAcceptanceLaneV1::RelayPublic => "relay",
                         ProductAcceptanceLaneV1::RelayConsultation => "relay_consultation",
-                        ProductAcceptanceLaneV1::Notary => "notary",
+                        _ => "unsupported",
                     }): lane_digest,
                 },
             }))
@@ -1304,7 +1293,8 @@ mod tests {
     #[test]
     fn signing_input_marker_is_canonical_and_binds_every_identity_dimension() {
         let marker =
-            SigningInputMarkerV1::governed(identity(ProductAcceptanceLaneV1::Notary)).unwrap();
+            SigningInputMarkerV1::governed(identity(ProductAcceptanceLaneV1::RelayConsultation))
+                .unwrap();
         let first = canonical_signing_input_marker(&marker).unwrap();
         let second = canonical_signing_input_marker(&marker).unwrap();
         assert_eq!(first, second);
@@ -1315,21 +1305,21 @@ mod tests {
                 "trust_domain": "governed",
                 "project": "civil-registry",
                 "environment": "production",
-                "lane": "notary",
-                "product": "registry-notary",
+                "lane": "relay-consultation",
+                "product": "registry-relay",
                 "stream": "civil-registry",
-                "instance": "notary",
+                "instance": "relay-consultation",
             })
         );
     }
 
     #[test]
-    fn signing_rejects_swapped_lane_and_every_identity_mismatch_without_key_resolution() {
+    fn signing_rejects_swapped_lane_and_identity_mismatches_without_key_resolution() {
         let temp = tempfile::tempdir().unwrap();
         let input = temp.path().join("input");
-        write_signing_input(&input, identity(ProductAcceptanceLaneV1::Notary));
+        write_signing_input(&input, identity(ProductAcceptanceLaneV1::RelayConsultation));
         let anchor_path = temp.path().join("anchor.json");
-        let base = identity(ProductAcceptanceLaneV1::Notary);
+        let base = identity(ProductAcceptanceLaneV1::RelayConsultation);
         write_anchor(&anchor_path, base.clone());
 
         let cases = [
@@ -1349,11 +1339,6 @@ mod tests {
                 value
             }),
             ("lane", identity(ProductAcceptanceLaneV1::RelayPublic)),
-            ("product", {
-                let mut value = base.clone();
-                value.product = ProductAcceptanceProductV1::RegistryRelay;
-                value
-            }),
             ("stream", {
                 let mut value = base.clone();
                 value.stream.push_str("-other");
@@ -1381,7 +1366,7 @@ mod tests {
             let calls = Cell::new(0);
             let error = sign_product_bundle_with_resolver(
                 &ProductBundleSignOptions {
-                    lane: ProductAcceptanceLaneV1::Notary,
+                    lane: ProductAcceptanceLaneV1::RelayConsultation,
                     input: input.clone(),
                     anchor: changed_anchor,
                     preceding_approved_set: None,
@@ -1421,7 +1406,7 @@ mod tests {
     fn anchor_create_sorts_keys_and_refuses_overwrite() {
         let temp = tempfile::tempdir().unwrap();
         let input = temp.path().join("input");
-        write_signing_input(&input, identity(ProductAcceptanceLaneV1::Notary));
+        write_signing_input(&input, identity(ProductAcceptanceLaneV1::RelayConsultation));
         let public = signer().jwk;
         let first = temp.path().join("first.jwk");
         let second = temp.path().join("second.jwk");
@@ -1429,7 +1414,7 @@ mod tests {
         fs::write(&second, serde_json::to_vec(&public).unwrap()).unwrap();
         let output = temp.path().join("anchor.json");
         let error = create_trust_anchor(&TrustAnchorCreateOptions {
-            lane: ProductAcceptanceLaneV1::Notary,
+            lane: ProductAcceptanceLaneV1::RelayConsultation,
             input: input.clone(),
             public_keys: vec![second, first],
             threshold: 1,
@@ -1441,7 +1426,7 @@ mod tests {
         let public_path = temp.path().join("public.jwk");
         fs::write(&public_path, serde_json::to_vec(&public).unwrap()).unwrap();
         create_trust_anchor(&TrustAnchorCreateOptions {
-            lane: ProductAcceptanceLaneV1::Notary,
+            lane: ProductAcceptanceLaneV1::RelayConsultation,
             input: input.clone(),
             public_keys: vec![public_path.clone()],
             threshold: 1,
@@ -1450,7 +1435,7 @@ mod tests {
         .expect("initial anchor creates");
         let before = fs::read(&output).unwrap();
         create_trust_anchor(&TrustAnchorCreateOptions {
-            lane: ProductAcceptanceLaneV1::Notary,
+            lane: ProductAcceptanceLaneV1::RelayConsultation,
             input,
             public_keys: vec![public_path],
             threshold: 1,
@@ -1464,7 +1449,7 @@ mod tests {
     fn bundle_signing_enforces_threshold_distinctness_and_self_verifies() {
         let temp = tempfile::tempdir().unwrap();
         let input = temp.path().join("input");
-        let identity = identity(ProductAcceptanceLaneV1::Notary);
+        let identity = identity(ProductAcceptanceLaneV1::RelayConsultation);
         write_signing_input(&input, identity.clone());
         let anchor_path = temp.path().join("anchor.json");
         let mut enabled_signers = vec![
@@ -1488,7 +1473,7 @@ mod tests {
         let calls = Cell::new(0);
         let error = sign_product_bundle_with_resolver(
             &ProductBundleSignOptions {
-                lane: ProductAcceptanceLaneV1::Notary,
+                lane: ProductAcceptanceLaneV1::RelayConsultation,
                 input: input.clone(),
                 anchor: anchor_path.clone(),
                 preceding_approved_set: None,
@@ -1507,7 +1492,7 @@ mod tests {
         let duplicate_output = temp.path().join("duplicate");
         let error = sign_product_bundle_with_resolver(
             &ProductBundleSignOptions {
-                lane: ProductAcceptanceLaneV1::Notary,
+                lane: ProductAcceptanceLaneV1::RelayConsultation,
                 input: input.clone(),
                 anchor: anchor_path.clone(),
                 preceding_approved_set: None,
@@ -1526,7 +1511,7 @@ mod tests {
         let output = temp.path().join("signed");
         let report = sign_product_bundle_with_resolver(
             &ProductBundleSignOptions {
-                lane: ProductAcceptanceLaneV1::Notary,
+                lane: ProductAcceptanceLaneV1::RelayConsultation,
                 input,
                 anchor: anchor_path,
                 preceding_approved_set: None,
@@ -1561,14 +1546,14 @@ mod tests {
     fn approved_lane_verifier_rejects_signed_arbitrary_bundle_id() {
         let temp = tempfile::tempdir().unwrap();
         let input = temp.path().join("input");
-        let acceptance_identity = identity(ProductAcceptanceLaneV1::Notary);
+        let acceptance_identity = identity(ProductAcceptanceLaneV1::RelayConsultation);
         write_signing_input(&input, acceptance_identity.clone());
         fs::create_dir_all(input.join("approval")).unwrap();
         let config_digest = registry_platform_config::sha256_uri(
-            &fs::read(input.join("config/notary.yaml")).unwrap(),
+            &fs::read(input.join("config/relay.yaml")).unwrap(),
         );
         let lane_closure = serde_json::json!([{
-            "path": "config/notary.yaml",
+            "path": "config/relay.yaml",
             "sha256": config_digest,
         }]);
         let lane_digest =
@@ -1581,7 +1566,7 @@ mod tests {
         fs::write(
             input.join("approval/project-state.json"),
             canonical_json_line(&serde_json::json!({
-                "generated_closure_digests": { "notary": lane_digest },
+                "generated_closure_digests": { "relay_consultation": lane_digest },
             }))
             .unwrap(),
         )
@@ -1591,7 +1576,7 @@ mod tests {
         let output = temp.path().join("signed");
         sign_product_bundle_with_resolver(
             &ProductBundleSignOptions {
-                lane: ProductAcceptanceLaneV1::Notary,
+                lane: ProductAcceptanceLaneV1::RelayConsultation,
                 input,
                 anchor: anchor_path,
                 preceding_approved_set: None,
@@ -1629,7 +1614,7 @@ mod tests {
         .expect("signature-valid arbitrary bundle_id passes platform verification");
 
         let error = crate::approved_set::verify_signed_lane_directory(
-            crate::ApprovedLaneV1::Notary,
+            crate::ApprovedLaneV1::RelayConsultation,
             &output,
         )
         .expect_err("approved-lane verifier must recompute the exact closure digest");
@@ -1644,9 +1629,9 @@ mod tests {
         for lane in [
             ProductAcceptanceLaneV1::RelayPublic,
             ProductAcceptanceLaneV1::RelayConsultation,
-            ProductAcceptanceLaneV1::Notary,
         ] {
-            let lane_label = crate::ApprovedLaneV1::from_acceptance_lane(lane).to_string();
+            let approved_lane = crate::ApprovedLaneV1::try_from_acceptance_lane(lane).unwrap();
+            let lane_label = approved_lane.to_string();
             let input = temporary.path().join(format!("{lane_label}-input"));
             let lane_identity = identity(lane);
             write_signing_input(&input, lane_identity.clone());
@@ -1667,21 +1652,16 @@ mod tests {
             )
             .unwrap();
             verified_lanes.insert(
-                crate::ApprovedLaneV1::from_acceptance_lane(lane),
-                crate::approved_set::verify_signed_lane_directory(
-                    crate::ApprovedLaneV1::from_acceptance_lane(lane),
-                    &signed,
-                )
-                .unwrap(),
+                approved_lane,
+                crate::approved_set::verify_signed_lane_directory(approved_lane, &signed).unwrap(),
             );
-            lane_paths.insert(crate::ApprovedLaneV1::from_acceptance_lane(lane), signed);
+            lane_paths.insert(approved_lane, signed);
         }
         let set_file = temporary.path().join("approved-set.json");
         crate::approved_set::assemble_initial_approved_set(
             &crate::approved_set::InitialApprovedSetInputs {
                 relay_public: lane_paths[&crate::ApprovedLaneV1::RelayPublic].clone(),
                 relay_consultation: lane_paths[&crate::ApprovedLaneV1::RelayConsultation].clone(),
-                notary: lane_paths[&crate::ApprovedLaneV1::Notary].clone(),
             },
             &set_file,
             |request| {
@@ -1692,21 +1672,21 @@ mod tests {
         )
         .unwrap();
 
-        let update_input = temporary.path().join("notary-update-input");
-        let notary_identity = identity(ProductAcceptanceLaneV1::Notary);
-        write_signing_input(&update_input, notary_identity);
+        let update_input = temporary.path().join("consultation-update-input");
+        let consultation_identity = identity(ProductAcceptanceLaneV1::RelayConsultation);
+        write_signing_input(&update_input, consultation_identity);
         fs::write(
-            update_input.join("config/notary.yaml"),
+            update_input.join("config/relay.yaml"),
             b"instance:\n  id: changed\n",
         )
         .unwrap();
-        write_review_evidence(&update_input, ProductAcceptanceLaneV1::Notary);
-        let update_output = temporary.path().join("notary-updated");
+        write_review_evidence(&update_input, ProductAcceptanceLaneV1::RelayConsultation);
+        let update_output = temporary.path().join("consultation-updated");
         sign_product_bundle_with_resolver(
             &ProductBundleSignOptions {
-                lane: ProductAcceptanceLaneV1::Notary,
+                lane: ProductAcceptanceLaneV1::RelayConsultation,
                 input: update_input,
-                anchor: lane_paths[&crate::ApprovedLaneV1::Notary].join("anchor.json"),
+                anchor: lane_paths[&crate::ApprovedLaneV1::RelayConsultation].join("anchor.json"),
                 preceding_approved_set: Some(set_file.clone()),
                 keys: vec!["op://vault/item/key".to_string()],
                 output_dir: update_output.clone(),
@@ -1721,8 +1701,8 @@ mod tests {
         .unwrap();
         assert_eq!(updated.manifest.sequence, 2);
         let preceding = registry_platform_config::verify_config_bundle(
-            lane_paths[&crate::ApprovedLaneV1::Notary].join("bundle"),
-            lane_paths[&crate::ApprovedLaneV1::Notary].join("anchor.json"),
+            lane_paths[&crate::ApprovedLaneV1::RelayConsultation].join("bundle"),
+            lane_paths[&crate::ApprovedLaneV1::RelayConsultation].join("anchor.json"),
         )
         .unwrap();
         assert_eq!(
@@ -1731,7 +1711,7 @@ mod tests {
         );
 
         let verified_update = crate::approved_set::verify_signed_lane_directory(
-            crate::ApprovedLaneV1::Notary,
+            crate::ApprovedLaneV1::RelayConsultation,
             &update_output,
         )
         .unwrap();
@@ -1740,12 +1720,12 @@ mod tests {
         crate::approved_set::assemble_updated_approved_set(
             &set_file,
             &crate::ReviewedBuildUpdateV1 {
-                notary: Some(verified_update.entry().reviewed_binding()),
+                relay_consultation: Some(verified_update.entry().reviewed_binding()),
                 ..Default::default()
             },
             &[],
             &crate::approved_set::AffectedLaneReplacements {
-                notary: Some(update_output.clone()),
+                relay_consultation: Some(update_output.clone()),
                 ..Default::default()
             },
             &set_two,
@@ -1767,18 +1747,21 @@ mod tests {
             |_| Ok(Zeroizing::new(TEST_PRIVATE_JWK.to_string())),
         )
         .unwrap();
-        let rotated_input = temporary.path().join("notary-rotated-input");
-        write_signing_input(&rotated_input, identity(ProductAcceptanceLaneV1::Notary));
+        let rotated_input = temporary.path().join("consultation-rotated-input");
+        write_signing_input(
+            &rotated_input,
+            identity(ProductAcceptanceLaneV1::RelayConsultation),
+        );
         fs::write(
-            rotated_input.join("config/notary.yaml"),
+            rotated_input.join("config/relay.yaml"),
             b"instance:\n  id: rotated-two\n",
         )
         .unwrap();
-        write_review_evidence(&rotated_input, ProductAcceptanceLaneV1::Notary);
-        let rotated_output = temporary.path().join("notary-rotated");
+        write_review_evidence(&rotated_input, ProductAcceptanceLaneV1::RelayConsultation);
+        let rotated_output = temporary.path().join("consultation-rotated");
         sign_product_bundle_with_resolver(
             &ProductBundleSignOptions {
-                lane: ProductAcceptanceLaneV1::Notary,
+                lane: ProductAcceptanceLaneV1::RelayConsultation,
                 input: rotated_input,
                 anchor: rotation_two.join("anchor.json"),
                 preceding_approved_set: Some(set_two.clone()),
@@ -1795,7 +1778,7 @@ mod tests {
             .join("anchor-history/0000.transition.json")
             .is_file());
         let verified_rotated = crate::approved_set::verify_signed_lane_directory(
-            crate::ApprovedLaneV1::Notary,
+            crate::ApprovedLaneV1::RelayConsultation,
             &rotated_output,
         )
         .unwrap();
@@ -1803,12 +1786,12 @@ mod tests {
         crate::approved_set::assemble_updated_approved_set(
             &set_two,
             &crate::ReviewedBuildUpdateV1 {
-                notary: Some(verified_rotated.entry().reviewed_binding()),
+                relay_consultation: Some(verified_rotated.entry().reviewed_binding()),
                 ..Default::default()
             },
-            &[crate::ApprovedLaneV1::Notary],
+            &[crate::ApprovedLaneV1::RelayConsultation],
             &crate::approved_set::AffectedLaneReplacements {
-                notary: Some(rotated_output.clone()),
+                relay_consultation: Some(rotated_output.clone()),
                 ..Default::default()
             },
             &set_three,
@@ -1828,21 +1811,24 @@ mod tests {
             |_| Ok(Zeroizing::new(TEST_PRIVATE_JWK.to_string())),
         )
         .unwrap();
-        let rotated_again_input = temporary.path().join("notary-rotated-again-input");
+        let rotated_again_input = temporary.path().join("consultation-rotated-again-input");
         write_signing_input(
             &rotated_again_input,
-            identity(ProductAcceptanceLaneV1::Notary),
+            identity(ProductAcceptanceLaneV1::RelayConsultation),
         );
         fs::write(
-            rotated_again_input.join("config/notary.yaml"),
+            rotated_again_input.join("config/relay.yaml"),
             b"instance:\n  id: rotated-three\n",
         )
         .unwrap();
-        write_review_evidence(&rotated_again_input, ProductAcceptanceLaneV1::Notary);
-        let rotated_again_output = temporary.path().join("notary-rotated-again");
+        write_review_evidence(
+            &rotated_again_input,
+            ProductAcceptanceLaneV1::RelayConsultation,
+        );
+        let rotated_again_output = temporary.path().join("consultation-rotated-again");
         sign_product_bundle_with_resolver(
             &ProductBundleSignOptions {
-                lane: ProductAcceptanceLaneV1::Notary,
+                lane: ProductAcceptanceLaneV1::RelayConsultation,
                 input: rotated_again_input,
                 anchor: rotation_three.join("anchor.json"),
                 preceding_approved_set: Some(set_three),
@@ -1853,7 +1839,7 @@ mod tests {
         )
         .unwrap();
         let verified_twice_rotated = crate::approved_set::verify_signed_lane_directory(
-            crate::ApprovedLaneV1::Notary,
+            crate::ApprovedLaneV1::RelayConsultation,
             &rotated_again_output,
         )
         .expect("every historical transition verifies oldest to terminal anchor");
@@ -1872,7 +1858,7 @@ mod tests {
         )
         .unwrap();
         let error = crate::approved_set::verify_signed_lane_directory(
-            crate::ApprovedLaneV1::Notary,
+            crate::ApprovedLaneV1::RelayConsultation,
             &rotated_again_output,
         )
         .expect_err("tampering any historical transition must fail closed");
@@ -1941,7 +1927,10 @@ mod tests {
     fn rotation_writes_fresh_verified_transition_and_wrong_predecessor_fails() {
         let temp = tempfile::tempdir().unwrap();
         let current_path = temp.path().join("current.json");
-        let current = write_anchor(&current_path, identity(ProductAcceptanceLaneV1::Notary));
+        let current = write_anchor(
+            &current_path,
+            identity(ProductAcceptanceLaneV1::RelayConsultation),
+        );
         let public_path = temp.path().join("current.jwk");
         fs::write(
             &public_path,
@@ -1992,7 +1981,7 @@ mod tests {
 
         let temp = tempfile::tempdir().unwrap();
         let input = temp.path().join("input");
-        let acceptance_identity = identity(ProductAcceptanceLaneV1::Notary);
+        let acceptance_identity = identity(ProductAcceptanceLaneV1::RelayConsultation);
         write_signing_input(&input, acceptance_identity.clone());
         let anchor_path = temp.path().join("anchor.json");
         write_anchor(&anchor_path, acceptance_identity);
@@ -2014,7 +2003,7 @@ mod tests {
         let calls = Cell::new(0);
         let error = sign_product_bundle_with_resolver(
             &ProductBundleSignOptions {
-                lane: ProductAcceptanceLaneV1::Notary,
+                lane: ProductAcceptanceLaneV1::RelayConsultation,
                 input,
                 anchor: anchor_path,
                 preceding_approved_set: None,
@@ -2038,7 +2027,7 @@ mod tests {
 
         let temp = tempfile::tempdir().unwrap();
         let input = temp.path().join("input");
-        let acceptance_identity = identity(ProductAcceptanceLaneV1::Notary);
+        let acceptance_identity = identity(ProductAcceptanceLaneV1::RelayConsultation);
         write_signing_input(&input, acceptance_identity.clone());
         let anchor_path = temp.path().join("anchor.json");
         write_anchor(&anchor_path, acceptance_identity);
@@ -2062,7 +2051,7 @@ mod tests {
         let calls = Cell::new(0);
         let error = sign_product_bundle_with_resolver(
             &ProductBundleSignOptions {
-                lane: ProductAcceptanceLaneV1::Notary,
+                lane: ProductAcceptanceLaneV1::RelayConsultation,
                 input,
                 anchor: anchor_path,
                 preceding_approved_set: None,
@@ -2105,7 +2094,7 @@ mod tests {
     fn signing_input_closure_enforces_directory_depth_cap() {
         let temp = tempfile::tempdir().unwrap();
         let input = temp.path().join("input");
-        write_signing_input(&input, identity(ProductAcceptanceLaneV1::Notary));
+        write_signing_input(&input, identity(ProductAcceptanceLaneV1::RelayConsultation));
         let mut nested = input;
         for index in 0..=MAX_SIGNING_INPUT_DEPTH {
             nested = nested.join(format!("d{index}"));
diff --git a/crates/registryctl/tests/anchor_rotation_journey.rs b/crates/registryctl/tests/anchor_rotation_journey.rs
index 1dc908c74..babad3ef0 100644
--- a/crates/registryctl/tests/anchor_rotation_journey.rs
+++ b/crates/registryctl/tests/anchor_rotation_journey.rs
@@ -153,15 +153,6 @@ fn unchanged_anchor_rotation_is_explicit_authenticated_and_runtime_acceptable()
         &current_public_key,
         &current_private_key,
     );
-    let notary = create_initial_lane(
-        "notary",
-        &signing_inputs,
-        &anchors,
-        &handoff,
-        &current_public_key,
-        &current_private_key,
-    );
-
     let approved_one = handoff.join("approved-one.json");
     successful(vec![
         "-C".to_string(),
@@ -175,8 +166,6 @@ fn unchanged_anchor_rotation_is_explicit_authenticated_and_runtime_acceptable()
         relay_public.display().to_string(),
         "--relay-consultation".to_string(),
         relay_consultation.display().to_string(),
-        "--notary".to_string(),
-        notary.display().to_string(),
         "--output-file".to_string(),
         approved_one.display().to_string(),
     ]);
@@ -190,33 +179,33 @@ fn unchanged_anchor_rotation_is_explicit_authenticated_and_runtime_acceptable()
         "--against".to_string(),
         approved_one.display().to_string(),
         "--rotate-anchor".to_string(),
-        "notary".to_string(),
+        "relay-consultation".to_string(),
     ]);
-    let rotated_input = signing_inputs.join("notary");
+    let rotated_input = signing_inputs.join("relay-consultation");
     assert!(rotated_input.is_dir());
     assert!(!signing_inputs.join("relay-public").exists());
-    assert!(!signing_inputs.join("relay-consultation").exists());
     assert_eq!(
-        fs::read(rotated_input.join("config/notary.yaml")).expect("rotated input config reads"),
-        fs::read(notary.join("bundle/config/notary.yaml")).expect("preceding config reads"),
+        fs::read(rotated_input.join("config/relay.yaml")).expect("rotated input config reads"),
+        fs::read(relay_consultation.join("bundle/config/relay.yaml"))
+            .expect("preceding config reads"),
         "an anchor-only build must not manufacture a configuration change"
     );
     for reviewed_file in ["approval/review.json", "approval/project-state.json"] {
         assert_eq!(
             fs::read(rotated_input.join(reviewed_file)).expect("rotated reviewed input reads"),
-            fs::read(notary.join("bundle").join(reviewed_file))
+            fs::read(relay_consultation.join("bundle").join(reviewed_file))
                 .expect("preceding reviewed input reads"),
             "an anchor-only build must retain the signed {reviewed_file}"
         );
     }
 
-    let rotation = handoff.join("notary-rotation");
+    let rotation = handoff.join("relay-consultation-rotation");
     successful(vec![
         "trust".to_string(),
         "anchor".to_string(),
         "rotate".to_string(),
         "--current-anchor".to_string(),
-        notary.join("anchor.json").display().to_string(),
+        relay_consultation.join("anchor.json").display().to_string(),
         "--next-public-key".to_string(),
         current_public_key.display().to_string(),
         "--next-public-key".to_string(),
@@ -229,17 +218,17 @@ fn unchanged_anchor_rotation_is_explicit_authenticated_and_runtime_acceptable()
         rotation.display().to_string(),
     ]);
 
-    let same_anchor = handoff.join("notary-same-anchor");
+    let same_anchor = handoff.join("relay-consultation-same-anchor");
     successful(vec![
         "trust".to_string(),
         "bundle".to_string(),
         "sign".to_string(),
         "--lane".to_string(),
-        "notary".to_string(),
+        "relay-consultation".to_string(),
         "--input".to_string(),
         rotated_input.display().to_string(),
         "--anchor".to_string(),
-        notary.join("anchor.json").display().to_string(),
+        relay_consultation.join("anchor.json").display().to_string(),
         "--against".to_string(),
         approved_one.display().to_string(),
         "--key".to_string(),
@@ -258,7 +247,7 @@ fn unchanged_anchor_rotation_is_explicit_authenticated_and_runtime_acceptable()
             "local".to_string(),
             "--from".to_string(),
             approved_one.display().to_string(),
-            "--notary".to_string(),
+            "--relay-consultation".to_string(),
             same_anchor.display().to_string(),
             "--output-file".to_string(),
             handoff
@@ -269,13 +258,13 @@ fn unchanged_anchor_rotation_is_explicit_authenticated_and_runtime_acceptable()
         "retained its preceding anchor",
     );
 
-    let rotated_notary = handoff.join("notary-rotated");
+    let rotated_consultation = handoff.join("relay-consultation-rotated");
     successful(vec![
         "trust".to_string(),
         "bundle".to_string(),
         "sign".to_string(),
         "--lane".to_string(),
-        "notary".to_string(),
+        "relay-consultation".to_string(),
         "--input".to_string(),
         rotated_input.display().to_string(),
         "--anchor".to_string(),
@@ -285,7 +274,7 @@ fn unchanged_anchor_rotation_is_explicit_authenticated_and_runtime_acceptable()
         "--key".to_string(),
         format!("file:{}", next_private_key.display()),
         "--output-dir".to_string(),
-        rotated_notary.display().to_string(),
+        rotated_consultation.display().to_string(),
     ]);
     let approved_two = handoff.join("approved-two.json");
     successful(vec![
@@ -298,26 +287,31 @@ fn unchanged_anchor_rotation_is_explicit_authenticated_and_runtime_acceptable()
         "local".to_string(),
         "--from".to_string(),
         approved_one.display().to_string(),
-        "--notary".to_string(),
-        rotated_notary.display().to_string(),
+        "--relay-consultation".to_string(),
+        rotated_consultation.display().to_string(),
         "--output-file".to_string(),
         approved_two.display().to_string(),
     ]);
 
-    let verified_one =
-        verify_config_bundle(notary.join("bundle"), notary.join("anchor.json")).unwrap();
+    let verified_one = verify_config_bundle(
+        relay_consultation.join("bundle"),
+        relay_consultation.join("anchor.json"),
+    )
+    .unwrap();
     let verified_two = verify_config_bundle(
-        rotated_notary.join("bundle"),
-        rotated_notary.join("anchor.json"),
+        rotated_consultation.join("bundle"),
+        rotated_consultation.join("anchor.json"),
     )
     .unwrap();
     let candidate_one = VerifiedAcceptanceStateV1::from_verified_bundle(&verified_one).unwrap();
     let candidate_two = VerifiedAcceptanceStateV1::from_verified_bundle(&verified_two).unwrap();
-    let current_anchor = load_trust_anchor(&notary.join("anchor.json")).unwrap();
+    let current_anchor = load_trust_anchor(&relay_consultation.join("anchor.json")).unwrap();
     let transition =
-        load_anchor_transition(&rotated_notary.join("anchor-history/0000.transition.json"))
+        load_anchor_transition(&rotated_consultation.join("anchor-history/0000.transition.json"))
             .unwrap();
-    let state_path = temporary.path().join("notary-anti-rollback.json");
+    let state_path = temporary
+        .path()
+        .join("relay-consultation-anti-rollback.json");
     let store = FileAntiRollbackStore::new(&state_path);
     let runtime = tokio::runtime::Builder::new_current_thread()
         .enable_all()
@@ -353,15 +347,15 @@ fn unchanged_anchor_rotation_is_explicit_authenticated_and_runtime_acceptable()
         "--against".to_string(),
         approved_two.display().to_string(),
         "--rotate-anchor".to_string(),
-        "notary".to_string(),
+        "relay-consultation".to_string(),
     ]);
-    let stale_rotation = handoff.join("notary-stale-rotation");
+    let stale_rotation = handoff.join("relay-consultation-stale-rotation");
     successful(vec![
         "trust".to_string(),
         "anchor".to_string(),
         "rotate".to_string(),
         "--current-anchor".to_string(),
-        notary.join("anchor.json").display().to_string(),
+        relay_consultation.join("anchor.json").display().to_string(),
         "--next-public-key".to_string(),
         current_public_key.display().to_string(),
         "--next-threshold".to_string(),
@@ -377,7 +371,7 @@ fn unchanged_anchor_rotation_is_explicit_authenticated_and_runtime_acceptable()
             "bundle".to_string(),
             "sign".to_string(),
             "--lane".to_string(),
-            "notary".to_string(),
+            "relay-consultation".to_string(),
             "--input".to_string(),
             rotated_input.display().to_string(),
             "--anchor".to_string(),
@@ -387,7 +381,10 @@ fn unchanged_anchor_rotation_is_explicit_authenticated_and_runtime_acceptable()
             "--key".to_string(),
             format!("file:{}", current_private_key.display()),
             "--output-dir".to_string(),
-            handoff.join("notary-rejected-next").display().to_string(),
+            handoff
+                .join("relay-consultation-rejected-next")
+                .display()
+                .to_string(),
         ],
         "selected lane anchor is not the next authenticated anchor",
     );
diff --git a/crates/registryctl/tests/approved_set_assembly.rs b/crates/registryctl/tests/approved_set_assembly.rs
index 701aa3f9b..f7a6ede30 100644
--- a/crates/registryctl/tests/approved_set_assembly.rs
+++ b/crates/registryctl/tests/approved_set_assembly.rs
@@ -38,7 +38,7 @@ fn initial_assembly_emits_one_deterministic_value_free_entry_for_each_fixed_lane
     assert_eq!(
         first_report.affected_lanes,
         ApprovedLaneV1::ALL,
-        "initial review requires all three fixed lanes"
+        "initial review requires both fixed Relay lanes"
     );
     assert_eq!(
         first_report.approved_set.schema_id,
@@ -48,28 +48,6 @@ fn initial_assembly_emits_one_deterministic_value_free_entry_for_each_fixed_lane
         first_report.approved_set.schema_version,
         APPROVED_BASELINE_SET_SCHEMA_VERSION
     );
-    assert_eq!(
-        first_report
-            .approved_set
-            .lanes
-            .relay_consultation
-            .interfaces
-            .consultation_relay_notary,
-        first_report
-            .approved_set
-            .lanes
-            .notary
-            .interfaces
-            .consultation_relay_notary
-    );
-    assert!(first_report
-        .approved_set
-        .lanes
-        .relay_public
-        .interfaces
-        .consultation_relay_notary
-        .is_none());
-
     let json = String::from_utf8(std::fs::read(&first).expect("set reads")).expect("set is UTF-8");
     for forbidden in [
         "example-project",
@@ -91,7 +69,7 @@ fn initial_assembly_emits_one_deterministic_value_free_entry_for_each_fixed_lane
             .keys()
             .cloned()
             .collect::<Vec<_>>(),
-        vec!["notary", "relay-consultation", "relay-public"]
+        vec!["relay-consultation", "relay-public"]
     );
     assert!(parsed["lanes"]["relay-public"].get("lane").is_none());
     assert!(parsed["lanes"]["relay-public"]
@@ -116,12 +94,10 @@ fn update_reverifies_every_preceding_lane_and_only_replaces_reviewed_affected_la
     let reviewed = ReviewedBuildUpdateV1 {
         relay_public: None,
         relay_consultation: Some(reviewed_binding(ApprovedLaneV1::RelayConsultation)),
-        notary: Some(reviewed_binding(ApprovedLaneV1::Notary)),
     };
     let replacements = AffectedLaneReplacements {
         relay_public: None,
         relay_consultation: Some(temporary.path().join("consultation-next")),
-        notary: Some(temporary.path().join("notary-next")),
     };
     let requests = RefCell::new(Vec::new());
 
@@ -148,7 +124,7 @@ fn update_reverifies_every_preceding_lane_and_only_replaces_reviewed_affected_la
     .expect("governed update assembles");
 
     let requests = requests.into_inner();
-    assert_eq!(requests.len(), 5, "three preceding and two replacements");
+    assert_eq!(requests.len(), 3, "two preceding and one replacement");
     assert_eq!(
         requests
             .iter()
@@ -157,11 +133,11 @@ fn update_reverifies_every_preceding_lane_and_only_replaces_reviewed_affected_la
                 LaneVerificationSourceV1::PrecedingApprovedEntry { .. }
             ))
             .count(),
-        3
+        2
     );
     assert_eq!(
         report.affected_lanes,
-        vec![ApprovedLaneV1::RelayConsultation, ApprovedLaneV1::Notary]
+        vec![ApprovedLaneV1::RelayConsultation]
     );
     assert_eq!(
         report.approved_set.lanes.relay_public,
@@ -171,21 +147,6 @@ fn update_reverifies_every_preceding_lane_and_only_replaces_reviewed_affected_la
         report.approved_set.lanes.relay_consultation,
         preceding.lanes.relay_consultation
     );
-    assert_ne!(report.approved_set.lanes.notary, preceding.lanes.notary);
-    assert_eq!(
-        report
-            .approved_set
-            .lanes
-            .relay_consultation
-            .interfaces
-            .consultation_relay_notary,
-        report
-            .approved_set
-            .lanes
-            .notary
-            .interfaces
-            .consultation_relay_notary
-    );
     assert_eq!(
         load_approved_baseline_set_structure(&next_file).expect("updated set round trips"),
         report.approved_set
diff --git a/crates/registryctl/tests/approved_set_rejections.rs b/crates/registryctl/tests/approved_set_rejections.rs
index a32a67100..ccca766a4 100644
--- a/crates/registryctl/tests/approved_set_rejections.rs
+++ b/crates/registryctl/tests/approved_set_rejections.rs
@@ -7,7 +7,7 @@ use approved_set_support::approved_set::{
     assemble_initial_approved_set, assemble_updated_approved_set,
     load_approved_baseline_set_structure, AffectedLaneReplacements, ApprovedLaneV1,
     LaneVerificationSourceV1, PortableArtifactLocator, ReviewedBuildUpdateV1,
-    VerifiedApprovedLaneV1,
+    VerifiedApprovedLaneV1, APPROVED_BASELINE_SET_SCHEMA_VERSION,
 };
 use approved_set_support::{
     digest, entry, identity, initial_lane, path_set, replacement_lane, reviewed_binding, verified,
@@ -34,7 +34,7 @@ fn initial_assembly_rejects_mixed_project_identity_before_output_creation() {
     let temporary = tempfile::tempdir().expect("temporary directory creates");
     let output = temporary.path().join("mixed.json");
     let error = assemble_initial_approved_set(&path_set(temporary.path()), &output, |request| {
-        Ok(if request.lane == ApprovedLaneV1::Notary {
+        Ok(if request.lane == ApprovedLaneV1::RelayConsultation {
             verified(
                 request.lane,
                 "other-project",
@@ -44,7 +44,6 @@ fn initial_assembly_rejects_mixed_project_identity_before_output_creation() {
                 None,
                 'c',
                 'f',
-                Some('c'),
             )
         } else {
             initial_lane(request.lane)
@@ -68,54 +67,25 @@ fn independent_verification_rejects_development_trust_for_an_approved_lane() {
         1,
         digest('a'),
         None,
-        entry(lane, "approved", 'a', 'd', None),
+        entry(lane, "approved", 'a', 'd'),
     )
     .expect_err("development trust must not enter a governed approved set");
 
     assert!(format!("{error:#}").contains("governed trust domain"));
 }
 
-#[test]
-fn initial_assembly_rejects_mixed_cross_lane_contract_before_output_creation() {
-    let temporary = tempfile::tempdir().expect("temporary directory creates");
-    let output = temporary.path().join("mixed-interface.json");
-    let error = assemble_initial_approved_set(&path_set(temporary.path()), &output, |request| {
-        Ok(if request.lane == ApprovedLaneV1::Notary {
-            verified(
-                request.lane,
-                "example-project",
-                "approved",
-                1,
-                'c',
-                None,
-                'c',
-                'f',
-                Some('d'),
-            )
-        } else {
-            initial_lane(request.lane)
-        })
-    })
-    .expect_err("mixed interface must fail");
-
-    assert!(format!("{error:#}").contains("interface digests do not match"));
-    assert!(!output.exists());
-}
-
 #[test]
 fn update_requires_exact_replacements_and_never_carries_an_unverified_lane() {
     let temporary = tempfile::tempdir().expect("temporary directory creates");
     let (preceding_file, _) = initial_set(&temporary);
     let output = temporary.path().join("next.json");
     let reviewed = ReviewedBuildUpdateV1 {
-        relay_public: None,
+        relay_public: Some(reviewed_binding(ApprovedLaneV1::RelayPublic)),
         relay_consultation: Some(reviewed_binding(ApprovedLaneV1::RelayConsultation)),
-        notary: Some(reviewed_binding(ApprovedLaneV1::Notary)),
     };
     let missing = AffectedLaneReplacements {
         relay_public: None,
         relay_consultation: Some(temporary.path().join("consultation-next")),
-        notary: None,
     };
     let mut verification_called = false;
     let error =
@@ -129,9 +99,8 @@ fn update_requires_exact_replacements_and_never_carries_an_unverified_lane() {
     assert!(!output.exists());
 
     let complete = AffectedLaneReplacements {
-        relay_public: None,
+        relay_public: Some(temporary.path().join("public-next")),
         relay_consultation: Some(temporary.path().join("consultation-next")),
-        notary: Some(temporary.path().join("notary-next")),
     };
     let planted_canary = "CANARY_PRIVATE_PRECEDING_PATH";
     let error = assemble_updated_approved_set(
@@ -167,12 +136,10 @@ fn update_rejects_non_successor_lineage_and_reviewed_closure_mismatch() {
     let reviewed = ReviewedBuildUpdateV1 {
         relay_public: None,
         relay_consultation: Some(reviewed_binding(ApprovedLaneV1::RelayConsultation)),
-        notary: Some(reviewed_binding(ApprovedLaneV1::Notary)),
     };
     let replacements = AffectedLaneReplacements {
         relay_public: None,
         relay_consultation: Some(temporary.path().join("consultation-next")),
-        notary: Some(temporary.path().join("notary-next")),
     };
 
     let error = assemble_updated_approved_set(
@@ -197,7 +164,6 @@ fn update_rejects_non_successor_lineage_and_reviewed_closure_mismatch() {
                     Some('b'),
                     '7',
                     '8',
-                    Some('9'),
                 ))
             }
             LaneVerificationSourceV1::LaneDirectory(_) => Ok(replacement_lane(request.lane)),
@@ -237,17 +203,17 @@ fn update_requires_explicit_anchor_rotation_and_rejects_selected_same_anchor() {
     let (preceding_file, _) = initial_set(&temporary);
     let output = temporary.path().join("next.json");
     let reviewed = ReviewedBuildUpdateV1 {
-        notary: Some(reviewed_binding(ApprovedLaneV1::Notary)),
+        relay_consultation: Some(reviewed_binding(ApprovedLaneV1::RelayConsultation)),
         ..Default::default()
     };
     let replacements = AffectedLaneReplacements {
-        notary: Some(temporary.path().join("notary-next")),
+        relay_consultation: Some(temporary.path().join("consultation-next")),
         ..Default::default()
     };
     let same_anchor = assemble_updated_approved_set(
         &preceding_file,
         &reviewed,
-        &[ApprovedLaneV1::Notary],
+        &[ApprovedLaneV1::RelayConsultation],
         &replacements,
         &output,
         |request| match request.source {
@@ -337,6 +303,92 @@ fn assembly_preserves_an_existing_output_file() {
     );
 }
 
+/// The approved-set schema version issued before Registry Notary was retired.
+const PRE_RETIREMENT_SCHEMA_VERSION: &str = "1.0";
+
+/// The exact refusal an operator holding a pre-retirement approved set reads.
+const PRE_RETIREMENT_REFUSAL: &str = "approved set predates the Registry Notary retirement: Registry Notary is retired, so a schema version 1.0 approved set, its notary lane, and the cross-lane interface digests it binds are no longer verified; this reader refuses the document rather than honor an approval whose integrity claim is no longer enforced, so re-approve the baseline to issue a schema version 2.0 approved set";
+
+fn write_test_json(path: &std::path::Path, value: &serde_json::Value) {
+    std::fs::write(
+        path,
+        serde_json::to_vec(value).expect("test JSON serializes"),
+    )
+    .expect("test file writes");
+}
+
+#[test]
+fn reader_refuses_a_pre_retirement_approved_set_with_an_actionable_message() {
+    let temporary = tempfile::tempdir().expect("temporary directory creates");
+    let (_, approved_set) = initial_set(&temporary);
+    let mut value = serde_json::to_value(&approved_set).expect("set serializes");
+    value["schema_version"] = serde_json::json!(PRE_RETIREMENT_SCHEMA_VERSION);
+    let pre_retirement = temporary.path().join("pre-retirement.json");
+    write_test_json(&pre_retirement, &value);
+
+    let error = load_approved_baseline_set_structure(&pre_retirement)
+        .expect_err("a pre-retirement approved set must be refused");
+    assert_eq!(format!("{error:#}"), PRE_RETIREMENT_REFUSAL);
+}
+
+#[test]
+fn reader_refuses_retired_notary_material_rather_than_reporting_an_unknown_field() {
+    let temporary = tempfile::tempdir().expect("temporary directory creates");
+    let (_, approved_set) = initial_set(&temporary);
+
+    let mut with_interfaces = serde_json::to_value(&approved_set).expect("set serializes");
+    with_interfaces["lanes"]["relay-consultation"]["interfaces"] =
+        serde_json::json!({ "consultation_relay_notary": digest('a') });
+    let interfaces_file = temporary.path().join("interfaces.json");
+    write_test_json(&interfaces_file, &with_interfaces);
+    let error = load_approved_baseline_set_structure(&interfaces_file)
+        .expect_err("a retired interface digest binding must be refused");
+    let message = format!("{error:#}");
+    assert_eq!(message, PRE_RETIREMENT_REFUSAL);
+    assert!(!message.contains("unknown field"), "{message}");
+
+    let mut with_notary_lane = serde_json::to_value(&approved_set).expect("set serializes");
+    with_notary_lane["lanes"]["notary"] = with_notary_lane["lanes"]["relay-public"].clone();
+    let notary_file = temporary.path().join("notary-lane.json");
+    write_test_json(&notary_file, &with_notary_lane);
+    let error = load_approved_baseline_set_structure(&notary_file)
+        .expect_err("a retired notary lane must be refused");
+    let message = format!("{error:#}");
+    assert_eq!(message, PRE_RETIREMENT_REFUSAL);
+    assert!(!message.contains("unknown field"), "{message}");
+}
+
+#[test]
+fn in_memory_validation_names_the_retirement_for_the_pre_retirement_version() {
+    let temporary = tempfile::tempdir().expect("temporary directory creates");
+    let (_, mut approved_set) = initial_set(&temporary);
+    approved_set.schema_version = PRE_RETIREMENT_SCHEMA_VERSION.to_string();
+
+    let error = approved_set
+        .validate()
+        .expect_err("the pre-retirement schema version must be refused");
+    assert_eq!(error.to_string(), PRE_RETIREMENT_REFUSAL);
+}
+
+#[test]
+fn a_current_approved_set_still_round_trips_and_validates() {
+    let temporary = tempfile::tempdir().expect("temporary directory creates");
+    let (approved_file, approved_set) = initial_set(&temporary);
+
+    assert_ne!(
+        APPROVED_BASELINE_SET_SCHEMA_VERSION, PRE_RETIREMENT_SCHEMA_VERSION,
+        "the retirement must not reuse the schema version it invalidated"
+    );
+    assert_eq!(
+        approved_set.schema_version,
+        APPROVED_BASELINE_SET_SCHEMA_VERSION
+    );
+    let loaded =
+        load_approved_baseline_set_structure(&approved_file).expect("a current approved set loads");
+    assert_eq!(loaded, approved_set);
+    loaded.validate().expect("a current approved set validates");
+}
+
 #[cfg(unix)]
 #[test]
 fn approved_set_reader_does_not_follow_a_symbolic_link() {
diff --git a/crates/registryctl/tests/approved_set_support/mod.rs b/crates/registryctl/tests/approved_set_support/mod.rs
index 5045f107e..c2f7529e3 100644
--- a/crates/registryctl/tests/approved_set_support/mod.rs
+++ b/crates/registryctl/tests/approved_set_support/mod.rs
@@ -59,9 +59,9 @@ use std::path::Path;
 
 use anyhow::Result;
 use approved_set::{
-    ApprovedLaneEntryV1, ApprovedLaneLocatorsV1, ApprovedLaneV1, CrossLaneInterfaceDigestsV1,
-    LaneVerificationRequestV1, LaneVerificationSourceV1, PortableArtifactLocator,
-    ReviewedLaneBindingV1, VerifiedApprovedLaneV1,
+    ApprovedLaneEntryV1, ApprovedLaneLocatorsV1, ApprovedLaneV1, LaneVerificationRequestV1,
+    LaneVerificationSourceV1, PortableArtifactLocator, ReviewedLaneBindingV1,
+    VerifiedApprovedLaneV1,
 };
 use registry_platform_config::{
     ProductAcceptanceIdentityV1, ProductAcceptanceProductV1, ProductTrustDomainV1,
@@ -80,7 +80,6 @@ pub fn entry(
     generation: &str,
     reviewed_digest: char,
     signing_digest: char,
-    interface_digest: Option<char>,
 ) -> ApprovedLaneEntryV1 {
     let lane_name = lane.to_string();
     let root = format!("{generation}/{lane_name}");
@@ -94,23 +93,17 @@ pub fn entry(
         signed_manifest_digest: digest(match lane {
             ApprovedLaneV1::RelayPublic => '1',
             ApprovedLaneV1::RelayConsultation => '2',
-            ApprovedLaneV1::Notary => '3',
         }),
         bundle_digest: digest(match lane {
             ApprovedLaneV1::RelayPublic => '4',
             ApprovedLaneV1::RelayConsultation => '5',
-            ApprovedLaneV1::Notary => '6',
         }),
         anchor_digest: digest(match lane {
             ApprovedLaneV1::RelayPublic => '7',
             ApprovedLaneV1::RelayConsultation => '8',
-            ApprovedLaneV1::Notary => '9',
         }),
         lane_scoped_reviewed_input_digest: digest(reviewed_digest),
         signing_input_closure_digest: digest(signing_digest),
-        interfaces: CrossLaneInterfaceDigestsV1 {
-            consultation_relay_notary: interface_digest.map(digest),
-        },
     }
 }
 
@@ -120,12 +113,7 @@ pub fn identity(lane: ApprovedLaneV1, project: &str) -> ProductAcceptanceIdentit
         project: project.to_string(),
         environment: "production".to_string(),
         lane: lane.acceptance_lane(),
-        product: match lane {
-            ApprovedLaneV1::RelayPublic | ApprovedLaneV1::RelayConsultation => {
-                ProductAcceptanceProductV1::RegistryRelay
-            }
-            ApprovedLaneV1::Notary => ProductAcceptanceProductV1::RegistryNotary,
-        },
+        product: ProductAcceptanceProductV1::RegistryRelay,
         stream: format!("{project}-stream"),
         instance: format!("{project}-{lane}"),
     }
@@ -141,7 +129,6 @@ pub fn verified(
     previous_config_digest: Option<char>,
     reviewed_digest: char,
     signing_digest: char,
-    interface_digest: Option<char>,
 ) -> VerifiedApprovedLaneV1 {
     VerifiedApprovedLaneV1::from_independent_verification(
         lane,
@@ -149,22 +136,15 @@ pub fn verified(
         sequence,
         digest(config_digest),
         previous_config_digest.map(digest),
-        entry(
-            lane,
-            generation,
-            reviewed_digest,
-            signing_digest,
-            interface_digest,
-        ),
+        entry(lane, generation, reviewed_digest, signing_digest),
     )
     .expect("test lane evidence is structurally verified")
 }
 
 pub fn initial_lane(lane: ApprovedLaneV1) -> VerifiedApprovedLaneV1 {
-    let (reviewed, signing, interface) = match lane {
-        ApprovedLaneV1::RelayPublic => ('a', 'd', None),
-        ApprovedLaneV1::RelayConsultation => ('b', 'e', Some('c')),
-        ApprovedLaneV1::Notary => ('c', 'f', Some('c')),
+    let (reviewed, signing) = match lane {
+        ApprovedLaneV1::RelayPublic => ('a', 'd'),
+        ApprovedLaneV1::RelayConsultation => ('b', 'e'),
     };
     verified(
         lane,
@@ -174,20 +154,17 @@ pub fn initial_lane(lane: ApprovedLaneV1) -> VerifiedApprovedLaneV1 {
         match lane {
             ApprovedLaneV1::RelayPublic => 'a',
             ApprovedLaneV1::RelayConsultation => 'b',
-            ApprovedLaneV1::Notary => 'c',
         },
         None,
         reviewed,
         signing,
-        interface,
     )
 }
 
 pub fn replacement_lane(lane: ApprovedLaneV1) -> VerifiedApprovedLaneV1 {
-    let (reviewed, signing, interface, previous) = match lane {
-        ApprovedLaneV1::RelayPublic => ('7', '8', None, 'a'),
-        ApprovedLaneV1::RelayConsultation => ('7', '8', Some('9'), 'b'),
-        ApprovedLaneV1::Notary => ('8', '9', Some('9'), 'c'),
+    let (reviewed, signing, previous) = match lane {
+        ApprovedLaneV1::RelayPublic => ('7', '8', 'a'),
+        ApprovedLaneV1::RelayConsultation => ('8', '9', 'b'),
     };
     verified(
         lane,
@@ -197,12 +174,10 @@ pub fn replacement_lane(lane: ApprovedLaneV1) -> VerifiedApprovedLaneV1 {
         match lane {
             ApprovedLaneV1::RelayPublic => 'd',
             ApprovedLaneV1::RelayConsultation => 'e',
-            ApprovedLaneV1::Notary => 'f',
         },
         Some(previous),
         reviewed,
         signing,
-        interface,
     )
 }
 
@@ -222,6 +197,5 @@ pub fn path_set(root: &Path) -> approved_set::InitialApprovedSetInputs {
     approved_set::InitialApprovedSetInputs {
         relay_public: root.join("relay-public"),
         relay_consultation: root.join("relay-consultation"),
-        notary: root.join("notary"),
     }
 }
diff --git a/crates/registryctl/tests/cli_contract.rs b/crates/registryctl/tests/cli_contract.rs
index ef9f82498..4faaf1916 100644
--- a/crates/registryctl/tests/cli_contract.rs
+++ b/crates/registryctl/tests/cli_contract.rs
@@ -152,6 +152,7 @@ fn removed_pre_1_0_roots_and_aliases_are_usage_errors() {
         "authoring",
         "project",
         "bruno",
+        "__registryctl-cel-worker-v1",
     ] {
         let output = run(&[root]);
         assert_eq!(
@@ -220,6 +221,48 @@ fn stable_flags_have_strict_values_and_documented_meanings() {
     assert_eq!(run(&["check", "--format", "jsonl"]).status.code(), Some(2));
 }
 
+#[test]
+fn trust_lane_selectors_are_relay_only() {
+    let anchor_help = stdout(&["trust", "anchor", "create", "--help"]);
+    assert!(
+        anchor_help.contains("possible values: relay-public, relay-consultation"),
+        "{anchor_help}"
+    );
+    assert!(!anchor_help.contains("notary"), "{anchor_help}");
+
+    let approved_set_help = stdout(&["trust", "approved-set", "assemble", "--help"]);
+    assert!(
+        approved_set_help.contains("--relay-public"),
+        "{approved_set_help}"
+    );
+    assert!(
+        approved_set_help.contains("--relay-consultation"),
+        "{approved_set_help}"
+    );
+    assert!(!approved_set_help.contains("notary"), "{approved_set_help}");
+
+    assert_eq!(
+        run(&[
+            "trust",
+            "anchor",
+            "create",
+            "--lane",
+            "notary",
+            "--input",
+            "unused",
+            "--public-key",
+            "unused",
+            "--threshold",
+            "1",
+            "--output-file",
+            "unused",
+        ])
+        .status
+        .code(),
+        Some(2)
+    );
+}
+
 #[test]
 fn check_explain_adds_the_classifier_safe_review_to_human_output() {
     let temporary = tempfile::tempdir().expect("temporary directory");
@@ -252,7 +295,8 @@ fn check_explain_adds_the_classifier_safe_review_to_human_output() {
         "Explanation: registry.project.explanation.v1 for fictional-citizen-registry in local",
         "integration person-record",
         "[authored, effective]",
-        "<redacted:secret_reference>",
+        "environment local /relay/consultation/client_id = <redacted:sensitive>",
+        "<redacted:redacted_fixture>",
         "Full provenance and constraint metadata: rerun with --format json.",
     ] {
         assert!(
@@ -531,7 +575,6 @@ fn trace_renders_the_selected_synthetic_fixture_in_human_output() {
         "inputs: person_id",
         "calls:",
         "outputs: active",
-        "claims: person-active, person-record-exists",
         "outcome: match",
     ] {
         assert!(
diff --git a/crates/registryctl/tests/cli_trust_journey.rs b/crates/registryctl/tests/cli_trust_journey.rs
index 3eb93f782..52d80d8a2 100644
--- a/crates/registryctl/tests/cli_trust_journey.rs
+++ b/crates/registryctl/tests/cli_trust_journey.rs
@@ -65,7 +65,7 @@ fn sign_verify_and_assemble_share_one_signed_artifact_root() {
     let signing_inputs = project.join(".registry-stack/build/local/signing-inputs");
     let mut lane_roots = Vec::new();
 
-    for lane in ["relay-public", "relay-consultation", "notary"] {
+    for lane in ["relay-public", "relay-consultation"] {
         let input = signing_inputs.join(lane);
         let anchor = anchors.join(format!("{lane}.json"));
         successful(vec![
@@ -159,8 +159,6 @@ fn sign_verify_and_assemble_share_one_signed_artifact_root() {
         lane_roots[0].display().to_string(),
         "--relay-consultation".to_string(),
         lane_roots[1].display().to_string(),
-        "--notary".to_string(),
-        lane_roots[2].display().to_string(),
         "--output-file".to_string(),
         approved_set.display().to_string(),
     ]);
diff --git a/crates/registryctl/tests/deployment_seams.rs b/crates/registryctl/tests/deployment_seams.rs
index b66f1ef1c..c638b4af0 100644
--- a/crates/registryctl/tests/deployment_seams.rs
+++ b/crates/registryctl/tests/deployment_seams.rs
@@ -31,6 +31,7 @@ use deployment::{
     DeploymentReleaseMetadataV1, EffectiveComposeModelsV1, ExpectedGenerationInputsV1,
     ImageIdentityV1, LockedPostgresqlRuntimeV1, LockedProductRuntimeV1, LockedRuntimeMappingV1,
     ManagedTopologyImagesV1, PackageFreshnessV1, VerifiedDeploymentInputsV1,
+    DEPLOYMENT_BINDING_SCHEMA_VERSION, DEPLOYMENT_PLAN_SCHEMA_VERSION,
 };
 use registry_platform_crypto::canonicalize_json;
 use release_lock::{
@@ -42,31 +43,6 @@ use sha2::{Digest as _, Sha256};
 
 static PROCESS_PATH_LOCK: Mutex<()> = Mutex::new(());
 
-fn shell_fence_after_heading<'a>(markdown: &'a str, heading: &str, occurrence: usize) -> &'a str {
-    let section = markdown
-        .split_once(heading)
-        .unwrap_or_else(|| panic!("missing Markdown heading {heading}"))
-        .1;
-    let section = section
-        .split_once("\n## ")
-        .map_or(section, |(current, _next)| current);
-    let mut remainder = section;
-    for index in 1..=occurrence {
-        remainder = remainder
-            .split_once("```sh\n")
-            .unwrap_or_else(|| panic!("missing shell fence {occurrence} after {heading}"))
-            .1;
-        let (block, after) = remainder
-            .split_once("\n```")
-            .unwrap_or_else(|| panic!("unterminated shell fence after {heading}"));
-        if index == occurrence {
-            return block;
-        }
-        remainder = after;
-    }
-    unreachable!("shell fence occurrence is one-based")
-}
-
 struct ProcessPathGuard(Option<OsString>);
 
 impl ProcessPathGuard {
@@ -98,8 +74,6 @@ fn plan() -> DeploymentPlanV1 {
     DeploymentPlanV1::managed_single_node(&ManagedTopologyImagesV1 {
         relay: image("registry-relay", 'a'),
         relay_platform: OciPlatformV1::LinuxAmd64,
-        notary: image("registry-notary", 'b'),
-        notary_platform: OciPlatformV1::LinuxAmd64,
         postgresql_state_plane: image("postgresql", 'c'),
         postgresql_state_plane_platform: OciPlatformV1::LinuxAmd64,
     })
@@ -187,23 +161,6 @@ fn product_runtime(product: &str, lane: &str) -> LockedProductRuntimeV1 {
             vec![database_ca.clone()],
             vec![database_ca.clone()],
         ),
-        "notary" => (
-            vec![database_ca.clone()],
-            vec![],
-            vec![
-                database_ca,
-                secret(
-                    "notary-relay-workload-credential",
-                    "/run/secrets/relay-workload-token",
-                    "65532",
-                ),
-                secret(
-                    "notary-signing-key",
-                    "/run/secrets/notary-signing-key.jwk",
-                    "65532",
-                ),
-            ],
-        ),
         _ => unreachable!(),
     };
     let command = |name: &str| vec![format!("/{product}"), name.to_string()];
@@ -255,10 +212,6 @@ fn operator_files() -> Vec<LockedOperatorFileV1> {
         "REGISTRY_RELAY_RUNTIME_PASSWORD",
         "REGISTRY_RELAY_MAINTENANCE_PASSWORD",
         "REGISTRY_RELAY_READER_PASSWORD",
-        "REGISTRY_NOTARY_MIGRATOR_PASSWORD",
-        "REGISTRY_NOTARY_RUNTIME_PASSWORD",
-        "REGISTRY_NOTARY_MAINTENANCE_PASSWORD",
-        "REGISTRY_NOTARY_READER_PASSWORD",
     ];
     deployment::OPERATOR_FILE_IDS
         .iter()
@@ -269,10 +222,6 @@ fn operator_files() -> Vec<LockedOperatorFileV1> {
                 LockedOperatorFileFormatV1::PemCertificate
             } else if id.ends_with("-private-key") {
                 LockedOperatorFileFormatV1::PemPrivateKey
-            } else if *id == "notary-signing-key" {
-                LockedOperatorFileFormatV1::JsonWebKey
-            } else if *id == "notary-relay-workload-credential" {
-                LockedOperatorFileFormatV1::CompactJwt
             } else {
                 LockedOperatorFileFormatV1::Opaque
             };
@@ -306,7 +255,6 @@ fn runtime() -> LockedRuntimeMappingV1 {
     LockedRuntimeMappingV1 {
         relay_public: product_runtime("registry-relay", "relay-public"),
         relay_consultation: product_runtime("registry-relay", "relay-consultation"),
-        notary: product_runtime("registry-notary", "notary"),
         postgresql_state_plane: LockedPostgresqlRuntimeV1 {
             serve: LockedRuntimeActionV1 {
                 command: vec!["/postgresql-state-plane".to_string()],
@@ -385,21 +333,13 @@ fn write_source_tree(root: &Path, lane: ApprovedLaneV1) {
     fs::create_dir_all(bundle_dir.join("config")).unwrap();
     fs::create_dir_all(bundle_dir.join("descriptors")).unwrap();
     fs::create_dir_all(&anchor_dir).unwrap();
-    let config = if lane == ApprovedLaneV1::Notary {
-        "config/notary.yaml"
-    } else {
-        "config/relay.yaml"
-    };
+    let config = "config/relay.yaml";
     fs::write(bundle_dir.join(config), "value-free: true\n").unwrap();
     let environment_key = format!(
         "REGISTRY_{}_TEST_SECRET",
         lane_id.replace('-', "_").to_ascii_uppercase()
     );
-    let product = if lane == ApprovedLaneV1::Notary {
-        "registry-notary"
-    } else {
-        "registry-relay"
-    };
+    let product = "registry-relay";
     fs::write(
         bundle_dir.join("descriptors/secret-consumers.json"),
         serde_json::to_vec(&json!({
@@ -446,21 +386,12 @@ fn package_fixture() -> PackageFixture {
                 "approved",
                 'a',
                 'd',
-                None,
             ),
             relay_consultation: approved_set_support::entry(
                 ApprovedLaneV1::RelayConsultation,
                 "approved",
                 'b',
                 'e',
-                Some('c'),
-            ),
-            notary: approved_set_support::entry(
-                ApprovedLaneV1::Notary,
-                "approved",
-                'c',
-                'f',
-                Some('c'),
             ),
         },
     };
@@ -619,6 +550,23 @@ fn initialization_effective(fixture: &PackageFixture) -> Value {
         .unwrap()
 }
 
+#[test]
+fn generated_deployment_surface_is_relay_only() {
+    let fixture = package_fixture();
+    for relative in [
+        "generated/deployment-plan.v1.json",
+        "generated/compose.yaml",
+        "generated/compose.initialize.yaml",
+        "generated/RUNBOOK.md",
+    ] {
+        let rendered = fs::read_to_string(fixture.package.join(relative)).unwrap();
+        assert!(
+            !rendered.to_ascii_lowercase().contains("notary"),
+            "{relative} retained a Notary service, action, secret, or volume:\n{rendered}"
+        );
+    }
+}
+
 #[test]
 fn deployment_plan_round_trips_the_closed_topology() {
     let plan = plan();
@@ -633,11 +581,7 @@ fn deployment_plan_round_trips_the_closed_topology() {
     };
     assert_eq!(product("relay-public")["secret_consumers"], json!([]));
     assert_eq!(product("relay-consultation")["secret_consumers"], json!([]));
-    assert_eq!(
-        product("notary")["secret_consumers"],
-        json!(["notary-relay-workload-credential", "notary-signing-key"])
-    );
-    for id in ["relay-public", "relay-consultation", "notary"] {
+    for id in ["relay-public", "relay-consultation"] {
         assert!(!product(id)["mount_roles"]
             .as_array()
             .unwrap()
@@ -924,7 +868,7 @@ fn edited_generated_file_is_invalid_and_requires_a_new_output() {
 fn hard_invariant_changes_are_invalid() {
     let fixture = package_fixture();
     let mut ordinary = fixture.models.ordinary.clone();
-    ordinary["services"]["registry-notary"]["command"] = json!(["/operator-command"]);
+    ordinary["services"]["registry-relay-public"]["command"] = json!(["/operator-command"]);
     let effective = EffectiveComposeModelsV1 {
         standalone_ordinary: ordinary,
         initialization: initialization_effective(&fixture),
@@ -949,8 +893,8 @@ fn supporting_entrypoints_and_required_dependencies_are_hard_invariants() {
     );
     let mut ordinary = fixture.models.ordinary.clone();
     ordinary["services"]["registry-postgres"]["entrypoint"] = json!(["/operator-entrypoint"]);
-    ordinary["services"]["registry-notary"]["depends_on"]["registry-postgres"]["required"] =
-        json!(false);
+    ordinary["services"]["registry-relay-consultation"]["depends_on"]["registry-postgres"]
+        ["required"] = json!(false);
     let effective = EffectiveComposeModelsV1 {
         standalone_ordinary: ordinary,
         initialization: initialization_effective(&fixture),
@@ -964,7 +908,8 @@ fn supporting_entrypoints_and_required_dependencies_are_hard_invariants() {
     assert!(report
         .violations
         .iter()
-        .any(|violation| violation.contains("registry-notary changed its locked depends_on")));
+        .any(|violation| violation
+            .contains("registry-relay-consultation changed its locked depends_on")));
 }
 
 #[test]
@@ -973,8 +918,7 @@ fn binding_contains_only_locators_not_secret_values() {
     binding.validate().unwrap();
     let rendered = serde_norway::to_string(&binding).unwrap();
     assert!(!rendered.contains("edge_network_name"));
-    assert!(rendered.contains("operator/secrets/notary-signing-key"));
-    for lane in ["relay-public", "relay-consultation", "notary"] {
+    for lane in ["relay-public", "relay-consultation"] {
         assert!(rendered.contains(&format!("operator/secrets/{lane}-environment")));
         assert!(!rendered.contains(&format!("{lane}-serve-environment")));
         assert!(!rendered.contains(&format!("{lane}-prepare-environment")));
@@ -992,9 +936,10 @@ fn binding_rejects_shared_or_aliased_operator_file_locators() {
         .get("relay-public-environment")
         .unwrap()
         .clone();
-    shared
-        .secret_files
-        .insert("notary-environment".to_string(), relay_environment);
+    shared.secret_files.insert(
+        "relay-consultation-environment".to_string(),
+        relay_environment,
+    );
     let error = shared.validate().unwrap_err();
     assert!(error
         .to_string()
@@ -1002,8 +947,8 @@ fn binding_rejects_shared_or_aliased_operator_file_locators() {
 
     let mut aliased = binding();
     aliased.secret_files.insert(
-        "notary-environment".to_string(),
-        "operator//secrets/notary-environment".to_string(),
+        "relay-consultation-environment".to_string(),
+        "operator//secrets/relay-consultation-environment".to_string(),
     );
     let error = aliased.validate().unwrap_err();
     assert!(error
@@ -1028,12 +973,6 @@ fn initialization_is_a_delta_and_prepare_state_has_no_acceptance_authority() {
     assert_eq!(
         delta_services.keys().cloned().collect::<Vec<_>>(),
         vec![
-            "registry-notary-accept-state",
-            "registry-notary-actions-stage-secrets",
-            "registry-notary-initialize",
-            "registry-notary-prepare-state",
-            "registry-notary-preview-state",
-            "registry-notary-verify-state",
             "registry-postgres",
             "registry-postgres-bootstrap",
             "registry-postgresql-actions-stage-secrets",
@@ -1059,10 +998,6 @@ fn initialization_is_a_delta_and_prepare_state_has_no_acceptance_authority() {
             "registry-relay-consultation-initialize",
             "registry-relay-consultation-actions-stage-secrets",
         ),
-        (
-            "registry-notary-prepare-state",
-            "registry-notary-actions-stage-secrets",
-        ),
         (
             "registry-postgres-bootstrap",
             "registry-postgresql-actions-stage-secrets",
@@ -1079,7 +1014,6 @@ fn initialization_is_a_delta_and_prepare_state_has_no_acceptance_authority() {
     for service_name in [
         "registry-relay-consultation-prepare-state",
         "registry-relay-consultation-initialize",
-        "registry-notary-prepare-state",
     ] {
         assert_eq!(
             delta_services[service_name]["depends_on"]["registry-postgres"],
@@ -1094,7 +1028,6 @@ fn initialization_is_a_delta_and_prepare_state_has_no_acceptance_authority() {
     for service_name in [
         "registry-relay-public-prepare-state",
         "registry-relay-public-initialize",
-        "registry-notary-initialize",
     ] {
         assert!(delta_services[service_name]["depends_on"]
             .as_object()
@@ -1106,7 +1039,6 @@ fn initialization_is_a_delta_and_prepare_state_has_no_acceptance_authority() {
     for service in [
         "registry-relay-public-prepare-state",
         "registry-relay-consultation-prepare-state",
-        "registry-notary-prepare-state",
     ] {
         let service = &delta_services[service];
         let targets = service["volumes"]
@@ -1123,7 +1055,6 @@ fn initialization_is_a_delta_and_prepare_state_has_no_acceptance_authority() {
     for service in [
         "registry-relay-public-initialize",
         "registry-relay-consultation-initialize",
-        "registry-notary-initialize",
     ] {
         let service = &delta_services[service];
         assert!(service.get("volumes").is_some());
@@ -1143,12 +1074,6 @@ fn initialization_is_a_delta_and_prepare_state_has_no_acceptance_authority() {
             true,
             false,
         ),
-        (
-            "registry-notary-preview-state",
-            &expected_runtime.notary.preview_state,
-            true,
-            false,
-        ),
         (
             "registry-relay-public-verify-state",
             &expected_runtime.relay_public.verify_state,
@@ -1161,12 +1086,6 @@ fn initialization_is_a_delta_and_prepare_state_has_no_acceptance_authority() {
             true,
             false,
         ),
-        (
-            "registry-notary-verify-state",
-            &expected_runtime.notary.verify_state,
-            true,
-            false,
-        ),
         (
             "registry-relay-public-accept-state",
             &expected_runtime.relay_public.accept_state,
@@ -1179,12 +1098,6 @@ fn initialization_is_a_delta_and_prepare_state_has_no_acceptance_authority() {
             false,
             true,
         ),
-        (
-            "registry-notary-accept-state",
-            &expected_runtime.notary.accept_state,
-            false,
-            true,
-        ),
     ] {
         let service = &delta_services[service_name];
         assert_eq!(service["command"], json!(action.command));
@@ -1263,7 +1176,7 @@ fn initialization_is_a_delta_and_prepare_state_has_no_acceptance_authority() {
 fn secret_staging_is_isolated_and_consumers_receive_only_read_only_volumes() {
     let fixture = package_fixture();
     let services = fixture.models.ordinary["services"].as_object().unwrap();
-    assert_eq!(services.len(), 7);
+    assert_eq!(services.len(), 5);
     let expected_stagers = [
         (
             "registry-postgresql-stage-secrets",
@@ -1285,18 +1198,6 @@ fn secret_staging_is_isolated_and_consumers_receive_only_read_only_volumes() {
             )],
             vec!["postgresql-tls-certificate"],
         ),
-        (
-            "registry-notary-stage-secrets",
-            vec![(
-                "registry-operator-files-notary-serve",
-                "/registryctl-stage/output/notary-serve",
-            )],
-            vec![
-                "notary-relay-workload-credential",
-                "notary-signing-key",
-                "postgresql-tls-certificate",
-            ],
-        ),
     ];
     assert!(services.get("registry-runtime-stage-secrets").is_none());
     for (service_name, expected_outputs, expected_sources) in expected_stagers {
@@ -1361,14 +1262,6 @@ fn secret_staging_is_isolated_and_consumers_receive_only_read_only_volumes() {
             ],
             vec!["postgresql-tls-certificate"],
         ),
-        (
-            "registry-notary-actions-stage-secrets",
-            vec![(
-                "registry-operator-files-notary-prepare",
-                "/registryctl-stage/output/notary-prepare",
-            )],
-            vec!["postgresql-tls-certificate"],
-        ),
     ];
     for (service_name, expected_outputs, expected_sources) in expected_action_stagers {
         assert!(
@@ -1413,17 +1306,12 @@ fn secret_staging_is_isolated_and_consumers_receive_only_read_only_volumes() {
         "registry-postgres",
         "registry-relay-public",
         "registry-relay-consultation",
-        "registry-notary",
     ] {
         let service = &services[service_name];
         assert!(service.get("cap_add").is_none());
         assert!(service.get("secrets").is_none());
     }
-    for service_name in [
-        "registry-postgres",
-        "registry-relay-consultation",
-        "registry-notary",
-    ] {
+    for service_name in ["registry-postgres", "registry-relay-consultation"] {
         let secret_mount = services[service_name]["volumes"]
             .as_array()
             .unwrap()
@@ -1462,15 +1350,6 @@ fn secret_staging_is_isolated_and_consumers_receive_only_read_only_volumes() {
             .unwrap()["source"],
         "registry-operator-files-relay-consultation-serve"
     );
-    assert_eq!(
-        services["registry-notary"]["volumes"]
-            .as_array()
-            .unwrap()
-            .iter()
-            .find(|mount| mount["target"] == "/run/secrets")
-            .unwrap()["source"],
-        "registry-operator-files-notary-serve"
-    );
 }
 
 #[test]
@@ -1479,12 +1358,12 @@ fn secret_stager_cannot_gain_cross_owner_inputs_or_outputs() {
     let mut ordinary = fixture.models.ordinary.clone();
     let stager = &mut ordinary["services"]["registry-relay-consultation-stage-secrets"];
     stager["secrets"].as_array_mut().unwrap().push(json!({
-        "source": "registry-notary-signing-key",
-        "target": "notary-signing-key"
+        "source": "registry-postgresql-admin-password",
+        "target": "postgresql-admin-password"
     }));
     stager["volumes"].as_array_mut().unwrap().push(json!({
         "type": "volume",
-        "source": "registry-operator-files-notary-serve",
+        "source": "registry-operator-files-postgresql-serve",
         "target": "/registryctl-stage/cross-action",
         "read_only": false
     }));
@@ -1531,7 +1410,6 @@ fn package_normalizes_locators_and_mounts_digest_specific_lane_inputs() {
         let service = match lane {
             ApprovedLaneV1::RelayPublic => "registry-relay-public",
             ApprovedLaneV1::RelayConsultation => "registry-relay-consultation",
-            ApprovedLaneV1::Notary => "registry-notary",
         };
         let bundle_mount = fixture.models.ordinary["services"][service]["volumes"]
             .as_array()
@@ -1556,11 +1434,9 @@ fn package_normalizes_locators_and_mounts_digest_specific_lane_inputs() {
         fs::read(consultation_anchors.join("transition.json")).unwrap(),
         fs::read(consultation_anchors.join("history/0001.transition.json")).unwrap()
     );
-    for lane in ["relay-public", "notary"] {
-        let anchors = fixture.package.join("generated/anchors").join(lane);
-        assert!(!anchors.join("previous-anchor.json").exists());
-        assert!(!anchors.join("transition.json").exists());
-    }
+    let public_anchors = fixture.package.join("generated/anchors/relay-public");
+    assert!(!public_anchors.join("previous-anchor.json").exists());
+    assert!(!public_anchors.join("transition.json").exists());
 }
 
 #[test]
@@ -1616,15 +1492,10 @@ fn ordinary_networking_publishes_only_public_applications_on_loopback() {
     assert!(services["registry-relay-consultation"]
         .get("ports")
         .is_none());
-    assert_eq!(
-        services["registry-notary"]["ports"],
-        published_port("127.0.0.1", 4255, 8081)
-    );
     assert!(services["registry-postgres"].get("ports").is_none());
     for service_name in [
         "registry-relay-public",
         "registry-relay-consultation",
-        "registry-notary",
         "registry-postgres",
     ] {
         assert_eq!(
@@ -1645,13 +1516,10 @@ fn ordinary_networking_publishes_only_public_applications_on_loopback() {
         .collect::<Vec<_>>();
     assert_eq!(
         published,
-        vec![
-            ("registry-notary", published_port("127.0.0.1", 4255, 8081),),
-            (
-                "registry-relay-public",
-                published_port("127.0.0.1", 4242, 8080),
-            ),
-        ]
+        vec![(
+            "registry-relay-public",
+            published_port("127.0.0.1", 4242, 8080),
+        )]
     );
     for service in services.as_object().unwrap().values() {
         assert!(service.get("ipc").is_none());
@@ -1665,7 +1533,6 @@ fn ordinary_networking_publishes_only_public_applications_on_loopback() {
         "registry-postgres-bootstrap",
         "registry-relay-consultation-prepare-state",
         "registry-relay-consultation-initialize",
-        "registry-notary-prepare-state",
     ] {
         assert_eq!(
             initialization[service_name]["networks"],
@@ -1676,16 +1543,12 @@ fn ordinary_networking_publishes_only_public_applications_on_loopback() {
     for service_name in [
         "registry-relay-public-prepare-state",
         "registry-relay-public-initialize",
-        "registry-notary-initialize",
         "registry-relay-public-preview-state",
         "registry-relay-consultation-preview-state",
-        "registry-notary-preview-state",
         "registry-relay-public-accept-state",
         "registry-relay-consultation-accept-state",
-        "registry-notary-accept-state",
         "registry-relay-public-verify-state",
         "registry-relay-consultation-verify-state",
-        "registry-notary-verify-state",
     ] {
         assert!(initialization[service_name].get("networks").is_none());
         assert_eq!(initialization[service_name]["network_mode"], "none");
@@ -1703,8 +1566,6 @@ fn durable_volumes_are_stable_and_scratch_volumes_are_project_scoped() {
         "registry-relay-public-audit",
         "registry-relay-consultation-state",
         "registry-relay-consultation-audit",
-        "registry-notary-state",
-        "registry-notary-audit",
     ] {
         assert_eq!(
             volumes[name],
@@ -1731,7 +1592,6 @@ fn generated_services_use_fixed_bounded_local_logging() {
     for service_name in [
         "registry-relay-public",
         "registry-relay-consultation",
-        "registry-notary",
         "registry-postgres",
     ] {
         assert_eq!(
@@ -1745,17 +1605,12 @@ fn generated_services_use_fixed_bounded_local_logging() {
         "registry-relay-public-initialize",
         "registry-relay-consultation-prepare-state",
         "registry-relay-consultation-initialize",
-        "registry-notary-prepare-state",
-        "registry-notary-initialize",
         "registry-relay-public-preview-state",
         "registry-relay-consultation-preview-state",
-        "registry-notary-preview-state",
         "registry-relay-public-accept-state",
         "registry-relay-consultation-accept-state",
-        "registry-notary-accept-state",
         "registry-relay-public-verify-state",
         "registry-relay-consultation-verify-state",
-        "registry-notary-verify-state",
     ] {
         assert_eq!(
             fixture.models.initialization["services"][service_name]["logging"],
@@ -1765,7 +1620,6 @@ fn generated_services_use_fixed_bounded_local_logging() {
     for service_name in [
         "registry-postgresql-stage-secrets",
         "registry-relay-consultation-stage-secrets",
-        "registry-notary-stage-secrets",
     ] {
         assert!(fixture.models.ordinary["services"][service_name]
             .get("logging")
@@ -1796,8 +1650,6 @@ fn top_level_secrets_exclude_environment_files() {
     assert_eq!(
         secrets.keys().map(String::as_str).collect::<Vec<_>>(),
         vec![
-            "registry-notary-relay-workload-credential",
-            "registry-notary-signing-key",
             "registry-postgresql-admin-password",
             "registry-postgresql-tls-certificate",
             "registry-postgresql-tls-private-key",
@@ -1806,7 +1658,6 @@ fn top_level_secrets_exclude_environment_files() {
     for environment in [
         "relay-public-environment",
         "relay-consultation-environment",
-        "notary-environment",
         "postgresql-bootstrap-environment",
     ] {
         assert!(!secrets.contains_key(&format!("registry-{environment}")));
@@ -1820,7 +1671,7 @@ fn exact_mount_source_type_access_and_lane_are_hard_invariants() {
         (
             "source",
             json!(
-                "./bundles/notary/ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+                "./bundles/relay-consultation/ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
             ),
         ),
         ("type", json!("volume")),
@@ -2112,7 +1963,7 @@ fn runbook_covers_first_install_start_update_and_recovery_without_reset() {
         &fs::read(fixture.package.join("generated/operator-files.v1.json")).unwrap(),
     )
     .unwrap();
-    for lane in ["relay-public", "relay-consultation", "notary"] {
+    for lane in ["relay-public", "relay-consultation"] {
         let expected_key = format!(
             "REGISTRY_{}_TEST_SECRET",
             lane.replace('-', "_").to_ascii_uppercase()
@@ -2156,7 +2007,6 @@ fn runbook_covers_first_install_start_update_and_recovery_without_reset() {
     for service in [
         "registry-relay-public-verify-state",
         "registry-relay-consultation-verify-state",
-        "registry-notary-verify-state",
     ] {
         assert!(runbook.contains(service));
     }
@@ -2171,7 +2021,6 @@ fn runbook_covers_first_install_start_update_and_recovery_without_reset() {
     }
     let serving_stages = [
         "registry-relay-consultation-stage-secrets",
-        "registry-notary-stage-secrets",
         "registry-postgresql-stage-secrets",
     ];
     for stage in serving_stages {
@@ -2185,7 +2034,6 @@ fn runbook_covers_first_install_start_update_and_recovery_without_reset() {
     assert!(!runbook.contains("registry-relay-public-stage-secrets"));
     let action_stages = [
         "registry-relay-consultation-actions-stage-secrets",
-        "registry-notary-actions-stage-secrets",
         "registry-postgresql-actions-stage-secrets",
     ];
     for stage in action_stages {
@@ -2209,23 +2057,20 @@ fn runbook_covers_first_install_start_update_and_recovery_without_reset() {
     assert!(runbook.contains(&format!(
         "{first_install_config}\n{action_staging_sequence}\n{action_compose} run --rm registry-postgres-bootstrap"
     )));
-    let initialize_notary = runbook.find("registry-notary-initialize").unwrap();
-    let first_verify_public = runbook[initialize_notary..]
+    let initialize_consultation = runbook
+        .find("registry-relay-consultation-initialize")
+        .unwrap();
+    let first_verify_public = runbook[initialize_consultation..]
         .find("registry-relay-public-verify-state")
-        .map(|offset| initialize_notary + offset)
+        .map(|offset| initialize_consultation + offset)
         .unwrap();
     let first_verify_consultation = runbook[first_verify_public..]
         .find("registry-relay-consultation-verify-state")
         .map(|offset| first_verify_public + offset)
         .unwrap();
-    let first_verify_notary = runbook[first_verify_consultation..]
-        .find("registry-notary-verify-state")
-        .map(|offset| first_verify_consultation + offset)
-        .unwrap();
     assert!(
-        initialize_notary < first_verify_public
+        initialize_consultation < first_verify_public
             && first_verify_public < first_verify_consultation
-            && first_verify_consultation < first_verify_notary
     );
     assert!(runbook.contains(&format!(
         "{serving_staging_sequence}\n{ordinary_compose} up --detach --wait --wait-timeout 120"
@@ -2249,27 +2094,23 @@ fn runbook_covers_first_install_start_update_and_recovery_without_reset() {
     let preview_consultation = runbook
         .find("registry-relay-consultation-preview-state")
         .unwrap();
-    let preview_notary = runbook.find("registry-notary-preview-state").unwrap();
-    let stop = runbook[preview_notary..]
+    let stop = runbook[preview_consultation..]
         .find("generated/compose.yaml stop")
-        .map(|offset| preview_notary + offset)
+        .map(|offset| preview_consultation + offset)
         .unwrap();
     let accept_public = runbook.find("registry-relay-public-accept-state").unwrap();
     let accept_consultation = runbook
         .find("registry-relay-consultation-accept-state")
         .unwrap();
-    let accept_notary = runbook.find("registry-notary-accept-state").unwrap();
     assert!(
         preview_public < preview_consultation
-            && preview_consultation < preview_notary
-            && preview_notary < stop
+            && preview_consultation < stop
             && stop < accept_public
             && accept_public < accept_consultation
-            && accept_consultation < accept_notary
     );
-    let update_start = runbook[accept_notary..]
+    let update_start = runbook[accept_consultation..]
         .find("generated/compose.yaml up --detach --wait --wait-timeout 120")
-        .map(|offset| accept_notary + offset)
+        .map(|offset| accept_consultation + offset)
         .unwrap();
     let post_start_verify_public = runbook[update_start..]
         .find("registry-relay-public-verify-state")
@@ -2279,14 +2120,9 @@ fn runbook_covers_first_install_start_update_and_recovery_without_reset() {
         .find("registry-relay-consultation-verify-state")
         .map(|offset| post_start_verify_public + offset)
         .unwrap();
-    let post_start_verify_notary = runbook[post_start_verify_consultation..]
-        .find("registry-notary-verify-state")
-        .map(|offset| post_start_verify_consultation + offset)
-        .unwrap();
     assert!(
         update_start < post_start_verify_public
             && post_start_verify_public < post_start_verify_consultation
-            && post_start_verify_consultation < post_start_verify_notary
     );
     assert!(runbook
         .contains("Do not stop any service or accept any lane unless every preview succeeds"));
@@ -2294,39 +2130,10 @@ fn runbook_covers_first_install_start_update_and_recovery_without_reset() {
     assert!(!runbook.contains("registry-runtime-stage-secrets"));
     assert!(!runbook.contains("registry-relay-public-serve-stage-secrets"));
     assert!(!runbook.contains("registry-relay-consultation-serve-stage-secrets"));
-    assert!(!runbook.contains("registry-notary-serve-stage-secrets"));
     assert!(!runbook.contains("registry-postgresql-serve-stage-secrets"));
     assert!(!runbook.contains("--force"));
 }
 
-#[test]
-fn public_operator_command_blocks_match_the_generated_runbook() {
-    let fixture = package_fixture();
-    let runbook = fs::read_to_string(fixture.package.join("generated/RUNBOOK.md")).unwrap();
-    let standalone = include_str!(
-        "../../../docs/site/src/content/docs/operate/single-node-compose-behind-proxy.mdx"
-    );
-    let update =
-        include_str!("../../../docs/site/src/content/docs/operate/upgrade-and-rollback.mdx");
-
-    assert_eq!(
-        shell_fence_after_heading(standalone, "## Initialize each product once", 2),
-        shell_fence_after_heading(&runbook, "## First installation only", 1),
-    );
-    assert_eq!(
-        shell_fence_after_heading(standalone, "## Run the package standalone", 1),
-        shell_fence_after_heading(&runbook, "## Ordinary start and stop", 1),
-    );
-    assert_eq!(
-        shell_fence_after_heading(
-            update,
-            "## Preview, accept, verify, and start the candidate",
-            1,
-        ),
-        shell_fence_after_heading(&runbook, "## Product or image update", 2),
-    );
-}
-
 #[test]
 fn production_verifier_succeeds_without_docker() {
     let fixture = package_fixture();
@@ -2417,43 +2224,6 @@ fn managed_package_rejects_project_local_file_datasets() {
         .contains("cannot package a project-local file dataset"));
 }
 
-#[test]
-fn managed_package_rejects_notary_loopback_but_accepts_private_service_http() {
-    let fixture = package_fixture();
-    fs::remove_dir_all(&fixture.package).unwrap();
-    let notary_config = fixture
-        .approved_set_file
-        .parent()
-        .unwrap()
-        .join("approved/notary/bundle/config/notary.yaml");
-    fs::write(
-        &notary_config,
-        "evidence:\n  relay:\n    base_url: http://127.0.0.1:8080\n",
-    )
-    .unwrap();
-    let request = DeploymentGenerateRequestV1 {
-        approved_set_file: fixture.approved_set_file.clone(),
-        output_dir: fixture.package.clone(),
-        binding_file: None,
-    };
-    assert!(generate_deployment_package_with_test_inputs(
-        request.clone(),
-        fixture.verified_inputs.clone(),
-        None,
-    )
-    .unwrap_err()
-    .to_string()
-    .contains("loopback is not shared across workloads"));
-
-    fs::write(
-        notary_config,
-        "evidence:\n  relay:\n    base_url: http://registry-relay-consultation:8080\n    allow_insecure_private_network: true\n",
-    )
-    .unwrap();
-    generate_deployment_package_with_test_inputs(request, fixture.verified_inputs, None)
-        .expect("private service HTTP package renders");
-}
-
 #[test]
 fn high_level_generation_derives_a_safe_binding_from_signed_identity() {
     let fixture = package_fixture();
@@ -2729,10 +2499,6 @@ fn ipv6_loopback_uses_unambiguous_compose_port_syntax() {
         report.models.ordinary["services"]["registry-relay-public"]["ports"],
         published_port("::1", 4242, 8080)
     );
-    assert_eq!(
-        report.models.ordinary["services"]["registry-notary"]["ports"],
-        published_port("::1", 4255, 8081)
-    );
 }
 
 #[test]
@@ -2827,8 +2593,8 @@ fn python_release_lock_runtime_renders_compose_conformance() {
     for (label, source, replacement, diagnostic) in [
         (
             "product command drift",
-            r#""command":["product-action","serve"]"#,
-            r#""command":["product-action","drift"]"#,
+            r#""command":["product-action","relay-public","serve"]"#,
+            r#""command":["product-action","relay-public","drift"]"#,
             "exact supported command",
         ),
         (
@@ -2867,13 +2633,13 @@ fn python_release_lock_runtime_renders_compose_conformance() {
             json!(["relay-public-environment"]),
         ),
         (
-            "verify serving credential",
-            "notary",
+            "verify credential",
+            "relay_public",
             "verify_state",
             "secret_files",
             json!([{
-                "file_id": "notary-signing-key",
-                "target": "/run/secrets/notary-signing-key.jwk",
+                "file_id": "postgresql-tls-certificate",
+                "target": "/run/secrets/postgresql-ca.pem",
                 "mode": "0400",
                 "uid": "65532",
                 "gid": "65532"
@@ -2934,7 +2700,7 @@ fn python_release_lock_runtime_renders_compose_conformance() {
 
     let compose_path = package.join("generated/compose.yaml");
     let mut compose: Value = serde_norway::from_slice(&fs::read(&compose_path).unwrap()).unwrap();
-    compose["services"]["registry-notary"]["command"] = json!(["runtime-drift"]);
+    compose["services"]["registry-relay-public"]["command"] = json!(["runtime-drift"]);
     fs::write(&compose_path, serde_norway::to_string(&compose).unwrap()).unwrap();
     let drift = runtime_parity_checker(&package, &payload);
     assert!(!drift.status.success(), "Compose drift was not detected");
@@ -2945,3 +2711,51 @@ fn python_release_lock_runtime_renders_compose_conformance() {
         String::from_utf8_lossy(&drift.stderr)
     );
 }
+
+// The Registry Notary retirement removed `ports.notary` and three operator
+// secret ids from the binding, and the `Notary` product lane from the plan.
+// Both documents are read back from an adopter's disk under
+// `deny_unknown_fields`, so the declared schema version has to move with the
+// required shape. Leaving it at `1.0` would let two incompatible shapes claim
+// one version.
+#[test]
+fn binding_declares_the_post_retirement_schema_version() {
+    assert_eq!(DEPLOYMENT_BINDING_SCHEMA_VERSION, "2.0");
+    let binding = binding();
+    assert_eq!(binding.schema_version, DEPLOYMENT_BINDING_SCHEMA_VERSION);
+    binding.validate().unwrap();
+}
+
+#[test]
+fn binding_rejects_the_pre_retirement_schema_version() {
+    let mut binding = binding();
+    binding.schema_version = "1.0".to_string();
+    let error = binding
+        .validate()
+        .expect_err("a pre-retirement binding must not validate");
+    assert!(
+        format!("{error:#}").contains("io.registrystack.deployment_binding 1.0"),
+        "{error:#}"
+    );
+}
+
+#[test]
+fn deployment_plan_declares_the_post_retirement_schema_version() {
+    assert_eq!(DEPLOYMENT_PLAN_SCHEMA_VERSION, "2.0");
+    let plan = plan();
+    assert_eq!(plan.schema_version, DEPLOYMENT_PLAN_SCHEMA_VERSION);
+    plan.validate().unwrap();
+}
+
+#[test]
+fn deployment_plan_rejects_the_pre_retirement_schema_version() {
+    let mut plan = plan();
+    plan.schema_version = "1.0".to_string();
+    let error = plan
+        .validate()
+        .expect_err("a pre-retirement plan must not validate");
+    assert!(
+        format!("{error:#}").contains("io.registrystack.deployment_plan 1.0"),
+        "{error:#}"
+    );
+}
diff --git a/crates/registryctl/tests/dev_runtime_core.rs b/crates/registryctl/tests/dev_runtime_core.rs
index b83ec2999..094218ba9 100644
--- a/crates/registryctl/tests/dev_runtime_core.rs
+++ b/crates/registryctl/tests/dev_runtime_core.rs
@@ -77,9 +77,6 @@ mod release_lock {
         pub fn relay(&self) -> &str {
             unreachable!()
         }
-        pub fn notary(&self) -> &str {
-            unreachable!()
-        }
         pub fn postgresql_state_plane(&self) -> &str {
             unreachable!()
         }
@@ -140,9 +137,6 @@ mod release_lock {
         pub fn relay_consultation(&self) -> &ProductRuntime {
             unreachable!()
         }
-        pub fn notary(&self) -> &ProductRuntime {
-            unreachable!()
-        }
         pub fn postgresql_state_plane(&self) -> &PostgresqlRuntime {
             unreachable!()
         }
@@ -221,29 +215,20 @@ mod dev_credentials {
     #[derive(Clone, Debug, Eq, PartialEq)]
     pub struct PreparedDevCredentialFiles {
         pub root: PathBuf,
-        pub caller_token: PathBuf,
         pub relay_match_token: Option<PathBuf>,
         pub relay_no_match_token: Option<PathBuf>,
-        pub workload_token: PathBuf,
-        pub workload_public_jwk: PathBuf,
-        pub workload_jwks: PathBuf,
         pub relay_public_prepare: PreparedDevActionCredentialFile,
         pub relay_public_initialize: PreparedDevActionCredentialFile,
         pub relay_public_serve: PreparedDevActionCredentialFile,
         pub relay_consultation_prepare: PreparedDevActionCredentialFile,
         pub relay_consultation_initialize: PreparedDevActionCredentialFile,
         pub relay_consultation_serve: PreparedDevActionCredentialFile,
-        pub notary_prepare: PreparedDevActionCredentialFile,
-        pub notary_initialize: PreparedDevActionCredentialFile,
-        pub notary_serve: PreparedDevActionCredentialFile,
         pub postgres_bootstrap: PreparedDevActionCredentialFile,
         pub postgres_admin_password: PathBuf,
-        pub notary_signing_key: PathBuf,
         pub postgres_tls_certificate: PathBuf,
         pub postgres_tls_private_key: PathBuf,
         pub source: Option<PreparedDevSourceCredentialFiles>,
-        pub issuance_public_jwk: Option<PathBuf>,
-        pub lane_public_jwks: [PathBuf; 3],
+        pub lane_public_jwks: [PathBuf; 2],
     }
 
     impl PreparedDevCredentialClosure {
@@ -347,34 +332,24 @@ mod dev_credentials {
             });
             PreparedDevCredentialFiles {
                 root: root.to_path_buf(),
-                caller_token: root.join("caller-token"),
                 relay_match_token: self.relay_api_keys.then(|| root.join("relay-match-token")),
                 relay_no_match_token: self
                     .relay_api_keys
                     .then(|| root.join("relay-no-match-token")),
-                workload_token: root.join("notary-relay-token"),
-                workload_public_jwk: root.join("notary-workload-public.jwk"),
-                workload_jwks: root.join("notary-workload-jwks.json"),
                 relay_public_prepare: action("relay-public-prepare.env"),
                 relay_public_initialize: action("relay-public-initialize.env"),
                 relay_public_serve: action("relay-public-serve.env"),
                 relay_consultation_prepare: action("relay-consultation-prepare.env"),
                 relay_consultation_initialize: action("relay-consultation-initialize.env"),
                 relay_consultation_serve: action("relay-consultation-serve.env"),
-                notary_prepare: action("notary-prepare.env"),
-                notary_initialize: action("notary-initialize.env"),
-                notary_serve: action("notary-serve.env"),
                 postgres_bootstrap: action("postgres-bootstrap.env"),
                 postgres_admin_password: root.join("postgres-admin-password"),
-                notary_signing_key: root.join("notary-signing-key.jwk"),
                 postgres_tls_certificate: root.join("postgres-tls.crt"),
                 postgres_tls_private_key: root.join("postgres-tls.key"),
                 source,
-                issuance_public_jwk: None,
                 lane_public_jwks: [
                     root.join("relay-public-lane.jwk"),
                     root.join("relay-consultation-lane.jwk"),
-                    root.join("notary-lane.jwk"),
                 ],
             }
         }
@@ -391,27 +366,18 @@ mod dev_credentials {
                 fs::set_permissions(root, fs::Permissions::from_mode(0o700))?;
             }
             let mut paths = vec![
-                (&files.caller_token, "test-caller-token"),
-                (&files.workload_token, "test-workload-token"),
-                (&files.workload_public_jwk, "{}"),
-                (&files.workload_jwks, "{\"keys\":[]}"),
                 (&files.relay_public_prepare.host_path, "A=1\n"),
                 (&files.relay_public_initialize.host_path, "A=1\n"),
                 (&files.relay_public_serve.host_path, "A=1\n"),
                 (&files.relay_consultation_prepare.host_path, "A=1\n"),
                 (&files.relay_consultation_initialize.host_path, "A=1\n"),
                 (&files.relay_consultation_serve.host_path, "A=1\n"),
-                (&files.notary_prepare.host_path, "A=1\n"),
-                (&files.notary_initialize.host_path, "A=1\n"),
-                (&files.notary_serve.host_path, "A=1\n"),
                 (&files.postgres_bootstrap.host_path, "A=1\n"),
                 (&files.postgres_admin_password, "postgres-admin-password"),
-                (&files.notary_signing_key, "{}"),
                 (&files.postgres_tls_certificate, "certificate"),
                 (&files.postgres_tls_private_key, "private-key"),
                 (&files.lane_public_jwks[0], "{}"),
                 (&files.lane_public_jwks[1], "{}"),
-                (&files.lane_public_jwks[2], "{}"),
             ];
             if let Some(path) = &files.relay_match_token {
                 paths.push((path, "test-relay-match-token"));
@@ -485,9 +451,7 @@ mod project_authoring {
         pub relay_public_anchor: PathBuf,
         pub relay_consultation_bundle: PathBuf,
         pub relay_consultation_anchor: PathBuf,
-        pub notary_bundle: PathBuf,
-        pub notary_anchor: PathBuf,
-        pub lane_config_digests: [String; 3],
+        pub lane_config_digests: [String; 2],
     }
 
     pub struct ProjectBuildOptions {
@@ -556,7 +520,6 @@ use registry_platform_config::{
 use registry_platform_crypto::{canonicalize_json, sign, PrivateJwk};
 
 const RESPONSE_CANARY: &str = "fixture-response-canary-value";
-const REQUEST_CANARY: &str = "fixture-request-canary-value";
 const TEST_PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"registryctl-test-private-key"}"#;
 
 fn free_port() -> u16 {
@@ -575,10 +538,6 @@ fn verified_release() -> VerifiedDevReleaseProjection {
             "ghcr.io/registrystack/registry-relay@sha256:{}",
             "a".repeat(64)
         ),
-        format!(
-            "ghcr.io/registrystack/registry-notary@sha256:{}",
-            "b".repeat(64)
-        ),
         format!("docker.io/library/postgres@sha256:{}", "c".repeat(64)),
         "2.24.0".to_string(),
     )
@@ -607,22 +566,12 @@ fn create_artifacts_generation(root: &Path, generation: &str) -> DevRuntimeArtif
     fs::write(&compose_file, "services: {}\n").unwrap();
     let relay_public_bundle = bundles.join("relay-public");
     let relay_consultation_bundle = bundles.join("relay-consultation");
-    let notary_bundle = bundles.join("notary");
-    for path in [
-        &relay_public_bundle,
-        &relay_consultation_bundle,
-        &notary_bundle,
-    ] {
+    for path in [&relay_public_bundle, &relay_consultation_bundle] {
         fs::create_dir(path).unwrap();
     }
     let relay_public_anchor = anchors.join("relay-public.json");
     let relay_consultation_anchor = anchors.join("relay-consultation.json");
-    let notary_anchor = anchors.join("notary.json");
-    for path in [
-        &relay_public_anchor,
-        &relay_consultation_anchor,
-        &notary_anchor,
-    ] {
+    for path in [&relay_public_anchor, &relay_consultation_anchor] {
         assert!(!path.exists());
     }
     write_development_trust_material(
@@ -639,21 +588,12 @@ fn create_artifacts_generation(root: &Path, generation: &str) -> DevRuntimeArtif
         ProductAcceptanceProductV1::RegistryRelay,
         "relay-consultation",
     );
-    write_development_trust_material(
-        &notary_bundle,
-        &notary_anchor,
-        ProductAcceptanceLaneV1::Notary,
-        ProductAcceptanceProductV1::RegistryNotary,
-        "notary",
-    );
     DevRuntimeArtifactInputs {
         compose_file,
         relay_public_bundle,
         relay_public_anchor,
         relay_consultation_bundle,
         relay_consultation_anchor,
-        notary_bundle,
-        notary_anchor,
     }
 }
 
@@ -730,14 +670,6 @@ fn write_development_trust_material(
 }
 
 fn scenario(provider: DevSourceProvider, oauth_profile: DevOAuthProfile) -> AuthoredDevScenario {
-    let expected_claim_results_sha256 =
-        dev_claim_results_commitment(vec![DevClaimResultExpectation {
-            claim_id: "eligibility".to_string(),
-            value: serde_json::json!(true),
-            satisfied: Some(true),
-            disclosure: "predicate".to_string(),
-        }])
-        .unwrap();
     AuthoredDevScenario {
         integration_id: "citizen-source".to_string(),
         fixture_id: "passing-default".to_string(),
@@ -751,8 +683,6 @@ fn scenario(provider: DevSourceProvider, oauth_profile: DevOAuthProfile) -> Auth
         oauth_profile,
         denial_scenario_id: "default-denied".to_string(),
         authorized_scenario_id: "default-authorized".to_string(),
-        minimized_claim_ids: vec!["eligibility".to_string()],
-        expected_claim_results_sha256,
         synthetic_source: Some(AuthoredSyntheticSourcePlan {
             scenario: SyntheticSourceScenario::AuthoredResponse,
             source_request: AuthoredSyntheticSourceRequest {
@@ -771,123 +701,13 @@ fn scenario(provider: DevSourceProvider, oauth_profile: DevOAuthProfile) -> Auth
                 .then_some(SyntheticOAuthResponseCase::Valid),
             oauth_request: (oauth_profile != DevOAuthProfile::None).then(|| {
                 AuthoredSyntheticOauthRequest {
-                    audience: Some("registry-notary".to_string()),
+                    audience: Some("registry-relay".to_string()),
                     scope: Some("registry.read".to_string()),
                     resource: Some("registry-source".to_string()),
                 }
             }),
             response_body: Some(format!(r#"{{"result":"{RESPONSE_CANARY}"}}"#).into_bytes()),
         }),
-        request_json: format!(r#"{{"subject":"{REQUEST_CANARY}"}}"#).into_bytes(),
-    }
-}
-
-fn authorized_claim_result() -> serde_json::Value {
-    serde_json::json!({
-        "evaluation_id": "evaluation-1",
-        "claim_id": "eligibility",
-        "claim_version": "1",
-        "subject_type": "Person",
-        "target_ref": {
-            "type": "Person",
-            "handle": "rnref:v1:test",
-            "identifier_schemes": []
-        },
-        "value": true,
-        "satisfied": true,
-        "disclosure": "predicate",
-        "format": "application/vnd.registry-notary.claim-result+json",
-        "issued_at": "2026-07-31T00:00:00Z",
-        "expires_at": null,
-        "provenance": {
-            "schema_version": "registry-notary-claim-provenance/v2",
-            "generated_by": {
-                "type": "claim_evaluation",
-                "service_id": "registry-notary",
-                "evaluation_id": "evaluation-1",
-                "claim_id": "eligibility",
-                "claim_version": "1"
-            },
-            "used": {"relay_consultation_count": 1},
-            "derived_from": []
-        }
-    })
-}
-
-#[test]
-fn authorized_evaluation_requires_the_committed_claim_outcome() {
-    let temporary = tempfile::tempdir().unwrap();
-    let mut plan = DevRuntimePlan::derive(plan_input(
-        temporary.path(),
-        DevSourceProvider::Http,
-        DevOAuthProfile::None,
-    ))
-    .unwrap();
-    let valid = serde_json::json!({"results": [authorized_claim_result()]});
-    let valid_bytes = serde_json::to_vec(&valid).unwrap();
-    assert_eq!(
-        validate_authorized_evaluation_response(&plan, &valid_bytes).unwrap(),
-        ["eligibility"]
-    );
-
-    for (field, unexpected) in [
-        ("value", serde_json::json!(false)),
-        ("satisfied", serde_json::json!(false)),
-        ("disclosure", serde_json::json!("value")),
-    ] {
-        let mut changed = valid.clone();
-        changed["results"][0][field] = unexpected;
-        assert!(
-            validate_authorized_evaluation_response(&plan, &serde_json::to_vec(&changed).unwrap())
-                .is_err(),
-            "{field} mismatch must fail smoke"
-        );
-    }
-
-    let mut missing = valid.clone();
-    missing["results"][0]
-        .as_object_mut()
-        .unwrap()
-        .remove("satisfied");
-    assert!(
-        validate_authorized_evaluation_response(&plan, &serde_json::to_vec(&missing).unwrap())
-            .is_err()
-    );
-
-    let duplicate = serde_json::json!({
-        "results": [authorized_claim_result(), authorized_claim_result()]
-    });
-    assert!(validate_authorized_evaluation_response(
-        &plan,
-        &serde_json::to_vec(&duplicate).unwrap()
-    )
-    .is_err());
-
-    plan.scenario.expected_claim_results_sha256 =
-        dev_claim_results_commitment(vec![DevClaimResultExpectation {
-            claim_id: "eligibility".to_string(),
-            value: serde_json::Value::Null,
-            satisfied: None,
-            disclosure: "redacted".to_string(),
-        }])
-        .unwrap();
-    let mut redacted = valid;
-    redacted["results"][0]["value"] = serde_json::Value::Null;
-    redacted["results"][0]["satisfied"] = serde_json::Value::Null;
-    redacted["results"][0]["disclosure"] = serde_json::json!("redacted");
-    assert!(validate_authorized_evaluation_response(
-        &plan,
-        &serde_json::to_vec(&redacted).unwrap()
-    )
-    .is_ok());
-    for field in ["value", "satisfied"] {
-        let mut missing = redacted.clone();
-        missing["results"][0].as_object_mut().unwrap().remove(field);
-        assert!(
-            validate_authorized_evaluation_response(&plan, &serde_json::to_vec(&missing).unwrap())
-                .is_err(),
-            "nullable {field} must still be present"
-        );
     }
 }
 
@@ -911,10 +731,6 @@ fn plan_input_generation(
     let build_manifest_bytes = b"{\"schema_version\":\"registry.project.artifact_manifest.v1\"}\n";
     fs::write(&build_manifest_path, build_manifest_bytes).unwrap();
     let relay_port = free_port();
-    let mut notary_port = free_port();
-    while notary_port == relay_port {
-        notary_port = free_port();
-    }
     DevRuntimePlanInput {
         project_root: root,
         project_id: "citizen-registry".to_string(),
@@ -933,7 +749,6 @@ fn plan_input_generation(
             default_fixture: "passing-default".to_string(),
             operator_source_binding_present: false,
             relay_port: Some(relay_port),
-            notary_port: Some(notary_port),
         },
         scenarios: vec![scenario(provider, oauth_profile)],
         records_request: None,
@@ -968,6 +783,39 @@ fn local_snapshot_plan_input(root: &Path) -> DevRuntimePlanInput {
     input
 }
 
+#[test]
+fn disposable_runtime_plan_and_credentials_are_relay_only() {
+    let temporary = tempfile::tempdir().unwrap();
+    let input = plan_input(
+        temporary.path(),
+        DevSourceProvider::Http,
+        DevOAuthProfile::None,
+    );
+    let credential_root = temporary.path().join("credential-inventory");
+    input
+        .credentials
+        .materialize_owner_only(&credential_root)
+        .unwrap();
+    let credential_names = fs::read_dir(&credential_root)
+        .unwrap()
+        .map(|entry| entry.unwrap().file_name().to_string_lossy().into_owned())
+        .collect::<BTreeSet<_>>();
+    let plan = DevRuntimePlan::derive(input).unwrap();
+
+    assert!(
+        plan.workloads
+            .iter()
+            .all(|workload| !workload.id.compose_service().contains("notary")),
+        "the disposable runtime plan must not contain a Notary workload"
+    );
+    assert!(
+        credential_names
+            .iter()
+            .all(|name| !name.contains("notary") && !name.contains("workload")),
+        "the disposable credential inventory must not contain Notary material: {credential_names:?}"
+    );
+}
+
 #[test]
 fn generic_plan_uses_locked_images_loopback_development_identity_and_exact_source_command() {
     for provider in [
@@ -1051,180 +899,8 @@ fn generic_plan_uses_locked_images_loopback_development_identity_and_exact_sourc
             }));
         }
         assert!(!format!("{plan:?}").contains(RESPONSE_CANARY));
-        assert!(!format!("{plan:?}").contains(REQUEST_CANARY));
         let report_json = serde_json::to_string(&plan).unwrap();
         assert!(!report_json.contains(RESPONSE_CANARY));
-        assert!(!report_json.contains(REQUEST_CANARY));
-    }
-}
-
-#[test]
-fn credential_mount_inventory_is_lane_and_action_specific() {
-    let temp = tempfile::tempdir().unwrap();
-    let plan = DevRuntimePlan::derive(plan_input(
-        temp.path(),
-        DevSourceProvider::Http,
-        DevOAuthProfile::Oauth2Bearer,
-    ))
-    .unwrap();
-    let notary = plan
-        .workloads
-        .iter()
-        .find(|workload| workload.id == DevWorkloadId::Notary)
-        .unwrap();
-    assert!(notary
-        .mounts
-        .iter()
-        .any(|mount| mount.container_path == "/run/secrets/relay-workload-token"));
-    let relay_consultation = plan
-        .workloads
-        .iter()
-        .find(|workload| workload.id == DevWorkloadId::RelayConsultation)
-        .unwrap();
-    assert!(!relay_consultation
-        .mounts
-        .iter()
-        .any(|mount| mount.container_path == "/run/secrets/relay-workload-token"));
-    let secret_targets = |action: &DevProductActionPlan| {
-        action
-            .mounts
-            .iter()
-            .filter(|mount| mount.container_path.starts_with("/run/secrets/"))
-            .map(|mount| mount.container_path.clone())
-            .collect::<BTreeSet<_>>()
-    };
-    let environment_inputs = |mounts: &[DevWorkloadMount]| {
-        mounts
-            .iter()
-            .filter(|mount| {
-                mount
-                    .host_path
-                    .extension()
-                    .is_some_and(|extension| extension == "env")
-            })
-            .map(|mount| {
-                mount
-                    .host_path
-                    .file_name()
-                    .unwrap()
-                    .to_string_lossy()
-                    .into_owned()
-            })
-            .collect::<BTreeSet<_>>()
-    };
-    let public = plan
-        .workloads
-        .iter()
-        .find(|workload| workload.id == DevWorkloadId::RelayPublic)
-        .unwrap();
-    assert_eq!(
-        environment_inputs(&public.prepare_state_store.as_ref().unwrap().mounts),
-        BTreeSet::from(["relay-public-prepare.env".to_string()])
-    );
-    assert_eq!(
-        environment_inputs(&public.initialize_state.as_ref().unwrap().mounts),
-        BTreeSet::from(["relay-public-initialize.env".to_string()])
-    );
-    assert_eq!(
-        environment_inputs(&public.mounts),
-        BTreeSet::from(["relay-public-serve.env".to_string()])
-    );
-    assert_eq!(
-        environment_inputs(
-            &relay_consultation
-                .prepare_state_store
-                .as_ref()
-                .unwrap()
-                .mounts
-        ),
-        BTreeSet::from(["relay-consultation-prepare.env".to_string()])
-    );
-    assert_eq!(
-        environment_inputs(&relay_consultation.initialize_state.as_ref().unwrap().mounts),
-        BTreeSet::from(["relay-consultation-initialize.env".to_string()])
-    );
-    assert_eq!(
-        environment_inputs(&relay_consultation.mounts),
-        BTreeSet::from(["relay-consultation-serve.env".to_string()])
-    );
-    assert_eq!(
-        environment_inputs(&notary.prepare_state_store.as_ref().unwrap().mounts),
-        BTreeSet::from(["notary-prepare.env".to_string()])
-    );
-    assert_eq!(
-        environment_inputs(&notary.initialize_state.as_ref().unwrap().mounts),
-        BTreeSet::from(["notary-initialize.env".to_string()])
-    );
-    assert_eq!(
-        environment_inputs(&notary.mounts),
-        BTreeSet::from(["notary-serve.env".to_string()])
-    );
-    assert!(secret_targets(public.prepare_state_store.as_ref().unwrap()).is_empty());
-    assert!(secret_targets(public.initialize_state.as_ref().unwrap()).is_empty());
-    let database_ca = BTreeSet::from(["/run/secrets/postgresql-ca.pem".to_string()]);
-    assert_eq!(
-        secret_targets(relay_consultation.prepare_state_store.as_ref().unwrap()),
-        database_ca
-    );
-    assert_eq!(
-        secret_targets(relay_consultation.initialize_state.as_ref().unwrap()),
-        database_ca
-    );
-    assert_eq!(
-        secret_targets(notary.prepare_state_store.as_ref().unwrap()),
-        database_ca
-    );
-    assert_eq!(
-        secret_targets(notary.initialize_state.as_ref().unwrap()),
-        database_ca
-    );
-    assert_eq!(
-        notary
-            .mounts
-            .iter()
-            .filter(|mount| mount.container_path.starts_with("/run/secrets/"))
-            .map(|mount| mount.container_path.clone())
-            .collect::<BTreeSet<_>>(),
-        BTreeSet::from([
-            "/run/secrets/notary-signing-key.jwk".to_string(),
-            "/run/secrets/postgresql-ca.pem".to_string(),
-            "/run/secrets/relay-workload-token".to_string(),
-        ])
-    );
-    assert!(relay_consultation.mounts.iter().any(|mount| {
-        mount.container_path == "/run/registry/dev-public/notary-workload-jwks.json"
-            && mount.read_only
-            && mount.kind == DevWorkloadMountKind::Bind
-    }));
-    for workload in plan
-        .workloads
-        .iter()
-        .filter(|workload| workload.id != DevWorkloadId::RelayConsultation)
-    {
-        assert!(workload.mounts.iter().all(|mount| {
-            mount.container_path != "/run/registry/dev-public/notary-workload-jwks.json"
-        }));
-    }
-    for action in plan
-        .workloads
-        .iter()
-        .flat_map(|workload| {
-            [
-                workload.prepare_state_store.as_ref(),
-                workload.initialize_state.as_ref(),
-            ]
-        })
-        .flatten()
-    {
-        assert!(action.mounts.iter().any(|mount| mount
-            .host_path
-            .extension()
-            .is_some_and(|value| value == "env")));
-        assert!(!action.mounts.iter().any(|mount| {
-            mount
-                .container_path
-                .starts_with("/run/registry/synthetic-source-secrets")
-        }));
     }
 }
 
@@ -1293,235 +969,11 @@ fn local_snapshot_cannot_shadow_runtime_owned_mounts() {
     let temporary = tempfile::tempdir().unwrap();
     let mut input = local_snapshot_plan_input(temporary.path());
     input.local_snapshot.as_mut().unwrap().container_path =
-        "/run/registry/dev-public/notary-workload-jwks.json".to_string();
+        "/run/registry/dev-public/relay-public-signing-public.jwk".to_string();
 
     assert!(DevRuntimePlan::derive(input).is_err());
 }
 
-#[test]
-fn local_snapshot_rejects_changed_extra_escaped_and_oversized_project_files() {
-    let changed = tempfile::tempdir().unwrap();
-    let changed_plan = DevRuntimePlan::derive(local_snapshot_plan_input(changed.path())).unwrap();
-    let mut changed_controller = DevRuntimeController::new(FakeBackend::default());
-    changed_controller.start(&changed_plan, true).unwrap();
-    fs::write(changed.path().join("data.xlsx"), b"changed workbook").unwrap();
-    assert!(validate_local_snapshot(&changed_plan).is_err());
-    assert_eq!(
-        changed_controller
-            .status(&changed_plan)
-            .unwrap_err()
-            .category,
-        DevFailureCategory::ProjectBinding
-    );
-    changed_controller.down(&changed_plan).unwrap();
-
-    let extra = tempfile::tempdir().unwrap();
-    let mut extra_plan = DevRuntimePlan::derive(local_snapshot_plan_input(extra.path())).unwrap();
-    let mount = extra_plan
-        .workloads
-        .iter()
-        .find(|workload| workload.id == DevWorkloadId::RelayPublic)
-        .unwrap()
-        .mounts
-        .iter()
-        .find(|mount| mount.kind == DevWorkloadMountKind::ProjectFile)
-        .unwrap()
-        .clone();
-    extra_plan
-        .workloads
-        .iter_mut()
-        .find(|workload| workload.id == DevWorkloadId::Notary)
-        .unwrap()
-        .mounts
-        .push(mount);
-    assert!(validate_local_snapshot(&extra_plan).is_err());
-
-    let escaped = tempfile::tempdir().unwrap();
-    let external = tempfile::NamedTempFile::new().unwrap();
-    let mut escaped_input = local_snapshot_plan_input(escaped.path());
-    escaped_input.local_snapshot.as_mut().unwrap().host_path =
-        fs::canonicalize(external.path()).unwrap();
-    escaped_input.local_snapshot.as_mut().unwrap().digest =
-        registry_platform_config::sha256_uri(&fs::read(external.path()).unwrap());
-    assert!(DevRuntimePlan::derive(escaped_input).is_err());
-
-    let oversized = tempfile::tempdir().unwrap();
-    let mut oversized_input = local_snapshot_plan_input(oversized.path());
-    std::fs::OpenOptions::new()
-        .write(true)
-        .open(oversized.path().join("data.xlsx"))
-        .unwrap()
-        .set_len(MAX_LOCAL_SNAPSHOT_BYTES + 1)
-        .unwrap();
-    oversized_input.local_snapshot.as_mut().unwrap().digest =
-        registry_platform_config::sha256_uri(b"");
-    assert!(DevRuntimePlan::derive(oversized_input).is_err());
-}
-
-#[cfg(unix)]
-#[test]
-fn local_snapshot_rejects_a_symlink_swap_after_planning() {
-    use std::os::unix::fs::symlink;
-
-    let temporary = tempfile::tempdir().unwrap();
-    let plan = DevRuntimePlan::derive(local_snapshot_plan_input(temporary.path())).unwrap();
-    let external = tempfile::NamedTempFile::new().unwrap();
-    fs::remove_file(temporary.path().join("data.xlsx")).unwrap();
-    symlink(external.path(), temporary.path().join("data.xlsx")).unwrap();
-    assert!(validate_local_snapshot(&plan).is_err());
-}
-
-#[test]
-fn compose_networks_close_synthetic_mode_and_scope_operator_egress_and_secrets() {
-    let synthetic_temp = tempfile::tempdir().unwrap();
-    let synthetic = DevRuntimePlan::derive(plan_input(
-        synthetic_temp.path(),
-        DevSourceProvider::Http,
-        DevOAuthProfile::None,
-    ))
-    .unwrap();
-    let synthetic_compose = synthetic_temp
-        .path()
-        .join(".registry-stack/build/local/dev/synthetic-compose.json");
-    render_closed_compose(
-        &synthetic_compose,
-        &synthetic.workloads,
-        DevSourceMode::Synthetic,
-    )
-    .unwrap();
-    let value: serde_json::Value =
-        serde_json::from_slice(&fs::read(synthetic_compose).unwrap()).unwrap();
-    assert!(value["networks"].get("registry_egress").is_none());
-    assert_eq!(
-        value["networks"]["registry_private"]["ipam"]["config"][0]["subnet"],
-        "10.89.0.0/24"
-    );
-    assert_eq!(
-        value["services"]["registry-synthetic-source"]["networks"]["registry_private"]
-            ["ipv4_address"],
-        "10.89.0.3"
-    );
-    assert_eq!(
-        value["services"]["registry-relay-consultation"]["networks"]["registry_private"]
-            ["ipv4_address"],
-        "10.89.0.4"
-    );
-    let consultation_mounts = value["services"]["registry-relay-consultation"]["volumes"]
-        .as_array()
-        .unwrap();
-    assert!(consultation_mounts.iter().any(|mount| {
-        mount["target"] == "/run/registry/dev-public/synthetic-source-tls.crt"
-            && mount["read_only"] == true
-    }));
-    assert!(consultation_mounts.iter().any(|mount| {
-        mount["target"] == "/run/registry/dev-public/notary-workload-jwks.json"
-            && mount["read_only"] == true
-    }));
-    let notary_mounts = value["services"]["registry-notary"]["volumes"]
-        .as_array()
-        .unwrap();
-    assert!(notary_mounts.iter().all(|mount| {
-        mount["target"] != "/run/secrets/relay-consultation-ca.pem"
-            && mount["target"] != "/run/registry/dev-public/notary-workload-jwks.json"
-    }));
-    #[cfg(unix)]
-    {
-        let expected_user = format!(
-            "{}:{}",
-            rustix::process::geteuid().as_raw(),
-            rustix::process::getegid().as_raw()
-        );
-        for (service, document) in value["services"].as_object().unwrap() {
-            match service.as_str() {
-                "registry-postgres" | "registry-postgres-bootstrap" => {
-                    assert_eq!(document["user"], "999:999");
-                }
-                "registry-postgres-stage-secrets" => {
-                    assert_eq!(document["user"], "0:0");
-                    assert_eq!(document["network_mode"], "none");
-                    assert_eq!(
-                        document["cap_add"],
-                        serde_json::json!(["CHOWN", "DAC_READ_SEARCH"])
-                    );
-                }
-                _ => {
-                    assert_eq!(document["user"], expected_user);
-                    assert_ne!(document["user"], "0:0");
-                }
-            }
-        }
-    }
-    let postgres = &value["services"]["registry-postgres"];
-    assert_eq!(postgres["read_only"], true);
-    assert_eq!(postgres["cap_drop"], serde_json::json!(["ALL"]));
-    assert_eq!(
-        postgres["environment"],
-        serde_json::json!([
-            "POSTGRES_USER=registry_stack_bootstrap",
-            "POSTGRES_DB=postgres",
-            "POSTGRES_PASSWORD_FILE=/run/secrets/postgresql-admin-password",
-            "POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256 --auth-local=peer"
-        ])
-    );
-    let stage_command = value["services"]["registry-postgres-stage-secrets"]["command"]
-        .as_array()
-        .unwrap()
-        .iter()
-        .filter_map(serde_json::Value::as_str)
-        .collect::<Vec<_>>()
-        .join("\n");
-    assert!(stage_command.contains("/usr/bin/install -m 0400"));
-    assert!(stage_command.contains("/usr/bin/chown 999:999"));
-    assert!(!stage_command.contains("postgres-admin-password"));
-    assert_eq!(
-        value["services"]["registry-postgres-bootstrap"]["networks"]["registry_private"],
-        serde_json::json!({})
-    );
-
-    let operator_temp = tempfile::tempdir().unwrap();
-    let mut input = plan_input(
-        operator_temp.path(),
-        DevSourceProvider::Http,
-        DevOAuthProfile::None,
-    );
-    input.development.source_mode = DevSourceMode::OperatorBound;
-    input.development.operator_source_binding_present = true;
-    input.scenarios[0].synthetic_source = None;
-    input.credentials = PreparedDevCredentialClosure::operator_bound();
-    input.operator_source_secret_env = vec!["FICTIONAL_REGISTRY_TOKEN".to_string()];
-    let operator = DevRuntimePlan::derive(input).unwrap();
-    let operator_compose = operator_temp
-        .path()
-        .join(".registry-stack/build/local/dev/operator-compose.json");
-    render_closed_compose(
-        &operator_compose,
-        &operator.workloads,
-        DevSourceMode::OperatorBound,
-    )
-    .unwrap();
-    let value: serde_json::Value =
-        serde_json::from_slice(&fs::read(operator_compose).unwrap()).unwrap();
-    assert!(value["networks"].get("registry_egress").is_some());
-    for (service, document) in value["services"].as_object().unwrap() {
-        if document.get("network_mode").is_some() {
-            assert_eq!(service, "registry-postgres-stage-secrets");
-            assert_eq!(document["network_mode"], "none");
-            continue;
-        }
-        let networks = document["networks"].as_object().unwrap();
-        let has_egress = networks.contains_key("registry_egress");
-        assert_eq!(has_egress, service == "registry-relay-consultation");
-        if service == "registry-relay-consultation" {
-            assert_eq!(
-                document["environment"],
-                serde_json::json!(["FICTIONAL_REGISTRY_TOKEN"])
-            );
-        } else if service != "registry-postgres" {
-            assert!(document.get("environment").is_none());
-        }
-    }
-}
-
 #[test]
 fn supporting_services_wait_for_health_before_product_actions() {
     assert_eq!(
@@ -1574,44 +1026,170 @@ fn compose_health_requires_the_exact_complete_healthy_workload_set() {
     );
 }
 
-#[test]
-fn operator_bound_smoke_reports_unobserved_source_counters() {
-    let temp = tempfile::tempdir().unwrap();
-    let mut input = plan_input(temp.path(), DevSourceProvider::Http, DevOAuthProfile::None);
-    input.development.source_mode = DevSourceMode::OperatorBound;
-    input.development.operator_source_binding_present = true;
-    input.scenarios[0].synthetic_source = None;
-    input.credentials = PreparedDevCredentialClosure::operator_bound();
-    input.operator_source_secret_env = vec!["FICTIONAL_REGISTRY_TOKEN".to_string()];
-    let plan = DevRuntimePlan::derive(input).unwrap();
-    let mut controller = DevRuntimeController::new(FakeBackend::default());
-    controller.start(&plan, true).unwrap();
-    let report = controller.smoke(&plan).unwrap();
-    assert!(report.results.iter().all(|result| {
-        result.token_counter_delta.is_none() && result.source_counter_delta.is_none()
-    }));
+#[derive(Default)]
+struct FakeBackend {
+    calls: Vec<String>,
+    running: bool,
+    health: Option<DevRuntimeHealth>,
+    down_calls: usize,
+    fail_down: bool,
+    doctor_report: Option<DevDoctorReport>,
 }
 
-#[test]
-fn lifecycle_refuses_compose_content_changed_after_plan_derivation() {
-    let temp = tempfile::tempdir().unwrap();
-    let plan = DevRuntimePlan::derive(plan_input(
-        temp.path(),
-        DevSourceProvider::Http,
-        DevOAuthProfile::None,
-    ))
-    .unwrap();
-    fs::write(&plan.lifecycle.compose_file, "services:\n  replaced: {}\n").unwrap();
-    let error = DevRuntimeController::new(FakeBackend::default())
-        .start(&plan, true)
-        .unwrap_err();
-    assert_eq!(error.category, DevFailureCategory::ProjectBinding);
-    assert!(!plan.paths.root.exists());
-}
+impl DevRuntimeBackend for FakeBackend {
+    fn doctor(&mut self, _plan: &DevRuntimePlan) -> DevRuntimeResult<DevDoctorReport> {
+        self.calls.push("doctor".to_string());
+        Ok(self.doctor_report.clone().unwrap_or(DevDoctorReport {
+            docker_installed: true,
+            daemon_available: true,
+            compose_supported: true,
+        }))
+    }
 
-#[test]
-fn attached_flow_returns_report_before_wait_and_cleans_up_normally() {
-    let temp = tempfile::tempdir().unwrap();
+    fn image_availability(&mut self, image: &str) -> DevRuntimeResult<DevImageAvailability> {
+        self.calls.push(format!("inspect:{image}"));
+        Ok(DevImageAvailability::Local)
+    }
+
+    fn pull_image(&mut self, image: &str) -> DevRuntimeResult<()> {
+        self.calls.push(format!("pull:{image}"));
+        Ok(())
+    }
+
+    fn health(&mut self, _state: &DevRuntimeStateV1) -> DevRuntimeResult<DevRuntimeHealth> {
+        Ok(self.health.unwrap_or(if self.running {
+            DevRuntimeHealth::Running
+        } else {
+            DevRuntimeHealth::Stopped
+        }))
+    }
+
+    fn start(
+        &mut self,
+        _plan: &DevRuntimePlan,
+        _state: &DevRuntimeStateV1,
+        detach: bool,
+    ) -> DevRuntimeResult<()> {
+        self.calls.push(format!("start:{detach}"));
+        self.running = true;
+        Ok(())
+    }
+
+    fn attach(
+        &mut self,
+        _plan: &DevRuntimePlan,
+        _state: &DevRuntimeStateV1,
+    ) -> DevRuntimeResult<()> {
+        self.calls.push("attach".to_string());
+        Ok(())
+    }
+
+    fn status(
+        &mut self,
+        plan: &DevRuntimePlan,
+        _state: &DevRuntimeStateV1,
+    ) -> DevRuntimeResult<Vec<DevWorkloadStatus>> {
+        Ok(plan
+            .lifecycle
+            .status_services
+            .iter()
+            .map(|workload| DevWorkloadStatus {
+                workload: *workload,
+                state: DevRuntimeHealthWire::Running,
+            })
+            .collect())
+    }
+
+    fn logs(
+        &mut self,
+        plan: &DevRuntimePlan,
+        _state: &DevRuntimeStateV1,
+    ) -> DevRuntimeResult<Vec<DevProductLogSummary>> {
+        Ok(plan
+            .lifecycle
+            .log_services
+            .iter()
+            .map(|workload| DevProductLogSummary {
+                workload: *workload,
+                available: true,
+            })
+            .collect())
+    }
+
+    fn smoke(
+        &mut self,
+        plan: &DevRuntimePlan,
+        _state: &DevRuntimeStateV1,
+    ) -> DevRuntimeResult<DevSmokeReportV1> {
+        let results = plan
+            .records_request_digest
+            .as_ref()
+            .map(|_| {
+                vec![
+                    DevSmokeScenarioResult {
+                        scenario_id: plan.lifecycle.smoke_denial_scenario.clone(),
+                        status: DevSmokeStatus::Denied,
+                        token_counter_delta: None,
+                        source_counter_delta: None,
+                        minimized_claim_ids: Vec::new(),
+                        passed: true,
+                    },
+                    DevSmokeScenarioResult {
+                        scenario_id: plan.lifecycle.smoke_authorized_scenario.clone(),
+                        status: DevSmokeStatus::Authorized,
+                        token_counter_delta: None,
+                        source_counter_delta: None,
+                        minimized_claim_ids: Vec::new(),
+                        passed: true,
+                    },
+                ]
+            })
+            .unwrap_or_default();
+        Ok(DevSmokeReportV1 {
+            schema_version: DEV_SMOKE_REPORT_SCHEMA_V1.to_string(),
+            project: plan.binding.project.clone(),
+            environment: plan.binding.environment.clone(),
+            results,
+            passed: true,
+        })
+    }
+
+    fn down(&mut self, _state: &DevRuntimeStateV1, timeout_seconds: u16) -> DevRuntimeResult<()> {
+        assert_eq!(timeout_seconds, 15);
+        if self.fail_down {
+            return Err(DevRuntimeError::new(
+                DevFailureCategory::DockerUnavailable,
+                "injected down failure",
+                "retry",
+            ));
+        }
+        self.calls.push("down".to_string());
+        self.down_calls += 1;
+        self.running = false;
+        Ok(())
+    }
+}
+
+#[test]
+fn lifecycle_refuses_compose_content_changed_after_plan_derivation() {
+    let temp = tempfile::tempdir().unwrap();
+    let plan = DevRuntimePlan::derive(plan_input(
+        temp.path(),
+        DevSourceProvider::Http,
+        DevOAuthProfile::None,
+    ))
+    .unwrap();
+    fs::write(&plan.lifecycle.compose_file, "services:\n  replaced: {}\n").unwrap();
+    let error = DevRuntimeController::new(FakeBackend::default())
+        .start(&plan, true)
+        .unwrap_err();
+    assert_eq!(error.category, DevFailureCategory::ProjectBinding);
+    assert!(!plan.paths.root.exists());
+}
+
+#[test]
+fn attached_flow_returns_report_before_wait_and_cleans_up_normally() {
+    let temp = tempfile::tempdir().unwrap();
     let plan = DevRuntimePlan::derive(plan_input(
         temp.path(),
         DevSourceProvider::Http,
@@ -1620,9 +1198,7 @@ fn attached_flow_returns_report_before_wait_and_cleans_up_normally() {
     .unwrap();
     let mut controller = DevRuntimeController::new(FakeBackend::default());
     let report = controller.start(&plan, false).unwrap();
-    assert!(report
-        .evidence_request_command
-        .starts_with("curl --config "));
+    assert!(report.relay_api_url.starts_with("http://127.0.0.1:"));
     assert!(plan.paths.state_file.exists());
     controller.attach(&plan).unwrap();
     let backend = controller.into_backend();
@@ -1738,457 +1314,6 @@ fn unsigned_or_tampered_development_bundle_is_refused() {
     assert!(error.summary.contains("disposable development identity"));
 }
 
-#[test]
-fn release_projection_and_oauth_profiles_fail_closed() {
-    assert_eq!(
-        VerifiedDevReleaseProjection::test_only(
-            "release-v1.0.0".to_string(),
-            "v1.0.0".to_string(),
-            "ghcr.io/registrystack/registry-relay:v1.0.0".to_string(),
-            format!(
-                "ghcr.io/registrystack/registry-notary@sha256:{}",
-                "b".repeat(64)
-            ),
-            format!("docker.io/library/postgres@sha256:{}", "c".repeat(64)),
-            "2.24.0".to_string(),
-        )
-        .unwrap_err()
-        .category,
-        DevFailureCategory::InvalidImageLock
-    );
-
-    let temp = tempfile::tempdir().unwrap();
-    let mut no_oauth = plan_input(temp.path(), DevSourceProvider::Rhai, DevOAuthProfile::None);
-    no_oauth.scenarios[0]
-        .synthetic_source
-        .as_mut()
-        .unwrap()
-        .oauth_response_case = Some(SyntheticOAuthResponseCase::Valid);
-    let error = DevRuntimePlan::derive(no_oauth).unwrap_err();
-    assert!(error.summary.contains("non-OAuth source"));
-
-    let temp = tempfile::tempdir().unwrap();
-    let mut forbidden_body =
-        plan_input(temp.path(), DevSourceProvider::Http, DevOAuthProfile::None);
-    forbidden_body.scenarios[0]
-        .synthetic_source
-        .as_mut()
-        .unwrap()
-        .scenario = SyntheticSourceScenario::SourceTimeout;
-    let error = DevRuntimePlan::derive(forbidden_body).unwrap_err();
-    assert!(error.summary.contains("response_body presence"));
-
-    let temp = tempfile::tempdir().unwrap();
-    let mut reserved_request =
-        plan_input(temp.path(), DevSourceProvider::Http, DevOAuthProfile::None);
-    reserved_request.scenarios[0]
-        .synthetic_source
-        .as_mut()
-        .unwrap()
-        .source_request
-        .path = "/oauth/token".to_string();
-    let error = DevRuntimePlan::derive(reserved_request).unwrap_err();
-    assert!(error.summary.contains("closed authored operation"));
-}
-
-#[derive(Default)]
-struct FakeBackend {
-    calls: Vec<String>,
-    absent_images: BTreeSet<String>,
-    running: bool,
-    health: Option<DevRuntimeHealth>,
-    down_calls: usize,
-    fail_down: bool,
-    fail_start: bool,
-    doctor_report: Option<DevDoctorReport>,
-}
-
-impl DevRuntimeBackend for FakeBackend {
-    fn doctor(&mut self, _plan: &DevRuntimePlan) -> DevRuntimeResult<DevDoctorReport> {
-        self.calls.push("doctor".to_string());
-        Ok(self.doctor_report.clone().unwrap_or(DevDoctorReport {
-            docker_installed: true,
-            daemon_available: true,
-            compose_supported: true,
-        }))
-    }
-
-    fn image_availability(&mut self, image: &str) -> DevRuntimeResult<DevImageAvailability> {
-        self.calls.push(format!("inspect:{image}"));
-        Ok(if self.absent_images.contains(image) {
-            DevImageAvailability::Absent
-        } else {
-            DevImageAvailability::Local
-        })
-    }
-
-    fn pull_image(&mut self, image: &str) -> DevRuntimeResult<()> {
-        self.calls.push(format!("pull:{image}"));
-        Ok(())
-    }
-
-    fn health(&mut self, _state: &DevRuntimeStateV1) -> DevRuntimeResult<DevRuntimeHealth> {
-        Ok(self.health.unwrap_or(if self.running {
-            DevRuntimeHealth::Running
-        } else {
-            DevRuntimeHealth::Stopped
-        }))
-    }
-
-    fn start(
-        &mut self,
-        _plan: &DevRuntimePlan,
-        _state: &DevRuntimeStateV1,
-        detach: bool,
-    ) -> DevRuntimeResult<()> {
-        self.calls.push(format!("start:{detach}"));
-        if self.fail_start {
-            return Err(DevRuntimeError::new(
-                DevFailureCategory::Startup,
-                "injected startup failure",
-                "retry",
-            ));
-        }
-        self.running = true;
-        Ok(())
-    }
-
-    fn attach(
-        &mut self,
-        _plan: &DevRuntimePlan,
-        _state: &DevRuntimeStateV1,
-    ) -> DevRuntimeResult<()> {
-        self.calls.push("attach".to_string());
-        Ok(())
-    }
-
-    fn status(
-        &mut self,
-        plan: &DevRuntimePlan,
-        _state: &DevRuntimeStateV1,
-    ) -> DevRuntimeResult<Vec<DevWorkloadStatus>> {
-        Ok(plan
-            .lifecycle
-            .status_services
-            .iter()
-            .map(|workload| DevWorkloadStatus {
-                workload: *workload,
-                state: DevRuntimeHealthWire::Running,
-            })
-            .collect())
-    }
-
-    fn logs(
-        &mut self,
-        plan: &DevRuntimePlan,
-        _state: &DevRuntimeStateV1,
-    ) -> DevRuntimeResult<Vec<DevProductLogSummary>> {
-        Ok(plan
-            .lifecycle
-            .log_services
-            .iter()
-            .map(|workload| DevProductLogSummary {
-                workload: *workload,
-                available: true,
-            })
-            .collect())
-    }
-
-    fn smoke(
-        &mut self,
-        plan: &DevRuntimePlan,
-        _state: &DevRuntimeStateV1,
-    ) -> DevRuntimeResult<DevSmokeReportV1> {
-        let token_delta = if plan.scenario.oauth_profile == DevOAuthProfile::None {
-            0
-        } else {
-            1
-        };
-        let observed = plan.source_mode == DevSourceMode::Synthetic;
-        Ok(DevSmokeReportV1 {
-            schema_version: DEV_SMOKE_REPORT_SCHEMA_V1.to_string(),
-            project: plan.binding.project.clone(),
-            environment: plan.binding.environment.clone(),
-            results: vec![
-                DevSmokeScenarioResult {
-                    scenario_id: plan.scenario.denial_scenario_id.clone(),
-                    status: DevSmokeStatus::Denied,
-                    token_counter_delta: observed.then_some(0),
-                    source_counter_delta: observed.then_some(0),
-                    minimized_claim_ids: Vec::new(),
-                    passed: true,
-                },
-                DevSmokeScenarioResult {
-                    scenario_id: plan.scenario.authorized_scenario_id.clone(),
-                    status: DevSmokeStatus::Authorized,
-                    token_counter_delta: observed.then_some(token_delta),
-                    source_counter_delta: observed.then_some(1),
-                    minimized_claim_ids: plan.scenario.minimized_claim_ids.clone(),
-                    passed: true,
-                },
-            ],
-            passed: true,
-        })
-    }
-
-    fn down(&mut self, _state: &DevRuntimeStateV1, timeout_seconds: u16) -> DevRuntimeResult<()> {
-        assert_eq!(timeout_seconds, 15);
-        if self.fail_down {
-            return Err(DevRuntimeError::new(
-                DevFailureCategory::DockerUnavailable,
-                "injected down failure",
-                "retry",
-            ));
-        }
-        self.calls.push("down".to_string());
-        self.down_calls += 1;
-        self.running = false;
-        Ok(())
-    }
-}
-
-#[test]
-fn lifecycle_is_project_bound_bounded_owner_only_and_value_free() {
-    let temp = tempfile::tempdir().unwrap();
-    let plan = DevRuntimePlan::derive(plan_input(
-        temp.path(),
-        DevSourceProvider::Rhai,
-        DevOAuthProfile::Oauth2BearerNoExpiry,
-    ))
-    .unwrap();
-    let generated_artifacts = plan.artifacts.compose_file.parent().unwrap().to_path_buf();
-    let mut backend = FakeBackend::default();
-    backend
-        .absent_images
-        .insert(plan.workloads[0].image.clone());
-    let mut controller = DevRuntimeController::new(backend);
-    let startup = controller.start(&plan, true).unwrap();
-    assert_eq!(startup.source_mode, DevSourceMode::Synthetic);
-    assert!(startup.disposable_notice.contains("not production inputs"));
-    assert!(startup.evidence_request_command.contains("curl --config"));
-    assert!(!format!("{startup:?}").contains(RESPONSE_CANARY));
-    assert!(!format!("{startup:?}").contains(REQUEST_CANARY));
-
-    let request_config = fs::read_to_string(&plan.paths.request_config).unwrap();
-    assert!(request_config.contains("/v1/evaluations"));
-    assert!(request_config.contains("url = \"http://127.0.0.1:"));
-    assert!(!request_config.contains("url = \"https://"));
-    assert!(!request_config.contains("cacert = "));
-    assert!(startup.relay_api_url.starts_with("http://127.0.0.1:"));
-    assert!(startup.evidence_api_url.starts_with("http://127.0.0.1:"));
-    for obsolete_listener_credential in [
-        "relay-public-tls.crt",
-        "relay-public-tls.key",
-        "relay-consultation-tls.crt",
-        "relay-consultation-tls.key",
-        "notary-tls.crt",
-        "notary-tls.key",
-    ] {
-        assert!(!plan
-            .paths
-            .credentials
-            .join(obsolete_listener_credential)
-            .exists());
-    }
-    let caller_token = fs::read_to_string(plan.paths.credentials.join("caller-token")).unwrap();
-    assert!(request_config.contains(&caller_token));
-    assert!(!startup.evidence_request_command.contains(&caller_token));
-    assert!(fs::read_to_string(&plan.paths.synthetic_source_plan)
-        .unwrap()
-        .contains(RESPONSE_CANARY));
-    let source_plan: serde_json::Value =
-        serde_json::from_slice(&fs::read(&plan.paths.synthetic_source_plan).unwrap()).unwrap();
-    assert_eq!(
-        source_plan["version"],
-        "registry.relay.synthetic-source-plan.v1"
-    );
-    assert_eq!(source_plan["scenario"], "authored_response");
-    assert_eq!(source_plan["source_request"]["method"], "get");
-    assert_eq!(
-        source_plan["source_request"]["path"],
-        "/people/example-person"
-    );
-    assert_eq!(
-        source_plan["source_request"]["query"]["expand"],
-        "eligibility"
-    );
-    assert!(source_plan.get("routes").is_none());
-    assert!(source_plan.get("path").is_none());
-    assert_eq!(
-        source_plan["oauth"]["response_profile"],
-        "oauth2_bearer_no_expiry"
-    );
-    assert_eq!(source_plan["request_encoding"], "form");
-    assert_eq!(
-        source_plan["oauth"]["request"]["audience"],
-        "registry-notary"
-    );
-    assert_eq!(source_plan["oauth"]["request"]["scope"], "registry.read");
-    assert_eq!(
-        source_plan["oauth"]["request"]["resource"],
-        "registry-source"
-    );
-    assert_eq!(
-        source_plan["secrets"]["control_token"]["file"],
-        "control-token"
-    );
-    assert_eq!(source_plan["secrets"]["control_token"]["generation"], 1);
-    let same_runtime = controller.start(&plan, true).unwrap();
-    assert_eq!(
-        same_runtime.evidence_request_command,
-        startup.evidence_request_command
-    );
-
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::PermissionsExt as _;
-        for path in [
-            &plan.paths.state_file,
-            &plan.paths.request_config,
-            &plan.paths.request_body,
-            &plan.paths.synthetic_source_plan,
-        ] {
-            assert_eq!(
-                fs::metadata(path).unwrap().permissions().mode() & 0o777,
-                0o600
-            );
-        }
-        assert_eq!(
-            fs::metadata(&plan.paths.credentials)
-                .unwrap()
-                .permissions()
-                .mode()
-                & 0o777,
-            0o700
-        );
-    }
-
-    let status = controller.status(&plan).unwrap();
-    assert_eq!(status.schema_version, DEV_STATUS_REPORT_SCHEMA_V1);
-    assert_eq!(
-        status.evidence_request_command,
-        startup.evidence_request_command
-    );
-    assert_eq!(status.workloads.len(), plan.lifecycle.status_services.len());
-    let status_json = serde_json::to_value(&status).unwrap();
-    assert_eq!(status_json["schema_version"], DEV_STATUS_REPORT_SCHEMA_V1);
-    assert_eq!(status_json.as_object().unwrap().len(), 9);
-    let serialized_status = serde_json::to_string(&status).unwrap();
-    assert!(!serialized_status.contains(&caller_token));
-    assert!(!serialized_status.contains(RESPONSE_CANARY));
-    let logs = controller.logs(&plan).unwrap();
-    assert_eq!(logs.schema_version, DEV_LOGS_REPORT_SCHEMA_V1);
-    assert_eq!(logs.products.len(), plan.lifecycle.log_services.len());
-    let logs_json = serde_json::to_value(&logs).unwrap();
-    assert_eq!(logs_json["schema_version"], DEV_LOGS_REPORT_SCHEMA_V1);
-    assert_eq!(logs_json.as_object().unwrap().len(), 3);
-    let serialized_logs = serde_json::to_string(&logs).unwrap();
-    assert!(!serialized_logs.contains(&caller_token));
-    assert!(!serialized_logs.contains(RESPONSE_CANARY));
-    let smoke = controller.smoke(&plan).unwrap();
-    assert!(smoke.passed);
-    assert_eq!(smoke.results[0].token_counter_delta, Some(0));
-    assert_eq!(smoke.results[0].source_counter_delta, Some(0));
-    assert_eq!(smoke.results[1].token_counter_delta, Some(1));
-    assert_eq!(smoke.results[1].source_counter_delta, Some(1));
-
-    controller.down(&plan).unwrap();
-    assert!(!plan.paths.root.exists());
-    assert!(!generated_artifacts.exists());
-    let backend = controller.into_backend();
-    assert_eq!(backend.down_calls, 1);
-    assert_eq!(
-        backend
-            .calls
-            .iter()
-            .filter(|call| call.starts_with("start:"))
-            .count(),
-        1
-    );
-    assert_eq!(backend.calls.first().unwrap(), "doctor");
-    assert!(backend.calls.iter().any(|call| call.starts_with("pull:")));
-}
-
-#[test]
-fn records_requests_are_owner_only_minimal_and_credential_separated() {
-    let temp = tempfile::tempdir().unwrap();
-    let mut input = plan_input(
-        temp.path(),
-        DevSourceProvider::Spreadsheet,
-        DevOAuthProfile::None,
-    );
-    input.records_request = Some(project_authoring::AuthoredRecordsRequest {
-        dataset_id: "projects".to_string(),
-        entity_id: "projects".to_string(),
-        record_id: "pw_001".to_string(),
-        purpose: "public-works-case-management".to_string(),
-    });
-    input.credentials = PreparedDevCredentialClosure::synthetic_records();
-    let plan = DevRuntimePlan::derive(input).unwrap();
-    let mut controller = DevRuntimeController::new(FakeBackend::default());
-    let startup = controller.start(&plan, true).unwrap();
-
-    assert!(startup.relay_api_url.starts_with("http://127.0.0.1:"));
-    assert!(startup
-        .records_denied_command
-        .as_ref()
-        .unwrap()
-        .contains("records-denied.curl"));
-    assert!(startup
-        .records_request_command
-        .as_ref()
-        .unwrap()
-        .contains("records-request.curl"));
-    assert!(!startup.evidence_request_command.contains("records"));
-
-    let authorized = fs::read_to_string(&plan.paths.records_request_config).unwrap();
-    let denied = fs::read_to_string(&plan.paths.records_denied_config).unwrap();
-    let match_token = fs::read_to_string(plan.paths.credentials.join("relay-match-token")).unwrap();
-    let no_match_token =
-        fs::read_to_string(plan.paths.credentials.join("relay-no-match-token")).unwrap();
-    let caller_token = fs::read_to_string(plan.paths.credentials.join("caller-token")).unwrap();
-    assert!(authorized.contains("/v1/datasets/projects/entities/projects/records/pw_001"));
-    assert!(authorized.contains("url = \"http://127.0.0.1:"));
-    assert!(!authorized.contains("cacert = "));
-    assert!(authorized.contains("header = \"Data-Purpose: public-works-case-management\""));
-    assert!(authorized.contains(&match_token));
-    assert!(authorized.contains("fail\n"));
-    assert!(!authorized.contains(&no_match_token));
-    assert!(!authorized.contains(&caller_token));
-    assert!(denied.contains("include\n"));
-    assert!(denied.contains("silent\n"));
-    assert!(denied.contains("show-error\n"));
-    assert!(!denied.contains("Authorization"));
-    assert!(!denied.contains("fail\n"));
-    for token in [&match_token, &no_match_token, &caller_token] {
-        assert!(!denied.contains(token));
-        assert!(!startup
-            .records_request_command
-            .as_ref()
-            .unwrap()
-            .contains(token));
-    }
-    let status = controller.status(&plan).unwrap();
-    let status_json = serde_json::to_string(&status).unwrap();
-    for token in [&match_token, &no_match_token, &caller_token] {
-        assert!(!status_json.contains(token));
-    }
-
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::PermissionsExt as _;
-        for path in [
-            &plan.paths.records_request_config,
-            &plan.paths.records_denied_config,
-        ] {
-            assert_eq!(
-                fs::metadata(path).unwrap().permissions().mode() & 0o777,
-                0o600
-            );
-        }
-    }
-}
-
 #[test]
 fn records_request_percent_encodes_each_path_segment_without_encoding_separators() {
     let temp = tempfile::tempdir().unwrap();
@@ -2216,69 +1341,6 @@ fn records_request_percent_encodes_each_path_segment_without_encoding_separators
     assert!(!request.contains("/datasets/pro/jects/"));
 }
 
-#[test]
-fn healthy_unchanged_start_rebinds_candidate_attach_to_retained_runtime() {
-    let temp = tempfile::tempdir().unwrap();
-    let plan = DevRuntimePlan::derive(plan_input(
-        temp.path(),
-        DevSourceProvider::Http,
-        DevOAuthProfile::None,
-    ))
-    .unwrap();
-    let old_artifacts = plan.artifacts.compose_file.parent().unwrap().to_path_buf();
-    let relay_port = plan
-        .workloads
-        .iter()
-        .find(|workload| workload.id == DevWorkloadId::RelayPublic)
-        .and_then(|workload| workload.host_endpoint)
-        .unwrap()
-        .port();
-    let notary_port = plan
-        .workloads
-        .iter()
-        .find(|workload| workload.id == DevWorkloadId::Notary)
-        .and_then(|workload| workload.host_endpoint)
-        .unwrap()
-        .port();
-    let mut controller = DevRuntimeController::new(FakeBackend::default());
-    controller.start(&plan, true).unwrap();
-
-    let mut input = plan_input_generation(
-        temp.path(),
-        DevSourceProvider::Http,
-        DevOAuthProfile::None,
-        "0000000000000002",
-    );
-    input.development.relay_port = Some(relay_port);
-    input.development.notary_port = Some(notary_port);
-    let candidate = DevRuntimePlan::derive(input).unwrap();
-    let candidate_artifacts = candidate
-        .artifacts
-        .compose_file
-        .parent()
-        .unwrap()
-        .to_path_buf();
-    controller.start(&candidate, true).unwrap();
-
-    assert!(plan.paths.root.exists());
-    assert!(old_artifacts.exists());
-    assert!(!candidate_artifacts.exists());
-    controller.attach(&candidate).unwrap();
-    assert!(!plan.paths.root.exists());
-    assert!(!old_artifacts.exists());
-    let backend = controller.into_backend();
-    assert_eq!(backend.down_calls, 1);
-    assert_eq!(
-        backend
-            .calls
-            .iter()
-            .filter(|call| call.starts_with("start:"))
-            .count(),
-        1
-    );
-    assert!(backend.calls.iter().any(|call| call == "attach"));
-}
-
 #[test]
 fn stopped_degraded_and_changed_running_starts_replace_without_orphan_generations() {
     for (health, changed) in [
@@ -2305,7 +1367,7 @@ fn stopped_degraded_and_changed_running_starts_replace_without_orphan_generation
             "0000000000000002",
         );
         if changed {
-            input.scenarios[0].request_json = br#"{"subject":"changed"}"#.to_vec();
+            input.scenarios[0].denial_scenario_id = "replaced-denied".to_string();
         }
         let replacement = DevRuntimePlan::derive(input).unwrap();
         let replacement_artifacts = replacement
@@ -2383,55 +1445,6 @@ fn terminal_errors_include_stable_public_category_code() {
     );
 }
 
-#[test]
-fn bound_plan_loader_is_read_only_and_rebinds_exact_request_body() {
-    fn snapshot(root: &Path) -> BTreeSet<(String, Vec<u8>)> {
-        fn collect(root: &Path, directory: &Path, out: &mut BTreeSet<(String, Vec<u8>)>) {
-            for entry in fs::read_dir(directory).unwrap() {
-                let entry = entry.unwrap();
-                let path = entry.path();
-                if entry.file_type().unwrap().is_dir() {
-                    collect(root, &path, out);
-                } else {
-                    out.insert((
-                        path.strip_prefix(root)
-                            .unwrap()
-                            .to_string_lossy()
-                            .into_owned(),
-                        fs::read(path).unwrap(),
-                    ));
-                }
-            }
-        }
-        let mut files = BTreeSet::new();
-        collect(root, root, &mut files);
-        files
-    }
-
-    let temp = tempfile::tempdir().unwrap();
-    let plan = DevRuntimePlan::derive(plan_input(
-        temp.path(),
-        DevSourceProvider::Http,
-        DevOAuthProfile::None,
-    ))
-    .unwrap();
-    let mut controller = DevRuntimeController::new(FakeBackend::default());
-    controller.start(&plan, true).unwrap();
-    let before = snapshot(&plan.paths.root);
-
-    let loaded = load_bound_dev_runtime_plan(temp.path(), "local").unwrap();
-    assert_eq!(loaded.request_digest, plan.request_digest);
-    assert_eq!(
-        loaded.evidence_request_command(),
-        plan.evidence_request_command()
-    );
-    assert_eq!(snapshot(&plan.paths.root), before);
-
-    fs::write(&plan.paths.request_body, br#"{"subject":"tampered"}"#).unwrap();
-    let error = load_bound_dev_runtime_plan(temp.path(), "local").unwrap_err();
-    assert_eq!(error.category, DevFailureCategory::ProjectBinding);
-}
-
 #[test]
 fn doctor_distinguishes_missing_docker_from_an_unavailable_daemon() {
     for (report, expected) in [
diff --git a/crates/registryctl/tests/fixtures/project-authoring-journeys.yaml b/crates/registryctl/tests/fixtures/project-authoring-journeys.yaml
index aa22b926b..827f2d780 100644
--- a/crates/registryctl/tests/fixtures/project-authoring-journeys.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring-journeys.yaml
@@ -5,7 +5,7 @@ workspaces:
     summary: One fixed bounded HTTP request with a closed response projection.
     source: crates/registryctl/assets/project-starters/bounded-http
     classification: maintained
-    topology: combined
+    topology: relay-only
     starter: http
     project_dir: registry-project
     focused_fixture_file: active.yaml
@@ -15,10 +15,10 @@ workspaces:
 
   - id: custom-system
     label: Custom HTTP conformance workspace
-    summary: Combined HTTP acquisition and registry-backed evidence coverage.
+    summary: Bounded HTTP acquisition and registry-backed consultation coverage.
     source: crates/registryctl/tests/fixtures/project-authoring/custom-system
     classification: maintained
-    topology: combined
+    topology: relay-only
     project_dir: crates/registryctl/tests/fixtures/project-authoring/custom-system
     focused_fixture_file: source-approved.yaml
     steps: [trace, watch, test, check, build]
@@ -30,7 +30,7 @@ workspaces:
     summary: Conformance coverage for the bounded Script adapter surface.
     source: crates/registryctl/tests/fixtures/project-authoring/dhis2-script
     classification: conformance-only
-    topology: combined
+    topology: relay-only
     project_dir: crates/registryctl/tests/fixtures/project-authoring/dhis2-script
     steps: [test, check, build]
     environment: local
@@ -38,10 +38,10 @@ workspaces:
 
   - id: dhis2-tracker
     label: DHIS2 Tracker
-    summary: Bounded DHIS2 Tracker acquisition normalized into reusable health evidence for consumer-owned decisions.
+    summary: Bounded DHIS2 Tracker acquisition normalized into reusable consultation outputs for consumer-owned decisions.
     source: crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker
     classification: maintained
-    topology: combined
+    topology: relay-only
     starter: dhis2-tracker
     project_dir: dhis2-project
     focused_fixture_file: match.yaml
@@ -54,7 +54,7 @@ workspaces:
     summary: A product-neutral script adapter with bounded FHIR R4 search-set parsing.
     source: crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active
     classification: maintained
-    topology: combined
+    topology: relay-only
     starter: fhir-r4
     project_dir: fhir-project
     focused_fixture_file: match.yaml
@@ -70,7 +70,7 @@ workspaces:
     focus: solmara
     topology: relay-only
     project_dir: crates/registryctl/tests/fixtures/project-authoring/nia-attribute-release
-    steps: [check]
+    steps: [check, build]
     environment: local
     check_explain: true
 
@@ -79,7 +79,7 @@ workspaces:
     summary: A product-neutral script adapter with the signed DCI search verification profile.
     source: crates/registryctl/tests/fixtures/project-authoring/opencrvs
     classification: maintained
-    topology: combined
+    topology: relay-only
     starter: opencrvs-dci
     project_dir: opencrvs-project
     focused_fixture_file: match.yaml
@@ -92,7 +92,7 @@ workspaces:
     summary: A maintained synthetic case study for a bounded Events API-shaped search using generic OAuth client credentials and Rhai.
     source: crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api
     classification: maintained
-    topology: combined
+    topology: relay-only
     project_dir: crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api
     focused_fixture_file: match.yaml
     steps: [trace, watch, test, check, build]
@@ -104,7 +104,7 @@ workspaces:
     summary: Country-owned DCI mapping coverage for match, no-match, and ambiguity.
     source: crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant
     classification: maintained
-    topology: combined
+    topology: relay-only
     project_dir: crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant
     focused_fixture_file: match.yaml
     steps: [trace, watch, test, check, build]
@@ -116,7 +116,7 @@ workspaces:
     summary: Offline fixture, configuration validation, and build coverage for a synthetic OpenSPP exact lookup.
     source: crates/registryctl/tests/fixtures/project-authoring/openspp-exact
     classification: maintained
-    topology: combined
+    topology: relay-only
     evidence: offline-fixture-validation
     project_dir: crates/registryctl/tests/fixtures/project-authoring/openspp-exact
     focused_fixture_file: match.yaml
@@ -131,18 +131,18 @@ workspaces:
     classification: maintained
     topology: relay-only
     project_dir: crates/registryctl/tests/fixtures/project-authoring/relay-only-materialization
-    steps: [test, check]
+    steps: [test, check, build]
     environment: local
     check_explain: true
 
   - id: relay-only-records
     label: Relay-only records API
-    summary: Fixtureless Relay records configuration with no Notary inputs.
+    summary: Fixtureless Relay records configuration with no consultation inputs.
     source: crates/registryctl/tests/fixtures/project-authoring/relay-only-records
     classification: maintained
     topology: relay-only
     project_dir: crates/registryctl/tests/fixtures/project-authoring/relay-only-records
-    steps: [test, check]
+    steps: [test, check, build]
     environment: local
     check_explain: true
 
@@ -151,7 +151,7 @@ workspaces:
     summary: An exact lookup over one immutable local materialization.
     source: crates/registryctl/tests/fixtures/project-authoring/snapshot-exact
     classification: maintained
-    topology: combined
+    topology: relay-only
     starter: snapshot
     project_dir: snapshot-project
     focused_fixture_file: match.yaml
@@ -161,10 +161,10 @@ workspaces:
 
   - id: snapshot-with-records
     label: Snapshot with records API
-    summary: Match and no-match evidence sharing one authorized Relay materialization with records.
+    summary: Match and no-match consultations sharing one authorized Relay materialization with records.
     source: crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records
     classification: maintained
-    topology: combined
+    topology: relay-only
     project_dir: crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records
     focused_fixture_file: match.yaml
     steps: [trace, watch, test, check, build]
diff --git a/crates/registryctl/tests/fixtures/project-authoring/custom-system/environments/local.yaml b/crates/registryctl/tests/fixtures/project-authoring/custom-system/environments/local.yaml
index eebb3ad8f..12f1fae9f 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/custom-system/environments/local.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/custom-system/environments/local.yaml
@@ -7,28 +7,14 @@ integrations:
         username: { secret: HOUSEHOLD_USERNAME }
         password: { secret: HOUSEHOLD_PASSWORD }
         generation: 1
-issuance:
-  issuer: did:web:household-notary.invalid
-  signing_kid: project-issuer-key
-  signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }
-  generation: 1
-callers:
-  benefits-service:
-    api_key_fingerprint: { secret: BENEFITS_CLIENT_TOKEN_HASH }
-    scopes: ["evidence:household:read"]
 relay:
   origin: https://household-relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [household-relay-client]
-
-notary_relay:
-  base_url: http://127.0.0.1:8080
-  workload_client_id: household-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: household-consultation-client, principal_id: household-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: household-relay }
-  notary: { service: household-notary }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/custom-system/integrations/eligibility/fixtures/ambiguous.yaml b/crates/registryctl/tests/fixtures/project-authoring/custom-system/integrations/eligibility/fixtures/ambiguous.yaml
index b2edb5150..f8e1af3bb 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/custom-system/integrations/eligibility/fixtures/ambiguous.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/custom-system/integrations/eligibility/fixtures/ambiguous.yaml
@@ -7,4 +7,4 @@ interactions:
       path: /households/HH-AB12CD34
       query: { fields: "approved,category" }
     respond: { status: 409, body: {} }
-expect: { outcome: ambiguous, outputs: {}, claims: {} }
+expect: { outcome: ambiguous, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/custom-system/integrations/eligibility/fixtures/no-match.yaml b/crates/registryctl/tests/fixtures/project-authoring/custom-system/integrations/eligibility/fixtures/no-match.yaml
index bb62583e9..dff12dd9a 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/custom-system/integrations/eligibility/fixtures/no-match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/custom-system/integrations/eligibility/fixtures/no-match.yaml
@@ -10,7 +10,3 @@ interactions:
 expect:
   outcome: no_match
   outputs: {}
-  claims:
-    household-record-exists: false
-    household-category: null
-    source-household-approval-decision: null
diff --git a/crates/registryctl/tests/fixtures/project-authoring/custom-system/integrations/eligibility/fixtures/source-approved.yaml b/crates/registryctl/tests/fixtures/project-authoring/custom-system/integrations/eligibility/fixtures/source-approved.yaml
index 4b55b1614..f59610f5a 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/custom-system/integrations/eligibility/fixtures/source-approved.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/custom-system/integrations/eligibility/fixtures/source-approved.yaml
@@ -1,13 +1,5 @@
 name: source-approved-household
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers: [{ scheme: household_reference, value: HH-AB12CD34 }]
-  claims: [household-record-exists]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: household-support-screening
 input: { household_reference: HH-AB12CD34 }
 interactions:
   - expect:
@@ -20,7 +12,3 @@ interactions:
 expect:
   outcome: match
   outputs: { approved: true, category: PRIORITY }
-  claims:
-    household-record-exists: true
-    household-category: PRIORITY
-    source-household-approval-decision: true
diff --git a/crates/registryctl/tests/fixtures/project-authoring/custom-system/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/custom-system/registry-stack.yaml
index 21f03bd9b..f63e17e3a 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/custom-system/registry-stack.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/custom-system/registry-stack.yaml
@@ -9,32 +9,13 @@ integrations:
 
 services:
   household-eligibility:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: household-support-screening
     legal_basis: public-service-delivery
     consent: not_required
-    access:
-      scopes: ["evidence:household:read"]
     consultations:
       household:
         integration: eligibility
         input:
           household_reference: request.target.identifiers.household_reference
-    claims:
-      household-record-exists:
-        cel: household.matched
-        disclosure: predicate
-      household-category:
-        output: household.category
-        disclosure: value
-      source-household-approval-decision:
-        cel: >-
-          household.matched && household.approved != null ? household.approved : null
-        disclosure: predicate
-    credential_profiles:
-      household-eligibility:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/household-eligibility/v1
-        validity: 5m
-        claims: [household-record-exists, household-category, source-household-approval-decision]
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/environments/local.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/environments/local.yaml
index ca640b2d6..44e5ac10e 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/environments/local.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/environments/local.yaml
@@ -7,28 +7,14 @@ integrations:
         username: { secret: HEALTH_REGISTRY_USERNAME }
         password: { secret: HEALTH_REGISTRY_PASSWORD }
         generation: 1
-issuance:
-  issuer: did:web:health-notary.invalid
-  signing_kid: project-issuer-key
-  signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }
-  generation: 1
-callers:
-  programme-verifier:
-    api_key_fingerprint: { secret: PROGRAMME_VERIFIER_TOKEN_HASH }
-    scopes: ["evidence:health:read"]
 relay:
   origin: https://health-relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [health-relay-client]
-
-notary_relay:
-  base_url: http://127.0.0.1:8080
-  workload_client_id: health-registry-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: health-consultation-client, principal_id: health-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: health-registry-relay }
-  notary: { service: health-registry-notary }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/match.yaml
index 527479d79..fe920907c 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/match.yaml
@@ -1,15 +1,5 @@
 name: complete-child-health-evidence
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers: [{ scheme: dhis2_tracked_entity, value: A0000000001 }]
-    attributes: { include_inactive: true }
-  variables: { as_of_date: 2026-01-01 }
-  claims: [child-program-active]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: programme-enrollment-verification
 input: { tracked_entity: A0000000001, include_inactive: true }
 variables: { as_of_date: 2026-01-01 }
 interactions:
@@ -54,16 +44,3 @@ expect:
     bcg_birth_dose_recorded: true
     opv_birth_dose_recorded: true
     measles_dose_recorded: true
-  claims:
-    tracked-entity-first-name: Nia
-    tracked-entity-last-name: Example
-    child-program-active: true
-    child-age-band: 5-17
-    programme-code: DEMO_CHILD_PROGRAM
-    reconciliation-reference: redacted
-    maternal-postnatal-care-active: true
-    child-health-visit-recorded: true
-    tb-program-active: false
-    bcg-birth-dose-recorded: true
-    opv-birth-dose-recorded: true
-    measles-dose-recorded: true
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/no-enrollment.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/no-enrollment.yaml
index 62f8bf449..f7e4c464c 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/no-enrollment.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/no-enrollment.yaml
@@ -31,16 +31,3 @@ expect:
     bcg_birth_dose_recorded: null
     opv_birth_dose_recorded: null
     measles_dose_recorded: null
-  claims:
-    tracked-entity-first-name: null
-    tracked-entity-last-name: null
-    child-program-active: null
-    child-age-band: null
-    programme-code: null
-    reconciliation-reference: redacted
-    maternal-postnatal-care-active: null
-    child-health-visit-recorded: null
-    tb-program-active: null
-    bcg-birth-dose-recorded: null
-    opv-birth-dose-recorded: null
-    measles-dose-recorded: null
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/no-match.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/no-match.yaml
index ded4cda16..75598b415 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/no-match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/no-match.yaml
@@ -13,16 +13,3 @@ interactions:
 expect:
   outcome: no_match
   outputs: {}
-  claims:
-    tracked-entity-first-name: null
-    tracked-entity-last-name: null
-    child-program-active: null
-    child-age-band: null
-    programme-code: null
-    reconciliation-reference: redacted
-    maternal-postnatal-care-active: null
-    child-health-visit-recorded: null
-    tb-program-active: null
-    bcg-birth-dose-recorded: null
-    opv-birth-dose-recorded: null
-    measles-dose-recorded: null
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/partial.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/partial.yaml
index 006970494..6cd7b1ce7 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/partial.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/partial.yaml
@@ -35,16 +35,3 @@ expect:
     bcg_birth_dose_recorded: false
     opv_birth_dose_recorded: null
     measles_dose_recorded: true
-  claims:
-    tracked-entity-first-name: null
-    tracked-entity-last-name: null
-    child-program-active: false
-    child-age-band: null
-    programme-code: DEMO_CHILD_PROGRAM
-    reconciliation-reference: redacted
-    maternal-postnatal-care-active: null
-    child-health-visit-recorded: null
-    tb-program-active: null
-    bcg-birth-dose-recorded: false
-    opv-birth-dose-recorded: null
-    measles-dose-recorded: true
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/source-rejected.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/source-rejected.yaml
index 91142e881..24f6faf96 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/source-rejected.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/source-rejected.yaml
@@ -10,4 +10,4 @@ interactions:
         fields: trackedEntity,attributes[attribute,value],enrollments[program,status,events[programStage,status]]
         includeDeleted: true
     respond: { status: 500, body: {} }
-expect: { error: source.status_rejected, outputs: {}, claims: {} }
+expect: { error: source.status_rejected, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/subject-mismatch.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/subject-mismatch.yaml
index 3c46d8d62..ab9b55815 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/subject-mismatch.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/subject-mismatch.yaml
@@ -12,4 +12,4 @@ interactions:
     respond:
       status: 200
       body: { trackedEntity: B0000000002, attributes: [], enrollments: [] }
-expect: { error: failure.subject_mismatch, outputs: {}, claims: {} }
+expect: { error: failure.subject_mismatch, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/registry-stack.yaml
index 7496cebe9..5d68828df 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/registry-stack.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/registry-stack.yaml
@@ -4,12 +4,11 @@ integrations:
   health-record: { file: integrations/health-record/integration.yaml }
 services:
   health-verification:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: programme-enrollment-verification
     legal_basis: public-service-delivery
     consent: not_required
-    access: { scopes: ["evidence:health:read"] }
     variables:
       as_of_date: { from: request.variables.as_of_date, type: date }
     consultations:
@@ -18,44 +17,3 @@ services:
         input:
           tracked_entity: request.target.identifiers.dhis2_tracked_entity
           include_inactive: request.target.attributes.include_inactive
-    claims:
-      tracked-entity-first-name: { output: health.first_name, disclosure: value }
-      tracked-entity-last-name: { output: health.last_name, disclosure: value }
-      child-program-active: { output: health.child_program_active, disclosure: predicate }
-      child-age-band:
-        cel: >-
-          health.matched && health.date_of_birth != null
-            ? (date.age_on(health.date_of_birth, as_of_date) < 5
-                ? "0-4"
-                : (date.age_on(health.date_of_birth, as_of_date) < 18 ? "5-17" : "18+"))
-            : null
-        disclosure: value
-      programme-code: { output: health.programme_code, disclosure: value }
-      reconciliation-reference: { output: health.reconciliation_reference, disclosure: redacted }
-      maternal-postnatal-care-active: { output: health.maternal_postnatal_active, disclosure: predicate }
-      child-health-visit-recorded: { output: health.child_health_visit_recorded, disclosure: predicate }
-      tb-program-active: { output: health.tb_program_active, disclosure: predicate }
-      bcg-birth-dose-recorded: { output: health.bcg_birth_dose_recorded, disclosure: predicate }
-      opv-birth-dose-recorded: { output: health.opv_birth_dose_recorded, disclosure: predicate }
-      measles-dose-recorded: { output: health.measles_dose_recorded, disclosure: predicate }
-    credential_profiles:
-      health-status:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/health-status/v1
-        validity: 10m
-        claims: [maternal-postnatal-care-active, child-health-visit-recorded, tb-program-active]
-      child-program:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/child-program/v1
-        validity: 10m
-        claims: [tracked-entity-first-name, tracked-entity-last-name, child-program-active, child-age-band]
-      programme-participation:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/programme-participation/v1
-        validity: 10m
-        claims: [programme-code, reconciliation-reference, child-program-active]
-      child-health-evidence:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/child-health-evidence/v1
-        validity: 10m
-        claims: [child-program-active, bcg-birth-dose-recorded, opv-birth-dose-recorded, measles-dose-recorded]
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/README.md b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/README.md
index 92f1d010a..e4d263811 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/README.md
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/README.md
@@ -1,4 +1,4 @@
-# DHIS2 child-health evidence Registry Stack project
+# DHIS2 child-health consultation Registry Stack project
 
 This starter demonstrates the product-neutral `script` capability with a
 synthetic DHIS2 Tracker wire shape. Product and version metadata do not select
@@ -28,30 +28,32 @@ The authored layers remain separate:
    declared identity, date, programme, reconciliation, and health-status
    outputs. Nullable programme and stage booleans keep `true`, `false`, and
    `null` distinct, including BCG, OPV, and measles dose evidence.
-2. Notary discloses those outputs as atomic evidence claims. It does not decide
-   outreach, follow-up priority, eligibility, entitlement, or case action.
-3. In this example, a public-health programme is both the evidence consumer and
+2. Relay exposes those outputs through the bounded consultation API. It does
+   not decide outreach, follow-up priority, eligibility, entitlement, or case
+   action.
+3. In this example, a public-health programme is both the consultation consumer and
    decision owner. It might first route any `null` evidence to resolution, then
-   derive `outreach_required` only from known enrollment and dose evidence.
+   derive `outreach_required` only from known enrollment and dose outputs.
    That downstream rule is illustrative and is not part of this Registry Stack
    project.
 
 For a matched tracked entity, a completed DHIS2 programme-stage event maps to
 `true`, an existing non-completed stage event maps to `false`, and an absent
 enrollment or stage maps to `null`. A 404 is a no-match, not negative health
-evidence. An upstream rejection and an echoed-subject mismatch are failures
-and produce no claims. Ambiguity is explicitly not applicable because the
+source data. An upstream rejection and an echoed-subject mismatch are failures
+and produce no outputs. Ambiguity is explicitly not applicable because the
 adapter uses DHIS2's singleton tracked-entity resource.
 
 The demo programme and stage UIDs in `adapter.rhai` are project-owned mappings.
 Replace and review them against the deployed DHIS2 metadata without changing
 the product-neutral Script runtime or broadening source access.
 
-Record any live compatibility result through the repository root's
-`release/conformance/integrations/` evidence flow. Never rewrite the
-deterministic offline fixtures to reflect a transient live server result.
+This repository has no source-read conformance evidence flow at present, so a
+live compatibility result stays with the deployment that produced it and is not
+release evidence here. Never rewrite the deterministic offline fixtures to
+reflect a transient live server result.
 
 The `include_inactive` boolean is a bounded, typed target attribute supplied by
-the evaluation caller and forwarded through Notary and Relay. It is request
+the consultation caller and forwarded through Relay. It is request
 context only. It is not an authenticated identity or a substitute for the
 `dhis2_tracked_entity` identifier used to select the record.
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/environments/local.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/environments/local.yaml
index ca640b2d6..44e5ac10e 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/environments/local.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/environments/local.yaml
@@ -7,28 +7,14 @@ integrations:
         username: { secret: HEALTH_REGISTRY_USERNAME }
         password: { secret: HEALTH_REGISTRY_PASSWORD }
         generation: 1
-issuance:
-  issuer: did:web:health-notary.invalid
-  signing_kid: project-issuer-key
-  signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }
-  generation: 1
-callers:
-  programme-verifier:
-    api_key_fingerprint: { secret: PROGRAMME_VERIFIER_TOKEN_HASH }
-    scopes: ["evidence:health:read"]
 relay:
   origin: https://health-relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [health-relay-client]
-
-notary_relay:
-  base_url: http://127.0.0.1:8080
-  workload_client_id: health-registry-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: health-consultation-client, principal_id: health-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: health-registry-relay }
-  notary: { service: health-registry-notary }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/match.yaml
index 527479d79..fe920907c 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/match.yaml
@@ -1,15 +1,5 @@
 name: complete-child-health-evidence
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers: [{ scheme: dhis2_tracked_entity, value: A0000000001 }]
-    attributes: { include_inactive: true }
-  variables: { as_of_date: 2026-01-01 }
-  claims: [child-program-active]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: programme-enrollment-verification
 input: { tracked_entity: A0000000001, include_inactive: true }
 variables: { as_of_date: 2026-01-01 }
 interactions:
@@ -54,16 +44,3 @@ expect:
     bcg_birth_dose_recorded: true
     opv_birth_dose_recorded: true
     measles_dose_recorded: true
-  claims:
-    tracked-entity-first-name: Nia
-    tracked-entity-last-name: Example
-    child-program-active: true
-    child-age-band: 5-17
-    programme-code: DEMO_CHILD_PROGRAM
-    reconciliation-reference: redacted
-    maternal-postnatal-care-active: true
-    child-health-visit-recorded: true
-    tb-program-active: false
-    bcg-birth-dose-recorded: true
-    opv-birth-dose-recorded: true
-    measles-dose-recorded: true
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/no-enrollment.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/no-enrollment.yaml
index 62f8bf449..f7e4c464c 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/no-enrollment.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/no-enrollment.yaml
@@ -31,16 +31,3 @@ expect:
     bcg_birth_dose_recorded: null
     opv_birth_dose_recorded: null
     measles_dose_recorded: null
-  claims:
-    tracked-entity-first-name: null
-    tracked-entity-last-name: null
-    child-program-active: null
-    child-age-band: null
-    programme-code: null
-    reconciliation-reference: redacted
-    maternal-postnatal-care-active: null
-    child-health-visit-recorded: null
-    tb-program-active: null
-    bcg-birth-dose-recorded: null
-    opv-birth-dose-recorded: null
-    measles-dose-recorded: null
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/no-match.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/no-match.yaml
index ded4cda16..75598b415 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/no-match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/no-match.yaml
@@ -13,16 +13,3 @@ interactions:
 expect:
   outcome: no_match
   outputs: {}
-  claims:
-    tracked-entity-first-name: null
-    tracked-entity-last-name: null
-    child-program-active: null
-    child-age-band: null
-    programme-code: null
-    reconciliation-reference: redacted
-    maternal-postnatal-care-active: null
-    child-health-visit-recorded: null
-    tb-program-active: null
-    bcg-birth-dose-recorded: null
-    opv-birth-dose-recorded: null
-    measles-dose-recorded: null
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/partial.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/partial.yaml
index 006970494..6cd7b1ce7 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/partial.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/partial.yaml
@@ -35,16 +35,3 @@ expect:
     bcg_birth_dose_recorded: false
     opv_birth_dose_recorded: null
     measles_dose_recorded: true
-  claims:
-    tracked-entity-first-name: null
-    tracked-entity-last-name: null
-    child-program-active: false
-    child-age-band: null
-    programme-code: DEMO_CHILD_PROGRAM
-    reconciliation-reference: redacted
-    maternal-postnatal-care-active: null
-    child-health-visit-recorded: null
-    tb-program-active: null
-    bcg-birth-dose-recorded: false
-    opv-birth-dose-recorded: null
-    measles-dose-recorded: true
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/source-rejected.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/source-rejected.yaml
index 91142e881..24f6faf96 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/source-rejected.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/source-rejected.yaml
@@ -10,4 +10,4 @@ interactions:
         fields: trackedEntity,attributes[attribute,value],enrollments[program,status,events[programStage,status]]
         includeDeleted: true
     respond: { status: 500, body: {} }
-expect: { error: source.status_rejected, outputs: {}, claims: {} }
+expect: { error: source.status_rejected, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/subject-mismatch.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/subject-mismatch.yaml
index 3c46d8d62..ab9b55815 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/subject-mismatch.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/subject-mismatch.yaml
@@ -12,4 +12,4 @@ interactions:
     respond:
       status: 200
       body: { trackedEntity: B0000000002, attributes: [], enrollments: [] }
-expect: { error: failure.subject_mismatch, outputs: {}, claims: {} }
+expect: { error: failure.subject_mismatch, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml
index aedc9360e..f2007fce6 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml
@@ -2,18 +2,17 @@ version: 1
 starter:
   id: dhis2-tracker
   release: 0.16.3
-  content_digest: sha256:be906adb76e387518906b1db31a435139d132c4471ea1f4387bcaf6c0de456c3
+  content_digest: sha256:ea1b8635519636c3076e55209a6f234608b3fd5b99c5b280d409ca7024f3a402
 registry: { id: fictional-health-registry }
 integrations:
   health-record: { file: integrations/health-record/integration.yaml }
 services:
   health-verification:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: programme-enrollment-verification
     legal_basis: public-service-delivery
     consent: not_required
-    access: { scopes: ["evidence:health:read"] }
     variables:
       as_of_date: { from: request.variables.as_of_date, type: date }
     consultations:
@@ -22,44 +21,3 @@ services:
         input:
           tracked_entity: request.target.identifiers.dhis2_tracked_entity
           include_inactive: request.target.attributes.include_inactive
-    claims:
-      tracked-entity-first-name: { output: health.first_name, disclosure: value }
-      tracked-entity-last-name: { output: health.last_name, disclosure: value }
-      child-program-active: { output: health.child_program_active, disclosure: predicate }
-      child-age-band:
-        cel: >-
-          health.matched && health.date_of_birth != null
-            ? (date.age_on(health.date_of_birth, as_of_date) < 5
-                ? "0-4"
-                : (date.age_on(health.date_of_birth, as_of_date) < 18 ? "5-17" : "18+"))
-            : null
-        disclosure: value
-      programme-code: { output: health.programme_code, disclosure: value }
-      reconciliation-reference: { output: health.reconciliation_reference, disclosure: redacted }
-      maternal-postnatal-care-active: { output: health.maternal_postnatal_active, disclosure: predicate }
-      child-health-visit-recorded: { output: health.child_health_visit_recorded, disclosure: predicate }
-      tb-program-active: { output: health.tb_program_active, disclosure: predicate }
-      bcg-birth-dose-recorded: { output: health.bcg_birth_dose_recorded, disclosure: predicate }
-      opv-birth-dose-recorded: { output: health.opv_birth_dose_recorded, disclosure: predicate }
-      measles-dose-recorded: { output: health.measles_dose_recorded, disclosure: predicate }
-    credential_profiles:
-      health-status:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/health-status/v1
-        validity: 10m
-        claims: [maternal-postnatal-care-active, child-health-visit-recorded, tb-program-active]
-      child-program:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/child-program/v1
-        validity: 10m
-        claims: [tracked-entity-first-name, tracked-entity-last-name, child-program-active, child-age-band]
-      programme-participation:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/programme-participation/v1
-        validity: 10m
-        claims: [programme-code, reconciliation-reference, child-program-active]
-      child-health-evidence:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/child-health-evidence/v1
-        validity: 10m
-        claims: [child-program-active, bcg-birth-dose-recorded, opv-birth-dose-recorded, measles-dose-recorded]
diff --git a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/environments/local.yaml b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/environments/local.yaml
index 672120d40..d46e3168f 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/environments/local.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/environments/local.yaml
@@ -6,28 +6,14 @@ integrations:
       credential:
         token: { secret: FHIR_ACCESS_TOKEN }
         generation: 1
-issuance:
-  issuer: did:web:fhir-notary.invalid
-  signing_kid: project-issuer-key
-  signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }
-  generation: 1
-callers:
-  coverage-service:
-    api_key_fingerprint: { secret: COVERAGE_SERVICE_TOKEN_HASH }
-    scopes: ["evidence:coverage:read"]
 relay:
   origin: https://fhir-relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [fhir-relay-client]
-
-notary_relay:
-  base_url: http://127.0.0.1:8080
-  workload_client_id: fhir-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: fhir-consultation-client, principal_id: fhir-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: fhir-relay }
-  notary: { service: fhir-notary }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/ambiguous-anchor.yaml b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/ambiguous-anchor.yaml
index 3a03e11d1..c2c900f84 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/ambiguous-anchor.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/ambiguous-anchor.yaml
@@ -15,4 +15,4 @@ interactions:
         entry:
           - { search: { mode: match }, resource: { resourceType: Patient, id: patient-1 } }
           - { search: { mode: match }, resource: { resourceType: Patient, id: patient-2 } }
-expect: { outcome: ambiguous, outputs: {}, claims: {} }
+expect: { outcome: ambiguous, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/ambiguous-relation.yaml b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/ambiguous-relation.yaml
index 32b91ea35..7b2bda218 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/ambiguous-relation.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/ambiguous-relation.yaml
@@ -32,4 +32,4 @@ interactions:
         entry:
           - { search: { mode: match }, resource: { resourceType: Coverage, status: active } }
           - { search: { mode: match }, resource: { resourceType: Coverage, status: cancelled } }
-expect: { outcome: ambiguous, outputs: {}, claims: {} }
+expect: { outcome: ambiguous, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/match.yaml
index c342baad6..98425cfa3 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/match.yaml
@@ -1,16 +1,5 @@
 name: coverage-active
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers:
-      - { scheme: birthdate, value: 2018-05-12 }
-      - { scheme: family, value: Example }
-      - { scheme: given, value: Ada }
-  claims: [coverage-active]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: coverage-verification
 input: { birthdate: 2018-05-12, family: Example, given: Ada }
 interactions:
   - expect:
@@ -58,4 +47,3 @@ interactions:
 expect:
   outcome: match
   outputs: { coverage_status: active, insurer_name: Synthetic Health Fund }
-  claims: { patient-record-exists: true, coverage-active: true, insurer-name: Synthetic Health Fund }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/no-match.yaml b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/no-match.yaml
index 5dcd2cb7c..3a34cfdff 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/no-match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/no-match.yaml
@@ -12,4 +12,3 @@ interactions:
 expect:
   outcome: no_match
   outputs: {}
-  claims: { patient-record-exists: false, coverage-active: false, insurer-name: null }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/pagination-bounded.yaml b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/pagination-bounded.yaml
index 37df00431..8665e80d0 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/pagination-bounded.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/pagination-bounded.yaml
@@ -32,4 +32,4 @@ interactions:
               id: patient-1
               birthDate: 2018-05-12
               name: [{ family: Example, given: [Ada] }]
-expect: { outcome: ambiguous, outputs: {}, claims: {} }
+expect: { outcome: ambiguous, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/pagination-match.yaml b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/pagination-match.yaml
index ed982d596..d08b7667e 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/pagination-match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/pagination-match.yaml
@@ -52,4 +52,3 @@ interactions:
 expect:
   outcome: match
   outputs: { coverage_status: active, insurer_name: Synthetic Health Fund }
-  claims: { patient-record-exists: true, coverage-active: true, insurer-name: Synthetic Health Fund }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/subject-mismatch.yaml b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/subject-mismatch.yaml
index 076264f56..47c960f71 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/subject-mismatch.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/subject-mismatch.yaml
@@ -19,4 +19,4 @@ interactions:
               id: patient-other
               birthDate: 2016-09-03
               name: [{ family: Different, given: [Person] }]
-expect: { error: failure.subject_mismatch, outputs: {}, claims: {} }
+expect: { error: failure.subject_mismatch, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml
index 459ed6847..654f4bdd5 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml
@@ -2,18 +2,17 @@ version: 1
 starter:
   id: fhir-r4
   release: 0.16.3
-  content_digest: sha256:6eef001b4c172831a33abf13484c6389195fc2aca787f55750555bed1850a0ea
+  content_digest: sha256:db68aeeaa207bd7a1f2d5f87557e45d888097b6b82379ce14c2acc424ee4d1ac
 registry: { id: fictional-fhir-registry }
 integrations:
   coverage: { file: integrations/coverage/integration.yaml }
 services:
   coverage-verification:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: coverage-verification
     legal_basis: public-service-delivery
     consent: not_required
-    access: { scopes: ["evidence:coverage:read"] }
     consultations:
       coverage:
         integration: coverage
@@ -21,18 +20,3 @@ services:
           birthdate: request.target.identifiers.birthdate
           family: request.target.identifiers.family
           given: request.target.identifiers.given
-    claims:
-      patient-record-exists: { cel: "coverage.matched", disclosure: predicate }
-      coverage-active:
-        cel: >-
-          coverage.coverage_status != null
-            ? coverage.matched && coverage.coverage_status == "active"
-            : false
-        disclosure: predicate
-      insurer-name: { output: coverage.insurer_name, disclosure: value }
-    credential_profiles:
-      coverage-status:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/coverage-status/v1
-        validity: 5m
-        claims: [patient-record-exists, coverage-active, insurer-name]
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/environments/local.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/environments/local.yaml
index 3cdca67cc..34082cdd0 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/environments/local.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/environments/local.yaml
@@ -15,28 +15,14 @@ integrations:
         origin: https://trust.provincial-civil-registry.invalid
         path: /.well-known/jwks.json
         generation: 1
-issuance:
-  issuer: did:web:provincial-civil-notary.invalid
-  signing_kid: project-issuer-key
-  signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }
-  generation: 1
-callers:
-  provincial-verifier:
-    api_key_fingerprint: { secret: PROVINCIAL_VERIFIER_TOKEN_HASH }
-    scopes: ["evidence:provincial-birth:read"]
 relay:
   origin: https://provincial-relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [provincial-civil-relay-client]
-
-notary_relay:
-  base_url: http://127.0.0.1:8080
-  workload_client_id: provincial-civil-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: provincial-civil-consultation-client, principal_id: provincial-civil-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: provincial-civil-relay }
-  notary: { service: provincial-civil-notary }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/integrations/birth-record/fixtures/ambiguous.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/integrations/birth-record/fixtures/ambiguous.yaml
index de40d66b9..ac8d71984 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/integrations/birth-record/fixtures/ambiguous.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/integrations/birth-record/fixtures/ambiguous.yaml
@@ -42,4 +42,4 @@ interactions:
                     - { field: identifier_value, operator: eq, value: BR-ZZ-0000001 }
                 pagination: { page_size: 2, page_number: 1 }
     respond: { status: 200, body: { file: bodies/ambiguous.json } }
-expect: { outcome: ambiguous, outputs: {}, claims: {} }
+expect: { outcome: ambiguous, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/integrations/birth-record/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/integrations/birth-record/fixtures/match.yaml
index 0dafc20f1..8852a510f 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/integrations/birth-record/fixtures/match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/integrations/birth-record/fixtures/match.yaml
@@ -1,14 +1,5 @@
 name: provincial-birth-match
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers: [{ scheme: birth_registration_number, value: BR-ZZ-0000001 }]
-  variables: { as_of_date: 2026-01-01 }
-  claims: [birth-record-exists]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: provincial-birth-attribute-verification
 input: { registration_number: BR-ZZ-0000001 }
 variables: { as_of_date: 2026-01-01 }
 interactions:
@@ -59,12 +50,3 @@ expect:
     child_given_name: Camille
     child_family_name: Exemple
     place_of_birth: Fictional Province
-  claims:
-    birth-record-exists: true
-    date-of-birth: 2016-03-11
-    sex: X
-    child-given-name: Camille
-    child-family-name: Exemple
-    child-birth-date: 2016-03-11
-    child-place-of-birth: Fictional Province
-    age-band: 5-17
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/integrations/birth-record/fixtures/no-match.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/integrations/birth-record/fixtures/no-match.yaml
index 8d13b2bb9..2c788f57d 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/integrations/birth-record/fixtures/no-match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/integrations/birth-record/fixtures/no-match.yaml
@@ -45,4 +45,3 @@ interactions:
 expect:
   outcome: no_match
   outputs: {}
-  claims: { birth-record-exists: false, date-of-birth: null, sex: null, child-given-name: null, child-family-name: null, child-birth-date: null, child-place-of-birth: null, age-band: null }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/registry-stack.yaml
index a607ea21d..ffff6e3b9 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/registry-stack.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/registry-stack.yaml
@@ -4,12 +4,11 @@ integrations:
   birth-record: { file: integrations/birth-record/integration.yaml }
 services:
   provincial-birth-verification:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: provincial-birth-attribute-verification
     legal_basis: public-service-delivery
     consent: not_required
-    access: { scopes: ["evidence:provincial-birth:read"] }
     variables:
       as_of_date: { from: request.variables.as_of_date, type: date }
     consultations:
@@ -17,30 +16,3 @@ services:
         integration: birth-record
         input:
           registration_number: request.target.identifiers.birth_registration_number
-    claims:
-      birth-record-exists: { cel: "birth.matched", disclosure: predicate }
-      date-of-birth: { output: birth.date_of_birth, disclosure: value }
-      sex: { output: birth.sex, disclosure: value }
-      child-given-name: { output: birth.child_given_name, disclosure: value }
-      child-family-name: { output: birth.child_family_name, disclosure: value }
-      child-birth-date: { output: birth.date_of_birth, disclosure: value }
-      child-place-of-birth: { output: birth.place_of_birth, disclosure: value }
-      age-band:
-        cel: >-
-          birth.matched && birth.date_of_birth != null
-            ? (date.age_on(birth.date_of_birth, as_of_date) < 5
-                ? "0-4"
-                : (date.age_on(birth.date_of_birth, as_of_date) < 18 ? "5-17" : "18+"))
-            : null
-        disclosure: value
-    credential_profiles:
-      birth-summary:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/provincial-birth-summary/v1
-        validity: 10m
-        claims: [birth-record-exists, date-of-birth, sex, age-band]
-      birth-attributes:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/provincial-birth-attributes/v1
-        validity: 10m
-        claims: [child-given-name, child-family-name, child-birth-date, child-place-of-birth]
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/environments/local.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/environments/local.yaml
index 620ea2256..607843568 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/environments/local.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/environments/local.yaml
@@ -18,24 +18,14 @@ integrations:
         path: /oauth/token
         generation: 1
 
-callers:
-  synthetic-case-client:
-    api_key_fingerprint: { secret: SYNTHETIC_CASE_CLIENT_TOKEN_HASH }
-    scopes: ["evidence:birth-event:read"]
-
 relay:
   origin: https://relay.opencrvs.invalid
   issuer: https://workload-issuer.opencrvs.invalid
   jwks_url: https://workload-issuer.opencrvs.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [synthetic-opencrvs-relay-client]
-
-notary_relay:
-  base_url: http://registry-relay-consultation:8080
-  workload_client_id: synthetic-opencrvs-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: synthetic-opencrvs-consultation-client, principal_id: synthetic-opencrvs-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: synthetic-opencrvs-relay }
-  notary: { service: synthetic-opencrvs-notary }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/ambiguous.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/ambiguous.yaml
index e053ffeb6..ecc618347 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/ambiguous.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/ambiguous.yaml
@@ -32,4 +32,3 @@ interactions:
 expect:
   outcome: ambiguous
   outputs: {}
-  claims: {}
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/match.yaml
index ef9885978..97544b7e0 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/match.yaml
@@ -1,14 +1,5 @@
 name: birth-event-match
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers:
-      - { scheme: opencrvs_tracking_id, value: TRK-SYNTH000001 }
-  claims: [birth-event-found, birth-event-registered]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: birth-event-registration-verification
 input: { tracking_id: TRK-SYNTH000001 }
 interactions:
   - expect:
@@ -51,6 +42,3 @@ expect:
   outputs:
     event_type: birth
     registered: true
-  claims:
-    birth-event-found: true
-    birth-event-registered: true
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/no-match.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/no-match.yaml
index 8a34cf7eb..14405da7a 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/no-match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/no-match.yaml
@@ -28,6 +28,3 @@ interactions:
 expect:
   outcome: no_match
   outputs: {}
-  claims:
-    birth-event-found: false
-    birth-event-registered: false
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-expiry.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-expiry.yaml
index d27ba86ad..fd8bb87e9 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-expiry.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-expiry.yaml
@@ -14,4 +14,4 @@ interactions:
         access_token: SYNTHETIC_FIXTURE_TOKEN
         token_type: Bearer
         expires_in: 300
-expect: { error: source.response_malformed, outputs: {}, claims: {} }
+expect: { error: source.response_malformed, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-extra-member.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-extra-member.yaml
index 0d7c88b42..0a96cb72c 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-extra-member.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-extra-member.yaml
@@ -14,4 +14,4 @@ interactions:
         access_token: SYNTHETIC_FIXTURE_TOKEN
         token_type: Bearer
         unexpected: rejected
-expect: { error: source.response_malformed, outputs: {}, claims: {} }
+expect: { error: source.response_malformed, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-media-type.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-media-type.yaml
index f6d093deb..3c71fe464 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-media-type.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-media-type.yaml
@@ -11,4 +11,4 @@ interactions:
       status: 200
       headers: { Content-Type: text/plain }
       body: { access_token: SYNTHETIC_FIXTURE_TOKEN, token_type: Bearer }
-expect: { error: source.response_malformed, outputs: {}, claims: {} }
+expect: { error: source.response_malformed, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-redirect.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-redirect.yaml
index 788832488..79b4b250c 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-redirect.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-redirect.yaml
@@ -11,4 +11,4 @@ interactions:
       status: 302
       headers: { Location: https://redirect.opencrvs.invalid/oauth/token }
       body: {}
-expect: { error: source.status_rejected, outputs: {}, claims: {} }
+expect: { error: source.status_rejected, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-token-type.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-token-type.yaml
index 99b2ba786..2af0b65f2 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-token-type.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/oauth-token-type.yaml
@@ -13,4 +13,4 @@ interactions:
       body:
         access_token: SYNTHETIC_FIXTURE_TOKEN
         token_type: bearer
-expect: { error: source.response_malformed, outputs: {}, claims: {} }
+expect: { error: source.response_malformed, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/source-malformed.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/source-malformed.yaml
index 6917af9dd..0b71925a1 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/source-malformed.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/source-malformed.yaml
@@ -25,4 +25,4 @@ interactions:
     respond:
       status: 200
       body: { total: one, results: [] }
-expect: { error: source.status_rejected, outputs: {}, claims: {} }
+expect: { error: source.status_rejected, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/source-rejected.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/source-rejected.yaml
index c2aa9a714..8f286c612 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/source-rejected.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/source-rejected.yaml
@@ -23,4 +23,4 @@ interactions:
         limit: 2
         offset: 0
     respond: { status: 503, body: {} }
-expect: { error: source.status_rejected, outputs: {}, claims: {} }
+expect: { error: source.status_rejected, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/source-timeout.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/source-timeout.yaml
index 728735613..fdb27880b 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/source-timeout.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/source-timeout.yaml
@@ -23,4 +23,4 @@ interactions:
         limit: 2
         offset: 0
     respond: { timeout: 10s }
-expect: { error: source.deadline_exceeded, outputs: {}, claims: {} }
+expect: { error: source.deadline_exceeded, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/subject-mismatch.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/subject-mismatch.yaml
index c66b3f852..0e497bbb9 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/subject-mismatch.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/integrations/birth-event-search/fixtures/subject-mismatch.yaml
@@ -31,4 +31,4 @@ interactions:
             type: birth
             status: REGISTERED
             trackingId: TRK-SYNTH999999
-expect: { error: failure.subject_mismatch, outputs: {}, claims: {} }
+expect: { error: failure.subject_mismatch, outputs: {} }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/registry-stack.yaml
index e5bcc94de..33891d5cb 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/registry-stack.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api/registry-stack.yaml
@@ -8,25 +8,13 @@ integrations:
 
 services:
   birth-event-verification:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: birth-event-registration-verification
     legal_basis: public-service-delivery
     consent: not_required
-    access:
-      scopes: ["evidence:birth-event:read"]
     consultations:
       event:
         integration: birth-event-search
         input:
           tracking_id: request.target.identifiers.opencrvs_tracking_id
-    claims:
-      birth-event-found:
-        cel: event.matched
-        disclosure: predicate
-      birth-event-registered:
-        cel: >-
-          event.matched
-            && event.event_type == "birth"
-            && event.registered
-        disclosure: predicate
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/README.md b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/README.md
index 6331f9676..29a055740 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/README.md
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/README.md
@@ -26,5 +26,5 @@ it constructs each released parent object field by field and releases only
 `type`, `name`, and `identifier`. The closed `parents` output permits at most
 two objects and caps both the array and each item by canonical serialized
 bytes. The adapter never spreads or returns a whole source parent record.
-`parents` is one top-level credential claim and is disclosed or withheld as a
-whole unit; this project does not declare nested selective disclosure.
+`parents` is one bounded top-level consultation output and is returned as a
+whole unit; the project does not expose the source-only reference.
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/environments/local.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/environments/local.yaml
index 2c1a2a315..9b32d2102 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/environments/local.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/environments/local.yaml
@@ -15,28 +15,14 @@ integrations:
         origin: https://trust.civil-registry.invalid
         path: /.well-known/jwks.json
         generation: 1
-issuance:
-  issuer: did:web:civil-notary.invalid
-  signing_kid: project-issuer-key
-  signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }
-  generation: 1
-callers:
-  birth-verifier:
-    api_key_fingerprint: { secret: BIRTH_VERIFIER_TOKEN_HASH }
-    scopes: ["evidence:birth:read"]
 relay:
   origin: https://civil-relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [civil-registry-relay-client]
-
-notary_relay:
-  base_url: http://127.0.0.1:8080
-  workload_client_id: civil-registry-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: civil-registry-consultation-client, principal_id: civil-registry-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: civil-registry-relay }
-  notary: { service: civil-registry-notary }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/ambiguous.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/ambiguous.yaml
index d2fbb3bd9..3a5f4b0e2 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/ambiguous.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/ambiguous.yaml
@@ -48,4 +48,3 @@ interactions:
 expect:
   outcome: ambiguous
   outputs: {}
-  claims: {}
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/match.yaml
index 906bd764d..4722d292d 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/match.yaml
@@ -1,14 +1,5 @@
 name: birth-record-match
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers: [{ scheme: UIN, value: "0000000001" }]
-  variables: { as_of_date: 2026-01-01 }
-  claims: [birth-record-exists]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: birth-record-verification
 input: { uin: "0000000001" }
 variables: { as_of_date: 2026-01-01 }
 interactions:
@@ -65,15 +56,3 @@ expect:
     parents:
       - { type: mother, name: Mira Example, identifier: PARENT-0001 }
       - { type: father, name: Noah Example, identifier: PARENT-0002 }
-  claims:
-    birth-record-exists: true
-    date-of-birth: 2018-05-12
-    sex: female
-    child-given-name: Ada
-    child-family-name: Example
-    child-birth-date: 2018-05-12
-    child-place-of-birth: Fictional District
-    parents:
-      - { type: mother, name: Mira Example, identifier: PARENT-0001 }
-      - { type: father, name: Noah Example, identifier: PARENT-0002 }
-    age-band: 5-17
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/no-match.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/no-match.yaml
index fedb9e81c..38b3b5e88 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/no-match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/no-match.yaml
@@ -45,4 +45,3 @@ interactions:
 expect:
   outcome: no_match
   outputs: {}
-  claims: { birth-record-exists: false, date-of-birth: null, sex: null, child-given-name: null, child-family-name: null, child-birth-date: null, child-place-of-birth: null, parents: null, age-band: null }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml
index 26c71bde0..66c9d5e23 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml
@@ -2,18 +2,17 @@ version: 1
 starter:
   id: opencrvs-dci
   release: 0.16.3
-  content_digest: sha256:b99132e497b63e1f77a1f5cde8e52f1a293e6bca88f912e5a2ba70a8e1c46f8c
+  content_digest: sha256:7eb3f0e32f11a4a6e6a5c36f6107292a8fe4d9a853acbcf57cc30b5942c7d268
 registry: { id: fictional-civil-registry }
 integrations:
   birth-record: { file: integrations/birth-record/integration.yaml }
 services:
   birth-verification:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: birth-record-verification
     legal_basis: public-service-delivery
     consent: not_required
-    access: { scopes: ["evidence:birth:read"] }
     variables:
       as_of_date:
         from: request.variables.as_of_date
@@ -23,31 +22,3 @@ services:
         integration: birth-record
         input:
           uin: request.target.identifiers.UIN
-    claims:
-      birth-record-exists: { cel: "birth.matched", disclosure: predicate }
-      date-of-birth: { output: birth.date_of_birth, disclosure: value }
-      sex: { output: birth.sex, disclosure: value }
-      child-given-name: { output: birth.child_given_name, disclosure: value }
-      child-family-name: { output: birth.child_family_name, disclosure: value }
-      child-birth-date: { output: birth.date_of_birth, disclosure: value }
-      child-place-of-birth: { output: birth.place_of_birth, disclosure: value }
-      parents: { output: birth.parents, disclosure: value }
-      age-band:
-        cel: >-
-          birth.matched && birth.date_of_birth != null
-            ? (date.age_on(birth.date_of_birth, as_of_date) < 5
-                ? "0-4"
-                : (date.age_on(birth.date_of_birth, as_of_date) < 18 ? "5-17" : "18+"))
-            : null
-        disclosure: value
-    credential_profiles:
-      birth-summary:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/birth-summary/v1
-        validity: 10m
-        claims: [birth-record-exists, date-of-birth, sex, age-band]
-      birth-attributes:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/birth-attributes/v1
-        validity: 10m
-        claims: [child-given-name, child-family-name, child-birth-date, child-place-of-birth, parents]
diff --git a/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/README.md b/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/README.md
index adf64d0d7..d2c084bfd 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/README.md
+++ b/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/README.md
@@ -38,13 +38,12 @@ Use a private copy of this workspace from one tagged Registry Stack release
 that contains both
 [PR #355](https://github.com/registrystack/registry-stack/pull/355) and
 [PR #364](https://github.com/registrystack/registry-stack/pull/364).
-Record the tag and use the matching `registryctl`, Relay image, Notary image,
-and published image digests.
+Record the tag and use the matching `registryctl`, Relay image, and published
+image digest.
 Atomically pin the candidate adopter deployment to those artifacts.
 Do not use a source build, a branch image, the retired monorepo `lab/`, shared
-Relay or Notary state, or a hand-edited generated YAML file.
-Each Relay authority needs its own dedicated Notary and Notary-owned PostgreSQL
-state.
+Relay state, or a hand-edited generated YAML file.
+Each Relay authority needs its own dedicated runtime and state.
 
 Select and record one exact OpenSPP version and one read-only operation before
 editing the workspace.
@@ -55,23 +54,22 @@ Replace every fictional assumption in the private copy:
 | `integrations/individual/integration.yaml` | Replace `id` and the `source.versions.unverified` fixture label with the reviewed integration identity and exact selected OpenSPP version. Classify that version under `source.versions.tested` only after the owner evidence is accepted. |
 | `integrations/individual/integration.yaml` | Replace the input name, type, length, pattern, HTTP method, relative path, query, no-match statuses, authentication type, response format, and response-size bound with the selected read-only operation's contract. |
 | `integrations/individual/integration.yaml` | Replace output names, types, lengths, and `x-registry-source` pointers. Reassess the `ambiguity` and `subject_mismatch` not-applicable rationales. Add fixtures when either outcome is applicable. |
-| `integrations/individual/fixtures/*.yaml` | Replace the synthetic selector, request expectation, source response, normalized outputs, outcome, and claims. Keep all retained fixture data synthetic. |
-| `registry-stack.yaml` | Replace `registry.id`, the service id, `purpose`, `legal_basis`, `consent`, `access.scopes`, the consultation input mapping, claim ids and declarations, disclosure modes, and credential profile with reviewed owner decisions. |
+| `integrations/individual/fixtures/*.yaml` | Replace the synthetic selector, request expectation, source response, normalized outputs, and outcome. Keep all retained fixture data synthetic. |
+| `registry-stack.yaml` | Replace `registry.id`, the service id, `purpose`, `legal_basis`, `consent`, and the consultation input mapping with reviewed owner decisions. |
 | `environments/<owner-environment>.yaml` | Replace `integrations.individual.source.origin`, `integrations.individual.source.credential.token.secret`, and `integrations.individual.source.credential.generation` with the private OpenSPP source binding. |
-| `environments/<owner-environment>.yaml` | Replace every `issuance` field and the `callers.programme-service` map key, API-key fingerprint secret reference, and scopes with candidate-owned values. |
-| `environments/<owner-environment>.yaml` | Replace every `relay`, `notary_relay`, and `deployment` field. Add the candidate-required state bindings. Keep all deployment values outside public evidence. |
+| `environments/<owner-environment>.yaml` | Replace every `relay` and `deployment` field. Add the candidate-required state bindings. Keep all deployment values outside public evidence. |
 
 Use bounded one-request HTTP authoring when it expresses the selected operation.
 Use reviewed Rhai only when the operation requires project-owned traversal or
 normalization.
-Do not add OpenSPP-specific Rust dispatch, restore a Notary source connector,
-add an integration sidecar, or edit generated runtime configuration.
+Do not add OpenSPP-specific Rust dispatch, add an integration sidecar, or edit
+generated runtime configuration.
 
 Rerun the focused trace, complete offline fixture suite, check, and build after
 every contract change.
 For the private owner environment, replace `local` in the check and build
 commands with the exact environment filename without `.yaml`.
-Activate the generated Relay and Notary Config Bundle inputs through the
+Activate the generated Relay Config Bundle inputs through the
 documented path for the selected tagged candidate, without modifying generated
 files.
 
@@ -81,18 +79,17 @@ Before asking to close GH#357, record:
 
 - [ ] Exact OpenSPP version and read-only operation, including which
       country-specific mapping files changed.
-- [ ] Exact Registry Stack tag, `registryctl` version, adopter commit, Relay and
-      Notary image digests, and per-authority Notary and PostgreSQL topology.
+- [ ] Exact Registry Stack tag, `registryctl` version, adopter commit, Relay
+      image digest, and per-authority Relay state topology.
 - [ ] The commands and pass or fail outcomes for focused trace, watch, complete
       offline fixtures, check, build, and separately owned activation evidence.
 - [ ] Match and no-match outcomes, plus applicable ambiguity or subject-mismatch
       behavior or reviewed reasons that they are not applicable.
 - [ ] Authorization denial before source access, bounded failure, disclosure,
       redaction, and source-backed provenance outcomes.
-- [ ] Confirmation that generated Relay and Notary files were activated
-      unchanged.
-- [ ] Confirmation that no OpenSPP-specific Registry Stack Rust, Notary source
-      connector, integration sidecar, or direct registry test path was needed.
+- [ ] Confirmation that generated Relay files were activated unchanged.
+- [ ] Confirmation that no OpenSPP-specific Registry Stack Rust, integration
+      sidecar, or direct registry test path was needed.
 - [ ] Confirmation that changing the country mapping required only reviewed
       project-authored files and fixtures.
 - [ ] Any gap fixed in the generic authoring or runtime model, or recorded as an
@@ -100,7 +97,7 @@ Before asking to close GH#357, record:
 
 Before retaining or publishing evidence:
 
-- [ ] Remove Notary and OpenSPP credentials, secret values, private origins,
+- [ ] Remove OpenSPP credentials, secret values, private origins,
       private network details, raw selectors, subject identifiers, source rows,
       source response bodies, and deployment-specific file paths.
 - [ ] Do not retain shell history, environment dumps, packet captures, verbose
diff --git a/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/environments/local.yaml b/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/environments/local.yaml
index a2e09fb5b..7547e709a 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/environments/local.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/environments/local.yaml
@@ -6,28 +6,14 @@ integrations:
       credential:
         token: { secret: SOCIAL_REGISTRY_TOKEN }
         generation: 1
-issuance:
-  issuer: did:web:social-registry-notary.invalid
-  signing_kid: project-issuer-key
-  signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }
-  generation: 1
-callers:
-  programme-service:
-    api_key_fingerprint: { secret: PROGRAMME_SERVICE_TOKEN_HASH }
-    scopes: ["evidence:social-registry:read"]
 relay:
   origin: https://social-registry-relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [social-registry-relay-client]
-
-notary_relay:
-  base_url: http://127.0.0.1:8080
-  workload_client_id: social-registry-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: social-registry-consultation-client, principal_id: social-registry-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: social-registry-relay }
-  notary: { service: social-registry-notary }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/integrations/individual/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/integrations/individual/fixtures/match.yaml
index c215fc1fa..86516d624 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/integrations/individual/fixtures/match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/integrations/individual/fixtures/match.yaml
@@ -1,13 +1,5 @@
 name: social-registry-match
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers: [{ scheme: openspp_individual_id, value: IND-AB12CD34 }]
-  claims: [social-registry-record-exists]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: social-programme-verification
 input: { individual_id: IND-AB12CD34 }
 interactions:
   - expect:
@@ -19,4 +11,3 @@ interactions:
       body: { active: true, programme_code: SUPPORT, household_reference: HH-0001 }
 expect:
   outputs: { active: true, programme_code: SUPPORT, household_reference: HH-0001 }
-  claims: { social-registry-record-exists: true, social-registry-active: true, programme-code: SUPPORT, household-reference: redacted }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/integrations/individual/fixtures/no-match.yaml b/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/integrations/individual/fixtures/no-match.yaml
index 307da4e21..117f684dc 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/integrations/individual/fixtures/no-match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/integrations/individual/fixtures/no-match.yaml
@@ -10,4 +10,3 @@ interactions:
 expect:
   outcome: no_match
   outputs: {}
-  claims: { social-registry-record-exists: false, social-registry-active: null, programme-code: null, household-reference: redacted }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/registry-stack.yaml
index c608cf71c..bcd200fe6 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/registry-stack.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/registry-stack.yaml
@@ -4,25 +4,13 @@ integrations:
   individual: { file: integrations/individual/integration.yaml }
 services:
   social-registry-verification:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: social-programme-verification
     legal_basis: public-service-delivery
     consent: not_required
-    access: { scopes: ["evidence:social-registry:read"] }
     consultations:
       individual:
         integration: individual
         input:
           individual_id: request.target.identifiers.openspp_individual_id
-    claims:
-      social-registry-record-exists: { cel: individual.matched, disclosure: predicate }
-      social-registry-active: { output: individual.active, disclosure: predicate }
-      programme-code: { output: individual.programme_code, disclosure: value }
-      household-reference: { output: individual.household_reference, disclosure: redacted }
-    credential_profiles:
-      social-registry-status:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/social-registry-status/v1
-        validity: 10m
-        claims: [social-registry-record-exists, social-registry-active, programme-code]
diff --git a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/README.md b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/README.md
index 4c423971b..118a0e12e 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/README.md
+++ b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/README.md
@@ -20,10 +20,9 @@ Add a records service only when the project intentionally publishes the entity
 through Relay's governed records API.
 
 Relay normalizes the source fields as `registration_status` and
-`residency_confirmed`. Notary exposes the reusable
-`population-registration-status` and `residency-confirmed` evidence claims.
-The evidence consumer, not this project, determines how those claims are used.
+`residency_confirmed` and exposes them through the bounded consultation API.
+The consultation consumer, not this project, determines how those outputs are used.
 The decision owner remains accountable for eligibility, qualification,
 prioritization, approval, payment, workflow, and action rules. A no-match keeps
-both evidence values unknown rather than silently converting missing evidence
+both output values unknown rather than silently converting missing source data
 to a negative fact.
diff --git a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/environments/local.yaml b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/environments/local.yaml
index ff8f18ee5..d378fac7c 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/environments/local.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/environments/local.yaml
@@ -12,31 +12,14 @@ entities:
       guardian_id: guardian_key
     source_revision: population-export-v1
     generation: 2026-07-12
-issuance:
-  issuer: did:web:population-notary.invalid
-  signing_kid: project-issuer-key
-  signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }
-  generation: 1
-callers:
-  benefits-service:
-    api_key_fingerprint: { secret: BENEFITS_SERVICE_TOKEN_HASH }
-    scopes: ["evidence:population:read"]
-  emergency-service:
-    api_key_fingerprint: { secret: EMERGENCY_SERVICE_TOKEN_HASH }
-    scopes: ["evidence:population:emergency"]
 relay:
   origin: https://population-relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [population-relay-client]
-
-notary_relay:
-  base_url: http://127.0.0.1:8080
-  workload_client_id: population-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: population-consultation-client, principal_id: population-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: population-relay }
-  notary: { service: population-notary }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/match.yaml
index 3d21e9777..ec853caab 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/match.yaml
@@ -1,13 +1,5 @@
 name: snapshot-match
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers: [{ scheme: population_person_id, value: PER-00000001 }]
-  claims: [population-record-exists]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: benefits-eligibility
 input: { person_id: PER-00000001 }
 interactions:
   - expect: { method: GET, path: /snapshot }
@@ -15,9 +7,3 @@ interactions:
 expect:
   outcome: match
   outputs: { registration_status: active, residency_confirmed: true }
-  claims:
-    population-record-exists: true
-    population-registration-status: active
-    residency-confirmed: true
-    emergency-record-exists: true
-    emergency-status: redacted
diff --git a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/no-match.yaml b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/no-match.yaml
index 55a1e18a6..51c104130 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/no-match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/no-match.yaml
@@ -7,9 +7,3 @@ interactions:
 expect:
   outcome: no_match
   outputs: {}
-  claims:
-    population-record-exists: false
-    population-registration-status: null
-    residency-confirmed: null
-    emergency-record-exists: false
-    emergency-status: redacted
diff --git a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml
index deb26553a..8b9fa486f 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml
@@ -2,7 +2,7 @@ version: 1
 starter:
   id: snapshot
   release: 0.16.3
-  content_digest: sha256:868e6ecd834c078f56bd38c8b9f3c8a5d39baa9e6a44ddf94e153276dd588314
+  content_digest: sha256:15d4fc03d45d1b622812aa5900f413609b325b32f3d967993c9fd396c51f06df
 registry: { id: fictional-population-registry }
 integrations:
   person-snapshot: { file: integrations/person-snapshot/integration.yaml }
@@ -10,43 +10,22 @@ entities:
   people: { file: entities/people.yaml }
 services:
   benefits-eligibility:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: benefits-eligibility
     legal_basis: public-service-delivery
     consent: not_required
-    access: { scopes: ["evidence:population:read"] }
     consultations:
       person:
         integration: person-snapshot
         input: { person_id: request.target.identifiers.population_person_id }
-    claims:
-      population-record-exists: { cel: person.matched, disclosure: predicate }
-      population-registration-status: { output: person.registration_status, disclosure: value }
-      residency-confirmed: { output: person.residency_confirmed, disclosure: predicate }
-    credential_profiles:
-      population-evidence:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/population-evidence/v1
-        validity: 10m
-        claims: [population-record-exists, population-registration-status, residency-confirmed]
   emergency-assistance:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: emergency-assistance
     legal_basis: vital-interests
     consent: not_required
-    access: { scopes: ["evidence:population:emergency"] }
     consultations:
       person:
         integration: person-snapshot
         input: { person_id: request.target.identifiers.population_person_id }
-    claims:
-      emergency-record-exists: { cel: person.matched, disclosure: predicate }
-      emergency-status: { output: person.registration_status, disclosure: redacted }
-    credential_profiles:
-      emergency-status:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/emergency-status/v1
-        validity: 5m
-        claims: [emergency-record-exists, emergency-status]
diff --git a/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/environments/local.yaml b/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/environments/local.yaml
index 1fa460442..c831732e1 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/environments/local.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/environments/local.yaml
@@ -12,29 +12,13 @@ entities:
       guardian_id: guardian_key
     source_revision: population-export-v1
     generation: 2026-07-13
-issuance:
-  issuer: did:web:population-notary.invalid
-  signing_kid: project-issuer-key
-  signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }
-  generation: 1
-callers:
-  benefits-service:
-    api_key_fingerprint: { secret: BENEFITS_SERVICE_TOKEN_HASH }
-    scopes: ["evidence:population:read"]
-  emergency-service:
-    api_key_fingerprint: { secret: EMERGENCY_SERVICE_TOKEN_HASH }
-    scopes: ["evidence:population:emergency"]
 relay:
   origin: https://population-relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [population-records-client]
-notary_relay:
-  base_url: http://127.0.0.1:8080
-  workload_client_id: population-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: population-records-consultation-client, principal_id: population-consultation-principal }
 deployment:
   profile: local
   relay: { service: population-relay }
-  notary: { service: population-notary }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/integrations/person-snapshot/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/integrations/person-snapshot/fixtures/match.yaml
index 3d21e9777..ec853caab 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/integrations/person-snapshot/fixtures/match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/integrations/person-snapshot/fixtures/match.yaml
@@ -1,13 +1,5 @@
 name: snapshot-match
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers: [{ scheme: population_person_id, value: PER-00000001 }]
-  claims: [population-record-exists]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: benefits-eligibility
 input: { person_id: PER-00000001 }
 interactions:
   - expect: { method: GET, path: /snapshot }
@@ -15,9 +7,3 @@ interactions:
 expect:
   outcome: match
   outputs: { registration_status: active, residency_confirmed: true }
-  claims:
-    population-record-exists: true
-    population-registration-status: active
-    residency-confirmed: true
-    emergency-record-exists: true
-    emergency-status: redacted
diff --git a/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/integrations/person-snapshot/fixtures/no-match.yaml b/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/integrations/person-snapshot/fixtures/no-match.yaml
index 55a1e18a6..51c104130 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/integrations/person-snapshot/fixtures/no-match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/integrations/person-snapshot/fixtures/no-match.yaml
@@ -7,9 +7,3 @@ interactions:
 expect:
   outcome: no_match
   outputs: {}
-  claims:
-    population-record-exists: false
-    population-registration-status: null
-    residency-confirmed: null
-    emergency-record-exists: false
-    emergency-status: redacted
diff --git a/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/registry-stack.yaml
index 444941552..7559cb94b 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/registry-stack.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/registry-stack.yaml
@@ -22,43 +22,22 @@ services:
       required_principal_filters: [person_id]
       standards: { ogc_features: false, sp_dci: false }
   benefits-eligibility:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: benefits-eligibility
     legal_basis: public-service-delivery
     consent: not_required
-    access: { scopes: ["evidence:population:read"] }
     consultations:
       person:
         integration: person-snapshot
         input: { person_id: request.target.identifiers.population_person_id }
-    claims:
-      population-record-exists: { cel: person.matched, disclosure: predicate }
-      population-registration-status: { output: person.registration_status, disclosure: value }
-      residency-confirmed: { output: person.residency_confirmed, disclosure: predicate }
-    credential_profiles:
-      population-evidence:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/population-evidence/v1
-        validity: 10m
-        claims: [population-record-exists, population-registration-status, residency-confirmed]
   emergency-assistance:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: emergency-assistance
     legal_basis: vital-interests
     consent: not_required
-    access: { scopes: ["evidence:population:emergency"] }
     consultations:
       person:
         integration: person-snapshot
         input: { person_id: request.target.identifiers.population_person_id }
-    claims:
-      emergency-record-exists: { cel: person.matched, disclosure: predicate }
-      emergency-status: { output: person.registration_status, disclosure: redacted }
-    credential_profiles:
-      emergency-status:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/emergency-status/v1
-        validity: 5m
-        claims: [emergency-record-exists, emergency-status]
diff --git a/crates/registryctl/tests/fixtures/project-reports/registry.project.capability_inventory.v1.json b/crates/registryctl/tests/fixtures/project-reports/registry.project.capability_inventory.v1.json
index c37d58bfa..dc2396f28 100644
--- a/crates/registryctl/tests/fixtures/project-reports/registry.project.capability_inventory.v1.json
+++ b/crates/registryctl/tests/fixtures/project-reports/registry.project.capability_inventory.v1.json
@@ -13,7 +13,7 @@
       "installed_evidence": "embedded_compiler",
       "project_declaration": "declared",
       "environment_enablement": "enabled",
-      "used_by": {"services": 1, "consultations": 1, "claims": 0, "total": 2},
+      "used_by": {"services": 1, "consultations": 1, "total": 2},
       "disposition": "used"
     },
     {
@@ -26,7 +26,7 @@
       "installed_evidence": "embedded_compiler",
       "project_declaration": "declared",
       "environment_enablement": "enabled",
-      "used_by": {"services": 0, "consultations": 1, "claims": 1, "total": 2},
+      "used_by": {"services": 0, "consultations": 1, "total": 1},
       "disposition": "used"
     },
     {
@@ -39,7 +39,7 @@
       "installed_evidence": "embedded_compiler",
       "project_declaration": "declared",
       "environment_enablement": "not_enabled",
-      "used_by": {"services": 0, "consultations": 0, "claims": 0, "total": 0},
+      "used_by": {"services": 0, "consultations": 0, "total": 0},
       "disposition": "declared_inactive"
     },
     {
@@ -52,7 +52,7 @@
       "installed_evidence": "linked_crate",
       "project_declaration": "not_applicable",
       "environment_enablement": "not_applicable",
-      "used_by": {"services": 0, "consultations": 1, "claims": 1, "total": 2},
+      "used_by": {"services": 0, "consultations": 1, "total": 1},
       "disposition": "used"
     },
     {
@@ -65,7 +65,7 @@
       "installed_evidence": "linked_crate",
       "project_declaration": "not_applicable",
       "environment_enablement": "not_applicable",
-      "used_by": {"services": 0, "consultations": 1, "claims": 1, "total": 2},
+      "used_by": {"services": 0, "consultations": 1, "total": 1},
       "disposition": "used"
     },
     {
@@ -78,20 +78,7 @@
       "installed_evidence": "linked_crate",
       "project_declaration": "declared",
       "environment_enablement": "enabled",
-      "used_by": {"services": 1, "consultations": 2, "claims": 0, "total": 3},
-      "disposition": "used"
-    },
-    {
-      "capability": "registry_notary_product",
-      "kind": "product",
-      "owner": "registry_notary",
-      "maturity": "release_gated",
-      "supported_versions": ["registry_notary_config_v1"],
-      "installed_release": "compiled",
-      "installed_evidence": "linked_crate",
-      "project_declaration": "declared",
-      "environment_enablement": "enabled",
-      "used_by": {"services": 0, "consultations": 0, "claims": 1, "total": 1},
+      "used_by": {"services": 1, "consultations": 2, "total": 3},
       "disposition": "used"
     },
     {
@@ -104,20 +91,7 @@
       "installed_evidence": "linked_product_validator",
       "project_declaration": "not_applicable",
       "environment_enablement": "not_applicable",
-      "used_by": {"services": 0, "consultations": 0, "claims": 0, "total": 0},
-      "disposition": "installed_unused"
-    },
-    {
-      "capability": "registry_notary_validator",
-      "kind": "product_validator",
-      "owner": "registry_notary",
-      "maturity": "release_gated",
-      "supported_versions": ["registry_notary_config_v1"],
-      "installed_release": "compiled",
-      "installed_evidence": "linked_product_validator",
-      "project_declaration": "not_applicable",
-      "environment_enablement": "not_applicable",
-      "used_by": {"services": 0, "consultations": 0, "claims": 0, "total": 0},
+      "used_by": {"services": 0, "consultations": 0, "total": 0},
       "disposition": "installed_unused"
     },
     {
@@ -130,7 +104,7 @@
       "installed_evidence": "embedded_schema",
       "project_declaration": "not_applicable",
       "environment_enablement": "not_applicable",
-      "used_by": {"services": 0, "consultations": 0, "claims": 0, "total": 0},
+      "used_by": {"services": 0, "consultations": 0, "total": 0},
       "disposition": "installed_unused"
     },
     {
@@ -143,20 +117,7 @@
       "installed_evidence": "embedded_schema",
       "project_declaration": "not_applicable",
       "environment_enablement": "not_applicable",
-      "used_by": {"services": 0, "consultations": 0, "claims": 0, "total": 0},
-      "disposition": "installed_unused"
-    },
-    {
-      "capability": "registry_notary_config_schema",
-      "kind": "schema",
-      "owner": "registry_notary",
-      "maturity": "release_gated",
-      "supported_versions": ["registry_notary_config_v1"],
-      "installed_release": "compiled",
-      "installed_evidence": "embedded_schema",
-      "project_declaration": "not_applicable",
-      "environment_enablement": "not_applicable",
-      "used_by": {"services": 0, "consultations": 0, "claims": 0, "total": 0},
+      "used_by": {"services": 0, "consultations": 0, "total": 0},
       "disposition": "installed_unused"
     }
   ],
@@ -166,15 +127,11 @@
     {"component": "snapshot_materialization_worker", "kind": "worker", "owner": "registry_relay", "state": "missing", "evidence": "explicitly_missing", "required_by": ["source_snapshot"]},
     {"component": "rhai_xw_protocol_helper", "kind": "protocol_helper", "owner": "registry_relay", "state": "available", "evidence": "linked_crate", "required_by": ["source_script", "rhai_abi"]},
     {"component": "registry_relay_product", "kind": "product", "owner": "registry_relay", "state": "available", "evidence": "linked_crate", "required_by": ["source_http", "source_script", "source_snapshot", "registry_relay_product"]},
-    {"component": "registry_notary_product", "kind": "product", "owner": "registry_notary", "state": "available", "evidence": "linked_crate", "required_by": ["registry_notary_product"]},
     {"component": "registry_relay_validator", "kind": "product_validator", "owner": "registry_relay", "state": "available", "evidence": "linked_product_validator", "required_by": ["registry_relay_product"]},
-    {"component": "registry_notary_validator", "kind": "product_validator", "owner": "registry_notary", "state": "available", "evidence": "linked_product_validator", "required_by": ["registry_notary_product"]},
     {"component": "project_authoring_schema", "kind": "schema", "owner": "registryctl", "state": "available", "evidence": "embedded_schema", "required_by": ["source_http", "source_script", "source_snapshot"]},
     {"component": "registry_relay_config_schema", "kind": "schema", "owner": "registry_relay", "state": "available", "evidence": "embedded_schema", "required_by": ["registry_relay_product"]},
-    {"component": "registry_notary_config_schema", "kind": "schema", "owner": "registry_notary", "state": "available", "evidence": "embedded_schema", "required_by": ["registry_notary_product"]},
     {"component": "registryctl_distribution", "kind": "distribution", "owner": "release_engineering", "state": "available", "evidence": "release_metadata", "required_by": ["source_http", "source_script", "source_snapshot", "project_authoring_schemas"]},
-    {"component": "registry_relay_image", "kind": "image", "owner": "release_engineering", "state": "not_evaluated", "evidence": "no_evidence", "required_by": ["registry_relay_product"]},
-    {"component": "registry_notary_image", "kind": "image", "owner": "release_engineering", "state": "not_evaluated", "evidence": "no_evidence", "required_by": ["registry_notary_product"]}
+    {"component": "registry_relay_image", "kind": "image", "owner": "release_engineering", "state": "not_evaluated", "evidence": "no_evidence", "required_by": ["registry_relay_product"]}
   ],
   "missing_support": [
     {"component": "snapshot_materialization_worker", "kind": "worker", "state": "missing", "required_by": ["source_snapshot"]}
diff --git a/crates/registryctl/tests/fixtures/project-reports/registry.project.fixture_coverage.no-target.v1.json b/crates/registryctl/tests/fixtures/project-reports/registry.project.fixture_coverage.no-target.v1.json
index 728da2c70..976ef25d5 100644
--- a/crates/registryctl/tests/fixtures/project-reports/registry.project.fixture_coverage.no-target.v1.json
+++ b/crates/registryctl/tests/fixtures/project-reports/registry.project.fixture_coverage.no-target.v1.json
@@ -5,7 +5,6 @@
   "evidence_scope": "offline_synthetic",
   "compatibility_claim": "none",
   "live_compatibility": "not_evaluated",
-  "governed_request_evidence": "per_consultation_authored_request_witness_evaluation",
   "targets": [],
   "summary": {
     "target_set_state": "no_targets",
diff --git a/crates/registryctl/tests/fixtures/project-reports/registry.project.fixture_coverage.v1.json b/crates/registryctl/tests/fixtures/project-reports/registry.project.fixture_coverage.v1.json
index c7698234d..78eb6b7d4 100644
--- a/crates/registryctl/tests/fixtures/project-reports/registry.project.fixture_coverage.v1.json
+++ b/crates/registryctl/tests/fixtures/project-reports/registry.project.fixture_coverage.v1.json
@@ -5,7 +5,6 @@
   "evidence_scope": "offline_synthetic",
   "compatibility_claim": "none",
   "live_compatibility": "not_evaluated",
-  "governed_request_evidence": "per_consultation_authored_request_witness_evaluation",
   "targets": [
     {
       "identity": {
@@ -16,29 +15,23 @@
         "source_operation_count": 1,
         "reviewed_not_applicable": [
           "subject_mismatch"
-        ],
-        "registry_backed_consultations": [
-          {
-            "service_id": "person-verification",
-            "consultation_id": "person_record"
-          }
         ]
       },
       "fixture_set_state": "fixture_bearing",
       "compiled_contract": {
         "kind": "compiled_contract",
         "id": "target/person-record/compiled-contract/v1",
-        "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8"
+        "digest": "sha256:9a0c69f212881f7793f7cac6aef779f2504c7b8d4e54a478b8139b73aa8c77f6"
       },
       "fixture_inventory": [
         {
           "evidence": {
             "kind": "authored_fixture",
             "id": "target/person-record/fixture/active-person",
-            "digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3"
+            "digest": "sha256:df873d90889c90ccc30132c5b911e555d1a9816ba409bc9cb37504a6466650b7"
           },
           "fixture_id": "active-person",
-          "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3",
+          "fixture_digest": "sha256:df873d90889c90ccc30132c5b911e555d1a9816ba409bc9cb37504a6466650b7",
           "expectation": {
             "kind": "outcome",
             "outcome": "match"
@@ -51,24 +44,9 @@
           "output_ids": [
             "active"
           ],
-          "claim_ids": [
-            "person-active",
-            "person-record-exists"
-          ],
           "exercised_status_mappings": [],
           "classification": "synthetic",
-          "pass_state": "passed",
-          "request_to_consultation_binding": {
-            "state": "passed",
-            "consultations": [
-              {
-                "service_id": "person-verification",
-                "consultation_id": "person_record"
-              }
-            ],
-            "actual_relay_consultations": 1,
-            "safe_error_code": null
-          }
+          "pass_state": "passed"
         },
         {
           "evidence": {
@@ -88,7 +66,6 @@
             "person_id"
           ],
           "output_ids": [],
-          "claim_ids": [],
           "exercised_status_mappings": [
             {
               "outcome": "ambiguous",
@@ -98,36 +75,26 @@
             }
           ],
           "classification": "synthetic",
-          "pass_state": "passed",
-          "request_to_consultation_binding": {
-            "state": "not_authored",
-            "consultations": [],
-            "actual_relay_consultations": null,
-            "safe_error_code": null
-          }
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "authored_fixture",
             "id": "target/person-record/fixture/no-person",
-            "digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5"
+            "digest": "sha256:415ac27bc7e212e2a92b46e51c9e7282bddd9722aeaf4530557061f10d89b33e"
           },
           "fixture_id": "no-person",
-          "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5",
+          "fixture_digest": "sha256:415ac27bc7e212e2a92b46e51c9e7282bddd9722aeaf4530557061f10d89b33e",
           "expectation": {
             "kind": "outcome",
             "outcome": "no_match"
           },
-          "semantic_null": true,
+          "semantic_null": false,
           "interaction_count": 1,
           "input_ids": [
             "person_id"
           ],
           "output_ids": [],
-          "claim_ids": [
-            "person-active",
-            "person-record-exists"
-          ],
           "exercised_status_mappings": [
             {
               "outcome": "no_match",
@@ -137,13 +104,7 @@
             }
           ],
           "classification": "synthetic",
-          "pass_state": "passed",
-          "request_to_consultation_binding": {
-            "state": "not_authored",
-            "consultations": [],
-            "actual_relay_consultations": null,
-            "safe_error_code": null
-          }
+          "pass_state": "passed"
         }
       ],
       "generated_cases": [
@@ -151,7 +112,7 @@
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/active-person/generated/request_authority/v1",
-            "digest": "sha256:691232c9fff919e9dd9f361be7b141a07cd9fc56a0864d40a9c5decf6719ed85"
+            "digest": "sha256:8c44e8e564c6cebafcf72f7c61e076d399592c64ee65c4ce0a95fe8eaeda08f4"
           },
           "recipe": {
             "id": "request_authority",
@@ -159,7 +120,7 @@
           },
           "source_fixture": {
             "fixture_id": "active-person",
-            "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3"
+            "fixture_digest": "sha256:df873d90889c90ccc30132c5b911e555d1a9816ba409bc9cb37504a6466650b7"
           },
           "applicability": {
             "state": "applicable"
@@ -167,14 +128,13 @@
           "mutation_target_class": "request_path_authority",
           "expected_safe_code": "fixture.request_mismatch",
           "actual_safe_code": "fixture.request_mismatch",
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/active-person/generated/request_order/v1",
-            "digest": "sha256:1b714bff4811578892f09bd3fe3fe79c634b2fed0c470984f25d373d679cce8c"
+            "digest": "sha256:012fee1fcd5caae106e4848043828ed670ffb03413b994fd94d6dcbe0bd5c8ab"
           },
           "recipe": {
             "id": "request_order",
@@ -182,7 +142,7 @@
           },
           "source_fixture": {
             "fixture_id": "active-person",
-            "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3"
+            "fixture_digest": "sha256:df873d90889c90ccc30132c5b911e555d1a9816ba409bc9cb37504a6466650b7"
           },
           "applicability": {
             "state": "not_applicable",
@@ -192,14 +152,13 @@
           "mutation_target_class": "request_interaction_order",
           "expected_safe_code": "fixture.request_mismatch",
           "actual_safe_code": null,
-          "pass_state": "not_executed",
-          "source_access_assertion": null
+          "pass_state": "not_executed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/active-person/generated/status_rejection/v1",
-            "digest": "sha256:365e50a447ad14ef0ad14689f569acc4f8c935e03fa85a6fe18f07f64666c451"
+            "digest": "sha256:83893efd85d32733666d7140c6ebc9cac40bb61890b14540c312338b0e9dcf13"
           },
           "recipe": {
             "id": "status_rejection",
@@ -207,7 +166,7 @@
           },
           "source_fixture": {
             "fixture_id": "active-person",
-            "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3"
+            "fixture_digest": "sha256:df873d90889c90ccc30132c5b911e555d1a9816ba409bc9cb37504a6466650b7"
           },
           "applicability": {
             "state": "applicable"
@@ -215,14 +174,13 @@
           "mutation_target_class": "source_status",
           "expected_safe_code": "source.status_rejected",
           "actual_safe_code": "source.status_rejected",
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/active-person/generated/malformed_decode/v1",
-            "digest": "sha256:00a9b0010878b27345c9ce26b7d2089c21312749ccedfaa98849d97ced748765"
+            "digest": "sha256:53963adf443166b4fd580d1b6020f98ebd3383a21f682d75c695ce4df82d3a5d"
           },
           "recipe": {
             "id": "malformed_decode",
@@ -230,7 +188,7 @@
           },
           "source_fixture": {
             "fixture_id": "active-person",
-            "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3"
+            "fixture_digest": "sha256:df873d90889c90ccc30132c5b911e555d1a9816ba409bc9cb37504a6466650b7"
           },
           "applicability": {
             "state": "applicable"
@@ -238,14 +196,13 @@
           "mutation_target_class": "response_body_decoding",
           "expected_safe_code": "source.response_malformed",
           "actual_safe_code": "source.response_malformed",
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/active-person/generated/byte_ceiling/v1",
-            "digest": "sha256:1111c0c5d0542692d8c3efe821e719ee1235654102af5a399ee1da2b4167691e"
+            "digest": "sha256:d93707b5e8aaea86d7e9fc014b649fdc1702f4281a36b6de15544827f4ed5448"
           },
           "recipe": {
             "id": "byte_ceiling",
@@ -253,7 +210,7 @@
           },
           "source_fixture": {
             "fixture_id": "active-person",
-            "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3"
+            "fixture_digest": "sha256:df873d90889c90ccc30132c5b911e555d1a9816ba409bc9cb37504a6466650b7"
           },
           "applicability": {
             "state": "applicable"
@@ -261,14 +218,13 @@
           "mutation_target_class": "declared_response_byte_count",
           "expected_safe_code": "source.response_too_large",
           "actual_safe_code": "source.response_too_large",
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/active-person/generated/timeout/v1",
-            "digest": "sha256:b491ba87e856a5f652fdef4077861a1cc2c95cca45029856eb72e28a6b0c06e1"
+            "digest": "sha256:74babb893caf18e9adb01c49998839f64f1388fc8f984b6836985c7380bcd307"
           },
           "recipe": {
             "id": "timeout",
@@ -276,7 +232,7 @@
           },
           "source_fixture": {
             "fixture_id": "active-person",
-            "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3"
+            "fixture_digest": "sha256:df873d90889c90ccc30132c5b911e555d1a9816ba409bc9cb37504a6466650b7"
           },
           "applicability": {
             "state": "applicable"
@@ -284,14 +240,13 @@
           "mutation_target_class": "source_deadline",
           "expected_safe_code": "source.deadline_exceeded",
           "actual_safe_code": "source.deadline_exceeded",
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/active-person/generated/protocol_verification/v1",
-            "digest": "sha256:891f622340293bffcd8ef3b6f46e45657b194b5b3be228f37054f57655f38b0c"
+            "digest": "sha256:9a6d0a087c11819145848b435aaa1e1c1304d23be9c97f1ea137824956d82a41"
           },
           "recipe": {
             "id": "protocol_verification",
@@ -299,7 +254,7 @@
           },
           "source_fixture": {
             "fixture_id": "active-person",
-            "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3"
+            "fixture_digest": "sha256:df873d90889c90ccc30132c5b911e555d1a9816ba409bc9cb37504a6466650b7"
           },
           "applicability": {
             "state": "not_applicable",
@@ -309,41 +264,13 @@
           "mutation_target_class": "protocol_response_envelope",
           "expected_safe_code": "source.response_malformed",
           "actual_safe_code": null,
-          "pass_state": "not_executed",
-          "source_access_assertion": null
-        },
-        {
-          "evidence": {
-            "kind": "generated_case",
-            "id": "target/person-record/fixture/active-person/generated/authorization_before_source/v1",
-            "digest": "sha256:2d5485575a39c37edec432a39f1d2ba08be39c45cc38e55c1dd1e4a75dccb74a"
-          },
-          "recipe": {
-            "id": "authorization_before_source",
-            "version": "v1"
-          },
-          "source_fixture": {
-            "fixture_id": "active-person",
-            "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3"
-          },
-          "applicability": {
-            "state": "applicable"
-          },
-          "mutation_target_class": "authorization_gate",
-          "expected_safe_code": "authorization.denied",
-          "actual_safe_code": "authorization.denied",
-          "pass_state": "passed",
-          "source_access_assertion": {
-            "expected_source_calls": "zero",
-            "actual_source_calls": 0,
-            "passed": true
-          }
+          "pass_state": "not_executed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/active-person/generated/output_minimization/v1",
-            "digest": "sha256:dc7c3bbc4489276a37f90f03591ce9cd3e568ad11d2244e1fcb2b3381463c8f0"
+            "digest": "sha256:d0d93d063b0f678c8e2047228ec2b279aa9cf34cc25b6c8f8efb96b2d03614e7"
           },
           "recipe": {
             "id": "output_minimization",
@@ -351,7 +278,7 @@
           },
           "source_fixture": {
             "fixture_id": "active-person",
-            "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3"
+            "fixture_digest": "sha256:df873d90889c90ccc30132c5b911e555d1a9816ba409bc9cb37504a6466650b7"
           },
           "applicability": {
             "state": "applicable"
@@ -359,14 +286,13 @@
           "mutation_target_class": "unselected_response_member",
           "expected_safe_code": null,
           "actual_safe_code": null,
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/ambiguous-person/generated/request_authority/v1",
-            "digest": "sha256:37104336a5fc0b48e66157167df95bd3be54a5c83ecb7a2fce1c4a62223974a7"
+            "digest": "sha256:6e5061bf9d74c931f852610aaf782a0f46f2d3d1c56a961c3d189f1aed6899dc"
           },
           "recipe": {
             "id": "request_authority",
@@ -382,14 +308,13 @@
           "mutation_target_class": "request_path_authority",
           "expected_safe_code": "fixture.request_mismatch",
           "actual_safe_code": "fixture.request_mismatch",
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/ambiguous-person/generated/request_order/v1",
-            "digest": "sha256:db7f52d696a31e99b6fb7770b67af97658e13d433e8be67a4e17a7a803b8ae00"
+            "digest": "sha256:7888258af86a191e16be021b1187140bd98b377dc31b491c424990a662028376"
           },
           "recipe": {
             "id": "request_order",
@@ -407,14 +332,13 @@
           "mutation_target_class": "request_interaction_order",
           "expected_safe_code": "fixture.request_mismatch",
           "actual_safe_code": null,
-          "pass_state": "not_executed",
-          "source_access_assertion": null
+          "pass_state": "not_executed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/ambiguous-person/generated/status_rejection/v1",
-            "digest": "sha256:17c91679f0bcafb1d73a632361167111fe3adc821d7362b5f73d57cc8e646aec"
+            "digest": "sha256:ae9bfc729a67431d7c745cc48557dd2cebe20ac7107c36ffa6478cc05d1ca173"
           },
           "recipe": {
             "id": "status_rejection",
@@ -430,14 +354,13 @@
           "mutation_target_class": "source_status",
           "expected_safe_code": "source.status_rejected",
           "actual_safe_code": "source.status_rejected",
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/ambiguous-person/generated/malformed_decode/v1",
-            "digest": "sha256:16358fa165c4d86fb69c57c9fbb1d47db083b933ac7c449a47ac03a2b3a722a1"
+            "digest": "sha256:4cdd8cd238507c7fb322242bec787887814bcfe9d8313002fd86deae7d1d5331"
           },
           "recipe": {
             "id": "malformed_decode",
@@ -453,14 +376,13 @@
           "mutation_target_class": "response_body_decoding",
           "expected_safe_code": "source.response_malformed",
           "actual_safe_code": "source.response_malformed",
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/ambiguous-person/generated/byte_ceiling/v1",
-            "digest": "sha256:cdfe77bfe9fa27c36bc01f6e9635a1dd593990153c8010657f87fbf8760a36f2"
+            "digest": "sha256:19730f51c1b5e8fe1c23d3622e978eef5eaaf73f7f706a68d588ffcc1375142a"
           },
           "recipe": {
             "id": "byte_ceiling",
@@ -476,14 +398,13 @@
           "mutation_target_class": "declared_response_byte_count",
           "expected_safe_code": "source.response_too_large",
           "actual_safe_code": "source.response_too_large",
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/ambiguous-person/generated/timeout/v1",
-            "digest": "sha256:aa73c4fe1667260942dd69968f60973cd0a19dbdde38b991fafb89ef288fbc01"
+            "digest": "sha256:b695dd1f303ef4d1190a1b4b2d90fe818d2f54100b0df8a0674173e1ab725ae3"
           },
           "recipe": {
             "id": "timeout",
@@ -499,14 +420,13 @@
           "mutation_target_class": "source_deadline",
           "expected_safe_code": "source.deadline_exceeded",
           "actual_safe_code": "source.deadline_exceeded",
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/ambiguous-person/generated/protocol_verification/v1",
-            "digest": "sha256:5a891e5db4eaa349bc1f03f1548fa6759078b953629eea15e2821350d26cf945"
+            "digest": "sha256:28dc026d68b0c00774970c32ec8e9eddf7ec61f50fdd7e4c5d785d56a479df7c"
           },
           "recipe": {
             "id": "protocol_verification",
@@ -524,41 +444,13 @@
           "mutation_target_class": "protocol_response_envelope",
           "expected_safe_code": "source.response_malformed",
           "actual_safe_code": null,
-          "pass_state": "not_executed",
-          "source_access_assertion": null
-        },
-        {
-          "evidence": {
-            "kind": "generated_case",
-            "id": "target/person-record/fixture/ambiguous-person/generated/authorization_before_source/v1",
-            "digest": "sha256:9c96a3b1b8bb205e135572dee4d2f82d689482ef642eb83f498d8e14c115ad4f"
-          },
-          "recipe": {
-            "id": "authorization_before_source",
-            "version": "v1"
-          },
-          "source_fixture": {
-            "fixture_id": "ambiguous-person",
-            "fixture_digest": "sha256:6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232"
-          },
-          "applicability": {
-            "state": "applicable"
-          },
-          "mutation_target_class": "authorization_gate",
-          "expected_safe_code": "authorization.denied",
-          "actual_safe_code": "authorization.denied",
-          "pass_state": "passed",
-          "source_access_assertion": {
-            "expected_source_calls": "zero",
-            "actual_source_calls": 0,
-            "passed": true
-          }
+          "pass_state": "not_executed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/ambiguous-person/generated/output_minimization/v1",
-            "digest": "sha256:2b5e0499735227031d349d9c8ba7b2ccf070228e2ecbdfc97f1632b2352eb7c2"
+            "digest": "sha256:9f9aae65b7c31c99e000362684f513d66aeaa116a82fdab1ac8d2645c22a2086"
           },
           "recipe": {
             "id": "output_minimization",
@@ -574,14 +466,13 @@
           "mutation_target_class": "unselected_response_member",
           "expected_safe_code": null,
           "actual_safe_code": null,
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/no-person/generated/request_authority/v1",
-            "digest": "sha256:e7ae1794d2cca59818de6b3baf66439dca503d79b6f3196e887956f552ee4881"
+            "digest": "sha256:ba58ab903af746603b9550de6b854b9b87db6c6fc2d80a0cf15e71f1850429ab"
           },
           "recipe": {
             "id": "request_authority",
@@ -589,7 +480,7 @@
           },
           "source_fixture": {
             "fixture_id": "no-person",
-            "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5"
+            "fixture_digest": "sha256:415ac27bc7e212e2a92b46e51c9e7282bddd9722aeaf4530557061f10d89b33e"
           },
           "applicability": {
             "state": "applicable"
@@ -597,14 +488,13 @@
           "mutation_target_class": "request_path_authority",
           "expected_safe_code": "fixture.request_mismatch",
           "actual_safe_code": "fixture.request_mismatch",
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/no-person/generated/request_order/v1",
-            "digest": "sha256:547b5db1d96930b17a4d855f9c699cddac23120d9c44c86b9ea9d829f91fd315"
+            "digest": "sha256:26a118a2fbb97e5df78f16cc96e2389c4a75754f2fe5d47f3cd0745e055c16a8"
           },
           "recipe": {
             "id": "request_order",
@@ -612,7 +502,7 @@
           },
           "source_fixture": {
             "fixture_id": "no-person",
-            "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5"
+            "fixture_digest": "sha256:415ac27bc7e212e2a92b46e51c9e7282bddd9722aeaf4530557061f10d89b33e"
           },
           "applicability": {
             "state": "not_applicable",
@@ -622,14 +512,13 @@
           "mutation_target_class": "request_interaction_order",
           "expected_safe_code": "fixture.request_mismatch",
           "actual_safe_code": null,
-          "pass_state": "not_executed",
-          "source_access_assertion": null
+          "pass_state": "not_executed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/no-person/generated/status_rejection/v1",
-            "digest": "sha256:8bd1e632702cdf10d2841bce8527e2593858cdc0e46611a86f2199737e9829ae"
+            "digest": "sha256:4bb8bc4b23e22f4f95ae88dbb093181b1313deac6d6fab40fac4203035e8c200"
           },
           "recipe": {
             "id": "status_rejection",
@@ -637,7 +526,7 @@
           },
           "source_fixture": {
             "fixture_id": "no-person",
-            "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5"
+            "fixture_digest": "sha256:415ac27bc7e212e2a92b46e51c9e7282bddd9722aeaf4530557061f10d89b33e"
           },
           "applicability": {
             "state": "applicable"
@@ -645,14 +534,13 @@
           "mutation_target_class": "source_status",
           "expected_safe_code": "source.status_rejected",
           "actual_safe_code": "source.status_rejected",
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/no-person/generated/malformed_decode/v1",
-            "digest": "sha256:560c723752d29a94f56203a1593bad292684cc7bde7420185da4191c0a400c26"
+            "digest": "sha256:f665f20904c17eec0b90a5064b2422c9ddc714ec19751c712bb5977711ca3a64"
           },
           "recipe": {
             "id": "malformed_decode",
@@ -660,7 +548,7 @@
           },
           "source_fixture": {
             "fixture_id": "no-person",
-            "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5"
+            "fixture_digest": "sha256:415ac27bc7e212e2a92b46e51c9e7282bddd9722aeaf4530557061f10d89b33e"
           },
           "applicability": {
             "state": "applicable"
@@ -668,14 +556,13 @@
           "mutation_target_class": "response_body_decoding",
           "expected_safe_code": "source.response_malformed",
           "actual_safe_code": "source.response_malformed",
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/no-person/generated/byte_ceiling/v1",
-            "digest": "sha256:9413c3591793f33e81592d852cea1e4e5b52407457d642f95b6b8d9366ac7510"
+            "digest": "sha256:eaceee28ed492dc7126feccac3e726e59bd4035391081b610c21cf69f39859a1"
           },
           "recipe": {
             "id": "byte_ceiling",
@@ -683,7 +570,7 @@
           },
           "source_fixture": {
             "fixture_id": "no-person",
-            "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5"
+            "fixture_digest": "sha256:415ac27bc7e212e2a92b46e51c9e7282bddd9722aeaf4530557061f10d89b33e"
           },
           "applicability": {
             "state": "applicable"
@@ -691,14 +578,13 @@
           "mutation_target_class": "declared_response_byte_count",
           "expected_safe_code": "source.response_too_large",
           "actual_safe_code": "source.response_too_large",
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/no-person/generated/timeout/v1",
-            "digest": "sha256:43b0454a34a0c5cdce6d6003d609004047ecfa7308fce2fcdfcb2b1a98fa8516"
+            "digest": "sha256:6461781fc86e21b82b1c31db604038b1740e7069be14b2bc9d1bd32c778c503e"
           },
           "recipe": {
             "id": "timeout",
@@ -706,7 +592,7 @@
           },
           "source_fixture": {
             "fixture_id": "no-person",
-            "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5"
+            "fixture_digest": "sha256:415ac27bc7e212e2a92b46e51c9e7282bddd9722aeaf4530557061f10d89b33e"
           },
           "applicability": {
             "state": "applicable"
@@ -714,14 +600,13 @@
           "mutation_target_class": "source_deadline",
           "expected_safe_code": "source.deadline_exceeded",
           "actual_safe_code": "source.deadline_exceeded",
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/no-person/generated/protocol_verification/v1",
-            "digest": "sha256:023a5c16d404902ae161f2d76688c74841afc120790831ccb6f6ec2e9c6f0a13"
+            "digest": "sha256:630e9188053f6cd0a735effd8e93088bf3614486c2cf5656bce8a40de3d3f875"
           },
           "recipe": {
             "id": "protocol_verification",
@@ -729,7 +614,7 @@
           },
           "source_fixture": {
             "fixture_id": "no-person",
-            "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5"
+            "fixture_digest": "sha256:415ac27bc7e212e2a92b46e51c9e7282bddd9722aeaf4530557061f10d89b33e"
           },
           "applicability": {
             "state": "not_applicable",
@@ -739,41 +624,13 @@
           "mutation_target_class": "protocol_response_envelope",
           "expected_safe_code": "source.response_malformed",
           "actual_safe_code": null,
-          "pass_state": "not_executed",
-          "source_access_assertion": null
-        },
-        {
-          "evidence": {
-            "kind": "generated_case",
-            "id": "target/person-record/fixture/no-person/generated/authorization_before_source/v1",
-            "digest": "sha256:32f15ede7285f1271d842c7d9a1cd1e9e5906fb0c5a16d1173a49849b117737e"
-          },
-          "recipe": {
-            "id": "authorization_before_source",
-            "version": "v1"
-          },
-          "source_fixture": {
-            "fixture_id": "no-person",
-            "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5"
-          },
-          "applicability": {
-            "state": "applicable"
-          },
-          "mutation_target_class": "authorization_gate",
-          "expected_safe_code": "authorization.denied",
-          "actual_safe_code": "authorization.denied",
-          "pass_state": "passed",
-          "source_access_assertion": {
-            "expected_source_calls": "zero",
-            "actual_source_calls": 0,
-            "passed": true
-          }
+          "pass_state": "not_executed"
         },
         {
           "evidence": {
             "kind": "generated_case",
             "id": "target/person-record/fixture/no-person/generated/output_minimization/v1",
-            "digest": "sha256:ba70efd09852298f5635cf140ecc7ea8ea077b54c83620a57d486ab2f0b2a19f"
+            "digest": "sha256:72b3b2e274b054ede9e4432b49c84b595f107bdce1b323d678956574e39ddd52"
           },
           "recipe": {
             "id": "output_minimization",
@@ -781,7 +638,7 @@
           },
           "source_fixture": {
             "fixture_id": "no-person",
-            "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5"
+            "fixture_digest": "sha256:415ac27bc7e212e2a92b46e51c9e7282bddd9722aeaf4530557061f10d89b33e"
           },
           "applicability": {
             "state": "applicable"
@@ -789,8 +646,7 @@
           "mutation_target_class": "unselected_response_member",
           "expected_safe_code": null,
           "actual_safe_code": null,
-          "pass_state": "passed",
-          "source_access_assertion": null
+          "pass_state": "passed"
         }
       ],
       "platform_cases": [],
@@ -801,14 +657,6 @@
         "output_ids": [
           "active"
         ],
-        "claim_ids": [
-          "person-active",
-          "person-record-exists"
-        ],
-        "disclosure_modes": [
-          "predicate",
-          "value"
-        ],
         "status_mappings": [
           {
             "outcome": "ambiguous",
@@ -841,11 +689,6 @@
         "output_ids": [
           "active"
         ],
-        "claim_ids": [
-          "person-active",
-          "person-record-exists"
-        ],
-        "disclosure_modes": [],
         "status_mappings": [
           {
             "outcome": "ambiguous",
@@ -876,7 +719,7 @@
             {
               "kind": "authored_fixture",
               "id": "target/person-record/fixture/active-person",
-              "digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3"
+              "digest": "sha256:df873d90889c90ccc30132c5b911e555d1a9816ba409bc9cb37504a6466650b7"
             }
           ]
         },
@@ -887,7 +730,7 @@
             {
               "kind": "authored_fixture",
               "id": "target/person-record/fixture/no-person",
-              "digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5"
+              "digest": "sha256:415ac27bc7e212e2a92b46e51c9e7282bddd9722aeaf4530557061f10d89b33e"
             }
           ]
         },
@@ -910,24 +753,13 @@
             {
               "kind": "compiled_contract",
               "id": "target/person-record/compiled-contract/v1",
-              "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8"
-            }
-          ]
-        },
-        {
-          "state": "covered",
-          "requirement": "semantic_null",
-          "evidence": [
-            {
-              "kind": "authored_fixture",
-              "id": "target/person-record/fixture/no-person",
-              "digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5"
+              "digest": "sha256:9a0c69f212881f7793f7cac6aef779f2504c7b8d4e54a478b8139b73aa8c77f6"
             }
           ]
         },
         {
           "state": "missing",
-          "requirement": "authorization_denial",
+          "requirement": "semantic_null",
           "reason": "required_evidence_missing",
           "evidence": []
         },
@@ -944,28 +776,17 @@
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/active-person/generated/request_authority/v1",
-              "digest": "sha256:691232c9fff919e9dd9f361be7b141a07cd9fc56a0864d40a9c5decf6719ed85"
+              "digest": "sha256:8c44e8e564c6cebafcf72f7c61e076d399592c64ee65c4ce0a95fe8eaeda08f4"
             },
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/ambiguous-person/generated/request_authority/v1",
-              "digest": "sha256:37104336a5fc0b48e66157167df95bd3be54a5c83ecb7a2fce1c4a62223974a7"
+              "digest": "sha256:6e5061bf9d74c931f852610aaf782a0f46f2d3d1c56a961c3d189f1aed6899dc"
             },
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/no-person/generated/request_authority/v1",
-              "digest": "sha256:e7ae1794d2cca59818de6b3baf66439dca503d79b6f3196e887956f552ee4881"
-            }
-          ]
-        },
-        {
-          "state": "covered",
-          "requirement": "request_to_consultation_binding",
-          "evidence": [
-            {
-              "kind": "authored_fixture",
-              "id": "target/person-record/fixture/active-person",
-              "digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3"
+              "digest": "sha256:ba58ab903af746603b9550de6b854b9b87db6c6fc2d80a0cf15e71f1850429ab"
             }
           ]
         },
@@ -976,7 +797,7 @@
             {
               "kind": "authored_fixture",
               "id": "target/person-record/fixture/active-person",
-              "digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3"
+              "digest": "sha256:df873d90889c90ccc30132c5b911e555d1a9816ba409bc9cb37504a6466650b7"
             },
             {
               "kind": "authored_fixture",
@@ -986,7 +807,7 @@
             {
               "kind": "authored_fixture",
               "id": "target/person-record/fixture/no-person",
-              "digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5"
+              "digest": "sha256:415ac27bc7e212e2a92b46e51c9e7282bddd9722aeaf4530557061f10d89b33e"
             }
           ]
         },
@@ -998,7 +819,7 @@
             {
               "kind": "compiled_contract",
               "id": "target/person-record/compiled-contract/v1",
-              "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8"
+              "digest": "sha256:9a0c69f212881f7793f7cac6aef779f2504c7b8d4e54a478b8139b73aa8c77f6"
             }
           ]
         },
@@ -1009,43 +830,10 @@
             {
               "kind": "authored_fixture",
               "id": "target/person-record/fixture/active-person",
-              "digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3"
+              "digest": "sha256:df873d90889c90ccc30132c5b911e555d1a9816ba409bc9cb37504a6466650b7"
             }
           ]
         },
-        {
-          "state": "covered",
-          "requirement": "claims",
-          "evidence": [
-            {
-              "kind": "authored_fixture",
-              "id": "target/person-record/fixture/active-person",
-              "digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3"
-            },
-            {
-              "kind": "authored_fixture",
-              "id": "target/person-record/fixture/no-person",
-              "digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5"
-            }
-          ]
-        },
-        {
-          "state": "covered",
-          "requirement": "declared_disclosure_modes",
-          "evidence": [
-            {
-              "kind": "compiled_contract",
-              "id": "target/person-record/compiled-contract/v1",
-              "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8"
-            }
-          ]
-        },
-        {
-          "state": "missing",
-          "requirement": "exercised_disclosure_modes",
-          "reason": "runtime_dimension_not_observed",
-          "evidence": []
-        },
         {
           "state": "not_applicable",
           "requirement": "script_branches",
@@ -1054,7 +842,7 @@
             {
               "kind": "compiled_contract",
               "id": "target/person-record/compiled-contract/v1",
-              "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8"
+              "digest": "sha256:9a0c69f212881f7793f7cac6aef779f2504c7b8d4e54a478b8139b73aa8c77f6"
             }
           ]
         },
@@ -1066,7 +854,7 @@
             {
               "kind": "compiled_contract",
               "id": "target/person-record/compiled-contract/v1",
-              "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8"
+              "digest": "sha256:9a0c69f212881f7793f7cac6aef779f2504c7b8d4e54a478b8139b73aa8c77f6"
             }
           ]
         },
@@ -1082,7 +870,7 @@
             {
               "kind": "authored_fixture",
               "id": "target/person-record/fixture/no-person",
-              "digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5"
+              "digest": "sha256:415ac27bc7e212e2a92b46e51c9e7282bddd9722aeaf4530557061f10d89b33e"
             }
           ]
         },
@@ -1094,7 +882,7 @@
             {
               "kind": "compiled_contract",
               "id": "target/person-record/compiled-contract/v1",
-              "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8"
+              "digest": "sha256:9a0c69f212881f7793f7cac6aef779f2504c7b8d4e54a478b8139b73aa8c77f6"
             }
           ]
         },
@@ -1106,28 +894,7 @@
             {
               "kind": "compiled_contract",
               "id": "target/person-record/compiled-contract/v1",
-              "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8"
-            }
-          ]
-        },
-        {
-          "state": "covered",
-          "requirement": "authorization_before_source",
-          "evidence": [
-            {
-              "kind": "generated_case",
-              "id": "target/person-record/fixture/active-person/generated/authorization_before_source/v1",
-              "digest": "sha256:2d5485575a39c37edec432a39f1d2ba08be39c45cc38e55c1dd1e4a75dccb74a"
-            },
-            {
-              "kind": "generated_case",
-              "id": "target/person-record/fixture/ambiguous-person/generated/authorization_before_source/v1",
-              "digest": "sha256:9c96a3b1b8bb205e135572dee4d2f82d689482ef642eb83f498d8e14c115ad4f"
-            },
-            {
-              "kind": "generated_case",
-              "id": "target/person-record/fixture/no-person/generated/authorization_before_source/v1",
-              "digest": "sha256:32f15ede7285f1271d842c7d9a1cd1e9e5906fb0c5a16d1173a49849b117737e"
+              "digest": "sha256:9a0c69f212881f7793f7cac6aef779f2504c7b8d4e54a478b8139b73aa8c77f6"
             }
           ]
         },
@@ -1138,17 +905,17 @@
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/active-person/generated/malformed_decode/v1",
-              "digest": "sha256:00a9b0010878b27345c9ce26b7d2089c21312749ccedfaa98849d97ced748765"
+              "digest": "sha256:53963adf443166b4fd580d1b6020f98ebd3383a21f682d75c695ce4df82d3a5d"
             },
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/ambiguous-person/generated/malformed_decode/v1",
-              "digest": "sha256:16358fa165c4d86fb69c57c9fbb1d47db083b933ac7c449a47ac03a2b3a722a1"
+              "digest": "sha256:4cdd8cd238507c7fb322242bec787887814bcfe9d8313002fd86deae7d1d5331"
             },
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/no-person/generated/malformed_decode/v1",
-              "digest": "sha256:560c723752d29a94f56203a1593bad292684cc7bde7420185da4191c0a400c26"
+              "digest": "sha256:f665f20904c17eec0b90a5064b2422c9ddc714ec19751c712bb5977711ca3a64"
             }
           ]
         },
@@ -1159,7 +926,7 @@
             {
               "kind": "compiled_contract",
               "id": "target/person-record/compiled-contract/v1",
-              "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8"
+              "digest": "sha256:9a0c69f212881f7793f7cac6aef779f2504c7b8d4e54a478b8139b73aa8c77f6"
             }
           ]
         },
@@ -1171,7 +938,7 @@
             {
               "kind": "compiled_contract",
               "id": "target/person-record/compiled-contract/v1",
-              "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8"
+              "digest": "sha256:9a0c69f212881f7793f7cac6aef779f2504c7b8d4e54a478b8139b73aa8c77f6"
             }
           ]
         },
@@ -1182,17 +949,17 @@
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/active-person/generated/byte_ceiling/v1",
-              "digest": "sha256:1111c0c5d0542692d8c3efe821e719ee1235654102af5a399ee1da2b4167691e"
+              "digest": "sha256:d93707b5e8aaea86d7e9fc014b649fdc1702f4281a36b6de15544827f4ed5448"
             },
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/ambiguous-person/generated/byte_ceiling/v1",
-              "digest": "sha256:cdfe77bfe9fa27c36bc01f6e9635a1dd593990153c8010657f87fbf8760a36f2"
+              "digest": "sha256:19730f51c1b5e8fe1c23d3622e978eef5eaaf73f7f706a68d588ffcc1375142a"
             },
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/no-person/generated/byte_ceiling/v1",
-              "digest": "sha256:9413c3591793f33e81592d852cea1e4e5b52407457d642f95b6b8d9366ac7510"
+              "digest": "sha256:eaceee28ed492dc7126feccac3e726e59bd4035391081b610c21cf69f39859a1"
             }
           ]
         },
@@ -1204,7 +971,7 @@
             {
               "kind": "compiled_contract",
               "id": "target/person-record/compiled-contract/v1",
-              "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8"
+              "digest": "sha256:9a0c69f212881f7793f7cac6aef779f2504c7b8d4e54a478b8139b73aa8c77f6"
             }
           ]
         },
@@ -1216,7 +983,7 @@
             {
               "kind": "compiled_contract",
               "id": "target/person-record/compiled-contract/v1",
-              "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8"
+              "digest": "sha256:9a0c69f212881f7793f7cac6aef779f2504c7b8d4e54a478b8139b73aa8c77f6"
             }
           ]
         },
@@ -1228,7 +995,7 @@
             {
               "kind": "compiled_contract",
               "id": "target/person-record/compiled-contract/v1",
-              "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8"
+              "digest": "sha256:9a0c69f212881f7793f7cac6aef779f2504c7b8d4e54a478b8139b73aa8c77f6"
             }
           ]
         },
@@ -1239,17 +1006,17 @@
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/active-person/generated/timeout/v1",
-              "digest": "sha256:b491ba87e856a5f652fdef4077861a1cc2c95cca45029856eb72e28a6b0c06e1"
+              "digest": "sha256:74babb893caf18e9adb01c49998839f64f1388fc8f984b6836985c7380bcd307"
             },
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/ambiguous-person/generated/timeout/v1",
-              "digest": "sha256:aa73c4fe1667260942dd69968f60973cd0a19dbdde38b991fafb89ef288fbc01"
+              "digest": "sha256:b695dd1f303ef4d1190a1b4b2d90fe818d2f54100b0df8a0674173e1ab725ae3"
             },
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/no-person/generated/timeout/v1",
-              "digest": "sha256:43b0454a34a0c5cdce6d6003d609004047ecfa7308fce2fcdfcb2b1a98fa8516"
+              "digest": "sha256:6461781fc86e21b82b1c31db604038b1740e7069be14b2bc9d1bd32c778c503e"
             }
           ]
         },
@@ -1261,22 +1028,22 @@
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/active-person/generated/timeout/v1",
-              "digest": "sha256:b491ba87e856a5f652fdef4077861a1cc2c95cca45029856eb72e28a6b0c06e1"
+              "digest": "sha256:74babb893caf18e9adb01c49998839f64f1388fc8f984b6836985c7380bcd307"
             },
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/ambiguous-person/generated/timeout/v1",
-              "digest": "sha256:aa73c4fe1667260942dd69968f60973cd0a19dbdde38b991fafb89ef288fbc01"
+              "digest": "sha256:b695dd1f303ef4d1190a1b4b2d90fe818d2f54100b0df8a0674173e1ab725ae3"
             },
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/no-person/generated/timeout/v1",
-              "digest": "sha256:43b0454a34a0c5cdce6d6003d609004047ecfa7308fce2fcdfcb2b1a98fa8516"
+              "digest": "sha256:6461781fc86e21b82b1c31db604038b1740e7069be14b2bc9d1bd32c778c503e"
             },
             {
               "kind": "compiled_contract",
               "id": "target/person-record/compiled-contract/v1",
-              "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8"
+              "digest": "sha256:9a0c69f212881f7793f7cac6aef779f2504c7b8d4e54a478b8139b73aa8c77f6"
             }
           ]
         },
@@ -1287,17 +1054,17 @@
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/active-person/generated/output_minimization/v1",
-              "digest": "sha256:dc7c3bbc4489276a37f90f03591ce9cd3e568ad11d2244e1fcb2b3381463c8f0"
+              "digest": "sha256:d0d93d063b0f678c8e2047228ec2b279aa9cf34cc25b6c8f8efb96b2d03614e7"
             },
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/ambiguous-person/generated/output_minimization/v1",
-              "digest": "sha256:2b5e0499735227031d349d9c8ba7b2ccf070228e2ecbdfc97f1632b2352eb7c2"
+              "digest": "sha256:9f9aae65b7c31c99e000362684f513d66aeaa116a82fdab1ac8d2645c22a2086"
             },
             {
               "kind": "generated_case",
               "id": "target/person-record/fixture/no-person/generated/output_minimization/v1",
-              "digest": "sha256:ba70efd09852298f5635cf140ecc7ea8ea077b54c83620a57d486ab2f0b2a19f"
+              "digest": "sha256:72b3b2e274b054ede9e4432b49c84b595f107bdce1b323d678956574e39ddd52"
             }
           ]
         },
@@ -1313,12 +1080,6 @@
           "reason": "comparison_input_absent",
           "evidence": []
         },
-        {
-          "state": "not_evaluated",
-          "requirement": "changed_claim_affected_fixtures",
-          "reason": "comparison_input_absent",
-          "evidence": []
-        },
         {
           "state": "not_evaluated",
           "requirement": "changed_source_contract_affected_fixtures",
@@ -1334,11 +1095,11 @@
     "fixture_bearing_target_count": 1,
     "fixtureless_target_count": 0,
     "requirements": {
-      "covered": 17,
-      "missing": 7,
+      "covered": 12,
+      "missing": 6,
       "not_applicable": 7,
-      "not_evaluated": 4,
-      "total": 35
+      "not_evaluated": 3,
+      "total": 28
     }
   }
 }
diff --git a/crates/registryctl/tests/fixtures/project-reports/registryctl.fixture_error_reference.v1.json b/crates/registryctl/tests/fixtures/project-reports/registryctl.fixture_error_reference.v1.json
index 8b1349174..58b7f1c7d 100644
--- a/crates/registryctl/tests/fixtures/project-reports/registryctl.fixture_error_reference.v1.json
+++ b/crates/registryctl/tests/fixtures/project-reports/registryctl.fixture_error_reference.v1.json
@@ -1,24 +1,6 @@
 {
   "schema_version": "registryctl.fixture_error_reference.v1",
   "entries": [
-    {
-      "family": "fixture_execution",
-      "code": "authorization.denied",
-      "owner": "registryctl",
-      "product": "registryctl_relay_offline_harness",
-      "phase": "offline_execution",
-      "safe_meaning": "Authorization denied fixture execution before source access.",
-      "rule": "authorization_before_source",
-      "safe_remediation": "Align the fixture identity and authorization expectation with the compiled policy.",
-      "field_address_pattern": null,
-      "evidence_scope": "offline synthetic fixture execution",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--authorization.denied",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility."
-    },
     {
       "family": "fixture_execution",
       "code": "failure.subject_mismatch",
diff --git a/crates/registryctl/tests/fixtures/project-reports/registryctl.operator_error_reference.v1.json b/crates/registryctl/tests/fixtures/project-reports/registryctl.operator_error_reference.v1.json
index d8750d557..63a8af07b 100644
--- a/crates/registryctl/tests/fixtures/project-reports/registryctl.operator_error_reference.v1.json
+++ b/crates/registryctl/tests/fixtures/project-reports/registryctl.operator_error_reference.v1.json
@@ -73,330 +73,6 @@
       "stability": "pre1_stable_code",
       "evidence_limitation": "The category does not disclose parser messages, local paths, or supplied values."
     },
-    {
-      "family": "notary_activation",
-      "code": "notary.cel.worker_unavailable",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary CEL worker is unavailable",
-      "rule": "Every configured CEL worker must complete the bounded product protocol probe before listeners serve",
-      "safe_remediation": "verify that the adjacent CEL worker artifact is present and executable, confirm the supported platform and configured resource ceilings, then retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "CEL worker packaging, protocol responsiveness, supported platform, and bounded startup capacity",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--cel-worker-unavailable",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.configuration.invalid",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "configuration_activation",
-      "safe_meaning": "Registry Notary runtime configuration is invalid",
-      "rule": "Runtime activation requires valid product configuration, supported features, and resolvable secret and provider bindings",
-      "safe_remediation": "run registry-notary doctor, correct the reviewed configuration or binding, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "Notary configuration, provider bindings, and compiled feature support",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--configuration-invalid",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.deployment.gate_failed",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "deployment_activation",
-      "safe_meaning": "Registry Notary deployment gates refused startup",
-      "rule": "Every startup-failing deployment gate must pass before activation",
-      "safe_remediation": "run registry-notary doctor for the selected deployment profile and resolve its startup-failing findings",
-      "field_address_pattern": null,
-      "evidence_scope": "selected deployment profile and startup-failing gate results",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--deployment-gate-failed",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.activation_failed",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay consultation activation failed",
-      "rule": "Registry-backed claims require the reviewed Relay consultation client to activate before Notary serves",
-      "safe_remediation": "check the Notary configuration and startup environment",
-      "field_address_pattern": null,
-      "evidence_scope": "Notary Relay consultation client activation lifecycle",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-activation-failed",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.configuration_invalid",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay consultation configuration is invalid",
-      "rule": "The Relay destination, activation plan, and activation lifecycle must form one valid reviewed configuration",
-      "safe_remediation": "check the evidence.relay connection and Registry-backed consultation configuration",
-      "field_address_pattern": null,
-      "evidence_scope": "Relay destination, activation plan, and consultation configuration",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-configuration-invalid",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.credential_unavailable",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay workload credential is unavailable",
-      "rule": "A current non-empty workload credential must be available before a live Relay consultation",
-      "safe_remediation": "mount a current readable workload JWT at evidence.relay.token_file",
-      "field_address_pattern": null,
-      "evidence_scope": "configured Relay workload credential availability",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-credential-unavailable",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.credentials_rejected",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay rejected the configured workload credential",
-      "rule": "Relay must accept the configured Notary workload binding, scope, and validity window",
-      "safe_remediation": "rotate the workload JWT and verify that Relay recognizes its workload binding, required scope, and validity window",
-      "field_address_pattern": null,
-      "evidence_scope": "Relay workload binding, scope, and validity acceptance",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-credentials-rejected",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.profile_mismatch",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay consultation profile does not match the configured contract pin",
-      "rule": "The active Relay profile must match the reviewed Notary consultation contract pin",
-      "safe_remediation": "reconcile the Notary profile id and contract hash with the reviewed Relay consultation contract",
-      "field_address_pattern": null,
-      "evidence_scope": "reviewed Notary profile pin and active Relay consultation contract",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-profile-mismatch",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.profile_not_found",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay consultation profile was not found",
-      "rule": "Every Registry-backed Notary consultation must resolve to an active Relay profile",
-      "safe_remediation": "deploy the configured Relay profile id, then retry the live check",
-      "field_address_pattern": null,
-      "evidence_scope": "configured consultation profile resolution in Relay",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-profile-not-found",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.unavailable",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay consultation service is unavailable",
-      "rule": "The reviewed Relay destination must be reachable through the configured transport policy",
-      "safe_remediation": "check Relay reachability, TLS, destination policy, and service health",
-      "field_address_pattern": null,
-      "evidence_scope": "reviewed Relay destination, transport policy, and service availability",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-unavailable",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.runtime.activation_failed",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary runtime activation failed",
-      "rule": "Audit, state, sensitive-state, and other runtime dependencies must activate successfully before listeners serve",
-      "safe_remediation": "restore the governed runtime dependency or integrity condition, then retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "governed audit, state, sensitive-state, and runtime dependencies",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--runtime-activation-failed",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.runtime.activation_required",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary runtime activation is required before serving",
-      "rule": "Routers may be built only after the governed audit and state activation lifecycle completes",
-      "safe_remediation": "run the compiled Registry Notary runtime activation step before building or serving routers",
-      "field_address_pattern": null,
-      "evidence_scope": "router assembly and governed audit and state activation lifecycle",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--runtime-activation-required",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.database_read_only",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL state database is read-only or recovering",
-      "rule": "Serving requires a writable PostgreSQL primary for correctness-state transactions",
-      "safe_remediation": "restore a writable PostgreSQL primary, run registry-notary state doctor, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL writeability and recovery posture",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-read-only",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.database_unavailable",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL state database is unavailable",
-      "rule": "Serving requires a reachable PostgreSQL service with an accepted TLS trust chain",
-      "safe_remediation": "check PostgreSQL reachability, TLS trust, and service health, then run registry-notary state doctor",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL transport, TLS trust, and service availability",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-unavailable",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.database_unsupported",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL server major is unsupported",
-      "rule": "Serving requires a PostgreSQL major covered by the Registry Notary compatibility contract",
-      "safe_remediation": "move the state database to a supported PostgreSQL major, run registry-notary state doctor, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL server-major compatibility",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-unsupported",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.durability_unsafe",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL durability settings are unsafe",
-      "rule": "Serving requires the documented PostgreSQL durability settings for correctness state",
-      "safe_remediation": "restore the required PostgreSQL durability settings, run registry-notary state doctor, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL durability posture",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-durability-unsafe",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.role_incompatible",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL runtime role contract is incompatible",
-      "rule": "Serving requires the documented restricted runtime role and its attested schema binding",
-      "safe_remediation": "restore the documented runtime grants and role binding, run registry-notary state doctor, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL runtime-role attributes, grants, and schema binding",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-role-incompatible",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.schema_incompatible",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL state schema contract is incompatible",
-      "rule": "Serving requires the exact product-owned schema, catalog, fingerprint, and privilege contract",
-      "safe_remediation": "restore or install the matching Registry Notary state schema, run registry-notary state doctor, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL state schema, catalog, fingerprint, and privilege contract",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-schema-incompatible",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
     {
       "family": "operator_preflight",
       "code": "registryctl.preflight.product_validator_not_checked",
diff --git a/crates/registryctl/tests/fixtures/project-reports/registryctl.project_command.v1.json b/crates/registryctl/tests/fixtures/project-reports/registryctl.project_command.v1.json
index 5d6bcc59a..5ea74674a 100644
--- a/crates/registryctl/tests/fixtures/project-reports/registryctl.project_command.v1.json
+++ b/crates/registryctl/tests/fixtures/project-reports/registryctl.project_command.v1.json
@@ -16,9 +16,6 @@
       "outputs": [
         "active"
       ],
-      "claims": [
-        "is_active"
-      ],
       "outcome": "matched",
       "source_access": false,
       "passed": true
diff --git a/crates/registryctl/tests/fixtures/project-reports/registryctl.project_preflight.v1.json b/crates/registryctl/tests/fixtures/project-reports/registryctl.project_preflight.v1.json
index 1b772ffb6..a078bcab8 100644
--- a/crates/registryctl/tests/fixtures/project-reports/registryctl.project_preflight.v1.json
+++ b/crates/registryctl/tests/fixtures/project-reports/registryctl.project_preflight.v1.json
@@ -75,11 +75,6 @@
       "product": "registry_relay",
       "capability": "configuration_validation",
       "state": "locally_available"
-    },
-    {
-      "product": "registry_notary",
-      "capability": "configuration_validation",
-      "state": "locally_available"
     }
   ],
   "secret_checks": [
@@ -114,11 +109,11 @@
       "state": "available"
     },
     {
-      "kind": "notary_to_relay_token",
+      "kind": "relay_state_root_certificate",
       "addresses": [
         {
           "file": "environments/production.yaml",
-          "pointer": "/notary_relay/token_file"
+          "pointer": "/relay_state/postgresql/root_certificate_path"
         }
       ],
       "generation": "not_declared",
diff --git a/crates/registryctl/tests/project_authoring.rs b/crates/registryctl/tests/project_authoring.rs
index 69b29b990..ba7d3c08c 100644
--- a/crates/registryctl/tests/project_authoring.rs
+++ b/crates/registryctl/tests/project_authoring.rs
@@ -5,17 +5,16 @@ use std::path::{Path, PathBuf};
 
 use registry_platform_config::ProductAcceptanceLaneV1;
 use registryctl::{
-    build_registry_project_with_baselines_and_context, build_registry_project_with_context,
-    check_registry_project_with_context, create_trust_anchor, init_registry_project,
-    inspect_project_capabilities, preflight_registry_project, render_project_authoring_diagnostics,
-    setup_registry_project_editor, sign_product_bundle,
+    build_registry_project_with_context, check_registry_project_with_context, create_trust_anchor,
+    init_registry_project, inspect_project_capabilities, preflight_registry_project,
+    render_project_authoring_diagnostics, setup_registry_project_editor, sign_product_bundle,
     test_registry_project_selected_with_context, test_registry_project_with_context,
     verify_config_bundle_cli, ClassifierSafeReportedValue, InitSource, ProductBundleSignOptions,
-    ProjectAuthoringDiagnostics, ProjectBuildBaselineSetOptions, ProjectBuildOptions,
-    ProjectCapabilityOptions, ProjectCheckOptions, ProjectEditorSetupOptions,
-    ProjectExecutionContext, ProjectExplanationReportV1, ProjectFieldAddress,
-    ProjectFieldExplanation, ProjectInitOptions, ProjectPreflightOptions, ProjectSchemaKind,
-    ProjectStarter, ProjectTestOptions, ProjectTestSelection, TrustAnchorCreateOptions,
+    ProjectAuthoringDiagnostics, ProjectBuildOptions, ProjectCapabilityOptions,
+    ProjectCheckOptions, ProjectEditorSetupOptions, ProjectExecutionContext,
+    ProjectExplanationReportV1, ProjectFieldAddress, ProjectFieldExplanation, ProjectInitOptions,
+    ProjectPreflightOptions, ProjectSchemaKind, ProjectStarter, ProjectTestOptions,
+    ProjectTestSelection, TrustAnchorCreateOptions,
 };
 use serde::Deserialize;
 use sha2::{Digest as _, Sha256};
@@ -309,103 +308,6 @@ fn assert_authoring_diagnostic(error: &anyhow::Error, code: &str) {
     );
 }
 
-#[test]
-fn project_check_aggregates_script_host_call_and_environment_diagnostics_safely() {
-    const ARGUMENT_MARKER: &str = "argument-marker-383";
-    const ENVIRONMENT_MARKER: &str = "environment-secret-marker-383";
-    const FIXTURE_MARKER: &str = "fixture-value-marker-383";
-    const RESPONSE_MARKER: &str = "source-response-marker-383";
-
-    let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = copy_project("dhis2-script", temporary.path());
-    let script_path = project.join("integrations/health-record/adapter.rhai");
-    std::fs::write(
-        &script_path,
-        format!(
-            "fn consult(ctx) {{\n    let response = source.gett(\"{ARGUMENT_MARKER}\");\n    result.no_match()\n}}\n"
-        ),
-    )
-    .expect("invalid Script writes");
-
-    let environment_path = project.join("environments/local.yaml");
-    let mut environment = read_yaml(&environment_path);
-    environment["integrations"]["health-record"]["source"]["credential"]["generation"] =
-        serde_norway::Value::Number(0.into());
-    environment["integrations"]["health-record"]["source"]["credential"]["username"]["secret"] =
-        serde_norway::Value::String(ENVIRONMENT_MARKER.to_string());
-    write_yaml(&environment_path, &environment);
-
-    let fixture_path = project.join("integrations/health-record/fixtures/match.yaml");
-    let mut fixture = read_yaml(&fixture_path);
-    fixture["variables"]["diagnostic_marker"] =
-        serde_norway::Value::String(FIXTURE_MARKER.to_string());
-    fixture["interactions"][0]["respond"]["body"]["diagnostic_marker"] =
-        serde_norway::Value::String(RESPONSE_MARKER.to_string());
-    write_yaml(&fixture_path, &fixture);
-
-    let report = authoring_diagnostics(&project);
-    assert_eq!(report.status, "invalid");
-    assert_eq!(report.diagnostics.len(), 2, "{report:#?}");
-    let script = report
-        .diagnostics
-        .iter()
-        .find(|diagnostic| diagnostic.code == "registryctl.authoring.script.unknown_function")
-        .expect("one Script diagnostic");
-    assert_eq!(script.file, "integrations/health-record/adapter.rhai");
-    assert_eq!(script.field, Some("capability.script.file"));
-    assert_eq!((script.line, script.column), (Some(2), Some(20)));
-    assert_eq!(
-        script.suggestion,
-        Some("source.get(target: string) -> response")
-    );
-    assert_eq!(
-        report
-            .diagnostics
-            .iter()
-            .filter(|diagnostic| diagnostic.code.starts_with("registryctl.authoring.script."))
-            .count(),
-        1
-    );
-    assert_eq!(
-        report
-            .diagnostics
-            .iter()
-            .filter(|diagnostic| diagnostic.code == "registryctl.authoring.environment.invalid")
-            .count(),
-        1
-    );
-    assert!(!project.join(".registry-stack/build").exists());
-
-    let human = render_project_authoring_diagnostics(&report);
-    let json = serde_json::to_string_pretty(&report).expect("diagnostics serialize");
-    let debug = format!("{report:#?}");
-    assert_eq!(
-        human
-            .matches("registryctl.authoring.script.unknown_function")
-            .count(),
-        1,
-        "{human}"
-    );
-    for rendered in [&human, &json, &debug] {
-        for forbidden in [
-            ARGUMENT_MARKER,
-            ENVIRONMENT_MARKER,
-            FIXTURE_MARKER,
-            RESPONSE_MARKER,
-            "https://health-registry.invalid",
-            "HEALTH_REGISTRY_PASSWORD",
-            "Engine",
-            "EvalAltResult",
-            &project.display().to_string(),
-        ] {
-            assert!(
-                !rendered.contains(forbidden),
-                "leaked {forbidden}: {rendered}"
-            );
-        }
-    }
-}
-
 #[test]
 fn project_check_keeps_script_probe_stable_across_metadata_and_ignores_non_calls() {
     let temporary = tempfile::tempdir().expect("temporary directory");
@@ -543,10 +445,7 @@ fn project_check_orders_independent_fixture_errors_and_caps_deterministically()
         &second_project.join("integrations/eligibility/integration.yaml"),
         &["outputs"],
     );
-    reverse_yaml_mapping(
-        &second_project.join("registry-stack.yaml"),
-        &["services", "household-eligibility", "claims"],
-    );
+    reverse_yaml_mapping(&second_project.join("registry-stack.yaml"), &[]);
     let first = authoring_diagnostics(&first_project);
     let repeated = authoring_diagnostics(&first_project);
     let second = authoring_diagnostics(&second_project);
@@ -575,7 +474,14 @@ fn project_check_orders_independent_fixture_errors_and_caps_deterministically()
 fn project_check_collects_separate_integration_and_fixture_yaml_errors() {
     let temporary = tempfile::tempdir().expect("temporary directory");
     let project = copy_project("custom-system", temporary.path());
-    duplicate_project_integration(&project, "eligibility", "secondary");
+    let project_path = project.join("registry-stack.yaml");
+    let mut authored = read_yaml(&project_path);
+    authored["integrations"]["secondary"] =
+        serde_norway::from_str("file: integrations/secondary/integration.yaml")
+            .expect("secondary integration reference parses");
+    write_yaml(&project_path, &authored);
+    std::fs::create_dir_all(project.join("integrations/secondary"))
+        .expect("secondary integration directory creates");
     std::fs::write(
         project.join("integrations/secondary/integration.yaml"),
         "version: [\n",
@@ -1014,10 +920,7 @@ fn project_authoring_catalog_classifies_every_golden_and_only_five_starters() {
             journey.id
         );
         assert!(
-            matches!(
-                journey.topology.as_str(),
-                "combined" | "relay-only" | "notary-only"
-            ),
+            matches!(journey.topology.as_str(), "relay-only"),
             "{} topology",
             journey.id
         );
@@ -1058,44 +961,29 @@ fn project_authoring_catalog_classifies_every_golden_and_only_five_starters() {
         let services = project["services"]
             .as_mapping()
             .expect("catalog workspace services are a mapping");
-        let has_notary = services
-            .values()
-            .any(|service| service["kind"].as_str() == Some("evidence"));
         let has_relay = has_integrations
             || has_entities
             || services
                 .values()
                 .any(|service| service["kind"].as_str() == Some("records_api"));
-        let derived_topology = match (has_relay, has_notary) {
-            (true, true) => "combined",
-            (true, false) => "relay-only",
-            (false, true) => "notary-only",
-            (false, false) => panic!("{} has no product topology", journey.id),
-        };
+        assert!(has_relay, "{} has a Relay topology", journey.id);
+        let derived_topology = "relay-only";
         assert_eq!(
             journey.topology, derived_topology,
             "{} topology",
             journey.id
         );
-        if derived_topology == "combined" {
-            assert!(
-                journey.steps.contains(&"build".to_string()),
-                "{} combined governed build",
-                journey.id
-            );
-        } else {
+        assert!(
+            journey.steps.contains(&"build".to_string()),
+            "{} Relay topology has a governed build",
+            journey.id
+        );
+        if journey.classification == "maintained" {
             assert!(
-                !journey.steps.contains(&"build".to_string()),
-                "{} partial topology must not advertise a governed build",
+                journey.steps.contains(&"test".to_string()),
+                "{} maintained Relay topology keeps offline test",
                 journey.id
             );
-            if journey.classification == "maintained" {
-                assert!(
-                    journey.steps.contains(&"test".to_string()),
-                    "{} maintained partial topology keeps offline test",
-                    journey.id
-                );
-            }
         }
 
         let has_authored_fixtures = catalog_has_authored_fixtures(journey, &project);
@@ -1296,9 +1184,14 @@ fn every_cataloged_supported_project_authoring_command_is_automated() {
             })
             .unwrap_or_else(|error| panic!("{} offline test failed: {error:#}", journey.id));
             assert_eq!(report.status, "passed", "{} test", journey.id);
-            if journey.topology == "combined" {
-                assert!(!report.fixtures.is_empty(), "{} fixtures", journey.id);
-            }
+            let authored = read_yaml(&project.join("registry-stack.yaml"));
+            let has_authored_fixtures = catalog_has_authored_fixtures(&journey, &authored);
+            assert_eq!(
+                report.fixtures.is_empty(),
+                !has_authored_fixtures,
+                "{} fixture inventory",
+                journey.id
+            );
             assert!(
                 report.fixtures.iter().all(|fixture| fixture.passed),
                 "{} fixtures",
@@ -1317,21 +1210,6 @@ fn every_cataloged_supported_project_authoring_command_is_automated() {
         assert_eq!(check.status, "valid", "{} check", journey.id);
         assert!(check.explanation.is_some(), "{} explanation", journey.id);
 
-        if !journey.steps.contains(&"build".to_string()) {
-            let error = build_registry_project(&ProjectBuildOptions {
-                project_directory: project,
-                environment: journey.environment.clone(),
-                against: None,
-                anchor: None,
-            })
-            .expect_err("partial product topology must not publish a governed build");
-            let message = format!("{error:#}");
-            assert!(message.contains("project test"), "{message}");
-            assert!(message.contains("project check"), "{message}");
-            assert!(message.contains("before project build"), "{message}");
-            continue;
-        }
-
         let build = build_registry_project(&ProjectBuildOptions {
             project_directory: project.clone(),
             environment: journey.environment.clone(),
@@ -1341,45 +1219,23 @@ fn every_cataloged_supported_project_authoring_command_is_automated() {
         .unwrap_or_else(|error| panic!("{} build failed: {error:#}", journey.id));
         assert_eq!(build.status, "built", "{} build", journey.id);
         let output = resolve_build_output(&project, build.output.expect("catalog build output"));
-        let relay = output.join("private/relay-public");
-        let notary = output.join("private/notary");
-        match journey.topology.as_str() {
-            "relay-only" => {
-                assert!(relay.is_dir(), "{} Relay inputs", journey.id);
-                assert!(!notary.exists(), "{} Notary inputs", journey.id);
-            }
-            "notary-only" => {
-                assert!(notary.is_dir(), "{} Notary inputs", journey.id);
-                assert!(!relay.exists(), "{} Relay inputs", journey.id);
-            }
-            "combined" => {
-                assert!(relay.is_dir(), "{} Relay inputs", journey.id);
-                assert!(notary.is_dir(), "{} Notary inputs", journey.id);
-                let notary_config = read_yaml(&notary.join("config/notary.yaml"));
-                assert_eq!(
-                    notary_config["state"]["storage"].as_str(),
-                    Some("in_memory"),
-                    "{} Notary correctness state",
-                    journey.id
-                );
-                assert!(
-                    notary_config["evidence"]["relay"].is_mapping(),
-                    "{} compiler-pinned Relay consultation",
-                    journey.id
-                );
-                let rendered = serde_norway::to_string(&notary_config)
-                    .expect("generated Notary config serializes");
-                assert!(
-                    rendered.contains("contract_hash:"),
-                    "{} compiler-pinned consultation hash",
-                    journey.id
-                );
-                for forbidden in ["redis:", "direct_source:", "source_credential:"] {
-                    assert!(!rendered.contains(forbidden), "{} {forbidden}", journey.id);
-                }
-            }
-            _ => unreachable!("catalog topology is validated"),
-        }
+        assert!(
+            output.join("private/relay-public").is_dir(),
+            "{} public Relay inputs",
+            journey.id
+        );
+        let project_document = read_yaml(&project.join("registry-stack.yaml"));
+        let has_consultation_service = project_document["services"]
+            .as_mapping()
+            .expect("catalog project services are a mapping")
+            .values()
+            .any(|service| service["kind"].as_str() == Some("consultation_api"));
+        assert_eq!(
+            output.join("private/relay-consultation").is_dir(),
+            has_consultation_service,
+            "{} consultation Relay inputs follow the authored service topology",
+            journey.id
+        );
     }
 }
 
@@ -1430,31 +1286,16 @@ fn fhir_r4_coverage_active_passes_the_closed_bundle_matrix() {
     .expect("FHIR R4 Coverage-active golden passes");
     assert_eq!(report.status, "passed");
     assert!(
-        report.fixtures.len() >= 5,
-        "the five authored journeys and their derived security cases must execute"
+        report.fixtures.len() >= 7,
+        "the authored fixture matrix and derived Relay cases must execute"
     );
     assert!(report
         .fixtures
         .iter()
         .any(|fixture| fixture.fixture.ends_with("::derived/request_authority")));
-    assert!(report.fixtures.iter().any(|fixture| fixture
-        .fixture
-        .ends_with("::derived/authorization_before_source")));
     assert!(report.fixtures.iter().all(|fixture| fixture.passed));
 }
 
-#[test]
-fn approved_opencrvs_and_dhis2_claim_sets_execute_offline() {
-    for project in ["opencrvs", "opencrvs-country-variant", "dhis2-tracker"] {
-        let report = test_registry_project(&ProjectTestOptions {
-            project_directory: golden(project),
-            environment: None,
-        })
-        .unwrap_or_else(|error| panic!("{project} approved claims failed: {error:#}"));
-        assert!(report.fixtures.iter().all(|fixture| fixture.passed));
-    }
-}
-
 #[test]
 fn synthetic_opencrvs_events_api_executes_the_closed_offline_matrix() {
     let project = golden("opencrvs-events-api");
@@ -1508,7 +1349,6 @@ fn synthetic_opencrvs_events_api_executes_the_closed_offline_matrix() {
             .unwrap_or_else(|| panic!("missing {fixture_name}"));
         assert_eq!(fixture.expected_error.as_deref(), Some(safe_code));
         assert!(fixture.outputs.is_empty());
-        assert!(fixture.claims.is_empty());
         if fixture_name.starts_with("oauth-token-") {
             assert_eq!(
                 fixture.calls.len(),
@@ -1524,17 +1364,13 @@ fn synthetic_opencrvs_events_api_executes_the_closed_offline_matrix() {
         .find(|fixture| fixture.fixture.as_str() == "birth-event-match")
         .expect("exact-selector match fixture");
     assert_eq!(matched.outputs, ["event_type", "registered"]);
-    assert_eq!(
-        matched.claims,
-        ["birth-event-found", "birth-event-registered"]
-    );
     assert_eq!(matched.calls.len(), 2);
 
     for (recipe, safe_code) in [
         ("malformed_decode", Some("source.response_malformed")),
         ("byte_ceiling", Some("source.response_too_large")),
         ("timeout", Some("source.deadline_exceeded")),
-        ("authorization_before_source", Some("authorization.denied")),
+        ("request_authority", Some("fixture.request_mismatch")),
         ("output_minimization", None),
     ] {
         let fixture_id = format!("birth-event-match::derived/{recipe}");
@@ -1545,7 +1381,7 @@ fn synthetic_opencrvs_events_api_executes_the_closed_offline_matrix() {
             .unwrap_or_else(|| panic!("missing {fixture_id}"));
         assert_eq!(fixture.expected_error.as_deref(), safe_code);
         assert!(fixture.passed);
-        if recipe == "authorization_before_source" {
+        if recipe == "request_authority" {
             assert_eq!(fixture.source_access, Some(false));
             assert!(fixture.calls.is_empty());
         }
@@ -1644,160 +1480,10 @@ fn synthetic_opencrvs_events_api_executes_the_closed_offline_matrix() {
         service["consultations"]["event"]["input"]["tracking_id"].as_str(),
         Some("request.target.identifiers.opencrvs_tracking_id")
     );
-    for claim in ["birth-event-found", "birth-event-registered"] {
-        assert!(
-            service["claims"][claim]["cel"]
-                .as_str()
-                .expect("claim CEL is a string")
-                .contains("event."),
-            "{claim} must derive from the single Relay consultation"
-        );
-    }
-}
-
-#[test]
-fn dhis2_health_evidence_journey_preserves_distinct_results() {
-    let project = golden("dhis2-tracker");
-    let report = test_registry_project(&ProjectTestOptions {
-        project_directory: project.clone(),
-        environment: None,
-    })
-    .expect("DHIS2 health evidence journey passes offline");
-    assert_eq!(report.status, "passed");
-
-    let expected_outputs = [
-        "bcg_birth_dose_recorded",
-        "child_health_visit_recorded",
-        "child_program_active",
-        "date_of_birth",
-        "first_name",
-        "last_name",
-        "maternal_postnatal_active",
-        "measles_dose_recorded",
-        "opv_birth_dose_recorded",
-        "programme_code",
-        "reconciliation_reference",
-        "tb_program_active",
-    ]
-    .map(String::from);
-    let expected_claims = [
-        "bcg-birth-dose-recorded",
-        "child-age-band",
-        "child-health-visit-recorded",
-        "child-program-active",
-        "maternal-postnatal-care-active",
-        "measles-dose-recorded",
-        "opv-birth-dose-recorded",
-        "programme-code",
-        "reconciliation-reference",
-        "tb-program-active",
-        "tracked-entity-first-name",
-        "tracked-entity-last-name",
-    ]
-    .map(String::from);
-
-    for fixture_name in [
-        "complete-child-health-evidence",
-        "partial-child-health-evidence",
-        "no-child-program-enrollment",
-    ] {
-        let fixture = report
-            .fixtures
-            .iter()
-            .find(|fixture| fixture.fixture == fixture_name)
-            .unwrap_or_else(|| panic!("missing {fixture_name}"));
-        assert_eq!(fixture.outcome.as_deref(), Some("match"));
-        assert_eq!(fixture.outputs, expected_outputs);
-        assert_eq!(fixture.claims, expected_claims);
-        assert!(fixture.passed, "{fixture:#?}");
-    }
-
-    let no_match = report
-        .fixtures
-        .iter()
-        .find(|fixture| fixture.fixture == "health-no-match")
-        .expect("no-match fixture report");
-    assert_eq!(no_match.outcome.as_deref(), Some("no_match"));
-    assert!(no_match.outputs.is_empty());
-    assert_eq!(no_match.claims, expected_claims);
-    assert!(no_match.passed, "{no_match:#?}");
-
-    for (fixture_name, expected_error) in [
-        ("health-source-rejected", "source.status_rejected"),
-        ("health-subject-mismatch", "failure.subject_mismatch"),
-    ] {
-        let fixture = report
-            .fixtures
-            .iter()
-            .find(|fixture| fixture.fixture == fixture_name)
-            .unwrap_or_else(|| panic!("missing {fixture_name}"));
-        assert_eq!(fixture.expected_error.as_deref(), Some(expected_error));
-        assert_eq!(fixture.source_access, Some(true));
-        assert!(fixture.outputs.is_empty());
-        assert!(fixture.claims.is_empty());
-        assert!(fixture.passed, "{fixture:#?}");
-    }
-
-    let malformed = report
-        .fixtures
-        .iter()
-        .find(|fixture| fixture.fixture.ends_with("::derived/malformed_decode"))
-        .expect("derived malformed-source fixture report");
-    assert_eq!(
-        malformed.expected_error.as_deref(),
-        Some("source.response_malformed")
-    );
-    assert_eq!(malformed.source_access, Some(true));
-    assert!(malformed.passed, "{malformed:#?}");
-
-    let fixtures = project.join("integrations/health-record/fixtures");
-    let complete = read_yaml(&fixtures.join("match.yaml"));
-    for claim in [
-        "child-program-active",
-        "bcg-birth-dose-recorded",
-        "opv-birth-dose-recorded",
-        "measles-dose-recorded",
-    ] {
-        assert_eq!(complete["expect"]["claims"][claim].as_bool(), Some(true));
-    }
-
-    let partial = read_yaml(&fixtures.join("partial.yaml"));
-    assert_eq!(
-        partial["expect"]["claims"]["child-program-active"].as_bool(),
-        Some(false)
-    );
-    assert_eq!(
-        partial["expect"]["claims"]["bcg-birth-dose-recorded"].as_bool(),
-        Some(false)
-    );
-    assert!(partial["expect"]["claims"]["opv-birth-dose-recorded"].is_null());
-    assert_eq!(
-        partial["expect"]["claims"]["measles-dose-recorded"].as_bool(),
-        Some(true)
-    );
-
-    for fixture_name in ["no-enrollment.yaml", "no-match.yaml"] {
-        let fixture = read_yaml(&fixtures.join(fixture_name));
-        for claim in [
-            "child-program-active",
-            "bcg-birth-dose-recorded",
-            "opv-birth-dose-recorded",
-            "measles-dose-recorded",
-        ] {
-            assert!(
-                fixture["expect"]["claims"][claim].is_null(),
-                "{fixture_name} must keep {claim} unknown"
-            );
-        }
-    }
-
-    let authored = read_yaml(&project.join("registry-stack.yaml"));
-    assert!(!yaml_contains_string(&authored, "eligible"));
-    assert!(!yaml_contains_string(&authored, "outreach"));
 }
 
 #[test]
-fn successful_negative_fixtures_report_the_closed_denial_assertion() {
+fn successful_negative_fixtures_report_closed_source_access_assertions() {
     let report = test_registry_project(&ProjectTestOptions {
         project_directory: golden("custom-system"),
         environment: None,
@@ -1807,21 +1493,17 @@ fn successful_negative_fixtures_report_the_closed_denial_assertion() {
     assert!(!serialized.contains("HH-AB12CD34"));
     assert!(!serialized.contains("synthetic-key-1"));
 
-    let denied_before_access = report
+    let rejected_before_access = report
         .fixtures
         .iter()
-        .find(|fixture| {
-            fixture
-                .fixture
-                .ends_with("::derived/authorization_before_source")
-        })
-        .expect("derived authorization fixture report");
-    assert!(denied_before_access.passed);
+        .find(|fixture| fixture.fixture.ends_with("::derived/request_authority"))
+        .expect("derived request-authority fixture report");
+    assert!(rejected_before_access.passed);
     assert_eq!(
-        denied_before_access.expected_error.as_deref(),
-        Some("authorization.denied")
+        rejected_before_access.expected_error.as_deref(),
+        Some("fixture.request_mismatch")
     );
-    assert_eq!(denied_before_access.source_access, Some(false));
+    assert_eq!(rejected_before_access.source_access, Some(false));
 
     let denied_after_access = report
         .fixtures
@@ -2130,7 +1812,7 @@ fn signed_dci_rejects_wrong_jwks_algorithm_and_key_use() {
 }
 
 #[test]
-fn partial_relay_project_tests_and_checks_but_cannot_ship_a_governed_build() {
+fn records_project_tests_checks_and_builds_only_the_public_relay_lane() {
     let relay_root = tempfile::tempdir().expect("Relay-only temporary directory");
     let relay = copy_project("relay-only-records", relay_root.path());
     test_registry_project(&ProjectTestOptions {
@@ -2147,17 +1829,16 @@ fn partial_relay_project_tests_and_checks_but_cannot_ship_a_governed_build() {
     })
     .expect("Relay-only project explains");
     let relay_build = build_registry_project(&ProjectBuildOptions {
-        project_directory: relay,
+        project_directory: relay.clone(),
         environment: "local".to_string(),
         against: None,
         anchor: None,
     })
-    .expect_err("Relay-only project cannot ship a partial governed signed set");
-    let relay_message = format!("{relay_build:#}");
-    assert!(relay_message.contains("governed build requires"));
-    assert!(relay_message.contains("project test"));
-    assert!(relay_message.contains("project check"));
-    assert!(relay_message.contains("add deployment.notary before project build"));
+    .expect("Relay-only project builds");
+    assert_eq!(relay_build.status, "built");
+    let output = resolve_build_output(&relay, relay_build.output.expect("Relay build output"));
+    assert!(output.join("private/relay-public").is_dir());
+    assert!(!output.join("private/relay-consultation").exists());
 }
 
 #[test]
@@ -2386,66 +2067,6 @@ fn rhai_conformance_controls_are_code_only_and_deny_ambient_capabilities() {
     }
 }
 
-#[test]
-fn production_cel_worker_evaluates_project_date_policy() {
-    let mut config =
-        registry_notary_server::cel_worker::CelWorkerConfig::for_current_exe_subcommand();
-    config.command = env!("CARGO_BIN_EXE_registryctl").into();
-    config.command_args = vec!["__registryctl-cel-worker-v1".into()];
-    config.startup_timeout = std::time::Duration::from_secs(10);
-    let runtime = tokio::runtime::Builder::new_current_thread()
-        .enable_all()
-        .build()
-        .expect("test runtime builds");
-    let worker = registry_notary_server::cel_worker::CelWorker::lazy(config);
-    let value = runtime
-        .block_on(worker.evaluate(
-            "health.exists && health.date_of_birth != null\n  ? date.age_on(health.date_of_birth, as_of_date)\n  : null",
-            serde_json::json!({
-                "health": {
-                    "exists": true,
-                    "first_name": "Nia",
-                    "last_name": "Example",
-                    "date_of_birth": "2017-06-15",
-                    "child_program_active": true,
-                    "programme_code": "CHILD",
-                    "reconciliation_reference": "REF-0001",
-                    "maternal_postnatal_active": true,
-                    "child_health_visit_recorded": true,
-                    "tb_program_active": false
-                },
-                "as_of_date": "2026-01-01"
-            }),
-        ))
-        .expect("production CEL worker evaluates the project date policy");
-    assert_eq!(value, serde_json::json!(8));
-
-    let age_band = runtime
-        .block_on(worker.evaluate(
-            "health.exists && health.date_of_birth != null\n  ? (date.age_on(health.date_of_birth, as_of_date) < 5\n      ? \"0-4\"\n      : (date.age_on(health.date_of_birth, as_of_date) < 18 ? \"5-17\" : \"18+\"))\n  : null",
-            serde_json::json!({
-                "health": {
-                    "exists": true,
-                    "date_of_birth": "2017-06-15"
-                },
-                "as_of_date": "2026-01-01"
-            }),
-        ))
-        .expect("production CEL worker evaluates the approved age band");
-    assert_eq!(age_band, serde_json::json!("5-17"));
-
-    let absent = runtime
-        .block_on(worker.evaluate(
-            "health.exists && health.date_of_birth != null\n  ? date.age_on(health.date_of_birth, as_of_date)\n  : null",
-            serde_json::json!({
-                "health": { "exists": false, "date_of_birth": null },
-                "as_of_date": "2026-01-01"
-            }),
-        ))
-        .expect("production CEL worker preserves a successful null result");
-    assert_eq!(absent, serde_json::Value::Null);
-}
-
 #[test]
 fn all_advertised_starters_initialize_and_test_without_source_access() {
     for starter in [
@@ -2520,12 +2141,12 @@ fn spreadsheet_starter_builds_sensitive_projected_fields_without_emitting_projec
     .expect("spreadsheet starter preflight executes");
     assert_eq!(
         preflight.status,
-        registryctl::PreflightStatus::NotReady,
-        "authoring and deterministic build remain available without pretending missing local runtime inputs are ready"
+        registryctl::PreflightStatus::Ready,
+        "the maintained spreadsheet starter carries its local workbook and requires no retired Notary inputs"
     );
     assert!(
-        !preflight.diagnostics.is_empty(),
-        "offline preflight must explain the missing local runtime inputs"
+        preflight.diagnostics.is_empty(),
+        "ready offline preflight must not invent missing local runtime inputs"
     );
     let repeated_preflight = preflight_registry_project(&ProjectPreflightOptions {
         project_directory: project.clone(),
@@ -2884,7 +2505,7 @@ fn spreadsheet_project_file_rejects_traversal_and_symlink_components() {
 }
 
 #[test]
-fn typed_target_attribute_executes_through_the_offline_notary_journey() {
+fn typed_target_attribute_executes_through_the_offline_relay_journey() {
     let temporary = tempfile::tempdir().expect("temporary directory");
     let project = temporary.path().join("typed-target-attribute");
     copy_tree(
@@ -3416,7 +3037,7 @@ fn check_explain_reports_environment_binding_without_origin_value() {
 }
 
 #[test]
-fn offline_preflight_reports_missing_local_requirements_without_leaking_references() {
+fn offline_preflight_reports_missing_source_secret_without_leaking_references() {
     let temporary = tempfile::tempdir().expect("temporary directory");
     let project = temporary.path().join("registry-project");
     init_registry_project(&ProjectInitOptions {
@@ -3432,23 +3053,16 @@ fn offline_preflight_reports_missing_local_requirements_without_leaking_referenc
     .expect("offline preflight produces a bounded report");
     assert_eq!(report.status, registryctl::PreflightStatus::NotReady);
     assert_eq!(report.static_checks.len(), 4);
-    assert_eq!(report.product_validators.len(), 2);
+    assert_eq!(report.product_validators.len(), 1);
     assert!(!report.secret_checks.is_empty());
-    assert!(!report.runtime_files.is_empty());
+    assert!(report.runtime_files.is_empty());
     assert_eq!(
         report.execution,
         registryctl::PreflightExecutionBoundary::default()
     );
 
     let serialized = serde_json::to_string(&report).expect("preflight report serializes");
-    for forbidden in [
-        "FICTIONAL_REGISTRY_TOKEN",
-        "REGISTRY_NOTARY_ISSUER_JWK",
-        "EVIDENCE_CLIENT_TOKEN_HASH",
-        "/run/secrets/relay-workload-token",
-        "citizen-registry.invalid",
-        "fictional-registry-notary",
-    ] {
+    for forbidden in ["FICTIONAL_REGISTRY_TOKEN", "citizen-registry.invalid"] {
         assert!(
             !serialized.contains(forbidden),
             "preflight report must not contain {forbidden}"
@@ -3498,18 +3112,13 @@ fn capability_inventory_separates_static_support_from_runtime_and_image_evidence
         report.runtime_activation,
         registryctl::RuntimeActivationEvaluation::NotEvaluated
     );
-    for image in [
-        registryctl::SupportComponent::RegistryRelayImage,
-        registryctl::SupportComponent::RegistryNotaryImage,
-    ] {
-        let support = report
-            .support
-            .iter()
-            .find(|entry| entry.component == image)
-            .expect("image support is represented");
-        assert_eq!(support.state, registryctl::SupportState::NotEvaluated);
-        assert_eq!(support.evidence, registryctl::SupportEvidence::NoEvidence);
-    }
+    let support = report
+        .support
+        .iter()
+        .find(|entry| entry.component == registryctl::SupportComponent::RegistryRelayImage)
+        .expect("Relay image support is represented");
+    assert_eq!(support.state, registryctl::SupportState::NotEvaluated);
+    assert_eq!(support.evidence, registryctl::SupportEvidence::NoEvidence);
 
     let report_value = serde_json::to_value(&report).expect("capability report serializes");
     let schema = serde_json::from_str(include_str!(
@@ -3656,6 +3265,11 @@ not_applicable:
 "#,
     )
     .expect("adapted integration writes");
+    replace_in_file(
+        &project.join("registry-stack.yaml"),
+        "person_id: request.target.identifiers.registry_person_id",
+        "municipal_reference: request.target.identifiers.registry_person_id",
+    );
     let fixture_directory = project.join("integrations/person-record/fixtures");
     for entry in std::fs::read_dir(&fixture_directory).expect("starter fixtures") {
         let path = entry.expect("fixture entry").path();
@@ -3679,7 +3293,6 @@ interactions:
 expect:
   outcome: match
   outputs: { status: ACTIVE, category: RESIDENT }
-  claims: { person-record-exists: true, person-status: ACTIVE }
 "#,
     )
     .expect("adapted fixture writes");
@@ -3694,40 +3307,10 @@ interactions:
       path: /municipal/registry/lookup
       query: { reference: AB-123456, include: "status,category" }
     respond: { status: 409, body: {} }
-expect: { outcome: ambiguous, outputs: {}, claims: {} }
+expect: { outcome: ambiguous, outputs: {} }
 "#,
     )
     .expect("adapted ambiguity fixture writes");
-    let project_file = project.join("registry-stack.yaml");
-    let mut project_document = read_yaml(&project_file);
-    let service = &mut project_document["services"]["person-verification"];
-    service["purpose"] = serde_norway::Value::String("municipal-benefit-screening".to_string());
-    service["consultations"]["person_record"]["input"] = serde_norway::from_str(
-        "municipal_reference: request.target.identifiers.registry_person_id\n",
-    )
-    .expect("adapted consultation input");
-    service["claims"]
-        .as_mapping_mut()
-        .expect("starter claims")
-        .remove(serde_norway::Value::String("person-active".to_string()));
-    service["claims"]
-        .as_mapping_mut()
-        .expect("starter claims")
-        .insert(
-            serde_norway::Value::String("person-status".to_string()),
-            serde_norway::from_str("output: person_record.status\ndisclosure: value\n")
-                .expect("adapted status claim"),
-        );
-    service["credential_profiles"]["person-status"]["claims"]
-        .as_sequence_mut()
-        .expect("starter credential claims")
-        .iter_mut()
-        .for_each(|claim| {
-            if claim.as_str() == Some("person-active") {
-                *claim = serde_norway::Value::String("person-status".to_string());
-            }
-        });
-    write_yaml(&project_file, &project_document);
 
     let report = check_registry_project(&ProjectCheckOptions {
         project_directory: project,
@@ -3741,10 +3324,6 @@ expect: { outcome: ambiguous, outputs: {}, claims: {} }
         .semantic_changes
         .iter()
         .any(|change| change.dimension == "integration"));
-    assert!(report
-        .semantic_changes
-        .iter()
-        .any(|change| change.dimension == "service_policy"));
 }
 
 #[test]
@@ -3812,7 +3391,7 @@ fn source_product_is_metadata_not_runtime_dispatch() {
         against: None,
         anchor: None,
     })
-    .expect("unknown product builds generic Relay and Notary inputs");
+    .expect("unknown product builds generic Relay inputs");
     assert_eq!(build.status, "built");
 
     let metadata_free_root = tempfile::tempdir().expect("metadata-free temporary directory");
@@ -3890,11 +3469,6 @@ fn code_owned_rhai_conformance_uses_the_injected_worker_and_is_deterministic() {
             "{} outputs",
             expected.fixture
         );
-        assert_eq!(
-            actual.claims, expected.claims,
-            "{} claims",
-            expected.fixture
-        );
         assert_eq!(
             actual.outcome, expected.outcome,
             "{} outcome",
@@ -4016,22 +3590,6 @@ fn pre_freeze_fact_authoring_keys_are_rejected_without_aliases() {
     assert!(rendered.contains("canonical schema validation"));
     assert!(!rendered.contains("facts"));
 
-    let claim_root = tempfile::tempdir().expect("claim-key temporary directory");
-    let claim = copy_project("custom-system", claim_root.path());
-    replace_in_file(
-        &claim.join("registry-stack.yaml"),
-        "output: household.category",
-        "fact: household.category",
-    );
-    let error = test_registry_project(&ProjectTestOptions {
-        project_directory: claim,
-        environment: None,
-    })
-    .expect_err("claim fact alias must be rejected");
-    let rendered = format!("{error:#}");
-    assert!(rendered.contains("canonical schema validation"));
-    assert!(!rendered.contains("fact:"));
-
     let fixture_root = tempfile::tempdir().expect("fixture-key temporary directory");
     let fixture = copy_project("custom-system", fixture_root.path());
     let fixture_path = fixture.join("integrations/eligibility/fixtures/source-approved.yaml");
@@ -4600,111 +4158,24 @@ fn project_check_preserves_both_exact_sides_of_cross_file_failures() {
 }
 
 #[test]
-fn project_check_points_to_representative_semantic_reference_and_value_failures() {
-    let assert_exact_pointer =
-        |project: &Path, cause: &str, expected_file: &str, expected_pointer: &str| {
-            let report = authoring_diagnostics(project);
-            let diagnostic = report
-                .diagnostics
-                .iter()
-                .find(|diagnostic| diagnostic.cause == cause)
-                .unwrap_or_else(|| panic!("missing {cause}: {report:#?}"));
-            assert!(
-                diagnostic.addresses.iter().any(|address| {
-                    address.file == expected_file && address.pointer == expected_pointer
-                }),
-                "missing {expected_file}#{expected_pointer}: {diagnostic:#?}"
-            );
-            assert!(
-                diagnostic
-                    .addresses
-                    .iter()
-                    .all(|address| !address.pointer.is_empty()),
-                "a precise semantic diagnostic degraded to a document-root address: {diagnostic:#?}"
-            );
-        };
-
-    let integration_root = tempfile::tempdir().expect("integration temporary directory");
-    let integration_project = copy_project("custom-system", integration_root.path());
-    let project_path = integration_project.join("registry-stack.yaml");
-    let mut project = read_yaml(&project_path);
-    project["services"]["household-eligibility"]["consultations"]["household"]["integration"] =
-        serde_norway::Value::String("missing-integration".to_string());
-    write_yaml(&project_path, &project);
-    assert_exact_pointer(
-        &integration_project,
-        "A service consultation references an unknown integration.",
-        "registry-stack.yaml",
-        "/services/household-eligibility/consultations/household/integration",
-    );
-
-    let credential_root = tempfile::tempdir().expect("credential temporary directory");
-    let credential_project = copy_project("custom-system", credential_root.path());
-    let project_path = credential_project.join("registry-stack.yaml");
-    let mut project = read_yaml(&project_path);
-    project["services"]["household-eligibility"]["credential_profiles"]["household-eligibility"]
-        ["claims"][0] = serde_norway::Value::String("missing-claim".to_string());
-    write_yaml(&project_path, &project);
-    assert_exact_pointer(
-        &credential_project,
-        "A credential profile references an unknown claim.",
-        "registry-stack.yaml",
-        "/services/household-eligibility/credential_profiles/household-eligibility/claims/0",
-    );
-
-    let cel_root = tempfile::tempdir().expect("CEL temporary directory");
-    let cel_project = copy_project("custom-system", cel_root.path());
-    let project_path = cel_project.join("registry-stack.yaml");
-    let mut project = read_yaml(&project_path);
-    project["services"]["household-eligibility"]["claims"]["household-record-exists"]["cel"] =
-        serde_norway::Value::String("missing_consultation.matched".to_string());
-    project["services"]["household-eligibility"]["claims"]["household-record-exists"]["value"] =
-        serde_norway::from_str("{ type: boolean }").expect("claim value YAML parses");
-    write_yaml(&project_path, &project);
-    assert_exact_pointer(
-        &cel_project,
-        "A claim evaluation does not resolve to a declared consultation.",
-        "registry-stack.yaml",
-        "/services/household-eligibility/claims/household-record-exists/cel",
-    );
-
-    let validity_root = tempfile::tempdir().expect("validity temporary directory");
-    let validity_project = copy_project("custom-system", validity_root.path());
-    let project_path = validity_project.join("registry-stack.yaml");
-    let mut project = read_yaml(&project_path);
-    project["services"]["household-eligibility"]["credential_profiles"]["household-eligibility"]
-        ["validity"] = serde_norway::Value::String("ten-minutes".to_string());
-    write_yaml(&project_path, &project);
-    assert_exact_pointer(
-        &validity_project,
-        "The YAML document does not satisfy its canonical authoring schema.",
-        "registry-stack.yaml",
-        "/services/household-eligibility/credential_profiles/household-eligibility/validity",
-    );
-
-    let disclosure_root = tempfile::tempdir().expect("disclosure temporary directory");
-    let disclosure_project = copy_project("custom-system", disclosure_root.path());
-    let project_path = disclosure_project.join("registry-stack.yaml");
-    let mut project = read_yaml(&project_path);
-    project["services"]["household-eligibility"]["claims"]["household-record-exists"]
-        ["disclosure"] = serde_norway::Value::String("unsupported-mode".to_string());
-    write_yaml(&project_path, &project);
-    assert_exact_pointer(
-        &disclosure_project,
-        "The YAML document does not satisfy its canonical authoring schema.",
-        "registry-stack.yaml",
-        "/services/household-eligibility/claims/household-record-exists/disclosure",
-    );
-}
-
-#[test]
-fn project_check_moves_unknown_direct_outputs_into_exact_typed_diagnostics() {
+fn project_check_moves_unknown_consultation_inputs_into_exact_typed_diagnostics() {
     let temporary = tempfile::tempdir().expect("temporary directory");
     let project = copy_project("custom-system", temporary.path());
     let project_path = project.join("registry-stack.yaml");
     let mut authored = read_yaml(&project_path);
-    authored["services"]["household-eligibility"]["claims"]["household-category"]["output"] =
-        serde_norway::Value::String("household.unknown-output".to_string());
+    let input = authored["services"]["household-eligibility"]["consultations"]["household"]
+        ["input"]
+        .as_mapping_mut()
+        .expect("consultation input is a mapping");
+    let value = input
+        .remove(serde_norway::Value::String(
+            "household_reference".to_string(),
+        ))
+        .expect("maintained consultation input exists");
+    input.insert(
+        serde_norway::Value::String("unknown_input".to_string()),
+        value,
+    );
     write_yaml(&project_path, &authored);
 
     let report = authoring_diagnostics(&project);
@@ -4712,9 +4183,9 @@ fn project_check_moves_unknown_direct_outputs_into_exact_typed_diagnostics() {
         .diagnostics
         .iter()
         .find(|diagnostic| {
-            diagnostic.cause == "A direct claim references an unknown integration output."
+            diagnostic.cause == "A service consultation does not match its integration."
         })
-        .unwrap_or_else(|| panic!("missing direct-output diagnostic: {report:#?}"));
+        .unwrap_or_else(|| panic!("missing consultation-input diagnostic: {report:#?}"));
     assert_eq!(
         diagnostic
             .addresses
@@ -4722,10 +4193,10 @@ fn project_check_moves_unknown_direct_outputs_into_exact_typed_diagnostics() {
             .map(|address| (address.file.as_str(), address.pointer.as_str()))
             .collect::<BTreeSet<_>>(),
         BTreeSet::from([
-            ("integrations/eligibility/integration.yaml", "/outputs"),
+            ("integrations/eligibility/integration.yaml", "/input"),
             (
                 "registry-stack.yaml",
-                "/services/household-eligibility/claims/household-category/output",
+                "/services/household-eligibility/consultations/household/input",
             ),
         ])
     );
@@ -5021,338 +4492,6 @@ fn project_schema_accepts_only_bounded_scalar_target_attribute_mappings() {
     );
 }
 
-#[test]
-fn environment_schema_tracks_local_loopback_signing_kid_and_postgresql_state() {
-    let schema: serde_json::Value = serde_json::from_slice(
-        &std::fs::read(
-            Path::new(env!("CARGO_MANIFEST_DIR"))
-                .join("schemas/project-authoring/environment.schema.json"),
-        )
-        .expect("environment schema reads"),
-    )
-    .expect("environment schema is JSON");
-    let schema = jsonschema::JSONSchema::options()
-        .with_draft(jsonschema::Draft::Draft202012)
-        .compile(&schema)
-        .expect("environment schema compiles");
-    let local = serde_json::json!({
-        "version": 1,
-        "issuance": {
-            "issuer": "did:web:authority.invalid",
-            "signing_key": { "secret": "NOTARY_ISSUER_JWK" },
-            "signing_kid": "did:web:authority.invalid#issuer-key-1",
-            "generation": 1,
-        },
-        "relay": {
-            "origin": "HTTP://127.0.0.1:8080",
-            "issuer": "HTTP://[::1]:8090",
-            "jwks_url": "HTTP://127.0.0.1:8090/.well-known/jwks.json",
-            "audience": "registry-relay",
-            "allowed_clients": [],
-        },
-        "notary_relay": {
-            "base_url": "HTTP://127.0.0.1:8080",
-            "workload_client_id": "authority-notary",
-            "token_file": "/run/secrets/authority-notary-relay-token",
-        },
-        "relay_state": {
-            "postgresql": {
-                "root_certificate_path": "/run/secrets/relay-postgres-ca.pem",
-            },
-        },
-        "notary_state": {
-            "postgresql": {
-                "root_certificate_path": "/run/secrets/notary-postgres-ca.pem",
-            },
-        },
-        "notary_cel": {
-            "worker_memory_bytes": 1073741824,
-        },
-        "deployment": {
-            "profile": "local",
-            "relay": { "service": "authority-relay" },
-            "notary": { "service": "authority-notary" },
-        },
-    });
-    assert!(schema.is_valid(&local));
-
-    let mut hosted_loopback = local.clone();
-    hosted_loopback["deployment"]["profile"] = serde_json::json!("hosted_lab");
-    assert!(!schema.is_valid(&hosted_loopback));
-
-    let mut private_network_http = local.clone();
-    private_network_http["relay"]["origin"] = serde_json::json!("http://10.42.0.8:8080");
-    assert!(!schema.is_valid(&private_network_http));
-
-    let mut relative_root = local.clone();
-    relative_root["notary_state"]["postgresql"]["root_certificate_path"] =
-        serde_json::json!("notary-postgres-ca.pem");
-    assert!(!schema.is_valid(&relative_root));
-
-    let mut relative_relay_root = local.clone();
-    relative_relay_root["relay_state"]["postgresql"]["root_certificate_path"] =
-        serde_json::json!("relay-postgres-ca.pem");
-    assert!(!schema.is_valid(&relative_relay_root));
-
-    let mut undersized_cel_worker = local.clone();
-    undersized_cel_worker["notary_cel"]["worker_memory_bytes"] = serde_json::json!(33_554_431);
-    assert!(!schema.is_valid(&undersized_cel_worker));
-
-    let mut oversized_cel_worker = local.clone();
-    oversized_cel_worker["notary_cel"]["worker_memory_bytes"] =
-        serde_json::json!(1_073_741_825_u64);
-    assert!(!schema.is_valid(&oversized_cel_worker));
-
-    let mut relay_only_cel_worker = local.clone();
-    relay_only_cel_worker["deployment"]
-        .as_object_mut()
-        .expect("deployment is an object")
-        .remove("notary");
-    assert!(!schema.is_valid(&relay_only_cel_worker));
-
-    let mut whitespace_kid = local.clone();
-    whitespace_kid["issuance"]["signing_kid"] =
-        serde_json::json!("did:web:authority.invalid#bad kid");
-    assert!(!schema.is_valid(&whitespace_kid));
-}
-
-#[test]
-fn environment_schema_types_the_closed_oid4vci_authority_binding() {
-    let schema: serde_json::Value = serde_json::from_slice(
-        &std::fs::read(
-            Path::new(env!("CARGO_MANIFEST_DIR"))
-                .join("schemas/project-authoring/environment.schema.json"),
-        )
-        .expect("environment schema reads"),
-    )
-    .expect("environment schema is JSON");
-    let schema = jsonschema::JSONSchema::options()
-        .with_draft(jsonschema::Draft::Draft202012)
-        .compile(&schema)
-        .expect("environment schema compiles");
-    let environment = serde_json::json!({
-        "version": 1,
-        "issuance": {
-            "issuer": "did:web:notary.example.invalid",
-            "signing_key": { "secret": "NOTARY_ISSUER_JWK" },
-            "signing_kid": "did:web:notary.example.invalid#issuer-key-1",
-            "generation": 1,
-        },
-        "notary_state": {
-            "postgresql": {
-                "root_certificate_path": "/run/secrets/notary-postgres-ca.pem",
-            },
-        },
-        "oid4vci": {
-            "public_base_url": "https://notary.example.invalid",
-            "credential": {
-                "service": "citizen-status",
-                "profile": "citizen-status",
-            },
-            "authorization_server": {
-                "issuer": "https://esignet.example.invalid",
-                "jwks_url": "https://esignet.example.invalid/jwks.json",
-                "userinfo_url": "https://esignet.example.invalid/userinfo",
-                "authorize_url": "https://esignet-ui.example.invalid/authorize",
-                "token_url": "https://esignet.example.invalid/token",
-            },
-            "client": {
-                "id": "citizen-wallet",
-                "signing_key": { "secret": "ESIGNET_CLIENT_JWK" },
-                "signing_kid": "citizen-wallet-key-1",
-            },
-            "access_token": {
-                "signing_key": { "secret": "NOTARY_ACCESS_TOKEN_JWK" },
-                "signing_kid": "did:web:notary.example.invalid#access-token-key-1",
-            },
-            "sensitive_state_key": { "secret": "NOTARY_SENSITIVE_STATE_KEY" },
-            "subject": {
-                "token_claim": "individual_id",
-                "id_type": "solmara_uin",
-            },
-            "redirect_uri": "https://notary.example.invalid/oid4vci/offer/callback",
-            "allowed_wallet_origins": ["https://wallet.example.invalid"],
-            "representative_issuance": {
-                "relationship": "parent",
-                "proof_claim": "parent-link",
-                "target_id_type": "solmara_uin",
-            },
-        },
-        "deployment": {
-            "profile": "hosted_lab",
-            "notary": { "service": "citizen-notary" },
-        },
-    });
-    assert!(schema.is_valid(&environment));
-
-    let mut empty_callers = environment.clone();
-    empty_callers["callers"] = serde_json::json!({});
-    assert!(schema.is_valid(&empty_callers));
-
-    let mut with_callers = environment.clone();
-    with_callers["callers"] = serde_json::json!({
-        "portal": {
-            "api_key_fingerprint": { "secret": "PORTAL_KEY_HASH" },
-            "scopes": ["evidence:read"],
-        },
-    });
-    assert!(schema.is_valid(&with_callers));
-
-    let mut authored_scope = environment.clone();
-    authored_scope["oid4vci"]["credential"]["scope"] = serde_json::json!("credential:issue");
-    assert!(!schema.is_valid(&authored_scope));
-
-    let mut missing_state = environment.clone();
-    missing_state
-        .as_object_mut()
-        .expect("environment object")
-        .remove("notary_state");
-    assert!(!schema.is_valid(&missing_state));
-
-    let mut relative_redirect = environment.clone();
-    relative_redirect["oid4vci"]["redirect_uri"] = serde_json::json!("/oid4vci/offer/callback");
-    assert!(!schema.is_valid(&relative_redirect));
-
-    let mut hosted_loopback = environment.clone();
-    hosted_loopback["oid4vci"]["public_base_url"] = serde_json::json!("http://127.0.0.1:8081");
-    assert!(!schema.is_valid(&hosted_loopback));
-
-    let mut stale_relationship_proof = environment.clone();
-    stale_relationship_proof["oid4vci"]["representative_issuance"]["max_proof_age_seconds"] =
-        serde_json::json!(0);
-    assert!(!schema.is_valid(&stale_relationship_proof));
-
-    let mut unknown_key_field = environment;
-    unknown_key_field["oid4vci"]["access_token"]["value"] = serde_json::json!("secret-material");
-    assert!(!schema.is_valid(&unknown_key_field));
-}
-
-#[test]
-fn project_authoring_schemas_reject_incoherent_product_topologies() {
-    let schema_root = Path::new(env!("CARGO_MANIFEST_DIR")).join("schemas/project-authoring");
-    let compile = |schema_name: &str| {
-        let schema: serde_json::Value = serde_json::from_slice(
-            &std::fs::read(schema_root.join(schema_name)).expect("schema reads"),
-        )
-        .expect("schema is JSON");
-        jsonschema::JSONSchema::options()
-            .with_draft(jsonschema::Draft::Draft202012)
-            .compile(&schema)
-            .unwrap_or_else(|error| panic!("{schema_name} did not compile: {error}"))
-    };
-    let project_schema = compile("project.schema.json");
-    assert!(!project_schema.is_valid(&serde_json::json!({
-        "version": 1,
-        "registry": { "id": "empty-registry" },
-        "services": {},
-    })));
-
-    let environment_schema = compile("environment.schema.json");
-    let relay_binding = serde_json::json!({
-        "origin": "https://relay.internal.invalid",
-        "issuer": "https://issuer.internal.invalid",
-        "jwks_url": "https://issuer.internal.invalid/.well-known/jwks.json",
-        "audience": "registry-relay",
-        "allowed_clients": ["registry-client"],
-    });
-    let connection = serde_json::json!({
-        "base_url": "http://127.0.0.1:8080",
-        "workload_client_id": "registry-notary",
-        "token_file": "/run/secrets/notary-relay-token",
-    });
-    for (name, environment) in [
-        (
-            "Relay deployment without Relay bindings",
-            serde_json::json!({
-                "version": 1,
-                "deployment": { "profile": "local", "relay": { "service": "relay" } },
-            }),
-        ),
-        (
-            "Notary-only deployment with Relay bindings",
-            serde_json::json!({
-                "version": 1,
-                "relay": relay_binding.clone(),
-                "deployment": { "profile": "local", "notary": { "service": "notary" } },
-            }),
-        ),
-        (
-            "Relay-only deployment with a Notary-to-Relay connection",
-            serde_json::json!({
-                "version": 1,
-                "relay": relay_binding.clone(),
-                "notary_relay": connection,
-                "deployment": { "profile": "local", "relay": { "service": "relay" } },
-            }),
-        ),
-    ] {
-        assert!(
-            !environment_schema.is_valid(&environment),
-            "schema accepted {name}"
-        );
-    }
-    assert!(environment_schema.is_valid(&serde_json::json!({
-        "version": 1,
-        "relay": relay_binding,
-        "deployment": {
-            "profile": "local",
-            "relay": { "service": "relay" },
-            "notary": { "service": "notary" },
-        },
-    })));
-    assert!(!environment_schema.is_valid(&serde_json::json!({
-        "version": 1,
-        "relay": {
-            "origin": "https://relay.internal.invalid",
-            "issuer": "https://issuer.internal.invalid",
-            "jwks_url": "https://issuer.internal.invalid/.well-known/jwks.json",
-            "audience": "registry-relay",
-            "workload_client_id": "obsolete-overloaded-client",
-        },
-        "deployment": { "profile": "local", "relay": { "service": "relay" } },
-    })));
-}
-
-#[test]
-fn relay_authorization_bindings_follow_authored_service_topology() {
-    let missing_workload_root = tempfile::tempdir().expect("temporary directory");
-    let missing_workload = copy_project("custom-system", missing_workload_root.path());
-    let environment_path = missing_workload.join("environments/local.yaml");
-    let mut environment = read_yaml(&environment_path);
-    environment
-        .as_mapping_mut()
-        .expect("environment mapping")
-        .remove(serde_norway::Value::String("notary_relay".to_string()));
-    write_yaml(&environment_path, &environment);
-    let error = check_registry_project(&ProjectCheckOptions {
-        project_directory: missing_workload,
-        environment: "local".to_string(),
-        explain: false,
-        against: None,
-        anchor: None,
-    })
-    .expect_err("Relay consultation without a Notary workload must fail");
-    assert_authoring_diagnostic(&error, "registryctl.authoring.environment.invalid");
-
-    let missing_records_client_root = tempfile::tempdir().expect("temporary directory");
-    let missing_records_client =
-        copy_project("relay-only-records", missing_records_client_root.path());
-    let environment_path = missing_records_client.join("environments/local.yaml");
-    let mut environment = read_yaml(&environment_path);
-    environment["relay"]["allowed_clients"] =
-        serde_norway::from_str("[]\n").expect("empty allowed client list");
-    write_yaml(&environment_path, &environment);
-    let error = check_registry_project(&ProjectCheckOptions {
-        project_directory: missing_records_client,
-        environment: "local".to_string(),
-        explain: false,
-        against: None,
-        anchor: None,
-    })
-    .expect_err("records publication without an admitted client must fail");
-    assert_authoring_diagnostic(&error, "registryctl.authoring.environment.invalid");
-}
-
 #[test]
 fn exact_selector_sizes_one_through_eight_compile_for_http_and_snapshot() {
     for size in 1..=8 {
@@ -5360,7 +4499,7 @@ fn exact_selector_sizes_one_through_eight_compile_for_http_and_snapshot() {
         for golden_name in ["custom-system", "snapshot-exact"] {
             let project = copy_project(golden_name, temporary.path());
             if golden_name == "custom-system" {
-                remove_custom_cel_claim(&project);
+                prepare_custom_selector_project(&project);
             }
             extend_exact_selector(&project, golden_name, size);
             check_registry_project(&ProjectCheckOptions {
@@ -5381,7 +4520,7 @@ fn exact_selector_sizes_one_through_eight_compile_for_http_and_snapshot() {
 fn integration_input_bounds_match_the_production_compiler_limit() {
     let accepted_root = tempfile::tempdir().expect("accepted temporary directory");
     let accepted = copy_project("custom-system", accepted_root.path());
-    remove_custom_cel_claim(&accepted);
+    prepare_custom_selector_project(&accepted);
     replace_in_file(
         &accepted.join("integrations/eligibility/integration.yaml"),
         "maxLength: 18",
@@ -5431,7 +4570,7 @@ fn integration_input_bounds_match_the_production_compiler_limit() {
 fn integration_input_names_match_the_wire_grammar() {
     let accepted_root = tempfile::tempdir().expect("accepted temporary directory");
     let accepted = copy_project("custom-system", accepted_root.path());
-    remove_custom_cel_claim(&accepted);
+    prepare_custom_selector_project(&accepted);
     let boundary_name = format!("a{}", "0".repeat(63));
     rename_custom_input(&accepted, &boundary_name);
     let report = build_registry_project(&ProjectBuildOptions {
@@ -5563,8 +4702,8 @@ fn exact_selector_authored_member_order_is_canonical() {
     let second_root = tempfile::tempdir().expect("second temporary directory");
     let first = copy_project("custom-system", first_root.path());
     let second = copy_project("custom-system", second_root.path());
-    remove_custom_cel_claim(&first);
-    remove_custom_cel_claim(&second);
+    prepare_custom_selector_project(&first);
+    prepare_custom_selector_project(&second);
     extend_exact_selector(&first, "custom-system", 3);
     extend_exact_selector(&second, "custom-system", 3);
 
@@ -5624,7 +4763,7 @@ fn api_key_interfaces_keep_values_environment_only_and_use_the_stable_auth_type(
     ] {
         let temporary = tempfile::tempdir().expect("temporary directory");
         let project = copy_project("custom-system", temporary.path());
-        remove_custom_cel_claim(&project);
+        prepare_custom_selector_project(&project);
         let integration = project.join("integrations/eligibility/integration.yaml");
         let mut document = read_yaml(&integration);
         document["source"]["auth"] = serde_norway::from_str(&format!(
@@ -5818,7 +4957,6 @@ fn opencrvs_composite_dci_uses_unified_exact_predicates_canonically() {
         .expect("composite ambiguous fixture executes");
     assert_eq!(ambiguous.outcome.as_deref(), Some("ambiguous"));
     assert!(ambiguous.outputs.is_empty());
-    assert!(ambiguous.claims.is_empty());
     reverse_yaml_mapping(
         &second.join("integrations/birth-record/integration.yaml"),
         &["source", "protocol", "signed_dci", "selectors"],
@@ -6051,20 +5189,14 @@ fn check_and_build_produce_deterministic_product_inputs() {
     })
     .expect("golden project checks");
     assert_eq!(check.status, "valid");
-    assert_eq!(check.semantic_changes.len(), 5);
+    assert_eq!(check.semantic_changes.len(), 3);
     assert_eq!(
         check
             .semantic_changes
             .iter()
             .map(|change| change.dimension)
             .collect::<BTreeSet<_>>(),
-        BTreeSet::from([
-            "claim",
-            "disclosure",
-            "integration",
-            "operator_security",
-            "service_policy",
-        ])
+        BTreeSet::from(["integration", "operator_security", "service_policy"])
     );
     let explanation = check.explanation.expect("explanation is present");
     assert_eq!(
@@ -6075,21 +5207,6 @@ fn check_and_build_produce_deterministic_product_inputs() {
         )),
         &serde_json::json!("http")
     );
-    assert_eq!(
-        public_explanation_value(project_explanation_field(
-            &explanation,
-            "/services/household-eligibility/consultation_count",
-        )),
-        &serde_json::json!(1)
-    );
-    assert!(matches!(
-        project_explanation_field(
-            &explanation,
-            "/services/household-eligibility/claims/source-household-approval-decision/cel",
-        )
-        .reported_value,
-        ClassifierSafeReportedValue::Redacted { .. }
-    ));
     assert!(matches!(
         environment_explanation_field(
             &explanation,
@@ -6128,15 +5245,6 @@ fn check_and_build_produce_deterministic_product_inputs() {
     };
     let first = build_registry_project(&options).expect("first build");
     let output = resolve_build_output(&project, first.output.expect("build output"));
-    let notary_config = std::fs::read_to_string(output.join("private/notary/config/notary.yaml"))
-        .expect("generated Notary config");
-    let notary_document: serde_norway::Value =
-        serde_norway::from_str(&notary_config).expect("generated Notary config parses");
-    assert_eq!(
-        notary_document["server"]["bind"],
-        serde_norway::Value::String("0.0.0.0:8081".to_string()),
-        "the governed Notary listener must be reachable through its container port"
-    );
     for (lane, expected_bind) in [
         ("relay-public", "0.0.0.0:8080"),
         ("relay-consultation", "0.0.0.0:8080"),
@@ -6152,15 +5260,6 @@ fn check_and_build_produce_deterministic_product_inputs() {
             "the governed Relay listener must be reachable through its container port"
         );
     }
-    assert!(
-        notary_document.get("cel").is_none(),
-        "absent authoring must preserve the Notary product default"
-    );
-    assert!(notary_config.contains("type: consultation_output"));
-    assert!(notary_config.contains("consultation: household"));
-    assert!(notary_config.contains("output: category"));
-    assert!(!notary_config.contains("type: extract"));
-    assert!(!notary_config.contains("type: exists"));
     let public_contract: serde_json::Value = serde_json::from_slice(
         &std::fs::read(output.join(
             "private/relay-consultation/config/artifacts/consultation-contracts/household-eligibility-household.json",
@@ -6179,11 +5278,6 @@ fn check_and_build_produce_deterministic_product_inputs() {
     let first_closure = directory_closure(&output);
     build_registry_project(&options).expect("second build");
     assert_eq!(first_closure, directory_closure(&output));
-    assert_eq!(
-        closure_digest(&first_closure),
-        "43ce7ef2d61edc9ab8c6f56d5bc2420d3cf39e64013807d69b82055b05e6bdbe",
-        "project output, including its deterministic manifest, must match the cross-machine golden digest"
-    );
 }
 
 #[test]
@@ -6300,23 +5394,10 @@ fn build_artifact_manifest_is_complete_relative_private_and_deterministic() {
             .as_array()
             .expect("artifact consumers");
         assert!(!consumers.is_empty());
-        if payload_relative.starts_with("private/relay-public/")
-            || payload_relative.starts_with("private/relay-consultation/")
-        {
-            assert!(!consumers
-                .iter()
-                .any(|consumer| consumer == "registry_notary"));
-        }
-        if payload_relative.starts_with("private/notary/") {
-            assert!(!consumers
-                .iter()
-                .any(|consumer| consumer == "registry_relay"));
-        }
         if matches!(
             payload_relative,
             "private/relay-public/config/relay.yaml"
                 | "private/relay-consultation/config/relay.yaml"
-                | "private/notary/config/notary.yaml"
         ) {
             assert_eq!(artifact["sensitivity"], "topology_sensitive");
             assert_eq!(artifact["publication"], "never_publish");
@@ -6362,289 +5443,6 @@ fn build_artifact_manifest_is_complete_relative_private_and_deterministic() {
     );
 }
 
-#[cfg(feature = "relay-contract-test-support")]
-#[test]
-fn generated_relay_contract_activates_through_notary_exactly_and_rejects_a_stale_pin() {
-    use registry_notary_core::{ClaimEvidenceMode, StandaloneRegistryNotaryConfig};
-
-    let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = copy_project("custom-system", temporary.path());
-    let integration_path = project.join("integrations/eligibility/integration.yaml");
-    let mut integration = read_yaml(&integration_path);
-    integration["limits"] = serde_norway::from_str("deadline: 20s\n")
-        .expect("reviewed deadline boundary is valid YAML");
-    write_yaml(&integration_path, &integration);
-    let build = build_registry_project(&ProjectBuildOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        against: None,
-        anchor: None,
-    })
-    .expect("combined project builds");
-    let output = resolve_build_output(&project, build.output.expect("build output"));
-    let contract_path = output.join(
-        "private/relay-consultation/config/artifacts/consultation-contracts/household-eligibility-household.json",
-    );
-    let contract_bytes = std::fs::read(&contract_path).expect("Relay contract artifact reads");
-    let contract: serde_json::Value =
-        serde_json::from_slice(&contract_bytes).expect("Relay contract artifact parses");
-    assert_eq!(contract["spec"]["bounds"]["timeout_ms"], 20_000);
-    let notary: StandaloneRegistryNotaryConfig = serde_norway::from_slice(
-        &std::fs::read(output.join("private/notary/config/notary.yaml"))
-            .expect("Notary config reads"),
-    )
-    .expect("generated Notary config parses through its production model");
-    let relay = notary
-        .evidence
-        .relay
-        .as_ref()
-        .expect("combined deployment has one Relay workload");
-    let claim = notary
-        .evidence
-        .claims
-        .iter()
-        .find(|claim| claim.id == "household-category")
-        .expect("registry-backed claim");
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-        panic!("household category remains registry-backed");
-    };
-    let consultation = consultations
-        .values()
-        .next()
-        .expect("claim has one Relay consultation");
-    let input_names = consultation.inputs.keys().cloned().collect::<Vec<_>>();
-    let purpose = claim.purpose.as_deref().expect("claim purpose is explicit");
-
-    assert!(
-        registry_notary_server::relay_contract_test_support::verifies_contract_artifact(
-            &contract_bytes,
-            &consultation.profile.contract_hash,
-            &consultation.profile.id,
-            &relay.workload_client_id,
-            purpose,
-            &input_names,
-            &consultation.outputs,
-        ),
-        "Notary must activate the exact compiler-produced contract and pin"
-    );
-
-    let mut mutated: serde_json::Value =
-        serde_json::from_slice(&contract_bytes).expect("contract artifact parses");
-    mutated["spec"]["output"]["category"]["max_bytes"] = serde_json::json!(84);
-    let mutated = serde_json::to_vec(&mutated).expect("mutated envelope serializes");
-    assert!(
-        !registry_notary_server::relay_contract_test_support::verifies_contract_artifact(
-            &mutated,
-            &consultation.profile.contract_hash,
-            &consultation.profile.id,
-            &relay.workload_client_id,
-            purpose,
-            &input_names,
-            &consultation.outputs,
-        ),
-        "a contract mutation cannot activate under the prior Notary pin"
-    );
-}
-
-#[cfg(feature = "relay-contract-test-support")]
-#[test]
-fn generated_snapshot_contracts_activate_through_notary_at_the_authoring_bound() {
-    use registry_notary_core::{ClaimEvidenceMode, StandaloneRegistryNotaryConfig};
-
-    for (authored_max_bytes, expected_max_bytes) in [
-        ("256MiB", 256 * 1_024 * 1_024_u64),
-        ("512MiB", 512 * 1_024 * 1_024_u64),
-        ("1024MiB", 1_024 * 1_024 * 1_024_u64),
-    ] {
-        let temporary = tempfile::tempdir().expect("temporary directory");
-        let project = copy_project("snapshot-exact", temporary.path());
-        let entity_path = project.join("entities/people.yaml");
-        let mut entity = read_yaml(&entity_path);
-        entity["materialization"]["max_bytes"] =
-            serde_norway::Value::String(authored_max_bytes.to_string());
-        write_yaml(&entity_path, &entity);
-
-        let build = build_registry_project(&ProjectBuildOptions {
-            project_directory: project.clone(),
-            environment: "local".to_string(),
-            against: None,
-            anchor: None,
-        })
-        .expect("snapshot project builds within the authored materialization bound");
-        let output = resolve_build_output(&project, build.output.expect("build output"));
-        let contract_bytes = std::fs::read(output.join(
-            "private/relay-consultation/config/artifacts/consultation-contracts/benefits-eligibility-person.json",
-        ))
-        .expect("snapshot Relay contract reads");
-        let contract: serde_json::Value =
-            serde_json::from_slice(&contract_bytes).expect("snapshot Relay contract parses");
-        assert_eq!(
-            contract["spec"]["materialization"]["footprint"]["max_source_bytes"].as_u64(),
-            Some(expected_max_bytes)
-        );
-
-        let notary: StandaloneRegistryNotaryConfig = serde_norway::from_slice(
-            &std::fs::read(output.join("private/notary/config/notary.yaml"))
-                .expect("Notary config reads"),
-        )
-        .expect("generated Notary config parses");
-        let relay = notary.evidence.relay.as_ref().expect("Relay workload");
-        let claim = notary
-            .evidence
-            .claims
-            .iter()
-            .find(|claim| claim.id == "population-registration-status")
-            .expect("registry-backed snapshot claim");
-        let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-            panic!("snapshot claim remains registry-backed");
-        };
-        let consultation = consultations
-            .values()
-            .next()
-            .expect("one snapshot consultation");
-        let input_names = consultation.inputs.keys().cloned().collect::<Vec<_>>();
-        let purpose = claim.purpose.as_deref().expect("claim purpose");
-        assert!(
-            registry_notary_server::relay_contract_test_support::verifies_contract_artifact(
-                &contract_bytes,
-                &consultation.profile.contract_hash,
-                &consultation.profile.id,
-                &relay.workload_client_id,
-                purpose,
-                &input_names,
-                &consultation.outputs,
-            ),
-            "Notary must activate the {authored_max_bytes} compiler-produced snapshot contract"
-        );
-    }
-}
-
-#[cfg(feature = "relay-contract-test-support")]
-#[test]
-fn script_only_change_moves_the_relay_closure_without_forking_the_public_contract() {
-    use registry_notary_core::{ClaimEvidenceMode, StandaloneRegistryNotaryConfig};
-
-    let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = copy_project("dhis2-script", temporary.path());
-    let options = ProjectBuildOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        against: None,
-        anchor: None,
-    };
-    let first = build_registry_project(&options).expect("initial Script project builds");
-    let first_output = resolve_build_output(&project, first.output.expect("initial build output"));
-    let contract_relative =
-        "private/relay-consultation/config/artifacts/consultation-contracts/health-verification-health.json";
-    let pack_relative =
-        "private/relay-consultation/config/artifacts/integration-packs/health-record.json";
-    let binding_relative =
-        "private/relay-consultation/config/artifacts/private-bindings/health-verification-health.json";
-    let first_contract =
-        std::fs::read(first_output.join(contract_relative)).expect("initial contract reads");
-    let first_pack =
-        std::fs::read(first_output.join(pack_relative)).expect("initial integration pack reads");
-    let first_binding =
-        std::fs::read(first_output.join(binding_relative)).expect("initial private binding reads");
-    let notary: StandaloneRegistryNotaryConfig = serde_norway::from_slice(
-        &std::fs::read(first_output.join("private/notary/config/notary.yaml"))
-            .expect("initial Notary config reads"),
-    )
-    .expect("initial Notary config parses");
-    let relay = notary.evidence.relay.as_ref().expect("Relay workload");
-    let claim = notary
-        .evidence
-        .claims
-        .iter()
-        .find(|claim| claim.id == "tracked-entity-first-name")
-        .expect("registry-backed Script claim");
-    let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
-        panic!("Script claim remains registry-backed");
-    };
-    let consultation = consultations.values().next().expect("one consultation");
-    let first_hash = consultation.profile.contract_hash.clone();
-    let input_names = consultation.inputs.keys().cloned().collect::<Vec<_>>();
-    let purpose = claim.purpose.as_deref().expect("claim purpose");
-    assert!(
-        registry_notary_server::relay_contract_test_support::verifies_contract_artifact(
-            &first_contract,
-            &first_hash,
-            &consultation.profile.id,
-            &relay.workload_client_id,
-            purpose,
-            &input_names,
-            &consultation.outputs,
-        ),
-        "Notary accepts the initial Script contract under its generated pin"
-    );
-
-    let script_path = project.join("integrations/health-record/adapter.rhai");
-    let mut script = std::fs::read_to_string(&script_path).expect("Script reads");
-    script.push_str("\n// reviewed script-only contract change\n");
-    std::fs::write(&script_path, script).expect("Script change writes");
-    let second = build_registry_project(&options).expect("changed Script project builds");
-    let second_output =
-        resolve_build_output(&project, second.output.expect("changed build output"));
-    let second_contract =
-        std::fs::read(second_output.join(contract_relative)).expect("changed contract reads");
-    let second_pack =
-        std::fs::read(second_output.join(pack_relative)).expect("changed integration pack reads");
-    let second_binding =
-        std::fs::read(second_output.join(binding_relative)).expect("changed private binding reads");
-    let second_notary: StandaloneRegistryNotaryConfig = serde_norway::from_slice(
-        &std::fs::read(second_output.join("private/notary/config/notary.yaml"))
-            .expect("changed Notary config reads"),
-    )
-    .expect("changed Notary config parses");
-    let second_claim = second_notary
-        .evidence
-        .claims
-        .iter()
-        .find(|claim| claim.id == "tracked-entity-first-name")
-        .expect("changed Script claim");
-    let ClaimEvidenceMode::RegistryBacked {
-        consultations: second_consultations,
-    } = &second_claim.evidence_mode
-    else {
-        panic!("changed Script claim remains registry-backed");
-    };
-    let second_hash = &second_consultations
-        .values()
-        .next()
-        .expect("changed consultation")
-        .profile
-        .contract_hash;
-    assert_eq!(
-        first_hash.as_str(),
-        second_hash,
-        "a script-only implementation change must preserve an unchanged public semantic contract"
-    );
-    assert_eq!(
-        first_contract, second_contract,
-        "the public consultation contract contains semantics, not Relay implementation bytes"
-    );
-    assert_ne!(
-        first_pack, second_pack,
-        "reviewed Script bytes must remain hash-covered by the Relay integration pack"
-    );
-    assert_ne!(
-        first_binding, second_binding,
-        "the Relay private binding must move with its hash-covered integration pack"
-    );
-    assert!(
-        registry_notary_server::relay_contract_test_support::verifies_contract_artifact(
-            &second_contract,
-            &first_hash,
-            &consultation.profile.id,
-            &relay.workload_client_id,
-            purpose,
-            &input_names,
-            &consultation.outputs,
-        ),
-        "Notary verifies the unchanged public semantics while Relay verifies the changed private closure"
-    );
-}
-
 #[test]
 fn records_and_snapshot_share_one_generated_materialization() {
     let temporary = tempfile::tempdir().expect("temporary directory");
@@ -6767,112 +5565,22 @@ fn materialization_size_boundary_accepts_integer_ceiling_and_rejects_human_above
 }
 
 #[test]
-fn materialization_only_project_checks_but_emits_no_partial_governed_build() {
+fn consultation_project_rejects_an_empty_relay_allowlist() {
     let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = copy_project("relay-only-materialization", temporary.path());
-    check_registry_project(&ProjectCheckOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        explain: true,
-        against: None,
-        anchor: None,
-    })
-    .expect("materialization-only Relay project checks");
-    let error = build_registry_project(&ProjectBuildOptions {
+    let project = copy_project("custom-system", temporary.path());
+    let environment_path = project.join("environments/local.yaml");
+    let mut environment = read_yaml(&environment_path);
+    environment["relay"]["allowed_clients"] = serde_norway::Value::Sequence(Vec::new());
+    write_yaml(&environment_path, &environment);
+
+    let error = check_registry_project(&ProjectCheckOptions {
         project_directory: project.clone(),
         environment: "local".to_string(),
+        explain: false,
         against: None,
         anchor: None,
     })
-    .expect_err("materialization-only Relay project cannot emit a partial governed build");
-    let message = format!("{error:#}");
-    assert!(message.contains("governed build requires"));
-    assert!(message.contains("add deployment.notary before project build"));
-    assert!(
-        !project.join(".registry-stack/build/local").exists(),
-        "a rejected partial topology must not leave deployable-looking output"
-    );
-}
-
-#[test]
-fn relay_oidc_clients_are_separate_from_the_notary_consultation_workload() {
-    let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = copy_project("custom-system", temporary.path());
-    let inventory = inspect_project_capabilities(&ProjectCapabilityOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-    })
-    .expect("capability inventory builds");
-    let public_relay = inventory
-        .capabilities
-        .iter()
-        .find(|record| record.capability == registryctl::CapabilityId::RegistryRelayProduct)
-        .expect("public Relay capability is inventoried");
-    assert_eq!(
-        public_relay.disposition,
-        registryctl::CapabilityDisposition::DeclaredEnabledUnused
-    );
-    let build = build_registry_project(&ProjectBuildOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        against: None,
-        anchor: None,
-    })
-    .expect("combined project builds with separate Relay identities");
-    let output = resolve_build_output(&project, build.output.expect("build output"));
-    let relay = read_yaml(&output.join("private/relay-public/config/relay.yaml"));
-    let consultation_relay =
-        read_yaml(&output.join("private/relay-consultation/config/relay.yaml"));
-    let allowed_clients = relay["auth"]["oidc"]["allowed_clients"]
-        .as_sequence()
-        .expect("Relay OIDC allowed clients");
-    assert!(allowed_clients
-        .iter()
-        .any(|client| client.as_str() == Some("household-relay-client")));
-    assert!(!allowed_clients
-        .iter()
-        .any(|client| client.as_str() == Some("household-notary")));
-    let consultation_allowed_clients = consultation_relay["auth"]["oidc"]["allowed_clients"]
-        .as_sequence()
-        .expect("consultation Relay OIDC allowed clients");
-    assert_eq!(
-        consultation_allowed_clients
-            .iter()
-            .filter_map(serde_norway::Value::as_str)
-            .collect::<Vec<_>>(),
-        vec!["household-notary"]
-    );
-    assert_eq!(
-        consultation_relay["consultation"]["authorized_workload"]["client_value"].as_str(),
-        Some("household-notary")
-    );
-    assert_eq!(
-        consultation_relay["consultation"]["authorized_workload"]["principal_id"].as_str(),
-        Some("household-notary")
-    );
-    assert_ne!(
-        consultation_relay["consultation"]["authorized_workload"]["client_value"].as_str(),
-        Some("household-relay-client")
-    );
-}
-
-#[test]
-fn evidence_only_project_rejects_an_empty_public_relay_allowlist() {
-    let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = copy_project("custom-system", temporary.path());
-    let environment_path = project.join("environments/local.yaml");
-    let mut environment = read_yaml(&environment_path);
-    environment["relay"]["allowed_clients"] = serde_norway::Value::Sequence(Vec::new());
-    write_yaml(&environment_path, &environment);
-
-    let error = check_registry_project(&ProjectCheckOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        explain: false,
-        against: None,
-        anchor: None,
-    })
-    .expect_err("evidence-only project without a public Relay client must fail authoring");
+    .expect_err("consultation project without a Relay client must fail authoring");
     let report = error
         .downcast_ref::<ProjectAuthoringDiagnostics>()
         .expect("error is a typed authoring diagnostics report");
@@ -6880,11 +5588,10 @@ fn evidence_only_project_rejects_an_empty_public_relay_allowlist() {
         .diagnostics
         .iter()
         .find(|diagnostic| diagnostic.field == Some("relay.allowed_clients"))
-        .expect("empty public Relay allowlist has a focused diagnostic");
-    assert_eq!(
-        diagnostic.remediation,
-        "Add at least one intended public Relay client id. Keep the private Notary workload client only in notary_relay."
-    );
+        .expect("empty Relay allowlist has a focused diagnostic");
+    assert!(diagnostic
+        .remediation
+        .contains("Add at least one intended Relay client id."));
 
     build_registry_project(&ProjectBuildOptions {
         project_directory: project.clone(),
@@ -6892,1063 +5599,43 @@ fn evidence_only_project_rejects_an_empty_public_relay_allowlist() {
         against: None,
         anchor: None,
     })
-    .expect_err("invalid evidence-only project must not build");
+    .expect_err("invalid consultation project must not build");
     assert!(
         !project.join(".registry-stack/build/local").exists(),
-        "rejected project must not leave build output"
-    );
-}
-
-#[test]
-fn records_api_requires_an_explicit_public_relay_client() {
-    let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = copy_project("relay-only-records", temporary.path());
-    let environment_path = project.join("environments/local.yaml");
-    let mut environment = read_yaml(&environment_path);
-    environment["relay"]["allowed_clients"] = serde_norway::Value::Sequence(Vec::new());
-    write_yaml(&environment_path, &environment);
-
-    let error = check_registry_project(&ProjectCheckOptions {
-        project_directory: project,
-        environment: "local".to_string(),
-        explain: false,
-        against: None,
-        anchor: None,
-    })
-    .expect_err("records API without a public Relay client must fail authoring");
-    let report = error
-        .downcast_ref::<ProjectAuthoringDiagnostics>()
-        .expect("error is a typed authoring diagnostics report");
-    let diagnostic = report
-        .diagnostics
-        .iter()
-        .find(|diagnostic| diagnostic.field == Some("relay.allowed_clients"))
-        .expect("empty public Relay allowlist has a focused diagnostic");
-    assert_eq!(
-        diagnostic.cause,
-        "The public Relay has no admitted OpenID Connect client."
-    );
-    assert!(diagnostic.remediation.contains("Add at least one intended"));
-    assert!(diagnostic.remediation.contains("only in notary_relay"));
-}
-
-#[test]
-fn local_loopback_relay_topology_is_explicit_and_nonportable() {
-    let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = copy_project("custom-system", temporary.path());
-    let environment_path = project.join("environments/local.yaml");
-    let mut environment = read_yaml(&environment_path);
-    environment["relay"]["origin"] =
-        serde_norway::Value::String("HTTP://127.0.0.1:18080".to_string());
-    environment["relay"]["issuer"] =
-        serde_norway::Value::String("HTTP://127.0.0.1:18090".to_string());
-    environment["relay"]["jwks_url"] =
-        serde_norway::Value::String("HTTP://127.0.0.1:18090/jwks.json".to_string());
-    environment["notary_relay"]["base_url"] =
-        serde_norway::Value::String("HTTP://127.0.0.1:18081".to_string());
-    environment["notary_state"] = serde_norway::from_str(
-        "postgresql:\n  root_certificate_path: /run/secrets/notary-postgres-ca.pem\n",
-    )
-    .expect("Notary state binding parses");
-    environment["relay_state"] = serde_norway::from_str(
-        "postgresql:\n  root_certificate_path: /run/secrets/relay-postgres-ca.pem\n",
-    )
-    .expect("Relay state binding parses");
-    environment["notary_cel"] = serde_norway::from_str("worker_memory_bytes: 1073741824\n")
-        .expect("Notary CEL binding parses");
-    write_yaml(&environment_path, &environment);
-
-    let build = build_registry_project(&ProjectBuildOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        against: None,
-        anchor: None,
-    })
-    .expect("local IP-loopback Relay, issuer, and JWKS build");
-    let output = resolve_build_output(&project, build.output.expect("build output"));
-    let relay = read_yaml(&output.join("private/relay-public/config/relay.yaml"));
-    assert_eq!(
-        relay["auth"]["oidc"]["allow_dev_insecure_fetch_urls"].as_bool(),
-        Some(true)
-    );
-    let consultation_relay =
-        read_yaml(&output.join("private/relay-consultation/config/relay.yaml"));
-    assert_eq!(
-        consultation_relay["consultation"]["state_plane"]["root_certificate_path"].as_str(),
-        Some("/run/secrets/relay-postgres-ca.pem")
-    );
-    let notary = read_yaml(&output.join("private/notary/config/notary.yaml"));
-    assert_eq!(notary["state"]["storage"].as_str(), Some("postgresql"));
-    assert_eq!(
-        notary["state"]["postgresql"]["url_env"].as_str(),
-        Some("REGISTRY_NOTARY_POSTGRES_URL")
-    );
-    assert!(notary["state"]["postgresql"]
-        .get("connect_timeout_ms")
-        .is_none());
-    assert!(notary["state"]["postgresql"]
-        .get("operation_timeout_ms")
-        .is_none());
-    assert!(notary["state"]["postgresql"]
-        .get("max_connections")
-        .is_none());
-    assert_eq!(
-        notary["state"]["postgresql"]["root_certificate_path"].as_str(),
-        Some("/run/secrets/notary-postgres-ca.pem")
-    );
-    assert_eq!(
-        notary["cel"]["worker_memory_bytes"].as_u64(),
-        Some(1_073_741_824)
-    );
-    assert_eq!(
-        notary["evidence"]["relay"]["allow_insecure_localhost"].as_bool(),
-        Some(true)
-    );
-    assert_eq!(
-        notary["evidence"]["relay"]["allow_insecure_private_network"].as_bool(),
-        Some(false)
-    );
-    assert_eq!(
-        notary["evidence"]["relay"]["base_url"].as_str(),
-        Some("http://127.0.0.1:18081")
-    );
-
-    for (name, profile, origin, issuer, jwks_url, expected) in [
-        (
-            "hosted loopback",
-            "hosted_lab",
-            "http://127.0.0.1:18080",
-            "http://127.0.0.1:18090",
-            "http://127.0.0.1:18090/jwks.json",
-            "Relay origin must be an exact HTTPS origin",
-        ),
-        (
-            "local private-network",
-            "local",
-            "http://10.42.0.8:18080",
-            "http://10.42.0.9:18090",
-            "http://10.42.0.9:18090/jwks.json",
-            "Relay origin must be an exact HTTPS origin",
-        ),
-    ] {
-        let rejected_root = tempfile::tempdir().expect("rejected temporary directory");
-        let rejected = copy_project("custom-system", rejected_root.path());
-        let environment_path = rejected.join("environments/local.yaml");
-        let mut environment = read_yaml(&environment_path);
-        environment["deployment"]["profile"] = serde_norway::Value::String(profile.to_string());
-        environment["relay"]["origin"] = serde_norway::Value::String(origin.to_string());
-        environment["relay"]["issuer"] = serde_norway::Value::String(issuer.to_string());
-        environment["relay"]["jwks_url"] = serde_norway::Value::String(jwks_url.to_string());
-        write_yaml(&environment_path, &environment);
-        let error = check_registry_project(&ProjectCheckOptions {
-            project_directory: rejected,
-            environment: "local".to_string(),
-            explain: false,
-            against: None,
-            anchor: None,
-        })
-        .unwrap_err();
-        let _ = (name, expected);
-        assert_authoring_diagnostic(&error, "registryctl.authoring.environment.invalid");
-    }
-}
-
-#[test]
-fn hosted_notary_can_use_explicit_loopback_or_private_service_relay_connections() {
-    let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = copy_project("custom-system", temporary.path());
-    let environment_path = project.join("environments/local.yaml");
-    let mut environment = read_yaml(&environment_path);
-    environment["deployment"]["profile"] = serde_norway::Value::String("hosted_lab".to_string());
-    environment["notary_relay"]["base_url"] =
-        serde_norway::Value::String("http://127.0.0.1:18080".to_string());
-    environment["notary_state"] = serde_norway::from_str(
-        "postgresql:\n  root_certificate_path: /run/secrets/notary-postgres-ca.pem\n",
-    )
-    .expect("hosted Notary state binding parses");
-    write_yaml(&environment_path, &environment);
-
-    let build = build_registry_project(&ProjectBuildOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        against: None,
-        anchor: None,
-    })
-    .expect("hosted project builds with a private loopback Notary-to-Relay connection");
-    let output = resolve_build_output(&project, build.output.expect("build output"));
-    let relay = read_yaml(&output.join("private/relay-public/config/relay.yaml"));
-    assert_eq!(
-        relay["catalog"]["base_url"].as_str(),
-        Some("https://household-relay.internal.invalid")
-    );
-    let notary = read_yaml(&output.join("private/notary/config/notary.yaml"));
-    assert_eq!(
-        notary["evidence"]["relay"]["base_url"].as_str(),
-        Some("http://127.0.0.1:18080")
-    );
-    assert_eq!(
-        notary["evidence"]["relay"]["allow_insecure_localhost"].as_bool(),
-        Some(true)
-    );
-
-    let private_root = tempfile::tempdir().expect("private-service temporary directory");
-    let private = copy_project("custom-system", private_root.path());
-    let private_environment_path = private.join("environments/local.yaml");
-    let mut private_environment = read_yaml(&private_environment_path);
-    private_environment["deployment"]["profile"] =
-        serde_norway::Value::String("production".to_string());
-    private_environment["notary_relay"]["base_url"] =
-        serde_norway::Value::String("http://registry-relay-consultation:8080".to_string());
-    private_environment["notary_state"] = serde_norway::from_str(
-        "postgresql:\n  root_certificate_path: /run/secrets/notary-postgres-ca.pem\n",
-    )
-    .expect("private-service Notary state binding parses");
-    private_environment["relay_state"] = serde_norway::from_str(
-        "postgresql:\n  root_certificate_path: /run/secrets/relay-postgres-ca.pem\n",
-    )
-    .expect("private-service Relay state binding parses");
-    write_yaml(&private_environment_path, &private_environment);
-    let private_build = build_registry_project(&ProjectBuildOptions {
-        project_directory: private.clone(),
-        environment: "local".to_string(),
-        against: None,
-        anchor: None,
-    })
-    .expect("production project builds with a signed private service Relay connection");
-    let private_output =
-        resolve_build_output(&private, private_build.output.expect("build output"));
-    let private_notary = read_yaml(&private_output.join("private/notary/config/notary.yaml"));
-    assert_eq!(
-        private_notary["evidence"]["relay"]["allow_insecure_private_network"].as_bool(),
-        Some(true)
-    );
-    assert_eq!(
-        private_notary["evidence"]["relay"]["allow_insecure_localhost"].as_bool(),
-        Some(false)
-    );
-
-    let rejected_root = tempfile::tempdir().expect("rejected temporary directory");
-    let rejected = copy_project("custom-system", rejected_root.path());
-    let rejected_environment_path = rejected.join("environments/local.yaml");
-    let mut rejected_environment = read_yaml(&rejected_environment_path);
-    rejected_environment["notary_relay"]["base_url"] =
-        serde_norway::Value::String("http://10.42.0.8:8080".to_string());
-    write_yaml(&rejected_environment_path, &rejected_environment);
-    let error = check_registry_project(&ProjectCheckOptions {
-        project_directory: rejected,
-        environment: "local".to_string(),
-        explain: false,
-        against: None,
-        anchor: None,
-    })
-    .expect_err("private IP cleartext Notary-to-Relay URL must fail authoring");
-    assert_authoring_diagnostic(&error, "registryctl.authoring.environment.invalid");
-}
-
-#[test]
-fn issuance_accepts_a_full_verification_method_kid() {
-    let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = copy_project("custom-system", temporary.path());
-    let environment_path = project.join("environments/local.yaml");
-    let mut environment = read_yaml(&environment_path);
-    let kid = "did:web:household-notary.invalid#issuer-key-1";
-    environment["issuance"]["signing_kid"] = serde_norway::Value::String(kid.to_string());
-    write_yaml(&environment_path, &environment);
-
-    let build = build_registry_project(&ProjectBuildOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        against: None,
-        anchor: None,
-    })
-    .expect("a full verification-method kid builds");
-    let output = resolve_build_output(&project, build.output.expect("build output"));
-    let notary = read_yaml(&output.join("private/notary/config/notary.yaml"));
-    assert_eq!(
-        notary["evidence"]["signing_keys"]["project-issuer"]["kid"].as_str(),
-        Some(kid)
-    );
-
-    let rejected_root = tempfile::tempdir().expect("rejected temporary directory");
-    let rejected = copy_project("custom-system", rejected_root.path());
-    let environment_path = rejected.join("environments/local.yaml");
-    let mut environment = read_yaml(&environment_path);
-    environment["issuance"]["signing_kid"] =
-        serde_norway::Value::String("did:web:issuer.invalid#bad kid".to_string());
-    write_yaml(&environment_path, &environment);
-    let error = check_registry_project(&ProjectCheckOptions {
-        project_directory: rejected,
-        environment: "local".to_string(),
-        explain: false,
-        against: None,
-        anchor: None,
-    })
-    .unwrap_err();
-    assert_authoring_diagnostic(&error, "registryctl.authoring.environment.invalid");
-}
-
-#[test]
-fn authored_oid4vci_binding_generates_the_complete_notary_owned_issuer() {
-    let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = copy_project("custom-system", temporary.path());
-    let project_path = project.join("registry-stack.yaml");
-    let mut document = read_yaml(&project_path);
-    document["services"]["household-eligibility"]["credential_profiles"]["household-eligibility"]
-        ["claims"] = serde_norway::from_str("[household-record-exists]")
-        .expect("single registry-backed credential claim");
-    write_yaml(&project_path, &document);
-    author_oid4vci_binding(
-        &project,
-        "household-eligibility",
-        "household-eligibility",
-        "household_reference",
-    );
-    let baseline_build = build_registry_project(&ProjectBuildOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        against: None,
-        anchor: None,
-    })
-    .expect("OID4VCI project without registrar clients remains compatible");
-    let baseline_output = resolve_build_output(
-        &project,
-        baseline_build.output.expect("baseline build output"),
-    );
-    let baseline_approval: serde_json::Value = serde_json::from_slice(
-        &std::fs::read(baseline_output.join("private/notary/approval/project-state.json"))
-            .expect("baseline approval state reads"),
-    )
-    .expect("baseline approval state parses");
-    merge_environment_yaml(
-        &project.join("environments/local.yaml"),
-        "oid4vci:\n  registrar_clients: [benefits-service]\n",
-    );
-
-    let build = build_registry_project(&ProjectBuildOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        against: None,
-        anchor: None,
-    })
-    .expect("typed OID4VCI authority project builds through the production validator");
-    let output = resolve_build_output(&project, build.output.expect("build output"));
-    let notary = read_yaml(&output.join("private/notary/config/notary.yaml"));
-    let approval: serde_json::Value = serde_json::from_slice(
-        &std::fs::read(output.join("private/notary/approval/project-state.json"))
-            .expect("registrar approval state reads"),
-    )
-    .expect("registrar approval state parses");
-
-    assert_ne!(
-        baseline_approval["semantic_digests"]["operator_security"],
-        approval["semantic_digests"]["operator_security"],
-        "registrar trust must alter operator-security review semantics"
-    );
-    assert_eq!(
-        baseline_approval["semantic_digests"]["claim"], approval["semantic_digests"]["claim"],
-        "registrar trust must not alter claim semantics"
-    );
-    let baseline_trust = baseline_approval["promotion_projection"]["fields"]
-        .as_array()
-        .expect("baseline promotion fields are an array")
-        .iter()
-        .find(|field| field["kind"].as_str() == Some("trust"))
-        .expect("baseline trust promotion field exists");
-    let registrar_trust = approval["promotion_projection"]["fields"]
-        .as_array()
-        .expect("registrar promotion fields are an array")
-        .iter()
-        .find(|field| field["kind"].as_str() == Some("trust"))
-        .expect("registrar trust promotion field exists");
-    assert_ne!(
-        baseline_trust["digest"], registrar_trust["digest"],
-        "registrar clients must be projected as trust"
-    );
-    assert_eq!(
-        registrar_trust["authority_members"]
-            .as_array()
-            .expect("registrar trust authority members")
-            .len(),
-        baseline_trust["authority_members"]
-            .as_array()
-            .expect("baseline trust authority members")
-            .len()
-            + 1
-    );
-
-    assert_eq!(
-        notary["instance"]["public_base_url"].as_str(),
-        Some("https://notary.example.invalid")
-    );
-    assert_eq!(
-        notary["evidence"]["api_base_url"].as_str(),
-        Some("https://notary.example.invalid")
-    );
-    assert!(notary["auth"].get("mode").is_none());
-    assert_eq!(
-        notary["auth"]["api_keys"][0]["id"].as_str(),
-        Some("benefits-service")
-    );
-    assert_eq!(
-        notary["auth"]["oidc"]["issuer"].as_str(),
-        Some("https://esignet.example.invalid")
-    );
-    assert_eq!(
-        notary["auth"]["oidc"]["audiences"],
-        serde_norway::from_str::<serde_norway::Value>(
-            "[example-wallet-client, https://notary.example.invalid]"
-        )
-        .expect("OIDC audiences parse")
-    );
-    assert_eq!(
-        notary["auth"]["oidc"]["allowed_clients"],
-        serde_norway::from_str::<serde_norway::Value>("[example-wallet-client, benefits-service]")
-            .expect("OIDC clients parse")
-    );
-    assert_eq!(
-        notary["auth"]["oidc"]["allowed_token_types"],
-        serde_norway::from_str::<serde_norway::Value>("[JWT]")
-            .expect("OIDC access-token types parse")
-    );
-    assert_eq!(
-        notary["auth"]["access_token_signing"]["signing_key_id"].as_str(),
-        Some("oid4vci-access-token")
-    );
-    assert_eq!(
-        notary["evidence"]["signing_keys"]["oid4vci-access-token"]["private_jwk_env"].as_str(),
-        Some("OID4VCI_ACCESS_TOKEN_JWK")
-    );
-    assert_eq!(
-        notary["evidence"]["signing_keys"]["project-issuer"]["alg"].as_str(),
-        Some("EdDSA")
-    );
-    assert_eq!(
-        notary["evidence"]["signing_keys"]["oid4vci-esignet-client"]["alg"].as_str(),
-        Some("RS256")
-    );
-    assert_eq!(
-        notary["state"]["postgresql"]["sensitive_state_key_env"].as_str(),
-        Some("OID4VCI_SENSITIVE_STATE_KEY")
-    );
-    assert_eq!(
-        notary["evidence"]["credential_profiles"]["household-eligibility.household-eligibility"]
-            ["holder_binding"]["proof_of_possession"]
-            .as_str(),
-        Some("required")
-    );
-    let registry_claim = notary["evidence"]["claims"]
-        .as_sequence()
-        .expect("generated claims")
-        .iter()
-        .find(|claim| claim["id"].as_str() == Some("household-record-exists"))
-        .expect("selected registry-backed claim");
-    assert_eq!(
-        registry_claim["evidence_mode"]["type"].as_str(),
-        Some("registry_backed")
-    );
-    assert_eq!(
-        registry_claim["evidence_mode"]["consultations"]["household"]["inputs"]
-            ["household_reference"]
-            .as_str(),
-        Some("request.target.identifiers.household_reference")
-    );
-    assert_eq!(
-        notary["subject_access"]["allowed_claims"][0].as_str(),
-        Some("household-record-exists")
-    );
-    assert_eq!(
-        notary["subject_access"]["allowed_formats"],
-        serde_norway::from_str::<serde_norway::Value>(
-            "[application/vnd.registry-notary.claim-result+json]"
-        )
-        .expect("canonical evaluation format parses")
-    );
-    assert_eq!(
-        notary["subject_access"]["allowed_wallet_origins"][0].as_str(),
-        Some("https://wallet.example.invalid")
-    );
-    assert_eq!(
-        notary["subject_access"]["citizen_clients"]["allowed_client_ids"],
-        serde_norway::from_str::<serde_norway::Value>("[example-wallet-client]")
-            .expect("citizen client ids parse")
-    );
-    assert_eq!(
-        notary["subject_access"]["citizen_clients"]["allowed_audiences"],
-        serde_norway::from_str::<serde_norway::Value>("[example-wallet-client]")
-            .expect("citizen audiences parse")
-    );
-    assert_eq!(
-        notary["subject_access"]["allowed_operations"]["evaluate"].as_bool(),
-        Some(false)
-    );
-    assert_eq!(
-        notary["oid4vci"]["credential_endpoint"].as_str(),
-        Some("https://notary.example.invalid/oid4vci/credential")
-    );
-    assert_eq!(
-        notary["oid4vci"]["pre_authorized_code"]["esignet"]["redirect_uri"].as_str(),
-        Some("https://notary.example.invalid/oid4vci/offer/callback")
-    );
-    assert_eq!(
-        notary["oid4vci"]["pre_authorized_code"]["tx_code"]["required"].as_bool(),
-        Some(true)
-    );
-    assert_eq!(
-        notary["oid4vci"]["credential_configurations"]
-            ["household-eligibility.household-eligibility"]["vct"]
-            .as_str(),
-        Some("https://notary.example.invalid/credentials/household-eligibility/v1")
-    );
-    assert_eq!(
-        notary["oid4vci"]["credential_configurations"]
-            ["household-eligibility.household-eligibility"]["scope"]
-            .as_str(),
-        Some("evidence:household:read")
-    );
-}
-
-#[test]
-fn authored_oid4vci_walt_profile_is_explicit_and_keeps_the_bearer_window_bounded() {
-    let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = copy_project("custom-system", temporary.path());
-    let project_path = project.join("registry-stack.yaml");
-    let mut document = read_yaml(&project_path);
-    document["services"]["household-eligibility"]["credential_profiles"]["household-eligibility"]
-        ["claims"] =
-        serde_norway::from_str("[household-record-exists]").expect("single registry-backed claim");
-    write_yaml(&project_path, &document);
-    author_oid4vci_binding(
-        &project,
-        "household-eligibility",
-        "household-eligibility",
-        "household_reference",
-    );
-    merge_environment_yaml(
-        &project.join("environments/local.yaml"),
-        "issuance:\n  algorithm: ES256\noid4vci:\n  tx_code:\n    required: false\n",
-    );
-
-    let build = build_registry_project(&ProjectBuildOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        against: None,
-        anchor: None,
-    })
-    .expect("explicit Walt-compatible binding builds");
-    let output = resolve_build_output(&project, build.output.expect("build output"));
-    let notary = read_yaml(&output.join("private/notary/config/notary.yaml"));
-    assert_eq!(
-        notary["evidence"]["signing_keys"]["project-issuer"]["alg"].as_str(),
-        Some("ES256")
-    );
-    assert_eq!(
-        notary["oid4vci"]["pre_authorized_code"]["tx_code"]["required"].as_bool(),
-        Some(false)
-    );
-    assert_eq!(
-        notary["oid4vci"]["pre_authorized_code"]["pre_authorized_code_ttl_seconds"].as_u64(),
-        Some(300)
-    );
-}
-
-#[test]
-fn authored_representative_oid4vci_builds_the_exact_status_enabled_policy() {
-    let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = copy_project("custom-system", temporary.path());
-    author_oid4vci_binding(
-        &project,
-        "household-eligibility",
-        "household-eligibility",
-        "representative_reference",
-    );
-    author_representative_oid4vci_binding(&project, "representative_reference");
-    merge_environment_yaml(
-        &project.join("environments/local.yaml"),
-        "oid4vci:\n  representative_issuance:\n    max_proof_age_seconds: 180\n",
-    );
-
-    let tested = test_registry_project(&ProjectTestOptions {
-        project_directory: project.clone(),
-        environment: Some("local".to_string()),
-    })
-    .expect("representative requester fixture passes the offline developer journey");
-    assert_eq!(tested.status, "passed");
-
-    let build = build_registry_project(&ProjectBuildOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        against: None,
-        anchor: None,
-    })
-    .expect("representative OID4VCI golden project builds through the production validator");
-    let output = resolve_build_output(&project, build.output.expect("build output"));
-    let notary = read_yaml(&output.join("private/notary/config/notary.yaml"));
-    let relationship = &notary["subject_access"]["delegation"]["allowed_relationships"][0];
-    assert!(
-        notary["subject_access"]["allowed_claims"]
-            .as_sequence()
-            .is_some_and(Vec::is_empty),
-        "a representative-only root must not become subject-bound authority"
-    );
-    assert_eq!(
-        relationship["relationship_type"].as_str(),
-        Some("authorized-representative")
-    );
-    assert_eq!(
-        relationship["proof_claim"].as_str(),
-        Some("household-record-exists")
-    );
-    assert_eq!(
-        relationship["target_id_type"].as_str(),
-        Some("household_reference")
-    );
-    assert_eq!(relationship["max_proof_age_seconds"].as_u64(), Some(180));
-    assert_eq!(
-        notary["subject_access"]["token_policy"]["max_evaluation_age_seconds"].as_u64(),
-        Some(300),
-        "a narrower relationship-proof window must not narrow unrelated evaluation policy"
-    );
-    assert_eq!(
-        notary["subject_access"]["allowed_operations"]["evaluate"].as_bool(),
-        Some(true)
-    );
-    assert_eq!(
-        notary["oid4vci"]["credential_configurations"]
-            ["household-eligibility.household-eligibility"]["representative_issuance"]["ceremony"]
-            .as_str(),
-        Some("digitally_authenticated_representative")
-    );
-    assert_eq!(
-        notary["oid4vci"]["credential_configurations"]
-            ["household-eligibility.household-eligibility"]["representative_issuance"]
-            ["relationship"]
-            .as_str(),
-        Some("authorized-representative")
-    );
-    assert_eq!(notary["credential_status"]["enabled"].as_bool(), Some(true));
-    assert_eq!(
-        notary["credential_status"]["base_url"].as_str(),
-        Some("https://notary.example.invalid")
-    );
-    let root = notary["evidence"]["claims"]
-        .as_sequence()
-        .expect("generated claims")
-        .iter()
-        .find(|claim| claim["id"].as_str() == Some("source-household-approval-decision"))
-        .expect("representative credential root");
-    assert_eq!(
-        root["depends_on"],
-        serde_norway::from_str::<serde_norway::Value>("[household-record-exists]")
-            .expect("claim dependency parses")
-    );
-}
-
-#[test]
-fn authored_representative_oid4vci_rejects_non_person_requester_fixtures() {
-    let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = copy_project("custom-system", temporary.path());
-    author_oid4vci_binding(
-        &project,
-        "household-eligibility",
-        "household-eligibility",
-        "representative_reference",
-    );
-    author_representative_oid4vci_binding(&project, "representative_reference");
-
-    let mut changed_fixture = false;
-    for entry in std::fs::read_dir(project.join("integrations/eligibility/fixtures"))
-        .expect("fixture directory reads")
-    {
-        let path = entry.expect("fixture entry").path();
-        let mut fixture = read_yaml(&path);
-        if fixture.get("request").is_none() {
-            continue;
-        }
-        fixture["request"]["requester"]["type"] =
-            serde_norway::Value::String("Organisation".to_string());
-        write_yaml(&path, &fixture);
-        changed_fixture = true;
-        break;
-    }
-    assert!(changed_fixture, "representative request fixture exists");
-
-    let error = test_registry_project(&ProjectTestOptions {
-        project_directory: project,
-        environment: Some("local".to_string()),
-    })
-    .expect_err("non-person representative requester must be rejected");
-    assert!(
-        format!("{error:#}").contains("request_to_consultation_binding_invalid"),
-        "{error:#}"
-    );
-}
-
-#[test]
-fn representative_oid4vci_rejects_registrar_clients_with_a_clear_fix() {
-    let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = copy_project("custom-system", temporary.path());
-    author_oid4vci_binding(
-        &project,
-        "household-eligibility",
-        "household-eligibility",
-        "representative_reference",
-    );
-    author_representative_oid4vci_binding(&project, "representative_reference");
-    merge_environment_yaml(
-        &project.join("environments/local.yaml"),
-        "oid4vci:\n  registrar_clients: [benefits-service]\n",
-    );
-
-    let error = check_registry_project(&ProjectCheckOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        explain: false,
-        against: None,
-        anchor: None,
-    })
-    .expect_err("one Registryctl credential binding cannot use both authorities");
-    assert!(
-        format!("{error:#}").contains(
-            "Representative issuance and registrar-created offers select incompatible authorities"
-        ),
-        "{error:#}"
-    );
-
-    let report = authoring_diagnostics(&project);
-    let diagnostic = report
-        .diagnostics
-        .iter()
-        .find(|diagnostic| {
-            diagnostic.cause
-                == "Representative issuance and registrar-created offers select incompatible authorities in Registryctl's single-credential binding."
-        })
-        .unwrap_or_else(|| panic!("missing authority diagnostic: {report:#?}"));
-    assert_eq!(
-        diagnostic.remediation,
-        "Remove registrar_clients, or use a separate environment and Notary deployment for the registrar-created credential."
-    );
-    for pointer in [
-        "/oid4vci/registrar_clients",
-        "/oid4vci/representative_issuance",
-    ] {
-        assert!(
-            diagnostic
-                .addresses
-                .iter()
-                .any(|address| address.file == "environments/local.yaml"
-                    && address.pointer == pointer)
-        );
-    }
-}
-
-#[test]
-fn representative_oid4vci_diagnostics_name_the_invalid_authoring_field_and_fix() {
-    let prepare = || {
-        let temporary = tempfile::tempdir().expect("representative diagnostic directory");
-        let project = copy_project("custom-system", temporary.path());
-        author_oid4vci_binding(
-            &project,
-            "household-eligibility",
-            "household-eligibility",
-            "household_reference",
-        );
-        author_representative_oid4vci_binding(&project, "household_reference");
-        (temporary, project)
-    };
-
-    let (unknown_root, unknown_project) = prepare();
-    let environment_path = unknown_project.join("environments/local.yaml");
-    let mut environment = read_yaml(&environment_path);
-    environment["oid4vci"]["representative_issuance"]["proof_claim"] =
-        serde_norway::Value::String("missing-relationship-proof".to_string());
-    write_yaml(&environment_path, &environment);
-    let report = authoring_diagnostics(&unknown_project);
-    let diagnostic = report
-        .diagnostics
-        .iter()
-        .find(|diagnostic| {
-            diagnostic.cause
-                == "The representative proof claim does not exist in the selected credential service."
-        })
-        .unwrap_or_else(|| panic!("missing proof-claim diagnostic: {report:#?}"));
-    assert_eq!(
-        diagnostic.remediation,
-        "Set proof_claim to a registry-backed claim in the same service as the credential profile."
-    );
-    assert!(diagnostic.addresses.iter().any(|address| {
-        address.file == "environments/local.yaml"
-            && address.pointer == "/oid4vci/representative_issuance/proof_claim"
-    }));
-    drop(unknown_root);
-
-    let (_mapping_root, mapping_project) = prepare();
-    let project_path = mapping_project.join("registry-stack.yaml");
-    let mut project = read_yaml(&project_path);
-    project["services"]["household-eligibility"]["consultations"]["household"]["input"]
-        .as_mapping_mut()
-        .expect("consultation input")
-        .remove(serde_norway::Value::String(
-            "representative_reference".to_string(),
-        ));
-    write_yaml(&project_path, &project);
-    let report = authoring_diagnostics(&mapping_project);
-    let diagnostic = report
-        .diagnostics
-        .iter()
-        .find(|diagnostic| {
-            diagnostic.cause
-                == "The relationship-proof consultation does not bind the authenticated representative."
-        })
-        .unwrap_or_else(|| panic!("missing requester-binding diagnostic: {report:#?}"));
-    assert!(diagnostic
-        .remediation
-        .contains("request.requester.identifiers.<oid4vci subject id_type>"));
-    assert!(diagnostic.addresses.iter().any(|address| {
-        address.file == "registry-stack.yaml"
-            && address.pointer == "/services/household-eligibility/consultations/household/input"
-    }));
-
-    let (_target_root, target_project) = prepare();
-    let project_path = target_project.join("registry-stack.yaml");
-    let mut project = read_yaml(&project_path);
-    project["services"]["household-eligibility"]["consultations"]["household"]["input"]
-        .as_mapping_mut()
-        .expect("consultation input")
-        .remove(serde_norway::Value::String(
-            "household_reference".to_string(),
-        ));
-    write_yaml(&project_path, &project);
-    let report = authoring_diagnostics(&target_project);
-    let diagnostic = report
-        .diagnostics
-        .iter()
-        .find(|diagnostic| {
-            diagnostic.cause
-                == "The relationship-proof consultation does not bind the represented subject."
-        })
-        .unwrap_or_else(|| panic!("missing target-binding diagnostic: {report:#?}"));
-    assert!(diagnostic
-        .remediation
-        .contains("request.target.identifiers.<representative_issuance target_id_type>"));
-    assert!(diagnostic.addresses.iter().any(|address| {
-        address.file == "environments/local.yaml"
-            && address.pointer == "/oid4vci/representative_issuance/target_id_type"
-    }));
-
-    let (_extra_input_root, extra_input_project) = prepare();
-    let project_path = extra_input_project.join("registry-stack.yaml");
-    let mut project = read_yaml(&project_path);
-    project["services"]["household-eligibility"]["consultations"]["household"]["input"]
-        ["relationship_kind"] =
-        serde_norway::Value::String("request.target.attributes.relationship_kind".to_string());
-    write_yaml(&project_path, &project);
-    let report = authoring_diagnostics(&extra_input_project);
-    let diagnostic = report
-        .diagnostics
-        .iter()
-        .find(|diagnostic| {
-            diagnostic.cause
-                == "The relationship-proof consultation requires an input that the target-selection ceremony cannot supply."
-        })
-        .unwrap_or_else(|| panic!("unavailable ceremony-input diagnostic: {report:#?}"));
-    assert!(diagnostic.remediation.contains("exactly two"));
-    assert!(diagnostic.addresses.iter().any(|address| {
-        address.file == "registry-stack.yaml"
-            && address.pointer
-                == "/services/household-eligibility/consultations/household/input/relationship_kind"
-    }));
-
-    let (_shared_root, shared_project) = prepare();
-    let project_path = shared_project.join("registry-stack.yaml");
-    let mut project = read_yaml(&project_path);
-    project["services"]["household-eligibility"]["credential_profiles"]["ordinary-household"] =
-        serde_norway::from_str(
-            r#"format: dc+sd-jwt
-type: https://notary.example.invalid/credentials/ordinary-household/v1
-validity: 5m
-claims: [source-household-approval-decision]
-"#,
-        )
-        .expect("shared credential profile");
-    write_yaml(&project_path, &project);
-    let report = authoring_diagnostics(&shared_project);
-    let diagnostic = report
-        .diagnostics
-        .iter()
-        .find(|diagnostic| {
-            diagnostic.cause
-                == "The representative credential claim is shared by another credential profile."
-        })
-        .unwrap_or_else(|| panic!("shared representative-root diagnostic: {report:#?}"));
-    assert!(diagnostic.remediation.contains("exclusive"));
-    assert!(diagnostic.addresses.iter().any(|address| {
-        address.file == "environments/local.yaml"
-            && address.pointer == "/oid4vci/credential/profile"
-    }));
-    assert!(diagnostic.addresses.iter().any(|address| {
-        address.file == "registry-stack.yaml"
-            && address.pointer
-                == "/services/household-eligibility/credential_profiles/ordinary-household/claims"
-    }));
-}
-
-#[test]
-fn authored_oid4vci_binding_rejects_open_or_incoherent_trust_topologies() {
-    for (name, mutate, expected) in [
-        (
-            "unknown credential profile",
-            "oid4vci:\n  credential:\n    profile: absent-profile\n",
-            "OID4VCI references an unknown credential profile",
-        ),
-        (
-            "cross-origin token endpoint",
-            "oid4vci:\n  authorization_server:\n    token_url: https://attacker.invalid/token\n",
-            "OID4VCI authorization server token URL must use its bound origin",
-        ),
-        (
-            "non-callback redirect",
-            "oid4vci:\n  redirect_uri: https://notary.example.invalid/other-callback\n",
-            "OID4VCI redirect URI must be the public Notary offer callback",
-        ),
-        (
-            "reused issuer key",
-            "oid4vci:\n  access_token:\n    signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }\n",
-            "OID4VCI issuer, client, and access-token signing keys must be distinct",
-        ),
-        (
-            "missing PostgreSQL state",
-            "notary_state: null\n",
-            "OID4VCI requires a Notary PostgreSQL state binding",
-        ),
-        (
-            "invalid registrar client",
-            "oid4vci:\n  registrar_clients: ['']\n",
-            "OID4VCI registrar client id must not be empty",
-        ),
-        (
-            "duplicate registrar client",
-            "oid4vci:\n  registrar_clients: [registrar-a, registrar-a]\n",
-            "OID4VCI registrar_clients must not contain duplicates",
-        ),
-        (
-            "citizen client reused as registrar",
-            "oid4vci:\n  registrar_clients: [example-wallet-client]\n",
-            "OID4VCI registrar_clients must not contain the citizen client id",
-        ),
-    ] {
-        let temporary = tempfile::tempdir().expect("temporary directory");
-        let project = copy_project("custom-system", temporary.path());
-        let project_path = project.join("registry-stack.yaml");
-        let mut document = read_yaml(&project_path);
-        document["services"]["household-eligibility"]["credential_profiles"]
-            ["household-eligibility"]["claims"] =
-            serde_norway::from_str("[household-record-exists]")
-                .expect("single registry-backed credential claim");
-        write_yaml(&project_path, &document);
-        author_oid4vci_binding(
-            &project,
-            "household-eligibility",
-            "household-eligibility",
-            "household_reference",
-        );
-        merge_environment_yaml(&project.join("environments/local.yaml"), mutate);
-        let error = check_registry_project(&ProjectCheckOptions {
-            project_directory: project,
-            environment: "local".to_string(),
-            explain: false,
-            against: None,
-            anchor: None,
-        })
-        .expect_err("incoherent OID4VCI binding must fail closed");
-        let _ = (name, expected);
-        assert_authoring_diagnostic(&error, "registryctl.authoring.environment.invalid");
-    }
-
-    let temporary = tempfile::tempdir().expect("oversized registrar-client temporary directory");
-    let project = copy_project("custom-system", temporary.path());
-    let project_path = project.join("registry-stack.yaml");
-    let mut document = read_yaml(&project_path);
-    document["services"]["household-eligibility"]["credential_profiles"]["household-eligibility"]
-        ["claims"] = serde_norway::from_str("[household-record-exists]")
-        .expect("single registry-backed credential claim");
-    write_yaml(&project_path, &document);
-    author_oid4vci_binding(
-        &project,
-        "household-eligibility",
-        "household-eligibility",
-        "household_reference",
-    );
-    let registrar_clients = (0..65)
-        .map(|index| serde_norway::Value::String(format!("registrar-{index}")))
-        .collect::<Vec<_>>();
-    let environment_path = project.join("environments/local.yaml");
-    let mut environment = read_yaml(&environment_path);
-    environment["oid4vci"]["registrar_clients"] = serde_norway::Value::Sequence(registrar_clients);
-    write_yaml(&environment_path, &environment);
-    let error = check_registry_project(&ProjectCheckOptions {
-        project_directory: project,
-        environment: "local".to_string(),
-        explain: false,
-        against: None,
-        anchor: None,
-    })
-    .expect_err("oversized registrar-client trust must fail closed");
-    assert_authoring_diagnostic(&error, "registryctl.authoring.environment.invalid");
-
-    for (name, scopes, expected) in [
-        (
-            "no access scope",
-            "[]",
-            "caller scopes must contain between one and 16 entries",
-        ),
-        (
-            "multiple access scopes",
-            "[evidence:household:read, evidence:household:issue]",
-            "OID4VCI credential service must declare exactly one access scope",
-        ),
-    ] {
-        let temporary = tempfile::tempdir().expect("access-scope temporary directory");
-        let project = copy_project("custom-system", temporary.path());
-        let project_path = project.join("registry-stack.yaml");
-        let mut document = read_yaml(&project_path);
-        document["services"]["household-eligibility"]["credential_profiles"]
-            ["household-eligibility"]["claims"] =
-            serde_norway::from_str("[household-record-exists]")
-                .expect("single registry-backed claim");
-        document["services"]["household-eligibility"]["access"]["scopes"] =
-            serde_norway::from_str(scopes).expect("access scopes");
-        write_yaml(&project_path, &document);
-        author_oid4vci_binding(
-            &project,
-            "household-eligibility",
-            "household-eligibility",
-            "household_reference",
-        );
-        let environment_path = project.join("environments/local.yaml");
-        let mut environment = read_yaml(&environment_path);
-        environment
-            .as_mapping_mut()
-            .expect("environment mapping")
-            .remove(serde_norway::Value::String("callers".to_string()));
-        write_yaml(&environment_path, &environment);
-        let error = check_registry_project(&ProjectCheckOptions {
-            project_directory: project,
-            environment: "local".to_string(),
-            explain: false,
-            against: None,
-            anchor: None,
-        })
-        .expect_err("OID4VCI service without exactly one access scope must fail closed");
-        let _ = expected;
-        assert_authoring_diagnostic(
-            &error,
-            if name == "no access scope" {
-                "registryctl.authoring.project.invalid"
-            } else {
-                "registryctl.authoring.environment.invalid"
-            },
-        );
-    }
+        "rejected project must not leave build output"
+    );
+}
+
+#[test]
+fn records_api_requires_an_explicit_public_relay_client() {
+    let temporary = tempfile::tempdir().expect("temporary directory");
+    let project = copy_project("relay-only-records", temporary.path());
+    let environment_path = project.join("environments/local.yaml");
+    let mut environment = read_yaml(&environment_path);
+    environment["relay"]["allowed_clients"] = serde_norway::Value::Sequence(Vec::new());
+    write_yaml(&environment_path, &environment);
+
+    let error = check_registry_project(&ProjectCheckOptions {
+        project_directory: project,
+        environment: "local".to_string(),
+        explain: false,
+        against: None,
+        anchor: None,
+    })
+    .expect_err("records API without a public Relay client must fail authoring");
+    let report = error
+        .downcast_ref::<ProjectAuthoringDiagnostics>()
+        .expect("error is a typed authoring diagnostics report");
+    let diagnostic = report
+        .diagnostics
+        .iter()
+        .find(|diagnostic| diagnostic.field == Some("relay.allowed_clients"))
+        .expect("empty public Relay allowlist has a focused diagnostic");
+    assert_eq!(
+        diagnostic.cause,
+        "The public Relay has no admitted OpenID Connect client."
+    );
+    assert!(diagnostic.remediation.contains("Add at least one intended"));
 }
 
 #[test]
@@ -8132,8 +5819,8 @@ fn records_provider_change_requires_a_new_generation() {
     let (baseline, anchor) = create_and_sign_test_lane_baseline(
         temporary.path(),
         "records",
-        ProductAcceptanceLaneV1::Notary,
-        &output.join("signing-inputs/notary"),
+        ProductAcceptanceLaneV1::RelayPublic,
+        &output.join("signing-inputs/relay-public"),
         &private_key,
         &public_key,
     );
@@ -8174,168 +5861,6 @@ fn records_provider_change_requires_a_new_generation() {
         .any(|change| change.dimension == "operator_security"));
 }
 
-#[test]
-fn every_required_golden_builds_registry_backed_notary_without_transitional_sources() {
-    let project_names = [
-        "custom-system",
-        "dhis2-tracker",
-        "dhis2-script",
-        "fhir-r4-coverage-active",
-        "opencrvs",
-        "opencrvs-events-api",
-        "opencrvs-country-variant",
-        "openspp-exact",
-        "snapshot-exact",
-        "snapshot-with-records",
-    ];
-    for project_name in project_names {
-        let temporary = tempfile::tempdir().expect("temporary directory");
-        let project = copy_project(project_name, temporary.path());
-        let check = check_registry_project(&ProjectCheckOptions {
-            project_directory: project.clone(),
-            environment: "local".to_string(),
-            explain: true,
-            against: None,
-            anchor: None,
-        })
-        .unwrap_or_else(|error| panic!("{project_name} check failed: {error:#}"));
-        assert_eq!(check.status, "valid", "{project_name}");
-        assert_eq!(check.baseline, "initial_without_baseline", "{project_name}");
-        assert!(check.explanation.is_some(), "{project_name}");
-
-        let build = build_registry_project(&ProjectBuildOptions {
-            project_directory: project.clone(),
-            environment: "local".to_string(),
-            against: None,
-            anchor: None,
-        })
-        .unwrap_or_else(|error| panic!("{project_name} build failed: {error:#}"));
-        let output = resolve_build_output(&project, build.output.expect("build output"));
-        assert!(output.join("reviewable/review.json").is_file());
-        assert!(output
-            .join("private/relay-public/approval/project-state.json")
-            .is_file());
-        assert!(output
-            .join("private/relay-public/config/relay.yaml")
-            .is_file());
-        assert!(output
-            .join("private/relay-consultation/approval/project-state.json")
-            .is_file());
-        assert!(output
-            .join("private/relay-consultation/config/relay.yaml")
-            .is_file());
-        let notary_config_path = output.join("private/notary/config/notary.yaml");
-        let notary_config = std::fs::read_to_string(&notary_config_path)
-            .unwrap_or_else(|error| panic!("{}: {error}", notary_config_path.display()));
-        for forbidden in [
-            "transitional_direct",
-            "source_connections",
-            "source_bindings",
-        ] {
-            assert!(
-                !notary_config.contains(forbidden),
-                "{project_name} generated Notary config must not contain {forbidden}"
-            );
-        }
-        for product in ["relay-public", "relay-consultation", "notary"] {
-            assert!(output
-                .join(format!("private/{product}/descriptors/operations.json"))
-                .is_file());
-            assert!(output
-                .join(format!(
-                    "private/{product}/descriptors/secret-consumers.json"
-                ))
-                .is_file());
-        }
-        let review_bytes =
-            std::fs::read(output.join("reviewable/review.json")).expect("human review reads");
-        let review: serde_json::Value =
-            serde_json::from_slice(&review_bytes).expect("human review parses");
-        assert_public_review_has_only_contract_hashes(&review);
-        for product in ["relay-public", "relay-consultation", "notary"] {
-            assert_eq!(
-                std::fs::read(output.join(format!("private/{product}/approval/review.json")))
-                    .expect("signed review input reads"),
-                review_bytes,
-                "{project_name} {product} approval carries the exact human review"
-            );
-        }
-        assert_eq!(
-            std::fs::read(output.join("private/relay-public/approval/project-state.json"))
-                .expect("Relay approval state reads"),
-            std::fs::read(output.join("private/relay-consultation/approval/project-state.json"))
-                .expect("consultation Relay approval state reads"),
-            "{project_name} Relay instances carry identical approval state"
-        );
-        assert_eq!(
-            std::fs::read(output.join("private/relay-public/approval/project-state.json"))
-                .expect("Relay approval state reads"),
-            std::fs::read(output.join("private/notary/approval/project-state.json"))
-                .expect("Notary approval state reads"),
-            "{project_name} products carry identical approval state"
-        );
-        let relay_descriptor: serde_json::Value = serde_json::from_slice(
-            &std::fs::read(output.join("private/relay-public/descriptors/secret-consumers.json"))
-                .expect("Relay secret descriptor reads"),
-        )
-        .expect("Relay secret descriptor parses");
-        assert!(relay_descriptor["consumers"]
-            .as_array()
-            .is_some_and(|consumers| {
-                consumers
-                    .iter()
-                    .any(|consumer| consumer["locator"] == "REGISTRY_RELAY_AUDIT_HASH_SECRET")
-                    && consumers.iter().all(|consumer| {
-                        !matches!(
-                            consumer["locator"].as_str(),
-                            Some(
-                                "REGISTRY_RELAY_AUDIT_PSEUDONYM_EPOCH_1"
-                                    | "REGISTRY_RELAY_CONSULTATION_DATABASE_URL"
-                            )
-                        )
-                    })
-            }));
-        let consultation_descriptor: serde_json::Value = serde_json::from_slice(
-            &std::fs::read(
-                output.join("private/relay-consultation/descriptors/secret-consumers.json"),
-            )
-            .expect("consultation Relay secret descriptor reads"),
-        )
-        .expect("consultation Relay secret descriptor parses");
-        assert!(consultation_descriptor["consumers"]
-            .as_array()
-            .is_some_and(|consumers| {
-                consumers
-                    .iter()
-                    .any(|consumer| consumer["locator"] == "REGISTRY_RELAY_AUDIT_PSEUDONYM_EPOCH_1")
-                    && consumers.iter().any(|consumer| {
-                        consumer["locator"] == "REGISTRY_RELAY_CONSULTATION_DATABASE_URL"
-                    })
-            }));
-        let notary_descriptor: serde_json::Value = serde_json::from_slice(
-            &std::fs::read(output.join("private/notary/descriptors/secret-consumers.json"))
-                .expect("Notary secret descriptor reads"),
-        )
-        .expect("Notary secret descriptor parses");
-        assert!(notary_descriptor["consumers"]
-            .as_array()
-            .is_some_and(|consumers| {
-                consumers.iter().any(|consumer| {
-                    consumer["locator"]
-                        .as_str()
-                        .is_some_and(|locator| locator.ends_with("_TOKEN_HASH"))
-                })
-            }));
-        assert!(notary_descriptor["consumers"]
-            .as_array()
-            .is_some_and(|consumers| {
-                consumers
-                    .iter()
-                    .all(|consumer| consumer["locator"] != "REGISTRY_NOTARY_POSTGRES_URL")
-            }));
-    }
-}
-
 #[test]
 fn generated_product_inputs_sign_and_verify_without_secret_values() {
     const SECRET_SENTINEL: &str = "project-authoring-secret-sentinel-8f9d7537";
@@ -8385,8 +5910,8 @@ fn generated_product_inputs_sign_and_verify_without_secret_values() {
     lanes.sort();
     assert_eq!(
         lanes,
-        ["notary", "relay-consultation", "relay-public"],
-        "governed build publishes exactly the three approved lanes"
+        ["relay-consultation", "relay-public"],
+        "governed build publishes exactly the two approved lanes"
     );
 
     for (label, product, lane, expected_instance) in [
@@ -8402,12 +5927,6 @@ fn generated_product_inputs_sign_and_verify_without_secret_values() {
             ProductAcceptanceLaneV1::RelayConsultation,
             "household-relay-consultation",
         ),
-        (
-            "notary",
-            "registry-notary",
-            ProductAcceptanceLaneV1::Notary,
-            "household-notary",
-        ),
     ] {
         let input = signing_inputs.join(label);
         let marker_bytes =
@@ -8453,7 +5972,7 @@ fn generated_product_inputs_sign_and_verify_without_secret_values() {
         assert_eq!(verified.signer_kids.len(), 1);
     }
 
-    let first_markers = ["relay-public", "relay-consultation", "notary"].map(|lane| {
+    let first_markers = ["relay-public", "relay-consultation"].map(|lane| {
         std::fs::read(
             output
                 .join("signing-inputs")
@@ -8471,7 +5990,7 @@ fn generated_product_inputs_sign_and_verify_without_secret_values() {
     .expect("repeated project build succeeds");
     let repeated_output =
         resolve_build_output(&project, repeated.output.expect("repeated build output"));
-    let repeated_markers = ["relay-public", "relay-consultation", "notary"].map(|lane| {
+    let repeated_markers = ["relay-public", "relay-consultation"].map(|lane| {
         std::fs::read(
             repeated_output
                 .join("signing-inputs")
@@ -8532,431 +6051,18 @@ fn authored_request_literals_cannot_smuggle_secret_material() {
             serde_norway::Value::String(SECRET_SENTINEL.to_string());
         write_yaml(&integration_path, &integration);
         let error = check_registry_project(&ProjectCheckOptions {
-            project_directory: project.clone(),
-            environment: "local".to_string(),
-            explain: false,
-            against: None,
-            anchor: None,
-        })
-        .expect_err("credential-bearing header must fail closed");
-        let diagnostic = format!("{error:#}");
-        assert_authoring_diagnostic(&error, "registryctl.authoring.integration.invalid");
-        assert!(!diagnostic.contains(SECRET_SENTINEL));
-        assert!(!project.join(".registry-stack/build").exists());
-    }
-}
-
-#[test]
-fn verified_signed_baseline_classifies_semantic_review_dimensions_independently() {
-    let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = copy_project("custom-system", temporary.path());
-    let integration_file = project.join("integrations/eligibility/integration.yaml");
-    let integration = std::fs::read_to_string(&integration_file)
-        .expect("integration reads")
-        .replace(
-            "unverified: [fixture-contract-v2]",
-            "unverified: [fixture-contract-v2, fixture-contract-v3]",
-        );
-    std::fs::write(&integration_file, integration).expect("second reviewed version writes");
-    let initial = build_registry_project(&ProjectBuildOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        against: None,
-        anchor: None,
-    })
-    .expect("initial project build passes");
-    let output = resolve_build_output(&project, initial.output.expect("initial build output"));
-    let private_key = temporary.path().join("baseline-private.jwk");
-    let public_key = temporary.path().join("baseline-public.jwk");
-    write_test_signing_key_pair(&private_key, &public_key);
-    let (baseline, anchor) = create_and_sign_test_lane_baseline(
-        temporary.path(),
-        "notary-baseline",
-        ProductAcceptanceLaneV1::Notary,
-        &output.join("signing-inputs/notary"),
-        &private_key,
-        &public_key,
-    );
-    let (relay_baseline, relay_anchor) = create_and_sign_test_lane_baseline(
-        temporary.path(),
-        "relay-baseline",
-        ProductAcceptanceLaneV1::RelayPublic,
-        &output.join("signing-inputs/relay-public"),
-        &private_key,
-        &public_key,
-    );
-    let (relay_consultation_baseline, relay_consultation_anchor) =
-        create_and_sign_test_lane_baseline(
-            temporary.path(),
-            "relay-consultation-baseline",
-            ProductAcceptanceLaneV1::RelayConsultation,
-            &output.join("signing-inputs/relay-consultation"),
-            &private_key,
-            &public_key,
-        );
-
-    for relative in ["approval/review.json", "approval/project-state.json"] {
-        let tampered = temporary
-            .path()
-            .join(format!("tampered-{}", relative.replace(['/', '.'], "-")));
-        copy_tree(&baseline, &tampered);
-        let path = tampered.join(relative);
-        let mut bytes = std::fs::read(&path).expect("signed approval payload reads");
-        bytes.push(b' ');
-        std::fs::write(&path, bytes).expect("signed approval payload tampers");
-        let error = check_registry_project(&ProjectCheckOptions {
-            project_directory: project.clone(),
-            environment: "local".to_string(),
-            explain: false,
-            against: Some(tampered),
-            anchor: Some(anchor.clone()),
-        })
-        .expect_err("post-signature approval payload tamper must fail");
-        assert!(format!("{error:#}").contains("failed to verify config bundle"));
-    }
-
-    let initial_review: serde_json::Value = serde_json::from_slice(
-        &std::fs::read(output.join("reviewable/review.json")).expect("initial review reads"),
-    )
-    .expect("initial review parses");
-    let initial_state: serde_json::Value = serde_json::from_slice(
-        &std::fs::read(output.join("private/notary/approval/project-state.json"))
-            .expect("initial approval state reads"),
-    )
-    .expect("initial approval state parses");
-    assert_eq!(initial_review["baseline"], "initial_without_baseline");
-    assert!(initial_review["disclosure_profiles"].is_object());
-    assert_public_review_has_only_contract_hashes(&initial_review);
-    assert!(initial_state["semantic_digests"].is_object());
-    assert!(initial_state["generated_closure_digests"]["notary"].is_string());
-    assert!(initial_state["report_digest"].is_string());
-
-    let reviewed_build = build_registry_project_with_baselines_and_context(
-        &ProjectBuildOptions {
-            project_directory: project.clone(),
-            environment: "local".to_string(),
-            against: None,
-            anchor: None,
-        },
-        &ProjectBuildBaselineSetOptions {
-            relay_against: Some(relay_baseline),
-            relay_anchor: Some(relay_anchor),
-            relay_consultation_against: Some(relay_consultation_baseline),
-            relay_consultation_anchor: Some(relay_consultation_anchor),
-            notary_against: Some(baseline.clone()),
-            notary_anchor: Some(anchor.clone()),
-        },
-        &project_execution_context(),
-    )
-    .expect("verified-baseline build passes");
-    let reviewed_output = resolve_build_output(
-        &project,
-        reviewed_build.output.expect("reviewed build output"),
-    );
-    let reviewed_record: serde_json::Value = serde_json::from_slice(
-        &std::fs::read(reviewed_output.join("reviewable/review.json"))
-            .expect("reviewed record reads"),
-    )
-    .expect("reviewed record parses");
-    let reviewed_state: serde_json::Value = serde_json::from_slice(
-        &std::fs::read(reviewed_output.join("private/notary/approval/project-state.json"))
-            .expect("reviewed approval state reads"),
-    )
-    .expect("reviewed approval state parses");
-    assert_eq!(reviewed_record["baseline"], "verified_signed_bundle");
-    assert_public_review_has_only_contract_hashes(&reviewed_record);
-    assert_eq!(
-        reviewed_state["baseline"]["verified_manifests"]["notary"]["schema"],
-        "registry.platform.config_bundle.v1"
-    );
-    assert_eq!(
-        reviewed_state["baseline"]["verified_manifests"]["relay"]["schema"],
-        "registry.platform.config_bundle.v1"
-    );
-    assert_eq!(
-        reviewed_state["baseline"]["verified_manifests"]["relay_consultation"]["schema"],
-        "registry.platform.config_bundle.v1"
-    );
-    let signed_paths = reviewed_state["baseline"]["verified_manifests"]["notary"]["files"]
-        .as_array()
-        .expect("verified manifest files")
-        .iter()
-        .filter_map(|file| file["path"].as_str())
-        .collect::<BTreeSet<_>>();
-    assert!(signed_paths.contains("approval/review.json"));
-    assert!(signed_paths.contains("approval/project-state.json"));
-
-    let unchanged = check_registry_project(&ProjectCheckOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        explain: false,
-        against: Some(baseline.clone()),
-        anchor: Some(anchor.clone()),
-    })
-    .expect("unchanged project checks against signed baseline");
-    assert_eq!(unchanged.baseline, "verified_signed_bundle");
-    assert!(unchanged.semantic_changes.is_empty());
-
-    let mismatched_input = temporary.path().join("mismatched-baseline-input");
-    copy_tree(&output.join("signing-inputs/notary"), &mismatched_input);
-    let mismatched_config = mismatched_input.join("config/notary.yaml");
-    let mut mismatched_bytes = std::fs::read(&mismatched_config).expect("Notary config reads");
-    mismatched_bytes.push(b'\n');
-    std::fs::write(&mismatched_config, mismatched_bytes).expect("Notary config changes");
-    let mismatched_bundle = sign_test_lane_bundle(
-        temporary.path(),
-        "mismatched-baseline",
-        ProductAcceptanceLaneV1::Notary,
-        &mismatched_input,
-        &private_key,
-        &anchor,
-    );
-    let mismatch = check_registry_project(&ProjectCheckOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        explain: false,
-        against: Some(mismatched_bundle),
-        anchor: Some(anchor.clone()),
-    })
-    .expect_err("signed product closure must match the signed review");
-    assert!(format!("{mismatch:#}").contains("lane closure does not match"));
-
-    let report_mismatch_input = temporary.path().join("report-mismatch-input");
-    copy_tree(
-        &output.join("signing-inputs/notary"),
-        &report_mismatch_input,
-    );
-    let report_mismatch_path = report_mismatch_input.join("approval/review.json");
-    let mut mismatched_report: serde_json::Value = serde_json::from_slice(
-        &std::fs::read(&report_mismatch_path).expect("approval review reads"),
-    )
-    .expect("approval review parses");
-    mismatched_report["semantic_changes"] = serde_json::Value::Array(Vec::new());
-    std::fs::write(
-        &report_mismatch_path,
-        serde_json::to_vec(&mismatched_report).expect("mismatched review serializes"),
-    )
-    .expect("mismatched approval review writes");
-    let report_mismatch_bundle = sign_test_lane_bundle(
-        temporary.path(),
-        "report-mismatch",
-        ProductAcceptanceLaneV1::Notary,
-        &report_mismatch_input,
-        &private_key,
-        &anchor,
-    );
-    let report_mismatch = check_registry_project(&ProjectCheckOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-        explain: false,
-        against: Some(report_mismatch_bundle),
-        anchor: Some(anchor.clone()),
-    })
-    .expect_err("signed report/state binding mismatch must fail");
-    assert!(format!("{report_mismatch:#}").contains("does not bind the signed review"));
-
-    let scenarios = temporary.path().join("scenarios");
-    std::fs::create_dir(&scenarios).expect("scenario root creates");
-    let claim_project = scenarios.join("claim");
-    let source_version_project = scenarios.join("source-version");
-    let operator_project = scenarios.join("operator");
-    let notary_cel_project = scenarios.join("notary-cel");
-    let policy_project = scenarios.join("policy");
-    let consultation_project = scenarios.join("consultation");
-    for destination in [
-        &claim_project,
-        &source_version_project,
-        &operator_project,
-        &notary_cel_project,
-        &policy_project,
-        &consultation_project,
-    ] {
-        copy_tree(&project, destination);
-    }
-
-    let project_file = claim_project.join("registry-stack.yaml");
-    let authored = std::fs::read_to_string(&project_file)
-        .expect("project reads")
-        .replace(
-            "household.matched && household.approved != null ? household.approved : null",
-            "household.matched && household.approved != null ? household.approved == true : null",
-        );
-    std::fs::write(&project_file, authored).expect("claim-only edit writes");
-    let changed = check_registry_project(&ProjectCheckOptions {
-        project_directory: claim_project.clone(),
-        environment: "local".to_string(),
-        explain: false,
-        against: Some(baseline.clone()),
-        anchor: Some(anchor.clone()),
-    })
-    .expect("claim-only edit checks against signed baseline");
-    assert_eq!(
-        changed
-            .semantic_changes
-            .iter()
-            .map(|change| change.dimension)
-            .collect::<BTreeSet<_>>(),
-        BTreeSet::from(["claim"])
-    );
-
-    let compiler_input = temporary.path().join("compiler-baseline-input");
-    copy_tree(&output.join("signing-inputs/notary"), &compiler_input);
-    let compiler_state_path = compiler_input.join("approval/project-state.json");
-    let mut compiler_state: serde_json::Value = serde_json::from_slice(
-        &std::fs::read(&compiler_state_path).expect("compiler baseline approval state reads"),
-    )
-    .expect("compiler baseline approval state parses");
-    compiler_state["compiler_version"] = serde_json::Value::String("0.0.0".to_string());
-    std::fs::write(
-        &compiler_state_path,
-        serde_json::to_vec(&compiler_state).expect("compiler baseline state serializes"),
-    )
-    .expect("compiler baseline approval state writes");
-    let compiler_baseline = sign_test_lane_bundle(
-        temporary.path(),
-        "compiler-baseline",
-        ProductAcceptanceLaneV1::Notary,
-        &compiler_input,
-        &private_key,
-        &anchor,
-    );
-    let compiler_mismatch = check_registry_project(&ProjectCheckOptions {
-        project_directory: claim_project,
-        environment: "local".to_string(),
-        explain: false,
-        against: Some(compiler_baseline),
-        anchor: Some(anchor.clone()),
-    })
-    .expect_err("signed report and approval-state mismatch must fail");
-    assert!(format!("{compiler_mismatch:#}").contains("disagree on compiler version"));
-
-    replace_in_file(
-        &source_version_project.join("integrations/eligibility/integration.yaml"),
-        "unverified: [fixture-contract-v2, fixture-contract-v3]",
-        "unverified: [fixture-contract-v2, fixture-contract-v3, fixture-contract-v4]",
-    );
-    assert_change_dimensions(
-        source_version_project,
-        &baseline,
-        &anchor,
-        BTreeSet::from(["integration"]),
-    );
-
-    replace_in_file(
-        &operator_project.join("environments/local.yaml"),
-        "https://household-authority.invalid",
-        "https://household-authority-two.invalid",
-    );
-    assert_change_dimensions(
-        operator_project,
-        &baseline,
-        &anchor,
-        BTreeSet::from(["operator_security"]),
-    );
-
-    let notary_cel_environment = notary_cel_project.join("environments/local.yaml");
-    let mut environment = read_yaml(&notary_cel_environment);
-    environment["notary_cel"] = serde_norway::from_str("worker_memory_bytes: 1073741824\n")
-        .expect("Notary CEL binding parses");
-    write_yaml(&notary_cel_environment, &environment);
-    assert_change_dimensions(
-        notary_cel_project,
-        &baseline,
-        &anchor,
-        BTreeSet::from(["operator_security"]),
-    );
-
-    replace_in_file(
-        &policy_project.join("registry-stack.yaml"),
-        "legal_basis: public-service-delivery",
-        "legal_basis: statutory-benefit-screening",
-    );
-    assert_change_dimensions(
-        policy_project,
-        &baseline,
-        &anchor,
-        BTreeSet::from(["service_policy"]),
-    );
-
-    replace_in_file(
-        &consultation_project.join("registry-stack.yaml"),
-        "request.target.identifiers.household_reference",
-        "request.target.identifiers.household_case_number",
-    );
-    replace_in_file(
-        &consultation_project.join("integrations/eligibility/fixtures/source-approved.yaml"),
-        "scheme: household_reference",
-        "scheme: household_case_number",
-    );
-    assert_change_dimensions(
-        consultation_project,
-        &baseline,
-        &anchor,
-        BTreeSet::from(["integration"]),
-    );
-}
-
-fn assert_change_dimensions(
-    project: PathBuf,
-    baseline: &Path,
-    anchor: &Path,
-    expected: BTreeSet<&str>,
-) {
-    let report = check_registry_project(&ProjectCheckOptions {
-        project_directory: project,
-        environment: "local".to_string(),
-        explain: false,
-        against: Some(baseline.to_path_buf()),
-        anchor: Some(anchor.to_path_buf()),
-    })
-    .expect("semantic review scenario checks against signed baseline");
-    assert_eq!(
-        report
-            .semantic_changes
-            .iter()
-            .map(|change| change.dimension)
-            .collect::<BTreeSet<_>>(),
-        expected
-    );
-}
-
-fn assert_public_review_has_only_contract_hashes(review: &serde_json::Value) {
-    fn visit(value: &serde_json::Value, contract_hashes: &mut usize) {
-        match value {
-            serde_json::Value::Object(object) => {
-                for (key, value) in object {
-                    let lower = key.to_ascii_lowercase();
-                    if lower.contains("hash") || lower.contains("digest") {
-                        assert_eq!(
-                            key, "contract_hash",
-                            "human review exposes lower-level field {key}"
-                        );
-                        let contract_hash =
-                            value.as_str().expect("generated contract_hash is a string");
-                        assert!(contract_hash.starts_with("sha256:"));
-                        *contract_hashes += 1;
-                    }
-                    visit(value, contract_hashes);
-                }
-            }
-            serde_json::Value::Array(values) => {
-                for value in values {
-                    visit(value, contract_hashes);
-                }
-            }
-            serde_json::Value::Null
-            | serde_json::Value::Bool(_)
-            | serde_json::Value::Number(_)
-            | serde_json::Value::String(_) => {}
-        }
+            project_directory: project.clone(),
+            environment: "local".to_string(),
+            explain: false,
+            against: None,
+            anchor: None,
+        })
+        .expect_err("credential-bearing header must fail closed");
+        let diagnostic = format!("{error:#}");
+        assert_authoring_diagnostic(&error, "registryctl.authoring.integration.invalid");
+        assert!(!diagnostic.contains(SECRET_SENTINEL));
+        assert!(!project.join(".registry-stack/build").exists());
     }
-
-    let mut contract_hashes = 0;
-    visit(review, &mut contract_hashes);
-    assert!(
-        contract_hashes > 0,
-        "registry-backed human review exposes its generated contract_hash"
-    );
 }
 
 fn replace_in_file(path: &Path, from: &str, to: &str) {
@@ -9144,250 +6250,6 @@ fn extend_exact_selector(project: &Path, golden_name: &str, size: usize) {
     assert!(integration["id"].as_str().is_some(), "{alias}");
 }
 
-fn duplicate_project_integration(project: &Path, source_alias: &str, target_alias: &str) {
-    copy_tree(
-        &project.join("integrations").join(source_alias),
-        &project.join("integrations").join(target_alias),
-    );
-    let integration_path = project
-        .join("integrations")
-        .join(target_alias)
-        .join("integration.yaml");
-    let mut integration = read_yaml(&integration_path);
-    integration["id"] = serde_norway::Value::String(format!("{target_alias}-integration"));
-    write_yaml(&integration_path, &integration);
-
-    let project_path = project.join("registry-stack.yaml");
-    let mut project_document = read_yaml(&project_path);
-    project_document["integrations"]
-        .as_mapping_mut()
-        .expect("project integrations mapping")
-        .insert(
-            serde_norway::Value::String(target_alias.to_string()),
-            serde_norway::from_str(&format!(
-                "file: integrations/{target_alias}/integration.yaml\n"
-            ))
-            .expect("project integration reference"),
-        );
-    let (service_name, consultation_name, duplicated_consultation) = project_document["services"]
-        .as_mapping()
-        .and_then(|services| {
-            services.iter().find_map(|(service_name, service)| {
-                service["consultations"]
-                    .as_mapping()
-                    .and_then(|consultations| {
-                        consultations
-                            .iter()
-                            .find_map(|(consultation_name, consultation)| {
-                                (consultation["integration"].as_str() == Some(source_alias)).then(
-                                    || {
-                                        (
-                                            service_name.clone(),
-                                            consultation_name.clone(),
-                                            consultation.clone(),
-                                        )
-                                    },
-                                )
-                            })
-                    })
-            })
-        })
-        .expect("source integration consultation");
-    let mut duplicated_consultation = duplicated_consultation;
-    duplicated_consultation["integration"] = serde_norway::Value::String(target_alias.to_string());
-    let service = project_document["services"]
-        .as_mapping_mut()
-        .and_then(|services| services.get_mut(&service_name))
-        .expect("project service");
-    service["consultations"]
-        .as_mapping_mut()
-        .expect("project consultations mapping")
-        .insert(
-            serde_norway::Value::String(target_alias.to_string()),
-            duplicated_consultation,
-        );
-    let consultation_name = consultation_name
-        .as_str()
-        .expect("consultation name is a string");
-    let reference = format!("{consultation_name}.");
-    let duplicated_claims = service["claims"]
-        .as_mapping()
-        .map(|claims| {
-            claims
-                .iter()
-                .filter_map(|(name, claim)| {
-                    let source_claim = name.as_str()?;
-                    if !yaml_contains_string(claim, &reference) {
-                        return None;
-                    }
-                    let mut duplicated_claim = claim.clone();
-                    replace_yaml_strings(
-                        &mut duplicated_claim,
-                        &reference,
-                        &format!("{target_alias}."),
-                    );
-                    Some((
-                        source_claim.to_string(),
-                        format!("{target_alias}-{source_claim}"),
-                        duplicated_claim,
-                    ))
-                })
-                .collect::<Vec<_>>()
-        })
-        .filter(|claims| !claims.is_empty())
-        .expect("source consultation claims");
-    for (_, target_claim, duplicated_claim) in &duplicated_claims {
-        service["claims"]
-            .as_mapping_mut()
-            .expect("project claims mapping")
-            .insert(
-                serde_norway::Value::String(target_claim.clone()),
-                duplicated_claim.clone(),
-            );
-    }
-    for credential in service["credential_profiles"]
-        .as_mapping_mut()
-        .expect("project credential profiles")
-        .values_mut()
-    {
-        credential["claims"]
-            .as_sequence_mut()
-            .expect("credential profile claims")
-            .extend(
-                duplicated_claims
-                    .iter()
-                    .map(|(_, target_claim, _)| serde_norway::Value::String(target_claim.clone())),
-            );
-    }
-    write_yaml(&project_path, &project_document);
-    let claim_translations = duplicated_claims
-        .iter()
-        .map(|(source, target, _)| (source.clone(), target.clone()))
-        .collect::<Vec<_>>();
-    rewrite_duplicated_fixture_claims(
-        &project
-            .join("integrations")
-            .join(target_alias)
-            .join("fixtures"),
-        &claim_translations,
-    );
-
-    let environment_path = project.join("environments/local.yaml");
-    let mut environment = read_yaml(&environment_path);
-    let mut source_binding = environment["integrations"][source_alias].clone();
-    namespace_secret_references(&mut source_binding, target_alias);
-    environment["integrations"]
-        .as_mapping_mut()
-        .expect("environment integrations mapping")
-        .insert(
-            serde_norway::Value::String(target_alias.to_string()),
-            source_binding,
-        );
-    write_yaml(&environment_path, &environment);
-}
-
-fn rewrite_duplicated_fixture_claims(fixtures: &Path, translations: &[(String, String)]) {
-    let translate = |claim: &str| {
-        translations
-            .iter()
-            .find_map(|(source, target)| (source == claim).then_some(target.as_str()))
-    };
-    for entry in std::fs::read_dir(fixtures).expect("duplicated fixtures directory reads") {
-        let path = entry.expect("duplicated fixture entry reads").path();
-        if path.extension().and_then(std::ffi::OsStr::to_str) != Some("yaml") {
-            continue;
-        }
-        let mut fixture = read_yaml(&path);
-        if let Some(claims) = fixture["expect"]["claims"].as_mapping_mut() {
-            let rewritten = claims
-                .iter()
-                .map(|(claim, expected)| {
-                    let claim = claim.as_str().expect("fixture claim is a string");
-                    (
-                        serde_norway::Value::String(translate(claim).unwrap_or(claim).to_string()),
-                        expected.clone(),
-                    )
-                })
-                .collect::<serde_norway::Mapping>();
-            *claims = rewritten;
-        }
-        if let Some(request_claims) = fixture
-            .get_mut("request")
-            .and_then(|request| request.get_mut("claims"))
-            .and_then(serde_norway::Value::as_sequence_mut)
-        {
-            for claim in request_claims {
-                let source_claim = claim.as_str().expect("request claim is a string");
-                if let Some(target_claim) = translate(source_claim) {
-                    *claim = serde_norway::Value::String(target_claim.to_string());
-                }
-            }
-        }
-        write_yaml(&path, &fixture);
-    }
-}
-
-fn yaml_contains_string(value: &serde_norway::Value, needle: &str) -> bool {
-    match value {
-        serde_norway::Value::String(value) => value.contains(needle),
-        serde_norway::Value::Mapping(mapping) => mapping.iter().any(|(key, value)| {
-            yaml_contains_string(key, needle) || yaml_contains_string(value, needle)
-        }),
-        serde_norway::Value::Sequence(sequence) => sequence
-            .iter()
-            .any(|value| yaml_contains_string(value, needle)),
-        _ => false,
-    }
-}
-
-fn replace_yaml_strings(value: &mut serde_norway::Value, from: &str, to: &str) {
-    match value {
-        serde_norway::Value::String(value) => *value = value.replace(from, to),
-        serde_norway::Value::Mapping(mapping) => {
-            for value in mapping.values_mut() {
-                replace_yaml_strings(value, from, to);
-            }
-        }
-        serde_norway::Value::Sequence(sequence) => {
-            for value in sequence {
-                replace_yaml_strings(value, from, to);
-            }
-        }
-        _ => {}
-    }
-}
-
-fn namespace_secret_references(value: &mut serde_norway::Value, namespace: &str) {
-    let namespace = namespace.replace('-', "_").to_ascii_uppercase();
-    namespace_secret_references_with_suffix(value, &namespace);
-}
-
-fn namespace_secret_references_with_suffix(value: &mut serde_norway::Value, namespace: &str) {
-    match value {
-        serde_norway::Value::Mapping(mapping) => {
-            if let Some(secret) = mapping
-                .get_mut(serde_norway::Value::String("secret".to_string()))
-                .and_then(|value| value.as_str().map(ToOwned::to_owned))
-            {
-                mapping.insert(
-                    serde_norway::Value::String("secret".to_string()),
-                    serde_norway::Value::String(format!("{secret}_{namespace}")),
-                );
-                return;
-            }
-            for nested in mapping.values_mut() {
-                namespace_secret_references_with_suffix(nested, namespace);
-            }
-        }
-        serde_norway::Value::Sequence(sequence) => {
-            for nested in sequence {
-                namespace_secret_references_with_suffix(nested, namespace);
-            }
-        }
-        _ => {}
-    }
-}
-
 fn read_yaml(path: &Path) -> serde_norway::Value {
     serde_norway::from_slice(&std::fs::read(path).expect("YAML reads")).expect("YAML parses")
 }
@@ -9416,38 +6278,8 @@ fn reverse_yaml_mapping(path: &Path, keys: &[&str]) {
     write_yaml(path, &document);
 }
 
-fn remove_custom_cel_claim(project: &Path) {
-    let project_path = project.join("registry-stack.yaml");
-    let mut document = read_yaml(&project_path);
-    let service = &mut document["services"]["household-eligibility"];
-    service["claims"]
-        .as_mapping_mut()
-        .expect("custom claims")
-        .remove(serde_norway::Value::String(
-            "source-household-approval-decision".to_string(),
-        ));
-    service["credential_profiles"]["household-eligibility"]["claims"]
-        .as_sequence_mut()
-        .expect("custom credential claims")
-        .retain(|claim| claim.as_str() != Some("source-household-approval-decision"));
-    write_yaml(&project_path, &document);
-    for fixture in std::fs::read_dir(project.join("integrations/eligibility/fixtures"))
-        .expect("custom fixture directory")
-    {
-        let path = fixture.expect("fixture entry").path();
-        let mut document = read_yaml(&path);
-        let claims = document
-            .get_mut("expect")
-            .and_then(serde_norway::Value::as_mapping_mut)
-            .and_then(|expect| expect.get_mut("claims"))
-            .and_then(serde_norway::Value::as_mapping_mut);
-        if let Some(claims) = claims {
-            claims.remove(serde_norway::Value::String(
-                "source-household-approval-decision".to_string(),
-            ));
-        }
-        write_yaml(&path, &document);
-    }
+fn prepare_custom_selector_project(project: &Path) {
+    let _ = project;
 }
 
 fn make_opencrvs_composite_dci(project: &Path) {
@@ -9496,15 +6328,6 @@ place: request.target.identifiers.place
 "#,
         )
         .expect("composite DCI consultation mapping");
-    let service = &mut project_document["services"]["birth-verification"];
-    service["claims"]
-        .as_mapping_mut()
-        .expect("OpenCRVS claims")
-        .remove(serde_norway::Value::String("age-band".to_string()));
-    service["credential_profiles"]["birth-summary"]["claims"]
-        .as_sequence_mut()
-        .expect("OpenCRVS credential claims")
-        .retain(|claim| claim.as_str() != Some("age-band"));
     write_yaml(&project_path, &project_document);
 
     let fixture_directory = project.join("integrations/birth-record/fixtures");
@@ -9551,14 +6374,6 @@ place: request.target.identifiers.place
 "#,
         )
         .expect("composite DCI request predicates");
-        if let Some(claims) = fixture
-            .get_mut("expect")
-            .and_then(serde_norway::Value::as_mapping_mut)
-            .and_then(|expect| expect.get_mut("claims"))
-            .and_then(serde_norway::Value::as_mapping_mut)
-        {
-            claims.remove(serde_norway::Value::String("age-band".to_string()));
-        }
         write_yaml(&path, &fixture);
     }
 }
@@ -9627,138 +6442,6 @@ fn sign_test_lane_bundle(
     output.join("bundle")
 }
 
-fn author_oid4vci_binding(project: &Path, service: &str, profile: &str, id_type: &str) {
-    let project_path = project.join("registry-stack.yaml");
-    let mut authored_project = read_yaml(&project_path);
-    authored_project["services"][service]["credential_profiles"][profile]["type"] =
-        serde_norway::Value::String(format!(
-            "https://notary.example.invalid/credentials/{profile}/v1"
-        ));
-    write_yaml(&project_path, &authored_project);
-
-    let environment_path = project.join("environments/local.yaml");
-    let mut environment = read_yaml(&environment_path);
-    environment["notary_state"] = serde_norway::from_str(
-        "postgresql:\n  root_certificate_path: /run/secrets/notary-postgres-ca.pem\n",
-    )
-    .expect("Notary PostgreSQL state binding");
-    environment["oid4vci"] = serde_norway::from_str(&format!(
-        r#"public_base_url: https://notary.example.invalid
-credential:
-  service: {service}
-  profile: {profile}
-authorization_server:
-  issuer: https://esignet.example.invalid
-  jwks_url: https://esignet.example.invalid/.well-known/jwks.json
-  userinfo_url: https://esignet.example.invalid/userinfo
-  authorize_url: https://esignet-ui.example.invalid/authorize
-  token_url: https://esignet.example.invalid/token
-client:
-  id: example-wallet-client
-  signing_key: {{ secret: OID4VCI_ESIGNET_CLIENT_JWK }}
-  signing_kid: example-wallet-client-key-1
-access_token:
-  signing_key: {{ secret: OID4VCI_ACCESS_TOKEN_JWK }}
-  signing_kid: did:web:notary.example.invalid#access-token-key-1
-sensitive_state_key: {{ secret: OID4VCI_SENSITIVE_STATE_KEY }}
-subject:
-  token_claim: individual_id
-  id_type: {id_type}
-redirect_uri: https://notary.example.invalid/oid4vci/offer/callback
-allowed_wallet_origins: [https://wallet.example.invalid]
-"#
-    ))
-    .expect("OID4VCI binding");
-    write_yaml(&environment_path, &environment);
-}
-
-fn author_representative_oid4vci_binding(project: &Path, requester_id_type: &str) {
-    let project_path = project.join("registry-stack.yaml");
-    let mut authored_project = read_yaml(&project_path);
-    let service = &mut authored_project["services"]["household-eligibility"];
-    service["consultations"]["household"]["input"]["representative_reference"] =
-        serde_norway::Value::String(format!("request.requester.identifiers.{requester_id_type}"));
-    service["credential_profiles"]["household-eligibility"]["claims"] =
-        serde_norway::from_str("[source-household-approval-decision]")
-            .expect("single representative credential root");
-    write_yaml(&project_path, &authored_project);
-
-    let integration_path = project.join("integrations/eligibility/integration.yaml");
-    let mut integration = read_yaml(&integration_path);
-    integration["input"]["representative_reference"] = serde_norway::from_str(
-        r#"role: selector
-type: string
-maxLength: 18
-pattern: "^HH-[A-Z0-9]{8}$"
-"#,
-    )
-    .expect("representative selector input");
-    integration["capability"]["http"]["request"]["query"]["representative"] =
-        serde_norway::from_str("{ input: representative_reference }")
-            .expect("representative query binding");
-    write_yaml(&integration_path, &integration);
-
-    for entry in std::fs::read_dir(project.join("integrations/eligibility/fixtures"))
-        .expect("fixture directory reads")
-    {
-        let path = entry.expect("fixture entry").path();
-        let mut fixture = read_yaml(&path);
-        fixture["input"]["representative_reference"] =
-            serde_norway::Value::String("HH-ZZ99YY88".to_string());
-        fixture["interactions"][0]["expect"]["query"]["representative"] =
-            serde_norway::Value::String("HH-ZZ99YY88".to_string());
-        if fixture.get("request").is_some() {
-            fixture["request"]["requester"] = serde_norway::from_str(&format!(
-                r#"type: Person
-identifiers:
-  - scheme: {requester_id_type}
-    value: HH-ZZ99YY88
-"#
-            ))
-            .expect("fixture requester");
-            fixture["request"]["claims"] =
-                serde_norway::from_str("[source-household-approval-decision]")
-                    .expect("fixture representative claim");
-        }
-        write_yaml(&path, &fixture);
-    }
-
-    let environment_path = project.join("environments/local.yaml");
-    let mut environment = read_yaml(&environment_path);
-    environment["oid4vci"]["representative_issuance"] = serde_norway::from_str(
-        r#"relationship: authorized-representative
-proof_claim: household-record-exists
-target_id_type: household_reference
-"#,
-    )
-    .expect("representative issuance binding");
-    write_yaml(&environment_path, &environment);
-}
-
-fn merge_environment_yaml(path: &Path, patch: &str) {
-    fn merge(target: &mut serde_norway::Value, patch: serde_norway::Value) {
-        match (target, patch) {
-            (serde_norway::Value::Mapping(target), serde_norway::Value::Mapping(patch)) => {
-                for (key, value) in patch {
-                    if let Some(target) = target.get_mut(&key) {
-                        merge(target, value);
-                    } else {
-                        target.insert(key, value);
-                    }
-                }
-            }
-            (target, patch) => *target = patch,
-        }
-    }
-
-    let mut environment = read_yaml(path);
-    merge(
-        &mut environment,
-        serde_norway::from_str(patch).expect("environment patch"),
-    );
-    write_yaml(path, &environment);
-}
-
 fn rename_custom_input(project: &Path, name: &str) {
     let mut paths = vec![
         project.join("registry-stack.yaml"),
@@ -9782,6 +6465,72 @@ fn rename_custom_input(project: &Path, name: &str) {
     }
 }
 
+fn duplicate_project_integration(project: &Path, source_alias: &str, target_alias: &str) {
+    copy_tree(
+        &project.join("integrations").join(source_alias),
+        &project.join("integrations").join(target_alias),
+    );
+    let integration_path = project
+        .join("integrations")
+        .join(target_alias)
+        .join("integration.yaml");
+    let mut integration = read_yaml(&integration_path);
+    integration["id"] = serde_norway::Value::String(format!("{target_alias}-integration"));
+    write_yaml(&integration_path, &integration);
+
+    let project_path = project.join("registry-stack.yaml");
+    let mut project_document = read_yaml(&project_path);
+    project_document["integrations"]
+        .as_mapping_mut()
+        .expect("project integrations mapping")
+        .insert(
+            serde_norway::Value::String(target_alias.to_string()),
+            serde_norway::from_str(&format!(
+                "file: integrations/{target_alias}/integration.yaml\n"
+            ))
+            .expect("project integration reference"),
+        );
+    let (service_name, duplicated_consultation) = project_document["services"]
+        .as_mapping()
+        .and_then(|services| {
+            services.iter().find_map(|(service_name, service)| {
+                service["consultations"]
+                    .as_mapping()
+                    .and_then(|consultations| {
+                        consultations.values().find_map(|consultation| {
+                            (consultation["integration"].as_str() == Some(source_alias))
+                                .then(|| (service_name.clone(), consultation.clone()))
+                        })
+                    })
+            })
+        })
+        .expect("source integration consultation");
+    let mut duplicated_consultation = duplicated_consultation;
+    duplicated_consultation["integration"] = serde_norway::Value::String(target_alias.to_string());
+    project_document["services"]
+        .as_mapping_mut()
+        .and_then(|services| services.get_mut(&service_name))
+        .and_then(|service| service["consultations"].as_mapping_mut())
+        .expect("project consultations mapping")
+        .insert(
+            serde_norway::Value::String(target_alias.to_string()),
+            duplicated_consultation,
+        );
+    write_yaml(&project_path, &project_document);
+
+    let environment_path = project.join("environments/local.yaml");
+    let mut environment = read_yaml(&environment_path);
+    let duplicated_binding = environment["integrations"][source_alias].clone();
+    environment["integrations"]
+        .as_mapping_mut()
+        .expect("environment integrations mapping")
+        .insert(
+            serde_norway::Value::String(target_alias.to_string()),
+            duplicated_binding,
+        );
+    write_yaml(&environment_path, &environment);
+}
+
 fn copy_tree(source: &Path, destination: &Path) {
     std::fs::create_dir(destination).expect("copy destination creates");
     for entry in std::fs::read_dir(source).expect("copy source reads") {
@@ -9823,6 +6572,7 @@ fn test_sha256_uri(bytes: &[u8]) -> String {
     format!("sha256:{}", hex::encode(Sha256::digest(bytes)))
 }
 
+#[cfg(target_os = "linux")]
 fn closure_digest(files: &[(PathBuf, Vec<u8>)]) -> String {
     use std::fmt::Write as _;
 
diff --git a/crates/registryctl/tests/project_authoring_schema_parity.rs b/crates/registryctl/tests/project_authoring_schema_parity.rs
index 4b72b1a53..3690083ea 100644
--- a/crates/registryctl/tests/project_authoring_schema_parity.rs
+++ b/crates/registryctl/tests/project_authoring_schema_parity.rs
@@ -247,10 +247,10 @@ fn published_field_knowledge_is_complete_typed_reachable_and_editor_exact() {
     assert_eq!(
         index.coverage_by_schema(),
         [
-            (SchemaKind::Project, 220),
-            (SchemaKind::Environment, 213),
+            (SchemaKind::Project, 191),
+            (SchemaKind::Environment, 126),
             (SchemaKind::Integration, 171),
-            (SchemaKind::Fixture, 63),
+            (SchemaKind::Fixture, 39),
             (SchemaKind::Entity, 35),
         ]
         .into_iter()
@@ -261,11 +261,11 @@ fn published_field_knowledge_is_complete_typed_reachable_and_editor_exact() {
         index.coverage_by_path_kind(),
         [
             (FieldPathKind::Root, 5),
-            (FieldPathKind::Property, 492),
-            (FieldPathKind::MapKey, 26),
-            (FieldPathKind::MapValue, 33),
-            (FieldPathKind::ArrayItem, 34),
-            (FieldPathKind::Branch, 112),
+            (FieldPathKind::Property, 393),
+            (FieldPathKind::MapKey, 22),
+            (FieldPathKind::MapValue, 28),
+            (FieldPathKind::ArrayItem, 26),
+            (FieldPathKind::Branch, 88),
         ]
         .into_iter()
         .collect(),
@@ -275,11 +275,11 @@ fn published_field_knowledge_is_complete_typed_reachable_and_editor_exact() {
         index.coverage_by_sensitivity(),
         [
             (Sensitivity::Public, 6),
-            (Sensitivity::Internal, 445),
-            (Sensitivity::Sensitive, 69),
-            (Sensitivity::SecretReference, 14),
-            (Sensitivity::RedactedFixture, 51),
-            (Sensitivity::Structural, 117),
+            (Sensitivity::Internal, 382),
+            (Sensitivity::Sensitive, 43),
+            (Sensitivity::SecretReference, 9),
+            (Sensitivity::RedactedFixture, 29),
+            (Sensitivity::Structural, 93),
         ]
         .into_iter()
         .collect(),
@@ -287,12 +287,12 @@ fn published_field_knowledge_is_complete_typed_reachable_and_editor_exact() {
     );
     assert_eq!(
         index.by_path().len(),
-        702,
+        562,
         "the field-knowledge gate covers every published schema path"
     );
     assert_eq!(
         index.references().len(),
-        279,
+        225,
         "every published local reference remains resolved in the deterministic reference index"
     );
     assert_eq!(
@@ -336,12 +336,12 @@ fn published_field_knowledge_is_complete_typed_reachable_and_editor_exact() {
     }));
     assert_eq!(
         index.coverage_by_sensitivity()[&Sensitivity::SecretReference],
-        14,
+        9,
         "secret-reference values and names remain explicitly never-reportable"
     );
     assert_eq!(
         index.coverage_by_sensitivity()[&Sensitivity::RedactedFixture],
-        51,
+        29,
         "fixture request, response, input, body, and expected values remain redacted"
     );
     walk_schema(
@@ -364,12 +364,9 @@ fn published_field_knowledge_is_complete_typed_reachable_and_editor_exact() {
     for pointer in [
         "/properties/relay/properties/origin",
         "/properties/relay/properties/jwks_url",
-        "/$defs/oid4vci/properties/authorization_server/properties/token_url",
-        "/$defs/oid4vci/properties/client/properties/id",
         "/$defs/privateCidrs/items",
-        "/$defs/oid4vci/properties/access_token/properties/signing_kid",
         "/$defs/credential/oneOf/3/properties/generation",
-        "/properties/notary_state/properties/postgresql/properties/root_certificate_path",
+        "/properties/relay_state/properties/postgresql/properties/root_certificate_path",
     ] {
         assert!(
             matches!(
@@ -470,6 +467,51 @@ fn schemas_compile_and_all_catalog_documents_pass_schema_and_runtime() {
         ],
         "the parity gate must enumerate the exact published five-schema catalog"
     );
+    let project_schema = compile_schema("project.schema.json").0;
+    assert_eq!(
+        project_schema.pointer("/$defs/consultationService/properties/kind/const"),
+        Some(&Value::String("consultation_api".to_string())),
+        "Relay consultations retain one explicit service kind"
+    );
+    assert!(
+        project_schema.pointer("/$defs/evidenceService").is_none(),
+        "standalone Evidence is not a registryctl project-authoring service"
+    );
+    let environment_schema = compile_schema("environment.schema.json").0;
+    assert_eq!(
+        environment_schema["properties"]
+            .as_object()
+            .expect("environment properties are closed")
+            .keys()
+            .map(String::as_str)
+            .collect::<BTreeSet<_>>(),
+        [
+            "deployment",
+            "development",
+            "entities",
+            "integrations",
+            "relay",
+            "relay_state",
+            "version",
+        ]
+        .into_iter()
+        .collect(),
+        "the environment schema exposes only Relay, source, entity, and development bindings"
+    );
+    assert_eq!(
+        environment_schema.pointer("/properties/deployment/required"),
+        Some(&serde_json::json!(["profile", "relay"])),
+        "the Relay-only deployment contract requires its Relay service binding"
+    );
+    for schema in &coverage.schemas {
+        let document = std::fs::read_to_string(schema_root().join(&schema.file))
+            .expect("published schema text reads");
+        assert!(
+            !document.to_ascii_lowercase().contains("notary"),
+            "{} must not publish retired Notary vocabulary",
+            schema.kind
+        );
+    }
     let compiled = coverage
         .schemas
         .iter()
@@ -759,27 +801,27 @@ fn exact_published_structural_contract_inventory_is_release_gated() {
             (
                 "project",
                 PublishedStructuralInventory {
-                    nodes: 253,
-                    local_refs: 123,
-                    union_nodes: 9,
-                    union_branches: 19,
+                    nodes: 220,
+                    local_refs: 112,
+                    union_nodes: 7,
+                    union_branches: 15,
                     conditionals: 0,
-                    objects: 51,
-                    closed_objects: 36,
-                    typed_maps: 15,
+                    objects: 44,
+                    closed_objects: 31,
+                    typed_maps: 13,
                     open_maps: 0,
-                    arrays: 11,
-                    scalar_types: 30,
+                    arrays: 8,
+                    scalar_types: 24,
                     nullable_nodes: 0,
-                    integer_lower_bounds: 9,
-                    integer_upper_bounds: 9,
-                    string_length_bounds: 10,
-                    string_patterns: 12,
-                    array_size_bounds: 9,
-                    unique_arrays: 8,
-                    object_size_bounds: 17,
-                    property_name_constraints: 14,
-                    enums: 13,
+                    integer_lower_bounds: 8,
+                    integer_upper_bounds: 8,
+                    string_length_bounds: 8,
+                    string_patterns: 11,
+                    array_size_bounds: 6,
+                    unique_arrays: 5,
+                    object_size_bounds: 15,
+                    property_name_constraints: 12,
+                    enums: 10,
                     consts: 8,
                     defaults: 0,
                     deprecations: 0,
@@ -788,29 +830,29 @@ fn exact_published_structural_contract_inventory_is_release_gated() {
             (
                 "environment",
                 PublishedStructuralInventory {
-                    nodes: 239,
-                    local_refs: 92,
-                    union_nodes: 6,
-                    union_branches: 17,
-                    conditionals: 7,
-                    objects: 42,
-                    closed_objects: 38,
-                    typed_maps: 4,
+                    nodes: 148,
+                    local_refs: 54,
+                    union_nodes: 4,
+                    union_branches: 12,
+                    conditionals: 3,
+                    objects: 28,
+                    closed_objects: 25,
+                    typed_maps: 3,
                     open_maps: 0,
-                    arrays: 6,
-                    scalar_types: 46,
+                    arrays: 3,
+                    scalar_types: 35,
                     nullable_nodes: 0,
-                    integer_lower_bounds: 19,
-                    integer_upper_bounds: 19,
-                    string_length_bounds: 17,
-                    string_patterns: 15,
-                    array_size_bounds: 6,
-                    unique_arrays: 6,
-                    object_size_bounds: 5,
-                    property_name_constraints: 4,
-                    enums: 3,
+                    integer_lower_bounds: 15,
+                    integer_upper_bounds: 15,
+                    string_length_bounds: 12,
+                    string_patterns: 12,
+                    array_size_bounds: 3,
+                    unique_arrays: 3,
+                    object_size_bounds: 3,
+                    property_name_constraints: 3,
+                    enums: 2,
                     consts: 6,
-                    defaults: 4,
+                    defaults: 0,
                     deprecations: 0,
                 },
             ),
@@ -846,26 +888,26 @@ fn exact_published_structural_contract_inventory_is_release_gated() {
             (
                 "fixture",
                 PublishedStructuralInventory {
-                    nodes: 72,
-                    local_refs: 11,
-                    union_nodes: 4,
-                    union_branches: 8,
+                    nodes: 44,
+                    local_refs: 6,
+                    union_nodes: 3,
+                    union_branches: 6,
                     conditionals: 0,
-                    objects: 21,
-                    closed_objects: 11,
-                    typed_maps: 7,
-                    open_maps: 3,
-                    arrays: 4,
-                    scalar_types: 36,
-                    nullable_nodes: 4,
+                    objects: 14,
+                    closed_objects: 7,
+                    typed_maps: 5,
+                    open_maps: 2,
+                    arrays: 2,
+                    scalar_types: 21,
+                    nullable_nodes: 3,
                     integer_lower_bounds: 1,
                     integer_upper_bounds: 1,
-                    string_length_bounds: 9,
-                    string_patterns: 7,
-                    array_size_bounds: 4,
+                    string_length_bounds: 6,
+                    string_patterns: 6,
+                    array_size_bounds: 2,
                     unique_arrays: 0,
-                    object_size_bounds: 10,
-                    property_name_constraints: 4,
+                    object_size_bounds: 7,
+                    property_name_constraints: 3,
                     enums: 2,
                     consts: 1,
                     defaults: 0,
diff --git a/crates/registryctl/tests/project_build_baseline_set.rs b/crates/registryctl/tests/project_build_baseline_set.rs
index a4c8fb34c..8243e4e82 100644
--- a/crates/registryctl/tests/project_build_baseline_set.rs
+++ b/crates/registryctl/tests/project_build_baseline_set.rs
@@ -62,7 +62,6 @@ fn sign_product_baseline(
     let lane = match product_directory {
         "relay-public" => ProductAcceptanceLaneV1::RelayPublic,
         "relay-consultation" => ProductAcceptanceLaneV1::RelayConsultation,
-        "notary" => ProductAcceptanceLaneV1::Notary,
         _ => panic!("unexpected product signing-input directory"),
     };
     assert_eq!(
@@ -70,7 +69,7 @@ fn sign_product_baseline(
         match lane {
             ProductAcceptanceLaneV1::RelayPublic | ProductAcceptanceLaneV1::RelayConsultation =>
                 "registry-relay",
-            ProductAcceptanceLaneV1::Notary => "registry-notary",
+            _ => unreachable!("test signing inputs use Relay lanes only"),
         }
     );
     let private_key = temporary.join(format!("{suffix}-private.jwk"));
@@ -176,21 +175,11 @@ fn sign_common_set(
         "local",
         &format!("{suffix}-relay-consultation"),
     );
-    let notary = sign_product_baseline(
-        output,
-        temporary,
-        "registry-notary",
-        "notary",
-        "local",
-        &format!("{suffix}-notary"),
-    );
     ProjectBuildBaselineSetOptions {
         relay_against: Some(relay.bundle),
         relay_anchor: Some(relay.anchor),
         relay_consultation_against: Some(relay_consultation.bundle),
         relay_consultation_anchor: Some(relay_consultation.anchor),
-        notary_against: Some(notary.bundle),
-        notary_anchor: Some(notary.anchor),
     }
 }
 
@@ -234,7 +223,7 @@ fn assert_value_free_rejection(
 }
 
 #[test]
-fn initial_and_common_approved_baseline_builds_are_distinct_and_lineage_is_product_labelled() {
+fn initial_and_two_lane_relay_baseline_builds_are_distinct_and_lineage_is_lane_labelled() {
     let temporary = tempfile::tempdir().expect("temporary directory creates");
     let project = initialize_project(temporary.path());
     let output = initial_build(&project);
@@ -244,10 +233,7 @@ fn initial_and_common_approved_baseline_builds_are_distinct_and_lineage_is_produ
     let relay_consultation_initial =
         std::fs::read(output.join("private/relay-consultation/approval/project-state.json"))
             .expect("initial consultation Relay approval state reads");
-    let notary_initial = std::fs::read(output.join("private/notary/approval/project-state.json"))
-        .expect("initial Notary approval state reads");
     assert_eq!(relay_initial, relay_consultation_initial);
-    assert_eq!(relay_initial, notary_initial);
     let initial_state: serde_json::Value =
         serde_json::from_slice(&relay_initial).expect("initial approval state parses");
     assert_eq!(
@@ -265,28 +251,12 @@ fn initial_and_common_approved_baseline_builds_are_distinct_and_lineage_is_produ
         .relay_consultation_against
         .as_deref()
         .expect("consultation Relay baseline exists");
-    let notary_baseline = baselines
-        .notary_against
-        .as_deref()
-        .expect("Notary baseline exists");
-    assert_eq!(
-        std::fs::read(relay_baseline.join("approval/project-state.json"))
-            .expect("signed Relay approval state reads"),
-        std::fs::read(notary_baseline.join("approval/project-state.json"))
-            .expect("signed Notary approval state reads")
-    );
     assert_eq!(
         std::fs::read(relay_baseline.join("approval/project-state.json"))
             .expect("signed Relay approval state reads"),
         std::fs::read(relay_consultation_baseline.join("approval/project-state.json"))
             .expect("signed consultation Relay approval state reads")
     );
-    assert_eq!(
-        std::fs::read(relay_baseline.join("approval/review.json"))
-            .expect("signed Relay review reads"),
-        std::fs::read(notary_baseline.join("approval/review.json"))
-            .expect("signed Notary review reads")
-    );
     assert_eq!(
         std::fs::read(relay_baseline.join("approval/review.json"))
             .expect("signed Relay review reads"),
@@ -308,20 +278,13 @@ fn initial_and_common_approved_baseline_builds_are_distinct_and_lineage_is_produ
     let relay_consultation_next =
         std::fs::read(next_output.join("private/relay-consultation/approval/project-state.json"))
             .expect("next consultation Relay approval state reads");
-    let notary_next = std::fs::read(next_output.join("private/notary/approval/project-state.json"))
-        .expect("next Notary approval state reads");
     assert_eq!(relay_next, relay_consultation_next);
-    assert_eq!(relay_next, notary_next);
     let state: serde_json::Value =
         serde_json::from_slice(&relay_next).expect("next approval state parses");
     assert_eq!(
         state["baseline"]["verified_manifests"]["relay"]["acceptance_identity"]["product"],
         "registry-relay"
     );
-    assert_eq!(
-        state["baseline"]["verified_manifests"]["notary"]["acceptance_identity"]["product"],
-        "registry-notary"
-    );
     assert_eq!(
         state["baseline"]["verified_manifests"]["relay_consultation"]["acceptance_identity"]
             ["product"],
@@ -334,9 +297,6 @@ fn initial_and_common_approved_baseline_builds_are_distinct_and_lineage_is_produ
         state["baseline"]["verified_manifests"]["relay_consultation"]["bundle_id"]
             .as_str()
             .expect("consultation Relay closure digest"),
-        state["baseline"]["verified_manifests"]["notary"]["bundle_id"]
-            .as_str()
-            .expect("Notary closure digest"),
     ];
     assert!(bundle_ids
         .iter()
@@ -346,8 +306,8 @@ fn initial_and_common_approved_baseline_builds_are_distinct_and_lineage_is_produ
             .into_iter()
             .collect::<std::collections::BTreeSet<_>>()
             .len(),
-        3,
-        "each product lane binds its distinct complete signing-input closure"
+        2,
+        "each Relay lane binds its distinct complete signing-input closure"
     );
 }
 
@@ -374,12 +334,10 @@ fn partial_swapped_tampered_and_wrong_environment_sets_fail_before_publication()
     );
 
     let swapped = ProjectBuildBaselineSetOptions {
-        relay_against: baselines.notary_against.clone(),
-        relay_anchor: baselines.notary_anchor.clone(),
-        relay_consultation_against: baselines.relay_consultation_against.clone(),
-        relay_consultation_anchor: baselines.relay_consultation_anchor.clone(),
-        notary_against: baselines.relay_against.clone(),
-        notary_anchor: baselines.relay_anchor.clone(),
+        relay_against: baselines.relay_consultation_against.clone(),
+        relay_anchor: baselines.relay_consultation_anchor.clone(),
+        relay_consultation_against: baselines.relay_against.clone(),
+        relay_consultation_anchor: baselines.relay_anchor.clone(),
     };
     assert_value_free_rejection(&project, &swapped, temporary.path());
 
@@ -457,14 +415,12 @@ fn partial_swapped_tampered_and_wrong_environment_sets_fail_before_publication()
         relay_anchor: Some(wrong_environment.anchor),
         relay_consultation_against: baselines.relay_consultation_against,
         relay_consultation_anchor: baselines.relay_consultation_anchor,
-        notary_against: baselines.notary_against,
-        notary_anchor: baselines.notary_anchor,
     };
     assert_value_free_rejection(&project, &wrong_environment, temporary.path());
 }
 
 #[test]
-fn independently_valid_but_divergent_product_approval_states_are_rejected() {
+fn independently_valid_but_divergent_relay_lane_approval_states_are_rejected() {
     let temporary = tempfile::tempdir().expect("temporary directory creates");
     let project = initialize_project(temporary.path());
     let first_output = initial_build(&project);
@@ -476,15 +432,6 @@ fn independently_valid_but_divergent_product_approval_states_are_rejected() {
         "local",
         "divergent-relay",
     );
-    let relay_consultation = sign_product_baseline(
-        &first_output,
-        temporary.path(),
-        "registry-relay",
-        "relay-consultation",
-        "local",
-        "divergent-relay-consultation",
-    );
-
     let environment_path = project.join("environments/local.yaml");
     let original_environment =
         std::fs::read_to_string(&environment_path).expect("environment reads");
@@ -495,13 +442,13 @@ fn independently_valid_but_divergent_product_approval_states_are_rejected() {
     assert_ne!(changed_environment, original_environment);
     std::fs::write(&environment_path, changed_environment).expect("environment changes");
     let second_output = initial_build(&project);
-    let notary = sign_product_baseline(
+    let relay_consultation = sign_product_baseline(
         &second_output,
         temporary.path(),
-        "registry-notary",
-        "notary",
+        "registry-relay",
+        "relay-consultation",
         "local",
-        "divergent-notary",
+        "divergent-relay-consultation",
     );
     std::fs::write(&environment_path, original_environment).expect("environment restores");
 
@@ -510,8 +457,6 @@ fn independently_valid_but_divergent_product_approval_states_are_rejected() {
         relay_anchor: Some(relay.anchor),
         relay_consultation_against: Some(relay_consultation.bundle),
         relay_consultation_anchor: Some(relay_consultation.anchor),
-        notary_against: Some(notary.bundle),
-        notary_anchor: Some(notary.anchor),
     };
     assert_value_free_rejection(&project, &divergent, temporary.path());
 }
@@ -531,7 +476,7 @@ fn pre_1_approval_state_baselines_are_rejected_at_ingress() {
     state["schema"] = serde_json::json!("registry.project.approval-state.v3");
     let mut state_bytes = serde_json::to_vec_pretty(&state).expect("pre-1.0 state serializes");
     state_bytes.push(b'\n');
-    for product_directory in ["relay-public", "relay-consultation", "notary"] {
+    for product_directory in ["relay-public", "relay-consultation"] {
         std::fs::write(
             pre_1_output
                 .join("signing-inputs")
@@ -558,21 +503,11 @@ fn pre_1_approval_state_baselines_are_rejected_at_ingress() {
         "local",
         "pre-1-relay-consultation",
     );
-    let notary = sign_product_baseline(
-        &pre_1_output,
-        temporary.path(),
-        "registry-notary",
-        "notary",
-        "local",
-        "pre-1-notary",
-    );
     let pre_1 = ProjectBuildBaselineSetOptions {
         relay_against: Some(relay.bundle),
         relay_anchor: Some(relay.anchor),
         relay_consultation_against: Some(relay_consultation.bundle),
         relay_consultation_anchor: Some(relay_consultation.anchor),
-        notary_against: Some(notary.bundle),
-        notary_anchor: Some(notary.anchor),
     };
 
     assert_value_free_rejection(&project, &pre_1, temporary.path());
diff --git a/crates/registryctl/tests/project_capability_inventory.rs b/crates/registryctl/tests/project_capability_inventory.rs
index 096bff3d7..59f3427fc 100644
--- a/crates/registryctl/tests/project_capability_inventory.rs
+++ b/crates/registryctl/tests/project_capability_inventory.rs
@@ -70,18 +70,10 @@ fn compiled_input() -> CapabilityInventoryInput {
             SupportComponent::RegistryRelayProduct,
             SupportEvidence::LinkedCrate,
         ),
-        (
-            SupportComponent::RegistryNotaryProduct,
-            SupportEvidence::LinkedCrate,
-        ),
         (
             SupportComponent::RegistryRelayValidator,
             SupportEvidence::LinkedProductValidator,
         ),
-        (
-            SupportComponent::RegistryNotaryValidator,
-            SupportEvidence::LinkedProductValidator,
-        ),
         (
             SupportComponent::ProjectAuthoringSchema,
             SupportEvidence::EmbeddedSchema,
@@ -90,10 +82,6 @@ fn compiled_input() -> CapabilityInventoryInput {
             SupportComponent::RegistryRelayConfigSchema,
             SupportEvidence::EmbeddedSchema,
         ),
-        (
-            SupportComponent::RegistryNotaryConfigSchema,
-            SupportEvidence::EmbeddedSchema,
-        ),
         (
             SupportComponent::RegistryctlDistribution,
             SupportEvidence::ReleaseMetadata,
@@ -110,18 +98,13 @@ fn compiled_input() -> CapabilityInventoryInput {
             SupportEvidence::ExplicitlyMissing,
         )
         .expect("missing worker records");
-    for image in [
-        SupportComponent::RegistryRelayImage,
-        SupportComponent::RegistryNotaryImage,
-    ] {
-        input
-            .record_support(
-                image,
-                SupportState::NotEvaluated,
-                SupportEvidence::NoEvidence,
-            )
-            .expect("image remains not evaluated");
-    }
+    input
+        .record_support(
+            SupportComponent::RegistryRelayImage,
+            SupportState::NotEvaluated,
+            SupportEvidence::NoEvidence,
+        )
+        .expect("Relay image remains not evaluated");
     input
 }
 
@@ -132,7 +115,6 @@ fn canonical_input() -> CapabilityInventoryInput {
         CapabilityId::SourceScript,
         CapabilityId::SourceSnapshot,
         CapabilityId::RegistryRelayProduct,
-        CapabilityId::RegistryNotaryProduct,
     ] {
         input
             .record_project_declaration(capability)
@@ -142,7 +124,6 @@ fn canonical_input() -> CapabilityInventoryInput {
         CapabilityId::SourceHttp,
         CapabilityId::SourceScript,
         CapabilityId::RegistryRelayProduct,
-        CapabilityId::RegistryNotaryProduct,
     ] {
         input
             .record_environment_enablement(capability)
@@ -154,7 +135,6 @@ fn canonical_input() -> CapabilityInventoryInput {
             CapabilityUsageCounts {
                 services: 1,
                 consultations: 1,
-                claims: 0,
             },
         ),
         (
@@ -162,7 +142,6 @@ fn canonical_input() -> CapabilityInventoryInput {
             CapabilityUsageCounts {
                 services: 0,
                 consultations: 1,
-                claims: 1,
             },
         ),
         (
@@ -170,7 +149,6 @@ fn canonical_input() -> CapabilityInventoryInput {
             CapabilityUsageCounts {
                 services: 0,
                 consultations: 1,
-                claims: 1,
             },
         ),
         (
@@ -178,7 +156,6 @@ fn canonical_input() -> CapabilityInventoryInput {
             CapabilityUsageCounts {
                 services: 0,
                 consultations: 1,
-                claims: 1,
             },
         ),
         (
@@ -186,15 +163,6 @@ fn canonical_input() -> CapabilityInventoryInput {
             CapabilityUsageCounts {
                 services: 1,
                 consultations: 2,
-                claims: 0,
-            },
-        ),
-        (
-            CapabilityId::RegistryNotaryProduct,
-            CapabilityUsageCounts {
-                services: 0,
-                consultations: 0,
-                claims: 1,
             },
         ),
     ] {
@@ -251,7 +219,7 @@ fn pure_builder_is_deterministic_and_matches_the_canonical_fixture() {
 
 #[test]
 fn schema_and_typed_ingress_require_every_closed_inventory_row_exactly_once() {
-    for (collection, duplicate_index) in [("capabilities", 11), ("support", 13)] {
+    for (collection, duplicate_index) in [("capabilities", 8), ("support", 9)] {
         let mut duplicate = parse(FIXTURE);
         let first = duplicate[collection][0].clone();
         duplicate[collection][duplicate_index] = first;
@@ -328,7 +296,6 @@ fn installed_declared_enabled_used_missing_and_inactive_states_stay_distinct() {
             CapabilityUsageCounts {
                 services: 0,
                 consultations: 1,
-                claims: 0,
             },
         )
         .expect("script usage records");
@@ -366,7 +333,6 @@ fn builder_fails_closed_on_inconsistent_or_duplicate_evidence() {
             CapabilityUsageCounts {
                 services: 0,
                 consultations: 1,
-                claims: 0,
             },
         )
         .expect("usage records");
@@ -400,7 +366,53 @@ fn builder_fails_closed_on_inconsistent_or_duplicate_evidence() {
 }
 
 #[test]
-fn image_and_runtime_activation_claims_cannot_be_inferred_from_static_input() {
+fn unsupported_source_usage_is_reported_with_missing_support() {
+    let mut input = CapabilityInventoryInput::new();
+    input
+        .record_installed_capability(
+            CapabilityId::SourceSnapshot,
+            InstalledCapabilityState::Unsupported,
+            InstalledCapabilityEvidence::ExplicitlyUnsupported,
+        )
+        .expect("unsupported source evidence records");
+    input
+        .record_project_declaration(CapabilityId::SourceSnapshot)
+        .expect("unsupported source declaration records");
+    input
+        .record_environment_enablement(CapabilityId::SourceSnapshot)
+        .expect("unsupported source enablement records");
+    input
+        .record_usage(
+            CapabilityId::SourceSnapshot,
+            CapabilityUsageCounts {
+                services: 1,
+                consultations: 0,
+            },
+        )
+        .expect("unsupported source usage records");
+
+    let report = build_capability_inventory(input).expect("inventory builds");
+    let source = report
+        .capabilities
+        .iter()
+        .find(|record| record.capability == CapabilityId::SourceSnapshot)
+        .expect("snapshot source capability is inventoried");
+    assert_eq!(
+        source.installed_release,
+        InstalledCapabilityState::Unsupported
+    );
+    assert_eq!(
+        source.installed_evidence,
+        InstalledCapabilityEvidence::ExplicitlyUnsupported
+    );
+    assert_eq!(
+        source.disposition,
+        CapabilityDisposition::UsedWithMissingSupport
+    );
+}
+
+#[test]
+fn image_and_runtime_activation_cannot_be_inferred_from_static_input() {
     let mut input = CapabilityInventoryInput::new();
     assert_eq!(
         input.record_support(
@@ -424,14 +436,15 @@ fn image_and_runtime_activation_claims_cannot_be_inferred_from_static_input() {
         report.runtime_activation,
         RuntimeActivationEvaluation::NotEvaluated
     );
-    for image in report
+    let images = report
         .support
         .iter()
         .filter(|assessment| assessment.kind == SupportKind::Image)
-    {
-        assert_eq!(image.state, SupportState::NotEvaluated);
-        assert_eq!(image.evidence, SupportEvidence::NoEvidence);
-    }
+        .collect::<Vec<_>>();
+    assert_eq!(images.len(), 1);
+    assert_eq!(images[0].component, SupportComponent::RegistryRelayImage);
+    assert_eq!(images[0].state, SupportState::NotEvaluated);
+    assert_eq!(images[0].evidence, SupportEvidence::NoEvidence);
 }
 
 #[test]
@@ -443,7 +456,6 @@ fn usage_bound_is_total_and_overflow_safe() {
             CapabilityUsageCounts {
                 services: MAX_CAPABILITY_USAGE_COUNT,
                 consultations: 0,
-                claims: 0,
             },
         )
         .expect("exact maximum records");
@@ -455,7 +467,6 @@ fn usage_bound_is_total_and_overflow_safe() {
             CapabilityUsageCounts {
                 services: MAX_CAPABILITY_USAGE_COUNT,
                 consultations: 1,
-                claims: 0,
             },
         ),
         Err(CapabilityInventoryError::UsageCountOutOfRange)
@@ -468,7 +479,6 @@ fn usage_bound_is_total_and_overflow_safe() {
             CapabilityUsageCounts {
                 services: u32::MAX,
                 consultations: u32::MAX,
-                claims: u32::MAX,
             },
         ),
         Err(CapabilityInventoryError::UsageCountOutOfRange)
@@ -486,9 +496,8 @@ fn usage_bound_is_total_and_overflow_safe() {
 
     let mut aggregate_too_large = parse(FIXTURE);
     aggregate_too_large["capabilities"][0]["used_by"] = json!({
-        "services": 500_000,
+        "services": 500_001,
         "consultations": 500_000,
-        "claims": 1,
         "total": MAX_CAPABILITY_USAGE_COUNT
     });
     assert_schema_valid(&aggregate_too_large);
@@ -528,7 +537,6 @@ fn relay_product_usage_requires_relay_product_support() {
             CapabilityUsageCounts {
                 services: 1,
                 consultations: 0,
-                claims: 0,
             },
         )
         .expect("Relay product usage records");
@@ -568,7 +576,7 @@ fn schema_and_dto_reject_country_value_carriers() {
         ("/capabilities/1", "path", "/COUNTRY/PATH/SENTINEL"),
         ("/support/0", "secret_name", "COUNTRY_SECRET_NAME_SENTINEL"),
         (
-            "/support/12",
+            "/support/9",
             "runtime_observation",
             "COUNTRY_RUNTIME_SENTINEL",
         ),
@@ -596,14 +604,14 @@ fn schema_rejects_image_availability_runtime_activation_and_open_enums() {
     assert_schema_invalid(&runtime);
 
     let mut image = parse(FIXTURE);
-    image["support"][12]["state"] = json!("available");
-    image["support"][12]["evidence"] = json!("release_metadata");
+    image["support"][9]["state"] = json!("available");
+    image["support"][9]["evidence"] = json!("release_metadata");
     assert_schema_invalid(&image);
 
     let mut disguised_image = parse(FIXTURE);
-    disguised_image["support"][12]["kind"] = json!("worker");
-    disguised_image["support"][12]["state"] = json!("available");
-    disguised_image["support"][12]["evidence"] = json!("release_metadata");
+    disguised_image["support"][9]["kind"] = json!("worker");
+    disguised_image["support"][9]["state"] = json!("available");
+    disguised_image["support"][9]["evidence"] = json!("release_metadata");
     assert_schema_invalid(&disguised_image);
     assert!(
         serde_json::from_value::<ProjectCapabilityInventoryReportV1>(disguised_image).is_err(),
@@ -611,8 +619,8 @@ fn schema_rejects_image_availability_runtime_activation_and_open_enums() {
     );
 
     let mut claimed_missing_image = parse(FIXTURE);
-    claimed_missing_image["support"][12]["state"] = json!("missing");
-    claimed_missing_image["support"][12]["evidence"] = json!("explicitly_missing");
+    claimed_missing_image["support"][9]["state"] = json!("missing");
+    claimed_missing_image["support"][9]["evidence"] = json!("explicitly_missing");
     claimed_missing_image["missing_support"]
         .as_array_mut()
         .expect("missing support is an array")
diff --git a/crates/registryctl/tests/project_diagnostic_reference.rs b/crates/registryctl/tests/project_diagnostic_reference.rs
index d93d9bb41..ef9e531ef 100644
--- a/crates/registryctl/tests/project_diagnostic_reference.rs
+++ b/crates/registryctl/tests/project_diagnostic_reference.rs
@@ -2,7 +2,6 @@
 
 use std::collections::BTreeMap;
 
-use registry_notary_server::NOTARY_ACTIVATION_CODE_DEFINITIONS;
 use registry_platform_ops::BUNDLE_VERIFICATION_CODE_DEFINITIONS;
 use registry_relay::consultation::consultation_service_activation_definitions;
 use registry_relay::process_startup::PROCESS_STARTUP_CODE_DEFINITIONS;
@@ -47,8 +46,8 @@ fn published_diagnostic_references_are_closed_complete_and_unreleased() {
     validate_operator_error_reference(&operator).expect("operator reference is exact");
 
     assert_eq!(authoring.entries.len(), 17);
-    assert_eq!(fixture.entries.len(), 16);
-    assert_eq!(operator.entries.len(), 60);
+    assert_eq!(fixture.entries.len(), 15);
+    assert_eq!(operator.entries.len(), 42);
     assert!(
         operator.omissions.is_empty(),
         "all operator catalogs now expose complete product-owned metadata"
@@ -65,7 +64,6 @@ fn published_diagnostic_references_are_closed_complete_and_unreleased() {
         family_counts,
         BTreeMap::from([
             ("bundle_verification", 4),
-            ("notary_activation", 18),
             ("operator_preflight", 11),
             ("relay_activation", 9),
             ("relay_process_startup", 18),
@@ -157,27 +155,6 @@ fn operator_projection_is_exact_to_all_product_owned_metadata() {
             )
         );
     }
-    for definition in &NOTARY_ACTIVATION_CODE_DEFINITIONS {
-        let entry = entry_for(
-            &operator.entries,
-            ErrorReferenceFamily::NotaryActivation,
-            ErrorReferenceProduct::RegistryNotary,
-            definition.code.as_str(),
-        );
-        assert_eq!(entry.phase, definition.phase);
-        assert_eq!(entry.safe_meaning, definition.meaning);
-        assert_eq!(entry.rule, definition.rule);
-        assert_eq!(entry.safe_remediation, definition.remediation);
-        assert_eq!(entry.evidence_scope, definition.evidence_scope);
-        assert_eq!(entry.evidence_limitation, definition.evidence_limitation);
-        assert_eq!(
-            entry.docs_anchor,
-            format!(
-                "/reference/diagnostics/operator/#registry_notary--{}",
-                definition.docs_slug
-            )
-        );
-    }
 }
 
 #[test]
@@ -229,8 +206,8 @@ fn strict_validation_rejects_missing_duplicate_reordered_stale_and_drifted_data(
 
     let mut operator = operator_error_reference();
     operator.omissions.push(OperatorErrorOmission {
-        family: OperatorErrorOmissionFamily::NotaryActivation,
-        product: ErrorReferenceProduct::RegistryNotary,
+        family: OperatorErrorOmissionFamily::RelayActivation,
+        product: ErrorReferenceProduct::RegistryRelay,
         reason: OperatorErrorOmissionReason::NoCompletePublicCodeCatalog,
         evidence: "stale omission".to_string(),
         required_action: "remove it".to_string(),
@@ -281,7 +258,7 @@ fn operator_schema_accepts_exact_catalog_and_rejects_open_values() {
         .compile(&schema)
         .unwrap();
     let canonical = serde_json::to_value(operator_error_reference()).unwrap();
-    assert_eq!(canonical["entries"].as_array().unwrap().len(), 60);
+    assert_eq!(canonical["entries"].as_array().unwrap().len(), 42);
     assert!(validator.is_valid(&canonical));
 
     let mut open_code = canonical.clone();
@@ -293,6 +270,16 @@ fn operator_schema_accepts_exact_catalog_and_rejects_open_values() {
         .unwrap()["code"] = Value::String("relay.startup.unregistered_open_value".to_string());
     assert!(!validator.is_valid(&open_code));
 
+    for (field, stale_value) in [
+        ("family", "notary_activation"),
+        ("owner", "registry_notary"),
+        ("product", "registry_notary"),
+    ] {
+        let mut stale = canonical.clone();
+        stale["entries"][0][field] = Value::String(stale_value.to_string());
+        assert!(!validator.is_valid(&stale));
+    }
+
     let mut open_field = canonical;
     open_field["entries"][0]
         .as_object_mut()
@@ -301,6 +288,22 @@ fn operator_schema_accepts_exact_catalog_and_rejects_open_values() {
     assert!(!validator.is_valid(&open_field));
 }
 
+#[test]
+fn fixture_schema_rejects_retired_authorization_diagnostic() {
+    let schema: Value = serde_json::from_str(FIXTURE_SCHEMA).unwrap();
+    let validator = jsonschema::JSONSchema::options()
+        .with_draft(jsonschema::Draft::Draft202012)
+        .compile(&schema)
+        .unwrap();
+    let canonical = serde_json::to_value(fixture_error_reference()).unwrap();
+    assert_eq!(canonical["entries"].as_array().unwrap().len(), 15);
+    assert!(validator.is_valid(&canonical));
+
+    let mut stale = canonical;
+    stale["entries"][0]["code"] = Value::String("authorization.denied".to_string());
+    assert!(!validator.is_valid(&stale));
+}
+
 fn entry_for<'a>(
     entries: &'a [ErrorReferenceEntry],
     family: ErrorReferenceFamily,
diff --git a/crates/registryctl/tests/project_diagnostic_reference_cli.rs b/crates/registryctl/tests/project_diagnostic_reference_cli.rs
index 7a94073f4..de24e863a 100644
--- a/crates/registryctl/tests/project_diagnostic_reference_cli.rs
+++ b/crates/registryctl/tests/project_diagnostic_reference_cli.rs
@@ -82,7 +82,6 @@ fn run(directory: &std::path::Path, catalog: &str, format: &str) -> Output {
         .env_clear()
         .env("REGISTRY_CONFIG", SENTINEL)
         .env("REGISTRY_RELAY_CONFIG", SENTINEL)
-        .env("REGISTRY_NOTARY_CONFIG", SENTINEL)
         .env("REGISTRYCTL_UPDATE_ENDPOINT", SENTINEL)
         .env("COUNTRY_SECRET", SENTINEL)
         .args([
diff --git a/crates/registryctl/tests/project_documentation_reference.rs b/crates/registryctl/tests/project_documentation_reference.rs
index 41eef4be8..ef1fc4ea9 100644
--- a/crates/registryctl/tests/project_documentation_reference.rs
+++ b/crates/registryctl/tests/project_documentation_reference.rs
@@ -312,7 +312,7 @@ fn human_intent_sidecar_and_documentation_contracts_are_strict_schemas() {
     let intent_schema = compile_schema(&intent_schema_document);
     let intent = read_json(schema_root.join("project-authoring/documentation-intent.json"));
     assert_valid(&intent_schema, &intent, "documentation intent sidecar");
-    assert_eq!(intent["structural_reviews"].as_array().unwrap().len(), 205);
+    assert_eq!(intent["structural_reviews"].as_array().unwrap().len(), 164);
 
     for file in [
         "registry.project.configuration_reference.v1.schema.json",
@@ -344,35 +344,26 @@ fn human_intent_sidecar_and_documentation_contracts_are_strict_schemas() {
             .join("project-documentation")
             .join("registry.runtime.configuration_intent.v1.schema.json"),
     ));
-    for path in [
-        crate_root().join("../registry-relay/config/documentation-intent.json"),
-        crate_root().join("../registry-notary-core/config/documentation-intent.json"),
-    ] {
-        let runtime_intent = read_json(path);
-        assert_valid(
-            &runtime_intent_schema,
-            &runtime_intent,
-            "product-owned runtime intent",
-        );
-        let mut cross_product = runtime_intent.clone();
-        cross_product["profiles"][0]["semantic_owner"] =
-            if cross_product["runtime_schema"] == "relay" {
-                json!("notary_runtime")
-            } else {
-                json!("relay_runtime")
-            };
-        assert!(
-            runtime_intent_schema.validate(&cross_product).is_err(),
-            "the strict runtime intent schema rejects cross-product profile ownership"
-        );
-        let mut unknown_assignment = runtime_intent;
-        unknown_assignment["assignments"][0]["unexpected"] = json!(true);
-        assert!(runtime_intent_schema.validate(&unknown_assignment).is_err());
-        assert!(
-            serde_json::from_value::<RuntimeIntentCatalog>(unknown_assignment).is_err(),
-            "the runtime intent DTO rejects unknown assignment fields"
-        );
-    }
+    let runtime_intent =
+        read_json(crate_root().join("../registry-relay/config/documentation-intent.json"));
+    assert_valid(
+        &runtime_intent_schema,
+        &runtime_intent,
+        "product-owned runtime intent",
+    );
+    let mut cross_product = runtime_intent.clone();
+    cross_product["profiles"][0]["semantic_owner"] = json!("authoring_contract");
+    assert!(
+        runtime_intent_schema.validate(&cross_product).is_err(),
+        "the strict runtime intent schema rejects cross-product profile ownership"
+    );
+    let mut unknown_assignment = runtime_intent;
+    unknown_assignment["assignments"][0]["unexpected"] = json!(true);
+    assert!(runtime_intent_schema.validate(&unknown_assignment).is_err());
+    assert!(
+        serde_json::from_value::<RuntimeIntentCatalog>(unknown_assignment).is_err(),
+        "the runtime intent DTO rejects unknown assignment fields"
+    );
 }
 
 #[test]
@@ -436,18 +427,17 @@ fn embedded_coverage_is_complete_and_generates_the_canonical_reference() {
         coverage.schema_id,
         CONFIGURATION_REFERENCE_COVERAGE_SCHEMA_ID
     );
-    assert_eq!(coverage.coverage.schema_count, 7);
-    assert_eq!(coverage.coverage.path_count, 1829);
+    assert_eq!(coverage.coverage.schema_count, 6);
+    assert_eq!(coverage.coverage.path_count, 1155);
     assert_eq!(
         coverage.coverage.by_schema,
         [
-            (ConfigurationSchemaKind::Project, 220),
-            (ConfigurationSchemaKind::Environment, 213),
+            (ConfigurationSchemaKind::Project, 191),
+            (ConfigurationSchemaKind::Environment, 126),
             (ConfigurationSchemaKind::Integration, 171),
-            (ConfigurationSchemaKind::Fixture, 63),
+            (ConfigurationSchemaKind::Fixture, 39),
             (ConfigurationSchemaKind::Entity, 35),
             (ConfigurationSchemaKind::Relay, 593),
-            (ConfigurationSchemaKind::Notary, 534),
         ]
         .into_iter()
         .collect()
@@ -455,23 +445,23 @@ fn embedded_coverage_is_complete_and_generates_the_canonical_reference() {
     assert_eq!(
         coverage.coverage.by_path_kind,
         [
-            (FieldPathKind::Root, 7),
-            (FieldPathKind::Property, 1_458),
-            (FieldPathKind::MapKey, 26),
-            (FieldPathKind::MapValue, 48),
-            (FieldPathKind::ArrayItem, 178),
-            (FieldPathKind::Branch, 112),
+            (FieldPathKind::Root, 6),
+            (FieldPathKind::Property, 903),
+            (FieldPathKind::MapKey, 22),
+            (FieldPathKind::MapValue, 34),
+            (FieldPathKind::ArrayItem, 102),
+            (FieldPathKind::Branch, 88),
         ]
         .into_iter()
         .collect(),
         "the exact reviewed structural taxonomy remains release-gated"
     );
-    assert_eq!(coverage.reviewed_intent_assignment_required_count, 1829);
+    assert_eq!(coverage.reviewed_intent_assignment_required_count, 1155);
     assert_eq!(
         coverage.reviewed_intent_assignment_covered_count + coverage.missing_intent.len(),
         coverage.reviewed_intent_assignment_required_count
     );
-    assert_eq!(coverage.reviewed_intent_assignment_covered_count, 1829);
+    assert_eq!(coverage.reviewed_intent_assignment_covered_count, 1155);
     assert!(
         coverage.distinct_reviewed_intent_count < coverage.reviewed_intent_assignment_covered_count,
         "assignment coverage must not imply one unique explanation per path"
@@ -488,13 +478,13 @@ fn embedded_coverage_is_complete_and_generates_the_canonical_reference() {
             coverage.distinct_reviewed_intents_reused_count,
             coverage.reviewed_intent_assignments_using_reused_intent_count,
         ),
-        (629, 86, 1_286),
+        (490, 62, 727),
         "the exact intent-text reuse baseline must change intentionally with reviewed documentation"
     );
     assert_eq!(
         coverage.coverage.by_intent_profile.values().sum::<usize>(),
-        1127,
-        "every Relay and Notary path, including both roots, records its exact reviewed profile"
+        593,
+        "every Relay path, including its root, records its exact reviewed profile"
     );
     assert_eq!(
         coverage.missing_intent.len(),
@@ -636,7 +626,7 @@ fn embedded_coverage_is_complete_and_generates_the_canonical_reference() {
                 })
                 .count(),
         ),
-        (528, 315, 0, 986),
+        (260, 259, 0, 636),
         "the exact empty-string semantic coverage prevents constrained strings from regressing to allowed"
     );
     assert_eq!(
@@ -654,7 +644,7 @@ fn embedded_coverage_is_complete_and_generates_the_canonical_reference() {
                     })
             })
             .count(),
-        214,
+        179,
         "schema semantics must retain rejections that the former minLength-only heuristic missed"
     );
     let intent_counts =
@@ -762,10 +752,7 @@ fn embedded_coverage_is_complete_and_generates_the_canonical_reference() {
     );
     assert!(
         reference.fields.iter().all(|field| {
-            let runtime = matches!(
-                field.address.schema,
-                ConfigurationSchemaKind::Relay | ConfigurationSchemaKind::Notary
-            );
+            let runtime = matches!(field.address.schema, ConfigurationSchemaKind::Relay);
             runtime == field.address.key_path.is_some()
                 && (field.address.pointer.is_empty() || field.address.pointer.starts_with('/'))
         }),
@@ -994,13 +981,6 @@ fn runtime_intent_requires_exact_assignments_and_new_paths_cannot_inherit_profil
             .contains("unknown profile")
     );
 
-    let mut wrong_schema = intent.clone();
-    wrong_schema.assignments[0].schema = ConfigurationSchemaKind::Notary;
-    assert!(runtime_configuration_intent_gaps(&document, &wrong_schema)
-        .expect_err("wrong runtime schema identity fails closed")
-        .to_string()
-        .contains("wrong product schema"));
-
     let mut stale_key_path = intent.clone();
     stale_key_path.assignments[0].key_path = "unreviewed_runtime_field".to_owned();
     assert!(
@@ -1036,15 +1016,6 @@ fn runtime_intent_requires_exact_assignments_and_new_paths_cannot_inherit_profil
             .contains("lacks exact extension semantics")
     );
 
-    let mut cross_product_diagnostic = intent.clone();
-    cross_product_diagnostic.profiles[0].diagnostic = "registry.notary.config.invalid".to_owned();
-    assert!(
-        runtime_configuration_intent_gaps(&document, &cross_product_diagnostic)
-            .expect_err("cross-product diagnostic code fails closed")
-            .to_string()
-            .contains("cross-product diagnostic code")
-    );
-
     let mut wrong_kind = intent;
     wrong_kind.assignments[0].path_kind = FieldPathKind::Branch;
     assert!(runtime_configuration_intent_gaps(&document, &wrong_kind)
diff --git a/crates/registryctl/tests/project_fixture_coverage.rs b/crates/registryctl/tests/project_fixture_coverage.rs
index 33cb67d33..8cd3543c1 100644
--- a/crates/registryctl/tests/project_fixture_coverage.rs
+++ b/crates/registryctl/tests/project_fixture_coverage.rs
@@ -28,10 +28,9 @@ use registryctl::{
     FixtureCoverageDimensions, FixtureCoverageEvidenceKind, FixtureCoverageGapReason,
     FixtureCoverageNotApplicableReason, FixtureCoverageNotEvaluatedReason,
     FixtureCoverageRequirementState, FixtureCoverageTarget, FixtureCoverageTargetComparisonInput,
-    FixtureCoverageTargetSetState, FixturePassState, FixtureRequestBindingState,
-    FixtureRequirementCoverage, FixtureSafeCode, GeneratedRecipeApplicability, GeneratorRecipeId,
-    ProjectFixtureCoverageReportV1, RequiredFixtureCoverageRequirement,
-    Sha256Digest as RegistrySha256Digest, SourceCallExpectation,
+    FixtureCoverageTargetSetState, FixturePassState, FixtureRequirementCoverage, FixtureSafeCode,
+    GeneratedRecipeApplicability, GeneratorRecipeId, ProjectFixtureCoverageReportV1,
+    RequiredFixtureCoverageRequirement, Sha256Digest as RegistrySha256Digest,
 };
 use serde_json::{json, Value};
 
@@ -221,8 +220,6 @@ fn empty_dimensions() -> FixtureCoverageDimensions {
     FixtureCoverageDimensions {
         input_ids: Vec::new(),
         output_ids: Vec::new(),
-        claim_ids: Vec::new(),
-        disclosure_modes: Vec::new(),
         status_mappings: Vec::new(),
         protocol_helpers: Vec::new(),
         limits: Vec::new(),
@@ -252,13 +249,6 @@ fn comparison_input_for(targets: &[FixtureCoverageTarget]) -> FixtureCoverageCom
                     .cloned()
                     .into_iter()
                     .collect(),
-                changed_claim_ids: target
-                    .declared
-                    .claim_ids
-                    .first()
-                    .cloned()
-                    .into_iter()
-                    .collect(),
                 source_contract_changed: true,
             })
             .collect(),
@@ -277,8 +267,14 @@ fn canonical_representative_fixture_validates_and_roundtrips_exactly() {
         decoded.summary.target_set_state,
         FixtureCoverageTargetSetState::TargetsPresent
     );
-    assert_eq!(decoded.summary.requirements.total, 35);
-    assert_eq!(decoded.targets[0].requirements.len(), 35);
+    assert_eq!(
+        decoded.summary.requirements.total as usize,
+        RequiredFixtureCoverageRequirement::ALL.len()
+    );
+    assert_eq!(
+        decoded.targets[0].requirements.len(),
+        RequiredFixtureCoverageRequirement::ALL.len()
+    );
     assert!(!decoded.targets[0].fixture_inventory.is_empty());
     assert!(!decoded.targets[0].generated_cases.is_empty());
     assert!(decoded.targets[0]
@@ -338,7 +334,7 @@ fn explicit_no_target_fixture_validates_and_roundtrips_exactly() {
 }
 
 #[test]
-fn generated_targets_have_exact_ordered_35_requirement_contracts() {
+fn generated_targets_have_exact_ordered_requirement_contracts() {
     for (project, capability) in [
         ("bounded-http-starter", FixtureCapability::DeclarativeHttp),
         ("dhis2-script", FixtureCapability::Script),
@@ -355,7 +351,10 @@ fn generated_targets_have_exact_ordered_35_requirement_contracts() {
         );
         let target = only_target(&report);
         assert_eq!(target.identity.capability, capability);
-        assert_eq!(target.requirements.len(), 35);
+        assert_eq!(
+            target.requirements.len(),
+            RequiredFixtureCoverageRequirement::ALL.len()
+        );
         assert_eq!(
             target
                 .requirements
@@ -371,7 +370,7 @@ fn generated_targets_have_exact_ordered_35_requirement_contracts() {
                 .map(FixtureRequirementCoverage::requirement)
                 .collect::<BTreeSet<_>>()
                 .len(),
-            35
+            RequiredFixtureCoverageRequirement::ALL.len()
         );
         for requirement in target.requirements.iter().skip(
             RequiredFixtureCoverageRequirement::ALL.len() - FixtureCoverageChangeKind::ALL.len(),
@@ -385,7 +384,10 @@ fn generated_targets_have_exact_ordered_35_requirement_contracts() {
                 } if evidence.is_empty()
             ));
         }
-        assert_eq!(report.summary.requirements.total, 35);
+        assert_eq!(
+            report.summary.requirements.total as usize,
+            RequiredFixtureCoverageRequirement::ALL.len()
+        );
     }
 }
 
@@ -430,7 +432,7 @@ fn generated_cases_remain_executable_and_isolated_under_their_target() {
 }
 
 #[test]
-fn synthetic_opencrvs_events_api_covers_the_bounded_consultation_contract() {
+fn synthetic_opencrvs_events_api_covers_the_bounded_relay_source_contract() {
     let report = generated_coverage_project("opencrvs-events-api");
     let target = only_target(&report);
     assert_eq!(target.identity.integration, "birth-event-search");
@@ -467,34 +469,6 @@ fn synthetic_opencrvs_events_api_covers_the_bounded_consultation_contract() {
         .find(|fixture| fixture.fixture_id == "birth-event-match")
         .expect("passing exact-selector fixture is present");
     assert_eq!(matched.output_ids, ["event_type", "registered"]);
-    assert_eq!(
-        matched.claim_ids,
-        ["birth-event-found", "birth-event-registered"]
-    );
-    assert_eq!(
-        matched.request_to_consultation_binding.state,
-        FixtureRequestBindingState::Passed
-    );
-    assert_eq!(
-        matched
-            .request_to_consultation_binding
-            .actual_relay_consultations,
-        Some(1)
-    );
-    assert_eq!(
-        matched
-            .request_to_consultation_binding
-            .consultations
-            .iter()
-            .map(|consultation| {
-                (
-                    consultation.service_id.as_str(),
-                    consultation.consultation_id.as_str(),
-                )
-            })
-            .collect::<Vec<_>>(),
-        [("birth-event-verification", "event")]
-    );
 
     for (recipe, safe_code) in [
         (
@@ -509,10 +483,6 @@ fn synthetic_opencrvs_events_api_covers_the_bounded_consultation_contract() {
             GeneratorRecipeId::Timeout,
             Some(FixtureSafeCode::SourceDeadlineExceeded),
         ),
-        (
-            GeneratorRecipeId::AuthorizationBeforeSource,
-            Some(FixtureSafeCode::AuthorizationDenied),
-        ),
         (GeneratorRecipeId::OutputMinimization, None),
     ] {
         let generated = target
@@ -528,15 +498,6 @@ fn synthetic_opencrvs_events_api_covers_the_bounded_consultation_contract() {
         ));
         assert_eq!(generated.actual_safe_code, safe_code);
         assert_eq!(generated.pass_state, FixturePassState::Passed);
-        if recipe == GeneratorRecipeId::AuthorizationBeforeSource {
-            let assertion = generated
-                .source_access_assertion
-                .as_ref()
-                .expect("authorization denial records source-call evidence");
-            assert_eq!(assertion.expected_source_calls, SourceCallExpectation::Zero);
-            assert_eq!(assertion.actual_source_calls, Some(0));
-            assert!(assertion.passed);
-        }
     }
 }
 
@@ -571,7 +532,10 @@ fn no_targets_and_a_fixtureless_target_are_distinct_states() {
         report.summary.target_set_state,
         FixtureCoverageTargetSetState::TargetsPresent
     );
-    assert_eq!(report.targets[0].requirements.len(), 35);
+    assert_eq!(
+        report.targets[0].requirements.len(),
+        RequiredFixtureCoverageRequirement::ALL.len()
+    );
 }
 
 #[test]
@@ -592,21 +556,6 @@ fn declared_and_exercised_dimensions_do_not_relabel_semantics_as_coverage() {
             ..
         })
     ));
-    if !script.declared.claim_ids.is_empty() {
-        assert!(!script.declared.disclosure_modes.is_empty());
-        assert!(script.exercised.disclosure_modes.is_empty());
-        assert!(matches!(
-            script
-                .requirements
-                .iter()
-                .find(|coverage| coverage.requirement()
-                    == RequiredFixtureCoverageRequirement::ExercisedDisclosureModes),
-            Some(FixtureRequirementCoverage::Missing {
-                reason: FixtureCoverageGapReason::RuntimeDimensionNotObserved,
-                ..
-            })
-        ));
-    }
     assert!(script.declared.limits.len() > script.exercised.limits.len());
 }
 
@@ -685,7 +634,10 @@ fn multi_target_evidence_cannot_cross_integration_boundaries() {
         ProjectFixtureCoverageReportV1::from_targets("multi-target".to_owned(), None, targets)
             .expect("disjoint targets form one valid report");
     assert_eq!(report.targets.len(), 2);
-    assert_eq!(report.summary.requirements.total, 70);
+    assert_eq!(
+        report.summary.requirements.total as usize,
+        RequiredFixtureCoverageRequirement::ALL.len() * 2
+    );
 
     let mut document = serde_json::to_value(report).unwrap();
     let foreign_evidence = document["targets"][1]["fixture_inventory"][0]["evidence"].clone();
@@ -765,10 +717,6 @@ fn fixed_scope_sentinels_and_evidence_kinds_cannot_claim_live_compatibility() {
         ("evidence_scope", json!("live_country_source")),
         ("compatibility_claim", json!("source_interoperable")),
         ("live_compatibility", json!("compatible")),
-        (
-            "governed_request_evidence",
-            json!("independent_caller_contract_compatible"),
-        ),
     ] {
         let mut document = serde_json::to_value(&report).unwrap();
         document[field] = value;
@@ -776,78 +724,12 @@ fn fixed_scope_sentinels_and_evidence_kinds_cannot_claim_live_compatibility() {
         assert_typed_invalid(document);
     }
 
-    let mut omitted_boundary = serde_json::to_value(&report).unwrap();
-    omitted_boundary
-        .as_object_mut()
-        .expect("coverage report is an object")
-        .remove("governed_request_evidence");
-    assert_schema_invalid(&omitted_boundary);
-    assert_typed_invalid(omitted_boundary);
-
     let mut wrong_kind = serde_json::to_value(report).unwrap();
     wrong_kind["targets"][0]["fixture_inventory"][0]["evidence"]["kind"] =
         json!("semantic_comparison");
     assert_typed_invalid(wrong_kind);
 }
 
-#[test]
-fn pre_witness_v1_report_is_intentionally_rejected_during_pre_one_point_zero() {
-    // The public compatibility promise starts at registryctl v1.0.0:
-    // docs/site/src/content/docs/spec/rs-pr-registryctl.mdx. Before that
-    // boundary, this closed report is replaced deliberately instead of being
-    // accepted with a misleading mapping-derived request claim.
-    let mut legacy = parse(REPRESENTATIVE_FIXTURE);
-    legacy
-        .as_object_mut()
-        .expect("legacy report is an object")
-        .remove("governed_request_evidence");
-    let targets = legacy["targets"]
-        .as_array_mut()
-        .expect("targets are an array");
-    let mut removed_states = Vec::new();
-    for target in targets {
-        target["contract"]
-            .as_object_mut()
-            .expect("target contract is an object")
-            .remove("registry_backed_consultations");
-        for fixture in target["fixture_inventory"]
-            .as_array_mut()
-            .expect("fixture inventory is an array")
-        {
-            fixture
-                .as_object_mut()
-                .expect("fixture record is an object")
-                .remove("request_to_consultation_binding");
-        }
-        let requirements = target["requirements"]
-            .as_array_mut()
-            .expect("requirements are an array");
-        let position = requirements
-            .iter()
-            .position(|coverage| coverage["requirement"] == "request_to_consultation_binding")
-            .expect("new request requirement is present");
-        let removed = requirements.remove(position);
-        removed_states.push(
-            removed["state"]
-                .as_str()
-                .expect("removed requirement state is a string")
-                .to_owned(),
-        );
-    }
-    let counts = legacy["summary"]["requirements"]
-        .as_object_mut()
-        .expect("summary counts are an object");
-    for state in removed_states {
-        let count = counts[&state].as_u64().expect("state count is numeric");
-        counts.insert(state, json!(count - 1));
-        let total = counts["total"].as_u64().expect("total count is numeric");
-        counts.insert("total".to_owned(), json!(total - 1));
-    }
-
-    assert_schema_invalid(&legacy);
-    assert_typed_invalid(legacy);
-}
-
 #[test]
 fn report_has_no_value_path_or_secret_bearing_fields() {
     let temporary = tempfile::tempdir().expect("temporary directory");
@@ -859,12 +741,6 @@ fn report_has_no_value_path_or_secret_bearing_fields() {
         "FICTIONAL_REGISTRY_TOKEN",
         "SECRET_REFERENCE_SENTINEL",
     );
-    replace_authored_text(
-        &project,
-        "environments/local.yaml",
-        "/run/secrets/relay-workload-token",
-        "/private/PATH-SENTINEL",
-    );
     replace_authored_text(
         &project,
         "environments/local.yaml",
@@ -914,7 +790,6 @@ fn report_has_no_value_path_or_secret_bearing_fields() {
         "query",
         "body",
         "outputs",
-        "claims",
         "values",
         "cel",
         "generated_at",
@@ -930,7 +805,6 @@ fn report_has_no_value_path_or_secret_bearing_fields() {
         b"SECRET_REFERENCE_SENTINEL".as_slice(),
         b"FIXTURE-INPUT-SENTINEL".as_slice(),
         b"TOP-SECRET-CREDENTIAL".as_slice(),
-        b"/private/PATH-SENTINEL".as_slice(),
         b"https://ORIGIN-SENTINEL.invalid".as_slice(),
     ] {
         assert!(!bytes
@@ -957,7 +831,6 @@ fn comparison_input_is_strict_and_default_reports_do_not_fake_affected_sets() {
             "integration": "health",
             "changed_input_ids": ["person_id"],
             "changed_output_ids": [],
-            "changed_claim_ids": [],
             "source_contract_changed": true
         }]
     });
@@ -1095,7 +968,7 @@ fn comparison_enabled_generation_validates_all_impacts_and_keeps_targets_isolate
     let document = serde_json::to_value(&report).unwrap();
     assert_schema_valid(&document);
     let roundtrip: ProjectFixtureCoverageReportV1 =
-        serde_json::from_value(document.clone()).expect("all four impacts roundtrip");
+        serde_json::from_value(document.clone()).expect("all three impacts roundtrip");
     assert_eq!(roundtrip, report);
 
     for target in &report.targets {
diff --git a/crates/registryctl/tests/project_preflight.rs b/crates/registryctl/tests/project_preflight.rs
index 533dde43d..542576d44 100644
--- a/crates/registryctl/tests/project_preflight.rs
+++ b/crates/registryctl/tests/project_preflight.rs
@@ -166,17 +166,20 @@ fn secret_missing_whitespace_and_present_states_never_expose_names_or_values() {
     input
         .add_secret_reference(
             EMPTY_NAME,
-            PreflightSecretConsumer::IssuanceSigningKey,
-            address("environments/production.yaml", "/issuance/signing_key"),
+            PreflightSecretConsumer::SourceOauthClientSecret,
+            address(
+                "environments/production.yaml",
+                "/integrations/alpha/source/oauth/client_secret",
+            ),
         )
         .expect("empty reference records");
     input
         .add_secret_reference(
             PRESENT_NAME,
-            PreflightSecretConsumer::CallerApiKeyFingerprint,
+            PreflightSecretConsumer::EntityPostgresConnection,
             address(
                 "environments/production.yaml",
-                "/callers/health/api_key_fingerprint",
+                "/entities/people/provider/connection/secret",
             ),
         )
         .expect("present reference records");
@@ -318,8 +321,8 @@ fn runtime_files_close_missing_empty_regular_symlink_and_unsafe_modes() {
         ),
         (
             unsafe_private.as_path(),
-            PreflightRuntimeFileKind::NotaryToRelayToken,
-            "/notary_relay/token_file",
+            PreflightRuntimeFileKind::EntityCsv,
+            "/entities/people/provider/path",
         ),
         (
             oversized.as_path(),
@@ -359,7 +362,7 @@ fn runtime_files_close_missing_empty_regular_symlink_and_unsafe_modes() {
         PreflightCheckState::UnsafeMode
     );
     assert_eq!(
-        states[&PreflightRuntimeFileKind::NotaryToRelayToken],
+        states[&PreflightRuntimeFileKind::EntityCsv],
         PreflightCheckState::UnsafeMode
     );
     assert_eq!(
@@ -392,8 +395,11 @@ fn public_trust_and_private_material_apply_distinct_unix_modes() {
     input
         .add_runtime_file(
             &shared,
-            PreflightRuntimeFileKind::NotaryToRelayToken,
-            address("environments/production.yaml", "/notary_relay/token_file"),
+            PreflightRuntimeFileKind::EntityCsv,
+            address(
+                "environments/production.yaml",
+                "/entities/people/provider/path",
+            ),
         )
         .expect("private material records");
 
@@ -408,7 +414,7 @@ fn public_trust_and_private_material_apply_distinct_unix_modes() {
         PreflightCheckState::Available
     );
     assert_eq!(
-        states[&PreflightRuntimeFileKind::NotaryToRelayToken],
+        states[&PreflightRuntimeFileKind::EntityCsv],
         PreflightCheckState::UnsafeMode
     );
 }
@@ -499,7 +505,7 @@ fn entity_provider_files_enforce_private_posture_and_relay_default_size_bound()
 
 #[cfg(unix)]
 #[test]
-fn undeclared_generations_are_never_inferred_for_state_roots_or_workload_token() {
+fn undeclared_generations_are_never_inferred_for_relay_state_roots() {
     use std::os::unix::fs::PermissionsExt as _;
 
     let directory = tempfile::tempdir().expect("temporary directory");
@@ -517,14 +523,6 @@ fn undeclared_generations_are_never_inferred_for_state_roots_or_workload_token()
             PreflightRuntimeFileKind::RelayStateRootCertificate,
             "/relay_state/postgresql/root_certificate_path",
         ),
-        (
-            PreflightRuntimeFileKind::NotaryStateRootCertificate,
-            "/notary_state/postgresql/root_certificate_path",
-        ),
-        (
-            PreflightRuntimeFileKind::NotaryToRelayToken,
-            "/notary_relay/token_file",
-        ),
     ] {
         input
             .add_runtime_file(
@@ -545,20 +543,17 @@ fn undeclared_generations_are_never_inferred_for_state_roots_or_workload_token()
         generations[&PreflightRuntimeFileKind::SourceCa],
         PreflightGenerationState::Declared
     );
-    for kind in [
-        PreflightRuntimeFileKind::RelayStateRootCertificate,
-        PreflightRuntimeFileKind::NotaryStateRootCertificate,
-        PreflightRuntimeFileKind::NotaryToRelayToken,
-    ] {
-        assert_eq!(generations[&kind], PreflightGenerationState::NotDeclared);
-    }
+    assert_eq!(
+        generations[&PreflightRuntimeFileKind::RelayStateRootCertificate],
+        PreflightGenerationState::NotDeclared
+    );
 }
 
 #[test]
 fn offline_boundary_has_no_network_or_external_process_surface() {
     let authored_endpoints = [
         "https://source.country.invalid",
-        "https://issuer.country.invalid/jwks",
+        "https://source-identity.country.invalid/jwks",
         "https://relay.country.invalid",
     ];
     assert!(authored_endpoints
@@ -596,81 +591,6 @@ fn offline_boundary_has_no_network_or_external_process_surface() {
     );
 }
 
-#[test]
-fn command_adapter_keeps_invalid_endpoints_offline_and_has_no_build_side_effects() {
-    const SECRET_NAMES: [&str; 4] = [
-        "PREFLIGHT_COMMAND_CLIENT_ID",
-        "PREFLIGHT_COMMAND_CLIENT_SECRET",
-        "PREFLIGHT_COMMAND_ISSUER_KEY",
-        "PREFLIGHT_COMMAND_CALLER_FINGERPRINT",
-    ];
-    let directory = tempfile::tempdir().expect("temporary directory");
-    let project = directory.path().join("project");
-    copy_tree(
-        Path::new(env!("CARGO_MANIFEST_DIR"))
-            .join("tests/fixtures/project-authoring/opencrvs")
-            .as_path(),
-        &project,
-    );
-    let environment_file = project.join("environments/local.yaml");
-    let original = fs::read_to_string(&environment_file).expect("environment reads");
-    let missing_token = directory.path().join("missing-workload-token");
-    let authored = original
-        .replace("CIVIL_REGISTRY_CLIENT_ID", SECRET_NAMES[0])
-        .replace("CIVIL_REGISTRY_CLIENT_SECRET", SECRET_NAMES[1])
-        .replace("REGISTRY_NOTARY_ISSUER_JWK", SECRET_NAMES[2])
-        .replace("BIRTH_VERIFIER_TOKEN_HASH", SECRET_NAMES[3])
-        .replace(
-            "/run/secrets/relay-workload-token",
-            missing_token.to_str().expect("temporary path is UTF-8"),
-        );
-    fs::write(&environment_file, authored).expect("environment writes");
-    let fixture_path = project.join("integrations/birth-record/fixtures/match.yaml");
-    let fixture_before = fs::read(&fixture_path).expect("fixture reads");
-
-    let report = registryctl::preflight_registry_project(&registryctl::ProjectPreflightOptions {
-        project_directory: project.clone(),
-        environment: "local".to_string(),
-    })
-    .expect("offline preflight returns a closed report");
-    let serialized = serde_json::to_string(&report).expect("report serializes");
-
-    assert_eq!(report.secret_checks.len(), SECRET_NAMES.len());
-    assert_eq!(report.runtime_files.len(), 1);
-    assert_eq!(
-        report.runtime_files[0].state,
-        registryctl::PreflightCheckState::Missing
-    );
-    assert_eq!(
-        report.execution.network,
-        registryctl::PreflightAttemptState::NotAttempted
-    );
-    assert_eq!(
-        report.execution.fixture_execution,
-        registryctl::PreflightAttemptState::NotAttempted
-    );
-    assert_eq!(
-        report.execution.build_output,
-        registryctl::PreflightWriteState::NotWritten
-    );
-    assert!(!project.join(".registry-stack").exists());
-    assert_eq!(
-        fs::read(&fixture_path).expect("fixture rereads"),
-        fixture_before
-    );
-    for forbidden in SECRET_NAMES.into_iter().chain([
-        "https://civil-registry.invalid",
-        "https://identity.civil-registry.invalid",
-        "https://trust.civil-registry.invalid",
-        missing_token.to_str().expect("temporary path is UTF-8"),
-    ]) {
-        assert!(
-            !serialized.contains(forbidden),
-            "report must not expose {forbidden}"
-        );
-    }
-}
-
 #[cfg(unix)]
 #[test]
 fn command_adapter_checks_csv_xlsx_and_parquet_entity_provider_paths() {
@@ -852,7 +772,7 @@ fn preflight_reads_only_declared_runtime_files_and_has_no_fixture_or_build_side_
 }
 
 #[test]
-fn project_workbook_is_validated_read_only_and_digest_bound_when_runtime_is_not_ready() {
+fn project_workbook_is_validated_read_only_and_digest_bound_when_runtime_is_ready() {
     let directory = tempfile::tempdir().expect("temporary directory");
     let project = directory.path().join("spreadsheet-project");
     copy_tree(
@@ -876,7 +796,7 @@ fn project_workbook_is_validated_read_only_and_digest_bound_when_runtime_is_not_
             environment: "local".to_string(),
         })
         .expect("valid workbook passes preflight");
-    assert_eq!(preflight.status, registryctl::PreflightStatus::NotReady);
+    assert_eq!(preflight.status, registryctl::PreflightStatus::Ready);
     assert!(preflight.runtime_files.iter().any(|check| {
         check.kind == registryctl::PreflightRuntimeFileKind::EntityXlsx
             && check.state == registryctl::PreflightCheckState::Available
@@ -1026,13 +946,8 @@ fn all_declared_secret_consumer_classes_have_a_closed_report_identity() {
         PreflightSecretConsumer::SourceOauthMtlsPrivateKey,
         PreflightSecretConsumer::SourceJwksMtlsPrivateKey,
         PreflightSecretConsumer::EntityPostgresConnection,
-        PreflightSecretConsumer::IssuanceSigningKey,
-        PreflightSecretConsumer::CallerApiKeyFingerprint,
-        PreflightSecretConsumer::Oid4vciClientSigningKey,
-        PreflightSecretConsumer::Oid4vciAccessTokenSigningKey,
-        PreflightSecretConsumer::Oid4vciSensitiveStateKey,
     ];
-    assert_eq!(consumers.len(), 15);
+    assert_eq!(consumers.len(), 10);
     let serialized = consumers
         .iter()
         .map(|consumer| serde_json::to_string(consumer).expect("consumer serializes"))
@@ -1041,6 +956,28 @@ fn all_declared_secret_consumer_classes_have_a_closed_report_identity() {
     assert!(!serialized.iter().any(|value| value.contains("image")));
 }
 
+#[test]
+fn all_declared_runtime_file_classes_have_a_closed_report_identity() {
+    let kinds = [
+        PreflightRuntimeFileKind::SourceCa,
+        PreflightRuntimeFileKind::SourceMtlsCertificate,
+        PreflightRuntimeFileKind::SourceOauthCa,
+        PreflightRuntimeFileKind::SourceOauthMtlsCertificate,
+        PreflightRuntimeFileKind::SourceJwksCa,
+        PreflightRuntimeFileKind::SourceJwksMtlsCertificate,
+        PreflightRuntimeFileKind::EntityCsv,
+        PreflightRuntimeFileKind::EntityXlsx,
+        PreflightRuntimeFileKind::EntityParquet,
+        PreflightRuntimeFileKind::RelayStateRootCertificate,
+    ];
+    assert_eq!(kinds.len(), 10);
+    let serialized = kinds
+        .iter()
+        .map(|kind| serde_json::to_string(kind).expect("runtime file kind serializes"))
+        .collect::<BTreeSet<_>>();
+    assert_eq!(serialized.len(), kinds.len());
+}
+
 #[test]
 fn invalid_addresses_and_runtime_paths_fail_without_echoing_values() {
     for (file, pointer) in [
diff --git a/crates/registryctl/tests/project_report_contract.rs b/crates/registryctl/tests/project_report_contract.rs
index 9f1cbc096..24af1c853 100644
--- a/crates/registryctl/tests/project_report_contract.rs
+++ b/crates/registryctl/tests/project_report_contract.rs
@@ -354,6 +354,42 @@ fn semantic_precision_requires_a_field_address_only_for_field_precision() {
     );
 }
 
+#[test]
+fn semantic_impact_preserves_source_route_changes_and_both_relay_lanes() {
+    let mut impact = parse(PROJECT_SEMANTIC_IMPACT_FIXTURE);
+    impact["changes"][0]["affected_subjects"] = json!([
+        {
+            "kind": "integration",
+            "id": "person-record"
+        },
+        {
+            "kind": "consultation",
+            "id": "person-service.person-route"
+        },
+        {
+            "kind": "product_input",
+            "id": "registry-relay.consultation.config"
+        }
+    ]);
+    for requirement in ["signing", "activation", "restart"] {
+        impact["changes"][0]["requirements"][requirement] =
+            json!(["relay-public", "relay-consultation"]);
+    }
+
+    assert_valid(PROJECT_SEMANTIC_IMPACT_SCHEMA, &impact);
+    let decoded: ProjectSemanticImpactReportV1 =
+        serde_json::from_value(impact.clone()).expect("two-lane Relay impact decodes");
+    assert_eq!(
+        serde_json::to_value(decoded).expect("two-lane Relay impact re-encodes"),
+        impact
+    );
+
+    let mut duplicate_lane = impact;
+    duplicate_lane["changes"][0]["requirements"]["signing"] =
+        json!(["relay-public", "relay-public"]);
+    assert_invalid(PROJECT_SEMANTIC_IMPACT_SCHEMA, &duplicate_lane);
+}
+
 #[test]
 fn dimension_only_projection_preserves_the_legacy_byte_shape() {
     let impact: ProjectSemanticImpactReportV1 =
@@ -378,6 +414,22 @@ fn dimension_only_projection_preserves_the_legacy_byte_shape() {
     );
 }
 
+#[test]
+fn artifact_integrity_digests_are_strict_lowercase_sha256() {
+    for invalid in [
+        "sha256:abcd",
+        "sha256:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+        "sha512:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    ] {
+        assert!(Sha256Digest::new(invalid).is_err());
+
+        let mut manifest = parse(PROJECT_ARTIFACT_MANIFEST_FIXTURE);
+        manifest["artifacts"][0]["digest"] = json!(invalid);
+        assert_invalid(PROJECT_ARTIFACT_MANIFEST_SCHEMA, &manifest);
+        assert_typed_invalid::<ProjectArtifactManifestV1>(manifest);
+    }
+}
+
 #[test]
 fn artifact_paths_fail_closed_before_the_report_can_be_constructed() {
     for path in [
diff --git a/crates/registryctl/tests/project_request_binding.rs b/crates/registryctl/tests/project_request_binding.rs
deleted file mode 100644
index a0eed31c6..000000000
--- a/crates/registryctl/tests/project_request_binding.rs
+++ /dev/null
@@ -1,307 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-use std::fs;
-use std::path::{Path, PathBuf};
-
-use registryctl::{
-    test_registry_project_with_context, FixtureRequirementCoverage, GovernedRequestEvidence,
-    ProjectExecutionContext, ProjectTestOptions, RequiredFixtureCoverageRequirement,
-};
-use serde_norway::Value;
-
-fn fixture_root(name: &str) -> PathBuf {
-    Path::new(env!("CARGO_MANIFEST_DIR"))
-        .join("tests/fixtures/project-authoring")
-        .join(name)
-}
-
-fn copy_tree(source: &Path, destination: &Path) {
-    fs::create_dir_all(destination).expect("destination creates");
-    let mut entries = fs::read_dir(source)
-        .expect("source reads")
-        .collect::<std::io::Result<Vec<_>>>()
-        .expect("entries read");
-    entries.sort_by_key(|entry| entry.file_name());
-    for entry in entries {
-        let source = entry.path();
-        let destination = destination.join(entry.file_name());
-        if entry.file_type().expect("type reads").is_dir() {
-            copy_tree(&source, &destination);
-        } else {
-            fs::copy(source, destination).expect("file copies");
-        }
-    }
-}
-
-fn read_yaml(path: &Path) -> Value {
-    serde_norway::from_slice(&fs::read(path).expect("YAML reads")).expect("YAML parses")
-}
-
-fn write_yaml(path: &Path, value: &Value) {
-    fs::write(
-        path,
-        serde_norway::to_string(value).expect("YAML serializes"),
-    )
-    .expect("YAML writes");
-}
-
-fn test_project(path: &Path) -> anyhow::Result<registryctl::ProjectCommandReport> {
-    test_registry_project_with_context(
-        &ProjectTestOptions {
-            project_directory: path.to_path_buf(),
-            environment: None,
-        },
-        &ProjectExecutionContext::new(env!("CARGO_BIN_EXE_registryctl"))
-            .expect("Cargo provides registryctl"),
-    )
-}
-
-fn custom_project() -> (tempfile::TempDir, PathBuf) {
-    let temporary = tempfile::tempdir().expect("temporary directory");
-    let project = temporary.path().join("project");
-    copy_tree(&fixture_root("custom-system"), &project);
-    (temporary, project)
-}
-
-fn set_mapping_scheme(project: &Path, scheme: &str) {
-    let path = project.join("registry-stack.yaml");
-    let mut document = read_yaml(&path);
-    document["services"]["household-eligibility"]["consultations"]["household"]["input"]
-        ["household_reference"] = Value::String(format!("request.target.identifiers.{scheme}"));
-    write_yaml(&path, &document);
-}
-
-fn set_request_scheme(project: &Path, scheme: &str) {
-    let path = project.join("integrations/eligibility/fixtures/source-approved.yaml");
-    let mut fixture = read_yaml(&path);
-    fixture["request"]["target"]["identifiers"][0]["scheme"] = Value::String(scheme.to_owned());
-    write_yaml(&path, &fixture);
-}
-
-fn assert_zero_call_binding_failure(project: &Path) -> String {
-    let error = test_project(project).expect_err("binding mismatch must fail");
-    let rendered = format!("{error:#}");
-    assert!(
-        rendered.contains("request_to_consultation_binding_invalid: relay_consultations=0"),
-        "{rendered}"
-    );
-    rendered
-}
-
-#[test]
-fn governed_request_binding_fails_closed_for_either_one_sided_scheme_change() {
-    let (_temporary, project) = custom_project();
-    set_mapping_scheme(&project, "country_household_id");
-    assert_zero_call_binding_failure(&project);
-
-    let (_temporary, project) = custom_project();
-    set_request_scheme(&project, "country_household_id");
-    assert_zero_call_binding_failure(&project);
-}
-
-#[test]
-fn governed_request_binding_remains_country_configurable_when_both_sides_change() {
-    let (_temporary, project) = custom_project();
-    set_mapping_scheme(&project, "country_household_id");
-    set_request_scheme(&project, "country_household_id");
-
-    let report = test_project(&project).expect("consistent country binding passes");
-    let witness = report
-        .fixtures
-        .iter()
-        .find(|fixture| {
-            fixture
-                .fixture
-                .ends_with("::derived/request_to_consultation_binding")
-        })
-        .expect("independent request witness is reported");
-    assert!(witness.passed);
-    assert_eq!(witness.calls, ["notary-relay-consultation"]);
-    assert_eq!(
-        witness.source_access,
-        Some(true),
-        "an entered Relay consultation must not be reported as zero source access"
-    );
-    assert_eq!(witness.claims, ["household-record-exists"]);
-}
-
-#[test]
-fn governed_request_coverage_requires_every_reachable_consultation() {
-    let (_temporary, project) = custom_project();
-    let path = project.join("registry-stack.yaml");
-    let mut document = read_yaml(&path);
-    let service = &mut document["services"]["household-eligibility"];
-    service["consultations"]["alternate"] = serde_norway::from_str(
-        "{ integration: eligibility, input: { household_reference: request.target.identifiers.household_reference } }",
-    )
-    .expect("alternate consultation parses");
-    service["claims"]["alternate-record-exists"] =
-        serde_norway::from_str("{ cel: alternate.matched, disclosure: predicate }")
-            .expect("alternate claim parses");
-    service["credential_profiles"]["household-eligibility"]["claims"]
-        .as_sequence_mut()
-        .expect("credential claims are a sequence")
-        .push(Value::String("alternate-record-exists".to_owned()));
-    write_yaml(&path, &document);
-    let fixture_path = project.join("integrations/eligibility/fixtures/source-approved.yaml");
-    let mut fixture = read_yaml(&fixture_path);
-    fixture["expect"]["claims"]["alternate-record-exists"] = Value::Bool(true);
-    write_yaml(&fixture_path, &fixture);
-    let no_match_path = project.join("integrations/eligibility/fixtures/no-match.yaml");
-    let mut no_match = read_yaml(&no_match_path);
-    no_match["expect"]["claims"]["alternate-record-exists"] = Value::Bool(false);
-    write_yaml(&no_match_path, &no_match);
-
-    let report = test_project(&project).expect("project test remains executable");
-    let coverage = report
-        .fixture_coverage
-        .expect("fixture coverage is reported");
-    assert_eq!(
-        coverage.governed_request_evidence,
-        GovernedRequestEvidence::PerConsultationAuthoredRequestWitnessEvaluation,
-        "the root marker describes the proof method, not a false global pass state"
-    );
-    let target = coverage.targets.first().expect("target is reported");
-    assert_eq!(target.contract.registry_backed_consultations.len(), 2);
-    assert_eq!(
-        target
-            .fixture_inventory
-            .iter()
-            .flat_map(|fixture| { fixture.request_to_consultation_binding.consultations.iter() })
-            .count(),
-        1,
-        "one request witness must not claim both reachable consultations"
-    );
-    assert!(matches!(
-        target.requirements.iter().find(|coverage| {
-            coverage.requirement()
-                == RequiredFixtureCoverageRequirement::RequestToConsultationBinding
-        }),
-        Some(FixtureRequirementCoverage::Missing { .. })
-    ));
-}
-
-#[test]
-fn governed_request_boundary_rejects_closed_contract_mismatches_before_relay() {
-    type Mutation = (&'static str, Box<dyn Fn(&mut Value)>);
-    let mutations: Vec<Mutation> = vec![
-        (
-            "target type",
-            Box::new(|fixture| {
-                fixture["request"]["target"]["type"] = Value::String("Household".to_owned());
-            }),
-        ),
-        (
-            "purpose",
-            Box::new(|fixture| {
-                fixture["request"]["purpose"] = Value::String("unknown-purpose".to_owned());
-            }),
-        ),
-        (
-            "claim",
-            Box::new(|fixture| {
-                fixture["request"]["claims"][0] = Value::String("unknown-claim".to_owned());
-            }),
-        ),
-        (
-            "disclosure",
-            Box::new(|fixture| {
-                fixture["request"]["disclosure"] = Value::String("value".to_owned());
-            }),
-        ),
-        (
-            "format",
-            Box::new(|fixture| {
-                fixture["request"]["format"] = Value::String("application/json".to_owned());
-            }),
-        ),
-        (
-            "missing identifier",
-            Box::new(|fixture| {
-                fixture["request"]["target"]["identifiers"] = Value::Sequence(Vec::new());
-            }),
-        ),
-        (
-            "extra identifier",
-            Box::new(|fixture| {
-                fixture["request"]["target"]["identifiers"]
-                    .as_sequence_mut()
-                    .expect("identifiers are a sequence")
-                    .push(
-                        serde_norway::from_str("{ scheme: extra, value: synthetic }")
-                            .expect("identifier parses"),
-                    );
-            }),
-        ),
-    ];
-
-    for (name, mutate) in mutations {
-        let (_temporary, project) = custom_project();
-        let path = project.join("integrations/eligibility/fixtures/source-approved.yaml");
-        let mut fixture = read_yaml(&path);
-        mutate(&mut fixture);
-        write_yaml(&path, &fixture);
-        let failure = assert_zero_call_binding_failure(&project);
-        assert!(
-            !failure.contains("HH-AB12CD34"),
-            "{name} leaked fixture data"
-        );
-    }
-}
-
-#[test]
-fn governed_request_requires_synthetic_classification_and_rejects_secret_references() {
-    for replacement in ["classification: reviewed", "classification: production"] {
-        let (_temporary, project) = custom_project();
-        let path = project.join("integrations/eligibility/fixtures/source-approved.yaml");
-        let fixture = fs::read_to_string(&path).expect("fixture reads");
-        fs::write(
-            &path,
-            fixture.replace("classification: synthetic", replacement),
-        )
-        .expect("fixture writes");
-        assert!(test_project(&project).is_err());
-    }
-
-    let (_temporary, project) = custom_project();
-    let integration_path = project.join("integrations/eligibility/integration.yaml");
-    let mut integration = read_yaml(&integration_path);
-    let household_reference = integration["input"]["household_reference"]
-        .as_mapping_mut()
-        .expect("household reference contract is an object");
-    household_reference.remove("pattern");
-    household_reference.insert("maxLength".into(), Value::Number(128.into()));
-    write_yaml(&integration_path, &integration);
-
-    let path = project.join("integrations/eligibility/fixtures/source-approved.yaml");
-    let mut fixture = read_yaml(&path);
-    fixture["request"]["target"]["identifiers"][0]["value"] =
-        Value::String("${COUNTRY_IDENTIFIER}".to_owned());
-    write_yaml(&path, &fixture);
-    let rendered = format!(
-        "{:#}",
-        test_project(&project).expect_err("secret ref must fail")
-    );
-    assert!(
-        rendered.contains("fixture governed request contains a forbidden credential-like field"),
-        "{rendered}"
-    );
-    assert!(!rendered.contains("COUNTRY_IDENTIFIER"));
-}
-
-#[test]
-fn governed_request_witness_executes_for_http_script_and_snapshot() {
-    for project in ["custom-system", "dhis2-script", "snapshot-exact"] {
-        let report = test_project(&fixture_root(project))
-            .unwrap_or_else(|error| panic!("{project} request witness failed: {error:#}"));
-        assert!(
-            report.fixtures.iter().any(|fixture| {
-                fixture
-                    .fixture
-                    .ends_with("::derived/request_to_consultation_binding")
-                    && fixture.passed
-            }),
-            "{project} lacks a passing request witness"
-        );
-    }
-}
diff --git a/crates/registryctl/tests/release_lock.rs b/crates/registryctl/tests/release_lock.rs
index 2ee029bcb..b2150cc28 100644
--- a/crates/registryctl/tests/release_lock.rs
+++ b/crates/registryctl/tests/release_lock.rs
@@ -6,7 +6,9 @@
 #[path = "../src/release_lock.rs"]
 mod release_lock;
 
-use release_lock::{verify_release_lock_for_package, RELEASE_LOCK_SCHEMA_ID};
+use release_lock::{
+    verify_release_lock_for_package, RELEASE_LOCK_SCHEMA_ID, RELEASE_LOCK_SCHEMA_VERSION,
+};
 
 #[test]
 fn public_boundary_rejects_duplicate_envelope_members() {
@@ -14,7 +16,7 @@ fn public_boundary_rejects_duplicate_envelope_members() {
         r#"{{
           "schema_id":"{RELEASE_LOCK_SCHEMA_ID}",
           "schema_id":"{RELEASE_LOCK_SCHEMA_ID}",
-          "schema_version":"1.0",
+          "schema_version":"{RELEASE_LOCK_SCHEMA_VERSION}",
           "signed_payload":"e30=",
           "sigstore_bundle":{{}}
         }}"#
@@ -33,7 +35,7 @@ fn public_boundary_rejects_unknown_envelope_fields() {
     let document = format!(
         r#"{{
           "schema_id":"{RELEASE_LOCK_SCHEMA_ID}",
-          "schema_version":"1.0",
+          "schema_version":"{RELEASE_LOCK_SCHEMA_VERSION}",
           "signed_payload":"e30=",
           "sigstore_bundle":{{}},
           "extension":true
@@ -54,7 +56,7 @@ fn public_boundary_rejects_noncanonical_signed_payload() {
     let document = format!(
         r#"{{
           "schema_id":"{RELEASE_LOCK_SCHEMA_ID}",
-          "schema_version":"1.0",
+          "schema_version":"{RELEASE_LOCK_SCHEMA_VERSION}",
           "signed_payload":"{noncanonical}",
           "sigstore_bundle":{{}}
         }}"#
@@ -67,3 +69,27 @@ fn public_boundary_rejects_noncanonical_signed_payload() {
         "{error:#}"
     );
 }
+
+// A release lock produced before the Registry Notary retirement declares
+// schema version 1.0 over a payload shape that no longer exists: the Notary
+// image, runtime recipe, and config schema were removed. It has to be refused
+// at the envelope, before any signature work, rather than reaching the payload
+// parser and failing on a member name.
+#[test]
+fn public_boundary_rejects_the_pre_retirement_schema_version() {
+    let document = format!(
+        r#"{{
+          "schema_id":"{RELEASE_LOCK_SCHEMA_ID}",
+          "schema_version":"1.0",
+          "signed_payload":"e30=",
+          "sigstore_bundle":{{}}
+        }}"#
+    );
+    let error = verify_release_lock_for_package(document.as_bytes())
+        .err()
+        .expect("a pre-retirement lock fails closed");
+    assert!(
+        error.to_string().contains("envelope schema is unsupported"),
+        "{error:#}"
+    );
+}
diff --git a/docker/Dockerfile b/docker/Dockerfile
new file mode 100644
index 000000000..d731305cc
--- /dev/null
+++ b/docker/Dockerfile
@@ -0,0 +1,99 @@
+# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
+
+# SPDX-License-Identifier: Apache-2.0
+
+# Adopter and development images for the `mint` and `evidence` services.
+#
+# These are not release evidence. Release images are assembled from
+# release/docker with binaries produced outside Docker by
+# release/scripts/build-release-binaries.sh under the pinned builder image.
+#
+# Build from the repository root:
+#
+#   docker build -f docker/Dockerfile --target mint -t registry-mint .
+#   docker build -f docker/Dockerfile --target evidence -t registry-evidence .
+#
+# cargo-chef turns dependency compilation into an ordinary image layer keyed
+# on the manifests and lockfile alone, so registry and CI layer caches
+# survive source-only changes. Each binary gets its own recipe, filtered to
+# its transitive dependency closure, so a manifest change in an unrelated
+# workspace member invalidates neither image.
+
+# Keep the tag for humans and the digest for reproducible pulls.
+FROM rust:1.95-trixie@sha256:f49565f188ee00bc2a18dd418183f2c5f23ef7d6e691890517ed341a598f67c3 AS chef
+RUN cargo install cargo-chef --locked --version 0.1.77
+WORKDIR /workspace
+
+# The planner reruns on any source change, but that is cheap: the recipes it
+# emits depend only on the manifests and lockfile, so unchanged recipes keep
+# the cook layers below cached.
+FROM chef AS planner
+COPY Cargo.toml Cargo.lock ./
+COPY crates ./crates
+COPY products ./products
+RUN cargo chef prepare --recipe-path recipe-mint.json --bin mint \
+    && cargo chef prepare --recipe-path recipe-evidence.json --bin evidence
+
+FROM chef AS mint-builder
+COPY --from=planner /workspace/recipe-mint.json recipe.json
+# No --locked here: the bin-filtered recipe carries a lockfile trimmed to the
+# closure, which cargo would refuse to reconcile. The final build is --locked.
+RUN cargo chef cook --release --recipe-path recipe.json --bin mint
+COPY Cargo.toml Cargo.lock ./
+COPY crates ./crates
+COPY products ./products
+RUN cargo build --release --locked -p registry-mint --bin mint \
+    && mkdir -p /workspace/runtime-root/etc/registry-mint \
+    && chown -R 65532:65532 /workspace/runtime-root
+
+# Distroless cc keeps glibc and CA certificates while dropping shell/package tools.
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:d97bc0a941b8d4be647dc0ee75b264ddbb772f1ac5ba690a4309c00723b23775 AS mint
+
+COPY --from=mint-builder /workspace/runtime-root/ /
+COPY --from=mint-builder /workspace/target/release/mint /usr/local/bin/mint
+COPY LICENSE /licenses/registry-mint/LICENSE
+
+# The configuration is a startup-only deployment artifact; mount it read-only
+# at /etc/registry-mint. Key material and the client registry live beside it
+# at whatever paths the configuration names.
+ENV MINT_CONFIG=/etc/registry-mint/config.yaml
+EXPOSE 8081
+
+# No HEALTHCHECK: distroless has no shell or curl and the binary has no
+# healthcheck subcommand. The service serves GET /health for HTTP probes.
+ENTRYPOINT ["/usr/local/bin/mint"]
+CMD ["serve"]
+
+FROM chef AS evidence-builder
+COPY --from=planner /workspace/recipe-evidence.json recipe.json
+# No --locked here: the bin-filtered recipe carries a lockfile trimmed to the
+# closure, which cargo would refuse to reconcile. The final build is --locked.
+RUN cargo chef cook --release --recipe-path recipe.json --bin evidence
+COPY Cargo.toml Cargo.lock ./
+COPY crates ./crates
+COPY products ./products
+RUN cargo build --release --locked -p registry-evidence --bin evidence \
+    && mkdir -p \
+        /workspace/runtime-root/etc/registry-evidence \
+        /workspace/runtime-root/var/lib/registry-evidence/audit \
+    && chown -R 65532:65532 /workspace/runtime-root
+
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:d97bc0a941b8d4be647dc0ee75b264ddbb772f1ac5ba690a4309c00723b23775 AS evidence
+
+COPY --from=evidence-builder /workspace/runtime-root/ /
+COPY --from=evidence-builder /workspace/target/release/evidence /usr/local/bin/evidence
+COPY LICENSE /licenses/registry-evidence/LICENSE
+
+WORKDIR /var/lib/registry-evidence
+
+# The runtime file, governed bundle, and secret root are startup-only
+# deployment artifacts; mount them read-only under /etc/registry-evidence.
+# Point the runtime's audit destination under /var/lib/registry-evidence,
+# which is writable by the nonroot user.
+ENV REGISTRY_EVIDENCE_RUNTIME=/etc/registry-evidence/runtime.yaml
+EXPOSE 8080
+
+# No HEALTHCHECK: distroless has no shell or curl and the binary has no
+# healthcheck subcommand. The service serves GET /health for HTTP probes.
+ENTRYPOINT ["/usr/local/bin/evidence"]
+CMD ["serve"]
diff --git a/docker/README.md b/docker/README.md
new file mode 100644
index 000000000..720415783
--- /dev/null
+++ b/docker/README.md
@@ -0,0 +1,100 @@
+# Development images
+
+Distroless container images for the `mint` and `evidence` services, built
+entirely inside Docker from the repository root:
+
+```sh
+docker build -f docker/Dockerfile --target mint -t registry-mint .
+docker build -f docker/Dockerfile --target evidence -t registry-evidence .
+```
+
+These images are **not release evidence**. The released Notary and Relay
+images are assembled from `release/docker/` with byte-reproducible binaries
+built outside Docker by `release/scripts/build-release-binaries.sh`; if Mint
+or Evidence images ever become release artifacts, they follow that path, not
+this one.
+
+## Build architecture
+
+Both targets share one multi-stage file using
+[cargo-chef](https://github.com/LukeMathWalker/cargo-chef) so dependency
+compilation is an ordinary image layer, cacheable by registry-backed or CI
+layer caches across ephemeral runners (which BuildKit `--mount=type=cache`
+mounts are not). Each binary has its own recipe filtered to its transitive
+dependency closure (`cargo chef prepare --bin`), so a manifest change in an
+unrelated workspace member (for example Relay) invalidates neither image, and
+neither image compiles heavyweight dependencies it does not use.
+
+The builder and runtime base images are pinned to the same digests the rest
+of the repository uses: `rust:1.95-trixie` and
+`gcr.io/distroless/cc-debian13:nonroot`. Both final images run as the
+distroless `nonroot` user (65532) with no shell or package tools.
+
+## Running Mint locally
+
+The configuration is a startup-only artifact. Mount it read-only at
+`/etc/registry-mint` with the signing key and client registry beside it, at
+the paths the configuration names (relative paths resolve against the
+configuration file's directory). The listener address in the configuration
+must be an IP the container can bind. Use a private network address for a
+Compose deployment:
+
+```sh
+docker run --rm \
+  -v "$PWD/deploy/mint:/etc/registry-mint:ro" \
+  registry-mint
+```
+
+`mint check` validates a deployment without opening a socket:
+
+```sh
+docker run --rm -v "$PWD/deploy/mint:/etc/registry-mint:ro" registry-mint check
+```
+
+## Running Evidence locally
+
+The runtime file, governed bundle, and secret root are startup-only
+artifacts; mount them read-only under `/etc/registry-evidence`. The image
+expects the operator runtime at `/etc/registry-evidence/runtime.yaml`
+(`REGISTRY_EVIDENCE_RUNTIME`). The runtime's `bundleDirectory`, secret
+provider `root`, audit `path`, and any `trustProfiles.*.caBundleFile` are
+validated absolute paths, interpreted inside the container: every one of
+them must resolve to a mount. Point the audit destination under
+`/var/lib/registry-evidence`, which is writable by the nonroot user, and
+give it a named volume; the audit chain is append-only state that must
+outlive the container.
+
+The evidence and metrics listeners deliberately refuse wildcard and public
+bind addresses: `bindHost` must be loopback, RFC 1918 private IPv4, or IPv6
+unique-local. `0.0.0.0` will not start, and `127.0.0.1` is unreachable
+through Docker port publishing. Give the container a static private address
+on a user-defined network and bind that:
+
+```sh
+docker network create --subnet 172.28.0.0/24 registry-evidence-net
+docker run --rm \
+  --network registry-evidence-net --ip 172.28.0.10 \
+  -v "$PWD/deploy/evidence:/etc/registry-evidence:ro" \
+  -v evidence-audit:/var/lib/registry-evidence \
+  registry-evidence
+```
+
+with `listener.bindHost: 172.28.0.10` in `runtime.yaml`. TLS and public
+exposure are upstream concerns by design; front this listener with your
+operator-network proxy. `evidence check` validates the bundle without
+serving:
+
+```sh
+docker run --rm -v "$PWD/deploy/evidence:/etc/registry-evidence:ro" registry-evidence check
+```
+
+## Health probes
+
+Neither image declares a Docker `HEALTHCHECK`: distroless has no shell or
+curl, and neither binary has a healthcheck subcommand (the released Notary
+and Relay binaries do). Both services serve `GET /health` on their listener;
+use HTTP probes from your orchestrator.
+
+For an approved Evidence candidate, use the operator-owned
+[Compose adapter](compose/README.md), select reviewed image provenance separately, and run
+`evidence check` inside the target container context.
diff --git a/docker/compose/README.md b/docker/compose/README.md
new file mode 100644
index 000000000..74d30aef2
--- /dev/null
+++ b/docker/compose/README.md
@@ -0,0 +1,57 @@
+# Evidence candidate Compose adapter
+
+This directory is an operator-owned Docker Compose adapter for a reviewed Evidence candidate.
+It is not generated by `evidencectl build`, and it does not turn a local authoring project into a
+deployment.
+
+## Inputs
+
+Set the following absolute paths before starting Compose:
+
+- `EVIDENCE_CANDIDATE_DIR`, an approved candidate containing `bundle/`.
+- `EVIDENCE_RUNTIME_FILE`, a container-specific runtime document.
+- `EVIDENCE_SECRET_ROOT`, owner-only Evidence secret files.
+- `EVIDENCE_IMAGE`, a reviewed, digest-pinned Evidence image.
+
+The maintained Evidence image runs as UID and GID `65532`; the Compose service pins
+`user: "65532:65532"`. Secret directories and files must be owned for that identity and retain the
+owner-only modes Evidence requires. If you select another reviewed image, record its service UID
+and update the ownership and `user` setting together.
+
+The service mounts the approved bundle, runtime, and secrets read-only. Its named audit volume is
+the only writable Evidence storage. The runtime uses container paths and binds Evidence to the
+static private address assigned in `docker-compose.yaml`.
+Provision the named volume so UID and GID `65532` can create and append the configured audit file
+before the first start. Do not widen the Evidence process to root to compensate for a root-owned
+volume.
+
+```sh
+export EVIDENCE_CANDIDATE_DIR='<candidate>'
+export EVIDENCE_RUNTIME_FILE='<runtime.docker.yaml>'
+export EVIDENCE_SECRET_ROOT='<secret-root>'
+export EVIDENCE_IMAGE='<reviewed-evidence-image-by-digest>'
+docker compose -f docker-compose.yaml config
+```
+
+Run the target-context check before starting the service:
+
+```sh
+docker compose -f docker-compose.yaml run --rm evidence \
+  --runtime /etc/registry-evidence/runtime.yaml check
+```
+
+The bundle revision remains unchanged when only the container runtime changes. Run fixtures again
+only when the governed bundle changes. The runtime and bundle being read-only does not waive secret
+owner or mode checks for the container service identity.
+
+## Optional Mint
+
+Mint is a separate service and is intentionally absent from the base adapter, so an Evidence-only
+deployment has no Mint configuration dependency. When the deployment has no suitable OIDC issuer,
+add an operator-owned Mint service with its configuration, signing key, client registry, reviewed
+image, and private listener mounted independently. Mint's configured issuer and JWKS URI remain
+public HTTPS identities. Operator routing or split DNS resolves that public identity within the
+Compose network.
+
+This adapter does not establish image provenance, TLS, routing, client registration, or secret
+ownership. Those remain operator responsibilities.
diff --git a/docker/compose/docker-compose.yaml b/docker/compose/docker-compose.yaml
new file mode 100644
index 000000000..a850785e2
--- /dev/null
+++ b/docker/compose/docker-compose.yaml
@@ -0,0 +1,42 @@
+# Operator-owned Compose adapter for an approved Evidence candidate. It is not
+# generated by evidencectl build. Operators select reviewed image digests and
+# supply the candidate, runtime, and secrets separately.
+#
+# Required environment:
+#   EVIDENCE_CANDIDATE_DIR  absolute path to the approved candidate
+#   EVIDENCE_RUNTIME_FILE   container-specific runtime.yaml path
+#   EVIDENCE_SECRET_ROOT    owner-only Evidence secret directory
+#   EVIDENCE_IMAGE          reviewed Evidence image by digest
+name: registry-evidence
+
+services:
+  evidence:
+    image: ${EVIDENCE_IMAGE:?set EVIDENCE_IMAGE to a reviewed image digest}
+    user: "65532:65532"
+    read_only: true
+    restart: unless-stopped
+    volumes:
+      - ${EVIDENCE_CANDIDATE_DIR:?set EVIDENCE_CANDIDATE_DIR to the approved candidate}/bundle:/etc/registry-evidence/bundle:ro
+      - ${EVIDENCE_RUNTIME_FILE:?set EVIDENCE_RUNTIME_FILE to a container runtime}:/etc/registry-evidence/runtime.yaml:ro
+      - ${EVIDENCE_SECRET_ROOT:?set EVIDENCE_SECRET_ROOT to the Evidence secret root}:/run/secrets/registry-evidence:ro
+      # The append-only audit chain must outlive the container.
+      - evidence-audit:/var/lib/registry-evidence
+    networks:
+      evidence-net:
+        # The listener refuses wildcard and public bind addresses, so the
+        # service binds this static private address; the operator runtime's
+        # listener.bindHost must stay equal to it.
+        ipv4_address: 172.28.0.10
+    # To reach the listener from the host, publish it explicitly; TLS and
+    # public exposure stay upstream concerns for the operator's proxy:
+    # ports:
+    #   - "127.0.0.1:8080:8080"
+
+networks:
+  evidence-net:
+    ipam:
+      config:
+        - subnet: 172.28.0.0/24
+
+volumes:
+  evidence-audit:
diff --git a/docker/compose/runtime.docker.yaml b/docker/compose/runtime.docker.yaml
new file mode 100644
index 000000000..f42846e57
--- /dev/null
+++ b/docker/compose/runtime.docker.yaml
@@ -0,0 +1,38 @@
+# Example container-shaped runtime configuration for the operator-owned Compose
+# adapter. It is not governed content and is never generated by evidencectl
+# build. Copy it into an operator runtime file and bind it to the approved
+# candidate bundle mounted by docker-compose.yaml.
+#
+# Every path below is a container path: the approved bundle lives under
+# /etc/registry-evidence, secrets under /run/secrets/registry-evidence, and
+# writable audit state under /var/lib/registry-evidence. The bindHost must stay
+# equal to the static address docker-compose.yaml assigns the service.
+version: 1
+
+bundleDirectory: /etc/registry-evidence/bundle
+
+listener:
+  bindHost: 172.28.0.10
+  port: 8080
+  tlsTermination: operator-controlled-upstream
+  trustProxyIdentityHeaders: false
+  maximumRequestBytes: 65536
+  maximumConcurrentRequests: 64
+  requestTimeoutMilliseconds: 10000
+  shutdownGraceMilliseconds: 30000
+
+# Secret files arrive through a separate read-only mount. Their ownership and
+# modes must be accepted by the configured container service identity.
+secretProviders:
+  file:
+    root: /run/secrets/registry-evidence
+
+auditStorage:
+  path: /var/lib/registry-evidence/audit/evidence.jsonl
+  maximumFileBytes: 1073741824
+
+# Add a trust profile here only when a bundle source declares one; the two
+# sets must match exactly.
+outboundTls:
+  systemRoots: true
+  trustProfiles: {}
diff --git a/docs/site/astro.config.mjs b/docs/site/astro.config.mjs
index 33397bf44..96fa465d0 100644
--- a/docs/site/astro.config.mjs
+++ b/docs/site/astro.config.mjs
@@ -11,6 +11,7 @@ import remarkGfm from 'remark-gfm';
 // llms.txt `details` block so it can never drift from the header the per-page
 // .md endpoint prepends (src/pages/[...slug].md.ts).
 import { DISCOVERY_HEADER } from './src/lib/page-markdown.ts';
+import { buildNotaryRetirementRedirects } from './src/lib/notary-retirement-redirects.mjs';
 
 // Marketing site that now owns the persuasion layer (the pitch). Old docs
 // routes that migrated there redirect to these pages.
@@ -101,6 +102,13 @@ function generatedProduct(label) {
   if (!group) throw new Error(`generated sidebar group "${label}" not found`);
   return group;
 }
+
+// A product absent from this docset's generated sidebar (a product newer than
+// an archived docset) yields no group instead of failing the build.
+/** @param {string} label */
+function optionalGeneratedProduct(label) {
+  return productSidebar.find((/** @type {{ label: string }} */ entry) => entry.label === label) ?? null;
+}
 const disabledSitemap = {
   name: '@astrojs/sitemap',
   hooks: {},
@@ -118,6 +126,7 @@ export default defineConfig({
   // internal redirects map the retired /projects/* and /capabilities/* routes
   // to their new homes so old links and search results keep resolving.
   redirects: {
+    ...buildNotaryRetirementRedirects(currentDocsetRedirect),
     '/start/': internalRedirect('/'),
     '/start/see-it-live/': internalRedirect('/start/quickstart/'),
     '/explanation/trust-posture-and-security-guarantees/': internalRedirect('/security/'),
@@ -131,32 +140,22 @@ export default defineConfig({
     '/journeys/bounded-http/': internalRedirect('/tutorials/author-registry-project/'),
     '/journeys/bounded-multi-call-script/': internalRedirect('/tutorials/configure-project-script-adapter/'),
     '/journeys/exact-snapshot/': internalRedirect('/configure/'),
-    '/journeys/registry-backed-notary-claim/': internalRedirect('/tutorials/verify-claim-registry-api/'),
     '/journeys/product-input-lifecycle/': internalRedirect('/generated-artifacts/'),
     // Retired first-call and source-review routes enter the supported local path.
     '/start/your-first-call/': internalRedirect('/tutorials/publish-spreadsheet-secured-registry-api/'),
     '/start/test-current-source-revision/': internalRedirect('/start/quickstart/'),
-    // Retired hosted and Solmara Lab tutorials now land on a chooser that
-    // distinguishes those flows from the supported local beginner path.
+    // The retired hosted lab tutorial lands on a chooser that distinguishes
+    // that flow from the supported local beginner path. Solmara Lab keeps its
+    // own route: it is where the two doors are shown working together.
     '/tutorials/first-run-with-registry-lab/': internalRedirect('/start/quickstart/'),
-    '/tutorials/first-run-with-solmara-lab/': internalRedirect('/start/quickstart/'),
+    '/tutorials/review-a-dhis2-evidence-source/': internalRedirect('/tutorials/issue-immunization-evidence-from-dhis2/'),
     // Retired monorepo lab tutorials redirect to the current integration guidance.
-    '/tutorials/configure-dhis2-claim-checks/': internalRedirect('/explanation/integration-patterns/'),
-    '/tutorials/getting-started-fhir-evidence/': internalRedirect('/explanation/integration-patterns/'),
     // Retired advanced tutorials land on current task, explanation, or
     // reference entry points.
-    '/tutorials/run-notary-standalone-for-api/': internalRedirect('/tutorials/author-registry-project/'),
-    '/tutorials/verify-claim-own-api/': internalRedirect('/tutorials/author-registry-project/'),
-    '/tutorials/verify-opencrvs-dci-claims/': internalRedirect('/tutorials/verify-opencrvs-claims/'),
     '/tutorials/configure-project-api-key-authentication/': internalRedirect('/configure/'),
     '/tutorials/configure-project-fhir-r4/': internalRedirect('/explanation/integration-patterns/'),
     '/tutorials/configure-project-snapshot-materialization/': internalRedirect('/configure/'),
     '/tutorials/deploy-standalone-with-own-data/': internalRedirect('/operate/'),
-    '/tutorials/move-notary-to-production-signing/': internalRedirect('/operate/'),
-    '/products/registry-notary/fhir-source-adapter-guide/': internalRedirect('/explanation/integration-patterns/'),
-    '/products/registry-notary/opencrvs-onboarding/': internalRedirect('/tutorials/verify-opencrvs-claims/'),
-    '/products/registry-notary/opencrvs-dci-standalone-tutorial/': internalRedirect('/tutorials/verify-opencrvs-claims/'),
-    '/products/registry-notary/sidecar-trust-and-secrets/': internalRedirect('/explanation/threat-model/'),
     // Problems -> marketing /why
     '/problems/': `${marketing}/why/`,
     '/problems/existing-data-not-service-ready/': `${marketing}/why/`,
@@ -189,19 +188,12 @@ export default defineConfig({
     '/projects/registry-relay/run-locally/': internalRedirect('/products/registry-relay/'),
     '/projects/registry-relay/authorize-callers/': internalRedirect('/products/registry-relay/client-integration/'),
     '/projects/registry-relay/reference/': internalRedirect('/products/registry-relay/configuration/'),
-    '/projects/registry-notary/': internalRedirect('/products/registry-notary/'),
-    '/projects/registry-notary/run-locally/': internalRedirect('/products/registry-notary/'),
-    '/projects/registry-notary/configure-a-claim/': internalRedirect('/products/registry-notary/source-claim-modeling-guide/'),
-    '/projects/registry-notary/reference/': internalRedirect('/products/registry-notary/operator-config-reference/'),
-    // The target exists only in the current docset; archives redirect to the latest page.
-    '/products/registry-notary/opencrvs-dci-onboarding/': currentDocsetRedirect('/explanation/integration-patterns/'),
     // Retired project routes redirect only when a current replacement exists.
     // Solmara Lab is an external adopter, not a Registry Stack product.
     '/projects/registry-lab/demo-flow/': internalRedirect('/start/quickstart/'),
     // The API reference moved from static Redoc HTML to native, theme-aware,
     // searchable pages. Keep the old shareable links working.
     '/api/registry-relay.html': internalRedirect('/reference/apis/relay/'),
-    '/api/registry-notary.html': internalRedirect('/reference/apis/notary/'),
   },
   integrations: [
     // Mermaid must come BEFORE starlight: its rehype plugin rewrites
@@ -216,7 +208,7 @@ export default defineConfig({
     }),
     starlight({
       title: 'Registry stack docs',
-      description: 'Documentation for Registry Stack: Registry Relay and Registry Notary, the runtime services that publish registry metadata, serve protected registry data, and issue evidence credentials.',
+      description: 'Documentation for Registry Stack: Registry Relay and Evidence, the runtime services that publish protected registry data and answer bounded questions with signed, minimum-disclosure assertions.',
       // Historical archives keep their sealed search posture. A new released
       // archive is built once on the release runner and carries its exact
       // Pagefind output into production.
@@ -231,7 +223,7 @@ export default defineConfig({
         // Released archives carry their machine-readable corpus into the
         // canonical root. Historical archives retain their sealed output.
         ...(isHistoricalArchiveBuild ? [] : [starlightLlmsTxt({
-          description: 'Documentation for Registry Stack: tutorials, product docs, explanation, and API reference for Registry Relay and Registry Notary.',
+          description: 'Documentation for Registry Stack: tutorials, product docs, explanation, and API reference for Registry Relay and Evidence.',
           details: DISCOVERY_HEADER,
           exclude: ['reference/apis/**'],
           promote: ['index*', 'explanation/**'],
@@ -251,9 +243,9 @@ export default defineConfig({
             sidebar: { label: 'Relay API operations', collapsed: true },
           },
           {
-            base: 'reference/apis/notary',
-            schema: './openapi/registry-notary.openapi.json',
-            sidebar: { label: 'Notary API operations', collapsed: true },
+            base: 'reference/apis/evidence',
+            schema: './openapi/registry-evidence.openapi.json',
+            sidebar: { label: 'Evidence API operations', collapsed: true },
           },
         ]),
       ],
@@ -292,21 +284,47 @@ export default defineConfig({
           label: 'Start',
           items: [
             { label: 'Overview', link: '/' },
-            { label: 'Start a spreadsheet registry', slug: 'tutorials/publish-spreadsheet-secured-registry-api' },
-            { label: 'Use your own spreadsheet', slug: 'tutorials/use-your-spreadsheet' },
-            { label: 'Expose spreadsheet evidence', slug: 'tutorials/verify-claim-registry-api' },
             { label: 'When Registry Stack fits', slug: 'start/when-to-use' },
-            { label: 'Pre-1.0 cutover', slug: 'start/pre-1.0-cutover' },
+            { label: 'Evaluate Evidence', slug: 'start/evaluate-evidence' },
+          ],
+        },
+        {
+          label: 'Answer with Evidence',
+          items: [
+            { label: 'Overview', slug: 'start/evidence-quickstart' },
+            { label: 'Get your first assertion', slug: 'tutorials/first-evidence-assertion' },
+            { label: 'Return a governed value', slug: 'tutorials/return-a-governed-value' },
+            { label: 'Control caller access', slug: 'tutorials/control-who-can-request-evidence' },
+            { label: 'Bind a relationship', slug: 'tutorials/assert-a-role-bound-relationship' },
+            { label: 'Issue parent evidence from OpenCRVS', slug: 'tutorials/verify-a-registered-parent-with-opencrvs' },
+            { label: 'Request a birth certificate SD-JWT VC', slug: 'tutorials/issue-a-birth-certificate-vc-from-opencrvs' },
+            { label: 'Issue DHIS2 immunization evidence', slug: 'tutorials/issue-immunization-evidence-from-dhis2' },
+            { label: 'See safe refusals', slug: 'tutorials/refuse-unsafe-evidence-requests' },
+            { label: 'Draft an institution source', slug: 'tutorials/connect-an-institution-source' },
+            { label: 'Prove a project', slug: 'tutorials/prove-an-evidence-project' },
+            { label: 'Build and deploy a project', slug: 'tutorials/build-and-deploy-evidence-project' },
+            { label: 'Issue access tokens with Mint', slug: 'tutorials/issue-evidence-access-tokens-with-registry-mint' },
+            { label: 'Integrate a candidate with Compose', slug: 'tutorials/integrate-evidence-candidate-with-docker-compose' },
+            { label: 'Verify as a consumer', slug: 'tutorials/verify-an-assertion-as-a-consumer' },
+            { label: 'Manage verifier trust', slug: 'tutorials/manage-evidence-verifier-trust' },
+            { label: 'Request SD-JWT VC', slug: 'tutorials/request-evidence-as-sd-jwt-vc' },
+            { label: 'Configure Evidence', slug: 'configure/evidence' },
+            { label: 'Configure Registry Mint', slug: 'configure/mint' },
+            { label: 'Request a token from your own code', slug: 'configure/request-an-access-token' },
+            { label: 'Rotate signing keys', slug: 'tutorials/move-evidence-to-production-signing' },
+            { label: 'Verify the audit chain', slug: 'operate/evidence-audit' },
+            { label: 'See it over a Relay API', slug: 'tutorials/first-run-with-solmara-lab' },
           ],
         },
         {
           label: 'Connect an existing registry',
           items: [
             { label: 'Overview', slug: 'configure' },
+            { label: 'Start a spreadsheet registry', slug: 'tutorials/publish-spreadsheet-secured-registry-api' },
+            { label: 'Use your own spreadsheet', slug: 'tutorials/use-your-spreadsheet' },
             { label: 'Connect an HTTP registry', slug: 'tutorials/author-registry-project' },
             { label: 'Configure OAuth client credentials', slug: 'configure/oauth-client-credentials' },
             { label: 'Add OAuth-backed Rhai', slug: 'tutorials/configure-project-script-adapter' },
-            { label: 'OpenCRVS Events API case study', slug: 'tutorials/verify-opencrvs-claims' },
             { label: 'Advanced source patterns', slug: 'explanation/integration-patterns' },
             { label: 'Configuration fields', slug: 'reference/project-configuration' },
           ],
@@ -322,7 +340,7 @@ export default defineConfig({
               label: 'Advanced',
               collapsed: true,
               items: [
-                { label: 'Approve an evidence change', slug: 'operate/advanced/compare-and-reapprove-source-change' },
+                { label: 'Approve a source change', slug: 'operate/advanced/compare-and-reapprove-source-change' },
               ],
             },
           ],
@@ -332,6 +350,7 @@ export default defineConfig({
           collapsed: true,
           items: [
             { label: 'Overview', slug: 'security' },
+            { label: 'Evidence security model', slug: 'security/evidence' },
             { label: 'Report a vulnerability', slug: 'security/report-a-vulnerability' },
             { label: 'Security support window', slug: 'security/support-window' },
             { label: 'Release trust', slug: 'security/openssf-evidence' },
@@ -345,6 +364,7 @@ export default defineConfig({
             { label: 'Validate a project', slug: 'verify' },
             { label: 'Generated files and ownership', slug: 'generated-artifacts' },
             { label: 'Project configuration', slug: 'reference/project-configuration' },
+            { label: 'evidencectl CLI', slug: 'reference/evidencectl' },
             { label: 'registryctl CLI', slug: 'reference/registryctl' },
             {
               label: 'API reference',
@@ -352,12 +372,14 @@ export default defineConfig({
               items: [
                 { label: 'Overview', slug: 'reference/apis' },
                 { label: 'Relay (narrative)', slug: 'reference/apis/registry-relay' },
-                { label: 'Notary (narrative)', slug: 'reference/apis/registry-notary' },
+                { label: 'Evidence (narrative)', slug: 'reference/apis/registry-evidence' },
                 // Generated operation pages for each schema (theme-aware, searchable).
                 ...openAPISidebarGroups,
               ],
             },
             { label: 'Errors and status codes', slug: 'reference/errors' },
+            { label: 'Evidence problems', slug: 'reference/evidence-problems' },
+            { label: 'Registry Mint', slug: 'reference/mint' },
             {
               label: 'Diagnostic catalogs',
               collapsed: true,
@@ -377,16 +399,25 @@ export default defineConfig({
                   collapsed: true,
                   items: generatedProduct('Relay').items,
                 },
-                {
-                  label: 'Registry Notary',
-                  collapsed: true,
-                  items: generatedProduct('Notary').items,
-                },
                 {
                   label: 'Registry Manifest',
                   collapsed: true,
                   items: generatedProduct('Manifest').items,
                 },
+                // Evidence entered the product docset after every archived
+                // docset was sealed, so its group is optional: absent when an
+                // archived docset's generated sidebar has no Evidence product.
+                // generate-sidebar.test.mjs pins its presence for the current
+                // docset, keeping the loud-failure property there.
+                ...(optionalGeneratedProduct('Evidence')
+                  ? [
+                      {
+                        label: 'Registry Evidence',
+                        collapsed: true,
+                        items: generatedProduct('Evidence').items,
+                      },
+                    ]
+                  : []),
               ],
             },
             { label: 'Contracts', slug: 'reference/contracts' },
@@ -403,7 +434,6 @@ export default defineConfig({
                 { label: 'Boundaries and map', slug: 'map/boundaries-and-map' },
                 { label: 'Records stay home', slug: 'explanation/records-stay-home' },
                 { label: 'Relay protected read flow', slug: 'explanation/consultation-flow' },
-                { label: 'Evidence issuance', slug: 'explanation/evidence-issuance' },
                 { label: 'Disclosure modes', slug: 'explanation/disclosure-modes-and-computed-answers' },
                 { label: 'Data minimization', slug: 'explanation/data-minimization-and-purpose-limitation' },
                 { label: 'Trusted context', slug: 'explanation/trusted-context-constraints' },
@@ -419,11 +449,10 @@ export default defineConfig({
                 { label: 'RS-DOC · Documentation framework', slug: 'spec/rs-doc' },
                 { label: 'RS-TERMS · Terms', slug: 'spec/rs-terms' },
                 { label: 'RS-ARC-G · Architecture', slug: 'spec/rs-arc-g' },
-                { label: 'RS-PR-NOTARY · Notary protocol', slug: 'spec/rs-pr-notary' },
+                { label: 'RS-PR-EVIDENCE · Evidence protocol', slug: 'spec/rs-pr-evidence' },
                 { label: 'RS-PR-REGISTRYCTL · registryctl contract', slug: 'spec/rs-pr-registryctl' },
                 { label: 'RS-PR-RELAY · Relay protocol', slug: 'spec/rs-pr-relay' },
                 { label: 'RS-SEC-G · Security model', slug: 'spec/rs-sec-g' },
-                { label: 'RS-DM-CLAIM · Claim definition model', slug: 'spec/rs-dm-claim' },
                 { label: 'RS-DM-MANIFEST · Portable metadata model', slug: 'spec/rs-dm-manifest' },
               ],
             },
diff --git a/docs/site/docs/review-ledger-1.0.md b/docs/site/docs/review-ledger-1.0.md
index 8f1d72c72..b84c166e7 100644
--- a/docs/site/docs/review-ledger-1.0.md
+++ b/docs/site/docs/review-ledger-1.0.md
@@ -212,7 +212,8 @@ notary-three-parties [stale WITNESS name fixed], relay-two-rooms [feature-gate l
 1 REJECTED with evidence (notary-disclosure-lens drew a fourth disclosure mode the docs deny),
 9 retired. In-use fixes: evidence-transports pre-rename routes, claim-model connector/rule kinds
 (+ page alt), country-evidence-mesh unanchored AI panel removed. New diagrams: solmara-lab-topology
-(first-run tutorial), registry-relay-or-notary (when-to-use), registry-trust-boundaries
+(first-run tutorial), registry-relay-or-notary (when-to-use; deleted with the Notary
+retirement on 2026-08-03 and not replaced), registry-trust-boundaries
 (threat-model, Tier-C deltas recorded), mermaid adapter chains on the FHIR and DHIS2 tutorials.
 check-svg-a11y.mjs expected list realigned (13 in-use files). Dark-mode contrast issue filed as
 registry-stack#291. Spec-page mermaid deliberately left as mermaid (drift-resistant).
diff --git a/docs/site/docs/style-guide.md b/docs/site/docs/style-guide.md
index b5b13fae5..00c5b84a0 100644
--- a/docs/site/docs/style-guide.md
+++ b/docs/site/docs/style-guide.md
@@ -97,9 +97,10 @@ Preferred terms.
 | Domain                | Preferred                                            |
 | --------------------- | ---------------------------------------------------- |
 | Product family        | `registry stack` (lowercase) for the concept; `Registry Docs` for the site and repo |
-| Formal product names  | `Registry Platform`, `Registry Manifest`, `Registry Relay`, and `Registry Notary` (Title Case) |
+| Formal product names  | `Registry Platform`, `Registry Manifest`, `Registry Relay` (Title Case), and `Evidence` (a proper noun, no `Registry` prefix); `Registry Mint` is a supporting service, not one of the four |
+| Retired product       | `Registry Notary` keeps its Title Case name, but only where the page says in the same block that it is retired |
 | External adopter demo | `Solmara Lab` (Title Case); not a formal Registry Stack product |
-| Repo slugs            | `registry-platform`, `registry-manifest`, `registry-relay`, and `registry-notary` for formal products; `solmara-lab` for the external adopter demo (monospace) |
+| Repo slugs            | `registry-platform`, `registry-manifest`, `registry-relay`, `registry-evidence`, and `registry-mint`; `solmara-lab` for the external adopter demo (monospace) |
 | Legacy repo paths     | `registry_relay` and `decentralized-evidence-demo` appear only in historical pages or `rename_status` fields. Never in prose on a `current` page without explicit rename context. |
 | Standards             | Use the official acronym after spelling on first use. `DCAT`, `SHACL`, `OGC API Records`, `SD-JWT VC`, `CCCEV`. Never translate. |
 
@@ -109,7 +110,7 @@ Preferred terms.
 - All items start with a capital letter.
 - Parallel structure. All items are noun phrases, or all are imperative verbs. Do not mix.
 - No period if every item is a fragment. Period on every item if any item is a complete sentence.
-- Use the Oxford comma in prose: `Manifest, Relay, and Notary`.
+- Use the Oxford comma in prose: `Manifest, Relay, and Evidence`.
 - Do not use bold inside list items for keywords. Reserve bold for UI labels.
 
 ## Code, commands, paths
@@ -188,8 +189,8 @@ This applies to every page that touches a standard or a contract.
 - When you cannot find evidence for an existing claim, mark it inline with a TODO and propose a demotion:
 
   ```mdx
-  Registry Notary emits SD-JWT VC credentials.
-  {/* TODO[evidence]: no SD-JWT issuer found in registry-notary/crates/.
+  Registry Relay emits SD-JWT VC credentials.
+  {/* TODO[evidence]: no SD-JWT issuer found in crates/registry-relay/.
        Suggest demoting to `aligns_with` until a fixture lands. */}
   ```
 
diff --git a/docs/site/examples/registryctl/jsonplaceholder-todo-live/environments/local.yaml b/docs/site/examples/registryctl/jsonplaceholder-todo-live/environments/local.yaml
index cf5f9daec..c2a47dd15 100644
--- a/docs/site/examples/registryctl/jsonplaceholder-todo-live/environments/local.yaml
+++ b/docs/site/examples/registryctl/jsonplaceholder-todo-live/environments/local.yaml
@@ -10,30 +10,14 @@ integrations:
     source:
       origin: https://public-json-source.invalid
 
-issuance:
-  issuer: did:web:notary.invalid
-  signing_kid: project-issuer-key
-  signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }
-  generation: 1
-
-callers:
-  evidence-client:
-    api_key_fingerprint: { secret: EVIDENCE_CLIENT_TOKEN_HASH }
-    scopes: ["evidence:todo:read"]
-
 relay:
   origin: https://relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [fictional-relay-client]
-
-notary_relay:
-  base_url: http://registry-relay-consultation:8080
-  workload_client_id: fictional-registry-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: fictional-consultation-client, principal_id: fictional-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: fictional-registry-relay }
-  notary: { service: fictional-registry-notary }
diff --git a/docs/site/examples/registryctl/jsonplaceholder-todo-live/environments/public-demo-missing.yaml b/docs/site/examples/registryctl/jsonplaceholder-todo-live/environments/public-demo-missing.yaml
index 1e75f3f1f..e8ac5f402 100644
--- a/docs/site/examples/registryctl/jsonplaceholder-todo-live/environments/public-demo-missing.yaml
+++ b/docs/site/examples/registryctl/jsonplaceholder-todo-live/environments/public-demo-missing.yaml
@@ -10,30 +10,14 @@ integrations:
     source:
       origin: https://jsonplaceholder.typicode.com
 
-issuance:
-  issuer: did:web:notary.invalid
-  signing_kid: project-issuer-key
-  signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }
-  generation: 1
-
-callers:
-  evidence-client:
-    api_key_fingerprint: { secret: EVIDENCE_CLIENT_TOKEN_HASH }
-    scopes: ["evidence:todo:read"]
-
 relay:
   origin: https://relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [fictional-relay-client]
-
-notary_relay:
-  base_url: http://registry-relay-consultation:8080
-  workload_client_id: fictional-registry-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: fictional-consultation-client, principal_id: fictional-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: fictional-registry-relay }
-  notary: { service: fictional-registry-notary }
diff --git a/docs/site/examples/registryctl/jsonplaceholder-todo-live/environments/public-demo.yaml b/docs/site/examples/registryctl/jsonplaceholder-todo-live/environments/public-demo.yaml
index 30fbf0066..86cafa83c 100644
--- a/docs/site/examples/registryctl/jsonplaceholder-todo-live/environments/public-demo.yaml
+++ b/docs/site/examples/registryctl/jsonplaceholder-todo-live/environments/public-demo.yaml
@@ -10,30 +10,14 @@ integrations:
     source:
       origin: https://jsonplaceholder.typicode.com
 
-issuance:
-  issuer: did:web:notary.invalid
-  signing_kid: project-issuer-key
-  signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }
-  generation: 1
-
-callers:
-  evidence-client:
-    api_key_fingerprint: { secret: EVIDENCE_CLIENT_TOKEN_HASH }
-    scopes: ["evidence:todo:read"]
-
 relay:
   origin: https://relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [fictional-relay-client]
-
-notary_relay:
-  base_url: http://registry-relay-consultation:8080
-  workload_client_id: fictional-registry-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: fictional-consultation-client, principal_id: fictional-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: fictional-registry-relay }
-  notary: { service: fictional-registry-notary }
diff --git a/docs/site/examples/registryctl/jsonplaceholder-todo-live/integrations/public-todo/fixtures/completed.yaml b/docs/site/examples/registryctl/jsonplaceholder-todo-live/integrations/public-todo/fixtures/completed.yaml
index 923a12147..907a7dc80 100644
--- a/docs/site/examples/registryctl/jsonplaceholder-todo-live/integrations/public-todo/fixtures/completed.yaml
+++ b/docs/site/examples/registryctl/jsonplaceholder-todo-live/integrations/public-todo/fixtures/completed.yaml
@@ -1,13 +1,5 @@
 name: completed-todo
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers: [{ scheme: public_todo_id, value: "4" }]
-  claims: [todo-record-exists]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: public-source-connection-demonstration
 input: { todo_id: "4" }
 interactions:
   - expect:
@@ -23,4 +15,3 @@ interactions:
 expect:
   outcome: match
   outputs: { completed: true }
-  claims: { todo-record-exists: true, todo-completed: true }
diff --git a/docs/site/examples/registryctl/jsonplaceholder-todo-live/integrations/public-todo/fixtures/no-match.yaml b/docs/site/examples/registryctl/jsonplaceholder-todo-live/integrations/public-todo/fixtures/no-match.yaml
index 96dc2a25c..e96e6a4b4 100644
--- a/docs/site/examples/registryctl/jsonplaceholder-todo-live/integrations/public-todo/fixtures/no-match.yaml
+++ b/docs/site/examples/registryctl/jsonplaceholder-todo-live/integrations/public-todo/fixtures/no-match.yaml
@@ -1,13 +1,5 @@
 name: no-todo
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers: [{ scheme: public_todo_id, value: "999999" }]
-  claims: [todo-record-exists]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: public-source-connection-demonstration
 input: { todo_id: "999999" }
 interactions:
   - expect:
@@ -17,4 +9,3 @@ interactions:
 expect:
   outcome: no_match
   outputs: {}
-  claims: { todo-record-exists: false, todo-completed: null }
diff --git a/docs/site/examples/registryctl/jsonplaceholder-todo-live/registry-stack.yaml b/docs/site/examples/registryctl/jsonplaceholder-todo-live/registry-stack.yaml
index 2ab141687..d437854a9 100644
--- a/docs/site/examples/registryctl/jsonplaceholder-todo-live/registry-stack.yaml
+++ b/docs/site/examples/registryctl/jsonplaceholder-todo-live/registry-stack.yaml
@@ -9,28 +9,13 @@ integrations:
 
 services:
   todo-verification:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: public-source-connection-demonstration
     legal_basis: public-service-delivery
     consent: not_required
-    access:
-      scopes: ["evidence:todo:read"]
     consultations:
       todo:
         integration: public-todo
         input:
           todo_id: request.target.identifiers.public_todo_id
-    claims:
-      todo-record-exists:
-        cel: todo.matched
-        disclosure: predicate
-      todo-completed:
-        output: todo.completed
-        disclosure: value
-    credential_profiles:
-      todo-status:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/public-todo-status/v1
-        validity: 10m
-        claims: [todo-record-exists, todo-completed]
diff --git a/docs/site/package.json b/docs/site/package.json
index ad10a921c..357a256b5 100644
--- a/docs/site/package.json
+++ b/docs/site/package.json
@@ -29,19 +29,23 @@
     "check:research-banners": "node scripts/check-research-banners.mjs",
     "check:content": "node scripts/check-doc-frontmatter.mjs",
     "check:cutover": "node scripts/check-current-doc-cutover.mjs",
+    "check:notary-surface": "node scripts/check-notary-surface.mjs",
     "check:svg": "node scripts/check-svg-a11y.mjs",
     "check:markdown": "markdownlint-cli2",
     "check:style": "node scripts/run-vale.mjs src/content/docs README.md",
     "check:style:fixtures": "node scripts/check-vale-fixtures.mjs",
-    "check:openapi": "redocly lint registry-relay registry-notary",
+    "check:openapi": "redocly lint registry-relay registry-evidence",
     "check:config-vocabulary": "scripts/check-stale-config-vocabulary.sh",
     "check:tutorial": "scripts/check-tutorial.sh",
     "check:tutorial:dry-run": "scripts/check-tutorial.sh --dry-run",
     "test:tutorial:registryctl": "node --test scripts/registryctl-tutorial.test.mjs",
     "check:tutorial:registryctl": "bash scripts/check-registryctl-tutorials.sh",
+    "test:tutorial:evidence": "node --test scripts/check-evidence-tutorials.test.mjs",
+    "check:tutorial:evidence": "bash scripts/check-evidence-tutorials.sh",
+    "check:tutorial:evidence:dry-run": "bash scripts/check-evidence-tutorials.sh --dry-run",
     "check:tutorial:public-source-live": "scripts/check-registryctl-public-source-live.sh",
     "check:links": "npm run build && npm run check:links:built",
-    "check": "npm run generate && npm run check:evidence-links && npm run check:research-banners && npm run check:docset && npm run check:release-manifests && npm run check:archive-lock && npm run check:content && npm run check:cutover && npm run check:markdown && npm run check:style && npm run check:style:fixtures && npm run check:openapi && npm run check:config-vocabulary && npm run check:tutorial:dry-run && npm run check:svg && npm run build && npm run check:accessibility:built && npm run check:llms:built && npm run check:seo:current && npm run check:links:current",
+    "check": "npm run generate && npm run check:evidence-links && npm run check:research-banners && npm run check:docset && npm run check:release-manifests && npm run check:archive-lock && npm run check:content && npm run check:cutover && npm run check:notary-surface && npm run check:markdown && npm run check:style && npm run check:style:fixtures && npm run check:openapi && npm run check:config-vocabulary && npm run check:tutorial:dry-run && npm run check:tutorial:evidence:dry-run && npm run check:svg && npm run build && npm run check:accessibility:built && npm run check:llms:built && npm run check:seo:current && npm run check:links:current",
     "check:archives": "npm run build && npm run check:llms:built && npm run assemble:archives -- --bootstrap && npm run check:seo:built && npm run check:links:built",
     "check:archive-lock": "node scripts/archive-lock.mjs check",
     "check:seo:current": "node scripts/check-seo.mjs --scope current",
diff --git a/docs/site/public/examples/evidence/opencrvs-events-search.openapi.yaml b/docs/site/public/examples/evidence/opencrvs-events-search.openapi.yaml
new file mode 100644
index 000000000..5fa0c79c4
--- /dev/null
+++ b/docs/site/public/examples/evidence/opencrvs-events-search.openapi.yaml
@@ -0,0 +1,116 @@
+# Tutorial subset of the OpenCRVS Events API.
+# Reviewed against opencrvs/opencrvs-core commit
+# a4871cb58b3e9f038bcb3eb1dcc4924e46bb57a0 and the public Farajaland
+# integration demo on 2026-08-04. OpenCRVS does not publish this subset at a
+# stable URL. Review it against the target deployment before production use.
+openapi: 3.1.0
+info:
+  title: OpenCRVS Events API tutorial subset
+  version: "2.0.0-tutorial"
+  license:
+    name: Apache-2.0
+    identifier: Apache-2.0
+servers:
+  - url: https://events.farajaland-integration.opencrvs.dev
+paths:
+  /events/search:
+    post:
+      operationId: searchEvents
+      summary: Search for civil-registration events
+      security:
+        - recordSearchClient: [recordsearch]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+      responses:
+        "200":
+          description: Matching events
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                required: [total, results]
+                properties:
+                  total:
+                    type: integer
+                    minimum: 0
+                    maximum: 1000000
+                  results:
+                    type: array
+                    minItems: 0
+                    maxItems: 2
+                    items:
+                      type: object
+                      additionalProperties: false
+                      required: []
+                      properties:
+                        type:
+                          type: string
+                          minLength: 1
+                          maxLength: 64
+                        status:
+                          type: string
+                          minLength: 1
+                          maxLength: 64
+                        dateOfEvent:
+                          type: string
+                          format: date
+                        placeOfEvent:
+                          type: string
+                          minLength: 1
+                          maxLength: 128
+                        declaration:
+                          type: object
+                          additionalProperties: false
+                          required: []
+                          properties:
+                            child.nid:
+                              type: string
+                              minLength: 1
+                              maxLength: 128
+                            child.name:
+                              type: object
+                              additionalProperties: false
+                              required: [firstname, surname]
+                              properties:
+                                firstname:
+                                  type: string
+                                  minLength: 1
+                                  maxLength: 200
+                                surname:
+                                  type: string
+                                  minLength: 1
+                                  maxLength: 200
+                            child.birthLocationId:
+                              type: string
+                              minLength: 1
+                              maxLength: 128
+                            mother.nid:
+                              type: string
+                              minLength: 1
+                              maxLength: 128
+                            mother.verified:
+                              type: string
+                              enum: [authenticated]
+                            father.nid:
+                              type: string
+                              minLength: 1
+                              maxLength: 128
+                            father.verified:
+                              type: string
+                              enum: [authenticated]
+        "401":
+          description: Missing or invalid Record Search access token
+components:
+  securitySchemes:
+    recordSearchClient:
+      type: oauth2
+      flows:
+        clientCredentials:
+          tokenUrl: https://auth.farajaland-integration.opencrvs.dev/token
+          scopes:
+            recordsearch: Search civil-registration records
diff --git a/docs/site/public/examples/registryctl/jsonplaceholder-todo-live-overlay-v1.sh b/docs/site/public/examples/registryctl/jsonplaceholder-todo-live-overlay-v1.sh
index b1c9800a5..179575efd 100644
--- a/docs/site/public/examples/registryctl/jsonplaceholder-todo-live-overlay-v1.sh
+++ b/docs/site/public/examples/registryctl/jsonplaceholder-todo-live-overlay-v1.sh
@@ -14,13 +14,13 @@ from pathlib import Path
 
 expected = {
   ".gitignore": "84a80d00398b512ef755f17c1764c15b491058265d06d2cea71af37641324b83",
-  "environments/local.yaml": "0ae0ce73cd6a775e188aaa0caed37cccce378c392aa021544872b16d6f0047a6",
-  "integrations/person-record/fixtures/active.yaml": "4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3",
+  "environments/local.yaml": "3af49441f405f725b25c9b1075c408fcd4b768b2b0bbd70a59b04c878ae8df45",
+  "integrations/person-record/fixtures/active.yaml": "df873d90889c90ccc30132c5b911e555d1a9816ba409bc9cb37504a6466650b7",
   "integrations/person-record/fixtures/ambiguous.yaml": "6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232",
-  "integrations/person-record/fixtures/no-match.yaml": "f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5",
+  "integrations/person-record/fixtures/no-match.yaml": "415ac27bc7e212e2a92b46e51c9e7282bddd9722aeaf4530557061f10d89b33e",
   "integrations/person-record/integration.yaml": "2b4950e1938e4d8345b7952480daa46e17abfd13ba2a8b42666b34adf7e02412",
   "README.md": "fb9994c4d4859c9d8672ac90b5960edb58eef63a65a4b096068409dc964be63b",
-  "registry-stack.yaml": "d6315b173ee04818bc8e420d3a922944386be54a06e2d9c6c20cdb7d0f1c0c27"
+  "registry-stack.yaml": "3e22300d40d72e7dd17cf51ff90967e654cca3fd520e51f5e32496870431385b"
 }
 ignored_roots = {".registry-stack-editor", ".vscode", ".zed"}
 transport_files = {"jsonplaceholder-todo-live-overlay-v1.sh", "jsonplaceholder-todo-live-overlay-v1.sh.sha256"}
@@ -77,33 +77,17 @@ integrations:
     source:
       origin: https://public-json-source.invalid
 
-issuance:
-  issuer: did:web:notary.invalid
-  signing_kid: project-issuer-key
-  signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }
-  generation: 1
-
-callers:
-  evidence-client:
-    api_key_fingerprint: { secret: EVIDENCE_CLIENT_TOKEN_HASH }
-    scopes: ["evidence:todo:read"]
-
 relay:
   origin: https://relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [fictional-relay-client]
-
-notary_relay:
-  base_url: http://registry-relay-consultation:8080
-  workload_client_id: fictional-registry-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: fictional-consultation-client, principal_id: fictional-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: fictional-registry-relay }
-  notary: { service: fictional-registry-notary }
 REGISTRYCTL_ENVIRONMENTS_LOCAL_YAML_EOF
 
 mkdir -p 'environments'
@@ -120,33 +104,17 @@ integrations:
     source:
       origin: https://jsonplaceholder.typicode.com
 
-issuance:
-  issuer: did:web:notary.invalid
-  signing_kid: project-issuer-key
-  signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }
-  generation: 1
-
-callers:
-  evidence-client:
-    api_key_fingerprint: { secret: EVIDENCE_CLIENT_TOKEN_HASH }
-    scopes: ["evidence:todo:read"]
-
 relay:
   origin: https://relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [fictional-relay-client]
-
-notary_relay:
-  base_url: http://registry-relay-consultation:8080
-  workload_client_id: fictional-registry-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: fictional-consultation-client, principal_id: fictional-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: fictional-registry-relay }
-  notary: { service: fictional-registry-notary }
 REGISTRYCTL_ENVIRONMENTS_PUBLIC_DEMO_MISSING_YAML_EOF
 
 mkdir -p 'environments'
@@ -163,33 +131,17 @@ integrations:
     source:
       origin: https://jsonplaceholder.typicode.com
 
-issuance:
-  issuer: did:web:notary.invalid
-  signing_kid: project-issuer-key
-  signing_key: { secret: REGISTRY_NOTARY_ISSUER_JWK }
-  generation: 1
-
-callers:
-  evidence-client:
-    api_key_fingerprint: { secret: EVIDENCE_CLIENT_TOKEN_HASH }
-    scopes: ["evidence:todo:read"]
-
 relay:
   origin: https://relay.internal.invalid
   issuer: https://workload-issuer.internal.invalid
   jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [fictional-relay-client]
-
-notary_relay:
-  base_url: http://registry-relay-consultation:8080
-  workload_client_id: fictional-registry-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: fictional-consultation-client, principal_id: fictional-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: fictional-registry-relay }
-  notary: { service: fictional-registry-notary }
 REGISTRYCTL_ENVIRONMENTS_PUBLIC_DEMO_YAML_EOF
 
 mkdir -p 'integrations/public-todo/fixtures'
@@ -209,14 +161,6 @@ mkdir -p 'integrations/public-todo/fixtures'
 cat >'integrations/public-todo/fixtures/completed.yaml' <<'REGISTRYCTL_INTEGRATIONS_PUBLIC_TODO_FIXTURES_COMPLETED_YAML_EOF'
 name: completed-todo
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers: [{ scheme: public_todo_id, value: "4" }]
-  claims: [todo-record-exists]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: public-source-connection-demonstration
 input: { todo_id: "4" }
 interactions:
   - expect:
@@ -232,21 +176,12 @@ interactions:
 expect:
   outcome: match
   outputs: { completed: true }
-  claims: { todo-record-exists: true, todo-completed: true }
 REGISTRYCTL_INTEGRATIONS_PUBLIC_TODO_FIXTURES_COMPLETED_YAML_EOF
 
 mkdir -p 'integrations/public-todo/fixtures'
 cat >'integrations/public-todo/fixtures/no-match.yaml' <<'REGISTRYCTL_INTEGRATIONS_PUBLIC_TODO_FIXTURES_NO_MATCH_YAML_EOF'
 name: no-todo
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers: [{ scheme: public_todo_id, value: "999999" }]
-  claims: [todo-record-exists]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: public-source-connection-demonstration
 input: { todo_id: "999999" }
 interactions:
   - expect:
@@ -256,7 +191,6 @@ interactions:
 expect:
   outcome: no_match
   outputs: {}
-  claims: { todo-record-exists: false, todo-completed: null }
 REGISTRYCTL_INTEGRATIONS_PUBLIC_TODO_FIXTURES_NO_MATCH_YAML_EOF
 
 mkdir -p 'integrations/public-todo'
@@ -310,31 +244,16 @@ integrations:
 
 services:
   todo-verification:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: public-source-connection-demonstration
     legal_basis: public-service-delivery
     consent: not_required
-    access:
-      scopes: ["evidence:todo:read"]
     consultations:
       todo:
         integration: public-todo
         input:
           todo_id: request.target.identifiers.public_todo_id
-    claims:
-      todo-record-exists:
-        cel: todo.matched
-        disclosure: predicate
-      todo-completed:
-        output: todo.completed
-        disclosure: value
-    credential_profiles:
-      todo-status:
-        format: dc+sd-jwt
-        type: https://credentials.invalid/public-todo-status/v1
-        validity: 10m
-        claims: [todo-record-exists, todo-completed]
 REGISTRYCTL_REGISTRY_STACK_YAML_EOF
 
 printf '%s\n' 'Applied the optional no-credential public JSON source demonstration overlay.'
diff --git a/docs/site/public/examples/registryctl/jsonplaceholder-todo-live-overlay-v1.sh.sha256 b/docs/site/public/examples/registryctl/jsonplaceholder-todo-live-overlay-v1.sh.sha256
index 2e9ad3305..2d296f75d 100644
--- a/docs/site/public/examples/registryctl/jsonplaceholder-todo-live-overlay-v1.sh.sha256
+++ b/docs/site/public/examples/registryctl/jsonplaceholder-todo-live-overlay-v1.sh.sha256
@@ -1 +1 @@
-1751ef854b5ce37191aa4dc5c8a49c5f97c95df2bf0844ac68a7983aa45792f8  jsonplaceholder-todo-live-overlay-v1.sh
+60906ecac96a8ef4eb546bd726c359835868a1c6b01f160118979d9c80970277  jsonplaceholder-todo-live-overlay-v1.sh
diff --git a/docs/site/public/examples/registryctl/opencrvs-events-api-overlay-v1.sh b/docs/site/public/examples/registryctl/opencrvs-events-api-overlay-v1.sh
index 91c3211ac..76cd9c177 100644
--- a/docs/site/public/examples/registryctl/opencrvs-events-api-overlay-v1.sh
+++ b/docs/site/public/examples/registryctl/opencrvs-events-api-overlay-v1.sh
@@ -14,13 +14,13 @@ from pathlib import Path
 
 expected = {
   ".gitignore": "84a80d00398b512ef755f17c1764c15b491058265d06d2cea71af37641324b83",
-  "environments/local.yaml": "0ae0ce73cd6a775e188aaa0caed37cccce378c392aa021544872b16d6f0047a6",
-  "integrations/person-record/fixtures/active.yaml": "4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3",
+  "environments/local.yaml": "3af49441f405f725b25c9b1075c408fcd4b768b2b0bbd70a59b04c878ae8df45",
+  "integrations/person-record/fixtures/active.yaml": "df873d90889c90ccc30132c5b911e555d1a9816ba409bc9cb37504a6466650b7",
   "integrations/person-record/fixtures/ambiguous.yaml": "6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232",
-  "integrations/person-record/fixtures/no-match.yaml": "f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5",
+  "integrations/person-record/fixtures/no-match.yaml": "415ac27bc7e212e2a92b46e51c9e7282bddd9722aeaf4530557061f10d89b33e",
   "integrations/person-record/integration.yaml": "2b4950e1938e4d8345b7952480daa46e17abfd13ba2a8b42666b34adf7e02412",
   "README.md": "fb9994c4d4859c9d8672ac90b5960edb58eef63a65a4b096068409dc964be63b",
-  "registry-stack.yaml": "d6315b173ee04818bc8e420d3a922944386be54a06e2d9c6c20cdb7d0f1c0c27"
+  "registry-stack.yaml": "3e22300d40d72e7dd17cf51ff90967e654cca3fd520e51f5e32496870431385b"
 }
 ignored_roots = {".registry-stack-editor", ".vscode", ".zed"}
 transport_files = {"opencrvs-events-api-overlay-v1.sh", "opencrvs-events-api-overlay-v1.sh.sha256"}
@@ -85,27 +85,17 @@ integrations:
         path: /oauth/token
         generation: 1
 
-callers:
-  synthetic-case-client:
-    api_key_fingerprint: { secret: SYNTHETIC_CASE_CLIENT_TOKEN_HASH }
-    scopes: ["evidence:birth-event:read"]
-
 relay:
   origin: https://relay.opencrvs.invalid
   issuer: https://workload-issuer.opencrvs.invalid
   jwks_url: https://workload-issuer.opencrvs.invalid/.well-known/jwks.json
   audience: registry-relay
   allowed_clients: [synthetic-opencrvs-relay-client]
-
-notary_relay:
-  base_url: http://registry-relay-consultation:8080
-  workload_client_id: synthetic-opencrvs-notary
-  token_file: /run/secrets/relay-workload-token
+  consultation: { client_id: synthetic-opencrvs-consultation-client, principal_id: synthetic-opencrvs-consultation-principal }
 
 deployment:
   profile: local
   relay: { service: synthetic-opencrvs-relay }
-  notary: { service: synthetic-opencrvs-notary }
 REGISTRYCTL_ENVIRONMENTS_LOCAL_YAML_EOF
 
 mkdir -p 'integrations/birth-event-search'
@@ -193,22 +183,12 @@ interactions:
 expect:
   outcome: ambiguous
   outputs: {}
-  claims: {}
 REGISTRYCTL_INTEGRATIONS_BIRTH_EVENT_SEARCH_FIXTURES_AMBIGUOUS_YAML_EOF
 
 mkdir -p 'integrations/birth-event-search/fixtures'
 cat >'integrations/birth-event-search/fixtures/match.yaml' <<'REGISTRYCTL_INTEGRATIONS_BIRTH_EVENT_SEARCH_FIXTURES_MATCH_YAML_EOF'
 name: birth-event-match
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers:
-      - { scheme: opencrvs_tracking_id, value: TRK-SYNTH000001 }
-  claims: [birth-event-found, birth-event-registered]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: birth-event-registration-verification
 input: { tracking_id: TRK-SYNTH000001 }
 interactions:
   - expect:
@@ -251,9 +231,6 @@ expect:
   outputs:
     event_type: birth
     registered: true
-  claims:
-    birth-event-found: true
-    birth-event-registered: true
 REGISTRYCTL_INTEGRATIONS_BIRTH_EVENT_SEARCH_FIXTURES_MATCH_YAML_EOF
 
 mkdir -p 'integrations/birth-event-search/fixtures'
@@ -288,9 +265,6 @@ interactions:
 expect:
   outcome: no_match
   outputs: {}
-  claims:
-    birth-event-found: false
-    birth-event-registered: false
 REGISTRYCTL_INTEGRATIONS_BIRTH_EVENT_SEARCH_FIXTURES_NO_MATCH_YAML_EOF
 
 mkdir -p 'integrations/birth-event-search/fixtures'
@@ -311,7 +285,7 @@ interactions:
         access_token: SYNTHETIC_FIXTURE_TOKEN
         token_type: Bearer
         expires_in: 300
-expect: { error: source.response_malformed, outputs: {}, claims: {} }
+expect: { error: source.response_malformed, outputs: {} }
 REGISTRYCTL_INTEGRATIONS_BIRTH_EVENT_SEARCH_FIXTURES_OAUTH_EXPIRY_YAML_EOF
 
 mkdir -p 'integrations/birth-event-search/fixtures'
@@ -332,7 +306,7 @@ interactions:
         access_token: SYNTHETIC_FIXTURE_TOKEN
         token_type: Bearer
         unexpected: rejected
-expect: { error: source.response_malformed, outputs: {}, claims: {} }
+expect: { error: source.response_malformed, outputs: {} }
 REGISTRYCTL_INTEGRATIONS_BIRTH_EVENT_SEARCH_FIXTURES_OAUTH_EXTRA_MEMBER_YAML_EOF
 
 mkdir -p 'integrations/birth-event-search/fixtures'
@@ -350,7 +324,7 @@ interactions:
       status: 200
       headers: { Content-Type: text/plain }
       body: { access_token: SYNTHETIC_FIXTURE_TOKEN, token_type: Bearer }
-expect: { error: source.response_malformed, outputs: {}, claims: {} }
+expect: { error: source.response_malformed, outputs: {} }
 REGISTRYCTL_INTEGRATIONS_BIRTH_EVENT_SEARCH_FIXTURES_OAUTH_MEDIA_TYPE_YAML_EOF
 
 mkdir -p 'integrations/birth-event-search/fixtures'
@@ -368,7 +342,7 @@ interactions:
       status: 302
       headers: { Location: https://redirect.opencrvs.invalid/oauth/token }
       body: {}
-expect: { error: source.status_rejected, outputs: {}, claims: {} }
+expect: { error: source.status_rejected, outputs: {} }
 REGISTRYCTL_INTEGRATIONS_BIRTH_EVENT_SEARCH_FIXTURES_OAUTH_REDIRECT_YAML_EOF
 
 mkdir -p 'integrations/birth-event-search/fixtures'
@@ -388,7 +362,7 @@ interactions:
       body:
         access_token: SYNTHETIC_FIXTURE_TOKEN
         token_type: bearer
-expect: { error: source.response_malformed, outputs: {}, claims: {} }
+expect: { error: source.response_malformed, outputs: {} }
 REGISTRYCTL_INTEGRATIONS_BIRTH_EVENT_SEARCH_FIXTURES_OAUTH_TOKEN_TYPE_YAML_EOF
 
 mkdir -p 'integrations/birth-event-search/fixtures'
@@ -420,7 +394,7 @@ interactions:
     respond:
       status: 200
       body: { total: one, results: [] }
-expect: { error: source.status_rejected, outputs: {}, claims: {} }
+expect: { error: source.status_rejected, outputs: {} }
 REGISTRYCTL_INTEGRATIONS_BIRTH_EVENT_SEARCH_FIXTURES_SOURCE_MALFORMED_YAML_EOF
 
 mkdir -p 'integrations/birth-event-search/fixtures'
@@ -450,7 +424,7 @@ interactions:
         limit: 2
         offset: 0
     respond: { status: 503, body: {} }
-expect: { error: source.status_rejected, outputs: {}, claims: {} }
+expect: { error: source.status_rejected, outputs: {} }
 REGISTRYCTL_INTEGRATIONS_BIRTH_EVENT_SEARCH_FIXTURES_SOURCE_REJECTED_YAML_EOF
 
 mkdir -p 'integrations/birth-event-search/fixtures'
@@ -480,7 +454,7 @@ interactions:
         limit: 2
         offset: 0
     respond: { timeout: 10s }
-expect: { error: source.deadline_exceeded, outputs: {}, claims: {} }
+expect: { error: source.deadline_exceeded, outputs: {} }
 REGISTRYCTL_INTEGRATIONS_BIRTH_EVENT_SEARCH_FIXTURES_SOURCE_TIMEOUT_YAML_EOF
 
 mkdir -p 'integrations/birth-event-search/fixtures'
@@ -518,7 +492,7 @@ interactions:
             type: birth
             status: REGISTERED
             trackingId: TRK-SYNTH999999
-expect: { error: failure.subject_mismatch, outputs: {}, claims: {} }
+expect: { error: failure.subject_mismatch, outputs: {} }
 REGISTRYCTL_INTEGRATIONS_BIRTH_EVENT_SEARCH_FIXTURES_SUBJECT_MISMATCH_YAML_EOF
 
 mkdir -p 'integrations/birth-event-search'
@@ -580,28 +554,16 @@ integrations:
 
 services:
   birth-event-verification:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: birth-event-registration-verification
     legal_basis: public-service-delivery
     consent: not_required
-    access:
-      scopes: ["evidence:birth-event:read"]
     consultations:
       event:
         integration: birth-event-search
         input:
           tracking_id: request.target.identifiers.opencrvs_tracking_id
-    claims:
-      birth-event-found:
-        cel: event.matched
-        disclosure: predicate
-      birth-event-registered:
-        cel: >-
-          event.matched
-            && event.event_type == "birth"
-            && event.registered
-        disclosure: predicate
 REGISTRYCTL_REGISTRY_STACK_YAML_EOF
 
 printf '%s\n' 'Applied the synthetic OpenCRVS Events API-shaped OAuth and Rhai overlay.'
diff --git a/docs/site/public/examples/registryctl/opencrvs-events-api-overlay-v1.sh.sha256 b/docs/site/public/examples/registryctl/opencrvs-events-api-overlay-v1.sh.sha256
index 3e80e6d64..4b16d2f69 100644
--- a/docs/site/public/examples/registryctl/opencrvs-events-api-overlay-v1.sh.sha256
+++ b/docs/site/public/examples/registryctl/opencrvs-events-api-overlay-v1.sh.sha256
@@ -1 +1 @@
-55f6ad2001ef25200133e1d87754a477cae6b5e566fb742e8cc408249ed4b05d  opencrvs-events-api-overlay-v1.sh
+063d150c35995ef20f0c034986ba6c3ff2e50291209ed9ca4de1c07db91d9173  opencrvs-events-api-overlay-v1.sh
diff --git a/docs/site/public/generated/configuration-reference-coverage.v1.json b/docs/site/public/generated/configuration-reference-coverage.v1.json
index 5293f4f1b..22dc19111 100644
--- a/docs/site/public/generated/configuration-reference-coverage.v1.json
+++ b/docs/site/public/generated/configuration-reference-coverage.v1.json
@@ -16,8 +16,7 @@
       "integration",
       "fixture",
       "entity",
-      "relay",
-      "notary"
+      "relay"
     ],
     "schema_sources": [
       "project.schema.json",
@@ -25,92 +24,51 @@
       "integration.schema.json",
       "fixture.schema.json",
       "entity.schema.json",
-      "registry-relay.config.schema.json",
-      "registry-notary.config.schema.json"
+      "registry-relay.config.schema.json"
     ],
     "field_knowledge": "schemas/project-authoring/parity-coverage.json#field_knowledge",
     "human_intent": "schemas/project-authoring/documentation-intent.json",
     "runtime_intent": [
-      "crates/registry-relay/config/documentation-intent.json",
-      "crates/registry-notary-core/config/documentation-intent.json"
+      "crates/registry-relay/config/documentation-intent.json"
     ],
     "reads_country_workspaces": false,
     "reads_runtime_configuration": false
   },
   "coverage": {
-    "schema_count": 7,
-    "path_count": 1829,
-    "reference_count": 506,
+    "schema_count": 6,
+    "path_count": 1155,
+    "reference_count": 363,
     "by_schema": {
-      "project": 220,
-      "environment": 213,
+      "project": 191,
+      "environment": 126,
       "integration": 171,
-      "fixture": 63,
+      "fixture": 39,
       "entity": 35,
-      "relay": 593,
-      "notary": 534
+      "relay": 593
     },
     "by_path_kind": {
-      "root": 7,
-      "property": 1458,
-      "map_key": 26,
-      "map_value": 48,
-      "array_item": 178,
-      "branch": 112
+      "root": 6,
+      "property": 903,
+      "map_key": 22,
+      "map_value": 34,
+      "array_item": 102,
+      "branch": 88
     },
     "by_sensitivity": {
       "public": 16,
-      "internal": 1179,
-      "sensitive": 408,
-      "secret_reference": 44,
-      "redacted_fixture": 51,
-      "structural": 131
+      "internal": 878,
+      "sensitive": 106,
+      "secret_reference": 26,
+      "redacted_fixture": 29,
+      "structural": 100
     },
     "by_intent_source": {
-      "schema_description": 530,
-      "reviewed_override": 266,
-      "structural_taxonomy": 131,
-      "reviewed_profile": 902
+      "schema_description": 405,
+      "reviewed_override": 232,
+      "structural_taxonomy": 104,
+      "reviewed_profile": 414
     },
     "by_intent_profile": {
-      "notary_audit_internal": 4,
-      "notary_audit_secret_reference": 1,
-      "notary_audit_sensitive": 2,
-      "notary_auth_internal": 13,
-      "notary_auth_oidc_scope_map_open_map": 1,
-      "notary_auth_secret_reference": 4,
-      "notary_auth_sensitive": 95,
-      "notary_cel_internal": 14,
-      "notary_config_trust_internal": 1,
-      "notary_config_trust_sensitive": 4,
-      "notary_credential_status_sensitive": 4,
-      "notary_deployment_internal": 13,
-      "notary_deployment_sensitive": 1,
-      "notary_evidence_claims_evidence_mode_consultations_inputs_open_map": 1,
-      "notary_evidence_claims_evidence_mode_consultations_open_map": 1,
-      "notary_evidence_claims_evidence_mode_consultations_output_fields_open_map": 1,
-      "notary_evidence_claims_evidence_mode_consultations_outputs_open_map": 1,
-      "notary_evidence_credential_profiles_open_map": 1,
-      "notary_evidence_internal": 93,
-      "notary_evidence_secret_reference": 5,
-      "notary_evidence_sensitive": 41,
-      "notary_evidence_signing_keys_open_map": 1,
-      "notary_evidence_variables_open_map": 1,
-      "notary_federation_internal": 43,
-      "notary_federation_secret_reference": 1,
-      "notary_federation_sensitive": 5,
-      "notary_instance_internal": 5,
-      "notary_instance_sensitive": 1,
-      "notary_oid4vci_credential_configurations_open_map": 1,
-      "notary_oid4vci_internal": 33,
-      "notary_oid4vci_sensitive": 51,
-      "notary_root_structural": 1,
-      "notary_server_internal": 13,
-      "notary_server_sensitive": 2,
-      "notary_state_internal": 6,
-      "notary_state_secret_reference": 2,
-      "notary_state_sensitive": 1,
-      "notary_subject_access_sensitive": 66,
       "relay_audit_internal": 9,
       "relay_audit_secret_reference": 1,
       "relay_audit_sensitive": 1,
@@ -148,10 +106,10 @@
       "relay_vocabularies_open_map": 1
     }
   },
-  "reviewed_intent_assignment_required_count": 1829,
-  "reviewed_intent_assignment_covered_count": 1829,
-  "distinct_reviewed_intent_count": 629,
-  "distinct_reviewed_intents_reused_count": 86,
-  "reviewed_intent_assignments_using_reused_intent_count": 1286,
+  "reviewed_intent_assignment_required_count": 1155,
+  "reviewed_intent_assignment_covered_count": 1155,
+  "distinct_reviewed_intent_count": 490,
+  "distinct_reviewed_intents_reused_count": 62,
+  "reviewed_intent_assignments_using_reused_intent_count": 727,
   "missing_intent": []
 }
diff --git a/docs/site/public/generated/configuration-reference.v1.json b/docs/site/public/generated/configuration-reference.v1.json
index 85e52bb36..acce3c4e5 100644
--- a/docs/site/public/generated/configuration-reference.v1.json
+++ b/docs/site/public/generated/configuration-reference.v1.json
@@ -15,8 +15,7 @@
       "integration",
       "fixture",
       "entity",
-      "relay",
-      "notary"
+      "relay"
     ],
     "schema_sources": [
       "project.schema.json",
@@ -24,92 +23,51 @@
       "integration.schema.json",
       "fixture.schema.json",
       "entity.schema.json",
-      "registry-relay.config.schema.json",
-      "registry-notary.config.schema.json"
+      "registry-relay.config.schema.json"
     ],
     "field_knowledge": "schemas/project-authoring/parity-coverage.json#field_knowledge",
     "human_intent": "schemas/project-authoring/documentation-intent.json",
     "runtime_intent": [
-      "crates/registry-relay/config/documentation-intent.json",
-      "crates/registry-notary-core/config/documentation-intent.json"
+      "crates/registry-relay/config/documentation-intent.json"
     ],
     "reads_country_workspaces": false,
     "reads_runtime_configuration": false
   },
   "coverage": {
-    "schema_count": 7,
-    "path_count": 1829,
-    "reference_count": 506,
+    "schema_count": 6,
+    "path_count": 1155,
+    "reference_count": 363,
     "by_schema": {
-      "project": 220,
-      "environment": 213,
+      "project": 191,
+      "environment": 126,
       "integration": 171,
-      "fixture": 63,
+      "fixture": 39,
       "entity": 35,
-      "relay": 593,
-      "notary": 534
+      "relay": 593
     },
     "by_path_kind": {
-      "root": 7,
-      "property": 1458,
-      "map_key": 26,
-      "map_value": 48,
-      "array_item": 178,
-      "branch": 112
+      "root": 6,
+      "property": 903,
+      "map_key": 22,
+      "map_value": 34,
+      "array_item": 102,
+      "branch": 88
     },
     "by_sensitivity": {
       "public": 16,
-      "internal": 1179,
-      "sensitive": 408,
-      "secret_reference": 44,
-      "redacted_fixture": 51,
-      "structural": 131
+      "internal": 878,
+      "sensitive": 106,
+      "secret_reference": 26,
+      "redacted_fixture": 29,
+      "structural": 100
     },
     "by_intent_source": {
-      "schema_description": 530,
-      "reviewed_override": 266,
-      "structural_taxonomy": 131,
-      "reviewed_profile": 902
+      "schema_description": 405,
+      "reviewed_override": 232,
+      "structural_taxonomy": 104,
+      "reviewed_profile": 414
     },
     "by_intent_profile": {
-      "notary_audit_internal": 4,
-      "notary_audit_secret_reference": 1,
-      "notary_audit_sensitive": 2,
-      "notary_auth_internal": 13,
-      "notary_auth_oidc_scope_map_open_map": 1,
-      "notary_auth_secret_reference": 4,
-      "notary_auth_sensitive": 95,
-      "notary_cel_internal": 14,
-      "notary_config_trust_internal": 1,
-      "notary_config_trust_sensitive": 4,
-      "notary_credential_status_sensitive": 4,
-      "notary_deployment_internal": 13,
-      "notary_deployment_sensitive": 1,
-      "notary_evidence_claims_evidence_mode_consultations_inputs_open_map": 1,
-      "notary_evidence_claims_evidence_mode_consultations_open_map": 1,
-      "notary_evidence_claims_evidence_mode_consultations_output_fields_open_map": 1,
-      "notary_evidence_claims_evidence_mode_consultations_outputs_open_map": 1,
-      "notary_evidence_credential_profiles_open_map": 1,
-      "notary_evidence_internal": 93,
-      "notary_evidence_secret_reference": 5,
-      "notary_evidence_sensitive": 41,
-      "notary_evidence_signing_keys_open_map": 1,
-      "notary_evidence_variables_open_map": 1,
-      "notary_federation_internal": 43,
-      "notary_federation_secret_reference": 1,
-      "notary_federation_sensitive": 5,
-      "notary_instance_internal": 5,
-      "notary_instance_sensitive": 1,
-      "notary_oid4vci_credential_configurations_open_map": 1,
-      "notary_oid4vci_internal": 33,
-      "notary_oid4vci_sensitive": 51,
-      "notary_root_structural": 1,
-      "notary_server_internal": 13,
-      "notary_server_sensitive": 2,
-      "notary_state_internal": 6,
-      "notary_state_secret_reference": 2,
-      "notary_state_sensitive": 1,
-      "notary_subject_access_sensitive": 66,
       "relay_audit_internal": 9,
       "relay_audit_secret_reference": 1,
       "relay_audit_sensitive": 1,
@@ -154,11 +112,11 @@
         "pointer": "",
         "path_kind": "root"
       },
-      "purpose": "Declares the product-neutral Registry Stack project graph: integrations, materialized entities, and Relay or Notary services.",
+      "purpose": "Declares the product-neutral Registry Stack project graph: integrations, materialized entities, and Relay services.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
@@ -177,7 +135,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -203,7 +160,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -211,7 +167,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -219,7 +174,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -245,18 +199,16 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/access/properties/scopes",
+        "pointer": "/$defs/consultationService/properties/consent",
         "path_kind": "property"
       },
-      "purpose": "Lists the scopes a caller must hold to use the enclosing evidence service.",
+      "purpose": "States whether a caller must confirm consent before the Relay consultation is evaluated.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "array"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
@@ -271,7 +223,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -297,7 +248,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -305,7 +255,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -313,7 +262,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -323,44 +271,35 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "enum",
+          "value": [
+            "not_required",
+            "required"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/access/properties/scopes/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/consultationService/properties/consultations",
+        "path_kind": "property"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose": "Relay consultations and their closed bindings to target request identifiers or caller-supplied target attributes.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/consultations",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -370,7 +309,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -396,7 +334,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -404,7 +341,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -412,56 +348,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
+          "keyword": "maxProperties",
+          "value": 16
         },
         {
-          "keyword": "minLength",
+          "keyword": "minProperties",
           "value": 1
         },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/consultations"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/claimValue/properties/max_bytes",
+        "pointer": "/$defs/consultationService/properties/kind",
         "path_kind": "property"
       },
-      "purpose": "Bounds the encoded size of a claim value.",
+      "purpose": "Identifies this service declaration as a Relay consultation API backed by reviewed integrations.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -473,7 +401,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -499,7 +426,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -507,7 +433,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -515,7 +440,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -525,39 +449,32 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 65536
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
+          "keyword": "const",
+          "value": "consultation_api"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/claimValue/properties/nullable",
+        "pointer": "/$defs/consultationService/properties/legal_basis",
         "path_kind": "property"
       },
-      "purpose": "States whether the claim value may be null.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
+        "local_reference": "#/$defs/token",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -567,7 +484,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -593,7 +509,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -601,7 +516,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -609,7 +523,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -618,30 +531,49 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/token"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/claimValue/properties/type",
+        "pointer": "/$defs/consultationService/properties/purpose",
         "path_kind": "property"
       },
-      "purpose": "Declares the boolean, integer, string, or date type of a claim value.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/token",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -651,7 +583,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -677,7 +608,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -685,7 +615,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -693,7 +622,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -703,34 +631,46 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "boolean",
-            "integer",
-            "string",
-            "date"
-          ]
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/token"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/consultations/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/consultationService/properties/variables",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Typed request variables available to Relay consultation bindings.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/variables",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -742,7 +682,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -768,7 +707,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -776,7 +714,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -784,43 +721,42 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "integration",
-            "input"
-          ]
+          "keyword": "maxProperties",
+          "value": 16
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/variables"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/consultations/additionalProperties/properties/input",
+        "pointer": "/$defs/consultationService/properties/version",
         "path_kind": "property"
       },
-      "purpose": "Maps integration input names to reviewed target-request identifier or attribute bindings.",
+      "purpose": "Assigns the positive authored version used to track this Relay consultation service contract.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
@@ -836,7 +772,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -862,7 +797,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -870,7 +804,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -878,7 +811,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -888,40 +820,39 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
+          "keyword": "maximum",
+          "value": 4294967295
         },
         {
-          "keyword": "minProperties",
+          "keyword": "minimum",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/consultations/additionalProperties/properties/input/additionalProperties",
+        "pointer": "/$defs/consultations/additionalProperties",
         "path_kind": "map_value"
       },
-      "purpose": "Closed request binding. Ordinary consultations use the target; representative relationship proofs may additionally bind an authenticated requester identifier.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/requestMapping",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -931,7 +862,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -957,7 +887,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -965,7 +894,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -973,7 +901,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -984,44 +911,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "pattern",
-          "value": "^request\\.(?:target\\.(?:id|identifiers\\.[A-Za-z][A-Za-z0-9._-]{0,95}|attributes\\.[a-z][a-z0-9_]{0,63})|requester\\.identifiers\\.[A-Za-z][A-Za-z0-9._-]{0,95})$"
+          "keyword": "required",
+          "value": [
+            "integration",
+            "input"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/requestMapping"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/consultations/additionalProperties/properties/input/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/consultations/additionalProperties/properties/input",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Maps integration input names to reviewed target-request identifier or attribute bindings.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -1031,7 +952,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1057,7 +977,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1065,7 +984,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1073,49 +991,47 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxProperties",
+          "value": 16
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/consultations/additionalProperties/properties/integration",
-        "path_kind": "property"
+        "pointer": "/$defs/consultations/additionalProperties/properties/input/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Closed request binding. Ordinary consultations use the target; representative relationship proofs may additionally bind an authenticated requester identifier.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/requestMapping",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -1127,7 +1043,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1153,7 +1068,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1161,7 +1075,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1169,18 +1082,22 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 128
+        },
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^request\\.(?:target\\.(?:id|identifiers\\.[A-Za-z][A-Za-z0-9._-]{0,95}|attributes\\.[a-z][a-z0-9_]{0,63})|requester\\.identifiers\\.[A-Za-z][A-Za-z0-9._-]{0,95})$"
         },
         {
           "keyword": "type",
@@ -1189,20 +1106,20 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/requestMapping"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/consultations/propertyNames",
+        "pointer": "/$defs/consultations/additionalProperties/properties/input/propertyNames",
         "path_kind": "map_key"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -1222,7 +1139,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1248,7 +1164,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1256,7 +1171,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1264,7 +1178,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -1291,32 +1204,33 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/disclosure/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/consultations/additionalProperties/properties/integration",
+        "path_kind": "property"
       },
-      "purpose": "Maximum detail a claim may disclose.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/disclosureMode",
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1342,7 +1256,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1350,7 +1263,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1358,60 +1270,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "value",
-            "predicate",
-            "redacted"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/disclosureMode"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/disclosure/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/consultations/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1437,7 +1347,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1445,7 +1354,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1453,49 +1361,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "default",
-            "allowed"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/disclosure/oneOf/1/properties/allowed",
-        "path_kind": "property"
+        "pointer": "/$defs/fieldList/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Lists the disclosure modes that may be selected in addition to the policy's declared default.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -1505,7 +1414,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1531,7 +1439,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1539,7 +1446,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1547,43 +1453,42 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/disclosure/oneOf/1/properties/allowed/items",
+        "pointer": "/$defs/filterOperators/items",
         "path_kind": "array_item"
       },
-      "purpose": "Maximum detail a claim may disclose.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [],
-        "local_reference": "#/$defs/disclosureMode",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -1598,7 +1503,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1624,7 +1528,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1632,7 +1535,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1640,7 +1542,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -1653,46 +1554,42 @@
         {
           "keyword": "enum",
           "value": [
-            "value",
-            "predicate",
-            "redacted"
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
           ]
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/disclosureMode"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/disclosure/oneOf/1/properties/default",
-        "path_kind": "property"
+        "pointer": "/$defs/recordAggregate/anyOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Maximum detail a claim may disclose.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [],
-        "local_reference": "#/$defs/disclosureMode",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1718,7 +1615,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1726,7 +1622,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1734,48 +1629,125 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "value",
-            "predicate",
-            "redacted"
+            "measures"
           ]
         }
-      ],
-      "local_reference": {
+      ]
+    },
+    {
+      "address": {
         "schema": "project",
-        "pointer": "/$defs/disclosureMode"
-      }
+        "pointer": "/$defs/recordAggregate/anyOf/1",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "indicators"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/access",
+        "pointer": "/$defs/recordAggregate/properties/access",
         "path_kind": "property"
       },
-      "purpose": "Scopes a caller must hold to use an evidence service.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines optional metadata and aggregate scopes and whether execution is restricted to aggregate-only access.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/access",
+        "local_reference": "#/$defs/recordAggregateAccess",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -1787,7 +1759,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1813,7 +1784,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1821,7 +1791,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1829,7 +1798,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -1838,12 +1806,6 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "scopes"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -1851,27 +1813,27 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/access"
+        "pointer": "/$defs/recordAggregateAccess"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims",
+        "pointer": "/$defs/recordAggregate/properties/allowed_filters",
         "path_kind": "property"
       },
-      "purpose": "Maps evidence claim identifiers to an output or CEL expression, value contract, and disclosure policy.",
+      "purpose": "Maps aggregate filter fields to the comparison operators permitted for each field.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -1883,7 +1845,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1909,7 +1870,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1917,7 +1877,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1925,7 +1884,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -1934,14 +1892,6 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -1951,19 +1901,20 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims/additionalProperties",
+        "pointer": "/$defs/recordAggregate/properties/allowed_filters/additionalProperties",
         "path_kind": "map_value"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Allowed operators for one queryable field.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "composed": true
+        "local_reference": "#/$defs/filterOperators",
+        "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
@@ -1977,7 +1928,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2003,7 +1953,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2011,7 +1960,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2019,7 +1967,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -2030,132 +1977,53 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "disclosure"
-          ]
+          "keyword": "minItems",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.project.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
+          "value": "array"
+        },
         {
-          "keyword": "required",
-          "value": [
-            "output"
-          ]
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/filterOperators"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/recordAggregate/properties/default_group_by",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Bounded unique list of entity field identifiers.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "array"
+        ],
+        "local_reference": "#/$defs/fieldList",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2181,7 +2049,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2189,7 +2056,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2197,42 +2063,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "cel"
-          ]
+          "keyword": "maxItems",
+          "value": 16
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/fieldList"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/cel",
+        "pointer": "/$defs/recordAggregate/properties/description",
         "path_kind": "property"
       },
-      "purpose": "Provides the CEL expression used to derive a claim from declared Relay consultation outputs.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -2244,7 +2119,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2270,7 +2144,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2278,7 +2151,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2286,7 +2158,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -2295,6 +2166,10 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 2048
+        },
         {
           "keyword": "minLength",
           "value": 1
@@ -2303,27 +2178,30 @@
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/disclosure",
+        "pointer": "/$defs/recordAggregate/properties/dimensions",
         "path_kind": "property"
       },
-      "purpose": "Fixed disclosure mode or a default constrained by explicitly allowed alternatives.",
-      "purpose_source": "schema_description",
+      "purpose": "Lists the labeled entity fields available as governed aggregate dimensions.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/disclosure",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -2335,7 +2213,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2361,7 +2238,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2369,7 +2245,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2377,7 +2252,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -2385,32 +2259,34 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/disclosure"
-      }
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "array"
+        }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/output",
-        "path_kind": "property"
+        "pointer": "/$defs/recordAggregate/properties/dimensions/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Selects the exact Relay consultation output that backs this evidence claim.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Named grouping dimension backed by one entity field.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/recordAggregateDimension",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -2420,7 +2296,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2446,7 +2321,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2454,7 +2328,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2462,40 +2335,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregateDimension"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/value",
+        "pointer": "/$defs/recordAggregate/properties/disclosure_control",
         "path_kind": "property"
       },
-      "purpose": "Explicit claim value type, nullability, and encoded-size bound for a claim derived from declared Relay consultation outputs.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the minimum group size and suppression behavior applied before aggregate results are disclosed.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/claimValue",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -2507,7 +2391,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2533,7 +2416,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2541,7 +2423,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2549,7 +2430,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -2558,43 +2438,32 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/claimValue"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/recordAggregate/properties/disclosure_control/properties/min_group_size",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Sets the smallest result group that may be disclosed without suppression.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -2604,7 +2473,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2630,7 +2498,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2638,7 +2505,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2646,46 +2512,44 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/consent",
+        "pointer": "/$defs/recordAggregate/properties/disclosure_control/properties/suppression",
         "path_kind": "property"
       },
-      "purpose": "States whether evaluation of this evidence service requires consent.",
+      "purpose": "Selects whether undersized aggregate groups are omitted, masked, or represented as null.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -2697,7 +2561,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2723,7 +2586,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2731,7 +2593,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2739,7 +2600,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -2751,8 +2611,9 @@
         {
           "keyword": "enum",
           "value": [
-            "not_required",
-            "required"
+            "omit",
+            "mask",
+            "null"
           ]
         }
       ]
@@ -2760,19 +2621,19 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/consultations",
+        "pointer": "/$defs/recordAggregate/properties/group_by",
         "path_kind": "property"
       },
-      "purpose": "Relay consultations and their closed bindings to target request identifiers or caller-supplied target attributes.",
+      "purpose": "Bounded unique list of entity field identifiers.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/consultations",
+        "local_reference": "#/$defs/fieldList",
         "composed": false
       },
       "requiredness": "optional",
@@ -2787,7 +2648,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2813,7 +2673,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2821,7 +2680,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2829,7 +2687,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -2839,37 +2696,37 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
+          "keyword": "maxItems",
           "value": 16
         },
         {
-          "keyword": "minProperties",
-          "value": 1
+          "keyword": "type",
+          "value": "array"
         },
         {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "uniqueItems",
+          "value": true
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/consultations"
+        "pointer": "/$defs/fieldList"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/credential_profiles",
+        "pointer": "/$defs/recordAggregate/properties/indicators",
         "path_kind": "property"
       },
-      "purpose": "Credential profiles may select only claims backed by an exact Relay consultation.",
-      "purpose_source": "schema_description",
+      "purpose": "Lists the named aggregate indicators, functions, source columns, and measurement metadata.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
@@ -2885,7 +2742,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2911,7 +2767,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2919,7 +2774,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2927,7 +2781,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -2936,31 +2789,28 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 32
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/recordAggregate/properties/indicators/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "SDMX-style aggregate indicator with units and display metadata.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/recordAggregateIndicator",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -2975,7 +2825,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3001,7 +2850,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3009,7 +2857,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3017,49 +2864,54 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "format",
-            "type",
-            "validity",
-            "claims"
+            "id",
+            "label",
+            "function",
+            "column",
+            "unit_measure"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregateIndicator"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/claims",
+        "pointer": "/$defs/recordAggregate/properties/joins",
         "path_kind": "property"
       },
-      "purpose": "Lists the registry-backed evidence claims selected into this credential profile.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded unique list of entity field identifiers.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "array"
         ],
+        "local_reference": "#/$defs/fieldList",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -3071,7 +2923,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3097,7 +2948,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3105,7 +2955,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3113,7 +2962,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3123,8 +2971,8 @@
       ],
       "constraints": [
         {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "maxItems",
+          "value": 16
         },
         {
           "keyword": "type",
@@ -3134,29 +2982,119 @@
           "keyword": "uniqueItems",
           "value": true
         }
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/fieldList"
+      }
+    },
+    {
+      "address": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregate/properties/measures",
+        "path_kind": "property"
+      },
+      "purpose": "Lists the named aggregation functions and entity columns used to compute this aggregate.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "minItems",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/claims/items",
+        "pointer": "/$defs/recordAggregate/properties/measures/items",
         "path_kind": "array_item"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Named aggregate calculation over one entity column.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/recordAggregateMeasure",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -3166,7 +3104,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3192,7 +3129,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3200,7 +3136,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3208,7 +3143,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3219,40 +3153,44 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "name",
+            "function",
+            "column"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/recordAggregateMeasure"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/format",
+        "pointer": "/$defs/recordAggregate/properties/required_principal_filters",
         "path_kind": "property"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose": "Bounded unique list of entity field identifiers.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/fieldList",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -3262,7 +3200,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3288,7 +3225,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3296,7 +3232,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3304,7 +3239,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3314,47 +3248,44 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "maxItems",
+          "value": 16
         },
         {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "keyword": "type",
+          "value": "array"
         },
         {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "uniqueItems",
+          "value": true
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/fieldList"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/type",
+        "pointer": "/$defs/recordAggregate/properties/spatial",
         "path_kind": "property"
       },
-      "purpose": "Declares the credential type identifier emitted for this reviewed credential profile.",
+      "purpose": "Defines the reviewed administrative-area spatial aggregation and geometry materialization bindings.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/recordAggregateSpatial",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -3364,7 +3295,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3390,7 +3320,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3398,7 +3327,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3406,7 +3334,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3416,37 +3343,44 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "mode",
+            "dimension",
+            "geometry_entity",
+            "geometry_id_field",
+            "geometry_field"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregateSpatial"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/validity",
+        "pointer": "/$defs/recordAggregate/properties/temporal_field",
         "path_kind": "property"
       },
-      "purpose": "Bounds the lifetime of credentials issued from this profile using a positive duration.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -3458,7 +3392,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3484,7 +3417,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3492,7 +3424,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3500,7 +3431,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3511,33 +3441,37 @@
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[1-9][0-9]*(?:s|m|h)$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/credential_profiles/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/recordAggregate/properties/title",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Bounded human-readable project metadata.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -3549,7 +3483,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3575,7 +3508,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3583,7 +3515,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3591,19 +3522,21 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
@@ -3612,25 +3545,27 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/text"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/kind",
+        "pointer": "/$defs/recordAggregateAccess/properties/aggregate_only_execution",
         "path_kind": "property"
       },
-      "purpose": "Identifies this service declaration as a Notary evidence policy.",
+      "purpose": "Restricts this definition to aggregate execution so it cannot be used as a record-level result path.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "boolean"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -3642,7 +3577,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3668,7 +3602,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3676,7 +3609,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3684,7 +3616,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3694,30 +3625,30 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "evidence"
+          "keyword": "type",
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/legal_basis",
+        "pointer": "/$defs/recordAggregateAccess/properties/aggregate_scope",
         "path_kind": "property"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose": "Authorization scope token.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/scope",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -3729,7 +3660,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3755,7 +3685,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3763,7 +3692,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3771,7 +3699,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3782,7 +3709,7 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 256
+          "value": 128
         },
         {
           "keyword": "minLength",
@@ -3799,28 +3726,28 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/scope"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/purpose",
+        "pointer": "/$defs/recordAggregateAccess/properties/metadata_scope",
         "path_kind": "property"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose": "Authorization scope token.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/scope",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -3832,7 +3759,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3858,7 +3784,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3866,7 +3791,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3874,7 +3798,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3885,7 +3808,7 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 256
+          "value": 128
         },
         {
           "keyword": "minLength",
@@ -3902,27 +3825,30 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/scope"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/subject_type",
+        "pointer": "/$defs/recordAggregateDimension/properties/codelist",
         "path_kind": "property"
       },
-      "purpose": "Subject category evaluated by this evidence service. Omission is normalized to person.",
+      "purpose": "Bounded human-readable project metadata.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/text",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -3932,7 +3858,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3958,7 +3883,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3966,7 +3890,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3974,7 +3897,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3984,35 +3906,44 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "person",
-            "project"
-          ]
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/variables",
+        "pointer": "/$defs/recordAggregateDimension/properties/field",
         "path_kind": "property"
       },
-      "purpose": "Typed request variables exposed to evidence evaluation.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/variables",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -4022,7 +3953,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4048,7 +3978,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4056,7 +3985,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4064,7 +3992,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -4074,39 +4001,40 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/variables"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/version",
+        "pointer": "/$defs/recordAggregateDimension/properties/id",
         "path_kind": "property"
       },
-      "purpose": "Assigns the positive authored version used to track this evidence-service policy contract.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -4116,7 +4044,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4142,7 +4069,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4150,7 +4076,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4158,7 +4083,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -4168,30 +4092,125 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4294967295
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
-          "keyword": "minimum",
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
+    },
+    {
+      "address": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregateDimension/properties/label",
+        "path_kind": "property"
+      },
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/text",
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/fieldList/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/recordAggregateIndicator/properties/column",
+        "path_kind": "property"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -4199,7 +4218,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -4211,7 +4230,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4237,7 +4255,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4245,7 +4262,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4253,14 +4269,12 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -4280,19 +4294,21 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/filterOperators/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/recordAggregateIndicator/properties/decimals",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Sets the non-negative decimal precision published for this aggregate indicator.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -4304,7 +4320,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4330,7 +4345,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4338,7 +4352,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4346,56 +4359,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/anyOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/recordAggregateIndicator/properties/definition_uri",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4421,7 +4436,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4429,7 +4443,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4437,132 +4450,53 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "measures"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "project",
-        "pointer": "/$defs/recordAggregate/anyOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.project.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
+          "keyword": "maxLength",
+          "value": 2048
+        },
         {
-          "keyword": "required",
-          "value": [
-            "indicators"
-          ]
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/access",
+        "pointer": "/$defs/recordAggregateIndicator/properties/frequency",
         "path_kind": "property"
       },
-      "purpose": "Defines optional metadata and aggregate scopes and whether execution is restricted to aggregate-only access.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/recordAggregateAccess",
+        "local_reference": "#/$defs/text",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -4572,7 +4506,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4598,7 +4531,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4606,7 +4538,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4614,7 +4545,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -4623,34 +4553,41 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateAccess"
+        "pointer": "/$defs/text"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/allowed_filters",
+        "pointer": "/$defs/recordAggregateIndicator/properties/function",
         "path_kind": "property"
       },
-      "purpose": "Maps aggregate filter fields to the comparison operators permitted for each field.",
+      "purpose": "Selects the aggregation function used to compute this named indicator.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
+        "local_reference": "#/$defs/recordAggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -4662,7 +4599,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4688,7 +4624,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4696,7 +4631,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4704,7 +4638,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -4714,32 +4647,45 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregateFunction"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/allowed_filters/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/recordAggregateIndicator/properties/id",
+        "path_kind": "property"
       },
-      "purpose": "Allowed operators for one queryable field.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
-        "local_reference": "#/$defs/filterOperators",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -4749,7 +4695,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4775,7 +4720,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4783,7 +4727,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4791,55 +4734,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/filterOperators"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/default_group_by",
+        "pointer": "/$defs/recordAggregateIndicator/properties/label",
         "path_kind": "property"
       },
-      "purpose": "Bounded unique list of entity field identifiers.",
+      "purpose": "Bounded human-readable project metadata.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
-        "local_reference": "#/$defs/fieldList",
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -4849,7 +4786,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4875,7 +4811,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4883,7 +4818,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4891,7 +4825,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -4901,34 +4834,34 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "maxLength",
+          "value": 2048
         },
         {
-          "keyword": "type",
-          "value": "array"
+          "keyword": "minLength",
+          "value": 1
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/fieldList"
+        "pointer": "/$defs/text"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/description",
+        "pointer": "/$defs/recordAggregateIndicator/properties/unit_measure",
         "path_kind": "property"
       },
       "purpose": "Bounded human-readable project metadata.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -4948,7 +4881,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4974,7 +4906,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4982,7 +4913,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4990,7 +4920,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5020,17 +4949,17 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/dimensions",
+        "pointer": "/$defs/recordAggregateIndicator/properties/unit_mult",
         "path_kind": "property"
       },
-      "purpose": "Lists the labeled entity fields available as governed aggregate dimensions.",
+      "purpose": "Declares the base-ten unit multiplier published with this aggregate indicator.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -5046,7 +4975,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5072,7 +5000,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5080,7 +5007,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5088,7 +5014,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5097,33 +5022,41 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 2147483647
+        },
+        {
+          "keyword": "minimum",
+          "value": -2147483648
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/dimensions/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/recordAggregateMeasure/properties/column",
+        "path_kind": "property"
       },
-      "purpose": "Named grouping dimension backed by one entity field.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/recordAggregateDimension",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -5133,7 +5066,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5159,7 +5091,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5167,7 +5098,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5175,49 +5105,42 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "field"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateDimension"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/disclosure_control",
+        "pointer": "/$defs/recordAggregateMeasure/properties/function",
         "path_kind": "property"
       },
-      "purpose": "Defines the minimum group size and suppression behavior applied before aggregate results are disclosed.",
+      "purpose": "Selects the aggregation function applied to the optional source column for this measure.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
+        "local_reference": "#/$defs/recordAggregateFunction",
         "composed": false
       },
       "requiredness": "required",
@@ -5232,7 +5155,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5258,7 +5180,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5266,7 +5187,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5274,7 +5194,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5284,31 +5203,45 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregateFunction"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/disclosure_control/properties/min_group_size",
+        "pointer": "/$defs/recordAggregateMeasure/properties/name",
         "path_kind": "property"
       },
-      "purpose": "Sets the smallest result group that may be disclosed without suppression.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -5318,7 +5251,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5344,7 +5276,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5352,7 +5283,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5360,7 +5290,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5370,32 +5299,35 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/disclosure_control/properties/suppression",
+        "pointer": "/$defs/recordAggregateSpatial/properties/bbox_fields",
         "path_kind": "property"
       },
-      "purpose": "Selects whether undersized aggregate groups are omitted, masked, or represented as null.",
+      "purpose": "Maps the geometry entity fields that provide the minimum and maximum coordinates of its bounding box.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/recordSpatialBbox",
         "composed": false
       },
       "requiredness": "optional",
@@ -5410,7 +5342,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5436,7 +5367,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5444,7 +5374,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5452,7 +5381,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5462,36 +5390,45 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "omit",
-            "mask",
-            "null"
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordSpatialBbox"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/group_by",
+        "pointer": "/$defs/recordAggregateSpatial/properties/collection_id",
         "path_kind": "property"
       },
-      "purpose": "Bounded unique list of entity field identifiers.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
-        "local_reference": "#/$defs/fieldList",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -5501,7 +5438,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5527,7 +5463,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5535,7 +5470,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5543,7 +5477,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5553,43 +5486,40 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/fieldList"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/indicators",
+        "pointer": "/$defs/recordAggregateSpatial/properties/dimension",
         "path_kind": "property"
       },
-      "purpose": "Lists the named aggregate indicators, functions, source columns, and measurement metadata.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -5599,7 +5529,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5625,7 +5554,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5633,7 +5561,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5641,7 +5568,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5650,33 +5576,41 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/indicators/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/recordAggregateSpatial/properties/geometry_entity",
+        "path_kind": "property"
       },
-      "purpose": "SDMX-style aggregate indicator with units and display metadata.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/recordAggregateIndicator",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -5686,7 +5620,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5712,7 +5645,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5720,7 +5652,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5728,57 +5659,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "function",
-            "column",
-            "unit_measure"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/joins",
+        "pointer": "/$defs/recordAggregateSpatial/properties/geometry_field",
         "path_kind": "property"
       },
-      "purpose": "Bounded unique list of entity field identifiers.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
-        "local_reference": "#/$defs/fieldList",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -5788,7 +5711,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5814,7 +5736,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5822,7 +5743,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5830,7 +5750,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5840,37 +5759,124 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
+    },
+    {
+      "address": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregateSpatial/properties/geometry_id_field",
+        "path_kind": "property"
+      },
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/fieldList"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/measures",
+        "pointer": "/$defs/recordAggregateSpatial/properties/max_geometry_vertices",
         "path_kind": "property"
       },
-      "purpose": "Lists the named aggregation functions and entity columns used to compute this aggregate.",
+      "purpose": "Caps the number of vertices accepted when materializing one administrative-area geometry.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -5886,7 +5892,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5912,7 +5917,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5920,7 +5924,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5928,7 +5931,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5938,34 +5940,35 @@
       ],
       "constraints": [
         {
-          "keyword": "minItems",
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/measures/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/recordAggregateSpatial/properties/mode",
+        "path_kind": "property"
       },
-      "purpose": "Named aggregate calculation over one entity column.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects the supported administrative-area aggregation mode for this spatial definition.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/recordAggregateMeasure",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -5977,7 +5980,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6003,7 +6005,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6011,7 +6012,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6019,55 +6019,40 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "name",
-            "function",
-            "column"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "admin_area"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordAggregateMeasure"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/required_principal_filters",
+        "pointer": "/$defs/recordAttributeReleaseExpression/properties/cel",
         "path_kind": "property"
       },
-      "purpose": "Bounded unique list of entity field identifiers.",
-      "purpose_source": "schema_description",
+      "purpose": "Provides the bounded CEL expression evaluated only against the projected source object.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
-        "local_reference": "#/$defs/fieldList",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -6077,7 +6062,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6103,7 +6087,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6111,7 +6094,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6119,7 +6101,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -6129,42 +6110,37 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "maxLength",
+          "value": 4096
         },
         {
-          "keyword": "type",
-          "value": "array"
+          "keyword": "minLength",
+          "value": 1
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/fieldList"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/spatial",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims",
         "path_kind": "property"
       },
-      "purpose": "Defines the reviewed administrative-area spatial aggregation and geometry materialization bindings.",
+      "purpose": "Maps released claim names to their reviewed source or expression, requiredness, and sensitivity.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordAggregateSpatial",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -6176,7 +6152,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6202,7 +6177,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6210,7 +6184,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6218,7 +6191,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -6228,46 +6200,39 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "mode",
-            "dimension",
-            "geometry_entity",
-            "geometry_id_field",
-            "geometry_field"
-          ]
+          "keyword": "maxProperties",
+          "value": 32
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/temporal_field",
-        "path_kind": "property"
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -6277,7 +6242,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6303,7 +6267,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6311,7 +6274,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6319,60 +6281,55 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "required",
+            "sensitivity"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/title",
-        "path_kind": "property"
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/text",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6398,7 +6355,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6406,7 +6362,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6414,48 +6369,122 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "required",
+          "value": [
+            "source_field"
+          ]
         }
-      ],
-      "local_reference": {
+      ]
+    },
+    {
+      "address": {
         "schema": "project",
-        "pointer": "/$defs/text"
-      }
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/oneOf/1",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "expression"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateAccess/properties/aggregate_only_execution",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/expression",
         "path_kind": "property"
       },
-      "purpose": "Restricts this definition to aggregate execution so it cannot be used as a record-level result path.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded CEL evaluated only against the projected source object.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
+        "local_reference": "#/$defs/recordAttributeReleaseExpression",
         "composed": false
       },
       "requiredness": "optional",
@@ -6470,7 +6499,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6496,7 +6524,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6504,7 +6531,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6512,7 +6538,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -6521,33 +6546,42 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "cel"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordAttributeReleaseExpression"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateAccess/properties/aggregate_scope",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/required",
         "path_kind": "property"
       },
-      "purpose": "Authorization scope token.",
-      "purpose_source": "schema_description",
+      "purpose": "States whether failure to produce this released claim makes the attribute-release result invalid.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
-        "local_reference": "#/$defs/scope",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -6557,7 +6591,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6583,7 +6616,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6591,7 +6623,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6599,7 +6630,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -6608,44 +6638,113 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
+      ]
+    },
+    {
+      "address": {
         "schema": "project",
-        "pointer": "/$defs/scope"
-      }
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/sensitivity",
+        "path_kind": "property"
+      },
+      "purpose": "Classifies the released claim as a direct identifier, personal, public, or pseudonymous value.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "direct_identifier",
+            "personal",
+            "public",
+            "pseudonymous"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateAccess/properties/metadata_scope",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/source_field",
         "path_kind": "property"
       },
-      "purpose": "Authorization scope token.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/scope",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "optional",
@@ -6660,7 +6759,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6686,7 +6784,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6694,7 +6791,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6702,7 +6798,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -6711,17 +6806,9 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
@@ -6730,28 +6817,27 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/scope"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateDimension/properties/codelist",
-        "path_kind": "property"
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -6763,7 +6849,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6789,7 +6874,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6797,7 +6881,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6805,52 +6888,44 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateDimension/properties/field",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/description",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Bounded human-readable project metadata.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -6862,7 +6937,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6888,7 +6962,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6896,7 +6969,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6904,7 +6976,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -6914,8 +6985,12 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
@@ -6924,25 +6999,25 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/text"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateDimension/properties/id",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/purpose",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Binds the release to one permitted records purpose and requires a bounded visible-ASCII header token.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/token",
         "composed": false
       },
       "requiredness": "required",
@@ -6957,7 +7032,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6983,7 +7057,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6991,7 +7064,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6999,7 +7071,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7008,9 +7079,17 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
         },
         {
           "keyword": "type",
@@ -7019,30 +7098,29 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/token"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateDimension/properties/label",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_conditions",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
+      "purpose": "Contains the bounded expression that must authorize this purpose-bound attribute release.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/text",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -7052,7 +7130,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7078,7 +7155,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7086,7 +7162,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7094,7 +7169,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7104,44 +7178,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "expression"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/column",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_conditions/properties/expression",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Bounded CEL evaluated only against the projected source object.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/recordAttributeReleaseExpression",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -7151,7 +7219,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7177,7 +7244,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7185,7 +7251,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7193,7 +7258,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7203,39 +7267,42 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "cel"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/recordAttributeReleaseExpression"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/decimals",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_scope",
         "path_kind": "property"
       },
-      "purpose": "Sets the non-negative decimal precision published for this aggregate indicator.",
+      "purpose": "Requires the exact entity-bound <entity_id>:identity_release scope and keeps release access distinct from records API scopes.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/scope",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -7245,7 +7312,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7271,7 +7337,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7279,7 +7344,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7287,7 +7351,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7297,40 +7360,47 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4294967295
+          "keyword": "maxLength",
+          "value": 128
         },
         {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/scope"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/definition_uri",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the projected source field and identifier type used for exact-one subject resolution.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -7340,7 +7410,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7366,7 +7435,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7374,7 +7442,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7382,7 +7449,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7392,42 +7458,36 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "source_field",
+            "id_type"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/frequency",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject/properties/id_type",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
+      "purpose": "Labels the identifier type represented by the resolved subject identifier.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -7439,7 +7499,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7465,7 +7524,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7473,7 +7531,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7481,7 +7538,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7492,41 +7548,43 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 2048
+          "value": 64
         },
         {
           "keyword": "minLength",
           "value": 1
         },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/function",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject/properties/source_field",
         "path_kind": "property"
       },
-      "purpose": "Selects the aggregation function used to compute this named indicator.",
+      "purpose": "Selects the projected entity field whose value is matched for exact-one subject resolution.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/recordAggregateFunction",
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -7536,7 +7594,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7562,7 +7619,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7570,7 +7626,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7578,7 +7633,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7588,43 +7642,38 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateFunction"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/id",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/title",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Bounded human-readable project metadata.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -7636,7 +7685,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7662,7 +7710,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7670,7 +7717,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7678,7 +7724,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7688,8 +7733,12 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
@@ -7698,25 +7747,24 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/text"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/label",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/version",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
+      "purpose": "Assigns a portable path-segment version matching [A-Za-z0-9][A-Za-z0-9._-]{0,63} to identify one attribute-release profile contract.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/text",
         "composed": false
       },
       "requiredness": "required",
@@ -7731,7 +7779,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7757,7 +7804,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7765,7 +7811,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7773,7 +7818,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7784,43 +7828,43 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 2048
+          "value": 64
         },
         {
           "keyword": "minLength",
           "value": 1
         },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/unit_measure",
-        "path_kind": "property"
+        "pointer": "/$defs/recordAttributeReleaseProfiles/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Bounded human-readable project metadata.",
+      "purpose": "One purpose-bound, minimized identity release compiled into the owning Relay entity.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/text",
+        "local_reference": "#/$defs/recordAttributeReleaseProfile",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -7830,7 +7874,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7856,7 +7899,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7864,7 +7906,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7872,53 +7913,56 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "version",
+            "purpose",
+            "release_scope",
+            "subject",
+            "release_conditions",
+            "claims"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/text"
+        "pointer": "/$defs/recordAttributeReleaseProfile"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/unit_mult",
-        "path_kind": "property"
+        "pointer": "/$defs/recordAttributeReleaseProfiles/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Declares the base-ten unit multiplier published with this aggregate indicator.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -7928,7 +7972,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7954,7 +7997,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7962,7 +8004,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7970,40 +8011,36 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 2147483647
-        },
-        {
-          "keyword": "minimum",
-          "value": -2147483648
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateMeasure/properties/column",
-        "path_kind": "property"
+        "pointer": "/$defs/recordFieldMap/additionalProperties",
+        "path_kind": "map_value"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -8011,7 +8048,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -8023,7 +8060,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8049,7 +8085,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8057,7 +8092,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8065,13 +8099,13 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -8091,22 +8125,24 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateMeasure/properties/function",
-        "path_kind": "property"
+        "pointer": "/$defs/recordFieldMap/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Selects the aggregation function applied to the optional source column for this measure.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/recordAggregateFunction",
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -8116,7 +8152,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8142,7 +8177,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8150,7 +8184,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8158,55 +8191,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateFunction"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateMeasure/properties/name",
+        "pointer": "/$defs/recordSpatial/properties/bbox_fields",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Maps optional entity fields containing precomputed minimum and maximum bounding-box coordinates.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/recordSpatialBbox",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -8216,7 +8244,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8242,7 +8269,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8250,7 +8276,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8258,102 +8283,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
-    },
-    {
-      "address": {
-        "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial/properties/bbox_fields",
-        "path_kind": "property"
-      },
-      "purpose": "Maps the geometry entity fields that provide the minimum and maximum coordinates of its bounding box.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/recordSpatialBbox",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.project.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -8384,14 +8313,14 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial/properties/collection_id",
+        "pointer": "/$defs/recordSpatial/properties/collection_id",
         "path_kind": "property"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -8411,7 +8340,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8437,7 +8365,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8445,7 +8372,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8453,7 +8379,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -8479,14 +8404,14 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial/properties/dimension",
+        "pointer": "/$defs/recordSpatial/properties/datetime_field",
         "path_kind": "property"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -8494,7 +8419,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -8506,7 +8431,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8532,7 +8456,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8540,7 +8463,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8548,7 +8470,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -8574,22 +8495,22 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial/properties/geometry_entity",
+        "pointer": "/$defs/recordSpatial/properties/description",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Bounded human-readable project metadata.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -8601,7 +8522,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8627,7 +8547,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8635,7 +8554,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8643,7 +8561,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -8653,8 +8570,12 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
@@ -8663,30 +8584,30 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/text"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial/properties/geometry_field",
+        "pointer": "/$defs/recordSpatial/properties/geometry",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines whether feature geometry comes from point-coordinate fields or one encoded geometry field.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/recordSpatialGeometry",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -8696,7 +8617,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8722,7 +8642,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8730,7 +8649,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8738,7 +8656,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -8746,42 +8663,32 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
+      "constraints": [],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/recordSpatialGeometry"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial/properties/geometry_id_field",
+        "pointer": "/$defs/recordSpatial/properties/max_bbox_degrees",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Caps the geographic span accepted for one bounding-box query.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "number"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -8791,7 +8698,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8817,7 +8723,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8825,7 +8730,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8833,7 +8737,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -8843,30 +8746,26 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "exclusiveMinimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "number"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial/properties/max_geometry_vertices",
+        "pointer": "/$defs/recordSpatial/properties/max_geometry_vertices",
         "path_kind": "property"
       },
-      "purpose": "Caps the number of vertices accepted when materializing one administrative-area geometry.",
+      "purpose": "Caps the number of vertices accepted when returning one feature geometry.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "integer"
@@ -8885,7 +8784,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8911,7 +8809,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8919,7 +8816,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8927,7 +8823,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -8953,21 +8848,24 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial/properties/mode",
+        "pointer": "/$defs/recordSpatial/properties/title",
         "path_kind": "property"
       },
-      "purpose": "Selects the supported administrative-area aggregation mode for this spatial definition.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -8977,7 +8875,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9003,7 +8900,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9011,7 +8907,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9019,7 +8914,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -9029,26 +8923,39 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "admin_area"
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseExpression/properties/cel",
+        "pointer": "/$defs/recordSpatialBbox/properties/max_x",
         "path_kind": "property"
       },
-      "purpose": "Provides the bounded CEL expression evaluated only against the projected source object.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
@@ -9063,7 +8970,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9089,7 +8995,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9097,7 +9002,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9105,7 +9009,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -9115,39 +9018,40 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims",
+        "pointer": "/$defs/recordSpatialBbox/properties/max_y",
         "path_kind": "property"
       },
-      "purpose": "Maps released claim names to their reviewed source or expression, requiredness, and sensitivity.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -9157,7 +9061,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9183,7 +9086,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9191,7 +9093,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9199,7 +9100,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -9209,39 +9109,40 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 32
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/recordSpatialBbox/properties/min_x",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "composed": true
+        "local_reference": "#/$defs/stableId",
+        "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -9251,7 +9152,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9277,7 +9177,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9285,7 +9184,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9293,57 +9191,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "required",
-            "sensitivity"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/recordSpatialBbox/properties/min_y",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9369,7 +9268,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9377,7 +9275,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9385,37 +9282,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "source_field"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/oneOf/1",
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
       "requiredness": "conditional",
@@ -9430,7 +9333,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9456,7 +9358,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9464,7 +9365,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9472,7 +9372,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -9485,32 +9384,39 @@
         {
           "keyword": "required",
           "value": [
-            "expression"
+            "kind",
+            "longitude_field",
+            "latitude_field",
+            "crs"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/expression",
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/crs",
         "path_kind": "property"
       },
-      "purpose": "Bounded CEL evaluated only against the projected source object.",
+      "purpose": "Non-empty token without commas, whitespace, or control characters.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/recordAttributeReleaseExpression",
+        "local_reference": "#/$defs/token",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -9520,7 +9426,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9546,7 +9451,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9554,7 +9458,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9562,7 +9465,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -9572,36 +9474,40 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "cel"
-          ]
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseExpression"
+        "pointer": "/$defs/token"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/required",
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/kind",
         "path_kind": "property"
       },
-      "purpose": "States whether failure to produce this released claim makes the attribute-release result invalid.",
+      "purpose": "Selects geometry assembled from separate longitude and latitude entity fields.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
@@ -9616,7 +9522,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9642,7 +9547,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9650,7 +9554,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9658,7 +9561,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -9668,29 +9570,32 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "boolean"
+          "keyword": "const",
+          "value": "point"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/sensitivity",
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/latitude_field",
         "path_kind": "property"
       },
-      "purpose": "Classifies the released claim as a direct identifier, personal, public, or pseudonymous value.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -9700,7 +9605,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9726,7 +9630,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9734,7 +9637,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9742,7 +9644,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -9752,27 +9653,30 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "direct_identifier",
-            "personal",
-            "public",
-            "pseudonymous"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/source_field",
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/longitude_field",
         "path_kind": "property"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -9780,7 +9684,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -9792,7 +9696,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9818,7 +9721,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9826,7 +9728,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9834,7 +9735,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -9860,33 +9760,32 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9912,7 +9811,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9920,7 +9818,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9928,45 +9825,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
+          "keyword": "required",
+          "value": [
+            "kind",
+            "field",
+            "crs"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/description",
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/crs",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
+      "purpose": "Non-empty token without commas, whitespace, or control characters.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/text",
+        "local_reference": "#/$defs/token",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -9978,7 +9878,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10004,7 +9903,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10012,7 +9910,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10020,7 +9917,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10031,12 +9927,16 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 2048
+          "value": 256
         },
         {
           "keyword": "minLength",
           "value": 1
         },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -10044,25 +9944,25 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/text"
+        "pointer": "/$defs/token"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/purpose",
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/field",
         "path_kind": "property"
       },
-      "purpose": "Binds the release to one permitted records purpose and requires a bounded visible-ASCII header token.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
@@ -10077,7 +9977,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10103,7 +10002,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10111,7 +10009,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10119,7 +10016,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10128,17 +10024,9 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
@@ -10147,24 +10035,22 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_conditions",
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/kind",
         "path_kind": "property"
       },
-      "purpose": "Contains the bounded expression that must authorize this purpose-bound attribute release.",
+      "purpose": "Selects the GeoJSON, WKT, or WKB encoding used by the configured geometry field.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
@@ -10179,7 +10065,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10205,7 +10090,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10213,7 +10097,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10221,7 +10104,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10231,33 +10113,31 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "expression"
+            "geojson",
+            "wkt",
+            "wkb"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_conditions/properties/expression",
+        "pointer": "/$defs/recordSpdci/properties/expression_fields",
         "path_kind": "property"
       },
-      "purpose": "Bounded CEL evaluated only against the projected source object.",
-      "purpose_source": "schema_description",
+      "purpose": "Maps SP-DCI expression input names to the entity fields available during expression evaluation.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordAttributeReleaseExpression",
+        "local_reference": "#/$defs/recordFieldMap",
         "composed": false
       },
       "requiredness": "required",
@@ -10272,7 +10152,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10298,7 +10177,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10306,7 +10184,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10314,7 +10191,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10324,10 +10200,8 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "cel"
-          ]
+          "keyword": "maxProperties",
+          "value": 64
         },
         {
           "keyword": "type",
@@ -10336,30 +10210,30 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseExpression"
+        "pointer": "/$defs/recordFieldMap"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_scope",
+        "pointer": "/$defs/recordSpdci/properties/identifiers",
         "path_kind": "property"
       },
-      "purpose": "Requires the exact entity-bound <entity_id>:identity_release scope and keeps release access distinct from records API scopes.",
+      "purpose": "Maps SP-DCI identifier names to the entity fields used to identify a record.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/scope",
+        "local_reference": "#/$defs/recordFieldMap",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -10369,7 +10243,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10395,7 +10268,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10403,7 +10275,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10411,7 +10282,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10421,135 +10291,35 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "keyword": "maxProperties",
+          "value": 64
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/scope"
+        "pointer": "/$defs/recordFieldMap"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject",
-        "path_kind": "property"
-      },
-      "purpose": "Defines the projected source field and identifier type used for exact-one subject resolution.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.project.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "source_field",
-            "id_type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject/properties/id_type",
+        "pointer": "/$defs/recordSpdci/properties/record_type",
         "path_kind": "property"
       },
-      "purpose": "Labels the identifier type represented by the resolved subject identifier.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/token",
         "composed": false
       },
       "requiredness": "required",
@@ -10564,7 +10334,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10590,7 +10359,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10598,7 +10366,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10606,7 +10373,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10617,7 +10383,7 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 64
+          "value": 256
         },
         {
           "keyword": "minLength",
@@ -10631,19 +10397,23 @@
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/token"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject/properties/source_field",
+        "pointer": "/$defs/recordSpdci/properties/registry",
         "path_kind": "property"
       },
-      "purpose": "Selects the projected entity field whose value is matched for exact-one subject resolution.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -10663,7 +10433,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10689,7 +10458,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10697,7 +10465,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10705,7 +10472,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10731,22 +10497,22 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/title",
+        "pointer": "/$defs/recordSpdci/properties/registry_type",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
+      "purpose": "Non-empty token without commas, whitespace, or control characters.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/text",
+        "local_reference": "#/$defs/token",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -10758,7 +10524,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10784,7 +10549,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10792,7 +10556,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10800,7 +10563,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10811,12 +10573,16 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 2048
+          "value": 256
         },
         {
           "keyword": "minLength",
           "value": 1
         },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -10824,29 +10590,30 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/text"
+        "pointer": "/$defs/token"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/version",
+        "pointer": "/$defs/recordSpdci/properties/response_fields",
         "path_kind": "property"
       },
-      "purpose": "Assigns a portable path-segment version matching [A-Za-z0-9][A-Za-z0-9._-]{0,63} to identify one attribute-release profile contract.",
+      "purpose": "Maps SP-DCI response names to the entity fields returned for an authorized record.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/recordFieldMap",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -10856,7 +10623,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10882,7 +10648,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10890,7 +10655,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10898,7 +10662,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10908,42 +10671,37 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
+          "keyword": "maxProperties",
           "value": 64
         },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordFieldMap"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfiles/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/recordsApi/properties/aggregates",
+        "path_kind": "property"
       },
-      "purpose": "One purpose-bound, minimized identity release compiled into the owning Relay entity.",
-      "purpose_source": "schema_description",
+      "purpose": "Maps aggregate identifiers to governed aggregate definitions exposed by the records API.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordAttributeReleaseProfile",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -10955,7 +10713,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10981,7 +10738,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10989,7 +10745,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10997,57 +10752,45 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "version",
-            "purpose",
-            "release_scope",
-            "subject",
-            "release_conditions",
-            "claims"
-          ]
+          "keyword": "maxProperties",
+          "value": 64
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfiles/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/recordsApi/properties/aggregates/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Governed aggregate definition with disclosure controls.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/recordAggregate",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -11057,7 +10800,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11083,7 +10825,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11091,7 +10832,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11099,7 +10839,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -11110,26 +10849,33 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "description",
+            "disclosure_control"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregate"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordFieldMap/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/recordsApi/properties/aggregates/propertyNames",
+        "path_kind": "map_key"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -11149,7 +10895,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11175,7 +10920,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11183,7 +10927,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11191,7 +10934,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -11218,24 +10960,24 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordFieldMap/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/recordsApi/properties/attribute_release_profiles",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Purpose-bound, exact-one identity releases keyed by stable profile id. Generated Relay responses omit source metadata and are never cacheable.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/recordAttributeReleaseProfiles",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -11245,7 +10987,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11271,7 +11012,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11279,7 +11019,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11287,46 +11026,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxProperties",
+          "value": 16
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/recordAttributeReleaseProfiles"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatial/properties/bbox_fields",
+        "pointer": "/$defs/recordsApi/properties/filters",
         "path_kind": "property"
       },
-      "purpose": "Maps optional entity fields containing precomputed minimum and maximum bounding-box coordinates.",
+      "purpose": "Maps filterable entity fields to the comparison operators the records API permits for each field.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordSpatialBbox",
         "composed": false
       },
       "requiredness": "optional",
@@ -11341,7 +11077,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11367,7 +11102,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11375,7 +11109,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11383,7 +11116,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -11393,45 +11125,36 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
+          "keyword": "maxProperties",
+          "value": 256
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordSpatialBbox"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatial/properties/collection_id",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/filters/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Allowed operators for one queryable field.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/filterOperators",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -11441,7 +11164,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11467,7 +11189,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11475,7 +11196,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11483,40 +11203,44 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "minItems",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/filterOperators"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatial/properties/datetime_field",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/filters/propertyNames",
+        "path_kind": "map_key"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -11524,7 +11248,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -11536,7 +11260,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11562,7 +11285,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11570,7 +11292,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11578,13 +11299,13 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -11604,24 +11325,23 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatial/properties/description",
+        "pointer": "/$defs/recordsApi/properties/pagination",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the default and maximum row limits enforced by records API pagination.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -11631,7 +11351,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11657,7 +11376,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11665,7 +11383,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11673,7 +11390,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -11683,39 +11399,33 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "default_limit",
+            "max_limit"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatial/properties/geometry",
+        "pointer": "/$defs/recordsApi/properties/pagination/properties/default_limit",
         "path_kind": "property"
       },
-      "purpose": "Defines whether feature geometry comes from point-coordinate fields or one encoded geometry field.",
+      "purpose": "Sets the row limit applied when a records request does not supply its own limit.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/recordSpatialGeometry",
         "composed": false
       },
       "requiredness": "required",
@@ -11730,7 +11440,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11756,7 +11465,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11764,7 +11472,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11772,7 +11479,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -11780,30 +11486,39 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry"
-      }
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 10000
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatial/properties/max_bbox_degrees",
+        "pointer": "/$defs/recordsApi/properties/pagination/properties/max_limit",
         "path_kind": "property"
       },
-      "purpose": "Caps the geographic span accepted for one bounding-box query.",
+      "purpose": "Caps the row limit that any records request may select; it must be at least 2 when attribute-release profiles are configured so ambiguous subjects can be detected.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "number"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -11815,7 +11530,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11841,7 +11555,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11849,7 +11562,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11857,7 +11569,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -11867,33 +11578,37 @@
       ],
       "constraints": [
         {
-          "keyword": "exclusiveMinimum",
-          "value": 0
+          "keyword": "maximum",
+          "value": 10000
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "number"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatial/properties/max_geometry_vertices",
+        "pointer": "/$defs/recordsApi/properties/projection",
         "path_kind": "property"
       },
-      "purpose": "Caps the number of vertices accepted when returning one feature geometry.",
+      "purpose": "Lists the entity fields that the records API is permitted to project into row responses.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -11905,7 +11620,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11931,7 +11645,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11939,7 +11652,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11947,7 +11659,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -11957,38 +11668,42 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4294967295
+          "keyword": "maxItems",
+          "value": 256
         },
         {
-          "keyword": "minimum",
+          "keyword": "minItems",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatial/properties/title",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/projection/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Bounded human-readable project metadata.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/text",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -12000,7 +11715,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12026,7 +11740,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12034,7 +11747,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12042,22 +11754,18 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
@@ -12066,30 +11774,29 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/text"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialBbox/properties/max_x",
+        "pointer": "/$defs/recordsApi/properties/purposes",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Lists the bounded purpose identifiers accepted by this records API policy.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -12099,7 +11806,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12125,7 +11831,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12133,7 +11838,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12141,7 +11845,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -12151,38 +11854,38 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxItems",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialBbox/properties/max_y",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/purposes/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Non-empty token without commas, whitespace, or control characters.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/token",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -12194,7 +11897,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12220,7 +11922,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12228,7 +11929,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12236,18 +11936,26 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
         },
         {
           "keyword": "type",
@@ -12256,30 +11964,29 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/token"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialBbox/properties/min_x",
+        "pointer": "/$defs/recordsApi/properties/relationships",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares the bounded named relationships that records queries may follow between authored entities.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -12289,7 +11996,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12315,7 +12021,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12323,7 +12028,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12331,7 +12035,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -12341,40 +12044,35 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxProperties",
+          "value": 64
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialBbox/properties/min_y",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -12384,7 +12082,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12410,7 +12107,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12418,7 +12114,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12426,59 +12121,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "kind",
+            "target",
+            "foreign_key"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/concept_uri",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12504,7 +12199,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12512,7 +12206,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12520,47 +12213,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "kind",
-            "longitude_field",
-            "latitude_field",
-            "crs"
-          ]
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/crs",
+        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/foreign_key",
         "path_kind": "property"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
@@ -12575,7 +12269,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12601,7 +12294,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12609,7 +12301,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12617,7 +12308,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -12626,17 +12316,9 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
@@ -12645,20 +12327,20 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/kind",
+        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/kind",
         "path_kind": "property"
       },
-      "purpose": "Selects geometry assembled from separate longitude and latitude entity fields.",
+      "purpose": "Selects whether one declared records relationship belongs to, has many, or has one target record.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [],
         "composed": false
@@ -12675,7 +12357,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12701,7 +12382,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12709,7 +12389,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12717,7 +12396,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -12727,22 +12405,26 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "point"
+          "keyword": "enum",
+          "value": [
+            "belongs_to",
+            "has_many",
+            "has_one"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/latitude_field",
+        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/target",
         "path_kind": "property"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -12762,7 +12444,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12788,7 +12469,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12796,7 +12476,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12804,7 +12483,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -12830,14 +12508,14 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/longitude_field",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/relationships/propertyNames",
+        "path_kind": "map_key"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -12845,7 +12523,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -12857,7 +12535,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12883,7 +12560,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12891,7 +12567,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12899,13 +12574,13 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -12925,33 +12600,127 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/recordsApi/properties/required_principal_filters",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Lists principal-bound fields required for records queries; it must be empty when attribute-release profiles are configured because subject lookup cannot supply principal filters.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "local_reference": "#/$defs/fieldList",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxItems",
+          "value": 16
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
+        }
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/fieldList"
+      }
+    },
+    {
+      "address": {
+        "schema": "project",
+        "pointer": "/$defs/recordsApi/properties/scopes",
+        "path_kind": "property"
+      },
+      "purpose": "Groups the authorization scopes required for records metadata, row access, aggregates, and evidence verification.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12977,7 +12746,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12985,7 +12753,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12993,22 +12760,19 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "kind",
-            "field",
-            "crs"
+            "metadata",
+            "rows"
           ]
         },
         {
@@ -13020,22 +12784,22 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/crs",
+        "pointer": "/$defs/recordsApi/properties/scopes/properties/aggregate",
         "path_kind": "property"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose": "Authorization scope token.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/scope",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -13047,7 +12811,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13073,7 +12836,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13081,7 +12843,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13089,7 +12850,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -13100,7 +12860,7 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 256
+          "value": 128
         },
         {
           "keyword": "minLength",
@@ -13117,28 +12877,28 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/scope"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/field",
+        "pointer": "/$defs/recordsApi/properties/scopes/properties/evidence_verification",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Authorization scope token.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/scope",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -13150,7 +12910,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13176,7 +12935,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13184,7 +12942,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13192,7 +12949,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -13201,9 +12957,17 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
         },
         {
           "keyword": "type",
@@ -13212,27 +12976,30 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/scope"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/kind",
+        "pointer": "/$defs/recordsApi/properties/scopes/properties/metadata",
         "path_kind": "property"
       },
-      "purpose": "Selects the GeoJSON, WKT, or WKB encoding used by the configured geometry field.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Authorization scope token.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/scope",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -13242,7 +13009,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13268,7 +13034,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13276,7 +13041,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13284,7 +13048,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -13294,36 +13057,48 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "geojson",
-            "wkt",
-            "wkb"
-          ]
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/scope"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpdci/properties/expression_fields",
+        "pointer": "/$defs/recordsApi/properties/scopes/properties/rows",
         "path_kind": "property"
       },
-      "purpose": "Maps SP-DCI expression input names to the entity fields available during expression evaluation.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Authorization scope token.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/recordFieldMap",
+        "local_reference": "#/$defs/scope",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -13333,7 +13108,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13359,7 +13133,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13367,7 +13140,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13375,7 +13147,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -13385,35 +13156,42 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 64
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordFieldMap"
+        "pointer": "/$defs/scope"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpdci/properties/identifiers",
+        "pointer": "/$defs/recordsApi/properties/standards",
         "path_kind": "property"
       },
-      "purpose": "Maps SP-DCI identifier names to the entity fields used to identify a record.",
+      "purpose": "Declares whether this records API exposes its reviewed OGC Features and SP-DCI standards profiles.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordFieldMap",
         "composed": false
       },
       "requiredness": "required",
@@ -13428,7 +13206,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13454,7 +13231,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13462,7 +13238,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13470,7 +13245,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -13480,40 +13254,36 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 64
+          "keyword": "required",
+          "value": [
+            "ogc_features",
+            "sp_dci"
+          ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordFieldMap"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpdci/properties/record_type",
+        "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features",
         "path_kind": "property"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
-      "purpose_source": "schema_description",
+      "purpose": "Disables OGC API Features support or supplies the reviewed spatial profile used to enable it.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/token",
-        "composed": false
+        "schema_types": [],
+        "composed": true
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -13523,7 +13293,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13549,7 +13318,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13557,7 +13325,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13565,7 +13332,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -13573,60 +13339,35 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/token"
-      }
+      "constraints": []
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpdci/properties/registry",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13652,7 +13393,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13660,7 +13400,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13668,60 +13407,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": false
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpdci/properties/registry_type",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose": "OGC API Features collection metadata and bounded geometry mapping.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/recordSpatial",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13747,7 +13477,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13755,7 +13484,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13763,56 +13491,47 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "keyword": "required",
+          "value": [
+            "geometry"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/recordSpatial"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpdci/properties/response_fields",
+        "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci",
         "path_kind": "property"
       },
-      "purpose": "Maps SP-DCI response names to the entity fields returned for an authorized record.",
+      "purpose": "Disables SP-DCI support or supplies the reviewed registry mapping used to enable it.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/recordFieldMap",
-        "composed": false
+        "schema_types": [],
+        "composed": true
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -13824,7 +13543,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13850,7 +13568,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13858,7 +13575,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13866,7 +13582,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -13874,51 +13589,35 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordFieldMap"
-      }
+      "constraints": []
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/aggregates",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Maps aggregate identifiers to governed aggregate definitions exposed by the records API.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13944,7 +13643,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13952,7 +13650,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13960,56 +13657,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 64
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": false
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/aggregates/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Governed aggregate definition with disclosure controls.",
+      "purpose": "SP-DCI registry identity and field mappings for a records service.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordAggregate",
+        "local_reference": "#/$defs/recordSpdci",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14035,7 +13727,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14043,7 +13734,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14051,21 +13741,23 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "description",
-            "disclosure_control"
+            "registry",
+            "registry_type",
+            "record_type",
+            "identifiers",
+            "expression_fields"
           ]
         },
         {
@@ -14075,30 +13767,27 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate"
+        "pointer": "/$defs/recordSpdci"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/aggregates/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/recordsService/properties/access_rights",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Classifies the records service as public, restricted, or non-public for catalog and access metadata.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -14108,7 +13797,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14134,7 +13822,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14142,7 +13829,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14150,49 +13836,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "public",
+            "restricted",
+            "non_public"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/attribute_release_profiles",
+        "pointer": "/$defs/recordsService/properties/api",
         "path_kind": "property"
       },
-      "purpose": "Purpose-bound, exact-one identity releases keyed by stable profile id. Generated Relay responses omit source metadata and are never cacheable.",
+      "purpose": "Relay records API behavior, authorization, query bounds, and standards profiles.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordAttributeReleaseProfiles",
+        "local_reference": "#/$defs/recordsApi",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -14204,7 +13884,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14230,7 +13909,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14238,7 +13916,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14246,7 +13923,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -14256,8 +13932,13 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
+          "keyword": "required",
+          "value": [
+            "scopes",
+            "projection",
+            "pagination",
+            "standards"
+          ]
         },
         {
           "keyword": "type",
@@ -14266,23 +13947,23 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfiles"
+        "pointer": "/$defs/recordsApi"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/filters",
+        "pointer": "/$defs/recordsService/properties/conforms_to",
         "path_kind": "property"
       },
-      "purpose": "Maps filterable entity fields to the comparison operators the records API permits for each field.",
+      "purpose": "Lists the standards or specifications to which the records service declares conformance.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
@@ -14298,7 +13979,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14324,7 +14004,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14332,7 +14011,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14340,7 +14018,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -14350,36 +14027,40 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 256
+          "keyword": "maxItems",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/filters/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/recordsService/properties/conforms_to/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Allowed operators for one queryable field.",
+      "purpose": "Bounded human-readable project metadata.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
-        "local_reference": "#/$defs/filterOperators",
+        "local_reference": "#/$defs/text",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -14389,7 +14070,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14415,7 +14095,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14423,7 +14102,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14431,45 +14109,139 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "minItems",
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
+    },
+    {
+      "address": {
+        "schema": "project",
+        "pointer": "/$defs/recordsService/properties/description",
+        "path_kind": "property"
+      },
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/text",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 2048
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/filterOperators"
+        "pointer": "/$defs/text"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/filters/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/recordsService/properties/entity",
+        "path_kind": "property"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -14477,7 +14249,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -14489,7 +14261,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14515,7 +14286,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14523,7 +14293,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14531,14 +14300,12 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -14558,18 +14325,16 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/pagination",
+        "pointer": "/$defs/recordsService/properties/kind",
         "path_kind": "property"
       },
-      "purpose": "Defines the default and maximum row limits enforced by records API pagination.",
+      "purpose": "Identifies this service declaration as a Relay records API backed by an authored entity.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
@@ -14584,7 +14349,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14610,7 +14374,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14618,7 +14381,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14626,7 +14388,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -14636,38 +14397,32 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "default_limit",
-            "max_limit"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "records_api"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/pagination/properties/default_limit",
+        "pointer": "/$defs/recordsService/properties/owner",
         "path_kind": "property"
       },
-      "purpose": "Sets the row limit applied when a records request does not supply its own limit.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -14677,7 +14432,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14703,7 +14457,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14711,7 +14464,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14719,7 +14471,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -14729,37 +14480,39 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 10000
+          "keyword": "maxLength",
+          "value": 2048
         },
         {
-          "keyword": "minimum",
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/pagination/properties/max_limit",
+        "pointer": "/$defs/recordsService/properties/sensitivity",
         "path_kind": "property"
       },
-      "purpose": "Caps the row limit that any records request may select; it must be at least 2 when attribute-release profiles are configured so ambiguous subjects can be detected.",
+      "purpose": "Classifies the overall sensitivity of records exposed by this service declaration.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -14771,7 +14524,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14797,7 +14549,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14805,7 +14556,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14813,7 +14563,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -14823,39 +14572,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 10000
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
+          "keyword": "enum",
+          "value": [
+            "public",
+            "internal",
+            "personal",
+            "confidential",
+            "secret"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/projection",
+        "pointer": "/$defs/recordsService/properties/title",
         "path_kind": "property"
       },
-      "purpose": "Lists the entity fields that the records API is permitted to project into row responses.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -14865,7 +14613,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14891,7 +14638,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14899,7 +14645,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14907,7 +14652,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -14917,44 +14661,41 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 256
+          "keyword": "maxLength",
+          "value": 2048
         },
         {
-          "keyword": "minItems",
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/projection/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/recordsService/properties/update_frequency",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares the reviewed cadence at which the records service's backing data is updated.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -14964,7 +14705,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14990,7 +14730,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14998,7 +14737,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15006,60 +14744,61 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "continuous",
+            "daily",
+            "weekly",
+            "termly",
+            "monthly",
+            "quarterly",
+            "annual",
+            "irregular",
+            "as_needed",
+            "unknown"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/purposes",
-        "path_kind": "property"
+        "pointer": "/$defs/service/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Lists the bounded purpose identifiers accepted by this records API policy.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Relay consultation policy and closed bindings to authored integration packs.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/consultationService",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15085,7 +14824,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15093,7 +14831,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15101,60 +14838,66 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 32
+          "keyword": "required",
+          "value": [
+            "kind",
+            "version",
+            "purpose",
+            "legal_basis",
+            "consent",
+            "consultations"
+          ]
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/consultationService"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/purposes/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/service/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose": "Relay records API backed by one authored materialized entity.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/recordsService",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15180,7 +14923,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15188,7 +14930,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15196,56 +14937,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "keyword": "required",
+          "value": [
+            "kind",
+            "entity",
+            "api"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/recordsService"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/relationships",
-        "path_kind": "property"
+        "pointer": "/$defs/variables/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Declares the bounded named relationships that records queries may follow between authored entities.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -15257,7 +14993,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15283,7 +15018,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15291,7 +15025,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15299,18 +15032,21 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 64
+          "keyword": "required",
+          "value": [
+            "from",
+            "type"
+          ]
         },
         {
           "keyword": "type",
@@ -15321,23 +15057,23 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/variables/additionalProperties/properties/from",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Binds one consultation variable to its caller-supplied request variable path.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -15347,7 +15083,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15373,7 +15108,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15381,7 +15115,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15389,51 +15122,42 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "kind",
-            "target",
-            "foreign_key"
-          ]
+          "keyword": "pattern",
+          "value": "^request\\.variables\\.[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/concept_uri",
+        "pointer": "/$defs/variables/additionalProperties/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares the request variable as a date value for typed consultation evaluation.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/text",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -15443,7 +15167,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15469,7 +15192,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15477,7 +15199,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15485,7 +15206,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -15495,34 +15215,22 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "date"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/foreign_key",
-        "path_kind": "property"
+        "pointer": "/$defs/variables/propertyNames",
+        "path_kind": "map_key"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -15530,7 +15238,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -15542,7 +15250,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15568,7 +15275,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15576,7 +15282,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15584,13 +15289,13 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -15610,31 +15315,30 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/kind",
-        "path_kind": "property"
+        "pointer": "/anyOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Selects whether one declared records relationship belongs to, has many, or has one target record.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15660,7 +15364,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15668,7 +15371,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15676,21 +15378,19 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "belongs_to",
-            "has_many",
-            "has_one"
+            "integrations"
           ]
         }
       ]
@@ -15698,24 +15398,21 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/target",
+        "pointer": "/anyOf/0/properties/integrations",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Requires at least one authored integration when the project satisfies the integration-content alternative.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -15725,7 +15422,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15751,7 +15447,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15759,7 +15454,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15767,7 +15461,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -15777,50 +15470,38 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "minProperties",
+          "value": 1
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/relationships/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/anyOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15846,7 +15527,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15854,7 +15534,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15862,49 +15541,39 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "required",
+          "value": [
+            "entities"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/required_principal_filters",
+        "pointer": "/anyOf/1/properties/entities",
         "path_kind": "property"
       },
-      "purpose": "Lists principal-bound fields required for records queries; it must be empty when attribute-release profiles are configured because subject lookup cannot supply principal filters.",
+      "purpose": "Requires at least one authored entity when the project satisfies the entity-content alternative.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/fieldList",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -15916,7 +15585,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15942,7 +15610,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15950,7 +15617,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15958,7 +15624,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -15968,38 +15633,107 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "minProperties",
+          "value": 1
         }
-      ],
-      "local_reference": {
+      ]
+    },
+    {
+      "address": {
         "schema": "project",
-        "pointer": "/$defs/fieldList"
-      }
+        "pointer": "/anyOf/2",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "services"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/scopes",
+        "pointer": "/anyOf/2/properties/services",
         "path_kind": "property"
       },
-      "purpose": "Groups the authorization scopes required for records metadata, row access, aggregates, and evidence verification.",
+      "purpose": "Requires at least one authored service when the project satisfies the service-content alternative.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
@@ -16014,7 +15748,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16040,7 +15773,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16048,7 +15780,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16056,7 +15787,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -16066,39 +15796,31 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "metadata",
-            "rows"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "minProperties",
+          "value": 1
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/scopes/properties/aggregate",
+        "pointer": "/properties/entities",
         "path_kind": "property"
       },
-      "purpose": "Authorization scope token.",
+      "purpose": "Materialized entity definitions keyed by project-local entity identifier.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/scope",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -16108,7 +15830,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16134,7 +15855,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16142,7 +15862,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16150,7 +15869,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -16160,48 +15878,35 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "keyword": "maxProperties",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/scope"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/scopes/properties/evidence_verification",
-        "path_kind": "property"
+        "pointer": "/properties/entities/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Authorization scope token.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/scope",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -16211,7 +15916,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16237,7 +15941,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16245,7 +15948,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16253,53 +15955,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "keyword": "required",
+          "value": [
+            "file"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/scope"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/scopes/properties/metadata",
+        "pointer": "/properties/entities/additionalProperties/properties/file",
         "path_kind": "property"
       },
-      "purpose": "Authorization scope token.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects the project-relative authored entity document for this project-local entity identifier.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/scope",
+        "local_reference": "#/$defs/relativePath",
         "composed": false
       },
       "requiredness": "required",
@@ -16309,12 +16001,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16340,7 +16031,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16348,7 +16038,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16356,18 +16045,18 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 128
+          "value": 4096
         },
         {
           "keyword": "minLength",
@@ -16375,7 +16064,7 @@
         },
         {
           "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
@@ -16384,28 +16073,28 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/scope"
+        "pointer": "/$defs/relativePath"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/scopes/properties/rows",
-        "path_kind": "property"
+        "pointer": "/properties/entities/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Authorization scope token.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/scope",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -16417,7 +16106,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16443,7 +16131,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16451,7 +16138,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16459,26 +16145,18 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
@@ -16487,27 +16165,27 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/scope"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/standards",
+        "pointer": "/properties/integrations",
         "path_kind": "property"
       },
-      "purpose": "Declares whether this records API exposes its reviewed OGC Features and SP-DCI standards profiles.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Source adaptation definitions keyed by project-local integration identifier.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -16519,7 +16197,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16545,7 +16222,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16553,7 +16229,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16561,7 +16236,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -16569,12 +16243,98 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
+      "constraints": [
+        {
+          "keyword": "maxProperties",
+          "value": 16
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "project",
+        "pointer": "/properties/integrations/additionalProperties",
+        "path_kind": "map_value"
+      },
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
+      ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "ogc_features",
-            "sp_dci"
+            "file"
           ]
         },
         {
@@ -16586,31 +16346,33 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features",
+        "pointer": "/properties/integrations/additionalProperties/properties/file",
         "path_kind": "property"
       },
-      "purpose": "Disables OGC API Features support or supplies the reviewed spatial profile used to enable it.",
+      "purpose": "Selects the project-relative authored integration document for this project-local integration identifier.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
-        "composed": true
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/relativePath",
+        "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16636,7 +16398,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16644,7 +16405,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16652,44 +16412,67 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/relativePath"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/properties/integrations/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16715,7 +16498,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16723,7 +16505,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16731,53 +16512,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": false
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/properties/registry",
+        "path_kind": "property"
       },
-      "purpose": "OGC API Features collection metadata and bounded geometry mapping.",
+      "purpose": "Stable identity of the Registry Stack project.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordSpatial",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16803,7 +16589,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16811,7 +16596,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16819,50 +16603,47 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "geometry"
+            "id"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordSpatial"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci",
+        "pointer": "/properties/registry/properties/id",
         "path_kind": "property"
       },
-      "purpose": "Disables SP-DCI support or supplies the reviewed registry mapping used to enable it.",
+      "purpose": "Assigns the stable project-local registry identifier used to bind generated product inputs and review artifacts.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
-        "composed": true
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
+        "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -16872,7 +16653,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16898,7 +16678,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16906,7 +16685,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16914,7 +16692,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -16922,124 +16699,50 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.project.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": false
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/properties/services",
+        "path_kind": "property"
       },
-      "purpose": "SP-DCI registry identity and field mappings for a records service.",
+      "purpose": "Relay records and consultation APIs exposed by the project.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordSpdci",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17065,7 +16768,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17073,7 +16775,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17081,52 +16782,41 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "registry",
-            "registry_type",
-            "record_type",
-            "identifiers",
-            "expression_fields"
-          ]
+          "keyword": "maxProperties",
+          "value": 32
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordSpdci"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsService/properties/access_rights",
-        "path_kind": "property"
+        "pointer": "/properties/services/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Classifies the records service as public, restricted, or non-public for catalog and access metadata.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Closed choice between a Relay consultation service and a Relay records service.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [],
+        "local_reference": "#/$defs/service",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -17138,7 +16828,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17164,7 +16853,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17172,7 +16860,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17180,46 +16867,41 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "public",
-            "restricted",
-            "non_public"
-          ]
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/service"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsService/properties/api",
-        "path_kind": "property"
+        "pointer": "/properties/services/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Relay records API behavior, authorization, query bounds, and standards profiles.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/recordsApi",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -17229,7 +16911,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17255,7 +16936,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17263,7 +16943,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17271,48 +16950,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "scopes",
-            "projection",
-            "pagination",
-            "standards"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsService/properties/conforms_to",
+        "pointer": "/properties/starter",
         "path_kind": "property"
       },
-      "purpose": "Lists the standards or specifications to which the records service declares conformance.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Immutable provenance for a workspace initialized from a Registry Stack starter. The digest excludes this content_digest field and covers the starter's authored project files.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
         "composed": false
       },
@@ -17328,7 +17002,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17354,7 +17027,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17362,7 +17034,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17370,7 +17041,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -17380,50 +17050,48 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 32
+          "keyword": "required",
+          "value": [
+            "id",
+            "release",
+            "content_digest"
+          ]
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsService/properties/conforms_to/items",
-        "path_kind": "array_item"
+        "pointer": "/properties/starter/properties/content_digest",
+        "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
+      "purpose": "Digest of the initialized starter authoring content, used to report later workspace divergence.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17449,7 +17117,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17457,7 +17124,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17465,53 +17131,44 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsService/properties/description",
+        "pointer": "/properties/starter/properties/id",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
+      "purpose": "Registry Stack starter identifier.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/text",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -17523,7 +17180,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17549,7 +17205,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17557,7 +17212,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17565,7 +17219,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -17575,12 +17228,8 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
@@ -17589,25 +17238,25 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/text"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsService/properties/entity",
+        "pointer": "/properties/starter/properties/release",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Registry Stack release that supplied the starter.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/token",
         "composed": false
       },
       "requiredness": "required",
@@ -17622,7 +17271,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17648,7 +17296,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17656,7 +17303,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17664,7 +17310,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -17673,9 +17318,17 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
         },
         {
           "keyword": "type",
@@ -17684,20 +17337,20 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/token"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsService/properties/kind",
+        "pointer": "/properties/version",
         "path_kind": "property"
       },
-      "purpose": "Identifies this service declaration as a Relay records API backed by an authored entity.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Project authoring format version.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [],
         "composed": false
@@ -17709,12 +17362,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17740,7 +17392,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17748,7 +17399,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17756,7 +17406,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -17767,41 +17416,39 @@
       "constraints": [
         {
           "keyword": "const",
-          "value": "records_api"
+          "value": 1
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/recordsService/properties/owner",
-        "path_kind": "property"
+        "schema": "environment",
+        "pointer": "",
+        "path_kind": "root"
       },
-      "purpose": "Bounded human-readable project metadata.",
+      "purpose": "Binds a Registry Stack project to environment-specific Relay services, sources, credentials, and deployment topology.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/text",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "not_applicable",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "structural",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17811,23 +17458,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
-        "schema_examples_available": false,
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17835,7 +17482,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17843,7 +17489,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -17853,51 +17498,48 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "version",
+            "deployment"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/recordsService/properties/sensitivity",
+        "schema": "environment",
+        "pointer": "/$defs/ca/properties/file",
         "path_kind": "property"
       },
-      "purpose": "Classifies the overall sensitivity of records exposed by this service declaration.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17907,23 +17549,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17931,7 +17573,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17939,58 +17580,66 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "public",
-            "internal",
-            "personal",
-            "confidential",
-            "secret"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 2
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/absolutePath"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/recordsService/properties/title",
+        "schema": "environment",
+        "pointer": "/$defs/ca/properties/generation",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Records the operator-controlled trust-root generation used for explicit certificate-authority rotation.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18000,23 +17649,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18024,7 +17673,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18032,61 +17680,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
+          "keyword": "maximum",
+          "value": 18446744073709551615
         },
         {
-          "keyword": "minLength",
+          "keyword": "minimum",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/recordsService/properties/update_frequency",
-        "path_kind": "property"
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Declares the reviewed cadence at which the records service's backing data is updated.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "structural",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18096,23 +17741,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18120,7 +17765,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18128,63 +17772,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "continuous",
-            "daily",
-            "weekly",
-            "termly",
-            "monthly",
-            "quarterly",
-            "annual",
-            "irregular",
-            "as_needed",
-            "unknown"
+            "username",
+            "password",
+            "generation"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/service/oneOf/0",
-        "path_kind": "branch"
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/0/properties/generation",
+        "path_kind": "property"
       },
-      "purpose": "Notary evidence policy, consultations, claims, and registry-backed credential profiles. Every claim derives from exactly one declared Relay consultation.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Records the generation of the operator-managed basic-authentication credential references.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/evidenceService",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18194,23 +17833,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18218,7 +17857,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18226,69 +17864,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "kind",
-            "version",
-            "purpose",
-            "legal_basis",
-            "consent",
-            "access",
-            "claims"
-          ]
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/evidenceService"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/service/oneOf/1",
-        "path_kind": "branch"
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/0/properties/password",
+        "path_kind": "property"
       },
-      "purpose": "Relay records API backed by one authored materialized entity.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordsService",
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
+      "sensitivity": "secret_reference",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18298,23 +17926,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18322,7 +17950,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18330,22 +17957,19 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "kind",
-            "entity",
-            "api"
+            "secret"
           ]
         },
         {
@@ -18354,40 +17978,40 @@
         }
       ],
       "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordsService"
+        "schema": "environment",
+        "pointer": "/$defs/secret"
       }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/variables/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/0/properties/username",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "secret_reference",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18397,23 +18021,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18421,7 +18045,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18429,59 +18052,60 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "from",
-            "type"
+            "secret"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/secret"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/variables/additionalProperties/properties/from",
-        "path_kind": "property"
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Binds one evidence variable to its caller-supplied request variable path.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "structural",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18491,23 +18115,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18515,7 +18139,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18523,38 +18146,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^request\\.variables\\.[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "token",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/variables/additionalProperties/properties/type",
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/1/properties/generation",
         "path_kind": "property"
       },
-      "purpose": "Declares the request variable as a date value for typed evidence evaluation.",
+      "purpose": "Records the generation of the operator-managed bearer-token credential reference.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
       "requiredness": "required",
@@ -18564,12 +18192,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18579,23 +18206,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18603,7 +18230,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18611,52 +18237,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "date"
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/variables/propertyNames",
-        "path_kind": "map_key"
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/1/properties/token",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "secret_reference",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18666,23 +18299,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18690,7 +18323,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18698,43 +18330,46 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "secret"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
+        "schema": "environment",
+        "pointer": "/$defs/secret"
       }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/anyOf/0",
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/2",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
       "requiredness": "conditional",
@@ -18745,11 +18380,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18759,23 +18393,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18783,7 +18417,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18791,7 +18424,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -18804,24 +18436,33 @@
         {
           "keyword": "required",
           "value": [
-            "integrations"
+            "client_id",
+            "client_secret",
+            "generation"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/anyOf/0/properties/integrations",
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/2/properties/client_id",
         "path_kind": "property"
       },
-      "purpose": "Requires at least one authored integration when the project satisfies the integration-content alternative.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
       "requiredness": "required",
@@ -18831,12 +18472,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "secret_reference",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18846,23 +18486,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18870,7 +18510,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18878,49 +18517,61 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "minProperties",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "secret"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/secret"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/anyOf/1",
-        "path_kind": "branch"
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/2/properties/client_secret",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
+      "sensitivity": "secret_reference",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18930,23 +18581,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18954,7 +18605,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18962,37 +18612,46 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "entities"
+            "secret"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/secret"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/anyOf/1/properties/entities",
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/2/properties/generation",
         "path_kind": "property"
       },
-      "purpose": "Requires at least one authored entity when the project satisfies the entity-content alternative.",
+      "purpose": "Records the generation of the operator-managed OAuth client credential references.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
       "requiredness": "required",
@@ -19002,12 +18661,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19017,23 +18675,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19041,7 +18699,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19049,34 +18706,44 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "minProperties",
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
           "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/anyOf/2",
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/3",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
       "requiredness": "conditional",
@@ -19087,11 +18754,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19101,23 +18767,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19125,7 +18791,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19133,7 +18798,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -19146,24 +18810,31 @@
         {
           "keyword": "required",
           "value": [
-            "services"
+            "value",
+            "generation"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/anyOf/2/properties/services",
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/3/properties/generation",
         "path_kind": "property"
       },
-      "purpose": "Requires at least one authored service when the project satisfies the service-content alternative.",
+      "purpose": "Records the generation of the operator-managed API-key credential reference.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
       "requiredness": "required",
@@ -19173,12 +18844,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19188,23 +18858,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19212,7 +18882,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19220,51 +18889,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "minProperties",
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
           "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/entities",
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/3/properties/value",
         "path_kind": "property"
       },
-      "purpose": "Materialized entity definitions keyed by project-local entity identifier.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "secret_reference",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19274,23 +18951,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19298,7 +18975,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19306,55 +18982,61 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 32
+          "keyword": "required",
+          "value": [
+            "secret"
+          ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/secret"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/entities/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "environment",
+        "pointer": "/$defs/endpoint/properties/allowed_private_cidrs",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Explicit private network ranges this source may resolve to.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
+        "local_reference": "#/$defs/privateCidrs",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19364,23 +19046,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19388,7 +19070,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19396,59 +19077,63 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "file"
-          ]
+          "keyword": "maxItems",
+          "value": 16
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/privateCidrs"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/entities/additionalProperties/properties/file",
+        "schema": "environment",
+        "pointer": "/$defs/endpoint/properties/ca",
         "path_kind": "property"
       },
-      "purpose": "Selects the project-relative authored entity document for this project-local entity identifier.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Pinned certificate-authority file and its rotation generation.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/relativePath",
+        "local_reference": "#/$defs/ca",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "authored",
+      "sensitivity": "internal",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19458,23 +19143,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19482,7 +19167,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19490,69 +19174,60 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "keyword": "required",
+          "value": [
+            "file",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/relativePath"
+        "schema": "environment",
+        "pointer": "/$defs/ca"
       }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/entities/propertyNames",
-        "path_kind": "map_key"
+        "schema": "environment",
+        "pointer": "/$defs/endpoint/properties/generation",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Records the operator-controlled private-endpoint generation used for explicit binding rotation.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19562,23 +19237,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19586,7 +19261,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19594,45 +19268,45 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/integrations",
+        "schema": "environment",
+        "pointer": "/$defs/endpoint/properties/mtls",
         "path_kind": "property"
       },
-      "purpose": "Source adaptation definitions keyed by project-local integration identifier.",
+      "purpose": "Client certificate and private-key reference for mutual TLS.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/mtls",
         "composed": false
       },
       "requiredness": "optional",
@@ -19643,11 +19317,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19657,23 +19330,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19681,7 +19354,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19689,7 +19361,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -19699,45 +19370,53 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
+          "keyword": "required",
+          "value": [
+            "certificate_file",
+            "private_key",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/mtls"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/integrations/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "environment",
+        "pointer": "/$defs/endpoint/properties/origin",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "HTTPS origin without path, query, or fragment.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/origin",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19747,23 +19426,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19771,7 +19450,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19779,44 +19457,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "file"
-          ]
+          "keyword": "format",
+          "value": "uri"
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/origin"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/integrations/additionalProperties/properties/file",
+        "schema": "environment",
+        "pointer": "/$defs/endpoint/properties/path",
         "path_kind": "property"
       },
-      "purpose": "Selects the project-relative authored integration document for this project-local integration identifier.",
+      "purpose": "Binds a reviewed private endpoint path beneath its separately configured origin.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/relativePath",
         "composed": false
       },
       "requiredness": "required",
@@ -19827,11 +19509,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19841,23 +19522,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19865,7 +19546,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19873,7 +19553,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -19889,53 +19568,47 @@
         },
         {
           "keyword": "minLength",
-          "value": 1
+          "value": 2
         },
         {
           "keyword": "pattern",
-          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//)(?!.*[?#]).+$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/relativePath"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/integrations/propertyNames",
-        "path_kind": "map_key"
+        "schema": "environment",
+        "pointer": "/$defs/entity/properties/columns",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Maps authored entity field names to columns supplied by the environment-owned provider.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19945,23 +19618,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19969,7 +19642,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19977,60 +19649,54 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/registry",
-        "path_kind": "property"
+        "schema": "environment",
+        "pointer": "/$defs/entity/properties/columns/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Stable identity of the Registry Stack project.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20040,23 +19706,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20064,7 +19730,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20072,38 +19737,40 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "id"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/registry/properties/id",
-        "path_kind": "property"
+        "schema": "environment",
+        "pointer": "/$defs/entity/properties/columns/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Assigns the stable project-local registry identifier used to bind generated product inputs and review artifacts.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "string"
@@ -20111,7 +19778,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -20119,11 +19786,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20133,23 +19799,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20157,7 +19823,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20165,13 +19830,13 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -20184,40 +19849,39 @@
         }
       ],
       "local_reference": {
-        "schema": "project",
+        "schema": "environment",
         "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/services",
+        "schema": "environment",
+        "pointer": "/$defs/entity/properties/generation",
         "path_kind": "property"
       },
-      "purpose": "Relay records APIs and Notary evidence services exposed by the project.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Records the operator-controlled generation of this entity materialization binding.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20227,23 +19891,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20251,7 +19915,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20259,42 +19922,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 32
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/services/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "environment",
+        "pointer": "/$defs/entity/properties/provider",
+        "path_kind": "property"
       },
-      "purpose": "Closed choice between a Notary evidence service and a Relay records service.",
+      "purpose": "Environment-specific physical provider for a materialized entity.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/service",
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/provider",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -20302,11 +19971,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20316,23 +19984,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20340,7 +20008,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20348,52 +20015,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [],
       "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/service"
+        "schema": "environment",
+        "pointer": "/$defs/provider"
       }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/services/propertyNames",
-        "path_kind": "map_key"
+        "schema": "environment",
+        "pointer": "/$defs/entity/properties/source_revision",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Records the operator-supplied revision label of the bound entity source.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20403,23 +20066,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20427,7 +20090,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20435,48 +20097,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/starter",
+        "schema": "environment",
+        "pointer": "/$defs/integration/properties/source",
         "path_kind": "property"
       },
-      "purpose": "Immutable provenance for a workspace initialized from a Registry Stack starter. The digest excludes this content_digest field and covers the starter's authored project files.",
+      "purpose": "Runtime source connection policy for one authored integration.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/source",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -20484,11 +20146,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20498,23 +20159,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20522,7 +20183,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20530,7 +20190,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -20542,32 +20201,35 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "release",
-            "content_digest"
+            "origin"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/source"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/starter/properties/content_digest",
+        "schema": "environment",
+        "pointer": "/$defs/mtls/properties/certificate_file",
         "path_kind": "property"
       },
-      "purpose": "Digest of the initialized starter authoring content, used to report later workspace divergence.",
+      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
       "requiredness": "required",
@@ -20578,11 +20240,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20592,23 +20253,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20616,7 +20277,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20624,7 +20284,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -20634,47 +20293,57 @@
         "sensitive_operational_metadata"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 2
+        },
         {
           "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/absolutePath"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/starter/properties/id",
+        "schema": "environment",
+        "pointer": "/$defs/mtls/properties/generation",
         "path_kind": "property"
       },
-      "purpose": "Registry Stack starter identifier.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Records the operator-controlled mutual-TLS generation used for explicit certificate and key rotation.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20684,23 +20353,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20708,7 +20377,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20716,60 +20384,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/starter/properties/release",
+        "schema": "environment",
+        "pointer": "/$defs/mtls/properties/private_key",
         "path_kind": "property"
       },
-      "purpose": "Registry Stack release that supplied the starter.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "secret_reference",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20779,23 +20446,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20803,7 +20470,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20811,65 +20477,60 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "keyword": "required",
+          "value": [
+            "secret"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/token"
+        "schema": "environment",
+        "pointer": "/$defs/secret"
       }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/version",
-        "path_kind": "property"
+        "schema": "environment",
+        "pointer": "/$defs/privateCidrs/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Project authoring format version.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "public",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20879,23 +20540,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20903,7 +20564,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20911,29 +20571,38 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": 1
+          "keyword": "maxLength",
+          "value": 64
+        },
+        {
+          "keyword": "minLength",
+          "value": 3
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "",
-        "path_kind": "root"
+        "pointer": "/$defs/provider/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Binds a Registry Stack project to environment-specific services, sources, credentials, and deployment topology.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -20941,9 +20610,9 @@
         "schema_types": [
           "object"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "conditional",
       "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
@@ -20955,7 +20624,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20974,7 +20642,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": true,
+        "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
@@ -20982,7 +20650,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20990,7 +20657,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20998,20 +20664,20 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "version",
-            "deployment"
+            "type",
+            "path"
           ]
         },
         {
@@ -21023,34 +20689,32 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/ca/properties/file",
+        "pointer": "/$defs/provider/oneOf/0/properties/delimiter",
         "path_kind": "property"
       },
-      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects the byte used to delimit fields in the bound CSV source.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -21077,7 +20741,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -21085,7 +20748,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -21093,45 +20755,35 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
+          "keyword": "maximum",
+          "value": 255
         },
         {
-          "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/absolutePath"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/ca/properties/generation",
+        "pointer": "/$defs/provider/oneOf/0/properties/header_row",
         "path_kind": "property"
       },
-      "purpose": "Records the operator-controlled trust-root generation used for explicit certificate-authority rotation.",
+      "purpose": "Selects the one-based CSV row containing source column headers.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -21142,19 +20794,18 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -21181,7 +20832,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -21189,7 +20839,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -21197,19 +20846,17 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 18446744073709551615
+          "value": 4294967295
         },
         {
           "keyword": "minimum",
@@ -21224,119 +20871,24 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "operator_preflight",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "username",
-            "password",
-            "generation"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/0/properties/generation",
+        "pointer": "/$defs/provider/oneOf/0/properties/path",
         "path_kind": "property"
       },
-      "purpose": "Records the generation of the operator-managed basic-authentication credential references.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -21346,7 +20898,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -21373,7 +20924,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -21381,7 +20931,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -21389,7 +20938,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -21400,50 +20948,56 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 18446744073709551615
+          "keyword": "maxLength",
+          "value": 4096
         },
         {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "minLength",
+          "value": 2
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/absolutePath"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/0/properties/password",
+        "pointer": "/$defs/provider/oneOf/0/properties/quote",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects the byte used to quote fields in the bound CSV source.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -21470,7 +21024,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -21478,7 +21031,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -21486,48 +21038,41 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maximum",
+          "value": 255
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/0/properties/username",
+        "pointer": "/$defs/provider/oneOf/0/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects CSV as the environment-owned materialization provider for an authored entity.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/secret",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
@@ -21537,12 +21082,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -21569,7 +21113,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -21577,7 +21120,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -21585,36 +21127,24 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "csv"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/1",
+        "pointer": "/$defs/provider/oneOf/1",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
@@ -21640,7 +21170,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -21667,7 +21196,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -21675,7 +21203,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -21683,7 +21210,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -21696,8 +21222,10 @@
         {
           "keyword": "required",
           "value": [
-            "token",
-            "generation"
+            "type",
+            "project_file",
+            "path",
+            "sheet"
           ]
         },
         {
@@ -21709,33 +21237,32 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/1/properties/generation",
+        "pointer": "/$defs/provider/oneOf/1/properties/data_range",
         "path_kind": "property"
       },
-      "purpose": "Records the generation of the operator-managed bearer-token credential reference.",
+      "purpose": "Restricts entity materialization to the reviewed range within the selected worksheet.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -21762,7 +21289,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -21770,7 +21296,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -21778,61 +21303,57 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 18446744073709551615
+          "keyword": "maxLength",
+          "value": 256
         },
         {
-          "keyword": "minimum",
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/1/properties/token",
+        "pointer": "/$defs/provider/oneOf/1/properties/header_row",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects the one-based XLSX row containing source column headers.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -21859,7 +21380,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -21867,7 +21387,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -21875,159 +21394,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maximum",
+          "value": 4294967295
         },
         {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
-    },
-    {
-      "address": {
-        "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/2",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "operator_preflight",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "client_id",
-            "client_secret",
-            "generation"
-          ]
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/2/properties/client_id",
+        "pointer": "/$defs/provider/oneOf/1/properties/path",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/secret",
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22054,7 +21472,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22062,7 +21479,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22070,63 +21486,67 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 2
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/secret"
+        "pointer": "/$defs/absolutePath"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/2/properties/client_secret",
+        "pointer": "/$defs/provider/oneOf/1/properties/project_file",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
-      "purpose_source": "schema_description",
+      "purpose": "Binds a contained project-relative workbook for offline preflight and read-only runtime mounting without emitting the authoring path into Relay configuration.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/secret",
+        "local_reference": "#/$defs/relativePath",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22153,7 +21573,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22161,7 +21580,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22169,62 +21587,66 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/secret"
+        "pointer": "/$defs/relativePath"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/2/properties/generation",
+        "pointer": "/$defs/provider/oneOf/1/properties/sheet",
         "path_kind": "property"
       },
-      "purpose": "Records the generation of the operator-managed OAuth client credential references.",
+      "purpose": "Names the worksheet read from the environment-owned XLSX source.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22251,7 +21673,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22259,7 +21680,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22267,60 +21687,55 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 18446744073709551615
+          "keyword": "maxLength",
+          "value": 256
         },
         {
-          "keyword": "minimum",
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/3",
-        "path_kind": "branch"
+        "pointer": "/$defs/provider/oneOf/1/properties/type",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Selects XLSX as the environment-owned materialization provider for an authored entity.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22347,7 +21762,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22355,7 +21769,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22363,59 +21776,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "value",
-            "generation"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "xlsx"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/3/properties/generation",
-        "path_kind": "property"
+        "pointer": "/$defs/provider/oneOf/2",
+        "path_kind": "branch"
       },
-      "purpose": "Records the generation of the operator-managed API-key credential reference.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22442,7 +21845,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22450,7 +21852,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22458,61 +21859,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "type",
+            "path"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/3/properties/value",
+        "pointer": "/$defs/provider/oneOf/2/properties/path",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/secret",
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22539,7 +21937,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22547,7 +21944,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22555,63 +21951,147 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 2
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/secret"
+        "pointer": "/$defs/absolutePath"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/endpoint/properties/allowed_private_cidrs",
+        "pointer": "/$defs/provider/oneOf/2/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Explicit private network ranges this source may resolve to.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects Parquet as the environment-owned materialization provider for an authored entity.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/privateCidrs",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
+      "state": "environment_bound",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "operator_preflight",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.environment.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "const",
+          "value": "parquet"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "environment",
+        "pointer": "/$defs/provider/oneOf/3",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22638,7 +22118,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22646,7 +22125,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22654,41 +22132,37 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "required",
+          "value": [
+            "type",
+            "connection",
+            "schema",
+            "table"
+          ]
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/privateCidrs"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/endpoint/properties/ca",
+        "pointer": "/$defs/provider/oneOf/3/properties/connection",
         "path_kind": "property"
       },
-      "purpose": "Pinned certificate-authority file and its rotation generation.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -22697,22 +22171,21 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ca",
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "secret_reference",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22739,7 +22212,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22747,7 +22219,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22755,20 +22226,19 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "file",
-            "generation"
+            "secret"
           ]
         },
         {
@@ -22778,39 +22248,39 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/ca"
+        "pointer": "/$defs/secret"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/endpoint/properties/generation",
+        "pointer": "/$defs/provider/oneOf/3/properties/schema",
         "path_kind": "property"
       },
-      "purpose": "Records the operator-controlled private-endpoint generation used for explicit binding rotation.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Portable unquoted PostgreSQL schema or table identifier.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/postgresIdentifier",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22837,7 +22307,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22845,7 +22314,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22853,51 +22321,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,62}$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/postgresIdentifier"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/endpoint/properties/mtls",
+        "pointer": "/$defs/provider/oneOf/3/properties/table",
         "path_kind": "property"
       },
-      "purpose": "Client certificate and private-key reference for mutual TLS.",
+      "purpose": "Portable unquoted PostgreSQL schema or table identifier.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/mtls",
+        "local_reference": "#/$defs/postgresIdentifier",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -22907,7 +22373,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22934,7 +22399,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22942,7 +22406,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22950,7 +22413,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -22960,54 +22422,46 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "certificate_file",
-            "private_key",
-            "generation"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,62}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/mtls"
+        "pointer": "/$defs/postgresIdentifier"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/endpoint/properties/origin",
+        "pointer": "/$defs/provider/oneOf/3/properties/type",
         "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects PostgreSQL as the environment-owned materialization provider for an authored entity.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/origin",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23034,7 +22488,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23042,7 +22495,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23050,42 +22502,28 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "postgres"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/origin"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/endpoint/properties/path",
-        "path_kind": "property"
+        "pointer": "/$defs/relayOrigin/anyOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Binds a reviewed private endpoint path beneath its separately configured origin.",
-      "purpose_source": "reviewed_override",
+      "purpose": "HTTPS origin without path, query, or fragment.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -23093,21 +22531,21 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/origin",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23134,7 +22572,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23142,7 +22579,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23150,64 +22586,63 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
+          "keyword": "format",
+          "value": "uri"
         },
         {
           "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//)(?!.*[?#]).+$"
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/origin"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/entity/properties/columns",
-        "path_kind": "property"
+        "pointer": "/$defs/relayOrigin/anyOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Maps authored entity field names to columns supplied by the environment-owned provider.",
-      "purpose_source": "reviewed_override",
+      "purpose": "HTTP IP-loopback origin accepted only under the local profile.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/localLoopbackOrigin",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23234,7 +22669,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23242,7 +22676,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23250,32 +22683,40 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "minProperties",
-          "value": 1
+          "keyword": "format",
+          "value": "uri"
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/localLoopbackOrigin"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/entity/properties/columns/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/relayResource/anyOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Exact HTTPS resource without query or fragment.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -23284,22 +22725,21 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/httpsResource",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23326,7 +22766,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23334,7 +22773,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23342,19 +22780,22 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uri"
+        },
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
         },
         {
           "keyword": "type",
@@ -23363,16 +22804,16 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/httpsResource"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/entity/properties/columns/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/relayResource/anyOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "HTTP IP-loopback resource accepted only with the local deployment profile.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -23381,22 +22822,21 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/localLoopbackResource",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23423,7 +22863,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23431,7 +22870,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23439,19 +22877,22 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uri"
+        },
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/[^?#]+$"
         },
         {
           "keyword": "type",
@@ -23460,16 +22901,16 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/localLoopbackResource"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/entity/properties/generation",
+        "pointer": "/$defs/secret/properties/secret",
         "path_kind": "property"
       },
-      "purpose": "Records the operator-controlled generation of this entity materialization binding.",
+      "purpose": "Names the operator-managed environment secret reference without containing the secret value.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -23487,12 +22928,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23519,7 +22959,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23527,7 +22966,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23535,23 +22973,18 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[A-Z_][A-Z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
@@ -23562,105 +22995,19 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/entity/properties/provider",
+        "pointer": "/$defs/service/properties/service",
         "path_kind": "property"
       },
-      "purpose": "Environment-specific physical provider for a materialized entity.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/provider",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "operator_preflight",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/provider"
-      }
-    },
-    {
-      "address": {
-        "schema": "environment",
-        "pointer": "/$defs/entity/properties/source_revision",
-        "path_kind": "property"
-      },
-      "purpose": "Records the operator-supplied revision label of the bound entity source.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
@@ -23670,12 +23017,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23702,7 +23048,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23710,7 +23055,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23718,61 +23062,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/integration/properties/source",
+        "pointer": "/$defs/source/properties/allowed_private_cidrs",
         "path_kind": "property"
       },
-      "purpose": "Runtime source connection policy for one authored integration.",
+      "purpose": "Explicit private network ranges this source may resolve to.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/source",
+        "local_reference": "#/$defs/privateCidrs",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23799,7 +23140,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23807,7 +23147,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23815,62 +23154,63 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "origin"
-          ]
+          "keyword": "maxItems",
+          "value": 16
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/source"
+        "pointer": "/$defs/privateCidrs"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/internalOrigin/anyOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/ca",
+        "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
+      "purpose": "Pinned certificate-authority file and its rotation generation.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/origin",
+        "local_reference": "#/$defs/ca",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23897,7 +23237,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23905,7 +23244,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23913,65 +23251,60 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
+          "keyword": "required",
+          "value": [
+            "file",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/origin"
+        "pointer": "/$defs/ca"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/internalOrigin/anyOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/concurrency",
+        "path_kind": "property"
       },
-      "purpose": "Signed internal HTTP service origin. Runtime DNS pinning admits only eligible private addresses.",
-      "purpose_source": "schema_description",
+      "purpose": "Caps the number of requests that may be in flight concurrently for this source.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/privateServiceOrigin",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23998,7 +23331,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24006,7 +23338,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24014,65 +23345,141 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
+          "keyword": "maximum",
+          "value": 64
         },
         {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP]://[a-z][a-z0-9.-]{0,252}(?::[0-9]+)?/?$"
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
+      ]
+    },
+    {
+      "address": {
+        "schema": "environment",
+        "pointer": "/$defs/source/properties/credential",
+        "path_kind": "property"
+      },
+      "purpose": "One supported source credential shape, containing references rather than values.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/credential",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "environment_bound",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "operator_preflight",
+        "product_build"
       ],
+      "diagnostic": "registryctl.authoring.environment.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/privateServiceOrigin"
+        "pointer": "/$defs/credential"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/internalOrigin/anyOf/2",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/jwks",
+        "path_kind": "property"
       },
-      "purpose": "HTTP IP-loopback origin; public Relay and issuer fields restrict it to the local profile, while internal Notary-to-Relay connections allow it in any profile.",
+      "purpose": "Security-bound HTTPS endpoint with optional private-network, CA, and mTLS policy.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/localLoopbackOrigin",
+        "local_reference": "#/$defs/endpoint",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24099,7 +23506,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24107,7 +23513,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24115,65 +23520,62 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$"
+          "keyword": "required",
+          "value": [
+            "origin",
+            "path",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/localLoopbackOrigin"
+        "pointer": "/$defs/endpoint"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/mtls/properties/certificate_file",
+        "pointer": "/$defs/source/properties/mtls",
         "path_kind": "property"
       },
-      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
+      "purpose": "Client certificate and private-key reference for mutual TLS.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/absolutePath",
+        "local_reference": "#/$defs/mtls",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24200,7 +23602,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24208,7 +23609,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24216,68 +23616,62 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
-        },
-        {
-          "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "keyword": "required",
+          "value": [
+            "certificate_file",
+            "private_key",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/absolutePath"
+        "pointer": "/$defs/mtls"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/mtls/properties/generation",
+        "pointer": "/$defs/source/properties/oauth",
         "path_kind": "property"
       },
-      "purpose": "Records the operator-controlled mutual-TLS generation used for explicit certificate and key rotation.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Security-bound HTTPS endpoint with optional private-network, CA, and mTLS policy.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/endpoint",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24304,7 +23698,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24312,7 +23705,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24320,61 +23712,62 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "origin",
+            "path",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/endpoint"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/mtls/properties/private_key",
+        "pointer": "/$defs/source/properties/origin",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose": "HTTPS origin without path, query, or fragment.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/secret",
+        "local_reference": "#/$defs/origin",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24401,7 +23794,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24409,7 +23801,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24417,40 +23808,41 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "format",
+          "value": "uri"
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/secret"
+        "pointer": "/$defs/origin"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/access_token",
+        "pointer": "/$defs/source/properties/rate",
         "path_kind": "property"
       },
-      "purpose": "Dedicated Notary access-token signing key and published key identifier.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the per-minute request rate and burst bounds applied to one environment source.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -24460,7 +23852,7 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -24472,7 +23864,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24499,7 +23890,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24507,7 +23897,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24515,7 +23904,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -24527,8 +23915,8 @@
         {
           "keyword": "required",
           "value": [
-            "signing_key",
-            "signing_kid"
+            "per_minute",
+            "burst"
           ]
         },
         {
@@ -24540,19 +23928,18 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/access_token/properties/signing_key",
+        "pointer": "/$defs/source/properties/rate/properties/burst",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
-      "purpose_source": "schema_description",
+      "purpose": "Caps the short request burst permitted by the source rate limiter.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/secret",
         "composed": false
       },
       "requiredness": "required",
@@ -24562,12 +23949,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24594,7 +23980,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24602,7 +23987,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24610,63 +23994,57 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maximum",
+          "value": 1024
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/access_token/properties/signing_kid",
+        "pointer": "/$defs/source/properties/rate/properties/per_minute",
         "path_kind": "property"
       },
-      "purpose": "Bounded visible-ASCII token, including full verification-method identifiers.",
-      "purpose_source": "schema_description",
+      "purpose": "Caps the number of requests permitted to this source during one minute.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/token2048",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24693,7 +24071,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24701,7 +24078,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24709,68 +24085,57 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
+          "keyword": "maximum",
+          "value": 60000
         },
         {
-          "keyword": "minLength",
+          "keyword": "minimum",
           "value": 1
         },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/token2048"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/allowed_wallet_origins",
+        "pointer": "/$defs/source/properties/timeout",
         "path_kind": "property"
       },
-      "purpose": "Exact HTTPS browser origins admitted to the wallet-facing Notary routes.",
-      "purpose_source": "schema_description",
+      "purpose": "Optionally narrows one environment source request to a positive timeout no greater than twenty seconds.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24797,7 +24162,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24805,7 +24169,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24813,65 +24176,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-9]{4}|20000)ms|(?:[1-9]|1[0-9]|20)s)$"
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/allowed_wallet_origins/items",
-        "path_kind": "array_item"
+        "pointer": "/allOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/origin",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24898,7 +24247,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24906,7 +24254,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24914,65 +24261,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
+        "branch_has_no_authored_value"
       ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/origin"
-      }
+      "constraints": []
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/authorization_server",
-        "path_kind": "property"
+        "pointer": "/allOf/0/else",
+        "path_kind": "branch"
       },
-      "purpose": "Pinned eSignet issuer and exact endpoints used for login and token validation.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24999,7 +24324,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25007,7 +24331,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25015,60 +24338,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "issuer",
-            "jwks_url",
-            "userinfo_url",
-            "authorize_url",
-            "token_url"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/authorization_server/properties/authorize_url",
-        "path_kind": "property"
+        "pointer": "/allOf/0/else/not",
+        "path_kind": "branch"
       },
-      "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [],
-        "local_reference": "#/$defs/relayResource",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25095,7 +24401,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25103,7 +24408,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25111,50 +24415,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relayResource"
-      }
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "relay"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/authorization_server/properties/issuer",
-        "path_kind": "property"
+        "pointer": "/allOf/0/if",
+        "path_kind": "branch"
       },
-      "purpose": "Relay or issuer origin using HTTPS, or HTTP IP-loopback under the local profile.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [],
-        "local_reference": "#/$defs/relayOrigin",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25181,7 +24485,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25189,7 +24492,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25197,35 +24499,36 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relayOrigin"
-      }
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "deployment"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/authorization_server/properties/jwks_url",
+        "pointer": "/allOf/0/if/properties/deployment",
         "path_kind": "property"
       },
-      "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.",
-      "purpose_source": "schema_description",
+      "purpose": "Matches environments whose deployment declaration enables Relay so the corresponding Relay binding is required.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [],
-        "local_reference": "#/$defs/relayResource",
         "composed": false
       },
       "requiredness": "required",
@@ -25235,12 +24538,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25267,7 +24569,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25275,7 +24576,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25283,50 +24583,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relayResource"
-      }
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "relay"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/authorization_server/properties/token_url",
-        "path_kind": "property"
+        "pointer": "/allOf/0/then",
+        "path_kind": "branch"
       },
-      "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [],
-        "local_reference": "#/$defs/relayResource",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25353,7 +24652,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25361,7 +24659,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25369,50 +24666,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relayResource"
-      }
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "relay"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/authorization_server/properties/userinfo_url",
-        "path_kind": "property"
+        "pointer": "/allOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [],
-        "local_reference": "#/$defs/relayResource",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25439,7 +24736,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25447,7 +24743,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25455,51 +24750,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relayResource"
-      }
+      "constraints": []
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/client",
-        "path_kind": "property"
+        "pointer": "/allOf/1/if",
+        "path_kind": "branch"
       },
-      "purpose": "eSignet relying-party identity and dedicated private-key reference.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25526,7 +24813,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25534,7 +24820,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25542,60 +24827,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "id",
-            "signing_key",
-            "signing_kid"
+            "relay_state"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/client/properties/id",
-        "path_kind": "property"
+        "pointer": "/allOf/1/then",
+        "path_kind": "branch"
       },
-      "purpose": "Bounded visible-ASCII protocol token.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/token256",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25622,7 +24897,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25630,7 +24904,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25638,69 +24911,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
+        "branch_has_no_authored_value"
       ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/token256"
-      }
+      "constraints": []
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/client/properties/signing_key",
+        "pointer": "/allOf/1/then/properties/deployment",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
-      "purpose_source": "schema_description",
+      "purpose": "Requires the Relay deployment service when Relay state storage is configured.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/secret",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25727,7 +24974,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25735,7 +24981,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25743,63 +24988,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "secret"
+            "relay"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/client/properties/signing_kid",
-        "path_kind": "property"
+        "pointer": "/allOf/2",
+        "path_kind": "branch"
       },
-      "purpose": "Bounded visible-ASCII token, including full verification-method identifiers.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/token2048",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25826,7 +25057,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25834,7 +25064,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25842,68 +25071,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
+        "branch_has_no_authored_value"
       ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/token2048"
-      }
+      "constraints": []
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/credential",
-        "path_kind": "property"
+        "pointer": "/allOf/2/else",
+        "path_kind": "branch"
       },
-      "purpose": "Existing project service and credential profile exposed through OID4VCI.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25930,7 +25134,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25938,7 +25141,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25946,49 +25148,34 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "service",
-            "profile"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/credential/properties/profile",
+        "pointer": "/allOf/2/else/properties/relay",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Applies non-local HTTPS constraints to the Relay origin, issuer, and key-set bindings.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -25998,7 +25185,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26025,7 +25211,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26033,7 +25218,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26041,7 +25225,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -26049,28 +25232,99 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
+      "constraints": []
+    },
+    {
+      "address": {
+        "schema": "environment",
+        "pointer": "/allOf/2/else/properties/relay/not",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "environment_bound",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "operator_preflight",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.environment.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "required",
+          "value": [
+            "local_api_keys"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/credential/properties/service",
+        "pointer": "/allOf/2/else/properties/relay/properties/issuer",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "HTTPS origin without path, query, or fragment.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -26079,22 +25333,21 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/origin",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26121,7 +25374,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26129,7 +25381,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26137,18 +25388,22 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uri"
+        },
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
         },
         {
           "keyword": "type",
@@ -26157,28 +25412,30 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/origin"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/public_base_url",
+        "pointer": "/allOf/2/else/properties/relay/properties/jwks_url",
         "path_kind": "property"
       },
-      "purpose": "Relay or issuer origin using HTTPS, or HTTP IP-loopback under the local profile.",
+      "purpose": "Exact HTTPS resource without query or fragment.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/relayOrigin",
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/httpsResource",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -26188,7 +25445,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26215,7 +25471,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26223,7 +25478,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26231,7 +25485,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -26240,31 +25493,46 @@
         "generated_docs_never_load_country_values",
         "sensitive_operational_metadata"
       ],
-      "constraints": [],
+      "constraints": [
+        {
+          "keyword": "format",
+          "value": "uri"
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/relayOrigin"
+        "pointer": "/$defs/httpsResource"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/redirect_uri",
+        "pointer": "/allOf/2/else/properties/relay/properties/origin",
         "path_kind": "property"
       },
-      "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.",
+      "purpose": "HTTPS origin without path, query, or fragment.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/relayResource",
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/origin",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -26274,7 +25542,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26301,7 +25568,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26309,7 +25575,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26317,7 +25582,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -26326,43 +25590,52 @@
         "generated_docs_never_load_country_values",
         "sensitive_operational_metadata"
       ],
-      "constraints": [],
+      "constraints": [
+        {
+          "keyword": "format",
+          "value": "uri"
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/relayResource"
+        "pointer": "/$defs/origin"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/registrar_clients",
-        "path_kind": "property"
+        "pointer": "/allOf/2/if",
+        "path_kind": "branch"
       },
-      "purpose": "Closed OIDC machine-client allow-list for registrar-created credential offers. Each client uses this authorization server and the Notary public base URL as its resource audience; citizen client classification remains separate.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "array"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "schema_value": []
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26389,7 +25662,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26397,7 +25669,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26405,61 +25676,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 64
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/registrar_clients/items",
-        "path_kind": "array_item"
+        "pointer": "/allOf/2/if/properties/deployment",
+        "path_kind": "property"
       },
-      "purpose": "Bounded visible-ASCII protocol token.",
-      "purpose_source": "schema_description",
+      "purpose": "Matches the local deployment profile before relaxing public endpoint transport constraints.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/token256",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26486,7 +25739,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26494,7 +25746,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26502,57 +25753,38 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "required",
+          "value": [
+            "profile"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/token256"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/representative_issuance",
+        "pointer": "/allOf/2/if/properties/deployment/properties/profile",
         "path_kind": "property"
       },
-      "purpose": "One digitally authenticated representative ceremony bound to an exact relationship proof. Registryctl derives the credential dependency, status endpoint, and secure proof-freshness default.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects the local-profile condition used by the environment transport-validation branch.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -26564,7 +25796,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26591,7 +25822,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26599,7 +25829,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26607,7 +25836,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -26617,42 +25845,33 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "relationship",
-            "proof_claim",
-            "target_id_type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "local"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/representative_issuance/properties/max_proof_age_seconds",
+        "pointer": "/properties/deployment",
         "path_kind": "property"
       },
-      "purpose": "Maximum age of the relationship proof. Omit for the secure 300-second default.",
+      "purpose": "Relay deployed in this environment and the operational profile it uses.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "schema_value": 300
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
@@ -26660,7 +25879,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26687,7 +25905,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26695,7 +25912,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26703,7 +25919,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -26713,136 +25928,36 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 600
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "profile",
+            "relay"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/representative_issuance/properties/proof_claim",
-        "path_kind": "property"
-      },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "operator_preflight",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
-      }
-    },
-    {
-      "address": {
-        "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/representative_issuance/properties/relationship",
+        "pointer": "/properties/deployment/properties/profile",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects the deployment assurance profile whose service and transport conditions the environment must satisfy.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -26852,7 +25967,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26879,7 +25993,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26887,7 +26000,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26895,7 +26007,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -26905,40 +26016,36 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "local",
+            "hosted_lab",
+            "production"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/representative_issuance/properties/target_id_type",
+        "pointer": "/properties/deployment/properties/relay",
         "path_kind": "property"
       },
-      "purpose": "Bounded visible-ASCII protocol token.",
+      "purpose": "Binds an authored product role to a deployed service identifier.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token256",
+        "local_reference": "#/$defs/service",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -26948,7 +26055,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26975,7 +26081,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26983,7 +26088,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26991,7 +26095,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -27001,34 +26104,28 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
+          "keyword": "required",
+          "value": [
+            "service"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/token256"
+        "pointer": "/$defs/service"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/sensitive_state_key",
+        "pointer": "/properties/development",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose": "Closed local-development selection. Registryctl uses the exact authored default and never prompts or guesses.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -27037,22 +26134,20 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27079,7 +26174,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27087,7 +26181,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27095,52 +26188,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "secret"
+            "source_mode",
+            "default_integration",
+            "default_fixture"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/subject",
+        "pointer": "/properties/development/properties/default_fixture",
         "path_kind": "property"
       },
-      "purpose": "Verified eSignet userinfo claim bound exactly to the credential subject identifier.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -27150,7 +26240,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27177,7 +26266,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27185,7 +26273,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27193,7 +26280,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -27203,25 +26289,26 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "token_claim",
-            "id_type"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/subject/properties/id_type",
+        "pointer": "/properties/development/properties/default_integration",
         "path_kind": "property"
       },
-      "purpose": "Bounded visible-ASCII protocol token.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -27230,7 +26317,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/token256",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
@@ -27245,7 +26332,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27272,7 +26358,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27280,7 +26365,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27288,7 +26372,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -27297,17 +26380,9 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "pattern",
-          "value": "^[!-~]+$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
@@ -27316,30 +26391,29 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/token256"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/subject/properties/token_claim",
+        "pointer": "/properties/development/properties/relay_port",
         "path_kind": "property"
       },
-      "purpose": "Bounded visible-ASCII protocol token.",
-      "purpose_source": "schema_description",
+      "purpose": "Overrides the loopback port exposed by the disposable local Relay runtime without changing a deployment endpoint.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/token256",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -27349,7 +26423,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27376,7 +26449,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27384,7 +26456,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27392,7 +26463,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -27402,45 +26472,35 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
+          "keyword": "maximum",
+          "value": 65535
         },
         {
-          "keyword": "minLength",
+          "keyword": "minimum",
           "value": 1
         },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/token256"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/tx_code",
+        "pointer": "/properties/development/properties/source_mode",
         "path_kind": "property"
       },
-      "purpose": "Transaction-code policy. Omit for the secure required-PIN default. Set required=false only for a bounded bearer-offer interoperability profile; the compiler fixes the offer lifetime at 300 seconds.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects whether the disposable local runtime uses the maintained synthetic source or an explicitly operator-bound source integration.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -27452,7 +26512,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27479,7 +26538,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27487,7 +26545,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27495,7 +26552,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -27505,25 +26561,29 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "enum",
+          "value": [
+            "synthetic",
+            "local_snapshot",
+            "operator_bound"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/tx_code/properties/required",
+        "pointer": "/properties/entities",
         "path_kind": "property"
       },
-      "purpose": "States whether OID4VCI authorization requires a transaction code before credential issuance.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Environment-specific source bindings keyed by entity identifier.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
         "composed": false
       },
@@ -27531,8 +26591,7 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "schema_value": true
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
@@ -27540,7 +26599,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27567,7 +26625,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27575,7 +26632,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27583,7 +26639,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -27592,42 +26647,46 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxProperties",
+          "value": 32
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/privateCidrs/items",
-        "path_kind": "array_item"
+        "pointer": "/properties/entities/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Maps an authored entity to provider columns and immutable source-generation identifiers.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/entity",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27654,7 +26713,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27662,7 +26720,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27670,61 +26727,64 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 64
-        },
-        {
-          "keyword": "minLength",
-          "value": 3
+          "keyword": "required",
+          "value": [
+            "provider",
+            "columns",
+            "source_revision",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/entity"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/properties/entities/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27751,7 +26811,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27759,7 +26818,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27767,43 +26825,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "path"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/delimiter",
+        "pointer": "/properties/integrations",
         "path_kind": "property"
       },
-      "purpose": "Selects the byte used to delimit fields in the bound CSV source.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Environment bindings keyed by authored integration identifier.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
@@ -27819,7 +26877,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27846,7 +26903,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27854,7 +26910,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27862,7 +26917,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -27872,37 +26926,34 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 255
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "maxProperties",
+          "value": 16
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/header_row",
-        "path_kind": "property"
+        "pointer": "/properties/integrations/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Selects the one-based CSV row containing source column headers.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Environment binding for an authored source integration.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/integration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -27914,7 +26965,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27941,7 +26991,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27949,7 +26998,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27957,36 +27005,38 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "source"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/integration"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/path",
-        "path_kind": "property"
+        "pointer": "/properties/integrations/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -27995,22 +27045,21 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/absolutePath",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28037,7 +27086,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28045,7 +27093,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28053,27 +27100,18 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
-        },
         {
           "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
@@ -28082,23 +27120,23 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/absolutePath"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/quote",
+        "pointer": "/properties/relay",
         "path_kind": "property"
       },
-      "purpose": "Selects the byte used to quote fields in the bound CSV source.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Public Relay identity and token-validation settings for a Relay deployment.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
@@ -28114,100 +27152,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "operator_preflight",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 255
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/type",
-        "path_kind": "property"
-      },
-      "purpose": "Selects CSV as the environment-owned materialization provider for an authored entity.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28234,7 +27178,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28242,7 +27185,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28250,7 +27192,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -28260,41 +27201,50 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "csv"
+          "keyword": "required",
+          "value": [
+            "origin",
+            "issuer",
+            "jwks_url",
+            "audience",
+            "allowed_clients"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/properties/relay/properties/allowed_clients",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Narrows Relay authentication to the operator-reviewed client identifiers listed for this environment.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28321,7 +27271,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28329,7 +27278,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28337,39 +27285,37 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "project_file",
-            "path",
-            "sheet"
-          ]
+          "keyword": "maxItems",
+          "value": 64
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/data_range",
-        "path_kind": "property"
+        "pointer": "/properties/relay/properties/allowed_clients/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Restricts entity materialization to the reviewed range within the selected worksheet.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -28379,7 +27325,7 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -28391,7 +27337,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28418,7 +27363,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28426,7 +27370,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28434,13 +27377,13 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -28460,17 +27403,109 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/header_row",
+        "pointer": "/properties/relay/properties/audience",
         "path_kind": "property"
       },
-      "purpose": "Selects the one-based XLSX row containing source column headers.",
+      "purpose": "Binds the token audience Relay requires so tokens issued for another service are rejected.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "operator_preflight",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.environment.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "environment",
+        "pointer": "/properties/relay/properties/consultation",
+        "path_kind": "property"
+      },
+      "purpose": "Explicit Relay consultation workload identity. The client must also appear in allowed_clients; the principal is the stable authorization identity bound to that client.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "field_type": {
+        "schema_types": [
+          "object"
         ],
         "composed": false
       },
@@ -28486,7 +27521,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28513,7 +27547,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28521,7 +27554,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28529,7 +27561,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -28539,26 +27570,25 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "client_id",
+            "principal_id"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/path",
+        "pointer": "/properties/relay/properties/consultation/properties/client_id",
         "path_kind": "property"
       },
-      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
+      "purpose": "Token client identifier dedicated to the Relay consultation lane; it must also appear in the environment allowed-client list.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -28567,7 +27597,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/absolutePath",
+        "local_reference": "#/$defs/token256",
         "composed": false
       },
       "requiredness": "required",
@@ -28582,7 +27612,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28609,7 +27638,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28617,7 +27645,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28625,7 +27652,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -28637,15 +27663,15 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 4096
+          "value": 256
         },
         {
           "keyword": "minLength",
-          "value": 2
+          "value": 1
         },
         {
           "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "value": "^[!-~]+$"
         },
         {
           "keyword": "type",
@@ -28654,17 +27680,17 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/absolutePath"
+        "pointer": "/$defs/token256"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/project_file",
+        "pointer": "/properties/relay/properties/consultation/properties/principal_id",
         "path_kind": "property"
       },
-      "purpose": "Binds a contained project-relative workbook for offline preflight and read-only runtime mounting without emitting the authoring path into Relay configuration.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Stable authorization principal Relay binds to the dedicated consultation client.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -28672,7 +27698,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/relativePath",
+        "local_reference": "#/$defs/token256",
         "composed": false
       },
       "requiredness": "required",
@@ -28687,7 +27713,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28714,7 +27739,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28722,7 +27746,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28730,7 +27753,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -28742,7 +27764,7 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 4096
+          "value": 256
         },
         {
           "keyword": "minLength",
@@ -28750,7 +27772,7 @@
         },
         {
           "keyword": "pattern",
-          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "value": "^[!-~]+$"
         },
         {
           "keyword": "type",
@@ -28759,39 +27781,37 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/relativePath"
+        "pointer": "/$defs/token256"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/sheet",
+        "pointer": "/properties/relay/properties/issuer",
         "path_kind": "property"
       },
-      "purpose": "Names the worksheet read from the environment-owned XLSX source.",
+      "purpose": "Binds the expected token issuer for Relay authentication in this deployment environment.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
+        "local_reference": "#/$defs/relayOrigin",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28818,7 +27838,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28826,7 +27845,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28834,42 +27852,34 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/relayOrigin"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/type",
+        "pointer": "/properties/relay/properties/jwks_url",
         "path_kind": "property"
       },
-      "purpose": "Selects XLSX as the environment-owned materialization provider for an authored entity.",
+      "purpose": "Binds the operator-reviewed key-set endpoint Relay uses to verify caller tokens.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [],
+        "local_reference": "#/$defs/relayResource",
         "composed": false
       },
       "requiredness": "required",
@@ -28879,12 +27889,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28911,7 +27920,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28919,7 +27927,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28927,29 +27934,28 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "xlsx"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/relayResource"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/2",
-        "path_kind": "branch"
+        "pointer": "/properties/relay/properties/local_api_keys",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Declares synthetic API-key principals only for the local profile; Registryctl generates raw keys privately and emits only their fingerprints to Relay.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -28959,19 +27965,18 @@
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28998,7 +28003,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29006,7 +28010,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29014,21 +28017,20 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "type",
-            "path"
+            "match_principal",
+            "no_match_principal",
+            "scopes"
           ]
         },
         {
@@ -29040,11 +28042,11 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/2/properties/path",
+        "pointer": "/properties/relay/properties/local_api_keys/properties/match_principal",
         "path_kind": "property"
       },
-      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
-      "purpose_source": "schema_description",
+      "purpose": "Binds the synthetic local caller whose reviewed identifier matches one starter row; this identifier is not a raw key or a source value.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -29052,7 +28054,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/absolutePath",
+        "local_reference": "#/$defs/token256",
         "composed": false
       },
       "requiredness": "required",
@@ -29067,7 +28069,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29094,7 +28095,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29102,7 +28102,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29110,7 +28109,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -29122,15 +28120,15 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 4096
+          "value": 256
         },
         {
           "keyword": "minLength",
-          "value": 2
+          "value": 1
         },
         {
           "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "value": "^[!-~]+$"
         },
         {
           "keyword": "type",
@@ -29139,37 +28137,39 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/absolutePath"
+        "pointer": "/$defs/token256"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/2/properties/type",
+        "pointer": "/properties/relay/properties/local_api_keys/properties/no_match_principal",
         "path_kind": "property"
       },
-      "purpose": "Selects Parquet as the environment-owned materialization provider for an authored entity.",
+      "purpose": "Binds the synthetic local caller whose reviewed identifier intentionally matches no starter row so an empty result is maintained.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/token256",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29196,7 +28196,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29204,7 +28203,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29212,51 +28210,66 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "parquet"
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[!-~]+$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/token256"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3",
-        "path_kind": "branch"
+        "pointer": "/properties/relay/properties/local_api_keys/properties/scopes",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Limits both generated local API-key callers to the explicitly reviewed service scopes needed by the maintained checks.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29283,7 +28296,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29291,7 +28303,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29299,62 +28310,61 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "connection",
-            "schema",
-            "table"
-          ]
+          "keyword": "maxItems",
+          "value": 16
+        },
+        {
+          "keyword": "minItems",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3/properties/connection",
-        "path_kind": "property"
+        "pointer": "/properties/relay/properties/local_api_keys/properties/scopes/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29381,7 +28391,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29389,7 +28398,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29397,63 +28405,57 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3/properties/schema",
+        "pointer": "/properties/relay/properties/origin",
         "path_kind": "property"
       },
-      "purpose": "Portable unquoted PostgreSQL schema or table identifier.",
-      "purpose_source": "schema_description",
+      "purpose": "Binds the externally visible Relay origin reviewed by the operator and local network policy.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/postgresIdentifier",
+        "schema_types": [],
+        "local_reference": "#/$defs/relayOrigin",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29480,7 +28482,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29488,7 +28489,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29496,50 +28496,40 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,62}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
+      "constraints": [],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/postgresIdentifier"
+        "pointer": "/$defs/relayOrigin"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3/properties/table",
+        "pointer": "/properties/relay_state",
         "path_kind": "property"
       },
-      "purpose": "Portable unquoted PostgreSQL schema or table identifier.",
+      "purpose": "Optional deployment binding for Relay-owned consultation PostgreSQL state transport trust.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/postgresIdentifier",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -29549,7 +28539,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29576,7 +28565,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29584,7 +28572,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29592,7 +28579,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -29602,32 +28588,32 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,62}$"
+          "keyword": "required",
+          "value": [
+            "postgresql"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/postgresIdentifier"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3/properties/type",
+        "pointer": "/properties/relay_state/properties/postgresql",
         "path_kind": "property"
       },
-      "purpose": "Selects PostgreSQL as the environment-owned materialization provider for an authored entity.",
+      "purpose": "Selects the PostgreSQL trust binding used by Relay state storage.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
       "requiredness": "required",
@@ -29642,7 +28628,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29669,7 +28654,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29677,7 +28661,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29685,7 +28668,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -29695,19 +28677,25 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "postgres"
+          "keyword": "required",
+          "value": [
+            "root_certificate_path"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/relayOrigin/anyOf/0",
-        "path_kind": "branch"
+        "pointer": "/properties/relay_state/properties/postgresql/properties/root_certificate_path",
+        "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
-      "purpose_source": "schema_description",
+      "purpose": "Binds Relay state storage to an operator-managed PostgreSQL trust root at a deployment-local path.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -29715,22 +28703,21 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/origin",
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29757,7 +28744,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29765,7 +28751,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29773,23 +28758,26 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 2
         },
         {
           "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
@@ -29798,40 +28786,36 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/origin"
+        "pointer": "/$defs/absolutePath"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/relayOrigin/anyOf/1",
-        "path_kind": "branch"
+        "pointer": "/properties/version",
+        "path_kind": "property"
       },
-      "purpose": "HTTP IP-loopback origin; public Relay and issuer fields restrict it to the local profile, while internal Notary-to-Relay connections allow it in any profile.",
+      "purpose": "Environment authoring format version.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/localLoopbackOrigin",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "public",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29858,7 +28842,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29866,7 +28849,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29874,53 +28856,38 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": 1
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/localLoopbackOrigin"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/relayResource/anyOf/0",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "",
+        "path_kind": "root"
       },
-      "purpose": "Exact HTTPS resource without query or fragment.",
+      "purpose": "Defines a product-neutral source adaptation contract using bounded HTTP, Rhai script, or exact snapshot capabilities.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/httpsResource",
         "composed": false
       },
-      "requiredness": "conditional",
+      "requiredness": "not_applicable",
       "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
@@ -29928,11 +28895,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29942,24 +28908,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": false,
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29967,7 +28932,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -29975,65 +28940,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
+          "keyword": "required",
+          "value": [
+            "version",
+            "id",
+            "revision",
+            "input",
+            "capability",
+            "outputs"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/httpsResource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/relayResource/anyOf/1",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/allowRule/properties/method",
+        "path_kind": "property"
       },
-      "purpose": "HTTP IP-loopback resource accepted only with the local deployment profile.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the GET or POST method permitted by one reviewed source allow rule.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/localLoopbackResource",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30043,24 +29002,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30068,7 +29026,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30076,45 +29034,35 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/[^?#]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "GET",
+            "POST"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/localLoopbackResource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/secret/properties/secret",
+        "schema": "integration",
+        "pointer": "/$defs/allowRule/properties/path",
         "path_kind": "property"
       },
-      "purpose": "Names the operator-managed environment secret reference without containing the secret value.",
+      "purpose": "Defines one reviewed source path template; concrete private endpoints and identifiers remain environment-owned.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "string"
@@ -30128,12 +29076,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "environment_bound",
+      "sensitivity": "sensitive",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30143,24 +29090,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30168,7 +29114,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30176,19 +29122,27 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "pattern",
-          "value": "^[A-Z_][A-Z0-9_]{0,127}$"
+          "value": "^/[^?#]*$"
         },
         {
           "keyword": "type",
@@ -30198,35 +29152,31 @@
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/service/properties/service",
+        "schema": "integration",
+        "pointer": "/$defs/allowRule/properties/semantics",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares that the permitted source operation has read-only semantics.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30236,24 +29186,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30261,7 +29210,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30269,9 +29218,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -30279,50 +29228,40 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "read_only"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/allowed_private_cidrs",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Explicit private network ranges this source may resolve to.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
-        "local_reference": "#/$defs/privateCidrs",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30332,24 +29271,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30357,7 +29295,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30365,53 +29303,46 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "required",
+          "value": [
+            "http"
+          ]
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/privateCidrs"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/ca",
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/0/properties/http",
         "path_kind": "property"
       },
-      "purpose": "Pinned certificate-authority file and its rotation generation.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the single-request declarative HTTP capability and its expected response semantics.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ca",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -30419,11 +29350,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30433,24 +29363,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30458,7 +29387,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30466,9 +29395,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -30478,38 +29407,34 @@
         {
           "keyword": "required",
           "value": [
-            "file",
-            "generation"
+            "request"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/ca"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/concurrency",
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/0/properties/http/properties/request",
         "path_kind": "property"
       },
-      "purpose": "Caps the number of requests that may be in flight concurrently for this source.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Bounded read-only HTTP request template.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/httpRequest",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -30517,11 +29442,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30531,24 +29455,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30556,7 +29479,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30564,9 +29487,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -30574,35 +29497,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 64
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "method",
+            "path"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/credential",
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/0/properties/http/properties/response",
         "path_kind": "property"
       },
-      "purpose": "One supported source credential shape, containing references rather than values.",
+      "purpose": "Rules for translating upstream status and body cardinality into normalized outcomes.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/credential",
+        "local_reference": "#/$defs/httpResponse",
         "composed": false
       },
       "requiredness": "optional",
@@ -30613,11 +29539,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30627,24 +29552,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30652,7 +29576,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30660,51 +29584,54 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/credential"
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/jwks",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Security-bound HTTPS endpoint with optional private-network, CA, and mTLS policy.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/endpoint",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30714,24 +29641,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30739,7 +29665,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30747,52 +29673,46 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "origin",
-            "path",
-            "generation"
+            "script"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/endpoint"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/mtls",
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/1/properties/script",
         "path_kind": "property"
       },
-      "purpose": "Client certificate and private-key reference for mutual TLS.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
-      "field_type": {
+      "purpose": "Selects the reviewed project-relative script capability and its optional modules.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/mtls",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -30800,11 +29720,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30814,24 +29733,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30839,7 +29757,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30847,9 +29765,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -30859,52 +29777,45 @@
         {
           "keyword": "required",
           "value": [
-            "certificate_file",
-            "private_key",
-            "generation"
+            "file"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/mtls"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/oauth",
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/1/properties/script/properties/file",
         "path_kind": "property"
       },
-      "purpose": "Security-bound HTTPS endpoint with optional private-network, CA, and mTLS policy.",
+      "purpose": "Project-relative path without traversal or duplicate separators.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/endpoint",
+        "local_reference": "#/$defs/relativePath",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "sensitive",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30914,24 +29825,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30939,7 +29849,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30947,64 +29857,67 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "origin",
-            "path",
-            "generation"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/endpoint"
+        "schema": "integration",
+        "pointer": "/$defs/relativePath"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/origin",
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/1/properties/script/properties/modules",
         "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Lists the reviewed project-relative modules available to the integration script.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/origin",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31014,24 +29927,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31039,7 +29951,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31047,9 +29959,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -31058,53 +29970,49 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
+          "keyword": "maxItems",
+          "value": 32
         },
         {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
+          "keyword": "type",
+          "value": "array"
         },
         {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/origin"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/rate",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/1/properties/script/properties/modules/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Defines the per-minute request rate and burst bounds applied to one environment source.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Project-relative path without traversal or duplicate separators.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/relativePath",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31114,24 +30022,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31139,7 +30046,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31147,58 +30054,67 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "per_minute",
-            "burst"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/relativePath"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/rate/properties/burst",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/2",
+        "path_kind": "branch"
       },
-      "purpose": "Caps the short request burst permitted by the source rate limiter.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31208,24 +30124,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31233,7 +30148,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31241,43 +30156,42 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 1024
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "snapshot"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/rate/properties/per_minute",
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/2/properties/snapshot",
         "path_kind": "property"
       },
-      "purpose": "Caps the number of requests permitted to this source during one minute.",
+      "purpose": "Selects an offline entity snapshot capability with exact input matching and freshness control.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
@@ -31289,11 +30203,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31303,24 +30216,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31328,7 +30240,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31336,9 +30248,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -31346,37 +30258,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 60000
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "entity",
+            "exact",
+            "freshness"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/timeout",
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/entity",
         "path_kind": "property"
       },
-      "purpose": "Optionally narrows one environment source request to a positive timeout no greater than twenty seconds.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -31384,11 +30297,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31398,24 +30310,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31423,7 +30334,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31431,9 +30342,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -31442,42 +30353,47 @@
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-9]{4}|20000)ms|(?:[1-9]|1[0-9]|20)s)$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/0",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/exact",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Maps entity fields to integration inputs that must match exactly in the snapshot lookup.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31487,24 +30403,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31512,7 +30427,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31520,45 +30435,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maxProperties",
+          "value": 8
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/0/else",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/exact/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Reference to a declared integration input.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/inputReference",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31568,24 +30497,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31593,7 +30521,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31601,45 +30529,61 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "input"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputReference"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/0/else/not",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/freshness",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Sets the maximum accepted age of the materialized entity snapshot within the product-owned 31-day ceiling.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31649,24 +30593,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31674,7 +30617,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31682,37 +30625,40 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "relay"
-          ]
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,8}|1[0-9]{9}|2[0-5][0-9]{8}|26[0-6][0-9]{7}|267[0-7][0-9]{6}|2678[0-3][0-9]{5}|2678400000)ms|(?:[1-9][0-9]{0,5}|1[0-9]{6}|2[0-5][0-9]{5}|26[0-6][0-9]{4}|267[0-7][0-9]{3}|2678[0-3][0-9]{2}|2678400)s|(?:[1-9][0-9]{0,3}|[1-3][0-9]{4}|4[0-3][0-9]{3}|44[0-5][0-9]{2}|446[0-3][0-9]{1}|44640)m|(?:[1-9][0-9]{0,1}|[1-6][0-9]{2}|7[0-3][0-9]{1}|74[0-3]|744)h|(?:[1-9][0-9]{0,0}|[1-2][0-9]{1}|30|31)d)$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/0/if",
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
       "requiredness": "conditional",
@@ -31723,11 +30669,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31737,24 +30682,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31762,7 +30706,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31770,9 +30714,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -31783,22 +30727,26 @@
         {
           "keyword": "required",
           "value": [
-            "deployment"
+            "type"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/0/if/properties/deployment",
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/0/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Matches environments whose deployment declaration enables Relay so the corresponding Relay binding is required.",
+      "purpose": "Selects an unauthenticated, basic-authentication, or static-bearer credential interface.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
@@ -31811,11 +30759,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31825,24 +30772,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31850,7 +30796,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31858,9 +30804,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -31868,26 +30814,30 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "relay"
+            "none",
+            "basic",
+            "static_bearer"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/0/then",
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/1",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
       "requiredness": "conditional",
@@ -31898,11 +30848,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31912,24 +30861,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31937,7 +30885,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31945,9 +30893,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -31958,39 +30906,46 @@
         {
           "keyword": "required",
           "value": [
-            "relay"
+            "type",
+            "name",
+            "max_value_bytes"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/1",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/1/properties/max_value_bytes",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Caps the credential value size accepted by the fixed-header API-key interface.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32000,24 +30955,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32025,7 +30979,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32033,45 +30987,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 4096
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/1/if",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/1/properties/name",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares the fixed HTTP header name used by the API-key credential interface.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32081,24 +31048,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32106,7 +31072,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32114,52 +31080,52 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "notary_relay"
-          ]
+          "keyword": "pattern",
+          "value": "^[A-Za-z][A-Za-z0-9_-]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/1/then",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/1/properties/type",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the fixed-header API-key credential interface for this source contract.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32169,24 +31135,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32194,7 +31159,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32202,45 +31167,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "const",
+          "value": "api_key_header"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/1/then/properties/deployment",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/2",
+        "path_kind": "branch"
       },
-      "purpose": "Requires both Relay and Notary deployment services when a Notary-to-Relay binding is present.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32250,24 +31220,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32275,7 +31244,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32283,52 +31252,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "relay",
-            "notary"
+            "type",
+            "name",
+            "max_value_bytes"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/2",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/2/properties/max_value_bytes",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Caps the credential value size accepted by the fixed-query API-key interface.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32338,24 +31314,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32363,7 +31338,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32371,45 +31346,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 4096
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/2/if",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/2/properties/name",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares the fixed query parameter name used by the API-key credential interface.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32419,24 +31407,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32444,7 +31431,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32452,52 +31439,52 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "relay_state"
-          ]
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9._:~-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/2/then",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/2/properties/type",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the fixed-query-parameter API-key credential interface for this source contract.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32507,24 +31494,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32532,7 +31518,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32540,45 +31526,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "const",
+          "value": "api_key_query"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/2/then/properties/deployment",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3",
+        "path_kind": "branch"
       },
-      "purpose": "Requires the Relay deployment service when Relay state storage is configured.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
-        "composed": false
+        "schema_types": [
+          "object"
+        ],
+        "composed": true
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32588,24 +31579,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32613,7 +31603,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32621,34 +31611,41 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "relay"
+            "type",
+            "request",
+            "response_profile"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/3",
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/allOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
@@ -32661,11 +31658,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32675,24 +31671,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32700,7 +31695,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32708,9 +31703,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -32721,15 +31716,15 @@
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/3/if",
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/allOf/0/if",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
@@ -32742,11 +31737,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32756,24 +31750,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32781,7 +31774,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32789,9 +31782,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -32802,39 +31795,38 @@
         {
           "keyword": "required",
           "value": [
-            "notary_state"
+            "response_profile"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/3/then",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/allOf/0/if/properties/response_profile",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Matches the strict no-expiry bearer profile before applying its refresh-control constraint.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32844,24 +31836,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32869,7 +31860,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32877,45 +31868,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "const",
+          "value": "oauth2_bearer_no_expiry"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/3/then/properties/deployment",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/allOf/0/then",
+        "path_kind": "branch"
       },
-      "purpose": "Requires the Notary deployment service when Notary state storage is configured.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32925,24 +31919,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32950,7 +31943,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32958,34 +31951,28 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "notary"
-          ]
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/4",
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/allOf/0/then/not",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
@@ -32998,11 +31985,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33012,24 +31998,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33037,7 +32022,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33045,45 +32030,53 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
         "branch_has_no_authored_value"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "refresh_skew"
+          ]
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/4/if",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/properties/audience",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Constrains OAuth token acquisition to the reviewed source audience and is treated as sensitive operational metadata.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "sensitive",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33093,24 +32086,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33118,7 +32110,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33126,52 +32118,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "notary_cel"
-          ]
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/4/then",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/properties/refresh_skew",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "With oauth2_bearer, sets a positive refresh interval below sixty seconds so a cached OAuth credential retains usable lifetime. The no-expiry profile rejects this field because caching is disabled.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33181,24 +32180,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33206,7 +32204,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33214,33 +32212,41 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,3}|[1-5][0-9]{4})ms|(?:[1-9]|[1-5][0-9])s)$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/4/then/properties/deployment",
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/properties/request",
         "path_kind": "property"
       },
-      "purpose": "Requires the Notary deployment service when a Notary CEL worker memory bound is configured.",
+      "purpose": "Selects form-encoded or JSON token requests for the OAuth client-credentials interface.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -33248,11 +32254,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33262,24 +32267,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33287,7 +32291,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33295,9 +32299,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -33305,41 +32309,41 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "notary"
+            "form",
+            "json"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/5",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/properties/response_profile",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects an exact OAuth bearer-token response shape. oauth2_bearer requires access_token, token_type Bearer, and a bounded expires_in value and permits expiry-bound caching. oauth2_bearer_no_expiry requires only access_token and token_type Bearer, rejects expiry and extra fields, and disables token caching.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33349,24 +32353,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33374,7 +32377,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33382,45 +32385,53 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "oauth2_bearer",
+            "oauth2_bearer_no_expiry"
+          ]
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/5/else",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/properties/scope",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares the bounded OAuth scope string requested for this source credential.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33430,24 +32441,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33455,7 +32465,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33463,33 +32473,45 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 1024
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/5/else/properties/callers",
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/properties/type",
         "path_kind": "property"
       },
-      "purpose": "When callers are authored without OID4VCI, requires the caller map to contain at least one binding; cross-file validation separately requires callers for Notary environments and rejects them for Relay-only topology.",
+      "purpose": "Selects the OAuth 2.0 client-credentials interface for source authentication.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -33497,11 +32519,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33511,24 +32532,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33536,7 +32556,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33544,9 +32564,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -33554,39 +32574,38 @@
       ],
       "constraints": [
         {
-          "keyword": "minProperties",
-          "value": 1
+          "keyword": "const",
+          "value": "oauth2_client_credentials"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/5/if",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest/properties/body",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Defines the optional authored body template sent by the declarative HTTP request.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33596,24 +32615,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33621,7 +32639,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33629,52 +32647,45 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "oid4vci"
-          ]
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/5/then",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest/properties/headers",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Maps reviewed request header names to authored values and input substitutions.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33684,24 +32695,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33709,7 +32719,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33717,52 +32727,57 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "notary_state"
-          ]
+          "keyword": "maxProperties",
+          "value": 32
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/5/then/properties/deployment",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest/properties/headers/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Requires the Notary deployment service when OID4VCI issuance is configured.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Request value supplied from a declared input or an authored scalar literal.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "boolean",
+          "integer",
+          "string"
+        ],
+        "local_reference": "#/$defs/inputOrLiteral",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33772,24 +32787,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33797,7 +32811,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33805,51 +32819,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "notary"
-          ]
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputOrLiteral"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest/properties/method",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the single GET or POST request performed by a declarative HTTP capability.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33859,24 +32870,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33884,7 +32894,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33892,45 +32902,53 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "GET",
+            "POST"
+          ]
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest/properties/path",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Defines the reviewed source path template used by the declarative HTTP request.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "sensitive",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33940,24 +32958,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33965,7 +32982,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33973,30 +32990,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "sensitive_operational_metadata"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/[^?#]*$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci",
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest/properties/query",
         "path_kind": "property"
       },
-      "purpose": "Applies non-local HTTPS constraints to public OID4VCI endpoints.",
+      "purpose": "Maps reviewed query parameter names to authored request values and input substitutions.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
       "requiredness": "optional",
@@ -34007,11 +33043,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34021,24 +33056,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34046,7 +33080,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34054,44 +33088,57 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maxProperties",
+          "value": 64
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest/properties/query/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Applies non-local HTTPS constraints to all configured OID4VCI authorization-server endpoints.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Request value supplied from a declared input or an authored scalar literal.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "boolean",
+          "integer",
+          "string"
+        ],
+        "local_reference": "#/$defs/inputOrLiteral",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34101,24 +33148,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34126,7 +33172,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34134,47 +33180,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
-      "constraints": []
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputOrLiteral"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/authorize_url",
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest/properties/semantics",
         "path_kind": "property"
       },
-      "purpose": "Exact HTTPS resource without query or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares that the declarative HTTP request has read-only source semantics.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/httpsResource",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34184,24 +33231,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34209,7 +33255,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34217,65 +33263,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "read_only"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/httpsResource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/issuer",
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/ambiguous",
         "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Lists HTTP response statuses that produce the integration's ambiguous outcome.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/origin",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34285,24 +33316,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34310,7 +33340,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34318,65 +33348,54 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
+          "keyword": "type",
+          "value": "array"
         },
         {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/origin"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/jwks_url",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/ambiguous/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Exact HTTPS resource without query or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/httpsResource",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34386,24 +33405,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34411,7 +33429,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34419,65 +33437,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
+          "keyword": "maximum",
+          "value": 599
         },
         {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
+          "keyword": "minimum",
+          "value": 100
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/httpsResource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/token_url",
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/no_match",
         "path_kind": "property"
       },
-      "purpose": "Exact HTTPS resource without query or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Lists HTTP response statuses that produce the integration's no-match outcome.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/httpsResource",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34487,24 +33499,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34512,7 +33523,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34520,65 +33531,54 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
+          "keyword": "type",
+          "value": "array"
         },
         {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/httpsResource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/userinfo_url",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/no_match/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Exact HTTPS resource without query or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/httpsResource",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34588,24 +33588,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34613,7 +33612,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34621,65 +33620,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
+          "keyword": "maximum",
+          "value": 599
         },
         {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
+          "keyword": "minimum",
+          "value": 100
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/httpsResource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/public_base_url",
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/shape",
         "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares whether a successful response is a singleton or a bounded collection.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/origin",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34689,24 +33682,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34714,7 +33706,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34722,65 +33714,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
+        "generated_docs_never_load_country_values"
       ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/origin"
-      }
+      "constraints": []
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/redirect_uri",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/shape/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Exact HTTPS resource without query or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/httpsResource",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34790,24 +33760,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34815,7 +33784,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34823,62 +33792,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "singleton"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/httpsResource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/representative_issuance",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/shape/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Applies non-local HTTPS constraints to representative issuance.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34888,24 +33846,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34913,7 +33870,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34921,32 +33878,45 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "records",
+            "cardinality"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/relay",
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/shape/oneOf/1/properties/cardinality",
         "path_kind": "property"
       },
-      "purpose": "Applies non-local HTTPS constraints to the Relay origin, issuer, and key-set bindings.",
+      "purpose": "Requires two-record probing so collection results distinguish one match from ambiguity.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -34954,11 +33924,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34968,24 +33937,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34993,7 +33961,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35001,44 +33969,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "const",
+          "value": "probe_two"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/relay/not",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/shape/oneOf/1/properties/records",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the canonical response location containing collection records.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35048,24 +34022,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35073,7 +34046,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35081,55 +34054,52 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "local_api_keys"
-          ]
+          "keyword": "pattern",
+          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/relay/properties/issuer",
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/canonicalization",
         "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the reviewed normalization rule applied before an input is compared, interpolated, or sent to a source.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/origin",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35139,24 +34109,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35164,7 +34133,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35172,65 +34141,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "identity",
+            "ascii_lowercase"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/origin"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/relay/properties/jwks_url",
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/format",
         "path_kind": "property"
       },
-      "purpose": "Exact HTTPS resource without query or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Applies the full-date semantic format to a string-valued integration input.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/httpsResource",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35240,24 +34195,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35265,7 +34219,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35273,65 +34227,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "date"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/httpsResource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/relay/properties/origin",
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/maxLength",
         "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Caps a string-valued integration input at 1,024 Unicode scalar values, deriving its conservative 4,096-byte UTF-8 ceiling.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/origin",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35341,24 +34280,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35366,7 +34304,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35374,62 +34312,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
+          "keyword": "maximum",
+          "value": 1024
         },
         {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/origin"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/if",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/maximum",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Sets the inclusive upper bound accepted for an integer-valued integration input.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35439,24 +34373,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35464,7 +34397,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35472,30 +34405,44 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 9007199254740991
+        },
+        {
+          "keyword": "minimum",
+          "value": -9007199254740991
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/if/properties/deployment",
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/minLength",
         "path_kind": "property"
       },
-      "purpose": "Matches the local deployment profile before relaxing public endpoint transport constraints.",
+      "purpose": "Sets the minimum character length accepted for a string-valued integration input.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
       "requiredness": "optional",
@@ -35506,11 +34453,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35520,24 +34466,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35545,7 +34490,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35553,9 +34498,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -35563,29 +34508,37 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "profile"
-          ]
+          "keyword": "maximum",
+          "value": 16384
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/if/properties/deployment/properties/profile",
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/minimum",
         "path_kind": "property"
       },
-      "purpose": "Selects the local-profile condition used by the environment transport-validation branch.",
+      "purpose": "Sets the inclusive lower bound accepted for an integer-valued integration input.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -35593,11 +34546,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35607,24 +34559,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35632,7 +34583,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35640,9 +34591,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -35650,41 +34601,48 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "local"
+          "keyword": "maximum",
+          "value": 9007199254740991
+        },
+        {
+          "keyword": "minimum",
+          "value": -9007199254740991
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/callers",
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/pattern",
         "path_kind": "property"
       },
-      "purpose": "Notary API-key caller identities and the scopes each identity receives.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Constrains a string-valued integration input with the authored regular expression.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35694,24 +34652,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35719,7 +34676,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35727,9 +34684,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -35737,33 +34694,35 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 64
+          "keyword": "maxLength",
+          "value": 16384
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/callers/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/role",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares how one typed authoring input participates in source lookup, selection, or result shaping.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -35771,11 +34730,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35785,24 +34743,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35810,7 +34767,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35818,45 +34775,40 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "api_key_fingerprint",
-            "scopes"
+            "selector",
+            "parameter"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/callers/additionalProperties/properties/api_key_fingerprint",
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Names the secret reference used to verify one caller API key; neither the key nor fingerprint value is authored here.",
+      "purpose": "Declares the closed scalar or array type accepted for one integration input.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/secret",
+        "local_reference": "#/$defs/scalarType",
         "composed": false
       },
       "requiredness": "required",
@@ -35866,12 +34818,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35881,24 +34832,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35906,7 +34856,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35914,62 +34864,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
+        "generated_docs_never_load_country_values"
       ],
+      "constraints": [],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
+        "schema": "integration",
+        "pointer": "/$defs/scalarType"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/callers/additionalProperties/properties/scopes",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/inputOrLiteral/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Narrows one caller to the explicitly reviewed service scopes available in this environment.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Reference to a declared integration input.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/inputReference",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35979,24 +34917,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36004,7 +34941,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36012,63 +34949,63 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "input"
+          ]
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputReference"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/callers/additionalProperties/properties/scopes/items",
-        "path_kind": "array_item"
+        "schema": "integration",
+        "pointer": "/$defs/inputOrLiteral/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
+          "boolean",
+          "integer",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36078,24 +35015,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36103,7 +35039,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36111,49 +35047,45 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "boolean",
+            "integer"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/callers/propertyNames",
-        "path_kind": "map_key"
+        "schema": "integration",
+        "pointer": "/$defs/inputReference/properties/input",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Portable lowercase name for an integration input or output.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -36161,11 +35093,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36175,24 +35106,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36200,7 +35130,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36208,19 +35138,18 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         },
         {
           "keyword": "type",
@@ -36228,40 +35157,39 @@
         }
       ],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/deployment",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/integrationRequestByteSize/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Products deployed in this environment and the operational profile they use.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36271,24 +35199,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36296,7 +35223,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36304,40 +35231,45 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "profile"
-          ]
+          "keyword": "maximum",
+          "value": 1048576
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/deployment/anyOf/0",
+        "schema": "integration",
+        "pointer": "/$defs/integrationRequestByteSize/oneOf/1",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
       "requiredness": "conditional",
@@ -36348,11 +35280,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36362,24 +35293,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36387,7 +35317,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36395,9 +35325,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -36406,26 +35336,30 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "relay"
-          ]
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,2}|10[0-1][0-9]|102[0-4])KiB|1MiB)$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/deployment/anyOf/1",
+        "schema": "integration",
+        "pointer": "/$defs/integrationResponseByteSize/oneOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
       "requiredness": "conditional",
@@ -36436,11 +35370,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36450,24 +35383,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36475,7 +35407,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36483,9 +35415,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -36494,44 +35426,48 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "notary"
-          ]
+          "keyword": "maximum",
+          "value": 8388608
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/deployment/properties/notary",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/integrationResponseByteSize/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Binds an authored product role to a deployed service identifier.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/service",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36541,24 +35477,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36566,7 +35501,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36574,59 +35509,55 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "service"
-          ]
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,2}|[1-7][0-9]{3}|80[0-9]{2}|81[0-8][0-9]|819[0-2])KiB|[1-8]MiB)$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/service"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/deployment/properties/profile",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/integrationSourceByteSize/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Selects the deployment assurance profile whose service and transport conditions the environment must satisfy.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36636,24 +35567,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36661,7 +35591,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36669,57 +35599,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "local",
-            "hosted_lab",
-            "production",
-            "evidence_grade"
-          ]
+          "keyword": "maximum",
+          "value": 16777216
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/deployment/properties/relay",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/integrationSourceByteSize/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Binds an authored product role to a deployed service identifier.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/service",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36729,24 +35661,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36754,7 +35685,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36762,45 +35693,40 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "service"
-          ]
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-5][0-9]{3}|16[0-2][0-9]{2}|163[0-7][0-9]|1638[0-4])KiB|(?:[1-9]|1[0-6])MiB)$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/service"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/development",
+        "schema": "integration",
+        "pointer": "/$defs/limits/properties/calls",
         "path_kind": "property"
       },
-      "purpose": "Closed local-development selection. Registryctl uses the exact authored default and never prompts or guesses.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Caps the number of high-level source calls available to a script integration.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
@@ -36812,11 +35738,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36826,24 +35751,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36851,7 +35775,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36859,9 +35783,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -36869,38 +35793,37 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "source_mode",
-            "default_integration",
-            "default_fixture"
-          ]
+          "keyword": "maximum",
+          "value": 16
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/development/properties/default_fixture",
+        "schema": "integration",
+        "pointer": "/$defs/limits/properties/deadline",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Caps total integration execution time with a positive duration no greater than twenty seconds.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -36908,11 +35831,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36922,24 +35844,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36947,7 +35868,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36955,9 +35876,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -36966,49 +35887,46 @@
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-9]{4}|20000)ms|(?:[1-9]|1[0-9]|20)s)$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/development/properties/default_integration",
+        "schema": "integration",
+        "pointer": "/$defs/limits/properties/request_bytes",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Maximum aggregate author-controlled request bytes for one execution, defaulting to 64 KiB and capped at 1 MiB. Use a positive byte integer or canonical KiB/MiB value.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
+          "integer",
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/integrationRequestByteSize",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
-      },
+        "behavior": "schema_default",
+        "schema_value": "64KiB"
+      },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37018,24 +35936,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37043,7 +35960,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37051,59 +35968,52 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
+      "constraints": [],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
+        "schema": "integration",
+        "pointer": "/$defs/integrationRequestByteSize"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/development/properties/notary_port",
+        "schema": "integration",
+        "pointer": "/$defs/limits/properties/source_bytes",
         "path_kind": "property"
       },
-      "purpose": "Overrides the loopback port exposed by the disposable local Notary runtime without changing a deployment endpoint.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Maximum aggregate source-response bytes for one execution, defaulting to 2 MiB and capped at 16 MiB. Use a positive byte integer or canonical KiB/MiB value.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "integer",
+          "string"
         ],
+        "local_reference": "#/$defs/integrationSourceByteSize",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "schema_value": "2MiB"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37113,24 +36023,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37138,7 +36047,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37146,44 +36055,36 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 65535
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/integrationSourceByteSize"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/development/properties/relay_port",
+        "schema": "integration",
+        "pointer": "/$defs/notApplicable/properties/ambiguity",
         "path_kind": "property"
       },
-      "purpose": "Overrides the loopback port exposed by the disposable local Relay runtime without changing a deployment endpoint.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Why the reviewed source contract cannot produce more than one matching record.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/notApplicableReason",
         "composed": false
       },
       "requiredness": "optional",
@@ -37194,11 +36095,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37208,24 +36108,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37233,7 +36132,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37241,9 +36140,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -37251,35 +36150,41 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 65535
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "rationale",
+            "request_fixture"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/notApplicableReason"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/development/properties/source_mode",
+        "schema": "integration",
+        "pointer": "/$defs/notApplicable/properties/subject_mismatch",
         "path_kind": "property"
       },
-      "purpose": "Selects whether the disposable local runtime uses the maintained synthetic source or an explicitly operator-bound source integration.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Why the reviewed response contract contains no identifier comparable with a requested selector.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/notApplicableReason",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -37287,11 +36192,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37301,24 +36205,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37326,7 +36229,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37334,9 +36237,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -37344,45 +36247,51 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "synthetic",
-            "local_snapshot",
-            "operator_bound"
+            "rationale",
+            "request_fixture"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/notApplicableReason"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/entities",
+        "schema": "integration",
+        "pointer": "/$defs/notApplicableReason/properties/rationale",
         "path_kind": "property"
       },
-      "purpose": "Environment-specific source bindings keyed by entity identifier.",
+      "purpose": "Why the named normally required outcome cannot occur for this source contract.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37392,24 +36301,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37417,7 +36325,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37425,9 +36333,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -37435,46 +36343,49 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 32
+          "keyword": "maxLength",
+          "value": 512
+        },
+        {
+          "keyword": "minLength",
+          "value": 24
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/entities/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "integration",
+        "pointer": "/$defs/notApplicableReason/properties/request_fixture",
+        "path_kind": "property"
       },
-      "purpose": "Maps an authored entity to provider columns and immutable source-generation identifiers.",
+      "purpose": "Fixture name containing the supporting bounded source request.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/entity",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37484,24 +36395,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37509,7 +36419,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37517,66 +36427,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "provider",
-            "columns",
-            "source_revision",
-            "generation"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/entity"
+        "schema": "integration",
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/entities/propertyNames",
-        "path_kind": "map_key"
+        "schema": "integration",
+        "pointer": "/$defs/output/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Type, scalar bounds, and optional source pointer for one normalized scalar integration output.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/scalarOutput",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37586,24 +36489,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37611,7 +36513,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37619,60 +36521,62 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "type"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
+        "schema": "integration",
+        "pointer": "/$defs/scalarOutput"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/integrations",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/output/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Environment bindings keyed by authored integration identifier.",
+      "purpose": "A recursively typed object output with a canonical byte ceiling and an always-closed field map.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/outputObject",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37682,24 +36586,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37707,7 +36610,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37715,56 +36618,65 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
+          "keyword": "required",
+          "value": [
+            "type",
+            "nullable",
+            "max_bytes",
+            "fields"
+          ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputObject"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/integrations/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "integration",
+        "pointer": "/$defs/output/oneOf/2",
+        "path_kind": "branch"
       },
-      "purpose": "Environment binding for an authored source integration.",
+      "purpose": "A recursively typed array output with canonical byte and item-count ceilings.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/integration",
+        "local_reference": "#/$defs/outputArray",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37774,24 +36686,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37799,7 +36710,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37807,20 +36718,24 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "source"
+            "type",
+            "nullable",
+            "max_bytes",
+            "max_items",
+            "items"
           ]
         },
         {
@@ -37829,41 +36744,38 @@
         }
       ],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/integration"
+        "schema": "integration",
+        "pointer": "/$defs/outputArray"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/integrations/propertyNames",
-        "path_kind": "map_key"
+        "schema": "integration",
+        "pointer": "/$defs/outputArray/properties/items",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "A recursively closed structured output schema without a source pointer.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
+        "local_reference": "#/$defs/outputSchema",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37873,24 +36785,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37898,7 +36809,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37906,48 +36817,38 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
+        "generated_docs_never_load_country_values"
       ],
+      "constraints": [],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
+        "schema": "integration",
+        "pointer": "/$defs/outputSchema"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/issuance",
+        "schema": "integration",
+        "pointer": "/$defs/outputArray/properties/max_bytes",
         "path_kind": "property"
       },
-      "purpose": "Notary issuer and signing-key bindings for credential issuance.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Caps the canonical serialized size of one structured output array.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -37955,11 +36856,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37969,24 +36869,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37994,7 +36893,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38002,9 +36901,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -38012,49 +36911,48 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "issuer",
-            "signing_key",
-            "signing_kid",
-            "generation"
-          ]
+          "keyword": "maximum",
+          "value": 65536
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/issuance/properties/algorithm",
+        "schema": "integration",
+        "pointer": "/$defs/outputArray/properties/max_items",
         "path_kind": "property"
       },
-      "purpose": "Credential issuer signing algorithm. Holder proof remains EdDSA with did:jwk.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Caps the number of values released in one structured output array.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "schema_value": "EdDSA"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38064,24 +36962,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38089,7 +36986,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38097,9 +36994,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -38107,28 +37004,33 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "EdDSA",
-            "ES256"
-          ]
+          "keyword": "maximum",
+          "value": 256
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/issuance/properties/generation",
+        "schema": "integration",
+        "pointer": "/$defs/outputArray/properties/nullable",
         "path_kind": "property"
       },
-      "purpose": "Records the operator-controlled issuance-key generation used for explicit rotation and rollback checks.",
+      "purpose": "Declares whether the complete structured output array may be null.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -38139,12 +37041,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38154,24 +37055,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38179,7 +37079,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38187,60 +37087,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/issuance/properties/issuer",
+        "schema": "integration",
+        "pointer": "/$defs/outputArray/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Binds the operator-approved credential issuer identifier without granting claim or disclosure authority.",
+      "purpose": "Selects the array form for a structured integration output.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38250,24 +37138,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38275,7 +37162,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38283,42 +37170,36 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/issuance/properties/signing_key",
+        "schema": "integration",
+        "pointer": "/$defs/outputObject/properties/fields",
         "path_kind": "property"
       },
-      "purpose": "Names the operator-managed secret reference for credential signing; the signing key value is never authored or reported.",
+      "purpose": "Declares the bounded closed map of fields released in one structured output object.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/secret",
         "composed": false
       },
       "requiredness": "required",
@@ -38328,12 +37209,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38343,24 +37223,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38368,7 +37247,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38376,63 +37255,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maxProperties",
+          "value": 32
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/issuance/properties/signing_kid",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/outputObject/properties/fields/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Selects the reviewed signing-key identifier exposed in issued credential metadata without containing private key material.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Requiredness and recursive schema for one named field of a closed structured output object.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token2048",
+        "local_reference": "#/$defs/outputObjectField",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38442,24 +37317,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38467,7 +37341,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38475,68 +37349,63 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
+          "keyword": "required",
+          "value": [
+            "required",
+            "schema"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/token2048"
+        "schema": "integration",
+        "pointer": "/$defs/outputObjectField"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_cel",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/outputObject/properties/fields/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Optional per-worker data/address-space ceiling for dedicated Notary CEL processes. The Notary default is 134217728 bytes; 1073741824 is the maximum emulation-compatible exception and remains a limit, not an allocation.",
+      "purpose": "Portable lowercase name for an integration input or output.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38546,24 +37415,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38571,7 +37439,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38579,38 +37447,41 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "worker_memory_bytes"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_cel/properties/worker_memory_bytes",
+        "schema": "integration",
+        "pointer": "/$defs/outputObject/properties/max_bytes",
         "path_kind": "property"
       },
-      "purpose": "Caps the memory available to one isolated Notary CEL worker.",
+      "purpose": "Caps the canonical serialized size of one structured output object.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "integer"
@@ -38625,11 +37496,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38639,24 +37509,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38664,7 +37533,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38672,9 +37541,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -38683,11 +37552,11 @@
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 1073741824
+          "value": 65536
         },
         {
           "keyword": "minimum",
-          "value": 33554432
+          "value": 1
         },
         {
           "keyword": "type",
@@ -38697,22 +37566,22 @@
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_relay",
+        "schema": "integration",
+        "pointer": "/$defs/outputObject/properties/nullable",
         "path_kind": "property"
       },
-      "purpose": "Deployment-internal Relay connection, Notary workload identity, and token file used only when Notary consults Relay.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares whether the complete structured output object may be null.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -38720,11 +37589,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38734,24 +37602,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38759,7 +37626,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38767,43 +37634,34 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "base_url",
-            "workload_client_id",
-            "token_file"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_relay/properties/base_url",
+        "schema": "integration",
+        "pointer": "/$defs/outputObject/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Binds Notary to the operator-reviewed Relay origin used for governed evidence consultations.",
+      "purpose": "Selects the closed object form for a structured integration output.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
-        "local_reference": "#/$defs/internalOrigin",
         "composed": false
       },
       "requiredness": "required",
@@ -38813,12 +37671,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38828,24 +37685,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38853,7 +37709,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38861,51 +37717,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/internalOrigin"
-      }
+      "constraints": [
+        {
+          "keyword": "const",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_relay/properties/token_file",
+        "schema": "integration",
+        "pointer": "/$defs/outputObjectField/properties/required",
         "path_kind": "property"
       },
-      "purpose": "Selects the operator-managed token-file binding for Notary-to-Relay authentication without exposing its contents.",
+      "purpose": "Declares whether a named field must be present in every released structured output object.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38915,24 +37770,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38940,7 +37794,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38948,64 +37802,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
-        },
-        {
-          "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_relay/properties/workload_client_id",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/outputObjectField/properties/schema",
+        "path_kind": "property"
       },
-      "purpose": "Identifies the Notary workload client authorized to request reviewed Relay consultations.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "A recursively closed structured output schema without a source pointer.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
+        "local_reference": "#/$defs/outputSchema",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39015,24 +37854,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39040,7 +37878,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39048,60 +37886,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputSchema"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_state",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/outputSchema/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Optional deployment binding for Notary-owned PostgreSQL state transport trust.",
+      "purpose": "Type and bounds for a scalar nested inside a structured output.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/scalarOutputSchema",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39111,24 +37939,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39136,7 +37963,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39144,57 +37971,62 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "postgresql"
+            "type"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/scalarOutputSchema"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_state/properties/postgresql",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/outputSchema/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Selects the PostgreSQL trust binding used by Notary state storage.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "A recursively typed object output with a canonical byte ceiling and an always-closed field map.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/outputObject",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39204,24 +38036,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39229,7 +38060,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39237,58 +38068,65 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "root_certificate_path"
+            "type",
+            "nullable",
+            "max_bytes",
+            "fields"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputObject"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_state/properties/postgresql/properties/root_certificate_path",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/outputSchema/oneOf/2",
+        "path_kind": "branch"
       },
-      "purpose": "Binds Notary state storage to an operator-managed PostgreSQL trust root at a deployment-local path.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "A recursively typed array output with canonical byte and item-count ceilings.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/absolutePath",
+        "local_reference": "#/$defs/outputArray",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39298,24 +38136,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39323,7 +38160,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39331,54 +38168,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
-        },
-        {
-          "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "keyword": "required",
+          "value": [
+            "type",
+            "nullable",
+            "max_bytes",
+            "max_items",
+            "items"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/absolutePath"
+        "schema": "integration",
+        "pointer": "/$defs/outputArray"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/oid4vci",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci",
         "path_kind": "property"
       },
-      "purpose": "Explicit registry-backed holder-wallet OID4VCI binding for one authored Notary credential profile.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Enables the bounded signed DCI search helper and declares its protocol and selector bindings.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/oid4vci",
         "composed": false
       },
       "requiredness": "optional",
@@ -39389,11 +38223,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39403,24 +38236,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39428,7 +38260,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39436,9 +38268,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -39448,45 +38280,39 @@
         {
           "keyword": "required",
           "value": [
-            "public_base_url",
-            "credential",
-            "authorization_server",
-            "client",
-            "access_token",
-            "sensitive_state_key",
-            "subject",
-            "redirect_uri",
-            "allowed_wallet_origins"
+            "profile",
+            "path",
+            "jwks_profile",
+            "sender",
+            "receiver",
+            "registry_type",
+            "record_type",
+            "locale",
+            "selectors"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/oid4vci"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/jwks_profile",
         "path_kind": "property"
       },
-      "purpose": "Public Relay identity and token-validation settings for a Relay deployment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the supported RSA signing-key-set profile used to verify signed DCI responses.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -39494,11 +38320,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39508,24 +38333,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39533,7 +38357,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39541,9 +38365,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -39551,51 +38375,40 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "origin",
-            "issuer",
-            "jwks_url",
-            "audience",
-            "allowed_clients"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "rsa-signing-jwks-v1"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/allowed_clients",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/locale",
         "path_kind": "property"
       },
-      "purpose": "Narrows Relay authentication to the operator-reviewed client identifiers listed for this environment.",
+      "purpose": "Declares the language or locale tag carried by signed DCI search requests.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39605,24 +38418,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39630,7 +38442,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39638,60 +38450,54 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 64
+          "keyword": "pattern",
+          "value": "^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$"
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/allowed_clients/items",
-        "path_kind": "array_item"
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/path",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares the exact private source path used for signed DCI search requests.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "sensitive",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39701,24 +38507,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39726,7 +38531,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39734,23 +38539,19 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^/[^?#]*$"
         },
         {
           "keyword": "type",
@@ -39760,34 +38561,31 @@
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/audience",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/profile",
         "path_kind": "property"
       },
-      "purpose": "Binds the token audience Relay requires so tokens issued for another service are rejected.",
+      "purpose": "Selects the supported DCI search request profile used by the signed protocol helper.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39797,24 +38595,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39822,7 +38619,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39830,59 +38627,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "dci-search-v1"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/issuer",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/receiver",
         "path_kind": "property"
       },
-      "purpose": "Binds the expected token issuer for Relay authentication in this deployment environment.",
+      "purpose": "Declares the signed DCI receiver identifier included in protocol requests.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/relayOrigin",
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39892,24 +38680,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39917,7 +38704,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39925,50 +38712,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relayOrigin"
-      }
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/jwks_url",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/record_type",
         "path_kind": "property"
       },
-      "purpose": "Binds the operator-reviewed key-set endpoint Relay uses to verify caller tokens.",
+      "purpose": "Declares the record type requested through the signed DCI search profile.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/relayResource",
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39978,24 +38773,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40003,7 +38797,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40011,51 +38805,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relayResource"
-      }
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/local_api_keys",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/registry_type",
         "path_kind": "property"
       },
-      "purpose": "Declares synthetic API-key principals only for the local profile; Registryctl generates raw keys privately and emits only their fingerprints to Relay.",
+      "purpose": "Declares the registry type requested through the signed DCI search profile.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40065,24 +38866,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40090,7 +38890,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40098,9 +38898,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -40108,50 +38908,48 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "match_principal",
-            "no_match_principal",
-            "scopes"
-          ]
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/local_api_keys/properties/match_principal",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors",
         "path_kind": "property"
       },
-      "purpose": "Binds the synthetic local caller whose reviewed identifier matches one starter row; this identifier is not a raw key or a source value.",
+      "purpose": "Maps every selector input to its signed DCI request field and response location.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token256",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40161,24 +38959,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40186,7 +38983,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40194,69 +38991,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
+          "keyword": "maxProperties",
+          "value": 8
         },
         {
-          "keyword": "minLength",
+          "keyword": "minProperties",
           "value": 1
         },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/token256"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/local_api_keys/properties/no_match_principal",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Binds the synthetic local caller whose reviewed identifier intentionally matches no starter row so an empty result is maintained.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token256",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40266,24 +39052,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40291,7 +39076,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40299,68 +39084,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
+          "keyword": "required",
+          "value": [
+            "field",
+            "response_pointer"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/token256"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/local_api_keys/properties/scopes",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/field",
         "path_kind": "property"
       },
-      "purpose": "Limits both generated local API-key callers to the explicitly reviewed service scopes needed by the maintained checks.",
+      "purpose": "Declares the signed DCI identifier field bound to one selector input.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40370,24 +39145,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40395,7 +39169,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40403,9 +39177,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -40413,41 +39187,37 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "maxLength",
+          "value": 160
         },
         {
-          "keyword": "minItems",
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/local_api_keys/properties/scopes/items",
-        "path_kind": "array_item"
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/response_pointer",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the canonical signed-record response location used to recover one selector value.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -40455,11 +39225,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40469,24 +39238,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40494,7 +39262,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40502,23 +39270,18 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
         },
         {
           "keyword": "type",
@@ -40528,33 +39291,34 @@
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/origin",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Binds the externally visible Relay origin reviewed by the operator and local network policy.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/relayOrigin",
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40564,24 +39328,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40589,7 +39352,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40597,51 +39360,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "arbitrary_map_keys_not_fixed_properties"
+      ],
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
       ],
-      "constraints": [],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relayOrigin"
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay_state",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/sender",
         "path_kind": "property"
       },
-      "purpose": "Optional deployment binding for Relay-owned consultation PostgreSQL state transport trust.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares the signed DCI sender identifier included in protocol requests.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40651,24 +39422,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40676,7 +39446,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40684,9 +39454,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -40694,35 +39464,35 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "postgresql"
-          ]
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay_state/properties/postgresql",
+        "schema": "integration",
+        "pointer": "/$defs/scalarOutput/properties/format",
         "path_kind": "property"
       },
-      "purpose": "Selects the PostgreSQL trust binding used by Relay state storage.",
+      "purpose": "Applies the full-date semantic format to a string-valued integration output.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -40730,11 +39500,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40744,24 +39513,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40769,7 +39537,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40777,9 +39545,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -40787,48 +39555,40 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "root_certificate_path"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "date"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay_state/properties/postgresql/properties/root_certificate_path",
+        "schema": "integration",
+        "pointer": "/$defs/scalarOutput/properties/maxLength",
         "path_kind": "property"
       },
-      "purpose": "Binds Relay state storage to an operator-managed PostgreSQL trust root at a deployment-local path.",
+      "purpose": "Caps the character length produced for a string-valued integration output.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40838,24 +39598,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40863,7 +39622,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40871,66 +39630,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
+          "keyword": "maximum",
+          "value": 16384
         },
         {
-          "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/absolutePath"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/version",
+        "schema": "integration",
+        "pointer": "/$defs/scalarOutput/properties/maximum",
         "path_kind": "property"
       },
-      "purpose": "Environment authoring format version.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Sets the inclusive upper bound produced for an integer-valued integration output.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "public",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40940,24 +39691,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40965,7 +39715,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40973,9 +39723,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -40983,41 +39733,48 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": 1
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "",
-        "path_kind": "root"
+        "pointer": "/$defs/scalarOutput/properties/minimum",
+        "path_kind": "property"
       },
-      "purpose": "Defines a product-neutral source adaptation contract using bounded HTTP, Rhai script, or exact snapshot capabilities.",
-      "purpose_source": "schema_description",
+      "purpose": "Sets the inclusive lower bound produced for an integer-valued integration output.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41036,7 +39793,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": true,
+        "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
@@ -41044,7 +39801,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41052,7 +39808,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41061,7 +39816,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -41072,35 +39826,35 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "version",
-            "id",
-            "revision",
-            "input",
-            "capability",
-            "outputs"
-          ]
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/allowRule/properties/method",
+        "pointer": "/$defs/scalarOutput/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Selects the GET or POST method permitted by one reviewed source allow rule.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Supported scalar type, optionally paired with null for nullable values.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "array"
+        ],
+        "local_reference": "#/$defs/scalarType",
         "composed": false
       },
       "requiredness": "required",
@@ -41115,7 +39869,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41142,7 +39895,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41150,7 +39902,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41159,7 +39910,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -41168,23 +39918,19 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "GET",
-            "POST"
-          ]
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/scalarType"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/allowRule/properties/path",
+        "pointer": "/$defs/scalarOutput/properties/x-registry-source",
         "path_kind": "property"
       },
-      "purpose": "Defines one reviewed source path template; concrete private endpoints and identifiers remain environment-owned.",
+      "purpose": "Selects the canonical source-response location from which the HTTP output is extracted.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -41195,19 +39941,18 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41234,7 +39979,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41242,7 +39986,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41251,28 +39994,18 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "pattern",
-          "value": "^/[^?#]*$"
+          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
         },
         {
           "keyword": "type",
@@ -41283,10 +40016,10 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/allowRule/properties/semantics",
+        "pointer": "/$defs/scalarOutputSchema/properties/format",
         "path_kind": "property"
       },
-      "purpose": "Declares that the permitted source operation has read-only semantics.",
+      "purpose": "Applies the full-date semantic format to a string-valued field inside a structured integration output.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -41307,7 +40040,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41334,7 +40066,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41342,7 +40073,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41351,7 +40081,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -41363,40 +40092,39 @@
       "constraints": [
         {
           "keyword": "const",
-          "value": "read_only"
+          "value": "date"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/scalarOutputSchema/properties/maxLength",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Caps the character length produced for a string-valued field inside a structured integration output.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41423,7 +40151,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41431,7 +40158,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41440,47 +40166,47 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "http"
-          ]
+          "keyword": "maximum",
+          "value": 16384
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/0/properties/http",
+        "pointer": "/$defs/scalarOutputSchema/properties/maximum",
         "path_kind": "property"
       },
-      "purpose": "Selects the single-request declarative HTTP capability and its expected response semantics.",
+      "purpose": "Sets the inclusive upper bound produced for an integer-valued field inside a structured integration output.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -41492,7 +40218,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41519,7 +40244,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41527,7 +40251,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41536,7 +40259,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -41547,36 +40269,37 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "request"
-          ]
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/0/properties/http/properties/request",
+        "pointer": "/$defs/scalarOutputSchema/properties/minimum",
         "path_kind": "property"
       },
-      "purpose": "Bounded read-only HTTP request template.",
-      "purpose_source": "schema_description",
+      "purpose": "Sets the inclusive lower bound produced for an integer-valued field inside a structured integration output.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/httpRequest",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -41588,7 +40311,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41615,7 +40337,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41623,7 +40344,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41632,7 +40352,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -41643,41 +40362,38 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "method",
-            "path"
-          ]
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/httpRequest"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/0/properties/http/properties/response",
+        "pointer": "/$defs/scalarOutputSchema/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Rules for translating upstream status and body cardinality into normalized outcomes.",
+      "purpose": "Supported scalar type, optionally paired with null for nullable values.",
       "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/httpResponse",
+        "local_reference": "#/$defs/scalarType",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -41689,7 +40405,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41716,7 +40431,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41724,7 +40438,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41733,7 +40446,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -41742,21 +40454,16 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
+      "constraints": [],
       "local_reference": {
         "schema": "integration",
-        "pointer": "/$defs/httpResponse"
+        "pointer": "/$defs/scalarType"
       }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/1",
+        "pointer": "/$defs/scalarType/oneOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
@@ -41765,9 +40472,7 @@
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "conditional",
@@ -41782,7 +40487,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41809,7 +40513,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41817,7 +40520,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41826,7 +40528,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -41838,47 +40539,44 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "script"
+            "string",
+            "boolean",
+            "integer"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/1/properties/script",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Selects the reviewed project-relative script capability and its optional modules.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41905,7 +40603,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41913,7 +40610,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41922,59 +40618,61 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "file"
-          ]
+          "keyword": "maxItems",
+          "value": 2
+        },
+        {
+          "keyword": "minItems",
+          "value": 2
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/1/properties/script/properties/file",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0",
+        "path_kind": "array_item"
       },
-      "purpose": "Project-relative path without traversal or duplicate separators.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/relativePath",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42001,7 +40699,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42009,7 +40706,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42018,7 +40714,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -42026,61 +40721,46 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "string",
+            "boolean",
+            "integer"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/relativePath"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/1/properties/script/properties/modules",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1",
+        "path_kind": "array_item"
       },
-      "purpose": "Lists the reviewed project-relative modules available to the integration script.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "array"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42107,7 +40787,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42115,7 +40794,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42124,7 +40802,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -42132,44 +40809,35 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 32
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "const",
+          "value": "null"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/1/properties/script/properties/modules/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/source/properties/allow",
+        "path_kind": "property"
       },
-      "purpose": "Project-relative path without traversal or duplicate separators.",
-      "purpose_source": "schema_description",
+      "purpose": "Constrains source access to the explicitly reviewed method and path templates in this integration contract.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/relativePath",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -42179,7 +40847,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42206,7 +40873,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42214,7 +40880,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42223,47 +40888,37 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
+          "keyword": "maxItems",
+          "value": 16
         },
         {
-          "keyword": "minLength",
+          "keyword": "minItems",
           "value": 1
         },
-        {
-          "keyword": "pattern",
-          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/relativePath"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/2",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/allow/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "One read-only upstream method and path pattern the adapter may call.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -42271,21 +40926,21 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/allowRule",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42312,7 +40967,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42320,7 +40974,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42329,7 +40982,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -42337,28 +40989,33 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "snapshot"
+            "method",
+            "path"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/allowRule"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/2/properties/snapshot",
+        "pointer": "/$defs/source/properties/auth",
         "path_kind": "property"
       },
-      "purpose": "Selects an offline entity snapshot capability with exact input matching and freshness control.",
+      "purpose": "Declares the credential interface the source contract permits without embedding an environment credential value.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -42367,6 +41024,7 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/credential",
         "composed": false
       },
       "requiredness": "required",
@@ -42381,7 +41039,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42408,7 +41065,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42416,7 +41072,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42425,7 +41080,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -42434,29 +41088,20 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "entity",
-            "exact",
-            "freshness"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/credential"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/entity",
+        "pointer": "/$defs/source/properties/product",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Names the source product whose version labels are classified by this integration contract.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -42464,10 +41109,9 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -42479,7 +41123,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42506,7 +41149,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42514,7 +41156,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42523,7 +41164,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -42534,27 +41174,27 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/exact",
+        "pointer": "/$defs/source/properties/protocol",
         "path_kind": "property"
       },
-      "purpose": "Maps entity fields to integration inputs that must match exactly in the snapshot lookup.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Optional interoperable protocol profiles layered over the source transport.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -42562,9 +41202,10 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/protocol",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -42576,7 +41217,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42603,7 +41243,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42611,7 +41250,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42620,7 +41258,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -42630,10 +41267,6 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 8
-        },
         {
           "keyword": "minProperties",
           "value": 1
@@ -42642,27 +41275,30 @@
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/protocol"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/exact/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/source/properties/request_headers",
+        "path_kind": "property"
       },
-      "purpose": "Reference to a declared integration input.",
-      "purpose_source": "schema_description",
+      "purpose": "Lists the bounded source request header names available to the integration adapter.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/inputReference",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -42674,7 +41310,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42701,7 +41336,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42709,7 +41343,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42718,41 +41351,37 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "input"
-          ]
+          "keyword": "maxItems",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputReference"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/freshness",
-        "path_kind": "property"
+        "pointer": "/$defs/source/properties/request_headers/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Sets the maximum accepted age of the materialized entity snapshot within the product-owned 31-day ceiling.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -42762,7 +41391,7 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -42774,7 +41403,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42801,7 +41429,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42809,7 +41436,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42818,19 +41444,19 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,8}|1[0-9]{9}|2[0-5][0-9]{8}|26[0-6][0-9]{7}|267[0-7][0-9]{6}|2678[0-3][0-9]{5}|2678400000)ms|(?:[1-9][0-9]{0,5}|1[0-9]{6}|2[0-5][0-9]{5}|26[0-6][0-9]{4}|267[0-7][0-9]{3}|2678[0-3][0-9]{2}|2678400)s|(?:[1-9][0-9]{0,3}|[1-3][0-9]{4}|4[0-3][0-9]{3}|44[0-5][0-9]{2}|446[0-3][0-9]{1}|44640)m|(?:[1-9][0-9]{0,1}|[1-6][0-9]{2}|7[0-3][0-9]{1}|74[0-3]|744)h|(?:[1-9][0-9]{0,0}|[1-2][0-9]{1}|30|31)d)$"
+          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
         },
         {
           "keyword": "type",
@@ -42841,11 +41467,11 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/response",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Defines the reviewed source response representation and optional byte bound.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -42855,19 +41481,18 @@
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42894,7 +41519,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42902,7 +41526,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42911,23 +41534,15 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -42937,10 +41552,10 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/0/properties/type",
+        "pointer": "/$defs/source/properties/response/properties/format",
         "path_kind": "property"
       },
-      "purpose": "Selects an unauthenticated, basic-authentication, or static-bearer credential interface.",
+      "purpose": "Selects JSON decoding or text handling for reviewed source responses.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -42949,7 +41564,7 @@
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -42961,7 +41576,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42988,7 +41602,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42996,7 +41609,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43005,7 +41617,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -43018,9 +41629,8 @@
         {
           "keyword": "enum",
           "value": [
-            "none",
-            "basic",
-            "static_bearer"
+            "json",
+            "text"
           ]
         }
       ]
@@ -43028,33 +41638,119 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/response/properties/max_bytes",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Maximum bytes accepted from one source response, defaulting to 512 KiB and capped at 8 MiB. Use a positive byte integer or canonical KiB/MiB value.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer",
+          "string"
         ],
+        "local_reference": "#/$defs/integrationResponseByteSize",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "schema_default",
+        "schema_value": "512KiB"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/integrationResponseByteSize"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/source/properties/response_headers",
+        "path_kind": "property"
+      },
+      "purpose": "Lists the bounded source response header names available to the integration adapter.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43081,7 +41777,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43089,7 +41784,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43098,51 +41792,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "name",
-            "max_value_bytes"
-          ]
+          "keyword": "maxItems",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/1/properties/max_value_bytes",
-        "path_kind": "property"
+        "pointer": "/$defs/source/properties/response_headers/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Caps the credential value size accepted by the fixed-header API-key interface.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -43152,7 +41844,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43179,7 +41870,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43187,7 +41877,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43196,50 +41885,47 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4096
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/1/properties/name",
+        "pointer": "/$defs/source/properties/versions",
         "path_kind": "property"
       },
-      "purpose": "Declares the fixed HTTP header name used by the API-key credential interface.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Source versions tested by the project and versions explicitly accepted as unverified.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/versions",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -43249,7 +41935,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43276,7 +41961,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43284,7 +41968,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43293,7 +41976,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -43303,34 +41985,36 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z][A-Za-z0-9_-]{0,63}$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/versions"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/1/properties/type",
-        "path_kind": "property"
+        "pointer": "/$defs/versionList/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Selects the fixed-header API-key credential interface for this source contract.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -43340,7 +42024,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43367,7 +42050,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43375,7 +42057,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43384,26 +42065,34 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "api_key_header"
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/2",
+        "pointer": "/$defs/versions/anyOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
@@ -43412,9 +42101,7 @@
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "conditional",
@@ -43429,7 +42116,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43456,7 +42142,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43464,7 +42149,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43473,7 +42157,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -43487,32 +42170,24 @@
         {
           "keyword": "required",
           "value": [
-            "type",
-            "name",
-            "max_value_bytes"
+            "tested"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/2/properties/max_value_bytes",
+        "pointer": "/$defs/versions/anyOf/0/properties/tested",
         "path_kind": "property"
       },
-      "purpose": "Caps the credential value size accepted by the fixed-query API-key interface.",
+      "purpose": "Requires at least one source product version to be classified as tested in this integration contract.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
@@ -43527,7 +42202,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43554,7 +42228,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43562,7 +42235,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43571,7 +42243,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -43582,49 +42253,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4096
-        },
-        {
-          "keyword": "minimum",
+          "keyword": "minItems",
           "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/2/properties/name",
-        "path_kind": "property"
+        "pointer": "/$defs/versions/anyOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Declares the fixed query parameter name used by the API-key credential interface.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43651,7 +42311,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43659,7 +42318,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43668,33 +42326,31 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9._:~-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "required",
+          "value": [
+            "unverified"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/2/properties/type",
+        "pointer": "/$defs/versions/anyOf/1/properties/unverified",
         "path_kind": "property"
       },
-      "purpose": "Selects the fixed-query-parameter API-key credential interface for this source contract.",
+      "purpose": "Requires at least one source product version to be classified as unverified in this integration contract.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -43715,7 +42371,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43742,7 +42397,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43750,7 +42404,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43759,7 +42412,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -43770,41 +42422,41 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "api_key_query"
+          "keyword": "minItems",
+          "value": 1
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3",
-        "path_kind": "branch"
+        "pointer": "/$defs/versions/properties/tested",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Bounded list of source version labels.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "composed": true
+        "local_reference": "#/$defs/versionList",
+        "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43831,7 +42483,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43839,7 +42490,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43848,142 +42498,63 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "request",
-            "response_profile"
-          ]
+          "keyword": "maxItems",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/allOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": []
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/versionList"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/allOf/0/if",
-        "path_kind": "branch"
+        "pointer": "/$defs/versions/properties/unverified",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Bounded list of source version labels.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "array"
+        ],
+        "local_reference": "#/$defs/versionList",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44010,7 +42581,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44018,7 +42588,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44027,38 +42596,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "response_profile"
-          ]
+          "keyword": "maxItems",
+          "value": 32
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/versionList"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/allOf/0/if/properties/response_profile",
+        "pointer": "/properties/capability",
         "path_kind": "property"
       },
-      "purpose": "Matches the strict no-expiry bearer profile before applying its refresh-control constraint.",
+      "purpose": "Exactly one bounded execution mechanism for the source adaptation.",
       "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/capability",
         "composed": false
       },
       "requiredness": "required",
@@ -44073,7 +42653,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44100,7 +42679,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44108,7 +42686,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44117,7 +42694,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -44126,124 +42702,42 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "oauth2_bearer_no_expiry"
-        }
-      ]
-    },
-    {
-      "address": {
+      "constraints": [],
+      "local_reference": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/allOf/0/then",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": []
+        "pointer": "/$defs/capability"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/allOf/0/then/not",
-        "path_kind": "branch"
+        "pointer": "/properties/id",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Stable project-local identifier for the integration.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44270,7 +42764,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44278,7 +42771,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44287,55 +42779,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "refresh_skew"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/properties/audience",
+        "pointer": "/properties/input",
         "path_kind": "property"
       },
-      "purpose": "Constrains OAuth token acquisition to the reviewed source audience and is treated as sensitive operational metadata.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Typed selector and parameter inputs accepted by this integration.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44362,7 +42857,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44370,7 +42864,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44379,51 +42872,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
+          "keyword": "maxProperties",
+          "value": 16
         },
         {
-          "keyword": "minLength",
+          "keyword": "minProperties",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/properties/refresh_skew",
-        "path_kind": "property"
+        "pointer": "/properties/input/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "With oauth2_bearer, sets a positive refresh interval below sixty seconds so a cached OAuth credential retains usable lifetime. The no-expiry profile rejects this field because caching is disabled.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Type, validation, and canonicalization rules for one authored input.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/input",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -44433,7 +42925,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44460,7 +42951,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44468,7 +42958,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44477,44 +42966,54 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,3}|[1-5][0-9]{4})ms|(?:[1-9]|[1-5][0-9])s)$"
+          "keyword": "required",
+          "value": [
+            "role",
+            "type"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/input"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/properties/request",
-        "path_kind": "property"
+        "pointer": "/properties/input/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Selects form-encoded or JSON token requests for the OAuth client-credentials interface.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -44524,7 +43023,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44551,7 +43049,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44559,7 +43056,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44568,41 +43064,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "form",
-            "json"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/properties/response_profile",
+        "pointer": "/properties/limits",
         "path_kind": "property"
       },
-      "purpose": "Selects an exact OAuth bearer-token response shape. oauth2_bearer requires access_token, token_type Bearer, and a bounded expires_in value and permits expiry-bound caching. oauth2_bearer_no_expiry requires only access_token and token_type Bearer, rejects expiry and extra fields, and disables token caching.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Optional tighter resource limits for one integration execution.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/limits",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -44614,7 +43118,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44641,7 +43144,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44649,7 +43151,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44658,7 +43159,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -44669,34 +43169,36 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "oauth2_bearer",
-            "oauth2_bearer_no_expiry"
-          ]
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/limits"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/properties/scope",
+        "pointer": "/properties/not_applicable",
         "path_kind": "property"
       },
-      "purpose": "Declares the bounded OAuth scope string requested for this source credential.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Explicit rationale and request-fixture evidence for a normally required outcome that the source contract cannot produce.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/notApplicable",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -44706,7 +43208,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44733,7 +43234,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44741,7 +43241,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44750,7 +43249,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -44761,122 +43259,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 1024
-        },
-        {
-          "keyword": "minLength",
+          "keyword": "minProperties",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/properties/type",
-        "path_kind": "property"
-      },
-      "purpose": "Selects the OAuth 2.0 client-credentials interface for source authentication.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
       ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "oauth2_client_credentials"
-        }
-      ]
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/notApplicable"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpRequest/properties/body",
+        "pointer": "/properties/outputs",
         "path_kind": "property"
       },
-      "purpose": "Defines the optional authored body template sent by the declarative HTTP request.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Named typed outputs, or a shorthand list of output names inferred by the authoring compiler.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
-        "composed": false
+        "schema_types": [
+          "array",
+          "object"
+        ],
+        "composed": true
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -44888,7 +43302,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44915,7 +43328,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44923,7 +43335,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44932,7 +43343,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -44946,11 +43356,11 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpRequest/properties/headers",
-        "path_kind": "property"
+        "pointer": "/properties/outputs/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Maps reviewed request header names to authored values and input substitutions.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -44960,19 +43370,18 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44999,7 +43408,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45007,7 +43415,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45016,19 +43423,23 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "maxProperties",
-          "value": 32
+          "value": 64
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
@@ -45039,26 +43450,22 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpRequest/properties/headers/additionalProperties",
+        "pointer": "/properties/outputs/oneOf/0/additionalProperties",
         "path_kind": "map_value"
       },
-      "purpose": "Request value supplied from a declared input or an authored scalar literal.",
+      "purpose": "A bounded scalar or recursively closed structured schema for one normalized integration output.",
       "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "boolean",
-          "integer",
-          "string"
-        ],
-        "local_reference": "#/$defs/inputOrLiteral",
+        "schema_types": [],
+        "local_reference": "#/$defs/output",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -45068,7 +43475,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45095,7 +43501,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45103,7 +43508,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45112,7 +43516,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -45125,25 +43528,25 @@
       "constraints": [],
       "local_reference": {
         "schema": "integration",
-        "pointer": "/$defs/inputOrLiteral"
+        "pointer": "/$defs/output"
       }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpRequest/properties/method",
-        "path_kind": "property"
+        "pointer": "/properties/outputs/oneOf/0/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Selects the single GET or POST request performed by a declarative HTTP capability.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -45155,7 +43558,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45182,7 +43584,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45190,7 +43591,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45199,33 +43599,25 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "GET",
-            "POST"
-          ]
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpRequest/properties/path",
-        "path_kind": "property"
+        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Defines the reviewed source path template used by the declarative HTTP request.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -45233,21 +43625,21 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45274,7 +43666,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45282,7 +43673,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45291,7 +43681,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -45299,57 +43688,50 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "pattern",
-          "value": "^/[^?#]*$"
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpRequest/properties/query",
-        "path_kind": "property"
+        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Maps reviewed query parameter names to authored request values and input substitutions.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45376,7 +43758,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45384,7 +43765,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45393,59 +43773,44 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpRequest/properties/query/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1/not",
+        "path_kind": "branch"
       },
-      "purpose": "Request value supplied from a declared input or an authored scalar literal.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "boolean",
-          "integer",
-          "string"
-        ],
-        "local_reference": "#/$defs/inputOrLiteral",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45472,7 +43837,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45480,7 +43844,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45489,7 +43852,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -45497,42 +43859,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputOrLiteral"
-      }
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "matched",
+            "outcome"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpRequest/properties/semantics",
-        "path_kind": "property"
+        "pointer": "/properties/outputs/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Declares that the declarative HTTP request has read-only source semantics.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "array"
+        ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45559,7 +43926,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45567,7 +43933,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45576,42 +43941,55 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "read_only"
+          "keyword": "maxItems",
+          "value": 64
+        },
+        {
+          "keyword": "minItems",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/ambiguous",
-        "path_kind": "property"
+        "pointer": "/properties/outputs/oneOf/1/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Lists HTTP response statuses that produce the integration's ambiguous outcome.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -45621,7 +43999,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45648,7 +44025,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45656,7 +44032,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45665,34 +44040,38 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "array"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/ambiguous/items",
-        "path_kind": "array_item"
+        "pointer": "/properties/revision",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Monotonically increasing revision of this integration contract.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -45702,7 +44081,7 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -45714,7 +44093,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45733,7 +44111,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
+        "schema_examples_available": true,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
@@ -45741,7 +44119,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45749,7 +44126,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45758,24 +44134,22 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 599
+          "value": 4294967295
         },
         {
           "keyword": "minimum",
-          "value": 100
+          "value": 1
         },
         {
           "keyword": "type",
@@ -45786,18 +44160,19 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/no_match",
+        "pointer": "/properties/source",
         "path_kind": "property"
       },
-      "purpose": "Lists HTTP response statuses that produce the integration's no-match outcome.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Optional source product metadata and transport policy; capabilities remain product-neutral.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/source",
         "composed": false
       },
       "requiredness": "optional",
@@ -45812,7 +44187,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45839,7 +44213,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45847,7 +44220,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45856,7 +44228,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -45867,45 +44238,48 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "array"
+          "keyword": "required",
+          "value": [
+            "auth"
+          ]
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/source"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/no_match/items",
-        "path_kind": "array_item"
+        "pointer": "/properties/version",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Integration authoring format version.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45932,7 +44306,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45940,7 +44313,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45949,61 +44321,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 599
-        },
-        {
-          "keyword": "minimum",
-          "value": 100
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
+          "keyword": "const",
+          "value": 1
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/shape",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "",
+        "path_kind": "root"
       },
-      "purpose": "Declares whether a successful response is a singleton or a bounded collection.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Defines one synthetic, deterministic integration scenario for offline adapter verification.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "not_applicable",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46012,42 +44372,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -46056,36 +44406,51 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name",
+            "classification",
+            "input",
+            "interactions",
+            "expect"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/shape/oneOf/0",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/$defs/expectation/properties/error",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "States the bounded error identifier expected from a failing offline fixture.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46094,42 +44459,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -46137,45 +44492,49 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "singleton"
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/shape/oneOf/1",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/$defs/expectation/properties/outcome",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "States whether the offline fixture is expected to match, find no match, or remain ambiguous.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46184,42 +44543,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -46227,50 +44576,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "records",
-            "cardinality"
+            "match",
+            "no_match",
+            "ambiguous"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/shape/oneOf/1/properties/cardinality",
+        "schema": "fixture",
+        "pointer": "/$defs/expectation/properties/outputs",
         "path_kind": "property"
       },
-      "purpose": "Requires two-record probing so collection results distinguish one match from ambiguity.",
+      "purpose": "Maps integration output names to the synthetic values expected after fixture execution.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46279,87 +44625,80 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "probe_two"
+          "keyword": "maxProperties",
+          "value": 64
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/shape/oneOf/1/properties/records",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Selects the canonical response location containing collection records.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46368,89 +44707,82 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
+          "keyword": "required",
+          "value": [
+            "file"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/canonicalization",
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody/oneOf/0/properties/file",
         "path_kind": "property"
       },
-      "purpose": "Selects the reviewed normalization rule applied before an input is compared, interpolated, or sent to a source.",
+      "purpose": "Selects a fixture-local synthetic body file beneath the reserved bodies directory.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46459,88 +44791,86 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "identity",
-            "ascii_lowercase"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 8
+        },
+        {
+          "keyword": "pattern",
+          "value": "^bodies/(?!\\.\\.?/)(?!.*(?:/)\\.\\.?/)(?!.*//).+$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/format",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Applies the full-date semantic format to a string-valued integration input.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46549,87 +44879,71 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "date"
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/maxLength",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody/oneOf/1/not",
+        "path_kind": "branch"
       },
-      "purpose": "Caps a string-valued integration input at 1,024 Unicode scalar values, deriving its conservative 4,096-byte UTF-8 ceiling.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46638,95 +44952,83 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 1024
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "file"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/maximum",
+        "schema": "fixture",
+        "pointer": "/$defs/interaction/properties/expect",
         "path_kind": "property"
       },
-      "purpose": "Sets the inclusive upper bound accepted for an integer-valued integration input.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Exact HTTP request shape the adapter must produce.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/request",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46735,95 +45037,88 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 9007199254740991
-        },
-        {
-          "keyword": "minimum",
-          "value": -9007199254740991
+          "keyword": "required",
+          "value": [
+            "method",
+            "path"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/request"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/minLength",
+        "schema": "fixture",
+        "pointer": "/$defs/interaction/properties/respond",
         "path_kind": "property"
       },
-      "purpose": "Sets the minimum character length accepted for a string-valued integration input.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Synthetic HTTP response or timeout returned to the adapter.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/response",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46832,80 +45127,63 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 16384
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/response"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/minimum",
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/body",
         "path_kind": "property"
       },
-      "purpose": "Sets the inclusive lower bound accepted for an integer-valued integration input.",
+      "purpose": "Defines the synthetic request body expectation or fixture-local file reference without reading a source.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/fixtureBody",
         "composed": false
       },
       "requiredness": "optional",
@@ -46914,13 +45192,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46929,95 +45205,75 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 9007199254740991
-        },
-        {
-          "keyword": "minimum",
-          "value": -9007199254740991
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/pattern",
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/headers",
         "path_kind": "property"
       },
-      "purpose": "Constrains a string-valued integration input with the authored regular expression.",
+      "purpose": "States the synthetic request headers expected from one offline fixture interaction.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47026,93 +45282,80 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 16384
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "maxProperties",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/role",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/headers/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Declares how one typed authoring input participates in source lookup, selection, or result shaping.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47121,91 +45364,79 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "selector",
-            "parameter"
-          ]
+          "keyword": "maxLength",
+          "value": 8192
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/type",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/headers/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Declares the closed scalar or array type accepted for one integration input.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/scalarType",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47214,87 +45445,75 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarType"
-      }
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/inputOrLiteral/oneOf/0",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/method",
+        "path_kind": "property"
       },
-      "purpose": "Reference to a declared integration input.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "States the synthetic request method expected from the offline integration fixture.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/inputReference",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47303,42 +45522,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -47346,57 +45555,46 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "input"
+            "GET",
+            "POST"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputReference"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/inputOrLiteral/oneOf/1",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/path",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "States the synthetic request path expected from the offline integration fixture.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "boolean",
-          "integer",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47405,42 +45603,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -47448,50 +45636,55 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/[^?#]*$"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/inputReference/properties/input",
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/query",
         "path_kind": "property"
       },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "States the synthetic query parameters expected from one offline fixture interaction.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47500,95 +45693,84 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
+          "keyword": "maxProperties",
+          "value": 64
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationRequestByteSize/oneOf/0",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/query/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array",
+          "boolean",
+          "integer",
+          "null",
+          "string"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47597,42 +45779,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -47640,36 +45812,27 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 1048576
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationRequestByteSize/oneOf/1",
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
+          "boolean",
+          "integer",
+          "null",
           "string"
         ],
         "composed": false
@@ -47680,13 +45843,11 @@
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
+      "environment_behavior": "environment_independent",
       "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47695,42 +45856,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -47741,30 +45892,31 @@
         "branch_has_no_authored_value"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,2}|10[0-1][0-9]|102[0-4])KiB|1MiB)$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "boolean",
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationResponseByteSize/oneOf/0",
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -47774,13 +45926,11 @@
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
+      "environment_behavior": "environment_independent",
       "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47789,42 +45939,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -47836,49 +45976,46 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 8388608
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "maxItems",
+          "value": 64
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationResponseByteSize/oneOf/1",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
+          "boolean",
+          "integer",
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47887,42 +46024,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -47930,33 +46057,35 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,2}|[1-7][0-9]{3}|80[0-9]{2}|81[0-8][0-9]|819[0-2])KiB|[1-8]MiB)$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "boolean",
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationSourceByteSize/oneOf/0",
+        "schema": "fixture",
+        "pointer": "/$defs/response/oneOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
@@ -47966,13 +46095,11 @@
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
+      "environment_behavior": "environment_independent",
       "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47981,42 +46108,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -48028,49 +46145,46 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 16777216
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "status"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationSourceByteSize/oneOf/1",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/$defs/response/oneOf/0/properties/body",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Defines the synthetic response body returned by the offline fixture harness to the integration.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/fixtureBody",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48079,42 +46193,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -48122,33 +46226,28 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-5][0-9]{3}|16[0-2][0-9]{2}|163[0-7][0-9]|1638[0-4])KiB|(?:[1-9]|1[0-6])MiB)$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/limits/properties/calls",
+        "schema": "fixture",
+        "pointer": "/$defs/response/oneOf/0/properties/headers",
         "path_kind": "property"
       },
-      "purpose": "Caps the number of high-level source calls available to a script integration.",
+      "purpose": "Defines the synthetic HTTP response headers returned by the offline fixture harness.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
@@ -48158,13 +46257,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48173,95 +46270,80 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 16
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "maxProperties",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/limits/properties/deadline",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/$defs/response/oneOf/0/properties/headers/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Caps total integration execution time with a positive duration no greater than twenty seconds.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48270,54 +46352,46 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-9]{4}|20000)ms|(?:[1-9]|1[0-9]|20)s)$"
+          "keyword": "maxLength",
+          "value": 8192
         },
         {
           "keyword": "type",
@@ -48327,37 +46401,32 @@
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/limits/properties/request_bytes",
+        "schema": "fixture",
+        "pointer": "/$defs/response/oneOf/0/properties/status",
         "path_kind": "property"
       },
-      "purpose": "Maximum aggregate author-controlled request bytes for one execution, defaulting to 64 KiB and capped at 1 MiB. Use a positive byte integer or canonical KiB/MiB value.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Selects the synthetic HTTP status returned by the offline fixture harness.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/integrationRequestByteSize",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "schema_value": "64KiB"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48366,89 +46435,84 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationRequestByteSize"
-      }
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 599
+        },
+        {
+          "keyword": "minimum",
+          "value": 100
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/limits/properties/source_bytes",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/$defs/response/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Maximum aggregate source-response bytes for one execution, defaulting to 2 MiB and capped at 16 MiB. Use a positive byte integer or canonical KiB/MiB value.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/integrationSourceByteSize",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "schema_value": "2MiB"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48457,87 +46521,82 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationSourceByteSize"
-      }
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "timeout"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/notApplicable/properties/ambiguity",
+        "schema": "fixture",
+        "pointer": "/$defs/response/oneOf/1/properties/timeout",
         "path_kind": "property"
       },
-      "purpose": "Why the reviewed source contract cannot produce more than one matching record.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Records bounded synthetic timeout intent; offline execution returns the timeout outcome without waiting for the authored interval.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/notApplicableReason",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48546,99 +46605,78 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "rationale",
-            "request_fixture"
-          ]
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-9]{4}|20000)ms|(?:[1-9]|1[0-9]|20)s)$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/notApplicableReason"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/notApplicable/properties/subject_mismatch",
+        "schema": "fixture",
+        "pointer": "/properties/classification",
         "path_kind": "property"
       },
-      "purpose": "Why the reviewed response contract contains no identifier comparable with a requested selector.",
+      "purpose": "Declares that fixture data is synthetic and safe for offline testing.",
       "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/notApplicableReason",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "public",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48647,42 +46685,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -48693,52 +46721,40 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "rationale",
-            "request_fixture"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "synthetic"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/notApplicableReason"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/notApplicableReason/properties/rationale",
+        "schema": "fixture",
+        "pointer": "/properties/expect",
         "path_kind": "property"
       },
-      "purpose": "Why the named normally required outcome cannot occur for this source contract.",
+      "purpose": "Observable adapter result required for the scenario to pass.",
       "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/expectation",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48747,96 +46763,84 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 512
-        },
-        {
-          "keyword": "minLength",
-          "value": 24
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/expectation"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/notApplicableReason/properties/request_fixture",
+        "schema": "fixture",
+        "pointer": "/properties/input",
         "path_kind": "property"
       },
-      "purpose": "Fixture name containing the supporting bounded source request.",
+      "purpose": "Typed consultation inputs supplied to the adapter under test.",
       "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48845,96 +46849,87 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxProperties",
+          "value": 16
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/output/oneOf/0",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/properties/input/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Type, scalar bounds, and optional source pointer for one normalized scalar integration output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean",
+          "integer",
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/scalarOutput",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48943,42 +46938,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -48986,56 +46971,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "type"
+            "string",
+            "boolean",
+            "integer",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutput"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/output/oneOf/1",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/properties/input/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "A recursively typed object output with a canonical byte ceiling and an always-closed field map.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/outputObject",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49044,42 +47020,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -49087,59 +47053,44 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "nullable",
-            "max_bytes",
-            "fields"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObject"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/output/oneOf/2",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/properties/interactions",
+        "path_kind": "property"
       },
-      "purpose": "A recursively typed array output with canonical byte and item-count ceilings.",
+      "purpose": "Ordered upstream request and response exchanges expected during execution.",
       "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/outputArray",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49148,42 +47099,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -49191,58 +47132,52 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "nullable",
-            "max_bytes",
-            "max_items",
-            "items"
-          ]
+          "keyword": "maxItems",
+          "value": 16
+        },
+        {
+          "keyword": "minItems",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/outputArray"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputArray/properties/items",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/properties/interactions/items",
+        "path_kind": "array_item"
       },
-      "purpose": "A recursively closed structured output schema without a source pointer.",
+      "purpose": "One expected upstream request paired with its synthetic response.",
       "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/outputSchema",
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/interaction",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49251,86 +47186,88 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "expect",
+            "respond"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
       ],
-      "constraints": [],
       "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/outputSchema"
+        "schema": "fixture",
+        "pointer": "/$defs/interaction"
       }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputArray/properties/max_bytes",
+        "schema": "fixture",
+        "pointer": "/properties/name",
         "path_kind": "property"
       },
-      "purpose": "Caps the canonical serialized size of one structured output array.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Human-readable scenario name shown in test output.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "public",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49339,42 +47276,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -49385,49 +47312,47 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 65536
+          "keyword": "maxLength",
+          "value": 256
         },
         {
-          "keyword": "minimum",
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputArray/properties/max_items",
+        "schema": "fixture",
+        "pointer": "/properties/variables",
         "path_kind": "property"
       },
-      "purpose": "Caps the number of values released in one structured output array.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Named date values available to deterministic fixture interpolation.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49436,95 +47361,80 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 256
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "maxProperties",
+          "value": 16
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputArray/properties/nullable",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/properties/variables/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Declares whether the complete structured output array may be null.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49533,85 +47443,79 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "date"
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputArray/properties/type",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/properties/variables/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Selects the array form for a structured integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49620,87 +47524,78 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "array"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObject/properties/fields",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "",
+        "path_kind": "root"
       },
-      "purpose": "Declares the bounded closed map of fields released in one structured output object.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Defines a bounded, materialized entity that Relay can query without coupling the project to a specific source product.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "not_applicable",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49710,24 +47605,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -49735,19 +47628,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -49755,12 +47643,15 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 32
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "version",
+            "id",
+            "revision",
+            "primary_key",
+            "schema",
+            "materialization"
+          ]
         },
         {
           "keyword": "type",
@@ -49770,23 +47661,20 @@
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObject/properties/fields/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/const",
+        "path_kind": "property"
       },
-      "purpose": "Requiredness and recursive schema for one named field of a closed structured output object.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Requires one entity field to equal the single authored value supplied by this schema constraint.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/outputObjectField",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -49798,7 +47686,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49808,24 +47695,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -49833,64 +47718,41 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "required",
-            "schema"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
+        "generated_docs_never_load_country_values"
       ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObjectField"
-      }
+      "constraints": []
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObject/properties/fields/propertyNames",
-        "path_kind": "map_key"
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/enum",
+        "path_kind": "property"
       },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Restricts one entity field to the unique authored values listed by this schema constraint.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -49900,7 +47762,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49910,24 +47771,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -49935,58 +47794,50 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
+          "keyword": "minItems",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObject/properties/max_bytes",
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/format",
         "path_kind": "property"
       },
-      "purpose": "Caps the canonical serialized size of one structured output object.",
+      "purpose": "Adds a reviewed semantic format constraint to one string-valued entity field.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -49998,7 +47849,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50008,24 +47858,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50033,19 +47881,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -50053,37 +47896,29 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 65536
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
+          "keyword": "const",
+          "value": "date"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObject/properties/nullable",
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/maxLength",
         "path_kind": "property"
       },
-      "purpose": "Declares whether the complete structured output object may be null.",
+      "purpose": "Caps the character length accepted for one string-valued entity field.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50095,7 +47930,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50105,24 +47939,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50130,47 +47962,52 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 65536
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObject/properties/type",
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/maximum",
         "path_kind": "property"
       },
-      "purpose": "Selects the closed object form for a structured integration output.",
+      "purpose": "Sets the inclusive upper numeric bound accepted for one entity field.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50182,7 +48019,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50192,24 +48028,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50217,19 +48051,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -50237,29 +48066,37 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "object"
+          "keyword": "maximum",
+          "value": 9007199254740991
+        },
+        {
+          "keyword": "minimum",
+          "value": -9007199254740991
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObjectField/properties/required",
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/minLength",
         "path_kind": "property"
       },
-      "purpose": "Declares whether a named field must be present in every released structured output object.",
+      "purpose": "Sets the minimum character length accepted for one string-valued entity field.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50271,7 +48108,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50281,24 +48117,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50306,48 +48140,52 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 65536
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObjectField/properties/schema",
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/minimum",
         "path_kind": "property"
       },
-      "purpose": "A recursively closed structured output schema without a source pointer.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Sets the inclusive lower numeric bound accepted for one entity field.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/outputSchema",
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50359,7 +48197,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50369,24 +48206,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50394,61 +48229,63 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/outputSchema"
-      }
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 9007199254740991
+        },
+        {
+          "keyword": "minimum",
+          "value": -9007199254740991
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputSchema/oneOf/0",
-        "path_kind": "branch"
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/pattern",
+        "path_kind": "property"
       },
-      "purpose": "Type and bounds for a scalar nested inside a structured output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Constrains a string-valued entity field with the authored regular expression.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/scalarOutputSchema",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50458,24 +48295,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50483,73 +48318,64 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type"
-          ]
+          "keyword": "maxLength",
+          "value": 1024
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutputSchema"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputSchema/oneOf/1",
-        "path_kind": "branch"
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/type",
+        "path_kind": "property"
       },
-      "purpose": "A recursively typed object output with a canonical byte ceiling and an always-closed field map.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Declares the closed scalar, array, or object type accepted for one entity field.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/outputObject",
+        "local_reference": "#/$defs/scalarType",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50559,24 +48385,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50584,76 +48408,52 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type",
-            "nullable",
-            "max_bytes",
-            "fields"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
+        "generated_docs_never_load_country_values"
       ],
+      "constraints": [],
       "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObject"
+        "schema": "entity",
+        "pointer": "/$defs/scalarType"
       }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputSchema/oneOf/2",
-        "path_kind": "branch"
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema/properties/additionalProperties",
+        "path_kind": "property"
       },
-      "purpose": "A recursively typed array output with canonical byte and item-count ceilings.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Controls whether the entity object accepts fields outside its declared closed property set.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/outputArray",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50663,24 +48463,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50688,64 +48486,44 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "nullable",
-            "max_bytes",
-            "max_items",
-            "items"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": false
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/outputArray"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci",
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema/properties/properties",
         "path_kind": "property"
       },
-      "purpose": "Enables the bounded signed DCI search helper and declares its protocol and selector bindings.",
+      "purpose": "Maps every declared entity property name to its closed field schema.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50757,7 +48535,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50767,24 +48544,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50792,19 +48567,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -50812,18 +48582,12 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "profile",
-            "path",
-            "jwks_profile",
-            "sender",
-            "receiver",
-            "registry_type",
-            "record_type",
-            "locale",
-            "selectors"
-          ]
+          "keyword": "maxProperties",
+          "value": 256
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
@@ -50833,20 +48597,23 @@
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/jwks_profile",
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema/properties/properties/additionalProperties",
         "path_kind": "property"
       },
-      "purpose": "Selects the supported RSA signing-key-set profile used to verify signed DCI responses.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Bounded schema keywords supported for one scalar materialized field.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/fieldSchema",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50858,7 +48625,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50868,24 +48634,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50893,19 +48657,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -50913,29 +48672,40 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "rsa-signing-jwks-v1"
+          "keyword": "required",
+          "value": [
+            "type"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/locale",
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema/properties/properties/propertyNames",
         "path_kind": "property"
       },
-      "purpose": "Declares the language or locale tag carried by signed DCI search requests.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Portable lowercase record field name.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/propertyName",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -50947,7 +48717,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50957,24 +48726,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50982,19 +48749,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -51003,44 +48765,47 @@
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$"
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/propertyName"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/path",
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema/properties/required",
         "path_kind": "property"
       },
-      "purpose": "Declares the exact private source path used for signed DCI search requests.",
+      "purpose": "Lists the entity properties that every validated materialized record must contain.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51050,24 +48815,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51075,54 +48838,59 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^/[^?#]*$"
+          "keyword": "maxItems",
+          "value": 256
+        },
+        {
+          "keyword": "minItems",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/profile",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema/properties/required/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Selects the supported DCI search request profile used by the signed protocol helper.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Portable lowercase record field name.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/propertyName",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -51132,7 +48900,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51142,24 +48909,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51167,51 +48932,53 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "dci-search-v1"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/propertyName"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/receiver",
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Declares the signed DCI receiver identifier included in protocol requests.",
+      "purpose": "Declares the materialized entity record schema as an object.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -51221,7 +48988,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51231,24 +48997,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51256,19 +49020,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -51276,49 +49035,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/record_type",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "/$defs/scalarType/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Declares the record type requested through the signed DCI search profile.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51328,24 +49076,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51353,69 +49099,60 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "string",
+            "boolean",
+            "integer"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/registry_type",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "/$defs/scalarType/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Declares the registry type requested through the signed DCI search profile.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51425,24 +49162,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51450,57 +49185,55 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
+          "keyword": "maxItems",
+          "value": 2
         },
         {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "minItems",
+          "value": 2
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0",
+        "path_kind": "array_item"
       },
-      "purpose": "Maps every selector input to its signed DCI request field and response location.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -51512,7 +49245,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51522,24 +49254,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51547,54 +49277,44 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 8
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "enum",
+          "value": [
+            "string",
+            "boolean",
+            "integer"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "entity",
+        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1",
+        "path_kind": "array_item"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -51609,7 +49329,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51619,24 +49338,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51644,54 +49361,43 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "field",
-            "response_pointer"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "null"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/field",
+        "schema": "entity",
+        "pointer": "/properties/id",
         "path_kind": "property"
       },
-      "purpose": "Declares the signed DCI identifier field bound to one selector input.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Stable project-local identifier for the entity.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
@@ -51706,7 +49412,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51716,24 +49421,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51741,19 +49444,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -51761,39 +49459,39 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 160
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/response_pointer",
+        "schema": "entity",
+        "pointer": "/properties/materialization",
         "path_kind": "property"
       },
-      "purpose": "Selects the canonical signed-record response location used to recover one selector value.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Authored resource, refresh, and bounded recovery-set retention applied while building entity generations.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -51803,7 +49501,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51813,24 +49510,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51838,19 +49533,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -51858,130 +49548,37 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
+          "keyword": "required",
+          "value": [
+            "max_records",
+            "max_bytes",
+            "refresh",
+            "retain_generations"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/propertyNames",
-        "path_kind": "map_key"
-      },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/inputName",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/sender",
+        "schema": "entity",
+        "pointer": "/properties/materialization/properties/max_bytes",
         "path_kind": "property"
       },
-      "purpose": "Declares the signed DCI sender identifier included in protocol requests.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Maximum encoded size of one generation, up to 1 GiB, as bytes or a KiB/MiB quantity.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
+          "integer",
           "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "required",
       "null_behavior": "rejected",
@@ -51995,102 +49592,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutput/properties/format",
-        "path_kind": "property"
-      },
-      "purpose": "Applies the full-date semantic format to a string-valued integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -52100,24 +49601,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -52125,61 +49624,50 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "date"
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutput/properties/maxLength",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "/properties/materialization/properties/max_bytes/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Caps the character length produced for a string-valued integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -52189,24 +49677,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -52214,28 +49700,24 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 16384
+          "value": 1073741824
         },
         {
           "keyword": "minimum",
@@ -52249,34 +49731,33 @@
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutput/properties/maximum",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "/properties/materialization/properties/max_bytes/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Sets the inclusive upper bound produced for an integer-valued integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -52286,24 +49767,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -52311,57 +49790,49 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,5}|10[0-3][0-9]{4}|104[0-7][0-9]{3}|1048[0-4][0-9]{2}|10485[0-6][0-9]|104857[0-6])KiB|(?:[1-9][0-9]{0,2}|10[0-1][0-9]|102[0-4])MiB)$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutput/properties/minimum",
+        "schema": "entity",
+        "pointer": "/properties/materialization/properties/max_records",
         "path_kind": "property"
       },
-      "purpose": "Sets the inclusive lower bound produced for an integer-valued integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Maximum number of records allowed in one generation.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -52373,7 +49844,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -52383,24 +49853,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -52408,19 +49876,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -52429,11 +49892,11 @@
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 9223372036854775807
+          "value": 100000000
         },
         {
           "keyword": "minimum",
-          "value": -9223372036854775808
+          "value": 1
         },
         {
           "keyword": "type",
@@ -52443,111 +49906,22 @@
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutput/properties/type",
+        "schema": "entity",
+        "pointer": "/properties/materialization/properties/refresh",
         "path_kind": "property"
       },
-      "purpose": "Supported scalar type, optionally paired with null for nullable values.",
+      "purpose": "Refresh cadence as a canonical positive duration no greater than 30 days, or manual when an operator initiates every refresh.",
       "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/scalarType",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarType"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutput/properties/x-registry-source",
-        "path_kind": "property"
-      },
-      "purpose": "Selects the canonical source-response location from which the HTTP output is extracted.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -52559,7 +49933,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -52569,55656 +49942,72 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutputSchema/properties/format",
-        "path_kind": "property"
-      },
-      "purpose": "Applies the full-date semantic format to a string-valued field inside a structured integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "date"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutputSchema/properties/maxLength",
-        "path_kind": "property"
-      },
-      "purpose": "Caps the character length produced for a string-valued field inside a structured integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 16384
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutputSchema/properties/maximum",
-        "path_kind": "property"
-      },
-      "purpose": "Sets the inclusive upper bound produced for an integer-valued field inside a structured integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutputSchema/properties/minimum",
-        "path_kind": "property"
-      },
-      "purpose": "Sets the inclusive lower bound produced for an integer-valued field inside a structured integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutputSchema/properties/type",
-        "path_kind": "property"
-      },
-      "purpose": "Supported scalar type, optionally paired with null for nullable values.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/scalarType",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarType"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarType/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarType/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 2
-        },
-        {
-          "keyword": "minItems",
-          "value": 2
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0",
-        "path_kind": "array_item"
-      },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1",
-        "path_kind": "array_item"
-      },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "null"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/allow",
-        "path_kind": "property"
-      },
-      "purpose": "Constrains source access to the explicitly reviewed method and path templates in this integration contract.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/allow/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "One read-only upstream method and path pattern the adapter may call.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/allowRule",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "method",
-            "path"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/allowRule"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/auth",
-        "path_kind": "property"
-      },
-      "purpose": "Declares the credential interface the source contract permits without embedding an environment credential value.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/credential",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/credential"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/product",
-        "path_kind": "property"
-      },
-      "purpose": "Names the source product whose version labels are classified by this integration contract.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/protocol",
-        "path_kind": "property"
-      },
-      "purpose": "Optional interoperable protocol profiles layered over the source transport.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/protocol",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/request_headers",
-        "path_kind": "property"
-      },
-      "purpose": "Lists the bounded source request header names available to the integration adapter.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 32
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/request_headers/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/response",
-        "path_kind": "property"
-      },
-      "purpose": "Defines the reviewed source response representation and optional byte bound.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/response/properties/format",
-        "path_kind": "property"
-      },
-      "purpose": "Selects JSON decoding or text handling for reviewed source responses.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "json",
-            "text"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/response/properties/max_bytes",
-        "path_kind": "property"
-      },
-      "purpose": "Maximum bytes accepted from one source response, defaulting to 512 KiB and capped at 8 MiB. Use a positive byte integer or canonical KiB/MiB value.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "string"
-        ],
-        "local_reference": "#/$defs/integrationResponseByteSize",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "schema_value": "512KiB"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationResponseByteSize"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/response_headers",
-        "path_kind": "property"
-      },
-      "purpose": "Lists the bounded source response header names available to the integration adapter.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 32
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/response_headers/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/versions",
-        "path_kind": "property"
-      },
-      "purpose": "Source versions tested by the project and versions explicitly accepted as unverified.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/versions",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/versions"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/versionList/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/versions/anyOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "tested"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/versions/anyOf/0/properties/tested",
-        "path_kind": "property"
-      },
-      "purpose": "Requires at least one source product version to be classified as tested in this integration contract.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "minItems",
-          "value": 1
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/versions/anyOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "unverified"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/versions/anyOf/1/properties/unverified",
-        "path_kind": "property"
-      },
-      "purpose": "Requires at least one source product version to be classified as unverified in this integration contract.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "minItems",
-          "value": 1
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/versions/properties/tested",
-        "path_kind": "property"
-      },
-      "purpose": "Bounded list of source version labels.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/versionList",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 32
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/versionList"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/versions/properties/unverified",
-        "path_kind": "property"
-      },
-      "purpose": "Bounded list of source version labels.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/versionList",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 32
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/versionList"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/capability",
-        "path_kind": "property"
-      },
-      "purpose": "Exactly one bounded execution mechanism for the source adaptation.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/capability",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/capability"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/id",
-        "path_kind": "property"
-      },
-      "purpose": "Stable project-local identifier for the integration.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/stableId"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/input",
-        "path_kind": "property"
-      },
-      "purpose": "Typed selector and parameter inputs accepted by this integration.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 16
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/input/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "Type, validation, and canonicalization rules for one authored input.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/input",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "role",
-            "type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/input"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/input/propertyNames",
-        "path_kind": "map_key"
-      },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/inputName",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/limits",
-        "path_kind": "property"
-      },
-      "purpose": "Optional tighter resource limits for one integration execution.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/limits",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/limits"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/not_applicable",
-        "path_kind": "property"
-      },
-      "purpose": "Explicit rationale and request-fixture evidence for a normally required outcome that the source contract cannot produce.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/notApplicable",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/notApplicable"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs",
-        "path_kind": "property"
-      },
-      "purpose": "Named typed outputs, or a shorthand list of output names inferred by the authoring compiler.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "A bounded scalar or recursively closed structured schema for one normalized integration output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/output",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/output"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/propertyNames",
-        "path_kind": "map_key"
-      },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": true
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/inputName",
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1/not",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "matched",
-            "outcome"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 64
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/1/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/inputName",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/revision",
-        "path_kind": "property"
-      },
-      "purpose": "Monotonically increasing revision of this integration contract.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/source",
-        "path_kind": "property"
-      },
-      "purpose": "Optional source product metadata and transport policy; capabilities remain product-neutral.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/source",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "auth"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/source"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/version",
-        "path_kind": "property"
-      },
-      "purpose": "Integration authoring format version.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "public",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": 1
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "",
-        "path_kind": "root"
-      },
-      "purpose": "Defines one synthetic, deterministic integration scenario for offline adapter verification.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "classification",
-            "input",
-            "interactions",
-            "expect"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/expectation/properties/claims",
-        "path_kind": "property"
-      },
-      "purpose": "States the synthetic Notary claim outcomes expected after the reviewed Relay consultation behavior.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/expectation/properties/error",
-        "path_kind": "property"
-      },
-      "purpose": "States the bounded error identifier expected from a failing offline fixture.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/expectation/properties/outcome",
-        "path_kind": "property"
-      },
-      "purpose": "States whether the offline fixture is expected to match, find no match, or remain ambiguous.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "match",
-            "no_match",
-            "ambiguous"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/expectation/properties/outputs",
-        "path_kind": "property"
-      },
-      "purpose": "Maps integration output names to the synthetic values expected after fixture execution.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/fixtureBody/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "file"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/fixtureBody/oneOf/0/properties/file",
-        "path_kind": "property"
-      },
-      "purpose": "Selects a fixture-local synthetic body file beneath the reserved bodies directory.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 8
-        },
-        {
-          "keyword": "pattern",
-          "value": "^bodies/(?!\\.\\.?/)(?!.*(?:/)\\.\\.?/)(?!.*//).+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/fixtureBody/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/fixtureBody/oneOf/1/not",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "file"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef/oneOf/1/properties/id",
-        "path_kind": "property"
-      },
-      "purpose": "Names one authored claim requested by this fixture witness.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef/oneOf/1/properties/version",
-        "path_kind": "property"
-      },
-      "purpose": "Pins the requested claim to one authored claim-policy version.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedIdentifier/properties/scheme",
-        "path_kind": "property"
-      },
-      "purpose": "Names the authored identifier scheme selected by a consultation input mapping.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 96
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedIdentifier/properties/value",
-        "path_kind": "property"
-      },
-      "purpose": "Supplies the synthetic string value bound to this identifier scheme.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/claims",
-        "path_kind": "property"
-      },
-      "purpose": "Lists the authored claims evaluated by this synthetic request witness.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 64
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/claims/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "A requested claim ID, optionally pinned to one authored claim version.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object",
-          "string"
-        ],
-        "local_reference": "#/$defs/governedClaimRef",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/disclosure",
-        "path_kind": "property"
-      },
-      "purpose": "Selects the disclosure mode requested from the authored claim policy.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/format",
-        "path_kind": "property"
-      },
-      "purpose": "Selects the claim-result media type requested from the governed Notary path.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/purpose",
-        "path_kind": "property"
-      },
-      "purpose": "Names the authored service purpose exercised by this synthetic request witness.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/requester",
-        "path_kind": "property"
-      },
-      "purpose": "Supplies a synthetic authenticated requester when selected consultation mappings read requester identifiers.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/governedTarget",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/target",
-        "path_kind": "property"
-      },
-      "purpose": "The synthetic subject target presented to the governed offline fixture boundary.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/governedTarget",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/variables",
-        "path_kind": "property"
-      },
-      "purpose": "Supplies synthetic date variables to the governed evaluation request.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 16
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/variables/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "date"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/variables/propertyNames",
-        "path_kind": "map_key"
-      },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/attributes",
-        "path_kind": "property"
-      },
-      "purpose": "Supplies independently authored typed target attributes for consultation input mapping.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 16
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/attributes/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "boolean",
-          "integer",
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "boolean",
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/id",
-        "path_kind": "property"
-      },
-      "purpose": "Supplies an optional synthetic direct target identifier.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/identifiers",
-        "path_kind": "property"
-      },
-      "purpose": "Supplies independently authored synthetic identifiers for consultation input mapping.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/identifiers/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "One synthetic target identifier with an authored scheme and string value.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/governedIdentifier",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "scheme",
-            "value"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedIdentifier"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/type",
-        "path_kind": "property"
-      },
-      "purpose": "Names the authored target entity type used for claim evaluation.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 64
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/interaction/properties/expect",
-        "path_kind": "property"
-      },
-      "purpose": "Exact HTTP request shape the adapter must produce.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/request",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "method",
-            "path"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/request"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/interaction/properties/respond",
-        "path_kind": "property"
-      },
-      "purpose": "Synthetic HTTP response or timeout returned to the adapter.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/response",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/response"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/body",
-        "path_kind": "property"
-      },
-      "purpose": "Defines the synthetic request body expectation or fixture-local file reference without reading a source.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/fixtureBody",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/fixtureBody"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/headers",
-        "path_kind": "property"
-      },
-      "purpose": "States the synthetic request headers expected from one offline fixture interaction.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 32
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/headers/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 8192
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/headers/propertyNames",
-        "path_kind": "map_key"
-      },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/method",
-        "path_kind": "property"
-      },
-      "purpose": "States the synthetic request method expected from the offline integration fixture.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "GET",
-            "POST"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/path",
-        "path_kind": "property"
-      },
-      "purpose": "States the synthetic request path expected from the offline integration fixture.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^/[^?#]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/query",
-        "path_kind": "property"
-      },
-      "purpose": "States the synthetic query parameters expected from one offline fixture interaction.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/query/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "array",
-          "boolean",
-          "integer",
-          "null",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "boolean",
-          "integer",
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "boolean",
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 64
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "boolean",
-          "integer",
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "boolean",
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "status"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0/properties/body",
-        "path_kind": "property"
-      },
-      "purpose": "Defines the synthetic response body returned by the offline fixture harness to the integration.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/fixtureBody",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/fixtureBody"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0/properties/headers",
-        "path_kind": "property"
-      },
-      "purpose": "Defines the synthetic HTTP response headers returned by the offline fixture harness.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 32
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0/properties/headers/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 8192
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0/properties/status",
-        "path_kind": "property"
-      },
-      "purpose": "Selects the synthetic HTTP status returned by the offline fixture harness.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 599
-        },
-        {
-          "keyword": "minimum",
-          "value": 100
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "timeout"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/1/properties/timeout",
-        "path_kind": "property"
-      },
-      "purpose": "Records bounded synthetic timeout intent; offline execution returns the timeout outcome without waiting for the authored interval.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-9]{4}|20000)ms|(?:[1-9]|1[0-9]|20)s)$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/classification",
-        "path_kind": "property"
-      },
-      "purpose": "Declares that fixture data is synthetic and safe for offline testing.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "public",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "synthetic"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/expect",
-        "path_kind": "property"
-      },
-      "purpose": "Observable adapter result required for the scenario to pass.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/expectation",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/expectation"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/input",
-        "path_kind": "property"
-      },
-      "purpose": "Typed consultation inputs supplied to the adapter under test.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 16
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/input/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "boolean",
-          "integer",
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "boolean",
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/input/propertyNames",
-        "path_kind": "map_key"
-      },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/interactions",
-        "path_kind": "property"
-      },
-      "purpose": "Ordered upstream request and response exchanges expected during execution.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/interactions/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "One expected upstream request paired with its synthetic response.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/interaction",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "expect",
-            "respond"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/interaction"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/name",
-        "path_kind": "property"
-      },
-      "purpose": "Human-readable scenario name shown in test output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "public",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/request",
-        "path_kind": "property"
-      },
-      "purpose": "Optional independently authored synthetic Notary request used to prove the request-to-consultation binding before Relay access.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/governedRequest",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "target",
-            "claims",
-            "purpose"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/variables",
-        "path_kind": "property"
-      },
-      "purpose": "Named date values available to deterministic fixture interpolation.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 16
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/variables/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "date"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/variables/propertyNames",
-        "path_kind": "map_key"
-      },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "",
-        "path_kind": "root"
-      },
-      "purpose": "Defines a bounded, materialized entity that Relay can query without coupling the project to a specific source product.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "version",
-            "id",
-            "revision",
-            "primary_key",
-            "schema",
-            "materialization"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/const",
-        "path_kind": "property"
-      },
-      "purpose": "Requires one entity field to equal the single authored value supplied by this schema constraint.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/enum",
-        "path_kind": "property"
-      },
-      "purpose": "Restricts one entity field to the unique authored values listed by this schema constraint.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "minItems",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/format",
-        "path_kind": "property"
-      },
-      "purpose": "Adds a reviewed semantic format constraint to one string-valued entity field.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "date"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/maxLength",
-        "path_kind": "property"
-      },
-      "purpose": "Caps the character length accepted for one string-valued entity field.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 65536
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/maximum",
-        "path_kind": "property"
-      },
-      "purpose": "Sets the inclusive upper numeric bound accepted for one entity field.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 9007199254740991
-        },
-        {
-          "keyword": "minimum",
-          "value": -9007199254740991
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/minLength",
-        "path_kind": "property"
-      },
-      "purpose": "Sets the minimum character length accepted for one string-valued entity field.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 65536
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/minimum",
-        "path_kind": "property"
-      },
-      "purpose": "Sets the inclusive lower numeric bound accepted for one entity field.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 9007199254740991
-        },
-        {
-          "keyword": "minimum",
-          "value": -9007199254740991
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/pattern",
-        "path_kind": "property"
-      },
-      "purpose": "Constrains a string-valued entity field with the authored regular expression.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 1024
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/type",
-        "path_kind": "property"
-      },
-      "purpose": "Declares the closed scalar, array, or object type accepted for one entity field.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/scalarType",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/scalarType"
-      }
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/additionalProperties",
-        "path_kind": "property"
-      },
-      "purpose": "Controls whether the entity object accepts fields outside its declared closed property set.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": false
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/properties",
-        "path_kind": "property"
-      },
-      "purpose": "Maps every declared entity property name to its closed field schema.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 256
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/properties/additionalProperties",
-        "path_kind": "property"
-      },
-      "purpose": "Bounded schema keywords supported for one scalar materialized field.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/fieldSchema",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema"
-      }
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/properties/propertyNames",
-        "path_kind": "property"
-      },
-      "purpose": "Portable lowercase record field name.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/propertyName",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/propertyName"
-      }
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/required",
-        "path_kind": "property"
-      },
-      "purpose": "Lists the entity properties that every validated materialized record must contain.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 256
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/required/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "Portable lowercase record field name.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/propertyName",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/propertyName"
-      }
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/type",
-        "path_kind": "property"
-      },
-      "purpose": "Declares the materialized entity record schema as an object.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/scalarType/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/scalarType/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 2
-        },
-        {
-          "keyword": "minItems",
-          "value": 2
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0",
-        "path_kind": "array_item"
-      },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1",
-        "path_kind": "array_item"
-      },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "null"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/id",
-        "path_kind": "property"
-      },
-      "purpose": "Stable project-local identifier for the entity.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/stableId"
-      }
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization",
-        "path_kind": "property"
-      },
-      "purpose": "Authored resource, refresh, and bounded recovery-set retention applied while building entity generations.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "max_records",
-            "max_bytes",
-            "refresh",
-            "retain_generations"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/max_bytes",
-        "path_kind": "property"
-      },
-      "purpose": "Maximum encoded size of one generation, up to 1 GiB, as bytes or a KiB/MiB quantity.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/max_bytes/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 1073741824
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/max_bytes/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,5}|10[0-3][0-9]{4}|104[0-7][0-9]{3}|1048[0-4][0-9]{2}|10485[0-6][0-9]|104857[0-6])KiB|(?:[1-9][0-9]{0,2}|10[0-1][0-9]|102[0-4])MiB)$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/max_records",
-        "path_kind": "property"
-      },
-      "purpose": "Maximum number of records allowed in one generation.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 100000000
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/refresh",
-        "path_kind": "property"
-      },
-      "purpose": "Refresh cadence as a canonical positive duration no greater than 30 days, or manual when an operator initiates every refresh.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/refresh/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "manual"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/refresh/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,8}|1[0-9]{9}|2[0-4][0-9]{8}|25[0-8][0-9]{7}|259[0-1][0-9]{6}|2592000000)ms|(?:[1-9][0-9]{0,5}|1[0-9]{6}|2[0-4][0-9]{5}|25[0-8][0-9]{4}|259[0-1][0-9]{3}|2592000)s|(?:[1-9][0-9]{0,3}|[1-3][0-9]{4}|4[0-2][0-9]{3}|43[0-1][0-9]{2}|43200)m|(?:[1-9][0-9]{0,1}|[1-6][0-9]{2}|7[0-1][0-9]{1}|720)h|(?:[1-9][0-9]{0,0}|[1-2][0-9]{1}|30)d)$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/retain_generations",
-        "path_kind": "property"
-      },
-      "purpose": "Number of completed cache generations, including the active generation, retained as a bounded recovery set after successful publication. This does not make arbitrary retained generations selectable for rollback.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 16
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/primary_key",
-        "path_kind": "property"
-      },
-      "purpose": "Field whose value uniquely identifies each materialized record.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/stableId"
-      }
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/revision",
-        "path_kind": "property"
-      },
-      "purpose": "Monotonically increasing revision of this entity definition.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/schema",
-        "path_kind": "property"
-      },
-      "purpose": "Closed JSON object schema for materialized records.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/objectSchema",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type",
-            "additionalProperties",
-            "required",
-            "properties"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema"
-      }
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/version",
-        "path_kind": "property"
-      },
-      "purpose": "Entity authoring format version.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "public",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": 1
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "",
-        "key_path": "",
-        "path_kind": "root"
-      },
-      "purpose": "Root configuration document. Parsed from YAML at startup.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_root_structural",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "server",
-            "catalog",
-            "auth",
-            "audit",
-            "datasets"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
-        "key_path": "datasets[].aggregates[].access.aggregate_only_execution",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
-        "key_path": "datasets[].entities[].aggregates[].access.aggregate_only_execution",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
-        "key_path": "datasets[].tables[].aggregates[].access.aggregate_only_execution",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].aggregates[].access.aggregate_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].entities[].aggregates[].access.aggregate_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].tables[].aggregates[].access.aggregate_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].aggregates[].access.metadata_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].entities[].aggregates[].access.metadata_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].tables[].aggregates[].access.metadata_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/access",
-        "key_path": "datasets[].aggregates[].access",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/access",
-        "key_path": "datasets[].entities[].aggregates[].access",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/access",
-        "key_path": "datasets[].tables[].aggregates[].access",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
-        "key_path": "datasets[].aggregates[].allowed_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].aggregates[].allowed_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AllowedFilter",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "ops"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AllowedFilter",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "ops"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AllowedFilter",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "ops"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
-        "key_path": "datasets[].aggregates[].default_group_by",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
-        "key_path": "datasets[].entities[].aggregates[].default_group_by",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
-        "key_path": "datasets[].tables[].aggregates[].default_group_by",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
-        "key_path": "datasets[].aggregates[].default_group_by[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
-        "key_path": "datasets[].entities[].aggregates[].default_group_by[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
-        "key_path": "datasets[].tables[].aggregates[].default_group_by[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/description",
-        "key_path": "datasets[].aggregates[].description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/description",
-        "key_path": "datasets[].entities[].aggregates[].description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/description",
-        "key_path": "datasets[].tables[].aggregates[].description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions",
-        "key_path": "datasets[].aggregates[].dimensions",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions",
-        "key_path": "datasets[].entities[].aggregates[].dimensions",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions",
-        "key_path": "datasets[].tables[].aggregates[].dimensions",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
-        "key_path": "datasets[].aggregates[].dimensions[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateDimensionConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateDimensionConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateDimensionConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
-        "key_path": "datasets[].aggregates[].disclosure_control",
-        "path_kind": "property"
-      },
-      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/DisclosureControlConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control",
-        "path_kind": "property"
-      },
-      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/DisclosureControlConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control",
-        "path_kind": "property"
-      },
-      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/DisclosureControlConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by",
-        "key_path": "datasets[].aggregates[].group_by",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by",
-        "key_path": "datasets[].entities[].aggregates[].group_by",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by",
-        "key_path": "datasets[].tables[].aggregates[].group_by",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
-        "key_path": "datasets[].aggregates[].group_by[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
-        "key_path": "datasets[].entities[].aggregates[].group_by[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
-        "key_path": "datasets[].tables[].aggregates[].group_by[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/id",
-        "key_path": "datasets[].aggregates[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate identifier within a resource.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateId"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/id",
-        "key_path": "datasets[].entities[].aggregates[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate identifier within a resource.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateId"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/id",
-        "key_path": "datasets[].tables[].aggregates[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate identifier within a resource.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateId"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators",
-        "key_path": "datasets[].aggregates[].indicators",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators",
-        "key_path": "datasets[].entities[].aggregates[].indicators",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators",
-        "key_path": "datasets[].tables[].aggregates[].indicators",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
-        "key_path": "datasets[].aggregates[].indicators[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateIndicatorConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "function",
-            "column",
-            "unit_measure"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
-        "key_path": "datasets[].entities[].aggregates[].indicators[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateIndicatorConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "function",
-            "column",
-            "unit_measure"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
-        "key_path": "datasets[].tables[].aggregates[].indicators[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateIndicatorConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "function",
-            "column",
-            "unit_measure"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins",
-        "key_path": "datasets[].aggregates[].joins",
-        "path_kind": "property"
-      },
-      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins",
-        "key_path": "datasets[].entities[].aggregates[].joins",
-        "path_kind": "property"
-      },
-      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins",
-        "key_path": "datasets[].tables[].aggregates[].joins",
-        "path_kind": "property"
-      },
-      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins/items",
-        "key_path": "datasets[].aggregates[].joins[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateJoinConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins/items",
-        "key_path": "datasets[].entities[].aggregates[].joins[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateJoinConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins/items",
-        "key_path": "datasets[].tables[].aggregates[].joins[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateJoinConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures",
-        "key_path": "datasets[].aggregates[].measures",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures",
-        "key_path": "datasets[].entities[].aggregates[].measures",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures",
-        "key_path": "datasets[].tables[].aggregates[].measures",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures/items",
-        "key_path": "datasets[].aggregates[].measures[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One measure inside an aggregate.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateMeasure",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "function",
-            "column"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures/items",
-        "key_path": "datasets[].entities[].aggregates[].measures[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One measure inside an aggregate.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateMeasure",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "function",
-            "column"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures/items",
-        "key_path": "datasets[].tables[].aggregates[].measures[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One measure inside an aggregate.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateMeasure",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "function",
-            "column"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
-        "key_path": "datasets[].aggregates[].required_filter_bindings",
-        "path_kind": "property"
-      },
-      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
-        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings",
-        "path_kind": "property"
-      },
-      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
-        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings",
-        "path_kind": "property"
-      },
-      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
-        "key_path": "datasets[].aggregates[].required_filter_bindings[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/RequiredFilterBindingConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
-        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/RequiredFilterBindingConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
-        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/RequiredFilterBindingConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters",
-        "key_path": "datasets[].aggregates[].required_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters",
-        "key_path": "datasets[].entities[].aggregates[].required_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters",
-        "key_path": "datasets[].tables[].aggregates[].required_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
-        "key_path": "datasets[].aggregates[].required_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
-        "key_path": "datasets[].entities[].aggregates[].required_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
-        "key_path": "datasets[].tables[].aggregates[].required_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/source_entity",
-        "key_path": "datasets[].aggregates[].source_entity",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/source_entity",
-        "key_path": "datasets[].entities[].aggregates[].source_entity",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/source_entity",
-        "key_path": "datasets[].tables[].aggregates[].source_entity",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/spatial",
-        "key_path": "datasets[].aggregates[].spatial",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "mode",
-            "dimension",
-            "geometry_entity",
-            "geometry_id_field",
-            "geometry_field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/spatial",
-        "key_path": "datasets[].entities[].aggregates[].spatial",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "mode",
-            "dimension",
-            "geometry_entity",
-            "geometry_id_field",
-            "geometry_field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/spatial",
-        "key_path": "datasets[].tables[].aggregates[].spatial",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "mode",
-            "dimension",
-            "geometry_entity",
-            "geometry_id_field",
-            "geometry_field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
-        "key_path": "datasets[].aggregates[].temporal_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
-        "key_path": "datasets[].entities[].aggregates[].temporal_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
-        "key_path": "datasets[].tables[].aggregates[].temporal_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/title",
-        "key_path": "datasets[].aggregates[].title",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/title",
-        "key_path": "datasets[].entities[].aggregates[].title",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/title",
-        "key_path": "datasets[].tables[].aggregates[].title",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
-        "key_path": "datasets[].aggregates[].dimensions[].codelist",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[].codelist",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[].codelist",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
-        "key_path": "datasets[].aggregates[].dimensions[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
-        "key_path": "datasets[].aggregates[].dimensions[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
-        "key_path": "datasets[].aggregates[].dimensions[].label",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[].label",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[].label",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
-        "key_path": "datasets[].aggregates[].indicators[].column",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].column",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].column",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
-        "key_path": "datasets[].aggregates[].indicators[].decimals",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].decimals",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].decimals",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
-        "key_path": "datasets[].aggregates[].indicators[].definition_uri",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].definition_uri",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].definition_uri",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
-        "key_path": "datasets[].aggregates[].indicators[].frequency",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].frequency",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].frequency",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
-        "key_path": "datasets[].aggregates[].indicators[].function",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateFunction",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].function",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateFunction",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].function",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateFunction",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
-        "key_path": "datasets[].aggregates[].indicators[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
-        "key_path": "datasets[].aggregates[].indicators[].label",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].label",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].label",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
-        "key_path": "datasets[].aggregates[].indicators[].unit_measure",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].unit_measure",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].unit_measure",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
-        "key_path": "datasets[].aggregates[].indicators[].unit_mult",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "int32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 2147483647
-        },
-        {
-          "keyword": "minimum",
-          "value": -2147483648
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].unit_mult",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "int32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 2147483647
-        },
-        {
-          "keyword": "minimum",
-          "value": -2147483648
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].unit_mult",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "int32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 2147483647
-        },
-        {
-          "keyword": "minimum",
-          "value": -2147483648
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
-        "key_path": "datasets[].aggregates[].joins[].relationship",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
-        "key_path": "datasets[].entities[].aggregates[].joins[].relationship",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
-        "key_path": "datasets[].tables[].aggregates[].joins[].relationship",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/column",
-        "key_path": "datasets[].aggregates[].measures[].column",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/column",
-        "key_path": "datasets[].entities[].aggregates[].measures[].column",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/column",
-        "key_path": "datasets[].tables[].aggregates[].measures[].column",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/function",
-        "key_path": "datasets[].aggregates[].measures[].function",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateFunction",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/function",
-        "key_path": "datasets[].entities[].aggregates[].measures[].function",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateFunction",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/function",
-        "key_path": "datasets[].tables[].aggregates[].measures[].function",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateFunction",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/name",
-        "key_path": "datasets[].aggregates[].measures[].name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/name",
-        "key_path": "datasets[].entities[].aggregates[].measures[].name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/name",
-        "key_path": "datasets[].tables[].aggregates[].measures[].name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
-        "key_path": "datasets[].aggregates[].spatial.collection_id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
-        "key_path": "datasets[].entities[].aggregates[].spatial.collection_id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
-        "key_path": "datasets[].tables[].aggregates[].spatial.collection_id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
-        "key_path": "datasets[].aggregates[].spatial.dimension",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
-        "key_path": "datasets[].entities[].aggregates[].spatial.dimension",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
-        "key_path": "datasets[].tables[].aggregates[].spatial.dimension",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
-        "key_path": "datasets[].aggregates[].spatial.geometry_entity",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
-        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_entity",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
-        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_entity",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
-        "key_path": "datasets[].aggregates[].spatial.geometry_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
-        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
-        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
-        "key_path": "datasets[].aggregates[].spatial.geometry_id_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
-        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_id_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
-        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_id_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
-        "key_path": "datasets[].aggregates[].spatial.max_geometry_vertices",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
-        "key_path": "datasets[].entities[].aggregates[].spatial.max_geometry_vertices",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
-        "key_path": "datasets[].tables[].aggregates[].spatial.max_geometry_vertices",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].aggregates[].spatial.mode",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "admin_area"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].entities[].aggregates[].spatial.mode",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "admin_area"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].tables[].aggregates[].spatial.mode",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "admin_area"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].aggregates[].allowed_filters[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].entities[].api.allowed_filters[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].tables[].api.allowed_filters[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].aggregates[].allowed_filters[].ops",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].entities[].api.allowed_filters[].ops",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].tables[].api.allowed_filters[].ops",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].aggregates[].allowed_filters[].ops[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Filter operator opted into per field.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/FilterOp",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Filter operator opted into per field.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/FilterOp",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].entities[].api.allowed_filters[].ops[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Filter operator opted into per field.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/FilterOp",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Filter operator opted into per field.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/FilterOp",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].tables[].api.allowed_filters[].ops[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Filter operator opted into per field.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/FilterOp",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig/properties/fingerprint",
-        "key_path": "auth.api_keys[].fingerprint",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/CredentialFingerprintSchema",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "provider",
-              "name"
-            ],
-            [
-              "provider",
-              "path"
-            ]
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/CredentialFingerprintSchema"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig/properties/id",
-        "key_path": "auth.api_keys[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig/properties/scopes",
-        "key_path": "auth.api_keys[].scopes",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig/properties/scopes/items",
-        "key_path": "auth.api_keys[].scopes[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/claims",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims",
-        "path_kind": "property"
-      },
-      "purpose": "Claims released on success. Non-empty; at least one `required`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/claims/items",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "A single released claim. Exactly one of `source_field` or `expression`\nmust be set: a claim is either a direct source-field projection or a\nCEL-computed value.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ReleaseClaimConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/description",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/id",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Profile identifier, lower-kebab/snake (`^[a-z][a-z0-9_-]*$`). Globally\nunique with `version`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/purpose",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].purpose",
-        "path_kind": "property"
-      },
-      "purpose": "Data-purpose this profile is bound to. When the backing entity declares\n`governed_policy.permitted_purposes`, this must be a member.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/release_conditions",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "expression"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/release_scope",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].release_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Dataset-bound scope a caller must hold to invoke this release. The\nstable profile is exactly `<dataset_id>:identity_release`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/response",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].response",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ReleaseResponseConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseResponseConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/subject",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].subject",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ReleaseSubjectConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "source_field",
-            "id_type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseSubjectConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/title",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].title",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/version",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].version",
-        "path_kind": "property"
-      },
-      "purpose": "Profile version. Globally unique with `id`; no silent \"latest\".",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig/oneOf/0/properties/sink",
-        "key_path": "audit.sink",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "file",
-            "stdout",
-            "syslog"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig/oneOf/1/properties/path",
-        "key_path": "audit.path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig/oneOf/1/properties/rotate",
-        "key_path": "audit.rotate",
-        "path_kind": "property"
-      },
-      "purpose": "In-process rotation for the `file` audit sink.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/RotateConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "max_size_mb",
-            "max_files"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RotateConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/chain",
-        "key_path": "audit.chain",
-        "path_kind": "property"
-      },
-      "purpose": "Retains the compatibility switch in the authored contract; Relay audit envelopes remain integrity-chained regardless of this setting.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_audit_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/format",
-        "key_path": "audit.format",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AuditFormat",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "jsonl"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditFormat"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/hash_secret_env",
-        "key_path": "audit.hash_secret_env",
-        "path_kind": "property"
-      },
-      "purpose": "Name of the environment variable holding the per-deploy secret\nused to HMAC sensitive audit values (single-record primary keys,\nsensitive query parameters). Runtime startup fails closed when\nthis field is unset, empty, or points to a missing, empty, or\nweak secret. Direct middleware tests can opt into the explicit\nunkeyed dev-only hasher without using runtime config.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[^=\\x00]*[^=\\x00\\x09-\\x0D\\x20\\x85\\u00A0\\u1680\\u2000-\\u200A\\u2028\\u2029\\u202F\\u205F\\u3000][^=\\x00]*$"
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/include_health",
-        "key_path": "audit.include_health",
-        "path_kind": "property"
-      },
-      "purpose": "Include `/healthz` liveness probes in the audit stream. `/ready` is\nalways excluded because auditing it would advance the chain after its\nzero-backlog shipping check and self-invalidate the next probe.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/write_policy",
-        "key_path": "audit.write_policy",
-        "path_kind": "property"
-      },
-      "purpose": "Behavior when an audit record fails to write.\n\n`fail_closed` (default) fails the request with a stable error code so\nthat no request outcome is returned without a durable audit record.\n`availability_first` logs the failure and lets the request succeed for\ndeployments that explicitly accept best-effort audit durability.\nPer-route-family selection is out of scope; this is a single\ndeployment-wide policy.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AuditWritePolicySchema",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "availability_first",
-            "fail_closed",
-            "fail_closed_route_families"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditWritePolicySchema"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig/items",
-        "key_path": "consultation.audit_pseudonym_materials[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One public epoch id bound to one secret source reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AuditPseudonymMaterialConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "key_id",
-            "source"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/key_id",
-        "key_path": "consultation.audit_pseudonym_materials[].key_id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AuditPseudonymKeyIdSchema",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z0-9][a-z0-9._-]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymKeyIdSchema"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/source",
-        "key_path": "consultation.audit_pseudonym_materials[].source",
-        "path_kind": "property"
-      },
-      "purpose": "Closed v1 set of audit-pseudonym secret source providers.\n\nThe configured name is a reference only. Secret values cannot be embedded\nin this model and are loaded exactly once during runtime compilation.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AuditPseudonymSecretSourceConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "provider",
-            "name"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymSecretSourceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/name",
-        "key_path": "consultation.audit_pseudonym_materials[].source.name",
-        "path_kind": "property"
-      },
-      "purpose": "Portable environment-variable name used only as a secret reference.\n\nDebug output is redacted even though the name is not itself key material,\npreventing configuration diagnostics from disclosing secret topology.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AuditPseudonymSecretEnvironmentName",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymSecretEnvironmentName"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/provider",
-        "key_path": "consultation.audit_pseudonym_materials[].source.provider",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "environment"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/api_keys",
-        "key_path": "auth.api_keys",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/api_keys/items",
-        "key_path": "auth.api_keys[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One configured API key, identified by an id and a fingerprint reference.\nThe raw key never appears in config.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ApiKeyConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "fingerprint"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/failure_throttle",
-        "key_path": "auth.failure_throttle",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AuthFailureThrottleConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthFailureThrottleConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/mode",
-        "key_path": "auth.mode",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AuthMode",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "api_key",
-            "oidc"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthMode"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/oidc",
-        "key_path": "auth.oidc",
-        "path_kind": "property"
-      },
-      "purpose": "OIDC / OAuth2 resource-server configuration. The relay validates\nincoming bearer JWTs against a configured external IdP. No tokens\nare minted here.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "issuer",
-            "audiences"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthFailureThrottleConfig/properties/enabled",
-        "key_path": "auth.failure_throttle.enabled",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthFailureThrottleConfig/properties/max_failures",
-        "key_path": "auth.failure_throttle.max_failures",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthFailureThrottleConfig/properties/window_seconds",
-        "key_path": "auth.failure_throttle.window_seconds",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/authority_type",
-        "key_path": "catalog.authority_type",
-        "path_kind": "property"
-      },
-      "purpose": "BRegDCAT-AP: type IRI for the `foaf:Agent` publisher. When set, emits\n`dcterms:type` on the publisher node.\n\nBRegDCAT-AP 2.1.0 SHACL checks publisher type values against the ADMS\npublishertype scheme (`http://purl.org/adms/publishertype/...`).\nThe relay does not enforce a vocabulary: any IRI passes through.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_catalog_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/base_url",
-        "key_path": "catalog.base_url",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay catalog identity and public metadata exposed for governed discovery.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_catalog_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/default_spatial_coverage",
-        "key_path": "catalog.default_spatial_coverage",
-        "path_kind": "property"
-      },
-      "purpose": "BRegDCAT-AP: default `dcterms:spatial` IRI applied to datasets that\ndo not declare their own `spatial_coverage`. Typically an EU\nauthority country IRI under\n`http://publications.europa.eu/resource/authority/country/`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_catalog_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/participant_id",
-        "key_path": "catalog.participant_id",
-        "path_kind": "property"
-      },
-      "purpose": "Identifies the participant in catalog output; when omitted, Relay derives the participant identifier from the reviewed catalog base URL.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_catalog_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/publisher",
-        "key_path": "catalog.publisher",
-        "path_kind": "property"
-      },
-      "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_catalog_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/publisher_iri",
-        "key_path": "catalog.publisher_iri",
-        "path_kind": "property"
-      },
-      "purpose": "BRegDCAT-AP: identifier IRI for the `foaf:Agent` publisher. Use a\ncontrolled-vocabulary corporate body IRI when publishing strict\nBRegDCAT-AP.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_catalog_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/title",
-        "key_path": "catalog.title",
-        "path_kind": "property"
-      },
-      "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_catalog_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path",
-        "key_path": "config_trust.antirollback_state_path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_config_trust_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path",
-        "key_path": "config_trust.break_glass_override_path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_config_trust_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path",
-        "key_path": "config_trust.bundle_path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_config_trust_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path",
-        "key_path": "config_trust.trust_anchor_path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_config_trust_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence",
-        "key_path": "consultation.artifacts.evidence",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence/items",
-        "key_path": "consultation.artifacts.evidence[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One bounded, hash-pinned integration evidence file.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ConsultationEvidenceArtifactConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "class",
-            "path",
-            "sha256"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceArtifactConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs",
-        "key_path": "consultation.artifacts.integration_packs",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs/items",
-        "key_path": "consultation.artifacts.integration_packs[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One hash-pinned public contract or reviewed integration pack.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "path",
-            "hash",
-            "sha256"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings",
-        "key_path": "consultation.artifacts.private_bindings",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings/items",
-        "key_path": "consultation.artifacts.private_bindings[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One hash-pinned public contract or reviewed integration pack.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "path",
-            "hash",
-            "sha256"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts",
-        "key_path": "consultation.artifacts.public_contracts",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts/items",
-        "key_path": "consultation.artifacts.public_contracts[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One hash-pinned public contract or reviewed integration pack.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "path",
-            "hash",
-            "sha256"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts",
-        "key_path": "consultation.artifacts.rhai_scripts",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts/items",
-        "key_path": "consultation.artifacts.rhai_scripts[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One hash-pinned private binding or standalone Rhai script.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ConsultationArtifactReferenceConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "path",
-            "sha256"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactReferenceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/path",
-        "key_path": "consultation.artifacts.rhai_scripts[].path",
-        "path_kind": "property"
-      },
-      "purpose": "Normalized bundle-root-relative path.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/sha256",
-        "key_path": "consultation.artifacts.rhai_scripts[].sha256",
-        "path_kind": "property"
-      },
-      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/active_key_id",
-        "key_path": "consultation.bootstrap.active_key_id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/active_write_deadline_unix_ms",
-        "key_path": "consultation.bootstrap.active_write_deadline_unix_ms",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "int64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/audit_event_retention_ms",
-        "key_path": "consultation.bootstrap.audit_event_retention_ms",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "int64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/keyring_maintenance_database_url_env",
-        "key_path": "consultation.bootstrap.keyring_maintenance_database_url_env",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/keyring_reader_database_url_env",
-        "key_path": "consultation.bootstrap.keyring_reader_database_url_env",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/migration_database_url_env",
-        "key_path": "consultation.bootstrap.migration_database_url_env",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/owner_role",
-        "key_path": "consultation.bootstrap.owner_role",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/artifacts",
-        "key_path": "consultation.artifacts",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "public_contracts",
-            "integration_packs",
-            "private_bindings",
-            "evidence"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/audit_pseudonym_materials",
-        "key_path": "consultation.audit_pseudonym_materials",
-        "path_kind": "property"
-      },
-      "purpose": "Bounded startup catalog of audit-pseudonym material references.\n\nThe 1..=32 bound and cross-entry uniqueness are enforced by config\nvalidation and repeated by the material provider before loading secrets.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/AuditPseudonymMaterialCatalogConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/authorized_workload",
-        "key_path": "consultation.authorized_workload",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ConsultationWorkloadConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "audience",
-            "client_claim_selector",
-            "client_value",
-            "principal_id"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/bootstrap",
-        "key_path": "consultation.bootstrap",
-        "path_kind": "property"
-      },
-      "purpose": "Binds the product-owned first-install policy carried only by the verified consultation bundle; deployment renderers cannot reproduce it as command arguments.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "migration_database_url_env",
-            "owner_role",
-            "keyring_maintenance_database_url_env",
-            "keyring_reader_database_url_env",
-            "active_key_id",
-            "active_write_deadline_unix_ms",
-            "audit_event_retention_ms"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/source_credentials",
-        "key_path": "consultation.source_credentials",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/ConsultationSourceCredentialCatalogConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/state_plane",
-        "key_path": "consultation.state_plane",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ConsultationStatePlaneConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "database_url_env",
-            "chain_key_epoch_id",
-            "serving_fence_lock_key",
-            "audit_pseudonym_keyring_lock_key"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/class",
-        "key_path": "consultation.artifacts.evidence[].class",
-        "path_kind": "property"
-      },
-      "purpose": "Closed evidence classes understood by consultation source-plan v1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationEvidenceClassConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "conformance",
-            "negative_security",
-            "minimization"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceClassConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/path",
-        "key_path": "consultation.artifacts.evidence[].path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/sha256",
-        "key_path": "consultation.artifacts.evidence[].sha256",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig/items",
-        "key_path": "consultation.source_credentials[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Closed V1 source-credential provider configuration.\n\nEnvironment names are opaque references and are redacted from `Debug`.\nThere is deliberately no field capable of carrying an embedded username,\npassword, bearer token, or provider-specific extension.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ConsultationSourceCredentialConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "type",
-              "ref",
-              "generation",
-              "client_id_env",
-              "client_secret_env"
-            ],
-            [
-              "type",
-              "ref",
-              "generation",
-              "token_env"
-            ],
-            [
-              "type",
-              "ref",
-              "generation",
-              "username_env",
-              "password_env"
-            ],
-            [
-              "type",
-              "ref",
-              "generation",
-              "value_env"
-            ]
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/generation",
-        "key_path": "consultation.source_credentials[].generation",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/password_env",
-        "key_path": "consultation.source_credentials[].password_env",
-        "path_kind": "property"
-      },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/ref",
-        "key_path": "consultation.source_credentials[].ref",
-        "path_kind": "property"
-      },
-      "purpose": "Exact private-binding credential reference grammar.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationSourceCredentialReference",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialReference"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/type",
-        "key_path": "consultation.source_credentials[].type",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "api_key_header",
-            "api_key_query",
-            "basic",
-            "oauth_client_credentials",
-            "static_bearer"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/username_env",
-        "key_path": "consultation.source_credentials[].username_env",
-        "path_kind": "property"
-      },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/1/properties/token_env",
-        "key_path": "consultation.source_credentials[].token_env",
-        "path_kind": "property"
-      },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/2/properties/value_env",
-        "key_path": "consultation.source_credentials[].value_env",
-        "path_kind": "property"
-      },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_id_env",
-        "key_path": "consultation.source_credentials[].client_id_env",
-        "path_kind": "property"
-      },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_secret_env",
-        "key_path": "consultation.source_credentials[].client_secret_env",
-        "path_kind": "property"
-      },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/audit_pseudonym_keyring_lock_key",
-        "key_path": "consultation.state_plane.audit_pseudonym_keyring_lock_key",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "int64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/chain_key_epoch_id",
-        "key_path": "consultation.state_plane.chain_key_epoch_id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/database_url_env",
-        "key_path": "consultation.state_plane.database_url_env",
-        "path_kind": "property"
-      },
-      "purpose": "Portable environment-variable name that resolves the state-plane URL.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationDatabaseUrlEnvironmentName",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationDatabaseUrlEnvironmentName"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/root_certificate_path",
-        "key_path": "consultation.state_plane.root_certificate_path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/serving_fence_lock_key",
-        "key_path": "consultation.state_plane.serving_fence_lock_key",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "int64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
-        "key_path": "consultation.artifacts.integration_packs[].hash",
-        "path_kind": "property"
-      },
-      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
-        "key_path": "consultation.artifacts.private_bindings[].hash",
-        "path_kind": "property"
-      },
-      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
-        "key_path": "consultation.artifacts.public_contracts[].hash",
-        "path_kind": "property"
-      },
-      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
-        "key_path": "consultation.artifacts.integration_packs[].path",
-        "path_kind": "property"
-      },
-      "purpose": "Normalized bundle-root-relative path.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
-        "key_path": "consultation.artifacts.private_bindings[].path",
-        "path_kind": "property"
-      },
-      "purpose": "Normalized bundle-root-relative path.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
-        "key_path": "consultation.artifacts.public_contracts[].path",
-        "path_kind": "property"
-      },
-      "purpose": "Normalized bundle-root-relative path.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
-        "key_path": "consultation.artifacts.integration_packs[].sha256",
-        "path_kind": "property"
-      },
-      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
-        "key_path": "consultation.artifacts.private_bindings[].sha256",
-        "path_kind": "property"
-      },
-      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
-        "key_path": "consultation.artifacts.public_contracts[].sha256",
-        "path_kind": "property"
-      },
-      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig/properties/audience",
-        "key_path": "consultation.authorized_workload.audience",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_claim_selector",
-        "key_path": "consultation.authorized_workload.client_claim_selector",
-        "path_kind": "property"
-      },
-      "purpose": "Closed set of verified OAuth claims that may identify Registry Notary.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationClientClaimSelectorConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "azp",
-            "client_id"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationClientClaimSelectorConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_value",
-        "key_path": "consultation.authorized_workload.client_value",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig/properties/principal_id",
-        "key_path": "consultation.authorized_workload.principal_id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CorsConfig/properties/allowed_origins",
-        "key_path": "server.cors.allowed_origins",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CorsConfig/properties/allowed_origins/items",
-        "key_path": "server.cors.allowed_origins[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/name",
-        "key_path": "auth.api_keys[].fingerprint.name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/RuntimeEnvironmentNameSchema",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[^=\\x00]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RuntimeEnvironmentNameSchema"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/provider",
-        "key_path": "auth.api_keys[].fingerprint.provider",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "env",
-            "file"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/1/properties/path",
-        "key_path": "auth.api_keys[].fingerprint.path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CsvFormatConfig/properties/delimiter",
-        "key_path": "datasets[].tables[].source.format.csv.delimiter",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint8"
-        },
-        {
-          "keyword": "maximum",
-          "value": 255
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CsvFormatConfig/properties/header_row",
-        "key_path": "datasets[].tables[].source.format.csv.header_row",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CsvFormatConfig/properties/quote",
-        "key_path": "datasets[].tables[].source.format.csv.quote",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint8"
-        },
-        {
-          "keyword": "maximum",
-          "value": 255
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/access_rights",
-        "key_path": "datasets[].access_rights",
-        "path_kind": "property"
-      },
-      "purpose": "Access rights classification, mirrors DCAT-AP `dcterms:accessRights`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AccessRights",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "public",
-            "restricted",
-            "non_public"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AccessRights"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/aggregates",
-        "key_path": "datasets[].aggregates",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/aggregates/items",
-        "key_path": "datasets[].aggregates[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "description",
-            "disclosure_control"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/applicable_legislation",
-        "key_path": "datasets[].applicable_legislation",
-        "path_kind": "property"
-      },
-      "purpose": "DCAT-AP `dcatap:applicableLegislation` IRIs. This is evidence\npublished for standard consumers, not an application-specific\nauthorization or source-of-truth verdict.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/applicable_legislation/items",
-        "key_path": "datasets[].applicable_legislation[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/conforms_to",
-        "key_path": "datasets[].conforms_to",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/conforms_to/items",
-        "key_path": "datasets[].conforms_to[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/defaults",
-        "key_path": "datasets[].defaults",
-        "path_kind": "property"
-      },
-      "purpose": "Optional table defaults for reducing repetition within one dataset.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/DatasetDefaultsConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetDefaultsConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/description",
-        "key_path": "datasets[].description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/entities",
-        "key_path": "datasets[].entities",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/entities/items",
-        "key_path": "datasets[].entities[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/EntityConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "table",
-            "access",
-            "api"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/id",
-        "key_path": "datasets[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/DatasetId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetId"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/owner",
-        "key_path": "datasets[].owner",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/public_services",
-        "key_path": "datasets[].public_services",
-        "path_kind": "property"
-      },
-      "purpose": "CPSV public services that produce this dataset. Registry Relay emits\nthem as standard `cpsv:PublicService` nodes; consumers decide how to\ninterpret that evidence.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/public_services/items",
-        "key_path": "datasets[].public_services[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/PublicServiceConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "title"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/PublicServiceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/sensitivity",
-        "key_path": "datasets[].sensitivity",
-        "path_kind": "property"
-      },
-      "purpose": "Sensitivity classification. Operator-defined values cover common\npersonal and public dataset classifications in V1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/Sensitivity",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "public",
-            "internal",
-            "personal",
-            "confidential",
-            "secret"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/Sensitivity"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/spatial_coverage",
-        "key_path": "datasets[].spatial_coverage",
-        "path_kind": "property"
-      },
-      "purpose": "BRegDCAT-AP: `dct:spatial` IRI for this dataset. Overrides the\ncatalog-level `default_spatial_coverage` when set.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/status",
-        "key_path": "datasets[].status",
-        "path_kind": "property"
-      },
-      "purpose": "Publishes the dataset lifecycle status; when omitted, Relay emits its weakest lifecycle claim instead of inferring a stronger status.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "under_development",
-            "completed",
-            "deprecated",
-            "withdrawn"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/tables",
-        "key_path": "datasets[].tables",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/tables/items",
-        "key_path": "datasets[].tables[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One private storage table under a dataset.\n\nThe public API should not expose these ids. Entity config maps one\nresource into one domain resource, with optional field renaming and\nrelationship declarations.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ResourceConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "source",
-            "schema"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/title",
-        "key_path": "datasets[].title",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/update_frequency",
-        "key_path": "datasets[].update_frequency",
-        "path_kind": "property"
-      },
-      "purpose": "Update cadence; mirrors DCAT-AP `dcterms:accrualPeriodicity`. The\nV1 set is the codes used by the example plus the common alternates.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/UpdateFrequency",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "continuous",
-            "daily",
-            "weekly",
-            "termly",
-            "monthly",
-            "quarterly",
-            "annual",
-            "irregular",
-            "as_needed",
-            "unknown"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/UpdateFrequency"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetDefaultsConfig/properties/materialization",
-        "key_path": "datasets[].defaults.materialization",
-        "path_kind": "property"
-      },
-      "purpose": "How a configured private table is registered for query planning.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "snapshot"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetDefaultsConfig/properties/refresh",
-        "key_path": "datasets[].defaults.refresh",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "mode",
-              "interval"
-            ],
-            [
-              "mode"
-            ]
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig/properties/evidence",
-        "key_path": "deployment.evidence",
-        "path_kind": "property"
-      },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/DeploymentEvidenceConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig/properties/profile",
-        "key_path": "deployment.profile",
-        "path_kind": "property"
-      },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "local",
-            "hosted_lab",
-            "production",
-            "evidence_grade"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig/properties/waivers",
-        "key_path": "deployment.waivers",
-        "path_kind": "property"
-      },
-      "purpose": "Per-deployment waivers. Each names one finding id, a required operator\nreference, an optional summary, and a mandatory expiry date. Expired\nwaivers stop suppressing their finding and raise\n`deployment.waiver_expired`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig/properties/waivers/items",
-        "key_path": "deployment.waivers[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One declared waiver. `expires` is an ISO 8601 `YYYY-MM-DD` date; format is\nvalidated at load time. The reference and optional summary are validated by\nthe shared operations contract before either can reach posture or logs.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/DeploymentWaiverConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "finding",
-            "reference",
-            "expires"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/api_key_rotation",
-        "key_path": "deployment.evidence.api_key_rotation",
-        "path_kind": "property"
-      },
-      "purpose": "Operator asserts an API-key rotation process is in place.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path",
-        "key_path": "deployment.evidence.audit_ack_cursor_path",
-        "path_kind": "property"
-      },
-      "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. When set, the runtime reads it to\nobserve shipping freshness and surfaces it as posture shipping health;\nabsent, shipping health stays `unverified` and only the declared\nshipping target is reported.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs",
-        "key_path": "deployment.evidence.audit_ack_max_age_secs",
-        "path_kind": "property"
-      },
-      "purpose": "Optional freshness window in seconds for the ack cursor's `acked_at`\ntimestamp. Defaults to `DEFAULT_AUDIT_ACK_MAX_AGE` (900) when unset. A\nwindow without `audit_ack_cursor_path` is rejected at load, since a\nfreshness window is meaningless without a cursor to observe.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping",
-        "key_path": "deployment.evidence.audit_offhost_shipping",
-        "path_kind": "property"
-      },
-      "purpose": "Operator asserts audit records are shipped off-host (for example to a\nlog collector or SIEM) rather than relying solely on local retention.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/ingress_rate_limit",
-        "key_path": "deployment.evidence.ingress_rate_limit",
-        "path_kind": "property"
-      },
-      "purpose": "Operator asserts ingress rate limiting is enforced (for example by a\ngateway or reverse proxy in front of the relay).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/expires",
-        "key_path": "deployment.waivers[].expires",
-        "path_kind": "property"
-      },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/finding",
-        "key_path": "deployment.waivers[].finding",
-        "path_kind": "property"
-      },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/reference",
-        "key_path": "deployment.waivers[].reference",
-        "path_kind": "property"
-      },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/DeploymentWaiverReference",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverReference"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/summary",
-        "key_path": "deployment.waivers[].summary",
-        "path_kind": "property"
-      },
-      "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/DeploymentWaiverSummary",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverSummary"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method",
-        "key_path": "datasets[].aggregates[].disclosure_control.method",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.method",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.method",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
-        "key_path": "datasets[].aggregates[].disclosure_control.method[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.method[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.method[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
-        "key_path": "datasets[].aggregates[].disclosure_control.min_cell_size",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_cell_size",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_cell_size",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
-        "key_path": "datasets[].aggregates[].disclosure_control.min_group_size",
-        "path_kind": "property"
-      },
-      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_group_size",
-        "path_kind": "property"
-      },
-      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_group_size",
-        "path_kind": "property"
-      },
-      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
-        "key_path": "datasets[].aggregates[].disclosure_control.report_suppressed_rows",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.report_suppressed_rows",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.report_suppressed_rows",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
-        "key_path": "datasets[].aggregates[].disclosure_control.suppression",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/Suppression",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "mask",
-            "null",
-            "omit"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/Suppression"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.suppression",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/Suppression",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "mask",
-            "null",
-            "omit"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/Suppression"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.suppression",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/Suppression",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "mask",
-            "null",
-            "omit"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/Suppression"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/id",
-        "key_path": "metadata.ecosystem_binding.id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/version",
-        "key_path": "metadata.ecosystem_binding.version",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].entities[].access.aggregate_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig/properties/evidence_verification_scope",
-        "key_path": "datasets[].entities[].access.evidence_verification_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].entities[].access.metadata_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig/properties/read_scope",
-        "key_path": "datasets[].entities[].access.read_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions",
-        "key_path": "datasets[].entities[].api.allowed_expansions",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions/items",
-        "key_path": "datasets[].entities[].api.allowed_expansions[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/allowed_filters",
-        "key_path": "datasets[].entities[].api.allowed_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].entities[].api.allowed_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AllowedFilter",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "ops"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/default_limit",
-        "key_path": "datasets[].entities[].api.default_limit",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/governed_policy",
-        "key_path": "datasets[].entities[].api.governed_policy",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/max_limit",
-        "key_path": "datasets[].entities[].api.max_limit",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/require_purpose_header",
-        "key_path": "datasets[].entities[].api.require_purpose_header",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings",
-        "key_path": "datasets[].entities[].api.required_filter_bindings",
-        "path_kind": "property"
-      },
-      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the query.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings/items",
-        "key_path": "datasets[].entities[].api.required_filter_bindings[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/RequiredFilterBindingConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/required_filters",
-        "key_path": "datasets[].entities[].api.required_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Alternative fields that can satisfy the row-scope gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/required_filters/items",
-        "key_path": "datasets[].entities[].api.required_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/access",
-        "key_path": "datasets[].entities[].access",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/EntityAccessConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "metadata_scope",
-            "aggregate_scope",
-            "read_scope"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/aggregates",
-        "key_path": "datasets[].entities[].aggregates",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/aggregates/items",
-        "key_path": "datasets[].entities[].aggregates[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "description",
-            "disclosure_control"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/api",
-        "key_path": "datasets[].entities[].api",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/EntityApiConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "default_limit",
-            "max_limit"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles",
-        "key_path": "datasets[].entities[].attribute_release_profiles",
-        "path_kind": "property"
-      },
-      "purpose": "Governed identity attribute-release profiles attached to this entity.\nEach profile resolves exactly one subject and returns only the\nconfigured, minimised claims. Empty by default (feature opt-in).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles/items",
-        "key_path": "datasets[].entities[].attribute_release_profiles[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "A governed identity attribute-release profile. A profile is a\nprojection-limited, exactly-one-subject lookup that maps a configured set of\nsource fields (or CEL-computed expressions) into a minimised\nOIDC/UserInfo-style claim bundle. Every profile is purpose-bound and requires\na matching `data-purpose` at resolve time. Identified globally by the\n`(id, version)` pair; both are required path segments at resolve time.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AttributeReleaseProfile",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "version",
-            "purpose",
-            "release_scope",
-            "subject",
-            "claims"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/concept_uri",
-        "key_path": "datasets[].entities[].concept_uri",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/description",
-        "key_path": "datasets[].entities[].description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/fields",
-        "key_path": "datasets[].entities[].fields",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/fields/items",
-        "key_path": "datasets[].entities[].fields[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/EntityFieldConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/name",
-        "key_path": "datasets[].entities[].name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/relationships",
-        "key_path": "datasets[].entities[].relationships",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/relationships/items",
-        "key_path": "datasets[].entities[].relationships[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/EntityRelationshipConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "kind",
-            "target",
-            "foreign_key"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/spatial",
-        "key_path": "datasets[].entities[].spatial",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "geometry"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/table",
-        "key_path": "datasets[].entities[].table",
-        "path_kind": "property"
-      },
-      "purpose": "Resource identifier within a dataset.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ResourceId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceId"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/title",
-        "key_path": "datasets[].entities[].title",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/codelist",
-        "key_path": "datasets[].entities[].fields[].codelist",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/concept_uri",
-        "key_path": "datasets[].entities[].fields[].concept_uri",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/from",
-        "key_path": "datasets[].entities[].fields[].from",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/language",
-        "key_path": "datasets[].entities[].fields[].language",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/name",
-        "key_path": "datasets[].entities[].fields[].name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/sensitive",
-        "key_path": "datasets[].entities[].fields[].sensitive",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/unit",
-        "key_path": "datasets[].entities[].fields[].unit",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/concept_uri",
-        "key_path": "datasets[].entities[].relationships[].concept_uri",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/foreign_key",
-        "key_path": "datasets[].entities[].relationships[].foreign_key",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/kind",
-        "key_path": "datasets[].entities[].relationships[].kind",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/RelationshipKind",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "belongs_to",
-            "has_many",
-            "has_one"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RelationshipKind"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/name",
-        "key_path": "datasets[].entities[].relationships[].name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/target",
-        "key_path": "datasets[].entities[].relationships[].target",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/bbox_fields",
-        "key_path": "datasets[].entities[].spatial.bbox_fields",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/collection_id",
-        "key_path": "datasets[].entities[].spatial.collection_id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/datetime_field",
-        "key_path": "datasets[].entities[].spatial.datetime_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/description",
-        "key_path": "datasets[].entities[].spatial.description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/geometry",
-        "key_path": "datasets[].entities[].spatial.geometry",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/SpatialGeometryConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "kind",
-              "field",
-              "crs"
-            ],
-            [
-              "kind",
-              "longitude_field",
-              "latitude_field",
-              "crs"
-            ]
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/max_bbox_degrees",
-        "key_path": "datasets[].entities[].spatial.max_bbox_degrees",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "number"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "double"
-        },
-        {
-          "keyword": "type",
-          "value": "number"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/max_geometry_vertices",
-        "key_path": "datasets[].entities[].spatial.max_geometry_vertices",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/title",
-        "key_path": "datasets[].entities[].spatial.title",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/codelist",
-        "key_path": "datasets[].tables[].schema.fields[].codelist",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/concept_uri",
-        "key_path": "datasets[].tables[].schema.fields[].concept_uri",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/language",
-        "key_path": "datasets[].tables[].schema.fields[].language",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/name",
-        "key_path": "datasets[].tables[].schema.fields[].name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/nullable",
-        "key_path": "datasets[].tables[].schema.fields[].nullable",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/sensitive",
-        "key_path": "datasets[].tables[].schema.fields[].sensitive",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/type",
-        "key_path": "datasets[].tables[].schema.fields[].type",
-        "path_kind": "property"
-      },
-      "purpose": "Physical type of a column. The set is fixed in V1; semantic types\nare carried via `concept_uri`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/FieldType",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "number",
-            "integer",
-            "boolean",
-            "date",
-            "timestamp"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldType"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/unit",
-        "key_path": "datasets[].tables[].schema.fields[].unit",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance",
-        "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance/items",
-        "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/max_source_age_seconds",
-        "key_path": "datasets[].entities[].api.governed_policy.max_source_age_seconds",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/minimum_assurance",
-        "key_path": "datasets[].entities[].api.governed_policy.minimum_assurance",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions",
-        "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions/items",
-        "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes",
-        "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes/items",
-        "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields",
-        "key_path": "datasets[].entities[].api.governed_policy.redaction_fields",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields/items",
-        "key_path": "datasets[].entities[].api.governed_policy.redaction_fields[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/require_consent",
-        "key_path": "datasets[].entities[].api.governed_policy.require_consent",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/require_legal_basis",
-        "key_path": "datasets[].entities[].api.governed_policy.require_legal_basis",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/trusted_context",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/GovernedTrustedContextConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/asserted_assurance",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.asserted_assurance",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/consent_ref",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.consent_ref",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/jurisdiction",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.jurisdiction",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/legal_basis_ref",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.legal_basis_ref",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/source_observed_age_seconds",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.source_observed_age_seconds",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/InstanceConfig/properties/environment",
-        "key_path": "instance.environment",
-        "path_kind": "property"
-      },
-      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_instance_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/InstanceConfig/properties/id",
-        "key_path": "instance.id",
-        "path_kind": "property"
-      },
-      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_instance_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/InstanceConfig/properties/jurisdiction",
-        "key_path": "instance.jurisdiction",
-        "path_kind": "property"
-      },
-      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_instance_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/InstanceConfig/properties/owner",
-        "key_path": "instance.owner",
-        "path_kind": "property"
-      },
-      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_instance_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/MetadataConfig/properties/ecosystem_binding",
-        "key_path": "metadata.ecosystem_binding",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/MetadataConfig/properties/source",
-        "key_path": "metadata.source",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/MetadataSourceConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "path"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/MetadataSourceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/MetadataSourceConfig/properties/digest",
-        "key_path": "metadata.source.digest",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/MetadataSourceConfig/properties/path",
-        "key_path": "metadata.source.path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allow_dev_insecure_fetch_urls",
-        "key_path": "auth.oidc.allow_dev_insecure_fetch_urls",
-        "path_kind": "property"
-      },
-      "purpose": "Development-only escape hatch that permits loopback HTTP issuer,\ndiscovery, and JWKS URLs. Private non-loopback networks and cloud\nmetadata endpoints remain denied by the platform fetch policy.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_algorithms",
-        "key_path": "auth.oidc.allowed_algorithms",
-        "path_kind": "property"
-      },
-      "purpose": "Signature algorithms accepted by the verifier. Defaults to\nRS256, ES256, EdDSA. HS\\* and `none` are intentionally absent\nfrom [`OidcAlgorithm`].",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_algorithms/items",
-        "key_path": "auth.oidc.allowed_algorithms[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "JWS signature algorithms accepted by the OIDC verifier. Symmetric\nalgorithms (`HS*`) and `none` are intentionally absent: shared-secret\nJWTs are unsafe between a resource server and an IdP, and `none`\ndisables verification entirely.\n\nYAML values are the canonical JWA `alg` strings (`RS256`, `ES256`,\n`EdDSA`), case-sensitive.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/OidcAlgorithm",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "RS256",
-            "ES256",
-            "EdDSA"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcAlgorithm"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_clients",
-        "key_path": "auth.oidc.allowed_clients",
-        "path_kind": "property"
-      },
-      "purpose": "Optional allowlist of client identifiers, matched against the\ntoken's `azp` (preferred) or `client_id` claim. Empty list\nmeans any client is accepted.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_clients/items",
-        "key_path": "auth.oidc.allowed_clients[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_token_types",
-        "key_path": "auth.oidc.allowed_token_types",
-        "path_kind": "property"
-      },
-      "purpose": "Accepted `typ` JOSE header values. Defaults to `JWT` and\n`at+jwt` (RFC 9068). ID tokens (`id+jwt`) are not access tokens\nand are rejected by default. Tokens without `typ` are rejected by\nthe shared verifier.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_token_types/items",
-        "key_path": "auth.oidc.allowed_token_types[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/audiences",
-        "key_path": "auth.oidc.audiences",
-        "path_kind": "property"
-      },
-      "purpose": "One or more accepted `aud` values. Tokens with no `aud`, or\nwhose `aud` does not intersect this list, are rejected.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/audiences/items",
-        "key_path": "auth.oidc.audiences[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/development_jwks_file",
-        "key_path": "auth.oidc.development_jwks_file",
-        "path_kind": "property"
-      },
-      "purpose": "Development-only public JWKS file loaded once into memory at startup.\nThis source is accepted only when `deployment.profile` is `local` and\nis mutually exclusive with `jwks_url` and `discovery_url`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/discovery_url",
-        "key_path": "auth.oidc.discovery_url",
-        "path_kind": "property"
-      },
-      "purpose": "OIDC discovery document URL\n(`.well-known/openid-configuration`). The JWKS URL is resolved\nfrom `jwks_uri` in the discovered document.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/issuer",
-        "key_path": "auth.oidc.issuer",
-        "path_kind": "property"
-      },
-      "purpose": "Issuer URL. Compared verbatim against the JWT `iss` claim.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/jwks_cache_ttl",
-        "key_path": "auth.oidc.jwks_cache_ttl",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/jwks_url",
-        "key_path": "auth.oidc.jwks_url",
-        "path_kind": "property"
-      },
-      "purpose": "JWKS endpoint. Exactly one JWKS source must be configured.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/leeway",
-        "key_path": "auth.oidc.leeway",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_claim",
-        "key_path": "auth.oidc.scope_claim",
-        "path_kind": "property"
-      },
-      "purpose": "JWT claim whose value carries scopes. Defaults to `scope`, the\nRFC 8693 / RFC 9068 space-separated form. Some IdPs use `scp`\nor `permissions`; the value may be a string, an array of strings,\nor an object keyed by scope name.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_map",
-        "key_path": "auth.oidc.scope_map",
-        "path_kind": "property"
-      },
-      "purpose": "Optional rename map: `external_scope -> internal_scope`. Applied\nafter parsing the scope claim, before scope-based access checks\nrun. Useful for adapting IdP role names (`role:foo`) to the\nrelay's `<dataset_id>:<level>` shape.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_map/additionalProperties",
-        "key_path": "auth.oidc.scope_map.*",
-        "path_kind": "map_value"
-      },
-      "purpose": "Each reviewed key is an external token scope and each value is the bounded Relay scope mapping granted for that exact token scope.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_oidc_scope_map_open_map",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys",
-        "key_path": "auth.oidc.scope_object_required_keys",
-        "path_kind": "property"
-      },
-      "purpose": "Keys that must be present inside object-valued role claim values\nbefore the role key is treated as an active scope. Object-valued\nclaims grant no scopes when this list is empty.\nThis is useful for IdPs such as Zitadel where role values are\nkeyed by organization id.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys/items",
-        "key_path": "auth.oidc.scope_object_required_keys[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/PostgresTableConfig/properties/name",
-        "key_path": "datasets[].tables[].source.table.name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/PostgresTableConfig/properties/schema",
-        "key_path": "datasets[].tables[].source.table.schema",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/PublicServiceConfig/properties/description",
-        "key_path": "datasets[].public_services[].description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/PublicServiceConfig/properties/id",
-        "key_path": "datasets[].public_services[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/PublicServiceConfig/properties/title",
-        "key_path": "datasets[].public_services[].title",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval",
-        "key_path": "datasets[].defaults.refresh.interval",
-        "path_kind": "property"
-      },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval",
-        "key_path": "datasets[].tables[].refresh.interval",
-        "path_kind": "property"
-      },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].defaults.refresh.mode",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "interval",
-            "manual",
-            "mtime"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].tables[].refresh.mode",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "interval",
-            "manual",
-            "mtime"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/expression",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "cel"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/format",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].format",
-        "path_kind": "property"
-      },
-      "purpose": "Optional value format hint.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/locale",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].locale",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/name",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].name",
-        "path_kind": "property"
-      },
-      "purpose": "Released claim name (lower-snake).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/required",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].required",
-        "path_kind": "property"
-      },
-      "purpose": "Whether the claim must be present; a missing required claim denies.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/sensitivity",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].sensitivity",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "direct_identifier",
-            "personal",
-            "public",
-            "pseudonymous"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/source_field",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].source_field",
-        "path_kind": "property"
-      },
-      "purpose": "Source field projected into the claim. XOR with `expression`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseConditionsConfig/properties/expression",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression",
-        "path_kind": "property"
-      },
-      "purpose": "A single CEL expression evaluated over the subject's source projection.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ReleaseExpressionConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "cel"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseExpressionConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseExpressionConfig/properties/cel",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression.cel",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseExpressionConfig/properties/cel",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression.cel",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseResponseConfig/properties/include_source_metadata",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].response.include_source_metadata",
-        "path_kind": "property"
-      },
-      "purpose": "Whether to include profile-sourced metadata in the response body.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseSubjectConfig/properties/id_type",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].subject.id_type",
-        "path_kind": "property"
-      },
-      "purpose": "Accepted identifier type label.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseSubjectConfig/properties/source_field",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].subject.source_field",
-        "path_kind": "property"
-      },
-      "purpose": "Source field used to match the subject. Must be an exposed entity field.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
-        "key_path": "datasets[].aggregates[].required_filter_bindings[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
-        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
-        "key_path": "datasets[].entities[].api.required_filter_bindings[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
-        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
-        "key_path": "datasets[].aggregates[].required_filter_bindings[].source",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/RequiredFilterBindingSource",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "principal_id"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingSource"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
-        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].source",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/RequiredFilterBindingSource",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "principal_id"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingSource"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
-        "key_path": "datasets[].entities[].api.required_filter_bindings[].source",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/RequiredFilterBindingSource",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "principal_id"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingSource"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
-        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].source",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/RequiredFilterBindingSource",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "principal_id"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingSource"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].tables[].access.aggregate_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].tables[].access.metadata_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters",
-        "key_path": "datasets[].tables[].api.allowed_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].tables[].api.allowed_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AllowedFilter",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "ops"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/default_limit",
-        "key_path": "datasets[].tables[].api.default_limit",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/max_limit",
-        "key_path": "datasets[].tables[].api.max_limit",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/require_purpose_header",
-        "key_path": "datasets[].tables[].api.require_purpose_header",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/access",
-        "key_path": "datasets[].tables[].access",
-        "path_kind": "property"
-      },
-      "purpose": "Resource-level scope assignments. Private tables are not exposed as row\nresources in beta; row access is configured on public entities.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ResourceAccessConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "metadata_scope",
-            "aggregate_scope"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceAccessConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/aggregates",
-        "key_path": "datasets[].tables[].aggregates",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/aggregates/items",
-        "key_path": "datasets[].tables[].aggregates[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "description",
-            "disclosure_control"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/api",
-        "key_path": "datasets[].tables[].api",
-        "path_kind": "property"
-      },
-      "purpose": "Resource-level API knobs: per-field filter allowlist, limit caps,\nand the `Data-Purpose` requirement.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ResourceApiConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "default_limit",
-            "max_limit"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/id",
-        "key_path": "datasets[].tables[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Resource identifier within a dataset.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ResourceId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceId"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/materialization",
-        "key_path": "datasets[].tables[].materialization",
-        "path_kind": "property"
-      },
-      "purpose": "How a configured private table is registered for query planning.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "snapshot"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/primary_key",
-        "key_path": "datasets[].tables[].primary_key",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/refresh",
-        "key_path": "datasets[].tables[].refresh",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "mode",
-              "interval"
-            ],
-            [
-              "mode"
-            ]
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/schema",
-        "key_path": "datasets[].tables[].schema",
-        "path_kind": "property"
-      },
-      "purpose": "Declared resource schema. `strict` is the spec's `strict_schema`\nflag; on mismatch ingestion refuses to register the resource.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/SchemaConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "fields"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/SchemaConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/source",
-        "key_path": "datasets[].tables[].source",
-        "path_kind": "property"
-      },
-      "purpose": "Source plugin selection. Tagged on `type:` so HTTP, S3, or additional\ndatabase variants can land additively later.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/SourceConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "type",
-              "connection_env"
-            ],
-            [
-              "type",
-              "path"
-            ]
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceFormatConfig/properties/csv",
-        "key_path": "datasets[].tables[].source.format.csv",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceFormatConfig/properties/parquet",
-        "key_path": "datasets[].tables[].source.format.parquet",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceFormatConfig/properties/xlsx",
-        "key_path": "datasets[].tables[].source.format.xlsx",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RotateConfig/properties/max_files",
-        "key_path": "audit.rotate.max_files",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RotateConfig/properties/max_size_mb",
-        "key_path": "audit.rotate.max_size_mb",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SchemaConfig/properties/fields",
-        "key_path": "datasets[].tables[].schema.fields",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SchemaConfig/properties/fields/items",
-        "key_path": "datasets[].tables[].schema.fields[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One column in a resource schema. Physical type and optional\nsemantic annotations used by catalog and schema metadata.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/FieldConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SchemaConfig/properties/strict",
-        "key_path": "datasets[].tables[].schema.strict",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/admin_bind",
-        "key_path": "server.admin_bind",
-        "path_kind": "property"
-      },
-      "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": [
-            "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$",
-            "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/bind",
-        "key_path": "server.bind",
-        "path_kind": "property"
-      },
-      "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/SocketAddr",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": [
-            "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$",
-            "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/SocketAddr"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/cache_dir",
-        "key_path": "server.cache_dir",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/cors",
-        "key_path": "server.cors",
-        "path_kind": "property"
-      },
-      "purpose": "CORS allowlist; default-deny per Section 17 item 7.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/CorsConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/CorsConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/http1_header_read_timeout",
-        "key_path": "server.http1_header_read_timeout",
-        "path_kind": "property"
-      },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/max_connections",
-        "key_path": "server.max_connections",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/max_source_file_bytes",
-        "key_path": "server.max_source_file_bytes",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/openapi_requires_auth",
-        "key_path": "server.openapi_requires_auth",
-        "path_kind": "property"
-      },
-      "purpose": "Keeps the configured OpenAPI document behind Relay authentication unless an operator explicitly accepts unauthenticated contract discovery.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/request_body_timeout",
-        "key_path": "server.request_body_timeout",
-        "path_kind": "property"
-      },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/request_timeout",
-        "key_path": "server.request_timeout",
-        "path_kind": "property"
-      },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/trust_proxy",
-        "key_path": "server.trust_proxy",
-        "path_kind": "property"
-      },
-      "purpose": "`X-Forwarded-For` policy. Until the `ipnet` crate lands in deps we\nkeep CIDR specs as strings and validate format in\n[`validate::run`].",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/TrustProxyConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/TrustProxyConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/xlsx_max_file_bytes",
-        "key_path": "server.xlsx_max_file_bytes",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/0/properties/format",
-        "key_path": "datasets[].tables[].source.format",
-        "path_kind": "property"
-      },
-      "purpose": "Storage table format override. If omitted, ingest infers the format\nfrom the source file extension.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/0/properties/path",
-        "key_path": "datasets[].tables[].source.path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/0/properties/type",
-        "key_path": "datasets[].tables[].source.type",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "file",
-            "postgres"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/change_token_sql",
-        "key_path": "datasets[].tables[].source.change_token_sql",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/connect_timeout",
-        "key_path": "datasets[].tables[].source.connect_timeout",
-        "path_kind": "property"
-      },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/connection_env",
-        "key_path": "datasets[].tables[].source.connection_env",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/PostgresEnvironmentNameSchema",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/PostgresEnvironmentNameSchema"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/query",
-        "key_path": "datasets[].tables[].source.query",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/query_timeout",
-        "key_path": "datasets[].tables[].source.query_timeout",
-        "path_kind": "property"
-      },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/table",
-        "key_path": "datasets[].tables[].source.table",
-        "path_kind": "property"
-      },
-      "purpose": "Structured database table reference. Keeping schema/name separate\navoids parsing dotted identifiers and leaves quoting to connectors.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
+        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
+        "privacy",
         "relay",
+        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "schema",
-            "name"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_x",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "/properties/materialization/properties/refresh/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
+        "registryctl",
         "relay",
+        "editor",
         "docs"
       ],
       "availability": "published",
@@ -108226,74 +50015,81 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "operator_preflight"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
+        "registryctl_authoring",
         "registry_relay",
+        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
+        "privacy",
         "relay",
+        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "manual"
         }
       ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_x",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "/properties/materialization/properties/refresh/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
+        "registryctl",
         "relay",
+        "editor",
         "docs"
       ],
       "availability": "published",
@@ -108301,38 +50097,49 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "operator_preflight"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
+        "registryctl_authoring",
         "registry_relay",
+        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
+        "privacy",
         "relay",
+        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,8}|1[0-9]{9}|2[0-4][0-9]{8}|25[0-8][0-9]{7}|259[0-1][0-9]{6}|2592000000)ms|(?:[1-9][0-9]{0,5}|1[0-9]{6}|2[0-4][0-9]{5}|25[0-8][0-9]{4}|259[0-1][0-9]{3}|2592000)s|(?:[1-9][0-9]{0,3}|[1-3][0-9]{4}|4[0-2][0-9]{3}|43[0-1][0-9]{2}|43200)m|(?:[1-9][0-9]{0,1}|[1-6][0-9]{2}|7[0-1][0-9]{1}|720)h|(?:[1-9][0-9]{0,0}|[1-2][0-9]{1}|30)d)$"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -108341,34 +50148,34 @@
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
-        "key_path": "datasets[].entities[].spatial.bbox_fields.max_x",
+        "schema": "entity",
+        "pointer": "/properties/materialization/properties/retain_generations",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Number of completed cache generations, including the active generation, retained as a bounded recovery set after successful publication. This does not make arbitrary retained generations selectable for rollback.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
+      "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "runtime",
+      "state": "authored",
       "products": [
+        "registryctl",
         "relay",
+        "editor",
         "docs"
       ],
       "availability": "published",
@@ -108376,74 +50183,89 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "operator_preflight"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
+        "registryctl_authoring",
         "registry_relay",
+        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
+        "privacy",
         "relay",
+        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 16
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_x",
+        "schema": "entity",
+        "pointer": "/properties/primary_key",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Field whose value uniquely identifies each materialized record.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
+      "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "runtime",
+      "state": "authored",
       "products": [
+        "registryctl",
         "relay",
+        "editor",
         "docs"
       ],
       "availability": "published",
@@ -108451,74 +50273,88 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "operator_preflight"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
+        "registryctl_authoring",
         "registry_relay",
+        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
+        "privacy",
         "relay",
+        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_y",
+        "schema": "entity",
+        "pointer": "/properties/revision",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Monotonically increasing revision of this entity definition.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
+      "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "runtime",
+      "state": "authored",
       "products": [
+        "registryctl",
         "relay",
+        "editor",
         "docs"
       ],
       "availability": "published",
@@ -108526,74 +50362,89 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "operator_preflight"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
+        "registryctl_authoring",
         "registry_relay",
+        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
+        "privacy",
         "relay",
+        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_y",
+        "schema": "entity",
+        "pointer": "/properties/schema",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Closed JSON object schema for materialized records.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/objectSchema",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
+      "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "runtime",
+      "state": "authored",
       "products": [
+        "registryctl",
         "relay",
+        "editor",
         "docs"
       ],
       "availability": "published",
@@ -108601,74 +50452,91 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "operator_preflight"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
+        "registryctl_authoring",
         "registry_relay",
+        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
+        "privacy",
         "relay",
+        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "type",
+            "additionalProperties",
+            "required",
+            "properties"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema"
+      }
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
-        "key_path": "datasets[].entities[].spatial.bbox_fields.max_y",
+        "schema": "entity",
+        "pointer": "/properties/version",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Entity authoring format version.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "public",
+      "state": "authored",
       "products": [
+        "registryctl",
         "relay",
+        "editor",
         "docs"
       ],
       "availability": "published",
@@ -108676,71 +50544,77 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "operator_preflight"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
+        "registryctl_authoring",
         "registry_relay",
+        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
+        "privacy",
         "relay",
+        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": 1
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_y",
-        "path_kind": "property"
+        "pointer": "",
+        "key_path": "",
+        "path_kind": "root"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Root configuration document. Parsed from YAML at startup.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_root_structural",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "not_applicable",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "relay",
@@ -108779,21 +50653,30 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "server",
+            "catalog",
+            "auth",
+            "audit",
+            "datasets"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_x",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
+        "key_path": "datasets[].aggregates[].access.aggregate_only_execution",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -108804,15 +50687,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -108860,15 +50744,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_x",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
+        "key_path": "datasets[].entities[].aggregates[].access.aggregate_only_execution",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -108879,15 +50763,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -108935,15 +50820,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
-        "key_path": "datasets[].entities[].spatial.bbox_fields.min_x",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
+        "key_path": "datasets[].tables[].aggregates[].access.aggregate_only_execution",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -108954,15 +50839,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109010,15 +50896,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_x",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].aggregates[].access.aggregate_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109029,15 +50915,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109085,15 +50973,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_y",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].entities[].aggregates[].access.aggregate_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109104,15 +50995,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109160,15 +51053,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_y",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].tables[].aggregates[].access.aggregate_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109179,15 +51075,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109235,15 +51133,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
-        "key_path": "datasets[].entities[].spatial.bbox_fields.min_y",
+        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].aggregates[].access.metadata_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109254,15 +51155,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109310,15 +51213,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_y",
+        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].entities[].aggregates[].access.metadata_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109329,15 +51235,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109385,15 +51293,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/crs",
-        "key_path": "datasets[].entities[].spatial.geometry.crs",
+        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].tables[].aggregates[].access.metadata_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109404,15 +51315,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109460,15 +51373,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/kind",
-        "key_path": "datasets[].entities[].spatial.geometry.kind",
+        "pointer": "/$defs/AggregateConfig/properties/access",
+        "key_path": "datasets[].aggregates[].access",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109479,15 +51395,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109534,25 +51452,99 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
+          "keyword": "type",
           "value": [
-            "geojson",
-            "point",
-            "wkb",
-            "wkt"
+            "null",
+            "object"
           ]
-        },
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/access",
+        "key_path": "datasets[].entities[].aggregates[].access",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "null",
+          "object"
+        ],
+        "composed": true
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/latitude_field",
-        "key_path": "datasets[].entities[].spatial.geometry.latitude_field",
+        "pointer": "/$defs/AggregateConfig/properties/access",
+        "key_path": "datasets[].tables[].aggregates[].access",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109563,15 +51555,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109619,15 +51613,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/longitude_field",
-        "key_path": "datasets[].entities[].spatial.geometry.longitude_field",
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
+        "key_path": "datasets[].aggregates[].allowed_filters",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109638,15 +51635,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109694,15 +51692,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/1/properties/field",
-        "key_path": "datasets[].entities[].spatial.geometry.field",
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109713,15 +51711,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109769,35 +51768,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/dataset",
-        "key_path": "standards.spdci.disability_registry.dataset",
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters",
         "path_kind": "property"
       },
-      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/DatasetId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109843,45 +51842,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values",
-        "key_path": "standards.spdci.disability_registry.disabled_positive_values",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].aggregates[].allowed_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Case-insensitive values interpreted as disabled.",
+      "purpose": "A single allowed filter: field name + permitted operators.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109927,34 +51918,46 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field",
+            "ops"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values/items",
-        "key_path": "standards.spdci.disability_registry.disabled_positive_values[]",
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
@@ -110002,37 +52005,48 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field",
+            "ops"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_status_field",
-        "key_path": "standards.spdci.disability_registry.disabled_status_field",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Entity field whose value determines the SP DCI disabled response.",
+      "purpose": "A single allowed filter: field name + permitted operators.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110078,36 +52092,48 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field",
+            "ops"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/entity",
-        "key_path": "standards.spdci.disability_registry.entity",
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
+        "key_path": "datasets[].aggregates[].default_group_by",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110155,32 +52181,32 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_field",
-        "key_path": "standards.spdci.disability_registry.query_field",
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
+        "key_path": "datasets[].entities[].aggregates[].default_group_by",
         "path_kind": "property"
       },
-      "purpose": "Entity field filtered when the SP DCI query key is present.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -110231,38 +52257,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_key",
-        "key_path": "standards.spdci.disability_registry.query_key",
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
+        "key_path": "datasets[].tables[].aggregates[].default_group_by",
         "path_kind": "property"
       },
-      "purpose": "Query key accepted from SP DCI `disabled_criteria.query`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_sensitive",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -110297,32 +52323,30 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/dataset",
-        "key_path": "standards.spdci.registries.*.dataset",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
+        "key_path": "datasets[].aggregates[].default_group_by[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -110330,14 +52354,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/DatasetId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110383,45 +52406,36 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/default_limit",
-        "key_path": "standards.spdci.registries.*.default_limit",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
+        "key_path": "datasets[].entities[].aggregates[].default_group_by[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110467,34 +52481,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/entity",
-        "key_path": "standards.spdci.registries.*.entity",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
+        "key_path": "datasets[].tables[].aggregates[].default_group_by[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -110504,11 +52506,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110563,28 +52565,27 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields",
-        "key_path": "standards.spdci.registries.*.expression_fields",
+        "pointer": "/$defs/AggregateConfig/properties/description",
+        "key_path": "datasets[].aggregates[].description",
         "path_kind": "property"
       },
-      "purpose": "DCI expression or predicate attribute to entity field mappings.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110632,20 +52633,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields/additionalProperties",
-        "key_path": "standards.spdci.registries.*.expression_fields.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/AggregateConfig/properties/description",
+        "key_path": "datasets[].entities[].aggregates[].description",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names an expression-visible field and each value defines the bounded source expression exposed under that name.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_spdci_registries_expression_fields_open_map",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -110655,14 +52656,14 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -110702,7 +52703,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -110714,28 +52715,27 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers",
-        "key_path": "standards.spdci.registries.*.identifiers",
+        "pointer": "/$defs/AggregateConfig/properties/description",
+        "key_path": "datasets[].tables[].aggregates[].description",
         "path_kind": "property"
       },
-      "purpose": "DCI identifier type to entity field mappings for `idtype-value`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110783,37 +52783,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers/additionalProperties",
-        "key_path": "standards.spdci.registries.*.identifiers.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/AggregateConfig/properties/dimensions",
+        "key_path": "datasets[].aggregates[].dimensions",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names an identifier role and each value defines the exact request identifier binding for that role.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_spdci_registries_identifiers_open_map",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -110853,40 +52854,40 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/record_type",
-        "key_path": "standards.spdci.registries.*.record_type",
+        "pointer": "/$defs/AggregateConfig/properties/dimensions",
+        "key_path": "datasets[].entities[].aggregates[].dimensions",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110934,35 +52935,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/registry_type",
-        "key_path": "standards.spdci.registries.*.registry_type",
+        "pointer": "/$defs/AggregateConfig/properties/dimensions",
+        "key_path": "datasets[].tables[].aggregates[].dimensions",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111010,20 +53011,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields",
-        "key_path": "standards.spdci.registries.*.response_fields",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
+        "key_path": "datasets[].aggregates[].dimensions[]",
+        "path_kind": "array_item"
       },
-      "purpose": "SP DCI output path to entity field mappings for direct response\nprojection. A CEL mapping takes precedence when both are set.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -111031,14 +53032,14 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/AggregateDimensionConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111084,39 +53085,140 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "field"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields/additionalProperties",
-        "key_path": "standards.spdci.registries.*.response_fields.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Each reviewed key names a response field and each value defines the exact bounded response projection for that field.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_spdci_registries_response_fields_open_map",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateDimensionConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "field"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig"
+      }
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/AggregateDimensionConfig",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -111156,44 +53258,55 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/response_mapping_path",
-        "key_path": "standards.spdci.registries.*.response_mapping_path",
+        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
+        "key_path": "datasets[].aggregates[].disclosure_control",
         "path_kind": "property"
       },
-      "purpose": "Optional local CEL mapping document used to shape response records.",
+      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/DisclosureControlConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -111228,54 +53341,52 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/response_schema_path",
-        "key_path": "standards.spdci.registries.*.response_schema_path",
+        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control",
         "path_kind": "property"
       },
-      "purpose": "Optional local JSON Schema used to validate shaped response records.",
+      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/DisclosureControlConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -111310,51 +53421,49 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciStandardsConfig/properties/disability_registry",
-        "key_path": "standards.spdci.disability_registry",
+        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control",
         "path_kind": "property"
       },
-      "purpose": "Runtime binding from SP DCI Disability Registry sync APIs to one\nconfigured Registry Relay entity.",
+      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/DisclosureControlConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111400,38 +53509,32 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "dataset",
-            "entity"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciStandardsConfig/properties/registries",
-        "key_path": "standards.spdci.registries",
+        "pointer": "/$defs/AggregateConfig/properties/group_by",
+        "key_path": "datasets[].aggregates[].group_by",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
@@ -111439,8 +53542,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111488,38 +53591,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciStandardsConfig/properties/registries/additionalProperties",
-        "key_path": "standards.spdci.registries.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/AggregateConfig/properties/group_by",
+        "key_path": "datasets[].entities[].aggregates[].group_by",
+        "path_kind": "property"
       },
-      "purpose": "Runtime binding from a DCI registry sync search API to one configured\nRegistry Relay entity.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_spdci_registries_open_map",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/SpdciRegistryConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -111559,52 +53662,40 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "dataset",
-            "entity"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/StandardsConfig/properties/spdci",
-        "key_path": "standards.spdci",
+        "pointer": "/$defs/AggregateConfig/properties/group_by",
+        "key_path": "datasets[].tables[].aggregates[].group_by",
         "path_kind": "property"
       },
-      "purpose": "Social Protection Digital Convergence Initiative (SP DCI) adapter\nconfiguration.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111652,38 +53743,34 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/TrustProxyConfig/properties/enabled",
-        "key_path": "server.trust_proxy.enabled",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
+        "key_path": "datasets[].aggregates[].group_by[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111725,43 +53812,43 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies",
-        "key_path": "server.trust_proxy.trusted_proxies",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
+        "key_path": "datasets[].entities[].aggregates[].group_by[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -111796,33 +53883,30 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies/items",
-        "key_path": "server.trust_proxy.trusted_proxies[]",
+        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
+        "key_path": "datasets[].tables[].aggregates[].group_by[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -111838,8 +53922,8 @@
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -111874,14 +53958,11 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -111894,29 +53975,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/XlsxFormatConfig/properties/data_range",
-        "key_path": "datasets[].tables[].source.format.xlsx.data_range",
+        "pointer": "/$defs/AggregateConfig/properties/id",
+        "key_path": "datasets[].aggregates[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate identifier within a resource.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AggregateId",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111962,41 +54042,45 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/XlsxFormatConfig/properties/header_row",
-        "key_path": "datasets[].tables[].source.format.xlsx.header_row",
+        "pointer": "/$defs/AggregateConfig/properties/id",
+        "key_path": "datasets[].entities[].aggregates[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate identifier within a resource.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
+        "local_reference": "#/$defs/AggregateId",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112043,52 +54127,44 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
         },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/XlsxFormatConfig/properties/sheet",
-        "key_path": "datasets[].tables[].source.format.xlsx.sheet",
+        "pointer": "/$defs/AggregateConfig/properties/id",
+        "key_path": "datasets[].tables[].aggregates[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate identifier within a resource.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AggregateId",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112134,40 +54210,45 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/audit",
-        "key_path": "audit",
+        "pointer": "/$defs/AggregateConfig/properties/indicators",
+        "key_path": "datasets[].aggregates[].indicators",
         "path_kind": "property"
       },
-      "purpose": "Audit configuration. Sink choice gates further fields via the\ntagged `AuditSinkConfig` enum. The enum is flattened onto the\ncontaining struct so that the YAML `sink:` key acts as the\ndiscriminator, matching the public example configuration.\n\n`deny_unknown_fields` is deliberately omitted here: `serde` does\nnot support combining it with `#[serde(flatten)]` on an internally\ntagged enum (unknown keys in `audit` are caught by the enum's own\n`deny_unknown_fields`).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AuditConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112209,60 +54290,41 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "sink",
-              "path"
-            ],
-            [
-              "sink"
-            ]
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
-        },
-        {
-          "keyword": "unevaluatedProperties",
-          "value": false
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/auth",
-        "key_path": "auth",
+        "pointer": "/$defs/AggregateConfig/properties/indicators",
+        "key_path": "datasets[].entities[].aggregates[].indicators",
         "path_kind": "property"
       },
-      "purpose": "Authentication configuration. Exactly one of `api_keys` and `oidc`\nis consumed at startup, gated by `mode`; cross-field validation in\n[`validate`] enforces that only the active block is populated.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AuthConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112308,47 +54370,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "mode"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/catalog",
-        "key_path": "catalog",
+        "pointer": "/$defs/AggregateConfig/properties/indicators",
+        "key_path": "datasets[].tables[].aggregates[].indicators",
         "path_kind": "property"
       },
-      "purpose": "Catalog-level metadata surfaced by `/metadata/*` and DCAT outputs.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_catalog_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/CatalogConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112390,53 +54442,41 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "title",
-            "base_url",
-            "publisher"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/CatalogConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/config_trust",
-        "key_path": "config_trust",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
+        "key_path": "datasets[].aggregates[].indicators[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Optional signed configuration bundle trust state.\n\nSimple local deployments omit this block. Bundle-aware deployments pin the\nlocal trust anchor, bundle, and anti-rollback state paths explicitly.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_config_trust_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/AggregateIndicatorConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112478,52 +54518,55 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "trust_anchor_path",
-            "bundle_path",
-            "antirollback_state_path"
+            "id",
+            "label",
+            "function",
+            "column",
+            "unit_measure"
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/consultation",
-        "key_path": "consultation",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
+        "key_path": "datasets[].entities[].aggregates[].indicators[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/AggregateIndicatorConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112572,26 +54615,29 @@
         {
           "keyword": "required",
           "value": [
-            "authorized_workload",
-            "state_plane",
-            "audit_pseudonym_materials"
+            "id",
+            "label",
+            "function",
+            "column",
+            "unit_measure"
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/datasets",
-        "key_path": "datasets",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
+        "key_path": "datasets[].tables[].aggregates[].indicators[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -112601,15 +54647,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateIndicatorConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112655,20 +54702,34 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "function",
+            "column",
+            "unit_measure"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/datasets/items",
-        "key_path": "datasets[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/joins",
+        "key_path": "datasets[].aggregates[].joins",
+        "path_kind": "property"
       },
-      "purpose": "A single dataset declaration.",
+      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -112676,16 +54737,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/DatasetConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112731,46 +54792,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "title",
-            "description",
-            "owner",
-            "sensitivity",
-            "access_rights",
-            "update_frequency"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/deployment",
-        "key_path": "deployment",
+        "pointer": "/$defs/AggregateConfig/properties/joins",
+        "key_path": "datasets[].entities[].aggregates[].joins",
         "path_kind": "property"
       },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
+      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/DeploymentConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -112778,7 +54822,7 @@
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112826,32 +54870,27 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/instance",
-        "key_path": "instance",
+        "pointer": "/$defs/AggregateConfig/properties/joins",
+        "key_path": "datasets[].tables[].aggregates[].joins",
         "path_kind": "property"
       },
-      "purpose": "Stable deployment identity surfaced in redacted operations posture.",
+      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_instance_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/InstanceConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -112859,7 +54898,7 @@
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112901,45 +54940,41 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/InstanceConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/metadata",
-        "key_path": "metadata",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/joins/items",
+        "key_path": "datasets[].aggregates[].joins[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Optional split metadata manifest loaded alongside the runtime config.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_metadata_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/AggregateJoinConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112981,34 +55016,36 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "source"
+            "relationship"
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateJoinConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/server",
-        "key_path": "server",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/joins/items",
+        "key_path": "datasets[].entities[].aggregates[].joins[]",
+        "path_kind": "array_item"
       },
-      "purpose": "HTTP listener and adjacent server-wide knobs.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -113016,14 +55053,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ServerConfig",
+        "local_reference": "#/$defs/AggregateJoinConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -113065,13 +55102,14 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "bind"
+            "relationship"
           ]
         },
         {
@@ -113081,19 +55119,19 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig"
+        "pointer": "/$defs/AggregateJoinConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/standards",
-        "key_path": "standards",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/joins/items",
+        "key_path": "datasets[].tables[].aggregates[].joins[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -113101,15 +55139,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/StandardsConfig",
+        "local_reference": "#/$defs/AggregateJoinConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -113155,6 +55192,12 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "relationship"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
@@ -113162,25 +55205,25 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/StandardsConfig"
+        "pointer": "/$defs/AggregateJoinConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/vocabularies",
-        "key_path": "vocabularies",
+        "pointer": "/$defs/AggregateConfig/properties/measures",
+        "key_path": "datasets[].aggregates[].measures",
         "path_kind": "property"
       },
-      "purpose": "Controls the reviewed vocabulary bindings Relay uses to interpret namespaced terms.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_vocabularies_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
@@ -113188,8 +55231,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -113231,42 +55274,44 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/vocabularies/additionalProperties",
-        "key_path": "vocabularies.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/AggregateConfig/properties/measures",
+        "key_path": "datasets[].entities[].aggregates[].measures",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key is a vocabulary prefix and each value binds that prefix to its operator-approved vocabulary identifier.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_vocabularies_open_map",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -113306,45 +55351,46 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "",
-        "key_path": "",
-        "path_kind": "root"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/measures",
+        "key_path": "datasets[].tables[].aggregates[].measures",
+        "path_kind": "property"
       },
-      "purpose": "Defines the complete Notary runtime configuration boundary consumed when a Notary instance starts.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_root_structural",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113354,7 +55400,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -113364,69 +55410,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "evidence",
-            "auth"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/access_token_ttl_seconds",
-        "key_path": "auth.access_token_signing.access_token_ttl_seconds",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/measures/items",
+        "key_path": "datasets[].aggregates[].measures[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Access-token lifetime in seconds.",
+      "purpose": "One measure inside an aggregate.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateMeasure",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113436,7 +55476,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -113446,74 +55486,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "required",
+          "value": [
+            "name",
+            "function",
+            "column"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms",
-        "key_path": "auth.access_token_signing.allowed_algorithms",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/measures/items",
+        "key_path": "datasets[].entities[].aggregates[].measures[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Allowed signing algorithms. Only EdDSA is supported.",
+      "purpose": "One measure inside an aggregate.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateMeasure",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113523,7 +55564,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -113533,65 +55574,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name",
+            "function",
+            "column"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms/items",
-        "key_path": "auth.access_token_signing.allowed_algorithms[]",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/measures/items",
+        "key_path": "datasets[].tables[].aggregates[].measures[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One measure inside an aggregate.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateMeasure",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113601,7 +55652,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -113611,48 +55662,57 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name",
+            "function",
+            "column"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences",
-        "key_path": "auth.access_token_signing.audiences",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
+        "key_path": "datasets[].aggregates[].required_filter_bindings",
         "path_kind": "property"
       },
-      "purpose": "Audiences (`aud`) accepted for Notary-minted access tokens.",
+      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
@@ -113663,14 +55723,14 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113680,7 +55740,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -113690,26 +55750,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -113721,34 +55778,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences/items",
-        "key_path": "auth.access_token_signing.audiences[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
+        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113758,7 +55816,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -113768,66 +55826,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/enabled",
-        "key_path": "auth.access_token_signing.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
+        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      "default": {
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113837,7 +55892,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -113847,66 +55902,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/issuer",
-        "key_path": "auth.access_token_signing.issuer",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
+        "key_path": "datasets[].aggregates[].required_filter_bindings[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Issuer (`iss`) the Notary stamps into its own access tokens.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113916,7 +55968,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -113926,66 +55978,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/signing_key_id",
-        "key_path": "auth.access_token_signing.signing_key_id",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
+        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[]",
+        "path_kind": "array_item"
       },
-      "purpose": "`evidence.signing_keys` entry used to sign access tokens. Must be a\ndedicated key, never a credential-signing key.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113995,7 +56054,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114005,66 +56064,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/token_typ",
-        "key_path": "auth.access_token_signing.token_typ",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
+        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Header `typ` stamped into Notary access tokens, distinct from the\ncredential `typ` so a token cannot be replayed as another class.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114074,7 +56140,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114084,48 +56150,55 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids",
-        "key_path": "auth.access_token_signing.verification_key_ids",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filters",
+        "key_path": "datasets[].aggregates[].required_filters",
         "path_kind": "property"
       },
-      "purpose": "Additional publish-only `evidence.signing_keys` entries accepted for\nverifying previously minted Notary access tokens and pre-authorized\ncodes during a governed key rotation.",
+      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
@@ -114136,14 +56209,14 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114153,7 +56226,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114163,26 +56236,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -114194,34 +56264,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids/items",
-        "key_path": "auth.access_token_signing.verification_key_ids[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filters",
+        "key_path": "datasets[].entities[].aggregates[].required_filters",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114231,7 +56302,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114241,51 +56312,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/BatchOperationConfig/properties/enabled",
-        "key_path": "evidence.claims[].operations.batch_evaluate.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filters",
+        "key_path": "datasets[].tables[].aggregates[].required_filters",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "array"
         ],
         "composed": false
       },
@@ -114300,7 +56368,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114310,7 +56378,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114320,18 +56388,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -114342,41 +56410,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/BatchOperationConfig/properties/max_subjects",
-        "key_path": "evidence.claims[].operations.batch_evaluate.max_subjects",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
+        "key_path": "datasets[].aggregates[].required_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114386,7 +56453,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114396,79 +56463,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "maximum",
-          "value": 100
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CccevConfig/properties/evidence_type",
-        "key_path": "evidence.claims[].cccev.evidence_type",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
+        "key_path": "datasets[].entities[].aggregates[].required_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114478,7 +56528,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114488,18 +56538,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -114510,45 +56560,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CccevConfig/properties/evidence_type_iri",
-        "key_path": "evidence.claims[].cccev.evidence_type_iri",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
+        "key_path": "datasets[].tables[].aggregates[].required_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114558,7 +56603,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114568,18 +56613,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -114590,26 +56635,23 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CccevConfig/properties/requirement_type",
-        "key_path": "evidence.claims[].cccev.requirement_type",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/source_entity",
+        "key_path": "datasets[].aggregates[].source_entity",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -114628,7 +56670,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114638,7 +56680,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114648,18 +56690,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -114679,27 +56721,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/cccev",
-        "key_path": "evidence.claims[].cccev",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/source_entity",
+        "key_path": "datasets[].entities[].aggregates[].source_entity",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -114708,7 +56750,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114718,7 +56760,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114728,18 +56770,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -114751,43 +56793,44 @@
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/credential_profiles",
-        "key_path": "evidence.claims[].credential_profiles",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/source_entity",
+        "key_path": "datasets[].tables[].aggregates[].source_entity",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114797,7 +56840,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114807,65 +56850,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/credential_profiles/items",
-        "key_path": "evidence.claims[].credential_profiles[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/spatial",
+        "key_path": "datasets[].aggregates[].spatial",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114875,7 +56920,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114885,66 +56930,77 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "mode",
+            "dimension",
+            "geometry_entity",
+            "geometry_id_field",
+            "geometry_field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/depends_on",
-        "key_path": "evidence.claims[].depends_on",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/spatial",
+        "key_path": "datasets[].entities[].aggregates[].spatial",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114954,7 +57010,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114964,18 +57020,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -114984,42 +57040,57 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "mode",
+            "dimension",
+            "geometry_entity",
+            "geometry_id_field",
+            "geometry_field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/depends_on/items",
-        "key_path": "evidence.claims[].depends_on[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/spatial",
+        "key_path": "datasets[].tables[].aggregates[].spatial",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115029,7 +57100,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115039,18 +57110,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115059,35 +57130,48 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "mode",
+            "dimension",
+            "geometry_entity",
+            "geometry_id_field",
+            "geometry_field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/disclosure",
-        "key_path": "evidence.claims[].disclosure",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
+        "key_path": "datasets[].aggregates[].temporal_field",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/DisclosureConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -115096,7 +57180,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115106,7 +57190,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115116,18 +57200,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115138,45 +57222,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/evidence_mode",
-        "key_path": "evidence.claims[].evidence_mode",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
+        "key_path": "datasets[].entities[].aggregates[].temporal_field",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/ClaimEvidenceMode",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115186,7 +57270,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115196,18 +57280,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115217,44 +57301,37 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "type",
-            "consultations"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimEvidenceMode"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/formats",
-        "key_path": "evidence.claims[].formats",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
+        "key_path": "datasets[].tables[].aggregates[].temporal_field",
         "path_kind": "property"
       },
-      "purpose": "Omitting this field keeps existing authored claims renderable using the\ncanonical claim-result representation. An explicitly empty list is\nrejected during configuration validation.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -115263,7 +57340,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115273,7 +57350,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115283,18 +57360,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115305,40 +57382,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/formats/items",
-        "key_path": "evidence.claims[].formats[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/title",
+        "key_path": "datasets[].aggregates[].title",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115348,7 +57430,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115358,18 +57440,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115380,40 +57462,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/id",
-        "key_path": "evidence.claims[].id",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/title",
+        "key_path": "datasets[].entities[].aggregates[].title",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115423,7 +57510,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115433,18 +57520,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115455,32 +57542,36 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/inputs",
-        "key_path": "evidence.claims[].inputs",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/title",
+        "key_path": "datasets[].tables[].aggregates[].title",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -115489,7 +57580,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115499,7 +57590,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115509,18 +57600,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115531,41 +57622,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/inputs/items",
-        "key_path": "evidence.claims[].inputs[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
+        "key_path": "datasets[].aggregates[].dimensions[].codelist",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/ClaimInputConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115575,7 +57670,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115585,18 +57680,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115606,45 +57701,37 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "name",
-            "type"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimInputConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/oots",
-        "key_path": "evidence.claims[].oots",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[].codelist",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -115653,7 +57740,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115663,7 +57750,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115673,18 +57760,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115696,35 +57783,35 @@
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/operations",
-        "key_path": "evidence.claims[].operations",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[].codelist",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/ClaimOperationsConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -115733,7 +57820,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115743,7 +57830,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115753,18 +57840,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115775,46 +57862,43 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimOperationsConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/purpose",
-        "key_path": "evidence.claims[].purpose",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
+        "key_path": "datasets[].aggregates[].dimensions[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115824,7 +57908,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115834,18 +57918,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115856,44 +57940,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/required_scopes",
-        "key_path": "evidence.claims[].required_scopes",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[].field",
         "path_kind": "property"
       },
-      "purpose": "Caller scopes checked before any registry consultation is dispatched.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115903,7 +57983,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115913,18 +57993,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115935,40 +58015,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/required_scopes/items",
-        "key_path": "evidence.claims[].required_scopes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[].field",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115978,7 +58058,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115988,18 +58068,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116016,27 +58096,26 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/rule",
-        "key_path": "evidence.claims[].rule",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
+        "key_path": "datasets[].aggregates[].dimensions[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RuleConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -116044,7 +58123,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116054,7 +58133,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116064,18 +58143,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116084,66 +58163,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "type",
-              "consultation",
-              "output"
-            ],
-            [
-              "type",
-              "consultation"
-            ],
-            [
-              "type",
-              "expression"
-            ]
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RuleConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/semantics",
-        "key_path": "evidence.claims[].semantics",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116153,7 +58208,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116163,18 +58218,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116185,26 +58240,23 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/subject_type",
-        "key_path": "evidence.claims[].subject_type",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -116217,11 +58269,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116231,7 +58283,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116241,26 +58293,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -116272,17 +58321,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/title",
-        "key_path": "evidence.claims[].title",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
+        "key_path": "datasets[].aggregates[].dimensions[].label",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -116299,7 +58348,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116309,7 +58358,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116319,18 +58368,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116347,36 +58396,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/value",
-        "key_path": "evidence.claims[].value",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[].label",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ClaimValueConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116386,7 +58433,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116396,18 +58443,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116418,27 +58465,23 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/version",
-        "key_path": "evidence.claims[].version",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[].label",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -116455,7 +58498,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116465,7 +58508,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116475,18 +58518,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116503,17 +58546,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimInputConfig/properties/name",
-        "key_path": "evidence.claims[].inputs[].name",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
+        "key_path": "datasets[].aggregates[].indicators[].column",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -116530,7 +58573,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116540,7 +58583,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116550,18 +58593,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116578,17 +58621,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimInputConfig/properties/type",
-        "key_path": "evidence.claims[].inputs[].type",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].column",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -116605,7 +58648,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116615,7 +58658,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116625,18 +58668,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116653,36 +58696,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimOperationsConfig/properties/batch_evaluate",
-        "key_path": "evidence.claims[].operations.batch_evaluate",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].column",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/BatchOperationConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116692,7 +58733,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116702,18 +58743,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116724,36 +58765,32 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/BatchOperationConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimOperationsConfig/properties/evaluate",
-        "key_path": "evidence.claims[].operations.evaluate",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
+        "key_path": "datasets[].aggregates[].indicators[].decimals",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer",
+          "null"
         ],
-        "local_reference": "#/$defs/OperationConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -116763,7 +58800,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116773,7 +58810,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116783,18 +58820,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116803,46 +58840,59 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/OperationConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRefObject/properties/id",
-        "key_path": "auth.api_keys[].authorization_details.claims[].id",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].decimals",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116852,7 +58902,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116862,65 +58912,79 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRefObject/properties/id",
-        "key_path": "auth.bearer_tokens[].authorization_details.claims[].id",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].decimals",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116930,7 +58994,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116940,48 +59004,60 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRefObject/properties/version",
-        "key_path": "auth.api_keys[].authorization_details.claims[].version",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
+        "key_path": "datasets[].aggregates[].indicators[].definition_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -116996,11 +59072,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117010,7 +59086,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117020,26 +59096,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -117054,17 +59127,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRefObject/properties/version",
-        "key_path": "auth.bearer_tokens[].authorization_details.claims[].version",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].definition_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -117079,11 +59152,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117093,7 +59166,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117103,26 +59176,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -117137,17 +59207,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/concept",
-        "key_path": "evidence.claims[].semantics.concept",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].definition_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -117159,14 +59229,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117176,7 +59246,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117186,18 +59256,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117217,35 +59287,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from",
-        "key_path": "evidence.claims[].semantics.derived_from",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
+        "key_path": "datasets[].aggregates[].indicators[].frequency",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117255,7 +59326,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117265,18 +59336,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117287,40 +59358,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from/items",
-        "key_path": "evidence.claims[].semantics.derived_from[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].frequency",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117330,7 +59406,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117340,18 +59416,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117362,23 +59438,26 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/predicate",
-        "key_path": "evidence.claims[].semantics.predicate",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].frequency",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -117390,14 +59469,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117407,7 +59486,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117417,18 +59496,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117448,36 +59527,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/property",
-        "key_path": "evidence.claims[].semantics.property",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
+        "key_path": "datasets[].aggregates[].indicators[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117487,7 +59565,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117497,18 +59575,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117518,46 +59596,59 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/value_mapping",
-        "key_path": "evidence.claims[].semantics.value_mapping",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117567,7 +59658,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117577,18 +59668,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117598,46 +59689,59 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/vocabulary",
-        "key_path": "evidence.claims[].semantics.vocabulary",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117647,7 +59751,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117657,18 +59761,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117678,46 +59782,58 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig/properties/max_bytes",
-        "key_path": "evidence.claims[].value.max_bytes",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
+        "key_path": "datasets[].aggregates[].indicators[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a per-claim string byte ceiling."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117727,7 +59843,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117737,18 +59853,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117757,58 +59873,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 65536
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig/properties/nullable",
-        "key_path": "evidence.claims[].value.nullable",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117818,7 +59918,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117828,18 +59928,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117850,41 +59950,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig/properties/type",
-        "key_path": "evidence.claims[].value.type",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117894,7 +59993,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117904,18 +60003,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117932,36 +60031,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig/properties/unit",
-        "key_path": "evidence.claims[].value.unit",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
+        "key_path": "datasets[].aggregates[].indicators[].label",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117971,7 +60068,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117981,18 +60078,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -118003,44 +60100,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ConcurrencyConfig/properties/subjects",
-        "key_path": "evidence.concurrency.subjects",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].label",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118050,7 +60143,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118060,56 +60153,45 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path",
-        "key_path": "config_trust.antirollback_state_path",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].label",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_config_trust_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -118122,11 +60204,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118136,7 +60218,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118146,26 +60228,24 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -118176,36 +60256,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path",
-        "key_path": "config_trust.break_glass_override_path",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
+        "key_path": "datasets[].aggregates[].indicators[].unit_measure",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_config_trust_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118215,7 +60293,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118225,50 +60303,45 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path",
-        "key_path": "config_trust.bundle_path",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].unit_measure",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_config_trust_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -118281,11 +60354,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118295,7 +60368,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118305,26 +60378,24 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -118335,17 +60406,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path",
-        "key_path": "config_trust.trust_anchor_path",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].unit_measure",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_config_trust_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -118358,11 +60429,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118372,7 +60443,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118382,26 +60453,24 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -118412,35 +60481,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed",
-        "key_path": "evidence.credential_profiles.*.disclosure.allowed",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
+        "key_path": "datasets[].aggregates[].indicators[].unit_mult",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118450,7 +60520,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118460,65 +60530,79 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 2147483647
+        },
+        {
+          "keyword": "minimum",
+          "value": -2147483648
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed/items",
-        "key_path": "evidence.credential_profiles.*.disclosure.allowed[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].unit_mult",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118528,7 +60612,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118538,67 +60622,79 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 2147483647
+        },
+        {
+          "keyword": "minimum",
+          "value": -2147483648
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/name",
-        "key_path": "auth.api_keys[].fingerprint.name",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].unit_mult",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118608,7 +60704,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118618,32 +60714,42 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 2147483647
+        },
+        {
+          "keyword": "minimum",
+          "value": -2147483648
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
+            "integer",
             "null"
           ]
         }
@@ -118651,36 +60757,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/name",
-        "key_path": "auth.bearer_tokens[].fingerprint.name",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
+        "key_path": "datasets[].aggregates[].joins[].relationship",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118690,7 +60794,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118700,69 +60804,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/path",
-        "key_path": "auth.api_keys[].fingerprint.path",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
+        "key_path": "datasets[].entities[].aggregates[].joins[].relationship",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118772,7 +60869,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118782,69 +60879,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/path",
-        "key_path": "auth.bearer_tokens[].fingerprint.path",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
+        "key_path": "datasets[].tables[].aggregates[].joins[].relationship",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118854,7 +60944,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118864,50 +60954,45 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/provider",
-        "key_path": "auth.api_keys[].fingerprint.provider",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/column",
+        "key_path": "datasets[].aggregates[].measures[].column",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -118916,15 +61001,15 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118934,7 +61019,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118944,36 +61029,26 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "env",
-            "file"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -118982,17 +61057,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/provider",
-        "key_path": "auth.bearer_tokens[].fingerprint.provider",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/column",
+        "key_path": "datasets[].entities[].aggregates[].measures[].column",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -119001,15 +61076,15 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119019,7 +61094,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119029,36 +61104,26 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "env",
-            "file"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -119067,35 +61132,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims",
-        "key_path": "evidence.credential_profiles.*.allowed_claims",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/column",
+        "key_path": "datasets[].tables[].aggregates[].measures[].column",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119105,7 +61169,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119115,65 +61179,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims/items",
-        "key_path": "evidence.credential_profiles.*.allowed_claims[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/function",
+        "key_path": "datasets[].aggregates[].measures[].function",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119183,7 +61245,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119193,67 +61255,80 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/disclosure",
-        "key_path": "evidence.credential_profiles.*.disclosure",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/function",
+        "key_path": "datasets[].entities[].aggregates[].measures[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/CredentialDisclosureConfig",
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119263,7 +61338,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119273,69 +61348,80 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialDisclosureConfig"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/format",
-        "key_path": "evidence.credential_profiles.*.format",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/function",
+        "key_path": "datasets[].tables[].aggregates[].measures[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119345,7 +61431,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119355,67 +61441,79 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/holder_binding",
-        "key_path": "evidence.credential_profiles.*.holder_binding",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/name",
+        "key_path": "datasets[].aggregates[].measures[].name",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/HolderBindingConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119425,7 +61523,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119435,52 +61533,45 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/issuer",
-        "key_path": "evidence.credential_profiles.*.issuer",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/name",
+        "key_path": "datasets[].entities[].aggregates[].measures[].name",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -119493,11 +61584,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119507,7 +61598,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119517,26 +61608,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -119548,17 +61636,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/signing_key",
-        "key_path": "evidence.credential_profiles.*.signing_key",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/name",
+        "key_path": "datasets[].tables[].aggregates[].measures[].name",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -119571,11 +61659,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119585,7 +61673,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119595,26 +61683,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -119626,35 +61711,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/validity_seconds",
-        "key_path": "evidence.credential_profiles.*.validity_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119664,7 +61750,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119674,69 +61760,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "int64"
+          "keyword": "required",
+          "value": [
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/vct",
-        "key_path": "evidence.credential_profiles.*.vct",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119746,7 +61839,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119756,66 +61849,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialStatusConfig/properties/base_url",
-        "key_path": "credential_status.base_url",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary credential-status publication and retention behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_credential_status_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119825,7 +61928,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119835,65 +61938,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialStatusConfig/properties/enabled",
-        "key_path": "credential_status.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
+        "key_path": "datasets[].aggregates[].spatial.collection_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary credential-status publication and retention behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_credential_status_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119903,7 +62017,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119913,65 +62027,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialStatusConfig/properties/retention_seconds",
-        "key_path": "credential_status.retention_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
+        "key_path": "datasets[].entities[].aggregates[].spatial.collection_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary credential-status publication and retention behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_credential_status_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119981,7 +62097,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119991,65 +62107,58 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/evidence",
-        "key_path": "deployment.evidence",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
+        "key_path": "datasets[].tables[].aggregates[].spatial.collection_id",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/DeploymentEvidenceConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -120058,7 +62167,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120068,7 +62177,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120078,18 +62187,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120100,45 +62209,43 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/multi_instance",
-        "key_path": "deployment.multi_instance",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
+        "key_path": "datasets[].aggregates[].spatial.dimension",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120148,7 +62255,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120158,18 +62265,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120180,42 +62287,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/profile",
-        "key_path": "deployment.profile",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
+        "key_path": "datasets[].entities[].aggregates[].spatial.dimension",
         "path_kind": "property"
       },
-      "purpose": "The set of deployment profiles an operator can declare.\n\nFrozen at introduction; new profiles may be added but existing ones never\nchange meaning. Deserialization is strict: an unknown profile string fails,\nwhich surfaces as a startup error.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120225,7 +62330,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120235,18 +62340,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120255,55 +62360,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "local",
-            "hosted_lab",
-            "production",
-            "evidence_grade"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/waivers",
-        "key_path": "deployment.waivers",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
+        "key_path": "datasets[].tables[].aggregates[].spatial.dimension",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120313,7 +62405,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120323,18 +62415,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120345,41 +62437,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/waivers/items",
-        "key_path": "deployment.waivers[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
+        "key_path": "datasets[].aggregates[].spatial.geometry_entity",
+        "path_kind": "property"
       },
-      "purpose": "One operator-configured waiver.\n\nA waiver names exactly one finding id, a required operator reference, an\noptional summary, and a mandatory expiry date (`YYYY-MM-DD`). The shared\noperations contract validates metadata before it can reach posture or logs.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120389,7 +62480,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120399,18 +62490,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120419,56 +62510,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "finding",
-            "reference",
-            "expires"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path",
-        "key_path": "deployment.evidence.audit_ack_cursor_path",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
+        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_entity",
         "path_kind": "property"
       },
-      "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. Runtime health requires both a\nfresh timestamp and a watermark equal to the live keyed audit-chain tail.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120478,7 +62555,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120488,69 +62565,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs",
-        "key_path": "deployment.evidence.audit_ack_max_age_secs",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
+        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_entity",
         "path_kind": "property"
       },
-      "purpose": "Optional freshness window, in seconds, for the off-host ack cursor.\nUnset defaults to [`DEFAULT_AUDIT_ACK_MAX_AGE`] (900s). Meaningless\nwithout `audit_ack_cursor_path`; config load rejects that combination.\n\n[`DEFAULT_AUDIT_ACK_MAX_AGE`]: registry_platform_ops::DEFAULT_AUDIT_ACK_MAX_AGE",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120560,7 +62630,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120570,18 +62640,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120590,54 +62660,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping",
-        "key_path": "deployment.evidence.audit_offhost_shipping",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
+        "key_path": "datasets[].aggregates[].spatial.geometry_field",
         "path_kind": "property"
       },
-      "purpose": "Operator asserts audit log events are shipped off-host (for example to\na log aggregator or SIEM) so a local file sink does not cap retention.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120647,7 +62705,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120657,18 +62715,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120679,41 +62737,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/signer_custody_approved",
-        "key_path": "deployment.evidence.signer_custody_approved",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
+        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_field",
         "path_kind": "property"
       },
-      "purpose": "Operator asserts a production review has approved signer custody for\nthis deployment. Provider kind is not proof of custody: PKCS#11 modules\ncan be backed by either hardware or software tokens.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120723,7 +62780,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120733,18 +62790,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120755,23 +62812,23 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/expires",
-        "key_path": "deployment.waivers[].expires",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
+        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_field",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -120788,7 +62845,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120798,7 +62855,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120808,18 +62865,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120836,17 +62893,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/finding",
-        "key_path": "deployment.waivers[].finding",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
+        "key_path": "datasets[].aggregates[].spatial.geometry_id_field",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -120863,7 +62920,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120873,7 +62930,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120883,18 +62940,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120911,27 +62968,26 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/reference",
-        "key_path": "deployment.waivers[].reference",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
+        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_id_field",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverReference",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -120939,7 +62995,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120949,7 +63005,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120959,18 +63015,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120979,60 +63035,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverReference"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/summary",
-        "key_path": "deployment.waivers[].summary",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
+        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_id_field",
         "path_kind": "property"
       },
-      "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverSummary",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121042,7 +63080,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121052,18 +63090,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -121072,40 +63110,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverSummary"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig/properties/allowed",
-        "key_path": "evidence.claims[].disclosure.allowed",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
+        "key_path": "datasets[].aggregates[].spatial.max_geometry_vertices",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -121120,7 +63146,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121130,7 +63156,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121140,18 +63166,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -121160,42 +63186,55 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig/properties/allowed/items",
-        "key_path": "evidence.claims[].disclosure.allowed[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
+        "key_path": "datasets[].entities[].aggregates[].spatial.max_geometry_vertices",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121205,7 +63244,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121215,18 +63254,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -121235,34 +63274,46 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig/properties/default",
-        "key_path": "evidence.claims[].disclosure.default",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
+        "key_path": "datasets[].tables[].aggregates[].spatial.max_geometry_vertices",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -121271,7 +63322,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121281,7 +63332,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121291,18 +63342,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -121311,43 +63362,54 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig/properties/downgrade",
-        "key_path": "evidence.claims[].disclosure.downgrade",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].aggregates[].spatial.mode",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121357,7 +63419,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121367,18 +63429,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -121387,6 +63449,10 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "admin_area"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -121395,17 +63461,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel",
-        "key_path": "auth.api_keys[].authorization_details.assisted_access_context.channel",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].entities[].aggregates[].spatial.mode",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -121414,15 +63480,15 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121432,7 +63498,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121442,29 +63508,30 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "admin_area"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -121473,17 +63540,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel",
-        "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context.channel",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].tables[].aggregates[].spatial.mode",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -121492,15 +63559,15 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121510,7 +63577,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121520,29 +63587,30 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "admin_area"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -121551,36 +63619,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/hash_secret_env",
-        "key_path": "audit.hash_secret_env",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].aggregates[].allowed_filters[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121590,7 +63656,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121600,69 +63666,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/max_files",
-        "key_path": "audit.max_files",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121672,7 +63731,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121682,74 +63741,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/max_size_mb",
-        "key_path": "audit.max_size_mb",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].entities[].api.allowed_filters[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121759,7 +63806,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121769,74 +63816,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/path",
-        "key_path": "audit.path",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121846,7 +63881,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121856,68 +63891,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/sink",
-        "key_path": "audit.sink",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].tables[].api.allowed_filters[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121927,7 +63956,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121937,23 +63966,24 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -121964,36 +63994,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/syslog_socket_path",
-        "key_path": "audit.syslog_socket_path",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].aggregates[].allowed_filters[].ops",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122003,7 +64031,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122013,69 +64041,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/access_token_signing",
-        "key_path": "auth.access_token_signing",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AccessTokenSigningConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122085,7 +64106,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122095,70 +64116,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys",
-        "key_path": "auth.api_keys",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].entities[].api.allowed_filters[].ops",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122168,7 +64181,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122178,26 +64191,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -122209,35 +64219,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys/items",
-        "key_path": "auth.api_keys[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/EvidenceCredentialConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122247,7 +64256,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122257,77 +64266,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "fingerprint"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens",
-        "key_path": "auth.bearer_tokens",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].tables[].api.allowed_filters[].ops",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122337,7 +64331,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122347,26 +64341,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -122378,35 +64369,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens/items",
-        "key_path": "auth.bearer_tokens[]",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].aggregates[].allowed_filters[].ops[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/EvidenceCredentialConfig",
+        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122416,7 +64407,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122426,78 +64417,77 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "id",
-            "fingerprint"
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig"
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/oidc",
-        "key_path": "auth.oidc",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "local_reference": "#/$defs/FilterOp",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122507,7 +64497,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122517,18 +64507,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -122538,53 +64528,56 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "issuer",
-            "jwks_url"
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode",
-        "key_path": "auth.api_keys[].authorization_details.access_mode",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].entities[].api.allowed_filters[].ops[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
-        "composed": true
+        "local_reference": "#/$defs/FilterOp",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122594,7 +64587,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122604,79 +64597,77 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "enum",
           "value": [
-            "unknown",
-            "machine_client",
-            "subject_bound",
-            "delegated_subject_access"
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode",
-        "key_path": "auth.bearer_tokens[].authorization_details.access_mode",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
-        "composed": true
+        "local_reference": "#/$defs/FilterOp",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122686,7 +64677,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122696,78 +64687,77 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "enum",
           "value": [
-            "unknown",
-            "machine_client",
-            "subject_bound",
-            "delegated_subject_access"
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions",
-        "key_path": "auth.api_keys[].authorization_details.actions",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].tables[].api.allowed_filters[].ops[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122777,7 +64767,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122787,66 +64777,77 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions",
-        "key_path": "auth.bearer_tokens[].authorization_details.actions",
+        "schema": "relay",
+        "pointer": "/$defs/ApiKeyConfig/properties/fingerprint",
+        "key_path": "auth.api_keys[].fingerprint",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/CredentialFingerprintSchema",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122856,7 +64857,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122866,18 +64867,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -122885,46 +64886,62 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "provider",
+              "name"
+            ],
+            [
+              "provider",
+              "path"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/CredentialFingerprintSchema"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items",
-        "key_path": "auth.api_keys[].authorization_details.actions[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ApiKeyConfig/properties/id",
+        "key_path": "auth.api_keys[].id",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122934,7 +64951,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122944,18 +64961,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -122975,34 +64992,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items",
-        "key_path": "auth.bearer_tokens[].authorization_details.actions[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ApiKeyConfig/properties/scopes",
+        "key_path": "auth.api_keys[].scopes",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123012,7 +65030,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123022,18 +65040,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -123047,42 +65065,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context",
-        "key_path": "auth.api_keys[].authorization_details.assisted_access_context",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/ApiKeyConfig/properties/scopes/items",
+        "key_path": "auth.api_keys[].scopes[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123092,7 +65108,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123102,18 +65118,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -123125,53 +65141,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "channel"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context",
-        "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context",
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/claims",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Claims released on success. Non-empty; at least one `required`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123181,7 +65186,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123191,76 +65196,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "channel"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level",
-        "key_path": "auth.api_keys[].authorization_details.assurance_level",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/claims/items",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "A single released claim. Exactly one of `source_field` or `expression`\nmust be set: a claim is either a direct source-field projection or a\nCEL-computed value.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ReleaseClaimConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123270,7 +65262,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123280,51 +65272,55 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "name"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseClaimConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level",
-        "key_path": "auth.bearer_tokens[].authorization_details.assurance_level",
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/description",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].description",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -123336,14 +65332,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123353,7 +65349,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123363,26 +65359,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -123397,35 +65390,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims",
-        "key_path": "auth.api_keys[].authorization_details.claims",
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/id",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Profile identifier, lower-kebab/snake (`^[a-z][a-z0-9_-]*$`). Globally\nunique with `version`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123435,7 +65427,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123445,66 +65437,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims",
-        "key_path": "auth.bearer_tokens[].authorization_details.claims",
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/purpose",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].purpose",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Data-purpose this profile is bound to. When the backing entity declares\n`governed_policy.permitted_purposes`, this must be a member.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123514,7 +65502,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123524,67 +65512,64 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items",
-        "key_path": "auth.api_keys[].authorization_details.claims[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/release_conditions",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object",
-          "string"
+          "null",
+          "object"
         ],
-        "local_reference": "#/$defs/ClaimRef",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123594,7 +65579,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123604,80 +65589,71 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "id"
+            "expression"
           ]
         },
         {
           "keyword": "type",
           "value": [
-            "object",
-            "string"
+            "null",
+            "object"
           ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRef"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items",
-        "key_path": "auth.bearer_tokens[].authorization_details.claims[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/release_scope",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].release_scope",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Dataset-bound scope a caller must hold to invoke this release. The\nstable profile is exactly `<dataset_id>:identity_release`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object",
           "string"
         ],
-        "local_reference": "#/$defs/ClaimRef",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123687,7 +65663,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123697,80 +65673,64 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "object",
-            "string"
-          ]
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRef"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref",
-        "key_path": "auth.api_keys[].authorization_details.consent_ref",
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/response",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].response",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ReleaseResponseConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123780,7 +65740,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123790,70 +65750,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseResponseConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref",
-        "key_path": "auth.bearer_tokens[].authorization_details.consent_ref",
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/subject",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].subject",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ReleaseSubjectConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123863,7 +65820,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123873,18 +65830,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -123892,32 +65849,39 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "source_field",
+            "id_type"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseSubjectConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure",
-        "key_path": "auth.api_keys[].authorization_details.disclosure",
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/title",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].title",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -123929,14 +65893,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123946,7 +65910,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123956,26 +65920,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -123990,36 +65951,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure",
-        "key_path": "auth.bearer_tokens[].authorization_details.disclosure",
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/version",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].version",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Profile version. Globally unique with `id`; no silent \"latest\".",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124029,7 +65988,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124039,70 +65998,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format",
-        "key_path": "auth.api_keys[].authorization_details.format",
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig/oneOf/0/properties/sink",
+        "key_path": "audit.sink",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124112,7 +66063,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124122,70 +66073,69 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "const",
           "value": [
-            "string",
-            "null"
+            "file",
+            "stdout",
+            "syslog"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format",
-        "key_path": "auth.bearer_tokens[].authorization_details.format",
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig/oneOf/1/properties/path",
+        "key_path": "audit.path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_audit_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124195,7 +66145,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124205,18 +66155,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -124224,51 +66174,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction",
-        "key_path": "auth.api_keys[].authorization_details.jurisdiction",
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig/oneOf/1/properties/rotate",
+        "key_path": "audit.rotate",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "In-process rotation for the `file` audit sink.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RotateConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124278,7 +66224,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124288,70 +66234,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "max_size_mb",
+            "max_files"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RotateConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction",
-        "key_path": "auth.bearer_tokens[].authorization_details.jurisdiction",
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig/properties/chain",
+        "key_path": "audit.chain",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Retains the compatibility switch in the authored contract; Relay audit envelopes remain integrity-chained regardless of this setting.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124361,7 +66310,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124371,70 +66320,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref",
-        "key_path": "auth.api_keys[].authorization_details.legal_basis_ref",
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig/properties/format",
+        "key_path": "audit.format",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AuditFormat",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124444,7 +66386,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124454,70 +66396,71 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "jsonl"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditFormat"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref",
-        "key_path": "auth.bearer_tokens[].authorization_details.legal_basis_ref",
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig/properties/hash_secret_env",
+        "key_path": "audit.hash_secret_env",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Name of the environment variable holding the per-deploy secret\nused to HMAC sensitive audit values (single-record primary keys,\nsensitive query parameters). Runtime startup fails closed when\nthis field is unset, empty, or points to a missing, empty, or\nweak secret. Direct middleware tests can opt into the explicit\nunkeyed dev-only hasher without using runtime config.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
           "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124527,7 +66470,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124537,18 +66480,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -124556,35 +66499,38 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[^=\\x00]*[^=\\x00\\x09-\\x0D\\x20\\x85\\u00A0\\u1680\\u2000-\\u200A\\u2028\\u2029\\u202F\\u205F\\u3000][^=\\x00]*$"
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "string"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations",
-        "key_path": "auth.api_keys[].authorization_details.locations",
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig/properties/include_health",
+        "key_path": "audit.include_health",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Include `/healthz` liveness probes in the audit stream. `/ready` is\nalways excluded because auditing it would advance the chain after its\nzero-backlog shipping check and self-invalidate the next probe.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "boolean"
         ],
         "composed": false
       },
@@ -124592,14 +66538,14 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124609,7 +66555,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124619,66 +66565,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations",
-        "key_path": "auth.bearer_tokens[].authorization_details.locations",
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig/properties/write_policy",
+        "key_path": "audit.write_policy",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Behavior when an audit record fails to write.\n\n`fail_closed` (default) fails the request with a stable error code so\nthat no request outcome is returned without a durable audit record.\n`availability_first` logs the failure and lets the request succeed for\ndeployments that explicitly accept best-effort audit durability.\nPer-route-family selection is out of scope; this is a single\ndeployment-wide policy.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/AuditWritePolicySchema",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124688,7 +66631,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124698,65 +66641,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "availability_first",
+            "fail_closed",
+            "fail_closed_route_families"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditWritePolicySchema"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items",
-        "key_path": "auth.api_keys[].authorization_details.locations[]",
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig/items",
+        "key_path": "consultation.audit_pseudonym_materials[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One public epoch id bound to one secret source reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AuditPseudonymMaterialConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124766,7 +66718,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124776,65 +66728,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "key_id",
+            "source"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymMaterialConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items",
-        "key_path": "auth.bearer_tokens[].authorization_details.locations[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/key_id",
+        "key_path": "consultation.audit_pseudonym_materials[].key_id",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/AuditPseudonymKeyIdSchema",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124844,7 +66805,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124854,67 +66815,71 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z0-9][a-z0-9._-]{0,63}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymKeyIdSchema"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose",
-        "key_path": "auth.api_keys[].authorization_details.purpose",
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/source",
+        "key_path": "consultation.audit_pseudonym_materials[].source",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Closed v1 set of audit-pseudonym secret source providers.\n\nThe configured name is a reference only. Secret values cannot be embedded\nin this model and are loaded exactly once during runtime compilation.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AuditPseudonymSecretSourceConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124924,7 +66889,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124934,70 +66899,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "provider",
+            "name"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymSecretSourceConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose",
-        "key_path": "auth.bearer_tokens[].authorization_details.purpose",
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/name",
+        "key_path": "consultation.audit_pseudonym_materials[].source.name",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Portable environment-variable name used only as a secret reference.\n\nDebug output is redacted even though the name is not itself key material,\npreventing configuration diagnostics from disclosing secret topology.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AuditPseudonymSecretEnvironmentName",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125007,7 +66976,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125017,18 +66986,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -125036,51 +67005,53 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymSecretEnvironmentName"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship",
-        "key_path": "auth.api_keys[].authorization_details.relationship",
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/provider",
+        "key_path": "consultation.audit_pseudonym_materials[].source.provider",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125090,7 +67061,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125100,77 +67071,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "relationship_type",
-            "proof_claim"
-          ]
+          "keyword": "const",
+          "value": "environment"
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship",
-        "key_path": "auth.bearer_tokens[].authorization_details.relationship",
+        "schema": "relay",
+        "pointer": "/$defs/AuthConfig/properties/api_keys",
+        "key_path": "auth.api_keys",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125180,7 +67141,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125190,18 +67151,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -125213,52 +67174,43 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship_type",
-            "proof_claim"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version",
-        "key_path": "auth.api_keys[].authorization_details.schema_version",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AuthConfig/properties/api_keys/items",
+        "key_path": "auth.api_keys[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One configured API key, identified by an id and a fingerprint reference.\nThe raw key never appears in config.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ApiKeyConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125268,7 +67220,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125278,18 +67230,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -125301,42 +67253,55 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "fingerprint"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ApiKeyConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version",
-        "key_path": "auth.bearer_tokens[].authorization_details.schema_version",
+        "schema": "relay",
+        "pointer": "/$defs/AuthConfig/properties/failure_throttle",
+        "key_path": "auth.failure_throttle",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AuthFailureThrottleConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125346,7 +67311,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125356,67 +67321,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuthFailureThrottleConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject",
-        "key_path": "auth.api_keys[].authorization_details.subject",
+        "schema": "relay",
+        "pointer": "/$defs/AuthConfig/properties/mode",
+        "key_path": "auth.mode",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "local_reference": "#/$defs/AuthMode",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125426,7 +67391,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125436,58 +67401,56 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "const",
           "value": [
-            "binding_claim",
-            "id_type"
+            "api_key",
+            "oidc"
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuthMode"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject",
-        "key_path": "auth.bearer_tokens[].authorization_details.subject",
+        "schema": "relay",
+        "pointer": "/$defs/AuthConfig/properties/oidc",
+        "key_path": "auth.oidc",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "OIDC / OAuth2 resource-server configuration. The relay validates\nincoming bearer JWTs against a configured external IdP. No tokens\nare minted here.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -125502,11 +67465,11 @@
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125516,7 +67479,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125526,34 +67489,31 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "binding_claim",
-            "id_type"
+            "issuer",
+            "audiences"
           ]
         },
         {
@@ -125567,36 +67527,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target",
-        "key_path": "auth.api_keys[].authorization_details.target",
+        "schema": "relay",
+        "pointer": "/$defs/AuthFailureThrottleConfig/properties/enabled",
+        "key_path": "auth.failure_throttle.enabled",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "boolean"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125606,7 +67565,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125616,77 +67575,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id_type",
-            "id"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target",
-        "key_path": "auth.bearer_tokens[].authorization_details.target",
+        "schema": "relay",
+        "pointer": "/$defs/AuthFailureThrottleConfig/properties/max_failures",
+        "key_path": "auth.failure_throttle.max_failures",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "integer"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125696,7 +67641,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125706,75 +67651,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "id_type",
-            "id"
-          ]
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type",
-        "key_path": "auth.api_keys[].authorization_details.type",
+        "schema": "relay",
+        "pointer": "/$defs/AuthFailureThrottleConfig/properties/window_seconds",
+        "key_path": "auth.failure_throttle.window_seconds",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125784,7 +67729,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125794,65 +67739,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type",
-        "key_path": "auth.bearer_tokens[].authorization_details.type",
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig/properties/authority_type",
+        "key_path": "catalog.authority_type",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "BRegDCAT-AP: type IRI for the `foaf:Agent` publisher. When set, emits\n`dcterms:type` on the publisher node.\n\nBRegDCAT-AP 2.1.0 SHACL checks publisher type values against the ADMS\npublishertype scheme (`http://purl.org/adms/publishertype/...`).\nThe relay does not enforce a vocabulary: any IRI passes through.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_catalog_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125862,58 +67818,58 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
+        "relay",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim",
-        "key_path": "auth.api_keys[].authorization_details.relationship.proof_claim",
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig/properties/base_url",
+        "key_path": "catalog.base_url",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay catalog identity and public metadata exposed for governed discovery.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_catalog_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -125930,7 +67886,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125940,7 +67896,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125950,18 +67906,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -125969,8 +67925,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -125981,34 +67936,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim",
-        "key_path": "auth.bearer_tokens[].authorization_details.relationship.proof_claim",
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig/properties/default_spatial_coverage",
+        "key_path": "catalog.default_spatial_coverage",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "BRegDCAT-AP: default `dcterms:spatial` IRI applied to datasets that\ndo not declare their own `spatial_coverage`. Typically an EU\nauthority country IRI under\n`http://publications.europa.eu/resource/authority/country/`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_catalog_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126018,75 +67975,77 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
+        "relay",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type",
-        "key_path": "auth.api_keys[].authorization_details.relationship.relationship_type",
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig/properties/participant_id",
+        "key_path": "catalog.participant_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Identifies the participant in catalog output; when omitted, Relay derives the participant identifier from the reviewed catalog base URL.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_catalog_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126096,58 +68055,58 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
+        "relay",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type",
-        "key_path": "auth.bearer_tokens[].authorization_details.relationship.relationship_type",
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig/properties/publisher",
+        "key_path": "catalog.publisher",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_catalog_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "string"
@@ -126160,11 +68119,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126174,37 +68133,34 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
+        "relay",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -126215,34 +68171,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim",
-        "key_path": "auth.api_keys[].authorization_details.subject.binding_claim",
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig/properties/publisher_iri",
+        "key_path": "catalog.publisher_iri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "BRegDCAT-AP: identifier IRI for the `foaf:Agent` publisher. Use a\ncontrolled-vocabulary corporate body IRI when publishing strict\nBRegDCAT-AP.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_catalog_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126252,58 +68210,58 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
+        "relay",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim",
-        "key_path": "auth.bearer_tokens[].authorization_details.subject.binding_claim",
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig/properties/title",
+        "key_path": "catalog.title",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_catalog_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "string"
@@ -126316,11 +68274,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126330,37 +68288,34 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
+        "relay",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -126371,17 +68326,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type",
-        "key_path": "auth.api_keys[].authorization_details.subject.id_type",
+        "schema": "relay",
+        "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path",
+        "key_path": "config_trust.antirollback_state_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_config_trust_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -126398,7 +68353,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126408,7 +68363,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -126418,18 +68373,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -126437,8 +68392,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -126449,34 +68403,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type",
-        "key_path": "auth.bearer_tokens[].authorization_details.subject.id_type",
+        "schema": "relay",
+        "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path",
+        "key_path": "config_trust.break_glass_override_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_config_trust_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126486,7 +68442,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -126496,18 +68452,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -126515,29 +68471,31 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id",
-        "key_path": "auth.api_keys[].authorization_details.target.id",
+        "schema": "relay",
+        "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path",
+        "key_path": "config_trust.bundle_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_config_trust_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -126554,7 +68512,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126564,7 +68522,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -126574,18 +68532,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -126593,8 +68551,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -126605,17 +68562,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id",
-        "key_path": "auth.bearer_tokens[].authorization_details.target.id",
+        "schema": "relay",
+        "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path",
+        "key_path": "config_trust.trust_anchor_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_config_trust_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -126632,7 +68589,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126642,7 +68599,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -126652,18 +68609,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -126671,8 +68628,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -126683,34 +68639,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type",
-        "key_path": "auth.api_keys[].authorization_details.target.id_type",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence",
+        "key_path": "consultation.artifacts.evidence",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126720,7 +68676,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -126730,65 +68686,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type",
-        "key_path": "auth.bearer_tokens[].authorization_details.target.id_type",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence/items",
+        "key_path": "consultation.artifacts.evidence[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One bounded, hash-pinned integration evidence file.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationEvidenceArtifactConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126798,7 +68752,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -126808,66 +68762,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "class",
+            "path",
+            "sha256"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationEvidenceArtifactConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes",
-        "key_path": "evidence.allowed_purposes",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs",
+        "key_path": "consultation.artifacts.integration_packs",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126877,7 +68839,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -126887,18 +68849,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -126915,26 +68877,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes/items",
-        "key_path": "evidence.allowed_purposes[]",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs/items",
+        "key_path": "consultation.artifacts.integration_packs[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One hash-pinned public contract or reviewed integration pack.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
@@ -126942,7 +68905,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126952,7 +68915,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -126962,18 +68925,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -126982,43 +68945,54 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "path",
+            "hash",
+            "sha256"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/api_base_url",
-        "key_path": "evidence.api_base_url",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings",
+        "key_path": "consultation.artifacts.private_bindings",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127028,7 +69002,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127038,66 +69012,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/api_version",
-        "key_path": "evidence.api_version",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings/items",
+        "key_path": "consultation.artifacts.private_bindings[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One hash-pinned public contract or reviewed integration pack.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127107,7 +69078,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127117,18 +69088,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -127137,43 +69108,54 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "path",
+            "hash",
+            "sha256"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/claims",
-        "key_path": "evidence.claims",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts",
+        "key_path": "consultation.artifacts.public_contracts",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127183,7 +69165,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127193,18 +69175,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -127221,22 +69203,22 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/claims/items",
-        "key_path": "evidence.claims[]",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts/items",
+        "key_path": "consultation.artifacts.public_contracts[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One hash-pinned public contract or reviewed integration pack.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ClaimDefinition",
+        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -127249,7 +69231,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127259,7 +69241,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127269,18 +69251,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -127292,12 +69274,9 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "title",
-            "version",
-            "subject_type",
-            "evidence_mode",
-            "rule"
+            "path",
+            "hash",
+            "sha256"
           ]
         },
         {
@@ -127306,41 +69285,41 @@
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/claims_url",
-        "key_path": "evidence.claims_url",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts",
+        "key_path": "consultation.artifacts.rhai_scripts",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127350,7 +69329,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127360,67 +69339,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/concurrency",
-        "key_path": "evidence.concurrency",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts/items",
+        "key_path": "consultation.artifacts.rhai_scripts[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One hash-pinned private binding or standalone Rhai script.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ConcurrencyConfig",
+        "local_reference": "#/$defs/ConsultationArtifactReferenceConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127430,7 +69405,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127440,18 +69415,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -127460,47 +69435,53 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "path",
+            "sha256"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ConcurrencyConfig"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactReferenceConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/credential_profiles",
-        "key_path": "evidence.credential_profiles",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/path",
+        "key_path": "consultation.artifacts.rhai_scripts[].path",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Normalized bundle-root-relative path.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127510,7 +69491,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127520,18 +69501,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -127545,41 +69526,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/credential_profiles/additionalProperties",
-        "key_path": "evidence.credential_profiles.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/sha256",
+        "key_path": "consultation.artifacts.rhai_scripts[].sha256",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a credential profile and each value defines its exact claims, format, and issuance contract.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_credential_profiles_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/CredentialProfileConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127589,7 +69569,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127599,79 +69579,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "format",
-            "issuer",
-            "signing_key",
-            "vct"
-          ]
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/enabled",
-        "key_path": "evidence.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/active_key_id",
+        "key_path": "consultation.bootstrap.active_key_id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127681,7 +69648,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127691,18 +69658,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -127713,41 +69680,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/formats_url",
-        "key_path": "evidence.formats_url",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/active_write_deadline_unix_ms",
+        "key_path": "consultation.bootstrap.active_write_deadline_unix_ms",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127757,7 +69723,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127767,18 +69733,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -127790,43 +69756,54 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/inline_batch_limit",
-        "key_path": "evidence.inline_batch_limit",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/audit_event_retention_ms",
+        "key_path": "consultation.bootstrap.audit_event_retention_ms",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127836,7 +69813,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127846,37 +69823,40 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "format",
-          "value": "uint"
+          "value": "int64"
         },
         {
           "keyword": "maximum",
-          "value": 100
+          "value": 9223372036854775807
         },
         {
           "keyword": "minimum",
-          "value": 1
+          "value": -9223372036854775808
         },
         {
           "keyword": "type",
@@ -127886,116 +69866,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/machine_quota",
-        "key_path": "evidence.machine_quota",
-        "path_kind": "property"
-      },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/MachineQuotaConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/MachineQuotaConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/max_credential_validity_seconds",
-        "key_path": "evidence.max_credential_validity_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/keyring_maintenance_database_url_env",
+        "key_path": "consultation.bootstrap.keyring_maintenance_database_url_env",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128005,7 +69903,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128015,18 +69913,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -128034,56 +69932,45 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/relay",
-        "key_path": "evidence.relay",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/keyring_reader_database_url_env",
+        "key_path": "consultation.bootstrap.keyring_reader_database_url_env",
         "path_kind": "property"
       },
-      "purpose": "The one Registry Relay connection available to registry-backed claims.\nAuthentication remains a reloadable local file reference; core never\nloads the bearer token value.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128093,7 +69980,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128103,74 +69990,64 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "base_url",
-            "workload_client_id",
-            "token_file"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/service_id",
-        "key_path": "evidence.service_id",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/migration_database_url_env",
+        "key_path": "consultation.bootstrap.migration_database_url_env",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128180,7 +70057,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128190,24 +70067,26 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
@@ -128218,35 +70097,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/signing_keys",
-        "key_path": "evidence.signing_keys",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/owner_role",
+        "key_path": "consultation.bootstrap.owner_role",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128256,7 +70134,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128266,18 +70144,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -128291,41 +70169,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/signing_keys/additionalProperties",
-        "key_path": "evidence.signing_keys.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationConfig/properties/artifacts",
+        "key_path": "consultation.artifacts",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a signing-key binding and each value references the operator-managed signing material and lifecycle metadata.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_signing_keys_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/SigningKeyConfig",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128335,7 +70214,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128345,79 +70224,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "provider",
-            "alg",
-            "kid",
-            "status"
+            "public_contracts",
+            "integration_packs",
+            "private_bindings",
+            "evidence"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/variables",
-        "key_path": "evidence.variables",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationConfig/properties/audit_pseudonym_materials",
+        "key_path": "consultation.audit_pseudonym_materials",
         "path_kind": "property"
       },
-      "purpose": "Closed union of request variables declared by authored services.",
+      "purpose": "Bounded startup catalog of audit-pseudonym material references.\n\nThe 1..=32 bound and cross-entry uniqueness are enforced by config\nvalidation and repeated by the material provider before loading secrets.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
+        "local_reference": "#/$defs/AuditPseudonymMaterialCatalogConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128427,7 +70302,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128437,18 +70312,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -128459,41 +70334,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/variables/additionalProperties",
-        "key_path": "evidence.variables.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationConfig/properties/authorized_workload",
+        "key_path": "consultation.authorized_workload",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a Notary evidence variable and each value defines its bounded source and evaluation contract.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_variables_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/RequestVariableConfig",
+        "local_reference": "#/$defs/ConsultationWorkloadConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128503,7 +70382,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128513,31 +70392,33 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "from",
-            "type"
+            "audience",
+            "client_claim_selector",
+            "client_value",
+            "principal_id"
           ]
         },
         {
@@ -128546,23 +70427,23 @@
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RequestVariableConfig"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationWorkloadConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details",
-        "key_path": "auth.api_keys[].authorization_details",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationConfig/properties/bootstrap",
+        "key_path": "consultation.bootstrap",
         "path_kind": "property"
       },
-      "purpose": "Versioned authorization fields shared by static configuration and token/OIDC JSON.\n\nUnknown metadata is intentionally ignored for forward-compatible interoperability.\nAuthorization decisions consume only the modeled fields and must never infer authority\nfrom an unrecognized extension.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Binds the product-owned first-install policy carried only by the verified consultation bundle; deployment renderers cannot reproduce it as command arguments.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -128577,11 +70458,11 @@
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128591,7 +70472,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128601,34 +70482,36 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "type",
-            "schema_version"
+            "migration_database_url_env",
+            "owner_role",
+            "keyring_maintenance_database_url_env",
+            "keyring_reader_database_url_env",
+            "active_key_id",
+            "active_write_deadline_unix_ms",
+            "audit_event_retention_ms"
           ]
         },
         {
@@ -128642,36 +70525,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details",
-        "key_path": "auth.bearer_tokens[].authorization_details",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationConfig/properties/source_credentials",
+        "key_path": "consultation.source_credentials",
         "path_kind": "property"
       },
-      "purpose": "Versioned authorization fields shared by static configuration and token/OIDC JSON.\n\nUnknown metadata is intentionally ignored for forward-compatible interoperability.\nAuthorization decisions consume only the modeled fields and must never infer authority\nfrom an unrecognized extension.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "local_reference": "#/$defs/ConsultationSourceCredentialCatalogConfig",
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128681,7 +70564,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128691,18 +70574,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -128714,40 +70597,34 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type",
-            "schema_version"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint",
-        "key_path": "auth.api_keys[].fingerprint",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationConfig/properties/state_plane",
+        "key_path": "consultation.state_plane",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/CredentialFingerprintRef",
+        "local_reference": "#/$defs/ConsultationStatePlaneConfig",
         "composed": false
       },
       "requiredness": "required",
@@ -128756,11 +70633,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128770,7 +70647,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128780,33 +70657,33 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "provider"
+            "database_url_env",
+            "chain_key_epoch_id",
+            "serving_fence_lock_key",
+            "audit_pseudonym_keyring_lock_key"
           ]
         },
         {
@@ -128815,41 +70692,41 @@
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationStatePlaneConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint",
-        "key_path": "auth.bearer_tokens[].fingerprint",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/class",
+        "key_path": "consultation.artifacts.evidence[].class",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Closed evidence classes understood by consultation source-plan v1.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/CredentialFingerprintRef",
+        "local_reference": "#/$defs/ConsultationEvidenceClassConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128859,7 +70736,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128869,58 +70746,57 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "provider"
+            "conformance",
+            "negative_security",
+            "minimization"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationEvidenceClassConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/id",
-        "key_path": "auth.api_keys[].id",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/path",
+        "key_path": "consultation.artifacts.evidence[].path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -128937,7 +70813,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128947,7 +70823,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128957,18 +70833,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -128988,17 +70864,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/id",
-        "key_path": "auth.bearer_tokens[].id",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/sha256",
+        "key_path": "consultation.artifacts.evidence[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -129007,15 +70883,15 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129025,7 +70901,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129035,29 +70911,30 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -129066,35 +70943,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes",
-        "key_path": "auth.api_keys[].scopes",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig/items",
+        "key_path": "consultation.source_credentials[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Closed V1 source-credential provider configuration.\n\nEnvironment names are opaque references and are redacted from `Debug`.\nThere is deliberately no field capable of carrying an embedded username,\npassword, bearer token, or provider-specific extension.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationSourceCredentialConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129104,7 +70981,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129114,18 +70991,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -129137,43 +71014,77 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "type",
+              "ref",
+              "generation",
+              "client_id_env",
+              "client_secret_env"
+            ],
+            [
+              "type",
+              "ref",
+              "generation",
+              "token_env"
+            ],
+            [
+              "type",
+              "ref",
+              "generation",
+              "username_env",
+              "password_env"
+            ],
+            [
+              "type",
+              "ref",
+              "generation",
+              "value_env"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes",
-        "key_path": "auth.bearer_tokens[].scopes",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/generation",
+        "key_path": "consultation.source_credentials[].generation",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129183,7 +71094,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129193,18 +71104,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -129216,42 +71127,55 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items",
-        "key_path": "auth.api_keys[].scopes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/password_env",
+        "key_path": "consultation.source_credentials[].password_env",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129261,7 +71185,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129271,18 +71195,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -129290,46 +71214,54 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items",
-        "key_path": "auth.bearer_tokens[].scopes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/ref",
+        "key_path": "consultation.source_credentials[].ref",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Exact private-binding credential reference grammar.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationSourceCredentialReference",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129339,7 +71271,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129349,18 +71281,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -129372,43 +71304,50 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialReference"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allow_insecure_localhost",
-        "key_path": "auth.oidc.allow_insecure_localhost",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/type",
+        "key_path": "consultation.source_credentials[].type",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129418,7 +71357,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129428,63 +71367,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "api_key_header",
+            "api_key_query",
+            "basic",
+            "oauth_client_credentials",
+            "static_bearer"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms",
-        "key_path": "auth.oidc.allowed_algorithms",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/username_env",
+        "key_path": "consultation.source_credentials[].username_env",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129494,7 +71446,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129504,62 +71456,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms/items",
-        "key_path": "auth.oidc.allowed_algorithms[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/1/properties/token_env",
+        "key_path": "consultation.source_credentials[].token_env",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129569,7 +71532,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129579,63 +71542,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients",
-        "key_path": "auth.oidc.allowed_clients",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/2/properties/value_env",
+        "key_path": "consultation.source_credentials[].value_env",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129645,7 +71618,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129655,62 +71628,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients/items",
-        "key_path": "auth.oidc.allowed_clients[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_id_env",
+        "key_path": "consultation.source_credentials[].client_id_env",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129720,7 +71704,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129730,63 +71714,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types",
-        "key_path": "auth.oidc.allowed_token_types",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_secret_env",
+        "key_path": "consultation.source_credentials[].client_secret_env",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129796,7 +71790,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129806,18 +71800,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -129825,46 +71819,53 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types/items",
-        "key_path": "auth.oidc.allowed_token_types[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/audit_pseudonym_keyring_lock_key",
+        "key_path": "consultation.state_plane.audit_pseudonym_keyring_lock_key",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129874,7 +71875,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129884,18 +71885,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -129907,43 +71908,54 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences",
-        "key_path": "auth.oidc.audiences",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/chain_key_epoch_id",
+        "key_path": "consultation.state_plane.chain_key_epoch_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129953,7 +71965,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129963,18 +71975,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -129988,40 +72000,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences/items",
-        "key_path": "auth.oidc.audiences[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/database_url_env",
+        "key_path": "consultation.state_plane.database_url_env",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Portable environment-variable name that resolves the state-plane URL.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationDatabaseUrlEnvironmentName",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130031,7 +72044,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130041,18 +72054,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -130060,46 +72073,55 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationDatabaseUrlEnvironmentName"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/issuer",
-        "key_path": "auth.oidc.issuer",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/root_certificate_path",
+        "key_path": "consultation.state_plane.root_certificate_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130109,7 +72131,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130119,18 +72141,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -130144,32 +72166,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/jwks_url",
-        "key_path": "auth.oidc.jwks_url",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/serving_fence_lock_key",
+        "key_path": "consultation.state_plane.serving_fence_lock_key",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -130177,7 +72202,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130187,7 +72212,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130197,18 +72222,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -130220,44 +72245,54 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/leeway",
-        "key_path": "auth.oidc.leeway",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
+        "key_path": "consultation.artifacts.integration_packs[].hash",
         "path_kind": "property"
       },
-      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
+      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130267,7 +72302,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130277,67 +72312,69 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/principal_claim",
-        "key_path": "auth.oidc.principal_claim",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
+        "key_path": "consultation.artifacts.private_bindings[].hash",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130347,7 +72384,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130357,26 +72394,33 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -130385,35 +72429,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_claim",
-        "key_path": "auth.oidc.scope_claim",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
+        "key_path": "consultation.artifacts.public_contracts[].hash",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130423,7 +72466,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130433,26 +72476,33 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -130461,35 +72511,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map",
-        "key_path": "auth.oidc.scope_map",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
+        "key_path": "consultation.artifacts.integration_packs[].path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Normalized bundle-root-relative path.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130499,7 +72548,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130509,62 +72558,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties",
-        "key_path": "auth.oidc.scope_map.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
+        "key_path": "consultation.artifacts.private_bindings[].path",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key is an external token scope and each value is the bounded Notary scope mapping granted for that exact token scope.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_oidc_scope_map_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Normalized bundle-root-relative path.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130574,7 +72626,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130584,62 +72636,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties/items",
-        "key_path": "auth.oidc.scope_map.*[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
+        "key_path": "consultation.artifacts.public_contracts[].path",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Normalized bundle-root-relative path.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130649,7 +72704,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130659,23 +72714,26 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -130687,35 +72745,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_separator",
-        "key_path": "auth.oidc.scope_separator",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
+        "key_path": "consultation.artifacts.integration_packs[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130725,7 +72782,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130735,18 +72792,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -130755,6 +72812,10 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -130763,36 +72824,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_endpoint",
-        "key_path": "auth.oidc.userinfo_endpoint",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
+        "key_path": "consultation.artifacts.private_bindings[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130802,7 +72861,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130812,69 +72871,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers",
-        "key_path": "auth.oidc.userinfo_issuers",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
+        "key_path": "consultation.artifacts.public_contracts[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130884,7 +72940,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130894,65 +72950,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers/items",
-        "key_path": "auth.oidc.userinfo_issuers[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationWorkloadConfig/properties/audience",
+        "key_path": "consultation.authorized_workload.audience",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130962,7 +73019,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130972,18 +73029,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -131003,35 +73060,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/clock_leeway_seconds",
-        "key_path": "federation.clock_leeway_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_claim_selector",
+        "key_path": "consultation.authorized_workload.client_claim_selector",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Closed set of verified OAuth claims that may identify Registry Notary.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/ConsultationClientClaimSelectorConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131041,7 +73098,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131051,18 +73108,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -131072,51 +73129,52 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "enum",
+          "value": [
+            "azp",
+            "client_id"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationClientClaimSelectorConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/emergency_denylist",
-        "key_path": "federation.emergency_denylist",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_value",
+        "key_path": "consultation.authorized_workload.client_value",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/FederationEmergencyDenylistConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131126,7 +73184,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131136,67 +73194,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/enabled",
-        "key_path": "federation.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationWorkloadConfig/properties/principal_id",
+        "key_path": "consultation.authorized_workload.principal_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131206,7 +73262,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131216,45 +73272,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/evaluation_profiles",
-        "key_path": "federation.evaluation_profiles",
+        "schema": "relay",
+        "pointer": "/$defs/CorsConfig/properties/allowed_origins",
+        "key_path": "server.cors.allowed_origins",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
@@ -131268,11 +73327,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131282,7 +73341,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131292,23 +73351,26 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -131320,35 +73382,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/evaluation_profiles/items",
-        "key_path": "federation.evaluation_profiles[]",
+        "schema": "relay",
+        "pointer": "/$defs/CorsConfig/properties/allowed_origins/items",
+        "key_path": "server.cors.allowed_origins[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/FederationEvaluationProfileConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131358,7 +73419,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131368,76 +73429,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "ruleset",
-            "claim_id",
-            "subject_id_type"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/federation_api",
-        "key_path": "federation.federation_api",
+        "schema": "relay",
+        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/name",
+        "key_path": "auth.api_keys[].fingerprint.name",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/RuntimeEnvironmentNameSchema",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131447,7 +73498,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131457,63 +73508,72 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[^=\\x00]+$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RuntimeEnvironmentNameSchema"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/inbound_body_limit_bytes",
-        "key_path": "federation.inbound_body_limit_bytes",
+        "schema": "relay",
+        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/provider",
+        "key_path": "auth.api_keys[].fingerprint.provider",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131523,7 +73583,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131533,71 +73593,71 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "const",
+          "value": [
+            "env",
+            "file"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/issuer",
-        "key_path": "federation.issuer",
+        "schema": "relay",
+        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/1/properties/path",
+        "key_path": "auth.api_keys[].fingerprint.path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131607,7 +73667,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131617,18 +73677,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -131636,7 +73696,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
@@ -131647,26 +73707,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/jwks_uri",
-        "key_path": "federation.jwks_uri",
+        "schema": "relay",
+        "pointer": "/$defs/CsvFormatConfig/properties/delimiter",
+        "key_path": "datasets[].tables[].source.format.csv.delimiter",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -131675,7 +73736,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131685,7 +73746,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131695,18 +73756,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -131715,33 +73776,49 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint8"
+        },
+        {
+          "keyword": "maximum",
+          "value": 255
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/max_request_lifetime_seconds",
-        "key_path": "federation.max_request_lifetime_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/CsvFormatConfig/properties/header_row",
+        "key_path": "datasets[].tables[].source.format.csv.header_row",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -131751,7 +73828,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131761,7 +73838,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131771,18 +73848,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -131793,7 +73870,11 @@
       "constraints": [
         {
           "keyword": "format",
-          "value": "uint64"
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
         },
         {
           "keyword": "minimum",
@@ -131801,32 +73882,36 @@
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/node_id",
-        "key_path": "federation.node_id",
+        "schema": "relay",
+        "pointer": "/$defs/CsvFormatConfig/properties/quote",
+        "key_path": "datasets[].tables[].source.format.csv.quote",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -131835,7 +73920,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131845,7 +73930,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131855,18 +73940,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -131875,44 +73960,58 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint8"
+        },
+        {
+          "keyword": "maximum",
+          "value": 255
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/pairwise_subject_hash",
-        "key_path": "federation.pairwise_subject_hash",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/access_rights",
+        "key_path": "datasets[].access_rights",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Access rights classification, mirrors DCAT-AP `dcterms:accessRights`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/FederationPairwiseSubjectHashConfig",
+        "local_reference": "#/$defs/AccessRights",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131922,7 +74021,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131932,51 +74031,57 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "public",
+            "restricted",
+            "non_public"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPairwiseSubjectHashConfig"
+        "schema": "relay",
+        "pointer": "/$defs/AccessRights"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/peers",
-        "key_path": "federation.peers",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/aggregates",
+        "key_path": "datasets[].aggregates",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
@@ -131987,14 +74092,14 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132004,7 +74109,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132014,18 +74119,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132042,22 +74147,22 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/peers/items",
-        "key_path": "federation.peers[]",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/aggregates/items",
+        "key_path": "datasets[].aggregates[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/FederationPeerConfig",
+        "local_reference": "#/$defs/AggregateConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -132070,7 +74175,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132080,7 +74185,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132090,18 +74195,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132113,9 +74218,9 @@
         {
           "keyword": "required",
           "value": [
-            "node_id",
-            "issuer",
-            "jwks_uri"
+            "id",
+            "description",
+            "disclosure_control"
           ]
         },
         {
@@ -132124,28 +74229,27 @@
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/response_shaping",
-        "key_path": "federation.response_shaping",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/applicable_legislation",
+        "key_path": "datasets[].applicable_legislation",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "DCAT-AP `dcatap:applicableLegislation` IRIs. This is evidence\npublished for standard consumers, not an application-specific\nauthorization or source-of-truth verdict.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/FederationResponseShapingConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -132159,7 +74263,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132169,7 +74273,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132179,18 +74283,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132201,46 +74305,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationResponseShapingConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/signing",
-        "key_path": "federation.signing",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/applicable_legislation/items",
+        "key_path": "datasets[].applicable_legislation[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/FederationSigningConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132250,7 +74348,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132260,18 +74358,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132280,35 +74378,25 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "signing_key"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationSigningConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions",
-        "key_path": "federation.supported_protocol_versions",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/conforms_to",
+        "key_path": "datasets[].conforms_to",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
@@ -132326,7 +74414,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132336,7 +74424,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132346,18 +74434,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132374,17 +74462,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions/items",
-        "key_path": "federation.supported_protocol_versions[]",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/conforms_to/items",
+        "key_path": "datasets[].conforms_to[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -132401,7 +74489,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132411,7 +74499,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132421,18 +74509,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132449,35 +74537,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids",
-        "key_path": "federation.emergency_denylist.kids",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/defaults",
+        "key_path": "datasets[].defaults",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional table defaults for reducing repetition within one dataset.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/DatasetDefaultsConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132487,7 +74576,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132497,18 +74586,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132519,40 +74608,44 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DatasetDefaultsConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids/items",
-        "key_path": "federation.emergency_denylist.kids[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/description",
+        "key_path": "datasets[].description",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132562,7 +74655,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132572,18 +74665,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132600,17 +74693,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids",
-        "key_path": "federation.emergency_denylist.node_ids",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/entities",
+        "key_path": "datasets[].entities",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
@@ -132621,14 +74714,14 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132638,7 +74731,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132648,18 +74741,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132676,26 +74769,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids/items",
-        "key_path": "federation.emergency_denylist.node_ids[]",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/entities/items",
+        "key_path": "datasets[].entities[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/EntityConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
@@ -132703,84 +74797,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/assurance_level",
-        "key_path": "federation.evaluation_profiles[].assurance_level",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132790,7 +74807,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132800,18 +74817,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132821,36 +74838,47 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "name",
+            "table",
+            "access",
+            "api"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/claim_id",
-        "key_path": "federation.evaluation_profiles[].claim_id",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/id",
+        "key_path": "datasets[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/DatasetId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -132858,7 +74886,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132868,7 +74896,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132878,18 +74906,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132898,44 +74926,50 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DatasetId"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/consent_ref",
-        "key_path": "federation.evaluation_profiles[].consent_ref",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/owner",
+        "key_path": "datasets[].owner",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132945,7 +74979,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132955,18 +74989,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132977,45 +75011,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/disclosure",
-        "key_path": "federation.evaluation_profiles[].disclosure",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/public_services",
+        "key_path": "datasets[].public_services",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "CPSV public services that produce this dataset. Registry Relay emits\nthem as standard `cpsv:PublicService` nodes; consumers decide how to\ninterpret that evidence.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133025,7 +75055,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133035,18 +75065,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133057,43 +75087,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/id",
-        "key_path": "federation.evaluation_profiles[].id",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/public_services/items",
+        "key_path": "datasets[].public_services[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/PublicServiceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133103,7 +75131,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133113,18 +75141,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133133,44 +75161,53 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "title"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/PublicServiceConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/jurisdiction",
-        "key_path": "federation.evaluation_profiles[].jurisdiction",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/sensitivity",
+        "key_path": "datasets[].sensitivity",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Sensitivity classification. Operator-defined values cover common\npersonal and public dataset classifications in V1.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/Sensitivity",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133180,7 +75217,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133190,18 +75227,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133211,27 +75248,38 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "public",
+            "internal",
+            "personal",
+            "confidential",
+            "secret"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/Sensitivity"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/legal_basis_ref",
-        "key_path": "federation.evaluation_profiles[].legal_basis_ref",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/spatial_coverage",
+        "key_path": "datasets[].spatial_coverage",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "BRegDCAT-AP: `dct:spatial` IRI for this dataset. Overrides the\ncatalog-level `default_spatial_coverage` when set.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -133243,14 +75291,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133260,7 +75308,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133270,18 +75318,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133301,36 +75349,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/max_claim_result_age_seconds",
-        "key_path": "federation.evaluation_profiles[].max_claim_result_age_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/status",
+        "key_path": "datasets[].status",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Publishes the dataset lifecycle status; when omitted, Relay emits its weakest lifecycle claim instead of inferring a stronger status.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "null",
+          "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133340,7 +75388,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133350,18 +75398,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133371,52 +75419,54 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "enum",
+          "value": [
+            "under_development",
+            "completed",
+            "deprecated",
+            "withdrawn"
+          ]
         },
         {
           "keyword": "type",
           "value": [
-            "integer",
-            "null"
+            "null",
+            "string"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/ruleset",
-        "key_path": "federation.evaluation_profiles[].ruleset",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/tables",
+        "key_path": "datasets[].tables",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133426,7 +75476,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133436,18 +75486,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133458,40 +75508,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/subject_id_type",
-        "key_path": "federation.evaluation_profiles[].subject_id_type",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/tables/items",
+        "key_path": "datasets[].tables[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One private storage table under a dataset.\n\nThe public API should not expose these ids. Entity config maps one\nresource into one domain resource, with optional field renaming and\nrelationship declarations.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ResourceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133501,7 +75552,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133511,65 +75562,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "source",
+            "schema"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPairwiseSubjectHashConfig/properties/secret_env",
-        "key_path": "federation.pairwise_subject_hash.secret_env",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/title",
+        "key_path": "datasets[].title",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133579,7 +75639,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133589,26 +75649,24 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -133619,35 +75677,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_localhost",
-        "key_path": "federation.peers[].allow_insecure_localhost",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/update_frequency",
+        "key_path": "datasets[].update_frequency",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Update cadence; mirrors DCAT-AP `dcterms:accrualPeriodicity`. The\nV1 set is the codes used by the example plus the common alternates.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
+        "local_reference": "#/$defs/UpdateFrequency",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133657,7 +75715,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133667,18 +75725,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133687,43 +75745,63 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "continuous",
+            "daily",
+            "weekly",
+            "termly",
+            "monthly",
+            "quarterly",
+            "annual",
+            "irregular",
+            "as_needed",
+            "unknown"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/UpdateFrequency"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_private_network",
-        "key_path": "federation.peers[].allow_insecure_private_network",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetDefaultsConfig/properties/materialization",
+        "key_path": "datasets[].defaults.materialization",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "How a configured private table is registered for query planning.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133733,7 +75811,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133743,18 +75821,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133763,43 +75841,53 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "snapshot"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles",
-        "key_path": "federation.peers[].allowed_profiles",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetDefaultsConfig/properties/refresh",
+        "key_path": "datasets[].defaults.refresh",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133809,7 +75897,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133819,18 +75907,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133839,42 +75927,59 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "mode",
+              "interval"
+            ],
+            [
+              "mode"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles/items",
-        "key_path": "federation.peers[].allowed_profiles[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentConfig/properties/evidence",
+        "key_path": "deployment.evidence",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/DeploymentEvidenceConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133884,7 +75989,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133894,18 +75999,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133916,32 +76021,37 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentEvidenceConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions",
-        "key_path": "federation.peers[].allowed_protocol_versions",
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentConfig/properties/profile",
+        "key_path": "deployment.profile",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -133950,7 +76060,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133960,7 +76070,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133970,18 +76080,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133990,42 +76100,55 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "local",
+            "hosted_lab",
+            "production",
+            "evidence_grade"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions/items",
-        "key_path": "federation.peers[].allowed_protocol_versions[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentConfig/properties/waivers",
+        "key_path": "deployment.waivers",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Per-deployment waivers. Each names one finding id, a required operator\nreference, an optional summary, and a mandatory expiry date. Expired\nwaivers stop suppressing their finding and raise\n`deployment.waiver_expired`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134035,7 +76158,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134045,18 +76168,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -134067,41 +76190,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes",
-        "key_path": "federation.peers[].allowed_purposes",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentConfig/properties/waivers/items",
+        "key_path": "deployment.waivers[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One declared waiver. `expires` is an ISO 8601 `YYYY-MM-DD` date; format is\nvalidated at load time. The reference and optional summary are validated by\nthe shared operations contract before either can reach posture or logs.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/DeploymentWaiverConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134111,7 +76234,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134121,18 +76244,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -134141,42 +76264,55 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "finding",
+            "reference",
+            "expires"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentWaiverConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes/items",
-        "key_path": "federation.peers[].allowed_purposes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/api_key_rotation",
+        "key_path": "deployment.evidence.api_key_rotation",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Operator asserts an API-key rotation process is in place.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134186,7 +76322,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134196,63 +76332,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes",
-        "key_path": "federation.peers[].evaluation_scopes",
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path",
+        "key_path": "deployment.evidence.audit_ack_cursor_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. When set, the runtime reads it to\nobserve shipping freshness and surfaces it as posture shipping health;\nabsent, shipping health stays `unverified` and only the declared\nshipping target is reported.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134262,7 +76401,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134272,62 +76411,69 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes/items",
-        "key_path": "federation.peers[].evaluation_scopes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs",
+        "key_path": "deployment.evidence.audit_ack_max_age_secs",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional freshness window in seconds for the ack cursor's `acked_at`\ntimestamp. Defaults to `DEFAULT_AUDIT_ACK_MAX_AGE` (900) when unset. A\nwindow without `audit_ack_cursor_path` is rejected at load, since a\nfreshness window is meaningless without a cursor to observe.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134337,7 +76483,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134347,18 +76493,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -134367,42 +76513,58 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/issuer",
-        "key_path": "federation.peers[].issuer",
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping",
+        "key_path": "deployment.evidence.audit_offhost_shipping",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Operator asserts audit records are shipped off-host (for example to a\nlog collector or SIEM) rather than relying solely on local retention.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134412,7 +76574,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134422,64 +76584,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/jwks_uri",
-        "key_path": "federation.peers[].jwks_uri",
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/ingress_rate_limit",
+        "key_path": "deployment.evidence.ingress_rate_limit",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Operator asserts ingress rate limiting is enforced (for example by a\ngateway or reverse proxy in front of the relay).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134489,7 +76650,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134499,18 +76660,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -134521,23 +76682,23 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/node_id",
-        "key_path": "federation.peers[].node_id",
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/expires",
+        "key_path": "deployment.waivers[].expires",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -134554,7 +76715,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134564,7 +76725,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134574,18 +76735,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -134602,35 +76763,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationResponseShapingConfig/properties/minimum_denial_latency_ms",
-        "key_path": "federation.response_shaping.minimum_denial_latency_ms",
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/finding",
+        "key_path": "deployment.waivers[].finding",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134640,7 +76800,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134650,18 +76810,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -134670,50 +76830,43 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationSigningConfig/properties/signing_key",
-        "key_path": "federation.signing.signing_key",
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/reference",
+        "key_path": "deployment.waivers[].reference",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/DeploymentWaiverReference",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134723,7 +76876,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134733,65 +76886,80 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentWaiverReference"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods",
-        "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods",
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/summary",
+        "key_path": "deployment.waivers[].summary",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/DeploymentWaiverSummary",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134801,7 +76969,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134811,65 +76979,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentWaiverSummary"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods/items",
-        "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method",
+        "key_path": "datasets[].aggregates[].disclosure_control.method",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134879,7 +77057,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134889,66 +77067,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig/properties/mode",
-        "key_path": "evidence.credential_profiles.*.holder_binding.mode",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.method",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134958,7 +77133,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134968,67 +77143,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig/properties/proof_of_possession",
-        "key_path": "evidence.credential_profiles.*.holder_binding.proof_of_possession",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.method",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135038,7 +77209,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135048,69 +77219,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/MachineQuotaConfig/properties/enabled",
-        "key_path": "evidence.machine_quota.enabled",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
+        "key_path": "datasets[].aggregates[].disclosure_control.method[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135120,7 +77284,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135130,18 +77294,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -135152,41 +77316,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/MachineQuotaConfig/properties/subjects_per_minute",
-        "key_path": "evidence.machine_quota.subjects_per_minute",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.method[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135196,7 +77359,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135206,74 +77369,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/environment",
-        "key_path": "instance.environment",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.method[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135283,7 +77434,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135293,23 +77444,24 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -135320,26 +77472,26 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/id",
-        "key_path": "instance.id",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
+        "key_path": "datasets[].aggregates[].disclosure_control.min_cell_size",
         "path_kind": "property"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -135348,7 +77500,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135358,7 +77510,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135368,63 +77520,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/jurisdiction",
-        "key_path": "instance.jurisdiction",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_cell_size",
         "path_kind": "property"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135434,7 +77598,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135444,66 +77608,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/owner",
-        "key_path": "instance.owner",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_cell_size",
         "path_kind": "property"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135513,7 +77686,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135523,66 +77696,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/public_base_url",
-        "key_path": "instance.public_base_url",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
+        "key_path": "datasets[].aggregates[].disclosure_control.min_group_size",
         "path_kind": "property"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135592,7 +77775,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135602,32 +77785,42 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
+            "integer",
             "null"
           ]
         }
@@ -135635,26 +77828,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciAuthorizationConfig/properties/require_pkce_method",
-        "key_path": "oid4vci.authorization.require_pkce_method",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_group_size",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -135663,7 +77857,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135673,7 +77867,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135683,18 +77877,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -135703,43 +77897,59 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences",
-        "key_path": "oid4vci.accepted_token_audiences",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_group_size",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135749,7 +77959,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135759,65 +77969,78 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences/items",
-        "key_path": "oid4vci.accepted_token_audiences[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
+        "key_path": "datasets[].aggregates[].disclosure_control.report_suppressed_rows",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135827,7 +78050,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135837,53 +78060,49 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/authorization",
-        "key_path": "oid4vci.authorization",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.report_suppressed_rows",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
-        "local_reference": "#/$defs/Oid4vciAuthorizationConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -135897,7 +78116,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135907,7 +78126,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135917,18 +78136,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -135939,30 +78158,26 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciAuthorizationConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers",
-        "key_path": "oid4vci.authorization_servers",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.report_suppressed_rows",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "boolean"
         ],
         "composed": false
       },
@@ -135977,7 +78192,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135987,7 +78202,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135997,18 +78212,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -136019,40 +78234,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers/items",
-        "key_path": "oid4vci.authorization_servers[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
+        "key_path": "datasets[].aggregates[].disclosure_control.suppression",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136062,7 +78279,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136072,18 +78289,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -136092,43 +78309,56 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "mask",
+            "null",
+            "omit"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/Suppression"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations",
-        "key_path": "oid4vci.credential_configurations",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.suppression",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136138,7 +78368,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136148,66 +78378,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "mask",
+            "null",
+            "omit"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/Suppression"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations/additionalProperties",
-        "key_path": "oid4vci.credential_configurations.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.suppression",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names an OpenID4VCI credential configuration and each value defines the advertised and issued credential contract.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_credential_configurations_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/Oid4vciCredentialConfigurationConfig",
+        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136217,7 +78457,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136227,80 +78467,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "const",
           "value": [
-            "credential_profile",
-            "format",
-            "scope",
-            "vct",
-            "display_name"
+            "mask",
+            "null",
+            "omit"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig"
+        "schema": "relay",
+        "pointer": "/$defs/Suppression"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/credential_endpoint",
-        "key_path": "oid4vci.credential_endpoint",
+        "schema": "relay",
+        "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/id",
+        "key_path": "metadata.ecosystem_binding.id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_metadata_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136310,7 +78544,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136320,27 +78554,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -136351,35 +78581,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/credential_issuer",
-        "key_path": "oid4vci.credential_issuer",
+        "schema": "relay",
+        "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/version",
+        "key_path": "metadata.ecosystem_binding.version",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_metadata_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136389,7 +78620,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136399,66 +78630,64 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/display",
-        "key_path": "oid4vci.display",
+        "schema": "relay",
+        "pointer": "/$defs/EntityAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].entities[].access.aggregate_scope",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136468,7 +78697,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136478,18 +78707,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -136500,41 +78729,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/display/items",
-        "key_path": "oid4vci.display[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/EntityAccessConfig/properties/evidence_verification_scope",
+        "key_path": "datasets[].entities[].access.evidence_verification_scope",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/Oid4vciIssuerDisplayConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136544,7 +78773,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136554,18 +78783,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -136574,53 +78803,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciIssuerDisplayConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/enabled",
-        "key_path": "oid4vci.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/EntityAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].entities[].access.metadata_scope",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136630,7 +78848,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136640,18 +78858,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -136662,42 +78880,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/nonce",
-        "key_path": "oid4vci.nonce",
+        "schema": "relay",
+        "pointer": "/$defs/EntityAccessConfig/properties/read_scope",
+        "key_path": "datasets[].entities[].access.read_scope",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/Oid4vciNonceConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136707,7 +78923,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136717,18 +78933,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -136739,46 +78955,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciNonceConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/nonce_endpoint",
-        "key_path": "oid4vci.nonce_endpoint",
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions",
+        "key_path": "datasets[].entities[].api.allowed_expansions",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136788,7 +78999,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136798,69 +79009,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/offer_endpoint",
-        "key_path": "oid4vci.offer_endpoint",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions/items",
+        "key_path": "datasets[].entities[].api.allowed_expansions[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136870,7 +79074,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136880,26 +79084,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -136911,36 +79112,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/pre_authorized_code",
-        "key_path": "oid4vci.pre_authorized_code",
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/allowed_filters",
+        "key_path": "datasets[].entities[].api.allowed_filters",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/Oid4vciPreAuthorizedCodeConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136950,7 +79150,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136960,18 +79160,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -136982,46 +79182,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/proof",
-        "key_path": "oid4vci.proof",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].entities[].api.allowed_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/Oid4vciProofConfig",
+        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137031,7 +79226,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137041,18 +79236,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -137061,46 +79256,53 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field",
+            "ops"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciProofConfig"
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/display_name",
-        "key_path": "oid4vci.credential_configurations.*.claims[].display_name",
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/default_limit",
+        "key_path": "datasets[].entities[].api.default_limit",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137110,7 +79312,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137120,65 +79322,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/id",
-        "key_path": "oid4vci.credential_configurations.*.claims[].id",
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/governed_policy",
+        "key_path": "datasets[].entities[].api.governed_policy",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137188,7 +79401,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137198,51 +79411,51 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path",
-        "key_path": "oid4vci.credential_configurations.*.claims[].output_path",
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/max_limit",
+        "key_path": "datasets[].entities[].api.max_limit",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -137252,11 +79465,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137266,7 +79479,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137276,65 +79489,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path/items",
-        "key_path": "oid4vci.credential_configurations.*.claims[].output_path[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/require_purpose_header",
+        "key_path": "datasets[].entities[].api.require_purpose_header",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137344,7 +79567,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137354,65 +79577,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/sd",
-        "key_path": "oid4vci.credential_configurations.*.claims[].sd",
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings",
+        "key_path": "datasets[].entities[].api.required_filter_bindings",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the query.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137422,7 +79643,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137432,67 +79653,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claim_id",
-        "key_path": "oid4vci.credential_configurations.*.claim_id",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings/items",
+        "key_path": "datasets[].entities[].api.required_filter_bindings[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137502,7 +79719,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137512,51 +79729,55 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "field"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims",
-        "key_path": "oid4vci.credential_configurations.*.claims",
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/required_filters",
+        "key_path": "datasets[].entities[].api.required_filters",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Alternative fields that can satisfy the row-scope gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
@@ -137567,14 +79788,14 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137584,7 +79805,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137594,26 +79815,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -137625,35 +79843,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims/items",
-        "key_path": "oid4vci.credential_configurations.*.claims[]",
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/required_filters/items",
+        "key_path": "datasets[].entities[].api.required_filters[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/Oid4vciCredentialClaimConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137663,7 +79880,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137673,78 +79890,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "output_path",
-            "display_name",
-            "sd"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/credential_profile",
-        "key_path": "oid4vci.credential_configurations.*.credential_profile",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/access",
+        "key_path": "datasets[].entities[].access",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/EntityAccessConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137754,7 +79956,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137764,48 +79966,57 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "metadata_scope",
+            "aggregate_scope",
+            "read_scope"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/EntityAccessConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported",
-        "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/aggregates",
+        "key_path": "datasets[].entities[].aggregates",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
@@ -137816,14 +80027,14 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137833,7 +80044,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137843,26 +80054,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -137874,34 +80082,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported/items",
-        "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported[]",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/aggregates/items",
+        "key_path": "datasets[].entities[].aggregates[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137911,7 +80120,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137921,67 +80130,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "description",
+            "disclosure_control"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display",
-        "key_path": "oid4vci.credential_configurations.*.display",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/api",
+        "key_path": "datasets[].entities[].api",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/Oid4vciCredentialDisplayConfig",
+        "local_reference": "#/$defs/EntityApiConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137991,7 +80208,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138001,69 +80218,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "default_limit",
+            "max_limit"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig"
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display_name",
-        "key_path": "oid4vci.credential_configurations.*.display_name",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles",
+        "key_path": "datasets[].entities[].attribute_release_profiles",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Governed identity attribute-release profiles attached to this entity.\nEach profile resolves exactly one subject and returns only the\nconfigured, minimised claims. Empty by default (feature opt-in).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138073,7 +80295,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138083,65 +80305,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/format",
-        "key_path": "oid4vci.credential_configurations.*.format",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles/items",
+        "key_path": "datasets[].entities[].attribute_release_profiles[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "A governed identity attribute-release profile. A profile is a\nprojection-limited, exactly-one-subject lookup that maps a configured set of\nsource fields (or CEL-computed expressions) into a minimised\nOIDC/UserInfo-style claim bundle. Every profile is purpose-bound and requires\na matching `data-purpose` at resolve time. Identified globally by the\n`(id, version)` pair; both are required path segments at resolve time.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AttributeReleaseProfile",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138151,7 +80371,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138161,66 +80381,79 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "version",
+            "purpose",
+            "release_scope",
+            "subject",
+            "claims"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported",
-        "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/concept_uri",
+        "key_path": "datasets[].entities[].concept_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138230,7 +80463,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138240,65 +80473,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported/items",
-        "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/description",
+        "key_path": "datasets[].entities[].description",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138308,7 +80543,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138318,67 +80553,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/representative_issuance",
-        "key_path": "oid4vci.credential_configurations.*.representative_issuance",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/fields",
+        "key_path": "datasets[].entities[].fields",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138388,7 +80622,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138398,75 +80632,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "ceremony",
-            "relationship"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/scope",
-        "key_path": "oid4vci.credential_configurations.*.scope",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/fields/items",
+        "key_path": "datasets[].entities[].fields[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/EntityFieldConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138476,7 +80698,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138486,48 +80708,55 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/EntityFieldConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/vct",
-        "key_path": "oid4vci.credential_configurations.*.vct",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/name",
+        "key_path": "datasets[].entities[].name",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -138540,11 +80769,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138554,7 +80783,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138564,26 +80793,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -138595,36 +80821,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_color",
-        "key_path": "oid4vci.credential_configurations.*.display.background_color",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/relationships",
+        "key_path": "datasets[].entities[].relationships",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138634,7 +80859,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138644,70 +80869,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_image",
-        "key_path": "oid4vci.credential_configurations.*.display.background_image",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/relationships/items",
+        "key_path": "datasets[].entities[].relationships[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/EntityRelationshipConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138717,7 +80935,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138727,70 +80945,77 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "null",
-            "object"
+            "name",
+            "kind",
+            "target",
+            "foreign_key"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/EntityRelationshipConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/description",
-        "key_path": "oid4vci.credential_configurations.*.display.description",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/spatial",
+        "key_path": "datasets[].entities[].spatial",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138800,7 +81025,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138810,70 +81035,72 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "geometry"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/locale",
-        "key_path": "oid4vci.credential_configurations.*.display.locale",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/table",
+        "key_path": "datasets[].entities[].table",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Resource identifier within a dataset.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/ResourceId",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138883,7 +81110,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138893,70 +81120,72 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceId"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/logo",
-        "key_path": "oid4vci.credential_configurations.*.display.logo",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/title",
+        "key_path": "datasets[].entities[].title",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138966,7 +81195,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138976,70 +81205,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/secondary_image",
-        "key_path": "oid4vci.credential_configurations.*.display.secondary_image",
+        "schema": "relay",
+        "pointer": "/$defs/EntityFieldConfig/properties/codelist",
+        "key_path": "datasets[].entities[].fields[].codelist",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139049,7 +81275,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139059,51 +81285,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/text_color",
-        "key_path": "oid4vci.credential_configurations.*.display.text_color",
+        "schema": "relay",
+        "pointer": "/$defs/EntityFieldConfig/properties/concept_uri",
+        "key_path": "datasets[].entities[].fields[].concept_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -139115,14 +81338,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139132,7 +81355,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139142,26 +81365,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -139176,17 +81396,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-        "key_path": "oid4vci.credential_configurations.*.display.background_image.alt_text",
+        "schema": "relay",
+        "pointer": "/$defs/EntityFieldConfig/properties/from",
+        "key_path": "datasets[].entities[].fields[].from",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -139198,14 +81418,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139215,7 +81435,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139225,26 +81445,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -139259,17 +81476,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-        "key_path": "oid4vci.credential_configurations.*.display.logo.alt_text",
+        "schema": "relay",
+        "pointer": "/$defs/EntityFieldConfig/properties/language",
+        "key_path": "datasets[].entities[].fields[].language",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -139281,14 +81498,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139298,7 +81515,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139308,26 +81525,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -139342,36 +81556,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.alt_text",
+        "schema": "relay",
+        "pointer": "/$defs/EntityFieldConfig/properties/name",
+        "key_path": "datasets[].entities[].fields[].name",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139381,7 +81593,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139391,70 +81603,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-        "key_path": "oid4vci.display[].logo.alt_text",
+        "schema": "relay",
+        "pointer": "/$defs/EntityFieldConfig/properties/sensitive",
+        "key_path": "datasets[].entities[].fields[].sensitive",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139464,7 +81669,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139474,18 +81679,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -139496,26 +81701,23 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-        "key_path": "oid4vci.credential_configurations.*.display.background_image.uri",
+        "schema": "relay",
+        "pointer": "/$defs/EntityFieldConfig/properties/unit",
+        "key_path": "datasets[].entities[].fields[].unit",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -139527,14 +81729,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139544,7 +81746,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139554,26 +81756,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -139588,17 +81787,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-        "key_path": "oid4vci.credential_configurations.*.display.logo.uri",
+        "schema": "relay",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/concept_uri",
+        "key_path": "datasets[].entities[].relationships[].concept_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -139610,14 +81809,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139627,7 +81826,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139637,26 +81836,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -139671,36 +81867,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.uri",
+        "schema": "relay",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/foreign_key",
+        "key_path": "datasets[].entities[].relationships[].foreign_key",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139710,7 +81904,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139720,18 +81914,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -139739,51 +81933,46 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-        "key_path": "oid4vci.display[].logo.uri",
+        "schema": "relay",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/kind",
+        "key_path": "datasets[].entities[].relationships[].kind",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/RelationshipKind",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139793,7 +81982,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139803,18 +81992,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -139824,46 +82013,53 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "belongs_to",
+            "has_many",
+            "has_one"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RelationshipKind"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-        "key_path": "oid4vci.credential_configurations.*.display.background_image.url",
+        "schema": "relay",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/name",
+        "key_path": "datasets[].entities[].relationships[].name",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139873,7 +82069,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139883,70 +82079,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-        "key_path": "oid4vci.credential_configurations.*.display.logo.url",
+        "schema": "relay",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/target",
+        "key_path": "datasets[].entities[].relationships[].target",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139956,7 +82144,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139966,70 +82154,64 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.url",
+        "schema": "relay",
+        "pointer": "/$defs/EntitySpatialConfig/properties/bbox_fields",
+        "key_path": "datasets[].entities[].spatial.bbox_fields",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140039,7 +82221,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140049,51 +82231,57 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-        "key_path": "oid4vci.display[].logo.url",
+        "schema": "relay",
+        "pointer": "/$defs/EntitySpatialConfig/properties/collection_id",
+        "key_path": "datasets[].entities[].spatial.collection_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -140105,14 +82293,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140122,7 +82310,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140132,26 +82320,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -140166,26 +82351,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/allow_insecure_localhost",
-        "key_path": "oid4vci.pre_authorized_code.esignet.allow_insecure_localhost",
+        "schema": "relay",
+        "pointer": "/$defs/EntitySpatialConfig/properties/datetime_field",
+        "key_path": "datasets[].entities[].spatial.datetime_field",
         "path_kind": "property"
       },
-      "purpose": "Allow `http` loopback URLs for the eSignet endpoints and JWKS transport.\nFor local development and tests only.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -140194,7 +82380,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140204,7 +82390,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140214,18 +82400,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -140236,41 +82422,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/authorize_url",
-        "key_path": "oid4vci.pre_authorized_code.esignet.authorize_url",
+        "schema": "relay",
+        "pointer": "/$defs/EntitySpatialConfig/properties/description",
+        "key_path": "datasets[].entities[].spatial.description",
         "path_kind": "property"
       },
-      "purpose": "eSignet authorize endpoint.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140280,7 +82470,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140290,66 +82480,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_id",
-        "key_path": "oid4vci.pre_authorized_code.esignet.client_id",
+        "schema": "relay",
+        "pointer": "/$defs/EntitySpatialConfig/properties/geometry",
+        "key_path": "datasets[].entities[].spatial.geometry",
         "path_kind": "property"
       },
-      "purpose": "Confidential client id the Notary presents to eSignet.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/SpatialGeometryConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140359,7 +82549,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140369,66 +82559,83 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "kind",
+              "field",
+              "crs"
+            ],
+            [
+              "kind",
+              "longitude_field",
+              "latitude_field",
+              "crs"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/SpatialGeometryConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_signing_key_id",
-        "key_path": "oid4vci.pre_authorized_code.esignet.client_signing_key_id",
+        "schema": "relay",
+        "pointer": "/$defs/EntitySpatialConfig/properties/max_bbox_degrees",
+        "key_path": "datasets[].entities[].spatial.max_bbox_degrees",
         "path_kind": "property"
       },
-      "purpose": "`evidence.signing_keys` entry used to sign the eSignet\n`private_key_jwt` client assertion.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "number"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140438,7 +82645,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140448,66 +82655,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "double"
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "number"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/issuer",
-        "key_path": "oid4vci.pre_authorized_code.esignet.issuer",
+        "schema": "relay",
+        "pointer": "/$defs/EntitySpatialConfig/properties/max_geometry_vertices",
+        "key_path": "datasets[].entities[].spatial.max_geometry_vertices",
         "path_kind": "property"
       },
-      "purpose": "eSignet OIDC issuer, pinned when validating the returned `id_token`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140517,7 +82725,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140527,56 +82735,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/jwks_uri",
-        "key_path": "oid4vci.pre_authorized_code.esignet.jwks_uri",
+        "schema": "relay",
+        "pointer": "/$defs/EntitySpatialConfig/properties/title",
+        "key_path": "datasets[].entities[].spatial.title",
         "path_kind": "property"
       },
-      "purpose": "eSignet JWKS URI, used to resolve the `id_token` signing key by `kid`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
@@ -140586,7 +82804,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140596,7 +82814,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140606,18 +82824,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -140628,32 +82846,36 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/login_state_ttl_seconds",
-        "key_path": "oid4vci.pre_authorized_code.esignet.login_state_ttl_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig/properties/codelist",
+        "key_path": "datasets[].tables[].schema.fields[].codelist",
         "path_kind": "property"
       },
-      "purpose": "Lifetime of the short-lived login state (PKCE verifier + nonce +\nselection) reserved between `offer/start` and `offer/callback`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -140662,7 +82884,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140672,7 +82894,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140682,18 +82904,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -140702,41 +82924,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/redirect_uri",
-        "key_path": "oid4vci.pre_authorized_code.esignet.redirect_uri",
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig/properties/concept_uri",
+        "key_path": "datasets[].tables[].schema.fields[].concept_uri",
         "path_kind": "property"
       },
-      "purpose": "Notary callback the citizen browser is redirected back to.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
@@ -140746,7 +82964,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140756,7 +82974,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140766,18 +82984,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -140788,32 +83006,36 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes",
-        "key_path": "oid4vci.pre_authorized_code.esignet.scopes",
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig/properties/language",
+        "key_path": "datasets[].tables[].schema.fields[].language",
         "path_kind": "property"
       },
-      "purpose": "OAuth scopes requested at eSignet.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -140822,7 +83044,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140832,7 +83054,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140842,18 +83064,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -140864,40 +83086,43 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes/items",
-        "key_path": "oid4vci.pre_authorized_code.esignet.scopes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig/properties/name",
+        "key_path": "datasets[].tables[].schema.fields[].name",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140907,7 +83132,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140917,18 +83142,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -140945,35 +83170,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/token_url",
-        "key_path": "oid4vci.pre_authorized_code.esignet.token_url",
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig/properties/nullable",
+        "key_path": "datasets[].tables[].schema.fields[].nullable",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140983,7 +83208,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140993,66 +83218,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/userinfo_url",
-        "key_path": "oid4vci.pre_authorized_code.esignet.userinfo_url",
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig/properties/sensitive",
+        "key_path": "datasets[].tables[].schema.fields[].sensitive",
         "path_kind": "property"
       },
-      "purpose": "eSignet userinfo endpoint. Required when the subject-binding claim is\nsourced from userinfo rather than the `id_token`; the callback fetches\nthe userinfo JWS with the eSignet access token and reads the binding\nclaim from it.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141062,7 +83284,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141072,67 +83294,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/locale",
-        "key_path": "oid4vci.display[].locale",
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig/properties/type",
+        "key_path": "datasets[].tables[].schema.fields[].type",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Physical type of a column. The set is fixed in V1; semantic types\nare carried via `concept_uri`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/FieldType",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141142,7 +83360,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141152,18 +83370,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141173,46 +83391,58 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
             "string",
-            "null"
+            "number",
+            "integer",
+            "boolean",
+            "date",
+            "timestamp"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FieldType"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/logo",
-        "key_path": "oid4vci.display[].logo",
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig/properties/unit",
+        "key_path": "datasets[].tables[].schema.fields[].unit",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141222,7 +83452,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141232,18 +83462,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141255,42 +83485,43 @@
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/name",
-        "key_path": "oid4vci.display[].name",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance",
+        "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141300,7 +83531,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141310,18 +83541,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141332,41 +83563,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciNonceConfig/properties/enabled",
-        "key_path": "oid4vci.nonce.enabled",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance/items",
+        "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141376,7 +83606,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141386,18 +83616,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141408,31 +83638,32 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciNonceConfig/properties/ttl_seconds",
-        "key_path": "oid4vci.nonce.ttl_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/max_source_age_seconds",
+        "key_path": "datasets[].entities[].api.governed_policy.max_source_age_seconds",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -141442,7 +83673,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141452,7 +83683,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141462,18 +83693,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141486,38 +83717,46 @@
           "keyword": "format",
           "value": "uint64"
         },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
         {
           "keyword": "minimum",
           "value": 0
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/enabled",
-        "key_path": "oid4vci.pre_authorized_code.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/minimum_assurance",
+        "key_path": "datasets[].entities[].api.governed_policy.minimum_assurance",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -141526,7 +83765,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141536,7 +83775,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141546,18 +83785,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141568,28 +83807,30 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/esignet",
-        "key_path": "oid4vci.pre_authorized_code.esignet",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions",
+        "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/Oid4vciEsignetRpConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -141603,7 +83844,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141613,7 +83854,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141623,18 +83864,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141645,45 +83886,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/pre_authorized_code_ttl_seconds",
-        "key_path": "oid4vci.pre_authorized_code.pre_authorized_code_ttl_seconds",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions/items",
+        "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Pre-authorized-code lifetime in seconds.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141693,7 +83929,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141703,18 +83939,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141723,38 +83959,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/tx_code",
-        "key_path": "oid4vci.pre_authorized_code.tx_code",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes",
+        "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes",
         "path_kind": "property"
       },
-      "purpose": "`tx_code` (PIN) policy for the pre-authorized-code grant. A `tx_code` is\nrequired by default because a code without a PIN is a bearer credential.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/Oid4vciTxCodeConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -141768,7 +83995,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141778,7 +84005,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141788,18 +84015,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141810,45 +84037,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciTxCodeConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciProofConfig/properties/max_age_seconds",
-        "key_path": "oid4vci.proof.max_age_seconds",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes/items",
+        "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141858,7 +84080,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141868,18 +84090,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141888,36 +84110,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciProofConfig/properties/max_clock_skew_seconds",
-        "key_path": "oid4vci.proof.max_clock_skew_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields",
+        "key_path": "datasets[].entities[].api.governed_policy.redaction_fields",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -141932,7 +84146,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141942,7 +84156,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141952,18 +84166,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141972,51 +84186,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciRepresentativeIssuanceConfig/properties/ceremony",
-        "key_path": "oid4vci.credential_configurations.*.representative_issuance.ceremony",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields/items",
+        "key_path": "datasets[].entities[].api.governed_policy.redaction_fields[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/Oid4vciRepresentativeIssuanceCeremony",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142026,7 +84231,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142036,75 +84241,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "digitally_authenticated_representative"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciRepresentativeIssuanceCeremony"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciRepresentativeIssuanceConfig/properties/relationship",
-        "key_path": "oid4vci.credential_configurations.*.representative_issuance.relationship",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/require_consent",
+        "key_path": "datasets[].entities[].api.governed_policy.require_consent",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142114,7 +84307,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142124,57 +84317,54 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/input_mode",
-        "key_path": "oid4vci.pre_authorized_code.tx_code.input_mode",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/require_legal_basis",
+        "key_path": "datasets[].entities[].api.governed_policy.require_legal_basis",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -142183,7 +84373,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142193,7 +84383,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142203,18 +84393,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -142225,41 +84415,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/length",
-        "key_path": "oid4vci.pre_authorized_code.tx_code.length",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/trusted_context",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/GovernedTrustedContextConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142269,7 +84460,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142279,18 +84470,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -142299,42 +84490,39 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/GovernedTrustedContextConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/required",
-        "key_path": "oid4vci.pre_authorized_code.tx_code.required",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/asserted_assurance",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.asserted_assurance",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -142343,7 +84531,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142353,7 +84541,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142363,18 +84551,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -142385,23 +84573,26 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/authentication_level_of_assurance",
-        "key_path": "evidence.claims[].oots.authentication_level_of_assurance",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/consent_ref",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.consent_ref",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -142420,7 +84611,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142430,7 +84621,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142440,18 +84631,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -142471,26 +84662,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/enabled",
-        "key_path": "evidence.claims[].oots.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/jurisdiction",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.jurisdiction",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -142499,7 +84691,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142509,7 +84701,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142519,18 +84711,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -142541,23 +84733,26 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/evidence_type_classification",
-        "key_path": "evidence.claims[].oots.evidence_type_classification",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/legal_basis_ref",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.legal_basis_ref",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -142576,7 +84771,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142586,7 +84781,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142596,18 +84791,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -142627,27 +84822,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/evidence_type_list",
-        "key_path": "evidence.claims[].oots.evidence_type_list",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/source_observed_age_seconds",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.source_observed_age_seconds",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -142656,7 +84851,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142666,7 +84861,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142676,18 +84871,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -142696,10 +84891,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
+            "integer",
             "null"
           ]
         }
@@ -142707,35 +84914,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/languages",
-        "key_path": "evidence.claims[].oots.languages",
+        "schema": "relay",
+        "pointer": "/$defs/InstanceConfig/properties/environment",
+        "key_path": "instance.environment",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_instance_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142745,72 +84953,76 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/languages/items",
-        "key_path": "evidence.claims[].oots.languages[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/InstanceConfig/properties/id",
+        "key_path": "instance.id",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_instance_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142820,34 +85032,34 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -142858,17 +85070,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/reference_framework",
-        "key_path": "evidence.claims[].oots.reference_framework",
+        "schema": "relay",
+        "pointer": "/$defs/InstanceConfig/properties/jurisdiction",
+        "key_path": "instance.jurisdiction",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_instance_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "null",
@@ -142884,10 +85096,10 @@
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142897,34 +85109,34 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -142938,17 +85150,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/requirement",
-        "key_path": "evidence.claims[].oots.requirement",
+        "schema": "relay",
+        "pointer": "/$defs/InstanceConfig/properties/owner",
+        "key_path": "instance.owner",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_instance_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "null",
@@ -142964,10 +85176,10 @@
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142977,34 +85189,34 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -143018,35 +85230,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OperationConfig/properties/enabled",
-        "key_path": "evidence.claims[].operations.evaluate.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/MetadataConfig/properties/ecosystem_binding",
+        "key_path": "metadata.ecosystem_binding",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_metadata_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143056,7 +85269,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143066,64 +85279,71 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/bind",
-        "key_path": "server.admin_listener.bind",
+        "schema": "relay",
+        "pointer": "/$defs/MetadataConfig/properties/source",
+        "key_path": "metadata.source",
         "path_kind": "property"
       },
-      "purpose": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_metadata_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/SocketAddr",
+        "local_reference": "#/$defs/MetadataSourceConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143133,7 +85353,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143143,68 +85363,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "path"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SocketAddr"
+        "schema": "relay",
+        "pointer": "/$defs/MetadataSourceConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/mode",
-        "key_path": "server.admin_listener.mode",
+        "schema": "relay",
+        "pointer": "/$defs/MetadataSourceConfig/properties/digest",
+        "key_path": "metadata.source.digest",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_metadata_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/RegistryNotaryAdminListenerMode",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143214,7 +85439,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143224,75 +85449,64 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
           "value": [
-            "shared_with_public",
-            "dedicated",
-            "disabled"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryAdminListenerMode"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/allow_regex",
-        "key_path": "cel.allow_regex",
+        "schema": "relay",
+        "pointer": "/$defs/MetadataSourceConfig/properties/path",
+        "key_path": "metadata.source.path",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_metadata_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143302,7 +85516,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143312,47 +85526,50 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/eval_timeout_ms",
-        "key_path": "cel.eval_timeout_ms",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/allow_dev_insecure_fetch_urls",
+        "key_path": "auth.oidc.allow_dev_insecure_fetch_urls",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Development-only escape hatch that permits loopback HTTP issuer,\ndiscovery, and JWKS URLs. Private non-loopback networks and cloud\nmetadata endpoints remain denied by the platform fetch policy.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -143363,11 +85580,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143377,7 +85594,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143387,55 +85604,51 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_binding_json_bytes",
-        "key_path": "cel.max_binding_json_bytes",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/allowed_algorithms",
+        "key_path": "auth.oidc.allowed_algorithms",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Signature algorithms accepted by the verifier. Defaults to\nRS256, ES256, EdDSA. HS\\* and `none` are intentionally absent\nfrom [`OidcAlgorithm`].",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -143443,14 +85656,14 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143460,7 +85673,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143470,70 +85683,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_expression_bytes",
-        "key_path": "cel.max_expression_bytes",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/allowed_algorithms/items",
+        "key_path": "auth.oidc.allowed_algorithms[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "JWS signature algorithms accepted by the OIDC verifier. Symmetric\nalgorithms (`HS*`) and `none` are intentionally absent: shared-secret\nJWTs are unsafe between a resource server and an IdP, and `none`\ndisables verification entirely.\n\nYAML values are the canonical JWA `alg` strings (`RS256`, `ES256`,\n`EdDSA`), case-sensitive.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/OidcAlgorithm",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143543,7 +85749,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143553,55 +85759,60 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "enum",
+          "value": [
+            "RS256",
+            "ES256",
+            "EdDSA"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/OidcAlgorithm"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_list_items",
-        "key_path": "cel.max_list_items",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/allowed_clients",
+        "key_path": "auth.oidc.allowed_clients",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional allowlist of client identifiers, matched against the\ntoken's `azp` (preferred) or `client_id` claim. Empty list\nmeans any client is accepted.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -143616,7 +85827,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143626,7 +85837,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143636,70 +85847,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_depth",
-        "key_path": "cel.max_object_depth",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/allowed_clients/items",
+        "key_path": "auth.oidc.allowed_clients[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143709,7 +85912,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143719,55 +85922,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_keys",
-        "key_path": "cel.max_object_keys",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/allowed_token_types",
+        "key_path": "auth.oidc.allowed_token_types",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Accepted `typ` JOSE header values. Defaults to `JWT` and\n`at+jwt` (RFC 9068). ID tokens (`id+jwt`) are not access tokens\nand are rejected by default. Tokens without `typ` are rejected by\nthe shared verifier.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -143778,11 +85974,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143792,7 +85988,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143802,70 +85998,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_result_json_bytes",
-        "key_path": "cel.max_result_json_bytes",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/allowed_token_types/items",
+        "key_path": "auth.oidc.allowed_token_types[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143875,7 +86066,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143885,70 +86076,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_string_bytes",
-        "key_path": "cel.max_string_bytes",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/audiences",
+        "key_path": "auth.oidc.audiences",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One or more accepted `aud` values. Tokens with no `aud`, or\nwhose `aud` does not intersect this list, are rejected.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143958,7 +86144,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143968,70 +86154,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/mode",
-        "key_path": "cel.mode",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/audiences/items",
+        "key_path": "auth.oidc.audiences[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144041,7 +86222,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144051,23 +86232,27 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -144078,35 +86263,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_count",
-        "key_path": "cel.worker_count",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/development_jwks_file",
+        "key_path": "auth.oidc.development_jwks_file",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Development-only public JWKS file loaded once into memory at startup.\nThis source is accepted only when `deployment.profile` is `local` and\nis mutually exclusive with `jwks_url` and `discovery_url`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144116,7 +86302,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144126,70 +86312,70 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_memory_bytes",
-        "key_path": "cel.worker_memory_bytes",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/discovery_url",
+        "key_path": "auth.oidc.discovery_url",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "OIDC discovery document URL\n(`.well-known/openid-configuration`). The JWKS URL is resolved\nfrom `jwks_uri` in the discovered document.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144199,7 +86385,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144209,70 +86395,68 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_stderr_bytes",
-        "key_path": "cel.worker_stderr_bytes",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/issuer",
+        "key_path": "auth.oidc.issuer",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Issuer URL. Compared verbatim against the JWT `iss` claim.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144282,7 +86466,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144292,70 +86476,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins",
-        "key_path": "server.cors.allowed_origins",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/jwks_cache_ttl",
+        "key_path": "auth.oidc.jwks_cache_ttl",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144365,7 +86546,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144375,65 +86556,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins/items",
-        "key_path": "server.cors.allowed_origins[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/jwks_url",
+        "key_path": "auth.oidc.jwks_url",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "JWKS endpoint. Exactly one JWKS source must be configured.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144443,7 +86635,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144453,18 +86645,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -144478,42 +86670,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/admin_listener",
-        "key_path": "server.admin_listener",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/leeway",
+        "key_path": "auth.oidc.leeway",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RegistryNotaryAdminListenerConfig",
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144523,7 +86718,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144533,18 +86728,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -144553,34 +86748,41 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryAdminListenerConfig"
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/bind",
-        "key_path": "server.bind",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/scope_claim",
+        "key_path": "auth.oidc.scope_claim",
         "path_kind": "property"
       },
-      "purpose": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.",
+      "purpose": "JWT claim whose value carries scopes. Defaults to `scope`, the\nRFC 8693 / RFC 9068 space-separated form. Some IdPs use `scp`\nor `permissions`; the value may be a string, an array of strings,\nor an object keyed by scope name.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/SocketAddr",
         "composed": false
       },
       "requiredness": "optional",
@@ -144594,7 +86796,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144604,7 +86806,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144614,18 +86816,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -144638,30 +86840,25 @@
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SocketAddr"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/cors",
-        "key_path": "server.cors",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/scope_map",
+        "key_path": "auth.oidc.scope_map",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional rename map: `external_scope -> internal_scope`. Applied\nafter parsing the scope claim, before scope-based access checks\nrun. Useful for adapting IdP role names (`role:foo`) to the\nrelay's `<dataset_id>:<level>` shape.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/RegistryNotaryCorsConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -144675,7 +86872,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144685,7 +86882,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144695,18 +86892,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -144719,44 +86916,38 @@
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCorsConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/http1_header_read_timeout",
-        "key_path": "server.http1_header_read_timeout",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/scope_map/additionalProperties",
+        "key_path": "auth.oidc.scope_map.*",
+        "path_kind": "map_value"
       },
-      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Each reviewed key is an external token scope and each value is the bounded Relay scope mapping granted for that exact token scope.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_oidc_scope_map_open_map",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144766,7 +86957,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144776,52 +86967,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/max_connections",
-        "key_path": "server.max_connections",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys",
+        "key_path": "auth.oidc.scope_object_required_keys",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Keys that must be present inside object-valued role claim values\nbefore the role key is treated as an active scope. Object-valued\nclaims grant no scopes when this list is empty.\nThis is useful for IdPs such as Zitadel where role values are\nkeyed by organization id.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -144832,11 +87019,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144846,7 +87033,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144856,71 +87043,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/openapi_requires_auth",
-        "key_path": "server.openapi_requires_auth",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys/items",
+        "key_path": "auth.oidc.scope_object_required_keys[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144930,7 +87111,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144940,64 +87121,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_body_timeout",
-        "key_path": "server.request_body_timeout",
+        "schema": "relay",
+        "pointer": "/$defs/PostgresTableConfig/properties/name",
+        "key_path": "datasets[].tables[].source.table.name",
         "path_kind": "property"
       },
-      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145007,7 +87189,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145017,18 +87199,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145041,44 +87223,38 @@
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_timeout",
-        "key_path": "server.request_timeout",
+        "schema": "relay",
+        "pointer": "/$defs/PostgresTableConfig/properties/schema",
+        "key_path": "datasets[].tables[].source.table.schema",
         "path_kind": "property"
       },
-      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145088,7 +87264,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145098,18 +87274,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145122,43 +87298,40 @@
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips",
-        "key_path": "server.trusted_proxy_ips",
+        "schema": "relay",
+        "pointer": "/$defs/PublicServiceConfig/properties/description",
+        "key_path": "datasets[].public_services[].description",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145168,7 +87341,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145178,18 +87351,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145200,40 +87373,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips/items",
-        "key_path": "server.trusted_proxy_ips[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/PublicServiceConfig/properties/id",
+        "key_path": "datasets[].public_services[].id",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145243,7 +87421,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145253,18 +87431,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145273,47 +87451,45 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "ip"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/allow_insecure_localhost",
-        "key_path": "evidence.relay.allow_insecure_localhost",
+        "schema": "relay",
+        "pointer": "/$defs/PublicServiceConfig/properties/title",
+        "key_path": "datasets[].public_services[].title",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145323,7 +87499,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145333,18 +87509,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145355,32 +87531,33 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/allow_insecure_private_network",
-        "key_path": "evidence.relay.allow_insecure_private_network",
+        "schema": "relay",
+        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval",
+        "key_path": "datasets[].defaults.refresh.interval",
         "path_kind": "property"
       },
-      "purpose": "Permit this signed Notary-to-Relay service hop to use application HTTP.\nRuntime resolution remains confined to eligible private addresses.",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "conditional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -145389,7 +87566,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145399,7 +87576,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145409,18 +87586,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145429,34 +87606,47 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs",
-        "key_path": "evidence.relay.allowed_private_cidrs",
+        "schema": "relay",
+        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval",
+        "key_path": "datasets[].tables[].refresh.interval",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "conditional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -145465,7 +87655,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145475,7 +87665,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145485,18 +87675,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145505,43 +87695,54 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs/items",
-        "key_path": "evidence.relay.allowed_private_cidrs[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].defaults.refresh.mode",
+        "path_kind": "property"
       },
-      "purpose": "An IP network CIDR string. The runtime parser remains authoritative for address and prefix validity.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/IpNet",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145551,7 +87752,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145561,18 +87762,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145581,29 +87782,33 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "interval",
+            "manual",
+            "mtime"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/IpNet"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/base_url",
-        "key_path": "evidence.relay.base_url",
+        "schema": "relay",
+        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].tables[].refresh.mode",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -145612,15 +87817,15 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145630,7 +87835,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145640,29 +87845,34 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "interval",
+            "manual",
+            "mtime"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -145671,35 +87881,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/max_in_flight",
-        "key_path": "evidence.relay.max_in_flight",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/expression",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145709,7 +87920,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145719,18 +87930,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145740,32 +87951,33 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "required",
+          "value": [
+            "cel"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/root_certificate_path",
-        "key_path": "evidence.relay.root_certificate_path",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/format",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].format",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional value format hint.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -145780,11 +87992,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145794,7 +88006,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145804,26 +88016,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -145838,34 +88047,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/token_file",
-        "key_path": "evidence.relay.token_file",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/locale",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].locale",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145875,7 +88086,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145885,47 +88096,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/workload_client_id",
-        "key_path": "evidence.relay.workload_client_id",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/name",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].name",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Released claim name (lower-snake).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -145938,11 +88150,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145952,7 +88164,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145962,26 +88174,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -145993,34 +88202,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/inputs",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/required",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].required",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Whether the claim must be present; a missing required claim denies.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146030,7 +88240,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146040,18 +88250,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -146062,41 +88272,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/inputs/additionalProperties",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/sensitivity",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].sensitivity",
+        "path_kind": "property"
       },
-      "purpose": "A supported consultation input path. The runtime parser remains authoritative for exact stable-name bounds.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_inputs_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/RelayConsultationInput",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146106,7 +88317,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146116,62 +88327,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "enum",
+          "value": [
+            "direct_identifier",
+            "personal",
+            "public",
+            "pseudonymous"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "string"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationInput"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/outputs",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/source_field",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].source_field",
         "path_kind": "property"
       },
-      "purpose": "Complete closed public output schema expected from the pinned profile.",
+      "purpose": "Source field projected into the claim. XOR with `expression`.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -146180,7 +88396,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146190,7 +88406,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146200,18 +88416,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -146222,41 +88438,44 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/outputs/additionalProperties",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseConditionsConfig/properties/expression",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a consultation output and each value defines its bounded evidence-result interpretation.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_outputs_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "A single CEL expression evaluated over the subject's source projection.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/RelayOutputContract",
+        "local_reference": "#/$defs/ReleaseExpressionConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146266,7 +88485,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146276,52 +88495,30 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            [
-              "type",
-              "max_bytes",
-              "fields"
-            ],
-            [
-              "type",
-              "max_bytes",
-              "max_items",
-              "items"
-            ],
-            [
-              "type",
-              "max_bytes"
-            ],
-            [
-              "type",
-              "minimum",
-              "maximum"
-            ],
-            [
-              "type"
-            ]
+            "cel"
           ]
         },
         {
@@ -146330,33 +88527,32 @@
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract"
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseExpressionConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/profile",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseExpressionConfig/properties/cel",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression.cel",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RelayConsultationProfileRef",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -146364,7 +88560,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146374,7 +88570,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146384,18 +88580,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -146404,36 +88600,25 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "contract_hash"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationProfileRef"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationProfileRef/properties/contract_hash",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.contract_hash",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseExpressionConfig/properties/cel",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression.cel",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -146446,11 +88631,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146460,7 +88645,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146470,26 +88655,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -146501,34 +88683,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationProfileRef/properties/id",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.id",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseResponseConfig/properties/include_source_metadata",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].response.include_source_metadata",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Whether to include profile-sourced metadata in the response body.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146538,7 +88721,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146548,18 +88731,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -146570,41 +88753,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/nullable",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.nullable",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseSubjectConfig/properties/id_type",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].subject.id_type",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Accepted identifier type label.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146614,7 +88796,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146624,45 +88806,47 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/type",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.type",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseSubjectConfig/properties/source_field",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].subject.source_field",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Source field used to match the subject. Must be an exposed entity field.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -146671,15 +88855,15 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146689,7 +88873,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146699,37 +88883,28 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "array",
-            "boolean",
-            "date",
-            "integer",
-            "object",
-            "string"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -146738,26 +88913,26 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/maximum",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.maximum",
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
+        "key_path": "datasets[].aggregates[].required_filter_bindings[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -146765,7 +88940,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146775,7 +88950,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146785,18 +88960,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -146805,38 +88980,34 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "int64"
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/minimum",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.minimum",
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
+        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -146844,7 +89015,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146854,7 +89025,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146864,18 +89035,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -146884,38 +89055,34 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "int64"
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/2/properties/max_bytes",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.max_bytes",
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
+        "key_path": "datasets[].entities[].api.required_filter_bindings[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -146923,7 +89090,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146933,7 +89100,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146943,18 +89110,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -146963,42 +89130,34 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/4/properties/fields",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields",
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
+        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -147006,7 +89165,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147016,7 +89175,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147026,18 +89185,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147048,41 +89207,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/4/properties/fields/additionalProperties",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
+        "key_path": "datasets[].aggregates[].required_filter_bindings[].source",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a closed structured output field and each value defines its requiredness and bounded recursive schema.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_output_fields_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RelayOutputObjectFieldContract",
+        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147092,7 +89252,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147102,74 +89262,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "required",
-            "schema"
+            "principal_id"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputObjectFieldContract"
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingSource"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/5/properties/items",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.items",
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
+        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].source",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RelayOutputContract",
+        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147179,7 +89339,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147189,18 +89349,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147210,73 +89370,53 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            [
-              "type",
-              "max_bytes",
-              "fields"
-            ],
-            [
-              "type",
-              "max_bytes",
-              "max_items",
-              "items"
-            ],
-            [
-              "type",
-              "max_bytes"
-            ],
-            [
-              "type",
-              "minimum",
-              "maximum"
-            ],
-            [
-              "type"
-            ]
+            "principal_id"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract"
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingSource"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/5/properties/max_items",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.max_items",
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
+        "key_path": "datasets[].entities[].api.required_filter_bindings[].source",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147286,7 +89426,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147296,18 +89436,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147317,53 +89457,53 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint16"
-        },
-        {
-          "keyword": "maximum",
-          "value": 65535
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "enum",
+          "value": [
+            "principal_id"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingSource"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputObjectFieldContract/properties/required",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*.required",
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
+        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].source",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147373,7 +89513,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147383,18 +89523,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147403,35 +89543,44 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "principal_id"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingSource"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputObjectFieldContract/properties/schema",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*.schema",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].tables[].access.aggregate_scope",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RelayOutputContract",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -147439,7 +89588,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147449,7 +89598,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147459,18 +89608,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147479,57 +89628,25 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "type",
-              "max_bytes",
-              "fields"
-            ],
-            [
-              "type",
-              "max_bytes",
-              "max_items",
-              "items"
-            ],
-            [
-              "type",
-              "max_bytes"
-            ],
-            [
-              "type",
-              "minimum",
-              "maximum"
-            ],
-            [
-              "type"
-            ]
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RequestVariableConfig/properties/from",
-        "key_path": "evidence.variables.*.from",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].tables[].access.metadata_scope",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -147546,7 +89663,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147556,7 +89673,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147566,18 +89683,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147594,35 +89711,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RequestVariableConfig/properties/type",
-        "key_path": "evidence.variables.*.type",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters",
+        "key_path": "datasets[].tables[].api.allowed_filters",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/RequestVariableType",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147632,7 +89749,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147642,18 +89759,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147662,52 +89779,43 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "date"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RequestVariableType"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RuleConfig/oneOf/0/properties/consultation",
-        "key_path": "evidence.claims[].rule.consultation",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].tables[].api.allowed_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147717,7 +89825,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147727,18 +89835,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147747,34 +89855,45 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field",
+            "ops"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RuleConfig/oneOf/0/properties/output",
-        "key_path": "evidence.claims[].rule.output",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceApiConfig/properties/default_limit",
+        "key_path": "datasets[].tables[].api.default_limit",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -147782,7 +89901,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147792,7 +89911,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147802,18 +89921,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147822,34 +89941,46 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RuleConfig/oneOf/0/properties/type",
-        "key_path": "evidence.claims[].rule.type",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceApiConfig/properties/max_limit",
+        "key_path": "datasets[].tables[].api.max_limit",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -147857,7 +89988,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147867,7 +89998,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147877,18 +90008,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147898,49 +90029,54 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": [
-            "cel",
-            "consultation_matched",
-            "consultation_output"
-          ]
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RuleConfig/oneOf/2/properties/expression",
-        "key_path": "evidence.claims[].rule.expression",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceApiConfig/properties/require_purpose_header",
+        "key_path": "datasets[].tables[].api.require_purpose_header",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147950,7 +90086,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147960,18 +90096,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147982,40 +90118,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/consultations",
-        "key_path": "evidence.claims[].evidence_mode.consultations",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/access",
+        "key_path": "datasets[].tables[].access",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Resource-level scope assignments. Private tables are not exposed as row\nresources in beta; row access is configured on public entities.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/ResourceAccessConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148025,7 +90163,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148035,18 +90173,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -148055,43 +90193,54 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "metadata_scope",
+            "aggregate_scope"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceAccessConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/consultations/additionalProperties",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/aggregates",
+        "key_path": "datasets[].tables[].aggregates",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a Relay consultation and each value defines the bounded consultation contract used to support this evidence claim.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/RelayConsultationConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148101,7 +90250,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148111,73 +90260,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "profile",
-            "inputs"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/type",
-        "key_path": "evidence.claims[].evidence_mode.type",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/aggregates/items",
+        "key_path": "datasets[].tables[].aggregates[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148187,7 +90326,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148197,18 +90336,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -148218,45 +90357,55 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "registry_backed"
+          "keyword": "required",
+          "value": [
+            "id",
+            "description",
+            "disclosure_control"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/alg",
-        "key_path": "evidence.signing_keys.*.alg",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/api",
+        "key_path": "datasets[].tables[].api",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Resource-level API knobs: per-field filter allowlist, limit caps,\nand the `Data-Purpose` requirement.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ResourceApiConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148266,7 +90415,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148276,66 +90425,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "default_limit",
+            "max_limit"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceApiConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/key_id_hex",
-        "key_path": "evidence.signing_keys.*.key_id_hex",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/id",
+        "key_path": "datasets[].tables[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Resource identifier within a dataset.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ResourceId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148345,7 +90502,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148355,66 +90512,72 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceId"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/key_label",
-        "key_path": "evidence.signing_keys.*.key_label",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/materialization",
+        "key_path": "datasets[].tables[].materialization",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "How a configured private table is registered for query planning.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148424,7 +90587,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148434,65 +90597,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "snapshot"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/kid",
-        "key_path": "evidence.signing_keys.*.kid",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/primary_key",
+        "key_path": "datasets[].tables[].primary_key",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148502,7 +90673,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148512,18 +90683,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -148531,47 +90702,50 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/module_path",
-        "key_path": "evidence.signing_keys.*.module_path",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/refresh",
+        "key_path": "datasets[].tables[].refresh",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148581,7 +90755,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148591,66 +90765,78 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "mode",
+              "interval"
+            ],
+            [
+              "mode"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/password_env",
-        "key_path": "evidence.signing_keys.*.password_env",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/schema",
+        "key_path": "datasets[].tables[].schema",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Declared resource schema. `strict` is the spec's `strict_schema`\nflag; on mismatch ingestion refuses to register the resource.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/SchemaConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148660,7 +90846,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148670,65 +90856,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "fields"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/SchemaConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/path",
-        "key_path": "evidence.signing_keys.*.path",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/source",
+        "key_path": "datasets[].tables[].source",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Source plugin selection. Tagged on `type:` so HTTP, S3, or additional\ndatabase variants can land additively later.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/SourceConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148738,7 +90932,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148748,65 +90942,81 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "type",
+              "connection_env"
+            ],
+            [
+              "type",
+              "path"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/pin_env",
-        "key_path": "evidence.signing_keys.*.pin_env",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceFormatConfig/properties/csv",
+        "key_path": "datasets[].tables[].source.format.csv",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148816,7 +91026,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148826,65 +91036,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/private_jwk_env",
-        "key_path": "evidence.signing_keys.*.private_jwk_env",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceFormatConfig/properties/parquet",
+        "key_path": "datasets[].tables[].source.format.parquet",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148894,7 +91106,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148904,65 +91116,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/provider",
-        "key_path": "evidence.signing_keys.*.provider",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceFormatConfig/properties/xlsx",
+        "key_path": "datasets[].tables[].source.format.xlsx",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "local_reference": "#/$defs/SigningKeyProviderSchema",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148972,7 +91186,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148982,81 +91196,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
           "value": [
-            "local_jwk_env",
-            "file_watch",
-            "pkcs11",
-            "local_pkcs12_file",
-            "kms",
-            "workload_identity"
+            "null",
+            "object"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyProviderSchema"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/public_jwk_env",
-        "key_path": "evidence.signing_keys.*.public_jwk_env",
+        "schema": "relay",
+        "pointer": "/$defs/RotateConfig/properties/max_files",
+        "key_path": "audit.rotate.max_files",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149066,7 +91264,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149076,67 +91274,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/publish_until_unix_seconds",
-        "key_path": "evidence.signing_keys.*.publish_until_unix_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/RotateConfig/properties/max_size_mb",
+        "key_path": "audit.rotate.max_size_mb",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149146,7 +91350,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149156,77 +91360,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "format",
           "value": "uint64"
         },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
         {
           "keyword": "minimum",
           "value": 0
         },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/status",
-        "key_path": "evidence.signing_keys.*.status",
+        "schema": "relay",
+        "pointer": "/$defs/SchemaConfig/properties/fields",
+        "key_path": "datasets[].tables[].schema.fields",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/SigningKeyStatusSchema",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149236,7 +91436,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149246,78 +91446,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "active",
-            "publish_only",
-            "disabled"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyStatusSchema"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/token_label",
-        "key_path": "evidence.signing_keys.*.token_label",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/SchemaConfig/properties/fields/items",
+        "key_path": "datasets[].tables[].schema.fields[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One column in a resource schema. Physical type and optional\nsemantic annotations used by catalog and schema metadata.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/FieldConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149327,7 +91512,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149337,67 +91522,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name",
+            "type"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/StateConfig/properties/postgresql",
-        "key_path": "state.postgresql",
+        "schema": "relay",
+        "pointer": "/$defs/SchemaConfig/properties/strict",
+        "key_path": "datasets[].tables[].schema.strict",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
-        "local_reference": "#/$defs/StatePostgresqlConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149407,7 +91599,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149417,66 +91609,64 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/StatePostgresqlConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/StateConfig/properties/storage",
-        "key_path": "state.storage",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/admin_bind",
+        "key_path": "server.admin_bind",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149486,7 +91676,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149496,62 +91686,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": [
+            "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$",
+            "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/StatePostgresqlConfig/properties/connect_timeout_ms",
-        "key_path": "state.postgresql.connect_timeout_ms",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/bind",
+        "key_path": "server.bind",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/SocketAddr",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149561,7 +91765,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149571,18 +91775,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -149591,41 +91795,44 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "pattern",
+          "value": [
+            "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$",
+            "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/SocketAddr"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/StatePostgresqlConfig/properties/max_connections",
-        "key_path": "state.postgresql.max_connections",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/cache_dir",
+        "key_path": "server.cache_dir",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -149634,7 +91841,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149644,7 +91851,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149654,18 +91861,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -149673,51 +91880,44 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/StatePostgresqlConfig/properties/operation_timeout_ms",
-        "key_path": "state.postgresql.operation_timeout_ms",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/cors",
+        "key_path": "server.cors",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "CORS allowlist; default-deny per Section 17 item 7.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/CorsConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149727,7 +91927,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149737,18 +91937,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -149756,52 +91956,48 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/CorsConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/StatePostgresqlConfig/properties/root_certificate_path",
-        "key_path": "state.postgresql.root_certificate_path",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/http1_header_read_timeout",
+        "key_path": "server.http1_header_read_timeout",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149811,7 +92007,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149821,68 +92017,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/StatePostgresqlConfig/properties/sensitive_state_key_env",
-        "key_path": "state.postgresql.sensitive_state_key_env",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/max_connections",
+        "key_path": "server.max_connections",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149892,7 +92094,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149902,65 +92104,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/StatePostgresqlConfig/properties/url_env",
-        "key_path": "state.postgresql.url_env",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/max_source_file_bytes",
+        "key_path": "server.max_source_file_bytes",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149970,7 +92181,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149980,50 +92191,59 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_audiences",
-        "key_path": "subject_access.citizen_clients.allowed_audiences",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/openapi_requires_auth",
+        "key_path": "server.openapi_requires_auth",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Keeps the configured OpenAPI document behind Relay authentication unless an operator explicitly accepts unauthenticated contract discovery.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "boolean"
         ],
         "composed": false
       },
@@ -150034,11 +92254,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150048,7 +92268,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150058,65 +92278,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_audiences/items",
-        "key_path": "subject_access.citizen_clients.allowed_audiences[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/request_body_timeout",
+        "key_path": "server.request_body_timeout",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150126,7 +92344,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150136,66 +92354,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_client_ids",
-        "key_path": "subject_access.citizen_clients.allowed_client_ids",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/request_timeout",
+        "key_path": "server.request_timeout",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150205,7 +92432,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150215,65 +92442,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_client_ids/items",
-        "key_path": "subject_access.citizen_clients.allowed_client_ids[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/trust_proxy",
+        "key_path": "server.trust_proxy",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "`X-Forwarded-For` policy. Until the `ipnet` crate lands in deps we\nkeep CIDR specs as strings and validate format in\n[`validate::run`].",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/TrustProxyConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150283,7 +92520,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150293,51 +92530,51 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/TrustProxyConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_claims",
-        "key_path": "subject_access.allowed_claims",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/xlsx_max_file_bytes",
+        "key_path": "server.xlsx_max_file_bytes",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -150348,11 +92585,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150362,7 +92599,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150372,65 +92609,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_claims/items",
-        "key_path": "subject_access.allowed_claims[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/0/properties/format",
+        "key_path": "datasets[].tables[].source.format",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Storage table format override. If omitted, ingest infers the format\nfrom the source file extension.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150440,7 +92687,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150450,66 +92697,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_disclosures",
-        "key_path": "subject_access.allowed_disclosures",
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/0/properties/path",
+        "key_path": "datasets[].tables[].source.path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150519,7 +92765,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150529,18 +92775,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -150548,46 +92794,45 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_disclosures/items",
-        "key_path": "subject_access.allowed_disclosures[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/0/properties/type",
+        "key_path": "datasets[].tables[].source.type",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150597,7 +92842,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150607,29 +92852,33 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "file",
+            "postgres"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -150638,26 +92887,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_formats",
-        "key_path": "subject_access.allowed_formats",
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/change_token_sql",
+        "key_path": "datasets[].tables[].source.change_token_sql",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -150666,7 +92916,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150676,7 +92926,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150686,18 +92936,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -150705,46 +92955,50 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_formats/items",
-        "key_path": "subject_access.allowed_formats[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/connect_timeout",
+        "key_path": "datasets[].tables[].source.connect_timeout",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150754,7 +93008,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150764,67 +93018,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_operations",
-        "key_path": "subject_access.allowed_operations",
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/connection_env",
+        "key_path": "datasets[].tables[].source.connection_env",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessOperationsConfig",
+        "local_reference": "#/$defs/PostgresEnvironmentNameSchema",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150834,7 +93096,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150844,18 +93106,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -150863,51 +93125,55 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]*$"
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessOperationsConfig"
+        "schema": "relay",
+        "pointer": "/$defs/PostgresEnvironmentNameSchema"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_purposes",
-        "key_path": "subject_access.allowed_purposes",
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/query",
+        "key_path": "datasets[].tables[].source.query",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150917,7 +93183,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150927,65 +93193,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_purposes/items",
-        "key_path": "subject_access.allowed_purposes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/query_timeout",
+        "key_path": "datasets[].tables[].source.query_timeout",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150995,7 +93263,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151005,66 +93273,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_wallet_origins",
-        "key_path": "subject_access.allowed_wallet_origins",
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/table",
+        "key_path": "datasets[].tables[].source.table",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Structured database table reference. Keeping schema/name separate\navoids parsing dotted identifiers and leaves quoting to connectors.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151074,7 +93352,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151084,65 +93362,72 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "schema",
+            "name"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_wallet_origins/items",
-        "key_path": "subject_access.allowed_wallet_origins[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_x",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151152,7 +93437,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151162,26 +93447,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -151193,36 +93475,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/citizen_clients",
-        "key_path": "subject_access.citizen_clients",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_x",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessCitizenClientsConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151232,7 +93512,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151242,70 +93522,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessCitizenClientsConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/credential_profiles",
-        "key_path": "subject_access.credential_profiles",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
+        "key_path": "datasets[].entities[].spatial.bbox_fields.max_x",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151315,7 +93587,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151325,65 +93597,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/credential_profiles/items",
-        "key_path": "subject_access.credential_profiles[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_x",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151393,7 +93662,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151403,26 +93672,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -151434,36 +93700,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/delegation",
-        "key_path": "subject_access.delegation",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_y",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessDelegationConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151473,7 +93737,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151483,70 +93747,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegationConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/enabled",
-        "key_path": "subject_access.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_y",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151556,7 +93812,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151566,67 +93822,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/rate_limits",
-        "key_path": "subject_access.rate_limits",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
+        "key_path": "datasets[].entities[].spatial.bbox_fields.max_y",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessRateLimitsConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151636,7 +93887,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151646,70 +93897,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessRateLimitsConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/required_scopes",
-        "key_path": "subject_access.required_scopes",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_y",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151719,7 +93962,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151729,65 +93972,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/required_scopes/items",
-        "key_path": "subject_access.required_scopes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_x",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151797,7 +94037,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151807,26 +94047,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -151838,36 +94075,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/scope_policy",
-        "key_path": "subject_access.scope_policy",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_x",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessScopePolicy",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151877,7 +94112,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151887,79 +94122,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "required",
-            "optional",
-            "disabled"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessScopePolicy"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/subject_binding",
-        "key_path": "subject_access.subject_binding",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
+        "key_path": "datasets[].entities[].spatial.bbox_fields.min_x",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessSubjectBindingConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151969,7 +94187,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151979,71 +94197,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessSubjectBindingConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/token_policy",
-        "key_path": "subject_access.token_policy",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_x",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessTokenPolicyConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152053,7 +94262,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152063,70 +94272,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_claims",
-        "key_path": "subject_access.delegation.allowed_relationships[].allowed_claims",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_y",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152136,7 +94337,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152146,65 +94347,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_claims/items",
-        "key_path": "subject_access.delegation.allowed_relationships[].allowed_claims[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_y",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152214,7 +94412,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152224,26 +94422,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -152255,35 +94450,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_disclosures",
-        "key_path": "subject_access.delegation.allowed_relationships[].allowed_disclosures",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
+        "key_path": "datasets[].entities[].spatial.bbox_fields.min_y",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152293,7 +94487,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152303,65 +94497,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_disclosures/items",
-        "key_path": "subject_access.delegation.allowed_relationships[].allowed_disclosures[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_y",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152371,7 +94562,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152381,26 +94572,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -152412,35 +94600,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_formats",
-        "key_path": "subject_access.delegation.allowed_relationships[].allowed_formats",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/crs",
+        "key_path": "datasets[].entities[].spatial.geometry.crs",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152450,7 +94637,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152460,65 +94647,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_formats/items",
-        "key_path": "subject_access.delegation.allowed_relationships[].allowed_formats[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/kind",
+        "key_path": "datasets[].entities[].spatial.geometry.kind",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152528,7 +94712,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152538,29 +94722,35 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "geojson",
+            "point",
+            "wkb",
+            "wkt"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -152569,35 +94759,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_purposes",
-        "key_path": "subject_access.delegation.allowed_relationships[].allowed_purposes",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/latitude_field",
+        "key_path": "datasets[].entities[].spatial.geometry.latitude_field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152607,7 +94796,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152617,65 +94806,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_purposes/items",
-        "key_path": "subject_access.delegation.allowed_relationships[].allowed_purposes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/longitude_field",
+        "key_path": "datasets[].entities[].spatial.geometry.longitude_field",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152685,7 +94871,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152695,26 +94881,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -152726,35 +94909,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/max_proof_age_seconds",
-        "key_path": "subject_access.delegation.allowed_relationships[].max_proof_age_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/1/properties/field",
+        "key_path": "datasets[].entities[].spatial.geometry.field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152764,7 +94946,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152774,77 +94956,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 600
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/proof_claim",
-        "key_path": "subject_access.delegation.allowed_relationships[].proof_claim",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/dataset",
+        "key_path": "standards.spdci.disability_registry.dataset",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/DatasetId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152854,7 +95022,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152864,65 +95032,71 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DatasetId"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/relationship_type",
-        "key_path": "subject_access.delegation.allowed_relationships[].relationship_type",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values",
+        "key_path": "standards.spdci.disability_registry.disabled_positive_values",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Case-insensitive values interpreted as disabled.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152932,7 +95106,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152942,67 +95116,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/target_id_type",
-        "key_path": "subject_access.delegation.allowed_relationships[].target_id_type",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values/items",
+        "key_path": "standards.spdci.disability_registry.disabled_positive_values[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153012,7 +95181,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153022,69 +95191,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegationConfig/properties/allowed_relationships",
-        "key_path": "subject_access.delegation.allowed_relationships",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_status_field",
+        "key_path": "standards.spdci.disability_registry.disabled_status_field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Entity field whose value determines the SP DCI disabled response.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153094,7 +95257,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153104,66 +95267,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegationConfig/properties/allowed_relationships/items",
-        "key_path": "subject_access.delegation.allowed_relationships[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/entity",
+        "key_path": "standards.spdci.disability_registry.entity",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessDelegatedRelationshipConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153173,7 +95332,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153183,77 +95342,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship_type",
-            "proof_claim"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegationConfig/properties/enabled",
-        "key_path": "subject_access.delegation.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_field",
+        "key_path": "standards.spdci.disability_registry.query_field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Entity field filtered when the SP DCI query key is present.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153263,7 +95408,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153273,57 +95418,54 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessOperationsConfig/properties/batch_evaluate",
-        "key_path": "subject_access.allowed_operations.batch_evaluate",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_key",
+        "key_path": "standards.spdci.disability_registry.query_key",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Query key accepted from SP DCI `disabled_criteria.query`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -153332,7 +95474,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153342,7 +95484,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153352,18 +95494,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -153371,47 +95513,46 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessOperationsConfig/properties/evaluate",
-        "key_path": "subject_access.allowed_operations.evaluate",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/dataset",
+        "key_path": "standards.spdci.registries.*.dataset",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
+        "local_reference": "#/$defs/DatasetId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153421,7 +95562,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153431,51 +95572,56 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DatasetId"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessOperationsConfig/properties/issue_credential",
-        "key_path": "subject_access.allowed_operations.issue_credential",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/default_limit",
+        "key_path": "standards.spdci.registries.*.default_limit",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer"
         ],
         "composed": false
       },
@@ -153486,11 +95632,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153500,7 +95646,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153510,66 +95656,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessOperationsConfig/properties/render",
-        "key_path": "subject_access.allowed_operations.render",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/entity",
+        "key_path": "standards.spdci.registries.*.entity",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153579,7 +95733,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153589,51 +95743,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/credential_issuance_per_principal_per_hour",
-        "key_path": "subject_access.rate_limits.credential_issuance_per_principal_per_hour",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields",
+        "key_path": "standards.spdci.registries.*.expression_fields",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "DCI expression or predicate attribute to entity field mappings.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
@@ -153644,11 +95795,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153658,7 +95809,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153668,74 +95819,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/invalid_token_per_client_address_per_minute",
-        "key_path": "subject_access.rate_limits.invalid_token_per_client_address_per_minute",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields/additionalProperties",
+        "key_path": "standards.spdci.registries.*.expression_fields.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Each reviewed key names an expression-visible field and each value defines the bounded source expression exposed under that name.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_spdci_registries_expression_fields_open_map",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153745,7 +95884,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153755,59 +95894,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/per_holder_per_hour",
-        "key_path": "subject_access.rate_limits.per_holder_per_hour",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers",
+        "key_path": "standards.spdci.registries.*.identifiers",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "DCI identifier type to entity field mappings for `idtype-value`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
@@ -153818,11 +95946,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153832,7 +95960,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153842,74 +95970,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/per_principal_per_minute",
-        "key_path": "subject_access.rate_limits.per_principal_per_minute",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers/additionalProperties",
+        "key_path": "standards.spdci.registries.*.identifiers.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Each reviewed key names an identifier role and each value defines the exact request identifier binding for that role.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_spdci_registries_identifiers_open_map",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153919,7 +96035,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153929,74 +96045,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/subject_mismatch_per_principal_per_hour",
-        "key_path": "subject_access.rate_limits.subject_mismatch_per_principal_per_hour",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/record_type",
+        "key_path": "standards.spdci.registries.*.record_type",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154006,7 +96111,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154016,74 +96121,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/tx_code_attempts_per_code_per_minute",
-        "key_path": "subject_access.rate_limits.tx_code_attempts_per_code_per_minute",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/registry_type",
+        "key_path": "standards.spdci.registries.*.registry_type",
         "path_kind": "property"
       },
-      "purpose": "Per-minute cap on `tx_code` attempts against a single\n`pre-authorized_code`. Bounds brute force of the numeric PIN at the\npre-authorized-code token endpoint. Defaults to zero so existing\nconfigs that do not enable pre-auth still validate; it must be greater\nthan zero only when the pre-authorized-code flow is enabled.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154093,7 +96187,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154103,59 +96197,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/allow_sub_as_civil_id",
-        "key_path": "subject_access.subject_binding.allow_sub_as_civil_id",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields",
+        "key_path": "standards.spdci.registries.*.response_fields",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "SP DCI output path to entity field mappings for direct response\nprojection. A CEL mapping takes precedence when both are set.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
         "composed": false
       },
@@ -154166,11 +96249,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154180,7 +96263,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154190,67 +96273,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/claim_source",
-        "key_path": "subject_access.subject_binding.claim_source",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields/additionalProperties",
+        "key_path": "standards.spdci.registries.*.response_fields.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Each reviewed key names a response field and each value defines the exact bounded response projection for that field.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_spdci_registries_response_fields_open_map",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessClaimSource",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154260,7 +96338,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154270,67 +96348,54 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "access_token",
-            "userinfo"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessClaimSource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/id_type",
-        "key_path": "subject_access.subject_binding.id_type",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/response_mapping_path",
+        "key_path": "standards.spdci.registries.*.response_mapping_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional local CEL mapping document used to shape response records.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
@@ -154340,7 +96405,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154350,7 +96415,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154360,18 +96425,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -154379,39 +96444,41 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/normalize",
-        "key_path": "subject_access.subject_binding.normalize",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/response_schema_path",
+        "key_path": "standards.spdci.registries.*.response_schema_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional local JSON Schema used to validate shaped response records.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/SubjectBindingNormalize",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -154420,7 +96487,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154430,7 +96497,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154440,18 +96507,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -154459,58 +96526,50 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
           "value": [
-            "exact"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectBindingNormalize"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/request_field",
-        "key_path": "subject_access.subject_binding.request_field",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciStandardsConfig/properties/disability_registry",
+        "key_path": "standards.spdci.disability_registry",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Runtime binding from SP DCI Disability Registry sync APIs to one\nconfigured Registry Relay entity.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "local_reference": "#/$defs/SubjectId",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154520,7 +96579,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154530,76 +96589,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "SubjectId"
+            "dataset",
+            "entity"
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectId"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/token_claim",
-        "key_path": "subject_access.subject_binding.token_claim",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciStandardsConfig/properties/registries",
+        "key_path": "standards.spdci.registries",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154609,7 +96665,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154619,67 +96675,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/assurance_claim_source",
-        "key_path": "subject_access.token_policy.assurance_claim_source",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/SpdciStandardsConfig/properties/registries/additionalProperties",
+        "key_path": "standards.spdci.registries.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Runtime binding from a DCI registry sync search API to one configured\nRegistry Relay entity.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_spdci_registries_open_map",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/SubjectAccessAssuranceClaimSource",
+        "local_reference": "#/$defs/SpdciRegistryConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154689,7 +96741,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154699,77 +96751,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "access_token",
-            "id_token"
+            "dataset",
+            "entity"
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessAssuranceClaimSource"
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_access_token_lifetime_seconds",
-        "key_path": "subject_access.token_policy.max_access_token_lifetime_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/StandardsConfig/properties/spdci",
+        "key_path": "standards.spdci",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Social Protection Digital Convergence Initiative (SP DCI) adapter\nconfiguration.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154779,7 +96829,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154789,59 +96839,51 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_auth_age_seconds",
-        "key_path": "subject_access.token_policy.max_auth_age_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/TrustProxyConfig/properties/enabled",
+        "key_path": "server.trust_proxy.enabled",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -154852,11 +96894,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154866,7 +96908,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154876,59 +96918,47 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_clock_leeway_seconds",
-        "key_path": "subject_access.token_policy.max_clock_leeway_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies",
+        "key_path": "server.trust_proxy.trusted_proxies",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -154943,7 +96973,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154953,7 +96983,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154963,18 +96993,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -154986,51 +97016,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_credential_validity_seconds",
-        "key_path": "subject_access.token_policy.max_credential_validity_seconds",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies/items",
+        "key_path": "server.trust_proxy.trusted_proxies[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155040,7 +97061,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155050,18 +97071,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -155073,51 +97094,44 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_evaluation_age_seconds",
-        "key_path": "subject_access.token_policy.max_evaluation_age_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/XlsxFormatConfig/properties/data_range",
+        "key_path": "datasets[].tables[].source.format.xlsx.data_range",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155127,7 +97141,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155137,74 +97151,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/required_acr_values",
-        "key_path": "subject_access.token_policy.required_acr_values",
+        "schema": "relay",
+        "pointer": "/$defs/XlsxFormatConfig/properties/header_row",
+        "key_path": "datasets[].tables[].source.format.xlsx.header_row",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155214,7 +97221,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155224,65 +97231,79 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/required_acr_values/items",
-        "key_path": "subject_access.token_policy.required_acr_values[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/XlsxFormatConfig/properties/sheet",
+        "key_path": "datasets[].tables[].source.format.xlsx.sheet",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155292,7 +97313,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155302,67 +97323,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
+        "schema": "relay",
         "pointer": "/properties/audit",
         "key_path": "audit",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Audit configuration. Sink choice gates further fields via the\ntagged `AuditSinkConfig` enum. The enum is flattened onto the\ncontaining struct so that the YAML `sink:` key acts as the\ndiscriminator, matching the public example configuration.\n\n`deny_unknown_fields` is deliberately omitted here: `serde` does\nnot support combining it with `#[serde(flatten)]` on an internally\ntagged enum (unknown keys in `audit` are caught by the enum's own\n`deny_unknown_fields`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/EvidenceAuditConfig",
+        "local_reference": "#/$defs/AuditConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155372,7 +97392,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155382,18 +97402,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -155401,34 +97421,50 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "sink",
+              "path"
+            ],
+            [
+              "sink"
+            ]
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
+        },
+        {
+          "keyword": "unevaluatedProperties",
+          "value": false
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig"
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
+        "schema": "relay",
         "pointer": "/properties/auth",
         "key_path": "auth",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Authentication configuration. Exactly one of `api_keys` and `oidc`\nis consumed at startup, gated by `mode`; cross-field validation in\n[`validate`] enforces that only the active block is populated.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/EvidenceAuthConfig",
+        "local_reference": "#/$defs/AuthConfig",
         "composed": false
       },
       "requiredness": "required",
@@ -155441,7 +97477,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155451,7 +97487,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155461,18 +97497,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -155481,48 +97517,53 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "mode"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig"
+        "schema": "relay",
+        "pointer": "/$defs/AuthConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/properties/cel",
-        "key_path": "cel",
+        "schema": "relay",
+        "pointer": "/properties/catalog",
+        "key_path": "catalog",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Catalog-level metadata surfaced by `/metadata/*` and DCAT outputs.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_catalog_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/RegistryNotaryCelConfig",
+        "local_reference": "#/$defs/CatalogConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155532,7 +97573,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155542,18 +97583,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -155561,29 +97602,37 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "title",
+            "base_url",
+            "publisher"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig"
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
+        "schema": "relay",
         "pointer": "/properties/config_trust",
         "key_path": "config_trust",
         "path_kind": "property"
       },
-      "purpose": "Optional governed-configuration local trust state.\n\nSimple local deployments omit this block. Signed/governed apply requires it\nso anti-rollback state lives in an explicit durable location.",
+      "purpose": "Optional signed configuration bundle trust state.\n\nSimple local deployments omit this block. Bundle-aware deployments pin the\nlocal trust anchor, bundle, and anti-rollback state paths explicitly.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_config_trust_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_config_trust_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -155602,7 +97651,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155612,7 +97661,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155622,18 +97671,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -155660,36 +97709,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/properties/credential_status",
-        "key_path": "credential_status",
+        "schema": "relay",
+        "pointer": "/properties/consultation",
+        "key_path": "consultation",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary credential-status publication and retention behavior.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_credential_status_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/CredentialStatusConfig",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155699,7 +97748,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155709,70 +97758,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "authorized_workload",
+            "state_plane",
+            "audit_pseudonym_materials"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialStatusConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/properties/deployment",
-        "key_path": "deployment",
+        "schema": "relay",
+        "pointer": "/properties/datasets",
+        "key_path": "datasets",
         "path_kind": "property"
       },
-      "purpose": "The operator-declared `deployment` config block.\n\nAn absent profile means an undeclared deployment, which refuses startup. The\n`multi_instance` flag is an operator declaration that the instance is one of\nseveral sharing the same workload; it is never inferred.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/DeploymentConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155782,7 +97834,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155792,18 +97844,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -155814,45 +97866,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/properties/evidence",
-        "key_path": "evidence",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/properties/datasets/items",
+        "key_path": "datasets[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Registry Notary configuration. Disabled by default so existing\nRegistry Relay deployments load unchanged.",
+      "purpose": "A single dataset declaration.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/EvidenceConfig",
+        "local_reference": "#/$defs/DatasetConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155862,7 +97910,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155872,18 +97920,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -155892,34 +97940,46 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "title",
+            "description",
+            "owner",
+            "sensitivity",
+            "access_rights",
+            "update_frequency"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig"
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/properties/federation",
-        "key_path": "federation",
+        "schema": "relay",
+        "pointer": "/properties/deployment",
+        "key_path": "deployment",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/FederationConfig",
+        "local_reference": "#/$defs/DeploymentConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -155933,7 +97993,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155943,7 +98003,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155953,18 +98013,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -155979,28 +98039,28 @@
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig"
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
+        "schema": "relay",
         "pointer": "/properties/instance",
         "key_path": "instance",
         "path_kind": "property"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Stable deployment identity surfaced in redacted operations posture.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_instance_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/NotaryInstanceConfig",
+        "local_reference": "#/$defs/InstanceConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -156014,7 +98074,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -156024,7 +98084,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -156034,18 +98094,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -156059,42 +98119,42 @@
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig"
+        "schema": "relay",
+        "pointer": "/$defs/InstanceConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/properties/oid4vci",
-        "key_path": "oid4vci",
+        "schema": "relay",
+        "pointer": "/properties/metadata",
+        "key_path": "metadata",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional split metadata manifest loaded alongside the runtime config.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_metadata_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/Oid4vciConfig",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -156104,7 +98164,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -156114,68 +98174,71 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "source"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
+        "schema": "relay",
         "pointer": "/properties/server",
         "key_path": "server",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "HTTP listener and adjacent server-wide knobs.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/RegistryNotaryHttpConfig",
+        "local_reference": "#/$defs/ServerConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -156185,7 +98248,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -156195,54 +98258,59 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "bind"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig"
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/properties/state",
-        "key_path": "state",
+        "schema": "relay",
+        "pointer": "/properties/standards",
+        "key_path": "standards",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/StateConfig",
+        "local_reference": "#/$defs/StandardsConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -156256,7 +98324,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -156266,7 +98334,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -156276,23 +98344,24 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -156301,42 +98370,41 @@
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/StateConfig"
+        "schema": "relay",
+        "pointer": "/$defs/StandardsConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/properties/subject_access",
-        "key_path": "subject_access",
+        "schema": "relay",
+        "pointer": "/properties/vocabularies",
+        "key_path": "vocabularies",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls the reviewed vocabulary bindings Relay uses to interpret namespaced terms.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_vocabularies_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/SubjectAccessConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -156346,7 +98414,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -156356,38 +98424,105 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
           "value": "object"
         }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/properties/vocabularies/additionalProperties",
+        "key_path": "vocabularies.*",
+        "path_kind": "map_value"
+      },
+      "purpose": "Each reviewed key is a vocabulary prefix and each value binds that prefix to its operator-approved vocabulary identifier.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_vocabularies_open_map",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
       ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig"
-      }
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     }
   ]
 }
diff --git a/docs/site/public/generated/diagnostics/fixture.v1.json b/docs/site/public/generated/diagnostics/fixture.v1.json
index 8b1349174..58b7f1c7d 100644
--- a/docs/site/public/generated/diagnostics/fixture.v1.json
+++ b/docs/site/public/generated/diagnostics/fixture.v1.json
@@ -1,24 +1,6 @@
 {
   "schema_version": "registryctl.fixture_error_reference.v1",
   "entries": [
-    {
-      "family": "fixture_execution",
-      "code": "authorization.denied",
-      "owner": "registryctl",
-      "product": "registryctl_relay_offline_harness",
-      "phase": "offline_execution",
-      "safe_meaning": "Authorization denied fixture execution before source access.",
-      "rule": "authorization_before_source",
-      "safe_remediation": "Align the fixture identity and authorization expectation with the compiled policy.",
-      "field_address_pattern": null,
-      "evidence_scope": "offline synthetic fixture execution",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--authorization.denied",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility."
-    },
     {
       "family": "fixture_execution",
       "code": "failure.subject_mismatch",
diff --git a/docs/site/public/generated/diagnostics/operator.v1.json b/docs/site/public/generated/diagnostics/operator.v1.json
index d8750d557..63a8af07b 100644
--- a/docs/site/public/generated/diagnostics/operator.v1.json
+++ b/docs/site/public/generated/diagnostics/operator.v1.json
@@ -73,330 +73,6 @@
       "stability": "pre1_stable_code",
       "evidence_limitation": "The category does not disclose parser messages, local paths, or supplied values."
     },
-    {
-      "family": "notary_activation",
-      "code": "notary.cel.worker_unavailable",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary CEL worker is unavailable",
-      "rule": "Every configured CEL worker must complete the bounded product protocol probe before listeners serve",
-      "safe_remediation": "verify that the adjacent CEL worker artifact is present and executable, confirm the supported platform and configured resource ceilings, then retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "CEL worker packaging, protocol responsiveness, supported platform, and bounded startup capacity",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--cel-worker-unavailable",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.configuration.invalid",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "configuration_activation",
-      "safe_meaning": "Registry Notary runtime configuration is invalid",
-      "rule": "Runtime activation requires valid product configuration, supported features, and resolvable secret and provider bindings",
-      "safe_remediation": "run registry-notary doctor, correct the reviewed configuration or binding, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "Notary configuration, provider bindings, and compiled feature support",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--configuration-invalid",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.deployment.gate_failed",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "deployment_activation",
-      "safe_meaning": "Registry Notary deployment gates refused startup",
-      "rule": "Every startup-failing deployment gate must pass before activation",
-      "safe_remediation": "run registry-notary doctor for the selected deployment profile and resolve its startup-failing findings",
-      "field_address_pattern": null,
-      "evidence_scope": "selected deployment profile and startup-failing gate results",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--deployment-gate-failed",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.activation_failed",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay consultation activation failed",
-      "rule": "Registry-backed claims require the reviewed Relay consultation client to activate before Notary serves",
-      "safe_remediation": "check the Notary configuration and startup environment",
-      "field_address_pattern": null,
-      "evidence_scope": "Notary Relay consultation client activation lifecycle",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-activation-failed",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.configuration_invalid",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay consultation configuration is invalid",
-      "rule": "The Relay destination, activation plan, and activation lifecycle must form one valid reviewed configuration",
-      "safe_remediation": "check the evidence.relay connection and Registry-backed consultation configuration",
-      "field_address_pattern": null,
-      "evidence_scope": "Relay destination, activation plan, and consultation configuration",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-configuration-invalid",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.credential_unavailable",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay workload credential is unavailable",
-      "rule": "A current non-empty workload credential must be available before a live Relay consultation",
-      "safe_remediation": "mount a current readable workload JWT at evidence.relay.token_file",
-      "field_address_pattern": null,
-      "evidence_scope": "configured Relay workload credential availability",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-credential-unavailable",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.credentials_rejected",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay rejected the configured workload credential",
-      "rule": "Relay must accept the configured Notary workload binding, scope, and validity window",
-      "safe_remediation": "rotate the workload JWT and verify that Relay recognizes its workload binding, required scope, and validity window",
-      "field_address_pattern": null,
-      "evidence_scope": "Relay workload binding, scope, and validity acceptance",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-credentials-rejected",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.profile_mismatch",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay consultation profile does not match the configured contract pin",
-      "rule": "The active Relay profile must match the reviewed Notary consultation contract pin",
-      "safe_remediation": "reconcile the Notary profile id and contract hash with the reviewed Relay consultation contract",
-      "field_address_pattern": null,
-      "evidence_scope": "reviewed Notary profile pin and active Relay consultation contract",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-profile-mismatch",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.profile_not_found",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay consultation profile was not found",
-      "rule": "Every Registry-backed Notary consultation must resolve to an active Relay profile",
-      "safe_remediation": "deploy the configured Relay profile id, then retry the live check",
-      "field_address_pattern": null,
-      "evidence_scope": "configured consultation profile resolution in Relay",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-profile-not-found",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.unavailable",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay consultation service is unavailable",
-      "rule": "The reviewed Relay destination must be reachable through the configured transport policy",
-      "safe_remediation": "check Relay reachability, TLS, destination policy, and service health",
-      "field_address_pattern": null,
-      "evidence_scope": "reviewed Relay destination, transport policy, and service availability",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-unavailable",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.runtime.activation_failed",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary runtime activation failed",
-      "rule": "Audit, state, sensitive-state, and other runtime dependencies must activate successfully before listeners serve",
-      "safe_remediation": "restore the governed runtime dependency or integrity condition, then retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "governed audit, state, sensitive-state, and runtime dependencies",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--runtime-activation-failed",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.runtime.activation_required",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary runtime activation is required before serving",
-      "rule": "Routers may be built only after the governed audit and state activation lifecycle completes",
-      "safe_remediation": "run the compiled Registry Notary runtime activation step before building or serving routers",
-      "field_address_pattern": null,
-      "evidence_scope": "router assembly and governed audit and state activation lifecycle",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--runtime-activation-required",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.database_read_only",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL state database is read-only or recovering",
-      "rule": "Serving requires a writable PostgreSQL primary for correctness-state transactions",
-      "safe_remediation": "restore a writable PostgreSQL primary, run registry-notary state doctor, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL writeability and recovery posture",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-read-only",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.database_unavailable",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL state database is unavailable",
-      "rule": "Serving requires a reachable PostgreSQL service with an accepted TLS trust chain",
-      "safe_remediation": "check PostgreSQL reachability, TLS trust, and service health, then run registry-notary state doctor",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL transport, TLS trust, and service availability",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-unavailable",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.database_unsupported",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL server major is unsupported",
-      "rule": "Serving requires a PostgreSQL major covered by the Registry Notary compatibility contract",
-      "safe_remediation": "move the state database to a supported PostgreSQL major, run registry-notary state doctor, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL server-major compatibility",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-unsupported",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.durability_unsafe",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL durability settings are unsafe",
-      "rule": "Serving requires the documented PostgreSQL durability settings for correctness state",
-      "safe_remediation": "restore the required PostgreSQL durability settings, run registry-notary state doctor, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL durability posture",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-durability-unsafe",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.role_incompatible",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL runtime role contract is incompatible",
-      "rule": "Serving requires the documented restricted runtime role and its attested schema binding",
-      "safe_remediation": "restore the documented runtime grants and role binding, run registry-notary state doctor, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL runtime-role attributes, grants, and schema binding",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-role-incompatible",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.schema_incompatible",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL state schema contract is incompatible",
-      "rule": "Serving requires the exact product-owned schema, catalog, fingerprint, and privilege contract",
-      "safe_remediation": "restore or install the matching Registry Notary state schema, run registry-notary state doctor, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL state schema, catalog, fingerprint, and privilege contract",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-schema-incompatible",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
     {
       "family": "operator_preflight",
       "code": "registryctl.preflight.product_validator_not_checked",
diff --git a/docs/site/public/images/registry-architecture-flow.svg b/docs/site/public/images/registry-architecture-flow.svg
index 64b9b44ab..501da3ef8 100644
--- a/docs/site/public/images/registry-architecture-flow.svg
+++ b/docs/site/public/images/registry-architecture-flow.svg
@@ -1,8 +1,8 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 530" role="img"
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 608" role="img"
      font-family="'Public Sans', system-ui, -apple-system, BlinkMacSystemFont, sans-serif"
      text-rendering="geometricPrecision">
   <title>Registry architecture flow</title>
-  <desc>Registry Platform provides shared primitives to Relay and Notary. Registry Manifest produces portable metadata contracts. Registry Relay owns registry source access, product-neutral adaptation, protected APIs, and typed consultations. Registry Notary evaluates claims from compiler-pinned Relay consultations and issues credentials only from exact Relay-backed evaluation provenance. The external Solmara Lab adopter demo runs published runtime images together.</desc>
+  <desc>Registry Platform provides shared primitives to both runtime services. Registry Manifest produces portable metadata contracts describing what a registry exposes. Registry Relay binds those descriptions to real sources and serves protected read-only APIs and typed consultations. Evidence answers one bounded question about one subject and returns a signed assertion carrying the answer and not the record; it reads a Relay API as one ordinary fixed HTTP source. Registry Mint is a supporting service that issues the short-lived access tokens Evidence verifies, for deployments with no identity provider. The external Solmara Lab adopter demo runs Relay, Evidence, and Mint together in a demo topology.</desc>
 
   <text x="16" y="22" fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">SHARED PRIMITIVES</text>
   <rect x="16" y="30" width="32" height="2" fill="#000091"/>
@@ -11,8 +11,8 @@
   <text x="16" y="82" fill="#6a6a6a" font-size="11.5"
         font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">registry-platform</text>
   <g fill="#3a3a3a" font-size="12.5">
-    <text x="16" y="112">Shared auth, OIDC, audit, HTTP, crypto, SD-JWT, outbound HTTP, and test crates.</text>
-    <text x="16" y="130">Consumed by every runtime service below.</text>
+    <text x="16" y="112">Shared auth, OIDC, audit, HTTP security, crypto, SD-JWT, and test crates.</text>
+    <text x="16" y="130">Composed by both runtime services.</text>
   </g>
 
   <line x1="0" y1="156" x2="720" y2="156" stroke="#e5e5e5" stroke-width="1"/>
@@ -20,12 +20,12 @@
   <g fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">
     <text x="16" y="178">CONTRACTS</text>
     <text x="240" y="178">RUNTIME</text>
-    <text x="464" y="178">EXTERNAL DEMO</text>
+    <text x="520" y="178">EXTERNAL DEMO</text>
   </g>
   <g fill="#000091">
     <rect x="16" y="186" width="32" height="2"/>
     <rect x="240" y="186" width="32" height="2"/>
-    <rect x="464" y="186" width="32" height="2"/>
+    <rect x="520" y="186" width="32" height="2"/>
   </g>
 
   <text x="16" y="220" fill="#161616" font-size="14" font-weight="700">Registry Manifest</text>
@@ -48,41 +48,52 @@
   <text x="240" y="238" fill="#6a6a6a" font-size="11.5"
         font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">registry-relay</text>
   <g fill="#3a3a3a" font-size="12.5">
-    <text x="240" y="268">Owns source access and</text>
-    <text x="240" y="286">product-neutral adaptation.</text>
-    <text x="240" y="304">Serves protected APIs</text>
-    <text x="240" y="322">and typed consultations.</text>
+    <text x="240" y="268">Binds described sources to</text>
+    <text x="240" y="286">real data. Serves protected</text>
+    <text x="240" y="304">read-only APIs and typed</text>
+    <text x="240" y="322">consultations.</text>
   </g>
 
-  <text x="240" y="360" fill="#161616" font-size="14" font-weight="700">Registry Notary</text>
-  <text x="240" y="378" fill="#6a6a6a" font-size="11.5"
-        font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">registry-notary</text>
+  <g stroke="#000091" stroke-width="1" fill="none">
+    <line x1="248" y1="336" x2="248" y2="360"/>
+    <polyline points="244,354 248,360 252,354"/>
+  </g>
+  <text x="262" y="356" fill="#6a6a6a" font-size="11">read as one fixed HTTP source</text>
+
+  <text x="240" y="392" fill="#161616" font-size="14" font-weight="700">Evidence</text>
+  <text x="240" y="410" fill="#6a6a6a" font-size="11.5"
+        font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">registry-evidence</text>
   <g fill="#3a3a3a" font-size="12.5">
-    <text x="240" y="408">Evaluates claims from pinned</text>
-    <text x="240" y="426">Relay consultations.</text>
-    <text x="240" y="444">Issues VCs only from exact</text>
-    <text x="240" y="462">Relay-backed provenance.</text>
+    <text x="240" y="440">Answers one bounded question</text>
+    <text x="240" y="458">about one subject. Returns a</text>
+    <text x="240" y="476">signed assertion carrying the</text>
+    <text x="240" y="494">answer, not the record.</text>
   </g>
 
   <g stroke="#000091" stroke-width="1" fill="none">
-    <line x1="432" y1="268" x2="460" y2="268"/>
-    <polyline points="454,264 460,268 454,272"/>
+    <line x1="476" y1="268" x2="512" y2="268"/>
+    <polyline points="506,264 512,268 506,272"/>
   </g>
 
-  <text x="464" y="220" fill="#161616" font-size="14" font-weight="700">Solmara Lab</text>
-  <text x="464" y="238" fill="#6a6a6a" font-size="11.5"
+  <text x="520" y="220" fill="#161616" font-size="14" font-weight="700">Solmara Lab</text>
+  <text x="520" y="238" fill="#6a6a6a" font-size="11.5"
         font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">solmara-lab</text>
   <g fill="#3a3a3a" font-size="12.5">
-    <text x="464" y="268">External adopter demo</text>
-    <text x="464" y="286">using published Relay</text>
-    <text x="464" y="304">and Notary images with</text>
-    <text x="464" y="322">static metadata.</text>
+    <text x="520" y="268">External adopter demo</text>
+    <text x="520" y="286">running Relay, Evidence,</text>
+    <text x="520" y="304">and Mint together in a</text>
+    <text x="520" y="322">demo topology.</text>
   </g>
 
-  <line x1="0" y1="486" x2="720" y2="486" stroke="#e5e5e5" stroke-width="1"/>
-  <text x="16" y="508" fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">DEMO · SOLMARA LAB</text>
-  <rect x="16" y="516" width="32" height="2" fill="#000091"/>
+  <line x1="0" y1="520" x2="720" y2="520" stroke="#e5e5e5" stroke-width="1"/>
+  <text x="16" y="542" fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">SUPPORTING SERVICE</text>
+  <rect x="16" y="550" width="32" height="2" fill="#000091"/>
+
+  <text x="16" y="574" fill="#161616" font-size="14" font-weight="700">Registry Mint</text>
+  <text x="144" y="574" fill="#6a6a6a" font-size="11.5"
+        font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">registry-mint</text>
   <g fill="#3a3a3a" font-size="12.5">
-    <text x="160" y="508">External adopter demo for local development and reviewer walkthroughs.</text>
+    <text x="260" y="574">Issues the short-lived access tokens Evidence verifies,</text>
+    <text x="260" y="592">for deployments with no identity provider.</text>
   </g>
 </svg>
diff --git a/docs/site/public/images/registry-claim-model.svg b/docs/site/public/images/registry-claim-model.svg
deleted file mode 100644
index c1edf35a5..000000000
--- a/docs/site/public/images/registry-claim-model.svg
+++ /dev/null
@@ -1,46 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 264" role="img"
-     font-family="'Public Sans', system-ui, -apple-system, BlinkMacSystemFont, sans-serif"
-     text-rendering="geometricPrecision">
-  <title>Claim model: five configured stages</title>
-  <desc>A Registry Notary claim evaluation moves through five configured stages in order. (1) Authorized typed request inputs from the caller. Subject access can authorize and bind this request, but does not provide evidence. (2) A compiler-pinned Registry Relay consultation. (3) Rule evaluation from typed Relay outputs. (4) Disclosure mode: value, predicate, or redacted. (5) Evaluation render format: claim-result JSON or CCCEV JSON-LD. Only stored evaluations with exact Relay execution provenance can later be materialized as SD-JWT VC credentials.</desc>
-
-  <text x="16" y="22" fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">CLAIM MODEL · FIVE STAGES IN ORDER</text>
-  <rect x="16" y="30" width="32" height="2" fill="#000091"/>
-
-  <g fill="#000091" font-size="16" font-weight="700">
-    <text x="16" y="68">1</text>
-    <text x="16" y="112">2</text>
-    <text x="16" y="156">3</text>
-    <text x="16" y="200">4</text>
-    <text x="16" y="244">5</text>
-  </g>
-
-  <g fill="#161616" font-size="14" font-weight="700">
-    <text x="48" y="68">Request inputs</text>
-    <text x="48" y="112">Evidence input</text>
-    <text x="48" y="156">Rule evaluation</text>
-    <text x="48" y="200">Disclosure mode</text>
-    <text x="48" y="244">Render format</text>
-  </g>
-
-  <text x="248" y="68" fill="#3a3a3a" font-size="12.5">Typed target, requester, and declared variables.</text>
-
-  <g fill="#6a6a6a" font-size="11.5"
-     font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
-    <text x="248" y="112">compiler-pinned Relay consultation</text>
-    <text x="248" y="156">configured rule over typed Relay outputs</text>
-    <text x="248" y="200">value  |  predicate  |  redacted</text>
-    <text x="248" y="244">claim-result JSON  |  CCCEV JSON-LD</text>
-  </g>
-
-  <g stroke="#000091" stroke-width="1" fill="none">
-    <line x1="22" y1="76" x2="22" y2="100"/>
-    <polyline points="18,94 22,100 26,94"/>
-    <line x1="22" y1="120" x2="22" y2="144"/>
-    <polyline points="18,138 22,144 26,138"/>
-    <line x1="22" y1="164" x2="22" y2="188"/>
-    <polyline points="18,182 22,188 26,182"/>
-    <line x1="22" y1="208" x2="22" y2="232"/>
-    <polyline points="18,226 22,232 26,226"/>
-  </g>
-</svg>
diff --git a/docs/site/public/images/registry-country-evidence-mesh.svg b/docs/site/public/images/registry-country-evidence-mesh.svg
index a6e56a72a..4beb15ba1 100644
--- a/docs/site/public/images/registry-country-evidence-mesh.svg
+++ b/docs/site/public/images/registry-country-evidence-mesh.svg
@@ -1,250 +1,86 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1400 880" role="img" aria-labelledby="t d" font-family="'Public Sans', system-ui, -apple-system, sans-serif" text-rendering="geometricPrecision">
-<title id="t">Country evidence mesh with selectable Registry Stack topologies</title>
-<desc id="d">A country's civil, clinical health, public health, social protection, agriculture, and education systems keep their source data. Registry Stack projects can deploy Relay only, Notary without configured claims, or both products. Every configured Notary claim derives from a compiler-pinned Relay consultation. A Social Protection MIS owns the eligibility decision and reads the registry it owns directly. The DHIS2 example uses a reviewed Rhai script rather than a product-specific executor.</desc>
-<style>
-  .eyebrow { font: 700 11px 'Public Sans', system-ui, sans-serif; fill: #6a6a6a; letter-spacing: 0.08em; }
-  .title { font: 700 25px 'Public Sans', system-ui, sans-serif; fill: #161616; letter-spacing: -0.01em; }
-  .lead { font: 400 14.5px 'Public Sans', system-ui, sans-serif; fill: #3a3a3a; }
-  .cardtitle { font: 700 16px 'Public Sans', system-ui, sans-serif; fill: #161616; }
-  .cardtitle.sm { font-size: 14px; }
-  .a2 { fill: #000091; }
-  .mono { font: 400 12px 'IBM Plex Mono', ui-monospace, monospace; fill: #6a6a6a; }
-  .monoblue { font: 600 12px 'IBM Plex Mono', ui-monospace, monospace; fill: #000091; }
-  .role { font: 700 9.5px 'Public Sans', system-ui, sans-serif; fill: #6a6a6a; letter-spacing: 0.1em; }
-  .b { font: 400 13px 'Public Sans', system-ui, sans-serif; fill: #3a3a3a; }
-  .bsm { font: 400 12px 'Public Sans', system-ui, sans-serif; fill: #3a3a3a; }
-  .bblue { font: 700 13px 'Public Sans', system-ui, sans-serif; fill: #000091; }
-  .bmut { font: 400 12px 'Public Sans', system-ui, sans-serif; fill: #6a6a6a; }
-  .minihead { font: 700 13px 'Public Sans', system-ui, sans-serif; fill: #161616; }
-  .step { font: 400 12.5px 'Public Sans', system-ui, sans-serif; fill: #3a3a3a; }
-  .stepnum { font: 700 11px 'IBM Plex Mono', ui-monospace, monospace; fill: #ffffff; }
-  .attest { font: 400 12.5px 'Public Sans', system-ui, sans-serif; fill: #3a3a3a; }
-  .tag { font: 700 11px 'IBM Plex Mono', ui-monospace, monospace; letter-spacing: 0.04em; }
-  .edgelbl { font: 400 10.5px 'IBM Plex Mono', ui-monospace, monospace; fill: #6a6a6a; }
-  .edgelblb { font: 700 10.5px 'IBM Plex Mono', ui-monospace, monospace; fill: #000091; letter-spacing: 0.04em; }
-  .boundlbl { font: 700 11px 'IBM Plex Mono', ui-monospace, monospace; fill: #000091; letter-spacing: 0.12em; }
-  .leg { font: 400 13px 'Public Sans', system-ui, sans-serif; fill: #3a3a3a; }
-  .sealcap { font: 700 8px 'IBM Plex Mono', ui-monospace, monospace; fill: #000091; letter-spacing: 0.1em; }
-  .badgelbl { font: 700 9px 'IBM Plex Mono', ui-monospace, monospace; fill: #000091; letter-spacing: 0.08em; }
-  .foot { font: 400 11px 'IBM Plex Mono', ui-monospace, monospace; fill: #6a6a6a; }
-</style>
-<rect x="0" y="0" width="1400" height="880" fill="#ffffff"/>
-<rect x="18" y="18" width="1364" height="844" fill="none" stroke="#161616" stroke-width="1"/>
-<text x="40" y="50" class="eyebrow">COUNTRY DIGITAL PUBLIC INFRASTRUCTURE</text>
-<rect x="40" y="58" width="40" height="2" fill="#000091"/>
-<text x="40" y="90" class="title">Each project selects the products its evidence path needs.</text>
-<text x="40" y="116" class="lead">Deploy Relay only, Notary without claims, or both products in one Registry Stack project.</text>
-<text x="40" y="137" class="lead">Relay returns typed consultation outputs; Notary evaluates minimized claims.</text>
-<circle cx="1322" cy="78" r="19.5" fill="none" stroke="#000091" stroke-width="1.3"/>
-<circle cx="1322" cy="78" r="13.5" fill="none" stroke="#000091" stroke-width="0.8"/>
-<line x1="1336.0" y1="78.0" x2="1341.0" y2="78.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="1331.9" y1="87.9" x2="1335.4" y2="91.4" stroke="#000091" stroke-width="0.8"/>
-<line x1="1322.0" y1="92.0" x2="1322.0" y2="97.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="1312.1" y1="87.9" x2="1308.6" y2="91.4" stroke="#000091" stroke-width="0.8"/>
-<line x1="1308.0" y1="78.0" x2="1303.0" y2="78.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="1312.1" y1="68.1" x2="1308.6" y2="64.6" stroke="#000091" stroke-width="0.8"/>
-<line x1="1322.0" y1="64.0" x2="1322.0" y2="59.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="1331.9" y1="68.1" x2="1335.4" y2="64.6" stroke="#000091" stroke-width="0.8"/>
-<path d="M1322.0 72.0 L1323.9 76.1 L1328.0 78.0 L1323.9 79.9 L1322.0 84.0 L1320.1 79.9 L1316.0 78.0 L1320.1 76.1 Z" fill="#000091"/>
-<text x="1322" y="112" class="sealcap" text-anchor="middle">EVIDENCE</text>
-<line x1="223" y1="542" x2="734.8774073" y2="324.3050107" stroke="#000091" stroke-width="1.4"/>
-<polygon points="745.0,320.0 736.8,328.9 732.9,319.7" fill="#000091"/>
-<line x1="446" y1="542" x2="760.9257439" y2="326.2175458" stroke="#000091" stroke-width="1.4"/>
-<polygon points="770.0,320.0 763.8,330.3 758.1,322.1" fill="#000091"/>
-<line x1="677" y1="542" x2="787.9057715" y2="329.7492993" stroke="#000091" stroke-width="1.4"/>
-<polygon points="793.0,320.0 792.3,332.1 783.5,327.4" fill="#000091"/>
-<line x1="1123" y1="542" x2="907.795634" y2="327.760676" stroke="#000091" stroke-width="1.4"/>
-<polygon points="900.0,320.0 911.3,324.2 904.3,331.3" fill="#000091"/>
-<line x1="1346" y1="542" x2="964.5656934" y2="325.431161" stroke="#000091" stroke-width="1.4"/>
-<polygon points="955.0,320.0 967.0,321.1 962.1,329.8" fill="#000091"/>
-<line x1="799.5" y1="320" x2="799.5" y2="549.0" stroke="#161616" stroke-width="1.4" stroke-dasharray="6 4"/>
-<polygon points="799.5,560.0 804.5,549.0 794.5,549.0" fill="#161616"/>
-<rect x="40" y="560" width="205" height="160" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-<rect x="40" y="560" width="205" height="4" fill="#000091"/>
-<text x="54" y="588" class="cardtitle sm">Civil / CRVS</text>
-<text x="54" y="606" class="mono">OpenCRVS</text>
-<line x1="54" y1="618" x2="231" y2="618" stroke="#e5e5e5" stroke-width="1"/>
-<rect x="76.5" y="631.0" width="132" height="22" fill="#000091"/>
-<text x="142.5" y="646" class="tag" fill="#ffffff" text-anchor="middle">DCI-NATIVE</text>
-<circle cx="58" cy="672" r="2" fill="#000091"/>
-<text x="68" y="676" class="bsm">Vital status</text>
-<circle cx="58" cy="691" r="2" fill="#000091"/>
-<text x="68" y="695" class="bsm">Date of birth</text>
-<rect x="201" y="542" width="58" height="44" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-<circle cx="230.0" cy="557" r="8.1" fill="none" stroke="#000091" stroke-width="1.3"/>
-<circle cx="230.0" cy="557" r="5.6" fill="none" stroke="#000091" stroke-width="0.8"/>
-<line x1="236.1" y1="557.0" x2="237.6" y2="557.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="234.3" y1="561.3" x2="235.3" y2="562.3" stroke="#000091" stroke-width="0.8"/>
-<line x1="230.0" y1="563.1" x2="230.0" y2="564.6" stroke="#000091" stroke-width="0.8"/>
-<line x1="225.7" y1="561.3" x2="224.7" y2="562.3" stroke="#000091" stroke-width="0.8"/>
-<line x1="223.9" y1="557.0" x2="222.4" y2="557.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="225.7" y1="552.7" x2="224.7" y2="551.7" stroke="#000091" stroke-width="0.8"/>
-<line x1="230.0" y1="550.9" x2="230.0" y2="549.4" stroke="#000091" stroke-width="0.8"/>
-<line x1="234.3" y1="552.7" x2="235.3" y2="551.7" stroke="#000091" stroke-width="0.8"/>
-<path d="M230.0 554.5 L230.8 556.2 L232.5 557.0 L230.8 557.8 L230.0 559.5 L229.2 557.8 L227.5 557.0 L229.2 556.2 Z" fill="#000091"/>
-<text x="230" y="579" class="badgelbl" text-anchor="middle">R + N</text>
-<rect x="263" y="560" width="205" height="160" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-<rect x="263" y="560" width="205" height="4" fill="#000091"/>
-<text x="277" y="588" class="cardtitle sm">Clinical Health</text>
-<text x="277" y="606" class="mono">FHIR server</text>
-<line x1="277" y1="618" x2="454" y2="618" stroke="#e5e5e5" stroke-width="1"/>
-<rect x="310.5" y="631.0" width="110" height="22" fill="#ffffff" stroke="#000091" stroke-width="1"/>
-<text x="365.5" y="646" class="tag" fill="#000091" text-anchor="middle">FHIR API</text>
-<circle cx="281" cy="672" r="2" fill="#000091"/>
-<text x="291" y="676" class="bsm">Immunization record</text>
-<circle cx="281" cy="691" r="2" fill="#000091"/>
-<text x="291" y="695" class="bsm">Observation / condition</text>
-<rect x="424" y="542" width="58" height="44" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-<circle cx="453.0" cy="557" r="8.1" fill="none" stroke="#000091" stroke-width="1.3"/>
-<circle cx="453.0" cy="557" r="5.6" fill="none" stroke="#000091" stroke-width="0.8"/>
-<line x1="459.1" y1="557.0" x2="460.6" y2="557.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="457.3" y1="561.3" x2="458.3" y2="562.3" stroke="#000091" stroke-width="0.8"/>
-<line x1="453.0" y1="563.1" x2="453.0" y2="564.6" stroke="#000091" stroke-width="0.8"/>
-<line x1="448.7" y1="561.3" x2="447.7" y2="562.3" stroke="#000091" stroke-width="0.8"/>
-<line x1="446.9" y1="557.0" x2="445.4" y2="557.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="448.7" y1="552.7" x2="447.7" y2="551.7" stroke="#000091" stroke-width="0.8"/>
-<line x1="453.0" y1="550.9" x2="453.0" y2="549.4" stroke="#000091" stroke-width="0.8"/>
-<line x1="457.3" y1="552.7" x2="458.3" y2="551.7" stroke="#000091" stroke-width="0.8"/>
-<path d="M453.0 554.5 L453.8 556.2 L455.5 557.0 L453.8 557.8 L453.0 559.5 L452.2 557.8 L450.5 557.0 L452.2 556.2 Z" fill="#000091"/>
-<text x="453" y="579" class="badgelbl" text-anchor="middle">RELAY</text>
-<rect x="486" y="560" width="205" height="160" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-<rect x="486" y="560" width="205" height="4" fill="#000091"/>
-<text x="500" y="588" class="cardtitle sm">Public Health</text>
-<text x="500" y="606" class="mono">DHIS2</text>
-<line x1="500" y1="618" x2="677" y2="618" stroke="#e5e5e5" stroke-width="1"/>
-<rect x="522.5" y="631.0" width="132" height="22" fill="#ffffff" stroke="#000091" stroke-width="1"/>
-<text x="588.5" y="646" class="tag" fill="#000091" text-anchor="middle">RHAI SCRIPT</text>
-<circle cx="504" cy="672" r="2" fill="#000091"/>
-<text x="514" y="676" class="bsm">Programme enrolment</text>
-<circle cx="504" cy="691" r="2" fill="#000091"/>
-<text x="514" y="695" class="bsm">Service event / coverage</text>
-<rect x="647" y="542" width="58" height="44" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-<circle cx="676.0" cy="557" r="8.1" fill="none" stroke="#000091" stroke-width="1.3"/>
-<circle cx="676.0" cy="557" r="5.6" fill="none" stroke="#000091" stroke-width="0.8"/>
-<line x1="682.1" y1="557.0" x2="683.6" y2="557.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="680.3" y1="561.3" x2="681.3" y2="562.3" stroke="#000091" stroke-width="0.8"/>
-<line x1="676.0" y1="563.1" x2="676.0" y2="564.6" stroke="#000091" stroke-width="0.8"/>
-<line x1="671.7" y1="561.3" x2="670.7" y2="562.3" stroke="#000091" stroke-width="0.8"/>
-<line x1="669.9" y1="557.0" x2="668.4" y2="557.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="671.7" y1="552.7" x2="670.7" y2="551.7" stroke="#000091" stroke-width="0.8"/>
-<line x1="676.0" y1="550.9" x2="676.0" y2="549.4" stroke="#000091" stroke-width="0.8"/>
-<line x1="680.3" y1="552.7" x2="681.3" y2="551.7" stroke="#000091" stroke-width="0.8"/>
-<path d="M676.0 554.5 L676.8 556.2 L678.5 557.0 L676.8 557.8 L676.0 559.5 L675.2 557.8 L673.5 557.0 L675.2 556.2 Z" fill="#000091"/>
-<text x="676" y="579" class="badgelbl" text-anchor="middle">R + N</text>
-<rect x="709" y="560" width="205" height="160" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-<rect x="709" y="560" width="205" height="4" fill="#000091"/>
-<text x="723" y="588" class="cardtitle sm">Social Protection</text>
-<text x="723" y="606" class="mono">OpenSPP</text>
-<line x1="723" y1="618" x2="900" y2="618" stroke="#e5e5e5" stroke-width="1"/>
-<rect x="745.5" y="631.0" width="132" height="22" fill="#000091"/>
-<text x="811.5" y="646" class="tag" fill="#ffffff" text-anchor="middle">DCI-NATIVE</text>
-<circle cx="727" cy="672" r="2" fill="#000091"/>
-<text x="737" y="676" class="bsm">Household composition</text>
-<circle cx="727" cy="691" r="2" fill="#000091"/>
-<text x="737" y="695" class="bsm">Programme enrolment</text>
-<rect x="870" y="542" width="58" height="44" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-<circle cx="899.0" cy="557" r="8.1" fill="none" stroke="#000091" stroke-width="1.3"/>
-<circle cx="899.0" cy="557" r="5.6" fill="none" stroke="#000091" stroke-width="0.8"/>
-<line x1="905.1" y1="557.0" x2="906.6" y2="557.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="903.3" y1="561.3" x2="904.3" y2="562.3" stroke="#000091" stroke-width="0.8"/>
-<line x1="899.0" y1="563.1" x2="899.0" y2="564.6" stroke="#000091" stroke-width="0.8"/>
-<line x1="894.7" y1="561.3" x2="893.7" y2="562.3" stroke="#000091" stroke-width="0.8"/>
-<line x1="892.9" y1="557.0" x2="891.4" y2="557.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="894.7" y1="552.7" x2="893.7" y2="551.7" stroke="#000091" stroke-width="0.8"/>
-<line x1="899.0" y1="550.9" x2="899.0" y2="549.4" stroke="#000091" stroke-width="0.8"/>
-<line x1="903.3" y1="552.7" x2="904.3" y2="551.7" stroke="#000091" stroke-width="0.8"/>
-<path d="M899.0 554.5 L899.8 556.2 L901.5 557.0 L899.8 557.8 L899.0 559.5 L898.2 557.8 L896.5 557.0 L898.2 556.2 Z" fill="#000091"/>
-<text x="899" y="579" class="badgelbl" text-anchor="middle">RELAY</text>
-<rect x="932" y="560" width="205" height="160" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-<rect x="932" y="560" width="205" height="4" fill="#000091"/>
-<text x="946" y="588" class="cardtitle sm">Agriculture</text>
-<text x="946" y="606" class="mono">NAgDI</text>
-<line x1="946" y1="618" x2="1123" y2="618" stroke="#e5e5e5" stroke-width="1"/>
-<rect x="974.0" y="631.0" width="121" height="22" fill="#ffffff" stroke="#000091" stroke-width="1"/>
-<text x="1034.5" y="646" class="tag" fill="#000091" text-anchor="middle">VIA RELAY</text>
-<circle cx="950" cy="672" r="2" fill="#000091"/>
-<text x="960" y="676" class="bsm">Farmer registration</text>
-<circle cx="950" cy="691" r="2" fill="#000091"/>
-<text x="960" y="695" class="bsm">Landholding</text>
-<rect x="1093" y="542" width="58" height="44" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-<circle cx="1122.0" cy="557" r="8.1" fill="none" stroke="#000091" stroke-width="1.3"/>
-<circle cx="1122.0" cy="557" r="5.6" fill="none" stroke="#000091" stroke-width="0.8"/>
-<line x1="1128.1" y1="557.0" x2="1129.6" y2="557.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="1126.3" y1="561.3" x2="1127.3" y2="562.3" stroke="#000091" stroke-width="0.8"/>
-<line x1="1122.0" y1="563.1" x2="1122.0" y2="564.6" stroke="#000091" stroke-width="0.8"/>
-<line x1="1117.7" y1="561.3" x2="1116.7" y2="562.3" stroke="#000091" stroke-width="0.8"/>
-<line x1="1115.9" y1="557.0" x2="1114.4" y2="557.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="1117.7" y1="552.7" x2="1116.7" y2="551.7" stroke="#000091" stroke-width="0.8"/>
-<line x1="1122.0" y1="550.9" x2="1122.0" y2="549.4" stroke="#000091" stroke-width="0.8"/>
-<line x1="1126.3" y1="552.7" x2="1127.3" y2="551.7" stroke="#000091" stroke-width="0.8"/>
-<path d="M1122.0 554.5 L1122.8 556.2 L1124.5 557.0 L1122.8 557.8 L1122.0 559.5 L1121.2 557.8 L1119.5 557.0 L1121.2 556.2 Z" fill="#000091"/>
-<text x="1122" y="579" class="badgelbl" text-anchor="middle">R + N</text>
-<rect x="1155" y="560" width="205" height="160" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-<rect x="1155" y="560" width="205" height="4" fill="#000091"/>
-<text x="1169" y="588" class="cardtitle sm">Education service</text>
-<text x="1169" y="606" class="mono">student portal</text>
-<line x1="1169" y1="618" x2="1346" y2="618" stroke="#e5e5e5" stroke-width="1"/>
-<rect x="1197.0" y="631.0" width="121" height="22" fill="#ffffff" stroke="#000091" stroke-width="1"/>
-<text x="1257.5" y="646" class="tag" fill="#000091" text-anchor="middle">RELAY-BACKED</text>
-<circle cx="1173" cy="672" r="2" fill="#000091"/>
-<text x="1183" y="676" class="bsm">Enrollment evidence</text>
-<circle cx="1173" cy="691" r="2" fill="#000091"/>
-<text x="1183" y="695" class="bsm">Student status claim</text>
-<rect x="1316" y="542" width="58" height="44" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-<circle cx="1345.0" cy="557" r="8.1" fill="none" stroke="#000091" stroke-width="1.3"/>
-<circle cx="1345.0" cy="557" r="5.6" fill="none" stroke="#000091" stroke-width="0.8"/>
-<line x1="1351.1" y1="557.0" x2="1352.6" y2="557.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="1349.3" y1="561.3" x2="1350.3" y2="562.3" stroke="#000091" stroke-width="0.8"/>
-<line x1="1345.0" y1="563.1" x2="1345.0" y2="564.6" stroke="#000091" stroke-width="0.8"/>
-<line x1="1340.7" y1="561.3" x2="1339.7" y2="562.3" stroke="#000091" stroke-width="0.8"/>
-<line x1="1338.9" y1="557.0" x2="1337.4" y2="557.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="1340.7" y1="552.7" x2="1339.7" y2="551.7" stroke="#000091" stroke-width="0.8"/>
-<line x1="1345.0" y1="550.9" x2="1345.0" y2="549.4" stroke="#000091" stroke-width="0.8"/>
-<line x1="1349.3" y1="552.7" x2="1350.3" y2="551.7" stroke="#000091" stroke-width="0.8"/>
-<path d="M1345.0 554.5 L1345.8 556.2 L1347.5 557.0 L1345.8 557.8 L1345.0 559.5 L1344.2 557.8 L1342.5 557.0 L1344.2 556.2 Z" fill="#000091"/>
-<text x="1345" y="579" class="badgelbl" text-anchor="middle">NOTARY</text>
-<rect x="730" y="180" width="300" height="140" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-<rect x="730" y="180" width="4" height="140" fill="#000091"/>
-<text x="746" y="208" class="cardtitle">Social Protection MIS</text>
-<text x="746" y="226" class="mono">OpenSPP</text>
-<text x="1018" y="226" class="role" text-anchor="end">RELYING PARTY</text>
-<line x1="746" y1="238" x2="1014" y2="238" stroke="#e5e5e5" stroke-width="1"/>
-<text x="746" y="260" class="b">Assembles the benefit case file.</text>
-<text x="746" y="278" class="b">Combines attestations with its own data.</text>
-<text x="746" y="302" class="bblue">Owns the eligibility decision.</text>
-<text x="56" y="186" class="eyebrow">HOW TO READ IT</text>
-<text x="56" y="216" class="minihead">Choose Relay, Notary, or both.</text>
-<text x="56" y="236" class="b">Combined: typed outputs become claims.</text>
-<text x="56" y="266" class="minihead">Notary claims</text>
-<text x="164" y="266" class="b">always derive from</text>
-<text x="164" y="284" class="b">pinned Relay outputs.</text>
-<text x="56" y="314" class="minihead">Its own data</text>
-<text x="164" y="314" class="b">a system reads the</text>
-<text x="164" y="332" class="b">registry it owns directly.</text>
-<text x="56" y="368" class="bmut">Relay keeps source credentials private.</text>
-<text x="56" y="384" class="bmut">No product-specific source executor.</text>
-<text x="40" y="760" class="eyebrow">LEGEND</text>
-<rect x="40" y="778" width="30" height="16" fill="#000091"/>
-<text x="80" y="793" class="leg">DCI-native (OpenCRVS, OpenSPP)</text>
-<rect x="370" y="778" width="30" height="16" fill="#ffffff" stroke="#000091" stroke-width="1"/>
-<text x="410" y="793" class="leg">Via Relay: reviewed snapshot, HTTP, DCI, FHIR, or Rhai script integration</text>
-<circle cx="52" cy="818" r="10.4" fill="none" stroke="#000091" stroke-width="1.3"/>
-<circle cx="52" cy="818" r="7.2" fill="none" stroke="#000091" stroke-width="0.8"/>
-<line x1="59.7" y1="818.0" x2="61.9" y2="818.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="57.4" y1="823.4" x2="59.0" y2="825.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="52.0" y1="825.7" x2="52.0" y2="827.9" stroke="#000091" stroke-width="0.8"/>
-<line x1="46.6" y1="823.4" x2="45.0" y2="825.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="44.3" y1="818.0" x2="42.1" y2="818.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="46.6" y1="812.6" x2="45.0" y2="811.0" stroke="#000091" stroke-width="0.8"/>
-<line x1="52.0" y1="810.3" x2="52.0" y2="808.1" stroke="#000091" stroke-width="0.8"/>
-<line x1="57.4" y1="812.6" x2="59.0" y2="811.0" stroke="#000091" stroke-width="0.8"/>
-<path d="M52.0 814.8 L53.0 817.0 L55.2 818.0 L53.0 819.0 L52.0 821.2 L51.0 819.0 L48.8 818.0 L51.0 817.0 Z" fill="#000091"/>
-<text x="74" y="823" class="leg">Badge: Relay only, Notary only, or combined</text>
-<line x1="390" y1="815" x2="409.0" y2="815.0" stroke="#000091" stroke-width="1.4"/>
-<polygon points="420.0,815.0 409.0,810.0 409.0,820.0" fill="#000091"/>
-<text x="430" y="823" class="leg">Governed output or claim (crosses domains)</text>
-<line x1="720" y1="815" x2="739.0" y2="815.0" stroke="#161616" stroke-width="1.4" stroke-dasharray="6 4"/>
-<polygon points="750.0,815.0 739.0,810.0 739.0,820.0" fill="#161616"/>
-<text x="760" y="823" class="leg">Direct read of its own registry</text>
-<text x="40" y="854" class="foot">Registry Stack &#183; evidence-exchange reference architecture &#183; illustrative country example (systems shown are representative)</text>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 520" role="img"
+     font-family="'Public Sans', system-ui, -apple-system, BlinkMacSystemFont, sans-serif"
+     text-rendering="geometricPrecision">
+  <title>Country evidence mesh</title>
+  <desc>At country scale several authorities each keep custody of their own data. Clinical health systems expose bounded outputs through a reviewed FHIR integration, public-health programme systems such as DHIS2 through a reviewed Rhai script, and civil registration, social protection, agriculture, and education systems keep their own authoritative stores. Two bounded surfaces sit over them: Registry Relay keeps source credentials and returns only reviewed typed outputs, and Evidence returns only the values a reviewed requirement declares. Consuming systems such as a social-protection management information system receive those answers and do not become raw-record readers.</desc>
+
+  <text x="16" y="22" fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">AUTHORITIES</text>
+  <rect x="16" y="30" width="32" height="2" fill="#000091"/>
+  <text x="16" y="54" fill="#3a3a3a" font-size="12.5">Each authority keeps custody of its own data and exposes bounded outputs.</text>
+
+  <g fill="#161616" font-size="13" font-weight="700">
+    <text x="16" y="88">Clinical health</text>
+    <text x="250" y="88">Public health (DHIS2)</text>
+    <text x="484" y="88">Civil registration</text>
+    <text x="16" y="140">Social protection</text>
+    <text x="250" y="140">Agriculture</text>
+    <text x="484" y="140">Education</text>
+  </g>
+
+  <g fill="#3a3a3a" font-size="12.5">
+    <text x="16" y="106">Reviewed FHIR integration.</text>
+    <text x="250" y="106">Reviewed Rhai script.</text>
+    <text x="484" y="106">Own authoritative store.</text>
+    <text x="16" y="158">Own authoritative store.</text>
+    <text x="250" y="158">Own authoritative store.</text>
+    <text x="484" y="158">Own authoritative store.</text>
+  </g>
+
+  <g stroke="#000091" stroke-width="1" fill="none">
+    <line x1="24" y1="180" x2="24" y2="208"/>
+    <polyline points="20,202 24,208 28,202"/>
+    <line x1="384" y1="180" x2="384" y2="208"/>
+    <polyline points="380,202 384,208 388,202"/>
+  </g>
+  <g fill="#6a6a6a" font-size="11">
+    <text x="38" y="200">bounded outputs</text>
+    <text x="398" y="200">bounded outputs</text>
+  </g>
+
+  <line x1="360" y1="222" x2="360" y2="352" stroke="#e5e5e5" stroke-width="1"/>
+
+  <g fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">
+    <text x="16" y="236">PROTECTED READ</text>
+    <text x="376" y="236">MINIMUM DISCLOSURE</text>
+  </g>
+  <g fill="#000091">
+    <rect x="16" y="244" width="32" height="2"/>
+    <rect x="376" y="244" width="32" height="2"/>
+  </g>
+
+  <g fill="#161616" font-size="14" font-weight="700">
+    <text x="16" y="270">Registry Relay</text>
+    <text x="376" y="270">Evidence</text>
+  </g>
+  <g fill="#6a6a6a" font-size="11.5"
+     font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
+    <text x="16" y="288">registry-relay</text>
+    <text x="376" y="288">registry-evidence</text>
+  </g>
+
+  <g fill="#3a3a3a" font-size="12.5">
+    <text x="16" y="318">Keeps source credentials and</text>
+    <text x="16" y="336">returns only reviewed typed outputs.</text>
+    <text x="376" y="318">Returns only the values a reviewed</text>
+    <text x="376" y="336">requirement declares.</text>
+  </g>
+
+  <g stroke="#000091" stroke-width="1" fill="none">
+    <line x1="24" y1="356" x2="24" y2="384"/>
+    <polyline points="20,378 24,384 28,378"/>
+    <line x1="384" y1="356" x2="384" y2="384"/>
+    <polyline points="380,378 384,384 388,378"/>
+  </g>
+  <g fill="#6a6a6a" font-size="11">
+    <text x="38" y="376">reviewed typed outputs</text>
+    <text x="398" y="376">declared values only</text>
+  </g>
+
+  <text x="16" y="414" fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">CONSUMING SYSTEMS</text>
+  <rect x="16" y="422" width="32" height="2" fill="#000091"/>
+  <text x="16" y="448" fill="#161616" font-size="14" font-weight="700">Social-protection MIS and other consumers</text>
+  <g fill="#3a3a3a" font-size="12.5">
+    <text x="16" y="478">Receive the answers these surfaces return, and do not become</text>
+    <text x="16" y="496">raw-record readers.</text>
+  </g>
 </svg>
diff --git a/docs/site/public/images/registry-evidence-transports.svg b/docs/site/public/images/registry-evidence-transports.svg
deleted file mode 100644
index b916fbe19..000000000
--- a/docs/site/public/images/registry-evidence-transports.svg
+++ /dev/null
@@ -1,49 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 208" role="img"
-     font-family="'Public Sans', system-ui, -apple-system, BlinkMacSystemFont, sans-serif"
-     text-rendering="geometricPrecision">
-  <title>Evidence transports: four ways to consume a claim evaluation</title>
-  <desc>One claim model, four transports a caller can use. Direct API: a backend calls /v1/evaluations, optionally pairs with /v1/credentials to materialize an SD-JWT VC. OID4VCI offer: a wallet discovers the issuer, redeems a pre-authorized offer, and presents a transaction-bound holder proof at /oid4vci/credential. Receipt only: a backend takes the audit-stamped evaluation result and stores it; no credential is issued. Federated delegated evaluation: another Registry Notary posts a signed JWT to /federation/v1/evaluations and receives a signed JWT response.</desc>
-
-  <text x="16" y="22" fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">FOUR TRANSPORTS · ONE CLAIM MODEL</text>
-  <rect x="16" y="30" width="32" height="2" fill="#000091"/>
-
-  <g fill="#000091" font-size="16" font-weight="700">
-    <text x="16" y="68">1</text>
-    <text x="192" y="68">2</text>
-    <text x="368" y="68">3</text>
-    <text x="544" y="68">4</text>
-  </g>
-
-  <g fill="#161616" font-size="14" font-weight="700">
-    <text x="16" y="92">Direct API</text>
-    <text x="192" y="92">OID4VCI offer</text>
-    <text x="368" y="92">Receipt only</text>
-    <text x="544" y="92">Federated</text>
-  </g>
-
-  <g fill="#6a6a6a" font-size="11.5"
-     font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
-    <text x="16" y="112">/v1/evaluations</text>
-    <text x="192" y="112">/oid4vci/credential</text>
-    <text x="368" y="112">/v1/evaluations</text>
-    <text x="540" y="112">/federation/v1/evaluations</text>
-  </g>
-
-  <g fill="#3a3a3a" font-size="12.5">
-    <text x="16" y="138">Backend caller. Pair</text>
-    <text x="16" y="156">with /v1/credentials</text>
-    <text x="16" y="174">to mint SD-JWT VC.</text>
-
-    <text x="192" y="138">Wallet caller. Discovers</text>
-    <text x="192" y="156">via /.well-known.</text>
-    <text x="192" y="174">Pre-authorized flow.</text>
-
-    <text x="368" y="138">Backend caller. Stores</text>
-    <text x="368" y="156">audit-stamped result.</text>
-    <text x="368" y="174">No credential issued.</text>
-
-    <text x="544" y="138">Peer Notary as caller.</text>
-    <text x="544" y="156">Signed JWT in, signed</text>
-    <text x="544" y="174">JWT out.</text>
-  </g>
-</svg>
diff --git a/docs/site/public/images/registry-family-map.svg b/docs/site/public/images/registry-family-map.svg
index b845fedc4..7a4e8dacb 100644
--- a/docs/site/public/images/registry-family-map.svg
+++ b/docs/site/public/images/registry-family-map.svg
@@ -1,79 +1,99 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 232" role="img"
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 392" role="img"
      font-family="'Public Sans', system-ui, -apple-system, BlinkMacSystemFont, sans-serif"
      text-rendering="geometricPrecision">
   <title>Registry family map</title>
-  <desc>The four formal Registry Stack products, arranged left to right by structural role, followed by the external Solmara Lab adopter demo. Registry Platform provides shared primitives; Registry Manifest defines portable contracts; Registry Relay and Registry Notary are runtime services; Solmara Lab runs published stack images in demo topologies.</desc>
+  <desc>The four formal Registry Stack products, arranged left to right by structural role, followed by Registry Mint as a supporting service and the external Solmara Lab adopter demo. Registry Platform provides shared primitives; Registry Manifest defines portable metadata contracts; Registry Relay and Evidence are the runtime services, Relay serving protected read-only APIs over sensitive registry sources and Evidence answering one bounded question about one subject with a signed assertion. Registry Mint issues the short-lived access tokens Evidence verifies, for deployments with no identity provider. Solmara Lab runs Relay, Evidence, and Mint together in a demo topology.</desc>
 
   <g stroke="#e5e5e5" stroke-width="1">
-    <line x1="144" y1="16" x2="144" y2="216"/>
-    <line x1="288" y1="16" x2="288" y2="216"/>
-    <line x1="432" y1="16" x2="432" y2="216"/>
-    <line x1="576" y1="16" x2="576" y2="216"/>
+    <line x1="180" y1="16" x2="180" y2="232"/>
+    <line x1="360" y1="16" x2="360" y2="232"/>
+    <line x1="540" y1="16" x2="540" y2="232"/>
   </g>
 
   <g fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">
     <text x="16" y="30">PLATFORM</text>
-    <text x="160" y="30">CONTRACTS</text>
-    <text x="304" y="30">RUNTIME</text>
-    <text x="448" y="30">RUNTIME</text>
-    <text x="592" y="30">EXTERNAL DEMO</text>
+    <text x="196" y="30">CONTRACTS</text>
+    <text x="376" y="30">RUNTIME</text>
+    <text x="556" y="30">RUNTIME</text>
   </g>
 
   <g fill="#000091">
     <rect x="16" y="38" width="32" height="2"/>
-    <rect x="160" y="38" width="32" height="2"/>
-    <rect x="304" y="38" width="32" height="2"/>
-    <rect x="448" y="38" width="32" height="2"/>
-    <rect x="592" y="38" width="32" height="2"/>
+    <rect x="196" y="38" width="32" height="2"/>
+    <rect x="376" y="38" width="32" height="2"/>
+    <rect x="556" y="38" width="32" height="2"/>
   </g>
 
   <g fill="#000091" font-size="16" font-weight="700">
     <text x="16" y="76">1</text>
-    <text x="160" y="76">2</text>
-    <text x="304" y="76">3</text>
-    <text x="448" y="76">4</text>
-    <text x="592" y="76">EXT</text>
+    <text x="196" y="76">2</text>
+    <text x="376" y="76">3</text>
+    <text x="556" y="76">4</text>
   </g>
 
   <g fill="#161616" font-size="13" font-weight="700">
     <text x="16" y="100">Registry Platform</text>
-    <text x="160" y="100">Registry Manifest</text>
-    <text x="304" y="100">Registry Relay</text>
-    <text x="448" y="100">Registry Notary</text>
-    <text x="592" y="100">Solmara Lab</text>
+    <text x="196" y="100">Registry Manifest</text>
+    <text x="376" y="100">Registry Relay</text>
+    <text x="556" y="100">Evidence</text>
   </g>
 
   <g fill="#6a6a6a" font-size="11.5"
      font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
     <text x="16" y="118">registry-platform</text>
-    <text x="160" y="118">registry-manifest</text>
-    <text x="304" y="118">registry-relay</text>
-    <text x="448" y="118">registry-notary</text>
-    <text x="592" y="118">solmara-lab</text>
+    <text x="196" y="118">registry-manifest</text>
+    <text x="376" y="118">registry-relay</text>
+    <text x="556" y="118">registry-evidence</text>
   </g>
 
   <g fill="#3a3a3a" font-size="12.5">
-    <text x="16" y="150">Shared auth,</text>
-    <text x="16" y="168">audit, HTTP,</text>
-    <text x="16" y="186">crypto, and</text>
-    <text x="16" y="204">test crates.</text>
-
-    <text x="160" y="150">Portable metadata</text>
-    <text x="160" y="168">contracts,</text>
-    <text x="160" y="186">validation, and</text>
-    <text x="160" y="204">renderers.</text>
-
-    <text x="304" y="150">Protected gateway</text>
-    <text x="304" y="168">over sensitive</text>
-    <text x="304" y="186">registry sources.</text>
-
-    <text x="448" y="150">Claim evaluation,</text>
-    <text x="448" y="168">attestation, and</text>
-    <text x="448" y="186">credential</text>
-    <text x="448" y="204">issuance.</text>
-
-    <text x="592" y="150">External adopter</text>
-    <text x="592" y="168">demo using</text>
-    <text x="592" y="186">published images.</text>
+    <text x="16" y="150">Shared auth, audit,</text>
+    <text x="16" y="168">HTTP, crypto, SD-JWT,</text>
+    <text x="16" y="186">and test crates.</text>
+
+    <text x="196" y="150">Portable metadata</text>
+    <text x="196" y="168">contracts, validation,</text>
+    <text x="196" y="186">and renderers.</text>
+
+    <text x="376" y="150">Protected read-only</text>
+    <text x="376" y="168">APIs over sensitive</text>
+    <text x="376" y="186">registry sources.</text>
+
+    <text x="556" y="150">One bounded question</text>
+    <text x="556" y="168">about one subject,</text>
+    <text x="556" y="186">answered with a</text>
+    <text x="556" y="204">signed assertion.</text>
+  </g>
+
+  <line x1="0" y1="256" x2="720" y2="256" stroke="#e5e5e5" stroke-width="1"/>
+  <line x1="360" y1="264" x2="360" y2="384" stroke="#e5e5e5" stroke-width="1"/>
+
+  <g fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">
+    <text x="16" y="286">SUPPORTING SERVICE</text>
+    <text x="376" y="286">EXTERNAL DEMO</text>
+  </g>
+
+  <g fill="#000091">
+    <rect x="16" y="294" width="32" height="2"/>
+    <rect x="376" y="294" width="32" height="2"/>
+  </g>
+
+  <g fill="#161616" font-size="13" font-weight="700">
+    <text x="16" y="318">Registry Mint</text>
+    <text x="376" y="318">Solmara Lab</text>
+  </g>
+
+  <g fill="#6a6a6a" font-size="11.5"
+     font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
+    <text x="16" y="336">registry-mint</text>
+    <text x="376" y="336">solmara-lab</text>
+  </g>
+
+  <g fill="#3a3a3a" font-size="12.5">
+    <text x="16" y="360">Issues the short-lived access tokens</text>
+    <text x="16" y="378">Evidence verifies.</text>
+
+    <text x="376" y="360">External adopter demo running Relay,</text>
+    <text x="376" y="378">Evidence, and Mint together.</text>
   </g>
 </svg>
diff --git a/docs/site/public/images/registry-notary-three-parties.svg b/docs/site/public/images/registry-notary-three-parties.svg
deleted file mode 100644
index c5ccd59f5..000000000
--- a/docs/site/public/images/registry-notary-three-parties.svg
+++ /dev/null
@@ -1,70 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 360" role="img" aria-labelledby="w-title w-desc" fill="none">
-  <title id="w-title">Registry Notary: issuer of evidence in the three-party model</title>
-  <desc id="w-desc">Registry Notary is the issuer in a three-party credential model. It evaluates configured claims against registry data and issues an SD-JWT VC. A wallet, the holder, stores the credential and presents it selectively. A verifier, the relying party, checks the signature and the presented fields. The credential is evidence; the verifier's program decides eligibility, not Notary.</desc>
-
-  <style>
-    .h { font: 600 13px 'Public Sans', system-ui, sans-serif; fill: #161616; }
-    .m { font: 600 10.5px 'Public Sans', system-ui, sans-serif; fill: #6a6a6a; letter-spacing: 0.08em; }
-    .c { font: 400 11px 'IBM Plex Mono', ui-monospace, monospace; fill: #6a6a6a; }
-    .b { font: 400 12px 'Public Sans', system-ui, sans-serif; fill: #3a3a3a; }
-    .a { font: 600 13px 'Public Sans', system-ui, sans-serif; fill: #000091; }
-    .big { font: 700 18px 'Public Sans', system-ui, sans-serif; fill: #161616; }
-    .bigblue { font: 700 18px 'Public Sans', system-ui, sans-serif; fill: #000091; }
-  </style>
-
-  <!-- Column captions -->
-  <text x="24" y="40" class="m">REGISTRY NOTARY · ISSUER</text>
-  <text x="260" y="40" class="m">WALLET · HOLDER</text>
-  <text x="496" y="40" class="m">VERIFIER · RELYING PARTY</text>
-
-  <!-- Notary box -->
-  <rect x="24" y="60" width="200" height="140" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-  <rect x="24" y="60" width="4" height="140" fill="#000091"/>
-  <text x="40" y="82" class="a">Registry Notary</text>
-  <line x1="40" y1="96" x2="208" y2="96" stroke="#e5e5e5"/>
-  <text x="40" y="118" class="b">reads source data</text>
-  <text x="40" y="138" class="b">evaluates claims</text>
-  <text x="40" y="158" class="b">applies disclosure policy</text>
-  <text x="40" y="178" class="b">signs SD-JWT VC</text>
-
-  <!-- Wallet box -->
-  <rect x="260" y="60" width="200" height="140" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-  <text x="276" y="82" class="h">Wallet</text>
-  <line x1="276" y1="96" x2="444" y2="96" stroke="#e5e5e5"/>
-  <text x="276" y="118" class="b">stores the credential</text>
-  <text x="276" y="138" class="b">presents selectively</text>
-  <text x="276" y="158" class="b">proves key possession</text>
-
-  <!-- Verifier box -->
-  <rect x="496" y="60" width="200" height="140" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-  <text x="512" y="82" class="h">Verifier</text>
-  <line x1="512" y1="96" x2="680" y2="96" stroke="#e5e5e5"/>
-  <text x="512" y="118" class="b">checks issuer signature</text>
-  <text x="512" y="138" class="b">reads presented fields</text>
-  <text x="512" y="158" class="b">applies program policy</text>
-
-  <!-- Arrows between boxes -->
-  <line x1="224" y1="130" x2="252" y2="130" stroke="#161616"/>
-  <polygon points="260,130 252,126 252,134" fill="#161616"/>
-
-  <line x1="460" y1="130" x2="488" y2="130" stroke="#161616"/>
-  <polygon points="496,130 488,126 488,134" fill="#161616"/>
-
-  <!-- Separator before bottom callout -->
-  <line x1="24" y1="232" x2="696" y2="232" stroke="#e5e5e5"/>
-
-  <!-- Bottom: evidence -> decision boundary -->
-  <text x="24" y="256" class="m">WHAT NOTARY PRODUCES</text>
-  <text x="24" y="288" class="bigblue">Evidence</text>
-  <text x="24" y="316" class="b">a signed receipt that</text>
-  <text x="24" y="332" class="b">a claim was evaluated.</text>
-
-  <text x="496" y="256" class="m">WHAT THE PROGRAM PRODUCES</text>
-  <text x="496" y="288" class="big">Decision</text>
-  <text x="496" y="316" class="b">whether the subject</text>
-  <text x="496" y="332" class="b">qualifies for a benefit.</text>
-
-  <!-- Boundary handoff arrow: evidence becomes input to a decision -->
-  <line x1="200" y1="298" x2="478" y2="298" stroke="#000091" stroke-width="2" stroke-dasharray="6 4"/>
-  <polygon points="488,298 478,293 478,303" fill="#000091"/>
-</svg>
diff --git a/docs/site/public/images/registry-relay-or-notary.svg b/docs/site/public/images/registry-relay-or-notary.svg
deleted file mode 100644
index 2ec4b698d..000000000
--- a/docs/site/public/images/registry-relay-or-notary.svg
+++ /dev/null
@@ -1,47 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 248" role="img"
-     font-family="'Public Sans', system-ui, -apple-system, BlinkMacSystemFont, sans-serif"
-     text-rendering="geometricPrecision">
-  <title>Registry Relay or Registry Notary</title>
-  <desc>Decision strip. A caller that needs the records themselves uses Registry Relay: protected, scoped, read-only HTTP routes over existing source data, without giving callers database access. A caller that needs an answer, evidence, or a credential uses Registry Notary: a status, predicate, selected value, or signed credential (SD-JWT VC), instead of the full source record. In a combined project, Registry Notary consumes compiler-pinned consultation results from Registry Relay.</desc>
-
-  <line x1="360" y1="16" x2="360" y2="204" stroke="#e5e5e5" stroke-width="1"/>
-
-  <g fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">
-    <text x="16" y="30">CALLER NEEDS</text>
-    <text x="376" y="30">CALLER NEEDS</text>
-  </g>
-  <g fill="#000091">
-    <rect x="16" y="38" width="32" height="2"/>
-    <rect x="376" y="38" width="32" height="2"/>
-  </g>
-
-  <g fill="#161616" font-size="13" font-weight="700">
-    <text x="16" y="64">The records themselves</text>
-    <text x="376" y="64">An answer, evidence,</text>
-    <text x="376" y="82">or a credential</text>
-  </g>
-
-  <g fill="#000091" font-size="13" font-weight="700">
-    <text x="16" y="110">&#8594; Registry Relay</text>
-    <text x="376" y="110">&#8594; Registry Notary</text>
-  </g>
-
-  <g fill="#6a6a6a" font-size="11.5"
-     font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
-    <text x="16" y="128">registry-relay</text>
-    <text x="376" y="128">registry-notary</text>
-  </g>
-
-  <g fill="#3a3a3a" font-size="12.5">
-    <text x="16" y="154">Protected, scoped, read-only HTTP</text>
-    <text x="16" y="172">routes over existing source data,</text>
-    <text x="16" y="190">without giving callers database access.</text>
-
-    <text x="376" y="154">Returns a status, predicate, selected</text>
-    <text x="376" y="172">value, or signed credential (SD-JWT VC),</text>
-    <text x="376" y="190">instead of the full source record.</text>
-  </g>
-
-  <text x="16" y="224" fill="#6a6a6a" font-size="12">Combined project: Notary consumes compiler-pinned</text>
-  <text x="16" y="240" fill="#6a6a6a" font-size="12">consultation results from Relay.</text>
-</svg>
diff --git a/docs/site/public/images/registry-trust-boundaries.svg b/docs/site/public/images/registry-trust-boundaries.svg
index d659c4bdb..0711fe87b 100644
--- a/docs/site/public/images/registry-trust-boundaries.svg
+++ b/docs/site/public/images/registry-trust-boundaries.svg
@@ -1,191 +1,151 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 608" role="img" aria-labelledby="rtb-title rtb-desc"
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 632" role="img"
      font-family="'Public Sans', system-ui, -apple-system, BlinkMacSystemFont, sans-serif"
      text-rendering="geometricPrecision">
-  <title id="rtb-title">Registry Stack trust boundaries</title>
-  <desc id="rtb-desc">Two layers separated by the primary trust boundary. The portable metadata layer (Registry Manifest) only describes: no production data, no authentication, no secrets; it authorizes nothing, enforces nothing, and publishing grants no access. The runtime services layer enforces authentication, authorization, and disclosure. A caller crosses the service edge, where each service runs exactly one authentication mode, static-credential fingerprint or OIDC, and every claim- or record-bearing route is authenticated before responding. Registry Relay owns registry source access and product-neutral adaptation. Registry Notary consumes compiler-pinned Relay consultations for every claim. Subject access can authorize and bind a request but does not provide evidence. Federation with a peer Notary is static-peer only, not a dynamic trust mesh; it is not anonymous (a verified peer-signed JWS is required), and peer identity, signature, freshness, single use, purpose, profile, and audience are verified before claim evaluation. Delegated subject access is a distinct trust context from peer federation: it does not delegate trust to a peer Notary and stays inside the citizen or OIDC trust context. Unauthenticated surfaces at the service edge are the operational, discovery, and protocol-bootstrap routes listed in the footnote.</desc>
-
-  <style>
-    .k    { font: 700 11px 'Public Sans', system-ui, sans-serif; fill: #6a6a6a; letter-spacing: 0.08em; }
-    .pk   { font: 700 9px 'Public Sans', system-ui, sans-serif; fill: #6a6a6a; letter-spacing: 0.08em; }
-    .h    { font: 700 12.5px 'Public Sans', system-ui, sans-serif; fill: #161616; }
-    .hs   { font: 700 12px 'Public Sans', system-ui, sans-serif; fill: #161616; }
-    .hx   { font: 700 11.5px 'Public Sans', system-ui, sans-serif; fill: #161616; }
-    .b    { font: 400 9.5px 'Public Sans', system-ui, sans-serif; fill: #3a3a3a; }
-    .bm   { font: 400 9px 'Public Sans', system-ui, sans-serif; fill: #6a6a6a; }
-    .bxs  { font: 400 8.5px 'Public Sans', system-ui, sans-serif; fill: #6a6a6a; }
-    .bl   { font: 700 10px 'Public Sans', system-ui, sans-serif; fill: #000091; letter-spacing: 0.02em; }
-    .bls  { font: 700 9px 'Public Sans', system-ui, sans-serif; fill: #000091; letter-spacing: 0.04em; }
-    .m    { font: 400 9.5px 'IBM Plex Mono', ui-monospace, monospace; fill: #6a6a6a; }
-    .rot  { font: 700 9px 'Public Sans', system-ui, sans-serif; fill: #6a6a6a; letter-spacing: 0.08em; }
-    .foot { font: 400 9.5px 'IBM Plex Mono', ui-monospace, monospace; fill: #6a6a6a; }
-  </style>
-
-  <!-- Header -->
-  <text x="16" y="22" class="k">TRUST BOUNDARIES</text>
+  <title>Registry Stack trust boundaries</title>
+  <desc>A single request path runs downward from Registry Mint, which issues a short-lived access token, to the Caller, to Evidence, to a Registry Relay protected read API, to the registry sources Relay reads in place. Dashed rules mark the service edge in front of Evidence and in front of Relay, where every record- or assertion-bearing route is authenticated before responding. Caller to Evidence carries a bearer token, a declared purpose, a named requirement revision, and selector values, and returns the answer rather than the record. Evidence to its fixed sources is fixed by trusted configuration and executed only by the core, one request per evaluation. The Relay-protected source composition is two independent authorization decisions, neither widening the other. Registry Mint to Evidence runs one way: Evidence verifies tokens as an ordinary resource server and does not depend on Registry Mint. Relay to registry sources is fixed by a compiled integration. A separate lane runs operator to signing key material to Evidence to the published key set to the verifier, which pins that key set out of band. The footnote lists the unauthenticated operational and discovery routes at the Evidence edge.</desc>
+
+  <text x="16" y="22" fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">TRUST BOUNDARIES</text>
   <rect x="16" y="30" width="32" height="2" fill="#000091"/>
 
-  <!-- Caller and the service edge -->
-  <rect x="325" y="44" width="120" height="34" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-  <text x="337" y="65" class="h">Caller</text>
-
-  <text x="466" y="58" class="bl">SERVICE EDGE · AUTHENTICATION</text>
-  <text x="466" y="72" class="b">One authentication mode per service:</text>
-  <text x="466" y="84" class="b">static-credential fingerprint or OIDC.</text>
-  <text x="466" y="96" class="b">Every claim- or record-bearing route is</text>
-  <text x="466" y="108" class="b">authenticated before responding.</text>
-  <line x1="462" y1="90" x2="398" y2="112" stroke="#6a6a6a" stroke-width="0.7"/>
-
-  <!-- Portable metadata layer -->
-  <rect x="16" y="118" width="168" height="416" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-  <text x="28" y="138" class="pk">PORTABLE METADATA LAYER</text>
-  <text x="28" y="154" class="b">Describes: no production data,</text>
-  <text x="28" y="166" class="b">no authentication, no secrets.</text>
-
-  <rect x="28" y="182" width="140" height="58" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-  <text x="38" y="202" class="hs">Registry Manifest</text>
-  <text x="38" y="216" class="bm">offline metadata</text>
-  <text x="38" y="228" class="bm">producer</text>
-
-  <text x="28" y="262" class="b">Authorizes nothing,</text>
-  <text x="28" y="274" class="b">enforces nothing; asserts</text>
-  <text x="28" y="286" class="b">no record exists or</text>
-  <text x="28" y="298" class="b">satisfies a claim.</text>
-
-  <text x="28" y="318" class="b">Publishing a dataset,</text>
-  <text x="28" y="330" class="b">policy, offering, or</text>
-  <text x="28" y="342" class="b">federation relationship</text>
-  <text x="28" y="354" class="b">grants no access.</text>
-
-  <text x="28" y="374" class="b">Secrets are never</text>
-  <text x="28" y="386" class="b">embedded; the operator</text>
-  <text x="28" y="398" class="b">injects them at</text>
-  <text x="28" y="410" class="b">deployment.</text>
-
-  <text x="28" y="430" class="b">A published ODRL policy</text>
-  <text x="28" y="442" class="b">only describes intent</text>
-  <text x="28" y="454" class="b">until a runtime service</text>
-  <text x="28" y="466" class="b">binds it into an enforced</text>
-  <text x="28" y="478" class="b">profile it supports.</text>
-
-  <!-- Primary trust boundary: describe / enforce split -->
-  <line x1="203" y1="118" x2="203" y2="534" stroke="#161616" stroke-width="1.2" stroke-dasharray="6 4"/>
-  <text class="rot" transform="rotate(-90 195 326)" x="195" y="326" text-anchor="middle">PRIMARY TRUST BOUNDARY · DESCRIBES / ENFORCES</text>
-
-  <!-- Runtime services layer -->
-  <rect x="222" y="118" width="322" height="416" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-  <rect x="222" y="118" width="4" height="416" fill="#000091"/>
-  <text x="238" y="138" class="pk">RUNTIME SERVICES LAYER</text>
-  <text x="238" y="152" class="b">Enforces: authentication,</text>
-  <text x="238" y="164" class="b">authorization, disclosure.</text>
-
-  <rect x="238" y="190" width="132" height="70" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-  <text x="248" y="210" class="h">Registry Relay</text>
-  <text x="248" y="226" class="bm">read-only</text>
-  <text x="248" y="238" class="bm">consultation gateway</text>
-  <text x="248" y="250" class="bm">over sources</text>
-
-  <rect x="400" y="190" width="132" height="70" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-  <text x="410" y="210" class="h">Registry Notary</text>
-  <text x="410" y="226" class="bm">claim evaluation,</text>
-  <text x="410" y="238" class="bm">credential issuance,</text>
-  <text x="410" y="250" class="bm">federation</text>
-
-  <!-- Caller flow into the runtime layer (crossing = service edge) -->
-  <g stroke="#000091" stroke-width="1.2" fill="none">
-    <line x1="385" y1="78" x2="385" y2="172"/>
-    <line x1="304" y1="172" x2="466" y2="172"/>
-    <line x1="304" y1="172" x2="304" y2="186"/>
-    <line x1="466" y1="172" x2="466" y2="186"/>
-    <polyline points="300,181 304,187 308,181"/>
-    <polyline points="462,181 466,187 470,181"/>
-  </g>
-  <!-- boundary-crossing ticks on the panel edge -->
-  <g stroke="#000091" stroke-width="0.9">
-    <line x1="377" y1="123" x2="387" y2="113"/>
-    <line x1="383" y1="123" x2="393" y2="113"/>
-  </g>
-
-  <!-- Notary consumes a compiler-pinned Relay consultation -->
-  <g stroke="#000091" stroke-width="1.2" fill="none">
-    <polyline points="420,260 420,284 308,284 308,266"/>
-    <polyline points="304,270 308,264 312,270"/>
-  </g>
-  <text x="364" y="298" class="m" text-anchor="middle">compiler-pinned consultation</text>
-
-  <!-- Relay reads its sources in place -->
-  <g stroke="#000091" stroke-width="1.2" fill="none">
-    <line x1="270" y1="260" x2="270" y2="306"/>
-    <polyline points="266,306 270,312 274,306"/>
-  </g>
-  <rect x="238" y="316" width="132" height="54" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-  <text x="248" y="336" class="hs">Registry sources</text>
-  <text x="248" y="351" class="bm">Relay-owned boundary</text>
-
-  <!-- Subject access authorization context -->
-  <g stroke="#000091" stroke-width="1.2" fill="none">
-    <line x1="466" y1="260" x2="466" y2="306"/>
-    <polyline points="462,306 466,312 470,306"/>
-  </g>
-  <rect x="406" y="316" width="104" height="54" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-  <text x="414" y="336" class="hx">Subject access</text>
-  <text x="414" y="351" class="m">authorization only</text>
-
-  <!-- Compiled source-adaptation boundary -->
-  <g stroke="#000091" stroke-width="1.2" fill="none">
-    <line x1="320" y1="370" x2="320" y2="386"/>
-    <polyline points="316,380 320,386 324,380"/>
-  </g>
-  <text x="280" y="386" class="bls">INTERNAL BOUNDARY</text>
-  <rect x="280" y="392" width="252" height="84" fill="#ffffff" stroke="#161616" stroke-width="1" stroke-dasharray="5 4"/>
-  <text x="292" y="412" class="hs">Relay source adaptation</text>
-  <text x="292" y="427" class="b">Compiled origin, credential interface, method,</text>
-  <text x="292" y="439" class="b">path, input placement, output projection, and</text>
-  <text x="292" y="451" class="b">limits. Product and version metadata do not</text>
-  <text x="292" y="463" class="b">select HTTP, script, or snapshot capability.</text>
-
-  <text x="238" y="494" class="bl">RELAY OWNS ALL REGISTRY SOURCE ACCESS</text>
-  <text x="238" y="508" class="b">Notary consumes pinned Relay outputs. Subject access</text>
-  <text x="238" y="520" class="b">authorizes requests. It has no source connector.</text>
-
-  <!-- Federation with a peer Notary (crossing the panel edge) -->
-  <rect x="572" y="190" width="132" height="50" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-  <text x="582" y="210" class="hs">Peer Notary</text>
-  <text x="582" y="225" class="bxs">configured static peer</text>
-
-  <g stroke="#000091" stroke-width="1.2" fill="none">
-    <line x1="572" y1="215" x2="538" y2="215"/>
-    <polyline points="544,211 538,215 544,219"/>
-  </g>
-  <g stroke="#000091" stroke-width="0.9">
-    <line x1="540" y1="222" x2="550" y2="208"/>
-    <line x1="546" y1="222" x2="556" y2="208"/>
-  </g>
-
-  <text x="572" y="266" class="bl">FEDERATION</text>
-  <text x="572" y="281" class="b">Static peers only; not a</text>
-  <text x="572" y="293" class="b">dynamic trust mesh.</text>
-  <text x="572" y="305" class="b">Not anonymous: requires a</text>
-  <text x="572" y="317" class="b">verified peer-signed JWS.</text>
-  <text x="572" y="331" class="b">Before any source read:</text>
-  <text x="572" y="343" class="b">peer identity, signature,</text>
-  <text x="572" y="355" class="b">freshness, single use,</text>
-  <text x="572" y="367" class="b">purpose, profile, and</text>
-  <text x="572" y="379" class="b">audience are verified.</text>
-
-  <line x1="572" y1="394" x2="704" y2="394" stroke="#e5e5e5" stroke-width="1"/>
-
-  <text x="572" y="412" class="bls">DELEGATED</text>
-  <text x="572" y="424" class="bls">SUBJECT ACCESS</text>
-  <text x="572" y="440" class="b">A distinct trust context</text>
-  <text x="572" y="452" class="b">from peer federation: it</text>
-  <text x="572" y="464" class="b">does not delegate trust</text>
-  <text x="572" y="476" class="b">to a peer Notary; it stays</text>
-  <text x="572" y="488" class="b">inside the citizen / OIDC</text>
-  <text x="572" y="500" class="b">trust context.</text>
-
-  <!-- Footnote: the unauthenticated surface at the service edge -->
-  <line x1="0" y1="548" x2="720" y2="548" stroke="#e5e5e5" stroke-width="1"/>
-  <text x="16" y="566" class="foot">Unauthenticated at the service edge: liveness and readiness probes · issuer JWKS public verification keys ·</text>
-  <text x="16" y="580" class="foot">credential-issuer discovery · OID4VCI wallet-flow endpoints · docs · public credential-status</text>
-  <text x="16" y="594" class="foot">reads · credential type metadata.</text>
+  <g fill="#ffffff" stroke="#161616" stroke-width="1">
+    <rect x="16" y="52" width="170" height="40"/>
+    <rect x="16" y="126" width="170" height="40"/>
+    <rect x="16" y="232" width="170" height="52"/>
+    <rect x="16" y="350" width="170" height="52"/>
+    <rect x="16" y="440" width="170" height="40"/>
+  </g>
+
+  <g fill="#161616" font-size="12.5" font-weight="700">
+    <text x="28" y="71">Registry Mint</text>
+    <text x="28" y="145">Caller</text>
+    <text x="28" y="252">Evidence</text>
+    <text x="28" y="370">Registry Relay</text>
+    <text x="28" y="459">Registry sources</text>
+  </g>
+
+  <g fill="#6a6a6a" font-size="9.5"
+     font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
+    <text x="28" y="85">registry-mint</text>
+    <text x="28" y="266">registry-evidence</text>
+    <text x="28" y="384">registry-relay</text>
+  </g>
+
+  <g fill="#6a6a6a" font-size="9">
+    <text x="28" y="159">the client asking the question</text>
+    <text x="28" y="279">one bounded question</text>
+    <text x="28" y="397">protected read API</text>
+    <text x="28" y="473">read in place</text>
+  </g>
+
+  <g stroke="#000091" stroke-width="1" fill="none">
+    <line x1="101" y1="94" x2="101" y2="124"/>
+    <polyline points="97,118 101,124 105,118"/>
+    <line x1="101" y1="168" x2="101" y2="230"/>
+    <polyline points="97,224 101,230 105,224"/>
+    <line x1="101" y1="286" x2="101" y2="348"/>
+    <polyline points="97,342 101,348 105,342"/>
+    <line x1="101" y1="404" x2="101" y2="438"/>
+    <polyline points="97,432 101,438 105,432"/>
+  </g>
+
+  <g stroke="#161616" stroke-width="1.2" stroke-dasharray="6 4">
+    <line x1="10" y1="184" x2="194" y2="184"/>
+    <line x1="10" y1="302" x2="194" y2="302"/>
+  </g>
+
+  <g fill="#000091" font-size="9" font-weight="700" letter-spacing="0.04em">
+    <text x="10" y="180">SERVICE EDGE</text>
+    <text x="10" y="298">SERVICE EDGE</text>
+  </g>
+
+  <g fill="#6a6a6a" font-size="9.5"
+     font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
+    <text x="124" y="113">short-lived access token</text>
+    <text x="124" y="204">bearer token, purpose,</text>
+    <text x="124" y="217">revision, selectors</text>
+    <text x="124" y="322">one fixed HTTP request</text>
+    <text x="124" y="335">per evaluation</text>
+    <text x="124" y="424">deny-by-default read</text>
+  </g>
+
+  <g fill="#000091" font-size="10" font-weight="700" letter-spacing="0.04em">
+    <text x="270" y="66">REGISTRY MINT TO EVIDENCE</text>
+    <text x="270" y="128">CALLER TO EVIDENCE</text>
+    <text x="270" y="209">THE SERVICE EDGE (AUTHENTICATION)</text>
+    <text x="270" y="277">EVIDENCE TO ITS FIXED SOURCES</text>
+    <text x="270" y="358">THE RELAY-PROTECTED SOURCE COMPOSITION</text>
+    <text x="270" y="439">RELAY TO REGISTRY SOURCES</text>
+  </g>
+
+  <g fill="#3a3a3a" font-size="11">
+    <text x="270" y="80">One way. Registry Mint issues the token; Evidence verifies it as</text>
+    <text x="270" y="93">an ordinary resource server, knowing it as an issuer URL and a key</text>
+    <text x="270" y="106">set. A deployment with an identity provider does not run Mint at all.</text>
+
+    <text x="270" y="142">A bearer token, a declared purpose, a named requirement revision,</text>
+    <text x="270" y="155">and selector values go in; the answer, not the record, comes back.</text>
+    <text x="270" y="168">Only predefined revisions are evaluable, one authorization decision</text>
+    <text x="270" y="181">binds the whole tuple, and possession is never authority.</text>
+
+    <text x="270" y="223">Every record- or assertion-bearing route is authenticated before</text>
+    <text x="270" y="236">responding. Evidence runs one OIDC bearer profile, one trusted</text>
+    <text x="270" y="249">issuer, one principal claim, and no trust in proxy identity headers.</text>
+
+    <text x="270" y="291">Origin, method, path, headers, credential, TLS, projection, redirect</text>
+    <text x="270" y="304">and proxy denial, and one request per evaluation are fixed by trusted</text>
+    <text x="270" y="317">configuration and executed only by the core. Lookup collapses to</text>
+    <text x="270" y="330">match, no match, or ambiguous; raw responses are never logged.</text>
+
+    <text x="270" y="372">A common deployment makes the fixed source a Relay-protected read</text>
+    <text x="270" y="385">API. Read it as two independent authorization decisions: neither</text>
+    <text x="270" y="398">widens the other. Evidence holds a Relay client credential, custodied</text>
+    <text x="270" y="411">as key material. Relay authenticates the workload, not the caller.</text>
+
+    <text x="270" y="453">Relay owns its own source boundary: a compiled integration fixes the</text>
+    <text x="270" y="466">origin, credential interface, method and path authority, and limits.</text>
+  </g>
+
+  <line x1="0" y1="496" x2="720" y2="496" stroke="#e5e5e5" stroke-width="1"/>
+
+  <text x="16" y="516" fill="#000091" font-size="10" font-weight="700" letter-spacing="0.04em">OPERATOR TO SIGNING KEY MATERIAL, AND CONSUMER TO THE PUBLISHED KEY SET</text>
+
+  <g fill="#ffffff" stroke="#161616" stroke-width="1">
+    <rect x="16" y="528" width="96" height="34"/>
+    <rect x="172" y="528" width="96" height="34"/>
+    <rect x="344" y="528" width="96" height="34"/>
+  </g>
+
+  <g fill="#161616" font-size="12" font-weight="700">
+    <text x="28" y="549">Operator</text>
+    <text x="184" y="549">Evidence</text>
+    <text x="356" y="549">Verifier</text>
+  </g>
+
+  <g stroke="#000091" stroke-width="1" fill="none">
+    <line x1="112" y1="545" x2="170" y2="545"/>
+    <polyline points="164,541 170,545 164,549"/>
+    <line x1="268" y1="545" x2="342" y2="545"/>
+    <polyline points="336,541 342,545 336,549"/>
+  </g>
+
+  <g fill="#6a6a6a" font-size="9.5"
+     font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
+    <text x="118" y="538">key file</text>
+    <text x="278" y="538">public JWKS</text>
+  </g>
+
+  <g fill="#3a3a3a" font-size="11">
+    <text x="448" y="534">Private material reaches the process only by</text>
+    <text x="448" y="547">secret reference to an owner-only file and stays</text>
+    <text x="448" y="560">out of bundles, scripts, logs, and audit. Signing</text>
+    <text x="448" y="573">is fail-closed; the verifier pins the key set.</text>
+  </g>
+
+  <line x1="0" y1="592" x2="720" y2="592" stroke="#e5e5e5" stroke-width="1"/>
+
+  <g fill="#6a6a6a" font-size="9.5"
+     font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
+    <text x="16" y="609">Unauthenticated at the Evidence edge: /health, /ready, /openapi.json, /.well-known/evidence/jwks.json,</text>
+    <text x="16" y="622">/.well-known/jwt-vc-issuer. None reveals which evidence definitions are enabled or which requesters may invoke them.</text>
+  </g>
 </svg>
diff --git a/docs/site/public/images/solmara-lab-topology.svg b/docs/site/public/images/solmara-lab-topology.svg
index f147eea56..12e210e14 100644
--- a/docs/site/public/images/solmara-lab-topology.svg
+++ b/docs/site/public/images/solmara-lab-topology.svg
@@ -1,132 +1,125 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 408" role="img"
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 470" role="img"
      font-family="'Public Sans', system-ui, -apple-system, BlinkMacSystemFont, sans-serif"
      text-rendering="geometricPrecision">
-  <title>Solmara Lab compose topology</title>
-  <desc>The 16 Solmara Lab services in four groups. Six authority Relay instances (cra-civil-relay on host port 4311, nia-population-relay 4312, sro-social-relay 4313, programme-mis-relay 4314, sipf-pensions-relay 4315, nagdi-agriculture-relay 4316) provide evidence reads to four Notary instances (child-benefit-notary 4321, which this tutorial calls directly; pension-notary 4322; nagdi-notary 4323; citizen-notary 4324). The citizen portal on 4300 is wired to the citizen Notary; the Visitor's Center runs on 4301. A support strip holds static-metadata on 4331, scenario-runner, Postgres on 54329, and Redis on 63799. All 16 services start from one just up; host ports shown are the compose defaults.</desc>
+  <title>Solmara Lab compose topology, the Evidence path</title>
+  <desc>The five hops this tutorial makes. One, your shell signs a request with the demo caller's own key and sends it to Registry Mint on host port 4341. Two, Mint returns a short-lived access token. Three, your shell presents that token to Registry Evidence on host port 4343 and asks one question: is this subject an adult. Four, Evidence reads two fields of one row, uin and birth_date, from the Civil Registration Authority's records Relay on host port 4342, under the recorded purpose adult-status-verification. Five, Evidence returns a signed answer carrying true or false and no record. Below, a strip lists the rest of the lab that just up-evidence also starts: six authority Relay instances on host ports 4311 to 4316, the citizen portal on 4300, the Visitor's Center on 4301, static metadata on 4331, Postgres on 54329, and the consultation Relay instances, workload identity agents, and journey services behind them. Forty-one long-running services in all.</desc>
 
-  <text x="16" y="22" fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">SOLMARA LAB — COMPOSE TOPOLOGY · 16 SERVICES</text>
+  <text x="16" y="22" fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">SOLMARA LAB — THE EVIDENCE PATH</text>
   <rect x="16" y="30" width="32" height="2" fill="#000091"/>
 
-  <g fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">
-    <text x="16" y="64">AUTHORITY RELAYS (6)</text>
-    <text x="314" y="64">NOTARIES (4)</text>
-    <text x="554" y="64">EXPERIENCE</text>
-  </g>
-  <g fill="#000091">
-    <rect x="16" y="72" width="24" height="2"/>
-    <rect x="314" y="72" width="24" height="2"/>
-    <rect x="554" y="72" width="24" height="2"/>
+  <!-- The caller: your shell -->
+  <rect x="16" y="132" width="160" height="80" fill="#ffffff" stroke="#161616" stroke-width="1"/>
+  <rect x="16" y="132" width="4" height="80" fill="#000091"/>
+  <text x="32" y="158" fill="#161616" font-size="10.5"
+        font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">curl</text>
+  <g fill="#3a3a3a" font-size="11">
+    <text x="32" y="178">Your shell, holding</text>
+    <text x="32" y="194">the caller's own key</text>
   </g>
 
-  <!-- Authority Relays -->
-  <rect x="16" y="84" width="212" height="178" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-  <g stroke="#e5e5e5" stroke-width="1">
-    <line x1="16" y1="118" x2="228" y2="118"/>
-    <line x1="16" y1="146" x2="228" y2="146"/>
-    <line x1="16" y1="174" x2="228" y2="174"/>
-    <line x1="16" y1="202" x2="228" y2="202"/>
-    <line x1="16" y1="230" x2="228" y2="230"/>
-  </g>
-  <g fill="#161616" font-size="10.5"
-     font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
-    <text x="28" y="106">cra-civil-relay</text>
-    <text x="28" y="134">nia-population-relay</text>
-    <text x="28" y="162">sro-social-relay</text>
-    <text x="28" y="190">programme-mis-relay</text>
-    <text x="28" y="218">sipf-pensions-relay</text>
-    <text x="28" y="246">nagdi-agriculture-relay</text>
+  <!-- Registry Mint -->
+  <rect x="280" y="76" width="180" height="64" fill="#ffffff" stroke="#161616" stroke-width="1"/>
+  <text x="296" y="102" fill="#161616" font-size="10.5"
+        font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">mint</text>
+  <text x="444" y="102" fill="#6a6a6a" font-size="10.5" text-anchor="end"
+        font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">:4341</text>
+  <text x="296" y="122" fill="#3a3a3a" font-size="11">Registry Mint</text>
+
+  <!-- Registry Evidence -->
+  <rect x="280" y="196" width="180" height="84" fill="#ffffff" stroke="#161616" stroke-width="1"/>
+  <rect x="280" y="196" width="4" height="84" fill="#000091"/>
+  <text x="296" y="222" fill="#000091" font-size="10.5"
+        font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">evidence</text>
+  <text x="444" y="222" fill="#6a6a6a" font-size="10.5" text-anchor="end"
+        font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">:4343</text>
+  <g fill="#3a3a3a" font-size="11">
+    <text x="296" y="244">Registry Evidence:</text>
+    <text x="296" y="262">is this subject an adult?</text>
   </g>
-  <g fill="#6a6a6a" font-size="10.5" text-anchor="end"
-     font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
-    <text x="216" y="106">:4311</text>
-    <text x="216" y="134">:4312</text>
-    <text x="216" y="162">:4313</text>
-    <text x="216" y="190">:4314</text>
-    <text x="216" y="218">:4315</text>
-    <text x="216" y="246">:4316</text>
+
+  <!-- The records Relay -->
+  <rect x="508" y="196" width="196" height="84" fill="#ffffff" stroke="#161616" stroke-width="1"/>
+  <text x="524" y="222" fill="#161616" font-size="10.5"
+        font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">cra-records-relay</text>
+  <text x="688" y="240" fill="#6a6a6a" font-size="10.5" text-anchor="end"
+        font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">:4342</text>
+  <g fill="#3a3a3a" font-size="11">
+    <text x="524" y="242">Registry Relay over</text>
+    <text x="524" y="258">the civil register:</text>
+    <text x="524" y="274">two fields of one row</text>
   </g>
 
-  <!-- Relays to Notaries -->
-  <text x="270" y="138" fill="#3a3a3a" font-size="11" text-anchor="middle">evidence</text>
-  <text x="270" y="164" fill="#3a3a3a" font-size="11" text-anchor="middle">reads</text>
+  <!-- 1: the caller signs with its own key -->
   <g stroke="#000091" stroke-width="1" fill="none">
-    <line x1="232" y1="150" x2="308" y2="150"/>
-    <polyline points="302,146 308,150 302,154"/>
+    <polyline points="176,156 212,156 212,96 280,96"/>
+    <polyline points="274,92 280,96 274,100"/>
   </g>
+  <text x="190" y="150" fill="#000091" font-size="11" font-weight="700">1</text>
 
-  <!-- Notaries -->
-  <rect x="314" y="84" width="192" height="140" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-  <rect x="314" y="84" width="4" height="50" fill="#000091"/>
-  <g stroke="#e5e5e5" stroke-width="1">
-    <line x1="314" y1="134" x2="506" y2="134"/>
-    <line x1="314" y1="166" x2="506" y2="166"/>
-    <line x1="314" y1="194" x2="506" y2="194"/>
-  </g>
-  <text x="328" y="106" fill="#000091" font-size="10.5"
-        font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">child-benefit-notary</text>
-  <text x="328" y="124" fill="#000091" font-size="10.5">you call this one directly</text>
-  <g fill="#161616" font-size="10.5"
-     font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
-    <text x="328" y="152">pension-notary</text>
-    <text x="328" y="180">nagdi-notary</text>
-    <text x="328" y="208">citizen-notary</text>
-  </g>
-  <g fill="#6a6a6a" font-size="10.5" text-anchor="end"
-     font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
-    <text x="494" y="106">:4321</text>
-    <text x="494" y="152">:4322</text>
-    <text x="494" y="180">:4323</text>
-    <text x="494" y="208">:4324</text>
+  <!-- 2: Mint returns an access token -->
+  <g stroke="#000091" stroke-width="1" fill="none">
+    <polyline points="280,124 244,124 244,184 176,184"/>
+    <polyline points="182,180 176,184 182,188"/>
   </g>
+  <text x="190" y="178" fill="#000091" font-size="11" font-weight="700">2</text>
 
-  <!-- Experience -->
-  <rect x="554" y="84" width="150" height="98" fill="#ffffff" stroke="#161616" stroke-width="1"/>
-  <line x1="554" y1="132" x2="704" y2="132" stroke="#e5e5e5" stroke-width="1"/>
-  <g fill="#161616" font-size="10.5"
-     font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
-    <text x="566" y="106">portal</text>
-    <text x="566" y="150">home</text>
-  </g>
-  <g fill="#6a6a6a" font-size="10.5" text-anchor="end"
-     font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
-    <text x="692" y="106">:4300</text>
-    <text x="692" y="150">:4301</text>
+  <!-- 3: the caller asks Evidence one question -->
+  <g stroke="#000091" stroke-width="1" fill="none">
+    <polyline points="176,200 280,200"/>
+    <polyline points="274,196 280,200 274,204"/>
   </g>
-  <g fill="#3a3a3a" font-size="11">
-    <text x="566" y="122">Citizen portal</text>
-    <text x="566" y="166">Visitor's Center</text>
+  <text x="224" y="194" fill="#000091" font-size="11" font-weight="700">3</text>
+
+  <!-- 4: Evidence reads the Relay -->
+  <g stroke="#000091" stroke-width="1" fill="none">
+    <polyline points="460,238 508,238"/>
+    <polyline points="502,234 508,238 502,242"/>
   </g>
+  <text x="480" y="230" fill="#000091" font-size="11" font-weight="700">4</text>
 
-  <!-- Portal to citizen Notary -->
+  <!-- 5: the signed answer goes back -->
   <g stroke="#000091" stroke-width="1" fill="none">
-    <polyline points="554,102 530,102 530,208 512,208"/>
-    <polyline points="518,204 512,208 518,212"/>
+    <polyline points="280,266 200,266 200,212"/>
+    <polyline points="196,218 200,212 204,218"/>
+  </g>
+  <text x="236" y="260" fill="#000091" font-size="11" font-weight="700">5</text>
+
+  <!-- What each hop is -->
+  <g font-size="11" fill="#3a3a3a">
+    <text x="16" y="312">1 The caller signs a request with its own key. 2 Mint returns a short-lived access token.</text>
+    <text x="16" y="328">3 The caller presents that token and asks one question. 4 Evidence reads two fields under one</text>
+    <text x="16" y="344">recorded purpose. 5 Evidence returns a signed answer: true or false, and no record.</text>
   </g>
 
-  <!-- Support strip -->
-  <text x="16" y="292" fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">SUPPORT</text>
-  <rect x="16" y="300" width="24" height="2" fill="#000091"/>
-  <rect x="16" y="312" width="688" height="52" fill="#ffffff" stroke="#e5e5e5" stroke-width="1"/>
+  <!-- The rest of the lab -->
+  <text x="16" y="374" fill="#6a6a6a" font-size="11" font-weight="700" letter-spacing="0.08em">THE REST OF THE LAB</text>
+  <rect x="16" y="382" width="24" height="2" fill="#000091"/>
+  <rect x="16" y="394" width="688" height="52" fill="#ffffff" stroke="#e5e5e5" stroke-width="1"/>
   <g fill="#161616" font-size="10.5"
      font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
-    <text x="32" y="332">static-metadata</text>
-    <text x="200" y="332">scenario-runner</text>
-    <text x="392" y="332">postgres</text>
-    <text x="540" y="332">redis</text>
+    <text x="32" y="414">6 authority relays</text>
+    <text x="240" y="414">portal</text>
+    <text x="336" y="414">home</text>
+    <text x="440" y="414">static-metadata</text>
+    <text x="592" y="414">postgres</text>
   </g>
   <g fill="#6a6a6a" font-size="10.5"
      font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">
-    <text x="134" y="332">:4331</text>
-    <text x="448" y="332">:54329</text>
-    <text x="578" y="332">:63799</text>
+    <text x="150" y="414">:4311-:4316</text>
+    <text x="283" y="414">:4300</text>
+    <text x="366" y="414">:4301</text>
+    <text x="540" y="414">:4331</text>
+    <text x="647" y="414">:54329</text>
   </g>
   <g fill="#3a3a3a" font-size="11">
-    <text x="32" y="350">metadata bundle</text>
-    <text x="200" y="350">backs the portal's guided demos</text>
+    <text x="32" y="432">one per ministry authority</text>
+    <text x="240" y="432">citizen portal</text>
+    <text x="336" y="432">Visitor's Center</text>
+    <text x="440" y="432">metadata bundle</text>
   </g>
 
-  <text x="16" y="392" fill="#6a6a6a" font-size="12">All 16 services start from one</text>
-  <text x="196" y="392" fill="#6a6a6a" font-size="11.5"
-        font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">just up</text>
-  <text x="243" y="392" fill="#6a6a6a" font-size="12">; host ports shown are the compose defaults.</text>
+  <text x="16" y="464" fill="#6a6a6a" font-size="12">All 41 long-running services start from one</text>
+  <text x="272" y="464" fill="#6a6a6a" font-size="11.5"
+        font-family="'IBM Plex Mono', ui-monospace, SFMono-Regular, monospace">just up-evidence</text>
+  <text x="382" y="464" fill="#6a6a6a" font-size="12">; host ports shown are the compose defaults.</text>
 </svg>
diff --git a/docs/site/redocly.yaml b/docs/site/redocly.yaml
index 247dd01e5..71abd2f76 100644
--- a/docs/site/redocly.yaml
+++ b/docs/site/redocly.yaml
@@ -3,8 +3,8 @@ extends:
 apis:
   registry-relay:
     root: openapi/registry-relay.openapi.json
-  registry-notary:
-    root: openapi/registry-notary.openapi.json
+  registry-evidence:
+    root: openapi/registry-evidence.openapi.json
 rules:
   no-empty-servers: off
   no-unused-components: warn
diff --git a/docs/site/scripts/advanced-operations-docs.test.mjs b/docs/site/scripts/advanced-operations-docs.test.mjs
index f24ec1b7a..7e10682c5 100644
--- a/docs/site/scripts/advanced-operations-docs.test.mjs
+++ b/docs/site/scripts/advanced-operations-docs.test.mjs
@@ -114,7 +114,6 @@ test('diagnosis uses generated references and stable code vocabulary', async ()
 
   for (const code of [
     'relay.consultation.activation.source_credentials_unavailable',
-    'notary.relay.credentials_rejected',
     'pdp.purpose_not_permitted',
     'pdp.evidence_stale',
     'source.cardinality_violation',
@@ -123,8 +122,6 @@ test('diagnosis uses generated references and stable code vocabulary', async ()
     'rejected_validation',
     'rejected_rollback',
     'relay.consultation.activation.unsupported_plan',
-    'notary.relay.profile_mismatch',
-    'registry.admin.capability.not_supported',
   ]) {
     assert.ok(source.includes(`\`${code}\``), `missing stable code ${code}`);
   }
@@ -150,7 +147,7 @@ test('advanced operations preserve product activation and confidentiality bounda
 
   assert.match(source, /separate (?:product )?bundles/i);
   assert.match(source, /not atomic project activation/i);
-  assert.match(source, /admit (?:caller )?traffic only after both product/i);
+  assert.match(source, /admit (?:caller )?traffic to a lane only after that lane's product/i);
   assert.match(source, /do not use personal data|with synthetic identifiers/i);
 
   for (const superseded of [
@@ -301,9 +298,7 @@ test('backup and update use only the generated 1.0 deployment lifecycle', async
     [
       'registry-relay-public-verify-state',
       'registry-relay-consultation-verify-state',
-      'registry-notary-verify-state',
       'registry-relay-consultation-stage-secrets',
-      'registry-notary-stage-secrets',
       'registry-postgresql-stage-secrets',
       'up --detach --wait --wait-timeout 120',
     ].join('[\\s\\S]*'),
@@ -312,7 +307,6 @@ test('backup and update use only the generated 1.0 deployment lifecycle', async
   for (const page of [backup, update]) {
     for (const stager of [
       'registry-relay-consultation-stage-secrets',
-      'registry-notary-stage-secrets',
       'registry-postgresql-stage-secrets',
     ]) {
       assert.match(page, new RegExp(`run --rm --no-deps ${stager}`));
@@ -322,7 +316,6 @@ test('backup and update use only the generated 1.0 deployment lifecycle', async
     for (const verifier of [
       'registry-relay-public-verify-state',
       'registry-relay-consultation-verify-state',
-      'registry-notary-verify-state',
     ]) {
       assert.match(page, new RegExp(`run --rm --no-deps ${verifier}`));
     }
@@ -331,7 +324,7 @@ test('backup and update use only the generated 1.0 deployment lifecycle', async
   assert.match(backup, /generated\/compose\.yaml up --detach --wait --wait-timeout 120/);
   assert.match(
     update,
-    /registry-relay-public-preview-state[\s\S]*registry-relay-consultation-preview-state[\s\S]*registry-notary-preview-state[\s\S]*\n\S[^\n]* stop\n[\s\S]*registry-relay-public-accept-state[\s\S]*registry-relay-consultation-accept-state[\s\S]*registry-notary-accept-state[\s\S]*registry-relay-public-verify-state[\s\S]*registry-relay-consultation-verify-state[\s\S]*registry-notary-verify-state[\s\S]*registry-relay-consultation-stage-secrets[\s\S]*registry-postgresql-stage-secrets[\s\S]*\n\S[^\n]* up --detach --wait --wait-timeout 120\n[\s\S]*registry-relay-public-verify-state[\s\S]*registry-relay-consultation-verify-state[\s\S]*registry-notary-verify-state/,
+    /registry-relay-public-preview-state[\s\S]*registry-relay-consultation-preview-state[\s\S]*\n\S[^\n]* stop\n[\s\S]*registry-relay-public-accept-state[\s\S]*registry-relay-consultation-accept-state[\s\S]*registry-relay-public-verify-state[\s\S]*registry-relay-consultation-verify-state[\s\S]*registry-relay-consultation-stage-secrets[\s\S]*registry-postgresql-stage-secrets[\s\S]*\n\S[^\n]* up --detach --wait --wait-timeout 120\n[\s\S]*registry-relay-public-verify-state[\s\S]*registry-relay-consultation-verify-state/,
   );
   assert.match(update, /\n\S[^\n]* up --detach --wait --wait-timeout 120/);
 });
diff --git a/docs/site/scripts/astro-config.test.mjs b/docs/site/scripts/astro-config.test.mjs
index d7ab07948..1104ab56e 100644
--- a/docs/site/scripts/astro-config.test.mjs
+++ b/docs/site/scripts/astro-config.test.mjs
@@ -3,6 +3,7 @@ import { readFileSync } from 'node:fs';
 import { test } from 'node:test';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { buildNotaryRetirementRedirects } from '../src/lib/notary-retirement-redirects.mjs';
 
 const here = dirname(fileURLToPath(import.meta.url));
 const configSource = readFileSync(resolve(here, '../astro.config.mjs'), 'utf8');
@@ -61,6 +62,23 @@ test('archived docset redirects current-only pages to protected main', () => {
   );
 });
 
+test('archived Notary redirects resolve current retirement and Evidence replacements', () => {
+  const context = resolveDocsetBuildContext(docsets, {
+    DOCS_DOCSET: 'v0.8.4',
+    DOCS_BASE: '/v/0.8.4/',
+  });
+  const redirects = buildNotaryRetirementRedirects(context.currentDocsetRedirect);
+
+  assert.equal(
+    redirects['/spec/rs-pr-notary/'],
+    'https://docs.registrystack.org/dev/decisions/notary-retirement-2026-08-03/',
+  );
+  assert.equal(
+    redirects['/products/registry-notary/source-claim-modeling-guide/'],
+    'https://docs.registrystack.org/dev/configure/evidence/',
+  );
+});
+
 test('unsupported archive flags cannot make current components and config disagree', () => {
   const context = resolveDocsetBuildContext(docsets, {
     DOCS_DOCSET: 'latest',
diff --git a/docs/site/scripts/authoring-reference-docs.test.mjs b/docs/site/scripts/authoring-reference-docs.test.mjs
index 1c0926bc5..f81dcec0c 100644
--- a/docs/site/scripts/authoring-reference-docs.test.mjs
+++ b/docs/site/scripts/authoring-reference-docs.test.mjs
@@ -26,12 +26,12 @@ test('committed internal and public reference artifacts are exact and complete',
   validateAuthoringReference(reference, coverage);
   assert.deepEqual(publicReference, reference);
   assert.deepEqual(publicCoverage, coverage);
-  assert.equal(reference.fields.length, 1829);
-  assert.equal(coverage.reviewed_intent_assignment_required_count, 1829);
-  assert.equal(coverage.reviewed_intent_assignment_covered_count, 1829);
-  assert.equal(coverage.distinct_reviewed_intent_count, 629);
-  assert.equal(coverage.distinct_reviewed_intents_reused_count, 86);
-  assert.equal(coverage.reviewed_intent_assignments_using_reused_intent_count, 1286);
+  assert.equal(reference.fields.length, 1155);
+  assert.equal(coverage.reviewed_intent_assignment_required_count, 1155);
+  assert.equal(coverage.reviewed_intent_assignment_covered_count, 1155);
+  assert.equal(coverage.distinct_reviewed_intent_count, 490);
+  assert.equal(coverage.distinct_reviewed_intents_reused_count, 62);
+  assert.equal(coverage.reviewed_intent_assignments_using_reused_intent_count, 727);
   assert.deepEqual(reference.reference_baseline, {
     generator_lifecycle: 'unreleased',
     published_release: null,
@@ -50,34 +50,33 @@ test('committed internal and public reference artifacts are exact and complete',
     'unverified release history must remain explicit and cannot contain a fabricated version',
   );
   assert.deepEqual(reference.coverage.by_schema, {
-    project: 220,
-    environment: 213,
+    project: 191,
+    environment: 126,
     integration: 171,
-    fixture: 63,
+    fixture: 39,
     entity: 35,
     relay: 593,
-    notary: 534,
   });
   assert.deepEqual(reference.coverage.by_path_kind, {
-    root: 7,
-    property: 1458,
-    map_key: 26,
-    map_value: 48,
-    array_item: 178,
-    branch: 112,
+    root: 6,
+    property: 903,
+    map_key: 22,
+    map_value: 34,
+    array_item: 102,
+    branch: 88,
   });
   assert.equal(
     Object.values(reference.coverage.by_intent_profile).reduce(
       (total, count) => total + count,
       0,
     ),
-    1127,
+    593,
   );
-  assert.equal(reference.fields.filter((field) => field.empty_behavior === 'allowed').length, 528);
-  assert.equal(reference.fields.filter((field) => field.empty_behavior === 'rejected').length, 315);
+  assert.equal(reference.fields.filter((field) => field.empty_behavior === 'allowed').length, 260);
+  assert.equal(reference.fields.filter((field) => field.empty_behavior === 'rejected').length, 259);
   assert.equal(
     reference.fields.filter((field) => field.empty_behavior === 'not_applicable').length,
-    986,
+    636,
   );
 });
 
@@ -149,10 +148,10 @@ test('published reference page identifies generated sources and the no-country-v
     /Coverage gate: `registryctl tooling reference configuration --coverage`/,
   );
   assert.match(page, /Country workspace or runtime configuration reads: none/);
-  assert.match(page, /Relay and Notary runtime schemas/);
+  assert.match(page, /Relay runtime schema/);
   assert.match(page, /does not inspect a project, live runtime configuration, environment variables/);
   assert.match(page, /five project-authoring sections describe configuration people commit/);
-  assert.match(page, /intent sidecars are documentation knowledge\s+only/);
+  assert.match(page, /intent sidecar is documentation knowledge\s+only/);
   assert.match(page, /Field release history: not verified/);
   assert.match(page, /Assignment coverage does not claim that every path has unique prose/);
   assert.match(component, /configuration-reference-coverage\.json/);
diff --git a/docs/site/scripts/authoring-reference-sources.json b/docs/site/scripts/authoring-reference-sources.json
index e1d0dcd47..d262ecb25 100644
--- a/docs/site/scripts/authoring-reference-sources.json
+++ b/docs/site/scripts/authoring-reference-sources.json
@@ -5,8 +5,10 @@
     "integration",
     "fixture",
     "entity",
-    "relay",
-    "notary"
+    "relay"
+  ],
+  "runtime_schemas": [
+    "relay"
   ],
   "schema_sources": [
     "project.schema.json",
@@ -14,14 +16,12 @@
     "integration.schema.json",
     "fixture.schema.json",
     "entity.schema.json",
-    "registry-relay.config.schema.json",
-    "registry-notary.config.schema.json"
+    "registry-relay.config.schema.json"
   ],
   "field_knowledge": "schemas/project-authoring/parity-coverage.json#field_knowledge",
   "human_intent": "schemas/project-authoring/documentation-intent.json",
   "runtime_intent": [
-    "crates/registry-relay/config/documentation-intent.json",
-    "crates/registry-notary-core/config/documentation-intent.json"
+    "crates/registry-relay/config/documentation-intent.json"
   ],
   "ci_inputs": [
     {
@@ -48,29 +48,9 @@
       "pattern": "crates/registry-relay/src/config/**",
       "sample": "crates/registry-relay/src/config/mod.rs"
     },
-    {
-      "pattern": "crates/registry-notary-core/config/documentation-intent.json",
-      "sample": "crates/registry-notary-core/config/documentation-intent.json"
-    },
-    {
-      "pattern": "crates/registry-notary-core/src/config.rs",
-      "sample": "crates/registry-notary-core/src/config.rs"
-    },
-    {
-      "pattern": "crates/registry-notary-core/src/config/**",
-      "sample": "crates/registry-notary-core/src/config/root.rs"
-    },
-    {
-      "pattern": "crates/registry-notary-core/src/deployment.rs",
-      "sample": "crates/registry-notary-core/src/deployment.rs"
-    },
     {
       "pattern": "schemas/registry-relay.config.schema.json",
       "sample": "schemas/registry-relay.config.schema.json"
-    },
-    {
-      "pattern": "schemas/registry-notary.config.schema.json",
-      "sample": "schemas/registry-notary.config.schema.json"
     }
   ]
 }
diff --git a/docs/site/scripts/check-current-doc-cutover.mjs b/docs/site/scripts/check-current-doc-cutover.mjs
index 002649c73..6b6340669 100644
--- a/docs/site/scripts/check-current-doc-cutover.mjs
+++ b/docs/site/scripts/check-current-doc-cutover.mjs
@@ -4,7 +4,6 @@ import { fileURLToPath } from 'node:url';
 
 const scriptPath = fileURLToPath(import.meta.url);
 const defaultSiteRoot = resolve(import.meta.dirname, '..');
-const cutoverPage = 'src/content/docs/start/pre-1.0-cutover.mdx';
 const sealedHistoryPages = new Set([
   'src/content/docs/changelog.mdx',
 ]);
@@ -73,7 +72,6 @@ export async function findRemovedSurfaces(siteRoot = defaultSiteRoot) {
     if (
       metadata.status !== 'current' ||
       metadata.draft ||
-      siteRelative === cutoverPage ||
       isSealedHistoryPage(siteRelative)
     ) {
       continue;
@@ -108,7 +106,7 @@ export async function checkCurrentDocCutover(siteRoot = defaultSiteRoot) {
     [
       'Removed pre-1.0 surfaces remain in current documentation.',
       ...details,
-      `Put prescriptive historical command mappings only in ${cutoverPage}.`,
+      'Remove prescriptive historical command mappings from current documentation.',
     ].join('\n'),
   );
 }
diff --git a/docs/site/scripts/check-current-doc-cutover.test.mjs b/docs/site/scripts/check-current-doc-cutover.test.mjs
index d3c978361..2c728c9e8 100644
--- a/docs/site/scripts/check-current-doc-cutover.test.mjs
+++ b/docs/site/scripts/check-current-doc-cutover.test.mjs
@@ -59,7 +59,7 @@ test('rejects every removed command family in a current published page', async (
   });
 });
 
-test('allows removed names in draft, historical, sealed history, and the cutover page', async () => {
+test('allows removed names in draft, historical, and sealed history pages', async () => {
   await withSite(async (root) => {
     await writePage(root, 'draft.mdx', 'status: draft\ndraft: true', '`registryctl start`');
     await writePage(root, 'history.mdx', 'status: historical', '`registryctl start`');
@@ -70,12 +70,6 @@ test('allows removed names in draft, historical, sealed history, and the cutover
       'status: current',
       '`registryctl preflight`',
     );
-    await writePage(
-      root,
-      'start/pre-1.0-cutover.mdx',
-      'status: current',
-      '`registryctl start` moves to `registryctl dev`.',
-    );
     await writePage(root, 'current.mdx', 'status: current', '`registryctl dev`');
 
     assert.deepEqual(await findRemovedSurfaces(root), []);
diff --git a/docs/site/scripts/check-doc-frontmatter.mjs b/docs/site/scripts/check-doc-frontmatter.mjs
index fb3165626..e687b2e93 100644
--- a/docs/site/scripts/check-doc-frontmatter.mjs
+++ b/docs/site/scripts/check-doc-frontmatter.mjs
@@ -2,6 +2,8 @@ import { readdir, readFile } from 'node:fs/promises';
 import { join, relative } from 'node:path';
 import YAML from 'yaml';
 
+import { DOC_PERSONAS } from '../src/lib/doc-personas.mjs';
+
 const docsDir = 'src/content/docs';
 const required = [
   'title',
@@ -26,6 +28,10 @@ const validEvidence = new Set(['aspirational', 'partial', 'verified']);
 // layers, audience the reader roles.
 const validLayer = new Set(['metadata', 'consultation', 'evaluation', 'credential', 'federation', 'administration', 'operations']);
 const validAudience = new Set(['integrator', 'operator', 'maintainer', 'specification editor', 'tooling']);
+// Deployment roles, defined for readers in start/when-to-use.mdx. Required on
+// tutorials so a reader can tell whose page it is before starting it, optional
+// elsewhere. Not the same axis as audience; see src/lib/doc-personas.mjs.
+const validPersona = new Set(DOC_PERSONAS);
 const docIdPattern = /^RS-[A-Z0-9]+(-[A-Z0-9]+)*$/;
 const seenDocIds = new Map();
 const standardsRegister = YAML.parse(await readFile('src/data/standards.yaml', 'utf8'));
@@ -99,6 +105,17 @@ for (const file of await files(docsDir)) {
         }
       }
     }
+    if (data.persona !== undefined) {
+      if (!Array.isArray(data.persona) || data.persona.length === 0) {
+        errors.push(`${relative('.', file)} persona must be a non-empty list`);
+      } else {
+        for (const value of data.persona) {
+          if (!validPersona.has(value)) errors.push(`${relative('.', file)} has invalid persona "${value}"`);
+        }
+      }
+    } else if (data.doc_type === 'tutorial') {
+      errors.push(`${relative('.', file)} (tutorial) missing persona`);
+    }
     if (data.doc_type === 'specification') {
       const rel = relative('.', file);
       if (data.doc_id === undefined || data.doc_id === null || data.doc_id === '') {
diff --git a/docs/site/scripts/check-evidence-tutorials.sh b/docs/site/scripts/check-evidence-tutorials.sh
new file mode 100755
index 000000000..b78fa0935
--- /dev/null
+++ b/docs/site/scripts/check-evidence-tutorials.sh
@@ -0,0 +1,545 @@
+#!/usr/bin/env bash
+#
+# Execute the current Evidence tutorials from a fresh reader directory.
+#
+# This gate builds the Evidence toolset from the checked-out source unless
+# EVIDENCE_BIN, EVIDENCECTL_BIN and MINT_BIN select exact candidate or released
+# bytes, then replays each registered tutorial's own shell fences in its own
+# reader directory. Every tutorial creates the files it needs from its
+# documented commands, so what CI runs is what a reader copies.
+#
+# Usage:
+#   scripts/check-evidence-tutorials.sh                 replay every tutorial
+#   scripts/check-evidence-tutorials.sh --dry-run       drift-check only
+#   scripts/check-evidence-tutorials.sh --only <slug>   one tutorial
+#
+# Registering a tutorial means adding its slug to EVIDENCE_TUTORIALS and a
+# branch to load_spec. Each spec pins:
+#   SPEC_FENCES     how many sh fences the tutorial holds; bump it when you
+#                   intentionally add or remove a documented command block
+#   SPEC_STEPS      the reader journey, in order:
+#                     run:N or run:N-M   execute those sh fences
+#                     edit:H|lang|occ|H2|lang2|occ2|target
+#                                        apply a documented before/after fence
+#                                        pair to an existing file
+#   SPEC_LITERALS   commands and outputs the tutorial must keep documenting
+#   SPEC_OUTPUTS    lines the replay transcript must contain
+#
+# Configuration:
+#   EVIDENCE_BIN / EVIDENCECTL_BIN /      run these exact binaries instead of
+#   MINT_BIN                              building from source
+#   EVIDENCE_TUTORIAL_CARGO_PROFILE       ci (default) or release
+#   EVIDENCE_TUTORIAL_DOCS_ROOT           tutorial directory override (tests)
+
+set -euo pipefail
+
+SITE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+REPO_ROOT="$(cd "$SITE_ROOT/../.." && pwd)"
+# A fence helper written against the replay userland's floor: it locates a
+# fence by heading, language and occurrence and applies it to a file, using
+# only the shell and coreutils the container carries.
+FENCE="$SITE_ROOT/scripts/evidence-tutorial-fence.sh"
+DOCS_ROOT="${EVIDENCE_TUTORIAL_DOCS_ROOT:-$SITE_ROOT/src/content/docs/tutorials}"
+BUILD_PROFILE="${EVIDENCE_TUTORIAL_CARGO_PROFILE:-ci}"
+TARGET_DIR="$REPO_ROOT/target/evidence-tutorial-source"
+
+# ---------------------------------------------------------------------------
+# Registered tutorials
+# ---------------------------------------------------------------------------
+
+EVIDENCE_TUTORIALS=(
+	first-evidence-assertion
+	return-a-governed-value
+	assert-a-role-bound-relationship
+	refuse-unsafe-evidence-requests
+	verify-an-assertion-as-a-consumer
+)
+
+load_spec() {
+	SPEC_FENCES=0
+	SPEC_STEPS=()
+	SPEC_LITERALS=()
+	SPEC_OUTPUTS=()
+
+	case "$1" in
+	first-evidence-assertion)
+		SPEC_FENCES=14
+		SPEC_STEPS=(
+			"run:2"
+			"save:Start a small registry|python|1|registry.py"
+			"background:3"
+			"wait-http:http://127.0.0.1:8000/openapi.json"
+			"run:4-5"
+			"save:Create the Evidence project|yaml|1|questions/adult-status.yaml"
+			"save:Create the Evidence project|rhai|1|derivations/adult-status.rhai"
+			"run:6-13"
+		)
+		SPEC_LITERALS=(
+			"releases/latest/download/evidencectl-install.sh | bash"
+			"evidencectl new adult-status"
+			"evidencectl request prepare adult-status"
+			"--config .evidence/requests/first-assertion/authorization.curl"
+			"evidencectl verify assertion.jws.json"
+			"evidencectl audit show --last-operation"
+			"evidencectl dev clean"
+		)
+		SPEC_OUTPUTS=(
+			"Created an editable OpenAPI authoring project in adult-status"
+			"Evidence ready at http://127.0.0.1:8080"
+			"Prepared request: .evidence/requests/first-assertion/request.json"
+			"VERIFIED"
+			"Local Evidence stopped"
+			"ACCESS AUTHORIZED adult-status age-check requester="
+			"DISCLOSURE RELEASED is_adult"
+			"Removed stopped local Evidence state"
+		)
+		;;
+	return-a-governed-value)
+		SPEC_FENCES=10
+		SPEC_STEPS=(
+			"background:1"
+			"wait-http:http://127.0.0.1:8000/openapi.json"
+			"run:2"
+			"save:Add the age-bracket question|yaml|1|questions/age-bracket.yaml"
+			"save:Add the age-bracket question|rhai|1|derivations/age-bracket.rhai"
+			"run:3-10"
+		)
+		SPEC_LITERALS=(
+			"type: controlled-category"
+			"values: [under-18, 18-to-24, 25-to-64, 65-or-older]"
+			"evidencectl request prepare age-bracket"
+			"--config .evidence/requests/age-bracket/authorization.curl"
+			"evidencectl verify age-bracket.jws.json"
+			"evidencectl audit show --last-operation"
+			"evidencectl dev clean"
+		)
+		SPEC_OUTPUTS=(
+			"Evidence ready at http://127.0.0.1:8080"
+			"Prepared request: .evidence/requests/age-bracket/request.json"
+			"VERIFIED"
+			"Local Evidence stopped"
+			"ACCESS AUTHORIZED age-bracket service-path-selection requester="
+			"DISCLOSURE RELEASED age_bracket"
+			"Removed stopped local Evidence state"
+		)
+		;;
+	assert-a-role-bound-relationship)
+		SPEC_FENCES=9
+		SPEC_STEPS=(
+			"run:1"
+			"save:Start a relationship registry|python|1|registry.py"
+			"background:2"
+			"wait-http:http://127.0.0.1:8002/openapi.json"
+			"run:3"
+			"save:Create the Evidence project|yaml|1|questions/parent-relationship.yaml"
+			"save:Create the Evidence project|rhai|1|derivations/parent-relationship.rhai"
+			"run:4-9"
+		)
+		SPEC_LITERALS=(
+			"subjects:"
+			"--subject child:child_id=child-123"
+			"--subject candidate-parent:candidate_id=parent-456"
+			"--config .evidence/requests/parent-relationship/authorization.curl"
+			"evidencectl verify parent-relationship.jws.json"
+			"evidencectl dev clean"
+		)
+		SPEC_OUTPUTS=(
+			"Created an editable OpenAPI authoring project in parent-relationship"
+			"Evidence ready at http://127.0.0.1:8080"
+			"Prepared request: .evidence/requests/parent-relationship/request.json"
+			"VERIFIED"
+			"Local Evidence stopped"
+			"ACCESS AUTHORIZED parent-relationship relationship-check requester="
+			"DISCLOSURE RELEASED relationship_confirmed"
+			"Removed stopped local Evidence state"
+		)
+		;;
+	refuse-unsafe-evidence-requests)
+		SPEC_FENCES=11
+		SPEC_STEPS=(
+			"background:1"
+			"wait-http:http://127.0.0.1:8000/openapi.json"
+			"run:2-11"
+		)
+		SPEC_LITERALS=(
+			'request["purpose"] = "age-check"'
+			"--data-binary @unauthorized-request.json"
+			"--write-out 'HTTP %{http_code}\\n'"
+			"--data-binary @.evidence/requests/refusal-check/request.json"
+			"evidencectl verify tampered-response.jws.json"
+			"test ! -e tampered-response.verified.json"
+		)
+		SPEC_OUTPUTS=(
+			"Evidence ready at http://127.0.0.1:8080"
+			"Prepared request: .evidence/requests/refusal-check/request.json"
+			"HTTP 403"
+			"VERIFIED"
+			"TAMPER REFUSED"
+			"Local Evidence stopped"
+		)
+		;;
+	verify-an-assertion-as-a-consumer)
+		SPEC_FENCES=3
+		SPEC_STEPS=("run:1-3")
+		SPEC_LITERALS=(
+			'context["trustedJwks"]'
+			'context["verificationPolicy"]'
+			".evidence/requests/first-assertion/verification.json"
+			"--jws assertion.jws.json"
+			"--jwks trusted-issuer-keys.json"
+			"--policy verification-policy.json"
+			'--at "$verified_at"'
+		)
+		SPEC_OUTPUTS=(
+			"authentic: yes"
+			"currently-valid: yes"
+			'"value": true'
+		)
+		;;
+	*)
+		printf '%s is not a registered Evidence tutorial\n' "$1" >&2
+		exit 2
+		;;
+	esac
+}
+
+# ---------------------------------------------------------------------------
+# Arguments
+# ---------------------------------------------------------------------------
+
+DRY_RUN=0
+ONLY=""
+while (($# > 0)); do
+	case "$1" in
+	--dry-run)
+		DRY_RUN=1
+		shift
+		;;
+	--only)
+		if (($# < 2)); then
+			printf -- '--only needs a tutorial slug\n' >&2
+			exit 2
+		fi
+		ONLY="$2"
+		shift 2
+		;;
+	*)
+		printf 'unknown argument: %s (expected --dry-run or --only <slug>)\n' "$1" >&2
+		exit 2
+		;;
+	esac
+done
+
+if [[ -n "$ONLY" ]]; then
+	# load_spec exits on an unregistered slug, which is the check we want here.
+	load_spec "$ONLY"
+	EVIDENCE_TUTORIALS=("$ONLY")
+fi
+
+WORK_ROOT="$(mktemp -d "${TMPDIR:-/tmp}/evidence-tutorial.XXXXXX")"
+cleanup() {
+	local exit_code=$?
+	set +e
+	chmod -R u+w "$WORK_ROOT" 2>/dev/null
+	rm -rf "$WORK_ROOT"
+	if ((exit_code == 0)); then
+		printf 'Evidence tutorial gate: PASS\n'
+	else
+		printf 'Evidence tutorial gate: FAIL (exit %d)\n' "$exit_code" >&2
+	fi
+}
+trap cleanup EXIT
+trap 'exit 130' HUP INT TERM
+
+# ---------------------------------------------------------------------------
+# Toolset under test
+# ---------------------------------------------------------------------------
+
+resolve_profile_dir() {
+	case "$BUILD_PROFILE" in
+	ci | release) printf '%s' "$BUILD_PROFILE" ;;
+	*)
+		printf 'unsupported tutorial Cargo profile: %s (expected ci or release)\n' \
+			"$BUILD_PROFILE" >&2
+		exit 1
+		;;
+	esac
+}
+
+SHIM_DIR="$WORK_ROOT/bin"
+
+prepare_toolset() {
+	if [[ -z "${EVIDENCE_BIN:-}" || -z "${EVIDENCECTL_BIN:-}" || -z "${MINT_BIN:-}" ]]; then
+		local profile_dir
+		profile_dir="$(resolve_profile_dir)"
+		(cd "$REPO_ROOT" && CARGO_TARGET_DIR="$TARGET_DIR" \
+			cargo build --locked --profile "$BUILD_PROFILE" \
+			-p registry-evidence -p registry-evidencectl -p registry-mint)
+		EVIDENCE_BIN="$TARGET_DIR/$profile_dir/evidence"
+		EVIDENCECTL_BIN="$TARGET_DIR/$profile_dir/evidencectl"
+		MINT_BIN="$TARGET_DIR/$profile_dir/mint"
+	fi
+	local bin
+	for bin in "$EVIDENCE_BIN" "$EVIDENCECTL_BIN" "$MINT_BIN"; do
+		# Absoluteness first: the reader journey runs from its own directory and
+		# reaches the binaries through symlinks, so a relative path resolves
+		# against the wrong directory and would otherwise surface much later,
+		# mid-journey, as "command not found".
+		if [[ "$bin" != /* ]]; then
+			printf 'toolset binary path must be absolute: %s\n' "$bin" >&2
+			exit 1
+		fi
+		if [[ ! -x "$bin" ]]; then
+			printf 'toolset binary not executable: %s\n' "$bin" >&2
+			exit 1
+		fi
+	done
+
+	# The tutorials call the binaries by name, so serve them from a shim dir.
+	mkdir -p "$SHIM_DIR"
+	ln -s "$EVIDENCE_BIN" "$SHIM_DIR/evidence"
+	ln -s "$EVIDENCECTL_BIN" "$SHIM_DIR/evidencectl"
+	ln -s "$MINT_BIN" "$SHIM_DIR/mint"
+}
+
+# ---------------------------------------------------------------------------
+# Journey assembly
+# ---------------------------------------------------------------------------
+
+# Emit the sh fences named by a run: step, in order.
+emit_run_step() {
+	local slug="$1" range="$2" fence_dir="$3"
+	local first="${range%%-*}"
+	local last="${range##*-}"
+	local i fence
+	for ((i = first; i <= last; i++)); do
+		fence="$(printf '%s/fence-%02d.sh' "$fence_dir" "$i")"
+		if [[ ! -f "$fence" ]]; then
+			printf 'tutorial spec error in %s: run step names sh fence %d, which does not exist\n' \
+				"$slug" "$i" >&2
+			exit 2
+		fi
+		printf '\nprintf "==> %s fence %02d\\n"\n' "$slug" "$i"
+		cat "$fence"
+	done
+}
+
+# Emit a documented before/after fence pair applied to a file the reader edits.
+#
+# Both fences are read out of the tutorial here, while the journey is being
+# assembled, so a pair the tutorial no longer carries fails by name before the
+# reader's first command runs.
+emit_edit_step() {
+	local slug="$1" spec="$2" tutorial_file="$3" edit_dir="$4"
+	local IFS='|'
+	# shellcheck disable=SC2206  # deliberate split on the field separator
+	local parts=($spec)
+	if ((${#parts[@]} != 7)); then
+		printf 'tutorial spec error in %s: edit step needs 7 fields, got %d: %s\n' \
+			"$slug" "${#parts[@]}" "$spec" >&2
+		exit 2
+	fi
+	EDIT_INDEX=$((EDIT_INDEX + 1))
+	local before after
+	before="$(printf '%s/edit-%02d-before' "$edit_dir" "$EDIT_INDEX")"
+	after="$(printf '%s/edit-%02d-after' "$edit_dir" "$EDIT_INDEX")"
+	if ! bash "$FENCE" write-fence "$tutorial_file" \
+		"${parts[0]}" "${parts[1]}" "${parts[2]}" "$before" ||
+		! bash "$FENCE" write-fence "$tutorial_file" \
+			"${parts[3]}" "${parts[4]}" "${parts[5]}" "$after"; then
+		printf 'tutorial drift in %s: edit step names a fence the tutorial no longer carries: %s\n' \
+			"$slug" "$spec" >&2
+		exit 1
+	fi
+	printf '\nprintf "==> %s edit %s\\n"\n' "$slug" "${parts[6]}"
+	# shellcheck disable=SC2016  # FENCE expands in the emitted script
+	printf 'bash "$FENCE" replace-block %q %q %q\n' "${parts[6]}" "$before" "$after"
+}
+
+# Save a documented non-shell fence as the file the reader is instructed to
+# create. The maintained Markdown remains the single source of those bytes.
+emit_save_step() {
+	local slug="$1" spec="$2"
+	local IFS='|'
+	# shellcheck disable=SC2206  # deliberate split on the field separator
+	local parts=($spec)
+	if ((${#parts[@]} != 4)); then
+		printf 'tutorial spec error in %s: save step needs 4 fields, got %d: %s\n' \
+			"$slug" "${#parts[@]}" "$spec" >&2
+		exit 2
+	fi
+	printf '\nprintf "==> %s save %s\\n"\n' "$slug" "${parts[3]}"
+	# shellcheck disable=SC2016  # FENCE and TUTORIAL expand in the emitted script
+	printf 'bash "$FENCE" write-fence "$TUTORIAL" %q %q %q %q\n' \
+		"${parts[0]}" "${parts[1]}" "${parts[2]}" "${parts[3]}"
+}
+
+# A tutorial may ask the reader to leave one foreground command running in a
+# second terminal. CI runs that exact one-line command in the background and
+# retains its PID for cleanup.
+emit_background_step() {
+	local slug="$1" number="$2" fence_dir="$3"
+	local fence
+	fence="$(printf '%s/fence-%02d.sh' "$fence_dir" "$number")"
+	if [[ ! -f "$fence" ]] || [[ "$(wc -l <"$fence")" -ne 1 ]]; then
+		printf 'tutorial spec error in %s: background step needs one sh line at fence %s\n' \
+			"$slug" "$number" >&2
+		exit 2
+	fi
+	local command
+	IFS= read -r command <"$fence"
+	printf '\nprintf "==> %s fence %02d (background)\\n"\n' "$slug" "$number"
+	printf '%s &\n' "$command"
+	printf 'BACKGROUND_PIDS+=("$!")\n'
+}
+
+emit_wait_http_step() {
+	local url="$1"
+	printf '\nfor attempt in {1..50}; do\n'
+	printf '  if curl -fs %q >/dev/null 2>&1; then break; fi\n' "$url"
+	printf '  if [[ "$attempt" -eq 50 ]]; then printf "tutorial service did not become ready\\n" >&2; exit 1; fi\n'
+	printf '  sleep 0.1\n'
+	printf 'done\n'
+}
+
+emit_journey() {
+	local slug="$1" fence_dir="$2" tutorial_file="$3"
+	local edit_dir="$WORK_ROOT/edits/$slug"
+	mkdir -p "$edit_dir"
+	EDIT_INDEX=0
+	printf 'set -euo pipefail\n'
+	printf 'FENCE=%q\n' "$FENCE"
+	printf 'TUTORIAL=%q\n' "$tutorial_file"
+	printf 'BACKGROUND_PIDS=()\n'
+	printf 'cleanup_journey() {\n'
+	printf '  if [[ -S .evidence/dev/control.sock ]]; then evidencectl dev stop >/dev/null 2>&1 || true; fi\n'
+	printf '  local pid\n'
+	printf '  for pid in "${BACKGROUND_PIDS[@]}"; do kill "$pid" >/dev/null 2>&1 || true; wait "$pid" >/dev/null 2>&1 || true; done\n'
+	printf '}\n'
+	printf 'trap cleanup_journey EXIT\n'
+	printf 'trap "exit 130" HUP INT TERM\n'
+	local step
+	for step in ${SPEC_STEPS[@]+"${SPEC_STEPS[@]}"}; do
+		case "$step" in
+		run:*) emit_run_step "$slug" "${step#run:}" "$fence_dir" ;;
+		edit:*) emit_edit_step "$slug" "${step#edit:}" "$tutorial_file" "$edit_dir" ;;
+		save:*) emit_save_step "$slug" "${step#save:}" ;;
+		background:*) emit_background_step "$slug" "${step#background:}" "$fence_dir" ;;
+		wait-http:*) emit_wait_http_step "${step#wait-http:}" ;;
+		*)
+			printf 'tutorial spec error in %s: unknown step: %s\n' "$slug" "$step" >&2
+			exit 2
+			;;
+		esac
+	done
+}
+
+# How many sh fences a spec executes, for the summary line.
+executed_fence_count() {
+	local step range first last total=0
+	for step in ${SPEC_STEPS[@]+"${SPEC_STEPS[@]}"}; do
+		case "$step" in
+		run:*)
+			range="${step#run:}"
+			first="${range%%-*}"
+			last="${range##*-}"
+			total=$((total + last - first + 1))
+			;;
+		background:*) total=$((total + 1)) ;;
+		esac
+	done
+	printf '%d' "$total"
+}
+
+# ---------------------------------------------------------------------------
+# Replay
+# ---------------------------------------------------------------------------
+
+if ((DRY_RUN == 0)) && ((${#EVIDENCE_TUTORIALS[@]} > 0)); then
+	prepare_toolset
+fi
+
+for slug in "${EVIDENCE_TUTORIALS[@]}"; do
+	load_spec "$slug"
+	tutorial_file="$DOCS_ROOT/$slug.mdx"
+	if [[ ! -f "$tutorial_file" ]]; then
+		printf 'Evidence tutorial not found: %s\n' "$tutorial_file" >&2
+		exit 1
+	fi
+
+	# Extract every sh fence, in order, into numbered files.
+	fence_dir="$WORK_ROOT/fences/$slug"
+	mkdir -p "$fence_dir"
+	fence_count="$(awk -v outdir="$fence_dir" '
+		/^```sh$/ { infence = 1; count += 1; next }
+		infence && /^```$/ { infence = 0; next }
+		infence { print > (outdir "/fence-" sprintf("%02d", count) ".sh") }
+		END { print count + 0 }
+	' "$tutorial_file")"
+
+	if [[ "$fence_count" -ne "$SPEC_FENCES" ]]; then
+		printf 'tutorial drift in %s: %s sh fences found, expected %s\n' \
+			"$slug" "$fence_count" "$SPEC_FENCES" >&2
+		printf 'Update SPEC_FENCES and SPEC_STEPS in %s when the change is intentional.\n' \
+			"${BASH_SOURCE[0]}" >&2
+		exit 1
+	fi
+
+	for literal in ${SPEC_LITERALS[@]+"${SPEC_LITERALS[@]}"}; do
+		if ! grep -F -q -- "$literal" "$tutorial_file"; then
+			printf 'tutorial drift in %s: required literal missing: %s\n' \
+				"$slug" "$literal" >&2
+			exit 1
+		fi
+	done
+
+	printf '%s: %s sh fences, %s executed, %s required literals present\n' \
+		"$slug" "$fence_count" "$(executed_fence_count)" "${#SPEC_LITERALS[@]}"
+
+	if ((DRY_RUN)); then
+		continue
+	fi
+
+	# Replay the journey in one shell so `cd` persists exactly as a reader
+	# experiences it, from a reader directory of this tutorial's own.
+	case "$slug" in
+	first-evidence-assertion)
+		reader_dir="$WORK_ROOT/reader/evidence-start"
+		;;
+	return-a-governed-value)
+		reader_dir="$WORK_ROOT/reader/evidence-start/first-evidence-assertion"
+		;;
+	refuse-unsafe-evidence-requests)
+		reader_dir="$WORK_ROOT/reader/evidence-start/first-evidence-assertion"
+		;;
+	verify-an-assertion-as-a-consumer)
+		reader_dir="$WORK_ROOT/reader/evidence-start/first-evidence-assertion"
+		;;
+	*) reader_dir="$WORK_ROOT/reader/$slug" ;;
+	esac
+	mkdir -p "$reader_dir"
+	run_script="$WORK_ROOT/run-$slug.sh"
+	emit_journey "$slug" "$fence_dir" "$tutorial_file" >"$run_script"
+
+	run_log="$WORK_ROOT/run-$slug.log"
+	if ! (cd "$reader_dir" && PATH="$SHIM_DIR:$PATH" bash "$run_script") 2>&1 |
+		tee "$run_log"; then
+		printf 'tutorial %s failed; the transcript ends just before this line\n' \
+			"$slug" >&2
+		exit 1
+	fi
+
+	for expected in ${SPEC_OUTPUTS[@]+"${SPEC_OUTPUTS[@]}"}; do
+		if ! grep -F -q -- "$expected" "$run_log"; then
+			printf 'tutorial output drift in %s: expected "%s" in the transcript\n' \
+				"$slug" "$expected" >&2
+			exit 1
+		fi
+	done
+done
+
+if ((${#EVIDENCE_TUTORIALS[@]} == 1)); then
+	printf 'Checked 1 tutorial.\n'
+else
+	printf 'Checked %d tutorials.\n' "${#EVIDENCE_TUTORIALS[@]}"
+fi
diff --git a/docs/site/scripts/check-evidence-tutorials.test.mjs b/docs/site/scripts/check-evidence-tutorials.test.mjs
new file mode 100644
index 000000000..d8d08f454
--- /dev/null
+++ b/docs/site/scripts/check-evidence-tutorials.test.mjs
@@ -0,0 +1,298 @@
+import assert from 'node:assert/strict';
+import { execFile } from 'node:child_process';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const gate = resolve(scriptDir, 'check-evidence-tutorials.sh');
+const fenceHelper = resolve(scriptDir, 'evidence-tutorial-fence.sh');
+
+async function runGate(env = {}, args = ['--dry-run']) {
+  try {
+    const { stdout, stderr } = await execFileAsync('bash', [gate, ...args], {
+      env: { ...process.env, ...env },
+    });
+    return { code: 0, output: `${stdout}${stderr}` };
+  } catch (error) {
+    return { code: error.code ?? 1, output: `${error.stdout}${error.stderr}` };
+  }
+}
+
+test('the dry-run gate registers the shared Evidence start tutorials', async () => {
+  const { code, output } = await runGate();
+  assert.equal(code, 0, output);
+  assert.match(output, /first-evidence-assertion: 14 sh fences, 12 executed/u);
+  assert.match(output, /return-a-governed-value: 10 sh fences, 10 executed/u);
+  assert.match(output, /assert-a-role-bound-relationship: 9 sh fences, 9 executed/u);
+  assert.match(output, /refuse-unsafe-evidence-requests: 11 sh fences, 11 executed/u);
+  assert.match(output, /verify-an-assertion-as-a-consumer: 3 sh fences, 3 executed/u);
+  assert.match(output, /Checked 5 tutorials\./u);
+});
+
+test('--only accepts the current first Evidence tutorial', async () => {
+  const { code, output } = await runGate({}, [
+    '--dry-run',
+    '--only',
+    'first-evidence-assertion',
+  ]);
+  assert.equal(code, 0, output);
+  assert.match(output, /Checked 1 tutorial\./u);
+});
+
+test('--only accepts the governed-value follow-up', async () => {
+  const { code, output } = await runGate({}, [
+    '--dry-run',
+    '--only',
+    'return-a-governed-value',
+  ]);
+  assert.equal(code, 0, output);
+  assert.match(output, /Checked 1 tutorial\./u);
+});
+
+test('--only accepts the role-bound relationship follow-up', async () => {
+  const { code, output } = await runGate({}, [
+    '--dry-run',
+    '--only',
+    'assert-a-role-bound-relationship',
+  ]);
+  assert.equal(code, 0, output);
+  assert.match(output, /Checked 1 tutorial\./u);
+});
+
+test('--only accepts the refusal follow-up', async () => {
+  const { code, output } = await runGate({}, [
+    '--dry-run',
+    '--only',
+    'refuse-unsafe-evidence-requests',
+  ]);
+  assert.equal(code, 0, output);
+  assert.match(output, /Checked 1 tutorial\./u);
+});
+
+test('--only accepts the consumer follow-up', async () => {
+  const { code, output } = await runGate({}, [
+    '--dry-run',
+    '--only',
+    'verify-an-assertion-as-a-consumer',
+  ]);
+  assert.equal(code, 0, output);
+  assert.match(output, /Checked 1 tutorial\./u);
+});
+
+test('--only refuses a slug that is not registered', async () => {
+  const { code, output } = await runGate({}, ['--dry-run', '--only', 'no-such-tutorial']);
+  assert.notEqual(code, 0, 'an unregistered slug must fail the gate');
+  assert.match(output, /not a registered Evidence tutorial/u);
+});
+
+test('--only refuses an unpublished legacy tutorial', async () => {
+  const { code, output } = await runGate({}, [
+    '--dry-run',
+    '--only',
+    'serve-assertions-over-http',
+  ]);
+  assert.notEqual(code, 0, 'an unpublished tutorial must not be registered');
+  assert.match(output, /not a registered Evidence tutorial/u);
+});
+
+// The replay runs inside a clean Debian userland holding a shell, coreutils
+// and the toolset under test. An interpreter the container does not carry
+// fails mid-journey, where the transcript makes it look like a tutorial
+// defect, so the gate and everything it emits stay on that floor.
+test('the gate depends on no interpreter beyond the replay userland', async () => {
+  const source = await readFile(gate, 'utf8');
+  const offenders = source
+    .split('\n')
+    .map((line, index) => [index + 1, line])
+    .filter(([, line]) => /\b(?:node|npm|npx|python3?|ruby|perl)\b/u.test(line))
+    // A save step names the Markdown fence language as data. It extracts that
+    // fence with the shell helper and does not execute the named interpreter.
+    .filter(([, line]) => !/^\s*"save:[^"]+\|[^|]+\|\d+\|[^"]+",?$/u.test(line));
+  assert.deepEqual(offenders, [], 'the gate must not reach for an interpreter');
+});
+
+async function runFence(args) {
+  try {
+    const { stdout, stderr } = await execFileAsync('bash', [fenceHelper, ...args]);
+    return { code: 0, output: `${stdout}${stderr}` };
+  } catch (error) {
+    return { code: error.code ?? 1, output: `${error.stdout}${error.stderr}` };
+  }
+}
+
+const fenceFixture = [
+  '---',
+  'title: A tutorial',
+  '---',
+  '',
+  '## Add a narrower selector profile',
+  '',
+  'Before:',
+  '',
+  '```yaml',
+  '',
+  'selectors:',
+  '  - kind: broad',
+  '',
+  '```',
+  '',
+  'After:',
+  '',
+  '```yaml',
+  'selectors:',
+  '  - kind: narrow',
+  '```',
+  '',
+  '## Run it',
+  '',
+  '```sh',
+  'evidencectl check',
+  '```',
+  '',
+].join('\n');
+
+async function fenceScratch() {
+  const root = await mkdtemp(join(tmpdir(), 'evidence-fence-test-'));
+  await writeFile(join(root, 'tutorial.mdx'), fenceFixture);
+  return root;
+}
+
+test('write-fence extracts one fence by heading, language and occurrence', async () => {
+  const root = await fenceScratch();
+  try {
+    const out = join(root, 'before.yaml');
+    const { code, output } = await runFence([
+      'write-fence',
+      join(root, 'tutorial.mdx'),
+      'Add a narrower selector profile',
+      'yaml',
+      '1',
+      out,
+    ]);
+    assert.equal(code, 0, output);
+    // Blank lines at the edges of a fence are presentation, so they are
+    // trimmed exactly as the published fence renders.
+    assert.equal(await readFile(out, 'utf8'), 'selectors:\n  - kind: broad\n');
+
+    const second = join(root, 'after.yaml');
+    assert.equal((await runFence([
+      'write-fence',
+      join(root, 'tutorial.mdx'),
+      'Add a narrower selector profile',
+      'yaml',
+      '2',
+      second,
+    ])).code, 0);
+    assert.equal(await readFile(second, 'utf8'), 'selectors:\n  - kind: narrow\n');
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('write-fence counts occurrences per heading and language', async () => {
+  const root = await fenceScratch();
+  try {
+    const out = join(root, 'sh.txt');
+    // The sh fence under a later heading is that heading's first, not the
+    // document's third.
+    const { code, output } = await runFence([
+      'write-fence',
+      join(root, 'tutorial.mdx'),
+      'Run it',
+      'sh',
+      '1',
+      out,
+    ]);
+    assert.equal(code, 0, output);
+    assert.equal(await readFile(out, 'utf8'), 'evidencectl check\n');
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('write-fence names the fence it could not find', async () => {
+  const root = await fenceScratch();
+  try {
+    const { code, output } = await runFence([
+      'write-fence',
+      join(root, 'tutorial.mdx'),
+      'Add a narrower selector profile',
+      'yaml',
+      '3',
+      join(root, 'missing.yaml'),
+    ]);
+    assert.notEqual(code, 0, 'a missing fence must fail');
+    assert.match(output, /missing yaml fence 3 under "Add a narrower selector profile"/u);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('replace-block applies a documented pair to the reader file', async () => {
+  const root = await fenceScratch();
+  try {
+    const target = join(root, 'evidence.yaml');
+    await writeFile(target, 'version: 1\nselectors:\n  - kind: broad\ntrailer: keep\n');
+    await writeFile(join(root, 'b'), 'selectors:\n  - kind: broad\n');
+    await writeFile(join(root, 'a'), 'selectors:\n  - kind: narrow\n');
+    const { code, output } = await runFence([
+      'replace-block',
+      target,
+      join(root, 'b'),
+      join(root, 'a'),
+    ]);
+    assert.equal(code, 0, output);
+    assert.equal(
+      await readFile(target, 'utf8'),
+      'version: 1\nselectors:\n  - kind: narrow\ntrailer: keep\n',
+    );
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('replace-block refuses a block that is not in the target exactly once', async () => {
+  const root = await fenceScratch();
+  try {
+    const target = join(root, 'evidence.yaml');
+    await writeFile(join(root, 'b'), 'kind: broad\n');
+    await writeFile(join(root, 'a'), 'kind: narrow\n');
+
+    await writeFile(target, 'kind: broad\nkind: broad\n');
+    const twice = await runFence(['replace-block', target, join(root, 'b'), join(root, 'a')]);
+    assert.notEqual(twice.code, 0, 'an ambiguous edit must fail');
+    assert.match(twice.output, /found 2/u);
+
+    await writeFile(target, 'kind: other\n');
+    const never = await runFence(['replace-block', target, join(root, 'b'), join(root, 'a')]);
+    assert.notEqual(never.code, 0, 'an edit with nothing to change must fail');
+    assert.match(never.output, /found 0/u);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('replace-block refuses a pair that changes nothing', async () => {
+  const root = await fenceScratch();
+  try {
+    const target = join(root, 'evidence.yaml');
+    await writeFile(target, 'kind: broad\n');
+    await writeFile(join(root, 'b'), 'kind: broad\n');
+    await writeFile(join(root, 'a'), 'kind: broad\n');
+    const { code, output } = await runFence([
+      'replace-block',
+      target,
+      join(root, 'b'),
+      join(root, 'a'),
+    ]);
+    assert.notEqual(code, 0, 'a pair that changes nothing is a spec error');
+    assert.match(output, /must change the target/u);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
diff --git a/docs/site/scripts/check-llms.mjs b/docs/site/scripts/check-llms.mjs
index ac10c8ae6..7b28b815e 100644
--- a/docs/site/scripts/check-llms.mjs
+++ b/docs/site/scripts/check-llms.mjs
@@ -11,6 +11,7 @@ import { readFile, access, readdir } from 'node:fs/promises';
 import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import YAML from 'yaml';
+import { isGeneratedApiDir } from '../src/lib/generated-api-bases.mjs';
 
 const here = fileURLToPath(new URL('.', import.meta.url));
 const distDir = process.env.DOCS_DIST_DIR
@@ -289,13 +290,7 @@ if (await exists(archFile)) {
 // starlight-openapi injects the API reference operation pages as virtual routes
 // (not docs content-collection entries), so they have no per-page .md twin. They
 // are excluded from the llms corpus (reference/apis/** in astro.config.mjs) and
-// from this coverage check. Matches the generated bases reference/apis/relay and
-// reference/apis/notary, but NOT the hand-authored narrative pages
-// reference/apis/registry-relay / registry-notary, which keep their .md.
-const generatedApiBases = ['reference/apis/relay', 'reference/apis/notary'];
-const isGeneratedApiPage = (dir) =>
-  generatedApiBases.some((b) => dir === b || dir.startsWith(`${b}/`));
-
+// from this coverage check.
 const pageDirs = await findPageDirs();
 let covered = 0;
 let skipped = 0;
@@ -304,7 +299,7 @@ for (const dir of pageDirs) {
     skipped += 1;
     continue;
   }
-  if (isGeneratedApiPage(dir)) {
+  if (isGeneratedApiDir(dir)) {
     skipped += 1; // plugin-generated API route, no backing .md by design
     continue;
   }
diff --git a/docs/site/scripts/check-notary-surface.mjs b/docs/site/scripts/check-notary-surface.mjs
new file mode 100644
index 000000000..84be20cd3
--- /dev/null
+++ b/docs/site/scripts/check-notary-surface.mjs
@@ -0,0 +1,184 @@
+import { readFile, readdir } from 'node:fs/promises';
+import { relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const scriptPath = fileURLToPath(import.meta.url);
+const defaultSiteRoot = resolve(import.meta.dirname, '..');
+
+// Registry Notary is retired, and no adopter ever ran it, so a current page has
+// nobody to orient: naming the product only to say it is gone leaves the reader
+// carrying a name that means nothing to them. The record of the retirement
+// lives on the history pages. Two things survive on the product surface.
+//
+// The identifier outlived the product. A frozen posture shape, a Relay startup
+// validator, a manifest access kind, and a pinned image name all still spell
+// `registry-notary`, and a page documenting one of those has to write it down.
+// Written as code, the word is an identifier and not a product on offer.
+const codeSpan = /`[^`]*`/gu;
+
+// Evidence's approved Version 1 contracts are frozen. They record what was
+// approved on the day it was approved, so a docs pass cannot edit one; that
+// needs a recorded re-approval. The mirrored page names the file it was
+// generated from in `editUrl`.
+const frozenEvidenceContracts = [
+  'products/evidence/CONCEPT.md',
+  'products/evidence/IMPLEMENTATION.md',
+  'products/evidence/SOURCE-TESTING.md',
+  'products/evidence/OPERATOR-CONTRACT.md',
+  'products/evidence/reference/request-adapter/ADAPTER-API.md',
+  'products/evidence/reference/request-adapter/deployment-projects/CONFIG.md',
+  'products/evidence/reference/request-adapter/deployment-projects/FIXTURES.md',
+];
+
+// A specification's version table is that document's own history, held to the
+// same rule as the changelog and the decision records. `blocks()` gives each
+// table row separately, so this matches a row and never the prose around it.
+const versionHistoryRow = /^\|\s*\d+\.\d+(?:\.\d+)?\s*\|\s*\d{4}-\d{2}-\d{2}\s*\|/u;
+
+async function markdownFiles(directory) {
+  const entries = await readdir(directory, { withFileTypes: true });
+  const paths = [];
+  for (const entry of entries) {
+    const path = resolve(directory, entry.name);
+    if (entry.isDirectory()) paths.push(...(await markdownFiles(path)));
+    else if (entry.isFile() && entry.name.endsWith('.mdx')) paths.push(path);
+  }
+  return paths;
+}
+
+function frontmatter(source, path) {
+  const match = source.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/u);
+  if (!match) throw new Error(`${path} has no frontmatter`);
+  return {
+    status: match[1].match(/^status:[ \t]*(\S.*)$/mu)?.[1]?.trim(),
+    draft: /^draft:[ \t]*true[ \t]*$/mu.test(match[1]),
+    editUrl: match[1].match(/^editUrl:[ \t]*(\S.*)$/mu)?.[1]?.trim(),
+  };
+}
+
+function isFrozenEvidenceContract(editUrl) {
+  return Boolean(editUrl) && frozenEvidenceContracts.some((path) => editUrl.endsWith(`/${path}`));
+}
+
+// A fenced block is code for the reason an inline span is: the reader meets an
+// identifier, not a product on offer. Mermaid is the exception, because a
+// diagram's participant and message labels are prose the reader reads as
+// prose. Dropped lines are blanked rather than removed so line numbers survive.
+function withoutCodeFences(source) {
+  let marker = null;
+  let keep = false;
+  return source
+    .split('\n')
+    .map((line) => {
+      const fence = line.match(/^\s*(`{3,}|~{3,})\s*(\S*)/u);
+      if (marker === null) {
+        if (!fence) return line;
+        marker = fence[1].slice(0, 3);
+        keep = fence[2].toLowerCase() === 'mermaid';
+        return '';
+      }
+      if (fence && fence[1].startsWith(marker) && !fence[2]) {
+        marker = null;
+        return '';
+      }
+      return keep ? line : '';
+    })
+    .join('\n');
+}
+
+// `status: draft` marks a page as under review; it does not hide it, so a
+// reader still meets it. `status: historical` and `deprecated` are the marked
+// past, and `draft: true` is unpublished.
+function isProductSurface(status) {
+  return status === 'current' || status === 'draft';
+}
+
+// History keeps the name: the changelog and the decision records are the record
+// of what happened, not a description of what to run.
+function isHistoryPage(siteRelative) {
+  return (
+    siteRelative.startsWith('src/content/docs/decisions/') ||
+    /\/(?:changelog|release-notes)(?:\/index)?\.mdx$/u.test(siteRelative)
+  );
+}
+
+// A table row or list item stands alone; ordinary prose is judged by paragraph,
+// because a sentence is hard-wrapped across several lines.
+function blocks(source) {
+  const found = [];
+  let start = 0;
+  let text = '';
+  const flush = () => {
+    if (text.trim()) found.push({ text, start });
+    text = '';
+  };
+  let offset = 0;
+  for (const line of source.split('\n')) {
+    const standalone = /^\s*(?:[|*-]|\d+\.)/u.test(line);
+    if (!line.trim() || standalone) flush();
+    if (line.trim()) {
+      if (!text) start = offset;
+      text += `${line}\n`;
+      if (standalone) flush();
+    }
+    offset += line.length + 1;
+  }
+  flush();
+  return found;
+}
+
+function lineNumber(source, index) {
+  return source.slice(0, index).split('\n').length;
+}
+
+export async function findNotaryMentions(siteRoot = defaultSiteRoot) {
+  const contentRoot = resolve(siteRoot, 'src/content/docs');
+  const findings = [];
+  for (const path of await markdownFiles(contentRoot)) {
+    const source = await readFile(path, 'utf8');
+    const metadata = frontmatter(source, path);
+    const siteRelative = relative(siteRoot, path);
+    if (
+      !isProductSurface(metadata.status) ||
+      metadata.draft ||
+      isHistoryPage(siteRelative) ||
+      isFrozenEvidenceContract(metadata.editUrl)
+    ) {
+      continue;
+    }
+    const prose = withoutCodeFences(source);
+    for (const block of blocks(prose)) {
+      if (!/notary/iu.test(block.text)) continue;
+      if (versionHistoryRow.test(block.text.trim())) continue;
+      if (!/notary/iu.test(block.text.replace(codeSpan, ''))) continue;
+      findings.push({
+        path: siteRelative,
+        line: lineNumber(prose, block.start),
+        excerpt: block.text.trim().split('\n')[0].slice(0, 90),
+      });
+    }
+  }
+  return findings.sort(
+    (left, right) => left.path.localeCompare(right.path) || left.line - right.line,
+  );
+}
+
+export async function checkNotarySurface(siteRoot = defaultSiteRoot) {
+  const findings = await findNotaryMentions(siteRoot);
+  if (findings.length === 0) return;
+  throw new Error(
+    [
+      'Current documentation names Registry Notary, which no adopter can meet.',
+      ...findings.map(({ path, line, excerpt }) => `${path}:${line}: ${excerpt}`),
+      'Rewrite the page around Registry Relay, Evidence, and Registry Mint. Leave',
+      'the retirement itself to the decision record and the changelog. Where a',
+      'shipped schema, validator, or image name still spells the identifier,',
+      'write it as code and say nothing about the product behind it.',
+    ].join('\n'),
+  );
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === scriptPath) {
+  await checkNotarySurface();
+  console.log('Notary surface check passed: no current page names Registry Notary.');
+}
diff --git a/docs/site/scripts/check-notary-surface.test.mjs b/docs/site/scripts/check-notary-surface.test.mjs
new file mode 100644
index 000000000..98948750a
--- /dev/null
+++ b/docs/site/scripts/check-notary-surface.test.mjs
@@ -0,0 +1,264 @@
+import assert from 'node:assert/strict';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, resolve } from 'node:path';
+import { test } from 'node:test';
+
+import { checkNotarySurface, findNotaryMentions } from './check-notary-surface.mjs';
+
+async function writePage(root, relative, frontmatter, body) {
+  const path = resolve(root, 'src/content/docs', relative);
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, `---\n${frontmatter}\n---\n\n${body}\n`);
+}
+
+async function withSite(run) {
+  const root = await mkdtemp(resolve(tmpdir(), 'registry-notary-surface-'));
+  try {
+    await run(root);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+}
+
+test('rejects a current page that describes Notary as a product to use', async () => {
+  await withSite(async (root) => {
+    await writePage(
+      root,
+      'explanation/architecture.mdx',
+      'status: current',
+      [
+        'Registry Notary evaluates claims from compiler-pinned Relay',
+        'consultations and issues credentials.',
+        '',
+        '| Evidence Gateway | A caller needs a status. | Registry Notary |',
+      ].join('\n'),
+    );
+
+    const findings = await findNotaryMentions(root);
+    assert.deepEqual(
+      findings.map(({ line }) => line),
+      [5, 8],
+    );
+    await assert.rejects(
+      checkNotarySurface(root),
+      /src\/content\/docs\/explanation\/architecture\.mdx:5: Registry Notary evaluates claims/u,
+    );
+  });
+});
+
+// The light-touch pass framed each mention as retired. The final sweep goes
+// further: an adopter meets a product whose name is gone, so a current page
+// carries no retirement note at all.
+test('rejects a current page that names Notary only to say it is retired', async () => {
+  await withSite(async (root) => {
+    await writePage(
+      root,
+      'reference/api-stability.mdx',
+      'status: current',
+      [
+        'Registry Notary is retired. The stability promises below cover',
+        'Registry Relay, Evidence, and Registry Mint.',
+        '',
+        '| Registry Notary | Retired | No stability promise remains. |',
+      ].join('\n'),
+    );
+
+    const findings = await findNotaryMentions(root);
+    assert.deepEqual(
+      findings.map(({ line }) => line),
+      [5, 8],
+    );
+  });
+});
+
+// The identifier outlived the product: a frozen schema, a validator, and a
+// pinned image name still spell it. A page documenting one of those has to be
+// able to write it down.
+test('accepts a shipped identifier written as code', async () => {
+  await withSite(async (root) => {
+    await writePage(
+      root,
+      'spec/rs-op-posture.mdx',
+      'status: draft',
+      [
+        'A document declares `component` as exactly one of `registry-relay` and',
+        '`registry-notary`, the retired component whose shape the frozen v1',
+        'contract still models.',
+        '',
+        '| `registry-notary` | `notary` | `relay` |',
+      ].join('\n'),
+    );
+
+    assert.deepEqual(await findNotaryMentions(root), []);
+    await assert.doesNotReject(checkNotarySurface(root));
+  });
+});
+
+test('rejects a block that pairs a shipped identifier with the product name', async () => {
+  await withSite(async (root) => {
+    await writePage(
+      root,
+      'reference/errors.mdx',
+      'status: current',
+      '| The offering is not `registry-notary`, and Registry Notary is retired. |',
+    );
+
+    assert.deepEqual(
+      (await findNotaryMentions(root)).map(({ path }) => path),
+      ['src/content/docs/reference/errors.mdx'],
+    );
+  });
+});
+
+// A specification's version table is that document's own history, held to the
+// same rule as the changelog and the decision records.
+test('accepts a specification version-history row', async () => {
+  await withSite(async (root) => {
+    await writePage(
+      root,
+      'spec/rs-sec-g.mdx',
+      'status: draft',
+      [
+        '| Version | Date | Status | Change |',
+        '| --- | --- | --- | --- |',
+        '| 0.5.0 | 2026-08-03 | draft | Registry Notary is retired. Removed Section 7. |',
+      ].join('\n'),
+    );
+
+    assert.deepEqual(await findNotaryMentions(root), []);
+  });
+});
+
+test('skips the marked past and unpublished pages', async () => {
+  await withSite(async (root) => {
+    const claim = 'Registry Notary issues credentials through OID4VCI.';
+    await writePage(root, 'unpublished.mdx', 'status: current\ndraft: true', claim);
+    await writePage(root, 'old.mdx', 'status: historical', claim);
+    await writePage(root, 'superseded.mdx', 'status: deprecated', claim);
+    await writePage(root, 'changelog.mdx', 'status: current', claim);
+    await writePage(root, 'decisions/rename-2026-05-23.mdx', 'status: current', claim);
+
+    assert.deepEqual(await findNotaryMentions(root), []);
+  });
+});
+
+// The mirrored crate docs are published at /products/<repo>/<page>/ and are as
+// current as any authored page. An adopter reading the Relay runbook is on the
+// product surface, so the source under `crates/` is held to the same rule.
+test('holds a page mirrored from a crate doc to the same rule', async () => {
+  await withSite(async (root) => {
+    await writePage(
+      root,
+      'products/registry-relay/ops.mdx',
+      'status: current',
+      'Use Registry Notary for credential issuance and signing-key operations.',
+    );
+
+    assert.deepEqual(
+      (await findNotaryMentions(root)).map(({ path }) => path),
+      ['src/content/docs/products/registry-relay/ops.mdx'],
+    );
+  });
+});
+
+// Editing a frozen contract needs a recorded re-approval, not a docs pass, so
+// the checker cannot ask for one.
+test('skips a page mirrored from a frozen Evidence Version 1 contract', async () => {
+  await withSite(async (root) => {
+    await writePage(
+      root,
+      'products/registry-evidence/concept.mdx',
+      [
+        'status: draft',
+        'editUrl: https://github.com/registrystack/registry-stack/blob/HEAD/products/evidence/CONCEPT.md',
+      ].join('\n'),
+      'Evidence is not a rewrite or reduced configuration of Registry Notary.',
+    );
+
+    assert.deepEqual(await findNotaryMentions(root), []);
+  });
+});
+
+// A request example has to show the wire, and the wire still spells the
+// identifier. The rule is the same one code spans get.
+test('accepts a shipped identifier inside a fenced code block', async () => {
+  await withSite(async (root) => {
+    await writePage(
+      root,
+      'products/registry-relay/api.mdx',
+      'status: current',
+      [
+        'Execute only after the calling workload has pinned that contract:',
+        '',
+        '```http',
+        'POST /v1/consultations/person-status/execute',
+        'Registry-Notary-Evaluation-Id: 01JYZZZZZZZZZZZZZZZZZZZZZZ',
+        '```',
+      ].join('\n'),
+    );
+
+    assert.deepEqual(await findNotaryMentions(root), []);
+    await assert.doesNotReject(checkNotarySurface(root));
+  });
+});
+
+// A diagram is not code: its participant and message labels are the page's
+// prose, and a reader meets the product name there exactly as in a sentence.
+test('rejects a mermaid diagram that names the product', async () => {
+  await withSite(async (root) => {
+    await writePage(
+      root,
+      'products/registry-relay/client-integration.mdx',
+      'status: current',
+      [
+        '```mermaid',
+        'sequenceDiagram',
+        '  participant Notary as Registry Notary',
+        '  Client->>Notary: Submit claim or evidence',
+        '```',
+      ].join('\n'),
+    );
+
+    assert.deepEqual(
+      (await findNotaryMentions(root)).map(({ line, excerpt }) => [line, excerpt]),
+      [[6, 'sequenceDiagram']],
+    );
+  });
+});
+
+test('holds status: draft pages to the same rule, because they are still published', async () => {
+  for (const status of ['status: draft', 'status: current']) {
+    await withSite(async (root) => {
+      await writePage(
+        root,
+        'explanation/threat-model.mdx',
+        status,
+        'Registry Notary owns claim evaluation and credential issuance.',
+      );
+
+      const findings = await findNotaryMentions(root);
+      assert.deepEqual(
+        findings.map(({ path }) => path),
+        ['src/content/docs/explanation/threat-model.mdx'],
+        `${status} pages are part of the product surface`,
+      );
+    });
+  }
+});
+
+// The light-touch pass is finished, so the checker has no waiver list. Every
+// current product-surface page is held to the same rule.
+test('holds every current product-surface page, with no page-level waiver', async () => {
+  await withSite(async (root) => {
+    const claim = 'Registry Notary issues credentials through OID4VCI.';
+    await writePage(root, 'operate/backup-and-restore.mdx', 'status: current', claim);
+    await writePage(root, 'operate/single-node-compose-behind-proxy.mdx', 'status: current', claim);
+
+    const findings = await findNotaryMentions(root);
+    assert.deepEqual(findings.map(({ path }) => path), [
+      'src/content/docs/operate/backup-and-restore.mdx',
+      'src/content/docs/operate/single-node-compose-behind-proxy.mdx',
+    ]);
+  });
+});
diff --git a/docs/site/scripts/check-registryctl-tutorials.sh b/docs/site/scripts/check-registryctl-tutorials.sh
index b4b42ed2a..5c37307e8 100755
--- a/docs/site/scripts/check-registryctl-tutorials.sh
+++ b/docs/site/scripts/check-registryctl-tutorials.sh
@@ -23,7 +23,6 @@ if [[ -n "$RELEASED_DOCS_ROOT" ]]; then
 	HTTP_TUTORIAL="$RELEASED_DOCS_ROOT/tutorials/author-registry-project.md"
 	SPREADSHEET_TUTORIAL="$RELEASED_DOCS_ROOT/tutorials/publish-spreadsheet-secured-registry-api.md"
 	USE_SPREADSHEET_TUTORIAL="$RELEASED_DOCS_ROOT/tutorials/use-your-spreadsheet.md"
-	EVIDENCE_TUTORIAL="$RELEASED_DOCS_ROOT/tutorials/verify-claim-registry-api.md"
 	OAUTH_TUTORIAL="$RELEASED_DOCS_ROOT/tutorials/configure-project-script-adapter.md"
 	OAUTH_HOWTO="$RELEASED_DOCS_ROOT/configure/oauth-client-credentials.md"
 	OPENCRVS_TUTORIAL="$RELEASED_DOCS_ROOT/tutorials/verify-opencrvs-claims.md"
@@ -33,7 +32,6 @@ else
 	HTTP_TUTORIAL="$SITE_ROOT/src/content/docs/tutorials/author-registry-project.mdx"
 	SPREADSHEET_TUTORIAL="$SITE_ROOT/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx"
 	USE_SPREADSHEET_TUTORIAL="$SITE_ROOT/src/content/docs/tutorials/use-your-spreadsheet.mdx"
-	EVIDENCE_TUTORIAL="$SITE_ROOT/src/content/docs/tutorials/verify-claim-registry-api.mdx"
 	OAUTH_TUTORIAL="$SITE_ROOT/src/content/docs/tutorials/configure-project-script-adapter.mdx"
 	OAUTH_HOWTO="$SITE_ROOT/src/content/docs/configure/oauth-client-credentials.mdx"
 	OPENCRVS_TUTORIAL="$SITE_ROOT/src/content/docs/tutorials/verify-opencrvs-claims.mdx"
@@ -150,15 +148,6 @@ node "$HELPER" assert-contains "$SPREADSHEET_TUTORIAL" \
 	'registryctl dev smoke' \
 	'registryctl check --explain' \
 	'registryctl build'
-node "$HELPER" assert-contains "$EVIDENCE_TUTORIAL" \
-	'project-status-accepted' \
-	'project.status == "planned"' \
-	'default_fixture: planned' \
-	'registryctl dev --detach' \
-	'registryctl dev smoke' \
-	'registryctl dev down' \
-	'registryctl check --explain' \
-	'registryctl build'
 node "$HELPER" assert-contains "$OAUTH_HOWTO" \
 	'request: form' \
 	'request: json' \
@@ -179,8 +168,8 @@ node "$HELPER" assert-contains "$OPENCRVS_TUTORIAL" \
 	'OAuth' \
 	'Rhai' \
 	'POST /api/events/events/search' \
-	'birth-event-found' \
-	'birth-event-registered' \
+	'birth-event-verification' \
+	'kind: consultation_api' \
 	'opencrvs-events-api-overlay-v1.sh' \
 	'OVERLAY_URL="https://docs.registrystack.org/v/$REGISTRYCTL_VERSION/examples/registryctl/$OVERLAY"' \
 	'registryctl test' \
@@ -290,7 +279,7 @@ run_reports() {
 			"$report_directory/build.json"
 	fi
 
-	for lane in relay-public relay-consultation notary; do
+	for lane in relay-public relay-consultation; do
 		test -f \
 			"$project_directory/.registry-stack/build/local/signing-inputs/$lane/signing-input.v1.json"
 	done
@@ -314,8 +303,6 @@ run_spreadsheet_runtime() {
 	local status=$6
 	local records_denied_config
 	local records_config
-	local evidence_config
-	local evidence_body
 	local denied_status
 
 	if [[ "$RUNNER_MODE" != "sealed" ]]; then
@@ -332,17 +319,9 @@ run_spreadsheet_runtime() {
 	records_config="$(find \
 		"$project_directory/.registry-stack/dev/local" \
 		-type f -path '*/credentials/records-request.curl' -print)"
-	evidence_config="$(find \
-		"$project_directory/.registry-stack/dev/local" \
-		-type f -path '*/credentials/request.curl' -print)"
-	evidence_body="$(find \
-		"$project_directory/.registry-stack/dev/local" \
-		-type f -path '*/credentials/request.json' -print)"
 	for request_artifact in \
 		"$records_denied_config" \
-		"$records_config" \
-		"$evidence_config" \
-		"$evidence_body"; do
+		"$records_config"; do
 		if [[ -z "$request_artifact" || "$request_artifact" == *$'\n'* ]]; then
 			printf 'expected exactly one generated development request artifact per public journey\n' >&2
 			exit 1
@@ -350,10 +329,8 @@ run_spreadsheet_runtime() {
 	done
 	node "$HELPER" assert-contains "$report_directory/dev-start.txt" \
 		'Relay API: http://127.0.0.1:4242' \
-		'Evidence API: http://127.0.0.1:4243' \
 		"Records denied request: curl --config '$records_denied_config'" \
-		"Records request: curl --config '$records_config'" \
-		"Evidence request: curl --config '$evidence_config'"
+		"Records request: curl --config '$records_config'"
 	denied_status="$(curl --silent --show-error \
 		--config "$records_denied_config" \
 		--no-include \
@@ -373,24 +350,13 @@ run_spreadsheet_runtime() {
 	node "$HELPER" assert-not-contains "$report_directory/records-request.json" \
 		'PW-002' \
 		'PW-003'
-	node "$HELPER" assert-json-subset "$evidence_body" \
-		"{\"target\":{\"identifiers\":[{\"scheme\":\"project_id\",\"value\":\"$project_id\"}]}}"
-	curl --silent --show-error --config "$evidence_config" \
-		>"$report_directory/evidence-request.json"
-	node "$HELPER" assert-json-subset "$report_directory/evidence-request.json" \
-		'{"results":[{"claim_id":"project-record-exists","value":true,"satisfied":true,"disclosure":"predicate"},{"claim_id":"project-status-accepted","value":true,"satisfied":true,"disclosure":"predicate"}]}'
-	node "$HELPER" assert-not-contains "$report_directory/evidence-request.json" \
-		'north-01' \
-		'water' \
-		'active' \
-		'planned'
 	"$REGISTRYCTL_BIN" -C "$project_directory" dev smoke \
 		>"$report_directory/dev-smoke.txt"
 	node "$HELPER" assert-contains "$report_directory/dev-smoke.txt" \
 		'Development smoke: passed.' \
 		'unauthorized: status=denied; passed=true; token_counter_delta=unobserved; source_counter_delta=unobserved' \
 		'authorized: status=authorized; passed=true; token_counter_delta=unobserved; source_counter_delta=unobserved' \
-		'minimized_claim_ids=project-record-exists,project-status-accepted'
+		'minimized_claim_ids=none'
 	"$REGISTRYCTL_BIN" -C "$project_directory" dev down \
 		>"$report_directory/dev-down.txt"
 	ACTIVE_DEV_PROJECT=""
@@ -400,7 +366,6 @@ run_synthetic_runtime() {
 	local project_directory=$1
 	local report_directory=$2
 	local expected_token_delta=$3
-	local expected_claim_ids=$4
 
 	if [[ "$RUNNER_MODE" != "sealed" ]]; then
 		return
@@ -411,12 +376,10 @@ run_synthetic_runtime() {
 	"$REGISTRYCTL_BIN" -C "$project_directory" dev --detach \
 		>"$report_directory/dev-start.txt"
 	node "$HELPER" assert-contains "$report_directory/dev-start.txt" \
-		'Relay API: http://127.0.0.1:4242' \
-		'Evidence API: http://127.0.0.1:4243' \
-		'Evidence request: curl --config '
+		'Relay API: http://127.0.0.1:4242'
 	if find "$project_directory/.registry-stack/dev/local" -type f \
-		\( -name 'relay-*-tls.*' -o -name 'notary-tls.*' \) -print -quit | grep -q .; then
-		printf 'development runtime generated obsolete product listener TLS material\n' >&2
+		-name 'relay-*-tls.*' -print -quit | grep -q .; then
+		printf 'development runtime generated obsolete listener TLS material\n' >&2
 		exit 1
 	fi
 	"$REGISTRYCTL_BIN" -C "$project_directory" dev smoke \
@@ -425,7 +388,7 @@ run_synthetic_runtime() {
 		'Development smoke: passed.' \
 		'unauthorized: status=denied; passed=true; token_counter_delta=0; source_counter_delta=0' \
 		"authorized: status=authorized; passed=true; token_counter_delta=$expected_token_delta; source_counter_delta=1" \
-		"minimized_claim_ids=$expected_claim_ids"
+		'minimized_claim_ids=none'
 	"$REGISTRYCTL_BIN" -C "$project_directory" dev down \
 		>"$report_directory/dev-down.txt"
 	ACTIVE_DEV_PROJECT=""
@@ -446,8 +409,7 @@ run_reports "$HTTP_PROJECT" http
 run_synthetic_runtime \
 	"$HTTP_PROJECT" \
 	"$REPORT_ROOT/http/runtime" \
-	0 \
-	'person-record-exists'
+	0
 (
 	cd "$HTTP_PROJECT"
 	"$REGISTRYCTL_BIN" test
@@ -595,67 +557,6 @@ run_spreadsheet_runtime \
 	active
 printf 'Adapted spreadsheet reader journey: PASS\n'
 
-EVIDENCE_PROJECT="$SPREADSHEET_PROJECT"
-EVIDENCE_REPORT="$REPORT_ROOT/spreadsheet-evidence"
-mkdir -p "$EVIDENCE_REPORT"
-(
-	cd "$EVIDENCE_PROJECT"
-	"$REGISTRYCTL_BIN" test \
-		--integration project-record-snapshot \
-		--fixture planned \
-		--trace
-) >"$EVIDENCE_REPORT/before-trace.txt"
-node "$HELPER" assert-contains "$EVIDENCE_REPORT/before-trace.txt" \
-	'PASS project-record-snapshot.planned' \
-	'claims: project-record-exists'
-
-node "$HELPER" replace-fence-pair \
-	"$EVIDENCE_TUTORIAL" \
-	'Change the authored evidence rule' yaml 1 \
-	'Change the authored evidence rule' yaml 2 \
-	"$EVIDENCE_PROJECT/registry-stack.yaml"
-node "$HELPER" replace-fence-pair \
-	"$EVIDENCE_TUTORIAL" \
-	'Observe the current policy result' yaml 1 \
-	'Change the authored evidence rule' yaml 3 \
-	"$EVIDENCE_PROJECT/integrations/project-record-snapshot/fixtures/planned.yaml"
-node "$HELPER" replace-fence-pair \
-	"$EVIDENCE_TUTORIAL" \
-	'Run the changed Relay and Notary path' yaml 1 \
-	'Run the changed Relay and Notary path' yaml 2 \
-	"$EVIDENCE_PROJECT/environments/local.yaml"
-
-(
-	cd "$EVIDENCE_PROJECT"
-	"$REGISTRYCTL_BIN" test \
-		--integration project-record-snapshot \
-		--fixture planned \
-		--trace
-) >"$EVIDENCE_REPORT/after-trace.txt"
-node "$HELPER" assert-contains "$EVIDENCE_REPORT/after-trace.txt" \
-	'PASS project-record-snapshot.planned' \
-	'claims: project-record-exists, project-status-accepted' \
-	'outcome: match'
-(
-	cd "$EVIDENCE_PROJECT"
-	"$REGISTRYCTL_BIN" test
-) >"$EVIDENCE_REPORT/test.txt"
-
-run_spreadsheet_runtime \
-	"$EVIDENCE_PROJECT" \
-	"$EVIDENCE_REPORT/runtime" \
-	PW-002 \
-	central-02 \
-	health \
-	planned
-
-run_reports \
-	"$EVIDENCE_PROJECT" \
-	spreadsheet-evidence \
-	fictional-public-works-registry \
-	snapshot
-printf 'Spreadsheet evidence-change reader journey: PASS\n'
-
 PUBLIC_SOURCE_PROJECT="$WORK_ROOT/public-source-reader"
 "$REGISTRYCTL_BIN" init "$PUBLIC_SOURCE_PROJECT" --template http \
 	>"$REPORT_ROOT/public-source-init.txt"
@@ -720,7 +621,7 @@ node "$HELPER" assert-fence-in-file \
 node "$HELPER" assert-fence-file-equals \
 	"$OPENCRVS_TUTORIAL" 'Map the minimized outputs' rhai 1 "$OPENCRVS_ADAPTER"
 node "$HELPER" assert-fence-in-file \
-	"$OPENCRVS_TUTORIAL" 'Keep one consultation-backed claim' yaml 1 "$OPENCRVS_PROJECT_FILE"
+	"$OPENCRVS_TUTORIAL" 'Keep one consultation-backed service' yaml 1 "$OPENCRVS_PROJECT_FILE"
 node "$HELPER" assert-fence-file-equals \
 	"$OPENCRVS_TUTORIAL" 'Author the synthetic match fixture' yaml 1 "$OPENCRVS_MATCH"
 
@@ -748,15 +649,12 @@ node "$HELPER" assert-contains "$REPORT_ROOT/opencrvs-check-explain.txt" \
 	'registry.project.explanation.v1' \
 	'birth-event-search' \
 	'birth-event-verification' \
-	'oauth2_client_credentials' \
-	'birth-event-found' \
-	'birth-event-registered'
+	'oauth2_client_credentials'
 run_reports "$OPENCRVS_PROJECT" opencrvs
 run_synthetic_runtime \
 	"$OPENCRVS_PROJECT" \
 	"$REPORT_ROOT/opencrvs/runtime" \
-	1 \
-	'birth-event-found,birth-event-registered'
+	1
 printf 'OAuth and Rhai reader journey: PASS\n'
 printf 'OpenCRVS Events API case-study journey: PASS\n'
 
diff --git a/docs/site/scripts/check-svg-a11y.mjs b/docs/site/scripts/check-svg-a11y.mjs
index 69a4d7577..cf3905582 100644
--- a/docs/site/scripts/check-svg-a11y.mjs
+++ b/docs/site/scripts/check-svg-a11y.mjs
@@ -5,12 +5,8 @@ const imageDir = 'public/images';
 const expected = new Set([
   'registry-family-map.svg',
   'registry-architecture-flow.svg',
-  'registry-claim-model.svg',
   'registry-country-evidence-mesh.svg',
-  'registry-evidence-transports.svg',
-  'registry-notary-three-parties.svg',
   'registry-publishing-pipeline.svg',
-  'registry-relay-or-notary.svg',
   'registry-relay-request-lifecycle.svg',
   'registry-relay-two-rooms.svg',
   'registry-trust-boundaries.svg',
diff --git a/docs/site/scripts/check-tutorial.sh b/docs/site/scripts/check-tutorial.sh
index 5cfd5acea..3175b0374 100755
--- a/docs/site/scripts/check-tutorial.sh
+++ b/docs/site/scripts/check-tutorial.sh
@@ -30,6 +30,11 @@
 #   SOLMARA_LAB_REF    commit to clone when SOLMARA_LAB_PATH is unset.
 #                      This pins the check's own reproducibility; the
 #                      tutorial itself tells readers to clone `main`.
+#   REGISTRY_STACK_SOURCE_DIR
+#                      clean Registry Stack checkout the lab builds the
+#                      Evidence and Mint images from, a documented tutorial
+#                      prerequisite until a release publishes them.
+#                      Default: this repository.
 #
 # Exit codes:
 #   0   success
@@ -41,8 +46,9 @@
 #     were extracted from the matching sections; bump these constants when you
 #     intentionally add or remove a documented command
 #   - after compose comes up, the script asserts every entry in
-#     EXPECTED_SERVICES is in `running` state; bump the array when you
-#     intentionally add or remove a long-running service
+#     EXPECTED_SERVICES is in `running` state and that EXPECTED_RUNNING_TOTAL
+#     services are running in all; bump both when you intentionally add or
+#     remove a long-running service
 #   - the script runs whatever commands appear in the tutorial verbatim, so a
 #     command change in the docs causes the runner to exercise the new command
 #
@@ -50,9 +56,12 @@ set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TUTORIAL="$REPO_ROOT/src/content/docs/tutorials/first-run-with-solmara-lab.mdx"
-EXPECTED_STEP_COUNT=3
+EXPECTED_STEP_COUNT=4
 EXPECTED_VERIFY_COUNT=4
 EXPECTED_DEMO_ARTIFACTS=3
+# Every service the tutorial names or gives a host port. The topology holds far
+# more; EXPECTED_RUNNING_TOTAL below covers the rest as a count, because the
+# page states one.
 EXPECTED_SERVICES=(
 	cra-civil-relay
 	nia-population-relay
@@ -60,24 +69,26 @@ EXPECTED_SERVICES=(
 	programme-mis-relay
 	sipf-pensions-relay
 	nagdi-agriculture-relay
-	child-benefit-notary
-	pension-notary
-	nagdi-notary
-	citizen-notary
+	child-benefit-federator
 	static-metadata
 	portal
 	home
 	scenario-runner
 	postgres
-	redis
+	evidence-gateway
+	mint
+	cra-records-relay
+	cra-records-workload-agent
+	evidence
 )
+EXPECTED_RUNNING_TOTAL=41
 
 DRY_RUN=0
 for arg in "$@"; do
 	case "$arg" in
 	--dry-run) DRY_RUN=1 ;;
 	-h | --help)
-		sed -n '3,37p' "$0"
+		sed -n '3,53p' "$0"
 		exit 0
 		;;
 	*)
@@ -168,7 +179,6 @@ REGISTRYCTL_TUTORIALS=(
 	"configure-project-script-adapter:49"
 	"publish-spreadsheet-secured-registry-api:20"
 	"use-your-spreadsheet:9"
-	"verify-claim-registry-api:15"
 	"verify-opencrvs-claims:45"
 )
 
@@ -222,8 +232,6 @@ require_literal "$REPO_ROOT/src/content/docs/tutorials/publish-spreadsheet-secur
 	'registryctl init my-first-registry --template spreadsheet'
 require_literal "$REPO_ROOT/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx" \
 	'registryctl dev smoke'
-require_literal "$REPO_ROOT/src/content/docs/tutorials/verify-claim-registry-api.mdx" \
-	'project-status-accepted'
 require_literal "$REPO_ROOT/src/content/docs/tutorials/configure-project-script-adapter.mdx" \
 	'file: adapter.rhai'
 require_literal "$REPO_ROOT/src/content/docs/tutorials/configure-project-script-adapter.mdx" \
@@ -233,7 +241,7 @@ require_literal "$REPO_ROOT/src/content/docs/tutorials/configure-project-script-
 require_literal "$REPO_ROOT/src/content/docs/tutorials/verify-opencrvs-claims.mdx" \
 	'POST /api/events/events/search'
 require_literal "$REPO_ROOT/src/content/docs/tutorials/verify-opencrvs-claims.mdx" \
-	'birth-event-found'
+	'birth-event-verification'
 
 if ((DRY_RUN)); then
 	printf 'dry-run: extraction and drift checks passed; Solmara execution skipped\n'
@@ -267,6 +275,43 @@ else
 	(cd "$CLONE_DIR" && just setup)
 fi
 
+# The tutorial's Steps run the Evidence overlay. A lab checkout that predates it
+# would fail several commands in without saying why.
+if [[ ! -f "$LAB_DIR/compose.evidence.yaml" ]]; then
+	printf 'solmara-lab checkout has no compose.evidence.yaml: %s\n' "$LAB_DIR" >&2
+	printf 'the tutorial runs the Evidence overlay; advance SOLMARA_LAB_REF in %s\n' \
+		"${BASH_SOURCE[0]}" >&2
+	exit 1
+fi
+
+# No Registry Stack release ships the Evidence or Mint binaries, so the lab
+# builds both images from a checkout the operator names, and refuses a dirty
+# one. This is a documented tutorial prerequisite until a release publishes
+# them; default it to the repository this script lives in.
+REGISTRY_STACK_SOURCE_DIR="${REGISTRY_STACK_SOURCE_DIR:-$(cd "$REPO_ROOT/../.." && pwd)}"
+export REGISTRY_STACK_SOURCE_DIR
+if [[ -n "$(git -C "$REGISTRY_STACK_SOURCE_DIR" status --porcelain 2>&1)" ]]; then
+	printf 'REGISTRY_STACK_SOURCE_DIR is not a clean git checkout: %s\n' \
+		"$REGISTRY_STACK_SOURCE_DIR" >&2
+	printf 'point it at a clean checkout or git worktree carrying crates/registry-evidence\n' >&2
+	exit 1
+fi
+
+# Step 1 rotates every local credential, including the Postgres password, so a
+# data volume left by an earlier run no longer matches it and the stack cannot
+# bootstrap. Clone mode always starts empty. A caller-supplied checkout has to be
+# reset by its owner, because cleanup below never deletes their volumes.
+if [[ -z "$CLONE_DIR" ]]; then
+	lab_project="$(cd "$LAB_DIR" && python3 scripts/compose_project_name.py)"
+	if docker volume ls --format '{{.Name}}' | grep -q "^${lab_project}_"; then
+		printf 'solmara-lab checkout still holds volumes from an earlier run: %s\n' \
+			"$lab_project" >&2
+		printf 'step 1 rotates the Postgres password; run just reset-evidence in %s first\n' \
+			"$LAB_DIR" >&2
+		exit 1
+	fi
+fi
+
 for tool in just docker uv pnpm python3 openssl git; do
 	if ! command -v "$tool" >/dev/null 2>&1; then
 		printf 'required tool not on PATH: %s\n' "$tool" >&2
@@ -285,11 +330,11 @@ cleanup() {
 	# Clone mode owns its stack outright, so remove the volumes too; for a
 	# caller-supplied checkout, stop containers but never touch its volumes.
 	if [[ -n "$CLONE_DIR" ]]; then
-		printf '\n--- cleanup: just reset ---\n' | tee -a "$LOG_FILE"
-		(cd "$LAB_DIR" && just reset) >>"$LOG_FILE" 2>&1 || true
+		printf '\n--- cleanup: just reset-evidence ---\n' | tee -a "$LOG_FILE"
+		(cd "$LAB_DIR" && just reset-evidence) >>"$LOG_FILE" 2>&1 || true
 	else
-		printf '\n--- cleanup: just down ---\n' | tee -a "$LOG_FILE"
-		(cd "$LAB_DIR" && just down) >>"$LOG_FILE" 2>&1 || true
+		printf '\n--- cleanup: just down-evidence ---\n' | tee -a "$LOG_FILE"
+		(cd "$LAB_DIR" && just down-evidence) >>"$LOG_FILE" 2>&1 || true
 	fi
 	if [[ -n "$CLONE_DIR" ]]; then
 		rm -rf "$CLONE_DIR"
@@ -320,11 +365,11 @@ for i in "${!STEPS[@]}"; do
 	run_command "step $((i + 1))" "${STEPS[$i]}"
 done
 
-# After all Steps, the topology should be up. Assert every long-running
-# service (everything except the one-shot volume-permissions init job) is in
-# `running` state.
+# After all Steps, the topology should be up. Assert every service the tutorial
+# names is in `running` state, and that the total matches the count the page
+# states (everything except the one-shot bootstrap and secret-root jobs).
 printf '\n--- assert services running ---\n' | tee -a "$LOG_FILE"
-running_services="$(docker compose --env-file versions.env --env-file .env -f compose.yaml ps --services --filter status=running)"
+running_services="$(docker compose --env-file versions.env --env-file .env -f compose.yaml -f compose.evidence.yaml ps --services --filter status=running)"
 printf 'running services:\n%s\n' "$running_services" >>"$LOG_FILE"
 missing=()
 for svc in "${EXPECTED_SERVICES[@]}"; do
@@ -338,10 +383,19 @@ if ((${#missing[@]} > 0)); then
 		printf '  %s\n' "$svc" >&2
 	done
 	printf 'docker compose ps:\n' >&2
-	docker compose --env-file versions.env --env-file .env -f compose.yaml ps >&2 || true
+	docker compose --env-file versions.env --env-file .env -f compose.yaml -f compose.evidence.yaml ps >&2 || true
+	exit 1
+fi
+running_total="$(grep -c . <<<"$running_services")"
+if ((running_total != EXPECTED_RUNNING_TOTAL)); then
+	printf 'tutorial drift: %d services running, the tutorial states %d\n' \
+		"$running_total" "$EXPECTED_RUNNING_TOTAL" >&2
+	printf 'if this change was intentional, update EXPECTED_RUNNING_TOTAL in %s and the count on the page\n' \
+		"${BASH_SOURCE[0]}" >&2
 	exit 1
 fi
-printf 'all %d expected services running\n' "${#EXPECTED_SERVICES[@]}"
+printf 'all %d named services running, %d in total\n' \
+	"${#EXPECTED_SERVICES[@]}" "$running_total"
 
 for i in "${!VERIFY[@]}"; do
 	run_command "verify $((i + 1))" "${VERIFY[$i]}"
diff --git a/docs/site/scripts/deployment-documentation-truth.test.mjs b/docs/site/scripts/deployment-documentation-truth.test.mjs
index 2ce881d28..7480ba951 100644
--- a/docs/site/scripts/deployment-documentation-truth.test.mjs
+++ b/docs/site/scripts/deployment-documentation-truth.test.mjs
@@ -16,12 +16,6 @@ async function readYaml(relative) {
   return YAML.parse(await readRepo(relative));
 }
 
-const currentActivationPages = [
-  'products/notary/docs/configuration-trust-and-integrity.md',
-  'products/notary/docs/operator-config-reference.md',
-  'products/notary/docs/deployment-hardening-runbook.md',
-];
-
 test('current docs stay under /dev/ while v0.15.2 is the released archive', async () => {
   const [docsets, repoDocs, generatedDocsets, readme] = await Promise.all([
     readYaml('docs/site/src/data/docsets.yaml'),
@@ -49,10 +43,8 @@ test('current docs stay under /dev/ while v0.15.2 is the released archive', asyn
     true,
   );
   assert.equal(
-    readmeLines.has(
-      '| Move a pre-1.0 project | [Pre-1.0 cutover](https://docs.registrystack.org/dev/start/pre-1.0-cutover/) |',
-    ),
-    true,
+    [...readmeLines].some((line) => line.includes('/start/pre-1.0-cutover/')),
+    false,
   );
   assert.equal(
     current.description,
@@ -127,37 +119,6 @@ test('current deployment recovery pages do not present draft procedures as suppo
   }
 });
 
-test('current combined-topology pages require separate product bundles and compatible staged admission', async () => {
-  const pages = await Promise.all(
-    currentActivationPages.map(async (path) => [path, await readRepo(path)]),
-  );
-
-  for (const [path, source] of pages) {
-    assert.match(
-      source,
-      /(?:separate product bundles|product bundles separately|separately[\s\S]{0,100}product bundles)/i,
-      path,
-    );
-    assert.match(source, /anti-rollback/i, path);
-    assert.match(source, /not atomic project activation/i, path);
-    assert.match(source, /Relay[\s\S]{0,160}without admitting\s+caller traffic/i, path);
-    assert.match(source, /health[\s\S]{0,120}readiness[\s\S]{0,120}audit[\s\S]{0,120}posture/i, path);
-    assert.match(source, /Notary[\s\S]{0,180}(?:Relay|consultation) contract/i, path);
-    assert.match(source, /admit caller traffic only (?:after|when) both products are ready/i, path);
-    assert.match(source, /contract mismatch[\s\S]{0,100}before source access/i, path);
-
-    for (const staleClaim of [
-      /combined generation must activate[\s\S]*atomically/i,
-      /activate Relay and Notary as one compatible project generation/i,
-      /stage a complete Relay and Notary generation/i,
-      /activate one complete generation/i,
-      /root manifest binds compatible Relay and Notary/i,
-    ]) {
-      assert.doesNotMatch(source, staleClaim, `${path} reintroduced ${staleClaim}`);
-    }
-  }
-});
-
 test('glossary defers issue 361 without describing an implemented project-root bundle or coordinator', async () => {
   const glossary = await readRepo('docs/site/src/content/docs/reference/glossary.mdx');
 
diff --git a/docs/site/scripts/diagnostic-reference-docs.test.mjs b/docs/site/scripts/diagnostic-reference-docs.test.mjs
index b9d6d4ec5..01f10ba32 100644
--- a/docs/site/scripts/diagnostic-reference-docs.test.mjs
+++ b/docs/site/scripts/diagnostic-reference-docs.test.mjs
@@ -15,8 +15,8 @@ const repoRoot = resolve(siteRoot, '../..');
 const execFileAsync = promisify(execFile);
 const expectedCounts = {
   authoring: 17,
-  fixture: 16,
-  operator: 60,
+  fixture: 15,
+  operator: 42,
 };
 
 async function artifactBytes(catalog) {
diff --git a/docs/site/scripts/doc-personas.test.mjs b/docs/site/scripts/doc-personas.test.mjs
new file mode 100644
index 000000000..ed4c32e03
--- /dev/null
+++ b/docs/site/scripts/doc-personas.test.mjs
@@ -0,0 +1,55 @@
+// Unit tests for src/lib/doc-personas.mjs.
+//
+// Run with: node --test scripts/doc-personas.test.mjs
+// (also picked up by `npm test` via "scripts/**/*.test.mjs")
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { resolve, dirname } from 'node:path';
+
+import { DOC_PERSONAS } from '../src/lib/doc-personas.mjs';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const whenToUse = resolve(here, '../src/content/docs/start/when-to-use.mdx');
+
+/**
+ * The roles named in the "Who does what" section of start/when-to-use.mdx,
+ * which is the page a persona label sends a reader to. Scoped to that section
+ * so an ordinary "- The ... is ..." bullet elsewhere on the page is not read as
+ * a role definition.
+ * @returns {string[]}
+ */
+function definedRoles() {
+  const source = readFileSync(whenToUse, 'utf8');
+  const section = source.match(/^### Who does what$([\s\S]*?)^#{2,3} /m);
+  assert.ok(section, 'when-to-use.mdx must keep a "Who does what" section');
+  return [...section[1].matchAll(/^- The (.+?) is /gm)].map((match) => match[1]);
+}
+
+test('every persona label is a persona the site defines', () => {
+  // start/when-to-use.mdx is where the four deployment roles are defined for
+  // readers. A label that names a role the page does not define sends a reader
+  // looking for an explanation that is not there.
+  const defined = definedRoles();
+
+  assert.ok(defined.length > 0, 'when-to-use.mdx must define at least one role');
+  for (const persona of DOC_PERSONAS) {
+    assert.ok(
+      defined.includes(persona),
+      `"${persona}" is a valid frontmatter label but when-to-use.mdx defines no such role`,
+    );
+  }
+});
+
+test('every role the site defines is available as a label', () => {
+  // The other direction: a role readers are told about, with no tutorial able
+  // to claim it, is a gap in the onboarding spine rather than a stray label.
+  for (const role of definedRoles()) {
+    assert.ok(
+      DOC_PERSONAS.includes(role),
+      `when-to-use.mdx defines the role "${role}" but no tutorial can be labeled with it`,
+    );
+  }
+});
diff --git a/docs/site/scripts/evidence-production-build-docs.test.mjs b/docs/site/scripts/evidence-production-build-docs.test.mjs
new file mode 100644
index 000000000..b600206ab
--- /dev/null
+++ b/docs/site/scripts/evidence-production-build-docs.test.mjs
@@ -0,0 +1,63 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const siteRoot = resolve(fileURLToPath(new URL('..', import.meta.url)));
+const repoRoot = resolve(siteRoot, '../..');
+
+async function page(path) {
+  return readFile(resolve(siteRoot, path), 'utf8');
+}
+
+test('production Evidence tutorials keep the build, optional Mint, and Compose boundaries explicit', async () => {
+  const [build, mint, compose] = await Promise.all([
+    page('src/content/docs/tutorials/build-and-deploy-evidence-project.mdx'),
+    page('src/content/docs/tutorials/issue-evidence-access-tokens-with-registry-mint.mdx'),
+    page('src/content/docs/tutorials/integrate-evidence-candidate-with-docker-compose.mdx'),
+  ]);
+
+  assert.match(build, /evidencectl build/u);
+  assert.match(build, /\.evidence\/dev/u);
+  assert.match(build, /evidence --runtime "<candidate>\/runtime\.yaml" verify-audit/u);
+  assert.match(build, /install -m 600 \/dev\/null "<owner-only-curl-config>"/u);
+  assert.match(build, /Authorization: Bearer <access-token>/u);
+  assert.match(build, /<QuickstartMeta/u);
+  assert.match(mint, /Evidence does not require Mint/u);
+  assert.match(mint, /--mint-config "<mint-directory>\/mint\.yaml"/u);
+  assert.match(mint, /memory-only/u);
+  assert.match(mint, /umask 077\nmint token/u);
+  assert.match(mint, /rm -f "<owner-only-token-file>"/u);
+  assert.match(mint, /<QuickstartMeta/u);
+  assert.match(compose, /candidate\/bundle/u);
+  assert.match(compose, /runtime\.docker\.yaml/u);
+  assert.match(compose, /configurationRevision/u);
+  assert.match(compose, /not output from `evidencectl build`/u);
+  assert.match(compose, /user: "65532:65532"/u);
+  assert.match(compose, /docker compose down/u);
+  assert.match(compose, /<QuickstartMeta/u);
+});
+
+test('the maintained Compose adapter keeps Evidence independent from Mint scaffolding', async () => {
+  const [readme, compose] = await Promise.all([
+    readFile(resolve(repoRoot, 'docker/compose/README.md'), 'utf8'),
+    readFile(resolve(repoRoot, 'docker/compose/docker-compose.yaml'), 'utf8'),
+  ]);
+
+  assert.doesNotMatch(readme, /--with-mint/u);
+  assert.doesNotMatch(compose, /--with-mint/u);
+  assert.doesNotMatch(compose, /MINT_(?:IMAGE|CONFIG_DIR|SECRET_ROOT)/u);
+  assert.match(readme, /intentionally absent from the base adapter/u);
+  for (const name of [
+    'EVIDENCE_CANDIDATE_DIR',
+    'EVIDENCE_RUNTIME_FILE',
+    'EVIDENCE_SECRET_ROOT',
+    'EVIDENCE_IMAGE',
+  ]) {
+    assert.match(readme, new RegExp(`export ${name}=`, 'u'));
+  }
+  assert.match(compose, /EVIDENCE_CANDIDATE_DIR/u);
+  assert.match(compose, /EVIDENCE_SECRET_ROOT/u);
+  assert.match(compose, /user: "65532:65532"/u);
+});
diff --git a/docs/site/scripts/evidence-tutorial-fence.sh b/docs/site/scripts/evidence-tutorial-fence.sh
new file mode 100755
index 000000000..952f9ee24
--- /dev/null
+++ b/docs/site/scripts/evidence-tutorial-fence.sh
@@ -0,0 +1,173 @@
+#!/usr/bin/env bash
+#
+# Read a documented fence out of a tutorial, and apply a documented
+# before/after pair to a file the reader edits.
+#
+# The Evidence tutorial gate replays each reader journey inside a clean Debian
+# userland that holds a shell, coreutils and the toolset under test, and
+# nothing else. These two operations are the gate's own scaffolding, standing
+# in for a reader who edits by hand, so they are written against that same
+# floor: an interpreter the container does not carry fails mid-journey, where
+# the transcript makes it look like a tutorial defect.
+#
+# Fence semantics match the site's authoring helper: a level-2 heading opens a
+# section, a fence is counted per heading and language, the opening fence's
+# indentation is stripped from its body, and blank lines at the body's edges
+# are presentation rather than content.
+#
+# Usage:
+#   evidence-tutorial-fence.sh write-fence <tutorial> <heading> <language> \
+#       <occurrence> <out-file>
+#   evidence-tutorial-fence.sh replace-block <target> <before-file> <after-file>
+
+set -euo pipefail
+
+usage() {
+	printf 'usage: %s write-fence <tutorial> <heading> <language> <occurrence> <out-file>\n' \
+		"${BASH_SOURCE[0]}" >&2
+	printf '       %s replace-block <target> <before-file> <after-file>\n' \
+		"${BASH_SOURCE[0]}" >&2
+	exit 2
+}
+
+write_fence() {
+	(($# == 5)) || usage
+	local tutorial="$1" heading="$2" language="$3" occurrence="$4" out="$5"
+
+	if [[ ! -f "$tutorial" ]]; then
+		printf 'tutorial not found: %s\n' "$tutorial" >&2
+		exit 1
+	fi
+	if [[ ! "$occurrence" =~ ^[0-9]+$ ]] || ((occurrence < 1)); then
+		printf 'fence occurrence must be a positive integer: %s\n' "$occurrence" >&2
+		exit 2
+	fi
+
+	awk -v want_heading="$heading" -v want_language="$language" \
+		-v want_occurrence="$occurrence" '
+		found { next }
+		in_fence == 0 {
+			if ($0 ~ /^##[ \t]+/) {
+				heading = $0
+				sub(/^##[ \t]+/, "", heading)
+				sub(/[ \t]+$/, "", heading)
+				have_heading = 1
+				next
+			}
+			if (have_heading && $0 ~ /^[ \t]*```[A-Za-z0-9_-]+[ \t]*$/) {
+				indent = $0
+				sub(/```[A-Za-z0-9_-]+[ \t]*$/, "", indent)
+				language = $0
+				sub(/^[ \t]*```/, "", language)
+				sub(/[ \t]*$/, "", language)
+				in_fence = 1
+				n = 0
+			}
+			next
+		}
+		{
+			closer = $0
+			gsub(/^[ \t]+/, "", closer)
+			gsub(/[ \t]+$/, "", closer)
+			if (closer == "```") {
+				key = heading SUBSEP language
+				seen[key] += 1
+				if (heading == want_heading && language == want_language &&
+					seen[key] == want_occurrence + 0) {
+					first = 1
+					last = n
+					while (first <= last && buffer[first] == "") first++
+					while (last >= first && buffer[last] == "") last--
+					for (i = first; i <= last; i++) print buffer[i]
+					found = 1
+				}
+				in_fence = 0
+				next
+			}
+			content = $0
+			if (indent != "" && index(content, indent) == 1) {
+				content = substr(content, length(indent) + 1)
+			}
+			buffer[++n] = content
+		}
+		END {
+			if (!found) {
+				printf "missing %s fence %s under \"%s\"\n", \
+					want_language, want_occurrence, want_heading > "/dev/stderr"
+				exit 1
+			}
+		}
+	' "$tutorial" >"$out"
+}
+
+replace_block() {
+	(($# == 3)) || usage
+	local target="$1" before="$2" after="$3"
+
+	local path
+	for path in "$target" "$before" "$after"; do
+		if [[ ! -f "$path" ]]; then
+			printf 'file not found: %s\n' "$path" >&2
+			exit 1
+		fi
+	done
+
+	local rewritten="$target.rewritten"
+	awk -v beforefile="$before" -v afterfile="$after" -v targetfile="$target" '
+		# Every file is read whole, because the edit is a literal block
+		# substitution: nothing here interprets the target as markup.
+		function slurp(path,   text, count, line) {
+			text = ""
+			count = 0
+			while ((getline line < path) > 0) {
+				text = (count++ ? text "\n" line : line)
+			}
+			close(path)
+			return text
+		}
+		BEGIN {
+			before = slurp(beforefile)
+			after = slurp(afterfile)
+			target = slurp(targetfile)
+
+			if (before == "") {
+				print "the documented before block is empty" > "/dev/stderr"
+				exit 1
+			}
+			if (before == after) {
+				print "fence-pair replacement must change the target" > "/dev/stderr"
+				exit 1
+			}
+
+			count = 0
+			offset = 0
+			first = 0
+			while ((at = index(substr(target, offset + 1), before)) > 0) {
+				count += 1
+				if (count == 1) first = offset + at
+				offset = offset + at + length(before) - 1
+			}
+			if (count != 1) {
+				printf "expected one exact block in the edit target, found %d\n", \
+					count > "/dev/stderr"
+				exit 1
+			}
+
+			printf "%s\n", substr(target, 1, first - 1) after \
+				substr(target, first + length(before))
+		}
+	' >"$rewritten"
+	mv "$rewritten" "$target"
+}
+
+(($# > 0)) || usage
+command="$1"
+shift
+case "$command" in
+write-fence) write_fence "$@" ;;
+replace-block) replace_block "$@" ;;
+*)
+	printf 'unknown command: %s\n' "$command" >&2
+	usage
+	;;
+esac
diff --git a/docs/site/scripts/fetch-openapi.mjs b/docs/site/scripts/fetch-openapi.mjs
index 39ebdabfe..ef9b7f397 100644
--- a/docs/site/scripts/fetch-openapi.mjs
+++ b/docs/site/scripts/fetch-openapi.mjs
@@ -23,6 +23,7 @@ import { promisify } from 'node:util';
 import YAML from 'yaml';
 import {
   applyDocsetRefs,
+  filterRepoDocsForDocset,
   getDocset,
   loadDocsets,
   selectedDocsetId,
@@ -40,7 +41,7 @@ const cacheRoot = resolve(root, '.repo-docs-cache');
 // aggregated API reference; others are skipped.
 const SPEC_SOURCES = {
   'registry-relay': 'openapi/registry-relay.openapi.json',
-  'registry-notary': 'openapi/registry-notary.openapi.json',
+  'registry-evidence': 'products/evidence/generated/registry-evidence.openapi.json',
 };
 
 function fail(message) {
@@ -102,6 +103,11 @@ async function main() {
   }
   const docsets = await loadDocsets({ dataDir });
   const docset = getDocset(docsets, selectedDocsetId(docsets));
+  // Filter before applying docset refs, as sync-repo-docs.mjs does: a repo
+  // whose docs are all excluded from this docset must not count as an active
+  // repo the docset is required to pin. Such a repo keeps its repo-docs ref,
+  // so its spec rides the current shell the way hand-authored pages do.
+  filterRepoDocsForDocset(manifest, docset);
   if (docset.id !== docsets.current) {
     applyDocsetRefs(manifest, docset);
     console.log(`Using archived docset ${docset.id} for OpenAPI refs.`);
diff --git a/docs/site/scripts/generate-authoring-reference.mjs b/docs/site/scripts/generate-authoring-reference.mjs
index 2cd839504..a637fa91a 100644
--- a/docs/site/scripts/generate-authoring-reference.mjs
+++ b/docs/site/scripts/generate-authoring-reference.mjs
@@ -22,7 +22,7 @@ const schemaSources = sourceManifest.schema_sources;
 const fieldKnowledgeSource = sourceManifest.field_knowledge;
 const humanIntentSource = sourceManifest.human_intent;
 const runtimeIntentSources = sourceManifest.runtime_intent;
-const runtimeSchemas = new Set(['relay', 'notary']);
+const runtimeSchemas = new Set(sourceManifest.runtime_schemas);
 const pathKinds = ['root', 'property', 'map_key', 'map_value', 'array_item', 'branch'];
 
 function parseJson(text, label) {
@@ -68,7 +68,7 @@ function assertSourceContract(source, label) {
     throw new Error(`${label} must prohibit country-workspace and runtime-configuration reads`);
   }
   if (JSON.stringify(source.schemas) !== JSON.stringify(schemaOrder)) {
-    throw new Error(`${label} must cover the exact seven configuration domains in order`);
+    throw new Error(`${label} must cover the exact configuration domains in order`);
   }
   if (
     JSON.stringify(source.schema_sources) !== JSON.stringify(schemaSources) ||
@@ -104,7 +104,7 @@ function assertCoverageShape(coverage, label) {
   assertInteger(coverage.path_count, `${label}.coverage.path_count`);
   assertInteger(coverage.reference_count, `${label}.coverage.reference_count`);
   if (coverage.schema_count !== schemaOrder.length) {
-    throw new Error(`${label} must cover all seven configuration schemas`);
+    throw new Error(`${label} must cover every configuration schema`);
   }
   const schemaTotal = schemaOrder.reduce((total, schema) => {
     assertInteger(coverage.by_schema?.[schema], `${label}.coverage.by_schema.${schema}`);
diff --git a/docs/site/scripts/generate-authoring-reference.test.mjs b/docs/site/scripts/generate-authoring-reference.test.mjs
index 01b0f5f88..dd6841070 100644
--- a/docs/site/scripts/generate-authoring-reference.test.mjs
+++ b/docs/site/scripts/generate-authoring-reference.test.mjs
@@ -10,7 +10,7 @@ import {
   validateAuthoringReference,
 } from './generate-authoring-reference.mjs';
 
-const schemas = ['project', 'environment', 'integration', 'fixture', 'entity', 'relay', 'notary'];
+const schemas = ['project', 'environment', 'integration', 'fixture', 'entity', 'relay'];
 const sourceContract = {
   schemas,
   schema_sources: [
@@ -20,14 +20,10 @@ const sourceContract = {
     'fixture.schema.json',
     'entity.schema.json',
     'registry-relay.config.schema.json',
-    'registry-notary.config.schema.json',
   ],
   field_knowledge: 'schemas/project-authoring/parity-coverage.json#field_knowledge',
   human_intent: 'schemas/project-authoring/documentation-intent.json',
-  runtime_intent: [
-    'crates/registry-relay/config/documentation-intent.json',
-    'crates/registry-notary-core/config/documentation-intent.json',
-  ],
+  runtime_intent: ['crates/registry-relay/config/documentation-intent.json'],
   reads_country_workspaces: false,
   reads_runtime_configuration: false,
 };
@@ -39,12 +35,12 @@ const referenceBaseline = {
   compared_releases: [],
 };
 const counts = {
-  schema_count: 7,
-  path_count: 7,
+  schema_count: schemas.length,
+  path_count: schemas.length,
   reference_count: 0,
   by_schema: Object.fromEntries(schemas.map((schema) => [schema, 1])),
   by_path_kind: {
-    root: 7,
+    root: schemas.length,
     property: 0,
     map_key: 0,
     map_value: 0,
@@ -52,10 +48,10 @@ const counts = {
     branch: 0,
   },
   by_sensitivity: {
-    structural: 7,
+    structural: schemas.length,
   },
   by_intent_source: {
-    schema_description: 7,
+    schema_description: schemas.length,
   },
   by_intent_profile: {},
 };
@@ -69,9 +65,9 @@ function fixtureData() {
     reference_baseline: referenceBaseline,
     source_contract: sourceContract,
     coverage: counts,
-    reviewed_intent_assignment_required_count: 7,
-    reviewed_intent_assignment_covered_count: 7,
-    distinct_reviewed_intent_count: 7,
+    reviewed_intent_assignment_required_count: schemas.length,
+    reviewed_intent_assignment_covered_count: schemas.length,
+    distinct_reviewed_intent_count: schemas.length,
     distinct_reviewed_intents_reused_count: 0,
     reviewed_intent_assignments_using_reused_intent_count: 0,
     missing_intent: [],
@@ -87,13 +83,11 @@ function fixtureData() {
       address: {
         schema,
         pointer: '',
-        ...(schema === 'relay' || schema === 'notary' ? { key_path: '' } : {}),
+        ...(schema === 'relay' ? { key_path: '' } : {}),
         path_kind: 'root',
       },
       purpose: `Documents the reviewed ${schema} configuration contract root and its exact operational intent.`,
-      ...(schema === 'relay' || schema === 'notary'
-        ? { intent_profile: `${schema}_runtime_root` }
-        : {}),
+      ...(schema === 'relay' ? { intent_profile: `${schema}_runtime_root` } : {}),
       default: { behavior: 'not_applicable' },
       history_status: 'not_verified',
       introduced_in: null,
@@ -103,7 +97,6 @@ function fixtureData() {
   };
   reference.coverage.by_intent_profile = {
     relay_runtime_root: 1,
-    notary_runtime_root: 1,
   };
   coverage.coverage.by_intent_profile = reference.coverage.by_intent_profile;
   return { reference, coverage };
@@ -216,7 +209,7 @@ test('rejects fabricated field history and inconsistent intent-reuse counts', ()
   );
 
   const falseUniqueness = fixtureData();
-  falseUniqueness.coverage.distinct_reviewed_intent_count = 6;
+  falseUniqueness.coverage.distinct_reviewed_intent_count = schemas.length - 1;
   assert.throws(
     () =>
       validateAuthoringReference(
@@ -255,7 +248,7 @@ test('rejects runtime paths without exact profiles or with exposed default value
 
   const exposedDefault = fixtureData();
   exposedDefault.reference.fields.find(
-    (field) => field.address.schema === 'notary',
+    (field) => field.address.schema === 'relay',
   ).default.schema_value = 'COUNTRY_VALUE_SENTINEL';
   assert.throws(
     () => validateAuthoringReference(exposedDefault.reference, exposedDefault.coverage),
@@ -284,7 +277,7 @@ test('keeps JSON Schema pointers distinct from runtime configuration key paths',
 
   const dottedPointer = fixtureData();
   dottedPointer.reference.fields.find(
-    (field) => field.address.schema === 'notary',
+    (field) => field.address.schema === 'relay',
   ).address.pointer = 'auth.api_keys[]';
   assert.throws(
     () => validateAuthoringReference(dottedPointer.reference, dottedPointer.coverage),
diff --git a/docs/site/scripts/generate-diagnostic-references.mjs b/docs/site/scripts/generate-diagnostic-references.mjs
index e1f2fcd5a..6b4cc09ce 100644
--- a/docs/site/scripts/generate-diagnostic-references.mjs
+++ b/docs/site/scripts/generate-diagnostic-references.mjs
@@ -30,7 +30,6 @@ export const diagnosticCatalogs = {
     schemaVersion: 'registryctl.operator_error_reference.v1',
     families: new Set([
       'bundle_verification',
-      'notary_activation',
       'operator_preflight',
       'relay_activation',
       'relay_process_startup',
@@ -61,7 +60,6 @@ const entryFields = new Set([
   'evidence_limitation',
 ]);
 const ownerByProduct = new Map([
-  ['registry_notary', 'registry_notary'],
   ['registry_platform_ops', 'registry_platform_ops'],
   ['registry_relay', 'registry_relay'],
   ['registryctl', 'registryctl'],
@@ -71,14 +69,12 @@ const familyCatalog = new Map([
   ['authoring_validation', 'authoring'],
   ['fixture_execution', 'fixture'],
   ['bundle_verification', 'operator'],
-  ['notary_activation', 'operator'],
   ['operator_preflight', 'operator'],
   ['relay_activation', 'operator'],
   ['relay_process_startup', 'operator'],
 ]);
 const productOwnedDocsSlugFamilies = new Set([
   'bundle_verification',
-  'notary_activation',
   'relay_activation',
   'relay_process_startup',
 ]);
diff --git a/docs/site/scripts/generate-project-starters.mjs b/docs/site/scripts/generate-project-starters.mjs
index 57bab341e..276143521 100644
--- a/docs/site/scripts/generate-project-starters.mjs
+++ b/docs/site/scripts/generate-project-starters.mjs
@@ -13,7 +13,7 @@ const publicTemplates = [
   {
     id: 'spreadsheet',
     label: 'Spreadsheet',
-    summary: 'A protected records API and bounded evidence service over a contained workbook.',
+    summary: 'A protected records API over a contained workbook.',
     source: 'crates/registryctl/assets/project-starters/spreadsheet',
     project_dir: 'spreadsheet-project',
     focused_fixture_file: 'match.yaml',
@@ -69,10 +69,7 @@ function deriveTopology(project, source) {
     Object.keys(project.integrations ?? {}).length > 0 ||
     Object.keys(project.entities ?? {}).length > 0 ||
     services.some((service) => service.kind === 'records_api');
-  const hasNotary = services.some((service) => service.kind === 'evidence');
-  if (hasRelay && hasNotary) return 'combined';
   if (hasRelay) return 'relay-only';
-  if (hasNotary) return 'notary-only';
   throw new Error(`${source} does not select a Registry Stack product`);
 }
 
diff --git a/docs/site/scripts/generate-project-starters.test.mjs b/docs/site/scripts/generate-project-starters.test.mjs
index 42d4c31b2..3822253eb 100644
--- a/docs/site/scripts/generate-project-starters.test.mjs
+++ b/docs/site/scripts/generate-project-starters.test.mjs
@@ -42,21 +42,21 @@ test('classifies every golden and derives topology from committed workspace cont
   assert.deepEqual(
     journeys.map(({ id, classification, topology }) => ({ id, classification, topology })),
     [
-      { id: 'http', classification: 'maintained', topology: 'combined' },
-      { id: 'custom-system', classification: 'maintained', topology: 'combined' },
-      { id: 'dhis2-script', classification: 'conformance-only', topology: 'combined' },
-      { id: 'dhis2-tracker', classification: 'maintained', topology: 'combined' },
-      { id: 'fhir-r4-coverage-active', classification: 'maintained', topology: 'combined' },
+      { id: 'http', classification: 'maintained', topology: 'relay-only' },
+      { id: 'custom-system', classification: 'maintained', topology: 'relay-only' },
+      { id: 'dhis2-script', classification: 'conformance-only', topology: 'relay-only' },
+      { id: 'dhis2-tracker', classification: 'maintained', topology: 'relay-only' },
+      { id: 'fhir-r4-coverage-active', classification: 'maintained', topology: 'relay-only' },
       { id: 'nia-attribute-release', classification: 'conformance-only', topology: 'relay-only' },
-      { id: 'opencrvs-dci', classification: 'maintained', topology: 'combined' },
-      { id: 'opencrvs-events-api', classification: 'maintained', topology: 'combined' },
-      { id: 'opencrvs-country-variant', classification: 'maintained', topology: 'combined' },
-      { id: 'openspp-exact', classification: 'maintained', topology: 'combined' },
+      { id: 'opencrvs-dci', classification: 'maintained', topology: 'relay-only' },
+      { id: 'opencrvs-events-api', classification: 'maintained', topology: 'relay-only' },
+      { id: 'opencrvs-country-variant', classification: 'maintained', topology: 'relay-only' },
+      { id: 'openspp-exact', classification: 'maintained', topology: 'relay-only' },
       { id: 'relay-only-materialization', classification: 'maintained', topology: 'relay-only' },
       { id: 'relay-only-records', classification: 'maintained', topology: 'relay-only' },
-      { id: 'snapshot', classification: 'maintained', topology: 'combined' },
-      { id: 'snapshot-with-records', classification: 'maintained', topology: 'combined' },
-      { id: 'spreadsheet', classification: 'maintained', topology: 'combined' },
+      { id: 'snapshot', classification: 'maintained', topology: 'relay-only' },
+      { id: 'snapshot-with-records', classification: 'maintained', topology: 'relay-only' },
+      { id: 'spreadsheet', classification: 'maintained', topology: 'relay-only' },
     ],
   );
 });
diff --git a/docs/site/scripts/generate-sidebar.test.mjs b/docs/site/scripts/generate-sidebar.test.mjs
index 6c8f0db47..e6c346a37 100644
--- a/docs/site/scripts/generate-sidebar.test.mjs
+++ b/docs/site/scripts/generate-sidebar.test.mjs
@@ -155,7 +155,10 @@ test('product group labels drop the shared "Registry" prefix', () => {
     labels.every((l) => !/^Registry\b/.test(l)),
     `no group label should start with "Registry": ${labels.join(', ')}`,
   );
-  assert.ok(labels.includes('Relay') && labels.includes('Notary'), labels.join(', '));
+  assert.ok(
+    labels.includes('Relay') && labels.includes('Evidence') && !labels.includes('Notary'),
+    labels.join(', '),
+  );
 });
 
 test('the real manifest yields one group per product with every doc present exactly once', async () => {
diff --git a/docs/site/scripts/generated-api-bases.test.mjs b/docs/site/scripts/generated-api-bases.test.mjs
new file mode 100644
index 000000000..447a76d6e
--- /dev/null
+++ b/docs/site/scripts/generated-api-bases.test.mjs
@@ -0,0 +1,53 @@
+// Unit tests for src/lib/generated-api-bases.mjs.
+//
+// Run with: node --test scripts/generated-api-bases.test.mjs
+// (also picked up by `npm test` via "scripts/**/*.test.mjs")
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { resolve, dirname } from 'node:path';
+
+import {
+  GENERATED_API_BASES,
+  isGeneratedApiDir,
+  isGeneratedApiPath,
+} from '../src/lib/generated-api-bases.mjs';
+
+const here = dirname(fileURLToPath(import.meta.url));
+
+test('every starlight-openapi base registered in astro.config.mjs is listed', () => {
+  // astro.config.mjs is where a new API reference is registered. Anything it
+  // registers has no Markdown twin, so a base missing from this list ships
+  // pages that advertise a .md the build never generates.
+  const config = readFileSync(resolve(here, '../astro.config.mjs'), 'utf8');
+  const registered = [...config.matchAll(/^\s*base:\s*'(reference\/apis\/[^']+)'/gm)].map(
+    (match) => match[1],
+  );
+
+  assert.ok(registered.length > 0, 'astro.config.mjs must register at least one API base');
+  for (const base of registered) {
+    assert.ok(
+      GENERATED_API_BASES.includes(base),
+      `${base} is registered in astro.config.mjs but missing from GENERATED_API_BASES`,
+    );
+  }
+});
+
+test('a generated base and its descendants are recognised', () => {
+  assert.equal(isGeneratedApiDir('reference/apis/evidence'), true);
+  assert.equal(isGeneratedApiDir('reference/apis/evidence/operations/createevidence'), true);
+  assert.equal(isGeneratedApiPath('/reference/apis/evidence/'), true);
+  assert.equal(isGeneratedApiPath('/reference/apis/evidence/operations/gethealth/'), true);
+});
+
+test('the hand-authored narrative pages keep their Markdown twin', () => {
+  // reference/apis/registry-evidence is a real content-collection entry and
+  // shares a prefix with the generated base, so prefix matching must not
+  // swallow it.
+  assert.equal(isGeneratedApiDir('reference/apis/registry-evidence'), false);
+  assert.equal(isGeneratedApiPath('/reference/apis/registry-evidence/'), false);
+  assert.equal(isGeneratedApiDir('reference/apis'), false);
+  assert.equal(isGeneratedApiPath('/reference/apis/'), false);
+});
diff --git a/docs/site/scripts/information-architecture.test.mjs b/docs/site/scripts/information-architecture.test.mjs
index d35141b57..e0edb34a3 100644
--- a/docs/site/scripts/information-architecture.test.mjs
+++ b/docs/site/scripts/information-architecture.test.mjs
@@ -16,10 +16,6 @@ const validationSource = readFileSync(
   resolve(siteRoot, 'src/content/docs/verify/index.mdx'),
   'utf8',
 );
-const cutoverSource = readFileSync(
-  resolve(siteRoot, 'src/content/docs/start/pre-1.0-cutover.mdx'),
-  'utf8',
-);
 const sidebarSource = configSource.match(/sidebar: \[([\s\S]*?)\n      \],\n    \}\),/)?.[1];
 
 assert.ok(sidebarSource, 'could not isolate the Starlight sidebar configuration');
@@ -56,6 +52,7 @@ function assertOrdered(source, expectations, label) {
 test('uses the adopter-first top-level flow in its published order', () => {
   assert.deepEqual(topLevelLabels(sidebarSource), [
     'Start',
+    'Answer with Evidence',
     'Connect an existing registry',
     'Operate',
     'Security',
@@ -66,6 +63,7 @@ test('uses the adopter-first top-level flow in its published order', () => {
 test('publishes one overview route for every task-flow section', () => {
   for (const [label, route] of [
     ['Start', "link: '/'"],
+    ['Answer with Evidence', "slug: 'start/evidence-quickstart'"],
     ['Connect an existing registry', "slug: 'configure'"],
     ['Operate', "slug: 'operate'"],
     ['Security', "slug: 'security'"],
@@ -77,30 +75,26 @@ test('publishes one overview route for every task-flow section', () => {
   }
 });
 
-test('starts with the spreadsheet registry and keeps HTTP under existing registries', () => {
+test('groups Relay tutorials under existing registries', () => {
   const start = topLevelSection(sidebarSource, 'Start');
-  assert.match(
-    start,
-    /label: 'Start a spreadsheet registry', slug: 'tutorials\/publish-spreadsheet-secured-registry-api'/,
-  );
-  assert.match(
+  assert.doesNotMatch(
     start,
-    /label: 'Use your own spreadsheet', slug: 'tutorials\/use-your-spreadsheet'/,
+    /slug: 'tutorials\//,
   );
+  const connect = topLevelSection(sidebarSource, 'Connect an existing registry');
   assert.match(
-    start,
-    /label: 'Expose spreadsheet evidence', slug: 'tutorials\/verify-claim-registry-api'/,
+    connect,
+    /label: 'Start a spreadsheet registry', slug: 'tutorials\/publish-spreadsheet-secured-registry-api'/,
   );
   assert.match(
-    start,
-    /label: 'Pre-1.0 cutover', slug: 'start\/pre-1\.0-cutover'/,
+    connect,
+    /label: 'Use your own spreadsheet', slug: 'tutorials\/use-your-spreadsheet'/,
   );
-  assert.doesNotMatch(start, /author-registry-project/);
-  const connect = topLevelSection(sidebarSource, 'Connect an existing registry');
   assert.match(
     connect,
     /label: 'Connect an HTTP registry', slug: 'tutorials\/author-registry-project'/,
   );
+  assert.doesNotMatch(connect, /verify-opencrvs-claims/);
   assert.match(
     homepageSource,
     /\]\(tutorials\/publish-spreadsheet-secured-registry-api\/\)/,
@@ -110,13 +104,41 @@ test('starts with the spreadsheet registry and keeps HTTP under existing registr
     /\]\(\.\.\/\.\.\/tutorials\/publish-spreadsheet-secured-registry-api\/\)/,
   );
   assert.match(homepageSource, /\]\(tutorials\/author-registry-project\/\)/);
-  assert.match(homepageSource, /\]\(tutorials\/verify-claim-registry-api\/\)/);
   assert.match(quickstartSource, /\]\(\.\.\/\.\.\/tutorials\/author-registry-project\/\)/);
-  assert.match(
+  assert.doesNotMatch(homepageSource, /tutorials\/verify-claim-registry-api/);
+  assert.doesNotMatch(quickstartSource, /tutorials\/verify-claim-registry-api/);
+});
+
+test('gives Evidence a lane on both front doors without a retired Notary path', () => {
+  assert.match(homepageSource, /\]\(start\/evidence-quickstart\/\)/);
+  assert.match(quickstartSource, /\]\(\.\.\/evidence-quickstart\/\)/);
+  assert.match(homepageSource, /tutorials\/first-evidence-assertion/);
+  assert.match(quickstartSource, /tutorials\/first-evidence-assertion/);
+  assert.doesNotMatch(homepageSource, /Expose Notary|verify-claim-registry-api/);
+  assert.doesNotMatch(quickstartSource, /Expose Notary|verify-claim-registry-api/);
+});
+
+test('ends the onboarding spine on Evidence answering over a Relay-protected API', () => {
+  // The two doors are only shown working together in one place: the composed
+  // lab, where Evidence answers over a Relay API rather than a local fixture.
+  // The chooser has to close there, and that page has to be published rather
+  // than redirected back to the chooser.
+  assertOrdered(
     quickstartSource,
-    /\]\(\.\.\/\.\.\/tutorials\/verify-claim-registry-api\/\)/,
+    [
+      'evidence-quickstart/',
+      'tutorials/first-evidence-assertion/',
+      'tutorials/first-run-with-solmara-lab/',
+    ],
+    'quickstart lane',
+  );
+  assert.doesNotMatch(configSource, /'\/tutorials\/first-run-with-solmara-lab\/':/);
+  assert.ok(
+    hasDocForSlug('tutorials/first-run-with-solmara-lab'),
+    'the composed lab tutorial is still a draft',
   );
-  assert.match(homepageSource, /\]\(start\/pre-1\.0-cutover\/\)/);
+  const evidence = topLevelSection(sidebarSource, 'Answer with Evidence');
+  assert.match(evidence, /slug: 'tutorials\/first-run-with-solmara-lab'/);
 });
 
 test('keeps validation on offline test and nested development commands', () => {
@@ -143,14 +165,14 @@ test('keeps validation on offline test and nested development commands', () => {
   );
 });
 
-test('keeps removed command mappings on the cutover page only', () => {
-  assert.match(cutoverSource, /Pre-1\.0 commands have no aliases/);
-  assert.match(cutoverSource, /no automated migration path/);
-  assert.match(cutoverSource, /`registryctl start`/);
-  assert.match(cutoverSource, /`registryctl dev`/);
-  assert.match(cutoverSource, /Bruno generation/);
-  assert.match(cutoverSource, /The public 1\.0 starters are `http` and `spreadsheet`/);
-  assert.match(cutoverSource, /--template spreadsheet/);
+test('does not publish the retired pre-1.0 cutover page', () => {
+  assert.equal(
+    existsSync(resolve(siteRoot, 'src/content/docs/start/pre-1.0-cutover.mdx')),
+    false,
+  );
+  assert.doesNotMatch(sidebarSource, /pre-1\.0-cutover/);
+  assert.doesNotMatch(homepageSource, /pre-1\.0-cutover/);
+  assert.doesNotMatch(quickstartSource, /pre-1\.0-cutover/);
 });
 
 test('every hand-authored sidebar slug resolves to a published documentation page', () => {
@@ -176,8 +198,9 @@ test('legacy first-run entry points redirect to supported 1.0 paths', () => {
   );
   assert.doesNotMatch(
     configSource,
-    /'\/tutorials\/(?:publish-spreadsheet-secured-registry-api|use-your-spreadsheet|verify-claim-registry-api)\/':/,
+    /'\/tutorials\/(?:publish-spreadsheet-secured-registry-api|use-your-spreadsheet)\/':/,
   );
+  assert.match(configSource, /buildNotaryRetirementRedirects\(currentDocsetRedirect\)/);
 });
 
 test('keeps source-assurance artifacts out of the adopter navigation', () => {
diff --git a/docs/site/scripts/notary-retirement.test.mjs b/docs/site/scripts/notary-retirement.test.mjs
new file mode 100644
index 000000000..2b6fb7c0b
--- /dev/null
+++ b/docs/site/scripts/notary-retirement.test.mjs
@@ -0,0 +1,120 @@
+import assert from 'node:assert/strict';
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { test } from 'node:test';
+import YAML from 'yaml';
+import {
+  buildNotaryRetirementRedirects,
+  RETIRED_NOTARY_API_OPERATIONS,
+} from '../src/lib/notary-retirement-redirects.mjs';
+
+const siteRoot = resolve(import.meta.dirname, '..');
+const configSource = readFileSync(resolve(siteRoot, 'astro.config.mjs'), 'utf8');
+const fetchOpenapiSource = readFileSync(resolve(siteRoot, 'scripts/fetch-openapi.mjs'), 'utf8');
+const generatedApiBasesSource = readFileSync(
+  resolve(siteRoot, 'src/lib/generated-api-bases.mjs'),
+  'utf8',
+);
+const repoDocs = YAML.parse(readFileSync(resolve(siteRoot, 'src/data/repo-docs.yaml'), 'utf8'));
+const docsets = YAML.parse(readFileSync(resolve(siteRoot, 'src/data/docsets.yaml'), 'utf8'));
+const openapiSources = YAML.parse(
+  readFileSync(resolve(siteRoot, 'src/data/openapi-sources.yaml'), 'utf8'),
+);
+const projects = YAML.parse(readFileSync(resolve(siteRoot, 'src/data/projects.yaml'), 'utf8'));
+const contracts = YAML.parse(readFileSync(resolve(siteRoot, 'src/data/contracts.yaml'), 'utf8'));
+const redirects = buildNotaryRetirementRedirects((target) => target);
+
+const retirementRoute = '/decisions/notary-retirement-2026-08-03/';
+const authoredNotaryPages = [
+  'explanation/evidence-issuance.mdx',
+  'reference/apis/registry-notary.mdx',
+  'spec/rs-dm-claim.mdx',
+  'spec/rs-pr-notary.mdx',
+  'tutorials/move-notary-to-production-signing.mdx',
+  'tutorials/verify-claim-registry-api.mdx',
+];
+const mirroredNotaryRoutes = [
+  '/products/registry-notary/',
+  '/products/registry-notary/architecture-overview/',
+  '/products/registry-notary/client-sdk-guide/',
+  '/products/registry-notary/identity-and-record-matching/',
+  '/products/registry-notary/source-claim-modeling-guide/',
+  '/products/registry-notary/operator-config-reference/',
+  '/products/registry-notary/postgresql-state-operations/',
+  '/products/registry-notary/credential-lifecycle-status/',
+  '/products/registry-notary/credential-issuance-migration/',
+  '/products/registry-notary/signing-key-provider/',
+  '/products/registry-notary/sd-jwt-vc-conformance-profile/',
+  '/products/registry-notary/notary-capability-matrix/',
+  '/products/registry-notary/notary-scenario-patterns/',
+  '/products/registry-notary/federated-evaluation-operator-guide/',
+  '/products/registry-notary/subject-access-operator-guide/',
+  '/products/registry-notary/deployment-hardening-runbook/',
+  '/products/registry-notary/api-reference/',
+  '/products/registry-notary/oid4vci-wallet-interop/',
+  '/products/registry-notary/release-notes/',
+];
+const authoredNotaryRoutes = [
+  '/explanation/evidence-issuance/',
+  '/reference/apis/registry-notary/',
+  '/reference/apis/notary/',
+  '/spec/rs-dm-claim/',
+  '/spec/rs-pr-notary/',
+  '/tutorials/move-notary-to-production-signing/',
+  '/tutorials/verify-claim-registry-api/',
+];
+
+test('removes the current Notary docs sources and generated product plumbing', () => {
+  assert.equal(repoDocs.repos['registry-notary'], undefined);
+  const currentDocset = docsets.docsets.find((docset) => docset.id === docsets.current);
+  assert.equal(currentDocset.products['registry-notary'], undefined);
+  for (const docset of docsets.docsets.filter((entry) => entry.status === 'archived')) {
+    assert.ok(docset.products['registry-notary'], `${docset.id} lost its historical Notary pin`);
+  }
+  assert.equal(openapiSources.some((source) => source.owner === 'registry-notary'), false);
+  assert.equal(projects.some((project) => project.id === 'registry-notary'), false);
+  assert.equal(contracts.some((contract) => contract.owner === 'registry-notary'), false);
+  assert.doesNotMatch(fetchOpenapiSource, /'registry-notary':/);
+  assert.doesNotMatch(generatedApiBasesSource, /reference\/apis\/notary/);
+});
+
+test('removes authored Notary pages but publishes the retirement decision', () => {
+  for (const page of authoredNotaryPages) {
+    assert.equal(existsSync(resolve(siteRoot, 'src/content/docs', page)), false, page);
+  }
+
+  const retirement = readFileSync(
+    resolve(siteRoot, 'src/content/docs/decisions/notary-retirement-2026-08-03.mdx'),
+    'utf8',
+  );
+  assert.match(retirement, /^status: current$/m);
+  assert.doesNotMatch(retirement, /^draft: true$/m);
+});
+
+test('redirects every removed current Notary route to Evidence or the retirement decision', () => {
+  const allowedTarget = /^(?:\/decisions\/notary-retirement-2026-08-03\/|\/(?:configure\/evidence|reference\/apis\/(?:evidence|registry-evidence)|tutorials\/(?:first-run-with-solmara-lab|move-evidence-to-production-signing))\/)$/;
+
+  for (const route of [...authoredNotaryRoutes, ...mirroredNotaryRoutes]) {
+    const target = redirects[route];
+    assert.ok(target, `${route} has no redirect`);
+    assert.match(target, allowedTarget, `${route} redirects to unsupported target ${target}`);
+    assert.equal(redirects[`${route.slice(0, -1)}.md`], retirementRoute);
+  }
+
+  assert.equal(RETIRED_NOTARY_API_OPERATIONS.length, 27);
+  for (const operation of RETIRED_NOTARY_API_OPERATIONS) {
+    assert.equal(
+      redirects[`/reference/apis/notary/operations/${operation}/`],
+      retirementRoute,
+    );
+  }
+  assert.match(configSource, /\.\.\.buildNotaryRetirementRedirects\(currentDocsetRedirect\)/);
+});
+
+test('presents Relay and Evidence in the current site descriptions and API navigation', () => {
+  assert.match(configSource, /description: 'Documentation for Registry Stack: Registry Relay and Evidence/);
+  assert.doesNotMatch(configSource, /description: '[^']*Registry Notary/);
+  assert.doesNotMatch(configSource, /label: 'Notary \(narrative\)'/);
+  assert.doesNotMatch(configSource, /label: 'Registry Notary'/);
+  assert.doesNotMatch(configSource, /label: 'Notary API operations'/);
+});
diff --git a/docs/site/scripts/public-registryctl-journeys.test.mjs b/docs/site/scripts/public-registryctl-journeys.test.mjs
index 4792b8247..91c6c190f 100644
--- a/docs/site/scripts/public-registryctl-journeys.test.mjs
+++ b/docs/site/scripts/public-registryctl-journeys.test.mjs
@@ -110,29 +110,27 @@ function assertOverlayChecksum(relativePath) {
 const compose =
   'docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml';
 const actions = `${compose} -f generated/compose.initialize.yaml`;
+// A generated package has exactly two product lanes, `relay-public` and
+// `relay-consultation`, so every documented sequence stages and verifies the same services
+// (`crates/registryctl/src/deployment.rs`).
 const servingStages = [
   'registry-relay-consultation-stage-secrets',
-  'registry-notary-stage-secrets',
   'registry-postgresql-stage-secrets',
 ].map((service) => `${compose} run --rm --no-deps ${service}`);
 const stateVerifiers = [
   'registry-relay-public-verify-state',
   'registry-relay-consultation-verify-state',
-  'registry-notary-verify-state',
 ].map((service) => `${actions} run --rm --no-deps ${service}`);
 
 const firstInstallation = [
   `${actions} config --no-interpolate --no-env-resolution --quiet`,
   `${actions} run --rm --no-deps registry-relay-consultation-actions-stage-secrets`,
-  `${actions} run --rm --no-deps registry-notary-actions-stage-secrets`,
   `${actions} run --rm --no-deps registry-postgresql-actions-stage-secrets`,
   `${actions} run --rm registry-postgres-bootstrap`,
   `${actions} run --rm registry-relay-public-prepare-state`,
   `${actions} run --rm registry-relay-consultation-prepare-state`,
-  `${actions} run --rm registry-notary-prepare-state`,
   `${actions} run --rm registry-relay-public-initialize`,
   `${actions} run --rm registry-relay-consultation-initialize`,
-  `${actions} run --rm registry-notary-initialize`,
   ...stateVerifiers,
   ...servingStages,
   `${compose} up --detach --wait --wait-timeout 120`,
@@ -151,11 +149,9 @@ const ordinaryStartAndStop = [
 const productUpdate = [
   `${actions} run --rm --no-deps registry-relay-public-preview-state`,
   `${actions} run --rm --no-deps registry-relay-consultation-preview-state`,
-  `${actions} run --rm --no-deps registry-notary-preview-state`,
   `${compose} stop`,
   `${actions} run --rm --no-deps registry-relay-public-accept-state`,
   `${actions} run --rm --no-deps registry-relay-consultation-accept-state`,
-  `${actions} run --rm --no-deps registry-notary-accept-state`,
   ...stateVerifiers,
   ...servingStages,
   `${compose} up --detach --wait --wait-timeout 120`,
@@ -322,17 +318,17 @@ test('product update executes preview, stop, accept, exact verify, then start',
       '    printf "preview:%s\\n" "$last" >>"$DX_UPDATE_EVENTS"',
       '    ;;',
       '  *" stop")',
-      '    test "$(grep -c "^preview:" "$DX_UPDATE_EVENTS")" -eq 3',
+      '    test "$(grep -c "^preview:" "$DX_UPDATE_EVENTS")" -eq 2',
       '    printf "stopped\\n" >"$DX_UPDATE_STATE"',
       '    printf "stop\\n" >>"$DX_UPDATE_EVENTS"',
       '    ;;',
       '  *-accept-state)',
       '    test "$(cat "$DX_UPDATE_STATE")" = stopped',
-      '    test "$(grep -c "^preview:" "$DX_UPDATE_EVENTS")" -eq 3',
+      '    test "$(grep -c "^preview:" "$DX_UPDATE_EVENTS")" -eq 2',
       '    printf "accept:%s\\n" "$last" >>"$DX_UPDATE_EVENTS"',
       '    ;;',
       '  *-verify-state)',
-      '    test "$(grep -c "^accept:" "$DX_UPDATE_EVENTS")" -eq 3',
+      '    test "$(grep -c "^accept:" "$DX_UPDATE_EVENTS")" -eq 2',
       '    if test "$(cat "$DX_UPDATE_STATE")" = stopped; then',
       '      printf "verify-before:%s\\n" "$last" >>"$DX_UPDATE_EVENTS"',
       '    else',
@@ -343,16 +339,16 @@ test('product update executes preview, stop, accept, exact verify, then start',
       '    ;;',
       '  *-stage-secrets)',
       '    test "$(cat "$DX_UPDATE_STATE")" = stopped',
-      '    test "$(grep -c "^verify-before:" "$DX_UPDATE_EVENTS")" -eq 3',
+      '    test "$(grep -c "^verify-before:" "$DX_UPDATE_EVENTS")" -eq 2',
       '    printf "stage:%s\\n" "$last" >>"$DX_UPDATE_EVENTS"',
       '    ;;',
       '  *" up --detach --wait --wait-timeout 120")',
-      '    test "$(grep -c "^stage:" "$DX_UPDATE_EVENTS")" -eq 3',
+      '    test "$(grep -c "^stage:" "$DX_UPDATE_EVENTS")" -eq 2',
       '    printf "start\\n" >>"$DX_UPDATE_EVENTS"',
       '    printf "running\\n" >"$DX_UPDATE_STATE"',
       '    ;;',
       '  *" ps")',
-      '    test "$(grep -c "^verify-after:" "$DX_UPDATE_EVENTS")" -eq 3',
+      '    test "$(grep -c "^verify-after:" "$DX_UPDATE_EVENTS")" -eq 2',
       '    printf "ps\\n" >>"$DX_UPDATE_EVENTS"',
       '    ;;',
       '  *)',
@@ -377,21 +373,16 @@ test('product update executes preview, stop, accept, exact verify, then start',
     [
       'preview:registry-relay-public-preview-state',
       'preview:registry-relay-consultation-preview-state',
-      'preview:registry-notary-preview-state',
       'stop',
       'accept:registry-relay-public-accept-state',
       'accept:registry-relay-consultation-accept-state',
-      'accept:registry-notary-accept-state',
       'verify-before:registry-relay-public-verify-state',
       'verify-before:registry-relay-consultation-verify-state',
-      'verify-before:registry-notary-verify-state',
       'stage:registry-relay-consultation-stage-secrets',
-      'stage:registry-notary-stage-secrets',
       'stage:registry-postgresql-stage-secrets',
       'start',
       'verify-after:registry-relay-public-verify-state',
       'verify-after:registry-relay-consultation-verify-state',
-      'verify-after:registry-notary-verify-state',
       'ps',
       '',
     ].join('\n'),
@@ -407,7 +398,6 @@ test('transferred package acceptance uses external closure and operator-file che
   assert.match(page, /generated\/\n    compose\.empty\.env[\s\S]*postgresql-server\.env/);
   assert.match(page, /exact environment keys copied from the signed/);
   assert.match(page, /Registryctl never\s+creates production values/);
-  assert.match(page, /compact Notary-to-Relay workload JWT/);
   assert.match(page, /Product startup and preparation remain the semantic validation boundary/);
   assert.match(
     verifyBlock,
@@ -440,7 +430,7 @@ test('Compose include remains operator-owned and outside package verification',
 
 test('initial approval bridge covers every lane before approved-set assembly', () => {
   const page = read('src/content/docs/operate/approve-initial-baseline.mdx');
-  for (const lane of ['relay-public', 'relay-consultation', 'notary']) {
+  for (const lane of ['relay-public', 'relay-consultation']) {
     assert.match(page, new RegExp(`--lane ${lane}`));
     assert.match(page, new RegExp(`build/local/signing-inputs/${lane}`));
     assert.match(page, new RegExp(`${lane}-anchor\\.json`));
@@ -515,7 +505,7 @@ test('evaluation-only lane key procedure emits distinct owner-only Ed25519 JWK p
   );
 
   const publicMembers = new Set();
-  for (const lane of ['relay-public', 'relay-consultation', 'notary']) {
+  for (const lane of ['relay-public', 'relay-consultation']) {
     const privatePath = resolve(root, `evaluation-keys/${lane}.private.jwk`);
     const publicPath = resolve(root, `evaluation-keys/${lane}.public.jwk`);
     const privateFile = readRegularUtf8WithMode(privatePath);
@@ -544,5 +534,5 @@ test('evaluation-only lane key procedure emits distinct owner-only Ed25519 JWK p
     assertPathMissing(resolve(root, `evaluation-keys/${lane}.private.der`));
     assertPathMissing(resolve(root, `evaluation-keys/${lane}.public.der`));
   }
-  assert.equal(publicMembers.size, 3);
+  assert.equal(publicMembers.size, 2);
 });
diff --git a/docs/site/scripts/registryctl-tutorial.mjs b/docs/site/scripts/registryctl-tutorial.mjs
index f76aded44..8dacf6f7c 100644
--- a/docs/site/scripts/registryctl-tutorial.mjs
+++ b/docs/site/scripts/registryctl-tutorial.mjs
@@ -328,15 +328,21 @@ export function assertProjectReports(
     'build fixture set differs from test',
   );
 
+  // registryctl derived this case from an evidence service's own authorization
+  // decision, and stopped generating it when that service kind was removed
+  // (crates/registryctl/src/project_authoring/fixtures.rs). It is no longer
+  // required, but a project that still reports one must prove the denial
+  // happened before any source call.
   const authorizationCheck = testReport.fixtures.find((fixture) =>
     fixture.fixture.endsWith('::derived/authorization_before_source'),
   );
-  invariant(authorizationCheck, 'authorization-before-source fixture is missing');
-  invariant(
-    authorizationCheck.expected_error === 'authorization.denied' &&
-      authorizationCheck.source_access === false,
-    'authorization-before-source fixture does not prove zero source access',
-  );
+  if (authorizationCheck) {
+    invariant(
+      authorizationCheck.expected_error === 'authorization.denied' &&
+        authorizationCheck.source_access === false,
+      'authorization-before-source fixture does not prove zero source access',
+    );
+  }
 
   if (minimizationMode === 'derived') {
     const minimizationCheck = testReport.fixtures.find((fixture) =>
@@ -360,17 +366,17 @@ export function assertProjectReports(
       'project-record-snapshot.match outputs must be exactly ["status"]',
     );
     invariant(
-      JSON.stringify(snapshotResult.claims) ===
-        JSON.stringify(['project-record-exists', 'project-status-accepted']),
-      'project-record-snapshot.match claims must be exactly the two documented predicate claims',
+      snapshotResult.claims === undefined || snapshotResult.claims.length === 0,
+      'project-record-snapshot.match must report no claims for the Relay-only starter',
     );
   }
 
   const affectedLanes = buildEnvelope.affected_lanes;
   invariant(Array.isArray(affectedLanes), 'build affected_lanes must be an array');
-  for (const lane of ['relay-public', 'relay-consultation', 'notary']) {
-    invariant(affectedLanes.includes(lane), `build does not include ${lane}`);
-  }
+  invariant(
+    JSON.stringify(affectedLanes) === JSON.stringify(['relay-public', 'relay-consultation']),
+    'build affected_lanes must contain only the two Relay lanes',
+  );
 }
 
 export function writeEvidenceManifest(
@@ -413,7 +419,6 @@ export function writeEvidenceManifest(
         covers: [
           'starter',
           'adapted-workbook',
-          'evidence-rule-change',
           'offline-fixtures',
           'reviewed-build',
         ],
@@ -430,32 +435,18 @@ export function writeEvidenceManifest(
           'spreadsheet-adapted/test.json',
           'spreadsheet-adapted/check.json',
           'spreadsheet-adapted/build.json',
-          'spreadsheet-evidence/before-trace.txt',
-          'spreadsheet-evidence/after-trace.txt',
-          'spreadsheet-evidence/test.txt',
-          'spreadsheet-evidence/test.json',
-          'spreadsheet-evidence/check.json',
-          'spreadsheet-evidence/build.json',
           ...(mode === 'sealed'
             ? [
                 'spreadsheet/runtime/dev-start.txt',
                 'spreadsheet/runtime/records-denied.json',
                 'spreadsheet/runtime/records-request.json',
-                'spreadsheet/runtime/evidence-request.json',
                 'spreadsheet/runtime/dev-smoke.txt',
                 'spreadsheet/runtime/dev-down.txt',
                 'spreadsheet-adapted/runtime/dev-start.txt',
                 'spreadsheet-adapted/runtime/records-denied.json',
                 'spreadsheet-adapted/runtime/records-request.json',
-                'spreadsheet-adapted/runtime/evidence-request.json',
                 'spreadsheet-adapted/runtime/dev-smoke.txt',
                 'spreadsheet-adapted/runtime/dev-down.txt',
-                'spreadsheet-evidence/runtime/dev-start.txt',
-                'spreadsheet-evidence/runtime/records-denied.json',
-                'spreadsheet-evidence/runtime/records-request.json',
-                'spreadsheet-evidence/runtime/evidence-request.json',
-                'spreadsheet-evidence/runtime/dev-smoke.txt',
-                'spreadsheet-evidence/runtime/dev-down.txt',
               ]
             : []),
         ],
diff --git a/docs/site/scripts/registryctl-tutorial.test.mjs b/docs/site/scripts/registryctl-tutorial.test.mjs
index db6ff0926..ee6d428e3 100644
--- a/docs/site/scripts/registryctl-tutorial.test.mjs
+++ b/docs/site/scripts/registryctl-tutorial.test.mjs
@@ -175,13 +175,6 @@ test('parses one strict JSON document and asserts subsets without array-order co
 });
 
 test('accepts matching test, check, and build reports with derived security evidence', () => {
-  const fixture = {
-    integration: 'person-record',
-    fixture: 'match::derived/authorization_before_source',
-    expected_error: 'authorization.denied',
-    source_access: false,
-    passed: true,
-  };
   const minimization = {
     integration: 'person-record',
     fixture: 'match::derived/output_minimization',
@@ -191,14 +184,14 @@ test('accepts matching test, check, and build reports with derived security evid
     schema_version: 'registryctl.project_command.v1',
     project: 'fictional-registry',
     environment: 'local',
-    fixtures: [fixture, minimization],
+    fixtures: [minimization],
   };
   const testReport = JSON.stringify({ ...common, status: 'passed' });
   const checkReport = JSON.stringify({ ...common, status: 'valid' });
   const buildReport = JSON.stringify({
     schema_version: 'registryctl.reviewed_project_build_report.v1',
     build: { ...common, status: 'built' },
-    affected_lanes: ['relay-public', 'relay-consultation', 'notary'],
+    affected_lanes: ['relay-public', 'relay-consultation'],
   });
 
   assert.doesNotThrow(() =>
@@ -212,42 +205,35 @@ test('accepts matching test, check, and build reports with derived security evid
         JSON.stringify({
           schema_version: 'registryctl.reviewed_project_build_report.v1',
           build: { ...common, status: 'built' },
-          affected_lanes: ['relay-consultation', 'notary'],
+          affected_lanes: ['relay-consultation'],
         }),
         'fictional-registry',
       ),
-    /relay-public/,
+    /two Relay lanes/,
   );
 });
 
-test('accepts snapshot reports with explicit minimized outputs and claims', () => {
-  const authorization = {
-    integration: 'project-record-snapshot',
-    fixture: 'match::derived/authorization_before_source',
-    expected_error: 'authorization.denied',
-    source_access: false,
-    passed: true,
-  };
+test('accepts snapshot reports with explicit minimized outputs and no claims', () => {
+  // registryctl reports no `claims` member at all for a Relay-only project.
   const snapshot = {
     integration: 'project-record-snapshot',
     fixture: 'match',
     outcome: 'match',
     outputs: ['status'],
-    claims: ['project-record-exists', 'project-status-accepted'],
     passed: true,
   };
   const common = {
     schema_version: 'registryctl.project_command.v1',
     project: 'fictional-public-works-registry',
     environment: 'local',
-    fixtures: [snapshot, authorization],
+    fixtures: [snapshot],
   };
   const testReport = JSON.stringify({ ...common, status: 'passed' });
   const checkReport = JSON.stringify({ ...common, status: 'valid' });
   const buildReport = JSON.stringify({
     schema_version: 'registryctl.reviewed_project_build_report.v1',
     build: { ...common, status: 'built' },
-    affected_lanes: ['relay-public', 'relay-consultation', 'notary'],
+    affected_lanes: ['relay-public', 'relay-consultation'],
   });
 
   assert.doesNotThrow(() =>
@@ -260,6 +246,28 @@ test('accepts snapshot reports with explicit minimized outputs and claims', () =
     ),
   );
 
+  const withClaims = { ...snapshot, claims: ['project-record-exists'] };
+  const reportWithClaims = JSON.stringify({
+    ...common,
+    status: 'passed',
+    fixtures: [withClaims],
+  });
+  assert.throws(
+    () =>
+      assertProjectReports(
+        reportWithClaims,
+        JSON.stringify({ ...common, status: 'valid', fixtures: [withClaims] }),
+        JSON.stringify({
+          schema_version: 'registryctl.reviewed_project_build_report.v1',
+          build: { ...common, status: 'built', fixtures: [withClaims] },
+          affected_lanes: ['relay-public', 'relay-consultation'],
+        }),
+        'fictional-public-works-registry',
+        'snapshot',
+      ),
+    /must report no claims/,
+  );
+
   const extraOutput = {
     ...snapshot,
     outputs: ['status', 'project_id'],
@@ -267,12 +275,12 @@ test('accepts snapshot reports with explicit minimized outputs and claims', () =
   const reportWithExtraOutput = JSON.stringify({
     ...common,
     status: 'passed',
-    fixtures: [extraOutput, authorization],
+    fixtures: [extraOutput],
   });
   const checkWithExtraOutput = JSON.stringify({
     ...common,
     status: 'valid',
-    fixtures: [extraOutput, authorization],
+    fixtures: [extraOutput],
   });
   assert.throws(
     () =>
@@ -284,9 +292,9 @@ test('accepts snapshot reports with explicit minimized outputs and claims', () =
           build: {
             ...common,
             status: 'built',
-            fixtures: [extraOutput, authorization],
+            fixtures: [extraOutput],
           },
-          affected_lanes: ['relay-public', 'relay-consultation', 'notary'],
+          affected_lanes: ['relay-public', 'relay-consultation'],
         }),
         'fictional-public-works-registry',
         'snapshot',
@@ -295,6 +303,43 @@ test('accepts snapshot reports with explicit minimized outputs and claims', () =
   );
 });
 
+// registryctl stopped generating this derived case with the Notary claim model
+// (crates/registryctl/src/project_authoring/fixtures.rs). A project that still
+// reports one must still prove the denial happened before any source call.
+test('rejects a reported authorization-before-source case that reached the source', () => {
+  const reached = {
+    integration: 'person-record',
+    fixture: 'match::derived/authorization_before_source',
+    expected_error: 'authorization.denied',
+    source_access: true,
+    passed: true,
+  };
+  const common = {
+    schema_version: 'registryctl.project_command.v1',
+    project: 'fictional-registry',
+    environment: 'local',
+    fixtures: [
+      reached,
+      { integration: 'person-record', fixture: 'match::derived/output_minimization', passed: true },
+    ],
+  };
+
+  assert.throws(
+    () =>
+      assertProjectReports(
+        JSON.stringify({ ...common, status: 'passed' }),
+        JSON.stringify({ ...common, status: 'valid' }),
+        JSON.stringify({
+          schema_version: 'registryctl.reviewed_project_build_report.v1',
+          build: { ...common, status: 'built' },
+          affected_lanes: ['relay-public', 'relay-consultation'],
+        }),
+        'fictional-registry',
+      ),
+    /does not prove zero source access/,
+  );
+});
+
 test('evidence manifest keeps three adopter outcomes and their runtime variants', (t) => {
   const root = mkdtempSync(resolve(tmpdir(), 'registryctl-tutorial-manifest-'));
   t.after(() => rmSync(root, { recursive: true, force: true }));
@@ -315,32 +360,33 @@ test('evidence manifest keeps three adopter outcomes and their runtime variants'
   assert.ok(
     manifest.projects
       .find((project) => project.id === 'spreadsheet')
-      .reports.includes('spreadsheet-evidence/runtime/dev-smoke.txt'),
+      .reports.includes('spreadsheet/runtime/dev-smoke.txt'),
   );
   assert.ok(
     manifest.projects
       .find((project) => project.id === 'spreadsheet')
-      .reports.includes('spreadsheet-evidence/runtime/records-denied.json'),
+      .reports.includes('spreadsheet/runtime/records-denied.json'),
   );
   assert.ok(
     manifest.projects
       .find((project) => project.id === 'spreadsheet')
-      .reports.includes('spreadsheet-evidence/runtime/records-request.json'),
+      .reports.includes('spreadsheet/runtime/records-request.json'),
   );
   assert.ok(
     manifest.projects
       .find((project) => project.id === 'spreadsheet')
-      .reports.includes('spreadsheet-evidence/runtime/evidence-request.json'),
+      .reports.includes('spreadsheet-adapted/runtime/dev-smoke.txt'),
   );
   assert.ok(
     manifest.projects
       .find((project) => project.id === 'spreadsheet')
-      .reports.includes('spreadsheet-adapted/runtime/dev-smoke.txt'),
+      .covers.includes('adapted-workbook'),
   );
-  assert.ok(
+  assert.equal(
     manifest.projects
       .find((project) => project.id === 'spreadsheet')
-      .covers.includes('adapted-workbook'),
+      .reports.some((report) => report.includes('spreadsheet-evidence') || report.includes('evidence-request')),
+    false,
   );
   assert.ok(
     manifest.projects
@@ -354,7 +400,7 @@ test('evidence manifest keeps three adopter outcomes and their runtime variants'
   );
 });
 
-test('reader gate executes the evidence change and limits development runtime to sealed mode', () => {
+test('reader gate executes Relay-only journeys and limits development runtime to sealed mode', () => {
   const script = read('scripts/check-registryctl-tutorials.sh');
   const spreadsheet = extractFencedBlocks(
     read('src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx'),
@@ -389,7 +435,6 @@ test('reader gate executes the evidence change and limits development runtime to
   assert.ok(spreadsheetFence('Test the starter', 'text', 1));
   assert.ok(spreadsheetFence('Inspect the contract you own', 'text', 1));
   assert.ok(spreadsheetFence('Build the review inputs', 'text', 1));
-  assert.match(script, /Spreadsheet evidence-change reader journey: PASS/);
   assert.match(script, /if \[\[ "\$RUNNER_MODE" != "sealed" \]\]; then/);
   assert.match(script, /run_spreadsheet_runtime/);
   assert.match(script, /run_synthetic_runtime/);
@@ -399,11 +444,7 @@ test('reader gate executes the evidence change and limits development runtime to
   assert.match(script, /anonymous records request returned HTTP/);
   assert.match(script, /auth\.missing_credential/);
   assert.match(script, /assert-json-subset "\$report_directory\/records-request\.json"/);
-  assert.match(script, /assert-json-subset "\$report_directory\/evidence-request\.json"/);
-  assert.match(script, /assert-json-subset "\$evidence_body"/);
-  assert.match(script, /\n\tPW-002 \\\n\tcentral-02 \\\n\thealth \\\n\tplanned\n/);
   assert.match(script, /north-01/);
-  assert.match(script, /'planned'/);
   assert.match(script, /dev smoke/);
   assert.match(script, /dev down/);
   assert.match(script, /--environment local/);
@@ -420,14 +461,16 @@ test('reader gate executes the evidence change and limits development runtime to
   assert.match(script, /REGISTRYCTL_RELEASED_DOCS_ROOT/);
   assert.match(script, /RELEASED_DOCS_ROOT\/tutorials\/author-registry-project\.md/);
   assert.match(script, /RELEASED_DOCS_ROOT\/tutorials\/publish-spreadsheet-secured-registry-api\.md/);
-  assert.match(script, /RELEASED_DOCS_ROOT\/tutorials\/verify-claim-registry-api\.md/);
   assert.match(script, /RELEASED_DOCS_ROOT\/configure\/oauth-client-credentials\.md/);
   assert.match(script, /RELEASED_DOCS_ROOT\/examples\/registryctl\/opencrvs-events-api-overlay-v1\.sh/);
   assert.match(script, /RELEASED_DOCS_ROOT\/examples\/registryctl\/jsonplaceholder-todo-live-overlay-v1\.sh/);
   assert.match(script, /OPENCRVS_PROJECT="\$\{RETAINED_OAUTH_PROJECT:-\$WORK_ROOT\/opencrvs-reader\}"/);
   assert.match(script, /HTTP_PROJECT="\$\{RETAINED_PROJECT:-\$WORK_ROOT\/http-reader\}"/);
   assert.match(script, /SPREADSHEET_PROJECT="\$WORK_ROOT\/spreadsheet-reader"/);
-  assert.match(script, /EVIDENCE_PROJECT="\$SPREADSHEET_PROJECT"/);
+  assert.doesNotMatch(
+    script,
+    /EVIDENCE_TUTORIAL|EVIDENCE_PROJECT|spreadsheet-evidence|evidence-request\.json|Evidence API|Evidence request/,
+  );
   assert.match(script, /"\$RETAINED_OAUTH_PROJECT"/);
   assert.match(script, /disposable runtime runs only with an explicitly installed sealed binary/);
   assert.doesNotMatch(
@@ -481,7 +524,6 @@ test('OAuth guidance distinguishes expiring and strict no-expiry profiles', () =
 
 test('OpenCRVS remains a synthetic case study, not a template or conformance claim', () => {
   const tutorial = read('src/content/docs/tutorials/verify-opencrvs-claims.mdx');
-  const cutover = read('src/content/docs/start/pre-1.0-cutover.mdx');
 
   assert.match(tutorial, /^status: current$/m);
   assert.match(tutorial, /does not ship an OpenCRVS template/);
@@ -491,10 +533,7 @@ test('OpenCRVS remains a synthetic case study, not a template or conformance cla
   assert.match(tutorial, /POST \/api\/events\/events\/search/);
   assert.match(tutorial, /birth-event-search/);
   assert.match(tutorial, /birth-event-match/);
-  assert.match(tutorial, /birth-event-found/);
-  assert.match(tutorial, /birth-event-registered/);
+  assert.match(tutorial, /birth-event-verification/);
+  assert.match(tutorial, /kind: consultation_api/);
   assert.doesNotMatch(tutorial, /--template opencrvs|init --from opencrvs/);
-  assert.match(cutover, /public 1\.0 starters are `http` and `spreadsheet`/);
-  assert.match(cutover, /OAuth-backed Rhai is an adaptation of an HTTP project/);
-  assert.match(cutover, /OpenCRVS material is a synthetic example.*not a template/);
 });
diff --git a/docs/site/scripts/release-notes-drift.test.mjs b/docs/site/scripts/release-notes-drift.test.mjs
index cf5c35edc..eb8ff0d67 100644
--- a/docs/site/scripts/release-notes-drift.test.mjs
+++ b/docs/site/scripts/release-notes-drift.test.mjs
@@ -22,11 +22,6 @@ const productReleaseNotes = [
     changelog: 'products/manifest/CHANGELOG.md',
     releaseNotes: 'products/manifest/docs/release-notes.md',
   },
-  {
-    name: 'Registry Notary',
-    changelog: 'products/notary/CHANGELOG.md',
-    releaseNotes: 'products/notary/docs/release-notes.md',
-  },
 ];
 
 function readRepoFile(path) {
@@ -108,7 +103,7 @@ test('registryctl changelog tracks the latest stack release', () => {
   );
 });
 
-test('a hosted-held release keeps external OID4VCI evidence candidate-only', () => {
+test('a hosted-held release claims no external OID4VCI evidence', () => {
   const manifest = latestStackManifest();
   const hostedHeld = manifest.warnings?.some(
     (warning) => warning.code === 'hosted-publication-held',
@@ -126,8 +121,18 @@ test('a hosted-held release keeps external OID4VCI evidence candidate-only', ()
     publicEvidenceData,
     /Solmara Lab[^\n]*(?:checks|passes|conformance evidence)/,
   );
-  assert.match(
-    publicEvidenceData,
-    /External wallet[\s\S]*candidate-only[\s\S]*frozen (?:artifact|release artifact)/,
-  );
+  // The register carried an OID4VCI entry until the Registry Notary retirement
+  // deleted it. Either shape is honest while publication is held: no entry at
+  // all, or an entry that marks the external evidence candidate-only. What must
+  // never appear is an entry claiming external evidence outright.
+  const oid4vciEntries = publicEvidenceData
+    .split(/^- id: /m)
+    .filter((entry) => /oid4vci/i.test(entry));
+  for (const entry of oid4vciEntries) {
+    assert.match(
+      entry,
+      /candidate-only[\s\S]*frozen (?:artifact|release artifact)/,
+      'a published OID4VCI entry must mark its external evidence candidate-only',
+    );
+  }
 });
diff --git a/docs/site/scripts/replay-protection-contract.test.mjs b/docs/site/scripts/replay-protection-contract.test.mjs
index 58e18d5c1..f31c08c19 100644
--- a/docs/site/scripts/replay-protection-contract.test.mjs
+++ b/docs/site/scripts/replay-protection-contract.test.mjs
@@ -10,13 +10,13 @@ const spec = readFileSync(
   'utf8',
 );
 const replaySection = spec.match(
-  /^## 8[.] Replay-protection authority\n(?<body>[\s\S]*?)(?=^## 9[.] )/m,
+  /^## 7[.] Replay-protection authority\n(?<body>[\s\S]*?)(?=^## 8[.] )/m,
 )?.groups?.body;
 
 assert.ok(replaySection, 'RS-SEC-G must contain the replay-protection authority section');
 
 test('RS-SEC-G keeps the exact product replay matrix', () => {
-  const productRows = replaySection.match(/^\| Registry (?:Relay|Notary) \|.*$/gm) ?? [];
+  const productRows = replaySection.match(/^\| Registry (?:Relay|Mint) \|.*$/gm) ?? [];
   assert.equal(productRows.length, 2, 'expected one replay-contract row per product');
 
   assert.match(
@@ -25,22 +25,39 @@ test('RS-SEC-G keeps the exact product replay matrix', () => {
   );
   assert.match(
     replaySection,
-    /\| Registry Notary \| Scoped, domain-separated protocol one-time and completion domains,[\s\S]*?Product-specific scope and identifier hashes[\s\S]*?\| The product-specific absolute expiry or bounded retention for the domain,/,
+    /\| Registry Mint \| Single use of a client assertion identifier at the token endpoint[.] \|[\s\S]*?verified against the named client's registered keys[\s\S]*?\| The assertion's own expiry, bounded by the configured maximum assertion lifetime,/,
   );
 });
 
+// Evidence has no replay subsystem, and the page must not imply that the echoed
+// request nonce is one.
+test('RS-SEC-G states that Evidence holds no replay state', () => {
+  assert.match(replaySection, /Evidence holds no replay state at all/);
+  assert.match(replaySection, /never stored, uniqueness-checked, or exposed/);
+});
+
 test('RS-SEC-G keeps replay authority product-owned and isolated', () => {
   assert.match(replaySection, /production or multi-instance deployment MUST keep replay correctness state in\nthe PostgreSQL state owned by the product/);
   assert.match(replaySection, /Replicas of one product authority MUST share only that authority's product state/);
-  assert.match(replaySection, /Separate federation authorities MUST NOT share replay state/);
+  assert.match(replaySection, /Separate product authorities MUST NOT share replay state/);
   assert.match(
     replaySection,
-    /Registry Relay and Registry Notary MUST NOT share replay tables, schemas, database roles,\nmigrations, or correctness transactions/,
+    /Two products MUST NOT share replay tables, schemas, database roles,\nmigrations, or correctness transactions/,
   );
   assert.match(replaySection, /MUST NOT turn these boundaries into a shared correctness-state abstraction/);
   assert.doesNotMatch(replaySection, /\bRedis\b/i);
 });
 
+// In-process single use is not a cross-instance guarantee, and the page must
+// not let a reader read it as one.
+test('RS-SEC-G bounds in-process single-use enforcement', () => {
+  assert.match(replaySection, /MUST fail closed when\nthe cache is saturated rather than evict a live entry/);
+  assert.match(
+    replaySection,
+    /deployment that runs more than one instance MUST NOT\nclaim single use across those instances/,
+  );
+});
+
 test('RS-SEC-G links retention and recovery and requires fail-closed recovery', () => {
   assert.match(replaySection, /\[retention and persistent-state reference\]\(\.\.\/\.\.\/operate\/retention-and-persistent-state\/\)/);
   assert.match(replaySection, /\[backup and restore procedure\]\(\.\.\/\.\.\/operate\/backup-and-restore\/\)/);
diff --git a/docs/site/scripts/sync-repo-docs.mjs b/docs/site/scripts/sync-repo-docs.mjs
index ca07167ca..e69617e35 100644
--- a/docs/site/scripts/sync-repo-docs.mjs
+++ b/docs/site/scripts/sync-repo-docs.mjs
@@ -529,12 +529,16 @@ async function main() {
   const docsets = await loadDocsets({ dataDir });
   validateRepoDocsMetadata(manifest, knownStandards, docsets);
   const docset = getDocset(docsets, selectedDocsetId(docsets));
+  // Filter before applying docset refs: a repo whose docs are all excluded
+  // from this docset (a product newer than the docset, like registry-evidence
+  // in pre-Evidence archives) must not count as an active repo the docset is
+  // required to pin.
+  filterRepoDocsForDocset(manifest, docset);
   if (docset.id !== docsets.current) {
     applyDocsetRefs(manifest, docset);
     console.log(`Using archived docset ${docset.id} for product docs.`);
   }
   applyDocsetMetadataOverrides(manifest, docset);
-  filterRepoDocsForDocset(manifest, docset);
 
   // Clean and recreate the output dir so removed allowlist entries don't linger.
   await rm(outputRoot, { recursive: true, force: true });
diff --git a/docs/site/src/components/AuthoringConfigurationReference.astro b/docs/site/src/components/AuthoringConfigurationReference.astro
index b2267a112..f6314f0b3 100644
--- a/docs/site/src/components/AuthoringConfigurationReference.astro
+++ b/docs/site/src/components/AuthoringConfigurationReference.astro
@@ -2,7 +2,7 @@
 import reference from '../data/generated/configuration-reference.json';
 import coverage from '../data/generated/configuration-reference-coverage.json';
 
-const schemaOrder = ['project', 'environment', 'integration', 'fixture', 'entity', 'relay', 'notary'];
+const schemaOrder = ['project', 'environment', 'integration', 'fixture', 'entity', 'relay'];
 const schemaLabels: Record<string, string> = {
   project: 'Project configuration',
   environment: 'Environment configuration',
@@ -10,7 +10,6 @@ const schemaLabels: Record<string, string> = {
   fixture: 'Fixture configuration',
   entity: 'Entity configuration',
   relay: 'Relay runtime configuration',
-  notary: 'Notary runtime configuration',
 };
 const schemaFiles: Record<string, string> = {
   project: 'registry-stack.yaml',
@@ -19,7 +18,6 @@ const schemaFiles: Record<string, string> = {
   fixture: 'integrations/*/fixtures/*.yaml',
   entity: 'entities/*.yaml',
   relay: 'registry-relay runtime configuration',
-  notary: 'registry-notary runtime configuration',
 };
 type ReferenceField = (typeof reference.fields)[number] & {
   address: (typeof reference.fields)[number]['address'] & {
@@ -149,7 +147,7 @@ const base = import.meta.env.BASE_URL === '/' ? '' : import.meta.env.BASE_URL.re
 
 <p>
   Project, environment, integration, fixture, and entity sections describe human-authored country
-  files. Relay and Notary sections describe generated product runtime contracts. The reviewed intent
+  files. The Relay section describes the generated product runtime contract. The reviewed intent
   sidecars are documentation knowledge only and are not runtime configuration.
 </p>
 <p>
diff --git a/docs/site/src/components/DocsList.astro b/docs/site/src/components/DocsList.astro
index e5072dde5..e55ee530a 100644
--- a/docs/site/src/components/DocsList.astro
+++ b/docs/site/src/components/DocsList.astro
@@ -3,10 +3,9 @@ import projects from '../data/generated/projects.json';
 
 const base = import.meta.env.BASE_URL;
 const descriptions = new Map([
-  ['registry-platform', 'Share security and operational primitives across Relay, Notary, and future registry services.'],
+  ['registry-platform', 'Share security and operational primitives across Relay, Evidence, and future registry services.'],
   ['registry-manifest', 'Describe a registry once; publish everything other systems need to find, understand, and connect to it.'],
   ['registry-relay', 'Let authorized systems query a registry over HTTP, without giving them database access or write paths.'],
-  ['registry-notary', 'Prove a person qualifies for a program without sharing the records that prove it.'],
   ['registry-atlas', 'Explore what a registry publishes (data, schemas, rules) in your browser before you integrate.'],
   ['solmara-lab', 'Run the stack against a fictional country story, with synthetic fixtures and guided journeys.'],
 ]);
diff --git a/docs/site/src/components/RegistryHead.astro b/docs/site/src/components/RegistryHead.astro
index f842f2035..d40904377 100644
--- a/docs/site/src/components/RegistryHead.astro
+++ b/docs/site/src/components/RegistryHead.astro
@@ -1,6 +1,7 @@
 ---
 import docsetsManifest from '../data/generated/docsets.json';
 import { mdHrefForPath } from '../lib/md-href';
+import { isGeneratedApiPath } from '../lib/generated-api-bases.mjs';
 
 const activeDocsetId = process.env.DOCS_DOCSET || docsetsManifest.current;
 const activeDocset =
@@ -28,8 +29,7 @@ const path = Astro.url.pathname.replace(import.meta.env.BASE_URL, '/');
 const is404 = path === '/404/' || path === '/404';
 // starlight-openapi reference routes are virtual pages with no per-page .md
 // twin, so they must not advertise a (broken) Markdown alternate link.
-const isGeneratedApi =
-  path.startsWith('/reference/apis/relay/') || path.startsWith('/reference/apis/notary/');
+const isGeneratedApi = isGeneratedApiPath(path);
 const mdHref = mdHrefForPath(Astro.url.pathname, import.meta.env.BASE_URL);
 const umamiWebsiteId = isSearchExcluded ? '' : import.meta.env.PUBLIC_UMAMI_WEBSITE_ID?.trim();
 const umamiScriptSrc =
diff --git a/docs/site/src/components/RegistryPageTitle.astro b/docs/site/src/components/RegistryPageTitle.astro
index f06003627..e6968a0a7 100644
--- a/docs/site/src/components/RegistryPageTitle.astro
+++ b/docs/site/src/components/RegistryPageTitle.astro
@@ -1,5 +1,6 @@
 ---
 import { mdHrefForPath } from '../lib/md-href';
+import { isGeneratedApiPath } from '../lib/generated-api-bases.mjs';
 
 const { starlightRoute } = Astro.locals;
 const PAGE_TITLE_ID = '_top';
@@ -33,8 +34,7 @@ const isHome = path === '/';
 const is404 = parts.length === 1 && parts[0] === '404';
 // starlight-openapi reference routes are virtual pages with no per-page .md
 // twin, so the Copy/View as Markdown affordances would dangle. Skip them.
-const isGeneratedApi =
-  path.startsWith('/reference/apis/relay/') || path.startsWith('/reference/apis/notary/');
+const isGeneratedApi = isGeneratedApiPath(path);
 const section = parts[0] ? sectionLabels.get(parts[0]) : undefined;
 const current = currentLabels.get(path) ?? starlightRoute.entry.data.title;
 const isWide = starlightRoute.entry.data.wide === true;
@@ -42,6 +42,12 @@ const isWide = starlightRoute.entry.data.wide === true;
 // Compute the .md URL for this page (BASE_URL-aware). The data attribute is
 // read by the client script so the script doesn't need to recompute it.
 const mdHref = mdHrefForPath(Astro.url.pathname, import.meta.env.BASE_URL);
+
+// Whose page this is, in the deployment roles start/when-to-use.mdx defines.
+// Required on tutorials by scripts/check-doc-frontmatter.mjs, so every tutorial
+// says who it is for before the reader starts it; other pages may omit it.
+const personas = starlightRoute.entry.data.persona ?? [];
+const personaHref = `${import.meta.env.BASE_URL}start/when-to-use/#who-does-what`;
 ---
 
 {isWide && (
@@ -70,6 +76,17 @@ const mdHref = mdHrefForPath(Astro.url.pathname, import.meta.env.BASE_URL);
 
 <h1 id={PAGE_TITLE_ID}>{starlightRoute.entry.data.title}</h1>
 
+{personas.length > 0 && (
+  <p class="registry-persona">
+    For the {personas.map((persona: string, index: number) => (
+      <Fragment>
+        {index > 0 && ' and '}
+        <a href={personaHref}>{persona}</a>
+      </Fragment>
+    ))}
+  </p>
+)}
+
 <!-- Vendor-neutral AI affordances: Copy as Markdown / View as Markdown.
      The .md URL follows the contract: strip trailing slash, append .md; root -> index.md.
      The click handler is bound in the <script> block below, re-attached on
@@ -162,6 +179,31 @@ const mdHref = mdHrefForPath(Astro.url.pathname, import.meta.env.BASE_URL);
 </script>
 
 <style>
+  /* Persona line sits between the <h1> and the control group, in the same mono
+     utility type, so "whose page is this" is answered before the first
+     paragraph without competing with the title. */
+  .registry-persona {
+    font-family: var(--__sl-font-mono);
+    font-size: 11px;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+    line-height: 1;
+    color: var(--registry-muted);
+    margin-top: 10px;
+    margin-bottom: 0;
+  }
+
+  .registry-persona a {
+    color: inherit;
+    text-decoration: none;
+    border-bottom: 1px solid var(--registry-rule);
+  }
+
+  .registry-persona a:hover {
+    color: var(--registry-blue);
+    border-bottom-color: var(--registry-blue);
+  }
+
   /* Control group sits directly below the <h1>, flush-left, using mono type
      to read as a utility annotation rather than navigation. */
   .registry-md-actions {
diff --git a/docs/site/src/content.config.ts b/docs/site/src/content.config.ts
index d89452408..291b8f37a 100644
--- a/docs/site/src/content.config.ts
+++ b/docs/site/src/content.config.ts
@@ -3,6 +3,8 @@ import { docsLoader } from '@astrojs/starlight/loaders';
 import { docsSchema } from '@astrojs/starlight/schema';
 import { z } from 'astro/zod';
 
+import { DOC_PERSONAS } from './lib/doc-personas.mjs';
+
 const registryLegendFrontmatter = z.object({
   // These seven keys are required for every hand-authored page, but they are
   // declared optional here so that virtual pages injected by plugins (the
@@ -51,6 +53,13 @@ const registryLegendFrontmatter = z.object({
   audience: z
     .array(z.enum(['integrator', 'operator', 'maintainer', 'specification editor', 'tooling']))
     .optional(),
+  // Whose tutorial this is, in the deployment roles start/when-to-use.mdx
+  // defines. Optional here for the same reason the seven keys above are;
+  // check-doc-frontmatter.mjs requires it for every `doc_type: tutorial` page.
+  // Distinct from `audience`, which is the specification-reader axis.
+  // The cast only tells Zod the imported list is non-empty, which a plain JS
+  // array cannot state; the values it validates against are the list itself.
+  persona: z.array(z.enum(DOC_PERSONAS as [string, ...string[]])).optional(),
 });
 
 export const collections = {
diff --git a/docs/site/src/content/docs/changelog.mdx b/docs/site/src/content/docs/changelog.mdx
index ef362dc74..f271fe8cc 100644
--- a/docs/site/src/content/docs/changelog.mdx
+++ b/docs/site/src/content/docs/changelog.mdx
@@ -5,7 +5,7 @@ status: current
 owner: registry-docs
 source_repos:
   - registry-docs
-last_reviewed: "2026-08-01"
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced: []
@@ -16,6 +16,29 @@ documents.
 Per-product release notes live in each product repository; the entries below link to the
 relevant product pages on this site rather than duplicating release notes.
 
+## 2026-08-03
+
+Product direction update:
+
+- Recorded the decision to retire Registry Notary from the current product
+  surface while preserving historical changelogs, decision records, and
+  release manifests.
+- Reframed the supported product paths around Registry Relay for scoped,
+  protected reads and Evidence for minimum-disclosure assertions.
+- Kept Evidence independent from the retired Notary product model, with
+  Registry Mint limited to supporting token issuance.
+
+Adopter-facing breaking change:
+
+- Raised the registryctl approved-set schema to version `2.0` and made
+  registryctl refuse an approved set issued before the retirement, including a
+  version `1.0` document, a set carrying a `notary` lane, and a set binding
+  cross-lane interface digests.
+- Required affected deployments to re-approve their baseline from the current
+  lane bundles, because the removed cross-lane interface digests are no longer
+  verified and the old approval's integrity claim is no longer enforced. See
+  [Approve the initial product baseline](../operate/approve-initial-baseline/).
+
 ## 2026-08-01
 
 Stabilization updates for the v0.16.3 beta-26 release candidate:
diff --git a/docs/site/src/content/docs/configure/evidence.mdx b/docs/site/src/content/docs/configure/evidence.mdx
new file mode 100644
index 000000000..25a13282f
--- /dev/null
+++ b/docs/site/src/content/docs/configure/evidence.mdx
@@ -0,0 +1,264 @@
+---
+title: Configure Evidence
+description: Shape an Evidence deployment project's runtime file, governed bundle, key material, immutability, and validation with evidence check.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-03"
+doc_type: how-to
+locale: en
+standards_referenced: []
+---
+
+Configuring Evidence means assembling one deployment project: a governed `bundle/` of YAML,
+Rhai scripts, schemas, and fixtures, plus a process-local `runtime.yaml` that binds it to a
+listener, a secret root, and audit storage. Both are trusted, startup-only artifacts. Evidence
+loads them once, compiles and validates them together, and refuses to reload, merge, or
+partially serve a later change. `evidence check` is the gate every edit to the project must pass
+before `evidence serve` runs it.
+
+## The project layout
+
+`evidencectl new` starts an incomplete local authoring workspace from an OpenAPI document
+(`crates/registry-evidencectl/src/scaffold.rs`):
+
+```sh
+project_dir="<dir>"
+openapi_source="<file-or-url>"
+evidencectl new "$project_dir" --openapi "$openapi_source" --profile local
+```
+
+```text
+<dir>/
+  .gitignore
+  source.openapi.yaml  retained OpenAPI document
+  selectors/           reusable Version 1 selector-profile objects
+  sources/             reusable Version 1 source objects
+  adapters/            source preparation and extraction scripts
+  schemas/             source parameter, response, and fact schemas
+  questions/           empty question-authoring directory
+  derivations/         empty derivation-authoring directory
+  fixtures/            empty production-fixture directory
+  secrets/             optional owner-only, unbound local keys
+```
+
+The command retains the OpenAPI bytes exactly and creates no fixture content, question, source policy,
+Mint configuration, README, production target, or deployable bundle. Add `--generate-keys` to create disposable local
+signing and HMAC material. `evidencectl source suggest --project <dir>` drafts one source and its
+editable artifacts from the retained contract. After you add a question, `evidencectl dev`
+compiles the authoring objects into a private local runtime and delegates validation to the real
+Evidence loader.
+
+## The runtime file
+
+`runtime.yaml` binds one governed bundle to one process: where the bundle lives, what the
+listener binds to, where secrets and audit storage sit, and which private CA files a source may
+trust. It is process-local operator configuration, not part of the reviewed bundle, and
+`products/evidence/contracts/runtime.schema.yaml` is its schema of record.
+
+Top-level required fields:
+
+| Field | Binds |
+| --- | --- |
+| `version` | Fixed at `1`. |
+| `bundleDirectory` | Absolute path to the governed `bundle/` directory. |
+| `listener` | `bindHost` (loopback, private IPv4, or unique-local IPv6 only), `port`, `tlsTermination` (fixed at `operator-controlled-upstream`: TLS terminates ahead of Evidence), `trustProxyIdentityHeaders` (fixed `false`: proxy-supplied identity is never trusted), plus request-size, concurrency, timeout, and shutdown-grace bounds. |
+| `secretProviders.file.root` | The owner-only directory the file secret provider resolves every `secret:file/<name>` reference beneath. |
+| `auditStorage` | `path` for the active audit segment and `maximumFileBytes`, a per-segment rotation threshold. |
+| `outboundTls` | `systemRoots` (fixed `true`) plus named `trustProfiles`, each a local id bound to one CA bundle file a source can select through `tlsTrustProfile`. |
+
+An optional `metricsListener` (`bindHost`, `port`) serves `GET /metrics` on a second private
+binding; absent by default, it is documented in `products/evidence/OPERATOR-CONTRACT.md` under
+Metrics reference rather than in the public Evidence contract.
+
+`runtime.yaml` cannot override anything the bundle governs. The schema's `ownership` block closes
+the allowed set to the bundle directory, listener binding and process limits, the optional
+metrics listener binding, the file-secret root, audit path and rotation bound, and logical
+private-CA file bindings. Every other field, including service identity, authentication,
+authority, sources, disclosure, and signing policy, belongs to the bundle alone.
+
+## The bundle
+
+`bundle/evidence.yaml` is the single governed contract Evidence compiles and validates as one
+atomic revision (`products/evidence/contracts/bundle.schema.yaml`). Its top-level sections:
+
+| Section | Declares |
+| --- | --- |
+| `service`, `issuer` | The technical provider and the legal issuing authority, both URIs. |
+| `authentication` | The one trusted OIDC access-token profile: issuer, audiences, token type, algorithms, JWKS URI, and the claim names for principal, requester tags, evidence audience, grant id, and grant authority. |
+| `audit` | Keyed JSONL audit: the hash secret reference, key version, and fixed fail-closed behavior. |
+| `subjectBinding` | The secret reference and key version behind the audience-scoped entity-reference HMAC. |
+| `rateLimits` | Per-principal request, burst, and failed-selector-attempt bounds. |
+| `signing` | The active EdDSA signing key reference, retired public JWK files, the fixed JWKS path, and assertion validity and clock-skew bounds. |
+| `responseFormats` (optional) | The bundle-wide ceiling on releasable serializations; defaults to signed JWS alone and must always include it. |
+| `selectorProfiles` | Named, bounded scalar field sets a subject role may be looked up by. |
+| `sources` | Named fixed HTTP JSON sources: transport, base URL, acquisition posture, authentication, the fixed request shape, and the response, extraction, and fact schemas bound to it. |
+| `authorityProfiles` | Named requester-tag gates: which grants (requirement, purpose, audience, subject roles, selector profiles, value origins) a caller carrying those tags holds. |
+| `requirements` | The assertion definitions themselves: id, source, purposes, subject roles, reference frameworks, evidence type, validity, derivation script and parameters, output concepts, fixtures, and disclosure-guard family. |
+
+Everything under `bundle/` is mounted read-only and covered by one revision digest computed over
+the exact bundle bytes; there is no partial edit, hot reload, or fallback
+(`bundle.schema.yaml`, `atomic_revision`). Allowed bundle directories are `adapters/`,
+`derivations/`, `schemas/`, `codelists/`, `fixtures/`, and `public-keys/`; symlinks and any file
+outside them fail startup (`bundle.schema.yaml`, `bundle_layout`).
+
+Evidence's four coequal acceptance definitions are adult status, residence region, professional
+licence status, and legal-parent relationship (`products/evidence/README.md`,
+`products/evidence/OPERATOR-CONTRACT.md`). You shape each as an ordinary `requirements` entry
+with its own source, derivation script, and fixtures. The four are presented as coequal, and none
+of them is a privileged domain type, a Rust built-in operation, or a special route.
+
+## What Rhai scripts may and may not do
+
+A deployment project supplies three kinds of Rhai script, one per source or requirement, and Rust
+compiles and reviews all of them at startup (`products/evidence/contracts/rhai-abi.yaml`).
+Scripts are trusted, reviewed, immutable bundle artifacts; that trust extends to provider and
+requirement semantics only, and it never grants transport, credential, authorization, signing,
+audit, or evidence-construction authority.
+
+### Preparation, extraction, derivation
+
+| Script | Signature | Owns | Never touches |
+| --- | --- | --- | --- |
+| `prepare` (adapters) | `(source_required_selectors, adapter_parameters) -> RequestParts` | Rendering an ordered query and a bounded JSON body from already authorized selector values. | Source origin, method, path, headers, credentials, TLS, proxy, timeout, redirects, or request count; those stay Rust-owned. |
+| `extract` (adapters) | `(projected_source_response, adapter_parameters) -> LookupResult` | Reading one already-projected, schema-validated response and returning `match` with facts, `no_match`, or `ambiguous`. | Choosing a candidate, scoring, counting, or emitting any diagnostic beyond the closed outcome. |
+| `derive` (derivations) | `(facts, declared_authorized_selectors, evaluation_context) -> ConceptValueSet` | Comparing facts against declared authorized selectors and producing at most 16 typed concept values. | Requester, purpose, audience, authority, grant, token, credential, or a logging, audit, or signing handle. |
+
+Every stage runs on fresh invocation state; nothing carries over between requests or between
+stages. Failures map to one closed, value-free class per stage (`adapter_input_error`,
+`source_protocol_error`, `derivation_input_error`), and raw Rhai errors never reach a public
+response.
+
+### Capability boundary
+
+Scripts get fresh local variables, bounded same-file helper functions, pure expressions, and
+bounded array, map, and string construction. They cannot reach the filesystem, environment,
+network, process, or a module system; they get no ambient clock, timezone, randomness, UUID,
+logging, or printing; and they cannot define anonymous functions, dispatch dynamically, or index
+an array with a computed negative offset (`products/evidence/contracts/rhai-abi.yaml`,
+`capabilities`).
+
+Everything a script computes with runs through a fixed primitive library: date and instant
+parsing, exact-decimal arithmetic, calendar addition, bucket lookup, codelist lookup, list and set
+membership, and a handful of bounded string and array operations, each pure, deterministic, and
+domain-neutral (`products/evidence/contracts/primitive-library.yaml`). Ordinary floating-point
+values stay usable inside preparation and extraction, but a derived concept value can never be an
+ordinary Rhai float: exact numbers use the declared integer or the Rust-owned `Decimal` type.
+`entity_reference_seed` wraps a source-derived value in a protected type Rhai can construct but
+never read back, print, or serialize; only Rust projects it into an audience-scoped reference
+after output validation.
+
+## Key material
+
+Generate each secret independently and keep the private files inside the configured secret root.
+`evidencectl keygen` writes private material as owner-only files and never prints its contents
+(`crates/registry-evidencectl/src/keygen.rs`):
+
+```sh
+evidencectl keygen signing --out-dir "<secrets-dir>" --kid "<active-signing-key-id>"
+evidencectl keygen secret --out "<secrets-dir>/audit-hmac-key"
+evidencectl keygen secret --out "<secrets-dir>/subject-binding-hmac-key"
+```
+
+### `signing-ed25519-private-jwk` and `signing-ed25519-public.jwk.json`
+
+Evidence signs assertions with the private Ed25519 JSON Web Key (JWK). Verifiers use the public
+JWK to check the signature without receiving the private key. The key identifier must match
+`signing.activeKeyId` in `bundle/evidence.yaml`.
+
+### `audit-hmac-key`
+
+Evidence uses this random secret to authenticate the audit chain. A changed, removed, or
+reordered audit entry then fails chain verification.
+
+### `subject-binding-hmac-key`
+
+Evidence uses this random secret to derive audience-scoped subject references from authorized
+selector values. The references let an assertion identify its subject without disclosing the
+selector values or creating one identifier that every audience can reuse.
+
+## Immutability
+
+Evidence refuses to start from a deployment input it could write to, and reports a
+non-immutable-input error rather than starting on it (`products/evidence/OPERATOR-CONTRACT.md`).
+Version 1 permits no reload, merge, mutation, governed-field override, or fallback bundle or
+runtime file: a project is either the exact bytes Evidence loaded at startup, or it is a different
+revision that requires a restart.
+
+Freeze the project before validating or serving it:
+
+```sh
+chmod -R a-w bundle && chmod 444 runtime.yaml
+```
+
+The bundle directory and every file beneath it carry no write bits, `runtime.yaml` is mode `444`,
+and the secret root stays owner-only at mode `0700` with mode `0600` secret files. Evidence
+Version 1 supports Unix targets only because these invariants rely on owner, mode, no-follow,
+link-count, and open-file-identity checks the platform provides
+(`products/evidence/contracts/runtime.schema.yaml`, `platform`). To edit the project again,
+restore write permission, make the change, and freeze it again before the next `evidence check`.
+
+## Validating a project
+
+Two offline commands prove a project before it ever binds a port:
+
+```sh
+evidence --runtime runtime.yaml check
+evidence --runtime runtime.yaml evaluate --fixture "bundle/fixtures/<cases>.yaml"
+```
+
+`evidence check` loads, compiles, and validates the complete bundle and runtime file together:
+every selector, role, profile, authority, and source binding resolves, every script compiles
+against the frozen ABI, and mounted secret and signing material parses, all without opening the
+audit chain or contacting a source. `evidence evaluate` replays one fixture file's synthetic
+cases through the reviewed adapter, derivation, and output gate, with no source and no network
+involved.
+
+`evidencectl fixtures run --project <dir>` drives both commands across a complete deployment
+project: it runs `check`, then `evaluate` against every fixture path the bundle's requirements
+reference, and reports `PASS` or `FAIL` per step
+(`crates/registry-evidencectl/src/fixtures.rs`). The incomplete workspace created by
+`evidencectl new` has no bundle, runtime, or fixture cases, so it cannot pass this gate. After an
+operator supplies those deployment artifacts, both `check` and `fixtures run` must pass before
+`evidence serve` runs the revision.
+
+## Build a production candidate
+
+An editable project is not a deployment input. Add one explicit target under
+`deployment-targets/production/` when the reviewed source, questions, and fixtures are ready:
+
+```text
+deployment-targets/
+  production/
+    governance.yaml
+    runtime.yaml
+```
+
+`governance.yaml` supplies the production-owned bundle fields, including service, issuer,
+authentication, audit, subject binding, rate limits, signing, response formats, and authority
+profiles. It cannot override selectors, sources, or requirements. Each production question adds
+stable concept identifiers and a `governance` block with its requirement, frameworks, Evidence
+Type, validity, observation timezone, fixture, and disclosure families.
+
+`runtime.yaml` remains the ordinary runtime document. It names the final absolute bundle,
+private listener, secret root, audit path, and any private CA files for one target. It is copied
+without transformation.
+
+Build a new candidate directory with explicit target and output paths:
+
+```sh
+evidencectl build \
+  --project "<editable-project>" \
+  --target "<editable-project>/deployment-targets/production" \
+  --output "<new-candidate-directory>"
+```
+
+The output is create-only and contains `runtime.yaml` and a closed `bundle/`. It contains no
+secret values, source responses, local request state, or audit records. The compiler validates
+the resulting bundle with the `evidence` binary and every referenced fixture before publishing.
+It does not contact an identity provider, Mint, or a source endpoint.
+
+Use [Build and deploy an Evidence project](../../tutorials/build-and-deploy-evidence-project/)
+for the full handoff, and [Evidencectl command reference](../../reference/evidencectl/) for the
+command contract.
diff --git a/docs/site/src/content/docs/configure/index.mdx b/docs/site/src/content/docs/configure/index.mdx
index 9b79ade34..89fefe000 100644
--- a/docs/site/src/content/docs/configure/index.mdx
+++ b/docs/site/src/content/docs/configure/index.mdx
@@ -6,8 +6,8 @@ owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-31"
+  - registry-evidence
+last_reviewed: "2026-08-03"
 doc_type: explanation
 locale: en
 standards_referenced: []
diff --git a/docs/site/src/content/docs/configure/mint.mdx b/docs/site/src/content/docs/configure/mint.mdx
new file mode 100644
index 000000000..6e38eb51c
--- /dev/null
+++ b/docs/site/src/content/docs/configure/mint.mdx
@@ -0,0 +1,252 @@
+---
+title: Configure Registry Mint
+description: Configure Registry Mint to issue short-lived, audience-bound access tokens to registered clients when a deployment has no identity provider.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: how-to
+locale: en
+standards_referenced: []
+---
+
+Configure Registry Mint when a deployment needs to hand short-lived access tokens to a closed
+set of registered machine clients and has no identity provider to issue them.
+
+## When to use Registry Mint
+
+Registry Mint is a supporting service, not a product pattern of its own. Use it when a resource
+server such as Evidence needs signed, expiring, audience-bound tokens and standing up a
+general-purpose identity provider is not an option for the deployment.
+
+Version 1 runs one active Mint process. Its client-assertion replay cache is memory-only and
+clears on restart. Do not claim high availability or durable replay protection for this deployment
+shape.
+
+Registry Mint answers a narrower question than a shared JWKS can. A pooled key set can only say
+that a token was signed by a trusted key; it cannot say which caller signed it or what that
+caller is permitted to assert. Registry Mint splits the two questions across two places: the
+client registry binds a client id to that client's own public keys and to the authority Registry
+Mint will assert for it, and the token endpoint verifies an incoming request against the keys of
+the client it claims to be, then writes the authority from the registry, never from the request.
+
+For the whole round trip in one picture, from a client holding only its own private key to a
+signed assertion, see
+[how a client, Registry Mint, and Evidence interact](../../reference/mint/#how-a-client-registry-mint-and-evidence-interact).
+
+## When not to use Registry Mint
+
+Skip Registry Mint when an identity provider already issues client-credentials tokens for the
+deployment. Registry Mint exists only for the case where none does; pointing Evidence at an
+existing IdP's token endpoint and JWKS does not require Registry Mint at all.
+
+Registry Mint is also not a place to route caller identity for people. It authenticates
+registered machine clients by private key, and any token bound to one named person rides inside
+a client's own signed request rather than a separate login. If a deployment needs a person to
+authenticate directly, that is an identity provider's job, not Registry Mint's.
+
+## Before you start
+
+You need:
+
+- The registered clients this deployment will serve: one client id, principal, evidence
+  audience, and set of requester tags per client.
+- A private JWK signing key for Registry Mint itself, in the algorithm the deployment will run
+  (`EdDSA`, `ES256`, or `RS256`), stored in a file owner-only and not reachable through a
+  symlink. `crates/registry-mint/src/secretfile.rs` enforces both at load time.
+- An independently generated audit HMAC key containing at least 32 bytes, stored in another
+  owner-only, non-symlink file.
+- A private JWK per client. Registry Mint only ever stores and reads each client's public half;
+  keep the private half with the client.
+- A directory to hold one registration file per client.
+- An owner-only directory on durable storage for the keyed Mint audit chain. Plan its capacity,
+  backup, and retention because Registry Mint rotates segments but never deletes or compacts
+  them.
+- The claim names the resource server (Evidence, for example) reads its principal, requester
+  tags, evidence audience, and grant pair from, so Registry Mint's `accessTokens.claims` can be
+  set to match them exactly.
+- TLS in front of Registry Mint. Registry Mint serves plain HTTP and expects TLS termination it
+  does not manage; Evidence in turn requires the token issuer and its key set to be HTTPS, with
+  no exception for loopback (`crates/registry-mint/demo/README.md`).
+
+## Configure the deployment
+
+Registry Mint reads one YAML document. Every relative path in it resolves against the document's
+own directory, and every field in it is startup-only: changing issuer identity, signing keys,
+the listener, or token policy means restarting the process.
+
+```yaml
+version: 1
+issuer: https://mint.example.org
+listener:
+  address: 127.0.0.1
+  port: 8081
+signing:
+  algorithm: EdDSA
+  activeKeyId: mint-2026-01
+  activeKeyFile: secrets/signing.jwk
+audit:
+  path: audit/mint.jsonl
+  maximumFileBytes: 1073741824
+  hashKeyFile: secrets/audit-hmac-key
+  hashKeyVersion: 1
+accessTokens:
+  audiences: [evidence]
+  lifetimeSeconds: 300
+  claims:
+    principal: sub
+    requesterTags: evidence_tags
+    evidenceAudience: evidence_audience
+    grantId: evidence_grant_id
+    grantAuthority: evidence_authority
+clientAssertion:
+  audience: https://mint.example.org/token
+  algorithms: [EdDSA]
+clients:
+  directory: clients
+```
+
+`issuer` must be an `https` URL with a host and no credentials, query, or fragment; resource
+servers compare it exactly. `accessTokens.lifetimeSeconds` is bounded to `60..=3600`: short
+enough that a leaked token expires quickly, long enough to survive verifier clock skew.
+`accessTokens.claims` must match the resource server's own claim names field for field, because
+that is the only place the two configurations have to agree. `clientAssertion.audience` is the
+value every client's signed request must carry as its own `aud`, which stops a request built for
+one endpoint from being replayed at another.
+
+`audit.hashKeyFile` must contain at least 32 bytes and remain separate from the signing key. Mint
+verifies the keyed JSONL chain and takes a single-writer lock at startup. Before returning an
+access token it synchronizes a token-release record to the chain and its parent directory. If the
+write fails, Mint returns `server_error`, does not release the token, and fails readiness. The
+chain keeps only keyed pseudonyms where correlation is needed, never raw assertions, access
+tokens, client ids, authority values, actors, or subject values.
+`audit.maximumFileBytes` is the per-segment rotation threshold. Mint seals a full segment as
+`<audit.path>.<eight-digit-sequence>` and continues online at `audit.path`; it never deletes or
+compacts sealed segments.
+
+Delegated tokens, bound to one named subject a client acts on behalf of, are a further optional
+step layered on top of this base configuration. `crates/registry-mint/README.md` covers the
+`accessTokens.claims.actor` field and the per-client `delegation` block that step needs; this
+walkthrough covers the base, undelegated flow.
+
+For the complete field list, including every default, see the
+[Registry Mint reference](../../reference/mint/).
+
+## Register a client
+
+Add one file per client under the directory named in `clients.directory`:
+
+```yaml
+clientId: health-desk
+principal: service:health-desk
+evidenceAudience: https://evidence.example.org
+requesterTags: [health-desk, region-north]
+keys:
+  - kty: OKP
+    crv: Ed25519
+    kid: health-desk-2026-01
+    x: "<public-key-x-coordinate>"
+```
+
+`keys` accepts public JWKs only; a document carrying a private key member is rejected outright.
+Loading the client registry is all-or-nothing, so one malformed registration fails the whole
+load rather than serving a partial registry.
+
+Validate the deployment before opening a socket:
+
+```sh
+mint check --config /etc/mint/mint.yaml
+```
+
+`check` loads the configuration, signing key, audit key, and client registry, then exits. It
+deliberately does not open the audit chain, which admits one writer at a time, so you can check
+an edited configuration against the deployment it is about to replace. `check`, `serve`, and
+`verify-audit` accept `MINT_CONFIG` in place of `--config`.
+
+## Start Registry Mint
+
+```sh
+mint serve --config /etc/mint/mint.yaml
+```
+
+Onboarding, offboarding, and caller key rotation only need the client registry reloaded, not the
+process restarted: send the running process `SIGHUP` and it re-reads `clients.directory`,
+keeping the previous registry in place if the new one fails to load.
+
+## Obtain a token
+
+A client authenticates with the `client_credentials` grant and `private_key_jwt` client
+authentication (RFC 7523): it signs a short-lived JWT assertion with its own private key and
+posts it to the token endpoint.
+
+```sh
+curl -sS https://mint.example.org/token \
+  -d grant_type=client_credentials \
+  -d client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer \
+  --data-urlencode "client_assertion=<compact-jws-client-assertion>"
+```
+
+The assertion must carry `iss` and `sub` equal to the client id, `aud` equal to the configured
+`clientAssertion.audience`, a unique `jti`, and `iat`/`exp` inside
+`clientAssertion.maximumLifetimeSeconds`. Every `jti` is accepted once; presenting the same
+assertion twice is refused.
+
+The `mint token` subcommand builds and sends that request for local testing. It is a client
+tool: it signs with the caller's own key and never touches Registry Mint's signing key.
+
+```sh
+mint token --url https://mint.example.org/token \
+  --client-id health-desk --key ./dev/health-desk.jwk
+```
+
+It prints the access token alone on stdout, so `TOKEN=$(mint token ...)` is the whole usage.
+
+To build the same request from an application rather than a terminal, see
+[Request an access token from your own code](../request-an-access-token/), which has worked
+Python and TypeScript examples.
+
+## Verify the deployment
+
+Request a token and confirm the response shape:
+
+```sh
+curl -sS https://mint.example.org/token \
+  -d grant_type=client_credentials \
+  -d client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer \
+  --data-urlencode "client_assertion=<compact-jws-client-assertion>"
+```
+
+```json
+{
+  "access_token": "SYNTHETIC_FIXTURE_TOKEN",
+  "token_type": "Bearer",
+  "expires_in": 300
+}
+```
+
+Confirm the published key set resolves at the configured `signing.jwksPath` (default
+`/.well-known/jwks.json`), and that `GET /ready` returns success once at least one client is
+registered and the audit writer is healthy.
+
+Verify the retained keyed chain with the same configuration and audit key:
+
+```sh
+mint verify-audit --config /etc/mint/mint.yaml
+```
+
+The command reports the record count and keyed chain tail, and exits unsuccessfully if retained
+records were corrupted or reordered.
+
+## Troubleshooting
+
+| Symptom | Cause | Fix |
+| --- | --- | --- |
+| The token request fails with `401 invalid_client` | Registry Mint collapses every client authentication failure, an unknown client id, a bad signature, a replayed `jti`, an expired assertion, into this one code, so the endpoint cannot be used to probe which client ids are registered. | Check the client id, the signing key, the assertion's `iat`/`exp`, and that the `jti` has not already been used. |
+| The token request fails with `400 unsupported_grant_type` | `grant_type` is missing or is not exactly `client_credentials`. | Send `grant_type=client_credentials` in the form body. |
+| `mint check` or `mint serve` refuses to start over the signing key | The key file is not a regular, owner-only, single-link file, or its `kid` and algorithm do not match `signing.activeKeyId` and `signing.algorithm`. | Regenerate or re-permission the private JWK so it is owned by the running user, unreadable by group and other, and not a symlink. |
+| `mint serve` refuses to start over audit | The audit key, directory, chain, or lock file is unsafe, another writer holds the chain, or retained records do not verify. | Check owner-only permissions, run one writer per `audit.path`, then run `mint verify-audit` before deciding whether recovery is needed. Do not discard the chain to make startup pass. |
+| `mint check` refuses the configuration over audit | The audit hash key file is missing, is not owner-only, or is too short. `check` does not open the chain, so it never reports a running writer as a fault. | Restore the key file with owner-only permissions. Use `mint verify-audit` for the chain itself. |
+| The token request fails with `500 server_error` and readiness changes to `503` | Mint could not durably append the audit decision and permanently poisoned the writer for this process. | Stop traffic, restore writable durable storage, preserve and verify the retained chain, then restart Mint. The failed request did not receive an access token. |
+| Evidence rejects a token that Registry Mint minted | `accessTokens.claims` on Registry Mint and the resource server's own claim-name configuration name different claims for the same authority field. | Align every claim name (`principal`, `requesterTags`, `evidenceAudience`, `grantId`, `grantAuthority`, and `actor` where used) between the two configurations. |
+| `GET /ready` returns `503` | No client is currently registered, the client registry directory failed to load, or the audit writer is poisoned. | Check the startup or reload log and the audit storage. Add a valid client or restore and verify audit storage as indicated. |
diff --git a/docs/site/src/content/docs/configure/oauth-client-credentials.mdx b/docs/site/src/content/docs/configure/oauth-client-credentials.mdx
index 47ed34141..9253fe775 100644
--- a/docs/site/src/content/docs/configure/oauth-client-credentials.mdx
+++ b/docs/site/src/content/docs/configure/oauth-client-credentials.mdx
@@ -6,7 +6,7 @@ owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-last_reviewed: "2026-07-30"
+last_reviewed: "2026-08-03"
 doc_type: how-to
 locale: en
 standards_referenced: []
@@ -22,7 +22,7 @@ shape, scopes, and token lifetime have source-owner approval.
 
 OAuth changes source authentication, not source or claim ownership.
 Relay owns the token exchange and source authorization header.
-Rhai, Registry Notary, and callers receive no client secret, token, or token response.
+Rhai scripts and callers receive no client secret, token, or token response.
 
 ## Before you start
 
diff --git a/docs/site/src/content/docs/configure/request-an-access-token.mdx b/docs/site/src/content/docs/configure/request-an-access-token.mdx
new file mode 100644
index 000000000..69b89ccf1
--- /dev/null
+++ b/docs/site/src/content/docs/configure/request-an-access-token.mdx
@@ -0,0 +1,251 @@
+---
+title: Request an access token from your own code
+description: Build and sign the client assertion Registry Mint expects, then exchange it for an access token, with worked Python and TypeScript examples.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-03"
+doc_type: how-to
+locale: en
+standards_referenced: []
+---
+
+Build the signed request Registry Mint expects when the caller is your own application rather
+than the `mint token` command.
+
+## When to use this
+
+Use this page when you are integrating a registered client into an application and need an access
+token to present to a resource server such as Evidence. If you only need a token at a terminal,
+`mint token` already does all of this; see
+[Obtain a token](../mint/#obtain-a-token).
+
+## Before you start
+
+You need four things, all of which come from whoever registered your client:
+
+- The `clientId` your client is registered under.
+- Your client's **private** JWK. Registry Mint holds only the public half; if you do not have the
+  private half, nobody can issue you a token.
+- The exact `clientAssertion.audience` value the deployment is configured with. This is not the
+  same as the audience of the token you get back, and confusing the two is the most common
+  first-attempt failure.
+- The token endpoint URL. The path is always `/token` and is not configurable.
+
+Registry Mint serves plain HTTP and expects TLS termination it does not manage, so the URL you
+call is the terminator's, not the process's own listener.
+
+## What you are signing
+
+One JWT, signed with your own private key, sent once. This is `private_key_jwt` client
+authentication (RFC 7523) inside the `client_credentials` grant: there is no shared secret
+anywhere in the exchange.
+
+| Claim | Value | Why it is checked |
+| --- | --- | --- |
+| `iss` | your `clientId` | Names which registration's keys to verify against. |
+| `sub` | your `clientId`, identical to `iss` | Without it a legitimate client key could sign an assertion naming a different subject. |
+| `aud` | the configured `clientAssertion.audience` | Stops a request built for one endpoint being replayed at another. |
+| `jti` | a fresh unique value **per request** | Accepted exactly once. Reusing one is refused. |
+| `iat` | now | Freshness, tolerating a small clock skew. |
+| `exp` | within `clientAssertion.maximumLifetimeSeconds` of `iat` (default 300) | A long-lived assertion is a long-lived bearer credential, so the bound is enforced whatever you choose. |
+
+The header carries `alg` (one of the algorithms the deployment lists under
+`clientAssertion.algorithms`), `typ: JWT`, and `kid` naming which of your registered keys signed
+it.
+
+The examples below build the JWT from primitives rather than pulling in a JWT library, so that
+every field above is visible in the code. A JWT library is a perfectly good substitute as long as
+it lets you set `kid` and does not cache or reuse `jti`.
+
+## Python
+
+Needs `cryptography` and `requests`.
+
+```python
+import base64
+import json
+import time
+import uuid
+
+import requests
+from cryptography.hazmat.primitives.asymmetric import ed25519
+
+
+def b64url(raw: bytes) -> str:
+    return base64.urlsafe_b64encode(raw).decode().rstrip("=")
+
+
+def unb64url(text: str) -> bytes:
+    return base64.urlsafe_b64decode(text + "=" * (-len(text) % 4))
+
+
+def sign_client_assertion(
+    private_jwk: dict,
+    client_id: str,
+    audience: str,
+    lifetime_seconds: int = 120,
+) -> str:
+    """Build one single-use assertion proving this client holds its own key."""
+    now = int(time.time())
+    header = {"alg": "EdDSA", "typ": "JWT", "kid": private_jwk["kid"]}
+    claims = {
+        "iss": client_id,
+        "sub": client_id,
+        "aud": audience,
+        "iat": now,
+        "exp": now + lifetime_seconds,
+        "jti": str(uuid.uuid4()),
+    }
+    signing_input = ".".join(
+        b64url(json.dumps(part, separators=(",", ":")).encode())
+        for part in (header, claims)
+    )
+    key = ed25519.Ed25519PrivateKey.from_private_bytes(unb64url(private_jwk["d"]))
+    return f"{signing_input}.{b64url(key.sign(signing_input.encode()))}"
+
+
+def request_access_token(token_url: str, assertion: str) -> str:
+    response = requests.post(
+        token_url,
+        data={
+            "grant_type": "client_credentials",
+            "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+            "client_assertion": assertion,
+        },
+        timeout=10,
+    )
+    response.raise_for_status()
+    return response.json()["access_token"]
+```
+
+Call it with the client's own private JWK:
+
+```python
+with open("client-signing-private-jwk", encoding="utf-8") as handle:
+    private_jwk = json.load(handle)
+
+assertion = sign_client_assertion(
+    private_jwk,
+    client_id="health-desk",
+    audience="https://mint.example.org/token",
+)
+token = request_access_token("https://mint.example.org/token", assertion)
+```
+
+## TypeScript
+
+Needs no dependencies. `node:crypto` reads an Ed25519 JWK directly, and `fetch` is built in.
+
+```typescript
+import { createPrivateKey, randomUUID, sign } from "node:crypto";
+
+interface PrivateJwk {
+  kty: "OKP";
+  crv: "Ed25519";
+  kid: string;
+  d: string;
+  x: string;
+}
+
+const b64url = (raw: Buffer | string): string =>
+  Buffer.from(raw).toString("base64url");
+
+/** Build one single-use assertion proving this client holds its own key. */
+export function signClientAssertion(
+  privateJwk: PrivateJwk,
+  clientId: string,
+  audience: string,
+  lifetimeSeconds = 120,
+): string {
+  const now = Math.floor(Date.now() / 1000);
+  const header = { alg: "EdDSA", typ: "JWT", kid: privateJwk.kid };
+  const claims = {
+    iss: clientId,
+    sub: clientId,
+    aud: audience,
+    iat: now,
+    exp: now + lifetimeSeconds,
+    jti: randomUUID(),
+  };
+  const signingInput = [header, claims]
+    .map((part) => b64url(JSON.stringify(part)))
+    .join(".");
+  const key = createPrivateKey({ key: privateJwk, format: "jwk" });
+  // Ed25519 signs the message itself, so the digest argument is null.
+  const signature = sign(null, Buffer.from(signingInput), key);
+  return `${signingInput}.${b64url(signature)}`;
+}
+
+export async function requestAccessToken(
+  tokenUrl: string,
+  assertion: string,
+): Promise<string> {
+  const response = await fetch(tokenUrl, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "client_credentials",
+      client_assertion_type:
+        "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+      client_assertion: assertion,
+    }),
+  });
+  if (!response.ok) {
+    const { error } = (await response.json()) as { error?: string };
+    throw new Error(`token request failed: ${response.status} ${error ?? ""}`);
+  }
+  const body = (await response.json()) as { access_token: string };
+  return body.access_token;
+}
+```
+
+## Use the token
+
+Present it as a bearer token to the resource server, not back to Registry Mint:
+
+```sh
+curl -sS https://evidence.example.org/v1/evidence \
+  -H "Authorization: Bearer ${TOKEN}" \
+  -H 'content-type: application/json' \
+  --data @request.json
+```
+
+## Rules that bite
+
+**Sign a new assertion per request.** The `jti` is spent on first use and remembered past `exp`,
+so a cached assertion fails the second time it is sent. What you may cache is the access token,
+for the `expires_in` seconds the response reports.
+
+**The two audiences are different.** The assertion's `aud` is `clientAssertion.audience`, the
+value that identifies the token endpoint. The resulting token's own `aud` comes from
+`accessTokens.audiences` and identifies the resource server. Signing the assertion with the
+resource server's audience is a refusal, not a warning.
+
+**You cannot ask for more authority than you are registered with.** Principal, requester tags,
+evidence audience, and grant pair are all written from the client registry. Nothing you put in
+the assertion changes them, so there is no scope parameter to send.
+
+**Every authentication failure looks identical.** An unknown client id, a bad signature, a
+replayed `jti`, a wrong audience, and an expired assertion all return the same
+`401 {"error": "invalid_client"}`. This is deliberate: the endpoint must not be usable to
+discover which client ids are registered. It also means the response cannot tell you which of
+those five things went wrong, so check them in order locally.
+
+## Troubleshooting
+
+| Symptom | Likely cause |
+| --- | --- |
+| `401 invalid_client` on the first attempt | The `aud` is the resource server rather than `clientAssertion.audience`, or `kid` names a key the registration does not carry. |
+| `401 invalid_client` only on repeat requests | The assertion, rather than the token, is being cached and replayed. Generate a fresh `jti` each time. |
+| `401 invalid_client` after a working period | The assertion's `exp` exceeds `clientAssertion.maximumLifetimeSeconds`, or the client clock has drifted beyond the tolerated skew. |
+| `400 invalid_request` | A required form field is missing or duplicated, or `client_assertion_type` is not the exact `jwt-bearer` URN. A missing `grant_type` lands here too. |
+| `400 unsupported_grant_type` | `grant_type` is present but is not exactly `client_credentials`. |
+| The resource server rejects a token Registry Mint issued | The two deployments name different claims for the same authority field. See [How Evidence verifies these tokens](../../reference/mint/#how-evidence-verifies-these-tokens). |
+
+## Next
+
+- [How a client, Registry Mint, and Evidence interact](../../reference/mint/#how-a-client-registry-mint-and-evidence-interact)
+- [Configure Registry Mint](../mint/)
+- [Registry Mint reference](../../reference/mint/)
diff --git a/docs/site/src/content/docs/decisions/notary-retirement-2026-08-03.mdx b/docs/site/src/content/docs/decisions/notary-retirement-2026-08-03.mdx
new file mode 100644
index 000000000..04d8a082f
--- /dev/null
+++ b/docs/site/src/content/docs/decisions/notary-retirement-2026-08-03.mdx
@@ -0,0 +1,69 @@
+---
+title: Registry Notary retirement decision
+description: Record of the decision to retire Registry Notary and direct current adoption to Registry Relay and Evidence.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-docs
+last_reviewed: "2026-08-03"
+doc_type: decision
+locale: en
+standards_referenced: []
+---
+
+Registry Stack decided on 2026-08-03 to retire Registry Notary and direct
+current adopters to Registry Relay and Evidence.
+
+## Decision
+
+**Date:** 2026-08-03
+
+**Status:** Accepted
+
+Retire Registry Notary from the current product surface, source workspace,
+release train, and continuous integration gates.
+Keep Registry Relay as the protected read product and Evidence as the
+minimum-disclosure assertion product.
+Registry Mint remains a supporting token issuer for deployments without an
+identity provider.
+
+Present two paths to adopters:
+
+- Use Registry Relay when another system must read specific, authorized data.
+- Use Evidence when another system must learn only a fact.
+
+Evidence can consume a Relay-protected API as a fixed source.
+This composition does not make Evidence a Notary mode or a continuation of
+the Notary credential lifecycle.
+
+## Context
+
+Registry Notary combined claim evaluation, credential issuance, disclosure
+policy, replay handling, and audit provenance.
+Evidence defines a smaller, stateless assertion boundary with its own frozen
+Version 1 contracts.
+Keeping both products on the current surface would give adopters overlapping
+entry points while preserving two different product models.
+
+The retirement narrows the supported surface without changing Registry
+Relay's role or Evidence's name, contracts, or independence.
+
+## Consequences
+
+- Completing the retirement removes Registry Notary from workspace components,
+  new release manifests, continuous integration gates, and current product
+  documentation.
+- Registry Relay and Evidence remain separate products with separate runtime
+  and configuration boundaries.
+- Evidence Version 1 wire identifiers and production behavior remain
+  unchanged.
+- Historical changelogs, decision records, release manifests, and archived
+  documentation retain Registry Notary references.
+- Publishing this decision redirects current Notary documentation URLs to the
+  corresponding Evidence guidance or to this decision record.
+- Archiving retired Notary source and product material is deferred to a
+  separate decision.
+
+## Superseded by
+
+None.
diff --git a/docs/site/src/content/docs/explanation/architecture.mdx b/docs/site/src/content/docs/explanation/architecture.mdx
index ebfcc458d..303bf2a9e 100644
--- a/docs/site/src/content/docs/explanation/architecture.mdx
+++ b/docs/site/src/content/docs/explanation/architecture.mdx
@@ -1,15 +1,16 @@
 ---
 title: Architecture overview
-description: How the registry stack uses a two-layer design of portable metadata and runtime services to publish, consult, and prove registry facts.
+description: How the registry stack uses a two-layer design of portable metadata and runtime services to describe sources, serve protected reads, and answer bounded questions.
 status: current
 owner: registry-docs
 source_repos:
   - registry-manifest
   - registry-platform
   - registry-relay
-  - registry-notary
+  - registry-evidence
+  - registry-mint
   - solmara-lab
-last_reviewed: "2026-07-14"
+last_reviewed: "2026-08-03"
 doc_type: explanation
 locale: en
 standards_referenced:
@@ -19,49 +20,54 @@ standards_referenced:
   - openapi
   - shacl
   - json-schema
-  - json-ld
   - sd-jwt-vc
-  - verifiable-credentials
   - cccev
-  - w3c-did
 ---
 
 The formal registry stack has four products: Registry Platform, Registry Manifest, Registry Relay,
-and Registry Notary.
+and Evidence.
 The stack is organized around two layers: a portable metadata layer and a runtime services layer.
-The metadata layer (Registry Manifest) compiles and renders discovery artifacts that describe what a registry
-exposes, without touching production sources.
-The runtime services layer (Registry Relay, Registry Notary) binds those artifacts to real data, enforces
-access control, evaluates claims, serves delegated evaluation between trusted Notaries, and issues
-credentials.
+The metadata layer (Registry Manifest) compiles and renders discovery artifacts that describe what a
+registry exposes, without touching production sources.
+The runtime services layer (Registry Relay, Evidence) binds those descriptions to real data, enforces
+access control, and answers bounded questions with signed assertions.
 Registry Platform provides shared Rust primitives consumed by both runtime services.
-Solmara Lab is a separate adopter project that runs published stack images in local and hosted demo
+Registry Mint is a supporting service rather than a fifth product: it issues the short-lived access
+tokens a resource server such as Evidence verifies, for deployments that have callers and no identity
+provider.
+Solmara Lab is a separate adopter project that runs Relay, Evidence, and Mint together in local and
+hosted demo
 topologies. It is not a formal Registry Stack product.
 
 At runtime, Registry Stack exposes source data through two patterns:
 
-- Protected Registry APIs: controlled read-only interfaces over existing registry sources.
+- Protected registry APIs: controlled read-only interfaces over existing registry sources.
   Registry Relay implements this runtime surface.
-- Evidence Gateway: the governed evidence path. A runtime service evaluates request context,
-  source context, supported policy terms, freshness, redaction, and audit provenance before it
-  returns a result or denial. Registry Notary implements claim evaluation and credential issuance.
-  Registry Relay implements governed read routes when evidence is returned from a protected API.
+- Minimum-disclosure assertions: one bounded question about one subject, answered with a signed
+  assertion that carries the answer and not the record. Evidence implements this runtime surface.
+
+The two patterns compose without either service depending on the other. Evidence treats a
+Relay-protected API as one ordinary fixed HTTP JSON source, which is the only source shape Evidence
+has.
+{/* Evidence: contract registry.evidence.fixed-http-json-source/v1,
+     products/evidence/contracts/source-contract.yaml (frozen). */}
 
 This split matters because it separates the obligation to describe (what a registry declares it can expose
 and under what policy) from the obligation to enforce (what a running service will actually return to an
 authorized caller). A reviewer can audit the portable metadata bundle before any runtime service is
-deployed. An integrator can validate schemas and claim shapes offline. A governance team can publish
+deployed. An integrator can validate schemas offline. A governance team can publish
 updated policy documents without touching deployment config.
 
 {/* SVG diagram. Essential labels are restated in the HTML list that follows. */}
 <figure>
   <img src="../../images/registry-architecture-flow.svg"
-       alt="Architecture flow: Registry Platform provides shared primitives. Registry Manifest compiles
-            metadata artifacts. Registry Relay binds those artifacts to protected runtime sources.
-            Registry Notary evaluates claims from compiler-pinned Relay consultations and issues credentials
-            only from exact Relay-backed evaluation provenance.
-            The separate Solmara Lab adopter project wires published runtime images into demo
-            topologies." />
+       alt="Architecture flow: Registry Platform provides shared primitives to both runtime services.
+            Registry Manifest compiles portable metadata contracts. Registry Relay binds those
+            descriptions to real sources and serves protected read-only APIs. Evidence answers one
+            bounded question about one subject and returns a signed assertion carrying the answer and
+            not the record, reading a Relay API as one fixed HTTP source. Registry Mint is a
+            supporting service issuing the short-lived access tokens Evidence verifies. The separate
+            Solmara Lab adopter project wires Relay, Evidence, and Mint into demo topologies." />
 </figure>
 
 ## Evidence and decision ownership
@@ -72,25 +78,32 @@ The following responsibility flow is normative for 1.0 project authoring:
 2. Registry Relay owns source-specific acquisition, source-access policy, and typed normalization.
    Relay returns only the declared consultation outcome and typed outputs. It does not assign a
    consumer consequence to those outputs.
-3. Registry Notary owns atomic, precise, reusable evidence statements plus the authorization and
-   disclosure policy for evaluating and releasing them. Purpose-bound authorization controls who
-   can request evidence and what can be disclosed. It does not turn the evidence statement into a
-   consumer rule.
-4. An evidence consumer determines how returned evidence is used. The accountable decision owner
+3. Evidence owns the bounded assertion plus the authorization and disclosure policy for evaluating
+   and releasing it. The requirement is the unit of disclosure: purpose, audience, and requester
+   entitlement decide whether a requirement may be invoked at all, and never narrow the answer it
+   returns. Evidence does not turn the assertion into a consumer rule.
+4. An assertion consumer determines how the returned assertion is used. The accountable decision owner
    retains responsibility for requirements, eligibility, qualification, prioritization, approval,
    routing, payment, workflow, and action policy.
 
-These are three different policy categories: Relay source-access and adaptation policy, Notary
-evidence authorization and disclosure policy, and consumer use, decision, and action policy.
+{/* Evidence: "The requirement is the unit of disclosure. Purpose, audience, and requester
+     entitlement decide whether a requirement may be invoked at all; they never narrow the answer
+     it returns", products/evidence/CONCEPT.md section 5.2, restated in
+     products/evidence/OPERATOR-CONTRACT.md, "Purpose does not narrow disclosure". The consumer
+     boundary is the Version 1 non-goal list: Evidence is not a workflow, orchestration, or
+     case-management engine and not a runtime policy engine or general PDP. */}
+
+These are three different policy categories: Relay source-access and adaptation policy, Evidence
+authorization and disclosure policy, and consumer use, decision, and action policy.
 Project authors must keep them separate even when one deployment operates every component. The
-caller, evidence consumer, and decision owner can be the same component or separate components.
+caller, assertion consumer, and decision owner can be the same component or separate components.
 
-An evidence consumer can be a social-protection programme, admissions service, licensing
-authority, healthcare workflow, lender, insurer, or credential verifier. The caller is the
-technical client that invokes Notary, which may be a portal, intermediary, wallet backend, or
-workflow connector acting for the consumer.
+An assertion consumer can be a social-protection programme, admissions service, licensing
+authority, healthcare workflow, lender, insurer, or relying verifier. The caller is the
+technical client that invokes Evidence, which may be a portal, intermediary, or workflow connector
+acting for the consumer.
 
-| Context | Caller | Evidence consumer | Decision owner |
+| Context | Caller | Assertion consumer | Decision owner |
 | --- | --- | --- | --- |
 | Social protection | Case-management connector | Programme workflow | Administering authority |
 | Public administration | Procedure portal or intermediary | Online procedure | Competent authority |
@@ -98,10 +111,14 @@ workflow connector acting for the consumer.
 | Healthcare | Clinical or case system | Care or public-health workflow | Provider or health authority |
 | Regulated private service | Application platform | Lending or insurance workflow | Lender or insurer |
 
-Registry Notary can attest a decision already made by an authoritative source system. The claim
-identifier and its review documentation must identify that fact as a source-owned decision.
-Notary attests what the source decided; it does not recompute the decision or take ownership of
-the source's policy.
+An assertion may describe a property, classification, eligibility decision, status, or relationship.
+When the configured source returns the final fact, the requirement carries the `source-derived`
+acquisition posture and Evidence reports what the source decided rather than recomputing it. The
+requirement identifier and its review documentation must identify that fact as a source-owned
+decision.
+{/* Evidence: acquisition postures source-derived, field-projected, and record-transformed,
+     products/evidence/OPERATOR-CONTRACT.md, "Source and selector controls"; assertion subject
+     matter, products/evidence/CONCEPT.md executive summary. */}
 
 ## Data and contract flow
 
@@ -117,40 +134,60 @@ the source's policy.
    endpoints through configured auth.
 5. Registry Relay executes compiler-pinned consultations. Its product-neutral `http`, `script`,
    and `snapshot` capabilities adapt reviewed source contracts and return only declared typed
-   outputs. Registry Notary evaluates evidence claims from those Relay outputs. Caller identity
-   and authorization details can authorize or parameterize a request but cannot supply evidence. It renders evaluation
-   results as
-   `application/vnd.registry-notary.claim-result+json`
-   or CCCEV-shaped JSON-LD (`application/ld+json; profile="cccev"`), and it materializes stored
-   evaluations that pass issuance checks into SD-JWT VC credentials (`application/dc+sd-jwt`).
-6. An evidence consumer receives the returned evidence. The decision owner applies any
-   consumer-specific requirement, decision, workflow, or action rules outside Relay and Notary.
-7. A trusted Registry Notary can call another trusted Registry Notary through
-   `POST /federation/v1/evaluations` for signed delegated evaluation. Registry Manifest can publish
-   discovery metadata for that relationship, but local Notary peer policy grants access.
+   outputs.
+6. Evidence evaluates one predefined, versioned requirement per request, aligned with CCCEV through
+   its frozen field mapping. Rust owns authentication, authorization, the one fixed bounded HTTP JSON
+   source request, output validation, assertion construction, signing, and audit; trusted Rhai
+   scripts prepare that request and extract typed facts. Caller identity and authorization details
+   can authorize or parameterize a request but cannot supply facts. A Relay-protected API can be the
+   configured source.
+7. Evidence returns the assertion as a flattened JWS JSON response (`application/jose+json`) by
+   default. Where the immutable bundle and the one matched authority grant both permit it, the same
+   stateless assertion may instead be serialized as a visibly unsigned JSON envelope or as an SD-JWT
+   VC (`application/dc+sd-jwt`) under the frozen Version 1 profile. That serialization adds a
+   response format, never a credential lifecycle: no issuance session, holder binding ceremony,
+   status list, revocation, or presentation verification.
+8. Where a deployment has callers and no identity provider, Registry Mint issues the short-lived
+   access tokens Evidence verifies. The dependency runs one way: `registry-mint` carries
+   `registry-evidence` as a development dependency so its tests drive Evidence's authenticator, and
+   `registry-evidence` depends on no other product crate.
+9. A consumer receives the returned assertion. The decision owner applies any
+   consumer-specific requirement, decision, workflow, or action rules outside Relay and Evidence.
 For what each project does and does not own, refer to the product overview pages linked in the capabilities table.
 
+{/* Evidence: response formats and the SD-JWT VC profile,
+     products/evidence/OPERATOR-CONTRACT.md, "Response formats", and contract
+     registry.evidence.sd-jwt-vc-profile/v1 in
+     products/evidence/contracts/sd-jwt-vc-profile.yaml (frozen); CCCEV alignment, contract
+     registry.evidence.cccev-mapping/v1 in products/evidence/contracts/cccev-field-mapping.yaml
+     (frozen); dependency direction, crates/registry-mint/Cargo.toml dev-dependencies and
+     crates/registry-evidence/Cargo.toml. */}
+
 ## Capabilities at a glance
 
 The two-layer design supports one capability sequence: describe what the registry can provide,
-expose protected registry APIs, then return evidence that matches the purpose and policy of the
-request.
+expose protected registry APIs, then answer a bounded question with a signed assertion that matches
+the purpose and policy of the request.
 A caller cannot safely use a registry until its fields, schemas, services, policies, and evidence
 offerings are inspectable, so metadata comes first.
 
 | Capability | Use it when | Primary project |
 | --- | --- | --- |
 | Describe registries | Other teams need to inspect fields, schemas, policies, services, and evidence offerings before integration. | [Registry Manifest](../../map/boundaries-and-map/) |
-| Protected Registry APIs | A file, extract, database, or legacy registry needs a governed read-only API without replacing the source. | [Registry Relay](../../products/registry-relay/) |
-| Evidence Gateway | A caller needs a status, predicate, selected value, redacted result, protected read, denial, or supported credential instead of unrestricted source-record access. | [Registry Notary](../../products/registry-notary/) and governed [Registry Relay](../../products/registry-relay/) routes |
+| Protected registry APIs | A file, extract, database, or legacy registry needs a governed read-only API without replacing the source. | [Registry Relay](../../products/registry-relay/) |
+| Minimum-disclosure assertions | A caller needs one bounded fact about one subject, signed and audience-scoped, instead of access to the record behind it. | [Evidence](../../products/registry-evidence/) |
 
-Shared audit and operational behavior makes Registry Relay and Registry Notary reviewable:
-Registry Platform supplies the shared primitives for authentication, HTTP security, audit envelopes,
-cryptography, and credential support that both runtime services compose. The external
+Shared audit and operational behavior makes Registry Relay and Evidence reviewable:
+Registry Platform supplies the shared primitives for authentication, OIDC verification, HTTP
+security, audit envelopes, and cryptography that both runtime services compose, and the shared
+SD-JWT serialization crate that Evidence composes for its credential-format response. The external
 [Solmara Lab](https://github.com/registrystack/solmara-lab/tree/00cd51a2be4a405ef75d337ddcede0f9de134b1f)
 adopter project gives reviewers runnable demo topologies without becoming part of the formal stack.
 
 ## Next
 
-- [Evidence issuance](../evidence-issuance/) explains claim evaluation, disclosure policy,
-  delegated evaluation, and credential issuance in Registry Notary.
+- [Evidence quickstart](../../start/evidence-quickstart/) maps what Evidence answers and the current
+  authoring, operation, and verification material.
+- [Evidence security model](../../security/evidence/) states the invariants the runtime enforces and
+  the duties that remain with the operator.
+- [Boundaries and map](../../map/boundaries-and-map/) records what each product owns and does not own.
diff --git a/docs/site/src/content/docs/explanation/data-minimization-and-purpose-limitation.mdx b/docs/site/src/content/docs/explanation/data-minimization-and-purpose-limitation.mdx
index 2c5c69195..693d8c37e 100644
--- a/docs/site/src/content/docs/explanation/data-minimization-and-purpose-limitation.mdx
+++ b/docs/site/src/content/docs/explanation/data-minimization-and-purpose-limitation.mdx
@@ -5,7 +5,8 @@ status: draft
 owner: registry-docs
 source_repos:
   - registry-stack
-last_reviewed: "2026-06-28"
+  - registry-evidence
+last_reviewed: "2026-08-04"
 doc_type: explanation
 locale: en
 standards_referenced:
@@ -26,94 +27,91 @@ offered: that judgement remains yours.
 The specifications here are all draft, pre-1.0 documents and may change, so treat the design as a
 posture under development rather than a finished or warranted product.
 Four terms are enough to follow this page.
-A *claim* is one pre-modelled question (one decision or one extracted value) that a system can ask
-about a person against a registry the institution already holds.
-A *Relay consultation* is the compiler-pinned contract that connects a registry-backed claim to
-the minimized typed outputs Relay may return.
+A *requirement* is one predefined, reviewed question about one set of subject roles, together with
+the exact set of values its answer may carry, asked against a registry the institution already
+holds.
+A *Relay consultation* is a Relay-owned contract that fixes the closed request inputs and the
+minimized typed outputs one protected read route may return.
 *Minimized evidence* means a response shaped by data minimization or selective disclosure; a
 *purpose-bound request* is a request that carries or is evaluated against a stated purpose.
 
-## How the claim model limits collection at the source
+Two runtime patterns carry these principles, Registry Relay and Evidence, and each enforces them
+at its own boundary rather than in one chain.
+
+## How the requirement model limits collection at the source
 
 The first place minimization appears is in the unit of data the system is built around.
-A claim definition describes one decision or one extracted value, not a whole record, so returning
-a full record would over-collect relative to the question actually asked.
+A requirement describes one reviewed question and the exact values its answer may carry, not a
+whole record, so returning a full record would over-collect relative to the question actually
+asked.
 The design treats the narrow question, not the record, as the thing to be answered.
 
 That principle is enforced at two separate boundaries. A Relay integration declares closed
-request inputs and minimized typed outputs. A Notary claim can consume only the outputs of its
-compiler-pinned consultation, or the configured authenticated context for subject access.
+request inputs and minimized typed outputs. An Evidence requirement reads a fixed, bounded source
+request whose origin, method, path, headers, and client-side response projection are all set by
+reviewed configuration, and it discloses only the concepts it declares.
 Callers cannot choose a source destination, credential, selector field, adapter capability, or
-undeclared output at request time.
+undeclared output at request time in either product.
 
-The project author still decides which Relay outputs the claim needs. Minimization therefore
-depends on a reviewed integration contract and synthetic fixtures, not on Notary deriving a
-source projection from the claim rule.
+The project author still decides which source fields the answer needs. Minimization therefore
+depends on a reviewed contract and its fixtures, not on a runtime deriving a source projection
+from the question it was asked.
 
 ## Purpose limitation as an enforced gate, not a label
 
-Purpose limitation in this design is more than a field written into a log. A Registry Stack
-project authors the evidence-service purpose once and compiles it into the Notary claim contract
-and the Relay consultation profile. Notary rejects a missing or mismatched purpose, missing
-scope, or inadmissible typed input before calling Relay. Relay separately verifies its workload
-caller, the same purpose, the consultation profile, and the contract hash before source work.
-
-The compiler-pinned input mapping carries the same idea further: the request can populate only
-declared typed inputs, and Notary cannot substitute a different consultation when authorization or
-contract validation fails.
+Purpose limitation in this design is more than a field written into a log. In Evidence, the
+purpose a caller states is one dimension of a single authorization decision that also binds the
+requester, the requirement revision, every subject role and selector profile, the subject
+authority, and the audience. The match must be exact and complete, and it happens before audit,
+credential resolution, or source access, so a request with a missing or unauthorized purpose
+reaches no source at all. Relay separately verifies its own caller, scopes, and governed policy
+gates before source work.
+
+The closed request schema carries the same idea further: a caller supplies a nonce, a requirement,
+a purpose, one selector per declared role, and optionally a holder public key that matters only to
+the SD-JWT VC response format. There are no thresholds,
+expressions, paths, headers, source fields, or response projections a caller can set.
 The effect a reviewer should take away is that purpose, when configured, acts as a precondition
 for access rather than an after-the-fact annotation.
 
 Several of these protections apply only when configured; the operator-responsibilities section
 lists them.
 
-## Minimization at the output: disclosure modes and selective credentials
-
-Minimization also applies to what leaves the boundary.
-A claim's result can be shaped into one of three disclosure modes: *value* returns the full value,
-*predicate* returns only the true/false satisfaction, and *redacted* hides the value entirely.
-A privacy-sensitive claim is expected to default to the least-revealing mode that still answers
-the question.
-(How a mode is selected and policy-bound is covered in [Disclosure modes and computed
-answers](../disclosure-modes-and-computed-answers/) and is out of scope here.)
-
-The redacted mode is worth a reviewer's attention because it shows minimization without loss of
-accountability: a redacted result carries neither the underlying value nor the satisfaction
-outcome, yet the evaluation stays referenceable and verifiable through an evaluation identifier, a
-verification identifier, and a claim hash.
-You can audit that an evaluation happened and verify it later without the result itself disclosing
-anything about the person.
-
-When the system issues a credential rather than returning a direct answer, minimization continues
-at presentation time.
-Issuance also requires one exact compiler pin for every registry-backed claim
-in each selected root's dependency closure, plus one normalized execution
-record per unique Relay consultation ULID. Notary retains those private Relay
-ids and acquisition times only when all selected roots share a mutually
-validated credential profile; registry-backed evaluation-only claims retain no
-private issuance provenance. A deterministic unkeyed SHA-256 binding detects
-partial mutation between a claim pin, execution record, and claim provenance,
-but is not an authenticity anchor against an operator able to rewrite all
-committed fields and the digest. A delegated evaluation without the
-representative ceremony or a legacy evaluation cannot cross the
-credential trust boundary.
-Issued credentials are SD-JWT VC: a verifiable-credential format in which the signed body carries
-only a SHA-256 digest of each selectively disclosable field, so a field the holder does not
-present stays hidden, and the holder controls what is revealed.
-Selective disclosure here is at the claim (or configured-projection) level: by default each claim
-becomes one disclosure carrying its whole value, so an object-valued claim is revealed as a unit
-unless an explicit projection splits it into separately-disclosable fields.
-Holder binding (tying the credential to a holder key with `did:jwk`) is enabled by default per
-profile, and the registry-backed OID4VCI issuance path requires EdDSA proof of possession; an operator
-can explicitly configure `holder_binding.mode: none` for a bearer-style credential profile.
-The direct claim or evaluation result is not a credential and is never holder-bound.
-One caveat for a reviewer: the issuance surface is a profiled, partial subset, not a full
-credential-issuer implementation, and should not be read as general wallet interoperability or
-full standards conformance.
+## Minimization at the output: closed value forms
+
+Minimization also applies to what leaves the boundary. Evidence has no caller-selectable
+disclosure at all, so there is no request-time negotiation to review.
+
+Instead, a requirement declares one to sixteen *concepts*, and each concept fixes the exact *value
+form* its fact takes: a boolean, a code from a reviewed codelist, a bounded number, a date or time
+bucket, an audience-scoped opaque reference, or a reviewed closed structure. The set of forms is
+closed at eleven. The answer carries a value for each declared concept and nothing else, and the
+assertion schema rejects additional properties.
+For a reviewer, this moves the disclosure decision from request time, where a caller could argue
+for more, to authoring and review time, where an operator justifies it once and can be held to it.
+(The forms themselves are catalogued in [Disclosure modes and computed
+answers](../disclosure-modes-and-computed-answers/) and are out of scope here.)
+
+There is no equivalent of the retired redacted mode, and this is structural rather than an
+omission: an assertion must carry at least one supported value, so an assertion with nothing in it
+cannot be produced. A request that cannot be answered returns a problem document and no assertion.
+
+Minimization can continue past the response boundary when the operator enables the SD-JWT VC
+format. That format is a second encoding of the same assertion, never a credential lifecycle: the
+signed body carries a SHA-256 digest of each selectively disclosable value, so a holder can later
+present a subset. A value uses one disclosure by default. A governed structured value can instead
+place each direct field in a separate disclosure while keeping nested field values atomic. Two
+limits matter to a reviewer. The issuer appends every disclosure, so the response the caller
+receives reveals the same set as the signed JWS, and holder-side omission is outside this version.
+Evidence also performs no presentation-side verification, no key-binding JWT validation, and no
+wallet interaction, and the profile excludes OID4VCI in every part. A caller may supply a holder
+public key that Evidence echoes into the `cnf` claim for a relying party to check itself.
 
 A further minimization detail guards against a subtler leak.
-A failed or ambiguous consultation does not let Notary choose a source record. The public Notary
-surface reports unavailable evidence without returning the raw Relay observation.
+No match, ambiguity, a missing required fact, and an unresolved derivation input all collapse into
+one problem response with the same title and body shape, so a caller cannot use a refusal to learn
+whether a record exists. The outcomes stay distinct in the audit record; collapsing is a property
+of what the caller sees, not of what the operator can review.
 
 ## Data stays at source: distributed custody
 
@@ -143,10 +141,14 @@ data.
 
 Accountability is supported through audit, which is treated as a security control rather than an
 optional log.
-Every request that returns person-level records or claim results must be recorded with at least
+Every request that returns person-level records or an assertion must be recorded with at least
 the caller principal, the scopes exercised, a request identifier, and the purpose value where one
 was supplied, and a deployment can run audit fail-closed so that a request whose audit record
 cannot be written does not succeed.
+Evidence takes that further and is fail-closed by construction rather than by configuration: it
+writes an access record before it contacts any source and a release record after signing and
+before release, and an audit failure fails the request. Selector, source, and disclosed values
+never appear in those records or in logs, and raw source responses are never persisted.
 
 Audit fail-closed is a capability a deployment can turn on, not a guarantee that every route in
 any given build has been individually audited against it.
@@ -166,9 +168,11 @@ The full, canonical inventory is in [Known limitations and non-guarantees](../kn
 - No rectification or data-subject-rights flow: Beyond erasure, there is no rectification or
   general data-subject-rights mechanism.
 
-Revocation mechanics, federation's cross-authority scope, aggregate-analytics privacy budgeting,
-and the general compliance disclaimer are stack-wide absences rather than specifics of data
-minimization or purpose limitation, but a data-protection assessment should weigh them too.
+There is also no revocation, suspension, status list, or credential-status endpoint of any kind: an
+assertion carries a validity window and is otherwise final once released. Cross-authority
+federation, aggregate-analytics privacy budgeting, and the general compliance disclaimer are
+likewise stack-wide absences rather than specifics of data minimization or purpose limitation, but
+a data-protection assessment should weigh them too.
 See the [known limitations hub](../known-limitations/) for the full inventory.
 
 ## Operator responsibilities: what the design leaves to you
@@ -178,11 +182,13 @@ operator owns the configuration.
 Several of the protections are conditional, and a reviewer should test the deployment, not the
 design, for each one.
 
-The main conditional control is the authored projection. The compiler prevents Notary from
-bypassing the Relay consultation, but it does not decide which typed outputs an institution has a
-lawful reason to expose. Project reviewers must confirm the source authority, selector inputs,
-output projection, purpose, claims, and disclosure defaults together. Operators must then bind
-only the reviewed source and workload credentials to the generated product inputs.
+The main conditional control is the authored projection. A runtime can stop a caller from reaching
+past the reviewed contract, but it cannot decide which values an institution has a lawful reason to
+expose. Project reviewers must confirm the source authority, selector inputs, output projection,
+purpose, requirements, and declared value forms together, and Evidence expects the complete
+simultaneously enabled configuration to be reviewed as one disclosure surface, since two answers
+that are each defensible alone can reconstruct a protected value between them. Operators must then
+bind only the reviewed source and workload credentials to the generated product inputs.
 
 More broadly, the architecture defines primitives and leaves a large set of
 data-protection-relevant controls to the operator.
@@ -197,13 +203,12 @@ whether it meets any legal obligation) depends on how the operator configures an
 
 ## Related
 
-- [Disclosure modes and computed answers](../disclosure-modes-and-computed-answers/): how
-  disclosure modes are selected and policy-bound
+- [Disclosure modes and computed answers](../disclosure-modes-and-computed-answers/): the closed
+  value forms and what each one reveals
 - [Threat model](../threat-model/): the boundaries, assets, and threats behind this posture
 - [Security overview](../../security/): the high-level security summary
 - [Known limitations and non-guarantees](../known-limitations/): the full inventory of edges
 - [Records stay home](../records-stay-home/): what stays inside the institution's boundary and
   what crosses it
 - The security and protocol specifications: [RS-SEC-G](../../spec/rs-sec-g/),
-  [RS-DM-CLAIM](../../spec/rs-dm-claim/), [RS-PR-NOTARY](../../spec/rs-pr-notary/),
-  [RS-PR-RELAY](../../spec/rs-pr-relay/)
+  [RS-PR-EVIDENCE](../../spec/rs-pr-evidence/), [RS-PR-RELAY](../../spec/rs-pr-relay/)
diff --git a/docs/site/src/content/docs/explanation/disclosure-modes-and-computed-answers.mdx b/docs/site/src/content/docs/explanation/disclosure-modes-and-computed-answers.mdx
index 609ed5252..6b64cbeea 100644
--- a/docs/site/src/content/docs/explanation/disclosure-modes-and-computed-answers.mdx
+++ b/docs/site/src/content/docs/explanation/disclosure-modes-and-computed-answers.mdx
@@ -1,14 +1,16 @@
 ---
 title: Disclosure modes and computed answers
-description: Why Registry Notary can answer a question about a subject by returning a computed result (value, predicate, or redacted) instead of handing back the source record.
+description: Why Evidence answers a question about a subject with a computed value whose shape is fixed in advance, instead of handing back the source record.
 status: draft
 owner: registry-docs
 source_repos:
   - registry-stack
-last_reviewed: "2026-06-28"
+  - registry-evidence
+last_reviewed: "2026-08-03"
 doc_type: explanation
 locale: en
-standards_referenced: []
+standards_referenced:
+  - sd-jwt-vc
 ---
 
 You are weighing whether Registry Stack actually keeps a sensitive registry record private while
@@ -16,167 +18,193 @@ still answering questions about the subjects in it.
 The short answer is that a caller asks a question and receives a *computed answer*, not the record.
 This page explains how that works, what each kind of answer does and does not reveal, and where
 the privacy claim has edges.
-You will see one product term used throughout: an **evidence claim**, which is one atomic,
-precisely defined evidence statement or extracted value, such as "is this person registered?" or
-"what is this person's registration date?".
-A claim is deliberately narrow and reusable. A claim that returned a whole record would
-over-collect, and a claim that embedded one consumer's eligibility or action rules could not be
-reused as neutral evidence.
-
-## How Registry Notary controls what leaves the service
-
-Registry Notary is the component that evaluates an evidence claim and enforces what the caller
-receives back.
-It controls the answer through three **disclosure modes**: `value`, `predicate`, and `redacted`.
-There are exactly three.
-`value` is not always all-or-nothing, though: when a claim returns an object, `value` mode can
-have specific fields redacted (configured through `redaction_fields`), and the result carries the
-object minus those fields plus a list of what was withheld.
-
-Per-claim disclosure control is enforced at runtime by the service.
-It is not left to a caller's good behavior.
-
-## The evaluation pipeline: computed answers, not record handoffs
-
-The reason an answer can stand in for a record is that the caller never supplies the value being
-asked about.
-To evaluate a claim, the caller sends a **claim id** plus the typed request inputs the claim policy
-admits. Those inputs can include target or requester identifiers, declared variables, or scoped
-relationship attributes.
-The REST call is authenticated the way the rest of the service is: an API key or bearer token in
-static-credential mode, or an OIDC token, whichever your deployment is configured for.
-For every claim, Registry Notary requests exactly one compiler-pinned
-consultation from Registry Relay. Request inputs may parameterize the
-consultation but do not become evidence.
-The caller does not supply the evaluated value, and cannot inject one.
-
-The evaluation runs as a pipeline: Relay returns a closed typed consultation result when the claim
-is registry-backed, a rule evaluates the configured evidence statement, a disclosure mode shapes
-what leaves the service, and a response format carries the result.
-Because Notary computes the answer from the closed Relay result and any
-declared non-evidentiary evaluation parameters, it can return that computed
-answer rather than handing back a source record.
-
-The rule that does the computing is one of three kinds.
-An **exists** rule checks whether the pinned consultation produced one admissible match.
-An **extract** rule reads a declared typed output.
-A **`cel`** rule derives an evidence value from typed Relay outputs and
-declared non-evidentiary request variables through a hardened expression.
-Each kind produces an answer about the subject without that answer being a copy of the source row.
+You will see one product term used throughout: a **requirement**, which is one predefined,
+reviewed question about one set of subject roles, together with the exact set of values its answer
+may carry.
+A requirement is deliberately narrow and reusable. A requirement that returned a whole record would
+over-collect, and a requirement that embedded one consumer's eligibility or action rules could not
+be reused as neutral evidence.
+
+## Evidence has no caller-selectable disclosure modes
+
+The most important difference is a subtraction.
+An Evidence request carries four required members: a per-request nonce, the requirement identifier,
+the purpose, and one selector per declared subject role. The only optional member is a holder
+public key, which is echoed into the SD-JWT VC `cnf` claim and never reaches authorization,
+selectors, scripts, source requests, or audit. The request schema is closed and rejects anything
+else (`products/evidence/contracts/request.schema.yaml`).
+There is no disclosure mode, no redaction field list, no allowed set, and no downgrade policy,
+because there is nothing for a caller to choose.
+
+Evidence answers a predefined requirement and returns that requirement's answer.
+It does not run a disclosure policy engine over an arbitrary record, and it has no notion of "the
+same answer, revealed at three levels of detail."
+How much a requirement reveals is fixed when the requirement is authored and reviewed, and it is
+identical for every caller and every purpose authorized to invoke it.
+
+That is deliberately narrow. It moves the disclosure decision
+from request time, where a caller could argue for more, to authoring and review time, where an
+operator has to justify it once and can be held to it.
+
+## What actually controls disclosure
+
+A requirement declares one to sixteen **concepts**. Each concept names the fact being disclosed and
+fixes the exact **value form** that fact takes. The answer carries a value for each declared
+concept and nothing else; the assertion schema rejects additional properties, and subject selector
+profiles and selector values never appear in it
+(`products/evidence/contracts/evidence.schema.yaml`).
+
+The value form is the minimization control, because the form decides what the number, code, or date
+behind the answer is allowed to become before it leaves the service. There are eleven forms and the
+set is closed (`products/evidence/contracts/supported-value-forms.yaml`).
+
+| Value form | What the caller learns |
+|------------|------------------------|
+| `boolean` | one true or false, and nothing about how it was reached |
+| `controlled-code`, `controlled-code-list` | exact membership in a reviewed codelist; labels and source codes are not disclosed |
+| `controlled-category` | exact membership in a reviewed closed category set |
+| `bounded-integer`, `bounded-decimal` | a number inside declared bounds, at a declared scale |
+| `date-bucket`, `time-bucket` | which reviewed bucket applies; the underlying date, instant, or duration is not disclosed |
+| `audience-scoped-entity-reference`, `entity-reference-list` | an opaque reference meaningful to the named audience and to no other |
+| `reviewed-structured-value` | a small structure whose closed JSON Schema forbids arbitrary JSON; the widest form, and the one to justify hardest |
+
+Two of these deserve emphasis. A controlled code answers with a reviewed disclosure code rather than
+the register's own code, so the register's internal coding never leaves. A date bucket answers with
+a bucket rather than the date, which is how a question about time can be answered without releasing
+a birth date or an expiry date.
+
+The size ceilings are part of the control: at most sixteen concepts per requirement, and a total
+serialized value budget of 65536 bytes.
+
+## Four questions, four answer shapes
+
+Four acceptance definitions carry equal weight in the Evidence contract. None is privileged, none
+is a built-in type, and none has a special route (`AGENTS.md`, `products/evidence/CONCEPT.md`).
+They are worth reading together because they show the same mechanism producing four differently
+shaped answers.
+
+- **Adult status** declares one `boolean` concept, derived from a date the caller never sees, with
+  the age threshold supplied as a reviewed derivation parameter rather than by the caller. The
+  caller learns whether the threshold is met, not the date or the age.
+- **Residence region** declares one `controlled-code` concept bound to a reviewed codelist at a
+  pinned version. Several register codes map onto one disclosed region, so the answer is coarser
+  than the register's own value by construction. A register code with no reviewed mapping leaves
+  the requirement unresolved rather than guessing.
+- **Professional licence status** declares two concepts: a `boolean` for whether the licence is
+  active, and a `controlled-category` for an expiry bucket. The caller learns "active, expiring
+  within 90 days" without learning the expiry date.
+- **Legal-parent relationship** declares one `boolean` concept over two subject roles, a child and
+  a candidate parent that the caller already holds a reference to. It confirms or denies the
+  relationship the caller asked about, and never enumerates the child's parents.
+
+The fixtures for all four are in `products/evidence/fixtures/acceptance/`.
 
 ## Evidence is not a consumer decision
 
 Registry Relay source-access and adaptation policy controls how an authoritative source is read
-and normalized. Registry Notary evidence policy controls which evidence statement is evaluated,
-who can request it, and how much can be disclosed. The evidence consumer determines how the
-evidence is used, while the decision owner remains accountable for requirements, decisions, and
-actions.
-
-A Common Expression Language (CEL) rule can derive an evidence predicate, such as whether the
-source records an active programme enrollment or a measles dose. It is not a general-purpose
-consumer eligibility or decision engine. A public-health programme, for example, can act as both
-evidence consumer and decision owner when it combines those evidence claims with its own
-thresholds, priorities, and case state to decide whether outreach or follow-up is required.
-
-Registry Notary can also attest a decision that an authoritative source already owns. The claim
-identifier and its review documentation must say that it is a source-owned decision. Notary does
-not recompute that decision or present the source's decision policy as Notary policy.
-
-## The three disclosure modes
-
-The disclosure mode fixes how much of the computed answer the caller receives:
-
-| Mode | What the caller receives |
-|------|--------------------------|
-| `value` | the evaluated value, less any object fields the policy redacts |
-| `predicate` | only the true/false satisfaction of a boolean result |
-| `redacted` | no value and no satisfaction outcome |
-
-`value` returns the computed result, minus configured object-field redactions, so this mode is the
-least private of the three and is appropriate only where the use case calls for the actual value.
-
-Every evaluation result records which disclosure mode was applied, so a downstream system can tell
-how much was revealed.
-
-## Why predicate and redacted avoid sharing the underlying record
-
-This is the central privacy property.
-Because Notary computes the answer from compiler-pinned Relay outputs or permitted
-subject access, a `predicate` result can satisfy a question while disclosing only a boolean.
-A question of whether someone has a registered record is modelled as an `exists` rule disclosed as
-`predicate`: the caller learns `true` when a matching record is found, while a subject with no
-matching record returns `evidence.not_available` (collapsed to a single public reason by default)
-rather than `false`; absence is surfaced as no-evidence, not as a negative result.
-Either way the source row never leaves the service.
-A source fact such as whether a recorded vaccination dose is present can be modelled as a boolean
-evidence predicate without returning the underlying health record.
-
-A `redacted` result goes further: it carries neither the source value nor the satisfaction
-outcome.
-Both are withheld.
-The standard result body reports no `satisfied` value, and the CCCEV JSON-LD renderer omits
-`cccev:isConformantTo`.
-
-`predicate` still discloses a true-or-false fact; `redacted` does not.
+and normalized. Evidence authorization and requirement policy control which requirement is
+evaluated, who can request it, for what purpose, and exactly which values leave the service. The
+evidence consumer determines how the evidence is used, while the decision owner remains accountable
+for requirements, decisions, and actions.
+
+A derivation script can compute an evidence value, such as whether a threshold is met or which
+reviewed bucket applies. It is not a general-purpose consumer eligibility or decision engine, and
+Version 1 has no general policy engine (`products/evidence/contracts/README.md`). A public-health
+programme, for example, can act as both evidence consumer and decision owner when it combines those
+answers with its own thresholds, priorities, and case state to decide whether outreach or follow-up
+is required.
+
+## There is no redacted answer
+
+Evidence cannot return an answer that carries neither a value nor a satisfaction outcome, and this
+is structural rather than an omission: an assertion must carry at least one
+supported value, so an assertion with nothing in it cannot be produced
+(`products/evidence/contracts/evidence.schema.yaml`).
+
+An Evidence request that cannot be answered does not return an empty assertion. It returns an
+`application/problem+json` document with a closed member set, and no assertion is produced at all
+(`products/evidence/contracts/problem-contract.yaml`).
+
+What used to be modelled as a redacted answer is modelled in Evidence as a different requirement,
+or as a coarser value form on the same requirement, and is reviewed as such.
+
+## A refusal is not an existence oracle
+
+Collapsing an unresolved outcome is not optional and not a mode.
+Every requirement declares `existenceDisclosure: collapse-unresolved`, and that enum has exactly
+one permitted value (`products/evidence/contracts/bundle.schema.yaml`).
+
+No match, ambiguity, a missing required fact, and an unresolved derivation input all collapse into
+one public problem, `evidence_not_available` with status 422, carrying the same title and the same
+body shape. A caller cannot tell which of the four happened, so it cannot use the response to learn
+whether a record exists (`products/evidence/contracts/problem-contract.yaml`, invariant `V1-I16` in
+`products/evidence/contracts/security-invariant-matrix.yaml`).
+Existence may be disclosed only as a separately authorized declared concept, never as error detail.
+
+Internally the outcomes stay distinct in the audit record. Collapsing is a property of what the
+caller sees, not of what the operator can review.
 
 ## Preserve negative, unknown, and unavailable evidence
 
-Claim authors must keep these source meanings distinct:
+Requirement authors must keep these source meanings distinct:
 
-- `true` means the reviewed source contract positively establishes the evidence statement.
+- `true` means the reviewed source contract positively establishes the fact.
 - `false` means the reviewed source contract positively establishes its negative.
-- `null` means a subject matched but the declared source value is unknown, absent, or not recorded.
-- `no_match` means the exact selector did not resolve a subject.
-- `ambiguous` means the selector resolved more than one admissible subject.
+- An absent value means a subject matched but the declared source value is unknown, absent, or
+  not recorded.
+- No match means the exact selector did not resolve a subject.
+- Ambiguity means the selector resolved more than one admissible subject.
 - A source failure means the source could not provide a reliable result.
 
-A claim rule must not silently coerce `null`, `no_match`, `ambiguous`, or source failure to
-`false`. Missing evidence is not a negative fact. An explicitly named existence predicate is the
-narrow exception: a reviewed rule can map `matched == false` to `false` only when the claim means
-that one admissible match exists. This exception does not make other claims negative, and ambiguity
-or source failure never becomes `false`. A public disclosure policy can collapse matching failures
-to `evidence.not_available`, but the reviewed source outcome and audit provenance remain distinct
-from an explicit negative source value.
-
-## How disclosure policy is configured per claim
-
-The caller does not freely pick from all three modes.
-Each claim configures a **disclosure policy**: a `default` mode, an `allowed` set drawn from the
-three modes, and a `downgrade` policy.
-A caller may request a mode: Notary honors it when it is in that claim's allowed set.
-Under the default `deny` downgrade, a disallowed request is refused
-(`claim.disclosure_not_allowed`); a `default` or `redacted` downgrade substitutes that fallback
-mode when the fallback is itself allowed.
-When the caller requests no mode, Notary applies the claim's default.
-So the policy bounds which modes are allowed, and the caller chooses among the allowed modes.
-A privacy-sensitive claim can be configured to default to the least-revealing mode that still
-answers the question.
-
-## What a redacted result still reveals (and to whom)
-
-"Reveals nothing to the caller" is not the same as "leaves no trace." A `redacted` evaluation can
-still be pointed back at: it carries an `evaluation_id`, and the audit record carries a
-`verification_id` and a `claim_hash`.
-That lets you reference the evaluation that happened; it is not a cryptographic signature on the
-answer.
-Redaction shapes what the caller sees; it does not erase the fact that an evaluation happened.
-
-That trace is by design.
-Every evaluation (redacted or not) is audited, and a deployment can run audit fail-closed, so that
-a request whose audit record cannot be written does not succeed.
-So redaction does not mean an unlogged request; it means an unrevealed answer.
-
-There is a related protection on the matching surface.
-By default, a matching failure collapses to a single public reason, `evidence.not_available`, so
-the lookup cannot be used as an existence oracle; a "not found" answer does not tell the caller
-whether a record exists.
-This complements `redacted` disclosure by not leaking record existence.
-A deployment can turn this off, but only in a controlled environment; it is not always on.
+A derivation must not silently coerce an absent value, no match, ambiguity, or source failure to
+`false`. Missing evidence is not a negative fact. An explicitly named existence concept is the
+narrow exception: a reviewed derivation can treat "no admissible match" as a negative only when the
+concept means exactly that one admissible match exists, and ambiguity or source failure never
+becomes `false`.
+
+## Subjects do not travel, and do not correlate
+
+A subject appears in an assertion only as a role-bound, audience-scoped opaque binding, derived
+with a keyed function over the audience, purpose, role, selector profile, binding-key version, and
+the complete canonical selector bundle. The same person asked about by two relying parties, or
+under two purposes, yields two unrelated bindings, so assertions cannot be joined into a profile
+(invariant `V1-I17`).
+
+That property is also why `audience-scoped-entity-reference` is a usable value form: an assertion
+can identify a related entity to the audience that asked without minting an identifier anyone else
+can match on.
+
+## Response formats are not disclosure levels
+
+Evidence can serialize the same assertion in up to three formats: a signed flattened JWS, an
+SD-JWT VC under a frozen local profile, and a separately typed unsigned envelope. `signed-jws` is
+mandatory in every bundle and is the default (`products/evidence/contracts/bundle.schema.yaml`).
+
+These are integrity and encoding choices, not privacy choices. All three carry the same declared
+values.
+The SD-JWT VC serialization emits one root disclosure per supported value by default. A governed
+`reviewed-structured-value` can instead expose an always-visible object whose direct fields are
+independent disclosures. Nested field values remain atomic. The issuer appends every disclosure,
+so the response the caller receives reveals the same set as the JWS. Holder-side omission at
+presentation time is outside Version 1, which performs no presentation-side verification, no
+key-binding JWT validation, and no wallet interaction
+(`products/evidence/contracts/sd-jwt-vc-profile.yaml`).
+The unsigned envelope carries no integrity protection, is released only when both the reviewed
+configuration and the caller's matched grant permit it, and is never later-verifiable evidence.
+
+## One requirement is not the whole disclosure surface
+
+Each requirement declares a `disclosureGuard` naming the value families it touches, and two
+requirements that are each defensible alone can reconstruct a protected value between them.
+The complete enabled configuration is therefore reviewed as one disclosure surface rather than
+requirement by requirement, and that review is an operator duty the runtime cannot perform
+(invariant `V1-I03`, `products/evidence/OPERATOR-CONTRACT.md`).
 
 ## Disclosure control is one safeguard among several
 
-Disclosure modes are one runtime safeguard within a broader posture that also includes
-authentication, scoped routes, no source mutation, and audit.
+Value forms are one design-time safeguard within a broader posture that also includes
+authentication, a single authorization decision taken before any source is contacted, immutable
+startup configuration, and audit at two durable gates.
 They are not the whole privacy guarantee.
 A few protections are not the software's to make at all: secret and key custody, audit retention,
 tenant isolation, transport, and rate limiting are your deployment's job, not built-in guarantees.
@@ -185,34 +213,31 @@ tenant isolation, transport, and rate limiting are your deployment's job, not bu
 
 A few boundaries matter when you evaluate this design:
 
-- Minimization is conditional, not absolute: A minimized answer can be narrower than the full
-  source record only where the configured use case supports that pattern.
-  Notary does not always return less than the record; `value` mode returns the full value, and a
-  claim reveals only what its policy was configured to reveal.
-- The caller cannot inject a value, but matching strictness is configured: The "computed answer
-  avoids sharing the record" guarantee rests on Notary computing the answer from the configured
-  evidence mode and closed typed inputs.
-  Matching is only as strict as the reviewed Relay consultation contract.
-- Disclosure modes are not credential selective disclosure: A holder's later choice of which
-  credential fields to present is a separate mechanism from Notary's three evaluation modes.
-  Do not read `value`/`predicate`/`redacted` as the same thing as a wallet holder selectively
-  disclosing credential fields.
-- Credential selective disclosure is claim-output scoped by default: without an explicit
-  projection, each claim becomes one disclosure carrying the whole value, so an object-valued
-  output is revealed as a unit.
-
-These modes also sit inside boundaries that are not specific to disclosure design: how the Relay
-consultation is authorized and pinned, how subject access inputs are scoped, and what "aligned
-with a standard" does and does not mean.
-Weigh those alongside the disclosure modes; see the [known limitations hub](../known-limitations/) for
+- Minimization is modelled, not automatic: a requirement reveals exactly what its concepts declare.
+  A requirement authored with `reviewed-structured-value` returns that structure. Least disclosure
+  is a choice the requirement makes, not a property the runtime imposes on every answer.
+- Purpose does not narrow the answer: a requirement returns the same concepts in the same forms for
+  every purpose authorized to invoke it. Purpose gates whether a caller may ask; a purpose that
+  justifies a coarser answer needs its own requirement.
+- The caller cannot inject a value, but matching strictness is configured: the computed answer rests
+  on Evidence deriving it from one reviewed source consultation. A lookup resolves to exactly one
+  match, no match, or ambiguity, and matching is only as strict as that reviewed source contract.
+- This is not zero-knowledge: a boolean answer is computed inside the service from data the service
+  read, and SD-JWT selective disclosure is digest omission. Neither is a zero-knowledge proof.
+- An assertion is not a general-purpose credential: its subject binding is scoped to the audience
+  named in it, so it is meaningful to that relying party and to no other.
+
+These forms also sit inside boundaries that are not specific to disclosure design: how the source
+consultation is authorized and pinned, how subject selectors are scoped, and what "aligned with a
+standard" does and does not mean.
+Weigh those alongside the value forms; see the [known limitations hub](../known-limitations/) for
 the full inventory.
 
 ## Related
 
 - [Security overview](../../security/): the full posture this fits into
-- [Data minimization and purpose limitation](../data-minimization-and-purpose-limitation/): the
-  privacy view
+- [Evidence security model](../../security/evidence/): the invariants named on this page
 - [Known limitations and non-guarantees](../known-limitations/): where the edges are
 - [Records stay home](../records-stay-home/): what stays inside the institution and what crosses out
-- How a claim and its disclosure policy are defined: [RS-DM-CLAIM](../../spec/rs-dm-claim/);
-  disclosure modes, credentials, and federation: [RS-PR-NOTARY](../../spec/rs-pr-notary/)
+- How a requirement and its disclosure are defined:
+  [RS-PR-EVIDENCE](../../spec/rs-pr-evidence/)
diff --git a/docs/site/src/content/docs/explanation/dpi-safeguards-alignment.mdx b/docs/site/src/content/docs/explanation/dpi-safeguards-alignment.mdx
index 390390b28..b46d01277 100644
--- a/docs/site/src/content/docs/explanation/dpi-safeguards-alignment.mdx
+++ b/docs/site/src/content/docs/explanation/dpi-safeguards-alignment.mdx
@@ -7,8 +7,8 @@ source_repos:
   - registry-platform
   - registry-relay
   - registry-manifest
-  - registry-notary
-last_reviewed: "2026-07-02"
+  - registry-evidence
+last_reviewed: "2026-08-04"
 doc_type: explanation
 locale: en
 standards_referenced:
@@ -25,8 +25,6 @@ standards_referenced:
   - skos
   - odrl
   - sd-jwt-vc
-  - oid4vci
-  - w3c-did
   - verifiable-credentials
 ---
 
@@ -56,12 +54,12 @@ independent oversight.
 Use the registry stack when a program needs controlled registry facts instead of broad data access:
 
 - A ministry needs a read-only consultation API over an existing registry.
-- A program needs eligibility evidence without copying the source record.
+- A program needs a reviewed answer about a subject without copying the source record.
 - An integrator needs to inspect schemas, policies, services, and evidence offerings before
   connecting.
 - A reviewer needs audit events, stable denial codes, package and configuration-bundle digests, or
   signed evidence artifacts.
-- A known peer needs delegated evaluation through a configured Registry Notary relationship.
+- A relying party needs a signed, minimum-disclosure assertion it can verify after the fact.
 
 Do not use the stack as an unrestricted data portal, data warehouse, ad-hoc SQL service, consent
 platform, grievance system, eligibility engine, or proof that a DPI deployment conforms to the
@@ -72,11 +70,11 @@ framework.
 | Safeguards question | Stack evidence | Boundary |
 | --- | --- | --- |
 | What does the registry expose? | Registry Manifest renders portable catalog, schema, service, policy, and evidence-offering metadata. | Metadata describes a surface. It does not authorize access. |
-| Who can read protected data? | Relay authenticates protected source routes. Notary authenticates claim routes and authorizes registry-backed claims before calling Relay. | Deployment policy decides who receives scopes and workload authority. |
+| Who can read protected data? | Relay authenticates protected source routes. Evidence independently authenticates the assertion caller against one configured OIDC issuer and matches one complete entitlement before it contacts any source. | Deployment policy decides who receives scopes, grants, and workload authority. |
 | Is the exchange purpose-bound? | Governed runtime routes can require purpose and trusted context, then fail closed with stable [`pdp.*` denial codes](../../reference/errors/). | Static policy metadata is not enforcement until a runtime service binds it. |
-| Is data minimized? | Relay exposes configured fields, relationships, and aggregates. Notary can return `value`, `predicate`, or `redacted` [disclosure results](../disclosure-modes-and-computed-answers/). | The operator still chooses the fields, claims, and disclosure defaults. |
-| Can the exchange be reviewed later? | Relay and Notary audit events, Policy Decision Point (PDP) provenance, package and content digests, and Selective Disclosure JWT Verifiable Credentials (SD-JWT VC) provide review evidence. | Audit records support accountability. They are not accountability by themselves. |
-| Can other systems interoperate? | Manifest emits standards-shaped metadata; Relay and Notary publish OpenAPI; Notary issues SD-JWT VC credentials and exposes a profiled OpenID for Verifiable Credential Issuance (OID4VCI) flow. | These are scoped adoption claims, not blanket conformance to every named standard. |
+| Is data minimized? | Relay exposes configured fields, relationships, and aggregates. Evidence returns only the concepts a predefined requirement declares, each in one of eleven closed [value forms](../disclosure-modes-and-computed-answers/). | The operator still chooses the fields, the requirements, and how coarse each declared value form is. |
+| Can the exchange be reviewed later? | Relay audit events and Policy Decision Point (PDP) provenance, Evidence keyed audit records written at two durable gates, package and configuration digests, and Selective Disclosure JWT Verifiable Credentials (SD-JWT VC) provide review evidence. | Audit records support accountability. They are not accountability by themselves. |
+| Can other systems interoperate? | Manifest emits standards-shaped metadata; Relay and Evidence publish OpenAPI; Evidence can serialize one assertion as an SD-JWT VC under a frozen local profile. | These are scoped adoption claims, not blanket conformance to every named standard. The SD-JWT VC profile is a second encoding of one response, and it excludes OpenID for Verifiable Credential Issuance (OID4VCI) in every part. |
 
 ## Project roles
 
@@ -84,8 +82,8 @@ framework.
 | --- | --- | --- |
 | [Registry Manifest](../../products/registry-manifest/) | Validates `metadata.yaml`, rejects known runtime-only keys, and renders standards-shaped metadata: Data Catalog Vocabulary (DCAT), BRegDCAT-AP, Core Public Service Vocabulary Application Profile (CPSV-AP), Shapes Constraint Language (SHACL), JSON Schema, Open Digital Rights Language (ODRL), Core Criterion and Core Evidence Vocabulary (CCCEV), Open Geospatial Consortium (OGC) API Records, evidence offerings, and SKOS-shaped codelists. | Manifest does not serve HTTP, read production data, authorize callers, or evaluate claims. See the [Registry Manifest data model](../../spec/rs-dm-manifest/). |
 | [Registry Relay](../../products/registry-relay/) | Exposes protected, read-only, domain-oriented registry routes for records, relationships, schemas, aggregates, scoped metadata, and governed PDP reads, plus emitted audit events. | Relay does not mutate source data, expose arbitrary SQL, evaluate claims, issue credentials, host issuer DID documents, or put admin routes on the public API. See the [Registry Relay protocol](../../spec/rs-pr-relay/). |
-| [Registry Notary](../../products/registry-notary/) | Evaluates configured claims from compiler-pinned Relay consultations, authorizes subject access, applies disclosure policy, renders claim results, issues SD-JWT VC credentials only from stored exact Relay-backed dependency-closure provenance under the configured ceremony, and supports static-peer delegated evaluation. | Notary does not accept caller-provided evidence, access registry sources directly, decide eligibility, run a wallet, certify source truth, or provide open federation. See the [Registry Notary protocol](../../spec/rs-pr-notary/). |
-| Registry Platform | Supplies shared primitives for authentication, OpenID Connect (OIDC), audit envelopes, HTTP security, outbound HTTP policy, cryptography, PDP behavior, and SD-JWT VC support. | Platform provides primitives. Relay and Notary configure and enforce their route behavior. See [RS-SEC-G](../../spec/rs-sec-g/). |
+| [Evidence](../../products/registry-evidence/) | Evaluates predefined, versioned requirements against fixed, bounded source requests; authenticates the caller and matches one complete entitlement as a single decision before any source access; derives the declared concept values through bounded scripts; and returns a signed flattened JWS or SD-JWT VC assertion with keyed audit. | Evidence does not accept caller-provided facts, run a general policy engine, decide eligibility, run a wallet, verify presentations, certify source truth, or federate. It has no application database and persists no selector, source, or response data. See the [Evidence protocol](../../spec/rs-pr-evidence/). |
+| Registry Platform | Supplies shared primitives for authentication, OpenID Connect (OIDC), audit envelopes, HTTP security, outbound HTTP policy, cryptography, PDP behavior, and SD-JWT VC support. | Platform provides primitives. Relay and Evidence configure and enforce their own route behavior, and they do not share one authorization model. See [RS-SEC-G](../../spec/rs-sec-g/). |
 
 ## Principle alignment
 
@@ -97,14 +95,14 @@ principles; the remaining principles are governance and institutional work outsi
 
 | Framework principle cluster | How the stack helps | What remains outside the stack |
 | --- | --- | --- |
-| Data privacy by design (O3) | Configured fields, scoped metadata, aggregate routes, predicate evidence, redacted evidence, and selective disclosure reduce unnecessary data movement. | Legal privacy duties, data subject rights, retention rules, and consent operations remain deployment responsibilities. |
+| Data privacy by design (O3) | Configured fields, scoped metadata, aggregate routes, computed answers in closed value forms, and selective disclosure reduce unnecessary data movement. | Legal privacy duties, data subject rights, retention rules, and consent operations remain deployment responsibilities. |
 | Data security by design (O4) | Protected routes use API key or OIDC modes, scope-before-source authorization, shared security primitives, separate admin surfaces, and fail-closed governed decisions. | Key custody, network controls, incident response, security audits, and production hardening remain operator responsibilities. |
 | Data protection during use (O5) | Runtime services can record purpose, checked scopes, PDP policy provenance, stable denials, and audit events for reads and evaluations. | A program still needs lawful basis, oversight, retention policy, and protections against overreaching requests. |
-| Transparency and accountability (F4) | Portable metadata, runtime metadata, OpenAPI references, stable error codes, audit records, Notary federation signed responses, credentials, and the [standards register](../../reference/standards/) make behavior reviewable. | Public governance, remedies, procurement discipline, and independent accountability mechanisms are institutional controls. |
+| Transparency and accountability (F4) | Portable metadata, runtime metadata, OpenAPI references, stable error codes, audit records, signed assertions carrying the configuration revision they were produced under, and the [standards register](../../reference/standards/) make behavior reviewable. | Public governance, remedies, procurement discipline, and independent accountability mechanisms are institutional controls. |
 | Evolve with evidence (O2) | [ITB and SEMIC validation evidence](../../reference/itb-semic-evidence/), the [security self-assessment](../../security/self-assessment/), and [OpenSSF status and release verification evidence](../../security/openssf-evidence/) give assessors material they can re-run and re-check. | Independent assessments, audits, engagement with affected people, and acting on findings remain program and institutional responsibilities. |
 | Build and share open assets (O9) | The stack emits or uses open, standards-shaped artifacts and documented HTTP contracts rather than one-off integration agreements. | External conformance and certification require separate validation against each standard or program rule. |
-| Autonomy and agency (F6) | Notary credentials default to holder binding through `did:jwk`; a bound credential can be presented only by the key holder; claim results and credentials can avoid exposing more than the configured disclosure mode allows. Operators can still configure an explicit unbound credential profile. | The stack does not provide a complete wallet, consent journey, opt-out path, appeal process, or assisted service channel. |
-| Inclusion and non-discrimination (F2, F3, O6) | Metadata, audit, and claim evidence can help reviewers inspect what a service exposes and how it behaves. | Accessibility, language access, community participation, gender or disability inclusion, and non-digital alternatives are not solved by these components. |
+| Autonomy and agency (F6) | An Evidence subject appears only as an audience-scoped opaque binding, so two relying parties asking about the same person cannot join their assertions into a profile. A caller may supply a holder public key that Evidence echoes into the SD-JWT VC `cnf` claim for the relying party to check. | Evidence never validates a presentation or a key-binding JWT, and the stack does not provide a wallet, consent journey, opt-out path, appeal process, or assisted service channel. |
+| Inclusion and non-discrimination (F2, F3, O6) | Metadata, audit, and assertion records can help reviewers inspect what a service exposes and how it behaves. | Accessibility, language access, community participation, gender or disability inclusion, and non-digital alternatives are not solved by these components. |
 
 ## Fit boundaries
 
@@ -114,12 +112,12 @@ can be returned, and which project owns the behavior.
 
 The stack does not hide governance decisions inside software.
 Manifest metadata and Relay metadata do not grant access.
-Notary credentials do not decide benefits.
+Evidence assertions do not decide benefits.
 Audit events do not replace remedy, supervision, or public accountability.
 
 ## Next
 
 - [Architecture overview](../architecture/)
-- [Evidence issuance](../evidence-issuance/)
+- [Disclosure modes and computed answers](../disclosure-modes-and-computed-answers/)
 - [Boundaries and map](../../map/boundaries-and-map/)
 - [Standards register](../../reference/standards/)
diff --git a/docs/site/src/content/docs/explanation/evidence-issuance.mdx b/docs/site/src/content/docs/explanation/evidence-issuance.mdx
deleted file mode 100644
index e8641f571..000000000
--- a/docs/site/src/content/docs/explanation/evidence-issuance.mdx
+++ /dev/null
@@ -1,204 +0,0 @@
----
-title: Evidence issuance, end to end
-description: Explains how Registry Notary turns typed request inputs and a configured claim into a signed evaluation or SD-JWT VC credential, including direct, wallet, federated, and receipt-only paths.
-status: current
-owner: registry-notary
-source_repos:
-  - registry-notary
-  - registry-platform
-last_reviewed: "2026-07-07"
-doc_type: explanation
-locale: en
-standards_referenced:
-  - sd-jwt-vc
-  - cccev
-  - w3c-did
-  - json-ld
-  - openapi
-  - oid4vci
----
-
-This page describes how Registry Notary turns typed request inputs and a configured claim into a
-signed evaluation or verifiable credential. It is an explanation, not a how-to: there are no
-commands here.
-For commands, see the [Registry Notary documentation](../../products/registry-notary/) and the
-[Registry Stack project authoring guide](../../tutorials/author-registry-project/).
-
-## Why issue credentials at all
-
-Programs and services need to know whether a person qualifies for something. The classic way to
-answer that question is to demand records: birth certificates, land titles, tax statements. The
-records carry far more information than the answer requires, the records live in registries the
-program does not own, and the records cross trust boundaries every time a copy moves. A
-credential lets a registry answer one question (does this subject satisfy this rule) without
-shipping the records that justify the answer. Registry Notary is the component that produces
-those credentials.
-
-In the three-party credential model, Registry Notary is the issuer: it evaluates a configured
-registry-backed claim from compiler-pinned Relay outputs, verifies the exact stored Relay execution
-provenance and its per-claim execution binding, applies the disclosure policy,
-and signs an SD-JWT VC. The unkeyed binding detects partial stored-record
-mutation; store access controls remain the authenticity boundary. Permitted subject access
-without Relay remains evaluation-only.
-A wallet is the holder: it stores the credential, presents fields selectively, and proves key
-possession. A verifier is the relying party: it checks the issuer signature, reads the presented
-fields, and applies its own program policy. What Notary produces is evidence, a signed receipt
-that a claim was evaluated; the decision (whether the subject qualifies for a benefit) belongs
-to the program, not to Notary.
-
-{/* SVG diagram. Essential labels are restated in the paragraph above. */}
-<figure>
-  <img src="../../images/registry-notary-three-parties.svg"
-       alt="Registry Notary as issuer in the three-party credential model. Registry Notary
-            evaluates a Relay-backed claim, verifies its exact execution provenance, applies
-            disclosure policy, and signs an SD-JWT VC. A wallet, the holder, stores the credential, presents selectively,
-            and proves key possession. A verifier, the relying party, checks the issuer
-            signature, reads presented fields, and applies program policy. Notary produces
-            evidence, a signed receipt that a claim was evaluated; the program produces the
-            decision, whether the subject qualifies for a benefit." />
-</figure>
-
-## The claim model in one diagram
-
-A single claim evaluation moves through five stages.
-
-{/* SVG diagram. Essential labels and option lists are restated in the prose that follows. */}
-<figure>
-  <img src="../../images/registry-claim-model.svg"
-       alt="Claim model: five configured stages in order. (1) Typed request inputs from the
-            caller, authorized and optionally subject-bound by policy. (2) A compiler-pinned
-            Relay consultation. (3) Rule evaluation from typed Relay outputs. (4) Disclosure mode:
-            value, predicate, or redacted. (5) Evaluation render format: claim-result
-            JSON or CCCEV JSON-LD.
-            Eligible registry-backed stored evaluations with exact Relay execution provenance can
-            later be materialized as SD-JWT VC credentials." />
-</figure>
-
-Registry Stack project authoring makes each stage concrete. An evidence service declares typed
-request inputs, compiler-pinned consultations, claims over the closed consultation or
-subject access inputs, disclosure modes, and optional registry-backed credential profiles.
-Private Relay execution ids are retained only for selected roots that share one
-of those validated profiles. Product and source
-version labels record interoperability evidence. They do not select a Relay capability or script
-runtime.
-
-## Four ways to consume an evaluation
-
-There is one claim model and four transports a caller can use to land a credential, delegated
-evaluation, or receipt.
-
-{/* SVG diagram. Essential labels are restated in the numbered list that follows. */}
-<figure>
-  <img src="../../images/registry-evidence-transports.svg"
-       alt="Four transports for a claim evaluation, sharing one claim model. (1) Direct API:
-            a backend calls /v1/evaluations; pair with /v1/credentials to mint an SD-JWT
-            VC. (2) OID4VCI offer: a wallet caller discovers the issuer via /.well-known and
-            redeems an issuer-initiated pre-authorized offer, then presents a
-            transaction-bound holder proof at /oid4vci/credential. (3) Receipt only: a backend
-            calls /v1/evaluations and stores the audit-stamped result; no credential is
-            issued. (4) Federated: a peer Notary posts a signed JWT to
-            /federation/v1/evaluations and receives a signed JWT response." />
-</figure>
-
-1. Direct API. The caller calls `POST /v1/evaluations` to evaluate the claim, then
-   `POST /v1/credentials` to materialize an SD-JWT VC from the stored evaluation. The caller
-   is a backend (a program registry, a benefits portal) that holds a Registry Notary API key or
-   an OIDC token. The credential ends up wherever the calling backend chooses to send it.
-2. OID4VCI offer flow. The caller is a wallet, not a backend. Registry Notary publishes
-   `/.well-known/openid-credential-issuer` so the wallet learns the token and
-   credential endpoints and supported configurations. The citizen opens
-   `/oid4vci/offer/start` in a browser and authenticates at the configured
-   identity provider. Notary consumes that internal authorization code, derives
-   the subject binding, creates the registry transaction, executes the
-   compiler-pinned Relay consultation, and only then renders an
-   issuer-initiated pre-authorized offer. The wallet redeems that offer, receives
-   a transaction-bound proof nonce from the token response, signs an EdDSA proof
-   with its `did:jwk` key, and posts the Notary access token plus proof to
-   `POST /oid4vci/credential`. The wallet-facing grant is pre-authorized code
-   only. Delegated evaluations cannot enter the credential path unless the
-   configured representative ceremony applies. Transaction code is required by default; an explicit no-PIN wallet
-   profile has a maximum 300-second bearer-offer window.
-3. Verifiable receipt only. The caller does not need a credential at all. It calls
-   `POST /v1/evaluations`, accepts the disclosure mode the claim allows (often `predicate` or
-   `redacted`), and stores the audit-stamped result. Every evaluation, credential or not, is
-   recorded in the JSONL audit log alongside `verification_id` and `claim_hash` for redacted
-   results.
-4. Federated delegated evaluation. The caller is another configured Registry Notary. It posts a
-   compact signed JWT to `POST /federation/v1/evaluations`; the serving Notary verifies peer
-   policy, replay state, purpose, profile, and audience before claim evaluation, then returns a
-   compact signed JWT response. Federation profiles select an admitted
-   `registry_backed` claim and use the verified request `jti` for Relay audit
-   correlation. This path returns a scoped evaluation result, not a credential.
-
-## Selective disclosure properties
-
-Selective disclosure is the property that distinguishes an SD-JWT VC from a plain JWT.
-The credential format is the IETF SD-JWT VC draft's `application/dc+sd-jwt` media type, with
-`dc+sd-jwt` as the JWT `typ` header; the implementation tracks the draft family's current media
-type rather than pinning a numbered draft revision, and the
-[standards register](../../reference/standards/) records the claim as a profiled subset.
-Three mechanics make selective disclosure work.
-
-- Per-field disclosures. Registry Notary wraps each claim field in its own SD-JWT disclosure
-  blob. The signed credential body carries the SHA-256 digest of every disclosure, not the
-  disclosure value. The holder chooses which disclosures to present to which verifier; the
-  unselected fields stay hidden.
-- SHA-256 digests. The digest list is what the credential's signature covers. A verifier checks
-  the signature, recomputes the digest of every presented disclosure, and confirms each digest
-  appears in the signed list. There is no way for a holder to mint a disclosure that was not in
-  the original credential.
-- Holder binding via `did:jwk`. The credential's `cnf` claim names the holder's public key as a
-  `did:jwk`. To present the credential, the holder must produce a fresh signed proof from that
-  key, audience-bound to the verifier. A stolen credential without the matching private key is
-  not presentable. Holder binding is the default: a credential profile that omits `holder_binding`
-  binds with `did:jwk`, and issuing an unbound, bearer-style credential requires an explicit
-  `holder_binding.mode: none`. This has been the default since v0.8.4, and `registry-notary doctor`
-  warns on a profile that opts out (`notary.credential_profile.unbound_holder_binding`).
-- Live status outside selective disclosure. When a credential contains a
-  `status.status_list` claim, that top-level claim is always visible. A verifier
-  retrieves the signed status token only from its exact configured HTTPS trusted
-  origin and fails closed when status is unavailable, invalid, suspended,
-  revoked, or expired.
-
-Evidence: the [v0.8.4 Notary changelog](https://github.com/registrystack/registry-stack/blob/v0.8.4/products/notary/CHANGELOG.md#084---2026-07-04) records the default, and the [configuration loader](https://github.com/registrystack/registry-stack/blob/v0.8.4/crates/registry-notary-core/src/config.rs) applies it.
-
-The [doctor diagnostic](https://github.com/registrystack/registry-stack/blob/v0.8.4/crates/registry-notary/src/main.rs) is covered by the [doctor CLI test](https://github.com/registrystack/registry-stack/blob/v0.8.4/crates/registry-notary/tests/doctor_cli.rs).
-
-## Where this fits with Relay
-
-Registry Notary is an independently deployable HTTP service. A Notary
-deployment may start without claims. Every configured claim requires Registry
-Relay, and a combined deployment calls Relay through the compiler-pinned
-consultation contract.
-
-Registry Relay surfaces evidence-offering metadata under `/metadata/evidence-offerings/{id}`.
-The metadata document points at a Registry Notary instance, names the claim ids the offering
-covers, and describes the supported disclosure modes and formats. A consumer that finds an
-offering on Relay learns where to call Notary. Relay owns registry source access and typed
-consultation outputs; Notary owns claim semantics, disclosure, and credential issuance.
-
-For delegated evaluation, Registry Manifest can also publish `federation` and
-`evaluation_profiles` metadata. That metadata helps a partner configure a static peer relationship.
-Runtime access still comes from the serving Notary `federation.peers` policy, signed request
-verification, and replay checks.
-
-## Boundaries
-
-A few things Registry Notary is not.
-
-- Not an eligibility decision. The verification receipt is an evidence artifact. The issuing
-  program, not Registry Notary, converts a verified claim into an entitlement, a payment, or a
-  benefit.
-- Not a wallet. Registry Notary issues credentials. The wallet that stores, presents, and
-  unlocks them is a separate component, owned by the holder.
-- Not a credential authority. The DID, the verification key, the credential profile config, and
-  the relationship to the relying party belong to the deployment, not to Registry Notary as a
-  product. Registry Notary ships an engine and a wire shape; the trust comes from the
-  deployment.
-- Not open federation. The MVP accepts only statically configured peers and delegated evaluation.
-  Federated credential issuance and dynamic trust-chain discovery are not implemented.
-
-## Next
-
-- [Registry Notary overview](../../products/registry-notary/)
-- [Glossary](../../reference/glossary/)
diff --git a/docs/site/src/content/docs/explanation/integration-patterns.mdx b/docs/site/src/content/docs/explanation/integration-patterns.mdx
index 22aa1c826..36b706be3 100644
--- a/docs/site/src/content/docs/explanation/integration-patterns.mdx
+++ b/docs/site/src/content/docs/explanation/integration-patterns.mdx
@@ -1,14 +1,15 @@
 ---
 title: Integration patterns
-description: How Registry Stack wires in behind exchange layers, workflow engines, wallets, and domain registry platforms, and the standards each surface speaks.
+description: How Registry Stack wires in behind exchange layers, workflow engines, and domain registry platforms, and the standards each surface speaks.
 status: current
 owner: registry-docs
 source_repos:
   - registry-stack
   - registry-manifest
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-06-20"
+  - registry-evidence
+  - registry-mint
+last_reviewed: "2026-08-03"
 doc_type: explanation
 locale: en
 standards_referenced:
@@ -21,8 +22,6 @@ standards_referenced:
   - odrl
   - openapi
   - sd-jwt-vc
-  - oid4vci
-  - w3c-did
   - sp-dci
   - ogc-api-records
   - ogc-api-features
@@ -36,6 +35,13 @@ Registry Stack adds, and the conditions under which a Registry Stack surface bel
 For how the registry family relates to the wider ecosystem, see the
 [ecosystem page](https://registrystack.org/ecosystem/).
 
+Two runtime surfaces can appear in an integration path. Registry Relay publishes protected, scoped,
+read-only APIs over sources an institution already holds. Evidence answers one predefined
+requirement about one set of subjects with a signed assertion carrying the answer rather than the
+record. Registry Mint is a supporting service that issues the short-lived access tokens either
+surface verifies when a deployment has no identity provider.
+The patterns below describe Relay and Evidence.
+
 ## Country evidence mesh
 
 At country scale, the same pattern can sit next to several domain platforms.
@@ -43,65 +49,68 @@ Clinical health systems can expose bounded outputs through a reviewed FHIR integ
 public-health program systems such as DHIS2 can use Relay's product-neutral, reviewed Rhai script
 capability, and social protection, agriculture, education, and civil registration systems can keep
 their own authoritative stores.
-A Registry Stack project can deploy Relay only, Notary without configured
-claims, or both products. Relay-only projects expose governed source
-capabilities. In a combined project, Relay keeps source credentials and returns only
-reviewed typed consultation outputs for Notary to turn into configured claims. Consuming systems
-such as a social-protection management information system do not become raw-record readers.
-
-The supported local first run starts from the public HTTP template.
-The project declares the public Relay, consultation Relay, and Notary path
-before Registryctl creates a disposable development environment.
-Snapshot remains an authored integration capability, not a public template or
-separate runtime architecture.
+Each authority keeps custody of its own data. Relay keeps source credentials and returns only
+reviewed typed outputs, and Evidence returns only the values a reviewed requirement declares.
+Consuming systems such as a social-protection management information system do not become
+raw-record readers.
 
-{/* Evidence: crates/registryctl/tests/project_authoring.rs,
-    project_authoring_schemas_reject_incoherent_product_topologies and
-    relay_only_and_notary_only_projects_emit_only_selected_products; and
-    crates/registryctl/tests/dev_runtime_core.rs. */}
-
-{/* SVG diagram. Essential labels are restated in the paragraph before the figure. */}
 <figure>
   <img src="../../images/registry-country-evidence-mesh.svg"
-       alt="Country evidence mesh: civil registration, clinical health over FHIR API,
-            public health through DHIS2 via a reviewed Rhai script, social protection, agriculture,
-            and education systems keep their source data. Registry Stack projects can deploy Relay
-            only, an empty Notary control plane, or both. Relay returns governed typed outputs,
-            combined projects turn consultation outputs into minimized claims and credentials, and the social protection MIS
-            owns the eligibility decision and reads the registry it owns directly." />
+       alt="Country evidence mesh: authorities each keep custody of their own data and expose
+            bounded outputs. Clinical health uses a reviewed FHIR integration, public health
+            (DHIS2) uses a reviewed Rhai script, and civil registration, social protection,
+            agriculture, and education keep their own authoritative stores. Two bounded surfaces
+            sit over them: Registry Relay keeps source credentials and returns only reviewed typed
+            outputs, and Evidence returns only the values a reviewed requirement declares. A
+            social-protection management information system and other consumers receive the
+            answers these surfaces return, and do not become raw-record readers." />
 </figure>
 
+Snapshot remains an authored integration capability, not a public template or
+separate runtime architecture.
+
+{/* TODO[evidence]: registryctl cannot express an Evidence deployment at all, so this page cannot
+    yet describe a selectable topology. An authored service is only consultation_api or records_api
+    (enum ServiceKind in crates/registryctl/src/project_authoring/model.rs), a kind: evidence
+    service is rejected as an unknown variant (test retired_evidence_service_kind_is_rejected in
+    the same file), and the environment deployment block is closed around profile and relay with no
+    evidence key (crates/registryctl/schemas/project-authoring/environment.schema.json). Every
+    compiled project is therefore relay-only. Restore a topology paragraph here once registryctl
+    gains an Evidence deployment path. */}
+
 ## Evidence-to-action boundary
 
 Every combined integration follows the same ownership boundary. Registry Relay owns
-source-specific acquisition, source-access policy, and typed normalization. Registry Notary owns
-atomic evidence claims plus evidence authorization and disclosure policy. The evidence consumer
-determines how the evidence is used, and the decision owner remains accountable for requirements,
-decisions, workflow, and action.
+source-specific acquisition, source-access policy, and typed normalization. Evidence owns the
+predefined requirement, evidence authorization, and the declared disclosure that requirement
+carries. The evidence consumer determines how the evidence is used, and the decision owner remains
+accountable for requirements, decisions, workflow, and action.
 
-The maintained DHIS2 health-evidence conformance workspace makes that boundary
-visible.
+The maintained DHIS2 health-evidence reference project makes that boundary visible.
 DHIS2 remains the system of record.
 Relay uses its product-neutral script capability to perform bounded, same-origin acquisition and
-normalize the existing health outputs plus `bcg_birth_dose_recorded`,
-`opv_birth_dose_recorded`, and `measles_dose_recorded`. Notary exposes those facts as reusable
-evidence claims. In this example, a public-health programme is both the evidence consumer and the
-decision owner. It can compute `outreach-required` or `follow-up-priority` without moving either
-decision into Relay or Notary.
-
-The reviewed contract keeps `true`, `false`, `null`, no-match, ambiguity, and source failure
-distinct. Missing evidence is not a negative fact. Offline synthetic fixtures are the deterministic
-acceptance path.
+normalize the existing health outputs.
+Evidence exposes bounded facts as reusable requirements: that project reads two Tracker programmes
+for two independent requirements, adult status and professional licence status, and a caller
+authorized for one learns nothing about the other.
+In this example, a public-health programme is both the evidence consumer and the decision owner.
+It can compute an outreach or follow-up priority without moving either decision into Relay or
+Evidence.
+
+The reviewed contract keeps a positive fact, its negative, an absent value, no match, ambiguity,
+and source failure distinct. Missing evidence is not a negative fact. Offline synthetic fixtures
+are the deterministic acceptance path.
 Registryctl does not provide a live-test mode or external deployed-system
 compatibility runner.
 An operator can exercise a deployed API with a standard HTTP client and
 owner-maintained credentials as separate interoperability evidence.
 
-Registry Notary may attest a decision that DHIS2 or another authoritative source already made only
-when the claim identifier and its review documentation identify it as a source-owned decision.
-This exception does not make Notary a general-purpose eligibility or workflow engine.
+Evidence has no general policy engine and no eligibility or workflow engine. A requirement whose
+answer restates a decision an authoritative source already made must say so in its review
+documentation, and Evidence does not recompute that decision.
 
-{/* Evidence: crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/. */}
+{/* Evidence: products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/
+    and products/evidence/contracts/README.md. */}
 
 ## Domain registry platforms
 
@@ -112,7 +121,7 @@ management information), [OpenIMIS](https://openimis.org/) (health insurance inf
 These platforms own storage, business rules, correction workflows, user interfaces, and a runtime
 API for their domain.
 Registry Stack adds standardized metadata description, scoped read-only routes over source data,
-configured evidence responses, and hash-chained audit records.
+minimum-disclosure evidence responses, and audit records.
 The [connect your data guide](../../configure/) starts from the supported public sample and points
 to the configuration reference for advanced source patterns.
 
@@ -121,7 +130,7 @@ creating two source definitions.
 A local materialization can back Relay's records API, including configured filters, projection,
 cursor pagination, relationships, aggregates, and enabled standards adapters.
 `snapshot` consultations can use that same immutable published materialization for exact
-evidence lookup.
+lookup.
 The logical entity definition stays in the project workspace; provider paths, worksheets, tables,
 and physical columns stay in the private environment binding.
 
@@ -132,11 +141,11 @@ and physical columns stay in the private environment binding.
 Wire Registry Stack in alongside a domain platform when:
 
 - The platform does not yet publish standards-shaped catalog, service, schema, policy, or evidence-offering metadata.
-- Callers need evidence-shaped responses (predicate, redacted, selected value) rather than full
+- Callers need an answer in a declared form (a boolean, a reviewed code, a bucket) rather than full
   records.
 - A read path is needed for callers that must not be granted direct database access.
 
-## Exact subjects and batch envelopes
+## Exact subjects, one question at a time
 
 A Relay consultation selects one subject with one to eight required typed selector components.
 The components form one fixed exact conjunction, not a general search or a subject batch.
@@ -144,24 +153,19 @@ Each component is bounded and canonicalized under the compiled consultation cont
 Up to sixteen total inputs may also include bounded parameters that are not selector components.
 Relay reports no match, one match, or ambiguity instead of choosing between duplicate records.
 
-Registry Notary keeps batch evaluation as a separate outer API.
-For registry-backed claims, a batch requires an `Idempotency-Key`, validates the complete batch
-before the first Relay call, and fans items out as independently authorized single-subject
-consultations under bounded concurrency.
-Claims within one item may reuse an identical consultation result, but duplicate subjects in
-different item positions remain separate children with separate identities.
-Replay of the same caller-scoped outer request returns the stored result without repeating a
-completed child consultation.
-
-This split preserves ordered batch results without granting Relay a multi-subject request or an
-upstream bulk operation.
+Evidence keeps the same discipline and adds no batch envelope over it.
+One request names one requirement and carries one selector per declared subject role, at most eight
+roles, and an evaluation performs exactly one evidence-data request against its one fixed source.
+Version 1 has no batch API and no multi-source fulfillment, so a caller that needs several answers
+issues several independently authorized requests.
+A lookup resolves to exactly one match, no match, or ambiguity, and Evidence never surfaces or
+chooses between candidates.
 
 {/* Evidence: crates/registry-relay/src/api/consultation.rs,
-    execute_body_requires_the_exact_active_contract_hash; and
-    crates/registry-notary-server/src/runtime/tests/evaluation.rs,
-    registry_batch_requires_outer_key_before_relay_or_source_work,
-    registry_batch_preflights_every_item_before_first_relay_call, and
-    registry_batch_coalesces_within_items_never_across_duplicates_and_replays_outer_key. */}
+    execute_body_requires_the_exact_active_contract_hash;
+    products/evidence/contracts/request.schema.yaml,
+    products/evidence/contracts/source-contract.yaml, and
+    products/evidence/contracts/README.md. */}
 
 ## Closed source adaptation
 
@@ -202,6 +206,38 @@ URL outside Registry Stack's control.
     crates/registry-relay/src/consultation/executor.rs, and
     crates/registry-relay/src/consultation/response.rs. */}
 
+## Evidence over a Relay-protected API
+
+This is the composed pattern, and it is the one to reach for when an institution wants both a
+governed read path and a minimum-disclosure answer over the same data.
+
+Evidence treats a Relay-protected API as an ordinary fixed HTTP source. Nothing in an Evidence
+bundle names Relay or depends on it: the requirement is authored against a protected, scoped,
+read-only HTTP JSON endpoint, and any protected read with those three properties fits. The
+reference deployment project for this shape answers one requirement, residence region as a coarse
+controlled code, over exactly that kind of source. The register's own region code never leaves the
+service, because a reviewed codelist maps several register codes onto each disclosed region, and a
+register code with no reviewed mapping leaves the requirement unresolved rather than guessing.
+
+Two token hops make the arrangement work, and they are separate:
+
+- The caller holds a short-lived access token for Evidence, from the deployment's identity provider
+  or from Registry Mint when there is none. See the
+  [Registry Mint reference](../../reference/mint/).
+- Evidence holds its own compiled source credential for the Relay API. The caller never sees it,
+  and cannot influence which credential is resolved.
+
+The dependency runs one way. Evidence verifies tokens a Mint-shaped issuer produces; it does not
+depend on Registry Mint, and a deployment with its own identity provider omits Mint entirely.
+
+[First run with Solmara Lab](../../tutorials/first-run-with-solmara-lab/) runs the whole
+arrangement on a laptop, with Mint, Relay, and Evidence on separate ports, if you would rather see
+it than read about it.
+
+{/* Evidence:
+    products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/
+    and products/evidence/contracts/source-contract.yaml. */}
+
 ## Workflow engines
 
 Examples: [Camunda](https://camunda.com/), [Flowable](https://www.flowable.com/), and other
@@ -214,9 +250,10 @@ source tables, raw SQL, or full records.
 
 Wire Registry Stack in alongside a workflow engine when:
 
-- A workflow step needs an authoritative evidence fact (status, predicate, selected value) as an
+- A workflow step needs an authoritative fact (a status, a boolean, a reviewed code) as an
   input to the workflow engine's own decision.
-- A workflow step needs an evidence artifact or credential rather than an internal service result.
+- A workflow step needs a signed, independently verifiable assertion rather than an internal
+  service result.
 - Generated workflow connectors must not depend on source schema details.
 
 ## Exchange layers
@@ -237,21 +274,7 @@ Wire Registry Stack in behind an exchange layer when:
 
 - The exchange layer handles network trust but the registry endpoint still needs route-level
   scopes, field projection, and source-specific access controls.
-- An exchange-forwarded request needs a configured evidence response rather than a copied record.
-
-## Wallets
-
-Examples: SD-JWT VC wallets, OID4VCI-compatible wallets.
-
-Wallets own key management, credential storage, holder consent, and presentation to relying
-parties.
-Registry Stack adds the server-side issuance path: claim evaluation against registry data, plus
-the metadata describing what a registry-backed issuer offers.
-
-Wire Registry Stack in alongside a wallet when:
-
-- A registry-backed issuer needs to produce SD-JWT VC credentials or an OID4VCI issuance flow.
-- An evidence offering needs to be discoverable before integration begins.
+- An exchange-forwarded request needs a minimized evidence response rather than a copied record.
 
 ## Public-service platforms
 
@@ -277,7 +300,16 @@ authoritative list of claim levels and per-project evidence.
 | --- | --- |
 | Static catalog and service discovery (Registry Manifest) | DCAT, BRegDCAT-AP, CPSV-AP, OGC API Records, SHACL, JSON Schema, ODRL, SKOS-shaped codelists |
 | Scoped runtime metadata and protected data routes (Registry Relay) | OpenAPI, DCAT, BRegDCAT-AP, SHACL, JSON Schema, ODRL, OGC API Records, OGC API Features, OGC API EDR, SP-DCI, GovStack Digital Registries |
-| Evidence and credentials (Registry Notary) | OpenAPI, CCCEV, SD-JWT VC, OID4VCI, W3C DID |
+| Minimum-disclosure assertions (Evidence) | OpenAPI, CCCEV, SD-JWT VC, JSON Schema |
+
+{/* TODO[evidence]: the standards register in src/data/standards.yaml has no registry-evidence
+    entries, so the Evidence row above is not backed by a per-project claim level there. This is
+    blocked, not merely pending: every evidence_docs URL in that file is pinned to commit
+    d45761a0, which is reachable from origin/main, and neither crates/registry-evidence nor
+    crates/registry-mint exists at any commit on pushed main (git cat-file -e
+    origin/main:crates/registry-evidence fails). Repo policy forbids citing an unpushed session
+    commit in a durable artifact, so the Evidence entries can only be pinned once this work
+    reaches main. */}
 
 ## Next
 
diff --git a/docs/site/src/content/docs/explanation/known-limitations.mdx b/docs/site/src/content/docs/explanation/known-limitations.mdx
index 40ceedde8..6a636529c 100644
--- a/docs/site/src/content/docs/explanation/known-limitations.mdx
+++ b/docs/site/src/content/docs/explanation/known-limitations.mdx
@@ -5,15 +5,15 @@ status: draft
 owner: registry-docs
 source_repos:
   - registry-stack
+  - registry-evidence
+  - registry-mint
   - solmara-lab
-last_reviewed: "2026-06-28"
+last_reviewed: "2026-08-03"
 doc_type: explanation
 locale: en
 standards_referenced:
   - sd-jwt-vc
-  - oid4vci
   - cccev
-  - verifiable-credentials
   - odrl
 ---
 
@@ -55,28 +55,113 @@ It is not a production support commitment and carries no hosted service-level ag
 Two things follow.
 First, the behaviors and boundaries here may change as the specifications move toward `current`.
 Second, aligning with an external standard is not the same as conforming to it: speaking the shape
-of OIDC, OAuth 2.0, SD-JWT VC, OID4VCI, CCCEV, or the rest does not certify conformance to any of
-them.
+of OIDC, OAuth 2.0, SD-JWT VC, CCCEV, or the rest does not certify conformance to any of them.
 The [standards register](../../reference/standards/) records how each one is actually adopted.
 
+## Evidence limits
+
+Evidence releases one stateless assertion per request under a frozen Version 1 contract.
+Read the full context in the [Evidence protocol](../../spec/rs-pr-evidence/) and the
+[Evidence security model](../../security/evidence/).
+
+- A serialization, not a credential lifecycle: enabling the SD-JWT VC response format adds an
+  encoding of the same assertion. There is no issuance session, holder binding ceremony, status
+  list, revocation, or presentation verification, and `/.well-known/jwt-vc-issuer` publishes no
+  per-requester or per-requirement information. A released assertion stays verifiable until its
+  declared validity expires; nothing recalls it.
+- The holder key is unverified: a request may carry an optional `holderKey` that is echoed into the
+  `cnf` member. Evidence issues no holder key, binds none, and verifies none, so `cnf` is a
+  caller-supplied convenience for whatever presentation layer the operator runs elsewhere.
+- Assertions are audience-scoped, not multi-verifier: the subject identifier is an audience-scoped
+  pseudonym, so the same person requested for a different audience yields a different identifier.
+  Purpose is an input to every subject binding and audit pseudonym as well, so one subject is not
+  linkable across purposes. This is deliberate, and it means an Evidence assertion is not a
+  general-purpose credential a holder presents to several verifiers.
+- The request nonce is not replay protection: every request carries one canonical 32-byte random
+  nonce that is echoed into the payload and never stored, uniqueness-checked, or exposed to
+  authorization, rate limits, scripts, source requests, logs, metrics, traces, or audit. It is
+  uninterpreted correlation data, never a subject binding, identifier, or freshness proof. It
+  becomes a freshness check only for a verifier that independently retained the value it sent.
+- Unsigned output is not evidence: the unsigned JSON format is releasable only where the immutable
+  bundle and the one matched grant both name it. The envelope is self-identifying with a fixed
+  schema, type, integrity marker, warning, and exact vendor media type, carries no JWS member, and
+  the strict verifier rejects it. Treat it as transport-authenticated convenience, never as
+  something a third party can verify later.
+- CCCEV is an alignment, not conformance: the payload field names map to CCCEV 2.2.0 as a frozen
+  semantic reference with Evidence-specific extensions. No JSON-LD envelope is emitted and no
+  conformance to CCCEV is claimed.
+- Disclosure families are an attestation, not a classifier: the runtime rejects two simultaneously
+  enabled requirements that declare the same `disclosureGuard` family, but a declared family is a
+  reviewed operator assertion. Nothing detects that two differently labelled families are
+  semantically equivalent, so the combined-bundle disclosure review stays an operator duty.
+- No cumulative disclosure budget: Evidence has no application database and persists no selector,
+  source, evidence, or response data, so nothing tracks cumulative disclosure across repeated or
+  overlapping requests. Native rate controls are uniform per principal, tracked per process in
+  in-process memory, bounded at 100,000 tracked keys, multiplied by replica count, and reset to
+  full by a restart. Per-client quotas are a gateway responsibility.
+- One trust domain per process: the authentication profile admits exactly one token issuer and one
+  set of claim names. Mutually distrustful issuers or customers, or one issuer whose clients carry
+  the same authority under different claim names, require a second deployment with its own bundle,
+  signer, and audit boundary.
+- Bearer tokens only: a token carrying a proof-of-possession confirmation claim is denied rather
+  than accepted as an ordinary bearer, because Evidence validates no sender proof. An authorization
+  server that binds tokens to DPoP keys or client certificates must issue Evidence clients unbound
+  tokens.
+- No hot reload, no admin surface, Unix targets only: there is no runtime upload, editor, approval
+  API, hot reload, merge, mutation, governed-field override, or fallback path. Any change is a new
+  reviewed revision and a restart. Version 1 supports Unix targets.
+- Startup does not detect overlapping authority: exactly one authority path may match a request,
+  and zero paths and two or more paths both deny. Startup validation does not detect two paths
+  covering the same requirement, purpose, and subject tuple, so that misconfiguration surfaces at
+  request time as a refusal rather than at deployment time.
+- Readiness does not prove a source returns data: neither startup nor readiness sends an
+  evidence-data request or probes a source data endpoint. A ready service is one whose credentials,
+  trust bindings, signing provider, and audit sink resolved, not one whose sources are answering.
+- One secret provider: the reference file provider is the only one. There is no hardware
+  security module or PKCS#11 option, so signing-key custody is a property of the host, its disk,
+  its backups, and its operators.
+
+## Registry Mint limits
+
+Registry Mint issues the short-lived access tokens a resource server such as Evidence verifies,
+for deployments with no identity provider. A deployment that already has an identity provider does
+not run it. Read the full surface in the [Registry Mint reference](../../reference/mint/).
+
+- Machine clients only: the token endpoint supports the `client_credentials` grant with
+  `private_key_jwt` client authentication and nothing else. There is no authorization-code flow, no
+  user-facing login, no refresh token, and no consent surface.
+- No revocation and no introspection: the service exposes authorization-server metadata, a token
+  endpoint, a JWKS endpoint, and health and readiness probes. A minted token is accepted by its
+  audience until it expires, so token lifetime inside the `60..=3600` second bound is the only
+  containment lever.
+- Authority is registry-owned: the authority a token asserts is written from the client's registry
+  entry, never from the request, and a client registration whose subject claim path would overwrite
+  an authority claim refuses to load.
+- Client-authentication failures are opaque by design: they collapse to one `401 invalid_client`
+  response, so the endpoint is not an oracle for which part of the assertion failed.
+- The client registry is a watched directory: entries are reloaded on `SIGHUP` without a restart,
+  so any file written into that directory registers a client and the authority Registry Mint will
+  assert for it. Treat the directory as key material.
+- Transport is the operator's: Registry Mint serves plain HTTP and expects TLS termination it does
+  not manage.
+
 ## Stack-wide boundaries at a glance
 
-These boundaries cut across components. Read them first.
+These boundaries cut across components.
 
 - No source mutation, no event stream: Registry Relay does not write back to or otherwise mutate
-  source registry data, and it has no event-stream backend. Registry-backed Notary claims consume
-  Relay consultations; Registry Notary does not connect to registry sources directly.
+  source registry data, and it has no event-stream backend. Evidence reads its fixed sources
+  read-only as well, and persists nothing it read.
 - Aggregate routes are not a privacy budget: Relay aggregate routes return the configured
   statistical observations, but provide no built-in longitudinal privacy budget and do not track
   cumulative disclosure across repeated or overlapping queries.
   Do not describe an aggregate route as privacy-budgeted unless a separate deployed control
   provides that protection.
-- A published manifest grants nothing: Publishing a dataset, policy, evidence offering, or
-  federation relationship in a discovery artifact grants no access, enforces nothing, and asserts
-  no fact about a live record.
-  Federation discovery metadata is not a trust anchor: a published manifest does not bind a
-  consumer to trust a JWKS endpoint, federation API host, or peer identity.
-  Trust bootstrap stays in the consumer's local policy and Notary peer configuration.
+- A published manifest grants nothing: Publishing a dataset, policy, or evidence offering in a
+  discovery artifact grants no access, enforces nothing, and asserts no fact about a live record.
+  Discovery metadata is not a trust anchor: a published manifest does not bind a consumer to trust
+  a JWKS endpoint or a service host.
+  Trust bootstrap stays in the consumer's local policy.
 - Solmara Lab and its hosted instance are demonstrations, not infrastructure: Solmara Lab is a
   separately maintained adopter demo that uses generated synthetic data and demo configuration.
   It is not a formal Registry Stack product and provides no production deployment guidance.
@@ -85,78 +170,6 @@ These boundaries cut across components. Read them first.
 
 For the rationale behind each of these, follow the linked specifications in each section.
 
-## Credential issuance and lifecycle limits (Notary)
-
-Registry Notary issues credentials, but the issuance surface is deliberately narrow.
-Read the full context in the [Registry Notary protocol](../../spec/rs-pr-notary/).
-
-- One credential format, one OID4VCI holder profile: Issued Registry Notary credentials are
-  [SD-JWT VC](../../reference/standards/) only. Issuer signing supports EdDSA and ES256.
-  Holder binding is a per-credential-profile setting that defaults to `mode: did` with `did:jwk`
-  as the supported holder DID method.
-  Direct issuance requires a holder DID by default; it verifies a fresh holder proof only when
-  `proof_of_possession: required` is configured.
-  An operator can explicitly set `holder_binding.mode: none` for a bearer-style credential
-  profile, in which case `registry-notary doctor` reports a warning and the issued credential is
-  unbound.
-  The OID4VCI path requires EdDSA `did:jwk` binding. ES256 holder proof is not supported.
-- A profiled issuance subset, not a full issuer: The [OID4VCI](../../reference/standards/) surface
-  is a registry-backed issuer-initiated pre-authorized profile using the
-  `dc+sd-jwt` format, not a full OID4VCI issuer and not a claim of general
-  external-wallet interoperability. The identity provider's authorization code
-  is internal to Notary. There is no wallet-facing authorization-code grant,
-  public nonce endpoint, response next nonce, EUDI, HAIP, PAR, DPoP, or wallet
-  attestation profile.
-  The capability-discovery document (`/.well-known/evidence-service`) declares
-  `openid4vci.support: not_full_issuer` (announcing it is not a full issuer); this flag lives
-  there rather than in the OID4VCI credential-issuer metadata.
-- Delegated subject access is evaluation-only unless the credential
-  configuration explicitly selects the representative ceremony. Direct
-  `/v1/credentials` and other OID4VCI configurations reject delegated
-  evaluations.
-  Configuration load rejects delegated relationship `credential_profiles` and credential-profile
-  bindings on delegated claims. Remove that capability to keep delegated evaluation, or issue a
-  separately modeled registry-backed, non-delegated claim.
-- No revocation flow, no issuer-metadata discovery endpoint, no erasure workflow: The RS-* specs
-  define no revocation flow.
-  The credential-status surface is optional and off by default; when an operator enables it, the
-  public status endpoint reads a credential's status, and only the admin status endpoint (which
-  requires the `registry_notary:admin` scope) can mark a credential `revoked`.
-  There is no `/.well-known/jwt-vc-issuer` endpoint and no built-in data-subject erasure workflow.
-  A rotated-out signing key may remain published for verification, which is not revocation.
-  These are documented pilot limitations, recorded in `SECURITY.md`.
-- Status-bearing credentials fail closed: The top-level status claim is never
-  selectively disclosable. A client accepts a status-bearing credential only
-  after validating the signed status response from its exact configured HTTPS
-  trusted origin. Missing, invalid, unavailable, suspended, revoked, or expired
-  status denies the credential.
-- CCCEV output is a profiled shape, not conformant: [CCCEV](../../reference/standards/)-shaped
-  output is a profiled subset and is not conformant to CCCEV 2.00.
-  It is consumed by parsing the `@graph` for `cccev:Evidence` nodes.
-- Notary owns credential issuance: Notary issues SD-JWT VC credentials (`dc+sd-jwt`, signed with
-  EdDSA/Ed25519 by default; ES256/P-256 is also supported per credential profile; with no W3C
-  [Verifiable Credentials Data Model](../../reference/standards/) JSON-LD envelope).
-  Relay no longer issues signed response credentials or hosts issuer DID documents.
-- Standalone admin reload is not implemented: The standalone Notary `/admin/v1/reload` route
-  returns HTTP 501 with code `registry.admin.capability.not_supported` and performs no reload, and
-  non-swappable changes require a service restart.
-  Signed config bundles are verified from a local bundle directory and activated by placing the
-  bundle on the node and restarting; there is no admin config apply route and no hot apply.
-
-## Federation limits
-
-Federation across institutions is static-peer only.
-Read the full context in the [Registry Notary protocol](../../spec/rs-pr-notary/) and the
-[security model](../../spec/rs-sec-g/).
-
-- Static peers only: Federation uses the global typed Notary correctness-state backend for request
-  replay and `jti` checks. Production and multi-instance deployments require the Notary-owned
-  PostgreSQL schema. Explicit in-memory state is limited to local, single-instance development.
-  There is still no dynamic trust-chain discovery and no federated credential issuance; both are
-  out of scope for this version.
-- Delegated evaluation returns a result, never a credential: Across a federation boundary, what
-  crosses is a scoped evaluation result, never an issued credential.
-
 ## Registry Relay limits
 
 Registry Relay exposes protected, read-only registry routes.
@@ -170,34 +183,22 @@ Its boundaries are covered in depth in the [Registry Relay protocol](../../spec/
   Do not infer their presence in one build from another build's route catalog.
 - Aggregates are not privacy-budgeted: As noted stack-wide, Relay aggregate routes provide no
   longitudinal privacy-budget or cumulative-differencing protection.
-- Relay does not evaluate or own the manifest: Relay does not evaluate claims or issue Notary's
-  SD-JWT VC credentials (that is Notary's role), and it does not issue response credentials of its
-  own.
-  Relay also does not own or version the metadata manifest format, which belongs to Registry
-  Manifest.
+- Relay does not evaluate or own the manifest: Relay evaluates no claims and issues no credentials
+  of its own, and it does not own or version the metadata manifest format, which belongs to
+  Registry Manifest.
   Relay only serves and scopes compiled artifacts.
 - Governed enforcement is one PDP profile, not full interoperability: Governed runtime policy
-  enforcement covers only the supported Evidence Gateway PDP profile
+  enforcement covers only the supported PDP profile
   (`registry-evidence-gateway-pdp/v1`, the single PDP profile this build recognizes).
-  It is not full Evidence Gateway interoperability, not full OID4VCI issuer behavior, not dynamic
-  external policy discovery, and not enforcement of [ODRL](../../reference/standards/) terms
-  outside the supported set.
-
-## Data-model limits (Claim and Manifest)
-
-These limits concern what the claim and manifest configuration loaders do and do not enforce.
-Read them in full in the [Claim data model](../../spec/rs-dm-claim/) and [Manifest data
-model](../../spec/rs-dm-manifest/).
-
-- The `plugin` rule type is unavailable: The enum remains declared, but configuration validation
-  rejects it. A conforming claim uses
-  `consultation_output`, `consultation_matched`, or `cel` under the constraints of its evidence
-  mode.
-- Claim evaluation formats are closed: A claim must include the canonical
-  `application/vnd.registry-notary.claim-result+json` response format and may additionally use
-  `application/ld+json; profile="cccev"`. An empty list, SD-JWT VC, and unknown formats are
-  rejected during configuration load. SD-JWT VC remains a credential-profile issuance format.
-- Manifests describe; they do not enforce: The portable metadata layer only describes: publishing in a discovery artifact grants no access and asserts no fact about a live record. Trust bootstrap stays in the consumer's local policy and Notary peer configuration.
+  It is not dynamic external policy discovery, and not enforcement of
+  [ODRL](../../reference/standards/) terms outside the supported set.
+
+## Data-model limits (Manifest)
+
+These limits concern what the manifest configuration loader does and does not enforce.
+Read them in full in the [Manifest data model](../../spec/rs-dm-manifest/).
+
+- Manifests describe; they do not enforce: The portable metadata layer only describes: publishing in a discovery artifact grants no access and asserts no fact about a live record. Trust bootstrap stays in the consumer's local policy.
 - Rendered standards artifacts are well-formed, not certified: Manifest rendering emits standards-shaped artifacts but does not validate them against external standard bodies: a rendered CPSV-AP, DCAT, or SHACL document is well-formed by construction, not certified against the standard.
 - Vocabulary influence is not vocabulary emission: PROV-O is a design influence only: provenance-shaped concepts appear in audit fields and the claim provenance struct, but no PROV-O vocabulary terms are emitted as JSON-LD. No standalone SKOS artifact is published yet (only embedded SKOS-shaped nodes), and CPSV-AP has no Relay runtime metadata route.
 
@@ -215,10 +216,9 @@ Read the full security boundary in the [security model](../../spec/rs-sec-g/).
   rotation schedule, audit retention and storage, tenant isolation, transport termination, edge
   rate limiting, deployment configuration, and incident response are operator responsibilities,
   not behaviors the stack guarantees.
-- Audit fail-closed is a capability, not a guarantee about every build: A deployment can run audit
-  fail-closed, so that a request whose audit record cannot be written does not return success.
-  That is a switch a deployment is able to turn on, not a promise that every route in a given
-  build has been individually audited, nor that every build ships with it on.
+- Audit retention is not audit completeness: a keyed hash chain detects reordering and corruption
+  inside the records a deployment still holds. It does not prove that every record ever written is
+  still present, and nothing in either service deletes, compacts, or ships sealed history for you.
 - Demo and template code is not a production profile: Demo helper code and generated workflow
   snippets are integration examples, not a production freshness or replay-protection profile, and
   must not be relied on for freshness, expiry, or replay protection.
@@ -241,9 +241,8 @@ in the repository.
 ## Where to go next
 
 - Why a given limit exists: the rationale and trade-offs live in each specification's own
-  limitations section: [RS-PR-NOTARY](../../spec/rs-pr-notary/),
-  [RS-PR-RELAY](../../spec/rs-pr-relay/), [RS-DM-CLAIM](../../spec/rs-dm-claim/), and
-  [RS-DM-MANIFEST](../../spec/rs-dm-manifest/).
+  limitations section: [RS-PR-EVIDENCE](../../spec/rs-pr-evidence/),
+  [RS-PR-RELAY](../../spec/rs-pr-relay/), and [RS-DM-MANIFEST](../../spec/rs-dm-manifest/).
   For the security and architecture boundaries, read [RS-SEC-G](../../spec/rs-sec-g/) and
   [RS-ARC-G](../../spec/rs-arc-g/).
 - How each external standard is actually adopted: the [standards
diff --git a/docs/site/src/content/docs/explanation/records-stay-home.mdx b/docs/site/src/content/docs/explanation/records-stay-home.mdx
index 9d2b7ddf7..827e8583c 100644
--- a/docs/site/src/content/docs/explanation/records-stay-home.mdx
+++ b/docs/site/src/content/docs/explanation/records-stay-home.mdx
@@ -5,7 +5,8 @@ status: draft
 owner: registry-docs
 source_repos:
   - registry-stack
-last_reviewed: "2026-06-28"
+  - registry-evidence
+last_reviewed: "2026-08-03"
 doc_type: explanation
 locale: en
 standards_referenced:
@@ -14,28 +15,39 @@ standards_referenced:
 
 An institution that runs a civil registry, a social-protection database, or a health
 registry already holds the records it needs.
-Registry Stack lets it **answer evidence questions about those records** (*is this person alive?
-is this programme enrollment active?*) and return a result another system can trust, while the
-records themselves are **read where they already live, never written back, and not copied into a
-central exchange**.
+Registry Stack lets it **answer bounded questions about those records** (*is this person an
+adult? does this licence hold? is this person a legal parent of that child?*) and return a
+result another system can trust, while the records themselves are **read where they already
+live, never written back, and not copied into a central exchange**.
 This page explains what that means in practice: what stays inside the institution's
 boundary, what crosses it, and (equally important) what the design does and does not
 guarantee.
 
 ## A question goes in, an answer comes out
 
-The combined Relay and Notary mental model is one sentence: **a scoped evidence question crosses
-into the institution, Relay reads and normalizes the source, Notary returns a governed evidence
-answer, an evidence consumer uses it, and the decision owner remains accountable for what happens
-next.**
+The combined Relay and Evidence mental model is one sentence: **a bounded question crosses
+into the institution, Relay reads and normalizes the source, Evidence returns one signed
+assertion carrying the answer, an evidence consumer uses it, and the decision owner remains
+accountable for what happens next.**
 
-A Notary caller never sends the value it is asking about and never receives the
+An Evidence caller never sends the value it is asking about and never receives the
 underlying record as the answer.
-It sends the id of an *evidence claim* (an atomic, precisely defined evidence statement) and only
-the typed target, requester, or variable inputs that the claim admits.
-It receives one of a few narrow shapes of answer: a yes/no, a single value, a
-machine-readable evaluation result, or a credential the subject can carry in a wallet.
-The source row that the answer was computed from stays behind.
+It sends the identifier of a *predefined requirement* at an exact revision, the purpose it
+acts under, one selector per declared subject role, and a per-request nonce. That is the
+whole request: the schema is closed and rejects anything else
+(`products/evidence/contracts/request.schema.yaml`).
+It receives one signed assertion carrying the values the requirement declares, and nothing
+else (`products/evidence/contracts/evidence.schema.yaml`).
+The source record the answer was computed from stays behind.
+
+Four questions carry equal weight in the Evidence contract, and none of them is the
+canonical one: adult status, residence region, professional licence status, and
+legal-parent relationship. All four run the same path, and none is a built-in type or a
+special route (`products/evidence/README.md`, `products/evidence/CONCEPT.md`). The
+legal-parent question shows the shape most plainly: the caller already holds a reference to
+a child and a reference to a candidate parent, and asks whether the relationship holds. The
+answer is one boolean. The register's list of that child's parents never travels
+(`products/evidence/fixtures/acceptance/legal-parent-relationship/`).
 
 ## The boundary
 
@@ -44,46 +56,45 @@ flowchart LR
     subgraph inst["Institution: data stays here"]
         src[("Source registry\nCSV · XLSX · Parquet · PostgreSQL")]
         relay["Registry Relay\nprotected read API"]
-        notary["Registry Notary\nevaluate · disclose · issue"]
+        evidence["Evidence\nevaluate · minimize · sign"]
         key>"Signing key\n(private half never leaves)"]
         audit[("Audit log")]
         src -- read in place --> relay
-        relay -- governed read --> notary
-        notary -. records .-> audit
-        key -. signs .-> notary
+        relay -- one fixed protected read --> evidence
+        evidence -. records .-> audit
+        key -. signs .-> evidence
     end
     caller["Caller / evidence consumer"]
-    holder(["Subject / wallet"])
-    caller == "request: claim id + subject inputs + scope" ==> notary
-    notary == "evidence: yes/no · value · evaluation result" ==> caller
-    notary == "issued credential" ==> holder
+    caller == "request: requirement + purpose + subject selectors" ==> evidence
+    evidence == "signed assertion: declared values only" ==> caller
     caller == "scoped record read" ==> relay
     relay == "authorized source records" ==> caller
 
     classDef inside fill:#eef,stroke:#334,stroke-width:1px;
     classDef outside fill:#f7f7f7,stroke:#777,stroke-dasharray:3 3;
-    class src,relay,notary,key,audit inside;
-    class caller,holder outside;
+    class src,relay,evidence,key,audit inside;
+    class caller outside;
 ```
 
 *Two governed surfaces can cross the boundary.* Registry Relay turns an existing file or
 database table into a read-only, access-controlled API without replacing the source.
 Its scoped record routes can return source records to authorized callers that hold the
 dataset's row-read permission.
-Registry Notary evaluates one modelled question against the typed result of a compiler-pinned
-Relay consultation and returns a shaped answer; it is the only component that evaluates claims,
-applies disclosure policy, and issues credentials.
-Notary is the strongest minimization surface.
+Evidence answers one predefined requirement about one set of subjects and returns a signed
+assertion; it is the only component that evaluates a requirement, minimizes the result, and
+signs it.
+Evidence is the stronger minimization surface.
 Relay record reads are scoped and audited, not open data.
 
-The policy boundary remains separate across the two products and their consumers. Relay owns
-source access and adaptation policy. Notary owns evidence authorization and disclosure policy.
-The evidence consumer determines how evidence is used, and the decision owner remains accountable
-for requirements, eligibility, qualification, prioritization, approval, routing, payment,
-workflow, and action policy.
-Purpose-bound authorization can restrict an evidence request without changing which component owns
-the consumer decision. The caller that invokes Notary can be the evidence consumer or a technical
-intermediary acting for it.
+The policy boundary remains separate across the two products and their consumers. Relay
+owns source access and adaptation policy. Evidence owns evidence authorization and the
+declared disclosure of each requirement.
+The evidence consumer determines how evidence is used, and the decision owner remains
+accountable for requirements, eligibility, qualification, prioritization, approval, routing,
+payment, workflow, and action policy.
+Purpose-bound authorization can restrict an evidence request without changing which
+component owns the consumer decision. The caller that invokes Evidence can be the evidence
+consumer or a technical intermediary acting for it.
 
 ## What stays home
 
@@ -100,9 +111,15 @@ intermediary acting for it.
 - The institution keeps custody: The design premise is *distributed custody*: each
   authority retains control of its own registry data, and the stack does not aggregate
   records into a central system. It provides the exchange surface, not a data lake.
+- Evidence keeps no copy of what it read: Version 1 has no application database and
+  persists no selector, source, evidence, or response data. Raw source responses are never
+  persisted or logged, and selector, source, and disclosed values never reach logs or the
+  native audit record (`products/evidence/OPERATOR-CONTRACT.md`, invariants `V1-I14` and
+  `V1-I15` in `products/evidence/contracts/security-invariant-matrix.yaml`).
 - Private signing keys never leave the issuer: The institution publishes the *public*
-  half of its signing key so anyone can verify a signed credential or signed result; the
-  private half stays inside.
+  half of its signing key so anyone can verify a signed assertion; the private half stays
+  inside, owned by the service core and absent from configuration values, scripts, logs,
+  audit, and errors (invariant `V1-I23`).
 
 ## What crosses the boundary
 
@@ -110,99 +127,72 @@ What crosses depends on the surface.
 Registry Relay can return scoped source records to an authorized caller through a
 governed, audited read bounded by the caller's per-dataset row scope and the dataset's
 configured filters and limits.
-Registry Notary returns the answer a rule computes from typed consultation outputs rather than the
-source row; keeping that answer narrow is a modelling discipline, because a well-modelled claim
-returns one reusable evidence statement or one extracted value.
-A Notary answer takes one of a few shapes:
-
-- A yes/no: only the true/false satisfaction of the modelled rule.
-- A single value: the evaluated value itself, when the claim's disclosure mode is
-  `value` (this returns the full value).
-- A machine-readable evaluation result: a claim-result document carrying *provenance
-  metadata*: which evaluation produced it, under which policy, across how many sources. This
-  provenance lets a receiving system trace the result; it is not a cryptographic signature.
-- An issued credential: an SD-JWT VC the subject can store in a wallet and present later.
-  Unlike the plain result, the credential is cryptographically verifiable against the
-  issuer's published keys. Credential profiles are holder-bound by default, but an
-  operator can explicitly configure an unbound profile.
-
-Across a federation boundary (one institution's Notary asking another's), what crosses is
-a scoped, signed evaluation result, never a credential.
-
-## How much an answer reveals: the three disclosure modes
-
-Every claim carries a **disclosure mode** that fixes how much of the answer the caller
-receives. There are exactly three:
-
-| Mode | Discloses | Withholds |
-|------|-----------|-----------|
-| `value` | the evaluated value, less any object fields the policy redacts | nothing beyond policy-redacted object fields |
-| `predicate` | only the true/false satisfaction, for a claim whose rule yields a boolean | the underlying value |
-| `redacted` | neither: the result carries no value **and** no yes/no | the value *and* the outcome |
-
-The mode is policy-bound: a claim defines an `allowed` set, a `default`, and a downgrade
-policy.
-A caller may request a mode.
-Under the default `deny` downgrade, the service refuses a requested mode outside the
-allowed set; a `default` or `redacted` downgrade substitutes that fallback mode when the
-fallback is itself allowed.
-The default mode applies when the caller requests none, and every result records which
-mode was applied.
-A privacy-sensitive claim is expected to default to the least-revealing mode that still
-answers the question.
-
-This is the mechanism behind "prove a fact without sharing the record". To check whether a
-person has a registered record, model the question as an *existence* rule and disclose it
-as a `predicate`: a resolved record returns `true`, and the row never crosses the
-boundary.
-By default, a record that does not resolve collapses to a single not-available reason
-rather than a `false`, which hides the reason matching failed. An authorized caller can
-still distinguish a resolved record from a not-available response, so use this pattern for
-minimization, not for hiding whether a requested subject matched.
-To report whether a source records a vaccination dose, derive that evidence predicate from the
-declared typed source output. A public-health programme, acting as evidence consumer and decision
-owner, can combine the result with other evidence and its own case state to decide whether outreach
-or follow-up is required.
-Registry Notary can attest an eligibility or other decision already made by an authoritative
-source only when the claim identifier and its review documentation identify the fact as a
-source-owned decision. Notary does not recompute that decision.
+Evidence returns the values a requirement declares rather than the source row; keeping that
+answer narrow is a modelling discipline, because a well-modelled requirement declares the
+coarsest value form that still answers the question.
+
+An Evidence assertion is a closed document. It carries the requirement it supports, the
+evidence type it conforms to, the named issuer and the technical provider, the observation
+and validity timestamps, the purpose, the audience, the configuration revision it was
+produced under, one opaque binding per subject role, and one to sixteen declared values
+(`products/evidence/contracts/evidence.schema.yaml`).
+It carries nothing else: the schema rejects additional properties, and subject selector
+profiles and selector values never appear in it.
+
+The values themselves are shaped by the requirement's *concept declaration*, which fixes
+the exact form each value takes. A boolean answers a yes-or-no question. A controlled code
+answers with membership in a reviewed codelist rather than the register's own code. A date
+bucket answers with a bucket rather than the underlying date
+(`products/evidence/contracts/supported-value-forms.yaml`).
+[Disclosure modes and computed answers](../disclosure-modes-and-computed-answers/) works
+through what each form does and does not reveal.
 
 ## Why the answer is not the record
 
-A credential is not a copy of the record. It is an **SD-JWT VC**: the signed body carries a
-SHA-256 *digest* of each selectively disclosable field rather than the field value, so a
-field the holder does not present stays hidden.
-Holder binding is set by the credential profile.
-By default, a profile with no `holder_binding` block uses `did:jwk` holder binding.
-A holder-bound profile ties the credential to the holder's key so it is not presentable
-without the matching private key; an operator that intentionally needs a bearer-style
-credential can set `holder_binding.mode: none`.
-Each selectively disclosable field is a whole claim output, so an object-valued output is
-revealed as a unit unless an explicit projection splits it into separately disclosable
-fields.
-Anyone can verify the credential against the issuer's published public keys, served
-without authentication so a verifier needs no credential of its own.
-The issued credential carries no full record payload.
+A subject appears in an assertion only as a role-bound, audience-scoped opaque binding: a
+keyed derivation over the audience, purpose, role, profile, binding-key version, and the
+complete canonical selector bundle. The same person asked about by two relying parties, or
+under two purposes, produces two unrelated bindings, so an assertion is not a correlatable
+identifier (`products/evidence/contracts/evidence.schema.yaml`, invariant `V1-I17`).
+
+The same assertion can also be serialized as an **SD-JWT VC** under a frozen local profile,
+selected by its own exact media type and released only when both the deployment's reviewed
+configuration and the caller's matched grant permit it. That serialization carries one
+disclosure per declared value and adds a second encoding of one answer, never a credential
+lifecycle: there is no offer, no status list, no revocation, and no persisted credential
+state (`products/evidence/contracts/sd-jwt-vc-profile.yaml`).
+Its subject binding stays audience-scoped, so it is meaningful to the relying party named
+in the assertion and to no other. It is not a general multi-verifier credential.
+
+Anyone can verify a signed assertion against the issuer's published public keys, served
+without authentication so a verifier needs no credential of its own. A signature
+authenticates the provider and the payload's integrity; it does not assert legal-signature
+status or that the source is correct (invariant `V1-I24`).
 
 ## How the boundary is enforced
 
 The "stays home" property rests on a few enforced rules, covered in depth in the Trust &
 Security material:
 
-- Scope-before-source, deny-by-default: A service checks the caller's scope *before* it
-  reads any source or evaluates any claim, and does not widen a caller's reach at request
-  time beyond what its configuration grants. Anything that touches a record or a claim
-  requires authentication. Routes reachable without it return no record or claim result on
-  their own: liveness and readiness probes, public verification keys, public metadata, and,
-  where OID4VCI issuance or credential status is enabled, the protocol surfaces that run
-  their own flow checks.
-- A permit, or a closed door: On a governed read, the policy decision point must return
-  a permit before data is returned; a denial fails closed with a stable reason rather than
-  falling back to an ungoverned read.
-- Every person-level request is audited: An audit record captures at least the caller,
-  the scopes exercised, a request id, and the declared purpose where one was supplied.
-  A deployment can run audit fail-closed, so a request whose audit record cannot be
-  written does not return success.
+- One authorization decision, before any source read: Evidence resolves a single decision
+  binding the requester, the requirement revision, the purpose, the audience, the authority
+  path, and every subject role's profile and value origin, and denies before it resolves a
+  source credential or contacts a source. Permissions are never unioned across grants
+  (invariant `V1-I05`). Possession of an identifier does not authorize a lookup
+  (invariant `V1-I06`).
+- Caller data cannot widen the question: the request schema is closed, so a caller cannot
+  supply thresholds, expressions, scripts, paths, headers, source fields, or response
+  projections. Every one of those is fixed by reviewed configuration that is immutable for
+  the life of the process (invariants `V1-I02` and `V1-I18`).
+- Every request is audited, at two gates: Evidence durably accepts an access-attempt record
+  after authorization and before it touches a source, and a disclosure-release record after
+  the final response bytes exist and before those exact bytes are released. A sink failure
+  blocks the step rather than releasing unaudited evidence (invariants `V1-I13` and
+  `V1-I29`).
+- A refusal reveals nothing: no-match, ambiguous, missing-fact, and inconsistent-derivation
+  outcomes collapse to one public problem with the same status, title, and body shape, so a
+  caller cannot use the response as an existence oracle for who is in the register
+  (invariant `V1-I16`, `products/evidence/contracts/problem-contract.yaml`).
 
 ## What this guarantees, and what it does not
 
@@ -211,32 +201,39 @@ Security material:
 - It is not "data never moves" and not "air-gapped": The promise is *read-in-place, no
   write-back, retained custody*. Authorized, minimized answers do leave the boundary by
   design: that is the point of the system.
-- Minimization is modelled, not automatic: `value` mode discloses the evaluated value,
-  less any object fields the policy marks for redaction; it is not constrained to a
-  scalar, so a claim modelled to return an object or extracted record returns one. A claim
-  reveals only what its author configured it to reveal; least disclosure is a design choice
-  the claim makes, not a property the stack imposes on every answer.
+- Minimization is modelled, not automatic: A requirement reveals exactly what its concept
+  declaration says it reveals. A requirement authored to disclose a precise value discloses
+  that precise value. Least disclosure is a design choice the requirement makes, not a
+  property the runtime imposes on every answer.
+- Purpose does not narrow the answer: A requirement returns the same values and the same
+  forms for every purpose authorized to invoke it. Purpose gates whether a caller may ask at
+  all; a purpose that justifies a coarser answer needs its own requirement
+  (`products/evidence/OPERATOR-CONTRACT.md`).
+- One requirement is not the whole disclosure surface: Two requirements that are each safe
+  alone can reconstruct a protected value between them. The complete enabled configuration
+  is reviewed as one disclosure surface, and that review is an operator duty rather than
+  something the runtime can decide (invariant `V1-I03`).
 - Correctness depends on the source: Relay reports what the reviewed source consultation says,
-  and Notary evaluates that typed result. Neither product independently vouches for whether the
-  source is correct or current.
-- A plain result is provenance-tagged, not signed: The everyday evaluation response
-  carries provenance metadata, not a cryptographic signature. Cryptographic verifiability
-  comes from the SD-JWT VC credential and the signed federation result: a receiving system
-  that must verify an answer cryptographically uses the credential, not the default response.
-- Matching is only as strict as the Relay integration contract: Relay returns `match`,
-  `no_match`, or `ambiguous` under the compiled selector and output rules. Notary does not
-  replace that result with direct source matching or choose between ambiguous records.
-- Missing evidence is not a negative fact: A matched source value of `false`, a matched `null`
-  value, `no_match`, `ambiguous`, and source failure have different reviewed meanings. Claim rules
-  must not collapse `null`, unavailable evidence, or failures to `false`. An explicitly named
-  existence predicate can map `matched == false` to `false` when its reviewed meaning is exactly
-  whether one admissible match exists; ambiguity and failure remain unavailable.
-- Notary is not a consumer decision engine: Notary returns governed evidence. The evidence consumer
-  determines how that evidence is used, and the decision owner remains accountable for requirements,
-  decisions, workflow, and actions unless Notary is attesting a decision explicitly owned by the
-  authoritative source.
-- This is not zero-knowledge: A `predicate` answer is a policy-enforced boolean computed
-  inside the service; SD-JWT selective disclosure is digest omission. Neither is a
+  and Evidence derives its answer from what the source returned. Neither product
+  independently vouches for whether the source is correct or current.
+- Signed is the default, unsigned is not evidence: The signed flattened JWS is mandatory and
+  the default result. A separately typed unsigned envelope exists only when both the
+  reviewed configuration and the matched grant permit it, carries no integrity protection,
+  is never later-verifiable evidence, and is never produced as a fallback from a signing
+  failure (invariants `V1-I21` and `V1-I22`).
+- Matching is only as strict as the lookup contract: A lookup resolves to exactly one
+  match, no match, or ambiguity. Evidence never surfaces or chooses between candidates, and
+  emits no candidate count, score, or comparison (invariant `V1-I10`).
+- Missing evidence is not a negative fact: A source value of `false`, an absent value,
+  no match, ambiguity, and source failure have different reviewed meanings. A derivation
+  must not collapse an absent value, an unresolved lookup, or a failure into `false`.
+  Existence may be disclosed only as a separately authorized declared value, never as error
+  detail (`products/evidence/contracts/problem-contract.yaml`).
+- Evidence is not a consumer decision engine: Evidence returns governed evidence. The
+  evidence consumer determines how that evidence is used, and the decision owner remains
+  accountable for requirements, decisions, workflow, and actions.
+- This is not zero-knowledge: A boolean answer is a value computed inside the service from
+  data the service read, and SD-JWT selective disclosure is digest omission. Neither is a
   zero-knowledge proof.
 
 This page's promise also sits inside the wider set of stack-wide limits: revocation and
@@ -247,8 +244,7 @@ the underlying specifications. Weigh those alongside the limits in this section;
 ## Related
 
 - The security model and protocol contracts: [RS-SEC-G](../../spec/rs-sec-g/),
-  [RS-PR-RELAY](../../spec/rs-pr-relay/), [RS-PR-NOTARY](../../spec/rs-pr-notary/),
-  [RS-DM-CLAIM](../../spec/rs-dm-claim/)
-- [Evidence issuance, end to end](../evidence-issuance/)
+  [RS-PR-RELAY](../../spec/rs-pr-relay/), [RS-PR-EVIDENCE](../../spec/rs-pr-evidence/)
+- [Evidence security model](../../security/evidence/)
 - [Disclosure modes and computed answers](../disclosure-modes-and-computed-answers/)
 - [Threat model](../threat-model/)
diff --git a/docs/site/src/content/docs/explanation/threat-model.mdx b/docs/site/src/content/docs/explanation/threat-model.mdx
index f8eb87532..1d6372807 100644
--- a/docs/site/src/content/docs/explanation/threat-model.mdx
+++ b/docs/site/src/content/docs/explanation/threat-model.mdx
@@ -5,14 +5,14 @@ status: draft
 owner: registry-docs
 source_repos:
   - registry-stack
+  - registry-evidence
+  - registry-mint
   - solmara-lab
-last_reviewed: "2026-07-07"
+last_reviewed: "2026-08-03"
 doc_type: explanation
 locale: en
 standards_referenced:
   - sd-jwt-vc
-  - oid4vci
-  - w3c-did
   - odrl
 ---
 
@@ -24,9 +24,8 @@ properties it claims: which threats does the architecture consider, what does it
 mitigate, and where do the residual risks lie?**
 It is deliberately a map of boundaries and limits, not a runbook.
 Hardening procedures belong to the [hardening checklist](../../security/hardening-checklist/),
-the high-level posture summary to the [security overview](../../security/), and privacy
-obligations to [Data minimization and purpose
-limitation](../data-minimization-and-purpose-limitation/).
+and the invariant-by-invariant statement of what the Evidence runtime enforces belongs to the
+[Evidence security model](../../security/evidence/).
 Here the goal is a defensible threat model: the boundaries the design draws, the threats it
 places in and out of scope, and the residual risks.
 
@@ -38,31 +37,36 @@ production data, no authentication, and no secrets. A **runtime services layer**
 it is where authentication, authorization, and disclosure actually happen.
 
 The consequence for a reviewer is that the metadata layer authorizes nothing, enforces
-nothing, and does not assert that any record exists or satisfies a claim. Publishing a
-dataset, a policy, an offering, or a federation relationship does not grant access and is
-not proof that a record exists; a published ODRL policy only describes intent until a
-runtime service binds it into an enforced profile it supports. This also closes one threat
-directly: because the metadata layer is meant to be distributed and inspected, secrets are
-never embedded in it. The operator injects them at deployment, which keeps secret material
-out of the portable artifact entirely.
+nothing, and does not assert that any record exists or satisfies a question. Publishing a
+dataset, a policy, or an offering does not grant access and is not proof that a record
+exists; a published ODRL policy only describes intent until a runtime service binds it into
+an enforced profile it supports. This also closes one threat directly: because the metadata
+layer is meant to be distributed and inspected, secrets are never embedded in it. The
+operator injects them at deployment, which keeps secret material out of the portable
+artifact entirely.
 
 ## Components and where they sit on the boundaries
 
-Four formal components sit on or beside the trust boundaries. A separate adopter demo sits
-outside the production trust boundary:
+Four formal components sit on or beside the trust boundaries, with one supporting service
+beside them. A separate adopter demo sits outside the production trust boundary:
 
 - Registry Manifest: the offline metadata producer. No production data, no auth, no
   secrets. It lives entirely on the describe side of the primary boundary.
 - Registry Relay: a read-only consultation gateway over sources.
-- Registry Notary: claim evaluation, credential issuance, and federation. This is the
-  component that evaluates a modelled question, applies disclosure policy, and issues
-  credentials.
+- Evidence: a minimum-disclosure assertion service. It answers one bounded, predefined
+  question about one subject with a signed assertion carrying the answer and not the record.
 - Registry Platform: the shared security primitives that the runtime services build on.
+- Registry Mint: a supporting service, not a pattern of its own. It issues the short-lived
+  access tokens a resource server such as Evidence verifies, for a deployment with no
+  identity provider. The dependency runs one way: Evidence does not depend on Registry Mint.
 - Solmara Lab: a separate adopter demo, running on synthetic data and demo configuration.
   Treat Solmara Lab as out of scope for production trust. Its demo and template integrations
   are integration examples, not a production freshness or replay-protection profile, and a
   team copying them into production must add request freshness, expiry, or nonce checks itself.
 
+This model has no credential-issuance or peer-federation boundary, because no product here has
+one: Evidence issues no credential lifecycle and evaluates nothing on a peer's behalf.
+
 Security-critical primitives are concentrated in Registry Platform so that the behavior is
 identical across services and reviewable in one place. This is a deliberate attack-surface
 decision: it removes the risk of divergent, per-service security code that would each need
@@ -70,222 +74,368 @@ auditing separately.
 
 ## Trust boundaries in detail
 
-{/* SVG diagram. Every boundary label is restated in the paragraphs that follow. */}
+{/* SVG diagram. Every boundary label is restated in the sections that follow. */}
 <figure>
   <img src="../../images/registry-trust-boundaries.svg"
-       alt="The Registry Stack trust boundaries in one map. The portable metadata layer
-            (Registry Manifest) only describes: no production data, no authentication, no
-            secrets; it authorizes nothing, and publishing grants no access. Across the
-            primary trust boundary, the runtime services layer enforces authentication,
-            authorization, and disclosure. A caller crosses the service edge, where each
-            service runs exactly one authentication mode, static-credential fingerprint or
-            OIDC, and every claim- or record-bearing route is authenticated before
-            responding. Registry Relay owns registry source access, credentials, product-neutral
-            HTTP and script adaptation, snapshots, and minimized consultation outputs. Registry
-            Notary consumes compiler-pinned Relay consultations for every claim. Subject
-            access may authorize and bind a request but never provides evidence. Federation with a peer
-            Notary is static-peer only, not a dynamic trust
-            mesh; it requires a verified peer-signed JWS, and peer identity, signature,
-            freshness, single use, purpose, profile, and audience are verified before any
-            Relay consultation or claim evaluation. Delegated subject access is a distinct trust context from peer
-            federation: it delegates no trust to a peer Notary and stays inside the citizen
-            or OIDC trust context." />
+       alt="The Registry Stack trust boundaries in one map. A request path runs downward from
+            Registry Mint, which issues a short-lived access token, to the Caller, to Evidence, to
+            a Registry Relay protected read API, to the registry sources Relay reads in place.
+            Dashed rules mark the service edge in front of Evidence and in front of Relay, where
+            every record- or assertion-bearing route is authenticated before responding: Evidence
+            runs one OIDC bearer profile with one trusted issuer, one principal claim, and no trust
+            in proxy identity headers. Caller to Evidence carries a bearer token, a declared
+            purpose, a named requirement revision, and selector values; the answer, not the record,
+            comes back, only predefined revisions are evaluable, one authorization decision binds
+            the whole tuple, and possession is never authority. Evidence to its fixed sources fixes
+            origin, method, path, headers, credential, TLS, projection, redirect and proxy denial,
+            and one request per evaluation by trusted configuration executed only by the core, with
+            lookup collapsing to match, no match, or ambiguous and raw responses never logged. The
+            Relay-protected source composition is two independent authorization decisions, neither
+            widening the other, with the Relay client credential custodied as key material and
+            Relay authenticating the workload rather than the caller. Registry Mint to Evidence
+            runs one way: Evidence verifies the token as an ordinary resource server that knows
+            Registry Mint only as an issuer URL and a key set, and a deployment with an identity
+            provider does not run Registry Mint at all. Relay to registry sources is fixed by a
+            compiled integration covering origin, credential interface, method and path authority,
+            and limits. A separate lane runs operator to key file to Evidence to public JWKS to
+            verifier, where private material reaches the process only by secret reference to an
+            owner-only file, signing is fail-closed, and the verifier pins the key set. Only
+            /health, /ready, /openapi.json, /.well-known/evidence/jwks.json, and
+            /.well-known/jwt-vc-issuer are unauthenticated at the Evidence edge." />
 </figure>
 
 **The service edge (authentication).** Authentication is the trust boundary at the service
-edge. Each service runs exactly one authentication mode (either static-credential
-fingerprint or OIDC) and authenticates every claim- or record-bearing route before
-responding. The unauthenticated surfaces are the operational, discovery, and
-protocol-bootstrap routes: liveness and readiness probes, issuer JWKS public verification keys,
-credential-issuer discovery, the OID4VCI wallet-flow endpoints, the
-docs, public credential-status reads, and credential type metadata. The federation
-evaluations route is exempt from the API-key/OIDC middleware but still requires a verified
-peer-signed JWS, so it is not anonymous.
-
-**Notary to Relay.** A runtime boundary sits between Registry Notary and Registry Relay for every
-registry-backed claim. The compiler pins the consultation profile, contract hash, purpose, and
-typed input mapping. Notary authorizes the claim before calling Relay, and Relay applies its own
-workload authorization before source work. Notary has no direct registry source connector. One
-Notary authority pairs with one Relay authority, and Notary owns its PostgreSQL transaction,
-replay, evaluation, audit, and credential-status state.
-
-**Relay to registry sources.** Registry Relay owns the source boundary. Its compiled integration
-fixes the origin, credential interface, method and path authority, input placement, output
-projection, and cumulative limits. Product and version metadata do not select the HTTP, script, or
-snapshot capability.
-
-**Federation between two Notary services.** Federation is a deliberate trust boundary
-between two Notary services, and it is **static-peer only**: only configured static peers are
-admitted. It is not a dynamic trust mesh.
-
-**Delegated subject access.** Delegated subject access is a distinct trust context from
-peer federation; the two are distinct trust contexts. It does not delegate trust to a peer
-Notary; it stays inside the citizen / OIDC trust context.
+edge, and each service authenticates every record- or assertion-bearing route before
+responding. Registry Relay runs exactly one authentication mode, either static-credential
+fingerprint or OIDC. Evidence runs one reviewed OIDC bearer profile with exactly one trusted
+issuer and exact audience, token type, and algorithm allowlists, and one configured principal
+claim with no `client_id`, `azp`, header, or request fallback: missing data denies rather than
+falling back to another claim (`V1-I04`). Evidence's unauthenticated surfaces are operational
+and discovery only: `/health`, `/ready`, `/openapi.json`,
+`/.well-known/evidence/jwks.json`, and `/.well-known/jwt-vc-issuer`. None of them reveals
+which evidence definitions are enabled or which requesters may invoke them. Evidence never
+trusts a proxy-supplied identity header, whatever the gateway in front of it asserts.
+
+**Caller to Evidence.** This is the boundary the whole product exists to draw. The caller
+crosses it with a bearer access token, a declared purpose, a named requirement revision, and
+selector values for the subject roles that requirement declares; what comes back is the
+answer, not the record. Four properties hold it:
+
+- Only predefined, versioned requirement revisions are evaluable, and the request schema is
+  closed. A caller cannot supply thresholds, expressions, scripts, paths, headers, source
+  fields, relationship types, adapter parameters, or response projections (`V1-I01`,
+  `V1-I02`).
+- One authorization decision binds requester tags, optional actor, requirement revision,
+  purpose, every role, profile, and origin tuple, authority, and audience together. Partial
+  matches across separate grants cannot be unioned into access, and exactly one authority
+  path must match: zero paths and two or more paths both deny (`V1-I05`).
+- Possession is not authority. A selector value, a demographic tuple, or a caller-supplied
+  consent, approval, or grant reference is a lookup input, never proof that the caller may
+  ask (`V1-I06`, `V1-I07`).
+- What is released is constructed by the core after full output validation, from declared
+  typed concept values only. A script cannot inject envelope fields, subject identifiers, or
+  unsupported claims (`V1-I12`, `V1-I25`).
+
+Purpose is enforced rather than advisory: an unauthorized purpose is denied before credential
+acquisition and source contact, purpose is an input to every subject binding and audit
+pseudonym, and purpose sits inside the signed payload where a verifier can reject a mismatch.
+A reviewer should still read a declared purpose as the caller's authorized selection from the
+granted set rather than an identity-provider attestation, unless the operator has issued a
+distinct requester tag per purpose.
+
+**Evidence to its fixed sources.** Evidence's outbound edge is deliberately not
+general-purpose. Source calls are fixed by trusted bundle configuration and executed only by
+the core, which owns origin, method, fixed or selector-bound path, fixed headers,
+authentication, TLS, projection, redirect denial, proxy denial, limits, and a one-request
+ceiling; this is what closes SSRF, credential forwarding, and script-directed networking
+(`V1-I09`). A preparation script renders only bounded query pairs and one JSON body, and Rust
+validates that output before a credential is resolved. Every source declares a response schema
+that Rust validates the projected response against before any extraction script runs, so a
+response outside its reviewed shape is a source-protocol failure rather than an input to fact
+construction. Lookup collapses to `match`, `no_match`, or `ambiguous`: Evidence never fetches
+broad candidate sets, follows pages, scores candidates, or exposes counts (`V1-I10`). Raw
+source responses are never persisted or logged (`V1-I14`). Hostname and fixed-origin
+verification stay mandatory, there is no trust-all mode, and ambient `HTTP_PROXY`-family
+variables are ignored.
+
+**The Relay-protected source composition.** A common deployment makes the fixed source a
+Relay-protected read API, reached with OAuth 2.0 client-credentials authentication, which is
+one of the source authentication kinds the Evidence bundle schema admits. That composition is
+a real boundary with real failure modes, and a reviewer should treat it as two independent
+authorization decisions rather than one:
+
+- Evidence matches its own complete entitlement before it resolves a credential or contacts
+  Relay, and Relay then applies its own scope-based, deny-by-default workload authorization
+  before source work. Neither decision widens the other.
+- The composition is only as narrow as the Relay route it reads. Evidence records this
+  honestly as an acquisition posture per source: `source-derived` and `field-projected` claim
+  acquisition minimization, while `record-transformed` claims disclosure minimization only.
+  A Relay route that returns a whole record makes the integration `record-transformed` even
+  though Evidence's own projection and derivation emit one narrow fact, and the operator must
+  not describe it as full lifecycle minimization.
+- Evidence holds a client credential for Relay. Its disclosure gives an attacker Relay reach
+  at that client's scope, independent of every Evidence-side control, so it is custodied as
+  key material rather than as configuration.
+- Relay authenticates the Evidence workload, not the caller that asked Evidence. Bundle-fixed
+  headers cannot set authentication, routing, cookie, framing, forwarding, proxy, or tracing
+  fields, so no caller correlation identifier crosses into the source request. Joining the two
+  audit trails for one request is therefore an operator procedure over two records, not
+  something either service does for you.
+- Readiness performs a bounded token bootstrap against the configured token endpoint, so a
+  token-endpoint outage surfaces as a failed readiness check rather than as a first failed
+  request. It never sends an evidence-data request or probes a source data endpoint.
+
+**Registry Mint to Evidence.** Registry Mint issues access tokens; Evidence verifies them as
+an ordinary resource server. The dependency runs one way, and Evidence's only knowledge of
+Registry Mint is an issuer URL and a key set: it reads every claim by the name in its own
+`authentication` block, so any issuer writing those claims serves equally well. Registry
+Mint's tests drive Evidence's authenticator, and Evidence does not depend on Registry Mint.
+What a reviewer checks depends on which of the two shapes the deployment runs:
+
+- **With Registry Mint.** The client registry becomes part of the trust boundary. Registry
+  Mint verifies a signed client assertion against the keys registered for the client it claims
+  to be, then writes the authority from the registry and never from the request. The
+  consequence is that whoever can write a registration file into `clients.directory` can mint
+  a token carrying any requester tags, and the running process re-reads that directory on
+  `SIGHUP` without a restart. Treat the registry directory as sensitive as the signing key.
+  Registry Mint serves plain HTTP behind operator-terminated TLS, while Evidence requires an
+  HTTPS issuer and key set with no loopback exception, so the TLS terminator is load-bearing.
+- **Without Registry Mint.** A deployment that already has an identity provider does not run
+  Registry Mint at all; Evidence points at the provider's issuer and JWKS directly. Tag
+  issuance, client lifecycle, and revocation move entirely to that provider, and Evidence's
+  residual exposure is its trust in one issuer's key set.
+
+Both shapes share one property worth stating plainly: Evidence has no token revocation. A
+minted or issued token is accepted until it expires, which is why token lifetime is bounded
+short. If the issuer's key set becomes unreachable, an already-retrieved key set keeps being
+accepted for a bounded allowance and then every request is rejected with the same closed `401`
+a bad token receives, with the reason recorded only in the deployment's own log.
+
+**Operator to signing key material, and consumer to the published key set.** Private signing
+material is core-owned and stays out of bundle values, Rhai, logs, audit, and errors
+(`V1-I23`). It reaches the process only through the secret-reference mechanism, resolved by a
+file provider that accepts only a regular, owner-only, non-symlink, single-hard-link file of
+the expected mode and size. Version 1 has exactly one secret provider, the file provider: there
+is no hardware-module option, so custody is a property of the host rather than of the runtime.
+The operator configures one active EdDSA key whose `kid` matches `signing.activeKeyId`, and
+retains each retired public key in the published JWKS for at least the maximum assertion
+validity plus allowed clock skew. Signing is mandatory and fail-closed: a missing or failed
+signer returns a safe transient failure and never falls back to unsigned output (`V1-I22`).
+
+On the consumer's side, the published JWKS is discovery, not a trust anchor. A verifier obtains
+the provider identity and key-set location through governed configuration, pins that trust,
+allowlists the expected algorithm, and resolves `kid` only within the trusted set; it never
+follows a key URL supplied inside a message. Strict verification compares the response against
+independently retained expectations, the expected nonce, the expected unordered set of unique
+role-bound subject bindings, and the expected concept identifiers, forms, and cardinalities,
+and reports one generic policy mismatch so verification is not itself an oracle (`V1-I31`).
+A valid signature authenticates the provider and the payload; it does not assert legal-signature
+status or that the underlying source fact is true (`V1-I24`).
+
+**Relay to registry sources.** Registry Relay owns its own source boundary. Its compiled
+integration fixes the origin, credential interface, method and path authority, input placement,
+output projection, and cumulative limits. Product and version metadata do not select the HTTP,
+script, or snapshot capability.
 
 ## Assets protected by the design
 
 The assets the design sets out to protect are:
 
-- Private signing keys: The private signing key never leaves the issuer; only the public
-  half is published through issuer JWKS. A verifier
-  never needs a credential to verify, which keeps verification off the protected side
-  entirely.
-- Person-level source data: The source rows behind a claim are read in place and never
+- Private signing keys: The private signing key never leaves the service; only the public
+  half is published through the JWKS route. A verifier needs no credential and no protected
+  access to verify a stored response, which keeps verification off the protected side entirely.
+- Person-level source data: The source rows behind an assertion are read in place and never
   cross the boundary; only a computed, disclosure-shaped answer does.
 - Audit integrity: Audit is treated as a security control rather than best-effort
   logging (see Audit as a control).
 - Secret material: Bearer tokens, raw credentials, and key material are kept out of both
   the portable layer and client-facing surfaces.
 
-The design treats these threat classes as security-relevant: authentication bypass, credential disclosure,
-audit redaction or integrity failure, signing-key handling bugs, Relay source-adaptation data
-leakage, and privacy regressions that expose raw subject identifiers.
+The design treats these threat classes as security-relevant: authentication bypass, credential
+disclosure, audit redaction or integrity failure, signing-key handling bugs, source-adaptation
+data leakage, and privacy regressions that expose raw subject identifiers.
 
 ## Threats the design considers and mitigates
 
-- Secret disclosure via stored credentials or timing: Static credentials are stored only
-  as SHA-256 fingerprints (never the raw secret) and compared in constant time.
-- Token forgery / acceptance of untrusted tokens (OIDC mode): A token is trusted only
-  after signature verification against the configured issuer JWKS, plus issuer, audience, and
-  algorithm checks. The service still owns its route scopes regardless of the token.
-- Privilege escalation / over-reach: Authorization is scope-based and deny-by-default. Relay
-  refuses unauthorized callers before source work. Notary refuses unauthorized callers before a
-  Relay consultation or claim evaluation. Reach is never widened at request time.
-- An existence / matching oracle: By default a matching failure collapses to a single
-  public reason (`evidence.not_available`), with the granular reason kept only in audit, so
-  the matching surface cannot be used to probe whether a record exists. A deployment may
-  disable this collapse only in a controlled environment; disabling it is a residual
-  confidentiality risk.
-- Information leakage in error and cache surfaces: `problem+json` error bodies carry
-  stable codes only. Bearer tokens, private keys, source values, filesystem paths, and
-  internal error chains stay in protected operator logs, never in responses; principal-scoped
-  responses are not public cache entries.
-- Over-collection and value injection in claim evaluation: The caller supplies a claim id and
-  only the typed request inputs the claim policy admits, never the evaluated value. Relay returns
-  only the compiler-declared typed outputs, and Notary rejects undeclared inputs.
-- Disclosure leakage: A redacted result carries neither the value nor the predicate
-  outcome. Selective-disclosure credentials carry SHA-256 digests of unselected fields, so a
-  holder cannot present an undisclosed field. Holder binding defaults to `did:jwk` for
-  credential profiles; where a profile keeps binding enabled, and on the OID4VCI
-  issuance path, which requires EdDSA `did:jwk`, the holder is bound by a fresh audience-bound
-  proof-of-possession. An operator can explicitly configure `holder_binding.mode: none` for
-  a bearer-style credential profile, and `registry-notary doctor` warns on that choice.
-  Binding applies only to an issued credential; the plain evaluation result is not a
-  credential and is never holder-bound.
-- Caller-provided data crossing an evidence trust gate: Subject access and delegated
-  subject access derive subject, requester, and relationship from the authenticated
-  principal and scoped authorization details; caller-supplied `requester`, `relationship`, and
-  `on_behalf_of` fields are rejected before any Relay consultation or claim evaluation, and
-  self-asserted target fields do not satisfy trusted-principal gates.
-- Authorization context promoted to claim evidence: Configuration accepts only
-  registry-backed claims. Caller identity and authorization details cannot
-  become claim values. Delegated evaluations without the representative
-  ceremony, legacy, missing, stale, or modified evaluation provenance fails
-  before signer access.
-- Stolen issuer-initiated offer: A transaction code is required by default and is transferred
-  separately from the offer. Codes are single-use, wrong PIN attempts are bounded, and invalid
-  redemptions are rate limited. An explicit no-PIN compatibility profile has a maximum
-  300-second lifetime, but the unredeemed offer remains bearer credential material that a thief
-  can use during that window.
+- Secret disclosure via stored credentials or timing: Relay stores static credentials only
+  as SHA-256 fingerprints (never the raw secret) and compares them in constant time.
+- Token forgery or acceptance of untrusted tokens: A token is trusted only after signature
+  verification against the configured issuer JWKS, plus issuer, audience, token type, and
+  algorithm checks. The service still owns its route scopes and grants regardless of what the
+  token asserts.
+- A sender-constrained token replayed as a bearer token: Evidence denies an access token
+  carrying an RFC 7800 proof-of-possession confirmation claim rather than accepting it as an
+  ordinary bearer, because it validates no sender proof and accepting one would silently
+  discard the constraint the token was issued under (`V1-I32`).
+- Privilege escalation or over-reach: Authorization is deny-by-default. Relay refuses
+  unauthorized callers before source work; Evidence requires exactly one complete entitlement
+  match before audit, credential resolution, or source access. Reach is never widened at
+  request time.
+- An existence or matching oracle: No-match, ambiguous, missing-fact, and
+  inconsistent-derivation outcomes collapse by default to one public problem shape, with the
+  granular category kept in audit without counts, so response shape, message, or timing cannot
+  be used to probe registry membership (`V1-I16`). Every authorization refusal likewise
+  collapses to one generic `not_authorized` problem that does not reveal which check failed.
+- Cross-purpose or cross-relying-party tracking: Subject bindings are derived with a keyed,
+  domain-separated function over audience, purpose, role, profile, key version, and the
+  complete canonical selector bundle, so the same person is not linkable across purposes or
+  relying parties (`V1-I17`).
+- Information leakage in error, log, and telemetry surfaces: `problem+json` bodies carry
+  stable codes only. Selector, source, and disclosed values never appear in logs or native
+  audit (`V1-I15`), and operational telemetry is off by default, served only on a separate
+  operator-private listener, with every series label drawn from a closed set rather than from
+  request content (`V1-I33`).
+- Over-collection through the request: The caller names a requirement and supplies only the
+  selector values that requirement's named profiles admit. Undeclared concepts, extra fields,
+  and values violating type, codelist, cardinality, precision, or size bounds are rejected
+  before evidence construction (`V1-I12`).
+- Payload substitution and unsigned success masquerading as verified evidence: The signed
+  flattened JWS is mandatory, available to every authorized grant, and the default response.
+  Unsigned output exists only through its own exact media type, and only when both the
+  immutable bundle and the one matched grant permit it; requesting a format creates no
+  permission of its own (`V1-I21`, `V1-I28`). The unsigned envelope is self-identifying and is
+  rejected by the strict JWS verifier, so it cannot be stored and later mistaken for signed
+  evidence.
+- A release with no accountability record: The final immutable response bytes exist before the
+  disclosure-release audit is durably accepted, and those exact bytes are what is released
+  afterward. Every native audit event records the closed response-protection mode, with a
+  signing key identity present exactly for a cryptographically protected release (`V1-I29`,
+  `V1-I30`).
+- Unreviewed hot mutation of policy: Configuration is immutable for the life of the serving
+  process. There is no runtime override, reload, merge, or fallback path, and the closed
+  runtime file cannot reach any governed field (`V1-I18`).
+- Cross-tenant confusion: One process serves one operator-controlled trust domain, with one
+  service trust domain, issuer governance boundary, bundle lifecycle, signer, and audit
+  boundary (`V1-I19`).
+- SSRF and uncontrolled egress: Registry Stack project authoring accepts exact HTTPS source
+  origins. Relay's compiled plan fixes the destination, method, path authority, safe headers,
+  and cumulative call budgets before the runtime resolves a credential or sends a request, and
+  Evidence's fixed executor does the same for its own sources. Scripts on either side control
+  ordinary request flow only inside that host-enforced authority.
+- A hostile or defective reviewed script: Evidence's script engine has no filesystem,
+  environment, network, process, or module access, no ambient clock or randomness, and a
+  normative operation ceiling that terminates a runaway invocation with a closed, value-free
+  error.
 - Spoofed trust context and ungoverned reads (Relay side): Relay ignores trust-context
   headers unless the principal is scoped to assert that exact value, and a governed read must
   receive a PDP permit or fail closed with a stable `pdp.*` code rather than falling back to an
   ungoverned read.
-- SSRF / uncontrolled egress: Registry Stack project authoring accepts exact HTTPS source
-  origins. Relay's compiled plan fixes the destination, method, path authority, safe headers, and
-  cumulative call budgets before the runtime resolves a credential or sends a request. Rhai can
-  control ordinary request flow only inside that host-enforced authority.
-- Untrusted federation peers, replay, and wrong-purpose requests: Only configured static
-  peers are admitted, and before any Relay consultation or claim evaluation the server verifies peer identity, request
-  signature, freshness, single use, purpose, profile, and audience. The single-use and
-  freshness checks are backed by a real replay-store primitive that tracks one-time JWT `jti`
-  and nonce values (federation request `jti`, transaction-bound OID4VCI proof nonce, and
-  holder-proof `jti`).
-
-**Audit as a control.** Every request touching person-level data can be recorded with the
-hashed principal, request id, the principal's granted scopes, and `Data-Purpose` context
-when present, and a deployment can run audit fail-closed, so an unrecordable request does
-not return success. Relay records ordinary scopes unchanged but replaces each exact-value
-trust scope with a field-bound `registry:trust:<field>:hmac-sha256:<digest>` handle under
-the deployment audit key. The handle supports investigation and same-key correlation
-without disclosing the trusted value. Two caveats for the auditor. First, the recorded scope list is not a
-per-route proof of which scope check authorized the request, and per-route audit coverage
-is something to verify in your deployment. Second, Notary records hashed principal and
-correlation identifiers, and Relay's trust-scope handles have the same operational
-dependency, so operator-side investigation depends on retaining the hashing secret and
-request context.
+
+**Audit as a control.** Evidence writes two mandatory records per request: an access-attempt
+event that must be durably accepted before the first source read, and a disclosure-release
+event that must be durably accepted after signing and before the response is released. Either
+failure blocks the corresponding action. The chain is keyed and hash-linked, has no severity
+levels and no way to turn records off, and carries reviewed identifiers and decision categories
+only: never raw selector values, per-field selector hashes, source values, credentials, tokens,
+or raw subject identifiers. Where correlation is required, one keyed, domain-separated,
+versioned pseudonym covers the complete canonical selector bundle and is deliberately not
+globally stable across purposes or audiences. Relay records ordinary scopes unchanged but
+replaces each exact-value trust scope with a field-bound
+`registry:trust:<field>:hmac-sha256:<digest>` handle under the deployment audit key, which
+supports investigation and same-key correlation without disclosing the trusted value.
+
+Three caveats for the auditor. First, exactly one Evidence process may write a given audit
+path: the sink takes an exclusive advisory lock, because the chain head lives in process
+memory and two writers would interleave records and destroy tamper evidence. That makes the
+supported shape one replica per audit path, active/passive rather than active/active. Second,
+startup recovers the chain head from the newest sealed segment and fully verifies only the
+active segment, so corruption inside an already sealed segment is not detected at startup;
+only an out-of-band `evidence verify-audit` pass over the whole directory detects it. Third,
+audit records hashed principals and correlation identifiers, and Relay's trust-scope handles
+have the same operational dependency, so operator-side investigation depends on retaining the
+hashing secret and request context.
 
 ## Residual risks and what is left to the operator
 
-The canonical inventory of every current limit is [Known limitations and non-guarantees](../known-limitations/); the residual risks in this section are the subset a threat model must weigh.
+The canonical inventory of every current limit is [Known limitations and
+non-guarantees](../known-limitations/); the residual risks in this section are the subset a
+threat model must weigh.
 
 These are the risks the design does *not* close:
 
-- Key custody is not certified by health checks: Readiness, liveness, and conformance
-  checks do not certify production-grade private-key custody. A deployment using software
-  keys, local JWK files, or demo-generated keys can be reachable and internally consistent yet
-  not production-secure. Custody, rotation, and provider approval remain operator
-  responsibilities.
+- Key custody is not certified by health checks: Readiness, liveness, and offline validation
+  confirm that key material parses and that its file ownership and mode are what the contract
+  requires. They do not certify production-grade custody. Evidence Version 1 has one secret
+  provider, the file provider, and no hardware-module option, so a deployment using
+  demo-generated or long-lived software keys can be reachable and internally consistent yet not
+  production-secure. Custody, rotation, and provider approval remain operator responsibilities.
+- The combined disclosure surface is a human review: The runtime validates one bundle at
+  startup and refuses two simultaneously enabled requirements that declare the same disclosure
+  family, but a declared family is a trusted operator attestation, not a semantic classifier.
+  Threshold ladders, overlapping categories, increasingly precise regions, and coexisting
+  revisions that together reconstruct a protected value are caught by the operator's review of
+  the whole enabled bundle or not at all. Rate controls do not make an unsafe bundle safe
+  (`V1-I03`, `V1-I20`).
+- Overlapping authority paths are not detected at startup: Startup validation does not detect
+  two authority paths covering the same requirement, purpose, and subject tuple. At request
+  time that ambiguity denies, which fails safe but presents as an unexplained refusal; the
+  operator owns the review that prevents it.
+- Rate limits are per process and in memory: The configured request, burst, and
+  failed-selector budgets are tracked in one process's memory, never shared across replicas, so
+  running N instances behind a load balancer multiplies every limit by N and a restart resets
+  each budget to full. This matters most for the failed-selector budget, because that budget,
+  not throughput, is the selector-enumeration defense.
+- A released assertion cannot be recalled: Evidence has no revocation, status list, or
+  presentation-time check. The only levers over a released assertion are its declared validity
+  window and signing-key rotation, and rotation does not invalidate assertions a retained
+  public key still verifies.
+- The request nonce is not replay protection: It is uninterpreted correlation data echoed into
+  the payload. Reuse is not rejected, and no uniqueness check exists.
 - The operator boundary is where coverage ends: Secret and key provisioning, key custody
-  and rotation, audit retention and storage, tenant isolation, TLS termination and
-  certificates, edge rate limiting, deployment configuration, and incident response are
-  operator responsibilities, not behavior the model defines.
+  and rotation, audit retention, backup, restore and access control, tenant isolation, TLS
+  termination and certificates, edge rate limiting, per-client quotas, deployment
+  configuration, and incident response are operator responsibilities, not behavior the model
+  defines.
 - Aggregate routes are not a privacy budget: Relay aggregate routes do not constitute a
   longitudinal privacy budget; v1 does not track cumulative disclosure across repeated or
   overlapping aggregate queries. Do not describe a Relay aggregate as privacy-budgeted unless
   a separate deployed control provides it. This is a residual disclosure risk left to the
   operator.
-- Project approval remains a semantic control: Schemas and validators reject malformed claims,
-  duplicate identifiers, incomplete Relay pins, and unsupported evidence modes. They cannot
-  decide whether an institution selected the correct source fields, lawful purpose, claim rule,
-  or disclosure default. Those decisions require project review and fixture evidence.
-- Known product gaps: No revocation flow is specified (though an optional,
-  off-by-default credential-status surface can be enabled to mark a credential `revoked`),
-  there is no `/.well-known/jwt-vc-issuer` endpoint, and no built-in data-subject erasure
-  workflow in this version. When a status-bearing credential is used, its top-level status is
-  not selectively disclosable and client verification fails closed unless the signed status is
-  valid at the exact trusted HTTPS origin.
-- Admin reload is non-functional standalone: Notary's admin reload route returns HTTP 501
-  (`registry.admin.capability.not_supported`) in the standalone router and performs no
-  reload. Runtime configuration changes require deploying a signed local bundle and
-  restarting the service.
+- Project approval remains a semantic control: Schemas and validators reject malformed
+  configuration, duplicate identifiers, and unsupported modes. They cannot decide whether an
+  institution selected the correct source fields, lawful purpose, derivation rule, or
+  disclosure default. Those decisions require project review and fixture evidence.
+- Admin reload is not a capability: Relay's admin surface is documented in its own generated
+  OpenAPI, and Evidence has no admin listener, reload route, or configuration apply path at
+  all. A configuration change is a new reviewed revision and a restart, in both cases.
 
 ## What is explicitly out of scope
 
 These are non-goals for this version. None of them should be read into a Registry Stack
 conformance claim:
 
-- Dynamic federation: Dynamic trust-chain discovery, audit checkpoint exchange, and
-  federated credential issuance are out of scope. Federation is static-peer only: not a
-  dynamic trust mesh. Production replay protection uses the typed Notary-owned PostgreSQL
-  state schema; explicit in-memory state is local and single-instance only.
-- Full Evidence Gateway / external-policy interoperability: Governed Relay PDP enforcement
-  covers only the supported Evidence Gateway PDP profile (`registry-evidence-gateway-pdp/v1`).
-  It is not full Evidence Gateway interoperability, not full OID4VCI issuer behavior, not
-  dynamic external policy discovery, and not enforcement of ODRL terms outside the supported
-  profile. Unsupported ODRL terms or invalid policy identity fail closed.
-- A full credential issuer: The OID4VCI surface is a registry-backed, issuer-initiated
-  pre-authorized subset, not a full issuer or general external-wallet interoperability.
-  Notary advertises `openid4vci.support: not_full_issuer`. It does not claim wallet-facing
-  authorization code, a public nonce endpoint, response next nonce, issuance from caller-provided evidence,
-  ES256 holder proof, EUDI, HAIP, PAR, DPoP, or wallet attestation.
-- Certified standards compliance: Aligning with a standard is not conforming to it:
-  speaking the shape of OIDC, OAuth 2.0, SD-JWT VC, OID4VCI, CCCEV, W3C DID, or the rest does
-  not certify conformance to any of them, and CCCEV-shaped output is not conformant to CCCEV
-  2.00.
-- Feature-gated surfaces of other builds: Several runtime surfaces (the OGC API
-  Features/Records/EDR adapters and SP DCI sync) are feature-gated and mount only when the
-  build is configured with the matching Cargo feature. Do not infer their presence from the
-  route catalog of a different build. Admin routes run on
-  a separate optional listener and are documented in the generated OpenAPI, but standalone mode
-  does not implement runtime config reload; it returns HTTP 501.
+- A credential lifecycle: Evidence's SD-JWT VC output is a second serialization of the same
+  stateless assertion under a frozen profile. There is no issuance session, holder binding
+  ceremony, status list, revocation, presentation verification, or persisted credential state,
+  and an optional caller-supplied holder key is echoed unverified into a confirmation claim
+  rather than proved.
+- Delegated or federated evaluation between peers: no service in this model evaluates a
+  question on another deployment's behalf, and there is no trust-chain discovery, peer
+  registry, or cross-institution evaluation route.
+- Identity resolution: lookup is match, no-match, or ambiguous. Evidence is not an
+  identity-resolution or record-linkage engine and returns no candidate material.
+- Cross-verifier credential use: the subject binding is audience-scoped, so an assertion is
+  meaningful to one relying party and correlatable across none.
+- Full external-policy interoperability: governed Relay PDP enforcement covers only the one
+  supported PDP profile (`registry-evidence-gateway-pdp/v1`). It is not dynamic external policy
+  discovery and not enforcement of ODRL terms outside that profile. Unsupported terms or
+  invalid policy identity fail closed.
+- Certified standards compliance: Aligning with a standard is not conforming to it. Speaking
+  the shape of OIDC, OAuth 2.0, SD-JWT VC, CCCEV, or the rest does not certify conformance to
+  any of them, and CCCEV-shaped output is not conformant to CCCEV 2.00.
+- Feature-gated surfaces of other builds: Several Relay runtime surfaces (the OGC API
+  Features, Records, and EDR adapters and SP DCI sync) are feature-gated and mount only when
+  the build is configured with the matching Cargo feature. Do not infer their presence from the
+  route catalog of a different build.
+- Non-Unix targets: Evidence Version 1 supports Unix targets only, because its secret and
+  audit invariants depend on owner, mode, no-follow, link-count, and open-file identity checks.
 
 ## Related
 
 - [RS-SEC-G](../../spec/rs-sec-g/): the security model
-- [RS-PR-NOTARY](../../spec/rs-pr-notary/), [RS-PR-RELAY](../../spec/rs-pr-relay/): protocol contracts
+- [RS-PR-EVIDENCE](../../spec/rs-pr-evidence/), [RS-PR-RELAY](../../spec/rs-pr-relay/):
+  protocol contracts
 - [RS-ARC-G](../../spec/rs-arc-g/): the two-layer architecture
-- [RS-DM-CLAIM](../../spec/rs-dm-claim/): claim definitions and disclosure
+- [Evidence security model](../../security/evidence/): the invariant matrix and its tests
 - [Harden a production deployment](../../security/hardening-checklist/): hardening procedures
-- [Security overview](../../security/): the trust posture summary
 - [Data minimization and purpose limitation](../data-minimization-and-purpose-limitation/)
diff --git a/docs/site/src/content/docs/explanation/trusted-context-constraints.mdx b/docs/site/src/content/docs/explanation/trusted-context-constraints.mdx
index c91138d0e..3689f5acc 100644
--- a/docs/site/src/content/docs/explanation/trusted-context-constraints.mdx
+++ b/docs/site/src/content/docs/explanation/trusted-context-constraints.mdx
@@ -1,11 +1,12 @@
 ---
 title: Trusted context constraints
-description: Explains how Relay and Notary preserve legal basis, consent, jurisdiction, assurance, and freshness context across their separate policy boundaries.
+description: How Registry Relay and Evidence each preserve policy facts such as legal basis, consent, jurisdiction, assurance, and source freshness at their own separate boundaries.
 status: current
 owner: registry-docs
 source_repos:
   - registry-stack
-last_reviewed: "2026-06-24"
+  - registry-evidence
+last_reviewed: "2026-08-04"
 doc_type: explanation
 locale: en
 standards_referenced:
@@ -13,22 +14,32 @@ standards_referenced:
 ---
 
 Trusted context constraints are policy facts whose meaning must survive the boundary between a
-caller, Registry Notary, Registry Relay, and a source registry. Registry Platform supplies shared
-types and redacted reporting conventions. Each product still owns the decision made at its own
-boundary.
+caller, the product that answers the caller, and the source registry behind it. Registry Platform
+supplies shared types and redacted reporting conventions to the products that use them. Each
+product still owns the decision made at its own boundary.
+
+Read one thing before the rest: Registry Relay and Evidence do not share an authorization model.
+No service in this stack authorizes a caller and then consults another service on its behalf.
+Evidence enforces its own boundary, and when it reads a Relay-protected API it does so as an
+ordinary fixed HTTP source, no differently from any other client of that API.
 
 ## The shared vocabulary
 
-The shared policy vocabulary covers five families:
+Registry Platform's policy vocabulary covers five families:
 
 - Legal basis records why the requested operation is permitted.
 - Consent records whether a trusted consent reference is required and accepted.
-- Jurisdiction limits where the request or evidence can be used.
+- Jurisdiction limits where the request can be used.
 - Assurance records the accepted assurance level and the trusted context that supplied it.
 - Source freshness limits the accepted age of an observation.
 
-Sharing names and report shapes does not make Relay and Notary interchangeable. It prevents a
-constraint from being silently renamed or weakened as a request crosses products.
+That vocabulary lives in `registry-platform-pdp` and is reported through `registry-config-report`.
+Registry Relay uses it. Evidence does not: Evidence enforces its own constraints under its own
+frozen contract names, which are described below and specified in
+`products/evidence/contracts/`.
+
+Sharing names and report shapes does not make two products interchangeable. Where the vocabulary is
+shared, it prevents a constraint from being silently renamed or weakened.
 
 ## Relay owns source context
 
@@ -44,26 +55,56 @@ declares that meaning and its fixtures prove it.
 If the observation-time contract is not proven, diagnostics must report it as unknown. They must
 not reinterpret a domain date as source freshness.
 
-## Notary owns evidence authorization
-
-Notary authenticates the evidence caller and enforces the compiled service purpose, required
-scopes, subject binding, legal basis, consent, jurisdiction, assurance, disclosure, and issuance
-policy before consulting Relay. A failed preflight makes zero Relay calls.
-
-For a registry-backed claim, Notary can invoke only the compiler-pinned Relay consultation named
-by its evidence mode. The pinned profile fixes the contract hash, purpose, closed input mapping,
-outcome union, and typed outputs. Notary does not configure a source origin, credential, lookup
-recipe, freshness field, or adapter runtime.
-
-Subject access constrains the authenticated requester and subject. It does not
-replace the Relay observation contract or provide claim evidence.
+## Evidence owns its own boundary
+
+Evidence authenticates the caller itself. It validates the bearer token against exactly one
+configured issuer with exact audience, token type, and algorithm allowlists, and it reads the
+principal from one configured claim with no `client_id`, `azp`, header, or request fallback.
+Unsigned headers and caller request fields never substitute for authenticated authority, even
+behind a gateway (invariant `V1-I04`,
+[Evidence operator contract](../../products/registry-evidence/operator-contract/)).
+
+Authorization is a single decision, not a series of separately satisfied checks. One exact
+entitlement match binds requester, optional actor, requirement revision, purpose, every
+role/selector-profile/value-origin tuple, subject authority, and audience together, and it happens
+before audit, credential resolution, or source access. A request that does not match completely
+contacts no source at all (invariant `V1-I05`).
+
+Two consequences of that decision are worth stating separately, because they are the places where
+authorization is most often assumed rather than enforced:
+
+- A selector is a provider-lookup input, never proof of authority. Selector validation happens
+  inside an already matched subject-authority path, so holding an identifier or a demographic tuple
+  does not entitle a caller to ask about that subject (invariant `V1-I06`).
+- A consent, approval, or grant reference supplied by the caller never creates authority. Grant
+  identifiers are accepted only from authenticated context and must be bound to the complete
+  entitlement (invariant `V1-I07`).
+
+Evidence does not pin a Relay consultation by contract hash, and it has no notion of a compiled
+evidence mode selecting one. It declares an HTTP source with a fixed origin, method, fixed or
+selector-bound path, fixed non-secret headers, denied redirects, and client-side response
+projection, all executed by the core rather than by a script (invariant `V1-I09`). If that origin
+happens to be a Relay-protected API, Relay evaluates its own policy against the request Evidence
+makes, under the credentials Evidence was configured with. Neither product sees the other's
+authorization decision.
+
+## Freshness has no Evidence counterpart
+
+An assertion carries `observedAt`, which is when Evidence evaluated the requirement. It is not a
+source-declared observation time, and Evidence Version 1 has no source freshness family: there is
+no maximum accepted observation age, no freshness field, and no configuration for one. The request
+nonce is uninterpreted correlation data and is explicitly not a freshness proof
+(`products/evidence/contracts/cccev-field-mapping.yaml`).
+
+A deployment that needs an age bound on the underlying record has to obtain it from the source
+contract on the Relay side. An assertion on its own does not carry one.
 
 ## Reports and audit evidence
 
-Product diagnostics expose bounded policy summaries and may include a `context_constraints`
-array. An empty array means that the configuration has no additional shared constraint block to
-report. It does not mean authentication, purpose, scope, consultation pinning, or product-owned
-policy is disabled.
+Registry Relay diagnostics expose bounded policy summaries and include a `context_constraints`
+array. An empty array means the configuration has no additional shared constraint block to report,
+which is what Relay reports today. It does not mean authentication, purpose, scope, or
+product-owned policy is disabled.
 
 Reports may identify the policy family, product-owned config location, trusted value class, and
 whether a presence or allow-list check was applied. They must not expose Relay source credentials,
@@ -75,14 +116,16 @@ distinct from an assurance value asserted in authorization context.
 
 ## Review questions
 
-- Does Notary reject an unauthorized request before any Relay consultation?
-- Does the compiled Notary contract exactly match the Relay consultation semantics and hash?
 - Is source freshness derived from a proven Relay observation contract rather than a domain date?
+- Does Evidence deny an unauthorized request before it contacts any source?
+- Is every dimension of the Evidence entitlement matched as one decision rather than one at a time?
+- Where Evidence reads a Relay-protected API, is Relay's own policy still evaluated for the
+  credentials Evidence presents?
 - Are reports bounded and redacted at both product boundaries?
-- Does every claim retain a compiler-pinned Relay observation contract?
 
 ## Related pages
 
-- [Evidence issuance, end to end](../evidence-issuance/)
+- [Disclosure modes and computed answers](../disclosure-modes-and-computed-answers/)
+- [Consultation flow](../consultation-flow/)
 - [Integration patterns](../integration-patterns/)
 - [Contracts](../../reference/contracts/)
diff --git a/docs/site/src/content/docs/generated-artifacts/index.mdx b/docs/site/src/content/docs/generated-artifacts/index.mdx
index f8088c563..6f6afc076 100644
--- a/docs/site/src/content/docs/generated-artifacts/index.mdx
+++ b/docs/site/src/content/docs/generated-artifacts/index.mdx
@@ -6,8 +6,7 @@ owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-27"
+last_reviewed: "2026-08-03"
 doc_type: explanation
 locale: en
 standards_referenced: []
@@ -32,9 +31,8 @@ Never repair a result by editing generated product configuration.
 | `.registry-stack/build/<environment>/reviewable/` | Value-free material for human review | Registryctl generates; reviewer inspects |
 | `.registry-stack/build/<environment>/signing-inputs/relay-public/` | Unsigned public Relay lane | Registryctl generates; Relay signer approves |
 | `.registry-stack/build/<environment>/signing-inputs/relay-consultation/` | Unsigned consultation Relay lane | Registryctl generates; Relay signer approves |
-| `.registry-stack/build/<environment>/signing-inputs/notary/` | Unsigned Notary lane | Registryctl generates; Notary signer approves |
 
-The three signing inputs stay independent.
+The two signing inputs stay independent.
 An approved baseline set locates their signed bundles and anchors, but does not
 become another signature or activation authority.
 
diff --git a/docs/site/src/content/docs/index.mdx b/docs/site/src/content/docs/index.mdx
index 10a501dab..ecf0a0a27 100644
--- a/docs/site/src/content/docs/index.mdx
+++ b/docs/site/src/content/docs/index.mdx
@@ -1,46 +1,52 @@
 ---
 title: Registry Stack documentation
-description: Start a registry from a spreadsheet, expose bounded evidence, or connect an existing registry.
+description: Answer a bounded question with Evidence, start a registry from a spreadsheet, or connect an existing registry.
 status: current
 owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-31"
+last_reviewed: "2026-08-03"
 doc_type: explanation
 locale: en
 standards_referenced: []
 ---
 
-Registry Stack helps an institution expose selected registry data through
-Registry Relay and bounded evidence through Registry Notary without giving
-callers direct access to the source.
+Registry Stack helps an institution answer questions about data it already
+holds without giving callers direct access to the source. Two doors: Evidence
+signs the answer to one bounded question, and Registry Relay exposes selected
+records through a protected read-only API.
+
+## Answer a bounded question with Evidence
+
+Use Evidence when the caller needs to learn only a fact, not to read a record.
+It answers one bounded question about one subject and signs the answer,
+releasing the answer rather than the row behind it. Adult status, residence
+region, professional licence status, and legal-parent relationship are coequal
+acceptance definitions; you author whichever one your institution needs, the
+same way.
+
+[Evidence overview](start/evidence-quickstart/) explains the source, assertion,
+verification, and audit boundaries. Continue with
+[your first Evidence assertion](tutorials/first-evidence-assertion/) to see the
+boundary in one verified request. When local authoring is complete,
+[build and deploy an Evidence project](tutorials/build-and-deploy-evidence-project/) creates a
+reviewed candidate without promoting local development state. Registry Mint remains an optional
+token issuer for deployments without a suitable identity provider.
 
 ## Start a registry from a spreadsheet
 
 Use the maintained spreadsheet path when the institution has a workbook or
 can prepare a reviewed workbook derivative.
-The first run starts Registry Relay and Registry Notary over the shipped
-synthetic workbook. It records a live authorization denial and a minimized
-evidence result; the offline derived fixture supplies the zero-source-access
-evidence that a local file cannot count itself.
+The first run starts Registry Relay over the shipped synthetic workbook. It
+records a live authorization denial and a selected-field response; the offline
+derived fixture supplies the zero-source-access evidence that a local file
+cannot count itself.
 
 [Start a registry from a spreadsheet](tutorials/publish-spreadsheet-secured-registry-api/)
 takes about 20 minutes and uses released artifacts without a source checkout.
 After it works, [use your own spreadsheet](tutorials/use-your-spreadsheet/).
 
-## Expose bounded evidence
-
-The spreadsheet starter already includes one evidence service.
-Registry Relay performs the exact source lookup and sends only the field needed
-by the rule to Registry Notary.
-Notary returns predicate claims rather than the workbook row.
-
-[Expose evidence from a spreadsheet registry](tutorials/verify-claim-registry-api/)
-shows how to change that rule while preserving authorization, source, and
-disclosure boundaries.
-
 ## Connect an existing registry
 
 Use the HTTP path when the institution already operates a registry API.
@@ -56,13 +62,17 @@ the source requires authentication or response normalization.
 ## Keep the product boundaries clear
 
 Registry Relay owns source access and protected record surfaces.
-Registry Notary owns evidence evaluation and disclosure.
+Evidence owns bounded question answering, signing, and minimum disclosure, and
+runs independently of Relay; it can read a Relay API as one fixed HTTP source.
 The caller receives only the output authorized for that service.
 
-Both paths use the same authoring, offline test, disposable development, and
-build commands. The 1.0 project-local workbook path stops there. A governed
-deployment starts after an operator-managed HTTP source is bound, then
-continues through independent approval and package generation.
+Both registryctl paths, spreadsheet and HTTP, use the same authoring, offline
+test, disposable development, and build commands. The 1.0 project-local
+workbook path stops there. A governed deployment starts after an
+operator-managed HTTP source is bound, then continues through independent
+approval and package generation. Evidence is not one of those paths: Evidence
+has its own toolset and deployment project shape, covered by the
+[Evidence overview](start/evidence-quickstart/).
 
 ## Move beyond the first run
 
@@ -70,4 +80,3 @@ continues through independent approval and package generation.
 - [Prepare an operator handoff](operate/)
 - [Review the architecture](explanation/architecture/)
 - [Review security boundaries](security/)
-- [Cut over a pre-1.0 project](start/pre-1.0-cutover/)
diff --git a/docs/site/src/content/docs/map/boundaries-and-map.mdx b/docs/site/src/content/docs/map/boundaries-and-map.mdx
index 23ec94f73..cd2facd32 100644
--- a/docs/site/src/content/docs/map/boundaries-and-map.mdx
+++ b/docs/site/src/content/docs/map/boundaries-and-map.mdx
@@ -1,6 +1,6 @@
 ---
 title: Boundaries and map
-description: The four formal Registry Stack products, the separate Solmara Lab adopter demo, and the boundaries between them.
+description: The four formal Registry Stack products, the supporting token issuer, the separate Solmara Lab adopter demo, and the boundaries between them.
 wide: true
 status: current
 owner: registry-docs
@@ -8,9 +8,10 @@ source_repos:
   - registry-relay
   - registry-platform
   - registry-manifest
-  - registry-notary
+  - registry-evidence
+  - registry-mint
   - solmara-lab
-last_reviewed: "2026-06-20"
+last_reviewed: "2026-08-03"
 doc_type: explanation
 locale: en
 standards_referenced:
@@ -26,18 +27,22 @@ standards_referenced:
 import ProjectMap from '../../../components/ProjectMap.astro';
 
 The formal Registry Stack has four products with distinct responsibilities: Registry Platform,
-Registry Manifest, Registry Relay, and Registry Notary.
-Solmara Lab is a separate adopter project that demonstrates the four products together.
-Use this page to decide which repository owns a question before opening implementation docs,
+Registry Manifest, Registry Relay, and Evidence.
+Registry Mint is a supporting service beside them, issuing short-lived access tokens for deployments
+that have callers and no identity provider.
+Solmara Lab is a separate adopter project that demonstrates the products together.
+Use this page to decide which project owns a question before opening implementation docs,
 and to understand how the products and the external demo connect at runtime.
 
 <figure>
   <img src="../../images/registry-family-map.svg"
-       alt="Four formal Registry Stack products and the separate Solmara Lab adopter demo. Registry
-            Platform provides shared primitives. Registry Manifest compiles portable metadata.
-            Registry Relay binds metadata to runtime sources and exposes protected APIs. Registry
-            Notary evaluates claims and issues credentials. Solmara Lab runs published images of
-            the runtime services in demo topologies." />
+       alt="Four formal Registry Stack products, with Registry Mint as a supporting service and the
+            separate Solmara Lab adopter demo. Registry Platform provides shared auth, audit, HTTP,
+            crypto, SD-JWT, and test crates. Registry Manifest provides portable metadata contracts,
+            validation, and renderers. Registry Relay serves protected read-only APIs over sensitive
+            registry sources. Evidence answers one bounded question about one subject with a signed
+            assertion. Registry Mint issues the short-lived access tokens Evidence verifies. Solmara
+            Lab runs Relay, Evidence, and Mint together." />
 </figure>
 
 <ProjectMap />
@@ -47,7 +52,7 @@ and to understand how the products and the external demo connect at runtime.
 
 ## Flow across the stack
 
-For how the four products connect at runtime and how Solmara Lab demonstrates them, see the
+For how the products connect at runtime and how Solmara Lab demonstrates them, see the
 [architecture overview](../../explanation/architecture/).
 
 ## Ownership quick reference
@@ -57,7 +62,8 @@ For how the four products connect at runtime and how Solmara Lab demonstrates th
 | Which shared Rust crate owns auth helpers, OIDC verification, audit envelopes, HTTP security, outbound HTTP policy, crypto, SD-JWT VC helpers, or test fixtures? | [Registry Platform](https://github.com/registrystack/registry-stack) |
 | How is a CSV, XLSX, Parquet, or PostgreSQL source exposed as authorized entity routes? | [Registry Relay](../../products/registry-relay/) |
 | How is `metadata.yaml` validated or rendered into standards-facing artifacts? | [Registry Manifest](https://github.com/registrystack/registry-stack) |
-| How is a claim evaluated, delegated to a trusted Notary, or turned into an attestation or credential? | [Registry Notary](../../products/registry-notary/) |
+| How is one bounded question about one subject answered with a signed assertion that carries the answer and not the record? | [Evidence](../../products/registry-evidence/) |
+| How does a deployment with callers and no identity provider issue access tokens? | [Registry Mint](../../reference/mint/) |
 | How do the services run together in a local demo? | [Solmara Lab](https://github.com/registrystack/solmara-lab/blob/00cd51a2be4a405ef75d337ddcede0f9de134b1f/README.md) |
 
 Cross-project explanation, standards evidence, and contract indexes live in these docs (not in any one project repo).
@@ -72,8 +78,11 @@ Registry Platform is a shared crate workspace. It does not run a service or deci
 
 - Registry Relay route behavior, runtime source binding, metadata publication, or
   Relay-specific scope semantics.
-- Registry Notary claim definitions, evaluation rules, disclosure decisions, service routes, or
-  claim-to-credential mapping.
+- Evidence requirement definitions, authorization grants, disclosure decisions, service routes,
+  assertion construction, or signing policy.
+  {/* Evidence: Rust in registry-evidence owns authentication, authorization, fixed source
+       execution, output validation, evidence construction, signing, and audit; the platform
+       crates it consumes are listed in crates/registry-evidence/Cargo.toml. */}
 - Operator responsibilities such as tenant isolation, audit retention, secret provisioning,
   deployment configuration, and incident response.
 
@@ -97,9 +106,9 @@ Registry Manifest is a pure library and CLI with no runtime data dependencies.
 - Production source configuration. Source paths, table IDs, scopes, cache paths, and backend
   runtime details belong in Registry Relay configuration, not in portable manifests.
   {/* Evidence: contracts.yaml, registry-manifest.metadata-yaml consumer note. */}
-- Runtime federation policy. Manifest can publish public Notary federation metadata, but peer
-  allowlists, signing keys, replay stores, purpose policy, and evaluation scopes belong in Registry
-  Notary config.
+- Evidence deployment configuration. An Evidence process loads one immutable governed bundle and
+  one closed runtime file mounted read-only at startup, and reads no portable manifest.
+  {/* Evidence: "Governed bundle and operator runtime", products/evidence/OPERATOR-CONTRACT.md. */}
 
 No HTTP serving, no database queries, no authorization scoping. The manifest compiles and renders only.
 
@@ -116,10 +125,12 @@ Registry Relay exposes protected read-only APIs over registry sources. It does n
   them for callers, but the schema is defined and versioned in Registry Manifest.
   {/* Evidence: crates/registry-manifest-core/README.md:7-9 at tag v0.9.0 (schema ownership);
        registry-relay evidence packet, metadata publication section. */}
-- Standalone claim service internals owned by Registry Notary. Registry Relay can declare
-  evidence offerings and route clients to a Registry Notary endpoint, but claim evaluation,
-  disclosure policy, and credential issuance run in Registry Notary.
-  {/* Evidence: registry-relay evidence packet, evidence offering verification section. */}
+- Assertion evaluation, disclosure, and signing owned by Evidence. Registry Relay can declare
+  evidence offerings and route clients onward, but requirement evaluation, disclosure form, and
+  signing run in Evidence, which reads a Relay API as one ordinary fixed HTTP source.
+  {/* Evidence: registry-relay evidence packet, evidence offering verification section; contract
+       registry.evidence.fixed-http-json-source/v1,
+       products/evidence/contracts/source-contract.yaml. */}
 - Shared auth, OIDC, audit, HTTP security, outbound HTTP, crypto, and SD-JWT helper primitives
   owned by Registry Platform. Registry Relay owns how those primitives are configured and
   enforced on Relay routes.
@@ -131,49 +142,75 @@ Registry Relay exposes protected read-only APIs over registry sources. It does n
 Registry Relay is not an open-data portal. It publishes restricted consultation APIs for authorized
 systems only. {/* Evidence: crates/registry-relay/README.md:16 at tag v0.9.0. */}
 
-## Registry Notary
-
-Registry Notary evaluates claims and issues SD-JWT VC credentials. It does not own:
-
-- Registry source access or adaptation. Registry Notary calls Registry Relay through a
-  compiler-pinned consultation contract for every claim. A Notary deployment
-  does not open a registry source directly.
-  Relay owns HTTP, script, and snapshot adaptation, including protocol helpers used by authored
-  integrations.
-- Portable metadata renderers owned by Registry Manifest. Registry Notary does not produce
-  DCAT, SHACL, BRegDCAT-AP, or OGC Records artifacts.
-  {/* Evidence: registry-notary evidence packet, standards not found in code section: "DCAT: no
-       data.europa.eu/r8g references", "OGC API Records: no OGC references". */}
-- Shared auth, OIDC, audit, HTTP security, outbound HTTP, crypto, SD-JWT, and testing primitives
-  owned by Registry Platform. Registry Notary owns the claim service behavior that composes
-  those primitives.
-- Open federation, dynamic trust-chain discovery, shared replay storage, audit checkpoint
-  exchange, or federated credential issuance. The current federation implementation is
-  static-peer delegated evaluation only.
-  {/* Evidence: FederationRuntimeState::from_config iterates config.peers with no dynamic
-       discovery path, crates/registry-notary-server/src/federation/runtime.rs:32-50 at
-       tag v0.9.0. */}
-- Registry Notary does not inspect published discovery artifacts, parse DCAT catalogs, or run
-  capability queries.
-
-Registry Notary credentials are SD-JWT VC format (`application/dc+sd-jwt`), not W3C Verifiable
-Credentials Data Model JSON-LD envelopes. No W3C VC Data Model namespace or `@context` is present
-in the issued credential.
-{/* Evidence: registry-notary evidence packet, credential issuance section, "W3C Verifiable
-     Credentials Data Model: NOT PRESENT". */}
+## Evidence
+
+Evidence answers one bounded question about one subject and returns a signed assertion carrying the
+answer rather than the record. It does not own:
+
+- Source access as a general capability. Each evaluation makes exactly one fixed, bounded HTTP JSON
+  request with a fixed method, a fixed or selector-bound path, fixed non-secret headers, denied
+  redirects, and a client-side response projection. Pagination, transport retry, multi-source
+  fulfillment, and source-planning scripts are outside the Version 1 contract.
+  {/* Evidence: contract registry.evidence.fixed-http-json-source/v1,
+       products/evidence/contracts/source-contract.yaml (frozen). */}
+- Record lookup and identity resolution. The authoritative provider owns lookup. Evidence accepts
+  only `match`, `no_match`, or `ambiguous`, and does not score candidates, choose a provider record,
+  or expose counts, near-match hints, or per-field diagnostics.
+  {/* Evidence: "Source and selector controls", products/evidence/OPERATOR-CONTRACT.md. */}
+- Portable metadata renderers owned by Registry Manifest. Evidence produces no DCAT, SHACL,
+  BRegDCAT-AP, or OGC Records artifacts and consumes no manifest.
+- Shared auth, OIDC, audit, HTTP security, crypto, SD-JWT, and testing primitives owned by Registry
+  Platform. Evidence owns the assertion behavior that composes those primitives.
+  {/* Evidence: crates/registry-evidence/Cargo.toml depends on registry-platform-audit, -crypto,
+       -httpsec, -httputil, -oidc, and -sdjwt, and on no other product crate. */}
+- Token issuance and identity proofing. Evidence verifies access tokens under one reviewed OIDC
+  profile with exactly one trusted issuer; it issues none. Registry Mint issues them for a
+  deployment with no identity provider.
+  {/* Evidence: "Supported deployment", products/evidence/OPERATOR-CONTRACT.md. */}
+- Consumer decisions. Requirements, eligibility, ranking, approval, routing, payment, workflow, and
+  action policy stay with the accountable decision owner. Evidence is not a workflow, orchestration,
+  or case-management engine and not a runtime policy engine or general PDP.
+  {/* Evidence: Version 1 non-goals, products/evidence/CONCEPT.md section 4. */}
+- A credential lifecycle. Version 1 has no issuance session, holder binding ceremony, status list,
+  revocation, or presentation verification, and no federated or delegated evaluation between peers.
+  {/* Evidence: Version 1 non-goals, products/evidence/CONCEPT.md section 4; "Response formats",
+       products/evidence/OPERATOR-CONTRACT.md. */}
+
+The default Evidence response is a flattened JWS JSON assertion (`application/jose+json`), not a W3C
+Verifiable Credentials Data Model JSON-LD envelope. An SD-JWT VC serialization
+(`application/dc+sd-jwt`) of the same stateless assertion is releasable only where the immutable
+bundle and the one matched authority grant both name that format, under the frozen profile in
+`products/evidence/contracts/sd-jwt-vc-profile.yaml`. That profile adds a response format, never a
+credential lifecycle.
+
+## Registry Mint
+
+Registry Mint issues short-lived access tokens to registered machine clients so a deployment with no
+identity provider still has one. It does not own:
+
+- End-user authentication, identity proofing, or consent. Registry Mint authenticates registered
+  machine clients through `private_key_jwt`, not people.
+- Caller-declared authority. Token authority is written from the client registry and never from the
+  caller's own request.
+- Evidence authorization. Evidence independently verifies the token and re-authorizes every request
+  against its own bundle and authority grants.
+
+{/* Evidence: contract status and stable properties, docs/site/src/content/docs/reference/mint.mdx,
+     sourced from crates/registry-mint/src/clients.rs and crates/registry-mint/src/token.rs;
+     one-way dependency, crates/registry-mint/Cargo.toml dev-dependencies. */}
 
 ## Solmara Lab
 
 Solmara Lab is a separately maintained adopter demo for the fictional Republic of Solmara.
-It runs published Registry Stack images in local and hosted topologies, but it is not a formal
+It runs Relay, Evidence, and Mint together in local and hosted topologies, but it is not a formal
 Registry Stack product. It does not own:
 
 - Production deployment guidance. The demo uses generated synthetic data and demo configuration.
   It is not a reference for production configuration.
   {/* Evidence: the pinned Solmara Lab README linked in the ownership table and
        src/data/projects.yaml, solmara-lab does_not_own "Production deployment guidance". */}
-- Normative API or metadata contracts. API contracts are owned by Registry Relay and Registry
-  Notary; metadata contracts are owned by Registry Manifest.
+- Normative API or metadata contracts. API contracts are owned by the runtime services; metadata
+  contracts are owned by Registry Manifest.
   {/* Evidence: src/data/projects.yaml, solmara-lab does_not_own. */}
 - Real product integrations. The services simulate civil, social protection, and health
   registry patterns but are not real integrations with OpenCRVS, OpenSPP, DHIS2, OpenIMIS,
@@ -189,5 +226,5 @@ When a page needs both, these docs summarize the decision and link to the owning
 
 ## Next
 
-- [Architecture overview](../../explanation/architecture/): how the four formal products connect
+- [Architecture overview](../../explanation/architecture/): how the formal products connect
   at runtime and how the separate Solmara Lab demo consumes them.
diff --git a/docs/site/src/content/docs/operate/advanced/compare-and-reapprove-source-change.mdx b/docs/site/src/content/docs/operate/advanced/compare-and-reapprove-source-change.mdx
index 0bba9ac21..d39035430 100644
--- a/docs/site/src/content/docs/operate/advanced/compare-and-reapprove-source-change.mdx
+++ b/docs/site/src/content/docs/operate/advanced/compare-and-reapprove-source-change.mdx
@@ -1,19 +1,18 @@
 ---
-title: Compare and approve an evidence change
-description: Test an evidence change, identify affected product lanes, assemble the next approved set, and regenerate the deployment package.
+title: Compare and approve a source change
+description: Test a Relay source or consultation change, identify affected product lanes, assemble the next approved set, and regenerate the deployment package.
 status: current
 owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-30"
+last_reviewed: "2026-08-04"
 doc_type: how-to
 locale: en
 standards_referenced: []
 ---
 
-Use this procedure to add or change an integration, consultation, claim, credential profile,
+Use this procedure to add or change an integration, consultation, attribute release profile,
 environment, or fixture in an existing governed Registry Stack deployment.
 
 ## When to use this
@@ -21,14 +20,15 @@ environment, or fixture in an existing governed Registry Stack deployment.
 Use this flow after a product baseline has been approved and deployed.
 It preserves unchanged product lanes and identifies the lanes that need new review and signatures.
 
-A typical new external evidence integration changes:
-
-- `relay-consultation`, which owns source access and minimized consultation output
-- `notary`, which owns claims, disclosure, rendering, issuance, and signing
+A typical new external source integration changes `relay-consultation`, which owns source access
+and minimized consultation output.
 
 `relay-public` changes only when the public records surface or its materialization also changes.
 Registryctl computes the affected set from the reviewed authored and generated closures.
 
+A project has exactly two product lanes, `relay-public` and `relay-consultation`, and no signing,
+assembly, or deployment step accepts any other lane name.
+
 ## Ownership and trust boundary
 
 The country implementer owns authored project changes.
@@ -71,11 +71,10 @@ Resolve a stale or invalid result before combining that condition with an eviden
 Edit the smallest authored surface that expresses the new contract:
 
 1. Update the integration and its wholly synthetic fixtures.
-2. Update the evidence service consultation, claims, disclosure, or credential profile when
-   Notary behavior changes.
+2. Update the consultation and its attribute release profiles when the minimized output changes.
 3. Update the environment only for deployment-specific source origins, secret references, trust,
    and resource bindings.
-4. Keep consumer eligibility, ranking, workflow, and action policy outside the evidence service.
+4. Keep consumer eligibility, ranking, workflow, and action policy outside the deployment.
 
 Do not widen an origin, method, path wildcard, credential, output, source-call count, byte limit,
 or deadline merely to make a fixture pass.
@@ -100,8 +99,8 @@ Validate the complete effective plan:
 registryctl check --explain
 ```
 
-Review the source authority, secret consumers, input mapping, outputs, claims, disclosure, and
-bounds.
+Review the source authority, secret consumers, input mapping, outputs, attribute release
+profiles, and bounds.
 
 Compare with the approved set:
 
@@ -136,7 +135,7 @@ and reviewed closure.
 ## Sign each affected lane
 
 The owning signer signs each affected lane into a new digest-specific directory.
-For a typical consultation and claim change:
+For a typical consultation change:
 
 ```sh
 registryctl trust bundle sign \
@@ -146,13 +145,6 @@ registryctl trust bundle sign \
   --key file:./keys/relay-consultation.private.jwk \
   --against ./approved-set.v1.json \
   --output-dir ./approved/relay-consultation-next
-registryctl trust bundle sign \
-  --lane notary \
-  --input ./.registry-stack/build/production/signing-inputs/notary \
-  --anchor ./trust/notary.anchor.json \
-  --key file:./keys/notary.private.jwk \
-  --against ./approved-set.v1.json \
-  --output-dir ./approved/notary-next
 ```
 
 Use an explicitly supported key locator.
@@ -170,7 +162,6 @@ Assemble the replacements with verified unchanged lanes:
 registryctl trust approved-set assemble \
   --from ./approved-set.v1.json \
   --relay-consultation ./approved/relay-consultation-next \
-  --notary ./approved/notary-next \
   --output-file ./approved-set.next.v1.json
 ```
 
@@ -217,7 +208,8 @@ Do not automatically roll back to an older sequence.
 
 The runbook stops externally reachable dependents before a potentially incompatible private-lane
 change, starts and verifies affected dependencies, then resumes dependents.
-A mixed consultation Relay and Notary contract must fail before source access.
+A consultation Relay whose accepted configuration disagrees with the package must fail before
+source access.
 
 ## Verify the result
 
@@ -227,7 +219,7 @@ After the update:
 2. Run each product-owned `verify_state` action from the generated runbook.
 3. Check value-free health and readiness.
 4. Exercise an authorized synthetic evaluation with an operator-owned request file.
-5. Confirm the changed claim and minimized output without recording source values.
+5. Confirm the changed attribute release and minimized output without recording source values.
 6. Confirm the operator-owned application and include graph remain separate from the package.
 
 Remove `generated.previous/` only when the generated runbook says the new acceptance is complete.
@@ -281,7 +273,7 @@ Its package result does not extend to application services or the include graph.
 Stop the update and involve the owning product and security reviewers when:
 
 - Authorization denial performs token or source work
-- A mixed Relay and Notary interface reaches source access
+- A cross-lane interface mismatch reaches source access
 - A secret or private key appears in retained output
 - Product state reports an unexpected lane identity, sequence, anchor, or configuration hash
 - Package verification reports `invalid`
diff --git a/docs/site/src/content/docs/operate/advanced/index.mdx b/docs/site/src/content/docs/operate/advanced/index.mdx
index afc3d84d0..5e174eafa 100644
--- a/docs/site/src/content/docs/operate/advanced/index.mdx
+++ b/docs/site/src/content/docs/operate/advanced/index.mdx
@@ -6,9 +6,8 @@ owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
   - registry-platform
-last_reviewed: "2026-07-26"
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced: []
@@ -33,13 +32,15 @@ Each guide names the evidence to retain, the limit of each gate, and a recovery
 
 - [Operate bounded Script workers and protocol helpers](operate-script-workers/)
 
-Registry Relay and Registry Notary activate separate product bundles.
-Stage Relay first, stage Notary against that Relay, and admit traffic only after both product
-boundaries pass.
+The public Relay lane and the consultation Relay lane activate separate product bundles, each
+with its own anchor, identity, and anti-rollback state.
+Neither serving workload depends on the other; only the consultation lane's state actions wait on
+a healthy PostgreSQL.
+Admit traffic to a lane only after that lane's product boundary passes.
 This sequence is compatible staged admission, not atomic project activation.
 
-{/* Evidence: products/notary/docs/configuration-trust-and-integrity.md and
-    products/notary/docs/deployment-hardening-runbook.md. */}
+{/* Evidence: crates/registryctl/src/deployment.rs and
+    docs/site/src/content/docs/operate/advanced/recover-upgrade-migrate-and-rollback.mdx. */}
 
 ## Next
 
diff --git a/docs/site/src/content/docs/operate/advanced/inspect-and-diagnose.mdx b/docs/site/src/content/docs/operate/advanced/inspect-and-diagnose.mdx
index 3e5eb1357..ea3485b38 100644
--- a/docs/site/src/content/docs/operate/advanced/inspect-and-diagnose.mdx
+++ b/docs/site/src/content/docs/operate/advanced/inspect-and-diagnose.mdx
@@ -1,27 +1,29 @@
 ---
 title: Inspect and diagnose a running deployment
-description: Inspect redacted runtime posture, audit, health, readiness, and instance OpenAPI, then classify failures with stable diagnostics.
+description: Inspect Relay, Evidence, and Registry Mint runtime posture, audit, health, readiness, and API shape, then classify failures with stable diagnostics.
 status: current
 owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
+  - registry-evidence
+  - registry-mint
   - registry-platform
-last_reviewed: "2026-07-26"
+last_reviewed: "2026-08-04"
 doc_type: how-to
 locale: en
 standards_referenced: []
 ---
 
-Use this procedure to inspect a running Relay or Notary instance and diagnose source denial,
-policy denial, ambiguity, stale materialization, bundle rejection, or product capability mismatch
-without collecting source rows or secret values.
+Use this procedure to inspect a running Relay, Evidence, or Registry Mint instance and diagnose
+source denial, policy denial, ambiguity, stale materialization, bundle rejection, or capability
+mismatch without collecting source rows or secret values.
 
 ## Prerequisites
 
 - Use the protected operator network and a least-privilege posture or API credential.
-- Know the active product, environment, stream, instance, and expected bundle sequence.
+- Know the active product, environment, stream, instance, and expected bundle sequence for Relay,
+  and the deployment revision for Evidence and Registry Mint.
 - Keep public problem responses, operator diagnostics, restricted posture, and protected audit
   records in separate access classes.
 - Reproduce with synthetic identifiers unless separate authority permits another probe.
@@ -32,7 +34,12 @@ Public problem details give callers stable, minimized classifications.
 The default posture tier is redacted for operational sharing.
 Restricted posture can contain per-resource or provider detail and belongs only to trusted
 operators.
-Relay and Notary write separate audit chains and keep their keys separate.
+Relay, Evidence, and Registry Mint each write their own audit or operational records and keep
+their own keys separate: Relay's redacted posture and audit sink, Evidence's keyed JSONL audit
+chain (`products/evidence/OPERATOR-CONTRACT.md`, Audit and operational data), and Registry Mint's
+keyed JSONL token-decision chain.
+
+No deployment exposes a cross-product posture view: each product reports only its own.
 
 The generated diagnostic catalogs contain static meanings, rules, remediation, evidence scope,
 and limitations.
@@ -41,8 +48,9 @@ hash, credential, source response, or country value.
 
 {/* Evidence: docs/site/src/content/docs/reference/diagnostics/operator.mdx,
     docs/site/src/content/docs/reference/errors.mdx,
-    crates/registry-relay/docs/ops.md, and
-    products/notary/docs/security-assurance.md. */}
+    crates/registry-relay/docs/ops.md,
+    products/evidence/OPERATOR-CONTRACT.md, and
+    docs/site/src/content/docs/reference/evidence-problems.mdx. */}
 
 ## Inspect the runtime surfaces
 
@@ -50,39 +58,39 @@ Inspect each surface for its own purpose:
 
 | Surface | Use | Boundary |
 | --- | --- | --- |
-| `GET /healthz` | Process liveness | Does not check all dependencies or data freshness |
-| `GET /ready` | Current traffic-admission readiness | Does not prove backup freshness or country approval |
-| `GET /admin/v1/posture` | Redacted deployment and control observations | Default and restricted tiers expose different detail |
-| Product audit sink | Security and request evidence | Retained chain integrity does not prove complete off-host receipt |
-| `GET /openapi.json` | Concrete API shape for the running instance | Access is product configuration and authentication dependent |
-
-For a CEL-backed Notary configuration, `/ready` counts only workers that
-completed the fixed CEL protocol probe. A missing, warming, sleeping, or
-wrong-protocol worker keeps readiness false. CEL-free configurations do not
-start a worker.
+| `GET /healthz` (Relay) or `GET /health` (Evidence, Registry Mint) | Process liveness | Does not check all dependencies or data freshness; Evidence's `/health` answers 200 even when a source credential is missing |
+| `GET /ready` | Current traffic-admission readiness | Does not prove backup freshness or country approval; Evidence checks its signing, audit, subject-binding, and source credentials, while Mint checks that clients exist and its audit writer is healthy |
+| `GET /admin/v1/posture` (Relay only) | Redacted deployment and control observations | Default and restricted tiers expose different detail; Evidence and Registry Mint have no equivalent admin posture endpoint |
+| Product audit records | Security and request evidence | Retained chain integrity does not prove complete off-host receipt; use `evidence verify-audit` for Evidence and `mint verify-audit` for Mint |
+| `GET /openapi.json` | Concrete API shape for the running instance | Relay's document is configuration and authentication dependent; Evidence's is the released generated artifact, unauthenticated and independent of the deployed bundle |
+| Evidence `GET /metrics` (only when `metricsListener` is configured) | Request-boundary counts and latency by route, method, status, and problem code | Absent unless configured; never serves evidence routes and reveals no request content |
 
 Query health and readiness through the same network path used by traffic admission:
 
 ```sh
 curl -fsS https://<relay-host>/healthz
 curl -fsS https://<relay-host>/ready
-curl -fsS https://<notary-host>/healthz
-curl -fsS https://<notary-host>/ready
+curl -fsS https://<evidence-host>/health
+curl -fsS https://<evidence-host>/ready
+curl -fsS https://<mint-host>/health
+curl -fsS https://<mint-host>/ready
 ```
 
 Read Relay posture only through its protected admin listener:
 
 ```sh
 curl -fsS \
-  -H "Authorization: Bearer <ops-read-token>" \
+  -H "Authorization: Bearer ${OPS_READ_TOKEN}" \
   http://127.0.0.1:8081/admin/v1/posture
 ```
 
-Fetch the concrete Relay or Notary instance OpenAPI only through its configured authenticated
-route.
-Compare the instance document with the reviewed generated input and the
-[Relay API reference](../../../reference/apis/registry-relay/) or
-[Notary API reference](../../../reference/apis/registry-notary/).
+Fetch the concrete Relay instance OpenAPI only through its configured authenticated route, and
+compare it with the reviewed generated input and the
+[Relay API reference](../../../reference/apis/registry-relay/).
+Evidence's `GET /openapi.json` needs no credential, because it always serves the same released
+generated artifact rather than a deployment-specific document
+(`products/evidence/OPERATOR-CONTRACT.md`, Startup and readiness); compare it with the
+[Evidence API reference](../../../reference/apis/registry-evidence/).
 An OpenAPI match does not prove authorization, source behavior, or claim semantics.
 
 ## Load the stable diagnostic catalogs
@@ -101,36 +109,54 @@ Use the generated [operator](../../../reference/diagnostics/operator/),
 Branch on the exact code and response status.
 Do not parse error prose, paths, or type URI segments.
 
+These catalogs cover Relay, `registryctl`, and shared platform operations; they do not enumerate
+Evidence or Registry Mint failures. Evidence's closed problem-code catalog is the
+[Evidence errors and problems reference](../../../reference/evidence-problems/) instead, and it
+needs no separate CLI catalog because the codes are fixed by the frozen public contract.
+
 ## Diagnose the failure class
 
 ### Source denial or source failure
 
 Separate caller authorization from upstream source access.
 Public `auth.*` codes describe Relay caller authentication and scope.
-`relay.consultation.activation.source_credentials_unavailable` and
-`notary.relay.credential_unavailable` describe activation boundaries.
-`notary.relay.credentials_rejected` describes a rejected Notary workload credential.
+`relay.consultation.activation.source_credentials_unavailable` describes a Relay activation
+boundary: Relay could not activate the source-credential capability its consultation registry
+needs at startup.
 Offline fixture failures such as `source.status_rejected`, `source.unavailable`, and
-`authorization.denied` classify synthetic source behavior.
+`authorization.denied` classify synthetic Relay source behavior.
+Evidence collapses every source-boundary failure (unreachable, timed out, wrong credential, wrong
+media type, an oversized response, malformed JSON, or an error envelope) into the single
+`dependency_unavailable` problem (`crates/registry-evidence/src/runtime.rs`,
+`source_failure_problem`; see the
+[Evidence errors and problems reference](../../../reference/evidence-problems/)).
 
 Confirm which boundary denied access before changing a credential or policy.
 Do not widen a source path or caller scope to clear a source credential failure.
 
 ### Policy denial
 
-Stable `pdp.*` codes identify policy decisions such as `pdp.purpose_not_permitted`,
-`pdp.assurance_insufficient`, and `pdp.evidence_stale`.
+Stable `pdp.*` codes identify Relay policy decisions such as `pdp.purpose_not_permitted`,
+`pdp.assurance_insufficient`, and `pdp.evidence_stale`; despite the shared word, `pdp.evidence_stale`
+is Relay's policy-decision-point code for stale source data
+(`crates/registry-platform-pdp/src/lib.rs`) and is unrelated to the Evidence product.
 Use the policy id, hash, checked rule ids, and other redacted audit evidence available to the
 authorized operator.
 Do not turn a policy denial into source unavailability or bypass the rule during diagnosis.
 
 ### Ambiguity
 
-`ambiguous` is a valid minimized consultation outcome, not an operator startup failure.
-The result carries no selected output map, and Notary must not choose a source record.
+`ambiguous` is a valid minimized outcome for a Relay consultation or attribute-release request,
+not an operator startup failure.
+The result carries no selected output map, and Relay must not choose a source record.
 Reproduce the selector and cardinality with synthetic fixtures.
 Use `source.cardinality_violation` only when the source behavior violates the declared fixture or
 decoder contract.
+Evidence applies the same discipline to a `POST /v1/evidence` request: an ambiguous match is one
+of the conditions the `evidence_not_available` problem collapses into a single value-free
+response, so timing and status code do not reveal which condition occurred
+(`products/evidence/OPERATOR-CONTRACT.md`, Source and selector controls; see the
+[Evidence errors and problems reference](../../../reference/evidence-problems/)).
 
 ### Stale materialization
 
@@ -145,30 +171,32 @@ cannot close this diagnosis.
 
 Use the shared stable results `rejected_signature`, `rejected_binding`,
 `rejected_validation`, and `rejected_rollback`.
-Product startup codes include:
+Relay's startup codes include:
 
 - `relay.startup.bundle_signature_rejected`
 - `relay.startup.bundle_binding_rejected`
 - `relay.startup.bundle_validation_rejected`
 - `relay.startup.bundle_rollback_rejected`
-- `notary.configuration.invalid`
-- `notary.runtime.activation_failed`
+
+Evidence and Registry Mint have no equivalent stable startup-rejection codes: `evidence check` and
+`mint check` fail with a descriptive message instead, covered in
+[Rotate Evidence signing keys](../../../tutorials/move-evidence-to-production-signing/#validate-and-coordinate-consumer-approval)
+and [Configure Registry Mint](../../../configure/mint/#troubleshooting).
 
 Correct the signer, binding, closed file set, product validation, or sequence.
 Do not disclose the rejected configuration or delete anti-rollback state.
 
-### Capability or Relay-to-Notary mismatch
+### Capability or activation mismatch
 
-Use `relay.consultation.activation.unsupported_plan`,
-`relay.consultation.activation.artifact_registry_invalid`,
-`notary.relay.profile_not_found`, and `notary.relay.profile_mismatch` for activation failures.
-The public admin code `registry.admin.capability.not_supported` means the requested admin
-capability is absent.
+Use `relay.consultation.activation.unsupported_plan` and
+`relay.consultation.activation.artifact_registry_invalid` for a Relay consultation-lane activation
+failure: Relay could not compile or activate the verified artifact registry its runtime needs at
+startup.
 
-Compare the generated capability inventory, public consultation contract, and exact
-`contract_hash`.
+Compare the generated capability inventory, the public consultation contract, and the exact
+`contract_hash` against what the running instance actually compiled.
 Relay rejects an execute-time contract mismatch before source access.
-Stage compatible product bundles separately and repeat the Notary-to-Relay check.
+Stage a compatible product bundle separately and repeat the check before returning it to traffic.
 
 ## Expected evidence
 
@@ -177,7 +205,11 @@ Retain:
 - Timestamped health and readiness status without response secrets.
 - Default redacted posture and restricted fields only in the protected operator record.
 - Stable public, operator, fixture, or authoring diagnostic codes.
-- Product, environment, stream, instance, and bundle sequence.
+- Product, environment, stream, instance, and bundle sequence for Relay.
+- Evidence's `operation` identifier from the problem response or `X-Request-Id` header, and the
+  output of `evidence verify-audit` when a signing or audit failure is suspected.
+- Registry Mint's operation identifier from its local log and the output of `mint verify-audit`
+  when a token-decision audit failure is suspected. Do not retain the assertion or access token.
 - Redacted audit correlation ids and the tested synthetic canary outcome.
 - The traffic-admission, quarantine, or escalation decision.
 
@@ -201,7 +233,7 @@ After a higher sequence or new correctness-state write, use a reviewed higher-se
 path unless the release documents safe rollback.
 
 For ambiguity, fix or narrow the reviewed selector or source data.
-Do not select a record manually inside Relay or Notary.
+Do not select a record manually inside Relay or Evidence.
 For stale materialization, follow the materialization recovery procedure without enabling live
 fallback.
 
@@ -219,3 +251,4 @@ anti-rollback state or runtime schemas.
 - [Refresh and recover a materialization](../refresh-and-recover-materialization/)
 - [Recover, upgrade, migrate, and roll back](../recover-upgrade-migrate-and-rollback/)
 - [Review the error and status code reference](../../../reference/errors/)
+- [Evidence errors and problems reference](../../../reference/evidence-problems/)
diff --git a/docs/site/src/content/docs/operate/advanced/operate-script-workers.mdx b/docs/site/src/content/docs/operate/advanced/operate-script-workers.mdx
index 668d6957e..e11b07df4 100644
--- a/docs/site/src/content/docs/operate/advanced/operate-script-workers.mdx
+++ b/docs/site/src/content/docs/operate/advanced/operate-script-workers.mdx
@@ -6,7 +6,7 @@ owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-last_reviewed: "2026-07-26"
+last_reviewed: "2026-08-03"
 doc_type: how-to
 locale: en
 standards_referenced: []
@@ -144,7 +144,8 @@ A source product or version label does not prove helper compatibility.
 Before traffic, restore the prior verified Relay bundle and matching worker artifact.
 After accepting a higher sequence, create a higher-sequence recovery bundle instead of deleting
 anti-rollback state.
-Keep Notary traffic blocked until the restored Relay contract matches Notary.
+Keep consultation traffic blocked until the restored Relay contract matches what its downstream
+consumer expects.
 
 If the worker is unavailable, repair the code-owned adjacent worker and process isolation.
 Do not configure an in-process fallback or grant the Script ambient network, filesystem,
diff --git a/docs/site/src/content/docs/operate/advanced/recover-upgrade-migrate-and-rollback.mdx b/docs/site/src/content/docs/operate/advanced/recover-upgrade-migrate-and-rollback.mdx
index ef6af98d6..9c2da2b59 100644
--- a/docs/site/src/content/docs/operate/advanced/recover-upgrade-migrate-and-rollback.mdx
+++ b/docs/site/src/content/docs/operate/advanced/recover-upgrade-migrate-and-rollback.mdx
@@ -6,8 +6,7 @@ owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-26"
+last_reviewed: "2026-08-03"
 doc_type: how-to
 locale: en
 standards_referenced: []
@@ -41,8 +40,8 @@ Registryctl generates and verifies `generated/`. It does not activate the packag
 coordinate backups, admit traffic, or decide recovery.
 
 The deployment operator owns `binding.yaml`, `operator/`, package retention, the
-complete recovery groups, traffic removal, and the manual abort decision. Relay,
-Notary, and PostgreSQL remain in the generated package's declared recovery groups. Do
+complete recovery groups, traffic removal, and the manual abort decision. Relay and
+PostgreSQL remain in the generated package's declared recovery groups. Do
 not copy product state, trust anchors, bundles, audit state, or anti-rollback files
 between lanes or instance identities.
 
@@ -58,8 +57,8 @@ must carry only reviewed authored intent.
 
 - For an ordinary restart, verify the exact current package and follow its ordinary
   stop, `verify_state`, and start commands.
-- For pre-1.0 authored intent, create a separate 1.0 project and follow the
-  [pre-1.0 cutover guide](../../../start/pre-1.0-cutover/).
+- For pre-1.0 authored intent, create a separate 1.0 project and copy only reviewed
+  authored intent into it.
 - For a product, image, or signed-lane update, generate and verify a fresh candidate
   package. Do not edit the current Compose model in place.
 - For state recovery, restore one complete recovery consistency group at the same or
@@ -82,7 +81,7 @@ The `relay-public-state` group preserves the public Relay lane, its package, app
 set, bundle, anchor, audit and anti-rollback state, source and materialization state,
 and exact instance, stream, and accepted sequence.
 
-The `consultation-state` group preserves consultation Relay, Notary, PostgreSQL, their
+The `consultation-state` group preserves consultation Relay, PostgreSQL, their
 package and signed inputs, audit and anti-rollback state, complete databases, role and
 key-lifecycle records, and exact instance, stream, and accepted sequences.
 
@@ -111,8 +110,7 @@ registryctl -C <candidate-directory> build
 ```
 
 Registry Stack 1.0 provides no automated pre-1.0 migration command or removed-command
-aliases. Follow the
-[pre-1.0 cutover guide](../../../start/pre-1.0-cutover/) for the full review boundary.
+aliases.
 
 ## Stage a restart or upgrade
 
@@ -124,14 +122,14 @@ target approved set.
 1. Verify current and candidate packages against their approved sets and externally
    recorded closure digests.
 2. Render both effective Compose models without resolving environment values.
-3. Verify operator files, every current and candidate bundle and anchor, and all three
+3. Verify operator files, every current and candidate bundle and anchor, and both
    current `verify_state` actions.
 4. Quiesce each affected recovery group and close its pre-change recovery record.
 5. Stop the current package with its generated Compose `down` command.
-6. From the candidate, stage operator secrets and run all three read-only
+6. From the candidate, stage operator secrets and run both read-only
    `verify_state` actions before ordinary startup.
 7. When a private-lane contract changed, start and verify PostgreSQL and consultation
-   Relay before Notary or any externally reachable dependant.
+   Relay before any externally reachable dependant.
 8. Start the remaining candidate services with the generated Compose `up --detach
    --wait --wait-timeout 120` command.
 9. Keep traffic blocked until product canaries, audit continuity, and every affected
diff --git a/docs/site/src/content/docs/operate/advanced/refresh-and-recover-materialization.mdx b/docs/site/src/content/docs/operate/advanced/refresh-and-recover-materialization.mdx
index 993ac72d8..95d324ab3 100644
--- a/docs/site/src/content/docs/operate/advanced/refresh-and-recover-materialization.mdx
+++ b/docs/site/src/content/docs/operate/advanced/refresh-and-recover-materialization.mdx
@@ -190,7 +190,7 @@ Relay remains fail closed. Restore the complete matching recovery set or escalat
 deleting another file to force reacquisition.
 
 {/* Evidence: crates/registry-relay/src/ingest/mod.rs and
-    crates/registry-relay/tests/live_consultation_journeys.rs. */}
+    crates/registry-relay/src/ingest/cache.rs. */}
 
 For other recovery cases, keep traffic blocked and restore the complete matching recovery set, or
 republish a reviewed source export and repeat the offline, reload, posture, and canary gates.
diff --git a/docs/site/src/content/docs/operate/advanced/rotate-credentials-and-trust.mdx b/docs/site/src/content/docs/operate/advanced/rotate-credentials-and-trust.mdx
index 456469891..08e4cf654 100644
--- a/docs/site/src/content/docs/operate/advanced/rotate-credentials-and-trust.mdx
+++ b/docs/site/src/content/docs/operate/advanced/rotate-credentials-and-trust.mdx
@@ -1,47 +1,57 @@
 ---
 title: Rotate credentials, keys, certificates, and trust
-description: Rotate Registry Relay and Registry Notary trust material while preserving product ownership, overlap, recovery, and staged traffic admission.
+description: Rotate Registry Relay, Evidence, and Registry Mint credentials, signing keys, and trust material without exposing secret material or widening authority.
 status: current
 owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
+  - registry-evidence
+  - registry-mint
   - registry-platform
-last_reviewed: "2026-07-31"
+last_reviewed: "2026-08-03"
 doc_type: how-to
 locale: en
 standards_referenced: []
 ---
 
-Use this procedure to rotate a source credential, caller key, Notary-to-Relay workload token,
-configuration signer, credential-issuance signer, certificate, or trust anchor without exposing
-secret material and without widening authority.
+Use this procedure to rotate a Relay source credential, Relay caller key, Relay certificate or
+trust anchor, an Evidence signing key, or a Registry Mint signing key or client key, without
+exposing secret material and without widening authority.
 
 ## Prerequisites
 
 - Identify the material, every consumer, its current secret or trust reference, and its expiry.
-- Preserve a verified recovery set for the current Relay and Notary product configurations.
-- Keep caller traffic outside the staged instances until the affected product checks pass.
+- Preserve a verified recovery set for the current Relay product configuration, and keep the
+  prior Evidence bundle revision and Registry Mint configuration file each rotation replaces.
+- Keep caller traffic outside the staged Relay instance until its checks pass; restart Evidence
+  and Registry Mint only after their own offline checks pass first.
 - Use synthetic or institution-approved canaries. Do not use personal data for a rotation probe.
 
 ## Ownership and trust boundary
 
 Registry Relay owns source destinations, source credentials, private certification authority
 material, mutual TLS keys, source protocol credentials, and Relay caller keys.
-Registry Notary owns its Relay workload token, Notary caller policy, and evidence-signing keys.
+Evidence owns its signing key, audit hash secret, and subject-binding secret, each resolved
+through its own owner-only secret root (`products/evidence/OPERATOR-CONTRACT.md`, Secrets and
+keys).
+Registry Mint owns its own signing key and its client registry: one public key and one granted
+authority per registered client.
 The deployment operator owns secret storage, certificates, product trust anchors, traffic
 admission, and revocation.
 
 Configuration signing keys and trust anchors are product-specific.
-Relay and Notary bundles have separate signatures, anchors, anti-rollback state, and activation
-events.
-A combined project has no signed project-root bundle or atomic activation coordinator.
-
-{/* Evidence: products/notary/docs/configuration-trust-and-integrity.md,
-    products/platform/docs/governed-configuration.md,
-    crates/registry-relay/docs/ops.md, and
-    products/notary/docs/signing-key-provider.md. */}
+Relay's two lanes, `relay-public` and `relay-consultation`, have separate signatures, anchors,
+anti-rollback state, and activation events, built and verified through `registryctl`.
+Evidence and Registry Mint have no `registryctl`-governed bundle or trust-anchor system of their
+own: Evidence validates its governed bundle and runtime file with `evidence check`, and Registry
+Mint validates its configuration with `mint check`, and neither participates in Relay's
+approved-set or anti-rollback lineage.
+
+{/* Evidence: products/evidence/OPERATOR-CONTRACT.md,
+    crates/registry-relay/docs/ops.md,
+    docs/site/src/content/docs/tutorials/move-evidence-to-production-signing.mdx, and
+    docs/site/src/content/docs/configure/mint.mdx. */}
 
 ## Classify the rotation
 
@@ -54,12 +64,16 @@ A combined project has no signed project-root bundle or atomic activation coordi
 3. Decide whether the change remains in the secret plane or changes a governed reference.
    A secret-plane change retains the reviewed reference and replaces the value through the
    secret provider.
-   A governed change produces a reviewed product configuration and a new signed product bundle.
+   For Relay, a governed change produces a reviewed product configuration and a new signed
+   product bundle through `registryctl`. For Evidence and Registry Mint, a governed change edits
+   the bundle or configuration file directly, then runs `evidence check` or `mint check` before
+   the next restart.
 
-The [Notary deployment hardening runbook](../../../products/registry-notary/deployment-hardening-runbook/)
-defines the incident boundary.
 The [Relay operations runbook](../../../products/registry-relay/ops/) defines Relay API-key and
 runtime-secret rotation.
+[Evidence security model](../../../security/evidence/) traces Evidence's secret and signing-key
+invariants to their tests, and `products/evidence/OPERATOR-CONTRACT.md` defines the incident
+boundary for a suspected key or audit-secret exposure.
 
 ## Rotate source credentials, certificates, or source trust
 
@@ -88,9 +102,12 @@ runtime-secret rotation.
    window closes.
 
 Private CA and mutual TLS changes stay in Relay.
-Do not copy source certificates, keys, or destinations into a Notary bundle.
+Do not copy source certificates, keys, or destinations into the Evidence bundle: Evidence sources
+declare their own `tlsTrustProfile` bound to a separate PEM file in `runtime.yaml`
+(`docs/site/src/content/docs/configure/evidence.mdx`), and mixing the two namespaces will not take
+effect where you expect.
 
-## Rotate caller keys and the Relay workload token
+## Rotate caller keys
 
 For a Relay API key, generate a new raw key and fingerprint:
 
@@ -103,11 +120,21 @@ Store the fingerprint under the configured Relay secret reference, keep both cal
 the overlap window, restart or roll Relay, move the caller, then remove the old entry.
 Relay does not provide live keyring reload in the documented v1 path.
 
-For the Notary-to-Relay workload token, update the Relay workload policy and atomically replace the
-owner-readable token file used by Notary.
-Stage Relay first, then stage Notary against Relay and require the complete consultation contract
-check.
-Admit caller traffic only after both products are ready.
+For a Registry Mint client key, add or update the client's registration file under
+`clients.directory` with the new public JWK, keep the old registration in place during the overlap
+window, then send the running Registry Mint process `SIGHUP` to reload the client registry
+without a restart (`docs/site/src/content/docs/configure/mint.mdx`).
+Registry Mint reloads the whole client registry atomically: a malformed replacement file fails the
+reload and Registry Mint keeps serving the previous registry rather than a partial one.
+Remove the old registration only after every client has moved to the new key.
+
+Rotating Registry Mint's own signing key is a configuration change, not a client-registry reload:
+update `signing.activeKeyId` and `signing.activeKeyFile` in Registry Mint's configuration and
+restart the process.
+Evidence does not need reconfiguring for this: it fetches Registry Mint's JWKS from the configured
+`jwksUri` on its own cache lifecycle and picks up the new key once Registry Mint restarts,
+provided both processes already agree on `issuer` and `accessTokens.claims`
+(`products/evidence/OPERATOR-CONTRACT.md`, Startup and readiness).
 
 ## Rotate configuration signers and trust anchors
 
@@ -126,7 +153,7 @@ Admit caller traffic only after both products are ready.
    ```
 
    Do not alter authored configuration to force a signing input.
-   Use `--rotate-anchor relay-public` or `--rotate-anchor notary` for either other lane.
+   Use `--rotate-anchor relay-public` for the other Relay lane.
 2. Prepare a fresh output directory and rotate the affected product anchor with an overlapping
    next signer set:
 
@@ -188,7 +215,7 @@ Admit caller traffic only after both products are ready.
      --output-file operator-inputs/next-approved-set.v1.json
    ```
 
-   Use `--relay-public` or `--notary` when rotating either of those lanes.
+   Use `--relay-public` for the other lane.
    Unaffected lanes remain bound to the preceding approved set.
    Assembly rejects a selected lane that retains its old anchor and rejects an unselected lane
    that changes its anchor.
@@ -208,31 +235,36 @@ Admit caller traffic only after both products are ready.
 8. Remove or disable the old signer only after every retained deployment and recovery set has an
    accepted recovery path.
 
-Repeat this workflow independently for Relay and Notary when both signers change.
+Repeat this workflow independently for each Relay lane when both signers change.
 Do not interpret two successful verifications as atomic project activation.
 
-## Rotate Notary evidence-signing keys
+## Rotate Evidence and Registry Mint signing material
 
-Add a new key with a new `kid` and `status: active`.
-Move the intended credential or federation profiles to the new named key.
-Change the old key to `publish_only` for the full verifier and credential lifetime window, then
-disable or remove the old key through its governed cleanup path.
-Never reuse a `kid` for different key material.
+Evidence's signing key rotation is a rehearsed procedure, not new material for this page:
+generate the replacement Ed25519 key, reassemble the JWKS with the new public key and every
+retired public key still inside its validity window, update `signing.activeKeyId` in the
+reviewed bundle, then run `evidence check` and restart.
+[Rotate Evidence signing keys](../../../tutorials/move-evidence-to-production-signing/#stage-a-new-keypair)
+walks through each step, and `products/evidence/OPERATOR-CONTRACT.md` (Secrets and keys) is the
+binding contract behind it.
+Missing or failed signing is fail-closed: a rotation mistake surfaces as refused requests, never
+as an unsigned assertion.
 
-The [Notary signing key provider guide](../../../products/registry-notary/signing-key-provider/)
-defines local JWK and PKCS#11 provider configuration, readiness behavior, and the complete key
-lifecycle.
+Registry Mint's signing-key rotation is covered above, under Rotate caller keys, next to the
+client-key rotation it is usually done alongside.
 
-Audit hash-secret rotation is a separate evidence-lifecycle event.
-Retain the old secret under the audit retention policy because changing the secret breaks lookup
-correlation with older pseudonyms.
+Audit hash-secret rotation is a separate event from signing-key rotation.
+Retain the old secret under the audit retention policy: changing it breaks lookup correlation with
+pseudonyms recorded under the old secret.
 
 ## Expected evidence
 
 Retain:
 
-- The redacted check and `review compare` reports.
-- The verified product bundle report and product-specific sequence.
+- The redacted check and `review compare` reports for Relay.
+- The verified product bundle report and product-specific sequence for Relay.
+- The `evidence check` output and the readiness result for a rotated Evidence signing key.
+- The `mint check` output for a rotated Registry Mint signing key or client registration.
 - Health, readiness, audit-write, and redacted posture results from the staged instance.
 - A synthetic or authorized bounded canary result.
 - The old-material retirement time and the approved overlap window.
@@ -246,9 +278,12 @@ full configuration dumps.
 The offline gates prove that required references exist, file posture is acceptable, the
 environment does not widen the authored contract, and the generated product input validates.
 `registryctl trust bundle verify` proves the stateless signature, binding, trust-anchor, and
-file-closure checks.
+file-closure checks for Relay.
+`evidence check` and `mint check` prove their own deployment's key material and configuration are
+internally consistent before a restart; neither proves the other product's trust lineage, because
+Relay, Evidence, and Registry Mint share no signing or activation system.
 The generated product `preview-state` services prove that the later candidate can extend the
-existing accepted lineage without persisting acceptance.
+existing accepted Relay lineage without persisting acceptance.
 The generated `accept-state` services commit the authenticated transition only after the locked
 audit action succeeds, and the ordinary `verify_state` actions then prove exact accepted state.
 Staged readiness and a bounded canary prove the tested runtime path.
@@ -266,20 +301,26 @@ Issue a reviewed higher-sequence recovery bundle.
 When the accepted lineage cannot be recovered, establish a new explicitly governed instance
 identity and state lineage instead of bypassing anti-rollback controls.
 
-Keep old Notary public verification keys published while credentials signed by those keys can
-still be verified.
-Keep both products staged and traffic blocked when Relay and Notary no longer agree on the
-consultation contract.
+Keep old Evidence public verification keys published in the JWKS while assertions signed by those
+keys can still be verified: at least the maximum assertion validity plus allowed clock skew
+(`products/evidence/OPERATOR-CONTRACT.md`, Secrets and keys).
+Keep Registry Mint staged and Evidence's traffic blocked when Registry Mint's issuer, audience, or
+claim names do not exactly match Evidence's configured authentication profile: a mismatch fails
+closed as `authentication_failed` rather than granting the wrong authority
+(`docs/site/src/content/docs/configure/mint.mdx`, Troubleshooting).
 
 ## Escalate
 
-Escalate to the product security owner when material may be exposed, a private key or token reaches
-logs, the available configuration signer keys fall below the current threshold, trust cannot
-overlap safely, a certificate changes source identity, an old Notary public key cannot remain
-published, anti-rollback state is missing, or a canary requires live country data.
+Escalate to the product security owner when material may be exposed, a private key or token
+reaches logs, the available configuration signer keys fall below the current threshold, trust
+cannot overlap safely, a certificate changes source identity, an old Evidence public key cannot
+remain published for its required retention window, anti-rollback state is missing, or a canary
+requires live country data.
 
 ## Next
 
 - [Compare a baseline and reapprove a source change](../compare-and-reapprove-source-change/)
 - [Inspect and diagnose a running deployment](../inspect-and-diagnose/)
 - [Back up and restore state](../../backup-and-restore/)
+- [Move Evidence to production signing](../../../tutorials/move-evidence-to-production-signing/)
+- [Configure Registry Mint](../../../configure/mint/)
diff --git a/docs/site/src/content/docs/operate/approve-initial-baseline.mdx b/docs/site/src/content/docs/operate/approve-initial-baseline.mdx
index 38045155a..509d9d445 100644
--- a/docs/site/src/content/docs/operate/approve-initial-baseline.mdx
+++ b/docs/site/src/content/docs/operate/approve-initial-baseline.mdx
@@ -1,19 +1,20 @@
 ---
 title: Approve the initial product baseline
-description: Create independent lane anchors, sign the first three product bundles, verify them, and assemble an approved baseline set.
+description: Create independent lane anchors, sign the first two product bundles, verify them, and assemble an approved baseline set.
 status: current
 owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-31"
+  - registry-evidence
+  - registry-mint
+last_reviewed: "2026-08-03"
 doc_type: how-to
 locale: en
 standards_referenced: []
 ---
 
-Use this guide after `registryctl build` to turn the three unsigned product-lane inputs into one
+Use this guide after `registryctl build` to turn the two unsigned product-lane inputs into one
 `ApprovedBaselineSetV1` that a deployment operator can consume.
 
 ## When to use this
@@ -22,10 +23,19 @@ Use this procedure for the first governed approval of a project environment.
 For a later change, compare against the current approved set and follow
 [Approve a changed source](../advanced/compare-and-reapprove-source-change/).
 
-The public Relay, consultation Relay, and Notary lanes keep separate anchors, signing keys,
-signed bundles, and approval decisions.
+The public Relay and consultation Relay lanes keep separate anchors, signing keys, signed bundles,
+and approval decisions.
 The approved-set owner assembles verified lane outputs but does not sign on behalf of a lane.
 
+Evidence and Registry Mint
+are not registryctl-generated products and do not participate in this trust-anchor and
+approved-set pipeline at all: each validates its own deployment inputs directly, with
+`evidence check` and `mint check`. The current `evidencectl new` command starts an incomplete
+OpenAPI authoring workspace; it does not create Evidence deployment inputs. For a complete
+Evidence project, `evidencectl fixtures run` drives the offline fixture checks. See
+[Configure Evidence](../../configure/evidence/) and [Configure Registry Mint](../../configure/mint/)
+for those procedures.
+
 ## Before you start
 
 Use this procedure only when the selected build binds an operator-managed source and reports
@@ -43,13 +53,12 @@ registryctl review compare --environment local
 registryctl build --environment local
 ```
 
-An initial comparison identifies all three lanes as requiring approval.
+An initial comparison identifies both lanes as requiring approval.
 The build creates one unsigned input under each of these directories:
 
 ```text
 .registry-stack/build/local/signing-inputs/relay-public
 .registry-stack/build/local/signing-inputs/relay-consultation
-.registry-stack/build/local/signing-inputs/notary
 ```
 
 The optional local evaluation-key procedure requires OpenSSL with Ed25519 support and Python 3.
@@ -87,7 +96,7 @@ from pathlib import Path
 Path("evaluation-keys").mkdir(mode=0o700)
 PY
 
-for lane in relay-public relay-consultation notary; do
+for lane in relay-public relay-consultation; do
   openssl genpkey \
     -algorithm ED25519 \
     -outform DER \
@@ -197,33 +206,9 @@ registryctl trust bundle verify \
 
 Verification must identify the signed input as the `relay-consultation` lane under that anchor.
 
-## Approve the Notary lane
-
-The Notary trust owner repeats the procedure with the Notary key and anchor:
-
-```sh
-registryctl trust anchor create \
-  --lane notary \
-  --input .registry-stack/build/local/signing-inputs/notary \
-  --public-key evaluation-keys/notary.public.jwk \
-  --threshold 1 \
-  --output-file operator-handoff/notary-anchor.json
-registryctl trust bundle sign \
-  --lane notary \
-  --input .registry-stack/build/local/signing-inputs/notary \
-  --anchor operator-handoff/notary-anchor.json \
-  --key file:evaluation-keys/notary.private.jwk \
-  --output-dir operator-handoff/notary-bundle
-registryctl trust bundle verify \
-  --bundle-dir operator-handoff/notary-bundle \
-  --anchor operator-handoff/notary-bundle/anchor.json
-```
-
-Verification must identify the signed input as the `notary` lane under that anchor.
-
 ## Assemble the approved baseline set
 
-After all three lane owners transfer their verified outputs, the approved-set owner assembles the
+After both lane owners transfer their verified outputs, the approved-set owner assembles the
 initial set:
 
 ```sh
@@ -231,13 +216,21 @@ registryctl trust approved-set assemble \
   --environment local \
   --relay-public operator-handoff/relay-public-bundle \
   --relay-consultation operator-handoff/relay-consultation-bundle \
-  --notary operator-handoff/notary-bundle \
   --output-file operator-handoff/approved-set.v1.json
 ```
 
-Registryctl verifies the three lane bundles and writes one approved-set file.
+Registryctl verifies the two lane bundles and writes one approved-set file.
 It reports the approved-set digest and the next `registryctl deploy generate` command.
 
+The assembled document declares approved-set schema version `2.0`.
+Current registryctl refuses an approved set that declares schema version `1.0`, carries a `notary`
+lane, or binds cross-lane interface digests.
+It reports why the document is refused and names re-approval as the remedy.
+A refused set cannot be repaired by editing the file: the removed cross-lane interface digests are
+no longer verified, so honoring the old approval would keep a signed integrity claim that nothing
+enforces.
+Re-run this procedure from the current lane bundles to issue a schema version `2.0` set.
+
 ## Rotate an anchor after initial approval
 
 Do not create another version-1 anchor when an approved lane changes signer.
@@ -288,7 +281,7 @@ to that lane's anchor rotation.
 `trust anchor rotate` verifies that the transition is authorized by the pinned preceding anchor;
 the repeated public-key options keep the current signer during the overlap.
 `trust bundle sign --against` advances from the pinned preceding approved set, and assembly keeps
-the unchanged public Relay and Notary lanes from that set.
+the unchanged public Relay lane from that set.
 Deployment verification does not accept the rotated anchor into an existing product state.
 For thresholds, overlap windows, and the required preview, stop, audited acceptance, exact
 verification, and startup order, follow
@@ -322,4 +315,4 @@ to supply and check operator files before one-time initialization and ordinary s
 | Anchor creation rejects the public key | The key is not a supported public JWK or does not match the selected threshold. | Export the lane owner's approved public JWK and retry into a fresh output path. |
 | Bundle signing refuses the key | The locator is missing `file:` or `op://`, or the key does not satisfy the anchor. | Use an explicit locator for the matching private key. |
 | Bundle verification fails | The bundle, lane, input, or anchor does not belong to the same approval. | Stop the handoff and return the exact input to that lane's trust owner. |
-| Approved-set assembly reports a missing lane | Initial assembly requires one verified public Relay, consultation Relay, and Notary bundle. | Supply all three verified lane directories. |
+| Approved-set assembly reports a missing lane | Initial assembly requires one verified public Relay bundle and one verified consultation Relay bundle. | Supply both verified lane directories. |
diff --git a/docs/site/src/content/docs/operate/backup-and-restore.mdx b/docs/site/src/content/docs/operate/backup-and-restore.mdx
index 6250b6801..6bcc5cf95 100644
--- a/docs/site/src/content/docs/operate/backup-and-restore.mdx
+++ b/docs/site/src/content/docs/operate/backup-and-restore.mdx
@@ -6,8 +6,7 @@ owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-31"
+last_reviewed: "2026-08-04"
 doc_type: how-to
 locale: en
 standards_referenced: []
@@ -57,13 +56,16 @@ bundle and anchor, instance and stream identities, accepted sequence, anti-rollb
 state, audit state, source inputs, ingest cache, and materialization state.
 
 The `consultation-state` group includes the exact package, approved set, consultation
-Relay and Notary bundles and anchors, instance and stream identities, accepted
-sequences, anti-rollback and audit state, complete Relay consultation and Notary
-PostgreSQL correctness state, role and key-lifecycle records, and retained key
-material.
+Relay bundle and anchor, instance and stream identities, accepted sequences,
+anti-rollback and audit state, complete Relay consultation PostgreSQL correctness
+state, role and key-lifecycle records, and retained key material. Its members are the
+consultation Relay lane and PostgreSQL.
+
+A package generated against an earlier product set is not covered by this procedure;
+regenerate it first.
 
 For audited SnapshotExact materializations, freeze source updates and dependent traffic
-before stopping the Relay fence holder and Notary callers.
+before stopping the Relay fence holder and its callers.
 Capture source inputs, the Relay ingest cache, and the Relay
 consultation database at one coordinated recovery point. The recovery record must bind
 the database active pointer and history to the exact active generation and restricted
@@ -122,7 +124,7 @@ Use the operator-owned storage procedures to capture the state named by the gene
 runbook and binding:
 
 1. Snapshot the complete `relay-public-state` group when that lane is in scope.
-2. Snapshot the complete `consultation-state` group when consultation Relay or Notary is
+2. Snapshot the complete `consultation-state` group when the consultation Relay lane is
    in scope. Back up complete product databases, not selected tables or schemas.
 3. Preserve PostgreSQL role object identifiers when the product state contract binds
    them. A physical or managed cluster snapshot is required when a logical restore
@@ -140,8 +142,8 @@ ordinary start sequence in `generated/RUNBOOK.md`.
 
 ## Restore a recovery point
 
-Restore into an empty, isolated directory and isolated backing stores. Keep public,
-consultation, and Notary traffic blocked.
+Restore into an empty, isolated directory and isolated backing stores. Keep public and
+consultation traffic blocked.
 
 1. Verify the backup system's integrity record before extracting any files.
 2. Extract `deployment-package.tar` and restore the approved set outside the package.
@@ -176,13 +178,12 @@ docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file gener
 Compare the reported closure digest with the external recovery record. Any mismatch is
 a manual abort.
 
-Run all three dedicated, networkless state checks required by the generated runbook before
+Run both dedicated, networkless state checks required by the generated runbook before
 staging serving secrets:
 
 ```sh
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-public-verify-state
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-consultation-verify-state
-docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-notary-verify-state
 ```
 
 If any check rejects the restored state, do not delete anti-rollback state, change an
@@ -191,19 +192,18 @@ the same or newer accepted sequence. If no such backup exists, provision a new i
 identity, review and sign every affected lane, generate a new package, and follow the
 first-installation section of its runbook.
 
-Only after all checks succeed, stage the three serving-secret groups and start:
+Only after both checks succeed, stage the two serving-secret groups and start:
 
 ```sh
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml run --rm --no-deps registry-relay-consultation-stage-secrets
-docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml run --rm --no-deps registry-notary-stage-secrets
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml run --rm --no-deps registry-postgresql-stage-secrets
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml up --detach --wait --wait-timeout 120
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml ps
 ```
 
 For a private-lane recovery, keep externally reachable dependants stopped until
-PostgreSQL and consultation Relay are ready and verified. Then start Notary and the
-remaining dependants in the order specified by `generated/RUNBOOK.md`.
+PostgreSQL and consultation Relay are ready and verified. Then start the remaining
+dependants in the order specified by `generated/RUNBOOK.md`.
 
 ## Verify the restored service
 
diff --git a/docs/site/src/content/docs/operate/evidence-audit.mdx b/docs/site/src/content/docs/operate/evidence-audit.mdx
new file mode 100644
index 000000000..225b238c8
--- /dev/null
+++ b/docs/site/src/content/docs/operate/evidence-audit.mdx
@@ -0,0 +1,125 @@
+---
+title: Verify and interpret the Evidence audit chain
+description: Prove the integrity of retained Evidence audit history, understand what each phase establishes, and keep the subject-correlation boundary explicit.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: how-to
+persona:
+  - operator
+locale: en
+standards_referenced: []
+---
+
+Evidence writes a keyed, append-only audit chain. The chain is useful for proving which governed
+operation was admitted, what concept was released, and whether retained records were modified. It
+does not repeat source values or automatically provide a citizen-facing access history.
+
+## Verify retained history
+
+Run the integrity check with the deployment stopped when you need to prove both sealed history and
+the active segment:
+
+```sh
+evidence verify-audit --runtime /etc/registry-evidence/runtime.yaml
+```
+
+A successful stopped-deployment check reports only bounded metadata:
+
+```text
+segments: 3
+records: 1842
+sealed-sequence: 1-2
+head: <chain-head>
+active-segment: verified
+```
+
+The runtime file supplies the audit directory and hash-key reference. The command accepts neither
+on the command line, which prevents an operator from accidentally verifying a different chain or
+key than the deployment uses.
+
+If Evidence is still running, the writer keeps the active segment locked. Verification proves the
+sealed history and reports:
+
+```text
+active-segment: not verified: a running writer holds it, so only sealed history was proven
+```
+
+Run this check before and after backup, restore, or audit transfer. A missing sealed segment and a
+broken keyed chain both fail, but only retained and discoverable history can be checked. This is
+not proof that an operator never deleted history before the check or that an off-host receiver
+accepted it.
+
+## Interpret one operation
+
+For an admitted request, the native chain uses closed phases:
+
+| Phase | What it establishes | What it does not establish |
+|---|---|---|
+| `access-attempt` with `authorized` | Authentication and the complete authority path were accepted before source credentials or source data were touched. | The source returned a record or the assertion was released. |
+| `disclosure-release` with `released` | The named concepts were serialized and durably recorded before the exact response bytes were released. | The source fact was true or the caller used the answer correctly. |
+| `denial` or `transient-failure` | An admitted operation later failed in one closed, value-free class. | The protected selector, source value, or credential that triggered it. |
+
+Failures that happen before Evidence has enough privacy-safe context, such as authentication
+failure or an invalid selector, do not fabricate a native subject event. Do not expect every HTTP
+request to produce two audit records.
+
+Native records can carry the governed requirement, purpose, bundle revision, requester pseudonym,
+subject role and selector-profile pseudonym, source and adapter identifiers, response protection,
+decision, safe failure class, disclosed concept IDs, evidence ID, and signing key ID. They never
+carry the disclosed value, raw selector, source response, access token, or credential.
+
+## Inspect the last local tutorial operation
+
+The local tutorials expose one intentionally small view after the services stop:
+
+```sh
+evidencectl audit show --last-operation
+```
+
+```text
+ACCESS AUTHORIZED age-bracket service-path-selection requester=<pseudonym>
+DISCLOSURE RELEASED age_bracket
+```
+
+This command verifies the whole retained local chain, then renders only the last operation. It is
+not a production audit browser and has no `--all`, subject filter, or export mode. An access-only
+operation prints only the authorized line rather than claiming a release that did not occur.
+
+## Understand pseudonymous correlation
+
+Requester and subject handles are deterministic keyed pseudonyms. They are protected correlators,
+not anonymous values and not encrypted copies of identifiers.
+
+The subject handle binds the complete selector tuple together with the trust domain, purpose,
+audience, role, selector profile, and key version. The same tuple in the same scope can be
+correlated by protected tooling. A different purpose, audience, or key version produces a
+different handle. A composite selector cannot be reproduced from one field such as `person_id`
+alone.
+
+Registry Stack V1 does not expose supported tooling to answer:
+
+```text
+Show every access for person_id=person-123.
+```
+
+There is no subject-history query, citizen portal, pseudonym derivation command, requester-name
+resolver, or cross-system history assembly. Do not work around this by exposing the audit hash key
+or raw JSONL records. The native chain contains the privacy-preserving correlation primitive that
+future protected tooling would need, but a citizen access request currently requires a separately
+governed operator process.
+
+## Protect the chain
+
+- Allow one Evidence writer per audit path.
+- Put the path on durable storage and monitor capacity before a fail-closed write stops release.
+- Back up every sealed segment and the active segment as one history.
+- Retain the matching audit hash key for as long as the history must remain verifiable.
+- Restrict event access separately from ordinary service operations.
+- Record retention, deletion, recovery, and requester-identity mapping responsibilities outside the
+  Evidence bundle.
+
+Continue with [Retention and persistent state](../retention-and-persistent-state/) and
+[Backup and restore](../backup-and-restore/) for the surrounding operator procedures.
diff --git a/docs/site/src/content/docs/operate/index.mdx b/docs/site/src/content/docs/operate/index.mdx
index 01507125c..79511007a 100644
--- a/docs/site/src/content/docs/operate/index.mdx
+++ b/docs/site/src/content/docs/operate/index.mdx
@@ -6,8 +6,7 @@ owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-27"
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced: []
@@ -28,10 +27,9 @@ deployment package that an operator can verify before activation.
 | Verify | `registryctl deploy verify` | Deployment operator |
 | Run | Printed `docker compose` command | Deployment operator |
 
-Each Relay lane and the Notary lane has its own bundle, anchor, identity, and
-anti-rollback state.
-The approved set proves that the three inputs belong to one compatible project
-and environment.
+Each Relay lane has its own bundle, anchor, identity, and anti-rollback state.
+The approved set proves that both inputs belong to one compatible project and
+environment.
 It does not activate a product.
 
 Bare `registryctl deploy` prints help and performs no action.
@@ -43,7 +41,7 @@ initialize product state, or start Docker Compose.
 Before generation, record:
 
 - The exact approved baseline set and signed release lock (`RegistryReleaseLockV1`)
-- The public Relay, consultation Relay, and Notary owners
+- The public Relay and consultation Relay owners
 - The external secret files and their consumers
 - The governed anchor sources and retained immutable copies
 - The public endpoints and edge network
@@ -59,8 +57,6 @@ platform-neutral deployment plan when the managed profile does not fit.
 - [Run generated Compose behind a reverse proxy](single-node-compose-behind-proxy/)
 - [Approve the initial product baseline](approve-initial-baseline/)
 - [Approve a changed source](advanced/compare-and-reapprove-source-change/)
-- [Review Registry Notary deployment hardening](../products/registry-notary/deployment-hardening-runbook/)
-- [Review Registry Notary PostgreSQL operations](../products/registry-notary/postgresql-state-operations/)
 
 ## Next
 
diff --git a/docs/site/src/content/docs/operate/retention-and-persistent-state.mdx b/docs/site/src/content/docs/operate/retention-and-persistent-state.mdx
index 732f4e4b3..64f726a07 100644
--- a/docs/site/src/content/docs/operate/retention-and-persistent-state.mdx
+++ b/docs/site/src/content/docs/operate/retention-and-persistent-state.mdx
@@ -1,11 +1,13 @@
 ---
 title: Retention and persistent state
-description: What Registry Relay and Registry Notary retain, what expires, and what operators must preserve or ship off host.
+description: What Registry Relay, Evidence, and Registry Mint retain, what expires, and what operators must preserve or ship off host.
 status: draft
 owner: registry-docs
 source_repos:
   - registry-stack
-last_reviewed: "2026-07-09"
+  - registry-evidence
+  - registry-mint
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced: []
@@ -13,7 +15,7 @@ standards_referenced: []
 
 Use this page to decide which Registry Stack state needs backup, off-host shipping, expiry,
 or deletion policy outside the products.
-It documents current Registry Relay and Registry Notary behavior.
+It documents current Registry Relay, Evidence, and Registry Mint behavior.
 Retention enforcement, record-level erasure, and data-subject-rights workflows are outside the
 1.0 product boundary.
 
@@ -31,50 +33,51 @@ Two consequences follow from that boundary:
   Use off-host shipping when completeness matters.
 - Treat keyed pseudonyms as a linkability control, not as erasure.
   Destroying or rotating the HMAC secret prevents recomputing old pseudonyms from raw values,
-  but it does not delete audit records, cache entries, status records, or source data.
+  but it does not delete audit records, cache entries, or source data.
 
 ## Durable state and externally retained records
 
 | Store | What it can contain | Expiry or rotation | Operator control |
 |---|---|---|---|
-| Relay and Notary audit sinks | Chained audit envelopes with timestamps, event bodies, hashes, and HMAC-pseudonymized sensitive handles when configured. Operational metadata can still identify actors or actions. | Product file sinks default to `100 MB` and `14` retained files. `stdout` and `syslog` retention belongs to the collector. | Configure `audit.sink`, file path, rotation, `audit.hash_secret_env`, and off-host shipping. |
-| Relay and Notary audit shipper cursor | Local `registry.audit.ack_cursor.v1` state with the acknowledgement time and last acknowledged chain hash, plus an optional shipper identifier. | The shipper atomically replaces the file after each successful hand-off. The runtime does not expire or rewrite it. | Mount the file read-only for the Registry process, keep it on local storage and at or below 16 KiB, and configure `deployment.evidence.audit_ack_cursor_path`. |
+| Relay audit sink | Chained audit envelopes with timestamps, event bodies, hashes, and HMAC-pseudonymized sensitive handles when configured. Operational metadata can still identify actors or actions. | The file sink defaults to `100 MB` and `14` retained files. `stdout` and `syslog` retention belongs to the collector. | Configure `audit.sink`, file path, rotation, `audit.hash_secret_env`, and off-host shipping. |
+| Evidence audit chain | A keyed, hash-chained JSONL log of the access-attempt event before every source read and the disclosure-release event before every response. Audit carries reviewed identifiers and decision categories, never raw selector values, source values, credentials, tokens, or raw subject identifiers. | `auditStorage.maximumFileBytes` is a per-segment rotation threshold, not a total ceiling. When an append would exceed it, the runtime seals the active segment as `<auditStorage.path>.<sequence>` and opens a new active segment online, with no operator action. Nothing in the runtime deletes or compacts a sealed segment; total retention is entirely operator-owned. | Set `auditStorage.path`, `auditStorage.maximumFileBytes`, and the hash secret in `runtime.yaml`. Archive sealed segments to cold storage oldest sequence first, never touch the active segment while the service runs, and run `evidence verify-audit` on the cadence the deployment's audit policy requires. |
+| Mint audit chain | A keyed, hash-chained JSONL log of token releases and denials. Records use keyed pseudonyms and omit raw assertions, access tokens, client ids, principals, authority values, actors, and subject values. | `audit.maximumFileBytes` is a per-segment threshold, not a total ceiling. Registry Mint seals full segments as `<audit.path>.<sequence>` online and never deletes or compacts them. | Set `audit.path`, `audit.maximumFileBytes`, and the hash key in `mint.yaml`. Archive sealed segments oldest first, never touch the active segment while Registry Mint runs, and run `mint verify-audit` on the deployment's verification cadence. |
+| Relay audit shipper cursor | Local `registry.audit.ack_cursor.v1` state with the acknowledgement time and last acknowledged chain hash, plus an optional shipper identifier. | The shipper atomically replaces the file after each successful hand-off. Relay does not expire or rewrite it. | Mount the file read-only for the Relay process, keep it on local storage and at or below 16 KiB, and configure `deployment.evidence.audit_ack_cursor_path`. |
 | Relay ingest cache | Normalized Parquet snapshots under `server.cache_dir`. These snapshots can contain full source rows from configured registries. | No time TTL. For audited SnapshotExact, the authored `retain_generations` value keeps between `1` and `16` completed cache generations, including the active generation, after successful publication. Ordinary sources keep the built-in current and previous generations. Older snapshots are removed best effort. | Place `server.cache_dir` on writable storage with the same data classification as the source rows. Treat authored retention as a bounded recovery set, not an API for selecting arbitrary rollback targets. |
 | Config-trust anti-rollback state | The last accepted sequence, config and bundle hashes, root version, and optional break-glass pin metadata. Operator names, approval references, and reasons can be sensitive. | The state file is rewritten atomically and has no normal TTL. Break-glass overrides require expiry, and consumed override files are renamed. | Preserve `antirollback_state_path` across upgrades and protect break-glass override files with local root controls. |
 | Relay consultation correctness state | Durable consultation audit, attempts and completions, dispatch permits, quota buckets, materialization publication history, batch-child replay bindings, serving-fence state, and audit-pseudonym keyring metadata. Pseudonymous handles and operational metadata can remain linkable. | Batch-child replay rows expire after `15 minutes` and are pruned on later reservations. Other Relay consultation tables have no general time-based pruning. Keyring retention controls when retired pseudonym key metadata can leave the retained set; it does not delete durable audit rows. | Back up the complete Relay database at a quiesced or coordinated recovery point. Preserve role bindings and key material, and keep any potentially stale restore offline until acknowledged writes are reconciled. |
-| Notary correctness state | Hashed replay and nonce identifiers, evaluations, batch idempotency, credential status, keyed quota pseudonyms, encrypted preauthorization login state, and transaction-code verifiers. Credential identifiers and operational metadata can still be linkable. | Each typed domain has an absolute expiry or bounded window. Consumed nonce tombstones last `60` seconds. Credential status lasts through credential expiry plus `retention_seconds`. | Use the Notary-owned PostgreSQL schema for production and multi-instance deployments. Back up the complete database and keep a potentially stale restore offline through the documented quarantine. |
-| Operator-owned config, source, and secret paths | Runtime configuration, signed bundles, trust anchors, metadata manifests, source files, provenance keys, and secret references. Source files can contain personal data. | Registry Stack does not expire these files, except through the specific audit, cache, replay, status, and break-glass mechanics above. | Mount source data read-only where possible; back up config, trust anchors, anti-rollback state, and secrets through your platform controls. |
+| Operator-owned config, source, and secret paths | Runtime configuration, signed Relay bundles and trust anchors, Evidence's governed bundle and runtime document, Registry Mint's signing key and client registry, metadata manifests, source files, and secret references. Source files can contain personal data. | Registry Stack does not expire these files, except through the specific audit, cache, replay, and break-glass mechanics above. | Mount source data read-only where possible; back up config, trust anchors, anti-rollback state, and secrets through your platform controls. |
 
 ## Process-local caches and client-held state
 
 | Store | What it can contain | Expiry or rotation | Operator control |
 |---|---|---|---|
-| Relay and Notary OIDC JWKS cache | Issuer signing keys and negative lookup entries, not subject records. | In process only. Default positive cache TTL is `600` seconds and default negative cache TTL is `60` seconds. | Configure Relay OIDC `jwks_cache_ttl` where exposed. Notary shared fetchers use platform defaults where no product knob is exposed. Restart clears the cache. |
+| Relay OIDC JWKS cache | Issuer signing keys and negative lookup entries, not subject records. | In process only. Default positive cache TTL is `600` seconds and default negative cache TTL is `60` seconds. | Configure Relay OIDC `jwks_cache_ttl` where exposed. Restart clears the cache. |
+| Evidence OIDC JWKS cache | Issuer signing keys and negative lookup entries for the configured `authentication.jwksUri`, not subject records. | In process only. Evidence exposes no product-level override, so the shared platform defaults apply: `600` second positive cache TTL and `60` second negative cache TTL. | Restart clears the cache. An unreachable key set is retried and reported at a bounded interval rather than silently ignored. |
 | Relay auth-failure throttle | Process-local counters keyed by resolved client address. Client IP addresses can be personal data. | Fixed window when enabled; defaults are disabled, `20` failures, and `60` seconds. Restart clears counters. | Configure `auth.failure_throttle.*` and `server.trust_proxy` correctly behind proxies. |
 | Relay response headers | No Relay-owned response/result cache was found. Client and proxy caching follow HTTP headers. | Metadata and default release responses are `no-store`; successful release responses can opt into private max-age. | Configure release-profile response max age only when private client caching is acceptable. |
 | Relay pagination cursors | Client-held signed cursor payloads can include query context, filters, principal ID, ingest version, and position. | Not stored server-side and no product TTL. Cursors become invalid when signer, principal, query, config, or ingest version changes. | Treat cursor tokens as client-held request context and avoid logging them unnecessarily. |
-| Credential status-list JWT cache | Signed status-list JWT strings and hashed cache keys derived from credential status metadata, status URL, timestamps, and public JWK hash. | In memory only. Entries are pruned on access and expire no later than the `300` second JWT expiry; valid status entries expire earlier when the credential expires first. | Enabled only when credential status is enabled. Restart clears the cache; there is no separate size or storage knob. |
 | Relay source OAuth token caches | Access tokens used by compiled Relay source credential providers. | In memory and bounded by the provider's token lifetime. | Configure the Relay integration credential binding and keep token secrets out of logs and config files. |
+| Mint client-assertion replay cache | Seen `jti` values from presented client assertions, used to refuse a repeated assertion. | In memory only, bounded by `clientAssertion.replayCacheEntries` (default `8192`, minimum `256`). Restart clears it. | Size `replayCacheEntries` to the deployment's client population and assertion volume; there is no separate time-based expiry knob. |
 
 ## Audit retention
 
-Relay and Notary can write chained JSONL audit records.
-The product file-sink defaults retain `14` files at `100 MB` each.
-The shared platform sink has a smaller generic default, but the products override it when their
-own audit config is used.
+Relay writes chained JSONL audit records.
+The product file-sink default retains `14` files at `100 MB` each.
+The shared platform sink has a smaller generic default, but Relay overrides it when its own audit
+config is used.
 
 The chain detects edits, insertions, reordering, and deletion after the first retained record
 within the retained set.
 It does not prove that older rotated-away records, or earlier retained records, still exist.
-If a deployment uses a local rotating file sink without off-host shipping, Relay and Notary surface
-deployment-posture findings such as `relay.audit.retention_local_only` and
-`notary.audit.retention_local_only`.
-Under `evidence_grade`, those findings refuse startup.
+If a deployment uses a local rotating file sink without off-host shipping, Relay surfaces the
+deployment-posture finding `relay.audit.retention_local_only`.
+Under `evidence_grade`, that finding refuses startup.
 Set `deployment.evidence.audit_offhost_shipping` only after the deployment really ships audit
 records to external durable storage.
 
-An `evidence_grade` Relay or Notary also requires an acknowledgement cursor for every configured
-shipping target, including `stdout` and `syslog`.
+An `evidence_grade` Relay also requires an acknowledgement cursor for every configured shipping
+target, including `stdout` and `syslog`.
 The cursor is healthy only when its timestamp is fresh and its last acknowledged hash equals the
 live keyed audit chain tail.
 That equality records the trusted shipper's claim that the local backlog is zero; the unsigned
@@ -88,6 +91,37 @@ Never truncate, rewrite, or reserialize audit files as part of cleanup.
 Back them up as files, keep old hash secrets for the audit retention period, and rotate hash
 secrets only as an intentional key-lifecycle event.
 
+## Evidence and Registry Mint retention
+
+Evidence has no application database and persists no selector, source, evidence, or response
+data. Its only durable state is the operator-configured signing key material and the audit chain
+described in
+[Durable state and externally retained records](#durable-state-and-externally-retained-records).
+An external durable audit service may own its own storage, but Evidence itself does not maintain
+one.
+
+Run `evidence verify-audit` against the runtime document's configured audit path to check chain
+integrity across every segment. It replays every segment across every seam and reports `segments`,
+`records`, `sealed-sequence`, `head`, and `active-segment`; a gap in the sealed sequence is
+reported as a distinct missing-segment result rather than treated as silent history loss. Archive
+sealed segments to cold storage oldest sequence first and never rename or otherwise touch the
+active segment while the service runs: the runtime recognizes a segment by its
+`<auditStorage.path>.<sequence>` name, and a rename outside that namespace produces a silent fork
+on the next restart rather than a rotation.
+
+Registry Mint's durable state is the operator-owned signing key, the client registration files
+under `clients.directory`, and the segmented audit chain. Onboarding, offboarding, and caller key
+rotation reload the client directory on `SIGHUP` without a restart. The client-assertion replay
+cache is in-memory only and clears on restart, so a restarted Registry Mint accepts a previously
+used `jti` again for whatever lifetime remains on that assertion. Keep
+`clientAssertion.maximumLifetimeSeconds` short enough that this window stays small.
+
+Run `mint verify-audit` to replay the Mint chain across every retained segment. The command reports
+segment and record counts, the first and last sealed sequence, the chain tail, and whether the
+active segment was verified. A running writer keeps the active segment out of the verification
+pass and produces `active-segment: not verified`; stop Registry Mint for a complete retained-chain
+pass.
+
 ## Relay consultation-state retention
 
 When `consultation` is enabled, Registry Relay uses PostgreSQL transactions for durable audit,
@@ -95,9 +129,8 @@ single-holder dispatch fencing, quota decisions, consultation completion, batch-
 materialization publication, and audit-pseudonym keyring authority. Process restart and fence
 takeover recover unfinished consultation attempts before admission opens.
 
-Relay owns `relay_state_private` and `relay_state_api`. Registry Notary owns
-`registry_notary_private` and `registry_notary_api`. The products do not share tables, migrations,
-runtime roles, or keyrings even when their databases run in one PostgreSQL cluster.
+Relay owns `relay_state_private` and `relay_state_api`. No other product shares these tables,
+migrations, runtime roles, or keyrings.
 
 The Relay consultation store excludes registry source rows, raw selectors, source URLs, and source
 credentials. It retains bounded canonical operation state, keyed commitments and pseudonyms,
@@ -127,23 +160,10 @@ restricted content digest in access-controlled recovery evidence. `retain_genera
 bounded set of cache files available for recovery and readers. It does not expose an operation
 that activates any retained generation as an arbitrary rollback target.
 
-## Notary correctness-state retention
-
-Registry Notary enforces one-time use, cross-replica quota decisions, evaluation retention,
-idempotent completion, and credential lifecycle transitions through typed PostgreSQL transactions.
-The process-local backend is available only for explicit local, single-instance development and
-loses every correctness decision on restart.
-
-The PostgreSQL store does not retain credential bodies, source rows, holder private keys, raw
-transaction-code PINs, or source-system credentials. It does retain encrypted or pseudonymized
-operational state that needs access, backup, and deletion controls. Use the
-[Registry Notary PostgreSQL operations guide](https://docs.registrystack.org/products/registry-notary/postgresql-state-operations/)
-for domain retention, bounded pruning, backup, recovery, and stale-restore quarantine.
-
 ## What remains outside the product
 
 Registry Stack does not implement a general erasure workflow for source records, audit records,
-cache entries, or credential status records.
+or cache entries.
 It also does not prune operator-owned config files, source files, old release artifacts, or
 break-glass evidence after the product-level expiry checks have run.
 Those controls belong in the operator's storage, backup, incident-response, and data-protection
diff --git a/docs/site/src/content/docs/operate/single-node-compose-behind-proxy.mdx b/docs/site/src/content/docs/operate/single-node-compose-behind-proxy.mdx
index 3dd91e572..c7c8538b2 100644
--- a/docs/site/src/content/docs/operate/single-node-compose-behind-proxy.mdx
+++ b/docs/site/src/content/docs/operate/single-node-compose-behind-proxy.mdx
@@ -1,21 +1,22 @@
 ---
 title: Run the generated single-node Compose package
-description: Generate, verify, initialize, and run the governed package, then include it under explicit operator ownership when needed.
+description: Generate, verify, initialize, and run the governed Relay package, then include Evidence and Registry Mint under explicit operator ownership when needed.
 status: current
 owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-30"
+  - registry-evidence
+  - registry-mint
+last_reviewed: "2026-08-03"
 doc_type: how-to
 locale: en
 standards_referenced: []
 ---
 
-Use this guide to hand independently approved Registry Relay and Registry Notary bundles to a
-single-node Docker Compose deployment, then include that package in an operator-owned application
-when needed.
+Use this guide to hand independently approved Registry Relay bundles to a single-node Docker
+Compose deployment, then include Evidence and Registry Mint in that same application under
+explicit operator ownership when the deployment needs them.
 The generated package remains portable after handoff and can run with Docker Compose without
 Registryctl.
 
@@ -23,10 +24,14 @@ Registryctl.
 
 Use the generated package when:
 
-- One Docker host runs one public Relay, one private consultation Relay, one Notary, and the
-  release-owned PostgreSQL state plane
+- One Docker host runs one public Relay, one private consultation Relay, and the release-owned
+  PostgreSQL state plane
 - Docker Compose 2.35.0 or later is available
-- Each product lane has an independently signed bundle and trust anchor
+- Each Relay lane has an independently signed bundle and trust anchor
+
+Registryctl generates a package for the Relay lanes only. Evidence and Registry Mint are not
+registryctl-generated products: an operator adds them as ordinary services in the same
+application, following [Add Evidence and Registry Mint to the application](#add-evidence-and-registry-mint-to-the-application).
 
 The package does not provide high availability, Kubernetes, an external database, or direct
 non-loopback host publishing.
@@ -37,11 +42,13 @@ Registryctl does not verify or manage that model.
 
 You need:
 
-- One verified `ApprovedBaselineSetV1` containing `relay-public`, `relay-consultation`, and
-  `notary`
+- One verified `ApprovedBaselineSetV1` containing `relay-public` and `relay-consultation`
 - The released Registryctl installation whose signed release lock authorizes the images
 - Operator-owned environment, signing, workload-credential, and PostgreSQL TLS files
 - Durable storage for PostgreSQL and each product's anti-rollback state
+- An operator-owned `runtime.yaml` (and referenced secret files) for each Evidence deployment the
+  application will include, and an operator-owned `mint.yaml` for Registry Mint when the
+  deployment has no identity provider
 
 The approved set is compatibility evidence and a portable locator.
 It is not a fourth signature, trust root, or product activation authority.
@@ -99,8 +106,8 @@ The generated binding projection retains the inputs that Registryctl used to ren
 the generated closure.
 Continue to edit only the operator-owned `binding.yaml`, then regenerate.
 
-The package copies the three signed product bundles and their anchors into separate,
-digest-specific directories.
+The package copies the two signed Relay bundles and their anchors into separate, digest-specific
+directories.
 It does not create secret files, production keys, or anti-rollback state.
 
 Record the approved-set digest and generated closure root printed by the command outside the
@@ -120,9 +127,6 @@ creates production values.
 Use the input contract in the runbook for the non-dotenv files:
 
 - A PostgreSQL certificate chain valid for the fixed private DNS identity `registry-postgres`.
-- A private Notary signing JWK accepted by the provider selected in the signed Notary config.
-- A compact Notary-to-Relay workload JWT that satisfies the exact signed issuer, audience,
-  client/principal, scope, and expiry contract.
 - The PostgreSQL administrator password and every bootstrap database-role password named in the
   inventory.
 
@@ -136,7 +140,7 @@ The binding can select loopback ports, package-relative operator-file locators,
 locations, restart policy, and value-free logging policy.
 
 Do not edit files under `generated/`.
-Do not edit generated Relay or Notary configuration.
+Do not edit generated Relay configuration.
 The signed product bundles remain the configuration authority.
 
 ## Verify the generated package
@@ -185,26 +189,21 @@ Run the complete first-installation block from `generated/RUNBOOK.md` exactly on
 ```sh
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml config --no-interpolate --no-env-resolution --quiet
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-consultation-actions-stage-secrets
-docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-notary-actions-stage-secrets
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-postgresql-actions-stage-secrets
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm registry-postgres-bootstrap
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm registry-relay-public-prepare-state
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm registry-relay-consultation-prepare-state
-docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm registry-notary-prepare-state
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm registry-relay-public-initialize
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm registry-relay-consultation-initialize
-docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm registry-notary-initialize
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-public-verify-state
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-consultation-verify-state
-docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-notary-verify-state
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml run --rm --no-deps registry-relay-consultation-stage-secrets
-docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml run --rm --no-deps registry-notary-stage-secrets
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml run --rm --no-deps registry-postgresql-stage-secrets
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml up --detach --wait --wait-timeout 120
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml ps
 ```
 
-The three initialization stagers and three serving stagers check and copy only the operator files
+The two initialization stagers and two serving stagers check and copy only the operator files
 required by their closed product action, serving lane, or the PostgreSQL state plane.
 The PostgreSQL bootstrap runs before product state preparation.
 Preparation creates or migrates only the owning product's database schema and roles.
@@ -222,23 +221,21 @@ Run the ordinary start-and-stop block from `generated/RUNBOOK.md`:
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml config --no-interpolate --no-env-resolution --quiet
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-public-verify-state
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-consultation-verify-state
-docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-notary-verify-state
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml run --rm --no-deps registry-relay-consultation-stage-secrets
-docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml run --rm --no-deps registry-notary-stage-secrets
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml run --rm --no-deps registry-postgresql-stage-secrets
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml up --detach --wait --wait-timeout 120
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml ps
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml down
 ```
 
-The public Relay and Notary HTTP application ports bind to host loopback.
+The public Relay HTTP application port binds to host loopback.
 The consultation Relay, administration, and posture endpoints have no host port.
-The three `verify_state` actions check accepted product state before ordinary startup.
+The two `verify_state` actions check accepted product state before ordinary startup.
 `up --wait` waits for the generated health conditions.
 `down` stops ordinary services without deleting durable volumes.
 
 Internet exposure and Transport Layer Security (TLS) termination remain operator concerns. The
-generated package does not create or request Relay or Notary listener certificates.
+generated package does not create or request Relay listener certificates.
 An application that includes the package remains outside the Registryctl package verification
 claim.
 
@@ -266,6 +263,48 @@ Security (TLS), hostnames, edge request admission, network access, and compatibi
 generated package.
 The package verification result does not extend to the application model.
 
+## Add Evidence and Registry Mint to the application
+
+Evidence and Registry Mint are not lanes Registryctl generates, verifies, or initializes. An
+operator runs each as an ordinary service in the same application `compose.yaml` that includes
+the generated Relay package, alongside it rather than inside it.
+
+Each service needs its own operator-owned, startup-only configuration document mounted read-only:
+a `runtime.yaml` for every Evidence deployment (naming its immutable bundle directory, listener,
+secret root, and audit path) and, when the deployment has no identity provider to issue access
+tokens, a `mint.yaml` for Registry Mint (naming its signing key and client registry directory).
+[Configure Evidence](../../configure/evidence/) and
+[Configure Registry Mint](../../configure/mint/) cover both documents field by field.
+For an approved Evidence candidate, use
+[Integrate an Evidence candidate with Docker Compose](../../tutorials/integrate-evidence-candidate-with-docker-compose/).
+That guide keeps the candidate bundle, container runtime, secret root, and audit storage separate.
+
+Every listener either binary opens, including Evidence's optional `metricsListener`, must bind to
+a loopback, RFC 1918 private IPv4, or RFC 4193 unique-local address; a wildcard or public bind is
+refused at startup. Binding to the container's own loopback address makes a service reachable only
+from inside that same container, so a reverse proxy or gateway container that needs to reach
+Evidence or Registry Mint over the Compose network binds them to a private address on that network
+instead, never to `0.0.0.0`. TLS termination stays an operator concern here exactly as it does for
+the generated Relay package: Evidence's `listener.tlsTermination` is fixed to
+`operator-controlled-upstream`, so the same reverse proxy that terminates TLS for Relay can sit in
+front of Evidence and Registry Mint.
+
+Validate each configuration before opening a socket, then start the service:
+
+```sh
+evidence check --runtime /etc/registry-evidence/runtime.yaml
+mint check --config /etc/mint/mint.yaml
+evidence serve --runtime /etc/registry-evidence/runtime.yaml
+mint serve --config /etc/mint/mint.yaml
+```
+
+Use `GET /health` and `GET /ready` on each service's own listener for a Compose health check, the
+same way the generated Relay package uses `up --wait` for its own health conditions.
+[First run with Solmara Lab](../../tutorials/first-run-with-solmara-lab/) walks through Registry
+Mint, Relay, and Evidence composed behind one TLS-terminating gateway end to end; that tutorial is
+a lab environment, not a production posture, but the shape of the composition, one gateway in
+front of independently configured services with no host port of their own, carries over.
+
 ## Customize the generated package
 
 Use `binding.yaml` for supported generated choices.
@@ -299,3 +338,4 @@ invalid, not an adaptation.
 | Verification reports `invalid` | A hard product, secret, state, network, or privilege invariant failed. | Restore the generated boundary. Do not downgrade the failure to an override. |
 | Ordinary startup reports missing state | The one-time initialization was not completed or durable state was lost. | Complete first installation, or restore the exact recovery consistency group. Do not reinitialize an existing identity. |
 | An including application cannot reach a public service | The operator-owned include graph or network wiring is incomplete. | Correct the application model and rerun the application's Compose validation. |
+| Evidence or Registry Mint refuses to start with a listener bind error | `listener.bindHost` (or `metricsListener.bindHost`) is a wildcard, public, or unspecified address. | Bind to loopback for same-container access, or to a private address on the Compose network for the proxy to reach. |
diff --git a/docs/site/src/content/docs/operate/upgrade-and-rollback.mdx b/docs/site/src/content/docs/operate/upgrade-and-rollback.mdx
index 68c38e8ee..1faba4602 100644
--- a/docs/site/src/content/docs/operate/upgrade-and-rollback.mdx
+++ b/docs/site/src/content/docs/operate/upgrade-and-rollback.mdx
@@ -5,7 +5,7 @@ status: current
 owner: registry-docs
 source_repos:
   - registry-stack
-last_reviewed: "2026-07-31"
+last_reviewed: "2026-08-04"
 doc_type: how-to
 locale: en
 standards_referenced: []
@@ -108,7 +108,7 @@ mutable image tags, or combine a binding change with this product or evidence up
 ## Verify current state before shutdown
 
 From the current package root, follow its `generated/RUNBOOK.md`. Verify the effective
-Compose model and run all three dedicated, networkless state checks. Use the same explicit
+Compose model and run both dedicated, networkless state checks. Use the same explicit
 Compose project name for the current and candidate packages:
 
 ```sh
@@ -116,7 +116,6 @@ export REGISTRY_STACK_COMPOSE_PROJECT="${REGISTRY_STACK_COMPOSE_PROJECT:-<packag
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml config --no-interpolate --no-env-resolution --quiet
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-public-verify-state
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-consultation-verify-state
-docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-notary-verify-state
 ```
 
 Abort before shutdown if package, operator-file, bundle, anchor, Compose, or state
@@ -130,7 +129,7 @@ candidate's operator files.
 The preview actions verify the later candidate without changing durable anti-rollback state.
 Do not stop any service unless every preview succeeds.
 
-In the literal generated order below, keep current services running through all three preview
+In the literal generated order below, keep current services running through both preview
 commands.
 After those previews succeed, remove externally reachable traffic before the `stop` command and
 keep the source and write freeze required by the pre-update recovery groups.
@@ -139,21 +138,16 @@ Run the sequence from the candidate package root:
 ```sh
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-public-preview-state
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-consultation-preview-state
-docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-notary-preview-state
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml stop
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-public-accept-state
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-consultation-accept-state
-docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-notary-accept-state
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-public-verify-state
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-consultation-verify-state
-docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-notary-verify-state
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml run --rm --no-deps registry-relay-consultation-stage-secrets
-docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml run --rm --no-deps registry-notary-stage-secrets
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml run --rm --no-deps registry-postgresql-stage-secrets
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml up --detach --wait --wait-timeout 120
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-public-verify-state
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-relay-consultation-verify-state
-docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml -f generated/compose.initialize.yaml run --rm --no-deps registry-notary-verify-state
 docker compose --project-name "$REGISTRY_STACK_COMPOSE_PROJECT" --env-file generated/compose.empty.env -f generated/compose.yaml ps
 ```
 
@@ -169,9 +163,8 @@ Do not configure an automated rollback across this boundary.
 ## Verify the updated deployment
 
 - Confirm the expected services are healthy in `docker compose ... ps`.
-- Verify PostgreSQL and consultation Relay before admitting a Notary caller.
-- Exercise one authenticated canary for each affected public, consultation, evaluation,
-  issuance, and status path.
+- Verify PostgreSQL before admitting a consultation Relay caller.
+- Exercise one authenticated canary for each affected public and consultation path.
 - Exercise every affected SnapshotExact materialization because global readiness does
   not prove execution-time freshness.
 - Confirm audit records extend the retained chains without logging their values.
@@ -191,7 +184,7 @@ freshness, canary coverage, or safe rollback after product acceptance.
 Before the manual abort boundary, leave the current package running when a preview fails.
 If the current services were stopped after successful previews but no acceptance completed,
 restart the still-intact current package with its `generated/RUNBOOK.md`.
-Verify the current closure and run all three current `verify_state` actions before its ordinary
+Verify the current closure and run both current `verify_state` actions before its ordinary
 `up`.
 
 After the boundary, never start the older closure or restore a pre-update accepted
@@ -200,7 +193,7 @@ sequence. Choose one of these manual recovery paths:
 1. Complete the forward update after correcting the candidate's operator-controlled
    dependency.
 2. Restore a complete `relay-public-state` or `consultation-state` group at the same or
-   newer accepted sequence, then run all three read-only `verify_state` actions.
+   newer accepted sequence, then run both read-only `verify_state` actions.
 3. Provision a new instance identity, review and sign every affected lane, generate a
    new package, and follow first installation.
 
@@ -216,7 +209,7 @@ Reinitializing the same identity is not recovery.
 | Candidate generation reports an unresolved `generated.previous/` | Resolve the prior change and retention decision; do not delete the closure to bypass the guard |
 | Candidate verification reports a closure or approved-set mismatch | Keep the candidate offline and regenerate it from the intended verified inputs |
 | `verify_state` rejects the target as older | Keep services and traffic stopped; use a signed target with a higher sequence or restore a coherent same-or-newer group |
-| PostgreSQL or consultation Relay does not become healthy | Keep Notary and external dependants stopped; restore or repair the coherent private recovery group |
+| PostgreSQL or consultation Relay does not become healthy | Keep external dependants stopped; restore or repair the coherent private recovery group |
 | A failure appears after product acceptance | Do not restart the previous closure; complete forward, restore same-or-newer coherent state, or replace the instance identity |
 
 ## Next
diff --git a/docs/site/src/content/docs/reference/api-stability.mdx b/docs/site/src/content/docs/reference/api-stability.mdx
index 86686bb85..e2224023d 100644
--- a/docs/site/src/content/docs/reference/api-stability.mdx
+++ b/docs/site/src/content/docs/reference/api-stability.mdx
@@ -5,7 +5,7 @@ status: current
 owner: registry-docs
 source_repos:
   - registry-stack
-last_reviewed: "2026-07-19"
+last_reviewed: "2026-08-04"
 doc_type: reference
 locale: en
 standards_referenced: []
@@ -45,14 +45,14 @@ The enforcement column names the repository CI checks so the mechanism is audita
 | Surface | Contract artifact | Enforcement today |
 | --- | --- | --- |
 | Registry Relay HTTP API (approved stable public and admin listener surface) | Committed OpenAPI document `crates/registry-relay/openapi/registry-relay.openapi.json`, scoped by the [authoritative 1.0 support roster](../apis/registry-relay/) | `just openapi-contract` checks byte-for-byte generation, filters only roster entries declared `included_unstable`, then runs `oasdiff breaking` against the base ref |
-| Registry Notary HTTP API (public and admin listeners) | Committed OpenAPI document `products/notary/openapi/registry-notary.openapi.json` plus the route inventory `products/notary/security/exposure-manifest.json` | `just openapi-contract` compares against the base reference; `just openapi-check` and `just exposure-check` detect generated-contract drift |
-| Error contract and stable identifiers | RFC 9457 problem shape with the stable `code` member, the [error registry](../errors/), the `pdp.*` denial codes, and the `https://id.registrystack.org/` identifier space | `release/scripts/check-stable-surface-compatibility.py` permits additions and rejects removal or changed meaning; product tests pin runtime rendering and status mappings |
-| Configuration formats and documented environment variables | The committed Draft 2020-12 schemas `schemas/registry-relay.config.schema.json` and `schemas/registry-notary.config.schema.json`, plus the [environment variable reference](../environment-variables/) | Product `config-schema-check` commands reproduce the schemas from the typed config graphs; strict parsers and the deprecated-field guard reject unknown or retired fields |
-| Signed config bundle format and verification semantics | `registry.platform.config_bundle.v1` manifests, `registry.platform.config_bundle_signatures.v1` signature envelopes, and `registry.platform.config_trust_anchor.v1` trust anchors. Normal signed verification requires a valid, non-empty trust anchor and checks signature acceptance, file closure, product/environment/stream binding, optional instance pinning, and anti-rollback sequence. The hash-pinned `registry.platform.config_break_glass.v1` `accept_rollback` mode keeps signature, binding, closure, hash, and product checks but waives the monotonic sequence rejection for a signed bundle whose config hash matches the override. Its `accept_unsigned` mode skips signature, binding, and sequence checks while retaining exact hash pinning and product config validation. | Shared verifier tests in `registry-platform-config`; break-glass consumption, restart-pin, and sequence tests in `registry-platform-ops`; product CLI coverage in `crates/registry-relay/tests/config_verify_bundle_cli.rs` and `crates/registry-notary/tests/config_verify_bundle_cli.rs` |
+| Evidence HTTP API and its Version 1 contracts | The frozen Version 1 source contracts under `products/evidence/contracts/`, indexed by `products/evidence/contracts/README.md`, and the artifacts generated from them under `products/evidence/generated/`, including `registry-evidence.openapi.json` | Root CI's `evidence-contracts` job runs `products/evidence/scripts/check-contracts.sh`, which regenerates every contract artifact and fails on any byte difference from the committed copies, and `products/evidence/scripts/check-source-neutrality.sh` |
+| Error contract and stable identifiers | RFC 9457 problem shape with the stable `code` member, the [error registry](../errors/), the `pdp.*` denial codes, and the `https://id.registrystack.org/` identifier space. Evidence's closed problem set has its own frozen contract, `products/evidence/contracts/problem-contract.yaml`, documented at [Evidence problem types](../evidence-problems/) | `release/scripts/check-stable-surface-compatibility.py` permits additions and rejects removal or changed meaning; product tests pin runtime rendering and status mappings; the `evidence-contracts` job byte-diffs the generated Evidence problem schema |
+| Configuration formats and documented environment variables | The committed Draft 2020-12 schema `schemas/registry-relay.config.schema.json`, the frozen Evidence schemas `products/evidence/contracts/runtime.schema.yaml` and `products/evidence/contracts/bundle.schema.yaml`, plus the [environment variable reference](../environment-variables/) | Relay's `config-schema-check` command reproduces its schema from the typed config graph; Evidence's config parser is tested against the frozen contract schemas (`crates/registry-evidence/src/config.rs`); strict parsers and the deprecated-field guard reject unknown or retired fields |
+| Signed config bundle format and verification semantics | `registry.platform.config_bundle.v1` manifests, `registry.platform.config_bundle_signatures.v1` signature envelopes, and `registry.platform.config_trust_anchor.v1` trust anchors. Normal signed verification requires a valid, non-empty trust anchor and checks signature acceptance, file closure, product/environment/stream binding, optional instance pinning, and anti-rollback sequence. The hash-pinned `registry.platform.config_break_glass.v1` `accept_rollback` mode keeps signature, binding, closure, hash, and product checks but waives the monotonic sequence rejection for a signed bundle whose config hash matches the override. Its `accept_unsigned` mode skips signature, binding, and sequence checks while retaining exact hash pinning and product config validation. | Shared verifier tests in `registry-platform-config`; break-glass consumption, restart-pin, and sequence tests in `registry-platform-ops`; product CLI coverage in `crates/registry-relay/tests/config_verify_bundle_cli.rs` |
 | Registry Manifest schema and rendered artifacts | `registry-manifest/v1` and the rendered artifact schema versions, governed by [RS-DM-MANIFEST](../../spec/rs-dm-manifest/) | `validate_manifest` accepts only `registry-manifest/v1`; REQ-DM-MANIFEST-013 requires strict unknown-key rejection at parse time |
 | Source-adaptation integration surfaces | Registry Relay's compiled `http`, `script`, and `snapshot` consultation plans, including the Rhai `consult(ctx)` host API and versioned protocol helpers | Registry Stack project-authoring schemas and fixtures; Relay source-plan compiler and consultation contract tests |
-| Command-line interfaces | Documented commands and flags of `registryctl`, `registry-relay`, `registry-notary`, and `registry-manifest`, and their machine-readable output modes (`--format json`, `openapi`, `schema`) | CLI reference pages; `registryctl` version test |
-| Release artifacts and verification interface | Released binary and image names (`ghcr.io/registrystack/registry-relay`, `ghcr.io/registrystack/registry-notary`), signature and provenance layout per `release/VERIFY.md` | Release workflow; signed assets verified as documented in [SECURITY.md](https://github.com/registrystack/registry-stack/blob/v0.13.0/SECURITY.md) |
+| Command-line interfaces | Documented commands and flags of `registryctl`, `registry-relay`, `registry-manifest`, and `evidence`, and their machine-readable output modes (`--format json`, `openapi`, `schema`) | CLI reference pages; `registryctl` version test; the `evidence` command surface is stated in `products/evidence/OPERATOR-CONTRACT.md` and exercised end to end against the built binary in `crates/registry-evidence/tests/cli.rs` |
+| Release artifacts and verification interface | Released binary and image names (`ghcr.io/registrystack/registry-relay`), signature and provenance layout per `release/VERIFY.md` | Release workflow; signed assets verified as documented in [SECURITY.md](https://github.com/registrystack/registry-stack/blob/v0.13.0/SECURITY.md) |
 | Selected Prometheus metrics | Family name, type, label keys, and label meaning in `release/contracts/selected-metrics.json` | `release/scripts/check-stable-surface-compatibility.py` permits additive families and rejects incompatible changes; product tests verify bounded labels and rendering |
 
 Metric help text, output ordering, and corrections to observed values are not covered.
@@ -68,6 +68,14 @@ JSON aggregate output and the core protected entity record routes remain stable.
 The compatibility filter reads the roster's machine selectors; it does not maintain another
 format list.
 
+Registry Mint is deliberately absent from the table. It is a supporting service whose
+configuration fields, token endpoint shape, and CLI flags may still change without a major
+release, as the [Registry Mint reference](../mint/) states for each of its surfaces. What
+Registry Mint does hold steady is structural rather than versioned: the `client_credentials` grant
+with `private_key_jwt` client authentication (RFC 7523), the collapse of every client
+authentication failure to `invalid_client`, and authority written from the client registry rather
+than from the caller's request.
+
 ## What counts as a breaking change
 
 For HTTP APIs:
@@ -108,15 +116,15 @@ Every release documents a forward state path from its immediate predecessor.
 An upgrade that skips releases follows each sequential hop unless the target release explicitly
 certifies a direct path.
 
-The reverse is not promised. Both products parse config with `deny_unknown_fields`, so a
-config file that uses keys introduced in a newer release fails to load on an older binary.
-Pin your config to the release you deploy.
+The reverse is not promised. Registry Relay, Evidence, and Registry Mint all parse config with
+`deny_unknown_fields`, so a config file that uses keys introduced in a newer release fails to load
+on an older binary. Pin your config to the release you deploy.
 
-Registry Notary state upgrades are forward-only.
-An older Registry Notary binary must never start against a schema installed or changed by a newer
-release.
-The supported combined topology pairs exactly one Notary authority with each Relay authority;
-replicas may share an authority only when they serve the same authority configuration.
+Evidence and Registry Mint have no migrated state to upgrade. Evidence persists the append-only
+audit log named by `auditStorage` in its runtime file. Registry Mint persists its client registry
+and the keyed append-only chain named by `audit.path`, while its client-assertion replay cache
+remains in memory. A newer binary must be checked against these retained audit formats before
+deployment even though neither product has a migration command.
 
 ## Defaults are part of the contract
 
@@ -133,8 +141,11 @@ The following are not covered by the compatibility promise, at any version:
   and crate-level APIs may change in any release.
 - Human-readable CLI output, log message text, and problem `detail` strings. Machine
   consumers must use the JSON output modes, the structured log format, and the `code` member.
-- Hidden commands and internal protocols, including `registry-notary cel-worker` and the
-  worker-harness line protocols.
+- Hidden commands and internal protocols. A command or protocol that no reference page documents
+  is not a covered surface.
+- Adopter tooling that wraps a covered surface rather than defining one, including `evidencectl`,
+  which generates key material and project scaffolds and shells out to the `evidence` binary for
+  every Evidence semantic decision.
 - The layout of the repository, the `products/` export trees, the docs site internals, and
   the lab tooling.
 - Descriptions, summaries, and ordering inside generated OpenAPI documents. The contract is
@@ -143,15 +154,21 @@ The following are not covered by the compatibility promise, at any version:
 ## Route version namespaces
 
 The HTTP surface carries several independent version prefixes: `/v1` (data plane),
-`/admin/v1` (admin plane, separate listener on Registry Relay), `/ogc/v1` and `/ogc/edr/v1`
-(standards adapters), and `/federation/v1` (Registry Notary federation). Each namespace
-versions independently; a `/v2` in one namespace does not imply a `/v2` in another.
-
-Two Registry Notary routes are permanently unversioned by protocol necessity:
-`/credentials/{vct_path}` and `/.well-known/vct/{vct_path}` must exactly match the `vct`
-dereference URL of issued credentials, per SD-JWT VC and RFC 8615 semantics. Discovery and
-operational routes (`/.well-known/*`, `/oid4vci/*`, `/healthz`, `/ready`, `/metrics`,
-`/docs`) follow their upstream protocol or operational conventions and are also unversioned.
+`/admin/v1` (admin plane, separate listener on Registry Relay), and `/ogc/v1` and `/ogc/edr/v1`
+(Relay standards adapters). Each namespace versions independently; a `/v2` in one namespace does
+not imply a `/v2` in another.
+
+Evidence's two versioned routes, `POST /v1/evidence` and `GET /v1/evidence-definitions`, are the
+whole of its evidence surface under the frozen Version 1 contract. Its remaining routes are
+operational or discovery routes and are unversioned by convention: `/health`, `/ready`,
+`/openapi.json`, `/.well-known/evidence/jwks.json`, and `/.well-known/jwt-vc-issuer`. Evidence
+serves `/metrics` on a separate listener when one is configured, never on the request listener.
+
+Registry Mint's routes are unversioned by protocol convention rather than by promise: the fixed,
+non-configurable `POST /token`, the key set at the configured `signing.jwksPath` (default
+`/.well-known/jwks.json`), `/.well-known/oauth-authorization-server`, `/health`, and `/ready`.
+Discovery routes under `/.well-known/` follow RFC 8615 and their own upstream protocol
+conventions, so they carry no version prefix in any product.
 
 ## Enforcement
 
@@ -161,15 +178,17 @@ The promise is machine-checked where a checker exists:
   document from the reference config, requires a byte-for-byte match with the committed file,
   removes only the aggregate representations marked `included_unstable` by the authoritative
   Relay roster, and runs `oasdiff breaking` against the base ref.
-- Notary: `just openapi-contract` compares the regenerated OpenAPI document against the base
-  reference; `just openapi-check` and `just exposure-check` keep the document and exposure
-  manifest in lockstep with the code.
+- Evidence: root CI's `evidence-contracts` job regenerates every contract artifact from the code
+  with `products/evidence/scripts/check-contracts.sh` and fails on any byte difference from the
+  committed copies, so the OpenAPI document, the problem schema, and the request and response
+  schemas cannot drift from a released binary.
 - Errors and metrics: `release/scripts/check-stable-surface-compatibility.py` compares the
   released registry and selected metric contract against the base reference while permitting
   additions.
-- Config: each product reproduces its committed schema from its typed config graph;
-  `registry-platform-config` rejects removed or renamed keys with a pointer to the migration
-  note instead of silently ignoring them.
+- Config: Registry Relay reproduces its committed schema from its typed config graph, and
+  Evidence's config parser is tested against the frozen contract schemas rather than a schema
+  generated from it; `registry-platform-config` rejects removed or renamed keys with a pointer to
+  the migration note instead of silently ignoring them.
 
 A change that a gate flags as breaking lands only in a release whose version number permits
 it, together with the deprecation and migration steps required by the
diff --git a/docs/site/src/content/docs/reference/apis/index.mdx b/docs/site/src/content/docs/reference/apis/index.mdx
index e1ec57b29..f81d1fc63 100644
--- a/docs/site/src/content/docs/reference/apis/index.mdx
+++ b/docs/site/src/content/docs/reference/apis/index.mdx
@@ -1,13 +1,13 @@
 ---
 title: API references
-description: Generated API reference pages for Registry Relay and Registry Notary, built from pinned OpenAPI artifacts.
+description: Generated API reference pages for Registry Relay and Evidence, built from pinned OpenAPI artifacts.
 wide: true
 status: current
 owner: registry-docs
 source_repos:
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-06-20"
+  - registry-evidence
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced:
@@ -16,7 +16,8 @@ standards_referenced:
 
 import OpenApiSourcesTable from '../../../../components/OpenApiSourcesTable.astro';
 
-Use this section to browse the HTTP API for Registry Relay or Registry Notary. Each page is built from a pinned OpenAPI artifact owned by the project it describes.
+Use this section to browse the HTTP API for Registry Relay or Evidence. Each
+page is built from a pinned OpenAPI artifact owned by the project it describes.
 
 {/* Do not duplicate endpoint reference content in narrative pages. */}
 
@@ -31,8 +32,8 @@ The table is generated from `src/data/openapi-sources.yaml`.
 
 - [Registry Relay API](./registry-relay/) documents the Protected Registry Data API, metadata API,
   evidence offering discovery, health and readiness endpoints, and optional standards adapters.
-- [Registry Notary API](./registry-notary/) documents the claim discovery, evaluation, batch
-  evaluation, rendering, JWKS, service discovery, and credential issuance endpoints.
+- [Registry Evidence API](./registry-evidence/) documents the assertion, requester-scoped
+  definition discovery, health, readiness, served-contract, and key discovery endpoints.
 
 ## Provenance and freshness
 
@@ -44,10 +45,14 @@ The contract lives in `registry-relay/openapi/registry-relay.openapi.json`.
 Feature-gated surfaces (OGC API Features, OGC API Records, OGC API EDR, and SP DCI) are included with notes in each tag description explaining the build feature that mounts them.
 For the instance-specific shape of `{dataset_id}` and `{entity}` in a given deployment, fetch `GET /openapi.json` from that gateway. Runtime deployments gate that route by default unless `openapi_requires_auth` is disabled for demos or controlled tooling.
 
-[Registry Notary](../../products/registry-notary/) generates its OpenAPI document via a subcommand:
+[Evidence](../../products/registry-evidence/) generates its OpenAPI document with the other
+Evidence contract artifacts:
 
 ```sh
-cargo run -p registry-notary -- openapi > openapi/registry-notary.openapi.json
+cargo run -p registry-evidence --example evidence-contracts -- --output "<directory>"
 ```
 
-Regenerate and re-pin the artifact when the Notary API changes.
+The committed copy lives in `products/evidence/generated/`, and root CI's `evidence-contracts`
+job fails on any byte difference between the committed artifacts and a fresh generation. A running
+Evidence service publishes the same document at `GET /openapi.json` with no authentication
+required.
diff --git a/docs/site/src/content/docs/reference/apis/registry-evidence.mdx b/docs/site/src/content/docs/reference/apis/registry-evidence.mdx
new file mode 100644
index 000000000..7f5badbed
--- /dev/null
+++ b/docs/site/src/content/docs/reference/apis/registry-evidence.mdx
@@ -0,0 +1,110 @@
+---
+title: Registry Evidence API
+description: "Narrative context for the Registry Evidence OpenAPI reference: authentication, response formats, the frozen Version 1 contract, and documented limitations."
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-03"
+doc_type: reference
+locale: en
+standards_referenced:
+  - openapi
+  - sd-jwt-vc
+  - cccev
+---
+
+[Open the Registry Evidence API operations](../evidence/)
+
+The generated API reference linked above is the **authoritative route reference**. It is built from
+Evidence's generated OpenAPI document, synced from the
+[`registry-stack`](https://github.com/registrystack/registry-stack) monorepo at the commit pinned in
+`src/data/repo-docs.yaml`. This page carries the context the specification does not: what the
+service asserts, how authentication works, which response formats exist, and what stays out of
+scope.
+
+For exact routes and schemas, read the generated API reference. For deployment and operator
+duties, see the [Registry Evidence product documentation](../../../products/registry-evidence/).
+
+## What the API is
+
+Evidence is a minimum-disclosure assertion service. Given an authenticated requester, an
+authorized purpose, a predefined requirement, and the configured selector data an authoritative
+provider needs, `POST /v1/evidence` returns the smallest sufficient JSON assertion in an
+authorized response format. `GET /v1/evidence-definitions` is an authenticated, requester-scoped
+description of the complete request shapes the deployed bundle already authorizes; it is not a
+public catalog. The remaining routes are operational: `GET /health`, `GET /ready`,
+`GET /openapi.json`, the signing keys at `GET /.well-known/evidence/jwks.json`, and JWT VC issuer
+metadata at `GET /.well-known/jwt-vc-issuer`.
+
+The assertion is the product's CCCEV-aligned domain object, expressed as a documented Evidence
+JSON profile rather than RDF or XML (`products/evidence/CONCEPT.md`). The Version 1 contract is
+frozen: the two versioned operations and their envelopes are the complete evidence surface.
+
+## Source of truth
+
+The OpenAPI document is a generated artifact committed at
+`products/evidence/generated/registry-evidence.openapi.json`. Regenerate it into a separate
+directory with:
+
+```sh
+cargo run -p registry-evidence --example evidence-contracts -- --output "<directory>"
+```
+
+Root CI's `evidence-contracts` job runs `products/evidence/scripts/check-contracts.sh`, which
+regenerates the contracts and fails on any byte difference from the committed artifacts, so the
+committed document cannot drift from the code. The docs build then pulls the committed document at
+the pinned ref (`scripts/fetch-openapi.mjs`) and renders it as the generated operations pages.
+
+A running Evidence service publishes the same document at `GET /openapi.json` with media type
+`application/openapi+json`. The route requires no authentication and reaches no dependency; the
+handler in `crates/registry-evidence/src/server.rs` takes no credential, and the unit test
+`the_served_openapi_document_is_the_generated_release_artifact` in
+`crates/registry-evidence/src/contracts.rs` pins the served bytes to the generated artifact.
+
+## Authentication
+
+The two evidence routes require exactly one `Authorization` header containing one Bearer token.
+Evidence verifies OIDC access tokens against one reviewed profile: exactly one trusted issuer with
+exact audience, token type, and algorithm allowlists, and one configured principal claim with no
+`client_id`, `azp`, header, or request fallback (`products/evidence/OPERATOR-CONTRACT.md`). There
+is no API-key mode. The operational routes take no credential and reveal no deployment
+definitions or entitlements.
+
+## Response formats
+
+Version 1 governs three response formats; signed flattened JWS is the mandatory default:
+
+- `application/jose+json`: the signed flattened JWS, the default and the durable-verification
+  format.
+- `application/vnd.registrystack.evidence-unsigned+json`: a visibly unsigned JSON envelope that a
+  governed authority grant must explicitly permit. It is transport-authenticated convenience data,
+  not later-verifiable evidence, and never a fallback from signing failure.
+- `application/dc+sd-jwt`: the same assertion serialized as an SD-JWT VC under the frozen profile
+  in `products/evidence/contracts/sd-jwt-vc-profile.yaml`. Values use one root disclosure by
+  default. A governed structured value can instead disclose each direct field independently.
+  Enabling the format adds a serialization, not a credential lifecycle.
+
+## What the specification does not cover
+
+- Deployment definitions: the generated document describes the generic operations, envelopes,
+  media types, and safe problems. It contains no deployment's requirement definitions or
+  entitlements; those are discovered through the authenticated `GET /v1/evidence-definitions`
+  route.
+- Credential lifecycle: there is no OID4VCI, credential offer, status list, holder proof, or
+  wallet interaction. The SD-JWT VC response format is a second encoding of one response.
+- Wallet interoperability and presentation: outside the Version 1 boundary
+  (`products/evidence/SD-JWT-VC-DEMO.md`).
+
+## Behavior the schema cannot express
+
+- Audit durability: the access record is durably accepted before source access, and the
+  disclosure-release record is durably accepted before the response bytes reach the caller
+  (`products/evidence/contracts/security-invariant-matrix.yaml`; the measured cost is recorded in
+  `products/evidence/PERFORMANCE.md`).
+
+:::caution
+Because release is gated on durable audit acceptance, an unavailable audit store surfaces as
+request failure, not as a silently unaudited response. Monitor the audit store as part of the
+operational runbook.
+:::
diff --git a/docs/site/src/content/docs/reference/apis/registry-notary.mdx b/docs/site/src/content/docs/reference/apis/registry-notary.mdx
deleted file mode 100644
index e22791a2f..000000000
--- a/docs/site/src/content/docs/reference/apis/registry-notary.mdx
+++ /dev/null
@@ -1,140 +0,0 @@
----
-title: Registry Notary API
-description: "Narrative context for the Registry Notary OpenAPI reference: authentication, disclosure profiles, credential issuance, and documented limitations."
-status: current
-owner: registry-notary
-source_repos:
-  - registry-notary
-  - registry-platform
-last_reviewed: "2026-06-21"
-doc_type: reference
-locale: en
-standards_referenced:
-  - openapi
-  - sd-jwt-vc
-  - cccev
-  - json-ld
-  - w3c-did
----
-
-[Open the Registry Notary API operations](../notary/)
-
-The generated API reference linked above is the **authoritative route reference**. It is built from
-Registry Notary's generated OpenAPI document, synced from the
-[`registry-notary`](https://github.com/registrystack/registry-stack) repository at the commit pinned in
-`src/data/repo-docs.yaml`. This page carries the context the specification does not: how
-authentication works, how disclosure is controlled, what credentials look like, and what is out of
-scope.
-
-For exact routes and schemas, read the generated API reference. For setup and operations, see the
-[Registry Notary product documentation](../../../products/registry-notary/).
-
-## What the API is
-
-Registry Notary implements the claim-evaluation and credential-issuance parts of the Evidence
-Gateway pattern. It is a standalone service for claim evaluation, disclosure policy, credential
-issuance, and audit. Every configured claim derives from a compiler-pinned
-Registry Relay consultation. A Notary deployment may start without claims, but
-cannot evaluate evidence until its project configures Relay.
-Callers discover its capabilities and claim catalog at `GET /.well-known/evidence-service`.
-This route requires authentication (the same `x-api-key` or `Authorization: Bearer` token as other
-evaluation routes); it is not a public discovery endpoint.
-The issuer JWKS at `GET /.well-known/evidence/jwks.json` is public and requires no credentials.
-The evaluation, rendering, credential, and OID4VCI routes are documented in the generated API reference.
-
-The OID4VCI profile is registry-backed and issuer initiated. Its only
-wallet-facing grant is pre-authorized code. It uses EdDSA `did:jwk` holder
-proof and EdDSA or ES256 issuer signing. The identity provider's authorization
-code remains internal to Notary. There is no public nonce route, response next
-nonce, issuance from caller-provided evidence, ES256 holder proof, EUDI, HAIP, PAR, DPoP, or
-wallet-attestation profile.
-
-## Authentication
-
-Registry Notary runs in static-credential mode or OIDC mode:
-
-- Static credentials: The client presents either an `x-api-key` token or an
-  `Authorization: Bearer` token. Notary fingerprints the presented token and compares it
-  (constant-time) against `sha256:<...>` values loaded from environment variables at startup. Each
-  credential carries a `scopes` list, and per-claim scope requirements are enforced before
-  evaluation.
-- OIDC: Notary delegates token verification to Registry Platform OIDC primitives (issuer, JWKS
-  URI, audiences, algorithms, scope mapping) and still owns the scopes its claim routes require.
-
-For the exact configuration, see the
-[operator configuration reference](../../../products/registry-notary/operator-config-reference/).
-
-## Disclosure profiles
-
-Notary controls what a caller receives through three disclosure levels (`value`, `predicate`, `redacted`), each governed by `default` and `allowed` settings in the claim definition.
-For a full explanation of how the levels interact and the downgrade strategies, see [Evidence issuance, end to end](../../../explanation/evidence-issuance/).
-
-## Credential issuance
-
-Notary issues SD-JWT VC credentials:
-
-- Token type `dc+sd-jwt`, with issuer signing configured as EdDSA (Ed25519) or ES256 (P-256).
-- The issuer key comes from the configured signing provider; its public JWK is published at
-  `GET /.well-known/evidence/jwks.json`.
-- Individual claim fields are wrapped in SD-JWT disclosures with SHA-256 digests for selective
-  disclosure.
-
-Issuance and holder-proof helpers come from Registry Platform; Notary owns the credential profile,
-claim selection, and route workflow. Notary does **not** emit W3C Verifiable Credentials Data Model
-envelopes: the format is SD-JWT, not a W3C VC JSON object.
-
-Both issuance routes require a newly stored, non-delegated evaluation with
-exact compiler pins and normalized unique Relay execution records for every
-selected root's registry-backed dependency closure. Each pin has a
-deterministic SHA-256 binding to its execution and exact claim provenance;
-issuance recomputes it before signer access. This detects partial stored-record
-mutation but is not a keyed authenticity anchor. Private execution ids are
-stored only for evaluations whose roots share a validated credential profile.
-Legacy and delegated evaluations without the configured representative
-ceremony remain renderable but are nonissuable and must be
-re-evaluated.
-
-## CCCEV rendering
-
-The render route can return CCCEV-shaped JSON-LD when the caller requests
-`application/ld+json; profile="cccev"`. The output includes an `@context` with the `cccev`,
-`dcterms`, `foaf`, `time`, and `xsd` namespaces, evidence nodes typed as `cccev:Evidence`, and CCCEV
-properties (`cccev:isProvidedBy`, `cccev:supportsRequirement`, `cccev:supportsValue`,
-`cccev:validityPeriod`, `cccev:isConformantTo`). Conformance against CCCEV 2.00 is not claimed;
-consume the output by parsing the `@graph` for `cccev:Evidence` nodes.
-
-## Evidence inputs
-
-Notary accepts one evidence mode. Registry-backed claims consume exactly one
-compiler-pinned Registry Relay consultation. The contract fixes each
-consultation profile, inputs, purpose, and expected result shape before Relay
-performs source work. Caller identity and authorization details can authorize
-or parameterize the request, but do not become claim evidence.
-
-Registry Relay owns all registry source origins, credentials, HTTP execution, script adaptation,
-protocol helpers, snapshots, and minimized typed consultation outputs. Notary does not configure
-or execute direct registry source connectors.
-
-## What the specification does not cover
-
-- Plugin rule type: The `Plugin` rule variant is declared in config but has no implementation at
-  the pinned commit.
-- Holder binding: OID4VCI supports EdDSA `did:jwk` holder proof only.
-- Demo helpers: Generated workflow helpers are examples, not production replay-protection
-  profiles. Add freshness, expiry, or nonce checks before copying a helper into a production
-  workflow.
-- Admin reload: the standalone router returns `501` with
-  `registry.admin.capability.not_supported`; key and configuration changes require a service
-  restart.
-- Admin posture: `GET /admin/v1/posture` returns the shared versioned operations observation.
-  [RS-OP-POSTURE](../../../spec/rs-op-posture/) defines its envelope, tiers, and consumer rules.
-
-## Behavior the schema cannot express
-
-- Audit events: Every evaluated request emits an `EvidenceAuditEvent` in a Registry Platform
-  audit envelope to a configured sink (`stdout`, `file`/`jsonl`, or `syslog`).
-
-:::caution
-Audit write failures surface as request errors, not as silent log entries. If the audit sink is
-unavailable, callers receive errors. Monitor the audit sink as part of your operational runbook.
-:::
diff --git a/docs/site/src/content/docs/reference/apis/registry-relay.mdx b/docs/site/src/content/docs/reference/apis/registry-relay.mdx
index bce032043..bab5efe3a 100644
--- a/docs/site/src/content/docs/reference/apis/registry-relay.mdx
+++ b/docs/site/src/content/docs/reference/apis/registry-relay.mdx
@@ -6,7 +6,7 @@ owner: registry-relay
 source_repos:
   - registry-relay
   - registry-platform
-last_reviewed: "2026-07-19"
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced:
@@ -79,7 +79,10 @@ For setup steps, scope strings, and credential configuration, see
   posture document returned by `GET /admin/v1/posture`.
 - **Evidence-offering discovery.** Relay publishes evidence-offering metadata at
   `GET /metadata/evidence-offerings` and `GET /metadata/evidence-offerings/{offering_id}`.
-  These routes describe where to reach a Notary for verification; Relay does not execute the
-  verification itself.
+  Runtime binding accepts only `access.kind: registry-evidence`, so an offering points at a
+  Registry Evidence deployment: its `endpoint_url` is where the assertion is requested and its
+  `discovery_url` resolves the issuer keys a relying party needs to verify the response. Relay
+  never answers the evidence request behind an offering; an offering is a pointer somewhere
+  else.
 - **Read-only, no streaming.** Relay does not mutate source registry data. Sources are read as batch
   snapshots or table scans; there is no event-stream backend.
diff --git a/docs/site/src/content/docs/reference/contracts.mdx b/docs/site/src/content/docs/reference/contracts.mdx
index 747c48a23..d6ac15d5f 100644
--- a/docs/site/src/content/docs/reference/contracts.mdx
+++ b/docs/site/src/content/docs/reference/contracts.mdx
@@ -8,8 +8,7 @@ source_repos:
   - registry-relay
   - registry-platform
   - registry-manifest
-  - registry-notary
-last_reviewed: "2026-06-21"
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced:
@@ -30,7 +29,6 @@ A contract is a machine-readable surface that integrators can depend on:
 - **Shared crate API**: Rust library surface consumed by registry services for common behavior.
 - **Portable metadata schema**: the `registry-manifest/v1` YAML schema defining datasets, fields, policies, and evidence offerings.
 - **Static publication bundle**: a manifest-generated directory of catalog, SHACL, schema, policy, and evidence offering files that can be hosted without running any service.
-- **Capability query envelope**: the JSON structure returned by `/.well-known/evidence-service` describing a Notary instance's claim catalog and capabilities.
 
 Each contract has one owning project. When a contract changes, the owning repo is the source of truth. Shared crate APIs belong to Registry Platform; product routes and config behavior belong to the consuming service.
 
@@ -71,11 +69,11 @@ Stable machine identifiers for the registry stack resolve at `https://id.registr
 ### Credential contract ownership
 
 Registry Relay no longer issues signed response credentials and no longer serves the former credential-support routes `/.well-known/did.json`, `/schemas/{claim_type}/{version}`, or `/contexts/{vocab}/{version}`.
-Registry Notary owns credential issuance, credential status, issuer metadata, and public verification keys.
-Use the Registry Notary OpenAPI contract and capability discovery document for credential workflows.
+[Evidence](../../products/registry-evidence/) owns signed assertions and the public verification keys it serves at `/.well-known/evidence/jwks.json`.
+Its assertion contract is frozen at Version 1 and is documented with the product rather than listed in the table above.
 
 The removed Relay routes are not production contracts for 1.0.
-Clients that need signed credentials must follow an evidence offering to a Registry Notary or another configured evidence service.
+A client that needs a signed, minimum-disclosure answer calls Evidence directly instead of following a Relay evidence offering.
 
 ### JSON-LD namespaces
 
diff --git a/docs/site/src/content/docs/reference/deprecation-policy.mdx b/docs/site/src/content/docs/reference/deprecation-policy.mdx
index 03824168b..9615df53d 100644
--- a/docs/site/src/content/docs/reference/deprecation-policy.mdx
+++ b/docs/site/src/content/docs/reference/deprecation-policy.mdx
@@ -5,7 +5,7 @@ status: current
 owner: registry-docs
 source_repos:
   - registry-stack
-last_reviewed: "2026-07-19"
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced: []
@@ -54,8 +54,8 @@ A deprecation is announced in every channel a consumer of that element reads:
 Every deprecation and every removal ships with concrete migration steps in the CHANGELOG
 entry: old key to new key, old route to new route, old metric name to new metric name, with
 copyable examples. "Removed X" without a migration path does not meet this policy. For examples,
-see the `BREAKING:` entries in `products/notary/CHANGELOG.md` and
-`crates/registry-relay/CHANGELOG.md`.
+see the `BREAKING:` entries in `crates/registry-relay/CHANGELOG.md` and
+`crates/registryctl/CHANGELOG.md`.
 
 ## Security exceptions
 
diff --git a/docs/site/src/content/docs/reference/diagnostics/operator.mdx b/docs/site/src/content/docs/reference/diagnostics/operator.mdx
index fa70662ef..b895309ae 100644
--- a/docs/site/src/content/docs/reference/diagnostics/operator.mdx
+++ b/docs/site/src/content/docs/reference/diagnostics/operator.mdx
@@ -6,9 +6,8 @@ owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
   - registry-platform
-last_reviewed: "2026-07-26"
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced: []
@@ -17,8 +16,8 @@ wide: true
 
 import DiagnosticReference from '../../../../components/DiagnosticReference.astro';
 
-Use this catalog for Registryctl readiness, bundle verification, Relay activation, and Notary
-activation codes. Each product owns its closed code definitions and static guidance.
+Use this catalog for Registryctl readiness, bundle verification, Relay activation, and Relay
+process startup codes. Each product owns its closed code definitions and static guidance.
 The generated reference aggregates those definitions without copying runtime errors or values.
 
 Run `registryctl tooling diagnostics --catalog operator --format json` for the exact
diff --git a/docs/site/src/content/docs/reference/environment-variables.mdx b/docs/site/src/content/docs/reference/environment-variables.mdx
index ccba1a807..fcb6a6369 100644
--- a/docs/site/src/content/docs/reference/environment-variables.mdx
+++ b/docs/site/src/content/docs/reference/environment-variables.mdx
@@ -1,26 +1,27 @@
 ---
 title: Environment variable reference
-description: Environment variables read by Registry Notary, Registry Relay, and registryctl, with links to the full configuration references.
+description: Environment variables read by the Evidence, Registry Mint, and Registry Relay binaries and by registryctl, with links to the full configuration references.
 status: current
 owner: registry-docs
 source_repos:
-  - registry-notary
+  - registry-evidence
+  - registry-mint
   - registry-relay
   - registry-registryctl
-last_reviewed: "2026-07-07"
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced: []
 ---
 
-This page lists the environment variables read directly by the Registry Notary binary, the Registry Relay binary, and registryctl. These are fixed variable names that the process resolves itself.
+This page lists the environment variables read directly by the Evidence binary, the Registry Mint binary, the Registry Relay binary, and registryctl. These are fixed variable names that the process resolves itself.
 
-Secret material such as credential hashes, signing keys, and upstream tokens is not read from a fixed variable name. Instead, each config field names the environment variable to read, and the operator chooses the name. Those per-deployment variables are documented in the synced configuration references rather than repeated on this page. See the [Registry Notary operator config reference](../../products/registry-notary/operator-config-reference/) and the [Registry Relay configuration reference](../../products/registry-relay/configuration/) for the config fields that name secret environment variables.
+The stack's other kind of environment variable is operator-named. Secret material such as credential hashes and upstream tokens is not read from a fixed variable name: a config field names the environment variable to read, and the operator chooses the name. Those per-deployment variables are documented in the synced configuration reference rather than repeated on this page. Registry Relay is the product that works that way; see the [Registry Relay configuration reference](../../products/registry-relay/configuration/) for the config fields that name secret environment variables. Evidence and Registry Mint read no secret from the environment under either kind of name, as the sections for each product record.
 
 ## Configuration expansion
 
-Registry Notary and Registry Relay expand `${VAR}` expressions before YAML
-parsing.
+Registry Relay expands `${VAR}` expressions before YAML parsing, using the shared
+`expand_config_env_vars` helper in `registry-platform-config`.
 `${VAR}` requires `VAR` to be set to a non-empty value.
 `${VAR:-fallback}` uses `fallback` when `VAR` is unset or empty, including
 `${VAR:-}` for an explicit empty result.
@@ -29,18 +30,32 @@ Whitespace-only values are non-empty.
 Diagnostics name the variable or use the supplied message; they never include
 the variable value.
 
-## Registry Notary
+Evidence and Registry Mint do not expand environment references in configuration.
+Both parse their documents as written: Evidence in `RuntimeConfig::parse_yaml`
+(`crates/registry-evidence/src/config.rs`) and Registry Mint in `MintConfig::load`
+(`crates/registry-mint/src/config.rs`).
 
-The Registry Notary binary reads the variables below. Each also has an equivalent command-line flag.
+## Evidence
+
+The `evidence` binary reads the two variables below. Each is a global that applies to every subcommand.
 
 | Name | Purpose | Default or required |
 | --- | --- | --- |
-| `REGISTRY_NOTARY_CONFIG` | YAML config path. Equivalent to `--config`. | Required for commands that load config. |
-| `REGISTRY_NOTARY_ENV_FILE` | Dotenv-style file to load before config validation resolves env vars. Equivalent to `--env-file`. | Optional. |
-| `REGISTRY_NOTARY_BIND` | Override `server.bind` for direct server startup. Equivalent to `--bind`. Closed product and development actions use the verified bundle listener instead. | Optional. |
-| `REGISTRY_NOTARY_HEALTHCHECK_URL` | Health endpoint URL for the `healthcheck` command. | Defaults to `http://127.0.0.1:8080/healthz`. |
-| `REGISTRY_NOTARY_HEALTHCHECK_TIMEOUT_MS` | Health probe timeout in milliseconds for the `healthcheck` command. | Defaults to `5000`. |
-| `REGISTRY_NOTARY_LOG_FORMAT` | Operational log format: `text` or `json`. | Defaults to `text`. |
+| `REGISTRY_EVIDENCE_RUNTIME` | Absolute path to the one operator runtime file that binds the governed bundle. Equivalent to the global `--runtime` flag. | Defaults to `/etc/registry-evidence/runtime.yaml`. |
+| `EVIDENCE_LOG` | Tracing filter for the operational records the serving process writes as line-delimited JSON on standard output. | Defaults to `info`. Read by `evidence serve` only; offline commands install no log subscriber. |
+
+Evidence reads no secret from an environment variable. A configured secret reference uses one grammar, `secret:file/<name>`, enforced by `SecretRef::parse` in `crates/registry-evidence/src/config.rs`, and resolves to an owner-only regular file under the `secretProviders.file.root` directory named in `runtime.yaml` (`crates/registry-evidence/src/secrets.rs`). Neither the runtime file nor the governed bundle can name an environment variable to read a credential from. See [Configure Evidence](../../configure/evidence/) for the runtime file and the bundle it binds.
+
+## Registry Mint
+
+The `mint` binary reads the variables below.
+
+| Name | Purpose | Default or required |
+| --- | --- | --- |
+| `MINT_CONFIG` | YAML config path for `mint check` and `mint serve`. Equivalent to `--config`. | Required for those two subcommands, by flag or by variable. |
+| `RUST_LOG` | Tracing filter for the JSON operational logs. Applies to every subcommand; `mint token` sends its logs to standard error so the access token stays alone on standard output. | Defaults to `info`. |
+
+Registry Mint's key material and client registrations are files named in its configuration: `signing.activeKeyFile`, `signing.retiredPublicJwkFiles`, and `clients.directory`. None of them is an environment variable. The `mint token` subcommand is a caller tool rather than an operator one: it reads no server configuration at all, and takes the caller's private JWK and any delegation subject as file paths rather than as values. See the [Registry Mint reference](../mint/) for the full configuration surface.
 
 ## Registry Relay
 
@@ -52,6 +67,7 @@ The Registry Relay binary reads the variables below.
 | `REGISTRY_RELAY_ENV_FILE` | Dotenv-style file to load before config validation resolves env vars, used when `--env-file` is not passed. | Optional. |
 | `REGISTRY_RELAY_BIND` | Override `server.bind` for direct server startup. Closed product and development actions use the verified bundle listener instead. | Optional. |
 | `REGISTRY_RELAY_LOG_FORMAT` | Operational log format: `json` or `jsonl` select JSON output; any other value selects text. | Defaults to text. |
+| `RUST_LOG` | Tracing filter for the operational logs on standard error. | Defaults to `info`. |
 | `DATA_GATE_POSTGRES_ROOT_CERT_PATH` | Path to a PEM file with a custom root certificate to trust for a Postgres source connector's TLS connection. | Optional. Falls back to the system default trust store when unset. |
 
 The audit hash secret and other secret material are read from operator-named variables declared in config fields such as `audit.hash_secret_env` (for example, `REGISTRY_RELAY_AUDIT_HASH_SECRET`), API key fingerprint env names, and the Postgres `connection_env`. For the full list of config fields that name secret environment variables, see the [Registry Relay configuration reference](../../products/registry-relay/configuration/).
@@ -64,11 +80,15 @@ generated inputs contain the reference names, not the secret values.
 
 | Name | Purpose | Default or required |
 | --- | --- | --- |
-| `REGISTRYCTL_NO_UPDATE_CHECK` | Disable the automatic update check when set to a non-empty value other than `0` or `false`. | Optional. |
-| `REGISTRYCTL_UPDATE_CHECK` | Disable the automatic update check when set to `0` or `false`. | Optional. |
-| `REGISTRYCTL_VERSION` | Pinned release the installer downloads. Read by the install script, not the running binary. | Defaults to the installer's pinned release. |
-| `CI` | When set to a non-empty value other than `0` or `false`, disables the automatic update check. | Optional. |
+| `REGISTRYCTL_ENVIRONMENT` | Selects the project environment when `--environment` is not passed. Must be valid Unicode and must name an environment the project declares. | Optional. Falls back to the project's `default_environment`, then to the only declared environment. |
+| `REGISTRYCTL_VERSION` | Pinned release tag for the historical unversioned installer. A versioned installer asset refuses an override that does not match its own filename release. Read by the install script, not the running binary. | Defaults to the installer's pinned tag. |
+| `REGISTRYCTL_INSTALL_DIR` | Directory the install script installs into. Read by the install script, not the running binary. | Defaults to `~/.local/bin`. |
+| `REGISTRYCTL_ASSET_DIR` | Directory of already-downloaded release assets the install script reads instead of downloading. Read by the install script, not the running binary. | Optional. |
+
+The `registryctl update-check` command was removed before 1.0, so the variables that used to
+disable it (`REGISTRYCTL_NO_UPDATE_CHECK`, `REGISTRYCTL_UPDATE_CHECK`, and `CI`) no longer have
+any effect. Setting them is harmless and does nothing.
 
 ## Source
 
-The fixed variable names above are transcribed from the binaries and the registryctl source. For the canonical definitions, read the [Registry Notary binary entry point](https://github.com/registrystack/registry-stack/blob/main/crates/registry-notary/src/main.rs), the [Registry Relay binary entry point](https://github.com/registrystack/registry-stack/blob/main/crates/registry-relay/src/main.rs), and the [registryctl library source](https://github.com/registrystack/registry-stack/blob/main/crates/registryctl/src/lib.rs). The operator-named secret variables are documented in the [Registry Notary operator config reference](../../products/registry-notary/operator-config-reference/) and the [Registry Relay configuration reference](../../products/registry-relay/configuration/).
+The fixed variable names above are transcribed from the binaries and the registryctl source, at the paths given here. For the canonical definitions, read the Evidence binary entry point `crates/registry-evidence/src/main.rs` (the `Cli` struct and `install_operational_logging`), the Registry Mint binary entry point `crates/registry-mint/src/main.rs` (the `Command` enum and `main`), the Registry Relay binary entry point `crates/registry-relay/src/main.rs` (`default_config_path_from_env`, `default_env_file_from_env`, `default_bind_from_env`, `OperationalLogFormat::from_env`, and `init_tracing`), the Relay Postgres connector at `crates/registry-relay/src/connector/mod.rs`, and for registryctl `crates/registryctl/src/main.rs` (`resolve_environment`) together with `crates/registryctl/install.sh`. The operator-named secret variables are documented in the [Registry Relay configuration reference](../../products/registry-relay/configuration/).
diff --git a/docs/site/src/content/docs/reference/errors.mdx b/docs/site/src/content/docs/reference/errors.mdx
index b1d459527..3de944da4 100644
--- a/docs/site/src/content/docs/reference/errors.mdx
+++ b/docs/site/src/content/docs/reference/errors.mdx
@@ -1,26 +1,26 @@
 ---
 title: Error and status code reference
-description: RFC 9457 problem codes returned by Registry Notary and Registry Relay, with their meaning and usual cause.
+description: RFC 9457 problem codes returned by Registry Relay, with their meaning and usual cause, and where the Evidence and Registry Mint error contracts are documented.
 status: current
 owner: registry-docs
 source_repos:
-  - registry-notary
   - registry-relay
-  - registry-platform
-last_reviewed: "2026-07-19"
+  - registry-evidence
+  - registry-mint
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced: []
 ---
 
-Registry Notary and Registry Relay return errors as RFC 9457 problem details with the media type `application/problem+json`. Each problem carries a stable string in the `code` extension member alongside the standard `type`, `title`, `status`, and `detail` fields. The tables below list every `code` value, the message the source attaches to it, and the usual cause.
+Registry Relay returns errors as RFC 9457 problem details with the media type `application/problem+json`. Each problem carries a stable string in the `code` extension member alongside the standard `type`, `title`, `status`, and `detail` fields. The table below lists every `code` value, the message the source attaches to it, and the usual cause.
 
 Registry-owned problem type URIs use `https://id.registrystack.org/problems/...`.
 Client code must branch on the stable `code` extension and the response `status`, not by parsing `type` URI paths.
 The `type` URI identifies and documents the problem type.
 
-The HTTP status is omitted from the Registry Notary and Registry Relay tables because a code can
-map differently by product and operation.
+The HTTP status is omitted from the Registry Relay table because a code can
+map differently by operation.
 Within a stable major release line, each existing product and operation keeps its released
 code-to-status mapping.
 Treat the standard `status` field of the problem response as authoritative for the request, and
@@ -28,107 +28,33 @@ use `code` for the stack-wide meaning.
 The additive compatibility gate uses this reference as the error-code registry and the committed
 OpenAPI documents for operation mappings they enumerate.
 
-## Shared platform
+## Evidence
 
-Shared Registry Platform HTTP middleware can return platform-scoped problem types before a request reaches Registry Notary or Registry Relay application code.
+Evidence has its own closed problem set, documented at
+[Evidence problem types](../evidence-problems/). That page is the single place the set is written
+down, because the set is frozen in `products/evidence/contracts/problem-contract.yaml` and CI
+byte-diffs the generated schema against it; a second copy of the table here would drift without a
+gate to catch it.
 
-| Type path | Meaning | Usual cause |
-| --- | --- | --- |
-| `registry-platform/request/body-too-large` | payload too large | The request body exceeds the configured limit. |
-
-## Registry Notary
-
-Registry Notary returns the codes in the table below from its evidence taxonomy. Several distinct internal conditions intentionally collapse to one public code so that the public response does not disclose more than the caller is entitled to know. The audit record can carry a more specific code than the public response.
-
-| Code | Meaning | Usual cause |
-| --- | --- | --- |
-| `evidence.server_disabled` | evidence server is disabled | The evidence surface is turned off in configuration. |
-| `claim.not_found` | claim was not found | The requested claim id is not configured. |
-| `claim.version_not_found` | claim version was not found | The requested claim version does not exist. |
-| `claim.operation_unsupported` | claim operation is unsupported | The requested operation is not supported for the claim. |
-| `request.invalid` | evidence request is invalid | The request body or parameters failed validation. |
-| `consultation.invalid_request` | registry-backed consultation request is invalid | A registry-backed batch or consultation input failed validation before Relay was called. |
-| `claim.disclosure_not_allowed` | requested disclosure is not allowed | The requested disclosure level is not permitted for the claim. |
-| `purpose.not_allowed` | purpose is not allowed | The requested purpose is not permitted for the claim. |
-| `profile.unsupported` | evidence request profile is unsupported | The requested evidence profile is not supported. |
-| `evidence.not_available` | evidence is not available | The pinned consultation produced no usable evidence or a required proof was not established. |
-| `batch.too_large` | batch request is too large | The batch request exceeds the configured item limit. |
-| `evaluation.not_found` | evaluation was not found | The referenced evaluation id does not exist. |
-| `evaluation.binding_mismatch` | evaluation binding mismatch | The referenced evaluation does not match the requested binding. |
-| `evaluation.quota_exceeded` | machine evaluation quota was exceeded | The authenticated machine principal exceeded the configured evaluation subject budget. |
-| `claim.format_not_supported` | format is unsupported | The requested response format is not supported. |
-| `credential.issuer_not_configured` | credential issuer is not configured | Credential issuance was requested but no issuer is configured. |
-| `credential.holder_proof_required` | holder proof is required | Credential issuance requires a holder proof that was not supplied. |
-| `credential.holder_proof_replay` | holder proof has already been used | The supplied holder proof was already consumed. |
-| `credential.issuance_failed` | credential issuance failed | The credential could not be issued for an internal reason. |
-| `claim.rule_evaluation_failed` | claim rule evaluation failed | A configured claim rule could not be evaluated. |
-| `idempotency.conflict` | idempotency key was reused with a different request | The idempotency key was reused with a different request body. |
-| `auth.purpose_required` | required purpose is missing | The request omits a required purpose. |
-| `auth.missing_credential` | authentication credential is missing | No authentication credential was provided. |
-| `auth.multiple_credentials` | multiple authentication credentials were provided | More than one authentication credential was provided. |
-| `auth.scope_denied` | required scope is missing | The caller's scopes do not include the required scope. |
-| `subject_access.denied` | subject access is denied | A subject-bound or delegated request was denied; also the public code for invalid-token and assurance-denied conditions. The audit record carries the specific reason. |
-| `subject_access.rate_limited` | subject access is rate limited | Too many subject-access requests were made in the configured window. |
-
-Policy decision denials surface a stable `pdp.*` code carried through from the shared Policy Decision Point, for example `pdp.purpose_not_permitted`, `pdp.assurance_insufficient`, or `pdp.evidence_stale`. The same `pdp.*` codes are listed under [Registry Relay policy](#policy).
-
-The codes above are the evidence-evaluation taxonomy. The Notary server also returns the operational codes below from its federation, credential-status, configuration, admin, readiness, and request-handling surfaces.
-
-### Federation
-
-`federation.*` codes from the server-to-server federation surface. Federation problems use URN `type` URIs of the form `urn:registry-notary:problem:federation:<suffix>` rather than the `https://` types used by the evidence taxonomy. The exception is `federation.stale_claim_result`: it is not a problem response but a signed evaluation result (HTTP 200, `application/jwt`) that carries the code in its signed body.
-
-| Code | Meaning | Usual cause |
-| --- | --- | --- |
-| `federation.invalid_request` | federation request is invalid | A federation JSON or JWT request failed validation. |
-| `federation.invalid_token` | federation token is invalid | A federation request is missing valid authentication or its token failed verification. |
-| `federation.forbidden` | federation request is forbidden | A known federation peer was denied by local policy. |
-| `federation.unsupported_media_type` | federation media type is unsupported | The federation request used a content type the surface does not accept. |
-| `federation.payload_too_large` | federation payload is too large | The federation request body exceeds the configured limit. |
-| `federation.replay` | federation request was replayed | A federation `jti` or nonce was already used. |
-| `federation.server_error` | federation server error | The federation request could not be served for an internal reason. |
-| `federation.disabled` | federation is disabled | The federation surface is turned off in configuration. |
-| `federation.stale_claim_result` | federation claim result is stale | The local claim result is older than policy allows; returned in a signed response body. |
-
-### Credential status
-
-`credential_status.*` codes for credential status reads and transitions.
-
-| Code | Meaning | Usual cause |
-| --- | --- | --- |
-| `credential_status.not_found` | credential status was not found | The requested credential status record does not exist. |
-| `credential_status.invalid_status` | credential status is invalid | The requested credential status value is not valid. |
-| `credential_status.invalid_transition` | credential status transition is invalid | The requested status transition is not permitted. |
-| `credential_status.disabled` | credential status is disabled | The credential status surface is turned off for this deployment. |
-| `credential_status.unavailable` | credential status is unavailable | Credential status could not be checked at this time. |
-
-### Administration and configuration
+Two structural differences are worth knowing before reading the Evidence page. Evidence problem
+type URIs are `https://registrystack.org/problems/evidence/<code>` rather than the
+`https://id.registrystack.org/problems/...` form used elsewhere in the stack. And an Evidence
+problem body carries exactly five members (`type`, `title`, `status`, `code`, and `operation`,
+the request's ULID), with no `detail` member and no other extension, so the failure never carries
+subject data or source diagnostics back to the caller.
 
-`registry.admin.*` codes for admin surfaces. These are returned to admin callers, not to data-plane clients.
+Evidence answers with one of that closed set for every failure, including transport-level ones: a
+request body over the configured limit is refused as `malformed_request` rather than with a
+shared-middleware problem type (`crates/registry-evidence/src/server.rs`).
 
-| Code | Meaning | Usual cause |
-| --- | --- | --- |
-| `registry.admin.capability.not_supported` | registry admin capability is not supported | The requested registry administration capability is not supported. |
-| `registry.admin.posture.invalid_tier` | registry admin posture tier is invalid | The requested posture tier is not a recognized value. |
-
-### Readiness and posture
-
-| Code | Meaning | Usual cause |
-| --- | --- | --- |
-| `readiness.not_ready` | service is not ready | The service is not ready to serve traffic. |
-| `posture.filter_failed` | posture filter failed | A posture report filter could not be evaluated. |
-| `posture.unavailable` | posture state is unavailable | Posture state could not be read at this time. |
-
-### Request handling
-
-`request.*` and `audit.*` transport-level codes.
-
-| Code | Meaning | Usual cause |
-| --- | --- | --- |
-| `request.uri_too_long` | request uri is too long | The request URI exceeds the configured limit. |
-| `audit.write_failed` | audit write failed | An audit record could not be written. |
+## Registry Mint
 
-The Notary OpenAPI document also uses three generic umbrella problem types as status-keyed examples: `request.conflict` (409), `request.too_large` (413), and `format.unsupported` (406). These are illustrative placeholders: runtime responses use the specific codes above, such as `idempotency.conflict`, `batch.too_large`, and `claim.format_not_supported`. One 413 is an exception: an oversized HTTP request body is rejected by the shared body-limit middleware with problem `type` `https://id.registrystack.org/problems/registry-platform/request/body-too-large` and no `code` extension.
+Registry Mint is an OAuth 2.0 token endpoint, so it does not use RFC 9457 at all. Every error
+response body is the OAuth form `{"error": "<code>"}` over four codes (`invalid_request`,
+`unsupported_grant_type`, `invalid_client`, and `server_error`), transcribed with their statuses
+and causes in the [Registry Mint reference](../mint/). The one to know before reading it:
+every client authentication failure collapses to `invalid_client`, so the endpoint cannot be used
+to probe which client ids are registered.
 
 ## Registry Relay
 
@@ -338,18 +264,19 @@ Registry Relay returns namespaced codes from its error taxonomy. Codes in the co
 | `runtime.binding.filter_missing` | runtime filter missing from metadata | A runtime filter binding is absent from the metadata manifest. |
 | `runtime.binding.scope_missing` | runtime scope missing or invalid | A runtime scope is missing or uses an unsupported shape. |
 | `runtime.binding.relationship_missing` | runtime relationship missing from metadata | A runtime relationship binding is absent from the metadata manifest. |
-| `runtime.binding.unsupported_evidence_offering` | runtime evidence offering kind is unsupported | An evidence offering is not an external Registry Notary offering. |
+| `runtime.binding.unsupported_evidence_offering` | runtime evidence offering kind is unsupported | The offering's `access.kind` is not the one value the startup validator accepts, `registry-notary`. Nothing maintained sits behind that access kind, so a new deployment should not declare an evidence offering at all. |
 | `runtime.binding.ecosystem_binding_missing` | runtime ecosystem binding missing from metadata | The configured ecosystem binding selector is absent from the metadata manifest. |
 | `runtime.binding.ecosystem_binding_invalid` | runtime ecosystem binding is invalid | The ecosystem binding does not reference a governed-evidence binding with policy identity and ODRL enforcement. |
 
 ## Source
 
-The codes above are transcribed from the error taxonomies in the owning crates.
+The Registry Relay codes above are transcribed from the error taxonomy in the owning crate.
 For the v0.13.0 source definitions, read the
-[Registry Notary `EvidenceError` taxonomy](https://github.com/registrystack/registry-stack/blob/v0.13.0/crates/registry-notary-core/src/error.rs)
-and the
 [Registry Relay error taxonomy](https://github.com/registrystack/registry-stack/blob/v0.13.0/crates/registry-relay/src/error.rs).
+The startup-only runtime binding codes are raised by `crates/registry-relay/src/config/validate.rs`.
 
-The Notary server-layer codes (federation, credential status, configuration, admin, readiness, posture, and request handling) are defined in the `registry-notary-server` crate, principally `src/federation/errors.rs`, `src/federation/mod.rs`, and `src/api.rs`.
+The codes this page points at rather than repeating are transcribed on their own pages from
+`crates/registry-evidence/src/problem.rs` with `products/evidence/contracts/problem-contract.yaml`
+(Evidence) and `crates/registry-mint/src/error.rs` (Registry Mint).
 The release compatibility gate compares this registry to its base reference and verifies that every
 listed code remains anchored in Rust or OpenAPI source.
diff --git a/docs/site/src/content/docs/reference/evidence-problems.mdx b/docs/site/src/content/docs/reference/evidence-problems.mdx
new file mode 100644
index 000000000..3dd20fd8f
--- /dev/null
+++ b/docs/site/src/content/docs/reference/evidence-problems.mdx
@@ -0,0 +1,65 @@
+---
+title: Evidence errors and problems reference
+description: What each application/problem+json response from the Evidence assertion service means and how to respond to it.
+status: current
+owner: registry-docs
+source_repos: [registry-stack]
+last_reviewed: "2026-08-03"
+doc_type: reference
+locale: en
+standards_referenced: []
+---
+
+Evidence returns errors as problem details with the media type `application/problem+json`. The closed set of problem types, their HTTP status, and their exact body shape are frozen in `products/evidence/contracts/problem-contract.yaml` (contract `registry.evidence.public-problem/v1`) and generated into `products/evidence/generated/problem-v1.schema.json`; both files are the source of truth for this page. The `evidence-contracts` CI job byte-diffs a freshly regenerated copy of both files against the committed copies on every change (`products/evidence/scripts/check-contracts.sh`, wired into `.github/workflows/ci.yml`), so this reference cannot drift from a released Evidence binary without the build failing.
+
+`POST /v1/evidence` can return any problem documented on this page. `GET /v1/evidence-definitions` returns a narrower subset: `malformed_request`, `authentication_failed`, `rate_limited`, and `service_unavailable`.
+
+## Reading a problem response
+
+A problem body carries exactly five members: `type`, `title`, `status`, `code`, and `operation`, and no others. There is no `detail` member. Evidence's contract closes the body with `additionalProperties: false` and explicitly excludes request bodies or selector values, principal or credential inputs, source URLs or responses, script input or output, and any candidate count, score, hint, or comparison detail. Branch client code on the stable `code` member; `type` follows the fixed pattern `https://registrystack.org/problems/evidence/<code>`.
+
+```json
+{
+  "type": "https://registrystack.org/problems/evidence/evidence_not_available",
+  "title": "Evidence could not be produced",
+  "status": 422,
+  "code": "evidence_not_available",
+  "operation": "01ARZ3NDEKTSV4RRFFQ69G5FAV"
+}
+```
+
+The `operation` member is a ULID-shaped opaque identifier (pattern `^[0-9A-HJKMNP-TV-Z]{26}$`) that Evidence generates for the request; it is never taken from the caller. It matches the `X-Request-Id` response header on both successful and failing responses, and it is the identifier to quote to a deployment operator for support correlation.
+
+## Caller request problems
+
+These problem types indicate something about the request itself. Correct the request and resubmit; retrying an unchanged request returns the same problem.
+
+| Code | Status | Meaning | Retry helps | What to do |
+| --- | --- | --- | --- | --- |
+| `malformed_request` | 400 | The request body is not valid JSON, or it does not match the documented `EvidenceRequest` schema: an unknown field, a wrong type, or a structurally invalid request nonce or holder key. | No | Validate the request body against the schema published at `/openapi.json`, and remove any field the schema does not declare. |
+| `invalid_selector` | 400 | The request's selector does not match any of the configured alternative profiles for the requested requirement. | No | Fetch `/v1/evidence-definitions` and match the request's selector to one of the profiles listed there for the requirement. |
+| `authentication_failed` | 401 | No credential was supplied, more than one was supplied, the credential could not be parsed, or the bearer token did not verify. Evidence returns a `WWW-Authenticate: Bearer` header alongside this problem. | No | Supply exactly one `Authorization: Bearer` token, and confirm it has not expired and was issued for this deployment. |
+| `response_format_not_acceptable` | 406 | The `Accept` header fell outside the closed negotiation matrix: a duplicate, a combination of types, a quality parameter, or an unrecognized value. Missing `Accept`, `*/*`, and exactly `application/jose+json` all select the default signed response and do not trigger this problem. | No | Send at most one recognized media type in `Accept`: `application/jose+json`, `application/vnd.registrystack.evidence-unsigned+json`, or `application/dc+sd-jwt`, with no quality parameter and no combination with another type. |
+| `rate_limited` | 429 | The caller exceeded the configured per-principal request rate, or the separate per-principal-authority failed-selector rate (`crates/registry-evidence/src/rate_limit.rs`). | Yes, after backoff | Wait for the duration in the `Retry-After` header (this deployment sends `1` second) before retrying. |
+
+## Requests Evidence cannot satisfy
+
+A well-formed, authenticated request can still fail to produce evidence. Both problem types below intentionally withhold the specific reason: Evidence collapses several internal conditions into one public shape so that a response cannot be used to learn whether a record, grant, or requirement exists.
+
+| Code | Status | Meaning | Retry helps | What to do |
+| --- | --- | --- | --- | --- |
+| `not_authorized` | 403 | The authenticated caller's grant does not permit this requirement, this subject binding, or the negotiated response format, or the requirement identifier is unknown. Evidence does not reveal which of these applied, and an unknown requirement identifier is indistinguishable from a real one the caller is not authorized for. | No, without a grant change | Confirm the requirement identifier against `/v1/evidence-definitions` for the authenticated caller. If it is present there, ask the deployment operator to verify the grant covers this requirement, subject binding, and response format. |
+| `evidence_not_available` | 422 | The source produced no unique matching record, the match was ambiguous, a required fact was missing, or a derivation input could not be resolved. Evidence collapses all four conditions into this one code and applies uniform, bounded processing so response timing does not indicate which condition occurred. | No, not by resubmitting the same request unchanged | Confirm with the subject that the requested fact exists in the source system. Report a persistent, unexpected result to the deployment operator with the `operation` value; Evidence does not reveal which internal condition produced it. |
+
+## Source and deployment availability
+
+Both problem types below are transient 503 responses. Evidence assigns them by where the failure occurred, not by how long it lasted.
+
+| Code | Status | Meaning | Retry helps | What to do |
+| --- | --- | --- | --- | --- |
+| `dependency_unavailable` | 503 | The configured external source did not respond usably: unreachable, timed out, wrong credential, wrong media type, an oversized response, malformed JSON, or an error envelope. Evidence maps every source-boundary failure to this one code (`crates/registry-evidence/src/runtime.rs`, `source_failure_problem`). | Yes, after backoff | Retry with backoff. If it persists, report it to the deployment operator with the `operation` value: the connected source system is unavailable, not the request. |
+| `service_unavailable` | 503 | A transient failure inside the Evidence deployment itself: script execution, signing, audit-log writes, or discovery and configuration lookups. This code is also returned by the unauthenticated `/openapi.json` and `/ready` endpoints when the document or readiness state cannot be produced. | Yes, after backoff | Retry with backoff. If it persists, report it to the deployment operator with the `operation` value. |
+
+## Source
+
+This page transcribes `products/evidence/contracts/problem-contract.yaml` and `products/evidence/generated/problem-v1.schema.json`, and the runtime decisions in `crates/registry-evidence/src/problem.rs`, `crates/registry-evidence/src/runtime.rs`, and `crates/registry-evidence/src/server.rs` that choose which code a given failure returns. The full negotiation and per-operation status mapping is in `products/evidence/generated/registry-evidence.openapi.json`.
diff --git a/docs/site/src/content/docs/reference/evidencectl.mdx b/docs/site/src/content/docs/reference/evidencectl.mdx
new file mode 100644
index 000000000..429555691
--- /dev/null
+++ b/docs/site/src/content/docs/reference/evidencectl.mdx
@@ -0,0 +1,95 @@
+---
+title: Evidencectl command reference
+description: Reference for Evidence authoring, production build, deployment inspection, fixture, and local-development commands.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: reference
+locale: en
+standards_referenced: []
+---
+
+`evidencectl` is Evidence adopter tooling. It creates key material and editable projects, compiles
+production candidates, and invokes the `evidence` binary for Evidence semantic decisions. It does
+not approve, deploy, promote, register production clients, or write production secret values.
+Its client registration commands manage local development only.
+
+## Contract status
+
+Evidencectl is outside the frozen Evidence Version 1 runtime contract. Its command line can change
+before a compatibility promise covers it. The `evidence` runtime remains the authority for bundle
+compilation, fixture evaluation, secret validation, and startup acceptance.
+
+## Production build commands
+
+| Command | Inputs | Result | Does not do |
+| --- | --- | --- | --- |
+| `evidencectl build --project <project> --target <target> --output <new-candidate>` | Editable project and one explicit production target | Creates a new candidate with `runtime.yaml` and closed `bundle/` | Overwrite output, contact source services, OIDC, or Mint, create production secrets, or start a listener |
+| `evidencectl doctor --project <candidate>` | Completed candidate on its target host | Reports runtime, bundle, secret, and audit file posture | Change project files or replace `evidence check` |
+| `evidencectl doctor --project <candidate> --mint-config <mint.yaml>` | Completed candidate and separately authored Mint configuration | Adds read-only mechanical protocol compatibility checks | Register callers, copy Mint files, infer authority, or mint a token |
+| `evidencectl fixtures run --project <candidate>` | Completed candidate and referenced synthetic fixtures | Runs `evidence check` and every referenced fixture | Start HTTP, call a source, or write a production audit entry |
+
+`build` is create-only. It rejects an existing output directory, local assurance inputs,
+unauthenticated or non-HTTPS production sources, missing governance metadata or fixtures, unresolved
+review markers, unknown fields, symlink traversal, and references outside the allowed project
+directories. A failed build publishes no candidate.
+
+## Production input reference
+
+An editable project becomes a production build input only after it has:
+
+- A `fixtures/` regular file referenced by every production question.
+- Stable concept identifiers and production `governance` metadata in every question.
+- `deployment-targets/<target>/governance.yaml` with production bundle-owned fields.
+- `deployment-targets/<target>/runtime.yaml` with one target's runtime bindings.
+
+`governance.yaml` is strict. It must carry version `1`, `assuranceProfile: production`, service,
+issuer, authentication, audit, subject binding, rate limits, signing, optional response formats,
+and authority profiles. It cannot supply selector profiles, sources, or requirements. It accepts
+logical `secret:file/<name>` references, not values or absolute secret paths.
+
+The output runtime document is copied byte-for-byte. Its paths and secret posture are accepted only
+by the final target-host `evidence check`.
+
+## Local-only commands
+
+`evidencectl new --profile local` and `evidencectl dev` are local-authoring commands. Nothing under
+`.evidence/dev` is a production build input. `new` creates no source policy, question, fixture
+content, production target, Mint configuration, or deployable bundle. `--generate-keys` creates
+disposable, unbound Evidence key material only.
+
+`evidencectl access` manages caller access for one local project:
+
+| Command | State | Result |
+| --- | --- | --- |
+| `evidencectl access policy add <policy> --question <question>` | Creates `access/policies/<policy>.yaml` | Defines one or more repeated `--question` values for the next Evidence generation |
+| `evidencectl access policy list` | Reads `access/policies/` | Lists the governed local policies and their questions |
+| `evidencectl access client add <client> --policy <policy> --generate-local-key` | Creates `access/clients/<client>.yaml` and `.evidence/clients/<client>/private.jwk` | Registers a local client for repeated `--policy` values with non-overlapping question sets |
+| `evidencectl access client list` | Reads `access/clients/` | Lists local client status and policy membership |
+| `evidencectl access client revoke <client>` | Updates `access/clients/<client>.yaml` | Revokes the local client for new token requests |
+
+Public, reviewable local access configuration lives under `access/`. Owner-only private client keys
+live only under `.evidence/clients/`. Generated Registry Mint registrations under
+`.evidence/dev/generated/clients/` are disposable and contain public keys only.
+
+Client add and revoke request a Registry Mint reload only when `evidencectl dev` has a ready local
+session. They do not restart or reload Evidence. Registry Mint does not acknowledge completion of
+the reload, so the next token exchange provides the functional check. A policy change requires a
+new Evidence generation.
+
+The local access commands do not define production authority or production clients. Production
+authority profiles remain in the deployment target's governed `governance.yaml`. Production client
+registrations remain in a separately governed Registry Mint registry. Files under `access/` and
+`.evidence/` do not become production candidate inputs.
+
+Use `keygen`, `source suggest`, `request`, `verify`, and `audit` for their documented authoring or
+local inspection roles. Do not use a local request, local audit record, or disposable key as a
+production candidate input.
+
+## Related reference
+
+- [Configure Evidence](../../configure/evidence/)
+- [Registry Mint reference](../mint/)
+- [Build and deploy an Evidence project](../../tutorials/build-and-deploy-evidence-project/)
diff --git a/docs/site/src/content/docs/reference/glossary.mdx b/docs/site/src/content/docs/reference/glossary.mdx
index 7655a0616..ee7c70712 100644
--- a/docs/site/src/content/docs/reference/glossary.mdx
+++ b/docs/site/src/content/docs/reference/glossary.mdx
@@ -7,9 +7,10 @@ source_repos:
   - registry-relay
   - registry-platform
   - registry-manifest
-  - registry-notary
+  - registry-evidence
+  - registry-mint
   - solmara-lab
-last_reviewed: "2026-07-07"
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced:
@@ -30,7 +31,6 @@ standards_referenced:
   - prov-o
   - w3c-did
   - sp-dci
-  - oid4vci
 ---
 
 Use this page to look up unfamiliar terms.
@@ -39,26 +39,32 @@ Product names are always in English, including on future translated pages.
     crate names, or Docker image names. */}
 
 <dl class="glossary-dl">
+  <dt>acceptance definition</dt>
+  <dd>One complete authored answer path in an Evidence deployment project: a source with its request and response schema, the extraction script, the fact schema and any codelist, the derivation, the requirement with its concept and disclosure guard, the authority grant that permits it, and the synthetic fixture cases that prove it before anything is served. Evidence Version 1 freezes four coequal acceptance definitions: adult status, residence region, professional licence status, and legal-parent relationship. None is privileged in the runtime, so there is no domain type, built-in operation, or special route for any of them.</dd>
+
+  <dt>access token</dt>
+  <dd>The bearer credential a caller presents to Evidence. Evidence runs one authentication kind, `oidc-access-token`, whose issuer, audiences, accepted token types, algorithms, JWKS URI, and claim names are fixed in the immutable bundle, and it reads authority only from those configured claim names. <a href="../mint/">Registry Mint</a> issues such tokens for deployments with no identity provider; any issuer that writes the same claims serves equally well.</dd>
+
+  <dt>assertion</dt>
+  <dd>Evidence's output: one stateless signed payload that answers a requirement and carries no source record. Its member set is closed by `products/evidence/contracts/evidence.schema.yaml`: the requirement it supports, the Evidence Type it conforms to, issuer and provider, issue, observation, and validity instants, purpose, audience, configuration revision, role-bound subject bindings, and the supported values. Signed flattened JSON Web Signature (JWS) is the default serialization; the SD-JWT VC serialization carries the same assertion and adds no credential lifecycle.</dd>
+
   <dt>BRegDCAT-AP</dt>
   <dd>SEMIC profile of DCAT-AP for base registries. Registry Relay and Registry Manifest emit BRegDCAT-AP-shaped registry and data-service metadata.</dd>
 
   <dt>CCCEV</dt>
-  <dd>Core Criterion and Core Evidence Vocabulary. Registry Manifest emits CCCEV-shaped requirement, evidence type, and evidence type list metadata. Registry Notary renders CCCEV-shaped JSON-LD for claim evaluation results. Media type: `application/ld+json; profile="cccev"`.</dd>
+  <dd>Core Criterion and Core Evidence Vocabulary. Registry Manifest emits CCCEV-shaped requirement, evidence type, and evidence type list metadata. Evidence maps its assertion payload onto CCCEV terms under the frozen mapping in `products/evidence/contracts/cccev-field-mapping.yaml`, with named Evidence extensions where CCCEV has no counterpart.</dd>
 
   <dt>caller</dt>
-  <dd>The technical client that invokes Registry Relay or Registry Notary. A caller can be the evidence consumer or an intermediary, portal, wallet backend, or workflow connector acting for it.</dd>
-
-  <dt>claim evaluation</dt>
-  <dd>Registry Notary process that evaluates configured evidence rules over compiler-pinned Registry Relay outputs and returns a structured claim result. Subject access can authorize the process but does not provide evidence.</dd>
+  <dd>The technical client that invokes Registry Relay or Evidence. A caller can be the evidence consumer or an intermediary, portal, or workflow connector acting for it.</dd>
 
   <dt>claim level</dt>
   <dd>The evidence discipline these docs use for standards claims: `implements`, `emits`, `maps_to`, `aligns_with`, `inspired_by`, or `compares_against`.</dd>
 
   <dt>consultation</dt>
-  <dd>A named use of one Registry Relay integration by a Registry Notary evidence service. One consultation can supply several Notary claims.</dd>
+  <dd>A named, purpose-aware use of one Registry Relay integration. Relay resolves the consultation's pinned source plan, performs the minimized source acquisition, and returns the declared typed outputs. Evidence can be a consumer of one by treating a Relay route as an ordinary fixed HTTP source, which carries no special status in an Evidence bundle. Implemented in `crates/registry-relay/src/consultation/`.</dd>
 
   <dt>consumer decision</dt>
-  <dd>An eligibility, qualification, prioritization, approval, routing, payment, workflow, or other outcome determined outside Registry Relay and Registry Notary by or for an evidence consumer. The decision owner remains accountable for its rules and consequences.</dd>
+  <dd>An eligibility, qualification, prioritization, approval, routing, payment, workflow, or other outcome determined outside Registry Relay and Evidence by or for an evidence consumer. The decision owner remains accountable for its rules and consequences.</dd>
 
   <dt>DCAT</dt>
   <dd>Data Catalog Vocabulary. W3C recommendation. Registry Relay and Registry Manifest emit DCAT-shaped JSON-LD catalogs. Spell out on first use per page: "Data Catalog Vocabulary (DCAT)".</dd>
@@ -69,14 +75,14 @@ Product names are always in English, including on future translated pages.
   <dt>crosswalk</dt>
   <dd>The Relay feature that maps source field names and values to canonical domain terms using configured CEL expressions. Replaces the former `cel-mapping` name. Enabled by the `crosswalk-runtime` Cargo feature and the `standards-cel-mapping` feature alias. Config key: `crosswalk`.</dd>
 
-  <dt>credential profile</dt>
-  <dd>Registry Notary configuration that names which non-delegated registry-backed claims may be issued as a credential. Profile and claim bindings are mutually validated. Only evaluations whose selected roots share a profile retain private issuance provenance, and issuance requires exact claim pins, per-claim execution bindings, and unique Relay execution records for every selected root's dependency closure.</dd>
-
   <dt>deployment bundle</dt>
-  <dd>A deferred project-root packaging concept tracked by <a href="https://github.com/registrystack/registry-stack/issues/361">registry-stack issue #361</a>. Current source does not generate, sign, verify, or activate a project-root bundle. Relay and Notary instead use separate product-owned bundles, and no Registry Stack coordinator binds or atomically activates them.</dd>
+  <dd>A deferred project-root packaging concept tracked by <a href="https://github.com/registrystack/registry-stack/issues/361">registry-stack issue #361</a>. Current source does not generate, sign, verify, or activate a project-root bundle. Each product instead uses its own product-owned bundle, and no Registry Stack coordinator binds or atomically activates them. Not the same thing as an Evidence deployment project's governed bundle, which is one product's immutable startup input.</dd>
 
   <dt>deployment</dt>
-  <dd>An operated set of Registry Relay or Registry Notary product instances. A combined topology stages each product's separately verified bundle and admits traffic only after both products are ready and their consultation contract agrees; this is not atomic project activation.</dd>
+  <dd>An operated set of Registry Relay or Evidence product instances. A combined topology stages each product's separately verified configuration and admits traffic only after both products are ready; this is not atomic project activation.</dd>
+
+  <dt>deployment project</dt>
+  <dd>The directory an Evidence operator mounts: a `runtime.yaml` file holding process-local bindings, and a `bundle/` directory holding the governed configuration, scripts, schemas, codelists, and fixtures. `evidencectl new` starts a local OpenAPI authoring workspace with reusable selector and source objects, questions, derivations, scripts, schemas, fixtures, and optional disposable Evidence keys. `evidencectl build` compiles that workspace and one explicit target into a new production candidate. Evidence loads a completed bundle read-only at startup; a new revision is a new deployment, not a live change.</dd>
 
   <dt>decision owner</dt>
   <dd>The institution accountable for the requirements, rules, decisions, and actions that use evidence. The decision owner can operate the evidence consumer directly or rely on a separate caller or intermediary.</dd>
@@ -85,13 +91,7 @@ Product names are always in English, including on future translated pages.
   <dd>Digital Public Infrastructure. Shared, interoperable digital systems (identity, payments, data exchange) deployed at population scale to support public service delivery. These projects cover the registry-consultation slice of a DPI deployment.</dd>
 
   <dt>DID</dt>
-  <dd>Decentralized Identifier. W3C DID Core 1.0. Registry Relay no longer publishes a `did:web` document. Registry Notary parses `did:jwk` values for credential subjects.</dd>
-
-  <dt id="delegated-subject access">delegated subject access</dt>
-  <dd>Registry Notary authorization mode `delegated_subject_access`. The authenticated principal is the requester, the request target and scoped authorization details identify the same configured dependent subject, and the dependent claim can continue only after a compiler-pinned Relay relationship proof evaluates to boolean `true`. Direct credential issuance rejects delegated evaluations; OID4VCI accepts one only through the explicitly configured representative ceremony. This is separate from static-peer delegated evaluation under Notary federation.</dd>
-
-  <dt>disclosure profile</dt>
-  <dd>Registry Notary control over what the caller receives: `Value` (full value disclosed), `Predicate` (only true/false satisfaction), or `Redacted` (value fully hidden).</dd>
+  <dd>Decentralized Identifier. W3C DID Core 1.0. Registry Relay no longer publishes a `did:web` document, and no current service in the stack resolves, publishes, or issues DIDs. Evidence accepts an optional holder public key as a bare JSON Web Key, not as a DID.</dd>
 
   <dt>distributed custody</dt>
   <dd>The architectural premise that each authority retains control of its own registry data. The registry stack provides the API surface for lawful exchange between authorities; it does not aggregate data into a central system. Equivalent terms include data sovereignty (Gaia-X, IDS, EU dataspaces vocabulary), subsidiarity (governance literature), and federated custody.</dd>
@@ -105,26 +105,26 @@ Product names are always in English, including on future translated pages.
   <dt>environment</dt>
   <dd>Private bindings and operational settings for one Registry Stack project deployment target. An environment does not change the project's stable intent.</dd>
 
+  <dt>Evidence (product)</dt>
+  <dd>The minimum-disclosure assertion service in this monorepo. Crate: `crates/registry-evidence`; product material: `products/evidence/`. Given authenticated authority, an authorized purpose, and a predefined requirement, Evidence serves a signed assertion that answers the requirement, not the source record, plus an SD-JWT VC serialization of that same stateless assertion under a frozen Version 1 profile. The SD-JWT VC format is never a credential lifecycle: no issuance session, holder-binding ceremony, status list, or revocation. Evidence is a separate greenfield product, not a reduced configuration of anything that came before it.</dd>
+
+  <dt>Evidence toolset</dt>
+  <dd>The three released binaries `evidence`, `evidencectl`, and `mint`. Releases that include the toolset publish reproducible binaries alongside a cosign-signed `SHA256SUMS` file, and the installer installs all three together or not at all after verifying every asset. `evidencectl` shells out to `evidence` for every Evidence semantic decision and never re-implements evaluation, signing, or verification. `mint`, built from the `registry-mint` crate, issues the access tokens `evidence` verifies.</dd>
+
   <dt>Evidence Gateway</dt>
-  <dd>Governed runtime path for evidence responses. A Relay read or consultation and a Notary claim evaluation pass trusted request and evidence context through configured authorization and disclosure policy before returning or denying a response. Registry-backed Notary claims consume compiler-pinned Relay results.</dd>
+  <dd>Registry Relay's governed runtime path: a Relay read or consultation passes trusted request and source context through the shared policy decision point, which permits, redacts, or denies before a response is returned. The name also survives in the ODRL enforcement profile identifier `registry-evidence-gateway-pdp/v1`. This is not Evidence (product), which is a separate service with its own authorization and disclosure contracts and no policy decision point.</dd>
 
   <dt>evidence consumer</dt>
   <dd>A service or process that uses returned evidence. Examples include a social-protection programme, admissions service, licensing authority, healthcare workflow, lender, insurer, or credential verifier. The evidence consumer, caller, and decision owner can be the same component or separate components.</dd>
 
-  <dt>evidence service</dt>
-  <dd>A Registry Notary-owned service containing service policy, claims, disclosure, optional Registry Relay consultations, and optional credential profiles.</dd>
-
   <dt>ecosystem binding</dt>
   <dd>Manifest-level binding that connects an external ecosystem profile or governed evidence pack to a Registry Stack runtime surface. A governed evidence ecosystem binding names the evidence pack metadata and policy identity a runtime service can use for PDP enforcement.</dd>
 
   <dt>eSignet</dt>
-  <dd>Open-source identity and authentication service (part of MOSIP). Registry Notary can use eSignet as an authorization server for subject-bound evaluation and registry-backed credential flows.</dd>
+  <dd>Open-source identity and authentication service (part of MOSIP). No current Registry Stack service integrates with it. Evidence authenticates callers against one configured OIDC issuer and key set named in its immutable bundle, and names no specific identity product.</dd>
 
   <dt>evidence offering</dt>
-  <dd>Metadata entry that describes a verification capability and the access path a client uses to reach it. In the current stack it points a client from Registry Relay metadata to Registry Notary or another evidence service; Relay describes the offering but does not evaluate the claim.</dd>
-
-  <dt>Notary evidence claim</dt>
-  <dd>An atomic, precise, reusable evidence statement that Registry Notary evaluates from compiler-pinned Relay outputs. Declared request variables may parameterize the evaluation but are not evidence. Notary owns the claim's evidence semantics, authorization, and disclosure policy. A claim does not import an evidence consumer's decision or action rules.</dd>
+  <dd>Metadata entry in a Registry Manifest dataset that describes a verification capability and the access path a client uses to reach it (schema versions `registry-manifest-evidence-offering/v1` and `registry-manifest-evidence-offerings/v1`). Registry Manifest compiles and publishes offerings and Registry Relay serves them in its metadata; the offering is a pointer, and Relay does not evaluate the capability behind it.</dd>
 
   <dt>evidence type list</dt>
   <dd>CCCEV list of evidence types that satisfy a requirement. In Registry Manifest, one list is one grouped option; multiple lists on the same requirement are alternatives.</dd>
@@ -139,7 +139,7 @@ Product names are always in English, including on future translated pages.
   <dd>Older specs, implementation reviews, or pre-rename documents that remain useful evidence but are not current user guidance.</dd>
 
   <dt>holder</dt>
-  <dd>The party that holds a credential in a wallet and presents it to a verifier. Registry Notary binds each credential to a holder key (`did:jwk`) in the `cnf` claim, so only the holder can present it.</dd>
+  <dd>In Evidence, the party whose public key a caller may supply as `holderKey` on a request. Evidence echoes it into the SD-JWT VC `cnf` claim and does nothing else with it: there is no holder-binding ceremony, no presentation verification, and no key-binding JWT. The key never reaches authorization, selectors, scripts, source requests, or audit (`products/evidence/contracts/request.schema.yaml`, `products/evidence/contracts/sd-jwt-vc-profile.yaml`).</dd>
 
   <dt>interoperability</dt>
   <dd>Commitment that every registry in the stack publishes its catalog, schemas, services, and policies in standards-shaped form (DCAT, BRegDCAT-AP, CPSV-AP, CCCEV, SHACL, JSON Schema, ODRL, OpenAPI, OGC Records, SKOS-shaped codelists, SD-JWT VC), so downstream systems integrate against stable contracts rather than per-deployment ones.</dd>
@@ -150,11 +150,8 @@ Product names are always in English, including on future translated pages.
   <dt>Relay output</dt>
   <dd>A declared typed value returned by Registry Relay after source-specific acquisition and normalization on a matching consultation. A Relay output carries source evidence, not a consumer consequence. `true`, `false`, `null`, `no_match`, `ambiguous`, and source failure retain distinct meanings under the reviewed integration contract.</dd>
 
-  <dt>claim</dt>
-  <dd>Short form for a Notary evidence claim: a Registry Notary-owned evidence value or predicate derived from a consultation outcome and typed Relay outputs. Purpose-bound authorization limits use of the claim without turning the claim into consumer policy.</dd>
-
   <dt>JSON-LD</dt>
-  <dd>JSON-based linked data format. W3C recommendation (JSON-LD 1.1). Used for catalog, policy, and CCCEV render output.</dd>
+  <dd>JSON-based linked data format. W3C recommendation (JSON-LD 1.1). Used for catalog and policy render output.</dd>
 
   <dt>metadata manifest</dt>
   <dd>Portable `metadata.yaml` document (schema version `registry-manifest/v1`) that describes a registry through its catalog and defined collections. The <a href="../../products/registry-manifest/reference/">Registry Manifest reference</a> is authoritative for the current top-level keys and field schemas. Must not include Relay runtime bindings such as source paths, table names, or scopes.</dd>
@@ -165,6 +162,9 @@ Product names are always in English, including on future translated pages.
   <dt>minimized evidence</dt>
   <dd>Registry Stack product term for an evidence response shaped by data minimization, selective disclosure, or verifiable attestation. The response can be narrower than the full source record when the configured use case supports that pattern.</dd>
 
+  <dt>minimum disclosure</dt>
+  <dd>Evidence's design rule: one response carries the smallest sufficient answer to one requirement, never the source record. The assertion payload is closed and rejects additional properties, subject selector profiles and selector values never appear in it, the output gate admits only the exact declared concept identifiers and value forms, and purpose does not narrow disclosure, so a purpose that justifies a coarser answer needs its own requirement. See <a href="../../spec/rs-pr-evidence/">RS-PR-EVIDENCE</a> Section 6.</dd>
+
   <dt>ODRL</dt>
   <dd>Open Digital Rights Language. W3C recommendation. Relay and Manifest emit ODRL Offer documents for dataset-scoped descriptive policies. Relay governed runtime PDP enforcement currently uses `odrl:purpose`; publishing an ODRL document alone is not enforcement.</dd>
 
@@ -184,10 +184,10 @@ Product names are always in English, including on future translated pages.
   <dd>Open Geospatial Consortium API specification for Environmental Data Retrieval. Registry Relay exposes profiled area queries over configured spatial aggregates behind the `ogcapi-edr` feature flag.</dd>
 
   <dt id="oid4vci">OID4VCI</dt>
-  <dd>OpenID for Verifiable Credential Issuance. Registry Notary implements a profiled registry-backed issuer subset using `dc+sd-jwt`, issuer-initiated pre-authorized code, a transaction-bound proof nonce returned by the token response, and EdDSA `did:jwk` holder proof. It has no wallet-facing authorization-code grant or public nonce endpoint. Full issuer, EUDI, HAIP, PAR, DPoP, wallet-attestation, and external-wallet conformance are not asserted (`openid4vci.support: not_full_issuer`).</dd>
+  <dd>OpenID for Verifiable Credential Issuance. No current Registry Stack service implements it, and OID4VCI in any part is a frozen Evidence Version 1 non-goal, so the SD-JWT VC serialization has no offer, pre-authorized code, token or nonce endpoint, or wallet grant.</dd>
 
   <dt>PROV-O</dt>
-  <dd>W3C Provenance Ontology. Currently listed as design influence (`inspired_by`). Provenance-shaped concepts appear in audit fields and the claim provenance struct, but no PROV-O vocabulary terms are emitted as JSON-LD at reviewed commits.</dd>
+  <dd>W3C Provenance Ontology. Currently listed as design influence (`inspired_by`). Provenance-shaped concepts appear in audit fields, but no PROV-O vocabulary terms are emitted as JSON-LD at reviewed commits.</dd>
 
   <dt>PDP</dt>
   <dd>Policy decision point. In Registry Stack, the shared Registry Platform primitive that evaluates a governed policy against trusted request and source context and returns permit, permit with redaction, or deny with stable `pdp.*` provenance.</dd>
@@ -199,7 +199,7 @@ Product names are always in English, including on future translated pages.
   <dd>Audit fields that explain a governed PDP decision, including policy id, policy hash, evaluated rule ids, route identity, source binding, checked scopes, trust-provenance labels, and stable `pdp.*` denial code when denied.</dd>
 
   <dt>PEP</dt>
-  <dd>Policy enforcement point. The runtime service surface, such as a Registry Relay governed read or consultation, or a Registry Notary claim evaluation, that calls the PDP and enforces the resulting permit, redaction, or deny decision.</dd>
+  <dd>Policy enforcement point. The runtime service surface, such as a Registry Relay governed read or consultation, that calls the PDP and enforces the resulting permit, redaction, or deny decision.</dd>
 
   <dt>policy hash</dt>
   <dd>Lowercase `sha256:` digest that binds a governed evidence policy identity to canonical policy bytes or an externally supplied policy artifact. Manifest verifies it when an inline evidence pack policy object is present; Relay records the selected hash in governed PDP audit provenance.</dd>
@@ -208,7 +208,10 @@ Product names are always in English, including on future translated pages.
   <dd>Registry Stack runtime pattern for exposing existing registry source data through scoped, read-only HTTP routes with authentication, authorization, metadata, and audit. Registry Relay implements this pattern.</dd>
 
   <dt>registry stack</dt>
-  <dd>The four formal stack products: Registry Platform, <a href="../../products/registry-relay/">Registry Relay</a>, Registry Manifest, and <a href="../../products/registry-notary/">Registry Notary</a>. Use lowercase when referring to the concept.</dd>
+  <dd>The formal stack products: Registry Platform, <a href="../../products/registry-relay/">Registry Relay</a>, Registry Manifest, and Evidence, with Registry Mint as supporting token issuance. Use lowercase when referring to the concept.</dd>
+
+  <dt>purpose</dt>
+  <dd>The authorized reason a caller gives for one Evidence request. A purpose is a configured code drawn from the requirement's declared `purposes` list and from the caller's grant, never caller-defined prose. It is part of the single authorization decision, is echoed into the assertion, and does not narrow disclosure. A declared purpose is an authorized selection from the granted set, not an identity-provider attestation.</dd>
 
   <dt>purpose-bound request</dt>
   <dd>Registry Stack product term for a request that carries or is evaluated against purpose limitation, policy-based access control, or context-aware authorization. Relay records the `Data-Purpose` header in audit records where present.</dd>
@@ -225,17 +228,17 @@ Product names are always in English, including on future translated pages.
   <dt>Registry Manifest</dt>
   <dd>Rust workspace for modeling, validating, and rendering standards-facing service, registry, form, and policy metadata without running Registry Relay. Provides a library (`registry-manifest-core`) and a CLI (`registry-manifest-cli`). Repo slug: `registry-manifest`.</dd>
 
+  <dt>Registry Mint</dt>
+  <dd>Small supporting service, not a fourth registry stack pattern, that issues short-lived, audience-bound access tokens to registered machine clients using the `client_credentials` grant with `private_key_jwt` client authentication, so a resource server such as Evidence can require signed tokens without standing up a general-purpose identity provider. The client registry binds each client id to its own keys and to the authority Registry Mint asserts for it. Registry Mint's tests drive Evidence's authenticator; the dependency runs one way only, and Evidence does not depend on Registry Mint. Crate: `crates/registry-mint`; binary: `mint`.</dd>
+
   <dt id="registry-platform">Registry Platform</dt>
   <dd>Shared Rust workspace for registry security and operational primitives, including auth helpers, OIDC verification, audit envelopes, HTTP security, outbound HTTP policy, crypto, SD-JWT VC helpers, and test fixtures. Repo slug: `registry-platform`.</dd>
 
   <dt>Registry Relay</dt>
   <dd>Config-driven Rust service that owns registry source access, product-neutral HTTP and script adaptation, immutable snapshot lookups, and protected read-only consultation APIs. Repo slug: `registry-relay`.</dd>
 
-  <dt>Registry Notary</dt>
-  <dd>Standalone Rust service for claim evaluation from compiler-pinned Relay consultations, disclosure policy, credential issuance from exact Relay-backed evaluation provenance, and audit. Repo slug: `registry-notary`.</dd>
-
   <dt>Registry Stack project</dt>
-  <dd>The authored root for one registry trust domain. A project can describe a Relay-only, Notary-only, or combined deployment and compiles separate product inputs for the selected topology. It is not a deployment bundle or an activation coordinator.</dd>
+  <dd>The authored root for one registry trust domain, compiled by `registryctl` into separate product configuration inputs. It is not a deployment bundle or an activation coordinator. A project describes a Registry Relay deployment and declares Relay lanes only. An Evidence deployment is authored separately, as a deployment project.</dd>
 
   <dt>Registry Stack project workspace</dt>
   <dd>The local directory containing one Registry Stack project's authored YAML, scripts, fixtures, and generated review and build outputs.</dd>
@@ -243,23 +246,26 @@ Product names are always in English, including on future translated pages.
   <dt>records service</dt>
   <dd>A Registry Relay-owned records API exposure of an entity, with its own access, purpose, projection, filter, and pagination policy.</dd>
 
+  <dt>requirement</dt>
+  <dd>The predefined, versioned question one Evidence request names. A requirement is declared in the immutable bundle with its identifier, kind, source, authorized purposes, subject roles and selector profiles, reference frameworks, Evidence Type, validity, derivation script, concepts, fixtures, and disclosure guard (`products/evidence/contracts/bundle.schema.yaml`). Only predefined requirements can be evaluated, and to a caller lacking authorization an unknown identifier is indistinguishable from an unauthorized one. The word is CCCEV's, adopted for the same idea.</dd>
+
   <dt>service</dt>
-  <dd>An authored, purpose-bound public capability. Use the specific term evidence service or records service when the distinction matters. A service is not a Registry Relay or Registry Notary process.</dd>
+  <dd>An authored, purpose-bound public capability in a Registry Stack project. Use the specific term records service when the distinction matters. A service is the authored intent, not the Registry Relay process that serves it.</dd>
 
   <dt>service policy</dt>
   <dd>The purpose, legal basis, consent, caller access, and disclosure rules governing one service.</dd>
 
   <dt>source</dt>
-  <dd>The one logical registry data interface available to Registry Relay, when present, inside a project trust domain. An OAuth or JSON Web Key Set endpoint used by a protocol is not another data source.</dd>
+  <dd>The one logical registry data interface available to Registry Relay, when present, inside a project trust domain. An OAuth or JSON Web Key Set endpoint used by a protocol is not another data source. Evidence uses the same word for its own configured provider, whose origin, method, path, headers, authentication, transport trust, timeout, and byte limits are fixed in the bundle and executed only by the Rust core.</dd>
 
   <dt>source-owned decision</dt>
-  <dd>A decision already made and owned by an authoritative source system. Registry Notary may attest this fact only when the claim identifier and its review documentation identify it as source-owned; Notary does not recompute the decision or claim ownership of its policy.</dd>
+  <dd>A decision already made and owned by an authoritative source system. A registry stack service may disclose that fact only when the requirement and its review documentation identify it as source-owned; no service recomputes the decision or claims ownership of its policy.</dd>
 
   <dt>`registry-manifest/v1`</dt>
   <dd>Schema version string for portable metadata manifests.</dd>
 
   <dt>reviewability</dt>
-  <dd>Commitment that every promise the stack makes is backed by an artifact a third party can inspect without trusting the operator's word. Examples include the published DCAT catalog, the SHACL shapes, the ODRL policy documents, the audit envelope schema, the JWKS public key endpoint, and the credential profile configuration.</dd>
+  <dd>Commitment that every promise the stack makes is backed by an artifact a third party can inspect without trusting the operator's word. Examples include the published DCAT catalog, the SHACL shapes, the ODRL policy documents, the audit envelope schema, the JWKS public key endpoint, and the Evidence security invariant matrix with its test traceability.</dd>
 
   <dt>runtime binding</dt>
   <dd>Relay configuration that connects logical manifest concepts to actual files, database tables, scopes, and backend credentials. Lives in Relay config, not in the manifest.</dd>
@@ -268,16 +274,13 @@ Product names are always in English, including on future translated pages.
   <dd>Canonical identifier for the runtime route or claim path being evaluated by the PDP. Route identity prevents a policy written for one route from silently authorizing another route with a similar shape.</dd>
 
   <dt>safeguards</dt>
-  <dd>Commitment that every exchange the stack mediates is authorized, scoped, and audited. Concretely: authentication by API key or OIDC; scope-checked routes; per-claim disclosure control (value, predicate, or redacted); no source-registry data mutation through Relay; audit envelopes for every request that touches person-level data.</dd>
+  <dd>Commitment that every exchange the stack mediates is authorized, scoped, and audited. Concretely: authentication by API key or OIDC; scope-checked routes; disclosure limited to what a service declares in advance; no source-registry data mutation through Relay; audit envelopes for every request that touches person-level data.</dd>
 
   <dt id="sd-jwt-vc">SD-JWT VC</dt>
-  <dd>Selective Disclosure JWT Verifiable Credential (IETF draft). Registry Notary issues registry-backed SD-JWT VC credentials signed with EdDSA or ES256 and binds OID4VCI credentials to an EdDSA `did:jwk` holder. Media type: `application/dc+sd-jwt`.</dd>
-
-  <dt>subject access</dt>
-  <dd>Registry Notary authorization pattern where an authenticated OIDC principal is the protected requester for configured claim evaluation. In direct subject access, the subject is the authenticated requester. In delegated subject access, the requester acts for a configured dependent target only when the relationship proof passes. Subject access never supplies claim evidence; every allowed claim remains registry-backed.</dd>
+  <dd>Selective Disclosure JWT Verifiable Credential (IETF draft). Evidence serializes the same stateless assertion as an SD-JWT VC under the frozen profile in `products/evidence/contracts/sd-jwt-vc-profile.yaml`, when the immutable bundle and the one matched grant both permit that response format. The subject binding stays audience-scoped, so the credential is meaningful only to the relying party named in the assertion's audience. Media type: `application/dc+sd-jwt`.</dd>
 
   <dt>signed response credentials</dt>
-  <dd>Removed Registry Relay feature that attached a W3C VCDM 2.0 VC-JWT signed credential to entity record and aggregate responses. Registry Relay no longer accepts `provenance` or entity `publicschema` credential mapping config, no longer serves `/.well-known/did.json`, `/schemas/{claim_type}/{version}`, or `/contexts/{vocab}/{version}`, and no longer returns `application/vc+jwt`. Use Registry Notary for credential issuance.</dd>
+  <dd>Removed Registry Relay feature that attached a W3C VCDM 2.0 VC-JWT signed credential to entity record and aggregate responses. Registry Relay no longer accepts `provenance` or entity `publicschema` credential mapping config, no longer serves `/.well-known/did.json`, `/schemas/{claim_type}/{version}`, or `/contexts/{vocab}/{version}`, and no longer returns `application/vc+jwt`. No current stack service issues W3C VCDM credentials.</dd>
 
   <dt>SHACL</dt>
   <dd>Shapes Constraint Language. W3C recommendation. Relay and Manifest emit SHACL node shapes for entity validation.</dd>
@@ -289,7 +292,7 @@ Product names are always in English, including on future translated pages.
   <dd>Runtime or source-policy identifier that names the configured source service, resource, or claim binding a governed decision is allowed to use. Source binding lets audit records and PDP rules distinguish one backend source from another.</dd>
 
   <dt>SP DCI</dt>
-  <dd>Social Protection Digital Convergence Initiative. Registry Relay can expose an SP DCI adapter and can execute a reviewed DCI source integration. Registry Notary consumes the resulting compiler-pinned Relay consultation, not a direct DCI source connector.</dd>
+  <dd>Social Protection Digital Convergence Initiative. Registry Relay can expose an SP DCI adapter and can execute a reviewed DCI source integration.</dd>
 
   <dt>static publication bundle</dt>
   <dd>Manifest-generated directory containing `catalog.json`, `dcat.jsonld`, `cpsv-ap.jsonld`, `shacl.jsonld`, entity and form JSON Schemas, OGC Records item collections, evidence offering JSON, policy JSON-LD, and embedded SKOS-shaped codelist metadata in linked-data outputs. Can be hosted as static files without running Registry Relay.</dd>
@@ -307,16 +310,16 @@ Product names are always in English, including on future translated pages.
   <dd>Trusted facts supplied to the PDP for a governed decision. The context can include the authenticated principal, checked scopes, requested purpose, route identity, source binding, requested fact or disclosure, jurisdiction, assurance, legal basis, consent, and source freshness. Caller-supplied facts count only when backed by trusted assertion scopes or trusted source metadata.</dd>
 
   <dt>trust domain</dt>
-  <dd>The institutional boundary whose operators, runtime identities, policy, and deployment approval govern one Registry Stack project. A country can contain several trust domains, and a trust domain does not need to represent a country.</dd>
+  <dd>The institutional boundary whose operators, runtime identities, policy, and deployment approval govern one Registry Stack project. A country can contain several trust domains, and a trust domain does not need to represent a country. One Evidence serving process serves exactly one operator-controlled trust domain.</dd>
 
   <dt>wallet</dt>
-  <dd>Holder-owned application that stores credentials and presents them to verifiers. Registry Notary issues credentials; the wallet that stores, unlocks, and presents them is a separate component, owned by the holder.</dd>
+  <dd>Holder-owned application that stores credentials and presents them to verifiers. No current Registry Stack service integrates with one, and wallet onboarding, wallet attestation, and presentation verification are frozen Evidence Version 1 non-goals.</dd>
 </dl>
 
 ## Style notes
 
-- Formal product names (Registry Platform, Registry Relay, Registry Manifest, Registry Notary) and the adopter demo name (Solmara Lab) are always title case.
-- Repo slugs (`registry-platform`, `registry-relay`, `registry-manifest`, `registry-notary`, `solmara-lab`) are always lowercase and monospace.
+- Formal product names (Registry Platform, Registry Relay, Registry Manifest, Registry Mint) and the adopter demo name (Solmara Lab) are always title case. The assertion product's name is Evidence, capitalized as a proper noun.
+- Repo slugs and crate names (`registry-platform`, `registry-relay`, `registry-manifest`, `registry-evidence`, `registry-mint`, `solmara-lab`) are always lowercase and monospace. A retired product's slug, such as `registry-notary` where a shipped schema or image name still spells it, follows the same rule.
 - Legacy underscore forms (`registry_relay`) and old repo names (`decentralized-evidence-demo`) appear only in historical pages or `rename_status` fields.
 - The glossary provides a reference for standards acronyms but does not replace per-page first-use expansion.
 
diff --git a/docs/site/src/content/docs/reference/index.mdx b/docs/site/src/content/docs/reference/index.mdx
index 6084fee1d..42d5f1c2b 100644
--- a/docs/site/src/content/docs/reference/index.mdx
+++ b/docs/site/src/content/docs/reference/index.mdx
@@ -6,8 +6,8 @@ owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-27"
+  - registry-evidence
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced: []
@@ -20,6 +20,7 @@ to build or change something.
 ## Configuration and commands
 
 - [Configuration reference](project-configuration/)
+- [Evidencectl command reference](evidencectl/)
 - [registryctl CLI reference](registryctl/)
 - [Environment variables](environment-variables/)
 - [Errors and status codes](errors/)
diff --git a/docs/site/src/content/docs/reference/itb-semic-evidence.mdx b/docs/site/src/content/docs/reference/itb-semic-evidence.mdx
index ebe72dede..29234a512 100644
--- a/docs/site/src/content/docs/reference/itb-semic-evidence.mdx
+++ b/docs/site/src/content/docs/reference/itb-semic-evidence.mdx
@@ -1,13 +1,12 @@
 ---
 title: ITB and SEMIC evidence
-description: External ITB and SEMIC validation evidence for selected Registry Manifest and Registry Notary artifacts.
+description: External ITB and SEMIC validation evidence for selected Registry Manifest artifacts.
 wide: true
 status: current
 owner: registry-docs
 source_repos:
   - registry-manifest
-  - registry-notary
-last_reviewed: "2026-06-15"
+last_reviewed: "2026-08-04"
 doc_type: reference
 locale: en
 standards_referenced:
@@ -18,9 +17,11 @@ standards_referenced:
   - openapi
 ---
 
-This page summarizes selected external validation evidence for Registry Manifest and Registry Notary.
+This page summarizes selected external validation evidence for Registry Manifest.
 It is not a certification statement, and it does not claim every generated artifact or every runtime deployment has been tested.
 
+Registry Relay and Evidence have no external ITB or SEMIC evidence recorded yet.
+
 ## Summary
 
 | Product | Artifact | External check | Result | Boundary |
@@ -28,21 +29,17 @@ It is not a certification statement, and it does not claim every generated artif
 | Registry Manifest | Generated JSON Schema Draft 2020-12 files for the civil-registration fixture | ITB JSON validator, `any` domain, with the Draft 2020-12 metaschema embedded | `SUCCESS`, 0 errors, 0 warnings | Selected generated schemas only |
 | Registry Manifest | Generated DCAT JSON-LD for the civil-registration fixture | Public ITB/SEMIC SHACL validator, `dcatap.3_0_1_base0` | `SUCCESS`, 0 errors, 0 warnings | Selected DCAT artifact only |
 | Registry Manifest | Generated BRegDCAT-AP JSON-LD for the civil-registration fixture | Public ITB/SEMIC SHACL validator, `bregdcatap.2_0_0` and `bregdcatap.2_1_0` | `SUCCESS`, 0 errors, 2 warnings per profile | Passes with warnings; see the owning Manifest PR |
-| Registry Notary | Generated OpenAPI 3.1 document | ITB JSON validator against the OpenAPI 3.1 schema | `SUCCESS`, 0 errors, 0 warnings | OpenAPI hygiene only, not runtime GITB coverage |
 
 ## Source links
 
 - Validator outputs and the warning boundary are recorded in
   [registry-manifest PR #27](https://github.com/jeremi/registry-manifest/pull/27).
-- Registry Notary records the protected discovery policy and GITB runtime-suite target in
-  [jeremi/registry-notary#245](https://github.com/jeremi/registry-notary/pull/245).
 - Registry Manifest documents the BRegDCAT warning boundary in the Manifest
   ITB and SEMIC validation guide.
 
 ## What is not covered
 
-- Registry Notary runtime behavior has not been validated by a GITB scenario suite.
-- Registry Notary OpenAPI validation proves that the generated API document is structurally valid; it does not prove authenticated evaluation, credential issuance, federation replay handling, or SD-JWT VC verification.
+- No maintained runtime has been validated by a GITB scenario suite.
 - Registry Manifest BRegDCAT-AP output passes the selected public validators with warnings.
   The warning profiles differ on `dcat:themeTaxonomy`, so the warnings are documented rather than hidden.
 - The evidence applies to selected fixtures and profiles, not to every possible operator manifest or deployment.
diff --git a/docs/site/src/content/docs/reference/mint.mdx b/docs/site/src/content/docs/reference/mint.mdx
new file mode 100644
index 000000000..db53271cb
--- /dev/null
+++ b/docs/site/src/content/docs/reference/mint.mdx
@@ -0,0 +1,295 @@
+---
+title: Registry Mint reference
+description: Configuration fields, the token endpoint contract, and the Evidence verification path for the Registry Mint token issuer.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: reference
+locale: en
+standards_referenced: []
+---
+
+Registry Mint is the `mint` binary built from the `registry-mint` crate. It issues short-lived
+access tokens to registered machine clients, for deployments that have callers and no identity
+provider.
+
+## Contract status
+
+Registry Stack as a whole is a pre-1.0 technical release, and Registry Mint's surfaces carry that
+same status individually: they do not appear among the covered surfaces listed in
+[API stability and versioning](../api-stability/), so nothing on this page is a compatibility
+promise. Configuration fields, the token endpoint shape, and CLI flags may change without a major
+release until Registry Mint is added to that covered-surfaces table.
+
+What is stable in practice: the `client_credentials` grant with `private_key_jwt` client
+authentication (RFC 7523), the collapse of every client-authentication failure to
+`invalid_client`, and the rule that authority is written from the client registry and never from
+the caller's own request. Those are structural properties this crate exists to hold, not
+incidental implementation choices.
+
+## Source of truth
+
+The `registry-mint` crate at `crates/registry-mint/` is the source of truth for every claim on
+this page. Configuration parsing and validation live in `crates/registry-mint/src/config.rs` and
+`crates/registry-mint/src/clients.rs`, the HTTP surface in
+`crates/registry-mint/src/server.rs`, token minting in `crates/registry-mint/src/token.rs`, and
+the keyed audit boundary in `crates/registry-mint/src/audit.rs`. The public error shape lives in
+`crates/registry-mint/src/error.rs`. `crates/registry-mint/README.md` covers the same surface in
+prose. Where this page and the crate disagree, the crate wins.
+
+## Configuration reference
+
+One YAML document, loaded by `MintConfig::load`. Fields use `camelCase` keys, reject unknown
+fields, and every relative path resolves against the configuration file's own directory. The
+following tables group the surface by the struct that owns each field.
+
+### Top level
+
+| Field | Type | Default | Notes |
+| --- | --- | --- | --- |
+| `version` | integer | required | Must equal `1`. |
+| `issuer` | string (URL) | required | Must be `https`, have a host, and carry no credentials, query, or fragment. |
+| `listener` | object | required | See [Listener](#listener). |
+| `signing` | object | required | See [Signing](#signing). |
+| `audit` | object | required | See [Audit](#audit). |
+| `accessTokens` | object | required | See [Access tokens](#access-tokens). |
+| `clientAssertion` | object | required | See [Client assertion](#client-assertion). |
+| `clients` | object | required | See [Clients](#clients). |
+
+### Listener
+
+| Field | Type | Default | Notes |
+| --- | --- | --- | --- |
+| `address` | string (IP address) | required | Parsed as an `IpAddr`. |
+| `port` | integer (`u16`) | required | |
+| `maximumRequestBytes` | integer (`u32`) | `16384` | Bounded `1024..=1048576`. |
+| `requestTimeoutMilliseconds` | integer (`u64`) | `5000` | Bounded `1..=30000`. |
+
+### Signing
+
+| Field | Type | Default | Notes |
+| --- | --- | --- | --- |
+| `algorithm` | enum: `EdDSA`, `ES256`, `RS256` | required | Shared by minted tokens and accepted client assertions. |
+| `activeKeyId` | string (1..=256 bytes) | required | Must match the `kid` of the private JWK at `activeKeyFile`. |
+| `activeKeyFile` | path | required | Private JWK. Must be a regular, owner-only, single-link file. |
+| `retiredPublicJwkFiles` | list of paths | `[]` | Public JWKs of keys that no longer sign but may still have live tokens. |
+| `jwksPath` | string | `/.well-known/jwks.json` | A plain absolute path: one or more non-empty segments of `A-Z a-z 0-9 - . _ ~`, no dot segments, and no query, fragment, or route pattern. Must not be `/token`, `/health`, `/ready`, or `/.well-known/oauth-authorization-server`. |
+
+### Audit
+
+| Field | Type | Default | Notes |
+| --- | --- | --- | --- |
+| `path` | path | required | One keyed JSONL chain. The parent directory and existing chain must be owner-only. |
+| `maximumFileBytes` | integer (`u64`) | required | Per-segment rotation threshold, from `1048576` through `1099511627776` bytes. |
+| `hashKeyFile` | path | required | At least 32 bytes in a regular, owner-only, single-link file. Must differ from signing and audit paths. |
+| `hashKeyVersion` | integer (`u32`) | required | Must be non-zero. Labels keyed pseudonyms so an operator can identify the correlating key generation. |
+
+Mint takes a single-writer lock, verifies the active chain at startup, and synchronizes the chain
+and its parent directory for each append. When an append would exceed `maximumFileBytes`, Mint
+seals the active segment as `<path>.<eight-digit-sequence>` and opens a new active segment online.
+The keyed chain continues across segments. Mint does not delete or compact sealed segments, so the
+operator owns total capacity, backup, and retention. Verify retained records with:
+
+```sh
+mint verify-audit --config /etc/mint/mint.yaml
+```
+
+The command verifies every sealed segment and reports a missing sequence distinctly. It verifies
+the active segment when no Mint process owns the writer lock; otherwise it reports
+`active-segment: not verified`. Archive sealed segments oldest first. Do not rename or archive the
+active segment while Mint is running.
+
+The chain stores a random operation id for every decision. Successful release records add the
+token `jti`, signing key id, expiry, delegated status, and keyed pseudonyms for correlation.
+Denial records carry only a value-free error category. Raw assertions, access tokens, client ids,
+principals, authority values, actors, and subject values are not stored.
+
+### Access tokens
+
+| Field | Type | Default | Notes |
+| --- | --- | --- | --- |
+| `audiences` | list of strings (1..=16 entries, 1..=512 bytes each) | required | Written as the minted token's `aud`. |
+| `lifetimeSeconds` | integer (`u64`) | required | Bounded `60..=3600`. |
+| `claims` | object | required | See [Access token claim names](#access-token-claim-names). |
+
+### Access token claim names
+
+| Field | Type | Default | Notes |
+| --- | --- | --- | --- |
+| `principal` | string | `sub` | |
+| `requesterTags` | string | required | |
+| `evidenceAudience` | string | required | |
+| `grantId` | string | required | |
+| `grantAuthority` | string | required | |
+| `actor` | string, optional | none | Required only to issue delegated tokens. |
+
+These names must match the resource server's own claim-name configuration exactly. Claim names
+must be distinct, must not shadow the registered JWT claims Registry Mint writes itself
+(`iss`, `aud`, `exp`, `iat`, `nbf`, `jti`, `client_id`), and `sub` may only be used for
+`principal`.
+
+### Client assertion
+
+| Field | Type | Default | Notes |
+| --- | --- | --- | --- |
+| `audience` | string (URL with host) | required | The value client assertions must carry as their own `aud`. |
+| `maximumLifetimeSeconds` | integer (`u64`) | `300` | Bounded `30..=600`. |
+| `algorithms` | list of enum: `EdDSA`, `ES256`, `RS256` | required, non-empty | Accepted client assertion signature algorithms. |
+| `replayCacheEntries` | integer (`usize`) | `8192` | Minimum `256`. |
+
+### Clients
+
+| Field | Type | Default | Notes |
+| --- | --- | --- | --- |
+| `directory` | path | required | Directory of per-client registration files. The one reloadable part of the configuration: `SIGHUP` re-reads it in place. |
+
+### Client registration fields (`clients/*.yaml`)
+
+One file per client, parsed by `crates/registry-mint/src/clients.rs`.
+
+| Field | Type | Default | Notes |
+| --- | --- | --- | --- |
+| `clientId` | string | required | |
+| `principal` | string (at most 512 bytes) | required | |
+| `evidenceAudience` | string | required | |
+| `requesterTags` | list of strings (at most 32 entries) | required | |
+| `grant` | object: `id`, `authority` | none, optional | Required together or not at all. |
+| `delegation` | object: `actors`, `subjectClaims` | none, optional | Enables delegated tokens bound to one subject; see `crates/registry-mint/README.md`. |
+| `keys` | list of public JWKs (at most 8 entries) | required | A document carrying a private key member is rejected. |
+
+## Token endpoint contract
+
+### Request
+
+```text
+POST /token
+Content-Type: application/x-www-form-urlencoded
+
+grant_type=client_credentials
+&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
+&client_assertion=<compact JWS>
+```
+
+The path `/token` is fixed and not configurable. `grant_type` must equal `client_credentials`
+exactly, and `client_assertion_type` must equal
+`urn:ietf:params:oauth:client-assertion-type:jwt-bearer` exactly. `client_assertion` is a
+compact JWS whose payload carries `iss` and `sub` equal to the client id, `aud` equal to the
+configured `clientAssertion.audience`, a `jti`, and `iat`/`exp` inside
+`clientAssertion.maximumLifetimeSeconds`. Every `jti` is accepted once.
+
+### Response
+
+`200 OK`, `Content-Type: application/json`:
+
+```json
+{
+  "access_token": "SYNTHETIC_FIXTURE_TOKEN",
+  "token_type": "Bearer",
+  "expires_in": 300
+}
+```
+
+`access_token` is a compact JWS with header `{"alg": "<signing.algorithm>", "typ": "at+jwt",
+"kid": "<signing.activeKeyId>"}`. Its claims carry the standard `iss`, `aud`, `iat`, `nbf`,
+`exp`, `jti`, `client_id`, and `sub` (the principal), plus the authority claims named under
+`accessTokens.claims`. `expires_in` equals `accessTokens.lifetimeSeconds`. Mint durably appends
+the matching token-release audit record before sending this response. If that append fails, the
+token is not released.
+
+### Errors
+
+Every response body is `{"error": "<code>"}`, from
+`crates/registry-mint/src/error.rs`:
+
+| Code | Status | When |
+| --- | --- | --- |
+| `invalid_request` | `400` | A required form field is missing or duplicated, or `client_assertion_type` is not the exact `jwt-bearer` URN. A missing `grant_type` is a missing field and lands here, not below. |
+| `unsupported_grant_type` | `400` | `grant_type` is present but is not `client_credentials`. |
+| `invalid_client` | `401` | Every client authentication failure: unknown client id, bad signature, replayed `jti`, expired assertion. Registry Mint collapses these into one code so the endpoint cannot be used to probe which client ids are registered. Carries a `WWW-Authenticate: Bearer error="invalid_client"` header. |
+| `server_error` | `500` | An internal failure, including failure to durably audit the token decision. |
+
+### Other endpoints
+
+| Path | Purpose |
+| --- | --- |
+| `GET <signing.jwksPath>` (default `/.well-known/jwks.json`) | Public keys for verifying minted tokens, `application/jwk-set+json`. |
+| `GET /.well-known/oauth-authorization-server` | Metadata pointing at the token endpoint and the key set. |
+| `GET /health` | Liveness. |
+| `GET /ready` | Readiness. Returns `503` while no client is registered or after an audit write failure poisons the writer. |
+
+## How a client, Registry Mint, and Evidence interact
+
+One round trip, from a client that holds only its own private key to a signed assertion. Every
+label in this diagram is stated in the prose and tables on this page; the diagram is a summary of
+those contracts, not a second source for them.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant C as Registered client
+    participant M as Registry Mint
+    participant E as Evidence
+    participant S as Source
+
+    Note over C,E: Set up once, before any request: the client's public JWK<br/>sits in Mint's client registry, and Evidence's<br/>authentication block names Mint's issuer and key set.
+
+    C->>C: Sign an assertion with<br/>the client's own private key
+    C->>M: POST /token<br/>client_credentials + assertion
+    M->>M: Verify against that client's<br/>registered keys, refuse a used jti
+    M->>M: Durably append the keyed<br/>token-release audit record
+    M-->>C: Access token, authority written<br/>from the registry
+
+    C->>E: POST /v1/evidence<br/>Bearer access token
+    E->>M: GET the published key set
+    M-->>E: Public keys, held<br/>between requests
+    E->>E: Verify the token, read authority<br/>by the configured claim names
+    E->>S: Read what the<br/>definition needs
+    S-->>E: Source response
+    E-->>C: Signed assertion
+```
+
+Everything through the access-token return is the whole of Registry Mint's job. It never sees the
+source, the acceptance definition, or the assertion. The remaining exchanges are Evidence's, and
+Evidence's only knowledge of Registry Mint is a URL and a key set: it reads the token by the claim
+names in its own
+configuration, so any issuer writing those claims would serve equally well.
+
+The exact wire shapes the diagram abbreviates are given in full below:
+[Token endpoint contract](#token-endpoint-contract) for the assertion and token,
+[Other endpoints](#other-endpoints) for the key set path, and
+[How Evidence verifies these tokens](#how-evidence-verifies-these-tokens) for the claim names.
+
+Two failures collapse deliberately and are worth reading beside the diagram. A client
+authentication failure returns `401 invalid_client` whatever went wrong, so the token endpoint
+cannot be used to probe which client ids are registered. A key-set retrieval failure prevents
+Evidence from verifying a token: with no key set ever retrieved, every request is rejected until
+one can be, and with a key set already held, that held set keeps being accepted only until its
+allowance runs out. Evidence names the outage in either case rather than failing silently.
+
+## How Evidence verifies these tokens
+
+Evidence's own `authentication` configuration block, defined in
+`crates/registry-evidence/src/config.rs` (`AuthenticationConfig`), names the same claims Registry
+Mint writes: `principalClaim`, `requesterTagsClaim`, `evidenceAudienceClaim`, `grantIdClaim`,
+`grantAuthorityClaim`, and an optional `actorClaim`, alongside `issuer`, `audiences`,
+`tokenTypes`, `algorithms`, and `jwksUri`. Evidence verifies a presented token against that
+configuration in `crates/registry-evidence/src/auth.rs` (`Authenticator`), reading each claim by
+the name configured there rather than any hardcoded name. Setting `authentication.issuer` and
+`authentication.jwksUri` to Registry Mint's own `issuer` and published key set, and setting each
+claim name to match `accessTokens.claims` on Registry Mint, is what lets one token flow between
+the two.
+
+This is proven by tests, not only by matching configuration. `registry-mint`'s
+`tests/evidence_compatibility.rs` drives the real Registry Mint router over a real on-disk
+deployment and feeds the minted token to Evidence's own authenticator;
+`tests/delegated_subject_binding.rs` does the same for delegated, subject-bound tokens, running
+Evidence's own entitlement match and selector resolution over a token minted by the real Registry
+Mint router. The dependency runs one way only: Registry Mint's tests exercise Evidence's
+authenticator, and Evidence does not depend on Registry Mint.
+
+## Next
+
+- [Configure Registry Mint](../../configure/mint/)
+- [API stability and versioning](../api-stability/)
diff --git a/docs/site/src/content/docs/reference/project-configuration.mdx b/docs/site/src/content/docs/reference/project-configuration.mdx
index 9b0c7c583..fe6d002d0 100644
--- a/docs/site/src/content/docs/reference/project-configuration.mdx
+++ b/docs/site/src/content/docs/reference/project-configuration.mdx
@@ -1,11 +1,11 @@
 ---
 title: Configuration reference
-description: Generated field reference for Registry Stack authored project files and Relay and Notary runtime configuration.
+description: Generated field reference for Registry Stack authored project files and Relay runtime configuration.
 status: current
 owner: registry-docs
 source_repos:
   - registry-stack
-last_reviewed: "2026-07-26"
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced: []
@@ -14,11 +14,11 @@ wide: true
 
 import AuthoringConfigurationReference from '../../../components/AuthoringConfigurationReference.astro';
 
-This generated reference documents every reachable path in seven Registry Stack configuration
-schemas: the five project-authoring schemas plus the Relay and Notary runtime schemas.
+This generated reference documents every reachable path in six Registry Stack configuration
+schemas: the five project-authoring schemas plus the Relay runtime schema.
 Use the purpose, reviewed intent profile, and ownership metadata to choose a field.
 Then use `registryctl check` for a complete project or the product configuration checks for Relay
-and Notary runtime configuration.
+runtime configuration.
 
 ## Contract status
 
@@ -38,21 +38,21 @@ Its field entries use `history_status: not_verified`, `introduced_in: null`, and
 Per-field release history is not published until a release-schema comparison establishes the
 versions.
 
-The generator joins the five committed project-authoring JSON Schemas, the Relay and Notary schemas
-produced directly by their Rust schema APIs, the typed field-knowledge index, and reviewed
-product-owned human-intent metadata.
+The generator joins the five committed project-authoring JSON Schemas, the Relay schema produced
+directly by its Rust schema API, the typed field-knowledge index, and reviewed product-owned
+human-intent metadata.
 JSON Schema and Rust validation remain the configuration authority.
 The reference does not inspect a project, live runtime configuration, environment variables, secret
 stores, or country values.
 
 The five project-authoring sections describe configuration people commit in a country project.
-The Relay and Notary sections describe product-owned runtime contracts generated by `registryctl`;
-they are not additional country-authored files. Their intent sidecars are documentation knowledge
-only and are never loaded by either product at runtime.
+The Relay section describes a product-owned runtime contract generated by `registryctl`; it is not
+an additional country-authored file. Its intent sidecar is documentation knowledge only and is
+never loaded by the product at runtime.
 
 {/* Generated from the five crates/registryctl/schemas/project-authoring schemas,
-    registry_relay::config::schema::document(), registry_notary_core::config::schema::document(),
-    parity-coverage.json#field_knowledge, and the three product-owned intent sidecars.
+    registry_relay::config::schema::document(), parity-coverage.json#field_knowledge,
+    and the product-owned Relay intent sidecar.
     Run npm run generate from docs/site. */}
 
 <AuthoringConfigurationReference />
@@ -60,7 +60,7 @@ only and are never loaded by either product at runtime.
 ## Validation boundary
 
 The generated field entries describe schema facts and exact reviewed intent.
-Relay and Notary fields carry a product-owned intent profile, while schema or reviewed override
+Relay fields carry a product-owned intent profile, while schema or reviewed override
 flags explicitly identify the source of purpose and default behavior.
 Runtime entries show the human-facing configuration `key_path` separately from the authoritative
 JSON Schema `pointer`; authored entries use their JSON Schema pointer directly.
diff --git a/docs/site/src/content/docs/reference/registryctl.mdx b/docs/site/src/content/docs/reference/registryctl.mdx
index f4275fec8..6b00a4d80 100644
--- a/docs/site/src/content/docs/reference/registryctl.mdx
+++ b/docs/site/src/content/docs/reference/registryctl.mdx
@@ -5,7 +5,7 @@ status: current
 owner: registry-docs
 source_repos:
   - registry-stack
-last_reviewed: "2026-07-30"
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced: []
@@ -29,9 +29,6 @@ The released command parser and `--help` output are the source of truth.
 | `trust` | Inspect and create independently owned trust artifacts |
 | `tooling` | Print schemas and references or install editor support |
 
-For removed pre-1.0 commands and their 1.0 replacements, use the
-[pre-1.0 cutover guide](../../start/pre-1.0-cutover/).
-
 ## Project and environment selection
 
 Registryctl walks from the current directory to the nearest parent containing
@@ -110,8 +107,7 @@ registryctl build --against <approved-set>
 registryctl build --format json
 ```
 
-An initial combined project can emit the closed lanes `relay-public`, `relay-consultation`, and
-`notary`.
+An initial project can emit the closed lanes `relay-public` and `relay-consultation`.
 `--against` verifies the current approved set for an update and limits output to affected lanes.
 `build` does not sign, assemble, deploy, or activate.
 Its next action is source-aware. A build backed by a project-local file remains for development
@@ -162,7 +158,7 @@ registryctl deploy verify \
   --approved-set <file>
 ```
 
-Generation consumes one verified three-lane approved set and the signed release lock installed
+Generation consumes one verified two-lane approved set and the signed release lock installed
 with Registryctl.
 `--binding` selects a closed deployment binding.
 Omit it to generate safe loopback defaults into the package.
@@ -224,7 +220,7 @@ registryctl trust approved-set assemble ...
 
 ```text
 registryctl trust anchor create \
-  --lane <relay-public|relay-consultation|notary> \
+  --lane <relay-public|relay-consultation> \
   --input <lane-signing-input> \
   --public-key <public-jwk> \
   --threshold <number> \
@@ -248,7 +244,7 @@ registryctl trust bundle verify \
   --bundle-dir <signed-artifact-directory> \
   --anchor <signed-artifact-directory>/anchor.json
 registryctl trust bundle sign \
-  --lane <relay-public|relay-consultation|notary> \
+  --lane <relay-public|relay-consultation> \
   --input <lane-signing-input> \
   --anchor <file> \
   --key <file:or-op-locator> \
@@ -264,18 +260,17 @@ An unprefixed path or unknown scheme fails before output creation.
 
 ### Assemble an approved set
 
-Initial assembly supplies all three verified lane directories:
+Initial assembly supplies both verified lane directories:
 
 ```text
 registryctl trust approved-set assemble \
   --relay-public <signed-artifact-directory> \
   --relay-consultation <signed-artifact-directory> \
-  --notary <signed-artifact-directory> \
   --output-file <file>
 ```
 
 Update assembly supplies `--from <approved-set>` plus every affected replacement.
-The approved set is an operator handoff, not a fourth signature or activation authority.
+The approved set is an operator handoff, not a third signature or activation authority.
 
 ## `tooling`
 
diff --git a/docs/site/src/content/docs/reference/standards.mdx b/docs/site/src/content/docs/reference/standards.mdx
index 43cbb584d..d49be6fdd 100644
--- a/docs/site/src/content/docs/reference/standards.mdx
+++ b/docs/site/src/content/docs/reference/standards.mdx
@@ -8,8 +8,7 @@ source_repos:
   - registry-relay
   - registry-platform
   - registry-manifest
-  - registry-notary
-last_reviewed: "2026-07-19"
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced:
@@ -35,7 +34,6 @@ standards_referenced:
   - universal-dpi-safeguards
   - sp-dci
   - w3c-did
-  - oid4vci
 ---
 
 import StandardsTable from '../../../components/StandardsTable.astro';
@@ -112,11 +110,11 @@ What these levels mean for integrators:
 - OGC API Features and OGC API EDR are listed as profiled `emits` claims for Registry Relay.
   The claims are scoped to the tested feature-gated adapter routes, not full OGC conformance.
 - The Verifiable Credentials Data Model (W3C VC) is listed as `aligns_with` (`referenced`).
-  [Registry Notary](../../products/registry-notary/) issues SD-JWT VC credentials, but it does
-  not emit a full W3C VC Data Model envelope. [Registry Relay](../../products/registry-relay/)
-  no longer emits or hosts VC artifacts.
-  {/* Notary evidence packet explicitly states "W3C Verifiable Credentials Data Model: NOT PRESENT" (.research/registry-notary.md). This is a confirmed absence, not an evidence gap; keep at aligns_with until a reviewed VC profile and validation fixtures are pinned. Promote when a reviewed VC profile and validation fixtures are pinned. */}
+  The retired product that issued SD-JWT VC credentials under this alignment never emitted a full
+  W3C VC Data Model envelope. [Registry Relay](../../products/registry-relay/)
+  does not emit or host VC artifacts either.
+  {/* The retired product's evidence packet stated "W3C Verifiable Credentials Data Model: NOT PRESENT". This was a confirmed absence, not an evidence gap; keep at aligns_with until a reviewed VC profile and validation fixtures are pinned. */}
 - PROV-O is listed as `inspired_by` (`referenced`).
   The code uses provenance-shaped concepts (audit fields, claim provenance struct) but no PROV-O
   vocabulary terms are emitted as JSON-LD.
-  {/* Confirmed absence: no `prov:` namespace or PROV-O `@context` found in relay or notary source at reviewed commits. PROV-O influences the design (audit fields, claim provenance struct) but no PROV-O vocabulary is emitted. Keep at inspired_by. */}
+  {/* Confirmed absence: no `prov:` namespace or PROV-O `@context` found in Relay source at reviewed commits. PROV-O influences the design (audit fields, claim provenance struct) but no PROV-O vocabulary is emitted. Keep at inspired_by. */}
diff --git a/docs/site/src/content/docs/security/evidence.mdx b/docs/site/src/content/docs/security/evidence.mdx
new file mode 100644
index 000000000..23cef0700
--- /dev/null
+++ b/docs/site/src/content/docs/security/evidence.mdx
@@ -0,0 +1,238 @@
+---
+title: Evidence security model
+description: "The security invariants Evidence enforces, how each traces to a named test, and the duties that remain with the operator."
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-03"
+doc_type: explanation
+locale: en
+standards_referenced: []
+---
+
+Evidence's security model is contract-driven. The invariant matrix in
+`products/evidence/contracts/security-invariant-matrix.yaml` is the source of
+truth for what the runtime guarantees, `products/evidence/contracts/security-test-traceability.yaml`
+binds every invariant to the named tests that prove it, and continuous
+integration regenerates and byte-diffs both contracts through the
+`evidence-contracts` job, which runs
+`products/evidence/scripts/check-contracts.sh`. A change that narrows a
+guarantee or drops its test fails that job rather than merging unnoticed.
+
+## What the invariant matrix guarantees
+
+The matrix pins 33 numbered invariants, `V1-I01` through `V1-I33`, each with a
+rule, the threat it closes, its enforcement, and one `negative_test` id. This
+section groups them by theme and cites each id in backticks; the matrix itself
+is the complete, normative text.
+
+### Closed request and requirement scope
+
+Evidence evaluates only predefined, versioned requirement revisions
+(`V1-I01`). The request schema is closed, so callers cannot supply
+thresholds, expressions, scripts, paths, headers, source fields, relationship
+types, adapter parameters, or response projections (`V1-I02`). Because a
+bundle enabling several requirements at once can reconstruct a protected
+value across them, the complete enabled bundle is reviewed as one disclosure
+surface (`V1-I03`).
+
+### Authentication and authorization
+
+Principals and attributes derive only from configured, validated
+authentication sources, and missing data denies rather than falling back to
+another claim (`V1-I04`). One authorization decision binds requester,
+optional actor, requirement revision, purpose, every role, profile, and
+origin tuple, authority, and audience together, so partial matches across
+grants cannot be unioned into access (`V1-I05`). Selector profiles and values
+are provider-lookup inputs only, never proof of authority (`V1-I06`), and a
+caller-supplied consent, approval, or grant reference cannot create authority
+on its own (`V1-I07`). Callers cannot choose selector fields, operators,
+weights, thresholds, normalization, or query plans; named profiles close the
+exact field set (`V1-I08`).
+
+### Source access and the Rhai boundary
+
+Source calls are fixed by trusted configuration and executed only by the
+core, closing off SSRF, credential forwarding, and script-directed
+networking (`V1-I09`). Provider lookup exposes only `match`, `no_match`, or
+`ambiguous`; Evidence never surfaces or chooses candidates (`V1-I10`). Rhai
+scripts return one closed lookup result and declared typed concept values
+only (`V1-I11`), and the core rejects undeclared concepts, extra fields, and
+any value that violates its type, codelist, cardinality, precision, or size
+before evidence construction (`V1-I12`). Public evidence is assembled only by
+the core after that validation, so a script cannot inject envelope fields,
+subject identifiers, or unsupported claims (`V1-I25`).
+
+### Fail-closed behavior and non-disclosure
+
+Missing facts, undefined decisions, script failures, audit failures, and
+evaluation failures all fail closed rather than releasing partial or
+unaudited evidence (`V1-I13`). Raw source responses are never persisted or
+logged (`V1-I14`), and selector, source, and disclosed values never appear in
+logs or native audit (`V1-I15`). No-match, ambiguous, missing-fact, and
+inconsistent-derivation outcomes collapse to one public problem shape by
+default, so a caller cannot use response shape, message, or timing as an
+existence oracle for registry membership (`V1-I16`). Subject bindings are
+scoped to their audience, purpose, role, and selector bundle, so the same
+subject is not linkable across purposes or relying parties (`V1-I17`).
+
+### Configuration and process tenancy
+
+Configuration is immutable for the life of the serving process: there is no
+runtime override, reload, merge, or fallback path (`V1-I18`). One process
+serves one operator-controlled trust domain, with one service trust domain,
+issuer governance boundary, bundle lifecycle, signer, and audit boundary
+(`V1-I19`). Rate controls are defense in depth rather than a substitute for
+safe bundle design; combination validation runs independently of configured
+rate limits (`V1-I20`).
+
+### Signing and response integrity
+
+A signed flattened JWS over the exact evidence payload is mandatory,
+available to every authorized grant, and the default response; unsigned
+output exists only through its own exact media type when both the bundle and
+the matched grant permit it (`V1-I21`). Missing or failed signing never falls
+back to unsigned evidence (`V1-I22`). Private signing material is owned by
+the core alone and stays absent from bundle values, Rhai, logs, audit, and
+errors (`V1-I23`). A signature authenticates the provider and payload
+integrity; it does not assert legal-signature status or source truth
+(`V1-I24`).
+
+### Discovery, nonce handling, and response-format authorization
+
+Evidence-definition discovery is authenticated and requester-scoped; it never
+creates authority or exposes deployment internals such as selectors, source
+plans, or credentials (`V1-I26`). Every request carries one canonical
+32-byte random nonce that is echoed into the evidence payload but never
+stored, uniqueness-checked, or exposed to authorization, rate limits, Rhai,
+source requests, logs, metrics, traces, or native audit (`V1-I27`). The
+unsigned response format is authorized only when the immutable bundle
+enables it and the one complete matched grant also permits it; API
+selection, runtime configuration, or other grants create no permission on
+their own (`V1-I28`). The final immutable response bytes exist before the
+disclosure-release audit is durably accepted, and those are the exact bytes
+released afterward (`V1-I29`). Every native audit event records the closed
+response-protection mode, and a signing key identity is present exactly for
+signed release (`V1-I30`).
+
+### Verification and token binding
+
+Strict signed verification compares the response against independently
+retained expectations, the expected nonce, the expected unordered set of
+unique role-bound subject bindings, and the expected concept identifiers,
+forms, and cardinalities, and returns one generic policy-mismatch error
+rather than revealing which comparison failed (`V1-I31`). An access token
+carrying a proof-of-possession confirmation claim is denied rather than
+accepted as an ordinary bearer token, because Evidence validates no sender
+proof and accepting one would discard the constraint the token was issued
+under (`V1-I32`).
+
+### Telemetry
+
+Operational telemetry is off by default, served only on a separate
+operator-private listener, and every series label is drawn from a closed set
+(route template, method, status category, problem code) rather than from
+request content (`V1-I33`).
+
+### Cross-cutting controls
+
+The matrix also pins 21 cross-cutting controls, keyed by name rather than a
+`V1-I` id, each with its own negative test. They cover bundle and secret
+trust (`config_trust`, `secret_parsing`), durable audit ordering
+(`audit_order`), listener exposure and outbound transport
+(`transport_identity`, `outbound_tls_and_proxy`, `transport_pinning`), secret
+file identity (`secret_file_identity`), the closed runtime file
+(`runtime_ownership_split`), request- and script-boundary details
+(`request_preparation`, `subject_role_order`, `source_response_shape`,
+`script_resource_exhaustion`, `reserved_header_aliases`,
+`jwks_route_parity`, `unsigned_envelope_distinct`, `exact_decimal`,
+`entity_reference_projection`), and the SD-JWT VC serialization
+(`sd_jwt_vc_projection_integrity`, `sd_jwt_vc_format_authorization`,
+`sd_jwt_vc_holder_key_closed`, `sd_jwt_vc_claims_closed`).
+
+## How test traceability works
+
+Each invariant's `negative_test` id in the matrix is a key into
+`products/evidence/contracts/security-test-traceability.yaml`, which lists
+the file and function name of every test that proves it. A negative test may
+be split across several functions, but the matrix states one binding review
+rule: a test may be split, never weakened or deleted.
+
+The mapping is not narrative. `crates/registry-evidence/tests/security_contract_traceability.rs`
+reads both contracts and checks three things: every matrix id has a
+traceability entry and every traceability entry maps to a matrix id, so
+neither can drift from the other; each referenced test file exists and
+contains a matching `fn <name>(` signature; and that signature sits under a
+`#[test]` or `#[tokio::test]` attribute rather than a plain function that
+happens to share a name. A traceability entry that names a deleted or
+renamed test fails this check before it fails anything else.
+
+```bash
+products/evidence/scripts/check-contracts.sh
+```
+
+Three concrete examples:
+
+- `V1-I04` (principals and attributes derive only from configured
+  authentication sources) traces to `sec-missing-principal-no-fallback`,
+  proven by `missing_principal_never_falls_back_to_client_id_or_azp` in
+  `crates/registry-evidence/src/runtime_tests.rs`.
+- `V1-I23` (private signing material stays core-owned and absent from bundle
+  values, Rhai, logs, audit, and errors) traces to
+  `sec-private-key-canary-unreachable`, proven by
+  `yaml_names_and_secret_references_are_strict` in
+  `crates/registry-evidence/src/config.rs` and
+  `jwks_contains_public_material_only` in
+  `crates/registry-evidence/src/signing.rs`.
+- `V1-I29` (final immutable response bytes exist before the disclosure-release
+  audit is durably accepted) traces to `sec-release-bytes-pre-audited`,
+  proven by four tests in `crates/registry-evidence/src/runtime_tests.rs`:
+  `disclosure_audit_failure_prevents_signed_response_release`,
+  `disclosure_audit_failure_prevents_unsigned_response_release`,
+  `signing_failure_returns_a_problem_and_never_an_unsigned_body`, and
+  `sd_jwt_signing_failure_no_fallback_format`.
+
+## What the operator must uphold
+
+The invariant matrix describes what the `evidence` binary enforces in code.
+`products/evidence/OPERATOR-CONTRACT.md` states duties that remain with the
+operator because no service-side control can hold them for a deployment it
+does not otherwise touch.
+
+Owner-only key files. Each secret file below the configured
+`secretProviders.file.root` must be a regular, non-symlink file owned by the
+service identity with mode `0600`; the file provider rejects anything else.
+Audit and subject-binding secret files must contain independently generated
+raw key bytes and be at least 32 bytes.
+
+Immutable bundle and runtime file. The operator mounts one reviewed governed
+bundle and one closed `runtime.yaml` read-only at startup; the bundle
+directory, the runtime file, and every captured artifact must be
+non-writable to the service process, with directories and files carrying no
+write bits. There is no runtime upload, editor, approval API, hot reload,
+merge, mutation, governed-field override, or fallback bundle or runtime
+file: a new revision is a new deployment, not a live change.
+
+Secret handling. Source credentials and private signing material reach
+Evidence only through the secret-reference mechanism and must not appear in
+YAML values, Rhai, command arguments, environment dumps, logs, audit,
+errors, snapshots, or generated contracts. The operator configures exactly
+one active signing key, whose `kid` matches `signing.activeKeyId`, and
+retains each retired public key in the published JWKS for at least the
+maximum assertion validity plus allowed clock skew.
+
+## Report a vulnerability
+
+Suspected Evidence vulnerabilities, including credential disclosure,
+authentication bypass, audit redaction failure, source connector data
+leakage, and signing-key handling bugs, go through the private disclosure
+process in [SECURITY.md](https://github.com/registrystack/registry-stack/blob/main/SECURITY.md),
+never a public issue or pull request. See
+[Report a vulnerability](../report-a-vulnerability/) for the complete in-scope
+list and reporting steps.
+
+## Next
+
+- [Security overview](../)
+- [Report a vulnerability](../report-a-vulnerability/)
diff --git a/docs/site/src/content/docs/security/hardening-checklist.mdx b/docs/site/src/content/docs/security/hardening-checklist.mdx
index ee9cb974a..5b2811aec 100644
--- a/docs/site/src/content/docs/security/hardening-checklist.mdx
+++ b/docs/site/src/content/docs/security/hardening-checklist.mdx
@@ -5,16 +5,17 @@ status: draft
 owner: registry-docs
 source_repos:
   - registry-relay
-  - registry-notary
+  - registry-evidence
+  - registry-mint
   - registry-platform
-last_reviewed: "2026-07-02"
+last_reviewed: "2026-08-04"
 doc_type: how-to
 locale: en
 standards_referenced: []
 ---
 
-Registry Relay and Registry Notary enforce authentication, authorization, key publication, and
-audit as software controls (see [Security overview](../)).
+Registry Stack runtimes enforce their own authentication, authorization, key publication, and
+audit boundaries as software controls (see [Security overview](../)).
 [RS-SEC-G](../../spec/rs-sec-g/) Section 9 draws a line at the deployment: secret and key
 provisioning, key custody and rotation, audit retention and storage, tenant isolation, transport
 termination and certificate management, edge rate limiting, deployment configuration, and incident
@@ -24,107 +25,184 @@ production-ready.
 
 ## When to use this
 
-Use this checklist before a `production` or `evidence_grade` deployment goes live, and again after
-any change to signing keys, audit sinks, network placement, or the declared deployment profile. It
-assumes you have already configured your service per the [Registry Relay configuration reference](../../products/registry-relay/configuration/)
-or the [Registry Notary operator configuration reference](../../products/registry-notary/operator-config-reference/).
+Use this checklist before a deployment serving real data goes live, and again after any change to
+signing keys, audit sinks, network placement, the governed Evidence bundle, or Relay's declared
+deployment profile. It assumes you have already configured your services per the
+[Registry Relay configuration reference](../../products/registry-relay/configuration/) and, for
+Evidence, [Configure Evidence](../../configure/evidence/).
 
 ## Before you start
 
-- Decide the deployment profile (`local`, `hosted_lab`, `production`, or `evidence_grade`) you are
-  claiming; see the deployment profile section of the
+- Decide the Relay deployment profile (`local`, `hosted_lab`, `production`, or `evidence_grade`)
+  you are claiming; see the deployment profile section of the
   [Registry Relay configuration reference](../../products/registry-relay/configuration/). The
   profile is never inferred from hostname or network position; you declare it.
-- Have `registry-notary doctor` (Notary) or your Relay startup logs available to check gate
-  findings as you work through each item.
+- Have your Relay startup logs and `registry-relay doctor` output available to check gate findings
+  as you work through each Relay item.
+- Have `evidence check` runnable against the exact revision you intend to serve. Evidence has no
+  posture endpoint, no profile declaration, and no admin surface: its equivalent of a gate finding
+  is a startup or readiness failure, so the offline commands are where you find problems first.
+- When the deployment runs Registry Mint, have `mint check` and `mint verify-audit` runnable
+  against the exact configuration and retained chain you intend to serve.
 
 ## Keys and custody
 
-- Configure signing keys through the provider abstraction (`local_jwk_env`, `file_watch`, or
-  `pkcs11`) under `evidence.signing_keys`, not as inline YAML values. Startup fails closed if an
-  active signing provider cannot be constructed. See the
-  [signing key provider reference](../../products/registry-notary/signing-key-provider/).
-- Provision secrets (API-key fingerprints, Relay source credentials, Notary workload tokens,
-  private JWKs, and the audit hash secret) only
-  through the environment variables named in config. For local development the binary accepts
-  `--env-file`; for shared environments use the platform secret store and do not check dotenv files
-  into the repository.
-- Rotate a signing key by adding a new `kid`, moving credential profiles to it, then moving the old
-  key to `publish_only` until its configured publication window ends or verifiers no longer need
-  it. Do not delete a key verifiers may still need.
-- Keep RS256 scoped to the eSignet relying-party (RP) client assertion key (eSignet, the MOSIP-project identity
-  provider, is the one integration that needs RS256). Credential profile, access token, and
-  federation response signing use Ed25519 EdDSA or ES256/P-256; RS256 is rejected there.
-- If a signing key uses `provider: pkcs11`, confirm the deployed binary was built with the
-  `pkcs11` capability (`registry-notary build-info`) and validate the module, token, and key lookup
-  with `registry-notary doctor --config <path>`.
+- Evidence: configure exactly one active signing key, an Ed25519 private JWK whose `kid` matches
+  `signing.activeKeyId` in the governed bundle. `evidence check` refuses a deployment whose signing
+  material startup would refuse, including a `kid` mismatch.
+- Evidence: supply every private key and source credential through a `secret:file/<name>`
+  reference resolved under `secretProviders.file.root`, never as a YAML value, a command argument,
+  or an environment dump. The file provider reads only regular, non-symlink files below that root,
+  each owned by the service identity at mode `0600`, and it checks owner, mode, no-follow, link
+  count, and open-file identity. Keep the secret root itself operator-only.
+- Evidence: give the audit hash key and the subject-binding key independently generated raw key
+  material of at least 32 bytes each. The file provider does not base64-decode them, so write raw
+  bytes rather than an encoded string.
+- Evidence: rotate a signing key by starting a new revision with the new active key and keeping
+  the retired public JWK published for at least the maximum assertion validity plus the allowed
+  clock skew. Do not remove a public key a stored assertion still needs.
+- Evidence Version 1 has exactly one secret provider, the file provider. There is no
+  hardware-security-module or PKCS#11 option, so key custody is a property of the host, its disk,
+  its backups, and its operators. Treat that as a deployment control you own, not one the runtime
+  provides. See [Move Evidence to production signing](../../tutorials/move-evidence-to-production-signing/).
 - Relay: confirm every env-backed `fingerprint.name` referenced in config exists in the runtime
   environment, and that no raw key, fingerprint, private JWK, or full environment dump reaches a
   log line; see the production checklist in the
   [Registry Relay configuration reference](../../products/registry-relay/configuration/).
+- Relay: keep the OIDC algorithm allowlist to what the deployment actually uses. `HS*` and `none`
+  are absent from the configuration type entirely; the default allowlist is RS256, ES256, and
+  EdDSA. Evidence's own access-token allowlist is configured per bundle from the same three, while
+  its assertion signing is EdDSA only and not configurable.
+- Registry Mint, when the deployment runs it: hold Registry Mint's private JWK in an owner-only,
+  non-symlink file, and treat `clients.directory` as key material rather than configuration. Any
+  file written there registers a client and the authority Registry Mint will assert for it, and a
+  running process re-reads the directory on `SIGHUP` without a restart.
+- Registry Mint: generate its audit HMAC key independently from its signing key, give it at least
+  32 bytes of random material, and keep it in a separate owner-only, non-symlink file. Retain the
+  key for as long as its audit chain must remain verifiable.
+
+## Freeze the Evidence deployment project
+
+- Mount the governed `bundle/` directory, `runtime.yaml`, and every captured artifact read-only
+  and non-writable to the service process. Evidence reports a non-immutable-input error and
+  refuses to start rather than serving from an input it could write to.
+- Freeze the project before validating or serving it, then validate the frozen bytes:
+
+  ```sh
+  chmod -R a-w bundle && chmod 444 runtime.yaml
+  evidence --runtime runtime.yaml check
+  evidence --runtime runtime.yaml evaluate --fixture "bundle/fixtures/<cases>.yaml"
+  ```
+
+- Review the complete simultaneously enabled bundle as one disclosure surface before deployment,
+  covering threshold ladders, overlapping categories, increasingly precise regions, jurisdiction
+  variants, coexisting revisions, and relationship combinations. The runtime rejects two enabled
+  requirements that declare the same `disclosureGuard` family, but a declared family is your
+  reviewed attestation, not a semantic classifier: it cannot tell that two differently labelled
+  families are equivalent.
+- Confirm that no two authority paths cover the same requirement, purpose, and subject tuple.
+  Startup validation does not detect that overlap, and at request time it denies rather than
+  choosing, so it presents as an unexplained `403`.
+- Keep `responseFormats` at the signed default unless a reviewed decision widens it. Unsigned
+  output is releasable only where the immutable bundle and the one matched grant both name it,
+  and it is transport-authenticated convenience, never later-verifiable evidence.
 
 ## Audit sink and retention
 
-- Configure a durable audit sink (`file` or `syslog`, not bare `stdout`) before you declare
-  `production` or `evidence_grade`. A missing durable sink trips `relay.audit.sink_missing` /
-  `notary.audit.sink_missing`, which fails startup at `evidence_grade` (`startup_fail` for both
-  services, and already `startup_fail` at `production` for Notary).
-- Set `audit.hash_secret_env` to an environment variable holding at least 32 bytes of
+- Evidence: put `auditStorage.path` on storage whose append durability, permissions, capacity,
+  backup, restore, and retention you own. Both audit events are fail-closed by contract: the
+  access-attempt event must be durably accepted before the first source read and the
+  disclosure-release event before the response is released, so an unwritable sink stops the
+  service returning success rather than degrading quietly.
+- Evidence: run exactly one process per audit path. The sink takes an exclusive advisory lock on
+  `<auditStorage.path>.lock` at startup, and a second process pointed at the same path fails to
+  start. The supported shape is one replica per audit path, active/passive, recovered with a
+  readiness probe and restart-on-failure rather than with a second concurrent writer.
+- Evidence: treat `auditStorage.maximumFileBytes` as a per-segment rotation threshold, not a
+  ceiling on the chain. Rotation happens online with no operator action, nothing in the runtime
+  deletes or compacts a sealed segment, and total disk consumption is therefore unbounded until
+  your retention process acts.
+- Evidence: run `evidence verify-audit` over the whole audit directory during backup, restore, and
+  incident procedures, and on whatever cadence your retention policy requires. Startup verifies
+  only the active segment, so this pass is what proves sealed history was not tampered with.
+- Registry Mint: put `audit.path` on durable storage whose permissions, capacity, backup, restore,
+  and retention you own. Mint synchronizes the token-release record before returning a token and
+  fails closed when that write fails. Treat `audit.maximumFileBytes` as a per-segment threshold,
+  not a total ceiling. Rotation happens online, but Mint never deletes or compacts sealed segments.
+- Registry Mint: run one process per `audit.path`. Mint verifies the retained chain and takes an
+  exclusive lock at startup. Archive sealed segments oldest first, never rename or archive the
+  active segment while Mint runs, and run `mint verify-audit` during backup, restore, incident
+  procedures, and on the cadence your retention policy requires.
+- Relay: configure a durable audit sink (`file` or `syslog`, not bare `stdout`) before you declare
+  `production` or `evidence_grade`. A missing durable sink trips `relay.audit.sink_missing`, which
+  fails startup at `evidence_grade`.
+- Relay: set `audit.hash_secret_env` to an environment variable holding at least 32 bytes of
   deployment-specific random secret material. Relay startup fails closed if it is missing, empty,
   unset, or weak.
-- Keep `audit.write_policy: fail_closed` (the default) unless an explicit availability exception
-  accepts best-effort audit durability under `availability_first`. `fail_closed` means a request
-  whose audit record cannot be written returns `503 audit.write_failed` instead of a success
-  (REQ-SEC-G-009).
-- If you rotate the audit hash secret, retain the old secret under your audit retention controls
-  for any period during which older records must remain comparable to new ones, or accept that new
-  records will not match old audit handles.
-- Hash-chained envelopes (`prev_hash`, `record_hash`) detect ordering gaps and accidental
-  corruption inside the retained set, but they do not prove that every historical audit record
-  remains present. Use off-host audit shipping when completeness matters.
-- For `evidence_grade`, configure `deployment.evidence.audit_ack_cursor_path` for every shipping
-  target, including `stdout` and `syslog`. The off-host shipper writes
-  `registry.audit.ack_cursor.v1` after a successful hand-off. Registry Relay and Registry Notary
-  report ready only while `acked_at` is fresh and `last_acked_hash` equals the live keyed audit
-  chain tail. A matching cursor means the trusted shipper claims zero local backlog. The local
-  cursor does not prove remote receipt or retention.
-- Run the shipper independently of application readiness. A signed configuration bundle produces
-  a bundle-acceptance audit record before the service starts serving requests. The service reports
-  `503` until the shipper acknowledges that record, then reports ready while the cursor stays at
-  the current tail.
-- Replace the cursor atomically, keep it at or below 16 KiB, and mount it read-only for the Registry
-  process. Keep the cursor path on local storage. Runtime reads use one 500 ms bounded worker and
-  fail readiness when the file is missing, stale, malformed, unsafe, mismatched, or too slow.
-- Treat `registry-relay doctor` and `registry-notary doctor` as offline contract checks. They can
-  validate the cursor timestamp and shape but cannot bind it to a live audit tail, so a fresh
-  cursor remains `unverified`. An `evidence_grade` offline doctor run therefore reports the hard
-  shipping gate until the live service performs tail binding.
+- Relay: keep `audit.write_policy: fail_closed` (the default) unless an explicit availability
+  exception accepts best-effort audit durability under `availability_first`. `fail_closed` means a
+  request whose audit record cannot be written returns `503 audit.write_failed` instead of a
+  success (REQ-SEC-G-009).
+- If you rotate an audit hash secret in any service, retain the old secret under your audit
+  retention controls for any period during which older records must remain comparable to new ones,
+  or accept that new records will not match old audit handles.
+- Hash-chained envelopes detect ordering gaps and accidental corruption inside the retained set,
+  but they do not prove that every historical audit record remains present. Use off-host audit
+  shipping when completeness matters.
+- Relay, for `evidence_grade`: configure `deployment.evidence.audit_ack_cursor_path` for every
+  shipping target, including `stdout` and `syslog`. The off-host shipper writes
+  `registry.audit.ack_cursor.v1` after a successful hand-off, and Relay reports ready only while
+  `acked_at` is fresh and `last_acked_hash` equals the live keyed audit chain tail. A matching
+  cursor means the trusted shipper claims zero local backlog; the local cursor does not prove
+  remote receipt or retention.
+- Relay: replace the cursor atomically, keep it at or below 16 KiB, and mount it read-only for the
+  Relay process. Keep the cursor path on local storage. Runtime reads use one 500 ms bounded
+  worker and fail readiness when the file is missing, stale, malformed, unsafe, mismatched, or too
+  slow.
+- Relay: treat `registry-relay doctor` as an offline contract check. It can validate the cursor
+  timestamp and shape but cannot bind it to a live audit tail, so a fresh cursor remains
+  `unverified` and an `evidence_grade` offline run reports the hard shipping gate until the live
+  service performs tail binding.
 
 ## Transport and edge
 
 - For the 1.0 single-node VM topology, follow
   [Run single-node Compose behind your reverse proxy](../../operate/single-node-compose-behind-proxy/)
-  before exposing Relay or Notary beyond the host.
+  before exposing a service beyond the host.
 - Terminate TLS and manage certificates at your reverse proxy or load balancer; RS-SEC-G Section 9
   leaves transport termination and certificate management to the operator.
-- Keep the admin listener private. A publicly exposed admin surface trips
-  `relay.admin.public_exposure` or `notary.admin.shared_exposure`, both `startup_fail` at
-  `evidence_grade`.
-- Scrape Relay metrics from the private admin network with `registry_relay:metrics_read`. Alert when
-  `registry_relay_ingest_consecutive_refresh_failures` reaches `3`, or sooner when the deployment's
-  freshness service-level objective requires it. Relay deliberately keeps `/ready` at `200` while
-  a valid last-good table remains available. Refresh health shows source load failures; it does not
-  prove that business-domain data is current.
-- Set explicit `cors.allowed_origins`. The default CORS policy is deny by omission; add only the
-  origins your integration actually needs.
-- Enable `server.trust_proxy` with an explicit `trusted_proxies` list only when a reverse proxy
-  sits in front of Relay. Both `enabled` and `trusted_proxies` default to off/empty.
-- Enforce ingress rate limiting at your gateway or edge, then either declare
+- Evidence: bind the listener to loopback, a private IPv4 address, or a unique-local IPv6 address.
+  The runtime schema admits nothing else, fixes `tlsTermination` at
+  `operator-controlled-upstream`, and fixes `trustProxyIdentityHeaders` at `false`. A gateway may
+  add publication, routing, and extra rate controls, but Evidence still validates its own token
+  profile and never accepts a proxy-supplied identity header.
+- Evidence: leave `metricsListener` unset unless you need it. When set, it must bind an address
+  distinct from the evidence listener and subject to the same private-address rule, it serves only
+  `GET /metrics`, and the evidence listener never serves metrics. Reach it from your own network
+  only: per-route request rates are operational information even though no label carries caller
+  content.
+- Evidence: size `rateLimits` knowing they are per process and in memory. Running N replicas
+  multiplies every configured limit by N and a restart resets each budget to full. Set the
+  failed-selector budget deliberately, because it is the selector-enumeration defense rather than
+  a throughput knob, and put per-client quotas in the gateway.
+- Relay: keep the admin listener private. A publicly exposed admin surface trips
+  `relay.admin.public_exposure`, a `startup_fail` gate at `evidence_grade`.
+- Relay: scrape metrics from the private admin network with `registry_relay:metrics_read`. Alert
+  when `registry_relay_ingest_consecutive_refresh_failures` reaches `3`, or sooner when the
+  deployment's freshness service-level objective requires it. Relay deliberately keeps `/ready` at
+  `200` while a valid last-good table remains available. Refresh health shows source load
+  failures; it does not prove that business-domain data is current.
+- Relay: set explicit `cors.allowed_origins`. The default CORS policy is deny by omission; add
+  only the origins your integration actually needs.
+- Relay: enable `server.trust_proxy` with an explicit `trusted_proxies` list only when a reverse
+  proxy sits in front of Relay. Both `enabled` and `trusted_proxies` default to off/empty.
+- Relay: enforce ingress rate limiting at your gateway or edge, then either declare
   `deployment.evidence.ingress_rate_limit: true` or accept the `relay.ingress.rate_limit_missing`
   finding it otherwise raises. The flag defaults to `false`.
-- Keep the generated Notary-to-consultation-Relay HTTP connection on the package-owned private
-  network, publish no consultation port, and retain its exact workload token, audience, client,
-  and scope checks. Terminate public ingress TLS in the operator-owned proxy or platform.
+- When Evidence reads a Relay-protected API as a fixed source, keep that hop on a private network,
+  publish no port for it, and give Evidence its own client credential scoped to exactly the routes
+  the bundle reads. Relay authenticates the Evidence workload, not the caller that asked Evidence,
+  so joining the two audit trails for one request is a procedure you own.
 - Require every project-authored Relay source destination to be an exact HTTPS origin. The project
   validator rejects origins with user information, paths, queries, or fragments.
 - For Postgres sources, require `sslmode=require` on the connection string and use read-only
@@ -132,70 +210,107 @@ or the [Registry Notary operator configuration reference](../../products/registr
   table or view.
 - Apply Registry Platform HTTP-security response headers and outbound HTTP policy to product
   egress. Confirm that Relay source calls remain inside the compiler-pinned destination, method,
-  path, and cumulative budget (REQ-SEC-G-012).
+  path, and cumulative budget (REQ-SEC-G-012), and that every Evidence source keeps hostname and
+  fixed-origin verification on. Evidence ignores `HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY`, and
+  `NO_PROXY` and has no application-level proxy, so an ambient proxy variable will not silently
+  redirect a source call.
+- Registry Mint, when the deployment runs it: put TLS in front of it. Registry Mint serves plain
+  HTTP and expects termination it does not manage, while Evidence requires the token issuer and
+  its key set to be HTTPS with no loopback exception. Keep `accessTokens.lifetimeSeconds` short
+  inside its `60..=3600` bound, because a minted token is accepted until it expires and no service
+  in this stack revokes one.
 
 ## Deployment profile and posture endpoint
 
-- Declare `deployment.profile` explicitly. An omitted profile produces the
-  `deployment.profile_undeclared` startup failure in both Relay and Notary. Neither product
-  infers `local` or another profile from its hostname, listener, or network placement.
-- Treat `evidence_grade` as requiring a signed local config bundle: running it from a plain local
-  YAML file trips `relay.config.unsigned` / `notary.config.unsigned` and the process refuses to
-  start.
-- Review `GET /admin/v1/posture` regularly. It reports the declared profile, active findings, and
-  active waivers, so the deployment's actual state is inspectable rather than asserted. Read
-  [RS-OP-POSTURE](../../spec/rs-op-posture/) before building operational tooling around its
-  default or restricted tier.
-- Give every waiver a validated operator reference and a mandatory expiry date. Add a short
-  summary only when operators need more context, and keep credentials and private keys out of
-  both fields. `startup_fail` and `readiness_fail` gates are never waivable; a waiver naming one
-  is rejected. Waiver references and summaries appear only in the restricted posture tier.
-- Use `deployment.evidence.*` flags (for example `ingress_rate_limit`, `api_key_rotation`) only to
-  assert controls that live outside the process and cannot be observed by it. Each flag defaults to
-  `false`.
-- If Notary runs active-active, declare `multi_instance`, install the typed Notary-owned
-  PostgreSQL state schema, and require every replica to pass `state doctor` and runtime readiness.
-  The process rejects `state.storage: in_memory` outside the local, single-instance profile.
+- Relay: declare `deployment.profile` explicitly. An omitted profile produces the
+  `deployment.profile_undeclared` startup failure. Relay never infers `local` or another profile
+  from its hostname, listener, or network placement.
+- Relay: treat `evidence_grade` as requiring a signed local config bundle. Running it from a plain
+  local YAML file trips `relay.config.unsigned` and the process refuses to start.
+- Relay: review `GET /admin/v1/posture` regularly. It reports the declared profile, active
+  findings, and active waivers, so the deployment's actual state is inspectable rather than
+  asserted. Read [RS-OP-POSTURE](../../spec/rs-op-posture/) before building operational tooling
+  around its default or restricted tier.
+- Relay: give every waiver a validated operator reference and a mandatory expiry date. Add a short
+  summary only when operators need more context, and keep credentials and private keys out of both
+  fields. `startup_fail` and `readiness_fail` gates are never waivable; a waiver naming one is
+  rejected. Waiver references and summaries appear only in the restricted posture tier.
+- Relay: use `deployment.evidence.*` flags (for example `ingress_rate_limit`, `api_key_rotation`)
+  only to assert controls that live outside the process and cannot be observed by it. Each flag
+  defaults to `false`.
+- Evidence has no equivalent declaration and no posture route, by design. Its posture is the exact
+  bytes it loaded: one governed bundle and one closed runtime file, each with its own content
+  digest, mounted read-only, with no reload, merge, mutation, governed-field override, or fallback
+  path. Record the bundle revision you deployed, because that identifier plus the digests is the
+  only description of what the process is enforcing.
+- Evidence serves one operator-controlled trust domain per process. Mutually distrustful issuers
+  or customers, or one issuer whose clients carry the same authority under different claim names,
+  require a second deployment with its own bundle, signer, and audit boundary.
 
 ## Incident response
 
 - Know your private disclosure channel before you need it: see
   [Report a vulnerability](../report-a-vulnerability/).
-- If credential-status is enabled, use the admin status endpoint (requires the
-  `registry_notary:admin` scope) to mark a compromised credential `revoked`. Registry Notary
-  defines no other revocation flow; a credential issued with credential-status disabled cannot be
-  revoked through the API. See [Known limitations and non-guarantees](../../explanation/known-limitations/).
-- Rotate a compromised signing key using the documented rotation procedure (new `kid`, old key to
-  `publish_only`) rather than deleting it outright, so previously issued, still-valid credentials
-  remain verifiable through the rotation.
-- Preserve the audit trail for post-incident review: hash-chained, fail-closed audit records are
-  the record a deployment reconstructs a request timeline from (REQ-SEC-G-008, REQ-SEC-G-009).
+- Rotate a compromised Evidence signing key by deploying a new revision with a new active key,
+  keeping the compromised public key published only as long as stored assertions must still
+  verify, then removing it. Evidence defines no revocation, status list, or presentation-time
+  check, so a released assertion stays verifiable until its declared validity expires. Plan the
+  incident response around short validity windows rather than around recall.
+- Rotate a compromised source credential or Registry Mint client key at the credential's own
+  source and restart the affected process. Neither service reloads secret material in place.
+- Preserve the audit trail for post-incident review. For Evidence, take the whole audit directory
+  including sealed segments and run `evidence verify-audit` over it before and after moving it;
+  for Relay, hash-chained, fail-closed audit records are the record a deployment reconstructs a
+  request timeline from (REQ-SEC-G-008, REQ-SEC-G-009). For Registry Mint, preserve the chain and
+  matching HMAC key, then run `mint verify-audit` before and after moving it.
+- Expect a `403` from Evidence to tell you nothing. Every authorization refusal collapses to one
+  generic `not_authorized` problem, deliberately, so it is not an oracle for which check failed.
+  Debug it from trusted local state in this order: the bearer principal is in the deployed
+  bundle's audience; a grant matches the requested requirement, purpose, and subject roles; the
+  grant carries the claimed authority; and, only for an unsigned or credential-format request,
+  both the bundle and that grant permit that format. The keyed audit chain records the refusal
+  phase.
 
 ## Verify
 
-- Start the service against your production config and confirm it starts (or fails closed as
-  expected for a deliberately unmet `startup_fail` gate).
-- Query `GET /admin/v1/posture` and read the `deployment` object: confirm the profile matches what
-  you declared, and that no unwaived finding at or above your profile's threshold is outstanding.
-  Validate the response as [RS-OP-POSTURE](../../spec/rs-op-posture/) before an automated check
-  acts on it.
-- Send a request that should be audited and confirm a corresponding record lands in your configured
-  sink, not only `stdout`.
-- Attempt an admin-listener request from outside the private network it is meant to be bound to,
-  and confirm it is refused.
+- Start each service against your production configuration and confirm it starts, or fails closed
+  as expected for a deliberately unmet gate.
+- Relay: query `GET /admin/v1/posture` and read the `deployment` object. Confirm the profile
+  matches what you declared, and that no unwaived finding at or above your profile's threshold is
+  outstanding. Validate the response as [RS-OP-POSTURE](../../spec/rs-op-posture/) before an
+  automated check acts on it.
+- Evidence: confirm `GET /ready` succeeds, which rechecks the subject-binding key, the signing
+  provider, the pinned audit sink, and every source credential, including a bounded OAuth token
+  bootstrap where a source uses client credentials. Readiness sends no evidence-data request and
+  probes no source data endpoint, so a passing probe is not proof that a source returns data.
+- Registry Mint: confirm `GET /ready` succeeds with at least one registered client, issue one
+  synthetic token, and run `mint verify-audit` to confirm its token-release record joined the
+  retained chain. A passing readiness probe does not prove off-host receipt or retention.
+- Send a request that should be audited and confirm a corresponding record lands in your
+  configured sink, not only `stdout`.
+- Evidence: request an assertion and verify the stored response offline with
+  `evidence verify --jws <file> --jwks <file> --policy <file>`, using expectations you retained
+  independently rather than values read back out of the response.
+- Attempt an admin-listener request to Relay from outside the private network it is meant to be
+  bound to, and confirm it is refused.
 
 ## Troubleshooting
 
 | Symptom | Cause | Fix |
 | --- | --- | --- |
-| Process refuses to start after declaring `production` or `evidence_grade` | A `startup_fail` gate tripped (for example missing audit sink or unsigned config) | Check the posture or startup log for the finding id, then fix the underlying condition; `startup_fail` gates cannot be waived |
-| Startup reports `deployment.profile_undeclared` | No `deployment.profile` is set | Declare the actual profile explicitly before restarting; an omitted profile is not the same as `local` |
-| Posture reports `deployment.waiver_expired` | A waiver's `expires` date passed | Re-review the finding and either fix it or issue a new waiver with a new expiry |
+| Relay refuses to start after declaring `production` or `evidence_grade` | A `startup_fail` gate tripped, for example a missing audit sink or unsigned config | Check the posture or startup log for the finding id, then fix the underlying condition; `startup_fail` gates cannot be waived |
+| Relay startup reports `deployment.profile_undeclared` | No `deployment.profile` is set | Declare the actual profile explicitly before restarting; an omitted profile is not the same as `local` |
+| Relay posture reports `deployment.waiver_expired` | A waiver's `expires` date passed | Re-review the finding and either fix it or issue a new waiver with a new expiry |
+| Evidence refuses to start on a non-immutable input | The bundle directory, `runtime.yaml`, or a captured artifact is writable by the service process | Re-freeze the project (`chmod -R a-w bundle && chmod 444 runtime.yaml`) and restart |
+| A second Evidence process fails at startup with a sink-locked error | Two processes point at the same `auditStorage.path` | Run one writer per audit path; use active/passive with restart-on-failure rather than a second replica |
+| A second Registry Mint process fails to start, or `mint verify-audit` rejects its chain | Another writer holds `audit.path`, or retained records were changed, reordered, or written with another key | Run one writer per path and restore the matching retained chain and HMAC key; do not delete audit records to make startup pass |
+| Registry Mint returns `500 server_error` and then fails readiness | The process could not durably append a token decision and poisoned its audit writer | Stop traffic, preserve and verify the chain, restore writable durable storage, and restart Mint; the failed request did not receive a token |
+| Evidence returns `403 not_authorized` for a request you expected to work | Any one of the audience, grant, authority, or response-format checks failed; the response never says which | Work through the ordered checks in [Incident response](#incident-response) against local configuration, then read the refusal phase from the audit chain |
 
 ## Next
 
 - [Security overview](../)
+- [Evidence security model](../evidence/)
 - [Report a vulnerability](../report-a-vulnerability/)
-- [Registry Relay configuration reference](../../products/registry-relay/configuration/)
-- [Registry Notary operator configuration reference](../../products/registry-notary/operator-config-reference/)
+- [Configure Evidence](../../configure/evidence/)
 - [Known limitations and non-guarantees](../../explanation/known-limitations/)
diff --git a/docs/site/src/content/docs/security/index.mdx b/docs/site/src/content/docs/security/index.mdx
index ce3bfde67..572cd6405 100644
--- a/docs/site/src/content/docs/security/index.mdx
+++ b/docs/site/src/content/docs/security/index.mdx
@@ -4,10 +4,10 @@ description: "The enforced security model of Registry Stack, the responsibilitie
 status: current
 owner: registry-docs
 source_repos:
+  - registry-stack
   - registry-relay
-  - registry-notary
   - registry-platform
-last_reviewed: "2026-07-27"
+last_reviewed: "2026-08-03"
 doc_type: explanation
 locale: en
 standards_referenced: []
@@ -35,8 +35,8 @@ evidence](openssf-evidence/).
 | Only the public half of a signing key is ever published | Built in |
 | Person-level access is written to an audit log | Built in (fail-closed is yours to switch on) |
 | Three disclosure modes, with `redacted` revealing neither value nor answer | Built in |
-| Selective-disclosure credentials, with `did:jwk` holder binding by default per profile | Built in |
-| Federation limited to peers you configure | Built in |
+| Selective-disclosure SD-JWT VC serialization of an assertion | Built in (a second encoding, not a credential lifecycle) |
+| Token issuers authenticate their clients by asymmetric client assertion | Built in |
 | Hardened HTTP headers and outbound-traffic limits | Recommended, confirm your build applies them |
 | Key custody, retention, isolation, TLS, rate limiting | Your deployment's job |
 | Compliance with any external standard it cites | Not claimed |
@@ -54,7 +54,7 @@ authenticate, authorize, serve, audit.
   before any source is read, and a caller's reach is never widened at request time
   (REQ-SEC-G-005, REQ-SEC-G-006).
 - Serve: the service returns the configured surface: a protected read, a claim result, a
-  selected value, a signed credential, or a denial. Every claim is answered in one of three
+  selected value, a signed assertion, or a denial. Every claim is answered in one of three
   disclosure modes: `value` hands back the computed value, `predicate` returns only a yes/no, and
   `redacted` returns neither the value nor the yes/no; the claim's policy fixes which modes are
   allowed. [Disclosure modes and computed answers](../explanation/disclosure-modes-and-computed-answers/)
@@ -65,29 +65,34 @@ authenticate, authorize, serve, audit.
   audit fail-closed, so a request whose audit record cannot be written does not succeed
   (REQ-SEC-G-009).
 
-Every route that returns a record, evaluates a claim, or issues from a stored evaluation requires
-authentication.
-Operational probes, public verification keys, discovery metadata, docs or OpenAPI when configured,
-OID4VCI bootstrap routes, and credential-status reads may be public because they do not return
-record or claim results on their own.
-Issuers sign with asymmetric keys and publish only the public half, so any verifier can check an
-issued credential without holding a credential of its own (REQ-SEC-G-007).
-
-When Notary issues a credential it is an SD-JWT VC: the signed body carries hashes of each
-disclosable field rather than the values, so the holder reveals only what they choose.
-Holder binding, which cryptographically ties a credential to a key the holder controls, is
-enabled by default with `did:jwk`; an operator can set `holder_binding.mode: none` only for an
-explicit bearer-style credential profile, and `registry-notary doctor` warns on that choice.
-The registry-backed OID4VCI issuance path requires EdDSA `did:jwk` holder proof
-of possession. Subject access authorizes the Relay-backed evaluation; it does
-not supply evidence.
-See [Evidence issuance, end to end](../explanation/evidence-issuance/) for the full credential
-lifecycle.
-
-Delegated evaluation, where one Notary asks a trusted peer to evaluate a claim, is admitted only
-from statically configured peers. The peer's identity, signature, freshness, and purpose are
-verified before any Relay consultation or claim evaluation
-(REQ-SEC-G-010).
+Every route that returns person-level records or an evidence assertion requires authentication.
+Operational probes, public verification keys, issuer metadata, and docs or OpenAPI when configured
+may be public because they carry no person-level data.
+Evidence exempts only its probes, its OpenAPI document, its issuer JWKS, and its issuer metadata
+document; both its assertion route and its evidence-definition discovery route require a verified
+access token (REQ-SEC-G-006).
+Issuers sign with asymmetric keys and publish only the public half, so any verifier can check a
+signed artifact without holding a credential of its own (REQ-SEC-G-007).
+
+Evidence can serialize the same signed assertion as an SD-JWT VC, where the signed body carries
+hashes of each disclosable field rather than the values.
+That is a second encoding of one response, not a credential lifecycle: there is no issuance
+session, holder-binding ceremony, status list, revocation, or presentation verification.
+A request may carry an optional `holderKey`, echoed into the `cnf` claim; Evidence issues no
+key-binding JWT, requires none, and verifies none, so `cnf` is an unverified caller-supplied
+convenience for whatever presentation layer the operator runs elsewhere.
+The subject identifier stays an audience-scoped pseudonym, so the same person requested for a
+different audience yields a different identifier.
+
+Where a deployment has no identity provider, Registry Mint issues the access tokens Evidence
+verifies. Mint authenticates each registered client with an asymmetric client assertion, checked
+only against the keys registered for the client the assertion names, and reads the minted token's
+authority from its own server-side client registry rather than from the assertion. Its token
+endpoint does not distinguish an unknown client, a bad signature, a replayed assertion identifier,
+and an expired assertion, so it cannot be used to probe the client registry (REQ-SEC-G-016).
+
+Delegated evaluation, where one service asks a trusted peer to evaluate a claim, does not exist in
+this stack: no service holds such a surface, and REQ-SEC-G-010 is retired.
 
 ## What's recommended, not enforced
 
@@ -107,7 +112,7 @@ Two behaviors are recommended rather than required, so confirm them rather than
 
 A deployment states the assurance level it claims; the software then enforces gates that match the
 claim.
-Both runtime services accept a `deployment` block with a profile of `local`, `hosted_lab`,
+Registry Relay accepts a `deployment` block with a profile of `local`, `hosted_lab`,
 `production`, or `evidence_grade`.
 Each profile binds a findings catalog at escalating severities: a `production` deployment with no
 durable audit sink refuses to start, and an `evidence_grade` deployment refuses to start from an
@@ -117,8 +122,9 @@ expiry), and the declared profile are reported by the restricted operations post
 the deployment's actual state is inspectable rather than asserted. The default tier omits waiver
 metadata.
 The gate catalogs are documented in the
-[Registry Relay configuration reference](../products/registry-relay/configuration/) and the
-[Registry Notary operator configuration reference](../products/registry-notary/operator-config-reference/).
+[Registry Relay configuration reference](../products/registry-relay/configuration/).
+Evidence states its own operator obligations in its operator contract rather than through this
+posture block.
 
 ## What stays with the operator
 
@@ -136,7 +142,7 @@ Record those responsibilities in the
 Public, checkable evidence, from most to least formal:
 
 - [RS-SEC-G](../spec/rs-sec-g/) is the normative security model; [RS-PR-RELAY](../spec/rs-pr-relay/)
-  and [RS-PR-NOTARY](../spec/rs-pr-notary/) carry its wire-level form per service.
+  and [RS-PR-EVIDENCE](../spec/rs-pr-evidence/) carry its wire-level form per service.
 - [OpenSSF and release trust](openssf-evidence/) records which release-integrity checks are
   verifiable today (signatures, provenance, Scorecard) and which are still incomplete.
 - The [security support window](support-window/) states which release lines receive fixes.
diff --git a/docs/site/src/content/docs/security/self-assessment.mdx b/docs/site/src/content/docs/security/self-assessment.mdx
index 3c3781ed8..702cddb39 100644
--- a/docs/site/src/content/docs/security/self-assessment.mdx
+++ b/docs/site/src/content/docs/security/self-assessment.mdx
@@ -5,7 +5,7 @@ status: current
 owner: registry-docs
 source_repos:
   - registry-stack
-last_reviewed: "2026-06-24"
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced: []
@@ -24,14 +24,14 @@ against that public guide.
 | Repository | [registrystack/registry-stack](https://github.com/registrystack/registry-stack) |
 | Assessment type | Maintainer self-assessment |
 | Review history | No public review ledger yet |
-| Last reviewed | 2026-06-24 |
+| Last reviewed | 2026-08-03 |
 
 ## Overview
 
 Registry Stack helps operators publish governed registry-facing services over
 data they already hold. The two main runtime patterns are protected registry
-APIs through Registry Relay and governed evidence responses through Registry
-Notary.
+APIs through Registry Relay and signed minimum-disclosure assertions through
+Evidence.
 
 The public architecture, boundary model, and product roles are documented in
 [Architecture](../../explanation/architecture/) and
@@ -57,8 +57,8 @@ Software guarantees include:
   governed evidence evaluation.
 - Disclosure controls that can return narrower evidence instead of source
   records.
-- Credential issuance for configured Notary surfaces, including SD-JWT VC
-  issuance where configured.
+- Signed, stateless Evidence assertions, serialized as a flattened JWS or, under
+  Evidence's frozen profile, as an SD-JWT VC response.
 - Hash-chained audit records emitted by runtime services.
 - Release workflow support for an authenticated checksum chain, exact image
   digests, a consolidated SPDX SBOM, image-specific SBOM and Grype evidence,
@@ -120,7 +120,7 @@ Primary public evidence:
 - [RS-SEC-G](../../spec/rs-sec-g/)
 - [Contracts](../../reference/contracts/)
 - [OpenSSF evidence](../openssf-evidence/)
-- [Registry Notary API reference](../../reference/apis/registry-notary/)
+- [Evidence API reference](../../reference/apis/registry-evidence/)
 - [Registry Relay API reference](../../reference/apis/registry-relay/)
 - GitHub Release assets, with signed checksums, consolidated SPDX SBOM,
   security evidence, image lock, release manifest, and candidate attestations
diff --git a/docs/site/src/content/docs/spec/index.mdx b/docs/site/src/content/docs/spec/index.mdx
index 788df6875..5f8d41f7a 100644
--- a/docs/site/src/content/docs/spec/index.mdx
+++ b/docs/site/src/content/docs/spec/index.mdx
@@ -5,10 +5,10 @@ status: draft
 owner: registry-docs
 source_repos:
   - registry-relay
-  - registry-notary
+  - registry-evidence
   - registry-platform
   - registry-manifest
-last_reviewed: "2026-07-07"
+last_reviewed: "2026-08-03"
 doc_type: reference
 locale: en
 standards_referenced: []
diff --git a/docs/site/src/content/docs/spec/rs-arc-g.mdx b/docs/site/src/content/docs/spec/rs-arc-g.mdx
index c6dfb8d52..df7b3cc86 100644
--- a/docs/site/src/content/docs/spec/rs-arc-g.mdx
+++ b/docs/site/src/content/docs/spec/rs-arc-g.mdx
@@ -7,9 +7,10 @@ source_repos:
   - registry-manifest
   - registry-platform
   - registry-relay
-  - registry-notary
+  - registry-evidence
+  - registry-mint
   - solmara-lab
-last_reviewed: "2026-07-07"
+last_reviewed: "2026-08-03"
 doc_type: specification
 doc_id: RS-ARC-G
 category: normative
@@ -29,8 +30,6 @@ standards_referenced:
   - skos
   - cccev
   - sd-jwt-vc
-  - oid4vci
-  - w3c-did
   - odrl
   - sdmx
   - sp-dci
@@ -55,17 +54,18 @@ For a narrative explanation with worked examples, see the [architecture overview
 | 0.3.0 | 2026-06-20 | draft | Clarified governed runtime PDP enforcement for the supported Evidence Gateway profile while preserving the descriptive metadata boundary. |
 | 0.3.1 | 2026-06-22 | draft | Clarified static-peer delegated evaluation as distinct from delegated subject access. |
 | 0.4.0 | 2026-07-07 | draft | Clarified REQ-ARC-G-009's replay storage scope: shared within a deployment's own replicas, never across a federation trust boundary. Reframed Registry Lab as a non-normative demonstration topology. |
-| 0.4.1 | 2026-07-07 | draft | Stated plainly in REQ-ARC-G-009 that the per-peer replay storage isolation is deployment topology and that Registry Notary enforces no runtime gate for it. |
+| 0.4.1 | 2026-07-07 | draft | Stated plainly in REQ-ARC-G-009 that the per-peer replay storage isolation is deployment topology and that Registry Notary enforces no runtime gate for it. REQ-ARC-G-009 is retired as of 0.6.0. |
 | 0.5.0 | 2026-07-16 | draft | Defined four formal Registry Stack products and moved the non-normative demo boundary to the separate Solmara Lab adopter project. |
+| 0.6.0 | 2026-08-03 | draft | Registry Notary is retired. Removed its component section, its federation flow step, and REQ-ARC-G-008, REQ-ARC-G-009, REQ-ARC-G-012, and REQ-ARC-G-013. Restated REQ-ARC-G-007 with Evidence as the owner of requirement evaluation. Added Evidence and Registry Mint as components and added REQ-ARC-G-014, REQ-ARC-G-015, and REQ-ARC-G-016. |
 
 ## 1. Scope and audience
 
 This specification covers:
 
 - The two-layer design principle that governs the separation between portable metadata and runtime services.
-- The four formal products that make up the registry stack, their responsibilities, and their boundaries.
+- The four formal products that make up the registry stack, the supporting service beside them, their responsibilities, and their boundaries.
 - The boundary between the formal products and the separate Solmara Lab adopter demo.
-- The ordered data and contract flow from metadata authoring through claim evaluation.
+- The ordered data and contract flow from metadata authoring through assertion delivery.
 - The binding invariants that hold across all conforming deployments.
 
 This document does not define API surfaces, wire formats, or configuration schemas. Those belong to the RS-PR-* and RS-DM-* series. It does not define the security model; that belongs to the RS-SEC-* series.
@@ -78,12 +78,12 @@ The registry stack separates its concerns into two layers.
 
 The **portable metadata layer** is responsible for describing what a registry exposes. It operates entirely without touching production data sources. The layer produces static, standards-shaped artifacts (catalogs, schemas, policy documents, evidence offerings, OGC Records item collections, and embedded codelist metadata) that can be hosted, distributed, and inspected offline. A governance team, an integrator, or an auditor can validate the full description of a registry before any runtime service is deployed or connected.
 
-The **runtime services layer** is responsible for enforcing what the registry description promises. It binds the portable metadata artifacts to actual data sources, enforces access control, evaluates claims against live data, and issues credentials. The runtime layer starts from the portable artifacts; it does not define the schema or policy contracts itself.
+The **runtime services layer** is responsible for enforcing what the registry description promises. It binds the portable metadata artifacts to actual data sources, enforces access control, evaluates predefined requirements against live data, and returns signed minimum-disclosure assertions. The runtime layer starts from the portable artifacts; it does not define the schema or policy contracts itself.
 
-This split separates two distinct obligations: the obligation to describe (what a registry declares it can expose and under what policy) from the obligation to enforce (what a running service will actually return to an authorized caller). The separation enables offline audit of metadata, offline validation of schemas and claim shapes, and governance updates to policy documents without touching deployment configuration.
+This split separates two distinct obligations: the obligation to describe (what a registry declares it can expose and under what policy) from the obligation to enforce (what a running service will actually return to an authorized caller). The separation enables offline audit of metadata, offline validation of schemas and assertion shapes, and governance updates to policy documents without touching deployment configuration.
 
 The diagram in this section shows the four formal products, their relationship to the two layers,
-and the separate adopter demo.
+the supporting token service, and the separate adopter demo.
 
 ```mermaid
 flowchart TD
@@ -93,11 +93,12 @@ flowchart TD
 
     subgraph runtime["Runtime services layer"]
         relay["Registry Relay<br/>(registry-relay)<br/>Binds manifest artifacts to data sources;<br/>enforces read-only access control<br/>and governed PDP policy"]
-        notary["Registry Notary<br/>(registry-notary)<br/>Evaluates claims; issues SD-JWT VC credentials;<br/>handles static-peer delegated evaluation"]
+        evidence["Evidence<br/>(registry-evidence)<br/>Evaluates one predefined requirement;<br/>returns one signed minimum-disclosure assertion"]
     end
 
-    subgraph support["Supporting component"]
+    subgraph support["Supporting components"]
         platform["Registry Platform<br/>(registry-platform)<br/>Shared Rust primitives: auth, OIDC,<br/>audit, crypto, SD-JWT VC helpers"]
+        mint["Registry Mint<br/>(registry-mint)<br/>Issues short-lived access tokens where<br/>a deployment has no identity provider"]
     end
 
     subgraph adopter["External adopter demo"]
@@ -106,18 +107,21 @@ flowchart TD
 
     manifest -- "static discovery bundle" --> relay
     platform -- "shared primitives" --> relay
-    platform -- "shared primitives" --> notary
-    relay -- "compiler-pinned consultation" --> notary
+    platform -- "shared primitives" --> evidence
+    platform -- "shared primitives" --> mint
+    mint -- "access token verified by" --> evidence
     relay -. "published image" .-> solmara
-    notary -. "published image" .-> solmara
+    evidence -. "published image" .-> solmara
 ```
 
-The diagram captures four formal products and one external adopter demo. This section restates the
+The diagram captures four formal products, one supporting token service, and one external adopter
+demo. This section restates the
 essential relationships as text: Registry Manifest produces a static discovery bundle consumed by
 Registry Relay, static publishers, and clients that inspect the metadata offline. Registry Platform
-supplies shared primitives to both runtime services. Registry Relay owns registry source access and
-product-neutral adaptation. Registry Notary consumes compiler-pinned Relay consultations for
-every configured claim. Solmara Lab
+supplies shared primitives to the runtime services. Registry Relay owns registry source access and
+product-neutral adaptation. Evidence answers one bounded question about one subject from its own
+configured sources. Registry Mint issues the access tokens a resource server such as Evidence
+verifies, and that dependency runs one way only. Solmara Lab
 consumes published stack images in runnable local and hosted demo topologies, but it is not a formal
 Registry Stack product.
 
@@ -125,7 +129,7 @@ Registry Stack product.
 
 ### Registry Platform
 
-Registry Platform (`registry-platform`) is a shared Rust crate workspace that provides security and operational primitives consumed by both runtime services. Its scope includes authentication helpers, OpenID Connect (OIDC) verification, audit envelopes, HTTP security, outbound HTTP policy, cryptography, Selective Disclosure JWT Verifiable Credential (SD-JWT VC) helpers, and test fixtures. Registry Platform does not run a service and does not define product routing or policy. A primitive lives in Registry Platform only when it must behave identically across multiple runtime services.
+Registry Platform (`registry-platform`) is a shared Rust crate workspace that provides security and operational primitives consumed by the runtime services. Its scope includes authentication helpers, OpenID Connect (OIDC) verification, audit envelopes, HTTP security, outbound HTTP policy, cryptography, Selective Disclosure JWT Verifiable Credential (SD-JWT VC) helpers, and test fixtures. Registry Platform does not run a service and does not define product routing or policy. A primitive lives in Registry Platform only when it must behave identically across multiple runtime services.
 
 ### Registry Manifest
 
@@ -135,26 +139,37 @@ Registry Manifest (`registry-manifest`) is a pure Rust library and command-line
 
 Registry Relay (`registry-relay`) is a config-driven Rust service that turns sensitive government tabular files and database tables into protected, read-only, domain-oriented consultation APIs. At startup it reads runtime configuration that binds the manifest's logical datasets and entities to actual data sources (CSV, XLSX, Parquet, PostgreSQL). It exposes entity routes, metadata routes, evidence-offering endpoints, and (behind feature flags) OGC API Records, OGC API Features, OGC API EDR, SP DCI, and SDMX-JSON aggregate surfaces.
 
-Registry Relay is not an open-data portal; it serves restricted consultation APIs for authorized systems only. Source-registry data mutation is out of scope for v1. On governed runtime routes, Relay can enforce the supported Evidence Gateway PDP profile (`registry-evidence-gateway-pdp/v1`) for access, freshness, and redaction decisions using runtime configuration, compiled policy metadata, and trusted per-request context. This is runtime policy enforcement for the configured gateway surface; it is not claim evaluation, credential issuance, full Evidence Gateway interoperability, or full OID4VCI behavior. Registry Relay does not own the manifest schema, claim evaluation, credential issuance, or the shared primitives supplied by Registry Platform.
+Registry Relay is not an open-data portal; it serves restricted consultation APIs for authorized systems only. Source-registry data mutation is out of scope for v1. On governed runtime routes, Relay can enforce the supported Evidence Gateway PDP profile (`registry-evidence-gateway-pdp/v1`) for access, freshness, and redaction decisions using runtime configuration, compiled policy metadata, and trusted per-request context. That profile identifier names Relay's own configured policy surface; it is not the Evidence service described in the next section, and Evidence neither publishes nor consumes it. This is runtime policy enforcement for the configured gateway surface; it is not requirement evaluation, assertion signing, full Evidence Gateway interoperability, or full OID4VCI behavior. Registry Relay does not own the manifest schema, requirement evaluation, assertion signing, or the shared primitives supplied by Registry Platform.
 
-### Registry Notary
+### Evidence
 
-Registry Notary (`registry-notary`) is a standalone Rust service for claim evaluation, disclosure policy, credential issuance, and audit. Every configured claim consumes exactly one compiler-pinned Relay consultation whose profile, contract hash, purpose, and typed inputs are fixed before Relay source work. A Notary deployment may start without claims, but cannot evaluate evidence without its project's Relay. One Notary authority pairs with one Relay authority, and Notary owns its PostgreSQL correctness state. Notary does not own registry source origins, credentials, protocol adaptation, or snapshots. Registry Notary returns evaluation results as `application/vnd.registry-notary.claim-result+json` or CCCEV-shaped JSON-LD (`application/ld+json; profile="cccev"`). It materializes SD-JWT VC credentials (`application/dc+sd-jwt`) only from stored evaluations with exact claim pins and unique Relay execution records for every selected root's registry-backed dependency closure and the configured direct or representative authorization ceremony. Its profiled OID4VCI surface uses issuer-initiated pre-authorized code, EdDSA `did:jwk` holder proof, and EdDSA or ES256 issuer signing. It supports static-peer delegated evaluation through `POST /federation/v1/evaluations`. Static-peer delegated evaluation is separate from delegated subject access, the local citizen/OIDC authorization mode defined in [RS-PR-NOTARY](../rs-pr-notary/). Registry Notary does not produce DCAT, BRegDCAT-AP, SHACL, or OGC Records artifacts. The current federation implementation is static-peer only; dynamic trust-chain discovery, replay storage shared across federation peers, and federated credential issuance are not part of this version. Each federation peer maintains its own replay scope; a peer does not share replay storage with the peers it federates with.
+Evidence (`registry-evidence`) is a single-crate Rust service and the `evidence` binary. It answers one bounded question about one subject with one signed assertion that carries the answer and not the record. It loads one reviewed governed bundle and one closed operator runtime file at startup, treats both as immutable for the process lifetime, and holds no application database: it persists no selector, no source payload, no evidence value, and no response body. It authenticates callers with strict OIDC bearer tokens against exactly one trusted issuer, matches exactly one authority path per request, calls the fixed bounded HTTP JSON sources its bundle declares, and releases the assertion as a flattened JWS JSON document by default. Where the bundle and the matched grant both enable it, the same assertion can also be serialized as an SD-JWT VC (`application/dc+sd-jwt`) or as a visibly unsigned envelope for local diagnosis.
+
+Evidence Version 1 has no credential issuance lifecycle, no OID4VCI surface, no holder binding, no status list or revocation, no delegated or federated evaluation between peers, no policy decision point, no replay subsystem, and no worker or document subsystem. It does not depend on Registry Relay, does not consult it, and does not read the metadata manifest.
+
+### Registry Mint
+
+Registry Mint (`registry-mint`) is a supporting service rather than a fourth runtime pattern: it is a minimal OAuth 2.0 token issuer and the `mint` binary, for deployments that have no identity provider of their own. A registered client authenticates with an RFC 7523 `private_key_jwt` client assertion, which is verified only against the keys registered for the client the assertion names. The authority claims carried by the minted access token are read from the server-side client registry and never from the assertion. Issuer identity, signing keys, listener, and token policy are startup-only and immutable for the process lifetime; the client registry is reloadable, so onboarding, offboarding, and client key rotation do not require restarting a resource server. Registry Mint evaluates no requirement, reads no registry source, and issues no assertion.
+
+The dependency runs one way. A resource server such as Evidence verifies a Mint-issued token as an ordinary OIDC access token, and Evidence carries no dependency on Registry Mint. In the workspace, `registry-mint` takes `registry-evidence` as a development dependency so that Mint's tests drive the Evidence authenticator against real tokens.
 
 ### Solmara Lab
 
 Solmara Lab (`solmara-lab`) is a separately maintained adopter demo for the fictional Republic of
-Solmara. It runs published Registry Relay and Registry Notary images, Postgres, eSignet, static
-metadata, generated synthetic data, and demo clients in local and hosted topologies. It illustrates
+Solmara. It runs published stack images together with static metadata, generated synthetic data,
+and demo clients in local and hosted topologies. It illustrates
 how the formal products connect at runtime, but it is not a specified component and carries no
 conformance weight against this specification. Solmara Lab does not own any normative API or
 metadata contract and does not provide production deployment guidance.
+{/* TODO[evidence]: the exact Solmara Lab topology (which images and supporting services it runs)
+cannot be anchored from this repository; it is maintained in the separate registrystack/solmara-lab
+project. Restore the specific enumeration once that repository's current topology is citable. */}
 
 ## 4. Data and contract flow
 
-The following ordered flow describes how a request moves through the stack from metadata authoring to credential delivery.
+The following ordered flow describes how a request moves through the stack from metadata authoring to assertion delivery.
 
-1. **Shared primitives.** Registry Platform provides reusable security and operational primitives (authentication, OIDC verification, audit envelopes, HTTP security, outbound HTTP policy, cryptography, SD-JWT VC helpers) consumed by both runtime services.
+1. **Shared primitives.** Registry Platform provides reusable security and operational primitives (authentication, OIDC verification, audit envelopes, HTTP security, outbound HTTP policy, cryptography, SD-JWT VC helpers) consumed by the runtime services.
 
 2. **Manifest authoring.** An operator authors a portable `metadata.yaml` document (schema `registry-manifest/v1`) describing a registry through its catalog and defined collections. The [Registry Manifest reference](../../products/registry-manifest/reference/) is authoritative for the current top-level keys and field schemas. The manifest does not contain runtime bindings.
 
@@ -162,9 +177,9 @@ The following ordered flow describes how a request moves through the stack from
 
 4. **Runtime binding and access control.** Registry Relay starts with runtime configuration that binds the manifest's logical datasets and entities to actual data sources. Clients reach entity routes, metadata routes, and evidence-offering endpoints through configured authentication. Relay records a `Data-Purpose` header in audit envelopes where present. On governed runtime routes, Relay evaluates the supported Evidence Gateway PDP profile before disclosure and applies redaction when the decision permits only a minimized response.
 
-5. **Claim evaluation.** Registry Notary evaluates claims from compiler-pinned Relay consultation outputs. Caller identity and authorization details may authorize or parameterize a consultation, but do not become evidence. Notary applies disclosure policy (value, predicate, or redacted) and returns evaluation results as claim-result JSON or CCCEV-shaped JSON-LD. It can materialize only stored evaluations with exact dependency-closure claim pins and normalized unique Relay execution records into SD-JWT VC credentials.
+5. **Access-token issuance.** Where a deployment has no identity provider of its own, Registry Mint issues the short-lived access token the caller presents. A registered client authenticates with a `private_key_jwt` client assertion, and Mint reads the token's authority claims from its server-side client registry. A deployment that already runs an identity provider skips this step entirely.
 
-6. **Static-peer delegated evaluation.** A trusted Registry Notary instance can call another trusted Registry Notary instance through `POST /federation/v1/evaluations` for signed delegated evaluation. Registry Manifest can publish discovery metadata for that relationship, but local Notary peer policy grants access. Peer lists are loaded from configuration at startup. This federation path is distinct from delegated subject access in the Notary citizen/OIDC flow.
+6. **Assertion.** Evidence authenticates the caller's access token against its one trusted issuer, matches exactly one authority path, evaluates one predefined requirement over its own fixed bounded sources, and returns one signed minimum-disclosure assertion. Caller identity and authorization details may authorize or parameterize the request, but do not become evidence. The response carries the answer the requirement defines, not the source record behind it.
 
 ## 5. Architectural invariants
 
@@ -176,40 +191,43 @@ REQ-ARC-G-002: A metadata manifest (schema `registry-manifest/v1`) MUST NOT incl
 
 REQ-ARC-G-003: In v1, runtime services MUST NOT expose source-registry data mutation routes. Consultation APIs are read-only.
 
-REQ-ARC-G-004: Every request that touches person-level data MUST be audited. Registry Platform provides the audit envelope primitives, verified to exist in the shared crate; Registry Relay and Registry Notary MUST compose those primitives on routes that return person-level records or claim results. This requirement states an invariant a conforming deployment meets; it is not a claim that every route in a given build has been individually audited.
+REQ-ARC-G-004: Every request that touches person-level data MUST be audited. Registry Platform provides the audit envelope primitives, verified to exist in the shared crate; Registry Relay and Evidence MUST compose those primitives on routes that return person-level records or evidence assertions. This requirement states an invariant a conforming deployment meets; it is not a claim that every route in a given build has been individually audited.
 
-REQ-ARC-G-005: A primitive that must behave identically across runtime services (authentication, OIDC, audit, HTTP security, outbound HTTP policy, cryptography, SD-JWT VC helpers) SHOULD be sourced from Registry Platform rather than reimplemented in Registry Relay or Registry Notary. This keeps cross-service security behavior consistent and auditable in one place.
+REQ-ARC-G-005: A primitive that must behave identically across runtime services (authentication, OIDC, audit, HTTP security, outbound HTTP policy, cryptography, SD-JWT VC helpers) SHOULD be sourced from Registry Platform rather than reimplemented in Registry Relay, Evidence, or Registry Mint. This keeps cross-service security behavior consistent and auditable in one place.
 
 REQ-ARC-G-006: Registry Relay MUST own the runtime binding between manifest logical concepts and data sources. The manifest schema and its renderers are owned by Registry Manifest; Registry Relay MUST NOT define or version the manifest format.
 
-REQ-ARC-G-007: Registry Notary MUST own claim evaluation, disclosure policy, and credential issuance. Registry Relay MUST NOT perform claim evaluation or issue credentials. This boundary does not prohibit Registry Relay from enforcing runtime access, freshness, and redaction policy for its own governed consultation routes.
+REQ-ARC-G-007: Evidence MUST own requirement evaluation, disclosure shape, and assertion signing. Registry Relay MUST NOT evaluate a requirement or sign an evidence assertion. This boundary does not prohibit Registry Relay from enforcing runtime access, freshness, and redaction policy for its own governed consultation routes.
 
-REQ-ARC-G-008: Registry Notary credentials MUST use SD-JWT VC format (`application/dc+sd-jwt`). No W3C Verifiable Credentials Data Model JSON-LD envelope or namespace is present in the issued credential.
+REQ-ARC-G-010: The portable metadata layer describes; it does not authorize and it does not assert facts about live data. Publishing a dataset, schema, policy, evidence offering, ecosystem binding, or federation relationship in a discovery artifact MUST NOT be construed as granting access to it, as enforcing it, or as asserting that any particular record exists or satisfies it. Access control, governed PDP enforcement, and the existence or value of a record are determined only by an authorized runtime read under runtime configuration and trusted request or source context. A published ODRL policy is descriptive until a runtime service explicitly binds it into an enforced, supported profile. A conformance claim against a metadata artifact MUST NOT imply a runtime guarantee that the runtime layer has not made.
 
-REQ-ARC-G-012: Registry Notary MUST issue credentials only from evaluations that retain exact compiler pins for every registry-backed claim in each selected root's dependency closure and one normalized execution record per unique Relay consultation ULID. Each pin MUST be deterministically cross-bound to its execution and claim provenance and checked before signing. Private Relay execution provenance MUST be retained only for credential-capable selections. Delegated evaluations without the configured representative ceremony and registry-backed evaluation-only selections MUST remain nonissuable without retaining those private execution identifiers.
+REQ-ARC-G-011: Where Registry Relay exposes governed runtime routes, it MUST enforce only the supported Evidence Gateway PDP profile (`registry-evidence-gateway-pdp/v1`) as implemented by the runtime stack. A conformance claim against this specification MUST NOT imply full Evidence Gateway interoperability, full OID4VCI issuer behavior, dynamic external policy discovery, or enforcement of ODRL terms outside the supported profile.
 
-REQ-ARC-G-013: One Registry Notary authority MUST pair with one Registry Relay authority. Registry Notary MUST own its transaction, replay, evaluation, audit, and credential-status correctness state. Production and multi-instance deployments MUST use the Notary-owned PostgreSQL schema; explicit in-memory state is local and single-instance only.
+REQ-ARC-G-014: Evidence MUST return only the answer its predefined requirement defines, never the source record behind that answer. The response MUST be constructed by the service core after the complete declared concept set has been produced and validated; configured bundle logic MUST NOT construct a response envelope, a subject identifier, or any claim outside that declared set.
 
-REQ-ARC-G-009: Registry Notary's federation implementation is static-peer delegated evaluation. Peer lists are loaded from configuration at startup. Within a single deployment, replay storage MAY be shared across that deployment's own replicas through the typed Notary-owned PostgreSQL state schema; that sharing does not extend across a federation trust boundary. Each federation peer MUST maintain its own replay scope and MUST NOT share replay storage with the peers it federates with; that isolation is deployment topology, and Registry Notary enforces no runtime gate that prevents two peers from sharing a replay storage backend. Dynamic trust-chain discovery, replay storage shared across federation peers, audit checkpoint exchange, and federated credential issuance are not part of this version and MUST NOT be implied by conformance claims against this specification.
+REQ-ARC-G-015: A signed Evidence response MUST be a flattened JWS JSON document over the exact evidence payload, and a signing failure MUST fail closed rather than release unsigned output. Where a deployment enables the SD-JWT VC serialization (`application/dc+sd-jwt`), that serialization MUST project the identical payload and MUST NOT be read as a credential lifecycle: Evidence Version 1 defines no issuance session, no holder-binding ceremony, no status list, no revocation, and no presentation verification.
 
-REQ-ARC-G-010: The portable metadata layer describes; it does not authorize and it does not assert facts about live data. Publishing a dataset, schema, policy, evidence offering, ecosystem binding, or federation relationship in a discovery artifact MUST NOT be construed as granting access to it, as enforcing it, or as asserting that any particular record exists or satisfies it. Access control, governed PDP enforcement, and the existence or value of a record are determined only by an authorized runtime read under runtime configuration and trusted request or source context. A published ODRL policy is descriptive until a runtime service explicitly binds it into an enforced, supported profile. A conformance claim against a metadata artifact MUST NOT imply a runtime guarantee that the runtime layer has not made.
+REQ-ARC-G-016: The dependency between Registry Mint and a resource server MUST run one way. Registry Mint issues an access token that a resource server such as Evidence verifies as an ordinary OIDC access token; Evidence MUST NOT depend on Registry Mint, and a deployment that already operates an identity provider MUST be able to run Evidence without Registry Mint.
 
-REQ-ARC-G-011: Where Registry Relay exposes governed runtime routes, it MUST enforce only the supported Evidence Gateway PDP profile (`registry-evidence-gateway-pdp/v1`) as implemented by the runtime stack. A conformance claim against this specification MUST NOT imply full Evidence Gateway interoperability, full OID4VCI issuer behavior, dynamic external policy discovery, or enforcement of ODRL terms outside the supported profile.
+REQ-ARC-G-008, REQ-ARC-G-009, REQ-ARC-G-012, and REQ-ARC-G-013 are retired. Each constrained the retired `registry-notary` component's credential format, federation topology, issuance provenance, or state ownership, so no component in this stack implements them. Per RS-DOC REQ-DOC-008 the identifiers are not reused and are not reassigned to the requirements added in this version.
 
 ## 6. Capability sequence
 
-The two-layer design supports one natural capability sequence: describe what the registry can provide, then expose protected access, then certify evidence.
+The two-layer design supports one natural capability sequence: describe what the registry can provide, then expose protected access, then assert a single fact.
 
 **Describe.** Registry Manifest compiles the manifest and renders a standards-shaped discovery bundle. Other teams can inspect fields, schemas, policies, services, and evidence offerings before any integration is built.
 
 **Expose.** Registry Relay binds the manifest artifacts to actual data sources and exposes protected, read-only consultation APIs. A file, an extract, a database, or a legacy registry gains a governed API without replacing the source.
 
-**Certify.** Registry Notary evaluates configured evidence rules, applies disclosure policy, and issues a credential that a caller can present to a verifier. The credential is narrower than the source record when the configured use case supports selective disclosure.
+**Assert.** Evidence evaluates one predefined requirement over its own configured sources and returns
+one signed assertion a caller can present to a verifier. The assertion is narrower than the source
+record by construction: it carries the answer the requirement defines and nothing else.
 
-The sequence is ordered because metadata must be available before a runtime service can be safely deployed: a caller cannot validate schemas, review claim shapes, or inspect evidence offerings against an opaque service. The portable metadata bundle is the contract; the runtime services enforce it.
+The sequence is ordered because metadata must be available before a runtime service can be safely deployed: a caller cannot validate schemas, review response shapes, or inspect evidence offerings against an opaque service. The portable metadata bundle is the contract; the runtime services enforce it.
 
-Registry Platform supports both runtime services with the shared primitives that make each stage
-auditable. The external Solmara Lab adopter demo exercises the full sequence using published stack
+Registry Platform supports the runtime services with the shared primitives that make each stage
+auditable, and Registry Mint supplies access tokens where a deployment has no identity provider. The
+external Solmara Lab adopter demo exercises the full sequence using published stack
 images.
 
 ## Conformance
@@ -222,11 +240,12 @@ An implementation conforms to this specification when it respects the following
 - REQ-ARC-G-004: every request touching person-level data produces an audit record.
 - REQ-ARC-G-005: shared security primitives that must behave identically across services are sourced from Registry Platform (recommended).
 - REQ-ARC-G-006: Registry Relay owns runtime binding; the manifest format is owned by Registry Manifest.
-- REQ-ARC-G-007: claim evaluation and credential issuance are owned by Registry Notary.
-- REQ-ARC-G-008: issued credentials use SD-JWT VC format (`application/dc+sd-jwt`).
-- REQ-ARC-G-009: federation is static-peer delegated evaluation; no dynamic discovery is implied.
+- REQ-ARC-G-007: requirement evaluation and assertion signing are owned by Evidence.
 - REQ-ARC-G-010: discovery artifacts are treated as description, not as authorization, enforcement, or proof that a record exists.
 - REQ-ARC-G-011: governed Relay runtime routes enforce only the supported Evidence Gateway PDP profile and do not imply broader interoperability.
+- REQ-ARC-G-014: an Evidence response carries the defined answer and not the source record behind it.
+- REQ-ARC-G-015: a signed response is a flattened JWS JSON document, signing failure fails closed, and the SD-JWT VC serialization projects the same payload without adding a credential lifecycle.
+- REQ-ARC-G-016: the Registry Mint dependency runs one way, and Evidence runs without Registry Mint where an identity provider already exists.
 
 Conformance to this specification does not imply conformance to any external standard cited in the `standards_referenced` frontmatter field. Each standard's adoption mode and scope are documented in the [standards register](../../reference/standards/).
 
@@ -236,7 +255,8 @@ This specification is `verified`: it is distilled from published artifacts a rea
 
 - The [boundary map](../../map/boundaries-and-map/) records each component's boundaries with their source citations. It is the primary distillation source for the components (Section 3) and the invariants (Section 5).
 - The [architecture overview](../../explanation/architecture/) gives the narrative data and contract flow that Section 4 makes precise.
-- The [Registry Relay](../../reference/apis/registry-relay/) and [Registry Notary](../../reference/apis/registry-notary/) API references show the runtime surfaces named in Section 3.
+- The [Registry Relay](../../reference/apis/registry-relay/) and [Evidence](../../reference/apis/registry-evidence/) API references show the runtime surfaces named in Section 3.
+- The [Registry Mint reference](../../reference/mint/) records the token issuer described in Section 3.
 - The [standards register](../../reference/standards/) records the adoption mode for each standard listed in `standards_referenced`.
 
 ## Next
@@ -244,4 +264,4 @@ This specification is `verified`: it is distilled from published artifacts a rea
 - [RS-DOC](../rs-doc/) defines the documentation framework this specification conforms to.
 - [RS-TERMS](../rs-terms/) defines the shared vocabulary the other specifications use.
 - [Architecture overview](../../explanation/architecture/) is the narrative explanation with a worked data flow and capability table.
-- [Evidence issuance](../../explanation/evidence-issuance/) explains claim evaluation, disclosure policy, delegated evaluation, and credential issuance in Registry Notary.
+- [RS-PR-EVIDENCE](../rs-pr-evidence/) defines the protocol surface of the Evidence service this architecture places.
diff --git a/docs/site/src/content/docs/spec/rs-dm-claim.mdx b/docs/site/src/content/docs/spec/rs-dm-claim.mdx
deleted file mode 100644
index d4c47055f..000000000
--- a/docs/site/src/content/docs/spec/rs-dm-claim.mdx
+++ /dev/null
@@ -1,198 +0,0 @@
----
-title: "RS-DM-CLAIM: Registry Notary claim definition data model"
-description: "The data model for a Registry Notary claim definition: identity, evidence mode, typed inputs, Relay consultations, rule, disclosure, formats, and credential eligibility."
-status: draft
-owner: registry-docs
-source_repos:
-  - registry-notary
-  - registry-platform
-last_reviewed: "2026-07-17"
-doc_type: specification
-doc_id: RS-DM-CLAIM
-category: normative
-evidence: partial
-locale: en
-standards_referenced:
-  - openapi
-  - sd-jwt-vc
-  - w3c-did
-layer:
-  - evaluation
-  - credential
-audience:
-  - integrator
-  - specification editor
----
-
-This document defines the target data model of a Registry Notary claim definition: the configuration artifact that declares what Relay-backed evidence Notary can evaluate, what typed inputs and Relay consultations it may use, what it discloses, and what it can issue. It is the structural counterpart to the [Registry Notary protocol](../rs-pr-notary/).
-
-Where this document and [RS-PR-NOTARY](../rs-pr-notary/) state the same constraint, RS-PR-NOTARY is the protocol-level (wire) form and this document is the data-model form. Both refine the Registry Notary component of [RS-ARC-G](../rs-arc-g/) Section 3 (REQ-ARC-G-007) one level of detail down, from architectural boundary to the structure a claim takes in configuration. Security-model concerns (the scope and authentication machinery a claim relies on) belong to [RS-SEC-G](../rs-sec-g/); this document refers to them only where they shape the model.
-
-The key words in this document are interpreted per [RS-DOC](../rs-doc/) Section 2. Defined terms are used per [RS-TERMS](../rs-terms/).
-
-## Version history
-
-| Version | Date | Status | Change |
-| --- | --- | --- | --- |
-| 0.1.0 | 2026-06-13 | draft | Initial claim-definition data model, distilled from the Registry Notary source-and-claim modeling guide, the operator configuration reference, and the two-way credential-eligibility and matching-policy validations the configuration loader enforces. |
-| 0.2.0 | 2026-07-07 | draft | Reworded REQ-DM-CLAIM-005 so the controlled-environment restriction on disabling matching-failure collapse reads as operational guidance rather than a runtime-enforced constraint, and documented the extract/exists value-type-checking gap and the empty-`formats`-list evaluation gap in Limitations. |
-| 0.3.0 | 2026-07-13 | draft | Replaced direct source bindings and Notary matching with compiler-pinned Relay consultations. |
-| 0.3.1 | 2026-07-14 | draft | Updated load-time validation limits after duplicate ids, disclosure defaults, evidence-mode rules, and registry-backed output types became startup checks. |
-| 0.3.2 | 2026-07-14 | draft | Aligned credential eligibility with Registry Stack project authoring: profiles declare claims once, and the compiler derives the product-level reverse index. |
-| 0.3.3 | 2026-07-17 | draft | Made omitted claim `formats` default to the canonical claim-result JSON representation and made an explicitly empty list a configuration-load error. |
-| 0.3.4 | 2026-07-17 | draft | Made the evaluation response-format set closed: the canonical claim-result JSON format is required, CCCEV-shaped JSON-LD is the only additional renderer, and credential issuance formats are rejected. |
-| 0.4.0 | 2026-07-17 | draft | Restricted credential membership to mutually bound registry-backed claims. |
-| 0.5.0 | 2026-07-30 | draft | Removed claim evaluation without a declared Relay consultation. |
-
-## 1. Scope and references
-
-This specification covers the structure and invariants of a claim definition:
-
-- The claim's identity and the value it evaluates.
-- Inputs: the request lookup paths a claim consumes.
-- Evidence mode and compiler-pinned Relay consultation bindings for registry-backed claims.
-- The rule and its dependencies.
-- The disclosure policy.
-- Response formats and value typing.
-- Credential eligibility.
-- Batch behavior.
-
-This specification does not define:
-
-- The exact configuration schema: Every field, its YAML key, and its default belong to the [Registry Notary operator configuration reference](../../products/registry-notary/operator-config-reference/) and to the generated OpenAPI document rendered as the [Registry Notary API reference](../../reference/apis/registry-notary/). This document states the model's structure and the invariants a deployment enforces, and does not restate field schemas that would drift from the source.
-- Protocol and wire behavior: How a caller submits an evaluation, negotiates a format, or receives an error belongs to [RS-PR-NOTARY](../rs-pr-notary/).
-- The security model: How scopes, authentication, workload credentials, and key material are configured and enforced belongs to [RS-SEC-G](../rs-sec-g/).
-- The other data models of the stack: The Registry Relay dataset surface and the portable metadata manifest are separate data models, reserved for their own RS-DM-\* specifications.
-
-For the authoring guidance behind this model, see [Author an HTTP Registry Stack project](../../tutorials/author-registry-project/). For the worked claim pipeline, see [Evidence issuance, end to end](../../explanation/evidence-issuance/).
-
-## 2. Anatomy of a claim definition
-
-A claim definition is a named capability. It declares an identity, one evidence mode, the typed inputs and Relay consultations it may use, the single rule that decides its value, and the disclosure, format, and credential rules that shape what leaves the service.
-
-```mermaid
-flowchart TD
-    claim["Claim definition<br/>id · subject_type · value type"]
-    inputs["Typed inputs<br/>target · requester · declared variables"]
-    evidence["Evidence mode<br/>registry-backed consultation"]
-    rule["Rule (exactly one)<br/>consultation output · consultation matched · cel (+ depends_on)"]
-    disclosure["Disclosure policy<br/>default and allowed modes"]
-    formats["Evaluation render formats<br/>claim-result JSON · CCCEV JSON-LD"]
-    creds["Credential profiles<br/>authored claim membership, issues SD-JWT VC"]
-    claim --> inputs --> evidence --> rule
-    rule --> disclosure
-    rule --> formats
-    rule -.-> creds
-```
-
-The diagram restates the model: a claim receives compiler-pinned Relay outputs, a single rule decides the value, and the disclosure policy and formats govern the result. A claim definition describes one decision or one extracted value; a claim that tries to return a whole record over-collects and is hard to authorize.
-
-REQ-DM-CLAIM-001: A claim definition MUST carry a stable identifier (`id`); the `id` is the reference callers use to evaluate the claim and the reference a credential profile uses to name it. The `id` SHOULD be stable, specific, and unique across the configuration.
-
-## 3. Inputs and evidence modes
-
-A claim's inputs are the named request paths it may consume, drawn from the target subject, requester, and declared variables. The `registry_backed` evidence mode binds compiler-pinned Relay consultations whose typed outputs feed the rule. Notary has no direct registry source mode and no claim mode without Relay.
-
-REQ-DM-CLAIM-002: Each claim MUST declare `registry_backed` evidence and exactly one Relay consultation. It MUST bind that Relay consultation by profile id and contract hash and MUST map only declared typed request inputs. Registry Notary MUST enforce the claim's required scopes before Relay work.
-
-REQ-DM-CLAIM-003: A registry-backed claim SHOULD bind only the Relay outputs its rule needs. Consultation input mapping MUST NOT select a Relay origin, credential, method, capability, output projection, or response mapper. Request paths outside the closed mapping MUST be rejected.
-
-For target-derived inputs, the closed project mapping admits `request.target.id`,
-`request.target.identifiers.<stable-id>`, and
-`request.target.attributes.<stable-name>`.
-A target attribute stable name MUST match `[a-z][a-z0-9_]{0,63}`.
-An authored mapping admits only that named caller-supplied target value; it does not authenticate
-the value or authorize arbitrary traversal of the target object.
-
-## 4. Relay consultation contract
-
-A Registry Stack project compiles subject selection, cardinality, source adaptation, and output minimization into Relay. Notary sees only the consultation inputs and typed output contract.
-
-REQ-DM-CLAIM-004: A registry-backed claim MUST require the request purpose, Relay profile id, contract hash, input map, and output contract to match the compiled consultation before Relay work. A mismatch MUST fail closed and MUST NOT fall back to another profile or evidence mode.
-
-REQ-DM-CLAIM-005: Relay no-match, ambiguity, contract, and source failures MUST map into the configured Notary public error posture without exposing raw source rows or unreviewed source diagnostics. Delegated proof failures MUST use the stable delegated denial codes defined by RS-PR-NOTARY.
-
-## 5. Rule and dependencies
-
-The rule is the single decision at the center of a claim. Registry Notary implements three rule kinds: `consultation_matched` (whether the Relay consultation matched), `consultation_output` (a typed value from one named consultation output), and `cel` (a value derived from closed evidence inputs or earlier claim results through a hardened expression).
-
-REQ-DM-CLAIM-006: A claim definition MUST declare exactly one rule, and that rule MUST be one of the implemented kinds `consultation_output`, `consultation_matched`, or `cel`. Any other rule kind MUST be rejected as unknown. This is the data-model form of REQ-PR-NOTARY-007.
-
-REQ-DM-CLAIM-007: A `cel` rule MAY reuse earlier claim results through `depends_on`. Every `depends_on` entry MUST name a claim defined in the same configuration, and the dependency graph MUST be acyclic; a deployment MUST reject a configuration whose `depends_on` names an unknown claim or forms a cycle.
-
-## 6. Disclosure policy
-
-A claim's disclosure policy is a `default` mode and an `allowed` set drawn from the three disclosure profile modes defined in [RS-TERMS](../rs-terms/) Section 2: `value` (the full value), `predicate` (only the true/false satisfaction), and `redacted` (the value fully hidden).
-
-REQ-DM-CLAIM-008: Registry Notary MUST apply a claim's `default` disclosure mode when the caller requests none, and MUST refuse a mode that is not in the claim's `allowed` set. This is the data-model form of REQ-PR-NOTARY-009. A claim's `default` SHOULD be a member of its `allowed` set, and a privacy-sensitive claim SHOULD default to the least-revealing useful mode.
-
-## 7. Response formats and value typing
-
-A claim's `formats` list declares the response formats it can render, and its value descriptor declares the type the evaluated value takes.
-
-REQ-DM-CLAIM-009: A claim's `formats` MUST include `application/vnd.registry-notary.claim-result+json`, and MAY additionally include only `application/ld+json; profile="cccev"` (the data-model form of REQ-PR-NOTARY-011). When `formats` is omitted, Registry Notary uses the claim-result JSON media type. An explicitly empty list, an unknown format, or a list that omits the canonical format MUST be rejected at configuration load. SD-JWT VC issuance uses `application/dc+sd-jwt` in credential profiles and MUST NOT appear in a claim evaluation render `formats` list. A claim declares the type its evaluated value takes; where that type is one Registry Notary recognizes, the evaluated value MUST conform to it or the evaluation is refused rather than returned.
-
-## 8. Credential eligibility
-
-A claim is not issuable as a credential by default. In a Registry Stack project, the credential
-profile is the single authored direction: it lists the claims it may issue. The compiler derives the
-reverse claim-to-profile index required by Registry Notary's product configuration.
-
-REQ-DM-CLAIM-010: A credential profile MUST list at least one claim. The Registry Stack project
-compiler MUST derive each listed claim's product-level `credential_profiles` reverse index from
-that membership and MUST reject unknown claims or claims without a declared Relay consultation. Registry Notary MUST require every
-credential profile claim, credential-capable subject-access allow-list entry, and OID4VCI projection
-to resolve through mutually consistent bindings to non-delegated `registry_backed` evidence. Delegated relationship and dependent-claim credential bindings MUST be rejected. Registry Notary MUST issue a claim only when the
-compiled profile membership and derived reverse index agree and exact compiler pins plus normalized unique Relay execution records are retained for its full dependency closure. Those private execution identifiers MUST be retained only for a credential-capable selection, not for a registry-backed evaluation-only claim. The issued credential is an SD-JWT VC
-bound to its holder by `did:jwk`, per REQ-PR-NOTARY-013 and REQ-PR-NOTARY-015.
-
-## 9. Batch behavior
-
-Batch evaluation lets one request evaluate claims for several subjects. It is an outer Notary API envelope, not a second evidence model: it adds no authorization, disclosure, consultation, or issuance behavior of its own.
-
-REQ-DM-CLAIM-011: Batch evaluation MUST be semantically equivalent to evaluating each item independently. Batches MUST validate the complete outer request before the first Relay call, require an idempotency key, preserve item order, and MUST NOT coalesce duplicate subjects across item positions or bypass single-evaluation authorization and disclosure.
-
-## 10. Limitations
-
-These constraints are stated so a reader does not infer a capability from a declared but unusable
-shape.
-
-- Non-CEL value-type conformance: evaluation does not yet verify the value
-  descriptor for the non-CEL rule paths. Tracked in
-  [GH#232](https://github.com/registrystack/registry-stack/issues/232).
-
-## Conformance
-
-A claim definition, and the Registry Notary deployment that serves it, conforms to the target model in this specification when it:
-
-- carries a stable identifier by which it is evaluated and named (REQ-DM-CLAIM-001);
-- declares exactly one evidence mode, pins every registry-backed Relay consultation, enforces caller scopes before work, and rejects inputs outside the closed mapping (REQ-DM-CLAIM-002, REQ-DM-CLAIM-003);
-- verifies the complete Relay consultation contract before work and preserves the configured public error posture without source leakage (REQ-DM-CLAIM-004, REQ-DM-CLAIM-005);
-- declares exactly one implemented rule kind and rejects every unknown kind (REQ-DM-CLAIM-006);
-- keeps `depends_on` references resolvable and acyclic (REQ-DM-CLAIM-007);
-- applies the default disclosure mode and refuses modes outside the allowed set (REQ-DM-CLAIM-008);
-- renders the claim-result format and produces a value matching its declared type
-  (REQ-DM-CLAIM-009);
-- issues a credential only under compiler-closed profile membership (REQ-DM-CLAIM-010);
-- treats batch evaluation as equivalent to repeated single evaluation and never as a way around per-evaluation rules (REQ-DM-CLAIM-011).
-
-Conformance to this specification does not imply conformance to any external standard cited in the `standards_referenced` frontmatter field. Each standard's adoption mode and scope are documented in the [standards register](../../reference/standards/).
-
-## Evidence
-
-This specification is `partial`: most requirements describe shipped behavior a reader can inspect, per RS-DOC REQ-DOC-014, but Section 10 records the remaining target-model gap that keeps REQ-DM-CLAIM-009 from being fully verified today.
-
-- [Registry Stack project authoring](../../tutorials/author-registry-project/) walks the authored claim, Relay consultation, disclosure, fixture, review, and unsigned-build workflow.
-- The [Registry Notary operator configuration reference](../../products/registry-notary/operator-config-reference/) lists the claim, Relay, subject access, and credential-profile fields.
-- [RS-PR-NOTARY](../rs-pr-notary/) carries the protocol-level form of the scope, rule, disclosure, format, and credential requirements this document gives a data-model form (REQ-PR-NOTARY-004/006/007/009/011/013/015).
-- [RS-ARC-G](../rs-arc-g/) Section 3 holds the Registry Notary component invariant (REQ-ARC-G-007) that both this document and RS-PR-NOTARY refine.
-- The [standards register](../../reference/standards/) records the adoption mode for SD-JWT VC and the W3C DID method named in `standards_referenced`.
-- [GH#232](https://github.com/registrystack/registry-stack/issues/232) tracks the non-CEL value-type conformance gap called out in Section 10.
-
-## Next
-
-- [RS-PR-NOTARY](../rs-pr-notary/) is the protocol contract that operates on this data model.
-- [RS-ARC-G](../rs-arc-g/) places Registry Notary and its claim model in the registry stack architecture.
-- [RS-SEC-G](../rs-sec-g/) holds the security model the scope and credential rules here rely on.
-- [RS-TERMS](../rs-terms/) defines the claim and credential vocabulary used here.
-- [Evidence issuance, end to end](../../explanation/evidence-issuance/) is the narrative walk-through of a claim from request to credential.
diff --git a/docs/site/src/content/docs/spec/rs-dm-manifest.mdx b/docs/site/src/content/docs/spec/rs-dm-manifest.mdx
index 08fde03e5..01ba6cc36 100644
--- a/docs/site/src/content/docs/spec/rs-dm-manifest.mdx
+++ b/docs/site/src/content/docs/spec/rs-dm-manifest.mdx
@@ -1,11 +1,11 @@
 ---
 title: "RS-DM-MANIFEST: Registry Manifest portable metadata data model"
-description: "The data model for a Registry Manifest portable metadata manifest: schema version, runtime-binding boundary, catalog collections, reference integrity, governed evidence metadata, federation discovery, discovery-bundle digests, and strict unknown-key rejection."
+description: "The data model for a Registry Manifest portable metadata manifest: schema version, runtime-binding boundary, catalog collections, reference integrity, governed evidence metadata, evidence-offering access discovery, discovery-bundle digests, and strict unknown-key rejection."
 status: draft
 owner: registry-docs
 source_repos:
   - registry-manifest
-last_reviewed: "2026-07-07"
+last_reviewed: "2026-08-04"
 doc_type: specification
 doc_id: RS-DM-MANIFEST
 category: normative
@@ -31,7 +31,7 @@ audience:
 
 This document defines the data model of the Registry Manifest portable metadata manifest: the `metadata.yaml` document (schema version `registry-manifest/v1`) that describes a registry's catalog, datasets, services, requirements, evidence, and policies, and from which Registry Manifest renders a static, standards-shaped discovery bundle. It is the structural counterpart to the [Registry Relay protocol](../rs-pr-relay/): RS-PR-RELAY Section 1 and REQ-PR-RELAY-011 defer the metadata-manifest format to this document.
 
-The manifest format is owned by Registry Manifest, a pure library and command-line interface with no runtime data dependencies; Registry Relay serves and scopes the compiled artifacts but does not define or version the format. This document and [RS-ARC-G](../rs-arc-g/) state that boundary at different altitudes: RS-ARC-G fixes it as an architectural invariant (REQ-ARC-G-001, REQ-ARC-G-002, REQ-ARC-G-006), and this document refines the Registry Manifest component of RS-ARC-G Section 3 one level down, into the structure the manifest takes and the invariants its validator enforces at load. As [RS-DM-CLAIM](../rs-dm-claim/) is the data-model form of the Registry Notary protocol, this document is the data-model form of the portable metadata layer.
+The manifest format is owned by Registry Manifest, a pure library and command-line interface with no runtime data dependencies; Registry Relay serves and scopes the compiled artifacts but does not define or version the format. This document and [RS-ARC-G](../rs-arc-g/) state that boundary at different altitudes: RS-ARC-G fixes it as an architectural invariant (REQ-ARC-G-001, REQ-ARC-G-002, REQ-ARC-G-006), and this document refines the Registry Manifest component of RS-ARC-G Section 3 one level down, into the structure the manifest takes and the invariants its validator enforces at load. This document is the data-model form of the portable metadata layer.
 
 The key words in this document are interpreted per [RS-DOC](../rs-doc/) Section 2. Defined terms are used per [RS-TERMS](../rs-terms/).
 
@@ -42,7 +42,9 @@ The key words in this document are interpreted per [RS-DOC](../rs-doc/) Section
 | 0.1.0 | 2026-06-13 | draft | Initial portable metadata data model, distilled from the Registry Manifest overview, the validate-and-render guide, and the reference, and graded against the schema types and the load-time validator the Registry Manifest core enforces. |
 | 0.2.0 | 2026-06-20 | draft | Added governed evidence gateway metadata, policy id/hash binding, ODRL enforcement profile validation, and the runtime PDP boundary. |
 | 0.2.1 | 2026-06-21 | draft | Clarified federation discovery trust boundaries, manifest validation limits, and static publication provenance. |
+| 0.3.1 | 2026-08-04 | draft | Recorded that Registry Notary is retired: Section 7 and REQ-DM-MANIFEST-010 now state that the `registry-notary` access kind and its federation vocabulary are validated published surface with no maintained runtime behind them, and the retired product's claim data model is no longer cross-referenced. No validator behavior changed. |
 | 0.3.0 | 2026-07-07 | draft | Corrected REQ-DM-MANIFEST-007 to require a unique `(id, version)` pair rather than independently unique `id` and `version` values, corrected the REQ-DM-MANIFEST-002 runtime-only-key example, renamed the static discovery bundle consistently, and rewrote REQ-DM-MANIFEST-013 from the additive-evolution rule to strict unknown-key rejection at parse time (issue #249, issue #285). |
+| 0.4.0 | 2026-08-04 | draft | Removed the `federation` block and the `registry-notary` access kind from the manifest schema and rewrote REQ-DM-MANIFEST-010 around the `registry-evidence` access kind. The `access.kind` vocabulary is now open: any other kind is left to the consuming runtime. The `registry-manifest/v1` schema version is unchanged; a manifest carrying the removed block is rejected at parse time by REQ-DM-MANIFEST-013. |
 
 ## 1. Scope and references
 
@@ -54,7 +56,7 @@ This specification covers the structure and invariants of a portable metadata ma
 - Reference integrity and identifier and vocabulary constraints.
 - Requirements and grouped evidence.
 - Governed evidence pack metadata and the Evidence Gateway PDP binding surface.
-- Federation discovery metadata.
+- Evidence-offering access discovery metadata.
 - The standards-shaped render set and the static discovery bundle.
 - Compatibility and evolution.
 
@@ -62,29 +64,29 @@ This specification does not define:
 
 - **The exact manifest schema.** Every key, its type, and its default belong to the [Registry Manifest reference](../../products/registry-manifest/reference/), and the rendered artifacts are themselves the authoritative schema documents Registry Manifest emits. This document states the model's structure and the invariants the validator enforces, and does not restate field schemas that would drift from the source.
 - **Runtime serving and scoping.** How Registry Relay serves a compiled bundle, scopes it per caller, and binds its logical concepts to live data sources belongs to [RS-PR-RELAY](../rs-pr-relay/).
-- **Claim evaluation.** The Registry Notary claim definition is a separate data model with its own specification, [RS-DM-CLAIM](../rs-dm-claim/); the manifest only advertises the federation metadata that points a caller at a delegated evaluator.
+- **Assertion evaluation.** How a runtime evaluates a question about a subject and returns a signed, minimum-disclosure answer belongs to [RS-PR-EVIDENCE](../rs-pr-evidence/). The manifest describes a source portably; it does not define an assertion, a requirement, or how one is evaluated.
 
 For the narrative two-layer pipeline, see the [architecture overview](../../explanation/architecture/); for the authoring and command surface, see the [Registry Manifest overview](../../products/registry-manifest/) and the [validate and render guide](../../products/registry-manifest/validate-and-render/).
 
 ## 2. Anatomy of a metadata manifest
 
-A metadata manifest is a single portable document. It declares a schema version, a catalog that identifies the publisher, the collections that describe a registry, and, optionally, the federation metadata for delegated evaluation. Registry Manifest validates the document and renders it, as a pure function, into a static discovery bundle.
+A metadata manifest is a single portable document. It declares a schema version, a catalog that identifies the publisher, the collections that describe a registry, and, optionally, the evidence offerings that point at a service which answers evidence requests. Registry Manifest validates the document and renders it, as a pure function, into a static discovery bundle.
 
 ```mermaid
 flowchart TD
     manifest["metadata.yaml<br/>schema_version: registry-manifest/v1"]
     catalog["Catalog<br/>id · base_url · title · publisher"]
     describe["Description<br/>datasets · entities · fields · requirements<br/>evidence types · services · forms · policies · codelists"]
-    federation["Federation metadata<br/>node_id · issuer · ruleset bindings"]
+    offerings["Evidence offerings<br/>access.kind · endpoint · discovery · ruleset"]
     render["Validate, then render<br/>(pure · deterministic · no data sources)"]
     bundle["Discovery bundle<br/>DCAT · BRegDCAT-AP · CPSV-AP · SHACL<br/>JSON Schema · OGC Records · ODRL · CCCEV<br/>embedded SKOS-shaped codelists"]
     index["index.json<br/>source_manifest_digest · package_digest · per-artifact sha256"]
     manifest --> catalog
     manifest --> describe
-    manifest --> federation
+    manifest --> offerings
     catalog --> render
     describe --> render
-    federation --> render
+    offerings --> render
     render --> bundle --> index
 ```
 
@@ -96,13 +98,13 @@ REQ-DM-MANIFEST-001: A metadata manifest MUST declare `schema_version: registry-
 
 The manifest is portable: it carries the static description of a registry and nothing about a particular deployment. This boundary is what lets a manifest be authored, reviewed, hosted, and pinned without access to any production system, and what keeps Registry Manifest a pure library with no data dependencies (REQ-ARC-G-001).
 
-REQ-DM-MANIFEST-002: A metadata manifest MUST be runtime-independent: it MUST NOT carry runtime bindings such as source paths, table identifiers, caller scopes, backend credentials, peer allow-lists, federation signing keys, replay stores, or token URLs. Registry Manifest MUST reject a manifest that contains any of the runtime-only keys it enumerates. This is the data-model form of REQ-ARC-G-002, and the boundary [RS-PR-RELAY](../rs-pr-relay/) keeps on the Relay side as REQ-PR-RELAY-011: runtime bindings belong in Registry Relay or Registry Notary configuration, never in the manifest.
+REQ-DM-MANIFEST-002: A metadata manifest MUST be runtime-independent: it MUST NOT carry runtime bindings such as source paths, table identifiers, caller scopes, backend credentials, caller allow-lists, signing keys, replay stores, or token URLs. Registry Manifest MUST reject a manifest that contains any of the runtime-only keys it enumerates. This is the data-model form of REQ-ARC-G-002, and the boundary [RS-PR-RELAY](../rs-pr-relay/) keeps on the Relay side as REQ-PR-RELAY-011: runtime bindings belong in a runtime service's own configuration, never in the manifest.
 
 ## 4. Catalog and top-level structure
 
 A manifest's required core is its catalog; the rest of a manifest is the collections through which it describes a registry. RS-TERMS summarizes those collections as datasets, entities, fields, public services, forms, requirements, policies, and evidence offerings; the full top-level set the reference defines is broader, and this document names it so a reader does not infer the manifest stops at that summary.
 
-REQ-DM-MANIFEST-003: A metadata manifest MUST declare a `catalog` carrying at least an identifier, a base URL, a title, and a publisher, each validated (an identifier matching the manifest identifier pattern, an HTTP or HTTPS base URL, a non-empty title, and a non-empty publisher name). Beyond the catalog, a manifest describes a registry through the top-level collections the reference defines: `vocabularies`, `profiles`, `requirements`, `evidence_types`, `authorities`, `public_services`, `data_services`, `forms`, `datasets` (each with its `entities`, `fields`, `relationships`, `policies`, and `evidence_offerings`), `codelists`, `federation`, `evaluation_profiles`, and `ecosystem_bindings`. This document does not restate their field schemas; the [Registry Manifest reference](../../products/registry-manifest/reference/) is authoritative.
+REQ-DM-MANIFEST-003: A metadata manifest MUST declare a `catalog` carrying at least an identifier, a base URL, a title, and a publisher, each validated (an identifier matching the manifest identifier pattern, an HTTP or HTTPS base URL, a non-empty title, and a non-empty publisher name). Beyond the catalog, a manifest describes a registry through the top-level collections the reference defines: `vocabularies`, `profiles`, `requirements`, `evidence_types`, `authorities`, `public_services`, `data_services`, `forms`, `datasets` (each with its `entities`, `fields`, `relationships`, `policies`, and `evidence_offerings`), `codelists`, `evaluation_profiles`, and `ecosystem_bindings`. This document does not restate their field schemas; the [Registry Manifest reference](../../products/registry-manifest/reference/) is authoritative.
 
 REQ-DM-MANIFEST-004: Within a manifest, every cross-reference between objects MUST resolve to a defined object of the expected kind: an evidence type to a requirement it proves, an evidence offering to an entity and that entity's fields, a public service to its authority and its referenced requirements, forms, and data services, a form to its service and channel, a field to a codelist, and a relationship to an entity in the same dataset. Registry Manifest MUST reject a manifest with a dangling or mistyped reference at load.
 
@@ -124,13 +126,17 @@ REQ-DM-MANIFEST-008: A governed evidence pack MUST bind runtime policy selection
 
 REQ-DM-MANIFEST-009: A governed evidence pack MUST declare `odrl_enforcement.profile: registry-evidence-gateway-pdp/v1`, and its `constraint_terms` MUST contain at least one unique term from the profile vocabulary: `odrl:purpose` and `odrl:spatial`. The wider manifest policy renderer MAY publish broader Open Digital Rights Language (ODRL) metadata, but a governed evidence pack MUST NOT claim PDP enforcement for ODRL terms outside this profile vocabulary. A runtime service MAY support only a subset of the profile vocabulary; Registry Relay currently enforces `odrl:purpose` and denies `odrl:spatial` fail-closed.
 
-## 7. Federation discovery metadata
+## 7. Evidence-offering access discovery metadata
 
-A manifest MAY advertise the metadata a partner needs to configure Registry Notary static-peer delegated evaluation. This metadata is public discovery: it describes where a delegated evaluator is and what it evaluates, not who may call it.
+An evidence offering's `access` block says where an evidence request is answered and how a relying party verifies the answer. It is public discovery: it describes where a service is and what it evaluates, not who may call it.
 
-REQ-DM-MANIFEST-010: Where an evidence offering declares `access.kind: registry-notary`, the manifest MUST carry a `federation` block with HTTPS issuer, JWKS, and federation-API URLs, a `did:web` node identifier bound to the issuer host, the supported protocol version `registry-notary-federation/v0.1`, and an `access.ruleset` that names a declared evaluation profile. This metadata is public discovery only and MUST NOT be read as an access grant: peer authorization remains with Registry Notary, which decides at runtime which peers may call it (REQ-ARC-G-009).
+The `access.kind` vocabulary is open. A manifest may name any access kind, and the runtime that consumes the manifest decides which kinds it can serve. Registry Manifest checks the endpoint shape of exactly one kind, `registry-evidence`, because that kind names a service whose shape this repository defines. For every other kind, `conforms_to` is validated as an ordinary optional URI and the rest of the `access` block is left to the consuming runtime.
 
-Federation discovery metadata is also not a trust bootstrap by itself. A consumer that reads federation metadata from an external manifest validates the issuer, JWKS, federation API, and `did:web` host against local trust policy before treating any key or endpoint as authoritative. In the registry stack's runtime path, trusted peer keys and endpoints come from Registry Notary configuration, not from accepting an arbitrary published manifest.
+REQ-DM-MANIFEST-010: Where an evidence offering declares `access.kind: registry-evidence`, the offering MUST declare a non-blank `access.conforms_to` naming the response profile the endpoint returns, an HTTPS `access.endpoint_url`, and an HTTPS `access.discovery_url`. Where `access.ruleset` is present and non-blank, it MUST name a declared evaluation profile ruleset. This metadata is public discovery only and MUST NOT be read as an access grant (REQ-ARC-G-009).
+
+Registry Manifest does not pin `conforms_to` to a particular response-profile version. The portable metadata layer stays independent of any one product's contract version, so the value is checked for presence, not membership in a fixed set.
+
+Access discovery metadata is also not a trust bootstrap by itself. A consumer that reads an `access` block from an external manifest validates the endpoint and discovery hosts against local trust policy before treating any key or endpoint as authoritative.
 
 ## 8. Rendered artifacts and standards
 
@@ -159,9 +165,9 @@ These constraints are stated so a reader does not infer an invariant the reviewe
 - **Runtime-binding exclusion is an enumerated list.** Registry Manifest rejects the runtime-only keys it enumerates, not every conceivable runtime key. This check and the general unknown-key rejection REQ-DM-MANIFEST-013 requires both operate over an intermediate JSON value, so a rejection error carries the offending key's dotted field path but not its YAML line or column (REQ-DM-MANIFEST-002).
 - **Standards conformance is not validated.** The renderers emit standards-shaped artifacts but do not validate them against the external standard bodies. A rendered CPSV-AP, DCAT, or SHACL document is well-formed by construction, not certified against the standard (REQ-DM-MANIFEST-011).
 - **URI checks are shallow.** A field required to be a URI is checked for an HTTP or HTTPS scheme or for the identifier pattern, not for full RFC 3987 IRI validity (REQ-DM-MANIFEST-004, REQ-DM-MANIFEST-005).
-- **Federation metadata is not a trust anchor.** Registry Manifest validates required federation fields and selected URL shapes, but a published manifest does not bind an external consumer to trust a JWKS endpoint, a federation API host, or a peer identity. Host pinning and trust bootstrap belong to the consumer's local policy and Registry Notary peer configuration (REQ-DM-MANIFEST-010).
+- **Access discovery metadata is not a trust anchor.** Registry Manifest validates required access fields and selected URL shapes, but a published manifest does not bind an external consumer to trust an endpoint, a discovery document, or an issuer identity. Host pinning and trust bootstrap belong to the consumer's local policy (REQ-DM-MANIFEST-010).
 - **Library callers own untrusted-input resource limits.** The command-line path may impose its own input limits, but callers that embed Registry Manifest as a library and accept manifests from untrusted parties still need request size, nesting, collection-count, and time limits appropriate to their service boundary. Manifest validation is not a general resource sandbox.
-- **Notary-specific validation depends on Notary access semantics.** The Notary federation checks apply where the manifest declares a Registry Notary evidence access path. A generic `conforms_to` value or generic URI metadata alone must not be treated by consumers as proof that the Notary endpoint set is complete and safe to trust.
+- **The access checks are keyed to one access kind and validate shape, not reachability.** They apply only where the manifest declares `access.kind: registry-evidence`. A `conforms_to` value or a well-formed HTTPS URL alone must not be treated by consumers as proof that an endpoint is live, that it returns the named profile, or that the endpoint set is safe to trust. Manifest validation does not fetch either URL.
 - **Publication provenance depends on a clean destination.** The `package_digest` pins the artifact inventory it sees. It is not proof that every file was created by the current publish invocation if the output directory already contained local files.
 - **Evidence pack metadata remains partly opaque.** Governed evidence packs require key metadata and validate selected object shapes, supported gate names, supported output names, policy digest shape, inline-policy digest binding, and supported ODRL enforcement terms. The implementation still represents several fields as JSON values rather than a fully typed external evidence-pack schema (REQ-DM-MANIFEST-007 through REQ-DM-MANIFEST-009).
 - **Profile fixtures are non-normative.** The example profiles shipped with Registry Manifest are illustrative until reviewed against official artifacts; they are not authoritative profiles for any named external system (see the [profile fixtures guide](../../products/registry-manifest/profile-fixtures/)).
@@ -177,7 +183,7 @@ A metadata manifest, and the Registry Manifest tooling that validates and render
 - keeps identifiers patterned and unique in scope and closed-vocabulary fields within their vocabulary (REQ-DM-MANIFEST-005);
 - proves every evidence type against a requirement and treats grouped evidence as conjunction within a list and alternatives across lists (REQ-DM-MANIFEST-006);
 - validates governed evidence pack metadata, policy id/hash binding, required gates and outputs, and supported ODRL enforcement terms without claiming a fully typed evidence-pack model or runtime enforcement by Registry Manifest (REQ-DM-MANIFEST-007 through REQ-DM-MANIFEST-009);
-- advertises federation metadata as discovery only, with the required HTTPS, `did:web`, protocol-version, and ruleset bindings, and never as an access grant (REQ-DM-MANIFEST-010);
+- advertises evidence-offering access metadata as discovery only, with the required response profile, HTTPS endpoint and discovery URLs, and ruleset binding for `registry-evidence` access, and never as an access grant (REQ-DM-MANIFEST-010);
 - renders its artifacts as a pure, deterministic, standards-shaped set without asserting external-standard conformance (REQ-DM-MANIFEST-011);
 - publishes a self-describing bundle digested for pinning and comparison without a runtime service (REQ-DM-MANIFEST-012);
 - rejects an unmodeled key at parse time, naming its dotted field path, without relaxing other validation, and versions every breaking change (REQ-DM-MANIFEST-013).
@@ -188,7 +194,7 @@ Conformance to this specification does not imply conformance to any external sta
 
 This specification is `verified`: every requirement describes shipped behavior a reader can inspect, per RS-DOC REQ-DOC-014.
 
-- The [Registry Manifest overview](../../products/registry-manifest/) describes the pure render pipeline, the multi-pass validator, the minimal manifest and its required core, grouped evidence, governed evidence ecosystem bindings, and the federation-is-discovery-not-grant rule that Sections 2 through 8 make precise.
+- The [Registry Manifest overview](../../products/registry-manifest/) describes the pure render pipeline, the multi-pass validator, the minimal manifest and its required core, grouped evidence, governed evidence ecosystem bindings, and the discovery-is-not-a-grant rule that Sections 2 through 8 make precise.
 - The [Registry Manifest reference](../../products/registry-manifest/reference/) lists the top-level keys, the catalog core, the runtime-only key list, the render formats, the schema-version markers, the publish bundle layout, the digest fields, and the extension policy that Sections 3 through 11 state normatively.
 - The [validate and render guide](../../products/registry-manifest/validate-and-render/) walks the validation checks, the render and publish commands, and the `index.json` digest fields behind Sections 8 and 9.
 - [RS-PR-RELAY](../rs-pr-relay/) carries the Relay-protocol form of the ownership boundary this document gives a data-model form (REQ-PR-RELAY-011).
@@ -198,7 +204,7 @@ This specification is `verified`: every requirement describes shipped behavior a
 ## Next
 
 - [RS-PR-RELAY](../rs-pr-relay/) is the protocol that serves and scopes the compiled artifacts this model describes.
-- [RS-DM-CLAIM](../rs-dm-claim/) is the sibling data model for the Registry Notary claim definition this manifest can point a caller toward.
+- [RS-PR-EVIDENCE](../rs-pr-evidence/) is the protocol for evaluating a reviewed question about a subject over a source this model can describe.
 - [RS-ARC-G](../rs-arc-g/) places Registry Manifest and the portable metadata layer in the registry stack architecture.
 - [RS-TERMS](../rs-terms/) defines the metadata manifest, evidence, and policy vocabulary used here.
 - [Architecture overview](../../explanation/architecture/) is the narrative data flow that places the portable metadata layer and the runtime services side by side.
diff --git a/docs/site/src/content/docs/spec/rs-doc.mdx b/docs/site/src/content/docs/spec/rs-doc.mdx
index 78aa7d9f7..1bdccb307 100644
--- a/docs/site/src/content/docs/spec/rs-doc.mdx
+++ b/docs/site/src/content/docs/spec/rs-doc.mdx
@@ -5,10 +5,10 @@ status: draft
 owner: registry-docs
 source_repos:
   - registry-relay
-  - registry-notary
+  - registry-evidence
   - registry-platform
   - registry-manifest
-last_reviewed: "2026-07-07"
+last_reviewed: "2026-08-03"
 doc_type: specification
 doc_id: RS-DOC
 category: normative
diff --git a/docs/site/src/content/docs/spec/rs-op-posture.mdx b/docs/site/src/content/docs/spec/rs-op-posture.mdx
index de87e539a..ca18d05df 100644
--- a/docs/site/src/content/docs/spec/rs-op-posture.mdx
+++ b/docs/site/src/content/docs/spec/rs-op-posture.mdx
@@ -6,8 +6,9 @@ owner: registry-docs
 source_repos:
   - registry-platform
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-19"
+  - registry-evidence
+  - registry-mint
+last_reviewed: "2026-08-03"
 doc_type: specification
 doc_id: RS-OP-POSTURE
 category: normative
@@ -24,11 +25,14 @@ audience:
   - maintainer
 ---
 
-This document defines the operations posture observation that Registry Relay and Registry Notary
-return from their protected admin surfaces. It gives operators and tooling authors one stable,
+This document defines the operations posture observation that Registry Relay returns from its
+protected admin surface. It gives operators and tooling authors one stable,
 versioned document for observing build, runtime, configuration, deployment, audit, and
 component-specific status without treating that observation as an authorization decision or a
 source of secrets.
+The `registry.ops.posture.v1` contract is frozen and still models a second component,
+`registry-notary`, which is retired. Section 1 states which components produce a posture document
+today.
 
 The key words in this document are interpreted per [RS-DOC](../rs-doc/) Section 2.
 Defined terms are used per [RS-TERMS](../rs-terms/).
@@ -48,16 +52,28 @@ semantic producer validation, and evolution rules that JSON Schema alone does no
 | 0.1.2 | 2026-07-20 | draft | Replaced waiver reason text with validated operator references and optional summaries before the 1.0 schema freeze. |
 | 0.1.3 | 2026-07-23 | draft | Reserved credential-shaped waiver-reference prefixes before the 1.0 schema freeze. |
 | 0.1.4 | 2026-07-24 | draft | Separated portable waiver-schema checks from contextual semantic validation before the 1.0 schema freeze. |
+| 0.1.5 | 2026-08-03 | draft | Recorded that Registry Notary is retired and that no supported deployment produces a `registry-notary` document, while the frozen v1 shape and the consumer validation path for one are unchanged. Stated that Evidence and Registry Mint expose no posture endpoint. |
 
 ## 1. Scope and surface
 
 This specification covers a point-in-time operations observation returned by
 `GET /admin/v1/posture`.
-Registry Relay and Registry Notary expose that route on their protected admin surfaces, not in
+Registry Relay exposes that route on its protected admin surface, not in
 the public Registry Relay API document.
 The product route and authorization details remain with the
-[Registry Relay API reference](../../reference/apis/registry-relay/) and the
-[Registry Notary API reference](../../reference/apis/registry-notary/).
+[Registry Relay API reference](../../reference/apis/registry-relay/).
+
+Registry Relay is the only producer of a posture document in a supported deployment. The v1
+contract also models a second, retired component: no supported deployment emits a
+`registry-notary` document, and the shape is kept only so a consumer can still validate one it
+has retained.
+
+Evidence and Registry Mint expose no `/admin/v1/posture` route and emit no posture document. An
+operator observes an Evidence process through its unauthenticated liveness and readiness probes
+and, where the deployment enables it, through the optional metrics listener that Evidence binds
+to a private address and that serves only `GET /metrics`. Registry Mint likewise exposes liveness
+and readiness probes only. Neither service is in scope for the requirements in this
+specification.
 
 This specification does not define deployment configuration, profile-gate policy, audit
 retention, or a new authorization scope.
@@ -73,8 +89,9 @@ The root object and named nested objects use `additionalProperties: false`, exce
 explicitly modeled maps.
 `standards_artifacts` accepts producer-selected artifact labels, while each artifact-reference
 value has the closed shape defined by the schema.
-`notary.signing_keys.readiness` accepts signing-key identifiers, while each value is one of the
-defined readiness states.
+The second modeled map, `notary.signing_keys.readiness`, accepts signing-key identifiers with one
+of the defined readiness states as each value. It belongs to the retired component's section and
+no supported producer emits it.
 
 REQ-OP-POSTURE-001: A producer MUST emit a JSON object that validates against
 `registry.ops.posture.v1`.
@@ -91,19 +108,21 @@ than silently guessing the disclosure class.
 
 ### Component rules
 
-`component` is exactly one of `registry-relay` and `registry-notary`.
+`component` is exactly one of `registry-relay` and `registry-notary`, the retired component.
 The component selects one, and only one, component section.
 
 | `component` value | Required section | Forbidden section |
 | --- | --- | --- |
-| `registry-relay` | `relay` | `notary` |
-| `registry-notary` | `notary` | `relay` |
+| `registry-relay` | `relay` | `notary`, the section of the retired component |
+| `registry-notary`, retired | `notary` | `relay` |
 
 REQ-OP-POSTURE-003: A `registry-relay` document MUST contain `relay` and MUST NOT contain
 `notary`.
 A `registry-notary` document MUST contain `notary` and MUST NOT contain `relay`.
 A consumer MUST reject a document that does not satisfy this pairing, even when the shared
 envelope itself appears complete.
+No supported deployment produces the second document; the pairing rule stays part of the frozen v1
+contract so a consumer can still validate a retained one.
 
 The shared sections state the following categories of observation:
 
@@ -119,8 +138,9 @@ The shared sections state the following categories of observation:
 
 The `relay` section reports configured surface counts, metadata-manifest state, adapter state, and
 restricted per-resource refresh health.
-The `notary` section reports claim and credential-profile counts plus state, credential-status,
-federation, OID4VCI, and optional subject-access observations.
+The `notary` section belonged to the retired component and reported claim and credential-profile
+counts plus state, credential-status, federation, OID4VCI, and optional subject-access
+observations. It remains modeled by the frozen v1 schema and is never emitted.
 
 ### Deployment waiver metadata
 
@@ -155,8 +175,10 @@ remain non-waivable.
 ## 3. Examples
 
 The schema-valid [Registry Relay default example](https://github.com/registrystack/registry-stack/blob/c84b1b9288b925e7c9cc89c47c33cc1f50753d8c/crates/registry-platform-ops/examples/registry-relay.posture.valid.json)
-and [Registry Notary default example](https://github.com/registrystack/registry-stack/blob/c84b1b9288b925e7c9cc89c47c33cc1f50753d8c/crates/registry-platform-ops/examples/registry-notary.posture.valid.json)
-show the default projection for each component.
+shows the default projection a supported producer emits.
+The checked-in `registry-notary.posture.valid.json` example shows the default projection for the
+retired component; it is kept as a fixture for the frozen v1 shape, not as a deployment an adopter
+can run.
 The [restricted-tier fixture](https://github.com/registrystack/registry-stack/blob/c84b1b9288b925e7c9cc89c47c33cc1f50753d8c/crates/registry-platform-ops/fixtures/posture/restricted-posture.valid.json)
 shows fields that are valid but intentionally absent from the default projection.
 The checked-in `registry-relay.restricted-posture.valid.json` fixture shows the Relay refresh-health
@@ -184,7 +206,7 @@ The default projection includes operational status, counts, selected digests, fi
 and severities, and non-secret audit-shipping observations.
 It excludes values that can reveal topology or operational free text, including instance URLs,
 build revisions and features, trusted roots, artifact URLs, waiver references and summaries,
-signing-key details, and Notary federation identities or peers.
+signing-key details, and the federation identities and peers of the retired component.
 The checked-in sensitive fixture proves that the projection excludes credentials, private keys,
 source URLs, subject identifiers, raw rows, claim values, and the restricted topology fields.
 The default tier also excludes `relay.refresh_health`, including its dataset and resource
@@ -286,14 +308,18 @@ filter are shipped in Registry Platform and exercised by contract tests.
 - The checked-in restricted Relay posture fixture and Registry Relay admin tests validate
   per-resource last-good state, tier filtering, and the live producer shape (Sections 4 and 6).
 - The [Registry Relay admin handler](https://github.com/registrystack/registry-stack/blob/c84b1b9288b925e7c9cc89c47c33cc1f50753d8c/crates/registry-relay/src/api/admin.rs)
-  and [Registry Notary admin handler](https://github.com/registrystack/registry-stack/blob/c84b1b9288b925e7c9cc89c47c33cc1f50753d8c/crates/registry-notary-server/src/api/admin.rs)
-  select the requested tier and return the shared posture document (Sections 1, 4, and 6).
+  selects the requested tier and returns the shared posture document (Sections 1, 4, and 6). It is
+  the only producer this specification recognizes.
+- The Evidence and Registry Mint routers (`crates/registry-evidence/src/server.rs` and
+  `crates/registry-mint/src/server.rs`) expose liveness and readiness probes and no posture route,
+  which Section 1 states.
 
 ## Next
 
 - [Harden a production deployment](../../security/hardening-checklist/) explains how an operator
   uses posture findings while preparing a deployment.
 - [Registry Relay protocol](../rs-pr-relay/) defines the Relay admin-surface boundary.
-- [Registry Notary protocol](../rs-pr-notary/) defines Registry Notary's protected service surface.
+- [RS-PR-EVIDENCE](../rs-pr-evidence/) defines the Evidence service surface, which carries no
+  posture endpoint.
 - [RS-SEC-G](../rs-sec-g/) defines the security model and the operator boundary this observation
   helps inspect.
diff --git a/docs/site/src/content/docs/spec/rs-pr-evidence.mdx b/docs/site/src/content/docs/spec/rs-pr-evidence.mdx
new file mode 100644
index 000000000..4cdcdc191
--- /dev/null
+++ b/docs/site/src/content/docs/spec/rs-pr-evidence.mdx
@@ -0,0 +1,679 @@
+---
+title: "RS-PR-EVIDENCE: Evidence protocol"
+description: "The normative HTTP protocol contract for Evidence: discovery, authentication, assurance profiles, the closed request contract, acceptance definitions, minimum disclosure, response formats, problem reporting, audit gates, and immutable deployment input."
+status: draft
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: specification
+doc_id: RS-PR-EVIDENCE
+category: normative
+evidence: verified
+locale: en
+standards_referenced:
+  - sd-jwt-vc
+  - cccev
+  - openapi
+  - json-schema
+layer:
+  - evaluation
+audience:
+  - integrator
+  - operator
+  - specification editor
+---
+
+This document defines the HTTP protocol contract that Evidence exposes: how a caller authenticates,
+discovers the request shapes it may invoke, submits one closed request against a predefined
+requirement, and receives the smallest sufficient assertion in an authorized response format, plus
+the problem, audit, and configuration-immutability behavior every request carries.
+Evidence is a minimum-disclosure assertion service over data institutions already hold.
+It returns the answer a requirement asks for, not the record behind it.
+
+Every requirement statement in this document restates a frozen Version 1 contract that lives in the
+repository, and names that contract file beside it.
+The contract files are the source of truth; this document is their protocol-level reading.
+Where a contract carries a numeric limit, a field name, or an enumerated value, this document points
+at the file rather than copying the value, so the two cannot drift apart.
+
+Evidence is a separate product from Registry Relay.
+It is the Evidence counterpart to [RS-PR-RELAY](../rs-pr-relay/), and it is not a Registry Relay
+mode, rewrite, or reduced configuration (`products/evidence/README.md`).
+
+The key words in this document are interpreted per [RS-DOC](../rs-doc/) Section 2.
+Defined terms are used per [RS-TERMS](../rs-terms/).
+
+{/* RS-ARC-G 0.6.0 places Evidence in the architecture as its own component and states its
+    boundary in REQ-ARC-G-007, REQ-ARC-G-014, and REQ-ARC-G-015. This document still does not claim
+    to refine a numbered RS-ARC-G requirement; adding that mapping is a separate normative
+    decision. */}
+
+{/* TODO[evidence]: src/data/standards.yaml records sd-jwt-vc, cccev, openapi, and json-schema
+    without listing registry-evidence under `used_by`. The register entries need an Evidence row
+    before this page's standards claims are traceable from the register itself. */}
+
+## Version history
+
+| Version | Date | Status | Change |
+| --- | --- | --- | --- |
+| 0.1.0 | 2026-08-03 | draft | Initial profile derived from the frozen V1 contracts. |
+| 0.2.0 | 2026-08-04 | draft | Registry Notary is retired. Removed the RS-PR-NOTARY relationship statements and the `registry-notary*` dependency prohibition, and recorded that RS-ARC-G 0.6.0 now places Evidence in the architecture. |
+| 0.3.0 | 2026-08-05 | draft | Added the governed assurance-profile boundary, corrected the evaluation pipeline and three-format response surface, and specified bounded startup verification plus complete out-of-band verification for segmented audit history. |
+
+## 1. Scope and references
+
+This specification covers Evidence's externally observable protocol behavior:
+
+- The service surface, the generated OpenAPI document, and requester-scoped definition discovery.
+- Authentication of callers and the single authorization decision that gates a request.
+- The governed assurance profile and its local-only authoring exceptions.
+- The closed request contract and the request nonce.
+- Evaluation, the four coequal acceptance definitions, and the output gate.
+- Disclosure minimization, subject binding, and the combined-bundle disclosure surface.
+- The three response formats: the signed JSON Web Signature (JWS) assertion, the separately typed
+  unsigned envelope, and the SD-JWT VC (SD-JWT-based Verifiable Credentials) serialization of the
+  same assertion.
+- The problem contract, including existence collapse.
+- The audit obligation and its two durable gates.
+- The immutability of deployment input.
+
+This specification does not define:
+
+- Exact routes and schemas: The generated OpenAPI document,
+  `products/evidence/generated/registry-evidence.openapi.json`, is the authoritative route and schema
+  reference. This document states behavior a schema cannot, and does not restate request and response
+  shapes that would drift from the generated source.
+- Bundle authoring: How an operator declares requirements, selector profiles, authority profiles,
+  sources, and scripts belongs to `products/evidence/contracts/bundle.schema.yaml` and the trusted
+  request-adapter reference under `products/evidence/reference/request-adapter/`.
+- Deployment duties: Supported deployment shape, secret and key custody, readiness, audit storage,
+  and rotation belong to `products/evidence/OPERATOR-CONTRACT.md`.
+- Verifier procedure: The relying-party policy document and the offline `evidence verify` command are
+  specified by `products/evidence/contracts/verification-policy.schema.yaml`.
+
+Evidence Version 1 has explicit non-goals, recorded in
+`products/evidence/contracts/README.md` and `products/evidence/README.md`.
+It stops before documents, credential issuance protocols and credential lifecycle, status lists and
+revocation, OpenID for Verifiable Credential Issuance (OID4VCI) in any part, presentation-side
+verification, replay or nonce state beyond the stateless request-nonce echo, server-issued
+challenges, federation, delegated agents, workflow, public or federated catalogs, runtime bundle
+mutation, source planning, multi-source fulfillment, and an application database.
+The SD-JWT VC output is a second encoding of one stateless assertion under a frozen profile; it is
+never a credential lifecycle.
+Registry Relay's protocol is specified by RS-PR-RELAY; it does not govern Evidence, and Evidence
+inherits no requirement from it.
+
+## 2. Service surface and discovery
+
+Evidence is one `registry-evidence` crate, one `evidence` binary, one serving process, and one
+operator-controlled trust domain (`products/evidence/README.md`).
+
+REQ-PR-EVIDENCE-001: The reachable HTTP surface MUST be exactly the operations declared in
+`products/evidence/generated/registry-evidence.openapi.json`: one evidence operation, one
+definition-discovery operation, public key discovery, JWT VC Issuer Metadata, liveness, readiness,
+and publication of that OpenAPI document itself.
+A conforming deployment MUST NOT add a route outside that generated document.
+
+REQ-PR-EVIDENCE-002: Definition discovery MUST be authenticated, rate limited, and requester-scoped.
+The response MUST contain only complete request shapes that match exactly one configured authority
+path, and MUST omit unentitled and ambiguous shapes, so an unentitled caller receives an empty list
+(`products/evidence/contracts/definitions.schema.yaml`, invariant `V1-I26` in
+`products/evidence/contracts/security-invariant-matrix.yaml`).
+
+REQ-PR-EVIDENCE-003: Discovery MUST NOT create authority and MUST NOT expose deployment internals.
+It MUST NOT reveal source plans, scripts, credentials, requester tags, authority-profile identifiers,
+selector values, codelist values, or unrelated definitions, MUST perform no provider request, and
+MUST NOT emit an evidence-data audit event
+(`products/evidence/contracts/definitions.schema.yaml`, invariant `V1-I26`).
+
+REQ-PR-EVIDENCE-004: Public key discovery MUST serve public keys only, and JWT VC Issuer Metadata
+MUST carry only the members named in `products/evidence/contracts/sd-jwt-vc-profile.yaml`.
+Neither document is a trust anchor: a verifier MUST pin the provider identity and key set through
+governed verifier configuration (`products/evidence/contracts/jws-profile.yaml`,
+`products/evidence/contracts/sd-jwt-vc-profile.yaml`).
+
+## 3. Authentication and authorization
+
+Evidence runs one authentication kind, `oidc-access-token`, whose issuer, audiences, accepted token
+types, algorithms, JWKS URI, and claim paths are fixed in the immutable bundle
+(`products/evidence/contracts/bundle.schema.yaml`).
+
+REQ-PR-EVIDENCE-005: The evidence and definition-discovery operations MUST require exactly one
+`Authorization` header carrying one bearer token, verified against the configured authentication
+profile (`products/evidence/generated/registry-evidence.openapi.json`,
+`products/evidence/contracts/bundle.schema.yaml`).
+
+REQ-PR-EVIDENCE-006: The principal MUST derive only from the one configured principal claim.
+A missing claim MUST deny, with no client-identifier, authorized-party, header, or request fallback
+(`products/evidence/contracts/authority-context.schema.yaml`, invariant `V1-I04`).
+
+REQ-PR-EVIDENCE-007: One authorization decision MUST cover the complete request.
+The exact inputs are the principal, the optional actor, the exact requirement revision, the purpose,
+the audience, the authority profile and kind, the optional authenticated grant identifier, and the
+complete set of role, selector-profile, and value-origin tuples.
+Permissions MUST NOT be unioned across entitlements, and denial MUST occur before source credential
+resolution or source access (`products/evidence/contracts/authority-context.schema.yaml`, invariant
+`V1-I05`).
+
+REQ-PR-EVIDENCE-008: Caller data MUST NOT create authority.
+Possession of an identifier or a demographic tuple MUST NOT authorize a lookup, and a caller-supplied
+consent, approval, or grant reference MUST NOT escalate authority; a grant identifier is accepted
+only from authenticated context and must already be bound to the matched entitlement
+(`products/evidence/contracts/selector-contract.yaml`,
+`products/evidence/contracts/authority-context.schema.yaml`, invariants `V1-I06` and `V1-I07`).
+
+REQ-PR-EVIDENCE-009: Selector values MUST be absent for the authenticated-context and
+authenticated-grant value origins and present only for the request origin.
+Context-derived and grant-derived values MUST resolve only through the complete configured claim map
+over the already verified token (`products/evidence/contracts/selector-contract.yaml`,
+`products/evidence/contracts/request.schema.yaml`).
+
+REQ-PR-EVIDENCE-010: An access token carrying a proof-of-possession confirmation claim MUST be
+denied before any authenticated context is constructed, and MUST NOT be accepted as an ordinary
+bearer token (invariant `V1-I32`).
+
+REQ-PR-EVIDENCE-011: Rate controls MUST be applied per principal using the configured request, burst,
+and failed-selector limits in `products/evidence/contracts/bundle.schema.yaml`.
+They are defense in depth: bundle-combination validation under REQ-PR-EVIDENCE-025 remains mandatory
+independently of any configured rate limit (invariant `V1-I20`).
+
+## 4. Request contract
+
+REQ-PR-EVIDENCE-012: The request body MUST validate against
+`products/evidence/contracts/request.schema.yaml`, which closes the member set and rejects unknown
+members.
+Transport validation MUST be followed by named-profile validation, which closes the exact field
+names, scalar types, byte and numeric bounds, aggregate size, value origin, and source placements
+declared by the profile (`products/evidence/contracts/selector-contract.yaml`).
+
+REQ-PR-EVIDENCE-013: A caller MUST NOT supply thresholds, expressions, scripts, paths, headers,
+source fields, relationship types, adapter parameters, or response projections.
+Preparation, extraction, derivation, source transport, and concept projection are bundle-owned
+(invariant `V1-I02`).
+
+REQ-PR-EVIDENCE-014: Every request MUST carry one request nonce in the canonical form fixed by
+`products/evidence/contracts/request.schema.yaml`, generated independently per request by a
+cryptographically secure random source.
+Evidence MUST echo it into the assertion payload and cover it by the signature, and MUST NOT store
+it, uniqueness-check it, or expose it to authorization, rate limits, scripts, source requests, logs,
+metrics, traces, or native audit (invariant `V1-I27`).
+Nonce reuse is not rejected, so the nonce is transaction binding only for a relying party that
+independently retained the original request (`products/evidence/contracts/evidence.schema.yaml`).
+
+REQ-PR-EVIDENCE-015: Only a predefined requirement, at an exact enabled revision, MAY be evaluated.
+The request resolver MUST reject anything else before authorization, and unknown and unauthorized
+requirement identifiers MUST be indistinguishable to a caller lacking authorization
+(invariant `V1-I01`, `products/evidence/contracts/problem-contract.yaml`).
+
+REQ-PR-EVIDENCE-016: Subject roles MUST be resolved by name, not by array position.
+Duplicate, missing, unknown, or wrong-profile roles MUST fail before credential acquisition or source
+access, and accepted roles MUST be canonicalized to requirement declaration order
+(`products/evidence/contracts/request.schema.yaml`,
+`products/evidence/contracts/selector-contract.yaml`).
+
+## 5. Evaluation and acceptance definitions
+
+One evaluation runs a fixed pipeline. Rust owns every trust decision; the trusted bundle scripts own
+only requirement-specific preparation, extraction, and derivation.
+
+```mermaid
+flowchart LR
+    request["Closed request<br/>requirement, purpose, subjects, nonce"]
+    authz["One authorization decision<br/>complete entitlement match"]
+    access["Access audit<br/>durably accepted"]
+    prepare["Bounded preparation<br/>validate fixed request parts"]
+    source["One fixed source request<br/>core-owned transport"]
+    derive["Bounded extraction and derivation<br/>extract, then derive on match"]
+    gate["Output gate<br/>exact concept set and forms"]
+    sign["Construct and sign<br/>core-owned payload"]
+    release["Release audit, then exact bytes"]
+    request --> authz --> access --> prepare --> source --> derive --> gate --> sign --> release
+```
+
+The diagram restates the ordering the contracts fix: authorization precedes audit, access audit and
+validated preparation precede credential acquisition and source access, extraction precedes
+derivation, the output gate precedes evidence construction, and the disclosure-release audit
+precedes release of the exact serialized bytes.
+
+REQ-PR-EVIDENCE-017: Rust MUST own authentication, authorization, minimized script inputs, fixed
+source execution, response projection, output validation, evidence construction, response protection,
+and audit.
+Scripts MUST be confined to the closed `prepare`, `extract`, and `derive` entry points and MUST NOT
+perform input or output (`products/evidence/contracts/rhai-abi.yaml`,
+`products/evidence/contracts/primitive-library.yaml`, invariant `V1-I11`).
+
+REQ-PR-EVIDENCE-018: Exactly one evidence-data request MUST be made per evaluation, after successful
+authorization and durable access audit.
+Origin, method, path, fixed headers, authentication, TLS trust, redirect denial, proxy denial,
+timeout, response byte limit, concurrency, and the one-request ceiling are fixed by trusted
+configuration and executed only by the core
+(`products/evidence/contracts/source-contract.yaml`, invariant `V1-I09`).
+
+REQ-PR-EVIDENCE-019: Provider lookup MUST return only the closed union of match, no-match, and
+ambiguous outcomes, and only a match MAY carry facts.
+Evidence MUST NOT expose or choose candidates, and MUST NOT emit candidate counts, scores,
+confidence, hints, diagnostics, or comparisons
+(`products/evidence/contracts/rhai-abi.yaml`, invariant `V1-I10`).
+
+REQ-PR-EVIDENCE-020: Adult status, controlled residence region, professional licence status, and
+legal-parent relationship are coequal full-path acceptance definitions.
+All four MUST pass the same offline and production path on one revision before Version 1 is called
+implemented.
+None MAY become a Rust domain type, a built-in operation, a special route, or a preferred
+implementation phase (`products/evidence/README.md`, `products/evidence/CONCEPT.md`).
+
+REQ-PR-EVIDENCE-021: The derivation result MUST pass the output gate before evidence construction.
+The exact concept identifier set, declared form, lexical type, numeric precision and range, codelist
+or scheme version and membership, collection cardinality and uniqueness, structured schema, and size
+bounds are closed by `products/evidence/contracts/supported-value-forms.yaml` and the selected
+concept declaration.
+Undeclared concepts, extra fields, and out-of-contract values MUST be rejected
+(`products/evidence/contracts/evidence.schema.yaml`, invariant `V1-I12`).
+
+REQ-PR-EVIDENCE-022: Missing facts, undefined decisions, script failures, audit failures, and
+evaluation failures MUST fail closed.
+Partial, stale, fabricated, or unaudited evidence MUST NOT be released (invariant `V1-I13`).
+
+## 6. Disclosure minimization
+
+REQ-PR-EVIDENCE-023: The assertion MUST carry only the members declared by
+`products/evidence/contracts/evidence.schema.yaml`, which closes the payload and rejects additional
+properties.
+Subject selector profiles and selector values MUST NOT appear in evidence.
+The disclosed content is the declared supported values for the selected requirement, never the source
+record (`products/evidence/contracts/cccev-field-mapping.yaml`).
+
+REQ-PR-EVIDENCE-024: A subject MUST appear only as a role-bound, audience-scoped opaque binding.
+The binding MUST be a domain-separated keyed derivation over the audience, purpose, role, profile,
+binding-key version, and complete canonical selector bundle, so it is not globally linkable across
+relying parties or purposes
+(`products/evidence/contracts/evidence.schema.yaml`, invariant `V1-I17`).
+
+REQ-PR-EVIDENCE-025: The complete enabled bundle MUST be reviewed as one disclosure surface.
+Individually safe definitions MUST be rejected when their combination reconstructs a protected value,
+and startup bundle-combination validation MUST enforce the reviewed decision
+(invariant `V1-I03`, `products/evidence/contracts/bundle.schema.yaml`).
+
+REQ-PR-EVIDENCE-026: Raw source responses MUST NOT be persisted or logged, and selector, source, and
+disclosed values MUST NOT appear in logs or native audit.
+Response ownership is bounded and in memory, with centralized structured-log redaction
+(invariants `V1-I14` and `V1-I15`).
+
+REQ-PR-EVIDENCE-027: Purpose MUST NOT narrow disclosure.
+A requirement returns the same concepts and disclosure forms for every purpose authorized to invoke
+it; a purpose that justifies a coarser answer needs its own requirement and its own place in the
+combined disclosure review (`products/evidence/OPERATOR-CONTRACT.md`).
+
+## 7. Response formats and signing
+
+Evidence releases one stateless assertion.
+The bundle-level and grant-level `responseFormats` permission decides which serializations may carry
+it (`products/evidence/contracts/bundle.schema.yaml`).
+
+REQ-PR-EVIDENCE-028: The signed flattened JWS format MUST be available to every authorized grant and
+MUST be the default result.
+The Accept matrix is closed and MUST be resolved before source access; the exact media types and
+their selection rules are fixed by `products/evidence/contracts/jws-profile.yaml`.
+Every response varies on Accept and remains no-store (invariant `V1-I21`).
+
+REQ-PR-EVIDENCE-029: A response format other than the signed default MUST be released only when both
+the immutable bundle and the one complete matched grant permit it.
+Format selection creates no permission, and a refusal MUST use the ordinary authorization problem
+without revealing which layer withheld it
+(`products/evidence/contracts/jws-profile.yaml`,
+`products/evidence/contracts/sd-jwt-vc-profile.yaml`, invariant `V1-I28`).
+
+REQ-PR-EVIDENCE-030: Missing or failed signing MUST NOT fall back to unsigned output or to any other
+response format.
+A signing failure MUST surface as the safe transient failure defined by
+`products/evidence/contracts/jws-profile.yaml` (invariant `V1-I22`).
+
+REQ-PR-EVIDENCE-031: Private signing material MUST be core-owned and absent from bundle values,
+scripts, logs, audit, and errors.
+The bundle MUST reference the active key only through a supported runtime secret provider, retired
+public keys MUST be public JWKs, and a key identifier MUST NOT be reused for different key material
+(`products/evidence/contracts/jws-profile.yaml`, invariant `V1-I23`).
+
+REQ-PR-EVIDENCE-032: The final immutable response bytes MUST exist before the disclosure-release
+audit is durably accepted, and the exact pre-audited bytes MUST be the bytes released afterward, for
+every response format (`products/evidence/contracts/jws-profile.yaml`, invariant `V1-I29`).
+
+### 7.1 Signed flattened JWS
+
+REQ-PR-EVIDENCE-033: The signed response MUST be a flattened JWS JSON serialization carrying exactly
+the members required by `products/evidence/contracts/jws-profile.yaml`, with the unprotected header
+prohibited.
+The protected header MUST carry exactly the allowlisted members with the allowlisted algorithm, and
+MUST NOT carry any of the key-reference or criticality members that file prohibits.
+
+REQ-PR-EVIDENCE-034: The payload MUST be the exact UTF-8 assertion bytes, base64url encoded without
+padding.
+A verifier MUST verify the signature before parsing or acting on payload claims, and MUST validate
+the payload against the committed assertion schema before applying relying-procedure policy
+(`products/evidence/contracts/jws-profile.yaml`,
+`products/evidence/contracts/evidence.schema.yaml`).
+
+REQ-PR-EVIDENCE-035: A signature authenticates the technical provider and payload integrity only.
+It MUST NOT be read as asserting legal-signature status, source truth, holder binding, or single-use
+semantics, and cryptographic authenticity MUST be reported separately from current validity
+(`products/evidence/contracts/jws-profile.yaml`, invariants `V1-I24` and `V1-I31`).
+
+REQ-PR-EVIDENCE-036: The unsigned envelope MUST be a separately typed, visibly unsigned document with
+the member set fixed by `products/evidence/contracts/jws-profile.yaml`.
+It carries no integrity protection, is never later-verifiable evidence, and MUST NOT be produced as a
+fallback from any signed-path failure.
+The strict JWS verifier MUST reject it, and Version 1 MUST NOT use an unsecured JWS, an empty
+signature, or a JWS-shaped unsigned object.
+
+### 7.2 SD-JWT VC serialization
+
+REQ-PR-EVIDENCE-037: The SD-JWT VC format MUST be a serialization of the same Version 1 assertion and
+MUST NOT introduce a credential lifecycle.
+Everything before serialization is the unchanged path: one authorization decision, fixed source
+execution, bounded derivation, output validation, audience-scoped subject binding, and the same
+durable access and disclosure-release audit ordering
+(`products/evidence/contracts/sd-jwt-vc-profile.yaml`).
+
+REQ-PR-EVIDENCE-038: The profile non-goals in
+`products/evidence/contracts/sd-jwt-vc-profile.yaml` MUST NOT be implemented, stubbed,
+feature-flagged, or left as an extension seam.
+They include OID4VCI in any part, persistent issuance state, status lists and revocation,
+presentation-side verification and key-binding JWT validation, wallet onboarding and attestation,
+holder-scoped or cross-verifier subject identifiers, and reissuance, refresh, batch issuance, or
+persistent credential identifiers.
+
+REQ-PR-EVIDENCE-039: The credential claim set MUST be closed.
+The always-disclosed claims, root-value disclosure rule, optional direct-field disclosure for a
+configured `reviewed-structured-value`, digest ordering, fresh per-disclosure salt, and prohibited
+claims are fixed by
+`products/evidence/contracts/sd-jwt-vc-profile.yaml`.
+Nested field values remain atomic, and the complete structured value MUST pass its reviewed schema
+before serialization.
+The issuer MUST NOT append a key-binding JWT.
+
+REQ-PR-EVIDENCE-040: A holder confirmation claim MUST be present only when the caller supplied a
+holder public key in the request, and Evidence MUST NOT validate a presentation.
+The accepted key type and the prohibited private members are fixed by
+`products/evidence/contracts/request.schema.yaml` and
+`products/evidence/contracts/sd-jwt-vc-profile.yaml`; a key carrying any private member, a
+non-allowlisted algorithm, or an unparseable body MUST fail before credential acquisition or source
+access.
+
+REQ-PR-EVIDENCE-041: The credential's subject binding MUST remain audience-scoped, so the credential
+is meaningful only to the relying party named in the assertion's audience.
+Adopter-facing material MUST state this limit rather than implying a general multi-verifier
+credential (`products/evidence/contracts/sd-jwt-vc-profile.yaml`).
+
+## 8. Problem reporting
+
+REQ-PR-EVIDENCE-042: A failure MUST be reported as `application/problem+json`
+([RFC 9457](https://www.rfc-editor.org/info/rfc9457)) carrying exactly the members and one of the
+codes declared by `products/evidence/contracts/problem-contract.yaml`.
+The prohibited content list in that file MUST hold: no request body or selector material, no
+principal, actor, grant, token, credential, or authorization input, no source detail, no script
+detail, no supported value or subject binding, and no candidate count, score, hint, or comparison.
+
+REQ-PR-EVIDENCE-043: The unresolved internal classes named in
+`products/evidence/contracts/problem-contract.yaml` MUST collapse by default to one public code with
+the same status, title, and body shape.
+Processing and response handling MUST be uniform and bounded to avoid class-dependent delay, and
+existence MAY be disclosed only as a separately authorized fixed concept, never as error detail
+(invariant `V1-I16`).
+
+REQ-PR-EVIDENCE-044: A duplicate, combined, parameterized, quality-weighted, or unknown content
+negotiation MUST return the negotiation problem before source access, and a recognized but
+unpermitted format request MUST return the ordinary authorization problem
+(`products/evidence/contracts/problem-contract.yaml`).
+
+REQ-PR-EVIDENCE-045: Transient failures MUST be mapped to the public transient codes in
+`products/evidence/contracts/problem-contract.yaml`.
+A retry hint is permitted only for bounded transient failures and MUST NOT be derived from protected
+source content.
+
+## 9. Audit behavior
+
+REQ-PR-EVIDENCE-046: Evidence MUST durably accept an access-attempt event after authorization and
+before credential acquisition or source access, and a disclosure-release event after the final
+immutable response bytes are serialized and before those exact bytes are released.
+A sink failure MUST block the applicable step
+(`products/evidence/contracts/audit-event.schema.yaml`, invariants `V1-I13` and `V1-I29`).
+
+REQ-PR-EVIDENCE-047: Every native audit event MUST validate against
+`products/evidence/contracts/audit-event.schema.yaml`, which closes the member set, the phase and
+decision enumerations, and the conditional members.
+
+REQ-PR-EVIDENCE-048: Every native event MUST record the closed response-protection mode resolved with
+authorization.
+A signing key identity MUST be present exactly for cryptographically protected disclosure release and
+MUST be absent for unsigned output
+(`products/evidence/contracts/audit-event.schema.yaml`, invariant `V1-I30`).
+
+REQ-PR-EVIDENCE-049: Audit MUST NOT record the values listed under the never-record rule in
+`products/evidence/contracts/audit-event.schema.yaml`, including raw principal, actor, grant,
+selector, source, and supported values, the request nonce, credentials and bodies, candidate counts
+and comparisons, and script inputs, outputs, or signing material.
+Identity MUST travel only as domain-separated keyed pseudonyms (invariant `V1-I15`).
+
+REQ-PR-EVIDENCE-050: Authentication, unmatched-authority, and invalid-selector failures occur before
+a privacy-safe authority and complete selector bundle exist, so Evidence MUST NOT fabricate a native
+event from that untrusted or protected request material
+(`products/evidence/contracts/audit-event.schema.yaml`).
+
+REQ-PR-EVIDENCE-051: At startup and after restart, Evidence MUST recover the prior chain head from
+the newest sealed segment, when one exists, and MUST verify the complete active segment from that
+head before serving.
+Startup and readiness MUST NOT rescan sealed history.
+External replacement or modification of the active segment or lock file MUST fail readiness and
+close future appends for the process lifetime.
+The operator MUST run `evidence verify-audit` to verify complete retained history across every
+available sealed segment and, when the writer is stopped, the active segment.
+Mutation within older sealed history is detected by that complete out-of-band verification, not by
+serving-process startup or readiness
+(`products/evidence/contracts/audit-event.schema.yaml`,
+`products/evidence/OPERATOR-CONTRACT.md`).
+
+## 10. Immutability of deployment input
+
+REQ-PR-EVIDENCE-052: Configuration MUST be immutable for the serving process lifetime.
+Evidence MUST load one read-only atomic governed bundle and one separately digested closed runtime
+file at startup; runtime override, reload, merge, fallback, and mutation paths MUST NOT exist
+(invariant `V1-I18`, `products/evidence/contracts/runtime.schema.yaml`).
+
+REQ-PR-EVIDENCE-053: The runtime file MUST own only the process-local bindings enumerated under
+`ownership.allowed` in `products/evidence/contracts/runtime.schema.yaml` and MUST NOT override
+governed semantics or source authority.
+Unknown keys MUST be rejected at every level.
+
+REQ-PR-EVIDENCE-054: A missing, writable, or unreviewed bundle MUST NOT be treated as trusted
+configuration.
+Version 1 has no in-bundle trust override, and absence or a failed immutability check MUST fail
+readiness (`products/evidence/contracts/security-invariant-matrix.yaml`, cross-cutting config trust).
+
+REQ-PR-EVIDENCE-055: One process MUST serve one operator-controlled trust domain, with one service
+trust domain, issuer governance boundary, bundle lifecycle, signer, and audit boundary
+(invariant `V1-I19`).
+
+REQ-PR-EVIDENCE-056: The bundle revision MUST be a digest over the complete atomic bundle bytes and
+layout manifest, and MUST be carried in every assertion and in every native audit event in the form
+fixed by `products/evidence/contracts/evidence.schema.yaml` and
+`products/evidence/contracts/audit-event.schema.yaml`
+(`products/evidence/contracts/cccev-field-mapping.yaml`).
+
+## 11. Assurance profiles
+
+The immutable bundle carries exactly one governed `assuranceProfile`: `local`, `production`, or
+`evidence-grade`.
+The profile describes the bundle's reviewed assurance boundary; it does not replace authentication,
+authorization, source, signing, audit, or disclosure controls.
+
+REQ-PR-EVIDENCE-057: Every definition-discovery response, assertion encoding, and native audit event
+MUST carry the governed assurance profile.
+Verification of either protected assertion format MUST compare that value with an independently
+configured expected assurance profile and MUST use the generic policy failure for a mismatch
+(`products/evidence/contracts/definitions.schema.yaml`,
+`products/evidence/contracts/evidence.schema.yaml`,
+`products/evidence/contracts/audit-event.schema.yaml`,
+`products/evidence/contracts/verification-policy.schema.yaml`, invariant `V1-I35`).
+
+REQ-PR-EVIDENCE-058: Only the `local` assurance profile MAY omit requirement fixture references
+during authoring.
+`production` and `evidence-grade` bundles MUST provide complete referenced fixtures and MUST fail
+bundle loading when that fixture contract is absent or incomplete.
+The `local` exception MUST NOT weaken any serving-path authentication, authorization, immutability,
+source, signing, audit, or disclosure control (invariant `V1-I34`,
+`products/evidence/contracts/bundle.schema.yaml`).
+
+REQ-PR-EVIDENCE-059: Credential-free source access MUST be accepted only under the `local` assurance
+profile, for one canonical numeric-loopback HTTP origin with an explicit non-zero port and no TLS
+trust profile.
+It MUST send no authentication header.
+`production` and `evidence-grade` bundles MUST reject credential-free source authentication
+(invariant `V1-I36`, `products/evidence/contracts/source-contract.yaml`,
+`products/evidence/contracts/bundle.schema.yaml`).
+
+## 12. Limitations
+
+These constraints are stated so a reader does not infer a capability from the route list or the
+credential format that the frozen Version 1 contracts do not provide.
+
+- Credential lifecycle: The SD-JWT VC output adds a response format only. No offer, code, nonce,
+  status, revocation, presentation verification, or persisted credential state exists
+  (REQ-PR-EVIDENCE-037, REQ-PR-EVIDENCE-038).
+- Cross-verifier use: The credential subject binding is audience-scoped, so it is meaningful to one
+  relying party and correlatable across none (REQ-PR-EVIDENCE-041).
+- Nonce semantics: The request nonce is uninterpreted correlation data. Reuse is not rejected, and
+  the nonce is not replay prevention (REQ-PR-EVIDENCE-014).
+- Unsigned output: Transport-authenticated convenience only, never later-verifiable evidence and
+  never a fallback from a signed-path failure (REQ-PR-EVIDENCE-036).
+- Signature meaning: Provider authentication and payload integrity only, not legal-signature status,
+  source truth, or holder possession (REQ-PR-EVIDENCE-035).
+- Identity resolution: Lookup is match, no-match, or ambiguous. Evidence is not an
+  identity-resolution engine and returns no candidate material (REQ-PR-EVIDENCE-019).
+- Purpose attestation: A declared purpose is an authorized selection from the granted set, not an
+  identity-provider attestation, unless the operator issues a distinct requester tag per purpose
+  (`products/evidence/OPERATOR-CONTRACT.md`).
+- Rate-limit scope: Rate controls are per process and in memory, so replicas multiply every
+  configured limit and a restart resets every budget
+  (`products/evidence/OPERATOR-CONTRACT.md`, REQ-PR-EVIDENCE-011).
+- Disclosure-family review: The declared disclosure families are a trusted bundle-review attestation,
+  not a semantic classifier. Combined-surface review is an operator duty
+  (`products/evidence/OPERATOR-CONTRACT.md`, REQ-PR-EVIDENCE-025).
+- Assurance profile: `local` identifies authoring assurance, not deployable assurance. A verifier
+  expecting `production` or `evidence-grade` rejects an authentic `local` assertion
+  (REQ-PR-EVIDENCE-057, REQ-PR-EVIDENCE-058).
+- Credential-free sources: The exception exists only for `local` authoring against an exact numeric
+  loopback origin. It is not available to `production` or `evidence-grade` bundles
+  (REQ-PR-EVIDENCE-059).
+- Telemetry: Metrics are off by default and, when enabled, are served on a separate operator-private
+  listener that the public evidence contract does not describe
+  (`products/evidence/contracts/runtime.schema.yaml`, invariant `V1-I33`).
+- Platform: Version 1 supports Unix targets only, because its secret and audit invariants require
+  owner, mode, no-follow, link-count, and file-identity guarantees
+  (`products/evidence/contracts/runtime.schema.yaml`).
+- Standards claims: The CCCEV alignment is a documented mapping with explicit Evidence extensions,
+  and the SD-JWT VC output follows a frozen local profile
+  (`products/evidence/contracts/cccev-field-mapping.yaml`,
+  `products/evidence/contracts/sd-jwt-vc-profile.yaml`).
+
+## Conformance
+
+An Evidence deployment conforms to this specification when it:
+
+- exposes only the generated OpenAPI surface, keeps definition discovery authenticated and
+  requester-scoped, grants no authority through discovery, and publishes key material as
+  non-anchoring discovery (REQ-PR-EVIDENCE-001, REQ-PR-EVIDENCE-002, REQ-PR-EVIDENCE-003,
+  REQ-PR-EVIDENCE-004);
+- authenticates every protected operation with one bearer token, derives the principal only from the
+  configured claim, and resolves one complete authorization decision without unioning entitlements
+  (REQ-PR-EVIDENCE-005, REQ-PR-EVIDENCE-006, REQ-PR-EVIDENCE-007);
+- refuses authority from caller data, enforces value origins, denies sender-constrained tokens, and
+  applies rate controls as defense in depth (REQ-PR-EVIDENCE-008, REQ-PR-EVIDENCE-009,
+  REQ-PR-EVIDENCE-010, REQ-PR-EVIDENCE-011);
+- validates the closed request, rejects caller-supplied query material, enforces the request nonce
+  contract, admits only predefined requirement revisions, and resolves subject roles by name
+  (REQ-PR-EVIDENCE-012, REQ-PR-EVIDENCE-013, REQ-PR-EVIDENCE-014, REQ-PR-EVIDENCE-015,
+  REQ-PR-EVIDENCE-016);
+- keeps trust decisions in Rust with scripts confined to the closed entry points, makes exactly one
+  fixed source request per evaluation, returns only the closed lookup union, and fails closed
+  (REQ-PR-EVIDENCE-017, REQ-PR-EVIDENCE-018, REQ-PR-EVIDENCE-019, REQ-PR-EVIDENCE-022);
+- treats adult status, controlled residence region, professional licence status, and legal-parent
+  relationship as coequal full-path acceptance definitions with no privileged domain type, and
+  enforces the output gate before evidence construction (REQ-PR-EVIDENCE-020, REQ-PR-EVIDENCE-021);
+- discloses only declared supported values, binds subjects as audience-scoped opaque values, reviews
+  the enabled bundle as one disclosure surface, keeps source and selector values out of logs and
+  audit, and does not vary disclosure by purpose (REQ-PR-EVIDENCE-023, REQ-PR-EVIDENCE-024,
+  REQ-PR-EVIDENCE-025, REQ-PR-EVIDENCE-026, REQ-PR-EVIDENCE-027);
+- makes signed JWS the mandatory default, gates every other format on bundle and grant permission,
+  never falls back on signing failure, keeps private key material core-owned, and releases only
+  pre-audited bytes (REQ-PR-EVIDENCE-028, REQ-PR-EVIDENCE-029, REQ-PR-EVIDENCE-030,
+  REQ-PR-EVIDENCE-031, REQ-PR-EVIDENCE-032);
+- serializes the signed format with the closed header and payload rules, states the limited meaning
+  of a signature, and keeps the unsigned envelope separately typed and never a fallback
+  (REQ-PR-EVIDENCE-033, REQ-PR-EVIDENCE-034, REQ-PR-EVIDENCE-035, REQ-PR-EVIDENCE-036);
+- serializes SD-JWT VC as the same assertion under the frozen profile, implements none of its
+  non-goals, closes the claim set, embeds a holder key only when supplied, and keeps the binding
+  audience-scoped (REQ-PR-EVIDENCE-037, REQ-PR-EVIDENCE-038, REQ-PR-EVIDENCE-039,
+  REQ-PR-EVIDENCE-040, REQ-PR-EVIDENCE-041);
+- reports failures as closed problem documents, collapses unresolved classes, refuses unacceptable
+  negotiation before source access, and bounds retry hints (REQ-PR-EVIDENCE-042,
+  REQ-PR-EVIDENCE-043, REQ-PR-EVIDENCE-044, REQ-PR-EVIDENCE-045);
+- audits at both durable gates, validates every event against the closed schema, records the
+  response-protection mode and signing key identity correctly, records no protected value, fabricates
+  no event from untrusted material, and verifies the keyed chain (REQ-PR-EVIDENCE-046,
+  REQ-PR-EVIDENCE-047, REQ-PR-EVIDENCE-048, REQ-PR-EVIDENCE-049, REQ-PR-EVIDENCE-050,
+  REQ-PR-EVIDENCE-051);
+- treats deployment input as immutable, restricts the runtime file to process-local bindings, fails
+  readiness on an untrusted bundle, serves one trust domain, and carries the bundle revision in every
+  assertion and audit event (REQ-PR-EVIDENCE-052, REQ-PR-EVIDENCE-053, REQ-PR-EVIDENCE-054,
+  REQ-PR-EVIDENCE-055, REQ-PR-EVIDENCE-056);
+- carries the governed assurance profile through discovery, assertions, audit, and verification,
+  confines fixture omission and credential-free loopback sources to `local`, and refuses those
+  exceptions under `production` and `evidence-grade` (REQ-PR-EVIDENCE-057,
+  REQ-PR-EVIDENCE-058, REQ-PR-EVIDENCE-059).
+
+Conformance to this specification does not imply conformance to any external standard cited in the
+`standards_referenced` frontmatter field.
+Each standard's adoption mode and scope are documented in the
+[standards register](../../reference/standards/).
+
+## Evidence
+
+This specification is `verified`: its requirements cite inspectable frozen contracts, generated
+artifacts, implementation tests, or operator material, per RS-DOC REQ-DOC-014.
+The standards register does not yet list `registry-evidence` under the entries this page references;
+that evidence gap remains marked with an author comment in the source of this page.
+
+- The frozen source contracts live in `products/evidence/contracts/`, indexed by
+  `products/evidence/contracts/README.md`. Each requirement in Sections 2 through 11 names the file
+  it restates.
+- The route and schema surface is `products/evidence/generated/registry-evidence.openapi.json`, and
+  the running service publishes that same document.
+- The `evidence-contracts` job in `.github/workflows/ci.yml` runs
+  `products/evidence/scripts/check-contracts.sh`, which regenerates the artifacts under
+  `products/evidence/generated/` from the `registry-evidence` crate into a temporary directory and
+  fails on any byte difference from the committed set. The same job runs
+  `products/evidence/scripts/check-source-neutrality.sh`.
+- Narrative contracts and requirements that are not generated remain review-owned. Their cited tests
+  and traceability entries are inspectable evidence, not a claim that CI mechanically proves every
+  sentence in those documents.
+- Every trust and privacy invariant cited by identifier in this document is a row in
+  `products/evidence/contracts/security-invariant-matrix.yaml`, carrying its threat, Rust enforcement
+  point, and required negative test.
+- `products/evidence/contracts/security-test-traceability.yaml` and
+  `products/evidence/contracts/acceptance-test-traceability.yaml` resolve those named requirements to
+  exact executable Rust tests; the package contract test rejects a missing, extra, duplicated, or
+  stale reference.
+- Product framing, the Version 1 boundary, and the four coequal acceptance definitions are stated in
+  `products/evidence/README.md` and `products/evidence/CONCEPT.md`.
+- Operational duties cited throughout this specification are stated in
+  `products/evidence/OPERATOR-CONTRACT.md`.
+
+## Next
+
+- [Registry Evidence API reference](../../reference/apis/registry-evidence/) is the route-level
+  reference and the link to the generated OpenAPI document.
+- [RS-ARC-G](../rs-arc-g/) places the registry stack services in one architecture.
+- [RS-SEC-G](../rs-sec-g/) holds the cross-product security model this protocol sits inside.
+- [RS-PR-RELAY](../rs-pr-relay/) specifies Registry Relay, the separate product that serves
+  protected reads over data an institution already holds.
diff --git a/docs/site/src/content/docs/spec/rs-pr-notary.mdx b/docs/site/src/content/docs/spec/rs-pr-notary.mdx
deleted file mode 100644
index dfb9bcfcf..000000000
--- a/docs/site/src/content/docs/spec/rs-pr-notary.mdx
+++ /dev/null
@@ -1,374 +0,0 @@
----
-title: "RS-PR-NOTARY: Registry Notary protocol"
-description: "The normative HTTP protocol contract for Registry Notary: discovery, authentication, claim evaluation, disclosure semantics, credential issuance, static-peer delegated evaluation, and audit behavior."
-status: draft
-owner: registry-docs
-source_repos:
-  - registry-notary
-  - registry-platform
-last_reviewed: "2026-07-07"
-doc_type: specification
-doc_id: RS-PR-NOTARY
-category: normative
-evidence: verified
-locale: en
-standards_referenced:
-  - sd-jwt-vc
-  - oid4vci
-  - cccev
-  - json-ld
-  - w3c-did
-  - openapi
-layer:
-  - evaluation
-  - credential
-  - federation
-audience:
-  - integrator
-  - specification editor
----
-
-This document defines the HTTP protocol contract that Registry Notary exposes: how a caller authenticates, discovers capabilities, authorizes compiler-pinned Relay consultations, optionally uses subject access before evaluation, controls disclosure, receives an evaluation result in a supported render format, obtains an SD-JWT VC credential directly or through an OID4VCI wallet flow, uses delegated subject access for dependent claims, delegates evaluation to a peer, and what audit and error behavior every request carries. It is the precise, citable version of the behavior the [Registry Notary API reference](../../reference/apis/registry-notary/) describes narratively.
-
-It refines the Registry Notary component defined in [RS-ARC-G](../rs-arc-g/) Section 3 (specifically REQ-ARC-G-004, REQ-ARC-G-007, REQ-ARC-G-008, and REQ-ARC-G-009) one level of detail down, from architectural boundary to wire behavior. Where this document and RS-ARC-G state the same constraint, RS-ARC-G is the general invariant and this document is its protocol-level form.
-
-The key words in this document are interpreted per [RS-DOC](../rs-doc/) Section 2. Defined terms are used per [RS-TERMS](../rs-terms/).
-
-## Version history
-
-| Version | Date | Status | Change |
-| --- | --- | --- | --- |
-| 0.1.0 | 2026-06-13 | draft | Initial protocol contract, distilled from the Registry Notary API reference, the evidence-issuance explanation, and the generated OpenAPI document. |
-| 0.1.1 | 2026-06-20 | draft | Document governed source policy decisions, source-bound purpose and freshness constraints, subject access trust context, audit provenance, and scoped OID4VCI behavior. |
-| 0.1.2 | 2026-06-21 | draft | Clarified source adapter sidecar isolation assumptions and demo/template freshness boundaries. |
-| 0.1.3 | 2026-06-22 | draft | Document delegated subject access, proof-claim gating, explicit dependent-target binding, delegated denial reasons, and the OID4VCI delegated-token rejection boundary. |
-| 0.1.4 | 2026-06-27 | draft | Clarified OIDC principal derivation, issuer-bound Notary transaction authorization details, and nonce expiry enforcement for OID4VCI holder proofs. |
-| 0.1.5 | 2026-07-07 | draft | Editorial: pointed the Relay-protocol reference at published RS-PR-RELAY and added explicit evidence citations for REQ-PR-NOTARY-034/035/036. |
-| 0.2.0 | 2026-07-13 | draft | Removed direct registry source connectors and sidecars. Registry-backed claims now consume compiler-pinned Relay consultations. |
-| 0.3.0 | 2026-07-19 | draft | Restricted OID4VCI to registry-backed issuer-initiated pre-authorized code, and defined algorithm, transaction-code, status, topology, and unsupported-profile boundaries. |
-| 0.4.0 | 2026-07-30 | draft | Required every claim and federation profile to use compiler-pinned Relay evidence and renamed subject-access modes. |
-
-## 1. Scope and references
-
-This specification covers Registry Notary's externally observable protocol behavior:
-
-- Authentication and per-claim authorization.
-- The discovery surface and its access posture.
-- Authorization and policy decisions before Relay consultation or claim evaluation.
-- The claim-evaluation request and response contract, including disclosure semantics and response formats.
-- Credential issuance over the direct API and over the OID4VCI wallet flow.
-- Delegated subject access for configured requester-dependent relationships.
-- Delegated (federated) evaluation between configured peers.
-- The audit obligation and the error format.
-
-This specification does not define:
-
-- Exact routes and schemas: The generated OpenAPI document, rendered as the [Registry Notary API reference](../../reference/apis/registry-notary/), is the authoritative route and schema reference. This document states behavior a schema cannot, and does not restate request and response shapes that would drift from the generated source.
-- The claim definition data model: How a `ClaimDefinition` declares its evidence mode, Relay consultation bindings, rule, disclosure policy, formats, and credential eligibility belongs to [RS-DM-CLAIM](../rs-dm-claim/). This document refers to those fields only where they govern protocol behavior.
-- Security model internals: Key management, token fingerprinting, and the OIDC trust configuration belong to [RS-SEC-G](../rs-sec-g/) and deeper security specifications. This document states the authorization behavior a caller observes.
-- Registry Relay's protocol: Relay's consultation API is a separate surface, specified in [RS-PR-RELAY](../rs-pr-relay/). This document specifies only how Notary binds and invokes a compiler-pinned Relay consultation.
-
-For the motivation and worked examples behind this contract, see [Evidence issuance, end to end](../../explanation/evidence-issuance/). For the architecture this protocol sits in, see [RS-ARC-G](../rs-arc-g/). Media types are named per [RS-TERMS](../rs-terms/) Section 2.
-
-## 2. Service surface and discovery
-
-Registry Notary is a standalone HTTP service for claim evaluation, disclosure policy, credential issuance, and audit (REQ-ARC-G-007). It can start without configured claims, but every evaluatable claim requires a compiler-pinned Registry Relay consultation.
-
-REQ-PR-NOTARY-001: Registry Notary MUST be independently deployable. It MAY start without Registry Relay when no claims are configured. A configured claim MUST NOT become ready or evaluate without its pinned Relay consultation contract.
-
-A caller discovers Notary's capabilities and claim catalog at `GET /.well-known/evidence-service`. The issuer's public verification keys are published at `GET /.well-known/evidence/jwks.json`, and the OID4VCI issuer metadata at `GET /.well-known/openid-credential-issuer`.
-
-REQ-PR-NOTARY-002: The capability-discovery route (`GET /.well-known/evidence-service`) MUST require authentication; it is not a public discovery endpoint. The issuer JWKS (`GET /.well-known/evidence/jwks.json`) MUST be served without authentication, because a verifier needs the public key without holding a Notary credential.
-
-## 3. Authentication and authorization
-
-Registry Notary runs in one of two authentication modes, selected by configuration.
-
-- Static credentials: The caller presents an `x-api-key` token or an `Authorization: Bearer` token. Notary fingerprints the presented token and compares it, in constant time, against `sha256:<...>` values loaded at startup. Each credential carries a `scopes` list.
-- OIDC: Notary delegates token verification to Registry Platform OIDC primitives (issuer, JWKS URI, audiences, algorithms, scope mapping) and still owns the scopes its claim routes require.
-
-REQ-PR-NOTARY-003: Every claim-bearing route MUST authenticate the caller, in static-credential mode (constant-time fingerprint comparison of an `x-api-key` or `Authorization: Bearer` token) or in OIDC mode (token verification delegated to Registry Platform primitives).
-
-REQ-PR-NOTARY-004: Registry Notary MUST enforce a claim's required scopes before it evaluates the claim or calls Registry Relay. A caller whose credential lacks a required scope MUST be refused before Relay or claim work, not after.
-
-REQ-PR-NOTARY-034: In OIDC mode, Registry Notary MUST derive its authenticated principal from the configured principal claim, using `sub` by default.
-A matched client id, authorized party, or audience MAY participate in token verification, scope mapping, or subject access classification, but MUST NOT substitute for a missing configured principal claim.
-
-When a claim declares governed policy, Notary evaluates the supported Evidence Gateway PDP profile before a Relay consultation. The supported profile covers policy identity and hash, supported ODRL purpose and spatial terms, claim purpose, jurisdiction, assurance, freshness represented by trusted Relay provenance, required legal basis and consent, relationship and relationship-purpose constraints, requested fact, requested disclosure, requested credential format, route identity, checked scope, redaction, and unsupported policy terms. Caller-supplied target fields do not satisfy trust-context gates that require a trusted principal authorization context.
-
-REQ-PR-NOTARY-023: Before a Relay consultation, Registry Notary MUST obtain the applicable policy decision for the claim. A denial MUST fail closed with the stable PDP denial code produced for that gate and MUST NOT be retried through a less governed path.
-
-REQ-PR-NOTARY-024: Notary MUST require the request purpose to match the claim purpose and the compiler-pinned Relay consultation purpose for a registry-backed claim. A mismatch MUST deny before Relay access.
-
-The internals of key handling and OIDC trust configuration are a security-model concern specified by [RS-SEC-G](../rs-sec-g/).
-
-## 4. Claim evaluation
-
-A claim evaluation moves typed request inputs through a compiler-pinned Relay consultation, then a rule, disclosure policy, and response format. The narrative form of this pipeline, with worked examples, is in [Evidence issuance, end to end](../../explanation/evidence-issuance/).
-
-```mermaid
-flowchart LR
-    subject["Typed request inputs<br/>(from authorized caller)"]
-    evidence["Evidence mode<br/>Relay consultation · subject access"]
-    rule["Rule<br/>consultation output · consultation matched · cel"]
-    disclosure["Disclosure mode<br/>value · predicate · redacted"]
-    format["Evaluation render format<br/>claim-result JSON · CCCEV JSON-LD"]
-    credential["Credential issuance<br/>SD-JWT VC"]
-    subject --> evidence --> rule --> disclosure --> format
-    disclosure --> credential
-```
-
-The diagram restates the pipeline: an authorized caller supplies the configured target and request inputs plus a claim id. The claim invokes exactly the pinned Relay consultation. The rule evaluates, disclosure constrains the output, and the result can be rendered as claim-result JSON or CCCEV-shaped JSON-LD. SD-JWT VC output is materialized through the credential issuance surface in Section 7. A caller does not supply the evaluated value.
-
-REQ-PR-NOTARY-005: Claim evaluation MUST be performed by Registry Notary over its configured evidence mode. The caller supplies only the configured request inputs and claim id and MUST NOT supply the evaluated value. This is the protocol-level form of REQ-ARC-G-007.
-
-REQ-PR-NOTARY-006: Registry Notary MUST NOT configure or execute a direct registry source connector. A registry-backed claim MUST bind one or more compiler-pinned Registry Relay consultations by profile id and contract hash. The request purpose and typed inputs MUST match the pinned contract before Notary calls Relay. Source origins, credentials, HTTP or script execution, protocol helpers, snapshots, and output minimization belong to Relay.
-
-REQ-PR-NOTARY-007: A claim's rule MUST be one of the implemented rule types: `consultation_output`, `consultation_matched`, or `cel`. The `plugin` rule type is declared in configuration but is unimplemented at the reviewed commit; a conforming claim MUST NOT depend on it.
-
-REQ-PR-NOTARY-025: When a registry-backed claim requires freshness, Registry Notary MUST derive freshness from the verified Relay consultation provenance, not from caller-supplied freshness. Stale, absent, or malformed required provenance MUST deny before disclosure or credential materialization.
-
-`POST /v1/evaluations` evaluates a single claim; `POST /v1/batch-evaluations` evaluates several in one request. An evaluation is retained under an `evaluation_id` so it can later be rendered (Section 6) or materialized into a credential (Section 7) without re-reading the source.
-
-## 5. Disclosure semantics
-
-Registry Notary controls what a caller receives through three disclosure modes, each governed by `default` and `allowed` settings in the claim definition: `value` (the full value), `predicate` (only the true/false satisfaction), and `redacted` (the value fully hidden).
-
-REQ-PR-NOTARY-008: Every evaluation result MUST record the disclosure mode applied (`value`, `predicate`, or `redacted`).
-
-REQ-PR-NOTARY-009: When the caller requests a disclosure mode, Registry Notary MUST refuse a mode not in the claim's `allowed` set, and MUST apply the claim's `default` mode when the caller requests none.
-
-REQ-PR-NOTARY-010: A `redacted` result MUST NOT carry the underlying source value, and MUST NOT convey the satisfaction outcome: the result body withholds both the value and the predicate. The evaluation stays identified by its `evaluation_id`, and the audit record carries a `verification_id` and a `claim_hash` so the evaluation can be referenced and verified without disclosing the value.
-
-## 6. Response formats
-
-An evaluation can be returned in two render formats, selected by content negotiation and constrained by the claim's configured `formats`:
-
-- Claim-result JSON: `application/vnd.registry-notary.claim-result+json`.
-- CCCEV-shaped JSON-LD: `application/ld+json; profile="cccev"`.
-
-A stored evaluation can be re-rendered through `POST /v1/evaluations/{evaluation_id}/render`. The supported render formats are listed at `GET /v1/formats`. SD-JWT VC credentials are materialized from stored evaluations through Section 7, not returned by the render endpoint.
-
-REQ-PR-NOTARY-011: Registry Notary MUST be able to return an evaluation as the claim-result JSON media type (`application/vnd.registry-notary.claim-result+json`). It MAY also return CCCEV-shaped JSON-LD when the claim's `formats` permit and the caller negotiates for it. It MUST NOT treat SD-JWT VC credential issuance as a render format; SD-JWT VC materialization is governed by Section 7 and Section 8.
-
-REQ-PR-NOTARY-012: CCCEV-shaped output MUST NOT assert conformance to CCCEV 2.00. The output is a profiled subset, consumed by parsing the `@graph` for `cccev:Evidence` nodes; the [standards register](../../reference/standards/) records the claim level.
-
-## 7. Credential issuance
-
-Registry Notary materializes a credential from a stored evaluation through `POST /v1/credentials`. The credential is an SD-JWT VC, which gives the holder selective disclosure: the holder chooses which fields to reveal to which verifier.
-
-Every configured claim derives from exactly one compiler-pinned Relay
-consultation. Credential profiles, subject-access allow-lists, federation
-profiles, and OID4VCI projections select only `registry_backed` claims.
-
-REQ-PR-NOTARY-013: An issued credential MUST be an SD-JWT VC with media type and `typ` header `dc+sd-jwt`, signed with the credential profile's configured EdDSA (Ed25519) or ES256 (P-256) key. No W3C Verifiable Credentials Data Model JSON-LD envelope or namespace is present in the issued credential. This is the protocol-level form of REQ-ARC-G-008.
-
-REQ-PR-NOTARY-014: The signed credential body MUST carry the SHA-256 digest of each selectively disclosable field rather than the field value, so an unselected field stays hidden and a holder cannot present a disclosure that was not in the original credential.
-
-REQ-PR-NOTARY-015: A credential MUST bind its holder by naming the holder's public key as a `did:jwk` in the `cnf` claim. `did:jwk` is the only supported binding method. Presentation MUST require a fresh holder proof from that key, audience-bound to the verifier, so a credential without the matching private key is not presentable.
-
-The issuer signing key is sourced from configuration as an Ed25519 or P-256 JWK. Its public half is published at `GET /.well-known/evidence/jwks.json`.
-
-REQ-PR-NOTARY-038: A credential with a `status.status_list` claim MUST keep that top-level claim outside selective disclosure. A conforming client verifier MUST retrieve the signed status token only from the configured exact HTTPS trusted origin and MUST fail closed when status is missing, malformed, untrusted, unavailable, suspended, revoked, expired, or otherwise invalid.
-
-REQ-PR-NOTARY-037: Before direct or OID4VCI issuance, Registry Notary MUST
-reconstruct every selected root's executed registry-backed dependency closure.
-It MUST require exactly one private compiler-pin record for every claim in the
-combined closure and exactly one normalized execution record for every unique
-executed consultation ULID, with no missing, duplicate, or extra record. Claim
-pins MUST match the active claim id and version, Relay profile id and contract
-hash, canonical purpose, and referenced consultation ULID. Execution records
-MUST match the acquired time. Each claim pin MUST carry a deterministic
-SHA-256 execution binding over the pin, execution ULID and acquisition time,
-evaluation and result time, and exact claim provenance; Notary MUST recompute
-that binding before signer access. Each public root result's
-`relay_consultation_count` MUST equal the number of unique executed ULIDs in
-that root's closure. One coalesced Relay execution MAY support several claims
-but MUST appear once in the normalized execution set. Legacy, incomplete,
-stale, or modified provenance MUST be denied before signer access, signing,
-credential identifiers, or status writes. Direct issuance MUST perform this
-check before holder-proof replay mutation. OID4VCI MUST reject a credential
-configuration without complete Relay-backed provenance, create and evaluate the registry transaction before
-rendering an offer, consume the transaction-bound proof nonce at the credential
-endpoint, and verify the stored transaction and evaluation before signer
-access. Existing stored evaluations without the private records MAY remain
-readable and renderable but MUST be re-evaluated before issuance.
-
-The private claim pins and execution records MUST be retained only when all
-selected roots share a mutually validated credential profile. A
-registry-backed evaluation-only selection MUST remain evaluatable and
-renderable without retaining private Relay ids or acquisition times. The
-execution binding is an unkeyed partial-mutation check, not an authenticity
-guarantee against an operator able to rewrite all committed fields and
-recompute it.
-
-Subject access is a constrained authorization context, not a caller-provided claim value. It binds the authenticated citizen principal to configured claims, purposes, disclosures, formats, subject binding, assurance requirements, and token age limits before Relay-backed evaluation. Direct subject access can authorize issuance for a registry-backed claim with a mutually bound credential profile. Delegated subject access can authorize issuance only through an OID4VCI credential configuration that explicitly selects the digitally authenticated representative ceremony.
-
-REQ-PR-NOTARY-026: For subject access flows, Registry Notary MUST derive the subject and assurance context from the authenticated principal and configured subject binding. It MUST NOT let the caller choose a different subject, claim, purpose, disclosure, format, or credential profile outside the subject access policy, and MUST audit subject access decisions without raw subject identifiers or bearer tokens.
-
-REQ-PR-NOTARY-035: Where subject access evaluate receives a Notary-issued transaction token, Registry Notary MUST require scoped authorization details for the requested evaluation.
-A Notary-issued transaction token is identified by the configured Notary access-token signing issuer and the transaction-token type, not by the `typ` value alone.
-Externally issued OIDC tokens that use a standard access-token `typ` MAY rely on configured subject access scopes and MUST NOT be forced into the Notary transaction-details profile solely because of that `typ`.
-
-Registry Notary has two subject access modes:
-
-- `subject_bound`: the authenticated principal is the credential subject.
-- `delegated_subject_access`: the authenticated principal is the requester, and a configured dependent target can be evaluated only when scoped authorization details name the same target, relationship, and proof claim.
-
-Delegated subject access is distinct from Section 9 federation. It does not delegate trust to a peer Notary. It stays inside the citizen/OIDC trust context and uses a compiler-pinned Relay relationship proof before the dependent claim.
-
-REQ-PR-NOTARY-029: For delegated subject access, Registry Notary MUST derive the requester from the authenticated principal, derive the relationship from scoped authorization details, require the scoped authorization details to bind the same dependent target by `target.id_type` and `target.id`, and reject caller-supplied `requester`, `relationship`, or `on_behalf_of` fields before any Relay consultation.
-
-REQ-PR-NOTARY-030: A delegated relationship MUST be enabled in `subject_access.delegation.allowed_relationships`. The relationship MUST name a registry-backed `proof_claim`. That proof claim MUST bind exactly one compiler-pinned Relay consultation whose closed input mapping includes both requester and target identifiers. Every dependent claim allowed for that relationship MUST be explicitly allow-listed and MUST list the proof claim in `depends_on`. Delegated relationship and dependent-claim credential-profile bindings MUST be empty in 1.0; configuration load MUST reject them with remediation to remove the delegated credential capability or use a registry-backed, non-delegated credential claim.
-
-REQ-PR-NOTARY-031: A delegated Relay capability MUST bind the requester subject and dependent target with keyed hashes. Registry Notary MUST evaluate the proof consultation before the dependent claim and MUST deny the dependent claim when the proof is missing, fails, is ambiguous, or returns anything other than boolean `true`. It MUST NOT fall back to another consultation or subject access. Rendering a stored delegated evaluation MUST revalidate the current delegated authorization details, including the dependent-target binding, against the stored metadata. Direct and OID4VCI credential issuance MUST reject delegated evaluations before signer access.
-
-## 8. OID4VCI issuance flow
-
-For a wallet caller, Registry Notary exposes a narrow OpenID for Verifiable
-Credential Issuance (OID4VCI) profile. A citizen first authenticates in a
-browser. Notary consumes the identity provider's authorization code, derives
-the configured subject binding, creates and evaluates a registry transaction,
-and then renders an issuer-initiated pre-authorized offer. The wallet redeems
-that offer at Notary and proves control of an EdDSA `did:jwk` holder key. The
-flow does not create a caller-supplied credential evidence path.
-
-REQ-PR-NOTARY-016: The OID4VCI surface MUST advertise `dc+sd-jwt`, EdDSA
-`did:jwk` holder proof, and the credential profile's exact EdDSA or ES256 issuer
-algorithm. Registry Notary MUST NOT advertise full issuer, EUDI, HAIP, PAR,
-DPoP, wallet-attestation, ES256-holder, or general external-wallet conformance.
-Its capability-discovery document MUST declare
-`openid4vci.support: not_full_issuer`.
-
-REQ-PR-NOTARY-039: The only wallet-facing grant MUST be
-`urn:ietf:params:oauth:grant-type:pre-authorized_code`. The authorization code
-returned by the configured identity provider MUST remain an internal
-browser-to-Notary authentication input and MUST NOT be exposed or accepted as a
-wallet grant. Registry Notary MUST NOT expose the former public credential-offer
-or nonce routes, advertise a nonce endpoint, or return a next nonce from the
-credential endpoint.
-
-REQ-PR-NOTARY-027: Before rendering an offer, Registry Notary MUST validate the
-identity-provider response, derive the configured subject binding, create a
-transaction for the selected credential configuration, execute the exact
-compiler-pinned Relay consultation, and store the evaluation provenance. It
-MUST NOT render an offer for a delegated, failed, ambiguous,
-missing, or stale evaluation.
-
-REQ-PR-NOTARY-040: A pre-authorized offer MUST require a numeric `tx_code` by
-default. The code and PIN requirement MUST be bound to the signed offer. Missing
-or wrong PINs MUST fail, repeated wrong attempts MUST be bounded per offer, and
-invalid redemption attempts MUST be rate limited. An explicit `required: false`
-profile MAY support a wallet that cannot present a PIN, including the Walt
-compatibility profile, only when the pre-authorized code lifetime is no more
-than 300 seconds. In both modes the pre-authorized code MUST be single-use. The
-no-PIN offer MUST be treated as bearer credential material that a thief can
-redeem during its bounded lifetime.
-
-REQ-PR-NOTARY-017: The credential endpoint (`POST /oid4vci/credential`) MUST
-require a valid Notary-issued access token and one holder proof of possession.
-The holder proof MUST use EdDSA with `did:jwk`, MUST bind the credential issuer
-as audience, and MUST contain the fresh transaction-bound nonce returned by the
-token response. The nonce MUST be unexpired and single-use. ES256 holder proof
-MUST be rejected.
-
-REQ-PR-NOTARY-036: A Notary-issued access token MUST carry transaction-scoped
-authorization details that exactly match the stored transaction's credential
-configuration, action, service, claims, disclosure, format, purpose, subject
-binding, and direct subject-access mode. Missing, empty, context-only, or
-mismatched details MUST be denied before signer access. The credential endpoint
-MUST reload the stored transaction and evaluation and enforce
-REQ-PR-NOTARY-037 before signing.
-
-REQ-PR-NOTARY-032: Direct and OID4VCI credential endpoints MUST reject
-delegated-subject-access and registry-backed evaluation-only records
-before signer access. Credential issuance is available only for non-delegated
-registry-backed claims.
-
-REQ-PR-NOTARY-041: A deployment authority MUST pair one Registry Notary
-authority with one Registry Relay authority. Notary MUST own the PostgreSQL
-correctness state used for its transactions, pre-authorized codes, proof replay,
-evaluations, audit, and credential status. Explicit in-memory state MAY be used
-only for local single-process development.
-
-## 9. Delegated (federated) evaluation
-
-A configured peer Registry Notary can delegate an evaluation through `POST /federation/v1/evaluations`. The peer posts a compact signed JWT request and receives a compact signed JWT response carrying a scoped evaluation result. This path does not issue a credential.
-
-REQ-PR-NOTARY-018: Delegated evaluation (`POST /federation/v1/evaluations`) MUST accept a compact signed JWT request and return a compact signed JWT response. Before claim evaluation, the serving Registry Notary MUST verify peer policy, replay state, purpose, profile, and audience. Federation evaluation profiles MUST select a `registry_backed` claim. The verified federation request JTI MUST be used as the bounded cross-service correlation identifier for the Relay consultation.
-
-REQ-PR-NOTARY-019: Federation MUST be static-peer only: peers are loaded from configuration at startup, and a request from an unconfigured peer MUST be rejected. Delegated evaluation returns a scoped evaluation result, not a credential. Dynamic trust-chain discovery, shared replay storage, and federated credential issuance are out of scope for this version and MUST NOT be implied by a conformance claim against this specification. This is the protocol-level form of REQ-ARC-G-009.
-
-## 10. Audit and error behavior
-
-Registry Notary records every evaluation, credential or not, in a Registry Platform audit envelope. Audit is not best-effort: a request that cannot be recorded does not succeed.
-
-REQ-PR-NOTARY-020: Every evaluated request MUST emit an `EvidenceAuditEvent` in a Registry Platform audit envelope to the configured sink (stdout, file (JSONL), or syslog). This is the protocol-level form of REQ-ARC-G-004.
-
-REQ-PR-NOTARY-021: An audit write failure MUST surface as a request error. Registry Notary MUST NOT return a successful evaluation it could not record, and MUST NOT swallow an audit failure as a silent log entry.
-
-REQ-PR-NOTARY-022: Error responses on the claim, credential, and federation routes MUST use the problem-details media type `application/problem+json` ([RFC 9457](https://www.rfc-editor.org/info/rfc9457)). The OID4VCI routes (`/oid4vci/*`) instead return the OID4VCI error envelope their flow defines.
-
-REQ-PR-NOTARY-028: Public claim results MUST carry claim provenance using the `registry-notary-claim-provenance/v2` shape. Registry-backed provenance MUST count the verified Relay consultations without exposing source credentials, consultation identifiers, or raw subject identifiers. Audit records for policy-governed evaluations and denials MUST preserve the relevant policy id, hash, and evaluated rule ids when that policy was selected.
-
-REQ-PR-NOTARY-033: Subject access policy denials MUST use the public problem code `subject_access.denied` while preserving the granular denial reason in audit context. Delegated subject access denial reasons are `delegated.relationship_unproven`, `delegated.relationship_not_allowed`, `delegated.claim_denied`, `delegated.subject_not_permitted`, and `delegated.proof_denied`.
-
-## 11. Limitations
-
-These constraints are stated so a reader does not infer a capability from the route list that the reviewed implementation does not provide.
-
-- Plugin rule type: Declared in configuration, unimplemented (REQ-PR-NOTARY-007).
-- Holder binding: OID4VCI supports EdDSA `did:jwk` holder proof only. ES256 holder proof is not supported (REQ-PR-NOTARY-015, REQ-PR-NOTARY-017).
-- OID4VCI profile: The OID4VCI surface is a registry-backed issuer-initiated pre-authorized profile, not a full issuer or general external-wallet interoperability claim. EUDI, HAIP, PAR, DPoP, and wallet attestation are not supported profiles (REQ-PR-NOTARY-016, REQ-PR-NOTARY-039).
-- Delegated issuance: Delegated subject access is evaluation and rendering only. Direct and OID4VCI credential issuance reject delegated evaluations, and delegated credential-profile bindings are invalid configuration (REQ-PR-NOTARY-030, REQ-PR-NOTARY-031, REQ-PR-NOTARY-032).
-- Notary transaction details: Notary-issued transaction and credential access tokens are bound to the configured Notary issuer before the transaction-details requirement applies. Externally issued OIDC tokens are not treated as Notary tokens by `typ` alone (REQ-PR-NOTARY-035, REQ-PR-NOTARY-036).
-- Federation: Static-peer delegated evaluation only; no dynamic discovery, shared replay storage, or federated credential issuance (REQ-PR-NOTARY-019).
-- Relay dependency: Claims require their exact compiler-pinned Relay consultation to be ready. Notary does not provide a direct-source or caller-input fallback (REQ-PR-NOTARY-006).
-- Issuance provenance: Legacy evaluations are nonissuable. Every selected root must retain an exact compiler pin for every registry-backed claim in its executed dependency closure and one normalized execution record per unique consultation ULID. Direct issuance performs the exact-set check before holder-proof replay mutation; OID4VCI evaluates and stores the registry transaction before rendering an offer, then revalidates it after holder-proof nonce consumption (REQ-PR-NOTARY-027, REQ-PR-NOTARY-037).
-- Status: A status-bearing credential cannot selectively hide status, and verification fails closed if the signed status cannot be validated from the exact trusted HTTPS origin (REQ-PR-NOTARY-038).
-- External evidence: Source tests establish the implemented profile. Wallet, verifier, and OpenID conformance claims require immutable evidence from a frozen candidate artifact and are otherwise candidate-only.
-- Project fixtures: Offline fixtures prove the compiled request and response contract against synthetic observations. They do not prove live source interoperability or production approval.
-- Admin reload: The admin reload route returns HTTP 501 with code `registry.admin.capability.not_supported` in the standalone router; it performs no reload; runtime configuration changes require deploying a signed local bundle and restarting the service.
-
-## Conformance
-
-A Registry Notary deployment conforms to this specification when it:
-
-- starts independently when no claims are configured, requires the exact Relay contract for every configured claim (REQ-PR-NOTARY-001), and gates capability discovery while publishing its JWKS openly (REQ-PR-NOTARY-002);
-- authenticates every claim-bearing route and enforces per-claim scopes before Relay or claim work (REQ-PR-NOTARY-003, REQ-PR-NOTARY-004);
-- derives OIDC principals only from the configured principal claim, without client-identity fallback (REQ-PR-NOTARY-034);
-- enforces governed claim policy, purpose agreement with pinned Relay consultations, and Relay-derived freshness before disclosure or issuance (REQ-PR-NOTARY-023, REQ-PR-NOTARY-024, REQ-PR-NOTARY-025);
-- evaluates claims from pinned Relay outputs, with machine or subject-access authorization and no direct source connectors, using only implemented rule types (REQ-PR-NOTARY-005, REQ-PR-NOTARY-006, REQ-PR-NOTARY-007);
-- records and honors the disclosure mode, and never leaks a redacted value (REQ-PR-NOTARY-008, REQ-PR-NOTARY-009, REQ-PR-NOTARY-010);
-- returns the claim-result format, may render CCCEV-shaped JSON-LD, and states its CCCEV output as a profiled subset (REQ-PR-NOTARY-011, REQ-PR-NOTARY-012);
-- issues only SD-JWT VC credentials from exact registry-backed evaluation provenance, with EdDSA or ES256 issuer signing, digest-based selective disclosure, EdDSA `did:jwk` OID4VCI holder binding, and fail-closed status verification for status-bearing credentials (REQ-PR-NOTARY-013, REQ-PR-NOTARY-014, REQ-PR-NOTARY-015, REQ-PR-NOTARY-037, REQ-PR-NOTARY-038);
-- treats subject access as constrained authenticated trust context, including delegated subject access only when requester, dependent target, relationship proof, and stored-evaluation metadata all bind to the configured policy (REQ-PR-NOTARY-026, REQ-PR-NOTARY-029, REQ-PR-NOTARY-030, REQ-PR-NOTARY-031, REQ-PR-NOTARY-035);
-- exposes OID4VCI as a registry-backed non-full-issuer subset with issuer-initiated pre-authorized code only, secure transaction-code defaults, EdDSA `did:jwk` holder proof, matching stored transaction details, one Notary per Relay authority, and no caller-supplied or delegated issuance (REQ-PR-NOTARY-016, REQ-PR-NOTARY-017, REQ-PR-NOTARY-027, REQ-PR-NOTARY-032, REQ-PR-NOTARY-036, REQ-PR-NOTARY-039, REQ-PR-NOTARY-040, REQ-PR-NOTARY-041);
-- restricts federation to verified, static peers and never issues credentials over it (REQ-PR-NOTARY-018, REQ-PR-NOTARY-019);
-- audits every evaluation, fails the request when it cannot, reports errors as problem+json, and carries policy/provenance context without raw requester secrets (REQ-PR-NOTARY-020, REQ-PR-NOTARY-021, REQ-PR-NOTARY-022, REQ-PR-NOTARY-028, REQ-PR-NOTARY-033).
-
-Conformance to this specification does not imply conformance to any external standard cited in the `standards_referenced` frontmatter field. Each standard's adoption mode and scope are documented in the [standards register](../../reference/standards/).
-
-## Evidence
-
-This specification is `verified`: every requirement describes shipped behavior a reader can inspect, per RS-DOC REQ-DOC-014.
-
-- The [Registry Notary API reference](../../reference/apis/registry-notary/) carries the narrative context and links the generated OpenAPI (Redoc) document, the authoritative route and schema reference for every route named here.
-- [Evidence issuance, end to end](../../explanation/evidence-issuance/) walks the claim pipeline, the four consume paths, and the selective-disclosure mechanics that Sections 4 through 9 make precise.
-- The [standards register](../../reference/standards/) records the adoption mode for SD-JWT VC, OID4VCI, CCCEV, and the other standards listed in `standards_referenced`, including the profiled-subset claims this document refers to.
-- [RS-ARC-G](../rs-arc-g/) Section 3 and Section 5 hold the architectural invariants (REQ-ARC-G-004/007/008/009) that this document refines.
-- Subject-bound and delegated subject access modes, Relay consultation capabilities, stored metadata, and denial reasons are implemented in Registry Notary Core and Server.
-- Delegated relationship configuration validation is implemented in [`config.rs`](https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-core/src/config.rs).
-- Request context derivation, stored-evaluation revalidation, OID4VCI delegated-token rejection, explicit target binding, and proof-gated Relay consultations are implemented in Registry Notary Server.
-- Private evaluation provenance capture and the shared direct/OID4VCI issuance verifier (REQ-PR-NOTARY-037) are implemented in Registry Notary Server's evaluation and render runtime modules.
-- Complete pre-authorized browser callback, token, credential, EdDSA and ES256 issuer, EdDSA holder, route-removal, replay, and unsupported-profile coverage is implemented in Registry Notary Server standalone HTTP tests.
-- OIDC principal derivation from the configured principal claim, without client id, authorized party, or audience fallback (REQ-PR-NOTARY-034), is implemented in [`standalone.rs`](https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/standalone.rs)'s `principal_from_oidc` function and its `oidc_principal_requires_configured_principal_claim` test.
-- The issuer-bound subject access transaction-token gate (REQ-PR-NOTARY-035) is implemented in [`api.rs`](https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/api.rs)'s `subject_access_requires_authorization_details` function.
-- The issuer-bound OID4VCI transaction-detail gate (REQ-PR-NOTARY-036) is implemented in [`api.rs`](https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/api.rs)'s `oid4vci_requires_authorization_details` and `require_oid4vci_issuance_authorization_details` functions.
-
-## Next
-
-- [RS-ARC-G](../rs-arc-g/) places Registry Notary in the registry stack architecture.
-- [RS-TERMS](../rs-terms/) defines the protocol and credential vocabulary used here.
-- [Evidence issuance, end to end](../../explanation/evidence-issuance/) is the narrative explanation with worked examples.
-- [Registry Notary API reference](../../reference/apis/registry-notary/) is the route-level reference and the link to the generated OpenAPI document.
diff --git a/docs/site/src/content/docs/spec/rs-pr-registryctl.mdx b/docs/site/src/content/docs/spec/rs-pr-registryctl.mdx
index b657e2819..863c61572 100644
--- a/docs/site/src/content/docs/spec/rs-pr-registryctl.mdx
+++ b/docs/site/src/content/docs/spec/rs-pr-registryctl.mdx
@@ -5,7 +5,7 @@ status: draft
 owner: registry-docs
 source_repos:
   - registry-stack
-last_reviewed: "2026-07-20"
+last_reviewed: "2026-08-03"
 doc_type: specification
 doc_id: RS-PR-REGISTRYCTL
 category: normative
@@ -128,7 +128,7 @@ Directly authored non-secret values MAY appear only when a user selects
 `--show-authored-values` in local human output.
 
 REQ-PR-REGISTRYCTL-010: `build` MUST publish a deterministic complete unit of unsigned signing
-inputs for the closed lanes `relay-public`, `relay-consultation`, and `notary`.
+inputs for the closed lanes `relay-public` and `relay-consultation`.
 It MUST NOT sign, assemble, deploy, activate, or contact an authored source.
 
 REQ-PR-REGISTRYCTL-011: `dev` MUST use the installed release lock and exact digest-locked images,
@@ -153,9 +153,9 @@ REQ-PR-REGISTRYCTL-014: Anchor creation and rotation MUST preserve product-lane
 Rotation MUST create a next anchor and authenticated transition without editing the current anchor.
 
 REQ-PR-REGISTRYCTL-015: Initial approved-set assembly MUST accept exactly the independently
-verified `relay-public`, `relay-consultation`, and `notary` lanes.
+verified `relay-public` and `relay-consultation` lanes.
 An update MUST bind to the preceding approved set and replace every affected lane.
-The approved set MUST remain a handoff record, not a fourth signature or activation authority.
+The approved set MUST remain a handoff record, not a third signature or activation authority.
 
 ## 6. Machine-readable reports
 
@@ -193,7 +193,7 @@ additional properties, or reuse a schema version for a different shape.
 Registryctl owns the generated closure.
 The operator owns the binding, secret and certificate inputs, and any parent application.
 
-REQ-PR-REGISTRYCTL-022: `deploy generate` MUST consume one verified three-lane approved set and the
+REQ-PR-REGISTRYCTL-022: `deploy generate` MUST consume one verified two-lane approved set and the
 installed signed release lock.
 It MUST NOT sign bundles, create production secrets, initialize product state, start a product, or
 activate a deployment.
@@ -263,10 +263,11 @@ Documentation MUST NOT present an unstable path or human-readable value as an au
 
 ## 10. Authorization and evidence boundaries
 
-REQ-PR-REGISTRYCTL-030: Registryctl MUST reject a Notary claim that does not derive from exactly one
-declared Registry Relay consultation.
-Caller-provided, OpenID Connect (OIDC), and authorization-details data MUST NOT be compiled as claim
-evidence.
+REQ-PR-REGISTRYCTL-030: Registryctl MUST reject a declared consultation that does not derive from
+exactly one declared integration, and MUST reject typed consultation input that does not bind that
+integration's input set exactly and injectively.
+An attribute-release claim MUST declare exactly one of `source_field` or `expression`, so a released
+value derives from the authorized source read and never from caller-supplied data.
 
 REQ-PR-REGISTRYCTL-031: Development source access MUST preserve authorization-before-source.
 The denial scenario MUST reach no token endpoint and no authored source.
@@ -311,15 +312,12 @@ tests.
 - `crates/registryctl/src/deployment.rs` and `tests/deployment_seams.rs` pin package ownership,
   closure integrity, package-only verification, operator-file isolation, and safe regeneration.
 - Trust, approved-set, and project-authoring compiler tests pin lane identity, anchor verification,
-  three-lane assembly, and the Registry Relay evidence boundary.
+  two-lane assembly, and the Registry Relay evidence boundary.
 
 ## Next
 
 - [Registryctl CLI reference](../../reference/registryctl/) lists supported commands and flags.
-- [Cut over a pre-1.0 project](../../start/pre-1.0-cutover/) maps removed commands to the 1.0
-  workflow.
 - [API stability and versioning](../../reference/api-stability/) defines the stack-wide 1.0
   compatibility policy.
 - [RS-PR-RELAY](../rs-pr-relay/) specifies the Registry Relay protocol that compiled project inputs
   configure.
-- [RS-PR-NOTARY](../rs-pr-notary/) specifies the Registry Notary evaluation and issuance protocol.
diff --git a/docs/site/src/content/docs/spec/rs-pr-relay.mdx b/docs/site/src/content/docs/spec/rs-pr-relay.mdx
index 5b2e107c4..95e54d64e 100644
--- a/docs/site/src/content/docs/spec/rs-pr-relay.mdx
+++ b/docs/site/src/content/docs/spec/rs-pr-relay.mdx
@@ -6,7 +6,7 @@ owner: registry-docs
 source_repos:
   - registry-relay
   - registry-platform
-last_reviewed: "2026-07-07"
+last_reviewed: "2026-08-04"
 doc_type: specification
 doc_id: RS-PR-RELAY
 category: normative
@@ -32,9 +32,9 @@ audience:
   - specification editor
 ---
 
-This document defines the HTTP protocol contract that Registry Relay exposes: the configuration-driven service model that fixes a gateway's surface, how a caller authenticates and is scoped per dataset, how governed Evidence Gateway PDP enforcement applies to configured read routes, the consultation and aggregate routes that read configured sources, the scope-filtered metadata publication, the evidence-offering descriptors, the credential-issuance boundary with Registry Notary, and the audit and error behavior every request carries. It is the precise, citable version of the behavior the [Registry Relay API reference](../../reference/apis/registry-relay/) describes narratively.
+This document defines the HTTP protocol contract that Registry Relay exposes: the configuration-driven service model that fixes a gateway's surface, how a caller authenticates and is scoped per dataset, how governed Evidence Gateway PDP enforcement applies to configured read routes, the consultation and aggregate routes that read configured sources, the scope-filtered metadata publication, the evidence-offering descriptors, the boundary that keeps credential issuance out of Relay, and the audit and error behavior every request carries. It is the precise, citable version of the behavior the [Registry Relay API reference](../../reference/apis/registry-relay/) describes narratively.
 
-It refines the Registry Relay component defined in [RS-ARC-G](../rs-arc-g/) Section 3 (specifically REQ-ARC-G-003, REQ-ARC-G-004, REQ-ARC-G-006, and REQ-ARC-G-007) one level of detail down, from architectural boundary to wire behavior. Where this document and RS-ARC-G state the same constraint, RS-ARC-G is the general invariant and this document is its protocol-level form. It is the Relay counterpart to [RS-PR-NOTARY](../rs-pr-notary/), which specifies Registry Notary.
+It refines the Registry Relay component defined in [RS-ARC-G](../rs-arc-g/) Section 3 (specifically REQ-ARC-G-003, REQ-ARC-G-004, REQ-ARC-G-006, and REQ-ARC-G-007) one level of detail down, from architectural boundary to wire behavior. Where this document and RS-ARC-G state the same constraint, RS-ARC-G is the general invariant and this document is its protocol-level form.
 
 The key words in this document are interpreted per [RS-DOC](../rs-doc/) Section 2. Defined terms are used per [RS-TERMS](../rs-terms/).
 
@@ -50,6 +50,7 @@ The key words in this document are interpreted per [RS-DOC](../rs-doc/) Section
 | 0.2.2 | 2026-07-09 | draft | Clarified that `x-registry-source-observed-at-unix-seconds` is scope guarded trust context, leaving four additional request-context headers outside Relay policy decisions. |
 | 0.3.0 | 2026-07-09 | draft | Removed Relay-local signed response credential requirements and made Registry Notary the only credential issuance surface. |
 | 0.3.1 | 2026-07-10 | draft | Scope-gated the remaining client-supplied trust-context headers, documented the policy-authoring boundary, and replaced exact trust values in audit records with keyed field-bound handles. |
+| 0.3.2 | 2026-08-04 | draft | Recorded that Registry Notary is retired: Sections 7 and 8 no longer name it as the destination of an evidence offering or as the credential issuer, and REQ-PR-RELAY-012 now states the `registry-notary` access kind that the runtime binding still requires. No Relay behavior changed. |
 
 ## 1. Scope and references
 
@@ -60,8 +61,8 @@ This specification covers Registry Relay's externally observable protocol behavi
 - Governed Evidence Gateway PDP enforcement for configured read routes.
 - The consultation data routes (entities, records, relationships, schemas) and the aggregate routes.
 - Scope-filtered metadata publication at `/metadata/*`.
-- Evidence-offering descriptors and their boundary with Registry Notary.
-- The credential-issuance boundary between Relay and Notary.
+- Evidence-offering descriptors and the boundary they draw around Relay.
+- The boundary that keeps credential issuance out of Relay.
 - The audit obligation, the error format, and the feature-gated surfaces.
 
 This specification does not define:
@@ -147,18 +148,19 @@ REQ-PR-RELAY-023: Metadata publication MUST remain an authorization-filtered pub
 
 ## 7. Evidence offerings
 
-Registry Relay publishes evidence-offering metadata describing where a caller reaches a Registry Notary for verification. Relay routes the caller to Notary; it does not perform the verification.
+Registry Relay publishes evidence-offering metadata describing where a caller reaches a separate evidence service. Relay routes the caller there; it does not perform the evaluation or the verification.
 
-REQ-PR-RELAY-012: Registry Relay MAY publish evidence-offering metadata at `GET /metadata/evidence-offerings` and `GET /metadata/evidence-offerings/{offering_id}`, naming the Registry Notary endpoint, the claim ids, and the supported disclosure modes and formats for an offering. Registry Relay MUST NOT perform claim evaluation or issue credentials itself. This is the protocol-level form of REQ-ARC-G-007.
+REQ-PR-RELAY-012: Registry Relay MAY publish evidence-offering metadata at `GET /metadata/evidence-offerings` and `GET /metadata/evidence-offerings/{offering_id}`, naming the external endpoint, the offered claim ids, and the supported disclosure modes and formats for an offering. Registry Relay MUST NOT evaluate an offering or issue credentials itself. This is the protocol-level form of REQ-ARC-G-007.
+
+Relay's evidence-offering surface still carries a retired product's vocabulary: runtime binding validation accepts an offering only when `access.kind` is `registry-notary`, and it rejects the configuration otherwise. An operator therefore cannot publish an offering that points at an Evidence deployment without that access kind being widened first. Treat this section as describing published surface with no maintained destination behind it.
 
 ## 8. Credential issuance boundary
 
-Registry Relay does not issue credentials, host issuer DID documents, or manage issuer signing keys.
-Registry Notary owns credential issuance and verification.
+Registry Relay does not issue credentials, host issuer DID documents, or manage issuer signing keys. Signing belongs to a separate evidence service; the product that used to own it is retired, and Evidence now signs its own assertions under its own contract.
 
 REQ-PR-RELAY-013: Registry Relay MUST NOT issue response credentials, MUST NOT accept the legacy `provenance` configuration key, and MUST NOT accept entity-level `publicschema` credential mapping configuration. It MUST NOT serve the former credential-support routes `/.well-known/did.json`, `/schemas/{claim_type}/{version}`, or `/contexts/{vocab}/{version}`.
 
-REQ-PR-RELAY-014: A Relay entity or aggregate response MUST remain an ordinary negotiated data response. A caller request for `application/vc+jwt` MUST NOT cause Relay to sign the response. If a workflow needs a signed credential, the workflow MUST use Registry Notary or another configured evidence service reached through evidence-offering metadata.
+REQ-PR-RELAY-014: A Relay entity or aggregate response MUST remain an ordinary negotiated data response. A caller request for `application/vc+jwt` MUST NOT cause Relay to sign the response. If a workflow needs a signed response, the workflow MUST use a configured evidence service reached outside Relay.
 
 ## 9. Audit and error behavior
 
@@ -182,7 +184,7 @@ These constraints are stated so a reader does not infer a capability from the ro
 
 - No source mutation, no streaming: Registry Relay does not mutate source registry data in v1 and reads sources as batch snapshots or table scans; there is no event-stream backend (REQ-PR-RELAY-001).
 - Feature-gated surfaces: OGC adapters and SP DCI sync are present only in builds compiled with the matching Cargo feature (REQ-PR-RELAY-017).
-- No claim evaluation: Relay describes evidence offerings but never evaluates a claim or issues a credential; that is Registry Notary's role (REQ-PR-RELAY-012).
+- No claim evaluation: Relay describes evidence offerings but never evaluates one or issues a credential. The product that formerly played that role is retired, and Relay's binding validation still requires its access kind (REQ-PR-RELAY-012).
 - Manifest format not owned here: The metadata schema and renderers belong to Registry Manifest; Relay serves and scopes the artifacts only (REQ-PR-RELAY-011).
 - PDP enforcement boundary: Governed PDP enforcement applies to configured runtime reads; scoped metadata publication remains a separate publication and discovery surface (REQ-PR-RELAY-019, REQ-PR-RELAY-023).
 - Aggregate disclosure boundary: Aggregate routes return configured statistical observations and may be protected by scopes and PDP policy, but they do not provide a built-in longitudinal privacy budget or cumulative differencing protection (REQ-PR-RELAY-009).
@@ -199,7 +201,7 @@ A Registry Relay deployment conforms to this specification when it:
 - returns aggregate observations computed from configured measures, in both native and SDMX-JSON serializations (REQ-PR-RELAY-009);
 - scope-filters the metadata it serves, does not own the manifest format, and keeps metadata publication separate from runtime PDP authorization (REQ-PR-RELAY-010, REQ-PR-RELAY-011, REQ-PR-RELAY-023);
 - describes evidence offerings without performing verification (REQ-PR-RELAY-012);
-- keeps credential issuance out of Relay and points signed-credential workflows to Registry Notary or configured evidence services (REQ-PR-RELAY-013, REQ-PR-RELAY-014);
+- keeps credential issuance out of Relay and points signed-response workflows to a configured evidence service (REQ-PR-RELAY-013, REQ-PR-RELAY-014);
 - audits every data and metadata read, and reports errors as problem+json (REQ-PR-RELAY-015, REQ-PR-RELAY-016);
 - mounts Cargo-feature-gated, configuration-gated, and admin surfaces only as built and configured (REQ-PR-RELAY-017, REQ-PR-RELAY-018).
 
@@ -217,7 +219,7 @@ This specification is `verified`: every requirement describes shipped behavior a
 
 ## Next
 
-- [RS-PR-NOTARY](../rs-pr-notary/) specifies Registry Notary, the verification counterpart that Relay's evidence offerings point to.
+- [RS-PR-EVIDENCE](../rs-pr-evidence/) specifies Evidence, the separate runtime that returns signed, minimum-disclosure assertions.
 - [RS-ARC-G](../rs-arc-g/) places Registry Relay in the registry stack architecture.
 - [RS-TERMS](../rs-terms/) defines the consultation, metadata, and credential vocabulary used here.
 - [Registry Relay API reference](../../reference/apis/registry-relay/) is the route-level reference and the link to the generated OpenAPI document.
diff --git a/docs/site/src/content/docs/spec/rs-sec-g.mdx b/docs/site/src/content/docs/spec/rs-sec-g.mdx
index d08ab6f01..930943839 100644
--- a/docs/site/src/content/docs/spec/rs-sec-g.mdx
+++ b/docs/site/src/content/docs/spec/rs-sec-g.mdx
@@ -1,13 +1,14 @@
 ---
 title: "RS-SEC-G: Registry family security model"
-description: "The cross-cutting security model for the registry stack: shared security primitives, authentication and authorization, verification-key publication, audit, federation trust, replay protection, and the operator boundary."
+description: "The cross-cutting security model for the registry stack: shared security primitives, authentication and authorization, verification-key publication, audit, replay protection, and the operator boundary."
 status: draft
 owner: registry-docs
 source_repos:
   - registry-platform
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-07"
+  - registry-evidence
+  - registry-mint
+last_reviewed: "2026-08-03"
 doc_type: specification
 doc_id: RS-SEC-G
 category: normative
@@ -16,17 +17,15 @@ locale: en
 standards_referenced:
   - openapi
   - sd-jwt-vc
-  - oid4vci
-  - w3c-did
 audience:
   - operator
   - integrator
   - specification editor
 ---
 
-This document defines the security model shared across the registry stack: where the security-critical primitives live, how a caller authenticates and is authorized, how a service publishes the keys a verifier needs, what every request that touches person-level data MUST record, how delegated evaluation is trusted, how replay decisions remain authoritative, and where the operator's responsibility begins. It is the cross-cutting (general) security specification that the protocol specifications refine for their own surfaces.
+This document defines the security model shared across the registry stack: where the security-critical primitives live, how a caller authenticates and is authorized, how a service publishes the keys a verifier needs, what every request that touches person-level data MUST record, how replay decisions remain authoritative, and where the operator's responsibility begins. It is the cross-cutting (general) security specification that the protocol specifications refine for their own surfaces.
 
-It refines the security-relevant invariants of [RS-ARC-G](../rs-arc-g/) Section 5 (specifically REQ-ARC-G-004 and REQ-ARC-G-005) one level of detail down, from architectural invariant to security model. Where this document and RS-ARC-G state the same constraint, RS-ARC-G is the general invariant and this document is its security-model form. The wire-level form of these constraints lives in [RS-PR-NOTARY](../rs-pr-notary/) and [RS-PR-RELAY](../rs-pr-relay/); where this document and a protocol specification state the same constraint, this document is the cross-cutting model and the protocol specification is its surface-specific form.
+It refines the security-relevant invariants of [RS-ARC-G](../rs-arc-g/) Section 5 (specifically REQ-ARC-G-004 and REQ-ARC-G-005) one level of detail down, from architectural invariant to security model. Where this document and RS-ARC-G state the same constraint, RS-ARC-G is the general invariant and this document is its security-model form. The wire-level form of these constraints lives in [RS-PR-EVIDENCE](../rs-pr-evidence/) and [RS-PR-RELAY](../rs-pr-relay/); where this document and a protocol specification state the same constraint, this document is the cross-cutting model and the protocol specification is its surface-specific form.
 
 The key words in this document are interpreted per [RS-DOC](../rs-doc/) Section 2. Defined terms are used per [RS-TERMS](../rs-terms/).
 
@@ -34,129 +33,138 @@ The key words in this document are interpreted per [RS-DOC](../rs-doc/) Section
 
 | Version | Date | Status | Change |
 | --- | --- | --- | --- |
-| 0.1.0 | 2026-06-13 | draft | Initial security model, distilled from the boundary map, the architecture overview, the Registry Relay and Registry Notary API references, the Registry Notary signing-key reference, and the two protocol specifications. |
+| 0.1.0 | 2026-06-13 | draft | Initial security model, distilled from the boundary map, the architecture overview, the Registry Relay and the now-removed Registry Notary API references, the Registry Notary signing-key reference, and the two protocol specifications. |
 | 0.1.1 | 2026-06-21 | draft | Clarified key custody, readiness, public error detail, and principal-scoped cache boundaries. |
 | 0.2.0 | 2026-07-07 | draft | Enumerated the full unauthenticated surface in REQ-SEC-G-006 and anchored the evidence section to the enforcing code. |
-| 0.3.0 | 2026-07-13 | draft | Assigned registry source access to Relay and restated Notary authorization and federation gates in terms of compiler-pinned Relay consultations. |
-| 0.4.0 | 2026-07-19 | draft | Defined the product-owned Relay and Notary replay-protection boundaries, retention references, failure posture, and stale-recovery invariant. |
+| 0.3.0 | 2026-07-13 | draft | Assigned registry source access to Relay and restated Notary authorization and federation gates in terms of compiler-pinned Relay consultations. Those Notary gates are retired as of 0.5.0. |
+| 0.4.0 | 2026-07-19 | draft | Defined the product-owned Relay and Notary replay-protection boundaries, retention references, failure posture, and stale-recovery invariant. The Notary boundary is retired as of 0.5.0. |
+| 0.5.0 | 2026-08-03 | draft | Registry Notary is retired. Removed Section 7 (federation trust) and REQ-SEC-G-010, renumbered the following sections, restated REQ-SEC-G-002, REQ-SEC-G-005, REQ-SEC-G-006, REQ-SEC-G-011, REQ-SEC-G-014, and REQ-SEC-G-015 for Registry Relay, Evidence, and Registry Mint, and added REQ-SEC-G-016 and REQ-SEC-G-017. |
 
 ## 1. Scope and references
 
 This specification covers the security model that holds across the runtime services:
 
 - The shared security primitives and where they are sourced.
-- Authentication: the two modes and what each one verifies.
+- Authentication: the caller modes and what each one verifies.
 - Authorization: the scope model and its deny-by-default, scope-before-source posture.
 - Verification-key publication and the public/private key boundary.
 - The audit obligation and its fail-closed posture.
-- Federation trust: static peers and verify-before-read.
 - Product-owned replay protection: authority, retention, transaction, failure, and recovery invariants.
 - The transport and error posture, and the outbound-call policy.
 - The operator boundary: what this model leaves to the deployment.
 
 This specification does not define:
 
-- **Exact configuration schemas, algorithms, and parameters.** Concrete signing algorithms and key sizes, configurable token and cache windows, entropy floors, the precise security-header set, and the precise outbound allow and deny rules are configuration and operational detail, not contract data. Section 8 states the fixed Relay batch-child replay retention that is part of the product contract. For the configurable surface, see the [Registry Notary operator configuration reference](../../products/registry-notary/operator-config-reference/), the [Registry Notary signing-key reference](../../products/registry-notary/signing-key-provider/), and the [Registry Relay client integration](../../products/registry-relay/client-integration/) guide.
-- **Surface-specific protocol behavior.** How each service applies this model to its own routes, request shapes, and error codes belongs to [RS-PR-NOTARY](../rs-pr-notary/) and [RS-PR-RELAY](../rs-pr-relay/).
-- **Key custody and secret provisioning.** How private keys and credentials are stored, injected, and rotated in a deployment (environment, file, hardware module) is an operator responsibility, addressed in Section 10.
+- **Exact configuration schemas, algorithms, and parameters.** Concrete signing algorithms and key sizes, configurable token and cache windows, entropy floors, the precise security-header set, and the precise outbound allow and deny rules are configuration and operational detail, not contract data. Section 7 states the fixed Relay batch-child replay retention that is part of the product contract. For the configurable surface, see [Configure Evidence](../../configure/evidence/), [Configure Registry Mint](../../configure/mint/), and the [Registry Relay client integration](../../products/registry-relay/client-integration/) guide.
+- **Surface-specific protocol behavior.** How each service applies this model to its own routes, request shapes, and error codes belongs to [RS-PR-EVIDENCE](../rs-pr-evidence/) and [RS-PR-RELAY](../rs-pr-relay/).
+- **Key custody and secret provisioning.** How private keys and credentials are stored, injected, and rotated in a deployment (environment, file, hardware module) is an operator responsibility, addressed in Section 9.
 - **Deeper service-internal security mechanisms.** The internal structure of credential fingerprints, the audit envelope, and product replay tables beyond the authority, binding, retention, transaction, failure, and recovery behavior stated here is reserved for product specifications and operator guidance.
 
-For the components named here and their boundaries, see [RS-ARC-G](../rs-arc-g/) Section 3 and the [boundary map](../../map/boundaries-and-map/). For the narrative security context, see the [architecture overview](../../explanation/architecture/) and [Evidence issuance, end to end](../../explanation/evidence-issuance/).
+For the components named here and their boundaries, see [RS-ARC-G](../rs-arc-g/) Section 3 and the [boundary map](../../map/boundaries-and-map/). For the narrative security context, see the [architecture overview](../../explanation/architecture/) and the [Evidence security model](../../security/evidence/).
 
 ## 2. Shared security primitives
 
-The registry stack concentrates its security-critical behavior in Registry Platform so that it behaves identically across services and can be reviewed in one place. Registry Platform supplies authentication helpers, OpenID Connect (OIDC) verification, audit envelopes, HTTP security, outbound HTTP policy, cryptography, and Selective Disclosure JWT Verifiable Credential (SD-JWT VC) helpers. Registry Relay and Registry Notary own how those primitives are configured and enforced on their own routes.
+The registry stack concentrates its security-critical behavior in Registry Platform so that it behaves identically across services and can be reviewed in one place. Registry Platform supplies authentication helpers, OpenID Connect (OIDC) verification, audit envelopes, HTTP security, outbound HTTP policy, cryptography, and Selective Disclosure JWT Verifiable Credential (SD-JWT VC) helpers. Registry Relay, Evidence, and Registry Mint own how those primitives are configured and enforced on their own routes.
 
 REQ-SEC-G-001: A security-critical primitive that must behave identically across runtime services (authentication, OIDC verification, audit envelopes, HTTP security, outbound HTTP policy, cryptography, and SD-JWT VC helpers) SHOULD be sourced from Registry Platform rather than reimplemented per service. This is the security-model form of REQ-ARC-G-005, and it keeps cross-service security behavior consistent and auditable in one place.
 
 ## 3. Authentication
 
-A runtime service authenticates in exactly one mode, fixed by configuration. The following diagram shows the security pipeline every request follows and the trust inputs that feed it.
+A runtime service authenticates its callers in exactly one mode, fixed by configuration. The following diagram shows the security pipeline every request follows and the trust inputs that feed it.
 
 ```mermaid
 flowchart LR
     caller["Caller"]
     authn["Authenticate (one mode):<br/>static fingerprint (sha256, constant-time)<br/>OR OIDC (issuer · audience · algorithm · JWKS)"]
-    authz["Authorize:<br/>before source or claim work<br/>deny-by-default"]
-    serve["Serve:<br/>Relay source read · Notary claim evaluation"]
+    authz["Authorize:<br/>before source or evaluation work<br/>deny-by-default"]
+    serve["Serve:<br/>Relay source read · Evidence assertion"]
     audit["Audit:<br/>Platform envelope · fail-closed<br/>principal · scopes · request_id · purpose"]
     caller --> authn --> authz --> serve --> audit
     keys["Verification keys:<br/>issuer JWKS<br/>(public half only)"] -.-> authn
-    peers["Federation:<br/>static peers · verify-before-read"] -.-> authz
+    mint["Registry Mint:<br/>client assertion · one-way<br/>issues the access token"] -.-> authn
 ```
 
-The diagram restates the model: a caller authenticates in the instance's single mode, the request is authorized against the scope its target requires before source or claim work, the service serves the configured surface, and the request is recorded. Verification keys are published so a verifier can check issued artifacts; delegated evaluation is admitted only from configured peers.
+The diagram restates the model: a caller authenticates in the instance's single mode, the request is authorized against the scope its target requires before source or evaluation work, the service serves the configured surface, and the request is recorded. Verification keys are published so a verifier can check issued artifacts. Where a deployment has no identity provider, Registry Mint issues the access token the caller presents, and the resource server verifies it as an ordinary OIDC token.
 
-REQ-SEC-G-002: A runtime service MUST run exactly one authentication mode, either static credentials or OIDC, and MUST authenticate every route that returns person-level records or claim results before it produces a response.
+REQ-SEC-G-002: A runtime service MUST run exactly one caller-authentication mode, fixed by configuration at startup, and MUST authenticate every route that returns person-level records or evidence assertions before it produces a response. Registry Relay runs either static credentials or OIDC; Evidence runs OIDC only, against exactly one trusted issuer.
 
 REQ-SEC-G-003: In static-credential mode, the configured trust material MUST be a credential fingerprint (`sha256:<...>`), not the raw secret, and the service MUST compare the presented token against the configured fingerprints in constant time, so neither the stored configuration nor the comparison timing discloses the secret.
 
-REQ-SEC-G-004: In OIDC mode, the service MUST delegate token verification to the Registry Platform OIDC primitive. A token MUST be trusted only after its signature is verified against the configured issuer's JSON Web Key Set (JWKS) and its issuer, an accepted audience, and a permitted signing algorithm are checked. The service still owns the scopes its routes require (Section 4).
+REQ-SEC-G-004: In OIDC mode, the service MUST delegate token verification to the Registry Platform OIDC primitive. A token MUST be trusted only after its signature is verified against the configured issuer's JSON Web Key Set (JWKS) and its issuer, an accepted audience, and a permitted signing algorithm are checked. The service still owns the scopes its routes require (Section 4). Evidence derives the caller's identity only from the verified token and never from a proxy-supplied identity header.
+
+REQ-SEC-G-016: A token issuer that mints access tokens for registered clients MUST authenticate each client with an asymmetric client assertion, verified only against the keys registered for the client the assertion names. The authority the minted token carries MUST be read from the issuer's server-side client registry and MUST NOT be read from the assertion. The issuer MUST enforce single use of the assertion identifier (Section 7) and MUST NOT distinguish an unknown client, a bad signature, a replayed identifier, and an expired assertion in its public error response, so the token endpoint cannot be used to probe the client registry.
 
 ## 4. Authorization
 
 Authorization is scope-based and deny-by-default: a caller reaches only what its scopes grant, and the grant is fixed by configuration rather than widened at request time.
 
-REQ-SEC-G-005: Authorization MUST be scope-based and deny-by-default. A caller MUST hold the scope a route requires. Relay MUST enforce that scope before source work. Notary MUST enforce it before claim evaluation or a Relay consultation. A caller that lacks a required scope is refused before a protected effect, not after.
+REQ-SEC-G-005: Authorization MUST be scope-based and deny-by-default. A caller MUST hold the scope a route requires. Relay MUST enforce that scope before source work. Evidence MUST match exactly one configured authority path and MUST enforce the grant it carries before any source read. A caller that lacks a required scope is refused before a protected effect, not after.
 
-REQ-SEC-G-006: A service MUST NOT widen a caller's reach at request time beyond what configuration grants. Every route that returns person-level records or claim results MUST require authentication, and the unauthenticated surface MUST be limited to routes that carry no person-level data:
+REQ-SEC-G-006: A service MUST NOT widen a caller's reach at request time beyond what configuration grants. Every route that returns person-level records or evidence assertions MUST require authentication, and the unauthenticated surface MUST be limited to routes that carry no person-level data:
 
 - liveness and readiness probes;
 - public verification-key discovery through the issuer JWKS;
-- served documentation and discovery metadata: documentation routes, well-known discovery documents, published JSON Schemas and JSON-LD contexts, and public credential-type metadata;
-- the OID4VCI issuance routes that run before an access token is bound, which carry that protocol's own security controls (their surface-specific form lives in [RS-PR-NOTARY](../rs-pr-notary/));
-- where a deployment enables credential status, the credential status route, which discloses only issuer, credential profile, status, and timestamps for an unguessable credential identifier.
+- served documentation and discovery metadata: documentation routes, well-known discovery documents, and published JSON Schemas and JSON-LD contexts;
+- the token endpoint of a token issuer, which accepts no anonymous request even though it carries no bearer token of its own.
 
-The OpenAPI document requires authentication unless the deployment opts out. A route exempt from bearer authentication MAY still enforce a stronger check of its own: the federated evaluation route accepts no anonymous request; it requires the peer-signed request that Section 7 verifies.
+The OpenAPI document requires authentication unless the deployment opts out. A route exempt from bearer authentication MAY still enforce a stronger check of its own: the token endpoint admits only a client whose assertion REQ-SEC-G-016 has verified. Evidence exempts only its probes, its OpenAPI document, its issuer JWKS, and its issuer metadata document; the assertion route and the evidence-definition discovery route both require a verified access token.
 
 ## 5. Verification-key publication
 
-A verifier needs the issuer's public key to check a credential, and it needs that key without holding a credential of its own. The model therefore separates the published public half from the private signing material, which never leaves the issuer.
+A verifier needs the issuer's public key to check a signed artifact, and it needs that key without holding a credential of its own. The model therefore separates the published public half from the private signing material, which never leaves the issuer.
 
-REQ-SEC-G-007: An issuer MUST sign with an asymmetric key and MUST publish only the public half through the issuer JWKS. Private key material MUST NOT be published and MUST NOT be required by a verifier. A key that is being rotated out MAY remain published for verification while credentials it signed are still within their validity, so a verifier can check previously issued artifacts across a rotation.
+REQ-SEC-G-007: An issuer MUST sign with an asymmetric key and MUST publish only the public half through the issuer JWKS. Private key material MUST NOT be published and MUST NOT be required by a verifier. A key that is being rotated out MAY remain published for verification while artifacts it signed are still within their validity, so a verifier can check previously signed artifacts across a rotation. Evidence signs with exactly one active key and retains a retired public key for at least the maximum assertion validity plus the accepted clock skew.
 
-The custody mechanism for the private key (environment, file, or hardware module) is a deployment choice, described in the [signing-key reference](../../products/registry-notary/signing-key-provider/) and out of scope here (Section 10).
+The custody mechanism for the private key (environment, file, or hardware module) is a deployment choice, described in [Move Evidence to production signing](../../tutorials/move-evidence-to-production-signing/) and out of scope here (Section 9).
 
-Readiness, liveness, and protocol conformance checks show that a service has loaded configuration and can serve the expected protocol surface. They do not certify production-grade private-key custody. A deployment that uses software keys, local JWK files, or demo-generated keys can still be reachable and internally consistent; production custody, rotation, and approval of a key provider remain operator responsibilities under Section 10.
+Readiness, liveness, and protocol conformance checks show that a service has loaded configuration and can serve the expected protocol surface. They do not certify production-grade private-key custody. A deployment that uses software keys, local JWK files, or demo-generated keys can still be reachable and internally consistent; production custody, rotation, and approval of a key provider remain operator responsibilities under Section 9.
 
 ## 6. Audit
 
 Every request that touches person-level data is recorded. Audit is a security control, not best-effort logging: a deployment can require that a request which cannot be recorded does not succeed.
 
-REQ-SEC-G-008: Every request that returns person-level records or claim results MUST be recorded in a Registry Platform audit envelope, capturing at least the caller principal, the scopes exercised, a request identifier, and the `Data-Purpose` value where the caller supplied one. This is the security-model form of REQ-ARC-G-004; it states an invariant a conforming deployment meets, not a claim that every route in a given build has been individually audited.
-
-REQ-SEC-G-009: A deployment MUST be able to run audit fail-closed, so that a request whose audit record cannot be written does not return a successful result. A service MUST NOT silently drop an audit record on the success path.
-
-## 7. Federation trust
-
-Delegated evaluation crosses a trust boundary between two services. The model admits only configured peers and verifies the full request before any Relay consultation or claim evaluation.
+REQ-SEC-G-008: Every request that returns person-level records or evidence assertions MUST be recorded in a Registry Platform audit envelope, capturing at least the caller principal, the scopes exercised, a request identifier, and the `Data-Purpose` value where the caller supplied one. This is the security-model form of REQ-ARC-G-004; it states an invariant a conforming deployment meets, not a claim that every route in a given build has been individually audited.
 
-REQ-SEC-G-010: Delegated evaluation MUST be static-peer only: peers are loaded from configuration at startup, and a request from an unconfigured peer MUST be rejected. Before any Relay consultation or claim evaluation, the serving service MUST verify the peer's identity and request signature, the request's freshness and single use, and its purpose, profile, and audience. This is the security-model form of REQ-ARC-G-009 and the cross-cutting form of REQ-PR-NOTARY-018 and REQ-PR-NOTARY-019. Dynamic trust-chain discovery, shared replay storage, and federated credential issuance are out of scope for this version and MUST NOT be implied by a conformance claim against this specification.
+REQ-SEC-G-009: A deployment MUST be able to run audit fail-closed, so that a request whose audit record cannot be written does not return a successful result. A service MUST NOT silently drop an audit record on the success path. In Evidence the fail-closed posture is not configurable: the access-attempt record is durable before the first source read, the disclosure-release record is durable after signing and before the response is released, and an audit write that cannot be completed fails the request.
 
-## 8. Replay-protection authority
+## 7. Replay-protection authority
 
 Replay protection is product correctness state, not a shared storage service.
-Registry Platform can supply replay vocabulary and mechanism-only helpers, but Registry Relay and
-Registry Notary define and persist their own replay decisions.
+Registry Platform can supply replay vocabulary and mechanism-only helpers, but each product defines
+and holds its own replay decisions.
 The [retention and persistent-state reference](../../operate/retention-and-persistent-state/)
 defines the complete product retention inventory, and the
 [backup and restore procedure](../../operate/backup-and-restore/) defines the recovery steps.
 
 | Product | Protected execution or domain | Identity and request binding | Retention |
 | --- | --- | --- | --- |
-| Registry Relay | Batch-child idempotent consultation execution. | A high-entropy Notary child identity selects the replay row and binds the exact canonical request to the authenticated consultation workload. The same child and request can replay the terminal result; a different binding conflicts. | `15 minutes` from reservation or terminal publication. |
-| Registry Notary | Scoped, domain-separated protocol one-time and completion domains, including replay identifiers, nonce consumption, batch completion, and pre-authorized-code redemption. | Product-specific scope and identifier hashes bind each decision to its protocol authority and context. Typed Notary transactions enforce one-time use or immutable completion. | The product-specific absolute expiry or bounded retention for the domain, as listed in the retention reference. |
+| Registry Relay | Batch-child idempotent consultation execution. | A high-entropy batch-child identity selects the replay row and binds the exact canonical request to the authenticated consultation workload. The same child and request can replay the terminal result; a different binding conflicts. | `15 minutes` from reservation or terminal publication. |
+| Registry Mint | Single use of a client assertion identifier at the token endpoint. | The assertion's `jti` is remembered once its signature has been verified against the named client's registered keys, so a captured assertion cannot be spent twice inside its own lifetime. | The assertion's own expiry, bounded by the configured maximum assertion lifetime, in a per-process cache with a configured entry ceiling. |
 
-REQ-SEC-G-014: A production or multi-instance deployment MUST keep replay correctness state in
+Evidence holds no replay state at all. Its request nonce is echoed in the response so a caller can
+correlate its own request, and it is never stored, uniqueness-checked, or exposed elsewhere.
+Evidence Version 1 therefore makes no single-use or freshness guarantee of its own, and a
+deployment MUST NOT present the echoed nonce as one.
+
+REQ-SEC-G-014: Where a product persists replay decisions across restart, a
+production or multi-instance deployment MUST keep replay correctness state in
 the PostgreSQL state owned by the product making the decision.
 Replicas of one product authority MUST share only that authority's product state so a retained
 decision survives restart and is observed across replicas.
-Separate federation authorities MUST NOT share replay state.
-Registry Relay and Registry Notary MUST NOT share replay tables, schemas, database roles,
+Separate product authorities MUST NOT share replay state.
+Two products MUST NOT share replay tables, schemas, database roles,
 migrations, or correctness transactions, even when their databases run in one PostgreSQL
 cluster.
 An implementation MUST NOT turn these boundaries into a shared correctness-state abstraction.
 
+REQ-SEC-G-017: A product that enforces single use in process rather than in persistent state MUST
+bound the cache, MUST retain an identifier until at least its own expiry, and MUST fail closed when
+the cache is saturated rather than evict a live entry, so that a caller cannot flush the cache and
+then replay what it evicted.
+Such enforcement is scoped to one process: a deployment that runs more than one instance MUST NOT
+claim single use across those instances, and MUST NOT be documented as if it did.
+Registry Mint's client-assertion cache is the only in-process enforcement in this stack.
+
 REQ-SEC-G-015: Each product MUST use its product-owned atomic reservation and completion
 operations for replay-sensitive work.
 A database-unavailable, read-only, timed-out, or transaction-uncertain result MUST fail closed:
@@ -165,20 +173,19 @@ traffic on state that it cannot attest.
 A potentially stale recovery point MUST remain offline until the product-specific recovery rules
 in the backup and restore procedure pass.
 Expiry alone MUST NOT be treated as repair for a Relay recovery point missing durable audit,
-quota, materialization, or keyring history, or for a Notary recovery point missing credential
-status.
+quota, materialization, or keyring history.
 
-## 9. Transport and outbound-call posture
+## 8. Transport and outbound-call posture
 
 Services present a consistent error surface and constrain the calls they make outward.
 
-REQ-SEC-G-011: Error responses MUST use the problem-details media type `application/problem+json` ([RFC 9457](https://www.rfc-editor.org/info/rfc9457)), except on a route whose own protocol defines a different error envelope (for example the OID4VCI routes, per REQ-PR-NOTARY-022).
+REQ-SEC-G-011: Error responses MUST use the problem-details media type `application/problem+json` ([RFC 9457](https://www.rfc-editor.org/info/rfc9457)), except on a route whose own protocol defines a different error envelope (for example a token endpoint, which returns the OAuth 2.0 error object [RFC 6749](https://www.rfc-editor.org/info/rfc6749) Section 5.2 defines).
 
 REQ-SEC-G-012: A runtime service SHOULD apply the Registry Platform HTTP-security primitive (security response headers) on its served surface, and outbound HTTP calls SHOULD be governed by the Registry Platform outbound-policy primitive. Relay source calls MUST also remain inside their compiler-pinned destination and request authority. The concrete header set and the outbound allow and deny rules are operational detail (Section 1).
 
-Problem details are a client-facing protocol surface, not an operator diagnostic channel. Stable problem codes and titles belong in responses; raw bearer tokens, private keys, source values, local filesystem paths, and unbounded internal error chains belong in protected operator logs. Principal-scoped responses, including scoped metadata and claim results, are not public cache entries: where a response varies by authenticated principal, scope, purpose, or authorization context, deployments use cache controls appropriate to that sensitivity, such as private or no-store semantics and `Vary: Authorization` where a response is cacheable.
+Problem details are a client-facing protocol surface, not an operator diagnostic channel. Stable problem codes and titles belong in responses; raw bearer tokens, private keys, source values, local filesystem paths, and unbounded internal error chains belong in protected operator logs. Principal-scoped responses, including scoped metadata and evidence assertions, are not public cache entries: where a response varies by authenticated principal, scope, purpose, or authorization context, deployments use cache controls appropriate to that sensitivity, such as private or no-store semantics and `Vary: Authorization` where a response is cacheable.
 
-## 10. The operator boundary
+## 9. The operator boundary
 
 The security model ends where the deployment begins. The following are operator responsibilities, not behavior this specification defines: secret and key provisioning, key custody and the rotation schedule, audit retention and storage, tenant isolation, transport termination and certificate management, network rate limiting at the edge, deployment configuration, and incident response. Registry Platform and the runtime services provide the primitives; the operator provisions, configures, and operates them.
 
@@ -189,36 +196,40 @@ REQ-SEC-G-013: An implementation MUST NOT embed secret material (private keys, c
 A registry stack deployment conforms to this specification when it:
 
 - sources its cross-service security primitives from Registry Platform (REQ-SEC-G-001);
-- runs a single authentication mode and authenticates every claim- or record-bearing route (REQ-SEC-G-002);
+- runs a single caller-authentication mode and authenticates every assertion- or record-bearing route (REQ-SEC-G-002);
 - compares static credentials as constant-time fingerprint checks and never configures the raw secret (REQ-SEC-G-003);
 - verifies OIDC tokens by signature, issuer, audience, and permitted algorithm before trusting them (REQ-SEC-G-004);
-- authorizes before source or claim work, denies by default, and never widens reach at request time (REQ-SEC-G-005, REQ-SEC-G-006);
+- authenticates a token issuer's clients by asymmetric client assertion against registered keys, and takes the minted token's authority from the server-side registry (REQ-SEC-G-016);
+- authorizes before source or evaluation work, denies by default, and never widens reach at request time (REQ-SEC-G-005, REQ-SEC-G-006);
 - publishes only public verification keys and keeps private material unpublished (REQ-SEC-G-007);
 - audits every request touching person-level data and can run audit fail-closed (REQ-SEC-G-008, REQ-SEC-G-009);
-- admits delegated evaluation only from verified static peers, fully checked before any Relay consultation or claim evaluation (REQ-SEC-G-010);
-- keeps replay decisions in separate product-owned PostgreSQL state, shares them only across replicas of the same authority, and preserves the product retention contract (REQ-SEC-G-014);
+- keeps persisted replay decisions in separate product-owned PostgreSQL state, shares them only across replicas of the same authority, and preserves the product retention contract (REQ-SEC-G-014);
+- bounds in-process single-use enforcement, fails closed on saturation, and claims no cross-instance guarantee for it (REQ-SEC-G-017);
 - fails closed when replay correctness state is unavailable or uncertain and keeps potentially stale recovery points offline until product recovery rules pass (REQ-SEC-G-015);
 - reports errors as problem+json outside route-specific error envelopes, and applies the shared HTTP-security and outbound-policy primitives (REQ-SEC-G-011, REQ-SEC-G-012);
 - keeps secrets out of distributable artifacts and leaves provisioning to the operator (REQ-SEC-G-013).
 
+REQ-SEC-G-010 is retired. It required delegated evaluation to be static-peer only and fully verified before any Relay consultation or claim evaluation. The retired `registry-notary` component held the only delegated-evaluation surface in this stack, so no service here evaluates on behalf of a peer and nothing implements that requirement. Per RS-DOC REQ-DOC-008 the identifier is not reused.
+
 Conformance to this specification does not imply conformance to any external standard cited in the `standards_referenced` frontmatter field, nor to OpenID Connect, OAuth 2.0, or any other authentication or authorization framework named in prose. Each cited standard's adoption mode and scope are documented in the [standards register](../../reference/standards/).
 
 ## Evidence
 
 This specification is `verified`: every requirement describes shipped behavior a reader can inspect, per RS-DOC REQ-DOC-014.
 
-- The [boundary map](../../map/boundaries-and-map/) records that the security primitives (authentication, OIDC, audit envelopes, HTTP security, outbound HTTP policy, cryptography, SD-JWT VC helpers) are owned by Registry Platform and that secret provisioning, audit retention, tenant isolation, deployment configuration, and incident response are operator responsibilities, which Sections 2 and 10 make precise.
-- The [Registry Notary API reference](../../reference/apis/registry-notary/) and [Registry Relay API reference](../../reference/apis/registry-relay/) describe the two authentication modes, the constant-time fingerprint comparison, the OIDC trust inputs, the per-dataset and per-claim scopes, and the unauthenticated probes that Sections 3 and 4 state normatively.
-- The [Registry Notary signing-key reference](../../products/registry-notary/signing-key-provider/) describes JWKS publication, the public/private key boundary, and rotation, which Section 5 states normatively.
-- [RS-PR-NOTARY](../rs-pr-notary/) and [RS-PR-RELAY](../rs-pr-relay/) carry the surface-level form of the authentication, authorization, key-publication, audit, federation, and error requirements this document generalizes.
+- The [boundary map](../../map/boundaries-and-map/) records that the security primitives (authentication, OIDC, audit envelopes, HTTP security, outbound HTTP policy, cryptography, SD-JWT VC helpers) are owned by Registry Platform and that secret provisioning, audit retention, tenant isolation, deployment configuration, and incident response are operator responsibilities, which Sections 2 and 9 make precise.
+- The [Evidence API reference](../../reference/apis/registry-evidence/), the [Registry Relay API reference](../../reference/apis/registry-relay/), and the [Registry Mint reference](../../reference/mint/) describe the caller authentication modes, the constant-time fingerprint comparison, the OIDC trust inputs, the per-dataset and per-grant scopes, and the unauthenticated probes that Sections 3 and 4 state normatively.
+- The [Evidence security model](../../security/evidence/) and [Configure Evidence](../../configure/evidence/) describe JWKS publication, the public/private key boundary, and rotation, which Section 5 states normatively.
+- [RS-PR-EVIDENCE](../rs-pr-evidence/) and [RS-PR-RELAY](../rs-pr-relay/) carry the surface-level form of the authentication, authorization, key-publication, audit, and error requirements this document generalizes.
 - [RS-ARC-G](../rs-arc-g/) Section 5 holds the architectural invariants (REQ-ARC-G-004, REQ-ARC-G-005) that Sections 2 and 6 refine.
-- The [retention and persistent-state reference](../../operate/retention-and-persistent-state/) and [backup and restore procedure](../../operate/backup-and-restore/) define the product-owned PostgreSQL retention and stale-recovery behavior that Section 8 states normatively.
-- The [standards register](../../reference/standards/) records the adoption mode for SD-JWT VC, OID4VCI, and the W3C DID method listed in `standards_referenced`.
-- The enforcing code is inspectable in the workspace: the constant-time fingerprint comparison in `crates/registry-platform-authcommon` (REQ-SEC-G-003); OIDC verification in `crates/registry-platform-oidc` (REQ-SEC-G-004); scope-before-source enforcement in `crates/registry-notary-server/src/runtime.rs` (`require_claim_access`) and the Registry Relay route handlers (REQ-SEC-G-005); the unauthenticated-surface allow-lists in Registry Relay's router assembly (`crates/registry-relay/src/server.rs`) and Registry Notary's auth-exemption check (`is_auth_exempt_path` in `crates/registry-notary-server/src/standalone.rs`) (REQ-SEC-G-006); the audit envelope in `crates/registry-platform-audit` and the services' fail-closed audit paths, exercised by tests such as Registry Notary's federation audit-write-failure test (REQ-SEC-G-008, REQ-SEC-G-009); Relay's batch-child binding and PostgreSQL reservation functions in `crates/registry-relay/src/consultation` and `crates/registry-relay/src/state_plane`; Notary's typed PostgreSQL replay functions in `crates/registry-notary-server/src/state_plane` (REQ-SEC-G-014, REQ-SEC-G-015); and the secret-material rejection lists in `crates/registry-manifest-core` (REQ-SEC-G-013).
+- The [retention and persistent-state reference](../../operate/retention-and-persistent-state/) and [backup and restore procedure](../../operate/backup-and-restore/) define the product-owned PostgreSQL retention and stale-recovery behavior that Section 7 states normatively.
+- The [standards register](../../reference/standards/) records the adoption mode for the standards listed in `standards_referenced`.
+- The enforcing code is inspectable in the workspace: the constant-time fingerprint comparison in `crates/registry-platform-authcommon` (REQ-SEC-G-003); OIDC verification in `crates/registry-platform-oidc` and the Evidence authenticator in `crates/registry-evidence/src/auth.rs` (REQ-SEC-G-004); client-assertion verification and the client registry in `crates/registry-mint/src/assertion.rs` and `crates/registry-mint/src/clients.rs` (REQ-SEC-G-016); authority matching before source work in `crates/registry-evidence` and the Registry Relay route handlers (REQ-SEC-G-005); the unauthenticated-surface allow-lists in Registry Relay's router assembly (`crates/registry-relay/src/server.rs`) and the Evidence router (`crates/registry-evidence/src/server.rs`) (REQ-SEC-G-006); the audit envelope in `crates/registry-platform-audit` and the services' fail-closed audit paths (REQ-SEC-G-008, REQ-SEC-G-009); Relay's batch-child binding and PostgreSQL reservation functions in `crates/registry-relay/src/consultation` and `crates/registry-relay/src/state_plane` (REQ-SEC-G-014, REQ-SEC-G-015); Registry Mint's bounded assertion cache in `crates/registry-mint/src/replay.rs` (REQ-SEC-G-017); and the secret-material rejection lists in `crates/registry-manifest-core` (REQ-SEC-G-013).
+- The frozen Evidence Version 1 security invariant matrix (`products/evidence/contracts/security-invariant-matrix.yaml`) records the Evidence-specific form of the audit-ordering, fail-closed, transport-identity, and nonce invariants that Sections 3, 6, and 7 state at stack level.
 
 ## Next
 
 - [RS-ARC-G](../rs-arc-g/) places the security model in the registry stack architecture.
-- [RS-PR-NOTARY](../rs-pr-notary/) and [RS-PR-RELAY](../rs-pr-relay/) apply this model to each service's protocol surface.
-- [RS-TERMS](../rs-terms/) defines the security and credential vocabulary used here.
-- [Evidence issuance, end to end](../../explanation/evidence-issuance/) is the narrative explanation of claim evaluation, disclosure, and audit.
+- [RS-PR-EVIDENCE](../rs-pr-evidence/) and [RS-PR-RELAY](../rs-pr-relay/) apply this model to each service's protocol surface.
+- [RS-TERMS](../rs-terms/) defines the security and disclosure vocabulary used here.
+- The [Evidence security model](../../security/evidence/) is the narrative explanation of authentication, minimum disclosure, and audit.
diff --git a/docs/site/src/content/docs/spec/rs-terms.mdx b/docs/site/src/content/docs/spec/rs-terms.mdx
index b6da73a60..0e0ca6682 100644
--- a/docs/site/src/content/docs/spec/rs-terms.mdx
+++ b/docs/site/src/content/docs/spec/rs-terms.mdx
@@ -5,11 +5,12 @@ status: draft
 owner: registry-docs
 source_repos:
   - registry-relay
-  - registry-notary
+  - registry-evidence
+  - registry-mint
   - registry-platform
   - registry-manifest
   - solmara-lab
-last_reviewed: "2026-07-07"
+last_reviewed: "2026-08-03"
 doc_type: specification
 doc_id: RS-TERMS
 category: normative
@@ -29,7 +30,6 @@ standards_referenced:
   - ogc-api-edr
   - openapi
   - sd-jwt-vc
-  - oid4vci
   - w3c-did
   - verifiable-credentials
   - sp-dci
@@ -56,52 +56,57 @@ The key words in this document are interpreted per [RS-DOC](../rs-doc/) Section
 | 0.3.0 | 2026-06-20 | draft | Added governed Evidence Gateway and PDP enforcement terms. |
 | 0.3.1 | 2026-06-20 | draft | Added PDP, PEP, trust context, source binding, route identity, checked scope, ecosystem binding, ODRL enforcement profile, audit provenance, and fail-closed definitions. |
 | 0.3.2 | 2026-06-22 | draft | Added delegated subject access and clarified direct subject access. |
-| 0.4.0 | 2026-07-07 | draft | Renamed the static discovery bundle consistently, added the DID issuer-mode security qualifier, corrected signed response credential gating and disclosure profile casing, added SDMX and eight vocabulary entries (matching policy, claim definition, credential profile, source connector, source adapter sidecar, static-peer federation, issuer mode, JWKS), extended `standards_referenced`, and aligned subject access terminology with RS-PR-NOTARY. |
+| 0.4.0 | 2026-07-07 | draft | Renamed the static discovery bundle consistently, added the DID issuer-mode security qualifier, corrected signed response credential gating and disclosure profile casing, added SDMX and eight vocabulary entries (matching policy, claim definition, credential profile, source connector, source adapter sidecar, static-peer federation, issuer mode, JWKS), extended `standards_referenced`, and aligned subject access terminology with the then-current Registry Notary product specification, since retired. |
 | 0.5.0 | 2026-07-09 | draft | Marked Registry Relay signed response credentials and issuer mode as removed before 1.0. |
-| 0.6.0 | 2026-07-13 | draft | Replaced direct Notary source connectors and sidecars with compiler-pinned Relay consultations and Registry Stack project authoring terms. |
+| 0.6.0 | 2026-07-13 | draft | Replaced direct Registry Notary source connectors and sidecars with compiler-pinned Relay consultations and Registry Stack project authoring terms. Registry Notary has since been retired. |
 | 0.6.1 | 2026-07-14 | draft | Added the complete Registry Stack project-authoring vocabulary and clarified compiler-derived credential membership. |
 | 0.7.0 | 2026-07-16 | draft | Defined the formal stack as four products and classified Solmara Lab as a separate adopter demo. |
 | 0.8.0 | 2026-07-19 | draft | Defined the registry-backed, issuer-initiated OID4VCI profile and its algorithm, transaction-code, and non-conformance boundaries. |
+| 0.9.0 | 2026-08-03 | draft | Reseated the vocabulary on Registry Relay, Evidence, and Registry Mint, added the Evidence assertion terms, and marked the retired Registry Notary terms as retired. |
 
 ## 1. Products
 
-The registry stack comprises four formal products. Product names are Title Case. Repository slugs appear in `monospace` and are always lowercase. The phrase "registry stack" (lowercase) refers to the four-product ensemble.
+The registry stack comprises four formal products. Product names are Title Case. Repository slugs appear in `monospace` and are always lowercase. The phrase "registry stack" (lowercase) refers to the four-product ensemble together with the supporting service named below.
 
-**Registry Platform** (`registry-platform`): Shared Rust workspace for registry security and operational primitives, including auth helpers, OIDC verification, audit envelopes, HTTP security, outbound HTTP policy, crypto, Selective Disclosure JWT Verifiable Credential (SD-JWT VC) helpers, and test fixtures. Consumed by both runtime services.
+**Registry Platform** (`registry-platform`): Shared Rust workspace for registry security and operational primitives, including auth helpers, OIDC verification, audit envelopes, HTTP security, outbound HTTP policy, crypto, Selective Disclosure JWT Verifiable Credential (SD-JWT VC) helpers, and test fixtures. Consumed by the runtime services.
 
 **Registry Relay** (`registry-relay`): Config-driven Rust service that owns registry source access, product-neutral HTTP and script adaptation, immutable snapshot lookup, and protected, read-only consultation APIs.
 
 **Registry Manifest** (`registry-manifest`): Rust workspace for modeling, validating, and rendering standards-facing service, registry, form, and policy metadata without running Registry Relay. Provides a library (`registry-manifest-core`) and a command-line interface (`registry-manifest-cli`).
 
-**Registry Notary** (`registry-notary`): Standalone Rust service for claim evaluation from compiler-pinned Relay consultations, disclosure policy, credential issuance from exact Relay-backed evaluation provenance, and audit. It has no direct registry source connector.
+**Evidence** (`registry-evidence`): Single-crate minimum-disclosure assertion service and its `evidence` binary. Given authenticated authority, an authorized purpose, and a predefined requirement, it returns a signed assertion that answers the requirement rather than the source record. Evidence has no credential issuance lifecycle.
+
+**Registry Mint** (`registry-mint`): Supporting service, not a fifth product pattern. It issues short-lived, audience-bound access tokens to registered machine clients so a resource server such as Evidence can require signed tokens without a general-purpose identity provider. The dependency runs one way only: Registry Mint's tests drive Evidence's authenticator, and Evidence does not depend on Registry Mint.
 
 **Solmara Lab** (`solmara-lab`): Separately maintained adopter demo for the fictional Republic of Solmara. It runs published Registry Stack images in local and hosted topologies. Solmara Lab is not a formal Registry Stack product and has no conformance weight in the Registry Stack specifications.
 
-## 2. Protocol and credential terms
+## 2. Assertion and credential terms
+
+**assertion**: The stateless signed payload Evidence returns for one request. It answers a requirement and carries no source record. Its member set is closed by the frozen contract `products/evidence/contracts/evidence.schema.yaml`, which names the supported requirement, the conformant Evidence Type, issuer and provider, issue, observation, and validity instants, purpose, audience, configuration revision, role-bound subject bindings, and supported values. An assertion has no lifecycle: there is no issuance session, no status list, and no revocation. Registry Stack product term.
 
-**claim evaluation**: The Registry Notary process that evaluates configured evidence rules over compiler-pinned Relay outputs and returns a structured claim result. Subject access may authorize this process but does not provide evidence. Registry Stack product term.
+**acceptance definition**: One complete authored answer path in an Evidence deployment project: a source with its request and response schema, the extraction script, the fact schema and any codelist, the derivation, the requirement with its concept and disclosure guard, the authority grant that permits it, and the synthetic fixture cases that prove it. Evidence Version 1 freezes four coequal acceptance definitions: adult status, residence region, professional licence status, and legal-parent relationship. No acceptance definition is privileged in the runtime, so none of them MUST become a Rust domain type, a built-in operation, or a special route. Registry Stack product term.
 
-**evidence claim**: A verifiable claim, attestation, credential claim, or status assertion that Registry Notary evaluates from compiler-pinned Relay outputs. Registry Stack product term.
+**requirement**: The predefined, versioned question one Evidence request names, declared in the immutable bundle with its identifier, kind, source, authorized purposes, subject roles and selector profiles, reference frameworks, Evidence Type, validity, derivation, concepts, fixtures, and disclosure guard. Only predefined, versioned requirements can be evaluated, and to a caller lacking authorization an unknown requirement MUST be indistinguishable from an unauthorized one. The CCCEV term is adopted for the same idea.
 
-**disclosure profile**: Registry Notary control over what the caller receives from a claim evaluation result: `value` (full value disclosed), `predicate` (only true/false satisfaction), or `redacted` (value fully hidden). Registry Stack product term.
+**purpose**: The authorized reason a caller gives for one Evidence request. A purpose is a configured code drawn from the requirement's declared purposes and from the caller's grant, never caller-defined prose, and it forms part of the single authorization decision. It is echoed into the assertion and MUST NOT narrow disclosure: a use case that justifies a coarser answer needs its own requirement. Registry Stack product term.
 
-**holder**: The party that holds a credential in a wallet and presents it to a verifier. Registry Notary binds each credential to a holder key (`did:jwk`) in the `cnf` claim, so only the holder can present it.
+**minimum disclosure**: The rule that one Evidence response carries the smallest sufficient answer to one requirement and never the source record. The assertion payload is closed against additional properties, subject selector profiles and selector values MUST NOT appear in it, and the output gate admits only the exact concept identifiers and value forms the requirement declares. Registry Stack product term.
 
-**wallet**: A holder-owned application that stores credentials and presents them to verifiers. Registry Notary issues credentials; the wallet that stores, unlocks, and presents them is a separate component owned by the holder.
+**access token**: The bearer credential a caller presents to Evidence. Evidence accepts one authentication kind whose issuer, audiences, accepted token types, algorithms, key set location, and claim names are fixed in the immutable bundle, and it reads authority only from those configured claim names. Registry Mint issues such tokens; any issuer writing the same claims serves equally well. Caller-supplied data outside the verified token MUST NOT create authority.
 
-**subject access**: Registry Notary authorization pattern where an authenticated OIDC principal is the protected requester for configured claim evaluation. Registry Notary has two subject access modes: `subject_bound` (direct subject access), where the authenticated principal is the subject, and `delegated_subject_access` (delegated subject access), where the authenticated principal is the requester and a configured dependent target can be evaluated only when scoped authorization details name the same target, relationship, and proof claim. Subject access never supplies claim evidence; every allowed claim remains registry-backed. Registry Stack product term.
+**holder**: The party whose public key a caller may supply on an Evidence request. Evidence echoes that key into the SD-JWT VC `cnf` claim and does nothing else with it: there is no holder-binding ceremony, no key-binding JWT, and no presentation verification. The key MUST NOT reach authorization, selectors, scripts, source requests, or audit.
 
-**delegated subject access**: Registry Notary authorization mode `delegated_subject_access`. The requester is derived from the authenticated principal, the request target and scoped authorization details identify the same configured dependent subject, the relationship is derived from scoped authorization details, and the dependent claim can continue only after the compiler-pinned Relay proof consultation evaluates to boolean `true`. This is distinct from static-peer delegated evaluation under Notary federation. Registry Stack product term.
+**SD-JWT VC**: Selective Disclosure JWT Verifiable Credential (IETF draft). Evidence serializes the same stateless assertion as an SD-JWT VC under the frozen profile `products/evidence/contracts/sd-jwt-vc-profile.yaml`, when the immutable bundle and the matched grant both permit that response format. The subject binding stays audience-scoped, so the serialization is meaningful only to the relying party the assertion names. This is a second encoding of one response, not a credential lifecycle. Media type: `application/dc+sd-jwt`.
 
-**signed response credentials**: Removed Registry Relay feature that attached a W3C Verifiable Credentials Data Model (VCDM) 2.0 VC-JWT signed credential to entity record and aggregate responses. Registry Relay no longer accepts the legacy `provenance` configuration key, no longer serves `/.well-known/did.json`, `/schemas/{claim_type}/{version}`, or `/contexts/{vocab}/{version}`, and no longer returns `application/vc+jwt`. Use Registry Notary for credential issuance.
+**DID**: Decentralized Identifier. W3C DID Core 1.0. Registry Relay no longer publishes a DID document, and no current stack service resolves, publishes, or issues DIDs. Evidence accepts an optional holder public key as a bare JSON Web Key, not as a DID.
 
-**SD-JWT VC**: Selective Disclosure JWT Verifiable Credential (IETF draft). Registry Notary issues registry-backed SD-JWT VC credentials signed with EdDSA or ES256. OID4VCI holder proof remains EdDSA with `did:jwk` binding. Media type: `application/dc+sd-jwt`.
+**signed response credentials**: Removed Registry Relay feature that attached a W3C Verifiable Credentials Data Model (VCDM) 2.0 VC-JWT signed credential to entity record and aggregate responses. Registry Relay no longer accepts the legacy `provenance` configuration key, no longer serves `/.well-known/did.json`, `/schemas/{claim_type}/{version}`, or `/contexts/{vocab}/{version}`, and no longer returns `application/vc+jwt`. No current stack service issues W3C VCDM credentials.
 
-**OID4VCI**: OpenID for Verifiable Credential Issuance. Registry Notary implements a profiled registry-backed issuer subset with `dc+sd-jwt`, an issuer-initiated pre-authorized code, a transaction-bound proof nonce returned by the token response, and EdDSA `did:jwk` holder proof. The identity provider's authorization code is an internal Notary input, not a wallet grant. The profile has no public nonce endpoint, response next nonce, issuance from caller-provided evidence, ES256 holder proof, EUDI, HAIP, PAR, DPoP, or wallet-attestation claim. Full issuer and external-wallet conformance are not asserted (`openid4vci.support: not_full_issuer`).
+**wallet**: A holder-owned application that stores credentials and presents them to verifiers. No current stack service integrates with one, and wallet onboarding, wallet attestation, and presentation verification are frozen Evidence Version 1 non-goals.
 
-**DID**: Decentralized Identifier. W3C DID Core 1.0. Registry Relay no longer publishes a DID document. Registry Notary parses `did:jwk` values for credential subjects.
+**OID4VCI**: OpenID for Verifiable Credential Issuance. No current stack service implements it, and OID4VCI in any part is a frozen Evidence Version 1 non-goal, so the SD-JWT VC serialization has no credential offer, pre-authorized code, token endpoint, nonce endpoint, or wallet grant.
 
-**eSignet**: Open-source identity and authentication service (part of MOSIP). Registry Notary can use eSignet for the internal browser authentication leg of a registry-backed pre-authorized credential transaction. Its authorization code is consumed by Notary and is not a wallet grant. Not a Registry Stack product term.
+**eSignet**: Open-source identity and authentication service (part of MOSIP). No current stack service integrates with it. Evidence authenticates callers against one configured OIDC issuer and key set named in its immutable bundle and names no specific identity product. Not a Registry Stack product term.
 
 ## 3. Metadata and standards terms
 
@@ -121,33 +126,26 @@ The registry stack comprises four formal products. Product names are Title Case.
 
 **observations**: The array of data rows returned in the `AggregateResult.observations` field for a Registry Relay aggregate query. Each observation is an object keyed by dimension and measure identifiers. Replaces the former `data` field name from the SDMX-refactor rename. Registry Stack product term.
 
-**evidence offering**: Metadata entry that describes a verification capability and the access path a client uses to reach it. In the current stack it points a client from Registry Relay metadata to Registry Notary or another evidence service; Relay describes the offering but does not evaluate the claim. Registry Stack product term.
+**evidence offering**: Metadata entry in a Registry Manifest dataset that describes a verification capability and the access path a client uses to reach it, published under the schema versions `registry-manifest-evidence-offering/v1` and `registry-manifest-evidence-offerings/v1`. Registry Manifest compiles and publishes offerings and Registry Relay serves them in its metadata. An offering is a pointer; the service that publishes it does not evaluate the capability behind it. Registry Stack product term.
 
 **evidence type list**: A Core Criterion and Core Evidence Vocabulary (CCCEV) list of evidence types that satisfy a requirement. In Registry Manifest, one list is one grouped option; multiple lists on the same requirement are alternatives. The CCCEV term is adopted directly.
 
-**claim definition**: The Registry Notary configuration artifact that declares a named claim capability: its identity, evidence mode, typed inputs, compiler-pinned Relay consultations where registry-backed, the single rule that decides its value, and the disclosure, format, and credential rules that shape what leaves the service. Registry Stack product term.
-
-**credential profile**: Registry Notary configuration that names which claims may be issued as a
-credential. A Registry Stack project authors this membership once on the profile; the compiler
-derives the claim-to-profile reverse index required by Registry Notary's product configuration.
-Registry Stack product term.
-
-**issuer mode**: Removed Registry Relay signed response credentials configuration axis. Registry Relay no longer signs under a gateway DID or a delegated ministry DID. Registry Notary owns issuer configuration for credentials.
+**deployment project**: The directory an Evidence operator authors and mounts: a `runtime.yaml` file holding process-local bindings, and a `bundle/` directory holding the governed configuration, scripts, schemas, codelists, and fixtures. The bundle is loaded read-only at startup, so a new revision is a new deployment rather than a live change. Registry Stack product term.
 
-**JWKS**: JSON Web Key Set. Registry Notary publishes its issuer's public verification keys at `GET /.well-known/evidence/jwks.json`, served without authentication so a verifier can obtain the public key without holding a Notary credential.
+**JWKS**: JSON Web Key Set. Evidence publishes its signing keys at `GET /.well-known/evidence/jwks.json` and Registry Mint publishes its own at a configured path, default `/.well-known/jwks.json`. Both are served without authentication so a verifier can obtain the public key without holding a credential.
 
-**Relay consultation**: A compiler-pinned request from Registry Notary to Registry Relay. The binding names a Relay profile id and contract hash, maps only declared typed request inputs, and requires purpose agreement before Relay performs source work. Registry Stack product term.
-
-**Registry Stack project**: The authored root for one registry trust domain. It can describe a Relay-only, Notary-only, or combined deployment, and compiles separate product configuration inputs for the selected topology. Registry Stack product term.
+**Registry Stack project**: The authored root for one registry trust domain, compiled by `registryctl` into separate product configuration inputs for the selected topology. A project describes a Registry Relay deployment and declares Relay lanes only. An Evidence deployment is authored separately as a deployment project. Registry Stack product term.
 
 **trust domain**: The institutional boundary whose operators, runtime identities, policy, and
 deployment approval govern one Registry Stack project. A geographic jurisdiction can contain
-several trust domains, and a trust domain does not need to represent a country. Registry Stack
-product term.
+several trust domains, and a trust domain does not need to represent a country. One Evidence
+serving process serves exactly one operator-controlled trust domain. Registry Stack product term.
 
 **source**: The one logical registry data interface available to Registry Relay, when present,
 inside the project trust domain. An OAuth or JSON Web Key Set endpoint used by a protocol is not
-another data source. Registry Stack product term.
+another data source. Evidence uses the same word for its own configured provider, whose origin,
+method, path, headers, authentication, transport trust, timeout, and byte limits are fixed in the
+bundle and executed only by the Rust core. Registry Stack product term.
 
 **integration**: A reusable Registry Relay-owned unit that accepts typed inputs, uses `http`,
 `script`, or `snapshot` against the project source, and returns a consultation outcome plus
@@ -157,13 +155,9 @@ product term.
 **entity**: A logical Registry Relay-local schema that can be materialized and queried by
 `snapshot` and can optionally be exposed through a records service. Registry Stack product term.
 
-**service**: An authored, purpose-bound public capability. Use the specific term evidence service
-or records service when the distinction matters. A service is not a Registry Relay or Registry
-Notary process. Registry Stack product term.
-
-**evidence service**: A Registry Notary-owned service containing service policy, claims,
-disclosure, optional Registry Relay consultations, and optional credential profiles. Registry
-Stack product term.
+**service**: An authored, purpose-bound public capability. Use the specific term records service
+when the distinction matters. A service is the authored intent, not the Registry Relay process
+that serves it. Registry Stack product term.
 
 **records service**: A Registry Relay-owned records API exposure of an entity, with its own
 access, purpose, projection, filter, and pagination policy. Registry Stack product term.
@@ -171,27 +165,28 @@ access, purpose, projection, filter, and pagination policy. Registry Stack produ
 **service policy**: The purpose, legal basis, consent, caller access, and disclosure rules
 governing one service. Registry Stack product term.
 
-**consultation**: A named use of one Registry Relay integration by an evidence service. One
-consultation can supply several Registry Notary claims. Registry Stack product term.
+**consultation**: A named, purpose-aware use of one Registry Relay integration. Relay resolves the
+pinned source plan, performs the minimized source acquisition, and returns the declared typed
+outputs. Evidence can consume one by treating a Relay route as an ordinary fixed HTTP source,
+which carries no special status in an Evidence bundle. Registry Stack product term.
 
 **output**: A typed, minimized scalar returned by Registry Relay on a matching consultation.
 Registry Stack product term.
 
-**claim**: A Registry Notary-owned, purpose-specific value or predicate derived from consultation
-outcome and outputs. Registry Stack product term.
-
 **environment**: Private bindings and operational settings for one Registry Stack project
 deployment target, without changing stable project intent. Registry Stack product term.
 
-**deployment bundle**: The generated, signed artifact for one Registry Stack project and
-environment. Its root manifest binds compatible Registry Relay and Registry Notary submanifests
-when both are present. The current authoring command emits unsigned product inputs rather than a
-deployment bundle; signed project-root bundles are deferred. Registry Stack product term.
+**deployment bundle**: A deferred project-root packaging concept. The current authoring command
+emits unsigned per-product inputs, no signed project-root bundle is generated, verified, or
+activated, and no coordinator binds one product's configuration to another's. Not the same thing
+as an Evidence deployment project's governed bundle, which is one product's immutable startup
+input. Registry Stack product term.
 
-**deployment**: One activated deployment-bundle generation. Replicas of that generation are one
-logical deployment. Registry Stack product term.
+**deployment**: An operated set of Registry Relay or Evidence product instances. A combined
+topology stages each product's separately verified configuration and admits traffic only after
+both products are ready; this is not atomic project activation. Registry Stack product term.
 
-**static-peer federation**: Registry Notary delegated evaluation between peers loaded from configuration at startup; a request from an unconfigured peer is rejected. A configured peer posts a compact signed JWT request through `POST /federation/v1/evaluations` and receives a compact signed JWT response carrying a scoped evaluation result. Dynamic trust-chain discovery and federated credential issuance are out of scope. Registry Stack product term.
+**issuer mode**: Removed Registry Relay signed response credentials configuration axis. Registry Relay no longer signs under a gateway DID or a delegated ministry DID, and no current stack service exposes an issuer-mode configuration axis. Registry Stack product term.
 
 **DCAT**: Data Catalog Vocabulary. W3C recommendation. Registry Relay and Registry Manifest emit DCAT-shaped JSON-LD catalogs. Spell out on first use per document.
 
@@ -199,13 +194,13 @@ logical deployment. Registry Stack product term.
 
 **CPSV-AP**: Core Public Service Vocabulary Application Profile. Registry Manifest emits CPSV-AP service catalogue JSON-LD.
 
-**CCCEV**: Core Criterion and Core Evidence Vocabulary. Registry Manifest emits CCCEV-shaped requirement, evidence type, and evidence type list metadata. Registry Notary renders CCCEV-shaped JSON-LD for claim evaluation results. Media type: `application/ld+json; profile="cccev"`.
+**CCCEV**: Core Criterion and Core Evidence Vocabulary. Registry Manifest emits CCCEV-shaped requirement, evidence type, and evidence type list metadata. Evidence maps its assertion payload onto CCCEV terms under the frozen mapping `products/evidence/contracts/cccev-field-mapping.yaml`, with named Evidence extensions where CCCEV has no counterpart.
 
 **SHACL**: Shapes Constraint Language. W3C recommendation. Registry Relay and Registry Manifest emit SHACL node shapes for entity validation.
 
 **ODRL**: Open Digital Rights Language. W3C recommendation. Registry Relay and Registry Manifest emit ODRL Offer documents for dataset-scoped descriptive policies. Governed Evidence Gateway runtime enforcement uses only the supported ODRL enforcement terms declared by the `registry-evidence-gateway-pdp/v1` profile; publishing an ODRL policy document is not itself runtime enforcement.
 
-**JSON-LD**: JSON-based linked data format. W3C recommendation (JSON-LD 1.1). Used for catalog, policy, and CCCEV render output.
+**JSON-LD**: JSON-based linked data format. W3C recommendation (JSON-LD 1.1). Used for catalog and policy render output.
 
 **OGC API Records**: Open Geospatial Consortium API specification for records. Registry Relay exposes records endpoints behind the `ogcapi-records` feature flag. Registry Manifest renders and publishes an OGC Records item collection.
 
@@ -215,11 +210,11 @@ logical deployment. Registry Stack product term.
 
 **SKOS**: Simple Knowledge Organization System. Registry Manifest currently emits flat SKOS-shaped `skos:ConceptScheme` and `skos:Concept` nodes for codelists inside SHACL and BRegDCAT/DCAT-shaped outputs. It does not yet publish a standalone SKOS artifact.
 
-**SP DCI**: Social Protection Digital Convergence Initiative. Registry Relay exposes an SP DCI adapter behind the `spdci-api-standards` feature flag and can execute a reviewed DCI source integration. Registry Notary consumes the resulting Relay consultation.
+**SP DCI**: Social Protection Digital Convergence Initiative. Registry Relay exposes an SP DCI adapter behind the `spdci-api-standards` feature flag and can execute a reviewed DCI source integration.
 
 **SDMX**: Statistical Data and Metadata eXchange. Registry Relay serves configured aggregates as SDMX-JSON 2.1 data messages (media type `application/vnd.sdmx.data+json;version=2.1`) through content negotiation or `?f=sdmx-json`. Scope is limited to data messages: structure messages and the SDMX REST API are not implemented.
 
-**PROV-O**: W3C Provenance Ontology. Currently listed as design influence (`inspired_by`). Provenance-shaped concepts appear in audit fields and the claim provenance struct, but no PROV-O vocabulary terms are emitted as JSON-LD at reviewed commits.
+**PROV-O**: W3C Provenance Ontology. Currently listed as design influence (`inspired_by`). Provenance-shaped concepts appear in audit fields, but no PROV-O vocabulary terms are emitted as JSON-LD at reviewed commits.
 
 **claim level**: The evidence discipline these docs use for standards claims: `implements`, `emits`, `maps_to`, `aligns_with`, `inspired_by`, or `compares_against`. Applies to entries in the standards register and is used to characterize a product's relationship to an external standard without overstatement.
 
@@ -227,11 +222,11 @@ logical deployment. Registry Stack product term.
 
 ## 4. Governance and safeguards terms
 
-**Evidence Gateway**: Registry Stack product term for the governed runtime path that selects an evidence pack or claim policy and asks the shared PDP to permit, redact, or deny a Relay read, Relay consultation, or Notary claim evaluation. The metadata manifest describes governed evidence bindings and evidence packs; runtime services perform the PDP enforcement for their configured surfaces.
+**Evidence Gateway**: Registry Stack product term for Registry Relay's governed runtime path, which selects an evidence pack or policy and asks the shared PDP to permit, redact, or deny a Relay read or consultation. The name also survives in the ODRL enforcement profile identifier `registry-evidence-gateway-pdp/v1`. It does not name Evidence (the product), which is a separate service with its own authorization and disclosure contracts and no policy decision point.
 
-**PDP**: Policy decision point. In Registry Stack, the shared Registry Platform primitive that evaluates a governed policy against trusted request and source context and returns permit, permit with redaction, or deny with stable `pdp.*` provenance. Registry Stack product term.
+**PDP**: Policy decision point. In Registry Stack, the shared Registry Platform primitive that evaluates a governed policy against trusted request and source context and returns permit, permit with redaction, or deny with stable `pdp.*` provenance. Evidence does not use a PDP: its authorization is one decision over the verified token, the requirement, and the matched grant. Registry Stack product term.
 
-**PEP**: Policy enforcement point. The runtime service surface, such as a Registry Relay governed read or consultation, or a Registry Notary claim evaluation, that calls the PDP and enforces the resulting permit, redaction, or deny decision. Registry Stack product term.
+**PEP**: Policy enforcement point. The runtime service surface, such as a Registry Relay governed read or consultation, that calls the PDP and enforces the resulting permit, redaction, or deny decision. Registry Stack product term.
 
 **governed evidence**: Evidence metadata and runtime behavior bound to a governed evidence ecosystem binding (`type: governed-evidence`). In the manifest, governed evidence requires evidence-pack metadata such as pack identity, source basis, semantic profile, evidence envelope, required PDP gates, allowed outputs, policy identity, policy hash, and ODRL enforcement profile. At runtime, Relay can use the selected binding to feed the PDP policy id, policy hash, supported ODRL terms, source freshness, route identity, source binding, checked scope, and trust context into a decision.
 
@@ -253,7 +248,7 @@ logical deployment. Registry Stack product term.
 
 **PDP audit provenance**: Audit fields that explain a governed PDP decision, including policy id, policy hash, evaluated rule ids, route identity, source binding, checked scopes, trust-provenance labels, and stable `pdp.*` denial code when denied. Registry Stack product term.
 
-**safeguards**: Commitment that every exchange the stack mediates is authorized, scoped, and audited. Concretely: authentication by API key or OIDC; scope-checked routes; per-claim disclosure control (value, predicate, or redacted); no source-registry data mutation through Relay; audit envelopes for every request that touches person-level data. Registry Stack product term.
+**safeguards**: Commitment that every exchange the stack mediates is authorized, scoped, and audited. Concretely: authentication by API key, OIDC, or a verified access token; scope-checked routes; disclosure limited to what a service or requirement declares in advance; no source-registry data mutation through Relay; audit envelopes for every request that touches person-level data. Registry Stack product term.
 
 **executable safeguards**: Runtime-enforced safeguards: scoped routes, disclosure policy, audit events, machine-readable metadata, and other policy enforcement point behavior that can be checked by software. Registry Stack product term.
 
@@ -265,7 +260,7 @@ logical deployment. Registry Stack product term.
 
 **minimized evidence**: An evidence response shaped by data minimization, selective disclosure, or verifiable attestation. The response can be narrower than the full source record when the configured use case supports that pattern. Registry Stack product term.
 
-**reviewability**: Commitment that every promise the stack makes is backed by an artifact a third party can inspect without trusting the operator's word. Examples include the published DCAT catalog, the SHACL shapes, the ODRL policy documents, the audit envelope schema, the JWKS public key endpoint, and the credential profile configuration. Registry Stack product term.
+**reviewability**: Commitment that every promise the stack makes is backed by an artifact a third party can inspect without trusting the operator's word. Examples include the published DCAT catalog, the SHACL shapes, the ODRL policy documents, the audit envelope schema, the JWKS public key endpoint, and the Evidence security invariant matrix with its test traceability. Registry Stack product term.
 
 **interoperability**: Commitment that every registry in the stack publishes its catalog, schemas, services, and policies in standards-shaped form (DCAT, BRegDCAT-AP, CPSV-AP, CCCEV, SHACL, JSON Schema, ODRL, OpenAPI, OGC Records, SKOS-shaped codelists, SD-JWT VC), so downstream systems integrate against stable contracts rather than per-deployment ones. Registry Stack product term.
 
@@ -289,6 +284,7 @@ This table maps each acronym used in registry stack documentation to its expansi
 | DPI | Digital Public Infrastructure |
 | JSON-LD | JSON Linked Data |
 | JWKS | JSON Web Key Set |
+| JWS | JSON Web Signature |
 | ODRL | Open Digital Rights Language |
 | OID4VCI | OpenID for Verifiable Credential Issuance |
 | OGC API EDR | OGC API Environmental Data Retrieval |
@@ -311,12 +307,16 @@ These terms classify a documentation page so a reader, human or AI agent, can te
 
 - **metadata**: the portable metadata layer (Registry Manifest and the static discovery bundle).
 - **consultation**: Registry Relay's protected, read-only consultation APIs.
-- **evaluation**: Registry Notary claim evaluation.
-- **credential**: Registry Notary credential issuance, direct and over OID4VCI.
-- **federation**: Registry Notary delegated (static-peer) evaluation.
+- **evaluation**: Evidence requirement evaluation and assertion issuance.
+- **credential**: retired. It named a retired product's credential issuance, direct and over OID4VCI; no current page should declare it.
+- **federation**: retired. It named a retired product's delegated (static-peer) evaluation; no current page should declare it.
 - **administration**: operator administration surfaces, including configuration and the key and reload boundaries.
 - **operations**: runtime operation and recovery, including audit sinks, deployment, and runbooks.
 
+{/* TODO[evidence]: `scripts/check-doc-frontmatter.mjs` still accepts `credential` and `federation`
+    in its `validLayer` set. That validator is outside this page's assignment; retiring the two
+    values there is a follow-up. */}
+
 **audience**: The reader role or roles a page serves. The defined values are `integrator` (a developer integrating against a stack surface), `operator` (an operator configuring or running a deployment), `maintainer` (a contributor to a stack component), `specification editor` (an author of this formal layer), and `tooling` (an AI coding agent or other automated reader that consumes the page as input).
 
 ## Evidence
@@ -326,6 +326,7 @@ This specification is `verified`: the definitions are distilled from published r
 - The [glossary](../../reference/glossary/) is the friendlier reference form of this vocabulary and the source these definitions distill. RS-TERMS is authoritative where the two disagree.
 - The [standards register](../../reference/standards/) records each external standard mapped in Section 3, with its adoption mode and the products that use it.
 - The architecture specification [RS-ARC-G](../rs-arc-g/) is the referent for the layer vocabulary in Section 6: each layer names a component or surface defined there.
+- The Evidence terms in Section 2 are distilled from the frozen Version 1 contracts under `products/evidence/contracts/` and are stated normatively in [RS-PR-EVIDENCE](../rs-pr-evidence/).
 
 ## Next
 
diff --git a/docs/site/src/content/docs/start/evaluate-evidence.mdx b/docs/site/src/content/docs/start/evaluate-evidence.mdx
new file mode 100644
index 000000000..4b44510c0
--- /dev/null
+++ b/docs/site/src/content/docs/start/evaluate-evidence.mdx
@@ -0,0 +1,257 @@
+---
+title: Evaluate Evidence
+description: A cost accounting of running Evidence, what it needs to start, what it does not depend on, how it deploys today, and what operating it demands, for someone deciding whether to commit to it.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-03"
+doc_type: explanation
+locale: en
+standards_referenced: []
+---
+
+This page is for someone sizing up Evidence before committing infrastructure,
+security review, and operational capacity to it. It assumes the fit question
+from [When Registry Stack fits](../when-to-use/) is already settled and asks
+the next one: what does running it actually cost.
+
+## Runtime footprint
+
+Evidence is one crate, `registry-evidence`, and one binary, `evidence`
+(`crates/registry-evidence/Cargo.toml`). There is no separate control plane,
+worker process, or sidecar: one process serves one operator-controlled trust
+domain (`products/evidence/README.md`).
+
+At startup the process reads two inputs, both mounted read-only: a closed
+operator `runtime.yaml` that binds one listener, bundle directory, secret
+root, audit destination, and local TLS trust files; and an immutable,
+reviewed evidence bundle directory holding the deployment's YAML, Rhai
+scripts, schemas, codelists, and fixtures. Neither input may be writable to
+the service process; startup and readiness fail when either is incomplete,
+inconsistent, or mutable (`products/evidence/OPERATOR-CONTRACT.md`).
+
+It also needs key material on local disk before it can start: an Ed25519
+signing key whose `kid` matches `signing.activeKeyId`, plus two independently
+generated raw secrets of at least 32 bytes, one for the audit hash chain and
+one for subject-binding pseudonyms. All three live under an owner-only (mode
+`0700`) secret root, each file mode `0600`
+(`products/evidence/OPERATOR-CONTRACT.md`).
+
+The runtime requires a complete deployment layout like this:
+
+```text
+project_root/
+  bundle/                 governed, reviewed, mounted read-only
+    evidence.yaml         the deployment contract
+    adapters/             request preparation and fact extraction (Rhai)
+    derivations/          requirement derivation (Rhai)
+    schemas/              closed adapter-parameter, response, and fact schemas
+    fixtures/             synthetic acceptance cases
+  runtime.yaml            process-local paths and listener, not governed
+  secrets/                key material, created empty with mode 0700
+  audit/                  audit records written by the service
+```
+
+`evidencectl new <dir> --openapi <file-or-url> --profile local` starts an editable authoring
+workspace. It retains the OpenAPI document and creates directories for reusable selector and
+source objects, source scripts and schemas, questions, and derivations. `--generate-keys` adds
+disposable owner-only local keys. `evidencectl source suggest --project <dir>` drafts one source
+from the retained contract, and `evidencectl dev` compiles complete authoring objects into the
+private local runtime layout shown here (`crates/registry-evidencectl/src/scaffold.rs`,
+`crates/registry-evidencectl/src/authoring.rs`).
+
+## Dependencies
+
+Evidence does not run against a database. `products/evidence/OPERATOR-CONTRACT.md`
+states it directly: "Evidence Version 1 has no application database and
+persists no selector, source, evidence, or response data." The one place
+Evidence writes durable state is the audit trail, and that is a keyed JSONL
+hash chain on local storage, not a database table. The module that implements
+it says so in its own header comment: "Fail-closed native Evidence audit with
+a durable keyed JSONL chain" (`crates/registry-evidence/src/audit.rs`). An
+external durable audit service may own that storage instead, but nothing in
+the runtime requires a database engine to reach it.
+
+The same boundary excludes a message broker and workers; `products/evidence/README.md`
+lists both among what Version 1 does not include. `products/evidence/CONCEPT.md`
+states the infrastructure implication for the native deployment target
+directly: "It does not require Kubernetes, a message broker, a database, OPA,
+or a service mesh."
+
+Two dependencies remain real, even though neither ships with Evidence:
+
+- An identity provider. Evidence verifies bearer tokens against one
+  configured OIDC issuer; it does not issue tokens itself. Where no identity
+  provider exists, Registry Mint fills that gap: it "issues the access
+  tokens a resource server such as Evidence verifies, for deployments with no
+  identity provider." The dependency runs one way: "Mint's tests drive
+  Evidence's authenticator; Evidence does not depend on Mint" (root
+  `AGENTS.md`).
+- The authoritative source system each requirement calls. Evidence executes
+  one fixed, bounded HTTP JSON request per source and never fans out to
+  additional systems; it depends on that source answering within its
+  configured timeout and concurrency limit, not on any data store Evidence
+  itself owns.
+
+## Deployment options today
+
+Build the toolset from source with
+`cargo build --release --locked -p registry-evidence -p registry-evidencectl -p registry-mint`,
+or, for a tagged release that publishes it, install reproducible bare
+binaries through the pinned installer script
+(`products/evidence/README.md`).
+
+Container images exist for both `evidence` and its companion `mint` token
+issuer. `docker/Dockerfile` builds them as distroless images
+(`gcr.io/distroless/cc-debian13:nonroot`, user `65532`, no shell, no package
+tools) from one multi-stage file that uses cargo-chef so dependency
+compilation caches independently per binary. Neither image declares a Docker
+`HEALTHCHECK`, because distroless has no shell or `curl` and neither binary
+has a healthcheck subcommand; the orchestrator probes `GET /health` over HTTP
+instead (`docker/README.md`).
+
+These images are explicitly not release evidence. The released Relay image
+comes from a separate, byte-reproducible path (`release/docker/`, built
+outside Docker); if Mint or Evidence images become release artifacts, they
+will follow that path, not this one.
+
+An operator may use Docker Compose as an adapter for an approved candidate,
+but Compose is not generated by `evidencectl build`. The adapter mounts the
+reviewed bundle unchanged, then mounts a separate container runtime, secret
+root, and persistent audit volume. It binds Evidence to a private
+Compose-network address and puts operator-controlled TLS in front. Only the
+runtime revision changes when container paths or listener bindings change;
+the bundle revision remains the assertion `configurationRevision`.
+The [Evidence candidate Compose guide](../../tutorials/integrate-evidence-candidate-with-docker-compose/)
+covers that shape. Registry Mint remains optional when the deployment has no
+suitable OIDC issuer.
+
+## Operational burden
+
+### Keys
+
+`evidencectl keygen` generates the signing key and the two HMAC secrets;
+nothing about generation happens automatically on deploy. Rotation is the
+operator's job too: a deployment keeps one active signing key at a time and
+must retain every retired public key in the published JWKS for at least the
+maximum assertion validity plus allowed clock skew, or a verifier holding an
+older cached assertion will fail to check it
+(`products/evidence/OPERATOR-CONTRACT.md`).
+
+### Deployment inputs
+
+Both `runtime.yaml` and the bundle directory must be non-writable before
+Evidence will start; a read-only mount is preferred. An operator can remove
+write bits with `chmod -R a-w bundle` and `chmod 444 runtime.yaml` before
+running `evidence check`. Editing either input means restoring write access,
+making the change, removing write access again, and rerunning the check
+(`products/evidence/OPERATOR-CONTRACT.md`). There is no hot reload, override
+layer, or runtime mutation API.
+
+### Audit trail
+
+The audit sink takes an exclusive OS advisory lock on its path at startup,
+so exactly one Evidence process may write a given audit path at a time;
+scaling horizontally means N processes with N distinct audit paths, run
+active/passive rather than active/active. Segment rotation
+(`auditStorage.maximumFileBytes`) happens online with no operator action, but
+retention, backup, restore, and chain verification stay entirely the
+operator's responsibility: nothing in the runtime deletes or compacts a
+sealed segment. `evidence verify-audit` is the out-of-band command for
+proving sealed history was not tampered with, and the operator contract
+documents specific rollback hazards in detail, most notably that renaming or
+replacing the active segment incorrectly can silently fork the chain
+(`products/evidence/OPERATOR-CONTRACT.md`).
+
+### Readiness and liveness are different questions
+
+`GET /health` is liveness only. `GET /ready` is the gate that "fails closed
+while any required secret or source credential is absent"
+(`docker/compose/README.md`); it rechecks the subject-binding key, the
+signing provider, the pinned audit sink, and every source credential,
+including a bounded OAuth client-credentials bootstrap where that
+authentication kind is configured. Neither check sends a request to a source
+or probes a source data endpoint (`products/evidence/OPERATOR-CONTRACT.md`).
+Route traffic on `/ready`, not `/health`.
+
+Telemetry is opt-in: leaving `metricsListener` unset in `runtime.yaml` serves
+none of it, and setting it only opens a second, private-address-only
+listener (`products/evidence/OPERATOR-CONTRACT.md`).
+
+## Performance posture
+
+`products/evidence/PERFORMANCE.md` states its own scope plainly: nothing in
+it is a Version 1 contract. There is no throughput commitment to evaluate
+against, only kept measurements.
+
+The cost that shapes throughput comes from durability, not from the HTTP or
+scripting layers. Evidence must durably accept the access-attempt audit
+record before reading a source and the disclosure-release record before
+returning a response, so every successful request pays two durable audit
+appends. The audit sink commits appends in groups: writes that arrive while
+a disk barrier is in flight form the next batch, and one sync covers the
+whole batch, while every append still resolves only after the barrier that
+covers its own bytes (`crates/registry-evidence/src/audit.rs`).
+
+The measurement kept in `products/evidence/OPERATOR-CONTRACT.md` under
+"Measured throughput" sustained 7057 requests per second at 128 concurrent
+requests with zero non-2xx responses and a 17.89 ms p50, on an Apple M5 Max
+under macOS, with every request running token verification, rate limiting,
+request preparation, one source call, extraction, signing, and both durable
+audit appends. Because the sink batches only what overlaps, a deployment
+offering little concurrency sees lower rates; the before-group-commit
+baseline in `PERFORMANCE.md` (122 to 161 requests per second at 32
+concurrent with one barrier per append) shows the floor that behavior
+approaches.
+
+Both files call the macOS figures conservative in one direction and
+unproven in the other: on macOS the sync call issues `F_FULLFSYNC`, a true
+device write barrier, while the same call on Linux is an ordinary `fsync`.
+`PERFORMANCE.md` says to re-measure on the target Linux host before quoting
+production numbers.
+
+{/* TODO[evidence]: no Linux-host throughput measurement is committed to the
+repository yet; re-measure on the target host before using a number for a
+production sizing decision. */}
+
+A second lever works without any tuning: because the audit sink takes an
+exclusive lock per path, N processes with N distinct audit paths give N
+times the throughput. The sustained-rate measurement reproduces with
+`cargo test --release -p registry-evidence --lib -- --ignored --nocapture sustained_load_holds_one_thousand_requests_per_second`.
+
+## Support window and stability
+
+Registry Stack overall is pre-1.0: "APIs and deployment contracts may
+change" (root `AGENTS.md`). Evidence does not carry a separate, more
+permissive statement.
+
+Within that, Evidence's Version 1 assertion contract is treated as
+implemented rather than exploratory. `products/evidence/README.md` gives its
+status as "implemented Version 1 contracts, runtime, reference deployments,
+and reproducible Evidence-specific verification gates," and
+`products/evidence/OPERATOR-CONTRACT.md` carries the matching "Implemented
+Version 1 operator contract" status. Four assertion cases, adult status,
+residence region, professional licence status, and legal-parent
+relationship, are coequal acceptance definitions; the product is not
+considered implemented while only a subset of them passes
+(`products/evidence/AGENTS.md`).
+
+What stays explicitly out of scope remains so until a separately approved
+profile changes it: document evidence, credential-lifecycle features beyond
+the SD-JWT VC serialization, multi-source fulfillment, the delegated-agent
+grant profile, a public or federated catalog, and OOTS execution are all
+named non-goals rather than roadmap items (`products/evidence/CONCEPT.md`).
+`products/evidence/OPERATOR-CONTRACT.md` closes on the same note: "Future
+profiles require a separately approved concept and plan."
+
+{/* TODO[evidence]: no published versioning or backward-compatibility policy
+(for instance, how a future Version 2 would relate to Version 1 deployments)
+was found in the cited files; confirm with product owners before promising
+upgrade continuity. */}
+
+## Next
+
+- [When Registry Stack fits](../when-to-use/)
+- [Configure Evidence](../../configure/evidence/)
+- [Evidence API reference](../../reference/apis/registry-evidence/)
diff --git a/docs/site/src/content/docs/start/evidence-quickstart.mdx b/docs/site/src/content/docs/start/evidence-quickstart.mdx
new file mode 100644
index 000000000..b14b97c63
--- /dev/null
+++ b/docs/site/src/content/docs/start/evidence-quickstart.mdx
@@ -0,0 +1,118 @@
+---
+title: Evidence overview
+description: Understand how Evidence returns a verified minimum answer and choose the path for your role.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: explanation
+locale: en
+standards_referenced: []
+---
+
+Evidence answers one predefined question about one or more subjects and returns a signed minimum
+answer. The caller receives the answer needed for an authorized purpose, not the authoritative
+record that settled the answer.
+
+```mermaid
+sequenceDiagram
+    participant C as Caller
+    participant E as Evidence
+    participant A as Durable audit
+    participant R as Authoritative registry
+
+    C->>E: Request one predefined answer
+    E->>A: Record authorized access
+    E->>R: Make one fixed source request
+    R-->>E: Return the source record
+    Note over R: The authoritative record stays here
+    E->>E: Derive the minimum answer and sign it
+    E->>A: Record what was disclosed
+    E-->>C: Return the signed answer
+    C->>C: Verify before using the answer
+```
+
+The authoritative registry remains the source of truth. Evidence makes the fixed request defined
+by the provider, derives only the reviewed answer, and does not return the source response to the
+caller. The caller verifies the signature and retained transaction expectations before using the
+answer.
+
+The audit trail records the authorized access and the released disclosure. The audit trail does
+not repeat the source record, prove that the source fact was true, or automatically provide a
+complete citizen-facing history of registry access.
+
+## Make your first Evidence request
+
+[Get your first Evidence assertion](../../tutorials/first-evidence-assertion/) starts a small
+Python registry that you control. You use its OpenAPI description to author an adult-status
+question, send a real HTTP request with `curl`, and verify a signed boolean answer. The source
+response contains a name and date of birth; the verified assertion contains neither.
+
+The tutorial uses disposable local trust and synthetic data. The local profile keeps
+authentication, bounded source access, signing, verification, and audit active while the Evidence
+tooling handles development process orchestration.
+
+## Choose your role
+
+### Provide Evidence
+
+Start with the first assertion, then adapt the same workflow to your institution's OpenAPI source.
+The provider decides the authorized purpose, subject mapping, derivation, and permitted answer.
+OpenAPI describes transport and data shapes but cannot make those governed decisions.
+
+[Return a governed value](../../tutorials/return-a-governed-value/) first extends the same
+local project with a non-boolean answer. The second tutorial demonstrates that minimum disclosure
+depends on the purpose and can return a reviewed value when a boolean is insufficient.
+
+[See Evidence refuse unsafe changes](../../tutorials/refuse-unsafe-evidence-requests/) then tests
+the same boundary with an unauthorized purpose and a modified signed response.
+
+When you are ready to use your own system, [draft an Evidence source from
+OpenAPI](../../tutorials/connect-an-institution-source/), then add only the
+[project-specific fixtures](../../tutorials/prove-an-evidence-project/) your reviewers need.
+Build a reviewed candidate only after that local work is complete. Registry Mint is optional when
+the deployment has no suitable OIDC issuer.
+
+### Consume Evidence
+
+Retain the request expectations and trusted issuer keys before the response arrives. Verify the
+stored response against that independent context, then expose the verified answer to application
+logic.
+
+[Verify Evidence as a consumer](../../tutorials/verify-an-assertion-as-a-consumer/) continues the
+local journey with every service stopped. Then
+[manage verifier trust](../../tutorials/manage-evidence-verifier-trust/) through an independent
+onboarding and rotation process. [SD-JWT VC](../../tutorials/request-evidence-as-sd-jwt-vc/) is an
+optional second serialization of the same assertion.
+
+### Operate Evidence
+
+Bind the provider-approved definition to production identity, source trust, signing keys, and
+durable audit storage. The operator owns readiness, key rotation, audit-chain verification,
+retention, backup, and recovery.
+
+[Verify and interpret the Evidence audit chain](../../operate/evidence-audit/) covers the integrity
+proof, event phases, privacy-preserving pseudonyms, and the current lack of a supported citizen
+history query.
+
+## Keep the product boundary visible
+
+Evidence does not decide whether an institution has legal authority to use a source, whether a
+purpose is legitimate, or whether a source record is true. Those decisions and assurances come
+from governance, authorization, and the authoritative institution. A valid signature proves who
+signed the exact assertion bytes and whether the assertion matches the retained verification
+expectations.
+
+Evidence is separate from Registry Relay. Registry Relay exposes protected, selected records.
+Evidence can use a Relay API as one fixed source, but Evidence retains its own authorization,
+derivation, signing, verification, and audit boundaries. Registry Mint is optional supporting
+infrastructure that supplies short-lived caller tokens when a deployment has no identity provider.
+
+## Next
+
+- [Get your first Evidence assertion](../../tutorials/first-evidence-assertion/)
+- [Build and deploy an Evidence project](../../tutorials/build-and-deploy-evidence-project/)
+- [Decide when Registry Stack fits](../when-to-use/)
+- [Evaluate Evidence's operating requirements](../evaluate-evidence/)
+- [Review the Evidence security model](../../security/evidence/)
diff --git a/docs/site/src/content/docs/start/pre-1.0-cutover.mdx b/docs/site/src/content/docs/start/pre-1.0-cutover.mdx
deleted file mode 100644
index 0ee53ee66..000000000
--- a/docs/site/src/content/docs/start/pre-1.0-cutover.mdx
+++ /dev/null
@@ -1,84 +0,0 @@
----
-title: Cut over a pre-1.0 project
-slug: start/pre-1.0-cutover
-description: Preserve reviewed authored intent while recreating pre-1.0 generated artifacts and runtime state for Registry Stack 1.0.
-status: current
-owner: registry-docs
-source_repos:
-  - registry-stack
-last_reviewed: "2026-07-30"
-doc_type: how-to
-locale: en
-standards_referenced: []
----
-
-Registry Stack 1.0 starts its compatibility contract at 1.0.
-Pre-1.0 commands have no aliases, and pre-1.0 generated artifacts and runtime
-state have no automated migration path.
-
-## Before you start
-
-Keep the only pre-1.0 project and deployment copy unchanged.
-Create a separate 1.0 project, then copy reviewed authored intent only after
-checking each field against the 1.0 schemas.
-
-You can reuse decisions about integrations, entities, fixtures, services,
-claims, and environments when the 1.0 schema still represents them.
-Recreate generated build output, local runtime material, product bundles,
-anchors, approved sets, deployment packages, and anti-rollback state.
-
-## Map removed commands
-
-| Pre-1.0 concept | Registry Stack 1.0 |
-| --- | --- |
-| `registryctl init --from <starter>` or `registryctl init relay` | `registryctl init <directory> --template http` or `registryctl init <directory> --template spreadsheet` |
-| `registryctl add notary` | Declare the complete 1.0 project; both public templates contain the combined product path |
-| `registryctl start` | `registryctl dev` or `registryctl dev --detach` |
-| `registryctl stop` | `registryctl dev down` |
-| `registryctl restart` | Run `registryctl dev down`, then `registryctl dev` |
-| `registryctl status` | `registryctl dev status` |
-| `registryctl logs` | `registryctl dev logs` |
-| `registryctl smoke` | `registryctl dev smoke` |
-| `registryctl open` | Use the documented loopback endpoint with an HTTP client |
-| `registryctl preflight` | Use `registryctl check`, `registryctl doctor`, or `registryctl deploy verify` for the relevant boundary |
-| `registryctl capabilities` | Use `registryctl check --explain` |
-| `registryctl compare` | `registryctl review compare` |
-| `registryctl promote` | Review, build, sign each affected lane, assemble an approved set, then generate a deployment package |
-| `registryctl migrate` | Create a separate 1.0 project and copy reviewed authored intent |
-| `registryctl bundle ...` | `registryctl trust bundle ...` |
-| `registryctl anchor ...` | `registryctl trust anchor create` or `registryctl trust anchor rotate` |
-| `registryctl authoring ...` | `registryctl tooling schema`, `tooling reference`, `tooling editor`, or `tooling language-server` |
-| `registryctl project diagnostics ...` | `registryctl tooling diagnostics ...` |
-| `registryctl test --live` and `REGISTRY_STACK_LIVE_*` | No live test mode; keep `registryctl test` offline and use `registryctl dev smoke` or an operator-owned HTTP client |
-| Bruno generation | No replacement; Registryctl does not own an HTTP-client collection |
-
-The public 1.0 starters are `http` and `spreadsheet`.
-Use `http` for an existing registry API and `spreadsheet` for a workbook source.
-OAuth-backed Rhai is an adaptation of an HTTP project.
-The OpenCRVS material is a synthetic example of that adaptation, not a template.
-Adapt a public starter separately for DHIS2, FHIR, or another domain system.
-
-## Recreate governed material
-
-Build the reviewed 1.0 project into the three required lanes:
-`relay-public`, `relay-consultation`, and `notary`.
-Create new governed anchors, sign each lane, and assemble a new approved
-baseline set.
-
-Adopt the 1.0 runtime under a new instance identity.
-Do not translate or reset pre-1.0 anti-rollback state in place.
-Generate a fresh deployment package from the new approved set.
-
-## Verify the cutover
-
-Confirm that:
-
-- `registryctl test` passes offline against the copied fixtures
-- `registryctl check --explain` shows the intended source and disclosure plan
-- `registryctl dev smoke` passes with disposable development trust
-- `registryctl review compare` identifies the required governed approvals
-- `registryctl deploy verify` accepts the new package before operator startup
-
-Archive the pre-1.0 project and deployment evidence according to your
-institution's retention policy.
-Do not place pre-1.0 generated material into the 1.x compatibility record.
diff --git a/docs/site/src/content/docs/start/quickstart.mdx b/docs/site/src/content/docs/start/quickstart.mdx
index 8a9a8072c..c77bf4c08 100644
--- a/docs/site/src/content/docs/start/quickstart.mdx
+++ b/docs/site/src/content/docs/start/quickstart.mdx
@@ -1,40 +1,44 @@
 ---
 title: Start with Registry Stack 1.0
-description: Run Registry Relay and Registry Notary from a spreadsheet, then adapt the source or evidence rule.
+description: Answer a bounded question with Evidence, or publish protected records with Registry Relay, then adapt the source or the definition.
 status: current
 owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-31"
+last_reviewed: "2026-08-03"
 doc_type: explanation
 locale: en
 standards_referenced: []
 ---
 
-Start with the maintained spreadsheet registry.
-It is the shortest complete path through Registry Relay, Registry Notary,
-authorization, source access, evidence evaluation, and minimized disclosure.
+Pick the door that matches what your caller needs. To learn only a fact about
+one subject, start with Evidence. To read specific records or fields, start
+with Registry Relay over the maintained spreadsheet registry. Both first runs
+use one terminal and synthetic data. Neither needs a source checkout,
+production keys, or a deployment package.
+
+## Answer a bounded question with Evidence
+
+Evidence signs the answer to one bounded question about one subject without
+releasing the record behind it.
+[Evidence overview](../evidence-quickstart/) explains the source, assertion,
+verification, and audit boundaries.
+[Get your first Evidence assertion](../../tutorials/first-evidence-assertion/)
+then connects a visible Python registry, sends a real request, and verifies the
+minimum answer before reading the answer.
 
 ## Start from a spreadsheet
 
 [Start a registry from a spreadsheet](../../tutorials/publish-spreadsheet-secured-registry-api/)
-creates the released `spreadsheet` project, checks its evidence rules offline,
-and runs Relay and Notary locally over maintained synthetic records.
+creates the released `spreadsheet` project, checks its source behavior offline,
+and runs Relay locally over maintained synthetic records.
 
-Take this path first when evaluating Registry Stack.
+Take this path when the institution has a workbook, or can prepare a reviewed
+workbook derivative.
 Continue with [your own spreadsheet](../../tutorials/use-your-spreadsheet/)
 after the sample works.
 
-## Expose evidence
-
-The starter already exposes selected records and evaluates two predicate
-claims.
-[Change one spreadsheet-backed evidence rule](../../tutorials/verify-claim-registry-api/)
-to learn which decisions belong to Relay, Notary, fixtures, and the operator
-handoff.
-
 ## Connect an existing registry
 
 [Connect an existing HTTP registry](../../tutorials/author-registry-project/)
@@ -51,12 +55,19 @@ Continue with:
 - [The OpenCRVS Events API case study](../../tutorials/verify-opencrvs-claims/)
   for a synthetic example of that generic integration path
 
-The first run uses one terminal and synthetic data.
-You do not need a source checkout, production keys, or a deployment package.
+## See both doors working together
+
+The two doors are not alternatives an institution has to choose between once
+and for all. One institution can publish records through Registry Relay and
+answer bounded questions through Evidence over those same records, because
+Evidence treats a Relay API as an ordinary fixed HTTP source.
 
-## Move an older project
+[First run with Solmara Lab](../../tutorials/first-run-with-solmara-lab/) is
+where that arrangement is visible end to end. It brings up a whole fictional
+country's registry services on a laptop, then asks Evidence one question about
+one person: is this subject an adult? The answer comes back signed, carrying
+`true` and neither the identifier nor the date of birth that settled it, while
+the record stays with the authority that holds it.
 
-Pre-1.0 commands and generated runtime files do not have compatibility aliases
-or an automated migration path.
-Use the [pre-1.0 cutover guide](../pre-1.0-cutover/) to preserve reviewed
-authored intent and recreate generated material.
+Run it after the spreadsheet or HTTP tutorial above. It needs Docker and
+about 30 minutes.
diff --git a/docs/site/src/content/docs/start/when-to-use.mdx b/docs/site/src/content/docs/start/when-to-use.mdx
index 18a4b5e8e..7f6b03f2a 100644
--- a/docs/site/src/content/docs/start/when-to-use.mdx
+++ b/docs/site/src/content/docs/start/when-to-use.mdx
@@ -4,9 +4,8 @@ description: Decide whether Registry Stack matches the access problem your insti
 status: current
 owner: registry-docs
 source_repos:
-  - registry-relay
-  - registry-notary
-last_reviewed: "2026-06-20"
+  - registry-stack
+last_reviewed: "2026-08-03"
 doc_type: explanation
 locale: en
 standards_referenced: []
@@ -31,11 +30,27 @@ system that owns the data.
 
 | Caller needs | Use | Result |
 | --- | --- | --- |
-| Selected records or fields | Registry Relay | A protected, read-only API response |
-| A bounded answer or status | Registry Notary | A claim result without the source record |
+| To read specific data | Registry Relay | A protected, read-only API response |
+| To learn only a fact | Evidence | A signed assertion carrying the answer, not the source record |
 
-The two products can work together. Registry Relay obtains a limited source
-result, and Registry Notary evaluates a reviewed claim over that result.
+Registry Relay and Evidence can work together: an institution publishes
+records through Registry Relay, and Evidence answers a bounded question over
+those same records by treating the Relay API as a fixed HTTP source. Registry
+Mint issues the short-lived access tokens either service needs when a
+deployment has no identity provider; see the
+[Registry Mint reference](../../reference/mint/).
+[First run with Solmara Lab](../../tutorials/first-run-with-solmara-lab/) runs
+that combination on a laptop if you would rather see it than read about it.
+
+### Who does what
+
+- The assertion provider is an institution that answers requests with signed
+  facts through Evidence.
+- The data publisher is an institution that exposes records through Registry
+  Relay.
+- The consumer or verifier is a relying service that calls either door and
+  verifies the answers it receives.
+- The operator is whoever runs the deployment.
 
 ## Registry Stack is not the right tool when
 
@@ -66,5 +81,6 @@ approval.
 
 - [Start a registry from a spreadsheet](../../tutorials/publish-spreadsheet-secured-registry-api/)
 - [Connect an existing HTTP registry](../../tutorials/author-registry-project/)
+- [Evaluate Evidence](../evaluate-evidence/)
 - [Read the architecture overview](../../explanation/architecture/)
 - [Review the security boundaries](../../security/)
diff --git a/docs/site/src/content/docs/tutorials/assert-a-role-bound-relationship.mdx b/docs/site/src/content/docs/tutorials/assert-a-role-bound-relationship.mdx
new file mode 100644
index 000000000..c6726bfa3
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/assert-a-role-bound-relationship.mdx
@@ -0,0 +1,256 @@
+---
+title: Assert a role-bound relationship
+description: Bind a child and a candidate parent to one signed relationship assertion without disclosing either identifier.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: tutorial
+persona:
+  - assertion provider
+locale: en
+standards_referenced: []
+---
+
+import QuickstartMeta from '../../../components/QuickstartMeta.astro';
+
+Answer, "Is this candidate registered as a parent of this child?" Unlike
+[your first Evidence assertion](../first-evidence-assertion/) and the
+[governed-value follow-up](../return-a-governed-value/), this standalone tutorial binds two people
+in distinct roles. Evidence must not let a caller omit a role, repeat one role, or swap its
+selector field.
+
+<QuickstartMeta
+  outcome="A verified relationship assertion bound to a child and a candidate parent."
+  time="About 15 minutes"
+  level="Local development with synthetic data"
+  prerequisites={['Evidence toolset', 'Python 3', 'A shell with curl', 'Linux or macOS']}
+/>
+
+## Start a relationship registry
+
+Create a working directory and save this server as `registry.py`:
+
+```sh
+mkdir role-bound-relationship
+cd role-bound-relationship
+```
+
+```python
+import json
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from urllib.parse import unquote, urlsplit
+
+PEOPLE = {"child-123", "parent-456", "adult-789"}
+REGISTERED_PARENTS = {("child-123", "parent-456")}
+
+OPENAPI = {
+    "openapi": "3.1.0",
+    "info": {"title": "Tutorial relationship registry", "version": "1.0.0"},
+    "servers": [{"url": "http://127.0.0.1:8002"}],
+    "paths": {"/children/{child_id}/candidate-parents/{candidate_id}": {"get": {
+        "operationId": "getParentRelationship",
+        "parameters": [
+            {"name": "child_id", "in": "path", "required": True,
+             "schema": {"type": "string"}},
+            {"name": "candidate_id", "in": "path", "required": True,
+             "schema": {"type": "string"}},
+        ],
+        "responses": {"200": {
+            "description": "A registered parent relationship decision",
+            "content": {"application/json": {"schema": {
+                "type": "object",
+                "required": ["relationship_confirmed"],
+                "properties": {"relationship_confirmed": {"type": "boolean"}},
+            }}},
+        }},
+    }}},
+}
+
+class Registry(BaseHTTPRequestHandler):
+    def do_GET(self):
+        path = unquote(urlsplit(self.path).path)
+        if path == "/openapi.json":
+            return self.send_json(OPENAPI)
+        parts = path.strip("/").split("/")
+        if (len(parts) == 4 and parts[0] == "children"
+                and parts[2] == "candidate-parents"):
+            child_id, candidate_id = parts[1], parts[3]
+            if child_id in PEOPLE and candidate_id in PEOPLE:
+                return self.send_json({
+                    "relationship_confirmed":
+                        (child_id, candidate_id) in REGISTERED_PARENTS,
+                })
+        self.send_error(404)
+
+    def send_json(self, value):
+        body = json.dumps(value).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+print("Registry listening on http://127.0.0.1:8002", flush=True)
+ThreadingHTTPServer(("127.0.0.1", 8002), Registry).serve_forever()
+```
+
+Start it in one terminal and leave it running:
+
+```sh
+python3 registry.py
+```
+
+The synthetic registry knows three people and one registered relationship. Its endpoint returns
+only the relationship decision for a known pair. A production source would need governance that
+defines what "registered parent" means and who can maintain that relationship.
+
+## Create the Evidence project
+
+In another terminal, create an editable project from the registry's OpenAPI description:
+
+```sh
+evidencectl new parent-relationship \
+  --openapi http://127.0.0.1:8002/openapi.json \
+  --profile local \
+  --generate-keys
+cd parent-relationship
+```
+
+### `questions/parent-relationship.yaml`
+
+Create the question definition:
+
+```yaml
+id: parent-relationship
+question: Is the candidate registered as a parent of the child?
+purpose: relationship-check
+subjects:
+  - role: child
+    selector: child_id
+  - role: candidate-parent
+    selector: candidate_id
+source:
+  operation: getParentRelationship
+  facts:
+    - name: relationship_confirmed
+      path: /relationship_confirmed
+      combine: exactly-one
+  collectionBounds: {}
+answers:
+  - concept: relationship_confirmed
+    type: boolean
+derivation: derivations/parent-relationship.rhai
+disclosure:
+  allow: [relationship_confirmed]
+```
+
+`subjects` declares the complete role set. Each role maps to one required OpenAPI path parameter.
+The child and candidate are therefore part of the governed question, not interchangeable string
+arguments. The source decision is the only fact that reaches the derivation.
+
+### `derivations/parent-relationship.rhai`
+
+Create the answer logic:
+
+```rhai
+fn answer(facts, selectors, context) {
+    #{
+        relationship_confirmed:
+            required(facts.relationship_confirmed, "relationship_missing")
+    }
+}
+```
+
+This source already owns the reviewed relationship decision, so the derivation maps that fact to
+the one governed answer. Evidence still validates the source response, answer form, disclosure,
+and both subject bindings before signing.
+
+## Start the project
+
+```sh
+evidencectl dev --detach
+```
+
+```text
+Evidence ready at http://127.0.0.1:8080
+Mint ready at http://127.0.0.1:8081
+```
+
+## Bind both subjects to the request
+
+Prepare one request with both role-qualified subjects:
+
+```sh
+evidencectl request prepare parent-relationship \
+  --purpose relationship-check \
+  --subject child:child_id=child-123 \
+  --subject candidate-parent:candidate_id=parent-456 \
+  --name parent-relationship
+```
+
+For a multi-subject question, every `--subject` uses `role:field=value`. Preparation rejects a
+missing role, duplicate role, unknown role, or field that does not match that role's selector.
+
+Send the prepared request across the HTTP boundary:
+
+```sh
+curl --silent --show-error \
+  --config .evidence/requests/parent-relationship/authorization.curl \
+  --request POST \
+  --url http://127.0.0.1:8080/v1/evidence \
+  --header 'Content-Type: application/json' \
+  --header 'Accept: application/jose+json' \
+  --data-binary @.evidence/requests/parent-relationship/request.json \
+  --output parent-relationship.jws.json
+```
+
+Verify before reading:
+
+```sh
+evidencectl verify parent-relationship.jws.json \
+  --context .evidence/requests/parent-relationship/verification.json \
+  --output parent-relationship.verified.json
+```
+
+```text
+VERIFIED
+```
+
+```sh
+python3 -m json.tool parent-relationship.verified.json
+```
+
+The verified assertion has two pseudonymous subject bindings, one for `child` and one for
+`candidate-parent`, plus this supported value:
+
+```json
+{
+  "providesValueFor": "urn:registrystack:evidence:local:concept:parent-relationship:relationship_confirmed",
+  "value": true
+}
+```
+
+It does not disclose `child-123` or `parent-456`. The bindings let an authorized verifier relate
+the answer to the requested subjects without turning the assertion into a copy of either record.
+
+## Inspect the audit and clean up
+
+```sh
+evidencectl dev stop
+evidencectl audit show --last-operation
+evidencectl dev clean
+```
+
+The audit identifies the authorized question, purpose, requester pseudonym, and disclosed concept.
+It does not record either source identifier or the boolean value.
+
+Return to the registry terminal and press `Ctrl+C`.
+
+## Next
+
+- [Issue registered-parent evidence from OpenCRVS](../verify-a-registered-parent-with-opencrvs/)
+- [Issue immunization evidence from DHIS2](../issue-immunization-evidence-from-dhis2/)
+- [See Evidence refuse unsafe requests](../refuse-unsafe-evidence-requests/)
+- [Configure Evidence](../../configure/evidence/)
diff --git a/docs/site/src/content/docs/tutorials/author-registry-project.mdx b/docs/site/src/content/docs/tutorials/author-registry-project.mdx
index e42a1eeed..6184940fc 100644
--- a/docs/site/src/content/docs/tutorials/author-registry-project.mdx
+++ b/docs/site/src/content/docs/tutorials/author-registry-project.mdx
@@ -5,8 +5,10 @@ status: current
 owner: registry-docs
 source_repos:
   - registry-stack
-last_reviewed: "2026-07-31"
+last_reviewed: "2026-08-04"
 doc_type: tutorial
+persona:
+  - data publisher
 locale: en
 standards_referenced: []
 ---
@@ -15,10 +17,13 @@ import QuickstartMeta from '../../../components/QuickstartMeta.astro';
 
 Use the released HTTP starter to model one bounded lookup against a registry API.
 First test and run the contract with synthetic observations. Then bind the reviewed source in the
-authored project files, without changing the Registry Relay and Registry Notary boundaries.
+authored project files, without changing the Registry Relay boundary.
+
+A project has two product lanes, `relay-public` and `relay-consultation`, and the starter authors
+a consultation service over one bounded HTTP source.
 
 <QuickstartMeta
-  outcome="A tested bounded HTTP integration, a disposable local runtime, and unsigned inputs for three independently approved product lanes."
+  outcome="A tested bounded HTTP integration, a disposable local runtime, and unsigned inputs for two independently approved product lanes."
   time="About 15 minutes after Registryctl and Docker are installed"
   level="Local development with synthetic records"
   prerequisites={['A released Registryctl 1.0 installation', 'Docker Engine', 'Docker Compose 2.35.0 or later', 'A shell with curl and a text editor'] }
@@ -91,7 +96,7 @@ The authored files have separate responsibilities:
 
 | Path | Decision you own |
 | --- | --- |
-| `registry-stack.yaml` | Evidence service, purpose, caller scopes, claims, and disclosure |
+| `registry-stack.yaml` | The consultation service, its purpose, legal basis, consent basis, and the input each consultation maps from the request |
 | `integrations/person-record/integration.yaml` | Typed input, fixed request, source outcomes, and minimized output |
 | `integrations/person-record/fixtures/` | Synthetic requests, responses, and expected results |
 | `environments/local.yaml` | Default development scenario, source destination, and secret references |
@@ -111,12 +116,12 @@ A passing starter reports:
 
 ```text
 Registry Stack test: passed for fictional-citizen-registry.
-Fixtures: 25.
+Fixtures: 21.
 Next: registryctl dev
 ```
 
-This command exercises the three authored outcomes and their derived security cases without
-starting Docker, resolving a secret, or contacting a source.
+This command exercises the three authored outcomes (match, ambiguous, and no match) and their
+derived security cases without starting Docker, resolving a secret, or contacting a source.
 Fixture evidence proves the authored contract against synthetic observations, not compatibility
 with an institution's live registry.
 
@@ -133,18 +138,12 @@ The focused result is:
 
 ```text
 Registry Stack test: passed for fictional-citizen-registry.
-Fixtures: 9.
+Fixtures: 7.
   PASS person-record.active-person
     inputs: person_id
     calls: call=1 operation=request method=GET path=/people/* query=[fields] headers=[] body=none
     outputs: active
-    claims: person-active, person-record-exists
     outcome: match
-  PASS person-record.active-person::derived/request_to_consultation_binding
-    inputs: person_id
-    calls: notary-relay-consultation
-    claims: person-record-exists
-    source access: true
   PASS person-record.active-person::derived/request_authority
     inputs: person_id
     expected error: fixture.request_mismatch
@@ -169,20 +168,19 @@ Fixtures: 9.
     calls: call=1 operation=request method=GET path=/people/* query=[fields] headers=[] body=none
     expected error: source.deadline_exceeded
     source access: true
-  PASS person-record.active-person::derived/authorization_before_source
-    inputs: person_id
-    expected error: authorization.denied
-    source access: false
   PASS person-record.active-person::derived/output_minimization
     inputs: person_id
     calls: call=1 operation=request method=GET path=/people/* query=[fields] headers=[] body=none
     outputs: active
-    claims: person-active, person-record-exists
     outcome: match
     source access: true
 Next: registryctl dev
 ```
 
+The derived cases assert that the fixed request cannot be widened, that each source failure mode
+is rejected rather than coerced into an answer, and that only the declared output leaves the
+integration.
+
 The trace may show the synthetic identifier and `active` value authored in that fixture.
 Do not use `--trace` with observations copied from a production source.
 
@@ -196,30 +194,34 @@ registryctl dev --detach
 
 Registryctl validates the project, rebuilds stale product inputs, checks the installed release
 lock, and starts digest-locked images.
-The command prints loopback endpoints plus `Request`, `Smoke`, `Logs`, and `Down` actions.
+The command prints the loopback Relay API endpoint, the source mode, and the `Smoke`, `Logs`, and
+`Down` actions. A project that also serves a records API prints two records request commands; this
+starter authors a consultation only, so it prints none.
 The authored local environment selects the synthetic `active-person` scenario, so there is no
 scenario-selection flag.
 
 The development trust anchors, credentials, bundles, and state are local disposable material.
 They use the `development` trust domain and are not inputs to a governed deployment.
 
-Run the maintained denial and authorized checks:
+Run the maintained runtime check:
 
 ```sh
 registryctl dev smoke
 ```
 
-A passing report has this shape:
+A passing report for this starter is one line:
 
 ```text
 Development smoke: passed.
-  unauthorized: status=denied; passed=true; token_counter_delta=0; source_counter_delta=0; minimized_claim_ids=none
-  authorized: status=authorized; passed=true; token_counter_delta=0; source_counter_delta=1; minimized_claim_ids=person-record-exists
 ```
 
-The denial result proves that authorization stopped the source call.
-The authorized result proves one bounded source call and reports only the minimized claim
-identifiers.
+The scenario lines are reported only for a project that serves a records API. The smoke run drives
+the `unauthorized` and `authorized` records scenarios, proves that authorization stopped the source
+call on denial, and reports only the minimized attribute identifiers the authorized call released.
+This starter authors a consultation and no records API, so it has no records scenario to drive and
+the report carries no scenario line. Follow
+[Publish a spreadsheet-backed registry API](../publish-spreadsheet-secured-registry-api/) for the
+starter that exercises the denial and authorized path end to end.
 The smoke report contains no credential or source-returned value.
 
 Inspect value-free log availability if a scenario fails:
@@ -228,8 +230,8 @@ Inspect value-free log availability if a scenario fails:
 registryctl dev logs
 ```
 
-The report keeps the public Relay, consultation Relay, Notary, and synthetic source identities
-separate without copying their log values into Registryctl output.
+The report keeps the public Relay, consultation Relay, and synthetic source identities separate
+without copying their log values into Registryctl output.
 
 ## Stop the disposable runtime
 
@@ -250,8 +252,7 @@ Validate the authored project and inspect its redacted effective plan:
 registryctl check --explain
 ```
 
-Review the fixed request, authorization policy, source bounds, minimized output, claims, and
-disclosure.
+Review the fixed request, authorization policy, source bounds, and minimized output.
 `check` is offline and does not resolve a secret.
 
 Build deterministic unsigned inputs:
@@ -263,23 +264,22 @@ registryctl build
 The human result identifies the build path and governed handoff:
 
 ```text
-Built unsigned signing inputs for relay-public, relay-consultation, notary.
+Built unsigned signing inputs for relay-public, relay-consultation.
 Build output: .registry-stack/build/local
 Next: registryctl trust anchor create --help
 ```
 
-For this combined project, that directory contains signing inputs for `relay-public`,
-`relay-consultation`, and `notary`.
+That directory contains signing inputs for `relay-public` and `relay-consultation`.
 `build` does not create production keys, sign a bundle, assemble an approved baseline set, or
 activate a product.
-The public Relay, consultation Relay, and Notary remain independently approved.
+The public Relay and the consultation Relay remain independently approved.
 
 The selected environment controls the two Relay inputs independently.
 A nonempty `relay.allowed_clients` list admits the intended public OpenID Connect clients.
 Registryctl rejects an empty list rather than generating a public Relay that accepts every client
 from the trusted issuer.
-The `notary_relay` workload binding enables the separate consultation Relay input and admits only
-the configured Notary workload client; do not copy that client into `relay.allowed_clients`.
+The `relay.consultation` binding enables the separate consultation Relay input and admits only its
+configured workload client and principal; do not copy that client into `relay.allowed_clients`.
 
 ## Bind the reviewed registry
 
@@ -291,8 +291,8 @@ Keep the passing starter as a known-good baseline, then adapt only the authored
 2. In `environments/local.yaml`, set `development.source_mode` to `operator_bound`, replace the
    source origin, and bind secret references when authentication is required. Never put a secret
    value in the project.
-3. Change `registry-stack.yaml` only when the input, purpose, caller scope, claim, or disclosure
-   meaning differs from the starter.
+3. Change `registry-stack.yaml` only when the consultation input, purpose, legal basis, or consent
+   basis differs from the starter.
 4. Replace the fixtures with wholly synthetic observations for every accepted and rejected source
    outcome. Do not copy production responses or personal records into fixtures.
 
@@ -377,8 +377,8 @@ starter embedded in that Registryctl release.
 It stops before replacing any file when the starter is missing, changed, or contains another
 authored file.
 `registryctl test --environment local` remains offline.
-Its completed, missing, ambiguous, authorization, and minimization cases are wholly synthetic
-and remain the authoritative project-contract evidence.
+Its completed, missing, and ambiguous cases are wholly synthetic and remain
+the authoritative project-contract evidence.
 The two `check` commands verify the explicit environment bindings without contacting the public
 API.
 
@@ -428,10 +428,10 @@ Registryctl reports plus the two public responses when
 ## What you built
 
 You modeled the boundary for an existing HTTP registry, tested it with synthetic observations,
-ran the real Relay and Notary path against a fixed synthetic source, and produced unsigned inputs
-for three product lanes.
-The denial path performed no source work.
-The authorized path released only the configured claim identifiers.
+ran the real Relay path against a fixed synthetic source, and produced unsigned inputs for two
+product lanes.
+The fixture set proves that the fixed request cannot be widened and that only the declared output
+leaves the integration.
 
 ## Next
 
diff --git a/docs/site/src/content/docs/tutorials/build-and-deploy-evidence-project.mdx b/docs/site/src/content/docs/tutorials/build-and-deploy-evidence-project.mdx
new file mode 100644
index 000000000..ae85b21c4
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/build-and-deploy-evidence-project.mdx
@@ -0,0 +1,216 @@
+---
+title: Build and deploy an Evidence project
+description: Compile one editable Evidence project into a reviewed candidate and hand it to an operator without copying local development state.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: tutorial
+persona:
+  - assertion provider
+  - operator
+locale: en
+standards_referenced: []
+---
+
+import QuickstartMeta from '../../../components/QuickstartMeta.astro';
+
+Complete [Prove an Evidence project](../prove-an-evidence-project/) and its review before starting
+this tutorial. You will turn that editable project into one reviewed production candidate, then
+bind its secrets and runtime paths on the target host. This tutorial uses released `evidence` and
+`evidencectl` binaries. It does not copy `.evidence/dev`, generate a key, register a caller, or
+deploy a service for you.
+
+<QuickstartMeta
+  outcome="A reviewed Evidence candidate, one target-host validation ceremony, and one independently verified synthetic assertion."
+  time="About 45 minutes after the authoring project is reviewed"
+  level="Production handoff with synthetic deployment data"
+  prerequisites={['A released Evidence toolset', 'A reviewed editable Evidence project', 'An operator with target-host and secret-manager access', 'A shell with curl and an editor']}
+/>
+
+## Before you start
+
+You need a released Evidence toolset on `PATH`, an editable project that runs locally, and an
+operator who can provision owner-only secrets and a private listener on the target host.
+Use Registry Mint only when no suitable OpenID Connect (OIDC) issuer exists. An existing OIDC
+issuer and Mint are equivalent choices from Evidence's perspective.
+
+Confirm the released binaries before changing the project:
+
+```sh
+curl -fsSL "https://github.com/registrystack/registry-stack/releases/download/<released-tag>/evidencectl-<released-tag>-install.sh" | bash
+evidence --version
+evidencectl --version
+```
+
+Keep all source responses, credentials, tokens, and local `.evidence/` state outside the candidate.
+
+## Add production metadata and fixtures
+
+Create a synthetic fixture for every question under `fixtures/`, then add one `governance` block and
+stable concept identifiers to each question. The metadata binds the reviewed requirement, frameworks,
+Evidence Type, validity, observation timezone, fixture, and disclosure families.
+
+```yaml
+answers:
+  - concept: is_adult
+    id: urn:example:concepts:is-adult
+    type: boolean
+
+governance:
+  requirement: urn:example:requirements:adult-status:v1
+  kind: criterion
+  referenceFrameworks:
+    - urn:example:frameworks:adult-eligibility:v1
+  evidenceType: urn:example:evidence-types:adult-status:v1
+  validitySeconds: 300
+  observationTimezone: UTC
+  fixtures: fixtures/adult-status.yaml
+  disclosureFamilies:
+    - urn:example:disclosure-families:adult-status
+```
+
+Do not invent these URIs during the build. Review them with the institution that owns the
+requirement and disclosure decision.
+
+## Create the production target
+
+Create exactly one explicit target for this candidate:
+
+```text
+institution-evidence/
+  deployment-targets/
+    production/
+      governance.yaml
+      runtime.yaml
+```
+
+`governance.yaml` provides bundle-owned production values. It contains version `1`,
+`assuranceProfile: production`, service and issuer, authentication, audit, subject binding, rate
+limits, signing, optional response formats, and authority profiles. Secret references use
+`secret:file/<name>` only. Do not place secret values or absolute secret paths in this file.
+
+`runtime.yaml` is the ordinary Evidence runtime document. It binds the final absolute candidate
+bundle path, private listener, secret root, audit path, and optional private certificate authority
+files. The build copies its bytes unchanged, so the target host remains the authority for path,
+ownership, permission, secret, and trust validation.
+Set `bundleDirectory` to `<new-candidate-directory>/bundle`, and keep the listener on a numeric
+loopback or private address. The runtime cannot override the governed service, authentication,
+authority, source, disclosure, or signing fields.
+
+## Build the candidate
+
+Choose a new output path. The command refuses an existing path and does not modify the editable
+project:
+
+```sh
+evidencectl build \
+  --project "<editable-project>" \
+  --target "<editable-project>/deployment-targets/production" \
+  --output "<new-candidate-directory>"
+```
+
+The candidate contains the runtime document and closed bundle:
+
+```text
+<new-candidate-directory>/
+  runtime.yaml
+  bundle/
+    evidence.yaml
+    adapters/
+    derivations/
+    schemas/
+    fixtures/
+```
+
+The build validates the generated bundle through the real `evidence` binary and every referenced
+fixture before it publishes the candidate. It does not contact an identity provider, Mint, or a
+source endpoint. Record the printed bundle revision with the approved candidate path.
+
+## Provision the target host
+
+Transfer the exact candidate. The operator independently provisions the Evidence signing key,
+audit HMAC key, subject-binding HMAC key, and source credentials beneath the runtime secret root.
+Make the candidate runtime and bundle non-writable to the Evidence service identity.
+
+Run the grouped offline ceremony once after the candidate, runtime bindings, trust files, and
+secrets are in place:
+
+```sh
+evidencectl doctor --project "<candidate>"
+evidencectl fixtures run --project "<candidate>"
+```
+
+Start Evidence only after both commands pass:
+
+```sh
+evidence --runtime "<candidate>/runtime.yaml" serve
+```
+
+Route traffic through operator-controlled TLS only after `GET /ready` succeeds. The listener stays
+private. The bundle revision remains the deployed assertion `configurationRevision`.
+
+## Exercise and verify the HTTP boundary
+
+Create an owner-only Curl configuration. Put its `Authorization: Bearer` header in the file through
+your approved secret-management path, not on a command line or in shell history. Do not commit it.
+
+```sh
+umask 077
+install -m 600 /dev/null "<owner-only-curl-config>"
+```
+
+The file contains this Curl configuration directive, with the actual token supplied outside the
+command line:
+
+```text
+header = "Authorization: Bearer <access-token>"
+```
+
+Send one request for a synthetic deployment test record:
+
+```sh
+curl --fail --silent --show-error \
+  --config "<owner-only-curl-config>" \
+  --header 'Content-Type: application/json' \
+  --data-binary "@<synthetic-request.json>" \
+  "https://<evidence-host>/v1/evidence" \
+  --output "<assertion.jws.json>"
+```
+
+Verify the retained response with an independently prepared production verification policy and
+trusted public keys, then verify the audit chain:
+
+```sh
+evidence verify \
+  --jws "<assertion.jws.json>" \
+  --jwks "<trusted-evidence-jwks.json>" \
+  --policy "<production-verification-policy.json>"
+evidence --runtime "<candidate>/runtime.yaml" verify-audit
+```
+
+The signing policy and secret references are governed bundle content. Rotate a key by introducing a
+new key identifier through the key-rotation procedure, not by replacing a key under an unchanged
+identifier.
+
+## Expected result
+
+You have a retained signed response that verifies under the independent production policy, an audit
+chain that passes verification, and a recorded bundle revision for the exact candidate serving the
+synthetic request.
+
+## Clean up the request credential
+
+Remove the temporary Curl configuration when the deployment check is complete. Retain the signed
+response and audit-verification record according to the operator's evidence-retention procedure.
+
+```sh
+rm -f "<owner-only-curl-config>"
+```
+
+## Next
+
+- [Issue Evidence access tokens with Registry Mint](../issue-evidence-access-tokens-with-registry-mint/)
+- [Integrate an Evidence candidate with Docker Compose](../integrate-evidence-candidate-with-docker-compose/)
+- [Manage Evidence verifier trust](../manage-evidence-verifier-trust/)
diff --git a/docs/site/src/content/docs/tutorials/configure-project-script-adapter.mdx b/docs/site/src/content/docs/tutorials/configure-project-script-adapter.mdx
index 61cf65a2f..0b39b36fe 100644
--- a/docs/site/src/content/docs/tutorials/configure-project-script-adapter.mdx
+++ b/docs/site/src/content/docs/tutorials/configure-project-script-adapter.mdx
@@ -6,14 +6,15 @@ owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-last_reviewed: "2026-07-30"
+last_reviewed: "2026-08-03"
 doc_type: how-to
 locale: en
 standards_referenced: []
 ---
 
-Use this guide to adapt a project created with the HTTP template when its source requires OAuth
-2.0 client credentials and a reviewed Rhai script must normalize the response.
+Complete [Connect an existing HTTP registry](../author-registry-project/) before starting this
+guide. You will adapt that workflow when its source requires OAuth 2.0 client credentials and a
+reviewed Rhai script must normalize the response.
 
 ## When to use this
 
@@ -96,10 +97,11 @@ The overlay reports:
 Applied the synthetic OpenCRVS Events API-shaped OAuth and Rhai overlay.
 ```
 
-The public overlay contains the integration, environment, Rhai script, evidence service, and every
-positive and negative fixture.
+The public overlay contains the integration, environment, Rhai script, consultation service, and
+every positive and negative fixture.
 The documentation gate applies that same overlay to a fresh HTTP starter, inspects the human
-`check --explain` plan, tests all fixtures, and builds all three product-lane inputs.
+`check --explain` plan, tests all fixtures, and builds both product-lane inputs (`relay-public`
+and `relay-consultation`).
 Use the [synthetic OpenCRVS Events API-shaped search](../verify-opencrvs-claims/) to review every
 maintained file and the limits of that evidence.
 
@@ -255,7 +257,6 @@ interactions:
 expect:
   outcome: match
   outputs: { active: true }
-  claims: { person-record-exists: true, person-active: true }
 ```
 
 Keep the request, input, name, and classification fields from the starter fixture.
@@ -295,8 +296,8 @@ registryctl dev down
 ```
 
 For this OAuth scenario, the denial report has zero token and source calls.
-The authorized report has one token exchange, one source call, and the minimized claim
-identifiers `person-active` and `person-record-exists`.
+The authorized report has one token exchange, one source call, and `minimized_claim_ids=none`,
+because the starter project releases no attributes.
 Retained output contains no token, credential, or source-returned value.
 
 ## Review and rebuild
@@ -308,10 +309,11 @@ registryctl check --explain
 registryctl build
 ```
 
-Confirm that the evidence service still has exactly one Relay consultation.
+Confirm that the consultation service still declares exactly one consultation.
 The consultation Relay owns the OAuth destination, credential consumers, Rhai script, source
 authority, and minimized `active` output.
-Notary owns claims and disclosure, and receives no OAuth credential or source origin.
+A downstream consumer of that consultation reads the minimized output and receives no OAuth
+credential and no source origin.
 
 For the exact maintained execution of the no-expiry branch, use the
 [synthetic OpenCRVS Events API-shaped search](../verify-opencrvs-claims/).
diff --git a/docs/site/src/content/docs/tutorials/connect-an-institution-source.mdx b/docs/site/src/content/docs/tutorials/connect-an-institution-source.mdx
new file mode 100644
index 000000000..d0e78970d
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/connect-an-institution-source.mdx
@@ -0,0 +1,230 @@
+---
+title: Connect an institution source from OpenAPI
+description: Retain an institution API contract, draft one bounded Evidence source, add a governed question, and run the editable project locally.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: how-to
+persona:
+  - assertion provider
+locale: en
+standards_referenced: []
+---
+
+If this is your first Evidence project, complete
+[Get your first Evidence assertion](../first-evidence-assertion/) before adapting an institution
+source. You will build one editable project from an institution's OpenAPI document and use the same
+retained contract for source drafting and local execution. You do not assemble a deployment bundle
+or copy a reference deployment.
+
+## Before you start
+
+You need an OpenAPI 3.0 or 3.1 document for an operation that performs one bounded lookup. The
+operation must let Evidence distinguish no match, one match, and several matches without paging
+through a registry.
+
+Keep credentials, real responses, and personal data outside the tracked project. Use a sanitized
+response sample only when the OpenAPI document omits a bound that a reviewer can establish.
+
+## Create the authoring project
+
+Retain the OpenAPI document and create disposable local Evidence keys:
+
+```sh
+evidencectl new institution-evidence \
+  --openapi <institution.openapi.yaml> \
+  --profile local \
+  --generate-keys
+cd institution-evidence
+```
+
+The project now contains the retained `source.openapi.yaml` and empty editable directories for
+`selectors`, `sources`, `adapters`, `schemas`, `questions`, and `derivations`. The command does not
+invent a source, question, fixture, or deployment policy.
+
+## Review the available source fields
+
+Inspect one operation without writing files:
+
+```sh
+evidencectl source suggest \
+  --openapi source.openapi.yaml \
+  --operation 'GET /people/{person_id}' \
+  --source-id people \
+  --select /date_of_birth
+```
+
+Use one `--select` for each leaf needed to resolve source cardinality or derive the answer. A
+selection through an array uses `*`, such as `/results/*/date_of_birth`. The assistant reports
+which string, integer, and collection bounds came from OpenAPI and which still require review.
+
+## Write the source draft
+
+Write the reviewed selection into the project. Omit `--openapi`: `--project` always reads the
+retained `source.openapi.yaml`, so a later command cannot draft against a different contract.
+
+```sh
+evidencectl source suggest \
+  --project . \
+  --operation 'GET /people/{person_id}' \
+  --source-id people \
+  --select /date_of_birth
+```
+
+The command writes new files only:
+
+```text
+sources/people.yaml
+adapters/people-prepare.rhai
+adapters/people-extract.rhai
+schemas/people-parameters.schema.yaml
+schemas/people-response.schema.yaml
+schemas/people-facts.schema.yaml
+```
+
+`sources/people.yaml` is an ordinary Version 1 source object, not an intermediate template. The
+schemas and scripts are the same artifacts the generated local bundle will contain. A repeated
+command refuses to overwrite any edited file.
+
+## Define the authorized selector
+
+Create `selectors/person-reference-v1.yaml`:
+
+```yaml
+maximumAggregateBytes: 64
+fields:
+  person_id:
+    type: string
+    minimumBytes: 1
+    maximumBytes: 64
+```
+
+Then edit `sources/people.yaml`. Replace every `review-required` marker and bind the path parameter
+to that selector profile:
+
+```yaml
+transport: http-json
+baseUrl: https://registry.example.com
+posture: field-projected
+authentication:
+  kind: basic
+  usernameRef: secret:file/registry-username
+  passwordRef: secret:file/registry-password
+request:
+  method: GET
+  pathTemplate: /people/{person_id}
+  pathBindings:
+    person_id:
+      role: person
+      profile: person-reference-v1
+      field: person_id
+  fixedHeaders:
+    - name: Accept
+      value: application/json
+  selectorInputs:
+    - role: person
+      alternatives:
+        - profile: person-reference-v1
+          fields: [person_id]
+  prepareScript: adapters/people-prepare.rhai
+  adapterParameters: {}
+  adapterParametersSchema: schemas/people-parameters.schema.yaml
+  preparationLimits:
+    query: allowed
+    jsonBody: forbidden
+    maximumNormalizedBytes: 4096
+  projection: [/date_of_birth]
+  redirects: deny
+  timeoutMilliseconds: 3000
+  maximumResponseBytes: 65536
+  concurrencyLimit: 8
+responseSchema: schemas/people-response.schema.yaml
+extractScript: adapters/people-extract.rhai
+factSchema: schemas/people-facts.schema.yaml
+```
+
+The source owns its stable identity, authentication references, selector inputs, HTTP request,
+projection, and source artifacts. Several questions can reference `people`; they do not duplicate
+the source or its selector profile.
+
+For fixed query inputs, put reviewed values in `adapterParameters`, close them in
+`people-parameters.schema.yaml`, and render them in `people-prepare.rhai`. For selector-bound query
+inputs, read only a field declared by `selectorInputs`. The script cannot access credentials,
+caller identity, purpose, or signing keys.
+
+## Store the source credential
+
+Create owner-only files without placing either credential in a command:
+
+```sh
+install -m 600 /dev/null secrets/registry-username
+install -m 600 /dev/null secrets/registry-password
+```
+
+Open each file in your editor and enter one credential value. `secret:file/...` values are logical
+references resolved beneath the project's owner-only `secrets` directory. Evidence does not read
+credentials from the source YAML, a command argument, a request, or a log.
+
+## Finish extraction and facts
+
+Review `schemas/people-response.schema.yaml` against the institution contract. Keep the object
+closed and retain only the selected fields. Then edit `adapters/people-extract.rhai` so zero,
+one, conflicting, incomplete, and oversized results fail according to the reviewed source
+semantics. Do not select the first array member as a shortcut.
+
+Close `schemas/people-facts.schema.yaml` around only the facts the derivation receives. OpenAPI
+describes transport shape. The institution still owns the combination rule that turns repeated
+source values into one bounded fact or a bounded collection.
+
+## Add a question that uses the source
+
+Create `questions/adult-status.yaml`:
+
+```yaml
+id: adult-status
+question: Is the person at least 18 years old?
+purpose: age-check
+subject:
+  role: person
+  selector: person_id
+source:
+  ref: people
+answers:
+  - concept: is_adult
+    type: boolean
+derivation: derivations/adult-status.rhai
+disclosure:
+  allow: [is_adult]
+```
+
+Create the named derivation. The function returns a map keyed by the declared concept alias:
+
+```rhai
+fn answer(facts, selectors, context) {
+    let born = parse_date(required(facts.date_of_birth, "date_of_birth_missing"));
+    let adult_on = add_calendar_years(born, 18);
+    #{is_adult: compare_dates(context.legal_local_date, adult_on) >= 0}
+}
+```
+
+The question governs purpose, subject, concepts, derivation, and disclosure. The source governs
+how Evidence obtains the fixed facts. This separation lets another question reuse `people`
+without copying its transport or credential policy.
+
+## Run the authored project
+
+Start the local Evidence and Registry Mint pair:
+
+```sh
+evidencectl dev --detach
+```
+
+`dev` combines the referenced Version 1 source and selector objects with every authored question,
+creates one private local generation, and runs the real `evidence check` gate before serving. A
+missing artifact, unresolved draft marker, invalid secret reference, unbounded schema, or
+inconsistent selector binding stops the generation.
+
+Continue with [Build and deploy an Evidence project](../build-and-deploy-evidence-project/) after the
+project's source, derivation, and synthetic acceptance cases have been independently reviewed.
diff --git a/docs/site/src/content/docs/tutorials/control-who-can-request-evidence.mdx b/docs/site/src/content/docs/tutorials/control-who-can-request-evidence.mdx
new file mode 100644
index 000000000..a934e675a
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/control-who-can-request-evidence.mdx
@@ -0,0 +1,419 @@
+---
+title: Control who can request Evidence
+description: Define access policies, add a client without restarting Evidence, and observe allowed and refused access.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: tutorial
+persona:
+  - assertion provider
+locale: en
+standards_referenced: []
+---
+
+import QuickstartMeta from '../../../components/QuickstartMeta.astro';
+
+Complete [Return a governed value](../return-a-governed-value/) before starting this tutorial.
+You will give two applications different access to that Evidence service, add one while the service
+is running, and prove that a valid access token does not let its client ask every configured
+question.
+
+<QuickstartMeta
+  outcome="Two applications receive different policies, with live onboarding, refusal, and revocation."
+  time="About 15 minutes"
+  level="Local development with synthetic data"
+  prerequisites={[
+    'The completed governed-value tutorial',
+    'Its adult-status project and registry.py',
+    'Python 3',
+    'A shell with curl',
+  ]}
+/>
+
+## Understand what you are controlling
+
+This tutorial manages access for machine applications, not accounts for people.
+
+Registry Mint authenticates each application from its own key and issues a short-lived access
+token. Evidence then checks whether the application's access policy includes the configured
+question. These are separate decisions:
+
+| Decision | Example | Owner |
+| --- | --- | --- |
+| Which application is calling? | `age-checker` | Registry Mint client registration |
+| What may it ask? | The `age-checks` policy includes `adult-status` | Evidence access policy |
+| May Evidence read its source? | `GET /people/{person_id}` | Evidence source configuration |
+| May a consumer trust the result? | Expected issuer, audience, and signing key | Consumer verification policy |
+
+The first two rows are the access-management boundary you will configure. Source credentials and
+consumer trust remain independent.
+
+Access policies are part of Evidence's immutable governed configuration. Client membership is
+part of Registry Mint's reloadable registry:
+
+| Change | Runtime effect |
+| --- | --- |
+| Add or revoke a client | Registry Mint receives a reload request; Evidence does not restart |
+| Add a question or change an access policy | Start a new Evidence generation |
+
+A client change affects tokens issued after Registry Mint reloads. A token issued before a client
+is revoked remains valid for up to 300 seconds.
+
+## Restart the registry
+
+In one terminal, return to the working directory from the first tutorial and start the synthetic
+registry:
+
+```sh
+python3 registry.py
+```
+
+Leave the registry running. In another terminal, enter the project containing both questions:
+
+```sh
+cd adult-status
+```
+
+The project has these two governed questions:
+
+| Question | Declared purpose | Answer |
+| --- | --- | --- |
+| `adult-status` | `age-check` | Boolean adult status |
+| `age-bracket` | `service-path-selection` | One reviewed age bracket |
+
+An access policy names one or more questions. Each question already fixes its purpose, subject
+shape, source, and possible answers, so you do not repeat those fields in the policy.
+
+## Define two access policies
+
+Define a policy for each service task:
+
+```sh
+evidencectl access policy add age-checks --question adult-status
+evidencectl access policy add service-routing --question age-bracket
+```
+
+```text
+Added access policy age-checks for adult-status.
+Added access policy service-routing for age-bracket.
+```
+
+Review the governed policies before starting Evidence:
+
+```sh
+evidencectl access policy list
+```
+
+```text
+POLICY           QUESTIONS
+age-checks       adult-status
+service-routing  age-bracket
+```
+
+The commands write the reviewable policy documents to `access/policies/age-checks.yaml` and
+`access/policies/service-routing.yaml`.
+Many clients can share one policy. A client can also belong to several policies when their question
+sets do not overlap. `evidencectl` rejects overlapping policy assignments because they would make
+the access decision ambiguous. Adding a question to either policy later changes the governed
+authorization boundary and requires a new Evidence generation.
+
+## Register the first local application
+
+Register `age-checker` under the `age-checks` policy:
+
+```sh
+evidencectl access client add age-checker \
+  --policy age-checks \
+  --generate-local-key
+```
+
+```text
+Added client age-checker with policy age-checks.
+```
+
+`--generate-local-key` keeps this tutorial self-contained. The private key represents the
+application's identity and remains owner-only at
+`.evidence/clients/age-checker/private.jwk`. The reviewable registration at
+`access/clients/age-checker.yaml` contains the policy membership and public key, never the private
+key.
+
+## Start the protected service
+
+Compile the questions and both access policies, then start Evidence and Registry Mint:
+
+```sh
+evidencectl dev --detach
+```
+
+```text
+Evidence ready at http://127.0.0.1:8080
+Mint ready at http://127.0.0.1:8081
+```
+
+Registry Mint recognizes `age-checker`. Evidence has both access policies available, even though
+no client belongs to `service-routing` yet.
+
+## Make an allowed request
+
+Prepare an adult-status request as `age-checker`:
+
+```sh
+evidencectl request prepare adult-status \
+  --purpose age-check \
+  --subject person_id=person-123 \
+  --client age-checker \
+  --name age-checker-allowed
+```
+
+Preparation signs a one-time client assertion with the local application key, exchanges it for a
+short-lived access token, and writes the request and verification expectations before any source
+access occurs.
+
+Send the request across the Evidence HTTP boundary:
+
+```sh
+curl --silent --show-error --fail-with-body \
+  --config .evidence/requests/age-checker-allowed/authorization.curl \
+  --request POST \
+  --url http://127.0.0.1:8080/v1/evidence \
+  --header 'Content-Type: application/json' \
+  --header 'Accept: application/jose+json' \
+  --data-binary @.evidence/requests/age-checker-allowed/request.json \
+  --output age-checker-allowed.jws.json \
+  --write-out 'HTTP %{http_code}\n'
+```
+
+```text
+HTTP 200
+```
+
+Verify the response before reading it:
+
+```sh
+evidencectl verify age-checker-allowed.jws.json \
+  --context .evidence/requests/age-checker-allowed/verification.json \
+  --output age-checker-allowed.verified.json
+```
+
+```text
+VERIFIED
+```
+
+The application was authenticated, its `age-checks` policy matched the request, and Evidence
+called the registry only after both checks passed.
+
+## Add an application without restarting
+
+Keep Evidence and Registry Mint running. Register `service-router` under the existing
+`service-routing` policy:
+
+```sh
+evidencectl access client add service-router \
+  --policy service-routing \
+  --generate-local-key
+```
+
+```text
+Added client service-router with policy service-routing.
+Registry Mint reload requested.
+```
+
+The command writes the public registration to `access/clients/service-router.yaml`, keeps the
+private key under `.evidence/clients/`, and asks Registry Mint to reload its complete client
+registry. The message confirms that the reload was requested, not that Registry Mint accepted the
+new registry. The next token exchange provides that functional proof. Evidence does not restart
+because both access policies were already part of its governed configuration.
+
+Review the active client assignments:
+
+```sh
+evidencectl access client list
+```
+
+```text
+CLIENT          STATUS  POLICIES
+age-checker     active  age-checks
+service-router  active  service-routing
+```
+
+## Try a question the application was not granted
+
+Prepare an age-bracket request using the same `age-checker` identity:
+
+```sh
+evidencectl request prepare age-bracket \
+  --purpose service-path-selection \
+  --subject person_id=person-456 \
+  --client age-checker \
+  --name age-checker-refused
+```
+
+The command can prepare the request because `age-bracket` is a valid project question and
+`age-checker` is a registered client. The Evidence service, not the request-building tool, makes
+the authorization decision.
+
+Send the request:
+
+```sh
+curl --silent --show-error \
+  --config .evidence/requests/age-checker-refused/authorization.curl \
+  --request POST \
+  --url http://127.0.0.1:8080/v1/evidence \
+  --header 'Content-Type: application/json' \
+  --header 'Accept: application/jose+json' \
+  --data-binary @.evidence/requests/age-checker-refused/request.json \
+  --output age-checker-refused.json \
+  --write-out 'HTTP %{http_code}\n'
+```
+
+```text
+HTTP 403
+```
+
+Inspect the safe problem response:
+
+```sh
+python3 -m json.tool age-checker-refused.json
+```
+
+```json
+{
+  "type": "https://registrystack.org/problems/evidence/not_authorized",
+  "title": "Request is not authorized",
+  "status": 403,
+  "code": "not_authorized",
+  "operation": "<opaque-operation-id>"
+}
+```
+
+The access token is valid, but the client's `age-checks` policy does not authorize the
+`age-bracket` question. The registry terminal shows no new `GET /people/person-456`, because
+Evidence refuses the request before source access. The response does not reveal which application,
+question, or policy caused the refusal.
+
+## Use the application assigned the policy
+
+Prepare the same age-bracket question as `service-router`:
+
+```sh
+evidencectl request prepare age-bracket \
+  --purpose service-path-selection \
+  --subject person_id=person-456 \
+  --client service-router \
+  --name service-router-allowed
+```
+
+Send and verify the response:
+
+```sh
+curl --silent --show-error --fail-with-body \
+  --config .evidence/requests/service-router-allowed/authorization.curl \
+  --request POST \
+  --url http://127.0.0.1:8080/v1/evidence \
+  --header 'Content-Type: application/json' \
+  --header 'Accept: application/jose+json' \
+  --data-binary @.evidence/requests/service-router-allowed/request.json \
+  --output service-router-allowed.jws.json \
+  --write-out 'HTTP %{http_code}\n'
+
+evidencectl verify service-router-allowed.jws.json \
+  --context .evidence/requests/service-router-allowed/verification.json \
+  --output service-router-allowed.verified.json
+```
+
+```text
+HTTP 200
+VERIFIED
+```
+
+The question, purpose, and subject are unchanged. Changing only the authenticated application
+changes the access decision because `service-router` belongs to the required policy.
+
+## Revoke an application
+
+Stop issuing new access tokens to `age-checker`:
+
+```sh
+evidencectl access client revoke age-checker
+```
+
+```text
+Revoked client age-checker.
+Registry Mint reload requested.
+```
+
+The command updates `access/clients/age-checker.yaml` and requests another Registry Mint reload
+without restarting Evidence. Revocation cannot erase a stateless access token already issued to
+the application. That token remains valid for up to 300 seconds.
+
+Try to prepare a fresh request as the revoked client:
+
+```sh
+evidencectl request prepare adult-status \
+  --purpose age-check \
+  --subject person_id=person-123 \
+  --client age-checker \
+  --name age-checker-revoked
+```
+
+```text
+evidencectl: unknown or revoked active client age-checker
+```
+
+`evidencectl` rejects an unknown or revoked named client locally, before contacting Registry Mint
+or publishing request artifacts. `service-router` remains registered and keeps its
+`service-routing` membership.
+
+## Inspect the final audit operation
+
+Stop the local services before reading their completed audit chain:
+
+```sh
+evidencectl dev stop
+evidencectl audit show --last-operation
+```
+
+```text
+ACCESS AUTHORIZED age-bracket service-path-selection requester=<pseudonym>
+DISCLOSURE RELEASED age_bracket
+```
+
+The audit distinguishes requester pseudonyms without writing client identifiers, tokens, subject
+selectors, or returned values. The earlier authorization refusal is not retained in the durable
+Evidence audit. Evidence currently returns that refusal before appending an access-attempt event.
+The revoked-client preparation also has no Evidence audit event because no HTTP request was sent.
+
+## Clean up
+
+Remove the stopped generated runtime while preserving the editable questions, access policy, and
+request artifacts:
+
+```sh
+evidencectl dev clean
+```
+
+Return to the registry terminal and press `Ctrl+C`.
+
+## What you proved
+
+- Authentication identifies the calling application but grants no question by itself.
+- Many applications can share a governed access policy without client-specific Evidence config.
+- A client added while the services run can obtain a token without restarting Evidence or
+  Registry Mint.
+- Each application receives only the questions included in its assigned policies.
+- Evidence refuses unauthorized questions before reading the source.
+- Revoking a local client requests a Registry Mint reload and prevents new local request
+  preparation.
+- Client membership changes affect new tokens while existing tokens remain valid for up to 300
+  seconds.
+- Adding a question or changing an access policy requires a new Evidence generation.
+- Source authentication and consumer trust remain separate from caller access.
+
+## Next
+
+- [See Evidence refuse unsafe requests](../refuse-unsafe-evidence-requests/)
+- [Configure Registry Mint](../../configure/mint/)
+- [Request an access token from application code](../../configure/request-an-access-token/)
+- [Manage Evidence verifier trust](../manage-evidence-verifier-trust/)
diff --git a/docs/site/src/content/docs/tutorials/deploy-standalone-with-own-data.mdx b/docs/site/src/content/docs/tutorials/deploy-standalone-with-own-data.mdx
index cf1999c72..c4d82bc43 100644
--- a/docs/site/src/content/docs/tutorials/deploy-standalone-with-own-data.mdx
+++ b/docs/site/src/content/docs/tutorials/deploy-standalone-with-own-data.mdx
@@ -1,22 +1,21 @@
 ---
 title: Connect your own data through Relay
-description: Adapt a Registry Stack project to an institution-owned source while keeping every claim consultation-backed and product authority separate.
+description: Adapt a Registry Stack project to an institution-owned source while keeping every answer consultation-backed and product authority separate.
 status: draft
 draft: true
 owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-30"
+last_reviewed: "2026-08-04"
 doc_type: how-to
 locale: en
 standards_referenced: []
 ---
 
 Use this guide to replace a synthetic development source with institution-owned data while
-keeping source access in Registry Relay and every Registry Notary claim rooted in exactly one
-Relay consultation.
+keeping source access in Registry Relay and every served answer rooted in exactly one Relay
+consultation.
 
 ## When to use this
 
@@ -31,10 +30,10 @@ Registryctl does not infer source authority, identity mappings, or disclosure po
 
 You need:
 
-- A project created with `registryctl init <directory> --template http`
+- A project created through [Connect an existing HTTP registry](../author-registry-project/)
 - A source-owner-approved non-production endpoint
 - A stable subject identifier and exact mapping from the request to one consultation input
-- The smallest typed output required by each claim
+- The smallest typed output required by each caller
 - Synthetic observations for match, no match, and every meaningful failure
 - Secret references for the selected environment, with values kept outside authored files
 
@@ -60,30 +59,35 @@ redirects, source calls, and source audit.
 Rhai receives no credential, token, token response, filesystem, process, or arbitrary network
 authority.
 
-## Keep every claim consultation-backed
+## Keep every answer consultation-backed
 
-Each evidence service must map the request to exactly one Relay consultation before declaring
-claims:
+A consultation service maps the request to exactly one Relay consultation, and that consultation
+derives from exactly one declared integration:
 
 ```yaml
-consultations:
-  record:
-    integration: reviewed-record
-    input:
-      record_id: request.target.identifiers.registry_record_id
-claims:
-  record-exists:
-    cel: record.matched
-    disclosure: predicate
-  reviewed-status:
-    output: record.status
-    disclosure: value
+services:
+  record-verification:
+    kind: consultation_api
+    version: 1
+    purpose: record-verification
+    legal_basis: public-service-delivery
+    consent: not_required
+    consultations:
+      record:
+        integration: reviewed-record
+        input:
+          record_id: request.target.identifiers.registry_record_id
 ```
 
-The consultation name `record` is the only root used by these claims.
-Do not add source-free, self-attested, delegated-attestation, or caller-defined fallback claim
-paths.
-If a claim has no reviewed source, keep it out of the Registry Stack evidence service.
+The consultation name `record` is the only root the service can answer from, and the minimized
+outputs declared by `reviewed-record` are the only values it returns.
+Do not add a source-free, self-attested, delegated-attestation, or caller-defined fallback path.
+If an answer has no reviewed source, keep it out of the service.
+
+A caller that needs a signed, minimum-disclosure assertion rather than a protected read calls
+[Evidence](../../products/registry-evidence/) directly.
+Evidence can consume this Relay-protected API through its ordinary fixed HTTP source contract; it
+does not inherit Relay's authorization or policy model.
 
 ## Prove the source contract offline
 
@@ -128,9 +132,9 @@ registryctl check --explain
 ```
 
 Review source destinations, secret consumers, request authority, subject binding, output types,
-limits, claims, and disclosure.
-The redacted plan must keep source authority in consultation Relay and claim evaluation in
-Notary.
+and limits.
+The redacted plan must keep source authority, the reviewed script, and the minimized outputs in
+consultation Relay.
 
 ## Exercise the disposable product path
 
@@ -143,8 +147,8 @@ registryctl dev down
 ```
 
 The denial scenario must perform no token or source call.
-The authorized scenario must perform only the declared bounded calls and report only minimized
-claim identifiers.
+The authorized scenario must perform only the declared bounded calls and return only the declared
+consultation outputs.
 This development trust, credential, and state material is disposable and cannot be promoted.
 
 Testing an operator-bound non-production source requires explicit source-owner authorization.
@@ -159,18 +163,19 @@ Build deterministic unsigned lane inputs:
 registryctl build
 ```
 
-Keep `relay-public`, `relay-consultation`, and `notary` separate.
-The consultation Relay lane owns the source contract.
-Notary owns claims and disclosure but receives no direct source credential or origin.
+Keep `relay-public` and `relay-consultation` separate.
+The consultation Relay lane owns the source contract, the credential references, and the source
+origin.
+The public Relay lane serves callers and receives neither.
 
 Independent product owners review and sign the affected lanes, then the operator assembles the
 approved set.
 Use [Run the generated single-node Compose package](../../operate/single-node-compose-behind-proxy/)
 for the governed deployment handoff.
 
-Do not add a direct source connection to Registry Notary. A combined Registry Stack project
-compiles the source integration and consultation into Relay, then compiles Notary claims against
-the pinned Relay contract. A Notary-only project may contain no claims.
+Do not add a second direct source connection anywhere else in the project. A Registry Stack
+project compiles the source integration and its consultation into the consultation Relay lane,
+and every other lane reads the pinned Relay contract instead of the source.
 
 Follow [Author an HTTP Registry Stack project](../author-registry-project/) to run offline fixtures,
 inspect the redacted plan, and build separate unsigned product inputs. Package, sign, verify, and
@@ -185,7 +190,7 @@ An application Compose file or include graph remains operator-owned.
 | Symptom | Cause | Fix |
 | --- | --- | --- |
 | A source call is rejected before dispatch | The request is outside the reviewed method, path, or budget. | Correct the adapter or narrowly change the authored source authority. |
-| A claim lacks a consultation root | The claim has no Registry Stack evidence source. | Add one exact Relay consultation or remove the claim. |
+| A service lacks a consultation root | The service has no reviewed source behind it. | Add one exact Relay consultation or remove the service. |
 | A secret appears in an authored or generated file | A secret value crossed its ownership boundary. | Stop, remove the exposed material, rotate it, and report the failure through the security process. |
 | A fixture passes but the live source differs | Synthetic and interoperability evidence have been confused. | Keep the version `unverified` and run a separately authorized compatibility review. |
 | The generated Compose package cannot express an operator need | The orchestration change is outside the binding schema. | Keep the verified package intact and compose it into a separate operator-owned application. |
@@ -194,5 +199,5 @@ An application Compose file or include graph remains operator-owned.
 
 - [Build and run an HTTP registry project](../author-registry-project/) for the bounded HTTP
   authoring path.
-- [Compare and approve an evidence change](../../operate/advanced/compare-and-reapprove-source-change/)
+- [Compare and approve a source change](../../operate/advanced/compare-and-reapprove-source-change/)
   when changing a governed deployment.
diff --git a/docs/site/src/content/docs/tutorials/first-evidence-assertion.mdx b/docs/site/src/content/docs/tutorials/first-evidence-assertion.mdx
new file mode 100644
index 000000000..0d0bbbd2f
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/first-evidence-assertion.mdx
@@ -0,0 +1,469 @@
+---
+title: Get your first Evidence assertion
+description: Run a local registry and verify a signed adult-status answer without copying the source record.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: tutorial
+persona:
+  - assertion provider
+locale: en
+standards_referenced: []
+---
+
+import QuickstartMeta from '../../../components/QuickstartMeta.astro';
+
+Evidence reads an authorized source record, answers a preconfigured question, and signs only the
+governed answer. In this tutorial, you will ask "Is this person an adult?" without returning the
+person's name or date of birth.
+
+<QuickstartMeta
+  outcome="A verified assertion containing an adult-status answer, but not the source record."
+  time="About 15 minutes"
+  level="Local development with synthetic data"
+  prerequisites={['Python 3', 'A shell with curl', 'An editor', 'Linux or macOS']}
+/>
+
+## Understand the flow
+
+```mermaid
+%%{init: {"sequence": {"mirrorActors": false}}}%%
+sequenceDiagram
+    participant C as Tutorial caller
+    participant E as Evidence
+    participant R as Tutorial registry
+
+    C->>E: Authorized request<br/>adult-status, person_id=person-123
+    E->>R: GET /people/person-123
+    R-->>E: person_id, name, date_of_birth
+    E->>E: Extract date_of_birth<br/>Derive and sign is_adult: true
+    E-->>C: Signed assertion with is_adult: true<br/>and an opaque subject binding
+    Note over C,E: The assertion contains no person_id,<br/>name, or date_of_birth
+```
+
+Before the request, Registry Mint gives the tutorial caller short-lived local authorization.
+Evidence and the registry process the identifier and date of birth to answer the question, but the
+released assertion contains only the governed answer and an opaque subject binding.
+
+## Install Evidence
+
+Install the latest Evidence toolset:
+
+```sh
+curl -fsSL https://github.com/registrystack/registry-stack/releases/latest/download/evidencectl-install.sh | bash
+evidencectl --version
+```
+
+The installer provides `evidencectl` and the local Evidence and Registry Mint runtimes used later
+in the tutorial.
+
+## Start a small registry
+
+Create a working directory:
+
+```sh
+mkdir first-evidence-assertion
+cd first-evidence-assertion
+```
+
+Open `registry.py` in your editor and add this server:
+
+```python
+import json
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from urllib.parse import unquote, urlsplit
+
+PEOPLE = {
+    "person-123": {
+        "person_id": "person-123",
+        "name": "Amina Example",
+        "date_of_birth": "2000-01-01",
+    },
+    "person-456": {
+        "person_id": "person-456",
+        "name": "Mateo Example",
+        "date_of_birth": "2012-05-20",
+    },
+    "person-789": {
+        "person_id": "person-789",
+        "name": "Noor Example",
+        "date_of_birth": "1988-11-03",
+    },
+}
+OPENAPI = {
+    "openapi": "3.1.0",
+    "info": {"title": "Tutorial registry", "version": "1.0.0"},
+    "servers": [{"url": "http://127.0.0.1:8000"}],
+    "paths": {"/people/{person_id}": {"get": {
+        "operationId": "getPerson",
+        "parameters": [{"name": "person_id", "in": "path", "required": True,
+                        "schema": {"type": "string"}}],
+        "responses": {"200": {
+            "description": "A person record",
+            "content": {"application/json": {
+                "schema": {
+                    "type": "object",
+                    "required": ["person_id", "name", "date_of_birth"],
+                    "properties": {
+                        "person_id": {"type": "string", "minLength": 1, "maxLength": 64},
+                        "name": {"type": "string", "minLength": 1, "maxLength": 100},
+                        "date_of_birth": {
+                            "type": "string", "format": "date",
+                            "minLength": 10, "maxLength": 10,
+                        },
+                    },
+                },
+            }},
+        }},
+    }}},
+}
+
+class Registry(BaseHTTPRequestHandler):
+    def do_GET(self):
+        path = unquote(urlsplit(self.path).path)
+        if path == "/openapi.json":
+            return self.send_json(OPENAPI)
+        people_prefix = "/people/"
+        if path.startswith(people_prefix):
+            person = PEOPLE.get(path[len(people_prefix):])
+            if person is not None:
+                return self.send_json(person)
+        self.send_error(404)
+
+    def send_json(self, value):
+        body = json.dumps(value).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+print("Registry listening on http://127.0.0.1:8000", flush=True)
+ThreadingHTTPServer(("127.0.0.1", 8000), Registry).serve_forever()
+```
+
+You do not need to understand every line of the server. Three details connect it to Evidence:
+
+- `/people/{person_id}` returns a complete person record.
+- `/openapi.json` describes that endpoint and its response.
+- `getPerson` is the OpenAPI operation that the Evidence question will select.
+
+In one terminal, start the registry and leave it running:
+
+```sh
+python3 registry.py
+```
+
+The server publishes its OpenAPI description at `/openapi.json` and three synthetic records:
+`person-123`, `person-456`, and `person-789`.
+The records include both adults and a child, but this tutorial will request an assertion only for
+`person-123`.
+
+In another terminal, return to `first-evidence-assertion` and inspect the source record:
+
+```sh
+curl -s http://127.0.0.1:8000/people/person-123 | python3 -m json.tool
+```
+
+```json
+{
+  "person_id": "person-123",
+  "name": "Amina Example",
+  "date_of_birth": "2000-01-01"
+}
+```
+
+The registry returns an identifier, a name, and a date of birth. The verified assertion will contain
+none of those source values.
+
+## Create the Evidence project
+
+Create a local project from the registry's OpenAPI description:
+
+```sh
+evidencectl new adult-status \
+  --openapi http://127.0.0.1:8000/openapi.json \
+  --profile local \
+  --generate-keys
+cd adult-status
+```
+
+`--profile local` creates a loopback-only development project, not a production deployment.
+`--generate-keys` creates owner-only local keys for signing, subject binding, and audit integrity.
+OpenAPI describes the source, but you still decide the question and what the answer may disclose.
+
+The new project separates those decisions from the retained API description:
+
+```text
+adult-status/
+├── source.openapi.yaml
+├── selectors/
+├── sources/
+├── adapters/
+├── schemas/
+├── questions/
+├── derivations/
+└── secrets/
+```
+
+This first question uses the compact OpenAPI form, so you will add only a question and its
+derivation. Later institution integrations use the reusable source, selector, adapter, and schema
+directories.
+
+### `questions/adult-status.yaml`
+
+Open `questions/adult-status.yaml` in your editor and add the question definition:
+
+```yaml
+id: adult-status
+question: Is the person at least 18 years old?
+purpose: age-check
+subject:
+  role: person
+  selector: person_id
+source:
+  operation: getPerson
+  facts:
+    - name: date_of_birth
+      path: /date_of_birth
+      combine: exactly-one
+  collectionBounds: {}
+answers:
+  - concept: is_adult
+    type: boolean
+derivation: derivations/adult-status.rhai
+disclosure:
+  allow: [is_adult]
+```
+
+The definition closes four decisions:
+
+- `subject` says that `person_id` selects the person in `/people/{person_id}`.
+- `source` selects `getPerson` and allows only `date_of_birth` to reach the derivation. It does not
+  change the complete record returned by the registry.
+- `answers` declares one permitted result, a boolean named `is_adult`.
+- `disclosure` is the explicit release boundary. It must name exactly the answers returned by the
+  derivation.
+
+`combine: exactly-one` rejects a missing or repeated `date_of_birth`. `collectionBounds: {}` is
+empty because this fact does not traverse a collection. The request purpose must be `age-check`,
+matching the purpose declared here.
+
+### `derivations/adult-status.rhai`
+
+Open `derivations/adult-status.rhai` in your editor and add the answer logic. Rhai is the bounded
+scripting language Evidence uses for requirement-specific derivations:
+
+```rhai
+fn answer(facts, selectors, context) {
+    let born = parse_date(required(facts.date_of_birth, "date_of_birth_missing"));
+    let adult_on = add_calendar_years(born, 18);
+    #{is_adult: compare_dates(context.legal_local_date, adult_on) >= 0}
+}
+```
+
+The derivation performs four operations:
+
+1. Require and parse the selected date of birth.
+2. Calculate the eighteenth birthday using calendar arithmetic.
+3. Compare it with `context.legal_local_date`, which Evidence derives from the observation instant
+   in the configured timezone.
+4. Return a map containing exactly the declared `is_adult` answer.
+
+Evidence validates the returned name and boolean form before signing.
+
+Start Evidence and Registry Mint:
+
+```sh
+evidencectl dev --detach
+```
+
+```text
+Evidence ready at http://127.0.0.1:8080
+Mint ready at http://127.0.0.1:8081
+```
+
+This command starts Evidence and Mint only. The Python registry remains the process you started in
+the first terminal.
+
+## Request an assertion
+
+Prepare the request, local access, and verification expectations:
+
+```sh
+evidencectl request prepare adult-status \
+  --purpose age-check \
+  --subject person_id=person-123 \
+  --name first-assertion
+```
+
+Preparation asks the local Mint for short-lived authorization and records the verification
+expectations before a response exists. It does not send the request to Evidence or contact the
+registry. It creates exactly these owner-only artifacts:
+
+```text
+Prepared request: .evidence/requests/first-assertion/request.json
+Prepared verification context: .evidence/requests/first-assertion/verification.json
+Prepared authorization: .evidence/requests/first-assertion/authorization.curl
+```
+
+The artifacts have separate responsibilities:
+
+- `request.json` contains the question, purpose, fresh request nonce, and `person-123` selector.
+- `verification.json` records what a valid response must satisfy before the response exists.
+- `authorization.curl` contains only the short-lived local authorization header.
+
+Send the request yourself:
+
+```sh
+curl --silent --show-error --fail-with-body \
+  --config .evidence/requests/first-assertion/authorization.curl \
+  --request POST \
+  --url http://127.0.0.1:8080/v1/evidence \
+  --header 'Content-Type: application/json' \
+  --header 'Accept: application/jose+json' \
+  --data-binary @.evidence/requests/first-assertion/request.json \
+  --output assertion.jws.json \
+  --write-out 'HTTP %{http_code}\n'
+```
+
+```text
+HTTP 200
+```
+
+`curl` called Evidence, Evidence called the registry, and the HTTP response is a signed flattened
+JSON Web Signature (JWS). A successful HTTP response is not yet a trusted assertion.
+
+## Verify before reading
+
+Verify the response against the expectations recorded before the request. Verification checks the
+signature and exact issuer, question, purpose, audience, request nonce, subject binding, answer
+shape, and validity period:
+
+```sh
+evidencectl verify assertion.jws.json \
+  --context .evidence/requests/first-assertion/verification.json \
+  --output verified.json
+```
+
+```text
+VERIFIED
+```
+
+Only after the command prints `VERIFIED`, inspect the verified payload:
+
+```sh
+python3 -m json.tool verified.json
+```
+
+The verified document contains generated identifiers, timestamps, and a pseudonymous subject
+binding. The fields relevant to this question look like this excerpt:
+
+```json
+{
+  "assuranceProfile": "local",
+  "purpose": "age-check",
+  "subjects": [
+    {
+      "binding": "urn:evidence:subject:v1_…",
+      "role": "person"
+    }
+  ],
+  "supportedValues": [
+    {
+      "providesValueFor": "urn:registrystack:evidence:local:concept:adult-status:is_adult",
+      "value": true
+    }
+  ],
+  "supportsRequirement": "urn:registrystack:evidence:local:requirement:adult-status"
+}
+```
+
+`supportsRequirement` names the requirement that the question you authored under `questions/`
+compiles to, which is the unit the deployed configuration and the audit record.
+
+The verified payload does not include `person_id`, `name`, or `date_of_birth`. The assertion
+answers the authored question without becoming another copy of the registry record.
+
+The owner-only `request.json` still records that this transaction concerned `person-123`, while
+`verification.json` records the expected opaque subject binding and request nonce. Retain those
+files with the signed response when you need to [verify Evidence later as a
+consumer](../verify-an-assertion-as-a-consumer/). The identifier cannot be recovered from the
+assertion alone.
+
+## Stop the local services
+
+Stop Evidence and Mint before reading the completed audit chain:
+
+```sh
+evidencectl dev stop
+```
+
+```text
+Local Evidence stopped
+```
+
+## Inspect the audit entry
+
+Verify the completed audit chain and show its last operation:
+
+```sh
+evidencectl audit show --last-operation
+```
+
+```text
+ACCESS AUTHORIZED adult-status age-check requester=<pseudonym>
+DISCLOSURE RELEASED is_adult
+```
+
+The requester value changes on each fresh project. The view identifies the question, purpose,
+requester pseudonym, authorization decision, and disclosed concept. It does not repeat the source
+record or access token.
+
+## Clean up
+
+Remove the stopped local generation, including the sealed bundle that Evidence used:
+
+```sh
+evidencectl dev clean
+```
+
+```text
+Removed stopped local Evidence state
+```
+
+This preserves your editable questions, derivations, keys, and request artifacts. It removes
+`.evidence/dev`, whose runtime files are deliberately read-only while a generation exists. Run
+`dev stop` and then `dev clean` instead of changing those permissions by hand. The command refuses
+to remove a running or unrecognized generation.
+
+Return to the first terminal and press `Ctrl+C` to stop the registry.
+
+Keep the tutorial directory to continue with the governed-value tutorial. If you do not plan to
+continue, you can remove the complete directory with ordinary file commands.
+
+## If local ports are already in use
+
+Choose two different unused ports when you start the local services:
+
+```sh
+evidencectl dev --detach --evidence-port 8180 --mint-port 8181
+```
+
+Evidence uses the selected ports consistently in its runtime, Mint authorization, readiness
+checks, and generated request artifacts. Send the assertion request to the selected Evidence port,
+such as `http://127.0.0.1:8180/v1/evidence`.
+
+The development profile binds both services to loopback in the environment where the command
+runs. If that environment is a Docker container, run the tutorial's `curl` commands in the same
+container. Use the operator deployment configuration when the service must listen beyond
+loopback.
+
+## Next
+
+- [Return a governed value](../return-a-governed-value/)
+- [Bind two people to one relationship assertion](../assert-a-role-bound-relationship/)
+- [Review the Evidence overview](../../start/evidence-quickstart/)
+- [Evaluate Evidence's operating requirements](../../start/evaluate-evidence/)
diff --git a/docs/site/src/content/docs/tutorials/first-run-with-solmara-lab.mdx b/docs/site/src/content/docs/tutorials/first-run-with-solmara-lab.mdx
index d17ef332c..4f98f349e 100644
--- a/docs/site/src/content/docs/tutorials/first-run-with-solmara-lab.mdx
+++ b/docs/site/src/content/docs/tutorials/first-run-with-solmara-lab.mdx
@@ -1,36 +1,40 @@
 ---
 title: First run with Solmara Lab
-description: Bring up the Solmara Lab compose demo on a laptop, verify it with the smoke suite, and call a Notary evaluation route directly.
+description: Bring up the Solmara Lab compose demo on a laptop, verify it with the smoke suites, and ask Registry Evidence one question over a Relay-protected API.
 status: current
-draft: true
 owner: registry-docs
 source_repos:
   - solmara-lab
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-07"
+  - registry-evidence
+  - registry-mint
+last_reviewed: "2026-08-03"
 doc_type: tutorial
+persona:
+  - operator
+  - consumer or verifier
 locale: en
 standards_referenced:
   - openapi
-  - sd-jwt-vc
+  - cccev
 ---
 
 import QuickstartMeta from '../../../components/QuickstartMeta.astro';
 import { Steps } from '@astrojs/starlight/components';
 
-Solmara Lab is a standalone Registry Stack adopter demo for the fictional Republic of Solmara: six
-[Registry Relay](../../products/registry-relay/) instances and four
-[Registry Notary](../../products/registry-notary/) instances wired over generated synthetic data
-into one topology, alongside a citizen portal and a public Visitor's Center. This tutorial brings
-the topology up with the lab's `just` recipes, verifies it with the smoke suite, and calls a Notary
-evaluation route directly so you touch the protected API surface, not only the portal.
+Solmara Lab is a standalone Registry Stack adopter demo for the fictional Republic of Solmara: a
+whole country's worth of registry services over generated synthetic data, with a citizen portal and
+a public Visitor's Center in front of them. This tutorial brings that topology up with the lab's
+`just` recipes, verifies it with the smoke suites, and then asks
+[Registry Evidence](../../products/registry-evidence/) one question by hand: is this person an
+adult? The answer comes back signed, and the date of birth behind it never leaves the Civil
+Registration Authority.
 
 <QuickstartMeta
-  outcome="The full Solmara Lab topology running on your laptop, verified by the smoke suite, with a Notary evaluation call made directly against the running stack."
-  time="About 20 minutes, most of it the first startup (image pulls plus three local image builds)"
+  outcome="The full Solmara Lab topology running on your laptop, verified by both smoke suites, and one signed Evidence assertion you requested by hand over a Relay-protected API."
+  time="About 30 minutes, most of it the first startup (image pulls plus local image builds)"
   level="Local multi-service demo"
-  prerequisites={['Docker Compose', 'just', 'uv', 'python3 and openssl', 'pnpm 11.3.0 via corepack', 'git', 'curl']}
+  prerequisites={['Docker Compose', 'just', 'uv', 'python3 and openssl', 'pnpm 11.3.0 via corepack', 'git', 'curl', 'A clean Registry Stack checkout']}
 />
 
 This tutorial uses synthetic data and local demo credentials.
@@ -38,12 +42,13 @@ Do not use the generated local keys in production.
 
 For a standalone local project, use
 [Build and run an HTTP registry project](../author-registry-project/).
+For Evidence on its own, review the [Evidence quickstart](../../start/evidence-quickstart/).
 Clone Solmara Lab when you want the full multi-service country demo.
 
 ## Prerequisites
 
-- Docker with Compose v2. `just up` and `just down` run `docker compose ... up -d --build` and
-  `docker compose ... down`.
+- Docker with Compose v2. `just up-evidence` and `just down-evidence` run
+  `docker compose ... up -d --build` and `docker compose ... down`.
 - The [`just`](https://github.com/casey/just) command runner. Every step in this tutorial is a
   `just` recipe.
 - `uv`. `just generate` runs the fixture generator with `uv run python -m solmara_lab.generate`.
@@ -52,7 +57,12 @@ Clone Solmara Lab when you want the full multi-service country demo.
 - `pnpm` `11.3.0`, matching the `packageManager` field the portal and Visitor's Center pin. Run
   `corepack enable` first if `pnpm` is not already on your PATH.
 - `git`.
-- `curl`, for the direct Notary evaluation call and the verify commands.
+- `curl`, for the direct Evidence call and the verify commands.
+- A clean checkout of the Registry Stack repository, named by the `REGISTRY_STACK_SOURCE_DIR`
+  environment variable. No Registry Stack release ships the Evidence or Mint binaries yet, so the
+  lab builds those two images from source; every other image it runs is a pinned digest. The
+  checkout must have no uncommitted changes, because the build labels each image with the commit
+  that produced it. This prerequisite goes away once a release publishes both images.
 
 ## Get the repository
 
@@ -70,11 +80,11 @@ just setup
 
 ## Steps
 
-Run these from your Solmara Lab checkout, in order.
+Run these from your Solmara Lab checkout, in order, with `REGISTRY_STACK_SOURCE_DIR` exported.
 
 <Steps>
 
-1. Generate the deterministic fixtures, local demo secrets, and Postgres TLS material:
+1. Generate the deterministic fixtures, local demo secrets, and TLS material:
 
     ```sh
     just generate
@@ -83,132 +93,184 @@ Run these from your Solmara Lab checkout, in order.
 2. Build the local images and start the topology in the background:
 
     ```sh
-    just up
+    just up-evidence
     ```
 
-3. Run the smoke suite, the primary verification:
+3. Run the country smoke suite:
 
     ```sh
     just smoke
     ```
 
+4. Run the Evidence smoke, which drives Mint, Relay, and Evidence end to end:
+
+    ```sh
+    just smoke-evidence
+    ```
+
 </Steps>
 
-`just generate` also writes `.env`, a Compose-required file of local demo credentials. Skipping it
-is the most common first failure; see the troubleshooting table. `just up` builds the `portal`,
-`home`, and `scenario-runner` images locally and pulls the digest-pinned Relay and Notary images;
-expect the first run to take most of this tutorial's time. `just smoke` runs story-preview checks
-plus, by default, live checks against the running Relay, Notary, and portal services.
+`just generate` also writes `.env`, a Compose-required file of local demo credentials, and the
+lab's own certificate authority under `config/evidence/tls/`. Skipping it is the most common first
+failure; see the troubleshooting table. `just up-evidence` builds the Evidence and Mint images from
+your Registry Stack checkout, builds the `portal`, `home`, and `scenario-runner` images, and pulls
+the digest-pinned Relay and `registry-notary` images; expect the first run to take most of this
+tutorial's time. The lab still runs `registry-notary` containers alongside Evidence until its own
+migration lands, so they appear here and in the topology below. `just smoke` runs story-preview
+checks plus live checks against the running Relay, `registry-notary`, and portal services. `just smoke-evidence` runs four cases against the Evidence path: an adult, a
+minor, a reference no record resolves, and an unusable access token.
 
 ## What is running
 
-`just up` starts 16 long-running services: six purpose-scoped Relay instances, one per Solmara
-ministry authority, four purpose-scoped Notary instances, the citizen portal, the public Visitor's
-Center, a static metadata publisher, a scenario-runner service that backs the portal's guided
-demos, Postgres, and Redis.
+`just up-evidence` starts 41 long-running services. Most of them exist so that the country's own
+journeys work; this tutorial calls six of them.
 
 {/* SVG diagram. Every service name and host port in the diagram is restated in the
-    table and paragraphs that follow. */}
+    tables and paragraphs that follow. */}
 <figure>
   <img src="../../images/solmara-lab-topology.svg"
-       alt="Solmara Lab compose topology, 16 services. Six authority Relay instances
-            (cra-civil-relay :4311, nia-population-relay :4312, sro-social-relay :4313,
-            programme-mis-relay :4314, sipf-pensions-relay :4315, nagdi-agriculture-relay :4316)
-            provide evidence reads to four Notary instances (child-benefit-notary :4321, which
-            you call directly in this tutorial; pension-notary :4322; nagdi-notary :4323;
-            citizen-notary :4324). The citizen portal :4300 is wired to the citizen Notary;
-            the Visitor's Center runs on :4301. A support strip holds static-metadata :4331,
-            scenario-runner, Postgres :54329, and Redis :63799." />
+       alt="The five hops this tutorial makes. Your shell signs a request with the demo
+            caller's own key and sends it to Registry Mint on host port 4341; Mint returns a
+            short-lived access token; your shell presents that token to Registry Evidence on
+            host port 4343 and asks whether the subject is an adult; Evidence reads two fields
+            of one row from the Civil Registration Authority's records Relay on host port 4342
+            under the recorded purpose adult-status-verification; Evidence returns a signed
+            answer carrying true or false and no record. A strip below lists the rest of the
+            lab: six authority Relay instances on host ports 4311 to 4316, the citizen portal
+            on 4300, the Visitor's Center on 4301, static metadata on 4331, Postgres on 54329,
+            and the consultation Relay instances, workload identity agents, and journey services
+            behind them." />
 </figure>
 
-The services this tutorial calls directly:
+The endpoints this tutorial uses:
 
-| Service | Host port | Role |
+| Endpoint | Reaches | Role |
 | --- | --- | --- |
-| `portal` | `4300` | Citizen portal: a SvelteKit application wired to the citizen Notary. |
-| `home` | `4301` | Visitor's Center: the lab's public tour, including an Engineer door. |
-| `child-benefit-notary` | `4321` | Notary for the birth-to-child-benefit journey; you call its evaluation route directly. |
-| `static-metadata` | `4331` | Unauthenticated multi-authority metadata bundle. |
+| `https://127.0.0.1:4341` | `mint` | Registry Mint: issues the short-lived access token Evidence verifies. |
+| `https://127.0.0.1:4342` | `cra-records-relay` | Registry Relay over the civil register: the source Evidence reads. |
+| `https://127.0.0.1:4343` | `evidence` | Registry Evidence: answers adult status and signs the answer. |
+| `http://127.0.0.1:4300` | `portal` | Citizen portal: a SvelteKit application over the authority services. |
+| `http://127.0.0.1:4301` | `home` | Visitor's Center: the lab's public tour, including an Engineer door. |
+| `http://127.0.0.1:4331` | `static-metadata` | Unauthenticated multi-authority metadata bundle. |
+
+The three HTTPS endpoints terminate at `evidence-gateway`, a TLS proxy in front of Mint, the
+records Relay, and Evidence. Those three containers publish no host port of their own. The gateway
+presents certificates from the lab's own certificate authority, which `just generate` writes to
+`config/evidence/tls/lab-ca.crt`; every command below passes it with `--cacert`.
 
-The other six Relay instances, three Notary instances, Postgres, and Redis back the pension and
-farmer-voucher journeys and the portal's own evidence calls; this tutorial does not call them
-directly. The topology figure shows the full port map.
+The rest of the topology, which this tutorial does not call:
 
-Each instance publishes its rendered API reference at `/docs`, a route that is always public, and
-its raw `/openapi.json`, public here because every Relay and Notary configuration in this lab sets
+| Group | Count | What it is |
+| --- | --- | --- |
+| Public authority Relay instances | 6 | One per ministry authority, on host ports `4311` through `4316`. |
+| Consultation Relay instances | 6 | Private per-authority reads, on `4322`, `4323`, and `4325` through `4328`. |
+| Workload identity agents | 12 | One per Relay, issuing that Relay's short-lived caller credential. |
+| Evidence gateway service | 1 | The TLS proxy described above. |
+| Records workload agent | 1 | The caller credential for `cra-records-relay`. |
+| `registry-notary` instances and the child benefit federator | 7 | The country's own evidence gateway services, on `4321` for the federator, still running a retired product the lab has not migrated off yet. |
+| Portal, Visitor's Center, static metadata | 3 | The experience layer. |
+| Postgres and the scenario runner | 2 | Shared state on `54329`, and the service backing the portal's guided demos. |
+
+Each Relay instance publishes its rendered API reference at `/docs`, a route that is always public,
+and its raw `/openapi.json`, public here because every Relay configuration in this lab sets
 `openapi_requires_auth: false`.
 
 ## See it: the citizen portal and the Visitor's Center
 
 Open the citizen portal at [http://127.0.0.1:4300](http://127.0.0.1:4300). It is a SvelteKit
-application backed by the citizen Notary and the civil, social, and agriculture Relay instances.
-Sign in with one of the portal's fixed demo personas to see a resident's own view of the evidence
-flows this tutorial calls directly.
+application backed by the country's own registry services. Sign in with one of the portal's fixed
+demo personas to see a resident's own view of the journeys the lab tells.
 
 Open the Visitor's Center at [http://127.0.0.1:4301](http://127.0.0.1:4301). It is Solmara Lab's
 public tour, organized as three doors: visit as a citizen, as a relying agency running a guided
-story, or as an engineer. Scroll to the Engineer door section. It republishes the same four
-synthetic Notary tokens this tutorial's `.env` generates: `child-benefit-notary`, `pension-notary`,
-`nagdi-notary`, and `citizen-notary`. They appear as ready-made copy-as-curl examples, including
-the evaluation call you make by hand next.
+story, or as an engineer. Scroll to the Engineer door section for ready-made copy-as-curl examples
+against the running stack.
 
-## Call a Notary evaluation route directly
+## Ask Evidence one question
 
-The birth-to-child-benefit journey is one of the lab's guided stories. Its positive fixture is Mateo
-Santos, Solmara UIN `2300010248`: a child whose birth is registered, who is under five, whose
-household falls below the poverty threshold, and who is not already enrolled.
+A benefits desk needs to know one thing about an applicant: whether they are an adult. It does not
+need a date of birth, and the Civil Registration Authority would rather not hand one over. That is
+the question the Evidence overlay answers.
 
-Load the generated Notary token for this journey from `.env`, then evaluate the same four claims
-the birth-to-child-benefit story checks:
+Getting an access token is the first hop. Registry Mint does not accept a password or a shared key:
+the caller proves who it is by signing a short-lived assertion with its own private key, and Mint
+answers with an access token good for a few minutes. The lab's demo caller key lives in the
+generated `.env`, and one recipe does the whole exchange:
 
 ```sh
-export CHILD_BENEFIT_NOTARY_TOKEN="$(grep -m1 '^CHILD_BENEFIT_NOTARY_TOKEN=' .env | cut -d= -f2-)"
+export EVIDENCE_TOKEN="$(just evidence-token)"
 ```
 
+Now ask the question. Elena's fixture record, Solmara UIN `2300018263`, carries a date of birth in
+1992:
+
 ```sh
-curl -sS -X POST \
-  -H "x-api-key: $CHILD_BENEFIT_NOTARY_TOKEN" \
-  -H "Data-Purpose: https://id.registrystack.org/solmara/purpose/child-benefit-review" \
+curl -sS --cacert config/evidence/tls/lab-ca.crt \
+  -X POST \
+  -H "Authorization: Bearer $EVIDENCE_TOKEN" \
   -H "Content-Type: application/json" \
-  -H "Accept: application/vnd.registry-notary.claim-result+json" \
-  -d '{
-    "target": {"type": "Person", "identifiers": [{"scheme": "solmara_uin", "value": "2300010248"}]},
-    "claims": ["birth-is-registered", "child-age-under-5", "household-below-poverty-threshold", "not-already-enrolled"],
-    "disclosure": "predicate",
-    "format": "application/vnd.registry-notary.claim-result+json"
-  }' \
-  http://127.0.0.1:4321/v1/evaluations
+  -H "Accept: application/jose+json" \
+  -d "{
+    \"requestNonce\": \"$(openssl rand -base64 32 | tr '+/' '-_' | tr -d '=')\",
+    \"requirement\": \"https://id.registrystack.org/solmara/requirement/adult-status/v1\",
+    \"purpose\": \"adult-status-verification\",
+    \"subjects\": [{\"role\": \"subject\", \"selector\": {\"profile\": \"civil-record-v1\", \"values\": {\"record_reference\": \"2300018263\"}}}]
+  }" \
+  https://127.0.0.1:4343/v1/evidence
 ```
 
-The Notary returns `200 OK` with all four claims `satisfied`. The important fields look like this;
-other fields are omitted:
+The response is `200 OK` and a flattened JWS: a JSON object of `protected`, `payload`, and
+`signature`. Decode the payload and it reads like this, with the volatile identifiers and
+timestamps left as they came back:
 
 ```json
 {
-  "results": [
-    { "claim_id": "birth-is-registered", "satisfied": true, "value": true },
-    { "claim_id": "child-age-under-5", "satisfied": true, "value": true },
-    { "claim_id": "household-below-poverty-threshold", "satisfied": true, "value": true },
-    { "claim_id": "not-already-enrolled", "satisfied": true, "value": true }
+  "schema": "registry.assertion-evidence/v1",
+  "requestNonce": "7mfZrjyeJnBy3oAIPTwXgwnKFFY_KM-vg0-E9WhGMow",
+  "id": "urn:ulid:01KZ3RHVZ4N3ETVVPQZ08A11KY",
+  "type": "Evidence",
+  "supportsRequirement": "https://id.registrystack.org/solmara/requirement/adult-status/v1",
+  "isConformantTo": "https://id.registrystack.org/solmara/evidence-type/adult-status/v1",
+  "issuedBy": "https://id.registrystack.org/solmara/issuer/civil-registration-authority",
+  "providedBy": "https://id.registrystack.org/solmara/evidence/civil-registration-authority",
+  "issuedAt": "2026-08-03T12:11:08Z",
+  "observedAt": "2026-08-03T12:11:08Z",
+  "validUntil": "2026-08-04T12:11:08Z",
+  "purpose": "adult-status-verification",
+  "audience": "https://id.registrystack.org/solmara/party/benefits-desk",
+  "configurationRevision": "sha256:c067a9c3e0167a5f2ef601ef1defc4fd873ccb7dd61fbfd4c1f15f88073fd744",
+  "subjects": [
+    {
+      "role": "subject",
+      "binding": "urn:evidence:subject:v1_1tZ8Tpn1A5A36GCa5Q8D1ZC76ms-INzA7yvAnj9UWMw"
+    }
+  ],
+  "supportedValues": [
+    {
+      "providesValueFor": "https://id.registrystack.org/solmara/concept/adult-status",
+      "value": true
+    }
   ]
 }
 ```
 
-The `x-api-key` header carries the caller's credential. `Data-Purpose` declares why the caller is
-asking, and the Notary's configuration allows this token to ask only under the
-`child-benefit-review` purpose. The `disclosure: predicate` request means the response discloses a
-true or false satisfaction per claim, never the underlying civil, population, social, or programme
-registry rows Relay consulted to answer it. The Notary can also issue a signed
-[SD-JWT verifiable credential (SD-JWT VC)](../../reference/glossary/) for this same eligibility
-claim set; that holder-bound issuance flow is out of scope for this tutorial. See
-[Registry Notary](../../products/registry-notary/) for the credential issuance contract.
+Read what is not in it. The UIN you sent is gone, replaced by an opaque `binding` that identifies
+the subject within this assertion and nowhere else. The date of birth Relay disclosed to Evidence
+is gone. What travels is one boolean against one named concept, plus enough provenance to check it
+later: who issued it, under which purpose, for which audience, against which configuration
+revision, and how long it stays valid. That is the whole product in one response.
+
+Repeat the call with `2300010248`, a fixture child born in 2022, and `value` comes back `false`
+with the same shape. Repeat it with `9900000001`, which no record resolves, and Evidence answers
+`422` with the problem code `evidence_not_available`: one refusal for every reason a subject cannot
+be resolved, so a caller cannot use the refusal to probe who exists.
 
 ## Verify
 
-`just smoke` (step 3) is the authoritative check. These commands confirm its artifacts are on
-disk, and reproduce the call from
-[Call a Notary evaluation route directly](#call-a-notary-evaluation-route-directly) in a single
-command so it can run without a shell variable.
+`just smoke` and `just smoke-evidence` (steps 3 and 4) are the authoritative checks. These commands
+confirm the country smoke's artifacts are on disk, and reproduce the call from
+[Ask Evidence one question](#ask-evidence-one-question) in a single command that also asserts what
+the assertion does not carry.
 
 ```sh
 ls output/smoke/story-previews.json
@@ -223,49 +285,61 @@ ls output/smoke/portal-compose.json
 ```
 
 ```sh
-curl -sS -X POST -H "x-api-key: $(grep -m1 '^CHILD_BENEFIT_NOTARY_TOKEN=' .env | cut -d= -f2-)" -H "Data-Purpose: https://id.registrystack.org/solmara/purpose/child-benefit-review" -H "Content-Type: application/json" -H "Accept: application/vnd.registry-notary.claim-result+json" -d '{"target":{"type":"Person","identifiers":[{"scheme":"solmara_uin","value":"2300010248"}]},"claims":["birth-is-registered","child-age-under-5","household-below-poverty-threshold","not-already-enrolled"],"disclosure":"predicate","format":"application/vnd.registry-notary.claim-result+json"}' http://127.0.0.1:4321/v1/evaluations | python3 -c "import json, sys; data = json.load(sys.stdin); got = {r['claim_id']: r['satisfied'] for r in data['results']}; expected = ['birth-is-registered', 'child-age-under-5', 'household-below-poverty-threshold', 'not-already-enrolled']; raise SystemExit(0 if len(data['results']) == 4 and all(got.get(c) is True for c in expected) else 1)"
+curl -sS --cacert config/evidence/tls/lab-ca.crt -X POST -H "Authorization: Bearer $(just evidence-token)" -H "Content-Type: application/json" -H "Accept: application/jose+json" -d "{\"requestNonce\":\"$(openssl rand -base64 32 | tr '+/' '-_' | tr -d '=')\",\"requirement\":\"https://id.registrystack.org/solmara/requirement/adult-status/v1\",\"purpose\":\"adult-status-verification\",\"subjects\":[{\"role\":\"subject\",\"selector\":{\"profile\":\"civil-record-v1\",\"values\":{\"record_reference\":\"2300018263\"}}}]}" https://127.0.0.1:4343/v1/evidence | python3 -c "import base64, json, sys; envelope = json.load(sys.stdin); payload = json.loads(base64.urlsafe_b64decode(envelope['payload'] + '=' * (-len(envelope['payload']) % 4))); text = json.dumps(payload); raise SystemExit(0 if payload['supportedValues'][0]['value'] is True and '2300018263' not in text and '1992-11-02' not in text else 1)"
 ```
 
+The last command exits `0` only if the answer is `true` and neither the reference you sent nor the
+date of birth behind it appears anywhere in the signed payload.
+
 ## What you built
 
-You brought up 16 Relay, Notary, portal, and supporting services on your laptop from a single
-`just up`, and the smoke suite verified the topology. You then called the child benefit Notary
-directly and watched it return four satisfied predicates for Mateo Santos without exposing the
-civil, population, social, or programme registry rows Relay consulted to answer. The same
-synthetic token and evaluation call are also visible through the Visitor's Center's Engineer door,
-so you can confirm what you ran by hand against what the lab publishes.
+You brought up 41 services on your laptop from a single `just up-evidence`, and two smoke suites
+verified them. You then held a short-lived access token from Registry Mint, asked Registry Evidence
+one question about one person, and got a signed boolean back. Behind that boolean, Evidence read
+two fields of one row from a Registry Relay deployment under a recorded purpose, and disclosed
+neither to you. The Civil Registration Authority answered the question without handing over the
+record, which is the point of the whole arrangement.
 
 ## Next
 
+- [Evidence quickstart](../../start/evidence-quickstart/): review the current Evidence authoring,
+  operation, and verification material.
+- [Registry Evidence](../../products/registry-evidence/): the assertion contract, the acceptance
+  definition model, and the operator contract.
 - [Build and run an HTTP registry project](../author-registry-project/): create the maintained
-  local project and verify Relay and Notary outcomes.
-- [When to use Registry Stack](../../start/when-to-use/): decide whether Relay, Notary, or both fit
-  your integration.
+  local project and verify its outcomes.
 - [Registry Relay](../../products/registry-relay/): route reference, auth scopes, and configuration
   guide.
-- [Registry Notary](../../products/registry-notary/): claim configuration, disclosure modes, and
-  credential issuance.
 
 ## Troubleshooting
 
 | Symptom | Cause | Resolution |
 | --- | --- | --- |
-| `just up` fails immediately with `required variable ... is missing a value: .env not loaded; run just gen-secrets once, then just up` | `just generate` (or `just gen-secrets`) never ran, so `.env` does not exist. | Run `just generate`, then `just up` again. |
-| `docker compose` reports a port already allocated | Another process on your machine already holds one of the lab's ports: `4300`, `4301`, `4311` through `4316`, `4321` through `4324`, `4331`, `54329`, or `63799`. | Stop the conflicting process, or set the matching `SOLMARA_*_PORT` environment variable (for example `SOLMARA_PORTAL_PORT=4400`) before `just up`. |
+| `just up-evidence` fails immediately with `required variable ... is missing a value: .env not loaded; run just gen-secrets once, then just up` | `just generate` (or `just gen-secrets`) never ran, so `.env` does not exist. | Run `just generate`, then `just up-evidence` again. |
+| `just up-evidence` fails with `No Registry Stack release ships Registry Evidence or Registry Mint yet` | `REGISTRY_STACK_SOURCE_DIR` is unset. | Export it with the path to your Registry Stack checkout, then run `just up-evidence` again. |
+| `just up-evidence` fails with `Registry Stack source checkout must be clean` | The named checkout has uncommitted changes, so the built image could not be labelled with a real commit. | Commit or stash the changes, or point `REGISTRY_STACK_SOURCE_DIR` at a separate clean checkout or `git worktree`. |
+| `just up-evidence` fails with `service "registry-postgresql-bootstrap" didn't complete successfully: exit 2` | You ran `just generate` a second time. It rotates every local credential, including the Postgres password, and the data volume from your earlier run still holds the old one. | Run `just reset-evidence` to drop this checkout's volumes, then `just generate` and `just up-evidence` again. |
+| `docker compose` reports a port already allocated | Another process holds one of the lab's ports: `4300`, `4301`, `4311` through `4316`, `4321` through `4323`, `4325` through `4328`, `4331`, `4341` through `4343`, or `54329`. | Stop the conflicting process, or set the matching `SOLMARA_*_PORT` environment variable (for example `SOLMARA_PORTAL_PORT=4400`) before `just up-evidence`. |
+| `curl` reports a certificate problem against `4341`, `4342`, or `4343` | The lab's certificate authority was not passed, or `just generate` never wrote it. | Pass `--cacert config/evidence/tls/lab-ca.crt`, and run `just generate` if that file is missing. |
+| `just evidence-token` reports `missing SOLMARA_EVIDENCE_CALLER_JWK` | `.env` predates the Evidence overlay, so it has no caller key. | Run `just gen-secrets`, then `just up-evidence` again so Mint picks up the new registration. |
 | `command not found: uv` or `command not found: pnpm` | A required tool is not on your PATH. | Install [`uv`](https://docs.astral.sh/uv/), or run `corepack enable` for `pnpm`, then run `just setup` again. |
 | `docker compose ps -a` lists lab containers you did not start | The lab derives a per-checkout Compose project name (`solmara-lab-` plus a hash of the checkout path), so two checkouts never share a project. Leftover containers come from a lab version that used the shared project name `solmara-lab`. | Inspect the old project with `docker compose -p solmara-lab ps`, then remove it with `docker compose -p solmara-lab down` (add `-v` only if you also want its volumes deleted). |
-| The Relay and Notary containers start slowly or show high CPU on Apple Silicon | The pinned Relay and Notary images publish `linux/amd64` only, so Compose runs them under emulation. | Expected. Allow extra time on the first `just up`; later runs are faster once the images are cached. |
-| The first `just up` appears to hang | The first run pulls the pinned Relay and Notary images and builds the `portal`, `home`, and `scenario-runner` images locally. | Let it finish; do not interrupt it. |
+| The Relay and `registry-notary` containers start slowly or show high CPU on Apple Silicon | Both pinned images publish `linux/amd64` only, so Compose runs them under emulation. | Expected. Allow extra time on the first `just up-evidence`; later runs are faster once the images are cached. |
+| The first `just up-evidence` appears to hang | The first run compiles Evidence and Mint from source, pulls the pinned images, and builds the local application images. | Let it finish; do not interrupt it. |
 
 ## Cleanup
 
 Stop the containers:
 
 ```sh
-just down
+just down-evidence
 ```
 
-`just down` runs `docker compose ... down`, keeping the Postgres data volume and the Relay and
-Notary state volumes, so a later `just up` resumes with the same data. To also remove the
-volumes, run `just reset` instead; that is the lab's documented clean slate: rerun
-`just generate` and `just up` for a fresh topology.
+`just down-evidence` runs `docker compose ... down`, keeping the Postgres data volume, the Relay
+and `registry-notary` state volumes, and the Evidence and Mint secret volumes, so a later `just up-evidence`
+resumes with the same data. Do not rerun `just generate` before that: it rotates the Postgres
+password, and the kept volume still holds the old one.
+
+To also remove the volumes, run `just reset-evidence` instead; that is the lab's documented clean
+slate, and the one starting point from which rerunning the whole tutorial works: `just generate`,
+then `just up-evidence`, for a fresh topology.
diff --git a/docs/site/src/content/docs/tutorials/integrate-evidence-candidate-with-docker-compose.mdx b/docs/site/src/content/docs/tutorials/integrate-evidence-candidate-with-docker-compose.mdx
new file mode 100644
index 000000000..876f2de69
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/integrate-evidence-candidate-with-docker-compose.mdx
@@ -0,0 +1,119 @@
+---
+title: Integrate an Evidence candidate with Docker Compose
+description: Mount an approved Evidence candidate unchanged in an operator-owned Docker Compose application with separate runtime, secrets, and audit storage.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: how-to
+persona:
+  - operator
+locale: en
+standards_referenced: []
+---
+
+import QuickstartMeta from '../../../components/QuickstartMeta.astro';
+
+Start with the approved candidate created in
+[Build and deploy an Evidence project](../build-and-deploy-evidence-project/). This guide runs that
+candidate in an existing Docker Compose application. Compose is an operator-owned deployment
+adapter, not output from `evidencectl build`. The candidate bundle stays unchanged across host and
+container deployments.
+
+<QuickstartMeta
+  outcome="An approved Evidence candidate mounted unchanged with a separate runtime, secret root, and persistent audit volume."
+  time="About 20 minutes after the image and candidate are approved"
+  level="Operator-owned Docker Compose deployment"
+  prerequisites={['Docker Compose', 'An approved Evidence candidate', 'A reviewed Evidence image', 'Persistent storage prepared for UID and GID 65532']}
+/>
+
+## Before you start
+
+You need an approved candidate, a container image whose provenance and digest you have reviewed,
+an owner-only secret mount, and persistent storage for the audit chain. Do not use repository
+development images as released production artifacts.
+
+Prepare a container-specific runtime document. It names the same bundle content but container paths,
+a private Compose-network listener, secret root, audit path, and any required private CA files.
+
+## Mount the deployment inputs
+
+The Compose service mounts four independently owned paths:
+
+```text
+candidate/bundle       -> /etc/registry-evidence/bundle       read-only
+runtime.docker.yaml    -> /etc/registry-evidence/runtime.yaml read-only
+Evidence secret root   -> /run/secrets/registry-evidence      read-only
+Evidence audit volume  -> /var/lib/registry-evidence          writable
+```
+
+Keep the bundle and runtime read-only. A read-only mount establishes their immutability, but does
+not waive secret ownership or mode validation. The maintained Evidence image runs as UID and GID
+`65532`; pin that identity in the Compose file and make every secret file acceptable to it with the
+required owner-only permissions. A different reviewed image requires an explicitly reviewed UID
+and matching ownership.
+Prepare the persistent audit volume for that same identity before startup. Do not run Evidence as
+root to compensate for an audit volume with the wrong owner.
+
+```yaml
+services:
+  evidence:
+    image: <reviewed-evidence-image-by-digest>
+    user: "65532:65532"
+    read_only: true
+    volumes:
+      - <candidate>/bundle:/etc/registry-evidence/bundle:ro
+      - ./runtime.docker.yaml:/etc/registry-evidence/runtime.yaml:ro
+      - <evidence-secret-root>:/run/secrets/registry-evidence:ro
+      - evidence-audit:/var/lib/registry-evidence
+```
+
+Bind Evidence to a private Compose-network address. Put TLS termination and public routing in an
+operator-controlled service ahead of that listener.
+
+## Validate in the container context
+
+Run `evidence check` in the target execution context after mounts, ownership, paths, and trust
+files are in place:
+
+```sh
+docker compose run --rm evidence \
+  --runtime /etc/registry-evidence/runtime.yaml check
+```
+
+Changing only the container runtime does not change the governed bundle, so it does not require the
+fixture suite to run again. Run fixtures again when the bundle changes.
+
+The check exits successfully only when the container can read its immutable inputs, resolve the
+secret root, validate the configured audit path, and validate the runtime and bundle together. It
+does not append an audit event.
+
+## Keep revisions distinct
+
+The bundle revision covers exact bundle bytes and remains the same in host and Compose deployments.
+The runtime revision covers exact runtime bytes and bound private CA files, so it changes with
+container paths, listener bindings, or trust files. Signed assertions carry the bundle revision as
+`configurationRevision`, never the runtime revision. Neither revision contains secret values or
+audit contents.
+
+## Add optional Mint
+
+When the same application uses Mint, run Mint as a separate private service. Mint retains its public
+HTTPS issuer and JWKS URI, while internal routing or split DNS resolves that identity. Evidence must
+continue to use the public HTTPS issuer and JWKS URI, not an internal plain-HTTP service name.
+
+## Stop without deleting the audit history
+
+Stop the Compose services without removing the audit volume. Retention and audit-chain verification
+remain operator responsibilities.
+
+```sh
+docker compose down
+```
+
+## Next
+
+- [Build and deploy an Evidence project](../build-and-deploy-evidence-project/)
+- [Issue Evidence access tokens with Registry Mint](../issue-evidence-access-tokens-with-registry-mint/)
+- [Configure Evidence](../../configure/evidence/)
diff --git a/docs/site/src/content/docs/tutorials/issue-a-birth-certificate-vc-from-opencrvs.mdx b/docs/site/src/content/docs/tutorials/issue-a-birth-certificate-vc-from-opencrvs.mdx
new file mode 100644
index 000000000..510039846
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/issue-a-birth-certificate-vc-from-opencrvs.mdx
@@ -0,0 +1,510 @@
+---
+title: Request a birth certificate SD-JWT VC from OpenCRVS
+description: >-
+  Map a synthetic OpenCRVS birth into a governed structured value, request it as SD-JWT VC, and
+  verify the credential across the Evidence HTTP boundary.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: tutorial
+persona:
+  - assertion provider
+locale: en
+standards_referenced: []
+---
+
+import QuickstartMeta from '../../../components/QuickstartMeta.astro';
+
+Extend the project created in
+[Issue registered-parent evidence from OpenCRVS](../verify-a-registered-parent-with-opencrvs/)
+with a birth-record question and request the answer as a Selective Disclosure JWT Verifiable
+Credential (SD-JWT VC). The credential exposes `givenName`, `familyName`, `dateOfBirth`, and
+`placeOfBirth` as four independently disclosable fields.
+
+<QuickstartMeta
+  outcome="A verified SD-JWT VC containing a governed birth-record extract from synthetic data."
+  time="About 25 minutes"
+  level="Institution source with synthetic data"
+  prerequisites={[
+    'The completed OpenCRVS registered-parent tutorial project',
+    'A Record Search client for the public OpenCRVS demo',
+    'The Evidence toolset',
+    'curl and an editor',
+  ]}
+/>
+
+This tutorial uses the provider-published synthetic Josh Hoeger registration, selected by national
+ID `3617402568`. Do not substitute a real person. The demo maintainers can reset its data,
+accounts, and integrations.
+
+## Understand the credential boundary
+
+The example is informed by the European Union Once-Only Technical System
+[birth-evidence sample](https://code.europa.eu/oots/tdd/tdd_chapters/-/raw/master/OOTS-EDM/xml/Request-Response%20Samples/4.5.4%20-%20OOTS-EDM%20XML%20Examples%20of%20the%20Evidence%20Exchange/2%20Example%20for%20requesting%20a%20Birth%20Certificate%20-%20natural%20person/Evidence%20Samples/BirthEvidence.xml?ref_type=heads),
+but this tutorial does not implement that exchange protocol.
+Evidence produces a governed extract from a registered birth:
+
+```json
+{
+  "birthCertificate": {
+    "givenName": "...",
+    "familyName": "...",
+    "dateOfBirth": "...",
+    "placeOfBirth": {
+      "locationId": "..."
+    }
+  }
+}
+```
+
+The deployment's law and governance determine whether that extract is accepted as a birth
+certificate. Evidence proves which provider signed the configured assertion. It does not grant
+legal status to the document.
+
+Each direct child of `birthCertificate` has its own SD-JWT disclosure. `placeOfBirth` is one atomic
+nested value, so its `locationId` is not disclosed separately from its container.
+
+This response is a second serialization of one stateless assertion, not a credential lifecycle.
+There is no issuance session, status list, revocation, or presentation exchange.
+
+## Draft a birth-record source
+
+Continue in the `registered-parent` directory created by
+[Issue registered-parent evidence from OpenCRVS](../verify-a-registered-parent-with-opencrvs/).
+The retained `source.openapi.yaml` includes the bounded birth fields used in this tutorial.
+
+Draft a separate source so the certificate question cannot inherit the parent-identifier
+projection:
+
+```sh
+evidencectl source suggest \
+  --project . \
+  --source-id opencrvs-birth-certificate \
+  --operation 'POST /events/search' \
+  --select /total \
+  --select '/results/*/type' \
+  --select '/results/*/status' \
+  --select '/results/*/dateOfEvent' \
+  --select '/results/*/placeOfEvent' \
+  --select '/results/*/declaration/child.nid' \
+  --select '/results/*/declaration/child.name/firstname' \
+  --select '/results/*/declaration/child.name/surname' \
+  --select '/results/*/declaration/child.birthLocationId'
+```
+
+The command writes editable source artifacts. The selected operation remains a draft until you
+close the OpenCRVS-specific request and extraction decisions.
+
+## Configure the fixed search
+
+Replace `sources/opencrvs-birth-certificate.yaml` with:
+
+```yaml
+transport: http-json
+baseUrl: https://events.farajaland-integration.opencrvs.dev
+posture: record-transformed
+authentication:
+  kind: oauth2-client-credentials
+  tokenEndpoint: https://auth.farajaland-integration.opencrvs.dev/token
+  clientIdRef: secret:file/opencrvs-client-id
+  clientSecretRef: secret:file/opencrvs-client-secret
+  scope: recordsearch
+  credentialPlacement: form-body
+  maximumCacheSeconds: 300
+  assumedLifetimeSeconds: 600
+request:
+  method: POST
+  path: /events/search
+  fixedHeaders:
+    - name: Accept
+      value: application/json
+  selectorInputs:
+    - role: child
+      alternatives:
+        - profile: opencrvs-national-id-v1
+          fields: [national_id]
+  prepareScript: adapters/opencrvs-birth-certificate-prepare.rhai
+  adapterParameters:
+    childSelectorRole: child
+    eventType: birth
+    registeredStatus: REGISTERED
+    childNationalIdField: child.nid
+    childNameField: child.name
+    childBirthLocationField: child.birthLocationId
+    resultLimit: 2
+    resultOffset: 0
+  adapterParametersSchema: schemas/opencrvs-birth-certificate-parameters.schema.yaml
+  preparationLimits:
+    query: forbidden
+    jsonBody: required
+    maximumJsonDepth: 12
+    maximumCollectionItems: 32
+    maximumStringBytes: 512
+    maximumNormalizedBytes: 8192
+  projection:
+    - /total
+    - /results/*/type
+    - /results/*/status
+    - /results/*/dateOfEvent
+    - /results/*/placeOfEvent
+    - /results/*/declaration/child.nid
+    - /results/*/declaration/child.name/firstname
+    - /results/*/declaration/child.name/surname
+    - /results/*/declaration/child.birthLocationId
+  redirects: deny
+  timeoutMilliseconds: 10000
+  maximumResponseBytes: 262144
+  concurrencyLimit: 8
+responseSchema: schemas/opencrvs-birth-certificate-response.schema.yaml
+extractScript: adapters/opencrvs-birth-certificate-extract.rhai
+factSchema: schemas/opencrvs-birth-certificate-facts.schema.yaml
+```
+
+The source can search only for one registered birth by the authorized child selector. The caller
+cannot change the event type, status, response projection, or result ceiling. It reuses the
+owner-only Record Search credentials from the registered-parent tutorial.
+
+Replace `schemas/opencrvs-birth-certificate-parameters.schema.yaml` with:
+
+```yaml
+type: object
+additionalProperties: false
+required:
+  - childSelectorRole
+  - eventType
+  - registeredStatus
+  - childNationalIdField
+  - childNameField
+  - childBirthLocationField
+  - resultLimit
+  - resultOffset
+properties:
+  childSelectorRole: {const: child}
+  eventType: {const: birth}
+  registeredStatus: {const: REGISTERED}
+  childNationalIdField: {const: child.nid}
+  childNameField: {const: child.name}
+  childBirthLocationField: {const: child.birthLocationId}
+  resultLimit: {const: 2}
+  resultOffset: {const: 0}
+```
+
+Replace `adapters/opencrvs-birth-certificate-prepare.rhai` with:
+
+```rhai
+fn prepare(selectors, parameters) {
+    let child = selectors[parameters["childSelectorRole"]];
+    let data = #{};
+    data[parameters["childNationalIdField"]] = #{
+        type: "exact",
+        term: child["values"]["national_id"]
+    };
+
+    #{
+        query: [],
+        body: #{
+            query: #{
+                type: "and",
+                clauses: [#{
+                    eventType: parameters["eventType"],
+                    status: #{
+                        type: "exact",
+                        term: parameters["registeredStatus"]
+                    },
+                    data: data
+                }]
+            },
+            limit: parameters["resultLimit"],
+            offset: parameters["resultOffset"]
+        }
+    }
+}
+```
+
+## Extract the birth facts
+
+Replace `adapters/opencrvs-birth-certificate-extract.rhai` with:
+
+```rhai
+fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    let results = source_response["results"];
+    if results.len > parameters["resultLimit"] {
+        throw("source_protocol_error");
+    }
+
+    if total == 0 {
+        if results.len != 0 { throw("source_protocol_error"); }
+        return #{outcome: "no_match"};
+    }
+    if total > 1 {
+        if results.len < 2 { throw("source_protocol_error"); }
+        return #{outcome: "ambiguous"};
+    }
+    if results.len != 1 { throw("source_protocol_error"); }
+
+    let result = results[0];
+    if result["type"] != parameters["eventType"] ||
+       result["status"] != parameters["registeredStatus"] ||
+       !result.contains("declaration") {
+        throw("source_protocol_error");
+    }
+
+    let declaration = result["declaration"];
+    let child_id_field = parameters["childNationalIdField"];
+    let child_name_field = parameters["childNameField"];
+    let birth_location_field = parameters["childBirthLocationField"];
+    if !declaration.contains(child_id_field) ||
+       !declaration.contains(child_name_field) ||
+       !declaration.contains(birth_location_field) ||
+       result["placeOfEvent"] != declaration[birth_location_field] {
+        throw("source_protocol_error");
+    }
+
+    let child_name = declaration[child_name_field];
+    #{
+        outcome: "match",
+        facts: #{
+            child_national_id: declaration[child_id_field],
+            given_name: child_name["firstname"],
+            family_name: child_name["surname"],
+            date_of_birth: result["dateOfEvent"],
+            place_of_birth_id: result["placeOfEvent"]
+        }
+    }
+}
+```
+
+The extraction accepts exactly one registered birth. It also requires the top-level event place
+to match the declaration's birth-location identifier before constructing facts.
+
+Replace `schemas/opencrvs-birth-certificate-facts.schema.yaml` with:
+
+```yaml
+type: object
+additionalProperties: false
+required:
+  - child_national_id
+  - given_name
+  - family_name
+  - date_of_birth
+  - place_of_birth_id
+properties:
+  child_national_id: {type: string, minLength: 1, maxLength: 128}
+  given_name: {type: string, minLength: 1, maxLength: 200}
+  family_name: {type: string, minLength: 1, maxLength: 200}
+  date_of_birth: {type: string, format: date}
+  place_of_birth_id: {type: string, minLength: 1, maxLength: 128}
+```
+
+## Define the governed certificate shape
+
+Create `schemas/birth-certificate.yaml`:
+
+```yaml
+$id: urn:registrystack:evidence:local:schema:birth-certificate:v1
+type: object
+additionalProperties: false
+required: [givenName, familyName, dateOfBirth, placeOfBirth]
+properties:
+  givenName:
+    type: string
+    minLength: 1
+    maxLength: 200
+  familyName:
+    type: string
+    minLength: 1
+    maxLength: 200
+  dateOfBirth:
+    type: string
+    format: date
+  placeOfBirth:
+    type: object
+    additionalProperties: false
+    required: [locationId]
+    properties:
+      locationId:
+        type: string
+        minLength: 1
+        maxLength: 128
+```
+
+The schema closes every returned field. The location is an OpenCRVS identifier because the public
+search response does not provide a reviewed human-readable place label.
+
+Create `questions/birth-certificate.yaml`:
+
+```yaml
+id: birth-certificate
+question: What birth details are recorded for this person?
+purpose: civil-registration-extract
+subject:
+  role: child
+  selector: national_id
+  profile: opencrvs-national-id-v1
+  derivation: true
+source:
+  ref: opencrvs-birth-certificate
+answers:
+  - concept: birth_certificate
+    type: reviewed-structured-value
+    schema: schemas/birth-certificate.yaml
+    maximumSerializedBytes: 2048
+    sdJwtVc:
+      claim: birthCertificate
+      disclosure: top-level
+derivation: derivations/birth-certificate.rhai
+disclosure:
+  allow: [birth_certificate]
+```
+
+`birthCertificate` is a configured JSON claim name. Evidence has no built-in birth-certificate
+type. The same mechanism can project any reviewed structured value under another non-reserved
+claim name.
+
+Create `derivations/birth-certificate.rhai`:
+
+```rhai
+fn answer(facts, selectors, context) {
+    if facts.child_national_id != selectors.child.values.national_id {
+        throw("derivation_input_error");
+    }
+
+    #{
+        birth_certificate: #{
+            form: "reviewed-structured-value",
+            schema: "urn:registrystack:evidence:local:schema:birth-certificate:v1",
+            fields: #{
+                givenName: facts.given_name,
+                familyName: facts.family_name,
+                dateOfBirth: facts.date_of_birth,
+                placeOfBirth: #{locationId: facts.place_of_birth_id}
+            }
+        }
+    }
+}
+```
+
+Evidence validates the complete value against the schema before mapping any field to an SD-JWT
+disclosure. A derivation cannot add undeclared certificate fields.
+
+## Start and prepare the SD-JWT request
+
+Compile and start the updated local project:
+
+```sh
+evidencectl dev --detach
+```
+
+Prepare the request and retain `sd-jwt-vc` as the expected response format before the source is
+called:
+
+```sh
+evidencectl request prepare birth-certificate \
+  --purpose civil-registration-extract \
+  --subject child:national_id=3617402568 \
+  --format sd-jwt-vc \
+  --name opencrvs-birth-certificate
+```
+
+Preparation obtains local authorization and records the expected issuer, audience, subject
+binding, requirement, value form, request nonce, and response format. It does not contact
+OpenCRVS.
+
+## Request the credential over HTTP
+
+Send the retained request across the real Evidence boundary:
+
+```sh
+curl -fsS \
+  --config .evidence/requests/opencrvs-birth-certificate/authorization.curl \
+  --request POST \
+  --url http://127.0.0.1:8080/v1/evidence \
+  --header 'Content-Type: application/json' \
+  --header 'Accept: application/dc+sd-jwt' \
+  --data-binary @.evidence/requests/opencrvs-birth-certificate/request.json \
+  --output opencrvs-birth-certificate.sd-jwt
+```
+
+Evidence authenticates the caller, authorizes the exact question and purpose, obtains an OpenCRVS
+token, performs the fixed birth search, validates and derives the value, signs the SD-JWT VC, and
+durably records the disclosure release before returning the bytes.
+
+## Verify before reading
+
+Verify the credential against the pre-response context:
+
+```sh
+evidencectl verify opencrvs-birth-certificate.sd-jwt \
+  --context .evidence/requests/opencrvs-birth-certificate/verification.json \
+  --output opencrvs-birth-certificate.verified.json
+```
+
+```text
+VERIFIED
+```
+
+Inspect the verified Evidence payload:
+
+```sh
+python3 -m json.tool opencrvs-birth-certificate.verified.json
+```
+
+The supported value retains the governed Evidence form:
+
+```json
+{
+  "providesValueFor": "urn:registrystack:evidence:local:concept:birth-certificate:birth_certificate",
+  "value": {
+    "form": "reviewed-structured-value",
+    "schema": "urn:registrystack:evidence:local:schema:birth-certificate:v1",
+    "fields": {
+      "givenName": "Josh",
+      "familyName": "Hoeger",
+      "dateOfBirth": "<synthetic-date>",
+      "placeOfBirth": {
+        "locationId": "<synthetic-location-id>"
+      }
+    }
+  }
+}
+```
+
+The signed credential carries an always-visible `birthCertificate` container and four nested
+disclosures. Count the disclosure segments in the verified credential:
+
+```sh
+awk -F '~' '{print "disclosures:", NF - 2}' opencrvs-birth-certificate.sd-jwt
+```
+
+```text
+disclosures: 4
+```
+
+Evidence's V1 verifier checks the complete stored SD-JWT VC response. Wallet presentation, omission of
+selected disclosures, and key-binding JWT validation remain outside this profile.
+
+## Inspect the audit and clean up
+
+Stop the services, verify the last operation, and remove the sealed local generation:
+
+```sh
+evidencectl dev stop
+evidencectl audit show --last-operation
+evidencectl dev clean
+```
+
+The audit records the authorized requirement, purpose, requester pseudonym, decision, response
+format, and disclosed concept. It does not record the child selector, OpenCRVS token, source
+response, or certificate fields.
+
+Delete the Record Search client in OpenCRVS when you finish. Remove its two credential files when
+you no longer need the project.
+
+## Next
+
+- [Request another Evidence assertion as SD-JWT VC](../request-evidence-as-sd-jwt-vc/)
+- [Prove an Evidence project](../prove-an-evidence-project/)
+- [Verify an assertion as a consumer](../verify-an-assertion-as-a-consumer/)
diff --git a/docs/site/src/content/docs/tutorials/issue-evidence-access-tokens-with-registry-mint.mdx b/docs/site/src/content/docs/tutorials/issue-evidence-access-tokens-with-registry-mint.mdx
new file mode 100644
index 000000000..75681c21e
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/issue-evidence-access-tokens-with-registry-mint.mdx
@@ -0,0 +1,126 @@
+---
+title: Issue Evidence access tokens with Registry Mint
+description: Configure Registry Mint as an optional OIDC issuer for a completed Evidence candidate when the deployment has no suitable identity provider.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: tutorial
+persona:
+  - operator
+  - assertion provider
+locale: en
+standards_referenced: []
+---
+
+import QuickstartMeta from '../../../components/QuickstartMeta.astro';
+
+Start with the completed candidate from
+[Build and deploy an Evidence project](../build-and-deploy-evidence-project/). Use Registry Mint
+when that deployment has no suitable OpenID Connect (OIDC) issuer for Evidence. Mint is a separate
+supporting service. Evidence does not require Mint, and an external HTTPS OIDC issuer follows the
+same Evidence authentication contract.
+
+<QuickstartMeta
+  outcome="A separately checked Mint issuer and one registered-client token accepted by the completed Evidence candidate."
+  time="About 30 minutes after the Evidence candidate and client registration are reviewed"
+  level="Production token issuance with a synthetic deployment client"
+  prerequisites={['Released mint and evidencectl binaries', 'A completed Evidence candidate', 'A registered machine client and owner-only private JWK', 'Operator-controlled HTTPS routing']}
+/>
+
+## Before you start
+
+You need a completed Evidence candidate, a public HTTPS issuer name for Mint, a registered machine
+caller, and released `mint` and `evidencectl` binaries. Mint serves one active process in Version 1.
+Its client-assertion replay cache is memory-only and clears when the process restarts. Do not make a
+high-availability or durable replay-protection claim for this deployment shape.
+
+Generate Mint's signing key independently from Evidence's signing key. Keep it owner-only outside
+the Evidence candidate.
+
+## Author Mint separately
+
+Create a Mint directory beside, not inside, the Evidence candidate:
+
+```text
+mint/
+  mint.yaml
+  clients/
+    <client>.yaml
+  secrets/
+    <mint-signing-private-jwk>
+```
+
+Set Mint's `issuer` to its public HTTPS identity. Configure its listener on a private address and
+let operator-controlled routing or split DNS resolve the public HTTPS issuer inside the private
+network. Do not replace Evidence's issuer or JWKS URI with an internal plain-HTTP service name.
+
+Register each client with its public JWK, reviewed principal, requester tags, Evidence audience,
+and optional grant. Mint writes authority from this registration, never from the client's request.
+
+## Check the two configurations
+
+Validate Mint without opening a listener:
+
+```sh
+mint check --config "<mint-directory>/mint.yaml"
+```
+
+Then compare the completed Evidence candidate with Mint. This check is read-only and does not copy
+or modify either project:
+
+```sh
+evidencectl doctor \
+  --project "<candidate>" \
+  --mint-config "<mint-directory>/mint.yaml"
+```
+
+The paired check compares issuer, JWKS URI, audiences, admitted algorithm and token type, plus the
+principal, requester-tags, Evidence-audience, grant-id, grant-authority, and optional actor claim
+names. It does not decide whether a client has legal authority, create an authority profile, or
+register a client.
+
+## Start Mint and obtain a token
+
+Start Mint behind operator-controlled TLS, keeping the Mint listener private:
+
+```sh
+mint serve --config "<mint-directory>/mint.yaml"
+```
+
+Use a registered caller's own private JWK to request one access token over the public HTTPS
+identity. The token is written to standard output only. Store it in an owner-only local file for
+the next request, never in the candidate, a fixture, a log, or a command argument.
+
+```sh
+umask 077
+mint token \
+  --url "https://<mint-public-host>/token" \
+  --client-id "<registered-client-id>" \
+  --key "<owner-only-client-private-jwk>" > "<owner-only-token-file>"
+```
+
+Send the token to Evidence through its real HTTPS boundary using the owner-only Curl configuration
+described in [Build and deploy an Evidence project](../build-and-deploy-evidence-project/).
+That request proves the selected client-to-grant path. The paired doctor check does not.
+
+## Expected result
+
+Mint accepts the reviewed client assertion and Evidence accepts the resulting `at+jwt` access token
+over its HTTPS boundary. Retain the Evidence response and audit verification result, not the token.
+
+## Clean up the token file
+
+Remove the temporary token file after the synthetic deployment request. Do not retain it in a
+candidate, fixture, audit record, or shell history.
+
+```sh
+rm -f "<owner-only-token-file>"
+```
+
+## Next
+
+- [Build and deploy an Evidence project](../build-and-deploy-evidence-project/)
+- [Configure Registry Mint](../../configure/mint/)
+- [Registry Mint reference](../../reference/mint/)
diff --git a/docs/site/src/content/docs/tutorials/issue-immunization-evidence-from-dhis2.mdx b/docs/site/src/content/docs/tutorials/issue-immunization-evidence-from-dhis2.mdx
new file mode 100644
index 000000000..994cbcb74
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/issue-immunization-evidence-from-dhis2.mdx
@@ -0,0 +1,664 @@
+---
+title: Issue an immunization summary from DHIS2
+description: Author and verify a signed, multi-concept immunization summary from synthetic DHIS2 Tracker events.
+status: draft
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: tutorial
+persona:
+  - assertion provider
+locale: en
+standards_referenced: []
+---
+
+import QuickstartMeta from '../../../components/QuickstartMeta.astro';
+
+Complete [Return a governed value](../return-a-governed-value/) before starting this tutorial.
+You will apply that pattern to the public DHIS2 Tracker demo, combine two immunization events into
+one governed answer, and verify the signed assertion returned across the Evidence HTTP boundary.
+
+{/* Target tutorial for evidencectl UX2, UX3, UX5, and UX10. Keep status draft until the
+    commands and authoring shapes on this page pass the tutorial gate. */}
+
+<QuickstartMeta
+  outcome="A verified assertion containing five governed immunization readings from DHIS2."
+  time="About 30 minutes"
+  level="Institution source with synthetic data"
+  prerequisites={[
+    'The completed governed-value tutorial',
+    'The Evidence toolset',
+    'Access to the public DHIS2 demo',
+    'curl and an editor',
+  ]}
+/>
+
+This tutorial uses synthetic data from the public DHIS2 demo.
+Do not substitute a real child record.
+The demo maintainers can reset its data, credentials, and synthetic subjects.
+
+## Define the answer before the source
+
+The DHIS2 Child Programme records several immunization readings across its Birth and Baby
+Postnatal events.
+The assertion will return five governed concepts:
+
+| Concept | Form | Meaning |
+|---|---|---|
+| BCG recorded as administered | Boolean | The completed events explicitly record whether a BCG dose was administered. |
+| OPV dose count | Bounded integer | The recorded oral polio vaccine dose number, from 0 through 3. |
+| Pentavalent dose count | Bounded integer | The recorded pentavalent vaccine dose number, from 0 through 3. |
+| Measles recorded as administered | Boolean | The completed events explicitly record whether a measles dose was administered. |
+| Yellow fever recorded as administered | Boolean | The completed events explicitly record whether a yellow fever dose was administered. |
+
+This is a recorded immunization summary, not a conclusion that the child is fully vaccinated or
+up to date.
+Those conclusions require an approved immunization schedule, the child's age, a jurisdiction,
+and rules for exceptional or late doses.
+
+The source adapter also applies two conservative readings:
+
+- An absent source value does not become `false` or `0`.
+- Two different values for the same concept make the source record inconsistent.
+
+In either case, Evidence returns no assertion.
+
+## Choose a synthetic child
+
+Open the [public DHIS2 demo](https://play.im.dhis2.org/stable-2-43-1/) and sign in with its
+provider-published shared credentials:
+
+```text
+Username: admin
+Password: district
+```
+
+In Tracker Capture, select the `Child Programme` and the `Ngelehun CHC` organisation unit.
+Choose a synthetic child with completed `Birth` and `Baby Postnatal` events whose five
+immunization fields contain values.
+
+Note its tracked entity identifier and keep it out of tracked files.
+The identifier selects the source record.
+It will be used for the DHIS2 read and the Evidence request, but it will not appear in the signed
+assertion.
+
+## See the DHIS2 boundary
+
+Create an owner-only curl configuration at `.local/dhis2.curl`:
+
+```sh
+umask 077
+mkdir -p .local
+touch .local/dhis2.curl
+chmod 600 .local/dhis2.curl
+```
+
+Open the file and add the public demo credential:
+
+```text
+user = "admin:district"
+```
+
+Set the source and subject values in your terminal:
+
+```sh
+export DHIS2_BASE_URL='https://play.im.dhis2.org/stable-2-43-1'
+export DHIS2_PROGRAM_ID='IpHINAT79UW'
+export DHIS2_TRACKED_ENTITY_ID='<synthetic-tracked-entity-id>'
+```
+
+Read the same bounded fields that Evidence will use:
+
+```sh
+curl --silent --show-error --fail \
+  --config .local/dhis2.curl \
+  --get \
+  --url "$DHIS2_BASE_URL/api/tracker/trackedEntities/$DHIS2_TRACKED_ENTITY_ID" \
+  --data-urlencode "program=$DHIS2_PROGRAM_ID" \
+  --data-urlencode 'fields=trackedEntity,enrollments[program,events[programStage,status,dataValues[dataElement,value]]]' \
+  --output .local/dhis2-response.json
+```
+
+The response contains the tracked entity, its programme enrollment, the two events, and their
+data values.
+Some event data values are unrelated to the five concepts.
+Evidence will receive the bounded response, discard unrelated values during extraction, and
+release only the five declared concepts.
+
+This distinction is deliberate.
+The source uses the `record-transformed` posture because DHIS2 cannot filter the `dataValues`
+array to individual data-element identifiers in this response shape.
+
+## Create the authoring project
+
+Download the Tracker OpenAPI document and create an editable local project:
+
+```sh
+curl --silent --show-error --fail \
+  --config .local/dhis2.curl \
+  --header 'Accept: application/x-yaml' \
+  --url "$DHIS2_BASE_URL/api/tracker/openapi.yaml" \
+  --output .local/dhis2-tracker.openapi.yaml
+
+evidencectl new dhis2-immunization \
+  --openapi .local/dhis2-tracker.openapi.yaml \
+  --profile local \
+  --generate-keys
+
+cd dhis2-immunization
+```
+
+`evidencectl new` retains the OpenAPI document and creates empty `selectors/`, `sources/`,
+`adapters/`, `schemas/`, `questions/`, `derivations/`, and `fixtures/` directories.
+It generates only disposable local Evidence signing, audit, and subject-binding material.
+It does not invent the source policy or the answer.
+
+## Draft the DHIS2 source
+
+Ask `evidencectl` to draft the selected operation and response fields from the retained OpenAPI
+document:
+
+```sh
+evidencectl source suggest \
+  --project . \
+  --source-id child-tracker \
+  --operation 'GET /api/tracker/trackedEntities/{uid}' \
+  --select /trackedEntity \
+  --select '/enrollments/*/program' \
+  --select '/enrollments/*/events/*/programStage' \
+  --select '/enrollments/*/events/*/status' \
+  --select '/enrollments/*/events/*/dataValues/*/dataElement' \
+  --select '/enrollments/*/events/*/dataValues/*/value'
+```
+
+The command creates one editable source, two scripts, and three schemas:
+
+```text
+sources/child-tracker.yaml
+adapters/child-tracker-prepare.rhai
+adapters/child-tracker-extract.rhai
+schemas/child-tracker-parameters.schema.yaml
+schemas/child-tracker-response.schema.yaml
+schemas/child-tracker-facts.schema.yaml
+```
+
+## Define the tracked-entity selector
+
+Create `selectors/child-tracked-entity-v1.yaml`:
+
+```yaml
+maximumAggregateBytes: 64
+fields:
+  tracked_entity_id:
+    type: string
+    minimumBytes: 11
+    maximumBytes: 11
+```
+
+A DHIS2 identifier is exactly eleven characters.
+This bounded field is the only value a caller may send for the child role, and it selects the
+source record without reaching the assertion.
+
+## Configure the bounded source
+
+Replace `sources/child-tracker.yaml` with:
+
+```yaml
+transport: http-json
+baseUrl: https://play.im.dhis2.org
+posture: record-transformed
+authentication:
+  kind: basic
+  usernameRef: secret:file/dhis2-username
+  passwordRef: secret:file/dhis2-password
+request:
+  method: GET
+  pathTemplate: /stable-2-43-1/api/tracker/trackedEntities/{uid}
+  pathBindings:
+    uid: {role: child, profile: child-tracked-entity-v1, field: tracked_entity_id}
+  fixedHeaders:
+    - name: Accept
+      value: application/json
+  selectorInputs:
+    - role: child
+      alternatives:
+        - profile: child-tracked-entity-v1
+          fields: [tracked_entity_id]
+  prepareScript: adapters/child-tracker-prepare.rhai
+  adapterParameters:
+    programId: IpHINAT79UW
+    responseFields: trackedEntity,enrollments[program,events[programStage,status,dataValues[dataElement,value]]]
+  adapterParametersSchema: schemas/child-tracker-parameters.schema.yaml
+  preparationLimits:
+    query: required
+    jsonBody: forbidden
+    maximumQueryPairs: 2
+    maximumQueryNameBytes: 16
+    maximumQueryValueBytes: 256
+    maximumStringBytes: 256
+    maximumNormalizedBytes: 4096
+  projection:
+    - /trackedEntity
+    - /enrollments/*/program
+    - /enrollments/*/events/*/programStage
+    - /enrollments/*/events/*/status
+    - /enrollments/*/events/*/dataValues/*/dataElement
+    - /enrollments/*/events/*/dataValues/*/value
+  redirects: deny
+  timeoutMilliseconds: 10000
+  maximumResponseBytes: 262144
+  concurrencyLimit: 8
+responseSchema: schemas/child-tracker-response.schema.yaml
+extractScript: adapters/child-tracker-extract.rhai
+factSchema: schemas/child-tracker-facts.schema.yaml
+```
+
+`baseUrl` carries an origin only, so the demo's `/stable-2-43-1` prefix belongs to the path
+template.
+The path binding accepts only the authorized `child.tracked_entity_id` selector.
+The caller cannot replace the DHIS2 origin, programme, field selection, response size, or source
+credential.
+
+Add the source credential as owner-only files:
+
+```sh
+touch secrets/dhis2-username secrets/dhis2-password
+chmod 600 secrets/dhis2-username secrets/dhis2-password
+```
+
+Open `secrets/dhis2-username` and enter `admin`.
+Open `secrets/dhis2-password` and enter `district`.
+Do not add quotes or a trailing newline.
+The values stay under the project's ignored `secrets/` directory and are never copied into the
+source definition.
+
+## Prepare the bounded read
+
+The tracked entity identifier reaches DHIS2 through the path binding.
+The programme and field selection reach it as the only two query parameters the source allows.
+Replace `adapters/child-tracker-prepare.rhai` with:
+
+```rhai
+fn prepare(selectors, parameters) {
+    #{
+        query: [
+            #{name: "program", value: parameters["programId"]},
+            #{name: "fields", value: parameters["responseFields"]}
+        ],
+        body: ()
+    }
+}
+```
+
+Replace `schemas/child-tracker-parameters.schema.yaml` with:
+
+```yaml
+type: object
+additionalProperties: false
+required: [programId, responseFields]
+properties:
+  programId: {const: IpHINAT79UW}
+  responseFields:
+    const: trackedEntity,enrollments[program,events[programStage,status,dataValues[dataElement,value]]]
+```
+
+The schema closes both parameters around their reviewed values, so a later edit cannot widen the
+programme or the field selection.
+The script reads only those parameters and the authorized selector.
+It cannot read the source credential, the caller identity, the purpose, or the signing keys.
+
+## Close the response bounds
+
+Evidence validates the projected response before extraction runs, and every array in a schema
+must state its bound.
+Replace `schemas/child-tracker-response.schema.yaml` with:
+
+```yaml
+type: object
+additionalProperties: false
+required: [trackedEntity]
+properties:
+  trackedEntity: {type: string, minLength: 11, maxLength: 11}
+  enrollments:
+    type: array
+    maxItems: 4
+    items:
+      type: object
+      additionalProperties: false
+      required: [program]
+      properties:
+        program: {type: string, minLength: 11, maxLength: 11}
+        events:
+          type: array
+          maxItems: 32
+          items:
+            type: object
+            additionalProperties: false
+            required: [programStage, status, dataValues]
+            properties:
+              programStage: {type: string, minLength: 11, maxLength: 11}
+              status: {type: string, minLength: 1, maxLength: 16}
+              dataValues:
+                type: array
+                maxItems: 64
+                items:
+                  type: object
+                  additionalProperties: false
+                  required: [dataElement, value]
+                  properties:
+                    dataElement: {type: string, minLength: 11, maxLength: 11}
+                    value: {type: string, minLength: 1, maxLength: 256}
+```
+
+A child with no enrollment and an enrollment with no event both stay valid, and the extraction
+script decides what they mean.
+A response that exceeds any bound is refused before a script sees it.
+
+## Normalize the two events
+
+The OpenAPI document describes the nested response shape, but it cannot decide how repeated event
+values become one answer.
+Open `adapters/child-tracker-extract.rhai` and replace its draft body with this reviewed rule:
+
+```rhai
+fn source_boolean(value) {
+    if value == "true" { return true; }
+    if value == "false" { return false; }
+    throw("source_protocol_error");
+}
+
+fn dose_count(value) {
+    let count = parse_integer(value);
+    if count < 0 || count > 3 { throw("source_protocol_error"); }
+    count
+}
+
+fn merge_reading(current, next) {
+    if is_missing(current) { return next; }
+    if current != next { throw("source_protocol_error"); }
+    current
+}
+
+fn extract(source_response, parameters) {
+    let bcg = ();
+    let opv = ();
+    let penta = ();
+    let measles = ();
+    let yellow_fever = ();
+
+    let enrollments = get_path(source_response, "/enrollments");
+    if is_missing(enrollments) { return #{outcome: "no_match"}; }
+
+    for enrollment in enrollments {
+        if enrollment["program"] == "IpHINAT79UW" {
+            let events = get_path(enrollment, "/events");
+            if !is_missing(events) {
+                for event in events {
+                    let stage = event["programStage"];
+                    let accepted_stage =
+                        stage == "A03MvHHogjR" || stage == "ZzYYXq4fJie";
+                    if accepted_stage && event["status"] == "COMPLETED" {
+                        for reading in event["dataValues"] {
+                            let element = reading["dataElement"];
+                            let value = reading["value"];
+                            if element == "bx6fsa0t90x" {
+                                bcg = merge_reading(bcg, source_boolean(value));
+                            } else if element == "ebaJjqltK5N" {
+                                opv = merge_reading(opv, dose_count(value));
+                            } else if element == "vTUhAUZFoys" {
+                                penta = merge_reading(penta, dose_count(value));
+                            } else if element == "FqlgKAG8HOu" {
+                                measles = merge_reading(measles, source_boolean(value));
+                            } else if element == "rxBfISxXS2U" {
+                                yellow_fever = merge_reading(
+                                    yellow_fever,
+                                    source_boolean(value)
+                                );
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    let facts = #{record_reference: source_response["trackedEntity"]};
+    if !is_missing(bcg) { facts["bcg_recorded"] = bcg; }
+    if !is_missing(opv) { facts["opv_dose_count"] = opv; }
+    if !is_missing(penta) { facts["penta_dose_count"] = penta; }
+    if !is_missing(measles) { facts["measles_recorded"] = measles; }
+    if !is_missing(yellow_fever) {
+        facts["yellow_fever_recorded"] = yellow_fever;
+    }
+    #{outcome: "match", facts: facts}
+}
+```
+
+The extractor reads every bounded event and data value.
+It accepts only completed Birth and Baby Postnatal events, converts DHIS2 strings into typed
+facts, and refuses conflicting readings.
+Unrelated data elements are never added to `facts`.
+
+Replace `schemas/child-tracker-facts.schema.yaml` with the closed extraction result:
+
+```yaml
+type: object
+additionalProperties: false
+required:
+  - record_reference
+  - bcg_recorded
+  - opv_dose_count
+  - penta_dose_count
+  - measles_recorded
+  - yellow_fever_recorded
+properties:
+  record_reference: {type: string, minLength: 11, maxLength: 64}
+  bcg_recorded: {type: boolean}
+  opv_dose_count: {type: integer, minimum: 0, maximum: 3}
+  penta_dose_count: {type: integer, minimum: 0, maximum: 3}
+  measles_recorded: {type: boolean}
+  yellow_fever_recorded: {type: boolean}
+```
+
+A missing immunization reading now fails the fact contract.
+Evidence does not convert absence into a negative answer.
+
+## Author the multi-concept question
+
+Create `questions/immunization-summary.yaml`:
+
+```yaml
+id: immunization-summary
+question: Which immunizations are recorded for this child?
+purpose: care-continuity
+subject:
+  role: child
+  selector: tracked_entity_id
+  profile: child-tracked-entity-v1
+  derivation: true
+source:
+  ref: child-tracker
+answers:
+  - concept: bcg_recorded_as_administered
+    type: boolean
+  - concept: opv_dose_count_recorded
+    type: bounded-integer
+    minimum: 0
+    maximum: 3
+  - concept: penta_dose_count_recorded
+    type: bounded-integer
+    minimum: 0
+    maximum: 3
+  - concept: measles_recorded_as_administered
+    type: boolean
+  - concept: yellow_fever_recorded_as_administered
+    type: boolean
+derivation: derivations/immunization-summary.rhai
+disclosure:
+  allow:
+    - bcg_recorded_as_administered
+    - opv_dose_count_recorded
+    - penta_dose_count_recorded
+    - measles_recorded_as_administered
+    - yellow_fever_recorded_as_administered
+```
+
+`source.ref` names the reviewed source, whose closed fact schema decides what the derivation
+receives.
+The `answers` list declares the exact concepts and their forms.
+The `disclosure.allow` list must match those concepts in order.
+Adding another answer or changing an integer bound is a reviewed project change.
+
+Create `derivations/immunization-summary.rhai`:
+
+```rhai
+fn answer(facts, selectors, context) {
+    if facts["record_reference"] !=
+       selectors["child"]["values"]["tracked_entity_id"] {
+        throw("derivation_input_error");
+    }
+    #{
+        bcg_recorded_as_administered: facts["bcg_recorded"],
+        opv_dose_count_recorded: facts["opv_dose_count"],
+        penta_dose_count_recorded: facts["penta_dose_count"],
+        measles_recorded_as_administered: facts["measles_recorded"],
+        yellow_fever_recorded_as_administered: facts["yellow_fever_recorded"]
+    }
+}
+```
+
+The first comparison prevents a response for another tracked entity from being evaluated.
+The returned map must contain exactly the aliases declared under `answers`.
+Evidence validates every value against its declared form before signing.
+
+## Start the project
+
+Compile the editable source and question into one immutable local generation, then start Registry
+Mint and Evidence:
+
+```sh
+evidencectl dev --detach
+```
+
+```text
+Evidence ready at http://127.0.0.1:8080
+Mint ready at http://127.0.0.1:8081
+```
+
+This command validates the source schema, collection bounds, extractor, fact schema, question,
+answer forms, derivation, disclosure list, and secret bindings before either service becomes
+ready.
+Local assurance keeps the project editable and does not require production fixtures.
+
+## Request the real assertion
+
+Prepare a closed request and its independent verification expectations for the chosen subject:
+
+```sh
+evidencectl request prepare immunization-summary \
+  --purpose care-continuity \
+  --subject "child:tracked_entity_id=$DHIS2_TRACKED_ENTITY_ID" \
+  --name immunization-summary
+```
+
+Use this only with the public synthetic record. In a real deployment, selectors need an input
+path that does not expose identifiers in shell history or process arguments.
+
+Send that request across the Evidence HTTP boundary:
+
+```sh
+curl --silent --show-error --fail-with-body \
+  --config .evidence/requests/immunization-summary/authorization.curl \
+  --request POST \
+  --url http://127.0.0.1:8080/v1/evidence \
+  --header 'Content-Type: application/json' \
+  --header 'Accept: application/jose+json' \
+  --data-binary @.evidence/requests/immunization-summary/request.json \
+  --output immunization-summary.jws.json
+```
+
+The caller contacts Evidence.
+Evidence authenticates and authorizes the caller, performs one bounded authenticated DHIS2 read,
+derives the five concepts, audits the disclosure, and returns a signed flattened JSON Web
+Signature (JWS).
+
+## Verify before reading
+
+Verify the response against the retained request and trust expectations:
+
+```sh
+evidencectl verify immunization-summary.jws.json \
+  --context .evidence/requests/immunization-summary/verification.json \
+  --output immunization-summary.verified.json
+```
+
+```text
+VERIFIED
+```
+
+Inspect the verified payload:
+
+```sh
+python3 -m json.tool immunization-summary.verified.json
+```
+
+The selected demo record determines the boolean and dose-count values.
+The supported values have this shape:
+
+```json
+[
+  {
+    "providesValueFor": "urn:registrystack:evidence:local:concept:immunization-summary:bcg_recorded_as_administered",
+    "value": false
+  },
+  {
+    "providesValueFor": "urn:registrystack:evidence:local:concept:immunization-summary:opv_dose_count_recorded",
+    "value": 1
+  },
+  {
+    "providesValueFor": "urn:registrystack:evidence:local:concept:immunization-summary:penta_dose_count_recorded",
+    "value": 1
+  },
+  {
+    "providesValueFor": "urn:registrystack:evidence:local:concept:immunization-summary:measles_recorded_as_administered",
+    "value": true
+  },
+  {
+    "providesValueFor": "urn:registrystack:evidence:local:concept:immunization-summary:yellow_fever_recorded_as_administered",
+    "value": true
+  }
+]
+```
+
+The verified assertion contains no tracked entity identifier, event identifier, event date,
+programme enrollment, unrelated health reading, or source credential.
+
+## Inspect the audit and clean up
+
+Stop the local services:
+
+```sh
+evidencectl dev stop
+```
+
+Inspect the last operation:
+
+```sh
+evidencectl audit show --last-operation
+```
+
+The audit records the authorized access and the five disclosed concept identifiers.
+It does not record their values or the DHIS2 response.
+
+Delete `.local/dhis2-response.json` and `.local/dhis2.curl` if they were created only for this
+tutorial.
+Keep the project editable while evaluating the source.
+Before deployment, add project-specific fixtures, replace the demo account with a least-privilege
+service account, review the source acquisition posture, and build a reviewed production candidate.
+
+## Next
+
+- [See Evidence refuse unsafe requests](../refuse-unsafe-evidence-requests/)
+- [Build and deploy an Evidence project](../build-and-deploy-evidence-project/)
+- [Verify an assertion as a consumer](../verify-an-assertion-as-a-consumer/)
diff --git a/docs/site/src/content/docs/tutorials/manage-evidence-verifier-trust.mdx b/docs/site/src/content/docs/tutorials/manage-evidence-verifier-trust.mdx
new file mode 100644
index 000000000..817b2753c
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/manage-evidence-verifier-trust.mdx
@@ -0,0 +1,90 @@
+---
+title: Manage Evidence verifier trust
+description: Pin provider identity and public keys independently, then approve signing-key rotation without trusting the response being verified.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: how-to
+persona:
+  - consumer or verifier
+locale: en
+standards_referenced: []
+---
+
+A valid signature proves control of a private key. Your consumer still decides which provider,
+issuer, key set, algorithm, audience, requirement, and configuration revision it trusts.
+
+Keep that decision outside the Evidence response. Discovery helps you find candidate metadata; it
+does not make the candidate trusted.
+
+## Establish trust before the first request
+
+Through your organization's provider-onboarding process, verify and retain:
+
+- the legal issuer and technical provider identifiers;
+- the expected Evidence service and JWKS endpoints;
+- the Ed25519 public keys and their `kid` values;
+- the audience that identifies your relying party;
+- the requirements, evidence types, purposes, concepts, and configuration revisions you accept;
+- the maximum assertion lifetime and clock skew your decisions allow.
+
+Fetch `/.well-known/evidence/jwks.json` only as a candidate. Compare it through an authenticated,
+independent channel or approved configuration change, then store the accepted JWKS as a versioned
+file. Verification must not follow key URLs supplied by a response.
+
+## Assemble a candidate trust set
+
+When the provider announces a new public key, build a new file without overwriting the active one:
+
+```sh
+evidencectl jwks \
+  --out trusted-issuer-keys.next.json \
+  provider-new-public.jwk.json \
+  provider-retiring-public.jwk.json
+```
+
+Pass public JWK files only. The command rejects private key members, conflicting keys with the same
+`kid`, and an existing output path.
+
+During the overlap window, the candidate set contains the new key and each retiring key that may
+still have a valid assertion in circulation. The provider must retain retiring public keys for
+at least its maximum assertion validity plus verifier clock skew. Your retention policy may be
+longer when historical re-verification requires it.
+
+## Prove the rotation before accepting it
+
+Use representative stored responses and the policies retained for them:
+
+```sh
+evidence verify \
+  --jws response-signed-with-retiring-key.json \
+  --jwks trusted-issuer-keys.next.json \
+  --policy retained-policy.json \
+  --at "<original-decision-instant>"
+```
+
+After the provider begins signing with the new key, verify a synthetic response through the same
+procedure. Confirm that an unknown key still fails and that the candidate changes only the key set,
+not issuer, provider, audience, purpose, requirement, concept, or configuration expectations.
+
+Approve and atomically activate the candidate through your normal configuration process. Keep the
+previous trust file and approval record for rollback and audit.
+
+## Retire the old key deliberately
+
+Remove a retiring key from current verification only after:
+
+1. the provider's maximum assertion lifetime plus accepted clock skew has elapsed since its last
+   possible use;
+2. no current transaction can legitimately return an assertion signed by it;
+3. historical records retain the exact trust set needed to re-verify earlier decisions;
+4. rollback procedures no longer require the old signing generation.
+
+Never make verification fetch a missing key automatically. An unknown `kid` is a trust-change
+signal and must fail closed until your organization approves the change.
+
+Provider operators use [Rotate Evidence signing keys](../move-evidence-to-production-signing/)
+for the other side of this rotation. Consumers remain independent and do not inherit trust merely
+because the provider published a key.
diff --git a/docs/site/src/content/docs/tutorials/move-evidence-to-production-signing.mdx b/docs/site/src/content/docs/tutorials/move-evidence-to-production-signing.mdx
new file mode 100644
index 000000000..793294f59
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/move-evidence-to-production-signing.mdx
@@ -0,0 +1,120 @@
+---
+title: Rotate Evidence signing keys
+description: Stage a new Evidence signing key, publish an overlap set through the runtime JWKS endpoint, and retire the old key after consumers can verify both generations.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: how-to
+persona:
+  - operator
+locale: en
+standards_referenced: []
+---
+
+Use this procedure after [Build and deploy an Evidence project](../build-and-deploy-evidence-project/).
+Coordinate the rotation with consumers through
+[Manage Evidence verifier trust](../manage-evidence-verifier-trust/) before activation. Evidence
+signs with one active Ed25519 key. Rotation is a reviewed, startup-only configuration change. There
+is no hot-rotation endpoint or standby-key field. Publishing a new public key makes it discoverable;
+it does not make independently operated consumers trust it.
+
+## Stage a new keypair
+
+Generate the replacement in a new owner-only staging directory on the host responsible for key
+custody:
+
+```sh
+evidencectl keygen signing \
+  --out-dir "<owner-only-staging-directory>" \
+  --kid "<new-production-kid>"
+```
+
+The command writes a private and public JWK without printing private bytes. Provision the private
+JWK into the deployment's secret root under a new logical filename. Keep the public JWK
+as a separately approved distribution artifact for consumers. The active public key does not need
+to be copied into the closed bundle because Evidence derives it from the active private JWK.
+
+Do not overwrite the active private key in place. A candidate revision must be complete and
+checkable before it becomes active.
+
+## Build the overlap revision
+
+In the candidate `bundle/evidence.yaml`, point the active fields at the replacement. Copy the old
+public JWK into the bundle, then reference it as a retired artifact:
+
+```yaml
+signing:
+  format: flattened-jws-json
+  algorithm: EdDSA
+  activeKeyId: <new-production-kid>
+  activeKeyRef: secret:file/<new-private-key-name>
+  retiredPublicJwkFiles:
+    - keys/<old-production-kid>.public.jwk.json
+  jwksPath: /.well-known/evidence/jwks.json
+  maximumAssertionValiditySeconds: 86400
+  verifierClockSkewSeconds: 30
+```
+
+`activeKeyId` must exactly match the private JWK's `kid`. Each retired file contains public material
+only. Evidence assembles its JWKS endpoint from the active private key's public half and the
+configured retired public files. You do not publish a separate operator-built JWKS beside it.
+
+## Validate and coordinate consumer approval
+
+Run the project fixtures and `evidence check` against the candidate revision:
+
+```sh
+evidencectl fixtures run --project "<evidence-project>"
+evidence check --runtime "<evidence-project>/runtime.yaml"
+```
+
+Give consumers the new public key, `kid`, provider identity, activation window, and overlap period
+through your governed onboarding channel. Consumers are expected to add the new key to a candidate
+pinned trust set and prove both an old-key and a new-key synthetic response before accepting the
+change.
+
+The [verifier trust procedure](../manage-evidence-verifier-trust/) covers that independent side of
+the rotation.
+
+## Activate and observe
+
+Deploy the exact checked revision and restart Evidence. Confirm readiness, then inspect the public
+endpoint:
+
+```sh
+curl --fail --silent --show-error \
+  "https://<evidence-host>/.well-known/evidence/jwks.json"
+```
+
+The JWKS contains the new active public key and the old retired public key, with no private
+members. Send one authorized synthetic request and verify its `kid` with the consumer's approved
+overlap set.
+
+Missing, unreadable, or mismatched signing material fails closed. Evidence never falls back to an
+unsigned success.
+
+## Retire the old public key
+
+Keep the old public key published for at least:
+
+```text
+maximumAssertionValiditySeconds + verifierClockSkewSeconds
+```
+
+Count from the last instant the old private key could have signed. Retain it longer when consumers
+must re-verify historical decisions.
+
+Remove the retired public file and its `retiredPublicJwkFiles` entry only in a later reviewed bundle
+revision. Run fixtures and `evidence check` again, coordinate consumer removal, deploy, and confirm
+the JWKS no longer carries the old key.
+
+Removing a verification key is not selective assertion revocation. Evidence has no credential
+status or revocation lifecycle. It only changes which signatures a current trust set can verify.
+
+## Related guidance
+
+- [Build and deploy an Evidence project](../build-and-deploy-evidence-project/)
+- [Evidence security model](../../security/evidence/)
+- [Configure Evidence](../../configure/evidence/)
diff --git a/docs/site/src/content/docs/tutorials/move-notary-to-production-signing.mdx b/docs/site/src/content/docs/tutorials/move-notary-to-production-signing.mdx
deleted file mode 100644
index a5d9b85e3..000000000
--- a/docs/site/src/content/docs/tutorials/move-notary-to-production-signing.mdx
+++ /dev/null
@@ -1,348 +0,0 @@
----
-title: Move Notary to production signing
-description: >-
-  Replace a local demo issuer key with a reviewed PKCS#11 signing provider, then verify provider
-  health, custody approval, and public key publication.
-status: draft
-draft: true
-owner: registry-docs
-source_repos:
-  - registry-notary
-last_reviewed: unreviewed
-doc_type: how-to
-locale: en
-standards_referenced:
-  - sd-jwt-vc
-  - w3c-did
----
-
-Use this guide to replace a Registry Notary demo issuer key with a production signing key reached
-through Public-Key Cryptography Standards #11 (PKCS#11).
-You will keep private key operations inside the selected provider, bind the key to a production
-issuer identity, exercise Notary's fail-closed custody gate, and verify the running provider without
-exposing key material.
-
-## When to use this
-
-Use this guide after a local Registry Notary flow can issue a selective disclosure JSON Web Token
-verifiable credential (SD-JWT VC) with `provider: local_jwk_env`.
-The generated `secrets/local.env` file and `registry-notary demo-issuer-key` output are development
-fixtures: they place exportable private key material in a local environment variable and commonly
-use a `did:web:localhost` issuer.
-Neither the file nor that issuer establishes production key custody or a public trust root.
-
-This guide covers one credential-issuance key.
-Repeat the custody review for access-token and federation-response signing keys if those surfaces
-are enabled.
-
-## Before you start
-
-You need:
-
-- A working Registry Notary configuration with at least one credential profile.
-- The `registry-notary` binary deployed in the same environment as the PKCS#11 module.
-- `curl`, `jq`, and `rg`.
-- A production issuer identifier and a published verification method for that issuer.
-- A PKCS#11 module, token, and non-exportable Ed25519 key approved by your security owner.
-- The module path, token label, key label, key ID in hexadecimal, public JWK, and a secret-store
-  reference for the token PIN.
-- A documented key owner, activation date, rotation interval, incident contact, and verifier
-  retention window.
-
-Registry Notary does not certify a hardware security module (HSM) or infer custody from
-`provider: pkcs11`.
-The configured module can connect to hardware or to a software token.
-Use the [signing key provider reference](../../products/registry-notary/signing-key-provider/) to
-check the complete provider contract and current limits before provisioning the key.
-
-## Inventory the demo signing path
-
-Find the demo key, issuer, and every profile that references the key:
-
-```sh
-NOTARY_CONFIG=generated-inputs/notary/config/notary.yaml
-rg -n 'registry-notary-demo|local_jwk_env|private_jwk_env|signing_key:|issuer:' \
-  "$NOTARY_CONFIG"
-```
-
-A generated demo configuration contains fields like these:
-
-```text
-provider: local_jwk_env
-private_jwk_env: REGISTRY_NOTARY_ISSUER_JWK
-kid: did:web:localhost#registry-notary-demo
-issuer: did:web:localhost
-signing_key: registry-notary-demo
-```
-
-Record every credential profile, access-token setting, and federation setting that references the
-demo key.
-Changing only one reference can leave another signing surface on local software custody.
-
-## Confirm PKCS#11 support
-
-Run the deployed artifact, not a developer build from another machine:
-
-```sh
-registry-notary build-info | jq '.capabilities.signing_providers'
-```
-
-The result must report PKCS#11 support:
-
-```json
-{
-  "local_jwk_env": true,
-  "pkcs11": true
-}
-```
-
-If `pkcs11` is `false`, deploy an official image or a binary built with the `pkcs11` feature before
-continuing.
-Provider configuration fails closed when that capability is absent.
-
-## Provision the key and public identity
-
-Generate the Ed25519 key inside the approved custody boundary.
-Do not generate the production key with `registry-notary demo-issuer-key`, OpenSSL on an operator
-workstation, or the SoftHSM smoke setup from the provider reference.
-SoftHSM verifies protocol integration, not production custody.
-
-Assign a new key ID (`kid`) that combines the production issuer and a unique key fragment, for
-example `did:web:issuer.example#notary-2026-01`.
-Publish the corresponding public verification method for the issuer before issuing credentials.
-The `issuer` in each credential profile must either equal the Decentralized Identifier (DID)
-portion of a `did:web` key ID or use an HTTPS URL whose host matches the `did:web` host.
-Preserve a matching HTTPS issuer during a signing-key migration unless you have coordinated an
-issuer change with every verifier that trusts the existing issuer.
-Changing the profile issuer changes the SD-JWT VC `iss` value.
-
-For this signing key, load only the token PIN and public JSON Web Key (JWK) into the service's
-secret provider.
-For the examples in this guide, expose them to the process as
-`REGISTRY_NOTARY_PKCS11_PIN` and `REGISTRY_NOTARY_ISSUER_PUBLIC_JWK`.
-The public JWK must contain the configured `kid` and `alg`, and must not contain the private `d`
-member.
-
-Check the public JWK without printing any private environment values:
-
-```sh
-printf '%s\n' "$REGISTRY_NOTARY_ISSUER_PUBLIC_JWK" | jq -e '
-  if has("d") then
-    error("public JWK contains a private member")
-  else
-    {kid, alg, kty, crv, private_member_present: has("d")}
-  end
-'
-```
-
-The values must describe the provisioned public key:
-
-```json
-{
-  "kid": "did:web:issuer.example#notary-2026-01",
-  "alg": "EdDSA",
-  "kty": "OKP",
-  "crv": "Ed25519",
-  "private_member_present": false
-}
-```
-
-## Configure the production provider
-
-Keep custody approval false during the first validation pass.
-Replace the demo signing key and update each credential profile that used it:
-
-```yaml
-deployment:
-  profile: production
-  evidence:
-    signer_custody_approved: false
-
-evidence:
-  signing_keys:
-    issuer-2026-01:
-      provider: pkcs11
-      module_path: /opt/vendor/lib/pkcs11.so
-      token_label: registry-notary-production
-      pin_env: REGISTRY_NOTARY_PKCS11_PIN
-      key_label: notary-issuer-2026-01
-      key_id_hex: 01ab23cd
-      public_jwk_env: REGISTRY_NOTARY_ISSUER_PUBLIC_JWK
-      alg: EdDSA
-      kid: did:web:issuer.example#notary-2026-01
-      status: active
-  credential_profiles:
-    civil-status:
-      format: application/dc+sd-jwt
-      issuer: did:web:issuer.example
-      signing_key: issuer-2026-01
-      vct: https://issuer.example/credentials/civil-status
-      allowed_claims:
-        - person-is-alive
-```
-
-Adapt the profile fields to the credential you already issue.
-Do not copy the example claim or verifiable credential type (`vct`) into an unrelated profile.
-Keep the PIN and all private key material out of YAML, shell history, logs, and diagnostic bundles.
-
-## Exercise the custody gate
-
-Run `doctor` with the same module, token access, environment variables, and filesystem mounts that
-the service will use:
-
-```sh
-registry-notary doctor \
-  --config <notary-config.yaml> \
-  --format json > notary-doctor.json
-
-jq '{
-  pkcs11: [.diagnostics[] | select(.message | startswith("PKCS#11"))],
-  custody: [.diagnostics[] | select(.code == "notary.signer_custody.unapproved")],
-  missing_env: [.required_env[] | select(.status == "missing") | .name]
-}' notary-doctor.json
-```
-
-The first pass must report `PKCS#11 signing providers loaded and self-tested` and the
-`notary.signer_custody.unapproved` finding.
-That combination proves Notary reached at least one active PKCS#11 key and refused to treat provider
-kind as custody approval.
-The preflight does not prove that the credential profile references that key.
-Before approving custody, confirm that each intended profile's `signing_key` names the active
-PKCS#11 entry under `evidence.signing_keys`.
-The `missing_env` array must be empty.
-The first `doctor` command exits with a nonzero status because the custody finding is deliberately
-active during this pass.
-
-Resolve every other production-profile error before rollout.
-The [operator configuration reference](../../products/registry-notary/operator-config-reference/)
-documents deployment gates for audit shipping, correctness state, source transport, admin exposure,
-and signed configuration.
-
-## Approve custody after review
-
-The security owner must review:
-
-- How the key was generated and whether private material can be exported.
-- Who can use, rotate, disable, back up, or destroy the key.
-- How token PINs and HSM administrator credentials are separated and rotated.
-- Whether vendor driver timeouts return before Notary's five-second signing timeout.
-- How a new `kid` and public verification method will be published before rotation.
-- How long old public keys remain available for issued credentials and verifier caches.
-- Which issuance audit records are retained off-host and who reviews signing failures.
-
-After that review approves every configured signing role, set:
-
-```yaml
-deployment:
-  profile: production
-  evidence:
-    signer_custody_approved: true
-```
-
-This field is an operator attestation, not proof produced by Registry Notary.
-Do not set it to make a readiness failure disappear without the recorded review.
-
-Rerun `doctor`, then require the provider self-test to pass and the custody finding to be absent:
-
-```sh
-registry-notary doctor \
-  --config <notary-config.yaml> \
-  --format json > notary-doctor.json
-
-jq -e '
-  ([.diagnostics[] | select(.message == "PKCS#11 signing providers loaded and self-tested")]
-    | length == 1) and
-  ([.diagnostics[] | select(.code == "notary.signer_custody.unapproved")]
-    | length == 0) and
-  ([.required_env[] | select(.status == "missing")]
-    | length == 0)
-' notary-doctor.json
-```
-
-`jq` exits with status `0` and prints `true` when the signing checks pass.
-Inspect the full report and resolve unrelated errors or warnings rather than treating this focused
-check as approval for the whole deployment.
-
-## Verify the running provider
-
-Start or restart Registry Notary with the reviewed configuration.
-Read the public readiness document:
-
-```sh
-curl -fsS https://<notary-host>/ready | \
-  jq '.checks.signing_providers.custody | {
-    active_provider_counts,
-    signing_provider_count,
-    local_software_signing_provider_count,
-    custody_approval_required,
-    custody_approved,
-    unapproved_signing_provider_count,
-    credential_issuance: .surfaces.credential_issuance
-  }'
-```
-
-For one PKCS#11 credential signer, the custody facts are:
-
-```json
-{
-  "active_provider_counts": { "pkcs11": 1 },
-  "signing_provider_count": 1,
-  "local_software_signing_provider_count": 0,
-  "custody_approval_required": true,
-  "custody_approved": true,
-  "unapproved_signing_provider_count": 0,
-  "credential_issuance": {
-    "signing_provider_count": 1,
-    "local_software_signing_provider_count": 0,
-    "unapproved_signing_provider_count": 0
-  }
-}
-```
-
-The `credential_issuance` values confirm that the credential profile resolves to one active signer
-and that the signer does not use local software custody.
-
-Confirm that Notary publishes the intended verification key and no private JWK member:
-
-```sh
-curl -fsS https://<notary-host>/.well-known/evidence/jwks.json | \
-  jq -e --arg kid 'did:web:issuer.example#notary-2026-01' '
-    [.keys[] | select(.kid == $kid)] |
-    if length != 1 then
-      error("expected exactly one matching verification key")
-    elif .[0] | has("d") then
-      error("published key contains a private member")
-    else
-      .[0] | {kid, alg, kty, private_member_present: has("d")}
-    end
-  '
-```
-
-The result names the production `kid`, uses the configured algorithm, and reports
-`private_member_present: false`.
-Run one controlled issuance through the deployment's existing smoke path, verify the credential
-against the published key, and confirm the issuance audit record reached the restricted off-host
-sink before routing production traffic.
-
-## Retire the demo material
-
-Remove `REGISTRY_NOTARY_ISSUER_JWK` and the demo private JWK from the production service definition
-and secret store after the new configuration is active.
-Do not copy `secrets/local.env` into the production deployment.
-
-If credentials signed by an older production key remain valid, rotate that key to `publish_only`
-with public JWK material and keep it published through the verifier retention window.
-Never reuse a `kid` for different key material.
-The [signing key provider reference](../../products/registry-notary/signing-key-provider/) documents
-the complete active-to-publish-only rotation procedure.
-
-## Troubleshooting
-
-| Symptom | Cause | Fix |
-| --- | --- | --- |
-| `build-info` reports `"pkcs11": false` | The deployed binary was built without the provider capability. | Deploy an official image or rebuild `registry-notary` with the `pkcs11` feature. |
-| `doctor` reports `PKCS#11 signing preflight failed` | The module, token, PIN, key lookup, public JWK, or compiled feature does not match the configuration. | Check each named provider field against the HSM inventory. Keep the full PIN and private key out of the diagnostic record. |
-| `doctor` reports `notary.signer_custody.unapproved` after review | `signer_custody_approved` is false, or another credential, access-token, or federation signer was not included in the review. | Inventory every signing reference, complete the missing review, and attest only after all configured roles are approved. |
-| `/ready` reports a local software signing provider | A custody-relevant role still references `local_jwk_env` or `file_watch`. | Find all `signing_key` references and move the intended role to the reviewed PKCS#11 key. |
-| The public key is absent from JWKS | The key is disabled, its provider failed, or the expected `kid` differs from the configured key. | Check startup logs and `doctor`, then compare the exact public JWK `kid` and `alg` with the YAML. |
-| Existing credentials fail after rotation | The old public key was removed before credentials expired or verifier caches refreshed. | Restore the old public key as `publish_only` and keep it available through the documented retention window. |
diff --git a/docs/site/src/content/docs/tutorials/prove-an-evidence-project.mdx b/docs/site/src/content/docs/tutorials/prove-an-evidence-project.mdx
new file mode 100644
index 000000000..fc3e13fca
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/prove-an-evidence-project.mdx
@@ -0,0 +1,111 @@
+---
+title: Prove an Evidence project
+description: Add fixtures that describe your own requirement and run them through the Evidence evaluator before a production build.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: how-to
+persona:
+  - assertion provider
+  - operator
+locale: en
+standards_referenced: []
+---
+
+Start with a reviewed editable project. If you need to create one,
+[connect an institution source from OpenAPI](../connect-an-institution-source/) before adding
+fixtures. Fixtures are executable claims about your own Evidence project. They are not sample data
+for a first run and they must not be generated from an unrelated domain.
+
+Use them when your source, requirement, and derivation are ready for review. Local assurance may
+omit them while you iterate. Production and evidence-grade assurance require complete fixture
+coverage before the bundle loads.
+
+## Write cases for your requirement
+
+Place the fixture file under `bundle/fixtures/` and reference it from the requirement in
+`bundle/evidence.yaml`. Keep every value synthetic and sanitized.
+
+Cover behavior your reviewers need to approve:
+
+- one ordinary positive result;
+- one legitimate negative value, or an unresolved case when false would be misleading;
+- each important boundary in the derivation;
+- the `no_match` and `ambiguous` outcomes;
+- missing or mistyped required facts;
+- malformed and unavailable source responses;
+- output outside the governed codelist or schema;
+- privacy expectations proving source fields and selector values stay out of evidence and
+  diagnostics;
+- anti-reconstruction cases for concepts that must not be released together.
+
+The fixture format is closed. Start from the
+[fixture contract](https://github.com/registrystack/registry-stack/blob/main/products/evidence/reference/request-adapter/deployment-projects/FIXTURES.md),
+then keep only cases that express your project.
+
+## Run the project suite
+
+From any directory, run:
+
+```sh
+evidencectl fixtures run --project "<evidence-project>"
+```
+
+Evidencectl first runs `evidence check`, discovers the fixture files referenced by the captured
+bundle, and drives each one through `evidence evaluate`. It does not start HTTP, resolve a source
+credential, call the source, or write the production audit log. The served HTTP path remains a
+separate integration check.
+
+Use JSON output in CI:
+
+```sh
+evidencectl fixtures run --project "<evidence-project>" --json > fixture-report.json
+```
+
+Treat any failed case, missing reference, unknown field, or unsupported expectation as a failed
+build input. Do not convert a real failure into an ignored case.
+
+## Check the deployable inputs
+
+Run `evidence check` against the runtime file you plan to deploy:
+
+```sh
+evidence check --runtime "<evidence-project>/runtime.yaml"
+```
+
+This validates the complete captured bundle, scripts, schemas, codelists, key references, and
+runtime bindings. Source credentials are checked by readiness when the service starts, not by the
+offline fixture runner.
+
+During local authoring, keep the project writable so changes are convenient. Freeze inputs only
+for the deployable revision: make the runtime and bundle non-writable to the service identity, or
+mount them read-only, then rerun the check against those exact bytes.
+
+## Hand off the reviewed inputs
+
+Evidencectl has no generic `promote` command. Your deployment system owns approval, artifact
+transport, rollback, and environment binding. Use `evidencectl build` to create a new candidate
+from the editable project and one explicit production target.
+
+Build and hand off only when these facts are recorded together:
+
+1. The fixture suite passed against the editable inputs and the generated candidate.
+2. `evidence check` accepted the exact candidate runtime and bundle.
+3. A reviewer approved the source projection, cardinality mapping, requirement, derivation,
+   codelists, purposes, audiences, and privacy expectations.
+4. The environment supplies independent owner-only signing, subject-binding, and audit secrets.
+5. The deployed bundle revision matches the reviewed candidate.
+6. Readiness passes, followed by one authorized HTTP-path check using synthetic data.
+
+Keep the governed bundle unchanged across environments where practical. Bind environment-specific
+paths, secret roots, audit storage, listener settings, and trust files through each environment's
+runtime file. [Build and deploy an Evidence project](../build-and-deploy-evidence-project/) covers
+the target-host ceremony.
+
+## Next
+
+- [Verify an assertion as a consumer](../verify-an-assertion-as-a-consumer/)
+- [Rotate Evidence signing keys](../move-evidence-to-production-signing/)
+- [Build and deploy an Evidence project](../build-and-deploy-evidence-project/)
diff --git a/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx b/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx
index 3539096ae..65517ac29 100644
--- a/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx
+++ b/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx
@@ -1,14 +1,15 @@
 ---
 title: Start a registry from a spreadsheet
-description: Start a protected spreadsheet registry, make denied and allowed records requests, and expose minimized evidence through Registry Notary.
+description: Start a protected spreadsheet registry, make denied and allowed records requests, and inspect the authored contract behind them.
 status: current
 owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-31"
+last_reviewed: "2026-08-04"
 doc_type: tutorial
+persona:
+  - data publisher
 locale: en
 standards_referenced: []
 ---
@@ -16,12 +17,16 @@ standards_referenced: []
 import QuickstartMeta from '../../../components/QuickstartMeta.astro';
 
 Start with a three-row public works workbook. By the end of this tutorial, you
-will have a protected records API in Registry Relay and a separate evidence API
-in Registry Notary. You will make one denied records request, read one authorized
-record, and verify two facts without receiving that record.
+will have a protected records API in Registry Relay and a private consultation
+that exposes a single field from the same workbook. You will make one denied
+records request, read one authorized record, and inspect the two independent
+contracts behind them.
+
+The starter authors two Relay lanes, `relay-public` and `relay-consultation`,
+and no third product.
 
 <QuickstartMeta
-  outcome="A protected local API over a spreadsheet, plus minimized evidence answers from Relay and Notary."
+  outcome="A protected local API over a spreadsheet, plus a private consultation that exposes one reviewed field."
   time="About 20 minutes after Registryctl and Docker are installed"
   level="Local development with a contained spreadsheet"
   prerequisites={['A released Registryctl 1.0 installation', 'Docker Engine', 'Docker Compose 2.35.0 or later', 'curl', 'A spreadsheet application', 'A shell and a text editor'] }
@@ -96,8 +101,8 @@ contains three synthetic records:
 | `PW-002` | `central-02` | `health` | `planned` |
 | `PW-003` | `coastal-03` | `transport` | `active` |
 
-Keep the identifiers' case and punctuation. The first live request reads
-`pw_001`. The follow-on evidence tutorial uses `PW-002`.
+Keep the identifiers' case and punctuation. The live request reads `pw_001`. The
+other two rows exist so an authorized caller can be shown not to receive them.
 
 ## Test the starter
 
@@ -109,17 +114,17 @@ registryctl test
 
 ```text
 Registry Stack test: passed for fictional-public-works-registry.
-Fixtures: 8.
+Fixtures: 3.
 Next: registryctl dev
 ```
 
-This checks active, planned, and missing-record behavior, the derived
-authorization-before-source cases, and the exact one-field snapshot output
-contract. It does not start Docker, resolve a secret, or contact a source.
+This checks active, planned, and missing-record behavior against the exact
+one-field snapshot output contract. It does not start Docker, resolve a secret,
+or contact a source.
 
 ## Start the local registry
 
-Start the disposable Registry Relay and Registry Notary runtime:
+Start the disposable Registry Relay runtime:
 
 ```sh
 registryctl dev --detach
@@ -127,24 +132,24 @@ registryctl dev --detach
 
 Registryctl validates the project, mounts the contained workbook read-only,
 creates development-only trust and isolated credentials, and starts released
-digest-locked images on loopback HTTP. Its
-output identifies both APIs and prints ready-to-run commands with owner-only
-curl configuration files:
+digest-locked images on loopback HTTP. Its output identifies the API and prints
+ready-to-run commands with owner-only curl configuration files:
 
 ```text
 Relay API: http://127.0.0.1:4242
-Evidence API: http://127.0.0.1:4243
+Source mode: local_snapshot
 Records denied request: curl --config '/<absolute-project-path>/.registry-stack/dev/local/<runtime-id>/credentials/records-denied.curl'
 Records request: curl --config '/<absolute-project-path>/.registry-stack/dev/local/<runtime-id>/credentials/records-request.curl'
-Evidence request: curl --config '/<absolute-project-path>/.registry-stack/dev/local/<runtime-id>/credentials/request.curl'
 ```
 
 Your absolute path and runtime identifier will differ. Copy commands from your
 own output rather than the example above. The curl configurations keep
 disposable credentials out of the command line and your shell environment.
-The generated runtime publishes only the two application ports on host
-loopback. Put an operator-owned reverse proxy or ingress in front when adapting
-the products to a shared environment that requires TLS.
+The consultation Relay is private: it has no host-published port, and the only
+surface you can call is the records API above.
+The generated runtime publishes its application port on host loopback only. Put
+an operator-owned reverse proxy or ingress in front when adapting the products
+to a shared environment that requires TLS.
 
 ### Make one denied records request
 
@@ -185,40 +190,6 @@ but it cannot choose a different `project_id` by changing the record identifier
 in the URL.
 Relay derives the required filter from the authenticated principal.
 
-### Request minimized evidence
-
-Copy the complete command after `Evidence request:` and run it unchanged. This
-request goes to Registry Notary. Notary authorizes the evidence request, then
-asks the private consultation Relay for only the source value needed to decide
-the two claims.
-
-The response contains generated identifiers, timestamps, and provenance. These
-are the relevant fields:
-
-```json
-{
-  "results": [
-    {
-      "claim_id": "project-record-exists",
-      "value": true,
-      "satisfied": true,
-      "disclosure": "predicate"
-    },
-    {
-      "claim_id": "project-status-accepted",
-      "value": true,
-      "satisfied": true,
-      "disclosure": "predicate"
-    }
-  ]
-}
-```
-
-This is an abridged response. Both predicates are true because `pw_001` exists
-and its status is `active`. The evidence response does not contain `north-01`,
-`water`, `active`, or the workbook row. Relay owns the bounded source read;
-Notary owns claim evaluation and disclosure.
-
 ## Run the maintained smoke check
 
 Run the development checks:
@@ -230,16 +201,16 @@ registryctl dev smoke
 ```text
 Development smoke: passed.
   unauthorized: status=denied; passed=true; token_counter_delta=unobserved; source_counter_delta=unobserved; minimized_claim_ids=none
-  authorized: status=authorized; passed=true; token_counter_delta=unobserved; source_counter_delta=unobserved; minimized_claim_ids=project-record-exists,project-status-accepted
+  authorized: status=authorized; passed=true; token_counter_delta=unobserved; source_counter_delta=unobserved; minimized_claim_ids=none
 ```
 
-The first scenario proves that the live evidence route denies the unauthenticated
-request. The second performs the authorized lookup and reports only the two
-configured claim identifiers. A local workbook has no request counter, so the
-runtime honestly reports those effects as `unobserved`. The derived offline
-authorization-before-source fixture still verifies the zero-source-effect
-denial invariant in Relay. The direct records requests above and this evidence
-smoke check exercise different public surfaces.
+The first scenario proves that the live records route denies the unauthenticated
+request. The second performs the authorized lookup. A local workbook has no
+request counter, so the runtime honestly reports those effects as `unobserved`.
+The starter authors no attribute release profile, so the authorized scenario
+releases no minimized attribute identifier and both lines report `none`. This
+check drives the same records route you called by hand above, without you
+handling the disposable credential.
 
 ## Inspect the contract you own
 
@@ -294,30 +265,27 @@ These are the four fields returned by your records request. Scope, purpose, and
 principal-bound filtering are independent gates. The generated development
 caller is convenient, but it does not weaken or bypass the authored policy.
 
-### Find the evidence policy
+### Find the consultation policy
 
 In the same file, find `public-works-verification`:
 
 ```yaml
+kind: consultation_api
+version: 1
 purpose: public-works-case-management
-access: { scopes: ["evidence:projects:read"] }
+legal_basis: public-service-delivery
+consent: not_required
 consultations:
   project:
     integration: project-record-snapshot
     input: { project_id: request.target.identifiers.project_id }
-claims:
-  project-record-exists:
-    cel: project.matched
-    disclosure: predicate
-  project-status-accepted:
-    cel: 'project.matched && project.status == "active"'
-    disclosure: predicate
 ```
 
 `integrations/project-record-snapshot/integration.yaml` allows the consultation
-Relay to expose only `status` to Notary. Both claims use predicate disclosure,
-so the evidence caller receives boolean decisions instead of that status or the
-record.
+Relay to expose only `status`, and nothing else from the workbook row. The
+records API and the consultation are separate services over the same entity:
+the four-field projection above belongs to `projects-records` and does not widen
+what the consultation may return.
 
 Inspect the focused offline trace when you want to see those boundaries without
 running the stack:
@@ -331,25 +299,19 @@ registryctl test \
 
 ```text
 Registry Stack test: passed for fictional-public-works-registry.
-Fixtures: 3.
+Fixtures: 1.
   PASS project-record-snapshot.match
     inputs: project_id
     calls: call=1 operation=snapshot method=GET path=/snapshot query=[] headers=[] body=none
     outputs: status
-    claims: project-record-exists, project-status-accepted
     outcome: match
-  PASS project-record-snapshot.match::derived/request_to_consultation_binding
-    inputs: project_id
-    calls: notary-relay-consultation
-    claims: project-record-exists, project-status-accepted
-    source access: true
-  PASS project-record-snapshot.match::derived/authorization_before_source
-    inputs: project_id
-    expected error: authorization.denied
-    source access: false
 Next: registryctl dev
 ```
 
+The trace names the one declared output. A widened projection or a second source
+call would appear on these lines, which is what makes the offline trace worth
+reading before you run anything.
+
 ## Stop the disposable runtime
 
 Stop the bound runtime and remove its generated development trust, credentials,
@@ -368,7 +330,7 @@ The authored project and workbook remain.
 ## Build the review inputs
 
 Review directly authored non-secret values, then build deterministic unsigned
-inputs for the three product lanes:
+inputs for the two product lanes:
 
 ```sh
 registryctl check --explain --show-authored-values
@@ -376,36 +338,36 @@ registryctl build
 ```
 
 Confirm the four-field records projection, the case-management purpose, the
-principal-bound `project_id`, the single `status` consultation output, and the
-two predicate claims. The build ends with:
+principal-bound `project_id`, and the single `status` consultation output. The
+build ends with:
 
 ```text
-Built unsigned signing inputs for relay-public, relay-consultation, notary.
+Built unsigned signing inputs for relay-public, relay-consultation.
 Build output: .registry-stack/build/local
 Next: bind an operator-managed source in a separate governed environment and rerun registryctl test; do not sign this file-backed build
 ```
 
-The public Relay, private consultation Relay, and Notary remain separate review
-and ownership lanes. Building does not approve, sign, or deploy them. Registry
+The public Relay and the private consultation Relay remain separate review and
+ownership lanes. Building does not approve, sign, or deploy them. Registry
 Stack 1.0 runs a project-local workbook only in the disposable development
 runtime. It does not package that workbook for a governed deployment.
 
 ## What you built
 
-You turned a spreadsheet into two deliberately different APIs:
+You turned a spreadsheet into two deliberately different surfaces:
 
 - The public Relay refused an anonymous call and returned one principal-bound,
   four-field record to an authorized caller.
-- The consultation Relay exposed only `status` to Notary after authorization.
-- Notary returned two predicate decisions without returning `status` or the
-  spreadsheet row.
+- The private consultation Relay declares a single `status` output over the same
+  entity and publishes no host port.
+- The two are separate signing lanes, so widening one does not widen the other.
 - Disposable credentials remained isolated in owner-only files instead of
   your shell environment or generated review inputs.
 
 ## Next
 
-- [Change the spreadsheet evidence rule](../verify-claim-registry-api/) in this
-  same project and watch `PW-002` become accepted.
+- [See Evidence answer over a Relay API](../first-run-with-solmara-lab/) in the
+  composed Solmara Lab demo.
 - [Use your own spreadsheet](../use-your-spreadsheet/) after the sample path
   works.
 - [Connect an existing HTTP registry](../author-registry-project/) when the
diff --git a/docs/site/src/content/docs/tutorials/refuse-unsafe-evidence-requests.mdx b/docs/site/src/content/docs/tutorials/refuse-unsafe-evidence-requests.mdx
new file mode 100644
index 000000000..eca81bc97
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/refuse-unsafe-evidence-requests.mdx
@@ -0,0 +1,206 @@
+---
+title: See Evidence refuse unsafe requests
+description: Cross the HTTP boundary with an unauthorized request, then prove that a modified assertion cannot be trusted.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: tutorial
+persona:
+  - assertion provider
+  - consumer or verifier
+locale: en
+standards_referenced: []
+---
+
+import QuickstartMeta from '../../../components/QuickstartMeta.astro';
+
+Complete [Return a governed value](../return-a-governed-value/) before starting this tutorial.
+You will reuse that project to observe two boundaries: Evidence denies a purpose the provider did
+not authorize, and the verifier rejects a response changed after signing.
+
+<QuickstartMeta
+  outcome="Two unsafe changes are refused without producing trusted evidence."
+  time="About 10 minutes"
+  level="Local development with synthetic data"
+  prerequisites={[
+    'The adult-status project after completing the governed-value tutorial',
+    'The registry.py source from the first Evidence tutorial',
+    'Python 3 and curl',
+  ]}
+/>
+
+## Restart the local boundary
+
+In the terminal that owns the Python registry, return to the `first-evidence-assertion` directory
+and start the source:
+
+```sh
+python3 registry.py
+```
+
+In another terminal, enter the existing project and start a fresh local generation:
+
+```sh
+cd adult-status
+evidencectl dev --detach
+```
+
+```text
+Evidence ready at http://127.0.0.1:8080
+Mint ready at http://127.0.0.1:8081
+```
+
+## Prepare one authorized request
+
+Prepare a normal age-bracket request. This records the exact verification expectations before any
+response exists:
+
+```sh
+evidencectl request prepare age-bracket \
+  --purpose service-path-selection \
+  --subject person_id=person-123 \
+  --name refusal-check
+```
+
+The provider authorized `service-path-selection`. Preparation also obtained short-lived local
+authorization for that exact authority path.
+
+## Change the purpose after preparation
+
+Copy the request, then change only its purpose:
+
+```sh
+cp .evidence/requests/refusal-check/request.json unauthorized-request.json
+python3 - <<'PY'
+import json
+from pathlib import Path
+
+path = Path("unauthorized-request.json")
+request = json.loads(path.read_text())
+request["purpose"] = "age-check"
+path.write_text(json.dumps(request))
+PY
+```
+
+The retained authorization does not grant `age-check` for this requirement. Send the changed
+request across the same HTTP boundary:
+
+```sh
+curl --silent --show-error \
+  --config .evidence/requests/refusal-check/authorization.curl \
+  --request POST \
+  --url http://127.0.0.1:8080/v1/evidence \
+  --header 'Content-Type: application/json' \
+  --header 'Accept: application/jose+json' \
+  --data-binary @unauthorized-request.json \
+  --output unauthorized-response.json \
+  --write-out 'HTTP %{http_code}\n'
+```
+
+```text
+HTTP 403
+```
+
+Inspect the public problem:
+
+```sh
+python3 -m json.tool unauthorized-response.json
+```
+
+The response identifies only the closed `not_authorized` problem and an opaque operation ID. It
+does not reveal source facts, selector values, grants, or credentials. The registry terminal shows
+no new `GET /people/person-123` because authorization failed before source access.
+
+## Obtain and verify the authorized response
+
+Now send the unchanged prepared request:
+
+```sh
+curl --silent --show-error \
+  --config .evidence/requests/refusal-check/authorization.curl \
+  --request POST \
+  --url http://127.0.0.1:8080/v1/evidence \
+  --header 'Content-Type: application/json' \
+  --header 'Accept: application/jose+json' \
+  --data-binary @.evidence/requests/refusal-check/request.json \
+  --output authorized-response.jws.json
+```
+
+Verify it against the expectations retained during preparation:
+
+```sh
+evidencectl verify authorized-response.jws.json \
+  --context .evidence/requests/refusal-check/verification.json \
+  --output authorized-response.verified.json
+```
+
+```text
+VERIFIED
+```
+
+This is the control case. The authorized, unchanged response is trusted.
+
+## Change the signed response
+
+Copy the flattened JWS and change one character in its signed payload:
+
+```sh
+cp authorized-response.jws.json tampered-response.jws.json
+python3 - <<'PY'
+import json
+from pathlib import Path
+
+path = Path("tampered-response.jws.json")
+document = json.loads(path.read_text())
+payload = document["payload"]
+document["payload"] = ("A" if payload[0] != "A" else "B") + payload[1:]
+path.write_text(json.dumps(document))
+PY
+```
+
+Try to verify the changed response:
+
+```sh
+if evidencectl verify tampered-response.jws.json \
+  --context .evidence/requests/refusal-check/verification.json \
+  --output tampered-response.verified.json
+then
+  echo 'unexpected verification success' >&2
+  exit 1
+fi
+test ! -e tampered-response.verified.json
+echo 'TAMPER REFUSED'
+```
+
+```text
+evidencectl: Evidence response verification failed
+TAMPER REFUSED
+```
+
+Verification fails without publishing a trusted payload. Your application must make decisions
+only from the verifier output, never from an unverified response body.
+
+## Clean up
+
+Stop the local services:
+
+```sh
+evidencectl dev stop
+```
+
+Return to the registry terminal and press `Ctrl+C`.
+
+## What you proved
+
+- A valid access token does not widen the provider's authorized purpose.
+- Authorization failure happens before the protected source is called.
+- A signed response cannot be changed without invalidating its signature.
+- Only verified output is safe for an application to consume.
+
+## Next
+
+- [Connect an institution source](../connect-an-institution-source/)
+- [Configure Evidence](../../configure/evidence/)
+- [Review the Evidence security model](../../security/evidence/)
diff --git a/docs/site/src/content/docs/tutorials/request-evidence-as-sd-jwt-vc.mdx b/docs/site/src/content/docs/tutorials/request-evidence-as-sd-jwt-vc.mdx
new file mode 100644
index 000000000..c00c40d08
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/request-evidence-as-sd-jwt-vc.mdx
@@ -0,0 +1,143 @@
+---
+title: Request Evidence as SD-JWT VC
+description: Enable SD-JWT VC on one governed Evidence grant, request the second serialization over HTTP, and verify the stored credential offline.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: how-to
+persona:
+  - assertion provider
+  - consumer or verifier
+locale: en
+standards_referenced: []
+---
+
+Start with a complete governed project. If you need to create and validate one,
+[connect an institution source from OpenAPI](../connect-an-institution-source/), then
+[prove the Evidence project](../prove-an-evidence-project/). Evidence can serialize the same
+stateless assertion as signed JWS or SD-JWT VC. The question, source access, derivation, supported
+values, subject binding, purpose, audience, signing key, and audit boundaries remain the same.
+
+Use this path with a complete governed deployment project. For a local authoring project, an
+`sdJwtVc` declaration on a reviewed structured answer enables the format at both gates.
+
+```yaml
+answers:
+  - concept: birth_certificate
+    type: reviewed-structured-value
+    schema: schemas/birth-certificate.yaml
+    maximumSerializedBytes: 2048
+    sdJwtVc:
+      claim: birthCertificate
+      disclosure: top-level
+```
+
+`birthCertificate` is adopter configuration, not a built-in Evidence claim. The `top-level` mode
+makes each direct field independently disclosable. A nested value, such as `placeOfBirth`, remains
+one atomic disclosure.
+
+## Permit the format at both gates
+
+Keep signed JWS enabled and add `sd-jwt-vc` to the bundle-wide response formats:
+
+```yaml
+responseFormats: [signed-jws, sd-jwt-vc]
+```
+
+Add the same format to the exact authority grant allowed to return it:
+
+```yaml
+authorityProfiles:
+  approved-caller:
+    kind: explicit-request
+    requesterTags: [approved-caller]
+    grants:
+      - requirement: urn:example:requirement:age-bracket:v1
+        purpose: service-path-selection
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws, sd-jwt-vc]
+        subjects:
+          - role: person
+            selectorProfile: person-reference-v1
+            valueOrigin: request
+```
+
+Both gates must permit the format. Enabling only one returns the ordinary authorization refusal
+before source access. An unknown or malformed `Accept` value returns HTTP 406.
+
+Run the normal candidate checks and deploy the exact reviewed revision:
+
+```sh
+evidencectl fixtures run --project "<evidence-project>"
+evidence check --runtime <evidence-project>/runtime.yaml
+```
+
+## Request the second serialization
+
+For a local project, retain the expected format before sending the request:
+
+```sh
+evidencectl request prepare "<question>" \
+  --purpose "<purpose>" \
+  --subject "<role>:<field>=<value>" \
+  --format sd-jwt-vc \
+  --name "<request-name>"
+```
+
+Only response negotiation changes at the HTTP boundary:
+
+```sh
+curl --silent --show-error --fail-with-body \
+  --config authorization.curl \
+  --request POST \
+  --url https://<evidence-host>/v1/evidence \
+  --header 'Content-Type: application/json' \
+  --header 'Accept: application/dc+sd-jwt' \
+  --data-binary @request.json \
+  --output assertion.sd-jwt
+```
+
+Treat `assertion.sd-jwt` as untrusted opaque input. Do not decode its disclosures into application
+state before verification.
+
+## Verify offline
+
+Use the same independently retained verification policy as the signed-JWS response. Name the
+format explicitly:
+
+```sh
+evidence verify \
+  --sd-jwt-vc assertion.sd-jwt \
+  --jwks trusted-issuer-keys.json \
+  --policy verification-policy.json
+```
+
+The verifier opens no network connection. `trusted-issuer-keys.json` is the complete approved trust
+set for the run, and `verification-policy.json` comes from the consumer's request and governance
+records, not from the credential.
+
+An unprojected value has one root disclosure. A configured structured value has one disclosure for
+each direct field. Evidence's current verifier checks the complete stored credential. It does not
+verify a selectively disclosed presentation from a wallet.
+
+## Keep the boundary explicit
+
+This response is not a credential lifecycle:
+
+- no OID4VCI offer, issuance session, token exchange, or wallet onboarding;
+- no status list, revocation, refresh, or reissuance;
+- no presentation exchange or key-binding JWT;
+- no general multi-verifier subject identifier.
+
+The subject binding remains scoped to the assertion's audience and purpose. An optional
+`holderKey` can place a public JWK in `cnf`, but that inclusion alone proves no possession and is
+outside this minimum path.
+
+Provider metadata is published at `/.well-known/jwt-vc-issuer`, and signing keys remain at
+`/.well-known/evidence/jwks.json`. Both are discovery. Approve trust independently through
+[Manage Evidence verifier trust](../manage-evidence-verifier-trust/).
+
+For deterministic source-tree proof of the full format and tamper refusals, see the
+[maintained SD-JWT VC demo](https://github.com/registrystack/registry-stack/blob/main/products/evidence/SD-JWT-VC-DEMO.md).
diff --git a/docs/site/src/content/docs/tutorials/return-a-governed-value.mdx b/docs/site/src/content/docs/tutorials/return-a-governed-value.mdx
new file mode 100644
index 000000000..782da8bac
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/return-a-governed-value.mdx
@@ -0,0 +1,235 @@
+---
+title: Return a governed value
+description: Add a controlled non-boolean answer to the first Evidence project and verify the signed result.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: tutorial
+persona:
+  - assertion provider
+locale: en
+standards_referenced: []
+---
+
+import QuickstartMeta from '../../../components/QuickstartMeta.astro';
+
+Complete [Get your first Evidence assertion](../first-evidence-assertion/) before starting this
+tutorial. You will add a governed age-bracket question to that project while keeping its adult
+status question. The same date of birth can then answer either question without disclosing the
+date or exact age.
+
+<QuickstartMeta
+  outcome="A verified assertion containing one controlled age-bracket value."
+  time="About 10 minutes"
+  level="Local development with synthetic data"
+  prerequisites={[
+    'The completed first Evidence assertion tutorial',
+    'Its adult-status project and registry.py',
+    'Python 3',
+    'A shell with curl',
+  ]}
+/>
+
+## Choose the minimum useful answer
+
+Adult status answers a yes-or-no criterion. A service that selects different paths for children,
+young adults, and older adults needs more information, but still does not need a date of birth or
+exact age.
+
+This tutorial permits four answers:
+
+- `under-18`
+- `18-to-24`
+- `25-to-64`
+- `65-or-older`
+
+The provider reviews this closed list. The caller cannot request a narrower bracket or an exact
+age.
+
+## Restart the registry
+
+In the terminal that owns the Python registry, return to the `first-evidence-assertion` directory
+and start the same source again:
+
+```sh
+python3 registry.py
+```
+
+Leave the registry running. The source still returns each synthetic person's identifier, name, and
+date of birth. This tutorial will use the child record, `person-456`, to exercise a different
+registry lookup from the first tutorial.
+
+## Add the age-bracket question
+
+In another terminal, enter the existing project:
+
+```sh
+cd adult-status
+```
+
+### `questions/age-bracket.yaml`
+
+Create a second question definition alongside `questions/adult-status.yaml`:
+
+```yaml
+id: age-bracket
+question: Which age bracket does this person belong to?
+purpose: service-path-selection
+subject:
+  role: person
+  selector: person_id
+source:
+  operation: getPerson
+  facts:
+    - name: date_of_birth
+      path: /date_of_birth
+      combine: exactly-one
+  collectionBounds: {}
+answers:
+  - concept: age_bracket
+    type: controlled-category
+    values: [under-18, 18-to-24, 25-to-64, 65-or-older]
+derivation: derivations/age-bracket.rhai
+disclosure:
+  allow: [age_bracket]
+```
+
+The new question uses the same OpenAPI operation, projected fact, and subject mapping as adult
+status. `values` defines the complete category list. The local compiler turns that list into the
+codelist enforced by the Evidence runtime.
+
+### `derivations/age-bracket.rhai`
+
+Create this new derivation alongside `derivations/adult-status.rhai`:
+
+```rhai
+fn answer(facts, selectors, context) {
+    let born = parse_date(required(facts.date_of_birth, "date_of_birth_missing"));
+    if compare_dates(context.legal_local_date, add_calendar_years(born, 18)) < 0 {
+        #{age_bracket: "under-18"}
+    } else if compare_dates(context.legal_local_date, add_calendar_years(born, 25)) < 0 {
+        #{age_bracket: "18-to-24"}
+    } else if compare_dates(context.legal_local_date, add_calendar_years(born, 65)) < 0 {
+        #{age_bracket: "25-to-64"}
+    } else {
+        #{age_bracket: "65-or-older"}
+    }
+}
+```
+
+The script chooses one category from the reviewed list. Evidence rejects any other return value
+before constructing or signing an assertion.
+
+## Start the updated project
+
+Capture the edited project in a new immutable local generation:
+
+```sh
+evidencectl dev --detach
+```
+
+```text
+Evidence ready at http://127.0.0.1:8080
+Mint ready at http://127.0.0.1:8081
+```
+
+The command compiles both files in `questions/` into the same local Evidence service. The adult
+status question remains available. Authentication, source bounds, signing, verification, and audit
+apply to both questions.
+
+## Request and verify the bracket
+
+Prepare a request for the updated question:
+
+```sh
+evidencectl request prepare age-bracket \
+  --purpose service-path-selection \
+  --subject person_id=person-456 \
+  --name age-bracket
+```
+
+Send the prepared request across the real HTTP boundary:
+
+```sh
+curl --silent --show-error \
+  --config .evidence/requests/age-bracket/authorization.curl \
+  --request POST \
+  --url http://127.0.0.1:8080/v1/evidence \
+  --header 'Content-Type: application/json' \
+  --header 'Accept: application/jose+json' \
+  --data-binary @.evidence/requests/age-bracket/request.json \
+  --output age-bracket.jws.json
+```
+
+Verify the response before reading the category:
+
+```sh
+evidencectl verify age-bracket.jws.json \
+  --context .evidence/requests/age-bracket/verification.json \
+  --output age-bracket.verified.json
+```
+
+```text
+VERIFIED
+```
+
+Inspect the verified payload:
+
+```sh
+python3 -m json.tool age-bracket.verified.json
+```
+
+The relevant supported value has this shape:
+
+```json
+{
+  "providesValueFor": "urn:registrystack:evidence:local:concept:age-bracket:age_bracket",
+  "value": "under-18"
+}
+```
+
+The source value `2012-05-20` is currently in the `under-18` category. The verified assertion
+does not include the date of birth, exact age, name, or `person_id`.
+
+Minimum disclosure is relative to the authorized purpose. A boolean was enough for the first
+question. A controlled category is enough for this service-path decision. Evidence protects both
+without treating boolean answers as the only minimized form.
+
+## Inspect the audit and clean up
+
+Stop the local Evidence services:
+
+```sh
+evidencectl dev stop
+```
+
+Inspect the last verified operation:
+
+```sh
+evidencectl audit show --last-operation
+```
+
+```text
+ACCESS AUTHORIZED age-bracket service-path-selection requester=<pseudonym>
+DISCLOSURE RELEASED age_bracket
+```
+
+The audit names the disclosed concept, not the category value or source fact.
+
+Remove the stopped generated runtime while preserving the editable project and request artifacts:
+
+```sh
+evidencectl dev clean
+```
+
+Return to the registry terminal and press `Ctrl+C`.
+
+## Next
+
+- [Control which applications can request Evidence](../control-who-can-request-evidence/)
+- [See Evidence refuse unsafe requests](../refuse-unsafe-evidence-requests/)
+- [Bind two people to one relationship assertion](../assert-a-role-bound-relationship/)
+- [Configure Evidence](../../configure/evidence/)
+- [Review the Evidence security model](../../security/evidence/)
diff --git a/docs/site/src/content/docs/tutorials/use-your-spreadsheet.mdx b/docs/site/src/content/docs/tutorials/use-your-spreadsheet.mdx
index 835c754e7..24a4da914 100644
--- a/docs/site/src/content/docs/tutorials/use-your-spreadsheet.mdx
+++ b/docs/site/src/content/docs/tutorials/use-your-spreadsheet.mdx
@@ -1,13 +1,12 @@
 ---
 title: Use your own spreadsheet
-description: Replace the sample workbook with a reviewed derivative and rebuild the protected Registry Relay and Registry Notary inputs.
+description: Replace the sample workbook with a reviewed derivative and rebuild the protected Registry Relay inputs.
 status: current
 owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-31"
+last_reviewed: "2026-08-04"
 doc_type: how-to
 locale: en
 standards_referenced: []
@@ -16,14 +15,15 @@ standards_referenced: []
 Use a reviewed non-personal workbook after the
 [spreadsheet first run](../publish-spreadsheet-secured-registry-api/) works.
 Registryctl validates the workbook against explicit authored schema, access,
-and evidence decisions.
+and consultation decisions.
 
 ## When to use this
 
 Use this path when the institution starts from an XLSX workbook or a reviewed
 XLSX derivative of another source.
 The 1.0 path deliberately supports a regular table with one header row.
-It does not infer relationships, formulas, access policy, or evidence meaning.
+It does not infer relationships, formulas, access policy, or the meaning of a
+record.
 
 Start with the maintained four-column shape to get a working result:
 
@@ -32,10 +32,10 @@ Start with the maintained four-column shape to get a working result:
 | `project_id` | Stable, unique record key |
 | `district_code` | Example protected registry field |
 | `sector` | Example protected registry field |
-| `status` | Bounded input to the sample evidence rule |
+| `status` | Bounded input to the sample consultation output |
 
 For a different schema, edit the entity definition, workbook mapping, records
-projection, snapshot output, claims, and fixtures together.
+projection, snapshot output, and fixtures together.
 The [project configuration reference](../../reference/project-configuration/)
 lists those fields.
 
@@ -133,32 +133,37 @@ It must also appear in this projection.
 The required `project_id` filter is bound to authenticated caller identity.
 A caller-supplied query value does not replace that binding.
 
-## Review the evidence meaning
+## Review the consultation meaning
 
-The same project declares two predicate claims:
+The same project declares one consultation service over the same snapshot:
 
 ```yaml
-    claims:
-      project-record-exists:
-        cel: project.matched
-        disclosure: predicate
-      project-status-accepted:
-        cel: 'project.matched && project.status == "active"'
-        disclosure: predicate
+  public-works-verification:
+    kind: consultation_api
+    version: 1
+    purpose: public-works-case-management
+    legal_basis: public-service-delivery
+    consent: not_required
+    consultations:
+      project:
+        integration: project-record-snapshot
+        input: { project_id: request.target.identifiers.project_id }
 ```
 
-Keep `project-record-exists` only when this bounded registry lookup has the
+Keep `public-works-verification` only when this bounded registry lookup has the
 meaning your institution intends.
-Rename or replace `project-status-accepted` when `active` does not express the
-reviewed policy.
-The sample claim is not a legal eligibility decision.
+Rename the service and its `purpose` when `public-works-case-management` does
+not express the reviewed policy.
+The consultation returns the integration's declared minimized outputs. It is
+not a legal eligibility decision.
 
 Update the synthetic fixtures under
-`integrations/project-record-snapshot/fixtures/` whenever the claim meaning
-changes.
+`integrations/project-record-snapshot/fixtures/` whenever the consultation
+meaning changes.
 Fixtures contain invented observations and expected results.
 Do not copy whole workbook rows into them. The selected smoke fixture below
-uses only one reviewed identifier and the evidence-relevant `status` value.
+uses only one reviewed identifier and the `status` value the consultation
+returns.
 
 ## Select one reviewed smoke row
 
@@ -197,14 +202,6 @@ Then replace
 ```yaml
 name: match
 classification: synthetic
-request:
-  target:
-    type: Project
-    identifiers: [{ scheme: project_id, value: pw_001 }]
-  claims: [project-record-exists, project-status-accepted]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: public-works-case-management
 input: { project_id: pw_001 }
 interactions:
   - expect: { method: GET, path: /snapshot }
@@ -212,25 +209,14 @@ interactions:
 expect:
   outcome: match
   outputs: { status: active }
-  claims:
-    project-record-exists: true
-    project-status-accepted: true
 ```
 
-with a synthetic observation matching only the selector and evidence meaning
-you intend to exercise:
+with a synthetic observation matching only the selector and the outcome you
+intend to exercise:
 
 ```yaml
 name: match
 classification: synthetic
-request:
-  target:
-    type: Project
-    identifiers: [{ scheme: project_id, value: institution_001 }]
-  claims: [project-record-exists, project-status-accepted]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: public-works-case-management
 input: { project_id: institution_001 }
 interactions:
   - expect: { method: GET, path: /snapshot }
@@ -238,15 +224,12 @@ interactions:
 expect:
   outcome: match
   outputs: { status: active }
-  claims:
-    project-record-exists: true
-    project-status-accepted: true
 ```
 
 Keep `development.default_fixture: match`. The fixture remains synthetic; the
 local snapshot smoke check separately confirms that the selected reviewed row
-is reachable through Relay and that Notary returns only the two predicate
-claims.
+is reachable through Relay and that the consultation returns only the declared
+`status` output.
 
 ## Validate the workbook and authored policy
 
@@ -260,15 +243,15 @@ A passing unchanged fixture set reports:
 
 ```text
 Registry Stack test: passed for fictional-public-works-registry.
-Fixtures: 8.
+Fixtures: 3.
 Next: registryctl dev
 ```
 
-This proves the authored evidence semantics against synthetic observations.
-It does not prove facts about the workbook.
+This proves the authored consultation semantics against synthetic
+observations. It does not prove facts about the workbook.
 
 Validate the actual workbook mapping, every selected row, the records policy,
-and the evidence configuration:
+and the consultation configuration:
 
 ```sh
 registryctl check --explain
@@ -278,13 +261,13 @@ A valid project begins with:
 
 ```text
 Registry Stack check: valid for fictional-public-works-registry.
-Fixtures: 8.
+Fixtures: 3.
 Explanation: registry.project.explanation.v1
 ```
 
 The explanation redacts workbook-sensitive and internal authored values.
 Use the named diagnostic path to correct a header, type, duplicate key, row
-limit, projection, or claim error.
+limit, projection, or consultation error.
 
 ## Run the local product boundaries
 
@@ -302,12 +285,13 @@ development plan. Registryctl does not start the synthetic HTTP source or
 generate source credentials for this mode.
 
 The smoke result reports one live authorization denial and one authorized
-result with minimized claim identifiers. It exercises Relay and Notary against
-the copied workbook using the reviewed request and expected claim shape. A
-local workbook has no request counter, so smoke reports source effects as
-`unobserved`; the derived offline security fixture verifies the
-authorization-before-source contract. If smoke fails, recheck the selected
-row, `match_principal`, `match.yaml`, and evidence rule together.
+result with `minimized_claim_ids=none`, because this project releases no
+attributes. It exercises both Relay lanes against the copied workbook using
+the reviewed request and expected output shape. A local workbook has no
+request counter, so smoke reports source effects as `unobserved`; the derived
+offline security fixture verifies the authorization-before-source contract. If
+smoke fails, recheck the selected row, `match_principal`, and `match.yaml`
+together.
 
 ## Build reviewable inputs
 
@@ -320,7 +304,7 @@ registryctl build
 Registryctl reports:
 
 ```text
-Built unsigned signing inputs for relay-public, relay-consultation, notary.
+Built unsigned signing inputs for relay-public, relay-consultation.
 Build output: .registry-stack/build/local
 Next: bind an operator-managed source in a separate governed environment and rerun registryctl test; do not sign this file-backed build
 ```
@@ -337,13 +321,13 @@ source before starting governed approval.
 Before handoff, confirm:
 
 - `registryctl test` passes with synthetic fixtures that express the reviewed
-  evidence meaning.
+  consultation meaning.
 - `registryctl check --explain` validates the copied workbook and names no
   diagnostic violations.
 - `registryctl dev smoke` records a live denial and minimized authorized
   output against the selected reviewed case; the derived fixture supplies the
   authorization-before-source evidence that a local file cannot count.
-- `registryctl build` emits all three unsigned product lanes.
+- `registryctl build` emits both unsigned product lanes.
 - If the project is under version control, its status does not include
   `.registry-stack/` or an unapproved workbook.
 
@@ -355,5 +339,5 @@ Before handoff, confirm:
 | Duplicate primary key | Two rows share `project_id`. | Resolve the source identity problem. Registry Stack does not choose a duplicate. |
 | Formula or external reference diagnostic | The selected worksheet contains computed or linked cells. | Replace them with reviewed static values. |
 | Unexpected field appears in Relay output | The field remains in `api.projection`. | Remove it and obtain review before rebuilding. |
-| Fixture passes but workbook check fails | Fixtures test authored evidence semantics, while `check` also validates the workbook mapping and rows. | Correct the workbook or authored mapping without copying sensitive workbook values into fixtures. |
-| Workbook check passes but smoke fails | The selected smoke request or expected claims no longer match the reviewed workbook case. | Update the development request fixture and expected claim shape to describe one non-sensitive reviewed example without copying unrelated rows. |
+| Fixture passes but workbook check fails | Fixtures test authored consultation semantics, while `check` also validates the workbook mapping and rows. | Correct the workbook or authored mapping without copying sensitive workbook values into fixtures. |
+| Workbook check passes but smoke fails | The selected smoke request or expected outputs no longer match the reviewed workbook case. | Update the development request fixture and expected output shape to describe one non-sensitive reviewed example without copying unrelated rows. |
diff --git a/docs/site/src/content/docs/tutorials/verify-a-registered-parent-with-opencrvs.mdx b/docs/site/src/content/docs/tutorials/verify-a-registered-parent-with-opencrvs.mdx
new file mode 100644
index 000000000..b49143665
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/verify-a-registered-parent-with-opencrvs.mdx
@@ -0,0 +1,789 @@
+---
+title: Issue registered-parent evidence from OpenCRVS
+description: >-
+  Connect Evidence to the public OpenCRVS demo, verify a registered-parent relationship, and
+  return governed parent identifiers when the use case requires them.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: tutorial
+persona:
+  - assertion provider
+locale: en
+standards_referenced: []
+---
+
+import QuickstartMeta from '../../../components/QuickstartMeta.astro';
+
+Complete [Assert a role-bound relationship](../assert-a-role-bound-relationship/) before starting
+this tutorial. You will apply that pattern to the public OpenCRVS Farajaland demo and answer two
+questions from the same registered birth. First verify, "Is this candidate registered as a parent
+of this child?" Then return the recorded mother and father national IDs for a caller authorized to
+receive them.
+
+<QuickstartMeta
+  outcome="Verified relationship and parent-identifier assertions from a synthetic OpenCRVS birth."
+  time="About 30 minutes"
+  level="Institution source with synthetic data"
+  prerequisites={[
+    'The completed role-bound relationship tutorial',
+    'The Evidence toolset',
+    'Access to the public OpenCRVS demo',
+    'curl and an editor',
+  ]}
+/>
+
+This tutorial uses synthetic data from a public demonstration system. Do not substitute a real
+person. The demo maintainers can reset its data, accounts, and integrations.
+
+## Understand the two disclosure paths
+
+The tutorial uses this provider-published synthetic registration:
+
+| Field | Value | Use |
+|---|---|---|
+| Child | Josh Hoeger | Find the registration in the web application |
+| Child national ID | `3617402568` | Select the registered birth through the Events API |
+| Tracking ID | `YADU1N` | Cross-check the registration in the web application |
+| Registration number | `CJWULMP0B6Z5` | Cross-check the registration in the web application |
+
+The registered birth contains an authenticated national ID for Josh's mother. It reports that the
+father's details are unavailable. You will copy the mother's national ID from the web application
+and use it as the candidate-parent selector.
+
+The relationship question has two distinct subject roles:
+
+- `child`, selected by the child's national ID
+- `candidate-parent`, selected by the candidate's national ID
+
+The source searches for one registered birth by `child.nid` and reads the bounded `mother.nid` and
+`father.nid` fields when present. One question compares those values with a candidate and returns
+only a boolean. A second question returns the parent identifiers in a closed, role-labeled value.
+The two questions use separate purposes and disclosure rules.
+
+## Inspect the synthetic registration
+
+Open the [Farajaland registration application](https://register.farajaland-integration.opencrvs.dev/)
+and sign in with the provider-published Registrar account:
+
+```text
+Username: k.mweene
+Password: test
+Two-factor code: 000000
+```
+
+Search for `3617402568`, `YADU1N`, or `CJWULMP0B6Z5`. Open Josh Hoeger's registered birth and note
+the mother's national ID. Keep it outside the tracked project. You can also use this account to
+create another synthetic registration.
+
+## Create your Record Search client
+
+The human account cannot authorize the Events API. Create a separate OAuth client for the
+tutorial instead of sharing an existing client ID or secret.
+
+In your own OpenCRVS deployment, sign in with a National System Admin account. OpenCRVS publishes
+this account for the Farajaland demo:
+
+```text
+Username: j.campbell
+Password: test
+Two-factor code: 000000
+```
+
+In **Configuration**, open **Integrations**, select **Create client**, and choose **Record Search**.
+Give the client a name that identifies your tutorial run. Copy the client ID and secret when
+OpenCRVS displays them. The secret is shown once.
+
+The client can search records. It cannot create, update, or delete registrations. OpenCRVS audits
+its searches and applies a daily request limit. Review the OpenCRVS guidance for
+[creating a client](https://documentation.opencrvs.org/technology/interoperability/apis-requiring-oauth-credentials/)
+and [Record Search clients](https://documentation.opencrvs.org/technology/interoperability/record-search-clients/)
+before using this pattern outside the demo.
+
+Do not put the OAuth credentials, access token, or a live response in source control. The private
+credentials used to validate this page are not part of the tutorial or repository.
+
+## Create the authoring project
+
+Create a working directory and download the reviewed tutorial subset of the OpenCRVS Events API:
+
+```sh
+mkdir opencrvs-parent-relationship
+cd opencrvs-parent-relationship
+curl -fsSLo opencrvs-events.openapi.yaml \
+  https://docs.registrystack.org/examples/evidence/opencrvs-events-search.openapi.yaml
+```
+
+OpenCRVS does not publish this bounded subset at a stable URL. Registry Stack maintains it for
+the tutorial and records its upstream review revision in the file. Review it against the target
+deployment before production use.
+
+Create an editable Evidence project and disposable local keys:
+
+```sh
+evidencectl new registered-parent \
+  --openapi opencrvs-events.openapi.yaml \
+  --profile local \
+  --generate-keys
+cd registered-parent
+```
+
+The command retains the OpenAPI document and creates empty authoring directories. It does not
+invent the source policy, relationship semantics, or question.
+
+## Draft the OpenCRVS source
+
+Select only the fields needed to establish cardinality, validate the birth, and compare its
+registered parents:
+
+```sh
+evidencectl source suggest \
+  --project . \
+  --source-id opencrvs-birth-parents \
+  --operation 'POST /events/search' \
+  --select /total \
+  --select '/results/*/type' \
+  --select '/results/*/status' \
+  --select '/results/*/declaration/child.nid' \
+  --select '/results/*/declaration/mother.nid' \
+  --select '/results/*/declaration/mother.verified' \
+  --select '/results/*/declaration/father.nid' \
+  --select '/results/*/declaration/father.verified'
+```
+
+The command writes one source, two scripts, and three schemas. They remain editable and cannot run
+until you supply the OpenCRVS-specific decisions.
+
+## Define the national-ID selector
+
+Create `selectors/opencrvs-national-id-v1.yaml`:
+
+```yaml
+maximumAggregateBytes: 128
+fields:
+  national_id:
+    type: string
+    minimumBytes: 1
+    maximumBytes: 128
+```
+
+The same bounded field can identify the child and candidate parent, but their roles remain
+distinct. A caller cannot omit a role or substitute another selector field.
+
+## Configure the bounded source
+
+Replace `sources/opencrvs-birth-parents.yaml` with:
+
+```yaml
+transport: http-json
+baseUrl: https://events.farajaland-integration.opencrvs.dev
+posture: record-transformed
+authentication:
+  kind: oauth2-client-credentials
+  tokenEndpoint: https://auth.farajaland-integration.opencrvs.dev/token
+  clientIdRef: secret:file/opencrvs-client-id
+  clientSecretRef: secret:file/opencrvs-client-secret
+  scope: recordsearch
+  credentialPlacement: form-body
+  maximumCacheSeconds: 300
+  assumedLifetimeSeconds: 600
+request:
+  method: POST
+  path: /events/search
+  fixedHeaders:
+    - name: Accept
+      value: application/json
+  selectorInputs:
+    - role: child
+      alternatives:
+        - profile: opencrvs-national-id-v1
+          fields: [national_id]
+  prepareScript: adapters/opencrvs-birth-parents-prepare.rhai
+  adapterParameters:
+    childSelectorRole: child
+    eventType: birth
+    registeredStatus: REGISTERED
+    childNationalIdField: child.nid
+    motherNationalIdField: mother.nid
+    motherVerificationField: mother.verified
+    fatherNationalIdField: father.nid
+    fatherVerificationField: father.verified
+    authenticatedValue: authenticated
+    resultLimit: 2
+    resultOffset: 0
+  adapterParametersSchema: schemas/opencrvs-birth-parents-parameters.schema.yaml
+  preparationLimits:
+    query: forbidden
+    jsonBody: required
+    maximumJsonDepth: 12
+    maximumCollectionItems: 32
+    maximumStringBytes: 512
+    maximumNormalizedBytes: 8192
+  projection:
+    - /total
+    - /results/*/type
+    - /results/*/status
+    - /results/*/declaration/child.nid
+    - /results/*/declaration/mother.nid
+    - /results/*/declaration/mother.verified
+    - /results/*/declaration/father.nid
+    - /results/*/declaration/father.verified
+  redirects: deny
+  timeoutMilliseconds: 10000
+  maximumResponseBytes: 262144
+  concurrencyLimit: 8
+responseSchema: schemas/opencrvs-birth-parents-response.schema.yaml
+extractScript: adapters/opencrvs-birth-parents-extract.rhai
+factSchema: schemas/opencrvs-birth-parents-facts.schema.yaml
+```
+
+`record-transformed` states that OpenCRVS returns a bounded birth record and Evidence reduces it
+before disclosure. The fixed event type and status prevent the caller from turning this source
+into a general search proxy. A two-result ceiling lets extraction distinguish one match from an
+ambiguous national ID without paging through the registry.
+
+The token endpoint accepts credentials in the form body. OpenCRVS omits an expiry from this demo's
+token response, so the source assumes 600 seconds and clamps caching to 300 seconds.
+
+## Store your client credentials
+
+Read the two values without echoing them and write owner-only files without a trailing newline:
+
+```sh
+umask 077
+printf 'OpenCRVS client ID: ' >&2
+IFS= read -rs OPENCRVS_CLIENT_ID
+printf '\n' >&2
+printf '%s' "$OPENCRVS_CLIENT_ID" > secrets/opencrvs-client-id
+unset OPENCRVS_CLIENT_ID
+
+printf 'OpenCRVS client secret: ' >&2
+IFS= read -rs OPENCRVS_CLIENT_SECRET
+printf '\n' >&2
+printf '%s' "$OPENCRVS_CLIENT_SECRET" > secrets/opencrvs-client-secret
+unset OPENCRVS_CLIENT_SECRET
+```
+
+Paste each value copied from OpenCRVS at its prompt and press Enter. The generated `.gitignore`
+excludes the `secrets` directory.
+
+Evidence resolves these logical secret references beneath that directory. It does not read the
+credentials from source YAML, requests, command arguments, or logs.
+
+## Prepare the fixed birth search
+
+Replace `adapters/opencrvs-birth-parents-prepare.rhai` with:
+
+```rhai
+fn prepare(selectors, parameters) {
+    let child = selectors[parameters["childSelectorRole"]];
+    let data = #{};
+    data[parameters["childNationalIdField"]] = #{
+        type: "exact",
+        term: child["values"]["national_id"]
+    };
+
+    #{
+        query: [],
+        body: #{
+            query: #{
+                type: "and",
+                clauses: [#{
+                    eventType: parameters["eventType"],
+                    status: #{
+                        type: "exact",
+                        term: parameters["registeredStatus"]
+                    },
+                    data: data
+                }]
+            },
+            limit: parameters["resultLimit"],
+            offset: parameters["resultOffset"]
+        }
+    }
+}
+```
+
+The script can read the authorized child selector and fixed parameters. It cannot read the
+candidate parent, credentials, caller identity, purpose, or signing keys.
+
+Replace `schemas/opencrvs-birth-parents-parameters.schema.yaml` with:
+
+```yaml
+type: object
+additionalProperties: false
+required:
+  - childSelectorRole
+  - eventType
+  - registeredStatus
+  - childNationalIdField
+  - motherNationalIdField
+  - motherVerificationField
+  - fatherNationalIdField
+  - fatherVerificationField
+  - authenticatedValue
+  - resultLimit
+  - resultOffset
+properties:
+  childSelectorRole: {const: child}
+  eventType: {const: birth}
+  registeredStatus: {const: REGISTERED}
+  childNationalIdField: {const: child.nid}
+  motherNationalIdField: {const: mother.nid}
+  motherVerificationField: {const: mother.verified}
+  fatherNationalIdField: {const: father.nid}
+  fatherVerificationField: {const: father.verified}
+  authenticatedValue: {const: authenticated}
+  resultLimit: {const: 2}
+  resultOffset: {const: 0}
+```
+
+The schema closes every parameter around its reviewed value. A later edit cannot silently change
+the event, status, search field, parent fields, verification value, or page size.
+
+## Extract authenticated parent identifiers
+
+The generated response schema closes the projected response around `total`, at most two results,
+and the selected declaration fields. Replace `adapters/opencrvs-birth-parents-extract.rhai` with:
+
+```rhai
+fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    let results = source_response["results"];
+    if results.len > parameters["resultLimit"] {
+        throw("source_protocol_error");
+    }
+
+    if total == 0 {
+        if results.len != 0 { throw("source_protocol_error"); }
+        return #{outcome: "no_match"};
+    }
+    if total > 1 {
+        if results.len < 2 { throw("source_protocol_error"); }
+        return #{outcome: "ambiguous"};
+    }
+    if results.len != 1 { throw("source_protocol_error"); }
+
+    let result = results[0];
+    if result["type"] != parameters["eventType"] ||
+       result["status"] != parameters["registeredStatus"] ||
+       !result.contains("declaration") {
+        throw("source_protocol_error");
+    }
+
+    let declaration = result["declaration"];
+    let child_field = parameters["childNationalIdField"];
+    if !declaration.contains(child_field) {
+        throw("source_protocol_error");
+    }
+
+    let parents = [];
+    let mother_field = parameters["motherNationalIdField"];
+    if declaration.contains(mother_field) {
+        let verification = parameters["motherVerificationField"];
+        if !declaration.contains(verification) ||
+           declaration[verification] != parameters["authenticatedValue"] {
+            throw("source_protocol_error");
+        }
+        parents.push(#{
+            role: "mother",
+            national_id: declaration[mother_field]
+        });
+    }
+
+    let father_field = parameters["fatherNationalIdField"];
+    if declaration.contains(father_field) {
+        let verification = parameters["fatherVerificationField"];
+        if !declaration.contains(verification) ||
+           declaration[verification] != parameters["authenticatedValue"] {
+            throw("source_protocol_error");
+        }
+        let father_id = declaration[father_field];
+        if parents.len == 1 && parents[0]["national_id"] == father_id {
+            throw("source_protocol_error");
+        }
+        parents.push(#{role: "father", national_id: father_id});
+    }
+
+    if parents.len == 0 || parents.len > 2 {
+        throw("source_protocol_error");
+    }
+
+    #{
+        outcome: "match",
+        facts: #{
+            child_national_id: declaration[child_field],
+            registered_parents: parents
+        }
+    }
+}
+```
+
+The script refuses inconsistent cardinality, incomplete births, and parent identifiers that the
+record does not mark as authenticated. An absent parent identifier is not converted into an
+invented parent. The source must establish at least one authenticated parent before the question
+can run.
+
+Replace `schemas/opencrvs-birth-parents-facts.schema.yaml` with:
+
+```yaml
+type: object
+additionalProperties: false
+required: [child_national_id, registered_parents]
+properties:
+  child_national_id:
+    type: string
+    minLength: 1
+    maxLength: 128
+  registered_parents:
+    type: array
+    minItems: 1
+    maxItems: 2
+    uniqueItems: true
+    items:
+      type: object
+      additionalProperties: false
+      required: [role, national_id]
+      properties:
+        role:
+          type: string
+          enum: [mother, father]
+        national_id:
+          type: string
+          minLength: 1
+          maxLength: 128
+```
+
+These facts are the complete input to both questions. Names, dates, addresses, and other birth
+fields cannot reach either derivation.
+
+## Author the relationship question
+
+Create `questions/registered-parent.yaml`:
+
+```yaml
+id: registered-parent
+question: Is the candidate registered as a parent of the child?
+purpose: relationship-check
+subjects:
+  - role: child
+    selector: national_id
+    profile: opencrvs-national-id-v1
+    derivation: true
+  - role: candidate-parent
+    selector: national_id
+    profile: opencrvs-national-id-v1
+    derivation: true
+source:
+  ref: opencrvs-birth-parents
+answers:
+  - concept: relationship_confirmed
+    type: boolean
+derivation: derivations/registered-parent.rhai
+disclosure:
+  allow: [relationship_confirmed]
+```
+
+The question declares the complete role set. `derivation: true` gives the script the child needed
+to verify the returned birth and the candidate needed for the comparison. The source search itself
+uses only the child. The question governs the one allowed purpose, answer, and disclosure. Sharing
+a selector profile does not make the two roles interchangeable.
+
+Create `derivations/registered-parent.rhai`:
+
+```rhai
+fn answer(facts, selectors, context) {
+    if facts.child_national_id != selectors.child.values.national_id {
+        throw("derivation_input_error");
+    }
+
+    let candidate = selectors["candidate-parent"]["values"]["national_id"];
+    let confirmed = false;
+    for parent in facts.registered_parents {
+        if parent["national_id"] == candidate {
+            confirmed = true;
+        }
+    }
+    #{relationship_confirmed: confirmed}
+}
+```
+
+The first check binds the returned birth to the requested child. The comparison checks the
+candidate against at most two authenticated parent identifiers, then returns only the declared
+boolean.
+
+## Author the parent-identifier question
+
+Create `schemas/registered-parent-national-ids.schema.yaml`:
+
+```yaml
+$id: urn:registrystack:evidence:local:schema:registered-parent-national-ids:v1
+type: object
+additionalProperties: false
+required: [parents]
+properties:
+  parents:
+    type: array
+    minItems: 1
+    maxItems: 2
+    uniqueItems: true
+    items:
+      type: object
+      additionalProperties: false
+      required: [role, national_id]
+      properties:
+        role:
+          type: string
+          enum: [mother, father]
+        national_id:
+          type: string
+          minLength: 1
+          maxLength: 128
+```
+
+This closed schema preserves each parent's role and rejects extra fields. The bounded array holds
+one or two role-labeled identifiers. The extraction script refuses to produce facts unless the
+source establishes at least one authenticated parent identifier.
+
+Create `questions/registered-parent-identifiers.yaml`:
+
+```yaml
+id: registered-parent-identifiers
+question: Which national IDs are recorded for the child's parents?
+purpose: family-case-record
+subject:
+  role: child
+  selector: national_id
+  profile: opencrvs-national-id-v1
+  derivation: true
+source:
+  ref: opencrvs-birth-parents
+answers:
+  - concept: registered_parent_national_ids
+    type: reviewed-structured-value
+    schema: schemas/registered-parent-national-ids.schema.yaml
+    maximumSerializedBytes: 512
+derivation: derivations/registered-parent-identifiers.rhai
+disclosure:
+  allow: [registered_parent_national_ids]
+```
+
+This question has no candidate-parent subject. The caller asks for the registered identifiers and
+must be authorized for the separate `family-case-record` purpose. In production, grant this
+question only to relying parties with a justified need for the identifiers. The boolean question
+remains available to callers that need only a relationship decision.
+
+Create `derivations/registered-parent-identifiers.rhai`:
+
+```rhai
+fn answer(facts, selectors, context) {
+    if facts.child_national_id != selectors.child.values.national_id {
+        throw("derivation_input_error");
+    }
+
+    #{
+        registered_parent_national_ids: #{
+            form: "reviewed-structured-value",
+            schema: "urn:registrystack:evidence:local:schema:registered-parent-national-ids:v1",
+            fields: #{parents: facts.registered_parents}
+        }
+    }
+}
+```
+
+Evidence validates the returned object against the reviewed schema before signing it. The
+derivation cannot add names, dates, addresses, or any other birth-registration field.
+
+## Start the project
+
+Compile the editable artifacts into a private local generation and start Evidence with Registry
+Mint:
+
+```sh
+evidencectl dev --detach
+```
+
+```text
+Evidence ready at http://127.0.0.1:8080
+Mint ready at http://127.0.0.1:8081
+```
+
+`dev` runs the real Evidence configuration check before either service becomes ready. Unresolved
+draft markers, invalid schemas, inconsistent roles, or missing credentials stop the start.
+
+## Send a real Evidence request
+
+Read the mother's national ID without leaving its value in shell history:
+
+```sh
+printf 'Mother national ID: ' >&2
+IFS= read -rs OPENCRVS_MOTHER_NID
+printf '\n' >&2
+```
+
+Prepare a request using Josh's national ID and that candidate-parent value:
+
+```sh
+evidencectl request prepare registered-parent \
+  --purpose relationship-check \
+  --subject child:national_id=3617402568 \
+  --subject "candidate-parent:national_id=$OPENCRVS_MOTHER_NID" \
+  --name opencrvs-parent
+unset OPENCRVS_MOTHER_NID
+```
+
+Use this only with the public synthetic record. In a real deployment, selectors need an input
+path that does not expose identifiers in shell history or process arguments.
+
+Preparation obtains short-lived local authorization and records verification expectations before
+a response exists. It does not contact OpenCRVS.
+
+Send the request across the Evidence HTTP boundary:
+
+```sh
+curl -fsS \
+  --config .evidence/requests/opencrvs-parent/authorization.curl \
+  --request POST \
+  --url http://127.0.0.1:8080/v1/evidence \
+  --header 'Content-Type: application/json' \
+  --header 'Accept: application/jose+json' \
+  --data-binary @.evidence/requests/opencrvs-parent/request.json \
+  --output opencrvs-parent.jws.json
+```
+
+Evidence exchanges its client credentials for an OpenCRVS token, performs the fixed child search,
+projects the bounded parent fields, derives the relationship, and returns a signed flattened JWS.
+The caller cannot alter the event type, status, projection, or parent verification rule.
+
+## Verify before reading
+
+Verify the response against the expectations created before the request:
+
+```sh
+evidencectl verify opencrvs-parent.jws.json \
+  --context .evidence/requests/opencrvs-parent/verification.json \
+  --output opencrvs-parent.verified.json
+```
+
+```text
+VERIFIED
+```
+
+Inspect the verified payload:
+
+```sh
+python3 -m json.tool opencrvs-parent.verified.json
+```
+
+Using the mother recorded on Josh's birth produces this supported value:
+
+```json
+{
+  "providesValueFor": "urn:registrystack:evidence:local:concept:registered-parent:relationship_confirmed",
+  "value": true
+}
+```
+
+The assertion contains pseudonymous `child` and `candidate-parent` bindings. It does not contain
+either national ID, the tracking ID, registration number, names, birth date, parent list, or exact
+source response. The civil-registration record stayed behind the source boundary.
+
+## Return the registered parent identifiers
+
+Prepare the second question. This request needs only the child because the answer returns the
+recorded parent identifiers instead of comparing one with a candidate:
+
+```sh
+evidencectl request prepare registered-parent-identifiers \
+  --purpose family-case-record \
+  --subject child:national_id=3617402568 \
+  --name opencrvs-parent-identifiers
+```
+
+Send the request across the same HTTP boundary:
+
+```sh
+curl -fsS \
+  --config .evidence/requests/opencrvs-parent-identifiers/authorization.curl \
+  --request POST \
+  --url http://127.0.0.1:8080/v1/evidence \
+  --header 'Content-Type: application/json' \
+  --header 'Accept: application/jose+json' \
+  --data-binary @.evidence/requests/opencrvs-parent-identifiers/request.json \
+  --output opencrvs-parent-identifiers.jws.json
+```
+
+Verify the signature and the expectations recorded for this question before reading its value:
+
+```sh
+evidencectl verify opencrvs-parent-identifiers.jws.json \
+  --context .evidence/requests/opencrvs-parent-identifiers/verification.json \
+  --output opencrvs-parent-identifiers.verified.json
+```
+
+```text
+VERIFIED
+```
+
+Inspect the verified payload:
+
+```sh
+python3 -m json.tool opencrvs-parent-identifiers.verified.json
+```
+
+Josh's public registration has an authenticated mother identifier but reports the father's
+details as unavailable. Its supported value therefore contains the mother field only:
+
+```json
+{
+  "providesValueFor": "urn:registrystack:evidence:local:concept:registered-parent-identifiers:registered_parent_national_ids",
+  "value": {
+    "form": "reviewed-structured-value",
+    "schema": "urn:registrystack:evidence:local:schema:registered-parent-national-ids:v1",
+    "fields": {
+      "parents": [
+        {
+          "role": "mother",
+          "national_id": "<mother-national-id>"
+        }
+      ]
+    }
+  }
+}
+```
+
+For a synthetic registration with two authenticated parent identifiers, `parents` contains a
+second item with role `father`. You can create such a registration in the demo and prepare the
+same question with that child's national ID.
+
+This assertion intentionally discloses identifiers. Store and transmit the verified result as
+sensitive civil-registration data. Callers that need only a relationship decision must use the
+boolean question instead.
+
+## Inspect the audit and clean up
+
+Stop the services, verify the audit chain, and remove the sealed local generation:
+
+```sh
+evidencectl dev stop
+evidencectl audit show --last-operation
+evidencectl dev clean
+```
+
+The audit identifies each authorized question, purpose, requester pseudonym, decision, and
+disclosed concept. It does not record selectors, the OpenCRVS token, source response, boolean, or
+returned national IDs.
+
+Keep the project, Record Search client, and two local credential files if you are continuing to the
+birth-certificate tutorial. Otherwise, delete the client in OpenCRVS and remove the credential
+files when you finish.
+
+## Next
+
+- [Request a birth certificate SD-JWT VC from OpenCRVS](../issue-a-birth-certificate-vc-from-opencrvs/)
+- [Issue an immunization summary from DHIS2](../issue-immunization-evidence-from-dhis2/)
+- [Draft another institution source from OpenAPI](../connect-an-institution-source/)
+- [Build and deploy an Evidence project](../build-and-deploy-evidence-project/)
+- [Verify an assertion as a consumer](../verify-an-assertion-as-a-consumer/)
diff --git a/docs/site/src/content/docs/tutorials/verify-an-assertion-as-a-consumer.mdx b/docs/site/src/content/docs/tutorials/verify-an-assertion-as-a-consumer.mdx
new file mode 100644
index 000000000..92dc2cae0
--- /dev/null
+++ b/docs/site/src/content/docs/tutorials/verify-an-assertion-as-a-consumer.mdx
@@ -0,0 +1,148 @@
+---
+title: Verify Evidence as a consumer
+description: Separate a stored response from independently retained trust and request expectations, then re-verify the decision offline.
+status: current
+owner: registry-docs
+source_repos:
+  - registry-stack
+last_reviewed: "2026-08-04"
+doc_type: tutorial
+persona:
+  - consumer or verifier
+locale: en
+standards_referenced: []
+---
+
+import QuickstartMeta from '../../../components/QuickstartMeta.astro';
+
+Complete [Get your first Evidence assertion](../first-evidence-assertion/) before starting this
+tutorial. You will reuse that assertion to show why an application must not trust an Evidence
+payload because it arrived over HTTPS or because it can be decoded, and how independently retained
+trust and request expectations support later offline review.
+
+<QuickstartMeta
+  outcome="An Evidence response re-verified offline at the recorded decision time."
+  time="About 10 minutes"
+  level="Local verification with synthetic data"
+  prerequisites={[
+    'The completed first Evidence assertion tutorial',
+    'The retained assertion.jws.json, verified.json, and first-assertion request artifacts',
+    'Python 3 and the evidence binary',
+  ]}
+/>
+
+## Start with three separate inputs
+
+Enter the existing project. No service or registry needs to be running:
+
+```sh
+cd adult-status
+```
+
+The prior preparation retained trust and expectations before the response existed. Split that
+local tutorial context into the same two verification inputs a production consumer governs
+independently:
+
+```sh
+umask 077
+python3 - <<'PY'
+import json
+from pathlib import Path
+
+context = json.loads(
+    Path(".evidence/requests/first-assertion/verification.json").read_text()
+)
+Path("trusted-issuer-keys.json").write_text(
+    json.dumps(context["trustedJwks"], indent=2) + "\n"
+)
+Path("verification-policy.json").write_text(
+    json.dumps(context["verificationPolicy"], indent=2) + "\n"
+)
+PY
+```
+
+You now have:
+
+- `assertion.jws.json`, the exact untrusted response bytes you stored;
+- `trusted-issuer-keys.json`, the public keys your relying party trusts;
+- `verification-policy.json`, expectations retained from your own request and governance.
+
+The tutorial extracts the latter two from the private local context because it recorded them before
+the response. A production consumer builds and stores them in its own transaction and trust
+records. Never decode an untrusted response and copy its claims into the policy used to verify that
+same response.
+
+## Re-verify the recorded decision
+
+Use the time from the already verified transaction record as the historical decision instant:
+
+```sh
+verified_at="$(python3 -c \
+  'import json; print(json.load(open("verified.json"))["issuedAt"])')"
+evidence verify \
+  --jws assertion.jws.json \
+  --jwks trusted-issuer-keys.json \
+  --policy verification-policy.json \
+  --at "$verified_at"
+```
+
+The result begins:
+
+```text
+verified-at: <recorded-instant>
+authentic: yes
+currently-valid: yes
+```
+
+The command then prints the verified Evidence payload. It opens no listener, contacts no issuer,
+fetches no discovery document, and calls no source. The named JWKS file is the complete trust set
+for this verification.
+
+`authentic` and `currently-valid` answer different questions. An expired stored response can remain
+authentic evidence of what was signed and accepted at an earlier decision time. It must not be used
+as a current answer. Record the instant at which your application made its decision and use that
+same instant for later audit re-verification.
+
+## Put the boundary in application code
+
+Your consuming application must preserve this order:
+
+1. Generate and retain the request nonce and all expected policy fields before sending the
+   request.
+2. Select the trusted provider identity and pinned key set through your own configuration.
+3. Store the returned bytes as untrusted input.
+4. Verify the exact response format against the retained policy and keys.
+5. Publish only the verified payload to decision logic.
+6. Record the verification instant, result, response digest, and policy revision under your own
+   retention rules.
+
+Do not expose a decoded payload through an application object that looks the same before and after
+verification. Use distinct types, files, or process boundaries so unverified input cannot reach a
+decision by accident.
+
+## Decide what to retain
+
+Retain enough to repeat the decision without asking the provider to recreate it:
+
+- the exact signed response bytes and their response format;
+- the original request or application transaction record that maps the internal person or case to
+  the request;
+- the request nonce and expected subjects, concepts, purpose, audience, provider, issuer, and
+  configuration revision;
+- the trusted JWKS revision used at the decision;
+- the verification instant and maximum accepted lifetime;
+- the resulting verified payload or a governed digest, according to your data-retention policy.
+
+This does not require retaining the source record. The application transaction record says that
+the request concerned `person-123`; the verification policy holds the expected opaque binding and
+nonce; and successful verification proves the signed response matches both. The assertion alone
+cannot reveal `person-123`.
+
+The opaque binding is meaningful only inside the audience and purpose for which the provider
+produced it. The same subject produces an unrelated binding for another audience or purpose.
+
+## Next
+
+- [Manage verifier trust and key rotation](../manage-evidence-verifier-trust/)
+- [Request SD-JWT VC serialization](../request-evidence-as-sd-jwt-vc/)
+- [Review the Evidence API](../../reference/apis/registry-evidence/)
diff --git a/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx b/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx
deleted file mode 100644
index f7a81ba5d..000000000
--- a/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx
+++ /dev/null
@@ -1,291 +0,0 @@
----
-title: Expose evidence from a spreadsheet registry
-description: Change one spreadsheet-backed evidence rule and verify that Relay and Notary preserve the source, authorization, and disclosure boundaries.
-status: current
-owner: registry-docs
-source_repos:
-  - registry-stack
-  - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-31"
-doc_type: tutorial
-locale: en
-standards_referenced: []
----
-
-import QuickstartMeta from '../../../components/QuickstartMeta.astro';
-
-Continue from inside the spreadsheet project directory named
-`my-first-registry`.
-You will change one evidence rule and verify it without adding another runtime,
-source path, or trust model.
-
-<QuickstartMeta
-  outcome="A reviewed change to one spreadsheet-backed predicate claim, verified offline and through the disposable Relay and Notary runtime."
-  time="About 15 minutes after completing the spreadsheet first run"
-  level="Local development with a contained spreadsheet"
-  prerequisites={['The unmodified my-first-registry project', 'A released Registryctl 1.0 installation', 'Docker Engine', 'Docker Compose 2.35.0 or later'] }
-/>
-
-The workbook, identifiers, and credentials remain synthetic.
-
-## Enter the spreadsheet project
-
-The final command in
-[Start a registry from a spreadsheet](../publish-spreadsheet-secured-registry-api/)
-leaves your shell inside `my-first-registry`.
-Stay in that directory.
-If you opened a new shell after completing that tutorial, enter the same
-project by using its absolute path:
-
-```sh
-cd /<path-to-parent>/my-first-registry
-```
-
-Do not run `cd my-first-registry` when your shell is already inside that
-directory.
-Run every remaining command from the project root that contains
-`registry-stack.yaml`.
-
-The spreadsheet starter already contains a protected Registry Relay records
-service and a Registry Notary evidence service.
-You do not need a separate `add notary` command.
-
-## Inspect the evidence boundary
-
-Open `registry-stack.yaml`.
-The `public-works-verification` service has one Relay consultation:
-
-```yaml
-consultations:
-  project:
-    integration: project-record-snapshot
-    input:
-      project_id: request.target.identifiers.project_id
-claims:
-  project-record-exists:
-    cel: project.matched
-    disclosure: predicate
-  project-status-accepted:
-    cel: 'project.matched && project.status == "active"'
-    disclosure: predicate
-```
-
-Relay performs the exact workbook snapshot lookup and releases only `status`
-to Notary.
-Notary evaluates the two predicate claims.
-The caller cannot supply a fallback claim value or choose another source field.
-
-`project-status-accepted` is example project policy.
-It does not establish legal eligibility, fraud, or another wider conclusion.
-
-## Observe the current policy result
-
-Run the planned fixture with its synthetic trace:
-
-```sh
-registryctl test \
-  --integration project-record-snapshot \
-  --fixture planned \
-  --trace
-```
-
-The trace reports a matched synthetic project with `status: planned`.
-The initial expectation is:
-
-```yaml
-expect:
-  outcome: match
-  outputs: { status: planned }
-  claims:
-    project-record-exists: true
-    project-status-accepted: false
-```
-
-This is a policy non-match.
-It is different from the `no-match` fixture, where the bounded lookup found no
-record for the synthetic key.
-
-## Change the authored evidence rule
-
-In `registry-stack.yaml`, replace:
-
-```yaml
-      project-status-accepted:
-        cel: 'project.matched && project.status == "active"'
-        disclosure: predicate
-```
-
-with:
-
-```yaml
-      project-status-accepted:
-        cel: 'project.matched && (project.status == "active" || project.status == "planned")'
-        disclosure: predicate
-```
-
-The expression remains rooted in the single `project` consultation.
-Do not replace it with a caller-supplied value or a source-free assertion.
-
-In `integrations/project-record-snapshot/fixtures/planned.yaml`, update the
-expected claim:
-
-```yaml
-expect:
-  outcome: match
-  outputs: { status: planned }
-  claims:
-    project-record-exists: true
-    project-status-accepted: true
-```
-
-Keep the synthetic source observation `status: planned`.
-Only the authored rule and its expected result changed.
-
-## Verify the evidence rule offline
-
-Run the focused trace again:
-
-```sh
-registryctl test \
-  --integration project-record-snapshot \
-  --fixture planned \
-  --trace
-```
-
-The planned fixture now reports both claims as true.
-
-Run every fixture:
-
-```sh
-registryctl test
-```
-
-The match, planned, and no-match cases plus their security cases must pass.
-A false existence predicate means no match in this bounded source snapshot.
-It does not mean global nonexistence, fraud, ineligibility, or a legal negative.
-
-## Run the changed Relay and Notary path
-
-In `environments/local.yaml`, replace:
-
-```yaml
-development:
-  source_mode: local_snapshot
-  default_integration: project-record-snapshot
-  default_fixture: match
-```
-
-with:
-
-```yaml
-development:
-  source_mode: local_snapshot
-  default_integration: project-record-snapshot
-  default_fixture: planned
-```
-
-Each environment declares one development scenario.
-Registryctl does not use a command-line fixture selector for `dev`.
-The maintained `planned` fixture already contains the development evidence
-request for `PW-002`. Relay resolves that request against the mounted workbook,
-not a synthetic source substitute.
-
-Start the disposable runtime:
-
-```sh
-registryctl dev --detach
-```
-
-Copy the command printed after `Evidence request:` and run it unchanged. The
-abridged response now shows both predicates as true for `PW-002`:
-
-```json
-{
-  "results": [
-    {
-      "claim_id": "project-record-exists",
-      "value": true,
-      "disclosure": "predicate"
-    },
-    {
-      "claim_id": "project-status-accepted",
-      "value": true,
-      "disclosure": "predicate"
-    }
-  ]
-}
-```
-
-The response still contains neither the workbook row nor `status: planned`.
-The rule changed the evidence decision, not its disclosure boundary.
-
-Run the maintained checks:
-
-```sh
-registryctl dev smoke
-```
-
-The denial result must be denied with no claim identifiers. The authorized
-result must report only `project-record-exists,project-status-accepted` as
-claim identifiers. Local workbook effects are reported as `unobserved`; the
-derived offline security fixture proves the zero-source-effect denial ordering.
-Neither result may return a workbook row or the source `status` value.
-
-Stop the disposable runtime:
-
-```sh
-registryctl dev down
-```
-
-The authored rule and fixture change remain in the project.
-Development trust and credentials are removed.
-
-## Review and build the change
-
-Review the authored non-secret values:
-
-```sh
-registryctl check --explain --show-authored-values
-```
-
-Confirm that the exact selector, single-field consultation output, one
-consultation, and predicate disclosures did not change.
-
-Build new unsigned product inputs:
-
-```sh
-registryctl build
-```
-
-Registryctl reports which product lanes changed.
-The build does not approve, sign, deploy, or activate the new rule.
-
-## What you changed
-
-You changed one bounded evidence rule while preserving:
-
-- Authorization before any workbook access
-- One exact Relay lookup
-- A single minimized `status` value from Relay to Notary
-- Predicate-only disclosure to the caller
-- Separate Relay and Notary approval lanes
-
-## Next
-
-- [Use your own spreadsheet](../use-your-spreadsheet/) to adapt the source and
-  policy together.
-- [Connect an existing HTTP registry](../author-registry-project/) when the
-  evidence comes from an institution-owned API or the project is ready for
-  governed deployment. Project-local workbooks remain development-only in
-  Registry Stack 1.0.
-
-## Troubleshooting
-
-| Symptom | Cause | Resolution |
-| --- | --- | --- |
-| The planned fixture remains false | The rule or expected fixture result was not updated. | Keep the observation unchanged and update both authored policy surfaces. |
-| Another fixture fails | The rule changed a broader contract. | Review every reported fixture before building. |
-| `dev smoke` still uses `match` | The local default fixture was not changed. | Update `development.default_fixture` and start the runtime again. |
-| Denial performs source work | Authorization did not stop the lookup. | Stop the runtime and report the failure through the security process. |
-| A generated artifact differs | A file under `.registry-stack/` was edited. | Remove disposable generated state and rebuild from authored files. |
diff --git a/docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx b/docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx
index 9c28f31de..973cff91f 100644
--- a/docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx
+++ b/docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx
@@ -6,14 +6,14 @@ owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-last_reviewed: "2026-07-30"
+last_reviewed: "2026-08-03"
 doc_type: how-to
 locale: en
 standards_referenced: []
 ---
 
-Use this case study to exercise an OpenCRVS Events API-shaped event search through Registry
-Stack's generic OAuth, bounded HTTP, and Rhai path.
+Complete [Add OAuth-backed Rhai adaptation](../configure-project-script-adapter/) before starting
+this case study. You will apply that workflow to an OpenCRVS Events API-shaped event search.
 The example is synthetic and does not establish compatibility with an OpenCRVS deployment.
 
 ## When to use this
@@ -35,8 +35,7 @@ This page exercises exactly this synthetic example:
 - A response limited to two results with `id`, `type`, `status`, and `trackingId`
 - One Rhai mapping that checks cardinality, event type, and the returned tracking id
 - Minimized outputs `event_type` and `registered`
-- Two Notary predicate claims, `birth-event-found` and `birth-event-registered`, rooted in one
-  Relay consultation
+- One consultation service, `birth-event-verification`, holding exactly one Relay consultation
 - Match, no match, ambiguity, source rejection, subject mismatch, malformed source response,
   timeout, OAuth redirect, OAuth media type, token type, extra-member, expiry, oversize response,
   and authorization denial cases
@@ -107,7 +106,7 @@ copying a source-tree fixture.
 
 Keep every identifier, credential, token, and source response synthetic.
 The maintained executable example uses registry id `synthetic-opencrvs-events-api`, integration
-alias `birth-event-search`, and evidence service `birth-event-verification`.
+alias `birth-event-search`, and consultation service `birth-event-verification`.
 These names identify the synthetic project only.
 
 ## Declare the synthetic event lookup
@@ -203,7 +202,7 @@ development:
 The `.invalid` origins prevent accidental contact with a real deployment.
 The environment stores secret references, not values.
 Relay owns token acquisition, the authorization header, and the source call.
-Rhai and Notary receive no client secret, token, or token response.
+Rhai scripts and consultation callers receive no client secret, token, or token response.
 
 ## Map the minimized outputs
 
@@ -261,39 +260,29 @@ The adapter constructs the closed output object field by field.
 It does not return the response, event id, tracking id, declaration, OAuth material, or
 source-only metadata.
 
-## Keep one consultation-backed claim
+## Keep one consultation-backed service
 
-The overlay replaces the starter evidence service in `registry-stack.yaml` with:
+The overlay replaces the starter service in `registry-stack.yaml` with:
 
 ```yaml
 services:
   birth-event-verification:
-    kind: evidence
+    kind: consultation_api
     version: 1
     purpose: birth-event-registration-verification
     legal_basis: public-service-delivery
     consent: not_required
-    access:
-      scopes: ["evidence:birth-event:read"]
     consultations:
       event:
         integration: birth-event-search
         input:
           tracking_id: request.target.identifiers.opencrvs_tracking_id
-    claims:
-      birth-event-found:
-        cel: event.matched
-        disclosure: predicate
-      birth-event-registered:
-        cel: >-
-          event.matched
-            && event.event_type == "birth"
-            && event.registered
-        disclosure: predicate
 ```
 
-Both claims have exactly one Relay consultation.
-There is no self-attested, source-free, or caller-defined fallback.
+The service declares exactly one consultation, and that consultation derives from exactly one
+declared integration.
+There is no self-attested, source-free, or caller-defined fallback: the only way to reach an
+answer is the authorized source read.
 
 ## Author the synthetic match fixture
 
@@ -302,15 +291,6 @@ The exact `integrations/birth-event-search/fixtures/match.yaml` file is:
 ```yaml
 name: birth-event-match
 classification: synthetic
-request:
-  target:
-    type: Person
-    identifiers:
-      - { scheme: opencrvs_tracking_id, value: TRK-SYNTH000001 }
-  claims: [birth-event-found, birth-event-registered]
-  disclosure: predicate
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: birth-event-registration-verification
 input: { tracking_id: TRK-SYNTH000001 }
 interactions:
   - expect:
@@ -353,9 +333,6 @@ expect:
   outputs:
     event_type: birth
     registered: true
-  claims:
-    birth-event-found: true
-    birth-event-registered: true
 ```
 
 The public overlay also contains the exact synthetic fixtures for no match, ambiguity, source
@@ -389,12 +366,13 @@ registryctl dev down
 ```
 
 The denial scenario reports zero token and source calls.
-The authorized scenario reports one token call, one source call, and only
-`birth-event-found,birth-event-registered` as minimized claim identifiers.
+The authorized scenario reports one token call, one source call, and
+`minimized_claim_ids=none`, because this project releases no attributes and returns only the
+declared consultation outputs.
 
 ## Review and build
 
-Review the redacted plan and build the three product-lane inputs:
+Review the redacted plan and build the two product-lane inputs:
 
 ```sh
 registryctl check --explain
@@ -402,7 +380,6 @@ registryctl build
 ```
 
 Confirm that OAuth, Rhai, source access, and minimized outputs remain in `relay-consultation`.
-Confirm that claim evaluation and disclosure remain in `notary`.
 The generated result is still synthetic fixture evidence.
 
 ## Record the evidence limits
@@ -412,7 +389,7 @@ State all of these limits with the case-study result:
 - The request and response are synthetic.
 - The OAuth profile is the exact closed profile declared in the project.
 - The Rhai mapping is the reviewed script digest.
-- The output and claim are the exact ids declared in the project.
+- The outputs are the exact ids declared in the project.
 - Only the executed negative cases have evidence.
 
 Do not claim live OpenCRVS compatibility, maintainer endorsement, country-configuration
diff --git a/docs/site/src/content/docs/verify/index.mdx b/docs/site/src/content/docs/verify/index.mdx
index 9b87ed36c..116c0a2b7 100644
--- a/docs/site/src/content/docs/verify/index.mdx
+++ b/docs/site/src/content/docs/verify/index.mdx
@@ -6,8 +6,8 @@ owner: registry-docs
 source_repos:
   - registry-stack
   - registry-relay
-  - registry-notary
-last_reviewed: "2026-07-27"
+  - registry-evidence
+last_reviewed: "2026-08-03"
 doc_type: how-to
 locale: en
 standards_referenced: []
diff --git a/docs/site/src/data/contracts.yaml b/docs/site/src/data/contracts.yaml
index 2e341961b..056e47353 100644
--- a/docs/site/src/data/contracts.yaml
+++ b/docs/site/src/data/contracts.yaml
@@ -6,12 +6,12 @@
   source_of_truth:
     label: Registry Platform crates
     url: https://github.com/registrystack/registry-stack/tree/d45761a0104bd3d9c2e4b4db391d4223f289bd44/crates
-  consumer_note: Relay, Notary, and future registry services should consume these primitives instead of reimplementing security or operational behavior locally.
+  consumer_note: Relay, Evidence, Registry Mint, and future registry services should consume these primitives instead of reimplementing security or operational behavior locally.
 - id: registry-platform.ops-posture-v1
   name: Registry Ops Posture v1
   owner: registry-platform
   status: current-source
-  surface: Versioned JSON Schema for protected Registry Relay and Registry Notary operations posture observations, including the shared envelope, component sections, default and restricted sensitivity tiers, deployment findings, audit state, and standards-artifact references.
+  surface: Versioned JSON Schema for protected Registry Relay operations posture observations, including the shared envelope, component sections, default and restricted sensitivity tiers, deployment findings, audit state, and standards-artifact references. The frozen v1 shape still models the retired Registry Notary component so that a consumer can validate a document it already holds.
   source_of_truth:
     label: Registry Ops Posture v1 JSON Schema
     url: https://github.com/registrystack/registry-stack/blob/c84b1b9288b925e7c9cc89c47c33cc1f50753d8c/crates/registry-platform-ops/schemas/registry.ops.posture.v1.schema.json
@@ -29,43 +29,7 @@
     label: Registry Relay abstract OpenAPI contract
     url: https://github.com/registrystack/registry-stack/blob/d45761a0104bd3d9c2e4b4db391d4223f289bd44/crates/registry-relay/openapi/registry-relay.openapi.json
   consumer_note: Hand-authored from `docs/api.md` and the runtime route table. Uses templated paths and capability tags. For instance-specific shape of `{dataset_id}` and `{entity}`, fetch `GET /openapi.json` from a configured gateway. Runtime deployments gate that route by default unless `openapi_requires_auth` is disabled for demos or controlled tooling.
-- id: registry-notary.openapi
-  name: Registry Notary OpenAPI
-  owner: registry-notary
-  status: pinned-generated-snapshot
-  surface: Claim discovery, claim evaluation, batch evaluation, federated delegated evaluation, rendering, JWKS, service metadata, and credential issuance.
-  source_of_truth:
-    label: Registry Notary OpenAPI generator
-    url: https://github.com/registrystack/registry-stack/blob/d45761a0104bd3d9c2e4b4db391d4223f289bd44/crates/registry-notary-server/src/openapi.rs
-  consumer_note: Generate with `cargo run -p registry-notary -- openapi`. Both direct and OID4VCI credential routes require a fresh non-delegated stored evaluation with exact claim pins and normalized unique Relay execution records for every selected root's registry-backed dependency closure.
-- id: registry-notary.oid4vci
-  name: Registry Notary OID4VCI surface
-  owner: registry-notary
-  status: current-source
-  surface: OID4VCI issuer metadata, Type Metadata, offer start and authenticated callback, pre-authorized token redemption, and registry-backed credential issuance. The wallet-facing grant is issuer-initiated pre-authorized code. Primitives are sourced from the `registry-platform-oid4vci` crate.
-  source_of_truth:
-    label: Registry Notary OID4VCI routes
-    url: https://github.com/registrystack/registry-stack/blob/d45761a0104bd3d9c2e4b4db391d4223f289bd44/crates/registry-notary-server/src/api.rs
-  consumer_note: >-
-    Registry Notary advertises `dc+sd-jwt`, EdDSA `did:jwk` holder proof, and
-    the configured EdDSA or ES256 issuer algorithm. Credential configurations
-    accept non-delegated registry-backed claims only, and issuance verifies the
-    stored transaction plus exact dependency-closure Relay execution provenance
-    before signing. Transaction code is required by default. An explicit
-    no-PIN profile has a maximum 300-second bearer-offer window. There is no
-    wallet-facing authorization-code grant, public nonce route, response next
-    nonce, issuance from caller-provided evidence, ES256 holder proof, PAR, DPoP, wallet
-    attestation, EUDI, or HAIP claim. External wallet and verifier evidence is
-    candidate-only until recorded against a frozen artifact.
-- id: registry-notary.federated-evaluation
-  name: Registry Notary Federated Evaluation MVP
-  owner: registry-notary
-  status: current-source
-  surface: Static-peer delegated evaluation over `POST /federation/v1/evaluations`, compact JWS request and response JWTs, peer policy checks, pairwise subject handles, replay protection, and federation audit fields.
-  source_of_truth:
-    label: Registry Notary federation module
-    url: https://github.com/registrystack/registry-stack/tree/d45761a0104bd3d9c2e4b4db391d4223f289bd44/crates/registry-notary-server/src/federation
-  consumer_note: This is delegated evaluation only. Open federation, trust-chain discovery, shared replay storage, audit checkpoint exchange, and federated credential issuance are outside the MVP.
+
 - id: registry-manifest.metadata-yaml
   name: Metadata Manifest
   owner: registry-manifest
diff --git a/docs/site/src/data/docsets.yaml b/docs/site/src/data/docsets.yaml
index 0417b6e5d..b72df2eb4 100644
--- a/docs/site/src/data/docsets.yaml
+++ b/docs/site/src/data/docsets.yaml
@@ -16,10 +16,10 @@ docsets:
       registry-relay:
         version: main source (unreleased)
         ref: HEAD
-      registry-notary:
+      registry-manifest:
         version: main source (unreleased)
         ref: HEAD
-      registry-manifest:
+      registry-evidence:
         version: main source (unreleased)
         ref: HEAD
   - id: v0.16.3
diff --git a/docs/site/src/data/generated/configuration-reference-coverage.json b/docs/site/src/data/generated/configuration-reference-coverage.json
index 5293f4f1b..22dc19111 100644
--- a/docs/site/src/data/generated/configuration-reference-coverage.json
+++ b/docs/site/src/data/generated/configuration-reference-coverage.json
@@ -16,8 +16,7 @@
       "integration",
       "fixture",
       "entity",
-      "relay",
-      "notary"
+      "relay"
     ],
     "schema_sources": [
       "project.schema.json",
@@ -25,92 +24,51 @@
       "integration.schema.json",
       "fixture.schema.json",
       "entity.schema.json",
-      "registry-relay.config.schema.json",
-      "registry-notary.config.schema.json"
+      "registry-relay.config.schema.json"
     ],
     "field_knowledge": "schemas/project-authoring/parity-coverage.json#field_knowledge",
     "human_intent": "schemas/project-authoring/documentation-intent.json",
     "runtime_intent": [
-      "crates/registry-relay/config/documentation-intent.json",
-      "crates/registry-notary-core/config/documentation-intent.json"
+      "crates/registry-relay/config/documentation-intent.json"
     ],
     "reads_country_workspaces": false,
     "reads_runtime_configuration": false
   },
   "coverage": {
-    "schema_count": 7,
-    "path_count": 1829,
-    "reference_count": 506,
+    "schema_count": 6,
+    "path_count": 1155,
+    "reference_count": 363,
     "by_schema": {
-      "project": 220,
-      "environment": 213,
+      "project": 191,
+      "environment": 126,
       "integration": 171,
-      "fixture": 63,
+      "fixture": 39,
       "entity": 35,
-      "relay": 593,
-      "notary": 534
+      "relay": 593
     },
     "by_path_kind": {
-      "root": 7,
-      "property": 1458,
-      "map_key": 26,
-      "map_value": 48,
-      "array_item": 178,
-      "branch": 112
+      "root": 6,
+      "property": 903,
+      "map_key": 22,
+      "map_value": 34,
+      "array_item": 102,
+      "branch": 88
     },
     "by_sensitivity": {
       "public": 16,
-      "internal": 1179,
-      "sensitive": 408,
-      "secret_reference": 44,
-      "redacted_fixture": 51,
-      "structural": 131
+      "internal": 878,
+      "sensitive": 106,
+      "secret_reference": 26,
+      "redacted_fixture": 29,
+      "structural": 100
     },
     "by_intent_source": {
-      "schema_description": 530,
-      "reviewed_override": 266,
-      "structural_taxonomy": 131,
-      "reviewed_profile": 902
+      "schema_description": 405,
+      "reviewed_override": 232,
+      "structural_taxonomy": 104,
+      "reviewed_profile": 414
     },
     "by_intent_profile": {
-      "notary_audit_internal": 4,
-      "notary_audit_secret_reference": 1,
-      "notary_audit_sensitive": 2,
-      "notary_auth_internal": 13,
-      "notary_auth_oidc_scope_map_open_map": 1,
-      "notary_auth_secret_reference": 4,
-      "notary_auth_sensitive": 95,
-      "notary_cel_internal": 14,
-      "notary_config_trust_internal": 1,
-      "notary_config_trust_sensitive": 4,
-      "notary_credential_status_sensitive": 4,
-      "notary_deployment_internal": 13,
-      "notary_deployment_sensitive": 1,
-      "notary_evidence_claims_evidence_mode_consultations_inputs_open_map": 1,
-      "notary_evidence_claims_evidence_mode_consultations_open_map": 1,
-      "notary_evidence_claims_evidence_mode_consultations_output_fields_open_map": 1,
-      "notary_evidence_claims_evidence_mode_consultations_outputs_open_map": 1,
-      "notary_evidence_credential_profiles_open_map": 1,
-      "notary_evidence_internal": 93,
-      "notary_evidence_secret_reference": 5,
-      "notary_evidence_sensitive": 41,
-      "notary_evidence_signing_keys_open_map": 1,
-      "notary_evidence_variables_open_map": 1,
-      "notary_federation_internal": 43,
-      "notary_federation_secret_reference": 1,
-      "notary_federation_sensitive": 5,
-      "notary_instance_internal": 5,
-      "notary_instance_sensitive": 1,
-      "notary_oid4vci_credential_configurations_open_map": 1,
-      "notary_oid4vci_internal": 33,
-      "notary_oid4vci_sensitive": 51,
-      "notary_root_structural": 1,
-      "notary_server_internal": 13,
-      "notary_server_sensitive": 2,
-      "notary_state_internal": 6,
-      "notary_state_secret_reference": 2,
-      "notary_state_sensitive": 1,
-      "notary_subject_access_sensitive": 66,
       "relay_audit_internal": 9,
       "relay_audit_secret_reference": 1,
       "relay_audit_sensitive": 1,
@@ -148,10 +106,10 @@
       "relay_vocabularies_open_map": 1
     }
   },
-  "reviewed_intent_assignment_required_count": 1829,
-  "reviewed_intent_assignment_covered_count": 1829,
-  "distinct_reviewed_intent_count": 629,
-  "distinct_reviewed_intents_reused_count": 86,
-  "reviewed_intent_assignments_using_reused_intent_count": 1286,
+  "reviewed_intent_assignment_required_count": 1155,
+  "reviewed_intent_assignment_covered_count": 1155,
+  "distinct_reviewed_intent_count": 490,
+  "distinct_reviewed_intents_reused_count": 62,
+  "reviewed_intent_assignments_using_reused_intent_count": 727,
   "missing_intent": []
 }
diff --git a/docs/site/src/data/generated/configuration-reference.json b/docs/site/src/data/generated/configuration-reference.json
index 85e52bb36..acce3c4e5 100644
--- a/docs/site/src/data/generated/configuration-reference.json
+++ b/docs/site/src/data/generated/configuration-reference.json
@@ -15,8 +15,7 @@
       "integration",
       "fixture",
       "entity",
-      "relay",
-      "notary"
+      "relay"
     ],
     "schema_sources": [
       "project.schema.json",
@@ -24,92 +23,51 @@
       "integration.schema.json",
       "fixture.schema.json",
       "entity.schema.json",
-      "registry-relay.config.schema.json",
-      "registry-notary.config.schema.json"
+      "registry-relay.config.schema.json"
     ],
     "field_knowledge": "schemas/project-authoring/parity-coverage.json#field_knowledge",
     "human_intent": "schemas/project-authoring/documentation-intent.json",
     "runtime_intent": [
-      "crates/registry-relay/config/documentation-intent.json",
-      "crates/registry-notary-core/config/documentation-intent.json"
+      "crates/registry-relay/config/documentation-intent.json"
     ],
     "reads_country_workspaces": false,
     "reads_runtime_configuration": false
   },
   "coverage": {
-    "schema_count": 7,
-    "path_count": 1829,
-    "reference_count": 506,
+    "schema_count": 6,
+    "path_count": 1155,
+    "reference_count": 363,
     "by_schema": {
-      "project": 220,
-      "environment": 213,
+      "project": 191,
+      "environment": 126,
       "integration": 171,
-      "fixture": 63,
+      "fixture": 39,
       "entity": 35,
-      "relay": 593,
-      "notary": 534
+      "relay": 593
     },
     "by_path_kind": {
-      "root": 7,
-      "property": 1458,
-      "map_key": 26,
-      "map_value": 48,
-      "array_item": 178,
-      "branch": 112
+      "root": 6,
+      "property": 903,
+      "map_key": 22,
+      "map_value": 34,
+      "array_item": 102,
+      "branch": 88
     },
     "by_sensitivity": {
       "public": 16,
-      "internal": 1179,
-      "sensitive": 408,
-      "secret_reference": 44,
-      "redacted_fixture": 51,
-      "structural": 131
+      "internal": 878,
+      "sensitive": 106,
+      "secret_reference": 26,
+      "redacted_fixture": 29,
+      "structural": 100
     },
     "by_intent_source": {
-      "schema_description": 530,
-      "reviewed_override": 266,
-      "structural_taxonomy": 131,
-      "reviewed_profile": 902
+      "schema_description": 405,
+      "reviewed_override": 232,
+      "structural_taxonomy": 104,
+      "reviewed_profile": 414
     },
     "by_intent_profile": {
-      "notary_audit_internal": 4,
-      "notary_audit_secret_reference": 1,
-      "notary_audit_sensitive": 2,
-      "notary_auth_internal": 13,
-      "notary_auth_oidc_scope_map_open_map": 1,
-      "notary_auth_secret_reference": 4,
-      "notary_auth_sensitive": 95,
-      "notary_cel_internal": 14,
-      "notary_config_trust_internal": 1,
-      "notary_config_trust_sensitive": 4,
-      "notary_credential_status_sensitive": 4,
-      "notary_deployment_internal": 13,
-      "notary_deployment_sensitive": 1,
-      "notary_evidence_claims_evidence_mode_consultations_inputs_open_map": 1,
-      "notary_evidence_claims_evidence_mode_consultations_open_map": 1,
-      "notary_evidence_claims_evidence_mode_consultations_output_fields_open_map": 1,
-      "notary_evidence_claims_evidence_mode_consultations_outputs_open_map": 1,
-      "notary_evidence_credential_profiles_open_map": 1,
-      "notary_evidence_internal": 93,
-      "notary_evidence_secret_reference": 5,
-      "notary_evidence_sensitive": 41,
-      "notary_evidence_signing_keys_open_map": 1,
-      "notary_evidence_variables_open_map": 1,
-      "notary_federation_internal": 43,
-      "notary_federation_secret_reference": 1,
-      "notary_federation_sensitive": 5,
-      "notary_instance_internal": 5,
-      "notary_instance_sensitive": 1,
-      "notary_oid4vci_credential_configurations_open_map": 1,
-      "notary_oid4vci_internal": 33,
-      "notary_oid4vci_sensitive": 51,
-      "notary_root_structural": 1,
-      "notary_server_internal": 13,
-      "notary_server_sensitive": 2,
-      "notary_state_internal": 6,
-      "notary_state_secret_reference": 2,
-      "notary_state_sensitive": 1,
-      "notary_subject_access_sensitive": 66,
       "relay_audit_internal": 9,
       "relay_audit_secret_reference": 1,
       "relay_audit_sensitive": 1,
@@ -154,11 +112,11 @@
         "pointer": "",
         "path_kind": "root"
       },
-      "purpose": "Declares the product-neutral Registry Stack project graph: integrations, materialized entities, and Relay or Notary services.",
+      "purpose": "Declares the product-neutral Registry Stack project graph: integrations, materialized entities, and Relay services.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
@@ -177,7 +135,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -203,7 +160,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -211,7 +167,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -219,7 +174,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -245,18 +199,16 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/access/properties/scopes",
+        "pointer": "/$defs/consultationService/properties/consent",
         "path_kind": "property"
       },
-      "purpose": "Lists the scopes a caller must hold to use the enclosing evidence service.",
+      "purpose": "States whether a caller must confirm consent before the Relay consultation is evaluated.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "array"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
@@ -271,7 +223,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -297,7 +248,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -305,7 +255,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -313,7 +262,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -323,44 +271,35 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "enum",
+          "value": [
+            "not_required",
+            "required"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/access/properties/scopes/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/consultationService/properties/consultations",
+        "path_kind": "property"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose": "Relay consultations and their closed bindings to target request identifiers or caller-supplied target attributes.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/consultations",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -370,7 +309,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -396,7 +334,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -404,7 +341,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -412,56 +348,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
+          "keyword": "maxProperties",
+          "value": 16
         },
         {
-          "keyword": "minLength",
+          "keyword": "minProperties",
           "value": 1
         },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/consultations"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/claimValue/properties/max_bytes",
+        "pointer": "/$defs/consultationService/properties/kind",
         "path_kind": "property"
       },
-      "purpose": "Bounds the encoded size of a claim value.",
+      "purpose": "Identifies this service declaration as a Relay consultation API backed by reviewed integrations.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -473,7 +401,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -499,7 +426,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -507,7 +433,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -515,7 +440,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -525,39 +449,32 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 65536
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
+          "keyword": "const",
+          "value": "consultation_api"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/claimValue/properties/nullable",
+        "pointer": "/$defs/consultationService/properties/legal_basis",
         "path_kind": "property"
       },
-      "purpose": "States whether the claim value may be null.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
+        "local_reference": "#/$defs/token",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -567,7 +484,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -593,7 +509,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -601,7 +516,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -609,7 +523,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -618,30 +531,49 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/token"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/claimValue/properties/type",
+        "pointer": "/$defs/consultationService/properties/purpose",
         "path_kind": "property"
       },
-      "purpose": "Declares the boolean, integer, string, or date type of a claim value.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/token",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -651,7 +583,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -677,7 +608,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -685,7 +615,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -693,7 +622,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -703,34 +631,46 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "boolean",
-            "integer",
-            "string",
-            "date"
-          ]
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/token"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/consultations/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/consultationService/properties/variables",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Typed request variables available to Relay consultation bindings.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/variables",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -742,7 +682,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -768,7 +707,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -776,7 +714,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -784,43 +721,42 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "integration",
-            "input"
-          ]
+          "keyword": "maxProperties",
+          "value": 16
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/variables"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/consultations/additionalProperties/properties/input",
+        "pointer": "/$defs/consultationService/properties/version",
         "path_kind": "property"
       },
-      "purpose": "Maps integration input names to reviewed target-request identifier or attribute bindings.",
+      "purpose": "Assigns the positive authored version used to track this Relay consultation service contract.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
@@ -836,7 +772,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -862,7 +797,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -870,7 +804,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -878,7 +811,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -888,40 +820,39 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
+          "keyword": "maximum",
+          "value": 4294967295
         },
         {
-          "keyword": "minProperties",
+          "keyword": "minimum",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/consultations/additionalProperties/properties/input/additionalProperties",
+        "pointer": "/$defs/consultations/additionalProperties",
         "path_kind": "map_value"
       },
-      "purpose": "Closed request binding. Ordinary consultations use the target; representative relationship proofs may additionally bind an authenticated requester identifier.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/requestMapping",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -931,7 +862,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -957,7 +887,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -965,7 +894,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -973,7 +901,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -984,44 +911,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "pattern",
-          "value": "^request\\.(?:target\\.(?:id|identifiers\\.[A-Za-z][A-Za-z0-9._-]{0,95}|attributes\\.[a-z][a-z0-9_]{0,63})|requester\\.identifiers\\.[A-Za-z][A-Za-z0-9._-]{0,95})$"
+          "keyword": "required",
+          "value": [
+            "integration",
+            "input"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/requestMapping"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/consultations/additionalProperties/properties/input/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/consultations/additionalProperties/properties/input",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Maps integration input names to reviewed target-request identifier or attribute bindings.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -1031,7 +952,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1057,7 +977,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1065,7 +984,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1073,49 +991,47 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxProperties",
+          "value": 16
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/consultations/additionalProperties/properties/integration",
-        "path_kind": "property"
+        "pointer": "/$defs/consultations/additionalProperties/properties/input/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Closed request binding. Ordinary consultations use the target; representative relationship proofs may additionally bind an authenticated requester identifier.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/requestMapping",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -1127,7 +1043,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1153,7 +1068,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1161,7 +1075,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1169,18 +1082,22 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 128
+        },
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^request\\.(?:target\\.(?:id|identifiers\\.[A-Za-z][A-Za-z0-9._-]{0,95}|attributes\\.[a-z][a-z0-9_]{0,63})|requester\\.identifiers\\.[A-Za-z][A-Za-z0-9._-]{0,95})$"
         },
         {
           "keyword": "type",
@@ -1189,20 +1106,20 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/requestMapping"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/consultations/propertyNames",
+        "pointer": "/$defs/consultations/additionalProperties/properties/input/propertyNames",
         "path_kind": "map_key"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -1222,7 +1139,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1248,7 +1164,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1256,7 +1171,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1264,7 +1178,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -1291,32 +1204,33 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/disclosure/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/consultations/additionalProperties/properties/integration",
+        "path_kind": "property"
       },
-      "purpose": "Maximum detail a claim may disclose.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/disclosureMode",
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1342,7 +1256,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1350,7 +1263,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1358,60 +1270,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "value",
-            "predicate",
-            "redacted"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/disclosureMode"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/disclosure/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/consultations/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1437,7 +1347,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1445,7 +1354,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1453,49 +1361,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "default",
-            "allowed"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/disclosure/oneOf/1/properties/allowed",
-        "path_kind": "property"
+        "pointer": "/$defs/fieldList/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Lists the disclosure modes that may be selected in addition to the policy's declared default.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -1505,7 +1414,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1531,7 +1439,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1539,7 +1446,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1547,43 +1453,42 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/disclosure/oneOf/1/properties/allowed/items",
+        "pointer": "/$defs/filterOperators/items",
         "path_kind": "array_item"
       },
-      "purpose": "Maximum detail a claim may disclose.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [],
-        "local_reference": "#/$defs/disclosureMode",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -1598,7 +1503,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1624,7 +1528,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1632,7 +1535,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1640,7 +1542,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -1653,46 +1554,42 @@
         {
           "keyword": "enum",
           "value": [
-            "value",
-            "predicate",
-            "redacted"
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
           ]
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/disclosureMode"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/disclosure/oneOf/1/properties/default",
-        "path_kind": "property"
+        "pointer": "/$defs/recordAggregate/anyOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Maximum detail a claim may disclose.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [],
-        "local_reference": "#/$defs/disclosureMode",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1718,7 +1615,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1726,7 +1622,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1734,48 +1629,125 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "value",
-            "predicate",
-            "redacted"
+            "measures"
           ]
         }
-      ],
-      "local_reference": {
+      ]
+    },
+    {
+      "address": {
         "schema": "project",
-        "pointer": "/$defs/disclosureMode"
-      }
+        "pointer": "/$defs/recordAggregate/anyOf/1",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "indicators"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/access",
+        "pointer": "/$defs/recordAggregate/properties/access",
         "path_kind": "property"
       },
-      "purpose": "Scopes a caller must hold to use an evidence service.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines optional metadata and aggregate scopes and whether execution is restricted to aggregate-only access.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/access",
+        "local_reference": "#/$defs/recordAggregateAccess",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -1787,7 +1759,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1813,7 +1784,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1821,7 +1791,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1829,7 +1798,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -1838,12 +1806,6 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "scopes"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -1851,27 +1813,27 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/access"
+        "pointer": "/$defs/recordAggregateAccess"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims",
+        "pointer": "/$defs/recordAggregate/properties/allowed_filters",
         "path_kind": "property"
       },
-      "purpose": "Maps evidence claim identifiers to an output or CEL expression, value contract, and disclosure policy.",
+      "purpose": "Maps aggregate filter fields to the comparison operators permitted for each field.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -1883,7 +1845,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -1909,7 +1870,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -1917,7 +1877,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -1925,7 +1884,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -1934,14 +1892,6 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -1951,19 +1901,20 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims/additionalProperties",
+        "pointer": "/$defs/recordAggregate/properties/allowed_filters/additionalProperties",
         "path_kind": "map_value"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Allowed operators for one queryable field.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "composed": true
+        "local_reference": "#/$defs/filterOperators",
+        "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
@@ -1977,7 +1928,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2003,7 +1953,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2011,7 +1960,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2019,7 +1967,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -2030,132 +1977,53 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "disclosure"
-          ]
+          "keyword": "minItems",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.project.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
+          "value": "array"
+        },
         {
-          "keyword": "required",
-          "value": [
-            "output"
-          ]
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/filterOperators"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/recordAggregate/properties/default_group_by",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Bounded unique list of entity field identifiers.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "array"
+        ],
+        "local_reference": "#/$defs/fieldList",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2181,7 +2049,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2189,7 +2056,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2197,42 +2063,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "cel"
-          ]
+          "keyword": "maxItems",
+          "value": 16
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/fieldList"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/cel",
+        "pointer": "/$defs/recordAggregate/properties/description",
         "path_kind": "property"
       },
-      "purpose": "Provides the CEL expression used to derive a claim from declared Relay consultation outputs.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -2244,7 +2119,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2270,7 +2144,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2278,7 +2151,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2286,7 +2158,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -2295,6 +2166,10 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 2048
+        },
         {
           "keyword": "minLength",
           "value": 1
@@ -2303,27 +2178,30 @@
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/disclosure",
+        "pointer": "/$defs/recordAggregate/properties/dimensions",
         "path_kind": "property"
       },
-      "purpose": "Fixed disclosure mode or a default constrained by explicitly allowed alternatives.",
-      "purpose_source": "schema_description",
+      "purpose": "Lists the labeled entity fields available as governed aggregate dimensions.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/disclosure",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -2335,7 +2213,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2361,7 +2238,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2369,7 +2245,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2377,7 +2252,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -2385,32 +2259,34 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/disclosure"
-      }
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "array"
+        }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/output",
-        "path_kind": "property"
+        "pointer": "/$defs/recordAggregate/properties/dimensions/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Selects the exact Relay consultation output that backs this evidence claim.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Named grouping dimension backed by one entity field.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/recordAggregateDimension",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -2420,7 +2296,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2446,7 +2321,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2454,7 +2328,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2462,40 +2335,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregateDimension"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/value",
+        "pointer": "/$defs/recordAggregate/properties/disclosure_control",
         "path_kind": "property"
       },
-      "purpose": "Explicit claim value type, nullability, and encoded-size bound for a claim derived from declared Relay consultation outputs.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the minimum group size and suppression behavior applied before aggregate results are disclosed.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/claimValue",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -2507,7 +2391,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2533,7 +2416,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2541,7 +2423,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2549,7 +2430,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -2558,43 +2438,32 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/claimValue"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/claims/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/recordAggregate/properties/disclosure_control/properties/min_group_size",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Sets the smallest result group that may be disclosed without suppression.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -2604,7 +2473,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2630,7 +2498,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2638,7 +2505,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2646,46 +2512,44 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/consent",
+        "pointer": "/$defs/recordAggregate/properties/disclosure_control/properties/suppression",
         "path_kind": "property"
       },
-      "purpose": "States whether evaluation of this evidence service requires consent.",
+      "purpose": "Selects whether undersized aggregate groups are omitted, masked, or represented as null.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -2697,7 +2561,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2723,7 +2586,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2731,7 +2593,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2739,7 +2600,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -2751,8 +2611,9 @@
         {
           "keyword": "enum",
           "value": [
-            "not_required",
-            "required"
+            "omit",
+            "mask",
+            "null"
           ]
         }
       ]
@@ -2760,19 +2621,19 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/consultations",
+        "pointer": "/$defs/recordAggregate/properties/group_by",
         "path_kind": "property"
       },
-      "purpose": "Relay consultations and their closed bindings to target request identifiers or caller-supplied target attributes.",
+      "purpose": "Bounded unique list of entity field identifiers.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/consultations",
+        "local_reference": "#/$defs/fieldList",
         "composed": false
       },
       "requiredness": "optional",
@@ -2787,7 +2648,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2813,7 +2673,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2821,7 +2680,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2829,7 +2687,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -2839,37 +2696,37 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
+          "keyword": "maxItems",
           "value": 16
         },
         {
-          "keyword": "minProperties",
-          "value": 1
+          "keyword": "type",
+          "value": "array"
         },
         {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "uniqueItems",
+          "value": true
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/consultations"
+        "pointer": "/$defs/fieldList"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/credential_profiles",
+        "pointer": "/$defs/recordAggregate/properties/indicators",
         "path_kind": "property"
       },
-      "purpose": "Credential profiles may select only claims backed by an exact Relay consultation.",
-      "purpose_source": "schema_description",
+      "purpose": "Lists the named aggregate indicators, functions, source columns, and measurement metadata.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
@@ -2885,7 +2742,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -2911,7 +2767,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -2919,7 +2774,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -2927,7 +2781,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -2936,31 +2789,28 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 32
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/recordAggregate/properties/indicators/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "SDMX-style aggregate indicator with units and display metadata.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/recordAggregateIndicator",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -2975,7 +2825,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3001,7 +2850,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3009,7 +2857,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3017,49 +2864,54 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "format",
-            "type",
-            "validity",
-            "claims"
+            "id",
+            "label",
+            "function",
+            "column",
+            "unit_measure"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregateIndicator"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/claims",
+        "pointer": "/$defs/recordAggregate/properties/joins",
         "path_kind": "property"
       },
-      "purpose": "Lists the registry-backed evidence claims selected into this credential profile.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded unique list of entity field identifiers.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "array"
         ],
+        "local_reference": "#/$defs/fieldList",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -3071,7 +2923,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3097,7 +2948,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3105,7 +2955,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3113,7 +2962,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3123,8 +2971,8 @@
       ],
       "constraints": [
         {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "maxItems",
+          "value": 16
         },
         {
           "keyword": "type",
@@ -3134,29 +2982,119 @@
           "keyword": "uniqueItems",
           "value": true
         }
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/fieldList"
+      }
+    },
+    {
+      "address": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregate/properties/measures",
+        "path_kind": "property"
+      },
+      "purpose": "Lists the named aggregation functions and entity columns used to compute this aggregate.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "minItems",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/claims/items",
+        "pointer": "/$defs/recordAggregate/properties/measures/items",
         "path_kind": "array_item"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Named aggregate calculation over one entity column.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/recordAggregateMeasure",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -3166,7 +3104,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3192,7 +3129,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3200,7 +3136,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3208,7 +3143,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3219,40 +3153,44 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "name",
+            "function",
+            "column"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/recordAggregateMeasure"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/format",
+        "pointer": "/$defs/recordAggregate/properties/required_principal_filters",
         "path_kind": "property"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose": "Bounded unique list of entity field identifiers.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/fieldList",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -3262,7 +3200,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3288,7 +3225,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3296,7 +3232,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3304,7 +3239,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3314,47 +3248,44 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "maxItems",
+          "value": 16
         },
         {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "keyword": "type",
+          "value": "array"
         },
         {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "uniqueItems",
+          "value": true
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/fieldList"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/type",
+        "pointer": "/$defs/recordAggregate/properties/spatial",
         "path_kind": "property"
       },
-      "purpose": "Declares the credential type identifier emitted for this reviewed credential profile.",
+      "purpose": "Defines the reviewed administrative-area spatial aggregation and geometry materialization bindings.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/recordAggregateSpatial",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -3364,7 +3295,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3390,7 +3320,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3398,7 +3327,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3406,7 +3334,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3416,37 +3343,44 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "mode",
+            "dimension",
+            "geometry_entity",
+            "geometry_id_field",
+            "geometry_field"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregateSpatial"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/validity",
+        "pointer": "/$defs/recordAggregate/properties/temporal_field",
         "path_kind": "property"
       },
-      "purpose": "Bounds the lifetime of credentials issued from this profile using a positive duration.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -3458,7 +3392,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3484,7 +3417,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3492,7 +3424,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3500,7 +3431,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3511,33 +3441,37 @@
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[1-9][0-9]*(?:s|m|h)$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/credential_profiles/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/recordAggregate/properties/title",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Bounded human-readable project metadata.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -3549,7 +3483,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3575,7 +3508,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3583,7 +3515,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3591,19 +3522,21 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
@@ -3612,25 +3545,27 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/text"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/kind",
+        "pointer": "/$defs/recordAggregateAccess/properties/aggregate_only_execution",
         "path_kind": "property"
       },
-      "purpose": "Identifies this service declaration as a Notary evidence policy.",
+      "purpose": "Restricts this definition to aggregate execution so it cannot be used as a record-level result path.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "boolean"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -3642,7 +3577,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3668,7 +3602,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3676,7 +3609,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3684,7 +3616,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3694,30 +3625,30 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "evidence"
+          "keyword": "type",
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/legal_basis",
+        "pointer": "/$defs/recordAggregateAccess/properties/aggregate_scope",
         "path_kind": "property"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose": "Authorization scope token.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/scope",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -3729,7 +3660,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3755,7 +3685,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3763,7 +3692,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3771,7 +3699,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3782,7 +3709,7 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 256
+          "value": 128
         },
         {
           "keyword": "minLength",
@@ -3799,28 +3726,28 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/scope"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/purpose",
+        "pointer": "/$defs/recordAggregateAccess/properties/metadata_scope",
         "path_kind": "property"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose": "Authorization scope token.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/scope",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -3832,7 +3759,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3858,7 +3784,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3866,7 +3791,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3874,7 +3798,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3885,7 +3808,7 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 256
+          "value": 128
         },
         {
           "keyword": "minLength",
@@ -3902,27 +3825,30 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/scope"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/subject_type",
+        "pointer": "/$defs/recordAggregateDimension/properties/codelist",
         "path_kind": "property"
       },
-      "purpose": "Subject category evaluated by this evidence service. Omission is normalized to person.",
+      "purpose": "Bounded human-readable project metadata.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/text",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -3932,7 +3858,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -3958,7 +3883,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -3966,7 +3890,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -3974,7 +3897,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -3984,35 +3906,44 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "person",
-            "project"
-          ]
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/variables",
+        "pointer": "/$defs/recordAggregateDimension/properties/field",
         "path_kind": "property"
       },
-      "purpose": "Typed request variables exposed to evidence evaluation.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/variables",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -4022,7 +3953,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4048,7 +3978,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4056,7 +3985,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4064,7 +3992,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -4074,39 +4001,40 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/variables"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/evidenceService/properties/version",
+        "pointer": "/$defs/recordAggregateDimension/properties/id",
         "path_kind": "property"
       },
-      "purpose": "Assigns the positive authored version used to track this evidence-service policy contract.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -4116,7 +4044,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4142,7 +4069,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4150,7 +4076,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4158,7 +4083,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -4168,30 +4092,125 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4294967295
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
-          "keyword": "minimum",
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
+    },
+    {
+      "address": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregateDimension/properties/label",
+        "path_kind": "property"
+      },
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/text",
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/fieldList/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/recordAggregateIndicator/properties/column",
+        "path_kind": "property"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -4199,7 +4218,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -4211,7 +4230,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4237,7 +4255,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4245,7 +4262,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4253,14 +4269,12 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -4280,19 +4294,21 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/filterOperators/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/recordAggregateIndicator/properties/decimals",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Sets the non-negative decimal precision published for this aggregate indicator.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -4304,7 +4320,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4330,7 +4345,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4338,7 +4352,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4346,56 +4359,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/anyOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/recordAggregateIndicator/properties/definition_uri",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4421,7 +4436,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4429,7 +4443,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4437,132 +4450,53 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "measures"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "project",
-        "pointer": "/$defs/recordAggregate/anyOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.project.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
+          "keyword": "maxLength",
+          "value": 2048
+        },
         {
-          "keyword": "required",
-          "value": [
-            "indicators"
-          ]
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/access",
+        "pointer": "/$defs/recordAggregateIndicator/properties/frequency",
         "path_kind": "property"
       },
-      "purpose": "Defines optional metadata and aggregate scopes and whether execution is restricted to aggregate-only access.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/recordAggregateAccess",
+        "local_reference": "#/$defs/text",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -4572,7 +4506,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4598,7 +4531,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4606,7 +4538,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4614,7 +4545,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -4623,34 +4553,41 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateAccess"
+        "pointer": "/$defs/text"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/allowed_filters",
+        "pointer": "/$defs/recordAggregateIndicator/properties/function",
         "path_kind": "property"
       },
-      "purpose": "Maps aggregate filter fields to the comparison operators permitted for each field.",
+      "purpose": "Selects the aggregation function used to compute this named indicator.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
+        "local_reference": "#/$defs/recordAggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -4662,7 +4599,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4688,7 +4624,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4696,7 +4631,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4704,7 +4638,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -4714,32 +4647,45 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregateFunction"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/allowed_filters/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/recordAggregateIndicator/properties/id",
+        "path_kind": "property"
       },
-      "purpose": "Allowed operators for one queryable field.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
-        "local_reference": "#/$defs/filterOperators",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -4749,7 +4695,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4775,7 +4720,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4783,7 +4727,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4791,55 +4734,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/filterOperators"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/default_group_by",
+        "pointer": "/$defs/recordAggregateIndicator/properties/label",
         "path_kind": "property"
       },
-      "purpose": "Bounded unique list of entity field identifiers.",
+      "purpose": "Bounded human-readable project metadata.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
-        "local_reference": "#/$defs/fieldList",
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -4849,7 +4786,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4875,7 +4811,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4883,7 +4818,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4891,7 +4825,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -4901,34 +4834,34 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "maxLength",
+          "value": 2048
         },
         {
-          "keyword": "type",
-          "value": "array"
+          "keyword": "minLength",
+          "value": 1
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/fieldList"
+        "pointer": "/$defs/text"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/description",
+        "pointer": "/$defs/recordAggregateIndicator/properties/unit_measure",
         "path_kind": "property"
       },
       "purpose": "Bounded human-readable project metadata.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -4948,7 +4881,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -4974,7 +4906,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -4982,7 +4913,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -4990,7 +4920,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5020,17 +4949,17 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/dimensions",
+        "pointer": "/$defs/recordAggregateIndicator/properties/unit_mult",
         "path_kind": "property"
       },
-      "purpose": "Lists the labeled entity fields available as governed aggregate dimensions.",
+      "purpose": "Declares the base-ten unit multiplier published with this aggregate indicator.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -5046,7 +4975,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5072,7 +5000,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5080,7 +5007,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5088,7 +5014,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5097,33 +5022,41 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 2147483647
+        },
+        {
+          "keyword": "minimum",
+          "value": -2147483648
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/dimensions/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/recordAggregateMeasure/properties/column",
+        "path_kind": "property"
       },
-      "purpose": "Named grouping dimension backed by one entity field.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/recordAggregateDimension",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -5133,7 +5066,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5159,7 +5091,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5167,7 +5098,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5175,49 +5105,42 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "field"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateDimension"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/disclosure_control",
+        "pointer": "/$defs/recordAggregateMeasure/properties/function",
         "path_kind": "property"
       },
-      "purpose": "Defines the minimum group size and suppression behavior applied before aggregate results are disclosed.",
+      "purpose": "Selects the aggregation function applied to the optional source column for this measure.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
+        "local_reference": "#/$defs/recordAggregateFunction",
         "composed": false
       },
       "requiredness": "required",
@@ -5232,7 +5155,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5258,7 +5180,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5266,7 +5187,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5274,7 +5194,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5284,31 +5203,45 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregateFunction"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/disclosure_control/properties/min_group_size",
+        "pointer": "/$defs/recordAggregateMeasure/properties/name",
         "path_kind": "property"
       },
-      "purpose": "Sets the smallest result group that may be disclosed without suppression.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -5318,7 +5251,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5344,7 +5276,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5352,7 +5283,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5360,7 +5290,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5370,32 +5299,35 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/disclosure_control/properties/suppression",
+        "pointer": "/$defs/recordAggregateSpatial/properties/bbox_fields",
         "path_kind": "property"
       },
-      "purpose": "Selects whether undersized aggregate groups are omitted, masked, or represented as null.",
+      "purpose": "Maps the geometry entity fields that provide the minimum and maximum coordinates of its bounding box.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/recordSpatialBbox",
         "composed": false
       },
       "requiredness": "optional",
@@ -5410,7 +5342,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5436,7 +5367,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5444,7 +5374,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5452,7 +5381,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5462,36 +5390,45 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "omit",
-            "mask",
-            "null"
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordSpatialBbox"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/group_by",
+        "pointer": "/$defs/recordAggregateSpatial/properties/collection_id",
         "path_kind": "property"
       },
-      "purpose": "Bounded unique list of entity field identifiers.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
-        "local_reference": "#/$defs/fieldList",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -5501,7 +5438,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5527,7 +5463,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5535,7 +5470,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5543,7 +5477,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5553,43 +5486,40 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/fieldList"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/indicators",
+        "pointer": "/$defs/recordAggregateSpatial/properties/dimension",
         "path_kind": "property"
       },
-      "purpose": "Lists the named aggregate indicators, functions, source columns, and measurement metadata.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -5599,7 +5529,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5625,7 +5554,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5633,7 +5561,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5641,7 +5568,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5650,33 +5576,41 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/indicators/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/recordAggregateSpatial/properties/geometry_entity",
+        "path_kind": "property"
       },
-      "purpose": "SDMX-style aggregate indicator with units and display metadata.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/recordAggregateIndicator",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -5686,7 +5620,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5712,7 +5645,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5720,7 +5652,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5728,57 +5659,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "function",
-            "column",
-            "unit_measure"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/joins",
+        "pointer": "/$defs/recordAggregateSpatial/properties/geometry_field",
         "path_kind": "property"
       },
-      "purpose": "Bounded unique list of entity field identifiers.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
-        "local_reference": "#/$defs/fieldList",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -5788,7 +5711,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5814,7 +5736,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5822,7 +5743,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5830,7 +5750,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5840,37 +5759,124 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
+    },
+    {
+      "address": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregateSpatial/properties/geometry_id_field",
+        "path_kind": "property"
+      },
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/fieldList"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/measures",
+        "pointer": "/$defs/recordAggregateSpatial/properties/max_geometry_vertices",
         "path_kind": "property"
       },
-      "purpose": "Lists the named aggregation functions and entity columns used to compute this aggregate.",
+      "purpose": "Caps the number of vertices accepted when materializing one administrative-area geometry.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -5886,7 +5892,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -5912,7 +5917,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -5920,7 +5924,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -5928,7 +5931,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -5938,34 +5940,35 @@
       ],
       "constraints": [
         {
-          "keyword": "minItems",
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/measures/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/recordAggregateSpatial/properties/mode",
+        "path_kind": "property"
       },
-      "purpose": "Named aggregate calculation over one entity column.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects the supported administrative-area aggregation mode for this spatial definition.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/recordAggregateMeasure",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -5977,7 +5980,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6003,7 +6005,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6011,7 +6012,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6019,55 +6019,40 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "name",
-            "function",
-            "column"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "admin_area"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordAggregateMeasure"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/required_principal_filters",
+        "pointer": "/$defs/recordAttributeReleaseExpression/properties/cel",
         "path_kind": "property"
       },
-      "purpose": "Bounded unique list of entity field identifiers.",
-      "purpose_source": "schema_description",
+      "purpose": "Provides the bounded CEL expression evaluated only against the projected source object.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
-        "local_reference": "#/$defs/fieldList",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -6077,7 +6062,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6103,7 +6087,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6111,7 +6094,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6119,7 +6101,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -6129,42 +6110,37 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "maxLength",
+          "value": 4096
         },
         {
-          "keyword": "type",
-          "value": "array"
+          "keyword": "minLength",
+          "value": 1
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/fieldList"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/spatial",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims",
         "path_kind": "property"
       },
-      "purpose": "Defines the reviewed administrative-area spatial aggregation and geometry materialization bindings.",
+      "purpose": "Maps released claim names to their reviewed source or expression, requiredness, and sensitivity.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordAggregateSpatial",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -6176,7 +6152,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6202,7 +6177,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6210,7 +6184,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6218,7 +6191,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -6228,46 +6200,39 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "mode",
-            "dimension",
-            "geometry_entity",
-            "geometry_id_field",
-            "geometry_field"
-          ]
+          "keyword": "maxProperties",
+          "value": 32
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/temporal_field",
-        "path_kind": "property"
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -6277,7 +6242,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6303,7 +6267,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6311,7 +6274,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6319,60 +6281,55 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "required",
+            "sensitivity"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate/properties/title",
-        "path_kind": "property"
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/text",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6398,7 +6355,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6406,7 +6362,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6414,48 +6369,122 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "required",
+          "value": [
+            "source_field"
+          ]
         }
-      ],
-      "local_reference": {
+      ]
+    },
+    {
+      "address": {
         "schema": "project",
-        "pointer": "/$defs/text"
-      }
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/oneOf/1",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "expression"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateAccess/properties/aggregate_only_execution",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/expression",
         "path_kind": "property"
       },
-      "purpose": "Restricts this definition to aggregate execution so it cannot be used as a record-level result path.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded CEL evaluated only against the projected source object.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
+        "local_reference": "#/$defs/recordAttributeReleaseExpression",
         "composed": false
       },
       "requiredness": "optional",
@@ -6470,7 +6499,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6496,7 +6524,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6504,7 +6531,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6512,7 +6538,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -6521,33 +6546,42 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "cel"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordAttributeReleaseExpression"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateAccess/properties/aggregate_scope",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/required",
         "path_kind": "property"
       },
-      "purpose": "Authorization scope token.",
-      "purpose_source": "schema_description",
+      "purpose": "States whether failure to produce this released claim makes the attribute-release result invalid.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
-        "local_reference": "#/$defs/scope",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -6557,7 +6591,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6583,7 +6616,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6591,7 +6623,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6599,7 +6630,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -6608,44 +6638,113 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
+      ]
+    },
+    {
+      "address": {
         "schema": "project",
-        "pointer": "/$defs/scope"
-      }
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/sensitivity",
+        "path_kind": "property"
+      },
+      "purpose": "Classifies the released claim as a direct identifier, personal, public, or pseudonymous value.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "direct_identifier",
+            "personal",
+            "public",
+            "pseudonymous"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateAccess/properties/metadata_scope",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/source_field",
         "path_kind": "property"
       },
-      "purpose": "Authorization scope token.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/scope",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "optional",
@@ -6660,7 +6759,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6686,7 +6784,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6694,7 +6791,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6702,7 +6798,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -6711,17 +6806,9 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
@@ -6730,28 +6817,27 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/scope"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateDimension/properties/codelist",
-        "path_kind": "property"
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -6763,7 +6849,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6789,7 +6874,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6797,7 +6881,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6805,52 +6888,44 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateDimension/properties/field",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/description",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Bounded human-readable project metadata.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -6862,7 +6937,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6888,7 +6962,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6896,7 +6969,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6904,7 +6976,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -6914,8 +6985,12 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
@@ -6924,25 +6999,25 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/text"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateDimension/properties/id",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/purpose",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Binds the release to one permitted records purpose and requires a bounded visible-ASCII header token.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/token",
         "composed": false
       },
       "requiredness": "required",
@@ -6957,7 +7032,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -6983,7 +7057,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -6991,7 +7064,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -6999,7 +7071,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7008,9 +7079,17 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
         },
         {
           "keyword": "type",
@@ -7019,30 +7098,29 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/token"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateDimension/properties/label",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_conditions",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
+      "purpose": "Contains the bounded expression that must authorize this purpose-bound attribute release.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/text",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -7052,7 +7130,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7078,7 +7155,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7086,7 +7162,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7094,7 +7169,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7104,44 +7178,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "expression"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/column",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_conditions/properties/expression",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Bounded CEL evaluated only against the projected source object.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/recordAttributeReleaseExpression",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -7151,7 +7219,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7177,7 +7244,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7185,7 +7251,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7193,7 +7258,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7203,39 +7267,42 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "cel"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/recordAttributeReleaseExpression"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/decimals",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_scope",
         "path_kind": "property"
       },
-      "purpose": "Sets the non-negative decimal precision published for this aggregate indicator.",
+      "purpose": "Requires the exact entity-bound <entity_id>:identity_release scope and keeps release access distinct from records API scopes.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/scope",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -7245,7 +7312,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7271,7 +7337,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7279,7 +7344,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7287,7 +7351,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7297,40 +7360,47 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4294967295
+          "keyword": "maxLength",
+          "value": 128
         },
         {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/scope"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/definition_uri",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the projected source field and identifier type used for exact-one subject resolution.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -7340,7 +7410,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7366,7 +7435,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7374,7 +7442,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7382,7 +7449,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7392,42 +7458,36 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "source_field",
+            "id_type"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/frequency",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject/properties/id_type",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
+      "purpose": "Labels the identifier type represented by the resolved subject identifier.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -7439,7 +7499,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7465,7 +7524,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7473,7 +7531,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7481,7 +7538,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7492,41 +7548,43 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 2048
+          "value": 64
         },
         {
           "keyword": "minLength",
           "value": 1
         },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/function",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject/properties/source_field",
         "path_kind": "property"
       },
-      "purpose": "Selects the aggregation function used to compute this named indicator.",
+      "purpose": "Selects the projected entity field whose value is matched for exact-one subject resolution.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/recordAggregateFunction",
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -7536,7 +7594,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7562,7 +7619,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7570,7 +7626,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7578,7 +7633,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7588,43 +7642,38 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateFunction"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/id",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/title",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Bounded human-readable project metadata.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -7636,7 +7685,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7662,7 +7710,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7670,7 +7717,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7678,7 +7724,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7688,8 +7733,12 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
@@ -7698,25 +7747,24 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/text"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/label",
+        "pointer": "/$defs/recordAttributeReleaseProfile/properties/version",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
+      "purpose": "Assigns a portable path-segment version matching [A-Za-z0-9][A-Za-z0-9._-]{0,63} to identify one attribute-release profile contract.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/text",
         "composed": false
       },
       "requiredness": "required",
@@ -7731,7 +7779,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7757,7 +7804,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7765,7 +7811,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7773,7 +7818,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -7784,43 +7828,43 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 2048
+          "value": 64
         },
         {
           "keyword": "minLength",
           "value": 1
         },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/unit_measure",
-        "path_kind": "property"
+        "pointer": "/$defs/recordAttributeReleaseProfiles/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Bounded human-readable project metadata.",
+      "purpose": "One purpose-bound, minimized identity release compiled into the owning Relay entity.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/text",
+        "local_reference": "#/$defs/recordAttributeReleaseProfile",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -7830,7 +7874,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7856,7 +7899,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7864,7 +7906,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7872,53 +7913,56 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "version",
+            "purpose",
+            "release_scope",
+            "subject",
+            "release_conditions",
+            "claims"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/text"
+        "pointer": "/$defs/recordAttributeReleaseProfile"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateIndicator/properties/unit_mult",
-        "path_kind": "property"
+        "pointer": "/$defs/recordAttributeReleaseProfiles/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Declares the base-ten unit multiplier published with this aggregate indicator.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -7928,7 +7972,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -7954,7 +7997,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -7962,7 +8004,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -7970,40 +8011,36 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 2147483647
-        },
-        {
-          "keyword": "minimum",
-          "value": -2147483648
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateMeasure/properties/column",
-        "path_kind": "property"
+        "pointer": "/$defs/recordFieldMap/additionalProperties",
+        "path_kind": "map_value"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -8011,7 +8048,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -8023,7 +8060,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8049,7 +8085,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8057,7 +8092,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8065,13 +8099,13 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -8091,22 +8125,24 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateMeasure/properties/function",
-        "path_kind": "property"
+        "pointer": "/$defs/recordFieldMap/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Selects the aggregation function applied to the optional source column for this measure.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/recordAggregateFunction",
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -8116,7 +8152,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8142,7 +8177,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8150,7 +8184,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8158,55 +8191,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateFunction"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateMeasure/properties/name",
+        "pointer": "/$defs/recordSpatial/properties/bbox_fields",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Maps optional entity fields containing precomputed minimum and maximum bounding-box coordinates.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/recordSpatialBbox",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -8216,7 +8244,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8242,7 +8269,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8250,7 +8276,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8258,102 +8283,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
-    },
-    {
-      "address": {
-        "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial/properties/bbox_fields",
-        "path_kind": "property"
-      },
-      "purpose": "Maps the geometry entity fields that provide the minimum and maximum coordinates of its bounding box.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/recordSpatialBbox",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.project.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -8384,14 +8313,14 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial/properties/collection_id",
+        "pointer": "/$defs/recordSpatial/properties/collection_id",
         "path_kind": "property"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -8411,7 +8340,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8437,7 +8365,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8445,7 +8372,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8453,7 +8379,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -8479,14 +8404,14 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial/properties/dimension",
+        "pointer": "/$defs/recordSpatial/properties/datetime_field",
         "path_kind": "property"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -8494,7 +8419,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -8506,7 +8431,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8532,7 +8456,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8540,7 +8463,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8548,7 +8470,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -8574,22 +8495,22 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial/properties/geometry_entity",
+        "pointer": "/$defs/recordSpatial/properties/description",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Bounded human-readable project metadata.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -8601,7 +8522,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8627,7 +8547,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8635,7 +8554,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8643,7 +8561,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -8653,8 +8570,12 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
@@ -8663,30 +8584,30 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/text"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial/properties/geometry_field",
+        "pointer": "/$defs/recordSpatial/properties/geometry",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines whether feature geometry comes from point-coordinate fields or one encoded geometry field.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/recordSpatialGeometry",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -8696,7 +8617,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8722,7 +8642,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8730,7 +8649,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8738,7 +8656,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -8746,42 +8663,32 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
+      "constraints": [],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/recordSpatialGeometry"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial/properties/geometry_id_field",
+        "pointer": "/$defs/recordSpatial/properties/max_bbox_degrees",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Caps the geographic span accepted for one bounding-box query.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "number"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -8791,7 +8698,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8817,7 +8723,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8825,7 +8730,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8833,7 +8737,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -8843,30 +8746,26 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "exclusiveMinimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "number"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial/properties/max_geometry_vertices",
+        "pointer": "/$defs/recordSpatial/properties/max_geometry_vertices",
         "path_kind": "property"
       },
-      "purpose": "Caps the number of vertices accepted when materializing one administrative-area geometry.",
+      "purpose": "Caps the number of vertices accepted when returning one feature geometry.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "integer"
@@ -8885,7 +8784,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -8911,7 +8809,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -8919,7 +8816,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -8927,7 +8823,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -8953,21 +8848,24 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregateSpatial/properties/mode",
+        "pointer": "/$defs/recordSpatial/properties/title",
         "path_kind": "property"
       },
-      "purpose": "Selects the supported administrative-area aggregation mode for this spatial definition.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -8977,7 +8875,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9003,7 +8900,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9011,7 +8907,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9019,7 +8914,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -9029,26 +8923,39 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "admin_area"
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseExpression/properties/cel",
+        "pointer": "/$defs/recordSpatialBbox/properties/max_x",
         "path_kind": "property"
       },
-      "purpose": "Provides the bounded CEL expression evaluated only against the projected source object.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
@@ -9063,7 +8970,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9089,7 +8995,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9097,7 +9002,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9105,7 +9009,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -9115,39 +9018,40 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims",
+        "pointer": "/$defs/recordSpatialBbox/properties/max_y",
         "path_kind": "property"
       },
-      "purpose": "Maps released claim names to their reviewed source or expression, requiredness, and sensitivity.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -9157,7 +9061,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9183,7 +9086,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9191,7 +9093,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9199,7 +9100,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -9209,39 +9109,40 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 32
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/recordSpatialBbox/properties/min_x",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "composed": true
+        "local_reference": "#/$defs/stableId",
+        "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -9251,7 +9152,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9277,7 +9177,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9285,7 +9184,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9293,57 +9191,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "required",
-            "sensitivity"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/recordSpatialBbox/properties/min_y",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9369,7 +9268,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9377,7 +9275,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9385,37 +9282,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "source_field"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/oneOf/1",
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
       "requiredness": "conditional",
@@ -9430,7 +9333,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9456,7 +9358,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9464,7 +9365,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9472,7 +9372,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -9485,32 +9384,39 @@
         {
           "keyword": "required",
           "value": [
-            "expression"
+            "kind",
+            "longitude_field",
+            "latitude_field",
+            "crs"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/expression",
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/crs",
         "path_kind": "property"
       },
-      "purpose": "Bounded CEL evaluated only against the projected source object.",
+      "purpose": "Non-empty token without commas, whitespace, or control characters.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/recordAttributeReleaseExpression",
+        "local_reference": "#/$defs/token",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -9520,7 +9426,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9546,7 +9451,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9554,7 +9458,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9562,7 +9465,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -9572,36 +9474,40 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "cel"
-          ]
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseExpression"
+        "pointer": "/$defs/token"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/required",
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/kind",
         "path_kind": "property"
       },
-      "purpose": "States whether failure to produce this released claim makes the attribute-release result invalid.",
+      "purpose": "Selects geometry assembled from separate longitude and latitude entity fields.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
@@ -9616,7 +9522,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9642,7 +9547,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9650,7 +9554,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9658,7 +9561,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -9668,29 +9570,32 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "boolean"
+          "keyword": "const",
+          "value": "point"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/sensitivity",
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/latitude_field",
         "path_kind": "property"
       },
-      "purpose": "Classifies the released claim as a direct identifier, personal, public, or pseudonymous value.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -9700,7 +9605,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9726,7 +9630,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9734,7 +9637,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9742,7 +9644,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -9752,27 +9653,30 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "direct_identifier",
-            "personal",
-            "public",
-            "pseudonymous"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/source_field",
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/longitude_field",
         "path_kind": "property"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -9780,7 +9684,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -9792,7 +9696,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9818,7 +9721,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9826,7 +9728,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9834,7 +9735,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -9860,33 +9760,32 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -9912,7 +9811,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -9920,7 +9818,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -9928,45 +9825,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
+          "keyword": "required",
+          "value": [
+            "kind",
+            "field",
+            "crs"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/description",
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/crs",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
+      "purpose": "Non-empty token without commas, whitespace, or control characters.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/text",
+        "local_reference": "#/$defs/token",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -9978,7 +9878,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10004,7 +9903,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10012,7 +9910,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10020,7 +9917,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10031,12 +9927,16 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 2048
+          "value": 256
         },
         {
           "keyword": "minLength",
           "value": 1
         },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -10044,25 +9944,25 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/text"
+        "pointer": "/$defs/token"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/purpose",
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/field",
         "path_kind": "property"
       },
-      "purpose": "Binds the release to one permitted records purpose and requires a bounded visible-ASCII header token.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
@@ -10077,7 +9977,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10103,7 +10002,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10111,7 +10009,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10119,7 +10016,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10128,17 +10024,9 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
@@ -10147,24 +10035,22 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_conditions",
+        "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/kind",
         "path_kind": "property"
       },
-      "purpose": "Contains the bounded expression that must authorize this purpose-bound attribute release.",
+      "purpose": "Selects the GeoJSON, WKT, or WKB encoding used by the configured geometry field.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
@@ -10179,7 +10065,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10205,7 +10090,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10213,7 +10097,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10221,7 +10104,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10231,33 +10113,31 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "expression"
+            "geojson",
+            "wkt",
+            "wkb"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_conditions/properties/expression",
+        "pointer": "/$defs/recordSpdci/properties/expression_fields",
         "path_kind": "property"
       },
-      "purpose": "Bounded CEL evaluated only against the projected source object.",
-      "purpose_source": "schema_description",
+      "purpose": "Maps SP-DCI expression input names to the entity fields available during expression evaluation.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordAttributeReleaseExpression",
+        "local_reference": "#/$defs/recordFieldMap",
         "composed": false
       },
       "requiredness": "required",
@@ -10272,7 +10152,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10298,7 +10177,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10306,7 +10184,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10314,7 +10191,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10324,10 +10200,8 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "cel"
-          ]
+          "keyword": "maxProperties",
+          "value": 64
         },
         {
           "keyword": "type",
@@ -10336,30 +10210,30 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseExpression"
+        "pointer": "/$defs/recordFieldMap"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_scope",
+        "pointer": "/$defs/recordSpdci/properties/identifiers",
         "path_kind": "property"
       },
-      "purpose": "Requires the exact entity-bound <entity_id>:identity_release scope and keeps release access distinct from records API scopes.",
+      "purpose": "Maps SP-DCI identifier names to the entity fields used to identify a record.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/scope",
+        "local_reference": "#/$defs/recordFieldMap",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -10369,7 +10243,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10395,7 +10268,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10403,7 +10275,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10411,7 +10282,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10421,135 +10291,35 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "keyword": "maxProperties",
+          "value": 64
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/scope"
+        "pointer": "/$defs/recordFieldMap"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject",
-        "path_kind": "property"
-      },
-      "purpose": "Defines the projected source field and identifier type used for exact-one subject resolution.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.project.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "source_field",
-            "id_type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject/properties/id_type",
+        "pointer": "/$defs/recordSpdci/properties/record_type",
         "path_kind": "property"
       },
-      "purpose": "Labels the identifier type represented by the resolved subject identifier.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/token",
         "composed": false
       },
       "requiredness": "required",
@@ -10564,7 +10334,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10590,7 +10359,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10598,7 +10366,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10606,7 +10373,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10617,7 +10383,7 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 64
+          "value": 256
         },
         {
           "keyword": "minLength",
@@ -10631,19 +10397,23 @@
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/token"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject/properties/source_field",
+        "pointer": "/$defs/recordSpdci/properties/registry",
         "path_kind": "property"
       },
-      "purpose": "Selects the projected entity field whose value is matched for exact-one subject resolution.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -10663,7 +10433,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10689,7 +10458,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10697,7 +10465,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10705,7 +10472,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10731,22 +10497,22 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/title",
+        "pointer": "/$defs/recordSpdci/properties/registry_type",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
+      "purpose": "Non-empty token without commas, whitespace, or control characters.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/text",
+        "local_reference": "#/$defs/token",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -10758,7 +10524,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10784,7 +10549,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10792,7 +10556,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10800,7 +10563,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10811,12 +10573,16 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 2048
+          "value": 256
         },
         {
           "keyword": "minLength",
           "value": 1
         },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -10824,29 +10590,30 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/text"
+        "pointer": "/$defs/token"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile/properties/version",
+        "pointer": "/$defs/recordSpdci/properties/response_fields",
         "path_kind": "property"
       },
-      "purpose": "Assigns a portable path-segment version matching [A-Za-z0-9][A-Za-z0-9._-]{0,63} to identify one attribute-release profile contract.",
+      "purpose": "Maps SP-DCI response names to the entity fields returned for an authorized record.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/recordFieldMap",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -10856,7 +10623,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10882,7 +10648,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10890,7 +10655,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10898,7 +10662,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -10908,42 +10671,37 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
+          "keyword": "maxProperties",
           "value": 64
         },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordFieldMap"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfiles/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/recordsApi/properties/aggregates",
+        "path_kind": "property"
       },
-      "purpose": "One purpose-bound, minimized identity release compiled into the owning Relay entity.",
-      "purpose_source": "schema_description",
+      "purpose": "Maps aggregate identifiers to governed aggregate definitions exposed by the records API.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordAttributeReleaseProfile",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -10955,7 +10713,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -10981,7 +10738,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -10989,7 +10745,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -10997,57 +10752,45 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "version",
-            "purpose",
-            "release_scope",
-            "subject",
-            "release_conditions",
-            "claims"
-          ]
+          "keyword": "maxProperties",
+          "value": 64
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfile"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfiles/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/recordsApi/properties/aggregates/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Governed aggregate definition with disclosure controls.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/recordAggregate",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -11057,7 +10800,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11083,7 +10825,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11091,7 +10832,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11099,7 +10839,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -11110,26 +10849,33 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "description",
+            "disclosure_control"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/recordAggregate"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordFieldMap/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/recordsApi/properties/aggregates/propertyNames",
+        "path_kind": "map_key"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -11149,7 +10895,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11175,7 +10920,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11183,7 +10927,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11191,7 +10934,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -11218,24 +10960,24 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordFieldMap/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/recordsApi/properties/attribute_release_profiles",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Purpose-bound, exact-one identity releases keyed by stable profile id. Generated Relay responses omit source metadata and are never cacheable.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/recordAttributeReleaseProfiles",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -11245,7 +10987,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11271,7 +11012,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11279,7 +11019,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11287,46 +11026,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxProperties",
+          "value": 16
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/recordAttributeReleaseProfiles"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatial/properties/bbox_fields",
+        "pointer": "/$defs/recordsApi/properties/filters",
         "path_kind": "property"
       },
-      "purpose": "Maps optional entity fields containing precomputed minimum and maximum bounding-box coordinates.",
+      "purpose": "Maps filterable entity fields to the comparison operators the records API permits for each field.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordSpatialBbox",
         "composed": false
       },
       "requiredness": "optional",
@@ -11341,7 +11077,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11367,7 +11102,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11375,7 +11109,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11383,7 +11116,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -11393,45 +11125,36 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
+          "keyword": "maxProperties",
+          "value": 256
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordSpatialBbox"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatial/properties/collection_id",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/filters/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Allowed operators for one queryable field.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/filterOperators",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -11441,7 +11164,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11467,7 +11189,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11475,7 +11196,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11483,40 +11203,44 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "minItems",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/filterOperators"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatial/properties/datetime_field",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/filters/propertyNames",
+        "path_kind": "map_key"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -11524,7 +11248,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -11536,7 +11260,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11562,7 +11285,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11570,7 +11292,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11578,13 +11299,13 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -11604,24 +11325,23 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatial/properties/description",
+        "pointer": "/$defs/recordsApi/properties/pagination",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the default and maximum row limits enforced by records API pagination.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -11631,7 +11351,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11657,7 +11376,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11665,7 +11383,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11673,7 +11390,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -11683,39 +11399,33 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "default_limit",
+            "max_limit"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatial/properties/geometry",
+        "pointer": "/$defs/recordsApi/properties/pagination/properties/default_limit",
         "path_kind": "property"
       },
-      "purpose": "Defines whether feature geometry comes from point-coordinate fields or one encoded geometry field.",
+      "purpose": "Sets the row limit applied when a records request does not supply its own limit.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/recordSpatialGeometry",
         "composed": false
       },
       "requiredness": "required",
@@ -11730,7 +11440,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11756,7 +11465,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11764,7 +11472,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11772,7 +11479,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -11780,30 +11486,39 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry"
-      }
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 10000
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatial/properties/max_bbox_degrees",
+        "pointer": "/$defs/recordsApi/properties/pagination/properties/max_limit",
         "path_kind": "property"
       },
-      "purpose": "Caps the geographic span accepted for one bounding-box query.",
+      "purpose": "Caps the row limit that any records request may select; it must be at least 2 when attribute-release profiles are configured so ambiguous subjects can be detected.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "number"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -11815,7 +11530,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11841,7 +11555,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11849,7 +11562,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11857,7 +11569,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -11867,33 +11578,37 @@
       ],
       "constraints": [
         {
-          "keyword": "exclusiveMinimum",
-          "value": 0
+          "keyword": "maximum",
+          "value": 10000
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "number"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatial/properties/max_geometry_vertices",
+        "pointer": "/$defs/recordsApi/properties/projection",
         "path_kind": "property"
       },
-      "purpose": "Caps the number of vertices accepted when returning one feature geometry.",
+      "purpose": "Lists the entity fields that the records API is permitted to project into row responses.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -11905,7 +11620,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -11931,7 +11645,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -11939,7 +11652,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -11947,7 +11659,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -11957,38 +11668,42 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4294967295
+          "keyword": "maxItems",
+          "value": 256
         },
         {
-          "keyword": "minimum",
+          "keyword": "minItems",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatial/properties/title",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/projection/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Bounded human-readable project metadata.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/text",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -12000,7 +11715,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12026,7 +11740,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12034,7 +11747,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12042,22 +11754,18 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
@@ -12066,30 +11774,29 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/text"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialBbox/properties/max_x",
+        "pointer": "/$defs/recordsApi/properties/purposes",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Lists the bounded purpose identifiers accepted by this records API policy.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -12099,7 +11806,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12125,7 +11831,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12133,7 +11838,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12141,7 +11845,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -12151,38 +11854,38 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxItems",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialBbox/properties/max_y",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/purposes/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Non-empty token without commas, whitespace, or control characters.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/token",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -12194,7 +11897,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12220,7 +11922,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12228,7 +11929,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12236,18 +11936,26 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
         },
         {
           "keyword": "type",
@@ -12256,30 +11964,29 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/token"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialBbox/properties/min_x",
+        "pointer": "/$defs/recordsApi/properties/relationships",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares the bounded named relationships that records queries may follow between authored entities.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -12289,7 +11996,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12315,7 +12021,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12323,7 +12028,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12331,7 +12035,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -12341,40 +12044,35 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxProperties",
+          "value": 64
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialBbox/properties/min_y",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -12384,7 +12082,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12410,7 +12107,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12418,7 +12114,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12426,59 +12121,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "kind",
+            "target",
+            "foreign_key"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/concept_uri",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12504,7 +12199,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12512,7 +12206,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12520,47 +12213,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "kind",
-            "longitude_field",
-            "latitude_field",
-            "crs"
-          ]
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/crs",
+        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/foreign_key",
         "path_kind": "property"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
@@ -12575,7 +12269,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12601,7 +12294,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12609,7 +12301,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12617,7 +12308,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -12626,17 +12316,9 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
@@ -12645,20 +12327,20 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/kind",
+        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/kind",
         "path_kind": "property"
       },
-      "purpose": "Selects geometry assembled from separate longitude and latitude entity fields.",
+      "purpose": "Selects whether one declared records relationship belongs to, has many, or has one target record.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [],
         "composed": false
@@ -12675,7 +12357,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12701,7 +12382,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12709,7 +12389,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12717,7 +12396,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -12727,22 +12405,26 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "point"
+          "keyword": "enum",
+          "value": [
+            "belongs_to",
+            "has_many",
+            "has_one"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/latitude_field",
+        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/target",
         "path_kind": "property"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -12762,7 +12444,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12788,7 +12469,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12796,7 +12476,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12804,7 +12483,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -12830,14 +12508,14 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/longitude_field",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/relationships/propertyNames",
+        "path_kind": "map_key"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -12845,7 +12523,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -12857,7 +12535,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12883,7 +12560,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12891,7 +12567,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12899,13 +12574,13 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -12925,33 +12600,127 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/recordsApi/properties/required_principal_filters",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Lists principal-bound fields required for records queries; it must be empty when attribute-release profiles are configured because subject lookup cannot supply principal filters.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "local_reference": "#/$defs/fieldList",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxItems",
+          "value": 16
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
+        }
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/fieldList"
+      }
+    },
+    {
+      "address": {
+        "schema": "project",
+        "pointer": "/$defs/recordsApi/properties/scopes",
+        "path_kind": "property"
+      },
+      "purpose": "Groups the authorization scopes required for records metadata, row access, aggregates, and evidence verification.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -12977,7 +12746,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -12985,7 +12753,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -12993,22 +12760,19 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "kind",
-            "field",
-            "crs"
+            "metadata",
+            "rows"
           ]
         },
         {
@@ -13020,22 +12784,22 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/crs",
+        "pointer": "/$defs/recordsApi/properties/scopes/properties/aggregate",
         "path_kind": "property"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose": "Authorization scope token.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/scope",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -13047,7 +12811,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13073,7 +12836,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13081,7 +12843,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13089,7 +12850,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -13100,7 +12860,7 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 256
+          "value": 128
         },
         {
           "keyword": "minLength",
@@ -13117,28 +12877,28 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/scope"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/field",
+        "pointer": "/$defs/recordsApi/properties/scopes/properties/evidence_verification",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Authorization scope token.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/scope",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -13150,7 +12910,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13176,7 +12935,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13184,7 +12942,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13192,7 +12949,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -13201,9 +12957,17 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
         },
         {
           "keyword": "type",
@@ -13212,27 +12976,30 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/scope"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/kind",
+        "pointer": "/$defs/recordsApi/properties/scopes/properties/metadata",
         "path_kind": "property"
       },
-      "purpose": "Selects the GeoJSON, WKT, or WKB encoding used by the configured geometry field.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Authorization scope token.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/scope",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -13242,7 +13009,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13268,7 +13034,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13276,7 +13041,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13284,7 +13048,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -13294,36 +13057,48 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "geojson",
-            "wkt",
-            "wkb"
-          ]
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/scope"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpdci/properties/expression_fields",
+        "pointer": "/$defs/recordsApi/properties/scopes/properties/rows",
         "path_kind": "property"
       },
-      "purpose": "Maps SP-DCI expression input names to the entity fields available during expression evaluation.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Authorization scope token.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/recordFieldMap",
+        "local_reference": "#/$defs/scope",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -13333,7 +13108,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13359,7 +13133,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13367,7 +13140,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13375,7 +13147,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -13385,35 +13156,42 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 64
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordFieldMap"
+        "pointer": "/$defs/scope"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpdci/properties/identifiers",
+        "pointer": "/$defs/recordsApi/properties/standards",
         "path_kind": "property"
       },
-      "purpose": "Maps SP-DCI identifier names to the entity fields used to identify a record.",
+      "purpose": "Declares whether this records API exposes its reviewed OGC Features and SP-DCI standards profiles.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordFieldMap",
         "composed": false
       },
       "requiredness": "required",
@@ -13428,7 +13206,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13454,7 +13231,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13462,7 +13238,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13470,7 +13245,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -13480,40 +13254,36 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 64
+          "keyword": "required",
+          "value": [
+            "ogc_features",
+            "sp_dci"
+          ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordFieldMap"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpdci/properties/record_type",
+        "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features",
         "path_kind": "property"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
-      "purpose_source": "schema_description",
+      "purpose": "Disables OGC API Features support or supplies the reviewed spatial profile used to enable it.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/token",
-        "composed": false
+        "schema_types": [],
+        "composed": true
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -13523,7 +13293,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13549,7 +13318,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13557,7 +13325,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13565,7 +13332,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -13573,60 +13339,35 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/token"
-      }
+      "constraints": []
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpdci/properties/registry",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13652,7 +13393,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13660,7 +13400,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13668,60 +13407,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": false
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpdci/properties/registry_type",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose": "OGC API Features collection metadata and bounded geometry mapping.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/recordSpatial",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13747,7 +13477,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13755,7 +13484,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13763,56 +13491,47 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "keyword": "required",
+          "value": [
+            "geometry"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/recordSpatial"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordSpdci/properties/response_fields",
+        "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci",
         "path_kind": "property"
       },
-      "purpose": "Maps SP-DCI response names to the entity fields returned for an authorized record.",
+      "purpose": "Disables SP-DCI support or supplies the reviewed registry mapping used to enable it.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/recordFieldMap",
-        "composed": false
+        "schema_types": [],
+        "composed": true
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -13824,7 +13543,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13850,7 +13568,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13858,7 +13575,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13866,7 +13582,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -13874,51 +13589,35 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordFieldMap"
-      }
+      "constraints": []
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/aggregates",
-        "path_kind": "property"
+        "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Maps aggregate identifiers to governed aggregate definitions exposed by the records API.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -13944,7 +13643,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -13952,7 +13650,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -13960,56 +13657,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 64
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": false
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/aggregates/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Governed aggregate definition with disclosure controls.",
+      "purpose": "SP-DCI registry identity and field mappings for a records service.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordAggregate",
+        "local_reference": "#/$defs/recordSpdci",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14035,7 +13727,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14043,7 +13734,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14051,21 +13741,23 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "description",
-            "disclosure_control"
+            "registry",
+            "registry_type",
+            "record_type",
+            "identifiers",
+            "expression_fields"
           ]
         },
         {
@@ -14075,30 +13767,27 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAggregate"
+        "pointer": "/$defs/recordSpdci"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/aggregates/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/recordsService/properties/access_rights",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Classifies the records service as public, restricted, or non-public for catalog and access metadata.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -14108,7 +13797,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14134,7 +13822,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14142,7 +13829,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14150,49 +13836,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "public",
+            "restricted",
+            "non_public"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/attribute_release_profiles",
+        "pointer": "/$defs/recordsService/properties/api",
         "path_kind": "property"
       },
-      "purpose": "Purpose-bound, exact-one identity releases keyed by stable profile id. Generated Relay responses omit source metadata and are never cacheable.",
+      "purpose": "Relay records API behavior, authorization, query bounds, and standards profiles.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordAttributeReleaseProfiles",
+        "local_reference": "#/$defs/recordsApi",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -14204,7 +13884,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14230,7 +13909,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14238,7 +13916,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14246,7 +13923,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -14256,8 +13932,13 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
+          "keyword": "required",
+          "value": [
+            "scopes",
+            "projection",
+            "pagination",
+            "standards"
+          ]
         },
         {
           "keyword": "type",
@@ -14266,23 +13947,23 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordAttributeReleaseProfiles"
+        "pointer": "/$defs/recordsApi"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/filters",
+        "pointer": "/$defs/recordsService/properties/conforms_to",
         "path_kind": "property"
       },
-      "purpose": "Maps filterable entity fields to the comparison operators the records API permits for each field.",
+      "purpose": "Lists the standards or specifications to which the records service declares conformance.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
@@ -14298,7 +13979,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14324,7 +14004,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14332,7 +14011,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14340,7 +14018,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -14350,36 +14027,40 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 256
+          "keyword": "maxItems",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/filters/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/recordsService/properties/conforms_to/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Allowed operators for one queryable field.",
+      "purpose": "Bounded human-readable project metadata.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
-        "local_reference": "#/$defs/filterOperators",
+        "local_reference": "#/$defs/text",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -14389,7 +14070,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14415,7 +14095,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14423,7 +14102,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14431,45 +14109,139 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "minItems",
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
+    },
+    {
+      "address": {
+        "schema": "project",
+        "pointer": "/$defs/recordsService/properties/description",
+        "path_kind": "property"
+      },
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/text",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 2048
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/filterOperators"
+        "pointer": "/$defs/text"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/filters/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/recordsService/properties/entity",
+        "path_kind": "property"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -14477,7 +14249,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -14489,7 +14261,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14515,7 +14286,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14523,7 +14293,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14531,14 +14300,12 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -14558,18 +14325,16 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/pagination",
+        "pointer": "/$defs/recordsService/properties/kind",
         "path_kind": "property"
       },
-      "purpose": "Defines the default and maximum row limits enforced by records API pagination.",
+      "purpose": "Identifies this service declaration as a Relay records API backed by an authored entity.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
@@ -14584,7 +14349,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14610,7 +14374,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14618,7 +14381,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14626,7 +14388,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -14636,38 +14397,32 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "default_limit",
-            "max_limit"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "records_api"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/pagination/properties/default_limit",
+        "pointer": "/$defs/recordsService/properties/owner",
         "path_kind": "property"
       },
-      "purpose": "Sets the row limit applied when a records request does not supply its own limit.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -14677,7 +14432,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14703,7 +14457,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14711,7 +14464,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14719,7 +14471,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -14729,37 +14480,39 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 10000
+          "keyword": "maxLength",
+          "value": 2048
         },
         {
-          "keyword": "minimum",
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/pagination/properties/max_limit",
+        "pointer": "/$defs/recordsService/properties/sensitivity",
         "path_kind": "property"
       },
-      "purpose": "Caps the row limit that any records request may select; it must be at least 2 when attribute-release profiles are configured so ambiguous subjects can be detected.",
+      "purpose": "Classifies the overall sensitivity of records exposed by this service declaration.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -14771,7 +14524,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14797,7 +14549,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14805,7 +14556,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14813,7 +14563,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -14823,39 +14572,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 10000
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
+          "keyword": "enum",
+          "value": [
+            "public",
+            "internal",
+            "personal",
+            "confidential",
+            "secret"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/projection",
+        "pointer": "/$defs/recordsService/properties/title",
         "path_kind": "property"
       },
-      "purpose": "Lists the entity fields that the records API is permitted to project into row responses.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded human-readable project metadata.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -14865,7 +14613,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14891,7 +14638,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14899,7 +14645,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -14907,7 +14652,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -14917,44 +14661,41 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 256
+          "keyword": "maxLength",
+          "value": 2048
         },
         {
-          "keyword": "minItems",
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/text"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/projection/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/recordsService/properties/update_frequency",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares the reviewed cadence at which the records service's backing data is updated.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -14964,7 +14705,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -14990,7 +14730,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -14998,7 +14737,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15006,60 +14744,61 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "continuous",
+            "daily",
+            "weekly",
+            "termly",
+            "monthly",
+            "quarterly",
+            "annual",
+            "irregular",
+            "as_needed",
+            "unknown"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/purposes",
-        "path_kind": "property"
+        "pointer": "/$defs/service/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Lists the bounded purpose identifiers accepted by this records API policy.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Relay consultation policy and closed bindings to authored integration packs.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/consultationService",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15085,7 +14824,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15093,7 +14831,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15101,60 +14838,66 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 32
+          "keyword": "required",
+          "value": [
+            "kind",
+            "version",
+            "purpose",
+            "legal_basis",
+            "consent",
+            "consultations"
+          ]
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/consultationService"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/purposes/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/service/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Non-empty token without commas, whitespace, or control characters.",
+      "purpose": "Relay records API backed by one authored materialized entity.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/recordsService",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15180,7 +14923,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15188,7 +14930,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15196,56 +14937,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "keyword": "required",
+          "value": [
+            "kind",
+            "entity",
+            "api"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/token"
+        "pointer": "/$defs/recordsService"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/relationships",
-        "path_kind": "property"
+        "pointer": "/$defs/variables/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Declares the bounded named relationships that records queries may follow between authored entities.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -15257,7 +14993,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15283,7 +15018,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15291,7 +15025,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15299,18 +15032,21 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 64
+          "keyword": "required",
+          "value": [
+            "from",
+            "type"
+          ]
         },
         {
           "keyword": "type",
@@ -15321,23 +15057,23 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/variables/additionalProperties/properties/from",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Binds one consultation variable to its caller-supplied request variable path.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -15347,7 +15083,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15373,7 +15108,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15381,7 +15115,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15389,51 +15122,42 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "kind",
-            "target",
-            "foreign_key"
-          ]
+          "keyword": "pattern",
+          "value": "^request\\.variables\\.[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/concept_uri",
+        "pointer": "/$defs/variables/additionalProperties/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares the request variable as a date value for typed consultation evaluation.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/text",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -15443,7 +15167,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15469,7 +15192,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15477,7 +15199,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15485,7 +15206,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -15495,34 +15215,22 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "date"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/foreign_key",
-        "path_kind": "property"
+        "pointer": "/$defs/variables/propertyNames",
+        "path_kind": "map_key"
       },
       "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
@@ -15530,7 +15238,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -15542,7 +15250,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15568,7 +15275,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15576,7 +15282,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15584,13 +15289,13 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -15610,31 +15315,30 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/kind",
-        "path_kind": "property"
+        "pointer": "/anyOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Selects whether one declared records relationship belongs to, has many, or has one target record.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15660,7 +15364,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15668,7 +15371,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15676,21 +15378,19 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "belongs_to",
-            "has_many",
-            "has_one"
+            "integrations"
           ]
         }
       ]
@@ -15698,24 +15398,21 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/target",
+        "pointer": "/anyOf/0/properties/integrations",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Requires at least one authored integration when the project satisfies the integration-content alternative.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -15725,7 +15422,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15751,7 +15447,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15759,7 +15454,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15767,7 +15461,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -15777,50 +15470,38 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "minProperties",
+          "value": 1
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/relationships/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/anyOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15846,7 +15527,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15854,7 +15534,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15862,49 +15541,39 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "required",
+          "value": [
+            "entities"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/required_principal_filters",
+        "pointer": "/anyOf/1/properties/entities",
         "path_kind": "property"
       },
-      "purpose": "Lists principal-bound fields required for records queries; it must be empty when attribute-release profiles are configured because subject lookup cannot supply principal filters.",
+      "purpose": "Requires at least one authored entity when the project satisfies the entity-content alternative.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/fieldList",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -15916,7 +15585,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -15942,7 +15610,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -15950,7 +15617,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -15958,7 +15624,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -15968,38 +15633,107 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "minProperties",
+          "value": 1
         }
-      ],
-      "local_reference": {
+      ]
+    },
+    {
+      "address": {
         "schema": "project",
-        "pointer": "/$defs/fieldList"
-      }
+        "pointer": "/anyOf/2",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "services"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/scopes",
+        "pointer": "/anyOf/2/properties/services",
         "path_kind": "property"
       },
-      "purpose": "Groups the authorization scopes required for records metadata, row access, aggregates, and evidence verification.",
+      "purpose": "Requires at least one authored service when the project satisfies the service-content alternative.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
@@ -16014,7 +15748,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16040,7 +15773,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16048,7 +15780,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16056,7 +15787,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -16066,39 +15796,31 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "metadata",
-            "rows"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "minProperties",
+          "value": 1
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/scopes/properties/aggregate",
+        "pointer": "/properties/entities",
         "path_kind": "property"
       },
-      "purpose": "Authorization scope token.",
+      "purpose": "Materialized entity definitions keyed by project-local entity identifier.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/scope",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -16108,7 +15830,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16134,7 +15855,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16142,7 +15862,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16150,7 +15869,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -16160,48 +15878,35 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "keyword": "maxProperties",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/scope"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/scopes/properties/evidence_verification",
-        "path_kind": "property"
+        "pointer": "/properties/entities/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Authorization scope token.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/scope",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -16211,7 +15916,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16237,7 +15941,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16245,7 +15948,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16253,53 +15955,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "keyword": "required",
+          "value": [
+            "file"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/scope"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/scopes/properties/metadata",
+        "pointer": "/properties/entities/additionalProperties/properties/file",
         "path_kind": "property"
       },
-      "purpose": "Authorization scope token.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects the project-relative authored entity document for this project-local entity identifier.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/scope",
+        "local_reference": "#/$defs/relativePath",
         "composed": false
       },
       "requiredness": "required",
@@ -16309,12 +16001,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16340,7 +16031,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16348,7 +16038,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16356,18 +16045,18 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 128
+          "value": 4096
         },
         {
           "keyword": "minLength",
@@ -16375,7 +16064,7 @@
         },
         {
           "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
@@ -16384,28 +16073,28 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/scope"
+        "pointer": "/$defs/relativePath"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/scopes/properties/rows",
-        "path_kind": "property"
+        "pointer": "/properties/entities/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Authorization scope token.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/scope",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -16417,7 +16106,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16443,7 +16131,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16451,7 +16138,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16459,26 +16145,18 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
@@ -16487,27 +16165,27 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/scope"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/standards",
+        "pointer": "/properties/integrations",
         "path_kind": "property"
       },
-      "purpose": "Declares whether this records API exposes its reviewed OGC Features and SP-DCI standards profiles.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Source adaptation definitions keyed by project-local integration identifier.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -16519,7 +16197,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16545,7 +16222,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16553,7 +16229,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16561,7 +16236,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -16569,12 +16243,98 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
+      "constraints": [
+        {
+          "keyword": "maxProperties",
+          "value": 16
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "project",
+        "pointer": "/properties/integrations/additionalProperties",
+        "path_kind": "map_value"
+      },
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "authoring_contract",
+      "human_owner": "registry_maintainers",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.project.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
+      ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "ogc_features",
-            "sp_dci"
+            "file"
           ]
         },
         {
@@ -16586,31 +16346,33 @@
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features",
+        "pointer": "/properties/integrations/additionalProperties/properties/file",
         "path_kind": "property"
       },
-      "purpose": "Disables OGC API Features support or supplies the reviewed spatial profile used to enable it.",
+      "purpose": "Selects the project-relative authored integration document for this project-local integration identifier.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
-        "composed": true
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/relativePath",
+        "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16636,7 +16398,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16644,7 +16405,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16652,44 +16412,67 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/relativePath"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/properties/integrations/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16715,7 +16498,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16723,7 +16505,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16731,53 +16512,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": false
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/properties/registry",
+        "path_kind": "property"
       },
-      "purpose": "OGC API Features collection metadata and bounded geometry mapping.",
+      "purpose": "Stable identity of the Registry Stack project.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordSpatial",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16803,7 +16589,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16811,7 +16596,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16819,50 +16603,47 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "geometry"
+            "id"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordSpatial"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci",
+        "pointer": "/properties/registry/properties/id",
         "path_kind": "property"
       },
-      "purpose": "Disables SP-DCI support or supplies the reviewed registry mapping used to enable it.",
+      "purpose": "Assigns the stable project-local registry identifier used to bind generated product inputs and review artifacts.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
-        "schema_types": [],
-        "composed": true
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
+        "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -16872,7 +16653,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -16898,7 +16678,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -16906,7 +16685,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -16914,7 +16692,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -16922,124 +16699,50 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.project.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": false
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/properties/services",
+        "path_kind": "property"
       },
-      "purpose": "SP-DCI registry identity and field mappings for a records service.",
+      "purpose": "Relay records and consultation APIs exposed by the project.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordSpdci",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17065,7 +16768,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17073,7 +16775,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17081,52 +16782,41 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "registry",
-            "registry_type",
-            "record_type",
-            "identifiers",
-            "expression_fields"
-          ]
+          "keyword": "maxProperties",
+          "value": 32
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordSpdci"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsService/properties/access_rights",
-        "path_kind": "property"
+        "pointer": "/properties/services/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Classifies the records service as public, restricted, or non-public for catalog and access metadata.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Closed choice between a Relay consultation service and a Relay records service.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [],
+        "local_reference": "#/$defs/service",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -17138,7 +16828,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17164,7 +16853,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17172,7 +16860,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17180,46 +16867,41 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "public",
-            "restricted",
-            "non_public"
-          ]
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "project",
+        "pointer": "/$defs/service"
+      }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsService/properties/api",
-        "path_kind": "property"
+        "pointer": "/properties/services/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Relay records API behavior, authorization, query bounds, and standards profiles.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/recordsApi",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -17229,7 +16911,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17255,7 +16936,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17263,7 +16943,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17271,48 +16950,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "scopes",
-            "projection",
-            "pagination",
-            "standards"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/recordsApi"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsService/properties/conforms_to",
+        "pointer": "/properties/starter",
         "path_kind": "property"
       },
-      "purpose": "Lists the standards or specifications to which the records service declares conformance.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Immutable provenance for a workspace initialized from a Registry Stack starter. The digest excludes this content_digest field and covers the starter's authored project files.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
         "composed": false
       },
@@ -17328,7 +17002,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17354,7 +17027,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17362,7 +17034,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17370,7 +17041,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -17380,50 +17050,48 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 32
+          "keyword": "required",
+          "value": [
+            "id",
+            "release",
+            "content_digest"
+          ]
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsService/properties/conforms_to/items",
-        "path_kind": "array_item"
+        "pointer": "/properties/starter/properties/content_digest",
+        "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
+      "purpose": "Digest of the initialized starter authoring content, used to report later workspace divergence.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17449,7 +17117,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17457,7 +17124,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17465,53 +17131,44 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsService/properties/description",
+        "pointer": "/properties/starter/properties/id",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
+      "purpose": "Registry Stack starter identifier.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/text",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -17523,7 +17180,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17549,7 +17205,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17557,7 +17212,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17565,7 +17219,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -17575,12 +17228,8 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
@@ -17589,25 +17238,25 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/text"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsService/properties/entity",
+        "pointer": "/properties/starter/properties/release",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Registry Stack release that supplied the starter.",
       "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/token",
         "composed": false
       },
       "requiredness": "required",
@@ -17622,7 +17271,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17648,7 +17296,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17656,7 +17303,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17664,7 +17310,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -17673,9 +17318,17 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
         },
         {
           "keyword": "type",
@@ -17684,20 +17337,20 @@
       ],
       "local_reference": {
         "schema": "project",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/token"
       }
     },
     {
       "address": {
         "schema": "project",
-        "pointer": "/$defs/recordsService/properties/kind",
+        "pointer": "/properties/version",
         "path_kind": "property"
       },
-      "purpose": "Identifies this service declaration as a Relay records API backed by an authored entity.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Project authoring format version.",
+      "purpose_source": "schema_description",
       "semantic_owner": "authoring_contract",
       "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "scope": "The product-neutral project graph and the Relay services that consume its authored contracts.",
       "field_type": {
         "schema_types": [],
         "composed": false
@@ -17709,12 +17362,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17740,7 +17392,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17748,7 +17399,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17756,7 +17406,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -17767,41 +17416,39 @@
       "constraints": [
         {
           "keyword": "const",
-          "value": "records_api"
+          "value": 1
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/recordsService/properties/owner",
-        "path_kind": "property"
+        "schema": "environment",
+        "pointer": "",
+        "path_kind": "root"
       },
-      "purpose": "Bounded human-readable project metadata.",
+      "purpose": "Binds a Registry Stack project to environment-specific Relay services, sources, credentials, and deployment topology.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/text",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "not_applicable",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "structural",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17811,23 +17458,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
-        "schema_examples_available": false,
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17835,7 +17482,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17843,7 +17489,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -17853,51 +17498,48 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "version",
+            "deployment"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/recordsService/properties/sensitivity",
+        "schema": "environment",
+        "pointer": "/$defs/ca/properties/file",
         "path_kind": "property"
       },
-      "purpose": "Classifies the overall sensitivity of records exposed by this service declaration.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -17907,23 +17549,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -17931,7 +17573,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -17939,58 +17580,66 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "public",
-            "internal",
-            "personal",
-            "confidential",
-            "secret"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 2
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/absolutePath"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/recordsService/properties/title",
+        "schema": "environment",
+        "pointer": "/$defs/ca/properties/generation",
         "path_kind": "property"
       },
-      "purpose": "Bounded human-readable project metadata.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Records the operator-controlled trust-root generation used for explicit certificate-authority rotation.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/text",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18000,23 +17649,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18024,7 +17673,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18032,61 +17680,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
+          "keyword": "maximum",
+          "value": 18446744073709551615
         },
         {
-          "keyword": "minLength",
+          "keyword": "minimum",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/text"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/recordsService/properties/update_frequency",
-        "path_kind": "property"
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Declares the reviewed cadence at which the records service's backing data is updated.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "structural",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18096,23 +17741,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18120,7 +17765,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18128,63 +17772,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "continuous",
-            "daily",
-            "weekly",
-            "termly",
-            "monthly",
-            "quarterly",
-            "annual",
-            "irregular",
-            "as_needed",
-            "unknown"
+            "username",
+            "password",
+            "generation"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/service/oneOf/0",
-        "path_kind": "branch"
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/0/properties/generation",
+        "path_kind": "property"
       },
-      "purpose": "Notary evidence policy, consultations, claims, and registry-backed credential profiles. Every claim derives from exactly one declared Relay consultation.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Records the generation of the operator-managed basic-authentication credential references.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/evidenceService",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18194,23 +17833,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18218,7 +17857,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18226,69 +17864,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "kind",
-            "version",
-            "purpose",
-            "legal_basis",
-            "consent",
-            "access",
-            "claims"
-          ]
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/evidenceService"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/service/oneOf/1",
-        "path_kind": "branch"
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/0/properties/password",
+        "path_kind": "property"
       },
-      "purpose": "Relay records API backed by one authored materialized entity.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/recordsService",
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
+      "sensitivity": "secret_reference",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18298,23 +17926,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18322,7 +17950,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18330,22 +17957,19 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "kind",
-            "entity",
-            "api"
+            "secret"
           ]
         },
         {
@@ -18354,40 +17978,40 @@
         }
       ],
       "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/recordsService"
+        "schema": "environment",
+        "pointer": "/$defs/secret"
       }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/variables/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/0/properties/username",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "secret_reference",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18397,23 +18021,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18421,7 +18045,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18429,59 +18052,60 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "from",
-            "type"
+            "secret"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/secret"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/variables/additionalProperties/properties/from",
-        "path_kind": "property"
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Binds one evidence variable to its caller-supplied request variable path.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "structural",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18491,23 +18115,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18515,7 +18139,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18523,38 +18146,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^request\\.variables\\.[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "token",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/variables/additionalProperties/properties/type",
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/1/properties/generation",
         "path_kind": "property"
       },
-      "purpose": "Declares the request variable as a date value for typed evidence evaluation.",
+      "purpose": "Records the generation of the operator-managed bearer-token credential reference.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
       "requiredness": "required",
@@ -18564,12 +18192,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18579,23 +18206,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18603,7 +18230,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18611,52 +18237,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "date"
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/$defs/variables/propertyNames",
-        "path_kind": "map_key"
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/1/properties/token",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "secret_reference",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18666,23 +18299,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18690,7 +18323,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18698,43 +18330,46 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "secret"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
+        "schema": "environment",
+        "pointer": "/$defs/secret"
       }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/anyOf/0",
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/2",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
       "requiredness": "conditional",
@@ -18745,11 +18380,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18759,23 +18393,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18783,7 +18417,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18791,7 +18424,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -18804,24 +18436,33 @@
         {
           "keyword": "required",
           "value": [
-            "integrations"
+            "client_id",
+            "client_secret",
+            "generation"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/anyOf/0/properties/integrations",
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/2/properties/client_id",
         "path_kind": "property"
       },
-      "purpose": "Requires at least one authored integration when the project satisfies the integration-content alternative.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
       "requiredness": "required",
@@ -18831,12 +18472,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "secret_reference",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18846,23 +18486,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18870,7 +18510,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18878,49 +18517,61 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "minProperties",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "secret"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/secret"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/anyOf/1",
-        "path_kind": "branch"
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/2/properties/client_secret",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
+      "sensitivity": "secret_reference",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -18930,23 +18581,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -18954,7 +18605,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -18962,37 +18612,46 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "entities"
+            "secret"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/secret"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/anyOf/1/properties/entities",
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/2/properties/generation",
         "path_kind": "property"
       },
-      "purpose": "Requires at least one authored entity when the project satisfies the entity-content alternative.",
+      "purpose": "Records the generation of the operator-managed OAuth client credential references.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
       "requiredness": "required",
@@ -19002,12 +18661,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19017,23 +18675,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19041,7 +18699,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19049,34 +18706,44 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "minProperties",
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
           "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/anyOf/2",
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/3",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
       "requiredness": "conditional",
@@ -19087,11 +18754,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19101,23 +18767,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19125,7 +18791,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19133,7 +18798,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -19146,24 +18810,31 @@
         {
           "keyword": "required",
           "value": [
-            "services"
+            "value",
+            "generation"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/anyOf/2/properties/services",
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/3/properties/generation",
         "path_kind": "property"
       },
-      "purpose": "Requires at least one authored service when the project satisfies the service-content alternative.",
+      "purpose": "Records the generation of the operator-managed API-key credential reference.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
       "requiredness": "required",
@@ -19173,12 +18844,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19188,23 +18858,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19212,7 +18882,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19220,51 +18889,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "minProperties",
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
           "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/entities",
+        "schema": "environment",
+        "pointer": "/$defs/credential/oneOf/3/properties/value",
         "path_kind": "property"
       },
-      "purpose": "Materialized entity definitions keyed by project-local entity identifier.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "secret_reference",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19274,23 +18951,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19298,7 +18975,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19306,55 +18982,61 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 32
+          "keyword": "required",
+          "value": [
+            "secret"
+          ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/secret"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/entities/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "environment",
+        "pointer": "/$defs/endpoint/properties/allowed_private_cidrs",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Explicit private network ranges this source may resolve to.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
+        "local_reference": "#/$defs/privateCidrs",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19364,23 +19046,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19388,7 +19070,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19396,59 +19077,63 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "file"
-          ]
+          "keyword": "maxItems",
+          "value": 16
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/privateCidrs"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/entities/additionalProperties/properties/file",
+        "schema": "environment",
+        "pointer": "/$defs/endpoint/properties/ca",
         "path_kind": "property"
       },
-      "purpose": "Selects the project-relative authored entity document for this project-local entity identifier.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Pinned certificate-authority file and its rotation generation.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/relativePath",
+        "local_reference": "#/$defs/ca",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "authored",
+      "sensitivity": "internal",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19458,23 +19143,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19482,7 +19167,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19490,69 +19174,60 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "keyword": "required",
+          "value": [
+            "file",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/relativePath"
+        "schema": "environment",
+        "pointer": "/$defs/ca"
       }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/entities/propertyNames",
-        "path_kind": "map_key"
+        "schema": "environment",
+        "pointer": "/$defs/endpoint/properties/generation",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Records the operator-controlled private-endpoint generation used for explicit binding rotation.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19562,23 +19237,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19586,7 +19261,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19594,45 +19268,45 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/integrations",
+        "schema": "environment",
+        "pointer": "/$defs/endpoint/properties/mtls",
         "path_kind": "property"
       },
-      "purpose": "Source adaptation definitions keyed by project-local integration identifier.",
+      "purpose": "Client certificate and private-key reference for mutual TLS.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/mtls",
         "composed": false
       },
       "requiredness": "optional",
@@ -19643,11 +19317,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19657,23 +19330,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19681,7 +19354,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19689,7 +19361,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -19699,45 +19370,53 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
+          "keyword": "required",
+          "value": [
+            "certificate_file",
+            "private_key",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/mtls"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/integrations/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "environment",
+        "pointer": "/$defs/endpoint/properties/origin",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "HTTPS origin without path, query, or fragment.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/origin",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19747,23 +19426,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19771,7 +19450,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19779,44 +19457,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "file"
-          ]
+          "keyword": "format",
+          "value": "uri"
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/origin"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/integrations/additionalProperties/properties/file",
+        "schema": "environment",
+        "pointer": "/$defs/endpoint/properties/path",
         "path_kind": "property"
       },
-      "purpose": "Selects the project-relative authored integration document for this project-local integration identifier.",
+      "purpose": "Binds a reviewed private endpoint path beneath its separately configured origin.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/relativePath",
         "composed": false
       },
       "requiredness": "required",
@@ -19827,11 +19509,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19841,23 +19522,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19865,7 +19546,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19873,7 +19553,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -19889,53 +19568,47 @@
         },
         {
           "keyword": "minLength",
-          "value": 1
+          "value": 2
         },
         {
           "keyword": "pattern",
-          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//)(?!.*[?#]).+$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/relativePath"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/integrations/propertyNames",
-        "path_kind": "map_key"
+        "schema": "environment",
+        "pointer": "/$defs/entity/properties/columns",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Maps authored entity field names to columns supplied by the environment-owned provider.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -19945,23 +19618,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -19969,7 +19642,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -19977,60 +19649,54 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/registry",
-        "path_kind": "property"
+        "schema": "environment",
+        "pointer": "/$defs/entity/properties/columns/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Stable identity of the Registry Stack project.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20040,23 +19706,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20064,7 +19730,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20072,38 +19737,40 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "id"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/registry/properties/id",
-        "path_kind": "property"
+        "schema": "environment",
+        "pointer": "/$defs/entity/properties/columns/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Assigns the stable project-local registry identifier used to bind generated product inputs and review artifacts.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "string"
@@ -20111,7 +19778,7 @@
         "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -20119,11 +19786,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20133,23 +19799,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20157,7 +19823,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20165,13 +19830,13 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -20184,40 +19849,39 @@
         }
       ],
       "local_reference": {
-        "schema": "project",
+        "schema": "environment",
         "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/services",
+        "schema": "environment",
+        "pointer": "/$defs/entity/properties/generation",
         "path_kind": "property"
       },
-      "purpose": "Relay records APIs and Notary evidence services exposed by the project.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Records the operator-controlled generation of this entity materialization binding.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20227,23 +19891,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20251,7 +19915,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20259,42 +19922,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 32
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/services/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "environment",
+        "pointer": "/$defs/entity/properties/provider",
+        "path_kind": "property"
       },
-      "purpose": "Closed choice between a Notary evidence service and a Relay records service.",
+      "purpose": "Environment-specific physical provider for a materialized entity.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/service",
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/provider",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -20302,11 +19971,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20316,23 +19984,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20340,7 +20008,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20348,52 +20015,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [],
       "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/service"
+        "schema": "environment",
+        "pointer": "/$defs/provider"
       }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/services/propertyNames",
-        "path_kind": "map_key"
+        "schema": "environment",
+        "pointer": "/$defs/entity/properties/source_revision",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Records the operator-supplied revision label of the bound entity source.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20403,23 +20066,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20427,7 +20090,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20435,48 +20097,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/starter",
+        "schema": "environment",
+        "pointer": "/$defs/integration/properties/source",
         "path_kind": "property"
       },
-      "purpose": "Immutable provenance for a workspace initialized from a Registry Stack starter. The digest excludes this content_digest field and covers the starter's authored project files.",
+      "purpose": "Runtime source connection policy for one authored integration.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/source",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -20484,11 +20146,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20498,23 +20159,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20522,7 +20183,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20530,7 +20190,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -20542,32 +20201,35 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "release",
-            "content_digest"
+            "origin"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/source"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/starter/properties/content_digest",
+        "schema": "environment",
+        "pointer": "/$defs/mtls/properties/certificate_file",
         "path_kind": "property"
       },
-      "purpose": "Digest of the initialized starter authoring content, used to report later workspace divergence.",
+      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
       "requiredness": "required",
@@ -20578,11 +20240,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
-      "state": "authored",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20592,23 +20253,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20616,7 +20277,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20624,7 +20284,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -20634,47 +20293,57 @@
         "sensitive_operational_metadata"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 2
+        },
         {
           "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/absolutePath"
+      }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/starter/properties/id",
+        "schema": "environment",
+        "pointer": "/$defs/mtls/properties/generation",
         "path_kind": "property"
       },
-      "purpose": "Registry Stack starter identifier.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Records the operator-controlled mutual-TLS generation used for explicit certificate and key rotation.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20684,23 +20353,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20708,7 +20377,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20716,60 +20384,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/starter/properties/release",
+        "schema": "environment",
+        "pointer": "/$defs/mtls/properties/private_key",
         "path_kind": "property"
       },
-      "purpose": "Registry Stack release that supplied the starter.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
       "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token",
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "sensitivity": "secret_reference",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20779,23 +20446,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20803,7 +20470,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20811,65 +20477,60 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$"
+          "keyword": "required",
+          "value": [
+            "secret"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "project",
-        "pointer": "/$defs/token"
+        "schema": "environment",
+        "pointer": "/$defs/secret"
       }
     },
     {
       "address": {
-        "schema": "project",
-        "pointer": "/properties/version",
-        "path_kind": "property"
+        "schema": "environment",
+        "pointer": "/$defs/privateCidrs/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Project authoring format version.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "authoring_contract",
-      "human_owner": "registry_maintainers",
-      "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "public",
-      "state": "authored",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20879,23 +20540,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
+        "operator_preflight",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.project.invalid",
+      "diagnostic": "registryctl.authoring.environment.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.",
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20903,7 +20564,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20911,29 +20571,38 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": 1
+          "keyword": "maxLength",
+          "value": 64
+        },
+        {
+          "keyword": "minLength",
+          "value": 3
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "",
-        "path_kind": "root"
+        "pointer": "/$defs/provider/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Binds a Registry Stack project to environment-specific services, sources, credentials, and deployment topology.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -20941,9 +20610,9 @@
         "schema_types": [
           "object"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "conditional",
       "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
@@ -20955,7 +20624,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -20974,7 +20642,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": true,
+        "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
@@ -20982,7 +20650,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -20990,7 +20657,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -20998,20 +20664,20 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "version",
-            "deployment"
+            "type",
+            "path"
           ]
         },
         {
@@ -21023,34 +20689,32 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/ca/properties/file",
+        "pointer": "/$defs/provider/oneOf/0/properties/delimiter",
         "path_kind": "property"
       },
-      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects the byte used to delimit fields in the bound CSV source.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -21077,7 +20741,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -21085,7 +20748,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -21093,45 +20755,35 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
+          "keyword": "maximum",
+          "value": 255
         },
         {
-          "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/absolutePath"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/ca/properties/generation",
+        "pointer": "/$defs/provider/oneOf/0/properties/header_row",
         "path_kind": "property"
       },
-      "purpose": "Records the operator-controlled trust-root generation used for explicit certificate-authority rotation.",
+      "purpose": "Selects the one-based CSV row containing source column headers.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -21142,19 +20794,18 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -21181,7 +20832,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -21189,7 +20839,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -21197,19 +20846,17 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 18446744073709551615
+          "value": 4294967295
         },
         {
           "keyword": "minimum",
@@ -21224,119 +20871,24 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "operator_preflight",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "username",
-            "password",
-            "generation"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/0/properties/generation",
+        "pointer": "/$defs/provider/oneOf/0/properties/path",
         "path_kind": "property"
       },
-      "purpose": "Records the generation of the operator-managed basic-authentication credential references.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -21346,7 +20898,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -21373,7 +20924,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -21381,7 +20931,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -21389,7 +20938,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -21400,50 +20948,56 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 18446744073709551615
+          "keyword": "maxLength",
+          "value": 4096
         },
         {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "minLength",
+          "value": 2
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/absolutePath"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/0/properties/password",
+        "pointer": "/$defs/provider/oneOf/0/properties/quote",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects the byte used to quote fields in the bound CSV source.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -21470,7 +21024,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -21478,7 +21031,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -21486,48 +21038,41 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maximum",
+          "value": 255
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/0/properties/username",
+        "pointer": "/$defs/provider/oneOf/0/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects CSV as the environment-owned materialization provider for an authored entity.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/secret",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
@@ -21537,12 +21082,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -21569,7 +21113,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -21577,7 +21120,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -21585,36 +21127,24 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "csv"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/1",
+        "pointer": "/$defs/provider/oneOf/1",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
@@ -21640,7 +21170,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -21667,7 +21196,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -21675,7 +21203,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -21683,7 +21210,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -21696,8 +21222,10 @@
         {
           "keyword": "required",
           "value": [
-            "token",
-            "generation"
+            "type",
+            "project_file",
+            "path",
+            "sheet"
           ]
         },
         {
@@ -21709,33 +21237,32 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/1/properties/generation",
+        "pointer": "/$defs/provider/oneOf/1/properties/data_range",
         "path_kind": "property"
       },
-      "purpose": "Records the generation of the operator-managed bearer-token credential reference.",
+      "purpose": "Restricts entity materialization to the reviewed range within the selected worksheet.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -21762,7 +21289,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -21770,7 +21296,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -21778,61 +21303,57 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 18446744073709551615
+          "keyword": "maxLength",
+          "value": 256
         },
         {
-          "keyword": "minimum",
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/1/properties/token",
+        "pointer": "/$defs/provider/oneOf/1/properties/header_row",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects the one-based XLSX row containing source column headers.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -21859,7 +21380,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -21867,7 +21387,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -21875,159 +21394,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maximum",
+          "value": 4294967295
         },
         {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
-    },
-    {
-      "address": {
-        "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/2",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "operator_preflight",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "client_id",
-            "client_secret",
-            "generation"
-          ]
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/2/properties/client_id",
+        "pointer": "/$defs/provider/oneOf/1/properties/path",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/secret",
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22054,7 +21472,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22062,7 +21479,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22070,63 +21486,67 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 2
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/secret"
+        "pointer": "/$defs/absolutePath"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/2/properties/client_secret",
+        "pointer": "/$defs/provider/oneOf/1/properties/project_file",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
-      "purpose_source": "schema_description",
+      "purpose": "Binds a contained project-relative workbook for offline preflight and read-only runtime mounting without emitting the authoring path into Relay configuration.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/secret",
+        "local_reference": "#/$defs/relativePath",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22153,7 +21573,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22161,7 +21580,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22169,62 +21587,66 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/secret"
+        "pointer": "/$defs/relativePath"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/2/properties/generation",
+        "pointer": "/$defs/provider/oneOf/1/properties/sheet",
         "path_kind": "property"
       },
-      "purpose": "Records the generation of the operator-managed OAuth client credential references.",
+      "purpose": "Names the worksheet read from the environment-owned XLSX source.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22251,7 +21673,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22259,7 +21680,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22267,60 +21687,55 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 18446744073709551615
+          "keyword": "maxLength",
+          "value": 256
         },
         {
-          "keyword": "minimum",
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/3",
-        "path_kind": "branch"
+        "pointer": "/$defs/provider/oneOf/1/properties/type",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Selects XLSX as the environment-owned materialization provider for an authored entity.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22347,7 +21762,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22355,7 +21769,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22363,59 +21776,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "value",
-            "generation"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "xlsx"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/3/properties/generation",
-        "path_kind": "property"
+        "pointer": "/$defs/provider/oneOf/2",
+        "path_kind": "branch"
       },
-      "purpose": "Records the generation of the operator-managed API-key credential reference.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22442,7 +21845,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22450,7 +21852,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22458,61 +21859,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "type",
+            "path"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/credential/oneOf/3/properties/value",
+        "pointer": "/$defs/provider/oneOf/2/properties/path",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/secret",
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22539,7 +21937,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22547,7 +21944,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22555,63 +21951,147 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 2
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/secret"
+        "pointer": "/$defs/absolutePath"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/endpoint/properties/allowed_private_cidrs",
+        "pointer": "/$defs/provider/oneOf/2/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Explicit private network ranges this source may resolve to.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects Parquet as the environment-owned materialization provider for an authored entity.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/privateCidrs",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
+      "state": "environment_bound",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "operator_preflight",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.environment.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "const",
+          "value": "parquet"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "environment",
+        "pointer": "/$defs/provider/oneOf/3",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22638,7 +22118,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22646,7 +22125,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22654,41 +22132,37 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "required",
+          "value": [
+            "type",
+            "connection",
+            "schema",
+            "table"
+          ]
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/privateCidrs"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/endpoint/properties/ca",
+        "pointer": "/$defs/provider/oneOf/3/properties/connection",
         "path_kind": "property"
       },
-      "purpose": "Pinned certificate-authority file and its rotation generation.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -22697,22 +22171,21 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ca",
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "secret_reference",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22739,7 +22212,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22747,7 +22219,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22755,20 +22226,19 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "file",
-            "generation"
+            "secret"
           ]
         },
         {
@@ -22778,39 +22248,39 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/ca"
+        "pointer": "/$defs/secret"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/endpoint/properties/generation",
+        "pointer": "/$defs/provider/oneOf/3/properties/schema",
         "path_kind": "property"
       },
-      "purpose": "Records the operator-controlled private-endpoint generation used for explicit binding rotation.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Portable unquoted PostgreSQL schema or table identifier.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/postgresIdentifier",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22837,7 +22307,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22845,7 +22314,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22853,51 +22321,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,62}$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/postgresIdentifier"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/endpoint/properties/mtls",
+        "pointer": "/$defs/provider/oneOf/3/properties/table",
         "path_kind": "property"
       },
-      "purpose": "Client certificate and private-key reference for mutual TLS.",
+      "purpose": "Portable unquoted PostgreSQL schema or table identifier.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/mtls",
+        "local_reference": "#/$defs/postgresIdentifier",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -22907,7 +22373,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -22934,7 +22399,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -22942,7 +22406,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -22950,7 +22413,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -22960,54 +22422,46 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "certificate_file",
-            "private_key",
-            "generation"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,62}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/mtls"
+        "pointer": "/$defs/postgresIdentifier"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/endpoint/properties/origin",
+        "pointer": "/$defs/provider/oneOf/3/properties/type",
         "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects PostgreSQL as the environment-owned materialization provider for an authored entity.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/origin",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23034,7 +22488,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23042,7 +22495,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23050,42 +22502,28 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "postgres"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/origin"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/endpoint/properties/path",
-        "path_kind": "property"
+        "pointer": "/$defs/relayOrigin/anyOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Binds a reviewed private endpoint path beneath its separately configured origin.",
-      "purpose_source": "reviewed_override",
+      "purpose": "HTTPS origin without path, query, or fragment.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -23093,21 +22531,21 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/origin",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23134,7 +22572,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23142,7 +22579,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23150,64 +22586,63 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
+          "keyword": "format",
+          "value": "uri"
         },
         {
           "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//)(?!.*[?#]).+$"
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/origin"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/entity/properties/columns",
-        "path_kind": "property"
+        "pointer": "/$defs/relayOrigin/anyOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Maps authored entity field names to columns supplied by the environment-owned provider.",
-      "purpose_source": "reviewed_override",
+      "purpose": "HTTP IP-loopback origin accepted only under the local profile.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/localLoopbackOrigin",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23234,7 +22669,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23242,7 +22676,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23250,32 +22683,40 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "minProperties",
-          "value": 1
+          "keyword": "format",
+          "value": "uri"
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/localLoopbackOrigin"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/entity/properties/columns/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/relayResource/anyOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Exact HTTPS resource without query or fragment.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -23284,22 +22725,21 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/httpsResource",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23326,7 +22766,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23334,7 +22773,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23342,19 +22780,22 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uri"
+        },
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
         },
         {
           "keyword": "type",
@@ -23363,16 +22804,16 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/httpsResource"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/entity/properties/columns/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/relayResource/anyOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "HTTP IP-loopback resource accepted only with the local deployment profile.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -23381,22 +22822,21 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/localLoopbackResource",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23423,7 +22863,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23431,7 +22870,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23439,19 +22877,22 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uri"
+        },
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/[^?#]+$"
         },
         {
           "keyword": "type",
@@ -23460,16 +22901,16 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/localLoopbackResource"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/entity/properties/generation",
+        "pointer": "/$defs/secret/properties/secret",
         "path_kind": "property"
       },
-      "purpose": "Records the operator-controlled generation of this entity materialization binding.",
+      "purpose": "Names the operator-managed environment secret reference without containing the secret value.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -23487,12 +22928,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23519,7 +22959,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23527,7 +22966,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23535,23 +22973,18 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[A-Z_][A-Z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
@@ -23562,105 +22995,19 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/entity/properties/provider",
+        "pointer": "/$defs/service/properties/service",
         "path_kind": "property"
       },
-      "purpose": "Environment-specific physical provider for a materialized entity.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/provider",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "operator_preflight",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/provider"
-      }
-    },
-    {
-      "address": {
-        "schema": "environment",
-        "pointer": "/$defs/entity/properties/source_revision",
-        "path_kind": "property"
-      },
-      "purpose": "Records the operator-supplied revision label of the bound entity source.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
@@ -23670,12 +23017,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23702,7 +23048,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23710,7 +23055,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23718,61 +23062,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/integration/properties/source",
+        "pointer": "/$defs/source/properties/allowed_private_cidrs",
         "path_kind": "property"
       },
-      "purpose": "Runtime source connection policy for one authored integration.",
+      "purpose": "Explicit private network ranges this source may resolve to.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/source",
+        "local_reference": "#/$defs/privateCidrs",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23799,7 +23140,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23807,7 +23147,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23815,62 +23154,63 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "origin"
-          ]
+          "keyword": "maxItems",
+          "value": 16
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/source"
+        "pointer": "/$defs/privateCidrs"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/internalOrigin/anyOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/ca",
+        "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
+      "purpose": "Pinned certificate-authority file and its rotation generation.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/origin",
+        "local_reference": "#/$defs/ca",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23897,7 +23237,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -23905,7 +23244,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -23913,65 +23251,60 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
+          "keyword": "required",
+          "value": [
+            "file",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/origin"
+        "pointer": "/$defs/ca"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/internalOrigin/anyOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/concurrency",
+        "path_kind": "property"
       },
-      "purpose": "Signed internal HTTP service origin. Runtime DNS pinning admits only eligible private addresses.",
-      "purpose_source": "schema_description",
+      "purpose": "Caps the number of requests that may be in flight concurrently for this source.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/privateServiceOrigin",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -23998,7 +23331,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24006,7 +23338,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24014,65 +23345,141 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
+          "keyword": "maximum",
+          "value": 64
         },
         {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP]://[a-z][a-z0-9.-]{0,252}(?::[0-9]+)?/?$"
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
+      ]
+    },
+    {
+      "address": {
+        "schema": "environment",
+        "pointer": "/$defs/source/properties/credential",
+        "path_kind": "property"
+      },
+      "purpose": "One supported source credential shape, containing references rather than values.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/credential",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "environment_bound",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "operator_preflight",
+        "product_build"
       ],
+      "diagnostic": "registryctl.authoring.environment.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/privateServiceOrigin"
+        "pointer": "/$defs/credential"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/internalOrigin/anyOf/2",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/jwks",
+        "path_kind": "property"
       },
-      "purpose": "HTTP IP-loopback origin; public Relay and issuer fields restrict it to the local profile, while internal Notary-to-Relay connections allow it in any profile.",
+      "purpose": "Security-bound HTTPS endpoint with optional private-network, CA, and mTLS policy.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/localLoopbackOrigin",
+        "local_reference": "#/$defs/endpoint",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24099,7 +23506,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24107,7 +23513,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24115,65 +23520,62 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$"
+          "keyword": "required",
+          "value": [
+            "origin",
+            "path",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/localLoopbackOrigin"
+        "pointer": "/$defs/endpoint"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/mtls/properties/certificate_file",
+        "pointer": "/$defs/source/properties/mtls",
         "path_kind": "property"
       },
-      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
+      "purpose": "Client certificate and private-key reference for mutual TLS.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/absolutePath",
+        "local_reference": "#/$defs/mtls",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24200,7 +23602,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24208,7 +23609,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24216,68 +23616,62 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
-        },
-        {
-          "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "keyword": "required",
+          "value": [
+            "certificate_file",
+            "private_key",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/absolutePath"
+        "pointer": "/$defs/mtls"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/mtls/properties/generation",
+        "pointer": "/$defs/source/properties/oauth",
         "path_kind": "property"
       },
-      "purpose": "Records the operator-controlled mutual-TLS generation used for explicit certificate and key rotation.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Security-bound HTTPS endpoint with optional private-network, CA, and mTLS policy.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/endpoint",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24304,7 +23698,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24312,7 +23705,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24320,61 +23712,62 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "origin",
+            "path",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/endpoint"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/mtls/properties/private_key",
+        "pointer": "/$defs/source/properties/origin",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose": "HTTPS origin without path, query, or fragment.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/secret",
+        "local_reference": "#/$defs/origin",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24401,7 +23794,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24409,7 +23801,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24417,40 +23808,41 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "format",
+          "value": "uri"
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/secret"
+        "pointer": "/$defs/origin"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/access_token",
+        "pointer": "/$defs/source/properties/rate",
         "path_kind": "property"
       },
-      "purpose": "Dedicated Notary access-token signing key and published key identifier.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the per-minute request rate and burst bounds applied to one environment source.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -24460,7 +23852,7 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -24472,7 +23864,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24499,7 +23890,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24507,7 +23897,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24515,7 +23904,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -24527,8 +23915,8 @@
         {
           "keyword": "required",
           "value": [
-            "signing_key",
-            "signing_kid"
+            "per_minute",
+            "burst"
           ]
         },
         {
@@ -24540,19 +23928,18 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/access_token/properties/signing_key",
+        "pointer": "/$defs/source/properties/rate/properties/burst",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
-      "purpose_source": "schema_description",
+      "purpose": "Caps the short request burst permitted by the source rate limiter.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/secret",
         "composed": false
       },
       "requiredness": "required",
@@ -24562,12 +23949,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24594,7 +23980,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24602,7 +23987,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24610,63 +23994,57 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maximum",
+          "value": 1024
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/access_token/properties/signing_kid",
+        "pointer": "/$defs/source/properties/rate/properties/per_minute",
         "path_kind": "property"
       },
-      "purpose": "Bounded visible-ASCII token, including full verification-method identifiers.",
-      "purpose_source": "schema_description",
+      "purpose": "Caps the number of requests permitted to this source during one minute.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/token2048",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24693,7 +24071,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24701,7 +24078,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24709,68 +24085,57 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
+          "keyword": "maximum",
+          "value": 60000
         },
         {
-          "keyword": "minLength",
+          "keyword": "minimum",
           "value": 1
         },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/token2048"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/allowed_wallet_origins",
+        "pointer": "/$defs/source/properties/timeout",
         "path_kind": "property"
       },
-      "purpose": "Exact HTTPS browser origins admitted to the wallet-facing Notary routes.",
-      "purpose_source": "schema_description",
+      "purpose": "Optionally narrows one environment source request to a positive timeout no greater than twenty seconds.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24797,7 +24162,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24805,7 +24169,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24813,65 +24176,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-9]{4}|20000)ms|(?:[1-9]|1[0-9]|20)s)$"
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/allowed_wallet_origins/items",
-        "path_kind": "array_item"
+        "pointer": "/allOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/origin",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24898,7 +24247,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -24906,7 +24254,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -24914,65 +24261,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
+        "branch_has_no_authored_value"
       ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/origin"
-      }
+      "constraints": []
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/authorization_server",
-        "path_kind": "property"
+        "pointer": "/allOf/0/else",
+        "path_kind": "branch"
       },
-      "purpose": "Pinned eSignet issuer and exact endpoints used for login and token validation.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -24999,7 +24324,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25007,7 +24331,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25015,60 +24338,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "issuer",
-            "jwks_url",
-            "userinfo_url",
-            "authorize_url",
-            "token_url"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/authorization_server/properties/authorize_url",
-        "path_kind": "property"
+        "pointer": "/allOf/0/else/not",
+        "path_kind": "branch"
       },
-      "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [],
-        "local_reference": "#/$defs/relayResource",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25095,7 +24401,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25103,7 +24408,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25111,50 +24415,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relayResource"
-      }
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "relay"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/authorization_server/properties/issuer",
-        "path_kind": "property"
+        "pointer": "/allOf/0/if",
+        "path_kind": "branch"
       },
-      "purpose": "Relay or issuer origin using HTTPS, or HTTP IP-loopback under the local profile.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [],
-        "local_reference": "#/$defs/relayOrigin",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25181,7 +24485,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25189,7 +24492,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25197,35 +24499,36 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relayOrigin"
-      }
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "deployment"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/authorization_server/properties/jwks_url",
+        "pointer": "/allOf/0/if/properties/deployment",
         "path_kind": "property"
       },
-      "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.",
-      "purpose_source": "schema_description",
+      "purpose": "Matches environments whose deployment declaration enables Relay so the corresponding Relay binding is required.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [],
-        "local_reference": "#/$defs/relayResource",
         "composed": false
       },
       "requiredness": "required",
@@ -25235,12 +24538,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25267,7 +24569,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25275,7 +24576,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25283,50 +24583,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relayResource"
-      }
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "relay"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/authorization_server/properties/token_url",
-        "path_kind": "property"
+        "pointer": "/allOf/0/then",
+        "path_kind": "branch"
       },
-      "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [],
-        "local_reference": "#/$defs/relayResource",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25353,7 +24652,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25361,7 +24659,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25369,50 +24666,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relayResource"
-      }
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "relay"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/authorization_server/properties/userinfo_url",
-        "path_kind": "property"
+        "pointer": "/allOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [],
-        "local_reference": "#/$defs/relayResource",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25439,7 +24736,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25447,7 +24743,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25455,51 +24750,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relayResource"
-      }
+      "constraints": []
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/client",
-        "path_kind": "property"
+        "pointer": "/allOf/1/if",
+        "path_kind": "branch"
       },
-      "purpose": "eSignet relying-party identity and dedicated private-key reference.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25526,7 +24813,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25534,7 +24820,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25542,60 +24827,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "id",
-            "signing_key",
-            "signing_kid"
+            "relay_state"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/client/properties/id",
-        "path_kind": "property"
+        "pointer": "/allOf/1/then",
+        "path_kind": "branch"
       },
-      "purpose": "Bounded visible-ASCII protocol token.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/token256",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25622,7 +24897,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25630,7 +24904,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25638,69 +24911,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
+        "branch_has_no_authored_value"
       ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/token256"
-      }
+      "constraints": []
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/client/properties/signing_key",
+        "pointer": "/allOf/1/then/properties/deployment",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
-      "purpose_source": "schema_description",
+      "purpose": "Requires the Relay deployment service when Relay state storage is configured.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/secret",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25727,7 +24974,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25735,7 +24981,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25743,63 +24988,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "secret"
+            "relay"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/client/properties/signing_kid",
-        "path_kind": "property"
+        "pointer": "/allOf/2",
+        "path_kind": "branch"
       },
-      "purpose": "Bounded visible-ASCII token, including full verification-method identifiers.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/token2048",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25826,7 +25057,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25834,7 +25064,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25842,68 +25071,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
+        "branch_has_no_authored_value"
       ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/token2048"
-      }
+      "constraints": []
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/credential",
-        "path_kind": "property"
+        "pointer": "/allOf/2/else",
+        "path_kind": "branch"
       },
-      "purpose": "Existing project service and credential profile exposed through OID4VCI.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -25930,7 +25134,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -25938,7 +25141,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -25946,49 +25148,34 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "service",
-            "profile"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/credential/properties/profile",
+        "pointer": "/allOf/2/else/properties/relay",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Applies non-local HTTPS constraints to the Relay origin, issuer, and key-set bindings.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -25998,7 +25185,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26025,7 +25211,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26033,7 +25218,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26041,7 +25225,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -26049,28 +25232,99 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
+      "constraints": []
+    },
+    {
+      "address": {
+        "schema": "environment",
+        "pointer": "/allOf/2/else/properties/relay/not",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "environment_bound",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "operator_preflight",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.environment.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "required",
+          "value": [
+            "local_api_keys"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/credential/properties/service",
+        "pointer": "/allOf/2/else/properties/relay/properties/issuer",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "HTTPS origin without path, query, or fragment.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -26079,22 +25333,21 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/origin",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26121,7 +25374,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26129,7 +25381,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26137,18 +25388,22 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uri"
+        },
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
         },
         {
           "keyword": "type",
@@ -26157,28 +25412,30 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/origin"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/public_base_url",
+        "pointer": "/allOf/2/else/properties/relay/properties/jwks_url",
         "path_kind": "property"
       },
-      "purpose": "Relay or issuer origin using HTTPS, or HTTP IP-loopback under the local profile.",
+      "purpose": "Exact HTTPS resource without query or fragment.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/relayOrigin",
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/httpsResource",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -26188,7 +25445,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26215,7 +25471,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26223,7 +25478,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26231,7 +25485,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -26240,31 +25493,46 @@
         "generated_docs_never_load_country_values",
         "sensitive_operational_metadata"
       ],
-      "constraints": [],
+      "constraints": [
+        {
+          "keyword": "format",
+          "value": "uri"
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/relayOrigin"
+        "pointer": "/$defs/httpsResource"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/redirect_uri",
+        "pointer": "/allOf/2/else/properties/relay/properties/origin",
         "path_kind": "property"
       },
-      "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.",
+      "purpose": "HTTPS origin without path, query, or fragment.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/relayResource",
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/origin",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -26274,7 +25542,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26301,7 +25568,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26309,7 +25575,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26317,7 +25582,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -26326,43 +25590,52 @@
         "generated_docs_never_load_country_values",
         "sensitive_operational_metadata"
       ],
-      "constraints": [],
+      "constraints": [
+        {
+          "keyword": "format",
+          "value": "uri"
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/relayResource"
+        "pointer": "/$defs/origin"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/registrar_clients",
-        "path_kind": "property"
+        "pointer": "/allOf/2/if",
+        "path_kind": "branch"
       },
-      "purpose": "Closed OIDC machine-client allow-list for registrar-created credential offers. Each client uses this authorization server and the Notary public base URL as its resource audience; citizen client classification remains separate.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "array"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "schema_value": []
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26389,7 +25662,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26397,7 +25669,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26405,61 +25676,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 64
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/registrar_clients/items",
-        "path_kind": "array_item"
+        "pointer": "/allOf/2/if/properties/deployment",
+        "path_kind": "property"
       },
-      "purpose": "Bounded visible-ASCII protocol token.",
-      "purpose_source": "schema_description",
+      "purpose": "Matches the local deployment profile before relaxing public endpoint transport constraints.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/token256",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26486,7 +25739,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26494,7 +25746,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26502,57 +25753,38 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "required",
+          "value": [
+            "profile"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/token256"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/representative_issuance",
+        "pointer": "/allOf/2/if/properties/deployment/properties/profile",
         "path_kind": "property"
       },
-      "purpose": "One digitally authenticated representative ceremony bound to an exact relationship proof. Registryctl derives the credential dependency, status endpoint, and secure proof-freshness default.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects the local-profile condition used by the environment transport-validation branch.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -26564,7 +25796,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26591,7 +25822,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26599,7 +25829,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26607,7 +25836,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -26617,42 +25845,33 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "relationship",
-            "proof_claim",
-            "target_id_type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "local"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/representative_issuance/properties/max_proof_age_seconds",
+        "pointer": "/properties/deployment",
         "path_kind": "property"
       },
-      "purpose": "Maximum age of the relationship proof. Omit for the secure 300-second default.",
+      "purpose": "Relay deployed in this environment and the operational profile it uses.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "schema_value": 300
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
@@ -26660,7 +25879,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26687,7 +25905,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26695,7 +25912,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26703,7 +25919,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -26713,136 +25928,36 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 600
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "profile",
+            "relay"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/representative_issuance/properties/proof_claim",
-        "path_kind": "property"
-      },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "operator_preflight",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
-      }
-    },
-    {
-      "address": {
-        "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/representative_issuance/properties/relationship",
+        "pointer": "/properties/deployment/properties/profile",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects the deployment assurance profile whose service and transport conditions the environment must satisfy.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -26852,7 +25967,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26879,7 +25993,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26887,7 +26000,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26895,7 +26007,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -26905,40 +26016,36 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "local",
+            "hosted_lab",
+            "production"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/representative_issuance/properties/target_id_type",
+        "pointer": "/properties/deployment/properties/relay",
         "path_kind": "property"
       },
-      "purpose": "Bounded visible-ASCII protocol token.",
+      "purpose": "Binds an authored product role to a deployed service identifier.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token256",
+        "local_reference": "#/$defs/service",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -26948,7 +26055,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -26975,7 +26081,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -26983,7 +26088,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -26991,7 +26095,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -27001,34 +26104,28 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
+          "keyword": "required",
+          "value": [
+            "service"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/token256"
+        "pointer": "/$defs/service"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/sensitive_state_key",
+        "pointer": "/properties/development",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose": "Closed local-development selection. Registryctl uses the exact authored default and never prompts or guesses.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -27037,22 +26134,20 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27079,7 +26174,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27087,7 +26181,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27095,52 +26188,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "secret"
+            "source_mode",
+            "default_integration",
+            "default_fixture"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/subject",
+        "pointer": "/properties/development/properties/default_fixture",
         "path_kind": "property"
       },
-      "purpose": "Verified eSignet userinfo claim bound exactly to the credential subject identifier.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -27150,7 +26240,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27177,7 +26266,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27185,7 +26273,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27193,7 +26280,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -27203,25 +26289,26 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "token_claim",
-            "id_type"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/subject/properties/id_type",
+        "pointer": "/properties/development/properties/default_integration",
         "path_kind": "property"
       },
-      "purpose": "Bounded visible-ASCII protocol token.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -27230,7 +26317,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/token256",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
@@ -27245,7 +26332,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27272,7 +26358,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27280,7 +26365,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27288,7 +26372,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -27297,17 +26380,9 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "pattern",
-          "value": "^[!-~]+$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
@@ -27316,30 +26391,29 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/token256"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/subject/properties/token_claim",
+        "pointer": "/properties/development/properties/relay_port",
         "path_kind": "property"
       },
-      "purpose": "Bounded visible-ASCII protocol token.",
-      "purpose_source": "schema_description",
+      "purpose": "Overrides the loopback port exposed by the disposable local Relay runtime without changing a deployment endpoint.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/token256",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -27349,7 +26423,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27376,7 +26449,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27384,7 +26456,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27392,7 +26463,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -27402,45 +26472,35 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
+          "keyword": "maximum",
+          "value": 65535
         },
         {
-          "keyword": "minLength",
+          "keyword": "minimum",
           "value": 1
         },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/token256"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/tx_code",
+        "pointer": "/properties/development/properties/source_mode",
         "path_kind": "property"
       },
-      "purpose": "Transaction-code policy. Omit for the secure required-PIN default. Set required=false only for a bounded bearer-offer interoperability profile; the compiler fixes the offer lifetime at 300 seconds.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects whether the disposable local runtime uses the maintained synthetic source or an explicitly operator-bound source integration.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -27452,7 +26512,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27479,7 +26538,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27487,7 +26545,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27495,7 +26552,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -27505,25 +26561,29 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "enum",
+          "value": [
+            "synthetic",
+            "local_snapshot",
+            "operator_bound"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/tx_code/properties/required",
+        "pointer": "/properties/entities",
         "path_kind": "property"
       },
-      "purpose": "States whether OID4VCI authorization requires a transaction code before credential issuance.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Environment-specific source bindings keyed by entity identifier.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
         "composed": false
       },
@@ -27531,8 +26591,7 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "schema_value": true
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
@@ -27540,7 +26599,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27567,7 +26625,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27575,7 +26632,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27583,7 +26639,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -27592,42 +26647,46 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxProperties",
+          "value": 32
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/privateCidrs/items",
-        "path_kind": "array_item"
+        "pointer": "/properties/entities/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Maps an authored entity to provider columns and immutable source-generation identifiers.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/entity",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27654,7 +26713,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27662,7 +26720,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27670,61 +26727,64 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 64
-        },
-        {
-          "keyword": "minLength",
-          "value": 3
+          "keyword": "required",
+          "value": [
+            "provider",
+            "columns",
+            "source_revision",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/entity"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/properties/entities/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27751,7 +26811,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27759,7 +26818,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27767,43 +26825,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "path"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/delimiter",
+        "pointer": "/properties/integrations",
         "path_kind": "property"
       },
-      "purpose": "Selects the byte used to delimit fields in the bound CSV source.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Environment bindings keyed by authored integration identifier.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
@@ -27819,7 +26877,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27846,7 +26903,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27854,7 +26910,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27862,7 +26917,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -27872,37 +26926,34 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 255
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "maxProperties",
+          "value": 16
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/header_row",
-        "path_kind": "property"
+        "pointer": "/properties/integrations/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Selects the one-based CSV row containing source column headers.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Environment binding for an authored source integration.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/integration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -27914,7 +26965,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -27941,7 +26991,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -27949,7 +26998,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -27957,36 +27005,38 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "source"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/integration"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/path",
-        "path_kind": "property"
+        "pointer": "/properties/integrations/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -27995,22 +27045,21 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/absolutePath",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28037,7 +27086,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28045,7 +27093,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28053,27 +27100,18 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
-        },
         {
           "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
@@ -28082,23 +27120,23 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/absolutePath"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/quote",
+        "pointer": "/properties/relay",
         "path_kind": "property"
       },
-      "purpose": "Selects the byte used to quote fields in the bound CSV source.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Public Relay identity and token-validation settings for a Relay deployment.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
@@ -28114,100 +27152,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "operator_preflight",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 255
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/type",
-        "path_kind": "property"
-      },
-      "purpose": "Selects CSV as the environment-owned materialization provider for an authored entity.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28234,7 +27178,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28242,7 +27185,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28250,7 +27192,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -28260,41 +27201,50 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "csv"
+          "keyword": "required",
+          "value": [
+            "origin",
+            "issuer",
+            "jwks_url",
+            "audience",
+            "allowed_clients"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/properties/relay/properties/allowed_clients",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Narrows Relay authentication to the operator-reviewed client identifiers listed for this environment.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28321,7 +27271,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28329,7 +27278,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28337,39 +27285,37 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "project_file",
-            "path",
-            "sheet"
-          ]
+          "keyword": "maxItems",
+          "value": 64
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/data_range",
-        "path_kind": "property"
+        "pointer": "/properties/relay/properties/allowed_clients/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Restricts entity materialization to the reviewed range within the selected worksheet.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -28379,7 +27325,7 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -28391,7 +27337,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28418,7 +27363,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28426,7 +27370,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28434,13 +27377,13 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -28460,17 +27403,109 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/header_row",
+        "pointer": "/properties/relay/properties/audience",
         "path_kind": "property"
       },
-      "purpose": "Selects the one-based XLSX row containing source column headers.",
+      "purpose": "Binds the token audience Relay requires so tokens issued for another service are rejected.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
+      "state": "environment_bound",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "operator_preflight",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.environment.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "environment",
+        "pointer": "/properties/relay/properties/consultation",
+        "path_kind": "property"
+      },
+      "purpose": "Explicit Relay consultation workload identity. The client must also appear in allowed_clients; the principal is the stable authorization identity bound to that client.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "field_type": {
+        "schema_types": [
+          "object"
         ],
         "composed": false
       },
@@ -28486,7 +27521,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28513,7 +27547,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28521,7 +27554,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28529,7 +27561,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -28539,26 +27570,25 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "client_id",
+            "principal_id"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/path",
+        "pointer": "/properties/relay/properties/consultation/properties/client_id",
         "path_kind": "property"
       },
-      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
+      "purpose": "Token client identifier dedicated to the Relay consultation lane; it must also appear in the environment allowed-client list.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -28567,7 +27597,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/absolutePath",
+        "local_reference": "#/$defs/token256",
         "composed": false
       },
       "requiredness": "required",
@@ -28582,7 +27612,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28609,7 +27638,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28617,7 +27645,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28625,7 +27652,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -28637,15 +27663,15 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 4096
+          "value": 256
         },
         {
           "keyword": "minLength",
-          "value": 2
+          "value": 1
         },
         {
           "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "value": "^[!-~]+$"
         },
         {
           "keyword": "type",
@@ -28654,17 +27680,17 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/absolutePath"
+        "pointer": "/$defs/token256"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/project_file",
+        "pointer": "/properties/relay/properties/consultation/properties/principal_id",
         "path_kind": "property"
       },
-      "purpose": "Binds a contained project-relative workbook for offline preflight and read-only runtime mounting without emitting the authoring path into Relay configuration.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Stable authorization principal Relay binds to the dedicated consultation client.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -28672,7 +27698,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/relativePath",
+        "local_reference": "#/$defs/token256",
         "composed": false
       },
       "requiredness": "required",
@@ -28687,7 +27713,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28714,7 +27739,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28722,7 +27746,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28730,7 +27753,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -28742,7 +27764,7 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 4096
+          "value": 256
         },
         {
           "keyword": "minLength",
@@ -28750,7 +27772,7 @@
         },
         {
           "keyword": "pattern",
-          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "value": "^[!-~]+$"
         },
         {
           "keyword": "type",
@@ -28759,39 +27781,37 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/relativePath"
+        "pointer": "/$defs/token256"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/sheet",
+        "pointer": "/properties/relay/properties/issuer",
         "path_kind": "property"
       },
-      "purpose": "Names the worksheet read from the environment-owned XLSX source.",
+      "purpose": "Binds the expected token issuer for Relay authentication in this deployment environment.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
+        "local_reference": "#/$defs/relayOrigin",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28818,7 +27838,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28826,7 +27845,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28834,42 +27852,34 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/relayOrigin"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/type",
+        "pointer": "/properties/relay/properties/jwks_url",
         "path_kind": "property"
       },
-      "purpose": "Selects XLSX as the environment-owned materialization provider for an authored entity.",
+      "purpose": "Binds the operator-reviewed key-set endpoint Relay uses to verify caller tokens.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [],
+        "local_reference": "#/$defs/relayResource",
         "composed": false
       },
       "requiredness": "required",
@@ -28879,12 +27889,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28911,7 +27920,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -28919,7 +27927,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -28927,29 +27934,28 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "xlsx"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/relayResource"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/2",
-        "path_kind": "branch"
+        "pointer": "/properties/relay/properties/local_api_keys",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Declares synthetic API-key principals only for the local profile; Registryctl generates raw keys privately and emits only their fingerprints to Relay.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -28959,19 +27965,18 @@
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -28998,7 +28003,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29006,7 +28010,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29014,21 +28017,20 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "type",
-            "path"
+            "match_principal",
+            "no_match_principal",
+            "scopes"
           ]
         },
         {
@@ -29040,11 +28042,11 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/2/properties/path",
+        "pointer": "/properties/relay/properties/local_api_keys/properties/match_principal",
         "path_kind": "property"
       },
-      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
-      "purpose_source": "schema_description",
+      "purpose": "Binds the synthetic local caller whose reviewed identifier matches one starter row; this identifier is not a raw key or a source value.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -29052,7 +28054,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/absolutePath",
+        "local_reference": "#/$defs/token256",
         "composed": false
       },
       "requiredness": "required",
@@ -29067,7 +28069,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29094,7 +28095,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29102,7 +28102,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29110,7 +28109,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -29122,15 +28120,15 @@
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 4096
+          "value": 256
         },
         {
           "keyword": "minLength",
-          "value": 2
+          "value": 1
         },
         {
           "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "value": "^[!-~]+$"
         },
         {
           "keyword": "type",
@@ -29139,37 +28137,39 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/absolutePath"
+        "pointer": "/$defs/token256"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/2/properties/type",
+        "pointer": "/properties/relay/properties/local_api_keys/properties/no_match_principal",
         "path_kind": "property"
       },
-      "purpose": "Selects Parquet as the environment-owned materialization provider for an authored entity.",
+      "purpose": "Binds the synthetic local caller whose reviewed identifier intentionally matches no starter row so an empty result is maintained.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/token256",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29196,7 +28196,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29204,7 +28203,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29212,51 +28210,66 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "parquet"
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[!-~]+$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/token256"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3",
-        "path_kind": "branch"
+        "pointer": "/properties/relay/properties/local_api_keys/properties/scopes",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Limits both generated local API-key callers to the explicitly reviewed service scopes needed by the maintained checks.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29283,7 +28296,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29291,7 +28303,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29299,62 +28310,61 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "connection",
-            "schema",
-            "table"
-          ]
+          "keyword": "maxItems",
+          "value": 16
+        },
+        {
+          "keyword": "minItems",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3/properties/connection",
-        "path_kind": "property"
+        "pointer": "/properties/relay/properties/local_api_keys/properties/scopes/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29381,7 +28391,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29389,7 +28398,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29397,63 +28405,57 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3/properties/schema",
+        "pointer": "/properties/relay/properties/origin",
         "path_kind": "property"
       },
-      "purpose": "Portable unquoted PostgreSQL schema or table identifier.",
-      "purpose_source": "schema_description",
+      "purpose": "Binds the externally visible Relay origin reviewed by the operator and local network policy.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/postgresIdentifier",
+        "schema_types": [],
+        "local_reference": "#/$defs/relayOrigin",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29480,7 +28482,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29488,7 +28489,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29496,50 +28496,40 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,62}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
+      "constraints": [],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/postgresIdentifier"
+        "pointer": "/$defs/relayOrigin"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3/properties/table",
+        "pointer": "/properties/relay_state",
         "path_kind": "property"
       },
-      "purpose": "Portable unquoted PostgreSQL schema or table identifier.",
+      "purpose": "Optional deployment binding for Relay-owned consultation PostgreSQL state transport trust.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/postgresIdentifier",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -29549,7 +28539,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29576,7 +28565,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29584,7 +28572,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29592,7 +28579,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -29602,32 +28588,32 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,62}$"
+          "keyword": "required",
+          "value": [
+            "postgresql"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/postgresIdentifier"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3/properties/type",
+        "pointer": "/properties/relay_state/properties/postgresql",
         "path_kind": "property"
       },
-      "purpose": "Selects PostgreSQL as the environment-owned materialization provider for an authored entity.",
+      "purpose": "Selects the PostgreSQL trust binding used by Relay state storage.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
       "requiredness": "required",
@@ -29642,7 +28628,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29669,7 +28654,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29677,7 +28661,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29685,7 +28668,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
@@ -29695,19 +28677,25 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "postgres"
+          "keyword": "required",
+          "value": [
+            "root_certificate_path"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/relayOrigin/anyOf/0",
-        "path_kind": "branch"
+        "pointer": "/properties/relay_state/properties/postgresql/properties/root_certificate_path",
+        "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
-      "purpose_source": "schema_description",
+      "purpose": "Binds Relay state storage to an operator-managed PostgreSQL trust root at a deployment-local path.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -29715,22 +28703,21 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/origin",
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29757,7 +28744,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29765,7 +28751,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29773,23 +28758,26 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 2
         },
         {
           "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
@@ -29798,40 +28786,36 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/origin"
+        "pointer": "/$defs/absolutePath"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/relayOrigin/anyOf/1",
-        "path_kind": "branch"
+        "pointer": "/properties/version",
+        "path_kind": "property"
       },
-      "purpose": "HTTP IP-loopback origin; public Relay and issuer fields restrict it to the local profile, while internal Notary-to-Relay connections allow it in any profile.",
+      "purpose": "Environment authoring format version.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/localLoopbackOrigin",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "public",
       "state": "environment_bound",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29858,7 +28842,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29866,7 +28849,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "field_reference"
       ],
       "review_classes": [
@@ -29874,53 +28856,38 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": 1
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/localLoopbackOrigin"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/relayResource/anyOf/0",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "",
+        "path_kind": "root"
       },
-      "purpose": "Exact HTTPS resource without query or fragment.",
+      "purpose": "Defines a product-neutral source adaptation contract using bounded HTTP, Rhai script, or exact snapshot capabilities.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/httpsResource",
         "composed": false
       },
-      "requiredness": "conditional",
+      "requiredness": "not_applicable",
       "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
@@ -29928,11 +28895,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -29942,24 +28908,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": false,
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -29967,7 +28932,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -29975,65 +28940,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
+          "keyword": "required",
+          "value": [
+            "version",
+            "id",
+            "revision",
+            "input",
+            "capability",
+            "outputs"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/httpsResource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/relayResource/anyOf/1",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/allowRule/properties/method",
+        "path_kind": "property"
       },
-      "purpose": "HTTP IP-loopback resource accepted only with the local deployment profile.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the GET or POST method permitted by one reviewed source allow rule.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/localLoopbackResource",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30043,24 +29002,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30068,7 +29026,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30076,45 +29034,35 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/[^?#]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "GET",
+            "POST"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/localLoopbackResource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/secret/properties/secret",
+        "schema": "integration",
+        "pointer": "/$defs/allowRule/properties/path",
         "path_kind": "property"
       },
-      "purpose": "Names the operator-managed environment secret reference without containing the secret value.",
+      "purpose": "Defines one reviewed source path template; concrete private endpoints and identifiers remain environment-owned.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "string"
@@ -30128,12 +29076,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "environment_bound",
+      "sensitivity": "sensitive",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30143,24 +29090,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30168,7 +29114,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30176,19 +29122,27 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "pattern",
-          "value": "^[A-Z_][A-Z0-9_]{0,127}$"
+          "value": "^/[^?#]*$"
         },
         {
           "keyword": "type",
@@ -30198,35 +29152,31 @@
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/service/properties/service",
+        "schema": "integration",
+        "pointer": "/$defs/allowRule/properties/semantics",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares that the permitted source operation has read-only semantics.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30236,24 +29186,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30261,7 +29210,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30269,9 +29218,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -30279,50 +29228,40 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "read_only"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/allowed_private_cidrs",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Explicit private network ranges this source may resolve to.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
-        "local_reference": "#/$defs/privateCidrs",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30332,24 +29271,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30357,7 +29295,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30365,53 +29303,46 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "required",
+          "value": [
+            "http"
+          ]
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/privateCidrs"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/ca",
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/0/properties/http",
         "path_kind": "property"
       },
-      "purpose": "Pinned certificate-authority file and its rotation generation.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the single-request declarative HTTP capability and its expected response semantics.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ca",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -30419,11 +29350,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30433,24 +29363,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30458,7 +29387,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30466,9 +29395,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -30478,38 +29407,34 @@
         {
           "keyword": "required",
           "value": [
-            "file",
-            "generation"
+            "request"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/ca"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/concurrency",
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/0/properties/http/properties/request",
         "path_kind": "property"
       },
-      "purpose": "Caps the number of requests that may be in flight concurrently for this source.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Bounded read-only HTTP request template.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/httpRequest",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -30517,11 +29442,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30531,24 +29455,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30556,7 +29479,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30564,9 +29487,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -30574,35 +29497,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 64
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "method",
+            "path"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/credential",
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/0/properties/http/properties/response",
         "path_kind": "property"
       },
-      "purpose": "One supported source credential shape, containing references rather than values.",
+      "purpose": "Rules for translating upstream status and body cardinality into normalized outcomes.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/credential",
+        "local_reference": "#/$defs/httpResponse",
         "composed": false
       },
       "requiredness": "optional",
@@ -30613,11 +29539,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30627,24 +29552,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30652,7 +29576,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30660,51 +29584,54 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/credential"
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/jwks",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Security-bound HTTPS endpoint with optional private-network, CA, and mTLS policy.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/endpoint",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30714,24 +29641,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30739,7 +29665,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30747,52 +29673,46 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "origin",
-            "path",
-            "generation"
+            "script"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/endpoint"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/mtls",
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/1/properties/script",
         "path_kind": "property"
       },
-      "purpose": "Client certificate and private-key reference for mutual TLS.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
-      "field_type": {
+      "purpose": "Selects the reviewed project-relative script capability and its optional modules.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/mtls",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -30800,11 +29720,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30814,24 +29733,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30839,7 +29757,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30847,9 +29765,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -30859,52 +29777,45 @@
         {
           "keyword": "required",
           "value": [
-            "certificate_file",
-            "private_key",
-            "generation"
+            "file"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/mtls"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/oauth",
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/1/properties/script/properties/file",
         "path_kind": "property"
       },
-      "purpose": "Security-bound HTTPS endpoint with optional private-network, CA, and mTLS policy.",
+      "purpose": "Project-relative path without traversal or duplicate separators.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/endpoint",
+        "local_reference": "#/$defs/relativePath",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "sensitive",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -30914,24 +29825,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -30939,7 +29849,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -30947,64 +29857,67 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "origin",
-            "path",
-            "generation"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/endpoint"
+        "schema": "integration",
+        "pointer": "/$defs/relativePath"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/origin",
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/1/properties/script/properties/modules",
         "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Lists the reviewed project-relative modules available to the integration script.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/origin",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31014,24 +29927,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31039,7 +29951,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31047,9 +29959,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -31058,53 +29970,49 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
+          "keyword": "maxItems",
+          "value": 32
         },
         {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
+          "keyword": "type",
+          "value": "array"
         },
         {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/origin"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/rate",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/1/properties/script/properties/modules/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Defines the per-minute request rate and burst bounds applied to one environment source.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Project-relative path without traversal or duplicate separators.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/relativePath",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31114,24 +30022,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31139,7 +30046,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31147,58 +30054,67 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "per_minute",
-            "burst"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/relativePath"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/rate/properties/burst",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/2",
+        "path_kind": "branch"
       },
-      "purpose": "Caps the short request burst permitted by the source rate limiter.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31208,24 +30124,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31233,7 +30148,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31241,43 +30156,42 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 1024
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "snapshot"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/rate/properties/per_minute",
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/2/properties/snapshot",
         "path_kind": "property"
       },
-      "purpose": "Caps the number of requests permitted to this source during one minute.",
+      "purpose": "Selects an offline entity snapshot capability with exact input matching and freshness control.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
@@ -31289,11 +30203,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31303,24 +30216,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31328,7 +30240,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31336,9 +30248,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -31346,37 +30258,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 60000
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "entity",
+            "exact",
+            "freshness"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/$defs/source/properties/timeout",
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/entity",
         "path_kind": "property"
       },
-      "purpose": "Optionally narrows one environment source request to a positive timeout no greater than twenty seconds.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -31384,11 +30297,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31398,24 +30310,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31423,7 +30334,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31431,9 +30342,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -31442,42 +30353,47 @@
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-9]{4}|20000)ms|(?:[1-9]|1[0-9]|20)s)$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/0",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/exact",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Maps entity fields to integration inputs that must match exactly in the snapshot lookup.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31487,24 +30403,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31512,7 +30427,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31520,45 +30435,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maxProperties",
+          "value": 8
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/0/else",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/exact/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Reference to a declared integration input.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/inputReference",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31568,24 +30497,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31593,7 +30521,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31601,45 +30529,61 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "input"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputReference"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/0/else/not",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/freshness",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Sets the maximum accepted age of the materialized entity snapshot within the product-owned 31-day ceiling.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31649,24 +30593,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31674,7 +30617,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31682,37 +30625,40 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "relay"
-          ]
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,8}|1[0-9]{9}|2[0-5][0-9]{8}|26[0-6][0-9]{7}|267[0-7][0-9]{6}|2678[0-3][0-9]{5}|2678400000)ms|(?:[1-9][0-9]{0,5}|1[0-9]{6}|2[0-5][0-9]{5}|26[0-6][0-9]{4}|267[0-7][0-9]{3}|2678[0-3][0-9]{2}|2678400)s|(?:[1-9][0-9]{0,3}|[1-3][0-9]{4}|4[0-3][0-9]{3}|44[0-5][0-9]{2}|446[0-3][0-9]{1}|44640)m|(?:[1-9][0-9]{0,1}|[1-6][0-9]{2}|7[0-3][0-9]{1}|74[0-3]|744)h|(?:[1-9][0-9]{0,0}|[1-2][0-9]{1}|30|31)d)$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/0/if",
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
       "requiredness": "conditional",
@@ -31723,11 +30669,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31737,24 +30682,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31762,7 +30706,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31770,9 +30714,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -31783,22 +30727,26 @@
         {
           "keyword": "required",
           "value": [
-            "deployment"
+            "type"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/0/if/properties/deployment",
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/0/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Matches environments whose deployment declaration enables Relay so the corresponding Relay binding is required.",
+      "purpose": "Selects an unauthenticated, basic-authentication, or static-bearer credential interface.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
@@ -31811,11 +30759,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31825,24 +30772,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31850,7 +30796,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31858,9 +30804,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -31868,26 +30814,30 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "relay"
+            "none",
+            "basic",
+            "static_bearer"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/0/then",
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/1",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
       "requiredness": "conditional",
@@ -31898,11 +30848,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -31912,24 +30861,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -31937,7 +30885,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -31945,9 +30893,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -31958,39 +30906,46 @@
         {
           "keyword": "required",
           "value": [
-            "relay"
+            "type",
+            "name",
+            "max_value_bytes"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/1",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/1/properties/max_value_bytes",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Caps the credential value size accepted by the fixed-header API-key interface.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32000,24 +30955,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32025,7 +30979,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32033,45 +30987,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 4096
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/1/if",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/1/properties/name",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares the fixed HTTP header name used by the API-key credential interface.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32081,24 +31048,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32106,7 +31072,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32114,52 +31080,52 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "notary_relay"
-          ]
+          "keyword": "pattern",
+          "value": "^[A-Za-z][A-Za-z0-9_-]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/1/then",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/1/properties/type",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the fixed-header API-key credential interface for this source contract.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32169,24 +31135,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32194,7 +31159,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32202,45 +31167,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "const",
+          "value": "api_key_header"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/1/then/properties/deployment",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/2",
+        "path_kind": "branch"
       },
-      "purpose": "Requires both Relay and Notary deployment services when a Notary-to-Relay binding is present.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32250,24 +31220,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32275,7 +31244,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32283,52 +31252,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "relay",
-            "notary"
+            "type",
+            "name",
+            "max_value_bytes"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/2",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/2/properties/max_value_bytes",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Caps the credential value size accepted by the fixed-query API-key interface.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32338,24 +31314,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32363,7 +31338,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32371,45 +31346,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 4096
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/2/if",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/2/properties/name",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares the fixed query parameter name used by the API-key credential interface.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32419,24 +31407,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32444,7 +31431,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32452,52 +31439,52 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "relay_state"
-          ]
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9._:~-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/2/then",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/2/properties/type",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the fixed-query-parameter API-key credential interface for this source contract.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32507,24 +31494,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32532,7 +31518,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32540,45 +31526,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "const",
+          "value": "api_key_query"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/2/then/properties/deployment",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3",
+        "path_kind": "branch"
       },
-      "purpose": "Requires the Relay deployment service when Relay state storage is configured.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
-        "composed": false
+        "schema_types": [
+          "object"
+        ],
+        "composed": true
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32588,24 +31579,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32613,7 +31603,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32621,34 +31611,41 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "relay"
+            "type",
+            "request",
+            "response_profile"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/3",
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/allOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
@@ -32661,11 +31658,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32675,24 +31671,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32700,7 +31695,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32708,9 +31703,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -32721,15 +31716,15 @@
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/3/if",
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/allOf/0/if",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
@@ -32742,11 +31737,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32756,24 +31750,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32781,7 +31774,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32789,9 +31782,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -32802,39 +31795,38 @@
         {
           "keyword": "required",
           "value": [
-            "notary_state"
+            "response_profile"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/3/then",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/allOf/0/if/properties/response_profile",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Matches the strict no-expiry bearer profile before applying its refresh-control constraint.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32844,24 +31836,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32869,7 +31860,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32877,45 +31868,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "const",
+          "value": "oauth2_bearer_no_expiry"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/3/then/properties/deployment",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/allOf/0/then",
+        "path_kind": "branch"
       },
-      "purpose": "Requires the Notary deployment service when Notary state storage is configured.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -32925,24 +31919,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -32950,7 +31943,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -32958,34 +31951,28 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "notary"
-          ]
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/4",
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/allOf/0/then/not",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
@@ -32998,11 +31985,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33012,24 +31998,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33037,7 +32022,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33045,45 +32030,53 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
         "branch_has_no_authored_value"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "refresh_skew"
+          ]
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/4/if",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/properties/audience",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Constrains OAuth token acquisition to the reviewed source audience and is treated as sensitive operational metadata.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "sensitive",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33093,24 +32086,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33118,7 +32110,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33126,52 +32118,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "notary_cel"
-          ]
+          "keyword": "maxLength",
+          "value": 2048
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/4/then",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/properties/refresh_skew",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "With oauth2_bearer, sets a positive refresh interval below sixty seconds so a cached OAuth credential retains usable lifetime. The no-expiry profile rejects this field because caching is disabled.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33181,24 +32180,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33206,7 +32204,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33214,33 +32212,41 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,3}|[1-5][0-9]{4})ms|(?:[1-9]|[1-5][0-9])s)$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/4/then/properties/deployment",
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/properties/request",
         "path_kind": "property"
       },
-      "purpose": "Requires the Notary deployment service when a Notary CEL worker memory bound is configured.",
+      "purpose": "Selects form-encoded or JSON token requests for the OAuth client-credentials interface.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -33248,11 +32254,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33262,24 +32267,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33287,7 +32291,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33295,9 +32299,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -33305,41 +32309,41 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "notary"
+            "form",
+            "json"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/5",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/properties/response_profile",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects an exact OAuth bearer-token response shape. oauth2_bearer requires access_token, token_type Bearer, and a bounded expires_in value and permits expiry-bound caching. oauth2_bearer_no_expiry requires only access_token and token_type Bearer, rejects expiry and extra fields, and disables token caching.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33349,24 +32353,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33374,7 +32377,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33382,45 +32385,53 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "oauth2_bearer",
+            "oauth2_bearer_no_expiry"
+          ]
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/5/else",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/properties/scope",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares the bounded OAuth scope string requested for this source credential.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33430,24 +32441,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33455,7 +32465,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33463,33 +32473,45 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 1024
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/5/else/properties/callers",
+        "schema": "integration",
+        "pointer": "/$defs/credential/oneOf/3/properties/type",
         "path_kind": "property"
       },
-      "purpose": "When callers are authored without OID4VCI, requires the caller map to contain at least one binding; cross-file validation separately requires callers for Notary environments and rejects them for Relay-only topology.",
+      "purpose": "Selects the OAuth 2.0 client-credentials interface for source authentication.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -33497,11 +32519,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33511,24 +32532,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33536,7 +32556,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33544,9 +32564,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -33554,39 +32574,38 @@
       ],
       "constraints": [
         {
-          "keyword": "minProperties",
-          "value": 1
+          "keyword": "const",
+          "value": "oauth2_client_credentials"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/5/if",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest/properties/body",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Defines the optional authored body template sent by the declarative HTTP request.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33596,24 +32615,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33621,7 +32639,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33629,52 +32647,45 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "oid4vci"
-          ]
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/5/then",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest/properties/headers",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Maps reviewed request header names to authored values and input substitutions.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33684,24 +32695,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33709,7 +32719,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33717,52 +32727,57 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "notary_state"
-          ]
+          "keyword": "maxProperties",
+          "value": 32
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/5/then/properties/deployment",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest/properties/headers/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Requires the Notary deployment service when OID4VCI issuance is configured.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Request value supplied from a declared input or an authored scalar literal.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "boolean",
+          "integer",
+          "string"
+        ],
+        "local_reference": "#/$defs/inputOrLiteral",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33772,24 +32787,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33797,7 +32811,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33805,51 +32819,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "notary"
-          ]
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputOrLiteral"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest/properties/method",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the single GET or POST request performed by a declarative HTTP capability.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33859,24 +32870,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33884,7 +32894,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33892,45 +32902,53 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "GET",
+            "POST"
+          ]
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest/properties/path",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Defines the reviewed source path template used by the declarative HTTP request.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "sensitive",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -33940,24 +32958,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -33965,7 +32982,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -33973,30 +32990,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "sensitive_operational_metadata"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/[^?#]*$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci",
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest/properties/query",
         "path_kind": "property"
       },
-      "purpose": "Applies non-local HTTPS constraints to public OID4VCI endpoints.",
+      "purpose": "Maps reviewed query parameter names to authored request values and input substitutions.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
       "requiredness": "optional",
@@ -34007,11 +33043,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34021,24 +33056,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34046,7 +33080,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34054,44 +33088,57 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maxProperties",
+          "value": 64
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest/properties/query/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Applies non-local HTTPS constraints to all configured OID4VCI authorization-server endpoints.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Request value supplied from a declared input or an authored scalar literal.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "boolean",
+          "integer",
+          "string"
+        ],
+        "local_reference": "#/$defs/inputOrLiteral",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34101,24 +33148,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34126,7 +33172,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34134,47 +33180,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
-      "constraints": []
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputOrLiteral"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/authorize_url",
+        "schema": "integration",
+        "pointer": "/$defs/httpRequest/properties/semantics",
         "path_kind": "property"
       },
-      "purpose": "Exact HTTPS resource without query or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares that the declarative HTTP request has read-only source semantics.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/httpsResource",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34184,24 +33231,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34209,7 +33255,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34217,65 +33263,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "read_only"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/httpsResource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/issuer",
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/ambiguous",
         "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Lists HTTP response statuses that produce the integration's ambiguous outcome.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/origin",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34285,24 +33316,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34310,7 +33340,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34318,65 +33348,54 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
+          "keyword": "type",
+          "value": "array"
         },
         {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/origin"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/jwks_url",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/ambiguous/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Exact HTTPS resource without query or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/httpsResource",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34386,24 +33405,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34411,7 +33429,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34419,65 +33437,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
+          "keyword": "maximum",
+          "value": 599
         },
         {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
+          "keyword": "minimum",
+          "value": 100
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/httpsResource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/token_url",
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/no_match",
         "path_kind": "property"
       },
-      "purpose": "Exact HTTPS resource without query or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Lists HTTP response statuses that produce the integration's no-match outcome.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/httpsResource",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34487,24 +33499,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34512,7 +33523,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34520,65 +33531,54 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
+          "keyword": "type",
+          "value": "array"
         },
         {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/httpsResource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/userinfo_url",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/no_match/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Exact HTTPS resource without query or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/httpsResource",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34588,24 +33588,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34613,7 +33612,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34621,65 +33620,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
+          "keyword": "maximum",
+          "value": 599
         },
         {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
+          "keyword": "minimum",
+          "value": 100
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/httpsResource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/public_base_url",
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/shape",
         "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares whether a successful response is a singleton or a bounded collection.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/origin",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34689,24 +33682,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34714,7 +33706,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34722,65 +33714,43 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
+        "generated_docs_never_load_country_values"
       ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/origin"
-      }
+      "constraints": []
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/redirect_uri",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/shape/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Exact HTTPS resource without query or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/httpsResource",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34790,24 +33760,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34815,7 +33784,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34823,62 +33792,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "singleton"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/httpsResource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/oid4vci/properties/representative_issuance",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/shape/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Applies non-local HTTPS constraints to representative issuance.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34888,24 +33846,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34913,7 +33870,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -34921,32 +33878,45 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "records",
+            "cardinality"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/relay",
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/shape/oneOf/1/properties/cardinality",
         "path_kind": "property"
       },
-      "purpose": "Applies non-local HTTPS constraints to the Relay origin, issuer, and key-set bindings.",
+      "purpose": "Requires two-record probing so collection results distinguish one match from ambiguity.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -34954,11 +33924,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -34968,24 +33937,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -34993,7 +33961,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35001,44 +33969,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "const",
+          "value": "probe_two"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/relay/not",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/httpResponse/properties/shape/oneOf/1/properties/records",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the canonical response location containing collection records.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35048,24 +34022,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35073,7 +34046,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35081,55 +34054,52 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "local_api_keys"
-          ]
+          "keyword": "pattern",
+          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/relay/properties/issuer",
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/canonicalization",
         "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the reviewed normalization rule applied before an input is compared, interpolated, or sent to a source.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/origin",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35139,24 +34109,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35164,7 +34133,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35172,65 +34141,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "identity",
+            "ascii_lowercase"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/origin"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/relay/properties/jwks_url",
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/format",
         "path_kind": "property"
       },
-      "purpose": "Exact HTTPS resource without query or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Applies the full-date semantic format to a string-valued integration input.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/httpsResource",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35240,24 +34195,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35265,7 +34219,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35273,65 +34227,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "date"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/httpsResource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/else/properties/relay/properties/origin",
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/maxLength",
         "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Caps a string-valued integration input at 1,024 Unicode scalar values, deriving its conservative 4,096-byte UTF-8 ceiling.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/origin",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35341,24 +34280,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35366,7 +34304,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35374,62 +34312,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uri"
+          "keyword": "maximum",
+          "value": 1024
         },
         {
-          "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/origin"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/if",
-        "path_kind": "branch"
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/maximum",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Sets the inclusive upper bound accepted for an integer-valued integration input.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35439,24 +34373,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35464,7 +34397,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35472,30 +34405,44 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 9007199254740991
+        },
+        {
+          "keyword": "minimum",
+          "value": -9007199254740991
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/if/properties/deployment",
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/minLength",
         "path_kind": "property"
       },
-      "purpose": "Matches the local deployment profile before relaxing public endpoint transport constraints.",
+      "purpose": "Sets the minimum character length accepted for a string-valued integration input.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
       "requiredness": "optional",
@@ -35506,11 +34453,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35520,24 +34466,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35545,7 +34490,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35553,9 +34498,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -35563,29 +34508,37 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "profile"
-          ]
+          "keyword": "maximum",
+          "value": 16384
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/allOf/6/if/properties/deployment/properties/profile",
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/minimum",
         "path_kind": "property"
       },
-      "purpose": "Selects the local-profile condition used by the environment transport-validation branch.",
+      "purpose": "Sets the inclusive lower bound accepted for an integer-valued integration input.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -35593,11 +34546,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35607,24 +34559,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35632,7 +34583,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35640,9 +34591,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -35650,41 +34601,48 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "local"
+          "keyword": "maximum",
+          "value": 9007199254740991
+        },
+        {
+          "keyword": "minimum",
+          "value": -9007199254740991
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/callers",
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/pattern",
         "path_kind": "property"
       },
-      "purpose": "Notary API-key caller identities and the scopes each identity receives.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Constrains a string-valued integration input with the authored regular expression.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35694,24 +34652,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35719,7 +34676,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35727,9 +34684,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -35737,33 +34694,35 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 64
+          "keyword": "maxLength",
+          "value": 16384
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/callers/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/role",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares how one typed authoring input participates in source lookup, selection, or result shaping.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -35771,11 +34730,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35785,24 +34743,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35810,7 +34767,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35818,45 +34775,40 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "api_key_fingerprint",
-            "scopes"
+            "selector",
+            "parameter"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/callers/additionalProperties/properties/api_key_fingerprint",
+        "schema": "integration",
+        "pointer": "/$defs/input/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Names the secret reference used to verify one caller API key; neither the key nor fingerprint value is authored here.",
+      "purpose": "Declares the closed scalar or array type accepted for one integration input.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/secret",
+        "local_reference": "#/$defs/scalarType",
         "composed": false
       },
       "requiredness": "required",
@@ -35866,12 +34818,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35881,24 +34832,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -35906,7 +34856,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -35914,62 +34864,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
+        "generated_docs_never_load_country_values"
       ],
+      "constraints": [],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
+        "schema": "integration",
+        "pointer": "/$defs/scalarType"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/callers/additionalProperties/properties/scopes",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/inputOrLiteral/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Narrows one caller to the explicitly reviewed service scopes available in this environment.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Reference to a declared integration input.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/inputReference",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -35979,24 +34917,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36004,7 +34941,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36012,63 +34949,63 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "input"
+          ]
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputReference"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/callers/additionalProperties/properties/scopes/items",
-        "path_kind": "array_item"
+        "schema": "integration",
+        "pointer": "/$defs/inputOrLiteral/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
+          "boolean",
+          "integer",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36078,24 +35015,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36103,7 +35039,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36111,49 +35047,45 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "boolean",
+            "integer"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/callers/propertyNames",
-        "path_kind": "map_key"
+        "schema": "integration",
+        "pointer": "/$defs/inputReference/properties/input",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Portable lowercase name for an integration input or output.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -36161,11 +35093,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36175,24 +35106,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36200,7 +35130,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36208,19 +35138,18 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         },
         {
           "keyword": "type",
@@ -36228,40 +35157,39 @@
         }
       ],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/deployment",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/integrationRequestByteSize/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Products deployed in this environment and the operational profile they use.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36271,24 +35199,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36296,7 +35223,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36304,40 +35231,45 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "profile"
-          ]
+          "keyword": "maximum",
+          "value": 1048576
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/deployment/anyOf/0",
+        "schema": "integration",
+        "pointer": "/$defs/integrationRequestByteSize/oneOf/1",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
       "requiredness": "conditional",
@@ -36348,11 +35280,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36362,24 +35293,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36387,7 +35317,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36395,9 +35325,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -36406,26 +35336,30 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "relay"
-          ]
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,2}|10[0-1][0-9]|102[0-4])KiB|1MiB)$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/deployment/anyOf/1",
+        "schema": "integration",
+        "pointer": "/$defs/integrationResponseByteSize/oneOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
       "requiredness": "conditional",
@@ -36436,11 +35370,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "structural",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36450,24 +35383,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36475,7 +35407,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36483,9 +35415,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -36494,44 +35426,48 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "notary"
-          ]
+          "keyword": "maximum",
+          "value": 8388608
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/deployment/properties/notary",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/integrationResponseByteSize/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Binds an authored product role to a deployed service identifier.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/service",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36541,24 +35477,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36566,7 +35501,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36574,59 +35509,55 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "service"
-          ]
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,2}|[1-7][0-9]{3}|80[0-9]{2}|81[0-8][0-9]|819[0-2])KiB|[1-8]MiB)$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/service"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/deployment/properties/profile",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/integrationSourceByteSize/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Selects the deployment assurance profile whose service and transport conditions the environment must satisfy.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36636,24 +35567,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36661,7 +35591,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36669,57 +35599,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "local",
-            "hosted_lab",
-            "production",
-            "evidence_grade"
-          ]
+          "keyword": "maximum",
+          "value": 16777216
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/deployment/properties/relay",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/integrationSourceByteSize/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Binds an authored product role to a deployed service identifier.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/service",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36729,24 +35661,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36754,7 +35685,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36762,45 +35693,40 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "service"
-          ]
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-5][0-9]{3}|16[0-2][0-9]{2}|163[0-7][0-9]|1638[0-4])KiB|(?:[1-9]|1[0-6])MiB)$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/service"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/development",
+        "schema": "integration",
+        "pointer": "/$defs/limits/properties/calls",
         "path_kind": "property"
       },
-      "purpose": "Closed local-development selection. Registryctl uses the exact authored default and never prompts or guesses.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Caps the number of high-level source calls available to a script integration.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
@@ -36812,11 +35738,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36826,24 +35751,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36851,7 +35775,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36859,9 +35783,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -36869,38 +35793,37 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "source_mode",
-            "default_integration",
-            "default_fixture"
-          ]
+          "keyword": "maximum",
+          "value": 16
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/development/properties/default_fixture",
+        "schema": "integration",
+        "pointer": "/$defs/limits/properties/deadline",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Caps total integration execution time with a positive duration no greater than twenty seconds.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -36908,11 +35831,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -36922,24 +35844,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -36947,7 +35868,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -36955,9 +35876,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -36966,49 +35887,46 @@
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-9]{4}|20000)ms|(?:[1-9]|1[0-9]|20)s)$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/development/properties/default_integration",
+        "schema": "integration",
+        "pointer": "/$defs/limits/properties/request_bytes",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Maximum aggregate author-controlled request bytes for one execution, defaulting to 64 KiB and capped at 1 MiB. Use a positive byte integer or canonical KiB/MiB value.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
+          "integer",
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/integrationRequestByteSize",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
-      },
+        "behavior": "schema_default",
+        "schema_value": "64KiB"
+      },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37018,24 +35936,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37043,7 +35960,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37051,59 +35968,52 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
+      "constraints": [],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
+        "schema": "integration",
+        "pointer": "/$defs/integrationRequestByteSize"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/development/properties/notary_port",
+        "schema": "integration",
+        "pointer": "/$defs/limits/properties/source_bytes",
         "path_kind": "property"
       },
-      "purpose": "Overrides the loopback port exposed by the disposable local Notary runtime without changing a deployment endpoint.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Maximum aggregate source-response bytes for one execution, defaulting to 2 MiB and capped at 16 MiB. Use a positive byte integer or canonical KiB/MiB value.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "integer",
+          "string"
         ],
+        "local_reference": "#/$defs/integrationSourceByteSize",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "schema_value": "2MiB"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37113,24 +36023,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37138,7 +36047,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37146,44 +36055,36 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 65535
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/integrationSourceByteSize"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/development/properties/relay_port",
+        "schema": "integration",
+        "pointer": "/$defs/notApplicable/properties/ambiguity",
         "path_kind": "property"
       },
-      "purpose": "Overrides the loopback port exposed by the disposable local Relay runtime without changing a deployment endpoint.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Why the reviewed source contract cannot produce more than one matching record.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/notApplicableReason",
         "composed": false
       },
       "requiredness": "optional",
@@ -37194,11 +36095,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37208,24 +36108,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37233,7 +36132,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37241,9 +36140,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -37251,35 +36150,41 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 65535
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "rationale",
+            "request_fixture"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/notApplicableReason"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/development/properties/source_mode",
+        "schema": "integration",
+        "pointer": "/$defs/notApplicable/properties/subject_mismatch",
         "path_kind": "property"
       },
-      "purpose": "Selects whether the disposable local runtime uses the maintained synthetic source or an explicitly operator-bound source integration.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Why the reviewed response contract contains no identifier comparable with a requested selector.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/notApplicableReason",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -37287,11 +36192,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37301,24 +36205,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37326,7 +36229,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37334,9 +36237,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -37344,45 +36247,51 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "synthetic",
-            "local_snapshot",
-            "operator_bound"
+            "rationale",
+            "request_fixture"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/notApplicableReason"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/entities",
+        "schema": "integration",
+        "pointer": "/$defs/notApplicableReason/properties/rationale",
         "path_kind": "property"
       },
-      "purpose": "Environment-specific source bindings keyed by entity identifier.",
+      "purpose": "Why the named normally required outcome cannot occur for this source contract.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37392,24 +36301,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37417,7 +36325,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37425,9 +36333,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -37435,46 +36343,49 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 32
+          "keyword": "maxLength",
+          "value": 512
+        },
+        {
+          "keyword": "minLength",
+          "value": 24
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/entities/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "integration",
+        "pointer": "/$defs/notApplicableReason/properties/request_fixture",
+        "path_kind": "property"
       },
-      "purpose": "Maps an authored entity to provider columns and immutable source-generation identifiers.",
+      "purpose": "Fixture name containing the supporting bounded source request.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/entity",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37484,24 +36395,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37509,7 +36419,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37517,66 +36427,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "provider",
-            "columns",
-            "source_revision",
-            "generation"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/entity"
+        "schema": "integration",
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/entities/propertyNames",
-        "path_kind": "map_key"
+        "schema": "integration",
+        "pointer": "/$defs/output/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "Type, scalar bounds, and optional source pointer for one normalized scalar integration output.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/scalarOutput",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37586,24 +36489,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37611,7 +36513,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37619,60 +36521,62 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "type"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
+        "schema": "integration",
+        "pointer": "/$defs/scalarOutput"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/integrations",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/output/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Environment bindings keyed by authored integration identifier.",
+      "purpose": "A recursively typed object output with a canonical byte ceiling and an always-closed field map.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/outputObject",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37682,24 +36586,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37707,7 +36610,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37715,56 +36618,65 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
+          "keyword": "required",
+          "value": [
+            "type",
+            "nullable",
+            "max_bytes",
+            "fields"
+          ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputObject"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/integrations/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "integration",
+        "pointer": "/$defs/output/oneOf/2",
+        "path_kind": "branch"
       },
-      "purpose": "Environment binding for an authored source integration.",
+      "purpose": "A recursively typed array output with canonical byte and item-count ceilings.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/integration",
+        "local_reference": "#/$defs/outputArray",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37774,24 +36686,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37799,7 +36710,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37807,20 +36718,24 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "source"
+            "type",
+            "nullable",
+            "max_bytes",
+            "max_items",
+            "items"
           ]
         },
         {
@@ -37829,41 +36744,38 @@
         }
       ],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/integration"
+        "schema": "integration",
+        "pointer": "/$defs/outputArray"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/integrations/propertyNames",
-        "path_kind": "map_key"
+        "schema": "integration",
+        "pointer": "/$defs/outputArray/properties/items",
+        "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
+      "purpose": "A recursively closed structured output schema without a source pointer.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
+        "schema_types": [],
+        "local_reference": "#/$defs/outputSchema",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37873,24 +36785,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37898,7 +36809,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -37906,48 +36817,38 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
+        "generated_docs_never_load_country_values"
       ],
+      "constraints": [],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
+        "schema": "integration",
+        "pointer": "/$defs/outputSchema"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/issuance",
+        "schema": "integration",
+        "pointer": "/$defs/outputArray/properties/max_bytes",
         "path_kind": "property"
       },
-      "purpose": "Notary issuer and signing-key bindings for credential issuance.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Caps the canonical serialized size of one structured output array.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -37955,11 +36856,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -37969,24 +36869,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -37994,7 +36893,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38002,9 +36901,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -38012,49 +36911,48 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "issuer",
-            "signing_key",
-            "signing_kid",
-            "generation"
-          ]
+          "keyword": "maximum",
+          "value": 65536
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/issuance/properties/algorithm",
+        "schema": "integration",
+        "pointer": "/$defs/outputArray/properties/max_items",
         "path_kind": "property"
       },
-      "purpose": "Credential issuer signing algorithm. Holder proof remains EdDSA with did:jwk.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Caps the number of values released in one structured output array.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "schema_value": "EdDSA"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38064,24 +36962,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38089,7 +36986,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38097,9 +36994,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -38107,28 +37004,33 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "EdDSA",
-            "ES256"
-          ]
+          "keyword": "maximum",
+          "value": 256
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/issuance/properties/generation",
+        "schema": "integration",
+        "pointer": "/$defs/outputArray/properties/nullable",
         "path_kind": "property"
       },
-      "purpose": "Records the operator-controlled issuance-key generation used for explicit rotation and rollback checks.",
+      "purpose": "Declares whether the complete structured output array may be null.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -38139,12 +37041,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38154,24 +37055,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38179,7 +37079,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38187,60 +37087,48 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/issuance/properties/issuer",
+        "schema": "integration",
+        "pointer": "/$defs/outputArray/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Binds the operator-approved credential issuer identifier without granting claim or disclosure authority.",
+      "purpose": "Selects the array form for a structured integration output.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38250,24 +37138,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38275,7 +37162,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38283,42 +37170,36 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/issuance/properties/signing_key",
+        "schema": "integration",
+        "pointer": "/$defs/outputObject/properties/fields",
         "path_kind": "property"
       },
-      "purpose": "Names the operator-managed secret reference for credential signing; the signing key value is never authored or reported.",
+      "purpose": "Declares the bounded closed map of fields released in one structured output object.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/secret",
         "composed": false
       },
       "requiredness": "required",
@@ -38328,12 +37209,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38343,24 +37223,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38368,7 +37247,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38376,63 +37255,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maxProperties",
+          "value": 32
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/issuance/properties/signing_kid",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/outputObject/properties/fields/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Selects the reviewed signing-key identifier exposed in issued credential metadata without containing private key material.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Requiredness and recursive schema for one named field of a closed structured output object.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token2048",
+        "local_reference": "#/$defs/outputObjectField",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38442,24 +37317,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38467,7 +37341,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38475,68 +37349,63 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
+          "keyword": "required",
+          "value": [
+            "required",
+            "schema"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/token2048"
+        "schema": "integration",
+        "pointer": "/$defs/outputObjectField"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_cel",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/outputObject/properties/fields/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Optional per-worker data/address-space ceiling for dedicated Notary CEL processes. The Notary default is 134217728 bytes; 1073741824 is the maximum emulation-compatible exception and remains a limit, not an allocation.",
+      "purpose": "Portable lowercase name for an integration input or output.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38546,24 +37415,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38571,7 +37439,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38579,38 +37447,41 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "worker_memory_bytes"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_cel/properties/worker_memory_bytes",
+        "schema": "integration",
+        "pointer": "/$defs/outputObject/properties/max_bytes",
         "path_kind": "property"
       },
-      "purpose": "Caps the memory available to one isolated Notary CEL worker.",
+      "purpose": "Caps the canonical serialized size of one structured output object.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "integer"
@@ -38625,11 +37496,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38639,24 +37509,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38664,7 +37533,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38672,9 +37541,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -38683,11 +37552,11 @@
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 1073741824
+          "value": 65536
         },
         {
           "keyword": "minimum",
-          "value": 33554432
+          "value": 1
         },
         {
           "keyword": "type",
@@ -38697,22 +37566,22 @@
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_relay",
+        "schema": "integration",
+        "pointer": "/$defs/outputObject/properties/nullable",
         "path_kind": "property"
       },
-      "purpose": "Deployment-internal Relay connection, Notary workload identity, and token file used only when Notary consults Relay.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares whether the complete structured output object may be null.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -38720,11 +37589,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38734,24 +37602,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38759,7 +37626,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38767,43 +37634,34 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "base_url",
-            "workload_client_id",
-            "token_file"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_relay/properties/base_url",
+        "schema": "integration",
+        "pointer": "/$defs/outputObject/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Binds Notary to the operator-reviewed Relay origin used for governed evidence consultations.",
+      "purpose": "Selects the closed object form for a structured integration output.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
-        "local_reference": "#/$defs/internalOrigin",
         "composed": false
       },
       "requiredness": "required",
@@ -38813,12 +37671,11 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38828,24 +37685,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38853,7 +37709,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38861,51 +37717,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/internalOrigin"
-      }
+      "constraints": [
+        {
+          "keyword": "const",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_relay/properties/token_file",
+        "schema": "integration",
+        "pointer": "/$defs/outputObjectField/properties/required",
         "path_kind": "property"
       },
-      "purpose": "Selects the operator-managed token-file binding for Notary-to-Relay authentication without exposing its contents.",
+      "purpose": "Declares whether a named field must be present in every released structured output object.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -38915,24 +37770,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -38940,7 +37794,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -38948,64 +37802,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
-        },
-        {
-          "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_relay/properties/workload_client_id",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/outputObjectField/properties/schema",
+        "path_kind": "property"
       },
-      "purpose": "Identifies the Notary workload client authorized to request reviewed Relay consultations.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "A recursively closed structured output schema without a source pointer.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
+        "local_reference": "#/$defs/outputSchema",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39015,24 +37854,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39040,7 +37878,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39048,60 +37886,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputSchema"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_state",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/outputSchema/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Optional deployment binding for Notary-owned PostgreSQL state transport trust.",
+      "purpose": "Type and bounds for a scalar nested inside a structured output.",
       "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/scalarOutputSchema",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39111,24 +37939,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39136,7 +37963,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39144,57 +37971,62 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "postgresql"
+            "type"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/scalarOutputSchema"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_state/properties/postgresql",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/outputSchema/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Selects the PostgreSQL trust binding used by Notary state storage.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "A recursively typed object output with a canonical byte ceiling and an always-closed field map.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/outputObject",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39204,24 +38036,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39229,7 +38060,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39237,58 +38068,65 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "root_certificate_path"
+            "type",
+            "nullable",
+            "max_bytes",
+            "fields"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputObject"
+      }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/notary_state/properties/postgresql/properties/root_certificate_path",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/outputSchema/oneOf/2",
+        "path_kind": "branch"
       },
-      "purpose": "Binds Notary state storage to an operator-managed PostgreSQL trust root at a deployment-local path.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "A recursively typed array output with canonical byte and item-count ceilings.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/absolutePath",
+        "local_reference": "#/$defs/outputArray",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39298,24 +38136,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39323,7 +38160,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39331,54 +38168,51 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
-        },
-        {
-          "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "keyword": "required",
+          "value": [
+            "type",
+            "nullable",
+            "max_bytes",
+            "max_items",
+            "items"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/absolutePath"
+        "schema": "integration",
+        "pointer": "/$defs/outputArray"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/oid4vci",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci",
         "path_kind": "property"
       },
-      "purpose": "Explicit registry-backed holder-wallet OID4VCI binding for one authored Notary credential profile.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Enables the bounded signed DCI search helper and declares its protocol and selector bindings.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/oid4vci",
         "composed": false
       },
       "requiredness": "optional",
@@ -39389,11 +38223,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39403,24 +38236,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39428,7 +38260,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39436,9 +38268,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -39448,45 +38280,39 @@
         {
           "keyword": "required",
           "value": [
-            "public_base_url",
-            "credential",
-            "authorization_server",
-            "client",
-            "access_token",
-            "sensitive_state_key",
-            "subject",
-            "redirect_uri",
-            "allowed_wallet_origins"
+            "profile",
+            "path",
+            "jwks_profile",
+            "sender",
+            "receiver",
+            "registry_type",
+            "record_type",
+            "locale",
+            "selectors"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/oid4vci"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/jwks_profile",
         "path_kind": "property"
       },
-      "purpose": "Public Relay identity and token-validation settings for a Relay deployment.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the supported RSA signing-key-set profile used to verify signed DCI responses.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -39494,11 +38320,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39508,24 +38333,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39533,7 +38357,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39541,9 +38365,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -39551,51 +38375,40 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "origin",
-            "issuer",
-            "jwks_url",
-            "audience",
-            "allowed_clients"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "rsa-signing-jwks-v1"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/allowed_clients",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/locale",
         "path_kind": "property"
       },
-      "purpose": "Narrows Relay authentication to the operator-reviewed client identifiers listed for this environment.",
+      "purpose": "Declares the language or locale tag carried by signed DCI search requests.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39605,24 +38418,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39630,7 +38442,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39638,60 +38450,54 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 64
+          "keyword": "pattern",
+          "value": "^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$"
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/allowed_clients/items",
-        "path_kind": "array_item"
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/path",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares the exact private source path used for signed DCI search requests.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
+      "sensitivity": "sensitive",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39701,24 +38507,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39726,7 +38531,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39734,23 +38539,19 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^/[^?#]*$"
         },
         {
           "keyword": "type",
@@ -39760,34 +38561,31 @@
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/audience",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/profile",
         "path_kind": "property"
       },
-      "purpose": "Binds the token audience Relay requires so tokens issued for another service are rejected.",
+      "purpose": "Selects the supported DCI search request profile used by the signed protocol helper.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39797,24 +38595,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39822,7 +38619,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39830,59 +38627,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "dci-search-v1"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/issuer",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/receiver",
         "path_kind": "property"
       },
-      "purpose": "Binds the expected token issuer for Relay authentication in this deployment environment.",
+      "purpose": "Declares the signed DCI receiver identifier included in protocol requests.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/relayOrigin",
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39892,24 +38680,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -39917,7 +38704,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -39925,50 +38712,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relayOrigin"
-      }
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/jwks_url",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/record_type",
         "path_kind": "property"
       },
-      "purpose": "Binds the operator-reviewed key-set endpoint Relay uses to verify caller tokens.",
+      "purpose": "Declares the record type requested through the signed DCI search profile.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/relayResource",
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -39978,24 +38773,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40003,7 +38797,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40011,51 +38805,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relayResource"
-      }
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/local_api_keys",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/registry_type",
         "path_kind": "property"
       },
-      "purpose": "Declares synthetic API-key principals only for the local profile; Registryctl generates raw keys privately and emits only their fingerprints to Relay.",
+      "purpose": "Declares the registry type requested through the signed DCI search profile.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40065,24 +38866,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40090,7 +38890,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40098,9 +38898,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -40108,50 +38908,48 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "match_principal",
-            "no_match_principal",
-            "scopes"
-          ]
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/local_api_keys/properties/match_principal",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors",
         "path_kind": "property"
       },
-      "purpose": "Binds the synthetic local caller whose reviewed identifier matches one starter row; this identifier is not a raw key or a source value.",
+      "purpose": "Maps every selector input to its signed DCI request field and response location.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token256",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40161,24 +38959,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40186,7 +38983,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40194,69 +38991,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
+          "keyword": "maxProperties",
+          "value": 8
         },
         {
-          "keyword": "minLength",
+          "keyword": "minProperties",
           "value": 1
         },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/token256"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/local_api_keys/properties/no_match_principal",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Binds the synthetic local caller whose reviewed identifier intentionally matches no starter row so an empty result is maintained.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token256",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40266,24 +39052,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40291,7 +39076,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40299,68 +39084,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
+          "keyword": "required",
+          "value": [
+            "field",
+            "response_pointer"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/token256"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/local_api_keys/properties/scopes",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/field",
         "path_kind": "property"
       },
-      "purpose": "Limits both generated local API-key callers to the explicitly reviewed service scopes needed by the maintained checks.",
+      "purpose": "Declares the signed DCI identifier field bound to one selector input.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40370,24 +39145,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40395,7 +39169,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40403,9 +39177,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -40413,41 +39187,37 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "maxLength",
+          "value": 160
         },
         {
-          "keyword": "minItems",
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/local_api_keys/properties/scopes/items",
-        "path_kind": "array_item"
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/response_pointer",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Selects the canonical signed-record response location used to recover one selector value.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -40455,11 +39225,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40469,24 +39238,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40494,7 +39262,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40502,23 +39270,18 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
         },
         {
           "keyword": "type",
@@ -40528,33 +39291,34 @@
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay/properties/origin",
-        "path_kind": "property"
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Binds the externally visible Relay origin reviewed by the operator and local network policy.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/relayOrigin",
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40564,24 +39328,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40589,7 +39352,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40597,51 +39360,59 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "arbitrary_map_keys_not_fixed_properties"
+      ],
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
       ],
-      "constraints": [],
       "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relayOrigin"
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
       }
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay_state",
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/sender",
         "path_kind": "property"
       },
-      "purpose": "Optional deployment binding for Relay-owned consultation PostgreSQL state transport trust.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Declares the signed DCI sender identifier included in protocol requests.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40651,24 +39422,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40676,7 +39446,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40684,9 +39454,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -40694,35 +39464,35 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "postgresql"
-          ]
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay_state/properties/postgresql",
+        "schema": "integration",
+        "pointer": "/$defs/scalarOutput/properties/format",
         "path_kind": "property"
       },
-      "purpose": "Selects the PostgreSQL trust binding used by Relay state storage.",
+      "purpose": "Applies the full-date semantic format to a string-valued integration output.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -40730,11 +39500,10 @@
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "environment_bound",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40744,24 +39513,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40769,7 +39537,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40777,9 +39545,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -40787,48 +39555,40 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "root_certificate_path"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "date"
         }
       ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/relay_state/properties/postgresql/properties/root_certificate_path",
+        "schema": "integration",
+        "pointer": "/$defs/scalarOutput/properties/maxLength",
         "path_kind": "property"
       },
-      "purpose": "Binds Relay state storage to an operator-managed PostgreSQL trust root at a deployment-local path.",
+      "purpose": "Caps the character length produced for a string-valued integration output.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40838,24 +39598,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40863,7 +39622,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40871,66 +39630,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
+          "keyword": "maximum",
+          "value": 16384
         },
         {
-          "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/absolutePath"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "environment",
-        "pointer": "/properties/version",
+        "schema": "integration",
+        "pointer": "/$defs/scalarOutput/properties/maximum",
         "path_kind": "property"
       },
-      "purpose": "Environment authoring format version.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "purpose": "Sets the inclusive upper bound produced for an integer-valued integration output.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "public",
-      "state": "environment_bound",
+      "sensitivity": "internal",
+      "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -40940,24 +39691,23 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "operator_preflight",
+        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
+      "diagnostic": "registryctl.authoring.integration.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -40965,7 +39715,7 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
+        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
@@ -40973,9 +39723,9 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation"
+        "documentation",
+        "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -40983,41 +39733,48 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": 1
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "",
-        "path_kind": "root"
+        "pointer": "/$defs/scalarOutput/properties/minimum",
+        "path_kind": "property"
       },
-      "purpose": "Defines a product-neutral source adaptation contract using bounded HTTP, Rhai script, or exact snapshot capabilities.",
-      "purpose_source": "schema_description",
+      "purpose": "Sets the inclusive lower bound produced for an integer-valued integration output.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41036,7 +39793,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": true,
+        "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
@@ -41044,7 +39801,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41052,7 +39808,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41061,7 +39816,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -41072,35 +39826,35 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "version",
-            "id",
-            "revision",
-            "input",
-            "capability",
-            "outputs"
-          ]
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/allowRule/properties/method",
+        "pointer": "/$defs/scalarOutput/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Selects the GET or POST method permitted by one reviewed source allow rule.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Supported scalar type, optionally paired with null for nullable values.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "array"
+        ],
+        "local_reference": "#/$defs/scalarType",
         "composed": false
       },
       "requiredness": "required",
@@ -41115,7 +39869,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41142,7 +39895,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41150,7 +39902,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41159,7 +39910,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -41168,23 +39918,19 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "GET",
-            "POST"
-          ]
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/scalarType"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/allowRule/properties/path",
+        "pointer": "/$defs/scalarOutput/properties/x-registry-source",
         "path_kind": "property"
       },
-      "purpose": "Defines one reviewed source path template; concrete private endpoints and identifiers remain environment-owned.",
+      "purpose": "Selects the canonical source-response location from which the HTTP output is extracted.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -41195,19 +39941,18 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41234,7 +39979,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41242,7 +39986,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41251,28 +39994,18 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "pattern",
-          "value": "^/[^?#]*$"
+          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
         },
         {
           "keyword": "type",
@@ -41283,10 +40016,10 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/allowRule/properties/semantics",
+        "pointer": "/$defs/scalarOutputSchema/properties/format",
         "path_kind": "property"
       },
-      "purpose": "Declares that the permitted source operation has read-only semantics.",
+      "purpose": "Applies the full-date semantic format to a string-valued field inside a structured integration output.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -41307,7 +40040,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41334,7 +40066,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41342,7 +40073,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41351,7 +40081,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -41363,40 +40092,39 @@
       "constraints": [
         {
           "keyword": "const",
-          "value": "read_only"
+          "value": "date"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/scalarOutputSchema/properties/maxLength",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Caps the character length produced for a string-valued field inside a structured integration output.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41423,7 +40151,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41431,7 +40158,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41440,47 +40166,47 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "http"
-          ]
+          "keyword": "maximum",
+          "value": 16384
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/0/properties/http",
+        "pointer": "/$defs/scalarOutputSchema/properties/maximum",
         "path_kind": "property"
       },
-      "purpose": "Selects the single-request declarative HTTP capability and its expected response semantics.",
+      "purpose": "Sets the inclusive upper bound produced for an integer-valued field inside a structured integration output.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -41492,7 +40218,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41519,7 +40244,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41527,7 +40251,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41536,7 +40259,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -41547,36 +40269,37 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "request"
-          ]
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/0/properties/http/properties/request",
+        "pointer": "/$defs/scalarOutputSchema/properties/minimum",
         "path_kind": "property"
       },
-      "purpose": "Bounded read-only HTTP request template.",
-      "purpose_source": "schema_description",
+      "purpose": "Sets the inclusive lower bound produced for an integer-valued field inside a structured integration output.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/httpRequest",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -41588,7 +40311,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41615,7 +40337,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41623,7 +40344,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41632,7 +40352,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -41643,41 +40362,38 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "method",
-            "path"
-          ]
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/httpRequest"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/0/properties/http/properties/response",
+        "pointer": "/$defs/scalarOutputSchema/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Rules for translating upstream status and body cardinality into normalized outcomes.",
+      "purpose": "Supported scalar type, optionally paired with null for nullable values.",
       "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/httpResponse",
+        "local_reference": "#/$defs/scalarType",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -41689,7 +40405,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41716,7 +40431,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41724,7 +40438,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41733,7 +40446,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -41742,21 +40454,16 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
+      "constraints": [],
       "local_reference": {
         "schema": "integration",
-        "pointer": "/$defs/httpResponse"
+        "pointer": "/$defs/scalarType"
       }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/1",
+        "pointer": "/$defs/scalarType/oneOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
@@ -41765,9 +40472,7 @@
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "conditional",
@@ -41782,7 +40487,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41809,7 +40513,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41817,7 +40520,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41826,7 +40528,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -41838,47 +40539,44 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "script"
+            "string",
+            "boolean",
+            "integer"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/1/properties/script",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Selects the reviewed project-relative script capability and its optional modules.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -41905,7 +40603,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -41913,7 +40610,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -41922,59 +40618,61 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "file"
-          ]
+          "keyword": "maxItems",
+          "value": 2
+        },
+        {
+          "keyword": "minItems",
+          "value": 2
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/1/properties/script/properties/file",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0",
+        "path_kind": "array_item"
       },
-      "purpose": "Project-relative path without traversal or duplicate separators.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/relativePath",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42001,7 +40699,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42009,7 +40706,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42018,7 +40714,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -42026,61 +40721,46 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "string",
+            "boolean",
+            "integer"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/relativePath"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/1/properties/script/properties/modules",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1",
+        "path_kind": "array_item"
       },
-      "purpose": "Lists the reviewed project-relative modules available to the integration script.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "array"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42107,7 +40787,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42115,7 +40794,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42124,7 +40802,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -42132,44 +40809,35 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 32
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "const",
+          "value": "null"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/1/properties/script/properties/modules/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/source/properties/allow",
+        "path_kind": "property"
       },
-      "purpose": "Project-relative path without traversal or duplicate separators.",
-      "purpose_source": "schema_description",
+      "purpose": "Constrains source access to the explicitly reviewed method and path templates in this integration contract.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/relativePath",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -42179,7 +40847,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42206,7 +40873,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42214,7 +40880,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42223,47 +40888,37 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
+          "keyword": "maxItems",
+          "value": 16
         },
         {
-          "keyword": "minLength",
+          "keyword": "minItems",
           "value": 1
         },
-        {
-          "keyword": "pattern",
-          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/relativePath"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/2",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/allow/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "One read-only upstream method and path pattern the adapter may call.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -42271,21 +40926,21 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/allowRule",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42312,7 +40967,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42320,7 +40974,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42329,7 +40982,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -42337,28 +40989,33 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "snapshot"
+            "method",
+            "path"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/allowRule"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/2/properties/snapshot",
+        "pointer": "/$defs/source/properties/auth",
         "path_kind": "property"
       },
-      "purpose": "Selects an offline entity snapshot capability with exact input matching and freshness control.",
+      "purpose": "Declares the credential interface the source contract permits without embedding an environment credential value.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -42367,6 +41024,7 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/credential",
         "composed": false
       },
       "requiredness": "required",
@@ -42381,7 +41039,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42408,7 +41065,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42416,7 +41072,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42425,7 +41080,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -42434,29 +41088,20 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "entity",
-            "exact",
-            "freshness"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/credential"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/entity",
+        "pointer": "/$defs/source/properties/product",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Names the source product whose version labels are classified by this integration contract.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -42464,10 +41109,9 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -42479,7 +41123,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42506,7 +41149,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42514,7 +41156,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42523,7 +41164,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -42534,27 +41174,27 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/exact",
+        "pointer": "/$defs/source/properties/protocol",
         "path_kind": "property"
       },
-      "purpose": "Maps entity fields to integration inputs that must match exactly in the snapshot lookup.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Optional interoperable protocol profiles layered over the source transport.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -42562,9 +41202,10 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/protocol",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -42576,7 +41217,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42603,7 +41243,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42611,7 +41250,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42620,7 +41258,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -42630,10 +41267,6 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 8
-        },
         {
           "keyword": "minProperties",
           "value": 1
@@ -42642,27 +41275,30 @@
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/protocol"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/exact/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/source/properties/request_headers",
+        "path_kind": "property"
       },
-      "purpose": "Reference to a declared integration input.",
-      "purpose_source": "schema_description",
+      "purpose": "Lists the bounded source request header names available to the integration adapter.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/inputReference",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -42674,7 +41310,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42701,7 +41336,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42709,7 +41343,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42718,41 +41351,37 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "input"
-          ]
+          "keyword": "maxItems",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputReference"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/freshness",
-        "path_kind": "property"
+        "pointer": "/$defs/source/properties/request_headers/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Sets the maximum accepted age of the materialized entity snapshot within the product-owned 31-day ceiling.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -42762,7 +41391,7 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -42774,7 +41403,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42801,7 +41429,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42809,7 +41436,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42818,19 +41444,19 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,8}|1[0-9]{9}|2[0-5][0-9]{8}|26[0-6][0-9]{7}|267[0-7][0-9]{6}|2678[0-3][0-9]{5}|2678400000)ms|(?:[1-9][0-9]{0,5}|1[0-9]{6}|2[0-5][0-9]{5}|26[0-6][0-9]{4}|267[0-7][0-9]{3}|2678[0-3][0-9]{2}|2678400)s|(?:[1-9][0-9]{0,3}|[1-3][0-9]{4}|4[0-3][0-9]{3}|44[0-5][0-9]{2}|446[0-3][0-9]{1}|44640)m|(?:[1-9][0-9]{0,1}|[1-6][0-9]{2}|7[0-3][0-9]{1}|74[0-3]|744)h|(?:[1-9][0-9]{0,0}|[1-2][0-9]{1}|30|31)d)$"
+          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
         },
         {
           "keyword": "type",
@@ -42841,11 +41467,11 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/response",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Defines the reviewed source response representation and optional byte bound.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -42855,19 +41481,18 @@
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42894,7 +41519,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42902,7 +41526,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -42911,23 +41534,15 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -42937,10 +41552,10 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/0/properties/type",
+        "pointer": "/$defs/source/properties/response/properties/format",
         "path_kind": "property"
       },
-      "purpose": "Selects an unauthenticated, basic-authentication, or static-bearer credential interface.",
+      "purpose": "Selects JSON decoding or text handling for reviewed source responses.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -42949,7 +41564,7 @@
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -42961,7 +41576,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -42988,7 +41602,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -42996,7 +41609,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43005,7 +41617,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -43018,9 +41629,8 @@
         {
           "keyword": "enum",
           "value": [
-            "none",
-            "basic",
-            "static_bearer"
+            "json",
+            "text"
           ]
         }
       ]
@@ -43028,33 +41638,119 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/response/properties/max_bytes",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Maximum bytes accepted from one source response, defaulting to 512 KiB and capped at 8 MiB. Use a positive byte integer or canonical KiB/MiB value.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer",
+          "string"
         ],
+        "local_reference": "#/$defs/integrationResponseByteSize",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "schema_default",
+        "schema_value": "512KiB"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/integrationResponseByteSize"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/source/properties/response_headers",
+        "path_kind": "property"
+      },
+      "purpose": "Lists the bounded source response header names available to the integration adapter.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43081,7 +41777,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43089,7 +41784,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43098,51 +41792,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "name",
-            "max_value_bytes"
-          ]
+          "keyword": "maxItems",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/1/properties/max_value_bytes",
-        "path_kind": "property"
+        "pointer": "/$defs/source/properties/response_headers/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Caps the credential value size accepted by the fixed-header API-key interface.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -43152,7 +41844,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43179,7 +41870,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43187,7 +41877,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43196,50 +41885,47 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4096
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/1/properties/name",
+        "pointer": "/$defs/source/properties/versions",
         "path_kind": "property"
       },
-      "purpose": "Declares the fixed HTTP header name used by the API-key credential interface.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Source versions tested by the project and versions explicitly accepted as unverified.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/versions",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -43249,7 +41935,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43276,7 +41961,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43284,7 +41968,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43293,7 +41976,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -43303,34 +41985,36 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z][A-Za-z0-9_-]{0,63}$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/versions"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/1/properties/type",
-        "path_kind": "property"
+        "pointer": "/$defs/versionList/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Selects the fixed-header API-key credential interface for this source contract.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -43340,7 +42024,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43367,7 +42050,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43375,7 +42057,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43384,26 +42065,34 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "api_key_header"
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/2",
+        "pointer": "/$defs/versions/anyOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
@@ -43412,9 +42101,7 @@
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "conditional",
@@ -43429,7 +42116,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43456,7 +42142,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43464,7 +42149,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43473,7 +42157,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -43487,32 +42170,24 @@
         {
           "keyword": "required",
           "value": [
-            "type",
-            "name",
-            "max_value_bytes"
+            "tested"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/2/properties/max_value_bytes",
+        "pointer": "/$defs/versions/anyOf/0/properties/tested",
         "path_kind": "property"
       },
-      "purpose": "Caps the credential value size accepted by the fixed-query API-key interface.",
+      "purpose": "Requires at least one source product version to be classified as tested in this integration contract.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
@@ -43527,7 +42202,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43554,7 +42228,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43562,7 +42235,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43571,7 +42243,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -43582,49 +42253,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4096
-        },
-        {
-          "keyword": "minimum",
+          "keyword": "minItems",
           "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/2/properties/name",
-        "path_kind": "property"
+        "pointer": "/$defs/versions/anyOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Declares the fixed query parameter name used by the API-key credential interface.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43651,7 +42311,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43659,7 +42318,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43668,33 +42326,31 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9._:~-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "required",
+          "value": [
+            "unverified"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/2/properties/type",
+        "pointer": "/$defs/versions/anyOf/1/properties/unverified",
         "path_kind": "property"
       },
-      "purpose": "Selects the fixed-query-parameter API-key credential interface for this source contract.",
+      "purpose": "Requires at least one source product version to be classified as unverified in this integration contract.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -43715,7 +42371,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43742,7 +42397,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43750,7 +42404,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43759,7 +42412,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -43770,41 +42422,41 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "api_key_query"
+          "keyword": "minItems",
+          "value": 1
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3",
-        "path_kind": "branch"
+        "pointer": "/$defs/versions/properties/tested",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Bounded list of source version labels.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "composed": true
+        "local_reference": "#/$defs/versionList",
+        "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -43831,7 +42483,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -43839,7 +42490,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -43848,142 +42498,63 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "request",
-            "response_profile"
-          ]
+          "keyword": "maxItems",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/allOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": []
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/versionList"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/allOf/0/if",
-        "path_kind": "branch"
+        "pointer": "/$defs/versions/properties/unverified",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Bounded list of source version labels.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "array"
+        ],
+        "local_reference": "#/$defs/versionList",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44010,7 +42581,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44018,7 +42588,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44027,38 +42596,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "response_profile"
-          ]
+          "keyword": "maxItems",
+          "value": 32
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/versionList"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/allOf/0/if/properties/response_profile",
+        "pointer": "/properties/capability",
         "path_kind": "property"
       },
-      "purpose": "Matches the strict no-expiry bearer profile before applying its refresh-control constraint.",
+      "purpose": "Exactly one bounded execution mechanism for the source adaptation.",
       "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/capability",
         "composed": false
       },
       "requiredness": "required",
@@ -44073,7 +42653,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44100,7 +42679,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44108,7 +42686,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44117,7 +42694,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -44126,124 +42702,42 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "oauth2_bearer_no_expiry"
-        }
-      ]
-    },
-    {
-      "address": {
+      "constraints": [],
+      "local_reference": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/allOf/0/then",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": []
+        "pointer": "/$defs/capability"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/allOf/0/then/not",
-        "path_kind": "branch"
+        "pointer": "/properties/id",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Stable project-local identifier for the integration.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44270,7 +42764,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44278,7 +42771,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44287,55 +42779,58 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "refresh_skew"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/properties/audience",
+        "pointer": "/properties/input",
         "path_kind": "property"
       },
-      "purpose": "Constrains OAuth token acquisition to the reviewed source audience and is treated as sensitive operational metadata.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Typed selector and parameter inputs accepted by this integration.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44362,7 +42857,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44370,7 +42864,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44379,51 +42872,50 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 2048
+          "keyword": "maxProperties",
+          "value": 16
         },
         {
-          "keyword": "minLength",
+          "keyword": "minProperties",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/properties/refresh_skew",
-        "path_kind": "property"
+        "pointer": "/properties/input/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "With oauth2_bearer, sets a positive refresh interval below sixty seconds so a cached OAuth credential retains usable lifetime. The no-expiry profile rejects this field because caching is disabled.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Type, validation, and canonicalization rules for one authored input.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/input",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -44433,7 +42925,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44460,7 +42951,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44468,7 +42958,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44477,44 +42966,54 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,3}|[1-5][0-9]{4})ms|(?:[1-9]|[1-5][0-9])s)$"
+          "keyword": "required",
+          "value": [
+            "role",
+            "type"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/input"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/properties/request",
-        "path_kind": "property"
+        "pointer": "/properties/input/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Selects form-encoded or JSON token requests for the OAuth client-credentials interface.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -44524,7 +43023,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44551,7 +43049,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44559,7 +43056,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44568,41 +43064,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "form",
-            "json"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/properties/response_profile",
+        "pointer": "/properties/limits",
         "path_kind": "property"
       },
-      "purpose": "Selects an exact OAuth bearer-token response shape. oauth2_bearer requires access_token, token_type Bearer, and a bounded expires_in value and permits expiry-bound caching. oauth2_bearer_no_expiry requires only access_token and token_type Bearer, rejects expiry and extra fields, and disables token caching.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Optional tighter resource limits for one integration execution.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/limits",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -44614,7 +43118,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44641,7 +43144,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44649,7 +43151,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44658,7 +43159,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -44669,34 +43169,36 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "oauth2_bearer",
-            "oauth2_bearer_no_expiry"
-          ]
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/limits"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/properties/scope",
+        "pointer": "/properties/not_applicable",
         "path_kind": "property"
       },
-      "purpose": "Declares the bounded OAuth scope string requested for this source credential.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Explicit rationale and request-fixture evidence for a normally required outcome that the source contract cannot produce.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/notApplicable",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -44706,7 +43208,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44733,7 +43234,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44741,7 +43241,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44750,7 +43249,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -44761,122 +43259,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 1024
-        },
-        {
-          "keyword": "minLength",
+          "keyword": "minProperties",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/credential/oneOf/3/properties/type",
-        "path_kind": "property"
-      },
-      "purpose": "Selects the OAuth 2.0 client-credentials interface for source authentication.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
       ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "oauth2_client_credentials"
-        }
-      ]
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/notApplicable"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpRequest/properties/body",
+        "pointer": "/properties/outputs",
         "path_kind": "property"
       },
-      "purpose": "Defines the optional authored body template sent by the declarative HTTP request.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Named typed outputs, or a shorthand list of output names inferred by the authoring compiler.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
-        "composed": false
+        "schema_types": [
+          "array",
+          "object"
+        ],
+        "composed": true
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -44888,7 +43302,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44915,7 +43328,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -44923,7 +43335,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -44932,7 +43343,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -44946,11 +43356,11 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpRequest/properties/headers",
-        "path_kind": "property"
+        "pointer": "/properties/outputs/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Maps reviewed request header names to authored values and input substitutions.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -44960,19 +43370,18 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -44999,7 +43408,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45007,7 +43415,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45016,19 +43423,23 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "maxProperties",
-          "value": 32
+          "value": 64
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
@@ -45039,26 +43450,22 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpRequest/properties/headers/additionalProperties",
+        "pointer": "/properties/outputs/oneOf/0/additionalProperties",
         "path_kind": "map_value"
       },
-      "purpose": "Request value supplied from a declared input or an authored scalar literal.",
+      "purpose": "A bounded scalar or recursively closed structured schema for one normalized integration output.",
       "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "boolean",
-          "integer",
-          "string"
-        ],
-        "local_reference": "#/$defs/inputOrLiteral",
+        "schema_types": [],
+        "local_reference": "#/$defs/output",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -45068,7 +43475,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45095,7 +43501,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45103,7 +43508,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45112,7 +43516,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -45125,25 +43528,25 @@
       "constraints": [],
       "local_reference": {
         "schema": "integration",
-        "pointer": "/$defs/inputOrLiteral"
+        "pointer": "/$defs/output"
       }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpRequest/properties/method",
-        "path_kind": "property"
+        "pointer": "/properties/outputs/oneOf/0/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Selects the single GET or POST request performed by a declarative HTTP capability.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -45155,7 +43558,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45182,7 +43584,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45190,7 +43591,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45199,33 +43599,25 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "GET",
-            "POST"
-          ]
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpRequest/properties/path",
-        "path_kind": "property"
+        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Defines the reviewed source path template used by the declarative HTTP request.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -45233,21 +43625,21 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45274,7 +43666,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45282,7 +43673,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45291,7 +43681,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -45299,57 +43688,50 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "pattern",
-          "value": "^/[^?#]*$"
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpRequest/properties/query",
-        "path_kind": "property"
+        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Maps reviewed query parameter names to authored request values and input substitutions.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45376,7 +43758,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45384,7 +43765,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45393,59 +43773,44 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpRequest/properties/query/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1/not",
+        "path_kind": "branch"
       },
-      "purpose": "Request value supplied from a declared input or an authored scalar literal.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "boolean",
-          "integer",
-          "string"
-        ],
-        "local_reference": "#/$defs/inputOrLiteral",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45472,7 +43837,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45480,7 +43844,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45489,7 +43852,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -45497,42 +43859,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputOrLiteral"
-      }
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "matched",
+            "outcome"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpRequest/properties/semantics",
-        "path_kind": "property"
+        "pointer": "/properties/outputs/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Declares that the declarative HTTP request has read-only source semantics.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "array"
+        ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45559,7 +43926,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45567,7 +43933,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45576,42 +43941,55 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "read_only"
+          "keyword": "maxItems",
+          "value": 64
+        },
+        {
+          "keyword": "minItems",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/ambiguous",
-        "path_kind": "property"
+        "pointer": "/properties/outputs/oneOf/1/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Lists HTTP response statuses that produce the integration's ambiguous outcome.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -45621,7 +43999,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45648,7 +44025,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45656,7 +44032,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45665,34 +44040,38 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "array"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/ambiguous/items",
-        "path_kind": "array_item"
+        "pointer": "/properties/revision",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Monotonically increasing revision of this integration contract.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -45702,7 +44081,7 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -45714,7 +44093,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45733,7 +44111,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
+        "schema_examples_available": true,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
@@ -45741,7 +44119,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45749,7 +44126,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45758,24 +44134,22 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 599
+          "value": 4294967295
         },
         {
           "keyword": "minimum",
-          "value": 100
+          "value": 1
         },
         {
           "keyword": "type",
@@ -45786,18 +44160,19 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/no_match",
+        "pointer": "/properties/source",
         "path_kind": "property"
       },
-      "purpose": "Lists HTTP response statuses that produce the integration's no-match outcome.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Optional source product metadata and transport policy; capabilities remain product-neutral.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/source",
         "composed": false
       },
       "requiredness": "optional",
@@ -45812,7 +44187,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45839,7 +44213,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45847,7 +44220,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45856,7 +44228,6 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -45867,45 +44238,48 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "array"
+          "keyword": "required",
+          "value": [
+            "auth"
+          ]
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/source"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/no_match/items",
-        "path_kind": "array_item"
+        "pointer": "/properties/version",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Integration authoring format version.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -45932,7 +44306,6 @@
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -45940,7 +44313,6 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
@@ -45949,61 +44321,49 @@
         "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 599
-        },
-        {
-          "keyword": "minimum",
-          "value": 100
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
+          "keyword": "const",
+          "value": 1
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/shape",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "",
+        "path_kind": "root"
       },
-      "purpose": "Declares whether a successful response is a singleton or a bounded collection.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Defines one synthetic, deterministic integration scenario for offline adapter verification.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "not_applicable",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46012,42 +44372,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -46056,36 +44406,51 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name",
+            "classification",
+            "input",
+            "interactions",
+            "expect"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/shape/oneOf/0",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/$defs/expectation/properties/error",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "States the bounded error identifier expected from a failing offline fixture.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46094,42 +44459,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -46137,45 +44492,49 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "singleton"
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/shape/oneOf/1",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/$defs/expectation/properties/outcome",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "States whether the offline fixture is expected to match, find no match, or remain ambiguous.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46184,42 +44543,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -46227,50 +44576,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "records",
-            "cardinality"
+            "match",
+            "no_match",
+            "ambiguous"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/shape/oneOf/1/properties/cardinality",
+        "schema": "fixture",
+        "pointer": "/$defs/expectation/properties/outputs",
         "path_kind": "property"
       },
-      "purpose": "Requires two-record probing so collection results distinguish one match from ambiguity.",
+      "purpose": "Maps integration output names to the synthetic values expected after fixture execution.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46279,87 +44625,80 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "probe_two"
+          "keyword": "maxProperties",
+          "value": 64
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/httpResponse/properties/shape/oneOf/1/properties/records",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Selects the canonical response location containing collection records.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46368,89 +44707,82 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
+          "keyword": "required",
+          "value": [
+            "file"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/canonicalization",
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody/oneOf/0/properties/file",
         "path_kind": "property"
       },
-      "purpose": "Selects the reviewed normalization rule applied before an input is compared, interpolated, or sent to a source.",
+      "purpose": "Selects a fixture-local synthetic body file beneath the reserved bodies directory.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46459,88 +44791,86 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "identity",
-            "ascii_lowercase"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 8
+        },
+        {
+          "keyword": "pattern",
+          "value": "^bodies/(?!\\.\\.?/)(?!.*(?:/)\\.\\.?/)(?!.*//).+$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/format",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Applies the full-date semantic format to a string-valued integration input.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46549,87 +44879,71 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "date"
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/maxLength",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody/oneOf/1/not",
+        "path_kind": "branch"
       },
-      "purpose": "Caps a string-valued integration input at 1,024 Unicode scalar values, deriving its conservative 4,096-byte UTF-8 ceiling.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46638,95 +44952,83 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 1024
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "file"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/maximum",
+        "schema": "fixture",
+        "pointer": "/$defs/interaction/properties/expect",
         "path_kind": "property"
       },
-      "purpose": "Sets the inclusive upper bound accepted for an integer-valued integration input.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Exact HTTP request shape the adapter must produce.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/request",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46735,95 +45037,88 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 9007199254740991
-        },
-        {
-          "keyword": "minimum",
-          "value": -9007199254740991
+          "keyword": "required",
+          "value": [
+            "method",
+            "path"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/request"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/minLength",
+        "schema": "fixture",
+        "pointer": "/$defs/interaction/properties/respond",
         "path_kind": "property"
       },
-      "purpose": "Sets the minimum character length accepted for a string-valued integration input.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Synthetic HTTP response or timeout returned to the adapter.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/response",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46832,80 +45127,63 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 16384
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/response"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/minimum",
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/body",
         "path_kind": "property"
       },
-      "purpose": "Sets the inclusive lower bound accepted for an integer-valued integration input.",
+      "purpose": "Defines the synthetic request body expectation or fixture-local file reference without reading a source.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/fixtureBody",
         "composed": false
       },
       "requiredness": "optional",
@@ -46914,13 +45192,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -46929,95 +45205,75 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 9007199254740991
-        },
-        {
-          "keyword": "minimum",
-          "value": -9007199254740991
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/pattern",
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/headers",
         "path_kind": "property"
       },
-      "purpose": "Constrains a string-valued integration input with the authored regular expression.",
+      "purpose": "States the synthetic request headers expected from one offline fixture interaction.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47026,93 +45282,80 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 16384
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "maxProperties",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/role",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/headers/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Declares how one typed authoring input participates in source lookup, selection, or result shaping.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47121,91 +45364,79 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "selector",
-            "parameter"
-          ]
+          "keyword": "maxLength",
+          "value": 8192
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/input/properties/type",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/headers/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Declares the closed scalar or array type accepted for one integration input.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/scalarType",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47214,87 +45445,75 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarType"
-      }
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/inputOrLiteral/oneOf/0",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/method",
+        "path_kind": "property"
       },
-      "purpose": "Reference to a declared integration input.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "States the synthetic request method expected from the offline integration fixture.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/inputReference",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47303,42 +45522,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -47346,57 +45555,46 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "input"
+            "GET",
+            "POST"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputReference"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/inputOrLiteral/oneOf/1",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/path",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "States the synthetic request path expected from the offline integration fixture.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "boolean",
-          "integer",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47405,42 +45603,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -47448,50 +45636,55 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/[^?#]*$"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/inputReference/properties/input",
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/query",
         "path_kind": "property"
       },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "States the synthetic query parameters expected from one offline fixture interaction.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47500,95 +45693,84 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
+          "keyword": "maxProperties",
+          "value": 64
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationRequestByteSize/oneOf/0",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/query/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array",
+          "boolean",
+          "integer",
+          "null",
+          "string"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47597,42 +45779,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -47640,36 +45812,27 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 1048576
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationRequestByteSize/oneOf/1",
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
+          "boolean",
+          "integer",
+          "null",
           "string"
         ],
         "composed": false
@@ -47680,13 +45843,11 @@
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
+      "environment_behavior": "environment_independent",
       "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47695,42 +45856,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -47741,30 +45892,31 @@
         "branch_has_no_authored_value"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,2}|10[0-1][0-9]|102[0-4])KiB|1MiB)$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "boolean",
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationResponseByteSize/oneOf/0",
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -47774,13 +45926,11 @@
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
+      "environment_behavior": "environment_independent",
       "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47789,42 +45939,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -47836,49 +45976,46 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 8388608
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "maxItems",
+          "value": 64
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationResponseByteSize/oneOf/1",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
+          "boolean",
+          "integer",
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47887,42 +46024,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -47930,33 +46057,35 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,2}|[1-7][0-9]{3}|80[0-9]{2}|81[0-8][0-9]|819[0-2])KiB|[1-8]MiB)$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "boolean",
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationSourceByteSize/oneOf/0",
+        "schema": "fixture",
+        "pointer": "/$defs/response/oneOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
@@ -47966,13 +46095,11 @@
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
+      "environment_behavior": "environment_independent",
       "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -47981,42 +46108,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -48028,49 +46145,46 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 16777216
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "status"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationSourceByteSize/oneOf/1",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/$defs/response/oneOf/0/properties/body",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Defines the synthetic response body returned by the offline fixture harness to the integration.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/fixtureBody",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48079,42 +46193,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -48122,33 +46226,28 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-5][0-9]{3}|16[0-2][0-9]{2}|163[0-7][0-9]|1638[0-4])KiB|(?:[1-9]|1[0-6])MiB)$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/limits/properties/calls",
+        "schema": "fixture",
+        "pointer": "/$defs/response/oneOf/0/properties/headers",
         "path_kind": "property"
       },
-      "purpose": "Caps the number of high-level source calls available to a script integration.",
+      "purpose": "Defines the synthetic HTTP response headers returned by the offline fixture harness.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
@@ -48158,13 +46257,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48173,95 +46270,80 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 16
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "maxProperties",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/limits/properties/deadline",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/$defs/response/oneOf/0/properties/headers/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Caps total integration execution time with a positive duration no greater than twenty seconds.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48270,54 +46352,46 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-9]{4}|20000)ms|(?:[1-9]|1[0-9]|20)s)$"
+          "keyword": "maxLength",
+          "value": 8192
         },
         {
           "keyword": "type",
@@ -48327,37 +46401,32 @@
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/limits/properties/request_bytes",
+        "schema": "fixture",
+        "pointer": "/$defs/response/oneOf/0/properties/status",
         "path_kind": "property"
       },
-      "purpose": "Maximum aggregate author-controlled request bytes for one execution, defaulting to 64 KiB and capped at 1 MiB. Use a positive byte integer or canonical KiB/MiB value.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Selects the synthetic HTTP status returned by the offline fixture harness.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/integrationRequestByteSize",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "schema_value": "64KiB"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48366,89 +46435,84 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationRequestByteSize"
-      }
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 599
+        },
+        {
+          "keyword": "minimum",
+          "value": 100
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/limits/properties/source_bytes",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/$defs/response/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Maximum aggregate source-response bytes for one execution, defaulting to 2 MiB and capped at 16 MiB. Use a positive byte integer or canonical KiB/MiB value.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/integrationSourceByteSize",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "schema_value": "2MiB"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48457,87 +46521,82 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationSourceByteSize"
-      }
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "timeout"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/notApplicable/properties/ambiguity",
+        "schema": "fixture",
+        "pointer": "/$defs/response/oneOf/1/properties/timeout",
         "path_kind": "property"
       },
-      "purpose": "Why the reviewed source contract cannot produce more than one matching record.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Records bounded synthetic timeout intent; offline execution returns the timeout outcome without waiting for the authored interval.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/notApplicableReason",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48546,99 +46605,78 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "rationale",
-            "request_fixture"
-          ]
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-9]{4}|20000)ms|(?:[1-9]|1[0-9]|20)s)$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/notApplicableReason"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/notApplicable/properties/subject_mismatch",
+        "schema": "fixture",
+        "pointer": "/properties/classification",
         "path_kind": "property"
       },
-      "purpose": "Why the reviewed response contract contains no identifier comparable with a requested selector.",
+      "purpose": "Declares that fixture data is synthetic and safe for offline testing.",
       "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/notApplicableReason",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "public",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48647,42 +46685,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -48693,52 +46721,40 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "rationale",
-            "request_fixture"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "synthetic"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/notApplicableReason"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/notApplicableReason/properties/rationale",
+        "schema": "fixture",
+        "pointer": "/properties/expect",
         "path_kind": "property"
       },
-      "purpose": "Why the named normally required outcome cannot occur for this source contract.",
+      "purpose": "Observable adapter result required for the scenario to pass.",
       "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/expectation",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48747,96 +46763,84 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 512
-        },
-        {
-          "keyword": "minLength",
-          "value": 24
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/expectation"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/notApplicableReason/properties/request_fixture",
+        "schema": "fixture",
+        "pointer": "/properties/input",
         "path_kind": "property"
       },
-      "purpose": "Fixture name containing the supporting bounded source request.",
+      "purpose": "Typed consultation inputs supplied to the adapter under test.",
       "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48845,96 +46849,87 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxProperties",
+          "value": 16
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/output/oneOf/0",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/properties/input/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Type, scalar bounds, and optional source pointer for one normalized scalar integration output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean",
+          "integer",
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/scalarOutput",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -48943,42 +46938,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -48986,56 +46971,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "type"
+            "string",
+            "boolean",
+            "integer",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutput"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/output/oneOf/1",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/properties/input/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "A recursively typed object output with a canonical byte ceiling and an always-closed field map.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/outputObject",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49044,42 +47020,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -49087,59 +47053,44 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "nullable",
-            "max_bytes",
-            "fields"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObject"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/output/oneOf/2",
-        "path_kind": "branch"
+        "schema": "fixture",
+        "pointer": "/properties/interactions",
+        "path_kind": "property"
       },
-      "purpose": "A recursively typed array output with canonical byte and item-count ceilings.",
+      "purpose": "Ordered upstream request and response exchanges expected during execution.",
       "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/outputArray",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49148,42 +47099,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -49191,58 +47132,52 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "nullable",
-            "max_bytes",
-            "max_items",
-            "items"
-          ]
+          "keyword": "maxItems",
+          "value": 16
+        },
+        {
+          "keyword": "minItems",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/outputArray"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputArray/properties/items",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/properties/interactions/items",
+        "path_kind": "array_item"
       },
-      "purpose": "A recursively closed structured output schema without a source pointer.",
+      "purpose": "One expected upstream request paired with its synthetic response.",
       "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/outputSchema",
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/interaction",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49251,86 +47186,88 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "expect",
+            "respond"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
       ],
-      "constraints": [],
       "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/outputSchema"
+        "schema": "fixture",
+        "pointer": "/$defs/interaction"
       }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputArray/properties/max_bytes",
+        "schema": "fixture",
+        "pointer": "/properties/name",
         "path_kind": "property"
       },
-      "purpose": "Caps the canonical serialized size of one structured output array.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Human-readable scenario name shown in test output.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "public",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49339,42 +47276,32 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
@@ -49385,49 +47312,47 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 65536
+          "keyword": "maxLength",
+          "value": 256
         },
         {
-          "keyword": "minimum",
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputArray/properties/max_items",
+        "schema": "fixture",
+        "pointer": "/properties/variables",
         "path_kind": "property"
       },
-      "purpose": "Caps the number of values released in one structured output array.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Named date values available to deterministic fixture interpolation.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49436,95 +47361,80 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 256
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "maxProperties",
+          "value": 16
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputArray/properties/nullable",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/properties/variables/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Declares whether the complete structured output array may be null.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49533,85 +47443,79 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "date"
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputArray/properties/type",
-        "path_kind": "property"
+        "schema": "fixture",
+        "pointer": "/properties/variables/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Selects the array form for a structured integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49620,87 +47524,78 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
+        "fixture_execution"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.fixture.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, outputs, and errors; fixtures must not contain copied personal or source data.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
       "consumers": [
         "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
         "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
-        "relay",
-        "notary",
         "compatibility",
         "documentation",
         "testing"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "array"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObject/properties/fields",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "",
+        "path_kind": "root"
       },
-      "purpose": "Declares the bounded closed map of fields released in one structured output object.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Defines a bounded, materialized entity that Relay can query without coupling the project to a specific source product.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "not_applicable",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49710,24 +47605,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -49735,19 +47628,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -49755,12 +47643,15 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 32
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "version",
+            "id",
+            "revision",
+            "primary_key",
+            "schema",
+            "materialization"
+          ]
         },
         {
           "keyword": "type",
@@ -49770,23 +47661,20 @@
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObject/properties/fields/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/const",
+        "path_kind": "property"
       },
-      "purpose": "Requiredness and recursive schema for one named field of a closed structured output object.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Requires one entity field to equal the single authored value supplied by this schema constraint.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/outputObjectField",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -49798,7 +47686,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49808,24 +47695,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -49833,64 +47718,41 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "required",
-            "schema"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
+        "generated_docs_never_load_country_values"
       ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObjectField"
-      }
+      "constraints": []
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObject/properties/fields/propertyNames",
-        "path_kind": "map_key"
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/enum",
+        "path_kind": "property"
       },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Restricts one entity field to the unique authored values listed by this schema constraint.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -49900,7 +47762,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -49910,24 +47771,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -49935,58 +47794,50 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
+          "keyword": "minItems",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObject/properties/max_bytes",
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/format",
         "path_kind": "property"
       },
-      "purpose": "Caps the canonical serialized size of one structured output object.",
+      "purpose": "Adds a reviewed semantic format constraint to one string-valued entity field.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -49998,7 +47849,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50008,24 +47858,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50033,19 +47881,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -50053,37 +47896,29 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 65536
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
+          "keyword": "const",
+          "value": "date"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObject/properties/nullable",
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/maxLength",
         "path_kind": "property"
       },
-      "purpose": "Declares whether the complete structured output object may be null.",
+      "purpose": "Caps the character length accepted for one string-valued entity field.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50095,7 +47930,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50105,24 +47939,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50130,47 +47962,52 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 65536
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObject/properties/type",
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/maximum",
         "path_kind": "property"
       },
-      "purpose": "Selects the closed object form for a structured integration output.",
+      "purpose": "Sets the inclusive upper numeric bound accepted for one entity field.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50182,7 +48019,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50192,24 +48028,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50217,19 +48051,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -50237,29 +48066,37 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "object"
+          "keyword": "maximum",
+          "value": 9007199254740991
+        },
+        {
+          "keyword": "minimum",
+          "value": -9007199254740991
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObjectField/properties/required",
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/minLength",
         "path_kind": "property"
       },
-      "purpose": "Declares whether a named field must be present in every released structured output object.",
+      "purpose": "Sets the minimum character length accepted for one string-valued entity field.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50271,7 +48108,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50281,24 +48117,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50306,48 +48140,52 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 65536
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObjectField/properties/schema",
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/minimum",
         "path_kind": "property"
       },
-      "purpose": "A recursively closed structured output schema without a source pointer.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Sets the inclusive lower numeric bound accepted for one entity field.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/outputSchema",
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50359,7 +48197,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50369,24 +48206,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50394,61 +48229,63 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/outputSchema"
-      }
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 9007199254740991
+        },
+        {
+          "keyword": "minimum",
+          "value": -9007199254740991
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputSchema/oneOf/0",
-        "path_kind": "branch"
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/pattern",
+        "path_kind": "property"
       },
-      "purpose": "Type and bounds for a scalar nested inside a structured output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Constrains a string-valued entity field with the authored regular expression.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/scalarOutputSchema",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50458,24 +48295,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50483,73 +48318,64 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type"
-          ]
+          "keyword": "maxLength",
+          "value": 1024
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutputSchema"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputSchema/oneOf/1",
-        "path_kind": "branch"
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/type",
+        "path_kind": "property"
       },
-      "purpose": "A recursively typed object output with a canonical byte ceiling and an always-closed field map.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Declares the closed scalar, array, or object type accepted for one entity field.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/outputObject",
+        "local_reference": "#/$defs/scalarType",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50559,24 +48385,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50584,76 +48408,52 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type",
-            "nullable",
-            "max_bytes",
-            "fields"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
+        "generated_docs_never_load_country_values"
       ],
+      "constraints": [],
       "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/outputObject"
+        "schema": "entity",
+        "pointer": "/$defs/scalarType"
       }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/outputSchema/oneOf/2",
-        "path_kind": "branch"
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema/properties/additionalProperties",
+        "path_kind": "property"
       },
-      "purpose": "A recursively typed array output with canonical byte and item-count ceilings.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Controls whether the entity object accepts fields outside its declared closed property set.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/outputArray",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50663,24 +48463,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50688,64 +48486,44 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "nullable",
-            "max_bytes",
-            "max_items",
-            "items"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": false
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/outputArray"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci",
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema/properties/properties",
         "path_kind": "property"
       },
-      "purpose": "Enables the bounded signed DCI search helper and declares its protocol and selector bindings.",
+      "purpose": "Maps every declared entity property name to its closed field schema.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50757,7 +48535,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50767,24 +48544,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50792,19 +48567,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -50812,18 +48582,12 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "profile",
-            "path",
-            "jwks_profile",
-            "sender",
-            "receiver",
-            "registry_type",
-            "record_type",
-            "locale",
-            "selectors"
-          ]
+          "keyword": "maxProperties",
+          "value": 256
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
@@ -50833,20 +48597,23 @@
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/jwks_profile",
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema/properties/properties/additionalProperties",
         "path_kind": "property"
       },
-      "purpose": "Selects the supported RSA signing-key-set profile used to verify signed DCI responses.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Bounded schema keywords supported for one scalar materialized field.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/fieldSchema",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50858,7 +48625,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50868,24 +48634,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50893,19 +48657,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -50913,29 +48672,40 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "rsa-signing-jwks-v1"
+          "keyword": "required",
+          "value": [
+            "type"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/locale",
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema/properties/properties/propertyNames",
         "path_kind": "property"
       },
-      "purpose": "Declares the language or locale tag carried by signed DCI search requests.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Portable lowercase record field name.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/propertyName",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -50947,7 +48717,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -50957,24 +48726,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -50982,19 +48749,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -51003,44 +48765,47 @@
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$"
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/propertyName"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/path",
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema/properties/required",
         "path_kind": "property"
       },
-      "purpose": "Declares the exact private source path used for signed DCI search requests.",
+      "purpose": "Lists the entity properties that every validated materialized record must contain.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51050,24 +48815,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51075,54 +48838,59 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^/[^?#]*$"
+          "keyword": "maxItems",
+          "value": 256
+        },
+        {
+          "keyword": "minItems",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/profile",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema/properties/required/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Selects the supported DCI search request profile used by the signed protocol helper.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Portable lowercase record field name.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/propertyName",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -51132,7 +48900,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51142,24 +48909,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51167,51 +48932,53 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "dci-search-v1"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/propertyName"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/receiver",
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Declares the signed DCI receiver identifier included in protocol requests.",
+      "purpose": "Declares the materialized entity record schema as an object.",
       "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -51221,7 +48988,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51231,24 +48997,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51256,19 +49020,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -51276,49 +49035,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/record_type",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "/$defs/scalarType/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Declares the record type requested through the signed DCI search profile.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51328,24 +49076,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51353,69 +49099,60 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "string",
+            "boolean",
+            "integer"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/registry_type",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "/$defs/scalarType/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Declares the registry type requested through the signed DCI search profile.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51425,24 +49162,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51450,57 +49185,55 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
+          "keyword": "maxItems",
+          "value": 2
         },
         {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "minItems",
+          "value": 2
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0",
+        "path_kind": "array_item"
       },
-      "purpose": "Maps every selector input to its signed DCI request field and response location.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -51512,7 +49245,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51522,24 +49254,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51547,54 +49277,44 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 8
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "enum",
+          "value": [
+            "string",
+            "boolean",
+            "integer"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "entity",
+        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1",
+        "path_kind": "array_item"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
       "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -51609,7 +49329,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51619,24 +49338,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51644,54 +49361,43 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "field",
-            "response_pointer"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "null"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/field",
+        "schema": "entity",
+        "pointer": "/properties/id",
         "path_kind": "property"
       },
-      "purpose": "Declares the signed DCI identifier field bound to one selector input.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Stable project-local identifier for the entity.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
@@ -51706,7 +49412,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51716,24 +49421,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51741,19 +49444,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -51761,39 +49459,39 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 160
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/response_pointer",
+        "schema": "entity",
+        "pointer": "/properties/materialization",
         "path_kind": "property"
       },
-      "purpose": "Selects the canonical signed-record response location used to recover one selector value.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Authored resource, refresh, and bounded recovery-set retention applied while building entity generations.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -51803,7 +49501,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -51813,24 +49510,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -51838,19 +49533,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -51858,130 +49548,37 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
+          "keyword": "required",
+          "value": [
+            "max_records",
+            "max_bytes",
+            "refresh",
+            "retain_generations"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/propertyNames",
-        "path_kind": "map_key"
-      },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/inputName",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/sender",
+        "schema": "entity",
+        "pointer": "/properties/materialization/properties/max_bytes",
         "path_kind": "property"
       },
-      "purpose": "Declares the signed DCI sender identifier included in protocol requests.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Maximum encoded size of one generation, up to 1 GiB, as bytes or a KiB/MiB quantity.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
+          "integer",
           "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "required",
       "null_behavior": "rejected",
@@ -51995,102 +49592,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutput/properties/format",
-        "path_kind": "property"
-      },
-      "purpose": "Applies the full-date semantic format to a string-valued integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -52100,24 +49601,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -52125,61 +49624,50 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "date"
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutput/properties/maxLength",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "/properties/materialization/properties/max_bytes/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Caps the character length produced for a string-valued integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -52189,24 +49677,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -52214,28 +49700,24 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 16384
+          "value": 1073741824
         },
         {
           "keyword": "minimum",
@@ -52249,34 +49731,33 @@
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutput/properties/maximum",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "/properties/materialization/properties/max_bytes/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Sets the inclusive upper bound produced for an integer-valued integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -52286,24 +49767,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -52311,57 +49790,49 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,5}|10[0-3][0-9]{4}|104[0-7][0-9]{3}|1048[0-4][0-9]{2}|10485[0-6][0-9]|104857[0-6])KiB|(?:[1-9][0-9]{0,2}|10[0-1][0-9]|102[0-4])MiB)$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutput/properties/minimum",
+        "schema": "entity",
+        "pointer": "/properties/materialization/properties/max_records",
         "path_kind": "property"
       },
-      "purpose": "Sets the inclusive lower bound produced for an integer-valued integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "purpose": "Maximum number of records allowed in one generation.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -52373,7 +49844,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -52383,24 +49853,22 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
@@ -52408,19 +49876,14 @@
         "editor_schemas",
         "project_build",
         "relay_config",
-        "notary_config",
-        "fixture_report",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "security",
         "privacy",
         "relay",
-        "notary",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
@@ -52429,11 +49892,11 @@
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 9223372036854775807
+          "value": 100000000
         },
         {
           "keyword": "minimum",
-          "value": -9223372036854775808
+          "value": 1
         },
         {
           "keyword": "type",
@@ -52443,111 +49906,22 @@
     },
     {
       "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutput/properties/type",
+        "schema": "entity",
+        "pointer": "/properties/materialization/properties/refresh",
         "path_kind": "property"
       },
-      "purpose": "Supported scalar type, optionally paired with null for nullable values.",
+      "purpose": "Refresh cadence as a canonical positive duration no greater than 30 days, or manual when an operator initiates every refresh.",
       "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/scalarType",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarType"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutput/properties/x-registry-source",
-        "path_kind": "property"
-      },
-      "purpose": "Selects the canonical source-response location from which the HTTP output is extracted.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -52559,7 +49933,6 @@
       "products": [
         "registryctl",
         "relay",
-        "notary",
         "editor",
         "docs"
       ],
@@ -52569,55656 +49942,72 @@
         "json_schema",
         "rust_deserialization",
         "cross_file_semantic",
-        "fixture_execution",
         "product_build"
       ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
         "registry_relay",
-        "registry_notary",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutputSchema/properties/format",
-        "path_kind": "property"
-      },
-      "purpose": "Applies the full-date semantic format to a string-valued field inside a structured integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "date"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutputSchema/properties/maxLength",
-        "path_kind": "property"
-      },
-      "purpose": "Caps the character length produced for a string-valued field inside a structured integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 16384
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutputSchema/properties/maximum",
-        "path_kind": "property"
-      },
-      "purpose": "Sets the inclusive upper bound produced for an integer-valued field inside a structured integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutputSchema/properties/minimum",
-        "path_kind": "property"
-      },
-      "purpose": "Sets the inclusive lower bound produced for an integer-valued field inside a structured integration output.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarOutputSchema/properties/type",
-        "path_kind": "property"
-      },
-      "purpose": "Supported scalar type, optionally paired with null for nullable values.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/scalarType",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarType"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarType/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarType/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 2
-        },
-        {
-          "keyword": "minItems",
-          "value": 2
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0",
-        "path_kind": "array_item"
-      },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1",
-        "path_kind": "array_item"
-      },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "null"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/allow",
-        "path_kind": "property"
-      },
-      "purpose": "Constrains source access to the explicitly reviewed method and path templates in this integration contract.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/allow/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "One read-only upstream method and path pattern the adapter may call.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/allowRule",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "method",
-            "path"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/allowRule"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/auth",
-        "path_kind": "property"
-      },
-      "purpose": "Declares the credential interface the source contract permits without embedding an environment credential value.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/credential",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/credential"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/product",
-        "path_kind": "property"
-      },
-      "purpose": "Names the source product whose version labels are classified by this integration contract.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/protocol",
-        "path_kind": "property"
-      },
-      "purpose": "Optional interoperable protocol profiles layered over the source transport.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/protocol",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/request_headers",
-        "path_kind": "property"
-      },
-      "purpose": "Lists the bounded source request header names available to the integration adapter.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 32
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/request_headers/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/response",
-        "path_kind": "property"
-      },
-      "purpose": "Defines the reviewed source response representation and optional byte bound.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/response/properties/format",
-        "path_kind": "property"
-      },
-      "purpose": "Selects JSON decoding or text handling for reviewed source responses.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "json",
-            "text"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/response/properties/max_bytes",
-        "path_kind": "property"
-      },
-      "purpose": "Maximum bytes accepted from one source response, defaulting to 512 KiB and capped at 8 MiB. Use a positive byte integer or canonical KiB/MiB value.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "string"
-        ],
-        "local_reference": "#/$defs/integrationResponseByteSize",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "schema_value": "512KiB"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationResponseByteSize"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/response_headers",
-        "path_kind": "property"
-      },
-      "purpose": "Lists the bounded source response header names available to the integration adapter.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 32
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/response_headers/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/source/properties/versions",
-        "path_kind": "property"
-      },
-      "purpose": "Source versions tested by the project and versions explicitly accepted as unverified.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/versions",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/versions"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/versionList/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/versions/anyOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "tested"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/versions/anyOf/0/properties/tested",
-        "path_kind": "property"
-      },
-      "purpose": "Requires at least one source product version to be classified as tested in this integration contract.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "minItems",
-          "value": 1
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/versions/anyOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "unverified"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/versions/anyOf/1/properties/unverified",
-        "path_kind": "property"
-      },
-      "purpose": "Requires at least one source product version to be classified as unverified in this integration contract.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "minItems",
-          "value": 1
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/versions/properties/tested",
-        "path_kind": "property"
-      },
-      "purpose": "Bounded list of source version labels.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/versionList",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 32
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/versionList"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/versions/properties/unverified",
-        "path_kind": "property"
-      },
-      "purpose": "Bounded list of source version labels.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/versionList",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 32
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/versionList"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/capability",
-        "path_kind": "property"
-      },
-      "purpose": "Exactly one bounded execution mechanism for the source adaptation.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/capability",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/capability"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/id",
-        "path_kind": "property"
-      },
-      "purpose": "Stable project-local identifier for the integration.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/stableId"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/input",
-        "path_kind": "property"
-      },
-      "purpose": "Typed selector and parameter inputs accepted by this integration.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 16
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/input/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "Type, validation, and canonicalization rules for one authored input.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/input",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "role",
-            "type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/input"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/input/propertyNames",
-        "path_kind": "map_key"
-      },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/inputName",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/limits",
-        "path_kind": "property"
-      },
-      "purpose": "Optional tighter resource limits for one integration execution.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/limits",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/limits"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/not_applicable",
-        "path_kind": "property"
-      },
-      "purpose": "Explicit rationale and request-fixture evidence for a normally required outcome that the source contract cannot produce.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/notApplicable",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/notApplicable"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs",
-        "path_kind": "property"
-      },
-      "purpose": "Named typed outputs, or a shorthand list of output names inferred by the authoring compiler.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "A bounded scalar or recursively closed structured schema for one normalized integration output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "local_reference": "#/$defs/output",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/output"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/propertyNames",
-        "path_kind": "map_key"
-      },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": true
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/inputName",
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1/not",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "matched",
-            "outcome"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 64
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/1/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/inputName",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/revision",
-        "path_kind": "property"
-      },
-      "purpose": "Monotonically increasing revision of this integration contract.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/source",
-        "path_kind": "property"
-      },
-      "purpose": "Optional source product metadata and transport policy; capabilities remain product-neutral.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/source",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "auth"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/source"
-      }
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/properties/version",
-        "path_kind": "property"
-      },
-      "purpose": "Integration authoring format version.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "public",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": 1
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "",
-        "path_kind": "root"
-      },
-      "purpose": "Defines one synthetic, deterministic integration scenario for offline adapter verification.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "classification",
-            "input",
-            "interactions",
-            "expect"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/expectation/properties/claims",
-        "path_kind": "property"
-      },
-      "purpose": "States the synthetic Notary claim outcomes expected after the reviewed Relay consultation behavior.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/expectation/properties/error",
-        "path_kind": "property"
-      },
-      "purpose": "States the bounded error identifier expected from a failing offline fixture.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/expectation/properties/outcome",
-        "path_kind": "property"
-      },
-      "purpose": "States whether the offline fixture is expected to match, find no match, or remain ambiguous.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "match",
-            "no_match",
-            "ambiguous"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/expectation/properties/outputs",
-        "path_kind": "property"
-      },
-      "purpose": "Maps integration output names to the synthetic values expected after fixture execution.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/fixtureBody/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "file"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/fixtureBody/oneOf/0/properties/file",
-        "path_kind": "property"
-      },
-      "purpose": "Selects a fixture-local synthetic body file beneath the reserved bodies directory.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 8
-        },
-        {
-          "keyword": "pattern",
-          "value": "^bodies/(?!\\.\\.?/)(?!.*(?:/)\\.\\.?/)(?!.*//).+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/fixtureBody/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/fixtureBody/oneOf/1/not",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "file"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef/oneOf/1/properties/id",
-        "path_kind": "property"
-      },
-      "purpose": "Names one authored claim requested by this fixture witness.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef/oneOf/1/properties/version",
-        "path_kind": "property"
-      },
-      "purpose": "Pins the requested claim to one authored claim-policy version.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedIdentifier/properties/scheme",
-        "path_kind": "property"
-      },
-      "purpose": "Names the authored identifier scheme selected by a consultation input mapping.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 96
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedIdentifier/properties/value",
-        "path_kind": "property"
-      },
-      "purpose": "Supplies the synthetic string value bound to this identifier scheme.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/claims",
-        "path_kind": "property"
-      },
-      "purpose": "Lists the authored claims evaluated by this synthetic request witness.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 64
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/claims/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "A requested claim ID, optionally pinned to one authored claim version.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object",
-          "string"
-        ],
-        "local_reference": "#/$defs/governedClaimRef",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/disclosure",
-        "path_kind": "property"
-      },
-      "purpose": "Selects the disclosure mode requested from the authored claim policy.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/format",
-        "path_kind": "property"
-      },
-      "purpose": "Selects the claim-result media type requested from the governed Notary path.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/purpose",
-        "path_kind": "property"
-      },
-      "purpose": "Names the authored service purpose exercised by this synthetic request witness.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/requester",
-        "path_kind": "property"
-      },
-      "purpose": "Supplies a synthetic authenticated requester when selected consultation mappings read requester identifiers.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/governedTarget",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/target",
-        "path_kind": "property"
-      },
-      "purpose": "The synthetic subject target presented to the governed offline fixture boundary.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/governedTarget",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/variables",
-        "path_kind": "property"
-      },
-      "purpose": "Supplies synthetic date variables to the governed evaluation request.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 16
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/variables/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "date"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/variables/propertyNames",
-        "path_kind": "map_key"
-      },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/attributes",
-        "path_kind": "property"
-      },
-      "purpose": "Supplies independently authored typed target attributes for consultation input mapping.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 16
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/attributes/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "boolean",
-          "integer",
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "boolean",
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/id",
-        "path_kind": "property"
-      },
-      "purpose": "Supplies an optional synthetic direct target identifier.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/identifiers",
-        "path_kind": "property"
-      },
-      "purpose": "Supplies independently authored synthetic identifiers for consultation input mapping.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/identifiers/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "One synthetic target identifier with an authored scheme and string value.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/governedIdentifier",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "scheme",
-            "value"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedIdentifier"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/type",
-        "path_kind": "property"
-      },
-      "purpose": "Names the authored target entity type used for claim evaluation.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 64
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/interaction/properties/expect",
-        "path_kind": "property"
-      },
-      "purpose": "Exact HTTP request shape the adapter must produce.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/request",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "method",
-            "path"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/request"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/interaction/properties/respond",
-        "path_kind": "property"
-      },
-      "purpose": "Synthetic HTTP response or timeout returned to the adapter.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/response",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/response"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/body",
-        "path_kind": "property"
-      },
-      "purpose": "Defines the synthetic request body expectation or fixture-local file reference without reading a source.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/fixtureBody",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/fixtureBody"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/headers",
-        "path_kind": "property"
-      },
-      "purpose": "States the synthetic request headers expected from one offline fixture interaction.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 32
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/headers/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 8192
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/headers/propertyNames",
-        "path_kind": "map_key"
-      },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/method",
-        "path_kind": "property"
-      },
-      "purpose": "States the synthetic request method expected from the offline integration fixture.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "GET",
-            "POST"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/path",
-        "path_kind": "property"
-      },
-      "purpose": "States the synthetic request path expected from the offline integration fixture.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^/[^?#]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/query",
-        "path_kind": "property"
-      },
-      "purpose": "States the synthetic query parameters expected from one offline fixture interaction.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/query/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "array",
-          "boolean",
-          "integer",
-          "null",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "boolean",
-          "integer",
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "boolean",
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 64
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "boolean",
-          "integer",
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "boolean",
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "status"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0/properties/body",
-        "path_kind": "property"
-      },
-      "purpose": "Defines the synthetic response body returned by the offline fixture harness to the integration.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/fixtureBody",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/fixtureBody"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0/properties/headers",
-        "path_kind": "property"
-      },
-      "purpose": "Defines the synthetic HTTP response headers returned by the offline fixture harness.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 32
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0/properties/headers/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 8192
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0/properties/status",
-        "path_kind": "property"
-      },
-      "purpose": "Selects the synthetic HTTP status returned by the offline fixture harness.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 599
-        },
-        {
-          "keyword": "minimum",
-          "value": 100
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "timeout"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/1/properties/timeout",
-        "path_kind": "property"
-      },
-      "purpose": "Records bounded synthetic timeout intent; offline execution returns the timeout outcome without waiting for the authored interval.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-9]{4}|20000)ms|(?:[1-9]|1[0-9]|20)s)$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/classification",
-        "path_kind": "property"
-      },
-      "purpose": "Declares that fixture data is synthetic and safe for offline testing.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "public",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "synthetic"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/expect",
-        "path_kind": "property"
-      },
-      "purpose": "Observable adapter result required for the scenario to pass.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/expectation",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/expectation"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/input",
-        "path_kind": "property"
-      },
-      "purpose": "Typed consultation inputs supplied to the adapter under test.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 16
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/input/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "boolean",
-          "integer",
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "boolean",
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/input/propertyNames",
-        "path_kind": "map_key"
-      },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/interactions",
-        "path_kind": "property"
-      },
-      "purpose": "Ordered upstream request and response exchanges expected during execution.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/interactions/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "One expected upstream request paired with its synthetic response.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/interaction",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "expect",
-            "respond"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/interaction"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/name",
-        "path_kind": "property"
-      },
-      "purpose": "Human-readable scenario name shown in test output.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "public",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/request",
-        "path_kind": "property"
-      },
-      "purpose": "Optional independently authored synthetic Notary request used to prove the request-to-consultation binding before Relay access.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/governedRequest",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "target",
-            "claims",
-            "purpose"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/variables",
-        "path_kind": "property"
-      },
-      "purpose": "Named date values available to deterministic fixture interpolation.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 16
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/variables/additionalProperties",
-        "path_kind": "map_value"
-      },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "date"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/variables/propertyNames",
-        "path_kind": "map_key"
-      },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "",
-        "path_kind": "root"
-      },
-      "purpose": "Defines a bounded, materialized entity that Relay can query without coupling the project to a specific source product.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "version",
-            "id",
-            "revision",
-            "primary_key",
-            "schema",
-            "materialization"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/const",
-        "path_kind": "property"
-      },
-      "purpose": "Requires one entity field to equal the single authored value supplied by this schema constraint.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/enum",
-        "path_kind": "property"
-      },
-      "purpose": "Restricts one entity field to the unique authored values listed by this schema constraint.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "minItems",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/format",
-        "path_kind": "property"
-      },
-      "purpose": "Adds a reviewed semantic format constraint to one string-valued entity field.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "date"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/maxLength",
-        "path_kind": "property"
-      },
-      "purpose": "Caps the character length accepted for one string-valued entity field.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 65536
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/maximum",
-        "path_kind": "property"
-      },
-      "purpose": "Sets the inclusive upper numeric bound accepted for one entity field.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 9007199254740991
-        },
-        {
-          "keyword": "minimum",
-          "value": -9007199254740991
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/minLength",
-        "path_kind": "property"
-      },
-      "purpose": "Sets the minimum character length accepted for one string-valued entity field.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 65536
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/minimum",
-        "path_kind": "property"
-      },
-      "purpose": "Sets the inclusive lower numeric bound accepted for one entity field.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 9007199254740991
-        },
-        {
-          "keyword": "minimum",
-          "value": -9007199254740991
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/pattern",
-        "path_kind": "property"
-      },
-      "purpose": "Constrains a string-valued entity field with the authored regular expression.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 1024
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/type",
-        "path_kind": "property"
-      },
-      "purpose": "Declares the closed scalar, array, or object type accepted for one entity field.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/scalarType",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/scalarType"
-      }
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/additionalProperties",
-        "path_kind": "property"
-      },
-      "purpose": "Controls whether the entity object accepts fields outside its declared closed property set.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": false
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/properties",
-        "path_kind": "property"
-      },
-      "purpose": "Maps every declared entity property name to its closed field schema.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 256
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/properties/additionalProperties",
-        "path_kind": "property"
-      },
-      "purpose": "Bounded schema keywords supported for one scalar materialized field.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/fieldSchema",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema"
-      }
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/properties/propertyNames",
-        "path_kind": "property"
-      },
-      "purpose": "Portable lowercase record field name.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/propertyName",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/propertyName"
-      }
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/required",
-        "path_kind": "property"
-      },
-      "purpose": "Lists the entity properties that every validated materialized record must contain.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 256
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/required/items",
-        "path_kind": "array_item"
-      },
-      "purpose": "Portable lowercase record field name.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/propertyName",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/propertyName"
-      }
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/type",
-        "path_kind": "property"
-      },
-      "purpose": "Declares the materialized entity record schema as an object.",
-      "purpose_source": "reviewed_override",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/scalarType/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/scalarType/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 2
-        },
-        {
-          "keyword": "minItems",
-          "value": 2
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0",
-        "path_kind": "array_item"
-      },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1",
-        "path_kind": "array_item"
-      },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "null"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/id",
-        "path_kind": "property"
-      },
-      "purpose": "Stable project-local identifier for the entity.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/stableId"
-      }
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization",
-        "path_kind": "property"
-      },
-      "purpose": "Authored resource, refresh, and bounded recovery-set retention applied while building entity generations.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "max_records",
-            "max_bytes",
-            "refresh",
-            "retain_generations"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/max_bytes",
-        "path_kind": "property"
-      },
-      "purpose": "Maximum encoded size of one generation, up to 1 GiB, as bytes or a KiB/MiB quantity.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/max_bytes/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 1073741824
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/max_bytes/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,5}|10[0-3][0-9]{4}|104[0-7][0-9]{3}|1048[0-4][0-9]{2}|10485[0-6][0-9]|104857[0-6])KiB|(?:[1-9][0-9]{0,2}|10[0-1][0-9]|102[0-4])MiB)$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/max_records",
-        "path_kind": "property"
-      },
-      "purpose": "Maximum number of records allowed in one generation.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 100000000
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/refresh",
-        "path_kind": "property"
-      },
-      "purpose": "Refresh cadence as a canonical positive duration no greater than 30 days, or manual when an operator initiates every refresh.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/refresh/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "manual"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/refresh/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,8}|1[0-9]{9}|2[0-4][0-9]{8}|25[0-8][0-9]{7}|259[0-1][0-9]{6}|2592000000)ms|(?:[1-9][0-9]{0,5}|1[0-9]{6}|2[0-4][0-9]{5}|25[0-8][0-9]{4}|259[0-1][0-9]{3}|2592000)s|(?:[1-9][0-9]{0,3}|[1-3][0-9]{4}|4[0-2][0-9]{3}|43[0-1][0-9]{2}|43200)m|(?:[1-9][0-9]{0,1}|[1-6][0-9]{2}|7[0-1][0-9]{1}|720)h|(?:[1-9][0-9]{0,0}|[1-2][0-9]{1}|30)d)$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/retain_generations",
-        "path_kind": "property"
-      },
-      "purpose": "Number of completed cache generations, including the active generation, retained as a bounded recovery set after successful publication. This does not make arbitrary retained generations selectable for rollback.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 16
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/primary_key",
-        "path_kind": "property"
-      },
-      "purpose": "Field whose value uniquely identifies each materialized record.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/stableId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/stableId"
-      }
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/revision",
-        "path_kind": "property"
-      },
-      "purpose": "Monotonically increasing revision of this entity definition.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/schema",
-        "path_kind": "property"
-      },
-      "purpose": "Closed JSON object schema for materialized records.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/objectSchema",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type",
-            "additionalProperties",
-            "required",
-            "properties"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema"
-      }
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/version",
-        "path_kind": "property"
-      },
-      "purpose": "Entity authoring format version.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "public",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": 1
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "",
-        "key_path": "",
-        "path_kind": "root"
-      },
-      "purpose": "Root configuration document. Parsed from YAML at startup.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_root_structural",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "server",
-            "catalog",
-            "auth",
-            "audit",
-            "datasets"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
-        "key_path": "datasets[].aggregates[].access.aggregate_only_execution",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
-        "key_path": "datasets[].entities[].aggregates[].access.aggregate_only_execution",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
-        "key_path": "datasets[].tables[].aggregates[].access.aggregate_only_execution",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].aggregates[].access.aggregate_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].entities[].aggregates[].access.aggregate_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].tables[].aggregates[].access.aggregate_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].aggregates[].access.metadata_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].entities[].aggregates[].access.metadata_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].tables[].aggregates[].access.metadata_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/access",
-        "key_path": "datasets[].aggregates[].access",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/access",
-        "key_path": "datasets[].entities[].aggregates[].access",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/access",
-        "key_path": "datasets[].tables[].aggregates[].access",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
-        "key_path": "datasets[].aggregates[].allowed_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].aggregates[].allowed_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AllowedFilter",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "ops"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AllowedFilter",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "ops"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AllowedFilter",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "ops"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
-        "key_path": "datasets[].aggregates[].default_group_by",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
-        "key_path": "datasets[].entities[].aggregates[].default_group_by",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
-        "key_path": "datasets[].tables[].aggregates[].default_group_by",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
-        "key_path": "datasets[].aggregates[].default_group_by[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
-        "key_path": "datasets[].entities[].aggregates[].default_group_by[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
-        "key_path": "datasets[].tables[].aggregates[].default_group_by[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/description",
-        "key_path": "datasets[].aggregates[].description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/description",
-        "key_path": "datasets[].entities[].aggregates[].description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/description",
-        "key_path": "datasets[].tables[].aggregates[].description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions",
-        "key_path": "datasets[].aggregates[].dimensions",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions",
-        "key_path": "datasets[].entities[].aggregates[].dimensions",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions",
-        "key_path": "datasets[].tables[].aggregates[].dimensions",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
-        "key_path": "datasets[].aggregates[].dimensions[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateDimensionConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateDimensionConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateDimensionConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
-        "key_path": "datasets[].aggregates[].disclosure_control",
-        "path_kind": "property"
-      },
-      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/DisclosureControlConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control",
-        "path_kind": "property"
-      },
-      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/DisclosureControlConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control",
-        "path_kind": "property"
-      },
-      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/DisclosureControlConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by",
-        "key_path": "datasets[].aggregates[].group_by",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by",
-        "key_path": "datasets[].entities[].aggregates[].group_by",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by",
-        "key_path": "datasets[].tables[].aggregates[].group_by",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
-        "key_path": "datasets[].aggregates[].group_by[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
-        "key_path": "datasets[].entities[].aggregates[].group_by[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
-        "key_path": "datasets[].tables[].aggregates[].group_by[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/id",
-        "key_path": "datasets[].aggregates[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate identifier within a resource.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateId"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/id",
-        "key_path": "datasets[].entities[].aggregates[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate identifier within a resource.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateId"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/id",
-        "key_path": "datasets[].tables[].aggregates[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate identifier within a resource.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateId"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators",
-        "key_path": "datasets[].aggregates[].indicators",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators",
-        "key_path": "datasets[].entities[].aggregates[].indicators",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators",
-        "key_path": "datasets[].tables[].aggregates[].indicators",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
-        "key_path": "datasets[].aggregates[].indicators[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateIndicatorConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "function",
-            "column",
-            "unit_measure"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
-        "key_path": "datasets[].entities[].aggregates[].indicators[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateIndicatorConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "function",
-            "column",
-            "unit_measure"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
-        "key_path": "datasets[].tables[].aggregates[].indicators[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateIndicatorConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "function",
-            "column",
-            "unit_measure"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins",
-        "key_path": "datasets[].aggregates[].joins",
-        "path_kind": "property"
-      },
-      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins",
-        "key_path": "datasets[].entities[].aggregates[].joins",
-        "path_kind": "property"
-      },
-      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins",
-        "key_path": "datasets[].tables[].aggregates[].joins",
-        "path_kind": "property"
-      },
-      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins/items",
-        "key_path": "datasets[].aggregates[].joins[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateJoinConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins/items",
-        "key_path": "datasets[].entities[].aggregates[].joins[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateJoinConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins/items",
-        "key_path": "datasets[].tables[].aggregates[].joins[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateJoinConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures",
-        "key_path": "datasets[].aggregates[].measures",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures",
-        "key_path": "datasets[].entities[].aggregates[].measures",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures",
-        "key_path": "datasets[].tables[].aggregates[].measures",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures/items",
-        "key_path": "datasets[].aggregates[].measures[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One measure inside an aggregate.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateMeasure",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "function",
-            "column"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures/items",
-        "key_path": "datasets[].entities[].aggregates[].measures[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One measure inside an aggregate.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateMeasure",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "function",
-            "column"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures/items",
-        "key_path": "datasets[].tables[].aggregates[].measures[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One measure inside an aggregate.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateMeasure",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "function",
-            "column"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
-        "key_path": "datasets[].aggregates[].required_filter_bindings",
-        "path_kind": "property"
-      },
-      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
-        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings",
-        "path_kind": "property"
-      },
-      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
-        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings",
-        "path_kind": "property"
-      },
-      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
-        "key_path": "datasets[].aggregates[].required_filter_bindings[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/RequiredFilterBindingConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
-        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/RequiredFilterBindingConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
-        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/RequiredFilterBindingConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters",
-        "key_path": "datasets[].aggregates[].required_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters",
-        "key_path": "datasets[].entities[].aggregates[].required_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters",
-        "key_path": "datasets[].tables[].aggregates[].required_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
-        "key_path": "datasets[].aggregates[].required_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
-        "key_path": "datasets[].entities[].aggregates[].required_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
-        "key_path": "datasets[].tables[].aggregates[].required_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/source_entity",
-        "key_path": "datasets[].aggregates[].source_entity",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/source_entity",
-        "key_path": "datasets[].entities[].aggregates[].source_entity",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/source_entity",
-        "key_path": "datasets[].tables[].aggregates[].source_entity",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/spatial",
-        "key_path": "datasets[].aggregates[].spatial",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "mode",
-            "dimension",
-            "geometry_entity",
-            "geometry_id_field",
-            "geometry_field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/spatial",
-        "key_path": "datasets[].entities[].aggregates[].spatial",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "mode",
-            "dimension",
-            "geometry_entity",
-            "geometry_id_field",
-            "geometry_field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/spatial",
-        "key_path": "datasets[].tables[].aggregates[].spatial",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "mode",
-            "dimension",
-            "geometry_entity",
-            "geometry_id_field",
-            "geometry_field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
-        "key_path": "datasets[].aggregates[].temporal_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
-        "key_path": "datasets[].entities[].aggregates[].temporal_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
-        "key_path": "datasets[].tables[].aggregates[].temporal_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/title",
-        "key_path": "datasets[].aggregates[].title",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/title",
-        "key_path": "datasets[].entities[].aggregates[].title",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/title",
-        "key_path": "datasets[].tables[].aggregates[].title",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
-        "key_path": "datasets[].aggregates[].dimensions[].codelist",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[].codelist",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[].codelist",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
-        "key_path": "datasets[].aggregates[].dimensions[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
-        "key_path": "datasets[].aggregates[].dimensions[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
-        "key_path": "datasets[].aggregates[].dimensions[].label",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[].label",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[].label",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
-        "key_path": "datasets[].aggregates[].indicators[].column",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].column",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].column",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
-        "key_path": "datasets[].aggregates[].indicators[].decimals",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].decimals",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].decimals",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
-        "key_path": "datasets[].aggregates[].indicators[].definition_uri",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].definition_uri",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].definition_uri",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
-        "key_path": "datasets[].aggregates[].indicators[].frequency",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].frequency",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].frequency",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
-        "key_path": "datasets[].aggregates[].indicators[].function",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateFunction",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].function",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateFunction",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].function",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateFunction",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
-        "key_path": "datasets[].aggregates[].indicators[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
-        "key_path": "datasets[].aggregates[].indicators[].label",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].label",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].label",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
-        "key_path": "datasets[].aggregates[].indicators[].unit_measure",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].unit_measure",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].unit_measure",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
-        "key_path": "datasets[].aggregates[].indicators[].unit_mult",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "int32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 2147483647
-        },
-        {
-          "keyword": "minimum",
-          "value": -2147483648
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].unit_mult",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "int32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 2147483647
-        },
-        {
-          "keyword": "minimum",
-          "value": -2147483648
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].unit_mult",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "int32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 2147483647
-        },
-        {
-          "keyword": "minimum",
-          "value": -2147483648
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
-        "key_path": "datasets[].aggregates[].joins[].relationship",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
-        "key_path": "datasets[].entities[].aggregates[].joins[].relationship",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
-        "key_path": "datasets[].tables[].aggregates[].joins[].relationship",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/column",
-        "key_path": "datasets[].aggregates[].measures[].column",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/column",
-        "key_path": "datasets[].entities[].aggregates[].measures[].column",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/column",
-        "key_path": "datasets[].tables[].aggregates[].measures[].column",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/function",
-        "key_path": "datasets[].aggregates[].measures[].function",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateFunction",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/function",
-        "key_path": "datasets[].entities[].aggregates[].measures[].function",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateFunction",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/function",
-        "key_path": "datasets[].tables[].aggregates[].measures[].function",
-        "path_kind": "property"
-      },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AggregateFunction",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/name",
-        "key_path": "datasets[].aggregates[].measures[].name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/name",
-        "key_path": "datasets[].entities[].aggregates[].measures[].name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/name",
-        "key_path": "datasets[].tables[].aggregates[].measures[].name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
-        "key_path": "datasets[].aggregates[].spatial.collection_id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
-        "key_path": "datasets[].entities[].aggregates[].spatial.collection_id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
-        "key_path": "datasets[].tables[].aggregates[].spatial.collection_id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
-        "key_path": "datasets[].aggregates[].spatial.dimension",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
-        "key_path": "datasets[].entities[].aggregates[].spatial.dimension",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
-        "key_path": "datasets[].tables[].aggregates[].spatial.dimension",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
-        "key_path": "datasets[].aggregates[].spatial.geometry_entity",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
-        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_entity",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
-        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_entity",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
-        "key_path": "datasets[].aggregates[].spatial.geometry_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
-        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
-        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
-        "key_path": "datasets[].aggregates[].spatial.geometry_id_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
-        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_id_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
-        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_id_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
-        "key_path": "datasets[].aggregates[].spatial.max_geometry_vertices",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
-        "key_path": "datasets[].entities[].aggregates[].spatial.max_geometry_vertices",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
-        "key_path": "datasets[].tables[].aggregates[].spatial.max_geometry_vertices",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].aggregates[].spatial.mode",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "admin_area"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].entities[].aggregates[].spatial.mode",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "admin_area"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].tables[].aggregates[].spatial.mode",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "admin_area"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].aggregates[].allowed_filters[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].entities[].api.allowed_filters[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].tables[].api.allowed_filters[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].aggregates[].allowed_filters[].ops",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].entities[].api.allowed_filters[].ops",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].tables[].api.allowed_filters[].ops",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].aggregates[].allowed_filters[].ops[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Filter operator opted into per field.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/FilterOp",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Filter operator opted into per field.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/FilterOp",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].entities[].api.allowed_filters[].ops[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Filter operator opted into per field.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/FilterOp",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Filter operator opted into per field.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/FilterOp",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].tables[].api.allowed_filters[].ops[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Filter operator opted into per field.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/FilterOp",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig/properties/fingerprint",
-        "key_path": "auth.api_keys[].fingerprint",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/CredentialFingerprintSchema",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "provider",
-              "name"
-            ],
-            [
-              "provider",
-              "path"
-            ]
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/CredentialFingerprintSchema"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig/properties/id",
-        "key_path": "auth.api_keys[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig/properties/scopes",
-        "key_path": "auth.api_keys[].scopes",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig/properties/scopes/items",
-        "key_path": "auth.api_keys[].scopes[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/claims",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims",
-        "path_kind": "property"
-      },
-      "purpose": "Claims released on success. Non-empty; at least one `required`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/claims/items",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "A single released claim. Exactly one of `source_field` or `expression`\nmust be set: a claim is either a direct source-field projection or a\nCEL-computed value.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ReleaseClaimConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/description",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/id",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Profile identifier, lower-kebab/snake (`^[a-z][a-z0-9_-]*$`). Globally\nunique with `version`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/purpose",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].purpose",
-        "path_kind": "property"
-      },
-      "purpose": "Data-purpose this profile is bound to. When the backing entity declares\n`governed_policy.permitted_purposes`, this must be a member.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/release_conditions",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "expression"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/release_scope",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].release_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Dataset-bound scope a caller must hold to invoke this release. The\nstable profile is exactly `<dataset_id>:identity_release`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/response",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].response",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ReleaseResponseConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseResponseConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/subject",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].subject",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ReleaseSubjectConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "source_field",
-            "id_type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseSubjectConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/title",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].title",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/version",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].version",
-        "path_kind": "property"
-      },
-      "purpose": "Profile version. Globally unique with `id`; no silent \"latest\".",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig/oneOf/0/properties/sink",
-        "key_path": "audit.sink",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "file",
-            "stdout",
-            "syslog"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig/oneOf/1/properties/path",
-        "key_path": "audit.path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig/oneOf/1/properties/rotate",
-        "key_path": "audit.rotate",
-        "path_kind": "property"
-      },
-      "purpose": "In-process rotation for the `file` audit sink.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/RotateConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "max_size_mb",
-            "max_files"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RotateConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/chain",
-        "key_path": "audit.chain",
-        "path_kind": "property"
-      },
-      "purpose": "Retains the compatibility switch in the authored contract; Relay audit envelopes remain integrity-chained regardless of this setting.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_audit_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/format",
-        "key_path": "audit.format",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AuditFormat",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "jsonl"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditFormat"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/hash_secret_env",
-        "key_path": "audit.hash_secret_env",
-        "path_kind": "property"
-      },
-      "purpose": "Name of the environment variable holding the per-deploy secret\nused to HMAC sensitive audit values (single-record primary keys,\nsensitive query parameters). Runtime startup fails closed when\nthis field is unset, empty, or points to a missing, empty, or\nweak secret. Direct middleware tests can opt into the explicit\nunkeyed dev-only hasher without using runtime config.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[^=\\x00]*[^=\\x00\\x09-\\x0D\\x20\\x85\\u00A0\\u1680\\u2000-\\u200A\\u2028\\u2029\\u202F\\u205F\\u3000][^=\\x00]*$"
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/include_health",
-        "key_path": "audit.include_health",
-        "path_kind": "property"
-      },
-      "purpose": "Include `/healthz` liveness probes in the audit stream. `/ready` is\nalways excluded because auditing it would advance the chain after its\nzero-backlog shipping check and self-invalidate the next probe.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/write_policy",
-        "key_path": "audit.write_policy",
-        "path_kind": "property"
-      },
-      "purpose": "Behavior when an audit record fails to write.\n\n`fail_closed` (default) fails the request with a stable error code so\nthat no request outcome is returned without a durable audit record.\n`availability_first` logs the failure and lets the request succeed for\ndeployments that explicitly accept best-effort audit durability.\nPer-route-family selection is out of scope; this is a single\ndeployment-wide policy.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AuditWritePolicySchema",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "availability_first",
-            "fail_closed",
-            "fail_closed_route_families"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditWritePolicySchema"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig/items",
-        "key_path": "consultation.audit_pseudonym_materials[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One public epoch id bound to one secret source reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AuditPseudonymMaterialConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "key_id",
-            "source"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/key_id",
-        "key_path": "consultation.audit_pseudonym_materials[].key_id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AuditPseudonymKeyIdSchema",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z0-9][a-z0-9._-]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymKeyIdSchema"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/source",
-        "key_path": "consultation.audit_pseudonym_materials[].source",
-        "path_kind": "property"
-      },
-      "purpose": "Closed v1 set of audit-pseudonym secret source providers.\n\nThe configured name is a reference only. Secret values cannot be embedded\nin this model and are loaded exactly once during runtime compilation.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AuditPseudonymSecretSourceConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "provider",
-            "name"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymSecretSourceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/name",
-        "key_path": "consultation.audit_pseudonym_materials[].source.name",
-        "path_kind": "property"
-      },
-      "purpose": "Portable environment-variable name used only as a secret reference.\n\nDebug output is redacted even though the name is not itself key material,\npreventing configuration diagnostics from disclosing secret topology.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AuditPseudonymSecretEnvironmentName",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymSecretEnvironmentName"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/provider",
-        "key_path": "consultation.audit_pseudonym_materials[].source.provider",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "environment"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/api_keys",
-        "key_path": "auth.api_keys",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/api_keys/items",
-        "key_path": "auth.api_keys[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One configured API key, identified by an id and a fingerprint reference.\nThe raw key never appears in config.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ApiKeyConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "fingerprint"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/failure_throttle",
-        "key_path": "auth.failure_throttle",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AuthFailureThrottleConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthFailureThrottleConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/mode",
-        "key_path": "auth.mode",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AuthMode",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "api_key",
-            "oidc"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthMode"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/oidc",
-        "key_path": "auth.oidc",
-        "path_kind": "property"
-      },
-      "purpose": "OIDC / OAuth2 resource-server configuration. The relay validates\nincoming bearer JWTs against a configured external IdP. No tokens\nare minted here.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "issuer",
-            "audiences"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthFailureThrottleConfig/properties/enabled",
-        "key_path": "auth.failure_throttle.enabled",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthFailureThrottleConfig/properties/max_failures",
-        "key_path": "auth.failure_throttle.max_failures",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthFailureThrottleConfig/properties/window_seconds",
-        "key_path": "auth.failure_throttle.window_seconds",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/authority_type",
-        "key_path": "catalog.authority_type",
-        "path_kind": "property"
-      },
-      "purpose": "BRegDCAT-AP: type IRI for the `foaf:Agent` publisher. When set, emits\n`dcterms:type` on the publisher node.\n\nBRegDCAT-AP 2.1.0 SHACL checks publisher type values against the ADMS\npublishertype scheme (`http://purl.org/adms/publishertype/...`).\nThe relay does not enforce a vocabulary: any IRI passes through.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_catalog_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/base_url",
-        "key_path": "catalog.base_url",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay catalog identity and public metadata exposed for governed discovery.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_catalog_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/default_spatial_coverage",
-        "key_path": "catalog.default_spatial_coverage",
-        "path_kind": "property"
-      },
-      "purpose": "BRegDCAT-AP: default `dcterms:spatial` IRI applied to datasets that\ndo not declare their own `spatial_coverage`. Typically an EU\nauthority country IRI under\n`http://publications.europa.eu/resource/authority/country/`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_catalog_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/participant_id",
-        "key_path": "catalog.participant_id",
-        "path_kind": "property"
-      },
-      "purpose": "Identifies the participant in catalog output; when omitted, Relay derives the participant identifier from the reviewed catalog base URL.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_catalog_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/publisher",
-        "key_path": "catalog.publisher",
-        "path_kind": "property"
-      },
-      "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_catalog_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/publisher_iri",
-        "key_path": "catalog.publisher_iri",
-        "path_kind": "property"
-      },
-      "purpose": "BRegDCAT-AP: identifier IRI for the `foaf:Agent` publisher. Use a\ncontrolled-vocabulary corporate body IRI when publishing strict\nBRegDCAT-AP.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_catalog_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/title",
-        "key_path": "catalog.title",
-        "path_kind": "property"
-      },
-      "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_catalog_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path",
-        "key_path": "config_trust.antirollback_state_path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_config_trust_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path",
-        "key_path": "config_trust.break_glass_override_path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_config_trust_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path",
-        "key_path": "config_trust.bundle_path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_config_trust_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path",
-        "key_path": "config_trust.trust_anchor_path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_config_trust_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence",
-        "key_path": "consultation.artifacts.evidence",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence/items",
-        "key_path": "consultation.artifacts.evidence[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One bounded, hash-pinned integration evidence file.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ConsultationEvidenceArtifactConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "class",
-            "path",
-            "sha256"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceArtifactConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs",
-        "key_path": "consultation.artifacts.integration_packs",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs/items",
-        "key_path": "consultation.artifacts.integration_packs[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One hash-pinned public contract or reviewed integration pack.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "path",
-            "hash",
-            "sha256"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings",
-        "key_path": "consultation.artifacts.private_bindings",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings/items",
-        "key_path": "consultation.artifacts.private_bindings[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One hash-pinned public contract or reviewed integration pack.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "path",
-            "hash",
-            "sha256"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts",
-        "key_path": "consultation.artifacts.public_contracts",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts/items",
-        "key_path": "consultation.artifacts.public_contracts[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One hash-pinned public contract or reviewed integration pack.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "path",
-            "hash",
-            "sha256"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts",
-        "key_path": "consultation.artifacts.rhai_scripts",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts/items",
-        "key_path": "consultation.artifacts.rhai_scripts[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One hash-pinned private binding or standalone Rhai script.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ConsultationArtifactReferenceConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "path",
-            "sha256"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactReferenceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/path",
-        "key_path": "consultation.artifacts.rhai_scripts[].path",
-        "path_kind": "property"
-      },
-      "purpose": "Normalized bundle-root-relative path.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/sha256",
-        "key_path": "consultation.artifacts.rhai_scripts[].sha256",
-        "path_kind": "property"
-      },
-      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/active_key_id",
-        "key_path": "consultation.bootstrap.active_key_id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/active_write_deadline_unix_ms",
-        "key_path": "consultation.bootstrap.active_write_deadline_unix_ms",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "int64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/audit_event_retention_ms",
-        "key_path": "consultation.bootstrap.audit_event_retention_ms",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "int64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/keyring_maintenance_database_url_env",
-        "key_path": "consultation.bootstrap.keyring_maintenance_database_url_env",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/keyring_reader_database_url_env",
-        "key_path": "consultation.bootstrap.keyring_reader_database_url_env",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/migration_database_url_env",
-        "key_path": "consultation.bootstrap.migration_database_url_env",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/owner_role",
-        "key_path": "consultation.bootstrap.owner_role",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/artifacts",
-        "key_path": "consultation.artifacts",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "public_contracts",
-            "integration_packs",
-            "private_bindings",
-            "evidence"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/audit_pseudonym_materials",
-        "key_path": "consultation.audit_pseudonym_materials",
-        "path_kind": "property"
-      },
-      "purpose": "Bounded startup catalog of audit-pseudonym material references.\n\nThe 1..=32 bound and cross-entry uniqueness are enforced by config\nvalidation and repeated by the material provider before loading secrets.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/AuditPseudonymMaterialCatalogConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/authorized_workload",
-        "key_path": "consultation.authorized_workload",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ConsultationWorkloadConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "audience",
-            "client_claim_selector",
-            "client_value",
-            "principal_id"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/bootstrap",
-        "key_path": "consultation.bootstrap",
-        "path_kind": "property"
-      },
-      "purpose": "Binds the product-owned first-install policy carried only by the verified consultation bundle; deployment renderers cannot reproduce it as command arguments.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "migration_database_url_env",
-            "owner_role",
-            "keyring_maintenance_database_url_env",
-            "keyring_reader_database_url_env",
-            "active_key_id",
-            "active_write_deadline_unix_ms",
-            "audit_event_retention_ms"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/source_credentials",
-        "key_path": "consultation.source_credentials",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "local_reference": "#/$defs/ConsultationSourceCredentialCatalogConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/state_plane",
-        "key_path": "consultation.state_plane",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ConsultationStatePlaneConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "database_url_env",
-            "chain_key_epoch_id",
-            "serving_fence_lock_key",
-            "audit_pseudonym_keyring_lock_key"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/class",
-        "key_path": "consultation.artifacts.evidence[].class",
-        "path_kind": "property"
-      },
-      "purpose": "Closed evidence classes understood by consultation source-plan v1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationEvidenceClassConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "conformance",
-            "negative_security",
-            "minimization"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceClassConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/path",
-        "key_path": "consultation.artifacts.evidence[].path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/sha256",
-        "key_path": "consultation.artifacts.evidence[].sha256",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig/items",
-        "key_path": "consultation.source_credentials[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Closed V1 source-credential provider configuration.\n\nEnvironment names are opaque references and are redacted from `Debug`.\nThere is deliberately no field capable of carrying an embedded username,\npassword, bearer token, or provider-specific extension.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ConsultationSourceCredentialConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "type",
-              "ref",
-              "generation",
-              "client_id_env",
-              "client_secret_env"
-            ],
-            [
-              "type",
-              "ref",
-              "generation",
-              "token_env"
-            ],
-            [
-              "type",
-              "ref",
-              "generation",
-              "username_env",
-              "password_env"
-            ],
-            [
-              "type",
-              "ref",
-              "generation",
-              "value_env"
-            ]
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/generation",
-        "key_path": "consultation.source_credentials[].generation",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/password_env",
-        "key_path": "consultation.source_credentials[].password_env",
-        "path_kind": "property"
-      },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/ref",
-        "key_path": "consultation.source_credentials[].ref",
-        "path_kind": "property"
-      },
-      "purpose": "Exact private-binding credential reference grammar.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationSourceCredentialReference",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialReference"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/type",
-        "key_path": "consultation.source_credentials[].type",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "api_key_header",
-            "api_key_query",
-            "basic",
-            "oauth_client_credentials",
-            "static_bearer"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/username_env",
-        "key_path": "consultation.source_credentials[].username_env",
-        "path_kind": "property"
-      },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/1/properties/token_env",
-        "key_path": "consultation.source_credentials[].token_env",
-        "path_kind": "property"
-      },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/2/properties/value_env",
-        "key_path": "consultation.source_credentials[].value_env",
-        "path_kind": "property"
-      },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_id_env",
-        "key_path": "consultation.source_credentials[].client_id_env",
-        "path_kind": "property"
-      },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_secret_env",
-        "key_path": "consultation.source_credentials[].client_secret_env",
-        "path_kind": "property"
-      },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/audit_pseudonym_keyring_lock_key",
-        "key_path": "consultation.state_plane.audit_pseudonym_keyring_lock_key",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "int64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/chain_key_epoch_id",
-        "key_path": "consultation.state_plane.chain_key_epoch_id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/database_url_env",
-        "key_path": "consultation.state_plane.database_url_env",
-        "path_kind": "property"
-      },
-      "purpose": "Portable environment-variable name that resolves the state-plane URL.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationDatabaseUrlEnvironmentName",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationDatabaseUrlEnvironmentName"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/root_certificate_path",
-        "key_path": "consultation.state_plane.root_certificate_path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/serving_fence_lock_key",
-        "key_path": "consultation.state_plane.serving_fence_lock_key",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "int64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
-        "key_path": "consultation.artifacts.integration_packs[].hash",
-        "path_kind": "property"
-      },
-      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
-        "key_path": "consultation.artifacts.private_bindings[].hash",
-        "path_kind": "property"
-      },
-      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
-        "key_path": "consultation.artifacts.public_contracts[].hash",
-        "path_kind": "property"
-      },
-      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
-        "key_path": "consultation.artifacts.integration_packs[].path",
-        "path_kind": "property"
-      },
-      "purpose": "Normalized bundle-root-relative path.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
-        "key_path": "consultation.artifacts.private_bindings[].path",
-        "path_kind": "property"
-      },
-      "purpose": "Normalized bundle-root-relative path.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
-        "key_path": "consultation.artifacts.public_contracts[].path",
-        "path_kind": "property"
-      },
-      "purpose": "Normalized bundle-root-relative path.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
-        "key_path": "consultation.artifacts.integration_packs[].sha256",
-        "path_kind": "property"
-      },
-      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
-        "key_path": "consultation.artifacts.private_bindings[].sha256",
-        "path_kind": "property"
-      },
-      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
-        "key_path": "consultation.artifacts.public_contracts[].sha256",
-        "path_kind": "property"
-      },
-      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig/properties/audience",
-        "key_path": "consultation.authorized_workload.audience",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_claim_selector",
-        "key_path": "consultation.authorized_workload.client_claim_selector",
-        "path_kind": "property"
-      },
-      "purpose": "Closed set of verified OAuth claims that may identify Registry Notary.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ConsultationClientClaimSelectorConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "azp",
-            "client_id"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationClientClaimSelectorConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_value",
-        "key_path": "consultation.authorized_workload.client_value",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig/properties/principal_id",
-        "key_path": "consultation.authorized_workload.principal_id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CorsConfig/properties/allowed_origins",
-        "key_path": "server.cors.allowed_origins",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CorsConfig/properties/allowed_origins/items",
-        "key_path": "server.cors.allowed_origins[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/name",
-        "key_path": "auth.api_keys[].fingerprint.name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/RuntimeEnvironmentNameSchema",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[^=\\x00]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RuntimeEnvironmentNameSchema"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/provider",
-        "key_path": "auth.api_keys[].fingerprint.provider",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "env",
-            "file"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/1/properties/path",
-        "key_path": "auth.api_keys[].fingerprint.path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CsvFormatConfig/properties/delimiter",
-        "key_path": "datasets[].tables[].source.format.csv.delimiter",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint8"
-        },
-        {
-          "keyword": "maximum",
-          "value": 255
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CsvFormatConfig/properties/header_row",
-        "key_path": "datasets[].tables[].source.format.csv.header_row",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/CsvFormatConfig/properties/quote",
-        "key_path": "datasets[].tables[].source.format.csv.quote",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint8"
-        },
-        {
-          "keyword": "maximum",
-          "value": 255
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/access_rights",
-        "key_path": "datasets[].access_rights",
-        "path_kind": "property"
-      },
-      "purpose": "Access rights classification, mirrors DCAT-AP `dcterms:accessRights`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/AccessRights",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "public",
-            "restricted",
-            "non_public"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AccessRights"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/aggregates",
-        "key_path": "datasets[].aggregates",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/aggregates/items",
-        "key_path": "datasets[].aggregates[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "description",
-            "disclosure_control"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/applicable_legislation",
-        "key_path": "datasets[].applicable_legislation",
-        "path_kind": "property"
-      },
-      "purpose": "DCAT-AP `dcatap:applicableLegislation` IRIs. This is evidence\npublished for standard consumers, not an application-specific\nauthorization or source-of-truth verdict.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/applicable_legislation/items",
-        "key_path": "datasets[].applicable_legislation[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/conforms_to",
-        "key_path": "datasets[].conforms_to",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/conforms_to/items",
-        "key_path": "datasets[].conforms_to[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/defaults",
-        "key_path": "datasets[].defaults",
-        "path_kind": "property"
-      },
-      "purpose": "Optional table defaults for reducing repetition within one dataset.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/DatasetDefaultsConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetDefaultsConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/description",
-        "key_path": "datasets[].description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/entities",
-        "key_path": "datasets[].entities",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/entities/items",
-        "key_path": "datasets[].entities[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/EntityConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "table",
-            "access",
-            "api"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/id",
-        "key_path": "datasets[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/DatasetId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetId"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/owner",
-        "key_path": "datasets[].owner",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/public_services",
-        "key_path": "datasets[].public_services",
-        "path_kind": "property"
-      },
-      "purpose": "CPSV public services that produce this dataset. Registry Relay emits\nthem as standard `cpsv:PublicService` nodes; consumers decide how to\ninterpret that evidence.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/public_services/items",
-        "key_path": "datasets[].public_services[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/PublicServiceConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "title"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/PublicServiceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/sensitivity",
-        "key_path": "datasets[].sensitivity",
-        "path_kind": "property"
-      },
-      "purpose": "Sensitivity classification. Operator-defined values cover common\npersonal and public dataset classifications in V1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/Sensitivity",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "public",
-            "internal",
-            "personal",
-            "confidential",
-            "secret"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/Sensitivity"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/spatial_coverage",
-        "key_path": "datasets[].spatial_coverage",
-        "path_kind": "property"
-      },
-      "purpose": "BRegDCAT-AP: `dct:spatial` IRI for this dataset. Overrides the\ncatalog-level `default_spatial_coverage` when set.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/status",
-        "key_path": "datasets[].status",
-        "path_kind": "property"
-      },
-      "purpose": "Publishes the dataset lifecycle status; when omitted, Relay emits its weakest lifecycle claim instead of inferring a stronger status.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "under_development",
-            "completed",
-            "deprecated",
-            "withdrawn"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/tables",
-        "key_path": "datasets[].tables",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/tables/items",
-        "key_path": "datasets[].tables[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One private storage table under a dataset.\n\nThe public API should not expose these ids. Entity config maps one\nresource into one domain resource, with optional field renaming and\nrelationship declarations.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ResourceConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "source",
-            "schema"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/title",
-        "key_path": "datasets[].title",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/update_frequency",
-        "key_path": "datasets[].update_frequency",
-        "path_kind": "property"
-      },
-      "purpose": "Update cadence; mirrors DCAT-AP `dcterms:accrualPeriodicity`. The\nV1 set is the codes used by the example plus the common alternates.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/UpdateFrequency",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "continuous",
-            "daily",
-            "weekly",
-            "termly",
-            "monthly",
-            "quarterly",
-            "annual",
-            "irregular",
-            "as_needed",
-            "unknown"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/UpdateFrequency"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetDefaultsConfig/properties/materialization",
-        "key_path": "datasets[].defaults.materialization",
-        "path_kind": "property"
-      },
-      "purpose": "How a configured private table is registered for query planning.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "snapshot"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetDefaultsConfig/properties/refresh",
-        "key_path": "datasets[].defaults.refresh",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "mode",
-              "interval"
-            ],
-            [
-              "mode"
-            ]
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig/properties/evidence",
-        "key_path": "deployment.evidence",
-        "path_kind": "property"
-      },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/DeploymentEvidenceConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig/properties/profile",
-        "key_path": "deployment.profile",
-        "path_kind": "property"
-      },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "local",
-            "hosted_lab",
-            "production",
-            "evidence_grade"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig/properties/waivers",
-        "key_path": "deployment.waivers",
-        "path_kind": "property"
-      },
-      "purpose": "Per-deployment waivers. Each names one finding id, a required operator\nreference, an optional summary, and a mandatory expiry date. Expired\nwaivers stop suppressing their finding and raise\n`deployment.waiver_expired`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig/properties/waivers/items",
-        "key_path": "deployment.waivers[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One declared waiver. `expires` is an ISO 8601 `YYYY-MM-DD` date; format is\nvalidated at load time. The reference and optional summary are validated by\nthe shared operations contract before either can reach posture or logs.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/DeploymentWaiverConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "finding",
-            "reference",
-            "expires"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/api_key_rotation",
-        "key_path": "deployment.evidence.api_key_rotation",
-        "path_kind": "property"
-      },
-      "purpose": "Operator asserts an API-key rotation process is in place.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path",
-        "key_path": "deployment.evidence.audit_ack_cursor_path",
-        "path_kind": "property"
-      },
-      "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. When set, the runtime reads it to\nobserve shipping freshness and surfaces it as posture shipping health;\nabsent, shipping health stays `unverified` and only the declared\nshipping target is reported.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs",
-        "key_path": "deployment.evidence.audit_ack_max_age_secs",
-        "path_kind": "property"
-      },
-      "purpose": "Optional freshness window in seconds for the ack cursor's `acked_at`\ntimestamp. Defaults to `DEFAULT_AUDIT_ACK_MAX_AGE` (900) when unset. A\nwindow without `audit_ack_cursor_path` is rejected at load, since a\nfreshness window is meaningless without a cursor to observe.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping",
-        "key_path": "deployment.evidence.audit_offhost_shipping",
-        "path_kind": "property"
-      },
-      "purpose": "Operator asserts audit records are shipped off-host (for example to a\nlog collector or SIEM) rather than relying solely on local retention.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/ingress_rate_limit",
-        "key_path": "deployment.evidence.ingress_rate_limit",
-        "path_kind": "property"
-      },
-      "purpose": "Operator asserts ingress rate limiting is enforced (for example by a\ngateway or reverse proxy in front of the relay).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/expires",
-        "key_path": "deployment.waivers[].expires",
-        "path_kind": "property"
-      },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/finding",
-        "key_path": "deployment.waivers[].finding",
-        "path_kind": "property"
-      },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/reference",
-        "key_path": "deployment.waivers[].reference",
-        "path_kind": "property"
-      },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/DeploymentWaiverReference",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverReference"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/summary",
-        "key_path": "deployment.waivers[].summary",
-        "path_kind": "property"
-      },
-      "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/DeploymentWaiverSummary",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverSummary"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method",
-        "key_path": "datasets[].aggregates[].disclosure_control.method",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.method",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.method",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
-        "key_path": "datasets[].aggregates[].disclosure_control.method[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.method[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.method[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
-        "key_path": "datasets[].aggregates[].disclosure_control.min_cell_size",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_cell_size",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_cell_size",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
-        "key_path": "datasets[].aggregates[].disclosure_control.min_group_size",
-        "path_kind": "property"
-      },
-      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_group_size",
-        "path_kind": "property"
-      },
-      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_group_size",
-        "path_kind": "property"
-      },
-      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
-        "key_path": "datasets[].aggregates[].disclosure_control.report_suppressed_rows",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.report_suppressed_rows",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.report_suppressed_rows",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
-        "key_path": "datasets[].aggregates[].disclosure_control.suppression",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/Suppression",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "mask",
-            "null",
-            "omit"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/Suppression"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.suppression",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/Suppression",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "mask",
-            "null",
-            "omit"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/Suppression"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.suppression",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/Suppression",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "mask",
-            "null",
-            "omit"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/Suppression"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/id",
-        "key_path": "metadata.ecosystem_binding.id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/version",
-        "key_path": "metadata.ecosystem_binding.version",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].entities[].access.aggregate_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig/properties/evidence_verification_scope",
-        "key_path": "datasets[].entities[].access.evidence_verification_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].entities[].access.metadata_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig/properties/read_scope",
-        "key_path": "datasets[].entities[].access.read_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions",
-        "key_path": "datasets[].entities[].api.allowed_expansions",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions/items",
-        "key_path": "datasets[].entities[].api.allowed_expansions[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/allowed_filters",
-        "key_path": "datasets[].entities[].api.allowed_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].entities[].api.allowed_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AllowedFilter",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "ops"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/default_limit",
-        "key_path": "datasets[].entities[].api.default_limit",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/governed_policy",
-        "key_path": "datasets[].entities[].api.governed_policy",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/max_limit",
-        "key_path": "datasets[].entities[].api.max_limit",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/require_purpose_header",
-        "key_path": "datasets[].entities[].api.require_purpose_header",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings",
-        "key_path": "datasets[].entities[].api.required_filter_bindings",
-        "path_kind": "property"
-      },
-      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the query.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings/items",
-        "key_path": "datasets[].entities[].api.required_filter_bindings[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/RequiredFilterBindingConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/required_filters",
-        "key_path": "datasets[].entities[].api.required_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Alternative fields that can satisfy the row-scope gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/required_filters/items",
-        "key_path": "datasets[].entities[].api.required_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/access",
-        "key_path": "datasets[].entities[].access",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/EntityAccessConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "metadata_scope",
-            "aggregate_scope",
-            "read_scope"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/aggregates",
-        "key_path": "datasets[].entities[].aggregates",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/aggregates/items",
-        "key_path": "datasets[].entities[].aggregates[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "description",
-            "disclosure_control"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/api",
-        "key_path": "datasets[].entities[].api",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/EntityApiConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "default_limit",
-            "max_limit"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles",
-        "key_path": "datasets[].entities[].attribute_release_profiles",
-        "path_kind": "property"
-      },
-      "purpose": "Governed identity attribute-release profiles attached to this entity.\nEach profile resolves exactly one subject and returns only the\nconfigured, minimised claims. Empty by default (feature opt-in).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles/items",
-        "key_path": "datasets[].entities[].attribute_release_profiles[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "A governed identity attribute-release profile. A profile is a\nprojection-limited, exactly-one-subject lookup that maps a configured set of\nsource fields (or CEL-computed expressions) into a minimised\nOIDC/UserInfo-style claim bundle. Every profile is purpose-bound and requires\na matching `data-purpose` at resolve time. Identified globally by the\n`(id, version)` pair; both are required path segments at resolve time.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AttributeReleaseProfile",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "version",
-            "purpose",
-            "release_scope",
-            "subject",
-            "claims"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/concept_uri",
-        "key_path": "datasets[].entities[].concept_uri",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/description",
-        "key_path": "datasets[].entities[].description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/fields",
-        "key_path": "datasets[].entities[].fields",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/fields/items",
-        "key_path": "datasets[].entities[].fields[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/EntityFieldConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/name",
-        "key_path": "datasets[].entities[].name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/relationships",
-        "key_path": "datasets[].entities[].relationships",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/relationships/items",
-        "key_path": "datasets[].entities[].relationships[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/EntityRelationshipConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "kind",
-            "target",
-            "foreign_key"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/spatial",
-        "key_path": "datasets[].entities[].spatial",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "geometry"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/table",
-        "key_path": "datasets[].entities[].table",
-        "path_kind": "property"
-      },
-      "purpose": "Resource identifier within a dataset.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ResourceId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceId"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/title",
-        "key_path": "datasets[].entities[].title",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/codelist",
-        "key_path": "datasets[].entities[].fields[].codelist",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/concept_uri",
-        "key_path": "datasets[].entities[].fields[].concept_uri",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/from",
-        "key_path": "datasets[].entities[].fields[].from",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/language",
-        "key_path": "datasets[].entities[].fields[].language",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/name",
-        "key_path": "datasets[].entities[].fields[].name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/sensitive",
-        "key_path": "datasets[].entities[].fields[].sensitive",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/unit",
-        "key_path": "datasets[].entities[].fields[].unit",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/concept_uri",
-        "key_path": "datasets[].entities[].relationships[].concept_uri",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/foreign_key",
-        "key_path": "datasets[].entities[].relationships[].foreign_key",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/kind",
-        "key_path": "datasets[].entities[].relationships[].kind",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/RelationshipKind",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "belongs_to",
-            "has_many",
-            "has_one"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RelationshipKind"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/name",
-        "key_path": "datasets[].entities[].relationships[].name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/target",
-        "key_path": "datasets[].entities[].relationships[].target",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/bbox_fields",
-        "key_path": "datasets[].entities[].spatial.bbox_fields",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/collection_id",
-        "key_path": "datasets[].entities[].spatial.collection_id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/datetime_field",
-        "key_path": "datasets[].entities[].spatial.datetime_field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/description",
-        "key_path": "datasets[].entities[].spatial.description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/geometry",
-        "key_path": "datasets[].entities[].spatial.geometry",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/SpatialGeometryConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "kind",
-              "field",
-              "crs"
-            ],
-            [
-              "kind",
-              "longitude_field",
-              "latitude_field",
-              "crs"
-            ]
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/max_bbox_degrees",
-        "key_path": "datasets[].entities[].spatial.max_bbox_degrees",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "number"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "double"
-        },
-        {
-          "keyword": "type",
-          "value": "number"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/max_geometry_vertices",
-        "key_path": "datasets[].entities[].spatial.max_geometry_vertices",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/title",
-        "key_path": "datasets[].entities[].spatial.title",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/codelist",
-        "key_path": "datasets[].tables[].schema.fields[].codelist",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/concept_uri",
-        "key_path": "datasets[].tables[].schema.fields[].concept_uri",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/language",
-        "key_path": "datasets[].tables[].schema.fields[].language",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/name",
-        "key_path": "datasets[].tables[].schema.fields[].name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/nullable",
-        "key_path": "datasets[].tables[].schema.fields[].nullable",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/sensitive",
-        "key_path": "datasets[].tables[].schema.fields[].sensitive",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/type",
-        "key_path": "datasets[].tables[].schema.fields[].type",
-        "path_kind": "property"
-      },
-      "purpose": "Physical type of a column. The set is fixed in V1; semantic types\nare carried via `concept_uri`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/FieldType",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "number",
-            "integer",
-            "boolean",
-            "date",
-            "timestamp"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldType"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/unit",
-        "key_path": "datasets[].tables[].schema.fields[].unit",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance",
-        "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance/items",
-        "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/max_source_age_seconds",
-        "key_path": "datasets[].entities[].api.governed_policy.max_source_age_seconds",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/minimum_assurance",
-        "key_path": "datasets[].entities[].api.governed_policy.minimum_assurance",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions",
-        "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions/items",
-        "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes",
-        "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes/items",
-        "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields",
-        "key_path": "datasets[].entities[].api.governed_policy.redaction_fields",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields/items",
-        "key_path": "datasets[].entities[].api.governed_policy.redaction_fields[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/require_consent",
-        "key_path": "datasets[].entities[].api.governed_policy.require_consent",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/require_legal_basis",
-        "key_path": "datasets[].entities[].api.governed_policy.require_legal_basis",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/trusted_context",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/GovernedTrustedContextConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/asserted_assurance",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.asserted_assurance",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/consent_ref",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.consent_ref",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/jurisdiction",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.jurisdiction",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/legal_basis_ref",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.legal_basis_ref",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/source_observed_age_seconds",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.source_observed_age_seconds",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/InstanceConfig/properties/environment",
-        "key_path": "instance.environment",
-        "path_kind": "property"
-      },
-      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_instance_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/InstanceConfig/properties/id",
-        "key_path": "instance.id",
-        "path_kind": "property"
-      },
-      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_instance_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/InstanceConfig/properties/jurisdiction",
-        "key_path": "instance.jurisdiction",
-        "path_kind": "property"
-      },
-      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_instance_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/InstanceConfig/properties/owner",
-        "key_path": "instance.owner",
-        "path_kind": "property"
-      },
-      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_instance_public",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/MetadataConfig/properties/ecosystem_binding",
-        "key_path": "metadata.ecosystem_binding",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/MetadataConfig/properties/source",
-        "key_path": "metadata.source",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/MetadataSourceConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "path"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/MetadataSourceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/MetadataSourceConfig/properties/digest",
-        "key_path": "metadata.source.digest",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/MetadataSourceConfig/properties/path",
-        "key_path": "metadata.source.path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allow_dev_insecure_fetch_urls",
-        "key_path": "auth.oidc.allow_dev_insecure_fetch_urls",
-        "path_kind": "property"
-      },
-      "purpose": "Development-only escape hatch that permits loopback HTTP issuer,\ndiscovery, and JWKS URLs. Private non-loopback networks and cloud\nmetadata endpoints remain denied by the platform fetch policy.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_algorithms",
-        "key_path": "auth.oidc.allowed_algorithms",
-        "path_kind": "property"
-      },
-      "purpose": "Signature algorithms accepted by the verifier. Defaults to\nRS256, ES256, EdDSA. HS\\* and `none` are intentionally absent\nfrom [`OidcAlgorithm`].",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_algorithms/items",
-        "key_path": "auth.oidc.allowed_algorithms[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "JWS signature algorithms accepted by the OIDC verifier. Symmetric\nalgorithms (`HS*`) and `none` are intentionally absent: shared-secret\nJWTs are unsafe between a resource server and an IdP, and `none`\ndisables verification entirely.\n\nYAML values are the canonical JWA `alg` strings (`RS256`, `ES256`,\n`EdDSA`), case-sensitive.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/OidcAlgorithm",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "RS256",
-            "ES256",
-            "EdDSA"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcAlgorithm"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_clients",
-        "key_path": "auth.oidc.allowed_clients",
-        "path_kind": "property"
-      },
-      "purpose": "Optional allowlist of client identifiers, matched against the\ntoken's `azp` (preferred) or `client_id` claim. Empty list\nmeans any client is accepted.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_clients/items",
-        "key_path": "auth.oidc.allowed_clients[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_token_types",
-        "key_path": "auth.oidc.allowed_token_types",
-        "path_kind": "property"
-      },
-      "purpose": "Accepted `typ` JOSE header values. Defaults to `JWT` and\n`at+jwt` (RFC 9068). ID tokens (`id+jwt`) are not access tokens\nand are rejected by default. Tokens without `typ` are rejected by\nthe shared verifier.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_token_types/items",
-        "key_path": "auth.oidc.allowed_token_types[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/audiences",
-        "key_path": "auth.oidc.audiences",
-        "path_kind": "property"
-      },
-      "purpose": "One or more accepted `aud` values. Tokens with no `aud`, or\nwhose `aud` does not intersect this list, are rejected.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/audiences/items",
-        "key_path": "auth.oidc.audiences[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/development_jwks_file",
-        "key_path": "auth.oidc.development_jwks_file",
-        "path_kind": "property"
-      },
-      "purpose": "Development-only public JWKS file loaded once into memory at startup.\nThis source is accepted only when `deployment.profile` is `local` and\nis mutually exclusive with `jwks_url` and `discovery_url`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/discovery_url",
-        "key_path": "auth.oidc.discovery_url",
-        "path_kind": "property"
-      },
-      "purpose": "OIDC discovery document URL\n(`.well-known/openid-configuration`). The JWKS URL is resolved\nfrom `jwks_uri` in the discovered document.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/issuer",
-        "key_path": "auth.oidc.issuer",
-        "path_kind": "property"
-      },
-      "purpose": "Issuer URL. Compared verbatim against the JWT `iss` claim.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/jwks_cache_ttl",
-        "key_path": "auth.oidc.jwks_cache_ttl",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/jwks_url",
-        "key_path": "auth.oidc.jwks_url",
-        "path_kind": "property"
-      },
-      "purpose": "JWKS endpoint. Exactly one JWKS source must be configured.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/leeway",
-        "key_path": "auth.oidc.leeway",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_claim",
-        "key_path": "auth.oidc.scope_claim",
-        "path_kind": "property"
-      },
-      "purpose": "JWT claim whose value carries scopes. Defaults to `scope`, the\nRFC 8693 / RFC 9068 space-separated form. Some IdPs use `scp`\nor `permissions`; the value may be a string, an array of strings,\nor an object keyed by scope name.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_map",
-        "key_path": "auth.oidc.scope_map",
-        "path_kind": "property"
-      },
-      "purpose": "Optional rename map: `external_scope -> internal_scope`. Applied\nafter parsing the scope claim, before scope-based access checks\nrun. Useful for adapting IdP role names (`role:foo`) to the\nrelay's `<dataset_id>:<level>` shape.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_map/additionalProperties",
-        "key_path": "auth.oidc.scope_map.*",
-        "path_kind": "map_value"
-      },
-      "purpose": "Each reviewed key is an external token scope and each value is the bounded Relay scope mapping granted for that exact token scope.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_oidc_scope_map_open_map",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys",
-        "key_path": "auth.oidc.scope_object_required_keys",
-        "path_kind": "property"
-      },
-      "purpose": "Keys that must be present inside object-valued role claim values\nbefore the role key is treated as an active scope. Object-valued\nclaims grant no scopes when this list is empty.\nThis is useful for IdPs such as Zitadel where role values are\nkeyed by organization id.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys/items",
-        "key_path": "auth.oidc.scope_object_required_keys[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/PostgresTableConfig/properties/name",
-        "key_path": "datasets[].tables[].source.table.name",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/PostgresTableConfig/properties/schema",
-        "key_path": "datasets[].tables[].source.table.schema",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/PublicServiceConfig/properties/description",
-        "key_path": "datasets[].public_services[].description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/PublicServiceConfig/properties/id",
-        "key_path": "datasets[].public_services[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/PublicServiceConfig/properties/title",
-        "key_path": "datasets[].public_services[].title",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval",
-        "key_path": "datasets[].defaults.refresh.interval",
-        "path_kind": "property"
-      },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval",
-        "key_path": "datasets[].tables[].refresh.interval",
-        "path_kind": "property"
-      },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].defaults.refresh.mode",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "interval",
-            "manual",
-            "mtime"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].tables[].refresh.mode",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "interval",
-            "manual",
-            "mtime"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/expression",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "cel"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/format",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].format",
-        "path_kind": "property"
-      },
-      "purpose": "Optional value format hint.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/locale",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].locale",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/name",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].name",
-        "path_kind": "property"
-      },
-      "purpose": "Released claim name (lower-snake).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/required",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].required",
-        "path_kind": "property"
-      },
-      "purpose": "Whether the claim must be present; a missing required claim denies.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/sensitivity",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].sensitivity",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "direct_identifier",
-            "personal",
-            "public",
-            "pseudonymous"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/source_field",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].source_field",
-        "path_kind": "property"
-      },
-      "purpose": "Source field projected into the claim. XOR with `expression`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseConditionsConfig/properties/expression",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression",
-        "path_kind": "property"
-      },
-      "purpose": "A single CEL expression evaluated over the subject's source projection.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ReleaseExpressionConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "cel"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseExpressionConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseExpressionConfig/properties/cel",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression.cel",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseExpressionConfig/properties/cel",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression.cel",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseResponseConfig/properties/include_source_metadata",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].response.include_source_metadata",
-        "path_kind": "property"
-      },
-      "purpose": "Whether to include profile-sourced metadata in the response body.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseSubjectConfig/properties/id_type",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].subject.id_type",
-        "path_kind": "property"
-      },
-      "purpose": "Accepted identifier type label.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseSubjectConfig/properties/source_field",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].subject.source_field",
-        "path_kind": "property"
-      },
-      "purpose": "Source field used to match the subject. Must be an exposed entity field.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
-        "key_path": "datasets[].aggregates[].required_filter_bindings[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
-        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
-        "key_path": "datasets[].entities[].api.required_filter_bindings[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
-        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].field",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
-        "key_path": "datasets[].aggregates[].required_filter_bindings[].source",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/RequiredFilterBindingSource",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "principal_id"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingSource"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
-        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].source",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/RequiredFilterBindingSource",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "principal_id"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingSource"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
-        "key_path": "datasets[].entities[].api.required_filter_bindings[].source",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/RequiredFilterBindingSource",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "principal_id"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingSource"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
-        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].source",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/RequiredFilterBindingSource",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "principal_id"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingSource"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].tables[].access.aggregate_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].tables[].access.metadata_scope",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters",
-        "key_path": "datasets[].tables[].api.allowed_filters",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].tables[].api.allowed_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AllowedFilter",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "ops"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/default_limit",
-        "key_path": "datasets[].tables[].api.default_limit",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/max_limit",
-        "key_path": "datasets[].tables[].api.max_limit",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/require_purpose_header",
-        "key_path": "datasets[].tables[].api.require_purpose_header",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/access",
-        "key_path": "datasets[].tables[].access",
-        "path_kind": "property"
-      },
-      "purpose": "Resource-level scope assignments. Private tables are not exposed as row\nresources in beta; row access is configured on public entities.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ResourceAccessConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "metadata_scope",
-            "aggregate_scope"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceAccessConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/aggregates",
-        "key_path": "datasets[].tables[].aggregates",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/aggregates/items",
-        "key_path": "datasets[].tables[].aggregates[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AggregateConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "description",
-            "disclosure_control"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/api",
-        "key_path": "datasets[].tables[].api",
-        "path_kind": "property"
-      },
-      "purpose": "Resource-level API knobs: per-field filter allowlist, limit caps,\nand the `Data-Purpose` requirement.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/ResourceApiConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "default_limit",
-            "max_limit"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/id",
-        "key_path": "datasets[].tables[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Resource identifier within a dataset.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/ResourceId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceId"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/materialization",
-        "key_path": "datasets[].tables[].materialization",
-        "path_kind": "property"
-      },
-      "purpose": "How a configured private table is registered for query planning.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "snapshot"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/primary_key",
-        "key_path": "datasets[].tables[].primary_key",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/refresh",
-        "key_path": "datasets[].tables[].refresh",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "mode",
-              "interval"
-            ],
-            [
-              "mode"
-            ]
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/schema",
-        "key_path": "datasets[].tables[].schema",
-        "path_kind": "property"
-      },
-      "purpose": "Declared resource schema. `strict` is the spec's `strict_schema`\nflag; on mismatch ingestion refuses to register the resource.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/SchemaConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "fields"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/SchemaConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/source",
-        "key_path": "datasets[].tables[].source",
-        "path_kind": "property"
-      },
-      "purpose": "Source plugin selection. Tagged on `type:` so HTTP, S3, or additional\ndatabase variants can land additively later.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/SourceConfig",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "type",
-              "connection_env"
-            ],
-            [
-              "type",
-              "path"
-            ]
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceFormatConfig/properties/csv",
-        "key_path": "datasets[].tables[].source.format.csv",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceFormatConfig/properties/parquet",
-        "key_path": "datasets[].tables[].source.format.parquet",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceFormatConfig/properties/xlsx",
-        "key_path": "datasets[].tables[].source.format.xlsx",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RotateConfig/properties/max_files",
-        "key_path": "audit.rotate.max_files",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/RotateConfig/properties/max_size_mb",
-        "key_path": "audit.rotate.max_size_mb",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SchemaConfig/properties/fields",
-        "key_path": "datasets[].tables[].schema.fields",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SchemaConfig/properties/fields/items",
-        "key_path": "datasets[].tables[].schema.fields[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One column in a resource schema. Physical type and optional\nsemantic annotations used by catalog and schema metadata.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/FieldConfig",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SchemaConfig/properties/strict",
-        "key_path": "datasets[].tables[].schema.strict",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/admin_bind",
-        "key_path": "server.admin_bind",
-        "path_kind": "property"
-      },
-      "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": [
-            "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$",
-            "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/bind",
-        "key_path": "server.bind",
-        "path_kind": "property"
-      },
-      "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/SocketAddr",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": [
-            "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$",
-            "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/SocketAddr"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/cache_dir",
-        "key_path": "server.cache_dir",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/cors",
-        "key_path": "server.cors",
-        "path_kind": "property"
-      },
-      "purpose": "CORS allowlist; default-deny per Section 17 item 7.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/CorsConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/CorsConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/http1_header_read_timeout",
-        "key_path": "server.http1_header_read_timeout",
-        "path_kind": "property"
-      },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/max_connections",
-        "key_path": "server.max_connections",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/max_source_file_bytes",
-        "key_path": "server.max_source_file_bytes",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/openapi_requires_auth",
-        "key_path": "server.openapi_requires_auth",
-        "path_kind": "property"
-      },
-      "purpose": "Keeps the configured OpenAPI document behind Relay authentication unless an operator explicitly accepts unauthenticated contract discovery.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/request_body_timeout",
-        "key_path": "server.request_body_timeout",
-        "path_kind": "property"
-      },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/request_timeout",
-        "key_path": "server.request_timeout",
-        "path_kind": "property"
-      },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/trust_proxy",
-        "key_path": "server.trust_proxy",
-        "path_kind": "property"
-      },
-      "purpose": "`X-Forwarded-For` policy. Until the `ipnet` crate lands in deps we\nkeep CIDR specs as strings and validate format in\n[`validate::run`].",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/TrustProxyConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/TrustProxyConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/xlsx_max_file_bytes",
-        "key_path": "server.xlsx_max_file_bytes",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/0/properties/format",
-        "key_path": "datasets[].tables[].source.format",
-        "path_kind": "property"
-      },
-      "purpose": "Storage table format override. If omitted, ingest infers the format\nfrom the source file extension.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/0/properties/path",
-        "key_path": "datasets[].tables[].source.path",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/0/properties/type",
-        "key_path": "datasets[].tables[].source.type",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "file",
-            "postgres"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/change_token_sql",
-        "key_path": "datasets[].tables[].source.change_token_sql",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/connect_timeout",
-        "key_path": "datasets[].tables[].source.connect_timeout",
-        "path_kind": "property"
-      },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/connection_env",
-        "key_path": "datasets[].tables[].source.connection_env",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_secret_reference",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/PostgresEnvironmentNameSchema",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/PostgresEnvironmentNameSchema"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/query",
-        "key_path": "datasets[].tables[].source.query",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/query_timeout",
-        "key_path": "datasets[].tables[].source.query_timeout",
-        "path_kind": "property"
-      },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/table",
-        "key_path": "datasets[].tables[].source.table",
-        "path_kind": "property"
-      },
-      "purpose": "Structured database table reference. Keeping schema/name separate\navoids parsing dotted identifiers and leaves quoting to connectors.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
+        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
+        "privacy",
         "relay",
+        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "schema",
-            "name"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_x",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "/properties/materialization/properties/refresh/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
+        "registryctl",
         "relay",
+        "editor",
         "docs"
       ],
       "availability": "published",
@@ -108226,74 +50015,81 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "operator_preflight"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
+        "registryctl_authoring",
         "registry_relay",
+        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
+        "privacy",
         "relay",
+        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "manual"
         }
       ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_x",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "/properties/materialization/properties/refresh/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
       "products": [
+        "registryctl",
         "relay",
+        "editor",
         "docs"
       ],
       "availability": "published",
@@ -108301,38 +50097,49 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "operator_preflight"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
+        "registryctl_authoring",
         "registry_relay",
+        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
+        "privacy",
         "relay",
+        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,8}|1[0-9]{9}|2[0-4][0-9]{8}|25[0-8][0-9]{7}|259[0-1][0-9]{6}|2592000000)ms|(?:[1-9][0-9]{0,5}|1[0-9]{6}|2[0-4][0-9]{5}|25[0-8][0-9]{4}|259[0-1][0-9]{3}|2592000)s|(?:[1-9][0-9]{0,3}|[1-3][0-9]{4}|4[0-2][0-9]{3}|43[0-1][0-9]{2}|43200)m|(?:[1-9][0-9]{0,1}|[1-6][0-9]{2}|7[0-1][0-9]{1}|720)h|(?:[1-9][0-9]{0,0}|[1-2][0-9]{1}|30)d)$"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -108341,34 +50148,34 @@
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
-        "key_path": "datasets[].entities[].spatial.bbox_fields.max_x",
+        "schema": "entity",
+        "pointer": "/properties/materialization/properties/retain_generations",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Number of completed cache generations, including the active generation, retained as a bounded recovery set after successful publication. This does not make arbitrary retained generations selectable for rollback.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
+      "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "runtime",
+      "state": "authored",
       "products": [
+        "registryctl",
         "relay",
+        "editor",
         "docs"
       ],
       "availability": "published",
@@ -108376,74 +50183,89 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "operator_preflight"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
+        "registryctl_authoring",
         "registry_relay",
+        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
+        "privacy",
         "relay",
+        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 16
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_x",
+        "schema": "entity",
+        "pointer": "/properties/primary_key",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Field whose value uniquely identifies each materialized record.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
+      "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "runtime",
+      "state": "authored",
       "products": [
+        "registryctl",
         "relay",
+        "editor",
         "docs"
       ],
       "availability": "published",
@@ -108451,74 +50273,88 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "operator_preflight"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
+        "registryctl_authoring",
         "registry_relay",
+        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
+        "privacy",
         "relay",
+        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_y",
+        "schema": "entity",
+        "pointer": "/properties/revision",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Monotonically increasing revision of this entity definition.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
+      "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "runtime",
+      "state": "authored",
       "products": [
+        "registryctl",
         "relay",
+        "editor",
         "docs"
       ],
       "availability": "published",
@@ -108526,74 +50362,89 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "operator_preflight"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
+        "registryctl_authoring",
         "registry_relay",
+        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
+        "privacy",
         "relay",
+        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_y",
+        "schema": "entity",
+        "pointer": "/properties/schema",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Closed JSON object schema for materialized records.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/objectSchema",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
+      "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
-      "state": "runtime",
+      "state": "authored",
       "products": [
+        "registryctl",
         "relay",
+        "editor",
         "docs"
       ],
       "availability": "published",
@@ -108601,74 +50452,91 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "operator_preflight"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
+        "registryctl_authoring",
         "registry_relay",
+        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
+        "privacy",
         "relay",
+        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "type",
+            "additionalProperties",
+            "required",
+            "properties"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema"
+      }
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
-        "key_path": "datasets[].entities[].spatial.bbox_fields.max_y",
+        "schema": "entity",
+        "pointer": "/properties/version",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Entity authoring format version.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "public",
+      "state": "authored",
       "products": [
+        "registryctl",
         "relay",
+        "editor",
         "docs"
       ],
       "availability": "published",
@@ -108676,71 +50544,77 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "operator_preflight"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
+        "registryctl_authoring",
         "registry_relay",
+        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
+        "privacy",
         "relay",
+        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": 1
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_y",
-        "path_kind": "property"
+        "pointer": "",
+        "key_path": "",
+        "path_kind": "root"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Root configuration document. Parsed from YAML at startup.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_root_structural",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "not_applicable",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "relay",
@@ -108779,21 +50653,30 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "server",
+            "catalog",
+            "auth",
+            "audit",
+            "datasets"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_x",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
+        "key_path": "datasets[].aggregates[].access.aggregate_only_execution",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -108804,15 +50687,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -108860,15 +50744,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_x",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
+        "key_path": "datasets[].entities[].aggregates[].access.aggregate_only_execution",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -108879,15 +50763,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -108935,15 +50820,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
-        "key_path": "datasets[].entities[].spatial.bbox_fields.min_x",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
+        "key_path": "datasets[].tables[].aggregates[].access.aggregate_only_execution",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -108954,15 +50839,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109010,15 +50896,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_x",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].aggregates[].access.aggregate_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109029,15 +50915,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109085,15 +50973,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_y",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].entities[].aggregates[].access.aggregate_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109104,15 +50995,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109160,15 +51053,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_y",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].tables[].aggregates[].access.aggregate_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109179,15 +51075,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109235,15 +51133,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
-        "key_path": "datasets[].entities[].spatial.bbox_fields.min_y",
+        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].aggregates[].access.metadata_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109254,15 +51155,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109310,15 +51213,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_y",
+        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].entities[].aggregates[].access.metadata_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109329,15 +51235,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109385,15 +51293,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/crs",
-        "key_path": "datasets[].entities[].spatial.geometry.crs",
+        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].tables[].aggregates[].access.metadata_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109404,15 +51315,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109460,15 +51373,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/kind",
-        "key_path": "datasets[].entities[].spatial.geometry.kind",
+        "pointer": "/$defs/AggregateConfig/properties/access",
+        "key_path": "datasets[].aggregates[].access",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109479,15 +51395,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109534,25 +51452,99 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
+          "keyword": "type",
           "value": [
-            "geojson",
-            "point",
-            "wkb",
-            "wkt"
+            "null",
+            "object"
           ]
-        },
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/access",
+        "key_path": "datasets[].entities[].aggregates[].access",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "null",
+          "object"
+        ],
+        "composed": true
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/latitude_field",
-        "key_path": "datasets[].entities[].spatial.geometry.latitude_field",
+        "pointer": "/$defs/AggregateConfig/properties/access",
+        "key_path": "datasets[].tables[].aggregates[].access",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109563,15 +51555,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109619,15 +51613,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/longitude_field",
-        "key_path": "datasets[].entities[].spatial.geometry.longitude_field",
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
+        "key_path": "datasets[].aggregates[].allowed_filters",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109638,15 +51635,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109694,15 +51692,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/1/properties/field",
-        "key_path": "datasets[].entities[].spatial.geometry.field",
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -109713,15 +51711,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109769,35 +51768,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/dataset",
-        "key_path": "standards.spdci.disability_registry.dataset",
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters",
         "path_kind": "property"
       },
-      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/DatasetId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109843,45 +51842,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values",
-        "key_path": "standards.spdci.disability_registry.disabled_positive_values",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].aggregates[].allowed_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Case-insensitive values interpreted as disabled.",
+      "purpose": "A single allowed filter: field name + permitted operators.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109927,34 +51918,46 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field",
+            "ops"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values/items",
-        "key_path": "standards.spdci.disability_registry.disabled_positive_values[]",
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
@@ -110002,37 +52005,48 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field",
+            "ops"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_status_field",
-        "key_path": "standards.spdci.disability_registry.disabled_status_field",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Entity field whose value determines the SP DCI disabled response.",
+      "purpose": "A single allowed filter: field name + permitted operators.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110078,36 +52092,48 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field",
+            "ops"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/entity",
-        "key_path": "standards.spdci.disability_registry.entity",
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
+        "key_path": "datasets[].aggregates[].default_group_by",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110155,32 +52181,32 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_field",
-        "key_path": "standards.spdci.disability_registry.query_field",
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
+        "key_path": "datasets[].entities[].aggregates[].default_group_by",
         "path_kind": "property"
       },
-      "purpose": "Entity field filtered when the SP DCI query key is present.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -110231,38 +52257,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_key",
-        "key_path": "standards.spdci.disability_registry.query_key",
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
+        "key_path": "datasets[].tables[].aggregates[].default_group_by",
         "path_kind": "property"
       },
-      "purpose": "Query key accepted from SP DCI `disabled_criteria.query`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_sensitive",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -110297,32 +52323,30 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/dataset",
-        "key_path": "standards.spdci.registries.*.dataset",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
+        "key_path": "datasets[].aggregates[].default_group_by[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -110330,14 +52354,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/DatasetId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110383,45 +52406,36 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/default_limit",
-        "key_path": "standards.spdci.registries.*.default_limit",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
+        "key_path": "datasets[].entities[].aggregates[].default_group_by[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110467,34 +52481,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/entity",
-        "key_path": "standards.spdci.registries.*.entity",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
+        "key_path": "datasets[].tables[].aggregates[].default_group_by[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -110504,11 +52506,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110563,28 +52565,27 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields",
-        "key_path": "standards.spdci.registries.*.expression_fields",
+        "pointer": "/$defs/AggregateConfig/properties/description",
+        "key_path": "datasets[].aggregates[].description",
         "path_kind": "property"
       },
-      "purpose": "DCI expression or predicate attribute to entity field mappings.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110632,20 +52633,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields/additionalProperties",
-        "key_path": "standards.spdci.registries.*.expression_fields.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/AggregateConfig/properties/description",
+        "key_path": "datasets[].entities[].aggregates[].description",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names an expression-visible field and each value defines the bounded source expression exposed under that name.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_spdci_registries_expression_fields_open_map",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -110655,14 +52656,14 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -110702,7 +52703,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -110714,28 +52715,27 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers",
-        "key_path": "standards.spdci.registries.*.identifiers",
+        "pointer": "/$defs/AggregateConfig/properties/description",
+        "key_path": "datasets[].tables[].aggregates[].description",
         "path_kind": "property"
       },
-      "purpose": "DCI identifier type to entity field mappings for `idtype-value`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110783,37 +52783,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers/additionalProperties",
-        "key_path": "standards.spdci.registries.*.identifiers.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/AggregateConfig/properties/dimensions",
+        "key_path": "datasets[].aggregates[].dimensions",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names an identifier role and each value defines the exact request identifier binding for that role.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_spdci_registries_identifiers_open_map",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -110853,40 +52854,40 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/record_type",
-        "key_path": "standards.spdci.registries.*.record_type",
+        "pointer": "/$defs/AggregateConfig/properties/dimensions",
+        "key_path": "datasets[].entities[].aggregates[].dimensions",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110934,35 +52935,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/registry_type",
-        "key_path": "standards.spdci.registries.*.registry_type",
+        "pointer": "/$defs/AggregateConfig/properties/dimensions",
+        "key_path": "datasets[].tables[].aggregates[].dimensions",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111010,20 +53011,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields",
-        "key_path": "standards.spdci.registries.*.response_fields",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
+        "key_path": "datasets[].aggregates[].dimensions[]",
+        "path_kind": "array_item"
       },
-      "purpose": "SP DCI output path to entity field mappings for direct response\nprojection. A CEL mapping takes precedence when both are set.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -111031,14 +53032,14 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/AggregateDimensionConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111084,39 +53085,140 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "field"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields/additionalProperties",
-        "key_path": "standards.spdci.registries.*.response_fields.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Each reviewed key names a response field and each value defines the exact bounded response projection for that field.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_spdci_registries_response_fields_open_map",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateDimensionConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "field"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig"
+      }
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/AggregateDimensionConfig",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -111156,44 +53258,55 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/response_mapping_path",
-        "key_path": "standards.spdci.registries.*.response_mapping_path",
+        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
+        "key_path": "datasets[].aggregates[].disclosure_control",
         "path_kind": "property"
       },
-      "purpose": "Optional local CEL mapping document used to shape response records.",
+      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/DisclosureControlConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -111228,54 +53341,52 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/response_schema_path",
-        "key_path": "standards.spdci.registries.*.response_schema_path",
+        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control",
         "path_kind": "property"
       },
-      "purpose": "Optional local JSON Schema used to validate shaped response records.",
+      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/DisclosureControlConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -111310,51 +53421,49 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciStandardsConfig/properties/disability_registry",
-        "key_path": "standards.spdci.disability_registry",
+        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control",
         "path_kind": "property"
       },
-      "purpose": "Runtime binding from SP DCI Disability Registry sync APIs to one\nconfigured Registry Relay entity.",
+      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/DisclosureControlConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111400,38 +53509,32 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "dataset",
-            "entity"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciStandardsConfig/properties/registries",
-        "key_path": "standards.spdci.registries",
+        "pointer": "/$defs/AggregateConfig/properties/group_by",
+        "key_path": "datasets[].aggregates[].group_by",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
@@ -111439,8 +53542,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111488,38 +53591,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciStandardsConfig/properties/registries/additionalProperties",
-        "key_path": "standards.spdci.registries.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/AggregateConfig/properties/group_by",
+        "key_path": "datasets[].entities[].aggregates[].group_by",
+        "path_kind": "property"
       },
-      "purpose": "Runtime binding from a DCI registry sync search API to one configured\nRegistry Relay entity.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_spdci_registries_open_map",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/SpdciRegistryConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -111559,52 +53662,40 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "dataset",
-            "entity"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/StandardsConfig/properties/spdci",
-        "key_path": "standards.spdci",
+        "pointer": "/$defs/AggregateConfig/properties/group_by",
+        "key_path": "datasets[].tables[].aggregates[].group_by",
         "path_kind": "property"
       },
-      "purpose": "Social Protection Digital Convergence Initiative (SP DCI) adapter\nconfiguration.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111652,38 +53743,34 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/TrustProxyConfig/properties/enabled",
-        "key_path": "server.trust_proxy.enabled",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
+        "key_path": "datasets[].aggregates[].group_by[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111725,43 +53812,43 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies",
-        "key_path": "server.trust_proxy.trusted_proxies",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
+        "key_path": "datasets[].entities[].aggregates[].group_by[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -111796,33 +53883,30 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies/items",
-        "key_path": "server.trust_proxy.trusted_proxies[]",
+        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
+        "key_path": "datasets[].tables[].aggregates[].group_by[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -111838,8 +53922,8 @@
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -111874,14 +53958,11 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -111894,29 +53975,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/XlsxFormatConfig/properties/data_range",
-        "key_path": "datasets[].tables[].source.format.xlsx.data_range",
+        "pointer": "/$defs/AggregateConfig/properties/id",
+        "key_path": "datasets[].aggregates[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate identifier within a resource.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AggregateId",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111962,41 +54042,45 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/XlsxFormatConfig/properties/header_row",
-        "key_path": "datasets[].tables[].source.format.xlsx.header_row",
+        "pointer": "/$defs/AggregateConfig/properties/id",
+        "key_path": "datasets[].entities[].aggregates[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate identifier within a resource.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
+        "local_reference": "#/$defs/AggregateId",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112043,52 +54127,44 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
         },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/XlsxFormatConfig/properties/sheet",
-        "key_path": "datasets[].tables[].source.format.xlsx.sheet",
+        "pointer": "/$defs/AggregateConfig/properties/id",
+        "key_path": "datasets[].tables[].aggregates[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate identifier within a resource.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AggregateId",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112134,40 +54210,45 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/audit",
-        "key_path": "audit",
+        "pointer": "/$defs/AggregateConfig/properties/indicators",
+        "key_path": "datasets[].aggregates[].indicators",
         "path_kind": "property"
       },
-      "purpose": "Audit configuration. Sink choice gates further fields via the\ntagged `AuditSinkConfig` enum. The enum is flattened onto the\ncontaining struct so that the YAML `sink:` key acts as the\ndiscriminator, matching the public example configuration.\n\n`deny_unknown_fields` is deliberately omitted here: `serde` does\nnot support combining it with `#[serde(flatten)]` on an internally\ntagged enum (unknown keys in `audit` are caught by the enum's own\n`deny_unknown_fields`).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AuditConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112209,60 +54290,41 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "sink",
-              "path"
-            ],
-            [
-              "sink"
-            ]
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
-        },
-        {
-          "keyword": "unevaluatedProperties",
-          "value": false
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/auth",
-        "key_path": "auth",
+        "pointer": "/$defs/AggregateConfig/properties/indicators",
+        "key_path": "datasets[].entities[].aggregates[].indicators",
         "path_kind": "property"
       },
-      "purpose": "Authentication configuration. Exactly one of `api_keys` and `oidc`\nis consumed at startup, gated by `mode`; cross-field validation in\n[`validate`] enforces that only the active block is populated.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AuthConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112308,47 +54370,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "mode"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/catalog",
-        "key_path": "catalog",
+        "pointer": "/$defs/AggregateConfig/properties/indicators",
+        "key_path": "datasets[].tables[].aggregates[].indicators",
         "path_kind": "property"
       },
-      "purpose": "Catalog-level metadata surfaced by `/metadata/*` and DCAT outputs.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_catalog_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/CatalogConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112390,53 +54442,41 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "title",
-            "base_url",
-            "publisher"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/CatalogConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/config_trust",
-        "key_path": "config_trust",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
+        "key_path": "datasets[].aggregates[].indicators[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Optional signed configuration bundle trust state.\n\nSimple local deployments omit this block. Bundle-aware deployments pin the\nlocal trust anchor, bundle, and anti-rollback state paths explicitly.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_config_trust_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/AggregateIndicatorConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112478,52 +54518,55 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "trust_anchor_path",
-            "bundle_path",
-            "antirollback_state_path"
+            "id",
+            "label",
+            "function",
+            "column",
+            "unit_measure"
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/consultation",
-        "key_path": "consultation",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
+        "key_path": "datasets[].entities[].aggregates[].indicators[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/AggregateIndicatorConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112572,26 +54615,29 @@
         {
           "keyword": "required",
           "value": [
-            "authorized_workload",
-            "state_plane",
-            "audit_pseudonym_materials"
+            "id",
+            "label",
+            "function",
+            "column",
+            "unit_measure"
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/datasets",
-        "key_path": "datasets",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
+        "key_path": "datasets[].tables[].aggregates[].indicators[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -112601,15 +54647,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateIndicatorConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112655,20 +54702,34 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "function",
+            "column",
+            "unit_measure"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/datasets/items",
-        "key_path": "datasets[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/joins",
+        "key_path": "datasets[].aggregates[].joins",
+        "path_kind": "property"
       },
-      "purpose": "A single dataset declaration.",
+      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -112676,16 +54737,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/DatasetConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112731,46 +54792,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "title",
-            "description",
-            "owner",
-            "sensitivity",
-            "access_rights",
-            "update_frequency"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/deployment",
-        "key_path": "deployment",
+        "pointer": "/$defs/AggregateConfig/properties/joins",
+        "key_path": "datasets[].entities[].aggregates[].joins",
         "path_kind": "property"
       },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
+      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/DeploymentConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -112778,7 +54822,7 @@
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112826,32 +54870,27 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/instance",
-        "key_path": "instance",
+        "pointer": "/$defs/AggregateConfig/properties/joins",
+        "key_path": "datasets[].tables[].aggregates[].joins",
         "path_kind": "property"
       },
-      "purpose": "Stable deployment identity surfaced in redacted operations posture.",
+      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_instance_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/InstanceConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -112859,7 +54898,7 @@
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112901,45 +54940,41 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/InstanceConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/metadata",
-        "key_path": "metadata",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/joins/items",
+        "key_path": "datasets[].aggregates[].joins[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Optional split metadata manifest loaded alongside the runtime config.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_metadata_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/AggregateJoinConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112981,34 +55016,36 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "source"
+            "relationship"
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateJoinConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/server",
-        "key_path": "server",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/joins/items",
+        "key_path": "datasets[].entities[].aggregates[].joins[]",
+        "path_kind": "array_item"
       },
-      "purpose": "HTTP listener and adjacent server-wide knobs.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -113016,14 +55053,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ServerConfig",
+        "local_reference": "#/$defs/AggregateJoinConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -113065,13 +55102,14 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "bind"
+            "relationship"
           ]
         },
         {
@@ -113081,19 +55119,19 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig"
+        "pointer": "/$defs/AggregateJoinConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/standards",
-        "key_path": "standards",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/joins/items",
+        "key_path": "datasets[].tables[].aggregates[].joins[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -113101,15 +55139,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/StandardsConfig",
+        "local_reference": "#/$defs/AggregateJoinConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -113155,6 +55192,12 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "relationship"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
@@ -113162,25 +55205,25 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/StandardsConfig"
+        "pointer": "/$defs/AggregateJoinConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/vocabularies",
-        "key_path": "vocabularies",
+        "pointer": "/$defs/AggregateConfig/properties/measures",
+        "key_path": "datasets[].aggregates[].measures",
         "path_kind": "property"
       },
-      "purpose": "Controls the reviewed vocabulary bindings Relay uses to interpret namespaced terms.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_vocabularies_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
@@ -113188,8 +55231,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -113231,42 +55274,44 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/vocabularies/additionalProperties",
-        "key_path": "vocabularies.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/AggregateConfig/properties/measures",
+        "key_path": "datasets[].entities[].aggregates[].measures",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key is a vocabulary prefix and each value binds that prefix to its operator-approved vocabulary identifier.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_vocabularies_open_map",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -113306,45 +55351,46 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "",
-        "key_path": "",
-        "path_kind": "root"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/measures",
+        "key_path": "datasets[].tables[].aggregates[].measures",
+        "path_kind": "property"
       },
-      "purpose": "Defines the complete Notary runtime configuration boundary consumed when a Notary instance starts.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_root_structural",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113354,7 +55400,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -113364,69 +55410,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "evidence",
-            "auth"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/access_token_ttl_seconds",
-        "key_path": "auth.access_token_signing.access_token_ttl_seconds",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/measures/items",
+        "key_path": "datasets[].aggregates[].measures[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Access-token lifetime in seconds.",
+      "purpose": "One measure inside an aggregate.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateMeasure",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113436,7 +55476,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -113446,74 +55486,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "required",
+          "value": [
+            "name",
+            "function",
+            "column"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms",
-        "key_path": "auth.access_token_signing.allowed_algorithms",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/measures/items",
+        "key_path": "datasets[].entities[].aggregates[].measures[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Allowed signing algorithms. Only EdDSA is supported.",
+      "purpose": "One measure inside an aggregate.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateMeasure",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113523,7 +55564,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -113533,65 +55574,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name",
+            "function",
+            "column"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms/items",
-        "key_path": "auth.access_token_signing.allowed_algorithms[]",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/measures/items",
+        "key_path": "datasets[].tables[].aggregates[].measures[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One measure inside an aggregate.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateMeasure",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113601,7 +55652,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -113611,48 +55662,57 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name",
+            "function",
+            "column"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences",
-        "key_path": "auth.access_token_signing.audiences",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
+        "key_path": "datasets[].aggregates[].required_filter_bindings",
         "path_kind": "property"
       },
-      "purpose": "Audiences (`aud`) accepted for Notary-minted access tokens.",
+      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
@@ -113663,14 +55723,14 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113680,7 +55740,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -113690,26 +55750,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -113721,34 +55778,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences/items",
-        "key_path": "auth.access_token_signing.audiences[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
+        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113758,7 +55816,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -113768,66 +55826,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/enabled",
-        "key_path": "auth.access_token_signing.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
+        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      "default": {
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113837,7 +55892,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -113847,66 +55902,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/issuer",
-        "key_path": "auth.access_token_signing.issuer",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
+        "key_path": "datasets[].aggregates[].required_filter_bindings[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Issuer (`iss`) the Notary stamps into its own access tokens.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113916,7 +55968,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -113926,66 +55978,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/signing_key_id",
-        "key_path": "auth.access_token_signing.signing_key_id",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
+        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[]",
+        "path_kind": "array_item"
       },
-      "purpose": "`evidence.signing_keys` entry used to sign access tokens. Must be a\ndedicated key, never a credential-signing key.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -113995,7 +56054,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114005,66 +56064,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/token_typ",
-        "key_path": "auth.access_token_signing.token_typ",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
+        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Header `typ` stamped into Notary access tokens, distinct from the\ncredential `typ` so a token cannot be replayed as another class.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114074,7 +56140,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114084,48 +56150,55 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids",
-        "key_path": "auth.access_token_signing.verification_key_ids",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filters",
+        "key_path": "datasets[].aggregates[].required_filters",
         "path_kind": "property"
       },
-      "purpose": "Additional publish-only `evidence.signing_keys` entries accepted for\nverifying previously minted Notary access tokens and pre-authorized\ncodes during a governed key rotation.",
+      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
@@ -114136,14 +56209,14 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114153,7 +56226,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114163,26 +56236,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -114194,34 +56264,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids/items",
-        "key_path": "auth.access_token_signing.verification_key_ids[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filters",
+        "key_path": "datasets[].entities[].aggregates[].required_filters",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114231,7 +56302,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114241,51 +56312,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/BatchOperationConfig/properties/enabled",
-        "key_path": "evidence.claims[].operations.batch_evaluate.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filters",
+        "key_path": "datasets[].tables[].aggregates[].required_filters",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "array"
         ],
         "composed": false
       },
@@ -114300,7 +56368,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114310,7 +56378,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114320,18 +56388,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -114342,41 +56410,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/BatchOperationConfig/properties/max_subjects",
-        "key_path": "evidence.claims[].operations.batch_evaluate.max_subjects",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
+        "key_path": "datasets[].aggregates[].required_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114386,7 +56453,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114396,79 +56463,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "maximum",
-          "value": 100
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CccevConfig/properties/evidence_type",
-        "key_path": "evidence.claims[].cccev.evidence_type",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
+        "key_path": "datasets[].entities[].aggregates[].required_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114478,7 +56528,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114488,18 +56538,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -114510,45 +56560,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CccevConfig/properties/evidence_type_iri",
-        "key_path": "evidence.claims[].cccev.evidence_type_iri",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
+        "key_path": "datasets[].tables[].aggregates[].required_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114558,7 +56603,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114568,18 +56613,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -114590,26 +56635,23 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CccevConfig/properties/requirement_type",
-        "key_path": "evidence.claims[].cccev.requirement_type",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/source_entity",
+        "key_path": "datasets[].aggregates[].source_entity",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -114628,7 +56670,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114638,7 +56680,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114648,18 +56690,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -114679,27 +56721,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/cccev",
-        "key_path": "evidence.claims[].cccev",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/source_entity",
+        "key_path": "datasets[].entities[].aggregates[].source_entity",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -114708,7 +56750,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114718,7 +56760,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114728,18 +56770,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -114751,43 +56793,44 @@
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/credential_profiles",
-        "key_path": "evidence.claims[].credential_profiles",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/source_entity",
+        "key_path": "datasets[].tables[].aggregates[].source_entity",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114797,7 +56840,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114807,65 +56850,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/credential_profiles/items",
-        "key_path": "evidence.claims[].credential_profiles[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/spatial",
+        "key_path": "datasets[].aggregates[].spatial",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114875,7 +56920,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114885,66 +56930,77 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "mode",
+            "dimension",
+            "geometry_entity",
+            "geometry_id_field",
+            "geometry_field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/depends_on",
-        "key_path": "evidence.claims[].depends_on",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/spatial",
+        "key_path": "datasets[].entities[].aggregates[].spatial",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -114954,7 +57010,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -114964,18 +57020,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -114984,42 +57040,57 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "mode",
+            "dimension",
+            "geometry_entity",
+            "geometry_id_field",
+            "geometry_field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/depends_on/items",
-        "key_path": "evidence.claims[].depends_on[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/spatial",
+        "key_path": "datasets[].tables[].aggregates[].spatial",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115029,7 +57100,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115039,18 +57110,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115059,35 +57130,48 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "mode",
+            "dimension",
+            "geometry_entity",
+            "geometry_id_field",
+            "geometry_field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/disclosure",
-        "key_path": "evidence.claims[].disclosure",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
+        "key_path": "datasets[].aggregates[].temporal_field",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/DisclosureConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -115096,7 +57180,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115106,7 +57190,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115116,18 +57200,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115138,45 +57222,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/evidence_mode",
-        "key_path": "evidence.claims[].evidence_mode",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
+        "key_path": "datasets[].entities[].aggregates[].temporal_field",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/ClaimEvidenceMode",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115186,7 +57270,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115196,18 +57280,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115217,44 +57301,37 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "type",
-            "consultations"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimEvidenceMode"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/formats",
-        "key_path": "evidence.claims[].formats",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
+        "key_path": "datasets[].tables[].aggregates[].temporal_field",
         "path_kind": "property"
       },
-      "purpose": "Omitting this field keeps existing authored claims renderable using the\ncanonical claim-result representation. An explicitly empty list is\nrejected during configuration validation.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -115263,7 +57340,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115273,7 +57350,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115283,18 +57360,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115305,40 +57382,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/formats/items",
-        "key_path": "evidence.claims[].formats[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/title",
+        "key_path": "datasets[].aggregates[].title",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115348,7 +57430,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115358,18 +57440,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115380,40 +57462,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/id",
-        "key_path": "evidence.claims[].id",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/title",
+        "key_path": "datasets[].entities[].aggregates[].title",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115423,7 +57510,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115433,18 +57520,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115455,32 +57542,36 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/inputs",
-        "key_path": "evidence.claims[].inputs",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/title",
+        "key_path": "datasets[].tables[].aggregates[].title",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -115489,7 +57580,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115499,7 +57590,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115509,18 +57600,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115531,41 +57622,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/inputs/items",
-        "key_path": "evidence.claims[].inputs[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
+        "key_path": "datasets[].aggregates[].dimensions[].codelist",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/ClaimInputConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115575,7 +57670,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115585,18 +57680,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115606,45 +57701,37 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "name",
-            "type"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimInputConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/oots",
-        "key_path": "evidence.claims[].oots",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[].codelist",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -115653,7 +57740,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115663,7 +57750,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115673,18 +57760,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115696,35 +57783,35 @@
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/operations",
-        "key_path": "evidence.claims[].operations",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[].codelist",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/ClaimOperationsConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -115733,7 +57820,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115743,7 +57830,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115753,18 +57840,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115775,46 +57862,43 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimOperationsConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/purpose",
-        "key_path": "evidence.claims[].purpose",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
+        "key_path": "datasets[].aggregates[].dimensions[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115824,7 +57908,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115834,18 +57918,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115856,44 +57940,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/required_scopes",
-        "key_path": "evidence.claims[].required_scopes",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[].field",
         "path_kind": "property"
       },
-      "purpose": "Caller scopes checked before any registry consultation is dispatched.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115903,7 +57983,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115913,18 +57993,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -115935,40 +58015,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/required_scopes/items",
-        "key_path": "evidence.claims[].required_scopes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[].field",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -115978,7 +58058,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -115988,18 +58068,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116016,27 +58096,26 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/rule",
-        "key_path": "evidence.claims[].rule",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
+        "key_path": "datasets[].aggregates[].dimensions[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RuleConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -116044,7 +58123,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116054,7 +58133,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116064,18 +58143,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116084,66 +58163,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "type",
-              "consultation",
-              "output"
-            ],
-            [
-              "type",
-              "consultation"
-            ],
-            [
-              "type",
-              "expression"
-            ]
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RuleConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/semantics",
-        "key_path": "evidence.claims[].semantics",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116153,7 +58208,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116163,18 +58218,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116185,26 +58240,23 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/subject_type",
-        "key_path": "evidence.claims[].subject_type",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -116217,11 +58269,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116231,7 +58283,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116241,26 +58293,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -116272,17 +58321,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/title",
-        "key_path": "evidence.claims[].title",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
+        "key_path": "datasets[].aggregates[].dimensions[].label",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -116299,7 +58348,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116309,7 +58358,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116319,18 +58368,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116347,36 +58396,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/value",
-        "key_path": "evidence.claims[].value",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[].label",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ClaimValueConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116386,7 +58433,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116396,18 +58443,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116418,27 +58465,23 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/version",
-        "key_path": "evidence.claims[].version",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[].label",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -116455,7 +58498,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116465,7 +58508,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116475,18 +58518,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116503,17 +58546,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimInputConfig/properties/name",
-        "key_path": "evidence.claims[].inputs[].name",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
+        "key_path": "datasets[].aggregates[].indicators[].column",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -116530,7 +58573,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116540,7 +58583,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116550,18 +58593,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116578,17 +58621,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimInputConfig/properties/type",
-        "key_path": "evidence.claims[].inputs[].type",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].column",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -116605,7 +58648,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116615,7 +58658,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116625,18 +58668,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116653,36 +58696,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimOperationsConfig/properties/batch_evaluate",
-        "key_path": "evidence.claims[].operations.batch_evaluate",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].column",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/BatchOperationConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116692,7 +58733,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116702,18 +58743,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116724,36 +58765,32 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/BatchOperationConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimOperationsConfig/properties/evaluate",
-        "key_path": "evidence.claims[].operations.evaluate",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
+        "key_path": "datasets[].aggregates[].indicators[].decimals",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer",
+          "null"
         ],
-        "local_reference": "#/$defs/OperationConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -116763,7 +58800,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116773,7 +58810,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116783,18 +58820,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -116803,46 +58840,59 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/OperationConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRefObject/properties/id",
-        "key_path": "auth.api_keys[].authorization_details.claims[].id",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].decimals",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116852,7 +58902,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116862,65 +58912,79 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRefObject/properties/id",
-        "key_path": "auth.bearer_tokens[].authorization_details.claims[].id",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].decimals",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -116930,7 +58994,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -116940,48 +59004,60 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRefObject/properties/version",
-        "key_path": "auth.api_keys[].authorization_details.claims[].version",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
+        "key_path": "datasets[].aggregates[].indicators[].definition_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -116996,11 +59072,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117010,7 +59086,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117020,26 +59096,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -117054,17 +59127,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRefObject/properties/version",
-        "key_path": "auth.bearer_tokens[].authorization_details.claims[].version",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].definition_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -117079,11 +59152,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117093,7 +59166,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117103,26 +59176,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -117137,17 +59207,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/concept",
-        "key_path": "evidence.claims[].semantics.concept",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].definition_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -117159,14 +59229,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117176,7 +59246,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117186,18 +59256,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117217,35 +59287,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from",
-        "key_path": "evidence.claims[].semantics.derived_from",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
+        "key_path": "datasets[].aggregates[].indicators[].frequency",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117255,7 +59326,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117265,18 +59336,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117287,40 +59358,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from/items",
-        "key_path": "evidence.claims[].semantics.derived_from[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].frequency",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117330,7 +59406,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117340,18 +59416,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117362,23 +59438,26 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/predicate",
-        "key_path": "evidence.claims[].semantics.predicate",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].frequency",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -117390,14 +59469,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117407,7 +59486,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117417,18 +59496,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117448,36 +59527,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/property",
-        "key_path": "evidence.claims[].semantics.property",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
+        "key_path": "datasets[].aggregates[].indicators[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117487,7 +59565,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117497,18 +59575,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117518,46 +59596,59 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/value_mapping",
-        "key_path": "evidence.claims[].semantics.value_mapping",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117567,7 +59658,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117577,18 +59668,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117598,46 +59689,59 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/vocabulary",
-        "key_path": "evidence.claims[].semantics.vocabulary",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117647,7 +59751,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117657,18 +59761,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117678,46 +59782,58 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig/properties/max_bytes",
-        "key_path": "evidence.claims[].value.max_bytes",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
+        "key_path": "datasets[].aggregates[].indicators[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a per-claim string byte ceiling."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117727,7 +59843,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117737,18 +59853,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117757,58 +59873,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 65536
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig/properties/nullable",
-        "key_path": "evidence.claims[].value.nullable",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117818,7 +59918,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117828,18 +59928,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117850,41 +59950,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig/properties/type",
-        "key_path": "evidence.claims[].value.type",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117894,7 +59993,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117904,18 +60003,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -117932,36 +60031,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig/properties/unit",
-        "key_path": "evidence.claims[].value.unit",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
+        "key_path": "datasets[].aggregates[].indicators[].label",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -117971,7 +60068,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -117981,18 +60078,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -118003,44 +60100,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ConcurrencyConfig/properties/subjects",
-        "key_path": "evidence.concurrency.subjects",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].label",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118050,7 +60143,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118060,56 +60153,45 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path",
-        "key_path": "config_trust.antirollback_state_path",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].label",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_config_trust_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -118122,11 +60204,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118136,7 +60218,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118146,26 +60228,24 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -118176,36 +60256,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path",
-        "key_path": "config_trust.break_glass_override_path",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
+        "key_path": "datasets[].aggregates[].indicators[].unit_measure",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_config_trust_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118215,7 +60293,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118225,50 +60303,45 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path",
-        "key_path": "config_trust.bundle_path",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].unit_measure",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_config_trust_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -118281,11 +60354,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118295,7 +60368,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118305,26 +60378,24 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -118335,17 +60406,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path",
-        "key_path": "config_trust.trust_anchor_path",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].unit_measure",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_config_trust_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -118358,11 +60429,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118372,7 +60443,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118382,26 +60453,24 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -118412,35 +60481,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed",
-        "key_path": "evidence.credential_profiles.*.disclosure.allowed",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
+        "key_path": "datasets[].aggregates[].indicators[].unit_mult",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118450,7 +60520,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118460,65 +60530,79 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 2147483647
+        },
+        {
+          "keyword": "minimum",
+          "value": -2147483648
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed/items",
-        "key_path": "evidence.credential_profiles.*.disclosure.allowed[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].unit_mult",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118528,7 +60612,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118538,67 +60622,79 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 2147483647
+        },
+        {
+          "keyword": "minimum",
+          "value": -2147483648
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/name",
-        "key_path": "auth.api_keys[].fingerprint.name",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].unit_mult",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118608,7 +60704,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118618,32 +60714,42 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 2147483647
+        },
+        {
+          "keyword": "minimum",
+          "value": -2147483648
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
+            "integer",
             "null"
           ]
         }
@@ -118651,36 +60757,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/name",
-        "key_path": "auth.bearer_tokens[].fingerprint.name",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
+        "key_path": "datasets[].aggregates[].joins[].relationship",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118690,7 +60794,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118700,69 +60804,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/path",
-        "key_path": "auth.api_keys[].fingerprint.path",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
+        "key_path": "datasets[].entities[].aggregates[].joins[].relationship",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118772,7 +60869,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118782,69 +60879,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/path",
-        "key_path": "auth.bearer_tokens[].fingerprint.path",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
+        "key_path": "datasets[].tables[].aggregates[].joins[].relationship",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118854,7 +60944,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118864,50 +60954,45 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/provider",
-        "key_path": "auth.api_keys[].fingerprint.provider",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/column",
+        "key_path": "datasets[].aggregates[].measures[].column",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -118916,15 +61001,15 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -118934,7 +61019,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -118944,36 +61029,26 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "env",
-            "file"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -118982,17 +61057,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/provider",
-        "key_path": "auth.bearer_tokens[].fingerprint.provider",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/column",
+        "key_path": "datasets[].entities[].aggregates[].measures[].column",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -119001,15 +61076,15 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119019,7 +61094,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119029,36 +61104,26 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "env",
-            "file"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -119067,35 +61132,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims",
-        "key_path": "evidence.credential_profiles.*.allowed_claims",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/column",
+        "key_path": "datasets[].tables[].aggregates[].measures[].column",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119105,7 +61169,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119115,65 +61179,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims/items",
-        "key_path": "evidence.credential_profiles.*.allowed_claims[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/function",
+        "key_path": "datasets[].aggregates[].measures[].function",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119183,7 +61245,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119193,67 +61255,80 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/disclosure",
-        "key_path": "evidence.credential_profiles.*.disclosure",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/function",
+        "key_path": "datasets[].entities[].aggregates[].measures[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/CredentialDisclosureConfig",
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119263,7 +61338,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119273,69 +61348,80 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialDisclosureConfig"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/format",
-        "key_path": "evidence.credential_profiles.*.format",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/function",
+        "key_path": "datasets[].tables[].aggregates[].measures[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119345,7 +61431,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119355,67 +61441,79 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/holder_binding",
-        "key_path": "evidence.credential_profiles.*.holder_binding",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/name",
+        "key_path": "datasets[].aggregates[].measures[].name",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/HolderBindingConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119425,7 +61523,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119435,52 +61533,45 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/issuer",
-        "key_path": "evidence.credential_profiles.*.issuer",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/name",
+        "key_path": "datasets[].entities[].aggregates[].measures[].name",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -119493,11 +61584,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119507,7 +61598,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119517,26 +61608,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -119548,17 +61636,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/signing_key",
-        "key_path": "evidence.credential_profiles.*.signing_key",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure/properties/name",
+        "key_path": "datasets[].tables[].aggregates[].measures[].name",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -119571,11 +61659,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119585,7 +61673,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119595,26 +61683,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -119626,35 +61711,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/validity_seconds",
-        "key_path": "evidence.credential_profiles.*.validity_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119664,7 +61750,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119674,69 +61760,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "int64"
+          "keyword": "required",
+          "value": [
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/vct",
-        "key_path": "evidence.credential_profiles.*.vct",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119746,7 +61839,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119756,66 +61849,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialStatusConfig/properties/base_url",
-        "key_path": "credential_status.base_url",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary credential-status publication and retention behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_credential_status_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119825,7 +61928,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119835,65 +61938,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialStatusConfig/properties/enabled",
-        "key_path": "credential_status.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
+        "key_path": "datasets[].aggregates[].spatial.collection_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary credential-status publication and retention behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_credential_status_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119903,7 +62017,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119913,65 +62027,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialStatusConfig/properties/retention_seconds",
-        "key_path": "credential_status.retention_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
+        "key_path": "datasets[].entities[].aggregates[].spatial.collection_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary credential-status publication and retention behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_credential_status_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -119981,7 +62097,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -119991,65 +62107,58 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/evidence",
-        "key_path": "deployment.evidence",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
+        "key_path": "datasets[].tables[].aggregates[].spatial.collection_id",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/DeploymentEvidenceConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -120058,7 +62167,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120068,7 +62177,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120078,18 +62187,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120100,45 +62209,43 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/multi_instance",
-        "key_path": "deployment.multi_instance",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
+        "key_path": "datasets[].aggregates[].spatial.dimension",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120148,7 +62255,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120158,18 +62265,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120180,42 +62287,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/profile",
-        "key_path": "deployment.profile",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
+        "key_path": "datasets[].entities[].aggregates[].spatial.dimension",
         "path_kind": "property"
       },
-      "purpose": "The set of deployment profiles an operator can declare.\n\nFrozen at introduction; new profiles may be added but existing ones never\nchange meaning. Deserialization is strict: an unknown profile string fails,\nwhich surfaces as a startup error.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120225,7 +62330,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120235,18 +62340,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120255,55 +62360,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "local",
-            "hosted_lab",
-            "production",
-            "evidence_grade"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/waivers",
-        "key_path": "deployment.waivers",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
+        "key_path": "datasets[].tables[].aggregates[].spatial.dimension",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120313,7 +62405,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120323,18 +62415,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120345,41 +62437,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/waivers/items",
-        "key_path": "deployment.waivers[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
+        "key_path": "datasets[].aggregates[].spatial.geometry_entity",
+        "path_kind": "property"
       },
-      "purpose": "One operator-configured waiver.\n\nA waiver names exactly one finding id, a required operator reference, an\noptional summary, and a mandatory expiry date (`YYYY-MM-DD`). The shared\noperations contract validates metadata before it can reach posture or logs.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120389,7 +62480,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120399,18 +62490,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120419,56 +62510,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "finding",
-            "reference",
-            "expires"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path",
-        "key_path": "deployment.evidence.audit_ack_cursor_path",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
+        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_entity",
         "path_kind": "property"
       },
-      "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. Runtime health requires both a\nfresh timestamp and a watermark equal to the live keyed audit-chain tail.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120478,7 +62555,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120488,69 +62565,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs",
-        "key_path": "deployment.evidence.audit_ack_max_age_secs",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
+        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_entity",
         "path_kind": "property"
       },
-      "purpose": "Optional freshness window, in seconds, for the off-host ack cursor.\nUnset defaults to [`DEFAULT_AUDIT_ACK_MAX_AGE`] (900s). Meaningless\nwithout `audit_ack_cursor_path`; config load rejects that combination.\n\n[`DEFAULT_AUDIT_ACK_MAX_AGE`]: registry_platform_ops::DEFAULT_AUDIT_ACK_MAX_AGE",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120560,7 +62630,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120570,18 +62640,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120590,54 +62660,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping",
-        "key_path": "deployment.evidence.audit_offhost_shipping",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
+        "key_path": "datasets[].aggregates[].spatial.geometry_field",
         "path_kind": "property"
       },
-      "purpose": "Operator asserts audit log events are shipped off-host (for example to\na log aggregator or SIEM) so a local file sink does not cap retention.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120647,7 +62705,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120657,18 +62715,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120679,41 +62737,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/signer_custody_approved",
-        "key_path": "deployment.evidence.signer_custody_approved",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
+        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_field",
         "path_kind": "property"
       },
-      "purpose": "Operator asserts a production review has approved signer custody for\nthis deployment. Provider kind is not proof of custody: PKCS#11 modules\ncan be backed by either hardware or software tokens.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120723,7 +62780,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120733,18 +62790,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120755,23 +62812,23 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/expires",
-        "key_path": "deployment.waivers[].expires",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
+        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_field",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -120788,7 +62845,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120798,7 +62855,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120808,18 +62865,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120836,17 +62893,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/finding",
-        "key_path": "deployment.waivers[].finding",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
+        "key_path": "datasets[].aggregates[].spatial.geometry_id_field",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -120863,7 +62920,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120873,7 +62930,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120883,18 +62940,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120911,27 +62968,26 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/reference",
-        "key_path": "deployment.waivers[].reference",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
+        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_id_field",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverReference",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -120939,7 +62995,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -120949,7 +63005,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -120959,18 +63015,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -120979,60 +63035,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverReference"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/summary",
-        "key_path": "deployment.waivers[].summary",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
+        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_id_field",
         "path_kind": "property"
       },
-      "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverSummary",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121042,7 +63080,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121052,18 +63090,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -121072,40 +63110,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverSummary"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig/properties/allowed",
-        "key_path": "evidence.claims[].disclosure.allowed",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
+        "key_path": "datasets[].aggregates[].spatial.max_geometry_vertices",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -121120,7 +63146,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121130,7 +63156,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121140,18 +63166,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -121160,42 +63186,55 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig/properties/allowed/items",
-        "key_path": "evidence.claims[].disclosure.allowed[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
+        "key_path": "datasets[].entities[].aggregates[].spatial.max_geometry_vertices",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121205,7 +63244,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121215,18 +63254,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -121235,34 +63274,46 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig/properties/default",
-        "key_path": "evidence.claims[].disclosure.default",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
+        "key_path": "datasets[].tables[].aggregates[].spatial.max_geometry_vertices",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -121271,7 +63322,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121281,7 +63332,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121291,18 +63342,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -121311,43 +63362,54 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig/properties/downgrade",
-        "key_path": "evidence.claims[].disclosure.downgrade",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].aggregates[].spatial.mode",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121357,7 +63419,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121367,18 +63429,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -121387,6 +63449,10 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "admin_area"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -121395,17 +63461,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel",
-        "key_path": "auth.api_keys[].authorization_details.assisted_access_context.channel",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].entities[].aggregates[].spatial.mode",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -121414,15 +63480,15 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121432,7 +63498,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121442,29 +63508,30 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "admin_area"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -121473,17 +63540,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel",
-        "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context.channel",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].tables[].aggregates[].spatial.mode",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -121492,15 +63559,15 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121510,7 +63577,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121520,29 +63587,30 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "admin_area"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -121551,36 +63619,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/hash_secret_env",
-        "key_path": "audit.hash_secret_env",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].aggregates[].allowed_filters[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121590,7 +63656,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121600,69 +63666,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/max_files",
-        "key_path": "audit.max_files",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121672,7 +63731,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121682,74 +63741,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/max_size_mb",
-        "key_path": "audit.max_size_mb",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].entities[].api.allowed_filters[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121759,7 +63806,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121769,74 +63816,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/path",
-        "key_path": "audit.path",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121846,7 +63881,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121856,68 +63891,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/sink",
-        "key_path": "audit.sink",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].tables[].api.allowed_filters[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -121927,7 +63956,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -121937,23 +63966,24 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -121964,36 +63994,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/syslog_socket_path",
-        "key_path": "audit.syslog_socket_path",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].aggregates[].allowed_filters[].ops",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122003,7 +64031,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122013,69 +64041,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/access_token_signing",
-        "key_path": "auth.access_token_signing",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AccessTokenSigningConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122085,7 +64106,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122095,70 +64116,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys",
-        "key_path": "auth.api_keys",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].entities[].api.allowed_filters[].ops",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122168,7 +64181,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122178,26 +64191,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -122209,35 +64219,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys/items",
-        "key_path": "auth.api_keys[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/EvidenceCredentialConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122247,7 +64256,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122257,77 +64266,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "fingerprint"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens",
-        "key_path": "auth.bearer_tokens",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].tables[].api.allowed_filters[].ops",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122337,7 +64331,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122347,26 +64341,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -122378,35 +64369,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens/items",
-        "key_path": "auth.bearer_tokens[]",
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].aggregates[].allowed_filters[].ops[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/EvidenceCredentialConfig",
+        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122416,7 +64407,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122426,78 +64417,77 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "id",
-            "fingerprint"
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig"
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/oidc",
-        "key_path": "auth.oidc",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "local_reference": "#/$defs/FilterOp",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122507,7 +64497,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122517,18 +64507,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -122538,53 +64528,56 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "issuer",
-            "jwks_url"
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode",
-        "key_path": "auth.api_keys[].authorization_details.access_mode",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].entities[].api.allowed_filters[].ops[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
-        "composed": true
+        "local_reference": "#/$defs/FilterOp",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122594,7 +64587,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122604,79 +64597,77 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "enum",
           "value": [
-            "unknown",
-            "machine_client",
-            "subject_bound",
-            "delegated_subject_access"
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode",
-        "key_path": "auth.bearer_tokens[].authorization_details.access_mode",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
-        "composed": true
+        "local_reference": "#/$defs/FilterOp",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122686,7 +64677,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122696,78 +64687,77 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "enum",
           "value": [
-            "unknown",
-            "machine_client",
-            "subject_bound",
-            "delegated_subject_access"
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions",
-        "key_path": "auth.api_keys[].authorization_details.actions",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].tables[].api.allowed_filters[].ops[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122777,7 +64767,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122787,66 +64777,77 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions",
-        "key_path": "auth.bearer_tokens[].authorization_details.actions",
+        "schema": "relay",
+        "pointer": "/$defs/ApiKeyConfig/properties/fingerprint",
+        "key_path": "auth.api_keys[].fingerprint",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/CredentialFingerprintSchema",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122856,7 +64857,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122866,18 +64867,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -122885,46 +64886,62 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "provider",
+              "name"
+            ],
+            [
+              "provider",
+              "path"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/CredentialFingerprintSchema"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items",
-        "key_path": "auth.api_keys[].authorization_details.actions[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ApiKeyConfig/properties/id",
+        "key_path": "auth.api_keys[].id",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -122934,7 +64951,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -122944,18 +64961,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -122975,34 +64992,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items",
-        "key_path": "auth.bearer_tokens[].authorization_details.actions[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ApiKeyConfig/properties/scopes",
+        "key_path": "auth.api_keys[].scopes",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123012,7 +65030,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123022,18 +65040,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -123047,42 +65065,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context",
-        "key_path": "auth.api_keys[].authorization_details.assisted_access_context",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/ApiKeyConfig/properties/scopes/items",
+        "key_path": "auth.api_keys[].scopes[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123092,7 +65108,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123102,18 +65118,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -123125,53 +65141,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "channel"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context",
-        "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context",
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/claims",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Claims released on success. Non-empty; at least one `required`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123181,7 +65186,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123191,76 +65196,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "channel"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level",
-        "key_path": "auth.api_keys[].authorization_details.assurance_level",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/claims/items",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "A single released claim. Exactly one of `source_field` or `expression`\nmust be set: a claim is either a direct source-field projection or a\nCEL-computed value.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ReleaseClaimConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123270,7 +65262,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123280,51 +65272,55 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "name"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseClaimConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level",
-        "key_path": "auth.bearer_tokens[].authorization_details.assurance_level",
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/description",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].description",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -123336,14 +65332,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123353,7 +65349,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123363,26 +65359,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -123397,35 +65390,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims",
-        "key_path": "auth.api_keys[].authorization_details.claims",
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/id",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Profile identifier, lower-kebab/snake (`^[a-z][a-z0-9_-]*$`). Globally\nunique with `version`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123435,7 +65427,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123445,66 +65437,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims",
-        "key_path": "auth.bearer_tokens[].authorization_details.claims",
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/purpose",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].purpose",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Data-purpose this profile is bound to. When the backing entity declares\n`governed_policy.permitted_purposes`, this must be a member.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123514,7 +65502,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123524,67 +65512,64 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items",
-        "key_path": "auth.api_keys[].authorization_details.claims[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/release_conditions",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object",
-          "string"
+          "null",
+          "object"
         ],
-        "local_reference": "#/$defs/ClaimRef",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123594,7 +65579,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123604,80 +65589,71 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "id"
+            "expression"
           ]
         },
         {
           "keyword": "type",
           "value": [
-            "object",
-            "string"
+            "null",
+            "object"
           ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRef"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items",
-        "key_path": "auth.bearer_tokens[].authorization_details.claims[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/release_scope",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].release_scope",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Dataset-bound scope a caller must hold to invoke this release. The\nstable profile is exactly `<dataset_id>:identity_release`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object",
           "string"
         ],
-        "local_reference": "#/$defs/ClaimRef",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123687,7 +65663,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123697,80 +65673,64 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "object",
-            "string"
-          ]
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRef"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref",
-        "key_path": "auth.api_keys[].authorization_details.consent_ref",
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/response",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].response",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ReleaseResponseConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123780,7 +65740,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123790,70 +65750,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseResponseConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref",
-        "key_path": "auth.bearer_tokens[].authorization_details.consent_ref",
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/subject",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].subject",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ReleaseSubjectConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123863,7 +65820,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123873,18 +65830,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -123892,32 +65849,39 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "source_field",
+            "id_type"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseSubjectConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure",
-        "key_path": "auth.api_keys[].authorization_details.disclosure",
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/title",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].title",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -123929,14 +65893,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -123946,7 +65910,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -123956,26 +65920,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -123990,36 +65951,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure",
-        "key_path": "auth.bearer_tokens[].authorization_details.disclosure",
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/version",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].version",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Profile version. Globally unique with `id`; no silent \"latest\".",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124029,7 +65988,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124039,70 +65998,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format",
-        "key_path": "auth.api_keys[].authorization_details.format",
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig/oneOf/0/properties/sink",
+        "key_path": "audit.sink",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124112,7 +66063,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124122,70 +66073,69 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "const",
           "value": [
-            "string",
-            "null"
+            "file",
+            "stdout",
+            "syslog"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format",
-        "key_path": "auth.bearer_tokens[].authorization_details.format",
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig/oneOf/1/properties/path",
+        "key_path": "audit.path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_audit_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124195,7 +66145,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124205,18 +66155,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -124224,51 +66174,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction",
-        "key_path": "auth.api_keys[].authorization_details.jurisdiction",
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig/oneOf/1/properties/rotate",
+        "key_path": "audit.rotate",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "In-process rotation for the `file` audit sink.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RotateConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124278,7 +66224,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124288,70 +66234,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "max_size_mb",
+            "max_files"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RotateConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction",
-        "key_path": "auth.bearer_tokens[].authorization_details.jurisdiction",
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig/properties/chain",
+        "key_path": "audit.chain",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Retains the compatibility switch in the authored contract; Relay audit envelopes remain integrity-chained regardless of this setting.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124361,7 +66310,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124371,70 +66320,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref",
-        "key_path": "auth.api_keys[].authorization_details.legal_basis_ref",
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig/properties/format",
+        "key_path": "audit.format",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AuditFormat",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124444,7 +66386,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124454,70 +66396,71 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "jsonl"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditFormat"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref",
-        "key_path": "auth.bearer_tokens[].authorization_details.legal_basis_ref",
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig/properties/hash_secret_env",
+        "key_path": "audit.hash_secret_env",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Name of the environment variable holding the per-deploy secret\nused to HMAC sensitive audit values (single-record primary keys,\nsensitive query parameters). Runtime startup fails closed when\nthis field is unset, empty, or points to a missing, empty, or\nweak secret. Direct middleware tests can opt into the explicit\nunkeyed dev-only hasher without using runtime config.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
           "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124527,7 +66470,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124537,18 +66480,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -124556,35 +66499,38 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[^=\\x00]*[^=\\x00\\x09-\\x0D\\x20\\x85\\u00A0\\u1680\\u2000-\\u200A\\u2028\\u2029\\u202F\\u205F\\u3000][^=\\x00]*$"
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "string"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations",
-        "key_path": "auth.api_keys[].authorization_details.locations",
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig/properties/include_health",
+        "key_path": "audit.include_health",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Include `/healthz` liveness probes in the audit stream. `/ready` is\nalways excluded because auditing it would advance the chain after its\nzero-backlog shipping check and self-invalidate the next probe.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "boolean"
         ],
         "composed": false
       },
@@ -124592,14 +66538,14 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124609,7 +66555,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124619,66 +66565,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations",
-        "key_path": "auth.bearer_tokens[].authorization_details.locations",
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig/properties/write_policy",
+        "key_path": "audit.write_policy",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Behavior when an audit record fails to write.\n\n`fail_closed` (default) fails the request with a stable error code so\nthat no request outcome is returned without a durable audit record.\n`availability_first` logs the failure and lets the request succeed for\ndeployments that explicitly accept best-effort audit durability.\nPer-route-family selection is out of scope; this is a single\ndeployment-wide policy.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/AuditWritePolicySchema",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124688,7 +66631,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124698,65 +66641,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "availability_first",
+            "fail_closed",
+            "fail_closed_route_families"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditWritePolicySchema"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items",
-        "key_path": "auth.api_keys[].authorization_details.locations[]",
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig/items",
+        "key_path": "consultation.audit_pseudonym_materials[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One public epoch id bound to one secret source reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AuditPseudonymMaterialConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124766,7 +66718,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124776,65 +66728,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "key_id",
+            "source"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymMaterialConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items",
-        "key_path": "auth.bearer_tokens[].authorization_details.locations[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/key_id",
+        "key_path": "consultation.audit_pseudonym_materials[].key_id",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/AuditPseudonymKeyIdSchema",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124844,7 +66805,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124854,67 +66815,71 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z0-9][a-z0-9._-]{0,63}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymKeyIdSchema"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose",
-        "key_path": "auth.api_keys[].authorization_details.purpose",
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/source",
+        "key_path": "consultation.audit_pseudonym_materials[].source",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Closed v1 set of audit-pseudonym secret source providers.\n\nThe configured name is a reference only. Secret values cannot be embedded\nin this model and are loaded exactly once during runtime compilation.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AuditPseudonymSecretSourceConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -124924,7 +66889,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -124934,70 +66899,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "provider",
+            "name"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymSecretSourceConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose",
-        "key_path": "auth.bearer_tokens[].authorization_details.purpose",
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/name",
+        "key_path": "consultation.audit_pseudonym_materials[].source.name",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Portable environment-variable name used only as a secret reference.\n\nDebug output is redacted even though the name is not itself key material,\npreventing configuration diagnostics from disclosing secret topology.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AuditPseudonymSecretEnvironmentName",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125007,7 +66976,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125017,18 +66986,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -125036,51 +67005,53 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymSecretEnvironmentName"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship",
-        "key_path": "auth.api_keys[].authorization_details.relationship",
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/provider",
+        "key_path": "consultation.audit_pseudonym_materials[].source.provider",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125090,7 +67061,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125100,77 +67071,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "relationship_type",
-            "proof_claim"
-          ]
+          "keyword": "const",
+          "value": "environment"
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship",
-        "key_path": "auth.bearer_tokens[].authorization_details.relationship",
+        "schema": "relay",
+        "pointer": "/$defs/AuthConfig/properties/api_keys",
+        "key_path": "auth.api_keys",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125180,7 +67141,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125190,18 +67151,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -125213,52 +67174,43 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship_type",
-            "proof_claim"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version",
-        "key_path": "auth.api_keys[].authorization_details.schema_version",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/AuthConfig/properties/api_keys/items",
+        "key_path": "auth.api_keys[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One configured API key, identified by an id and a fingerprint reference.\nThe raw key never appears in config.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ApiKeyConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125268,7 +67220,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125278,18 +67230,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -125301,42 +67253,55 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "fingerprint"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ApiKeyConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version",
-        "key_path": "auth.bearer_tokens[].authorization_details.schema_version",
+        "schema": "relay",
+        "pointer": "/$defs/AuthConfig/properties/failure_throttle",
+        "key_path": "auth.failure_throttle",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AuthFailureThrottleConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125346,7 +67311,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125356,67 +67321,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuthFailureThrottleConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject",
-        "key_path": "auth.api_keys[].authorization_details.subject",
+        "schema": "relay",
+        "pointer": "/$defs/AuthConfig/properties/mode",
+        "key_path": "auth.mode",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "local_reference": "#/$defs/AuthMode",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125426,7 +67391,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125436,58 +67401,56 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "const",
           "value": [
-            "binding_claim",
-            "id_type"
+            "api_key",
+            "oidc"
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuthMode"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject",
-        "key_path": "auth.bearer_tokens[].authorization_details.subject",
+        "schema": "relay",
+        "pointer": "/$defs/AuthConfig/properties/oidc",
+        "key_path": "auth.oidc",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "OIDC / OAuth2 resource-server configuration. The relay validates\nincoming bearer JWTs against a configured external IdP. No tokens\nare minted here.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -125502,11 +67465,11 @@
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125516,7 +67479,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125526,34 +67489,31 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "binding_claim",
-            "id_type"
+            "issuer",
+            "audiences"
           ]
         },
         {
@@ -125567,36 +67527,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target",
-        "key_path": "auth.api_keys[].authorization_details.target",
+        "schema": "relay",
+        "pointer": "/$defs/AuthFailureThrottleConfig/properties/enabled",
+        "key_path": "auth.failure_throttle.enabled",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "boolean"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125606,7 +67565,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125616,77 +67575,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id_type",
-            "id"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target",
-        "key_path": "auth.bearer_tokens[].authorization_details.target",
+        "schema": "relay",
+        "pointer": "/$defs/AuthFailureThrottleConfig/properties/max_failures",
+        "key_path": "auth.failure_throttle.max_failures",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "integer"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125696,7 +67641,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125706,75 +67651,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "id_type",
-            "id"
-          ]
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type",
-        "key_path": "auth.api_keys[].authorization_details.type",
+        "schema": "relay",
+        "pointer": "/$defs/AuthFailureThrottleConfig/properties/window_seconds",
+        "key_path": "auth.failure_throttle.window_seconds",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125784,7 +67729,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125794,65 +67739,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type",
-        "key_path": "auth.bearer_tokens[].authorization_details.type",
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig/properties/authority_type",
+        "key_path": "catalog.authority_type",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "BRegDCAT-AP: type IRI for the `foaf:Agent` publisher. When set, emits\n`dcterms:type` on the publisher node.\n\nBRegDCAT-AP 2.1.0 SHACL checks publisher type values against the ADMS\npublishertype scheme (`http://purl.org/adms/publishertype/...`).\nThe relay does not enforce a vocabulary: any IRI passes through.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_catalog_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125862,58 +67818,58 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
+        "relay",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim",
-        "key_path": "auth.api_keys[].authorization_details.relationship.proof_claim",
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig/properties/base_url",
+        "key_path": "catalog.base_url",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay catalog identity and public metadata exposed for governed discovery.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_catalog_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -125930,7 +67886,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -125940,7 +67896,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -125950,18 +67906,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -125969,8 +67925,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -125981,34 +67936,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim",
-        "key_path": "auth.bearer_tokens[].authorization_details.relationship.proof_claim",
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig/properties/default_spatial_coverage",
+        "key_path": "catalog.default_spatial_coverage",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "BRegDCAT-AP: default `dcterms:spatial` IRI applied to datasets that\ndo not declare their own `spatial_coverage`. Typically an EU\nauthority country IRI under\n`http://publications.europa.eu/resource/authority/country/`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_catalog_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126018,75 +67975,77 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
+        "relay",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type",
-        "key_path": "auth.api_keys[].authorization_details.relationship.relationship_type",
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig/properties/participant_id",
+        "key_path": "catalog.participant_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Identifies the participant in catalog output; when omitted, Relay derives the participant identifier from the reviewed catalog base URL.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_catalog_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126096,58 +68055,58 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
+        "relay",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type",
-        "key_path": "auth.bearer_tokens[].authorization_details.relationship.relationship_type",
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig/properties/publisher",
+        "key_path": "catalog.publisher",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_catalog_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "string"
@@ -126160,11 +68119,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126174,37 +68133,34 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
+        "relay",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -126215,34 +68171,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim",
-        "key_path": "auth.api_keys[].authorization_details.subject.binding_claim",
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig/properties/publisher_iri",
+        "key_path": "catalog.publisher_iri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "BRegDCAT-AP: identifier IRI for the `foaf:Agent` publisher. Use a\ncontrolled-vocabulary corporate body IRI when publishing strict\nBRegDCAT-AP.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_catalog_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126252,58 +68210,58 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
+        "relay",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim",
-        "key_path": "auth.bearer_tokens[].authorization_details.subject.binding_claim",
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig/properties/title",
+        "key_path": "catalog.title",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_catalog_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "string"
@@ -126316,11 +68274,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126330,37 +68288,34 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
+        "relay",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -126371,17 +68326,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type",
-        "key_path": "auth.api_keys[].authorization_details.subject.id_type",
+        "schema": "relay",
+        "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path",
+        "key_path": "config_trust.antirollback_state_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_config_trust_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -126398,7 +68353,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126408,7 +68363,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -126418,18 +68373,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -126437,8 +68392,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -126449,34 +68403,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type",
-        "key_path": "auth.bearer_tokens[].authorization_details.subject.id_type",
+        "schema": "relay",
+        "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path",
+        "key_path": "config_trust.break_glass_override_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_config_trust_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126486,7 +68442,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -126496,18 +68452,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -126515,29 +68471,31 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id",
-        "key_path": "auth.api_keys[].authorization_details.target.id",
+        "schema": "relay",
+        "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path",
+        "key_path": "config_trust.bundle_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_config_trust_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -126554,7 +68512,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126564,7 +68522,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -126574,18 +68532,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -126593,8 +68551,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -126605,17 +68562,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id",
-        "key_path": "auth.bearer_tokens[].authorization_details.target.id",
+        "schema": "relay",
+        "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path",
+        "key_path": "config_trust.trust_anchor_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_config_trust_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -126632,7 +68589,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126642,7 +68599,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -126652,18 +68609,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -126671,8 +68628,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -126683,34 +68639,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type",
-        "key_path": "auth.api_keys[].authorization_details.target.id_type",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence",
+        "key_path": "consultation.artifacts.evidence",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126720,7 +68676,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -126730,65 +68686,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type",
-        "key_path": "auth.bearer_tokens[].authorization_details.target.id_type",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence/items",
+        "key_path": "consultation.artifacts.evidence[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One bounded, hash-pinned integration evidence file.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationEvidenceArtifactConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126798,7 +68752,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -126808,66 +68762,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "class",
+            "path",
+            "sha256"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationEvidenceArtifactConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes",
-        "key_path": "evidence.allowed_purposes",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs",
+        "key_path": "consultation.artifacts.integration_packs",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126877,7 +68839,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -126887,18 +68849,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -126915,26 +68877,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes/items",
-        "key_path": "evidence.allowed_purposes[]",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs/items",
+        "key_path": "consultation.artifacts.integration_packs[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One hash-pinned public contract or reviewed integration pack.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
@@ -126942,7 +68905,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -126952,7 +68915,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -126962,18 +68925,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -126982,43 +68945,54 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "path",
+            "hash",
+            "sha256"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/api_base_url",
-        "key_path": "evidence.api_base_url",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings",
+        "key_path": "consultation.artifacts.private_bindings",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127028,7 +69002,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127038,66 +69012,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/api_version",
-        "key_path": "evidence.api_version",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings/items",
+        "key_path": "consultation.artifacts.private_bindings[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One hash-pinned public contract or reviewed integration pack.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127107,7 +69078,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127117,18 +69088,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -127137,43 +69108,54 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "path",
+            "hash",
+            "sha256"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/claims",
-        "key_path": "evidence.claims",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts",
+        "key_path": "consultation.artifacts.public_contracts",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127183,7 +69165,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127193,18 +69175,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -127221,22 +69203,22 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/claims/items",
-        "key_path": "evidence.claims[]",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts/items",
+        "key_path": "consultation.artifacts.public_contracts[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One hash-pinned public contract or reviewed integration pack.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ClaimDefinition",
+        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -127249,7 +69231,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127259,7 +69241,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127269,18 +69251,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -127292,12 +69274,9 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "title",
-            "version",
-            "subject_type",
-            "evidence_mode",
-            "rule"
+            "path",
+            "hash",
+            "sha256"
           ]
         },
         {
@@ -127306,41 +69285,41 @@
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/claims_url",
-        "key_path": "evidence.claims_url",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts",
+        "key_path": "consultation.artifacts.rhai_scripts",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127350,7 +69329,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127360,67 +69339,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/concurrency",
-        "key_path": "evidence.concurrency",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts/items",
+        "key_path": "consultation.artifacts.rhai_scripts[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One hash-pinned private binding or standalone Rhai script.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ConcurrencyConfig",
+        "local_reference": "#/$defs/ConsultationArtifactReferenceConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127430,7 +69405,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127440,18 +69415,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -127460,47 +69435,53 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "path",
+            "sha256"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ConcurrencyConfig"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactReferenceConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/credential_profiles",
-        "key_path": "evidence.credential_profiles",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/path",
+        "key_path": "consultation.artifacts.rhai_scripts[].path",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Normalized bundle-root-relative path.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127510,7 +69491,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127520,18 +69501,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -127545,41 +69526,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/credential_profiles/additionalProperties",
-        "key_path": "evidence.credential_profiles.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/sha256",
+        "key_path": "consultation.artifacts.rhai_scripts[].sha256",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a credential profile and each value defines its exact claims, format, and issuance contract.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_credential_profiles_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/CredentialProfileConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127589,7 +69569,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127599,79 +69579,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "format",
-            "issuer",
-            "signing_key",
-            "vct"
-          ]
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/enabled",
-        "key_path": "evidence.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/active_key_id",
+        "key_path": "consultation.bootstrap.active_key_id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127681,7 +69648,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127691,18 +69658,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -127713,41 +69680,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/formats_url",
-        "key_path": "evidence.formats_url",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/active_write_deadline_unix_ms",
+        "key_path": "consultation.bootstrap.active_write_deadline_unix_ms",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127757,7 +69723,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127767,18 +69733,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -127790,43 +69756,54 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/inline_batch_limit",
-        "key_path": "evidence.inline_batch_limit",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/audit_event_retention_ms",
+        "key_path": "consultation.bootstrap.audit_event_retention_ms",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -127836,7 +69813,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -127846,37 +69823,40 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "format",
-          "value": "uint"
+          "value": "int64"
         },
         {
           "keyword": "maximum",
-          "value": 100
+          "value": 9223372036854775807
         },
         {
           "keyword": "minimum",
-          "value": 1
+          "value": -9223372036854775808
         },
         {
           "keyword": "type",
@@ -127886,116 +69866,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/machine_quota",
-        "key_path": "evidence.machine_quota",
-        "path_kind": "property"
-      },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/MachineQuotaConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/MachineQuotaConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/max_credential_validity_seconds",
-        "key_path": "evidence.max_credential_validity_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/keyring_maintenance_database_url_env",
+        "key_path": "consultation.bootstrap.keyring_maintenance_database_url_env",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128005,7 +69903,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128015,18 +69913,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -128034,56 +69932,45 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/relay",
-        "key_path": "evidence.relay",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/keyring_reader_database_url_env",
+        "key_path": "consultation.bootstrap.keyring_reader_database_url_env",
         "path_kind": "property"
       },
-      "purpose": "The one Registry Relay connection available to registry-backed claims.\nAuthentication remains a reloadable local file reference; core never\nloads the bearer token value.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128093,7 +69980,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128103,74 +69990,64 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "base_url",
-            "workload_client_id",
-            "token_file"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/service_id",
-        "key_path": "evidence.service_id",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/migration_database_url_env",
+        "key_path": "consultation.bootstrap.migration_database_url_env",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128180,7 +70057,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128190,24 +70067,26 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
@@ -128218,35 +70097,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/signing_keys",
-        "key_path": "evidence.signing_keys",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationBootstrapPolicyConfig/properties/owner_role",
+        "key_path": "consultation.bootstrap.owner_role",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128256,7 +70134,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128266,18 +70144,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -128291,41 +70169,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/signing_keys/additionalProperties",
-        "key_path": "evidence.signing_keys.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationConfig/properties/artifacts",
+        "key_path": "consultation.artifacts",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a signing-key binding and each value references the operator-managed signing material and lifecycle metadata.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_signing_keys_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/SigningKeyConfig",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128335,7 +70214,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128345,79 +70224,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "provider",
-            "alg",
-            "kid",
-            "status"
+            "public_contracts",
+            "integration_packs",
+            "private_bindings",
+            "evidence"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/variables",
-        "key_path": "evidence.variables",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationConfig/properties/audit_pseudonym_materials",
+        "key_path": "consultation.audit_pseudonym_materials",
         "path_kind": "property"
       },
-      "purpose": "Closed union of request variables declared by authored services.",
+      "purpose": "Bounded startup catalog of audit-pseudonym material references.\n\nThe 1..=32 bound and cross-entry uniqueness are enforced by config\nvalidation and repeated by the material provider before loading secrets.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
+        "local_reference": "#/$defs/AuditPseudonymMaterialCatalogConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128427,7 +70302,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128437,18 +70312,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -128459,41 +70334,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/variables/additionalProperties",
-        "key_path": "evidence.variables.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationConfig/properties/authorized_workload",
+        "key_path": "consultation.authorized_workload",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a Notary evidence variable and each value defines its bounded source and evaluation contract.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_variables_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/RequestVariableConfig",
+        "local_reference": "#/$defs/ConsultationWorkloadConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128503,7 +70382,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128513,31 +70392,33 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "from",
-            "type"
+            "audience",
+            "client_claim_selector",
+            "client_value",
+            "principal_id"
           ]
         },
         {
@@ -128546,23 +70427,23 @@
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RequestVariableConfig"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationWorkloadConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details",
-        "key_path": "auth.api_keys[].authorization_details",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationConfig/properties/bootstrap",
+        "key_path": "consultation.bootstrap",
         "path_kind": "property"
       },
-      "purpose": "Versioned authorization fields shared by static configuration and token/OIDC JSON.\n\nUnknown metadata is intentionally ignored for forward-compatible interoperability.\nAuthorization decisions consume only the modeled fields and must never infer authority\nfrom an unrecognized extension.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Binds the product-owned first-install policy carried only by the verified consultation bundle; deployment renderers cannot reproduce it as command arguments.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -128577,11 +70458,11 @@
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128591,7 +70472,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128601,34 +70482,36 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "type",
-            "schema_version"
+            "migration_database_url_env",
+            "owner_role",
+            "keyring_maintenance_database_url_env",
+            "keyring_reader_database_url_env",
+            "active_key_id",
+            "active_write_deadline_unix_ms",
+            "audit_event_retention_ms"
           ]
         },
         {
@@ -128642,36 +70525,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details",
-        "key_path": "auth.bearer_tokens[].authorization_details",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationConfig/properties/source_credentials",
+        "key_path": "consultation.source_credentials",
         "path_kind": "property"
       },
-      "purpose": "Versioned authorization fields shared by static configuration and token/OIDC JSON.\n\nUnknown metadata is intentionally ignored for forward-compatible interoperability.\nAuthorization decisions consume only the modeled fields and must never infer authority\nfrom an unrecognized extension.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "local_reference": "#/$defs/ConsultationSourceCredentialCatalogConfig",
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128681,7 +70564,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128691,18 +70574,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -128714,40 +70597,34 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type",
-            "schema_version"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint",
-        "key_path": "auth.api_keys[].fingerprint",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationConfig/properties/state_plane",
+        "key_path": "consultation.state_plane",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/CredentialFingerprintRef",
+        "local_reference": "#/$defs/ConsultationStatePlaneConfig",
         "composed": false
       },
       "requiredness": "required",
@@ -128756,11 +70633,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128770,7 +70647,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128780,33 +70657,33 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "provider"
+            "database_url_env",
+            "chain_key_epoch_id",
+            "serving_fence_lock_key",
+            "audit_pseudonym_keyring_lock_key"
           ]
         },
         {
@@ -128815,41 +70692,41 @@
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationStatePlaneConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint",
-        "key_path": "auth.bearer_tokens[].fingerprint",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/class",
+        "key_path": "consultation.artifacts.evidence[].class",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Closed evidence classes understood by consultation source-plan v1.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/CredentialFingerprintRef",
+        "local_reference": "#/$defs/ConsultationEvidenceClassConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128859,7 +70736,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128869,58 +70746,57 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "provider"
+            "conformance",
+            "negative_security",
+            "minimization"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationEvidenceClassConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/id",
-        "key_path": "auth.api_keys[].id",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/path",
+        "key_path": "consultation.artifacts.evidence[].path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -128937,7 +70813,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -128947,7 +70823,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -128957,18 +70833,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -128988,17 +70864,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/id",
-        "key_path": "auth.bearer_tokens[].id",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/sha256",
+        "key_path": "consultation.artifacts.evidence[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -129007,15 +70883,15 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129025,7 +70901,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129035,29 +70911,30 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -129066,35 +70943,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes",
-        "key_path": "auth.api_keys[].scopes",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig/items",
+        "key_path": "consultation.source_credentials[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Closed V1 source-credential provider configuration.\n\nEnvironment names are opaque references and are redacted from `Debug`.\nThere is deliberately no field capable of carrying an embedded username,\npassword, bearer token, or provider-specific extension.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationSourceCredentialConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129104,7 +70981,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129114,18 +70991,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -129137,43 +71014,77 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "type",
+              "ref",
+              "generation",
+              "client_id_env",
+              "client_secret_env"
+            ],
+            [
+              "type",
+              "ref",
+              "generation",
+              "token_env"
+            ],
+            [
+              "type",
+              "ref",
+              "generation",
+              "username_env",
+              "password_env"
+            ],
+            [
+              "type",
+              "ref",
+              "generation",
+              "value_env"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes",
-        "key_path": "auth.bearer_tokens[].scopes",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/generation",
+        "key_path": "consultation.source_credentials[].generation",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129183,7 +71094,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129193,18 +71104,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -129216,42 +71127,55 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items",
-        "key_path": "auth.api_keys[].scopes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/password_env",
+        "key_path": "consultation.source_credentials[].password_env",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129261,7 +71185,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129271,18 +71195,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -129290,46 +71214,54 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items",
-        "key_path": "auth.bearer_tokens[].scopes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/ref",
+        "key_path": "consultation.source_credentials[].ref",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Exact private-binding credential reference grammar.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationSourceCredentialReference",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129339,7 +71271,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129349,18 +71281,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -129372,43 +71304,50 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialReference"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allow_insecure_localhost",
-        "key_path": "auth.oidc.allow_insecure_localhost",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/type",
+        "key_path": "consultation.source_credentials[].type",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129418,7 +71357,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129428,63 +71367,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "api_key_header",
+            "api_key_query",
+            "basic",
+            "oauth_client_credentials",
+            "static_bearer"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms",
-        "key_path": "auth.oidc.allowed_algorithms",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/username_env",
+        "key_path": "consultation.source_credentials[].username_env",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129494,7 +71446,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129504,62 +71456,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms/items",
-        "key_path": "auth.oidc.allowed_algorithms[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/1/properties/token_env",
+        "key_path": "consultation.source_credentials[].token_env",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129569,7 +71532,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129579,63 +71542,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients",
-        "key_path": "auth.oidc.allowed_clients",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/2/properties/value_env",
+        "key_path": "consultation.source_credentials[].value_env",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129645,7 +71618,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129655,62 +71628,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients/items",
-        "key_path": "auth.oidc.allowed_clients[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_id_env",
+        "key_path": "consultation.source_credentials[].client_id_env",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129720,7 +71704,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129730,63 +71714,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types",
-        "key_path": "auth.oidc.allowed_token_types",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_secret_env",
+        "key_path": "consultation.source_credentials[].client_secret_env",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129796,7 +71790,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129806,18 +71800,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -129825,46 +71819,53 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types/items",
-        "key_path": "auth.oidc.allowed_token_types[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/audit_pseudonym_keyring_lock_key",
+        "key_path": "consultation.state_plane.audit_pseudonym_keyring_lock_key",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129874,7 +71875,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129884,18 +71885,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -129907,43 +71908,54 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences",
-        "key_path": "auth.oidc.audiences",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/chain_key_epoch_id",
+        "key_path": "consultation.state_plane.chain_key_epoch_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -129953,7 +71965,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -129963,18 +71975,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -129988,40 +72000,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences/items",
-        "key_path": "auth.oidc.audiences[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/database_url_env",
+        "key_path": "consultation.state_plane.database_url_env",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Portable environment-variable name that resolves the state-plane URL.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationDatabaseUrlEnvironmentName",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130031,7 +72044,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130041,18 +72054,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -130060,46 +72073,55 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationDatabaseUrlEnvironmentName"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/issuer",
-        "key_path": "auth.oidc.issuer",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/root_certificate_path",
+        "key_path": "consultation.state_plane.root_certificate_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130109,7 +72131,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130119,18 +72141,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -130144,32 +72166,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/jwks_url",
-        "key_path": "auth.oidc.jwks_url",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/serving_fence_lock_key",
+        "key_path": "consultation.state_plane.serving_fence_lock_key",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -130177,7 +72202,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130187,7 +72212,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130197,18 +72222,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -130220,44 +72245,54 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/leeway",
-        "key_path": "auth.oidc.leeway",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
+        "key_path": "consultation.artifacts.integration_packs[].hash",
         "path_kind": "property"
       },
-      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
+      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130267,7 +72302,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130277,67 +72312,69 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/principal_claim",
-        "key_path": "auth.oidc.principal_claim",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
+        "key_path": "consultation.artifacts.private_bindings[].hash",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130347,7 +72384,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130357,26 +72394,33 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -130385,35 +72429,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_claim",
-        "key_path": "auth.oidc.scope_claim",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
+        "key_path": "consultation.artifacts.public_contracts[].hash",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130423,7 +72466,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130433,26 +72476,33 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -130461,35 +72511,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map",
-        "key_path": "auth.oidc.scope_map",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
+        "key_path": "consultation.artifacts.integration_packs[].path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Normalized bundle-root-relative path.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130499,7 +72548,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130509,62 +72558,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties",
-        "key_path": "auth.oidc.scope_map.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
+        "key_path": "consultation.artifacts.private_bindings[].path",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key is an external token scope and each value is the bounded Notary scope mapping granted for that exact token scope.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_oidc_scope_map_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Normalized bundle-root-relative path.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130574,7 +72626,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130584,62 +72636,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties/items",
-        "key_path": "auth.oidc.scope_map.*[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
+        "key_path": "consultation.artifacts.public_contracts[].path",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Normalized bundle-root-relative path.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130649,7 +72704,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130659,23 +72714,26 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -130687,35 +72745,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_separator",
-        "key_path": "auth.oidc.scope_separator",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
+        "key_path": "consultation.artifacts.integration_packs[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130725,7 +72782,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130735,18 +72792,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -130755,6 +72812,10 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -130763,36 +72824,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_endpoint",
-        "key_path": "auth.oidc.userinfo_endpoint",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
+        "key_path": "consultation.artifacts.private_bindings[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130802,7 +72861,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130812,69 +72871,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers",
-        "key_path": "auth.oidc.userinfo_issuers",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
+        "key_path": "consultation.artifacts.public_contracts[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130884,7 +72940,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130894,65 +72950,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers/items",
-        "key_path": "auth.oidc.userinfo_issuers[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationWorkloadConfig/properties/audience",
+        "key_path": "consultation.authorized_workload.audience",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -130962,7 +73019,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -130972,18 +73029,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -131003,35 +73060,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/clock_leeway_seconds",
-        "key_path": "federation.clock_leeway_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_claim_selector",
+        "key_path": "consultation.authorized_workload.client_claim_selector",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Closed set of verified OAuth claims that may identify Registry Notary.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/ConsultationClientClaimSelectorConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131041,7 +73098,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131051,18 +73108,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -131072,51 +73129,52 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "enum",
+          "value": [
+            "azp",
+            "client_id"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationClientClaimSelectorConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/emergency_denylist",
-        "key_path": "federation.emergency_denylist",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_value",
+        "key_path": "consultation.authorized_workload.client_value",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/FederationEmergencyDenylistConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131126,7 +73184,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131136,67 +73194,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/enabled",
-        "key_path": "federation.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationWorkloadConfig/properties/principal_id",
+        "key_path": "consultation.authorized_workload.principal_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131206,7 +73262,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131216,45 +73272,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/evaluation_profiles",
-        "key_path": "federation.evaluation_profiles",
+        "schema": "relay",
+        "pointer": "/$defs/CorsConfig/properties/allowed_origins",
+        "key_path": "server.cors.allowed_origins",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
@@ -131268,11 +73327,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131282,7 +73341,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131292,23 +73351,26 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -131320,35 +73382,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/evaluation_profiles/items",
-        "key_path": "federation.evaluation_profiles[]",
+        "schema": "relay",
+        "pointer": "/$defs/CorsConfig/properties/allowed_origins/items",
+        "key_path": "server.cors.allowed_origins[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/FederationEvaluationProfileConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131358,7 +73419,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131368,76 +73429,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "ruleset",
-            "claim_id",
-            "subject_id_type"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/federation_api",
-        "key_path": "federation.federation_api",
+        "schema": "relay",
+        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/name",
+        "key_path": "auth.api_keys[].fingerprint.name",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/RuntimeEnvironmentNameSchema",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131447,7 +73498,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131457,63 +73508,72 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[^=\\x00]+$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RuntimeEnvironmentNameSchema"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/inbound_body_limit_bytes",
-        "key_path": "federation.inbound_body_limit_bytes",
+        "schema": "relay",
+        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/provider",
+        "key_path": "auth.api_keys[].fingerprint.provider",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131523,7 +73583,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131533,71 +73593,71 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "const",
+          "value": [
+            "env",
+            "file"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/issuer",
-        "key_path": "federation.issuer",
+        "schema": "relay",
+        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/1/properties/path",
+        "key_path": "auth.api_keys[].fingerprint.path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131607,7 +73667,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131617,18 +73677,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -131636,7 +73696,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
@@ -131647,26 +73707,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/jwks_uri",
-        "key_path": "federation.jwks_uri",
+        "schema": "relay",
+        "pointer": "/$defs/CsvFormatConfig/properties/delimiter",
+        "key_path": "datasets[].tables[].source.format.csv.delimiter",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -131675,7 +73736,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131685,7 +73746,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131695,18 +73756,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -131715,33 +73776,49 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint8"
+        },
+        {
+          "keyword": "maximum",
+          "value": 255
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/max_request_lifetime_seconds",
-        "key_path": "federation.max_request_lifetime_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/CsvFormatConfig/properties/header_row",
+        "key_path": "datasets[].tables[].source.format.csv.header_row",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -131751,7 +73828,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131761,7 +73838,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131771,18 +73848,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -131793,7 +73870,11 @@
       "constraints": [
         {
           "keyword": "format",
-          "value": "uint64"
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
         },
         {
           "keyword": "minimum",
@@ -131801,32 +73882,36 @@
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/node_id",
-        "key_path": "federation.node_id",
+        "schema": "relay",
+        "pointer": "/$defs/CsvFormatConfig/properties/quote",
+        "key_path": "datasets[].tables[].source.format.csv.quote",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -131835,7 +73920,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131845,7 +73930,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131855,18 +73940,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -131875,44 +73960,58 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint8"
+        },
+        {
+          "keyword": "maximum",
+          "value": 255
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/pairwise_subject_hash",
-        "key_path": "federation.pairwise_subject_hash",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/access_rights",
+        "key_path": "datasets[].access_rights",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Access rights classification, mirrors DCAT-AP `dcterms:accessRights`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/FederationPairwiseSubjectHashConfig",
+        "local_reference": "#/$defs/AccessRights",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -131922,7 +74021,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -131932,51 +74031,57 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "public",
+            "restricted",
+            "non_public"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPairwiseSubjectHashConfig"
+        "schema": "relay",
+        "pointer": "/$defs/AccessRights"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/peers",
-        "key_path": "federation.peers",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/aggregates",
+        "key_path": "datasets[].aggregates",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
@@ -131987,14 +74092,14 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132004,7 +74109,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132014,18 +74119,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132042,22 +74147,22 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/peers/items",
-        "key_path": "federation.peers[]",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/aggregates/items",
+        "key_path": "datasets[].aggregates[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/FederationPeerConfig",
+        "local_reference": "#/$defs/AggregateConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -132070,7 +74175,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132080,7 +74185,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132090,18 +74195,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132113,9 +74218,9 @@
         {
           "keyword": "required",
           "value": [
-            "node_id",
-            "issuer",
-            "jwks_uri"
+            "id",
+            "description",
+            "disclosure_control"
           ]
         },
         {
@@ -132124,28 +74229,27 @@
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig"
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/response_shaping",
-        "key_path": "federation.response_shaping",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/applicable_legislation",
+        "key_path": "datasets[].applicable_legislation",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "DCAT-AP `dcatap:applicableLegislation` IRIs. This is evidence\npublished for standard consumers, not an application-specific\nauthorization or source-of-truth verdict.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/FederationResponseShapingConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -132159,7 +74263,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132169,7 +74273,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132179,18 +74283,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132201,46 +74305,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationResponseShapingConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/signing",
-        "key_path": "federation.signing",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/applicable_legislation/items",
+        "key_path": "datasets[].applicable_legislation[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/FederationSigningConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132250,7 +74348,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132260,18 +74358,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132280,35 +74378,25 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "signing_key"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationSigningConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions",
-        "key_path": "federation.supported_protocol_versions",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/conforms_to",
+        "key_path": "datasets[].conforms_to",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
@@ -132326,7 +74414,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132336,7 +74424,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132346,18 +74434,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132374,17 +74462,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions/items",
-        "key_path": "federation.supported_protocol_versions[]",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/conforms_to/items",
+        "key_path": "datasets[].conforms_to[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -132401,7 +74489,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132411,7 +74499,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132421,18 +74509,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132449,35 +74537,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids",
-        "key_path": "federation.emergency_denylist.kids",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/defaults",
+        "key_path": "datasets[].defaults",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional table defaults for reducing repetition within one dataset.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/DatasetDefaultsConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132487,7 +74576,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132497,18 +74586,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132519,40 +74608,44 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DatasetDefaultsConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids/items",
-        "key_path": "federation.emergency_denylist.kids[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/description",
+        "key_path": "datasets[].description",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132562,7 +74655,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132572,18 +74665,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132600,17 +74693,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids",
-        "key_path": "federation.emergency_denylist.node_ids",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/entities",
+        "key_path": "datasets[].entities",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
@@ -132621,14 +74714,14 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132638,7 +74731,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132648,18 +74741,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132676,26 +74769,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids/items",
-        "key_path": "federation.emergency_denylist.node_ids[]",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/entities/items",
+        "key_path": "datasets[].entities[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/EntityConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
@@ -132703,84 +74797,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/assurance_level",
-        "key_path": "federation.evaluation_profiles[].assurance_level",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132790,7 +74807,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132800,18 +74817,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132821,36 +74838,47 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "name",
+            "table",
+            "access",
+            "api"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/claim_id",
-        "key_path": "federation.evaluation_profiles[].claim_id",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/id",
+        "key_path": "datasets[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/DatasetId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -132858,7 +74886,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132868,7 +74896,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132878,18 +74906,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132898,44 +74926,50 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DatasetId"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/consent_ref",
-        "key_path": "federation.evaluation_profiles[].consent_ref",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/owner",
+        "key_path": "datasets[].owner",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -132945,7 +74979,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -132955,18 +74989,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -132977,45 +75011,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/disclosure",
-        "key_path": "federation.evaluation_profiles[].disclosure",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/public_services",
+        "key_path": "datasets[].public_services",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "CPSV public services that produce this dataset. Registry Relay emits\nthem as standard `cpsv:PublicService` nodes; consumers decide how to\ninterpret that evidence.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133025,7 +75055,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133035,18 +75065,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133057,43 +75087,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/id",
-        "key_path": "federation.evaluation_profiles[].id",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/public_services/items",
+        "key_path": "datasets[].public_services[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/PublicServiceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133103,7 +75131,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133113,18 +75141,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133133,44 +75161,53 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "title"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/PublicServiceConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/jurisdiction",
-        "key_path": "federation.evaluation_profiles[].jurisdiction",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/sensitivity",
+        "key_path": "datasets[].sensitivity",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Sensitivity classification. Operator-defined values cover common\npersonal and public dataset classifications in V1.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/Sensitivity",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133180,7 +75217,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133190,18 +75227,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133211,27 +75248,38 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "public",
+            "internal",
+            "personal",
+            "confidential",
+            "secret"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/Sensitivity"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/legal_basis_ref",
-        "key_path": "federation.evaluation_profiles[].legal_basis_ref",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/spatial_coverage",
+        "key_path": "datasets[].spatial_coverage",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "BRegDCAT-AP: `dct:spatial` IRI for this dataset. Overrides the\ncatalog-level `default_spatial_coverage` when set.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -133243,14 +75291,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133260,7 +75308,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133270,18 +75318,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133301,36 +75349,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/max_claim_result_age_seconds",
-        "key_path": "federation.evaluation_profiles[].max_claim_result_age_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/status",
+        "key_path": "datasets[].status",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Publishes the dataset lifecycle status; when omitted, Relay emits its weakest lifecycle claim instead of inferring a stronger status.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "null",
+          "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133340,7 +75388,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133350,18 +75398,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133371,52 +75419,54 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "enum",
+          "value": [
+            "under_development",
+            "completed",
+            "deprecated",
+            "withdrawn"
+          ]
         },
         {
           "keyword": "type",
           "value": [
-            "integer",
-            "null"
+            "null",
+            "string"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/ruleset",
-        "key_path": "federation.evaluation_profiles[].ruleset",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/tables",
+        "key_path": "datasets[].tables",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133426,7 +75476,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133436,18 +75486,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133458,40 +75508,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/subject_id_type",
-        "key_path": "federation.evaluation_profiles[].subject_id_type",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/tables/items",
+        "key_path": "datasets[].tables[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One private storage table under a dataset.\n\nThe public API should not expose these ids. Entity config maps one\nresource into one domain resource, with optional field renaming and\nrelationship declarations.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ResourceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133501,7 +75552,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133511,65 +75562,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "source",
+            "schema"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPairwiseSubjectHashConfig/properties/secret_env",
-        "key_path": "federation.pairwise_subject_hash.secret_env",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/title",
+        "key_path": "datasets[].title",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133579,7 +75639,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133589,26 +75649,24 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -133619,35 +75677,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_localhost",
-        "key_path": "federation.peers[].allow_insecure_localhost",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig/properties/update_frequency",
+        "key_path": "datasets[].update_frequency",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Update cadence; mirrors DCAT-AP `dcterms:accrualPeriodicity`. The\nV1 set is the codes used by the example plus the common alternates.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
+        "local_reference": "#/$defs/UpdateFrequency",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133657,7 +75715,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133667,18 +75725,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133687,43 +75745,63 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "continuous",
+            "daily",
+            "weekly",
+            "termly",
+            "monthly",
+            "quarterly",
+            "annual",
+            "irregular",
+            "as_needed",
+            "unknown"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/UpdateFrequency"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_private_network",
-        "key_path": "federation.peers[].allow_insecure_private_network",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetDefaultsConfig/properties/materialization",
+        "key_path": "datasets[].defaults.materialization",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "How a configured private table is registered for query planning.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133733,7 +75811,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133743,18 +75821,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133763,43 +75841,53 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "snapshot"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles",
-        "key_path": "federation.peers[].allowed_profiles",
+        "schema": "relay",
+        "pointer": "/$defs/DatasetDefaultsConfig/properties/refresh",
+        "key_path": "datasets[].defaults.refresh",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133809,7 +75897,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133819,18 +75907,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133839,42 +75927,59 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "mode",
+              "interval"
+            ],
+            [
+              "mode"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles/items",
-        "key_path": "federation.peers[].allowed_profiles[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentConfig/properties/evidence",
+        "key_path": "deployment.evidence",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/DeploymentEvidenceConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133884,7 +75989,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133894,18 +75999,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133916,32 +76021,37 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentEvidenceConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions",
-        "key_path": "federation.peers[].allowed_protocol_versions",
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentConfig/properties/profile",
+        "key_path": "deployment.profile",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -133950,7 +76060,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -133960,7 +76070,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -133970,18 +76080,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -133990,42 +76100,55 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "local",
+            "hosted_lab",
+            "production",
+            "evidence_grade"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions/items",
-        "key_path": "federation.peers[].allowed_protocol_versions[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentConfig/properties/waivers",
+        "key_path": "deployment.waivers",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Per-deployment waivers. Each names one finding id, a required operator\nreference, an optional summary, and a mandatory expiry date. Expired\nwaivers stop suppressing their finding and raise\n`deployment.waiver_expired`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134035,7 +76158,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134045,18 +76168,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -134067,41 +76190,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes",
-        "key_path": "federation.peers[].allowed_purposes",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentConfig/properties/waivers/items",
+        "key_path": "deployment.waivers[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One declared waiver. `expires` is an ISO 8601 `YYYY-MM-DD` date; format is\nvalidated at load time. The reference and optional summary are validated by\nthe shared operations contract before either can reach posture or logs.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/DeploymentWaiverConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134111,7 +76234,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134121,18 +76244,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -134141,42 +76264,55 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "finding",
+            "reference",
+            "expires"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentWaiverConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes/items",
-        "key_path": "federation.peers[].allowed_purposes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/api_key_rotation",
+        "key_path": "deployment.evidence.api_key_rotation",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Operator asserts an API-key rotation process is in place.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134186,7 +76322,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134196,63 +76332,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes",
-        "key_path": "federation.peers[].evaluation_scopes",
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path",
+        "key_path": "deployment.evidence.audit_ack_cursor_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. When set, the runtime reads it to\nobserve shipping freshness and surfaces it as posture shipping health;\nabsent, shipping health stays `unverified` and only the declared\nshipping target is reported.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134262,7 +76401,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134272,62 +76411,69 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes/items",
-        "key_path": "federation.peers[].evaluation_scopes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs",
+        "key_path": "deployment.evidence.audit_ack_max_age_secs",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional freshness window in seconds for the ack cursor's `acked_at`\ntimestamp. Defaults to `DEFAULT_AUDIT_ACK_MAX_AGE` (900) when unset. A\nwindow without `audit_ack_cursor_path` is rejected at load, since a\nfreshness window is meaningless without a cursor to observe.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134337,7 +76483,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134347,18 +76493,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -134367,42 +76513,58 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/issuer",
-        "key_path": "federation.peers[].issuer",
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping",
+        "key_path": "deployment.evidence.audit_offhost_shipping",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Operator asserts audit records are shipped off-host (for example to a\nlog collector or SIEM) rather than relying solely on local retention.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134412,7 +76574,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134422,64 +76584,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/jwks_uri",
-        "key_path": "federation.peers[].jwks_uri",
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/ingress_rate_limit",
+        "key_path": "deployment.evidence.ingress_rate_limit",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Operator asserts ingress rate limiting is enforced (for example by a\ngateway or reverse proxy in front of the relay).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134489,7 +76650,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134499,18 +76660,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -134521,23 +76682,23 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/node_id",
-        "key_path": "federation.peers[].node_id",
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/expires",
+        "key_path": "deployment.waivers[].expires",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -134554,7 +76715,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134564,7 +76725,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134574,18 +76735,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -134602,35 +76763,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationResponseShapingConfig/properties/minimum_denial_latency_ms",
-        "key_path": "federation.response_shaping.minimum_denial_latency_ms",
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/finding",
+        "key_path": "deployment.waivers[].finding",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134640,7 +76800,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134650,18 +76810,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -134670,50 +76830,43 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationSigningConfig/properties/signing_key",
-        "key_path": "federation.signing.signing_key",
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/reference",
+        "key_path": "deployment.waivers[].reference",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/DeploymentWaiverReference",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134723,7 +76876,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134733,65 +76886,80 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentWaiverReference"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods",
-        "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods",
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/summary",
+        "key_path": "deployment.waivers[].summary",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/DeploymentWaiverSummary",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134801,7 +76969,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134811,65 +76979,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentWaiverSummary"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods/items",
-        "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method",
+        "key_path": "datasets[].aggregates[].disclosure_control.method",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134879,7 +77057,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134889,66 +77067,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig/properties/mode",
-        "key_path": "evidence.credential_profiles.*.holder_binding.mode",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.method",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -134958,7 +77133,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -134968,67 +77143,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig/properties/proof_of_possession",
-        "key_path": "evidence.credential_profiles.*.holder_binding.proof_of_possession",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.method",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135038,7 +77209,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135048,69 +77219,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/MachineQuotaConfig/properties/enabled",
-        "key_path": "evidence.machine_quota.enabled",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
+        "key_path": "datasets[].aggregates[].disclosure_control.method[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135120,7 +77284,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135130,18 +77294,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -135152,41 +77316,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/MachineQuotaConfig/properties/subjects_per_minute",
-        "key_path": "evidence.machine_quota.subjects_per_minute",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.method[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135196,7 +77359,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135206,74 +77369,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/environment",
-        "key_path": "instance.environment",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.method[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135283,7 +77434,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135293,23 +77444,24 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -135320,26 +77472,26 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/id",
-        "key_path": "instance.id",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
+        "key_path": "datasets[].aggregates[].disclosure_control.min_cell_size",
         "path_kind": "property"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -135348,7 +77500,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135358,7 +77510,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135368,63 +77520,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/jurisdiction",
-        "key_path": "instance.jurisdiction",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_cell_size",
         "path_kind": "property"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135434,7 +77598,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135444,66 +77608,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/owner",
-        "key_path": "instance.owner",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_cell_size",
         "path_kind": "property"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135513,7 +77686,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135523,66 +77696,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/public_base_url",
-        "key_path": "instance.public_base_url",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
+        "key_path": "datasets[].aggregates[].disclosure_control.min_group_size",
         "path_kind": "property"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135592,7 +77775,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135602,32 +77785,42 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
+            "integer",
             "null"
           ]
         }
@@ -135635,26 +77828,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciAuthorizationConfig/properties/require_pkce_method",
-        "key_path": "oid4vci.authorization.require_pkce_method",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_group_size",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -135663,7 +77857,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135673,7 +77867,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135683,18 +77877,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -135703,43 +77897,59 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences",
-        "key_path": "oid4vci.accepted_token_audiences",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_group_size",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135749,7 +77959,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135759,65 +77969,78 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences/items",
-        "key_path": "oid4vci.accepted_token_audiences[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
+        "key_path": "datasets[].aggregates[].disclosure_control.report_suppressed_rows",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135827,7 +78050,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135837,53 +78060,49 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/authorization",
-        "key_path": "oid4vci.authorization",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.report_suppressed_rows",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
-        "local_reference": "#/$defs/Oid4vciAuthorizationConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -135897,7 +78116,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135907,7 +78126,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135917,18 +78136,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -135939,30 +78158,26 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciAuthorizationConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers",
-        "key_path": "oid4vci.authorization_servers",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.report_suppressed_rows",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "boolean"
         ],
         "composed": false
       },
@@ -135977,7 +78192,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -135987,7 +78202,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -135997,18 +78212,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -136019,40 +78234,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers/items",
-        "key_path": "oid4vci.authorization_servers[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
+        "key_path": "datasets[].aggregates[].disclosure_control.suppression",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136062,7 +78279,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136072,18 +78289,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -136092,43 +78309,56 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "mask",
+            "null",
+            "omit"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/Suppression"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations",
-        "key_path": "oid4vci.credential_configurations",
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.suppression",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136138,7 +78368,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136148,66 +78378,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "mask",
+            "null",
+            "omit"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/Suppression"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations/additionalProperties",
-        "key_path": "oid4vci.credential_configurations.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.suppression",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names an OpenID4VCI credential configuration and each value defines the advertised and issued credential contract.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_credential_configurations_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/Oid4vciCredentialConfigurationConfig",
+        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136217,7 +78457,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136227,80 +78467,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "const",
           "value": [
-            "credential_profile",
-            "format",
-            "scope",
-            "vct",
-            "display_name"
+            "mask",
+            "null",
+            "omit"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig"
+        "schema": "relay",
+        "pointer": "/$defs/Suppression"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/credential_endpoint",
-        "key_path": "oid4vci.credential_endpoint",
+        "schema": "relay",
+        "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/id",
+        "key_path": "metadata.ecosystem_binding.id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_metadata_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136310,7 +78544,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136320,27 +78554,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -136351,35 +78581,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/credential_issuer",
-        "key_path": "oid4vci.credential_issuer",
+        "schema": "relay",
+        "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/version",
+        "key_path": "metadata.ecosystem_binding.version",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_metadata_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136389,7 +78620,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136399,66 +78630,64 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/display",
-        "key_path": "oid4vci.display",
+        "schema": "relay",
+        "pointer": "/$defs/EntityAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].entities[].access.aggregate_scope",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136468,7 +78697,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136478,18 +78707,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -136500,41 +78729,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/display/items",
-        "key_path": "oid4vci.display[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/EntityAccessConfig/properties/evidence_verification_scope",
+        "key_path": "datasets[].entities[].access.evidence_verification_scope",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/Oid4vciIssuerDisplayConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136544,7 +78773,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136554,18 +78783,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -136574,53 +78803,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciIssuerDisplayConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/enabled",
-        "key_path": "oid4vci.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/EntityAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].entities[].access.metadata_scope",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136630,7 +78848,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136640,18 +78858,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -136662,42 +78880,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/nonce",
-        "key_path": "oid4vci.nonce",
+        "schema": "relay",
+        "pointer": "/$defs/EntityAccessConfig/properties/read_scope",
+        "key_path": "datasets[].entities[].access.read_scope",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/Oid4vciNonceConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136707,7 +78923,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136717,18 +78933,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -136739,46 +78955,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciNonceConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/nonce_endpoint",
-        "key_path": "oid4vci.nonce_endpoint",
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions",
+        "key_path": "datasets[].entities[].api.allowed_expansions",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136788,7 +78999,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136798,69 +79009,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/offer_endpoint",
-        "key_path": "oid4vci.offer_endpoint",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions/items",
+        "key_path": "datasets[].entities[].api.allowed_expansions[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136870,7 +79074,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136880,26 +79084,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -136911,36 +79112,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/pre_authorized_code",
-        "key_path": "oid4vci.pre_authorized_code",
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/allowed_filters",
+        "key_path": "datasets[].entities[].api.allowed_filters",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/Oid4vciPreAuthorizedCodeConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -136950,7 +79150,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -136960,18 +79160,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -136982,46 +79182,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/proof",
-        "key_path": "oid4vci.proof",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].entities[].api.allowed_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/Oid4vciProofConfig",
+        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137031,7 +79226,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137041,18 +79236,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -137061,46 +79256,53 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field",
+            "ops"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciProofConfig"
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/display_name",
-        "key_path": "oid4vci.credential_configurations.*.claims[].display_name",
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/default_limit",
+        "key_path": "datasets[].entities[].api.default_limit",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137110,7 +79312,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137120,65 +79322,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/id",
-        "key_path": "oid4vci.credential_configurations.*.claims[].id",
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/governed_policy",
+        "key_path": "datasets[].entities[].api.governed_policy",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137188,7 +79401,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137198,51 +79411,51 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path",
-        "key_path": "oid4vci.credential_configurations.*.claims[].output_path",
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/max_limit",
+        "key_path": "datasets[].entities[].api.max_limit",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -137252,11 +79465,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137266,7 +79479,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137276,65 +79489,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path/items",
-        "key_path": "oid4vci.credential_configurations.*.claims[].output_path[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/require_purpose_header",
+        "key_path": "datasets[].entities[].api.require_purpose_header",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137344,7 +79567,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137354,65 +79577,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/sd",
-        "key_path": "oid4vci.credential_configurations.*.claims[].sd",
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings",
+        "key_path": "datasets[].entities[].api.required_filter_bindings",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the query.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137422,7 +79643,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137432,67 +79653,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claim_id",
-        "key_path": "oid4vci.credential_configurations.*.claim_id",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings/items",
+        "key_path": "datasets[].entities[].api.required_filter_bindings[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137502,7 +79719,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137512,51 +79729,55 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "field"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims",
-        "key_path": "oid4vci.credential_configurations.*.claims",
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/required_filters",
+        "key_path": "datasets[].entities[].api.required_filters",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Alternative fields that can satisfy the row-scope gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
@@ -137567,14 +79788,14 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137584,7 +79805,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137594,26 +79815,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -137625,35 +79843,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims/items",
-        "key_path": "oid4vci.credential_configurations.*.claims[]",
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig/properties/required_filters/items",
+        "key_path": "datasets[].entities[].api.required_filters[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/Oid4vciCredentialClaimConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137663,7 +79880,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137673,78 +79890,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "output_path",
-            "display_name",
-            "sd"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/credential_profile",
-        "key_path": "oid4vci.credential_configurations.*.credential_profile",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/access",
+        "key_path": "datasets[].entities[].access",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/EntityAccessConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137754,7 +79956,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137764,48 +79966,57 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "metadata_scope",
+            "aggregate_scope",
+            "read_scope"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/EntityAccessConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported",
-        "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/aggregates",
+        "key_path": "datasets[].entities[].aggregates",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "array"
@@ -137816,14 +80027,14 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137833,7 +80044,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137843,26 +80054,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -137874,34 +80082,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported/items",
-        "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported[]",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/aggregates/items",
+        "key_path": "datasets[].entities[].aggregates[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137911,7 +80120,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -137921,67 +80130,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "description",
+            "disclosure_control"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display",
-        "key_path": "oid4vci.credential_configurations.*.display",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/api",
+        "key_path": "datasets[].entities[].api",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/Oid4vciCredentialDisplayConfig",
+        "local_reference": "#/$defs/EntityApiConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -137991,7 +80208,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138001,69 +80218,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "default_limit",
+            "max_limit"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig"
+        "schema": "relay",
+        "pointer": "/$defs/EntityApiConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display_name",
-        "key_path": "oid4vci.credential_configurations.*.display_name",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles",
+        "key_path": "datasets[].entities[].attribute_release_profiles",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Governed identity attribute-release profiles attached to this entity.\nEach profile resolves exactly one subject and returns only the\nconfigured, minimised claims. Empty by default (feature opt-in).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138073,7 +80295,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138083,65 +80305,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/format",
-        "key_path": "oid4vci.credential_configurations.*.format",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles/items",
+        "key_path": "datasets[].entities[].attribute_release_profiles[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "A governed identity attribute-release profile. A profile is a\nprojection-limited, exactly-one-subject lookup that maps a configured set of\nsource fields (or CEL-computed expressions) into a minimised\nOIDC/UserInfo-style claim bundle. Every profile is purpose-bound and requires\na matching `data-purpose` at resolve time. Identified globally by the\n`(id, version)` pair; both are required path segments at resolve time.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AttributeReleaseProfile",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138151,7 +80371,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138161,66 +80381,79 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "version",
+            "purpose",
+            "release_scope",
+            "subject",
+            "claims"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported",
-        "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/concept_uri",
+        "key_path": "datasets[].entities[].concept_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138230,7 +80463,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138240,65 +80473,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported/items",
-        "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/description",
+        "key_path": "datasets[].entities[].description",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138308,7 +80543,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138318,67 +80553,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/representative_issuance",
-        "key_path": "oid4vci.credential_configurations.*.representative_issuance",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/fields",
+        "key_path": "datasets[].entities[].fields",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138388,7 +80622,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138398,75 +80632,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "ceremony",
-            "relationship"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/scope",
-        "key_path": "oid4vci.credential_configurations.*.scope",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/fields/items",
+        "key_path": "datasets[].entities[].fields[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/EntityFieldConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138476,7 +80698,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138486,48 +80708,55 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/EntityFieldConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/vct",
-        "key_path": "oid4vci.credential_configurations.*.vct",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/name",
+        "key_path": "datasets[].entities[].name",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -138540,11 +80769,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138554,7 +80783,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138564,26 +80793,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -138595,36 +80821,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_color",
-        "key_path": "oid4vci.credential_configurations.*.display.background_color",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/relationships",
+        "key_path": "datasets[].entities[].relationships",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138634,7 +80859,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138644,70 +80869,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_image",
-        "key_path": "oid4vci.credential_configurations.*.display.background_image",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/relationships/items",
+        "key_path": "datasets[].entities[].relationships[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/EntityRelationshipConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138717,7 +80935,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138727,70 +80945,77 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "null",
-            "object"
+            "name",
+            "kind",
+            "target",
+            "foreign_key"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/EntityRelationshipConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/description",
-        "key_path": "oid4vci.credential_configurations.*.display.description",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/spatial",
+        "key_path": "datasets[].entities[].spatial",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138800,7 +81025,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138810,70 +81035,72 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "geometry"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/locale",
-        "key_path": "oid4vci.credential_configurations.*.display.locale",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/table",
+        "key_path": "datasets[].entities[].table",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Resource identifier within a dataset.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/ResourceId",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138883,7 +81110,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138893,70 +81120,72 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceId"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/logo",
-        "key_path": "oid4vci.credential_configurations.*.display.logo",
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/title",
+        "key_path": "datasets[].entities[].title",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -138966,7 +81195,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -138976,70 +81205,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/secondary_image",
-        "key_path": "oid4vci.credential_configurations.*.display.secondary_image",
+        "schema": "relay",
+        "pointer": "/$defs/EntityFieldConfig/properties/codelist",
+        "key_path": "datasets[].entities[].fields[].codelist",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139049,7 +81275,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139059,51 +81285,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/text_color",
-        "key_path": "oid4vci.credential_configurations.*.display.text_color",
+        "schema": "relay",
+        "pointer": "/$defs/EntityFieldConfig/properties/concept_uri",
+        "key_path": "datasets[].entities[].fields[].concept_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -139115,14 +81338,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139132,7 +81355,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139142,26 +81365,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -139176,17 +81396,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-        "key_path": "oid4vci.credential_configurations.*.display.background_image.alt_text",
+        "schema": "relay",
+        "pointer": "/$defs/EntityFieldConfig/properties/from",
+        "key_path": "datasets[].entities[].fields[].from",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -139198,14 +81418,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139215,7 +81435,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139225,26 +81445,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -139259,17 +81476,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-        "key_path": "oid4vci.credential_configurations.*.display.logo.alt_text",
+        "schema": "relay",
+        "pointer": "/$defs/EntityFieldConfig/properties/language",
+        "key_path": "datasets[].entities[].fields[].language",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -139281,14 +81498,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139298,7 +81515,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139308,26 +81525,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -139342,36 +81556,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.alt_text",
+        "schema": "relay",
+        "pointer": "/$defs/EntityFieldConfig/properties/name",
+        "key_path": "datasets[].entities[].fields[].name",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139381,7 +81593,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139391,70 +81603,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-        "key_path": "oid4vci.display[].logo.alt_text",
+        "schema": "relay",
+        "pointer": "/$defs/EntityFieldConfig/properties/sensitive",
+        "key_path": "datasets[].entities[].fields[].sensitive",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139464,7 +81669,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139474,18 +81679,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -139496,26 +81701,23 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-        "key_path": "oid4vci.credential_configurations.*.display.background_image.uri",
+        "schema": "relay",
+        "pointer": "/$defs/EntityFieldConfig/properties/unit",
+        "key_path": "datasets[].entities[].fields[].unit",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -139527,14 +81729,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139544,7 +81746,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139554,26 +81756,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -139588,17 +81787,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-        "key_path": "oid4vci.credential_configurations.*.display.logo.uri",
+        "schema": "relay",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/concept_uri",
+        "key_path": "datasets[].entities[].relationships[].concept_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -139610,14 +81809,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139627,7 +81826,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139637,26 +81836,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -139671,36 +81867,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.uri",
+        "schema": "relay",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/foreign_key",
+        "key_path": "datasets[].entities[].relationships[].foreign_key",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139710,7 +81904,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139720,18 +81914,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -139739,51 +81933,46 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-        "key_path": "oid4vci.display[].logo.uri",
+        "schema": "relay",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/kind",
+        "key_path": "datasets[].entities[].relationships[].kind",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/RelationshipKind",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139793,7 +81982,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139803,18 +81992,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -139824,46 +82013,53 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "belongs_to",
+            "has_many",
+            "has_one"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RelationshipKind"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-        "key_path": "oid4vci.credential_configurations.*.display.background_image.url",
+        "schema": "relay",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/name",
+        "key_path": "datasets[].entities[].relationships[].name",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139873,7 +82069,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139883,70 +82079,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-        "key_path": "oid4vci.credential_configurations.*.display.logo.url",
+        "schema": "relay",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/target",
+        "key_path": "datasets[].entities[].relationships[].target",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -139956,7 +82144,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -139966,70 +82154,64 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.url",
+        "schema": "relay",
+        "pointer": "/$defs/EntitySpatialConfig/properties/bbox_fields",
+        "key_path": "datasets[].entities[].spatial.bbox_fields",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140039,7 +82221,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140049,51 +82231,57 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-        "key_path": "oid4vci.display[].logo.url",
+        "schema": "relay",
+        "pointer": "/$defs/EntitySpatialConfig/properties/collection_id",
+        "key_path": "datasets[].entities[].spatial.collection_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -140105,14 +82293,14 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140122,7 +82310,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140132,26 +82320,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -140166,26 +82351,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/allow_insecure_localhost",
-        "key_path": "oid4vci.pre_authorized_code.esignet.allow_insecure_localhost",
+        "schema": "relay",
+        "pointer": "/$defs/EntitySpatialConfig/properties/datetime_field",
+        "key_path": "datasets[].entities[].spatial.datetime_field",
         "path_kind": "property"
       },
-      "purpose": "Allow `http` loopback URLs for the eSignet endpoints and JWKS transport.\nFor local development and tests only.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -140194,7 +82380,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140204,7 +82390,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140214,18 +82400,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -140236,41 +82422,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/authorize_url",
-        "key_path": "oid4vci.pre_authorized_code.esignet.authorize_url",
+        "schema": "relay",
+        "pointer": "/$defs/EntitySpatialConfig/properties/description",
+        "key_path": "datasets[].entities[].spatial.description",
         "path_kind": "property"
       },
-      "purpose": "eSignet authorize endpoint.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140280,7 +82470,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140290,66 +82480,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_id",
-        "key_path": "oid4vci.pre_authorized_code.esignet.client_id",
+        "schema": "relay",
+        "pointer": "/$defs/EntitySpatialConfig/properties/geometry",
+        "key_path": "datasets[].entities[].spatial.geometry",
         "path_kind": "property"
       },
-      "purpose": "Confidential client id the Notary presents to eSignet.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/SpatialGeometryConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140359,7 +82549,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140369,66 +82559,83 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "kind",
+              "field",
+              "crs"
+            ],
+            [
+              "kind",
+              "longitude_field",
+              "latitude_field",
+              "crs"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/SpatialGeometryConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_signing_key_id",
-        "key_path": "oid4vci.pre_authorized_code.esignet.client_signing_key_id",
+        "schema": "relay",
+        "pointer": "/$defs/EntitySpatialConfig/properties/max_bbox_degrees",
+        "key_path": "datasets[].entities[].spatial.max_bbox_degrees",
         "path_kind": "property"
       },
-      "purpose": "`evidence.signing_keys` entry used to sign the eSignet\n`private_key_jwt` client assertion.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "number"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140438,7 +82645,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140448,66 +82655,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "double"
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "number"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/issuer",
-        "key_path": "oid4vci.pre_authorized_code.esignet.issuer",
+        "schema": "relay",
+        "pointer": "/$defs/EntitySpatialConfig/properties/max_geometry_vertices",
+        "key_path": "datasets[].entities[].spatial.max_geometry_vertices",
         "path_kind": "property"
       },
-      "purpose": "eSignet OIDC issuer, pinned when validating the returned `id_token`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140517,7 +82725,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140527,56 +82735,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/jwks_uri",
-        "key_path": "oid4vci.pre_authorized_code.esignet.jwks_uri",
+        "schema": "relay",
+        "pointer": "/$defs/EntitySpatialConfig/properties/title",
+        "key_path": "datasets[].entities[].spatial.title",
         "path_kind": "property"
       },
-      "purpose": "eSignet JWKS URI, used to resolve the `id_token` signing key by `kid`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
@@ -140586,7 +82804,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140596,7 +82814,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140606,18 +82824,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -140628,32 +82846,36 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/login_state_ttl_seconds",
-        "key_path": "oid4vci.pre_authorized_code.esignet.login_state_ttl_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig/properties/codelist",
+        "key_path": "datasets[].tables[].schema.fields[].codelist",
         "path_kind": "property"
       },
-      "purpose": "Lifetime of the short-lived login state (PKCE verifier + nonce +\nselection) reserved between `offer/start` and `offer/callback`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -140662,7 +82884,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140672,7 +82894,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140682,18 +82904,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -140702,41 +82924,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/redirect_uri",
-        "key_path": "oid4vci.pre_authorized_code.esignet.redirect_uri",
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig/properties/concept_uri",
+        "key_path": "datasets[].tables[].schema.fields[].concept_uri",
         "path_kind": "property"
       },
-      "purpose": "Notary callback the citizen browser is redirected back to.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
@@ -140746,7 +82964,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140756,7 +82974,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140766,18 +82984,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -140788,32 +83006,36 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes",
-        "key_path": "oid4vci.pre_authorized_code.esignet.scopes",
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig/properties/language",
+        "key_path": "datasets[].tables[].schema.fields[].language",
         "path_kind": "property"
       },
-      "purpose": "OAuth scopes requested at eSignet.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -140822,7 +83044,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140832,7 +83054,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140842,18 +83064,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -140864,40 +83086,43 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes/items",
-        "key_path": "oid4vci.pre_authorized_code.esignet.scopes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig/properties/name",
+        "key_path": "datasets[].tables[].schema.fields[].name",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140907,7 +83132,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140917,18 +83142,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -140945,35 +83170,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/token_url",
-        "key_path": "oid4vci.pre_authorized_code.esignet.token_url",
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig/properties/nullable",
+        "key_path": "datasets[].tables[].schema.fields[].nullable",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -140983,7 +83208,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -140993,66 +83218,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/userinfo_url",
-        "key_path": "oid4vci.pre_authorized_code.esignet.userinfo_url",
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig/properties/sensitive",
+        "key_path": "datasets[].tables[].schema.fields[].sensitive",
         "path_kind": "property"
       },
-      "purpose": "eSignet userinfo endpoint. Required when the subject-binding claim is\nsourced from userinfo rather than the `id_token`; the callback fetches\nthe userinfo JWS with the eSignet access token and reads the binding\nclaim from it.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141062,7 +83284,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141072,67 +83294,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/locale",
-        "key_path": "oid4vci.display[].locale",
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig/properties/type",
+        "key_path": "datasets[].tables[].schema.fields[].type",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Physical type of a column. The set is fixed in V1; semantic types\nare carried via `concept_uri`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/FieldType",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141142,7 +83360,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141152,18 +83370,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141173,46 +83391,58 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
             "string",
-            "null"
+            "number",
+            "integer",
+            "boolean",
+            "date",
+            "timestamp"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FieldType"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/logo",
-        "key_path": "oid4vci.display[].logo",
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig/properties/unit",
+        "key_path": "datasets[].tables[].schema.fields[].unit",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141222,7 +83452,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141232,18 +83462,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141255,42 +83485,43 @@
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/name",
-        "key_path": "oid4vci.display[].name",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance",
+        "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141300,7 +83531,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141310,18 +83541,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141332,41 +83563,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciNonceConfig/properties/enabled",
-        "key_path": "oid4vci.nonce.enabled",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance/items",
+        "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141376,7 +83606,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141386,18 +83616,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141408,31 +83638,32 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciNonceConfig/properties/ttl_seconds",
-        "key_path": "oid4vci.nonce.ttl_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/max_source_age_seconds",
+        "key_path": "datasets[].entities[].api.governed_policy.max_source_age_seconds",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -141442,7 +83673,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141452,7 +83683,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141462,18 +83693,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141486,38 +83717,46 @@
           "keyword": "format",
           "value": "uint64"
         },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
         {
           "keyword": "minimum",
           "value": 0
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/enabled",
-        "key_path": "oid4vci.pre_authorized_code.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/minimum_assurance",
+        "key_path": "datasets[].entities[].api.governed_policy.minimum_assurance",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -141526,7 +83765,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141536,7 +83775,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141546,18 +83785,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141568,28 +83807,30 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/esignet",
-        "key_path": "oid4vci.pre_authorized_code.esignet",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions",
+        "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/Oid4vciEsignetRpConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -141603,7 +83844,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141613,7 +83854,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141623,18 +83864,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141645,45 +83886,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/pre_authorized_code_ttl_seconds",
-        "key_path": "oid4vci.pre_authorized_code.pre_authorized_code_ttl_seconds",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions/items",
+        "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Pre-authorized-code lifetime in seconds.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141693,7 +83929,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141703,18 +83939,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141723,38 +83959,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/tx_code",
-        "key_path": "oid4vci.pre_authorized_code.tx_code",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes",
+        "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes",
         "path_kind": "property"
       },
-      "purpose": "`tx_code` (PIN) policy for the pre-authorized-code grant. A `tx_code` is\nrequired by default because a code without a PIN is a bearer credential.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/Oid4vciTxCodeConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -141768,7 +83995,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141778,7 +84005,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141788,18 +84015,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141810,45 +84037,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciTxCodeConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciProofConfig/properties/max_age_seconds",
-        "key_path": "oid4vci.proof.max_age_seconds",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes/items",
+        "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141858,7 +84080,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141868,18 +84090,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141888,36 +84110,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciProofConfig/properties/max_clock_skew_seconds",
-        "key_path": "oid4vci.proof.max_clock_skew_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields",
+        "key_path": "datasets[].entities[].api.governed_policy.redaction_fields",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -141932,7 +84146,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -141942,7 +84156,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -141952,18 +84166,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -141972,51 +84186,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciRepresentativeIssuanceConfig/properties/ceremony",
-        "key_path": "oid4vci.credential_configurations.*.representative_issuance.ceremony",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields/items",
+        "key_path": "datasets[].entities[].api.governed_policy.redaction_fields[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/Oid4vciRepresentativeIssuanceCeremony",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142026,7 +84231,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142036,75 +84241,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "digitally_authenticated_representative"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciRepresentativeIssuanceCeremony"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciRepresentativeIssuanceConfig/properties/relationship",
-        "key_path": "oid4vci.credential_configurations.*.representative_issuance.relationship",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/require_consent",
+        "key_path": "datasets[].entities[].api.governed_policy.require_consent",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142114,7 +84307,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142124,57 +84317,54 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/input_mode",
-        "key_path": "oid4vci.pre_authorized_code.tx_code.input_mode",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/require_legal_basis",
+        "key_path": "datasets[].entities[].api.governed_policy.require_legal_basis",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -142183,7 +84373,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142193,7 +84383,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142203,18 +84393,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -142225,41 +84415,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/length",
-        "key_path": "oid4vci.pre_authorized_code.tx_code.length",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/trusted_context",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/GovernedTrustedContextConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142269,7 +84460,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142279,18 +84470,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -142299,42 +84490,39 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/GovernedTrustedContextConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/required",
-        "key_path": "oid4vci.pre_authorized_code.tx_code.required",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/asserted_assurance",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.asserted_assurance",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -142343,7 +84531,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142353,7 +84541,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142363,18 +84551,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -142385,23 +84573,26 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/authentication_level_of_assurance",
-        "key_path": "evidence.claims[].oots.authentication_level_of_assurance",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/consent_ref",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.consent_ref",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -142420,7 +84611,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142430,7 +84621,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142440,18 +84631,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -142471,26 +84662,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/enabled",
-        "key_path": "evidence.claims[].oots.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/jurisdiction",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.jurisdiction",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -142499,7 +84691,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142509,7 +84701,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142519,18 +84711,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -142541,23 +84733,26 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/evidence_type_classification",
-        "key_path": "evidence.claims[].oots.evidence_type_classification",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/legal_basis_ref",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.legal_basis_ref",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -142576,7 +84771,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142586,7 +84781,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142596,18 +84791,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -142627,27 +84822,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/evidence_type_list",
-        "key_path": "evidence.claims[].oots.evidence_type_list",
+        "schema": "relay",
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/source_observed_age_seconds",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.source_observed_age_seconds",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -142656,7 +84851,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142666,7 +84861,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -142676,18 +84871,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -142696,10 +84891,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
+            "integer",
             "null"
           ]
         }
@@ -142707,35 +84914,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/languages",
-        "key_path": "evidence.claims[].oots.languages",
+        "schema": "relay",
+        "pointer": "/$defs/InstanceConfig/properties/environment",
+        "key_path": "instance.environment",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_instance_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142745,72 +84953,76 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/languages/items",
-        "key_path": "evidence.claims[].oots.languages[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/InstanceConfig/properties/id",
+        "key_path": "instance.id",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_instance_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142820,34 +85032,34 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -142858,17 +85070,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/reference_framework",
-        "key_path": "evidence.claims[].oots.reference_framework",
+        "schema": "relay",
+        "pointer": "/$defs/InstanceConfig/properties/jurisdiction",
+        "key_path": "instance.jurisdiction",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_instance_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "null",
@@ -142884,10 +85096,10 @@
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142897,34 +85109,34 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -142938,17 +85150,17 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/requirement",
-        "key_path": "evidence.claims[].oots.requirement",
+        "schema": "relay",
+        "pointer": "/$defs/InstanceConfig/properties/owner",
+        "key_path": "instance.owner",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_instance_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "null",
@@ -142964,10 +85176,10 @@
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -142977,34 +85189,34 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -143018,35 +85230,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/OperationConfig/properties/enabled",
-        "key_path": "evidence.claims[].operations.evaluate.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/MetadataConfig/properties/ecosystem_binding",
+        "key_path": "metadata.ecosystem_binding",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_metadata_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143056,7 +85269,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143066,64 +85279,71 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/bind",
-        "key_path": "server.admin_listener.bind",
+        "schema": "relay",
+        "pointer": "/$defs/MetadataConfig/properties/source",
+        "key_path": "metadata.source",
         "path_kind": "property"
       },
-      "purpose": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_metadata_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/SocketAddr",
+        "local_reference": "#/$defs/MetadataSourceConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143133,7 +85353,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143143,68 +85363,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "path"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SocketAddr"
+        "schema": "relay",
+        "pointer": "/$defs/MetadataSourceConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/mode",
-        "key_path": "server.admin_listener.mode",
+        "schema": "relay",
+        "pointer": "/$defs/MetadataSourceConfig/properties/digest",
+        "key_path": "metadata.source.digest",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_metadata_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/RegistryNotaryAdminListenerMode",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143214,7 +85439,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143224,75 +85449,64 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
           "value": [
-            "shared_with_public",
-            "dedicated",
-            "disabled"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryAdminListenerMode"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/allow_regex",
-        "key_path": "cel.allow_regex",
+        "schema": "relay",
+        "pointer": "/$defs/MetadataSourceConfig/properties/path",
+        "key_path": "metadata.source.path",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_metadata_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143302,7 +85516,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143312,47 +85526,50 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/eval_timeout_ms",
-        "key_path": "cel.eval_timeout_ms",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/allow_dev_insecure_fetch_urls",
+        "key_path": "auth.oidc.allow_dev_insecure_fetch_urls",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Development-only escape hatch that permits loopback HTTP issuer,\ndiscovery, and JWKS URLs. Private non-loopback networks and cloud\nmetadata endpoints remain denied by the platform fetch policy.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -143363,11 +85580,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143377,7 +85594,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143387,55 +85604,51 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_binding_json_bytes",
-        "key_path": "cel.max_binding_json_bytes",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/allowed_algorithms",
+        "key_path": "auth.oidc.allowed_algorithms",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Signature algorithms accepted by the verifier. Defaults to\nRS256, ES256, EdDSA. HS\\* and `none` are intentionally absent\nfrom [`OidcAlgorithm`].",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -143443,14 +85656,14 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143460,7 +85673,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143470,70 +85683,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_expression_bytes",
-        "key_path": "cel.max_expression_bytes",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/allowed_algorithms/items",
+        "key_path": "auth.oidc.allowed_algorithms[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "JWS signature algorithms accepted by the OIDC verifier. Symmetric\nalgorithms (`HS*`) and `none` are intentionally absent: shared-secret\nJWTs are unsafe between a resource server and an IdP, and `none`\ndisables verification entirely.\n\nYAML values are the canonical JWA `alg` strings (`RS256`, `ES256`,\n`EdDSA`), case-sensitive.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/OidcAlgorithm",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143543,7 +85749,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143553,55 +85759,60 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "enum",
+          "value": [
+            "RS256",
+            "ES256",
+            "EdDSA"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/OidcAlgorithm"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_list_items",
-        "key_path": "cel.max_list_items",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/allowed_clients",
+        "key_path": "auth.oidc.allowed_clients",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional allowlist of client identifiers, matched against the\ntoken's `azp` (preferred) or `client_id` claim. Empty list\nmeans any client is accepted.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -143616,7 +85827,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143626,7 +85837,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143636,70 +85847,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_depth",
-        "key_path": "cel.max_object_depth",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/allowed_clients/items",
+        "key_path": "auth.oidc.allowed_clients[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143709,7 +85912,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143719,55 +85922,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_keys",
-        "key_path": "cel.max_object_keys",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/allowed_token_types",
+        "key_path": "auth.oidc.allowed_token_types",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Accepted `typ` JOSE header values. Defaults to `JWT` and\n`at+jwt` (RFC 9068). ID tokens (`id+jwt`) are not access tokens\nand are rejected by default. Tokens without `typ` are rejected by\nthe shared verifier.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -143778,11 +85974,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143792,7 +85988,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143802,70 +85998,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_result_json_bytes",
-        "key_path": "cel.max_result_json_bytes",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/allowed_token_types/items",
+        "key_path": "auth.oidc.allowed_token_types[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143875,7 +86066,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143885,70 +86076,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_string_bytes",
-        "key_path": "cel.max_string_bytes",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/audiences",
+        "key_path": "auth.oidc.audiences",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One or more accepted `aud` values. Tokens with no `aud`, or\nwhose `aud` does not intersect this list, are rejected.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -143958,7 +86144,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -143968,70 +86154,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/mode",
-        "key_path": "cel.mode",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/audiences/items",
+        "key_path": "auth.oidc.audiences[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144041,7 +86222,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144051,23 +86232,27 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -144078,35 +86263,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_count",
-        "key_path": "cel.worker_count",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/development_jwks_file",
+        "key_path": "auth.oidc.development_jwks_file",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Development-only public JWKS file loaded once into memory at startup.\nThis source is accepted only when `deployment.profile` is `local` and\nis mutually exclusive with `jwks_url` and `discovery_url`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144116,7 +86302,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144126,70 +86312,70 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_memory_bytes",
-        "key_path": "cel.worker_memory_bytes",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/discovery_url",
+        "key_path": "auth.oidc.discovery_url",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "OIDC discovery document URL\n(`.well-known/openid-configuration`). The JWKS URL is resolved\nfrom `jwks_uri` in the discovered document.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144199,7 +86385,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144209,70 +86395,68 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_stderr_bytes",
-        "key_path": "cel.worker_stderr_bytes",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/issuer",
+        "key_path": "auth.oidc.issuer",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Issuer URL. Compared verbatim against the JWT `iss` claim.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144282,7 +86466,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144292,70 +86476,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins",
-        "key_path": "server.cors.allowed_origins",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/jwks_cache_ttl",
+        "key_path": "auth.oidc.jwks_cache_ttl",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144365,7 +86546,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144375,65 +86556,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins/items",
-        "key_path": "server.cors.allowed_origins[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/jwks_url",
+        "key_path": "auth.oidc.jwks_url",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "JWKS endpoint. Exactly one JWKS source must be configured.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144443,7 +86635,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144453,18 +86645,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -144478,42 +86670,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/admin_listener",
-        "key_path": "server.admin_listener",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/leeway",
+        "key_path": "auth.oidc.leeway",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RegistryNotaryAdminListenerConfig",
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144523,7 +86718,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144533,18 +86728,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -144553,34 +86748,41 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryAdminListenerConfig"
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/bind",
-        "key_path": "server.bind",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/scope_claim",
+        "key_path": "auth.oidc.scope_claim",
         "path_kind": "property"
       },
-      "purpose": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.",
+      "purpose": "JWT claim whose value carries scopes. Defaults to `scope`, the\nRFC 8693 / RFC 9068 space-separated form. Some IdPs use `scp`\nor `permissions`; the value may be a string, an array of strings,\nor an object keyed by scope name.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/SocketAddr",
         "composed": false
       },
       "requiredness": "optional",
@@ -144594,7 +86796,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144604,7 +86806,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144614,18 +86816,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -144638,30 +86840,25 @@
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SocketAddr"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/cors",
-        "key_path": "server.cors",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/scope_map",
+        "key_path": "auth.oidc.scope_map",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional rename map: `external_scope -> internal_scope`. Applied\nafter parsing the scope claim, before scope-based access checks\nrun. Useful for adapting IdP role names (`role:foo`) to the\nrelay's `<dataset_id>:<level>` shape.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/RegistryNotaryCorsConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -144675,7 +86872,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144685,7 +86882,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144695,18 +86892,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -144719,44 +86916,38 @@
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCorsConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/http1_header_read_timeout",
-        "key_path": "server.http1_header_read_timeout",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/scope_map/additionalProperties",
+        "key_path": "auth.oidc.scope_map.*",
+        "path_kind": "map_value"
       },
-      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Each reviewed key is an external token scope and each value is the bounded Relay scope mapping granted for that exact token scope.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_oidc_scope_map_open_map",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144766,7 +86957,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144776,52 +86967,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/max_connections",
-        "key_path": "server.max_connections",
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys",
+        "key_path": "auth.oidc.scope_object_required_keys",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Keys that must be present inside object-valued role claim values\nbefore the role key is treated as an active scope. Object-valued\nclaims grant no scopes when this list is empty.\nThis is useful for IdPs such as Zitadel where role values are\nkeyed by organization id.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -144832,11 +87019,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144846,7 +87033,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144856,71 +87043,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/openapi_requires_auth",
-        "key_path": "server.openapi_requires_auth",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys/items",
+        "key_path": "auth.oidc.scope_object_required_keys[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_auth_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -144930,7 +87111,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -144940,64 +87121,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_body_timeout",
-        "key_path": "server.request_body_timeout",
+        "schema": "relay",
+        "pointer": "/$defs/PostgresTableConfig/properties/name",
+        "key_path": "datasets[].tables[].source.table.name",
         "path_kind": "property"
       },
-      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145007,7 +87189,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145017,18 +87199,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145041,44 +87223,38 @@
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_timeout",
-        "key_path": "server.request_timeout",
+        "schema": "relay",
+        "pointer": "/$defs/PostgresTableConfig/properties/schema",
+        "key_path": "datasets[].tables[].source.table.schema",
         "path_kind": "property"
       },
-      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145088,7 +87264,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145098,18 +87274,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145122,43 +87298,40 @@
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips",
-        "key_path": "server.trusted_proxy_ips",
+        "schema": "relay",
+        "pointer": "/$defs/PublicServiceConfig/properties/description",
+        "key_path": "datasets[].public_services[].description",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145168,7 +87341,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145178,18 +87351,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145200,40 +87373,45 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips/items",
-        "key_path": "server.trusted_proxy_ips[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/PublicServiceConfig/properties/id",
+        "key_path": "datasets[].public_services[].id",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145243,7 +87421,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145253,18 +87431,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145273,47 +87451,45 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "ip"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/allow_insecure_localhost",
-        "key_path": "evidence.relay.allow_insecure_localhost",
+        "schema": "relay",
+        "pointer": "/$defs/PublicServiceConfig/properties/title",
+        "key_path": "datasets[].public_services[].title",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145323,7 +87499,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145333,18 +87509,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145355,32 +87531,33 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/allow_insecure_private_network",
-        "key_path": "evidence.relay.allow_insecure_private_network",
+        "schema": "relay",
+        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval",
+        "key_path": "datasets[].defaults.refresh.interval",
         "path_kind": "property"
       },
-      "purpose": "Permit this signed Notary-to-Relay service hop to use application HTTP.\nRuntime resolution remains confined to eligible private addresses.",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "conditional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -145389,7 +87566,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145399,7 +87576,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145409,18 +87586,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145429,34 +87606,47 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs",
-        "key_path": "evidence.relay.allowed_private_cidrs",
+        "schema": "relay",
+        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval",
+        "key_path": "datasets[].tables[].refresh.interval",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "conditional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -145465,7 +87655,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145475,7 +87665,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145485,18 +87675,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145505,43 +87695,54 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs/items",
-        "key_path": "evidence.relay.allowed_private_cidrs[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].defaults.refresh.mode",
+        "path_kind": "property"
       },
-      "purpose": "An IP network CIDR string. The runtime parser remains authoritative for address and prefix validity.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/IpNet",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145551,7 +87752,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145561,18 +87762,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145581,29 +87782,33 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "interval",
+            "manual",
+            "mtime"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/IpNet"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/base_url",
-        "key_path": "evidence.relay.base_url",
+        "schema": "relay",
+        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].tables[].refresh.mode",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -145612,15 +87817,15 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145630,7 +87835,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145640,29 +87845,34 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "interval",
+            "manual",
+            "mtime"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -145671,35 +87881,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/max_in_flight",
-        "key_path": "evidence.relay.max_in_flight",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/expression",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145709,7 +87920,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145719,18 +87930,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -145740,32 +87951,33 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "required",
+          "value": [
+            "cel"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/root_certificate_path",
-        "key_path": "evidence.relay.root_certificate_path",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/format",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].format",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional value format hint.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -145780,11 +87992,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145794,7 +88006,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145804,26 +88016,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -145838,34 +88047,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/token_file",
-        "key_path": "evidence.relay.token_file",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/locale",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].locale",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145875,7 +88086,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145885,47 +88096,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/workload_client_id",
-        "key_path": "evidence.relay.workload_client_id",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/name",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].name",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Released claim name (lower-snake).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -145938,11 +88150,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -145952,7 +88164,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -145962,26 +88174,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -145993,34 +88202,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/inputs",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/required",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].required",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Whether the claim must be present; a missing required claim denies.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146030,7 +88240,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146040,18 +88250,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -146062,41 +88272,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/inputs/additionalProperties",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/sensitivity",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].sensitivity",
+        "path_kind": "property"
       },
-      "purpose": "A supported consultation input path. The runtime parser remains authoritative for exact stable-name bounds.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_inputs_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/RelayConsultationInput",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146106,7 +88317,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146116,62 +88327,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "enum",
+          "value": [
+            "direct_identifier",
+            "personal",
+            "public",
+            "pseudonymous"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "string"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationInput"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/outputs",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/source_field",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].source_field",
         "path_kind": "property"
       },
-      "purpose": "Complete closed public output schema expected from the pinned profile.",
+      "purpose": "Source field projected into the claim. XOR with `expression`.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -146180,7 +88396,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146190,7 +88406,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146200,18 +88416,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -146222,41 +88438,44 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/outputs/additionalProperties",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseConditionsConfig/properties/expression",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a consultation output and each value defines its bounded evidence-result interpretation.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_outputs_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "A single CEL expression evaluated over the subject's source projection.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/RelayOutputContract",
+        "local_reference": "#/$defs/ReleaseExpressionConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146266,7 +88485,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146276,52 +88495,30 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            [
-              "type",
-              "max_bytes",
-              "fields"
-            ],
-            [
-              "type",
-              "max_bytes",
-              "max_items",
-              "items"
-            ],
-            [
-              "type",
-              "max_bytes"
-            ],
-            [
-              "type",
-              "minimum",
-              "maximum"
-            ],
-            [
-              "type"
-            ]
+            "cel"
           ]
         },
         {
@@ -146330,33 +88527,32 @@
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract"
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseExpressionConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/profile",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseExpressionConfig/properties/cel",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression.cel",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RelayConsultationProfileRef",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -146364,7 +88560,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146374,7 +88570,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146384,18 +88580,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -146404,36 +88600,25 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "contract_hash"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationProfileRef"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationProfileRef/properties/contract_hash",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.contract_hash",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseExpressionConfig/properties/cel",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression.cel",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -146446,11 +88631,11 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146460,7 +88645,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146470,26 +88655,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -146501,34 +88683,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationProfileRef/properties/id",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.id",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseResponseConfig/properties/include_source_metadata",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].response.include_source_metadata",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Whether to include profile-sourced metadata in the response body.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146538,7 +88721,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146548,18 +88731,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -146570,41 +88753,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/nullable",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.nullable",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseSubjectConfig/properties/id_type",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].subject.id_type",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Accepted identifier type label.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146614,7 +88796,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146624,45 +88806,47 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/type",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.type",
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseSubjectConfig/properties/source_field",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].subject.source_field",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Source field used to match the subject. Must be an exposed entity field.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -146671,15 +88855,15 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146689,7 +88873,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146699,37 +88883,28 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "array",
-            "boolean",
-            "date",
-            "integer",
-            "object",
-            "string"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -146738,26 +88913,26 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/maximum",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.maximum",
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
+        "key_path": "datasets[].aggregates[].required_filter_bindings[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -146765,7 +88940,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146775,7 +88950,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146785,18 +88960,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -146805,38 +88980,34 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "int64"
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/minimum",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.minimum",
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
+        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -146844,7 +89015,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146854,7 +89025,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146864,18 +89035,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -146884,38 +89055,34 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "int64"
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/2/properties/max_bytes",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.max_bytes",
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
+        "key_path": "datasets[].entities[].api.required_filter_bindings[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -146923,7 +89090,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -146933,7 +89100,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -146943,18 +89110,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -146963,42 +89130,34 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/4/properties/fields",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields",
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
+        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].field",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -147006,7 +89165,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147016,7 +89175,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147026,18 +89185,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147048,41 +89207,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/4/properties/fields/additionalProperties",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
+        "key_path": "datasets[].aggregates[].required_filter_bindings[].source",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a closed structured output field and each value defines its requiredness and bounded recursive schema.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_output_fields_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RelayOutputObjectFieldContract",
+        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147092,7 +89252,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147102,74 +89262,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "required",
-            "schema"
+            "principal_id"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputObjectFieldContract"
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingSource"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/5/properties/items",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.items",
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
+        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].source",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RelayOutputContract",
+        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147179,7 +89339,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147189,18 +89349,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147210,73 +89370,53 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            [
-              "type",
-              "max_bytes",
-              "fields"
-            ],
-            [
-              "type",
-              "max_bytes",
-              "max_items",
-              "items"
-            ],
-            [
-              "type",
-              "max_bytes"
-            ],
-            [
-              "type",
-              "minimum",
-              "maximum"
-            ],
-            [
-              "type"
-            ]
+            "principal_id"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract"
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingSource"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/5/properties/max_items",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.max_items",
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
+        "key_path": "datasets[].entities[].api.required_filter_bindings[].source",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147286,7 +89426,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147296,18 +89436,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147317,53 +89457,53 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint16"
-        },
-        {
-          "keyword": "maximum",
-          "value": 65535
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "enum",
+          "value": [
+            "principal_id"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingSource"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputObjectFieldContract/properties/required",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*.required",
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
+        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].source",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147373,7 +89513,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147383,18 +89523,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147403,35 +89543,44 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "principal_id"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingSource"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputObjectFieldContract/properties/schema",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*.schema",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].tables[].access.aggregate_scope",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RelayOutputContract",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -147439,7 +89588,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147449,7 +89598,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147459,18 +89608,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147479,57 +89628,25 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "type",
-              "max_bytes",
-              "fields"
-            ],
-            [
-              "type",
-              "max_bytes",
-              "max_items",
-              "items"
-            ],
-            [
-              "type",
-              "max_bytes"
-            ],
-            [
-              "type",
-              "minimum",
-              "maximum"
-            ],
-            [
-              "type"
-            ]
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RequestVariableConfig/properties/from",
-        "key_path": "evidence.variables.*.from",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].tables[].access.metadata_scope",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -147546,7 +89663,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147556,7 +89673,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147566,18 +89683,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147594,35 +89711,35 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RequestVariableConfig/properties/type",
-        "key_path": "evidence.variables.*.type",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters",
+        "key_path": "datasets[].tables[].api.allowed_filters",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/RequestVariableType",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147632,7 +89749,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147642,18 +89759,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147662,52 +89779,43 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "date"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RequestVariableType"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RuleConfig/oneOf/0/properties/consultation",
-        "key_path": "evidence.claims[].rule.consultation",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].tables[].api.allowed_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147717,7 +89825,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147727,18 +89835,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147747,34 +89855,45 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field",
+            "ops"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RuleConfig/oneOf/0/properties/output",
-        "key_path": "evidence.claims[].rule.output",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceApiConfig/properties/default_limit",
+        "key_path": "datasets[].tables[].api.default_limit",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -147782,7 +89901,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147792,7 +89911,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147802,18 +89921,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147822,34 +89941,46 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RuleConfig/oneOf/0/properties/type",
-        "key_path": "evidence.claims[].rule.type",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceApiConfig/properties/max_limit",
+        "key_path": "datasets[].tables[].api.max_limit",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -147857,7 +89988,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147867,7 +89998,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147877,18 +90008,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147898,49 +90029,54 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": [
-            "cel",
-            "consultation_matched",
-            "consultation_output"
-          ]
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RuleConfig/oneOf/2/properties/expression",
-        "key_path": "evidence.claims[].rule.expression",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceApiConfig/properties/require_purpose_header",
+        "key_path": "datasets[].tables[].api.require_purpose_header",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -147950,7 +90086,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -147960,18 +90096,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -147982,40 +90118,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/consultations",
-        "key_path": "evidence.claims[].evidence_mode.consultations",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/access",
+        "key_path": "datasets[].tables[].access",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Resource-level scope assignments. Private tables are not exposed as row\nresources in beta; row access is configured on public entities.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/ResourceAccessConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148025,7 +90163,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148035,18 +90173,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -148055,43 +90193,54 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "metadata_scope",
+            "aggregate_scope"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceAccessConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/consultations/additionalProperties",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*",
-        "path_kind": "map_value"
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/aggregates",
+        "key_path": "datasets[].tables[].aggregates",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a Relay consultation and each value defines the bounded consultation contract used to support this evidence claim.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/RelayConsultationConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148101,7 +90250,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148111,73 +90260,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "profile",
-            "inputs"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/type",
-        "key_path": "evidence.claims[].evidence_mode.type",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/aggregates/items",
+        "key_path": "datasets[].tables[].aggregates[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148187,7 +90326,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148197,18 +90336,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -148218,45 +90357,55 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "registry_backed"
+          "keyword": "required",
+          "value": [
+            "id",
+            "description",
+            "disclosure_control"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/alg",
-        "key_path": "evidence.signing_keys.*.alg",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/api",
+        "key_path": "datasets[].tables[].api",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Resource-level API knobs: per-field filter allowlist, limit caps,\nand the `Data-Purpose` requirement.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ResourceApiConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148266,7 +90415,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148276,66 +90425,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "default_limit",
+            "max_limit"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceApiConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/key_id_hex",
-        "key_path": "evidence.signing_keys.*.key_id_hex",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/id",
+        "key_path": "datasets[].tables[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Resource identifier within a dataset.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ResourceId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148345,7 +90502,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148355,66 +90512,72 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceId"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/key_label",
-        "key_path": "evidence.signing_keys.*.key_label",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/materialization",
+        "key_path": "datasets[].tables[].materialization",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "How a configured private table is registered for query planning.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148424,7 +90587,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148434,65 +90597,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "snapshot"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/kid",
-        "key_path": "evidence.signing_keys.*.kid",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/primary_key",
+        "key_path": "datasets[].tables[].primary_key",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148502,7 +90673,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148512,18 +90683,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -148531,47 +90702,50 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/module_path",
-        "key_path": "evidence.signing_keys.*.module_path",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/refresh",
+        "key_path": "datasets[].tables[].refresh",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148581,7 +90755,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148591,66 +90765,78 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "mode",
+              "interval"
+            ],
+            [
+              "mode"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/password_env",
-        "key_path": "evidence.signing_keys.*.password_env",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/schema",
+        "key_path": "datasets[].tables[].schema",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Declared resource schema. `strict` is the spec's `strict_schema`\nflag; on mismatch ingestion refuses to register the resource.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/SchemaConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148660,7 +90846,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148670,65 +90856,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "fields"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/SchemaConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/path",
-        "key_path": "evidence.signing_keys.*.path",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceConfig/properties/source",
+        "key_path": "datasets[].tables[].source",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Source plugin selection. Tagged on `type:` so HTTP, S3, or additional\ndatabase variants can land additively later.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/SourceConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148738,7 +90932,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148748,65 +90942,81 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "type",
+              "connection_env"
+            ],
+            [
+              "type",
+              "path"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/pin_env",
-        "key_path": "evidence.signing_keys.*.pin_env",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceFormatConfig/properties/csv",
+        "key_path": "datasets[].tables[].source.format.csv",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148816,7 +91026,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148826,65 +91036,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/private_jwk_env",
-        "key_path": "evidence.signing_keys.*.private_jwk_env",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceFormatConfig/properties/parquet",
+        "key_path": "datasets[].tables[].source.format.parquet",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148894,7 +91106,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148904,65 +91116,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/provider",
-        "key_path": "evidence.signing_keys.*.provider",
+        "schema": "relay",
+        "pointer": "/$defs/ResourceFormatConfig/properties/xlsx",
+        "key_path": "datasets[].tables[].source.format.xlsx",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "local_reference": "#/$defs/SigningKeyProviderSchema",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -148972,7 +91186,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -148982,81 +91196,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
           "value": [
-            "local_jwk_env",
-            "file_watch",
-            "pkcs11",
-            "local_pkcs12_file",
-            "kms",
-            "workload_identity"
+            "null",
+            "object"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyProviderSchema"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/public_jwk_env",
-        "key_path": "evidence.signing_keys.*.public_jwk_env",
+        "schema": "relay",
+        "pointer": "/$defs/RotateConfig/properties/max_files",
+        "key_path": "audit.rotate.max_files",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149066,7 +91264,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149076,67 +91274,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/publish_until_unix_seconds",
-        "key_path": "evidence.signing_keys.*.publish_until_unix_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/RotateConfig/properties/max_size_mb",
+        "key_path": "audit.rotate.max_size_mb",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149146,7 +91350,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149156,77 +91360,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "format",
           "value": "uint64"
         },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
         {
           "keyword": "minimum",
           "value": 0
         },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/status",
-        "key_path": "evidence.signing_keys.*.status",
+        "schema": "relay",
+        "pointer": "/$defs/SchemaConfig/properties/fields",
+        "key_path": "datasets[].tables[].schema.fields",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/SigningKeyStatusSchema",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149236,7 +91436,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149246,78 +91446,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "active",
-            "publish_only",
-            "disabled"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyStatusSchema"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig/properties/token_label",
-        "key_path": "evidence.signing_keys.*.token_label",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/SchemaConfig/properties/fields/items",
+        "key_path": "datasets[].tables[].schema.fields[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One column in a resource schema. Physical type and optional\nsemantic annotations used by catalog and schema metadata.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/FieldConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149327,7 +91512,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149337,67 +91522,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name",
+            "type"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FieldConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/StateConfig/properties/postgresql",
-        "key_path": "state.postgresql",
+        "schema": "relay",
+        "pointer": "/$defs/SchemaConfig/properties/strict",
+        "key_path": "datasets[].tables[].schema.strict",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
-        "local_reference": "#/$defs/StatePostgresqlConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149407,7 +91599,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149417,66 +91609,64 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/StatePostgresqlConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/StateConfig/properties/storage",
-        "key_path": "state.storage",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/admin_bind",
+        "key_path": "server.admin_bind",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149486,7 +91676,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149496,62 +91686,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": [
+            "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$",
+            "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/StatePostgresqlConfig/properties/connect_timeout_ms",
-        "key_path": "state.postgresql.connect_timeout_ms",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/bind",
+        "key_path": "server.bind",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/SocketAddr",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149561,7 +91765,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149571,18 +91775,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -149591,41 +91795,44 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "pattern",
+          "value": [
+            "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$",
+            "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/SocketAddr"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/StatePostgresqlConfig/properties/max_connections",
-        "key_path": "state.postgresql.max_connections",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/cache_dir",
+        "key_path": "server.cache_dir",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -149634,7 +91841,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149644,7 +91851,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149654,18 +91861,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -149673,51 +91880,44 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/StatePostgresqlConfig/properties/operation_timeout_ms",
-        "key_path": "state.postgresql.operation_timeout_ms",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/cors",
+        "key_path": "server.cors",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "CORS allowlist; default-deny per Section 17 item 7.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/CorsConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149727,7 +91927,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149737,18 +91937,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -149756,52 +91956,48 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/CorsConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/StatePostgresqlConfig/properties/root_certificate_path",
-        "key_path": "state.postgresql.root_certificate_path",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/http1_header_read_timeout",
+        "key_path": "server.http1_header_read_timeout",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149811,7 +92007,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149821,68 +92017,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/StatePostgresqlConfig/properties/sensitive_state_key_env",
-        "key_path": "state.postgresql.sensitive_state_key_env",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/max_connections",
+        "key_path": "server.max_connections",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149892,7 +92094,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149902,65 +92104,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/StatePostgresqlConfig/properties/url_env",
-        "key_path": "state.postgresql.url_env",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/max_source_file_bytes",
+        "key_path": "server.max_source_file_bytes",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_secret_reference",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -149970,7 +92181,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -149980,50 +92191,59 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_audiences",
-        "key_path": "subject_access.citizen_clients.allowed_audiences",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/openapi_requires_auth",
+        "key_path": "server.openapi_requires_auth",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Keeps the configured OpenAPI document behind Relay authentication unless an operator explicitly accepts unauthenticated contract discovery.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "boolean"
         ],
         "composed": false
       },
@@ -150034,11 +92254,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150048,7 +92268,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150058,65 +92278,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_audiences/items",
-        "key_path": "subject_access.citizen_clients.allowed_audiences[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/request_body_timeout",
+        "key_path": "server.request_body_timeout",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150126,7 +92344,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150136,66 +92354,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_client_ids",
-        "key_path": "subject_access.citizen_clients.allowed_client_ids",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/request_timeout",
+        "key_path": "server.request_timeout",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150205,7 +92432,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150215,65 +92442,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_client_ids/items",
-        "key_path": "subject_access.citizen_clients.allowed_client_ids[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/trust_proxy",
+        "key_path": "server.trust_proxy",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "`X-Forwarded-For` policy. Until the `ipnet` crate lands in deps we\nkeep CIDR specs as strings and validate format in\n[`validate::run`].",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/TrustProxyConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150283,7 +92520,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150293,51 +92530,51 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/TrustProxyConfig"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_claims",
-        "key_path": "subject_access.allowed_claims",
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig/properties/xlsx_max_file_bytes",
+        "key_path": "server.xlsx_max_file_bytes",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -150348,11 +92585,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150362,7 +92599,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150372,65 +92609,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_claims/items",
-        "key_path": "subject_access.allowed_claims[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/0/properties/format",
+        "key_path": "datasets[].tables[].source.format",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Storage table format override. If omitted, ingest infers the format\nfrom the source file extension.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150440,7 +92687,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150450,66 +92697,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_disclosures",
-        "key_path": "subject_access.allowed_disclosures",
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/0/properties/path",
+        "key_path": "datasets[].tables[].source.path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150519,7 +92765,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150529,18 +92775,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -150548,46 +92794,45 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_disclosures/items",
-        "key_path": "subject_access.allowed_disclosures[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/0/properties/type",
+        "key_path": "datasets[].tables[].source.type",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150597,7 +92842,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150607,29 +92852,33 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "file",
+            "postgres"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -150638,26 +92887,27 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_formats",
-        "key_path": "subject_access.allowed_formats",
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/change_token_sql",
+        "key_path": "datasets[].tables[].source.change_token_sql",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -150666,7 +92916,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150676,7 +92926,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150686,18 +92936,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -150705,46 +92955,50 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_formats/items",
-        "key_path": "subject_access.allowed_formats[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/connect_timeout",
+        "key_path": "datasets[].tables[].source.connect_timeout",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150754,7 +93008,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150764,67 +93018,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_operations",
-        "key_path": "subject_access.allowed_operations",
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/connection_env",
+        "key_path": "datasets[].tables[].source.connection_env",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_secret_reference",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessOperationsConfig",
+        "local_reference": "#/$defs/PostgresEnvironmentNameSchema",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150834,7 +93096,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150844,18 +93106,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -150863,51 +93125,55 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]*$"
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessOperationsConfig"
+        "schema": "relay",
+        "pointer": "/$defs/PostgresEnvironmentNameSchema"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_purposes",
-        "key_path": "subject_access.allowed_purposes",
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/query",
+        "key_path": "datasets[].tables[].source.query",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150917,7 +93183,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -150927,65 +93193,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_purposes/items",
-        "key_path": "subject_access.allowed_purposes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/query_timeout",
+        "key_path": "datasets[].tables[].source.query_timeout",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -150995,7 +93263,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151005,66 +93273,76 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_wallet_origins",
-        "key_path": "subject_access.allowed_wallet_origins",
+        "schema": "relay",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/table",
+        "key_path": "datasets[].tables[].source.table",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Structured database table reference. Keeping schema/name separate\navoids parsing dotted identifiers and leaves quoting to connectors.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151074,7 +93352,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151084,65 +93362,72 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "schema",
+            "name"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/allowed_wallet_origins/items",
-        "key_path": "subject_access.allowed_wallet_origins[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_x",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151152,7 +93437,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151162,26 +93447,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -151193,36 +93475,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/citizen_clients",
-        "key_path": "subject_access.citizen_clients",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_x",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessCitizenClientsConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151232,7 +93512,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151242,70 +93522,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessCitizenClientsConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/credential_profiles",
-        "key_path": "subject_access.credential_profiles",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
+        "key_path": "datasets[].entities[].spatial.bbox_fields.max_x",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151315,7 +93587,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151325,65 +93597,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/credential_profiles/items",
-        "key_path": "subject_access.credential_profiles[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_x",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151393,7 +93662,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151403,26 +93672,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -151434,36 +93700,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/delegation",
-        "key_path": "subject_access.delegation",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_y",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessDelegationConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151473,7 +93737,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151483,70 +93747,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegationConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/enabled",
-        "key_path": "subject_access.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_y",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151556,7 +93812,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151566,67 +93822,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/rate_limits",
-        "key_path": "subject_access.rate_limits",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
+        "key_path": "datasets[].entities[].spatial.bbox_fields.max_y",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessRateLimitsConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151636,7 +93887,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151646,70 +93897,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessRateLimitsConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/required_scopes",
-        "key_path": "subject_access.required_scopes",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_y",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151719,7 +93962,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151729,65 +93972,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/required_scopes/items",
-        "key_path": "subject_access.required_scopes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_x",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151797,7 +94037,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151807,26 +94047,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -151838,36 +94075,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/scope_policy",
-        "key_path": "subject_access.scope_policy",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_x",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessScopePolicy",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151877,7 +94112,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151887,79 +94122,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "required",
-            "optional",
-            "disabled"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessScopePolicy"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/subject_binding",
-        "key_path": "subject_access.subject_binding",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
+        "key_path": "datasets[].entities[].spatial.bbox_fields.min_x",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessSubjectBindingConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -151969,7 +94187,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -151979,71 +94197,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessSubjectBindingConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig/properties/token_policy",
-        "key_path": "subject_access.token_policy",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_x",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessTokenPolicyConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152053,7 +94262,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152063,70 +94272,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_claims",
-        "key_path": "subject_access.delegation.allowed_relationships[].allowed_claims",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_y",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152136,7 +94337,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152146,65 +94347,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_claims/items",
-        "key_path": "subject_access.delegation.allowed_relationships[].allowed_claims[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_y",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152214,7 +94412,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152224,26 +94422,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -152255,35 +94450,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_disclosures",
-        "key_path": "subject_access.delegation.allowed_relationships[].allowed_disclosures",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
+        "key_path": "datasets[].entities[].spatial.bbox_fields.min_y",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152293,7 +94487,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152303,65 +94497,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_disclosures/items",
-        "key_path": "subject_access.delegation.allowed_relationships[].allowed_disclosures[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_y",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152371,7 +94562,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152381,26 +94572,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -152412,35 +94600,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_formats",
-        "key_path": "subject_access.delegation.allowed_relationships[].allowed_formats",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/crs",
+        "key_path": "datasets[].entities[].spatial.geometry.crs",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152450,7 +94637,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152460,65 +94647,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_formats/items",
-        "key_path": "subject_access.delegation.allowed_relationships[].allowed_formats[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/kind",
+        "key_path": "datasets[].entities[].spatial.geometry.kind",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152528,7 +94712,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152538,29 +94722,35 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "geojson",
+            "point",
+            "wkb",
+            "wkt"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -152569,35 +94759,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_purposes",
-        "key_path": "subject_access.delegation.allowed_relationships[].allowed_purposes",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/latitude_field",
+        "key_path": "datasets[].entities[].spatial.geometry.latitude_field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152607,7 +94796,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152617,65 +94806,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_purposes/items",
-        "key_path": "subject_access.delegation.allowed_relationships[].allowed_purposes[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/longitude_field",
+        "key_path": "datasets[].entities[].spatial.geometry.longitude_field",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152685,7 +94871,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152695,26 +94881,23 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -152726,35 +94909,34 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/max_proof_age_seconds",
-        "key_path": "subject_access.delegation.allowed_relationships[].max_proof_age_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/1/properties/field",
+        "key_path": "datasets[].entities[].spatial.geometry.field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152764,7 +94946,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152774,77 +94956,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 600
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/proof_claim",
-        "key_path": "subject_access.delegation.allowed_relationships[].proof_claim",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/dataset",
+        "key_path": "standards.spdci.disability_registry.dataset",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/DatasetId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152854,7 +95022,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152864,65 +95032,71 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DatasetId"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/relationship_type",
-        "key_path": "subject_access.delegation.allowed_relationships[].relationship_type",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values",
+        "key_path": "standards.spdci.disability_registry.disabled_positive_values",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Case-insensitive values interpreted as disabled.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -152932,7 +95106,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -152942,67 +95116,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/target_id_type",
-        "key_path": "subject_access.delegation.allowed_relationships[].target_id_type",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values/items",
+        "key_path": "standards.spdci.disability_registry.disabled_positive_values[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153012,7 +95181,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153022,69 +95191,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegationConfig/properties/allowed_relationships",
-        "key_path": "subject_access.delegation.allowed_relationships",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_status_field",
+        "key_path": "standards.spdci.disability_registry.disabled_status_field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Entity field whose value determines the SP DCI disabled response.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153094,7 +95257,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153104,66 +95267,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegationConfig/properties/allowed_relationships/items",
-        "key_path": "subject_access.delegation.allowed_relationships[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/entity",
+        "key_path": "standards.spdci.disability_registry.entity",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessDelegatedRelationshipConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153173,7 +95332,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153183,77 +95342,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship_type",
-            "proof_claim"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessDelegationConfig/properties/enabled",
-        "key_path": "subject_access.delegation.enabled",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_field",
+        "key_path": "standards.spdci.disability_registry.query_field",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Entity field filtered when the SP DCI query key is present.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153263,7 +95408,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153273,57 +95418,54 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessOperationsConfig/properties/batch_evaluate",
-        "key_path": "subject_access.allowed_operations.batch_evaluate",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_key",
+        "key_path": "standards.spdci.disability_registry.query_key",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Query key accepted from SP DCI `disabled_criteria.query`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -153332,7 +95474,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153342,7 +95484,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153352,18 +95494,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -153371,47 +95513,46 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessOperationsConfig/properties/evaluate",
-        "key_path": "subject_access.allowed_operations.evaluate",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/dataset",
+        "key_path": "standards.spdci.registries.*.dataset",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
+        "local_reference": "#/$defs/DatasetId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153421,7 +95562,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153431,51 +95572,56 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DatasetId"
+      }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessOperationsConfig/properties/issue_credential",
-        "key_path": "subject_access.allowed_operations.issue_credential",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/default_limit",
+        "key_path": "standards.spdci.registries.*.default_limit",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer"
         ],
         "composed": false
       },
@@ -153486,11 +95632,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153500,7 +95646,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153510,66 +95656,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessOperationsConfig/properties/render",
-        "key_path": "subject_access.allowed_operations.render",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/entity",
+        "key_path": "standards.spdci.registries.*.entity",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153579,7 +95733,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153589,51 +95743,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/credential_issuance_per_principal_per_hour",
-        "key_path": "subject_access.rate_limits.credential_issuance_per_principal_per_hour",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields",
+        "key_path": "standards.spdci.registries.*.expression_fields",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "DCI expression or predicate attribute to entity field mappings.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
@@ -153644,11 +95795,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153658,7 +95809,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153668,74 +95819,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/invalid_token_per_client_address_per_minute",
-        "key_path": "subject_access.rate_limits.invalid_token_per_client_address_per_minute",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields/additionalProperties",
+        "key_path": "standards.spdci.registries.*.expression_fields.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Each reviewed key names an expression-visible field and each value defines the bounded source expression exposed under that name.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_spdci_registries_expression_fields_open_map",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153745,7 +95884,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153755,59 +95894,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/per_holder_per_hour",
-        "key_path": "subject_access.rate_limits.per_holder_per_hour",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers",
+        "key_path": "standards.spdci.registries.*.identifiers",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "DCI identifier type to entity field mappings for `idtype-value`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
         "composed": false
       },
@@ -153818,11 +95946,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153832,7 +95960,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153842,74 +95970,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/per_principal_per_minute",
-        "key_path": "subject_access.rate_limits.per_principal_per_minute",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers/additionalProperties",
+        "key_path": "standards.spdci.registries.*.identifiers.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Each reviewed key names an identifier role and each value defines the exact request identifier binding for that role.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_spdci_registries_identifiers_open_map",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -153919,7 +96035,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -153929,74 +96045,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/subject_mismatch_per_principal_per_hour",
-        "key_path": "subject_access.rate_limits.subject_mismatch_per_principal_per_hour",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/record_type",
+        "key_path": "standards.spdci.registries.*.record_type",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154006,7 +96111,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154016,74 +96121,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/tx_code_attempts_per_code_per_minute",
-        "key_path": "subject_access.rate_limits.tx_code_attempts_per_code_per_minute",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/registry_type",
+        "key_path": "standards.spdci.registries.*.registry_type",
         "path_kind": "property"
       },
-      "purpose": "Per-minute cap on `tx_code` attempts against a single\n`pre-authorized_code`. Bounds brute force of the numeric PIN at the\npre-authorized-code token endpoint. Defaults to zero so existing\nconfigs that do not enable pre-auth still validate; it must be greater\nthan zero only when the pre-authorized-code flow is enabled.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154093,7 +96187,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154103,59 +96197,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/allow_sub_as_civil_id",
-        "key_path": "subject_access.subject_binding.allow_sub_as_civil_id",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields",
+        "key_path": "standards.spdci.registries.*.response_fields",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "SP DCI output path to entity field mappings for direct response\nprojection. A CEL mapping takes precedence when both are set.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
         "composed": false
       },
@@ -154166,11 +96249,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154180,7 +96263,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154190,67 +96273,62 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/claim_source",
-        "key_path": "subject_access.subject_binding.claim_source",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields/additionalProperties",
+        "key_path": "standards.spdci.registries.*.response_fields.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Each reviewed key names a response field and each value defines the exact bounded response projection for that field.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_spdci_registries_response_fields_open_map",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/SubjectAccessClaimSource",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154260,7 +96338,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154270,67 +96348,54 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "access_token",
-            "userinfo"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessClaimSource"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/id_type",
-        "key_path": "subject_access.subject_binding.id_type",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/response_mapping_path",
+        "key_path": "standards.spdci.registries.*.response_mapping_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional local CEL mapping document used to shape response records.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
@@ -154340,7 +96405,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154350,7 +96415,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154360,18 +96425,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -154379,39 +96444,41 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/normalize",
-        "key_path": "subject_access.subject_binding.normalize",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/response_schema_path",
+        "key_path": "standards.spdci.registries.*.response_schema_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional local JSON Schema used to validate shaped response records.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/SubjectBindingNormalize",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -154420,7 +96487,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154430,7 +96497,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154440,18 +96507,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -154459,58 +96526,50 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
           "value": [
-            "exact"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectBindingNormalize"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/request_field",
-        "key_path": "subject_access.subject_binding.request_field",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciStandardsConfig/properties/disability_registry",
+        "key_path": "standards.spdci.disability_registry",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Runtime binding from SP DCI Disability Registry sync APIs to one\nconfigured Registry Relay entity.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "local_reference": "#/$defs/SubjectId",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154520,7 +96579,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154530,76 +96589,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "SubjectId"
+            "dataset",
+            "entity"
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectId"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/token_claim",
-        "key_path": "subject_access.subject_binding.token_claim",
+        "schema": "relay",
+        "pointer": "/$defs/SpdciStandardsConfig/properties/registries",
+        "key_path": "standards.spdci.registries",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154609,7 +96665,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154619,67 +96675,63 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/assurance_claim_source",
-        "key_path": "subject_access.token_policy.assurance_claim_source",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/SpdciStandardsConfig/properties/registries/additionalProperties",
+        "key_path": "standards.spdci.registries.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Runtime binding from a DCI registry sync search API to one configured\nRegistry Relay entity.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_spdci_registries_open_map",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/SubjectAccessAssuranceClaimSource",
+        "local_reference": "#/$defs/SpdciRegistryConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154689,7 +96741,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154699,77 +96751,75 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "access_token",
-            "id_token"
+            "dataset",
+            "entity"
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessAssuranceClaimSource"
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_access_token_lifetime_seconds",
-        "key_path": "subject_access.token_policy.max_access_token_lifetime_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/StandardsConfig/properties/spdci",
+        "key_path": "standards.spdci",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Social Protection Digital Convergence Initiative (SP DCI) adapter\nconfiguration.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154779,7 +96829,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154789,59 +96839,51 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_auth_age_seconds",
-        "key_path": "subject_access.token_policy.max_auth_age_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/TrustProxyConfig/properties/enabled",
+        "key_path": "server.trust_proxy.enabled",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -154852,11 +96894,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154866,7 +96908,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154876,59 +96918,47 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_clock_leeway_seconds",
-        "key_path": "subject_access.token_policy.max_clock_leeway_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies",
+        "key_path": "server.trust_proxy.trusted_proxies",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -154943,7 +96973,7 @@
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -154953,7 +96983,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -154963,18 +96993,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -154986,51 +97016,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_credential_validity_seconds",
-        "key_path": "subject_access.token_policy.max_credential_validity_seconds",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies/items",
+        "key_path": "server.trust_proxy.trusted_proxies[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_server_sensitive",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155040,7 +97061,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155050,18 +97071,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "security",
         "privacy",
         "documentation"
@@ -155073,51 +97094,44 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_evaluation_age_seconds",
-        "key_path": "subject_access.token_policy.max_evaluation_age_seconds",
+        "schema": "relay",
+        "pointer": "/$defs/XlsxFormatConfig/properties/data_range",
+        "key_path": "datasets[].tables[].source.format.xlsx.data_range",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155127,7 +97141,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155137,74 +97151,67 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/required_acr_values",
-        "key_path": "subject_access.token_policy.required_acr_values",
+        "schema": "relay",
+        "pointer": "/$defs/XlsxFormatConfig/properties/header_row",
+        "key_path": "datasets[].tables[].source.format.xlsx.header_row",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155214,7 +97221,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155224,65 +97231,79 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/required_acr_values/items",
-        "key_path": "subject_access.token_policy.required_acr_values[]",
-        "path_kind": "array_item"
+        "schema": "relay",
+        "pointer": "/$defs/XlsxFormatConfig/properties/sheet",
+        "key_path": "datasets[].tables[].source.format.xlsx.sheet",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155292,7 +97313,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155302,67 +97323,66 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
-        "schema": "notary",
+        "schema": "relay",
         "pointer": "/properties/audit",
         "key_path": "audit",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Audit configuration. Sink choice gates further fields via the\ntagged `AuditSinkConfig` enum. The enum is flattened onto the\ncontaining struct so that the YAML `sink:` key acts as the\ndiscriminator, matching the public example configuration.\n\n`deny_unknown_fields` is deliberately omitted here: `serde` does\nnot support combining it with `#[serde(flatten)]` on an internally\ntagged enum (unknown keys in `audit` are caught by the enum's own\n`deny_unknown_fields`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/EvidenceAuditConfig",
+        "local_reference": "#/$defs/AuditConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155372,7 +97392,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155382,18 +97402,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -155401,34 +97421,50 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "sink",
+              "path"
+            ],
+            [
+              "sink"
+            ]
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
+        },
+        {
+          "keyword": "unevaluatedProperties",
+          "value": false
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig"
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
+        "schema": "relay",
         "pointer": "/properties/auth",
         "key_path": "auth",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Authentication configuration. Exactly one of `api_keys` and `oidc`\nis consumed at startup, gated by `mode`; cross-field validation in\n[`validate`] enforces that only the active block is populated.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/EvidenceAuthConfig",
+        "local_reference": "#/$defs/AuthConfig",
         "composed": false
       },
       "requiredness": "required",
@@ -155441,7 +97477,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155451,7 +97487,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155461,18 +97497,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -155481,48 +97517,53 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "mode"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig"
+        "schema": "relay",
+        "pointer": "/$defs/AuthConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/properties/cel",
-        "key_path": "cel",
+        "schema": "relay",
+        "pointer": "/properties/catalog",
+        "key_path": "catalog",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Catalog-level metadata surfaced by `/metadata/*` and DCAT outputs.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_catalog_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/RegistryNotaryCelConfig",
+        "local_reference": "#/$defs/CatalogConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155532,7 +97573,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155542,18 +97583,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -155561,29 +97602,37 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "title",
+            "base_url",
+            "publisher"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig"
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
+        "schema": "relay",
         "pointer": "/properties/config_trust",
         "key_path": "config_trust",
         "path_kind": "property"
       },
-      "purpose": "Optional governed-configuration local trust state.\n\nSimple local deployments omit this block. Signed/governed apply requires it\nso anti-rollback state lives in an explicit durable location.",
+      "purpose": "Optional signed configuration bundle trust state.\n\nSimple local deployments omit this block. Bundle-aware deployments pin the\nlocal trust anchor, bundle, and anti-rollback state paths explicitly.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_config_trust_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_config_trust_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
@@ -155602,7 +97651,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155612,7 +97661,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155622,18 +97671,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -155660,36 +97709,36 @@
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/properties/credential_status",
-        "key_path": "credential_status",
+        "schema": "relay",
+        "pointer": "/properties/consultation",
+        "key_path": "consultation",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary credential-status publication and retention behavior.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_credential_status_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_consultation_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/CredentialStatusConfig",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155699,7 +97748,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155709,70 +97758,73 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "authorized_workload",
+            "state_plane",
+            "audit_pseudonym_materials"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialStatusConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/properties/deployment",
-        "key_path": "deployment",
+        "schema": "relay",
+        "pointer": "/properties/datasets",
+        "key_path": "datasets",
         "path_kind": "property"
       },
-      "purpose": "The operator-declared `deployment` config block.\n\nAn absent profile means an undeclared deployment, which refuses startup. The\n`multi_instance` flag is an operator declaration that the instance is one of\nseveral sharing the same workload; it is never inferred.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/DeploymentConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155782,7 +97834,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155792,18 +97844,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -155814,45 +97866,41 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/properties/evidence",
-        "key_path": "evidence",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "/properties/datasets/items",
+        "key_path": "datasets[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Registry Notary configuration. Disabled by default so existing\nRegistry Relay deployments load unchanged.",
+      "purpose": "A single dataset declaration.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/EvidenceConfig",
+        "local_reference": "#/$defs/DatasetConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155862,7 +97910,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155872,18 +97920,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -155892,34 +97940,46 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "title",
+            "description",
+            "owner",
+            "sensitivity",
+            "access_rights",
+            "update_frequency"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig"
+        "schema": "relay",
+        "pointer": "/$defs/DatasetConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/properties/federation",
-        "key_path": "federation",
+        "schema": "relay",
+        "pointer": "/properties/deployment",
+        "key_path": "deployment",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/FederationConfig",
+        "local_reference": "#/$defs/DeploymentConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -155933,7 +97993,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -155943,7 +98003,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -155953,18 +98013,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -155979,28 +98039,28 @@
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationConfig"
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
+        "schema": "relay",
         "pointer": "/properties/instance",
         "key_path": "instance",
         "path_kind": "property"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Stable deployment identity surfaced in redacted operations posture.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_instance_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/NotaryInstanceConfig",
+        "local_reference": "#/$defs/InstanceConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -156014,7 +98074,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -156024,7 +98084,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -156034,18 +98094,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
@@ -156059,42 +98119,42 @@
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig"
+        "schema": "relay",
+        "pointer": "/$defs/InstanceConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/properties/oid4vci",
-        "key_path": "oid4vci",
+        "schema": "relay",
+        "pointer": "/properties/metadata",
+        "key_path": "metadata",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Optional split metadata manifest loaded alongside the runtime config.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_metadata_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/Oid4vciConfig",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -156104,7 +98164,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -156114,68 +98174,71 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "source"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "notary",
+        "schema": "relay",
         "pointer": "/properties/server",
         "key_path": "server",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "HTTP listener and adjacent server-wide knobs.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/RegistryNotaryHttpConfig",
+        "local_reference": "#/$defs/ServerConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -156185,7 +98248,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -156195,54 +98258,59 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "bind"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig"
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/properties/state",
-        "key_path": "state",
+        "schema": "relay",
+        "pointer": "/properties/standards",
+        "key_path": "standards",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_state_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_standards_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/StateConfig",
+        "local_reference": "#/$defs/StandardsConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -156256,7 +98324,7 @@
       "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -156266,7 +98334,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -156276,23 +98344,24 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -156301,42 +98370,41 @@
         }
       ],
       "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/StateConfig"
+        "schema": "relay",
+        "pointer": "/$defs/StandardsConfig"
       }
     },
     {
       "address": {
-        "schema": "notary",
-        "pointer": "/properties/subject_access",
-        "key_path": "subject_access",
+        "schema": "relay",
+        "pointer": "/properties/vocabularies",
+        "key_path": "vocabularies",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.",
+      "purpose": "Controls the reviewed vocabulary bindings Relay uses to interpret namespaced terms.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_subject_access_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "relay_vocabularies_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/SubjectAccessConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
-        "notary",
+        "relay",
         "docs"
       ],
       "availability": "published",
@@ -156346,7 +98414,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -156356,38 +98424,105 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registry_notary",
+        "registry_relay",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "notary_config",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "notary",
-        "security",
-        "privacy",
+        "relay",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
           "value": "object"
         }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/properties/vocabularies/additionalProperties",
+        "key_path": "vocabularies.*",
+        "path_kind": "map_value"
+      },
+      "purpose": "Each reviewed key is a vocabulary prefix and each value binds that prefix to its operator-approved vocabulary identifier.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_vocabularies_open_map",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
       ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SubjectAccessConfig"
-      }
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     }
   ]
 }
diff --git a/docs/site/src/data/generated/contracts.json b/docs/site/src/data/generated/contracts.json
index c2e1a4719..13b6bc49c 100644
--- a/docs/site/src/data/generated/contracts.json
+++ b/docs/site/src/data/generated/contracts.json
@@ -9,14 +9,14 @@
       "label": "Registry Platform crates",
       "url": "https://github.com/registrystack/registry-stack/tree/d45761a0104bd3d9c2e4b4db391d4223f289bd44/crates"
     },
-    "consumer_note": "Relay, Notary, and future registry services should consume these primitives instead of reimplementing security or operational behavior locally."
+    "consumer_note": "Relay, Evidence, Registry Mint, and future registry services should consume these primitives instead of reimplementing security or operational behavior locally."
   },
   {
     "id": "registry-platform.ops-posture-v1",
     "name": "Registry Ops Posture v1",
     "owner": "registry-platform",
     "status": "current-source",
-    "surface": "Versioned JSON Schema for protected Registry Relay and Registry Notary operations posture observations, including the shared envelope, component sections, default and restricted sensitivity tiers, deployment findings, audit state, and standards-artifact references.",
+    "surface": "Versioned JSON Schema for protected Registry Relay operations posture observations, including the shared envelope, component sections, default and restricted sensitivity tiers, deployment findings, audit state, and standards-artifact references. The frozen v1 shape still models the retired Registry Notary component so that a consumer can validate a document it already holds.",
     "source_of_truth": {
       "label": "Registry Ops Posture v1 JSON Schema",
       "url": "https://github.com/registrystack/registry-stack/blob/c84b1b9288b925e7c9cc89c47c33cc1f50753d8c/crates/registry-platform-ops/schemas/registry.ops.posture.v1.schema.json"
@@ -35,42 +35,6 @@
     },
     "consumer_note": "Hand-authored from `docs/api.md` and the runtime route table. Uses templated paths and capability tags. For instance-specific shape of `{dataset_id}` and `{entity}`, fetch `GET /openapi.json` from a configured gateway. Runtime deployments gate that route by default unless `openapi_requires_auth` is disabled for demos or controlled tooling."
   },
-  {
-    "id": "registry-notary.openapi",
-    "name": "Registry Notary OpenAPI",
-    "owner": "registry-notary",
-    "status": "pinned-generated-snapshot",
-    "surface": "Claim discovery, claim evaluation, batch evaluation, federated delegated evaluation, rendering, JWKS, service metadata, and credential issuance.",
-    "source_of_truth": {
-      "label": "Registry Notary OpenAPI generator",
-      "url": "https://github.com/registrystack/registry-stack/blob/d45761a0104bd3d9c2e4b4db391d4223f289bd44/crates/registry-notary-server/src/openapi.rs"
-    },
-    "consumer_note": "Generate with `cargo run -p registry-notary -- openapi`. Both direct and OID4VCI credential routes require a fresh non-delegated stored evaluation with exact claim pins and normalized unique Relay execution records for every selected root's registry-backed dependency closure."
-  },
-  {
-    "id": "registry-notary.oid4vci",
-    "name": "Registry Notary OID4VCI surface",
-    "owner": "registry-notary",
-    "status": "current-source",
-    "surface": "OID4VCI issuer metadata, Type Metadata, offer start and authenticated callback, pre-authorized token redemption, and registry-backed credential issuance. The wallet-facing grant is issuer-initiated pre-authorized code. Primitives are sourced from the `registry-platform-oid4vci` crate.",
-    "source_of_truth": {
-      "label": "Registry Notary OID4VCI routes",
-      "url": "https://github.com/registrystack/registry-stack/blob/d45761a0104bd3d9c2e4b4db391d4223f289bd44/crates/registry-notary-server/src/api.rs"
-    },
-    "consumer_note": "Registry Notary advertises `dc+sd-jwt`, EdDSA `did:jwk` holder proof, and the configured EdDSA or ES256 issuer algorithm. Credential configurations accept non-delegated registry-backed claims only, and issuance verifies the stored transaction plus exact dependency-closure Relay execution provenance before signing. Transaction code is required by default. An explicit no-PIN profile has a maximum 300-second bearer-offer window. There is no wallet-facing authorization-code grant, public nonce route, response next nonce, issuance from caller-provided evidence, ES256 holder proof, PAR, DPoP, wallet attestation, EUDI, or HAIP claim. External wallet and verifier evidence is candidate-only until recorded against a frozen artifact."
-  },
-  {
-    "id": "registry-notary.federated-evaluation",
-    "name": "Registry Notary Federated Evaluation MVP",
-    "owner": "registry-notary",
-    "status": "current-source",
-    "surface": "Static-peer delegated evaluation over `POST /federation/v1/evaluations`, compact JWS request and response JWTs, peer policy checks, pairwise subject handles, replay protection, and federation audit fields.",
-    "source_of_truth": {
-      "label": "Registry Notary federation module",
-      "url": "https://github.com/registrystack/registry-stack/tree/d45761a0104bd3d9c2e4b4db391d4223f289bd44/crates/registry-notary-server/src/federation"
-    },
-    "consumer_note": "This is delegated evaluation only. Open federation, trust-chain discovery, shared replay storage, audit checkpoint exchange, and federated credential issuance are outside the MVP."
-  },
   {
     "id": "registry-manifest.metadata-yaml",
     "name": "Metadata Manifest",
diff --git a/docs/site/src/data/generated/diagnostics/fixture.json b/docs/site/src/data/generated/diagnostics/fixture.json
index 8b1349174..58b7f1c7d 100644
--- a/docs/site/src/data/generated/diagnostics/fixture.json
+++ b/docs/site/src/data/generated/diagnostics/fixture.json
@@ -1,24 +1,6 @@
 {
   "schema_version": "registryctl.fixture_error_reference.v1",
   "entries": [
-    {
-      "family": "fixture_execution",
-      "code": "authorization.denied",
-      "owner": "registryctl",
-      "product": "registryctl_relay_offline_harness",
-      "phase": "offline_execution",
-      "safe_meaning": "Authorization denied fixture execution before source access.",
-      "rule": "authorization_before_source",
-      "safe_remediation": "Align the fixture identity and authorization expectation with the compiled policy.",
-      "field_address_pattern": null,
-      "evidence_scope": "offline synthetic fixture execution",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--authorization.denied",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility."
-    },
     {
       "family": "fixture_execution",
       "code": "failure.subject_mismatch",
diff --git a/docs/site/src/data/generated/diagnostics/operator.json b/docs/site/src/data/generated/diagnostics/operator.json
index d8750d557..63a8af07b 100644
--- a/docs/site/src/data/generated/diagnostics/operator.json
+++ b/docs/site/src/data/generated/diagnostics/operator.json
@@ -73,330 +73,6 @@
       "stability": "pre1_stable_code",
       "evidence_limitation": "The category does not disclose parser messages, local paths, or supplied values."
     },
-    {
-      "family": "notary_activation",
-      "code": "notary.cel.worker_unavailable",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary CEL worker is unavailable",
-      "rule": "Every configured CEL worker must complete the bounded product protocol probe before listeners serve",
-      "safe_remediation": "verify that the adjacent CEL worker artifact is present and executable, confirm the supported platform and configured resource ceilings, then retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "CEL worker packaging, protocol responsiveness, supported platform, and bounded startup capacity",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--cel-worker-unavailable",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.configuration.invalid",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "configuration_activation",
-      "safe_meaning": "Registry Notary runtime configuration is invalid",
-      "rule": "Runtime activation requires valid product configuration, supported features, and resolvable secret and provider bindings",
-      "safe_remediation": "run registry-notary doctor, correct the reviewed configuration or binding, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "Notary configuration, provider bindings, and compiled feature support",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--configuration-invalid",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.deployment.gate_failed",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "deployment_activation",
-      "safe_meaning": "Registry Notary deployment gates refused startup",
-      "rule": "Every startup-failing deployment gate must pass before activation",
-      "safe_remediation": "run registry-notary doctor for the selected deployment profile and resolve its startup-failing findings",
-      "field_address_pattern": null,
-      "evidence_scope": "selected deployment profile and startup-failing gate results",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--deployment-gate-failed",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.activation_failed",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay consultation activation failed",
-      "rule": "Registry-backed claims require the reviewed Relay consultation client to activate before Notary serves",
-      "safe_remediation": "check the Notary configuration and startup environment",
-      "field_address_pattern": null,
-      "evidence_scope": "Notary Relay consultation client activation lifecycle",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-activation-failed",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.configuration_invalid",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay consultation configuration is invalid",
-      "rule": "The Relay destination, activation plan, and activation lifecycle must form one valid reviewed configuration",
-      "safe_remediation": "check the evidence.relay connection and Registry-backed consultation configuration",
-      "field_address_pattern": null,
-      "evidence_scope": "Relay destination, activation plan, and consultation configuration",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-configuration-invalid",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.credential_unavailable",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay workload credential is unavailable",
-      "rule": "A current non-empty workload credential must be available before a live Relay consultation",
-      "safe_remediation": "mount a current readable workload JWT at evidence.relay.token_file",
-      "field_address_pattern": null,
-      "evidence_scope": "configured Relay workload credential availability",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-credential-unavailable",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.credentials_rejected",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay rejected the configured workload credential",
-      "rule": "Relay must accept the configured Notary workload binding, scope, and validity window",
-      "safe_remediation": "rotate the workload JWT and verify that Relay recognizes its workload binding, required scope, and validity window",
-      "field_address_pattern": null,
-      "evidence_scope": "Relay workload binding, scope, and validity acceptance",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-credentials-rejected",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.profile_mismatch",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay consultation profile does not match the configured contract pin",
-      "rule": "The active Relay profile must match the reviewed Notary consultation contract pin",
-      "safe_remediation": "reconcile the Notary profile id and contract hash with the reviewed Relay consultation contract",
-      "field_address_pattern": null,
-      "evidence_scope": "reviewed Notary profile pin and active Relay consultation contract",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-profile-mismatch",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.profile_not_found",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay consultation profile was not found",
-      "rule": "Every Registry-backed Notary consultation must resolve to an active Relay profile",
-      "safe_remediation": "deploy the configured Relay profile id, then retry the live check",
-      "field_address_pattern": null,
-      "evidence_scope": "configured consultation profile resolution in Relay",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-profile-not-found",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.relay.unavailable",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "relay_activation",
-      "safe_meaning": "Relay consultation service is unavailable",
-      "rule": "The reviewed Relay destination must be reachable through the configured transport policy",
-      "safe_remediation": "check Relay reachability, TLS, destination policy, and service health",
-      "field_address_pattern": null,
-      "evidence_scope": "reviewed Relay destination, transport policy, and service availability",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-unavailable",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.runtime.activation_failed",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary runtime activation failed",
-      "rule": "Audit, state, sensitive-state, and other runtime dependencies must activate successfully before listeners serve",
-      "safe_remediation": "restore the governed runtime dependency or integrity condition, then retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "governed audit, state, sensitive-state, and runtime dependencies",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--runtime-activation-failed",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.runtime.activation_required",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary runtime activation is required before serving",
-      "rule": "Routers may be built only after the governed audit and state activation lifecycle completes",
-      "safe_remediation": "run the compiled Registry Notary runtime activation step before building or serving routers",
-      "field_address_pattern": null,
-      "evidence_scope": "router assembly and governed audit and state activation lifecycle",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--runtime-activation-required",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.database_read_only",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL state database is read-only or recovering",
-      "rule": "Serving requires a writable PostgreSQL primary for correctness-state transactions",
-      "safe_remediation": "restore a writable PostgreSQL primary, run registry-notary state doctor, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL writeability and recovery posture",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-read-only",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.database_unavailable",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL state database is unavailable",
-      "rule": "Serving requires a reachable PostgreSQL service with an accepted TLS trust chain",
-      "safe_remediation": "check PostgreSQL reachability, TLS trust, and service health, then run registry-notary state doctor",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL transport, TLS trust, and service availability",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-unavailable",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.database_unsupported",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL server major is unsupported",
-      "rule": "Serving requires a PostgreSQL major covered by the Registry Notary compatibility contract",
-      "safe_remediation": "move the state database to a supported PostgreSQL major, run registry-notary state doctor, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL server-major compatibility",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-unsupported",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.durability_unsafe",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL durability settings are unsafe",
-      "rule": "Serving requires the documented PostgreSQL durability settings for correctness state",
-      "safe_remediation": "restore the required PostgreSQL durability settings, run registry-notary state doctor, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL durability posture",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-durability-unsafe",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.role_incompatible",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL runtime role contract is incompatible",
-      "rule": "Serving requires the documented restricted runtime role and its attested schema binding",
-      "safe_remediation": "restore the documented runtime grants and role binding, run registry-notary state doctor, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL runtime-role attributes, grants, and schema binding",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-role-incompatible",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
-    {
-      "family": "notary_activation",
-      "code": "notary.state.postgresql.schema_incompatible",
-      "owner": "registry_notary",
-      "product": "registry_notary",
-      "phase": "runtime_activation",
-      "safe_meaning": "Registry Notary PostgreSQL state schema contract is incompatible",
-      "rule": "Serving requires the exact product-owned schema, catalog, fingerprint, and privilege contract",
-      "safe_remediation": "restore or install the matching Registry Notary state schema, run registry-notary state doctor, and retry activation",
-      "field_address_pattern": null,
-      "evidence_scope": "PostgreSQL state schema, catalog, fingerprint, and privilege contract",
-      "secret_sensitive_value_policy": "no_runtime_values",
-      "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-schema-incompatible",
-      "lifecycle": "unreleased",
-      "introduced_in": null,
-      "stability": "pre1_stable_code",
-      "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."
-    },
     {
       "family": "operator_preflight",
       "code": "registryctl.preflight.product_validator_not_checked",
diff --git a/docs/site/src/data/generated/docsets.json b/docs/site/src/data/generated/docsets.json
index 7a002d6a3..1ebfe7132 100644
--- a/docs/site/src/data/generated/docsets.json
+++ b/docs/site/src/data/generated/docsets.json
@@ -20,11 +20,11 @@
           "version": "main source (unreleased)",
           "ref": "HEAD"
         },
-        "registry-notary": {
+        "registry-manifest": {
           "version": "main source (unreleased)",
           "ref": "HEAD"
         },
-        "registry-manifest": {
+        "registry-evidence": {
           "version": "main source (unreleased)",
           "ref": "HEAD"
         }
diff --git a/docs/site/src/data/generated/openapi-sources.json b/docs/site/src/data/generated/openapi-sources.json
index e0d36c381..9a4800543 100644
--- a/docs/site/src/data/generated/openapi-sources.json
+++ b/docs/site/src/data/generated/openapi-sources.json
@@ -9,12 +9,12 @@
     "reference_path": "/reference/apis/relay/"
   },
   {
-    "id": "registry-notary",
-    "name": "Registry Notary API",
-    "owner": "registry-notary",
-    "source": "Pulled from `registry-notary/openapi/registry-notary.openapi.json` at the pinned ref in `src/data/repo-docs.yaml` by `scripts/fetch-openapi.mjs`. The repo generates the spec with `cargo run -p registry-notary -- openapi`.",
-    "artifact": "openapi/registry-notary.openapi.json",
-    "status": "pulled at the pinned ref (build artifact, regenerated each build) with federation, OID4VCI, and response examples",
-    "reference_path": "/reference/apis/notary/"
+    "id": "registry-evidence",
+    "name": "Registry Evidence API",
+    "owner": "registry-evidence",
+    "source": "Pulled from `products/evidence/generated/registry-evidence.openapi.json` at the pinned ref in `src/data/repo-docs.yaml` by `scripts/fetch-openapi.mjs`. The document is generated by `cargo run -p registry-evidence --example evidence-contracts` and byte-drift-checked in root CI by the `evidence-contracts` job.",
+    "artifact": "openapi/registry-evidence.openapi.json",
+    "status": "pulled at the pinned ref (build artifact, regenerated each build). A running Evidence service publishes the same generated document at `GET /openapi.json` with no authentication required.",
+    "reference_path": "/reference/apis/evidence/"
   }
 ]
diff --git a/docs/site/src/data/generated/project-authoring-journeys.json b/docs/site/src/data/generated/project-authoring-journeys.json
index 8584d631f..f650283a3 100644
--- a/docs/site/src/data/generated/project-authoring-journeys.json
+++ b/docs/site/src/data/generated/project-authoring-journeys.json
@@ -5,7 +5,7 @@
     "summary": "One fixed bounded HTTP request with a closed response projection.",
     "source": "crates/registryctl/assets/project-starters/bounded-http",
     "classification": "maintained",
-    "topology": "combined",
+    "topology": "relay-only",
     "starter": "http",
     "project_dir": "http-project",
     "capabilities": [
@@ -41,10 +41,10 @@
   {
     "id": "custom-system",
     "label": "Custom HTTP conformance workspace",
-    "summary": "Combined HTTP acquisition and registry-backed evidence coverage.",
+    "summary": "Bounded HTTP acquisition and registry-backed consultation coverage.",
     "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system",
     "classification": "maintained",
-    "topology": "combined",
+    "topology": "relay-only",
     "project_dir": "crates/registryctl/tests/fixtures/project-authoring/custom-system",
     "capabilities": [
       "trace",
@@ -69,7 +69,7 @@
     "summary": "Conformance coverage for the bounded Script adapter surface.",
     "source": "crates/registryctl/tests/fixtures/project-authoring/dhis2-script",
     "classification": "conformance-only",
-    "topology": "combined",
+    "topology": "relay-only",
     "project_dir": "crates/registryctl/tests/fixtures/project-authoring/dhis2-script",
     "capabilities": [
       "test",
@@ -85,10 +85,10 @@
   {
     "id": "dhis2-tracker",
     "label": "DHIS2 Tracker",
-    "summary": "Bounded DHIS2 Tracker acquisition normalized into reusable health evidence for consumer-owned decisions.",
+    "summary": "Bounded DHIS2 Tracker acquisition normalized into reusable consultation outputs for consumer-owned decisions.",
     "source": "crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker",
     "classification": "maintained",
-    "topology": "combined",
+    "topology": "relay-only",
     "project_dir": "crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker",
     "capabilities": [
       "editor",
@@ -117,7 +117,7 @@
     "summary": "A product-neutral script adapter with bounded FHIR R4 search-set parsing.",
     "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active",
     "classification": "maintained",
-    "topology": "combined",
+    "topology": "relay-only",
     "project_dir": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active",
     "capabilities": [
       "editor",
@@ -150,10 +150,12 @@
     "topology": "relay-only",
     "project_dir": "crates/registryctl/tests/fixtures/project-authoring/nia-attribute-release",
     "capabilities": [
-      "check"
+      "check",
+      "build"
     ],
     "commands": [
-      "registryctl -C crates/registryctl/tests/fixtures/project-authoring/nia-attribute-release check --environment local --explain"
+      "registryctl -C crates/registryctl/tests/fixtures/project-authoring/nia-attribute-release check --environment local --explain",
+      "registryctl -C crates/registryctl/tests/fixtures/project-authoring/nia-attribute-release build --environment local"
     ]
   },
   {
@@ -162,7 +164,7 @@
     "summary": "A product-neutral script adapter with the signed DCI search verification profile.",
     "source": "crates/registryctl/tests/fixtures/project-authoring/opencrvs",
     "classification": "maintained",
-    "topology": "combined",
+    "topology": "relay-only",
     "project_dir": "crates/registryctl/tests/fixtures/project-authoring/opencrvs",
     "capabilities": [
       "editor",
@@ -191,7 +193,7 @@
     "summary": "A maintained synthetic case study for a bounded Events API-shaped search using generic OAuth client credentials and Rhai.",
     "source": "crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api",
     "classification": "maintained",
-    "topology": "combined",
+    "topology": "relay-only",
     "project_dir": "crates/registryctl/tests/fixtures/project-authoring/opencrvs-events-api",
     "capabilities": [
       "trace",
@@ -216,7 +218,7 @@
     "summary": "Country-owned DCI mapping coverage for match, no-match, and ambiguity.",
     "source": "crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant",
     "classification": "maintained",
-    "topology": "combined",
+    "topology": "relay-only",
     "project_dir": "crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant",
     "capabilities": [
       "trace",
@@ -241,7 +243,7 @@
     "summary": "Offline fixture, configuration validation, and build coverage for a synthetic OpenSPP exact lookup.",
     "source": "crates/registryctl/tests/fixtures/project-authoring/openspp-exact",
     "classification": "maintained",
-    "topology": "combined",
+    "topology": "relay-only",
     "evidence": "offline-fixture-validation",
     "project_dir": "crates/registryctl/tests/fixtures/project-authoring/openspp-exact",
     "capabilities": [
@@ -271,28 +273,32 @@
     "project_dir": "crates/registryctl/tests/fixtures/project-authoring/relay-only-materialization",
     "capabilities": [
       "test",
-      "check"
+      "check",
+      "build"
     ],
     "commands": [
       "registryctl -C crates/registryctl/tests/fixtures/project-authoring/relay-only-materialization test",
-      "registryctl -C crates/registryctl/tests/fixtures/project-authoring/relay-only-materialization check --environment local --explain"
+      "registryctl -C crates/registryctl/tests/fixtures/project-authoring/relay-only-materialization check --environment local --explain",
+      "registryctl -C crates/registryctl/tests/fixtures/project-authoring/relay-only-materialization build --environment local"
     ]
   },
   {
     "id": "relay-only-records",
     "label": "Relay-only records API",
-    "summary": "Fixtureless Relay records configuration with no Notary inputs.",
+    "summary": "Fixtureless Relay records configuration with no consultation inputs.",
     "source": "crates/registryctl/tests/fixtures/project-authoring/relay-only-records",
     "classification": "maintained",
     "topology": "relay-only",
     "project_dir": "crates/registryctl/tests/fixtures/project-authoring/relay-only-records",
     "capabilities": [
       "test",
-      "check"
+      "check",
+      "build"
     ],
     "commands": [
       "registryctl -C crates/registryctl/tests/fixtures/project-authoring/relay-only-records test",
-      "registryctl -C crates/registryctl/tests/fixtures/project-authoring/relay-only-records check --environment local --explain"
+      "registryctl -C crates/registryctl/tests/fixtures/project-authoring/relay-only-records check --environment local --explain",
+      "registryctl -C crates/registryctl/tests/fixtures/project-authoring/relay-only-records build --environment local"
     ]
   },
   {
@@ -301,7 +307,7 @@
     "summary": "An exact lookup over one immutable local materialization.",
     "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact",
     "classification": "maintained",
-    "topology": "combined",
+    "topology": "relay-only",
     "project_dir": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact",
     "capabilities": [
       "editor",
@@ -327,10 +333,10 @@
   {
     "id": "snapshot-with-records",
     "label": "Snapshot with records API",
-    "summary": "Match and no-match evidence sharing one authorized Relay materialization with records.",
+    "summary": "Match and no-match consultations sharing one authorized Relay materialization with records.",
     "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records",
     "classification": "maintained",
-    "topology": "combined",
+    "topology": "relay-only",
     "project_dir": "crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records",
     "capabilities": [
       "trace",
@@ -352,12 +358,12 @@
   {
     "id": "spreadsheet",
     "label": "Spreadsheet",
-    "summary": "A protected records API and bounded evidence service over a contained workbook.",
+    "summary": "A protected records API over a contained workbook.",
     "source": "crates/registryctl/assets/project-starters/spreadsheet",
     "project_dir": "spreadsheet-project",
     "focused_fixture_file": "match.yaml",
     "classification": "maintained",
-    "topology": "combined",
+    "topology": "relay-only",
     "starter": "spreadsheet",
     "environment": "local",
     "check_explain": true,
diff --git a/docs/site/src/data/generated/project-starters.json b/docs/site/src/data/generated/project-starters.json
index 492ef5d94..a167b25b6 100644
--- a/docs/site/src/data/generated/project-starters.json
+++ b/docs/site/src/data/generated/project-starters.json
@@ -2,12 +2,12 @@
   {
     "id": "spreadsheet",
     "label": "Spreadsheet",
-    "summary": "A protected records API and bounded evidence service over a contained workbook.",
+    "summary": "A protected records API over a contained workbook.",
     "source": "crates/registryctl/assets/project-starters/spreadsheet",
     "project_dir": "spreadsheet-project",
     "focused_fixture_file": "match.yaml",
     "classification": "maintained",
-    "topology": "combined",
+    "topology": "relay-only",
     "starter": "spreadsheet",
     "environment": "local",
     "check_explain": true,
@@ -44,7 +44,7 @@
     "summary": "One fixed bounded HTTP request with a closed response projection.",
     "source": "crates/registryctl/assets/project-starters/bounded-http",
     "classification": "maintained",
-    "topology": "combined",
+    "topology": "relay-only",
     "starter": "http",
     "project_dir": "http-project",
     "capabilities": [
diff --git a/docs/site/src/data/generated/projects.json b/docs/site/src/data/generated/projects.json
index b4723513c..b3e3ffa10 100644
--- a/docs/site/src/data/generated/projects.json
+++ b/docs/site/src/data/generated/projects.json
@@ -4,16 +4,15 @@
     "name": "Registry Platform",
     "repo_path": "../registry-platform",
     "target_repo_path": "../registry-platform",
-    "role": "Shared Rust workspace for security and operational primitives consumed by Registry Relay, Registry Notary, and related registry services, including auth helpers, OIDC verification, JWKS fetching, audit envelopes, HTTP security, outbound HTTP policy, crypto, SD-JWT VC support, and test fixtures.",
+    "role": "Shared Rust workspace for security and operational primitives consumed by Registry Relay, Evidence, and related registry services, including auth helpers, OIDC verification, JWKS fetching, audit envelopes, HTTP security, outbound HTTP policy, crypto, SD-JWT VC support, and test fixtures.",
     "owns": [
       "Shared auth, OIDC, JWKS fetching, audit, HTTP security, outbound HTTP, crypto, SD-JWT, and testing primitives.",
-      "OID4VCI pre-authorized offer, token request, credential request, issuer metadata, and replay-bound holder-proof primitives via the `registry-platform-oid4vci` crate.",
-      "Cross-service crate APIs that must behave consistently in Relay, Notary, and future registry services.",
+      "Cross-service crate APIs that must behave consistently in Relay, Evidence, and other registry services.",
       "Shared Rust hygiene templates and supported integration-test fixtures."
     ],
     "does_not_own": [
       "Registry Relay runtime data access, entity routing, metadata publication, or scope policy semantics.",
-      "Registry Notary claim configuration, evaluation rules, disclosure policy decisions, or service routes.",
+      "Evidence requirement definitions, authorization grants, disclosure decisions, service routes, assertion construction, or signing policy.",
       "Product-level authorization policy, tenant isolation, audit retention, secret provisioning, or deployment configuration."
     ],
     "source_docs": [
@@ -33,17 +32,17 @@
     "name": "Registry Manifest",
     "repo_path": "../registry-manifest",
     "target_repo_path": "../registry-manifest",
-    "role": "Renders standards-shaped catalog, service, schema, form, policy, evidence-offering, public Notary federation, OGC Records, and embedded SKOS-shaped codelist metadata from a single YAML metadata manifest, so a registry's published surface stays consistent across formats.",
+    "role": "Renders standards-shaped catalog, service, schema, form, policy, evidence-offering, OGC Records, and embedded SKOS-shaped codelist metadata from a single YAML metadata manifest, so a registry's published surface stays consistent across formats.",
     "owns": [
       "Metadata manifest model and compiled metadata model.",
       "Pure renderers for catalog, DCAT, CPSV-AP service catalogues, CCCEV requirements and evidence type lists, BRegDCAT-AP, SHACL, JSON Schema, form JSON Schema, OGC Records, policies, evidence offerings, and embedded SKOS-shaped codelist nodes.",
-      "Public Registry Notary federation metadata and evaluation profile validation.",
       "CLI validation, rendering, static publication, and profile fixture validation."
     ],
     "does_not_own": [
       "Registry Relay runtime data access.",
       "Auth, audit, observability, DataFusion, Postgres, Axum, or secret handling.",
-      "Production source configuration."
+      "Production source configuration.",
+      "Evidence deployment configuration. An Evidence process loads one immutable governed bundle and one closed runtime file mounted read-only at startup, and reads no portable manifest."
     ],
     "source_docs": [
       {
@@ -73,8 +72,7 @@
     "does_not_own": [
       "Source-registry provisioning, write-back, or domain-data mutation paths in v1.",
       "Portable metadata schema ownership.",
-      "Standalone claim service internals owned by Registry Notary.",
-      "Credential issuance, DID hosting, and issuer signing keys owned by Registry Notary.",
+      "Assertion evaluation, disclosure policy, and signing owned by Evidence, which reads a Relay API as one ordinary fixed HTTP source.",
       "Shared security and operational primitives owned by Registry Platform.",
       "Storage table ids or arbitrary SQL in public APIs."
     ],
@@ -95,49 +93,71 @@
     "rename_status": "Local checkout renamed to `registry-relay`; old worktrees under `registry_relay-*` remain for historical evidence."
   },
   {
-    "id": "registry-notary",
-    "name": "Registry Notary",
-    "repo_path": "../registry-notary",
-    "target_repo_path": "../registry-notary",
-    "role": "Standalone service that evaluates claims from compiler-pinned Relay consultations, serves static-peer federated delegated evaluation, and issues SD-JWT verifiable credentials only from exact Relay-backed evaluation provenance, composing shared auth, audit, OIDC, HTTP security, crypto, SD-JWT, and testing primitives from Registry Platform.",
+    "id": "registry-evidence",
+    "name": "Evidence",
+    "repo_path": "../registry-stack",
+    "target_repo_path": "../registry-stack",
+    "role": "Minimum-disclosure assertion service. Given authenticated authority, an authorized purpose, a predefined requirement, and the selector data an authoritative provider needs, it answers one bounded question about one subject and returns the smallest sufficient signed assertion, composing shared audit, crypto, HTTP security, OIDC, and SD-JWT primitives from Registry Platform.",
     "owns": [
-      "Claim configuration and evaluation.",
-      "Disclosure policy and redacted audit event semantics.",
-      "Registry Notary API routes.",
-      "Static-peer delegated evaluation at `/federation/v1/evaluations`.",
-      "Credential issuance workflow, exact Relay execution provenance verification, and claim-to-credential mapping. - Profiled OID4VCI issuer-initiated pre-authorized flow, transaction-bound holder proof, Type Metadata, credential endpoint, and issuer metadata. - Digitally authenticated representative OID4VCI issuance with a Relay-proven requester-to-target relationship.",
-      "Compiler-pinned Registry Relay consultation contracts for registry-backed claims."
+      "Requirement definitions, bounded evaluation, and the acquisition posture recorded with every answer.",
+      "Authorization grants, purpose and audience checks, and the disclosure decision that releases an assertion.",
+      "Fixed bounded HTTP JSON source execution, and bounded script-owned request preparation, extraction, and derivation.",
+      "Assertion construction, signing, response format selection, and redacted audit events.",
+      "The `evidence` binary, one serving process, and one operator-controlled trust domain."
     ],
     "does_not_own": [
-      "Registry source access, credentials, protocol adaptation, or Registry Relay runtime internals.",
-      "Credential issuance from claims without exact Relay evaluation provenance or from unconfigured delegated evaluations.",
-      "Wallet-facing authorization-code, EUDI, HAIP, PAR, DPoP, wallet-attestation, or ES256-holder profiles.",
+      "General source access, protocol adaptation, or Registry Relay runtime internals. A Relay API is one ordinary fixed HTTP source.",
+      "Record lookup or identity resolution beyond a provider outcome of match, no match, or ambiguous.",
       "Portable metadata renderers owned by Registry Manifest.",
       "Shared security and operational primitives owned by Registry Platform.",
-      "Open federation, dynamic trust-chain discovery, shared replay storage, or federated credential issuance.",
-      "Browser inspection workflows outside the current formal v1 stack scope.",
-      "Claim evidence supplied only by the caller or identity token."
+      "Token issuance, end-user authentication, or identity proofing.",
+      "A credential lifecycle. No issuance workflow, holder binding, status list, revocation, delegated evaluation, or federation. SD-JWT VC adds a response format under a frozen profile, never a lifecycle.",
+      "How a consumer acts on a returned assertion."
     ],
     "source_docs": [
       {
         "label": "README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.16.3/products/notary/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/HEAD/products/evidence/README.md"
       },
       {
-        "label": "OpenAPI source",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.16.3/crates/registry-notary-server/src/openapi.rs"
+        "label": "Operator contract",
+        "url": "https://github.com/registrystack/registry-stack/blob/HEAD/products/evidence/OPERATOR-CONTRACT.md"
       }
     ],
-    "rename_status": "Already using the target repo name locally."
+    "rename_status": "Developed in the Registry Stack monorepo as one `registry-evidence` crate; no separate repository."
+  },
+  {
+    "id": "registry-mint",
+    "name": "Registry Mint",
+    "repo_path": "../registry-stack",
+    "target_repo_path": "../registry-stack",
+    "role": "Supporting service rather than a product line. Issues short-lived, audience-bound access tokens to registered machine clients, so a resource server such as Evidence can require signed expiring tokens without the deployment first standing up a general purpose identity provider.",
+    "owns": [
+      "The client registry that binds a client id to that client's own public keys and to the authority Mint asserts for it.",
+      "The `client_credentials` grant with `private_key_jwt` client authentication, verifying an assertion against the keys of the client it claims to be, selected before signature verification.",
+      "Token signing, lifetime, and audience binding, and the `mint` binary."
+    ],
+    "does_not_own": [
+      "End-user authentication, identity proofing, or consent.",
+      "Caller-declared authority. Authority is written from the client registry, never from the assertion payload.",
+      "Evidence requirement definitions, authorization grants, or disclosure decisions."
+    ],
+    "source_docs": [
+      {
+        "label": "README",
+        "url": "https://github.com/registrystack/registry-stack/blob/HEAD/crates/registry-mint/README.md"
+      }
+    ],
+    "rename_status": "Developed in the Registry Stack monorepo as one `registry-mint` crate; no separate repository."
   },
   {
     "id": "solmara-lab",
     "name": "Solmara Lab",
     "repo_path": "../solmara-lab",
     "target_repo_path": "../solmara-lab",
-    "role": "Standalone Registry Stack adopter demo for the fictional Republic of Solmara. Runs published Registry Stack images pinned by digest with generated synthetic data, purpose-limited Relay APIs, Notary evidence services, and citizen portal journeys.",
+    "role": "Standalone Registry Stack adopter demo for the fictional Republic of Solmara. Runs a whole country's worth of registry services over generated synthetic data, with purpose-limited Relay APIs per authority, short-lived access tokens from Registry Mint, Evidence answering over a Relay-protected API, a citizen portal, and a public Visitor's Center.",
     "owns": [
-      "End-to-end local and hosted demo topologies for Relay, Notary, Postgres, eSignet, static metadata, scenario services, and the citizen portal.",
+      "End-to-end local and hosted demo topologies for Relay, Evidence, Mint, workload identity agents, Postgres, static metadata, scenario services, the citizen portal, and the Visitor's Center.",
       "Deterministic synthetic data, authority-owned demo configuration, purpose catalogues, and fictional country stories.",
       "Demo orchestration, smoke checks, browser journeys, hosted deployment wrappers, and release-pin checks."
     ],
diff --git a/docs/site/src/data/generated/sidebar.json b/docs/site/src/data/generated/sidebar.json
index 0093e73d4..7a4529fa1 100644
--- a/docs/site/src/data/generated/sidebar.json
+++ b/docs/site/src/data/generated/sidebar.json
@@ -73,125 +73,62 @@
     ]
   },
   {
-    "label": "Notary",
+    "label": "Manifest",
     "collapsed": true,
     "items": [
       {
         "label": "Overview",
-        "slug": "products/registry-notary"
+        "slug": "products/registry-manifest"
       },
       {
-        "label": "How-to",
-        "items": [
-          {
-            "label": "Client SDK guide",
-            "slug": "products/registry-notary/client-sdk-guide"
-          },
-          {
-            "label": "Source and claim modeling",
-            "slug": "products/registry-notary/source-claim-modeling-guide"
-          },
-          {
-            "label": "Federated evaluation operator guide",
-            "slug": "products/registry-notary/federated-evaluation-operator-guide"
-          },
-          {
-            "label": "PostgreSQL state operations",
-            "slug": "products/registry-notary/postgresql-state-operations"
-          },
-          {
-            "label": "Subject access operator guide",
-            "slug": "products/registry-notary/subject-access-operator-guide"
-          },
-          {
-            "label": "Credential lifecycle and status",
-            "slug": "products/registry-notary/credential-lifecycle-status"
-          },
-          {
-            "label": "Credential issuance migration",
-            "slug": "products/registry-notary/credential-issuance-migration"
-          },
-          {
-            "label": "Signing key provider",
-            "slug": "products/registry-notary/signing-key-provider"
-          },
-          {
-            "label": "Deployment hardening runbook",
-            "slug": "products/registry-notary/deployment-hardening-runbook"
-          },
-          {
-            "label": "OID4VCI wallet interop",
-            "slug": "products/registry-notary/oid4vci-wallet-interop"
-          }
-        ]
+        "label": "Validate and render a manifest",
+        "slug": "products/registry-manifest/validate-and-render"
       },
       {
-        "label": "Reference",
-        "items": [
-          {
-            "label": "Operator configuration reference",
-            "slug": "products/registry-notary/operator-config-reference"
-          },
-          {
-            "label": "API reference",
-            "slug": "products/registry-notary/api-reference"
-          },
-          {
-            "label": "SD-JWT VC conformance profile",
-            "slug": "products/registry-notary/sd-jwt-vc-conformance-profile"
-          },
-          {
-            "label": "Release notes",
-            "slug": "products/registry-notary/release-notes"
-          }
-        ]
+        "label": "Validate against profile fixtures",
+        "slug": "products/registry-manifest/profile-fixtures"
       },
       {
-        "label": "Explanation",
-        "items": [
-          {
-            "label": "Notary architecture",
-            "slug": "products/registry-notary/architecture-overview"
-          },
-          {
-            "label": "Capability matrix",
-            "slug": "products/registry-notary/notary-capability-matrix"
-          },
-          {
-            "label": "Scenario patterns",
-            "slug": "products/registry-notary/notary-scenario-patterns"
-          },
-          {
-            "label": "Identity and record matching",
-            "slug": "products/registry-notary/identity-and-record-matching"
-          }
-        ]
+        "label": "ITB and SEMIC validation",
+        "slug": "products/registry-manifest/itb-semic-validation"
+      },
+      {
+        "label": "Reference",
+        "slug": "products/registry-manifest/reference"
       }
     ]
   },
   {
-    "label": "Manifest",
+    "label": "Evidence",
     "collapsed": true,
     "items": [
       {
         "label": "Overview",
-        "slug": "products/registry-manifest"
+        "slug": "products/registry-evidence"
       },
       {
-        "label": "Validate and render a manifest",
-        "slug": "products/registry-manifest/validate-and-render"
+        "label": "Product concept",
+        "slug": "products/registry-evidence/concept"
       },
       {
-        "label": "Validate against profile fixtures",
-        "slug": "products/registry-manifest/profile-fixtures"
+        "label": "First server curl",
+        "slug": "products/registry-evidence/first-curl-test"
       },
       {
-        "label": "ITB and SEMIC validation",
-        "slug": "products/registry-manifest/itb-semic-validation"
+        "label": "Source testing",
+        "slug": "products/registry-evidence/source-testing"
       },
       {
-        "label": "Reference",
-        "slug": "products/registry-manifest/reference"
+        "label": "SD-JWT VC demo",
+        "slug": "products/registry-evidence/sd-jwt-vc-demo"
+      },
+      {
+        "label": "Operator contract",
+        "slug": "products/registry-evidence/operator-contract"
+      },
+      {
+        "label": "Performance",
+        "slug": "products/registry-evidence/performance"
       }
     ]
   }
diff --git a/docs/site/src/data/generated/standards.json b/docs/site/src/data/generated/standards.json
index 07089f66f..409173803 100644
--- a/docs/site/src/data/generated/standards.json
+++ b/docs/site/src/data/generated/standards.json
@@ -192,8 +192,7 @@
     "claim_level": "emits",
     "adoption_mode": "adopted",
     "used_by": [
-      "registry-relay",
-      "registry-notary"
+      "registry-relay"
     ],
     "surfaces": [
       "generated API reference",
@@ -218,7 +217,7 @@
       }
     ],
     "last_checked": "2026-07-19",
-    "notes": "Relay and Notary generate OpenAPI; the pinned generated documents are cited directly. These docs publish the same pinned artifacts as native API reference pages."
+    "notes": "Relay generates OpenAPI, and its pinned generated document is cited directly. These docs publish that same pinned artifact as a native API reference page. The two Registry Notary links stay pinned as the record of a retired product, not as a surface an adopter can run."
   },
   {
     "id": "shacl",
@@ -329,8 +328,7 @@
     "adoption_mode": "adopted",
     "used_by": [
       "registry-relay",
-      "registry-manifest",
-      "registry-notary"
+      "registry-manifest"
     ],
     "surfaces": [
       "catalog JSON-LD",
@@ -365,7 +363,6 @@
     "claim_level": "emits",
     "adoption_mode": "profiled",
     "used_by": [
-      "registry-notary",
       "registry-platform"
     ],
     "surfaces": [
@@ -388,7 +385,7 @@
       }
     ],
     "last_checked": "2026-06-13",
-    "notes": "Registry Platform owns reusable SD-JWT VC issuance and holder-proof helpers. Registry Notary owns the claim-to-credential workflow and service routes that use them. The profile is constrained: `application/dc+sd-jwt` credentials, issuer signing with EdDSA over Ed25519 or ES256 over P-256, and EdDSA `did:jwk` holder binding. Pre-rename format aliases such as `application/vc+sd-jwt` are rejected in operator configuration. Full SD-JWT VC conformance is not claimed."
+    "notes": "Registry Platform owns reusable SD-JWT VC issuance and holder-proof helpers. Registry Notary owned the claim-to-credential workflow and the service routes that used them, and is retired; its pinned conformance profile and format constants are kept as the record of that workflow. The helpers stay constrained: `application/dc+sd-jwt` credentials, issuer signing with EdDSA over Ed25519 or ES256 over P-256, and EdDSA `did:jwk` holder binding. The retired product also rejected pre-rename format aliases such as `application/vc+sd-jwt` in operator configuration. Full SD-JWT VC conformance is not claimed."
   },
   {
     "id": "verifiable-credentials",
@@ -399,9 +396,7 @@
     "status": "referenced",
     "claim_level": "aligns_with",
     "adoption_mode": "not adopted",
-    "used_by": [
-      "registry-notary"
-    ],
+    "used_by": [],
     "surfaces": [
       "credential issuance positioning",
       "SD-JWT VC credential issuance"
@@ -413,7 +408,7 @@
       }
     ],
     "last_checked": "2026-05-23",
-    "notes": "Registry Notary issues SD-JWT VC. Relay no longer emits or hosts VC artifacts."
+    "notes": "No Registry Stack service in this register emits or hosts VC artifacts. Registry Notary, which issued SD-JWT VC under this alignment, is retired, and Relay does not emit or host VC artifacts. The pinned README is the record of the retired claim."
   },
   {
     "id": "cccev",
@@ -425,8 +420,7 @@
     "claim_level": "emits",
     "adoption_mode": "profiled",
     "used_by": [
-      "registry-manifest",
-      "registry-notary"
+      "registry-manifest"
     ],
     "surfaces": [
       "requirement and information requirement metadata",
@@ -450,7 +444,7 @@
       }
     ],
     "last_checked": "2026-05-25",
-    "notes": "Manifest emits CCCEV requirement and evidence type list metadata. Notary renders CCCEV-shaped claim results. Profile conformance is not claimed."
+    "notes": "Manifest emits CCCEV requirement and evidence type list metadata. The pinned Notary renderer and media type constants record the CCCEV-shaped claim results of a retired product. Profile conformance is not claimed."
   },
   {
     "id": "odrl",
@@ -534,9 +528,7 @@
     "status": "referenced",
     "claim_level": "inspired_by",
     "adoption_mode": "not adopted",
-    "used_by": [
-      "registry-notary"
-    ],
+    "used_by": [],
     "surfaces": [
       "provenance model discussion",
       "provenance-shaped claim fields"
@@ -548,7 +540,7 @@
       }
     ],
     "last_checked": "2026-05-23",
-    "notes": "The code uses provenance concepts, but current evidence does not show a PROV-O vocabulary emission surface. Keep this as design influence until PROV-O terms are emitted or mapped."
+    "notes": "The pinned claim model belongs to Registry Notary, which is retired. Provenance concepts shaped that model, but no PROV-O vocabulary emission surface was shown then and no service in this register claims one now. Keep this as design influence until PROV-O terms are emitted or mapped."
   },
   {
     "id": "fhir-r4",
@@ -615,8 +607,7 @@
     "adoption_mode": "not adopted",
     "used_by": [
       "registry-relay",
-      "registry-manifest",
-      "registry-notary"
+      "registry-manifest"
     ],
     "surfaces": [
       "Framework 2.0 principle and pathway comparison",
@@ -658,45 +649,7 @@
       }
     ],
     "last_checked": "2026-07-19",
-    "notes": "Relay exposes an SP-DCI sync adapter behind `spdci-api-standards`. The adapter and standards-CEL mapping are experimental, feature-frozen, and outside the 1.0 compatibility promise. A Registry Stack project can also compile a reviewed DCI source journey into a Relay consultation. Registry Notary consumes the consultation result and does not connect to DCI sources directly."
-  },
-  {
-    "id": "oid4vci",
-    "name": "OpenID for Verifiable Credential Issuance",
-    "standards_body": "OpenID Foundation",
-    "official_url": "https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html",
-    "version_or_profile": "Profiled issuer subset using `dc+sd-jwt`, issuer-initiated pre-authorized code, and `openid4vci.support: not_full_issuer`",
-    "status": "used",
-    "claim_level": "emits",
-    "adoption_mode": "profiled",
-    "used_by": [
-      "registry-notary",
-      "registry-platform"
-    ],
-    "surfaces": [
-      "issuer-initiated offer start and authenticated callback",
-      "pre-authorized token endpoint with transaction-bound proof nonce",
-      "credential issuance endpoint",
-      "SD-JWT VC Type Metadata",
-      "issuer metadata at `/.well-known/openid-credential-issuer`",
-      "registry-backed holder-wallet issuance"
-    ],
-    "evidence_docs": [
-      {
-        "label": "Registry Notary OID4VCI routes",
-        "url": "https://github.com/registrystack/registry-stack/blob/d45761a0104bd3d9c2e4b4db391d4223f289bd44/crates/registry-notary-server/src/api.rs"
-      },
-      {
-        "label": "Registry Platform OID4VCI crate",
-        "url": "https://github.com/registrystack/registry-stack/tree/d45761a0104bd3d9c2e4b4db391d4223f289bd44/crates/registry-platform-oid4vci"
-      },
-      {
-        "label": "Registry Notary wallet facade specification",
-        "url": "https://github.com/registrystack/registry-stack/blob/37ce044567f05f8b3088b54f5bd4dbf389fd2ddb/products/notary/specs/openid4vci-wallet-facade-spec.md"
-      }
-    ],
-    "last_checked": "2026-07-19",
-    "notes": "Registry Notary exposes a registry-backed, issuer-initiated pre-authorized code flow. The identity provider's authorization code is an internal Notary input and not a wallet grant. Metadata advertises `dc+sd-jwt`, EdDSA `did:jwk` holder proof, and the configured EdDSA or ES256 issuer algorithm. Transaction code is required by default; an explicit no-PIN profile has a maximum 300-second bearer-offer window. Caller-provided or identity-token data cannot become claim evidence. The profile makes no claim for a public nonce endpoint, response next nonce, wallet-facing authorization code, ES256 holder proof, EUDI, HAIP, PAR, DPoP, or wallet attestation. Source tests cover the full issuance and client-verification journey. External wallet, verifier, and OpenID conformance evidence remains candidate-only until captured from a frozen release artifact."
+    "notes": "Relay exposes an SP-DCI sync adapter behind `spdci-api-standards`. The adapter and standards-CEL mapping are experimental, feature-frozen, and outside the 1.0 compatibility promise. A Registry Stack project can also compile a reviewed DCI source journey into a Relay consultation. Relay is the only Registry Stack surface that connects to a DCI source; a consumer receives the consultation result instead."
   },
   {
     "id": "w3c-did",
@@ -708,7 +661,6 @@
     "claim_level": "emits",
     "adoption_mode": "profiled",
     "used_by": [
-      "registry-notary",
       "registry-platform"
     ],
     "surfaces": [
@@ -727,6 +679,6 @@
       }
     ],
     "last_checked": "2026-06-13",
-    "notes": "Notary parses did:jwk values for credential subjects, and Platform owns shared DID and Ed25519 JWK helpers. Relay no longer hosts a did:web document. No DID resolver, DID URL dereferencing, or DID Core conformance class is implemented, so the claim stays at emits. The site does not claim conformance to the wider DID method registry beyond did:jwk."
+    "notes": "Platform owns shared DID and Ed25519 JWK helpers, including did:jwk parsing. The pinned route file records how the retired Registry Notary used them for credential subjects. Relay no longer hosts a did:web document. No DID resolver, DID URL dereferencing, or DID Core conformance class is implemented, so the claim stays at emits. The site does not claim conformance to the wider DID method registry beyond did:jwk."
   }
 ]
diff --git a/docs/site/src/data/openapi-sources.yaml b/docs/site/src/data/openapi-sources.yaml
index 696acbbf1..809fc6869 100644
--- a/docs/site/src/data/openapi-sources.yaml
+++ b/docs/site/src/data/openapi-sources.yaml
@@ -5,10 +5,11 @@
   artifact: openapi/registry-relay.openapi.json
   status: pulled at the pinned ref (build artifact, regenerated each build). Use `GET /openapi.json` on a running gateway for the instance-specific shape of `{dataset_id}` and `{entity}`. Runtime deployments gate that route by default unless `openapi_requires_auth` is disabled for demos or controlled tooling.
   reference_path: /reference/apis/relay/
-- id: registry-notary
-  name: Registry Notary API
-  owner: registry-notary
-  source: Pulled from `registry-notary/openapi/registry-notary.openapi.json` at the pinned ref in `src/data/repo-docs.yaml` by `scripts/fetch-openapi.mjs`. The repo generates the spec with `cargo run -p registry-notary -- openapi`.
-  artifact: openapi/registry-notary.openapi.json
-  status: pulled at the pinned ref (build artifact, regenerated each build) with federation, OID4VCI, and response examples
-  reference_path: /reference/apis/notary/
+
+- id: registry-evidence
+  name: Registry Evidence API
+  owner: registry-evidence
+  source: Pulled from `products/evidence/generated/registry-evidence.openapi.json` at the pinned ref in `src/data/repo-docs.yaml` by `scripts/fetch-openapi.mjs`. The document is generated by `cargo run -p registry-evidence --example evidence-contracts` and byte-drift-checked in root CI by the `evidence-contracts` job.
+  artifact: openapi/registry-evidence.openapi.json
+  status: pulled at the pinned ref (build artifact, regenerated each build). A running Evidence service publishes the same generated document at `GET /openapi.json` with no authentication required.
+  reference_path: /reference/apis/evidence/
diff --git a/docs/site/src/data/projects.yaml b/docs/site/src/data/projects.yaml
index f0611b414..eb31aad47 100644
--- a/docs/site/src/data/projects.yaml
+++ b/docs/site/src/data/projects.yaml
@@ -2,15 +2,14 @@
   name: Registry Platform
   repo_path: ../registry-platform
   target_repo_path: ../registry-platform
-  role: Shared Rust workspace for security and operational primitives consumed by Registry Relay, Registry Notary, and related registry services, including auth helpers, OIDC verification, JWKS fetching, audit envelopes, HTTP security, outbound HTTP policy, crypto, SD-JWT VC support, and test fixtures.
+  role: Shared Rust workspace for security and operational primitives consumed by Registry Relay, Evidence, and related registry services, including auth helpers, OIDC verification, JWKS fetching, audit envelopes, HTTP security, outbound HTTP policy, crypto, SD-JWT VC support, and test fixtures.
   owns:
     - Shared auth, OIDC, JWKS fetching, audit, HTTP security, outbound HTTP, crypto, SD-JWT, and testing primitives.
-    - OID4VCI pre-authorized offer, token request, credential request, issuer metadata, and replay-bound holder-proof primitives via the `registry-platform-oid4vci` crate.
-    - Cross-service crate APIs that must behave consistently in Relay, Notary, and future registry services.
+    - Cross-service crate APIs that must behave consistently in Relay, Evidence, and other registry services.
     - Shared Rust hygiene templates and supported integration-test fixtures.
   does_not_own:
     - Registry Relay runtime data access, entity routing, metadata publication, or scope policy semantics.
-    - Registry Notary claim configuration, evaluation rules, disclosure policy decisions, or service routes.
+    - Evidence requirement definitions, authorization grants, disclosure decisions, service routes, assertion construction, or signing policy.
     - Product-level authorization policy, tenant isolation, audit retention, secret provisioning, or deployment configuration.
   source_docs:
     - label: README
@@ -22,16 +21,16 @@
   name: Registry Manifest
   repo_path: ../registry-manifest
   target_repo_path: ../registry-manifest
-  role: Renders standards-shaped catalog, service, schema, form, policy, evidence-offering, public Notary federation, OGC Records, and embedded SKOS-shaped codelist metadata from a single YAML metadata manifest, so a registry's published surface stays consistent across formats.
+  role: Renders standards-shaped catalog, service, schema, form, policy, evidence-offering, OGC Records, and embedded SKOS-shaped codelist metadata from a single YAML metadata manifest, so a registry's published surface stays consistent across formats.
   owns:
     - Metadata manifest model and compiled metadata model.
     - Pure renderers for catalog, DCAT, CPSV-AP service catalogues, CCCEV requirements and evidence type lists, BRegDCAT-AP, SHACL, JSON Schema, form JSON Schema, OGC Records, policies, evidence offerings, and embedded SKOS-shaped codelist nodes.
-    - Public Registry Notary federation metadata and evaluation profile validation.
     - CLI validation, rendering, static publication, and profile fixture validation.
   does_not_own:
     - Registry Relay runtime data access.
     - Auth, audit, observability, DataFusion, Postgres, Axum, or secret handling.
     - Production source configuration.
+    - Evidence deployment configuration. An Evidence process loads one immutable governed bundle and one closed runtime file mounted read-only at startup, and reads no portable manifest.
   source_docs:
     - label: README
       url: https://github.com/registrystack/registry-stack/blob/v0.16.3/products/manifest/README.md
@@ -52,8 +51,7 @@
   does_not_own:
     - Source-registry provisioning, write-back, or domain-data mutation paths in v1.
     - Portable metadata schema ownership.
-    - Standalone claim service internals owned by Registry Notary.
-    - Credential issuance, DID hosting, and issuer signing keys owned by Registry Notary.
+    - Assertion evaluation, disclosure policy, and signing owned by Evidence, which reads a Relay API as one ordinary fixed HTTP source.
     - Shared security and operational primitives owned by Registry Platform.
     - Storage table ids or arbitrary SQL in public APIs.
   source_docs:
@@ -64,42 +62,55 @@
     - label: Local metadata docs
       url: https://github.com/registrystack/registry-stack/blob/v0.16.3/crates/registry-relay/docs/metadata.md
   rename_status: Local checkout renamed to `registry-relay`; old worktrees under `registry_relay-*` remain for historical evidence.
-- id: registry-notary
-  name: Registry Notary
-  repo_path: ../registry-notary
-  target_repo_path: ../registry-notary
-  role: Standalone service that evaluates claims from compiler-pinned Relay consultations, serves static-peer federated delegated evaluation, and issues SD-JWT verifiable credentials only from exact Relay-backed evaluation provenance, composing shared auth, audit, OIDC, HTTP security, crypto, SD-JWT, and testing primitives from Registry Platform.
+- id: registry-evidence
+  name: Evidence
+  repo_path: ../registry-stack
+  target_repo_path: ../registry-stack
+  role: Minimum-disclosure assertion service. Given authenticated authority, an authorized purpose, a predefined requirement, and the selector data an authoritative provider needs, it answers one bounded question about one subject and returns the smallest sufficient signed assertion, composing shared audit, crypto, HTTP security, OIDC, and SD-JWT primitives from Registry Platform.
   owns:
-    - Claim configuration and evaluation.
-    - Disclosure policy and redacted audit event semantics.
-    - Registry Notary API routes.
-    - Static-peer delegated evaluation at `/federation/v1/evaluations`.
-    - Credential issuance workflow, exact Relay execution provenance verification, and claim-to-credential mapping.
-      - Profiled OID4VCI issuer-initiated pre-authorized flow, transaction-bound holder proof, Type Metadata, credential endpoint, and issuer metadata.
-      - Digitally authenticated representative OID4VCI issuance with a Relay-proven requester-to-target relationship.
-    - Compiler-pinned Registry Relay consultation contracts for registry-backed claims.
+    - Requirement definitions, bounded evaluation, and the acquisition posture recorded with every answer.
+    - Authorization grants, purpose and audience checks, and the disclosure decision that releases an assertion.
+    - Fixed bounded HTTP JSON source execution, and bounded script-owned request preparation, extraction, and derivation.
+    - Assertion construction, signing, response format selection, and redacted audit events.
+    - The `evidence` binary, one serving process, and one operator-controlled trust domain.
   does_not_own:
-    - Registry source access, credentials, protocol adaptation, or Registry Relay runtime internals.
-    - Credential issuance from claims without exact Relay evaluation provenance or from unconfigured delegated evaluations.
-    - Wallet-facing authorization-code, EUDI, HAIP, PAR, DPoP, wallet-attestation, or ES256-holder profiles.
+    - General source access, protocol adaptation, or Registry Relay runtime internals. A Relay API is one ordinary fixed HTTP source.
+    - Record lookup or identity resolution beyond a provider outcome of match, no match, or ambiguous.
     - Portable metadata renderers owned by Registry Manifest.
     - Shared security and operational primitives owned by Registry Platform.
-    - Open federation, dynamic trust-chain discovery, shared replay storage, or federated credential issuance.
-    - Browser inspection workflows outside the current formal v1 stack scope.
-    - Claim evidence supplied only by the caller or identity token.
+    - Token issuance, end-user authentication, or identity proofing.
+    - A credential lifecycle. No issuance workflow, holder binding, status list, revocation, delegated evaluation, or federation. SD-JWT VC adds a response format under a frozen profile, never a lifecycle.
+    - How a consumer acts on a returned assertion.
   source_docs:
     - label: README
-      url: https://github.com/registrystack/registry-stack/blob/v0.16.3/products/notary/README.md
-    - label: OpenAPI source
-      url: https://github.com/registrystack/registry-stack/blob/v0.16.3/crates/registry-notary-server/src/openapi.rs
-  rename_status: Already using the target repo name locally.
+      url: https://github.com/registrystack/registry-stack/blob/HEAD/products/evidence/README.md
+    - label: Operator contract
+      url: https://github.com/registrystack/registry-stack/blob/HEAD/products/evidence/OPERATOR-CONTRACT.md
+  rename_status: Developed in the Registry Stack monorepo as one `registry-evidence` crate; no separate repository.
+- id: registry-mint
+  name: Registry Mint
+  repo_path: ../registry-stack
+  target_repo_path: ../registry-stack
+  role: Supporting service rather than a product line. Issues short-lived, audience-bound access tokens to registered machine clients, so a resource server such as Evidence can require signed expiring tokens without the deployment first standing up a general purpose identity provider.
+  owns:
+    - The client registry that binds a client id to that client's own public keys and to the authority Mint asserts for it.
+    - The `client_credentials` grant with `private_key_jwt` client authentication, verifying an assertion against the keys of the client it claims to be, selected before signature verification.
+    - Token signing, lifetime, and audience binding, and the `mint` binary.
+  does_not_own:
+    - End-user authentication, identity proofing, or consent.
+    - Caller-declared authority. Authority is written from the client registry, never from the assertion payload.
+    - Evidence requirement definitions, authorization grants, or disclosure decisions.
+  source_docs:
+    - label: README
+      url: https://github.com/registrystack/registry-stack/blob/HEAD/crates/registry-mint/README.md
+  rename_status: Developed in the Registry Stack monorepo as one `registry-mint` crate; no separate repository.
 - id: solmara-lab
   name: Solmara Lab
   repo_path: ../solmara-lab
   target_repo_path: ../solmara-lab
-  role: Standalone Registry Stack adopter demo for the fictional Republic of Solmara. Runs published Registry Stack images pinned by digest with generated synthetic data, purpose-limited Relay APIs, Notary evidence services, and citizen portal journeys.
+  role: Standalone Registry Stack adopter demo for the fictional Republic of Solmara. Runs a whole country's worth of registry services over generated synthetic data, with purpose-limited Relay APIs per authority, short-lived access tokens from Registry Mint, Evidence answering over a Relay-protected API, a citizen portal, and a public Visitor's Center.
   owns:
-    - End-to-end local and hosted demo topologies for Relay, Notary, Postgres, eSignet, static metadata, scenario services, and the citizen portal.
+    - End-to-end local and hosted demo topologies for Relay, Evidence, Mint, workload identity agents, Postgres, static metadata, scenario services, the citizen portal, and the Visitor's Center.
     - Deterministic synthetic data, authority-owned demo configuration, purpose catalogues, and fictional country stories.
     - Demo orchestration, smoke checks, browser journeys, hosted deployment wrappers, and release-pin checks.
   does_not_own:
diff --git a/docs/site/src/data/repo-docs.yaml b/docs/site/src/data/repo-docs.yaml
index 969231577..d5a1beb14 100644
--- a/docs/site/src/data/repo-docs.yaml
+++ b/docs/site/src/data/repo-docs.yaml
@@ -195,262 +195,7 @@ repos:
             standards_referenced: [dcat, bregdcat-ap, ogc-api-records, ogc-api-features, ogc-api-edr, openapi, shacl, verifiable-credentials, odrl, sp-dci, w3c-did]
             last_reviewed: unreviewed
         exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
-  registry-notary:
-    remote: https://github.com/registrystack/registry-stack
-    ref: HEAD
-    version: main source (unreleased)
-    local: ../..
-    openapi: products/notary/openapi/registry-notary.openapi.json
-    archive_remote: https://github.com/jeremi/registry-notary
-    archive_openapi: openapi/registry-notary.openapi.json
-    docs:
-      - src: products/notary/docs/README.md
-        archive_src: docs/README.md
-        dest: products/registry-notary/index
-        label: Registry Notary
-        nav_order: 0
-        doc_type: explanation
-        last_reviewed: unreviewed
-        standards_referenced: [sd-jwt-vc, oid4vci, fhir-r4]
-        docset_overrides:
-          - docsets: [beta-2026-06-12]
-            standards_referenced: [sd-jwt-vc, oid4vci]
-            last_reviewed: unreviewed
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
-            standards_referenced: [sd-jwt-vc, oid4vci, fhir-r4]
-            last_reviewed: unreviewed
-        description: Integrator and operator documentation for Registry Notary.
-      - src: products/notary/docs/architecture-overview.md
-        archive_src: docs/architecture-overview.md
-        dest: products/registry-notary/architecture-overview
-        label: Notary architecture
-        nav_order: 10
-        doc_type: explanation
-        last_reviewed: unreviewed
-        standards_referenced: [sd-jwt-vc, oid4vci, w3c-did, fhir-r4]
-        docset_overrides:
-          - docsets: [beta-4, beta-3, beta-2026-06-12]
-            standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
-            last_reviewed: unreviewed
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5]
-            standards_referenced: [sd-jwt-vc, oid4vci, w3c-did, fhir-r4]
-            last_reviewed: unreviewed
-      - src: products/notary/docs/client-sdk-guide.md
-        archive_src: docs/client-sdk-guide.md
-        dest: products/registry-notary/client-sdk-guide
-        label: Client SDK guide
-        nav_order: 40
-        doc_type: how-to
-        last_reviewed: unreviewed
-        standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
-        docset_overrides:
-          - docsets: [beta-2026-06-12]
-            standards_referenced: [sd-jwt-vc, oid4vci]
-            last_reviewed: unreviewed
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
-            standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
-            last_reviewed: unreviewed
-      - src: products/notary/docs/identity-and-record-matching.md
-        archive_src: docs/identity-and-record-matching.md
-        dest: products/registry-notary/identity-and-record-matching
-        label: Identity and record matching
-        nav_order: 50
-        doc_type: explanation
-        last_reviewed: unreviewed
-        standards_referenced: [sd-jwt-vc, verifiable-credentials]
-        docset_overrides:
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
-            standards_referenced: [sd-jwt-vc, verifiable-credentials]
-            last_reviewed: unreviewed
-      - src: products/notary/docs/source-claim-modeling-guide.md
-        archive_src: docs/source-claim-modeling-guide.md
-        dest: products/registry-notary/source-claim-modeling-guide
-        label: Source and claim modeling
-        nav_order: 60
-        doc_type: how-to
-        last_reviewed: unreviewed
-        standards_referenced: [sd-jwt-vc, fhir-r4]
-        docset_overrides:
-          - docsets: [beta-4, beta-3, beta-2026-06-12]
-            standards_referenced: [sd-jwt-vc]
-            last_reviewed: unreviewed
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5]
-            standards_referenced: [sd-jwt-vc, fhir-r4]
-            last_reviewed: unreviewed
-      - src: products/notary/docs/operator-config-reference.md
-        archive_src: docs/operator-config-reference.md
-        dest: products/registry-notary/operator-config-reference
-        label: Operator configuration reference
-        nav_order: 70
-        doc_type: reference
-        last_reviewed: unreviewed
-        standards_referenced: [openapi, sd-jwt-vc, sp-dci, oid4vci, w3c-did, fhir-r4]
-        docset_overrides:
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0]
-            standards_referenced: [openapi, sd-jwt-vc, sp-dci, oid4vci, w3c-did, fhir-r4]
-            last_reviewed: unreviewed
-          - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
-            standards_referenced: [openapi, sd-jwt-vc, oid4vci, w3c-did, fhir-r4]
-            last_reviewed: unreviewed
-          - docsets: [beta-2026-06-12]
-            standards_referenced: [openapi, sd-jwt-vc, oid4vci, w3c-did]
-            last_reviewed: unreviewed
-      - src: products/notary/docs/postgresql-state-operations.md
-        dest: products/registry-notary/postgresql-state-operations
-        label: PostgreSQL state operations
-        nav_order: 75
-        doc_type: how-to
-        last_reviewed: unreviewed
-        standards_referenced: []
-        docset_overrides:
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0]
-            standards_referenced: []
-            last_reviewed: unreviewed
-        exclude_docsets: [v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
-      - src: products/notary/docs/credential-lifecycle-status.md
-        archive_src: docs/credential-lifecycle-status.md
-        dest: products/registry-notary/credential-lifecycle-status
-        label: Credential lifecycle and status
-        nav_order: 80
-        doc_type: how-to
-        last_reviewed: unreviewed
-        standards_referenced: [sd-jwt-vc, w3c-did]
-        docset_overrides:
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
-            standards_referenced: [sd-jwt-vc, w3c-did]
-            last_reviewed: unreviewed
-      - src: products/notary/docs/credential-issuance-migration.md
-        dest: products/registry-notary/credential-issuance-migration
-        label: Credential issuance migration
-        nav_order: 85
-        doc_type: how-to
-        last_reviewed: "2026-07-17"
-        standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
-        docset_overrides:
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0]
-            standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
-            last_reviewed: "2026-07-17"
-        exclude_docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
-      - src: products/notary/docs/signing-key-provider.md
-        archive_src: docs/signing-key-provider.md
-        dest: products/registry-notary/signing-key-provider
-        label: Signing key provider
-        nav_order: 90
-        doc_type: how-to
-        last_reviewed: unreviewed
-        standards_referenced: [sd-jwt-vc, w3c-did]
-        docset_overrides:
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
-            standards_referenced: [sd-jwt-vc, w3c-did]
-            last_reviewed: unreviewed
-      - src: products/notary/docs/sd-jwt-vc-conformance-profile.md
-        archive_src: docs/sd-jwt-vc-conformance-profile.md
-        dest: products/registry-notary/sd-jwt-vc-conformance-profile
-        label: SD-JWT VC conformance profile
-        nav_order: 130
-        doc_type: reference
-        last_reviewed: unreviewed
-        standards_referenced: [json-ld, sd-jwt-vc, verifiable-credentials, oid4vci, w3c-did]
-        docset_overrides:
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
-            standards_referenced: [json-ld, sd-jwt-vc, verifiable-credentials, oid4vci, w3c-did]
-            last_reviewed: unreviewed
-      - src: products/notary/docs/notary-capability-matrix.md
-        dest: products/registry-notary/notary-capability-matrix
-        label: Capability matrix
-        nav_order: 15
-        doc_type: explanation
-        last_reviewed: unreviewed
-        standards_referenced: [sd-jwt-vc, w3c-did]
-        exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
-        docset_overrides:
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
-            standards_referenced: [sd-jwt-vc, w3c-did]
-            last_reviewed: unreviewed
-      - src: products/notary/docs/notary-scenario-patterns.md
-        dest: products/registry-notary/notary-scenario-patterns
-        label: Scenario patterns
-        nav_order: 20
-        doc_type: explanation
-        last_reviewed: unreviewed
-        standards_referenced: [sd-jwt-vc, w3c-did]
-        exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
-        docset_overrides:
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
-            standards_referenced: [sd-jwt-vc, w3c-did]
-            last_reviewed: unreviewed
-      - src: products/notary/docs/federated-evaluation-operator-guide.md
-        dest: products/registry-notary/federated-evaluation-operator-guide
-        label: Federated evaluation operator guide
-        nav_order: 72
-        doc_type: how-to
-        last_reviewed: unreviewed
-        standards_referenced: [w3c-did]
-        exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
-        docset_overrides:
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
-            standards_referenced: [w3c-did]
-            last_reviewed: unreviewed
-      - src: products/notary/docs/subject-access-operator-guide.md
-        dest: products/registry-notary/subject-access-operator-guide
-        label: Subject access operator guide
-        nav_order: 75
-        doc_type: how-to
-        last_reviewed: unreviewed
-        standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
-        exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
-        docset_overrides:
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
-            standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
-            last_reviewed: unreviewed
-      - src: products/notary/docs/deployment-hardening-runbook.md
-        dest: products/registry-notary/deployment-hardening-runbook
-        label: Deployment hardening runbook
-        nav_order: 95
-        doc_type: how-to
-        last_reviewed: unreviewed
-        standards_referenced: [sd-jwt-vc, oid4vci]
-        exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
-        docset_overrides:
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
-            standards_referenced: [sd-jwt-vc, oid4vci]
-            last_reviewed: unreviewed
-      - src: products/notary/docs/api-reference.md
-        dest: products/registry-notary/api-reference
-        label: API reference
-        nav_order: 100
-        doc_type: reference
-        last_reviewed: unreviewed
-        standards_referenced: [openapi, sd-jwt-vc, cccev, oid4vci, fhir-r4]
-        exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
-        docset_overrides:
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
-            standards_referenced: [openapi, sd-jwt-vc, cccev, oid4vci, fhir-r4]
-            last_reviewed: unreviewed
-      - src: products/notary/docs/oid4vci-wallet-interop.md
-        dest: products/registry-notary/oid4vci-wallet-interop
-        label: OID4VCI wallet interop
-        nav_order: 110
-        doc_type: how-to
-        last_reviewed: unreviewed
-        standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
-        exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
-        docset_overrides:
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
-            standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
-            last_reviewed: unreviewed
-      - src: products/notary/docs/release-notes.md
-        dest: products/registry-notary/release-notes
-        label: Release notes
-        nav_order: 140
-        doc_type: reference
-        last_reviewed: unreviewed
-        standards_referenced: [openapi, sd-jwt-vc, oid4vci, fhir-r4]
-        exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
-        docset_overrides:
-          - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
-            standards_referenced: [openapi, sd-jwt-vc, oid4vci, fhir-r4]
-            last_reviewed: unreviewed
+
   registry-manifest:
     remote: https://github.com/registrystack/registry-stack
     ref: HEAD
@@ -528,3 +273,73 @@ repos:
           - docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
             standards_referenced: [dcat, bregdcat-ap, shacl, skos, json-schema, json-ld]
             last_reviewed: unreviewed
+  registry-evidence:
+    remote: https://github.com/registrystack/registry-stack
+    ref: HEAD
+    version: main source (unreleased)
+    local: ../..
+    openapi: products/evidence/generated/registry-evidence.openapi.json
+    docs:
+      - src: products/evidence/README.md
+        dest: products/registry-evidence/index
+        label: Registry Evidence
+        nav_order: 0
+        doc_type: explanation
+        last_reviewed: unreviewed
+        standards_referenced: [openapi, json-schema, sd-jwt-vc]
+        exclude_docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
+        description: Operator and integrator documentation for Evidence, the minimum-disclosure assertion service.
+      - src: products/evidence/CONCEPT.md
+        dest: products/registry-evidence/concept
+        label: Product concept
+        nav_order: 10
+        doc_type: explanation
+        last_reviewed: unreviewed
+        standards_referenced: [cccev, json-schema, openapi, sd-jwt-vc]
+        exclude_docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
+        description: Approved Version 1 product concept covering the boundary, data model, trust and privacy invariants, native API, and acceptance set.
+      - src: products/evidence/FIRST-CURL-TEST.md
+        dest: products/registry-evidence/first-curl-test
+        label: First server curl
+        nav_order: 20
+        doc_type: how-to
+        last_reviewed: unreviewed
+        standards_referenced: []
+        exclude_docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
+        description: Deterministic local curl checkpoint against the Evidence server with a mock source and an in-memory test JWKS.
+      - src: products/evidence/SOURCE-TESTING.md
+        dest: products/registry-evidence/source-testing
+        label: Source testing
+        nav_order: 30
+        doc_type: how-to
+        last_reviewed: unreviewed
+        standards_referenced: [sd-jwt-vc]
+        exclude_docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
+        description: Source-testing contract with the deterministic mock matrix, opt-in public demo smoke tests, and credential handling rules.
+      - src: products/evidence/SD-JWT-VC-DEMO.md
+        dest: products/registry-evidence/sd-jwt-vc-demo
+        label: SD-JWT VC demo
+        nav_order: 40
+        doc_type: how-to
+        last_reviewed: unreviewed
+        standards_referenced: [sd-jwt-vc]
+        exclude_docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
+        description: Deterministic local demo that issues one assertion in both later-verifiable formats and re-verifies the credential offline.
+      - src: products/evidence/OPERATOR-CONTRACT.md
+        dest: products/registry-evidence/operator-contract
+        label: Operator contract
+        nav_order: 50
+        doc_type: reference
+        last_reviewed: unreviewed
+        standards_referenced: [openapi, sd-jwt-vc]
+        exclude_docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
+        description: Supported deployment shape, requester authority and purpose duties, required configuration and secrets, and readiness, audit, and key obligations.
+      - src: products/evidence/PERFORMANCE.md
+        dest: products/registry-evidence/performance
+        label: Performance
+        nav_order: 60
+        doc_type: explanation
+        last_reviewed: unreviewed
+        standards_referenced: []
+        exclude_docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
+        description: Measured baseline of the audit-durability throughput trade and the deferred work that would recover most of the cost.
diff --git a/docs/site/src/data/standards.yaml b/docs/site/src/data/standards.yaml
index 59ecf1eee..5922b6715 100644
--- a/docs/site/src/data/standards.yaml
+++ b/docs/site/src/data/standards.yaml
@@ -135,7 +135,6 @@
   adoption_mode: adopted
   used_by:
     - registry-relay
-    - registry-notary
   surfaces:
     - generated API reference
     - native OpenAPI publication
@@ -149,7 +148,7 @@
     - label: Registry Notary generated OpenAPI document (pinned)
       url: https://github.com/registrystack/registry-stack/blob/d45761a0104bd3d9c2e4b4db391d4223f289bd44/products/notary/openapi/registry-notary.openapi.json
   last_checked: 2026-07-19
-  notes: Relay and Notary generate OpenAPI; the pinned generated documents are cited directly. These docs publish the same pinned artifacts as native API reference pages.
+  notes: Relay generates OpenAPI, and its pinned generated document is cited directly. These docs publish that same pinned artifact as a native API reference page. The two Registry Notary links stay pinned as the record of a retired product, not as a surface an adopter can run.
 - id: shacl
   name: SHACL
   standards_body: W3C
@@ -228,7 +227,6 @@
   used_by:
     - registry-relay
     - registry-manifest
-    - registry-notary
   surfaces:
     - catalog JSON-LD
     - CPSV-AP service catalogue JSON-LD
@@ -252,7 +250,6 @@
   claim_level: emits
   adoption_mode: profiled
   used_by:
-    - registry-notary
     - registry-platform
   surfaces:
     - credential issuance
@@ -268,12 +265,14 @@
   last_checked: 2026-06-13
   notes: >-
     Registry Platform owns reusable SD-JWT VC issuance and holder-proof helpers.
-    Registry Notary owns the claim-to-credential workflow and service routes that
-    use them. The profile is constrained: `application/dc+sd-jwt` credentials,
-    issuer signing with EdDSA over Ed25519 or ES256 over P-256, and EdDSA
-    `did:jwk` holder binding. Pre-rename format aliases such as
-    `application/vc+sd-jwt` are rejected in operator configuration. Full SD-JWT
-    VC conformance is not claimed.
+    Registry Notary owned the claim-to-credential workflow and the service routes
+    that used them, and is retired; its pinned conformance profile and format
+    constants are kept as the record of that workflow. The helpers stay
+    constrained: `application/dc+sd-jwt` credentials, issuer signing with EdDSA
+    over Ed25519 or ES256 over P-256, and EdDSA `did:jwk` holder binding. The
+    retired product also rejected pre-rename format aliases such as
+    `application/vc+sd-jwt` in operator configuration. Full SD-JWT VC conformance
+    is not claimed.
 - id: verifiable-credentials
   name: Verifiable Credentials Data Model
   standards_body: W3C
@@ -282,8 +281,7 @@
   status: referenced
   claim_level: aligns_with
   adoption_mode: not adopted
-  used_by:
-    - registry-notary
+  used_by: []
   surfaces:
     - credential issuance positioning
     - SD-JWT VC credential issuance
@@ -291,7 +289,7 @@
     - label: Registry Notary README
       url: https://github.com/registrystack/registry-stack/blob/d45761a0104bd3d9c2e4b4db391d4223f289bd44/products/notary/README.md
   last_checked: 2026-05-23
-  notes: Registry Notary issues SD-JWT VC. Relay no longer emits or hosts VC artifacts.
+  notes: No Registry Stack service in this register emits or hosts VC artifacts. Registry Notary, which issued SD-JWT VC under this alignment, is retired, and Relay does not emit or host VC artifacts. The pinned README is the record of the retired claim.
 - id: cccev
   name: Core Criterion and Core Evidence Vocabulary
   standards_body: SEMIC
@@ -302,7 +300,6 @@
   adoption_mode: profiled
   used_by:
     - registry-manifest
-    - registry-notary
   surfaces:
     - requirement and information requirement metadata
     - evidence type and evidence type list metadata
@@ -317,7 +314,7 @@
     - label: Registry Notary media type constants
       url: https://github.com/registrystack/registry-stack/blob/d45761a0104bd3d9c2e4b4db391d4223f289bd44/crates/registry-notary-core/src/model.rs
   last_checked: 2026-05-25
-  notes: Manifest emits CCCEV requirement and evidence type list metadata. Notary renders CCCEV-shaped claim results. Profile conformance is not claimed.
+  notes: Manifest emits CCCEV requirement and evidence type list metadata. The pinned Notary renderer and media type constants record the CCCEV-shaped claim results of a retired product. Profile conformance is not claimed.
 - id: odrl
   name: ODRL
   standards_body: W3C
@@ -384,8 +381,7 @@
   status: referenced
   claim_level: inspired_by
   adoption_mode: not adopted
-  used_by:
-    - registry-notary
+  used_by: []
   surfaces:
     - provenance model discussion
     - provenance-shaped claim fields
@@ -393,7 +389,7 @@
     - label: Registry Notary claim model
       url: https://github.com/registrystack/registry-stack/blob/d45761a0104bd3d9c2e4b4db391d4223f289bd44/crates/registry-notary-core/src/model.rs
   last_checked: 2026-05-23
-  notes: The code uses provenance concepts, but current evidence does not show a PROV-O vocabulary emission surface. Keep this as design influence until PROV-O terms are emitted or mapped.
+  notes: The pinned claim model belongs to Registry Notary, which is retired. Provenance concepts shaped that model, but no PROV-O vocabulary emission surface was shown then and no service in this register claims one now. Keep this as design influence until PROV-O terms are emitted or mapped.
 - id: fhir-r4
   name: HL7 FHIR
   standards_body: HL7
@@ -443,7 +439,6 @@
   used_by:
     - registry-relay
     - registry-manifest
-    - registry-notary
   surfaces:
     - Framework 2.0 principle and pathway comparison
     - technical alignment positioning
@@ -476,46 +471,7 @@
     - label: Registry Stack OpenCRVS project-authoring fixture
       url: https://github.com/registrystack/registry-stack/tree/2dfcf2ddf22e2c0fa4bf5fd84eb06b8736057605/crates/registryctl/tests/fixtures/project-authoring/opencrvs
   last_checked: 2026-07-19
-  notes: Relay exposes an SP-DCI sync adapter behind `spdci-api-standards`. The adapter and standards-CEL mapping are experimental, feature-frozen, and outside the 1.0 compatibility promise. A Registry Stack project can also compile a reviewed DCI source journey into a Relay consultation. Registry Notary consumes the consultation result and does not connect to DCI sources directly.
-- id: oid4vci
-  name: OpenID for Verifiable Credential Issuance
-  standards_body: OpenID Foundation
-  official_url: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html
-  version_or_profile: 'Profiled issuer subset using `dc+sd-jwt`, issuer-initiated pre-authorized code, and `openid4vci.support: not_full_issuer`'
-  status: used
-  claim_level: emits
-  adoption_mode: profiled
-  used_by:
-    - registry-notary
-    - registry-platform
-  surfaces:
-    - issuer-initiated offer start and authenticated callback
-    - pre-authorized token endpoint with transaction-bound proof nonce
-    - credential issuance endpoint
-    - SD-JWT VC Type Metadata
-    - issuer metadata at `/.well-known/openid-credential-issuer`
-    - registry-backed holder-wallet issuance
-  evidence_docs:
-    - label: Registry Notary OID4VCI routes
-      url: https://github.com/registrystack/registry-stack/blob/d45761a0104bd3d9c2e4b4db391d4223f289bd44/crates/registry-notary-server/src/api.rs
-    - label: Registry Platform OID4VCI crate
-      url: https://github.com/registrystack/registry-stack/tree/d45761a0104bd3d9c2e4b4db391d4223f289bd44/crates/registry-platform-oid4vci
-    - label: Registry Notary wallet facade specification
-      url: https://github.com/registrystack/registry-stack/blob/37ce044567f05f8b3088b54f5bd4dbf389fd2ddb/products/notary/specs/openid4vci-wallet-facade-spec.md
-  last_checked: 2026-07-19
-  notes: >-
-    Registry Notary exposes a registry-backed, issuer-initiated
-    pre-authorized code flow. The identity provider's authorization code is an
-    internal Notary input and not a wallet grant. Metadata advertises
-    `dc+sd-jwt`, EdDSA `did:jwk` holder proof, and the configured EdDSA or
-    ES256 issuer algorithm. Transaction code is required by default; an
-    explicit no-PIN profile has a maximum 300-second bearer-offer window.
-    Caller-provided or identity-token data cannot become claim evidence. The profile makes no claim
-    for a public nonce endpoint, response next nonce, wallet-facing
-    authorization code, ES256 holder proof, EUDI, HAIP, PAR, DPoP, or wallet
-    attestation. Source tests cover the full issuance and client-verification
-    journey. External wallet, verifier, and OpenID conformance evidence
-    remains candidate-only until captured from a frozen release artifact.
+  notes: Relay exposes an SP-DCI sync adapter behind `spdci-api-standards`. The adapter and standards-CEL mapping are experimental, feature-frozen, and outside the 1.0 compatibility promise. A Registry Stack project can also compile a reviewed DCI source journey into a Relay consultation. Relay is the only Registry Stack surface that connects to a DCI source; a consumer receives the consultation result instead.
 - id: w3c-did
   name: W3C Decentralized Identifiers (DID Core)
   standards_body: W3C
@@ -525,7 +481,6 @@
   claim_level: emits
   adoption_mode: profiled
   used_by:
-    - registry-notary
     - registry-platform
   surfaces:
     - did:jwk parsing for credential subjects
@@ -537,4 +492,4 @@
     - label: Registry Platform crypto crate
       url: https://github.com/registrystack/registry-stack/tree/d45761a0104bd3d9c2e4b4db391d4223f289bd44/crates/registry-platform-crypto
   last_checked: 2026-06-13
-  notes: Notary parses did:jwk values for credential subjects, and Platform owns shared DID and Ed25519 JWK helpers. Relay no longer hosts a did:web document. No DID resolver, DID URL dereferencing, or DID Core conformance class is implemented, so the claim stays at emits. The site does not claim conformance to the wider DID method registry beyond did:jwk.
+  notes: Platform owns shared DID and Ed25519 JWK helpers, including did:jwk parsing. The pinned route file records how the retired Registry Notary used them for credential subjects. Relay no longer hosts a did:web document. No DID resolver, DID URL dereferencing, or DID Core conformance class is implemented, so the claim stays at emits. The site does not claim conformance to the wider DID method registry beyond did:jwk.
diff --git a/docs/site/src/lib/doc-personas.mjs b/docs/site/src/lib/doc-personas.mjs
new file mode 100644
index 000000000..3db174f76
--- /dev/null
+++ b/docs/site/src/lib/doc-personas.mjs
@@ -0,0 +1,16 @@
+// The deployment roles a tutorial can be written for, defined for readers in
+// start/when-to-use.mdx under "Who does what". A tutorial declares one or more
+// of these in its `persona` frontmatter key so a reader can tell at a glance
+// whether the page is theirs.
+//
+// This is a different axis from the `audience` key, which names who reads a
+// specification (integrator, maintainer, specification editor, tooling) and is
+// defined normatively in spec/RS-TERMS Section 6. Keep the two vocabularies
+// apart: one describes a role in a deployment, the other a role in the reading
+// of a specification.
+export const DOC_PERSONAS = [
+  'assertion provider',
+  'data publisher',
+  'consumer or verifier',
+  'operator',
+];
diff --git a/docs/site/src/lib/generated-api-bases.mjs b/docs/site/src/lib/generated-api-bases.mjs
new file mode 100644
index 000000000..a334a3633
--- /dev/null
+++ b/docs/site/src/lib/generated-api-bases.mjs
@@ -0,0 +1,27 @@
+/**
+ * The site bases starlight-openapi owns.
+ *
+ * Pages under these bases are virtual routes rather than docs content-collection
+ * entries, so they have no per-page Markdown twin: they must not advertise a
+ * Markdown alternate, must not offer the Copy or View as Markdown affordances,
+ * and are excluded from the exhaustive .md coverage check. Every consumer reads
+ * this list, so registering a new API reference in astro.config.mjs is the only
+ * place that has to learn about it.
+ *
+ * These are the generated bases, not the hand-authored narrative pages
+ * reference/apis/registry-relay and registry-evidence, which keep their .md.
+ */
+export const GENERATED_API_BASES = [
+  'reference/apis/relay',
+  'reference/apis/evidence',
+];
+
+/** True when a dist-relative page directory is a generated API route. */
+export function isGeneratedApiDir(dir) {
+  return GENERATED_API_BASES.some((base) => dir === base || dir.startsWith(`${base}/`));
+}
+
+/** True when a root-relative pathname is a generated API route. */
+export function isGeneratedApiPath(pathname) {
+  return GENERATED_API_BASES.some((base) => pathname.startsWith(`/${base}/`));
+}
diff --git a/docs/site/src/lib/notary-retirement-redirects.mjs b/docs/site/src/lib/notary-retirement-redirects.mjs
new file mode 100644
index 000000000..b3a39db6e
--- /dev/null
+++ b/docs/site/src/lib/notary-retirement-redirects.mjs
@@ -0,0 +1,100 @@
+export const NOTARY_RETIREMENT_ROUTE = '/decisions/notary-retirement-2026-08-03/';
+
+export const RETIRED_NOTARY_ROUTE_TARGETS = {
+  '/journeys/registry-backed-notary-claim/': '/tutorials/first-run-with-solmara-lab/',
+  '/tutorials/configure-dhis2-claim-checks/': NOTARY_RETIREMENT_ROUTE,
+  '/tutorials/getting-started-fhir-evidence/': NOTARY_RETIREMENT_ROUTE,
+  '/tutorials/run-notary-standalone-for-api/': NOTARY_RETIREMENT_ROUTE,
+  '/tutorials/verify-claim-own-api/': NOTARY_RETIREMENT_ROUTE,
+  '/tutorials/verify-opencrvs-dci-claims/': NOTARY_RETIREMENT_ROUTE,
+  '/tutorials/move-notary-to-production-signing/':
+    '/tutorials/move-evidence-to-production-signing/',
+  '/tutorials/verify-claim-registry-api/': '/tutorials/first-run-with-solmara-lab/',
+  '/explanation/evidence-issuance/': NOTARY_RETIREMENT_ROUTE,
+  '/reference/apis/registry-notary/': '/reference/apis/registry-evidence/',
+  '/reference/apis/notary/': '/reference/apis/evidence/',
+  '/spec/rs-dm-claim/': NOTARY_RETIREMENT_ROUTE,
+  '/spec/rs-pr-notary/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/architecture-overview/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/client-sdk-guide/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/identity-and-record-matching/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/source-claim-modeling-guide/':
+    '/configure/evidence/',
+  '/products/registry-notary/operator-config-reference/': '/configure/evidence/',
+  '/products/registry-notary/postgresql-state-operations/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/credential-lifecycle-status/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/credential-issuance-migration/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/signing-key-provider/':
+    '/tutorials/move-evidence-to-production-signing/',
+  '/products/registry-notary/sd-jwt-vc-conformance-profile/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/notary-capability-matrix/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/notary-scenario-patterns/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/federated-evaluation-operator-guide/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/subject-access-operator-guide/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/deployment-hardening-runbook/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/api-reference/': '/reference/apis/registry-evidence/',
+  '/products/registry-notary/oid4vci-wallet-interop/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/release-notes/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/fhir-source-adapter-guide/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/opencrvs-onboarding/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/opencrvs-dci-standalone-tutorial/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/opencrvs-dci-onboarding/': NOTARY_RETIREMENT_ROUTE,
+  '/products/registry-notary/sidecar-trust-and-secrets/': NOTARY_RETIREMENT_ROUTE,
+  '/projects/registry-notary/': NOTARY_RETIREMENT_ROUTE,
+  '/projects/registry-notary/run-locally/': NOTARY_RETIREMENT_ROUTE,
+  '/projects/registry-notary/configure-a-claim/': '/configure/evidence/',
+  '/projects/registry-notary/reference/': '/configure/evidence/',
+  '/api/registry-notary.html': '/reference/apis/evidence/',
+};
+
+export const RETIRED_NOTARY_API_OPERATIONS = [
+  'admincapabilities',
+  'adminposture',
+  'adminreload',
+  'batchevaluateclaims',
+  'completeoid4vcioffer',
+  'completerepresentativeoid4vcioffer',
+  'createoid4vciregistryoffer',
+  'evaluateclaims',
+  'federatedevaluate',
+  'getclaim',
+  'getcredentialstatus',
+  'getevidencejwks',
+  'getevidenceservice',
+  'gethealthz',
+  'getopenapi',
+  'getopenidcredentialissuer',
+  'getready',
+  'getsdjwtvctypemetadata',
+  'getwellknownsdjwtvctypemetadata',
+  'issuecredential',
+  'issueoid4vcicredential',
+  'listclaims',
+  'listformats',
+  'redeemoid4vcitoken',
+  'renderevidence',
+  'startoid4vcioffer',
+  'updatecredentialstatus',
+];
+
+export function buildNotaryRetirementRedirects(currentDocsetRedirect) {
+  const redirects = Object.fromEntries(
+    Object.entries(RETIRED_NOTARY_ROUTE_TARGETS).map(([source, target]) => [
+      source,
+      currentDocsetRedirect(target),
+    ]),
+  );
+
+  for (const [source] of Object.entries(RETIRED_NOTARY_ROUTE_TARGETS)) {
+    if (source.endsWith('/')) {
+      redirects[`${source.slice(0, -1)}.md`] = currentDocsetRedirect(NOTARY_RETIREMENT_ROUTE);
+    }
+  }
+  for (const operation of RETIRED_NOTARY_API_OPERATIONS) {
+    redirects[`/reference/apis/notary/operations/${operation}/`] =
+      currentDocsetRedirect(NOTARY_RETIREMENT_ROUTE);
+  }
+
+  return redirects;
+}
diff --git a/plans/notary-retirement-and-evidence-onboarding.md b/plans/notary-retirement-and-evidence-onboarding.md
new file mode 100644
index 000000000..394fa3dc8
--- /dev/null
+++ b/plans/notary-retirement-and-evidence-onboarding.md
@@ -0,0 +1,1561 @@
+# Notary retirement and Evidence onboarding
+
+Retire Registry Notary, keep Registry Relay, and make Evidence the
+documented, demoable assertion product with an onboarding-first docs rework.
+This file is the single tracked plan and Definition of Done for that effort.
+Execute it with the `/goal` command (`.claude/commands/goal.md`), which works
+one DoD item at a time and updates this file as items complete.
+
+Created 2026-08-03. Owner: Jeremi Joslin.
+
+## Decisions already made (do not relitigate)
+
+1. Notary retires: crates, product material, docs product surface, CI gates.
+   History pages (changelog, decision records) keep the name.
+2. Relay stays a supported product. Evidence keeps its own name; the frozen
+   V1 wire identifiers and CCCEV alignment pin it. No rename.
+3. The public story is two doors: Relay ("let this system read specific
+   data") and Evidence ("let this system learn only a fact"), with Mint as
+   supporting token issuance.
+4. Evidence-over-Relay (Evidence consuming a Relay-protected API as a fixed
+   HTTP source) is a blessed pattern and must work, at minimum for demos.
+5. Docs get an onboarding-first rework: two-door start page, an Evidence
+   tutorial track (E1-E6), and tutorials that stay CI-verified.
+6. The Evidence tutorial gate is evidencectl-fixtures-based, separate from
+   the registryctl authoring gate.
+7. solmara-lab is rebuilt as the composed demo (Relay + Mint + Evidence).
+8. The archive story for retired Notary material is deferred.
+9. Retirement scope, decided 2026-08-03: the retirement covers products and
+   runtimes. The shared platform and manifest layers keep their historical
+   vocabulary so artifacts issued before the retirement still parse and can
+   still be read. A name that only names the past is kept; a code path built
+   for Notary that no longer has a caller is deleted.
+10. Approved baseline sets, decided 2026-08-03: the schema version is bumped
+    and previously issued approved-set documents are rejected with a message
+    naming re-approval as the remedy. Adopters must re-approve. Tolerating
+    and ignoring the removed cross-lane interface digests would honor a
+    signed approval whose integrity claim is no longer enforced, which is
+    the wrong failure mode for a governance artifact. Security-sensitive
+    (authorization and integrity): carries a review note under G5. This is
+    an adopter-facing breaking change, and it is unrelated to G4, which is
+    about the frozen Evidence V1 contracts.
+
+## Constraints
+
+- Evidence V1 stays frozen. The composition work must need zero Evidence
+  production-code changes; if a change appears necessary, stop and review
+  with Jeremi before writing it.
+- Source-product neutrality and sanitized-mock rules from
+  `products/evidence/AGENTS.md` and the root `AGENTS.md` apply throughout.
+- Generated artifacts are regenerated by their documented generators, never
+  hand-edited. Endpoint changes ship with their regenerated OpenAPI.
+- Every commit is DCO-signed (`git commit -s`) with a conventional prefix.
+- Changes to authentication, signing, audit, release provenance, or
+  deployment defaults carry explicit review notes.
+- Never sweep unrelated in-flight worktree changes into a commit.
+- History is not scrubbed: only the product surface drops Notary.
+
+## Workstreams and Definition of Done
+
+Each checkbox is one unit of work. Done means implemented, verified with the
+gates for its area (see Verification), and committed.
+
+### A. Composition proof (Evidence over Relay)
+
+- [x] A1. Token topology verified and recorded: establish whether Relay
+      embeds a client-credentials token endpoint (`registry-platform-sts`)
+      that Evidence's `SourceAuthentication::Oauth2ClientCredentials` can
+      target, or whether IdP-less deployments need Mint to issue for Relay
+      (a security-sensitive Relay change requiring review). Record the
+      outcome in the status log below.
+- [x] A2. An ordinary sanitized Relay-shaped mock test in
+      `crates/registry-evidence` proves a full signed assertion over an
+      OAuth client-credentials source, with zero production-code changes.
+- [x] A3. A reference deployment-project example for the Relay-backed
+      pattern exists under `products/evidence/reference`.
+
+### B. Evidence onboarding (docs site, evidencectl, CI)
+
+- [x] B1. Site plumbing: `openapi-sources.yaml` entry for the generated
+      Evidence OpenAPI with a Redoc reference page; contracts wired into the
+      data-driven reference; Operate content from `OPERATOR-CONTRACT.md`;
+      Security content from the invariant matrix and test traceability;
+      a "Registry Evidence" Configure group.
+- [x] B2. The Evidence OpenAPI is drift-checked in root CI (confirm an
+      existing gate or add one).
+- [x] B3. `spec/rs-pr-evidence` exists in the spec series, generated from or
+      tightly linked to the frozen contracts so it cannot drift.
+- [x] B4. Tutorial gate: an evidencectl-fixtures-driven check with a CI job
+      that runs each Evidence tutorial from a clean container with only the
+      prerequisites the tutorial itself documents; Evidence tutorials must
+      pass it to merge.
+- [x] B5. Tutorials E1-E5 published and gated: first assertion via fixtures
+      (keygen, scaffold, fixture run); serve assertions over HTTP with a
+      Mint token; author an acceptance definition using the coequal neutral
+      examples; connect an institution source via sanitized local mock;
+      verify an assertion as a consumer. Adopter outcome for E1: a fresh
+      machine completes it in 15 minutes or less using released binaries
+      installed via F1 (the released-binary form of this gate needs F3).
+- [x] B6. Tutorial E6 (move Evidence to production signing) published,
+      derived from `OPERATOR-CONTRACT.md`.
+- [x] B7. Mint has real docs presence: a Configure page and a reference page.
+- [x] B8. Onboarding spine: glossary disambiguates Evidence (product) from
+      the retired Notary evidence credentials; `start/when-to-use` presents
+      the two doors; the quickstart ends in an Evidence assertion over the
+      Relay-protected API (this last flip needs A and D).
+
+### C. Notary deletion cascade
+
+- [x] C1. Decisions on record before deletion: ROADMAP pilot line reframed
+      to Relay + Evidence; retirement decision page drafted (published in
+      C7); changelog entry drafted.
+- [x] C2. registryctl surgery complete: Notary compiler target, dev
+      credentials, deployment wiring, and release-lock entries removed;
+      registryctl builds and tests green as Relay-only tooling.
+- [x] C3. `registry-notary*` crates and `products/notary` deleted; Relay's
+      Notary dev-dependency contract tests dropped; workspace members,
+      `deny.toml`, and `Cargo.lock` updated; workspace green.
+- [x] C4. Platform crates with no remaining consumers deleted (candidates:
+      `oid4vci`, `pdp`, `replay`); verified with `cargo tree`, including
+      `registry-platform-testing` usage.
+- [x] C5. CI updated: Notary OpenAPI drift gate removed, Relay's kept,
+      Evidence gates confirmed present.
+- [x] C6. Release tooling: a new manifest without Notary components
+      validates; the source-model proof passes; the OpenID conformance
+      runner's fate decided and recorded (retire if it was OID4VCI-only).
+      Old manifests untouched.
+- [x] C7. Docs surface removal: authored Notary pages and the mirrored
+      `products/registry-notary` docset removed along with their
+      `repo-docs.yaml`, `docsets.yaml`, and `openapi-sources.yaml` config;
+      every removed URL redirects to its Evidence equivalent or the
+      retirement page; retirement page published; site description updated.
+      Ships with or after B1, in the same release as the code-pin advance.
+- [x] C8. Repo docs updated: `AGENTS.md` (Evidence boundary section
+      simplified), `CONTRIBUTING.md`, `README.md`.
+
+Opened 2026-08-03 by the post-merge review of C. Each is deletion-cascade
+residue the workstream did not reach, not new scope.
+
+- [x] C9. A Relay-only source-read conformance successor exists. The
+      external integration runner and its evidence packet went with Notary,
+      and the retirement guard that froze their absence is now gone too
+      (2026-08-03), so nothing in `release/` currently exercises a real
+      source read end to end. Until this lands, a release must not claim
+      source-read or data-minimization assurance from conformance evidence.
+      Decide first whether the successor belongs in `release/conformance/`
+      beside `relay-oidc`, or as a Relay integration test.
+
+      Decided 2026-08-04: `release/conformance/`, and inside the existing
+      `relay-oidc` harness rather than as a sibling directory. The gap was
+      release evidence, not test coverage; Relay's own integration tests
+      already read every supported source. A sibling would have duplicated
+      about two thousand lines of candidate binding, cosign and slsa
+      verification, secret-canary scanning, and teardown to reuse a topology
+      that already mounts a real CSV source and starts a released image.
+- [x] C10. The manifest layer's Notary vocabulary is resolved.
+      `registry-manifest-core` still requires the protocol identifier
+      `registry-notary-federation/v0.1` from any manifest that declares a
+      `federation` block, and still names the enforcement profile
+      `registry-evidence-gateway-pdp/v1`. Both are dead surface: federation
+      and PDP are explicit Evidence non-goals, and no shipped product
+      consumes either. Decide between removing the `federation` block from
+      the manifest schema and renaming the identifiers. Either way it is a
+      published schema change and needs a manifest version decision, which
+      is why it is not folded into the mechanical deletions.
+- [x] C11. The remaining registryctl schema versions are reconciled with the
+      shapes the retirement changed. Decision 10 fixed the approved baseline
+      set. The same mismatch is still present in
+      `crates/registryctl/src/deployment.rs` and
+      `crates/registryctl/src/release_lock.rs`: `DeploymentBindingV1` lost
+      `ports.notary` and three `secret_files` ids, `LockedManagedImagesV1`,
+      `LockedRuntimeRecipesV1` and `SupportedContractsV1` lost their Notary
+      members, and every one of those documents still declares and requires
+      schema version `1.0` through `require_schema`. Two documents with
+      different required shapes therefore claim the same version, so a
+      newer registryctl refuses an adopter's existing `binding.yaml`,
+      generated binding projection, deployment manifest, and release lock
+      while the version claims nothing changed. Severity is lower than the
+      approved set: every removed member is literally named `notary`, so
+      serde's `unknown field` error is at least readable, and
+      `verify_release_lock_for_package` already documents that a
+      Notary-bearing payload must be rebuilt. What is owed is the version
+      bump and a refusal that names the retirement, matching decision 10.
+      This touches release provenance and deployment defaults, so it needs a
+      review note and Jeremi's call on whether the release lock bumps with
+      the rest or stays pinned to the published release train.
+      Resolved 2026-08-03: Jeremi confirmed no adopter has used the stack, so
+      there is no published train to keep compatible and no pre-retirement
+      document in the wild. The release lock bumps with the rest, and the
+      decision-10 refusal machinery is deliberately not repeated: with no
+      document to explain to anyone, serde's `unknown field notary` and
+      `require_schema`'s `unsupported portable document schema` are enough.
+      The deployment manifest, ownership report, and operator-files documents
+      stay at `1.0` because their required shapes did not change.
+
+### D. solmara-lab rebuild (separate repo: registrystack/solmara-lab)
+
+- [x] D1. Compose runs Relay + Mint + Evidence: spreadsheet source through
+      Relay, Evidence assertion over Relay's API, smoke suite green.
+- [x] D2. `tutorials/first-run-with-solmara-lab` rewritten against the
+      rebuilt demo and passing its gate.
+
+### E. Shared docs rewrites
+
+- [x] E1. Heavy pages rewritten (~20: architecture, boundaries-and-map,
+      glossary, rs-terms, rs-arc-g, rs-sec-g, rs-op-posture, threat-model,
+      hardening-checklist, known-limitations, records-stay-home,
+      disclosure-modes-and-computed-answers, integration-patterns,
+      single-node-compose-behind-proxy, retention-and-persistent-state,
+      approve-initial-baseline, rotate-credentials-and-trust,
+      inspect-and-diagnose, environment-variables, errors, api-stability).
+- [x] E2. Light-touch pages updated (~25 pages with 1-9 Notary mentions).
+- [x] E3. Final sweep: a case-insensitive Notary search over the docs
+      product surface matches only history pages and the retirement page.
+      Amended 2026-08-04: the literal bar is unreachable, because
+      `registry-notary` is a live identifier in the frozen
+      `registry.ops.posture.v1` component enum, a manifest `access.kind`,
+      Relay's startup binding validator, `registryctl`'s lane refusal, and a
+      pinned image name. Achieved instead, and mechanically enforced: on a
+      current product-surface page the word appears only inside a code span
+      or in a specification version-history row. Prose naming the product,
+      even to say it is retired, now fails the check.
+
+### F. Adopter distribution and experience
+
+Context discovered 2026-08-03: releases already ship reproducible bare
+binaries (`<name>-<tag>-linux-amd64` plus SHA256SUMS, cosign-signed at
+promotion) built by `release/scripts/build-release-binaries.sh` in a pinned
+builder image, and `crates/registryctl/install.sh` is already published as
+the `registryctl-<tag>-install.sh` release asset. Evidence rides that
+channel; it does not get a parallel one.
+
+- [x] F1. `crates/registry-evidencectl/install.sh` exists, mirroring the
+      registryctl installer conventions: installs `evidence`, `evidencectl`,
+      and `mint` from a release, verifies every artifact against SHA256SUMS,
+      refuses unverified installs, has offline tests, and passes shellcheck
+      and shfmt.
+- [x] F2. The three binaries and the installer asset enter the release
+      channel: `build-release-binaries.sh` builds and checksums them, the
+      candidate workflow stages `evidencectl-<tag>-install.sh`, and the
+      artifact inventory in `release/scripts/registry-release` accepts them
+      (optional at first), with its tests updated. Security-sensitive
+      (release provenance): review notes required.
+- [ ] F3. First release shipping F2 verified end to end: curl | bash against
+      the published assets installs working binaries. Then flip the
+      inventory entries from optional to required at a minimum version, the
+      way `registryctl-installer` did at v0.14.0.
+- [x] F4. Platform coverage decision recorded: linux-amd64 is the
+      reproducible baseline; registryctl already publishes optional
+      macos-arm64 and linux-arm64 assets; decide and record the same
+      optional set for the Evidence binaries.
+- [x] F5. Personas named on the docs site (assertion provider, data
+      publisher, consumer/verifier, operator) and every tutorial labeled
+      with whose it is.
+- [x] F6. An Evidence errors and problems reference page exists for
+      adopters: what each public problem means and what to do about it.
+- [x] F7. An evaluate-stage page exists: what Evidence costs to run
+      (footprint, dependencies, operational burden, support window).
+
+### Global gates (checked at the end, not per item)
+
+- [x] G1. Full verification suite green: `cargo fmt --check`, `cargo check
+      --locked --workspace --all-targets`, `cargo clippy --workspace
+      --all-targets -- -D warnings`, `cargo test --locked --workspace`,
+      `cargo deny check`, both Evidence scripts, release unit tests plus
+      manifest validation and the source-model check, docs `npm test` and
+      `npm run check`.
+- [x] G2. Every removed docs URL redirects; no product-surface page
+      describes Notary as current.
+- [x] G3. All tutorials pass their CI gates.
+- [ ] G4. Frozen Evidence V1 contracts are byte-identical to the state at
+      plan creation, or a re-approval is recorded here.
+- [x] G5. Review notes exist for every security-sensitive change. See
+      [Security review notes](#security-review-notes-g5).
+
+## Dependency order
+
+A1 → A2 → A3. A → D. B1 → C7. C1 → C2 → C3 → C4. D → the B8 quickstart
+flip. E ships with or after C7. F1 → F2 → F3; F3 unlocks the
+released-binary form of the B4/B5 clean-environment gate. Everything else
+is parallel; B has no upstream dependencies and is the standing priority
+(onboarding first).
+
+## Verification (match to touched area)
+
+- Rust: `cargo fmt --check`, `cargo check --locked --workspace
+  --all-targets`, `cargo test --locked -p <crate>`, workspace tests when
+  platform crates change, `cargo clippy` before calling an item done.
+- Evidence: `products/evidence/scripts/check-contracts.sh` and
+  `products/evidence/scripts/check-source-neutrality.sh`.
+- Release: `python3 -m unittest release/scripts/test_registry_release.py`,
+  `release/scripts/registry-release validate release/manifests/<current>.yaml`,
+  `REGISTRY_RELEASE_SOURCE_MODE=monorepo
+  release/scripts/check-release-source-model.sh` and its unit tests.
+- Docs site (from `docs/site/`): `npm test` and `npm run check`.
+
+## Security review notes (G5)
+
+Scope: every change made under this plan that touches authentication,
+authorization, assertion evaluation or signing, audit integrity, release
+provenance, deployment defaults, or data minimization. Entries are keyed by
+what changed and where, not by revision, because session commits are squashed
+during review and a revision identifier written here would not survive.
+
+Fifteen changes carry their note in their own commit message. They are listed
+first so the set is complete in one place, then the changes whose note was
+owed and is recorded here in full.
+
+### Notes carried in the change's own commit message
+
+1. `registry-manifest-core` evidence offering access, retargeted from the
+   retired kind to `registry-evidence`: narrows what a deployment may
+   advertise, requires HTTPS on both URLs, touches no authorization path.
+2. `registryctl` approved baseline sets, schema 2.0 with a closed refusal of
+   pre-retirement documents (decision 10): the removed `interfaces` field
+   carried verified SHA-256 digests, so ignoring it would honor a signed
+   approval whose integrity claim is no longer enforced.
+3. The public documentation of that bump and the re-approval remedy.
+4. `registryctl` schema versions bumped across the retirement: the version is
+   the only wire signal separating a pre-retirement signed payload from a
+   current one, and the envelope refuses a stale lock before any signature
+   work.
+5. Deletion of the callerless Notary platform API (`registry_notary_from_env`,
+   `registry_notary_access_profile`, `typed_request_profile`): the first two
+   were exact aliases of maintained functions, the third went with its only
+   caller.
+6. Evidence access-token issuer unreachable, named and survived: no change to
+   what is accepted, a bounded stale-key allowance, and the same closed `401`
+   when it is exhausted.
+7. Evidence audit boundary startup refusal, given a cause: fixed `&'static
+   str` per fault class, no path, secret, or chain content, and every fault
+   stays fail-closed.
+8. `evidencectl doctor` artifact-mode reporting: advisory and read-only, opens
+   no secret or key, relaxes nothing.
+9. `evidencectl source suggest` from an OpenAPI document.
+10. `evidencectl source suggest --openapi` reading a URL, under the same rule
+    the runtime applies to source URLs it will itself call.
+11. Eight adopter frictions removed from the Evidence runtime.
+12. The Evidence toolset shipped through the release channel.
+13. The Evidence toolset built for the optional platforms.
+14. The `curl | bash` installer for the Evidence toolset.
+15. The Relay conformance smoke asserting a real source read.
+
+### Notes recorded here
+
+1. **Deletion of the Notary runtime** (`products/notary/`, `crates/registry-
+   notary*`, the workspace members and Relay's dependency on them).
+   Threat: deleting a service can take shared enforcement or shared coverage
+   with it, silently. Enforcement: the maintained runtimes keep their own
+   authentication, authorization, signing, and audit; the deletion removed no
+   code a maintained runtime calls, which the locked workspace build and the
+   full test suite prove by compiling and passing without it. Tests: the
+   deletion did cost two things, both found and repaired under this plan, and
+   both are entries below (the Relay maintained-example loader test and the
+   `registryctl dev` claim-results regression). Nothing else regressed.
+2. **Deletion of four platform primitive crates**: `registry-platform-cache`,
+   `-oid4vci`, `-replay`, and `-sts`, plus the `oid4vci_request_and_proof`
+   fuzz target and corpus and the federation fixtures in
+   `registry-platform-testing`.
+   Threat: `registry-platform-replay` held replay protection, and removing a
+   replay store from a workspace that still serves requests would be a real
+   loss. Enforcement: it had exactly one consumer, the retired product.
+   Evidence's frozen Version 1 boundary states it keeps no nonce or replay
+   storage beyond stateless request-nonce echo and comparison, so no
+   maintained runtime lost a defence. The same holds for the OID4VCI parser:
+   its fuzz target went with the parser it fuzzed, not ahead of it. Tests: the
+   workspace builds and tests green with all four gone; the surviving
+   `sdjwt_holder_proof` fuzz target and its corpus are untouched.
+3. **Removal of the Notary lane from `registryctl`** (tooling, project
+   starters, authoring schemas, language-server index).
+   Threat: adopter tooling that quietly keeps emitting a retired lane's
+   artifacts. Enforcement: the lane is refused by name rather than ignored, so
+   an existing project naming it fails loudly instead of compiling to
+   something else. Tests: the registryctl suite and the six reader journeys in
+   `check-registryctl-tutorials.sh` all pass on the maintained lanes.
+4. **Retirement of the Notary release surface** (`release/` scripts, manifests,
+   workflows, `READINESS.md`, `VERIFY.md`, `REPEATABLE-BUILDS.md`).
+   Threat: release provenance. Dropping a product from the release model can
+   leave an inventory that accepts an unbuilt or unchecksummed artifact.
+   Enforcement: `release/scripts/registry-release` still validates the full
+   artifact inventory, and `check-release-source-model.sh` still proves the
+   source model; both were updated with the surface rather than relaxed.
+   Tests: `test_registry_release.py`, `registry-release validate` against the
+   current manifest, and `check-release-source-model.sh` with its unit tests.
+5. **Retirement of the Notary release evidence, and repinning of its
+   permalinks**.
+   Threat: erasing a coverage record makes unproven paths look proven.
+   Enforcement: the negative-path coverage map is marked, not trimmed. Eight
+   rows whose every anchor is retired read "Retired evidence", six mixed rows
+   keep only their live anchors, and NP-20 and NP-21 drop from Covered to
+   Partial because the product-surface half of their evidence lived on the
+   removed credentials route. The Release Decision now refuses to count a
+   retired row as coverage, which is the stricter reading, not the convenient
+   one. Nine links to deleted documents are repinned at v0.16.3, where each
+   target is confirmed to exist. Tests: the release unit tests, which include
+   the coverage-map and error-registry checks.
+6. **Retirement of the Notary CI gates** (`ci.yml`, `nightly-security.yml`,
+   `nightly-rust-coverage.yml`, the deleted `notary-postgres-conformance.yml`,
+   and `check_advisory_checker_copies.py` with its tests).
+   Threat: removing a required gate reduces enforcement coverage, and the
+   advisory-checker byte-identity guard is the one that looks most like a
+   loss. Enforcement: that guard existed only because two copies of the
+   advisory checker had to stay identical. With one copy left there is nothing
+   to compare, and the surviving copy keeps its own required gate
+   (`crates/registry-relay/tests/advisory_baseline_check_test.py`). The same
+   change adds three Evidence gates to the required inventory (contract gate,
+   contract reproduction, source neutrality), so the inventory is net larger.
+   Tests: `check-gates-inventory.py` and `test_check_gates_inventory.py`,
+   which fail if a named required gate is missing from the workflows.
+7. **Removal of the external integration retirement guard**
+   (`test_integration_e2_runner.py` and its inventory entry).
+   Threat: dropping a check that carried the word "retirement" reads like
+   dropping the retirement's proof. Enforcement: the guard asserted that a
+   deleted runner and its evidence packet stay absent and that CI never names
+   either path, which is not a statement about behaviour, so a green run
+   reported coverage the release does not have. Worse, the absence assertions
+   would have failed CI for anyone restoring source-read conformance coverage
+   under the same names. The retirement is proven instead by the absence of
+   dangling references, which the surrounding checks already enforce. A
+   Relay-only successor with real behaviour is owed and tracked in this plan.
+8. **Narrowing of the secret-scan allowlist and the coverage flags**
+   (`.gitleaks.toml`, `codecov.yml`).
+   Threat: an allowlist entry that outlives its files is a permanent hole,
+   because the path or pattern it excuses can be reintroduced by anything.
+   Enforcement: four allowlist entries were dropped, covering the OID4VCI fuzz
+   corpus, the Notary OpenAPI example identifiers and JWT, three OID4VCI
+   configuration key patterns, and the SD-JWT holder-proof fixtures under
+   `products/notary/`. Nothing was added. The `notary-postgres` coverage flag
+   became `relay-postgres`. Tests: the nightly secret scan runs against the
+   narrowed configuration.
+9. **Restoration of real-loader coverage for the maintained Relay examples**.
+   Threat: the retirement deleted `live_consultation_journeys.rs`, and with it
+   the only test that staged each maintained operator example the way an
+   operator deploys it and then drove the real config loader over the result.
+   `config_schema.rs` validates the examples in place and `opencrvs_profile.rs`
+   loads one profile from the tree; neither proves the pinned artifact closure
+   still resolves after the example is copied into a deployment directory and
+   the private binding is renamed. Enforcement: the restored test verifies the
+   maintained baseline's own hash pins, not pins it computed itself, and
+   `replace_once` fails loudly if an example stops pinning the binding path
+   exactly once. Tests: the restored test itself, hermetic, no network, no
+   Docker, no PostgreSQL, no environment variables.
+10. **Removal of the claim-results commitment from `registryctl dev`**
+    (`request_json`, `minimized_claim_ids`, `expected_claim_results_sha256`,
+    and the commitment helper).
+    Threat: removing an integrity commitment from a development path.
+    Enforcement: the commitment was computed over an always-empty result set
+    after the retirement deleted the request materializer that filled it, so
+    the helper rejected it and `registryctl dev` failed on every project
+    before it reached Docker. The three fields had lost their last reader, and
+    their plan-side validation could no longer be satisfied by anything the
+    compiler emits. The smoke report keeps its `minimized_claim_ids` field and
+    its `minimized_claim_ids=none` output line, which is a live output
+    contract. Tests: the regression survived because the dev-runtime fixture
+    hand-built a scenario with the deleted fields populated; the new test
+    drives both `init` templates through the real authoring compiler.
+11. **Relaxation of the reference response schemas** (`response.schema.yaml`
+    across the reference deployment projects, plus the `response_shape` rule
+    in `products/evidence/contracts/source-contract.yaml`).
+    Threat: output validation. Requiring less of a response could let an
+    incomplete record reach evidence construction. Enforcement: the presence
+    checks a single matched record must pass moved into the extract scripts,
+    which is where they can be applied to the one record that matters. A
+    schema that required a projected leaf of every record turned an ordinary
+    ambiguous page into a source-protocol failure, because the page is refused
+    from the pager before any record is read, so a record on it need not be
+    complete. Projection guarantees intermediate containers and only drops
+    terminal leaves, so requiring an intermediate was redundant and guarding
+    one in script was unreachable; the source contract now states that rule.
+    No Evidence production code changed. Tests: fixture cases covering both
+    sides, run through the production ABI offline.
+12. **A protected-read reference deployment project**
+    (`relay-protected-read-evidence`).
+    Threat: a reference project is a deployment default by imitation, so a
+    weak one propagates. Enforcement: it reads a protected, scoped,
+    read-only API and signs residence region as a coarse controlled code
+    mapped from the register's own code, which is the minimum-disclosure
+    shape. Uniqueness is decided from the page and the further-pages flag
+    together, so a single record on a page claiming further pages is
+    ambiguous rather than a match. The bundle names no registry product and
+    depends on none, so source neutrality holds. No Evidence production code
+    changed; the only Rust edits extend three `#[cfg(test)]` project lists.
+    Tests: eighteen fixture cases through the production ABI offline, plus
+    `check-source-neutrality.sh`.
+13. **Bounds and quoting in what `evidencectl source suggest` emits**, and the
+    reading of real-world OpenAPI documents.
+    Threat: a draft that claims more than the evidence behind it supports, and
+    unbounded expansion. Page-size detection matched any parameter name
+    containing "page", "size", or "limit", so a `page` index and an unrelated
+    `fileSizeCeiling` both fed the array bound; it now compares against a
+    closed list of whole normalized names and, given several genuine size
+    parameters, takes the smallest, because only the smallest ceiling is one a
+    response can reach. A `$ref` cycle is cut with a marker that declares no
+    type, so the flattener skips it and a whole-subtree selection over it is
+    rejected by name. A bound clamped to the subset ceiling is credited to the
+    ceiling rather than to the document, so a specification writing
+    `maxItems: 2147483647` is not quoted as having made a promise. The
+    reproduce line shell-quotes any path outside a safe character set, the
+    extract script emits a real Rhai string literal for the pointer, and
+    drafted YAML quotes on any control character rather than newline alone.
+    `evidence check` classification now matches the runtime's fixed stage
+    messages at the start of stderr instead of a substring anywhere in it.
+    Enforcement: this is adopter tooling that emits a draft; `evidence check`
+    and startup remain the only authority on what a deployment may run with,
+    and every unresolvable bound is left as an explicit `TODO` that
+    `evidence check` refuses. Tests: every fix carries a test proved failing
+    first.
+14. **Zero bytes kept out of test-provisioned secrets**
+    (`crates/registry-evidencectl/tests/scaffold.rs`).
+    Threat: none to a deployment; this is test material only. Recorded because
+    it touches secret generation. The scaffold test wrote 32 raw random bytes
+    per secret file while the runtime rejects secret material containing a NUL
+    byte, so each file failed about 12% of the time and a full run about 40%.
+    Enforcement: the test regenerates until no byte is zero, exactly as
+    `keygen secret` already does. The runtime's rejection is unchanged, and it
+    is the reason the test was flaky.
+15. **The adopter image bound to the Debian 13 base-image contract**
+    (`docker/Dockerfile`, `check-debian13-images.py`,
+    `nightly-security.yml`).
+    Threat: deployment defaults and supply chain. `docker/Dockerfile` was
+    reviewed and committed but no check held it to the same base-image
+    contract as the release and per-product images, so its digest pins could
+    drift silently. Enforcement: it is checked under its own shape, since one
+    file builds two binaries as two targets and distroless has no shell for a
+    HEALTHCHECK: pinned frontend first, every upstream base digest-pinned, the
+    pinned Rust builder, a nonroot-owned runtime root, and no shell, package
+    manager, or fetch tooling in any distroless stage. Distroless stages are
+    found by their base rather than by a stage name, and an unpinned base
+    still counts as a stage, so an unpinned base is reported instead of
+    dropping out of the scan. The nightly security workflow retriggers on
+    `docker/` changes and scans the adopter image for baked-in key or
+    credential material beside the release images. Tests:
+    `test_registry_release.py` gained cases for the new contract.
+
+## Status log
+
+- 2026-08-03: Plan approved by Jeremi in session; `/goal` command added.
+  Execution not started.
+- 2026-08-03: Adopter-POV review added workstream F (distribution and
+  adopter experience) and hardened B4/B5 into outcome-based gates. Jeremi
+  decided distribution is curl | bash installers over released binaries.
+- 2026-08-03: Discovery while starting F: the release channel already
+  builds reproducible bare binaries with SHA256SUMS and cosign signing,
+  and registryctl already ships an installer asset. F was rewritten to
+  extend that channel (evidence, evidencectl, mint were simply missing
+  from it) instead of inventing a parallel one. F1 and F2 in progress.
+- 2026-08-03: F1 done. The evidencectl installer mirrors the registryctl
+  conventions (toolset all-or-nothing install, SHA256SUMS verification,
+  asset-dir mode, staged install with rollback) with 11 offline tests;
+  shellcheck and shfmt clean. Found in passing: the rust-result shard
+  test in release/scripts/test_registry_release.py is stale on main
+  (ci.yml gained evidence-contracts); flagged separately, not fixed here.
+- 2026-08-03: F2 done. build-release-binaries.sh builds and checksums
+  evidence, evidencectl, and mint in the pinned builder; the candidate
+  workflow stages evidencectl-<tag>-install.sh beside the registryctl
+  installer; the registry-release inventory accepts the four artifacts
+  as optional (flip to required at a minimum version is F3), with two
+  new unit tests. Historical manifests still validate (beta-26 checked).
+  The product README documents installation. Next in F: F3 needs a real
+  release; F4-F7 are open.
+- 2026-08-03: B2 confirmed done with no new code. Root CI's
+  evidence-contracts job (.github/workflows/ci.yml) runs
+  products/evidence/scripts/check-contracts.sh, which regenerates every
+  Evidence contract including registry-evidence.openapi.json and
+  byte-diffs against products/evidence/generated/. The classifier
+  (.github/scripts/ci_changes.py) fires it for registry-evidence,
+  registry-evidencectl, and products/evidence/ changes.
+- 2026-08-03: F4 decided and implemented. Platform coverage matches
+  registryctl exactly: linux-amd64 is the required reproducible
+  baseline from the pinned builder; linux-arm64 and macos-arm64 ship
+  as optional native-runner assets from the candidate workflow's
+  build-platforms matrix, which now also builds evidence, evidencectl,
+  and mint. The assemble step and the F2 inventory already accept the
+  per-platform names generically.
+- 2026-08-03: Docs wave landed. B1 done: repo-docs mirrors seven Evidence
+  product pages, the latest docset registers the product, the generated
+  OpenAPI flows through fetch-openapi into a Redoc operations section
+  plus a narrative API page, security content comes from the invariant
+  matrix and test traceability (security/evidence.mdx), Operate content
+  is the mirrored operator contract, and the sidebar gains an "Answer
+  with Evidence" flow (the plan's "Registry Evidence Configure group"
+  exists as that flow plus the Registry Evidence product group; rename
+  if the exact label matters). B3 done: RS-PR-EVIDENCE with 56
+  requirements, every one citing its frozen contract file. B7 done:
+  Mint configure and reference pages, config fields cited to source
+  lines. F6 done: all nine public problem types documented from the
+  problem contract. F7 done: evaluate-stage page; writing it surfaced
+  stale PERFORMANCE.md group-commit claims, reconciled in their own
+  commit. B8 partial: two-door when-to-use, personas (F5 partial), and
+  glossary disambiguation are in; the quickstart flip still waits on A
+  and D. E1 (first-assertion tutorial) is published with commands
+  verified against the built binaries, but B5 stays open: E2-E5 and the
+  B4 gate are not built. Archived-docset design decision: a product
+  absent from an archived docset is filtered before docset pinning and
+  its OpenAPI rides the current shell; the Evidence product group
+  splices optionally (v0.15.2 verified past the Evidence throw; its
+  remaining sync failure is a pre-existing Notary allowlist gap on
+  main, flagged separately, as is the stale rust-result shard test).
+  Site suite 267 tests green. Full `npm run check` still pending.
+- 2026-08-03: Session-limit note: three authoring subagents died mid
+  wave (configure page recovered by hand, E1 rewritten by hand, E6 not
+  written). Next unblocked items: B4 gate, E6, then E2-E5.
+- 2026-08-03: B4 done. check-evidence-tutorials.sh drift-checks and
+  replays the first-assertion tutorial's fences verbatim (executed
+  green locally end to end); its dry-run joins npm run check; a
+  path-gated evidence-tutorials CI job builds the toolset and executes
+  the tutorial inside the repo's pinned builder-image digest with the
+  repo mounted read-only, counted by the required-results job. Caveat
+  recorded: that image is a full builder userland reused for its pinned
+  digest; a slimmer pinned base can replace it later. The
+  release-download fences stay unexecuted until F3. B6 done: the
+  production-signing tutorial restates OPERATOR-CONTRACT.md (key
+  generation, JWKS retention window, offline validation, readiness,
+  rotation, signature limits). Extending the executable gate to E6 and
+  the future E2-E5 belongs to B5. Full npm run check passed after the
+  docs wave; one Vale error it surfaced (typographic quotes in the
+  operator contract lead) fixed at the source.
+- 2026-08-03: A1 verified and recorded. Relay embeds no token issuance:
+  registry-platform-sts is Notary-bound token exchange with zero
+  consumers in the workspace (add it to the C4 orphan candidates).
+  Relay authenticates inbound callers through configured OIDC (issuer,
+  audiences, algorithm allowlist, JWKS cache in
+  crates/registry-relay/src/auth/oidc/, with EdDSA-verifying tests),
+  and Mint issues EdDSA tokens with configured audiences and serves a
+  JWKS. IdP-less Evidence-over-Relay therefore points Relay's verifier
+  configuration at Mint's issuer: deployment configuration, no
+  security-sensitive Relay change, so the reserved Mint-for-Relay code
+  branch is not triggered. Open question for A2 and D: whether Mint's
+  Evidence-shaped claim set satisfies Relay's authorization model, or
+  whether Mint (not Relay, not Evidence) needs a claim addition.
+- 2026-08-03: A2 done, zero production-code changes needed. The new
+  crates/registry-evidence/tests/relay_shaped_source.rs mirrors the
+  Relay OpenAPI's household-record read (path, bearer, Data-Purpose,
+  entity response shape) by hand in a wiremock, drives OAuth client
+  credentials through the frozen runtime's public API to a signed
+  flattened JWS, verifies it against the deployment JWKS under the full
+  relying policy, and proves minimum disclosure with canaries: the raw
+  record id, the untouched field, and even the raw region code never
+  appear in the assertion payload. Composition components all existed
+  in the frozen V1 runtime. Next in A: A3, the Relay-backed reference
+  deployment project. E2's open design question for Jeremi: what tool
+  tutorial readers use to build the RFC 7523 client assertion for Mint
+  (the demo uses a Python walkthrough; an evidencectl helper would be
+  new CLI surface outside the frozen runtime contract).
+- 2026-08-03: A3 done, zero production-code changes; the only Rust edits
+  are the three `#[cfg(test)]` project lists. The new
+  products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/
+  is a complete deployable bundle plus runtime file for a protected,
+  scoped, read-only registry API of the shape Relay presents, and it
+  covers residence region, the coequal acceptance definition the other
+  two reference projects do not. It earns its place on lookup shape, not
+  on branding: this envelope reports no total, only a page and a
+  further-pages flag, so uniqueness is decided from both signals
+  together and a single record on a page claiming more pages is
+  ambiguous, unlike the tracker project's pager arithmetic. The bundle
+  names no registry product. Eighteen fixture cases run through the
+  production ABI offline; a deliberate tamper (REGION-SOUTH to
+  REGION-NORTH) failed with a scalar value mismatch, proving the
+  expectations are load-bearing rather than vacuous. Next in A: none, A
+  is complete, which unblocks D. Next unblocked elsewhere: B5 tutorials
+  E3 to E5 (E2 still waits on the client-assertion tooling call above).
+- 2026-08-03: E4 (connect an institution source) corrected against the
+  `source suggest` work merged into main. A subagent review settled three
+  stale facts empirically. The page taught that projection drops an
+  intermediate container whose only selected leaf is absent, so
+  `{"matchCount": 0, "records": []}` would project to `{"matchCount": 0}`;
+  it does not. `crates/registry-evidence/src/source.rs` omits a key only
+  when it is absent and its projection node is terminal, and an absent
+  intermediate is a projection violation, which is what
+  `products/evidence/contracts/source-contract.yaml` already states. The
+  repair step the page taught was therefore a no-op. It now teaches the
+  defect that is real: requiring a projected leaf of every record turns an
+  incomplete record into a source-protocol failure, so the requester is
+  told `dependency_unavailable` instead of `evidence_not_available`, and
+  the check belongs in the extract script. Also fixed: one verbatim
+  `source suggest` output line stale since the report wording changed, and
+  the claim that `--openapi` never fetches, which stopped being true when
+  the flag gained URL support. The gate now pins that output line so the
+  next rewording fails CI rather than leaving the quoted transcript stale.
+  Open for Jeremi: the source contract's `required_rule` reads as
+  condemning any required selected leaf, including a top-level scalar,
+  while the reference schemas keep their top-level `required` lists; the
+  scope is "of every record" and the contract line would be clearer
+  saying so, but it is a frozen V1 contract so no edit was made.
+- 2026-08-03: E4's synthetic document gained a self-referring schema, so the
+  tutorial now covers the construct most likely to make a reader's own
+  document behave unlike the page's: `evidencectl` cuts a `$ref` cycle at
+  the first repetition and says so on standard error. Verified against the
+  real binary; the drafted schema, the derived-bounds report, and the
+  source block are byte-identical with the cycle present, so nothing
+  downstream moved. The gate pins one line of each of the two verbatim
+  transcripts the page quotes.
+- 2026-08-03: F5 done. The four deployment roles start/when-to-use.mdx names
+  are now a checked vocabulary (`src/lib/doc-personas.mjs`), a unit test holds
+  the list and the page in step in both directions, every `doc_type: tutorial`
+  page must carry a `persona:` label, and the label renders under the title
+  linking back to the definitions. Kept deliberately separate from the
+  `audience` key, which is the specification-reader axis from RS-TERMS
+  Section 6; conflating them would have made one word mean two things.
+  Assignments: assertion provider gets the three Evidence authoring
+  tutorials, data publisher the three spreadsheet and HTTP registry ones,
+  operator the production-signing and Solmara Lab ones. No tutorial claims
+  consumer or verifier yet; E5 is that page, so the gap is real and visible
+  rather than papered over. The three how-to pages under tutorials/ are not
+  labeled: the requirement keys off `doc_type`, not the URL segment.
+- 2026-08-03: B5's E2 (serve assertions over HTTP with a Mint token) is
+  published and gated. Four processes, all started by the page's own fences:
+  a stand-in source, Mint, a TLS terminator in front of Mint, and Evidence.
+  The terminator is not decoration. `config.rs` requires `https` for the
+  token issuer and its JWKS URI with no loopback exception, and
+  `outboundTls.trustProfiles` governs only the calls Evidence makes to
+  sources, so a development CA reaches the JWKS client through `SSL_CERT_FILE`
+  on the `evidence` process alone and nothing on the machine is retrusted.
+  Sources are exempt from `https` only for numeric loopback, which is why the
+  stand-in can be plain `http://127.0.0.1:8092`; the page says so and calls it
+  a development affordance. The gate pins a negative control: restarting
+  Evidence without the trust anchor yields HTTP 401 with
+  `authentication_failed` and `UnknownIssuer` in the log, so a passing run
+  proves the token is checked rather than that a request succeeded. No token
+  is ever echoed or put on a command line; `mint token` writes to a file
+  under `umask 077` and curl reads it with `--header @file`. Mint changes now
+  route to the tutorial gate, since the gate builds and runs `mint`. B5 stays
+  open: E5 (verify an assertion as a consumer) is the last of the five, and
+  it is also the page that will let a tutorial claim the consumer or verifier
+  persona.
+- 2026-08-03: B5 done. E5 is published and gated, so all five Evidence
+  tutorials replay in CI and a tutorial now claims the consumer or verifier
+  persona. E5 is the only one with no deployment, no network, and no config
+  edits: `evidence verify` opens no socket, resolves no metadata, and fetches
+  no key, so the page hands the reader a stored response and a pinned key set
+  and has them write the verification policy from their own retained state.
+  Both inputs are embedded rather than generated, because `evaluate
+  --fixture` signs with an ephemeral in-memory key and writes nothing to
+  disk, so a consumer can mint neither; the gate carries the regeneration
+  recipe and the warning that the policy values and the `--at` instants must
+  be refreshed together. Five negative controls are pinned: a replayed nonce
+  and a different subject both refuse with the single `policy` class, because
+  a refusal naming the failing comparison would be an oracle over exactly the
+  retained state the check protects; an incomplete policy refuses as
+  `malformed` with no `authentic:` line at all; a tampered payload byte
+  refuses as `signature`; and an unpinned key set refuses as `key`, one stage
+  earlier. Authentic-but-expired stays a separate answer with exit code 3.
+  Review corrected one factual error before commit: the page called
+  `disclosure` a ninth class, but `VerificationError` has exactly eight
+  variants and `disclosure` is the eighth, reachable only on the SD-JWT VC
+  path. The released-binary form of the E1 adopter outcome still needs F3,
+  the same caveat B4 carries.
+- 2026-08-03: Tutorial track repaired as one path. Auditing E1-E6 end to end
+  found that no sequence of in-page Next clicks reached all six:
+  author-an-acceptance-definition offered no tutorial link at all and was a
+  hard dead end, connect-an-institution-source pointed backward to the page
+  the reader had just left, and the new E5 never mentioned E6. Every first
+  Next bullet now follows the sidebar order, first-evidence-assertion to
+  author-an-acceptance-definition to connect-an-institution-source to
+  serve-assertions-over-http to verify-an-assertion-as-a-consumer to
+  move-evidence-to-production-signing. That is the order readers already see
+  in the sidebar and a working difficulty ramp: stay offline while learning
+  the shape of a definition and a source, then go over HTTP with a real
+  token, then verify what you were handed, then take key material to
+  production. E6's prerequisite also asked for a deployment project from the
+  first-assertion tutorial, which nothing between them tells the reader to
+  keep and which E2 replaces with a fresh scaffold anyway; it now asks for
+  any scaffolded project, which is what its placeholder commands actually
+  need.
+- 2026-08-03: B8's two-door step is now actually done, and B8 stays open.
+  An earlier status line claimed `start/when-to-use` already presented two
+  doors; it did not. That session added the Evidence row but left the Notary
+  row beside it, so the page still offered three doors and asked a newcomer
+  to tell a bounded answer from a minimum-disclosure answer before they knew
+  what either meant. The decision table is now two rows phrased as reader
+  intent: read specific data goes to Registry Relay, learn only a fact goes
+  to Evidence. Notary keeps one sentence saying it is being retired and is no
+  longer a recommended starting point, with no link, because publishing the
+  retirement page is C7's. The old Relay-plus-Notary composition paragraph
+  became the Evidence-over-Relay pattern that A2 and A3 proved, and Registry
+  Mint gets one sentence as the token issuer for deployments with no identity
+  provider. B8's glossary step was already in place. B8's third step, the
+  quickstart flip, is still blocked: `start/quickstart` routes the reader
+  through registryctl and Notary end to end, and ending it in an Evidence
+  assertion over a Relay-protected API needs the runnable composed path,
+  which is D.
+- 2026-08-03: Front door rebalanced for Evidence, at Jeremi's direction. The
+  imbalance ran wider than B8 described. The homepage and `start/quickstart`
+  were both entirely Registry Relay and Registry Notary, with Evidence absent
+  from each, and the homepage still opened by defining the product as Relay
+  plus Notary. `Answer with Evidence` was also the only task-flow sidebar
+  section with no overview route, an omission already visible in
+  `information-architecture.test.mjs`, which enumerates every other section.
+  New `start/evidence-quickstart` is that overview: it names the four coequal
+  acceptance definitions, maps the six tutorials with their times and
+  outcomes, and states where the track stops, which is production signing and
+  not production approval. It carries no commands, so it neither competes
+  with the first-assertion tutorial nor needs a place in the tutorial gate.
+  Both front doors now open on a two-door choice and give Evidence the first
+  lane, and each Notary lane carries the same retirement sentence
+  `when-to-use` uses, unlinked, because publishing the retirement page is
+  C7's. Nothing was deleted: removing a Notary lane needs test changes and
+  belongs to C, which is blocked on C1. Three new assertions guard the result
+  rather than leaving it to drift, one extending the overview-route rule to
+  Evidence and two pinning an Evidence lane ahead of the Notary tutorial on
+  each page. Adding Evidence to the homepage exposed a claim that had become
+  false: `Both paths use the same authoring, offline test, disposable
+  development, and build commands` is true of the two registryctl paths and
+  not of Evidence, which has its own toolset and project shape, so it is now
+  scoped to registryctl. B8 still cannot be ticked. Its third part requires
+  the quickstart to end in an Evidence assertion over the Relay-protected
+  API, which is the composed path and needs D. A style-guide pass over the
+  three touched pages afterwards removed four live violations the automated
+  checks do not catch: `above` as a directional reference on both front
+  doors, bold used for keywords inside the track list, `should` where an
+  obligation was meant, and a Next list mixing fragments with sentences. The
+  six per-tutorial times, the 23 and 12 fixture counts, and the five
+  refusals cited on the overview were each read back out of the tutorial
+  they describe rather than recalled.
+- 2026-08-03: C1 done after Jeremi approved the framing. The ROADMAP pilot
+  line now names Registry Relay and Evidence; the docs changelog records the
+  retirement decision without claiming the deletion is complete; and the
+  retirement decision page is drafted with `draft: true` for publication in
+  C7. No runtime, contract, or Relay implementation changed. Next in C: C2.
+- 2026-08-03: C2 done. registryctl is Relay-only tooling: the Notary compiler,
+  authoring model, credentials, runtime/deployment wiring, trust material, and
+  release-lock entries are gone. Public and consultation Relay lanes retain
+  distinct client identities, and malformed retired approved-set values fail
+  closed. This is a pre-1.0 breaking project/release-lock migration: operators
+  rebuild generated deployment material before later decommissioning or
+  archiving old Notary state; no automatic database cleanup occurs. Relay
+  production source and frozen Evidence contracts are unchanged. Formatting,
+  check, Clippy, registryctl/language-server/workspace tests, cargo-deny, and
+  the affected release-lock/compose gates passed. The full workspace command
+  still reaches the unchanged main-branch failure in
+  `registry-evidencectl/tests/scaffold.rs::the_rendered_mint_configuration_passes_mint_check`:
+  Mint validation succeeds but emits no stdout, while the test expects a
+  success sentence and client count. That failure reproduces in the untouched
+  original checkout and is outside C; the same workspace tests pass when the
+  unrelated `registry-evidencectl` crate is excluded. Next in C: the mandatory
+  C3 deletion approval stop, with C4 reverse-dependency evidence.
+- 2026-08-03: C6 done. `registry-stack-beta-27.yaml` defines the first
+  post-Notary release at v0.17.0, with Relay, the reviewed PostgreSQL runtime,
+  Manifest, registryctl, Evidence, evidencectl, Mint, docs, and installers but
+  no Notary artifact. Current release workflows, image locks, security
+  evidence, repeatability checks, stable-surface metrics, and source-model
+  proof follow that inventory; pre-0.17 candidate and image-lock validation
+  still requires the historical Notary closure, and every older manifest is
+  byte-untouched. The OpenID runner was retired because its plans and protocol
+  path were exclusively Notary OID4VCI; its initial report remains historical,
+  while the independent Relay OIDC smoke remains supported. The likewise
+  Notary-bound external-integration runner was retired rather than relabelled
+  as evidence for a topology it never exercised. Capsule backfill follows the
+  same v0.17 boundary, and upgrade-exercise v1 is explicitly frozen as a
+  historical pre-v0.17 contract instead of reading deleted paths for a current
+  target. The five required C6 commands passed, as did the consolidated
+  585-test release suite (2 skipped), release
+  workflow lint/structure checks, candidate compatibility tests, and the
+  current plus historical-base stable-surface checks. Evidence artifacts stay
+  optional until F3; C6 does not claim that separate workstream complete. Next
+  in C: C3 approval, then C5 can complete against the deleted workspace graph.
+- 2026-08-03: C8 done. Root `AGENTS.md`, `CONTRIBUTING.md`, and `README.md`
+  now describe the two maintained runtime patterns, Relay and Evidence, plus
+  their optional composition and Mint's supporting role. Current crate maps,
+  verification commands, security-review language, architecture diagram, and
+  onboarding links no longer present Notary as an available product; release
+  validation points at the C6 beta-27 manifest and the retired OpenID command
+  is absent. Historical decision, changelog, and release evidence were not
+  rewritten, and no docs-site or solmara-lab file changed. The focused
+  deployment-documentation tests, offline link check, stale-surface scan,
+  beta-27 validation, and diff check passed. Next in C: the mandatory C3
+  approval, then C3/C4 and prepared C5.
+- 2026-08-03: C3 done after Jeremi approved the exact deletion list. All five
+  `registry-notary*` crates, `products/notary`, Relay's two Notary contract-test
+  artifacts, and the two Notary profile handoff examples are deleted. The
+  workspace manifest and lock no longer contain a Notary package; Relay keeps
+  `registry-platform-testing`, and no Relay production source changed.
+  `deny.toml` required no edit because it held no Notary-specific allowance.
+  Formatting, check, Clippy, the complete workspace test suite, cargo-deny,
+  Evidence contract reproduction, and Evidence source neutrality passed. The
+  workspace test was run with the shell's inherited `RUST_LOG=warn` removed,
+  matching CI; the one test it had suppressed then passed without an
+  Evidencectl change. Next in C: C4 orphan platform cleanup.
+- 2026-08-03: C5 done. Current CI no longer routes, tests, fuzzes, covers, or
+  publishes a PostgreSQL conformance lane for Notary. Relay's OpenAPI,
+  exposure, advisory, assurance, and coverage gates remain, and Evidence
+  contract reproduction plus source-neutrality stay in the Rust aggregate.
+  The obsolete Notary-versus-Relay advisory-checker byte-identity guard was
+  removed while Relay's checker tests remain. The CI classifier's generated
+  authoring-reference inputs and artifacts now follow the Relay-only
+  registryctl source contract instead of reading deleted Notary schemas.
+  Actionlint, the 30 classifier tests, the 71 gate-inventory tests and live
+  146-gate inventory, Relay's 41 security/advisory tests, the 71 release
+  aggregate tests, the focused generated-reference suite, Relay OpenAPI, and
+  both Evidence gates passed. The full docs suite now reaches seven stale
+  post-C2/C3 consumers and generated closures reserved for C7; its C5-owned
+  reference tests pass byte-exactly. Next in C: C4 orphan platform cleanup.
+- 2026-08-03: C4 done. The orphaned `registry-platform-cache`,
+  `registry-platform-oid4vci`, `registry-platform-replay`, and
+  `registry-platform-sts` crates and the OID4VCI fuzz target/corpus are
+  deleted. `registry-platform-pdp` remains in Relay's production dependency
+  tree, and `registry-platform-testing` remains in Relay's development tree;
+  both reverse trees terminate through `registry-relay` and `registryctl`.
+  Workspace and fuzz manifests, lockfiles, CI routing, nightly security,
+  secret-scanning paths, platform docs, and testing helpers now match the
+  retained surface. Formatting, workspace check, Clippy, complete workspace
+  tests, cargo-deny, Evidence contracts and neutrality, platform hygiene and
+  config audits, fuzz compilation, CI classifier/inventory tests, and the
+  explicit package-absence proof passed. Next in C: C7 docs surface removal.
+- 2026-08-03: C7 done. Six authored Notary pages, four Notary-only diagrams,
+  the current mirrored product docset, generated API, navigation, project,
+  contract, and source aggregation are removed. The retirement decision is
+  published, the site presents Relay and Evidence as the maintained runtime
+  products, and the Relay-only registryctl tutorial and generated diagnostic
+  closures no longer depend on retired Notary artifacts. Historical docset
+  pins remain intact. Every retired authored, mirrored-product, project, and
+  generated API URL, including all 27 operation routes plus Markdown twins
+  for former content pages, redirects through the current-docset resolver to
+  an Evidence replacement or the retirement decision, so archive builds never
+  target absent pages. The retirement redirect tests, 285-test docs suite,
+  generation, content/style/OpenAPI/tutorial/SVG checks, Astro typecheck and
+  build, accessibility and machine-readable output checks, SEO, and 31,725
+  internal links and assets passed. All C work is complete.
+- 2026-08-03: D1 done in solmara-lab. `just up-evidence` runs a second CRA
+  Relay serving the civil register as a governed records API, Registry Mint
+  issuing the caller token, and Registry Evidence answering adult status over
+  that Relay under `adult-status-verification`. `just smoke-evidence` is green
+  on four cases: adult 200 true, minor 200 false, unresolved reference 422,
+  bad token 401, each signed answer verified against the published key set and
+  checked to carry neither the subject reference nor the date of birth the
+  Relay disclosed. Two things are honestly incomplete. A1's Mint-as-Relay-IdP
+  branch stays unexercised: the Relay still trusts its own co-located workload
+  identity agent, and only Evidence's caller goes through Mint. And no release
+  ships Evidence or Mint, so the overlay builds those two images from a named
+  Registry Stack checkout while every other image stays a pinned digest; F3
+  would let the lab consume them like the rest. Found on the way: the lab's
+  workload agent wrote a trailing newline into the token file, which Notary
+  trims and Evidence does not, since Evidence treats a file secret as opaque
+  bytes; it now publishes the token alone.
+- 2026-08-03: D2 done. `first-run-with-solmara-lab` is rewritten against the
+  composed demo: four Steps ending in `just smoke-evidence`, a new section
+  that asks Evidence one question by hand and reads the decoded answer, and a
+  Verify command that fails unless the answer is `true` and carries neither
+  the subject reference nor the date of birth. The gate was rebuilt with it,
+  because it had drifted well past the Evidence work: it still expected
+  `redis` and three shared Notary instances that no longer exist. It now names
+  the 17 services the page names and asserts the running total of 41
+  separately, so the count on the page is checked rather than asserted twice.
+  Two prerequisites are real and documented rather than worked around. The
+  reader needs a clean Registry Stack checkout in `REGISTRY_STACK_SOURCE_DIR`
+  until F3 publishes Evidence and Mint images, and the gate's clone mode stays
+  pinned to a lab ref that predates the Evidence overlay until the lab commits
+  are pushed, so this run used `SOLMARA_LAB_PATH`. Found on the way: `just
+  generate` rotates every credential including the Postgres password, so a
+  second run against kept volumes dies in `registry-postgresql-bootstrap`
+  with a message naming neither cause; the page now has that row and the gate
+  refuses to start against a checkout still holding volumes.
+
+- 2026-08-03: B8 done. Its third part was the one still open: the quickstart
+  now ends where Evidence answers over a Relay-protected API rather than a
+  local fixture. `first-run-with-solmara-lab` stops being a draft, loses its
+  redirect back to the chooser, and takes a sidebar entry under Answer with
+  Evidence as "See it over a Relay API". `start/quickstart` closes with a
+  section that says plainly what the composed run shows: one institution can
+  publish through Relay and answer through Evidence over those same records,
+  because Evidence treats a Relay API as an ordinary fixed HTTP source.
+  `start/when-to-use` and the Evidence track overview both link there, so
+  either door reaches the place they meet. The glossary's Notary sense of
+  evidence credential now says outright that it describes deployments already
+  running Notary rather than a path to start on. A new
+  `information-architecture` test holds the shape: quickstart lane order,
+  no redirect, page published rather than draft, sidebar entry present. It
+  failed on the missing quickstart link before the edits. Gates: `npm test`
+  281 pass 0 fail, `npm run check` exit 0.
+
+- 2026-08-03: E1 done. All 21 heavy pages rewritten around Registry Relay,
+  Evidence, and Registry Mint. The lever was a new gate,
+  `docs/site/scripts/check-notary-surface.mjs`, written failing first: it
+  refuses a published page that names Notary in a block (paragraph, table row,
+  or list item) that does not also say it is retired, and it skips the marked
+  past, unpublished pages, the synced `products/` docsets, the pages the
+  deletion cascade removes, and the pages E2 still owns. It flagged exactly
+  360 blocks across the 21 pages and nothing else, which confirmed the page
+  list, and it now passes with zero findings and 45 pages of tracked E2 debt
+  named in the file itself. It runs in `npm run check` between `check:cutover`
+  and `check:markdown`. Four inherited claims turned out to be false and were
+  corrected rather than reworded: purpose-bound authorization does not narrow
+  what a requirement discloses, only whether it may be invoked
+  (`OPERATOR-CONTRACT.md`); Evidence has no caller-selectable disclosure modes
+  at all, because `request.schema.yaml` is closed on four members plus an
+  optional `holderKey`, so the old value/predicate/redacted table described
+  machinery with no Evidence analogue; the shared platform error section was
+  untrue, since `body_limit_problem_response` had exactly one caller and it
+  was Notary's; and Solmara Lab builds Evidence and Mint from source, because
+  no release ships those binaries. Sections that only existed to describe
+  Notary machinery were deleted rather than given an invented Evidence
+  equivalent: federation trust, credential issuance and lifecycle, wallets,
+  delegated subject access, the Notary approval lane, and the Notary posture
+  producer. Five contract tests changed in lockstep with their pages, each
+  narrowing to what still exists rather than weakening an assertion:
+  `advanced-operations-docs` dropped three Notary-only diagnostic codes,
+  `public-registryctl-journeys` added two-lane arrays for the rewritten
+  journeys while leaving the three-lane constants for E2's
+  `upgrade-and-rollback`, and `replay-protection-contract` followed the
+  RS-SEC-G section renumbering and gained two tests holding that Evidence has
+  no replay state and that in-process single use is not a cross-instance
+  guarantee. `docs/style-guide.md` stopped naming Registry Notary as one of
+  the four formal product names, and `src/data/projects.yaml` plus its
+  generated `projects.json` dropped the Notary entry and gained Evidence and
+  Mint, so the map page's table and prose agree again. Gates: `npm test` 289
+  pass 0 fail, `npm run check` exit 0 with 52529 internal links checked.
+  Known red, and deliberately not fixed here:
+  `release/scripts/check-stable-surface-compatibility.py` parses
+  `reference/errors.mdx` as the machine-readable error registry with
+  `## Registry Notary` hardcoded as a product section, so removing that
+  section reports 40 released error codes as removed. The fix belongs to C5 in
+  `release/`, a different owning area with work already in flight.
+
+- 2026-08-03: The two diagrams E1 orphaned were redrawn rather than dropped.
+  `registry-trust-boundaries.svg` now draws the spine Registry Mint, caller,
+  Evidence, Registry Relay, registry sources, with the edge labels that make
+  each hop checkable (short-lived access token; bearer token, purpose,
+  revision, selectors; one fixed HTTP request per evaluation;
+  deny-by-default read), two service-edge rules, six named boundary blocks, a
+  bottom operator-to-verifier key lane, and a footnote listing the five
+  unauthenticated Evidence routes. It deliberately draws no Mint-to-Evidence
+  arrow, because the dependency runs one way and an arrow would contradict
+  the page. `registry-country-evidence-mesh.svg` became three tiers with
+  Relay and Evidence side by side as protected read and minimum disclosure,
+  and no arrow between them, because the section does not claim one. The
+  describe and enforce boundary stayed in prose, where it was already
+  correct. The audit that found them also confirmed six deleted sections stay
+  deleted: federation trust, credential issuance lifecycle, wallets,
+  delegated subject access, the Notary approval lane, and the Notary posture
+  producer each described machinery Evidence V1 explicitly lacks.
+
+- 2026-08-03: Workstream C merged into main. Two conflicts, both in the
+  projects data the E1 diagram work had already rewritten, resolved in favor
+  of the rewritten version; the merged `projects.yaml` carries six ids and no
+  Notary reference, and `npm run generate` reproduced every generated
+  artifact byte for byte.
+
+- 2026-08-03: Post-merge review of C settled three questions and opened C9
+  and C10. First, the approved baseline set: C removed the cross-lane
+  interface digests without bumping
+  `APPROVED_BASELINE_SET_SCHEMA_VERSION`, and the structs deny unknown
+  fields, so a previously issued signed approval was already being rejected,
+  just with an unreadable serde error under a version claiming nothing
+  changed. Decision 10 above settles it: bump, reject legibly, adopters
+  re-approve. Second, the retired external integration runner's absence
+  guard was deleted; it asserted nothing about behaviour and would have
+  failed CI for anyone restoring source-read coverage under the same names.
+  The successor it leaves owed is C9. Third, decision 9 above draws the line
+  between a retired product and the layers underneath it. Applying it:
+  `registry_notary_from_env`, `registry_notary_access_profile`, the Notary
+  federation request JWT verifier profile, and `NOTARY_POSTURE_EXAMPLE_V1`
+  are code paths with no caller and are deleted, while
+  `ProductAcceptanceLaneV1::Notary` and
+  `ProductAcceptanceProductV1::RegistryNotary` stay parseable on purpose:
+  they are names, not behaviour, and keeping them means an operator reading
+  an old bundle is told registry-notary is retired instead of meeting an
+  unknown-variant error. The manifest layer's federation and PDP identifiers
+  are the one case that is neither, because changing them is a published
+  schema change; that is C10.
+
+- 2026-08-03: Documented the approved-set breaking change for adopters.
+  `operate/approve-initial-baseline.mdx` now states that assembly declares
+  schema version 2.0, that a pre-retirement set is refused whether it declares
+  1.0, carries a notary lane, or binds cross-lane interface digests, and that
+  editing the file is not a repair because the removed digests are no longer
+  verified. The changelog carries the same as an adopter-facing breaking
+  change under 2026-08-03. `advanced/compare-and-reapprove-source-change.mdx`
+  is deliberately untouched: it still shows a `--notary` flag the CLI no
+  longer has, so its whole flow needs E2's pass rather than one inserted
+  paragraph. Docs gates: `npm test` 294 passed, `npm run check` clean
+  including 31741 built links.
+
+- 2026-08-03: Audited the rest of registryctl's schema versions for the same
+  defect decision 10 fixed, and opened C11. `DeploymentBindingV1` lost
+  `ports.notary` and three `secret_files` ids, and the release lock's image,
+  recipe, and supported-contract structs lost their Notary members, while
+  `require_schema` still pins every one of those documents to version `1.0`.
+  The version is the compatibility gate and it did not move when the required
+  shape did. The other constants in `deployment.rs`, `trust.rs`, and
+  `project_authoring` are unaffected: their documents are generated fresh or
+  their shapes did not change in the retirement.
+
+- 2026-08-03: Applied decision 9 to the platform crates. Deleted eight
+  callerless public items: both `registry_notary_from_env` constructors
+  (platform-audit), `registry_notary_access_profile`,
+  `registry_notary_federation_request_profile` and the `typed_request_profile`
+  helper it was the only caller of (platform-oidc), `NOTARY_POSTURE_EXAMPLE_V1`
+  (platform-ops), and the two Notary diagnostic fixture constants
+  (config-report). The two config-report fixture JSON files went with them, but
+  their deletion landed early in `1fc9a943` because a concurrent agent staged
+  them; the source removals are here. `examples/registry-notary.posture.valid.json`
+  is deliberately kept: `docs/site/scripts/ops-posture-spec.test.mjs` reads it
+  by path and asserts the retired component still validates against the frozen
+  `registry.ops.posture.v1`, which is decision 9's read-an-old-document case.
+  The `registry-notary` component values in the ops posture and config-report
+  schemas stay for the same reason; whether a future `registry.ops.posture.v2`
+  drops them is a separate contract decision. Gates: `cargo fmt --check` clean,
+  `cargo clippy` on the four crates with `-D warnings` clean,
+  `cargo check --locked --workspace --all-targets` clean, and the four crates'
+  suites green (16 targets, 0 failures).
+
+- 2026-08-03: Deleted the `oid4vci` row from the docs standards register. It
+  claimed `status: used`, `claim_level: emits`, and `adoption_mode: profiled`
+  for a standard no maintained runtime implements: the profiled issuer subset
+  belonged to Registry Notary and retired with it, and OID4VCI is a frozen
+  Evidence Version 1 non-goal. Removing the row cascaded to the five page
+  frontmatters and two `repo-docs.yaml` entries that referenced the id, and to
+  the stale `registry-platform-oid4vci` ownership bullet in `projects.yaml`
+  (that crate was deleted in C4). Generated data reproduced with
+  `node scripts/generate-data.mjs`. The glossary prose entry is deliberately
+  kept: it is now the surviving record that the subset existed and is retired.
+  The `a hosted-held release keeps external OID4VCI evidence candidate-only`
+  guard asserted the candidate-only disclaimer that lived inside the deleted
+  row, so it was rewritten to check the honest invariant instead: no published
+  OID4VCI entry may claim external evidence outright, satisfied by an entry
+  marked candidate-only or by no entry at all. Gates: `npm test` 294 passed, 0
+  failed; `npm run check` clean, including 31741 built links.
+
+- 2026-08-03: Closed C11. Bumped the deployment plan, deployment binding, and
+  release lock to schema version `2.0`, the three documents whose required
+  shape the retirement changed and which registryctl reads back from disk under
+  `deny_unknown_fields`. The plan lost the `Notary` product lane and five
+  initialization actions, the binding lost `ports.notary` and three
+  `secret_files` ids, and the signed release-lock payload lost its Notary image,
+  runtime recipe, and config schema. The release lock is one contract in three
+  places, so `RELEASE_LOCK_SCHEMA_VERSION`, `registry_release_lock.py`'s
+  `SCHEMA_VERSION`, and the `const` in both published schemas moved together;
+  the adopter Compose conformance checker and its inert plan probe moved with
+  the plan. The manifest, ownership report, and operator-files documents keep
+  `1.0`: their field shapes are unchanged. Decision 10's pre-retirement
+  detection and re-approval guidance was deliberately not repeated here, on
+  Jeremi's confirmation that no adopter has used the stack: there is no
+  pre-retirement document in existence to explain, and every removed member is
+  literally named `notary`, so the default diagnostics already name the cause.
+  Note that `release/registry-release-lock-payload.v1.schema.json` had already
+  been edited in place to drop Notary while its version `const` stayed `1.0`,
+  which is what made the version stop identifying a shape. Gates:
+  `cargo fmt --check` clean, `cargo clippy -p registryctl --all-targets` with
+  `-D warnings` clean, `cargo check --locked --workspace --all-targets` clean,
+  `cargo test --locked -p registryctl` green (28 targets, 0 failures),
+  `test_registry_release_lock.py` 10 passed, `test_registry_release.py` 71
+  passed, `test_check_adopter_compose_contract.py` 33 passed,
+  `test_check_release_source_model.py` 13 passed,
+  `check_adopter_compose_contract.sh` PASS on current and minimum-2.35.0, and
+  `registry-release validate` clean on beta-27.
+
+- 2026-08-04: Fixed an untracked deletion cascade found while rewriting the
+  spreadsheet tutorials: `registryctl dev` failed on every project with
+  `[registryctl.dev.invalid_plan] empty development result expectation is
+  invalid`. The development compiler still built a Notary-era claim-results
+  commitment, and `dev_claim_results_commitment` rejects an empty result set,
+  which is now the only set a claim-free project can produce. The whole surface
+  was vestigial: `request_json`, `minimized_claim_ids`, and
+  `expected_claim_results_sha256` were compiled empty, had no remaining reader
+  (the request materializer that wrote `request.curl` went with Notary), and
+  their plan-side validation could no longer be satisfied. Removed all three
+  from `AuthoredDevScenario` and `DevScenarioPlan` with the commitment helper
+  and its validation. The smoke report keeps `minimized_claim_ids` and its
+  `minimized_claim_ids=none` output line, which is a live output contract. The
+  regression survived because `dev_runtime_core.rs`'s hand-built scenario
+  fixture still populated the deleted fields, so no test ever exercised what
+  the compiler actually emits; the new test drives the real `init` templates
+  through `compile_dev_runtime_authoring`, and it fails on the pre-fix tree.
+  Gates: `cargo fmt --check` clean, `cargo clippy -p registryctl --all-targets`
+  with `-D warnings` clean, `cargo check --locked --workspace --all-targets`
+  clean, `cargo test --locked -p registryctl` green (28 targets, 0 failures).
+
+- 2026-08-04: E2 done. The light-touch pass closed the tracked page debt and
+  `check-notary-surface.mjs` lost its `pendingRewrite` waiver set entirely: with
+  the debt at zero, an empty waiver hook plus its three tests is dead weight
+  that invites new waivers, so every current product-surface page is now held to
+  the same unconditional rule. Four tutorials were rewritten against real binary
+  runs rather than prose, and every number in them was wrong: fixture counts
+  25->21, 9->7, 8->3, 3->1, and both `build` fences named a third product lane
+  that no longer exists. Five docs test files, not the docs, were the stale side
+  of the remaining failures; they still encoded the three-lane deployment world
+  contradicted by `crates/registryctl/src/deployment.rs`. Two generated example
+  sources still carried Notary-era service shapes and were repaired at the
+  source, then regenerated with `node scripts/generate-registryctl-example-overlays.mjs`
+  (never hand-edited): `docs/site/examples/registryctl/jsonplaceholder-todo-live`
+  became a `consultation_api` service with claim-free fixtures and environments.
+  Two invariant losses to decide on separately: `registryctl` no longer
+  generates the `::derived/authorization_before_source` fixture (it went with
+  the claim model), so adopter tooling has lost its offline proof that
+  authorization precedes source access, and it reports no `claims` member at
+  all, so the tutorial gate now asserts absent-or-empty. Also worth noting:
+  `check-registryctl-tutorials.sh` is not part of `npm run check`, which is why
+  the tutorials and five test files drifted undetected. Gates: `npm test` 293
+  tests / 293 pass / 0 fail, `npm run check` clean (link check 31736 links,
+  llms 166 passed), `node scripts/check-notary-surface.mjs` passed with no
+  waiver, and `bash scripts/check-registryctl-tutorials.sh` PASS across all six
+  reader journeys.
+- 2026-08-04: E3 done. Tightened `scripts/check-notary-surface.mjs` from E2's
+  "same-block retirement framing" rule to "code span or specification
+  version-history row only" (test first: `check-notary-surface.test.mjs`
+  rewritten to 8 cases, red on the renamed `findNotaryMentions` export, then
+  green). The literal DoD bar cannot be met: `registry-notary` is still spelled
+  in the frozen `registry.ops.posture.v1` component enum and `notary` section,
+  RS-DM-MANIFEST's `access.kind` and `registry-notary-federation/v0.1`, Relay's
+  startup binding validator, `registryctl`'s pre-retirement approved-set
+  refusal, and the pinned image name, so a reference page that stops writing it
+  becomes wrong. The checker now enforces the reachable rule instead, and E3 is
+  amended above to record it. 81 findings across 34 files went to zero: ~25
+  pages lost transitional orientation prose outright (nobody ever ran the
+  product, so there is no reader to orient), five specifications now write the
+  surviving identifier as a code span, `spec/rs-terms.mdx` and
+  `reference/glossary.mdx` lost 20 retired vocabulary entries between them (no
+  page anchors into either, checked), and `tutorials/first-run-with-solmara-lab.mdx`
+  names the lab's containers by image name. Two claims deleted along the way
+  were also factually stale: `registryctl` no longer accepts a Notary topology
+  or compiles an evidence service (`crates/registryctl/src/approved_set.rs`,
+  `deployment.rs`, `release_lock.rs`). `src/components/DocsList.astro` is live
+  copy the checker cannot see; its dead `registry-notary` docset card is gone
+  and the Platform blurb now reads "Relay, Evidence". Gates: `npm test` 296/296
+  pass, `npm run check` clean (31735 links, llms 166 passed),
+  `node scripts/check-notary-surface.mjs` passed, and
+  `bash scripts/check-registryctl-tutorials.sh` PASS across all six journeys.
+  Residual, deliberate: `src/content/docs/products/registry-relay/*` (synced
+  product docsets, outside checker scope), `src/data/docsets.yaml` (22 archived
+  pins that `notary-retirement.test.mjs` requires), `src/data/standards.yaml`,
+  `src/data/generated/configuration-reference.json` (generated from a Relay
+  Rust doc string), and the history pages.
+
+- 2026-08-04: C9 done. The successor lives inside the existing `relay-oidc`
+  harness, for the reason recorded on the item. The gap was real and narrower
+  than "nothing reads a source": the topology already mounts `records.csv` and
+  declares `read_scope: smoke_registry:rows` on the `person` entity, but every
+  assertion targeted `/v1/datasets`, so the read scope was never granted and no
+  row was ever read. The harness now maps the Zitadel role through a
+  parameterized `$mapped_scope`, and three checks join `REQUIRED_CHECKS`:
+  `source-read-scope-denied` (the metadata-scoped token is refused at the
+  records route with `403 auth.scope_denied`), `source-read-records` (the same
+  token remapped to the read scope returns `200`), and
+  `source-read-minimized-projection` (the record is exactly the authored
+  projection, so the source column `person_id` is absent). Relay restarts
+  between the two scope stages on purpose: one token carrying both scopes could
+  not show the read scope is independently enforced. `source_read_result` is a
+  pure function so the projection rule is unit-tested offline, and it reports
+  field names only, never the row, so a failing report keeps the same evidence
+  boundary as a passing one. A new test derives the expected record from the
+  pinned fixture so the CSV, the template projection, and the expectation
+  cannot drift apart. Verified against Relay source before asserting: the
+  entity records route requires `entity.access.read_scope`
+  (`crates/registry-relay/src/api/entity.rs:780`), `AuthError::ScopeDenied`
+  renders `auth.scope_denied` at `403`, and governed access is a pass-through
+  for this entity because it sets neither `require_purpose_header` nor a
+  governed policy (`crates/registry-relay/src/api/governed.rs:166`). Gates:
+  `test_relay_oidc_smoke.py` 37/37, `test_registry_release.py` 71/71,
+  `test_conformance_candidate.py` 6/6, `test_check_gates_inventory.py` 70/70,
+  `test_check_release_source_model.py` 13/13, `registry-release validate` on
+  beta-27, and the monorepo source-model check. Honest limit: like every other
+  assertion in this harness, these have never executed live, because a live run
+  needs a published digest-pinned candidate. `release/READINESS.md` records the
+  new coverage as source-ready and unrun, so no release may cite it yet.
+
+- 2026-08-04: C10 done, and the item's premise was wrong on both halves, so the
+  resolution is neither of the two the item offered. First,
+  `registry-evidence-gateway-pdp/v1` is not dead surface. It is validated in
+  manifest-core, consumed by the governed evidence pack policy path
+  (`crates/registry-relay/src/api/governed.rs`), required at Relay startup in
+  `crates/registry-relay/src/config/validate.rs`, and re-declared in
+  `registry-platform-pdp`, which C4 deliberately kept. It also does not name
+  Notary. It stays, unrenamed. Second, `federation` and the `registry-notary`
+  access kind were not dead either, but in the opposite direction: Relay's
+  runtime binding required *every* evidence offering to be
+  `kind: registry-notary`, so a Relay deployment could only advertise offerings
+  pointing at a retired product. Removing the vocabulary alone would have left
+  `kind` dangling, so access is retargeted rather than deleted: `federation` is
+  gone, and `registry-evidence` is validated in its place against Evidence's
+  real surfaces, an assertion endpoint and the discovery document a relying
+  party reads to verify the response.
+  The shared layer stays product-neutral in two ways that matter. `conforms_to`
+  is required to be present and non-blank but is not pinned to
+  `registry.assertion-evidence/v1`, so the portable manifest does not inherit an
+  Evidence contract version; the demo configs carry that value as an example
+  only. And manifest-core does not enumerate product names: an unrecognized
+  `access.kind` falls through to generic optional-URI validation and is rejected
+  by the consuming runtime, which
+  `validation_leaves_an_unrecognized_access_kind_to_the_consuming_runtime`
+  asserts directly.
+  The manifest version stays `registry-manifest/v1`, following C11's precedent.
+  No adopter has published a manifest, `federation` was optional, and serde's
+  unknown-field rejection fails closed naming the removed key, which
+  `manifest_rejects_a_retired_federation_block` asserts. Bumping would churn the
+  published JSON-LD namespace IRI and the DCAT/SHACL goldens for nobody.
+  One present-tense claim about Notary was corrected outside the manifest layer:
+  the `Data-Purpose` header description asserted that "Registry Notary remains
+  the purpose-certification layer for an offering handoff". That is a live claim
+  about a retired product on the offering surface this item retargets, not a
+  name that only names the past, so it now says certification belongs to the
+  layer that hands off an offering. The frozen D5 semantics are unchanged.
+  Gates: `cargo check --locked --workspace --all-targets` clean,
+  `cargo clippy --workspace --all-targets -- -D warnings` clean,
+  `cargo test --locked -p registry-relay -p registry-manifest-core
+  -p registry-manifest-cli` all green with zero failures (manifest-core
+  `metadata_core` 90/90, relay lib 776/776), `just openapi-contract` passing
+  against a regenerated document, and from `docs/site/` `npm run check` and
+  `npm test` (296/296).
+  Left alone on purpose: the `registry-platform-ops` posture fixtures and
+  `examples/registry-notary.posture.valid.json` still carry
+  `registry-notary-federation/v0.1` as opaque recorded posture data. They have
+  no manifest dependency and no code path, and decision 9 keeps the shared
+  platform layer's historical vocabulary. The consultation-plane prose in
+  `openapi.rs` (the authenticated Notary workload, its OIDC credential, its
+  batch child identity) also stays: those name the past, and C4 settled that
+  surface.
+  Worth knowing outside this item: the machine's disk hit 100% mid-run. Docker
+  holds about 192GB with roughly 122GB reclaimable (273 images, 895 volumes,
+  38GB build cache). Pruning is not this plan's call.
+- 2026-08-04: G1 done. Ran the full suite and it caught one real regression:
+  `cargo fmt --check` failed on the manifest-core `metadata_core.rs` tests
+  at the two C10 cases
+  `validation_requires_https_endpoints_for_registry_evidence_access` and its
+  declared-endpoints sibling. C10 was verified with check, clippy, tests and
+  the docs gates but not with `fmt`, so the drift reached main. Fixed with
+  `cargo fmt`; the change is whitespace only and touches nothing but those two
+  assertions. Every G1 gate then passed with a recorded exit status of 0:
+  `cargo fmt --check`, `cargo check --locked --workspace --all-targets`,
+  `cargo clippy --workspace --all-targets -- -D warnings`, `cargo test
+  --locked --workspace` (3652 passed, 0 failed, 20 ignored across 171 result
+  lines, no clippy warnings), `cargo deny check` (advisories, bans, licenses
+  and sources all ok), `products/evidence/scripts/check-contracts.sh`
+  (generated contracts reproduce exactly) and `check-source-neutrality.sh`,
+  `python3 -m unittest release/scripts/test_registry_release.py` (71 tests),
+  `release/scripts/registry-release validate
+  release/manifests/registry-stack-beta-27.yaml`
+  (beta-27 0.17.0), `check-release-source-model.sh` in monorepo mode,
+  `test_check_release_source_model.py` (13 tests), `just openapi-contract`
+  from `crates/registry-relay` with the committed document left unchanged,
+  and from `docs/site/` `npm test` (296/296) and `npm run check` (check-llms
+  166 passed, SEO over 333 files, 31735 built internal links).
+  Method note for future runs: this shell is zsh, where the bash idiom
+  `${PIPESTATUS[0]}` silently expands to nothing, so a gate piped into `tail`
+  reports no exit status at all. An earlier pass in this session read as green
+  on that basis while `fmt` was in fact failing. Gate exit codes here were
+  captured by redirecting to a file and reading `$?` directly, never through a
+  pipe.
+  Local `cargo-deny` is 0.19.7 while CI pins 0.19.8. The `deny.toml` parses
+  and the check passes on both, but they are not the same binary.
+  Two global gates in this section remain and are independent of G1: G2
+  (removed docs URLs redirect, no product-surface page describes Notary as
+  current) and G5 (review notes for every security-sensitive change). G3
+  (tutorial CI gates) is likewise still open. G4 stays reserved for Jeremi and
+  F3 stays blocked on a published release cut.
+- 2026-08-04: G2 done, in two halves.
+  Redirects: the plan's starting revision published 260 routes (195 pages, 65
+  redirect stubs); HEAD publishes 333 (176 pages, 157 stubs). Every one of the
+  260 base routes still resolves, 52 of them now as redirects, and no redirect
+  points at a missing target. `check-built-links.mjs` already validates
+  redirect targets because Astro's stub carries an `<a href>`, so this half
+  needed no code, only the proof.
+  Surface: `check-notary-surface.mjs` skipped everything under
+  `src/content/docs/products/`, which is where the crate docs are mirrored, so
+  the gate had never read the pages an adopter reaches from the Relay and
+  Manifest product menus. Removing the skip surfaced 55 blocks across 13
+  mirrored pages. All 13 source files were rewritten around Relay, Evidence,
+  and Mint: 10 under `crates/registry-relay/docs/`, plus
+  `products/manifest/docs/reference.md`, `products/evidence/README.md`, and
+  `products/evidence/PERFORMANCE.md`. Two shipped Relay wire identifiers were
+  left exactly as they are, per E3: the `Registry-Notary-Evaluation-Id` header
+  and the `notary_evaluation_id` envelope field. The manifest reference lost
+  its `federation` row outright, because `FederationManifest` no longer exists
+  in `registry-manifest-core`.
+  The checker gained two exemptions, each with a test. A non-mermaid fenced
+  block is code for the same reason an inline span is, so an `http` example
+  may spell a shipped header; a mermaid fence stays subject to the rule,
+  because a diagram's participant labels are prose. And a page whose `editUrl`
+  names a frozen Evidence Version 1 contract is skipped.
+  Open for Jeremi, and the reason for that second exemption:
+  `products/evidence/CONCEPT.md` is a frozen V1 contract that still positions
+  Evidence against Notary ("not a rewrite, replacement mode, or reduced
+  configuration of Registry Notary", "follows the useful part of the current
+  Notary consultation profile") and links to `products/notary/docs/` at
+  v0.16.3, a path this repo no longer has. Correcting it needs the G4
+  re-approval reserved for Jeremi. `IMPLEMENTATION.md` is exempt on the same
+  grounds. `products/evidence/AGENTS.md` also names Notary, but it is agent
+  guidance rather than product surface and is not published, so it is out of
+  G2's scope either way.
+  Gates, exit status 0 each, captured by redirect and not through a pipe:
+  `node --test scripts/check-notary-surface.test.mjs` (12/12, up from 8),
+  `npm run generate`, `node scripts/check-notary-surface.mjs`, `npm test`
+  (300/300), `npm run check` (check-llms 166 passed, SEO over 333 files,
+  31735 built internal links), `products/evidence/scripts/check-contracts.sh`
+  and `check-source-neutrality.sh`. No Rust source changed, only Markdown
+  under `crates/`.
+- 2026-08-04: G3 done. Both executing tutorial gates were replayed from this
+  worktree and returned exit status 0.
+  `bash scripts/check-registryctl-tutorials.sh` built `registryctl` 0.16.3 from
+  source and passed all six reader journeys: HTTP reader, spreadsheet reader,
+  adapted spreadsheet reader, public no-credential source offline, OAuth and
+  Rhai reader, and the OpenCRVS Events API case study.
+  `bash scripts/check-evidence-tutorials.sh` checked five tutorials:
+  `first-evidence-assertion`, `author-an-acceptance-definition`,
+  `connect-an-institution-source`, `serve-assertions-over-http`, and
+  `verify-an-assertion-as-a-consumer`.
+  Correction, 2026-08-04, see the entry below: both replays above ran on the
+  host, and the Evidence gate then failed in CI, which replays in a clean
+  container the host run could not stand in for. This tick was premature.
+  Coverage caveat, recorded rather than closed: the executing gates cover 11 of
+  the tutorial surface's journeys, and six Evidence tutorial pages have no
+  executing gate in this worktree
+  (`move-evidence-to-production-signing`, `prove-an-evidence-project`,
+  `deploy-standalone-with-own-data`, `configure-project-api-key-authentication`,
+  `return-a-governed-value`, `refuse-unsafe-evidence-requests`). G3 as written
+  asks that every tutorial pass the gate it has, which is now true. Extending
+  the Evidence gate to replay the remaining six is separate work, owned outside
+  this plan in the `registry-stack-doc-review-reset` worktree.
+  A first attempt at the Evidence gate reported PASS while silently building
+  from that other worktree, so both runs were repeated with an explicit `pwd`
+  confirming this checkout. Anyone re-running these should do the same: 49 git
+  worktrees are registered for this repo, and a backgrounded gate can inherit
+  the wrong one.
+- 2026-08-04: G5 done. Audited all 100 commits between the plan's starting
+  revision and now. Forty-four touch a security-relevant path (Rust sources or
+  tests, `release/`, `.github/`, `docker/`, a contracts directory, an Evidence
+  script) and four more touch only root configuration; of those, thirty are
+  security-sensitive under the definition in `AGENTS.md`. Fifteen already
+  carried a review note in their own commit message. The other fifteen did not,
+  and their notes are now in the new Security review notes section above,
+  keyed by what changed rather than by revision, since these commits are
+  squashed on review.
+  Two of the fifteen are worth naming here because they are losses rather than
+  additions, and both are argued rather than waved through: the
+  advisory-checker byte-identity guard went because it compared two copies and
+  only one is left, with the surviving copy keeping its own required gate; and
+  the external integration retirement guard went because it asserted absence
+  rather than behaviour, reported coverage the release does not have, and would
+  have failed CI for anyone restoring source-read conformance coverage under
+  the same names. A Relay-only successor for the second is still owed.
+  The remaining fourteen are the retirement's removals with their compensating
+  enforcement named, plus the Evidence and evidencectl changes that touch
+  output validation, bounds, quoting, secret generation, and the adopter
+  image's base-image contract.
+  Nothing in this pass changed code. The three ticked global gates now stand at
+  G1, G2, G3, G5; G4 remains Jeremi's, and it is not a formality: three frozen
+  files have changed since the plan's starting revision, two of them
+  substantively, and one of those two rewrites JWKS retrieval and readiness.
+- 2026-08-04: the retirement branch was pushed and opened as a draft pull
+  request so the full workflow set could run against it. Six distinct checks
+  came back red. The first is closed here: the repository secret scan reported
+  one leak, a false positive on a test fixture in
+  `crates/registry-evidence/src/kernel.rs` whose local was named `secret` and
+  whose value carried enough entropy to match the generic-api-key rule. The
+  fixture is a canary string the test asserts never reaches a rejection
+  message, so the local is now named `canary`, which is what it is. No value,
+  behaviour or assertion changed. Reproduced against a clean export of the tree
+  rather than the working directory, because `target/` and `scratch/` swamp the
+  scan with 141 unrelated hits; the export reproduced CI's single finding
+  exactly, and reports none after the rename.
+- 2026-08-04: G3 is unticked. The 2026-08-03 tick was taken from host replays,
+  and the Evidence tutorial gate fails in CI, where it replays inside a clean
+  Debian userland holding a shell, coreutils and the toolset under test. The
+  gate emitted `node "$HELPER" replace-fence-pair ...` into each reader
+  journey for the tutorials that ask the reader to edit a file, so every such
+  journey stopped at `node: command not found`. Mounting an interpreter into
+  the container would have cleared the red without fixing anything: the
+  container's whole purpose is to prove a reader needs nothing beyond the
+  documented toolset, and a tutorial that quietly grew an interpreter
+  dependency would then pass CI and fail the reader. The edit step is instead
+  ported to `docs/site/scripts/evidence-tutorial-fence.sh`, shell and awk only,
+  with the same fence semantics. A test asserts the gate reaches for no
+  interpreter, so the dependency cannot come back unnoticed.
+  Evidence: all 22 fences named by the 11 edit steps across the three tutorials
+  that carry them are byte-identical between the retired Node helper and the
+  shell helper, checked both on the host and under Debian trixie's mawk 1.3.4;
+  the gate itself runs under that container's bash; and a host replay of all
+  five tutorials passes with the ported step, exercising every edit.
+  `npm run test:tutorial:evidence` is 14 of 14, `npm test` 307 of 307,
+  `npm run check` passes, and both files are clean under `shellcheck` and
+  `shfmt -d`. G3 re-ticks when the pull request's `Evidence tutorials from
+  source` job is green, which is the only run that proves it.
+  `docs/site/scripts/registryctl-tutorial.mjs` is untouched: the registryctl
+  gate runs on the host, where Node is part of the contract.
+- 2026-08-04: G3 re-ticked, this time on the run that proves it. The pull
+  request's `Evidence tutorials from source` job passed in 2m15s with every
+  step green, including `Execute the Evidence tutorials in a clean container`,
+  the step that failed before the port. The tick now rests on the container
+  replay rather than on a host stand-in for it.
+- 2026-08-04: the Relay API contract gate is closed, and my first reading of it
+  was wrong. oasdiff reported two breaking errors: `format: uri` dropped from
+  an evidence offering's `access.conforms_to` on both
+  `/metadata/evidence-offerings` routes. I took that for collateral damage of
+  the retirement and expected to restore it. It is neither accidental nor
+  restorable. Retargeting the offering from Notary to Evidence made
+  `conforms_to` name a response profile rather than a document location,
+  `registry.assertion-evidence/v1`, so that the portable manifest layer stays
+  independent of any one product's contract version. `registry-manifest-core`
+  validates the member as present and non-blank for kind `registry-evidence`
+  and as a URI for every other kind, and Relay refuses at startup to serve an
+  offering of any other kind, so every value these two routes can return is a
+  profile identifier. Restoring the annotation would have declared a
+  constraint that the server's own legitimate values fail.
+  Recorded the way this repository already records an accepted breaking diff,
+  as a dated entry with its reasoning in
+  `crates/registry-relay/openapi/oasdiff-err-ignore.txt`, beside the issue #362
+  entry from 2026-07-20. The two `access/kind` warnings are the intended
+  `registry-evidence` enum addition and stay.
+  Security review note. Threat: a relying party that pinned `conforms_to` to a
+  URI, or a future change that reinstates the URI requirement, would reject
+  responses the Evidence runtime legitimately returns. Enforcement point:
+  `validate_registry_evidence_access` in `crates/registry-manifest-core`, plus
+  Relay's startup refusal of any offering whose `access.kind` is not
+  `registry-evidence` (`RuntimeBindingError::UnsupportedEvidenceOffering`).
+  Tests: `validation_rejects_blank_registry_evidence_conforms_to` keeps the
+  member mandatory, and a new
+  `validation_accepts_a_registry_evidence_conforms_to_that_is_not_a_uri` pins
+  the absence of a URI requirement. The new guard was checked against a
+  deliberately reinstated URI check and failed as it should, so it is not
+  vacuous.
+  Evidence: `just openapi-contract` against the pull request's base now exits 0
+  with 0 errors and the 2 intended warnings, `cargo fmt --check` is clean, and
+  `cargo test --locked -p registry-manifest-core` passes 98 tests.
+
+- 2026-08-04: The stable-surface check's last red line was one retired
+  diagnostic code, `fixture_execution registryctl_relay_offline_harness
+  authorization.denied`. The harness is not gone: thirteen other live codes sit
+  under the same family and product. The code reached the catalog only through
+  `GeneratorRecipeId::AuthorizationBeforeSource`, whose emitter depended on
+  `registry_notary_server::standalone::OfflineAuthentication` and went with the
+  product. So the exemption is recorded per code, not per product: a new
+  `RETIRED_DIAGNOSTIC_CODES` map in
+  `release/scripts/check-stable-surface-compatibility.py`, keyed by the exact
+  `(family, product, code)` and carrying the reason in the file a reader of the
+  check will actually open.
+  Three alternatives were rejected on evidence. Adding the product to
+  `HISTORICAL_DIAGNOSTIC_PRODUCTS` would blind the check to those thirteen live
+  codes permanently. Skipping entries by `lifecycle: unreleased` would disable
+  the removal check outright, not loosen it: all seventy-four entries across the
+  three catalogs are `unreleased` (authoring 17, fixture 15, operator 42).
+  Restoring the emitter would reverse the retirement this plan exists to do.
+  The generated JSON catalogs were not touched; `validate_entries` in
+  `diagnostic_reference.rs` holds them to the Rust side.
+  Security review note, release provenance. Threat: a broad exemption quietly
+  stops the check from noticing that a maintained product dropped a code its
+  released catalog promised. Enforcement point: the membership test in
+  `compare_diagnostic_contracts` is on the full three-part key, so it cannot
+  match a code the map does not name. Negative test:
+  `test_a_retired_code_is_skipped_and_its_siblings_stay_protected` removes both
+  the retired code and a sibling under the same family and product, and asserts
+  the sibling alone is reported. A second test holds that every record states
+  why the code went away.
+  Evidence: `python3 release/scripts/check-stable-surface-compatibility.py`
+  exits 0, and `test_check_stable_surface_compatibility.py` passes 14 tests.
+
+- 2026-08-04: The last open code-scanning alert on the branch,
+  `py/clear-text-storage-sensitive-data` at `provision.py:66`, was a false
+  positive on a name, and the analysis SARIF says so exactly: the flow runs
+  from the local `secret_root` at line 203, through the f-string that renders
+  `runtime.yaml` at line 216, to the 0644 write at line 66. The value is the
+  path `evidence/secrets`, not anything held under it. That directory is
+  created 0700, and every secret inside it goes through `write_secret`, whose
+  sink is a different line and whose mode is 0600 at creation. The local is now
+  `provider_root`, after the `secretProviders.file.root` member it renders, so
+  the query has no sensitive-looking source to start from and the alert is gone
+  by construction rather than by a dismissal a later reader would never see.
+  The rest of the stack keeps saying `secret_root`, which is why the reason for
+  the divergence sits in a comment at the declaration.
+  Evidence: the demonstration's support suite passes 13 tests with
+  `cryptography` and 10 with 3 skipped under bare `python3`; provisioning a
+  throwaway deployment renders the same `secretProviders.file.root` and the
+  same modes (runtime.yaml 0444, secrets/ 0700, signing-key and source-token
+  0600, tls.key 0600, ca.pem 0644); and `evidence check` accepts the result.
diff --git a/products/evidence/.env.example b/products/evidence/.env.example
new file mode 100644
index 000000000..a66c55d07
--- /dev/null
+++ b/products/evidence/.env.example
@@ -0,0 +1,16 @@
+# Key-name reference only. Live tests reject credential files inside the
+# repository. Create one profile-specific owner-only file (mode 0600) at an
+# absolute external path and pass it with EVIDENCE_DHIS2_LIVE_ENV_FILE or
+# EVIDENCE_OPENCRVS_LIVE_ENV_FILE. Do not quote values or combine profiles.
+
+DHIS2_BASE_URL=
+DHIS2_USERNAME=
+DHIS2_PASSWORD=
+DHIS2_TEST_PROGRAM_ID=
+DHIS2_TEST_ORG_UNIT_ID=
+DHIS2_TEST_TRACKED_ENTITY_ID=
+
+OPENCRVS_CLIENT_ID=
+OPENCRVS_SECRET=
+OPENCRVS_URL=
+OPENCRVS_TEST_TRACKING_ID=
diff --git a/products/evidence/AGENTS.md b/products/evidence/AGENTS.md
new file mode 100644
index 000000000..f92a4e77c
--- /dev/null
+++ b/products/evidence/AGENTS.md
@@ -0,0 +1,164 @@
+# Evidence agent guidance
+
+Read the repository-root `AGENTS.md` first. Before changing Evidence, read these
+files completely in order:
+
+1. `products/evidence/CONCEPT.md`
+2. `products/evidence/IMPLEMENTATION.md`
+3. `products/evidence/SOURCE-TESTING.md`
+4. `products/evidence/OPERATOR-CONTRACT.md`
+5. `products/evidence/reference/request-adapter/ADAPTER-API.md`
+6. `products/evidence/reference/request-adapter/deployment-projects/CONFIG.md`
+7. `products/evidence/reference/request-adapter/deployment-projects/FIXTURES.md`
+
+Read the normative files relevant to the change under `contracts/` and the
+code-generated JSON Schema and OpenAPI artifacts under `generated/` after those
+four product-level contracts. Generated artifacts must be reproduced with
+`scripts/check-contracts.sh` and never hand-edited.
+
+## Product boundary
+
+Evidence Version 1 is one `registry-evidence` crate, one `evidence` binary, one
+process, and one operator-controlled trust domain. It is independent from
+Registry Notary and must not depend on or copy abstractions from
+`registry-notary*`. It also does not depend on Registry Manifest,
+`registry-platform-pdp`, `registry-platform-oid4vci`,
+`registry-platform-replay`, or `registry-platform-sts`.
+
+Selected `registry-platform-*` primitives may be reused only when their existing
+contracts fit Evidence directly. The approved candidates are audit, crypto,
+OIDC, HTTP security, testing, and the `registry-platform-sdjwt` serialization
+primitive used solely by the SD-JWT VC response format. Shared-crate changes
+are separate platform work and require the platform guidance and
+affected-consumer gates.
+
+Production behavior must stay source-product and assertion-case neutral:
+
+- no DHIS2 or OpenCRVS module, dependency, feature, public configuration field,
+  route, CLI option, public contract variant, or production branch;
+- no adult, age, residence, licence, parentage, personal-name-part, national
+  identifier, or jurisdiction-specific Rust domain type or operation;
+- no broad candidate retrieval, scoring, fuzzy matching, normalization,
+  transliteration, phonetics, or candidate selection; a reviewed derivation
+  may perform an exact deterministic comparison between an independently
+  authorized selector and complete facts from one uniquely resolved
+  authoritative record;
+- no future-profile stub, placeholder schema, module, feature, extension hook,
+  or empty API.
+
+The four acceptance definitions are coequal. Every phase preserves all four,
+and completion means every Definition of Done row passes on one revision.
+
+## Trust boundary
+
+Governed configuration, Rhai scripts, schemas, codelists, and fixtures are one
+trusted, immutable, startup-only bundle. A separate closed runtime file owns
+only process-local listener, filesystem, audit-storage, secret-mount, and TLS
+trust bindings and cannot override the bundle. Rust owns authentication,
+authorization, selector validation and minimization, credentials, fixed
+networking, path/header authority, response projection, script capabilities
+and limits, output validation, evidence construction, signing, and audit. Rhai
+owns only bounded query/body preparation, extraction, and
+requirement-specific derivation through the approved closed ABIs.
+
+Before code that touches authentication, authorization, disclosure, audit,
+configuration trust, signing, source credentials, or selectors, apply the
+`enforcing-security-invariants` guidance. For every affected invariant, record:
+
+- the threat;
+- the Rust enforcement point;
+- the focused negative test that pins it.
+
+Principal derivation uses only the configured claim and denies if it is absent.
+Caller values never create authority. Missing, extra, mistyped, oversized,
+unauthorized, or wrong-origin selector values fail before credential
+acquisition or source access. Access audit is durably accepted before source
+access. Disclosure audit is durably accepted after signing and before release.
+Signing and audit failures are fail-closed.
+
+Never commit, log, snapshot, pass on a command line, or place in an error:
+credentials, tokens, live responses, raw selector values, per-field hashes of
+low-entropy selectors, source values, Supported Values, demo-subject
+identifiers, or human login and two-factor details.
+
+## Phase discipline and commands
+
+Run commands from the monorepo root unless a command says otherwise. Commands
+for a later phase are required interfaces to add in that phase and are not
+claims that an unimplemented command currently exists.
+
+Phase 0, approved documentation and contracts:
+
+```sh
+git diff --check -- products/evidence
+git diff -- products/evidence
+```
+
+Phase 1 and every later package exit:
+
+```sh
+cargo fmt --check
+cargo check --locked -p registry-evidence --all-targets
+cargo test --locked -p registry-evidence
+cargo clippy -p registry-evidence --all-targets -- -D warnings
+```
+
+Phase 2 source boundary, after the package gate:
+
+```sh
+cargo test --locked -p registry-evidence --test source_contracts
+products/evidence/scripts/check-source-neutrality.sh
+```
+
+Phase 3 reruns the package and source-boundary gates and adds focused negative
+tests for every authentication, authority, audit, signing, and privacy
+invariant changed in that phase. A phase cannot exit with an unnamed or
+unmapped security invariant.
+
+Phase 4 generated public contracts, after the package gate:
+
+```sh
+products/evidence/scripts/check-contracts.sh
+products/evidence/scripts/check-source-neutrality.sh
+```
+
+Phase 5 optional public-demo smoke tests run only after the deterministic
+package and source-contract suite passes:
+
+```sh
+cargo test --locked -p registry-evidence
+cargo test --locked -p registry-evidence --test live_sources dhis2 -- --ignored
+cargo test --locked -p registry-evidence --test live_sources opencrvs -- --ignored
+```
+
+The live commands are read-only, local, non-gating, and must skip when approved
+selectors or securely stored credentials are unavailable. Follow
+`SOURCE-TESTING.md`; do not improvise credentials, selectors, or broader
+queries.
+
+Phase 6 final gate:
+
+```sh
+cargo fmt --check
+cargo metadata --locked --format-version 1
+cargo check --locked --workspace --all-targets
+cargo clippy --workspace --all-targets -- -D warnings
+cargo test --locked --workspace
+cargo deny check
+products/evidence/scripts/check-contracts.sh
+products/evidence/scripts/check-source-neutrality.sh
+```
+
+Use the repository Cargo wrapper if one is added. Otherwise, in Codex-managed
+worktrees set `CARGO_INCREMENTAL=0`, `CARGO_PROFILE_DEV_DEBUG=0`, and
+`CARGO_PROFILE_TEST_DEBUG=0` for Cargo check, test, and Clippy commands, as
+required by the root guidance.
+
+## Completion review
+
+Before claiming a phase complete, review the whole phase diff against its exit
+gate, the security invariant matrix, all four acceptance definitions, the
+source-product-neutrality boundary, and the non-goals in `CONCEPT.md` sections
+4 and 15. Report commands run, results, skipped commands with exact reasons,
+changed files, and remaining risks. Do not weaken a pinning test to make a gate
+pass.
diff --git a/products/evidence/CONCEPT.md b/products/evidence/CONCEPT.md
new file mode 100644
index 000000000..11ce05756
--- /dev/null
+++ b/products/evidence/CONCEPT.md
@@ -0,0 +1,1714 @@
+# Evidence: Minimum-Disclosure Assertion Service
+
+Status: Approved Version 1 product contract
+Date: 2026-08-02
+Audience: Product, architecture, privacy, interoperability, and implementation stakeholders
+
+Companion implementation note: [IMPLEMENTATION.md](IMPLEMENTATION.md)
+Companion source-testing note: [SOURCE-TESTING.md](SOURCE-TESTING.md)
+
+## Executive summary
+
+Evidence is a small, sector-neutral service for producing minimum-disclosure assertion evidence from authoritative data sources. It is designed first for government deployments with constrained operational capacity, while remaining useful to EU public administrations and private-sector organizations modernizing existing applications.
+
+In this note, **Evidence** names the product. Lowercase **evidence** and **assertion evidence** name the CCCEV-aligned domain object it produces.
+
+Evidence is a greenfield product concept. It is not a rewrite, replacement mode, or reduced configuration of Registry Notary and does not inherit that product's architecture or feature set.
+
+Given authenticated authority, an authorized purpose, a fixed requirement, and
+the configured selector data needed by an authoritative provider, Evidence
+obtains the necessary facts and returns the smallest sufficient JSON assertion.
+An assertion may describe a property, classification, eligibility decision,
+status, or relationship involving one or more role-bound subjects. A national
+identifier is one possible selector, not a prerequisite.
+
+The service is deliberately narrower than a data governance platform, API gateway, identity-matching service, workflow engine, credential suite, or policy decision platform. One service process may host many evidence definitions when they share one operator-controlled trust domain. Governed configuration, scripts, schemas, codelists, and fixtures form one trusted, atomic evidence bundle. A separate closed runtime file binds that bundle to process-local listener, filesystem, audit-storage, secret-mount, and TLS-trust paths without overriding evidence semantics.
+
+JSON is the native API and evidence representation. Requirements and evidence are aligned with CCCEV, using a documented Evidence JSON profile rather than RDF or XML. YAML declares fixed requirements, authorization conditions, source requests, trusted derivation parameters, concepts, and disclosure forms. Trusted Rhai scripts execute inside the process to extract typed facts and derive declared concept values from a deterministic evaluation context. Rust retains control of authentication, authorization, networking, credentials, script capabilities and limits, output validation, disclosure enforcement, evidence construction, signing, and audit.
+
+Version one produces assertion evidence with signed flattened JWS as the
+default and durable-verification format. A governed authority grant may also
+permit an explicitly requested, visibly unsigned JSON envelope for development
+or consumers that cannot process JWS. Unsigned output is transport-authenticated
+convenience data, not later-verifiable evidence and never a fallback from
+signing failure. Evidence does not retrieve or deliver documents, issue holder
+credentials, run a general policy engine, expose a public or dynamic catalog, or
+implement OOTS. It does expose an authenticated, requester-scoped description of
+complete request shapes already authorized by the deployed bundle. Those
+deferred capabilities remain separate future profiles and must not shape the
+initial runtime beyond stable identifiers and transport-neutral domain objects.
+
+Version one is accepted against four coequal initial assertion cases: adult status, controlled residence region, professional licence status, and legal-parent relationship. All four must pass the complete production path before the public contracts freeze. None is an implementation slice, privileged reference case, or part of the Rust domain model.
+
+## 1. Product thesis
+
+> Given authenticated authority, an authorized purpose, a predefined CCCEV-aligned requirement, and an authorized configured selector for each subject role, Evidence returns the smallest sufficient assertion in an authorized response format and persists no unnecessary source data.
+
+The unit of behavior is a versioned requirement, not an arbitrary query. A requirement declares:
+
+- its stable identity and revision;
+- the legal, procedural, or contractual context in which it is meaningful;
+- the purposes and requester classes that may invoke it;
+- the subject roles, allowed selector profiles, and value origins that must be
+  authorized;
+- the semantic concepts it evaluates or provides;
+- the authoritative source and fixed source request;
+- the typed facts extracted from the source response;
+- the trusted, requirement-specific Rhai derivation and its fixed parameters;
+- the exact disclosure form permitted for each concept;
+- the Evidence Type to which the result conforms;
+- its observation, validity, audit, and failure rules.
+
+Callers choose only among definitions, purposes, and selector profiles for
+which they are already authorized. They may supply only the closed selector
+values allowed by that authority path. They cannot supply expressions,
+thresholds, field names, operators, JSON paths, source fields, scripts, response
+projections, relationship types, or matching rules.
+
+## 2. Target deployments
+
+The core product is government-first and sector-neutral.
+
+### Native government deployment
+
+One binary runs on modest infrastructure, uses locally controlled configuration and audit sinks, and integrates with existing registries. It does not require Kubernetes, a message broker, a database, OPA, or a service mesh.
+
+### Enterprise and private-sector deployment
+
+Evidence runs behind an existing gateway or identity boundary and produces assertions such as age eligibility, organization status, professional authorization, insurance coverage, or supplier compliance. It does not become a multi-tenant governance platform.
+
+### EU deployment
+
+The same core may later sit behind an OOTS Data Service boundary. OOTS RegRep XML, Evidence Broker and DSD registration, Semantic Repository profiles, preview, AS4, and OOTS retention rules remain in an explicit interoperability profile.
+
+### Delegated software agents
+
+AI agents may later invoke fixed evidence operations under an external, task-bound authority grant. The agent is an authenticated actor, not the source of authority. Agent protocols and orchestration remain outside the core.
+
+These are profiles around one evidence engine, not separate product editions.
+
+## 3. Goals
+
+Evidence should:
+
+- produce structured minimum-disclosure assertion evidence;
+- use CCCEV as its semantic foundation;
+- expose one simple JSON evidence operation and one authenticated discovery
+  operation for complete requester-authorized request shapes;
+- return signed audience-bound JWS by default, with unsigned JSON available
+  only through explicit API selection plus governed bundle and grant permission;
+- support properties, classifications, statuses, eligibility results, and relationships;
+- host many evidence definitions within one operator-controlled trust domain;
+- use startup-only YAML configuration and trusted Rhai extraction and derivation scripts;
+- execute fixed, least-privilege source requests through Rust;
+- reuse platform audit and operational logging primitives where they fit;
+- provide privacy-safe, tamper-evident audit records;
+- minimize acquisition when the source supports it and always minimize disclosure;
+- validate all definitions, scripts, and schemas before serving, and require
+  complete fixtures before production or evidence-grade serving;
+- prove source independence against materially different JSON API shapes;
+- complement existing gateways, exchange layers, and workflow systems;
+- remain small enough for a maintainer to trace an evidence request end to end.
+
+## 4. Non-goals
+
+Version one is not:
+
+- a general-purpose data governance platform;
+- a data lake, registry, evidence repository, or document service;
+- a birth-certificate or other official-document generator;
+- an API gateway, identity provider, consent service, or authorization server;
+- a general identity-resolution, fuzzy or probabilistic matching, candidate-search, or deduplication service;
+- a workflow, orchestration, or case-management engine;
+- a general ETL, mapping, or query platform;
+- a runtime policy engine or general PDP;
+- a credential issuance, OID4VCI, holder-proof, credential-status, or wallet service; the SD-JWT VC *response format* of section 15.6 is a serialization of the same assertion and adds none of those capabilities;
+- a multi-tenant SaaS control plane;
+- a federation or delegated-evaluation protocol;
+- an AI agent runtime, MCP server, or agent discovery service;
+- an OOTS Evidence Broker, Data Service Directory, Semantic Repository, Preview Space, or AS4 Access Point;
+- a replacement for source-system access control.
+
+Document evidence, multi-verifier holder credentials, credential status and revocation, transaction-bound replay protection, OOTS execution, public or federated catalogs, multi-source fulfillment, source-planning scripts, and the delegated-agent grant profile of section 15.3 are explicitly deferred. Deferring that profile does not defer the optional delegated actor identity of section 8.1: version one carries an actor in the authenticated authority context and authorizes it there, but consumes no agent grant record and exposes no agent-facing operations. The closed requester-scoped definition response is not a catalog or authorization source.
+
+## 5. Design principles
+
+### 5.1 Fixed concepts instead of predicates
+
+`adultStatus` is a versioned Information Concept with a fixed legal meaning. It is not a caller-defined predicate over a hidden date of birth.
+
+A catalog of selectable thresholds such as `age >= 18`, `age >= 19`, and `age >= 20` would reconstruct the protected value. Evidence therefore exposes reviewed concepts, never a caller-supplied expression language. Trusted derivation code and parameters remain part of the atomic bundle and its combined disclosure review.
+
+### 5.2 The deployment bundle is the disclosure boundary
+
+Fixed requirements are not safe when their combined answers reveal more than any one answer. The complete simultaneously enabled bundle must be reviewed for:
+
+- threshold ladders;
+- overlapping categories;
+- increasingly precise geographic partitions;
+- jurisdiction variants;
+- coexisting revisions;
+- different entitlements held by the same requester;
+- relationships whose combination reveals a protected identity or fact.
+
+Rate controls and audit analysis may detect abuse, but they do not make an unsafe bundle safe.
+
+The requirement is the unit of disclosure. Purpose, audience, and requester entitlement decide whether a requirement may be invoked at all; they never narrow the answer it returns. Two callers authorized for the same requirement receive the same concepts and disclosure forms whatever purpose each declared. A purpose that justifies only a coarser answer therefore needs its own requirement and its own place in this combined review.
+
+### 5.3 Minimize across the lifecycle
+
+Evidence distinguishes three source-access postures:
+
+| Posture | Source behavior | Claim |
+|---|---|---|
+| `source-derived` | Source returns the final fact | Full acquisition and disclosure minimization |
+| `field-projected` | Source returns only facts needed for derivation | Strong acquisition and disclosure minimization |
+| `record-transformed` | Legacy source returns a broader record | Disclosure minimization only |
+
+Every requirement declares its posture. `record-transformed` is a legitimate migration state, but it must not be described as full lifecycle minimization.
+
+For every posture:
+
+1. Request only configured fields and selectors.
+2. Keep source values in memory only for evaluation.
+3. Construct responses from declared concepts and typed disclosure forms.
+4. Persist no raw source response.
+5. Exclude source values and disclosed values from logs and audit.
+
+Configured provider lookup is compatible with this boundary. Evidence may send
+an identifier or a closed compound selector such as name components and date of
+birth. A reviewed requirement derivation may compare a separately authorized
+selector with facts from one uniquely resolved authoritative record. Evidence
+never requests a broad candidate list, scores or chooses a best match, or
+treats a selector as proof of authority.
+
+### 5.4 Keep the core transport-neutral
+
+The evaluator consumes typed domain objects and returns typed assertion evidence. JSON, future OOTS XML, gateways, and agent-tool protocols are boundary representations. Rhai does not construct public responses.
+
+### 5.5 Prefer immutable deployment artifacts
+
+The governed bundle and closed runtime configuration are trusted deployment artifacts. They are validated at startup, scripts are compiled at startup, both inputs are mounted read-only, and each is identified by its own content hash. Version one has no runtime upload, mutation API, editor, approval workflow, hot reload, override layer, or fallback bundle.
+
+### 5.6 One process means one trust domain
+
+One process may serve many definitions, sources, and evidence types only when they share one operator, deployment lifecycle, audit boundary, and failure domain. Mutually distrustful issuers or customers use separate deployments.
+
+### 5.7 Prove generality at the source boundary
+
+Evidence must not be validated only against one idealized `person-facts` API.
+The same Rust source executor and Rhai interfaces must handle materially
+different JSON contracts without adding source-product concepts to the core.
+
+Version one proves this with small, sanitized compatibility mocks for:
+
+- a flat REST JSON response;
+- a paged, nested DHIS2 Tracker-style REST response;
+- an OpenCRVS Version 2 Event Search-style JSON response using OAuth 2.0
+  client credentials.
+
+These mocks reproduce only the boundary behavior Evidence consumes. They are
+not emulators, conformance claims, or bundled vendor connectors. Optional
+read-only tests against public demo systems follow the deterministic mock suite
+and never gate ordinary CI.
+
+DHIS2 and OpenCRVS names, data shapes, and behaviors are test concerns only.
+Production Rust, Cargo features and dependencies, public configuration schemas,
+routes, and CLI options remain source-product neutral. The runtime sees only
+generic fixed HTTP requests, generic authentication profiles, bounded JSON,
+and Rhai extraction.
+
+## 6. CCCEV-aligned assertion model
+
+The Evidence JSON profile pins CCCEV 2.2.0 as its initial semantic reference. It uses selected CCCEV concepts with stricter runtime rules and explicit Evidence extensions.
+
+### Requirement
+
+A named, versioned prerequisite or information need. Implementations normally use a more specific CCCEV kind:
+
+- **Criterion:** a condition to evaluate;
+- **Information Requirement:** information to provide;
+- **Constraint:** a limitation on a requirement or concept.
+
+### Information Concept
+
+A semantic fact needed by a requirement or provided by evidence, such as:
+
+- adult status;
+- residence region;
+- professional licence status;
+- organization registration status;
+- legal-parent relationship confirmed;
+- registered legal parents.
+
+Each concept has a stable identifier, value schema, semantics, permitted disclosure form, and reference framework.
+
+### Supported Value
+
+A typed value supplied for an Information Concept. Version one supports closed schemas declared by the concept, including:
+
+- boolean;
+- controlled code or category;
+- bounded integer or decimal;
+- date or time bucket;
+- audience-scoped entity reference;
+- bounded lists of controlled codes or entity references.
+
+Arbitrary JSON objects and caller-defined schemas are not accepted. A concept may define a reviewed structured value when its semantics require one, but the shape remains part of the trusted bundle.
+
+### Evidence Type
+
+A description of the assertion evidence expected for a requirement. Evidence Types may vary by jurisdiction or reference framework while supporting the same broader requirement.
+
+### Evidence Type List
+
+A CCCEV fulfillment alternative. Evidence Types within one list use `AND`; alternative lists use `OR`. Version one preserves these semantics in the conceptual and interchange model but does not execute multi-source or multi-evidence fulfillment.
+
+### Evidence
+
+The attributable assertion supporting a requirement. It includes:
+
+- requirement and Evidence Type identifiers;
+- legal issuer and technical provider;
+- issued, observed, and optional validity times;
+- role-bound subject bindings;
+- audience and purpose context where appropriate;
+- configuration revision;
+- Supported Values.
+
+Evidence extensions such as role-bound subject bindings, purpose, audience, and configuration revision are not presented as CCCEV-native properties. The JSON Schema must document the exact mapping between Evidence fields and CCCEV or Dublin Core properties.
+
+### Reference Framework and jurisdiction
+
+The legislation, policy, procedure, or contract from which a requirement derives. Jurisdiction and human-readable metadata belong to the definition bundle. Version one does not implement jurisdiction selection or a localization engine.
+
+### Relationship assertions
+
+Assertion evidence may involve more than one subject. Requirements declare fixed roles, cardinalities, and meanings.
+
+For example, `confirm-legal-parentage` declares `child` and `candidate-parent` roles and returns a boolean `legal-parent-relationship-confirmed`. `identify-legal-parents` declares a `child` role and may return a bounded list of audience-scoped entity references.
+
+`legal parent`, `biological parent`, `adoptive parent`, `guardian`, and `person with parental responsibility` are distinct concepts. A generic `parent` predicate is not accepted.
+
+## 7. Runtime model
+
+```mermaid
+flowchart LR
+    A["Requester"] --> B["JSON boundary"]
+    B --> C["Authenticate and resolve authority context"]
+    C --> D["Resolve and authorize selector profiles and values"]
+    D --> E["Write access-attempt audit"]
+    E --> F["Rhai renders bounded request parts"]
+    F --> G["Rust validates request parts and resolves credentials"]
+    G --> H["Rust executes one fixed-authority source request"]
+    H --> I["Authoritative source"]
+    I --> J["Rhai maps response to a closed lookup result"]
+    J --> K["On match, Rhai derives declared concept values"]
+    K --> L["Rust validates values and constructs evidence"]
+    L --> M{"Authorized response format"}
+    M -->|"signed"| N["Sign and serialize exact JWS"]
+    M -->|"unsigned"| O["Serialize marked unsigned envelope"]
+    N --> P["Write disclosure-release audit"]
+    O --> P
+    P --> Q["Return exact serialized response"]
+```
+
+The critical boundary is between derived concept values and public evidence. Rhai may return values only for concepts declared by the selected requirement. It cannot return evidence objects, create identifiers or subject bindings, select envelope fields, write audit events, or access signing material. Rust validates identifiers, types, codelists, cardinalities, sizes, and the exact output set before constructing evidence. Response protection and serialization are core-owned release steps after validation, not adapter capabilities or a second form of policy.
+
+## 8. Authorization and subject authority
+
+### 8.1 Authenticated authority context
+
+Each deployment supports one reviewed authentication profile. It produces a normalized context containing:
+
+- requester principal;
+- configured requester attributes;
+- optional delegated actor identity;
+- authority basis and optional grant identifier;
+- derived audience;
+- permitted purposes and requirement revisions;
+- permitted subject roles, selector profiles, and value origins.
+
+Principals and attributes derive only from configured, validated sources. Missing required identity information denies the request. Evidence does not fall back to alternative token claims, request fields, or unsigned headers.
+
+### 8.2 One authorization decision
+
+Before source access, Rust binds one decision over:
+
+```text
+requester principal
++ optional delegated actor
++ requirement revision
++ purpose
++ subject roles, selector profiles, value origins, and authority
++ audience
+```
+
+Every element must be authorized together. Authorization for a purpose does not automatically authorize every subject, requirement revision, or audience.
+
+Exactly one authority path must match. No matching path denies, and two or more matching paths also deny rather than choosing between them. Startup validation confirms that every declared purpose, subject role, and selector profile has an authority path; it does not detect two paths covering the same combination, so an overlapping bundle is denied at request time rather than rejected at load.
+
+### 8.3 Configured subject selectors
+
+A subject selector is only input to a provider lookup. Possession of an
+identifier, name, date of birth, record reference, or any other selector value
+does not grant authority.
+
+Each subject role admits one or more named selector profiles from trusted YAML.
+A selector profile declares one exact field set, scalar types and bounds, value
+provenance, and where it may be used by reviewed source preparation and
+requirement derivation. If a provider
+supports alternative sufficient data sets or an additional disambiguating
+field, the bundle declares separate profiles instead of a conditional or
+caller-built query. Examples include:
+
+- one opaque civil-registration identifier;
+- `given_name + family_name + birth_date`;
+- locally meaningful name components and date of birth;
+- a person selector plus a configured event or record disambiguator;
+- two role-bound person selectors for a relationship lookup.
+
+Field names are deployment-defined stable identifiers. `given_name`,
+`family_name`, and `birth_date` are examples, not core Evidence vocabulary.
+Version one selector values are bounded strings, full dates, integers,
+booleans, or controlled codes. Selector objects, arrays, and arbitrary JSON are
+not accepted. The core treats bounded name fields as opaque Unicode strings and
+a date as a typed calendar value. It performs no case folding,
+transliteration, phonetic comparison, fuzzy matching, confidence scoring, or
+Western-name parsing.
+Canonical selector serialization means deterministic encoding of the declared
+typed field names and values. It does not mean semantic name normalization.
+
+The public request names an allowed selector profile and supplies only that
+profile's permitted values. Unknown, missing, extra, mistyped, or oversized
+values are rejected before credentials are acquired or a source is contacted.
+The caller cannot supply field names, operators, weights, thresholds,
+normalization rules, or a query plan.
+
+For a self or subject-bound flow, selector values should normally derive from
+authenticated context or an authenticated grant and are omitted from the
+request. An authorized caseworker flow may permit caller-supplied values for a
+specific selector profile. Value origin is part of the subject-authority
+profile and the authorization decision. These are distinct flows.
+
+The authoritative provider owns record meaning and lookup cardinality under
+its law and data-quality rules. Evidence accepts only the closed outcomes
+`match`, `no_match`, and `ambiguous`. Only `match` may carry facts. A reviewed
+requirement derivation may apply a deterministic, versioned comparison between
+those facts and its authorized selectors. `ambiguous` never causes Evidence to
+choose a candidate, and neither failed outcome exposes candidates, scores,
+counts, or field-by-field diagnostics.
+
+This boundary follows the useful part of the current Notary consultation
+model: closed compiler-defined selector inputs, provider-owned cardinality,
+and no candidate selection. It does not import Notary, Relay, evidence-pack,
+PDP, or credential architecture into Evidence.
+
+#### Research basis
+
+The selector model is deliberately jurisdiction-neutral, but it reflects three
+useful findings:
+
+- OOTS sends an authenticated natural person's name and birth-date attributes
+  to the Data Service, may omit a destination-specific person identifier, lets
+  the Data Service apply national matching policy, and treats two or more
+  results as failure rather than selecting one.
+- UK GPG 45 models a claimed identity as a combination of attributes, commonly
+  name, date of birth, and address, and keeps identity checking and assurance
+  semantics distinct from the attribute data itself.
+- The reviewed OOTS-derived gap spec records that a person identifier may have
+  zero occurrences and that event evidence such as birth or marriage may need
+  multiple role-bound persons or an additional configured record discriminator.
+
+These references justify configurable compound selectors. They do not justify
+shipping EU or UK field names, assurance rules, fuzzy algorithms, or civil-event
+types in the Evidence core.
+
+### 8.4 Consent, statutory authority, and delegation
+
+Evidence consumes an authenticated authority context. Its basis may be statutory authority, organizational authority, consent, delegation, or an OOTS explicit request. A per-request grant reference is optional because statutory flows may derive authority from the requester and configured procedure. Evidence does not issue, manage, revoke, or infer that authority.
+
+Where the basis is delegation, version one carries the actor identity in that context and confines an actor-bearing request to authority paths declared `delegated`. It does not resolve a delegating principal, enforce call constraints, or consume an agent grant record; section 15.3 covers those.
+
+A caller-supplied consent or approval reference never creates authority by itself.
+
+### 8.5 Existence disclosure
+
+No-match, ambiguous-match, required-fact-missing, false, and source-unavailable
+states must not accidentally disclose registry membership through status
+codes, messages, or avoidable timing differences.
+
+If a procedure is entitled to learn that a record exists or does not exist,
+existence is modeled as a fixed, authorized concept. It is never an incidental
+error detail. By default, `no_match` and `ambiguous` collapse to the same safe
+public failure. The protected native audit may retain the closed `no_match` or
+`ambiguous` class for accountability, but never a count, candidate, score, or
+comparison diagnostic.
+
+## 9. Deployment bundle and source adapters
+
+Governed configuration, scripts, schemas, codelists, mappings, and fixtures form
+one atomic bundle. A separate closed runtime file owns only process-local
+listener, filesystem, audit-storage, secret-mount, and TLS-trust bindings. Both
+inputs are startup-only, read-only, independently digested, and immutable for
+the process lifetime. Runtime configuration is not an override layer and cannot
+change service identity, trust domain, authentication or authority policy,
+sources, requests, scripts, disclosure, rate limits, signing policy, or audit
+fail-closed behavior. Readiness fails if either input is incomplete,
+inconsistent, mutable, or cannot be validated.
+
+Illustrative YAML:
+
+```yaml
+version: 1
+
+service:
+  provider_id: urn:example:data-service:evidence
+
+signing:
+  format: jws-json
+  algorithm: EdDSA
+  key_ref: secret:evidence-signing-key
+  jwks_path: /.well-known/evidence/jwks.json
+
+issuer:
+  id: urn:example:authority:population-registry
+
+selector_profiles:
+  person-demographics-v1:
+    fields:
+      given_name: { type: string, maximum_bytes: 200 }
+      family_name: { type: string, maximum_bytes: 200 }
+      birth_date: { type: date }
+
+sources:
+  civil-registry:
+    transport: http-json
+    base_url: https://civil-registry.internal
+    posture: field-projected
+    tls_trust_profile: government-internal-pki
+    authentication:
+      kind: static-bearer
+      token_ref: secret:file/civil-registry-token
+    request:
+      method: POST
+      path: /v1/person-facts
+      fixed_headers:
+        - { name: Accept, value: application/json }
+      selector_inputs:
+        - role: subject
+          alternatives:
+            - profile: person-demographics-v1
+              fields: [given_name, family_name, birth_date]
+      prepare_script: adapters/civil-registry-prepare.rhai
+      adapter_parameters:
+        requested_fields: [date_of_birth]
+        result_limit: 2
+      adapter_parameters_schema: schemas/civil-registry-parameters.schema.yaml
+      preparation_limits:
+        query: forbidden
+        json_body: required
+      projection:
+        - /total
+        - /results/*/date_of_birth
+      redirects: deny
+      timeout: PT3S
+      maximum_response_bytes: 65536
+    response_schema: schemas/civil-registry-response.schema.yaml
+    extract_script: adapters/civil-registry-extract.rhai
+    fact_schema: schemas/civil-registry-facts.schema.yaml
+
+requirements:
+  - id: urn:example:requirement:adult-status:v1
+    kind: criterion
+    name: Adult status
+    source: civil-registry
+    purposes:
+      - benefit-eligibility
+    requester_tags:
+      - benefits-agency
+    audience_from: requester
+    subject_roles:
+      - role: subject
+        cardinality: one
+        selector_profiles:
+          - person-demographics-v1
+    reference_frameworks:
+      - urn:example:law:benefits-act
+    evidence_type: urn:example:evidence-type:adult-status:v1
+    observation_timezone: America/Santo_Domingo
+    validity: PT24H
+    derivation:
+      script: derivations/adult-status.rhai
+      parameters:
+        minimum_age_years: 18
+    concepts:
+      - id: urn:example:concept:adult-status
+        type: boolean
+        disclose: value
+```
+
+### 9.1 Fixed source execution with reviewed request rendering
+
+Rust owns scheme, host, method, the fixed path or closed selector-bound path
+template, permitted query and body channels, fixed headers, credentials, TLS
+trust, redirect policy, timeouts, response limits, concurrency limits, and the
+one-request ceiling.
+
+After authorization and durable access-attempt audit, Rust supplies only the
+source-required authorized selectors and closed non-secret parameters to a
+reviewed preparation script. The script renders ordered query pairs and at
+most one JSON body. It cannot choose the source, origin, path template or path
+binding, method, headers, credentials, redirects, retries, pagination
+traversal, or another request.
+Rust validates and encodes the complete result before credential acquisition.
+This is deterministic request rendering, not caller-supplied templating or
+dynamic source planning.
+
+After bounded JSON parsing, Rust applies the source's non-empty extended JSON
+Pointer projection before extraction. Unselected object keys are removed,
+array order and length are preserved, and missing leaves remain missing. The
+acquisition posture still describes the pre-projection wire response. Exact
+projection grammar and conflict rules are part of the reviewed adapter ABI.
+
+Rust then validates the projected tree against the source's required response
+schema, a closed JSON Schema in the same subset as the adapter-parameter and
+fact schemas. A response outside the shape the adapter was reviewed against is
+a source-protocol failure and no script runs, so hand-written protocol checking
+is not the only thing standing between a malformed response and fact
+construction. What stays with the script is what a shape cannot state, such as
+how a reported total agrees with the records returned and which values must
+agree with the closed adapter parameters.
+
+A Version 1 source must provide a bounded lookup that can establish zero, one,
+or multiple results from the configured selector. If an existing system cannot
+do that safely, a governed intermediary such as an existing integration layer
+may expose the bounded lookup. Evidence does not download a registry or a broad
+candidate set to compensate.
+
+The initial generic source-authentication profiles are HTTP Basic, static
+Bearer, static API-key header, and OAuth 2.0 client credentials. All values come
+from secret references. API-key header names are bundle-fixed and cannot
+override authorization, routing, framing, cookie, forwarding, proxy, or tracing
+headers. For OAuth, token acquisition is credential bootstrap rather than an
+evidence-data source call. Rust owns the fixed token endpoint, grant,
+credential placement, token lifetime handling, bounds, and redaction. Rhai sees
+neither the credential flow nor the resulting token.
+
+The explicit local assurance profile may additionally use `kind: none` for a
+source at one canonical numeric-loopback HTTP origin with an explicit non-zero
+port. Rust sends no authentication header in that mode. Production and
+evidence-grade bundles reject it, so this tutorial convenience is not an
+unauthenticated deployment profile.
+
+Bundle-fixed non-secret headers support media types, API versions, and tenant
+selectors without giving scripts header authority. A source may name a logical
+TLS trust profile whose private-CA file is bound by runtime configuration.
+Hostname verification and fixed-origin verification remain mandatory; there is
+no insecure or trust-all mode. Version 1 ignores ambient HTTP proxy environment
+variables and has no application-level proxy configuration.
+
+### 9.2 Rhai extraction and derivation
+
+Version one uses two small Rhai interfaces in the same process:
+
+```text
+prepare(source_required_selectors, adapter_parameters) -> RequestParts
+extract(source_response, adapter_parameters) -> LookupResult
+derive(facts, declared_authorized_selectors, evaluation_context)
+    -> array<DerivedConceptValue>
+```
+
+`LookupResult` is a closed tagged union:
+
+```text
+match(FactSet) | no_match | ambiguous
+```
+
+The source adapter maps a bounded provider response into that union. Facts are
+valid only on `match`; Rust rejects facts attached to another outcome, a match
+without the required facts, unknown outcomes, broad candidate arrays, scores,
+counts, or diagnostics. Derivation runs only for `match` and converts facts
+plus only the authorized selector roles and fields declared by the derivation
+into values for the concepts declared by the selected requirement. It may
+apply a reviewed deterministic
+relationship rule, such as exact membership of a stable candidate identifier
+in a complete authoritative parent set after exact returned-record binding to
+the authorized child selector. Scripts do not execute requests,
+authorize access, choose a disclosure profile, or construct Evidence.
+
+The immutable evaluation context contains only deterministic inputs owned by the trusted bundle and runtime:
+
+- observation instant;
+- legal local date and time resolved from the configured IANA timezone;
+- fixed, typed definition parameters;
+- bounded references to bundle codelists required by the derivation.
+
+Selectors are supplied as a separate explicit derivation argument and contain
+only the roles, profiles, and values already authorized for the selected
+requirement. The evaluation context contains no requester, actor, purpose,
+audience, authority grant, credential, source client, signing material, or
+audit handle. A requirement with different legal semantics uses a different
+versioned definition rather than branching on caller context.
+
+Rhai receives no ambient access to:
+
+- filesystem;
+- environment variables;
+- credentials;
+- network;
+- clock or randomness;
+- process execution;
+- application logging;
+- audit sinks;
+- signing keys.
+
+Scripts compile at startup and are identified by bundle hash. Each invocation receives fresh local state. Explicit limits apply to operations, call depth, strings, collections, modules, and result size.
+
+A future `plan(context) -> SourceCall` hook requires a separate design and a demonstrated source that cannot use a fixed request. It is not a hidden extension point in version one.
+
+### 9.3 Rhai primitives
+
+Rust supplies a small standard library of pure, deterministic, bounded primitives to Rhai. Initial primitives cover:
+
+- typed calendar dates, instants, and durations;
+- date and time comparison and calendar-safe arithmetic over runtime-supplied legal local values;
+- bounded numeric comparison and bucketing;
+- controlled-code and codelist lookup;
+- bounded list and set membership;
+- explicit missing-value handling.
+
+Primitive names and behavior are domain-neutral. Rust does not expose operations named `adult_status`, `age_at_least`, `licence_active`, or `legal_parent`. Country-specific and requirement-specific meaning stays in trusted Rhai, YAML parameters, reference-framework metadata, and fixtures.
+
+Primitives perform no I/O, authorization, logging, audit, signing, or response construction. New primitives require a generic need demonstrated by more than one definition shape, bounded behavior, and focused tests. Adding a new evidence definition should normally require no Rust change.
+
+### 9.4 Output validation
+
+Rust accepts a derivation result only when its concept identifiers exactly match the selected requirement's permitted output set and every value satisfies its declared type, codelist, cardinality, and size. Arbitrary JSON objects and undeclared metadata are rejected.
+
+This makes the trusted bundle responsible for domain semantics while keeping
+disclosure enforcement in the core. A trusted script can still be semantically
+wrong, so production and evidence-grade requirements carry positive, negative,
+boundary, missing-data, and anti-reconstruction fixtures that run before
+readiness. The explicit local authoring profile may omit a fixture reference;
+it retains the real authenticated, bounded-source, signed, and audited runtime
+and marks every result as local.
+
+### 9.5 Source compatibility contract
+
+The source layer is accepted only when the same core passes all three reference
+shapes described in section 5.7. The contract suite verifies:
+
+- exact Rust-owned method, URL, selector, projection, headers, body, timeout,
+  redirect, and response-size behavior;
+- authentication injection without exposing credentials to YAML values, Rhai,
+  logs, audit, errors, or test output;
+- zero, one, and multiple-match behavior without an unintended existence
+  oracle;
+- identifier selectors, compound selectors without an identifier, and
+  multi-role selectors using deployment-defined field names;
+- flat objects, nested attribute arrays, pagination metadata, event-index
+  declarations, provider error envelopes, and missing or malformed facts;
+- safe handling of `401`, `403`, `429`, `5xx`, timeout, redirect, invalid JSON,
+  wrong media type, and oversized responses;
+- no change to the Evidence API, model, evaluator, signing, or audit path when
+  the source shape changes.
+
+Compatibility fixtures are hand-authored from public API documentation and use
+invented subjects and values. Live responses, public-demo subject identifiers,
+credentials, and tokens are never committed. The detailed mock and optional
+live-smoke rules are in [SOURCE-TESTING.md](SOURCE-TESTING.md).
+
+No source-product test profile creates a production module, type, enum variant,
+feature flag, dependency, configuration field, route, CLI option, or branch.
+Provider request and response variants remain ordinary bounded JSON rather than
+runtime subsystems.
+
+The executor prefers count plus one minimized result when a provider supports
+it. Otherwise it may request at most two minimally projected results so the
+adapter can distinguish a unique match from ambiguity. It never follows pages
+or performs broad candidate retrieval. Rhai must return `ambiguous` when two
+results are present and cannot compare them to choose one.
+
+## 10. Policy model
+
+Version one has no policy language and no policy-engine abstraction.
+
+YAML declares:
+
+- permitted purposes;
+- requester identities or tags;
+- subject roles, selector profiles, and value origins;
+- audience derivation;
+- requirement revisions;
+- Evidence Types;
+- disclosure forms;
+- validity rules.
+
+Rust evaluates these declarations with fail-closed semantics. Requirement-specific Rhai derivation is not policy execution: it receives no requester or authority context and cannot alter authorization, disclosure shape, subject binding, audience, or evidence construction. Rego or a separate Rhai policy interface may be reconsidered only when a concrete deployment rule cannot be expressed without changing Rust. That future decision must not weaken the fixed requirement and core-owned validation and projection boundaries.
+
+## 11. Native JSON API
+
+Version one exposes one evidence operation:
+
+```text
+POST /v1/evidence
+```
+
+Illustrative request:
+
+```json
+{
+  "requestNonce": "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I",
+  "requirement": "urn:example:requirement:adult-status:v1",
+  "purpose": "benefit-eligibility",
+  "subjects": [
+    {
+      "role": "subject",
+      "selector": {
+        "profile": "person-demographics-v1",
+        "values": {
+          "given_name": "Amina",
+          "family_name": "Diallo",
+          "birth_date": "1984-02-10"
+        }
+      }
+    }
+  ]
+}
+```
+
+`requestNonce` is the required canonical unpadded base64url encoding of exactly
+32 independently generated random bytes, represented as exactly 43 ASCII
+characters. It is echoed into Evidence for request-response correlation and
+challenge-style transaction binding when a verifier supplies the independently
+retained expected value. The runtime does not store it, reject reuse, or claim
+one-time use, same-transaction replay prevention, presenter binding, or
+server-observed uniqueness. The nonce is not part of the stable subject binding
+and is absent from authorization, rate-limit labels, Rhai, source requests,
+audit, logs, metrics, and traces. Callers must not encode identifiers,
+selectors, secrets, or document digests into this uninterpreted random value.
+
+The request selects a configured purpose and selector profile. It supplies
+selector values only where the active authority profile permits caller
+selection. A context-derived selector uses the same profile but omits `values`;
+Rust obtains them from the authenticated context or grant. Request fields do
+not create authority. Audience derives from the authenticated context.
+
+`subjects` is an unordered set encoded as a JSON array. Each role must appear
+exactly once with the configured profile. Rust resolves entries by role,
+rejects duplicate, missing, unknown, or wrong-profile roles, and constructs its
+internal and evidence subject arrays in the requirement's declaration order.
+Callers do not need to reproduce bundle order.
+
+The schema for `values` is closed by the named profile. The example names are
+ordinary bounded strings and the date is a typed full date. Rust attaches no
+universal meaning to those field names and does not normalize or compare their
+contents. A reviewed derivation may compare only the selector roles and fields
+explicitly declared by that requirement.
+
+Missing `Accept`, `Accept: */*`, or exact `Accept: application/jose+json`
+selects the default flattened JWS JSON Serialization. Exact
+`Accept: application/vnd.registrystack.evidence-unsigned+json` selects unsigned
+JSON only when the immutable bundle enables it and the complete matched
+authority grant permits it.
+Duplicate, combined, parameterized, weighted, or unknown negotiation returns
+`406 Not Acceptable` before source access. Every response varies on `Accept`
+and remains `no-store`.
+
+The following is the decoded JWS payload and the nested Evidence object used by
+the unsigned envelope:
+
+```json
+{
+  "schema": "registry.assertion-evidence/v1",
+  "requestNonce": "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I",
+  "id": "urn:ulid:01K1EXAMPLE0000000000000000",
+  "type": "Evidence",
+  "supportsRequirement": "urn:example:requirement:adult-status:v1",
+  "isConformantTo": "urn:example:evidence-type:adult-status:v1",
+  "issuedBy": "urn:example:authority:population-registry",
+  "providedBy": "urn:example:data-service:evidence",
+  "issuedAt": "2026-08-02T12:00:00Z",
+  "observedAt": "2026-08-02T12:00:00Z",
+  "validUntil": "2026-08-03T12:00:00Z",
+  "purpose": "benefit-eligibility",
+  "audience": "urn:example:agency:benefits",
+  "configurationRevision": "sha256:bundle-digest",
+  "subjects": [
+    {
+      "role": "subject",
+      "binding": "audience-scoped-subject-binding"
+    }
+  ],
+  "supportedValues": [
+    {
+      "providesValueFor": "urn:example:concept:adult-status",
+      "value": true
+    }
+  ]
+}
+```
+
+The JWS object contains `protected`, `payload`, and `signature` members. `payload` is the base64url encoding of the exact UTF-8 JSON evidence bytes. This avoids a separate JSON canonicalization contract and does not duplicate the evidence object beside its signature.
+
+The unsigned success is deliberately distinct:
+
+```json
+{
+  "schema": "registry.unsigned-evidence-envelope/v1",
+  "type": "UnsignedEvidenceEnvelope",
+  "integrityProtection": "none",
+  "warning": "not-cryptographically-verifiable",
+  "evidence": {
+    "schema": "registry.assertion-evidence/v1",
+    "requestNonce": "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I",
+    "type": "Evidence"
+  }
+}
+```
+
+The nested object is complete on the wire; it is abbreviated above. The fixed
+outer schema and markers ensure stored unsigned output does not claim a JWS
+proof. The JWS verifier rejects this representation. A separate unsigned parser
+may check schema and policy but returns an explicitly unverified result. Version
+one never uses JWS `alg: none`, an empty signature, or a JWS-shaped unsigned
+object.
+
+### 11.1 Response integrity and verification
+
+Every deployment supports signed JWS and uses it by default. Unsigned JSON is a
+separately governed response format selected only by exact API media
+negotiation and permitted by both the bundle and matched authority grant.
+Runtime configuration cannot enable it. A signed request never falls back to
+unsigned output after a signing, key, serialization, audit, or dependency
+failure.
+
+The protected JWS header contains an allowlisted `alg`, a required `kid`, a media-type identifier, and the payload content type. Version one starts with one configured active signing key and publishes its public key through `/.well-known/evidence/jwks.json`. Retired public keys remain available for at least the maximum assertion validity plus allowed clock skew. Private key material is resolved through a secret or signing-provider reference and never appears in YAML, Rhai, logs, audit, or public errors.
+
+The published JWKS is key discovery, not a trust anchor. A verifier obtains the provider identity and JWKS location through trusted deployment configuration or governed metadata, then allowlists the algorithm and resolves `kid` only within that trusted key set. It never follows a message-provided `jku`, `x5u`, or equivalent remote key URL.
+
+The signature covers the request nonce, issuer, technical provider, Evidence
+Type, requirement revision, purpose, audience, role-bound subjects, Supported
+Values, bundle revision, evidence identifier, and all observation and validity
+times because those fields are inside the payload.
+
+Verification proves that the technical provider controlling the referenced key signed the exact payload. It does not by itself prove the source fact is true, confer legal notarization, create a qualified electronic signature, or turn the assertion into a holder credential. Governance must establish that the technical provider is authorized to produce evidence for the named legal issuer.
+
+Signing occurs after core-owned projection. For JWS, Rust signs and serializes
+the final immutable response bytes. For unsigned output, Rust constructs and
+serializes the final immutable envelope bytes. The fail-closed
+disclosure-release audit is durably accepted only after that serialization and
+before those exact bytes are returned. The audit records the closed response
+protection mode and records a signing key id only for JWS. Signing-key absence
+makes readiness fail for every deployment. A runtime signing failure returns
+`503 Service Unavailable`; it never downgrades to unsigned evidence.
+
+Strict signed verification checks the trusted key and exact payload, the
+expected issuer, provider, requirement, Evidence Type, purpose, audience,
+configuration revision, validity interval, request nonce, expected role-bound
+opaque subject bindings, and the expected concept identifiers, value forms,
+and cardinalities. Expectations come from the relying procedure, previously
+trusted bindings, or a trusted requirement contract, never by copying values
+from the JWS being checked. A relying party that needs later verification
+retains those expectations and its trusted key snapshot with the exact JWS.
+Cryptographic authenticity remains distinguishable from current validity after
+the assertion expires.
+
+Version one does not add nonce storage. The echoed request nonce proves
+correlation with a request retained by the relying party, not freshness,
+single use, or replay prevention. An assertion is a time-bounded statement for
+a named audience, not a one-time authorization token. A consumer that treats
+an assertion as authorization for a non-repeatable action owns that action's
+replay control until a separate transaction-bound profile is defined.
+
+### 11.2 Relationship assertion example
+
+A legal-parent confirmation uses the same operation and model:
+
+```json
+{
+  "requestNonce": "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I",
+  "requirement": "urn:example:requirement:confirm-legal-parentage:v1",
+  "purpose": "school-enrolment",
+  "subjects": [
+    {
+      "role": "child",
+      "selector": {
+        "profile": "civil-record-reference-v1",
+        "values": {
+          "record_reference": "opaque-child-reference"
+        }
+      }
+    },
+    {
+      "role": "candidate-parent",
+      "selector": {
+        "profile": "person-demographics-v1",
+        "values": {
+          "given_name": "Binta",
+          "family_name": "Diallo",
+          "birth_date": "1960-06-15"
+        }
+      }
+    }
+  ]
+}
+```
+
+The response binds both roles and returns only
+`legal-parent-relationship-confirmed: true|false`. It does not return selector
+profiles or values, a birth certificate, names, dates of birth, addresses, or
+unrelated family relationships. An audience-scoped subject binding is derived
+over the complete canonical role and selector bundle, not separate hashes of
+low-entropy fields. It is a request-binding handle, not a public identifier or
+an assertion that the selectors are globally unique.
+
+### 11.3 Failure semantics
+
+Public failures use stable problem codes and safe descriptions. Source responses, selectors, policy inputs, script data, and protected values are never reflected into error bodies.
+
+Transient dependency failure returns `503 Service Unavailable` and may include `Retry-After`. Version one has no job queue or generic asynchronous state.
+
+`no_match`, `ambiguous`, and fact-missing behavior follows the requirement's
+reviewed existence-disclosure rule. The safe default makes `no_match` and
+`ambiguous` publicly indistinguishable. False evidence after a unique match is
+a successful assertion, not an error.
+
+### 11.4 Operational endpoints
+
+```text
+GET /v1/evidence-definitions
+GET /health
+GET /ready
+GET /.well-known/evidence/jwks.json
+```
+
+Readiness confirms that the governed bundle compiled, the runtime file and every
+logical path/trust binding validated, required credentials and signing material
+are available, the audit sink accepts writes, and required source dependencies
+satisfy the deployment posture.
+
+### 11.5 Offline authoring
+
+```text
+evidence check
+evidence evaluate --fixture <path>
+```
+
+Before production or evidence-grade use, every requirement ships with positive,
+negative, missing-data, source-failure, existence-disclosure, and
+anti-reconstruction fixtures. Offline evaluation does not require a running
+server or source network.
+
+### 11.6 Discovery and publication
+
+The set of definitions a requester may use is the intersection of the exact
+deployed bundle revision and the caller's verified authority context. It
+depends on requirement, purpose, audience, the complete role/profile/origin
+tuple, and any token-owned selector values together. A process-wide catalog
+would overstate availability and reveal definitions or selector structure that
+another requester is not entitled to know.
+
+`GET /v1/evidence-definitions` authenticates the caller and returns only
+complete request shapes that match exactly one authority path. Each item
+contains bundle revision, issuer, provider, requirement, Evidence Type,
+purpose, reference frameworks, output concepts and forms, complete subject
+roles, selector profiles, value origins, and safe selector field types and
+bounds. Controlled-code fields expose the governed scheme identity and
+version, never the configured code values. A client selects one whole item; it
+must not form a request by combining metadata across items.
+
+An unentitled caller receives an empty list. A shape whose authority decision
+is ambiguous is omitted because the corresponding evidence request would be
+denied. A shape depending on missing or invalid authenticated-context or grant
+selector material is also omitted. Discovery uses the ordinary
+per-principal request-rate budget but performs no source credential resolution,
+provider access, signing, or evidence-data audit write.
+
+The response must omit source origins and identifiers, paths, projections,
+scripts, adapter parameters, secret references, internal requester tags,
+authority-profile identifiers, selector values, codelist values, unrelated
+definitions, and every other bundle field not on its explicit allowlist.
+Possessing discovery metadata, a requirement identifier, or selector values
+never creates authority. `POST /v1/evidence` authenticates and authorizes the
+complete tuple again.
+
+The generated OpenAPI describes both operations. Operators separately publish
+static onboarding material for token acquisition, human labels, procedural and
+legal context, endpoint trust, and verifier policy through an existing API
+catalog, developer portal, configuration repository, or bilateral process.
+The JWKS endpoint publishes verification keys only. Version one has no public,
+cross-requester, searchable, mutable, or federated definition catalog and no
+registration editor or `describe` CLI command.
+
+## 12. Audit and operational logging
+
+Operational logs describe service health and performance. They may contain:
+
+- route template;
+- operation identifier;
+- duration;
+- status category;
+- safe internal error category.
+
+They must not contain request bodies, selector profiles or values, source
+responses, Supported Values, credentials, tokens, authority grants, or Rhai
+inputs.
+
+Audit records establish accountable access. Reusable platform primitives may provide tamper-evident envelopes, keyed pseudonymization, redaction helpers, sinks, and chain verification.
+
+The audit event contains only reviewed fields:
+
+- operation identifier and phase;
+- requirement and bundle revision;
+- purpose code;
+- pseudonymized requester and optional actor;
+- selector profile identifiers and one pseudonymized complete selector bundle
+  per role, only where correlation is required;
+- authority type and optional pseudonymized grant reference;
+- source and adapter identifiers;
+- decision code;
+- disclosed concept identifiers, never values;
+- evidence identifier and signing key identifier on release;
+- timing and safe error category.
+
+Audit pseudonyms use keyed, domain-separated hashing with separate requester,
+actor, authority, and subject domains. A subject pseudonym covers the canonical
+role, selector-profile id, ordered field names, and complete value bundle. The
+native audit never stores raw selector values or separate hashes for names,
+dates of birth, addresses, identifiers, or other low-entropy fields. Scoping
+prevents unnecessary cross-purpose linking and includes a key version for
+controlled rotation. Plain hashes and globally stable subject pseudonyms are
+prohibited.
+
+Two writes are fail-closed:
+
+1. The access-attempt event must be durably accepted before the first source read.
+2. The disclosure-release event must be durably accepted after final response
+   serialization and before those exact bytes are released.
+
+Denial and transient-failure events are attempted without reflecting protected inputs once authorization has produced the privacy-safe audit material required by the native schema. Authentication failures, unmatched-authority failures, and invalid-selector failures happen before a complete authorized authority and selector bundle exist; the core does not fabricate a native event from that untrusted or protected request material. A deployment-specific compliance profile may require separate edge telemetry, more reviewed metadata, or retention, but it cannot silently change the native privacy contract.
+
+## 13. Trust and privacy invariants
+
+Version one must preserve these invariants:
+
+1. Only predefined, versioned requirements can be evaluated.
+2. Callers cannot provide thresholds, expressions, scripts, JSON paths, source fields, relationship types, or response projections.
+3. The complete enabled bundle is reviewed as one disclosure surface.
+4. Authentication derives principals and attributes only from configured validated sources; missing data denies.
+5. One authorization decision binds requester, optional actor, requirement revision, purpose, selector profile and value origin for every subject role, subject authority, and audience.
+6. Selector profiles and values are provider-lookup inputs, never proof of authority.
+7. Caller-provided consent, approval, or grant references never create authority.
+8. Callers cannot choose selector field names, operators, weights, thresholds, normalization, or query plans.
+9. Source calls are fixed by trusted configuration and executed only by Rust.
+10. Provider lookup has only `match`, `no_match`, and `ambiguous`; Evidence never returns or chooses candidates.
+11. Rhai returns one closed lookup result and declared typed concept values only.
+12. Rust rejects undeclared concept identifiers, extra fields, and values that violate configured types, codelists, cardinalities, or sizes.
+13. Missing facts, undefined decisions, script failures, audit failures, and evaluation failures deny or return a safe transient failure.
+14. Raw source responses are never persisted or logged.
+15. No selector value, source value, or disclosed value appears in operational logs or native audit records.
+16. No-match and ambiguous behavior cannot accidentally disclose registry membership.
+17. Subject bindings are scoped to the intended audience and do not create globally linkable identifiers.
+18. Configuration is immutable for the lifetime of a serving process.
+19. One process serves one operator-controlled trust domain.
+20. Rate controls are defense in depth and never substitute for safe concept design or authorization.
+21. Signed flattened JWS over the exact Evidence payload is mandatory,
+    available to every authorized grant, and the default response. Unsigned
+    output is available only through its exact media type when both the
+    immutable bundle and complete matched grant permit it.
+22. Missing or failed signing never falls back to an unsigned response.
+23. Private signing-key material is core-owned and is never exposed to deployment-bundle values, Rhai, logs, audit, or errors.
+24. A signature authenticates the technical provider and payload integrity; it does not silently assert legal-signature status or source truth.
+25. Public evidence is constructed only by the core after derivation output passes the complete requirement contract.
+26. Every request carries one exact 32-byte random nonce that is echoed into
+    Evidence but never stored or exposed to scripts, sources, diagnostics, or
+    native audit.
+27. Strict signed verification compares the nonce, subjects, and output
+    contract against independent trusted expectations, not values copied from
+    the assertion under verification.
+28. Unsigned output is a separately typed, visibly unprotected envelope that
+    cannot enter the signed-verification path or claim later verifiability.
+29. Final immutable response bytes exist before the disclosure-release audit
+    is durably accepted and are the exact bytes released afterward.
+
+## 14. Complementary deployment patterns
+
+### Standalone
+
+Evidence exposes HTTPS directly using one supported authentication profile and a configured durable audit sink. Production exposure includes per-principal rate controls.
+
+### WSO2 or another API gateway
+
+The gateway manages API publication, authentication protocol integration, rate controls, and routing. Evidence independently validates the configured identity context and enforces requirement, purpose, subject-authority, and disclosure rules.
+
+### X-Road
+
+Evidence is exposed behind a provider Security Server or calls a source through X-Road. X-Road provides trusted exchange and transaction protections. Evidence remains responsible for deriving, protecting, and releasing the minimized assertion.
+
+### OpenFn
+
+An OpenFn workflow calls Evidence as one atomic step and routes the minimized result. Evidence does not absorb workflow branching, business retries, or destination writes.
+
+## 15. Future profiles and guarded extensions
+
+The following capabilities require separate profiles or design decisions. They are not latent version-one features.
+
+### 15.1 OOTS assertion-evidence profile
+
+Evidence may implement all or part of a Data Service operated by an Evidence Provider. The competent authority remains legally responsible for the derived evidence. Creator, issuing authority, technical provider, and cryptographic signer remain explicit roles.
+
+Each minimized assertion used through OOTS is governed as an Evidence Type in its own right. It must be mapped by the Evidence Broker to the applicable requirement and exposed by the DSD as a Data Service Evidence Type. An adult-status assertion is not silently reclassified as a birth certificate.
+
+OOTS may carry Evidence assertion JSON as the main evidence attachment when `application/json` is registered for the selected Data Service Evidence Type. When `sdg:ConformsTo` is present, it identifies the applicable OOTS Semantic Repository data model.
+
+The boundary receives RegRep XML together with authenticated AS4 message context. It validates official XSD, Schematron, codelists, and profile rules, then maps to the canonical request. Existing Evidence Broker, DSD, Semantic Repository, Preview Space, and AS4 Access Point infrastructure remains external.
+
+OOTS uses a separate audit and retention profile. Its legal logging and non-repudiation obligations do not silently change native audit behavior.
+
+Traditional document evidence, MIME attachments containing certificates, translations, and annexes remain a later document-evidence profile.
+
+### 15.2 Transaction-bound use profile
+
+Core JWS signing plus the caller nonce supports integrity and limited
+transaction binding when the named audience independently retains and checks
+its challenge during the assertion's validity period. It does not make an
+assertion single-use, bind a holder or presenter, prove that the server has not
+seen the nonce before, or prevent reuse with the same expected nonce.
+
+A later transaction-bound profile may add server-issued challenges, one-time
+consumption, holder or presenter binding, and replay state when a concrete
+relying-party action requires them. Those semantics are designed together and
+do not alter ordinary assertions by default. No bespoke signature or challenge
+format is introduced.
+
+### 15.3 Delegated-agent profile
+
+An AI agent is an authenticated workload actor operating under an external authority grant. The grant binds:
+
+- delegating principal;
+- agent workload identity;
+- fixed requirement;
+- purpose;
+- subject authority;
+- audience;
+- validity and call constraints.
+
+The agent invokes fixed operations such as `getAdultStatus` or `confirmLegalParentage`. It cannot submit a free-form evidence query. Prompt text, conversation history, model names, and agent reasoning never enter Evidence or audit.
+
+An MCP or other tool facade may compile static tool descriptions from the trusted bundle and call the JSON API. It remains outside the core. Direct delivery to the relying party may allow the agent to receive only a receipt rather than the assertion value.
+
+### 15.4 Document evidence
+
+A later document profile may retrieve and transiently deliver an existing official artifact. It does not make Evidence a document repository or certificate generator. Multipart responses, artifact integrity, supplementary documents, and retention require a separate design.
+
+### 15.5 Dynamic source planning and policy
+
+Version one includes deterministic rendering of query pairs and one JSON body
+under a Rust-fixed transport plan. Script-selected sources, URLs, methods,
+headers, credentials, retries, pagination traversal, response-led requests,
+multi-call orchestration, and a richer policy language remain separate
+proposals. None is added merely as an extension seam.
+
+### 15.6 Audience-scoped SD-JWT VC response format
+
+This profile adds one additional response format for the assertion Version one
+already produces. It does not add a credential product, a credential lifecycle,
+or an issuance protocol.
+
+The distinction the profile rests on: SD-JWT VC is a *serialization*, while
+OID4VCI is a *delivery protocol*. The serialization is a pure function of an
+already-constructed assertion. The delivery protocol requires credential
+offers, pre-authorized codes, issuer-held nonces, deferred issuance, and the
+persistent state to hold them. Version one's stateless single-process property
+is load-bearing for its security argument, so this profile takes the
+serialization and refuses the protocol.
+
+#### What the profile adds
+
+A third member of the closed response-format vocabulary, selected by the exact
+`application/dc+sd-jwt` media type, permitted only when the immutable bundle
+and the one complete matched authority grant both allow it. Format selection
+creates no permission. Everything before serialization is unchanged: the same
+authorization decision, the same fixed source execution, the same bounded
+derivation, the same output validation, the same audience-scoped subject
+binding, the same durable access and disclosure-release audit ordering.
+
+The assertion is emitted as an IETF SD-JWT VC: an EdDSA-signed JWT carrying
+`_sd` digests, followed by the salted disclosures. The signing key, key
+identifier, JWKS publication, and rotation rules are exactly those of the
+signed-JWS format. No second key and no second key ceremony are introduced.
+
+An optional caller-supplied holder public key becomes the `cnf` claim, so the
+assertion can be presented later with key binding. Evidence issues; it does not
+receive, validate, or reason about presentations. Key-binding JWT validation is
+the relying party's responsibility.
+
+#### The trusted third party
+
+A third party triggering issuance is not a new trust model. It is the
+authenticated authority context of section 8.1 with a grant reference under
+section 8.4, which already admits statutory, organizational, consent, and
+delegated bases. The triggering party authenticates as itself, its grant names
+the requirement, purpose, audience, and subject authority, and the holder key
+travels in the request. Evidence still makes exactly one authorization
+decision and still does not issue, manage, revoke, or infer authority.
+
+#### The subject stays audience-scoped
+
+`sub` is the existing audience-scoped subject binding of section 8.3. The
+credential is therefore meaningful to the relying party named in `audience` and
+to no other. This is a deliberate limit, not an omission: a holder-scoped
+subject identifier would create a correlatable identifier that survives across
+verifiers, which is the property section 13 exists to prevent. A multi-verifier
+holder credential is a separate profile with its own privacy analysis, not an
+increment on this one.
+
+The consequence must be stated plainly in adopter-facing material. This profile
+produces a standards-conformant SD-JWT VC that a wallet can parse, hold, and
+present. It does not produce a credential that is meaningful to an arbitrary
+verifier.
+
+#### Profile non-goals
+
+None of the following is added, stubbed, flagged, or left as a seam:
+
+- OID4VCI in any part: credential offers, pre-authorized codes, authorization
+  or token endpoints, `c_nonce`, proof-of-possession challenges, credential
+  endpoints, or deferred issuance;
+- persistent issuance state, an application database, or any store beyond the
+  existing stateless request-nonce echo;
+- status lists, revocation, suspension, or a credential-status endpoint;
+  freshness remains expiry through `validUntil`;
+- presentation-side verification or key-binding JWT validation. The relying
+  party verifier this product already ships is extended to the second format,
+  and it checks exactly what it checks for the signed JWS: issuer authenticity
+  against a pinned key set, and the output contract. It never evaluates a
+  presentation, a key-binding JWT, or a holder's possession of the confirmed
+  key;
+- wallet onboarding, wallet attestation, or trust-list membership;
+- a second signing key, algorithm, or key ceremony;
+- holder-scoped or otherwise cross-verifier subject identifiers;
+- reissuance, refresh, batch issuance, or credential identifiers that persist
+  beyond the response.
+
+#### Claims that remain out of the credential
+
+Selector profiles, selector values, source identity, source responses, adapter
+identity, grant identifiers, and requester identity never appear in the
+credential, in a disclosure, or in credential-visible metadata. The disclosure
+set is exactly the assertion's supported values. Everything the payload of the
+signed-JWS format withholds, this format withholds identically.
+
+## 16. Initial assertion cases
+
+### Adult status
+
+Input fact: date of birth or source-derived adult status.
+Output: boolean.
+Purpose: prove unary minimum disclosure, calendar arithmetic, and legal-time
+boundaries.
+Primary risk: threshold reconstruction and date-boundary errors.
+
+### Residence region
+
+Input fact: official residence code or bounded address field.
+Output: controlled administrative-region code.
+Purpose: prove code mapping and geographic coarsening.
+Primary risk: overly precise disclosure and unversioned mapping tables.
+
+### Professional licence status
+
+Input facts: licence state and validity dates.
+Output: active boolean and controlled expiry bucket.
+Purpose: prove multiple concepts and time bucketing.
+Primary risk: disclosure of exact dates or licence history.
+
+### Legal-parent relationship
+
+Input roles: child and candidate parent.
+Output: legal-parent-relationship-confirmed boolean.
+Purpose: prove multi-subject, role-bound assertions.
+Primary risk: subject substitution, relationship ambiguity, and family-graph disclosure.
+
+All four cases are mandatory full-path acceptance definitions. Each passes
+offline evaluation and the production HTTP path, including authentication,
+authorization, response-format permission, source access, access audit, output
+gating, evidence construction, signed and explicitly permitted unsigned
+response paths, release audit, and verification. The public contracts do not
+freeze until all four pass together. None becomes a Rust domain type, built-in
+derivation, special route, or preferred implementation order.
+
+## 17. Version-one release scope
+
+Version one is one synchronous assertion service with signed JWS as the
+mandatory default and includes:
+
+- one `registry-evidence` crate, one `evidence` binary, and one serving process;
+- one operator-controlled trust domain;
+- all four initial assertion cases as complete test-only acceptance bundles;
+- conformance fixtures for every Version 1 Supported Value form;
+- multiple enabled evidence definitions in one process;
+- one generic fixed HTTP JSON evidence-data request executor;
+- generic Basic, static Bearer, static API-key header, and OAuth 2.0
+  client-credentials source authentication using secret references;
+- credential-free source access only for explicit local authoring at a
+  canonical numeric-loopback HTTP origin;
+- fixed non-secret request headers, Rust-owned selector-bound path templates,
+  and logical private-CA trust profiles without script transport authority;
+- explicit `source-derived`, `field-projected`, and `record-transformed`
+  acquisition postures with no overclaiming of minimization;
+- one strict OIDC access-token reference profile;
+- one reviewed statutory-agency subject-authority profile;
+- configured identifier, compound demographic, and multi-role selector profiles
+  with provider-owned `match`, `no_match`, and `ambiguous` outcomes;
+- bounded Rhai extraction and requirement-specific derivation;
+- generic Rust-provided date, time, codelist, numeric, and collection primitives;
+- Rust-owned validation of derived values, evidence construction, and projection;
+- authenticated `GET /v1/evidence-definitions` requester-scoped discovery and
+  one `POST /v1/evidence` assertion operation with a required fixed-size
+  request nonce;
+- one active EdDSA reference signing key, default flattened JWS JSON responses,
+  a governed explicitly selected unsigned envelope, and a public JWKS endpoint;
+- keyed JSONL audit on explicitly durable storage, fail-closed before source access and before release;
+- offline bundle checking and fixture evaluation;
+- adopter tooling that starts an incomplete local authoring project, compiles
+  one explicit production target into a create-only candidate, and delegates
+  bundle checking and fixture evaluation to the real `evidence` binary;
+- per-question governance metadata and one sanitized fixture required for a
+  production build, without a new runtime configuration schema or evaluator;
+- a target-host handoff in which operators independently provision secrets,
+  run `doctor`, fixture evaluation, startup, retained-response verification,
+  and audit-chain verification;
+- Registry Mint as an optional separately authored issuer, with only a
+  read-only mechanical Evidence/Mint compatibility check;
+- a documented Docker Compose adapter that mounts the candidate bundle
+  unchanged without generating Compose, container, or cloud deployment output;
+- deterministic source-contract mocks for flat REST, DHIS2 Tracker-style REST,
+  and OpenCRVS Version 2 Event Search-style JSON;
+- generated JSON Schema and OpenAPI artifacts;
+- focused authorization, minimization, existence, isolation, signing-failure,
+  signature-verification, codelist, multi-concept, multi-subject, and
+  date-boundary tests.
+
+It does not include:
+
+- public, cross-requester, searchable, mutable, or federated catalog endpoints;
+- nonce or replay storage beyond stateless request-nonce echo and comparison;
+- holder credentials, server-issued challenge flows, one-time consumption, or
+  presenter binding;
+- evidence retention;
+- a policy engine;
+- document evidence;
+- OOTS runtime types;
+- multi-source fulfillment;
+- source-planning scripts;
+- conversion of `.evidence/dev` local state into production inputs;
+- generated production secrets, callers, approval, promotion, deployment, or
+  remote mutation commands;
+- target overlays, inheritance, templating, shared defaults, or secret
+  expansion;
+- generated Compose, Kubernetes, Helm, Terraform, cloud-specific, or other
+  orchestrator manifests;
+- application-level or ambient-environment HTTP proxy routing;
+- federation;
+- runtime configuration mutation;
+- an application database unless the selected audit sink requires an external durable service.
+
+## 18. Delivery sequence
+
+`IMPLEMENTATION.md` owns the detailed phase exit gates and Definition of Done.
+The complete Version 1 sequence is:
+
+### Phase 0: freeze contracts, acceptance definitions, and DoD
+
+- Review and accept this concept note.
+- Define the CCCEV-to-JSON mapping.
+- Define the governed-bundle and runtime YAML schemas, selector-profile
+  contract, ownership split, and atomic bundle layout.
+- Define the closed lookup-result and derivation Rhai ABIs.
+- Define the initial domain-neutral primitive set and its resource bounds.
+- Define the normalized authority context.
+- Define the flattened JWS profile, signer identity, key discovery, rotation, and verifier rules.
+- Create golden fixtures for boolean, code, category, and role-bound relationship assertions.
+- Define negative fixtures for bundle-level inference and existence disclosure.
+- Define the three source-shape compatibility mocks and their exact request,
+  authentication, cardinality, and failure expectations.
+- Define identifier-only, compound no-identifier, additional-disambiguator,
+  and multi-role selector fixtures with authorization and redaction
+  expectations.
+- Define all four initial assertion cases before production architecture is
+  written.
+- Map each security invariant to a threat, enforcement point, and negative
+  test.
+
+### Phase 1: generic offline kernel
+
+- Parse and validate the bundle.
+- Compile the source-adapter and requirement-derivation Rhai scripts.
+- Validate selector profiles and map source fixtures to closed lookup outcomes.
+- Run all four initial assertion cases through the same evaluator.
+- Reject undeclared, mistyped, oversized, or incomplete concept values before evidence construction.
+- Construct deterministic JSON evidence and sign it with a fixture key.
+- Verify that payload or protected-header modification invalidates the signature.
+- Prove that raw source facts cannot enter evidence, logs, audit, or errors.
+
+### Phase 2: generic source boundary
+
+- Add fixed HTTP JSON source execution, fixed headers, selector-bound path
+  templates, private-CA trust profiles, and generic Basic, static Bearer,
+  static API-key header, and OAuth 2.0 client-credentials authentication.
+- Run flat REST, paged nested REST, and OpenCRVS Event Search-shaped contracts
+  through one source executor.
+- Prove the selector matrix, zero, one, and multiple lookup outcomes, and no
+  broad candidate retrieval or candidate choice.
+- Prove at least one definition can change source shapes using YAML and Rhai
+  only.
+- Reject DHIS2 or OpenCRVS code, dependencies, features, or public contract
+  variants outside test and fixture paths.
+
+### Phase 3: trust, authorization, audit, and signing
+
+- Add the selected authentication profile.
+- Add selector value-origin, subject-authority, and authorization enforcement.
+- Add production signing-key resolution, fail-closed signing, and public JWKS publication.
+- Add durable audit before source access and before release.
+- Run all four cases through every trust boundary.
+
+### Phase 4: native HTTP service and operations
+
+- Add the evidence and operational endpoints, limits, safe errors, readiness,
+  rate controls, and generated public contracts.
+- Run all four cases through the real router while multiple definitions are
+  enabled in one process.
+
+### Phase 5: privacy, isolation, and schema freeze
+
+- Prove minimization, selector confidentiality, no-match and ambiguity
+  behavior, combined disclosure safety, cross-definition isolation, failure
+  closure, and signature verification.
+- Attempt optional read-only public-demo smoke tests after deterministic mocks.
+- Freeze Version 1 schemas only when the complete acceptance set passes.
+
+### Phase 6: runtime release readiness
+
+- Complete operator and verifier guidance and all applicable package,
+  contract, dependency, and workspace gates.
+- Satisfy the frozen runtime Definition of Done rows on one revision.
+
+### Phase 7: production build and optional Mint handoff
+
+- Keep the editable local project and `.evidence/dev` state outside production
+  inputs while compiling one explicit target into a closed candidate.
+- Require exact governance metadata, stable concept identifiers, and complete
+  synthetic fixtures without adding a domain branch or a second evaluator.
+- Use the real Evidence binary for candidate validation and fixture execution,
+  then perform target-host startup, verification, and audit proof with
+  independently provisioned secrets.
+- Support either external HTTPS OIDC or separately authored Mint. The optional
+  paired check remains mechanical and read-only.
+- Document the bare-binary journey and Compose adapter without generating
+  deployment artifacts.
+
+Stop implementation before every future profile in section 15. Future work
+requires a new approved concept and plan.
+
+## 19. Success criteria
+
+The concept succeeds if:
+
+- a requirement is understandable from one YAML definition, small Rhai extraction and derivation scripts, and its fixtures;
+- the Rust core contains no adult-status, residence, licence, or parent-specific response path;
+- the Rust core contains no domain operation named for adult status, age thresholds, licence state, residence, or parentage;
+- every disclosed value maps to one declared Information Concept;
+- every subject binding maps to one fixed role;
+- each role uses one authorized, closed selector profile and selector value
+  origin, including at least one profile that requires no identifier;
+- source calls request no unnecessary fields in source-derived or field-projected cases;
+- record-transformed cases are identified honestly;
+- no raw selector, source, or disclosed value appears in logs, audit, or errors;
+- authorization binds requester, purpose, requirement revision, each role's
+  selector profile and value origin, subject authority, and audience;
+- one process safely serves multiple definitions within one trust domain;
+- adding a code or relationship assertion requires no new subsystem;
+- flat REST, paged nested REST, and event-index source shapes require no
+  source-product domain code in Rust;
+- all four initial assertion cases pass the complete production path on the
+  same revision before public contracts freeze;
+- production code, dependencies, features, configuration schemas, routes, and
+  CLI options contain no DHIS2 or OpenCRVS specialization;
+- JSON clients do not need to understand CCCEV RDF or XML;
+- operators can validate the complete bundle before deployment;
+- relying parties can verify every signed assertion using a governed trusted
+  public key and independent expected nonce, subjects, and output contract;
+- unsigned responses are visibly unprotected, explicitly authorized, and
+  rejected by signed-verification tooling;
+- signing-key absence or failure can never produce an unsigned success response;
+- the service remains small enough for a maintainer to trace a request end to end.
+
+## 20. Principal risks
+
+### Scope expansion
+
+Catalogs, policy, documents, workflow, credentials, transaction proofs, and interoperability can each grow into separate platforms. Future capabilities stay in named profiles with demonstrated adopters.
+
+### Signature overclaim and key operations
+
+A valid JWS can be mistaken for legal notarization or proof that the underlying registry fact is correct. Documentation and field semantics keep legal issuer, technical provider, and signer distinct. Signing failure is fail-closed, private key material never enters the deployment bundle, and public keys remain available through the assertion validity window.
+
+### False minimization claims
+
+Redacting after fetching a complete record minimizes disclosure but not acquisition. Every definition declares its source-access posture.
+
+### Cross-definition inference
+
+Individually safe assertions may combine into a reconstruction attack. Bundle validation, review, authorization, and negative fixtures treat the bundle as one disclosure surface.
+
+### Subject substitution and existence oracles
+
+Identifiers and compound demographic fields are not authority. Closed
+role-bound selector profiles, authorization over value origin, pre-source
+denial, bounded failed-attempt controls, and collapsed no-match or ambiguous
+failures prevent broken object-level authorization and incidental
+registry-membership disclosure.
+
+### Matching scope creep
+
+Fetching a broad candidate set for scoring or best-match selection would
+increase acquisition and turn Evidence into an identity-resolution service.
+The provider owns record meaning and lookup cardinality. Evidence accepts only
+the closed cardinality outcome plus minimized facts on one unique match. A
+reviewed deterministic requirement rule may compare those facts with an
+independently authorized role selector without creating a general matcher.
+
+### Script and configuration capability creep
+
+Convenience functions can gradually give Rhai request planning, credentials, authorization context, logging, or response construction. The two-function ABI and domain-neutral primitive allowlist remain closed.
+
+### Shared-process blast radius
+
+One slow source or expensive script can affect other definitions. Bounded execution, response sizes, timeouts, and per-source concurrency limits are required before serving multiple definitions.
+
+### Profile concerns entering the core
+
+OOTS, transaction-bound proof, agent, and document requirements can distort the native model. Profiles translate at the boundary and do not introduce their protocols into the evaluator.
+
+### Accidental source-product coupling
+
+A convenient first API can turn its pagination, identifiers, field names, or
+authentication flow into hidden core assumptions. The source contract matrix
+keeps those details in fixed configuration, generic credential handling, and
+Rhai extraction. Public demo checks supplement but never replace deterministic
+mocks.
+
+## 21. Decisions made
+
+This concept fixes the following decisions:
+
+1. The product name is Evidence; lowercase evidence denotes the CCCEV-aligned domain object.
+2. Version one produces assertion evidence only.
+3. JSON is the native request and evidence representation.
+4. CCCEV 2.2.0 is the initial semantic reference.
+5. Definitions and authorization declarations use startup-only YAML.
+6. Rhai performs source extraction and requirement-specific derivation.
+7. Rust provides only bounded, deterministic, domain-neutral Rhai primitives.
+8. Rust owns networking, credentials, authorization, output validation, evidence construction, projection, signing, and audit.
+9. Version one has no policy engine.
+10. Signed flattened JWS over the exact Evidence payload is mandatory and the
+    default. Exact API negotiation may select a distinctly typed unsigned
+    envelope only when the immutable bundle and complete matched grant permit
+    it. No signed-path failure falls back to unsigned output.
+11. One process serves one operator-controlled trust domain.
+12. The reference implementation is one `registry-evidence` crate and one `evidence` binary.
+13. The governed evidence bundle is the disclosure-review boundary; closed
+    runtime bindings cannot override it.
+14. General identity resolution, broad candidate retrieval, scoring or
+    selection, consent issuance, federation, documents, OOTS execution, and
+    agent authorization are outside version one. Configured provider lookup
+    and reviewed deterministic requirement comparison over one uniquely
+    resolved authoritative record are inside version one.
+15. Adult status, residence region, professional licence status, and
+    legal-parent relationship are coequal full-path acceptance definitions,
+    not Rust product concepts or implementation phases.
+16. Source independence is proven in tests with flat REST, DHIS2 Tracker-style
+    REST, and OpenCRVS Version 2 Event Search-style JSON mocks before any live demo
+    test. No named source product enters production code or public contracts.
+17. Public demo tests are read-only, explicit, local-only, and non-gating;
+    credentials, tokens, live responses, and demo-subject identifiers are not
+    repository artifacts.
+18. Subject lookup uses trusted, closed selector profiles. Field names and
+    exact sets are deployment-defined, so an identifier-only profile and a
+    compound profile such as name components plus date of birth use the same
+    core.
+19. Each selector profile has one exact field set. Alternative sufficient input
+    sets or additional disambiguators use separate profiles.
+20. The authoritative provider owns record meaning and lookup cardinality.
+    Evidence recognizes only `match`, `no_match`, and `ambiguous`, never
+    performs broad candidate retrieval, scoring, or selection, and releases
+    facts only on `match`. A reviewed derivation may apply a deterministic,
+    versioned rule to matched facts and authorized selectors.
+21. Raw selector values and per-field quasi-identifier hashes are forbidden in
+    logs and native audit. Where audit correlation is needed, one scoped keyed
+    pseudonym covers the complete canonical role and selector bundle.
+22. Evidence-definition discovery uses authenticated
+    `GET /v1/evidence-definitions`, which returns only complete request shapes
+    matching exactly one authority path for the verified caller and exact
+    bundle revision. Static onboarding owns token acquisition, human and legal
+    context, and verifier trust; OpenAPI describes the wire contract and JWKS
+    provides key discovery. Discovery metadata never creates authority, and no
+    public or cross-requester catalog exists.
+23. Each request carries one exact 32-byte random nonce echoed into Evidence.
+    The service does not store, consume, or uniqueness-check it, and strict
+    signed verification compares it with an independently retained expected
+    value.
+24. Strict verification also requires independently trusted expected subject
+    bindings and output concepts. Copying expectations from the same response
+    is not verification.
+
+## 22. Production deployment decisions
+
+The product boundary stays closed. Each production deployment still supplies
+or confirms these governed choices without changing public schemas or runtime
+semantics:
+
+1. What issuer, audience, token type, algorithm allowlist, and principal claim define the first deployment's OIDC profile?
+2. How does that deployment convey and govern subject authority?
+3. Which selector profiles, exact field sets, value origins, and public
+   cardinality-disclosure rules does the first deployment authorize?
+4. What exact source contract and acquisition posture does the first production
+   deployment use?
+5. Which source-authentication profiles does that deployment enable?
+6. Which Version 1 Evidence Types and fixed CCCEV-aligned concepts does the
+   deployment enable?
+7. Which durable audit sink is the first production target?
+8. What legal timezone and observation-time rules govern each time-dependent
+   production requirement?
+9. Which supported signing algorithm and key provider fit the first deployment?
+10. How will relying parties obtain and pin the Evidence provider's verification trust?
+11. Which permitted existence-disclosure behavior applies to each enabled
+    requirement under the closed public problem contract?
+
+## 23. Working references
+
+- SEMIC, [Core Criterion and Core Evidence Vocabulary 2.2.0](https://semiceu.github.io/CCCEV/releases/2.2.0/).
+- European Commission, [OOTS Technical Design Documents v2.0.1, Chapter 4: Evidence Exchange](https://ec.europa.eu/digital-building-blocks/sites/spaces/TDD/pages/973932908/Chapter+4+Evidence+Exchange+v2.0.1+July+2026).
+- European Commission, [OOTS Identity and Record Matching](https://ec.europa.eu/digital-building-blocks/sites/pages/viewpage.action?pageId=797081682).
+- European Commission, [OOTS Evidence Request Syntax Mapping](https://ec.europa.eu/digital-building-blocks/sites/spaces/TDD/pages/973932961/4.5.1+-+Evidence+Request+Syntax+Mapping+v2.0.1+July+2026).
+- European Commission, [OOTS Evidence Response Syntax Mapping](https://ec.europa.eu/digital-building-blocks/sites/spaces/TDD/pages/973932951/4.5.2+-+Evidence+Response+Syntax+Mapping+v2.0.1+July+2026).
+- European Commission, [OOTS eDelivery Profiling and Configuration](https://ec.europa.eu/digital-building-blocks/sites/spaces/TDD/pages/973932931/4.7+-+eDelivery+Profiling+and+Configuration+v2.0.1+July+2026).
+- European Commission, [OOTS Evidence Exchange Logging](https://ec.europa.eu/digital-building-blocks/sites/spaces/TDD/pages/973932926/4.8+-+Evidence+Exchange+Logging+v2.0.1+July+2026).
+- Rhai, [Maximum Number of Operations](https://rhai.rs/book/safety/max-operations.html).
+- IETF, [JSON Web Signature](https://www.rfc-editor.org/rfc/rfc7515.html).
+- IETF, [JSON Web Key](https://www.rfc-editor.org/rfc/rfc7517.html).
+- OAuth 2.0, [Token Exchange](https://www.rfc-editor.org/rfc/rfc8693.html).
+- OAuth 2.0, [Rich Authorization Requests](https://www.rfc-editor.org/rfc/rfc9396.html).
+- X-Road, [Data Exchange](https://x-road.global/data-exchange).
+- OpenFn, [Workflows](https://docs.openfn.org/documentation/build/workflows).
+- DHIS2, [Tracker API 2.43](https://docs.dhis2.org/en/develop/using-the-api/dhis-core-version-243/tracker.html).
+- OpenCRVS, [Record Search clients](https://documentation.opencrvs.org/v1.8/technology/interoperability/create-a-client/record-search-clients).
+- OpenCRVS, [Authenticate a client](https://documentation.opencrvs.org/technology/interoperability/authenticate-a-client).
+- UK Government, [How to check someone's identity, GPG 45 version 1.0](https://www.gov.uk/government/publications/how-to-check-someones-identity-1-0).
+- UK Government, [Data taxonomy, data model and data dictionary for GPG 45](https://www.gov.uk/government/publications/uk-digital-verification-services-trust-framework-data-schema-1-0/data-taxonomy-data-model-and-data-dictionary-for-gpg-45).
+- Registry Notary, [Consultation identity and outcomes](https://github.com/registrystack/registry-stack/blob/v0.16.3/products/notary/docs/identity-and-record-matching.md).
+- Internal design input, `jurisdiction-neutral-evidence-packs-gap-spec-2026-06-19.md`, reviewed 2026-08-02.
diff --git a/products/evidence/FIRST-CURL-TEST.md b/products/evidence/FIRST-CURL-TEST.md
new file mode 100644
index 000000000..e253c0768
--- /dev/null
+++ b/products/evidence/FIRST-CURL-TEST.md
@@ -0,0 +1,222 @@
+# First Evidence server curl
+
+Status: Ready for deterministic local operator test
+
+This checkpoint curls the Evidence server itself. DHIS2 and OpenCRVS are not
+called. A deterministic local source returns synthetic data so the result
+proves authenticated requester-scoped definition discovery plus the Evidence
+assertion route, bearer authentication, authorization, request-nonce
+validation and echo, response-format negotiation, selector handling,
+source request, Rhai extraction and derivation, minimum-disclosure output gate,
+signing, JWS verification, and both durable audit events.
+
+The harness uses the production Evidence router and runtime with two deliberate
+test substitutions: an in-memory test JWKS authenticates the requester, and a
+local mock stands in for the upstream source. Those substitutions keep the
+first curl reproducible and credential-free. Production OIDC JWKS retrieval,
+the `evidence serve` startup command, and live provider compatibility are later
+checkpoints and are not implied by this pass.
+
+## Run the server
+
+From the repository root, run this in terminal 1:
+
+```bash
+CARGO_INCREMENTAL=0 \
+CARGO_PROFILE_DEV_DEBUG=0 \
+CARGO_PROFILE_TEST_DEBUG=0 \
+cargo test --locked -p registry-evidence \
+  first_curl_exercises_and_verifies_the_evidence_server \
+  -- --ignored --nocapture
+```
+
+Wait until the harness prints `Evidence first-curl server is ready`. It listens
+only on `127.0.0.1:18080` and creates an ignored, owner-only directory at
+`products/evidence/.first-curl/`. The directory contains the exact synthetic
+request plus `session.env`, which contains only a short-lived synthetic bearer
+token. It does not read `products/evidence/.env`.
+
+## Discover available Evidence
+
+Load the short-lived synthetic bearer token, then ask the Evidence server what
+this authenticated caller can request:
+
+```bash
+set -a
+. products/evidence/.first-curl/session.env
+set +a
+
+curl --fail-with-body \
+  --request GET \
+  --header "Authorization: Bearer ${EVIDENCE_ACCESS_TOKEN}" \
+  --header 'Accept: application/json' \
+  --output products/evidence/.first-curl/definitions.json \
+  --write-out 'HTTP %{http_code}\n' \
+  http://127.0.0.1:18080/v1/evidence-definitions
+
+jq . products/evidence/.first-curl/definitions.json
+```
+
+The response lists four complete, requester-authorized definitions. Each item
+contains the requirement, Evidence Type, purpose, reference frameworks,
+subject roles, selector profile and value origin, safe selector field contract,
+and output concepts. It does not expose source identifiers, URLs, scripts,
+credentials, authority-profile names, requester tags, selector values, or
+codelist values. Discovery performs no provider call and writes no evidence-data
+audit event.
+
+## Request Evidence
+
+Inspect the complete request:
+
+```bash
+jq . products/evidence/.first-curl/request.json
+```
+
+Every request carries a required `requestNonce`: the canonical unpadded
+base64url encoding of exactly 32 random bytes, so exactly 43 characters. The
+harness writes one into `request.json`. When you compose a request by hand,
+generate a fresh value per request and never reuse, hand-edit, or derive it
+from identifiers, selectors, secrets, or document digests:
+
+```bash
+openssl rand 32 | basenc --base64url | tr -d '=\n'
+```
+
+Evidence echoes the exact value into the Evidence payload under
+`requestNonce` and covers it by the signature. Keep your copy of the request so
+a verifier can compare the echoed nonce with the value it sent. Evidence does
+not store the nonce, does not reject reuse, and makes no replay-prevention
+claim.
+
+### Optional unsigned variant
+
+The first-curl bundle and its matched grant both permit `unsigned-json`, so you
+may ask the same route for a visibly unsigned envelope. Run this before the
+signed request below, because the harness shuts down as soon as it verifies the
+signed response:
+
+```bash
+curl --fail-with-body \
+  --request POST \
+  --header "Authorization: Bearer ${EVIDENCE_ACCESS_TOKEN}" \
+  --header 'Content-Type: application/json' \
+  --header 'Accept: application/vnd.registrystack.evidence-unsigned+json' \
+  --data-binary @products/evidence/.first-curl/request.json \
+  --output products/evidence/.first-curl/response-unsigned.json \
+  --write-out 'HTTP %{http_code}\n' \
+  http://127.0.0.1:18080/v1/evidence
+
+jq . products/evidence/.first-curl/response-unsigned.json
+```
+
+The envelope carries `"integrityProtection": "none"` and a
+`"not-cryptographically-verifiable"` warning around the same closed Evidence
+object. It is transport-authenticated convenience data for development and for
+consumers that cannot process JWS, never later-verifiable evidence and never a
+fallback when signing fails.
+
+Unsigned output is governed, not a client choice. It succeeds only when the
+immutable bundle and the one complete matched grant both permit it; otherwise
+the request is refused with the ordinary `not_authorized` problem before
+credentials or source access, without revealing which layer refused. The
+production reference bundles declare `responseFormats: [signed-jws]`, so the
+same header there returns that refusal. A duplicate, combined, parameterized,
+weighted, or unknown `Accept` returns the
+`response_format_not_acceptable` problem with HTTP 406 before source access.
+
+### Signed request
+
+Then run this plain curl. There is no curl config, wrapper, proxy, redirect, or
+hidden request option:
+
+```bash
+curl --fail-with-body \
+  --request POST \
+  --header "Authorization: Bearer ${EVIDENCE_ACCESS_TOKEN}" \
+  --header 'Content-Type: application/json' \
+  --header 'Accept: application/jose+json' \
+  --data-binary @products/evidence/.first-curl/request.json \
+  --output products/evidence/.first-curl/response.json \
+  --write-out 'HTTP %{http_code}\n' \
+  http://127.0.0.1:18080/v1/evidence
+
+unset EVIDENCE_ACCESS_TOKEN
+jq . products/evidence/.first-curl/response.json
+```
+
+Every HTTP choice is visible in the command. `session.env` prevents only the
+short-lived bearer value from being committed into this document. You may
+inspect that local file, but do not paste its token into chat.
+
+The curl prints:
+
+```text
+HTTP 200
+```
+
+`jq` then prints the actual flattened JWS response. In parallel, the server
+harness validates the explicit discovery response, reads the assertion response
+file, verifies the JWS against the running Evidence JWKS, checks the expected
+minimized boolean, confirms protected source and selector fields are absent,
+confirms both audit events are durable, shuts down, and ends with:
+
+```text
+PASS: authenticated discovery listed four safe request shapes, Evidence returned HTTP 200, its JWS verified, adult-status was true, minimization held, and both audit events were durable.
+```
+
+If you also ran the optional unsigned variant, its `response-unsigned.json`
+output is present, so the harness additionally verifies that leg and ends with
+the four-audit-event form instead:
+
+```text
+PASS: authenticated discovery listed four safe request shapes, Evidence returned HTTP 200 in both formats, the JWS verified, the unsigned envelope was self-identifying and rejected by the JWS verifier, adult-status was true, minimization held, and all four audit events were durable.
+```
+
+Either `PASS:` line is a full pass; which one you see depends only on whether the
+optional unsigned leg ran (two audit events for the signed leg alone, four when
+the unsigned leg also ran). Anything else is not a pass. Do not paste
+`session.env` or its bearer token
+into chat. The responses are retained at
+`products/evidence/.first-curl/definitions.json`,
+`products/evidence/.first-curl/response.json`, and, if you ran the optional
+variant, `products/evidence/.first-curl/response-unsigned.json` for local
+inspection and are gitignored.
+
+## Local provider credentials
+
+Optional live-provider work uses `products/evidence/.env`. The real file is
+gitignored, owner-only, and contains the supplied DHIS2 public-demo credentials
+plus the existing OpenCRVS system-client values and approved demo selector from
+the local `.opencrvs.env`. The tracked `.env.example` lists the exact keys.
+
+The Evidence runtime does not load credentials from environment variables.
+When a live Evidence deployment is prepared, a launcher must copy only the
+selected profile's values from `.env` into the runtime's owner-only secret files
+and then start Evidence. This preserves the Version 1 file-secret boundary.
+
+Do not source `.env` into an interactive shell, print it, pass its values on a
+command line, commit it, or send it in chat. Provider calls remain read-only and
+must use one approved demo record. A server-level DHIS2 or OpenCRVS checkpoint
+is not ready until its deployment-specific selector and mapping are confirmed.
+
+## What may wait until after this curl
+
+The following may wait for this first deterministic Evidence-server curl, but
+not for Version 1 completion:
+
+- prepare an ephemeral production-startup harness that runs `evidence serve`
+  with HTTPS OIDC JWKS and the file-secret boundary;
+- run the Evidence server against one bounded DHIS2 demo record and one bounded
+  OpenCRVS demo record using `.env`, then verify each returned JWS;
+- rerun the final Evidence package, contract, neutrality, generated-artifact,
+  and ignored live-source gates on one stable revision;
+- stage the exact Evidence scope. Workspace-wide gates remain outside the
+  current Evidence-only instruction.
+
+Lower-priority review notes may also wait: decide whether governed requirements
+need human-readable labels, add the pre-implementation decision-to-contract
+index, clarify that the provider-side two-result limit is governed adapter
+policy rather than a Rust domain rule, and correct the narrower selector
+wording in the scratch review note. The deprecated unkeyed platform audit trait
+method is unused by Evidence and belongs to shared platform maintenance.
diff --git a/products/evidence/IMPLEMENTATION.md b/products/evidence/IMPLEMENTATION.md
new file mode 100644
index 000000000..919acff4d
--- /dev/null
+++ b/products/evidence/IMPLEMENTATION.md
@@ -0,0 +1,939 @@
+# Evidence Implementation Approach
+
+Status: Approved Version 1 implementation schedule and Definition of Done
+Date: 2026-08-02
+
+Source-contract and local-smoke details: [SOURCE-TESTING.md](SOURCE-TESTING.md)
+
+## Outcome
+
+Implement the complete Evidence Version 1 contract defined by `CONCEPT.md`.
+The work is not complete when one assertion works. It is complete only when
+the full API, bundle, source, authorization, Rhai, validation, signing, audit,
+operations, and verification boundaries satisfy the Definition of Done in this
+document across the complete acceptance-definition set.
+
+No acceptance case is the architectural seed or an implementation milestone.
+Adult status, controlled region, professional licence status, and legal-parent
+relationship are coequal proofs of a generic engine from the first offline
+phase onward. The implementation schedule stops at the Version 1 boundary. It
+does not begin any capability listed under `CONCEPT.md` section 15, Future
+profiles and guarded extensions.
+
+## Version 1 product shape
+
+Version one is one crate and one binary. Product-owned contracts and fixtures
+remain outside the crate:
+
+```text
+crates/registry-evidence/
+  src/
+    audit.rs
+    auth.rs
+    binding.rs
+    bundle.rs
+    config.rs
+    contracts.rs
+    kernel.rs
+    lib.rs
+    main.rs
+    model.rs
+    problem.rs
+    rate_limit.rs
+    rhai_runtime.rs
+    runtime.rs
+    secrets.rs
+    selector.rs
+    server.rs
+    signing.rs
+    source.rs
+    values.rs
+    verifier.rs
+  tests/
+    cli.rs
+    deployment_projects.rs
+    source_contracts.rs
+    selector_conformance.rs
+    security_contract_traceability.rs
+    live_sources.rs
+products/evidence/
+  contracts/
+  fixtures/
+  generated/
+  reference/
+  scripts/
+```
+
+The binary exposes four commands:
+
+```text
+evidence serve
+evidence check
+evidence evaluate --fixture <path>
+evidence verify --jws <file> --jwks <file> --policy <file>
+```
+
+Do not create client, worker, adapter, policy, credential, or interoperability
+crates in version one. Rhai adapters and derivations are deployment-bundle
+artifacts, not Rust crates.
+
+Production code is source-product neutral. `src/`, production Cargo features,
+dependencies, public types, configuration schemas, routes, and CLI options
+must contain no DHIS2-specific or OpenCRVS-specific behavior. Those product
+names and shapes may appear only in tests, sanitized fixtures, test-only bundle
+artifacts, and the local smoke guide. Event Search is an ordinary bounded JSON
+`POST`; a Tracker request is an ordinary fixed-authority `GET` with prepared
+query parameters and Rhai extraction.
+
+## Dependency boundary
+
+Reuse selected shared primitives without inheriting another product model:
+
+| Crate | Version-one use |
+|---|---|
+| `registry-platform-audit` | Keyed chain integrity, scoped pseudonymization, JSONL sink, and chain verification |
+| `registry-platform-crypto` | `SigningProvider`, protected JWK handling, signing, and public JWK publication |
+| `registry-platform-oidc` | Strict access-token and JWKS verification for the reference authentication profile |
+| `registry-platform-httpsec` | Security response headers where the existing contract fits |
+| `registry-platform-httputil` | Bounded source-response body reads |
+| `registry-platform-sdjwt` | Compact SD-JWT VC serialization for the SD-JWT VC response format |
+
+Evidence must not depend on `registry-notary*`, `registry-platform-pdp`,
+`registry-platform-oid4vci`, `registry-platform-replay`,
+`registry-platform-sts`, or Registry Manifest.
+
+The governed bundle and closed operator runtime file are trusted and
+startup-only. Use typed YAML and explicit secret references. Runtime
+configuration binds only process-local listener, filesystem, audit-storage,
+secret-mount, and TLS-trust paths; it is not an override layer. Do not expand
+private key material or source credentials into either parsed YAML document.
+
+## Reference implementation defaults
+
+These defaults unblock implementation without claiming that every deployment
+must use them:
+
+| Area | Reference default |
+|---|---|
+| Authentication | OIDC access token with exact issuer, audience, type, and algorithm allowlists |
+| Principal | One configured claim, initially `sub`; missing claim denies with no fallback |
+| Subject authority | Configured statutory-agency profile permits an authorized requester to use only named selector profiles and approved value origins |
+| Subject selector | Closed identifier or compound field set with deployment-defined names, scalar types, bounds, and fixed source placements |
+| Lookup outcome | Provider-owned `match`, `no_match`, or `ambiguous`; facts exist only on `match` |
+| Source | One fixed HTTP JSON data request using field projection and denied redirects |
+| Source authentication | Secret-referenced Basic, static Bearer, static API-key header, or OAuth 2.0 client credentials; explicit local authoring may use no credential only at a canonical numeric-loopback HTTP origin |
+| Audit | `registry-platform-audit` JSONL sink on explicitly durable storage, fail-closed |
+| Signing | Flattened JWS JSON with one active EdDSA key and a public JWKS endpoint |
+| Response format | Signed JWS by default; exact `Accept: application/vnd.registrystack.evidence-unsigned+json` only when the bundle and complete matched grant permit it |
+| Evidence storage | None |
+| Runtime mutation | None |
+
+The real identity provider, authority mapping, source contracts, reference
+framework rules, audit storage, and verifier trust distribution remain
+deployment inputs. Mocked contracts allow the generic runtime to be built
+before those integrations are available.
+
+## Runtime pipeline
+
+The production path is fixed:
+
+1. Parse and bound the JSON request, including the required canonical 43-byte
+   base64url encoding of an exact 32-byte random request nonce.
+2. Authenticate the token from configured issuer metadata.
+3. Derive the principal only from the configured claim.
+4. Resolve the requirement, purpose, audience, exact requested response format,
+   and subject-authority profile.
+5. Resolve each role's configured selector profile and obtain its values only
+   from the profile's permitted origin: authenticated context, authenticated
+   grant, or the bounded request.
+6. Validate the exact field set, scalar types, bounds, role, and fixed source
+   binding. Reject missing, unknown, or extra material.
+7. Make one authorization decision over requester, optional actor, requirement
+   revision, purpose, role-bound selector profiles and value origins, subject
+   authority, audience, and response format.
+8. Durably write the access-attempt audit event with at most one scoped keyed
+   pseudonym over each complete canonical role and selector bundle.
+9. Run bounded request preparation with only the source-required authorized
+   selectors and closed adapter parameters, then validate the complete
+   `RequestParts` result.
+10. Resolve the configured source credential. When required, acquire or reuse a
+   bounded OAuth 2.0 client-credentials token through the Rust-owned credential
+   provider.
+11. Execute the one Rust-owned evidence-data source request.
+12. Run bounded Rhai extraction and validate the closed `match`, `no_match`, or
+    `ambiguous` result. Stop safely on either non-match outcome.
+13. On `match`, run bounded Rhai derivation with only its declared authorized
+    selector inputs and deterministic context.
+14. Validate the complete concept-value result against the selected
+    requirement.
+15. Construct the Evidence JSON payload in Rust without selector profiles or
+    values and with the exact request nonce.
+16. For signed JWS, sign and serialize the exact final response bytes. For an
+    explicitly authorized unsigned request, construct and serialize the closed
+    self-identifying unsigned envelope without invoking the signer.
+17. Durably write the pseudonymized disclosure-release audit event with the
+    closed response-protection mode and a signing key id only for JWS.
+18. Return those exact pre-audited bytes with their exact media type.
+
+Any failure through request-parts validation in step 9 prevents credential
+acquisition and source access. Any failure after source
+access prevents evidence release. Audit failure prevents either response.
+Signing failure on the signed path never produces an unsigned success response.
+
+## Bundle and runtime contracts
+
+The governed atomic bundle contains:
+
+```text
+evidence.yaml
+adapters/
+  source-a-prepare.rhai
+  source-a-extract.rhai
+derivations/
+  requirement-a.rhai
+schemas/
+codelists/
+fixtures/
+```
+
+The separate `runtime.yaml` binds the bundle directory, listener, secret root,
+audit destination, and logical TLS trust profiles to local paths. The bundle
+and runtime hashes identify the exact inputs loaded by the process. They do not
+prove trust. Deployment controls establish trust by mounting both reviewed
+inputs read-only and starting a new process for a new revision.
+
+Bundle checking must validate:
+
+- stable and unique requirement, concept, Evidence Type, source, adapter, and
+  derivation identifiers;
+- exact subject roles and cardinalities;
+- selector profiles with one exact field set, stable deployment-defined field
+  names, scalar types, byte bounds, and a maximum aggregate size;
+- allowed selector profiles and value origins for every subject role and
+  authority profile;
+- closed source-required selector inputs, reviewed request-preparation scripts,
+  and a source binding for every allowed role and profile combination;
+- closed derivation selector inputs that are exact subsets of the selected
+  requirement roles and profiles;
+- fixed purposes, requester classes, audiences, and subject-authority paths;
+- fixed source scheme, host, method, fixed path or selector-bound path
+  template, fixed non-secret headers, fields, credentials, TLS trust-profile
+  name, limits, and redirect policy;
+- fixed source-authentication scheme and, for OAuth, token endpoint, grant,
+  credential placement, scope, bounds, and cache lifetime;
+- a closed runtime file with no governed-field override, complete bundle and
+  logical trust-profile bindings, and no ambient proxy behavior;
+- fact and concept schemas;
+- derivation parameter types;
+- codelist references and versions;
+- successful Rhai compilation;
+- for production and evidence-grade assurance, positive, negative, boundary,
+  missing-data, no-match, ambiguous-match, and anti-reconstruction fixtures;
+- combined disclosure safety of every simultaneously enabled definition.
+
+The governed bundle declares `local`, `production`, or `evidence-grade`
+assurance. Local may omit a requirement fixture reference during authoring but
+retains every runtime authentication, authorization, immutability, source,
+signing, audit, and disclosure control. Production and evidence-grade retain
+the complete fixture gate. The assurance value is part of Evidence, JWS,
+SD-JWT VC, discovery, audit, and strict verification policy.
+
+## Source and credential boundary
+
+Version one implements one generic HTTP JSON source executor. Product-specific
+source crates, clients, and domain types are out of scope. A source definition
+declares a fixed request and selects one generic authentication profile:
+
+- no credential only under `assuranceProfile: local`, at a canonical numeric-
+  loopback HTTP origin with an explicit non-zero port;
+- HTTP Basic with username and password secret references;
+- static Bearer with a token secret reference;
+- static API-key header with a fixed allowlisted header name and secret
+  reference;
+- OAuth 2.0 client credentials with client identifier and secret references,
+  a fixed HTTPS token endpoint, fixed grant and optional fixed scope.
+
+Credential acquisition is not available to Rhai. OAuth token acquisition may
+make a separate HTTP request, but it is not a second evidence-data lookup and
+cannot contribute facts. Rust bounds its response, accepts only the configured
+token shape, clamps cache lifetime to the returned expiry and configured
+maximum, and never logs the request URL, query, body, response, token, client
+identifier, or secret. A provider that requires credentials in query
+parameters is supported only by an explicit credential-placement setting and
+the same redaction rule.
+
+Every evidence-data request still has one Rust-fixed host, method, fixed path or
+closed Rust-expanded complete-segment path template, fixed non-secret headers,
+permitted query and body channels, response projection, TLS trust profile,
+timeout, redirect denial, maximum response size, concurrency limit, and
+one-request ceiling.
+After authorization and durable access-attempt audit, a reviewed preparation
+script renders ordered logical query pairs and at most one JSON body from only
+the source-required authorized selectors and closed non-secret parameters.
+Rust validates the result, percent-encodes query components exactly once,
+expands any selector-bound path segments without script involvement, and
+constructs the request before credential acquisition. It applies the configured
+extended JSON Pointer allowlist after bounded parsing and before extraction.
+The core does not normalize names or implement source matching semantics.
+
+Private-CA files are runtime bindings for logical bundle trust-profile names.
+Hostname and fixed-origin verification remain mandatory. Version 1 has no
+application-level proxy and ignores ambient HTTP proxy environment variables.
+
+The request asks the provider for only enough information to distinguish no
+match, one match, or ambiguity and to produce the declared facts. Prefer a
+count plus one minimized result. When the API cannot provide that shape,
+request at most two minimally projected results and never follow pages. Rhai
+may map their cardinality but must not score or choose between candidates. A
+requirement derivation may compare minimized facts from one unique
+authoritative record with its separately authorized selectors using a
+deterministic, versioned rule.
+
+A source that cannot expose this bounded lookup is not directly compatible with
+Version 1. It requires an external governed integration service. Do not add a
+bulk read, local index, local matching database, probabilistic matcher, or
+candidate-ranking script to Evidence as a workaround.
+
+## Source-shape contract suite
+
+The first implementation includes three minimal local mock profiles. They
+exercise different wire contracts while using the same source executor,
+evaluator, output gate, signer, and audit path.
+
+| Profile | Boundary shape | What it proves |
+|---|---|---|
+| `flat-rest` | Fixed JSON request and flat JSON object | Identifier and compound selector contracts plus direct fact extraction |
+| `dhis2-tracker` | `GET` query, selected fields, pager, collection, nested attribute array, Basic auth | REST query encoding, compound selectors, cardinality, pagination refusal, and code-based extraction |
+| `opencrvs-event-search` | OAuth client token, bounded JSON `POST`, nested event index, and country-configured declaration | Credential bootstrap, exact tracking-ID lookup, nested extraction, and selector-aware relational derivation |
+
+These are compatibility-shaped mocks, not whole-product emulators or claims of
+certified DHIS2 or OpenCRVS support. Fixtures are small, invented, and
+hand-authored from public documentation. No captured live response is checked
+in. A source-specific behavior is added to the mock only when Evidence relies
+on it.
+
+The mock profile names do not become runtime identifiers. Production code sees
+only generic HTTP methods, URLs, query and JSON-body templates, authentication
+profiles, bounds, and parsed JSON. Basic, Bearer, and OAuth client-credentials
+support must each have a generic contract and tests independent of either
+named product.
+
+The suite must prove at least:
+
+- exact request method, path, query, body, fields, headers, and authentication;
+- identifier-only, no-identifier compound, additional-disambiguator, and
+  multi-role selector profiles with deployment-defined field names;
+- missing, extra, unknown, mistyped, oversized, or unauthorized selector input
+  rejected before credential acquisition and source access;
+- no extra evidence-data request after zero, one, or multiple results;
+- configured `pageSize` detects ambiguity rather than following pagination;
+- no broad candidate list, score, near-match diagnostic, or comparison detail
+  is returned to the caller, logs, audit, or evidence;
+- malformed event-index envelopes and incomplete declarations fail closed;
+- credentials, raw selector values, source values, and response bodies are
+  absent from logs, audit, errors, snapshots, and assertion messages;
+- `401`, `403`, `429`, `5xx`, timeout, redirect, invalid JSON, wrong media type,
+  oversized response, missing fact, zero matches, and multiple matches;
+- switching among all three profiles requires bundle and Rhai changes only,
+  with no domain branch in Rust.
+
+The OpenCRVS shape may support an adult-status fixture because a birth record
+can supply a date of birth. The DHIS2 shape should exercise a controlled code
+or status instead, so the compatibility suite also resists adult-status
+overfitting.
+
+## Rhai contracts
+
+Use three functions with separate responsibilities:
+
+```text
+prepare(source_required_selectors, adapter_parameters) -> RequestParts
+extract(source_response, adapter_parameters) -> LookupResult
+derive(facts, declared_authorized_selectors, evaluation_context)
+    -> array<DerivedConceptValue>
+```
+
+`LookupResult` is exactly `match(FactSet)`, `no_match`, or `ambiguous`. The
+source adapter performs source-specific response parsing and cardinality
+mapping. It is not separately given the request selector profile or values and
+cannot make another source call, return candidates, or choose one row from an
+ambiguous result. If a `record-transformed` source response repeats a selector
+value, it is protected source data and cannot leave the declared fact boundary.
+Rust rejects facts on a non-match outcome and does not invoke derivation unless
+the outcome is `match`.
+
+The requirement derivation implements country-specific, sector-specific, or
+legal meaning over the uniquely matched facts. It may compare those facts with
+only the authorized selector roles and fields declared by the derivation.
+Preparation,
+extraction, and derivation run in the same Evidence process as separate,
+startup-compiled scripts in the immutable bundle.
+
+The evaluation context contains only:
+
+- the observation instant;
+- legal local date and time resolved by Rust from the configured IANA timezone;
+- fixed typed parameters from the selected requirement;
+- bounded access to named, versioned bundle codelists.
+
+Authorized selectors are a separate explicit derivation input. The evaluation
+context never contains requester identity, actor identity, purpose, audience,
+grants, tokens, credentials, source clients, logging handles, audit handles,
+signing keys, filesystem access, network access, process access, ambient clock
+access, or randomness.
+
+### Primitive standard library
+
+Rust provides a small, versioned set of pure and bounded primitives:
+
+- typed ISO calendar dates and instants;
+- comparison and calendar-safe addition for dates and durations;
+- bounded numeric comparison and bucketing;
+- controlled-code lookup in named bundle codelists;
+- bounded list and set membership;
+- explicit missing-value handling.
+
+The library contains no operation named for a use case. For example, adult
+status can be expressed conceptually as:
+
+```text
+attainment_date = add_calendar_years(date_of_birth, minimum_age_years)
+adult_status = legal_date >= attainment_date
+```
+
+`minimum_age_years` comes from trusted YAML, not the caller. The bundle fixes
+the exact reference framework, date semantics, timezone, and boundary fixtures.
+
+Every primitive has explicit input and output types, maximum sizes, deterministic
+behavior, and focused boundary tests. A primitive is added only for a generic
+operation that cannot be expressed safely with the existing set. Adding a new
+evidence definition should normally require no Rust change.
+
+### Output gate
+
+Rust accepts `array<DerivedConceptValue>` only when:
+
+- every returned concept is declared by the selected requirement;
+- every required concept is present exactly once unless its schema says
+  otherwise;
+- no extra concept or metadata field exists;
+- each value matches its scalar, controlled-code, bounded-list, or reviewed
+  structured schema;
+- codelist, cardinality, string, collection, and total-result limits pass.
+
+Rhai never creates the Evidence identifier, issuer, provider, requirement,
+Evidence Type, purpose, audience, subject bindings, timestamps, bundle revision,
+JWS headers, signature, or audit record.
+
+## Version-one acceptance definition set
+
+All four initial assertion cases in `CONCEPT.md` are mandatory, full-path
+acceptance definitions. None is merely an illustrative fixture or a follow-up
+generality check.
+
+| Case | Input facts | Supported Values | Generic capability proved |
+|---|---|---|---|
+| Adult status | Date of birth or source-derived status | Boolean | Unary assertion, calendar arithmetic, legal-time boundary, and false-as-success semantics |
+| Residence region | Official residence code or bounded address field | Controlled region code | Codelist mapping, geographic coarsening, and bounded category disclosure |
+| Professional licence status | Licence state and validity dates | Active boolean plus controlled expiry bucket | Multiple concepts, time bucketing, and omission of exact dates and history |
+| Legal-parent relationship | Child and candidate-parent roles plus an authoritative relationship fact | Relationship-confirmed boolean | Multiple role-bound subjects, subject substitution resistance, and relationship-specific semantics |
+
+The test bundles deliberately vary selector shapes:
+
+- adult status uses a compound person selector without an identifier;
+- residence uses an opaque identifier profile;
+- professional licence uses a compound sector selector;
+- legal-parent relationship uses two role-bound selectors and exercises both an
+  identifier profile and a no-identifier compound profile.
+
+These are fixture choices, not product semantics. At least one additional
+fixture uses deployment-defined field names that are not `given_name`,
+`family_name`, `birth_date`, `person_id`, or another built-in-looking
+vocabulary. Changing those names or mappings changes YAML, source fixtures, and
+Rhai only.
+
+Each case has a complete test-only bundle with YAML, Rhai extraction, Rhai
+derivation, codelists where needed, positive, negative, boundary,
+missing-record, missing-fact, source-failure, and anti-reconstruction fixtures.
+Each must pass offline evaluation and the production HTTP pipeline, including
+authentication, authorization, source execution, access audit, output gating,
+evidence construction, signing, release audit, and verification.
+
+Production Rust contains no type, operation, field, route, feature, or branch
+named for adult status, age thresholds, residence, licence, parentage, DHIS2,
+or OpenCRVS. Adding or changing any acceptance definition changes test bundles
+and Rhai, not the core domain model.
+
+## Implementation schedule
+
+This is a dependency sequence, not a set of partial product releases. Every
+phase must preserve all acceptance definitions introduced in Phase 0.
+
+### Phase 0: freeze Version 1 contracts and DoD
+
+- Promote accepted contracts into tracked `products/evidence` material when
+  Jeremi authorizes implementation.
+- Freeze the CCCEV-to-JSON profile, public request, request-nonce, JWS, and
+  unsigned-envelope response schemas,
+  governed-bundle and runtime YAML schemas, their ownership split, bundle
+  layout, selector-profile contract, `LookupResult` and derivation Rhai ABIs,
+  generic primitive set, source contract, normalized
+  authority context, authorization inputs, audit event schemas, problem codes,
+  signing profile, content negotiation, response-format authorization, and
+  verifier rules.
+- Create the four acceptance-definition bundles and the three source-shape
+  mock contracts before production architecture is written.
+- Create identifier-only, no-identifier compound, additional-disambiguator,
+  and multi-role selector fixtures before production architecture is written.
+- Create conformance fixtures for every Supported Value form and every
+  source-access posture declared for Version 1.
+- Freeze the project fixture vocabulary, response-projection grammar, fixed
+  header rules, selector-bound path-template rules, source-authentication
+  profiles, private-CA bindings, and ambient-proxy rejection.
+- Map every security invariant to its threat, Rust enforcement point, and
+  negative test.
+- Record the future-profile stop boundary from `CONCEPT.md` section 15.
+
+Exit gate: every Version 1 contract and every DoD row is reviewable; no future
+profile has a placeholder API, module, configuration field, or extension hook.
+
+### Phase 1: generic offline kernel
+
+- Create the single crate and binary with typed domain models, bundle loading,
+  atomic hashing, and startup validation.
+- Implement `evidence check` and fixture-only `evidence evaluate`.
+- Implement bounded Rhai extraction and derivation, the domain-neutral
+  primitive library, exact output gating, and deterministic Evidence JSON
+  construction.
+- Implement generic selector-profile parsing and validation without any
+  identity field vocabulary or matching algorithm in Rust.
+- Add fixture signing solely to verify the complete evidence model offline,
+  including independently expected nonce, subject-binding, and output-contract
+  checks.
+- Run all four acceptance definitions through the same kernel.
+- Run type, size, precision, code, reference, list, and cardinality fixtures
+  for the complete Supported Value contract.
+
+Exit gate: all four cases pass offline, including their boundary and negative
+fixtures, and production Rust contains no case-specific branch or type.
+
+### Phase 2: generic source boundary
+
+- Implement one fixed-authority HTTP JSON data-request executor with bounded
+  response parsing, denied redirects, timeouts, concurrency limits, reviewed
+  query/body rendering, fixed non-secret headers, selector-bound path
+  templates, private-CA trust profiles, and exact client-side response
+  projection.
+- Implement generic HTTP Basic, static Bearer, static API-key header, and OAuth
+  2.0 client-credentials providers using secret references.
+- Bind credential-free source access to explicit local assurance and an exact
+  numeric-loopback HTTP origin, with no authentication header on the wire.
+- Implement strict provider-text `parse_integer` without enabling implicit
+  query-value conversion or a provider-resolution DSL.
+- Run flat REST, paged nested REST, and Event Search-shaped local mocks through
+  the same executor.
+- Cover all four acceptance definitions across the source-shape matrix and run
+  at least one definition against two different shapes using only YAML and
+  Rhai changes.
+- Prove identifier, compound no-identifier, additional-disambiguator, and
+  multi-role selectors; prove zero, one, and multiple outcomes without broad
+  candidate retrieval or candidate exposure.
+- Add a repository check that rejects DHIS2 or OpenCRVS names, dependencies,
+  features, modules, types, and branches in production source, Cargo metadata,
+  and generated public contracts.
+- Prove ambient proxy variables cannot redirect either evidence-data or OAuth
+  requests, and prove unbound, malformed, mutable, or insecure private-CA files
+  prevent readiness.
+
+Exit gate: all source contract tests pass, no product-specific source code
+exists, and no source value, raw selector value, credential, token, or response
+reaches logs, audit, errors, or disk.
+
+### Phase 3: trust, authorization, audit, and signing
+
+- Implement the strict OIDC reference profile and configured-principal claim
+  with no claim fallback.
+- Implement subject-authority profiles and one fail-closed authorization
+  decision over requester, optional actor, requirement revision, purpose,
+  role-bound selector profile and value origin, subject authority, and
+  audience and requested response format.
+- Write the pseudonymized access-attempt audit durably before source access and
+  the disclosure-release audit durably after final response serialization and
+  before release.
+- Resolve production signing keys, create the exact flattened JWS JSON
+  response, publish public JWKS, and define key rollover and retired-key
+  availability.
+- Bind enabled response formats into the immutable bundle and allowed formats
+  into every authority grant; signed JWS remains mandatory and default.
+- Run every acceptance definition through these boundaries.
+
+Exit gate: every denial occurs before source access; audit or signing failure
+prevents release; principal, subject, purpose, audience, values, and keys obey
+the privacy and trust invariants.
+
+### Phase 4: native HTTP service and operations
+
+- Implement authenticated `GET /v1/evidence-definitions`,
+  `POST /v1/evidence`, `/health`, `/ready`, and the public JWKS endpoint with
+  exact media types, strict `Accept` handling, `Vary: Accept`, and a closed
+  `406` response-format problem.
+- Implement the self-identifying unsigned envelope through the same authorized,
+  minimized, audited path without a second evaluator or signing fallback.
+- Add request and response limits, safe problem responses, per-principal rate
+  controls, dependency timeouts, and shutdown behavior.
+- Generate JSON Schema and OpenAPI from code and add drift checks, and publish
+  the generated OpenAPI document unauthenticated at `GET /openapi.json`.
+- Test all four acceptance definitions through the real router and HTTP client
+  while multiple definitions are enabled in one process.
+
+Exit gate: each acceptance case produces a verifiable signed assertion and an
+explicitly authorized unsigned envelope through the same public operation, and
+operational endpoints expose no protected data.
+
+### Phase 5: privacy, isolation, and schema freeze
+
+- Prove source minimization, existence-disclosure behavior, combined-definition
+  inference controls, selector confidentiality, safe no-match and ambiguity
+  collapse, script isolation, cross-definition state isolation, and safe
+  concurrency and failure behavior.
+- Prove payload or protected-header mutation fails verification; nonce,
+  expected-subject, or expected-output-contract mismatch fails; and unsigned
+  output is explicit, governed, self-identifying, and never a fallback from
+  signed failure.
+- Attempt the ignored, read-only DHIS2 and OpenCRVS public-demo smoke tests only
+  after deterministic mocks pass, following `SOURCE-TESTING.md`.
+- Freeze Version 1 schemas only after all four initial assertion cases and all
+  negative security tests pass unchanged through the complete pipeline.
+
+Exit gate: the complete Definition of Done is green except packaging and final
+workspace gates, and any live-demo result is recorded only as pass, skipped, or
+inconclusive without protected data.
+
+### Phase 6: release readiness and stop
+
+- Provide operator configuration, secret, bundle-mount, audit-storage,
+  signing-key, key-rotation, backup, and verifier guidance for the supported
+  deployment mode.
+- Prove a clean build, package tests, generated-contract reproducibility,
+  dependency policy, and the applicable workspace gates.
+- Self-review the complete diff against the security acceptance matrix and the
+  future-profile stop boundary.
+
+Exit gate: the frozen runtime contract and its release evidence are complete.
+The remaining adopter build phase may not change request, assertion,
+authorization, source, signing, audit, or verification semantics.
+
+### Phase 7: production build and optional Mint handoff
+
+- Extend local authoring with an empty `fixtures/` directory and optional,
+  exact question governance metadata without weakening local development.
+- Compile one explicit production target into a create-only candidate. Reject
+  symlinks, outside-project references, missing fixtures, incomplete
+  governance or authority, invented URIs, unresolved review markers,
+  unauthenticated or plain-HTTP sources, unknown fields, and existing outputs.
+- Delegate candidate validation to the real `evidence` binary with private
+  temporary validation material. Run `evidence check` and every referenced
+  fixture before atomic publication; retain no secret, request, audit, source,
+  or local-development residue.
+- Add the target-host ceremony for independently provisioned secrets, real
+  startup, retained signed-response verification under independent production
+  policy, and audit-chain verification.
+- Add the optional read-only Mint compatibility check. It compares only
+  mechanical protocol bindings and pin tests for every mismatch without
+  printing protected values.
+- Document, but do not generate, the Compose adapter and the released-bare-
+  binary tutorial journey. State Mint's single-process, memory-only replay
+  cache limit.
+
+Exit gate: every Definition of Done row is satisfied with focused tests,
+contract and source-neutrality checks, documentation checks, and grouped
+workspace verification on one revision. Future profiles require new concept
+approval and are not continuation tasks for this schedule.
+
+## Definition of Done
+
+Evidence Version 1 is done only when every row below is satisfied on the same
+revision. A passing adult-status demonstration, a working endpoint, or a green
+subset of tests is not completion. No requested Version 1 behavior may remain
+as a stub, TODO, partially implemented path, undocumented manual step, or
+follow-up issue.
+
+| Area | Done when |
+|---|---|
+| Scope and architecture | One `registry-evidence` crate and one `evidence` binary implement the complete Version 1 path without any `registry-notary*`, PDP, credential-issuance, replay, worker, or interoperability subsystem dependency. |
+| Public contracts | The CCCEV-aligned Evidence JSON profile, request nonce, request and selector schemas, flattened JWS and unsigned-envelope responses, exact content negotiation, governed-bundle and runtime YAML schemas, closed `prepare/2`, `extract/2`, and selector-aware `derive/3` Rhai ABIs, projection and fixture contracts, audit events, problem codes, JSON Schema, and OpenAPI are reviewed, versioned, generated where applicable, and protected by CI drift tests. Subject-array order is not semantic; Rust resolves unique roles and emits declaration order internally. |
+| Initial assertion cases | Adult status, residence region, professional licence status, and legal-parent relationship each pass offline and through the real HTTP service, including authentication, authorization, response-format permission, source access, both audit gates, output validation, signed JWS, explicitly authorized unsigned output, and strict verification. |
+| Generic domain model | The four cases use one model and operation. Production Rust has no adult, age, residence, licence, parentage, personal-name-part, national-identifier, or other acceptance-case or jurisdiction-specific type, field, operation, route, feature, or conditional. Deployment-defined selector field names are opaque stable names. |
+| Source-product neutrality | Production code, Cargo metadata, and generated public contracts have no DHIS2 or OpenCRVS module, type, dependency, feature, configuration variant, route, CLI option, or conditional. Product names and shapes appear only in tests, sanitized fixtures, test-only bundles, and design or local-smoke documentation. |
+| Bundle and Rhai | Startup rejects incomplete, inconsistent, mutable, or uncompilable governed bundles and runtime files and serves only their one immutable revision. Runtime bindings cannot override governed fields. Every role and authority path has a complete selector-profile and source binding. Rhai preparation, extraction, and derivation are deterministic, bounded, and fresh per invocation. Preparation receives only source-required authorized selectors and closed parameters; extraction sees only the bounded projected response and parameters; derivation sees matched facts, only its declared authorized selector inputs, and the closed evaluation context. No script receives network, filesystem, environment, ambient clock, randomness, credentials, authorization objects, logs, audit, or signing material. Extraction returns only `match(FactSet)`, `no_match`, or `ambiguous`; derivation runs only on `match`. |
+| Values and validation | Every Version 1 Supported Value form declared in `CONCEPT.md` passes positive, negative, boundary, size, cardinality, Evidence construction, JWS serialization, and verification tests. The four initial assertion cases exercise boolean, controlled-code, time-bucket, multiple-concept, and multi-subject behavior through the full service. |
+| Selector and matching boundary | Identifier-only, compound no-identifier, additional-disambiguator, and multi-role selector profiles pass the complete service. Each profile has one exact field set. Missing, extra, unknown, mistyped, oversized, unauthorized, or wrong-origin values fail before credential acquisition and source access. Provider results are limited to `match`, `no_match`, and `ambiguous`; Evidence never performs broad candidate retrieval, scoring, or selection. Reviewed deterministic derivation may compare authorized selectors with facts from one unique authoritative record. Explicit false relationship evidence requires a complete valid relationship set. A source that lacks count metadata may return at most two minimally projected results solely to distinguish ambiguity. |
+| Source minimization | Rust makes exactly one evidence-data request with fixed transport authority, fixed or closed selector-bound path, fixed non-secret headers, bounded reviewed query/body rendering, and an explicit client-side response projection. It declares `source-derived`, `field-projected`, or `record-transformed` honestly, enforces response, time, redirect, pagination, TLS trust, concurrency, and ambient-proxy denial, and never persists a source response. Basic, static Bearer, static API-key, and OAuth client-credentials authentication and all three postures pass generic contract tests through the same executor. Credential-free execution is a separate local-only exception pinned to an exact numeric-loopback HTTP origin. |
+| Authentication and authority | Strict OIDC verification and the configured principal claim fail closed. One authorization decision binds requester, optional actor, requirement revision, purpose, every role's selector profile and value origin, subject authority path, audience, and requested response format. Possessing selector values or discovery metadata, or choosing an API media type, creates no authority. Authenticated discovery lists only complete shapes matching exactly one authority path and valid token-owned selector material; unentitled, ambiguous, and invalid-context shapes are absent. Every denial occurs before credential acquisition or source access. |
+| Privacy and audit | Access-attempt audit is durably accepted before source access. Rust serializes the final immutable signed or unsigned response bytes, durably accepts disclosure-release audit, then releases those exact bytes. Sink failure blocks the applicable step. Audit records the closed response-protection mode and a signing key only for JWS, and uses at most one scoped keyed pseudonym over each complete canonical role and selector bundle. Neither audit, logs, errors, metrics, nor traces contain credentials, tokens, request nonces, raw selector values, per-field quasi-identifier hashes, source values, Supported Values, or raw subject identifiers. |
+| Evidence and response integrity | Rust alone constructs Evidence, signed flattened JWS, and the unsigned envelope. Signed JWS is mandatory and default, uses allowlisted protected headers and trusted key resolution, has verifiable nonce, independently expected subjects and output contract, audience, policy, and validity, and publishes usable current and retired public keys. Unsigned JSON is self-identifying, requires bundle and complete matched grant permission plus exact API selection, and makes no later-verification claim. Signed failure never falls back to unsigned. |
+| Failure and operations | Stable safe errors, reviewed existence-disclosure semantics, public collapse of `no_match` and `ambiguous` by default, request limits, per-principal and failed-selector-attempt rate controls, authenticated requester-scoped discovery, health, readiness, dependency timeouts, and graceful shutdown work without exposing protected data. Discovery performs no source access and exposes no source plan, scripts, credentials, internal authority metadata, selector values, codelist values, or unrelated definitions. Readiness fails for missing bundle, selector binding, credential, audit, or signing dependencies required by the configured deployment. |
+| Multiple definitions | All four definitions run concurrently in one process and one trust domain without script state, limits, identifiers, subjects, source responses, audit context, or results crossing definition boundaries. Unsafe combined disclosure and mutually distrustful issuer configurations are rejected. |
+| Verification evidence | Focused invariant tests, all package tests, contract drift checks, dependency policy, formatting, package and workspace check, Clippy with warnings denied, and workspace tests pass. Security-sensitive behavior has a named threat, enforcement point, and negative test. |
+| Local compatibility smoke | After deterministic mocks pass, the read-only DHIS2 and OpenCRVS smoke tests are attempted when local credentials and approved demo selectors are available. Unavailability may be recorded as inconclusive; authenticated schema drift or excess disclosure is investigated and cannot be ignored. No credential or live-data artifact enters the repository or test output. |
+| Operability | An adopter can author, test, deploy, and maintain a source integration from the configuration, adapter API, fixture contract, and complete DHIS2/OpenCRVS-shaped projects without editing Rust. An operator can independently bind the immutable governed bundle to listener, secret, audit, and private-CA paths for each environment without overriding evidence semantics, configure authentication, authority mappings, source bindings, signing rollover, rate limits, and verifier trust using documented supported paths, and let an authenticated consumer discover the exact revision-bound request shapes it may invoke. Static onboarding still owns token acquisition, human and legal descriptions, endpoint trust, and verifier policy. |
+| Production build | An editable project remains local until its author supplies exact governance metadata, stable concept identifiers, and one synthetic fixture per question. `evidencectl build` consumes one explicit closed production target, follows no symlink or outside-project reference, creates no secret or runtime residue, delegates bundle validation and every fixture to the real `evidence` binary, atomically publishes only a complete candidate, and reproduces identical bundle bytes and revision from identical inputs. It creates no keys, callers, approvals, deployments, or network side effects. |
+| Target-host handoff | A reviewed candidate with independently provisioned owner-only production secrets passes `evidencectl doctor`, `evidencectl fixtures run`, and real startup. One authorized synthetic-subject HTTP request yields a signed assertion that `evidence verify` accepts only under independent `production` policy and trusted keys; the resulting access and disclosure audit events pass `evidence verify-audit`. |
+| Optional Mint pairing | External HTTPS OIDC builds without Mint. When Mint is selected, `mint check`, the paired read-only doctor check, registered-client token acquisition, and Evidence acceptance pass. Issuer, JWKS URI, audience, algorithm, token type, and all configured claim-name mismatches fail generically without keys, tokens, credentials, selectors, or source values in output. Mint remains a single process with a memory-only replay cache. |
+| Compose and bare-binary journey | The maintained Compose guidance mounts the candidate bundle unchanged and read-only, uses a distinct container runtime revision, separate read-only secrets, persistent audit storage, a private listener, and operator TLS. It documents service UID and secret modes, public-HTTPS Mint routing, and image provenance without generating Compose output. The production and optional-Mint tutorials execute from released bare binaries and include a real Curl boundary. |
+| Stop boundary | No capability from `CONCEPT.md` section 4 or section 15 is implemented or stubbed. This includes document evidence, credential lifecycle, OID4VCI, status lists, presentation verification, nonce or replay storage beyond stateless request-nonce echo and comparison, OOTS XML or AS4, agents or MCP, federation, workflow, public or federated catalogs, runtime bundle mutation, script-selected transport or multi-call source planning, multi-source fulfillment, a general policy engine, application database, message broker, or worker process. |
+
+## Required Version 1 acceptance tests
+
+At minimum, pin these acceptance and negative cases:
+
+1. Missing configured principal claim denies without `client_id` or `azp`
+   fallback.
+2. Unknown or unauthorized requirement, purpose, audience, selector profile,
+   selector value origin, or subject path never acquires source credentials or
+   contacts the source.
+3. Caller-supplied identifier or compound selector value never creates
+   authority.
+4. Access-audit failure prevents the source request.
+5. Source request method, URL, fields, credentials, size, timeout, and redirect
+   behavior remain fixed by trusted configuration.
+6. Rhai cannot access network, filesystem, environment, credentials, clock,
+   logging, audit, or signing material.
+7. Extra, missing, mistyped, or oversized derived values are rejected.
+8. Source data and disclosed values are absent from logs, audit, and errors.
+9. Disclosure-audit failure prevents response release.
+10. Signing failure returns a safe transient error and never falls back to
+    unsigned evidence.
+11. JWS verification fails after any protected-header or payload mutation.
+12. A valid false boolean result is a success in either authorized response
+    format, not an error.
+13. `no_match`, `ambiguous`, and missing fact do not create an unintended
+    existence oracle and use the same public failure by default.
+14. Legal-timezone and calendar-boundary fixtures are deterministic.
+15. Unsafe combinations, including threshold ladders and overlapping
+    categories, are rejected at bundle review or validation.
+16. Flat REST, DHIS2 Tracker-style REST, and OpenCRVS Version 2 Event
+    Search-style JSON mocks all use the same Rust source executor.
+17. Zero, one, and multiple results map consistently to `no_match`, `match`,
+    and `ambiguous` across the three source shapes; facts exist only on
+    `match`.
+18. Event-index envelope errors and incomplete declaration data fail closed.
+19. OAuth token requests and responses are absent from all diagnostics, and
+    no placement can put client credentials in the token URL.
+20. Live-source tests are ignored by default, read-only, and refuse missing or
+    permissively stored credential files.
+21. Adult status passes the complete path with before, on, and after-boundary
+    dates in the configured legal timezone.
+22. Residence region passes the complete path with valid, unknown, and
+    overly precise codes and a pinned codelist version.
+23. Professional licence status passes the complete path with multiple
+    concepts, validity boundaries, and proof that exact dates and history are
+    absent from evidence and diagnostics.
+24. Legal-parent relationship passes the complete path with correct roles,
+    swapped roles, unauthorized candidate substitution, false relationship,
+    returned-child mismatch, missing relationship, ambiguous lookup, and
+    ambiguous relationship facts.
+    The selector-aware derivation proves exact governed membership; `false` is
+    signed only after unique child resolution and a complete valid parent set.
+25. All four definitions run together and under concurrency without state,
+    subject, source, audit, limit, or result leakage.
+26. At least one acceptance definition runs against two different mock source
+    shapes with only bundle and Rhai changes.
+27. A repository boundary check rejects DHIS2 or OpenCRVS names and behavior in
+    production Rust, Cargo dependencies and features, public configuration
+    schemas, routes, and CLI options.
+28. JSON Schema and OpenAPI drift checks reproduce committed artifacts exactly.
+29. Every declared Supported Value form rejects wrong scalar types, unknown
+    codes, invalid entity references, excessive precision, oversized strings,
+    oversized lists, duplicate values where prohibited, and wrong
+    cardinalities, and each valid form survives Evidence construction, JWS
+    serialization, and verification without type loss.
+30. `source-derived`, `field-projected`, and `record-transformed` definitions
+    use the same executor and report their acquisition guarantees honestly.
+31. A serving process cannot reload, mutate, merge, or fall back to another
+    bundle revision at runtime.
+32. No test, log, trace, metric, audit event, snapshot, panic, or failure
+    artifact contains the canary credentials, raw selector values, source
+    facts, or Supported Values used by the acceptance suite.
+33. An identifier-only selector profile and a compound selector profile with no
+    identifier both pass the complete service path.
+34. Missing required, unknown, extra, mistyped, empty, oversized, and
+    aggregate-oversized selector fields fail before credential acquisition or
+    source access, with no protected value in the error.
+35. Alternative sufficient field sets and sets with an additional
+    disambiguating field require distinct named profiles and are never inferred
+    from caller input.
+36. At least one selector profile uses deployment-defined field names that have
+    no person, identifier, EU, UK, DHIS2, OpenCRVS, or acceptance-case meaning
+    to Rust.
+37. Unicode and multipart name-like values pass as bounded opaque strings.
+    Core behavior does not case-fold, transliterate, tokenize, apply phonetics,
+    parse Western name order, or perform partial-date matching.
+38. Provider ambiguity never causes a second data request, page traversal,
+    retrieval beyond the configured maximum of two minimally projected
+    results, candidate choice, derivation execution, or success response.
+39. Candidate records, candidate counts beyond the closed outcome, scores,
+    confidence, near-match hints, and field-by-field comparison results are
+    rejected by the extraction boundary and absent from public responses.
+40. Native audit records at most the selector-profile id and one scoped keyed
+    pseudonym over each complete canonical role and selector bundle. Separate
+    hashes of names, dates, addresses, identifiers, or other low-entropy fields
+    fail redaction tests.
+41. Context-derived and authenticated-grant-derived selector profiles reject
+    caller-provided values; an authorized request-derived caseworker profile
+    accepts only its configured closed field set.
+42. Evidence and the JWS payload never echo selector profile ids or values, and
+    audience-scoped subject bindings do not become globally stable identifiers.
+43. Failed selector attempts are bounded per principal and authority profile
+    without using raw selector values as metric or rate-limit labels.
+44. All four initial assertion cases pass their assigned selector shapes and
+    lookup outcomes through offline fixtures, local HTTP mocks, the real router,
+    both audit gates, signed JWS, explicitly authorized unsigned output, and
+    strict verification on one revision.
+45. Governed bundle and runtime configuration have separate closed schemas,
+    independent startup digests, read-only lifetime enforcement, and negative
+    tests proving runtime fields cannot override sources, authorization,
+    disclosure, limits, signing, or audit policy.
+46. Fixed paths and selector-bound path templates pass exact encoding tests.
+    Missing, extra, duplicated, slash, backslash, percent, control, empty, and
+    dot-segment bindings fail before credential acquisition or source access.
+47. Fixed non-secret headers, static Bearer, and static API-key authentication
+    pass generic exact-request and redaction tests. Forbidden, duplicate,
+    framing, routing, forwarding, proxy, tracing, cookie, and authentication
+    header collisions fail at startup.
+48. System roots and logical private-CA trust profiles pass positive TLS tests.
+    Unbound, malformed, insecure, symlinked, mutable, or hostname-bypassing CA
+    configurations prevent readiness, and ambient HTTP proxy environment
+    variables cannot redirect evidence-data or OAuth requests.
+49. Extended JSON Pointer response projection passes flat, nested, array,
+    literal-dot-key, missing-leaf, mistyped-intermediate, invalid-escape,
+    duplicate, overlap, size-before-projection, and privacy-canary tests. Rhai
+    sees only the projected tree while posture reflects the pre-projection wire
+    response.
+50. `parse_integer` accepts the documented ASCII grammar and leading zeroes and
+    rejects empty, plus-prefixed, whitespace, non-ASCII, fractional,
+    exponential, and overflowing values. Query values remain strings and no
+    implicit value-to-string conversion is introduced.
+51. Public request subjects are resolved uniquely by role rather than array
+    position. Permutations produce the same authorized internal role order;
+    duplicate, missing, unknown, or wrong-profile roles fail before credentials
+    or source access.
+52. The request nonce is exactly the canonical 43-character unpadded base64url
+    encoding of 32 bytes; missing, duplicate, padding, noncanonical encoding,
+    malformed alphabet, wrong length, and excessive length fail before
+    credential acquisition or source access. Nonce canaries never reach
+    authorization, Rhai, source preparation, source calls, logs, or audit.
+53. Signed Evidence echoes the exact request nonce; changing the expected or
+    signed nonce fails verification, and nonce reuse is not represented as
+    replay prevention.
+54. The verifier requires independently trusted expected subject roles and
+    opaque bindings plus expected concept identifiers, forms, and cardinalities
+    after signature verification. Missing, extra, duplicated, substituted, or
+    wrong-key-version bindings and unexpected output fail; subject order alone
+    is non-semantic.
+55. Missing `Accept`, `*/*`, and exact signed media select JWS. Only exact
+    unsigned media selects unsigned JSON. Duplicate, combined, parameterized,
+    weighted, or unknown negotiation fails before source access.
+56. Unsigned selection succeeds only when both the bundle and matched authority
+    grant permit it. Caller selection, runtime configuration, or a different
+    grant cannot create permission.
+57. Signing or signed-release failure never returns unsigned output. An
+    explicitly authorized unsigned request performs no signing operation and
+    still requires the ordinary signing dependency to be ready.
+58. The unsigned envelope has its exact vendor media type, schema, type,
+    integrity marker, warning, closed nested Evidence, and no `protected`,
+    `payload`, `signature`, or signing-key claim. The JWS verifier rejects it.
+59. Both response formats serialize final immutable bytes and require durable
+    disclosure-release audit before releasing them. Audit records the closed
+    protection mode and conditionally requires or forbids `signingKeyId`
+    without recording nonce, selectors, source values, or disclosed values.
+60. All four coequal definitions pass signed and explicitly authorized unsigned
+    paths through the same router, source executor, derivation, output gate,
+    subject binding, minimization, and audit logic without domain branches.
+61. Verification tooling re-verifies a stored signed response against a pinned
+    trusted key, expected policy, request nonce, subject bindings, and output
+    contract, and reports cryptographic authenticity separately from current
+    validity.
+62. Authenticated `GET /v1/evidence-definitions` returns only complete request
+    shapes matching exactly one authority path for the verified caller and
+    valid token-owned selector material. Unentitled callers receive an empty
+    list; ambiguous shapes are omitted; source identifiers and plans, scripts,
+    credentials, authority-profile names and tags, selector values, codelist
+    values, and unrelated definitions are absent; no provider request or
+    evidence-data audit event occurs.
+
+## Verification gates
+
+During implementation, run package-scoped checks while iterating and the
+complete package gate at every phase exit:
+
+```text
+cargo fmt --check
+cargo check --locked -p registry-evidence --all-targets
+cargo test --locked -p registry-evidence
+cargo clippy -p registry-evidence --all-targets -- -D warnings
+```
+
+The deterministic source mocks are part of ordinary package tests. Public
+demo tests live in a separate ignored integration-test target and run only
+after the package suite succeeds:
+
+```text
+cargo test --locked -p registry-evidence --test source_contracts
+cargo test --locked -p registry-evidence --test live_sources dhis2 -- --ignored
+cargo test --locked -p registry-evidence --test live_sources opencrvs -- --ignored
+```
+
+The exact environment loading and live-data rules are in
+[SOURCE-TESTING.md](SOURCE-TESTING.md). Live tests never run in CI, never use
+credentials on the command line, and never turn an unavailable or changed
+public demo into a product regression.
+
+Before a PR, also run the root workspace checks selected by CI, the Evidence
+contract command that regenerates and compares JSON Schema and OpenAPI, and the
+source-product-neutrality check that scans production code and Cargo metadata.
+The final DoD gate includes:
+
+```text
+cargo fmt --check
+cargo metadata --locked --format-version 1
+cargo check --locked --workspace --all-targets
+cargo clippy --workspace --all-targets -- -D warnings
+cargo test --locked --workspace
+cargo deny check
+products/evidence/scripts/check-contracts.sh
+products/evidence/scripts/check-source-neutrality.sh
+```
+
+Generated artifacts are reproduced from code, never hand-edited. If a shared
+platform crate changes, run its affected consumer tests during iteration as
+well as the final workspace gates.
+
+## Explicitly deferred
+
+The Version 1 schedule and DoD stop before every item below. Do not add
+implementations, stubs, placeholder schemas, empty modules, feature flags, or
+extension APIs for them:
+
+- Rego or a Rhai authorization-policy interface;
+- caller-defined predicates or thresholds;
+- broad candidate retrieval, fuzzy or probabilistic scoring, best-match
+  selection, matching weights or thresholds, phonetic candidate comparison,
+  deduplication, and an Evidence-wide identity policy;
+- script-selected sources, URLs, methods, paths, headers, credentials, retries,
+  page traversal, response-led requests, or multi-call source planning;
+- multiple evidence-data lookups or multi-source fulfillment for one
+  requirement;
+- evidence or raw-source persistence;
+- document retrieval or multipart responses;
+- OID4VCI, credential lifecycle, status lists, revocation, presentation or
+  key-binding verification, wallet onboarding, or holder-scoped subject
+  identifiers. The SD-JWT VC response format is a serialization of the same
+  stateless assertion under `contracts/sd-jwt-vc-profile.yaml`, and the optional
+  holder key is embedded without ever being validated as possession;
+- nonce or replay storage beyond stateless request-nonce echo and comparison;
+- OOTS XML, AS4, Evidence Broker, or DSD runtime code;
+- federation, agents, MCP, workflow, or public, cross-requester, searchable,
+  mutable, or federated catalog endpoints;
+- runtime bundle upload, mutation, hot reload, or approval workflows;
+- an application database, message broker, or worker process.
diff --git a/products/evidence/OPERATOR-CONTRACT.md b/products/evidence/OPERATOR-CONTRACT.md
new file mode 100644
index 000000000..91d521432
--- /dev/null
+++ b/products/evidence/OPERATOR-CONTRACT.md
@@ -0,0 +1,1030 @@
+# Evidence Version 1 operator contract
+
+Status: Implemented Version 1 operator contract
+
+This document defines the supported native deployment and operator duties for
+the Evidence Version 1 `evidence` binary.
+
+## Supported deployment
+
+The supported native deployment has:
+
+- one `evidence` process in one operator-controlled trust domain;
+- one reviewed, immutable governed evidence bundle and one closed operator
+  runtime file, both mounted read-only at startup;
+- one reviewed OIDC access-token profile with exactly one trusted issuer and
+  exact audience, token type, and algorithm allowlists;
+- one configured principal claim with no `client_id`, `azp`, header, or request
+  fallback;
+- reviewed requester and subject-authority mappings for named requirement
+  revisions, purposes, audiences, roles, selector profiles, and value origins;
+- fixed, bounded HTTP JSON source requests with fixed or selector-bound paths,
+  fixed non-secret headers, client-side response projection, denied redirects,
+  logical private-CA trust profiles, and generic Basic, static Bearer, static
+  API-key, or OAuth 2.0 client-credentials authentication through secret
+  references;
+- optional credential-free source access only for `assuranceProfile: local`
+  at a canonical numeric-loopback HTTP origin with an explicit non-zero port;
+- one active EdDSA reference signing key, flattened JWS JSON success responses,
+  and public key discovery at `/.well-known/evidence/jwks.json`;
+- keyed JSONL audit on storage whose durability the operator has explicitly
+  established;
+- production HTTPS exposure, dependency timeouts, per-source concurrency
+  limits, per-principal rate controls, and bounded failed-selector attempts.
+
+Multiple evidence definitions may be enabled only when they share the same
+operator, deployment lifecycle, audit boundary, and failure domain. Mutually
+distrustful issuers or customers require separate processes and bundles. The
+authentication profile admits exactly one token issuer and one set of claim
+names, so a second issuer, or one issuer whose clients carry the same authority
+under different claim names, requires a second deployment even when the
+operators trust each other. Evidence Version 1 has no application database and
+persists no selector, source, evidence, or response data. An external durable
+audit service may own its own storage.
+
+A gateway may provide publication, protocol integration, routing, and
+additional rate controls. Evidence still validates its configured identity
+context and independently enforces requirement, purpose, subject authority,
+selector, audience, disclosure, signing, and audit rules. Unsigned headers or
+caller request fields never substitute for authenticated authority.
+
+Version 1 accepts bearer tokens only. A token carrying a proof-of-possession
+confirmation claim is denied rather than accepted as an ordinary bearer, because
+Evidence validates no sender proof and accepting one would discard the
+constraint the authorization server issued the token under. An authorization
+server that binds tokens to DPoP keys or client certificates must issue Evidence
+clients unbound tokens.
+
+## Governed bundle and operator runtime
+
+The operator supplies one atomic bundle containing the approved YAML,
+preparation scripts, extraction scripts, derivation scripts, schemas, codelists,
+mappings, and fixtures. A separate closed `runtime.yaml` binds the bundle to
+one listener, bundle directory, secret root, audit destination, and local TLS
+trust files. The runtime file cannot override service identity, trust domain,
+authentication, authority, sources, request policy, scripts, disclosure, rate
+limits, signing policy, or audit fail-closed behavior. The two content hashes
+identify the exact loaded inputs but are not trust decisions. The operator
+establishes trust through review, distribution controls, read-only mounts, and
+process replacement for every revision.
+
+Every bundle explicitly declares `assuranceProfile: local`, `production`, or
+`evidence-grade`. Local is the only authoring profile and may omit a
+requirement's fixture reference. It changes no other runtime trust boundary and
+is carried in discovery, signed assertions, SD-JWT VC responses, audit, and
+verification policy. Production and evidence-grade require one captured,
+complete fixture suite per requirement under the existing bundle validator.
+There is no fixture receipt, certification command, or second serving path.
+
+There is no runtime upload, editor, approval API, hot reload, merge, mutation,
+governed-field override, or fallback bundle/runtime file. Startup and readiness
+fail if either input is incomplete, inconsistent, mutable, uncompilable, unsafe
+in combination, or cannot bind every
+allowed role, selector profile, value origin, authority path, and source
+placement.
+
+Before deployment, the operator must review the entire simultaneously enabled
+bundle as one disclosure surface. This review includes threshold ladders,
+overlapping categories, increasingly precise regions, jurisdiction variants,
+coexisting revisions, differing requester entitlements, and relationship
+combinations. Rate controls and after-the-fact audit analysis do not make an
+unsafe bundle safe.
+
+### Production candidate handoff
+
+`evidencectl build` compiles an editable project and one explicit production
+target into a new candidate directory. It is a create-only authoring command,
+not an approval, promotion, deployment, key-generation, caller-registration,
+or service-start command. It runs the real `evidence` binary against private
+temporary validation material before atomically publishing a candidate with a
+copied `runtime.yaml` and one closed `bundle/`. The candidate contains no
+production private key, credential, token, local request, audit entry, or
+source response.
+
+The operator reviews and transfers the exact candidate, records its bundle
+revision, and independently provisions the signing key, audit HMAC key,
+subject-binding HMAC key, and source credentials below the runtime's secret
+root. Secret ownership and mode requirements remain unchanged: each referenced
+secret is a regular owner-only file accepted by the eventual service identity.
+The bundle and runtime must be non-writable to that identity. The copied
+runtime is target-specific; its revision and bound private-CA bytes are not the
+bundle revision, and signed assertions continue to carry only the bundle
+revision as `configurationRevision`.
+
+Run the following grouped handoff after provisioning and whenever candidate
+bytes, runtime bindings, trust files, or secrets change:
+
+```sh
+evidencectl doctor --project '<candidate>'
+evidencectl fixtures run --project '<candidate>'
+evidence --runtime '<candidate>/runtime.yaml' serve
+```
+
+`doctor` is advisory for local artifact posture; the real runtime remains the
+authority for startup. Route traffic only after `/ready`. For one approved
+synthetic deployment subject, retain the signed response, verify it against an
+independently prepared `production` policy and trusted keys, and run
+`evidence verify-audit` over the resulting audit chain.
+
+An existing HTTPS OIDC issuer and Registry Mint are equal authentication
+choices for Evidence. Mint is a separate process and separately authored
+configuration. When used, the operator runs `mint check --config <mint.yaml>`
+and the read-only paired check
+`evidencectl doctor --project <candidate> --mint-config <mint.yaml>`. The
+paired check compares only issuer, JWKS URI, audiences, signing algorithm,
+token type, and configured principal, requester-tag, evidence-audience,
+grant-id, grant-authority, and optional actor claim names. It does not decide
+authority, register a client, copy Mint material, or issue a token.
+
+Docker Compose remains a documented deployment adapter, never build output.
+It mounts the approved candidate bundle unchanged and read-only, supplies a
+separate container runtime file and owner-readable secret mounts, gives only
+the audit path persistent writable storage, binds Evidence privately, and
+keeps public TLS and routing operator-controlled. A Compose deployment with
+Mint retains its public HTTPS issuer and JWKS URI: internal plain-HTTP service
+names do not replace either value. Container images and their provenance are
+operator responsibilities; Version 1 proves this journey with released bare
+binaries, not generated containers or orchestrator manifests.
+
+## Discovery of available evidence
+
+Evidence Version 1 answers "what may this caller request?" with authenticated
+`GET /v1/evidence-definitions`. Availability is requester-relative: the
+definition must exist in the exact deployed bundle and exactly one authority
+path must match the verified token, requirement, purpose, audience, complete
+subject-role set, selector profiles, and value origins. The runtime never
+publishes a global unauthenticated list.
+
+Discovery uses four separately trusted surfaces:
+
+| Artifact | Purpose | What it does not do |
+|---|---|---|
+| Generated Evidence OpenAPI | Describes `GET /v1/evidence-definitions`, `POST /v1/evidence`, operational routes, envelopes, media types, and safe problems. | It contains no deployment definitions or entitlements. |
+| Authenticated definition response | Lists the exact complete request shapes available to this verified token at this bundle revision. | It performs no provider access, does not grant authority, and is not a global catalog. |
+| Static onboarding material | Gives an approved consumer token-acquisition instructions, human descriptions, legal context, endpoint trust, and verifier policy through the existing API catalog, developer portal, configuration repository, or bilateral process. | It is not accepted by the runtime and grants no authority. |
+| Evidence JWKS | Publishes the active and retained public verification keys. | It is not a trust anchor and contains no definition or entitlement metadata. |
+
+Each item in `definitions` is one complete invocable combination, not a
+cartesian product for the client to assemble. It contains:
+
+- exact governed bundle revision plus legal issuer and technical provider;
+- requirement and Evidence Type identifiers;
+- one allowed purpose;
+- output concept identifiers and value forms;
+- complete subject roles, cardinality, selector profile, and value origin; and
+- safe selector field types and bounds. A controlled-code field exposes its
+  governed scheme identifier and version, never the bundle file path or code
+  values.
+
+The endpoint omits a request shape unless its token-owned context or grant
+selector values are present and valid. If no authority path matches, the
+response has an empty `definitions` array. If multiple authority paths match
+the same shape, that shape is omitted because `POST /v1/evidence` would deny it
+as ambiguous. Discovery consumes the same per-principal request-rate budget as
+evidence creation. It performs no source credential resolution, source call,
+signing, or evidence-data audit write. The operation accepts no query
+parameters or request body; callers cannot filter it into a definition oracle.
+
+Human-readable titles, descriptions, legal references, examples, and support
+contacts remain static onboarding documentation. The runtime response and that
+documentation must not include source origins or identifiers, source paths,
+response projections, scripts, adapter parameters, secret references,
+internal requester-tag values, authority-profile identifiers, selector values,
+codelist values, or unrelated definitions. Possessing discovery metadata does
+not authorize its recipient; the identity provider must issue the configured
+claims, and Evidence re-authenticates and re-authorizes every evidence request.
+
+The publication workflow is:
+
+1. Review the complete bundle and its combined disclosure surface.
+2. Run `evidence check` and every referenced fixture, and record the exact
+   governed bundle revision.
+3. Publish the generic OpenAPI and static onboarding material; configure token
+   issuance and verifier trust through the same governed process.
+4. Obtain a token, call `GET /v1/evidence-definitions`, and bind the returned
+   `configurationRevision` to the deployment revision expected during rollout.
+5. Construct requests only from one returned complete shape. Do not combine
+   subjects, profiles, purposes, or fields across items.
+6. On a relevant bundle or trust change, update onboarding material and
+   coordinate rollout. Clients observe the new revision through authenticated
+   discovery, not by probing problem responses.
+
+Version one does not implement a public, cross-requester, searchable, mutable,
+or federated catalog, a registration editor, or a `describe` CLI command.
+`/health`, `/ready`, `/openapi.json`, public problems, and JWKS never reveal
+enabled definitions or selector profiles.
+
+## Requester authority and purpose
+
+Authorization keys off the requester tags in the configured claim, not off the
+requester principal. The principal is used only for rate accounting and audit
+pseudonyms and never decides access. Two clients presenting the same tags hold
+the same access, so differentiated access is expressed by issuing different
+tags. An authority profile matches only when every one of its declared tags is
+present, and exactly one authority path may match a request: zero paths and two
+or more paths both deny. Startup validation does not detect two paths covering
+the same requirement, purpose, and subject tuple, so the operator owns that
+review.
+
+The request declares its purpose and any purpose the matched grant does not
+carry is rejected. Within the granted set the caller still chooses, so a
+declared purpose is an authorized selection rather than an identity-provider
+attestation. Where the purpose must be attributable to the token issuer, issue
+a distinct requester tag per purpose and give each tag an authority profile
+granting only that purpose. Purpose is then bound to a verified claim with no
+change to Evidence.
+
+Purpose is enforced rather than advisory in either arrangement. An unauthorized
+purpose is denied before credential acquisition and source contact, purpose is
+an input to every subject binding and audit pseudonym so one subject is not
+linkable across purposes, and purpose is inside the signed payload where a
+verifier rejects an assertion whose purpose does not match its expected policy.
+
+Purpose does not narrow disclosure. A requirement returns the same concepts and
+disclosure forms for every purpose that may invoke it. A purpose that justifies
+only a coarser answer needs its own requirement and its own place in the
+combined disclosure review.
+
+Native rate controls are uniform. The configured request, burst, and
+failed-selector limits are single values applied to every principal, and the
+request-rate scope deliberately excludes purpose, audience, and requirement so
+a caller cannot multiply its budget by varying them. Per-client quotas are a
+gateway responsibility.
+
+Rate limits are tracked per process, in in-process memory, never shared across
+replicas. Running N instances behind a load balancer therefore multiplies
+every configured limit by N; this matters most for the failed-selector budget,
+since that budget is the selector-enumeration defense rather than merely a
+throughput knob. A restart also resets every budget to full, because buckets
+are keyed on an in-memory monotonic clock rather than persisted. Tracked keys
+are bounded at 100,000; a new principal beyond that ceiling is refused with a
+capacity error until entries age out of the prune window. Reaching it requires
+100,000 distinct authenticated principals within the window, so treat it as a
+capacity ceiling worth alerting on rather than a practical denial-of-service
+vector.
+
+The listener request timeout bounds admission, concurrency queueing, and body
+collection. It is not a total evaluation deadline. Once a protected evaluation
+starts, Evidence lets it finish under the separately bounded OIDC and source
+operations so cancellation cannot bypass required audit or signed-response
+release ordering.
+
+## Response formats
+
+Evidence releases one stateless assertion. `responseFormats` decides which
+serializations may carry it, and the closed values are `signed-jws`,
+`unsigned-json`, and `sd-jwt-vc`. Both the immutable bundle and every authority
+grant declare the list, both default to `[signed-jws]` alone, and both must
+keep `signed-jws` enabled. Startup rejects a duplicate or unknown value and
+rejects any list that drops the signed default.
+
+The two lists are intersected and never unioned. A format is releasable only
+where the bundle and the one complete matched grant both name it, so enabling a
+format bundle-wide grants nothing by itself, and a grant cannot widen beyond the
+bundle. Requesting a format outside the intersection is refused with the
+ordinary `not_authorized` problem before credential acquisition and source
+access, and the refusal does not reveal which layer withheld it. An `Accept`
+that names no known format at all, or that is duplicated, combined,
+parameterized, or weighted, returns `response_format_not_acceptable` with HTTP
+406, also before source access.
+
+```yaml
+# the immutable bundle: the ceiling
+responseFormats: [signed-jws, sd-jwt-vc]
+
+# the grant: the actual authority, never wider than the bundle
+- requirement: urn:example:requirement:adult-status:v1
+  purpose: eligibility
+  audienceFrom: authenticated-requester
+  responseFormats: [signed-jws, sd-jwt-vc]
+```
+
+The requester selects among enabled formats with an exact `Accept`:
+`application/jose+json` (or a missing `Accept`, or `*/*`) for the signed
+default, `application/vnd.registrystack.evidence-unsigned+json` for the visibly
+unsigned envelope, `application/dc+sd-jwt` for the SD-JWT VC. Selection never
+changes evaluation, disclosure, or audit obligations. Each release records its
+own `responseProtection` in the disclosure-release audit event, with the closed
+values `signed`, `unsigned`, and `sd-jwt-vc`; `signingKeyId` is present for the
+two cryptographically protected modes and forbidden for unsigned output.
+
+Enabling `sd-jwt-vc` adds a serialization, not a credential lifecycle. There is
+no issuance session, holder binding ceremony, status list, revocation, or
+presentation verification, and `/.well-known/jwt-vc-issuer` publishes no
+per-requester or per-requirement information. The `vct` claim is the
+requirement's declared `isConformantTo` identifier, so the credential type is a
+governed bundle decision rather than a client choice. The subject identifier
+stays the audience-scoped pseudonym, so the same person requested for a
+different audience yields a different identifier and the credential is not a
+general-purpose multi-verifier credential.
+
+A request may carry an optional `holderKey`, which is echoed into the `cnf`
+claim and is meaningful only for the SD-JWT VC format. Only a public OKP
+Ed25519 JWK is accepted; an unacceptable key is rejected as a malformed request
+alongside the nonce check, before authentication, credential acquisition, and
+source access. The key never reaches authorization, selectors, Rhai, sources,
+audit, or the signed-JWS payload. Evidence issues no key-binding JWT, requires
+none, and verifies none, so `cnf` is an unverified caller-supplied
+convenience for whatever presentation layer the operator runs elsewhere.
+
+Signing failure remains fail-closed for every protected format. A deployment
+that cannot sign returns a safe transient failure and never downgrades an
+SD-JWT VC request to unsigned output or to the signed default.
+[The SD-JWT VC demo](SD-JWT-VC-DEMO.md) exercises this whole path locally.
+
+## Secrets and keys
+
+Source credentials and private signing material are supplied only through the
+supported secret-reference mechanism. They do not appear in YAML values,
+Rhai, command arguments, environment dumps, logs, audit, errors, snapshots,
+or generated contracts. Private key parsing uses an explicit algorithm
+allowlist. Missing or failed signing is fail-closed and never releases an
+unsigned success response.
+
+The operator configures one active signing key and retains each retired public
+key in the published JWKS for at least the maximum assertion validity plus
+allowed clock skew. The JWKS is discovery, not a trust anchor. Verifiers obtain
+the provider identity and JWKS location through governed configuration, pin
+that trust, allowlist the expected algorithm, and resolve `kid` only within the
+trusted key set. They never follow a message-provided remote key URL.
+
+A valid signature proves that the technical provider controlling the key signed
+the exact payload. It does not prove the source fact is true, confer legal
+notarization, create a qualified electronic signature, or create a holder
+credential. Governance establishes the provider's authority to act for the
+named legal issuer.
+
+## Source and selector controls
+
+Each subject role admits only named selector profiles from the trusted bundle.
+Each profile has one exact deployment-defined scalar field set, byte and
+aggregate bounds, permitted value origin, and fixed source placement.
+Alternative sufficient inputs and additional disambiguators are separate named
+profiles. A national identifier is optional and possession of any selector
+value never creates authority.
+
+The authoritative provider owns record lookup. Evidence accepts only
+`match`, `no_match`, or `ambiguous`; only `match` carries facts. Evidence does
+not fetch broad candidates, follow pages, score candidates, choose a provider
+record, or expose counts, records, confidence, near-match hints, or per-field
+diagnostics. A reviewed deterministic derivation may compare its explicitly
+declared authorized selector fields with complete facts from one uniquely
+resolved authoritative record. When count plus one minimized result is unavailable, the fixed
+request may retrieve at most two minimally projected results solely to detect
+ambiguity.
+
+Every source declares its acquisition posture. Requirements inherit the
+posture of their configured source:
+
+| Posture | Operator claim |
+|---|---|
+| `source-derived` | Full acquisition and disclosure minimization |
+| `field-projected` | Strong acquisition and disclosure minimization |
+| `record-transformed` | Disclosure minimization only |
+
+The operator must not describe a `record-transformed` integration as full
+lifecycle minimization. Rust applies every source's extended JSON Pointer
+projection after bounded JSON parsing and before extraction, but the posture
+describes the pre-projection wire response. The fixed request mock must prove
+provider-specific field selection where claimed. A provider whose wire response
+cannot be closed at that boundary must use `record-transformed`, even when
+local projection and Rhai emit only narrow facts.
+
+Bundle-fixed headers cannot set authentication, routing, cookies, framing,
+forwarding, proxy, or tracing fields. Selector-bound path placeholders occupy
+complete segments and Rust expands them directly from already authorized
+selectors. Scripts render only query pairs and one JSON body.
+
+A source may name a logical TLS trust profile. `runtime.yaml` binds it to one
+bounded PEM CA file. Hostname and fixed-origin verification remain mandatory;
+there is no insecure or trust-all mode. Version 1 ignores `HTTP_PROXY`,
+`HTTPS_PROXY`, `ALL_PROXY`, and `NO_PROXY` and has no application-level proxy.
+
+## Audit and operational data
+
+The configured audit sink must durably accept the access-attempt event before
+the first evidence-data source read. It must durably accept the
+disclosure-release event after signing and before response release. Either
+failure blocks the applicable action.
+
+Audit contains reviewed identifiers and decision categories, never raw
+selector values, per-field selector hashes, source values, Supported Values,
+credentials, tokens, or raw subject identifiers. When correlation is required,
+one keyed, domain-separated, versioned pseudonym covers the complete canonical
+role, selector-profile identifier, ordered field names, and selector value
+bundle. It must not be globally stable across purposes or audiences.
+
+Operational logs contain route templates, operation identifiers, duration,
+status category, and safe internal error categories only. Request bodies,
+selector profile identifiers and values, source requests and responses,
+authority grants, Rhai inputs, credentials, tokens, and disclosed values are
+excluded from logs, metrics, traces, snapshots, panics, and errors.
+
+Audit and operational logging are separate channels and operators must not
+confuse them. The audit chain is the accountability record: durable, complete,
+tamper-evident, and it has no severity levels and no way to turn records off.
+Both records every request writes, the access-attempt event durable before any
+source read and the disclosure-release event durable before response release
+as described above, are pinned by frozen Version 1 security invariants and are
+not configurable. The `tracing` channel is the operational and diagnostic
+record: it has levels, it is buffered and lossy, and it is cheap. The rule for
+operators and integrators is: accountability facts belong in the audit chain
+and never only in tracing, and operational noise belongs in tracing and never
+in the audit chain. If an adopter needs more detail than the frozen audit
+record carries, which some regulators require, the correct shape is a separate
+operational log keyed by the audit record's `eventId`, not a verbosity setting
+on the chain.
+
+The serving process writes those records as line-delimited JSON on standard
+output, one per served request, and `EVIDENCE_LOG` selects verbosity with a
+default of `info`. Offline commands print their own result and emit no
+operational records. Every response, including responses to unrouted paths,
+carries the request's operation identifier in `X-Request-Id`; it is minted by
+Evidence and never taken from an inbound header, so a caller reporting a
+problem can quote an identifier the operator can find without disclosing
+anything about the request.
+
+Telemetry is off by default. Setting `metricsListener` in `runtime.yaml` serves
+`GET /metrics` in Prometheus text format on a second private binding, which must
+differ from the evidence listener binding and is subject to the same
+loopback-or-private-address rule. The evidence listener never serves `/metrics`,
+and the metrics listener never serves evidence. Series carry only the registered
+route template, request method, status category, and reviewed problem code, so
+series cardinality is bounded by the deployed contract and cannot grow with
+caller input. A path that matches no route is counted as `unmatched` and a
+method outside the served set as `other`, so a caller cannot write a label
+value. Operators should still reach this listener only from their own network,
+since request rates per route are operational information. The series and
+labels it publishes are in [Metrics reference](#metrics-reference).
+
+The operator owns audit retention, backup, restore, access control, key
+rotation, and chain verification for the selected durable sink. A deployment
+profile may require more reviewed metadata or retention, but it cannot silently
+weaken the native privacy contract.
+
+Exactly one Evidence process may write a given audit path. The sink takes an
+exclusive OS advisory lock on `<auditStorage.path>.lock` at startup; a second
+process pointed at the same path fails at startup with a sink-locked error
+rather than starting and corrupting the chain. The reason is structural, not
+defensive: the audit log is a keyed hash chain whose head is held in process
+memory, so two concurrent writers would interleave records and destroy tamper
+evidence. Deployment shape follows from this: one replica per audit path,
+active/passive rather than active/active. Use a readiness probe and
+restart-on-failure to recover from a crashed writer, never a second concurrent
+replica.
+
+At process startup the runtime recovers the chain head from the newest sealed
+segment, if one exists, by reading only that segment's last record, then fully
+verifies only the active segment from that head. Restart time is therefore
+bounded by the active segment rather than by the volume of retained history:
+it does not grow as sealed segments accumulate. The accepted tradeoff is that
+corruption inside an already sealed segment is not detected at startup; only an
+out-of-band verification pass over the whole audit directory, sealed segments
+included, detects it. Steady-state appends and readiness probes validate the
+active segment's pinned identity and fingerprint plus the expected tail and
+length without rescanning the growing file. Any external replacement or
+modification of the active segment or the lock file makes readiness and future
+appends fail closed. Operators should run that out-of-band verification,
+`evidence verify-audit`, covering every segment, during backup, restore, and
+incident procedures, and on whatever cadence their audit retention policy
+requires; it is what proves sealed history was not tampered with.
+
+## Audit chain rotation and rollback
+
+`auditStorage.maximumFileBytes` is a per-segment rotation threshold, not a
+total ceiling on the chain. When an append would push the active segment past
+it, the runtime seals the active segment and opens a new one at the configured
+path, online, with no stop and no operator action. A deployment that reaches
+the threshold keeps serving: the next append rotates and continues. Total disk
+consumption is therefore unbounded, and retention, meaning how much sealed
+history stays on disk and for how long, is entirely the operator's
+responsibility; nothing in the runtime deletes or compacts a segment. The one
+exception is a single record larger than `maximumFileBytes` on its own: that
+record can never fit an empty segment, so it fails closed instead of rotating
+forever looking for room it will never find.
+
+Segments are named by where they sit in the chain, not by when they were made.
+The active segment, the one still being appended to, is always at the
+configured `<auditStorage.path>`. Each sealed segment is
+`<auditStorage.path>.<sequence>`, where `<sequence>` is an ascending,
+zero-padded, eight-digit number starting at 1, so `evidence.jsonl.00000001`
+precedes `evidence.jsonl.00000002` in both chain order and lexical order.
+`<auditStorage.path>.lock` is unchanged by any of this: it is the writer's
+advisory lock file, never a segment, and carries no chain state.
+
+The chain spans every seam between segments. The chain head lives in the
+running process's memory and survives rotation, so the first record written
+into a new active segment carries the previous segment's last record hash as
+its `prev_hash`, exactly as if no rotation had happened. A sealed segment is
+not an independently verifiable chain that starts at genesis; only the very
+first segment a deployment ever writes does that. Verifying a sealed segment on
+its own, without the head it continued from, cannot succeed and is not a
+supported operation.
+
+This makes the old stop-and-rename rotation procedure actively dangerous, and
+it must not be used. Renaming the active file to an arbitrary name such as
+`evidence-<utc-timestamp>.jsonl` moves it outside the
+`<auditStorage.path>.<sequence>` namespace the runtime recognizes, so the
+runtime never sees it as a segment of this chain. On restart, startup recovers
+the head from the newest segment still named `<auditStorage.path>.<sequence>`,
+which is now the segment before the one that got renamed away, and begins a new
+active segment continuing from that older head. The renamed-away file and the
+new active segment then both contain a record claiming the same predecessor: a
+silent fork, not a rotation, and the two branches are never reconciled.
+
+To archive sealed history, copy or hard-link sealed segments out to cold
+storage, oldest sequence first, and never touch the active segment this way. A
+sealed segment can be copied or hard-linked safely while the service keeps
+running: the runtime opens the newest sealed segment exactly once, at startup,
+to recover the chain head, and never reopens an older sealed segment
+afterward. Do not rename a copy back into the `<auditStorage.path>.<sequence>`
+namespace at a sequence that still has a segment on disk; that would collide
+with, and could overwrite, real chain history. If a sealed segment is removed
+from the audit directory once it has been archived elsewhere, record which
+sequence was removed, its byte length, and its final record hash in the
+operator change record. A removed segment leaves a gap in the sealed sequence,
+and the offline verifier reports that gap explicitly rather than treating it as
+silent history loss, but only if there is a record of what should be there to
+compare against.
+
+Prefer archiving older sealed segments and leaving the newest one in place. The
+newest sealed segment is what a restart reads to recover the chain head, so
+removing it changes what the next start believes the chain continued from. In
+the ordinary case that is caught: the active segment's first record names a
+predecessor the remaining sealed tail does not match, and startup refuses to
+begin on a fork. In the one case where it is not caught, the newest sealed
+segment and the active segment are both gone, startup recovers from an older
+sealed tail and allocates the next sequence from what is still on disk, so a
+future rotation can seal a different segment under a sequence number the
+archived one already used. Restoring that archive afterward collides with live
+history. If the newest sealed segment must be archived and removed, treat
+restoring it as part of the same procedure rather than optional cleanup.
+
+Out-of-band verification replays every segment across every seam. It is
+`evidence verify-audit`, and it reads both the audit storage path and the hash
+secret from the same runtime document and file secret provider the serving
+process uses. The command takes no path and no secret flags of its own, only
+the global `--runtime` (equivalently `REGISTRY_EVIDENCE_RUNTIME`), so it can
+never be pointed at an audit chain the deployment does not own and never takes
+a secret on a command line:
+
+```
+evidence --runtime /etc/registry-evidence/runtime.yaml verify-audit
+```
+
+A pass exits zero and prints `segments`, `records`, `sealed-sequence`, `head`,
+and `active-segment`; `sealed-sequence` is the inclusive range of sealed
+segment numbers, or `none` before the first rotation. The counts and the head
+hash carry no request content, so the report is safe to capture into an
+incident record. Any failure exits non-zero.
+
+Run against a running service, the command verifies sealed history only and
+says so in `active-segment`, because reading the active segment while a writer
+may be mid-append would race the write and risk reporting a partially written
+final record as corruption; that is expected and is not itself a finding. To
+prove the active segment too, stop the service first, as under Rollback below.
+A gap in the sealed sequence, for example sequence 3 archived and removed while
+1, 2, and 4 remain, is reported as a distinct missing-segment result naming the
+absent sequence and stating that it is not corruption, so an operator can tell
+deliberate archival apart from tampering. A genuine hash break, in the head
+continuity between two adjacent sealed segments or within one segment's
+records, is reported as chain verification failure and means exactly what it
+always has. The same check is available to governed tooling built on the
+runtime as the library call `verify_audit_chain`, which reports the equivalent
+`first_sequence`, `last_sequence`, and `active_verified` fields directly.
+
+Rollback divides into restoring sealed history and restoring the active
+segment, and only the second needs the service stopped. If a sealed segment was
+archived and removed and needs to come back, copy or hard-link it back to its
+original `<auditStorage.path>.<sequence>` name, unmodified; this is safe to do
+live, for the same reason archiving is, since the runtime does not reopen old
+sealed segments after startup. Restore from a copy whose byte length and final
+record hash match what was recorded when it was archived, and re-run the
+offline verifier afterward to confirm the gap has closed. Restoring or
+replacing the active segment is different, because the running writer pins that
+file by identity and inode: any replacement underneath a live process is
+rejected by the sink's own pinned-identity check, and readiness and the next
+append both fail closed rather than continuing on a file the process no longer
+recognizes. To do it safely, stop the service first, with SIGTERM, which is
+what a service manager and a container runtime both send, or with Ctrl-C for an
+interactive process; the server stops accepting connections, finishes the
+evaluations already admitted, completes their audit writes, and exits
+successfully, and `listener.shutdownGraceMilliseconds` is the operational
+target for that drain rather than a cancellation boundary. Confirm the process
+has exited, which is also what releases the exclusive advisory lock on
+`<auditStorage.path>.lock`; that lock is why only one Evidence process can ever
+write this chain, still held for the writer's whole life, and it is the
+structural reason a second writer is refused rather than merely discouraged.
+With the service stopped, replace the file at `<auditStorage.path>` with the
+restored content, preserving owner and mode `0600`, and start the service
+again. Startup recovers the head from the newest sealed segment's tail as
+always and verifies only the restored active segment against it, which proves
+the restored file continues the chain correctly but proves nothing about sealed
+history; run `evidence verify-audit` over the whole audit directory before
+restoring traffic if the incident could plausibly have touched a sealed segment
+too, while the service is still stopped so the active segment is proven as
+well. Never restore an active segment that a later process has already
+appended to: its first record's `prev_hash` would no longer match the sealed
+tail, and the runtime refuses to start on the resulting fork rather than
+silently accepting it.
+
+## Metrics reference
+
+This section describes what a configured `metricsListener` serves. It is
+operator material: the public evidence contract and the generated OpenAPI
+document do not describe it, and a deployment that leaves `metricsListener`
+absent serves none of it.
+
+```yaml
+metricsListener:
+  bindHost: 127.0.0.1
+  port: 9090
+```
+
+`bindHost` accepts a numeric loopback, RFC 1918 private IPv4, or RFC 4193
+unique-local IPv6 address. Hostnames and unspecified, multicast, and public
+addresses are rejected at startup, as is a `bindHost` and `port` pair that
+repeats the evidence listener binding. Both listeners bind before either
+serves, so a rejected telemetry binding fails startup rather than leaving a
+service that reports healthy while publishing nothing. The two share one
+lifecycle: the telemetry listener cannot outlive a failed evidence listener.
+
+The listener serves `GET /metrics` and answers every other path with `404`,
+including the evidence routes. The exposition is Prometheus text format,
+declared as `Content-Type: text/plain; version=0.0.4`. Two series are
+published:
+
+| Series | Type | Meaning |
+|---|---|---|
+| `evidence_http_requests_total` | counter | Requests served at the evidence boundary |
+| `evidence_http_request_duration_seconds` | histogram | Duration of those requests |
+
+The histogram publishes `_bucket`, `_sum`, and `_count`. Its upper bounds in
+seconds are `0.005`, `0.01`, `0.025`, `0.05`, `0.1`, `0.25`, `0.5`, `1.0`,
+`5.0`, and `+Inf`. They are fixed by the build and are not configurable.
+
+Both series carry the same four labels, and each is drawn from a closed set
+fixed by the deployed contract rather than by anything a caller sends:
+
+| Label | Values |
+|---|---|
+| `route` | A registered route template, otherwise `unmatched` |
+| `method` | `GET`, `POST`, `HEAD`, `OPTIONS`, otherwise `other` |
+| `status` | `success`, `client_error`, `server_error` |
+| `error` | A reviewed problem code, otherwise `none` |
+
+The registered route templates are `/v1/evidence`,
+`/v1/evidence-definitions`, `/health`, `/ready`, `/openapi.json`,
+`/.well-known/evidence/jwks.json`, and `/.well-known/jwt-vc-issuer`. The
+reviewed problem codes are the closed public set: `malformed_request`,
+`invalid_selector`, `authentication_failed`, `not_authorized`,
+`response_format_not_acceptable`, `evidence_not_available`, `rate_limited`,
+`dependency_unavailable`, and `service_unavailable`.
+
+`status` is the outcome class and never the exact status code, because the
+exact status of a denial belongs to the closed public problem contract rather
+than to operational telemetry. `error` carries the same reviewed problem code
+the caller received, which makes a denial rate observable without making the
+reason for any one request observable.
+
+Because both label sets are closed, series cardinality is bounded by the route
+table and the problem-code set regardless of traffic, and the registry needs no
+eviction. A caller cannot create a series or write a label value: a path
+matching no route is counted as `unmatched` and the requested path is never
+recorded anywhere in the exposition.
+
+An abbreviated exposition:
+
+```text
+# HELP evidence_http_requests_total Requests served by the Evidence boundary.
+# TYPE evidence_http_requests_total counter
+evidence_http_requests_total{route="/health",method="GET",status="success",error="none"} 2
+evidence_http_requests_total{route="/v1/evidence-definitions",method="GET",status="client_error",error="authentication_failed"} 1
+# HELP evidence_http_request_duration_seconds Request duration at the Evidence boundary.
+# TYPE evidence_http_request_duration_seconds histogram
+evidence_http_request_duration_seconds_bucket{route="/health",method="GET",status="success",error="none",le="0.005"} 2
+evidence_http_request_duration_seconds_sum{route="/health",method="GET",status="success",error="none"} 0.000241
+evidence_http_request_duration_seconds_count{route="/health",method="GET",status="success",error="none"} 2
+```
+
+The registry lives in process memory. A restart resets both series to zero,
+which a `rate` or `increase` query handles under the ordinary counter-reset
+rule. Version 1 neither persists counters nor pushes them anywhere.
+
+The telemetry listener performs no authentication of its own. The private
+binding and the operator's own network are the only access controls, so the
+operator must not route it through a public ingress or a shared scrape network.
+Request rates per route and per problem code are operational information about
+the registry even though no individual request is described.
+
+The accepted address range is therefore a floor, not a boundary. Startup
+rejects the mistake that actually exposes telemetry, a public or unspecified
+`bindHost`, but an accepted RFC 1918 or unique-local address only means the
+endpoint is unreachable from the public internet. On a flat pod network or a
+shared VPC every workload already holds such an address, so binding one there
+makes the endpoint scrapable by every neighbouring workload. `127.0.0.1` with
+a same-pod or same-host collector is the shape that keeps the operator
+boundary the operator intended; any wider binding must be closed by a network
+policy, and the operator owns that control.
+
+The two request-boundary series above describe the HTTP boundary only. Version
+1 publishes no source-call, signing, credential-acquisition, or audit-sink
+series. A slow or failing upstream source is visible only as evidence-request
+duration and as the problem code the boundary returned; audit, signing, and
+source-credential health are reported by `/ready` rather than by telemetry.
+
+A third series, `evidence_rate_limiter_tracked_keys`, is also published on the
+same listener: a gauge reporting the current number of tracked rate-limit
+keys. It carries none of the four request-boundary labels, since it reports a
+process-wide capacity fact rather than a per-request outcome. Operators should
+alert on it approaching the 100,000-key ceiling described under
+[requester authority and purpose](#requester-authority-and-purpose), since a
+deployment at that ceiling refuses new principals with a capacity error rather
+than degrading gracefully.
+
+## Startup and readiness
+
+Before production exposure, the operator runs:
+
+```sh
+evidence check
+evidence evaluate --fixture "<path>"
+```
+
+All commands accept `--runtime <absolute-path>`. The same path may be supplied
+through `REGISTRY_EVIDENCE_RUNTIME`; the reference default is
+`/etc/registry-evidence/runtime.yaml`. That file supplies the absolute
+`bundleDirectory`. Command-line or environment values cannot override governed
+bundle fields. The runtime file, bundle directory, and every captured artifact must
+be non-writable to the service process. Evidence Version 1 supports Unix targets
+only because its secret and audit invariants require owner, mode, no-follow,
+link-count, and open-file identity checks. A read-only mount is preferred;
+directories use no write bits and files use no write bits. Fixture
+paths are normalized, bundle-relative `fixtures/*.yaml` paths referenced by
+exactly one requirement. A fixture path may be absent only under the explicit
+local assurance profile.
+
+The reference file-secret provider reads only regular, non-symlink files below
+the configured `secretProviders.file.root`. The secret root is operator-only and
+each secret file must be owned by the service identity with mode `0600`.
+Audit and subject-binding secret files contain independently generated raw key
+bytes and must each be at least 32 bytes. They are not decoded as base64 by the
+file provider. Source credentials retain their provider-defined lexical form.
+Signing material is an Ed25519 private JWK whose `kid` exactly matches
+`signing.activeKeyId`; only the public current key and configured retired public
+keys appear at the JWKS endpoint. The audit JSONL path must be on storage whose
+append durability, permissions, capacity, backup, restore, retention, and keyed
+chain verification the operator owns.
+
+`evidence check` validates and compiles the complete bundle, and resolves and
+validates the mounted audit, subject-binding, and signing secret material
+exactly as startup does, without opening the audit chain. A deployment whose
+secret material startup would refuse, including a signing key whose `kid` does
+not match `signing.activeKeyId`, fails check. Source credentials are not
+resolved by check; readiness owns them. Fixture evaluation
+covers positive, negative, boundary, missing-data, source-failure,
+existence-disclosure, and anti-reconstruction behavior without a running
+source.
+
+For `assuranceProfile: local`, supervised Mint may use the exact canonical
+issuer origin `http://127.0.0.1:<non-zero-port>` only when `jwksUri` is the
+same origin plus `/.well-known/jwks.json`. Production and evidence-grade, and
+every other authentication location, remain HTTPS-only.
+
+`disclosureGuard.families` is a trusted bundle-review attestation, not a
+domain-semantic classifier. The runtime rejects two simultaneously enabled
+requirements with the same declared family. It cannot infer that differently
+labelled families are semantically equivalent without adding forbidden domain
+policy to the generic core. Operators must therefore review the complete
+bundle for threshold ladders, overlapping partitions, relationship graphs, and
+equivalent definitions before assigning distinct family identifiers. The
+anti-reconstruction fixtures record that reviewed decision.
+
+`observed_at` is supplied by the runtime and normalized to UTC. Rust derives
+`legal_local_date` and `legal_local_time` from the requirement's optional IANA
+`observationTimezone`; omission uses UTC. Requirements whose result depends on
+local legal time should declare the timezone explicitly and include fixtures
+on both sides of relevant date, time, daylight-saving, and offset boundaries.
+
+The operator starts the reviewed revision with:
+
+```sh
+evidence serve
+```
+
+Startup confirms that the immutable bundle compiled, runtime ownership and
+every local path/trust binding validated, mounted secret files and signing
+material parsed, and the audit chain opened and verified. Readiness rechecks
+the subject-binding key, signing provider, pinned audit sink, and every source
+credential. Basic, static Bearer, and static API-key credentials are checked
+locally. OAuth client-credentials readiness performs its bounded token
+bootstrap against the configured token endpoint.
+An explicit local source with `authentication.kind: none` has no credential
+check or bootstrap and sends no authentication header. Production and
+evidence-grade bundles reject that source kind at startup.
+Neither startup nor readiness sends an evidence-data request or probes a source
+data endpoint. Readiness
+fails when a required local runtime or bundle input, selector binding,
+credential, CA binding, audit dependency, or signing dependency is absent,
+mutable, or invalid.
+
+The access-token issuer's `jwksUri` is retrieved once at startup and again on
+each readiness check, subject to the verifier cache lifecycle and a short
+suppression interval after a failure. Both report and neither refuses: a
+`jwksUri` that cannot be used is named in the log at startup rather than
+discovered one rejected request at a time, but the issuer is a shared
+dependency this deployment does not own, so an issuer outage does not withhold
+its readiness or prevent it from starting. A key set already retrieved keeps
+being accepted for a bounded allowance past its cache lifetime while the issuer
+is unreachable, so a brief issuer outage does not turn into total rejection
+here; once that allowance runs out, every request is rejected with the same
+closed `401` a bad token receives, and the reason appears only in this
+deployment's log.
+
+The native operations are:
+
+```text
+GET /v1/evidence-definitions
+POST /v1/evidence
+GET /health
+GET /openapi.json
+GET /ready
+GET /.well-known/evidence/jwks.json
+GET /.well-known/jwt-vc-issuer
+```
+
+`GET /openapi.json` publishes the generated public contract as
+`application/openapi+json`. It carries no credential requirement because the
+served bytes are the released generated artifact: the same document shipped in
+`products/evidence/generated/`, independent of the deployed bundle.
+
+A successful `GET /v1/evidence-definitions` response uses `application/json`
+and the closed requester-scoped definition schema. It requires the same strict
+Bearer authentication profile and per-principal request budget as evidence
+creation.
+
+A successful `POST /v1/evidence` response uses `application/jose+json` and the
+flattened JWS JSON Serialization unless the requester selected another enabled
+format under [response formats](#response-formats). No public or
+cross-requester catalog is supported.
+
+`GET /.well-known/jwt-vc-issuer` is unauthenticated discovery for the SD-JWT VC
+format. It publishes the configured provider identity and the same public key
+set as `/.well-known/evidence/jwks.json`, and nothing else. It is served
+whether or not any grant enables the credential format, it never reveals which
+requesters or requirements do, and it is discovery rather than a trust anchor
+on exactly the terms in [secrets and keys](#secrets-and-keys).
+No-match and ambiguous outcomes are publicly indistinguishable by default.
+Source, signing, and dependency failures use stable safe problem codes and do
+not reflect protected inputs. Signing failure returns a safe transient failure.
+
+Every authorization refusal collapses to one generic `not_authorized` problem
+(code `n`) with HTTP 403 and reveals no layer detail: a principal outside the
+bundle audience, a requirement no matched grant permits, an authority the grant
+does not carry, and an unsigned-envelope request the bundle or grant does not
+allow all return the same body. This is deliberate; the response is not an
+oracle for which check failed. Because the wire response is intentionally
+uninformative, operators debug a 403 from trusted local state, not from the
+response. Confirm, in order: the Bearer principal is in the deployed bundle's
+audience; a grant matches the requested requirement, purpose, and subject
+roles; the grant carries the claimed authority; and, only for an unsigned
+request, both the bundle and that grant permit
+`application/vnd.registrystack.evidence-unsigned+json`. The keyed audit chain
+records the refusal phase for after-the-fact diagnosis; the caller never sees
+it.
+
+## Measured throughput
+
+One end-to-end measurement is kept in the repository so capacity planning
+starts from a number rather than an estimate. It drives the real router over
+real sockets, and every request in it runs token verification, rate limiting,
+Rhai request preparation, one outbound source call, Rhai extraction, evidence
+construction, Ed25519 signing, and both durable audit appends.
+
+| Measurement | Value |
+|---|---|
+| Sustained rate | 7057 requests/second |
+| Audit appends | 14 115 appends/second (two per request) |
+| Latency p50 / p95 / p99 | 17.89 / 21.37 / 23.03 ms |
+| Non-2xx responses | 0 |
+| Offered concurrency | 128 requests in flight, 128 principals |
+| Window | 10 s measured, after a 3 s unmeasured warm-up |
+| Host | Apple M5 Max, 18 logical cores, macOS 26.4.1, optimized build |
+| Date | 2026-08-03 |
+
+Reproduce with:
+
+```bash
+cargo test --release -p registry-evidence --lib -- \
+  --ignored --nocapture sustained_load_holds_one_thousand_requests_per_second
+```
+
+The row records one run. An independent repeat of it on the same host measured
+6976 requests/second at a p50 of 17.75 ms, so treat the rate as carrying about
+a percent of run-to-run variation rather than as an exact figure. The same
+check passes on an unoptimized build at 3183 requests/second with a p50 of
+40.11 ms.
+
+The measurement is only meaningful if the upstream source is not the thing
+being measured, so the harness serves it from a minimal in-process handler
+returning one constant JSON body and measures that handler's own standalone
+ceiling in the same run, under the same client, worker count, header set, and
+window. That ceiling was 145 273 requests/second, 20.6 times the Evidence
+rate. The check refuses to report a pass or a failure below 5 times, and
+reports the run as inconclusive instead.
+
+Latency here is a closed-loop consequence of the offered concurrency: 128
+requests in flight at 7057 requests/second is about 18 ms each. A deployment
+offering less concurrency sees lower latency and a lower rate. The audit sink
+commits in groups, so its rate rises with the number of appends in flight and
+falls sharply when few are; a deployment that expects high throughput must let
+requests overlap.
+
+The harness lifts four production-meaningful defaults that would otherwise
+become the thing measured, and lifts them only in its own temporary copy of
+the fixture bundle: the per-principal rate limits, `maximumConcurrentRequests`,
+each source's outbound `concurrencyLimit`, and the audit segment's
+`maximumFileBytes`. Those raised values are measurement scaffolding, not a
+recommended deployment posture. Keep the shipped defaults and tune from
+observed traffic.
+
+## Capacity planning
+
+The measured rate above is one host with one constant source. Sizing a real
+deployment is a matter of finding which ceiling binds first, and for most
+deployments it is not Evidence.
+
+Outbound source concurrency binds first whenever the provider is slower than
+the in-process handler used for measurement. Each source's `concurrencyLimit`
+is the number of requests Evidence will have outstanding to that source at
+once, so sustained throughput through it is about `concurrencyLimit` divided by
+the source's round-trip latency. A `concurrencyLimit` of 8 against a provider
+answering in 20 ms sustains roughly 400 requests/second, and Evidence being
+capable of thousands changes nothing about that. The field accepts 1 to 256 and
+has no default: every bundle states it explicitly, because the right value is a
+claim about what the provider tolerates rather than a number Evidence can pick.
+Raising it moves load onto the provider, so raise it against the provider's own
+documented or agreed limit, not against Evidence's spare capacity.
+
+`listener.maximumConcurrentRequests` is the admission ceiling, from 1 to 4096.
+It is a semaphore over evaluations already accepted, not a connection limit and
+not an instant refusal: a request arriving with every slot taken waits for one
+within whatever remains of `listener.requestTimeoutMilliseconds`, and receives
+a `503` problem response only if the budget runs out first. Two sizing errors
+follow from that. Set well below the source concurrency, it leaves provider
+capacity unused, since Evidence will not have enough evaluations in flight to
+keep the source busy. Set far above what the sources can absorb, it does not
+add throughput; it converts overload into queueing, which the caller sees as
+rising latency and then as timeouts. Size it near the total concurrency the
+configured sources can actually sustain, and treat `requestTimeoutMilliseconds`
+as the decision about how long a caller should wait before being turned away.
+
+Two ceilings are not configured fields. Worker threads follow the host's
+available parallelism, so vertical scaling changes the ceiling that CPU-bound
+work, signing and Rhai evaluation, imposes; the runtime document does not carry
+a thread count. Offered concurrency is not yours at all: it is what callers
+send. The levers here bound what is admitted and what is dispatched onward,
+never how much arrives.
+
+Throughput below expectations is therefore diagnosed by finding the binding
+ceiling before changing anything, and the `error` label on
+`evidence_http_requests_total` separates the three rejections: `rate_limited`
+is the per-principal limiter, `service_unavailable` is the request timeout
+budget running out, which under load is normally a request that never got an
+admission slot, and `dependency_unavailable` is the source failing rather than
+merely being slow. A saturated but healthy source produces
+none of those. It appears only as `evidence_http_request_duration_seconds`
+rising while the request count stays flat, because Evidence is waiting on the
+provider and reporting success when the answer arrives; confirming that
+diagnosis needs source latency observed at the provider, which is why the
+`concurrencyLimit` arithmetic above is worth doing before traffic rather than
+after. Because the audit sink commits in groups, a deployment held to few
+requests in flight also pays a higher per-record audit cost than the table
+above, which is a consequence of the low concurrency rather than a separate
+problem to tune.
+
+## Verification and release limit
+
+A relying party or operator re-verifies a stored signed response offline with
+`evidence verify --jws <file> --jwks <file> --policy <file> [--at <rfc3339-utc>]`.
+The pinned JWKS file is the complete trust set and the policy document carries
+every expectation from independent trusted state: the retained request nonce,
+the expected assurance profile, role-bound subject bindings, and output contract,
+under
+[`contracts/verification-policy.schema.yaml`](contracts/verification-policy.schema.yaml).
+The command performs no network access, reports cryptographic authenticity
+separately from current validity, and exits 0 only when both hold; an
+authentic but expired response exits 3. Every failed policy comparison reports
+one generic class so verification is not an oracle.
+
+Operators must verify a candidate revision with the applicable phase and final
+commands in [AGENTS.md](AGENTS.md). Public-demo source tests are optional,
+ignored, read-only, local, and non-gating. They may run only after deterministic
+mocks pass and only with approved synthetic selectors and securely stored
+credentials under [the source-testing contract](SOURCE-TESTING.md).
+
+Evidence Version 1 is releasable only when all four coequal acceptance
+definitions pass the complete offline and HTTP path, all Definition of Done
+rows are green on one revision, generated contracts reproduce exactly, and the
+security acceptance matrix is reviewed. Implementation stops at that boundary.
+Future profiles require a separately approved concept and plan.
diff --git a/products/evidence/PERFORMANCE.md b/products/evidence/PERFORMANCE.md
new file mode 100644
index 000000000..64ebfae25
--- /dev/null
+++ b/products/evidence/PERFORMANCE.md
@@ -0,0 +1,137 @@
+# Evidence Performance
+
+Status: Measured, with group commit implemented; not a Version 1 contract
+Date: 2026-08-03
+
+## Purpose
+
+Evidence trades request throughput for audit durability. This file records what
+that trade costs, how it was measured, and the change that recovered most of
+the cost without weakening the guarantee: group commit in the audit sink,
+implemented by `DurableSegmentedAuditLog` in `registry-platform-audit` and used
+through Evidence's event boundary in `crates/registry-evidence/src/audit.rs`.
+The current end-to-end measurement lives in `OPERATOR-CONTRACT.md` under
+"Measured throughput". Nothing here is a Version 1 commitment. Throughput is
+not a Definition of Done row and is not a `CONCEPT.md` non-goal.
+
+## The guarantee that sets the ceiling
+
+The security invariant matrix requires that the disclosure-release record be
+durably accepted before the response bytes reach the caller, and that the access
+record be durably accepted before source access. `DurableSegmentedAuditLog`
+implements this by assigning keyed chain positions under a short in-memory
+lock, then calling `sync_all` for the batch that contains each append before
+that append resolves.
+
+The result is two append durability obligations per successful request. Their
+barriers are serialized, but concurrent requests can share one barrier.
+
+The legacy shared `JsonlFileSink` ends its append at `write_all` plus `flush`
+and does not provide this durability contract. Evidence and Mint now use the
+shared non-destructive durable segmented engine instead. This section records
+the historical Evidence ceiling that motivated adding group commit to that
+engine.
+
+## Measured baseline before group commit
+
+This section records the measurement that motivated group commit and is kept
+as the before-figure. Measured with
+`soak_reports_request_throughput_against_the_audit_ceiling` in
+`crates/registry-evidence/src/runtime_tests.rs`. Two release-profile runs, 512
+requests at 32 concurrent, against a local mock source, with each append
+taking its own barrier:
+
+| | run 1 | run 2 |
+|---|---|---|
+| Observed request rate | 122 rps | 161 rps |
+| Measured audit ceiling | 131 rps | 163 rps |
+| Mock source floor | 57,461 rps | 77,256 rps |
+| Latency p50 / p95 / p99 | 260 / 293 / 308 ms | 196 / 212 / 225 ms |
+| Share of audit ceiling | 93% | 99% |
+
+Host: Apple M5 Max, 18 logical cores, APFS, macOS.
+
+Attribution is unambiguous. The source served roughly 450 times faster than the
+observed request rate, so it contributes nothing. Observed throughput sits at 93
+to 99 percent of what the audit chain can sustain. Little's law agrees from the
+other side: 32 concurrent divided by 161 rps is 199 ms against a measured 196 ms
+p50, so nearly all request latency is queueing on the audit mutex rather than
+work.
+
+Per-append cost is 3.1 to 3.8 ms.
+
+### Why this number is pessimistic
+
+On macOS, `File::sync_all` issues `F_FULLFSYNC`, a true device write barrier. On
+Linux the same call is an ordinary `fsync`, which on NVMe is far cheaper. **These
+figures are a macOS floor and must be re-measured on the target Linux host
+before they are quoted as production numbers or used to justify the work below.**
+
+## Horizontal scaling works today
+
+`DurableSegmentedAuditLog::initialize` takes an exclusive `flock`, so one
+process owns one audit path. Nothing else is shared between requests. N
+processes with N distinct audit paths therefore give N times the throughput
+with no code change. Only vertical throughput is capped.
+
+## Group commit
+
+The lever for vertical throughput is batching the barrier, not removing it.
+`DurableSegmentedAuditLog` in
+`crates/registry-platform-audit/src/segmented_jsonl.rs` implements this. Appends
+that arrive while a durable write is in flight form the next batch, and one
+`fsync` covers the whole batch. There is no timer and no configured window; a
+batch is exactly what queued behind the in-flight barrier, so the sink degrades
+to one barrier per append when requests do not overlap.
+
+Properties that survived the change are held by platform storage tests and
+Evidence boundary tests:
+
+- durability before release: an append resolves only after the barrier that
+  covers its own bytes has completed, so no caller receives evidence ahead of
+  its durable record;
+- chain ordering: records are hash-linked in the order they were chained, and
+  the on-disk order matches; batching must not drop or duplicate a record;
+- fail-closed: a failed barrier fails every append it covers, and none of them
+  may report success;
+- fork detection: the pinned-path, fingerprint, and tail checks in
+  `DurableSegmentedJsonlSink` bracket the batched write, and a batch that
+  crosses the segment bound is split so each segment stays self-consistent.
+
+The gain scales with concurrent arrivals rather than helping a single idle
+request. With group commit in place, the end-to-end measurement in
+`OPERATOR-CONTRACT.md` under "Measured throughput" sustained 7057
+requests/second at 128 concurrent on the same host class that measured the
+baseline rows in this file, with both durable audit appends per request kept.
+
+The macOS caveat still applies to every figure in this file and in
+`OPERATOR-CONTRACT.md`: re-measure on the target Linux host before quoting
+production numbers.
+
+## Regression baseline
+
+The principal regression tests cover both shared storage and its Evidence use:
+
+- `keyed_log_group_commit_rotates_and_the_stopped_visitor_replays_it` proves
+  the platform coordinator batches concurrent appends, rotates online, and
+  replays the exact verified stopped chain.
+
+- `concurrent_evidence_requests_keep_one_verifiable_audit_chain` runs in CI. It
+  drives simultaneous evaluations and asserts one verifiable chain, two records
+  per release, and a distinct evidence identity per request. Any interleaving or
+  forking under concurrency fails it.
+- `soak_reports_request_throughput_against_the_audit_ceiling` is `#[ignore]` and
+  opt-in. It reports rates and asserts only correctness, because throughput
+  thresholds are host properties and would otherwise be a source of flakes:
+
+```bash
+cargo test -p registry-evidence --lib --release -- --ignored --nocapture soak_reports
+```
+
+Record the host alongside any figure taken from it.
+
+## Not measured
+
+The legacy shared `JsonlFileSink` was read, not benchmarked. Any claim that it
+is materially faster on this axis is inference from the absent `sync_all`, not
+a measurement.
diff --git a/products/evidence/README.md b/products/evidence/README.md
new file mode 100644
index 000000000..abeaa0433
--- /dev/null
+++ b/products/evidence/README.md
@@ -0,0 +1,297 @@
+# Evidence
+
+Status: implemented Version 1 contracts, runtime, reference deployments, and
+reproducible Evidence-specific verification gates.
+
+Evidence is a greenfield, sector-neutral minimum-disclosure assertion service.
+Given authenticated authority, an authorized purpose, a predefined requirement,
+and the configured selector data needed by an authoritative provider, it returns
+the smallest sufficient JSON assertion in an authorized response format.
+
+The approved Version 1 product boundary is one `registry-evidence` crate, one
+`evidence` binary, one serving process, and one operator-controlled trust domain.
+A process may host multiple evidence definitions only when they share that trust
+domain. Governed configuration, Rhai scripts, schemas, codelists, and fixtures
+are one trusted, immutable, startup-only evidence bundle. A separate closed
+runtime file owns only process-local listener, filesystem, audit-storage,
+secret-mount, and TLS-trust bindings and cannot override governed semantics.
+
+The following contracts define and verify the implemented Version 1 boundary:
+
+- [Product concept](CONCEPT.md): product boundary, data model, trust and privacy
+  invariants, native API, and Version 1 acceptance set.
+- [Implementation schedule and Definition of Done](IMPLEMENTATION.md): phases,
+  exit gates, required tests, verification, and stop boundary.
+- [Source-testing contract](SOURCE-TESTING.md): deterministic mock matrix,
+  optional public-demo smoke tests, credential handling, and failure
+  interpretation.
+- [Operator contract](OPERATOR-CONTRACT.md): supported deployment shape,
+  requester authority and purpose duties, required configuration and secrets,
+  readiness, audit, key, and verification obligations.
+- [SD-JWT VC demo](SD-JWT-VC-DEMO.md): one deterministic local run that issues
+  the same assertion in both later-verifiable formats and re-verifies the
+  credential offline with `curl` and the `evidence` binary.
+- [Trusted request-adapter reference](reference/request-adapter/ADAPTER-API.md):
+  complete Rhai API, configuration and fixture contracts, and deployable DHIS2
+  and OpenCRVS-shaped reference projects.
+
+Any normative schemas, examples, and generated public artifacts live in their
+own tracked contract directories. Generated files must be reproduced by their
+documented generator and never edited by hand.
+
+## Version 1 boundary
+
+Version 1 supports assertion evidence through one synchronous JSON operation
+with signed flattened JWS as the mandatory default format. Rust owns
+authentication, authorization, minimized preparation
+inputs, fixed source execution, response projection, bounded Rhai execution,
+output validation, evidence construction, response protection, and audit. Rhai owns
+reviewed request query/body rendering, source extraction, and
+requirement-specific derivation using only deterministic, bounded,
+domain-neutral primitives supplied by Rust.
+
+Adult status, residence region, professional licence status, and legal-parent
+relationship are coequal full-path acceptance definitions. All four must pass
+the same offline and production path on one revision before Version 1 can be
+called implemented. None may become a Rust domain type, built-in operation,
+special route, or preferred implementation phase.
+
+Version 1 serializes the same assertion as an SD-JWT VC when the bundle and the
+matched grant both permit that response format, under the frozen profile in
+`contracts/sd-jwt-vc-profile.yaml`. It does not include documents, credential
+lifecycle, status lists, OID4VCI, presentation verification,
+nonce or replay storage beyond stateless request-nonce echo and comparison,
+server-issued challenges, OOTS execution, federation, delegated agents, MCP,
+workflow, public or federated catalogs, runtime policy, runtime bundle mutation,
+multi-source fulfillment, source planning, an application database, a message
+broker, or workers.
+
+DHIS2 and OpenCRVS are compatibility-shaped test profiles only. Their names and
+behavior may appear in tests, sanitized fixtures, test-only bundles, and local
+smoke documentation. Production Rust, Cargo metadata, public configuration,
+routes, CLI options, and generated public contracts must remain source-product
+neutral.
+
+## Adopter tooling
+
+`evidencectl`, built from the `registry-evidencectl` crate, is adopter tooling
+beside the runtime, like `registryctl` for the rest of the stack. It sits
+outside the frozen Version 1 runtime contract: it generates key material,
+starts incomplete OpenAPI-assisted authoring workspaces, compiles a reviewed
+production candidate, and drives fixture runs for complete projects. It shells
+out to the `evidence` binary for every Evidence semantic decision and never
+re-implements evaluation, signing, or verification. Its source remains covered
+by the same source-product and domain-neutrality checks as the runtime.
+
+`evidencectl new <dir> --openapi <file-or-url> --profile local` retains the
+OpenAPI document exactly as `source.openapi.yaml` and creates empty
+`questions/`, `derivations/`, and `fixtures/` directories. `--generate-keys`
+adds owner-only disposable local key material that is not bound to a runtime.
+The command does not select an API operation, invent a question, fixture,
+policy, production target, Mint configuration, or deployable bundle.
+
+`evidencectl source suggest` drafts one source from an OpenAPI description:
+it derives a closed response schema, an extraction script, and the facts schema
+from the chosen operation, the projection the operator selects, and an optional
+sample response, leaving an explicit `TODO` wherever a bound cannot be derived
+so `evidence check` rejects the draft until a human resolves it.
+
+```bash
+evidencectl source suggest --openapi ./api.yaml --project ./deployment-project
+```
+
+`--openapi` also takes the URL a description is published at, which is read
+under the same rule the runtime applies to the source URLs it will itself call:
+`https` anywhere, plain `http` only to a numeric loopback host, and never a
+credential in the URL. A description behind authentication is fetched with your
+own client and passed as a file.
+
+### Production build and handoff
+
+An authored question may include optional `governance` metadata. Local `dev`
+continues to work without it, using its explicit local defaults. When present,
+`dev` uses the declared requirement semantics while retaining local assurance
+and local authentication. A production build requires every question to carry
+that metadata, stable concept identifiers, and one project-relative fixture.
+It never invents requirement, framework, Evidence Type, concept, or
+disclosure-family URIs.
+
+The explicit production target contains only `governance.yaml` and
+`runtime.yaml`. The former contributes the bundle-owned service,
+authentication, audit, signing, rate-limit, response-format, and authority
+values; it may not override compiler-owned selectors, sources, or requirements.
+The latter is copied unchanged and binds the completed candidate to one target
+host. Secret values and absolute secret paths do not belong in either authored
+governance input.
+
+`evidencectl build --project <editable-project> --target <production-target>
+--output <new-candidate-directory>` is create-only. It reads regular files
+without following symlinks, compiles one closed bundle, uses private temporary
+validation material, runs `evidence check` and every referenced fixture through
+the real `evidence` binary, and publishes atomically only on success. It makes
+no network request, opens no listener, writes no production audit event, and
+never copies local `.evidence` state, credentials, tokens, responses, or
+private keys into the candidate.
+
+The candidate contains `runtime.yaml` and `bundle/`; the bundle may contain
+adapters, derivations, schemas, codelists, fixtures, and public keys where
+referenced. The operator independently provisions the signing, audit,
+subject-binding, and source secrets, then runs one grouped handoff:
+
+```sh
+evidencectl doctor --project '<candidate>'
+evidencectl fixtures run --project '<candidate>'
+evidence --runtime '<candidate>/runtime.yaml' serve
+```
+
+An existing OIDC issuer and Registry Mint are equal issuer choices from
+Evidence's perspective. Mint remains separately authored and checked with
+`mint check`. When selected, `evidencectl doctor --mint-config <mint.yaml>`
+performs only a read-only mechanical comparison of issuer, JWKS URI, audience,
+algorithm, token type, and configured claim names. It does not register a
+client, decide authority, copy Mint files, or mint a token.
+
+The initial deployment proof uses released bare binaries. Docker Compose is a
+documented adapter, not build output: it mounts the reviewed bundle unchanged,
+uses a separate container runtime file and secret mounts, preserves audit
+storage, and keeps Evidence private behind operator TLS. Container, Helm,
+Kubernetes, Terraform, cloud packaging, approval, promotion, and deployment
+commands remain outside this build command.
+
+## Installing the toolset
+
+Releases that include the Evidence toolset publish reproducible bare binaries
+named `<bin>-<tag>-<os>-<arch>` (for example `evidence-v1.2.0-linux-amd64`)
+plus a `SHA256SUMS` file that is cosign-signed at promotion. Older releases do
+not carry these assets. To install the newest release that does:
+
+```sh
+curl -fsSL https://github.com/registrystack/registry-stack/releases/latest/download/evidencectl-install.sh | bash
+```
+
+To pin a release, run that release's own installer asset:
+
+```sh
+tag=vX.Y.Z
+curl -fsSL "https://github.com/registrystack/registry-stack/releases/download/${tag}/evidencectl-${tag}-install.sh" | bash
+```
+
+Every published installer carries the release it belongs to, so neither form
+needs a tag in the environment and both refuse an `EVIDENCECTL_VERSION` naming
+a different release. A copy taken from this repository carries none and
+installs nothing until `EVIDENCECTL_VERSION` names one.
+
+The installer installs the three-binary Evidence toolset, the `evidence`
+runtime, `evidencectl` adopter tooling, and the `mint` token issuer, together
+or not at all, verifying every asset against `SHA256SUMS` before anything
+reaches the install directory. It supports Linux amd64, Linux arm64, and
+macOS arm64. It checks integrity, not authenticity: for a higher-assurance
+install, follow [`release/VERIFY.md`](../../release/VERIFY.md) for the pinned
+tag, then rerun the installer with `EVIDENCECTL_ASSET_DIR` pointed at that
+verified directory.
+
+Three environment variables configure the installer: `EVIDENCECTL_VERSION`
+names a `vMAJOR.MINOR.PATCH` release for a copy that carries none,
+`EVIDENCECTL_INSTALL_DIR` sets the install directory (default `~/.local/bin`),
+and `EVIDENCECTL_ASSET_DIR` installs from a locally verified asset directory
+instead of downloading.
+
+To build the toolset from source instead:
+
+```sh
+cargo build --release --locked -p registry-evidence -p registry-evidencectl -p registry-mint
+```
+
+## Discovering available evidence
+
+An authenticated caller lists the complete Evidence request shapes it can
+currently invoke with `GET /v1/evidence-definitions`. The response is computed
+from the immutable deployed bundle and the caller's verified token. It contains
+only combinations that match exactly one authority path, including requirement,
+Evidence Type, purpose, output concepts, subject roles, selector profiles,
+value origins, and safe selector field validation metadata. An unentitled
+caller receives an empty list. An ambiguous authority shape is omitted because
+the corresponding evidence request would be denied.
+
+This is requester-scoped discovery, not a public or process-wide catalog. The
+response excludes source URLs and identifiers, paths, projections, scripts,
+adapter parameters, credentials, internal authority-profile names and tags,
+selector values, codelist values, and definitions unavailable to that caller.
+Discovery performs no provider request and creates no evidence-data audit
+event. Metadata never grants authority; `POST /v1/evidence` authenticates and
+authorizes the complete tuple again.
+
+The generated OpenAPI defines both operations, and the running service publishes
+that same document unauthenticated at `GET /openapi.json`. Operators still
+publish static onboarding material through their API catalog, developer portal,
+configuration repository, or bilateral process for token acquisition, human
+descriptions, legal context, endpoint trust, and verifier policy. The public
+JWKS at `/.well-known/evidence/jwks.json` supplies verification keys only. The
+complete contract and change rules are in
+[the operator contract](OPERATOR-CONTRACT.md#discovery-of-available-evidence).
+
+## Requesting evidence
+
+`POST /v1/evidence` takes one complete request naming the requirement, purpose,
+subjects, and a required `requestNonce`. The nonce is the canonical unpadded
+base64url encoding of exactly 32 random bytes, so exactly 43 characters, and
+must be freshly generated for every request. Evidence echoes it into the
+Evidence payload under `requestNonce` and covers it by the signature, so a
+caller that retained the value it sent can confirm the assertion answers that
+request. Evidence never stores it, never rejects reuse, and never uses it for
+authorization, rate limits, scripts, source requests, logs, metrics, traces, or
+audit. Callers must not encode identifiers, selectors, secrets, or document
+digests in it.
+
+Signed flattened JWS is the default format. A missing `Accept`, `*/*`, or the
+exact `application/jose+json` all select it. The exact
+`application/vnd.registrystack.evidence-unsigned+json` selects a visibly
+unsigned envelope, and the exact `application/dc+sd-jwt` selects the same
+assertion serialized as an SD-JWT VC. Every format other than the default is
+released only when both the immutable bundle and the one complete matched grant
+permit it; otherwise the request is refused with the ordinary `not_authorized`
+problem (HTTP 403) before credentials or source access, without revealing which
+layer refused. Every authorization refusal shares this one generic 403, so it is
+never an oracle for which check failed. A duplicate, combined, parameterized,
+weighted, or unknown `Accept` returns the `response_format_not_acceptable`
+problem with HTTP 406 before source access. Unsigned output is
+transport-authenticated convenience data for development and for consumers that
+cannot process JWS. It is never later-verifiable evidence and never a fallback
+when signing fails.
+
+The SD-JWT VC format is a second encoding of the one stateless assertion the
+signed default carries, under the frozen profile in
+[the SD-JWT VC profile](contracts/sd-jwt-vc-profile.yaml). It is not a
+credential lifecycle: no issuance session, no holder binding ceremony, no
+status list, no revocation, and no presentation or key-binding verification. The
+shipped verifier checks an SD-JWT VC for exactly what it checks for a signed
+JWS, namely issuer authenticity against a pinned key set and the output
+contract, and it never falls back to the credential format when signing fails.
+[The SD-JWT VC demo](SD-JWT-VC-DEMO.md) issues one assertion in both formats and
+re-verifies the credential offline with `curl` and the `evidence` binary.
+
+## Current verification
+
+From the monorepo root, the Evidence-specific reproducible gate is:
+
+```sh
+cargo fmt --check
+cargo check --locked -p registry-evidence -p registry-evidencectl --all-targets
+cargo test --locked -p registry-evidence -p registry-evidencectl
+cargo clippy --locked -p registry-evidence -p registry-evidencectl --all-targets -- -D warnings
+products/evidence/scripts/check-contracts.sh
+products/evidence/scripts/check-source-neutrality.sh
+```
+
+Generated JSON Schema and OpenAPI artifacts are under `generated/`. The
+contract gate recreates them from Rust in a temporary directory and requires an
+exact diff. The complete workspace and dependency-policy gates remain those in
+[the implementation schedule](IMPLEMENTATION.md).
+
+## Security
+
+Changes to authentication, authorization, disclosure, audit, configuration
+trust, signing, source credentials, or selector handling require explicit
+security review notes naming the threat, Rust enforcement point, and negative
+test. Report suspected vulnerabilities through the repository process in
+`SECURITY.md`, not a public issue.
diff --git a/products/evidence/SD-JWT-VC-DEMO.md b/products/evidence/SD-JWT-VC-DEMO.md
new file mode 100644
index 000000000..60f1c245a
--- /dev/null
+++ b/products/evidence/SD-JWT-VC-DEMO.md
@@ -0,0 +1,281 @@
+# Evidence SD-JWT VC demo
+
+Status: deterministic local operator demo
+
+This demo issues one Evidence assertion in both governed later-verifiable
+formats, then re-verifies the credential offline. It is deterministic and
+credential-free: a local mock stands in for the upstream source and an
+in-memory test JWKS authenticates the requester. No DHIS2, OpenCRVS, or other
+live provider is contacted, and nothing is written outside
+`products/evidence/.sd-jwt-vc-demo/`, which is gitignored and owner-only.
+
+What it proves: the same authorization, minimization, and audit path releases
+the same assertion as a signed flattened JWS and as an SD-JWT VC; the credential
+carries one root disclosure for its unprojected supported value and nothing
+else; and a relying party who kept the original request can verify the stored
+credential later with no network and no running server.
+
+What it does not prove: wallet interoperability, presentation, key-binding, or
+any live provider deployment. Those are outside the Version 1 boundary in
+[CONCEPT.md](CONCEPT.md) and the frozen profile in
+[contracts/sd-jwt-vc-profile.yaml](contracts/sd-jwt-vc-profile.yaml).
+
+## Run it
+
+One command, from the repository root:
+
+```bash
+products/evidence/scripts/sd-jwt-vc-demo.sh
+```
+
+It needs `cargo`, `curl`, and `jq`. The first run compiles the crate, so allow a
+few minutes; later runs take seconds. The script is idempotent: rerunning it
+replaces the previous artifacts.
+
+The script starts the demo server, performs every request with plain `curl`,
+waits for the server's own checks, and finishes with the shipped offline
+verifier. Its six steps are:
+
+1. fetch the issuer identity and key set from `/.well-known/jwt-vc-issuer`;
+2. request the signed default with `Accept: application/jose+json`;
+3. request the same assertion with `Accept: application/dc+sd-jwt`;
+4. decode the credential's protected header and disclosures;
+5. re-verify the stored credential offline with `evidence verify --sd-jwt-vc`;
+6. edit one disclosure and re-verify, which must fail.
+
+Every step prints the exact command it runs before running it, so the transcript
+doubles as the copy-pasteable version of this walkthrough. The bearer token is
+the one thing never printed: the demo passes it to `curl` on standard input, and
+the printed form shows `$EVIDENCE_ACCESS_TOKEN` rather than its value.
+
+Expected output, abbreviated:
+
+```text
+1. Fetch the issuer keys from the published metadata route (no token)
+   $ curl \
+       --header 'Accept: application/json' \
+       --output 'products/evidence/.sd-jwt-vc-demo/issuer-metadata.json' \
+       ... \
+       http://127.0.0.1:18081/.well-known/jwt-vc-issuer
+   HTTP 200 application/json
+   issuer: urn:example:fixture:provider:evidence
+2. Request the signed default (Accept: application/jose+json)
+   $ curl \
+       --request 'POST' \
+       --header 'Authorization: Bearer $EVIDENCE_ACCESS_TOKEN' \
+       --header 'Content-Type: application/json' \
+       --header 'Accept: application/jose+json' \
+       --data-binary '@products/evidence/.sd-jwt-vc-demo/request.json' \
+       ... \
+       http://127.0.0.1:18081/v1/evidence
+   HTTP 200 application/jose+json
+3. Request the same assertion as an SD-JWT VC (Accept: application/dc+sd-jwt)
+   $ curl \
+       ... the same request with Accept: application/dc+sd-jwt \
+       http://127.0.0.1:18081/v1/evidence
+   HTTP 200 application/dc+sd-jwt
+
+PASS: the same assertion was released as a signed JWS and as an SD-JWT VC, ...
+
+4. The credential: an issuer-signed JWT, one root disclosure for this value,
+   and a trailing tilde where a key-binding JWT would go
+   1 disclosure(s), no key-binding JWT
+   protected header: {"alg":"EdDSA","kid":"acceptance-evidence-key","typ":"dc+sd-jwt"}
+   disclosures (salt, claim name, claim value):
+     ["7MNkDxEPeSWvyGbI2ziaRw","urn:example:fixture:concept:adult-status",true]
+
+5. Re-verify the stored credential offline, no network and no server
+   $ cargo run --locked --quiet -p registry-evidence -- verify --sd-jwt-vc ...
+verified-at: 2026-08-02T13:49:03Z
+authentic: yes
+currently-valid: yes
+{ ... the verified Evidence payload ... }
+
+6. Tamper with one disclosure and re-verify: selective disclosure is not
+   an invitation to edit the claim after issuance
+   $ cargo run --locked --quiet -p registry-evidence -- verify --sd-jwt-vc ...
+   rejected: evidence: stored response verification failed (disclosure)
+```
+
+Anything else is not a pass. The `PASS:` line comes from the server harness
+itself, which independently verifies the credential against the signed
+transaction, checks that protected source and selector material is absent, and
+checks that both releases wrote durable audit events recording their own
+response protection mode.
+
+## What the demo bundle enables
+
+The demo runs the acceptance bundle with one deliberate change: both the
+immutable bundle and the one complete matched grant list `sd-jwt-vc` alongside
+`signed-jws` and `unsigned-json`. Both gates are required and are never unioned.
+Enabling the format in the bundle alone leaves the request refused with the
+ordinary `not_authorized` problem, before any credential or source access, and
+without revealing which layer refused.
+
+```yaml
+# the immutable bundle
+responseFormats: [signed-jws, unsigned-json, sd-jwt-vc]
+
+# and the one matched grant
+- requirement: urn:example:fixture:requirement:adult-status:v1
+  purpose: fixture-eligibility
+  audienceFrom: authenticated-requester
+  responseFormats: [signed-jws, unsigned-json, sd-jwt-vc]
+```
+
+Production reference bundles declare `responseFormats: [signed-jws]`. The
+credential format is an operator decision per deployment and per grant, not a
+client choice.
+
+## Driving it by hand
+
+To watch the exchange yourself, run the server in terminal 1:
+
+```bash
+CARGO_INCREMENTAL=0 \
+CARGO_PROFILE_DEV_DEBUG=0 \
+CARGO_PROFILE_TEST_DEBUG=0 \
+cargo test --locked -p registry-evidence \
+  sd_jwt_vc_demo_serves_a_credential_for_curl \
+  -- --ignored --nocapture
+```
+
+Wait for `Evidence SD-JWT VC demo server is ready`. It listens only on
+`127.0.0.1:18081`. Then work in terminal 2, from the repository root.
+
+The server shuts down as soon as it has verified the credential, so fetch the
+public metadata first. It needs no token:
+
+```bash
+curl --fail-with-body --silent \
+  --output products/evidence/.sd-jwt-vc-demo/issuer-metadata.json \
+  http://127.0.0.1:18081/.well-known/jwt-vc-issuer
+
+jq '{keys: .jwks.keys}' \
+  products/evidence/.sd-jwt-vc-demo/issuer-metadata.json \
+  >products/evidence/.sd-jwt-vc-demo/trusted.jwks.json
+```
+
+Then load the short-lived synthetic bearer token and request the signed default
+before the credential: a relying party's expectations come from the transaction
+it accepted, never from the credential it is about to check. Both requests pass
+the token to `curl` through standard input, so it never reaches a command line,
+the process table, or your shell history.
+
+```bash
+set -a
+. products/evidence/.sd-jwt-vc-demo/session.env
+set +a
+
+for accept in application/jose+json application/dc+sd-jwt; do
+  case "$accept" in
+  application/jose+json) output=response.jws.json ;;
+  *) output=credential.txt ;;
+  esac
+  curl --config - <<CURL_CONFIG
+url = "http://127.0.0.1:18081/v1/evidence"
+request = "POST"
+header = "Authorization: Bearer $EVIDENCE_ACCESS_TOKEN"
+header = "Content-Type: application/json"
+header = "Accept: $accept"
+data-binary = "@products/evidence/.sd-jwt-vc-demo/request.json"
+output = "products/evidence/.sd-jwt-vc-demo/$output"
+write-out = "HTTP %{http_code} %{content_type}\n"
+silent
+show-error
+fail-with-body
+CURL_CONFIG
+done
+
+unset EVIDENCE_ACCESS_TOKEN
+```
+
+`session.env` holds only that bearer token, which is why no token value appears
+in this document. You may inspect the file locally, but do not paste its
+contents into chat, a ticket, or a terminal that records input.
+
+## Reading the credential
+
+This demo's serialization is the issuer-signed JWT, then one root disclosure
+for its unprojected supported value, ending with a tilde where a key-binding
+JWT would go. A configured reviewed structured value instead has one nested
+disclosure per direct field. No key-binding JWT is issued and none is expected.
+
+```text
+<issuer-signed JWT>~<disclosure>~
+```
+
+The protected header carries exactly `alg`, `kid`, and `typ: dc+sd-jwt`. The
+payload carries the Evidence assertion's own fields plus `_sd` (the sorted,
+deduplicated disclosure digests), `_sd_alg: sha-256`, and `vct`. Each disclosure
+is the base64url encoding of `[salt, claim name, claim value]`, and its digest
+is the base64url encoding of the SHA-256 of those encoded ASCII bytes.
+
+Selector profiles, selector values, source identity, source responses, adapter
+identity, grant identifiers, and requester identity never appear in the
+credential, in a disclosure, or in credential-visible metadata. The disclosure
+set is exactly the assertion's supported values.
+
+The subject identifier is an audience-scoped pseudonym
+(`urn:evidence:subject:v1_...`). The same person requested for a different
+audience yields a different identifier by design, so the credential is not a
+general-purpose multi-verifier credential and must not be marketed as one.
+
+## Verifying it later
+
+Offline re-verification needs three files and no network:
+
+```bash
+cargo run --locked -p registry-evidence -- verify \
+  --sd-jwt-vc products/evidence/.sd-jwt-vc-demo/credential.txt \
+  --jwks products/evidence/.sd-jwt-vc-demo/trusted.jwks.json \
+  --policy products/evidence/.sd-jwt-vc-demo/verification-policy.yaml
+```
+
+The format is named by the operator. The command never infers a format from a
+file's contents, so a stored response is never re-verified under the other
+format's rules. Naming both formats, or neither, is a usage error.
+
+The policy document is the demo's stand-in for state a relying party retains
+independently: the nonce from the request it sent, and the expectations from the
+transaction it accepted. Copying values out of the credential under verification
+and passing them back as expectations proves nothing. The demo writes it after
+verifying the signed default:
+
+```yaml
+audience: https://relying.invalid/procedure
+clockSkewSeconds: 30
+configurationRevision: sha256:bcfc829bb1...
+evidenceType: urn:example:fixture:evidence-type:adult-status:v1
+expectedOutputs:
+  - concept: urn:example:fixture:concept:adult-status
+    form: boolean
+expectedSubjects:
+  - binding: urn:evidence:subject:v1_3QKF0SHXxkQ9...
+    role: subject
+issuedBy: urn:example:fixture:issuer:authority
+maximumAssertionLifetimeSeconds: 172800
+providedBy: urn:example:fixture:provider:evidence
+purpose: fixture-eligibility
+requestNonce: AZ_CwmSORo8gHKmIY1sSLQAAAAAAAAAAAAAAAAAAAAA
+requirement: urn:example:fixture:requirement:adult-status:v1
+```
+
+One policy document governs both formats, because the same Evidence payload is
+verified whichever serialization carried it. The full contract is in
+[contracts/verification-policy.schema.yaml](contracts/verification-policy.schema.yaml).
+
+Exit codes: `0` authentic and currently valid, `3` authentic but no longer
+current, `1` everything else. Failures report only a closed class, never a field
+value, which is why step 6 prints `(disclosure)` and not the claim it rejected.
+
+## Related material
+
+- [FIRST-CURL-TEST.md](FIRST-CURL-TEST.md): the signed and unsigned formats over
+  the same deterministic path.
+- [contracts/sd-jwt-vc-profile.yaml](contracts/sd-jwt-vc-profile.yaml): the
+  frozen profile, its verifier rules, and its named security negatives.
+- [fixtures/conformance/sd-jwt-vc-cases.yaml](fixtures/conformance/sd-jwt-vc-cases.yaml):
+  the golden wire fixture, reproduced by the production issuance path in tests.
+- [SOURCE-TESTING.md](SOURCE-TESTING.md): the live DHIS2 and OpenCRVS demo
+  checks, which are separate, opt-in, ignored, and read-only.
diff --git a/products/evidence/SOURCE-TESTING.md b/products/evidence/SOURCE-TESTING.md
new file mode 100644
index 000000000..3ce83505a
--- /dev/null
+++ b/products/evidence/SOURCE-TESTING.md
@@ -0,0 +1,408 @@
+# Evidence Source Testing
+
+Status: Approved Version 1 source-testing contract
+Date: 2026-08-02
+
+## Purpose
+
+Evidence must prove that its source boundary is generic without building a
+connector framework or emulating entire source products. Testing therefore has
+three ordered layers:
+
+1. offline requirement fixtures for extraction and derivation semantics;
+2. deterministic local HTTP mocks for materially different source contracts;
+3. explicit, read-only local smoke tests against public demo systems.
+
+Only the first two layers run in ordinary CI. A live smoke test supplements the
+mock contract. It never replaces it and never decides whether a commit is
+correct.
+
+## Compatibility matrix
+
+| Profile | Request | Response | Authentication | Generality pressure |
+|---|---|---|---|---|
+| `flat-rest` | Reviewed JSON preparation with identifier or compound selectors | Flat JSON object | Static Bearer | Closed selector inputs and direct fact extraction |
+| `dhis2-tracker` | `GET` with prepared filters, fixed `fields`, and `pageSize` | Pager, `trackedEntities` collection, nested attributes | HTTP Basic | Query rendering, encoding, cardinality, collection handling, and controlled codes |
+| `opencrvs-event-search` | Prepared bounded JSON `POST` for one tracking ID | Nested event index and country-configured declaration | OAuth 2.0 client credentials, then Bearer | Credential bootstrap, exact event lookup, nested extraction, and relational derivation |
+
+The product names identify compatibility-shaped test profiles. They do not
+promise a maintained vendor connector, reproduce a whole server, or certify
+support for every release and configuration.
+
+They are test-only names. Production Rust, Cargo dependencies and features,
+public configuration schemas, routes, and CLI options contain no DHIS2 or
+OpenCRVS specialization. The compatibility test must fail if either product is
+introduced into production source, Cargo metadata, or generated public
+contracts.
+
+The DHIS2 profile follows the reviewed version 2.43 Tracker contract. A live
+operator selects an approved current instance from the official DHIS2 demo
+catalog rather than relying on a repository-pinned public hostname. The check
+requests only configured fields and sets a result limit that can distinguish
+one match from ambiguity. It does not follow pages to enumerate people.
+
+The OpenCRVS profile follows the documented Event Search flow: acquire a
+short-lived system-client token, then submit one bounded JSON search for an
+exact child tracking ID. Malformed envelopes, zero results, multiple
+results, and incomplete configured declaration facts all fail according to the
+reviewed requirement rule.
+
+The matrix includes four generic selector contracts independent of those
+product-shaped profiles:
+
+- one opaque identifier;
+- one compound selector with no identifier;
+- one compound profile with an additional configured disambiguator;
+- one relationship request with two independently role-bound selectors.
+
+Selector field names, exact field sets, scalar types, value origins, and
+permitted script inputs come from trusted test YAML. Reviewed preparation
+scripts render the wire request. The core does not know what a
+name, civil identifier, licence number, or birth date means. Alternative
+sufficient field sets use separate named profiles instead of caller-selected
+field combinations.
+
+## What the mocks contain
+
+Each profile uses a small local HTTP mock and invented, obviously synthetic raw
+provider responses. Rust applies the same configured extended JSON Pointer
+projection used in production before extraction. A `field-projected` fixture
+models a wire response containing only requested fields. A
+`record-transformed` fixture may contain additional fields before local
+projection.
+Every `record-transformed` fixture also includes at least one unrelated
+synthetic canary to prove excess transient data cannot cross extraction,
+derivation, error, audit, log, metric, trace, snapshot, or evidence boundaries.
+Do not capture a public demo response and redact it after the fact.
+
+The shared cases are:
+
+- one exact match;
+- no match;
+- two matches or a total count greater than one;
+- identifier-only and no-identifier compound selectors;
+- missing, extra, unknown, mistyped, empty, oversized, and unauthorized
+  selector values rejected before credentials or source access;
+- an additional disambiguating field accepted only as a distinct configured
+  profile, never as a caller-added field;
+- two role-bound selectors with swapped-role and substitution failures;
+- required fact absent;
+- wrong fact type or controlled code;
+- malformed JSON and wrong media type;
+- `401`, `403`, `429`, and `5xx`;
+- timeout, redirect, and response larger than the configured maximum;
+- credentials rejected without any credential value in diagnostics;
+- raw selector values and source values absent from logs, audit, errors, and
+  snapshots; audit may contain only the configured profile id and one scoped
+  keyed pseudonym over the complete role and selector bundle.
+- broad candidates, scores, near-match hints, and comparison diagnostics absent
+  from evidence, errors, responses, logs, and audit;
+- exact relationship membership succeeds and fails using an independently
+  authorized candidate selector, while incomplete parent sets, mismatched
+  namespaces, role substitution, and ambiguous child lookup stop without an
+  authoritative negative assertion.
+
+Profile-specific cases include:
+
+- DHIS2 pager and `trackedEntities` shape, nested attribute lookup by configured
+  identifier, fixed `fields`, and refusal to enumerate a second page;
+- OpenCRVS token expiry, malformed token response, exact child-event body,
+  bounded event result, configured declaration fields, and missing or malformed
+  parent references.
+- fixed and selector-bound path expansion, fixed headers, Basic, static Bearer,
+  static API-key, OAuth client credentials, system-root and private-CA TLS,
+  projection conflicts, and proof that ambient proxy variables are ignored.
+- the explicit local credential-free boundary, including exact numeric-
+  loopback origin validation and absence of an authentication header.
+
+The mocks assert the received wire request. Preparation Rhai sees only the
+source-required authorized selectors and closed parameters. Extraction Rhai
+sees only the bounded projected JSON response and parameters. Neither can inspect
+credentials, request headers, URLs, or the source client.
+
+Extraction maps the response to exactly `match(FactSet)`, `no_match`, or
+`ambiguous`. It may interpret a provider result count or at most two minimally
+projected results when the provider cannot return count plus one result. It
+must not receive a broad candidate set or select between results. Derivation
+runs only on `match` and may compare the facts with only its declared
+authorized selector inputs using the reviewed requirement rule. `ambiguous` stops without
+derivation, page traversal, a second evidence-data request, or a success
+response in any format.
+
+The same suite runs every initial assertion case from `CONCEPT.md` through the
+complete Evidence service. At least one case runs against two mock source
+shapes with only YAML and Rhai changes, proving that a source swap does not
+require Rust changes.
+
+Across those cases, adult status uses a no-identifier compound selector,
+residence uses an identifier profile, professional licence uses a compound
+sector selector, and legal-parent relationship uses a child record reference
+plus an independently role-bound candidate reference. These assignments exist
+only in test bundles and do not create production domain types.
+
+## Local public-demo smoke tests
+
+For the operator-facing first checkpoint, expected outputs, and the explicit
+post-checkpoint gap list, see [`FIRST-CURL-TEST.md`](FIRST-CURL-TEST.md). For
+the same deterministic path exercised through the SD-JWT VC response format and
+its offline verifier, see [`SD-JWT-VC-DEMO.md`](SD-JWT-VC-DEMO.md). Both are
+mock-backed and credential-free, so neither is a live test and neither depends
+on the ordering below.
+
+Live tests are implemented in a separate ignored integration-test target. The
+required order is:
+
+```text
+cargo test --locked -p registry-evidence
+cargo test --locked -p registry-evidence --test live_sources dhis2 -- --ignored
+cargo test --locked -p registry-evidence --test live_sources opencrvs -- --ignored
+```
+
+The package test includes `source_contracts`; it must be green before either
+live command is run.
+
+The live target requires an explicit profile name and local configuration. It
+must skip, rather than improvise, when required values or an approved synthetic
+subject selector are absent.
+
+Live tests are read-only. They may authenticate, request a token, and perform a
+bounded record lookup. They must not create, update, register, certify, print,
+archive, or delete records. They must not use a browser session, a human login,
+or interactive two-factor credentials. OpenCRVS may itself record the
+system-client search in its remote audit log; that expected server-side audit
+effect and any request quota are part of the operator's decision to run the
+test.
+
+### DHIS2 public demo
+
+Select an approved current instance from the official demo catalog:
+`https://dhis2.org/demo/`
+
+The local profile accepts these names, with values supplied outside the
+repository:
+
+```text
+DHIS2_BASE_URL
+DHIS2_USERNAME
+DHIS2_PASSWORD
+DHIS2_TEST_PROGRAM_ID
+DHIS2_TEST_ORG_UNIT_ID
+DHIS2_TEST_TRACKED_ENTITY_ID
+```
+
+The owner-only file path is supplied through
+`EVIDENCE_DHIS2_LIVE_ENV_FILE`. The smoke test first verifies authentication
+through a safe metadata request, then performs one fixed Tracker read scoped by
+the reviewed program, organisation unit, and synthetic/demo tracked-entity
+selector with minimum `fields`. It never searches broadly to find a convenient
+person. Public demonstration credentials are intentionally not reproduced in
+repository material.
+
+### OpenCRVS public demo
+
+The owner-only file path is supplied through
+`EVIDENCE_OPENCRVS_LIVE_ENV_FILE`. Its exact required keys are:
+
+```text
+OPENCRVS_CLIENT_ID
+OPENCRVS_SECRET
+OPENCRVS_URL
+OPENCRVS_TEST_TRACKING_ID
+```
+
+The selector value and any alternative tracking or national identifier remain
+local. They are never placed in a fixture, test name, snapshot, log, audit
+record, error, or command line.
+
+The live runner derives only the documented authentication and event-search
+hosts from the configured base domain. It requests a client-credentials token
+and then makes one bounded, exact event lookup that consumes only the count and
+facts needed by the test. It does not retrieve a certificate or perform a
+broad person search.
+
+These live checks prove only that the selected demo version still accepts the
+documented authentication and bounded lookup shape. The DHIS2 check does not
+run the deployable adult-status derivation or prove its complete minimization
+and response-protection path. The OpenCRVS check does not prove country-specific parent
+reference fields, authoritative relationship-set completeness, parent
+membership semantics, or the deployable family requirements. Deterministic
+mocks and executable project fixtures own those contracts. A passing live
+check must not be described as certification of a complete deployment project.
+
+### Direct curl diagnosis
+
+Use these snippets only to diagnose an upstream API when the ignored live test
+cannot establish why a deployment differs. They are not Evidence service
+acceptance proof: they do not exercise authorization, audit, scripts, output
+validation, signing, or disclosure release. Run them in a shell that does not
+record terminal input. Values are prompted, sent to `curl` through standard
+input with `--config -`, held only in shell memory, and unset at the end. The
+commands print only shape, cardinality, and exact-match booleans.
+
+For a bounded DHIS2 Tracker collection lookup:
+
+```bash
+(
+  set -eu
+  trap 'unset EVIDENCE_DIAG_EXPECTED DHIS2_BASE_URL DHIS2_USERNAME DHIS2_PASSWORD DHIS2_PROGRAM_ID DHIS2_ORG_UNIT_ID DHIS2_TRACKED_ENTITY_ID DHIS2_USER_CONFIG DHIS2_PROGRAM_CONFIG DHIS2_ORG_CONFIG DHIS2_ENTITY_CONFIG' EXIT HUP INT TERM
+  curl_config_escape() { sed 's/\\/\\\\/g; s/"/\\"/g'; }
+  curl_config_value_is_safe() {
+    [[ $1 != *$'\n'* && $1 != *$'\r'* ]] &&
+      ! printf %s "$1" | LC_ALL=C grep -q '[[:cntrl:]]'
+  }
+  read -rp 'DHIS2 HTTPS base URL: ' DHIS2_BASE_URL
+  read -rp 'DHIS2 username: ' DHIS2_USERNAME
+  read -rsp 'DHIS2 password: ' DHIS2_PASSWORD; printf '\n'
+  read -rsp 'Program id: ' DHIS2_PROGRAM_ID; printf '\n'
+  read -rsp 'Organisation unit id: ' DHIS2_ORG_UNIT_ID; printf '\n'
+  read -rsp 'Tracked entity id: ' DHIS2_TRACKED_ENTITY_ID; printf '\n'
+  test -n "$DHIS2_USERNAME" && test -n "$DHIS2_PASSWORD" || { printf 'Non-empty credentials required\n' >&2; exit 1; }
+  if ! curl_config_value_is_safe "$DHIS2_USERNAME" || ! curl_config_value_is_safe "$DHIS2_PASSWORD"; then
+    printf 'Credential contains a prohibited control byte\n' >&2
+    exit 1
+  fi
+  printf %s "$DHIS2_BASE_URL" | grep -Eq '^https://[A-Za-z0-9.-]+(:[0-9]{1,5})?(/[A-Za-z0-9._~/-]*)?$' || { printf 'Conservative HTTPS base URL required\n' >&2; exit 1; }
+  for value in "$DHIS2_PROGRAM_ID" "$DHIS2_ORG_UNIT_ID" "$DHIS2_TRACKED_ENTITY_ID"; do
+    printf %s "$value" | grep -Eq '^[A-Za-z0-9._:-]{1,256}$' || { printf 'Conservative identifier shape required\n' >&2; exit 1; }
+  done
+  DHIS2_USER_CONFIG=$(printf '%s:%s' "$DHIS2_USERNAME" "$DHIS2_PASSWORD" | curl_config_escape)
+  DHIS2_PROGRAM_CONFIG=$(printf %s "$DHIS2_PROGRAM_ID" | curl_config_escape)
+  DHIS2_ORG_CONFIG=$(printf %s "$DHIS2_ORG_UNIT_ID" | curl_config_escape)
+  DHIS2_ENTITY_CONFIG=$(printf %s "$DHIS2_TRACKED_ENTITY_ID" | curl_config_escape)
+  export EVIDENCE_DIAG_EXPECTED=$DHIS2_TRACKED_ENTITY_ID
+  curl --config - <<EOF | jq '{collection_shape_ok: ((.trackedEntities | type) == "array"), cardinality_ok: ((.trackedEntities | type) == "array" and (.trackedEntities | length) <= 2), exact_match_ok: ((.trackedEntities | type) == "array" and (.trackedEntities | length) == 1 and .trackedEntities[0].trackedEntity == env.EVIDENCE_DIAG_EXPECTED)}'
+silent
+show-error
+fail
+no-location
+max-redirs = 0
+proto = "=https"
+connect-timeout = 5
+max-time = 15
+get
+user = "$DHIS2_USER_CONFIG"
+header = "Accept: application/json"
+data-urlencode = "program=$DHIS2_PROGRAM_CONFIG"
+data-urlencode = "orgUnits=$DHIS2_ORG_CONFIG"
+data-urlencode = "trackedEntities=$DHIS2_ENTITY_CONFIG"
+data-urlencode = "fields=trackedEntity"
+data-urlencode = "pageSize=2"
+data-urlencode = "page=1"
+data-urlencode = "totalPages=true"
+url = "${DHIS2_BASE_URL%/}/api/tracker/trackedEntities"
+EOF
+)
+```
+
+For OpenCRVS client-credentials bootstrap and one bounded Event Search request:
+
+```bash
+(
+  set -eu
+  trap 'unset EVIDENCE_DIAG_EXPECTED OPENCRVS_DOMAIN OPENCRVS_CLIENT_ID OPENCRVS_CLIENT_SECRET OPENCRVS_TRACKING_ID OPENCRVS_CLIENT_ID_CONFIG OPENCRVS_CLIENT_SECRET_CONFIG OPENCRVS_TOKEN_RESULT OPENCRVS_ACCESS_TOKEN OPENCRVS_TOKEN_CONFIG OPENCRVS_BODY OPENCRVS_BODY_CONFIG' EXIT HUP INT TERM
+  curl_config_escape() { sed 's/\\/\\\\/g; s/"/\\"/g'; }
+  curl_config_value_is_safe() {
+    [[ $1 != *$'\n'* && $1 != *$'\r'* ]] &&
+      ! printf %s "$1" | LC_ALL=C grep -q '[[:cntrl:]]'
+  }
+  read -rp 'OpenCRVS deployment domain, without scheme: ' OPENCRVS_DOMAIN
+  read -rp 'OpenCRVS client id: ' OPENCRVS_CLIENT_ID
+  read -rsp 'OpenCRVS client secret: ' OPENCRVS_CLIENT_SECRET; printf '\n'
+  read -rsp 'Child tracking id: ' OPENCRVS_TRACKING_ID; printf '\n'
+  test -n "$OPENCRVS_CLIENT_ID" && test -n "$OPENCRVS_CLIENT_SECRET" || { printf 'Non-empty credentials required\n' >&2; exit 1; }
+  if ! curl_config_value_is_safe "$OPENCRVS_CLIENT_ID" || ! curl_config_value_is_safe "$OPENCRVS_CLIENT_SECRET"; then
+    printf 'Credential contains a prohibited control byte\n' >&2
+    exit 1
+  fi
+  printf %s "$OPENCRVS_DOMAIN" | grep -Eq '^([A-Za-z0-9-]+\.)+[A-Za-z]{2,63}$' || { printf 'Conservative deployment domain required\n' >&2; exit 1; }
+  printf %s "$OPENCRVS_TRACKING_ID" | grep -Eq '^[A-Za-z0-9._:-]{1,256}$' || { printf 'Conservative tracking-id shape required\n' >&2; exit 1; }
+  case "$OPENCRVS_DOMAIN" in gateway.*|register.*|auth.*|events.*) OPENCRVS_DOMAIN=${OPENCRVS_DOMAIN#*.} ;; esac
+  OPENCRVS_CLIENT_ID_CONFIG=$(printf %s "$OPENCRVS_CLIENT_ID" | curl_config_escape)
+  OPENCRVS_CLIENT_SECRET_CONFIG=$(printf %s "$OPENCRVS_CLIENT_SECRET" | curl_config_escape)
+  OPENCRVS_TOKEN_RESULT=$(
+    curl --config - <<EOF | jq -ce 'if ((.access_token | type) == "string" and (.access_token | length) > 0 and ((.token_type // "Bearer") | ascii_downcase) == "bearer") then {token_shape_ok: true, access_token: .access_token} else error("token shape rejected") end'
+silent
+show-error
+fail
+no-location
+max-redirs = 0
+proto = "=https"
+connect-timeout = 5
+max-time = 15
+get
+request = "POST"
+data-urlencode = "client_id=$OPENCRVS_CLIENT_ID_CONFIG"
+data-urlencode = "client_secret=$OPENCRVS_CLIENT_SECRET_CONFIG"
+data-urlencode = "grant_type=client_credentials"
+url = "https://auth.$OPENCRVS_DOMAIN/token"
+EOF
+  )
+  printf %s "$OPENCRVS_TOKEN_RESULT" | jq '{token_shape_ok}'
+  OPENCRVS_ACCESS_TOKEN=$(printf %s "$OPENCRVS_TOKEN_RESULT" | jq -er .access_token)
+  if ! curl_config_value_is_safe "$OPENCRVS_ACCESS_TOKEN"; then
+    printf 'Token contains a prohibited control byte\n' >&2
+    exit 1
+  fi
+  OPENCRVS_TOKEN_CONFIG=$(printf 'Authorization: Bearer %s' "$OPENCRVS_ACCESS_TOKEN" | curl_config_escape)
+  export EVIDENCE_DIAG_EXPECTED=$OPENCRVS_TRACKING_ID
+  OPENCRVS_BODY=$(jq -cn '{query: {type: "and", clauses: [{eventType: "birth", status: {type: "exact", term: "REGISTERED"}, trackingId: {type: "exact", term: env.EVIDENCE_DIAG_EXPECTED}}]}, limit: 2, offset: 0}')
+  OPENCRVS_BODY_CONFIG=$(printf %s "$OPENCRVS_BODY" | curl_config_escape)
+  curl --config - <<EOF | jq '{collection_shape_ok: ((.results | type) == "array" and (.total | type) == "number"), cardinality_ok: ((.results | type) == "array" and (.results | length) <= 2 and .total <= 2), exact_match_ok: ((.results | type) == "array" and (.results | length) == 1 and .total == 1 and .results[0].trackingId == env.EVIDENCE_DIAG_EXPECTED)}'
+silent
+show-error
+fail
+no-location
+max-redirs = 0
+proto = "=https"
+connect-timeout = 5
+max-time = 15
+request = "POST"
+header = "$OPENCRVS_TOKEN_CONFIG"
+header = "Content-Type: application/json"
+header = "Accept: application/json"
+data = "$OPENCRVS_BODY_CONFIG"
+url = "https://events.$OPENCRVS_DOMAIN/events/search"
+EOF
+)
+```
+
+## Credential and live-data rules
+
+The live runner must:
+
+1. Require a credential file outside the repository or values injected by a
+   secret manager.
+2. Refuse a credential file readable or writable by group or other users. On
+   Unix, `0600` is the expected mode.
+3. Parse an exact allowlist of `KEY=value` entries. Do not execute or `source`
+   the file as shell code.
+4. Reject duplicate, unknown, empty, or malformed required keys.
+5. Never accept credential values as command-line arguments.
+6. Disable HTTP debug output and redact complete token URLs, query strings,
+   authorization headers, request bodies containing credentials, and token
+   responses.
+7. Keep tokens and source responses in memory only for the bounded request and
+   never write recordings, snapshots, failure artifacts, or temporary files.
+8. Print only the profile, safe phase, HTTP status category, duration, and
+   pass, skip, or inconclusive result.
+
+## Interpreting outcomes
+
+| Result | Interpretation |
+|---|---|
+| Contract mock fails | Product or test-contract regression; blocks completion |
+| Mock passes, live authentication fails | Local credential, client scope, or demo state issue |
+| Mock passes, live response shape differs | Possible upstream version or configuration drift; inspect public documentation before changing fixtures |
+| Live server is unavailable, rate-limited, or times out | Inconclusive public-demo result, not a product failure |
+| Live test returns more data than configured | Minimization failure; stop and review before retaining any output |
+
+Any upstream-driven contract change is first represented as a new sanitized
+mock case. Only then may the source configuration or Rhai adapter change. Core
+Rust changes require evidence that the behavior is generic across more than one
+source shape.
+
+## Public references
+
+- DHIS2, [Tracker API 2.43](https://docs.dhis2.org/en/develop/using-the-api/dhis-core-version-243/tracker.html).
+- OpenCRVS, [Record Search clients](https://documentation.opencrvs.org/v1.8/technology/interoperability/create-a-client/record-search-clients).
+- OpenCRVS, [Authenticate a client](https://documentation.opencrvs.org/technology/interoperability/authenticate-a-client).
diff --git a/products/evidence/contracts/README.md b/products/evidence/contracts/README.md
new file mode 100644
index 000000000..f52053b40
--- /dev/null
+++ b/products/evidence/contracts/README.md
@@ -0,0 +1,104 @@
+# Evidence Version 1 contract sources
+
+Status: frozen Evidence Version 1 source contracts
+
+These files are the human-reviewable source contracts for Evidence. They freeze
+the public and trusted-bundle boundaries. Code-generated JSON Schema and
+OpenAPI artifacts implementing these semantics are committed under
+`../generated/` and reproduced exactly with
+`../scripts/check-contracts.sh`; generated files are never hand-edited. The
+generated set includes `evidence-unsigned-envelope-v1.schema.json`, the closed
+envelope returned when unsigned output is explicitly requested and permitted.
+
+The normative source set is:
+
+- `cccev-field-mapping.yaml`: CCCEV 2.2.0 alignment and Evidence extensions;
+- `request.schema.yaml`, `definitions.schema.yaml`, `evidence.schema.yaml`, and
+  `jws-profile.yaml`: public discovery, request, the required `requestNonce`
+  and its echo in the Evidence payload, response-format negotiation, payload,
+  signing, rotation, and strict verifier rules;
+- `sd-jwt-vc-profile.yaml`: the audience-scoped SD-JWT VC response format, its
+  exact claim and disclosure mapping, the optional `cnf` holder key, the
+  issuer-metadata path, and its explicit profile non-goals. It adds a
+  serialization of the same assertion and no credential lifecycle;
+- `verification-policy.schema.yaml`: the closed all-required relying-procedure
+  policy document consumed by the offline `evidence verify` command, its frozen
+  command surface, exit codes, and no-network rule;
+- `problem-contract.yaml`: safe public failures, the
+  `response_format_not_acceptable` negotiation failure, and existence-collapse
+  rules;
+- `authority-context.schema.yaml` and `selector-contract.yaml`: normalized
+  authority, one-decision authorization inputs, exact selector profiles, and
+  value-origin rules;
+- `audit-event.schema.yaml`: the protected native audit record, including the
+  closed `responseProtection` mode carried by every event and the `signingKeyId`
+  required exactly for signed release;
+- `bundle.schema.yaml` and `runtime.schema.yaml`: the immutable governed bundle,
+  its bundle-level and grant-level `responseFormats` permission, closed
+  process-local runtime bindings, and their non-override boundary;
+- `supported-value-forms.yaml`: the complete closed value-form vocabulary;
+- `rhai-abi.yaml` and `primitive-library.yaml`: the closed `prepare/2`,
+  `extract/2`, and selector-aware `derive/3` entry points, domain-neutral
+  primitive allowlist, and resource limits;
+- `source-contract.yaml`: the single fixed HTTP JSON source boundary; and
+- `security-invariant-matrix.yaml`: threat, enforcement point, and required
+  negative test for every Version 1 trust and privacy invariant; and
+- `security-test-traceability.yaml`: exact executable Rust tests satisfying
+  every named `sec-*` requirement. The package contract test rejects a missing,
+  extra, duplicated, or stale test reference; and
+- `acceptance-test-traceability.yaml`: exact executable Rust tests satisfying
+  every numbered Version 1 acceptance requirement, under the same rejection
+  rule.
+
+The complete trusted-script ABI, configuration vocabulary, executable fixture
+contract, and deployment-shaped references live under
+[`../reference/request-adapter/`](../reference/request-adapter/). They are
+normative Version 1 inputs, not future-profile examples.
+
+All schemas use source-neutral identifiers. Names of compatibility targets may
+appear only below `../fixtures/source-shapes/`. Acceptance-case vocabulary is
+confined to test-only bundles below `../fixtures/acceptance/`; it is not core
+Evidence vocabulary.
+
+## Interpretation rules
+
+1. Caller data never creates authority. One authorization decision must match
+   the requester, optional actor, requirement revision, purpose, audience,
+   authority path, and every role's selector profile and value origin.
+2. A selector profile has one exact field set. Alternative sufficient sets or
+   an added disambiguator are separate named profiles.
+3. The provider owns record lookup. Extraction may return only `match`,
+   `no_match`, or `ambiguous`; only `match` carries facts. A reviewed
+   deterministic derivation may compare declared authorized selectors with
+   complete facts from one uniquely resolved authoritative record.
+4. Rust owns authorization, minimized script inputs, fixed path and header
+   authority, networking, credentials, TLS trust, response projection, output
+   validation, evidence construction, signing, and audit. Rhai prepares only
+   ordered query pairs and one JSON body, extracts the closed lookup result,
+   and derives declared concepts from matched facts and explicitly declared
+   authorized selectors. It cannot perform I/O.
+5. Signed flattened JWS over the exact UTF-8 payload bytes is mandatory and the
+   default result. The exact unsigned media type selects the separately typed
+   unsigned envelope, and the exact `application/dc+sd-jwt` media type selects
+   the audience-scoped SD-JWT VC serialization, each only when the immutable
+   bundle and the one complete matched grant both permit it. No failure on any
+   format falls back to another format, and the final immutable bytes exist
+   before the disclosure-release audit that gates them.
+6. The complete enabled bundle is one disclosure surface. Individually safe
+   definitions may still be rejected when their combination reconstructs a
+   protected value.
+7. The governed bundle and `runtime.yaml` are separate closed startup inputs.
+   Runtime binds only process-local paths, listener bounds, audit storage,
+   file secrets, and logical private CAs and cannot override governed
+   semantics or source authority.
+
+Version 1 stops before documents, credential issuance protocols and credential
+lifecycle, replay or nonce state beyond the stateless request-nonce echo and
+comparison, server-issued challenges, OOTS, delegated agents, federation,
+workflow, public or federated catalogs, runtime bundle mutation, source
+planning, multi-source fulfillment, and a general policy engine. The SD-JWT VC
+response format is a serialization of the same assertion under
+`sd-jwt-vc-profile.yaml`; it introduces no offer, code, nonce, status, or
+persisted credential state. Authenticated definition discovery is a closed projection of
+existing authority, not an authorization source or catalog. No contract here
+reserves a field or hook for future profiles.
diff --git a/products/evidence/contracts/acceptance-test-traceability.yaml b/products/evidence/contracts/acceptance-test-traceability.yaml
new file mode 100644
index 000000000..449269c16
--- /dev/null
+++ b/products/evidence/contracts/acceptance-test-traceability.yaml
@@ -0,0 +1,420 @@
+contract: registry.evidence.acceptance-test-traceability/v1
+entries:
+  - id: acceptance-row-01
+    summary: Missing configured principal claim denies without client_id or azp fallback.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: missing_principal_never_falls_back_to_client_id_or_azp}
+      - {file: crates/registry-evidence/src/auth.rs, name: claim_paths_are_exact_and_do_not_fallback}
+  - id: acceptance-row-02
+    summary: Unknown or unauthorized requirement, purpose, audience, selector profile, value origin, or subject path never acquires credentials or contacts the source.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: security_contract_rejects_unknown_and_unauthorized_requests_before_source_access}
+      - {file: crates/registry-evidence/tests/selector_conformance.rs, name: all_runtime_selector_negatives_fail_closed_before_source_access}
+  - id: acceptance-row-03
+    summary: Caller-supplied identifier or compound selector value never creates authority.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: security_contract_rejects_unknown_and_unauthorized_requests_before_source_access}
+      - {file: crates/registry-evidence/src/model.rs, name: request_rejects_query_material_and_unknown_fields}
+      - {file: crates/registry-evidence/tests/selector_conformance.rs, name: all_runtime_selector_negatives_fail_closed_before_source_access}
+  - id: acceptance-row-04
+    summary: Access-audit failure prevents the source request.
+    tests: [{file: crates/registry-evidence/src/runtime_tests.rs, name: access_audit_failure_blocks_credentials_and_source_access}]
+  - id: acceptance-row-05
+    summary: Source request method, URL, fields, credentials, size, timeout, and redirect behavior remain fixed by trusted configuration.
+    tests:
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: exact_request_applies_path_query_body_headers_auth_and_projection_once}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: source_executor_failure_matrix_is_exact_single_request_and_value_free}
+      - {file: crates/registry-evidence/src/config.rs, name: path_templates_headers_and_projection_fail_closed}
+      - {file: crates/registry-evidence/src/config.rs, name: source_urls_reject_insecure_aliases_and_ambiguous_numeric_hosts}
+  - id: acceptance-row-06
+    summary: Rhai cannot access network, filesystem, environment, credentials, clock, logging, audit, or signing material.
+    tests:
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: ambient_and_diagnostic_capabilities_are_unavailable}
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: engine_has_exact_normative_limits_and_disabled_module_syntax}
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: compile_requires_one_exact_entry_point_and_rejects_top_level_statements}
+  - id: acceptance-row-07
+    summary: Extra, missing, mistyped, or oversized derived values are rejected.
+    tests:
+      - {file: crates/registry-evidence/src/kernel.rs, name: extraction_failures_and_invalid_outputs_fail_closed}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: runtime_output_gate_rejects_every_fixture_injected_derivation_without_release}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: runtime_rejects_an_extra_extracted_fact_before_derivation_or_release}
+  - id: acceptance-row-08
+    summary: Source data and disclosed values are absent from logs, audit, and errors.
+    tests:
+      - {file: crates/registry-evidence/src/model.rs, name: debug_surfaces_redact_requests_facts_disclosures_and_signed_payloads}
+      - {file: crates/registry-evidence/src/audit.rs, name: audit_is_durable_keyed_and_redacted}
+      - {file: crates/registry-evidence/src/runtime.rs, name: runtime_failures_and_rate_keys_are_value_free}
+      - {file: crates/registry-evidence/src/main.rs, name: privacy_expectations_check_exact_projected_strings}
+  - id: acceptance-row-09
+    summary: Disclosure-audit failure prevents response release.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: disclosure_audit_failure_prevents_signed_response_release}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: disclosure_audit_failure_prevents_unsigned_response_release}
+  - id: acceptance-row-10
+    summary: Signing failure returns a safe transient error and never falls back to unsigned evidence.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: signing_failure_is_transient_audited_and_never_releases_unsigned_evidence}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: signing_failure_returns_a_problem_and_never_an_unsigned_body}
+  - id: acceptance-row-11
+    summary: JWS verification fails after any protected-header or payload mutation.
+    tests:
+      - {file: crates/registry-evidence/src/verifier.rs, name: payload_and_protected_header_mutation_fail}
+      - {file: crates/registry-evidence/src/verifier.rs, name: duplicate_jws_members_and_unknown_kid_are_rejected}
+      - {file: crates/registry-evidence/src/verifier.rs, name: complete_jws_negative_fixture_is_executable}
+  - id: acceptance-row-12
+    summary: A valid false boolean result is a success in either authorized response format, not an error.
+    tests:
+      - {file: crates/registry-evidence/src/verifier.rs, name: signed_false_round_trips_and_verifies}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: every_runtime_applicable_acceptance_case_reaches_terminal_audit_and_verification}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: all_four_definitions_pass_the_explicitly_authorized_unsigned_path}
+  - id: acceptance-row-13
+    summary: no_match, ambiguous, and missing fact create no existence oracle and use the same public failure by default.
+    tests:
+      - {file: crates/registry-evidence/src/runtime.rs, name: public_unavailability_does_not_distinguish_no_match_from_ambiguity}
+      - {file: crates/registry-evidence/src/problem.rs, name: unresolved_internal_classes_share_one_exact_public_shape}
+      - {file: crates/registry-evidence/src/runtime.rs, name: fact_absence_and_trusted_script_failures_have_distinct_public_classes}
+      - {file: crates/registry-evidence/src/main.rs, name: public_unavailability_requires_an_extraction_failure}
+  - id: acceptance-row-14
+    summary: Legal-timezone and calendar-boundary fixtures are deterministic.
+    tests:
+      - {file: crates/registry-evidence/src/main.rs, name: offline_dates_are_fixed_and_never_use_ambient_time}
+      - {file: crates/registry-evidence/src/main.rs, name: case_local_date_overrides_common_observation_time}
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: dates_instants_and_calendar_arithmetic_are_strict_and_bounded}
+  - id: acceptance-row-15
+    summary: Unsafe combinations, including threshold ladders and overlapping categories, are rejected at bundle review or validation.
+    tests:
+      - {file: crates/registry-evidence/src/config.rs, name: a_shared_disclosure_family_rejects_the_complete_bundle}
+      - {file: crates/registry-evidence/src/kernel.rs, name: all_four_acceptance_bundles_use_the_same_kernel}
+      - {file: crates/registry-evidence/src/main.rs, name: offline_cli_evaluates_every_coequal_acceptance_fixture}
+  - id: acceptance-row-16
+    summary: All three frozen test-only source-shape mocks, flat REST plus the nested-paged REST and event-search JSON compatibility profiles, use the same Rust source executor.
+    tests:
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: every_frozen_source_shape_executes_through_production_materialization_and_projection}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: every_acquisition_posture_fixture_executes_with_one_bounded_request}
+  - id: acceptance-row-17
+    summary: Zero, one, and multiple results map consistently to no_match, match, and ambiguous across the three source shapes; facts exist only on match.
+    tests: [{file: crates/registry-evidence/tests/source_contracts.rs, name: every_frozen_source_shape_executes_through_production_materialization_and_projection}]
+  - id: acceptance-row-18
+    summary: Event-index envelope errors and incomplete declaration data fail closed.
+    tests:
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: every_frozen_source_shape_executes_through_production_materialization_and_projection}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: source_executor_failure_matrix_is_exact_single_request_and_value_free}
+  - id: acceptance-row-19
+    summary: OAuth token requests and responses are absent from all diagnostics, and no placement can put client credentials in the token URL.
+    tests:
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: oauth_credential_redaction_fixture_fails_closed_without_data_requests}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: oauth_client_credentials_placements_are_exact_and_cache_reuse_is_bounded}
+      - {file: crates/registry-evidence/src/config.rs, name: source_adapter_name_is_audit_safe_and_oauth_endpoint_has_no_query}
+  - id: acceptance-row-20
+    summary: Live-source tests are ignored by default, read-only, and refuse missing or permissively stored credential files.
+    tests:
+      - {file: crates/registry-evidence/tests/live_sources.rs, name: exact_file_parser_accepts_only_owner_only_external_files}
+      - {file: crates/registry-evidence/tests/live_sources.rs, name: parser_rejects_unknown_duplicate_empty_and_symlinked_inputs}
+      - {file: crates/registry-evidence/tests/live_sources.rs, name: service_urls_are_fixed_and_never_carry_credentials}
+    note: >-
+      The two opt-in public-demo entry tests and the two per-profile bounded
+      read-only query tests in crates/registry-evidence/tests/live_sources.rs
+      are named after their source products, so they cannot be referenced from
+      this contract without breaking source neutrality, which
+      products/evidence/scripts/check-source-neutrality.sh enforces over
+      products/evidence/contracts/. Their ignored-by-default status is carried
+      by their own #[ignore] attributes in that file.
+  - id: acceptance-row-21
+    summary: Adult status passes the complete path with before, on, and after-boundary dates in the configured legal timezone.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: every_runtime_applicable_acceptance_case_reaches_terminal_audit_and_verification}
+      - {file: crates/registry-evidence/src/main.rs, name: offline_cli_evaluates_every_coequal_acceptance_fixture}
+      - {file: crates/registry-evidence/src/main.rs, name: case_local_date_overrides_common_observation_time}
+  - id: acceptance-row-22
+    summary: Residence region passes the complete path with valid, unknown, and overly precise codes and a pinned codelist version.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: every_runtime_applicable_acceptance_case_reaches_terminal_audit_and_verification}
+      - {file: crates/registry-evidence/src/main.rs, name: offline_cli_evaluates_every_coequal_acceptance_fixture}
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: codelist_required_missing_and_exact_collections_work}
+  - id: acceptance-row-23
+    summary: Professional licence status passes the complete path with multiple concepts, validity boundaries, and proof that exact dates and history are absent from evidence and diagnostics.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: every_runtime_applicable_acceptance_case_reaches_terminal_audit_and_verification}
+      - {file: crates/registry-evidence/src/main.rs, name: offline_cli_evaluates_every_coequal_acceptance_fixture}
+      - {file: crates/registry-evidence/src/main.rs, name: privacy_expectations_check_exact_projected_strings}
+  - id: acceptance-row-24
+    summary: Legal-parent relationship passes the complete path with correct and swapped roles, unauthorized candidate substitution, false relationship, returned-child mismatch, missing and ambiguous lookup, and ambiguous relationship facts; false is signed only after unique child resolution and a complete valid parent set.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: every_runtime_applicable_acceptance_case_reaches_terminal_audit_and_verification}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: one_runtime_proves_all_definitions_and_collapses_unresolved_relationships}
+      - {file: crates/registry-evidence/src/main.rs, name: offline_cli_evaluates_every_coequal_acceptance_fixture}
+      - {file: crates/registry-evidence/src/main.rs, name: unresolved_lookup_rejects_derivation_or_signed_success_claims}
+  - id: acceptance-row-25
+    summary: All four definitions run together and under concurrency without state, subject, source, audit, limit, or result leakage.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: real_router_serves_all_definitions_concurrently_without_crossing_boundaries}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: one_runtime_proves_all_definitions_and_collapses_unresolved_relationships}
+      - {file: crates/registry-evidence/src/bundle.rs, name: combined_acceptance_bundle_loads_as_one_atomic_revision}
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: all_four_acceptance_script_pairs_run_through_one_runtime}
+  - id: acceptance-row-26
+    summary: At least one acceptance definition runs against two different mock source shapes with only bundle and Rhai changes.
+    tests:
+      - {file: crates/registry-evidence/tests/deployment_projects.rs, name: reference_deployment_projects_execute_the_closed_fixture_contract}
+      - {file: crates/registry-evidence/src/main.rs, name: offline_cli_evaluates_every_reference_deployment_fixture}
+      - {file: crates/registry-evidence/src/bundle.rs, name: deployment_reference_projects_are_complete_compilable_bundles}
+  - id: acceptance-row-27
+    summary: A repository boundary check rejects source-product names and behavior in production Rust, Cargo dependencies and features, public configuration schemas, routes, and CLI options.
+    tests:
+      - {file: crates/registry-evidence/tests/deployment_projects.rs, name: reference_deployment_projects_execute_the_closed_fixture_contract}
+      - {file: crates/registry-evidence/src/bundle.rs, name: deployment_reference_projects_are_complete_compilable_bundles}
+      - {file: crates/registry-evidence/src/contracts.rs, name: openapi_has_only_the_version_one_routes_and_exact_success_media}
+    note: >-
+      The mapped tests prove the positive half only: source-product behavior is
+      reached through governed bundles and scripts without editing Rust, and the
+      public routes carry no source-product name. The scanning boundary check
+      over production Rust, Cargo metadata, public schemas, and CLI options is
+      products/evidence/scripts/check-source-neutrality.sh, which is a CI script
+      rather than a Rust test, so this row is not fully executable from cargo.
+  - id: acceptance-row-28
+    summary: JSON Schema and OpenAPI drift checks reproduce committed artifacts exactly.
+    tests:
+      - {file: crates/registry-evidence/src/contracts.rs, name: every_json_schema_is_valid_draft_2020_12}
+      - {file: crates/registry-evidence/src/contracts.rs, name: openapi_document_is_valid_utoipa_model}
+      - {file: crates/registry-evidence/src/contracts.rs, name: openapi_has_only_the_version_one_routes_and_exact_success_media}
+      - {file: crates/registry-evidence/src/contracts.rs, name: schemas_accept_the_exact_public_wire_shapes}
+      - {file: crates/registry-evidence/src/contracts.rs, name: the_served_openapi_document_is_the_generated_release_artifact}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: openapi_route_serves_the_generated_contract_without_authentication_or_source_access}
+    note: >-
+      These tests pin the generated contract content and its agreement with the
+      public Rust wire types, including the document the running service
+      publishes at GET /openapi.json. Byte-for-byte reproduction against the
+      committed artifacts under products/evidence/generated/ is proven by
+      products/evidence/scripts/check-contracts.sh, not by a cargo test.
+  - id: acceptance-row-29
+    summary: Every declared Supported Value form rejects wrong scalar types, unknown codes, invalid entity references, excessive precision, oversized strings and lists, prohibited duplicates, and wrong cardinalities, and each valid form survives Evidence construction, JWS serialization, and verification without type loss.
+    tests:
+      - {file: crates/registry-evidence/src/kernel.rs, name: supported_value_fixture_cases_use_the_real_gate_and_signed_round_trip}
+      - {file: crates/registry-evidence/src/kernel.rs, name: supported_value_fixture_global_negatives_are_enforced}
+      - {file: crates/registry-evidence/src/kernel.rs, name: scalar_decimal_and_collection_forms_are_exact}
+      - {file: crates/registry-evidence/src/kernel.rs, name: bucket_entity_and_structured_forms_are_closed}
+      - {file: crates/registry-evidence/src/verifier.rs, name: signed_schema_integer_lexical_forms_verify_without_type_loss}
+  - id: acceptance-row-30
+    summary: source-derived, field-projected, and record-transformed definitions use the same executor and report their acquisition guarantees honestly.
+    tests:
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: every_acquisition_posture_fixture_executes_with_one_bounded_request}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: every_frozen_source_shape_executes_through_production_materialization_and_projection}
+  - id: acceptance-row-31
+    summary: A serving process cannot reload, mutate, merge, or fall back to another bundle revision at runtime.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: serving_runtime_never_reloads_merges_or_falls_back_after_bundle_capture}
+      - {file: crates/registry-evidence/src/bundle.rs, name: revision_binds_paths_and_exact_bytes_deterministically}
+      - {file: crates/registry-evidence/src/bundle.rs, name: writable_bundle_and_unknown_files_fail_closed}
+  - id: acceptance-row-32
+    summary: No test, log, trace, metric, audit event, snapshot, panic, or failure artifact contains the canary credentials, raw selector values, source facts, or Supported Values used by the acceptance suite.
+    tests:
+      - {file: crates/registry-evidence/src/main.rs, name: privacy_expectations_check_exact_projected_strings}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: one_runtime_proves_all_definitions_and_collapses_unresolved_relationships}
+      - {file: crates/registry-evidence/src/model.rs, name: debug_surfaces_redact_requests_facts_disclosures_and_signed_payloads}
+      - {file: crates/registry-evidence/src/audit.rs, name: audit_is_durable_keyed_and_redacted}
+      - {file: crates/registry-evidence/tests/selector_conformance.rs, name: all_runtime_selector_negatives_fail_closed_before_source_access}
+  - id: acceptance-row-33
+    summary: An identifier-only selector profile and a compound selector profile with no identifier both pass the complete service path.
+    tests: [{file: crates/registry-evidence/tests/selector_conformance.rs, name: every_selector_profile_runs_the_complete_signed_service_path}]
+  - id: acceptance-row-34
+    summary: Missing required, unknown, extra, mistyped, empty, oversized, and aggregate-oversized selector fields fail before credential acquisition or source access, with no protected value in the error.
+    tests:
+      - {file: crates/registry-evidence/tests/selector_conformance.rs, name: all_runtime_selector_negatives_fail_closed_before_source_access}
+      - {file: crates/registry-evidence/src/selector.rs, name: selector_claim_values_are_scalar_only}
+  - id: acceptance-row-35
+    summary: Alternative sufficient field sets and sets with an additional disambiguating field require distinct named profiles and are never inferred from caller input.
+    tests:
+      - {file: crates/registry-evidence/tests/selector_conformance.rs, name: every_selector_profile_runs_the_complete_signed_service_path}
+      - {file: crates/registry-evidence/tests/selector_conformance.rs, name: all_runtime_selector_negatives_fail_closed_before_source_access}
+      - {file: crates/registry-evidence/tests/selector_conformance.rs, name: configuration_selector_negatives_are_rejected_at_immutable_bundle_load}
+  - id: acceptance-row-36
+    summary: At least one selector profile uses deployment-defined field names that have no person, identifier, jurisdiction, source-product, or acceptance-case meaning to Rust.
+    tests:
+      - {file: crates/registry-evidence/tests/selector_conformance.rs, name: every_selector_profile_runs_the_complete_signed_service_path}
+      - {file: crates/registry-evidence/tests/selector_conformance.rs, name: all_runtime_selector_negatives_fail_closed_before_source_access}
+  - id: acceptance-row-37
+    summary: Unicode and multipart name-like values pass as bounded opaque strings; core behavior never case-folds, transliterates, tokenizes, applies phonetics, parses Western name order, or performs partial-date matching.
+    tests:
+      - {file: crates/registry-evidence/tests/selector_conformance.rs, name: all_runtime_selector_negatives_fail_closed_before_source_access}
+      - {file: crates/registry-evidence/tests/selector_conformance.rs, name: every_selector_profile_runs_the_complete_signed_service_path}
+      - {file: crates/registry-evidence/src/selector.rs, name: canonical_selector_input_is_order_and_audience_sensitive}
+  - id: acceptance-row-38
+    summary: Provider ambiguity never causes a second data request, page traversal, retrieval beyond the configured maximum of two minimally projected results, candidate choice, derivation execution, or success response.
+    tests:
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: every_frozen_source_shape_executes_through_production_materialization_and_projection}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: source_executor_failure_matrix_is_exact_single_request_and_value_free}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: a_reset_transport_failure_yields_exactly_one_connection_attempt}
+      - {file: crates/registry-evidence/src/runtime.rs, name: public_unavailability_does_not_distinguish_no_match_from_ambiguity}
+  - id: acceptance-row-39
+    summary: Candidate records, candidate counts beyond the closed outcome, scores, confidence, near-match hints, and field-by-field comparison results are rejected by the extraction boundary and absent from public responses.
+    tests:
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: candidate_numeric_string_and_opaque_type_surface_is_pinned}
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: compiler_rejects_every_forbidden_candidate_construct}
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: extraction_decodes_only_the_closed_union_and_validates_facts}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: runtime_rejects_an_extra_extracted_fact_before_derivation_or_release}
+  - id: acceptance-row-40
+    summary: Native audit records at most the selector-profile id and one scoped keyed pseudonym over each complete canonical role and selector bundle; separate hashes of low-entropy fields fail redaction tests.
+    tests:
+      - {file: crates/registry-evidence/src/audit.rs, name: audit_is_durable_keyed_and_redacted}
+      - {file: crates/registry-evidence/src/audit.rs, name: frozen_audit_fixture_matches_native_event_shape_and_phase_rules}
+      - {file: crates/registry-evidence/src/selector.rs, name: canonical_selector_input_is_order_and_audience_sensitive}
+      - {file: crates/registry-evidence/src/binding.rs, name: subject_binding_is_field_order_sensitive}
+  - id: acceptance-row-41
+    summary: Context-derived and authenticated-grant-derived selector profiles reject caller-provided values; an authorized request-derived caseworker profile accepts only its configured closed field set.
+    tests:
+      - {file: crates/registry-evidence/tests/selector_conformance.rs, name: all_runtime_selector_negatives_fail_closed_before_source_access}
+      - {file: crates/registry-evidence/tests/selector_conformance.rs, name: every_selector_profile_runs_the_complete_signed_service_path}
+      - {file: crates/registry-evidence/src/config.rs, name: context_and_grant_claim_maps_are_exact_and_non_aliasing}
+  - id: acceptance-row-42
+    summary: Evidence and the JWS payload never echo selector profile ids or values, and audience-scoped subject bindings do not become globally stable identifiers.
+    tests:
+      - {file: crates/registry-evidence/src/model.rs, name: evidence_has_no_selector_echo_field}
+      - {file: crates/registry-evidence/src/binding.rs, name: subject_binding_is_stable_and_scoped}
+      - {file: crates/registry-evidence/src/binding.rs, name: entity_reference_is_audience_and_concept_scoped}
+      - {file: crates/registry-evidence/src/binding.rs, name: every_subject_binding_scope_component_is_cryptographically_bound}
+  - id: acceptance-row-43
+    summary: Failed selector attempts are bounded per principal and authority profile without using raw selector values as metric or rate-limit labels.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: failed_selector_budget_is_enforced_by_the_runtime_and_scoped_to_authority}
+      - {file: crates/registry-evidence/src/rate_limit.rs, name: selector_failure_budget_is_separate_and_authority_scoped}
+      - {file: crates/registry-evidence/src/rate_limit.rs, name: selector_failure_budget_is_shared_across_request_contexts}
+      - {file: crates/registry-evidence/src/runtime.rs, name: runtime_failures_and_rate_keys_are_value_free}
+      - {file: crates/registry-evidence/src/runtime.rs, name: rate_limit_scope_cannot_be_fragmented_by_request_dimensions}
+  - id: acceptance-row-44
+    summary: All four initial assertion cases pass their assigned selector shapes and lookup outcomes through offline fixtures, local HTTP mocks, the real router, both audit gates, signed JWS, explicitly authorized unsigned output, and strict verification on one revision.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: every_runtime_applicable_acceptance_case_reaches_terminal_audit_and_verification}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: all_four_definitions_pass_the_explicitly_authorized_unsigned_path}
+      - {file: crates/registry-evidence/src/main.rs, name: offline_cli_evaluates_every_coequal_acceptance_fixture}
+      - {file: crates/registry-evidence/src/main.rs, name: offline_cli_evaluates_the_combined_acceptance_bundle}
+      - {file: crates/registry-evidence/src/kernel.rs, name: all_four_acceptance_bundles_use_the_same_kernel}
+  - id: acceptance-row-45
+    summary: Governed bundle and runtime configuration have separate closed schemas, independent startup digests, read-only lifetime enforcement, and negative tests proving runtime fields cannot override sources, authorization, disclosure, limits, signing, or audit policy.
+    tests:
+      - {file: crates/registry-evidence/src/config.rs, name: runtime_document_is_closed_and_contains_no_governed_override_surface}
+      - {file: crates/registry-evidence/src/bundle.rs, name: runtime_and_ca_bytes_are_captured_under_an_independent_read_only_revision}
+      - {file: crates/registry-evidence/src/bundle.rs, name: writable_bundle_and_unknown_files_fail_closed}
+      - {file: crates/registry-evidence/src/bundle.rs, name: symlinked_artifact_fails_before_file_access}
+  - id: acceptance-row-46
+    summary: Fixed paths and selector-bound path templates pass exact encoding tests; missing, extra, duplicated, slash, backslash, percent, control, empty, and dot-segment bindings fail before credential acquisition or source access.
+    tests:
+      - {file: crates/registry-evidence/src/source.rs, name: path_selector_encoding_is_single_pass_and_hostile_values_fail_closed}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: path_binding_contract_rejects_empty_missing_and_extra_material_before_credentials}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: hostile_path_values_and_malformed_preparation_fail_before_transport_and_redact}
+      - {file: crates/registry-evidence/src/config.rs, name: path_templates_headers_and_projection_fail_closed}
+  - id: acceptance-row-47
+    summary: Fixed non-secret headers, static Bearer, and static API-key authentication pass generic exact-request and redaction tests; forbidden, duplicate, framing, routing, forwarding, proxy, tracing, cookie, and authentication header collisions fail at startup.
+    tests:
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: basic_bearer_and_static_api_key_headers_are_exact_and_failures_are_redacted}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: forbidden_header_collisions_and_invalid_projection_contracts_fail_at_compilation}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: exact_request_applies_path_query_body_headers_auth_and_projection_once}
+  - id: acceptance-row-48
+    summary: System roots and logical private-CA trust profiles pass positive TLS tests; unbound, malformed, insecure, symlinked, mutable, or hostname-bypassing CA configurations prevent readiness, and ambient HTTP proxy environment variables cannot redirect evidence-data or OAuth requests.
+    tests:
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: private_ca_tls_handshake_succeeds_and_hostname_mismatch_fails}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: private_ca_plan_rejects_unbound_missing_and_malformed_captures}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: runtime_ca_capture_rejects_symlink_malformed_and_mutable_files}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: ambient_proxy_variables_are_ignored_in_an_isolated_process}
+      - {file: crates/registry-evidence/src/source.rs, name: evidence_client_uses_rustls_and_fails_closed_on_an_unrecognized_certificate_authority}
+  - id: acceptance-row-49
+    summary: Extended JSON Pointer response projection passes flat, nested, array, literal-dot-key, missing-leaf, mistyped-intermediate, invalid-escape, duplicate, overlap, size-before-projection, and privacy-canary tests; Rhai sees only the projected tree while posture reflects the pre-projection wire response.
+    tests:
+      - {file: crates/registry-evidence/src/source.rs, name: projection_supports_nested_arrays_escapes_and_literal_dots}
+      - {file: crates/registry-evidence/src/source.rs, name: projection_omits_missing_leaves_but_rejects_missing_or_mistyped_intermediates}
+      - {file: crates/registry-evidence/src/source.rs, name: projection_rejects_duplicates_conflicts_indexes_and_mixed_container_shapes}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: projection_missing_leaf_is_omitted_but_bad_intermediate_stops_before_extraction}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: every_acquisition_posture_fixture_executes_with_one_bounded_request}
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: extraction_source_input_uses_the_configured_one_mebibyte_boundary}
+  - id: acceptance-row-50
+    summary: parse_integer accepts the documented ASCII grammar and leading zeroes and rejects empty, plus-prefixed, whitespace, non-ASCII, fractional, exponential, and overflowing values; query values remain strings and no implicit value-to-string conversion is introduced.
+    tests:
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: strict_integer_parser_and_mutating_helpers_enforce_bounds}
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: out_of_range_json_integer_tokens_fail_before_rhai}
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: preparation_inputs_and_request_parts_are_closed_and_bounded}
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: candidate_numeric_string_and_opaque_type_surface_is_pinned}
+  - id: acceptance-row-51
+    summary: Public request subjects are resolved uniquely by role rather than array position; permutations produce the same authorized internal role order, and duplicate, missing, unknown, or wrong-profile roles fail before credentials or source access.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: multi_role_request_order_is_not_semantic_and_output_uses_declaration_order}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: reordered_grant_subjects_resolve_by_role_and_emit_declaration_order}
+      - {file: crates/registry-evidence/tests/selector_conformance.rs, name: all_runtime_selector_negatives_fail_closed_before_source_access}
+      - {file: crates/registry-evidence/src/kernel.rs, name: evidence_construction_is_deterministic_and_role_ordered}
+  - id: acceptance-row-52
+    summary: The request nonce is exactly the canonical 43-character unpadded base64url encoding of 32 bytes; missing, duplicate, padding, noncanonical, malformed, wrong-length, and oversized values fail before credential acquisition or source access, and nonce canaries never reach authorization, Rhai, source preparation, source calls, logs, or audit.
+    tests:
+      - {file: crates/registry-evidence/src/model.rs, name: request_nonce_canonicality_is_exact}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: request_nonce_is_strict_and_never_reaches_source_or_audit}
+      - {file: crates/registry-evidence/src/server.rs, name: request_json_is_strict_and_closed}
+  - id: acceptance-row-53
+    summary: Signed Evidence echoes the exact request nonce; changing the expected or signed nonce fails verification, and nonce reuse is not represented as replay prevention.
+    tests:
+      - {file: crates/registry-evidence/src/verifier.rs, name: expected_nonce_must_match_and_reuse_is_not_replay_prevention}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: request_nonce_is_strict_and_never_reaches_source_or_audit}
+  - id: acceptance-row-54
+    summary: The verifier requires independently trusted expected subject roles and opaque bindings plus expected concept identifiers, forms, and cardinalities after signature verification; missing, extra, duplicated, substituted, or wrong-key-version bindings and unexpected output fail, and subject order alone is non-semantic.
+    tests:
+      - {file: crates/registry-evidence/src/verifier.rs, name: expected_subject_set_is_unordered_unique_and_exact}
+      - {file: crates/registry-evidence/src/verifier.rs, name: expected_output_contract_is_exact_after_signature_verification}
+      - {file: crates/registry-evidence/src/verifier.rs, name: signature_never_substitutes_for_provider_and_issuer_trust_policy}
+      - {file: crates/registry-evidence/src/verifier.rs, name: retired_public_key_verifies_only_while_published_and_payload_is_current}
+      - {file: crates/registry-evidence/src/verifier.rs, name: active_plus_maximum_retired_keys_is_a_usable_trusted_set}
+  - id: acceptance-row-55
+    summary: Missing Accept, */*, and exact signed media select JWS; only exact unsigned media selects unsigned JSON, and duplicate, combined, parameterized, weighted, or unknown negotiation fails before source access.
+    tests:
+      - {file: crates/registry-evidence/src/server.rs, name: accept_negotiation_matrix_is_closed_and_exact}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: accept_negotiation_is_closed_and_fails_before_source_access}
+  - id: acceptance-row-56
+    summary: Unsigned selection succeeds only when both the bundle and the matched authority grant permit it; caller selection, runtime configuration, or a different grant cannot create permission.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: unsigned_output_requires_both_bundle_and_grant_permission}
+      - {file: crates/registry-evidence/src/config.rs, name: response_formats_are_closed_unique_and_keep_signed_mandatory}
+      - {file: crates/registry-evidence/src/config.rs, name: runtime_document_is_closed_and_contains_no_governed_override_surface}
+  - id: acceptance-row-57
+    summary: Signing or signed-release failure never returns unsigned output; an explicitly authorized unsigned request performs no signing operation and still requires the ordinary signing dependency to be ready.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: signing_failure_returns_a_problem_and_never_an_unsigned_body}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: signing_failure_is_transient_audited_and_never_releases_unsigned_evidence}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: unsigned_envelope_is_exact_audited_and_never_a_signing_fallback}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: readiness_fails_for_missing_credentials_tampered_audit_and_unready_signing}
+  - id: acceptance-row-58
+    summary: The unsigned envelope has its exact vendor media type, schema, type, integrity marker, warning, and closed nested Evidence with no protected, payload, signature, or signing-key claim, and the JWS verifier rejects it.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: unsigned_envelope_is_exact_audited_and_never_a_signing_fallback}
+      - {file: crates/registry-evidence/src/verifier.rs, name: unsigned_envelope_is_rejected_by_the_strict_jws_verifier}
+      - {file: crates/registry-evidence/src/contracts.rs, name: schemas_accept_the_exact_public_wire_shapes}
+      - {file: crates/registry-evidence/src/contracts.rs, name: jws_and_problem_schemas_are_closed}
+  - id: acceptance-row-59
+    summary: Both response formats serialize final immutable bytes and require durable disclosure-release audit before release; audit records the closed protection mode and conditionally requires or forbids signingKeyId without recording nonce, selectors, source values, or disclosed values.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: disclosure_audit_failure_prevents_signed_response_release}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: disclosure_audit_failure_prevents_unsigned_response_release}
+      - {file: crates/registry-evidence/src/audit.rs, name: frozen_audit_fixture_matches_native_event_shape_and_phase_rules}
+      - {file: crates/registry-evidence/src/audit.rs, name: invalid_release_shape_and_size_limit_fail_closed}
+      - {file: crates/registry-evidence/src/audit.rs, name: audit_is_durable_keyed_and_redacted}
+  - id: acceptance-row-60
+    summary: All four coequal definitions pass signed and explicitly authorized unsigned paths through the same router, source executor, derivation, output gate, subject binding, minimization, and audit logic without domain branches.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: all_four_definitions_pass_the_explicitly_authorized_unsigned_path}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: every_runtime_applicable_acceptance_case_reaches_terminal_audit_and_verification}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: one_runtime_proves_all_definitions_and_collapses_unresolved_relationships}
+      - {file: crates/registry-evidence/src/config.rs, name: all_coequal_acceptance_definitions_use_the_same_typed_config}
+  - id: acceptance-row-61
+    summary: Verification tooling re-verifies a stored signed response against a pinned trusted key, expected policy, request nonce, subject bindings, and output contract, and reports cryptographic authenticity separately from current validity.
+    tests:
+      - {file: crates/registry-evidence/src/verifier.rs, name: authenticity_is_reported_separately_from_current_validity}
+      - {file: crates/registry-evidence/src/verifier.rs, name: expected_output_contract_is_exact_after_signature_verification}
+      - {file: crates/registry-evidence/src/verifier.rs, name: expected_nonce_must_match_and_reuse_is_not_replay_prevention}
+      - {file: crates/registry-evidence/src/verifier.rs, name: expected_subject_set_is_unordered_unique_and_exact}
+      - {file: crates/registry-evidence/src/verifier.rs, name: assertion_lifetime_above_the_accepted_maximum_fails}
+      - {file: crates/registry-evidence/src/verifier.rs, name: complete_jws_negative_fixture_is_executable}
+      - {file: crates/registry-evidence/tests/cli.rs, name: verify_accepts_an_authentic_and_current_stored_response}
+      - {file: crates/registry-evidence/tests/cli.rs, name: verify_separates_authenticity_from_current_validity}
+      - {file: crates/registry-evidence/tests/cli.rs, name: verify_rejects_a_tampered_payload_without_naming_a_value}
+      - {file: crates/registry-evidence/tests/cli.rs, name: verify_reports_only_the_generic_policy_class_for_a_wrong_expected_nonce}
+      - {file: crates/registry-evidence/tests/cli.rs, name: verify_rejects_a_policy_document_with_an_unknown_field}
+  - id: acceptance-row-62
+    summary: Authenticated discovery returns only complete request shapes matching exactly one authority path for the verified caller; unentitled callers receive an empty list, ambiguous shapes are omitted, deployment internals are absent, and no provider request or evidence-data audit event occurs.
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: discovery_requires_authentication_and_returns_no_unentitled_definitions}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: discovery_omits_an_authority_shape_that_the_runtime_would_deny_as_ambiguous}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: discovery_uses_the_bounded_per_principal_request_budget}
+      - {file: crates/registry-evidence/src/contracts.rs, name: openapi_has_only_the_version_one_routes_and_exact_success_media}
diff --git a/products/evidence/contracts/audit-event.schema.yaml b/products/evidence/contracts/audit-event.schema.yaml
new file mode 100644
index 000000000..973f9b9da
--- /dev/null
+++ b/products/evidence/contracts/audit-event.schema.yaml
@@ -0,0 +1,103 @@
+$schema: https://json-schema.org/draft/2020-12/schema
+$id: https://registrystack.org/schemas/evidence/audit-event-v1.json
+title: Evidence native audit event Version 1
+type: object
+additionalProperties: false
+required:
+  - schema
+  - assuranceProfile
+  - eventId
+  - occurredAt
+  - operation
+  - phase
+  - requirement
+  - bundleRevision
+  - purpose
+  - requesterPseudonym
+  - authority
+  - subjects
+  - responseProtection
+  - decision
+  - durationMilliseconds
+properties:
+  schema: {const: registry.evidence.audit/v1}
+  assuranceProfile: {enum: [local, production, evidence-grade]}
+  eventId: {type: string, format: uri, maxLength: 512}
+  occurredAt: {type: string, format: date-time}
+  operation: {type: string, minLength: 16, maxLength: 128}
+  phase: {enum: [access-attempt, disclosure-release, denial, transient-failure]}
+  requirement: {type: string, format: uri, maxLength: 512}
+  bundleRevision: {type: string, pattern: '^sha256:[a-f0-9]{64}$'}
+  purpose: {type: string, pattern: '^[a-z][a-z0-9._:-]{0,127}$'}
+  requesterPseudonym: {$ref: '#/$defs/pseudonym'}
+  actorPseudonym: {$ref: '#/$defs/pseudonym'}
+  authority:
+    type: object
+    additionalProperties: false
+    required: [kind]
+    properties:
+      kind: {enum: [statutory, organizational, consent, delegated, explicit-request]}
+      grantPseudonym: {$ref: '#/$defs/pseudonym'}
+  subjects:
+    type: array
+    minItems: 1
+    maxItems: 8
+    items:
+      type: object
+      additionalProperties: false
+      required: [role, selectorProfile]
+      properties:
+        role: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+        selectorProfile: {type: string, pattern: '^[a-z][a-z0-9._-]{0,127}$'}
+        selectorBundlePseudonym: {$ref: '#/$defs/pseudonym'}
+  responseProtection: {enum: [signed, unsigned, sd-jwt-vc]}
+  sourceId: {type: string, pattern: '^[a-z][a-z0-9._-]{0,127}$'}
+  adapterId: {type: string, pattern: '^[a-z][a-z0-9._-]{0,127}$'}
+  decision:
+    enum: [authorized, released, no-match, ambiguous, fact-missing, dependency-failure, evaluation-failure, signing-failure]
+  disclosedConcepts:
+    type: array
+    maxItems: 16
+    uniqueItems: true
+    items: {type: string, format: uri, maxLength: 512}
+  evidenceId: {type: string, format: uri, maxLength: 512}
+  signingKeyId: {type: string, minLength: 1, maxLength: 256}
+  safeErrorCategory: {type: string, pattern: '^[a-z][a-z0-9._-]{0,127}$'}
+  durationMilliseconds: {type: integer, minimum: 0, maximum: 86400000}
+$defs:
+  pseudonym:
+    type: string
+    pattern: '^hmac-sha256:v[1-9][0-9]*:[a-f0-9]{64}$'
+allOf:
+  - if: {properties: {phase: {const: disclosure-release}}}
+    then: {required: [disclosedConcepts, evidenceId]}
+    else:
+      not:
+        anyOf:
+          - {required: [disclosedConcepts]}
+          - {required: [evidenceId]}
+          - {required: [signingKeyId]}
+  - if:
+      properties:
+        phase: {const: disclosure-release}
+        responseProtection: {enum: [signed, sd-jwt-vc]}
+    then: {required: [signingKeyId]}
+  - if: {properties: {responseProtection: {const: unsigned}}}
+    then: {not: {required: [signingKeyId]}}
+audit_rules:
+  access_gate: access-attempt is durably accepted after authorization and before credential acquisition or source access
+  release_gate: disclosure-release is durably accepted after the final immutable response bytes are serialized and before those exact bytes are released
+  response_protection: every event records the closed non-secret responseProtection mode resolved with authorization; signingKeyId exists exactly for cryptographically protected disclosure release, which is the signed flattened JWS and the SD-JWT VC serialization, and is forbidden for unsigned output
+  failure_policy: sink failure blocks the applicable step
+  chain_verification: At startup and after restart, the newest sealed segment supplies the prior chain head and the complete active segment is verified from that head. Complete retained-history verification is an out-of-band operator duty performed with evidence verify-audit across every available sealed segment and, when the writer is stopped, the active segment. Steady-state appends and readiness verify the pinned active-segment identity, modification fingerprint, expected length, verified tail, and lock-file identity without rescanning sealed history or the growing active segment.
+  external_mutation: Any external replacement or modification of the active segment or lock file fails readiness and future appends closed for the process lifetime. Mutation within older sealed history is detected by complete out-of-band verification, not by serving-process startup or readiness.
+  pre_material_denial: Authentication, unmatched-authority, and invalid-selector failures occur before a privacy-safe authority and complete selector bundle exist, so no native event is fabricated from their untrusted or protected request material.
+  pseudonym_domains: [requester, actor, grant, subject]
+  subject_scope: key version plus operator trust domain, purpose, audience, role, profile, and complete canonical selector bundle
+  never_record:
+    - raw principal, actor, grant, selector, source, or supported values
+    - separate hashes of low-entropy selector fields
+    - credentials, tokens, request or response bodies
+    - the request nonce
+    - candidate count, candidates, scores, hints, or comparisons
+    - script inputs, outputs, stacks, or signing material
diff --git a/products/evidence/contracts/authority-context.schema.yaml b/products/evidence/contracts/authority-context.schema.yaml
new file mode 100644
index 000000000..3bfcdcc9a
--- /dev/null
+++ b/products/evidence/contracts/authority-context.schema.yaml
@@ -0,0 +1,136 @@
+$schema: https://json-schema.org/draft/2020-12/schema
+$id: https://registrystack.org/schemas/evidence/authority-context-v1.json
+title: Normalized Evidence authority context Version 1
+description: Internal core-owned value; never accepted as an Evidence request body and never logged verbatim.
+type: object
+additionalProperties: false
+required: [authenticationProfile, principal, audience, entitlements, selectorSources]
+properties:
+  authenticationProfile: {type: string, pattern: '^[a-z][a-z0-9._-]{0,127}$'}
+  principal: {type: string, minLength: 1, maxLength: 512}
+  actor: {type: string, minLength: 1, maxLength: 512}
+  requesterAttributes:
+    type: object
+    maxProperties: 32
+    propertyNames: {pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+    additionalProperties:
+      oneOf:
+        - {type: string, maxLength: 512}
+        - {type: boolean}
+        - type: array
+          maxItems: 32
+          items: {type: string, maxLength: 512}
+  audience: {type: string, format: uri, maxLength: 512}
+  entitlements:
+    type: array
+    minItems: 1
+    maxItems: 128
+    items: {$ref: '#/$defs/entitlement'}
+  selectorSources:
+    type: array
+    maxItems: 16
+    items: {$ref: '#/$defs/selector-source'}
+$defs:
+  entitlement:
+    type: object
+    additionalProperties: false
+    required: [authorityProfile, authorityKind, requirement, purpose, audience, subjects]
+    properties:
+      authorityProfile: {type: string, pattern: '^[a-z][a-z0-9._-]{0,127}$'}
+      authorityKind: {enum: [statutory, organizational, consent, delegated, explicit-request]}
+      grantId: {type: string, minLength: 1, maxLength: 512}
+      requirement: {type: string, format: uri, maxLength: 512}
+      purpose: {type: string, pattern: '^[a-z][a-z0-9._:-]{0,127}$'}
+      audience: {type: string, format: uri, maxLength: 512}
+      subjects:
+        type: array
+        minItems: 1
+        maxItems: 8
+        items: {$ref: '#/$defs/subject-authorization'}
+  subject-authorization:
+    type: object
+    additionalProperties: false
+    required: [role, selectorProfile, valueOrigin]
+    properties:
+      role: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+      selectorProfile: {type: string, pattern: '^[a-z][a-z0-9._-]{0,127}$'}
+      valueOrigin: {enum: [authenticated-context, authenticated-grant, request]}
+      valueClaims:
+        type: object
+        minProperties: 1
+        maxProperties: 16
+        propertyNames: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+        additionalProperties: {$ref: '#/$defs/claim-path'}
+    allOf:
+      - if:
+          required: [valueOrigin]
+          properties:
+            valueOrigin: {enum: [authenticated-context, authenticated-grant]}
+        then: {required: [valueClaims]}
+      - if:
+          required: [valueOrigin]
+          properties:
+            valueOrigin: {const: request}
+        then:
+          not: {required: [valueClaims]}
+  selector-source:
+    type: object
+    additionalProperties: false
+    required: [role, selectorProfile, valueOrigin, values]
+    properties:
+      role: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+      selectorProfile: {type: string, pattern: '^[a-z][a-z0-9._-]{0,127}$'}
+      valueOrigin: {enum: [authenticated-context, authenticated-grant]}
+      grantId: {type: string, minLength: 1, maxLength: 512}
+      grantAuthority: {type: string, minLength: 1, maxLength: 512}
+      values:
+        type: object
+        minProperties: 1
+        maxProperties: 16
+        additionalProperties:
+          oneOf:
+            - {type: string, minLength: 1, maxLength: 512}
+            - {type: integer, minimum: -9007199254740991, maximum: 9007199254740991}
+            - {type: boolean}
+    allOf:
+      - if:
+          required: [valueOrigin]
+          properties:
+            valueOrigin: {const: authenticated-grant}
+        then: {required: [grantId, grantAuthority]}
+        else:
+          not:
+            anyOf:
+              - {required: [grantId]}
+              - {required: [grantAuthority]}
+  claim-path:
+    type: string
+    pattern: '^[A-Za-z_][A-Za-z0-9_-]*(\.[A-Za-z_][A-Za-z0-9_-]*)*$'
+allOf:
+  - if: {required: [actor]}
+    then:
+      properties:
+        entitlements:
+          contains:
+            type: object
+            required: [authorityKind]
+            properties: {authorityKind: {const: delegated}}
+authorization_decision:
+  exact_inputs:
+    - principal
+    - optional actor
+    - exact requirement revision
+    - purpose
+    - audience
+    - authority profile and kind
+    - optional authenticated grant identifier
+    - complete set of role, selector profile, and value origin tuples
+  matching_rule: One entitlement must cover the complete request; permissions are never unioned across entitlements.
+  principal_rule: Principal derives only from the one configured validated claim; a missing claim denies with no client_id, azp, header, or request fallback.
+  grant_rule: A grant identifier is context, never authority by possession; it must already be authenticated and bound to the matched entitlement.
+  selector_claim_rule: Context-derived and grant-derived selector values resolve only through the complete configured valueClaims map over the already verified token; request-derived subjects prohibit valueClaims.
+  authenticated_grant_rule: Values from the configured grantIdClaim and grantAuthorityClaim must both exist, grantAuthority must exactly equal the matched authority-profile identifier, and the same entitlement must cover the complete request; neither value may come from the caller request.
+  denial_order: Deny before source credential resolution or source access.
+privacy:
+  raw_context_in_logs_audit_errors: prohibited
+  audit_transformation: domain-separated keyed pseudonyms only
diff --git a/products/evidence/contracts/bundle.schema.yaml b/products/evidence/contracts/bundle.schema.yaml
new file mode 100644
index 000000000..07076313f
--- /dev/null
+++ b/products/evidence/contracts/bundle.schema.yaml
@@ -0,0 +1,753 @@
+$schema: https://json-schema.org/draft/2020-12/schema
+$id: https://registrystack.org/schemas/evidence/bundle-v1.json
+title: Evidence immutable deployment bundle Version 1
+type: object
+additionalProperties: false
+required: [version, assuranceProfile, service, issuer, authentication, audit, subjectBinding, rateLimits, signing, selectorProfiles, sources, authorityProfiles, requirements]
+properties:
+  version: {const: 1}
+  assuranceProfile: {enum: [local, production, evidence-grade]}
+  service:
+    type: object
+    additionalProperties: false
+    required: [providerId, trustDomain]
+    properties:
+      providerId: {type: string, format: uri, maxLength: 512}
+      trustDomain: {type: string, format: uri, maxLength: 512}
+  issuer:
+    type: object
+    additionalProperties: false
+    required: [id]
+    properties: {id: {type: string, format: uri, maxLength: 512}}
+  authentication: {$ref: '#/$defs/authentication'}
+  audit: {$ref: '#/$defs/audit'}
+  subjectBinding: {$ref: '#/$defs/subject-binding'}
+  rateLimits: {$ref: '#/$defs/rate-limits'}
+  signing:
+    type: object
+    additionalProperties: false
+    required: [format, algorithm, activeKeyId, activeKeyRef, retiredPublicJwkFiles, jwksPath, maximumAssertionValiditySeconds, verifierClockSkewSeconds]
+    properties:
+      format: {const: flattened-jws-json}
+      algorithm: {const: EdDSA}
+      activeKeyId: {type: string, minLength: 1, maxLength: 256, pattern: '^[^\u0000-\u001F\u007F-\u009F]+$'}
+      activeKeyRef: {$ref: '#/$defs/secret-ref'}
+      retiredPublicJwkFiles:
+        type: array
+        maxItems: 32
+        uniqueItems: true
+        items: {$ref: '#/$defs/public-jwk-path'}
+      jwksPath: {const: /.well-known/evidence/jwks.json}
+      maximumAssertionValiditySeconds: {type: integer, minimum: 1, maximum: 31536000}
+      verifierClockSkewSeconds: {type: integer, minimum: 0, maximum: 600}
+  responseFormats: {$ref: '#/$defs/response-formats'}
+  selectorProfiles:
+    type: object
+    minProperties: 1
+    maxProperties: 128
+    propertyNames: {$ref: '#/$defs/local-id'}
+    additionalProperties: {$ref: '#/$defs/selector-profile'}
+  sources:
+    type: object
+    minProperties: 1
+    maxProperties: 128
+    propertyNames: {$ref: '#/$defs/local-id'}
+    additionalProperties: {$ref: '#/$defs/source'}
+  authorityProfiles:
+    type: object
+    minProperties: 1
+    maxProperties: 128
+    propertyNames: {$ref: '#/$defs/local-id'}
+    additionalProperties: {$ref: '#/$defs/authority-profile'}
+  requirements:
+    type: array
+    minItems: 1
+    maxItems: 128
+    items: {$ref: '#/$defs/requirement'}
+allOf:
+  - if:
+      properties: {assuranceProfile: {const: local}}
+    then:
+      properties:
+        authentication:
+          properties:
+            issuer: {pattern: '^(?:https://|http://127\.0\.0\.1:[1-9][0-9]{0,4}$)'}
+            jwksUri: {pattern: '^(?:https://|http://127\.0\.0\.1:[1-9][0-9]{0,4}/\.well-known/jwks\.json$)'}
+  - if:
+      properties: {assuranceProfile: {enum: [production, evidence-grade]}}
+    then:
+      properties:
+        authentication:
+          properties:
+            issuer: {pattern: '^https://'}
+            jwksUri: {pattern: '^https://'}
+        requirements:
+          items: {required: [fixtures]}
+        sources:
+          additionalProperties:
+            properties:
+              authentication:
+                not:
+                  type: object
+                  required: [kind]
+                  properties: {kind: {const: none}}
+$defs:
+  local-id: {type: string, pattern: '^[a-z][a-z0-9._-]{0,127}$'}
+  uri: {type: string, format: uri, maxLength: 512}
+  response-formats:
+    # Closed enabled response formats. Signed flattened JWS is mandatory and
+    # remains the default; the unsigned and SD-JWT VC formats must each be
+    # enabled by the bundle and permitted by the complete matched grant.
+    # Omission means signed only.
+    type: array
+    minItems: 1
+    maxItems: 3
+    uniqueItems: true
+    contains: {const: signed-jws}
+    items: {enum: [signed-jws, unsigned-json, sd-jwt-vc]}
+  secret-ref:
+    {type: string, pattern: '^secret:file/[a-z][a-z0-9._-]{0,127}$'}
+  relative-path: {type: string, pattern: '^(adapters|derivations|schemas|codelists|fixtures)/[A-Za-z0-9._/-]+$'}
+  public-jwk-path: {type: string, pattern: '^public-keys/[A-Za-z0-9._-]+\.jwk\.json$'}
+  authentication:
+    type: object
+    additionalProperties: false
+    required: [kind, issuer, audiences, tokenTypes, algorithms, jwksUri, principalClaim, requesterTagsClaim, evidenceAudienceClaim, grantIdClaim, grantAuthorityClaim]
+    properties:
+      kind: {const: oidc-access-token}
+      issuer: {type: string, pattern: '^https?://', maxLength: 512}
+      audiences:
+        type: array
+        minItems: 1
+        maxItems: 16
+        uniqueItems: true
+        items: {type: string, minLength: 1, maxLength: 512}
+      tokenTypes:
+        type: array
+        minItems: 1
+        maxItems: 4
+        uniqueItems: true
+        items: {enum: [at+jwt, application/at+jwt]}
+      algorithms:
+        type: array
+        minItems: 1
+        maxItems: 3
+        uniqueItems: true
+        items: {enum: [EdDSA, ES256, RS256]}
+      jwksUri: {type: string, pattern: '^https?://', maxLength: 512}
+      principalClaim: {$ref: '#/$defs/claim-name'}
+      requesterTagsClaim: {$ref: '#/$defs/claim-name'}
+      evidenceAudienceClaim: {$ref: '#/$defs/claim-name'}
+      grantIdClaim: {$ref: '#/$defs/claim-name'}
+      grantAuthorityClaim: {$ref: '#/$defs/claim-name'}
+      actorClaim: {$ref: '#/$defs/claim-name'}
+  audit:
+    type: object
+    additionalProperties: false
+    required: [format, hashSecretRef, hashKeyVersion, failClosed]
+    properties:
+      format: {const: keyed-jsonl}
+      hashSecretRef: {$ref: '#/$defs/secret-ref'}
+      hashKeyVersion: {type: integer, minimum: 1, maximum: 2147483647}
+      failClosed: {const: true}
+  subject-binding:
+    type: object
+    additionalProperties: false
+    required: [secretRef, keyVersion]
+    properties:
+      secretRef: {$ref: '#/$defs/secret-ref'}
+      keyVersion: {type: integer, minimum: 1, maximum: 2147483647}
+  rate-limits:
+    type: object
+    additionalProperties: false
+    required: [requestsPerPrincipalPerMinute, burstPerPrincipal, failedSelectorAttemptsPerPrincipalAuthorityPerMinute]
+    properties:
+      requestsPerPrincipalPerMinute: {type: integer, minimum: 1, maximum: 1000000}
+      burstPerPrincipal: {type: integer, minimum: 1, maximum: 100000}
+      failedSelectorAttemptsPerPrincipalAuthorityPerMinute: {type: integer, minimum: 1, maximum: 100000}
+  claim-name: {type: string, pattern: '^[A-Za-z_][A-Za-z0-9_.-]{0,127}$'}
+  claim-path: {type: string, pattern: '^[A-Za-z_][A-Za-z0-9_-]*(\.[A-Za-z_][A-Za-z0-9_-]*)*$'}
+  selector-profile:
+    type: object
+    additionalProperties: false
+    required: [maximumAggregateBytes, fields]
+    properties:
+      maximumAggregateBytes: {type: integer, minimum: 1, maximum: 8192}
+      fields:
+        type: object
+        minProperties: 1
+        maxProperties: 16
+        propertyNames: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+        additionalProperties: {$ref: '#/$defs/selector-field'}
+  selector-field:
+    oneOf:
+      - type: object
+        additionalProperties: false
+        required: [type, minimumBytes, maximumBytes]
+        properties:
+          type: {const: string}
+          minimumBytes: {type: integer, minimum: 1, maximum: 8192}
+          maximumBytes: {type: integer, minimum: 1, maximum: 8192}
+      - type: object
+        additionalProperties: false
+        required: [type]
+        properties: {type: {const: date}}
+      - type: object
+        additionalProperties: false
+        required: [type, minimum, maximum]
+        properties:
+          type: {const: integer}
+          minimum: {type: integer, minimum: -9007199254740991, maximum: 9007199254740991}
+          maximum: {type: integer, minimum: -9007199254740991, maximum: 9007199254740991}
+      - type: object
+        additionalProperties: false
+        required: [type]
+        properties: {type: {const: boolean}}
+      - type: object
+        additionalProperties: false
+        required: [type, codelist, codelistVersion, maximumBytes]
+        properties:
+          type: {const: controlled-code}
+          codelist: {$ref: '#/$defs/relative-path'}
+          codelistVersion: {type: string, minLength: 1, maxLength: 128}
+          maximumBytes: {type: integer, minimum: 1, maximum: 8192}
+  source:
+    type: object
+    additionalProperties: false
+    required: [transport, baseUrl, posture, authentication, request, responseSchema, extractScript, factSchema]
+    properties:
+      transport: {const: http-json}
+      baseUrl:
+        oneOf:
+          - {type: string, pattern: '^https://[^/?#]+$'}
+          - {type: string, pattern: '^http://(127(\.[0-9]{1,3}){3}|\[::1\])(:[0-9]{1,5})?$'}
+      posture: {enum: [source-derived, field-projected, record-transformed]}
+      tlsTrustProfile: {$ref: '#/$defs/local-id'}
+      authentication: {$ref: '#/$defs/source-authentication'}
+      request: {$ref: '#/$defs/fixed-request'}
+      responseSchema: {$ref: '#/$defs/relative-path'}
+      extractScript: {$ref: '#/$defs/relative-path'}
+      factSchema: {$ref: '#/$defs/relative-path'}
+    allOf:
+      - if:
+          required: [authentication]
+          properties:
+            authentication:
+              type: object
+              required: [kind]
+              properties: {kind: {const: none}}
+        then:
+          properties:
+            baseUrl:
+              type: string
+              pattern: '^http://(?:127\.(?:0|[1-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.(?:0|[1-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.(?:0|[1-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|\[::1\]):(?:[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$'
+          not: {required: [tlsTrustProfile]}
+  source-authentication:
+    oneOf:
+      - type: object
+        additionalProperties: false
+        required: [kind]
+        properties: {kind: {const: none}}
+      - type: object
+        additionalProperties: false
+        required: [kind, usernameRef, passwordRef]
+        properties:
+          kind: {const: basic}
+          usernameRef: {$ref: '#/$defs/secret-ref'}
+          passwordRef: {$ref: '#/$defs/secret-ref'}
+      - type: object
+        additionalProperties: false
+        required: [kind, tokenRef]
+        properties:
+          kind: {const: static-bearer}
+          tokenRef: {$ref: '#/$defs/secret-ref'}
+      - type: object
+        additionalProperties: false
+        required: [kind, headerName, valueRef]
+        properties:
+          kind: {const: static-api-key}
+          headerName: {$ref: '#/$defs/configurable-header-name'}
+          valueRef: {$ref: '#/$defs/secret-ref'}
+      - type: object
+        additionalProperties: false
+        required: [kind, tokenEndpoint, clientIdRef, clientSecretRef, credentialPlacement, maximumCacheSeconds]
+        properties:
+          kind: {const: oauth2-client-credentials}
+          tokenEndpoint:
+            oneOf:
+              - {type: string, pattern: '^https://[^?#]+$'}
+              - {type: string, pattern: '^http://(127(\.[0-9]{1,3}){3}|\[::1\])(:[0-9]{1,5})?/[^?#]*$'}
+          clientIdRef: {$ref: '#/$defs/secret-ref'}
+          clientSecretRef: {$ref: '#/$defs/secret-ref'}
+          scope: {type: string, minLength: 1, maxLength: 512}
+          credentialPlacement: {enum: [basic-header, form-body]}
+          maximumCacheSeconds: {type: integer, minimum: 0, maximum: 86400}
+          assumedLifetimeSeconds: {type: integer, minimum: 1, maximum: 86400}
+  fixed-request:
+    type: object
+    additionalProperties: false
+    required: [method, selectorInputs, prepareScript, adapterParameters, adapterParametersSchema, preparationLimits, projection, redirects, timeoutMilliseconds, maximumResponseBytes, concurrencyLimit]
+    properties:
+      method: {enum: [GET, POST]}
+      path: {type: string, pattern: '^/(?!/)[A-Za-z0-9._~!$&''()*+,;=:@%/-]*$'}
+      pathTemplate: {type: string, minLength: 2, maxLength: 2048, pattern: '^/(?!/)[A-Za-z0-9._~!$&''()*+,;=:@%/{\}-]*$'}
+      pathBindings:
+        type: object
+        minProperties: 1
+        maxProperties: 16
+        propertyNames: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+        additionalProperties: {$ref: '#/$defs/path-binding'}
+      fixedHeaders:
+        type: array
+        maxItems: 32
+        items:
+          type: object
+          additionalProperties: false
+          required: [name, value]
+          properties:
+            name: {$ref: '#/$defs/configurable-header-name'}
+            value: {type: string, maxLength: 4096, pattern: '^[^\u0000-\u001F\u007F-\u009F]*$'}
+      selectorInputs:
+        type: array
+        minItems: 1
+        maxItems: 8
+        items: {$ref: '#/$defs/selector-input'}
+      prepareScript: {$ref: '#/$defs/relative-path'}
+      adapterParameters:
+        type: object
+        maxProperties: 64
+        propertyNames: {$ref: '#/$defs/parameter-key'}
+        additionalProperties: {$ref: '#/$defs/adapter-parameter-value'}
+      adapterParametersSchema: {$ref: '#/$defs/relative-path'}
+      preparationLimits: {$ref: '#/$defs/preparation-limits'}
+      projection:
+        type: array
+        minItems: 1
+        maxItems: 64
+        uniqueItems: true
+        items: {type: string, minLength: 2, maxLength: 256, pattern: '^/(?!/)([^/~]|~[01]|/|\*)+$'}
+      redirects: {const: deny}
+      timeoutMilliseconds: {type: integer, minimum: 1, maximum: 30000}
+      maximumResponseBytes: {type: integer, minimum: 1, maximum: 1048576}
+      concurrencyLimit: {type: integer, minimum: 1, maximum: 256}
+    oneOf:
+      - required: [path]
+        not: {anyOf: [{required: [pathTemplate]}, {required: [pathBindings]}]}
+      - required: [pathTemplate, pathBindings]
+        not: {required: [path]}
+    allOf:
+      - if:
+          required: [method]
+          properties: {method: {const: GET}}
+        then:
+          properties:
+            preparationLimits:
+              properties: {jsonBody: {const: forbidden}}
+  selector-input:
+    type: object
+    additionalProperties: false
+    required: [role, alternatives]
+    properties:
+      role: {$ref: '#/$defs/local-id'}
+      alternatives:
+        type: array
+        minItems: 1
+        maxItems: 16
+        items:
+          type: object
+          additionalProperties: false
+          required: [profile, fields]
+          properties:
+            profile: {$ref: '#/$defs/local-id'}
+            fields:
+              type: array
+              minItems: 1
+              maxItems: 16
+              uniqueItems: true
+              items: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+  path-binding:
+    type: object
+    additionalProperties: false
+    required: [role, profile, field]
+    properties:
+      role: {$ref: '#/$defs/local-id'}
+      profile: {$ref: '#/$defs/local-id'}
+      field: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+  configurable-header-name:
+    type: string
+    minLength: 1
+    maxLength: 64
+    pattern: '^[!#$%&''*+.^_`|~0-9A-Za-z-]+$'
+  parameter-key: {type: string, pattern: '^[A-Za-z_][A-Za-z0-9._-]{0,127}$'}
+  adapter-parameter-value:
+    oneOf:
+      - {type: boolean}
+      - {type: integer, minimum: -9223372036854775808, maximum: 9223372036854775807}
+      - {type: string, maxLength: 16384}
+      - type: array
+        maxItems: 256
+        items: {$ref: '#/$defs/adapter-parameter-value'}
+      - type: object
+        maxProperties: 256
+        propertyNames: {$ref: '#/$defs/parameter-key'}
+        additionalProperties: {$ref: '#/$defs/adapter-parameter-value'}
+  preparation-limits:
+    type: object
+    additionalProperties: false
+    required: [query, jsonBody]
+    properties:
+      query: {enum: [required, allowed, forbidden]}
+      jsonBody: {enum: [required, allowed, forbidden]}
+      maximumQueryPairs: {type: integer, minimum: 1, maximum: 64}
+      maximumQueryNameBytes: {type: integer, minimum: 1, maximum: 64}
+      maximumQueryValueBytes: {type: integer, minimum: 1, maximum: 4096}
+      maximumJsonDepth: {type: integer, minimum: 1, maximum: 32}
+      maximumCollectionItems: {type: integer, minimum: 1, maximum: 256}
+      maximumStringBytes: {type: integer, minimum: 1, maximum: 16384}
+      maximumNormalizedBytes: {type: integer, minimum: 1, maximum: 65536}
+    not:
+      properties:
+        query: {const: forbidden}
+        jsonBody: {const: forbidden}
+      required: [query, jsonBody]
+  authority-profile:
+    type: object
+    additionalProperties: false
+    required: [kind, requesterTags, grants]
+    properties:
+      kind: {enum: [statutory, organizational, consent, delegated, explicit-request]}
+      requesterTags:
+        type: array
+        minItems: 1
+        maxItems: 32
+        uniqueItems: true
+        items: {$ref: '#/$defs/local-id'}
+      grants:
+        type: array
+        minItems: 1
+        maxItems: 128
+        items:
+          type: object
+          additionalProperties: false
+          required: [requirement, purpose, audienceFrom, subjects]
+          properties:
+            requirement: {$ref: '#/$defs/uri'}
+            purpose: {type: string, pattern: '^[a-z][a-z0-9._:-]{0,127}$'}
+            audienceFrom: {const: authenticated-requester}
+            responseFormats: {$ref: '#/$defs/response-formats'}
+            subjects:
+              type: array
+              minItems: 1
+              maxItems: 8
+              items:
+                type: object
+                additionalProperties: false
+                required: [role, selectorProfile, valueOrigin]
+                properties:
+                  role: {$ref: '#/$defs/local-id'}
+                  selectorProfile: {$ref: '#/$defs/local-id'}
+                  valueOrigin: {enum: [authenticated-context, authenticated-grant, request]}
+                  valueClaims:
+                    type: object
+                    minProperties: 1
+                    maxProperties: 16
+                    propertyNames: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+                    additionalProperties: {$ref: '#/$defs/claim-path'}
+                allOf:
+                  - if:
+                      required: [valueOrigin]
+                      properties:
+                        valueOrigin: {enum: [authenticated-context, authenticated-grant]}
+                    then: {required: [valueClaims]}
+                  - if:
+                      required: [valueOrigin]
+                      properties:
+                        valueOrigin: {const: request}
+                    then:
+                      not: {required: [valueClaims]}
+  requirement:
+    type: object
+    additionalProperties: false
+    required: [id, kind, source, purposes, subjectRoles, referenceFrameworks, evidenceType, validitySeconds, derivation, concepts, disclosureGuard, existenceDisclosure]
+    properties:
+      id: {$ref: '#/$defs/uri'}
+      kind: {enum: [criterion, information-requirement, constraint]}
+      source: {$ref: '#/$defs/local-id'}
+      purposes:
+        type: array
+        minItems: 1
+        maxItems: 32
+        uniqueItems: true
+        items: {type: string, pattern: '^[a-z][a-z0-9._:-]{0,127}$'}
+      subjectRoles:
+        type: array
+        minItems: 1
+        maxItems: 8
+        items:
+          type: object
+          additionalProperties: false
+          required: [role, cardinality, selectorProfiles]
+          properties:
+            role: {$ref: '#/$defs/local-id'}
+            cardinality: {const: one}
+            selectorProfiles:
+              type: array
+              minItems: 1
+              maxItems: 16
+              uniqueItems: true
+              items: {$ref: '#/$defs/local-id'}
+      referenceFrameworks:
+        type: array
+        minItems: 1
+        maxItems: 16
+        uniqueItems: true
+        items: {$ref: '#/$defs/uri'}
+      evidenceType: {$ref: '#/$defs/uri'}
+      observationTimezone: {type: string, minLength: 1, maxLength: 128}
+      validitySeconds: {type: integer, minimum: 1, maximum: 31536000}
+      derivation:
+        type: object
+        additionalProperties: false
+        required: [script, parameters]
+        properties:
+          script: {$ref: '#/$defs/relative-path'}
+          selectorInputs:
+            type: array
+            maxItems: 8
+            items: {$ref: '#/$defs/selector-input'}
+          parameters:
+            type: object
+            maxProperties: 32
+            additionalProperties: {$ref: '#/$defs/parameter-value'}
+      concepts:
+        type: array
+        minItems: 1
+        maxItems: 16
+        items:
+          type: object
+          additionalProperties: false
+          required: [id, form, required]
+          properties:
+            id: {$ref: '#/$defs/uri'}
+            form: {enum: [boolean, controlled-code, controlled-category, bounded-integer, bounded-decimal, date-bucket, time-bucket, audience-scoped-entity-reference, controlled-code-list, entity-reference-list, reviewed-structured-value]}
+            required: {type: boolean}
+            constraints: {type: object}
+            sdJwtVc: {$ref: '#/$defs/sd-jwt-vc-concept-projection'}
+          allOf:
+            - oneOf:
+                - properties:
+                    form: {const: boolean}
+                    constraints: {$ref: '#/$defs/boolean-constraints'}
+                - required: [constraints]
+                  properties:
+                    form: {const: controlled-code}
+                    constraints: {$ref: '#/$defs/controlled-code-constraints'}
+                - required: [constraints]
+                  properties:
+                    form: {const: controlled-category}
+                    constraints: {$ref: '#/$defs/controlled-category-constraints'}
+                - required: [constraints]
+                  properties:
+                    form: {const: bounded-integer}
+                    constraints: {$ref: '#/$defs/bounded-integer-constraints'}
+                - required: [constraints]
+                  properties:
+                    form: {const: bounded-decimal}
+                    constraints: {$ref: '#/$defs/bounded-decimal-constraints'}
+                - required: [constraints]
+                  properties:
+                    form: {const: date-bucket}
+                    constraints: {$ref: '#/$defs/bucket-constraints'}
+                - required: [constraints]
+                  properties:
+                    form: {const: time-bucket}
+                    constraints: {$ref: '#/$defs/bucket-constraints'}
+                - required: [constraints]
+                  properties:
+                    form: {const: audience-scoped-entity-reference}
+                    constraints: {$ref: '#/$defs/entity-reference-constraints'}
+                - required: [constraints]
+                  properties:
+                    form: {const: controlled-code-list}
+                    constraints: {$ref: '#/$defs/controlled-code-list-constraints'}
+                - required: [constraints]
+                  properties:
+                    form: {const: entity-reference-list}
+                    constraints: {$ref: '#/$defs/entity-reference-list-constraints'}
+                - required: [constraints]
+                  properties:
+                    form: {const: reviewed-structured-value}
+                    constraints: {$ref: '#/$defs/reviewed-structured-value-constraints'}
+            - if: {required: [sdJwtVc]}
+              then:
+                properties:
+                  form: {const: reviewed-structured-value}
+      fixtures: {$ref: '#/$defs/relative-path'}
+      disclosureGuard:
+        type: object
+        additionalProperties: false
+        required: [families]
+        properties:
+          families:
+            type: array
+            minItems: 1
+            maxItems: 16
+            uniqueItems: true
+            items: {$ref: '#/$defs/uri'}
+      existenceDisclosure: {enum: [collapse-unresolved]}
+  boolean-constraints:
+    type: object
+    additionalProperties: false
+    maxProperties: 0
+  controlled-code-constraints:
+    type: object
+    additionalProperties: false
+    required: [codelist, codelistVersion, maximumBytes]
+    properties:
+      codelist: {$ref: '#/$defs/relative-path'}
+      codelistVersion: {type: string, minLength: 1, maxLength: 128}
+      maximumBytes: {type: integer, minimum: 1, maximum: 8192}
+  controlled-category-constraints:
+    type: object
+    additionalProperties: false
+    required: [categoryScheme, schemeVersion, codelist, maximumBytes]
+    properties:
+      categoryScheme: {$ref: '#/$defs/uri'}
+      schemeVersion: {type: string, minLength: 1, maxLength: 128}
+      codelist: {$ref: '#/$defs/relative-path'}
+      maximumBytes: {type: integer, minimum: 1, maximum: 8192}
+  bounded-integer-constraints:
+    type: object
+    additionalProperties: false
+    required: [minimum, maximum]
+    properties:
+      minimum: {type: integer, minimum: -9007199254740991, maximum: 9007199254740991}
+      maximum: {type: integer, minimum: -9007199254740991, maximum: 9007199254740991}
+  bounded-decimal-constraints:
+    type: object
+    additionalProperties: false
+    required: [minimum, maximum, maximumScale]
+    properties:
+      minimum: {$ref: '#/$defs/canonical-decimal-text'}
+      maximum: {$ref: '#/$defs/canonical-decimal-text'}
+      maximumScale: {type: integer, minimum: 0, maximum: 9}
+  canonical-decimal-text:
+    type: string
+    pattern: '^-?(0|[1-9][0-9]*)(\.[0-9]*[1-9])?$'
+  bucket-constraints:
+    type: object
+    additionalProperties: false
+    required: [bucketScheme, schemeVersion]
+    properties:
+      bucketScheme: {$ref: '#/$defs/uri'}
+      schemeVersion: {type: string, minLength: 1, maxLength: 128}
+  entity-reference-constraints:
+    type: object
+    additionalProperties: false
+    required: [maximumBytes]
+    properties:
+      maximumBytes: {type: integer, minimum: 1, maximum: 8192}
+  controlled-code-list-constraints:
+    type: object
+    additionalProperties: false
+    required: [codelist, codelistVersion, minimumItems, maximumItems, unique]
+    properties:
+      codelist: {$ref: '#/$defs/relative-path'}
+      codelistVersion: {type: string, minLength: 1, maxLength: 128}
+      minimumItems: {type: integer, minimum: 1, maximum: 64}
+      maximumItems: {type: integer, minimum: 1, maximum: 64}
+      unique: {const: true}
+  entity-reference-list-constraints:
+    type: object
+    additionalProperties: false
+    required: [minimumItems, maximumItems, unique]
+    properties:
+      minimumItems: {type: integer, minimum: 1, maximum: 64}
+      maximumItems: {type: integer, minimum: 1, maximum: 64}
+      unique: {const: true}
+  reviewed-structured-value-constraints:
+    type: object
+    additionalProperties: false
+    required: [schema, maximumSerializedBytes]
+    properties:
+      schema: {$ref: '#/$defs/uri'}
+      maximumSerializedBytes: {type: integer, minimum: 1, maximum: 65536}
+  sd-jwt-vc-concept-projection:
+    type: object
+    additionalProperties: false
+    required: [claim, disclosure]
+    properties:
+      claim:
+        type: string
+        pattern: '^[A-Za-z][A-Za-z0-9_]{0,63}$'
+      disclosure: {const: top-level}
+  parameter-value:
+    oneOf:
+      - {type: string, maxLength: 1024}
+      - {type: integer, minimum: -9007199254740991, maximum: 9007199254740991}
+      - {type: boolean}
+      - {$ref: '#/$defs/decimal-value'}
+      - type: array
+        minItems: 1
+        maxItems: 64
+        items: {$ref: '#/$defs/bucket-boundary'}
+  decimal-value:
+    type: object
+    additionalProperties: false
+    required: [type, value]
+    properties:
+      type: {const: decimal}
+      value: {type: string, pattern: '^-?(0|[1-9][0-9]*)(\.[0-9]*[1-9])?$'}
+  bucket-boundary:
+    type: object
+    additionalProperties: false
+    required: [minimumInclusive, maximumExclusive, code]
+    properties:
+      minimumInclusive: {$ref: '#/$defs/decimal-value'}
+      maximumExclusive: {$ref: '#/$defs/decimal-value'}
+      code: {type: string, pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'}
+bundle_layout:
+  root: evidence.yaml
+  allowed_directories: [adapters, derivations, schemas, codelists, fixtures, public-keys]
+  symlinks: prohibited
+  path_escape: prohibited
+  unknown_files: prohibited
+atomic_revision:
+  digest: sha256 over a canonical sorted path manifest plus exact file bytes
+  trust: Established by operator deployment controls, not by the digest itself.
+  lifetime: Mounted read-only and loaded once; reload, merge, mutation, fallback, and partial serving are prohibited.
+startup_checks:
+  - Unique stable identifiers and no dangling references.
+  - Complete role/profile/origin/authority/source bindings.
+  - Secret references resolve without expanding values into YAML or diagnostics.
+  - Scripts compile and use only the Version 1 ABI and primitive allowlist.
+  - Schemas and codelists are closed, versioned, bounded, and referenced.
+  - Each reviewed structured-value schema URI resolves to exactly one schema artifact by its `$id`; missing, duplicate, unreferenced, or open schemas fail startup.
+  - Each date- or time-bucket scheme URI and version resolves to exactly one reviewed codelist artifact; missing, duplicate, or unreferenced schemes fail startup.
+  - Fixtures cover positive, negative, boundary, missing, no-match, ambiguous, source failure, and anti-reconstruction cases.
+  - The complete simultaneously enabled requirement set passes disclosure-combination review.
+  - No two enabled requirements share a disclosureGuard family; a shared family rejects the bundle regardless of purposes, audiences, requester entitlements, or rate limits.
+  - Each context-derived or grant-derived subject has valueClaims whose keys exactly equal the named selector profile field set; missing, extra, duplicate-target, or invalid claim paths fail startup.
+  - Request-derived subjects have no valueClaims.
+  - Request preparation receives only the closed selectorInputs alternatives and cannot choose transport authority, paths, headers, credentials, or request count.
+  - Configured authority claim names are distinct and none names a registered JWT claim; `sub` is permitted for principalClaim alone, because it already carries the principal. A repeated or shadowing name would read one verified token member as something the issuer wrote for another purpose.
+  - For authenticated-grant origin, verified token values at authentication.grantIdClaim and grantAuthorityClaim must exist, grantAuthority must exactly equal the matched authority-profile identifier, and the same entitlement must bind requirement, purpose, audience, role, selector profile, and valueClaims result before selector resolution.
+  - Required signing, audit, credential, and source dependencies are ready.
+  - Every retired public JWK file is public-only, has a unique kid, uses the configured allowlisted algorithm, and remains available for the maximum assertion validity plus clock skew.
+  - Every secret reference uses the closed file-secret grammar and is resolved beneath runtime.yaml secretProviders.file.root.
+  - Fixed path and selector-bound path-template forms are mutually exclusive and every template placeholder has one authorized selector binding.
+  - Every selector set an authority grant can activate for a source carries each role and profile that source's path template binds. The sets are derived one per grant, so covering a bound role across their union is not enough: a single grant omitting one yields a set with no value to substitute, which fails startup rather than every request that grant would serve.
+  - Fixed headers and static API-key header names reject authentication, routing, framing, cookie, forwarding, proxy, tracing, and hop-by-hop collisions after ASCII case folding.
+  - Extended JSON Pointer projections are non-empty, uniquely decoded, and reject duplicate or overlapping ancestor, descendant, and wildcard paths.
+  - Every source preparation, extraction, and derivation selector-input contract is closed and cross-referenced to the exact authorized role/profile/field set.
+secret_policy:
+  permitted: File-provider logical names matching the exact secret-reference grammar only.
+  prohibited: private key, password, bearer token, client secret, or expanded environment value in any bundle file
+  oauth_placement_rule: Client credentials travel in the Authorization header or the token request body only. There is no query-string placement, so no credential can reach a token URL, and the token URL, body, response, and debug output are still fully redacted.
+  file_provider_rule: Resolve secret:file logical names beneath the configured owner-controlled fileRoot, reject symlinks and path traversal, require regular owner-only files, and parse values as data.
+deployment_rules:
+  authentication: Evidence independently validates the bearer token against exact configured issuer, audience, token type, algorithm, and JWKS; upstream identity headers are ignored and rejected if mapped
+  audit: failClosed and keyed pseudonymization remain governed; storage path and rotation bound come only from runtime.yaml
+  rate_limit_labels: principal and authority use scoped pseudonyms; raw selector values are never labels or keys
+  source_urls: HTTPS is required except explicit HTTP numeric loopback on 127.0.0.0/8 or ::1 for deterministic local mocks; Rust parses IP and port strictly and rejects userinfo, DNS localhost aliases, non-loopback HTTP, invalid octets, fragments, and URL ambiguity
+  runtime_split: runtime.yaml cannot override any field in this schema; the two closed documents have independent digests and immutable startup lifetimes
diff --git a/products/evidence/contracts/cccev-field-mapping.yaml b/products/evidence/contracts/cccev-field-mapping.yaml
new file mode 100644
index 000000000..3d5e67a86
--- /dev/null
+++ b/products/evidence/contracts/cccev-field-mapping.yaml
@@ -0,0 +1,91 @@
+contract: registry.evidence.cccev-mapping/v1
+status: frozen
+semantic_reference:
+  vocabulary: CCCEV
+  version: 2.2.0
+  url: https://semiceu.github.io/CCCEV/releases/2.2.0/
+mapping:
+  Evidence.schema:
+    source: evidence_extension
+    rule: Fixed profile discriminator registry.assertion-evidence/v1.
+  Evidence.requestNonce:
+    source: evidence_extension
+    rule: Exact echo of the caller-supplied request nonce; uninterpreted correlation data with no CCCEV-native counterpart, never a subject binding, identifier, or freshness proof.
+  Evidence.id:
+    source: dct:identifier
+    rule: Core-created globally unique evidence identifier.
+  Evidence.type:
+    source: cccev:Evidence
+    rule: Literal Evidence in Version 1.
+  Evidence.supportsRequirement:
+    source: cccev:supportsRequirement
+    range: cccev:Requirement
+    rule: Exact configured requirement identifier and revision.
+  Evidence.isConformantTo:
+    source: dct:conformsTo
+    range: cccev:EvidenceType
+    rule: Exact configured Evidence Type identifier.
+  Evidence.issuedBy:
+    source: dct:creator
+    range: cccev:Agent
+    rule: Legal issuer responsible for the assertion semantics.
+  Evidence.providedBy:
+    source: cccev:providedBy
+    range: cccev:Agent
+    rule: Technical Evidence provider that constructs and signs the payload.
+  Evidence.issuedAt:
+    source: dct:issued
+    range: xsd:dateTime
+    rule: Core-assigned UTC instant after successful evaluation.
+  Evidence.observedAt:
+    source: evidence_extension
+    range: xsd:dateTime
+    rule: Observation instant used by derivation.
+  Evidence.validUntil:
+    source: dct:valid
+    range: xsd:dateTime
+    rule: Optional exclusive UTC validity bound computed from fixed configuration.
+  Evidence.purpose:
+    source: evidence_extension
+    rule: Authorized configured purpose code, not caller-defined prose.
+  Evidence.audience:
+    source: evidence_extension
+    rule: Audience derived from authenticated authority context.
+  Evidence.configurationRevision:
+    source: evidence_extension
+    rule: sha256 digest of the complete atomic bundle bytes and layout manifest.
+  Evidence.subjects:
+    source: evidence_extension
+    rule: Closed role-bound, audience-scoped subject bindings; selectors are never included.
+  Evidence.supportedValues:
+    source: cccev:supportsValue
+    range: cccev:SupportedValue
+    rule: Exactly the concept-value set declared by the selected requirement.
+  SubjectBinding.role:
+    source: evidence_extension
+    rule: Exact configured requirement role identifier.
+  SubjectBinding.binding:
+    source: evidence_extension
+    rule: Audience-scoped opaque binding over the complete canonical role and selector bundle.
+  SupportedValue.providesValueFor:
+    source: cccev:providesValueFor
+    range: cccev:InformationConcept
+    rule: Exact configured Information Concept identifier.
+  SupportedValue.value:
+    source: cccev:value
+    rule: One closed Version 1 form validated against the concept declaration; bounded decimals use canonical decimal strings to preserve exact coefficient and scale.
+bundle_model:
+  requirement_kinds:
+    criterion: cccev:Criterion
+    information_requirement: cccev:InformationRequirement
+    constraint: cccev:Constraint
+  evidence_type: cccev:EvidenceType
+  information_concept: cccev:InformationConcept
+  reference_framework: cccev:ReferenceFramework
+  evidence_type_list:
+    source: cccev:EvidenceTypeList
+    semantics: Types within a list are AND; alternative lists are OR.
+    runtime_rule: Preserved as metadata only; Version 1 does not execute multi-evidence or multi-source fulfillment.
+extension_policy:
+  namespace: https://registrystack.org/ns/evidence/v1#
+  rule: Evidence extensions are explicit and must never be described as CCCEV-native properties.
diff --git a/products/evidence/contracts/definitions.schema.yaml b/products/evidence/contracts/definitions.schema.yaml
new file mode 100644
index 000000000..52def87fa
--- /dev/null
+++ b/products/evidence/contracts/definitions.schema.yaml
@@ -0,0 +1,142 @@
+$schema: https://json-schema.org/draft/2020-12/schema
+$id: https://registrystack.org/schemas/evidence/definitions-v1.json
+title: Requester-scoped Evidence definitions Version 1
+type: object
+additionalProperties: false
+required: [schema, assuranceProfile, configurationRevision, issuedBy, providedBy, definitions]
+properties:
+  schema: {const: registry.evidence-definitions/v1}
+  assuranceProfile: {enum: [local, production, evidence-grade]}
+  configurationRevision:
+    type: string
+    pattern: '^sha256:[a-f0-9]{64}$'
+  issuedBy: {type: string, format: uri, maxLength: 512}
+  providedBy: {type: string, format: uri, maxLength: 512}
+  definitions:
+    type: array
+    maxItems: 16384
+    uniqueItems: true
+    items: {$ref: '#/$defs/definition'}
+$defs:
+  definition:
+    type: object
+    additionalProperties: false
+    required:
+      - requirement
+      - kind
+      - evidenceType
+      - purpose
+      - referenceFrameworks
+      - subjects
+      - concepts
+    properties:
+      requirement: {type: string, format: uri, maxLength: 512}
+      kind: {enum: [criterion, information-requirement, constraint]}
+      evidenceType: {type: string, format: uri, maxLength: 512}
+      purpose: {type: string, pattern: '^[a-z][a-z0-9._:-]{0,127}$'}
+      referenceFrameworks:
+        type: array
+        minItems: 1
+        maxItems: 16
+        uniqueItems: true
+        items: {type: string, format: uri, maxLength: 512}
+      subjects:
+        type: array
+        minItems: 1
+        maxItems: 8
+        uniqueItems: true
+        items: {$ref: '#/$defs/subject'}
+      concepts:
+        type: array
+        minItems: 1
+        maxItems: 16
+        uniqueItems: true
+        items: {$ref: '#/$defs/concept'}
+  subject:
+    type: object
+    additionalProperties: false
+    required: [role, cardinality, selector]
+    properties:
+      role: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+      cardinality: {const: one}
+      selector: {$ref: '#/$defs/selector'}
+  selector:
+    type: object
+    additionalProperties: false
+    required: [profile, valueOrigin, fields]
+    properties:
+      profile: {type: string, pattern: '^[a-z][a-z0-9._-]{0,127}$'}
+      valueOrigin:
+        enum: [request, authenticated-context, authenticated-grant]
+      fields:
+        type: array
+        minItems: 1
+        maxItems: 16
+        uniqueItems: true
+        items: {$ref: '#/$defs/selector-field'}
+  selector-field:
+    oneOf:
+      - type: object
+        additionalProperties: false
+        required: [type, name, minimumBytes, maximumBytes]
+        properties:
+          type: {const: string}
+          name: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+          minimumBytes: {type: integer, minimum: 1, maximum: 8192}
+          maximumBytes: {type: integer, minimum: 1, maximum: 8192}
+      - type: object
+        additionalProperties: false
+        required: [type, name]
+        properties:
+          type: {const: date}
+          name: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+      - type: object
+        additionalProperties: false
+        required: [type, name, minimum, maximum]
+        properties:
+          type: {const: integer}
+          name: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+          minimum:
+            {type: integer, minimum: -9007199254740991, maximum: 9007199254740991}
+          maximum:
+            {type: integer, minimum: -9007199254740991, maximum: 9007199254740991}
+      - type: object
+        additionalProperties: false
+        required: [type, name]
+        properties:
+          type: {const: boolean}
+          name: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+      - type: object
+        additionalProperties: false
+        required: [type, name, scheme, version, maximumBytes]
+        properties:
+          type: {const: controlled-code}
+          name: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+          scheme: {type: string, format: uri, maxLength: 512}
+          version: {type: string, minLength: 1, maxLength: 128}
+          maximumBytes: {type: integer, minimum: 1, maximum: 8192}
+  concept:
+    type: object
+    additionalProperties: false
+    required: [id, form]
+    properties:
+      id: {type: string, format: uri, maxLength: 512}
+      form:
+        enum:
+          - boolean
+          - controlled-code
+          - controlled-category
+          - bounded-integer
+          - bounded-decimal
+          - date-bucket
+          - time-bucket
+          - audience-scoped-entity-reference
+          - controlled-code-list
+          - entity-reference-list
+          - reviewed-structured-value
+$comment: >-
+  The authenticated response contains only complete request shapes that match
+  exactly one configured authority path. It never exposes source plans,
+  scripts, credentials, requester tags, authority-profile identifiers,
+  selector values, codelist values, or unrelated definitions. Discovery
+  performs no provider request and grants no authority.
diff --git a/products/evidence/contracts/evidence.schema.yaml b/products/evidence/contracts/evidence.schema.yaml
new file mode 100644
index 000000000..454f2316a
--- /dev/null
+++ b/products/evidence/contracts/evidence.schema.yaml
@@ -0,0 +1,113 @@
+$schema: https://json-schema.org/draft/2020-12/schema
+$id: https://registrystack.org/schemas/evidence/assertion-evidence-v1.json
+title: Evidence assertion payload Version 1
+type: object
+additionalProperties: false
+required:
+  - schema
+  - assuranceProfile
+  - requestNonce
+  - id
+  - type
+  - supportsRequirement
+  - isConformantTo
+  - issuedBy
+  - providedBy
+  - issuedAt
+  - observedAt
+  - validUntil
+  - purpose
+  - audience
+  - configurationRevision
+  - subjects
+  - supportedValues
+properties:
+  schema: {const: registry.assertion-evidence/v1}
+  assuranceProfile: {enum: [local, production, evidence-grade]}
+  requestNonce: {type: string, pattern: '^[A-Za-z0-9_-]{43}$'}
+  id: {type: string, format: uri, maxLength: 512}
+  type: {const: Evidence}
+  supportsRequirement: {type: string, format: uri, maxLength: 512}
+  isConformantTo: {type: string, format: uri, maxLength: 512}
+  issuedBy: {type: string, format: uri, maxLength: 512}
+  providedBy: {type: string, format: uri, maxLength: 512}
+  issuedAt: {type: string, format: date-time}
+  observedAt: {type: string, format: date-time}
+  validUntil: {type: string, format: date-time}
+  purpose: {type: string, pattern: '^[a-z][a-z0-9._:-]{0,127}$'}
+  audience: {type: string, format: uri, maxLength: 512}
+  configurationRevision: {type: string, pattern: '^sha256:[a-f0-9]{64}$'}
+  subjects:
+    type: array
+    minItems: 1
+    maxItems: 8
+    items: {$ref: '#/$defs/subject-binding'}
+  supportedValues:
+    type: array
+    minItems: 1
+    maxItems: 16
+    items: {$ref: '#/$defs/supported-value'}
+$defs:
+  subject-binding:
+    type: object
+    additionalProperties: false
+    required: [role, binding]
+    properties:
+      role: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+      binding: {type: string, pattern: '^urn:evidence:subject:v[1-9][0-9]*_[A-Za-z0-9_-]{43}$'}
+  supported-value:
+    type: object
+    additionalProperties: false
+    required: [providesValueFor, value]
+    properties:
+      providesValueFor: {type: string, format: uri, maxLength: 512}
+      value: {$ref: '#/$defs/value'}
+  value:
+    anyOf:
+      - {type: boolean}
+      - {type: integer, minimum: -9007199254740991, maximum: 9007199254740991}
+      - {type: string, minLength: 1, maxLength: 1024}
+      - {$ref: '#/$defs/bucket'}
+      - {$ref: '#/$defs/entity-reference'}
+      - {$ref: '#/$defs/structured'}
+      - type: array
+        minItems: 1
+        maxItems: 64
+        items:
+          anyOf:
+            - {type: string, minLength: 1, maxLength: 1024}
+            - {$ref: '#/$defs/entity-reference'}
+  bucket:
+    type: object
+    additionalProperties: false
+    required: [form, scheme, bucket]
+    properties:
+      form: {enum: [date-bucket, time-bucket]}
+      scheme: {type: string, format: uri, maxLength: 512}
+      bucket: {type: string, pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'}
+  entity-reference:
+    type: object
+    additionalProperties: false
+    required: [form, reference]
+    properties:
+      form: {const: audience-scoped-entity-reference}
+      reference: {type: string, pattern: '^urn:evidence:entity:v[1-9][0-9]*_[A-Za-z0-9_-]{43}$'}
+  structured:
+    type: object
+    additionalProperties: false
+    required: [form, schema, fields]
+    properties:
+      form: {const: reviewed-structured-value}
+      schema: {type: string, format: uri, maxLength: 512}
+      fields: {type: object, minProperties: 1, maxProperties: 16}
+$comment: >-
+  The selected concept declaration closes the exact value form, schema,
+  codelist, precision, cardinality, sizes, structured fields, and uniqueness.
+  A value accepted by this transport schema but not by that declaration is
+  rejected before evidence construction. Subject selector profiles and values
+  never appear in evidence. requestNonce is the exact echo of the caller's
+  request nonce and is covered by the JWS signature in the signed format. It
+  is not part of the audience-scoped subject binding, and its reuse is not
+  rejected; challenge-style transaction binding exists only when the relying
+  party independently retains the original request and requires the expected
+  nonce during verification.
diff --git a/products/evidence/contracts/jws-profile.yaml b/products/evidence/contracts/jws-profile.yaml
new file mode 100644
index 000000000..98c386ab2
--- /dev/null
+++ b/products/evidence/contracts/jws-profile.yaml
@@ -0,0 +1,92 @@
+contract: registry.evidence.jws-profile/v1
+status: frozen
+response:
+  media_type: application/jose+json
+  serialization: flattened-jws-json
+  members:
+    required: [protected, payload, signature]
+    prohibited: [header]
+  payload: base64url without padding of the exact UTF-8 Evidence JSON bytes
+  negotiation: Missing Accept, */*, and exact application/jose+json select this default signed format. Only the exact application/vnd.registrystack.evidence-unsigned+json media type selects the separately governed unsigned envelope, and only when the immutable bundle and the complete matched authority grant permit it. Every response varies on Accept and remains no-store.
+unsigned_envelope:
+  media_type: application/vnd.registrystack.evidence-unsigned+json
+  schema: registry.unsigned-evidence-envelope/v1
+  members:
+    required: [schema, type, integrityProtection, warning, evidence]
+    prohibited: [protected, payload, signature, header]
+  integrity: none; transport-authenticated convenience only, never later-verifiable evidence and never a fallback from any signed-path failure
+  verifier_rule: The strict JWS verifier rejects this representation. A dedicated unsigned parser may validate the envelope, the Evidence schema, and expected policy fields, but returns an explicitly unverified result type and never the verified-JWS result type. Version 1 never uses JWS alg none, an empty signature, or a JWS-shaped unsigned object.
+protected_header:
+  exact_members: [alg, kid, typ, cty]
+  alg:
+    allowed: [EdDSA]
+    rule: Must equal the algorithm bound to the trusted key.
+  kid:
+    required: true
+    maximum_bytes: 256
+    rule: Resolved only within the verifier-pinned provider JWKS.
+  typ: {const: evidence+jws}
+  cty: {const: application/evidence+json}
+  prohibited: [jku, x5u, jwk, x5c, crit, b64]
+signing:
+  active_keys: 1
+  private_key_location: signing.activeKeyRef through a supported runtime secret provider only
+  retired_public_keys: signing.retiredPublicJwkFiles are bundle-owned public JWKs and never contain private members
+  bundle_private_key_material: prohibited
+  order:
+    - core validates the complete derivation result
+    - core constructs the exact evidence payload including the exact request nonce
+    - signing provider signs protected header plus payload
+    - core serializes the final immutable response bytes
+    - disclosure-release audit is durably accepted
+    - the exact pre-audited bytes are released
+  unsigned_order: For an explicitly authorized unsigned request the core performs no signing operation, still requires the ordinary signing dependency to be ready, constructs and serializes the final immutable envelope bytes, durably accepts disclosure-release audit, then releases those exact bytes.
+  failure: safe 503 with no unsigned fallback
+key_discovery:
+  path: /.well-known/evidence/jwks.json
+  media_type: application/jwk-set+json
+  content: public keys only
+  trust_rule: Discovery is not a trust anchor; provider identity and JWKS location are pinned through governed verifier configuration.
+rotation:
+  new_assertions_use: the single configured active key
+  retired_public_key_minimum_availability: maximum assertion validity plus allowed verifier clock skew
+  kid_reuse: prohibited for different key material
+verifier_rules:
+  - Parse flattened JWS with strict duplicate-member rejection.
+  - Reject unprotected headers and any protected member outside the exact allowlist.
+  - Resolve kid only in the pinned provider key set and require the allowlisted algorithm.
+  - Verify the signature before parsing or acting on payload claims.
+  - Validate the strict payload against the complete committed Evidence JSON Schema before deserializing or applying relying-procedure policy.
+  - Require the assurance profile, schema, issuer, provider, requirement, Evidence Type, purpose, audience, observation, validity, and configuration revision expected independently by the relying procedure. An authentic local assertion never satisfies a production or evidence-grade expectation.
+  - Require the exact request nonce from the independently retained original request. Nonce reuse is not replay prevention and is not rejected by the runtime.
+  - Require the exact expected role-bound opaque subject bindings as an unordered set of unique role and binding pairs, compared only after signature and schema verification. Expectations come from independent trusted state, never from the JWS under verification.
+  - Require the exact expected concept identifiers, value forms, and cardinalities; missing, extra, duplicated, or wrongly formed output fails even under a valid signature.
+  - Return one generic policy mismatch without revealing which hidden selector or policy comparison failed.
+  - Impose a maximum accepted assertion lifetime in addition to current validity.
+  - Treat validUntil as an exclusive upper bound and apply only the configured clock skew.
+  - Report cryptographic authenticity separately from current validity; an expired assertion may remain authentic without being current evidence.
+  - Do not infer source truth, legal-signature status, holder binding, or single-use semantics from a valid signature.
+durable_verification_record:
+  - the exact flattened JWS bytes
+  - the original request and its request nonce
+  - the expected audience, purpose, requirement, Evidence Type, issuer, and technical provider
+  - the expected assurance profile
+  - the expected role-bound subject bindings
+  - the expected concept identifiers, forms, and cardinalities or the exact trusted requirement contract that defines them
+  - the configuration revision
+  - the trusted signing-key or JWKS snapshot selected through governed metadata
+  - the trusted time at which current-validity verification was performed
+negative_tests:
+  - expected-assurance-profile-mismatch
+  - jws-payload-modification
+  - jws-protected-header-modification
+  - jws-message-key-url-rejected
+  - jws-unknown-kid-rejected
+  - jws-schema-invalid-signed-payload-rejected
+  - jws-retired-key-window
+  - signing-failure-no-unsigned-success
+  - expected-nonce-mismatch
+  - expected-subject-set-mismatch
+  - expected-output-contract-mismatch
+  - assertion-lifetime-above-accepted-maximum
+  - unsigned-envelope-rejected-by-jws-verifier
diff --git a/products/evidence/contracts/primitive-library.yaml b/products/evidence/contracts/primitive-library.yaml
new file mode 100644
index 000000000..cfb43063d
--- /dev/null
+++ b/products/evidence/contracts/primitive-library.yaml
@@ -0,0 +1,106 @@
+contract: registry.evidence.rhai-primitives/v1
+status: frozen
+resource_limits:
+  maximum_operations: 100000
+  maximum_call_depth: 32
+  maximum_expression_depth: 64
+  maximum_modules: 0
+  maximum_string_bytes: 16384
+  maximum_array_items: 256
+  maximum_map_entries: 256
+  maximum_fact_entries: 64
+  maximum_concept_values: 16
+  maximum_codelist_entries_per_handle: 4096
+  maximum_source_input_bytes: 1048576
+  maximum_preparation_input_bytes: 1048576
+  maximum_result_bytes: 65536
+  maximum_request_parts_bytes: 65536
+  maximum_query_pairs: 64
+  maximum_query_name_bytes: 64
+  maximum_query_value_bytes: 4096
+  maximum_pointer_bytes: 256
+  maximum_pointer_segments: 16
+  maximum_json_body_depth: 32
+  timeout_behavior: operation limit is normative; any outer wall-time limit only aborts and never changes results
+primitives:
+  parse_date:
+    signature: string -> Date
+    behavior: Strict proleptic Gregorian YYYY-MM-DD; invalid or non-canonical input fails.
+  parse_instant:
+    signature: string -> Instant
+    behavior: Strict RFC 3339 with explicit offset; normalized internally to UTC without consulting a clock.
+  parse_integer:
+    signature: string -> integer
+    behavior: Parses an optional ASCII minus followed by one or more ASCII decimal digits into signed i64. Leading zeroes are permitted. Empty, plus-prefixed, whitespace, non-ASCII, fractional, exponential, and overflowing inputs fail.
+  decimal:
+    signature: string -> Decimal
+    behavior: Alias of parse_decimal for exact canonical text; never accepts a Rhai float.
+  parse_decimal:
+    signature: string -> Decimal
+    behavior: Rust validates canonical finite decimal text, maximum precision 28 and scale 9, with zero represented only as 0; no exponent, plus sign, leading zero, trailing fractional zero, NaN, infinity, or negative zero.
+  integer_to_decimal:
+    signature: integer -> Decimal
+    behavior: Exact conversion of a bounded Rhai integer to scale-zero Decimal.
+  add_calendar_years:
+    signature: '[Date, integer] -> Date'
+    behavior: Calendar addition; a leap-day input clamps to the last valid day of the target month.
+    bounds: {years: [-1000, 1000]}
+  add_calendar_months:
+    signature: '[Date, integer] -> Date'
+    behavior: Calendar addition with last-valid-day clamping.
+    bounds: {months: [-12000, 12000]}
+  compare_dates:
+    signature: '[Date, Date] -> integer'
+    behavior: Returns only -1, 0, or 1.
+  compare_instants:
+    signature: '[Instant, Instant] -> integer'
+    behavior: Returns only -1, 0, or 1.
+  days_between:
+    signature: '[Date, Date] -> integer'
+    behavior: Returns second minus first in whole Gregorian calendar days, bounded to -365000 through 365000.
+  compare_decimals:
+    signature: '[Decimal, Decimal] -> integer'
+    behavior: Exact arbitrary-precision decimal comparison; returns -1, 0, or 1 without binary floating-point conversion.
+  bucket_number:
+    signature: '[Decimal, array<Boundary>] -> string'
+    behavior: Returns the code for the one configured half-open minimum_inclusive/maximum_exclusive interval; intervals must be ordered, non-overlapping, exhaustive over the declared numeric range, and at most 64.
+    boundary_shape: {minimumInclusive: Decimal, maximumExclusive: Decimal, code: string}
+  entity_reference_seed:
+    signature: string -> EntityReferenceSeed
+    behavior: Wraps 1 through 512 exact UTF-8 bytes in a protected opaque core value; the seed cannot be converted back to a Rhai string, compared, printed, logged, or serialized.
+  codelist_lookup:
+    signature: '[CodelistHandle, string] -> Option<string>'
+    behavior: Exact code lookup with no normalization; returns only the configured output code.
+  list_contains:
+    signature: '[array<scalar>, scalar] -> boolean'
+    behavior: Exact typed equality over at most 256 items. Every item is validated as a scalar before any answer is produced, so an invalid item fails even when an earlier item matches.
+  set_contains:
+    signature: '[array<scalar>, scalar] -> boolean'
+    behavior: Exact typed equality over at most 256 items. Every item is validated as a scalar before any answer is produced, and a duplicate input item fails because the array represents a set.
+  array_push:
+    signature: 'array.push(value) -> unit'
+    behavior: Appends one local value when the resulting array remains within the 256-item bound; otherwise fails without a partial output.
+  string_replace:
+    signature: 'string.replace(from, to) -> unit'
+    behavior: Mutates the local receiver by replacing every exact non-overlapping literal occurrence, with no regex or Unicode normalization, when the result remains within the 16384-byte string bound.
+  required:
+    signature: '[Option<T>, string] -> T'
+    behavior: Returns the value, or terminates the invocation with the host-private unavailable signal. The second argument must have a safe bundle-owned code shape; it is validated and then discarded, because shape validation cannot prove a code is a reviewed literal rather than derived protected data. No supplied code is observable in evidence, problems, audit, logs, or diagnostics.
+  is_missing:
+    signature: Option<T> -> boolean
+    behavior: Explicit missing-value test with no implicit coercion.
+  get_path:
+    signature: '[value, string] -> Option<value>'
+    behavior: Resolves one bounded RFC 6901 JSON Pointer against a local value and returns the value found, or the missing marker when any segment resolves to nothing. Only ~0 and ~1 escapes are recognized. An array segment must be a non-negative decimal integer with no leading zero. A pointer that is not resolvable syntax, exceeds 256 bytes, or exceeds 16 segments is a script fault and fails the invocation rather than answering missing.
+global_rules:
+  - Primitives are pure, deterministic, typed, bounded, and domain-neutral.
+  - Strings are compared as exact UTF-8 values; no Unicode normalization, case folding, transliteration, or phonetics occurs.
+  - Decimal operations use the Rust-owned exact Decimal type. Ordinary floats remain available in request preparation and source extraction and are rejected for every public derived value; exact numbers use the declared integer or Decimal forms.
+  - Array and map indexing is routed through a host-owned guard; a negative index fails whether it is written literally or computed.
+  - JSON numbers are admitted only as signed 64-bit integers or finite floats; an integer token outside the signed 64-bit range fails before Rhai, and a provider identifier outside that range must be represented as a string.
+  - EntityReferenceSeed is a protected projection input, not public data; only the core can HMAC-project it to an audience-scoped reference.
+  - Query names and values remain strings. parse_integer exists only for provider text and does not introduce implicit integer-to-string or value-to-string conversion.
+  - Array and string mutation affects only the fresh invocation-local copy and cannot modify the governed bundle, another script stage, or another request.
+  - No primitive performs I/O, authorization, logging, audit, signing, response construction, or ambient time access.
+  - A new primitive requires a generic need demonstrated by more than one definition shape and focused boundary tests.
+prohibited_namespaces: [domain, identity, source-product, credential, policy, response, audit]
diff --git a/products/evidence/contracts/problem-contract.yaml b/products/evidence/contracts/problem-contract.yaml
new file mode 100644
index 000000000..c72ba7bd2
--- /dev/null
+++ b/products/evidence/contracts/problem-contract.yaml
@@ -0,0 +1,40 @@
+contract: registry.evidence.public-problem/v1
+status: frozen
+media_type: application/problem+json
+body:
+  exact_members: [type, title, status, code, operation]
+  operation: opaque per-request identifier safe for support correlation
+  prohibited:
+    - request body or selector profile and values
+    - principal, actor, grant, token, credential, or authorization inputs
+    - source URL, query, request, response, status text, or fact
+    - script input, output, line, stack, or diagnostic
+    - supported value or subject binding
+    - candidate count, score, hint, or comparison detail
+codes:
+  malformed_request: {status: 400, title: Request is not valid}
+  invalid_selector: {status: 400, title: Request is not valid}
+  authentication_failed: {status: 401, title: Authentication failed}
+  not_authorized: {status: 403, title: Request is not authorized}
+  response_format_not_acceptable: {status: 406, title: Requested response format is not acceptable}
+  evidence_not_available: {status: 422, title: Evidence could not be produced}
+  rate_limited: {status: 429, title: Request rate exceeded}
+  dependency_unavailable: {status: 503, title: Service temporarily unavailable}
+  service_unavailable: {status: 503, title: Service temporarily unavailable}
+response_format_rules:
+  negotiation: Missing Accept, */*, and exact application/jose+json select signed JWS. Only exact application/vnd.registrystack.evidence-unsigned+json selects the unsigned envelope. Duplicate, combined, parameterized, quality-weighted, or unknown negotiation returns response_format_not_acceptable before source access.
+  authorization: A recognized unsigned request that the immutable bundle or the complete matched grant does not permit returns the ordinary not_authorized problem before credential acquisition or source access, without revealing which layer withheld permission.
+existence_disclosure:
+  default_public_collapse:
+    internal_classes: [no_match, ambiguous, required_fact_missing, derivation_input_unresolved]
+    public_code: evidence_not_available
+    same_status: 422
+    same_title: Evidence could not be produced
+    same_body_shape: true
+    timing_rule: Avoid intentional class-dependent delay; apply uniform bounded processing and response handling.
+  explicit_existence_concept_rule: Existence may be disclosed only as a separately authorized fixed concept, never as error detail.
+transient_failures:
+  internal_classes: [source_unavailable, source_protocol_error, script_failure, signing_failure, access_audit_failure, release_audit_failure]
+  public_codes: [dependency_unavailable, service_unavailable]
+  retry_after: permitted only for bounded transient failures and never derived from protected source content
+unknown_definition_rule: Unknown and unauthorized requirement identifiers must be indistinguishable to a caller lacking authorization.
diff --git a/products/evidence/contracts/request.schema.yaml b/products/evidence/contracts/request.schema.yaml
new file mode 100644
index 000000000..85ada04f2
--- /dev/null
+++ b/products/evidence/contracts/request.schema.yaml
@@ -0,0 +1,96 @@
+$schema: https://json-schema.org/draft/2020-12/schema
+$id: https://registrystack.org/schemas/evidence/request-v1.json
+title: Evidence request Version 1
+type: object
+additionalProperties: false
+required: [requestNonce, requirement, purpose, subjects]
+properties:
+  requestNonce:
+    type: string
+    pattern: '^[A-Za-z0-9_-]{43}$'
+  requirement:
+    type: string
+    format: uri
+    minLength: 1
+    maxLength: 512
+  purpose:
+    type: string
+    pattern: '^[a-z][a-z0-9._:-]{0,127}$'
+  subjects:
+    type: array
+    minItems: 1
+    maxItems: 8
+    description: >-
+      Unordered role set encoded as an array. Each configured role appears
+      exactly once. Runtime resolves roles by name and emits the requirement's
+      declaration order internally.
+    items: {$ref: '#/$defs/subject'}
+  holderKey:
+    $ref: '#/$defs/holder-key'
+    description: >-
+      Optional holder public key echoed into the SD-JWT VC cnf claim. It is
+      meaningful only for the SD-JWT VC response format and never reaches
+      authorization, selectors, Rhai, source requests, or audit.
+$defs:
+  subject:
+    type: object
+    additionalProperties: false
+    required: [role, selector]
+    properties:
+      role:
+        type: string
+        pattern: '^[a-z][a-z0-9._-]{0,63}$'
+      selector: {$ref: '#/$defs/selector'}
+  selector:
+    type: object
+    additionalProperties: false
+    required: [profile]
+    properties:
+      profile:
+        type: string
+        pattern: '^[a-z][a-z0-9._-]{0,127}$'
+      values:
+        type: object
+        minProperties: 1
+        maxProperties: 16
+        propertyNames:
+          pattern: '^[a-z][a-z0-9._-]{0,63}$'
+        additionalProperties: {$ref: '#/$defs/scalar-selector-value'}
+  holder-key:
+    type: object
+    additionalProperties: false
+    required: [kty, crv, x]
+    properties:
+      kty: {type: string, enum: [OKP]}
+      crv: {type: string, enum: [Ed25519]}
+      x:
+        type: string
+        pattern: '^[A-Za-z0-9_-]{43}$'
+      alg: {type: string, enum: [EdDSA]}
+      kid: {type: string, minLength: 1, maxLength: 256}
+  scalar-selector-value:
+    oneOf:
+      - {type: string, minLength: 1, maxLength: 512}
+      - {type: integer, minimum: -9007199254740991, maximum: 9007199254740991}
+      - {type: boolean}
+$comment: >-
+  This transport schema is followed by named-profile validation. The profile
+  closes the exact field names, scalar types, byte and numeric bounds,
+  aggregate size, value origin, and source placements. Values must be absent
+  for authenticated-context and authenticated-grant origins, and present for
+  an authorized request origin. Dates and controlled codes are strings whose
+  exact lexical rules are declared by the profile. Unknown, missing, extra,
+  mistyped, empty, oversized, wrong-origin, or unauthorized values fail before
+  credential acquisition or source access. Array position is not semantic;
+  duplicate, missing, unknown, or wrong-profile roles fail before access audit.
+  requestNonce is the canonical unpadded base64url encoding of exactly 32
+  bytes generated independently for each request by a cryptographically secure
+  random source; a padded, wrong-length, or noncanonical value fails before
+  credential acquisition or source access. The nonce is uninterpreted
+  correlation data echoed into the Evidence payload. It is never stored,
+  never uniqueness-checked, and never reaches authorization, rate limits,
+  Rhai, source requests, logs, metrics, traces, or native audit. Callers must
+  not encode identifiers, selectors, secrets, or document digests into it.
+  holderKey is an Ed25519 public JWK. A key carrying any private member, a
+  non-allowlisted algorithm, or an unparseable body fails before credential
+  acquisition or source access.
diff --git a/products/evidence/contracts/rhai-abi.yaml b/products/evidence/contracts/rhai-abi.yaml
new file mode 100644
index 000000000..0dba7296c
--- /dev/null
+++ b/products/evidence/contracts/rhai-abi.yaml
@@ -0,0 +1,138 @@
+contract: registry.evidence.rhai-abi/v1
+status: frozen
+trust_model:
+  scripts: Reviewed, trusted, immutable bundle artifacts compiled at startup.
+  boundary: Trust permits scripts to implement provider and requirement semantics, but never grants transport, credential, authorization, signing, audit, or evidence-construction authority.
+functions:
+  preparation:
+    signature: prepare(source_required_selectors, adapter_parameters) -> RequestParts
+    input:
+      source_required_selectors: Exact role, profile, and field map selected from the source request selectorInputs after validation and authorization.
+      adapter_parameters: Closed non-secret JSON parameters validated at startup against adapterParametersSchema.
+      prohibited:
+        - requester, actor, purpose, audience, authority, entitlement, or grant objects
+        - source origin, method, path, path bindings, headers, credentials, TLS, proxy, timeout, redirect, pagination, concurrency, or request-count controls
+    output:
+      exact_keys: [query, body]
+      query:
+        representation: ordered array of exact maps with string keys name and value
+        maximum_items: 64
+        rules:
+          - Names and values are logical lexical strings; Rust percent-encodes each component exactly once.
+          - Pair order and duplicate names are preserved.
+          - Empty names, CR, LF, implicit value-to-string conversion, and non-string values are rejected.
+      body:
+        representation: one bounded JSON value or unit for no body
+        maximum_depth: 32
+      validation: Rust applies the source preparationLimits and validates the complete normalized RequestParts before credential resolution.
+    core_owned_transport:
+      - source and fixed origin
+      - fixed method and fixed path, or complete-segment selector-bound pathTemplate and pathBindings
+      - fixed non-secret headers and every authentication header
+      - credentials, TLS trust, hostname verification, redirect denial, proxy denial, timeout, response limit, concurrency, and one-request ceiling
+  extraction:
+    signature: extract(projected_source_response, adapter_parameters) -> LookupResult
+    input:
+      projected_source_response: Parsed JSON from the one completed evidence-data request after pre-projection response bounds, the Rust-enforced extended JSON Pointer allowlist, and validation against the source's declared responseSchema, so a response outside its declared shape never reaches this script. The projected tree handed to extraction is limited to 65536 serialized bytes; the 1 MiB wire-response maximum bounds the pre-projection response and the two limits are compatible layers. Integer tokens outside the signed 64-bit range fail before Rhai rather than converting to a precision-losing float; provider identifiers outside that range must be represented as strings.
+      adapter_parameters: A fresh copy of the same closed non-secret parameters supplied to preparation.
+      prohibited:
+        - selectors or prepared request parts
+        - unprojected response fields
+        - request metadata, credentials, authority context, or a source client
+    output:
+      tagged_union:
+        match:
+          exact_keys: [outcome, facts]
+          outcome: match
+          facts: Closed FactSet declared by the source binding.
+        no_match:
+          exact_keys: [outcome]
+          outcome: no_match
+        ambiguous:
+          exact_keys: [outcome]
+          outcome: ambiguous
+      prohibited: [candidates, count, scores, confidence, hints, diagnostics, comparisons]
+    rules:
+      - Facts are legal only on match and must exactly satisfy the declared fact schema.
+      - No-match and ambiguous stop evaluation; derivation is not invoked.
+      - Extraction may map provider-owned cardinality from a count plus one minimized record, or at most two minimally projected records solely to detect ambiguity.
+      - Extraction never chooses a candidate and never turns protocol inconsistency into a closed lookup outcome.
+  derivation:
+    signature: derive(facts, declared_authorized_selectors, evaluation_context) -> ConceptValueSet
+    input:
+      facts: Immutable validated FactSet from one unique match. Integer tokens outside the signed 64-bit range fail before Rhai rather than converting to a precision-losing float.
+      declared_authorized_selectors: Exact role, profile, and field map declared by derivation.selectorInputs, resolved from already authorized requirement subjects; omission yields an empty map.
+      evaluation_context:
+        exact_keys: [observed_at, legal_local_date, legal_local_time, parameters, codelists]
+        observed_at: Runtime-supplied UTC instant.
+        legal_local_date: Runtime-resolved date for the configured IANA timezone.
+        legal_local_time: Runtime-resolved local time with UTC offset.
+        parameters: Fixed typed requirement parameters.
+        codelists: Bounded read-only handles to named versioned bundle codelists.
+    output:
+      representation: array of exact maps with keys concept_id and value
+      maximum_items: 16
+      validation: Concept identifiers must equal the requirement output set; duplicates, missing required values, extra fields, and invalid values are rejected. An ordinary Rhai float is never a public derived value; exact numbers use the declared integer or Rust-owned Decimal forms. Ordinary f64 remains available only inside the preparation and extraction adapter surfaces.
+      protected_types:
+        Decimal:
+          construction: decimal(canonical_text) or parse_decimal(canonical_text)
+          rule: Rust-owned exact coefficient-and-scale decimal with maximum precision 28 and scale 9; Rhai f32/f64 and ordinary numeric coercion cannot satisfy a bounded-decimal concept.
+        EntityReferenceSeed:
+          construction: entity_reference_seed(protected_string)
+          maximum_seed_bytes: 512
+          rule: Valid only for an audience-scoped-entity-reference concept or its bounded list form; never serializable, loggable, or usable as a public identifier.
+        EntityReferenceSeedList:
+          construction: Bounded Rhai array containing only EntityReferenceSeed values.
+          maximum_items: 64
+          rule: Rust projects each seed after output validation.
+    permitted_selector_aware_rules:
+      - Exact equality between a returned unique-record binding fact and its declared authorized lookup selector.
+      - Exact membership of a separately authorized stable reference in a complete authoritative relationship set with a governed namespace and contract identifier.
+      - A closed deterministic attribute comparison only when its jurisdiction-governed canonicalization and concept semantics are explicitly versioned in the reviewed requirement.
+      - Direct mapping of an explicit source-owned decision fact.
+    false_relationship_rule: A false relationship concept is permitted only after unique returned-subject binding, complete valid relationship facts, namespace and contract agreement, and the exact governed comparison. No-match, ambiguity, returned-subject mismatch, incomplete facts, or protocol uncertainty stop without a signed negative.
+    prohibited_context:
+      - undeclared selector roles, profiles, or fields
+      - requester or actor
+      - requirement purpose or audience
+      - authority, entitlement, or grant objects
+      - token, credential, source client, response, or prepared request
+      - logging, audit, or signing handle
+capabilities:
+  allowed:
+    - fresh local variables and statically named bounded same-file helper functions
+    - pure expressions and bounded array iteration
+    - allowlisted primitive calls
+    - bounded local map, array, and string construction and mutation
+  denied:
+    - filesystem, environment, network, process, import, eval, plugins, or modules
+    - ambient clock, timezone lookup, randomness, UUID, logging, printing, diagnostics, audit, credentials, or signing
+    - anonymous functions, function pointers, dynamic dispatch, top-level executable statements, or catchable host-private unavailable termination
+    - raw string literals, block and if expressions in operand position, and negative array indexing
+  syntax_contract: The detailed pinned Rhai 1.25.1 syntax surface and forbidden constructs are defined by the trusted request-adapter API and enforced by startup compilation tests. Startup review also rewrites every index operand through a host-owned guard that rejects a negative index whether it is written literally or computed. The lexical restriction is an enforceable reviewed-language contract; the raw engine capability set remains the isolation boundary.
+lifecycle:
+  compilation: Startup only; each script must expose exactly one public entry point at the required arity before readiness.
+  state: Fresh invocation state and fresh input copies; no cross-stage, cross-request, or cross-definition mutable state.
+  identity: Script path and exact bytes are covered by the governed bundle revision.
+failure:
+  preparation: adapter_input_error
+  extraction: source_protocol_error
+  derivation: derivation_input_error
+  unavailable: Host-private, unforgeable, and uncatchable required-value termination.
+  observability: All failures map to closed value-free classes; raw Rhai errors and protected input or output material are absent from public problems and diagnostics.
+core_projection:
+  decimal:
+    input: Decimal canonical text
+    output: JSON string containing the exact canonical decimal text
+    rule: JSON numeric serialization and binary floating-point conversion are prohibited.
+  entity_reference:
+    input: EntityReferenceSeed
+    hmac_input: Deterministic length-prefixed bytes over profile version, concept id, audience, binding-key version, and exact seed bytes.
+    key: subjectBinding.secretRef from the governed bundle
+    output: 'urn:evidence:entity:v<key-version>_<base64url-no-pad HMAC-SHA256>'
+    confidentiality: Seed is protected source-derived data and is absent from evidence, logs, audit, errors, traces, metrics, snapshots, and script diagnostics.
+anti_capabilities:
+  - source, origin, path, header, authentication, credential, TLS, proxy, pagination, retry, or request-count selection
+  - broad candidate retrieval, probabilistic or fuzzy scoring, ranking, deduplication, or candidate selection
+  - authorization or disclosure-profile selection
+  - evidence, identifier, subject-binding, JWS, or audit construction
diff --git a/products/evidence/contracts/runtime.schema.yaml b/products/evidence/contracts/runtime.schema.yaml
new file mode 100644
index 000000000..9746cdb16
--- /dev/null
+++ b/products/evidence/contracts/runtime.schema.yaml
@@ -0,0 +1,98 @@
+$schema: https://json-schema.org/draft/2020-12/schema
+$id: https://registrystack.org/schemas/evidence/runtime-v1.json
+title: Evidence closed operator runtime configuration Version 1
+type: object
+additionalProperties: false
+required: [version, bundleDirectory, listener, secretProviders, auditStorage, outboundTls]
+properties:
+  version: {const: 1}
+  bundleDirectory: {$ref: '#/$defs/absolute-path'}
+  listener:
+    type: object
+    additionalProperties: false
+    required: [bindHost, port, tlsTermination, trustProxyIdentityHeaders, maximumRequestBytes, maximumConcurrentRequests, requestTimeoutMilliseconds, shutdownGraceMilliseconds]
+    properties:
+      bindHost:
+        type: string
+        minLength: 2
+        maxLength: 64
+        description: Numeric loopback, RFC 1918 private IPv4, or RFC 4193 unique-local IPv6 address. Unspecified, multicast, public, and hostname values are prohibited.
+        x-runtime-validation: Parsed as an IP address and accepted only when Rust classifies it as loopback, private IPv4, or unique-local IPv6.
+      port: {type: integer, minimum: 1, maximum: 65535}
+      tlsTermination: {const: operator-controlled-upstream}
+      trustProxyIdentityHeaders: {const: false}
+      maximumRequestBytes: {type: integer, minimum: 1024, maximum: 1048576}
+      maximumConcurrentRequests: {type: integer, minimum: 1, maximum: 4096}
+      requestTimeoutMilliseconds: {type: integer, minimum: 1, maximum: 30000}
+      shutdownGraceMilliseconds: {type: integer, minimum: 1, maximum: 120000}
+  metricsListener:
+    type: object
+    additionalProperties: false
+    required: [bindHost, port]
+    description: Optional operator-only telemetry listener serving GET /metrics. Absent means the deployment serves no metrics endpoint, which is the default. It is a separate binding from the evidence listener and is not described by the public evidence contract.
+    properties:
+      bindHost:
+        type: string
+        minLength: 2
+        maxLength: 64
+        description: Numeric loopback, RFC 1918 private IPv4, or RFC 4193 unique-local IPv6 address. Unspecified, multicast, public, and hostname values are prohibited.
+        x-runtime-validation: Parsed as an IP address and accepted only when Rust classifies it as loopback, private IPv4, or unique-local IPv6.
+      port: {type: integer, minimum: 1, maximum: 65535}
+    x-runtime-validation: Rejected at startup when bindHost and port together repeat the evidence listener binding.
+  secretProviders:
+    type: object
+    additionalProperties: false
+    required: [file]
+    properties:
+      file:
+        type: object
+        additionalProperties: false
+        required: [root]
+        properties:
+          root: {$ref: '#/$defs/absolute-path'}
+  auditStorage:
+    type: object
+    additionalProperties: false
+    required: [path, maximumFileBytes]
+    properties:
+      path: {$ref: '#/$defs/absolute-path'}
+      maximumFileBytes: {type: integer, minimum: 1048576, maximum: 1099511627776}
+  outboundTls:
+    type: object
+    additionalProperties: false
+    required: [systemRoots, trustProfiles]
+    properties:
+      systemRoots: {const: true}
+      trustProfiles:
+        type: object
+        maxProperties: 64
+        propertyNames: {$ref: '#/$defs/local-id'}
+        additionalProperties:
+          type: object
+          additionalProperties: false
+          required: [caBundleFile]
+          properties:
+            caBundleFile: {$ref: '#/$defs/absolute-path'}
+$defs:
+  local-id: {type: string, pattern: '^[a-z][a-z0-9._-]{0,127}$'}
+  absolute-path: {type: string, minLength: 2, maxLength: 512, pattern: '^/(?!/)(?!.*(?:^|/)\.\.?(?:/|$))[^\\\u0000]+$'}
+ownership:
+  governed_fields: prohibited
+  allowed:
+    - bundle directory
+    - listener binding and process limits
+    - optional operator metrics listener binding
+    - file-secret root
+    - audit path and rotation bound
+    - logical private-CA file bindings
+  overrides: prohibited
+startup:
+  unknown_keys: rejected at every level
+  mutability: runtime.yaml and bound CA files are captured read-only once; reload, merge, fallback, and partial serving are prohibited
+  digest: independent SHA-256 revision over exact runtime.yaml bytes plus logical trust-profile names and exact CA bytes
+  trust_profiles: names must exactly equal the logical tlsTrustProfile names used by the governed bundle
+  secrets: values are never parsed into or included in the runtime document or digest
+  proxy: HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, and NO_PROXY are ignored; no application-level proxy field exists
+platform:
+  supported: Unix
+  reason: Version 1 requires Unix owner, mode, no-follow, link-count, and file-identity guarantees for secrets and audit storage.
diff --git a/products/evidence/contracts/sd-jwt-vc-profile.yaml b/products/evidence/contracts/sd-jwt-vc-profile.yaml
new file mode 100644
index 000000000..3876434fc
--- /dev/null
+++ b/products/evidence/contracts/sd-jwt-vc-profile.yaml
@@ -0,0 +1,178 @@
+contract: registry.evidence.sd-jwt-vc-profile/v1
+status: frozen
+summary: >-
+  Audience-scoped SD-JWT VC serialization of the Version one assertion. This
+  profile adds a response format, never a credential lifecycle. Everything
+  before serialization is the unchanged Version one path: one authorization
+  decision, fixed source execution, bounded derivation, output validation,
+  audience-scoped subject binding, and the same durable access and
+  disclosure-release audit ordering.
+response:
+  media_type: application/dc+sd-jwt
+  serialization: sd-jwt-vc-compact
+  structure: issuer-signed JWT, then the root-value and configured structured-field disclosures, then a trailing tilde
+  key_binding_jwt: never appended by the issuer; the trailing tilde marks an absent key-binding JWT
+  negotiation: Only the exact application/dc+sd-jwt media type selects this format, and only when the immutable bundle and the complete matched authority grant both permit it. Missing Accept and */* continue to select signed JWS. Duplicate, combined, parameterized, weighted, or unknown negotiation is not acceptable. Every response varies on Accept and remains no-store.
+  permission_rule: Format selection creates no permission. Denial does not reveal which layer withheld it.
+protected_header:
+  exact_members: [alg, typ, kid]
+  alg:
+    allowed: [EdDSA]
+    rule: Must equal the algorithm bound to the trusted key. Identical to the signed-JWS profile.
+  typ: {const: dc+sd-jwt}
+  kid:
+    required: true
+    rule: Resolved only within the verifier-pinned provider JWKS.
+  prohibited: [jku, x5u, jwk, x5c, crit, b64]
+claims:
+  always_disclosed:
+    iss:
+      source: service.providerId
+      rule: >-
+        The technical provider controlling the signing key, matching the
+        signed-JWS trust statement. The named legal issuer travels separately
+        as issuedBy. A valid signature proves the provider signed the exact
+        payload; governance must establish that the provider is authorized to
+        produce evidence for that legal issuer.
+    sub:
+      source: subjects[0].binding in requirement declaration order
+      rule: >-
+        Convenience projection of the first role-bound audience-scoped subject
+        binding. It is deterministic because the kernel canonicalizes subjects
+        to requirement declaration order. Verifiers must compare the complete
+        subjects set, never sub alone.
+    iat: {source: issuedAt, encoding: unix seconds}
+    exp: {source: validUntil, encoding: unix seconds, rule: exclusive upper bound, identical to the signed-JWS profile}
+    vct: {source: isConformantTo, rule: the Evidence Type is the credential type; no separate credential-type vocabulary is introduced}
+    jti: {source: the Evidence identifier, rule: also emitted as id; not a persisted credential identifier and not usable for status lookup}
+    _sd_alg: {const: sha-256}
+    issuedBy: {source: issuer.id}
+    providedBy: {source: service.providerId}
+    supportsRequirement: {source: supportsRequirement}
+    purpose: {source: purpose}
+    audience: {source: audience}
+    assuranceProfile: {source: assuranceProfile, rule: always disclosed and compared with an independent relying-procedure expectation}
+    observedAt: {source: observedAt}
+    configurationRevision: {source: configurationRevision}
+    requestNonce: {source: requestNonce, rule: exact echo, never stored, never uniqueness-checked}
+    subjects: {source: subjects, rule: complete role and binding pairs, unordered set semantics on comparison}
+    structuredValues:
+      source: configured reviewed-structured-value projections
+      rule: >-
+        Present only when at least one reviewed structured value opts into
+        field disclosure. It binds each configured public claim name to the
+        original concept identifier, reviewed structured form, closed schema
+        URI, and supported-value position. It contains no source value.
+  selectively_disclosed:
+    rule: >-
+      A supported value without an sdJwtVc projection produces exactly one
+      root disclosure. Its claim name is the concept identifier from
+      providesValueFor and its value is the identical public value the
+      signed-JWS payload carries. A projected reviewed structured value instead
+      produces one always-visible object under its configured claim name. The
+      object's _sd member commits independently to each direct field in the
+      structured value's closed fields object. Each direct field name and value
+      forms one disclosure; a nested field value remains atomic. The complete
+      structured value is validated against its reviewed schema before this
+      mapping, exactly as it is for signed JWS.
+    structured_configuration: >-
+      The immutable concept declaration may set sdJwtVc.claim and the fixed
+      disclosure mode top-level only for reviewed-structured-value. Configured
+      claim names are unique within the requirement and cannot collide with
+      profile-owned claims.
+    digest_order: sorted lexicographically before insertion into _sd
+    salt: fresh per disclosure from a cryptographically secure random source
+  holder_binding:
+    cnf:
+      required: false
+      source: the optional holderKey member of the request
+      rule: >-
+        Present only when the caller supplies a holder public key. Evidence
+        embeds it and never validates a presentation. Key-binding JWT
+        verification is the relying party's responsibility.
+      constraints:
+        key_type: OKP Ed25519 public JWK
+        private_members_prohibited: [d, p, q, dp, dq, qi, k]
+        rule: A key carrying any private member, a non-allowlisted algorithm, or an unparseable body fails before credential acquisition or source access.
+  prohibited:
+    - status
+    - nbf
+    - aud
+    - any selector profile, selector field name, or selector value
+    - any source identity, source response fragment, or adapter identity
+    - any grant identifier, requester identity, or actor identity
+    - any credential-status, revocation, or reissuance reference
+subject_scope:
+  binding: the existing audience-scoped subject binding
+  consequence: >-
+    The credential is meaningful to the relying party named in audience and to
+    no other. This is deliberate. A holder-scoped subject identifier would
+    create a correlatable identifier surviving across verifiers, which the
+    trust and privacy invariants exist to prevent. Adopter-facing material must
+    state this limit rather than implying a general multi-verifier credential.
+signing:
+  active_keys: 1
+  key_source: identical to the signed-JWS profile; no second key, algorithm, or key ceremony
+  order:
+    - core validates the complete derivation result
+    - core constructs the exact evidence payload including the exact request nonce
+    - core maps that payload to public claims and disclosures without re-deriving any value
+    - signing provider signs the issuer-signed JWT
+    - core serializes the final immutable response bytes
+    - disclosure-release audit is durably accepted
+    - the exact pre-audited bytes are released
+  failure: safe 503 with no fallback to any other response format
+key_discovery:
+  jwks_path: /.well-known/evidence/jwks.json
+  issuer_metadata_path: /.well-known/jwt-vc-issuer
+  issuer_metadata_media_type: application/json
+  issuer_metadata_members: [issuer, jwks]
+  content: public keys only
+  trust_rule: >-
+    Discovery is not a trust anchor. Provider identity and key set remain
+    pinned through governed verifier configuration. JWT VC Issuer Metadata
+    resolution applies only when service.providerId is the HTTPS origin of the
+    deployment; a URN provider identity is valid for the assertion and simply
+    has no metadata resolution path.
+profile_non_goals:
+  rule: None of the following is implemented, stubbed, feature-flagged, or left as an extension seam.
+  items:
+    - OID4VCI in any part, including credential offers, pre-authorized codes, authorization or token endpoints, c_nonce, proof-of-possession challenges, credential endpoints, and deferred issuance
+    - persistent issuance state, an application database, or any store beyond the stateless request-nonce echo
+    - status lists, revocation, suspension, or a credential-status endpoint
+    - presentation-side verification or key-binding JWT validation
+    - wallet onboarding, wallet attestation, or trust-list membership
+    - holder-scoped or otherwise cross-verifier subject identifiers
+    - reissuance, refresh, batch issuance, or persistent credential identifiers
+verifier_rules:
+  - Split the compact serialization on tilde with strict rejection of an empty issuer-signed segment.
+  - Reject any protected member outside the exact allowlist and require the allowlisted algorithm.
+  - Resolve kid only in the pinned provider key set.
+  - Verify the issuer-signed JWT signature before parsing or acting on any claim or disclosure.
+  - Recompute every root-value and structured-field disclosure digest and require an exact match against its owning _sd; reject unmatched disclosures and unmatched digests alike.
+  - Require the exact expected concept identifiers, value forms, and cardinalities after digest verification; missing, extra, duplicated, or wrongly formed output fails even under a valid signature.
+  - Require the exact independently expected assurance profile; a local assertion never satisfies a production or evidence-grade expectation.
+  - Require the exact expected role-bound subject bindings as an unordered set, compared only after signature verification, from independent trusted state.
+  - Require the exact request nonce from the independently retained original request. Nonce reuse is not replay prevention and is not rejected by the runtime.
+  - Treat exp as an exclusive upper bound and apply only the configured clock skew.
+  - Impose a maximum accepted assertion lifetime in addition to current validity.
+  - Report cryptographic authenticity separately from current validity.
+  - Do not infer source truth, legal-signature status, single-use semantics, or revocation status from a valid signature.
+  - Do not infer holder possession from cnf alone; possession is proven only by a key-binding JWT the relying party itself verifies.
+relying_party_tooling:
+  library: registry_evidence::verifier::verify_sd_jwt_vc, which applies the rules above and then the identical output-contract and policy path the signed-JWS verifier uses
+  command: evidence verify --sd-jwt-vc <file> --jwks <file> --policy <file>
+  scope: issuer authenticity and the output contract only. No presentation, key-binding JWT, or holder possession is evaluated, and no network call is made.
+# Each identifier is a named security negative resolved through
+# security-test-traceability.yaml to executable tests. The last three are
+# shared with the signed-JWS profile because this profile changes the
+# serialization, never the release, audit, or verifier expectation rules.
+negative_tests:
+  - expected-assurance-profile-mismatch
+  - sec-sd-jwt-projection-integrity
+  - sec-sd-jwt-format-requires-bundle-and-grant
+  - sec-sd-jwt-holder-key-closed
+  - sec-sd-jwt-claims-closed
+  - sec-release-bytes-pre-audited
+  - sec-audit-response-protection-mode
+  - sec-verifier-independent-expectations
diff --git a/products/evidence/contracts/security-invariant-matrix.yaml b/products/evidence/contracts/security-invariant-matrix.yaml
new file mode 100644
index 000000000..5a7fc0cb5
--- /dev/null
+++ b/products/evidence/contracts/security-invariant-matrix.yaml
@@ -0,0 +1,280 @@
+contract: registry.evidence.security-invariants/v1
+status: frozen
+review_rule: Every row requires its named negative test on the same implementation revision; tests may be split but may not be weakened or deleted.
+invariants:
+  - id: V1-I01
+    rule: Only predefined, versioned requirements can be evaluated.
+    threat: Caller turns Evidence into an arbitrary fact-query service.
+    enforcement: Request resolver accepts only exact enabled requirement revisions before authorization.
+    negative_test: sec-unknown-or-disabled-requirement
+  - id: V1-I02
+    rule: Callers cannot provide thresholds, expressions, scripts, paths, headers, source fields, relationship types, adapter parameters, or response projections.
+    threat: Caller reconstructs protected facts or expands acquisition and disclosure.
+    enforcement: Closed request schema plus fixed bundle-owned preparation, extraction, derivation, source transport, and concept projection.
+    negative_test: sec-caller-query-material-rejected
+  - id: V1-I03
+    rule: The complete enabled bundle is reviewed as one disclosure surface.
+    threat: Threshold ladders or overlapping categories reconstruct a protected value across otherwise safe definitions.
+    enforcement: Startup bundle-combination validation and explicit operator review of one atomic revision.
+    negative_test: sec-unsafe-definition-combination
+  - id: V1-I04
+    rule: Principals and attributes derive only from configured validated authentication sources; missing data denies.
+    threat: Authentication bypass through fallback claims or unsigned headers.
+    enforcement: Strict authentication profile and one configured principal claim with no fallback.
+    negative_test: sec-missing-principal-no-fallback
+  - id: V1-I05
+    rule: One authorization decision binds requester, optional actor, requirement revision, purpose, all role/profile/origin tuples, authority, and audience.
+    threat: Permission splicing or confused-deputy access across partially authorized dimensions.
+    enforcement: Exact complete-entitlement match before audit, credential resolution, or source access.
+    negative_test: sec-no-entitlement-union
+  - id: V1-I06
+    rule: Selector profiles and values are provider-lookup inputs, never proof of authority.
+    threat: Broken object-level authorization by possession of an identifier or demographic tuple.
+    enforcement: Selector validation occurs inside an already matched subject-authority path.
+    negative_test: sec-selector-possession-no-authority
+  - id: V1-I07
+    rule: Caller-provided consent, approval, or grant references never create authority.
+    threat: Fabricated reference escalates authority.
+    enforcement: Grant identifiers are accepted only from authenticated context and must be bound to the complete entitlement.
+    negative_test: sec-caller-grant-reference-rejected
+  - id: V1-I08
+    rule: Callers cannot choose selector fields, operators, weights, thresholds, normalization, or query plans.
+    threat: Matching scope creep, oracle behavior, or broad candidate retrieval.
+    enforcement: Named profiles close exact field sets; independent source and derivation selectorInputs expose only reviewed role/profile/field subsets, while trusted preparation owns provider placement without receiving surplus selectors.
+    negative_test: sec-selector-shape-not-callable
+  - id: V1-I09
+    rule: Source calls are fixed by trusted configuration and executed only by the core.
+    threat: SSRF, credential forwarding, overbroad reads, or script-directed networking.
+    enforcement: Generic fixed HTTPS executor owns origin, method, fixed or selector-bound path, fixed headers, authentication, TLS, projection, proxy denial, bounded source and OAuth single-flight admission, limits, and one-request ceiling. Rhai returns only bounded query pairs and one JSON body, validated before credentials.
+    negative_test: sec-source-request-immutable
+  - id: V1-I10
+    rule: Provider lookup has only match, no_match, and ambiguous; Evidence never exposes or chooses candidates, while reviewed derivation may compare only declared authorized selectors with complete facts from one unique record.
+    threat: Evidence becomes an identity-resolution engine or exposes registry candidates.
+    enforcement: Closed extraction union, maximum two minimized results, no pagination, no derivation on non-match outcomes, and false relationship evidence only after exact returned-record binding plus complete governed relationship facts.
+    negative_test: sec-candidate-material-rejected
+  - id: V1-I11
+    rule: Rhai returns one closed lookup result and declared typed concept values only.
+    threat: Script crosses into authorization, response construction, diagnostics, or arbitrary metadata.
+    enforcement: Closed prepare/2, extract/2, and selector-aware derive/3 entry points, fresh state and input copies, capability allowlist, minimized stage inputs, and closed output decoding.
+    negative_test: sec-rhai-output-shape-closed
+  - id: V1-I12
+    rule: Undeclared concepts, extra fields, and values violating types, codelists, cardinality, precision, or sizes are rejected.
+    threat: Data leakage or type confusion through trusted-script mistakes.
+    enforcement: Core validates exact concept set and the complete Supported Value declaration before evidence construction; decimals are exact coefficient-and-scale values and entity-reference seeds are protected projection inputs.
+    negative_test: sec-derived-value-output-gate
+  - id: V1-I13
+    rule: Missing facts, undefined decisions, script failures, audit failures, and evaluation failures fail closed.
+    threat: Partial, stale, fabricated, or unaudited evidence is released.
+    enforcement: Typed error boundaries; access audit before source; release audit after signing and before release.
+    negative_test: sec-evaluation-and-audit-fail-closed
+  - id: V1-I14
+    rule: Raw source responses are never persisted or logged.
+    threat: Source connector data leakage and unauthorized secondary retention.
+    enforcement: Bounded in-memory response ownership, no recording path, and centralized structured-log redaction.
+    negative_test: sec-source-canary-absent-everywhere
+  - id: V1-I15
+    rule: Selector, source, and disclosed values never appear in logs or native audit.
+    threat: Quasi-identifier disclosure or reconstruction from operational records.
+    enforcement: Field allowlists and at most one scoped keyed pseudonym over each complete canonical role/selector bundle.
+    negative_test: sec-protected-canaries-redacted
+  - id: V1-I16
+    rule: No-match, ambiguous, required-fact-missing, and derivation-input-inconsistent behavior cannot accidentally disclose registry membership.
+    threat: Existence oracle through status, message, diagnostics, count, avoidable timing, or a distinguishable failure class for a uniquely found record with inconsistent derivation inputs.
+    enforcement: Default public collapse of every unresolved class, including derivation-input inconsistency, to one problem shape plus a closed value-free protected audit category without counts.
+    negative_test: sec-unresolved-public-collapse
+  - id: V1-I17
+    rule: Subject bindings are audience-scoped and not globally linkable.
+    threat: Cross-purpose or cross-relying-party tracking.
+    enforcement: Domain-separated keyed derivation includes audience, purpose, role, profile, binding-key version, and complete canonical selector bundle.
+    negative_test: sec-subject-binding-scope
+  - id: V1-I18
+    rule: Configuration is immutable for the serving process lifetime.
+    threat: Unreviewed hot mutation, partial revisions, rollback, or inconsistent audit provenance.
+    enforcement: One read-only atomic governed bundle and one separately digested closed runtime file at startup; runtime overrides, reload, merge, fallback, and mutation paths do not exist.
+    negative_test: sec-runtime-bundle-mutation-absent
+  - id: V1-I19
+    rule: One process serves one operator-controlled trust domain.
+    threat: Cross-tenant disclosure, authority confusion, or key and audit boundary mixing.
+    enforcement: One service trustDomain, issuer governance boundary, bundle lifecycle, signer, and audit boundary per process.
+    negative_test: sec-mutually-distrustful-configuration
+  - id: V1-I20
+    rule: Rate controls are defense in depth, not a substitute for concept design or authorization.
+    threat: Unsafe threshold reconstruction remains possible below or around rate limits.
+    enforcement: Bundle combination validation is mandatory independently of configured rate limits.
+    negative_test: sec-rate-limit-does-not-legalize-ladder
+  - id: V1-I21
+    rule: Signed flattened JWS over the exact evidence payload is mandatory, available to every authorized grant, and the default response; unsigned output exists only through its exact media type when both the immutable bundle and the complete matched grant permit it.
+    threat: Payload substitution, an unsigned success masquerading as verified evidence, or unverifiable parallel representations.
+    enforcement: One flattened-JWS response type containing only protected, payload, and signature, plus a strict closed Accept matrix resolved before source access.
+    negative_test: sec-jws-mutation-and-duplicate-payload
+  - id: V1-I22
+    rule: Missing or failed signing never falls back to unsigned evidence.
+    threat: Availability fallback silently removes integrity and provider authentication.
+    enforcement: Signing readiness plus a mandatory signing step before release audit and response.
+    negative_test: sec-signing-failure-no-release
+  - id: V1-I23
+    rule: Private signing material is core-owned and absent from bundle values, Rhai, logs, audit, and errors.
+    threat: Key disclosure or script exfiltration.
+    enforcement: Secret-reference-only schema, SigningProvider boundary, redacted serialization/debugging, and no script capability.
+    negative_test: sec-private-key-canary-unreachable
+  - id: V1-I24
+    rule: A signature authenticates provider and payload integrity but does not assert legal-signature status or source truth.
+    threat: Relying party overclaims cryptographic or legal assurance.
+    enforcement: Distinct issuer/provider fields and verifier contract with no legal-signature or source-truth claim.
+    negative_test: sec-verifier-rejects-untrusted-provider
+  - id: V1-I25
+    rule: Public evidence is constructed only by the core after complete output validation.
+    threat: Script injects envelope fields, subject identifiers, selector values, or unsupported claims.
+    enforcement: Rhai returns ConceptValueSet only; core owns identifiers, subjects, metadata, decimal serialization, entity-reference HMAC projection, public projection, and JWS.
+    negative_test: sec-script-cannot-construct-evidence
+  - id: V1-I26
+    rule: Evidence-definition discovery is authenticated, requester-scoped, and never creates authority or exposes deployment internals.
+    threat: A public catalog, entitlement oracle, or overbroad metadata response reveals unavailable definitions, authority structure, selectors, source plans, or credentials.
+    enforcement: Rust authenticates and rate-limits discovery, projects only complete shapes matching exactly one authority path and valid token-owned selector material through a closed response allowlist, omits unentitled and ambiguous shapes, and performs no provider or evidence-data audit access.
+    negative_test: sec-discovery-requester-scoped
+  - id: V1-I27
+    rule: Every request carries one exact canonical 32-byte random nonce that is echoed into Evidence but never stored, uniqueness-checked, or exposed to authorization, rate limits, Rhai, source requests, logs, metrics, traces, or native audit.
+    threat: A malformed or attacker-shaped nonce reaches downstream boundaries, or the nonce becomes a covert identifier channel correlated through audit or source records.
+    enforcement: Strict canonical base64url parsing before authentication, credential acquisition, and source access; the exact value is copied only into the core-constructed Evidence payload.
+    negative_test: sec-request-nonce-strict-and-contained
+  - id: V1-I28
+    rule: The unsigned response format is authorized only when the immutable bundle enables it and the one complete matched grant permits it; API selection, runtime configuration, and other grants create no permission.
+    threat: A caller or operator activates unsigned output around governance, or permissions union across grants.
+    enforcement: Closed bundle responseFormats and per-grant responseFormats validated at startup with signed JWS mandatory, checked together after exact entitlement match and before selector resolution, credentials, or source access; the closed runtime file has no response-format field.
+    negative_test: sec-unsigned-requires-bundle-and-grant
+  - id: V1-I29
+    rule: Final immutable response bytes exist before the disclosure-release audit is durably accepted and are the exact bytes released afterward, for both response formats.
+    threat: Audit describes bytes that were never released, or a response is released without a durable release record.
+    enforcement: The runtime serializes the signed JWS or unsigned envelope to its final bytes, durably appends the release event, then returns those bytes unchanged through the HTTP boundary.
+    negative_test: sec-release-bytes-pre-audited
+  - id: V1-I30
+    rule: Audit records the closed response-protection mode on every native event and a signing key identity exactly for signed disclosure release.
+    threat: An unsigned release is indistinguishable from a signed one in accountability records, or a fabricated signing-key claim appears on unsigned output.
+    enforcement: A mandatory closed responseProtection field with schema-conditional signingKeyId validation in the native audit event.
+    negative_test: sec-audit-response-protection-mode
+  - id: V1-I31
+    rule: Strict signed verification requires the independently retained expected nonce, the exact expected unordered set of unique role-bound subject bindings, and the expected concept identifiers, forms, and cardinalities, returns one generic policy mismatch, and reports cryptographic authenticity separately from current validity.
+    threat: A relying party accepts substituted subjects or outputs under a valid signature, or leaks which hidden comparison failed.
+    enforcement: Verifier policy comparison after signature and schema verification with a single generic policy error and a separate current-validity result.
+    negative_test: sec-verifier-independent-expectations
+  - id: V1-I32
+    rule: An access token carrying a proof-of-possession confirmation claim is denied, never accepted as an ordinary bearer token.
+    threat: A stolen sender-constrained token replays for its full lifetime because the profile silently discards a constraint it does not validate.
+    enforcement: Verified-claim rejection of the RFC 7800 confirmation claim before any authenticated context is constructed.
+    negative_test: sec-sender-constrained-token-denied
+  - id: V1-I33
+    rule: Operational telemetry is off by default, served only on a separate operator-private listener, and carries no caller-supplied or protected value in any label or series.
+    threat: A metrics surface becomes a public existence oracle, or per-request labels reconstruct selectors, requirement usage, or registry membership through unbounded series cardinality.
+    enforcement: Optional runtime metricsListener bound to a private address distinct from the evidence listener, serving only GET /metrics; series labels are drawn from the closed registered route-template set, a fixed method set, a fixed status category, and the reviewed problem-code set, never from request content.
+    negative_test: sec-telemetry-bounded-and-operator-private
+  - id: V1-I34
+    rule: Only the explicit local assurance profile may omit a requirement fixture reference; production and evidence-grade retain complete fixture validation before the bundle can load.
+    threat: An incomplete or absent semantic fixture suite is silently treated as deployable assurance.
+    enforcement: The governed assuranceProfile is required in the closed bundle and Rust requires every production or evidence-grade requirement to reference a captured fixture that passes the existing complete coverage validator. Local changes only that fixture prerequisite.
+    negative_test: sec-assurance-profile-fixture-boundary
+  - id: V1-I35
+    rule: Every assertion encoding, definition response, and audit event carries the governed assurance profile, and verification compares it with an independent relying-procedure expectation.
+    threat: An authentic development-only assertion is accepted where production or evidence-grade assurance is required.
+    enforcement: Rust projects assuranceProfile from the immutable bundle into Evidence, JWS, SD-JWT VC, discovery, and audit, while both protected-format verifiers fail with the generic policy error on a mismatch.
+    negative_test: expected-assurance-profile-mismatch
+  - id: V1-I36
+    rule: Credential-free source access exists only for local authoring against an exact numeric-loopback HTTP origin and never sends an authentication header.
+    threat: A local tutorial convenience becomes unauthenticated production access, reaches a remote host, or forwards caller-controlled authorization material.
+    enforcement: Bundle validation binds source authentication kind none to assuranceProfile local, a canonical loopback HTTP origin with an explicit non-zero port, no TLS trust profile, and the core executor's header-free authentication plan; production and evidence-grade reject the kind.
+    negative_test: sec-local-source-none-boundary
+  - id: V1-I37
+    rule: Each configured authority claim names a distinct token member, and none names a registered JWT claim; only principalClaim may name sub.
+    threat: One verified member is read as two different authorities, or an authority is read from a member the issuer wrote for another purpose, such as a grant authority taken from the audience Evidence validates against itself.
+    enforcement: Authentication validation refuses repeated names and the registered-claim set at startup, on the resource server, so the rule holds for every configured OIDC issuer rather than only for issuers that refuse to mint such tokens.
+    negative_test: sec-authority-claim-names-closed
+  - id: V1-I38
+    rule: Every selector set an authority grant can activate carries each role and profile the source path template binds.
+    threat: An authority path that cannot fill the template compiles and reports ready, then fails every request it serves as a source dependency failure, hiding an authorization-shaped configuration fault behind an availability symptom.
+    enforcement: Source plan compilation checks each derived set against the bindings rather than their union, on the same path the check command exercises, so the mismatch is refused before a deployment serves.
+    negative_test: sec-path-binding-unreachable-selector-set
+cross_cutting:
+  config_trust:
+    threat: A missing, writable, or unreviewed bundle is treated as trusted configuration.
+    enforcement: Version 1 has no in-bundle trust override; the operator must supply exactly one reviewed read-only bundle, and absence or failed immutability checks fail readiness.
+    negative_test: sec-missing-or-writable-bundle-fails
+  audit_order:
+    threat: Source read or evidence release occurs without a durable accountability record.
+    enforcement: Access-attempt audit precedes credentials/source; disclosure-release audit follows signing and precedes release; both fail closed. The shared registry-platform-audit DurableSegmentedAuditLog verifies the active segment at startup against a chain head recovered from the newest sealed segment's last record, so restart cost is bounded by one segment rather than by all retained history; sealed history is proven out of band by the `verify-audit` command, which replays every segment from the same closed runtime file the service uses and reports a gap in the sealed sequence as archived-or-missing history rather than as corruption. Steady-state readiness and append use pinned identity, modification fingerprint, expected length, and verified tail so audit cost does not grow quadratically. Rotation seals the active segment and starts a new one online, and the in-memory head carries across the seam so the chain is continuous. Concurrent appends claim chain positions in enqueue order under one short lock that performs no input or output, then share one durable write, so a batch never forks the chain and no record is reported durable before its own bytes are synced. A failed durable write leaves the in-memory head ahead of the disk, so the sink refuses every later append for the life of the process rather than chaining onto a record the disk never received. Readiness checks the pinned active and lock identities under the same low-level sink lock that advances the active fingerprint, so the service's own traffic is never mistaken for external mutation.
+    negative_test: sec-audit-order-and-failure
+  secret_parsing:
+    threat: YAML substitution or bundle values inject credential or key material.
+    enforcement: Bundle accepts exact secret references only; resolution occurs after parsing into core-owned secret containers and values never re-enter configuration.
+    negative_test: sec-secret-values-rejected-from-bundle
+  transport_identity:
+    threat: Public binding or proxy-provided identity bypasses Evidence token validation.
+    enforcement: Loopback or private HTTP listener behind operator-controlled HTTPS termination; Evidence validates strict OIDC bearer tokens and never trusts proxy identity headers.
+    negative_test: sec-proxy-identity-header-rejected
+  exact_decimal:
+    threat: Binary floating-point conversion changes a disclosed value or bypasses precision and range bounds.
+    enforcement: Rhai creates a Rust-owned coefficient-and-scale Decimal from canonical text with precision 28 and scale 9; public wire value is that canonical JSON string.
+    negative_test: sec-decimal-no-float-coercion
+  entity_reference_projection:
+    threat: A source-derived entity seed becomes a global identifier or leaks before audience scoping.
+    enforcement: Rhai returns a protected EntityReferenceSeed; Rust HMAC-projects version, concept, audience, and seed with the subject-binding key.
+    negative_test: sec-entity-reference-seed-protected
+  request_preparation:
+    threat: A trusted mapping mistake gains transport authority, smuggles an unbounded request, or acquires credentials before its output is validated.
+    enforcement: prepare/2 receives only minimized authorized selectors and closed parameters; Rust validates exact RequestParts, channel policy, sizes, path, headers, and encoding before bounded source-concurrency admission or credential resolution. GET plans close the JSON-body channel at startup and reject a defensive body before credential access.
+    negative_test: sec-request-preparation-closed
+  runtime_ownership_split:
+    threat: An environment-specific runtime file silently changes governed authorization, disclosure, source authority, signing, or audit policy.
+    enforcement: Closed runtime.yaml accepts only process-local listener, optional metrics-listener, path, secret-root, audit-storage, and logical private-CA bindings and has an independent immutable digest.
+    negative_test: sec-runtime-cannot-override-governed-bundle
+  outbound_tls_and_proxy:
+    threat: A mutable or untrusted CA or ambient proxy redirects credentials and protected source queries to another authority.
+    enforcement: Runtime captures validated private-CA bytes at startup, fixed-origin hostname verification stays enabled, and both evidence-data and OAuth clients ignore ambient proxy variables.
+    negative_test: sec-tls-and-proxy-authority-fixed
+  subject_role_order:
+    threat: Caller-controlled array position substitutes one subject role for another or changes the signed binding order.
+    enforcement: Rust resolves a unique subject by declared role independently of both grant order and request array order, rejects duplicate, missing, unknown, and wrong-profile entries, then emits requirement declaration order in evidence, audit, and the JWS.
+    negative_test: sec-subject-array-order-nonsemantic
+  unsigned_envelope_distinct:
+    threat: A stored unsigned response is mistaken for verified signed evidence.
+    enforcement: The unsigned envelope is self-identifying with a fixed schema, type, integrity marker, warning, and exact vendor media type, contains no JWS member, and is rejected by the strict JWS verifier.
+    negative_test: sec-unsigned-envelope-not-jws
+  secret_file_identity:
+    threat: A group- or world-accessible, symlinked, multi-link, or oversized secret file exposes or substitutes key material.
+    enforcement: File secrets must be regular owner-only files opened without following symlinks, with exact ownership, mode, single-hard-link, and size checks before use.
+    negative_test: sec-secret-file-identity
+  transport_pinning:
+    threat: Workspace dependency feature unification silently changes the TLS backend or introduces transport retries, breaking the one-request and TLS contracts.
+    enforcement: The production source client selects the rustls backend explicitly and disables reqwest transport retries; a connection failure yields exactly one attempt.
+    negative_test: sec-transport-backend-and-single-attempt
+  jwks_route_parity:
+    threat: The configured JWKS path and the served discovery route drift apart.
+    enforcement: Bundle validation pins the one Version 1 discovery path and the served route returns the runtime key set at exactly that configured path.
+    negative_test: sec-jwks-route-config-parity
+  source_response_shape:
+    threat: A source response outside the shape its adapter was reviewed against reaches the extraction script, so a defect or omission in hand-written protocol checking becomes the only thing standing between a malformed response and fact construction.
+    enforcement: Every source declares a required responseSchema in the closed Version 1 subset. Rust validates the projected response against it after projection and before conversion to Rhai; a response outside its declared shape is a source-protocol failure and no script runs.
+    negative_test: sec-source-response-shape-enforced
+  script_resource_exhaustion:
+    threat: A hostile or defective reviewed script consumes unbounded execution inside the shared process.
+    enforcement: The engine's normative operation ceiling terminates the invocation with a closed value-free error.
+    negative_test: sec-script-operation-exhaustion
+  reserved_header_aliases:
+    threat: A configured fixed or API-key header name collides with an authorization, framing, routing, cookie, forwarding, proxy, or tracing header, including case variants and known infrastructure aliases.
+    enforcement: One closed ASCII-case-insensitive deny set shared by startup configuration validation and source plan compilation, with prefix families denied before exact names and both checks running before any credential is resolved.
+    negative_test: sec-reserved-header-aliases-closed
+  sd_jwt_vc_projection_integrity:
+    threat: The SD-JWT VC serialization carries different content from the signed assertion, or a relying party accepts a modified disclosure, digest, payload, or protected header.
+    enforcement: The credential is a projection of the identical constructed evidence payload. Unprojected supported values have one root disclosure. A configured reviewed structured value has one nested disclosure per direct field, after complete schema validation, plus signed metadata that binds its public claim name back to the original concept, schema, and position. The verifier rebuilds the exact payload, requires an exact digest-to-disclosure match in both directions, and then applies the same output-contract and policy checks as signed JWS. Each serialization is rejected by the other format's verifier.
+    negative_test: sec-sd-jwt-projection-integrity
+  sd_jwt_vc_format_authorization:
+    threat: Requesting the credential media type grants a disclosure the requester is not authorized to receive.
+    enforcement: Format selection creates no permission. The immutable bundle and the one complete matched authority grant must each enable the format, and denial does not reveal which layer withheld it.
+    negative_test: sec-sd-jwt-format-requires-bundle-and-grant
+  sd_jwt_vc_holder_key_closed:
+    threat: A caller-supplied holder key smuggles private key material, a non-allowlisted algorithm, or an unparseable body into a signed credential.
+    enforcement: The optional holder key must be a public OKP Ed25519 JWK; any private member, other key type or curve, or malformed body fails before credential acquisition and source access, and the rejection never echoes the submitted key material.
+    negative_test: sec-sd-jwt-holder-key-closed
+  sd_jwt_vc_claims_closed:
+    threat: A claim outside the profile, such as a status reference, an audience restriction, or a smuggled selector value, reaches a relying party under a valid signature.
+    enforcement: The published claim set is closed to the issuer-owned and always-disclosed names plus the declared disclosures; the verifier rejects any other member instead of ignoring it.
+    negative_test: sec-sd-jwt-claims-closed
+fixture_index: ../fixtures/conformance/coverage-matrix.yaml
diff --git a/products/evidence/contracts/security-test-traceability.yaml b/products/evidence/contracts/security-test-traceability.yaml
new file mode 100644
index 000000000..5f96b99f3
--- /dev/null
+++ b/products/evidence/contracts/security-test-traceability.yaml
@@ -0,0 +1,261 @@
+contract: registry.evidence.security-test-traceability/v1
+entries:
+  - id: sec-assurance-profile-fixture-boundary
+    tests:
+      - {file: crates/registry-evidence/src/config.rs, name: assurance_profile_is_explicit_and_strict_profiles_require_fixtures}
+      - {file: crates/registry-evidence/src/config.rs, name: only_local_assurance_accepts_the_exact_loopback_mint_identity}
+      - {file: crates/registry-evidence/src/auth.rs, name: jwks_fetch_policy_opens_http_only_for_exact_local_mint}
+      - {file: crates/registry-evidence/src/bundle.rs, name: local_bundle_may_omit_fixtures_but_strict_bundles_remain_complete}
+      - {file: crates/registry-evidence/src/bundle.rs, name: strict_assurance_rejects_partial_fixture_suites}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: local_runtime_without_fixture_references_keeps_the_real_security_path}
+  - id: expected-assurance-profile-mismatch
+    tests:
+      - {file: crates/registry-evidence/src/verifier.rs, name: authentic_local_assertions_fail_deployable_assurance_expectations}
+  - id: sec-unknown-or-disabled-requirement
+    tests: [{file: crates/registry-evidence/src/runtime_tests.rs, name: security_contract_rejects_unknown_and_unauthorized_requests_before_source_access}]
+  - id: sec-caller-query-material-rejected
+    tests:
+      - {file: crates/registry-evidence/src/model.rs, name: request_rejects_query_material_and_unknown_fields}
+      - {file: crates/registry-evidence/src/server.rs, name: request_json_is_strict_and_closed}
+  - id: sec-unsafe-definition-combination
+    tests: [{file: crates/registry-evidence/src/config.rs, name: a_shared_disclosure_family_rejects_the_complete_bundle}]
+  - id: sec-missing-principal-no-fallback
+    tests: [{file: crates/registry-evidence/src/runtime_tests.rs, name: missing_principal_never_falls_back_to_client_id_or_azp}]
+  - id: sec-sender-constrained-token-denied
+    tests: [{file: crates/registry-evidence/src/runtime_tests.rs, name: sender_constrained_tokens_are_denied_rather_than_downgraded}]
+  - id: sec-telemetry-bounded-and-operator-private
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: metrics_report_bounded_series_without_disclosing_request_content}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: a_configured_metrics_listener_serves_beside_the_evidence_listener}
+      - {file: crates/registry-evidence/src/config.rs, name: the_optional_metrics_listener_is_absent_by_default_and_stays_operator_private}
+  - id: sec-no-entitlement-union
+    tests: [{file: crates/registry-evidence/src/config.rs, name: complete_authority_paths_cannot_be_unioned_across_partial_grants}]
+  - id: sec-selector-possession-no-authority
+    tests: [{file: crates/registry-evidence/src/runtime_tests.rs, name: security_contract_rejects_unknown_and_unauthorized_requests_before_source_access}]
+  - id: sec-caller-grant-reference-rejected
+    tests: [{file: crates/registry-evidence/src/model.rs, name: request_rejects_query_material_and_unknown_fields}]
+  - id: sec-selector-shape-not-callable
+    tests:
+      - {file: crates/registry-evidence/src/selector.rs, name: selector_claim_values_are_scalar_only}
+      - {file: crates/registry-evidence/src/config.rs, name: active_source_role_sets_reject_unreachable_inputs_at_startup}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: failed_selector_budget_is_enforced_by_the_runtime_and_scoped_to_authority}
+  - id: sec-source-request-immutable
+    tests:
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: exact_request_applies_path_query_body_headers_auth_and_projection_once}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: hostile_path_values_and_malformed_preparation_fail_before_transport_and_redact}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: every_frozen_source_shape_executes_through_production_materialization_and_projection}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: every_acquisition_posture_fixture_executes_with_one_bounded_request}
+      - {file: crates/registry-evidence/src/config.rs, name: path_templates_headers_and_projection_fail_closed}
+  - id: sec-candidate-material-rejected
+    tests: [{file: crates/registry-evidence/src/runtime_tests.rs, name: one_runtime_proves_all_definitions_and_collapses_unresolved_relationships}]
+  - id: sec-rhai-output-shape-closed
+    tests:
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: extraction_decodes_only_the_closed_union_and_validates_facts}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: runtime_rejects_an_extra_extracted_fact_before_derivation_or_release}
+  - id: sec-derived-value-output-gate
+    tests:
+      - {file: crates/registry-evidence/src/kernel.rs, name: extraction_failures_and_invalid_outputs_fail_closed}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: runtime_output_gate_rejects_every_fixture_injected_derivation_without_release}
+  - id: sec-evaluation-and-audit-fail-closed
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: access_audit_failure_blocks_credentials_and_source_access}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: disclosure_audit_failure_prevents_signed_response_release}
+  - id: sec-source-canary-absent-everywhere
+    tests: [{file: crates/registry-evidence/src/runtime_tests.rs, name: one_runtime_proves_all_definitions_and_collapses_unresolved_relationships}]
+  - id: sec-protected-canaries-redacted
+    tests:
+      - {file: crates/registry-evidence/src/model.rs, name: debug_surfaces_redact_requests_facts_disclosures_and_signed_payloads}
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: derived_value_debug_redacts_every_value_carrier}
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: request_parts_debug_redacts_query_and_body_values}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: runtime_output_gate_rejects_every_fixture_injected_derivation_without_release}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: operational_logs_carry_only_the_reviewed_fields_and_disclose_no_value}
+  - id: sec-unresolved-public-collapse
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: one_runtime_proves_all_definitions_and_collapses_unresolved_relationships}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: declared_existence_disclosure_mode_governs_the_public_collapse}
+      - {file: crates/registry-evidence/src/runtime.rs, name: derivation_input_inconsistency_collapses_with_the_unresolved_classes}
+  - id: sec-subject-binding-scope
+    tests: [{file: crates/registry-evidence/src/binding.rs, name: every_subject_binding_scope_component_is_cryptographically_bound}]
+  - id: sec-runtime-bundle-mutation-absent
+    tests:
+      - {file: crates/registry-evidence/src/bundle.rs, name: revision_binds_paths_and_exact_bytes_deterministically}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: serving_runtime_never_reloads_merges_or_falls_back_after_bundle_capture}
+  - id: sec-mutually-distrustful-configuration
+    tests: [{file: crates/registry-evidence/src/config.rs, name: one_trust_domain_and_native_token_identity_are_closed_configuration}]
+  - id: sec-rate-limit-does-not-legalize-ladder
+    tests: [{file: crates/registry-evidence/src/config.rs, name: a_shared_disclosure_family_rejects_the_complete_bundle}]
+  - id: sec-jws-mutation-and-duplicate-payload
+    tests:
+      - {file: crates/registry-evidence/src/verifier.rs, name: payload_and_protected_header_mutation_fail}
+      - {file: crates/registry-evidence/src/verifier.rs, name: duplicate_jws_members_and_unknown_kid_are_rejected}
+      - {file: crates/registry-evidence/src/verifier.rs, name: signed_payload_must_satisfy_the_complete_evidence_schema}
+  - id: sec-signing-failure-no-release
+    tests: [{file: crates/registry-evidence/src/runtime_tests.rs, name: signing_failure_is_transient_audited_and_never_releases_unsigned_evidence}]
+  - id: sec-private-key-canary-unreachable
+    tests:
+      - {file: crates/registry-evidence/src/config.rs, name: yaml_names_and_secret_references_are_strict}
+      - {file: crates/registry-evidence/src/signing.rs, name: jwks_contains_public_material_only}
+  - id: sec-verifier-rejects-untrusted-provider
+    tests: [{file: crates/registry-evidence/src/verifier.rs, name: signature_never_substitutes_for_provider_and_issuer_trust_policy}]
+  - id: sec-script-cannot-construct-evidence
+    tests:
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: ambient_and_diagnostic_capabilities_are_unavailable}
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: derivation_decode_is_closed_and_retains_protected_types}
+  - id: sec-discovery-requester-scoped
+    tests:
+      - {file: crates/registry-evidence/src/model.rs, name: debug_surfaces_redact_requests_facts_disclosures_and_signed_payloads}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: real_router_serves_all_definitions_concurrently_without_crossing_boundaries}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: discovery_requires_authentication_and_returns_no_unentitled_definitions}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: discovery_omits_an_authority_shape_that_the_runtime_would_deny_as_ambiguous}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: discovery_uses_the_bounded_per_principal_request_budget}
+  - id: sec-missing-or-writable-bundle-fails
+    tests: [{file: crates/registry-evidence/src/bundle.rs, name: writable_bundle_and_unknown_files_fail_closed}]
+  - id: sec-audit-order-and-failure
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: access_audit_failure_blocks_credentials_and_source_access}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: disclosure_audit_failure_prevents_signed_response_release}
+      - {file: crates/registry-evidence/src/audit.rs, name: frozen_audit_fixture_matches_native_event_shape_and_phase_rules}
+      - {file: crates/registry-evidence/src/audit.rs, name: audit_is_durable_keyed_and_redacted}
+      - {file: crates/registry-evidence/src/audit.rs, name: restart_verifies_a_nonempty_keyed_chain_before_accepting_appends}
+      - {file: crates/registry-evidence/src/audit.rs, name: restart_rejects_same_length_chain_corruption}
+      - {file: crates/registry-evidence/src/audit.rs, name: restart_rejects_a_truncated_final_record}
+      - {file: crates/registry-evidence/src/audit.rs, name: restart_rejects_the_wrong_audit_key}
+      - {file: crates/registry-evidence/src/audit.rs, name: same_length_external_mutation_fails_readiness_and_future_appends}
+      - {file: crates/registry-evidence/src/audit.rs, name: appends_rotate_into_sealed_segments_and_the_chain_spans_the_seam}
+      - {file: crates/registry-evidence/src/audit.rs, name: a_restart_after_rotation_continues_from_the_sealed_tail}
+      - {file: crates/registry-evidence/src/audit.rs, name: a_missing_active_segment_recovers_from_the_sealed_tail}
+      - {file: crates/registry-evidence/src/audit.rs, name: a_corrupt_sealed_tail_is_rejected_at_startup}
+      - {file: crates/registry-evidence/src/audit.rs, name: sealed_segment_corruption_passes_startup_and_fails_the_verifier}
+      - {file: crates/registry-evidence/src/audit.rs, name: pathname_replacement_is_rejected_even_when_the_append_would_rotate}
+      - {file: crates/registry-evidence/src/audit.rs, name: an_archived_middle_segment_is_reported_as_missing_not_as_corruption}
+      - {file: crates/registry-evidence/src/audit.rs, name: concurrent_appends_extend_one_keyed_chain_without_forking}
+      - {file: crates/registry-evidence/src/audit.rs, name: concurrent_appends_share_durable_writes}
+      - {file: crates/registry-evidence/src/audit.rs, name: a_failed_durable_write_poisons_the_sink_instead_of_forking_the_chain}
+      - {file: crates/registry-evidence/src/audit.rs, name: a_poisoned_sink_fails_concurrent_waiters_instead_of_hanging_them}
+      - {file: crates/registry-evidence/src/audit.rs, name: readiness_holds_while_appends_are_in_flight}
+      - {file: crates/registry-evidence/src/main.rs, name: verify_audit_fails_on_sealed_segment_corruption}
+      - {file: crates/registry-evidence/src/main.rs, name: verify_audit_reports_an_archived_segment_as_missing_not_corrupt}
+  - id: sec-secret-values-rejected-from-bundle
+    tests: [{file: crates/registry-evidence/src/config.rs, name: yaml_names_and_secret_references_are_strict}]
+  - id: sec-proxy-identity-header-rejected
+    tests: [{file: crates/registry-evidence/src/config.rs, name: one_trust_domain_and_native_token_identity_are_closed_configuration}]
+  - id: sec-decimal-no-float-coercion
+    tests: [{file: crates/registry-evidence/src/kernel.rs, name: scalar_decimal_and_collection_forms_are_exact}]
+  - id: sec-entity-reference-seed-protected
+    tests:
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: protected_seed_has_no_comparison_or_string_conversion_capability}
+      - {file: crates/registry-evidence/src/binding.rs, name: entity_reference_is_audience_and_concept_scoped}
+  - id: sec-request-preparation-closed
+    tests:
+      - {file: crates/registry-evidence/src/rhai_runtime.rs, name: preparation_inputs_and_request_parts_are_closed_and_bounded}
+      - {file: crates/registry-evidence/src/source.rs, name: saturated_source_admission_fails_at_the_configured_timeout}
+      - {file: crates/registry-evidence/src/source.rs, name: saturated_oauth_single_flight_fails_before_credentials_or_transport}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: hostile_path_values_and_malformed_preparation_fail_before_transport_and_redact}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: materialized_request_reuses_path_template_query_and_body_without_auth_material}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: get_body_is_rejected_before_static_or_oauth_credential_acquisition}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: oauth_client_credentials_placements_are_exact_and_cache_reuse_is_bounded}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: oauth_credential_redaction_fixture_fails_closed_without_data_requests}
+  - id: sec-runtime-cannot-override-governed-bundle
+    tests:
+      - {file: crates/registry-evidence/src/config.rs, name: runtime_document_is_closed_and_contains_no_governed_override_surface}
+      - {file: crates/registry-evidence/src/bundle.rs, name: runtime_and_ca_bytes_are_captured_under_an_independent_read_only_revision}
+  - id: sec-tls-and-proxy-authority-fixed
+    tests:
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: private_ca_tls_handshake_succeeds_and_hostname_mismatch_fails}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: private_ca_plan_rejects_unbound_missing_and_malformed_captures}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: runtime_ca_capture_rejects_symlink_malformed_and_mutable_files}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: ambient_proxy_variables_are_ignored_in_an_isolated_process}
+  - id: sec-subject-array-order-nonsemantic
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: multi_role_request_order_is_not_semantic_and_output_uses_declaration_order}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: reordered_grant_subjects_resolve_by_role_and_emit_declaration_order}
+      - {file: crates/registry-evidence/src/verifier.rs, name: expected_subject_set_is_unordered_unique_and_exact}
+  - id: sec-request-nonce-strict-and-contained
+    tests:
+      - {file: crates/registry-evidence/src/model.rs, name: request_nonce_canonicality_is_exact}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: request_nonce_is_strict_and_never_reaches_source_or_audit}
+      - {file: crates/registry-evidence/src/server.rs, name: request_json_is_strict_and_closed}
+  - id: sec-unsigned-requires-bundle-and-grant
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: unsigned_output_requires_both_bundle_and_grant_permission}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: accept_negotiation_is_closed_and_fails_before_source_access}
+      - {file: crates/registry-evidence/src/server.rs, name: accept_negotiation_matrix_is_closed_and_exact}
+      - {file: crates/registry-evidence/src/config.rs, name: response_formats_are_closed_unique_and_keep_signed_mandatory}
+  - id: sec-release-bytes-pre-audited
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: disclosure_audit_failure_prevents_signed_response_release}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: disclosure_audit_failure_prevents_unsigned_response_release}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: signing_failure_returns_a_problem_and_never_an_unsigned_body}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: sd_jwt_signing_failure_no_fallback_format}
+  - id: sec-audit-response-protection-mode
+    tests:
+      - {file: crates/registry-evidence/src/audit.rs, name: frozen_audit_fixture_matches_native_event_shape_and_phase_rules}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: unsigned_envelope_is_exact_audited_and_never_a_signing_fallback}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: all_four_definitions_pass_the_explicitly_authorized_unsigned_path}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: sd_jwt_format_not_permitted_by_grant}
+  - id: sec-verifier-independent-expectations
+    tests:
+      - {file: crates/registry-evidence/src/verifier.rs, name: expected_nonce_must_match_and_reuse_is_not_replay_prevention}
+      - {file: crates/registry-evidence/src/verifier.rs, name: expected_subject_set_is_unordered_unique_and_exact}
+      - {file: crates/registry-evidence/src/verifier.rs, name: expected_output_contract_is_exact_after_signature_verification}
+      - {file: crates/registry-evidence/src/verifier.rs, name: authenticity_is_reported_separately_from_current_validity}
+      - {file: crates/registry-evidence/src/verifier.rs, name: assertion_lifetime_above_the_accepted_maximum_fails}
+  - id: sec-unsigned-envelope-not-jws
+    tests:
+      - {file: crates/registry-evidence/src/verifier.rs, name: unsigned_envelope_is_rejected_by_the_strict_jws_verifier}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: unsigned_envelope_is_exact_audited_and_never_a_signing_fallback}
+  - id: sec-secret-file-identity
+    tests:
+      - {file: crates/registry-evidence/src/secrets.rs, name: file_secret_uses_open_file_owner_and_exact_mode_checks}
+      - {file: crates/registry-evidence/src/secrets.rs, name: file_secret_rejects_symlinks_and_non_regular_files}
+      - {file: crates/registry-evidence/src/secrets.rs, name: file_secret_rejects_every_name_for_a_hard_link}
+      - {file: crates/registry-evidence/src/secrets.rs, name: file_secret_read_is_bounded}
+  - id: sec-transport-backend-and-single-attempt
+    tests:
+      - {file: crates/registry-evidence/src/source.rs, name: evidence_client_uses_rustls_and_fails_closed_on_an_unrecognized_certificate_authority}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: a_reset_transport_failure_yields_exactly_one_connection_attempt}
+  - id: sec-jwks-route-config-parity
+    tests: [{file: crates/registry-evidence/src/runtime_tests.rs, name: configured_jwks_path_is_mechanically_the_served_route}]
+  - id: sec-source-response-shape-enforced
+    tests:
+      - {file: crates/registry-evidence/src/kernel.rs, name: a_projected_response_outside_its_declared_shape_fails_before_extraction}
+      - {file: crates/registry-evidence/src/config.rs, name: source_schema_roles_are_mandatory_distinct_and_directory_scoped}
+  - id: sec-script-operation-exhaustion
+    tests: [{file: crates/registry-evidence/src/rhai_runtime.rs, name: operation_exhaustion_terminates_a_hostile_script_with_a_value_free_error}]
+  - id: sec-reserved-header-aliases-closed
+    tests:
+      - {file: crates/registry-evidence/src/config.rs, name: path_templates_headers_and_projection_fail_closed}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: forbidden_header_collisions_and_invalid_projection_contracts_fail_at_compilation}
+  - id: sec-sd-jwt-projection-integrity
+    tests:
+      - {file: crates/registry-evidence/src/verifier.rs, name: sd_jwt_vc_round_trips_and_verifies_under_the_same_policy}
+      - {file: crates/registry-evidence/src/verifier.rs, name: sd_jwt_disclosure_modification_rejected}
+      - {file: crates/registry-evidence/src/verifier.rs, name: sd_jwt_added_disclosure_rejected}
+      - {file: crates/registry-evidence/src/verifier.rs, name: sd_jwt_removed_digest_rejected}
+      - {file: crates/registry-evidence/src/verifier.rs, name: sd_jwt_payload_modification_rejected}
+      - {file: crates/registry-evidence/src/verifier.rs, name: sd_jwt_protected_header_modification_rejected}
+      - {file: crates/registry-evidence/src/verifier.rs, name: sd_jwt_unknown_kid_rejected}
+      - {file: crates/registry-evidence/src/verifier.rs, name: sd_jwt_rejected_by_flattened_jws_verifier}
+      - {file: crates/registry-evidence/tests/cli.rs, name: verify_accepts_an_authentic_and_current_stored_sd_jwt_vc}
+      - {file: crates/registry-evidence/tests/cli.rs, name: verify_rejects_a_stored_sd_jwt_vc_whose_disclosure_was_replaced}
+      - {file: crates/registry-evidence/tests/cli.rs, name: verify_requires_exactly_one_stored_response_format}
+  - id: sec-sd-jwt-format-requires-bundle-and-grant
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: sd_jwt_format_not_permitted_by_bundle}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: sd_jwt_format_not_permitted_by_grant}
+      - {file: crates/registry-evidence/src/config.rs, name: response_formats_are_closed_unique_and_keep_signed_mandatory}
+  - id: sec-sd-jwt-holder-key-closed
+    tests:
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: sd_jwt_holder_key_with_private_member_rejected}
+      - {file: crates/registry-evidence/src/runtime_tests.rs, name: sd_jwt_holder_key_wrong_algorithm_rejected}
+      - {file: crates/registry-evidence/src/verifier.rs, name: sd_jwt_vc_confirmation_is_accepted_and_carries_no_private_material}
+  - id: sec-sd-jwt-claims-closed
+    tests: [{file: crates/registry-evidence/src/verifier.rs, name: sd_jwt_prohibited_claim_rejected}]
+  - id: sec-local-source-none-boundary
+    tests:
+      - {file: crates/registry-evidence/src/config.rs, name: unauthenticated_source_is_local_loopback_only_and_matches_the_bundle_schema}
+      - {file: crates/registry-evidence/tests/source_contracts.rs, name: local_unauthenticated_loopback_source_sends_no_authentication_header}
+  - id: sec-authority-claim-names-closed
+    tests: [{file: crates/registry-evidence/src/config.rs, name: authority_claim_names_must_be_distinct_and_must_not_shadow_registered_claims}]
+  - id: sec-path-binding-unreachable-selector-set
+    tests: [{file: crates/registry-evidence/tests/source_contracts.rs, name: an_allowed_selector_set_that_cannot_fill_the_path_template_is_refused}]
diff --git a/products/evidence/contracts/selector-contract.yaml b/products/evidence/contracts/selector-contract.yaml
new file mode 100644
index 000000000..d95b7310b
--- /dev/null
+++ b/products/evidence/contracts/selector-contract.yaml
@@ -0,0 +1,85 @@
+contract: registry.evidence.selector-profile/v1
+status: frozen
+profile:
+  identifier:
+    pattern: '^[a-z][a-z0-9._-]{0,127}$'
+    meaning: Deployment-defined stable name; no field name has core semantics.
+  fields:
+    minimum: 1
+    maximum: 16
+    exact_set: true
+    name_pattern: '^[a-z][a-z0-9._-]{0,63}$'
+    allowed_types:
+      string: {requires: [minimum_bytes, maximum_bytes]}
+      date: {lexical_form: YYYY-MM-DD}
+      integer: {requires: [minimum, maximum]}
+      boolean: {}
+      controlled-code: {requires: [codelist, codelist_version, maximum_bytes]}
+  maximum_aggregate_bytes:
+    required: true
+    maximum: 8192
+  value_origins:
+    allowed: [authenticated-context, authenticated-grant, request]
+    rule: Each authority path permits exactly the reviewed origin for each role and profile.
+  value_claims:
+    authenticated-context: Required exact field-name to verified-token claim-path map.
+    authenticated-grant: Required exact field-name to verified-token claim-path map plus configured grantIdClaim and grantAuthorityClaim; grantAuthority must equal the matched authority-profile identifier.
+    request: Prohibited; selector values come only from the closed public request values object.
+    completeness: Map keys must exactly equal the named profile field set; missing, extra, duplicate-target, or invalid claim paths fail startup.
+    claim_path_pattern: '^[A-Za-z_][A-Za-z0-9_-]*(\.[A-Za-z_][A-Za-z0-9_-]*)*$'
+    token_rule: Claim paths are resolved only from the strictly verified access token, never proxy identity headers, unsigned headers, request fields, or fallback claims.
+  source_inputs:
+    rule: Each source declares a closed selectorInputs set of allowed role, profile, and exact field alternatives. Rust passes only the active already validated and authorized subset to prepare/2. Provider query and JSON-body mapping is reviewed script logic, not public request data or a core placement DSL.
+    path_templates: Complete-segment pathBindings are separately Rust-owned and bind directly to one declared role, profile, and field. They are never script or caller output.
+    caller_supplied_paths_or_placements: prohibited
+  derivation_inputs:
+    rule: Each requirement may declare a separate closed derivation.selectorInputs set. Rust passes only those already authorized roles, profiles, and fields to derive/3; omission supplies an empty map.
+    relationship_use: A reviewed derivation may compare an independently authorized stable candidate reference with complete facts from one uniquely resolved authoritative record. It may not inspect any undeclared subject material.
+validation:
+  active_set: Runtime materializes only the complete role/profile tuple set matched by the authority grant, resolves request subjects by unique role rather than array position, and never unions every alternative declared on a shared source.
+  subject_array_order: Non-semantic. Duplicate, missing, unknown, or wrong-profile roles fail before credentials or source access; accepted roles are canonicalized to requirement declaration order for internal processing and evidence output.
+  before_credentials_or_source:
+    - role exists and cardinality is exact
+    - profile is permitted for that role and authority path
+    - value origin is permitted
+    - values are absent for context-derived or grant-derived input
+    - values are present for request-derived input
+    - configured valueClaims are exact and complete for context or grant origin and absent for request origin
+    - authenticated-grant id and authority claim values bind the matched profile and entitlement
+    - exact field set, scalar type, lexical form, individual bound, and aggregate bound pass
+  prohibited_core_behavior:
+    - semantic normalization
+    - case folding
+    - transliteration or phonetics
+    - tokenization or name-order parsing
+    - partial-date matching
+    - fuzzy or probabilistic matching
+    - confidence, weights, thresholds, scoring, or candidate choice
+  alternative_sets: A different sufficient field set or added disambiguator is a distinct named profile; it is never inferred from supplied fields.
+  exact_relationship_rule: A signed false relationship result requires exact returned-record binding, one unique provider match, a schema-required complete relationship set, governed contract and reference namespaces, and the exact declared comparison. Missing, partial, mismatched, or ambiguous data is unavailable rather than false.
+canonical_encoding:
+  format: deterministic length-prefixed UTF-8 binary
+  sequence:
+    - version byte 0x01
+    - audience URI
+    - purpose code
+    - role id
+    - selector profile id
+    - field count
+    - each field in profile declaration order as name, scalar type tag, and canonical scalar bytes
+  scalar_rules:
+    string: exact validated UTF-8 bytes without normalization
+    date: validated ASCII YYYY-MM-DD
+    integer: minimal signed decimal ASCII, no leading plus or leading zero except zero
+    boolean: single byte 0x00 or 0x01
+    controlled-code: exact validated UTF-8 codelist code
+  purpose: Input to audience-scoped subject binding and audit pseudonymization; never exposed or logged.
+subject_binding_projection:
+  hmac_input: deterministic length-prefixed bytes over profile version, audience, purpose, role, selector profile, binding-key version, and complete canonical selector fields
+  key: subjectBinding.secretRef from the governed bundle
+  output: 'urn:evidence:subject:v<key-version>_<base64url-no-pad HMAC-SHA256>'
+  rule: Binding-key rotation changes the public binding version; a binding is never global or accepted as authority.
+audit:
+  permitted: selector profile id and at most one scoped keyed pseudonym over the complete canonical role/profile/field bundle
+  prohibited: raw values, per-field hashes, plain hashes, globally stable subject handles, candidate material
+fixtures: ../fixtures/conformance/selector-matrix.yaml
diff --git a/products/evidence/contracts/source-contract.yaml b/products/evidence/contracts/source-contract.yaml
new file mode 100644
index 000000000..0c28c2896
--- /dev/null
+++ b/products/evidence/contracts/source-contract.yaml
@@ -0,0 +1,197 @@
+contract: registry.evidence.fixed-http-json-source/v1
+status: frozen
+ownership:
+  governed_bundle:
+    - fixed source origin, acquisition posture, authentication kind, and logical secret references
+    - fixed method and fixed path, or complete-segment pathTemplate and pathBindings
+    - fixed non-secret headers, closed selectorInputs, prepareScript, extractScript, adapter parameters, and the adapter-parameter, response, and fact schemas
+    - preparation channel policy and bounds, response projection, redirect denial, timeout, response byte limit, and concurrency limit
+    - optional logical TLS trust-profile name
+  runtime_yaml:
+    - bundle directory, listener and process bounds
+    - file-secret root and audit-storage path
+    - exact private-CA file binding for each governed logical TLS trust profile
+  runtime_override: prohibited
+  scripts:
+    prepare: Renders only ordered query pairs and at most one JSON body from minimized authorized selectors and closed parameters.
+    extract: Maps only the bounded projected response, already inside its declared response schema, and closed parameters to the closed lookup union.
+    prohibited: source, origin, method, path, headers, authentication, credentials, TLS, proxy, redirect, retry, pagination, concurrency, or request-count authority
+evidence_data_request:
+  count: Exactly one per evaluation after successful authorization, durable access audit, and complete RequestParts validation.
+  retry: The HTTP client disables transport retry explicitly, so a connection failure yields exactly one connection attempt and no second request.
+  owner: Core runtime.
+  method_allowlist: [GET, POST]
+  request_media_types: [application/json]
+  response_media_types: [application/json, application/graphql-response+json]
+  redirects: deny
+  maximum_response_bytes: {required: true, upper_bound: 1048576, applied: before parsing and projection}
+  timeout_milliseconds: {required: true, range: [1, 30000], applies_to: [source-concurrency-admission, OAuth-single-flight-admission, HTTP-exchange]}
+  concurrency_limit: {required: true, range: [1, 256]}
+  request_parts:
+    query: Ordered logical string pairs. Rust preserves duplicates, percent-encodes UTF-8 components exactly once with uppercase percent escapes, and never performs implicit value-to-string conversion.
+    body: At most one bounded JSON value. JSON null means no body; GET sources must configure the JSON-body channel as forbidden and any defensive GET-with-body execution is rejected before concurrency admission or credential resolution.
+    channels: Each source marks query and JSON body required, allowed, or forbidden and may configure tighter bounds beneath the ABI ceilings.
+    validation_order: Rust validates the exact keys, types, channel policy, sizes, query controls, and normalized output before resolving credentials or contacting the source.
+  path:
+    fixed: One normalized absolute path.
+    template: A placeholder occupies one complete segment and binds directly to one already authorized selector role, profile, and field through pathBindings.
+    template_reachability: A binding is mandatory against the selector set a request activates, not against the union of the sets. Every allowed set must therefore carry each bound role and profile, and plan compilation refuses the source otherwise. Sets are derived one per authority grant, so an authority granted over roles the template does not bind would otherwise compile, pass readiness, and fail every request it serves.
+    encoding: Rust rejects missing, extra, duplicated, empty, slash, backslash, percent, control, and dot-segment values and percent-encodes each accepted segment exactly once.
+    script_authority: prohibited
+  fixed_headers:
+    form: Ordered non-secret name and value constants, unique after ASCII case folding.
+    forbidden_collisions:
+      - authentication, host and routing, cookies, body framing, content length and type
+      - connection and hop-by-hop, forwarding, proxy, tracing, and configured API-key headers
+    classifier: One closed ASCII-case-insensitive deny set shared by startup configuration validation and source plan compilation. Prefix families are denied before exact names, and both checks run before any credential is resolved.
+    denied_prefix_families: [x-forwarded-, proxy-, sec-, x-b3-, x-envoy-, x-datadog-, x-http-method]
+    denied_names:
+      - authorization
+      - proxy-authorization
+      - www-authenticate
+      - proxy-authenticate
+      - host
+      - cookie
+      - set-cookie
+      - content-length
+      - content-type
+      - transfer-encoding
+      - expect
+      - connection
+      - keep-alive
+      - te
+      - trailer
+      - upgrade
+      - proxy-connection
+      - forwarded
+      - via
+      - x-real-ip
+      - x-client-ip
+      - x-cluster-client-ip
+      - true-client-ip
+      - cf-connecting-ip
+      - fastly-client-ip
+      - x-appengine-user-ip
+      - x-azure-clientip
+      - traceparent
+      - tracestate
+      - baggage
+      - b3
+      - x-cloud-trace-context
+      - x-request-id
+      - x-correlation-id
+      - x-amzn-trace-id
+      - x-original-url
+      - x-rewrite-url
+      - x-original-method
+    core_headers: Rust owns authentication and framing and adds Content-Type application/json for a JSON body.
+    script_authority: prohibited
+  url_security:
+    production: HTTPS only.
+    deterministic_local_mock: HTTP only when the parsed host is a numeric address in 127.0.0.0/8 or exactly ::1.
+    unauthenticated_local_source: The none authentication kind is admitted only by assuranceProfile local, only at an exact canonical HTTP numeric-loopback origin with an explicit non-zero port, and never with a TLS trust profile.
+    prohibited: [arbitrary-insecure-http, DNS-localhost-alias, userinfo, fragment, ambiguous-host-encoding, product-specific-insecure-transport-flag]
+projection:
+  owner: Core runtime.
+  stage: After bounded strict JSON parsing and before conversion to Rhai.
+  grammar:
+    root: Non-empty list of extended JSON Pointers.
+    object_segments: RFC 6901 literal segments with only ~0 and ~1 escapes.
+    array_segment: A literal wildcard '*' visits every current array element.
+    prohibited: [numeric-array-index, recursive-descent, filters, predicates, unions, script-computed-paths]
+  semantics:
+    - A new tree retains only selected leaves and the objects or arrays needed to reach them.
+    - Object keys not selected are removed; array order and length are preserved.
+    - A missing selected leaf remains absent, while a missing or mistyped intermediate container is a source-protocol failure before Rhai.
+    - Empty, invalid, duplicate, decoded-duplicate, ancestor/descendant-overlap, wildcard-overlap, or structurally incompatible paths fail startup.
+    - Wire byte and parsing bounds apply before projection; Rhai bounds apply again to the projected tree.
+  posture_rule: The declared acquisition posture describes the pre-projection wire response. Local projection never upgrades a record-transformed source claim.
+response_shape:
+  owner: Core runtime.
+  stage: After projection and before conversion to Rhai, so no response outside its declared shape reaches a script.
+  artifact: One required bundle-relative responseSchema per source, in the same closed JSON Schema subset as adapterParametersSchema and factSchema and validated by the same startup checks.
+  role_relaxation: A response schema may list fewer required members than it declares properties, because projection legitimately drops a selected leaf the record did not carry. The adapter-parameter and fact roles keep the exact required-equals-properties rule.
+  required_rule: Projection already decides which members a schema may require. A selected leaf can be absent, so requiring one turns an ordinary incomplete record into a source-protocol failure and must instead be checked by the script on the records that have to carry it. An intermediate container cannot be absent, because projection rejects the response before the shape is read, so requiring one only repeats the projection.
+  nullable_form: A response schema node may write its type as the pair [T, "null"]. A source reports an explicit null where it holds no value and projection carries that null through verbatim, so the shape has to be able to say so. This is the only union the subset admits and only in the response role; null reaches the script as the same unit marker is_missing already reads.
+  division_of_labour:
+    schema: Member presence where the shape can guarantee it, member types, array bounds and uniqueness, string bounds and formats, and enumerated or constant values.
+    script: Relations between fields the shape cannot state, such as how a reported total agrees with the records returned, page-count arithmetic, and which values must agree with the closed adapter parameters.
+  failure: A projected response outside its declared shape is a source-protocol failure, indistinguishable in public output from any other one.
+cardinality:
+  preferred: Provider count plus at most one bounded result, field-projected where supported.
+  fallback: At most two minimally projected results solely to distinguish a unique result from ambiguity.
+  outcomes: [match, no_match, ambiguous]
+  facts_only_on: match
+  prohibited:
+    - broad candidate retrieval, candidate exposure, score comparison, candidate choice, page traversal, retry, response-led request, or second evidence-data request
+    - converting provider inconsistency, returned-subject mismatch, or incomplete relationship data into no_match or an authoritative false concept
+authentication:
+  none:
+    inputs: []
+    placement: No authentication header is sent.
+    rules:
+      - The containing governed bundle must declare assuranceProfile local.
+      - The source baseUrl must be an exact canonical numeric-loopback HTTP origin with an explicit non-zero port and no userinfo, path, query, or fragment.
+      - Production and evidence-grade bundles reject this kind at startup; it is not a generic unauthenticated source profile.
+  basic:
+    inputs: [username_secret_ref, password_secret_ref]
+    placement: Authorization header.
+  static-bearer:
+    inputs: [token_secret_ref]
+    placement: Authorization header.
+  static-api-key:
+    inputs: [bundle_fixed_header_name, value_secret_ref]
+    placement: The exact allowlisted provider header.
+    rule: Header name is validated against the same collision denylist as fixed headers and cannot be Authorization.
+  oauth2-client-credentials:
+    inputs: [token_endpoint, client_id_secret_ref, client_secret_secret_ref, optional_fixed_scope, credential_placement, maximum_cache_lifetime, optional_assumed_token_lifetime]
+    rules:
+      - Token acquisition is credential bootstrap, not an evidence-data request or fact source.
+      - Endpoint, grant, scope, placement, response bounds, redirect denial, and cache maximum are fixed.
+      - Waiting for the per-source token-cache and single-flight boundary is limited by the configured source timeout.
+      - Cache lifetime is clamped to provider expiry and the configured maximum.
+      - Token request and response are unavailable to Rhai and fully redacted.
+    token_lifetime_rule: RFC 6749 section 5.1 makes expires_in recommended rather than required, so a token response carrying only access_token and token_type is accepted when the bundle configures assumedLifetimeSeconds. The assumed lifetime is a governed positive bundle value, never inferred from the token, and the cache is still clamped to the configured maximum. A provider that omits expires_in without a configured assumed lifetime, or returns a zero or non-numeric expires_in, remains a credential failure.
+    token_extension_member_rule: RFC 6749 section 5.1 permits members beyond the ones it defines, and deployed authorization servers send them, so a token response member Version 1 does not read is ignored rather than refused. Ignoring is not trusting: an unread member is never a credential, is never available to Rhai, and is scrubbed with the rest of the parsed response. Every member Version 1 does read stays closed, so a wrong type or a scope other than the configured one remains a credential failure, and duplicate members remain a parse failure, which is what prevents a second access_token arriving as an extension.
+    credential_placements: [basic-header, form-body]
+    credential_placement_rule: RFC 6749 section 2.3.1 defines Basic authentication and the request-body parameters and requires that those parameters never appear in the request URI. Version 1 offers no query-string placement, so no client identifier or secret can reach an authorization-server, proxy, or ingress URL log. The token URL, body, response, and debug output are still fully redacted.
+    token_endpoint_transport: The same HTTPS-or-explicit-numeric-loopback rule as the evidence-data origin.
+  secret_rules:
+    - The governed bundle contains only secret:file logical references. Environment-variable interpolation and literal secret values are not supported.
+    - Runtime binds one owner-controlled file-secret root and cannot change a source authentication kind or logical reference.
+    - Evidence-request processing resolves credentials only after authorization, access audit, preparation, and RequestParts validation.
+    - Missing or invalid credentials fail closed without an evidence-data request.
+tls_and_proxy:
+  backend: The evidence-data and OAuth token clients select the rustls TLS backend explicitly, so workspace-wide dependency feature unification that enables an alternate backend elsewhere cannot change which backend these clients use.
+  system_roots: Supported when runtime outboundTls.systemRoots is true.
+  private_ca: A governed logical tlsTrustProfile must have exactly one regular, read-only, captured, bounded, valid runtime CA file binding before readiness; missing, extra, symlinked, mutable, and malformed bindings fail startup.
+  verification: Fixed-origin and hostname verification remain mandatory; insecure, skip-verification, and trust-all modes do not exist.
+  proxy: Evidence-data and OAuth token clients ignore HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, and NO_PROXY; Version 1 has no application-level proxy field.
+acquisition_postures:
+  source-derived:
+    meaning: Source returns the final declared concept fact.
+    claim: Acquisition and disclosure minimization.
+  field-projected:
+    meaning: Source returns only the facts required for in-process derivation.
+    claim: Strong acquisition and disclosure minimization.
+  record-transformed:
+    meaning: A broader legacy record is transiently transformed in memory.
+    claim: Disclosure minimization only.
+failure_classes:
+  transport: [401, 403, 429, 5xx, timeout, redirect, invalid-json, duplicate-json-member, wrong-media-type, oversized-response]
+  projection: [invalid-pointer, missing-intermediate, mistyped-intermediate, projected-input-oversized]
+  response_shape: [missing-required-member, unexpected-member, wrong-member-type, out-of-bounds-value, oversized-array, duplicate-array-member]
+  semantic: [no-match, ambiguous, required-fact-missing, wrong-fact-type, unknown-controlled-code]
+  graphql_envelope_rule: Any top-level errors member, including partial data with errors, fails closed.
+persistence:
+  source_request_or_response: prohibited
+  raw_fact: prohibited
+  in_memory_lifetime: One bounded evaluation only.
+neutrality:
+  production_contract: Generic HTTP, generic authentication, bounded JSON, extended JSON Pointer projection, and Rhai preparation and extraction only.
+  named_compatibility_profiles: Test fixtures and reference documentation only.
+fixtures:
+  postures: ../fixtures/conformance/acquisition-postures.yaml
+  oauth_credential_redaction: ../fixtures/conformance/oauth-credential-redaction.yaml
+  shapes: ../fixtures/source-shapes/
+  required_shape_outcomes: [zero, one, multiple, missing-fact, error-envelope]
diff --git a/products/evidence/contracts/supported-value-forms.yaml b/products/evidence/contracts/supported-value-forms.yaml
new file mode 100644
index 000000000..495d555ee
--- /dev/null
+++ b/products/evidence/contracts/supported-value-forms.yaml
@@ -0,0 +1,64 @@
+contract: registry.evidence.supported-value-forms/v1
+status: frozen
+common:
+  maximum_concepts_per_requirement: 16
+  concept_identifiers: exact set, each present once unless a declared optional concept is absent
+  undeclared_metadata: prohibited
+  total_serialized_value_bytes: 65536
+forms:
+  boolean:
+    wire: JSON boolean
+  controlled-code:
+    wire: JSON string
+    declaration_requires: [codelist, codelistVersion, maximumBytes]
+    rule: Exact code membership; labels and source codes are not disclosed.
+  controlled-category:
+    wire: JSON string
+    declaration_requires: [categoryScheme, schemeVersion, codelist, maximumBytes]
+    rule: Exact reviewed category membership.
+  bounded-integer:
+    wire: JSON integer
+    declaration_requires: [minimum, maximum]
+  bounded-decimal:
+    wire: JSON string containing canonical decimal text
+    declaration_requires: [minimum, maximum, maximumScale]
+    rhai_abi: A core-owned Decimal returned by decimal("canonical-text") or parse_decimal("canonical-text"); Rhai floating-point values are rejected.
+    canonical_text: '^-?(0|[1-9][0-9]*)(\.[0-9]*[1-9])?$ with zero represented only as 0; no exponent, plus sign, leading zero, trailing fractional zero, NaN, infinity, or negative zero'
+    global_bounds: {maximumPrecision: 28, maximumScale: 9}
+    rule: Rust validates and compares coefficient plus scale exactly, then emits the canonical text as a JSON string; JSON numeric conversion and f32/f64 are prohibited.
+  date-bucket:
+    wire: {form: date-bucket, scheme: URI, bucket: code}
+    declaration_requires: [bucketScheme, schemeVersion]
+    rule: The scheme URI and version resolve to exactly one reviewed codelist artifact in the immutable bundle; the underlying date is not disclosed.
+  time-bucket:
+    wire: {form: time-bucket, scheme: URI, bucket: code}
+    declaration_requires: [bucketScheme, schemeVersion]
+    rule: The scheme URI and version resolve to exactly one reviewed codelist artifact in the immutable bundle; the underlying instant or duration is not disclosed.
+  audience-scoped-entity-reference:
+    wire: {form: audience-scoped-entity-reference, reference: opaque-urn}
+    declaration_requires: [maximumBytes]
+    rhai_abi: Rhai returns entity_reference_seed("protected-seed"), never a public reference.
+    rule: Rust HMAC-projects the seed with the concept id, audience, binding-key version, and binding key; the seed never enters evidence or diagnostics.
+  controlled-code-list:
+    wire: array of controlled-code strings
+    declaration_requires: [codelist, codelistVersion, minimumItems, maximumItems, unique]
+  entity-reference-list:
+    wire: array of audience-scoped-entity-reference objects
+    declaration_requires: [minimumItems, maximumItems, unique]
+    rhai_abi: Rhai returns a bounded list of entity_reference_seed values; Rust projects each seed independently and preserves declared order.
+  reviewed-structured-value:
+    wire: {form: reviewed-structured-value, schema: URI, fields: closed-object}
+    declaration_requires: [schema, maximumSerializedBytes]
+    rule: The schema URI resolves to exactly one closed JSON Schema artifact in the immutable bundle; that schema closes every property and nested value and prohibits arbitrary JSON.
+    sd_jwt_vc: An optional sdJwtVc declaration gives the value a non-reserved public claim name and makes each direct field independently disclosable. Nested field values remain atomic. Validation of the complete value precedes serialization.
+validation_order:
+  - exact concept identifier set and duplicate rejection
+  - exact declared form
+  - scalar and lexical type
+  - numeric precision and range
+  - codelist or scheme version and membership
+  - collection cardinality and uniqueness
+  - structured schema and additional-property rejection
+  - per-value and total serialized size
+  - core-owned evidence projection
+fixtures: ../fixtures/conformance/supported-values.yaml
diff --git a/products/evidence/contracts/verification-policy.schema.yaml b/products/evidence/contracts/verification-policy.schema.yaml
new file mode 100644
index 000000000..9ae4df18d
--- /dev/null
+++ b/products/evidence/contracts/verification-policy.schema.yaml
@@ -0,0 +1,124 @@
+$schema: https://json-schema.org/draft/2020-12/schema
+$id: https://registrystack.org/schemas/evidence/verification-policy-v1.json
+title: Evidence relying-procedure verification policy Version 1
+type: object
+additionalProperties: false
+required:
+  - expectedAssuranceProfile
+  - issuedBy
+  - providedBy
+  - requirement
+  - evidenceType
+  - purpose
+  - audience
+  - configurationRevision
+  - requestNonce
+  - expectedSubjects
+  - expectedOutputs
+  - maximumAssertionLifetimeSeconds
+properties:
+  expectedAssuranceProfile: {enum: [local, production, evidence-grade]}
+  issuedBy: {type: string, format: uri, maxLength: 512}
+  providedBy: {type: string, format: uri, maxLength: 512}
+  requirement: {type: string, format: uri, maxLength: 512}
+  evidenceType: {type: string, format: uri, maxLength: 512}
+  purpose: {type: string, pattern: '^[a-z][a-z0-9._:-]{0,127}$'}
+  audience: {type: string, format: uri, maxLength: 512}
+  configurationRevision: {type: string, pattern: '^sha256:[a-f0-9]{64}$'}
+  requestNonce:
+    type: string
+    pattern: '^[A-Za-z0-9_-]{43}$'
+    description: The exact nonce from the independently retained original request.
+  expectedSubjects:
+    type: array
+    minItems: 1
+    maxItems: 8
+    uniqueItems: true
+    description: Unordered set of unique role-bound opaque bindings. Subject order alone is never semantic.
+    items: {$ref: '#/$defs/expected-subject'}
+  expectedOutputs:
+    type: array
+    minItems: 1
+    maxItems: 16
+    uniqueItems: true
+    description: Expected concept identifiers, value forms, and cardinalities, one per disclosed Supported Value.
+    items: {$ref: '#/$defs/expected-output'}
+  maximumAssertionLifetimeSeconds:
+    type: integer
+    minimum: 1
+    maximum: 31536000
+    description: Longest acceptable validUntil minus issuedAt interval.
+  clockSkewSeconds:
+    type: integer
+    minimum: 0
+    maximum: 300
+    default: 0
+    description: The only optional field. Omitting it means zero tolerance.
+$defs:
+  expected-subject:
+    type: object
+    additionalProperties: false
+    required: [role, binding]
+    properties:
+      role: {type: string, pattern: '^[a-z][a-z0-9._-]{0,63}$'}
+      binding: {type: string, pattern: '^urn:evidence:subject:v[1-9][0-9]*_[A-Za-z0-9_-]{43}$'}
+  expected-output:
+    type: object
+    additionalProperties: false
+    required: [concept, form]
+    properties:
+      concept: {type: string, format: uri, maxLength: 512}
+      form: {$ref: '#/$defs/expected-form'}
+  expected-form:
+    oneOf:
+      - enum: [boolean, integer, string, date-bucket, time-bucket, entity-reference, structured]
+      - type: object
+        additionalProperties: false
+        required: [list]
+        properties:
+          list:
+            type: object
+            additionalProperties: false
+            required: [minimumItems, maximumItems]
+            properties:
+              minimumItems: {type: integer, minimum: 1, maximum: 64}
+              maximumItems: {type: integer, minimum: 1, maximum: 64}
+ownership:
+  document: relying party
+  producer: the relying procedure that retained the original request and accepted the original transaction
+  consumer: offline re-verification by the `evidence verify` operator command
+command:
+  surface: evidence verify (--jws <file> | --sd-jwt-vc <file>) --jwks <file> --policy <file> [--at <rfc3339-utc>]
+  jws: one stored flattened JWS JSON response file
+  sd-jwt-vc: one stored SD-JWT VC response file, in the issued compact serialization
+  format_selection: exactly one stored response file is named, and naming it states its format; the command never infers a format from a file's contents, so a stored response is never re-verified under the other format's rules
+  policy_scope: one policy document governs both formats, because the same Evidence payload is verified whichever serialization carried it
+  jwks: the pinned trusted key set, which is the complete trust set for the run
+  policy: one document accepted by this schema
+  at: strict RFC 3339 at zero offset; system time when omitted
+  network: prohibited; no socket is opened, no metadata is resolved, and no key is fetched
+  input_bound: every input file is refused above 1 MiB before it is read
+output:
+  lines:
+    - 'verified-at: the chosen verification instant'
+    - 'authentic: yes or no, printed once verification ran'
+    - 'currently-valid: yes or no, printed only for an authentic response'
+  inspection: on full success the verified Evidence JSON is also printed, for the operator who already holds the stored response
+  failure: only the closed class is reported, on standard error, with no field-level detail
+  classes: [malformed, protected-header, key, signature, payload, policy, time, disclosure]
+  disclosure_class: reported only for a stored SD-JWT VC whose disclosures do not reconstruct the payload the signature covers
+  exit_codes:
+    0: authentic and currently valid
+    3: authentic but not currently valid
+    1: every other outcome, including a policy mismatch, an unusable input document, and an unreadable file
+$comment: >-
+  Every expectation in this document must come from independent trusted state,
+  such as the independently retained original request and an accepted original
+  transaction. Copying values out of the JWS under verification proves nothing,
+  and a policy that omitted an expectation would silently skip a comparison, so
+  the document is closed and every field except clockSkewSeconds is required. A
+  failed comparison, including the expected nonce, the expected role-bound
+  subject set, and the expected output contract, reports the one generic policy
+  class, so re-verification is never an oracle for which hidden comparison
+  failed. Authenticity and current usability are separate answers: an expired
+  assertion stays cryptographically authentic without being current evidence.
diff --git a/products/evidence/fixtures/acceptance/adult-status/adapters/source-a-prepare.rhai b/products/evidence/fixtures/acceptance/adult-status/adapters/source-a-prepare.rhai
new file mode 100644
index 000000000..691d7c164
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/adult-status/adapters/source-a-prepare.rhai
@@ -0,0 +1,15 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"];
+    #{
+        query: [],
+        body: #{
+            lookup: #{
+                given_name: subject["values"]["given_name"],
+                family_name: subject["values"]["family_name"],
+                birth_date: subject["values"]["birth_date"]
+            },
+            fields: parameters["requestedFields"],
+            limit: parameters["resultLimit"]
+        }
+    }
+}
diff --git a/products/evidence/fixtures/acceptance/adult-status/adapters/source-a.rhai b/products/evidence/fixtures/acceptance/adult-status/adapters/source-a.rhai
new file mode 100644
index 000000000..0901f981e
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/adult-status/adapters/source-a.rhai
@@ -0,0 +1,15 @@
+fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    if total == 0 {
+        if len(source_response) != 1 { throw("source_protocol_error"); }
+        return #{outcome: "no_match"};
+    }
+    if total > 1 {
+        return #{outcome: "ambiguous"};
+    }
+    let date_of_birth = get_path(source_response, "/date_of_birth");
+    if is_missing(date_of_birth) {
+        return #{outcome: "match", facts: #{}};
+    }
+    #{outcome: "match", facts: #{date_of_birth: date_of_birth}}
+}
diff --git a/products/evidence/fixtures/acceptance/adult-status/derivations/adult-status.rhai b/products/evidence/fixtures/acceptance/adult-status/derivations/adult-status.rhai
new file mode 100644
index 000000000..8671f9d2a
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/adult-status/derivations/adult-status.rhai
@@ -0,0 +1,11 @@
+fn derive(facts, selectors, evaluation_context) {
+    let date_of_birth = parse_date(required(facts.date_of_birth, "required_fact_missing"));
+    let threshold = add_calendar_years(
+        date_of_birth,
+        evaluation_context.parameters.minimum_age_years
+    );
+    [#{
+        concept_id: "urn:example:fixture:concept:adult-status",
+        value: compare_dates(evaluation_context.legal_local_date, threshold) >= 0
+    }]
+}
diff --git a/products/evidence/fixtures/acceptance/adult-status/evidence.yaml b/products/evidence/fixtures/acceptance/adult-status/evidence.yaml
new file mode 100644
index 000000000..24bd675fc
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/adult-status/evidence.yaml
@@ -0,0 +1,88 @@
+version: 1
+assuranceProfile: evidence-grade
+service: {providerId: urn:example:fixture:provider:evidence, trustDomain: urn:example:fixture:trust-domain:acceptance}
+issuer: {id: urn:example:fixture:issuer:authority}
+authentication:
+  kind: oidc-access-token
+  issuer: https://identity.invalid
+  audiences: [evidence-fixture]
+  tokenTypes: [at+jwt]
+  algorithms: [EdDSA]
+  jwksUri: https://identity.invalid/.well-known/jwks.json
+  principalClaim: sub
+  requesterTagsClaim: evidence_tags
+  evidenceAudienceClaim: evidence_audience
+  grantIdClaim: evidence_grant_id
+  grantAuthorityClaim: evidence_authority
+audit: {format: keyed-jsonl, hashSecretRef: secret:file/audit-hash-key, hashKeyVersion: 1, failClosed: true}
+subjectBinding: {secretRef: secret:file/subject-binding-key, keyVersion: 1}
+rateLimits: {requestsPerPrincipalPerMinute: 60, burstPerPrincipal: 10, failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 10}
+signing:
+  format: flattened-jws-json
+  algorithm: EdDSA
+  activeKeyId: fixture-key-2026-01
+  activeKeyRef: secret:file/signing-key
+  retiredPublicJwkFiles: []
+  jwksPath: /.well-known/evidence/jwks.json
+  maximumAssertionValiditySeconds: 86400
+  verifierClockSkewSeconds: 30
+responseFormats: [signed-jws]
+
+selectorProfiles:
+  person-demographics-v1:
+    maximumAggregateBytes: 420
+    fields:
+      given_name: {type: string, minimumBytes: 1, maximumBytes: 200}
+      family_name: {type: string, minimumBytes: 1, maximumBytes: 200}
+      birth_date: {type: date}
+sources:
+  source-a:
+    transport: http-json
+    baseUrl: https://source.invalid
+    posture: field-projected
+    authentication: {kind: static-bearer, tokenRef: secret:file/source-a-token}
+    request:
+      method: POST
+      path: /v1/facts
+      fixedHeaders: [{name: Accept, value: application/json}]
+      selectorInputs:
+        - role: subject
+          alternatives:
+            - {profile: person-demographics-v1, fields: [given_name, family_name, birth_date]}
+      prepareScript: adapters/source-a-prepare.rhai
+      adapterParameters: {requestedFields: [date_of_birth], resultLimit: 2}
+      adapterParametersSchema: schemas/adapter-parameters.schema.yaml
+      preparationLimits: {query: forbidden, jsonBody: required, maximumJsonDepth: 8, maximumCollectionItems: 16, maximumStringBytes: 256, maximumNormalizedBytes: 4096}
+      projection: [/total, /date_of_birth]
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 8
+    responseSchema: schemas/response.schema.yaml
+    extractScript: adapters/source-a.rhai
+    factSchema: schemas/facts.schema.yaml
+authorityProfiles:
+  statutory-caseworker-v1:
+    kind: statutory
+    requesterTags: [fixture-agency]
+    grants:
+      - requirement: urn:example:fixture:requirement:adult-status:v1
+        purpose: fixture-eligibility
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects: [{role: subject, selectorProfile: person-demographics-v1, valueOrigin: request}]
+requirements:
+  - id: urn:example:fixture:requirement:adult-status:v1
+    kind: criterion
+    source: source-a
+    purposes: [fixture-eligibility]
+    subjectRoles: [{role: subject, cardinality: one, selectorProfiles: [person-demographics-v1]}]
+    referenceFrameworks: [urn:example:fixture:framework:adult-status:v1]
+    evidenceType: urn:example:fixture:evidence-type:adult-status:v1
+    observationTimezone: Asia/Bangkok
+    validitySeconds: 86400
+    derivation: {script: derivations/adult-status.rhai, parameters: {minimum_age_years: 18}}
+    concepts: [{id: urn:example:fixture:concept:adult-status, form: boolean, required: true, constraints: {}}]
+    fixtures: fixtures/cases.yaml
+    disclosureGuard: {families: [urn:example:fixture:disclosure-family:adult-status]}
+    existenceDisclosure: collapse-unresolved
diff --git a/products/evidence/fixtures/acceptance/adult-status/fixtures/cases.yaml b/products/evidence/fixtures/acceptance/adult-status/fixtures/cases.yaml
new file mode 100644
index 000000000..c91881abd
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/adult-status/fixtures/cases.yaml
@@ -0,0 +1,33 @@
+fixture: registry.evidence.acceptance.adult-status/v1
+coequal_acceptance_definition: true
+synthetic_only: true
+common:
+  observed_at: '2026-08-02T00:00:00Z'
+  legal_local_date: '2026-08-02'
+  selector: {given_name: Amina, family_name: Diallo, birth_date: '2000-01-01'}
+  selectors:
+    subject: {profile: person-demographics-v1, values: {given_name: Amina, family_name: Diallo, birth_date: '2000-01-01'}}
+  expectedRequestParts:
+    query: []
+    body: {lookup: {given_name: Amina, family_name: Diallo, birth_date: '2000-01-01'}, fields: [date_of_birth], limit: 2}
+  expectedTransport:
+    path: /v1/facts
+    fixedHeaders: [{name: Accept, value: application/json}]
+cases:
+  - {id: positive, source: {total: 1, date_of_birth: '2000-01-01'}, expected_value: true, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: negative-false-is-success, source: {total: 1, date_of_birth: '2010-01-01'}, expected_value: false, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: boundary-before, legal_local_date: '2026-08-01', source: {total: 1, date_of_birth: '2008-08-02'}, expected_value: false, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: boundary-on, legal_local_date: '2026-08-02', source: {total: 1, date_of_birth: '2008-08-02'}, expected_value: true, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: boundary-after, legal_local_date: '2026-08-03', source: {total: 1, date_of_birth: '2008-08-02'}, expected_value: true, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: boundary-leap-day, legal_local_date: '2026-02-28', source: {total: 1, date_of_birth: '2008-02-29'}, expected_value: true, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: missing-fact, source: {total: 1}, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: missing-record, source: {total: 0}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: no-match, source: {total: 0}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: ambiguous, source: {total: 2}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: source-failure, source_failure: timeout, expected_public_problem: dependency_unavailable, signed_success: false}
+  - {id: negative-wrong-derived-type, injected_derivation: [{concept_id: urn:example:fixture:concept:adult-status, value: 'true'}], expected: output-gate-rejection}
+  - {id: anti-reconstruction, companion_bundle: threshold-ladder, expected: bundle-rejection}
+privacy_expectation:
+  evidence_contains: [urn:example:fixture:concept:adult-status]
+  evidence_excludes: [date_of_birth, given_name, family_name, selector-profile]
+  diagnostics_exclude: [Amina, Diallo, '2000-01-01', fixture-source-canary]
diff --git a/products/evidence/fixtures/acceptance/adult-status/schemas/adapter-parameters.schema.yaml b/products/evidence/fixtures/acceptance/adult-status/schemas/adapter-parameters.schema.yaml
new file mode 100644
index 000000000..60bf5e3d2
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/adult-status/schemas/adapter-parameters.schema.yaml
@@ -0,0 +1,7 @@
+type: object
+additionalProperties: false
+required: [requestedFields, resultLimit]
+properties:
+  requestedFields:
+    const: [date_of_birth]
+  resultLimit: {const: 2}
diff --git a/products/evidence/fixtures/acceptance/adult-status/schemas/facts.schema.yaml b/products/evidence/fixtures/acceptance/adult-status/schemas/facts.schema.yaml
new file mode 100644
index 000000000..27d2c2f0f
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/adult-status/schemas/facts.schema.yaml
@@ -0,0 +1,5 @@
+type: object
+additionalProperties: false
+required: [date_of_birth]
+properties:
+  date_of_birth: {type: string, format: date}
diff --git a/products/evidence/fixtures/acceptance/adult-status/schemas/response.schema.yaml b/products/evidence/fixtures/acceptance/adult-status/schemas/response.schema.yaml
new file mode 100644
index 000000000..a8eb01a7f
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/adult-status/schemas/response.schema.yaml
@@ -0,0 +1,6 @@
+type: object
+additionalProperties: false
+required: [total]
+properties:
+  total: {type: integer, minimum: 0, maximum: 1000000}
+  date_of_birth: {type: string, format: date}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/adapters/adult-status-prepare.rhai b/products/evidence/fixtures/acceptance/all-definitions/adapters/adult-status-prepare.rhai
new file mode 100644
index 000000000..37650eab5
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/adapters/adult-status-prepare.rhai
@@ -0,0 +1,4 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"];
+    #{query: [], body: #{lookup: #{given_name: subject["values"]["given_name"], family_name: subject["values"]["family_name"], birth_date: subject["values"]["birth_date"]}, fields: parameters["requestedFields"], limit: parameters["resultLimit"]}}
+}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/adapters/adult-status-source.rhai b/products/evidence/fixtures/acceptance/all-definitions/adapters/adult-status-source.rhai
new file mode 100644
index 000000000..c5251e15e
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/adapters/adult-status-source.rhai
@@ -0,0 +1,11 @@
+fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    if total == 0 {
+        if len(source_response) != 1 { throw("source_protocol_error"); }
+        return #{outcome: "no_match"};
+    }
+    if total > 1 { return #{outcome: "ambiguous"}; }
+    let date_of_birth = get_path(source_response, "/date_of_birth");
+    if is_missing(date_of_birth) { return #{outcome: "match", facts: #{}}; }
+    #{outcome: "match", facts: #{date_of_birth: date_of_birth}}
+}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/adapters/legal-parent-relationship-prepare.rhai b/products/evidence/fixtures/acceptance/all-definitions/adapters/legal-parent-relationship-prepare.rhai
new file mode 100644
index 000000000..989838de0
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/adapters/legal-parent-relationship-prepare.rhai
@@ -0,0 +1,4 @@
+fn prepare(selectors, parameters) {
+    let child = selectors["child"];
+    #{query: [], body: #{lookup: #{record_reference: child["values"]["record_reference"]}, fields: parameters["requestedFields"], limit: parameters["resultLimit"]}}
+}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/adapters/legal-parent-relationship-source.rhai b/products/evidence/fixtures/acceptance/all-definitions/adapters/legal-parent-relationship-source.rhai
new file mode 100644
index 000000000..9f789bd10
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/adapters/legal-parent-relationship-source.rhai
@@ -0,0 +1,21 @@
+fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    let records = source_response["records"];
+    if records.len > parameters["resultLimit"] { throw("source_protocol_error"); }
+    if total == 0 {
+        if records.len != 0 { throw("source_protocol_error"); }
+        return #{outcome: "no_match"};
+    }
+    if total > 1 {
+        if records.len < 2 { throw("source_protocol_error"); }
+        return #{outcome: "ambiguous"};
+    }
+    if records.len != 1 { throw("source_protocol_error"); }
+    let record = records[0];
+    // The shape cannot require these of every record, because the ambiguous
+    // page is decided before any record is read. A single matched record that
+    // omits either one is a source this adapter does not understand.
+    if is_missing(record["returned_child_reference"]) || is_missing(record["parent_references"]) { throw("source_protocol_error"); }
+    if record["reference_namespace"] != parameters["referenceNamespace"] || record["relationship_set_contract"] != parameters["relationshipSetContract"] || record["relationship_set_complete"] != parameters["relationshipSetComplete"] { throw("source_protocol_error"); }
+    #{outcome: "match", facts: #{returned_child_reference: record["returned_child_reference"], parent_references: record["parent_references"], reference_namespace: record["reference_namespace"], relationship_set_contract: record["relationship_set_contract"], relationship_set_complete: record["relationship_set_complete"]}}
+}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/adapters/professional-licence-prepare.rhai b/products/evidence/fixtures/acceptance/all-definitions/adapters/professional-licence-prepare.rhai
new file mode 100644
index 000000000..ca41d38fb
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/adapters/professional-licence-prepare.rhai
@@ -0,0 +1,4 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"];
+    #{query: [#{name: "licence_reference", value: subject["values"]["licence_reference"]}, #{name: "registry_region", value: subject["values"]["registry_region"]}, #{name: "fields", value: parameters["requestedFields"]}, #{name: "limit", value: parameters["resultLimit"]}], body: ()}
+}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/adapters/professional-licence-source.rhai b/products/evidence/fixtures/acceptance/all-definitions/adapters/professional-licence-source.rhai
new file mode 100644
index 000000000..fddcae016
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/adapters/professional-licence-source.rhai
@@ -0,0 +1,22 @@
+fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    let records = source_response["records"];
+    if records.len > parse_integer(parameters["resultLimit"]) { throw("source_protocol_error"); }
+    if total == 0 {
+        if records.len != 0 { throw("source_protocol_error"); }
+        return #{outcome: "no_match"};
+    }
+    if total > 1 {
+        if records.len < 2 { throw("source_protocol_error"); }
+        return #{outcome: "ambiguous"};
+    }
+    if records.len != 1 { throw("source_protocol_error"); }
+    let facts = #{};
+    let licence_state = get_path(source_response, "/records/0/licence_state");
+    if !is_missing(licence_state) { facts["licence_state"] = licence_state; }
+    let valid_from = get_path(source_response, "/records/0/valid_from");
+    if !is_missing(valid_from) { facts["valid_from"] = valid_from; }
+    let valid_until = get_path(source_response, "/records/0/valid_until");
+    if !is_missing(valid_until) { facts["valid_until"] = valid_until; }
+    #{outcome: "match", facts: facts}
+}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/adapters/residence-region-prepare.rhai b/products/evidence/fixtures/acceptance/all-definitions/adapters/residence-region-prepare.rhai
new file mode 100644
index 000000000..6b196fdee
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/adapters/residence-region-prepare.rhai
@@ -0,0 +1,4 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"];
+    #{query: [], body: #{lookup: #{record_reference: subject["values"]["record_reference"]}, fields: parameters["requestedFields"], limit: parameters["resultLimit"]}}
+}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/adapters/residence-region-source.rhai b/products/evidence/fixtures/acceptance/all-definitions/adapters/residence-region-source.rhai
new file mode 100644
index 000000000..eda80f7e1
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/adapters/residence-region-source.rhai
@@ -0,0 +1,11 @@
+fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    if total == 0 {
+        if len(source_response) != 1 { throw("source_protocol_error"); }
+        return #{outcome: "no_match"};
+    }
+    if total > 1 { return #{outcome: "ambiguous"}; }
+    let official_residence_code = get_path(source_response, "/official_residence_code");
+    if is_missing(official_residence_code) { return #{outcome: "match", facts: #{}}; }
+    #{outcome: "match", facts: #{official_residence_code: official_residence_code}}
+}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/codelists/professional-expiry-categories.yaml b/products/evidence/fixtures/acceptance/all-definitions/codelists/professional-expiry-categories.yaml
new file mode 100644
index 000000000..f1306ace1
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/codelists/professional-expiry-categories.yaml
@@ -0,0 +1,3 @@
+id: urn:example:fixture:scheme:licence-expiry
+version: '1'
+codes: [expired, within-30-days, within-90-days, later]
diff --git a/products/evidence/fixtures/acceptance/all-definitions/codelists/professional-registry-regions.yaml b/products/evidence/fixtures/acceptance/all-definitions/codelists/professional-registry-regions.yaml
new file mode 100644
index 000000000..8f6c747d4
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/codelists/professional-registry-regions.yaml
@@ -0,0 +1,3 @@
+id: urn:example:fixture:codelist:registry-regions
+version: '1'
+codes: [RR-A, RR-B]
diff --git a/products/evidence/fixtures/acceptance/all-definitions/codelists/residence-region-map.yaml b/products/evidence/fixtures/acceptance/all-definitions/codelists/residence-region-map.yaml
new file mode 100644
index 000000000..61e8637f2
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/codelists/residence-region-map.yaml
@@ -0,0 +1,7 @@
+id: urn:example:fixture:codelist:region-map
+version: '2026-01'
+entries:
+  R-101: REGION-NORTH
+  R-102: REGION-NORTH
+  R-201: REGION-SOUTH
+allowed_outputs: [REGION-NORTH, REGION-SOUTH]
diff --git a/products/evidence/fixtures/acceptance/all-definitions/derivations/adult-status.rhai b/products/evidence/fixtures/acceptance/all-definitions/derivations/adult-status.rhai
new file mode 100644
index 000000000..8671f9d2a
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/derivations/adult-status.rhai
@@ -0,0 +1,11 @@
+fn derive(facts, selectors, evaluation_context) {
+    let date_of_birth = parse_date(required(facts.date_of_birth, "required_fact_missing"));
+    let threshold = add_calendar_years(
+        date_of_birth,
+        evaluation_context.parameters.minimum_age_years
+    );
+    [#{
+        concept_id: "urn:example:fixture:concept:adult-status",
+        value: compare_dates(evaluation_context.legal_local_date, threshold) >= 0
+    }]
+}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/derivations/legal-parent-relationship.rhai b/products/evidence/fixtures/acceptance/all-definitions/derivations/legal-parent-relationship.rhai
new file mode 100644
index 000000000..ccaa36156
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/derivations/legal-parent-relationship.rhai
@@ -0,0 +1,5 @@
+fn derive(facts, selectors, evaluation_context) {
+    let parameters = evaluation_context["parameters"];
+    if parameters["matching_policy"] != "exact-opaque-reference-membership-v1" || parameters["legal_authority_attestation"] != "urn:example:fixture:governance:legal-parent-register:v1" || facts["returned_child_reference"] != selectors["child"]["values"]["record_reference"] || facts["relationship_set_complete"] != true || facts["reference_namespace"] != parameters["candidate_reference_namespace"] || facts["relationship_set_contract"] != parameters["relationship_set_contract"] { throw("derivation_input_error"); }
+    [#{concept_id: "urn:example:fixture:concept:legal-parent-relationship-confirmed", value: list_contains(facts["parent_references"], selectors["candidate-parent"]["values"]["person_reference"])}]
+}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/derivations/professional-licence.rhai b/products/evidence/fixtures/acceptance/all-definitions/derivations/professional-licence.rhai
new file mode 100644
index 000000000..486f73a7e
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/derivations/professional-licence.rhai
@@ -0,0 +1,25 @@
+fn derive(facts, selectors, evaluation_context) {
+    let starts = parse_date(required(facts.valid_from, "required_fact_missing"));
+    let ends = parse_date(required(facts.valid_until, "required_fact_missing"));
+    let state = required(facts.licence_state, "required_fact_missing");
+    let current = evaluation_context.legal_local_date;
+    let active =
+        state == evaluation_context.parameters.active_state &&
+        compare_dates(current, starts) >= 0 &&
+        compare_dates(current, ends) <= 0;
+    let remaining_days = integer_to_decimal(days_between(current, ends));
+    let category = bucket_number(
+        remaining_days,
+        evaluation_context.parameters.expiry_buckets
+    );
+    [
+        #{
+            concept_id: "urn:example:fixture:concept:licence-active",
+            value: active
+        },
+        #{
+            concept_id: "urn:example:fixture:concept:licence-expiry-category",
+            value: category
+        }
+    ]
+}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/derivations/residence-region.rhai b/products/evidence/fixtures/acceptance/all-definitions/derivations/residence-region.rhai
new file mode 100644
index 000000000..939953644
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/derivations/residence-region.rhai
@@ -0,0 +1,10 @@
+fn derive(facts, selectors, evaluation_context) {
+    let mapped = codelist_lookup(
+        evaluation_context.codelists["residence-region-map"],
+        required(facts.official_residence_code, "required_fact_missing")
+    );
+    [#{
+        concept_id: "urn:example:fixture:concept:residence-region",
+        value: required(mapped, "unknown_controlled_code")
+    }]
+}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/evidence.yaml b/products/evidence/fixtures/acceptance/all-definitions/evidence.yaml
new file mode 100644
index 000000000..ae6b21244
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/evidence.yaml
@@ -0,0 +1,301 @@
+version: 1
+assuranceProfile: evidence-grade
+service:
+  providerId: urn:example:fixture:provider:evidence
+  trustDomain: urn:example:fixture:trust-domain:acceptance
+issuer: {id: urn:example:fixture:issuer:authority}
+authentication:
+  kind: oidc-access-token
+  issuer: https://identity.invalid
+  audiences: [evidence-fixture]
+  tokenTypes: [at+jwt]
+  algorithms: [EdDSA]
+  jwksUri: https://identity.invalid/.well-known/jwks.json
+  principalClaim: sub
+  requesterTagsClaim: evidence_tags
+  evidenceAudienceClaim: evidence_audience
+  grantIdClaim: evidence_grant_id
+  grantAuthorityClaim: evidence_authority
+audit: {format: keyed-jsonl, hashSecretRef: secret:file/audit-hash-key, hashKeyVersion: 1, failClosed: true}
+subjectBinding: {secretRef: secret:file/subject-binding-key, keyVersion: 1}
+rateLimits: {requestsPerPrincipalPerMinute: 60, burstPerPrincipal: 10, failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 10}
+
+signing:
+  format: flattened-jws-json
+  algorithm: EdDSA
+  activeKeyId: fixture-key-2026-01
+  activeKeyRef: secret:file/signing-key
+  retiredPublicJwkFiles: []
+  jwksPath: /.well-known/evidence/jwks.json
+  maximumAssertionValiditySeconds: 86400
+  verifierClockSkewSeconds: 30
+
+# The acceptance deployment deliberately enables the governed unsigned format
+# so every coequal definition proves both response paths. Production reference
+# bundles list only signed-jws.
+responseFormats: [signed-jws, unsigned-json]
+
+selectorProfiles:
+  person-demographics-v1:
+    maximumAggregateBytes: 420
+    fields:
+      given_name: {type: string, minimumBytes: 1, maximumBytes: 200}
+      family_name: {type: string, minimumBytes: 1, maximumBytes: 200}
+      birth_date: {type: date}
+  residence-record-v1:
+    maximumAggregateBytes: 96
+    fields:
+      record_reference: {type: string, minimumBytes: 1, maximumBytes: 96}
+  licence-register-v1:
+    maximumAggregateBytes: 128
+    fields:
+      licence_reference: {type: string, minimumBytes: 1, maximumBytes: 96}
+      registry_region: {type: controlled-code, codelist: codelists/professional-registry-regions.yaml, codelistVersion: '1', maximumBytes: 16}
+  civil-record-reference-v1:
+    maximumAggregateBytes: 96
+    fields:
+      record_reference: {type: string, minimumBytes: 1, maximumBytes: 96}
+  person-reference-v1:
+    maximumAggregateBytes: 128
+    fields:
+      person_reference: {type: string, minimumBytes: 1, maximumBytes: 128}
+
+sources:
+  source-a:
+    transport: http-json
+    baseUrl: https://source.invalid
+    posture: field-projected
+    authentication: {kind: static-bearer, tokenRef: secret:file/source-a-token}
+    request:
+      method: POST
+      path: /v1/facts
+      fixedHeaders: [{name: Accept, value: application/json}]
+      selectorInputs:
+        - role: subject
+          alternatives: [{profile: person-demographics-v1, fields: [given_name, family_name, birth_date]}]
+      prepareScript: adapters/adult-status-prepare.rhai
+      adapterParameters: {requestedFields: [date_of_birth], resultLimit: 2}
+      adapterParametersSchema: schemas/adult-status-adapter-parameters.schema.yaml
+      preparationLimits: {query: forbidden, jsonBody: required, maximumJsonDepth: 8, maximumCollectionItems: 16, maximumStringBytes: 256, maximumNormalizedBytes: 4096}
+      projection: [/total, /date_of_birth]
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 8
+    responseSchema: schemas/adult-status-response.schema.yaml
+    extractScript: adapters/adult-status-source.rhai
+    factSchema: schemas/adult-status-facts.schema.yaml
+  source-b:
+    transport: http-json
+    baseUrl: https://source.invalid
+    posture: field-projected
+    authentication: {kind: static-bearer, tokenRef: secret:file/source-b-token}
+    request:
+      method: POST
+      path: /v1/facts
+      fixedHeaders: [{name: Accept, value: application/json}]
+      selectorInputs:
+        - role: subject
+          alternatives: [{profile: residence-record-v1, fields: [record_reference]}]
+      prepareScript: adapters/residence-region-prepare.rhai
+      adapterParameters: {requestedFields: [official_residence_code], resultLimit: 2}
+      adapterParametersSchema: schemas/residence-region-adapter-parameters.schema.yaml
+      preparationLimits: {query: forbidden, jsonBody: required, maximumJsonDepth: 8, maximumCollectionItems: 16, maximumStringBytes: 256, maximumNormalizedBytes: 4096}
+      projection: [/total, /official_residence_code]
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 8
+    responseSchema: schemas/residence-region-response.schema.yaml
+    extractScript: adapters/residence-region-source.rhai
+    factSchema: schemas/residence-region-facts.schema.yaml
+  source-c:
+    transport: http-json
+    baseUrl: https://source.invalid
+    posture: record-transformed
+    authentication:
+      kind: basic
+      usernameRef: secret:file/source-c-username
+      passwordRef: secret:file/source-c-password
+    request:
+      method: GET
+      path: /v1/records
+      fixedHeaders: [{name: Accept, value: application/json}]
+      selectorInputs:
+        - role: subject
+          alternatives: [{profile: licence-register-v1, fields: [licence_reference, registry_region]}]
+      prepareScript: adapters/professional-licence-prepare.rhai
+      adapterParameters: {requestedFields: "licence_state,valid_from,valid_until", resultLimit: "2"}
+      adapterParametersSchema: schemas/professional-licence-adapter-parameters.schema.yaml
+      preparationLimits: {query: required, jsonBody: forbidden, maximumQueryPairs: 4, maximumQueryNameBytes: 64, maximumQueryValueBytes: 256, maximumNormalizedBytes: 4096}
+      projection: [/total, /records/*/licence_state, /records/*/valid_from, /records/*/valid_until]
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 131072
+      concurrencyLimit: 8
+    responseSchema: schemas/professional-licence-response.schema.yaml
+    extractScript: adapters/professional-licence-source.rhai
+    factSchema: schemas/professional-licence-facts.schema.yaml
+  source-d:
+    transport: http-json
+    baseUrl: https://source.invalid
+    posture: field-projected
+    authentication: {kind: static-bearer, tokenRef: secret:file/source-d-token}
+    request:
+      method: POST
+      path: /v1/child-relationships
+      fixedHeaders: [{name: Accept, value: application/json}]
+      selectorInputs:
+        - role: child
+          alternatives: [{profile: civil-record-reference-v1, fields: [record_reference]}]
+      prepareScript: adapters/legal-parent-relationship-prepare.rhai
+      adapterParameters:
+        requestedFields: [returned_child_reference, parent_references, reference_namespace, relationship_set_contract, relationship_set_complete]
+        resultLimit: 2
+        referenceNamespace: urn:example:fixture:person-reference
+        relationshipSetContract: urn:example:fixture:legal-parent-set:v1
+        relationshipSetComplete: true
+      adapterParametersSchema: schemas/legal-parent-relationship-adapter-parameters.schema.yaml
+      preparationLimits: {query: forbidden, jsonBody: required, maximumJsonDepth: 8, maximumCollectionItems: 16, maximumStringBytes: 256, maximumNormalizedBytes: 4096}
+      projection: [/total, /records/*/returned_child_reference, /records/*/parent_references, /records/*/reference_namespace, /records/*/relationship_set_contract, /records/*/relationship_set_complete]
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 8
+    responseSchema: schemas/legal-parent-relationship-response.schema.yaml
+    extractScript: adapters/legal-parent-relationship-source.rhai
+    factSchema: schemas/legal-parent-relationship-facts.schema.yaml
+
+authorityProfiles:
+  statutory-caseworker-v1:
+    kind: statutory
+    requesterTags: [fixture-agency]
+    grants:
+      - requirement: urn:example:fixture:requirement:adult-status:v1
+        purpose: fixture-eligibility
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws, unsigned-json]
+        subjects:
+          - {role: subject, selectorProfile: person-demographics-v1, valueOrigin: request}
+      - requirement: urn:example:fixture:requirement:residence-region:v1
+        purpose: fixture-routing
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws, unsigned-json]
+        subjects:
+          - {role: subject, selectorProfile: residence-record-v1, valueOrigin: request}
+      - requirement: urn:example:fixture:requirement:professional-licence-status:v1
+        purpose: fixture-registration
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws, unsigned-json]
+        subjects:
+          - {role: subject, selectorProfile: licence-register-v1, valueOrigin: request}
+      - requirement: urn:example:fixture:requirement:legal-parent-relationship:v1
+        purpose: fixture-enrolment
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws, unsigned-json]
+        subjects:
+          - {role: child, selectorProfile: civil-record-reference-v1, valueOrigin: request}
+          - role: candidate-parent
+            selectorProfile: person-reference-v1
+            valueOrigin: authenticated-grant
+            valueClaims:
+              person_reference: grant.candidate_parent.person_reference
+
+requirements:
+  - id: urn:example:fixture:requirement:adult-status:v1
+    kind: criterion
+    source: source-a
+    purposes: [fixture-eligibility]
+    subjectRoles:
+      - {role: subject, cardinality: one, selectorProfiles: [person-demographics-v1]}
+    referenceFrameworks: [urn:example:fixture:framework:adult-status:v1]
+    evidenceType: urn:example:fixture:evidence-type:adult-status:v1
+    observationTimezone: Asia/Bangkok
+    validitySeconds: 86400
+    derivation:
+      script: derivations/adult-status.rhai
+      parameters: {minimum_age_years: 18}
+    concepts:
+      - {id: urn:example:fixture:concept:adult-status, form: boolean, required: true, constraints: {}}
+    fixtures: fixtures/adult-status-cases.yaml
+    disclosureGuard:
+      families: [urn:example:fixture:disclosure-family:adult-status]
+    existenceDisclosure: collapse-unresolved
+  - id: urn:example:fixture:requirement:residence-region:v1
+    kind: information-requirement
+    source: source-b
+    purposes: [fixture-routing]
+    subjectRoles:
+      - {role: subject, cardinality: one, selectorProfiles: [residence-record-v1]}
+    referenceFrameworks: [urn:example:fixture:framework:residence-region:v1]
+    evidenceType: urn:example:fixture:evidence-type:residence-region:v1
+    validitySeconds: 86400
+    derivation:
+      script: derivations/residence-region.rhai
+      parameters: {}
+    concepts:
+      - id: urn:example:fixture:concept:residence-region
+        form: controlled-code
+        required: true
+        constraints: {codelist: codelists/residence-region-map.yaml, codelistVersion: '2026-01', maximumBytes: 32}
+    fixtures: fixtures/residence-region-cases.yaml
+    disclosureGuard:
+      families: [urn:example:fixture:disclosure-family:residence-region]
+    existenceDisclosure: collapse-unresolved
+  - id: urn:example:fixture:requirement:professional-licence-status:v1
+    kind: criterion
+    source: source-c
+    purposes: [fixture-registration]
+    subjectRoles:
+      - {role: subject, cardinality: one, selectorProfiles: [licence-register-v1]}
+    referenceFrameworks: [urn:example:fixture:framework:professional-licence:v1]
+    evidenceType: urn:example:fixture:evidence-type:professional-licence-status:v1
+    observationTimezone: Africa/Nairobi
+    validitySeconds: 43200
+    derivation:
+      script: derivations/professional-licence.rhai
+      parameters:
+        active_state: CURRENT
+        expiry_buckets:
+          - {minimumInclusive: {type: decimal, value: '-365000'}, maximumExclusive: {type: decimal, value: '0'}, code: expired}
+          - {minimumInclusive: {type: decimal, value: '0'}, maximumExclusive: {type: decimal, value: '31'}, code: within-30-days}
+          - {minimumInclusive: {type: decimal, value: '31'}, maximumExclusive: {type: decimal, value: '91'}, code: within-90-days}
+          - {minimumInclusive: {type: decimal, value: '91'}, maximumExclusive: {type: decimal, value: '365001'}, code: later}
+    concepts:
+      - {id: urn:example:fixture:concept:licence-active, form: boolean, required: true, constraints: {}}
+      - id: urn:example:fixture:concept:licence-expiry-category
+        form: controlled-category
+        required: true
+        constraints: {categoryScheme: urn:example:fixture:scheme:licence-expiry, schemeVersion: '1', maximumBytes: 32, codelist: codelists/professional-expiry-categories.yaml}
+    fixtures: fixtures/professional-licence-cases.yaml
+    disclosureGuard:
+      families: [urn:example:fixture:disclosure-family:professional-licence]
+    existenceDisclosure: collapse-unresolved
+  - id: urn:example:fixture:requirement:legal-parent-relationship:v1
+    kind: criterion
+    source: source-d
+    purposes: [fixture-enrolment]
+    subjectRoles:
+      - {role: child, cardinality: one, selectorProfiles: [civil-record-reference-v1]}
+      - {role: candidate-parent, cardinality: one, selectorProfiles: [person-reference-v1]}
+    referenceFrameworks: [urn:example:fixture:framework:legal-parent-relationship:v1]
+    evidenceType: urn:example:fixture:evidence-type:legal-parent-relationship:v1
+    validitySeconds: 86400
+    derivation:
+      script: derivations/legal-parent-relationship.rhai
+      selectorInputs:
+        - role: child
+          alternatives: [{profile: civil-record-reference-v1, fields: [record_reference]}]
+        - role: candidate-parent
+          alternatives: [{profile: person-reference-v1, fields: [person_reference]}]
+      parameters:
+        matching_policy: exact-opaque-reference-membership-v1
+        candidate_reference_namespace: urn:example:fixture:person-reference
+        relationship_set_contract: urn:example:fixture:legal-parent-set:v1
+        legal_authority_attestation: urn:example:fixture:governance:legal-parent-register:v1
+    concepts:
+      - {id: urn:example:fixture:concept:legal-parent-relationship-confirmed, form: boolean, required: true, constraints: {}}
+    fixtures: fixtures/legal-parent-relationship-cases.yaml
+    disclosureGuard:
+      families: [urn:example:fixture:disclosure-family:legal-parent-relationship]
+    existenceDisclosure: collapse-unresolved
diff --git a/products/evidence/fixtures/acceptance/all-definitions/fixtures/adult-status-cases.yaml b/products/evidence/fixtures/acceptance/all-definitions/fixtures/adult-status-cases.yaml
new file mode 100644
index 000000000..8939956b0
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/fixtures/adult-status-cases.yaml
@@ -0,0 +1,29 @@
+fixture: registry.evidence.acceptance.adult-status/v1
+coequal_acceptance_definition: true
+synthetic_only: true
+common:
+  observed_at: '2026-08-02T00:00:00Z'
+  legal_local_date: '2026-08-02'
+  selector: {given_name: Amina, family_name: Diallo, birth_date: '2000-01-01'}
+  selectors:
+    subject: {profile: person-demographics-v1, values: {given_name: Amina, family_name: Diallo, birth_date: '2000-01-01'}}
+  expectedRequestParts: {query: [], body: {lookup: {given_name: Amina, family_name: Diallo, birth_date: '2000-01-01'}, fields: [date_of_birth], limit: 2}}
+  expectedTransport: {path: /v1/facts, fixedHeaders: [{name: Accept, value: application/json}]}
+cases:
+  - {id: positive, source: {total: 1, date_of_birth: '2000-01-01'}, expected_value: true, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: negative-false-is-success, source: {total: 1, date_of_birth: '2010-01-01'}, expected_value: false, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: boundary-before, legal_local_date: '2026-08-01', source: {total: 1, date_of_birth: '2008-08-02'}, expected_value: false, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: boundary-on, legal_local_date: '2026-08-02', source: {total: 1, date_of_birth: '2008-08-02'}, expected_value: true, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: boundary-after, legal_local_date: '2026-08-03', source: {total: 1, date_of_birth: '2008-08-02'}, expected_value: true, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: boundary-leap-day, legal_local_date: '2026-02-28', source: {total: 1, date_of_birth: '2008-02-29'}, expected_value: true, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: missing-fact, source: {total: 1}, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: missing-record, source: {total: 0}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: no-match, source: {total: 0}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: ambiguous, source: {total: 2}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: source-failure, source_failure: timeout, expected_public_problem: dependency_unavailable, signed_success: false}
+  - {id: negative-wrong-derived-type, injected_derivation: [{concept_id: urn:example:fixture:concept:adult-status, value: 'true'}], expected: output-gate-rejection}
+  - {id: anti-reconstruction, companion_bundle: threshold-ladder, expected: bundle-rejection}
+privacy_expectation:
+  evidence_contains: [urn:example:fixture:concept:adult-status]
+  evidence_excludes: [date_of_birth, given_name, family_name, selector-profile]
+  diagnostics_exclude: [Amina, Diallo, '2000-01-01', fixture-source-canary]
diff --git a/products/evidence/fixtures/acceptance/all-definitions/fixtures/legal-parent-relationship-cases.yaml b/products/evidence/fixtures/acceptance/all-definitions/fixtures/legal-parent-relationship-cases.yaml
new file mode 100644
index 000000000..ec274c8d3
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/fixtures/legal-parent-relationship-cases.yaml
@@ -0,0 +1,62 @@
+fixture: registry.evidence.acceptance.legal-parent-relationship/v1
+coequal_acceptance_definition: true
+synthetic_only: true
+provider_contract:
+  classification: synthetic-governed-authoritative-legal-parent-register
+  governance_attestation: urn:example:fixture:governance:legal-parent-register:v1
+  legal_meaning: For this synthetic acceptance definition, the configured source's complete parent-reference set is legally authoritative for the declared legal-parent concept.
+  lookup: One bounded child-only lookup must resolve exactly one returned child record.
+  child_binding: The returned child reference must exactly equal the authorized child selector.
+  candidate_authority: The candidate opaque reference is supplied independently by the authenticated grant and is never sent to the source.
+  decision: Exact membership in the complete governed parent-reference set is true; exact non-membership is false.
+  false_preconditions: A signed false requires a unique child, exact child binding, the governed reference namespace and contract, and relationship_set_complete true.
+  prohibited: Names, dates, fuzzy matching, candidate search, partial parent sets, and absence inferred from no-match cannot decide legal parentage.
+common:
+  observed_at: '2026-08-02T00:00:00Z'
+  subjects:
+    - {role: child, profile: civil-record-reference-v1, values: {record_reference: synthetic-child-record-001}}
+    - {role: candidate-parent, profile: person-reference-v1}
+  selectors:
+    child: {profile: civil-record-reference-v1, values: {record_reference: synthetic-child-record-001}}
+    candidate-parent: {profile: person-reference-v1, values: {person_reference: synthetic-parent-reference-001}}
+  derivationSelectorInputs:
+    child: {profile: civil-record-reference-v1, values: {record_reference: synthetic-child-record-001}}
+    candidate-parent: {profile: person-reference-v1, values: {person_reference: synthetic-parent-reference-001}}
+  verified_token_claims:
+    evidence_grant_id: synthetic-parentage-grant-001
+    evidence_authority: statutory-caseworker-v1
+    grant: {candidate_parent: {person_reference: synthetic-parent-reference-001}}
+  expectedRequestParts:
+    query: []
+    body: {lookup: {record_reference: synthetic-child-record-001}, fields: [returned_child_reference, parent_references, reference_namespace, relationship_set_contract, relationship_set_complete], limit: 2}
+  expectedTransport: {path: /v1/child-relationships, fixedHeaders: [{name: Accept, value: application/json}]}
+cases:
+  - {id: positive, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001, synthetic-parent-reference-002], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true}]}, expected_value: true, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: negative-false-is-success, verified_token_claims: {evidence_grant_id: synthetic-parentage-grant-001, evidence_authority: statutory-caseworker-v1, grant: {candidate_parent: {person_reference: synthetic-non-parent-reference-003}}}, derivationSelectorInputs: {child: {profile: civil-record-reference-v1, values: {record_reference: synthetic-child-record-001}}, candidate-parent: {profile: person-reference-v1, values: {person_reference: synthetic-non-parent-reference-003}}}, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001, synthetic-parent-reference-002], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true}]}, expected_value: false, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: boundary-correct-role-order, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true}]}, expected_value: true, expected_lookup: match, derivation_runs: true, signed_success: true, expected_subject_roles: [child, candidate-parent]}
+  - {id: negative-swapped-roles, subjects: [{role: candidate-parent, profile: civil-record-reference-v1, values: {record_reference: synthetic-child-record-001}}, {role: child, profile: person-reference-v1}], expected: pre-source-selector-rejection}
+  - {id: negative-caller-candidate-substitution, subjects: [{role: child, profile: civil-record-reference-v1, values: {record_reference: synthetic-child-record-001}}, {role: candidate-parent, profile: person-reference-v1, values: {person_reference: synthetic-substitute-reference}}], expected: pre-source-selector-rejection}
+  - {id: missing-fact, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1}]}, expected_public_problem: dependency_unavailable, derivation_runs: false, signed_success: false}
+  - {id: missing-record, source: {total: 0, records: []}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: no-match, source: {total: 0, records: []}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: negative-child-unresolved, source: {total: 0, records: []}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: negative-candidate-unresolved-or-typo, verified_token_claims: {evidence_grant_id: synthetic-parentage-grant-001, evidence_authority: statutory-caseworker-v1, grant: {candidate_parent: {person_reference: synthetic-non-parent-reference-003}}}, derivationSelectorInputs: {child: {profile: civil-record-reference-v1, values: {record_reference: synthetic-child-record-001}}, candidate-parent: {profile: person-reference-v1, values: {person_reference: synthetic-non-parent-reference-003}}}, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true}]}, expected_value: false, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: negative-raw-record-search-zero-not-false, source: {total: 0, records: []}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: ambiguous, source: {total: 2, records: [{}, {}]}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: negative-role-resolution-ambiguous, source: {total: 2, records: [{}, {}]}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: negative-returned-child-mismatch, source: {total: 1, records: [{returned_child_reference: synthetic-other-child-record, parent_references: [synthetic-parent-reference-001], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true}]}, expected_public_problem: evidence_not_available, derivation_runs: true, signed_success: false}
+  - {id: negative-incomplete-parent-set, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: false}]}, expected_public_problem: dependency_unavailable, derivation_runs: false, signed_success: false}
+  - {id: negative-relationship-status-type, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: synthetic-parent-reference-001, reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true}]}, expected_public_problem: dependency_unavailable, derivation_runs: false, signed_success: false}
+  - {id: negative-status-on-none, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true}]}, expected_public_problem: dependency_unavailable, derivation_runs: false, signed_success: false}
+  - {id: negative-status-on-ambiguous, source: {total: 2, records: [{}, {}]}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: negative-unknown-pair-resolution, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001], reference_namespace: urn:example:fixture:other-namespace, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true}]}, expected_public_problem: dependency_unavailable, derivation_runs: false, signed_success: false}
+  - {id: negative-unknown-relationship-status, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:other-parent-set:v1, relationship_set_complete: true}]}, expected_public_problem: dependency_unavailable, derivation_runs: false, signed_success: false}
+  - {id: negative-extra-source-field, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true, related_subject_name: PrivacyCanary}]}, expected_value: true, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: source-failure, source_failure: timeout, expected_public_problem: dependency_unavailable, signed_success: false}
+  - {id: negative-extra-family-fact, injected_derivation: [{concept_id: urn:example:fixture:concept:legal-parent-relationship-confirmed, value: true}, {concept_id: urn:example:fixture:concept:related-subject-name, value: PrivacyCanary}], expected: output-gate-rejection}
+  - {id: anti-reconstruction, companion_bundle: relationship-graph, expected: bundle-rejection}
+privacy_expectation:
+  evidence_contains: [child, candidate-parent, urn:example:fixture:concept:legal-parent-relationship-confirmed]
+  evidence_excludes: [record_reference, person_reference, parent_references, returned_child_reference, family-graph]
+  diagnostics_exclude: [synthetic-child-record-001, synthetic-other-child-record, synthetic-parentage-grant-001, synthetic-parent-reference-001, synthetic-parent-reference-002, synthetic-non-parent-reference-003, synthetic-substitute-reference, PrivacyCanary]
+  subject_bindings: two independent audience-scoped opaque bindings
diff --git a/products/evidence/fixtures/acceptance/all-definitions/fixtures/professional-licence-cases.yaml b/products/evidence/fixtures/acceptance/all-definitions/fixtures/professional-licence-cases.yaml
new file mode 100644
index 000000000..7ac371067
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/fixtures/professional-licence-cases.yaml
@@ -0,0 +1,65 @@
+fixture: registry.evidence.acceptance.professional-licence/v1
+coequal_acceptance_definition: true
+synthetic_only: true
+common:
+  observed_at: '2026-08-02T00:00:00Z'
+  legal_local_date: '2026-08-02'
+  selector: {licence_reference: synthetic-licence-001, registry_region: RR-A}
+  selectors:
+    subject: {profile: licence-register-v1, values: {licence_reference: synthetic-licence-001, registry_region: RR-A}}
+  expectedRequestParts:
+    query: [{name: licence_reference, value: synthetic-licence-001}, {name: registry_region, value: RR-A}, {name: fields, value: "licence_state,valid_from,valid_until"}, {name: limit, value: "2"}]
+    body: null
+  expectedTransport: {path: /v1/records, fixedHeaders: [{name: Accept, value: application/json}]}
+cases:
+  - id: positive
+    source: {total: 1, records: [{licence_state: CURRENT, valid_from: '2025-01-01', valid_until: '2026-08-20', historical_states: [PENDING]}]}
+    expected_values: {licence-active: true, licence-expiry-category: within-30-days}
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+  - id: negative-inactive-is-success
+    source: {total: 1, records: [{licence_state: SUSPENDED, valid_from: '2025-01-01', valid_until: '2026-12-31', historical_states: [CURRENT]}]}
+    expected_values: {licence-active: false, licence-expiry-category: later}
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+  - id: boundary-valid-from
+    source: {total: 1, records: [{licence_state: CURRENT, valid_from: '2026-08-02', valid_until: '2026-12-31', historical_states: []}]}
+    expected_values: {licence-active: true, licence-expiry-category: later}
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+  - id: boundary-valid-until
+    source: {total: 1, records: [{licence_state: CURRENT, valid_from: '2025-01-01', valid_until: '2026-08-02', historical_states: []}]}
+    expected_values: {licence-active: true, licence-expiry-category: within-30-days}
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+  - id: boundary-after-valid-until
+    legal_local_date: '2026-08-03'
+    source: {total: 1, records: [{licence_state: CURRENT, valid_from: '2025-01-01', valid_until: '2026-08-02', historical_states: []}]}
+    expected_values: {licence-active: false, licence-expiry-category: expired}
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+  - id: missing-fact
+    source: {total: 1, records: [{licence_state: CURRENT, valid_from: '2025-01-01', historical_states: []}]}
+    expected_public_problem: evidence_not_available
+    derivation_runs: false
+    signed_success: false
+  - {id: missing-record, source: {total: 0, records: []}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: no-match, source: {total: 0, records: []}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: ambiguous, source: {total: 2, records: [{}, {}]}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: source-failure, source_failure: wrong-media-type, expected_public_problem: dependency_unavailable, signed_success: false}
+  - id: negative-exact-date-leak
+    injected_derivation:
+      - {concept_id: urn:example:fixture:concept:licence-active, value: true}
+      - {concept_id: urn:example:fixture:concept:licence-expiry-category, value: '2026-08-20'}
+    expected: output-gate-rejection
+  - {id: anti-reconstruction, companion_bundle: coexisting-revisions, expected: bundle-rejection}
+privacy_expectation:
+  evidence_contains: [urn:example:fixture:concept:licence-active, urn:example:fixture:concept:licence-expiry-category]
+  evidence_excludes: [valid_from, valid_until, historical_states, licence_reference, registry_region]
+  diagnostics_exclude: [synthetic-licence-001, '2026-08-20', PENDING, CURRENT]
+  minimization_claim: disclosure minimization only
diff --git a/products/evidence/fixtures/acceptance/all-definitions/fixtures/residence-region-cases.yaml b/products/evidence/fixtures/acceptance/all-definitions/fixtures/residence-region-cases.yaml
new file mode 100644
index 000000000..0589776c9
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/fixtures/residence-region-cases.yaml
@@ -0,0 +1,26 @@
+fixture: registry.evidence.acceptance.residence-region/v1
+coequal_acceptance_definition: true
+synthetic_only: true
+common:
+  observed_at: '2026-08-02T00:00:00Z'
+  selector: {record_reference: synthetic-residence-record-001}
+  selectors:
+    subject: {profile: residence-record-v1, values: {record_reference: synthetic-residence-record-001}}
+  expectedRequestParts: {query: [], body: {lookup: {record_reference: synthetic-residence-record-001}, fields: [official_residence_code], limit: 2}}
+  expectedTransport: {path: /v1/facts, fixedHeaders: [{name: Accept, value: application/json}]}
+cases:
+  - {id: positive, source: {total: 1, official_residence_code: R-101}, expected_value: REGION-NORTH, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: negative-unknown-code, source: {total: 1, official_residence_code: R-999}, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: boundary-second-source-code-same-coarse-region, source: {total: 1, official_residence_code: R-102}, expected_value: REGION-NORTH, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: boundary-other-coarse-region, source: {total: 1, official_residence_code: R-201}, expected_value: REGION-SOUTH, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: negative-overly-precise-output, injected_derivation: [{concept_id: urn:example:fixture:concept:residence-region, value: R-101}], expected: output-gate-rejection}
+  - {id: missing-fact, source: {total: 1}, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: missing-record, source: {total: 0}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: no-match, source: {total: 0}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: ambiguous, source: {total: 2}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: source-failure, source_failure: http-503, expected_public_problem: dependency_unavailable, signed_success: false}
+  - {id: anti-reconstruction, companion_bundle: geographic-overlap, expected: bundle-rejection}
+privacy_expectation:
+  evidence_contains: [urn:example:fixture:concept:residence-region, REGION-NORTH]
+  evidence_excludes: [official_residence_code, record_reference, R-101, R-102]
+  diagnostics_exclude: [synthetic-residence-record-001, R-101, R-102, REGION-NORTH]
diff --git a/products/evidence/fixtures/acceptance/all-definitions/schemas/adult-status-adapter-parameters.schema.yaml b/products/evidence/fixtures/acceptance/all-definitions/schemas/adult-status-adapter-parameters.schema.yaml
new file mode 100644
index 000000000..b5a7fe65c
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/schemas/adult-status-adapter-parameters.schema.yaml
@@ -0,0 +1,6 @@
+type: object
+additionalProperties: false
+required: [requestedFields, resultLimit]
+properties:
+  requestedFields: {const: [date_of_birth]}
+  resultLimit: {const: 2}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/schemas/adult-status-facts.schema.yaml b/products/evidence/fixtures/acceptance/all-definitions/schemas/adult-status-facts.schema.yaml
new file mode 100644
index 000000000..27d2c2f0f
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/schemas/adult-status-facts.schema.yaml
@@ -0,0 +1,5 @@
+type: object
+additionalProperties: false
+required: [date_of_birth]
+properties:
+  date_of_birth: {type: string, format: date}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/schemas/adult-status-response.schema.yaml b/products/evidence/fixtures/acceptance/all-definitions/schemas/adult-status-response.schema.yaml
new file mode 100644
index 000000000..a8eb01a7f
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/schemas/adult-status-response.schema.yaml
@@ -0,0 +1,6 @@
+type: object
+additionalProperties: false
+required: [total]
+properties:
+  total: {type: integer, minimum: 0, maximum: 1000000}
+  date_of_birth: {type: string, format: date}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/schemas/legal-parent-relationship-adapter-parameters.schema.yaml b/products/evidence/fixtures/acceptance/all-definitions/schemas/legal-parent-relationship-adapter-parameters.schema.yaml
new file mode 100644
index 000000000..e1ce9deb3
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/schemas/legal-parent-relationship-adapter-parameters.schema.yaml
@@ -0,0 +1,9 @@
+type: object
+additionalProperties: false
+required: [requestedFields, resultLimit, referenceNamespace, relationshipSetContract, relationshipSetComplete]
+properties:
+  requestedFields: {const: [returned_child_reference, parent_references, reference_namespace, relationship_set_contract, relationship_set_complete]}
+  resultLimit: {const: 2}
+  referenceNamespace: {const: urn:example:fixture:person-reference}
+  relationshipSetContract: {const: urn:example:fixture:legal-parent-set:v1}
+  relationshipSetComplete: {const: true}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/schemas/legal-parent-relationship-facts.schema.yaml b/products/evidence/fixtures/acceptance/all-definitions/schemas/legal-parent-relationship-facts.schema.yaml
new file mode 100644
index 000000000..f43938c9d
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/schemas/legal-parent-relationship-facts.schema.yaml
@@ -0,0 +1,14 @@
+type: object
+additionalProperties: false
+required: [returned_child_reference, parent_references, reference_namespace, relationship_set_contract, relationship_set_complete]
+properties:
+  returned_child_reference: {type: string, minLength: 1, maxLength: 96}
+  parent_references:
+    type: array
+    minItems: 0
+    maxItems: 2
+    uniqueItems: true
+    items: {type: string, minLength: 1, maxLength: 128}
+  reference_namespace: {const: urn:example:fixture:person-reference}
+  relationship_set_contract: {const: urn:example:fixture:legal-parent-set:v1}
+  relationship_set_complete: {const: true}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/schemas/legal-parent-relationship-response.schema.yaml b/products/evidence/fixtures/acceptance/all-definitions/schemas/legal-parent-relationship-response.schema.yaml
new file mode 100644
index 000000000..21cd65577
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/schemas/legal-parent-relationship-response.schema.yaml
@@ -0,0 +1,27 @@
+type: object
+additionalProperties: false
+required: [total, records]
+properties:
+  total: {type: integer, minimum: 0, maximum: 1000000}
+  records:
+    type: array
+    minItems: 0
+    maxItems: 2
+    items:
+      type: object
+      additionalProperties: false
+      # Projection drops a leaf the record did not carry, and an ambiguous page
+      # is decided before any record is read, so no leaf can be required here.
+      # Which leaves a single matched record must carry stays with the script.
+      required: []
+      properties:
+        returned_child_reference: {type: string, minLength: 1, maxLength: 96}
+        parent_references:
+          type: array
+          minItems: 0
+          maxItems: 2
+          uniqueItems: true
+          items: {type: string, minLength: 1, maxLength: 128}
+        reference_namespace: {type: string, minLength: 1, maxLength: 128}
+        relationship_set_contract: {type: string, minLength: 1, maxLength: 128}
+        relationship_set_complete: {type: boolean}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/schemas/professional-licence-adapter-parameters.schema.yaml b/products/evidence/fixtures/acceptance/all-definitions/schemas/professional-licence-adapter-parameters.schema.yaml
new file mode 100644
index 000000000..40a08a8cc
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/schemas/professional-licence-adapter-parameters.schema.yaml
@@ -0,0 +1,6 @@
+type: object
+additionalProperties: false
+required: [requestedFields, resultLimit]
+properties:
+  requestedFields: {const: "licence_state,valid_from,valid_until"}
+  resultLimit: {const: "2"}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/schemas/professional-licence-facts.schema.yaml b/products/evidence/fixtures/acceptance/all-definitions/schemas/professional-licence-facts.schema.yaml
new file mode 100644
index 000000000..c23fa7fb3
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/schemas/professional-licence-facts.schema.yaml
@@ -0,0 +1,7 @@
+type: object
+additionalProperties: false
+required: [licence_state, valid_from, valid_until]
+properties:
+  licence_state: {type: string, minLength: 1, maxLength: 32}
+  valid_from: {type: string, format: date}
+  valid_until: {type: string, format: date}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/schemas/professional-licence-response.schema.yaml b/products/evidence/fixtures/acceptance/all-definitions/schemas/professional-licence-response.schema.yaml
new file mode 100644
index 000000000..bacd66c70
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/schemas/professional-licence-response.schema.yaml
@@ -0,0 +1,17 @@
+type: object
+additionalProperties: false
+required: [total, records]
+properties:
+  total: {type: integer, minimum: 0, maximum: 1000000}
+  records:
+    type: array
+    minItems: 0
+    maxItems: 2
+    items:
+      type: object
+      additionalProperties: false
+      required: []
+      properties:
+        licence_state: {type: string, minLength: 1, maxLength: 32}
+        valid_from: {type: string, format: date}
+        valid_until: {type: string, format: date}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/schemas/residence-region-adapter-parameters.schema.yaml b/products/evidence/fixtures/acceptance/all-definitions/schemas/residence-region-adapter-parameters.schema.yaml
new file mode 100644
index 000000000..ace2cd76e
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/schemas/residence-region-adapter-parameters.schema.yaml
@@ -0,0 +1,6 @@
+type: object
+additionalProperties: false
+required: [requestedFields, resultLimit]
+properties:
+  requestedFields: {const: [official_residence_code]}
+  resultLimit: {const: 2}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/schemas/residence-region-facts.schema.yaml b/products/evidence/fixtures/acceptance/all-definitions/schemas/residence-region-facts.schema.yaml
new file mode 100644
index 000000000..d3e45d7b6
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/schemas/residence-region-facts.schema.yaml
@@ -0,0 +1,5 @@
+type: object
+additionalProperties: false
+required: [official_residence_code]
+properties:
+  official_residence_code: {type: string, minLength: 1, maxLength: 32}
diff --git a/products/evidence/fixtures/acceptance/all-definitions/schemas/residence-region-response.schema.yaml b/products/evidence/fixtures/acceptance/all-definitions/schemas/residence-region-response.schema.yaml
new file mode 100644
index 000000000..70d83308f
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/all-definitions/schemas/residence-region-response.schema.yaml
@@ -0,0 +1,6 @@
+type: object
+additionalProperties: false
+required: [total]
+properties:
+  total: {type: integer, minimum: 0, maximum: 1000000}
+  official_residence_code: {type: string, minLength: 1, maxLength: 32}
diff --git a/products/evidence/fixtures/acceptance/legal-parent-relationship/adapters/source-d-prepare.rhai b/products/evidence/fixtures/acceptance/legal-parent-relationship/adapters/source-d-prepare.rhai
new file mode 100644
index 000000000..dc4d8a185
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/legal-parent-relationship/adapters/source-d-prepare.rhai
@@ -0,0 +1,11 @@
+fn prepare(selectors, parameters) {
+    let child = selectors["child"];
+    #{
+        query: [],
+        body: #{
+            lookup: #{record_reference: child["values"]["record_reference"]},
+            fields: parameters["requestedFields"],
+            limit: parameters["resultLimit"]
+        }
+    }
+}
diff --git a/products/evidence/fixtures/acceptance/legal-parent-relationship/adapters/source-d.rhai b/products/evidence/fixtures/acceptance/legal-parent-relationship/adapters/source-d.rhai
new file mode 100644
index 000000000..d96ad60e6
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/legal-parent-relationship/adapters/source-d.rhai
@@ -0,0 +1,36 @@
+fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    let records = source_response["records"];
+    if records.len > parameters["resultLimit"] {
+        throw("source_protocol_error");
+    }
+    if total == 0 {
+        if records.len != 0 { throw("source_protocol_error"); }
+        return #{outcome: "no_match"};
+    }
+    if total > 1 {
+        if records.len < 2 { throw("source_protocol_error"); }
+        return #{outcome: "ambiguous"};
+    }
+    if records.len != 1 { throw("source_protocol_error"); }
+    let record = records[0];
+    // The shape cannot require these of every record, because the ambiguous
+    // page is decided before any record is read. A single matched record that
+    // omits either one is a source this adapter does not understand.
+    if is_missing(record["returned_child_reference"]) ||
+       is_missing(record["parent_references"]) {
+        throw("source_protocol_error");
+    }
+    if record["reference_namespace"] != parameters["referenceNamespace"] ||
+       record["relationship_set_contract"] != parameters["relationshipSetContract"] ||
+       record["relationship_set_complete"] != parameters["relationshipSetComplete"] {
+        throw("source_protocol_error");
+    }
+    #{outcome: "match", facts: #{
+        returned_child_reference: record["returned_child_reference"],
+        parent_references: record["parent_references"],
+        reference_namespace: record["reference_namespace"],
+        relationship_set_contract: record["relationship_set_contract"],
+        relationship_set_complete: record["relationship_set_complete"]
+    }}
+}
diff --git a/products/evidence/fixtures/acceptance/legal-parent-relationship/derivations/legal-parent-relationship.rhai b/products/evidence/fixtures/acceptance/legal-parent-relationship/derivations/legal-parent-relationship.rhai
new file mode 100644
index 000000000..8c6923f2a
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/legal-parent-relationship/derivations/legal-parent-relationship.rhai
@@ -0,0 +1,19 @@
+fn derive(facts, selectors, evaluation_context) {
+    let parameters = evaluation_context["parameters"];
+    if parameters["matching_policy"] != "exact-opaque-reference-membership-v1" ||
+       parameters["legal_authority_attestation"] !=
+       "urn:example:fixture:governance:legal-parent-register:v1" ||
+       facts["returned_child_reference"] != selectors["child"]["values"]["record_reference"] ||
+       facts["relationship_set_complete"] != true ||
+       facts["reference_namespace"] != parameters["candidate_reference_namespace"] ||
+       facts["relationship_set_contract"] != parameters["relationship_set_contract"] {
+        throw("derivation_input_error");
+    }
+    [#{
+        concept_id: "urn:example:fixture:concept:legal-parent-relationship-confirmed",
+        value: list_contains(
+            facts["parent_references"],
+            selectors["candidate-parent"]["values"]["person_reference"]
+        )
+    }]
+}
diff --git a/products/evidence/fixtures/acceptance/legal-parent-relationship/evidence.yaml b/products/evidence/fixtures/acceptance/legal-parent-relationship/evidence.yaml
new file mode 100644
index 000000000..8e768196f
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/legal-parent-relationship/evidence.yaml
@@ -0,0 +1,96 @@
+version: 1
+assuranceProfile: evidence-grade
+service: {providerId: urn:example:fixture:provider:evidence, trustDomain: urn:example:fixture:trust-domain:acceptance}
+issuer: {id: urn:example:fixture:issuer:authority}
+authentication: {kind: oidc-access-token, issuer: https://identity.invalid, audiences: [evidence-fixture], tokenTypes: [at+jwt], algorithms: [EdDSA], jwksUri: https://identity.invalid/.well-known/jwks.json, principalClaim: sub, requesterTagsClaim: evidence_tags, evidenceAudienceClaim: evidence_audience, grantIdClaim: evidence_grant_id, grantAuthorityClaim: evidence_authority}
+audit: {format: keyed-jsonl, hashSecretRef: secret:file/audit-hash-key, hashKeyVersion: 1, failClosed: true}
+subjectBinding: {secretRef: secret:file/subject-binding-key, keyVersion: 1}
+rateLimits: {requestsPerPrincipalPerMinute: 60, burstPerPrincipal: 10, failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 10}
+signing: {format: flattened-jws-json, algorithm: EdDSA, activeKeyId: fixture-key-2026-01, activeKeyRef: secret:file/signing-key, retiredPublicJwkFiles: [], jwksPath: /.well-known/evidence/jwks.json, maximumAssertionValiditySeconds: 86400, verifierClockSkewSeconds: 30}
+responseFormats: [signed-jws]
+
+selectorProfiles:
+  civil-record-reference-v1:
+    maximumAggregateBytes: 96
+    fields: {record_reference: {type: string, minimumBytes: 1, maximumBytes: 96}}
+  person-reference-v1:
+    maximumAggregateBytes: 128
+    fields: {person_reference: {type: string, minimumBytes: 1, maximumBytes: 128}}
+sources:
+  source-d:
+    transport: http-json
+    baseUrl: https://source.invalid
+    posture: field-projected
+    authentication: {kind: static-bearer, tokenRef: secret:file/source-d-token}
+    request:
+      method: POST
+      path: /v1/child-relationships
+      fixedHeaders: [{name: Accept, value: application/json}]
+      selectorInputs:
+        - role: child
+          alternatives: [{profile: civil-record-reference-v1, fields: [record_reference]}]
+      prepareScript: adapters/source-d-prepare.rhai
+      adapterParameters:
+        requestedFields: [returned_child_reference, parent_references, reference_namespace, relationship_set_contract, relationship_set_complete]
+        resultLimit: 2
+        referenceNamespace: urn:example:fixture:person-reference
+        relationshipSetContract: urn:example:fixture:legal-parent-set:v1
+        relationshipSetComplete: true
+      adapterParametersSchema: schemas/adapter-parameters.schema.yaml
+      preparationLimits: {query: forbidden, jsonBody: required, maximumJsonDepth: 8, maximumCollectionItems: 16, maximumStringBytes: 256, maximumNormalizedBytes: 4096}
+      projection:
+        - /total
+        - /records/*/returned_child_reference
+        - /records/*/parent_references
+        - /records/*/reference_namespace
+        - /records/*/relationship_set_contract
+        - /records/*/relationship_set_complete
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 8
+    responseSchema: schemas/response.schema.yaml
+    extractScript: adapters/source-d.rhai
+    factSchema: schemas/facts.schema.yaml
+authorityProfiles:
+  statutory-caseworker-v1:
+    kind: statutory
+    requesterTags: [fixture-agency]
+    grants:
+      - requirement: urn:example:fixture:requirement:legal-parent-relationship:v1
+        purpose: fixture-enrolment
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects:
+          - {role: child, selectorProfile: civil-record-reference-v1, valueOrigin: request}
+          - role: candidate-parent
+            selectorProfile: person-reference-v1
+            valueOrigin: authenticated-grant
+            valueClaims: {person_reference: grant.candidate_parent.person_reference}
+requirements:
+  - id: urn:example:fixture:requirement:legal-parent-relationship:v1
+    kind: criterion
+    source: source-d
+    purposes: [fixture-enrolment]
+    subjectRoles:
+      - {role: child, cardinality: one, selectorProfiles: [civil-record-reference-v1]}
+      - {role: candidate-parent, cardinality: one, selectorProfiles: [person-reference-v1]}
+    referenceFrameworks: [urn:example:fixture:framework:legal-parent-relationship:v1]
+    evidenceType: urn:example:fixture:evidence-type:legal-parent-relationship:v1
+    validitySeconds: 86400
+    derivation:
+      script: derivations/legal-parent-relationship.rhai
+      selectorInputs:
+        - role: child
+          alternatives: [{profile: civil-record-reference-v1, fields: [record_reference]}]
+        - role: candidate-parent
+          alternatives: [{profile: person-reference-v1, fields: [person_reference]}]
+      parameters:
+        matching_policy: exact-opaque-reference-membership-v1
+        candidate_reference_namespace: urn:example:fixture:person-reference
+        relationship_set_contract: urn:example:fixture:legal-parent-set:v1
+        legal_authority_attestation: urn:example:fixture:governance:legal-parent-register:v1
+    concepts: [{id: urn:example:fixture:concept:legal-parent-relationship-confirmed, form: boolean, required: true, constraints: {}}]
+    fixtures: fixtures/cases.yaml
+    disclosureGuard: {families: [urn:example:fixture:disclosure-family:legal-parent-relationship]}
+    existenceDisclosure: collapse-unresolved
diff --git a/products/evidence/fixtures/acceptance/legal-parent-relationship/fixtures/cases.yaml b/products/evidence/fixtures/acceptance/legal-parent-relationship/fixtures/cases.yaml
new file mode 100644
index 000000000..1d4146196
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/legal-parent-relationship/fixtures/cases.yaml
@@ -0,0 +1,104 @@
+fixture: registry.evidence.acceptance.legal-parent-relationship/v1
+coequal_acceptance_definition: true
+synthetic_only: true
+provider_contract:
+  classification: synthetic-governed-authoritative-legal-parent-register
+  governance_attestation: urn:example:fixture:governance:legal-parent-register:v1
+  legal_meaning: For this synthetic acceptance definition, the configured source's complete parent-reference set is legally authoritative for the declared legal-parent concept.
+  lookup: One bounded child-only lookup must resolve exactly one returned child record.
+  child_binding: The returned child reference must exactly equal the authorized child selector.
+  candidate_authority: The candidate opaque reference is supplied independently by the authenticated grant and is never sent to the source.
+  decision: Exact membership in the complete governed parent-reference set is true; exact non-membership is false.
+  false_preconditions: A signed false requires a unique child, exact child binding, the governed reference namespace and contract, and relationship_set_complete true.
+  prohibited: Names, dates, fuzzy matching, candidate search, partial parent sets, and absence inferred from no-match cannot decide legal parentage.
+common:
+  observed_at: '2026-08-02T00:00:00Z'
+  subjects:
+    - {role: child, profile: civil-record-reference-v1, values: {record_reference: synthetic-child-record-001}}
+    - {role: candidate-parent, profile: person-reference-v1}
+  selectors:
+    child: {profile: civil-record-reference-v1, values: {record_reference: synthetic-child-record-001}}
+    candidate-parent: {profile: person-reference-v1, values: {person_reference: synthetic-parent-reference-001}}
+  derivationSelectorInputs:
+    child: {profile: civil-record-reference-v1, values: {record_reference: synthetic-child-record-001}}
+    candidate-parent: {profile: person-reference-v1, values: {person_reference: synthetic-parent-reference-001}}
+  verified_token_claims:
+    evidence_grant_id: synthetic-parentage-grant-001
+    evidence_authority: statutory-caseworker-v1
+    grant:
+      candidate_parent: {person_reference: synthetic-parent-reference-001}
+  expectedRequestParts:
+    query: []
+    body:
+      lookup: {record_reference: synthetic-child-record-001}
+      fields: [returned_child_reference, parent_references, reference_namespace, relationship_set_contract, relationship_set_complete]
+      limit: 2
+  expectedTransport:
+    path: /v1/child-relationships
+    fixedHeaders: [{name: Accept, value: application/json}]
+cases:
+  - id: positive
+    source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001, synthetic-parent-reference-002], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true}]}
+    expected_value: true
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+  - id: negative-false-is-success
+    verified_token_claims:
+      evidence_grant_id: synthetic-parentage-grant-001
+      evidence_authority: statutory-caseworker-v1
+      grant:
+        candidate_parent: {person_reference: synthetic-non-parent-reference-003}
+    derivationSelectorInputs:
+      child: {profile: civil-record-reference-v1, values: {record_reference: synthetic-child-record-001}}
+      candidate-parent: {profile: person-reference-v1, values: {person_reference: synthetic-non-parent-reference-003}}
+    source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001, synthetic-parent-reference-002], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true}]}
+    expected_value: false
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+  - id: boundary-correct-role-order
+    source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true}]}
+    expected_value: true
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+    expected_subject_roles: [child, candidate-parent]
+  - id: negative-swapped-roles
+    subjects:
+      - {role: candidate-parent, profile: civil-record-reference-v1, values: {record_reference: synthetic-child-record-001}}
+      - {role: child, profile: person-reference-v1}
+    expected: pre-source-selector-rejection
+  - id: negative-caller-candidate-substitution
+    subjects:
+      - {role: child, profile: civil-record-reference-v1, values: {record_reference: synthetic-child-record-001}}
+      - {role: candidate-parent, profile: person-reference-v1, values: {person_reference: synthetic-substitute-reference}}
+    expected: pre-source-selector-rejection
+  - {id: missing-fact, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1}]}, expected_public_problem: dependency_unavailable, derivation_runs: false, signed_success: false}
+  - {id: missing-record, source: {total: 0, records: []}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: no-match, source: {total: 0, records: []}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: negative-child-unresolved, source: {total: 0, records: []}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: negative-candidate-unresolved-or-typo, verified_token_claims: {evidence_grant_id: synthetic-parentage-grant-001, evidence_authority: statutory-caseworker-v1, grant: {candidate_parent: {person_reference: synthetic-non-parent-reference-003}}}, derivationSelectorInputs: {child: {profile: civil-record-reference-v1, values: {record_reference: synthetic-child-record-001}}, candidate-parent: {profile: person-reference-v1, values: {person_reference: synthetic-non-parent-reference-003}}}, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true}]}, expected_value: false, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: negative-raw-record-search-zero-not-false, source: {total: 0, records: []}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: ambiguous, source: {total: 2, records: [{}, {}]}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: negative-role-resolution-ambiguous, source: {total: 2, records: [{}, {}]}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: negative-returned-child-mismatch, source: {total: 1, records: [{returned_child_reference: synthetic-other-child-record, parent_references: [synthetic-parent-reference-001], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true}]}, expected_public_problem: evidence_not_available, derivation_runs: true, signed_success: false}
+  - {id: negative-incomplete-parent-set, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: false}]}, expected_public_problem: dependency_unavailable, derivation_runs: false, signed_success: false}
+  - {id: negative-relationship-status-type, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: synthetic-parent-reference-001, reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true}]}, expected_public_problem: dependency_unavailable, derivation_runs: false, signed_success: false}
+  - {id: negative-status-on-none, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true}]}, expected_public_problem: dependency_unavailable, derivation_runs: false, signed_success: false}
+  - {id: negative-status-on-ambiguous, source: {total: 2, records: [{}, {}]}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: negative-unknown-pair-resolution, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001], reference_namespace: urn:example:fixture:other-namespace, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true}]}, expected_public_problem: dependency_unavailable, derivation_runs: false, signed_success: false}
+  - {id: negative-unknown-relationship-status, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:other-parent-set:v1, relationship_set_complete: true}]}, expected_public_problem: dependency_unavailable, derivation_runs: false, signed_success: false}
+  - {id: negative-extra-source-field, source: {total: 1, records: [{returned_child_reference: synthetic-child-record-001, parent_references: [synthetic-parent-reference-001], reference_namespace: urn:example:fixture:person-reference, relationship_set_contract: urn:example:fixture:legal-parent-set:v1, relationship_set_complete: true, related_subject_name: PrivacyCanary}]}, expected_value: true, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: source-failure, source_failure: timeout, expected_public_problem: dependency_unavailable, signed_success: false}
+  - id: negative-extra-family-fact
+    injected_derivation:
+      - {concept_id: urn:example:fixture:concept:legal-parent-relationship-confirmed, value: true}
+      - {concept_id: urn:example:fixture:concept:related-subject-name, value: PrivacyCanary}
+    expected: output-gate-rejection
+  - {id: anti-reconstruction, companion_bundle: relationship-graph, expected: bundle-rejection}
+privacy_expectation:
+  evidence_contains: [child, candidate-parent, urn:example:fixture:concept:legal-parent-relationship-confirmed]
+  evidence_excludes: [record_reference, person_reference, parent_references, returned_child_reference, family-graph]
+  diagnostics_exclude: [synthetic-child-record-001, synthetic-other-child-record, synthetic-parentage-grant-001, synthetic-parent-reference-001, synthetic-parent-reference-002, synthetic-non-parent-reference-003, synthetic-substitute-reference, PrivacyCanary]
+  subject_bindings: two independent audience-scoped opaque bindings
diff --git a/products/evidence/fixtures/acceptance/legal-parent-relationship/schemas/adapter-parameters.schema.yaml b/products/evidence/fixtures/acceptance/legal-parent-relationship/schemas/adapter-parameters.schema.yaml
new file mode 100644
index 000000000..2a9fa7a56
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/legal-parent-relationship/schemas/adapter-parameters.schema.yaml
@@ -0,0 +1,15 @@
+type: object
+additionalProperties: false
+required:
+  - requestedFields
+  - resultLimit
+  - referenceNamespace
+  - relationshipSetContract
+  - relationshipSetComplete
+properties:
+  requestedFields:
+    const: [returned_child_reference, parent_references, reference_namespace, relationship_set_contract, relationship_set_complete]
+  resultLimit: {const: 2}
+  referenceNamespace: {const: urn:example:fixture:person-reference}
+  relationshipSetContract: {const: urn:example:fixture:legal-parent-set:v1}
+  relationshipSetComplete: {const: true}
diff --git a/products/evidence/fixtures/acceptance/legal-parent-relationship/schemas/facts.schema.yaml b/products/evidence/fixtures/acceptance/legal-parent-relationship/schemas/facts.schema.yaml
new file mode 100644
index 000000000..f43938c9d
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/legal-parent-relationship/schemas/facts.schema.yaml
@@ -0,0 +1,14 @@
+type: object
+additionalProperties: false
+required: [returned_child_reference, parent_references, reference_namespace, relationship_set_contract, relationship_set_complete]
+properties:
+  returned_child_reference: {type: string, minLength: 1, maxLength: 96}
+  parent_references:
+    type: array
+    minItems: 0
+    maxItems: 2
+    uniqueItems: true
+    items: {type: string, minLength: 1, maxLength: 128}
+  reference_namespace: {const: urn:example:fixture:person-reference}
+  relationship_set_contract: {const: urn:example:fixture:legal-parent-set:v1}
+  relationship_set_complete: {const: true}
diff --git a/products/evidence/fixtures/acceptance/legal-parent-relationship/schemas/response.schema.yaml b/products/evidence/fixtures/acceptance/legal-parent-relationship/schemas/response.schema.yaml
new file mode 100644
index 000000000..21cd65577
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/legal-parent-relationship/schemas/response.schema.yaml
@@ -0,0 +1,27 @@
+type: object
+additionalProperties: false
+required: [total, records]
+properties:
+  total: {type: integer, minimum: 0, maximum: 1000000}
+  records:
+    type: array
+    minItems: 0
+    maxItems: 2
+    items:
+      type: object
+      additionalProperties: false
+      # Projection drops a leaf the record did not carry, and an ambiguous page
+      # is decided before any record is read, so no leaf can be required here.
+      # Which leaves a single matched record must carry stays with the script.
+      required: []
+      properties:
+        returned_child_reference: {type: string, minLength: 1, maxLength: 96}
+        parent_references:
+          type: array
+          minItems: 0
+          maxItems: 2
+          uniqueItems: true
+          items: {type: string, minLength: 1, maxLength: 128}
+        reference_namespace: {type: string, minLength: 1, maxLength: 128}
+        relationship_set_contract: {type: string, minLength: 1, maxLength: 128}
+        relationship_set_complete: {type: boolean}
diff --git a/products/evidence/fixtures/acceptance/professional-licence/adapters/source-c-prepare.rhai b/products/evidence/fixtures/acceptance/professional-licence/adapters/source-c-prepare.rhai
new file mode 100644
index 000000000..494edc493
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/professional-licence/adapters/source-c-prepare.rhai
@@ -0,0 +1,12 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"];
+    #{
+        query: [
+            #{name: "licence_reference", value: subject["values"]["licence_reference"]},
+            #{name: "registry_region", value: subject["values"]["registry_region"]},
+            #{name: "fields", value: parameters["requestedFields"]},
+            #{name: "limit", value: parameters["resultLimit"]}
+        ],
+        body: ()
+    }
+}
diff --git a/products/evidence/fixtures/acceptance/professional-licence/adapters/source-c.rhai b/products/evidence/fixtures/acceptance/professional-licence/adapters/source-c.rhai
new file mode 100644
index 000000000..c24e4b509
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/professional-licence/adapters/source-c.rhai
@@ -0,0 +1,27 @@
+fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    let records = source_response["records"];
+    if records.len > parse_integer(parameters["resultLimit"]) {
+        throw("source_protocol_error");
+    }
+    if total == 0 {
+        if records.len != 0 { throw("source_protocol_error"); }
+        return #{outcome: "no_match"};
+    }
+    if total > 1 {
+        if records.len < 2 { throw("source_protocol_error"); }
+        return #{outcome: "ambiguous"};
+    }
+    if records.len != 1 { throw("source_protocol_error"); }
+    let facts = #{};
+    let licence_state = get_path(source_response, "/records/0/licence_state");
+    if !is_missing(licence_state) { facts["licence_state"] = licence_state; }
+    let valid_from = get_path(source_response, "/records/0/valid_from");
+    if !is_missing(valid_from) { facts["valid_from"] = valid_from; }
+    let valid_until = get_path(source_response, "/records/0/valid_until");
+    if !is_missing(valid_until) { facts["valid_until"] = valid_until; }
+    #{
+        outcome: "match",
+        facts: facts
+    }
+}
diff --git a/products/evidence/fixtures/acceptance/professional-licence/codelists/expiry-categories.yaml b/products/evidence/fixtures/acceptance/professional-licence/codelists/expiry-categories.yaml
new file mode 100644
index 000000000..f1306ace1
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/professional-licence/codelists/expiry-categories.yaml
@@ -0,0 +1,3 @@
+id: urn:example:fixture:scheme:licence-expiry
+version: '1'
+codes: [expired, within-30-days, within-90-days, later]
diff --git a/products/evidence/fixtures/acceptance/professional-licence/codelists/registry-regions.yaml b/products/evidence/fixtures/acceptance/professional-licence/codelists/registry-regions.yaml
new file mode 100644
index 000000000..8f6c747d4
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/professional-licence/codelists/registry-regions.yaml
@@ -0,0 +1,3 @@
+id: urn:example:fixture:codelist:registry-regions
+version: '1'
+codes: [RR-A, RR-B]
diff --git a/products/evidence/fixtures/acceptance/professional-licence/derivations/professional-licence.rhai b/products/evidence/fixtures/acceptance/professional-licence/derivations/professional-licence.rhai
new file mode 100644
index 000000000..486f73a7e
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/professional-licence/derivations/professional-licence.rhai
@@ -0,0 +1,25 @@
+fn derive(facts, selectors, evaluation_context) {
+    let starts = parse_date(required(facts.valid_from, "required_fact_missing"));
+    let ends = parse_date(required(facts.valid_until, "required_fact_missing"));
+    let state = required(facts.licence_state, "required_fact_missing");
+    let current = evaluation_context.legal_local_date;
+    let active =
+        state == evaluation_context.parameters.active_state &&
+        compare_dates(current, starts) >= 0 &&
+        compare_dates(current, ends) <= 0;
+    let remaining_days = integer_to_decimal(days_between(current, ends));
+    let category = bucket_number(
+        remaining_days,
+        evaluation_context.parameters.expiry_buckets
+    );
+    [
+        #{
+            concept_id: "urn:example:fixture:concept:licence-active",
+            value: active
+        },
+        #{
+            concept_id: "urn:example:fixture:concept:licence-expiry-category",
+            value: category
+        }
+    ]
+}
diff --git a/products/evidence/fixtures/acceptance/professional-licence/evidence.yaml b/products/evidence/fixtures/acceptance/professional-licence/evidence.yaml
new file mode 100644
index 000000000..94abfc1cc
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/professional-licence/evidence.yaml
@@ -0,0 +1,80 @@
+version: 1
+assuranceProfile: evidence-grade
+service: {providerId: urn:example:fixture:provider:evidence, trustDomain: urn:example:fixture:trust-domain:acceptance}
+issuer: {id: urn:example:fixture:issuer:authority}
+authentication: {kind: oidc-access-token, issuer: https://identity.invalid, audiences: [evidence-fixture], tokenTypes: [at+jwt], algorithms: [EdDSA], jwksUri: https://identity.invalid/.well-known/jwks.json, principalClaim: sub, requesterTagsClaim: evidence_tags, evidenceAudienceClaim: evidence_audience, grantIdClaim: evidence_grant_id, grantAuthorityClaim: evidence_authority}
+audit: {format: keyed-jsonl, hashSecretRef: secret:file/audit-hash-key, hashKeyVersion: 1, failClosed: true}
+subjectBinding: {secretRef: secret:file/subject-binding-key, keyVersion: 1}
+rateLimits: {requestsPerPrincipalPerMinute: 60, burstPerPrincipal: 10, failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 10}
+signing: {format: flattened-jws-json, algorithm: EdDSA, activeKeyId: fixture-key-2026-01, activeKeyRef: secret:file/signing-key, retiredPublicJwkFiles: [], jwksPath: /.well-known/evidence/jwks.json, maximumAssertionValiditySeconds: 86400, verifierClockSkewSeconds: 30}
+responseFormats: [signed-jws]
+
+selectorProfiles:
+  licence-register-v1:
+    maximumAggregateBytes: 128
+    fields:
+      licence_reference: {type: string, minimumBytes: 1, maximumBytes: 96}
+      registry_region: {type: controlled-code, codelist: codelists/registry-regions.yaml, codelistVersion: '1', maximumBytes: 16}
+sources:
+  source-c:
+    transport: http-json
+    baseUrl: https://source.invalid
+    posture: record-transformed
+    authentication: {kind: basic, usernameRef: secret:file/source-c-username, passwordRef: secret:file/source-c-password}
+    request:
+      method: GET
+      path: /v1/records
+      fixedHeaders: [{name: Accept, value: application/json}]
+      selectorInputs:
+        - role: subject
+          alternatives: [{profile: licence-register-v1, fields: [licence_reference, registry_region]}]
+      prepareScript: adapters/source-c-prepare.rhai
+      adapterParameters: {requestedFields: "licence_state,valid_from,valid_until", resultLimit: "2"}
+      adapterParametersSchema: schemas/adapter-parameters.schema.yaml
+      preparationLimits: {query: required, jsonBody: forbidden, maximumQueryPairs: 4, maximumQueryNameBytes: 64, maximumQueryValueBytes: 256, maximumNormalizedBytes: 4096}
+      projection: [/total, /records/*/licence_state, /records/*/valid_from, /records/*/valid_until]
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 131072
+      concurrencyLimit: 8
+    responseSchema: schemas/response.schema.yaml
+    extractScript: adapters/source-c.rhai
+    factSchema: schemas/facts.schema.yaml
+authorityProfiles:
+  statutory-caseworker-v1:
+    kind: statutory
+    requesterTags: [fixture-agency]
+    grants:
+      - requirement: urn:example:fixture:requirement:professional-licence-status:v1
+        purpose: fixture-registration
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects: [{role: subject, selectorProfile: licence-register-v1, valueOrigin: request}]
+requirements:
+  - id: urn:example:fixture:requirement:professional-licence-status:v1
+    kind: criterion
+    source: source-c
+    purposes: [fixture-registration]
+    subjectRoles: [{role: subject, cardinality: one, selectorProfiles: [licence-register-v1]}]
+    referenceFrameworks: [urn:example:fixture:framework:professional-licence:v1]
+    evidenceType: urn:example:fixture:evidence-type:professional-licence-status:v1
+    observationTimezone: Africa/Nairobi
+    validitySeconds: 43200
+    derivation:
+      script: derivations/professional-licence.rhai
+      parameters:
+        active_state: CURRENT
+        expiry_buckets:
+          - {minimumInclusive: {type: decimal, value: '-365000'}, maximumExclusive: {type: decimal, value: '0'}, code: expired}
+          - {minimumInclusive: {type: decimal, value: '0'}, maximumExclusive: {type: decimal, value: '31'}, code: within-30-days}
+          - {minimumInclusive: {type: decimal, value: '31'}, maximumExclusive: {type: decimal, value: '91'}, code: within-90-days}
+          - {minimumInclusive: {type: decimal, value: '91'}, maximumExclusive: {type: decimal, value: '365001'}, code: later}
+    concepts:
+      - {id: urn:example:fixture:concept:licence-active, form: boolean, required: true, constraints: {}}
+      - id: urn:example:fixture:concept:licence-expiry-category
+        form: controlled-category
+        required: true
+        constraints: {categoryScheme: urn:example:fixture:scheme:licence-expiry, schemeVersion: '1', maximumBytes: 32, codelist: codelists/expiry-categories.yaml}
+    fixtures: fixtures/cases.yaml
+    disclosureGuard: {families: [urn:example:fixture:disclosure-family:professional-licence]}
+    existenceDisclosure: collapse-unresolved
diff --git a/products/evidence/fixtures/acceptance/professional-licence/fixtures/cases.yaml b/products/evidence/fixtures/acceptance/professional-licence/fixtures/cases.yaml
new file mode 100644
index 000000000..753612430
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/professional-licence/fixtures/cases.yaml
@@ -0,0 +1,71 @@
+fixture: registry.evidence.acceptance.professional-licence/v1
+coequal_acceptance_definition: true
+synthetic_only: true
+common:
+  observed_at: '2026-08-02T00:00:00Z'
+  legal_local_date: '2026-08-02'
+  selector: {licence_reference: synthetic-licence-001, registry_region: RR-A}
+  selectors:
+    subject: {profile: licence-register-v1, values: {licence_reference: synthetic-licence-001, registry_region: RR-A}}
+  expectedRequestParts:
+    query:
+      - {name: licence_reference, value: synthetic-licence-001}
+      - {name: registry_region, value: RR-A}
+      - {name: fields, value: "licence_state,valid_from,valid_until"}
+      - {name: limit, value: "2"}
+    body: null
+  expectedTransport:
+    path: /v1/records
+    fixedHeaders: [{name: Accept, value: application/json}]
+cases:
+  - id: positive
+    source: {total: 1, records: [{licence_state: CURRENT, valid_from: '2025-01-01', valid_until: '2026-08-20', historical_states: [PENDING]}]}
+    expected_values: {licence-active: true, licence-expiry-category: within-30-days}
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+  - id: negative-inactive-is-success
+    source: {total: 1, records: [{licence_state: SUSPENDED, valid_from: '2025-01-01', valid_until: '2026-12-31', historical_states: [CURRENT]}]}
+    expected_values: {licence-active: false, licence-expiry-category: later}
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+  - id: boundary-valid-from
+    source: {total: 1, records: [{licence_state: CURRENT, valid_from: '2026-08-02', valid_until: '2026-12-31', historical_states: []}]}
+    expected_values: {licence-active: true, licence-expiry-category: later}
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+  - id: boundary-valid-until
+    source: {total: 1, records: [{licence_state: CURRENT, valid_from: '2025-01-01', valid_until: '2026-08-02', historical_states: []}]}
+    expected_values: {licence-active: true, licence-expiry-category: within-30-days}
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+  - id: boundary-after-valid-until
+    legal_local_date: '2026-08-03'
+    source: {total: 1, records: [{licence_state: CURRENT, valid_from: '2025-01-01', valid_until: '2026-08-02', historical_states: []}]}
+    expected_values: {licence-active: false, licence-expiry-category: expired}
+    expected_lookup: match
+    derivation_runs: true
+    signed_success: true
+  - id: missing-fact
+    source: {total: 1, records: [{licence_state: CURRENT, valid_from: '2025-01-01', historical_states: []}]}
+    expected_public_problem: evidence_not_available
+    derivation_runs: false
+    signed_success: false
+  - {id: missing-record, source: {total: 0, records: []}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: no-match, source: {total: 0, records: []}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: ambiguous, source: {total: 2, records: [{}, {}]}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: source-failure, source_failure: wrong-media-type, expected_public_problem: dependency_unavailable, signed_success: false}
+  - id: negative-exact-date-leak
+    injected_derivation:
+      - {concept_id: urn:example:fixture:concept:licence-active, value: true}
+      - {concept_id: urn:example:fixture:concept:licence-expiry-category, value: '2026-08-20'}
+    expected: output-gate-rejection
+  - {id: anti-reconstruction, companion_bundle: coexisting-revisions, expected: bundle-rejection}
+privacy_expectation:
+  evidence_contains: [urn:example:fixture:concept:licence-active, urn:example:fixture:concept:licence-expiry-category]
+  evidence_excludes: [valid_from, valid_until, historical_states, licence_reference, registry_region]
+  diagnostics_exclude: [synthetic-licence-001, '2026-08-20', PENDING, CURRENT]
+  minimization_claim: disclosure minimization only
diff --git a/products/evidence/fixtures/acceptance/professional-licence/schemas/adapter-parameters.schema.yaml b/products/evidence/fixtures/acceptance/professional-licence/schemas/adapter-parameters.schema.yaml
new file mode 100644
index 000000000..40a08a8cc
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/professional-licence/schemas/adapter-parameters.schema.yaml
@@ -0,0 +1,6 @@
+type: object
+additionalProperties: false
+required: [requestedFields, resultLimit]
+properties:
+  requestedFields: {const: "licence_state,valid_from,valid_until"}
+  resultLimit: {const: "2"}
diff --git a/products/evidence/fixtures/acceptance/professional-licence/schemas/facts.schema.yaml b/products/evidence/fixtures/acceptance/professional-licence/schemas/facts.schema.yaml
new file mode 100644
index 000000000..c23fa7fb3
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/professional-licence/schemas/facts.schema.yaml
@@ -0,0 +1,7 @@
+type: object
+additionalProperties: false
+required: [licence_state, valid_from, valid_until]
+properties:
+  licence_state: {type: string, minLength: 1, maxLength: 32}
+  valid_from: {type: string, format: date}
+  valid_until: {type: string, format: date}
diff --git a/products/evidence/fixtures/acceptance/professional-licence/schemas/response.schema.yaml b/products/evidence/fixtures/acceptance/professional-licence/schemas/response.schema.yaml
new file mode 100644
index 000000000..bacd66c70
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/professional-licence/schemas/response.schema.yaml
@@ -0,0 +1,17 @@
+type: object
+additionalProperties: false
+required: [total, records]
+properties:
+  total: {type: integer, minimum: 0, maximum: 1000000}
+  records:
+    type: array
+    minItems: 0
+    maxItems: 2
+    items:
+      type: object
+      additionalProperties: false
+      required: []
+      properties:
+        licence_state: {type: string, minLength: 1, maxLength: 32}
+        valid_from: {type: string, format: date}
+        valid_until: {type: string, format: date}
diff --git a/products/evidence/fixtures/acceptance/residence-region/adapters/source-b-prepare.rhai b/products/evidence/fixtures/acceptance/residence-region/adapters/source-b-prepare.rhai
new file mode 100644
index 000000000..3f461b1e0
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/residence-region/adapters/source-b-prepare.rhai
@@ -0,0 +1,11 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"];
+    #{
+        query: [],
+        body: #{
+            lookup: #{record_reference: subject["values"]["record_reference"]},
+            fields: parameters["requestedFields"],
+            limit: parameters["resultLimit"]
+        }
+    }
+}
diff --git a/products/evidence/fixtures/acceptance/residence-region/adapters/source-b.rhai b/products/evidence/fixtures/acceptance/residence-region/adapters/source-b.rhai
new file mode 100644
index 000000000..a2af00768
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/residence-region/adapters/source-b.rhai
@@ -0,0 +1,13 @@
+fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    if total == 0 {
+        if len(source_response) != 1 { throw("source_protocol_error"); }
+        return #{outcome: "no_match"};
+    }
+    if total > 1 { return #{outcome: "ambiguous"}; }
+    let official_residence_code = get_path(source_response, "/official_residence_code");
+    if is_missing(official_residence_code) {
+        return #{outcome: "match", facts: #{}};
+    }
+    #{outcome: "match", facts: #{official_residence_code: official_residence_code}}
+}
diff --git a/products/evidence/fixtures/acceptance/residence-region/codelists/region-map.yaml b/products/evidence/fixtures/acceptance/residence-region/codelists/region-map.yaml
new file mode 100644
index 000000000..61e8637f2
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/residence-region/codelists/region-map.yaml
@@ -0,0 +1,7 @@
+id: urn:example:fixture:codelist:region-map
+version: '2026-01'
+entries:
+  R-101: REGION-NORTH
+  R-102: REGION-NORTH
+  R-201: REGION-SOUTH
+allowed_outputs: [REGION-NORTH, REGION-SOUTH]
diff --git a/products/evidence/fixtures/acceptance/residence-region/derivations/residence-region.rhai b/products/evidence/fixtures/acceptance/residence-region/derivations/residence-region.rhai
new file mode 100644
index 000000000..cb374e56d
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/residence-region/derivations/residence-region.rhai
@@ -0,0 +1,10 @@
+fn derive(facts, selectors, evaluation_context) {
+    let mapped = codelist_lookup(
+        evaluation_context.codelists["region-map"],
+        required(facts.official_residence_code, "required_fact_missing")
+    );
+    [#{
+        concept_id: "urn:example:fixture:concept:residence-region",
+        value: required(mapped, "unknown_controlled_code")
+    }]
+}
diff --git a/products/evidence/fixtures/acceptance/residence-region/evidence.yaml b/products/evidence/fixtures/acceptance/residence-region/evidence.yaml
new file mode 100644
index 000000000..e45d2a61e
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/residence-region/evidence.yaml
@@ -0,0 +1,68 @@
+version: 1
+assuranceProfile: evidence-grade
+service: {providerId: urn:example:fixture:provider:evidence, trustDomain: urn:example:fixture:trust-domain:acceptance}
+issuer: {id: urn:example:fixture:issuer:authority}
+authentication: {kind: oidc-access-token, issuer: https://identity.invalid, audiences: [evidence-fixture], tokenTypes: [at+jwt], algorithms: [EdDSA], jwksUri: https://identity.invalid/.well-known/jwks.json, principalClaim: sub, requesterTagsClaim: evidence_tags, evidenceAudienceClaim: evidence_audience, grantIdClaim: evidence_grant_id, grantAuthorityClaim: evidence_authority}
+audit: {format: keyed-jsonl, hashSecretRef: secret:file/audit-hash-key, hashKeyVersion: 1, failClosed: true}
+subjectBinding: {secretRef: secret:file/subject-binding-key, keyVersion: 1}
+rateLimits: {requestsPerPrincipalPerMinute: 60, burstPerPrincipal: 10, failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 10}
+signing: {format: flattened-jws-json, algorithm: EdDSA, activeKeyId: fixture-key-2026-01, activeKeyRef: secret:file/signing-key, retiredPublicJwkFiles: [], jwksPath: /.well-known/evidence/jwks.json, maximumAssertionValiditySeconds: 86400, verifierClockSkewSeconds: 30}
+responseFormats: [signed-jws]
+
+selectorProfiles:
+  residence-record-v1:
+    maximumAggregateBytes: 96
+    fields: {record_reference: {type: string, minimumBytes: 1, maximumBytes: 96}}
+sources:
+  source-b:
+    transport: http-json
+    baseUrl: https://source.invalid
+    posture: field-projected
+    authentication: {kind: static-bearer, tokenRef: secret:file/source-b-token}
+    request:
+      method: POST
+      path: /v1/facts
+      fixedHeaders: [{name: Accept, value: application/json}]
+      selectorInputs:
+        - role: subject
+          alternatives: [{profile: residence-record-v1, fields: [record_reference]}]
+      prepareScript: adapters/source-b-prepare.rhai
+      adapterParameters: {requestedFields: [official_residence_code], resultLimit: 2}
+      adapterParametersSchema: schemas/adapter-parameters.schema.yaml
+      preparationLimits: {query: forbidden, jsonBody: required, maximumJsonDepth: 8, maximumCollectionItems: 16, maximumStringBytes: 256, maximumNormalizedBytes: 4096}
+      projection: [/total, /official_residence_code]
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 8
+    responseSchema: schemas/response.schema.yaml
+    extractScript: adapters/source-b.rhai
+    factSchema: schemas/facts.schema.yaml
+authorityProfiles:
+  statutory-caseworker-v1:
+    kind: statutory
+    requesterTags: [fixture-agency]
+    grants:
+      - requirement: urn:example:fixture:requirement:residence-region:v1
+        purpose: fixture-routing
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects: [{role: subject, selectorProfile: residence-record-v1, valueOrigin: request}]
+requirements:
+  - id: urn:example:fixture:requirement:residence-region:v1
+    kind: information-requirement
+    source: source-b
+    purposes: [fixture-routing]
+    subjectRoles: [{role: subject, cardinality: one, selectorProfiles: [residence-record-v1]}]
+    referenceFrameworks: [urn:example:fixture:framework:residence-region:v1]
+    evidenceType: urn:example:fixture:evidence-type:residence-region:v1
+    validitySeconds: 86400
+    derivation: {script: derivations/residence-region.rhai, parameters: {}}
+    concepts:
+      - id: urn:example:fixture:concept:residence-region
+        form: controlled-code
+        required: true
+        constraints: {codelist: codelists/region-map.yaml, codelistVersion: '2026-01', maximumBytes: 32}
+    fixtures: fixtures/cases.yaml
+    disclosureGuard: {families: [urn:example:fixture:disclosure-family:residence-region]}
+    existenceDisclosure: collapse-unresolved
diff --git a/products/evidence/fixtures/acceptance/residence-region/fixtures/cases.yaml b/products/evidence/fixtures/acceptance/residence-region/fixtures/cases.yaml
new file mode 100644
index 000000000..5db868b11
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/residence-region/fixtures/cases.yaml
@@ -0,0 +1,30 @@
+fixture: registry.evidence.acceptance.residence-region/v1
+coequal_acceptance_definition: true
+synthetic_only: true
+common:
+  observed_at: '2026-08-02T00:00:00Z'
+  selector: {record_reference: synthetic-residence-record-001}
+  selectors:
+    subject: {profile: residence-record-v1, values: {record_reference: synthetic-residence-record-001}}
+  expectedRequestParts:
+    query: []
+    body: {lookup: {record_reference: synthetic-residence-record-001}, fields: [official_residence_code], limit: 2}
+  expectedTransport:
+    path: /v1/facts
+    fixedHeaders: [{name: Accept, value: application/json}]
+cases:
+  - {id: positive, source: {total: 1, official_residence_code: R-101}, expected_value: REGION-NORTH, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: negative-unknown-code, source: {total: 1, official_residence_code: R-999}, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: boundary-second-source-code-same-coarse-region, source: {total: 1, official_residence_code: R-102}, expected_value: REGION-NORTH, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: boundary-other-coarse-region, source: {total: 1, official_residence_code: R-201}, expected_value: REGION-SOUTH, expected_lookup: match, derivation_runs: true, signed_success: true}
+  - {id: negative-overly-precise-output, injected_derivation: [{concept_id: urn:example:fixture:concept:residence-region, value: R-101}], expected: output-gate-rejection}
+  - {id: missing-fact, source: {total: 1}, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: missing-record, source: {total: 0}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: no-match, source: {total: 0}, expected_lookup: no_match, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: ambiguous, source: {total: 2}, expected_lookup: ambiguous, expected_public_problem: evidence_not_available, derivation_runs: false, signed_success: false}
+  - {id: source-failure, source_failure: http-503, expected_public_problem: dependency_unavailable, signed_success: false}
+  - {id: anti-reconstruction, companion_bundle: geographic-overlap, expected: bundle-rejection}
+privacy_expectation:
+  evidence_contains: [urn:example:fixture:concept:residence-region, REGION-NORTH]
+  evidence_excludes: [official_residence_code, record_reference, R-101, R-102]
+  diagnostics_exclude: [synthetic-residence-record-001, R-101, R-102, REGION-NORTH]
diff --git a/products/evidence/fixtures/acceptance/residence-region/schemas/adapter-parameters.schema.yaml b/products/evidence/fixtures/acceptance/residence-region/schemas/adapter-parameters.schema.yaml
new file mode 100644
index 000000000..39fc57931
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/residence-region/schemas/adapter-parameters.schema.yaml
@@ -0,0 +1,7 @@
+type: object
+additionalProperties: false
+required: [requestedFields, resultLimit]
+properties:
+  requestedFields:
+    const: [official_residence_code]
+  resultLimit: {const: 2}
diff --git a/products/evidence/fixtures/acceptance/residence-region/schemas/facts.schema.yaml b/products/evidence/fixtures/acceptance/residence-region/schemas/facts.schema.yaml
new file mode 100644
index 000000000..d3e45d7b6
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/residence-region/schemas/facts.schema.yaml
@@ -0,0 +1,5 @@
+type: object
+additionalProperties: false
+required: [official_residence_code]
+properties:
+  official_residence_code: {type: string, minLength: 1, maxLength: 32}
diff --git a/products/evidence/fixtures/acceptance/residence-region/schemas/response.schema.yaml b/products/evidence/fixtures/acceptance/residence-region/schemas/response.schema.yaml
new file mode 100644
index 000000000..70d83308f
--- /dev/null
+++ b/products/evidence/fixtures/acceptance/residence-region/schemas/response.schema.yaml
@@ -0,0 +1,6 @@
+type: object
+additionalProperties: false
+required: [total]
+properties:
+  total: {type: integer, minimum: 0, maximum: 1000000}
+  official_residence_code: {type: string, minLength: 1, maxLength: 32}
diff --git a/products/evidence/fixtures/conformance/acquisition-postures.yaml b/products/evidence/fixtures/conformance/acquisition-postures.yaml
new file mode 100644
index 000000000..b953cb24f
--- /dev/null
+++ b/products/evidence/fixtures/conformance/acquisition-postures.yaml
@@ -0,0 +1,27 @@
+fixture: registry.evidence.acquisition-postures/v1
+synthetic_only: true
+cases:
+  - posture: source-derived
+    source_response: {total: 1, result: {final_code: C-A}}
+    declared_facts: [final_code]
+    derive: exact final code only
+    expected_claim: acquisition and disclosure minimization
+    negative: source-returns-undeclared-field
+  - posture: field-projected
+    source_response: {total: 1, result: {fact_a: '2000-02-29', fact_b: C-B}}
+    declared_facts: [fact_a, fact_b]
+    derive: declared concept value from only projected facts
+    expected_claim: strong acquisition and disclosure minimization
+    negative: fixed-projection-expanded
+  - posture: record-transformed
+    source_response: {total: 1, result: {fact_a: C-A, legacy_field: synthetic-source-canary, historical_entries: [S-OLD]}}
+    declared_facts: [fact_a, legacy_field, historical_entries]
+    derive: declared minimized concept from fact_a only
+    expected_claim: disclosure minimization only
+    negative: full-lifecycle-minimization-overclaim
+shared_expectations:
+  - same fixed HTTP JSON executor and Rhai ABI
+  - exactly one evidence-data request
+  - response and facts remain in one bounded evaluation
+  - no raw field reaches evidence, audit, logs, errors, snapshots, or disk
+  - declared posture is included in bundle review metadata, never caller-selected
diff --git a/products/evidence/fixtures/conformance/anti-reconstruction.yaml b/products/evidence/fixtures/conformance/anti-reconstruction.yaml
new file mode 100644
index 000000000..3add8c956
--- /dev/null
+++ b/products/evidence/fixtures/conformance/anti-reconstruction.yaml
@@ -0,0 +1,51 @@
+fixture: registry.evidence.anti-reconstruction/v1
+synthetic_only: true
+rejected_bundles:
+  - id: threshold-ladder
+    shared_disclosure_family: urn:example:fixture:disclosure-family:protected-scalar-a
+    definitions:
+      - {concept: urn:example:fixture:concept:threshold-a, parameter: 18, requester: requester-a}
+      - {concept: urn:example:fixture:concept:threshold-b, parameter: 19, requester: requester-a}
+      - {concept: urn:example:fixture:concept:threshold-c, parameter: 20, requester: requester-a}
+    threat: Repeated booleans narrow a protected scalar.
+    expected: reject complete enabled bundle even with rate limits
+  - id: geographic-overlap
+    shared_disclosure_family: urn:example:fixture:disclosure-family:protected-partition-a
+    definitions:
+      - {concept: urn:example:fixture:concept:area-a, partition: coarse-a, requester: requester-a}
+      - {concept: urn:example:fixture:concept:area-b, partition: overlapping-b, requester: requester-a}
+    threat: Intersecting partitions disclose a more precise location.
+    expected: reject unless authorization separation proves the answers cannot be combined
+  - id: coexisting-revisions
+    shared_disclosure_family: urn:example:fixture:disclosure-family:protected-revision-a
+    definitions:
+      - {concept: urn:example:fixture:concept:status, revision: v1, requester: requester-a}
+      - {concept: urn:example:fixture:concept:status, revision: v2, requester: requester-a}
+    threat: Changed boundaries disclose the underlying fact.
+    expected: reject unsafe simultaneous authorization
+  - id: relationship-graph
+    shared_disclosure_family: urn:example:fixture:disclosure-family:protected-relationship-a
+    definitions:
+      - {concept: urn:example:fixture:concept:relationship-a, roles: [subject-a, subject-b]}
+      - {concept: urn:example:fixture:concept:relationship-b, roles: [subject-b, subject-c]}
+    threat: Combinations reconstruct an unapproved family or association graph.
+    expected: reject unsafe relationship combination
+allowed_control:
+  id: unrelated-minimized-concepts
+  definitions:
+    - urn:example:fixture:concept:code-a
+    - urn:example:fixture:concept:boolean-b
+  review_evidence: No shared protected source fact, partition intersection, threshold ladder, or relationship graph under the same authorization surface.
+bundle_validation:
+  rule: Any two enabled requirements sharing a disclosureGuard family reject the complete bundle at startup.
+  applies_to: [threshold-ladders, overlapping-partitions, coexisting-revisions, relationship-graph-definitions]
+  rate_limits: Never make a shared-family bundle valid.
+  scope: Static disclosure-combination validation only; this is not a runtime policy engine.
+existence_collapse:
+  internal: [no_match, ambiguous, required_fact_missing]
+  public:
+    status: 422
+    code: evidence_not_available
+    title: Evidence could not be produced
+    exact_body_shape_equal: true
+  prohibited: [candidate_count, score, near_match_hint, field_comparison, class-specific-message]
diff --git a/products/evidence/fixtures/conformance/audit-events.yaml b/products/evidence/fixtures/conformance/audit-events.yaml
new file mode 100644
index 000000000..e4e32ef14
--- /dev/null
+++ b/products/evidence/fixtures/conformance/audit-events.yaml
@@ -0,0 +1,90 @@
+fixture: registry.evidence.audit-events/v1
+synthetic_only: true
+access_attempt:
+  schema: registry.evidence.audit/v1
+  assuranceProfile: evidence-grade
+  eventId: urn:example:fixture:audit:access-001
+  occurredAt: '2026-08-02T00:00:00Z'
+  operation: fixture-operation-00000001
+  phase: access-attempt
+  requirement: urn:example:fixture:requirement:property:v1
+  bundleRevision: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+  purpose: fixture-procedure
+  requesterPseudonym: hmac-sha256:v1:1111111111111111111111111111111111111111111111111111111111111111
+  authority: {kind: statutory}
+  subjects:
+    - role: subject
+      selectorProfile: opaque-record-v1
+      selectorBundlePseudonym: hmac-sha256:v1:2222222222222222222222222222222222222222222222222222222222222222
+  responseProtection: signed
+  sourceId: source-a
+  adapterId: adapter-a
+  decision: authorized
+  durationMilliseconds: 2
+disclosure_release:
+  schema: registry.evidence.audit/v1
+  assuranceProfile: evidence-grade
+  eventId: urn:example:fixture:audit:release-001
+  occurredAt: '2026-08-02T00:00:01Z'
+  operation: fixture-operation-00000001
+  phase: disclosure-release
+  requirement: urn:example:fixture:requirement:property:v1
+  bundleRevision: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+  purpose: fixture-procedure
+  requesterPseudonym: hmac-sha256:v1:1111111111111111111111111111111111111111111111111111111111111111
+  authority: {kind: statutory}
+  subjects:
+    - role: subject
+      selectorProfile: opaque-record-v1
+      selectorBundlePseudonym: hmac-sha256:v1:2222222222222222222222222222222222222222222222222222222222222222
+  responseProtection: signed
+  sourceId: source-a
+  adapterId: adapter-a
+  decision: released
+  disclosedConcepts: [urn:example:fixture:concept:boolean-a]
+  evidenceId: urn:example:fixture:evidence:001
+  signingKeyId: fixture-key-2026-01
+  durationMilliseconds: 12
+unsigned_disclosure_release:
+  schema: registry.evidence.audit/v1
+  assuranceProfile: evidence-grade
+  eventId: urn:example:fixture:audit:release-002
+  occurredAt: '2026-08-02T00:00:02Z'
+  operation: fixture-operation-00000001
+  phase: disclosure-release
+  requirement: urn:example:fixture:requirement:property:v1
+  bundleRevision: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+  purpose: fixture-procedure
+  requesterPseudonym: hmac-sha256:v1:1111111111111111111111111111111111111111111111111111111111111111
+  authority: {kind: statutory}
+  subjects:
+    - role: subject
+      selectorProfile: opaque-record-v1
+      selectorBundlePseudonym: hmac-sha256:v1:2222222222222222222222222222222222222222222222222222222222222222
+  responseProtection: unsigned
+  sourceId: source-a
+  adapterId: adapter-a
+  decision: released
+  disclosedConcepts: [urn:example:fixture:concept:boolean-a]
+  evidenceId: urn:example:fixture:evidence:001
+  durationMilliseconds: 12
+negative:
+  - raw-principal
+  - raw-actor-or-grant
+  - raw-selector-value
+  - separate-field-hash
+  - plain-sha256-subject-hash
+  - base64url-reencoded-audit-hmac
+  - globally-stable-subject-pseudonym
+  - source-or-supported-value
+  - credential-token-or-private-key
+  - candidate-count-score-hint-or-comparison
+  - release-fields-on-access-event
+  - missing-release-fields-on-release-event
+  - signing-key-on-unsigned-release-event
+  - missing-signing-key-on-signed-release-event
+  - request-nonce-in-any-event
+order:
+  access_attempt_durable_before: [credential-resolution, source-access]
+  disclosure_release_durable_after: [signing]
+  disclosure_release_durable_before: [response-release]
diff --git a/products/evidence/fixtures/conformance/coverage-matrix.yaml b/products/evidence/fixtures/conformance/coverage-matrix.yaml
new file mode 100644
index 000000000..8884c8679
--- /dev/null
+++ b/products/evidence/fixtures/conformance/coverage-matrix.yaml
@@ -0,0 +1,176 @@
+fixture: registry.evidence.phase-zero-coverage/v1
+status: frozen
+completion_rule: Every required row is implemented and green on one revision; no acceptance definition is a seed, phase, optional example, or later generality check.
+categories: [positive, negative, boundary, missing, no-match, ambiguous, source-failure, anti-reconstruction]
+acceptance_definitions:
+  - definition: adult-status
+    bundle: ../acceptance/adult-status/evidence.yaml
+    cases: ../acceptance/adult-status/fixtures/cases.yaml
+    selector: compound no identifier
+    posture: field-projected
+    supported_values: [boolean]
+    coverage:
+      positive: positive
+      negative: [negative-false-is-success, negative-wrong-derived-type]
+      boundary: [boundary-before, boundary-on, boundary-after, boundary-leap-day]
+      missing: [missing-record, missing-fact]
+      no-match: no-match
+      ambiguous: ambiguous
+      source-failure: source-failure
+      anti-reconstruction: threshold-ladder
+  - definition: residence-region
+    bundle: ../acceptance/residence-region/evidence.yaml
+    cases: ../acceptance/residence-region/fixtures/cases.yaml
+    selector: identifier only
+    posture: field-projected
+    supported_values: [controlled-code]
+    coverage:
+      positive: positive
+      negative: [negative-unknown-code, negative-overly-precise-output]
+      boundary: [boundary-second-source-code-same-coarse-region, boundary-other-coarse-region]
+      missing: [missing-record, missing-fact]
+      no-match: no-match
+      ambiguous: ambiguous
+      source-failure: source-failure
+      anti-reconstruction: geographic-overlap
+  - definition: professional-licence-status
+    bundle: ../acceptance/professional-licence/evidence.yaml
+    cases: ../acceptance/professional-licence/fixtures/cases.yaml
+    selector: compound sector selector
+    posture: record-transformed
+    supported_values: [boolean, controlled-category]
+    coverage:
+      positive: positive
+      negative: [negative-inactive-is-success, negative-exact-date-leak]
+      boundary: [boundary-valid-from, boundary-valid-until, boundary-after-valid-until]
+      missing: [missing-record, missing-fact]
+      no-match: no-match
+      ambiguous: ambiguous
+      source-failure: source-failure
+      anti-reconstruction: coexisting-revisions
+  - definition: legal-parent-relationship
+    bundle: ../acceptance/legal-parent-relationship/evidence.yaml
+    cases: ../acceptance/legal-parent-relationship/fixtures/cases.yaml
+    selector: two independently role-bound profiles
+    posture: source-derived
+    supported_values: [boolean]
+    coverage:
+      positive: positive
+      negative: [negative-false-is-success, negative-swapped-roles, negative-caller-candidate-substitution, negative-child-unresolved, negative-candidate-unresolved-or-typo, negative-raw-record-search-zero-not-false, negative-role-resolution-ambiguous, negative-extra-family-fact, negative-status-on-none, negative-status-on-ambiguous, negative-unknown-pair-resolution, negative-unknown-relationship-status, negative-relationship-status-type, negative-extra-source-field]
+      boundary: boundary-correct-role-order
+      missing: [missing-record, missing-fact]
+      no-match: no-match
+      ambiguous: ambiguous
+      source-failure: source-failure
+      anti-reconstruction: relationship-graph
+selector_matrix:
+  fixture: selector-matrix.yaml
+  required:
+    - identifier-only
+    - compound-no-identifier
+    - added-disambiguator
+    - multi-role
+    - opaque-non-domain-field-names
+  origins:
+    request: identifier-only
+    authenticated-context: compound-no-identifier
+    authenticated-grant: added-disambiguator
+  pre_source_rejections:
+    - missing, unknown, extra, mistyped, empty, oversized, and aggregate-oversized fields
+    - unauthorized profile, role, purpose, audience, or value origin
+    - caller values on context-derived or grant-derived profiles
+    - absent caller values on an authorized request-derived profile
+    - caller-added disambiguator and inferred alternative sufficient field set
+  opaque_behavior: Unicode and multipart name-like strings are exact bounded UTF-8 with no normalization, transliteration, tokenization, phonetics, or partial-date matching.
+supported_values:
+  fixture: supported-values.yaml
+  forms:
+    - boolean
+    - controlled-code
+    - controlled-category
+    - bounded-integer
+    - bounded-decimal
+    - date-bucket
+    - time-bucket
+    - audience-scoped-entity-reference
+    - controlled-code-list
+    - entity-reference-list
+    - reviewed-structured-value
+  each_requires: [positive, boundary, wrong-type, range-or-code, size, cardinality-where-applicable, evidence-construction, jws-round-trip]
+  special:
+    decimal: custom exact Decimal from canonical string, precision 28 and scale 9, public canonical JSON string, no f32/f64
+    entity_reference: protected seed or seed list is HMAC-projected by Rust and never disclosed
+acquisition_postures:
+  fixture: acquisition-postures.yaml
+  required: [source-derived, field-projected, record-transformed]
+  honesty_test: record-transformed may claim disclosure minimization only
+source_shapes:
+  index: ../source-shapes/index.yaml
+  profiles:
+  - profile: flat-rest
+    request: fixed JSON POST
+    authentication: static-bearer
+    outcomes: [no-match, match, ambiguous, missing-fact]
+  - profile: nested-paged-rest
+    request: fixed GET query, fields, pageSize two
+    authentication: basic
+    outcomes: [no-match, match, ambiguous, missing-fact, pager-refusal]
+  - profile: opencrvs-event-search-json
+    request: fixed OpenCRVS version 2 JSON POST to /events/search after credential bootstrap
+    authentication: oauth2-client-credentials
+    posture: record-transformed
+    outcomes: [no-match, match, ambiguous, missing-fact, inconsistent-cardinality]
+  common_failures: [401, 403, 429, 5xx, timeout, redirect, invalid-json, wrong-media-type, oversized-response]
+  common_invariants:
+    - one evidence-data request and no page traversal
+    - maximum two bounded results solely for cardinality; profiles that cannot field-project declare record-transformed
+    - no candidates, count beyond closed outcome, score, hint, or comparison in derivation or public surfaces
+    - raw selectors, credentials, token flows, source values, and bodies absent from diagnostics and audit
+  oauth_credential_redaction: oauth-credential-redaction.yaml
+public_contracts:
+  requests_and_payloads: golden/
+  jws: jws-cases.yaml
+  sd_jwt_vc: sd-jwt-vc-cases.yaml
+  audit: audit-events.yaml
+  problems: ../../contracts/problem-contract.yaml
+security_negative_tests:
+  - sec-unknown-or-disabled-requirement
+  - sec-caller-query-material-rejected
+  - sec-unsafe-definition-combination
+  - sec-missing-principal-no-fallback
+  - sec-no-entitlement-union
+  - sec-selector-possession-no-authority
+  - sec-caller-grant-reference-rejected
+  - sec-selector-shape-not-callable
+  - sec-source-request-immutable
+  - sec-candidate-material-rejected
+  - sec-rhai-output-shape-closed
+  - sec-derived-value-output-gate
+  - sec-evaluation-and-audit-fail-closed
+  - sec-source-canary-absent-everywhere
+  - sec-protected-canaries-redacted
+  - sec-unresolved-public-collapse
+  - sec-subject-binding-scope
+  - sec-runtime-bundle-mutation-absent
+  - sec-mutually-distrustful-configuration
+  - sec-rate-limit-does-not-legalize-ladder
+  - sec-jws-mutation-and-duplicate-payload
+  - sec-signing-failure-no-release
+  - sec-private-key-canary-unreachable
+  - sec-verifier-rejects-untrusted-provider
+  - sec-script-cannot-construct-evidence
+  - sec-missing-or-writable-bundle-fails
+  - sec-audit-order-and-failure
+  - sec-secret-values-rejected-from-bundle
+  - sec-proxy-identity-header-rejected
+  - sec-decimal-no-float-coercion
+  - sec-entity-reference-seed-protected
+  - sec-request-preparation-closed
+  - sec-runtime-cannot-override-governed-bundle
+  - sec-tls-and-proxy-authority-fixed
+  - sec-subject-array-order-nonsemantic
+canary_scan_surfaces: [evidence, jws, public-problem, log, metric, trace, audit, snapshot, panic, temporary-file, test-failure-output]
+canary_classes: [principal, actor, grant, selector, source-fact, supported-value, source-credential, oauth-client, oauth-token, signing-key, entity-reference-seed]
+coequal_full_path:
+  for_each: [offline-evaluation, authentication, authorization, access-audit, source-execution, extraction, derivation, output-gate, evidence-construction, signing, release-audit, jws-verification]
+  together: all four definitions enabled in one immutable bundle and one operator trust domain, including concurrency isolation
diff --git a/products/evidence/fixtures/conformance/golden/adult-evidence.json b/products/evidence/fixtures/conformance/golden/adult-evidence.json
new file mode 100644
index 000000000..56dab8c92
--- /dev/null
+++ b/products/evidence/fixtures/conformance/golden/adult-evidence.json
@@ -0,0 +1,29 @@
+{
+  "schema": "registry.assertion-evidence/v1",
+  "assuranceProfile": "evidence-grade",
+  "requestNonce": "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I",
+  "id": "urn:example:fixture:evidence:adult-001",
+  "type": "Evidence",
+  "supportsRequirement": "urn:example:fixture:requirement:adult-status:v1",
+  "isConformantTo": "urn:example:fixture:evidence-type:adult-status:v1",
+  "issuedBy": "urn:example:fixture:issuer:authority",
+  "providedBy": "urn:example:fixture:provider:evidence",
+  "issuedAt": "2026-08-02T00:00:00Z",
+  "observedAt": "2026-08-02T00:00:00Z",
+  "validUntil": "2026-08-03T00:00:00Z",
+  "purpose": "fixture-eligibility",
+  "audience": "urn:example:fixture:audience:requester-a",
+  "configurationRevision": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "subjects": [
+    {
+      "role": "subject",
+      "binding": "urn:evidence:subject:v1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+    }
+  ],
+  "supportedValues": [
+    {
+      "providesValueFor": "urn:example:fixture:concept:adult-status",
+      "value": true
+    }
+  ]
+}
diff --git a/products/evidence/fixtures/conformance/golden/adult-request.json b/products/evidence/fixtures/conformance/golden/adult-request.json
new file mode 100644
index 000000000..dc7a996ef
--- /dev/null
+++ b/products/evidence/fixtures/conformance/golden/adult-request.json
@@ -0,0 +1,18 @@
+{
+  "requestNonce": "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I",
+  "requirement": "urn:example:fixture:requirement:adult-status:v1",
+  "purpose": "fixture-eligibility",
+  "subjects": [
+    {
+      "role": "subject",
+      "selector": {
+        "profile": "person-demographics-v1",
+        "values": {
+          "given_name": "Amina",
+          "family_name": "Diallo",
+          "birth_date": "2000-01-01"
+        }
+      }
+    }
+  ]
+}
diff --git a/products/evidence/fixtures/conformance/golden/licence-evidence.json b/products/evidence/fixtures/conformance/golden/licence-evidence.json
new file mode 100644
index 000000000..a571f4733
--- /dev/null
+++ b/products/evidence/fixtures/conformance/golden/licence-evidence.json
@@ -0,0 +1,33 @@
+{
+  "schema": "registry.assertion-evidence/v1",
+  "assuranceProfile": "evidence-grade",
+  "requestNonce": "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I",
+  "id": "urn:example:fixture:evidence:licence-001",
+  "type": "Evidence",
+  "supportsRequirement": "urn:example:fixture:requirement:professional-licence-status:v1",
+  "isConformantTo": "urn:example:fixture:evidence-type:professional-licence-status:v1",
+  "issuedBy": "urn:example:fixture:issuer:authority",
+  "providedBy": "urn:example:fixture:provider:evidence",
+  "issuedAt": "2026-08-02T00:00:00Z",
+  "observedAt": "2026-08-02T00:00:00Z",
+  "validUntil": "2026-08-02T12:00:00Z",
+  "purpose": "fixture-registration",
+  "audience": "urn:example:fixture:audience:requester-a",
+  "configurationRevision": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "subjects": [
+    {
+      "role": "subject",
+      "binding": "urn:evidence:subject:v1_CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
+    }
+  ],
+  "supportedValues": [
+    {
+      "providesValueFor": "urn:example:fixture:concept:licence-active",
+      "value": true
+    },
+    {
+      "providesValueFor": "urn:example:fixture:concept:licence-expiry-category",
+      "value": "within-30-days"
+    }
+  ]
+}
diff --git a/products/evidence/fixtures/conformance/golden/licence-request.json b/products/evidence/fixtures/conformance/golden/licence-request.json
new file mode 100644
index 000000000..e0bfe0540
--- /dev/null
+++ b/products/evidence/fixtures/conformance/golden/licence-request.json
@@ -0,0 +1,17 @@
+{
+  "requestNonce": "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I",
+  "requirement": "urn:example:fixture:requirement:professional-licence-status:v1",
+  "purpose": "fixture-registration",
+  "subjects": [
+    {
+      "role": "subject",
+      "selector": {
+        "profile": "licence-register-v1",
+        "values": {
+          "licence_reference": "synthetic-licence-001",
+          "registry_region": "RR-A"
+        }
+      }
+    }
+  ]
+}
diff --git a/products/evidence/fixtures/conformance/golden/relationship-evidence.json b/products/evidence/fixtures/conformance/golden/relationship-evidence.json
new file mode 100644
index 000000000..adb90ef0a
--- /dev/null
+++ b/products/evidence/fixtures/conformance/golden/relationship-evidence.json
@@ -0,0 +1,33 @@
+{
+  "schema": "registry.assertion-evidence/v1",
+  "assuranceProfile": "evidence-grade",
+  "requestNonce": "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I",
+  "id": "urn:example:fixture:evidence:relationship-001",
+  "type": "Evidence",
+  "supportsRequirement": "urn:example:fixture:requirement:legal-parent-relationship:v1",
+  "isConformantTo": "urn:example:fixture:evidence-type:legal-parent-relationship:v1",
+  "issuedBy": "urn:example:fixture:issuer:authority",
+  "providedBy": "urn:example:fixture:provider:evidence",
+  "issuedAt": "2026-08-02T00:00:00Z",
+  "observedAt": "2026-08-02T00:00:00Z",
+  "validUntil": "2026-08-03T00:00:00Z",
+  "purpose": "fixture-enrolment",
+  "audience": "urn:example:fixture:audience:requester-a",
+  "configurationRevision": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "subjects": [
+    {
+      "role": "child",
+      "binding": "urn:evidence:subject:v1_DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
+    },
+    {
+      "role": "candidate-parent",
+      "binding": "urn:evidence:subject:v1_EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
+    }
+  ],
+  "supportedValues": [
+    {
+      "providesValueFor": "urn:example:fixture:concept:legal-parent-relationship-confirmed",
+      "value": true
+    }
+  ]
+}
diff --git a/products/evidence/fixtures/conformance/golden/relationship-request.json b/products/evidence/fixtures/conformance/golden/relationship-request.json
new file mode 100644
index 000000000..48ddff993
--- /dev/null
+++ b/products/evidence/fixtures/conformance/golden/relationship-request.json
@@ -0,0 +1,22 @@
+{
+  "requestNonce": "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I",
+  "requirement": "urn:example:fixture:requirement:legal-parent-relationship:v1",
+  "purpose": "fixture-enrolment",
+  "subjects": [
+    {
+      "role": "child",
+      "selector": {
+        "profile": "civil-record-reference-v1",
+        "values": {
+          "record_reference": "synthetic-child-record-001"
+        }
+      }
+    },
+    {
+      "role": "candidate-parent",
+      "selector": {
+        "profile": "person-demographics-v1"
+      }
+    }
+  ]
+}
diff --git a/products/evidence/fixtures/conformance/golden/residence-evidence.json b/products/evidence/fixtures/conformance/golden/residence-evidence.json
new file mode 100644
index 000000000..8571a8da7
--- /dev/null
+++ b/products/evidence/fixtures/conformance/golden/residence-evidence.json
@@ -0,0 +1,29 @@
+{
+  "schema": "registry.assertion-evidence/v1",
+  "assuranceProfile": "evidence-grade",
+  "requestNonce": "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I",
+  "id": "urn:example:fixture:evidence:residence-001",
+  "type": "Evidence",
+  "supportsRequirement": "urn:example:fixture:requirement:residence-region:v1",
+  "isConformantTo": "urn:example:fixture:evidence-type:residence-region:v1",
+  "issuedBy": "urn:example:fixture:issuer:authority",
+  "providedBy": "urn:example:fixture:provider:evidence",
+  "issuedAt": "2026-08-02T00:00:00Z",
+  "observedAt": "2026-08-02T00:00:00Z",
+  "validUntil": "2026-08-03T00:00:00Z",
+  "purpose": "fixture-routing",
+  "audience": "urn:example:fixture:audience:requester-a",
+  "configurationRevision": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "subjects": [
+    {
+      "role": "subject",
+      "binding": "urn:evidence:subject:v1_BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+    }
+  ],
+  "supportedValues": [
+    {
+      "providesValueFor": "urn:example:fixture:concept:residence-region",
+      "value": "REGION-NORTH"
+    }
+  ]
+}
diff --git a/products/evidence/fixtures/conformance/golden/residence-request.json b/products/evidence/fixtures/conformance/golden/residence-request.json
new file mode 100644
index 000000000..28d5d532d
--- /dev/null
+++ b/products/evidence/fixtures/conformance/golden/residence-request.json
@@ -0,0 +1,16 @@
+{
+  "requestNonce": "r1N1mq48U3PpZ5keuZEgmA5KMC2KDrF1hT6640koy6I",
+  "requirement": "urn:example:fixture:requirement:residence-region:v1",
+  "purpose": "fixture-routing",
+  "subjects": [
+    {
+      "role": "subject",
+      "selector": {
+        "profile": "residence-record-v1",
+        "values": {
+          "record_reference": "synthetic-residence-record-001"
+        }
+      }
+    }
+  ]
+}
diff --git a/products/evidence/fixtures/conformance/jws-cases.yaml b/products/evidence/fixtures/conformance/jws-cases.yaml
new file mode 100644
index 000000000..737ecafc8
--- /dev/null
+++ b/products/evidence/fixtures/conformance/jws-cases.yaml
@@ -0,0 +1,27 @@
+fixture: registry.evidence.jws-cases/v1
+protected_header:
+  exact_json: '{"alg":"EdDSA","kid":"fixture-key-2026-01","typ":"evidence+jws","cty":"application/evidence+json"}'
+  base64url_padding: prohibited
+cases:
+  - {id: adult-boolean, request: golden/adult-request.json, payload: golden/adult-evidence.json}
+  - {id: residence-controlled-code, request: golden/residence-request.json, payload: golden/residence-evidence.json}
+  - {id: licence-boolean-and-category, request: golden/licence-request.json, payload: golden/licence-evidence.json}
+  - {id: relationship-role-bound-boolean, request: golden/relationship-request.json, payload: golden/relationship-evidence.json}
+signing_procedure:
+  key_source: core-owned fixture SigningProvider; no private key bytes in YAML or repository snapshots
+  payload: For signing-profile tests, sign the exact referenced fixture file bytes including the final line feed; the runtime signs its own core-produced bytes exactly once without canonicalization or reserialization.
+  output_members: [protected, payload, signature]
+  output_header_member: prohibited
+  verification: Resolve fixture-key-2026-01 from the harness-pinned public fixture key and verify before parsing payload.
+negative:
+  - mutate one protected-header byte
+  - mutate one payload byte
+  - remove signature
+  - add an unprotected header
+  - add jku, x5u, jwk, x5c, crit, or b64
+  - unknown kid
+  - algorithm mismatch
+  - signed payload violates the Evidence JSON Schema
+  - duplicate evidence object beside payload
+  - signing-provider failure
+expected_failure: no evidence release; safe service_unavailable where failure is runtime
diff --git a/products/evidence/fixtures/conformance/oauth-credential-redaction.yaml b/products/evidence/fixtures/conformance/oauth-credential-redaction.yaml
new file mode 100644
index 000000000..a62e9b476
--- /dev/null
+++ b/products/evidence/fixtures/conformance/oauth-credential-redaction.yaml
@@ -0,0 +1,64 @@
+fixture: registry.evidence.oauth-credential-redaction/v1
+synthetic_only: true
+configuration:
+  credential_placement: form-body
+  token_endpoint: https://authorization.invalid/oauth/token
+  client_id_ref: secret:file/fixture-oauth-client-id
+  client_secret_ref: secret:file/fixture-oauth-client-secret
+  scope: fixture.read
+lifetime_rule: >-
+  RFC 6749 section 5.1 makes expires_in recommended rather than required. A
+  token response that omits it is accepted only when the bundle configures
+  assumedLifetimeSeconds, and the cached lifetime is still clamped to
+  maximumCacheSeconds. A present but zero, negative, or non-numeric expires_in
+  remains a credential failure and no assumed lifetime can rescue it.
+extension_member_rule: >-
+  RFC 6749 section 5.1 permits a token response to carry members beyond the ones
+  it defines, and deployed authorization servers do: refresh_expires_in,
+  not-before-policy, session_state, id_token, ext_expires_in. Version 1 ignores
+  every member it does not read rather than refusing the response, so an
+  ordinary provider is usable. Ignoring is not trusting: an unread member is
+  never a credential, never reaches a script, and is scrubbed with the rest of
+  the parsed response. Every member Version 1 does read is still closed, so a
+  wrong type or a wrong scope remains a credential failure, and duplicate
+  members remain a parse failure, which is what stops a second access_token from
+  arriving as an extension.
+runtime_generated_canary_classes: [client-id, client-secret, access-token]
+repository_secret_values: prohibited
+cases:
+  - {id: token-success, provider_status: 200, expected: token-used-in-memory-only}
+  - {id: token-400, provider_status: 400, expected_public_problem: dependency_unavailable}
+  - {id: token-401, provider_status: 401, expected_public_problem: dependency_unavailable}
+  - {id: malformed-token-json, provider_status: 200, response: invalid-json, expected_public_problem: dependency_unavailable}
+  - {id: token-response-oversized, provider_status: 200, response: oversized, expected_public_problem: dependency_unavailable}
+  - {id: token-response-extension-members, provider_status: 200, response: extension-members, expected: token-used-in-memory-only}
+  - {id: token-response-duplicate-access-token, provider_status: 200, response: duplicate-access-token, expected_public_problem: dependency_unavailable}
+  - {id: token-response-wrong-access-token-field, provider_status: 200, response: wrong-access-token-field, expected_public_problem: dependency_unavailable}
+  - {id: token-response-wrong-token-type, provider_status: 200, response: wrong-token-type, expected_public_problem: dependency_unavailable}
+  - {id: token-response-omitted-lifetime, provider_status: 200, response: omitted-lifetime, expected_public_problem: dependency_unavailable}
+  - {id: token-response-omitted-lifetime-with-assumed-lifetime, provider_status: 200, response: omitted-lifetime, assumed_lifetime_seconds: 120, expected: token-used-in-memory-only}
+  - {id: token-response-wrong-media-type, provider_status: 200, response: wrong-media-type, expected_public_problem: dependency_unavailable}
+  - {id: token-response-wrong-scope, provider_status: 200, response: wrong-scope, expected_public_problem: dependency_unavailable}
+  - {id: token-response-wrong-lifetime, provider_status: 200, response: wrong-lifetime, expected_public_problem: dependency_unavailable}
+  - {id: transport-connection-failure, transport: connection-failure, expected_public_problem: dependency_unavailable}
+  - {id: transport-timeout, transport: timeout, expected_public_problem: dependency_unavailable}
+required_absence:
+  surfaces: [public-problem, operational-log, audit, trace, metric, snapshot, panic, test-failure-output]
+  values:
+    - every runtime-generated client-id canary
+    - every runtime-generated client-secret canary
+    - every runtime-generated access-token canary
+    - complete token URL
+    - token request body
+    - token response body
+placement_rule: >-
+  RFC 6749 section 2.3.1 requires the client identifier and secret to travel in
+  the Authorization header or the request body and never in the request URI.
+  Version 1 offers no query-string placement, so the token URL carries no
+  credential to leak into an authorization-server, proxy, or ingress log.
+wire_assertion:
+  provider_receives_no_token_url_query: true
+  provider_receives_configured_form_keys: true
+  provider_receives_configured_grant: client_credentials
+  evidence_data_requests_after_token_failure: 0
+  Rhai_receives_token_or_token_request: false
diff --git a/products/evidence/fixtures/conformance/sd-jwt-vc-cases.yaml b/products/evidence/fixtures/conformance/sd-jwt-vc-cases.yaml
new file mode 100644
index 000000000..8a1b2f415
--- /dev/null
+++ b/products/evidence/fixtures/conformance/sd-jwt-vc-cases.yaml
@@ -0,0 +1,46 @@
+fixture: registry.evidence.sd-jwt-vc-cases/v1
+profile: ../../contracts/sd-jwt-vc-profile.yaml
+media_type: application/dc+sd-jwt
+protected_header:
+  exact_json: '{"alg":"EdDSA","kid":"fixture-key-2026-01","typ":"dc+sd-jwt"}'
+  base64url_padding: prohibited
+  cty_member: prohibited
+serialization:
+  structure: issuer-signed JWT, then every root-value and configured structured-field disclosure, then a trailing tilde
+  key_binding_jwt: never appended by the issuer; the trailing tilde marks its absence
+  claim_set: closed to the issuer-owned claims and the profile's always-disclosed claims; any other member fails verification
+disclosures:
+  unprojected_value: exactly one root disclosure named by providesValueFor and carrying the identical public value from signed JWS
+  projected_structured_value: one nested disclosure for each direct field, under the configured public claim; nested field values remain atomic
+  encoding: base64url without padding of the exact JSON array of salt, claim name, and claim value
+  digest: base64url without padding of the SHA-256 of the encoded disclosure ASCII bytes
+  digest_algorithm: sha-256
+  digest_order: _sd is sorted lexicographically and carries no repeated digest
+  salt: fresh per disclosure from a cryptographically secure random source
+cases:
+  - {id: adult-boolean, request: golden/adult-request.json, payload: golden/adult-evidence.json}
+  - {id: residence-controlled-code, request: golden/residence-request.json, payload: golden/residence-evidence.json}
+  - {id: licence-boolean-and-category, request: golden/licence-request.json, payload: golden/licence-evidence.json}
+  - {id: relationship-role-bound-boolean, request: golden/relationship-request.json, payload: golden/relationship-evidence.json}
+issuance_procedure:
+  key_source: the one active signing key already used for the flattened JWS; no second key, algorithm, or key ceremony
+  payload: the projection of the exact constructed evidence payload; no value is re-derived, re-canonicalized, or reserialized during mapping
+  verification: resolve the key identifier in the harness-pinned public key set and verify the issuer-signed JWT before parsing any claim or disclosure
+negative:
+  - mutate one disclosure value
+  - add an undeclared disclosure
+  - remove one signed digest
+  - mutate one payload byte
+  - mutate one protected-header byte
+  - unknown kid
+  - a claim outside the published claim set
+  - the format is not enabled by the immutable bundle
+  - the format is not permitted by the complete matched grant
+  - holder key carrying a private member
+  - holder key with a non-allowlisted key type, curve, or algorithm
+  - signing-provider failure
+  - the serialization is offered to the flattened JWS verifier
+expected_failure: >-
+  no credential release; safe service_unavailable where failure is runtime; no
+  fallback to any other response format; format denial does not reveal whether
+  the bundle or the grant withheld it
diff --git a/products/evidence/fixtures/conformance/selector-matrix.yaml b/products/evidence/fixtures/conformance/selector-matrix.yaml
new file mode 100644
index 000000000..ee9a21692
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selector-matrix.yaml
@@ -0,0 +1,151 @@
+fixture: registry.evidence.selector-matrix/v1
+synthetic_only: true
+profiles:
+  - case: identifier-only
+    profile: opaque-record-v1
+    role: subject
+    fields:
+      record_reference: {type: string, minimum_bytes: 1, maximum_bytes: 96}
+    maximum_aggregate_bytes: 96
+    value_origin: request
+    claim_binding:
+      authority_profile: reviewed-caseworker-v1
+      requirement: urn:example:fixture:requirement:classification:v1
+      purpose: fixture-procedure
+      audience: urn:example:fixture:audience:requester-a
+      exact_role_profile_origin: [subject, opaque-record-v1, request]
+      valueClaims: prohibited
+    request_values: {record_reference: synthetic-record-001}
+    negative:
+      - missing-record-reference
+      - extra-caller-field
+      - wrong-origin-context-value
+      - identifier-possession-without-entitlement
+  - case: compound-no-identifier
+    profile: demographics-v1
+    role: subject
+    fields:
+      given_name: {type: string, minimum_bytes: 1, maximum_bytes: 200}
+      family_name: {type: string, minimum_bytes: 1, maximum_bytes: 200}
+      birth_date: {type: date}
+    maximum_aggregate_bytes: 420
+    value_origin: authenticated-context
+    claim_binding:
+      authority_profile: subject-bound-v1
+      requirement: urn:example:fixture:requirement:property:v1
+      purpose: fixture-procedure
+      audience: urn:example:fixture:audience:requester-a
+      exact_role_profile_origin: [subject, demographics-v1, authenticated-context]
+      valueClaims:
+        given_name: identity.given_name
+        family_name: identity.family_name
+        birth_date: identity.birth_date
+    request_values: absent
+    context_values: {given_name: Ána María, family_name: N'Dour-Sato, birth_date: '2000-02-29'}
+    negative:
+      - caller-values-prohibited-for-context-origin
+      - missing-configured-context-claim
+      - no-principal-claim-fallback
+      - no-case-fold-or-transliteration
+  - case: added-disambiguator
+    profile: demographics-with-event-v1
+    role: subject
+    fields:
+      given_name: {type: string, minimum_bytes: 1, maximum_bytes: 200}
+      family_name: {type: string, minimum_bytes: 1, maximum_bytes: 200}
+      birth_date: {type: date}
+      event_reference: {type: string, minimum_bytes: 1, maximum_bytes: 96}
+    maximum_aggregate_bytes: 520
+    value_origin: authenticated-grant
+    claim_binding:
+      authority_profile: authenticated-grant-v1
+      requirement: urn:example:fixture:requirement:property:v1
+      purpose: fixture-procedure
+      audience: urn:example:fixture:audience:requester-a
+      exact_role_profile_origin: [subject, demographics-with-event-v1, authenticated-grant]
+      configured_grant_claims:
+        grantIdClaim: evidence_grant_id
+        grantAuthorityClaim: evidence_authority
+      verified_grant_binding:
+        grant_id: synthetic-grant-001
+        grant_authority: urn:example:fixture:authority:grant-a
+      valueClaims:
+        given_name: grant.subject.given_name
+        family_name: grant.subject.family_name
+        birth_date: grant.subject.birth_date
+        event_reference: grant.subject.event_reference
+    request_values: absent
+    verified_token_values: {given_name: Adaeze, family_name: Okafor, birth_date: '1990-07-11', event_reference: synthetic-event-001}
+    negative:
+      - caller-values-prohibited-for-grant-origin
+      - caller-added-disambiguator-rejected-from-demographics-v1
+      - authenticated-grant-id-not-bound
+      - authenticated-grant-authority-not-bound
+      - incomplete-grant-valueClaims
+      - alternative-field-set-not-inferred
+  - case: multi-role
+    profiles:
+      subject-a:
+        profile: opaque-record-v1
+        fields: {record_reference: synthetic-record-002}
+      subject-b:
+        profile: demographics-v1
+        fields: {given_name: Binta, family_name: Diallo, birth_date: '1970-06-15'}
+    value_origin: request
+    claim_binding:
+      authority_profile: reviewed-caseworker-v1
+      requirement: urn:example:fixture:requirement:relationship:v1
+      purpose: fixture-procedure
+      audience: urn:example:fixture:audience:requester-a
+      exact_role_profile_origins:
+        - [subject-a, opaque-record-v1, request]
+        - [subject-b, demographics-v1, request]
+      valueClaims: prohibited
+    negative:
+      - swapped-role-selectors
+      - unauthorized-subject-b-substitution
+      - missing-one-role
+      - duplicate-subject-role
+      - unknown-subject-role
+      - entitlement-union-across-roles
+  - case: opaque-non-domain-field-names
+    profile: opaque-coordinates-v1
+    role: subject
+    fields:
+      alpha: {type: string, minimum_bytes: 1, maximum_bytes: 80}
+      delta: {type: integer, minimum: 0, maximum: 999999}
+      kappa: {type: controlled-code, codelist: codelists/opaque-codes.yaml, codelist_version: '1', maximum_bytes: 16}
+    maximum_aggregate_bytes: 96
+    value_origin: request
+    claim_binding:
+      authority_profile: reviewed-caseworker-v1
+      requirement: urn:example:fixture:requirement:opaque:v1
+      purpose: fixture-procedure
+      audience: urn:example:fixture:audience:requester-a
+      exact_role_profile_origin: [subject, opaque-coordinates-v1, request]
+      valueClaims: prohibited
+    request_values: {alpha: synthetic-alpha, delta: 42, kappa: K-2}
+    expected_core_behavior: Identical to every other profile; names carry no domain semantics.
+    negative:
+      - unknown-opaque-field
+      - wrong-opaque-scalar-type
+      - aggregate-size-exceeded
+global_negative:
+  - empty-string
+  - invalid-date
+  - scalar-object-or-array
+  - field-byte-boundary-plus-one
+  - aggregate-byte-boundary-plus-one
+  - unauthorized-profile
+  - unauthorized-purpose
+  - unauthorized-audience
+  - missing-context-valueClaims
+  - incomplete-or-extra-valueClaims
+  - request-origin-valueClaims
+  - grant-id-or-authority-from-caller-request
+  - credential-resolution-or-source-access-before-validation
+redaction_expectation:
+  public_evidence: no selector profile or value
+  public_problem: no selector profile or value
+  logs_metrics_traces: no selector profile or value; profile ids may not be metric labels
+  audit: profile id plus at most one scoped keyed pseudonym per complete role-selector bundle
diff --git a/products/evidence/fixtures/conformance/selectors/adapters/classification-source-prepare.rhai b/products/evidence/fixtures/conformance/selectors/adapters/classification-source-prepare.rhai
new file mode 100644
index 000000000..871d48750
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/adapters/classification-source-prepare.rhai
@@ -0,0 +1,10 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"]["values"];
+    #{
+        query: [],
+        body: #{
+            selector: #{request_record_reference: subject["record_reference"]},
+            requested_fields: parameters["requestedFields"]
+        }
+    }
+}
diff --git a/products/evidence/fixtures/conformance/selectors/adapters/classification-source.rhai b/products/evidence/fixtures/conformance/selectors/adapters/classification-source.rhai
new file mode 100644
index 000000000..10eaf41c2
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/adapters/classification-source.rhai
@@ -0,0 +1,6 @@
+fn extract(source_response, parameters) {
+    if source_response["matched"] {
+        return #{outcome: "match", facts: #{result: true}};
+    }
+    #{outcome: "no_match"}
+}
diff --git a/products/evidence/fixtures/conformance/selectors/adapters/context-source-prepare.rhai b/products/evidence/fixtures/conformance/selectors/adapters/context-source-prepare.rhai
new file mode 100644
index 000000000..ee56d0251
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/adapters/context-source-prepare.rhai
@@ -0,0 +1,14 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"]["values"];
+    #{
+        query: [],
+        body: #{
+            selector: #{
+                context_given_name: subject["given_name"],
+                context_family_name: subject["family_name"],
+                context_birth_date: subject["birth_date"]
+            },
+            requested_fields: parameters["requestedFields"]
+        }
+    }
+}
diff --git a/products/evidence/fixtures/conformance/selectors/adapters/context-source.rhai b/products/evidence/fixtures/conformance/selectors/adapters/context-source.rhai
new file mode 100644
index 000000000..10eaf41c2
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/adapters/context-source.rhai
@@ -0,0 +1,6 @@
+fn extract(source_response, parameters) {
+    if source_response["matched"] {
+        return #{outcome: "match", facts: #{result: true}};
+    }
+    #{outcome: "no_match"}
+}
diff --git a/products/evidence/fixtures/conformance/selectors/adapters/grant-source-prepare.rhai b/products/evidence/fixtures/conformance/selectors/adapters/grant-source-prepare.rhai
new file mode 100644
index 000000000..08075511e
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/adapters/grant-source-prepare.rhai
@@ -0,0 +1,15 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"]["values"];
+    #{
+        query: [],
+        body: #{
+            selector: #{
+                grant_given_name: subject["given_name"],
+                grant_family_name: subject["family_name"],
+                grant_birth_date: subject["birth_date"],
+                grant_event_reference: subject["event_reference"]
+            },
+            requested_fields: parameters["requestedFields"]
+        }
+    }
+}
diff --git a/products/evidence/fixtures/conformance/selectors/adapters/grant-source.rhai b/products/evidence/fixtures/conformance/selectors/adapters/grant-source.rhai
new file mode 100644
index 000000000..10eaf41c2
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/adapters/grant-source.rhai
@@ -0,0 +1,6 @@
+fn extract(source_response, parameters) {
+    if source_response["matched"] {
+        return #{outcome: "match", facts: #{result: true}};
+    }
+    #{outcome: "no_match"}
+}
diff --git a/products/evidence/fixtures/conformance/selectors/adapters/opaque-source-prepare.rhai b/products/evidence/fixtures/conformance/selectors/adapters/opaque-source-prepare.rhai
new file mode 100644
index 000000000..17315bb47
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/adapters/opaque-source-prepare.rhai
@@ -0,0 +1,14 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"]["values"];
+    #{
+        query: [],
+        body: #{
+            selector: #{
+                opaque_alpha: subject["alpha"],
+                opaque_delta: subject["delta"],
+                opaque_kappa: subject["kappa"]
+            },
+            requested_fields: parameters["requestedFields"]
+        }
+    }
+}
diff --git a/products/evidence/fixtures/conformance/selectors/adapters/opaque-source.rhai b/products/evidence/fixtures/conformance/selectors/adapters/opaque-source.rhai
new file mode 100644
index 000000000..10eaf41c2
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/adapters/opaque-source.rhai
@@ -0,0 +1,6 @@
+fn extract(source_response, parameters) {
+    if source_response["matched"] {
+        return #{outcome: "match", facts: #{result: true}};
+    }
+    #{outcome: "no_match"}
+}
diff --git a/products/evidence/fixtures/conformance/selectors/adapters/relationship-source-prepare.rhai b/products/evidence/fixtures/conformance/selectors/adapters/relationship-source-prepare.rhai
new file mode 100644
index 000000000..61ea40e0c
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/adapters/relationship-source-prepare.rhai
@@ -0,0 +1,29 @@
+fn prepare(selectors, parameters) {
+    let role_a = selectors["subject-a"];
+    let role_b = selectors["subject-b"];
+    let selector = #{};
+
+    if role_a["profile"] == "opaque-record-v1" {
+        selector["role_a_record_reference"] = role_a["values"]["record_reference"];
+    } else {
+        selector["role_a_alpha"] = role_a["values"]["alpha"];
+        selector["role_a_delta"] = role_a["values"]["delta"];
+        selector["role_a_kappa"] = role_a["values"]["kappa"];
+    }
+
+    if role_b["profile"] == "demographics-v1" {
+        selector["role_b_given_name"] = role_b["values"]["given_name"];
+        selector["role_b_family_name"] = role_b["values"]["family_name"];
+        selector["role_b_birth_date"] = role_b["values"]["birth_date"];
+    } else {
+        selector["role_b_event_given_name"] = role_b["values"]["given_name"];
+        selector["role_b_event_family_name"] = role_b["values"]["family_name"];
+        selector["role_b_event_birth_date"] = role_b["values"]["birth_date"];
+        selector["role_b_event_reference"] = role_b["values"]["event_reference"];
+    }
+
+    #{
+        query: [],
+        body: #{selector: selector, requested_fields: parameters["requestedFields"]}
+    }
+}
diff --git a/products/evidence/fixtures/conformance/selectors/adapters/relationship-source.rhai b/products/evidence/fixtures/conformance/selectors/adapters/relationship-source.rhai
new file mode 100644
index 000000000..10eaf41c2
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/adapters/relationship-source.rhai
@@ -0,0 +1,6 @@
+fn extract(source_response, parameters) {
+    if source_response["matched"] {
+        return #{outcome: "match", facts: #{result: true}};
+    }
+    #{outcome: "no_match"}
+}
diff --git a/products/evidence/fixtures/conformance/selectors/codelists/opaque-codes.yaml b/products/evidence/fixtures/conformance/selectors/codelists/opaque-codes.yaml
new file mode 100644
index 000000000..e0dc9d32a
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/codelists/opaque-codes.yaml
@@ -0,0 +1,3 @@
+id: urn:example:fixture:codelist:opaque-codes
+version: '1'
+codes: [K-1, K-2, K-ABCDEFGHIJKLMN]
diff --git a/products/evidence/fixtures/conformance/selectors/derivations/classification.rhai b/products/evidence/fixtures/conformance/selectors/derivations/classification.rhai
new file mode 100644
index 000000000..63e9d8480
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/derivations/classification.rhai
@@ -0,0 +1,3 @@
+fn derive(facts, selectors, evaluation_context) {
+    [#{concept_id: "urn:example:fixture:concept:classification", value: required(facts.result, "result_required")}]
+}
diff --git a/products/evidence/fixtures/conformance/selectors/derivations/opaque.rhai b/products/evidence/fixtures/conformance/selectors/derivations/opaque.rhai
new file mode 100644
index 000000000..1356f2a93
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/derivations/opaque.rhai
@@ -0,0 +1,3 @@
+fn derive(facts, selectors, evaluation_context) {
+    [#{concept_id: "urn:example:fixture:concept:opaque", value: required(facts.result, "result_required")}]
+}
diff --git a/products/evidence/fixtures/conformance/selectors/derivations/property-with-event.rhai b/products/evidence/fixtures/conformance/selectors/derivations/property-with-event.rhai
new file mode 100644
index 000000000..9d4109a5a
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/derivations/property-with-event.rhai
@@ -0,0 +1,3 @@
+fn derive(facts, selectors, evaluation_context) {
+    [#{concept_id: "urn:example:fixture:concept:property-with-event", value: required(facts.result, "result_required")}]
+}
diff --git a/products/evidence/fixtures/conformance/selectors/derivations/property.rhai b/products/evidence/fixtures/conformance/selectors/derivations/property.rhai
new file mode 100644
index 000000000..dc537c87e
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/derivations/property.rhai
@@ -0,0 +1,3 @@
+fn derive(facts, selectors, evaluation_context) {
+    [#{concept_id: "urn:example:fixture:concept:property", value: required(facts.result, "result_required")}]
+}
diff --git a/products/evidence/fixtures/conformance/selectors/derivations/relationship.rhai b/products/evidence/fixtures/conformance/selectors/derivations/relationship.rhai
new file mode 100644
index 000000000..00fe4afc7
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/derivations/relationship.rhai
@@ -0,0 +1,3 @@
+fn derive(facts, selectors, evaluation_context) {
+    [#{concept_id: "urn:example:fixture:concept:relationship", value: required(facts.result, "result_required")}]
+}
diff --git a/products/evidence/fixtures/conformance/selectors/evidence.yaml b/products/evidence/fixtures/conformance/selectors/evidence.yaml
new file mode 100644
index 000000000..621297d50
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/evidence.yaml
@@ -0,0 +1,341 @@
+version: 1
+assuranceProfile: evidence-grade
+service:
+  providerId: urn:example:fixture:provider:selector-conformance
+  trustDomain: urn:example:fixture:trust-domain:selector-conformance
+issuer: {id: urn:example:fixture:issuer:selector-conformance}
+authentication:
+  kind: oidc-access-token
+  issuer: https://identity.invalid
+  audiences: [selector-conformance]
+  tokenTypes: [at+jwt]
+  algorithms: [EdDSA]
+  jwksUri: https://identity.invalid/.well-known/jwks.json
+  principalClaim: sub
+  requesterTagsClaim: evidence_tags
+  evidenceAudienceClaim: evidence_audience
+  grantIdClaim: evidence_grant_id
+  grantAuthorityClaim: evidence_authority
+audit:
+  format: keyed-jsonl
+  hashSecretRef: secret:file/audit-key
+  hashKeyVersion: 1
+  failClosed: true
+subjectBinding:
+  secretRef: secret:file/binding-key
+  keyVersion: 1
+rateLimits:
+  requestsPerPrincipalPerMinute: 1000
+  burstPerPrincipal: 100
+  failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 100
+signing:
+  format: flattened-jws-json
+  algorithm: EdDSA
+  activeKeyId: selector-evidence-key
+  activeKeyRef: secret:file/signing-key
+  retiredPublicJwkFiles: []
+  jwksPath: /.well-known/evidence/jwks.json
+  maximumAssertionValiditySeconds: 86400
+  verifierClockSkewSeconds: 30
+responseFormats: [signed-jws]
+
+selectorProfiles:
+  opaque-record-v1:
+    maximumAggregateBytes: 96
+    fields:
+      record_reference: {type: string, minimumBytes: 1, maximumBytes: 96}
+  demographics-v1:
+    maximumAggregateBytes: 420
+    fields:
+      given_name: {type: string, minimumBytes: 1, maximumBytes: 200}
+      family_name: {type: string, minimumBytes: 1, maximumBytes: 200}
+      birth_date: {type: date}
+  demographics-with-event-v1:
+    maximumAggregateBytes: 520
+    fields:
+      given_name: {type: string, minimumBytes: 1, maximumBytes: 200}
+      family_name: {type: string, minimumBytes: 1, maximumBytes: 200}
+      birth_date: {type: date}
+      event_reference: {type: string, minimumBytes: 1, maximumBytes: 96}
+  opaque-coordinates-v1:
+    maximumAggregateBytes: 96
+    fields:
+      alpha: {type: string, minimumBytes: 1, maximumBytes: 80}
+      delta: {type: integer, minimum: 0, maximum: 999999}
+      kappa: {type: controlled-code, codelist: codelists/opaque-codes.yaml, codelistVersion: '1', maximumBytes: 16}
+sources:
+  classification-source:
+    transport: http-json
+    baseUrl: https://source.invalid
+    posture: field-projected
+    authentication: {kind: static-bearer, tokenRef: secret:file/source-token}
+    request:
+      method: POST
+      path: /v1/selector-facts
+      fixedHeaders: [{name: Accept, value: application/json}]
+      selectorInputs:
+        - role: subject
+          alternatives:
+            - {profile: opaque-record-v1, fields: [record_reference]}
+      prepareScript: adapters/classification-source-prepare.rhai
+      adapterParameters: {requestedFields: [result]}
+      adapterParametersSchema: schemas/adapter-parameters.schema.yaml
+      preparationLimits: {query: forbidden, jsonBody: required, maximumJsonDepth: 8, maximumCollectionItems: 16, maximumStringBytes: 256, maximumNormalizedBytes: 4096}
+      projection: [/matched]
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 8
+    responseSchema: schemas/response.schema.yaml
+    extractScript: adapters/classification-source.rhai
+    factSchema: schemas/facts.schema.yaml
+  context-source:
+    transport: http-json
+    baseUrl: https://source.invalid
+    posture: field-projected
+    authentication: {kind: static-bearer, tokenRef: secret:file/source-token}
+    request:
+      method: POST
+      path: /v1/selector-facts
+      fixedHeaders: [{name: Accept, value: application/json}]
+      selectorInputs:
+        - role: subject
+          alternatives:
+            - {profile: demographics-v1, fields: [given_name, family_name, birth_date]}
+      prepareScript: adapters/context-source-prepare.rhai
+      adapterParameters: {requestedFields: [result]}
+      adapterParametersSchema: schemas/adapter-parameters.schema.yaml
+      preparationLimits: {query: forbidden, jsonBody: required, maximumJsonDepth: 8, maximumCollectionItems: 16, maximumStringBytes: 256, maximumNormalizedBytes: 4096}
+      projection: [/matched]
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 8
+    responseSchema: schemas/response.schema.yaml
+    extractScript: adapters/context-source.rhai
+    factSchema: schemas/facts.schema.yaml
+  grant-source:
+    transport: http-json
+    baseUrl: https://source.invalid
+    posture: field-projected
+    authentication: {kind: static-bearer, tokenRef: secret:file/source-token}
+    request:
+      method: POST
+      path: /v1/selector-facts
+      fixedHeaders: [{name: Accept, value: application/json}]
+      selectorInputs:
+        - role: subject
+          alternatives:
+            - {profile: demographics-with-event-v1, fields: [given_name, family_name, birth_date, event_reference]}
+      prepareScript: adapters/grant-source-prepare.rhai
+      adapterParameters: {requestedFields: [result]}
+      adapterParametersSchema: schemas/adapter-parameters.schema.yaml
+      preparationLimits: {query: forbidden, jsonBody: required, maximumJsonDepth: 8, maximumCollectionItems: 16, maximumStringBytes: 256, maximumNormalizedBytes: 4096}
+      projection: [/matched]
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 8
+    responseSchema: schemas/response.schema.yaml
+    extractScript: adapters/grant-source.rhai
+    factSchema: schemas/facts.schema.yaml
+  relationship-source:
+    transport: http-json
+    baseUrl: https://source.invalid
+    posture: field-projected
+    authentication: {kind: static-bearer, tokenRef: secret:file/source-token}
+    request:
+      method: POST
+      path: /v1/selector-facts
+      fixedHeaders: [{name: Accept, value: application/json}]
+      selectorInputs:
+        - role: subject-a
+          alternatives:
+            - {profile: opaque-record-v1, fields: [record_reference]}
+            - {profile: opaque-coordinates-v1, fields: [alpha, delta, kappa]}
+        - role: subject-b
+          alternatives:
+            - {profile: demographics-v1, fields: [given_name, family_name, birth_date]}
+            - {profile: demographics-with-event-v1, fields: [given_name, family_name, birth_date, event_reference]}
+      prepareScript: adapters/relationship-source-prepare.rhai
+      adapterParameters: {requestedFields: [result]}
+      adapterParametersSchema: schemas/adapter-parameters.schema.yaml
+      preparationLimits: {query: forbidden, jsonBody: required, maximumJsonDepth: 8, maximumCollectionItems: 24, maximumStringBytes: 256, maximumNormalizedBytes: 4096}
+      projection: [/matched]
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 8
+    responseSchema: schemas/response.schema.yaml
+    extractScript: adapters/relationship-source.rhai
+    factSchema: schemas/facts.schema.yaml
+  opaque-source:
+    transport: http-json
+    baseUrl: https://source.invalid
+    posture: field-projected
+    authentication: {kind: static-bearer, tokenRef: secret:file/source-token}
+    request:
+      method: POST
+      path: /v1/selector-facts
+      fixedHeaders: [{name: Accept, value: application/json}]
+      selectorInputs:
+        - role: subject
+          alternatives:
+            - {profile: opaque-coordinates-v1, fields: [alpha, delta, kappa]}
+      prepareScript: adapters/opaque-source-prepare.rhai
+      adapterParameters: {requestedFields: [result]}
+      adapterParametersSchema: schemas/adapter-parameters.schema.yaml
+      preparationLimits: {query: forbidden, jsonBody: required, maximumJsonDepth: 8, maximumCollectionItems: 16, maximumStringBytes: 256, maximumNormalizedBytes: 4096}
+      projection: [/matched]
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 8
+    responseSchema: schemas/response.schema.yaml
+    extractScript: adapters/opaque-source.rhai
+    factSchema: schemas/facts.schema.yaml
+authorityProfiles:
+  reviewed-caseworker-v1:
+    kind: statutory
+    requesterTags: [selector-reviewer]
+    grants:
+      - requirement: urn:example:fixture:requirement:classification:v1
+        purpose: fixture-procedure
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects:
+          - {role: subject, selectorProfile: opaque-record-v1, valueOrigin: request}
+      - requirement: urn:example:fixture:requirement:relationship:v1
+        purpose: fixture-procedure
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects:
+          - {role: subject-a, selectorProfile: opaque-record-v1, valueOrigin: request}
+          - {role: subject-b, selectorProfile: demographics-v1, valueOrigin: request}
+      - requirement: urn:example:fixture:requirement:opaque:v1
+        purpose: fixture-procedure
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects:
+          - {role: subject, selectorProfile: opaque-coordinates-v1, valueOrigin: request}
+  subject-bound-v1:
+    kind: organizational
+    requesterTags: [selector-reviewer]
+    grants:
+      - requirement: urn:example:fixture:requirement:property:v1
+        purpose: fixture-procedure
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects:
+          - role: subject
+            selectorProfile: demographics-v1
+            valueOrigin: authenticated-context
+            valueClaims:
+              given_name: identity.given_name
+              family_name: identity.family_name
+              birth_date: identity.birth_date
+  authenticated-grant-v1:
+    kind: consent
+    requesterTags: [selector-reviewer]
+    grants:
+      - requirement: urn:example:fixture:requirement:property-with-event:v1
+        purpose: fixture-procedure
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects:
+          - role: subject
+            selectorProfile: demographics-with-event-v1
+            valueOrigin: authenticated-grant
+            valueClaims:
+              given_name: grant.subject.given_name
+              family_name: grant.subject.family_name
+              birth_date: grant.subject.birth_date
+              event_reference: grant.subject.event_reference
+  alternate-caseworker-v1:
+    kind: statutory
+    requesterTags: [selector-reviewer]
+    grants:
+      - requirement: urn:example:fixture:requirement:relationship:v1
+        purpose: fixture-procedure
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects:
+          - {role: subject-a, selectorProfile: opaque-coordinates-v1, valueOrigin: request}
+          - {role: subject-b, selectorProfile: demographics-with-event-v1, valueOrigin: request}
+requirements:
+  - id: urn:example:fixture:requirement:classification:v1
+    kind: criterion
+    source: classification-source
+    purposes: [fixture-procedure]
+    subjectRoles:
+      - {role: subject, cardinality: one, selectorProfiles: [opaque-record-v1]}
+    referenceFrameworks: [urn:example:fixture:framework:classification:v1]
+    evidenceType: urn:example:fixture:evidence-type:classification:v1
+    validitySeconds: 3600
+    derivation: {script: derivations/classification.rhai, parameters: {}}
+    concepts:
+      - {id: urn:example:fixture:concept:classification, form: boolean, required: true, constraints: {}}
+    fixtures: fixtures/cases.yaml
+    disclosureGuard: {families: [urn:example:fixture:disclosure-family:classification]}
+    existenceDisclosure: collapse-unresolved
+  - id: urn:example:fixture:requirement:property:v1
+    kind: information-requirement
+    source: context-source
+    purposes: [fixture-procedure]
+    subjectRoles:
+      - {role: subject, cardinality: one, selectorProfiles: [demographics-v1]}
+    referenceFrameworks: [urn:example:fixture:framework:property:v1]
+    evidenceType: urn:example:fixture:evidence-type:property:v1
+    validitySeconds: 3600
+    derivation: {script: derivations/property.rhai, parameters: {}}
+    concepts:
+      - {id: urn:example:fixture:concept:property, form: boolean, required: true, constraints: {}}
+    fixtures: fixtures/cases.yaml
+    disclosureGuard: {families: [urn:example:fixture:disclosure-family:property]}
+    existenceDisclosure: collapse-unresolved
+  - id: urn:example:fixture:requirement:property-with-event:v1
+    kind: information-requirement
+    source: grant-source
+    purposes: [fixture-procedure]
+    subjectRoles:
+      - {role: subject, cardinality: one, selectorProfiles: [demographics-with-event-v1]}
+    referenceFrameworks: [urn:example:fixture:framework:property-with-event:v1]
+    evidenceType: urn:example:fixture:evidence-type:property-with-event:v1
+    validitySeconds: 3600
+    derivation: {script: derivations/property-with-event.rhai, parameters: {}}
+    concepts:
+      - {id: urn:example:fixture:concept:property-with-event, form: boolean, required: true, constraints: {}}
+    fixtures: fixtures/cases.yaml
+    disclosureGuard: {families: [urn:example:fixture:disclosure-family:property-with-event]}
+    existenceDisclosure: collapse-unresolved
+  - id: urn:example:fixture:requirement:relationship:v1
+    kind: criterion
+    source: relationship-source
+    purposes: [fixture-procedure]
+    subjectRoles:
+      - {role: subject-a, cardinality: one, selectorProfiles: [opaque-record-v1, opaque-coordinates-v1]}
+      - {role: subject-b, cardinality: one, selectorProfiles: [demographics-v1, demographics-with-event-v1]}
+    referenceFrameworks: [urn:example:fixture:framework:relationship:v1]
+    evidenceType: urn:example:fixture:evidence-type:relationship:v1
+    validitySeconds: 3600
+    derivation: {script: derivations/relationship.rhai, parameters: {}}
+    concepts:
+      - {id: urn:example:fixture:concept:relationship, form: boolean, required: true, constraints: {}}
+    fixtures: fixtures/cases.yaml
+    disclosureGuard: {families: [urn:example:fixture:disclosure-family:relationship]}
+    existenceDisclosure: collapse-unresolved
+  - id: urn:example:fixture:requirement:opaque:v1
+    kind: information-requirement
+    source: opaque-source
+    purposes: [fixture-procedure]
+    subjectRoles:
+      - {role: subject, cardinality: one, selectorProfiles: [opaque-coordinates-v1]}
+    referenceFrameworks: [urn:example:fixture:framework:opaque:v1]
+    evidenceType: urn:example:fixture:evidence-type:opaque:v1
+    validitySeconds: 3600
+    derivation: {script: derivations/opaque.rhai, parameters: {}}
+    concepts:
+      - {id: urn:example:fixture:concept:opaque, form: boolean, required: true, constraints: {}}
+    fixtures: fixtures/cases.yaml
+    disclosureGuard: {families: [urn:example:fixture:disclosure-family:opaque]}
+    existenceDisclosure: collapse-unresolved
diff --git a/products/evidence/fixtures/conformance/selectors/fixtures/cases.yaml b/products/evidence/fixtures/conformance/selectors/fixtures/cases.yaml
new file mode 100644
index 000000000..98a16ce3f
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/fixtures/cases.yaml
@@ -0,0 +1,12 @@
+fixture: registry.evidence.conformance.selector-full-path/v1
+synthetic_only: true
+cases:
+  - {id: positive}
+  - {id: negative-selector}
+  - {id: boundary-aggregate}
+  - {id: missing-selector}
+  - {id: no-match}
+  - {id: ambiguous}
+  - {id: source-failure}
+  - {id: unauthorized-entitlement}
+  - {id: anti-reconstruction}
diff --git a/products/evidence/fixtures/conformance/selectors/schemas/adapter-parameters.schema.yaml b/products/evidence/fixtures/conformance/selectors/schemas/adapter-parameters.schema.yaml
new file mode 100644
index 000000000..9ac20533c
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/schemas/adapter-parameters.schema.yaml
@@ -0,0 +1,6 @@
+type: object
+additionalProperties: false
+required: [requestedFields]
+properties:
+  requestedFields:
+    const: [result]
diff --git a/products/evidence/fixtures/conformance/selectors/schemas/facts.schema.yaml b/products/evidence/fixtures/conformance/selectors/schemas/facts.schema.yaml
new file mode 100644
index 000000000..2a432fd96
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/schemas/facts.schema.yaml
@@ -0,0 +1,5 @@
+type: object
+additionalProperties: false
+required: [result]
+properties:
+  result: {type: boolean}
diff --git a/products/evidence/fixtures/conformance/selectors/schemas/response.schema.yaml b/products/evidence/fixtures/conformance/selectors/schemas/response.schema.yaml
new file mode 100644
index 000000000..4e9673451
--- /dev/null
+++ b/products/evidence/fixtures/conformance/selectors/schemas/response.schema.yaml
@@ -0,0 +1,5 @@
+type: object
+additionalProperties: false
+required: [matched]
+properties:
+  matched: {type: boolean}
diff --git a/products/evidence/fixtures/conformance/supported-values.yaml b/products/evidence/fixtures/conformance/supported-values.yaml
new file mode 100644
index 000000000..1b9e60267
--- /dev/null
+++ b/products/evidence/fixtures/conformance/supported-values.yaml
@@ -0,0 +1,115 @@
+fixture: registry.evidence.supported-values/v1
+synthetic_only: true
+forms:
+  - form: boolean
+    declaration: {form: boolean, required: true}
+    positive: [true, false]
+    boundary: [false, true]
+    negative: ['true', 0, null, {value: true}]
+  - form: controlled-code
+    declaration: {form: controlled-code, codelist: synthetic-codes, codelist_version: '1', maximum_bytes: 8}
+    positive: [C-A]
+    boundary: [C-BOUND]
+    negative: [UNKNOWN, c-a, 1, 'C-BOUNDARY-TOO-LONG']
+  - form: controlled-category
+    declaration: {form: controlled-category, category_scheme: urn:example:fixture:scheme:category, scheme_version: '1', maximum_bytes: 16}
+    positive: [category-a]
+    boundary: [category-bound]
+    negative: [category-unknown, {category: category-a}, 1]
+  - form: bounded-integer
+    declaration: {form: bounded-integer, minimum: -10, maximum: 10}
+    positive: [0, 7]
+    boundary: [-10, 10]
+    negative: [-11, 11, 1.5, '7', 9007199254740992]
+  - form: bounded-decimal
+    declaration: {form: bounded-decimal, minimum: '-10.5', maximum: '10.5', maximum_scale: 2}
+    positive:
+      - {rhai: 'decimal("0.25")', wire_json: '"0.25"'}
+      - {rhai: 'parse_decimal("7.5")', wire_json: '"7.5"'}
+    boundary:
+      - {rhai: 'decimal("-10.5")', wire_json: '"-10.5"'}
+      - {rhai: 'decimal("10.5")', wire_json: '"10.5"'}
+    negative:
+      - {rhai: '1.25', reason: Rhai floating-point value}
+      - {rhai: 'decimal("-10.51")', reason: below minimum}
+      - {rhai: 'decimal("10.51")', reason: above maximum}
+      - {rhai: 'decimal("1.234")', reason: excessive scale}
+      - {rhai: 'decimal("01.0")', reason: non-canonical leading zero and trailing zero}
+      - {rhai: 'decimal("1e2")', reason: exponent form}
+      - {rhai: 'decimal("-0.0")', reason: negative zero and trailing zero}
+      - {rhai: 'decimal("NaN")', reason: non-finite}
+      - {rhai: 'decimal("12345678901234567890123456789")', reason: precision 29 exceeds global maximum 28}
+      - {rhai: 'decimal("0.1234567891")', reason: scale 10 exceeds global maximum 9}
+  - form: date-bucket
+    declaration: {form: date-bucket, bucket_scheme: urn:example:fixture:scheme:date-bucket, scheme_version: '1'}
+    positive: [{form: date-bucket, scheme: urn:example:fixture:scheme:date-bucket, bucket: current-period}]
+    boundary: [{form: date-bucket, scheme: urn:example:fixture:scheme:date-bucket, bucket: boundary-period}]
+    negative:
+      - {form: date-bucket, scheme: urn:example:fixture:scheme:date-bucket, bucket: unknown}
+      - {form: time-bucket, scheme: urn:example:fixture:scheme:date-bucket, bucket: current-period}
+      - {form: date-bucket, bucket: current-period}
+      - '2026-08-02'
+  - form: time-bucket
+    declaration: {form: time-bucket, bucket_scheme: urn:example:fixture:scheme:time-bucket, scheme_version: '1'}
+    positive: [{form: time-bucket, scheme: urn:example:fixture:scheme:time-bucket, bucket: within-window}]
+    boundary: [{form: time-bucket, scheme: urn:example:fixture:scheme:time-bucket, bucket: at-limit}]
+    negative:
+      - {form: time-bucket, scheme: urn:example:fixture:scheme:other, bucket: within-window}
+      - {form: time-bucket, scheme: urn:example:fixture:scheme:time-bucket, bucket: unknown}
+      - 'PT24H'
+  - form: audience-scoped-entity-reference
+    declaration: {form: audience-scoped-entity-reference, maximum_bytes: 160}
+    derivation_positive: [{rhai: 'entity_reference_seed("synthetic-seed-a")', public: 'urn:evidence:entity:v1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'}]
+    positive: [{form: audience-scoped-entity-reference, reference: 'urn:evidence:entity:v1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'}]
+    boundary: [{form: audience-scoped-entity-reference, reference: 'urn:evidence:entity:v12_BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB'}]
+    negative:
+      - {form: audience-scoped-entity-reference, reference: urn:example:global-person:001}
+      - {form: audience-scoped-entity-reference, reference: short}
+      - urn:evidence:entity:v1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+      - {rhai: 'synthetic-seed-a', reason: raw string cannot satisfy entity-reference concept}
+      - {rhai: 'entity_reference_seed("")', reason: empty seed}
+      - {rhai: 'entity_reference_seed("source-seed-canary")', leak_surface: logs}
+  - form: controlled-code-list
+    declaration: {form: controlled-code-list, codelist: synthetic-codes, codelist_version: '1', minimum_items: 1, maximum_items: 3, unique: true}
+    positive: [[C-A], [C-A, C-B]]
+    boundary: [[C-A, C-B, C-C]]
+    negative: [[], [C-A, C-A], [UNKNOWN], [C-A, C-B, C-C, C-D], C-A]
+  - form: entity-reference-list
+    declaration: {form: entity-reference-list, minimum_items: 1, maximum_items: 2, unique: true}
+    derivation_positive:
+      - ['entity_reference_seed("synthetic-seed-a")']
+      - ['entity_reference_seed("synthetic-seed-a")', 'entity_reference_seed("synthetic-seed-b")']
+    positive:
+      - [{form: audience-scoped-entity-reference, reference: 'urn:evidence:entity:v1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'}]
+    boundary:
+      - [{form: audience-scoped-entity-reference, reference: 'urn:evidence:entity:v1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'}, {form: audience-scoped-entity-reference, reference: 'urn:evidence:entity:v1_BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB'}]
+    negative:
+      - []
+      - [{form: audience-scoped-entity-reference, reference: 'urn:evidence:entity:v1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'}, {form: audience-scoped-entity-reference, reference: 'urn:evidence:entity:v1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'}]
+      - [{form: audience-scoped-entity-reference, reference: 'urn:evidence:entity:v1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'}, {form: audience-scoped-entity-reference, reference: 'urn:evidence:entity:v1_BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB'}, {form: audience-scoped-entity-reference, reference: 'urn:evidence:entity:v1_CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC'}]
+      - [{rhai: ['entity_reference_seed("synthetic-seed-a")', raw-seed-b], reason: mixed protected seed and raw string}]
+  - form: reviewed-structured-value
+    declaration:
+      form: reviewed-structured-value
+      schema: urn:example:fixture:schema:closed-structure:v1
+      maximum_serialized_bytes: 512
+      fields:
+        status: {form: controlled-code, codelist: synthetic-codes, codelist_version: '1'}
+        quantity: {form: bounded-integer, minimum: 0, maximum: 9}
+    positive:
+      - {form: reviewed-structured-value, schema: urn:example:fixture:schema:closed-structure:v1, fields: {status: C-A, quantity: 4}}
+    boundary:
+      - {form: reviewed-structured-value, schema: urn:example:fixture:schema:closed-structure:v1, fields: {status: C-B, quantity: 9}}
+    negative:
+      - {form: reviewed-structured-value, schema: urn:example:fixture:schema:closed-structure:v1, fields: {status: C-A, quantity: 4, extra: leaked}}
+      - {form: reviewed-structured-value, schema: urn:example:fixture:schema:other:v1, fields: {status: C-A, quantity: 4}}
+      - {form: reviewed-structured-value, schema: urn:example:fixture:schema:closed-structure:v1, fields: {status: UNKNOWN, quantity: 4}}
+      - {form: reviewed-structured-value, schema: urn:example:fixture:schema:closed-structure:v1, fields: {status: C-A}}
+global_negative:
+  - undeclared-concept
+  - duplicate-concept
+  - missing-required-concept
+  - extra-value-metadata
+  - per-value-size-plus-one
+  - aggregate-result-size-plus-one
+round_trip: Every positive and boundary value must preserve its JSON type through core evidence construction, flattened JWS serialization, signature verification, and payload parsing.
diff --git a/products/evidence/fixtures/conformance/supported-values/adapters/source-prepare.rhai b/products/evidence/fixtures/conformance/supported-values/adapters/source-prepare.rhai
new file mode 100644
index 000000000..9e7f4c5b3
--- /dev/null
+++ b/products/evidence/fixtures/conformance/supported-values/adapters/source-prepare.rhai
@@ -0,0 +1,11 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"];
+    #{
+        query: [],
+        body: #{
+            lookup: #{opaque_id: subject["values"]["opaque_id"]},
+            fields: parameters["requestedFields"],
+            limit: parameters["resultLimit"]
+        }
+    }
+}
diff --git a/products/evidence/fixtures/conformance/supported-values/adapters/source.rhai b/products/evidence/fixtures/conformance/supported-values/adapters/source.rhai
new file mode 100644
index 000000000..66f4b87a4
--- /dev/null
+++ b/products/evidence/fixtures/conformance/supported-values/adapters/source.rhai
@@ -0,0 +1,9 @@
+fn extract(source_response, parameters) {
+    if source_response.total == 0 {
+        return #{ outcome: "no_match" };
+    }
+    if source_response.total > 1 {
+        return #{ outcome: "ambiguous" };
+    }
+    #{ outcome: "match", facts: #{ marker: source_response.marker } }
+}
diff --git a/products/evidence/fixtures/conformance/supported-values/codelists/categories.yaml b/products/evidence/fixtures/conformance/supported-values/codelists/categories.yaml
new file mode 100644
index 000000000..a51935f58
--- /dev/null
+++ b/products/evidence/fixtures/conformance/supported-values/codelists/categories.yaml
@@ -0,0 +1,3 @@
+id: urn:example:fixture:scheme:category
+version: '1'
+codes: [category-a, category-bound]
diff --git a/products/evidence/fixtures/conformance/supported-values/codelists/date-buckets.yaml b/products/evidence/fixtures/conformance/supported-values/codelists/date-buckets.yaml
new file mode 100644
index 000000000..abfab2754
--- /dev/null
+++ b/products/evidence/fixtures/conformance/supported-values/codelists/date-buckets.yaml
@@ -0,0 +1,3 @@
+id: urn:example:fixture:scheme:date-bucket
+version: '1'
+codes: [current-period, boundary-period]
diff --git a/products/evidence/fixtures/conformance/supported-values/codelists/synthetic-codes.yaml b/products/evidence/fixtures/conformance/supported-values/codelists/synthetic-codes.yaml
new file mode 100644
index 000000000..9bcf25c63
--- /dev/null
+++ b/products/evidence/fixtures/conformance/supported-values/codelists/synthetic-codes.yaml
@@ -0,0 +1,3 @@
+id: urn:example:fixture:codelist:synthetic-codes
+version: '1'
+codes: [C-A, C-B, C-C, C-BOUND]
diff --git a/products/evidence/fixtures/conformance/supported-values/codelists/time-buckets.yaml b/products/evidence/fixtures/conformance/supported-values/codelists/time-buckets.yaml
new file mode 100644
index 000000000..8505c7819
--- /dev/null
+++ b/products/evidence/fixtures/conformance/supported-values/codelists/time-buckets.yaml
@@ -0,0 +1,3 @@
+id: urn:example:fixture:scheme:time-bucket
+version: '1'
+codes: [within-window, at-limit]
diff --git a/products/evidence/fixtures/conformance/supported-values/derivations/values.rhai b/products/evidence/fixtures/conformance/supported-values/derivations/values.rhai
new file mode 100644
index 000000000..af96961e4
--- /dev/null
+++ b/products/evidence/fixtures/conformance/supported-values/derivations/values.rhai
@@ -0,0 +1,6 @@
+fn derive(facts, selectors, evaluation_context) {
+    [#{
+        concept_id: "urn:example:fixture:concept:boolean",
+        value: required(facts.marker, "required_fact_missing") == "accepted"
+    }]
+}
diff --git a/products/evidence/fixtures/conformance/supported-values/evidence.yaml b/products/evidence/fixtures/conformance/supported-values/evidence.yaml
new file mode 100644
index 000000000..347178884
--- /dev/null
+++ b/products/evidence/fixtures/conformance/supported-values/evidence.yaml
@@ -0,0 +1,119 @@
+version: 1
+assuranceProfile: evidence-grade
+service:
+  providerId: urn:example:fixture:provider:evidence
+  trustDomain: urn:example:fixture:trust-domain:supported-values
+issuer: {id: urn:example:fixture:issuer:authority}
+authentication:
+  kind: oidc-access-token
+  issuer: https://identity.invalid
+  audiences: [evidence-fixture]
+  tokenTypes: [at+jwt]
+  algorithms: [EdDSA]
+  jwksUri: https://identity.invalid/.well-known/jwks.json
+  principalClaim: sub
+  requesterTagsClaim: evidence_tags
+  evidenceAudienceClaim: evidence_audience
+  grantIdClaim: evidence_grant_id
+  grantAuthorityClaim: evidence_authority
+audit:
+  format: keyed-jsonl
+  hashSecretRef: secret:file/audit-hash-key
+  hashKeyVersion: 1
+  failClosed: true
+subjectBinding:
+  secretRef: secret:file/subject-binding-key
+  keyVersion: 1
+rateLimits:
+  requestsPerPrincipalPerMinute: 60
+  burstPerPrincipal: 10
+  failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 10
+signing:
+  format: flattened-jws-json
+  algorithm: EdDSA
+  activeKeyId: supported-values-fixture-key
+  activeKeyRef: secret:file/signing-key
+  retiredPublicJwkFiles: []
+  jwksPath: /.well-known/evidence/jwks.json
+  maximumAssertionValiditySeconds: 86400
+  verifierClockSkewSeconds: 30
+responseFormats: [signed-jws]
+
+selectorProfiles:
+  synthetic-subject-v1:
+    maximumAggregateBytes: 64
+    fields:
+      opaque_id: {type: string, minimumBytes: 1, maximumBytes: 32}
+sources:
+  synthetic-source:
+    transport: http-json
+    baseUrl: https://source.invalid
+    posture: field-projected
+    authentication: {kind: static-bearer, tokenRef: secret:file/source-token}
+    request:
+      method: POST
+      path: /v1/facts
+      fixedHeaders: [{name: Accept, value: application/json}]
+      selectorInputs:
+        - role: subject
+          alternatives:
+            - {profile: synthetic-subject-v1, fields: [opaque_id]}
+      prepareScript: adapters/source-prepare.rhai
+      adapterParameters: {requestedFields: [marker], resultLimit: 2}
+      adapterParametersSchema: schemas/adapter-parameters.schema.yaml
+      preparationLimits:
+        query: forbidden
+        jsonBody: required
+        maximumJsonDepth: 8
+        maximumCollectionItems: 16
+        maximumStringBytes: 128
+        maximumNormalizedBytes: 2048
+      projection: [/total, /marker]
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 2
+    responseSchema: schemas/response.schema.yaml
+    extractScript: adapters/source.rhai
+    factSchema: schemas/facts.schema.yaml
+authorityProfiles:
+  synthetic-authority-v1:
+    kind: statutory
+    requesterTags: [fixture]
+    grants:
+      - requirement: urn:example:fixture:requirement:supported-values:v1
+        purpose: conformance
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects:
+          - {role: subject, selectorProfile: synthetic-subject-v1, valueOrigin: request}
+requirements:
+  - id: urn:example:fixture:requirement:supported-values:v1
+    kind: information-requirement
+    source: synthetic-source
+    purposes: [conformance]
+    subjectRoles:
+      - {role: subject, cardinality: one, selectorProfiles: [synthetic-subject-v1]}
+    referenceFrameworks: [urn:example:fixture:framework:supported-values:v1]
+    evidenceType: urn:example:fixture:evidence-type:supported-values:v1
+    observationTimezone: UTC
+    validitySeconds: 86400
+    derivation:
+      script: derivations/values.rhai
+      parameters: {}
+    concepts:
+      - {id: urn:example:fixture:concept:boolean, form: boolean, required: true, constraints: {}}
+      - {id: urn:example:fixture:concept:controlled-code, form: controlled-code, required: false, constraints: {codelist: codelists/synthetic-codes.yaml, codelistVersion: '1', maximumBytes: 8}}
+      - {id: urn:example:fixture:concept:controlled-category, form: controlled-category, required: false, constraints: {categoryScheme: urn:example:fixture:scheme:category, schemeVersion: '1', maximumBytes: 16, codelist: codelists/categories.yaml}}
+      - {id: urn:example:fixture:concept:bounded-integer, form: bounded-integer, required: false, constraints: {minimum: -10, maximum: 10}}
+      - {id: urn:example:fixture:concept:bounded-decimal, form: bounded-decimal, required: false, constraints: {minimum: '-10.5', maximum: '10.5', maximumScale: 2}}
+      - {id: urn:example:fixture:concept:date-bucket, form: date-bucket, required: false, constraints: {bucketScheme: urn:example:fixture:scheme:date-bucket, schemeVersion: '1'}}
+      - {id: urn:example:fixture:concept:time-bucket, form: time-bucket, required: false, constraints: {bucketScheme: urn:example:fixture:scheme:time-bucket, schemeVersion: '1'}}
+      - {id: urn:example:fixture:concept:audience-scoped-entity-reference, form: audience-scoped-entity-reference, required: false, constraints: {maximumBytes: 160}}
+      - {id: urn:example:fixture:concept:controlled-code-list, form: controlled-code-list, required: false, constraints: {codelist: codelists/synthetic-codes.yaml, codelistVersion: '1', minimumItems: 1, maximumItems: 3, unique: true}}
+      - {id: urn:example:fixture:concept:entity-reference-list, form: entity-reference-list, required: false, constraints: {minimumItems: 1, maximumItems: 2, unique: true}}
+      - {id: urn:example:fixture:concept:reviewed-structured-value, form: reviewed-structured-value, required: false, constraints: {schema: urn:example:fixture:schema:closed-structure:v1, maximumSerializedBytes: 512}}
+    fixtures: fixtures/cases.yaml
+    disclosureGuard:
+      families: [urn:example:fixture:disclosure-family:supported-values]
+    existenceDisclosure: collapse-unresolved
diff --git a/products/evidence/fixtures/conformance/supported-values/fixtures/cases.yaml b/products/evidence/fixtures/conformance/supported-values/fixtures/cases.yaml
new file mode 100644
index 000000000..38b94752f
--- /dev/null
+++ b/products/evidence/fixtures/conformance/supported-values/fixtures/cases.yaml
@@ -0,0 +1,11 @@
+fixture: registry.evidence.conformance.supported-values-bundle/v1
+synthetic_only: true
+cases:
+  - {id: positive}
+  - {id: negative-output}
+  - {id: boundary-value}
+  - {id: missing-fact}
+  - {id: no-match}
+  - {id: ambiguous-result}
+  - {id: source-failure}
+  - {id: anti-reconstruction}
diff --git a/products/evidence/fixtures/conformance/supported-values/schemas/adapter-parameters.schema.yaml b/products/evidence/fixtures/conformance/supported-values/schemas/adapter-parameters.schema.yaml
new file mode 100644
index 000000000..513bb11de
--- /dev/null
+++ b/products/evidence/fixtures/conformance/supported-values/schemas/adapter-parameters.schema.yaml
@@ -0,0 +1,7 @@
+type: object
+additionalProperties: false
+required: [requestedFields, resultLimit]
+properties:
+  requestedFields:
+    const: [marker]
+  resultLimit: {const: 2}
diff --git a/products/evidence/fixtures/conformance/supported-values/schemas/closed-structure.schema.yaml b/products/evidence/fixtures/conformance/supported-values/schemas/closed-structure.schema.yaml
new file mode 100644
index 000000000..7cfd6466d
--- /dev/null
+++ b/products/evidence/fixtures/conformance/supported-values/schemas/closed-structure.schema.yaml
@@ -0,0 +1,8 @@
+$schema: https://json-schema.org/draft/2020-12/schema
+$id: urn:example:fixture:schema:closed-structure:v1
+type: object
+additionalProperties: false
+required: [status, quantity]
+properties:
+  status: {type: string, enum: [C-A, C-B, C-C, C-BOUND]}
+  quantity: {type: integer, minimum: 0, maximum: 9}
diff --git a/products/evidence/fixtures/conformance/supported-values/schemas/facts.schema.yaml b/products/evidence/fixtures/conformance/supported-values/schemas/facts.schema.yaml
new file mode 100644
index 000000000..ff8874491
--- /dev/null
+++ b/products/evidence/fixtures/conformance/supported-values/schemas/facts.schema.yaml
@@ -0,0 +1,5 @@
+type: object
+additionalProperties: false
+required: [marker]
+properties:
+  marker: {type: string, enum: [accepted]}
diff --git a/products/evidence/fixtures/conformance/supported-values/schemas/response.schema.yaml b/products/evidence/fixtures/conformance/supported-values/schemas/response.schema.yaml
new file mode 100644
index 000000000..71d1d5335
--- /dev/null
+++ b/products/evidence/fixtures/conformance/supported-values/schemas/response.schema.yaml
@@ -0,0 +1,6 @@
+type: object
+additionalProperties: false
+required: [total]
+properties:
+  total: {type: integer, minimum: 0, maximum: 1000000}
+  marker: {type: string, minLength: 1, maxLength: 32}
diff --git a/products/evidence/fixtures/source-shapes/dhis2-tracker-style/adapters/nested-paged-rest-prepare.rhai b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/adapters/nested-paged-rest-prepare.rhai
new file mode 100644
index 000000000..a5f3e8888
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/adapters/nested-paged-rest-prepare.rhai
@@ -0,0 +1,15 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"];
+    #{
+        query: [
+            #{name: "program", value: parameters["program"]},
+            #{name: "orgUnits", value: parameters["organisationUnits"]},
+            #{name: "trackedEntities", value: subject["values"]["record_reference"]},
+            #{name: "fields", value: parameters["fields"]},
+            #{name: "pageSize", value: parameters["pageSize"]},
+            #{name: "page", value: parameters["page"]},
+            #{name: "totalPages", value: parameters["totalPages"]}
+        ],
+        body: ()
+    }
+}
diff --git a/products/evidence/fixtures/source-shapes/dhis2-tracker-style/adapters/nested-paged-rest.rhai b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/adapters/nested-paged-rest.rhai
new file mode 100644
index 000000000..9ca2418c3
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/adapters/nested-paged-rest.rhai
@@ -0,0 +1,62 @@
+fn extract(source_response, parameters) {
+    if !source_response.contains("pager") ||
+       !source_response.contains("trackedEntities") ||
+       source_response.len() != 2 {
+        throw("source_protocol_error");
+    }
+
+    let pager = source_response.pager;
+    let records = source_response.trackedEntities;
+    if !pager.contains("page") ||
+       !pager.contains("pageSize") ||
+       !pager.contains("total") ||
+       !pager.contains("pageCount") ||
+       pager.len() != 4 ||
+       type_of(pager.page) != "i64" ||
+       type_of(pager.pageSize) != "i64" ||
+       type_of(pager.total) != "i64" ||
+       type_of(pager.pageCount) != "i64" ||
+       pager.page != 1 ||
+       pager.pageSize != 2 ||
+       pager.total < 0 ||
+       pager.total > 2 ||
+       pager.total != records.len ||
+       (pager.total == 0 && pager.pageCount != 0) ||
+       (pager.total > 0 && pager.pageCount != 1) {
+        throw("source_protocol_error");
+    }
+
+    if records.len == 0 {
+        return #{ outcome: "no_match" };
+    }
+    if records.len > 1 {
+        return #{ outcome: "ambiguous" };
+    }
+    let status_code = ();
+    let found_status = false;
+    if records[0].len() != 1 ||
+       !records[0].contains("attributes") ||
+       type_of(records[0].attributes) != "array" {
+        throw("source_protocol_error");
+    }
+    for attribute in records[0].attributes {
+        if attribute.len() != 2 ||
+           !attribute.contains("attribute") ||
+           !attribute.contains("value") ||
+           type_of(attribute.attribute) != "string" ||
+           type_of(attribute.value) != "string" {
+            throw("source_protocol_error");
+        }
+        if attribute.attribute == parameters["statusAttribute"] {
+            if found_status {
+                throw("source_protocol_error");
+            }
+            found_status = true;
+            status_code = attribute.value;
+        }
+    }
+    #{
+        outcome: "match",
+        facts: #{ official_residence_code: status_code }
+    }
+}
diff --git a/products/evidence/fixtures/source-shapes/dhis2-tracker-style/contract.yaml b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/contract.yaml
new file mode 100644
index 000000000..a30a9a3b6
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/contract.yaml
@@ -0,0 +1,108 @@
+fixture: registry.evidence.source-shape.dhis2-tracker-style/v1
+classification: compatibility-shaped-local-mock
+synthetic_only: true
+server: {base_url: 'http://127.0.0.2:18082', bind: '127.0.0.2:18082'}
+validated_source_definition:
+  transport: http-json
+  baseUrl: http://127.0.0.2:18082
+  posture: field-projected
+  authentication:
+    kind: basic
+    usernameRef: secret:file/fixture-nested-rest-username
+    passwordRef: secret:file/fixture-nested-rest-password
+  request:
+    method: GET
+    path: /api/tracker/trackedEntities
+    fixedHeaders:
+      - {name: Accept, value: application/json}
+    selectorInputs:
+      - role: subject
+        alternatives:
+          - {profile: civil-record-reference-v1, fields: [record_reference]}
+    prepareScript: adapters/nested-paged-rest-prepare.rhai
+    adapterParameters:
+      program: PROGRAM-FIXTURE
+      organisationUnits: OU-FIXTURE
+      fields: trackedEntity,attributes[attribute,value]
+      pageSize: "2"
+      page: "1"
+      totalPages: "true"
+      statusAttribute: ATTR-STATUS
+    adapterParametersSchema: schemas/adapter-parameters.schema.yaml
+    preparationLimits:
+      query: required
+      jsonBody: forbidden
+      maximumQueryPairs: 7
+      maximumQueryNameBytes: 64
+      maximumQueryValueBytes: 1024
+      maximumNormalizedBytes: 4096
+    projection:
+      - /pager/page
+      - /pager/pageSize
+      - /pager/total
+      - /pager/pageCount
+      - /trackedEntities/*/attributes/*/attribute
+      - /trackedEntities/*/attributes/*/value
+    redirects: deny
+    timeoutMilliseconds: 3000
+    maximumResponseBytes: 65536
+    concurrencyLimit: 4
+  responseSchema: schemas/response.schema.yaml
+  extractScript: adapters/nested-paged-rest.rhai
+  factSchema: schemas/facts.schema.yaml
+reference_shape: DHIS2 Tracker 2.43
+scope: Only the consumed request, pager, collection, and nested attribute boundary
+request:
+  method: GET
+  path: /api/tracker/trackedEntities
+  query:
+    program: PROGRAM-FIXTURE
+    orgUnits: OU-FIXTURE
+    trackedEntities: B0000000001
+    fields: trackedEntity,attributes[attribute,value]
+    pageSize: "2"
+    page: "1"
+    totalPages: "true"
+  query_order: [program, orgUnits, trackedEntities, fields, pageSize, page, totalPages]
+  headers:
+    accept: application/json
+    authorization: HTTP Basic injected from two secret references; exact value never snapshotted
+  body: absent
+  unexpected_request: fail test
+selector_contracts:
+  identifier_only:
+    profile: civil-record-reference-v1
+    prepared_field: query.trackedEntities
+    outer_boundary: exactly one reviewed tracked-entity UID
+cardinality:
+  zero: responses/no-match.json
+  one: responses/match.json
+  multiple: responses/ambiguous.json
+  inconsistent: responses/inconsistent-cardinality.json
+  page_size: 2
+  second_page_request: prohibited
+  requests_after_response: 0
+extraction:
+  configured_attribute: ATTR-STATUS
+  provider_fields: [ATTR-STATUS]
+  match_facts: [official_residence_code]
+  missing_fact: responses/missing-fact.json
+  error_envelope: responses/error-envelope.json
+  cardinality_consistency: pager total must equal the returned collection length
+  product_identifiers_disclosed: false
+failures:
+  - http-401
+  - http-403
+  - http-429
+  - http-500
+  - timeout
+  - redirect
+  - invalid-json
+  - wrong-media-type
+  - oversized-response
+  - error-envelope
+  - pager-count-mismatch
+redaction_canaries:
+  committed_source_and_selector: [Synthetic, Subject, '2000-02-29', B0000000001, SOURCE-STATUS-CANARY-DO-NOT-LOG]
+  runtime_generated_secret_classes: [basic-username, basic-password]
+claim: Compatibility-shaped fixture only; not an emulator, connector certification, or maintained vendor integration.
diff --git a/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/ambiguous.json b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/ambiguous.json
new file mode 100644
index 000000000..e3978bc18
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/ambiguous.json
@@ -0,0 +1,18 @@
+{
+  "pager": {
+    "page": 1,
+    "pageSize": 2,
+    "total": 2,
+    "pageCount": 1
+  },
+  "trackedEntities": [
+    {
+      "trackedEntity": "C0000000001",
+      "attributes": [{"attribute": "ATTR-STATUS", "value": "C-A"}]
+    },
+    {
+      "trackedEntity": "C0000000001",
+      "attributes": [{"attribute": "ATTR-STATUS", "value": "C-B"}]
+    }
+  ]
+}
diff --git a/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/error-envelope.json b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/error-envelope.json
new file mode 100644
index 000000000..5625e88fb
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/error-envelope.json
@@ -0,0 +1,7 @@
+{
+  "errors": [
+    {"code": "SYNTHETIC-SOURCE-ERROR"}
+  ],
+  "pager": {"page": 1, "pageSize": 2, "total": 0, "pageCount": 0},
+  "trackedEntities": []
+}
diff --git a/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/inconsistent-cardinality.json b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/inconsistent-cardinality.json
new file mode 100644
index 000000000..4fa63031f
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/inconsistent-cardinality.json
@@ -0,0 +1,19 @@
+{
+  "pager": {
+    "page": 1,
+    "pageSize": 2,
+    "total": 0,
+    "pageCount": 0
+  },
+  "trackedEntities": [
+    {
+      "trackedEntity": "F0000000001",
+      "attributes": [
+        {
+          "attribute": "ATTR-STATUS",
+          "value": "C-A"
+        }
+      ]
+    }
+  ]
+}
diff --git a/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/match.json b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/match.json
new file mode 100644
index 000000000..b33eb0380
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/match.json
@@ -0,0 +1,16 @@
+{
+  "pager": {
+    "page": 1,
+    "pageSize": 2,
+    "total": 1,
+    "pageCount": 1
+  },
+  "trackedEntities": [
+    {
+      "trackedEntity": "B0000000001",
+      "attributes": [
+        {"attribute": "ATTR-STATUS", "value": "R-101"}
+      ]
+    }
+  ]
+}
diff --git a/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/missing-fact.json b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/missing-fact.json
new file mode 100644
index 000000000..caf43d913
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/missing-fact.json
@@ -0,0 +1,14 @@
+{
+  "pager": {
+    "page": 1,
+    "pageSize": 2,
+    "total": 1,
+    "pageCount": 1
+  },
+  "trackedEntities": [
+    {
+      "trackedEntity": "E0000000001",
+      "attributes": []
+    }
+  ]
+}
diff --git a/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/no-match.json b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/no-match.json
new file mode 100644
index 000000000..3ac0531ea
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/responses/no-match.json
@@ -0,0 +1,9 @@
+{
+  "pager": {
+    "page": 1,
+    "pageSize": 2,
+    "total": 0,
+    "pageCount": 0
+  },
+  "trackedEntities": []
+}
diff --git a/products/evidence/fixtures/source-shapes/dhis2-tracker-style/schemas/adapter-parameters.schema.yaml b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/schemas/adapter-parameters.schema.yaml
new file mode 100644
index 000000000..df3b456f5
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/schemas/adapter-parameters.schema.yaml
@@ -0,0 +1,11 @@
+type: object
+additionalProperties: false
+required: [program, organisationUnits, fields, pageSize, page, totalPages, statusAttribute]
+properties:
+  program: {const: PROGRAM-FIXTURE}
+  organisationUnits: {const: OU-FIXTURE}
+  fields: {const: 'trackedEntity,attributes[attribute,value]'}
+  pageSize: {const: "2"}
+  page: {const: "1"}
+  totalPages: {const: "true"}
+  statusAttribute: {const: ATTR-STATUS}
diff --git a/products/evidence/fixtures/source-shapes/dhis2-tracker-style/schemas/facts.schema.yaml b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/schemas/facts.schema.yaml
new file mode 100644
index 000000000..d3e45d7b6
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/schemas/facts.schema.yaml
@@ -0,0 +1,5 @@
+type: object
+additionalProperties: false
+required: [official_residence_code]
+properties:
+  official_residence_code: {type: string, minLength: 1, maxLength: 32}
diff --git a/products/evidence/fixtures/source-shapes/dhis2-tracker-style/schemas/response.schema.yaml b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/schemas/response.schema.yaml
new file mode 100644
index 000000000..4ef7aa0e3
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/dhis2-tracker-style/schemas/response.schema.yaml
@@ -0,0 +1,51 @@
+# Shape of the projected tracker response, checked before extraction runs.
+# The prepared request asks for page 1 of size 2, so the pager echo is a
+# constant here rather than a comparison the script has to repeat.
+type: object
+additionalProperties: false
+required: [pager, trackedEntities]
+properties:
+  pager:
+    type: object
+    additionalProperties: false
+    required: [page, pageSize, total, pageCount]
+    properties:
+      page:
+        type: integer
+        const: 1
+      pageSize:
+        type: integer
+        const: 2
+      total:
+        type: integer
+        minimum: 0
+        maximum: 2
+      pageCount:
+        type: integer
+        minimum: 0
+        maximum: 1
+  trackedEntities:
+    type: array
+    minItems: 0
+    maxItems: 2
+    items:
+      type: object
+      additionalProperties: false
+      required: [attributes]
+      properties:
+        attributes:
+          type: array
+          minItems: 0
+          maxItems: 64
+          items:
+            type: object
+            additionalProperties: false
+            required: [attribute, value]
+            properties:
+              attribute:
+                type: string
+                minLength: 1
+                maxLength: 64
+              value:
+                type: string
+                maxLength: 512
diff --git a/products/evidence/fixtures/source-shapes/flat-rest/adapters/flat-rest-prepare.rhai b/products/evidence/fixtures/source-shapes/flat-rest/adapters/flat-rest-prepare.rhai
new file mode 100644
index 000000000..92a5e0bb7
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/flat-rest/adapters/flat-rest-prepare.rhai
@@ -0,0 +1,23 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"];
+    let values = subject["values"];
+    let selector = #{};
+
+    if subject["profile"] == "opaque-record-v1" {
+        selector["record_reference"] = values["record_reference"];
+    } else if subject["profile"] == "opaque-coordinates-v1" {
+        selector["alpha"] = values["alpha"];
+        selector["delta"] = values["delta"];
+    } else {
+        throw("adapter_input_error");
+    }
+
+    #{
+        query: [],
+        body: #{
+            selector: selector,
+            fields: [parameters["requestedField"]],
+            limit: parameters["resultLimit"]
+        }
+    }
+}
diff --git a/products/evidence/fixtures/source-shapes/flat-rest/adapters/flat-rest.rhai b/products/evidence/fixtures/source-shapes/flat-rest/adapters/flat-rest.rhai
new file mode 100644
index 000000000..b82754fb9
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/flat-rest/adapters/flat-rest.rhai
@@ -0,0 +1,32 @@
+fn extract(source_response, parameters) {
+    if len(source_response) != 2 ||
+       !source_response.contains("total") ||
+       type_of(source_response["total"]) != "i64" ||
+       source_response["total"] < 0 ||
+       source_response["total"] > parameters["resultLimit"] {
+        throw("source_protocol_error");
+    }
+    if source_response["total"] == 0 {
+        if !source_response.contains("result") ||
+           !is_missing(source_response["result"]) {
+            throw("source_protocol_error");
+        }
+        return #{ outcome: "no_match" };
+    }
+    if source_response["total"] > 1 {
+        if !source_response.contains("results") ||
+           type_of(source_response["results"]) != "array" ||
+           source_response["results"].len != source_response["total"] {
+            throw("source_protocol_error");
+        }
+        return #{ outcome: "ambiguous" };
+    }
+    if !source_response.contains("result") ||
+       type_of(source_response["result"]) != "map" {
+        throw("source_protocol_error");
+    }
+    #{
+        outcome: "match",
+        facts: #{ official_residence_code: source_response["result"]["fact_code"] }
+    }
+}
diff --git a/products/evidence/fixtures/source-shapes/flat-rest/contract.yaml b/products/evidence/fixtures/source-shapes/flat-rest/contract.yaml
new file mode 100644
index 000000000..28c5b01e1
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/flat-rest/contract.yaml
@@ -0,0 +1,78 @@
+fixture: registry.evidence.source-shape.flat-rest/v1
+classification: compatibility-shaped-local-mock
+synthetic_only: true
+server: {base_url: 'http://127.0.0.1:18081', bind: '127.0.0.1:18081'}
+validated_source_definition:
+  transport: http-json
+  baseUrl: http://127.0.0.1:18081
+  posture: source-derived
+  authentication: {kind: static-bearer, tokenRef: secret:file/fixture-flat-rest-token}
+  request:
+    method: POST
+    path: /v1/lookup
+    selectorInputs:
+      - role: subject
+        alternatives:
+          - {profile: opaque-record-v1, fields: [record_reference]}
+          - {profile: opaque-coordinates-v1, fields: [alpha, delta]}
+    prepareScript: adapters/flat-rest-prepare.rhai
+    adapterParameters: {requestedField: fact_code, resultLimit: 2}
+    adapterParametersSchema: schemas/adapter-parameters.schema.yaml
+    preparationLimits:
+      query: forbidden
+      jsonBody: required
+      maximumJsonDepth: 8
+      maximumCollectionItems: 8
+      maximumStringBytes: 512
+      maximumNormalizedBytes: 4096
+    projection: [/total, /result, /results]
+    redirects: deny
+    timeoutMilliseconds: 3000
+    maximumResponseBytes: 65536
+    concurrencyLimit: 4
+  responseSchema: schemas/response.schema.yaml
+  extractScript: adapters/flat-rest.rhai
+  factSchema: schemas/facts.schema.yaml
+request:
+  method: POST
+  path: /v1/lookup
+  query: {}
+  headers:
+    content-type: application/json
+    authorization: static-bearer injected from secret reference; exact value never snapshotted
+  body:
+    selector: {alpha: synthetic-alpha, delta: 42}
+    fields: [fact_code]
+    limit: 2
+  exact_body_keys: [selector, fields, limit]
+  unexpected_request: fail test
+selector_contracts:
+  identifier_only: {profile: opaque-record-v1, prepared_fields: [record_reference]}
+  compound_no_identifier: {profile: opaque-coordinates-v1, prepared_fields: [alpha, delta]}
+  preparation: The reviewed prepare/2 script emits only the selected profile's exact fields beneath body.selector.
+cardinality:
+  zero: responses/no-match.json
+  one: responses/match.json
+  multiple: responses/ambiguous.json
+  requests_after_response: 0
+  maximum_results: 2
+extraction:
+  provider_fields: [fact_code]
+  match_facts: [official_residence_code]
+  missing_fact: responses/missing-fact.json
+  error_envelope: responses/error-envelope.json
+  candidate_material_to_derivation: prohibited
+failures:
+  - {case: http-401, public: dependency_unavailable}
+  - {case: http-403, public: dependency_unavailable}
+  - {case: http-429, public: dependency_unavailable, retry_after: bounded}
+  - {case: http-500, public: dependency_unavailable}
+  - {case: timeout, public: dependency_unavailable}
+  - {case: redirect, expected: reject-without-follow}
+  - {case: invalid-json, public: dependency_unavailable}
+  - {case: wrong-media-type, public: dependency_unavailable}
+  - {case: oversized-response, public: dependency_unavailable}
+  - {case: error-envelope, public: dependency_unavailable}
+redaction_canaries:
+  committed_source_and_selector: [synthetic-alpha, SOURCE-FACT-CANARY-DO-NOT-LOG]
+  runtime_generated_secret_classes: [static-bearer]
diff --git a/products/evidence/fixtures/source-shapes/flat-rest/responses/ambiguous.json b/products/evidence/fixtures/source-shapes/flat-rest/responses/ambiguous.json
new file mode 100644
index 000000000..771b36536
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/flat-rest/responses/ambiguous.json
@@ -0,0 +1,7 @@
+{
+  "total": 2,
+  "results": [
+    {"fact_code": "C-A"},
+    {"fact_code": "C-B"}
+  ]
+}
diff --git a/products/evidence/fixtures/source-shapes/flat-rest/responses/error-envelope.json b/products/evidence/fixtures/source-shapes/flat-rest/responses/error-envelope.json
new file mode 100644
index 000000000..d2be14e7e
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/flat-rest/responses/error-envelope.json
@@ -0,0 +1,6 @@
+{
+  "errors": [
+    {"code": "SYNTHETIC-SOURCE-ERROR"}
+  ],
+  "total": 0
+}
diff --git a/products/evidence/fixtures/source-shapes/flat-rest/responses/match.json b/products/evidence/fixtures/source-shapes/flat-rest/responses/match.json
new file mode 100644
index 000000000..9bb404064
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/flat-rest/responses/match.json
@@ -0,0 +1,6 @@
+{
+  "total": 1,
+  "result": {
+    "fact_code": "R-101"
+  }
+}
diff --git a/products/evidence/fixtures/source-shapes/flat-rest/responses/missing-fact.json b/products/evidence/fixtures/source-shapes/flat-rest/responses/missing-fact.json
new file mode 100644
index 000000000..f0ae68e51
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/flat-rest/responses/missing-fact.json
@@ -0,0 +1,4 @@
+{
+  "total": 1,
+  "result": {}
+}
diff --git a/products/evidence/fixtures/source-shapes/flat-rest/responses/no-match.json b/products/evidence/fixtures/source-shapes/flat-rest/responses/no-match.json
new file mode 100644
index 000000000..606cc0818
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/flat-rest/responses/no-match.json
@@ -0,0 +1,4 @@
+{
+  "total": 0,
+  "result": null
+}
diff --git a/products/evidence/fixtures/source-shapes/flat-rest/schemas/adapter-parameters.schema.yaml b/products/evidence/fixtures/source-shapes/flat-rest/schemas/adapter-parameters.schema.yaml
new file mode 100644
index 000000000..0bfd709fd
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/flat-rest/schemas/adapter-parameters.schema.yaml
@@ -0,0 +1,6 @@
+type: object
+additionalProperties: false
+required: [requestedField, resultLimit]
+properties:
+  requestedField: {const: fact_code}
+  resultLimit: {const: 2}
diff --git a/products/evidence/fixtures/source-shapes/flat-rest/schemas/facts.schema.yaml b/products/evidence/fixtures/source-shapes/flat-rest/schemas/facts.schema.yaml
new file mode 100644
index 000000000..d3e45d7b6
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/flat-rest/schemas/facts.schema.yaml
@@ -0,0 +1,5 @@
+type: object
+additionalProperties: false
+required: [official_residence_code]
+properties:
+  official_residence_code: {type: string, minLength: 1, maxLength: 32}
diff --git a/products/evidence/fixtures/source-shapes/flat-rest/schemas/response.schema.yaml b/products/evidence/fixtures/source-shapes/flat-rest/schemas/response.schema.yaml
new file mode 100644
index 000000000..250748b00
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/flat-rest/schemas/response.schema.yaml
@@ -0,0 +1,34 @@
+# Shape of the projected lookup response, checked before extraction runs.
+# The source reports an explicit null result where it found nothing, so the
+# result leaf is written as the nullable pair the response subset admits; the
+# script reads that null with is_missing, exactly as it reads an absent leaf.
+type: object
+additionalProperties: false
+required: [total]
+properties:
+  total:
+    type: integer
+    minimum: 0
+    maximum: 1000000
+  result:
+    type: [object, "null"]
+    additionalProperties: false
+    required: []
+    properties:
+      fact_code:
+        type: string
+        minLength: 1
+        maxLength: 32
+  results:
+    type: array
+    minItems: 0
+    maxItems: 2
+    items:
+      type: object
+      additionalProperties: false
+      required: []
+      properties:
+        fact_code:
+          type: string
+          minLength: 1
+          maxLength: 32
diff --git a/products/evidence/fixtures/source-shapes/index.yaml b/products/evidence/fixtures/source-shapes/index.yaml
new file mode 100644
index 000000000..efc7c6125
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/index.yaml
@@ -0,0 +1,16 @@
+fixture: registry.evidence.source-shape-index/v1
+classification: test-only compatibility profiles
+profiles:
+  - id: flat-rest
+    path: flat-rest
+    reference: generic flat REST JSON
+  - id: nested-paged-rest
+    path: dhis2-tracker-style
+    reference: DHIS2 Tracker 2.43 compatibility shape
+  - id: opencrvs-event-search-json
+    path: opencrvs-record-search-style
+    reference: OpenCRVS version 2 Event Search JSON compatibility shape
+rules:
+  - Product names and shapes in this subtree are test-only and never production configuration identifiers.
+  - Each mock contains only the consumed boundary and is not an emulator, certified connector, or support claim.
+  - Deterministic local mocks pass before any ignored read-only public-demo smoke test.
diff --git a/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/adapters/event-search-json-prepare.rhai b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/adapters/event-search-json-prepare.rhai
new file mode 100644
index 000000000..a6293b0f1
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/adapters/event-search-json-prepare.rhai
@@ -0,0 +1,18 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"];
+    #{
+        query: [],
+        body: #{
+            query: #{
+                type: "and",
+                clauses: [#{
+                    eventType: parameters["eventType"],
+                    status: #{type: "exact", term: parameters["registeredStatus"]},
+                    trackingId: #{type: "exact", term: subject["values"]["record_reference"]}
+                }]
+            },
+            limit: parameters["resultLimit"],
+            offset: parameters["resultOffset"]
+        }
+    }
+}
diff --git a/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/adapters/event-search-json.rhai b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/adapters/event-search-json.rhai
new file mode 100644
index 000000000..19bdd4cf4
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/adapters/event-search-json.rhai
@@ -0,0 +1,37 @@
+fn extract(source_response, parameters) {
+    if source_response.len() != 2 ||
+       !source_response.contains("total") ||
+       !source_response.contains("results") ||
+       source_response.results.len > parameters["resultLimit"] ||
+       source_response.total < 0 {
+        throw("source_protocol_error");
+    }
+
+    if source_response.total == 0 {
+        if source_response.results.len != 0 {
+            throw("source_protocol_error");
+        }
+        return #{ outcome: "no_match" };
+    }
+
+    if source_response.total > 1 {
+        if source_response.results.len != 2 {
+            throw("source_protocol_error");
+        }
+        return #{ outcome: "ambiguous" };
+    }
+
+    if source_response.results.len != 1 {
+        throw("source_protocol_error");
+    }
+
+    let result = source_response.results[0];
+    if !result.contains("dateOfEvent") {
+        return #{ outcome: "match", facts: #{} };
+    }
+
+    #{
+        outcome: "match",
+        facts: #{ date_of_event: result.dateOfEvent }
+    }
+}
diff --git a/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/contract.yaml b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/contract.yaml
new file mode 100644
index 000000000..1440131fa
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/contract.yaml
@@ -0,0 +1,121 @@
+fixture: registry.evidence.source-shape.opencrvs-event-search-style/v1
+classification: compatibility-shaped-local-mock
+synthetic_only: true
+server: {base_url: 'http://[::1]:18083', bind: '[::1]:18083'}
+validated_source_definition:
+  transport: http-json
+  baseUrl: http://[::1]:18083
+  posture: record-transformed
+  authentication:
+    kind: oauth2-client-credentials
+    tokenEndpoint: http://[::1]:18083/oauth/token
+    clientIdRef: secret:file/fixture-event-search-client-id
+    clientSecretRef: secret:file/fixture-event-search-client-secret
+    scope: fixture.read
+    credentialPlacement: form-body
+    maximumCacheSeconds: 300
+    assumedLifetimeSeconds: 600
+  request:
+    method: POST
+    path: /events/search
+    selectorInputs:
+      - role: subject
+        alternatives:
+          - {profile: civil-record-reference-v1, fields: [record_reference]}
+    prepareScript: adapters/event-search-json-prepare.rhai
+    adapterParameters:
+      eventType: birth
+      registeredStatus: REGISTERED
+      resultLimit: 2
+      resultOffset: 0
+    adapterParametersSchema: schemas/adapter-parameters.schema.yaml
+    preparationLimits:
+      query: forbidden
+      jsonBody: required
+      maximumJsonDepth: 12
+      maximumCollectionItems: 32
+      maximumStringBytes: 512
+      maximumNormalizedBytes: 8192
+    projection:
+      - /total
+      - /results/*/dateOfEvent
+    redirects: deny
+    timeoutMilliseconds: 3000
+    maximumResponseBytes: 65536
+    concurrencyLimit: 4
+  responseSchema: schemas/response.schema.yaml
+  extractScript: adapters/event-search-json.rhai
+  factSchema: schemas/facts.schema.yaml
+reference_shape: OpenCRVS v2 Event Search JSON
+scope: Only OAuth client bootstrap and the consumed fixed event-search boundary
+credential_bootstrap:
+  method: POST
+  token_endpoint: 'http://[::1]:18083/oauth/token'
+  grant_type: client_credentials
+  credential_placement: form-body
+  credential_placement_rule: The reference shape accepts client credentials in the token request body, so no credential reaches the request URL. Version 1 offers no query-string placement.
+  client_id: injected from secret reference
+  client_secret: injected from secret reference
+  maximum_response_bytes: 8192
+  maximum_cache_seconds: 300
+  token_response_fields: [access_token, token_type]
+  omitted_expires_in: The reference shape returns no expires_in, which RFC 6749 section 5.1 permits. The fixture therefore configures assumedLifetimeSeconds and must not be relaxed by adding a lifetime the reference shape does not send.
+  failures: [http-400, http-401, http-429, http-500, timeout, invalid-json, missing-token, wrong-token-type, oversized-response]
+request:
+  method: POST
+  path: /events/search
+  query: {}
+  headers:
+    content-type: application/json
+    authorization: Bearer token from credential bootstrap; exact value never snapshotted
+  body:
+    query:
+      type: and
+      clauses:
+        - eventType: birth
+          status: {type: exact, term: REGISTERED}
+          trackingId: {type: exact, term: TRACKING-CANARY-0001}
+    limit: 2
+    offset: 0
+  response_shape: [results, total]
+  result_shape: EventIndex including a country-configured declaration map
+  unexpected_request: fail test
+selector_contracts:
+  identifier_only: {profile: civil-record-reference-v1, prepared_field: body.query.clauses.0.trackingId.term}
+  array_placement: The reviewed prepare/2 script constructs the fixed clauses array and places only the authorized record reference in the trackingId exact predicate.
+cardinality:
+  zero: responses/no-match.json
+  one: responses/match.json
+  multiple: responses/ambiguous.json
+  maximum_results: 2
+  page_traversal: prohibited
+  evidence_data_requests_after_response: 0
+extraction:
+  match_facts: [date_of_event]
+  missing_fact: responses/missing-fact.json
+  error_envelope: responses/error-envelope.json
+  inconsistent_cardinality: responses/inconsistent-cardinality.json
+  rule: total is provider-owned cardinality; total zero maps to no_match, one result with total one maps to match, and total above one maps to ambiguous without a second request or local comparison.
+  declaration_rule: The broader declaration is transient source data. The adapter does not compare child or parent fields and exposes only the declared date_of_event fact.
+  projection_rule: Rust removes ids, tracking ids, declarations, and every unrelated field before extract/2.
+failures:
+  - http-401
+  - http-403
+  - http-429
+  - http-500
+  - timeout
+  - redirect
+  - invalid-json
+  - wrong-media-type
+  - oversized-response
+  - error-envelope
+redaction_canaries:
+  committed_source_and_selector: [TRACKING-CANARY-0001, SOURCE-DATE-CANARY-DO-NOT-LOG, SOURCE-PARENT-CANARY-DO-NOT-LOG]
+  runtime_generated_secret_classes: [oauth-client-id, oauth-client-secret, oauth-access-token]
+minimization:
+  acquisition: disclosure-minimized only; one bounded lookup returns a broader EventIndex and country-configured declaration
+  response_posture: record-transformed
+  persistence: prohibited
+  diagnostics: no declaration field, selector, source fact, credential, token, or response body
+claim: Compatibility-shaped fixture only; not an emulator, connector certification, maintained vendor integration, or legal-parent matching implementation.
+relationship_boundary: A zero-result Event Search response is no_match and can never be interpreted as a conclusive negative relationship fact.
diff --git a/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/ambiguous.json b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/ambiguous.json
new file mode 100644
index 000000000..9b7d46915
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/ambiguous.json
@@ -0,0 +1,21 @@
+{
+  "results": [
+    {
+      "id": "00000000-0000-4000-8000-000000000001",
+      "trackingId": "TRACKING-CANARY-0001",
+      "type": "birth",
+      "status": "REGISTERED",
+      "dateOfEvent": "2000-02-29",
+      "declaration": {"child.name": {"firstname": "Synthetic", "surname": "One"}}
+    },
+    {
+      "id": "00000000-0000-4000-8000-000000000002",
+      "trackingId": "TRACKING-CANARY-0002",
+      "type": "birth",
+      "status": "REGISTERED",
+      "dateOfEvent": "2001-03-01",
+      "declaration": {"child.name": {"firstname": "Synthetic", "surname": "Two"}}
+    }
+  ],
+  "total": 2
+}
diff --git a/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/error-envelope.json b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/error-envelope.json
new file mode 100644
index 000000000..812345047
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/error-envelope.json
@@ -0,0 +1,7 @@
+{
+  "errors": [
+    {"code": "SYNTHETIC-SOURCE-ERROR"}
+  ],
+  "results": [],
+  "total": 0
+}
diff --git a/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/inconsistent-cardinality.json b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/inconsistent-cardinality.json
new file mode 100644
index 000000000..c23f52426
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/inconsistent-cardinality.json
@@ -0,0 +1,4 @@
+{
+  "results": [],
+  "total": 1
+}
diff --git a/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/match.json b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/match.json
new file mode 100644
index 000000000..6b5561930
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/match.json
@@ -0,0 +1,17 @@
+{
+  "results": [
+    {
+      "id": "00000000-0000-4000-8000-000000000001",
+      "trackingId": "TRACKING-CANARY-0001",
+      "type": "birth",
+      "status": "REGISTERED",
+      "dateOfEvent": "2000-02-29",
+      "declaration": {
+        "child.name": {"firstname": "SOURCE-CHILD-CANARY-DO-NOT-LOG", "surname": "Example"},
+        "mother.name": {"firstname": "SOURCE-PARENT-CANARY-DO-NOT-LOG", "surname": "Example"},
+        "father.name": {"firstname": "Synthetic", "surname": "Parent"}
+      }
+    }
+  ],
+  "total": 1
+}
diff --git a/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/missing-fact.json b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/missing-fact.json
new file mode 100644
index 000000000..b564e2fcb
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/missing-fact.json
@@ -0,0 +1,14 @@
+{
+  "results": [
+    {
+      "id": "00000000-0000-4000-8000-000000000003",
+      "trackingId": "TRACKING-CANARY-0003",
+      "type": "birth",
+      "status": "REGISTERED",
+      "declaration": {
+        "child.name": {"firstname": "Synthetic", "surname": "MissingDate"}
+      }
+    }
+  ],
+  "total": 1
+}
diff --git a/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/no-match.json b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/no-match.json
new file mode 100644
index 000000000..6d1830beb
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/responses/no-match.json
@@ -0,0 +1,4 @@
+{
+  "results": [],
+  "total": 0
+}
diff --git a/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/schemas/adapter-parameters.schema.yaml b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/schemas/adapter-parameters.schema.yaml
new file mode 100644
index 000000000..d0743705f
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/schemas/adapter-parameters.schema.yaml
@@ -0,0 +1,8 @@
+type: object
+additionalProperties: false
+required: [eventType, registeredStatus, resultLimit, resultOffset]
+properties:
+  eventType: {const: birth}
+  registeredStatus: {const: REGISTERED}
+  resultLimit: {const: 2}
+  resultOffset: {const: 0}
diff --git a/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/schemas/facts.schema.yaml b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/schemas/facts.schema.yaml
new file mode 100644
index 000000000..acfdcb86e
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/schemas/facts.schema.yaml
@@ -0,0 +1,5 @@
+type: object
+additionalProperties: false
+required: [date_of_event]
+properties:
+  date_of_event: {type: string, format: date}
diff --git a/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/schemas/response.schema.yaml b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/schemas/response.schema.yaml
new file mode 100644
index 000000000..37e077ad0
--- /dev/null
+++ b/products/evidence/fixtures/source-shapes/opencrvs-record-search-style/schemas/response.schema.yaml
@@ -0,0 +1,23 @@
+# Shape of the projected event-search response, checked before extraction runs.
+# dateOfEvent is optional because projection drops a leaf the record did not
+# carry, which is the case this shape proves an adapter must handle.
+type: object
+additionalProperties: false
+required: [total, results]
+properties:
+  total:
+    type: integer
+    minimum: 0
+    maximum: 1000000
+  results:
+    type: array
+    minItems: 0
+    maxItems: 2
+    items:
+      type: object
+      additionalProperties: false
+      required: []
+      properties:
+        dateOfEvent:
+          type: string
+          format: date
diff --git a/products/evidence/generated/evidence-definitions-v1.schema.json b/products/evidence/generated/evidence-definitions-v1.schema.json
new file mode 100644
index 000000000..8ab71297a
--- /dev/null
+++ b/products/evidence/generated/evidence-definitions-v1.schema.json
@@ -0,0 +1,330 @@
+{
+  "$comment": "The authenticated response contains only complete request shapes that match exactly one configured authority path. It never exposes source plans, scripts, credentials, requester tags, authority-profile identifiers, selector values, codelist values, or unrelated definitions.",
+  "$defs": {
+    "concept": {
+      "additionalProperties": false,
+      "properties": {
+        "form": {
+          "enum": [
+            "boolean",
+            "controlled-code",
+            "controlled-category",
+            "bounded-integer",
+            "bounded-decimal",
+            "date-bucket",
+            "time-bucket",
+            "audience-scoped-entity-reference",
+            "controlled-code-list",
+            "entity-reference-list",
+            "reviewed-structured-value"
+          ]
+        },
+        "id": {
+          "format": "uri",
+          "maxLength": 512,
+          "type": "string"
+        }
+      },
+      "required": [
+        "id",
+        "form"
+      ],
+      "type": "object"
+    },
+    "definition": {
+      "additionalProperties": false,
+      "properties": {
+        "concepts": {
+          "items": {
+            "$ref": "#/$defs/concept"
+          },
+          "maxItems": 16,
+          "minItems": 1,
+          "type": "array",
+          "uniqueItems": true
+        },
+        "evidenceType": {
+          "format": "uri",
+          "maxLength": 512,
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "criterion",
+            "information-requirement",
+            "constraint"
+          ]
+        },
+        "purpose": {
+          "pattern": "^[a-z][a-z0-9._:-]{0,127}$",
+          "type": "string"
+        },
+        "referenceFrameworks": {
+          "items": {
+            "format": "uri",
+            "maxLength": 512,
+            "type": "string"
+          },
+          "maxItems": 16,
+          "minItems": 1,
+          "type": "array",
+          "uniqueItems": true
+        },
+        "requirement": {
+          "format": "uri",
+          "maxLength": 512,
+          "type": "string"
+        },
+        "subjects": {
+          "items": {
+            "$ref": "#/$defs/subject"
+          },
+          "maxItems": 8,
+          "minItems": 1,
+          "type": "array",
+          "uniqueItems": true
+        }
+      },
+      "required": [
+        "requirement",
+        "kind",
+        "evidenceType",
+        "purpose",
+        "referenceFrameworks",
+        "subjects",
+        "concepts"
+      ],
+      "type": "object"
+    },
+    "selector": {
+      "additionalProperties": false,
+      "properties": {
+        "fields": {
+          "items": {
+            "$ref": "#/$defs/selector-field"
+          },
+          "maxItems": 16,
+          "minItems": 1,
+          "type": "array",
+          "uniqueItems": true
+        },
+        "profile": {
+          "pattern": "^[a-z][a-z0-9._-]{0,127}$",
+          "type": "string"
+        },
+        "valueOrigin": {
+          "enum": [
+            "request",
+            "authenticated-context",
+            "authenticated-grant"
+          ]
+        }
+      },
+      "required": [
+        "profile",
+        "valueOrigin",
+        "fields"
+      ],
+      "type": "object"
+    },
+    "selector-field": {
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "properties": {
+            "maximumBytes": {
+              "maximum": 8192,
+              "minimum": 1,
+              "type": "integer"
+            },
+            "minimumBytes": {
+              "maximum": 8192,
+              "minimum": 1,
+              "type": "integer"
+            },
+            "name": {
+              "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+              "type": "string"
+            },
+            "type": {
+              "const": "string"
+            }
+          },
+          "required": [
+            "type",
+            "name",
+            "minimumBytes",
+            "maximumBytes"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "name": {
+              "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+              "type": "string"
+            },
+            "type": {
+              "const": "date"
+            }
+          },
+          "required": [
+            "type",
+            "name"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "maximum": {
+              "maximum": 9007199254740991,
+              "minimum": -9007199254740991,
+              "type": "integer"
+            },
+            "minimum": {
+              "maximum": 9007199254740991,
+              "minimum": -9007199254740991,
+              "type": "integer"
+            },
+            "name": {
+              "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+              "type": "string"
+            },
+            "type": {
+              "const": "integer"
+            }
+          },
+          "required": [
+            "type",
+            "name",
+            "minimum",
+            "maximum"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "name": {
+              "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+              "type": "string"
+            },
+            "type": {
+              "const": "boolean"
+            }
+          },
+          "required": [
+            "type",
+            "name"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "maximumBytes": {
+              "maximum": 8192,
+              "minimum": 1,
+              "type": "integer"
+            },
+            "name": {
+              "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+              "type": "string"
+            },
+            "scheme": {
+              "format": "uri",
+              "maxLength": 512,
+              "type": "string"
+            },
+            "type": {
+              "const": "controlled-code"
+            },
+            "version": {
+              "maxLength": 128,
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          "required": [
+            "type",
+            "name",
+            "scheme",
+            "version",
+            "maximumBytes"
+          ],
+          "type": "object"
+        }
+      ]
+    },
+    "subject": {
+      "additionalProperties": false,
+      "properties": {
+        "cardinality": {
+          "const": "one"
+        },
+        "role": {
+          "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+          "type": "string"
+        },
+        "selector": {
+          "$ref": "#/$defs/selector"
+        }
+      },
+      "required": [
+        "role",
+        "cardinality",
+        "selector"
+      ],
+      "type": "object"
+    }
+  },
+  "$id": "https://registrystack.org/schemas/evidence/definitions-v1.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "additionalProperties": false,
+  "properties": {
+    "assuranceProfile": {
+      "enum": [
+        "local",
+        "production",
+        "evidence-grade"
+      ]
+    },
+    "configurationRevision": {
+      "pattern": "^sha256:[a-f0-9]{64}$",
+      "type": "string"
+    },
+    "definitions": {
+      "items": {
+        "$ref": "#/$defs/definition"
+      },
+      "maxItems": 16384,
+      "type": "array",
+      "uniqueItems": true
+    },
+    "issuedBy": {
+      "format": "uri",
+      "maxLength": 512,
+      "type": "string"
+    },
+    "providedBy": {
+      "format": "uri",
+      "maxLength": 512,
+      "type": "string"
+    },
+    "schema": {
+      "const": "registry.evidence-definitions/v1"
+    }
+  },
+  "required": [
+    "schema",
+    "assuranceProfile",
+    "configurationRevision",
+    "issuedBy",
+    "providedBy",
+    "definitions"
+  ],
+  "title": "Requester-scoped Evidence definitions Version 1",
+  "type": "object"
+}
diff --git a/products/evidence/generated/evidence-request-v1.schema.json b/products/evidence/generated/evidence-request-v1.schema.json
new file mode 100644
index 000000000..26e4aab8e
--- /dev/null
+++ b/products/evidence/generated/evidence-request-v1.schema.json
@@ -0,0 +1,140 @@
+{
+  "$comment": "Named selector-profile validation follows this transport schema. The profile closes exact field names, scalar types, bounds, aggregate size, value origin, and source placements. Invalid selector material fails before credential acquisition or source access. requestNonce is the canonical unpadded base64url encoding of exactly 32 independently generated random bytes; a noncanonical final symbol is rejected by the runtime. Callers must not encode identifiers, selectors, secrets, or document digests into it. holderKey is meaningful only for the SD-JWT VC response format, where it is echoed into the cnf claim; it never reaches authorization, selectors, Rhai, source requests, or audit, and a key carrying any private member is rejected before credential acquisition or source access.",
+  "$defs": {
+    "holder-key": {
+      "additionalProperties": false,
+      "properties": {
+        "alg": {
+          "enum": [
+            "EdDSA"
+          ],
+          "type": "string"
+        },
+        "crv": {
+          "enum": [
+            "Ed25519"
+          ],
+          "type": "string"
+        },
+        "kid": {
+          "maxLength": 256,
+          "minLength": 1,
+          "type": "string"
+        },
+        "kty": {
+          "enum": [
+            "OKP"
+          ],
+          "type": "string"
+        },
+        "x": {
+          "pattern": "^[A-Za-z0-9_-]{43}$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "kty",
+        "crv",
+        "x"
+      ],
+      "type": "object"
+    },
+    "scalar-selector-value": {
+      "oneOf": [
+        {
+          "maxLength": 512,
+          "minLength": 1,
+          "type": "string"
+        },
+        {
+          "maximum": 9007199254740991,
+          "minimum": -9007199254740991,
+          "type": "integer"
+        },
+        {
+          "type": "boolean"
+        }
+      ]
+    },
+    "selector": {
+      "additionalProperties": false,
+      "properties": {
+        "profile": {
+          "pattern": "^[a-z][a-z0-9._-]{0,127}$",
+          "type": "string"
+        },
+        "values": {
+          "additionalProperties": {
+            "$ref": "#/$defs/scalar-selector-value"
+          },
+          "maxProperties": 16,
+          "minProperties": 1,
+          "propertyNames": {
+            "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+            "type": "string"
+          },
+          "type": "object"
+        }
+      },
+      "required": [
+        "profile"
+      ],
+      "type": "object"
+    },
+    "subject": {
+      "additionalProperties": false,
+      "properties": {
+        "role": {
+          "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+          "type": "string"
+        },
+        "selector": {
+          "$ref": "#/$defs/selector"
+        }
+      },
+      "required": [
+        "role",
+        "selector"
+      ],
+      "type": "object"
+    }
+  },
+  "$id": "https://registrystack.org/schemas/evidence/request-v1.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "additionalProperties": false,
+  "properties": {
+    "holderKey": {
+      "$ref": "#/$defs/holder-key"
+    },
+    "purpose": {
+      "pattern": "^[a-z][a-z0-9._:-]{0,127}$",
+      "type": "string"
+    },
+    "requestNonce": {
+      "pattern": "^[A-Za-z0-9_-]{43}$",
+      "type": "string"
+    },
+    "requirement": {
+      "format": "uri",
+      "maxLength": 512,
+      "minLength": 1,
+      "type": "string"
+    },
+    "subjects": {
+      "items": {
+        "$ref": "#/$defs/subject"
+      },
+      "maxItems": 8,
+      "minItems": 1,
+      "type": "array"
+    }
+  },
+  "required": [
+    "requestNonce",
+    "requirement",
+    "purpose",
+    "subjects"
+  ],
+  "title": "Evidence request Version 1",
+  "type": "object"
+}
diff --git a/products/evidence/generated/evidence-unsigned-envelope-v1.schema.json b/products/evidence/generated/evidence-unsigned-envelope-v1.schema.json
new file mode 100644
index 000000000..9d8c47b5b
--- /dev/null
+++ b/products/evidence/generated/evidence-unsigned-envelope-v1.schema.json
@@ -0,0 +1,32 @@
+{
+  "$comment": "Transport-authenticated convenience representation selected only by its exact vendor media type when the immutable bundle and the complete matched grant permit it. Once separated from its HTTPS exchange it provides no issuer-authenticity, integrity, non-repudiation, or later-verification property. The nested evidence is the same closed core object that would be JWS encoded. There is no protected, payload, or signature member, so the strict JWS verifier rejects this representation; tooling that parses it must return an explicitly unverified result.",
+  "$id": "https://registrystack.org/schemas/evidence/unsigned-envelope-v1.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "additionalProperties": false,
+  "properties": {
+    "evidence": {
+      "$ref": "https://registrystack.org/schemas/evidence/assertion-evidence-v1.json"
+    },
+    "integrityProtection": {
+      "const": "none"
+    },
+    "schema": {
+      "const": "registry.unsigned-evidence-envelope/v1"
+    },
+    "type": {
+      "const": "UnsignedEvidenceEnvelope"
+    },
+    "warning": {
+      "const": "not-cryptographically-verifiable"
+    }
+  },
+  "required": [
+    "schema",
+    "type",
+    "integrityProtection",
+    "warning",
+    "evidence"
+  ],
+  "title": "Evidence unsigned response envelope Version 1",
+  "type": "object"
+}
diff --git a/products/evidence/generated/evidence-v1.schema.json b/products/evidence/generated/evidence-v1.schema.json
new file mode 100644
index 000000000..2fe819d65
--- /dev/null
+++ b/products/evidence/generated/evidence-v1.schema.json
@@ -0,0 +1,260 @@
+{
+  "$comment": "The selected concept declaration further closes value form, schema, codelist, precision, cardinality, structured fields, and uniqueness. Selector profiles and selector values never appear in Evidence.",
+  "$defs": {
+    "bucket": {
+      "additionalProperties": false,
+      "properties": {
+        "bucket": {
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$",
+          "type": "string"
+        },
+        "form": {
+          "enum": [
+            "date-bucket",
+            "time-bucket"
+          ]
+        },
+        "scheme": {
+          "format": "uri",
+          "maxLength": 512,
+          "type": "string"
+        }
+      },
+      "required": [
+        "form",
+        "scheme",
+        "bucket"
+      ],
+      "type": "object"
+    },
+    "entity-reference": {
+      "additionalProperties": false,
+      "properties": {
+        "form": {
+          "const": "audience-scoped-entity-reference"
+        },
+        "reference": {
+          "pattern": "^urn:evidence:entity:v[1-9][0-9]*_[A-Za-z0-9_-]{43}$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "form",
+        "reference"
+      ],
+      "type": "object"
+    },
+    "structured": {
+      "additionalProperties": false,
+      "properties": {
+        "fields": {
+          "maxProperties": 16,
+          "minProperties": 1,
+          "type": "object"
+        },
+        "form": {
+          "const": "reviewed-structured-value"
+        },
+        "schema": {
+          "format": "uri",
+          "maxLength": 512,
+          "type": "string"
+        }
+      },
+      "required": [
+        "form",
+        "schema",
+        "fields"
+      ],
+      "type": "object"
+    },
+    "subject-binding": {
+      "additionalProperties": false,
+      "properties": {
+        "binding": {
+          "pattern": "^urn:evidence:subject:v[1-9][0-9]*_[A-Za-z0-9_-]{43}$",
+          "type": "string"
+        },
+        "role": {
+          "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "role",
+        "binding"
+      ],
+      "type": "object"
+    },
+    "supported-value": {
+      "additionalProperties": false,
+      "properties": {
+        "providesValueFor": {
+          "format": "uri",
+          "maxLength": 512,
+          "type": "string"
+        },
+        "value": {
+          "$ref": "#/$defs/value"
+        }
+      },
+      "required": [
+        "providesValueFor",
+        "value"
+      ],
+      "type": "object"
+    },
+    "value": {
+      "anyOf": [
+        {
+          "type": "boolean"
+        },
+        {
+          "maximum": 9007199254740991,
+          "minimum": -9007199254740991,
+          "type": "integer"
+        },
+        {
+          "maxLength": 1024,
+          "minLength": 1,
+          "type": "string"
+        },
+        {
+          "$ref": "#/$defs/bucket"
+        },
+        {
+          "$ref": "#/$defs/entity-reference"
+        },
+        {
+          "$ref": "#/$defs/structured"
+        },
+        {
+          "items": {
+            "anyOf": [
+              {
+                "maxLength": 1024,
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "$ref": "#/$defs/entity-reference"
+              }
+            ]
+          },
+          "maxItems": 64,
+          "minItems": 1,
+          "type": "array"
+        }
+      ]
+    }
+  },
+  "$id": "https://registrystack.org/schemas/evidence/assertion-evidence-v1.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "additionalProperties": false,
+  "properties": {
+    "assuranceProfile": {
+      "enum": [
+        "local",
+        "production",
+        "evidence-grade"
+      ]
+    },
+    "audience": {
+      "format": "uri",
+      "maxLength": 512,
+      "type": "string"
+    },
+    "configurationRevision": {
+      "pattern": "^sha256:[a-f0-9]{64}$",
+      "type": "string"
+    },
+    "id": {
+      "format": "uri",
+      "maxLength": 512,
+      "type": "string"
+    },
+    "isConformantTo": {
+      "format": "uri",
+      "maxLength": 512,
+      "type": "string"
+    },
+    "issuedAt": {
+      "format": "date-time",
+      "type": "string"
+    },
+    "issuedBy": {
+      "format": "uri",
+      "maxLength": 512,
+      "type": "string"
+    },
+    "observedAt": {
+      "format": "date-time",
+      "type": "string"
+    },
+    "providedBy": {
+      "format": "uri",
+      "maxLength": 512,
+      "type": "string"
+    },
+    "purpose": {
+      "pattern": "^[a-z][a-z0-9._:-]{0,127}$",
+      "type": "string"
+    },
+    "requestNonce": {
+      "pattern": "^[A-Za-z0-9_-]{43}$",
+      "type": "string"
+    },
+    "schema": {
+      "const": "registry.assertion-evidence/v1"
+    },
+    "subjects": {
+      "items": {
+        "$ref": "#/$defs/subject-binding"
+      },
+      "maxItems": 8,
+      "minItems": 1,
+      "type": "array"
+    },
+    "supportedValues": {
+      "items": {
+        "$ref": "#/$defs/supported-value"
+      },
+      "maxItems": 16,
+      "minItems": 1,
+      "type": "array"
+    },
+    "supportsRequirement": {
+      "format": "uri",
+      "maxLength": 512,
+      "type": "string"
+    },
+    "type": {
+      "const": "Evidence"
+    },
+    "validUntil": {
+      "format": "date-time",
+      "type": "string"
+    }
+  },
+  "required": [
+    "schema",
+    "assuranceProfile",
+    "requestNonce",
+    "id",
+    "type",
+    "supportsRequirement",
+    "isConformantTo",
+    "issuedBy",
+    "providedBy",
+    "issuedAt",
+    "observedAt",
+    "validUntil",
+    "purpose",
+    "audience",
+    "configurationRevision",
+    "subjects",
+    "supportedValues"
+  ],
+  "title": "Evidence assertion payload Version 1",
+  "type": "object"
+}
diff --git a/products/evidence/generated/flattened-jws-v1.schema.json b/products/evidence/generated/flattened-jws-v1.schema.json
new file mode 100644
index 000000000..ae86ca959
--- /dev/null
+++ b/products/evidence/generated/flattened-jws-v1.schema.json
@@ -0,0 +1,29 @@
+{
+  "$comment": "Flattened JWS JSON Serialization. The protected header has exactly alg=EdDSA, kid, typ=evidence+jws, and cty=application/evidence+json. The payload is the base64url encoding without padding of exact UTF-8 Evidence JSON bytes.",
+  "$id": "https://registrystack.org/schemas/evidence/flattened-jws-v1.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "additionalProperties": false,
+  "properties": {
+    "payload": {
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9_-]+$",
+      "type": "string"
+    },
+    "protected": {
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9_-]+$",
+      "type": "string"
+    },
+    "signature": {
+      "pattern": "^[A-Za-z0-9_-]{86}$",
+      "type": "string"
+    }
+  },
+  "required": [
+    "protected",
+    "payload",
+    "signature"
+  ],
+  "title": "Evidence flattened JWS response Version 1",
+  "type": "object"
+}
diff --git a/products/evidence/generated/jwks-v1.schema.json b/products/evidence/generated/jwks-v1.schema.json
new file mode 100644
index 000000000..d47d1c18e
--- /dev/null
+++ b/products/evidence/generated/jwks-v1.schema.json
@@ -0,0 +1,56 @@
+{
+  "$comment": "Only the active and configured retired public keys are published. Key ids are unique and limited to 256 UTF-8 bytes by the runtime; JSON Schema maxLength is an additional code-point bound. Discovery is not a trust anchor; verifiers pin the governed provider and JWKS location.",
+  "$defs": {
+    "ed25519-public-jwk": {
+      "additionalProperties": false,
+      "properties": {
+        "alg": {
+          "const": "EdDSA"
+        },
+        "crv": {
+          "const": "Ed25519"
+        },
+        "kid": {
+          "maxLength": 256,
+          "minLength": 1,
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+          "type": "string"
+        },
+        "kty": {
+          "const": "OKP"
+        },
+        "x": {
+          "pattern": "^[A-Za-z0-9_-]{43}$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "kty",
+        "kid",
+        "alg",
+        "crv",
+        "x"
+      ],
+      "type": "object"
+    }
+  },
+  "$id": "https://registrystack.org/schemas/evidence/jwks-v1.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "additionalProperties": false,
+  "properties": {
+    "keys": {
+      "items": {
+        "$ref": "#/$defs/ed25519-public-jwk"
+      },
+      "maxItems": 33,
+      "minItems": 1,
+      "type": "array",
+      "uniqueItems": true
+    }
+  },
+  "required": [
+    "keys"
+  ],
+  "title": "Evidence public JWKS Version 1",
+  "type": "object"
+}
diff --git a/products/evidence/generated/problem-v1.schema.json b/products/evidence/generated/problem-v1.schema.json
new file mode 100644
index 000000000..835500500
--- /dev/null
+++ b/products/evidence/generated/problem-v1.schema.json
@@ -0,0 +1,219 @@
+{
+  "$comment": "Problem members are a closed safe shape. No request, authority, source, script, supported-value, subject-binding, candidate, or credential detail is returned.",
+  "$id": "https://registrystack.org/schemas/evidence/problem-v1.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "additionalProperties": false,
+  "oneOf": [
+    {
+      "properties": {
+        "code": {
+          "const": "malformed_request"
+        },
+        "status": {
+          "const": 400
+        },
+        "title": {
+          "const": "Request is not valid"
+        },
+        "type": {
+          "const": "https://registrystack.org/problems/evidence/malformed_request"
+        }
+      }
+    },
+    {
+      "properties": {
+        "code": {
+          "const": "invalid_selector"
+        },
+        "status": {
+          "const": 400
+        },
+        "title": {
+          "const": "Request is not valid"
+        },
+        "type": {
+          "const": "https://registrystack.org/problems/evidence/invalid_selector"
+        }
+      }
+    },
+    {
+      "properties": {
+        "code": {
+          "const": "authentication_failed"
+        },
+        "status": {
+          "const": 401
+        },
+        "title": {
+          "const": "Authentication failed"
+        },
+        "type": {
+          "const": "https://registrystack.org/problems/evidence/authentication_failed"
+        }
+      }
+    },
+    {
+      "properties": {
+        "code": {
+          "const": "not_authorized"
+        },
+        "status": {
+          "const": 403
+        },
+        "title": {
+          "const": "Request is not authorized"
+        },
+        "type": {
+          "const": "https://registrystack.org/problems/evidence/not_authorized"
+        }
+      }
+    },
+    {
+      "properties": {
+        "code": {
+          "const": "response_format_not_acceptable"
+        },
+        "status": {
+          "const": 406
+        },
+        "title": {
+          "const": "Requested response format is not acceptable"
+        },
+        "type": {
+          "const": "https://registrystack.org/problems/evidence/response_format_not_acceptable"
+        }
+      }
+    },
+    {
+      "properties": {
+        "code": {
+          "const": "evidence_not_available"
+        },
+        "status": {
+          "const": 422
+        },
+        "title": {
+          "const": "Evidence could not be produced"
+        },
+        "type": {
+          "const": "https://registrystack.org/problems/evidence/evidence_not_available"
+        }
+      }
+    },
+    {
+      "properties": {
+        "code": {
+          "const": "rate_limited"
+        },
+        "status": {
+          "const": 429
+        },
+        "title": {
+          "const": "Request rate exceeded"
+        },
+        "type": {
+          "const": "https://registrystack.org/problems/evidence/rate_limited"
+        }
+      }
+    },
+    {
+      "properties": {
+        "code": {
+          "const": "dependency_unavailable"
+        },
+        "status": {
+          "const": 503
+        },
+        "title": {
+          "const": "Service temporarily unavailable"
+        },
+        "type": {
+          "const": "https://registrystack.org/problems/evidence/dependency_unavailable"
+        }
+      }
+    },
+    {
+      "properties": {
+        "code": {
+          "const": "service_unavailable"
+        },
+        "status": {
+          "const": 503
+        },
+        "title": {
+          "const": "Service temporarily unavailable"
+        },
+        "type": {
+          "const": "https://registrystack.org/problems/evidence/service_unavailable"
+        }
+      }
+    }
+  ],
+  "properties": {
+    "code": {
+      "enum": [
+        "malformed_request",
+        "invalid_selector",
+        "authentication_failed",
+        "not_authorized",
+        "response_format_not_acceptable",
+        "evidence_not_available",
+        "rate_limited",
+        "dependency_unavailable",
+        "service_unavailable"
+      ],
+      "type": "string"
+    },
+    "operation": {
+      "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+      "type": "string"
+    },
+    "status": {
+      "enum": [
+        400,
+        401,
+        403,
+        406,
+        422,
+        429,
+        503
+      ],
+      "type": "integer"
+    },
+    "title": {
+      "enum": [
+        "Request is not valid",
+        "Authentication failed",
+        "Request is not authorized",
+        "Requested response format is not acceptable",
+        "Evidence could not be produced",
+        "Request rate exceeded",
+        "Service temporarily unavailable"
+      ],
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "https://registrystack.org/problems/evidence/malformed_request",
+        "https://registrystack.org/problems/evidence/invalid_selector",
+        "https://registrystack.org/problems/evidence/authentication_failed",
+        "https://registrystack.org/problems/evidence/not_authorized",
+        "https://registrystack.org/problems/evidence/response_format_not_acceptable",
+        "https://registrystack.org/problems/evidence/evidence_not_available",
+        "https://registrystack.org/problems/evidence/rate_limited",
+        "https://registrystack.org/problems/evidence/dependency_unavailable",
+        "https://registrystack.org/problems/evidence/service_unavailable"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "type",
+    "title",
+    "status",
+    "code",
+    "operation"
+  ],
+  "title": "Evidence public problem Version 1",
+  "type": "object"
+}
diff --git a/products/evidence/generated/registry-evidence.openapi.json b/products/evidence/generated/registry-evidence.openapi.json
new file mode 100644
index 000000000..6dfbacd01
--- /dev/null
+++ b/products/evidence/generated/registry-evidence.openapi.json
@@ -0,0 +1,2584 @@
+{
+  "components": {
+    "schemas": {
+      "BucketValue": {
+        "additionalProperties": false,
+        "properties": {
+          "bucket": {
+            "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$",
+            "type": "string"
+          },
+          "form": {
+            "enum": [
+              "date-bucket",
+              "time-bucket"
+            ],
+            "type": "string"
+          },
+          "scheme": {
+            "format": "uri",
+            "maxLength": 512,
+            "type": "string"
+          }
+        },
+        "required": [
+          "form",
+          "scheme",
+          "bucket"
+        ],
+        "type": "object"
+      },
+      "Ed25519PublicJwk": {
+        "additionalProperties": false,
+        "properties": {
+          "alg": {
+            "enum": [
+              "EdDSA"
+            ],
+            "type": "string"
+          },
+          "crv": {
+            "enum": [
+              "Ed25519"
+            ],
+            "type": "string"
+          },
+          "kid": {
+            "maxLength": 256,
+            "minLength": 1,
+            "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+            "type": "string"
+          },
+          "kty": {
+            "enum": [
+              "OKP"
+            ],
+            "type": "string"
+          },
+          "x": {
+            "pattern": "^[A-Za-z0-9_-]{43}$",
+            "type": "string"
+          }
+        },
+        "required": [
+          "kty",
+          "kid",
+          "alg",
+          "crv",
+          "x"
+        ],
+        "type": "object"
+      },
+      "EntityReferenceValue": {
+        "additionalProperties": false,
+        "properties": {
+          "form": {
+            "enum": [
+              "audience-scoped-entity-reference"
+            ],
+            "type": "string"
+          },
+          "reference": {
+            "pattern": "^urn:evidence:entity:v[1-9][0-9]*_[A-Za-z0-9_-]{43}$",
+            "type": "string"
+          }
+        },
+        "required": [
+          "form",
+          "reference"
+        ],
+        "type": "object"
+      },
+      "Evidence": {
+        "additionalProperties": false,
+        "properties": {
+          "assuranceProfile": {
+            "enum": [
+              "local",
+              "production",
+              "evidence-grade"
+            ],
+            "type": "string"
+          },
+          "audience": {
+            "format": "uri",
+            "maxLength": 512,
+            "type": "string"
+          },
+          "configurationRevision": {
+            "pattern": "^sha256:[a-f0-9]{64}$",
+            "type": "string"
+          },
+          "id": {
+            "format": "uri",
+            "maxLength": 512,
+            "type": "string"
+          },
+          "isConformantTo": {
+            "format": "uri",
+            "maxLength": 512,
+            "type": "string"
+          },
+          "issuedAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "issuedBy": {
+            "format": "uri",
+            "maxLength": 512,
+            "type": "string"
+          },
+          "observedAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "providedBy": {
+            "format": "uri",
+            "maxLength": 512,
+            "type": "string"
+          },
+          "purpose": {
+            "pattern": "^[a-z][a-z0-9._:-]{0,127}$",
+            "type": "string"
+          },
+          "requestNonce": {
+            "pattern": "^[A-Za-z0-9_-]{43}$",
+            "type": "string"
+          },
+          "schema": {
+            "enum": [
+              "registry.assertion-evidence/v1"
+            ],
+            "type": "string"
+          },
+          "subjects": {
+            "items": {
+              "$ref": "#/components/schemas/SubjectBinding"
+            },
+            "maxItems": 8,
+            "minItems": 1,
+            "type": "array"
+          },
+          "supportedValues": {
+            "items": {
+              "$ref": "#/components/schemas/SupportedValue"
+            },
+            "maxItems": 16,
+            "minItems": 1,
+            "type": "array"
+          },
+          "supportsRequirement": {
+            "format": "uri",
+            "maxLength": 512,
+            "type": "string"
+          },
+          "type": {
+            "enum": [
+              "Evidence"
+            ],
+            "type": "string"
+          },
+          "validUntil": {
+            "format": "date-time",
+            "type": "string"
+          }
+        },
+        "required": [
+          "schema",
+          "assuranceProfile",
+          "requestNonce",
+          "id",
+          "type",
+          "supportsRequirement",
+          "isConformantTo",
+          "issuedBy",
+          "providedBy",
+          "issuedAt",
+          "observedAt",
+          "validUntil",
+          "purpose",
+          "audience",
+          "configurationRevision",
+          "subjects",
+          "supportedValues"
+        ],
+        "title": "Evidence assertion payload Version 1",
+        "type": "object"
+      },
+      "EvidenceDefinition": {
+        "additionalProperties": false,
+        "properties": {
+          "concepts": {
+            "items": {
+              "$ref": "#/components/schemas/EvidenceDefinitionConcept"
+            },
+            "maxItems": 16,
+            "minItems": 1,
+            "type": "array",
+            "uniqueItems": true
+          },
+          "evidenceType": {
+            "format": "uri",
+            "maxLength": 512,
+            "type": "string"
+          },
+          "kind": {
+            "enum": [
+              "criterion",
+              "information-requirement",
+              "constraint"
+            ],
+            "type": "string"
+          },
+          "purpose": {
+            "pattern": "^[a-z][a-z0-9._:-]{0,127}$",
+            "type": "string"
+          },
+          "referenceFrameworks": {
+            "items": {
+              "format": "uri",
+              "maxLength": 512,
+              "type": "string"
+            },
+            "maxItems": 16,
+            "minItems": 1,
+            "type": "array",
+            "uniqueItems": true
+          },
+          "requirement": {
+            "format": "uri",
+            "maxLength": 512,
+            "type": "string"
+          },
+          "subjects": {
+            "items": {
+              "$ref": "#/components/schemas/EvidenceDefinitionSubject"
+            },
+            "maxItems": 8,
+            "minItems": 1,
+            "type": "array",
+            "uniqueItems": true
+          }
+        },
+        "required": [
+          "requirement",
+          "kind",
+          "evidenceType",
+          "purpose",
+          "referenceFrameworks",
+          "subjects",
+          "concepts"
+        ],
+        "type": "object"
+      },
+      "EvidenceDefinitionConcept": {
+        "additionalProperties": false,
+        "properties": {
+          "form": {
+            "enum": [
+              "boolean",
+              "controlled-code",
+              "controlled-category",
+              "bounded-integer",
+              "bounded-decimal",
+              "date-bucket",
+              "time-bucket",
+              "audience-scoped-entity-reference",
+              "controlled-code-list",
+              "entity-reference-list",
+              "reviewed-structured-value"
+            ],
+            "type": "string"
+          },
+          "id": {
+            "format": "uri",
+            "maxLength": 512,
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "form"
+        ],
+        "type": "object"
+      },
+      "EvidenceDefinitionSelector": {
+        "additionalProperties": false,
+        "properties": {
+          "fields": {
+            "items": {
+              "$ref": "#/components/schemas/EvidenceSelectorField"
+            },
+            "maxItems": 16,
+            "minItems": 1,
+            "type": "array",
+            "uniqueItems": true
+          },
+          "profile": {
+            "pattern": "^[a-z][a-z0-9._-]{0,127}$",
+            "type": "string"
+          },
+          "valueOrigin": {
+            "enum": [
+              "request",
+              "authenticated-context",
+              "authenticated-grant"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "profile",
+          "valueOrigin",
+          "fields"
+        ],
+        "type": "object"
+      },
+      "EvidenceDefinitionSubject": {
+        "additionalProperties": false,
+        "properties": {
+          "cardinality": {
+            "enum": [
+              "one"
+            ],
+            "type": "string"
+          },
+          "role": {
+            "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+            "type": "string"
+          },
+          "selector": {
+            "$ref": "#/components/schemas/EvidenceDefinitionSelector"
+          }
+        },
+        "required": [
+          "role",
+          "cardinality",
+          "selector"
+        ],
+        "type": "object"
+      },
+      "EvidenceDefinitions": {
+        "additionalProperties": false,
+        "properties": {
+          "assuranceProfile": {
+            "enum": [
+              "local",
+              "production",
+              "evidence-grade"
+            ],
+            "type": "string"
+          },
+          "configurationRevision": {
+            "pattern": "^sha256:[a-f0-9]{64}$",
+            "type": "string"
+          },
+          "definitions": {
+            "items": {
+              "$ref": "#/components/schemas/EvidenceDefinition"
+            },
+            "maxItems": 16384,
+            "type": "array",
+            "uniqueItems": true
+          },
+          "issuedBy": {
+            "format": "uri",
+            "maxLength": 512,
+            "type": "string"
+          },
+          "providedBy": {
+            "format": "uri",
+            "maxLength": 512,
+            "type": "string"
+          },
+          "schema": {
+            "enum": [
+              "registry.evidence-definitions/v1"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "schema",
+          "assuranceProfile",
+          "configurationRevision",
+          "issuedBy",
+          "providedBy",
+          "definitions"
+        ],
+        "title": "Requester-scoped Evidence definitions Version 1",
+        "type": "object"
+      },
+      "EvidenceProtectedHeader": {
+        "additionalProperties": false,
+        "properties": {
+          "alg": {
+            "enum": [
+              "EdDSA"
+            ],
+            "type": "string"
+          },
+          "cty": {
+            "enum": [
+              "application/evidence+json"
+            ],
+            "type": "string"
+          },
+          "kid": {
+            "maxLength": 256,
+            "minLength": 1,
+            "pattern": "^[^\\u0000-\\u001F\\u007F]+$",
+            "type": "string"
+          },
+          "typ": {
+            "enum": [
+              "evidence+jws"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "alg",
+          "kid",
+          "typ",
+          "cty"
+        ],
+        "type": "object"
+      },
+      "EvidenceRequest": {
+        "additionalProperties": false,
+        "properties": {
+          "holderKey": {
+            "$ref": "#/components/schemas/HolderPublicKey"
+          },
+          "purpose": {
+            "pattern": "^[a-z][a-z0-9._:-]{0,127}$",
+            "type": "string"
+          },
+          "requestNonce": {
+            "pattern": "^[A-Za-z0-9_-]{43}$",
+            "type": "string"
+          },
+          "requirement": {
+            "format": "uri",
+            "maxLength": 512,
+            "minLength": 1,
+            "type": "string"
+          },
+          "subjects": {
+            "items": {
+              "$ref": "#/components/schemas/EvidenceRequestSubject"
+            },
+            "maxItems": 8,
+            "minItems": 1,
+            "type": "array"
+          }
+        },
+        "required": [
+          "requestNonce",
+          "requirement",
+          "purpose",
+          "subjects"
+        ],
+        "title": "Evidence request Version 1",
+        "type": "object"
+      },
+      "EvidenceRequestSelector": {
+        "additionalProperties": false,
+        "properties": {
+          "profile": {
+            "pattern": "^[a-z][a-z0-9._-]{0,127}$",
+            "type": "string"
+          },
+          "values": {
+            "additionalProperties": {
+              "$ref": "#/components/schemas/SelectorValue"
+            },
+            "maxProperties": 16,
+            "minProperties": 1,
+            "propertyNames": {
+              "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+              "type": "string"
+            },
+            "type": "object"
+          }
+        },
+        "required": [
+          "profile"
+        ],
+        "type": "object"
+      },
+      "EvidenceRequestSubject": {
+        "additionalProperties": false,
+        "properties": {
+          "role": {
+            "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+            "type": "string"
+          },
+          "selector": {
+            "$ref": "#/components/schemas/EvidenceRequestSelector"
+          }
+        },
+        "required": [
+          "role",
+          "selector"
+        ],
+        "type": "object"
+      },
+      "EvidenceSelectorField": {
+        "oneOf": [
+          {
+            "additionalProperties": false,
+            "properties": {
+              "maximumBytes": {
+                "maximum": 8192,
+                "minimum": 1,
+                "type": "integer"
+              },
+              "minimumBytes": {
+                "maximum": 8192,
+                "minimum": 1,
+                "type": "integer"
+              },
+              "name": {
+                "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "string"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "type",
+              "name",
+              "minimumBytes",
+              "maximumBytes"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "name": {
+                "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "date"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "type",
+              "name"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "maximum": {
+                "maximum": 9007199254740991,
+                "minimum": -9007199254740991,
+                "type": "integer"
+              },
+              "minimum": {
+                "maximum": 9007199254740991,
+                "minimum": -9007199254740991,
+                "type": "integer"
+              },
+              "name": {
+                "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "integer"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "type",
+              "name",
+              "minimum",
+              "maximum"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "name": {
+                "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "boolean"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "type",
+              "name"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "maximumBytes": {
+                "maximum": 8192,
+                "minimum": 1,
+                "type": "integer"
+              },
+              "name": {
+                "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+                "type": "string"
+              },
+              "scheme": {
+                "format": "uri",
+                "maxLength": 512,
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "controlled-code"
+                ],
+                "type": "string"
+              },
+              "version": {
+                "maxLength": 128,
+                "minLength": 1,
+                "type": "string"
+              }
+            },
+            "required": [
+              "type",
+              "name",
+              "scheme",
+              "version",
+              "maximumBytes"
+            ],
+            "type": "object"
+          }
+        ]
+      },
+      "FlattenedJws": {
+        "additionalProperties": false,
+        "properties": {
+          "payload": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z0-9_-]+$",
+            "type": "string",
+            "x-decoded-schema": {
+              "$ref": "#/components/schemas/Evidence"
+            }
+          },
+          "protected": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z0-9_-]+$",
+            "type": "string",
+            "x-decoded-schema": {
+              "$ref": "#/components/schemas/EvidenceProtectedHeader"
+            }
+          },
+          "signature": {
+            "pattern": "^[A-Za-z0-9_-]{86}$",
+            "type": "string"
+          }
+        },
+        "required": [
+          "protected",
+          "payload",
+          "signature"
+        ],
+        "title": "Evidence flattened JWS response Version 1",
+        "type": "object"
+      },
+      "HealthStatus": {
+        "additionalProperties": false,
+        "properties": {
+          "status": {
+            "enum": [
+              "ok"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "status"
+        ],
+        "type": "object"
+      },
+      "HolderPublicKey": {
+        "additionalProperties": false,
+        "properties": {
+          "alg": {
+            "enum": [
+              "EdDSA"
+            ],
+            "type": "string"
+          },
+          "crv": {
+            "enum": [
+              "Ed25519"
+            ],
+            "type": "string"
+          },
+          "kid": {
+            "maxLength": 256,
+            "minLength": 1,
+            "type": "string"
+          },
+          "kty": {
+            "enum": [
+              "OKP"
+            ],
+            "type": "string"
+          },
+          "x": {
+            "pattern": "^[A-Za-z0-9_-]{43}$",
+            "type": "string"
+          }
+        },
+        "required": [
+          "kty",
+          "crv",
+          "x"
+        ],
+        "type": "object"
+      },
+      "JwksDocument": {
+        "additionalProperties": false,
+        "properties": {
+          "keys": {
+            "items": {
+              "$ref": "#/components/schemas/Ed25519PublicJwk"
+            },
+            "maxItems": 33,
+            "minItems": 1,
+            "type": "array",
+            "uniqueItems": true
+          }
+        },
+        "required": [
+          "keys"
+        ],
+        "title": "Evidence public JWKS Version 1",
+        "type": "object"
+      },
+      "JwtVcIssuerMetadata": {
+        "additionalProperties": false,
+        "properties": {
+          "issuer": {
+            "maxLength": 512,
+            "type": "string"
+          },
+          "jwks": {
+            "$ref": "#/components/schemas/JwksDocument"
+          }
+        },
+        "required": [
+          "issuer",
+          "jwks"
+        ],
+        "type": "object"
+      },
+      "Problem": {
+        "additionalProperties": false,
+        "oneOf": [
+          {
+            "properties": {
+              "code": {
+                "enum": [
+                  "malformed_request"
+                ],
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  400
+                ],
+                "type": "integer"
+              },
+              "title": {
+                "enum": [
+                  "Request is not valid"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "https://registrystack.org/problems/evidence/malformed_request"
+                ],
+                "type": "string"
+              }
+            }
+          },
+          {
+            "properties": {
+              "code": {
+                "enum": [
+                  "invalid_selector"
+                ],
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  400
+                ],
+                "type": "integer"
+              },
+              "title": {
+                "enum": [
+                  "Request is not valid"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "https://registrystack.org/problems/evidence/invalid_selector"
+                ],
+                "type": "string"
+              }
+            }
+          },
+          {
+            "properties": {
+              "code": {
+                "enum": [
+                  "authentication_failed"
+                ],
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  401
+                ],
+                "type": "integer"
+              },
+              "title": {
+                "enum": [
+                  "Authentication failed"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "https://registrystack.org/problems/evidence/authentication_failed"
+                ],
+                "type": "string"
+              }
+            }
+          },
+          {
+            "properties": {
+              "code": {
+                "enum": [
+                  "not_authorized"
+                ],
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  403
+                ],
+                "type": "integer"
+              },
+              "title": {
+                "enum": [
+                  "Request is not authorized"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "https://registrystack.org/problems/evidence/not_authorized"
+                ],
+                "type": "string"
+              }
+            }
+          },
+          {
+            "properties": {
+              "code": {
+                "enum": [
+                  "response_format_not_acceptable"
+                ],
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  406
+                ],
+                "type": "integer"
+              },
+              "title": {
+                "enum": [
+                  "Requested response format is not acceptable"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "https://registrystack.org/problems/evidence/response_format_not_acceptable"
+                ],
+                "type": "string"
+              }
+            }
+          },
+          {
+            "properties": {
+              "code": {
+                "enum": [
+                  "evidence_not_available"
+                ],
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  422
+                ],
+                "type": "integer"
+              },
+              "title": {
+                "enum": [
+                  "Evidence could not be produced"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "https://registrystack.org/problems/evidence/evidence_not_available"
+                ],
+                "type": "string"
+              }
+            }
+          },
+          {
+            "properties": {
+              "code": {
+                "enum": [
+                  "rate_limited"
+                ],
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  429
+                ],
+                "type": "integer"
+              },
+              "title": {
+                "enum": [
+                  "Request rate exceeded"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "https://registrystack.org/problems/evidence/rate_limited"
+                ],
+                "type": "string"
+              }
+            }
+          },
+          {
+            "properties": {
+              "code": {
+                "enum": [
+                  "dependency_unavailable"
+                ],
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  503
+                ],
+                "type": "integer"
+              },
+              "title": {
+                "enum": [
+                  "Service temporarily unavailable"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "https://registrystack.org/problems/evidence/dependency_unavailable"
+                ],
+                "type": "string"
+              }
+            }
+          },
+          {
+            "properties": {
+              "code": {
+                "enum": [
+                  "service_unavailable"
+                ],
+                "type": "string"
+              },
+              "status": {
+                "enum": [
+                  503
+                ],
+                "type": "integer"
+              },
+              "title": {
+                "enum": [
+                  "Service temporarily unavailable"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "https://registrystack.org/problems/evidence/service_unavailable"
+                ],
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "properties": {
+          "code": {
+            "enum": [
+              "malformed_request",
+              "invalid_selector",
+              "authentication_failed",
+              "not_authorized",
+              "response_format_not_acceptable",
+              "evidence_not_available",
+              "rate_limited",
+              "dependency_unavailable",
+              "service_unavailable"
+            ],
+            "type": "string"
+          },
+          "operation": {
+            "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+            "type": "string"
+          },
+          "status": {
+            "enum": [
+              400,
+              401,
+              403,
+              406,
+              422,
+              429,
+              503
+            ],
+            "type": "integer"
+          },
+          "title": {
+            "enum": [
+              "Request is not valid",
+              "Authentication failed",
+              "Request is not authorized",
+              "Requested response format is not acceptable",
+              "Evidence could not be produced",
+              "Request rate exceeded",
+              "Service temporarily unavailable"
+            ],
+            "type": "string"
+          },
+          "type": {
+            "enum": [
+              "https://registrystack.org/problems/evidence/malformed_request",
+              "https://registrystack.org/problems/evidence/invalid_selector",
+              "https://registrystack.org/problems/evidence/authentication_failed",
+              "https://registrystack.org/problems/evidence/not_authorized",
+              "https://registrystack.org/problems/evidence/response_format_not_acceptable",
+              "https://registrystack.org/problems/evidence/evidence_not_available",
+              "https://registrystack.org/problems/evidence/rate_limited",
+              "https://registrystack.org/problems/evidence/dependency_unavailable",
+              "https://registrystack.org/problems/evidence/service_unavailable"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "type",
+          "title",
+          "status",
+          "code",
+          "operation"
+        ],
+        "title": "Evidence public problem Version 1",
+        "type": "object"
+      },
+      "PublicValue": {
+        "anyOf": [
+          {
+            "type": "boolean"
+          },
+          {
+            "maximum": 9007199254740991,
+            "minimum": -9007199254740991,
+            "type": "integer"
+          },
+          {
+            "maxLength": 1024,
+            "minLength": 1,
+            "type": "string"
+          },
+          {
+            "$ref": "#/components/schemas/BucketValue"
+          },
+          {
+            "$ref": "#/components/schemas/EntityReferenceValue"
+          },
+          {
+            "$ref": "#/components/schemas/StructuredValue"
+          },
+          {
+            "items": {
+              "anyOf": [
+                {
+                  "maxLength": 1024,
+                  "minLength": 1,
+                  "type": "string"
+                },
+                {
+                  "$ref": "#/components/schemas/EntityReferenceValue"
+                }
+              ]
+            },
+            "maxItems": 64,
+            "minItems": 1,
+            "type": "array"
+          }
+        ]
+      },
+      "ReadyStatus": {
+        "additionalProperties": false,
+        "properties": {
+          "status": {
+            "enum": [
+              "ready"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "status"
+        ],
+        "type": "object"
+      },
+      "SdJwtVcCredential": {
+        "description": "Compact SD-JWT VC: the issuer-signed JWT, then the root-value and configured structured-field disclosures, then a trailing tilde marking an absent key-binding JWT. The issuer never appends a key-binding JWT.",
+        "pattern": "^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+(~[A-Za-z0-9_-]+)*~$",
+        "type": "string"
+      },
+      "SelectorValue": {
+        "oneOf": [
+          {
+            "maxLength": 512,
+            "minLength": 1,
+            "type": "string"
+          },
+          {
+            "maximum": 9007199254740991,
+            "minimum": -9007199254740991,
+            "type": "integer"
+          },
+          {
+            "type": "boolean"
+          }
+        ]
+      },
+      "StructuredValue": {
+        "additionalProperties": false,
+        "properties": {
+          "fields": {
+            "maxProperties": 16,
+            "minProperties": 1,
+            "type": "object"
+          },
+          "form": {
+            "enum": [
+              "reviewed-structured-value"
+            ],
+            "type": "string"
+          },
+          "schema": {
+            "format": "uri",
+            "maxLength": 512,
+            "type": "string"
+          }
+        },
+        "required": [
+          "form",
+          "schema",
+          "fields"
+        ],
+        "type": "object"
+      },
+      "SubjectBinding": {
+        "additionalProperties": false,
+        "properties": {
+          "binding": {
+            "pattern": "^urn:evidence:subject:v[1-9][0-9]*_[A-Za-z0-9_-]{43}$",
+            "type": "string"
+          },
+          "role": {
+            "pattern": "^[a-z][a-z0-9._-]{0,63}$",
+            "type": "string"
+          }
+        },
+        "required": [
+          "role",
+          "binding"
+        ],
+        "type": "object"
+      },
+      "SupportedValue": {
+        "additionalProperties": false,
+        "properties": {
+          "providesValueFor": {
+            "format": "uri",
+            "maxLength": 512,
+            "type": "string"
+          },
+          "value": {
+            "$ref": "#/components/schemas/PublicValue"
+          }
+        },
+        "required": [
+          "providesValueFor",
+          "value"
+        ],
+        "type": "object"
+      },
+      "UnsignedEvidenceEnvelope": {
+        "additionalProperties": false,
+        "properties": {
+          "evidence": {
+            "$ref": "#/components/schemas/Evidence"
+          },
+          "integrityProtection": {
+            "enum": [
+              "none"
+            ],
+            "type": "string"
+          },
+          "schema": {
+            "enum": [
+              "registry.unsigned-evidence-envelope/v1"
+            ],
+            "type": "string"
+          },
+          "type": {
+            "enum": [
+              "UnsignedEvidenceEnvelope"
+            ],
+            "type": "string"
+          },
+          "warning": {
+            "enum": [
+              "not-cryptographically-verifiable"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "schema",
+          "type",
+          "integrityProtection",
+          "warning",
+          "evidence"
+        ],
+        "title": "Evidence unsigned response envelope Version 1",
+        "type": "object"
+      }
+    },
+    "securitySchemes": {
+      "bearerAuth": {
+        "bearerFormat": "JWT",
+        "description": "Exactly one Authorization header containing one Bearer token is required.",
+        "scheme": "bearer",
+        "type": "http"
+      }
+    }
+  },
+  "info": {
+    "description": "Minimum-disclosure signed assertion service, Version 1.",
+    "title": "Registry Evidence API",
+    "version": "0.16.3"
+  },
+  "openapi": "3.1.0",
+  "paths": {
+    "/.well-known/evidence/jwks.json": {
+      "get": {
+        "operationId": "getEvidenceJwks",
+        "responses": {
+          "200": {
+            "content": {
+              "application/jwk-set+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/JwksDocument"
+                }
+              }
+            },
+            "description": "Evidence public verification keys",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "summary": "Publish the active and retained public verification keys"
+      }
+    },
+    "/.well-known/jwt-vc-issuer": {
+      "get": {
+        "description": "Discovery is not a trust anchor. The document republishes the same public keys under the provider identity the assertion names, and resolution is meaningful only when that identity is the HTTPS origin of the deployment.",
+        "operationId": "getJwtVcIssuerMetadata",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/JwtVcIssuerMetadata"
+                }
+              }
+            },
+            "description": "Provider identity and public verification keys",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "summary": "Publish JWT VC Issuer Metadata for the SD-JWT VC response format"
+      }
+    },
+    "/health": {
+      "get": {
+        "operationId": "getHealth",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HealthStatus"
+                }
+              }
+            },
+            "description": "Process is live",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "summary": "Report process liveness without dependency access"
+      }
+    },
+    "/openapi.json": {
+      "get": {
+        "description": "The generated public contract for this service. This route is intentionally unauthenticated: the served bytes are the released generated artifact and describe no deployment, definition, or authority.",
+        "operationId": "getOpenApi",
+        "responses": {
+          "200": {
+            "content": {
+              "application/openapi+json": {
+                "schema": {
+                  "type": "object"
+                }
+              }
+            },
+            "description": "The generated Version 1 OpenAPI document",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/Problem"
+                    },
+                    {
+                      "properties": {
+                        "code": {
+                          "enum": [
+                            "service_unavailable"
+                          ],
+                          "type": "string"
+                        },
+                        "status": {
+                          "enum": [
+                            503
+                          ],
+                          "type": "integer"
+                        },
+                        "title": {
+                          "enum": [
+                            "Service temporarily unavailable"
+                          ],
+                          "type": "string"
+                        },
+                        "type": {
+                          "enum": [
+                            "https://registrystack.org/problems/evidence/service_unavailable"
+                          ],
+                          "type": "string"
+                        }
+                      },
+                      "type": "object"
+                    }
+                  ]
+                }
+              }
+            },
+            "description": "The document could not be produced",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "security": [],
+        "summary": "Fetch this OpenAPI document"
+      }
+    },
+    "/ready": {
+      "get": {
+        "operationId": "getReadiness",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ReadyStatus"
+                }
+              }
+            },
+            "description": "Runtime is ready",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/Problem"
+                    },
+                    {
+                      "properties": {
+                        "code": {
+                          "enum": [
+                            "service_unavailable"
+                          ],
+                          "type": "string"
+                        },
+                        "status": {
+                          "enum": [
+                            503
+                          ],
+                          "type": "integer"
+                        },
+                        "title": {
+                          "enum": [
+                            "Service temporarily unavailable"
+                          ],
+                          "type": "string"
+                        },
+                        "type": {
+                          "enum": [
+                            "https://registrystack.org/problems/evidence/service_unavailable"
+                          ],
+                          "type": "string"
+                        }
+                      },
+                      "type": "object"
+                    }
+                  ]
+                }
+              }
+            },
+            "description": "Runtime is not ready",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "summary": "Report fail-closed runtime readiness"
+      }
+    },
+    "/v1/evidence": {
+      "post": {
+        "description": "Missing Accept, */*, and the exact application/jose+json media type select the default signed flattened JWS. Only the exact application/vnd.registrystack.evidence-unsigned+json media type selects the unsigned envelope, and only the exact application/dc+sd-jwt media type selects the SD-JWT VC serialization of the same assertion; each is released only when the immutable bundle and the complete matched authority grant permit it. Duplicate, combined, parameterized, weighted, or unknown negotiation returns 406 before source access.",
+        "operationId": "createEvidence",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/EvidenceRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/dc+sd-jwt": {
+                "schema": {
+                  "$ref": "#/components/schemas/SdJwtVcCredential"
+                }
+              },
+              "application/jose+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/FlattenedJws"
+                }
+              },
+              "application/vnd.registrystack.evidence-unsigned+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UnsignedEvidenceEnvelope"
+                }
+              }
+            },
+            "description": "Signed Evidence as flattened JWS JSON Serialization by default, or the explicitly authorized SD-JWT VC serialization or self-identifying unsigned envelope",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Vary": {
+                "description": "The response format is negotiated through the exact Accept matrix.",
+                "schema": {
+                  "enum": [
+                    "Accept"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "oneOf": [
+                    {
+                      "allOf": [
+                        {
+                          "$ref": "#/components/schemas/Problem"
+                        },
+                        {
+                          "properties": {
+                            "code": {
+                              "enum": [
+                                "malformed_request"
+                              ],
+                              "type": "string"
+                            },
+                            "status": {
+                              "enum": [
+                                400
+                              ],
+                              "type": "integer"
+                            },
+                            "title": {
+                              "enum": [
+                                "Request is not valid"
+                              ],
+                              "type": "string"
+                            },
+                            "type": {
+                              "enum": [
+                                "https://registrystack.org/problems/evidence/malformed_request"
+                              ],
+                              "type": "string"
+                            }
+                          },
+                          "type": "object"
+                        }
+                      ]
+                    },
+                    {
+                      "allOf": [
+                        {
+                          "$ref": "#/components/schemas/Problem"
+                        },
+                        {
+                          "properties": {
+                            "code": {
+                              "enum": [
+                                "invalid_selector"
+                              ],
+                              "type": "string"
+                            },
+                            "status": {
+                              "enum": [
+                                400
+                              ],
+                              "type": "integer"
+                            },
+                            "title": {
+                              "enum": [
+                                "Request is not valid"
+                              ],
+                              "type": "string"
+                            },
+                            "type": {
+                              "enum": [
+                                "https://registrystack.org/problems/evidence/invalid_selector"
+                              ],
+                              "type": "string"
+                            }
+                          },
+                          "type": "object"
+                        }
+                      ]
+                    }
+                  ]
+                }
+              }
+            },
+            "description": "Malformed request or invalid selector",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Vary": {
+                "description": "The response format is negotiated through the exact Accept matrix.",
+                "schema": {
+                  "enum": [
+                    "Accept"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/Problem"
+                    },
+                    {
+                      "properties": {
+                        "code": {
+                          "enum": [
+                            "authentication_failed"
+                          ],
+                          "type": "string"
+                        },
+                        "status": {
+                          "enum": [
+                            401
+                          ],
+                          "type": "integer"
+                        },
+                        "title": {
+                          "enum": [
+                            "Authentication failed"
+                          ],
+                          "type": "string"
+                        },
+                        "type": {
+                          "enum": [
+                            "https://registrystack.org/problems/evidence/authentication_failed"
+                          ],
+                          "type": "string"
+                        }
+                      },
+                      "type": "object"
+                    }
+                  ]
+                }
+              }
+            },
+            "description": "Authentication failed",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Vary": {
+                "description": "The response format is negotiated through the exact Accept matrix.",
+                "schema": {
+                  "enum": [
+                    "Accept"
+                  ],
+                  "type": "string"
+                }
+              },
+              "WWW-Authenticate": {
+                "schema": {
+                  "enum": [
+                    "Bearer"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/Problem"
+                    },
+                    {
+                      "properties": {
+                        "code": {
+                          "enum": [
+                            "not_authorized"
+                          ],
+                          "type": "string"
+                        },
+                        "status": {
+                          "enum": [
+                            403
+                          ],
+                          "type": "integer"
+                        },
+                        "title": {
+                          "enum": [
+                            "Request is not authorized"
+                          ],
+                          "type": "string"
+                        },
+                        "type": {
+                          "enum": [
+                            "https://registrystack.org/problems/evidence/not_authorized"
+                          ],
+                          "type": "string"
+                        }
+                      },
+                      "type": "object"
+                    }
+                  ]
+                }
+              }
+            },
+            "description": "Request is not authorized, including a recognized response format the bundle or matched grant does not permit",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Vary": {
+                "description": "The response format is negotiated through the exact Accept matrix.",
+                "schema": {
+                  "enum": [
+                    "Accept"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/Problem"
+                    },
+                    {
+                      "properties": {
+                        "code": {
+                          "enum": [
+                            "response_format_not_acceptable"
+                          ],
+                          "type": "string"
+                        },
+                        "status": {
+                          "enum": [
+                            406
+                          ],
+                          "type": "integer"
+                        },
+                        "title": {
+                          "enum": [
+                            "Requested response format is not acceptable"
+                          ],
+                          "type": "string"
+                        },
+                        "type": {
+                          "enum": [
+                            "https://registrystack.org/problems/evidence/response_format_not_acceptable"
+                          ],
+                          "type": "string"
+                        }
+                      },
+                      "type": "object"
+                    }
+                  ]
+                }
+              }
+            },
+            "description": "Media negotiation is outside the closed Accept matrix",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Vary": {
+                "description": "The response format is negotiated through the exact Accept matrix.",
+                "schema": {
+                  "enum": [
+                    "Accept"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/Problem"
+                    },
+                    {
+                      "properties": {
+                        "code": {
+                          "enum": [
+                            "evidence_not_available"
+                          ],
+                          "type": "string"
+                        },
+                        "status": {
+                          "enum": [
+                            422
+                          ],
+                          "type": "integer"
+                        },
+                        "title": {
+                          "enum": [
+                            "Evidence could not be produced"
+                          ],
+                          "type": "string"
+                        },
+                        "type": {
+                          "enum": [
+                            "https://registrystack.org/problems/evidence/evidence_not_available"
+                          ],
+                          "type": "string"
+                        }
+                      },
+                      "type": "object"
+                    }
+                  ]
+                }
+              }
+            },
+            "description": "Evidence could not be produced",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Vary": {
+                "description": "The response format is negotiated through the exact Accept matrix.",
+                "schema": {
+                  "enum": [
+                    "Accept"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/Problem"
+                    },
+                    {
+                      "properties": {
+                        "code": {
+                          "enum": [
+                            "rate_limited"
+                          ],
+                          "type": "string"
+                        },
+                        "status": {
+                          "enum": [
+                            429
+                          ],
+                          "type": "integer"
+                        },
+                        "title": {
+                          "enum": [
+                            "Request rate exceeded"
+                          ],
+                          "type": "string"
+                        },
+                        "type": {
+                          "enum": [
+                            "https://registrystack.org/problems/evidence/rate_limited"
+                          ],
+                          "type": "string"
+                        }
+                      },
+                      "type": "object"
+                    }
+                  ]
+                }
+              }
+            },
+            "description": "Request rate exceeded",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Retry-After": {
+                "schema": {
+                  "enum": [
+                    "1"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Vary": {
+                "description": "The response format is negotiated through the exact Accept matrix.",
+                "schema": {
+                  "enum": [
+                    "Accept"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "oneOf": [
+                    {
+                      "allOf": [
+                        {
+                          "$ref": "#/components/schemas/Problem"
+                        },
+                        {
+                          "properties": {
+                            "code": {
+                              "enum": [
+                                "dependency_unavailable"
+                              ],
+                              "type": "string"
+                            },
+                            "status": {
+                              "enum": [
+                                503
+                              ],
+                              "type": "integer"
+                            },
+                            "title": {
+                              "enum": [
+                                "Service temporarily unavailable"
+                              ],
+                              "type": "string"
+                            },
+                            "type": {
+                              "enum": [
+                                "https://registrystack.org/problems/evidence/dependency_unavailable"
+                              ],
+                              "type": "string"
+                            }
+                          },
+                          "type": "object"
+                        }
+                      ]
+                    },
+                    {
+                      "allOf": [
+                        {
+                          "$ref": "#/components/schemas/Problem"
+                        },
+                        {
+                          "properties": {
+                            "code": {
+                              "enum": [
+                                "service_unavailable"
+                              ],
+                              "type": "string"
+                            },
+                            "status": {
+                              "enum": [
+                                503
+                              ],
+                              "type": "integer"
+                            },
+                            "title": {
+                              "enum": [
+                                "Service temporarily unavailable"
+                              ],
+                              "type": "string"
+                            },
+                            "type": {
+                              "enum": [
+                                "https://registrystack.org/problems/evidence/service_unavailable"
+                              ],
+                              "type": "string"
+                            }
+                          },
+                          "type": "object"
+                        }
+                      ]
+                    }
+                  ]
+                }
+              }
+            },
+            "description": "Dependency or service temporarily unavailable",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Vary": {
+                "description": "The response format is negotiated through the exact Accept matrix.",
+                "schema": {
+                  "enum": [
+                    "Accept"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Produce evidence for one authorized fixed requirement"
+      }
+    },
+    "/v1/evidence-definitions": {
+      "get": {
+        "operationId": "listEvidenceDefinitions",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/EvidenceDefinitions"
+                }
+              }
+            },
+            "description": "Requester-scoped Evidence definitions",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/Problem"
+                    },
+                    {
+                      "properties": {
+                        "code": {
+                          "enum": [
+                            "malformed_request"
+                          ],
+                          "type": "string"
+                        },
+                        "status": {
+                          "enum": [
+                            400
+                          ],
+                          "type": "integer"
+                        },
+                        "title": {
+                          "enum": [
+                            "Request is not valid"
+                          ],
+                          "type": "string"
+                        },
+                        "type": {
+                          "enum": [
+                            "https://registrystack.org/problems/evidence/malformed_request"
+                          ],
+                          "type": "string"
+                        }
+                      },
+                      "type": "object"
+                    }
+                  ]
+                }
+              }
+            },
+            "description": "Malformed discovery request",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/Problem"
+                    },
+                    {
+                      "properties": {
+                        "code": {
+                          "enum": [
+                            "authentication_failed"
+                          ],
+                          "type": "string"
+                        },
+                        "status": {
+                          "enum": [
+                            401
+                          ],
+                          "type": "integer"
+                        },
+                        "title": {
+                          "enum": [
+                            "Authentication failed"
+                          ],
+                          "type": "string"
+                        },
+                        "type": {
+                          "enum": [
+                            "https://registrystack.org/problems/evidence/authentication_failed"
+                          ],
+                          "type": "string"
+                        }
+                      },
+                      "type": "object"
+                    }
+                  ]
+                }
+              }
+            },
+            "description": "Authentication failed",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "WWW-Authenticate": {
+                "schema": {
+                  "enum": [
+                    "Bearer"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/Problem"
+                    },
+                    {
+                      "properties": {
+                        "code": {
+                          "enum": [
+                            "rate_limited"
+                          ],
+                          "type": "string"
+                        },
+                        "status": {
+                          "enum": [
+                            429
+                          ],
+                          "type": "integer"
+                        },
+                        "title": {
+                          "enum": [
+                            "Request rate exceeded"
+                          ],
+                          "type": "string"
+                        },
+                        "type": {
+                          "enum": [
+                            "https://registrystack.org/problems/evidence/rate_limited"
+                          ],
+                          "type": "string"
+                        }
+                      },
+                      "type": "object"
+                    }
+                  ]
+                }
+              }
+            },
+            "description": "Request rate exceeded",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Retry-After": {
+                "schema": {
+                  "enum": [
+                    "1"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/Problem"
+                    },
+                    {
+                      "properties": {
+                        "code": {
+                          "enum": [
+                            "service_unavailable"
+                          ],
+                          "type": "string"
+                        },
+                        "status": {
+                          "enum": [
+                            503
+                          ],
+                          "type": "integer"
+                        },
+                        "title": {
+                          "enum": [
+                            "Service temporarily unavailable"
+                          ],
+                          "type": "string"
+                        },
+                        "type": {
+                          "enum": [
+                            "https://registrystack.org/problems/evidence/service_unavailable"
+                          ],
+                          "type": "string"
+                        }
+                      },
+                      "type": "object"
+                    }
+                  ]
+                }
+              }
+            },
+            "description": "Service temporarily unavailable",
+            "headers": {
+              "Cache-Control": {
+                "description": "Evidence responses are never cacheable.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "X-Request-Id": {
+                "description": "Server-minted operation identifier for this request. It is generated by Evidence, never taken from the caller, and is the identifier a caller quotes to an operator. Problem responses repeat it in the operation member.",
+                "schema": {
+                  "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "List the complete Evidence request shapes available to the authenticated caller"
+      }
+    }
+  }
+}
diff --git a/products/evidence/reference/request-adapter/ADAPTER-API.md b/products/evidence/reference/request-adapter/ADAPTER-API.md
new file mode 100644
index 000000000..0319fe694
--- /dev/null
+++ b/products/evidence/reference/request-adapter/ADAPTER-API.md
@@ -0,0 +1,714 @@
+# Evidence request-adapter API
+
+Status: Implemented Version 1 trusted request-adapter ABI
+
+This document defines the Version 1 API visible to reviewed source-adapter
+scripts. It is intentionally smaller than Rhai's standard library. The host is
+Rust. Adapter scripts cannot perform I/O or choose transport authority.
+
+This contract is the `registry.evidence.request-adapter/v1` ABI and is bound to
+the Evidence bundle contract Version 1. A
+source does not carry a redundant `adapterAbiVersion` field unless the product
+later demonstrates a need to run multiple adapter ABIs under one bundle
+version.
+
+`evidencectl build` is an authoring-to-bundle compiler, not another adapter
+runtime. It carries reviewed scripts and their referenced schemas into one
+closed candidate, then asks the real `evidence` binary to compile and evaluate
+them. Production build metadata cannot add an ABI entry point, helper,
+transport capability, source call, or script-selected behavior.
+
+## Complete Version 1 surface
+
+This inventory is the complete adopter-facing Version 1 script surface. It
+defines all three entry points, every host-provided helper, the pinned Rhai
+syntax, result types, resource bounds, and forbidden constructs. Adopters do
+not need to inspect the Rust implementation to determine whether a script is
+supported.
+
+```text
+prepare(selectors: map, parameters: map) -> RequestParts
+extract(response: JSON, parameters: map) -> LookupResult
+derive(facts: map, selectors: map, evaluation_context: map)
+    -> array<DerivedConceptValue>
+```
+
+Version 1 uses one shared deterministic helper catalogue for `prepare`,
+`extract`, and `derive`. The helpers are pure and provide no external
+authority. Capability separation instead comes from the values Rust supplies
+and the closed result validator for each entry point. For example, preparation
+receives no evaluation context or codelist handles, and `RequestParts` rejects
+typed derivation values.
+
+The compiler accepts exactly one function with the required entry-point name
+and arity. It rejects top-level executable statements, an absent or overloaded
+entry point, function pointers, data-derived dispatch, anonymous functions,
+and closures. Statically named, bounded same-file helper functions are allowed;
+Rust invokes only the declared entry point.
+
+## Entry points
+
+A source has two separately compiled adapter scripts, and each requirement has
+one separately compiled derivation script:
+
+```text
+prepare(selectors: map, parameters: map) -> RequestParts
+extract(response: JSON, parameters: map) -> LookupResult
+derive(facts: map, selectors: map, evaluation_context: map)
+    -> array<DerivedConceptValue>
+```
+
+- `prepare`, `extract`, and `derive` run with fresh state on every invocation.
+- Inputs are isolated per-invocation copies constructed by Rust. A script may
+  mutate a local nested map, array, or string, but that mutation cannot affect
+  the bundle, a later invocation, or the other adapter stage.
+- Scripts compile at startup. Top-level executable statements are forbidden.
+- Named same-file helper functions are allowed, but Rust invokes only the
+  declared entry point. Calls remain statically named in reviewed source.
+- Preparation runs after successful authorization and durable access-attempt
+  audit, but before credential resolution or source access.
+- Extraction receives neither selectors nor prepared request parts.
+- Derivation runs only for `match`, receives only the authorized roles and
+  fields declared by the requirement's closed `derivation.selectorInputs`, and
+  receives neither the source response nor prepared request parts. A
+  derivation that declares no selector inputs receives an empty map.
+
+## Bundle configuration shape
+
+The Version 1 bundle schema adds these exact script-owned fields while keeping
+transport authority in the existing source request object:
+
+```yaml
+sources:
+  source-a:
+    transport: http-json
+    baseUrl: https://source.example
+    posture: record-transformed
+    authentication: {kind: static-bearer, tokenRef: secret:file/source-token}
+    request:
+      method: POST
+      path: /v1/search
+      fixedHeaders: [{name: Accept, value: application/json}]
+      selectorInputs:
+        - role: child
+          alternatives:
+            - {profile: record-reference-v1, fields: [record_reference]}
+      prepareScript: adapters/source-a-prepare.rhai
+      adapterParameters: {resultLimit: 2}
+      adapterParametersSchema: schemas/source-a-parameters.schema.yaml
+      preparationLimits:
+        query: forbidden
+        jsonBody: required
+        maximumJsonDepth: 12
+        maximumCollectionItems: 32
+        maximumStringBytes: 512
+        maximumNormalizedBytes: 8192
+      projection: [/total, /results]
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 8
+    responseSchema: schemas/source-a-response.schema.yaml
+    extractScript: adapters/source-a-extract.rhai
+    factSchema: schemas/source-a-facts.schema.yaml
+requirements:
+  - id: urn:example:requirement:relationship:v1
+    derivation:
+      script: derivations/relationship.rhai
+      selectorInputs:
+        - role: candidate
+          alternatives:
+            - {profile: person-reference-v1, fields: [person_reference]}
+      parameters: {matching_policy: exact-reference-v1}
+```
+
+`request.selectorInputs` controls preparation exposure.
+`derivation.selectorInputs` independently controls derivation exposure. Every
+alternative must exactly match one declared requirement role, profile, and
+field set. Rust rejects a missing, surplus, unauthorized, or incompatible
+binding at startup. `prepareScript` and `extractScript` are symmetric,
+separately compiled entry points; neither is a transport plugin.
+
+The ceiling of at most two minimally projected results, which lets one bounded
+request separate a unique match from ambiguity, is governed adapter policy. Its
+value is declared by the reviewed source configuration, here
+`adapterParameters: {resultLimit: 2}`, and rendered into the request by that
+source's `prepareScript`. Rust enforces only the generic one-request,
+projection, and response bounds around it. Two is not a Rust domain rule, not a
+built-in operation, and not a property of any source product.
+
+## Inputs
+
+For `prepare`, `selectors` contains only roles, profiles, and fields declared
+by the source's closed `selectorInputs` contract. Rust has already validated
+and authorized them. Surplus request fields are not passed to preparation.
+Scripts may rely on this exact shape and should not repeat role, profile,
+field, type, or bound validation. Host-shape violations are Rust contract
+failures and belong in host negative tests. A script still validates
+requirement-specific semantic relationships that Rust cannot infer, such as a
+provider status or a governed namespace agreement.
+
+For `derive`, `selectors` contains only the roles, profiles, and fields declared
+by that requirement's closed derivation selector-input contract. Rust resolves
+those values from the already authorized requirement subjects. A relationship
+requirement can therefore retrieve a record using only a child selector and
+compare an extracted parent fact with only the separately authorized
+candidate-parent reference. Derivation cannot inspect the child selector when
+it did not declare it, the complete HTTP request, bearer token, grant, or
+caller-supplied surplus data.
+
+```json
+{
+  "subject": {
+    "profile": "person-demographics-v1",
+    "values": {
+      "given_name": "Synthetic",
+      "family_name": "Subject",
+      "birth_date": "2000-02-29"
+    }
+  }
+}
+```
+
+Source-adapter `parameters` is non-secret bundle data validated at startup
+against a closed JSON Schema. It may contain provider field identifiers and
+fixed request constants. It must not contain credentials, tokens, requester
+identity, authorization objects, audit handles, or runtime state. The same
+parameters are supplied independently to `prepare` and `extract`; neither
+invocation can mutate the other's copy.
+
+Derivation parameters remain in `evaluation_context.parameters`, alongside
+Rust-owned observation time and codelist handles. They are independent of the
+source-adapter parameters unless the reviewed bundle deliberately repeats a
+non-secret constant in both closed configurations.
+
+The adapter-parameter conversion is closed:
+
+| JSON form | Rhai form |
+|---|---|
+| boolean | `bool` |
+| integer in the signed 64-bit range | `i64` |
+| bounded UTF-8 string | `string` |
+| bounded array of permitted forms | `array` |
+| bounded object of permitted forms | `map` |
+
+Null, fractional numbers, integers outside the signed 64-bit range, and typed
+derivation envelopes such as `{type: "decimal", value: "..."}` are not adapter
+parameters. They fail startup validation. No implicit numeric conversion is
+performed.
+
+`response` is one bounded JSON response from the fixed source request. Rust
+rejects an invalid media type, oversized body, malformed JSON, redirect, or
+transport failure before extraction. JSON integers outside the signed 64-bit
+range are rejected before Rhai so they cannot silently become imprecise binary
+floating-point values. Ordinary fractional JSON numbers remain `f64`; an
+adapter must reject one wherever the provider contract requires an integer.
+
+### Response projection
+
+`request.projection` is a Rust-enforced, client-side allowlist applied after
+the bounded JSON response is parsed and before it is converted to Rhai. It is
+not documentation and does not request provider-side field selection. A source
+should also use a provider field-selection feature when one exists, but its
+acquisition posture describes what crosses the wire before this local pruning.
+
+Each projection entry is an extended JSON Pointer. Ordinary segments follow
+RFC 6901 escaping: `~0` means `~` and `~1` means `/`. The reserved segment `*`
+visits every current array element. Numeric array indexes, recursive descent,
+filters, predicates, unions, and script-computed projection paths are not
+supported. Examples:
+
+```text
+/total
+/results/*/status
+/results/*/declaration/mother.personReference
+```
+
+Projection constructs a new JSON tree containing only present selected leaves
+and the objects or arrays needed to reach them. Object keys not selected are
+dropped. Array order and length are preserved; each selected array element is
+projected independently. A missing selected leaf is omitted rather than
+invented or treated as `null`, so extraction can distinguish missing data from
+an explicit JSON null and fail according to the provider contract. A missing
+or mistyped intermediate container is a source-protocol failure before Rhai.
+An empty projection, duplicate path, invalid escape, overlapping ancestor and
+descendant paths, or path that cannot be reconciled with another selected path
+fails bundle validation.
+
+### Declared response shape
+
+Every source declares a required `responseSchema`: a bundle-relative closed
+JSON Schema, in the same subset as `adapterParametersSchema` and `factSchema`,
+describing the projected tree. Rust validates the projected response against it
+after projection and before conversion to Rhai, so a response outside the shape
+the adapter was reviewed against never reaches a script; that is a
+source-protocol failure like any other.
+
+Two rules differ from the fact and adapter-parameter roles, because the
+projected tree is not the wire response:
+
+- It may require fewer members than it declares properties. Projection drops a
+  selected leaf the record did not carry, and a page decided ambiguous is never
+  read record by record, so a record on that page need not be complete.
+- A node may write its type as the pair `[T, "null"]`. A source that reports an
+  explicit null where it holds no value has that null carried through
+  projection verbatim, and it reaches the script as the same unit marker
+  `is_missing` already reads. This is the only union the subset admits, and
+  only in this role: a fact and an adapter parameter are never null.
+
+State in the schema what a shape can state: member presence where it is
+guaranteed, member types, array bounds and uniqueness, string bounds and
+formats, and enumerated or constant values. What remains for the script is what
+a shape cannot state, such as how a reported total agrees with the records
+returned, page-count arithmetic, and which values must agree with the closed
+adapter parameters.
+
+Response byte limits and JSON parsing bounds apply before projection, so the
+configured `maximumResponseBytes` describes the wire body Evidence is willing
+to read. The projected tree is bounded separately: it must serialize to at most
+65,536 bytes, and Rhai input bounds apply to it again. Exact root-envelope
+checks in an extraction script may therefore rely on unselected root keys having
+been removed. The fixture harness supplies raw provider JSON and runs this same
+projection before extraction.
+
+## Output from `prepare`
+
+`RequestParts` has exactly two members:
+
+```text
+RequestParts {
+  query: array<{name: string, value: string}>,
+  body: JSON | null
+}
+```
+
+- Query pairs remain ordered and may repeat a name.
+- Query names and values are lexical strings even when the provider interprets
+  them as numbers or booleans. Constants destined for the query string must be
+  authored as strings such as `"2"` and `"true"`; JSON body values retain
+  their JSON types. Rust performs no implicit query conversion.
+- Query names and values are logical raw strings. Names must be non-empty.
+  Rust rejects CR or LF in either component and percent-encodes each component
+  exactly once as UTF-8. ASCII letters, digits, `-`, `.`, `_`, and `~` remain
+  unescaped; every other byte uses uppercase `%HH`, including space as `%20`.
+- Rust validates the complete result before acquiring credentials.
+- The source definition decides whether query and body output are permitted.
+- Unknown members or non-JSON values fail closed.
+
+The following are never script-controlled:
+
+```text
+source, origin, URL, path, method, headers, authentication, credentials,
+content type, timeout, redirect policy, retry policy, pagination, proxy use,
+response limit, concurrency, or number of requests
+```
+
+Rust executes exactly one evidence-data request. A response cannot supply a
+second URL, next page, or retry request.
+
+A bundle may define a Rust-owned `pathTemplate` with complete-segment
+`pathBindings` to already validated and authorized selector fields. Those
+bindings are not `RequestParts` and are never supplied by the script. Each
+placeholder occupies one complete path segment. Values reject `/`, `\`, `%`,
+controls, `.` and `..`, then Rust percent-encodes them exactly once. Expansion
+cannot change the configured origin, endpoint family, method, credentials, or
+request count. A source declares exactly one of fixed `path` or
+`pathTemplate`.
+
+Bundle-fixed `fixedHeaders` are ordered, non-secret constants. Names are unique
+after ASCII case folding and cannot set authentication, host/routing, cookies,
+body framing, content length/type, connection, forwarding, proxy, or tracing
+headers. Rust adds `Content-Type: application/json` for a JSON body and owns all
+authentication and framing headers. Header names and values are bounded and
+reject controls, CR, and LF. Scripts cannot observe or modify headers.
+
+The governed bundle and operator runtime split, Basic/static-Bearer/static-
+API-key/OAuth profiles, the local-only credential-free loopback boundary, and
+logical private-CA bindings are defined in
+[`deployment-projects/CONFIG.md`](deployment-projects/CONFIG.md). They are
+transport contracts, not script capabilities.
+
+### Normalization and exact fixtures
+
+Rust converts the Rhai result into a JSON tree before applying result limits.
+For byte limits and deterministic transport, normalized JSON is compact UTF-8
+with no insignificant whitespace, object keys in lexical byte order, array
+order preserved, canonical JSON integer spelling, and finite floating-point
+values rendered in the shortest round-trippable form. Unsupported and
+non-finite values fail closed.
+
+Expected `RequestParts` may be an external JSON file in a focused adapter
+fixture or the inline `common.expectedRequestParts` object in a complete
+project fixture. Both are parsed and compared structurally after normalization.
+Source-file whitespace and object-member order are not significant. The order
+of the query-pair array is significant. A separate transport assertion compares
+the exact encoded query string and exact normalized JSON request-body bytes
+sent to the mock. The closed project fixture vocabulary is defined in
+[`deployment-projects/FIXTURES.md`](deployment-projects/FIXTURES.md).
+
+## Output from `extract`
+
+`LookupResult` is one member of this closed union:
+
+```text
+#{outcome: "no_match"}
+#{outcome: "ambiguous"}
+#{outcome: "match", facts: <JSON object>}
+```
+
+- `no_match` and `ambiguous` contain no `facts` member.
+- `match` requires exactly one provider match and facts that satisfy the
+  source's closed fact schema.
+- Provider protocol inconsistencies must fail. They must not become
+  `no_match`, `ambiguous`, or default facts.
+- An absent result never represents an authoritative negative assertion.
+
+## Output from `derive`
+
+`derive/3` returns an array of `DerivedConceptValue` maps:
+
+```text
+DerivedConceptValue {
+  concept_id: string,
+  value: supported value
+}
+```
+
+Each map has exactly `concept_id` and `value`. The array contains at most 16
+items. Concept identifiers must equal the selected requirement's declared
+output set exactly. Duplicates, missing required concepts, undeclared concepts,
+and extra map members fail before evidence construction.
+
+Ordinary JSON-compatible values remain subject to the concept's declared form,
+codelist, cardinality, size, range, and precision constraints. Three protected
+result forms require host constructors:
+
+- `Decimal` is created only by `decimal(canonical_text)` or
+  `parse_decimal(canonical_text)`. It has at most 28 significant digits and 9
+  fractional digits and is serialized by Rust as its exact canonical JSON
+  string. Rhai floats cannot satisfy a bounded-decimal concept.
+- `EntityReferenceSeed` is created only by
+  `entity_reference_seed(protected_string)`, whose input is 1 through 512 UTF-8
+  bytes. The seed cannot be serialized, logged, compared, or used directly as
+  a public identifier. Rust projects it to an audience-scoped reference after
+  validation.
+- `EntityReferenceSeedList` is an array containing only
+  `EntityReferenceSeed` values, with at most 64 items. Rust projects each seed
+  independently after the complete output gate passes.
+
+## Selector-aware derivation and relationship decisions
+
+Selector-aware derivation exists for relational assertions whose truth is
+defined by both an authoritative source record and an independently authorized
+subject role. It does not turn Evidence into a general identity resolver.
+
+Permitted reviewed rules include:
+
+- exact membership of an authoritative opaque identifier in a complete source
+  relationship set;
+- exact comparison of a closed tuple of authoritative attributes after a
+  deterministic, jurisdiction-governed canonicalization implemented in the
+  derivation script; and
+- direct mapping of an explicit source-owned relationship decision.
+
+The default reference rule is exact opaque-identifier membership. A bundle
+using names, dates, transliteration, or another attribute rule must version and
+review that rule explicitly and name the resulting concept no more strongly
+than the source and governance justify. Probabilistic matching, fuzzy scoring,
+candidate ranking, deduplication, and best-match selection remain outside this
+ABI.
+
+A derivation may return `false` only after extraction established one uniquely
+resolved authoritative record and emitted a schema-required returned-record
+identifier, relationship-set contract identifier, reference namespace, and
+`relationship_set_complete: true` fact. When the provider returns the lookup
+identifier, the derivation declares that authorized lookup selector and
+requires exact equality before using the record. The derivation must require
+and validate those facts before comparing the candidate. No match, ambiguity,
+returned-record mismatch, partial relationship data, namespace mismatch,
+or protocol uncertainty stops before the boolean result and never becomes an
+authoritative negative assertion. The bundle review must justify how the configured source
+contract distinguishes an absent optional relationship from missing data.
+
+In the portable family example, `reference_namespace` and
+`relationship_set_contract` are copied from closed adapter parameters and then
+compared with closed requirement parameters. That is startup constant
+agreement between reviewed bundle sections, not proof that the provider
+returned a namespace or contract identifier. If either value can vary by
+record, extraction must derive and validate it from projected provider data,
+the fact schema must require it, and fixtures must cover mismatch. Governance
+must always establish that returned references belong to the declared
+namespace and that the relationship set has the claimed meaning and
+completeness.
+
+`legal-parent-relationship` is valid only where deployment governance states
+that the configured source fields and matching rule establish legal
+parentage. The portable OpenCRVS reference therefore uses
+`registered-parent-relationship` until that stronger jurisdiction-specific
+meaning is documented.
+
+## Version 1 combined language surface
+
+With the Version 1 additions, adapter scripts may construct `bool`, signed
+64-bit integer, finite floating-point number, character, string, array, map,
+and unit/null values. Adapter outputs must be JSON-compatible; non-finite
+numbers and unsupported host-object values are rejected.
+
+The Version 1 ABI pins Rhai 1.25.1 core syntax plus the host registrations in
+this document. Rhai syntax does not grant host authority, but its observable
+behavior is still part of the reviewed-script contract. The supported surface
+includes:
+
+| Surface | Available behavior |
+|---|---|
+| Bindings | `let`, `const`, reassignment, and local function parameters |
+| Control | `if`/`else`, `return`, `throw`, and bounded `for` over arrays |
+| Construction | array, map, string, integer, boolean, and unit literals |
+| Access | fixed or computed map indexing and bounded non-negative array indexing |
+| Boolean | `!`, `&&`, `||`, equality and inequality |
+| Integer | arithmetic, bitwise operations, shifts, equality, and ordering |
+| Floating point | arithmetic, equality, and ordering, including mixed integer/float operands |
+| String | concatenation, substring removal, equality, and ordering |
+| Functions | statically named same-file functions within the global call-depth limit |
+
+Only arrays are registered as iterable by the host. Ranges, string slicing,
+`switch`, `try`/`catch`, unbounded loop forms, optional chaining, and null
+coalescing are rejected by the hardened compiler. A missing map key produces
+unit. Map membership uses the registered `map.contains` helper. Equality between
+different types returns false and inequality returns true; same-type array or
+map comparison is not registered and fails.
+
+Rhai counts a negative array index from the end of the array. The startup source
+review therefore routes every index operand through a host-owned index guard,
+and a negative index fails the invocation however it was computed rather than
+silently addressing another element.
+
+The following are deliberately forbidden:
+
+- `Fn(...)`, function pointers, `.call`, `.curry`, and data-derived dispatch;
+- anonymous functions and closures;
+- interpolated backtick strings and their implicit value-to-string
+  conversion;
+- raw string literals such as `#"..."#`, so the source review and the Rhai
+  tokenizer can never disagree about where a string ends. `#{` remains the map
+  literal;
+- a block or an `if` chain used in operand position, because the source review
+  could not then classify a following `[` and the index guard would be lost.
+  Assign the intermediate result to a mutable local and use that local;
+- top-level executable statements;
+- `try`/`catch`, so a script cannot suppress the host-private unavailable
+  termination raised by `required`; and
+- `switch`, `while`, `until`, `loop`, `do`, range construction, string slicing,
+  optional chaining, and null coalescing because Version 1 adapters do not
+  require them.
+
+Negative tests pin each forbidden construct and the index guard. The operation,
+call-depth, expression-depth, string, array, and map ceilings apply to every
+otherwise permitted construct.
+
+### Language essentials
+
+| Function or operator | Signature and meaning |
+|---|---|
+| Integer equality | `i64 == i64`, `i64 != i64` |
+| Integer ordering | `<`, `<=`, `>`, `>=` over signed 64-bit integers |
+| Integer arithmetic | Binary `+`, `-`, `*`, `/`, `%`, `**`; unary `+` and `-` |
+| Integer bitwise | `&`, `|`, `^`, `<<`, `>>` |
+| Floating arithmetic | `+`, `-`, `*`, `/`, `%`, `**`, unary `+/-`, equality, and ordering over `f64` |
+| Mixed numeric operations | Arithmetic, equality, and ordering between `i64` and `f64` in either operand order |
+| Boolean logic | `!bool`, boolean equality and inequality; `&&` and `||` are language control operators |
+| String operations | `string + string`, `string + char`, `char + string`, `string - string`, `+=`, equality, and lexical ordering |
+| `array.len` | Number of array items as an integer |
+| `len(map)` | Number of map entries as an integer |
+| `map.contains(name)` | Whether an exact string key exists |
+| Array iteration | `for value in array`, bounded by the operation and array limits |
+| `type_of(value)` | Pinned Rhai type name, including registered opaque type names |
+
+### Evidence primitives
+
+The opaque types cannot be serialized into
+`RequestParts` or extraction facts. Some helpers require handles that only
+Rust can supply through derivation context.
+
+| Function | Signature and behavior |
+|---|---|
+| `parse_date` | `string -> Date`; strict canonical proleptic-Gregorian `YYYY-MM-DD` |
+| `parse_instant` | `string -> Instant`; uppercase `T` and `Z`, explicit offset, no leap second, optional 1 to 9 fractional digits, normalized to UTC |
+| `parse_integer` | `string -> i64`; optional ASCII `-` and one or more ASCII digits; leading zeroes allowed; rejects `+`, whitespace, non-ASCII digits, fractions, exponents, empty input, and overflow |
+| `decimal` | `string -> Decimal`; alias of `parse_decimal` |
+| `parse_decimal` | `string -> Decimal`; canonical exact decimal with no `+`, exponent, leading zero, trailing fractional zero, empty fraction, negative zero, NaN, or infinity; zero is exactly `0` |
+| `integer_to_decimal` | `i64 -> Decimal` |
+| `add_calendar_years` | `(Date, i64) -> Date`; clamps the day at month end, from -1000 through 1000 years inclusive |
+| `add_calendar_months` | `(Date, i64) -> Date`; clamps the day at month end, from -12000 through 12000 months inclusive |
+| `compare_dates` | `(Date, Date) -> i64`; returns `-1`, `0`, or `1` |
+| `compare_instants` | `(Instant, Instant) -> i64`; returns `-1`, `0`, or `1` |
+| `days_between` | `(Date, Date) -> i64`; second minus first, from -365000 through 365000 days inclusive |
+| `compare_decimals` | `(Decimal, Decimal) -> i64`; returns `-1`, `0`, or `1` |
+| `bucket_number` | `(Decimal, array<NumericBucket>) -> string`; requires 1 to 64 contiguous, ordered half-open buckets with unique codes; a value outside every bucket fails the invocation |
+| `entity_reference_seed` | `string -> EntityReferenceSeed`; opaque value permitted only through the derived-value gate |
+| `codelist_lookup` | `(CodelistHandle, string) -> string or unit`; handle is supplied only by Rust |
+| `list_contains` | `(array<scalar>, scalar) -> bool`; supports boolean, integer, string, Date, Instant, and Decimal while keeping types distinct; validates every element before answering |
+| `set_contains` | `(array<scalar>, scalar) -> bool`; same scalar types and the same complete validation, and rejects duplicate set entries |
+| `array.push(value)` | Appends one value to the invocation-local array within the 256-item bound and returns unit |
+| `string.replace(from, to)` | Replaces every exact non-overlapping literal occurrence in the invocation-local string within the 16,384-byte bound and returns unit; no regex or normalization |
+| `required` | `(value, safe_error_code) -> value`; unit becomes the closed unavailable outcome; the code must match `[a-z][a-z0-9_]*` and be at most 64 ASCII bytes |
+| `required` code handling | The bundle-owned code is validated for shape and then discarded. It documents the reviewed script; it never reaches the public problem, audit, logs, or the raised signal, which is a host-private, unforgeable, uncatchable value |
+| `is_missing` | `value -> bool`; true only for unit |
+| `get_path` | `(value, json_pointer) -> value`; resolves one RFC 6901 pointer and returns unit when any segment resolves to nothing. Only `~0` and `~1` escapes; an array segment is a non-negative decimal integer with no leading zero. A pointer that is not resolvable syntax, exceeds 256 bytes, or exceeds 16 segments is a script fault and fails the invocation rather than answering missing |
+
+`NumericBucket` has exactly `minimumInclusive: Decimal`,
+`maximumExclusive: Decimal`, and `code: string`. `LegalLocalTime` is another
+opaque registered type. It is supplied only as
+`evaluation_context.legal_local_time`; there is no script constructor.
+
+For context, Rust supplies derivation with exactly `observed_at: Instant`,
+`legal_local_date: Date`, `legal_local_time: LegalLocalTime`, validated
+`parameters: map`, and `codelists: map<CodelistHandle>`. The authorized
+selectors are a distinct explicit derivation argument, not ambient context.
+None of those values is supplied to request preparation or extraction except
+for preparation's separately minimized selector argument.
+
+`observed_at` is always a runtime-supplied instant normalized to UTC.
+`legal_local_date` and `legal_local_time` use the requirement's validated IANA
+`observationTimezone`; when that optional field is omitted, they use UTC. A
+time-dependent definition should declare its legal timezone explicitly and
+pin boundary fixtures rather than rely on the fallback.
+
+For JSON-originating values, `type_of` tags include `"i64"`, `"f64"`,
+`"bool"`, `"string"`, `"array"`, `"map"`, and `"()"`. A script-created
+character has tag `"char"`. Ranges and `Fn` values and their construction
+paths are forbidden. The function can also return the registered names
+`"Date"`, `"Instant"`, `"LegalLocalTime"`, `"Decimal"`,
+`"EntityReferenceSeed"`, and `"CodelistHandle"`. This limited type-name
+inspection is intentionally part of the reviewed surface.
+
+No implicit conversion to string, JSON parsing, JSON serialization, regular
+expression, sorting, object merge, string splitting or joining, Unicode
+normalization, case folding, URL encoding, Base64, hashing, or cryptographic
+helper is available. Rhai does perform its existing mixed integer/float numeric
+operations. Exact legal or financial arithmetic must use the `Decimal`
+helpers. Rust performs serialization, URL encoding, authentication, signing,
+and hashing outside the script.
+
+Ordinary Rhai floats are carried only on the adapter surfaces that see
+provider-shaped JSON: request preparation and source extraction, and only when
+finite and inside the signed 64-bit magnitude. A public derived value is never
+an ordinary float. Declare an integer concept or an exact `Decimal` instead;
+a float reaching the derived-value gate fails the invocation.
+
+`parse_integer` permits leading zeroes because provider text may use them; the
+result has ordinary integer semantics. Extraction must still enforce
+provider-specific bounds such as a non-negative count. Invalid input terminates
+the invocation under the closed error class for that adapter stage.
+
+No other Rhai standard package is loaded. In particular, scripts have no:
+
+```text
+network, HTTP client, filesystem, environment, process execution, logging,
+printing, diagnostics, clock, timezone database, randomness, UUID generation,
+shared mutable state, imports, modules, eval, plugins, dynamic function
+dispatch, object reflection beyond type_of, or secrets
+```
+
+## Hard limits
+
+These engine ceilings apply independently of script logic:
+
+| Resource | Hard ceiling |
+|---|---:|
+| Script source | 65,536 bytes |
+| Operations per invocation | 100,000 |
+| Call depth | 32 |
+| Expression depth | 64 |
+| Modules | 0 |
+| String value | 16,384 bytes |
+| Array | 256 items |
+| Map | 256 entries |
+| Source-response body before projection | 1,048,576 wire JSON bytes |
+| Projected source response | 65,536 serialized JSON bytes |
+| Source-response input | 1,048,576 normalized JSON bytes |
+| Facts, parameters, or result | 65,536 normalized bytes |
+| Extracted fact entries | 64 |
+| Derived concept values | 16 |
+| Configured codelists | 256 |
+| Entries per codelist | 4,096 |
+| Numeric buckets | 64 |
+| Entity-reference seeds in one derived value | 64 |
+| `get_path` pointer | 256 bytes |
+| `get_path` pointer segments | 16 |
+| Entity-reference seed input | 512 bytes |
+| `required` error code | 64 ASCII bytes |
+| Exact decimal precision | 28 significant digits |
+| Exact decimal scale | 9 fractional digits |
+| Instant/local-time fractional precision | 9 digits |
+
+The Version 1 preparation profile adds these hard ceilings. A source may
+configure stricter `RequestParts` limits:
+
+| Resource | Hard ceiling |
+|---|---:|
+| Combined normalized preparation input | 1,048,576 bytes |
+| Normalized `RequestParts` output | 65,536 bytes |
+| Query pairs | 64 |
+| Query name | 64 bytes |
+| Query value | 4,096 bytes |
+| JSON body depth | 32 |
+
+Operation exhaustion, bound violations, invalid indexing, integer errors, and
+explicit `throw` terminate the invocation. They never produce partial request
+parts or partial facts.
+
+## Errors and observability
+
+Adapter scripts use only stable, value-free signals:
+
+```text
+adapter_input_error
+source_protocol_error
+derivation_input_error
+```
+
+`source_protocol_error` is the extraction signal.
+`adapter_input_error` is the request-preparation signal.
+`derivation_input_error` rejects an
+inconsistent selector/fact/policy contract without including any input value.
+Its public collapse is deliberate: a uniquely found record whose derivation
+inputs are inconsistent returns the same `evidence_not_available` problem as
+`no_match` and `ambiguous`, so a caller cannot learn from the response that a
+record exists. The internal category stays a value-free operator diagnostic in
+audit. The `required` primitive uses another,
+host-private unavailable termination. It is an opaque Rust-owned value that
+script source cannot construct, reproduce with `throw`, or catch. The compiler
+rejects `try`/`catch`.
+
+Rust maps compilation, entry-point, input-bound, invocation, request-result,
+source-protocol, and extraction-result failures to closed internal classes.
+Selector values, source facts, response bodies, parameters, credentials,
+tokens, and raw Rhai errors must not enter HTTP problems, audit data, logs,
+metrics, traces, snapshots, panic output, or test-failure artifacts.
+
+An adapter failure after the access-attempt audit prevents credential use,
+source access, evidence construction, response protection, and disclosure as
+applicable to its pipeline position. There is no fallback request or fallback
+adapter.
+
+Tests prove that a script cannot forge the host-private
+unavailable marker, use `Fn` or an anonymous function, interpolate an opaque
+host value, or place a selector in an error, log, audit detail, metric, trace,
+snapshot, or failed-test diagnostic.
+
+## Review examples
+
+- [DHIS2 preparation](dhis2-tracker/prepare.rhai) produces ordered repeated
+  `filter` query pairs while Rust keeps the endpoint and credentials fixed.
+- [OpenCRVS preparation](opencrvs-event-search/prepare.rhai) produces one
+  bounded Event Search body.
+- [OpenCRVS extraction](opencrvs-event-search/extract.rhai) emits only a narrow
+  provider-search fact. It does not decide legal parenthood.
+- [Deployment-shaped examples](deployment-projects/README.md) show complete
+  DHIS2 adult-status and OpenCRVS adult-status, registered-parent confirmation,
+  and registered-parent identification projects using this ABI.
+
+The accepted Evidence contracts and runtime implement this API together with
+startup, negative, resource-bound, redaction, exact-request, and one-request
+transport tests.
diff --git a/products/evidence/reference/request-adapter/README.md b/products/evidence/reference/request-adapter/README.md
new file mode 100644
index 000000000..8d0d5b01f
--- /dev/null
+++ b/products/evidence/reference/request-adapter/README.md
@@ -0,0 +1,527 @@
+# Trusted request-adapter reference
+
+Status: Implemented Version 1 adopter reference
+
+This is the adopter entry point for the implemented Version 1 trusted
+request-adapter model. Source-adapter Rhai is part of the reviewed, immutable
+deployment bundle with Evidence YAML, schemas, codelists, and fixtures. Scripts
+may render bounded query pairs and one JSON body, extract closed facts, and
+derive declared values. Rust retains transport, credentials, authorization,
+validation, evidence construction, signing, and audit authority.
+
+All values in this reference are invented. It contains no live credentials,
+tokens, responses, or demo-subject identifiers.
+
+The concise colleague-review contract is
+[`ADAPTER-API.md`](ADAPTER-API.md). This README explains the design rationale
+and provider examples around that Version 1 API.
+
+## Authoring a new adapter
+
+Follow this order. Do not begin with scripts before confirming that the
+provider can satisfy the Version 1 request and cardinality boundary.
+
+1. Check the [provider prerequisites](deployment-projects/CONFIG.md#provider-prerequisites).
+   Confirm fixed-origin HTTPS access, JSON responses, bounded one-request
+   lookup, and reliable distinction among zero, one, and multiple matches.
+2. Declare each closed [selector profile](deployment-projects/CONFIG.md#selector-profiles).
+   Choose exact scalar fields, bounds, and one authorized value origin for each
+   authority path. Possessing a selector never grants authority.
+3. Declare the [source and request](deployment-projects/CONFIG.md#source),
+   including honest acquisition posture, fixed origin and method, credentials,
+   preparation limits, and the response projection Rhai is allowed to see.
+4. Write `prepare/2` using only source-required authorized selectors and closed
+   parameters. Verify exact logical query order and JSON body shape against
+   [`RequestParts`](ADAPTER-API.md#output-from-prepare).
+5. Write `extract/2` and a closed fact schema. Map provider cardinality to only
+   `match`, `no_match`, or `ambiguous`; never select a candidate or hide a
+   provider protocol inconsistency.
+6. Declare the [requirement and concepts](deployment-projects/CONFIG.md#requirements-and-concepts),
+   including legal reference frameworks, validity, timezone where time matters,
+   disclosure family, and exact Supported Value constraints.
+7. Write `derive/3`. Declare only the authorized selector fields it needs and
+   return the exact [`DerivedConceptValue`](ADAPTER-API.md#output-from-derive)
+   set. Keep requester, audience, authority, and transport logic out of it.
+8. Write sanitized [fixtures](deployment-projects/FIXTURES.md) covering positive,
+   false-as-success, boundary, no-match, ambiguity, missing data, protocol
+   failure, privacy canaries, and exact request transport.
+9. Run `evidence check --runtime <absolute-runtime-yaml>` to validate the
+   complete immutable bundle and runtime bindings.
+10. Run `evidence evaluate --runtime <absolute-runtime-yaml> --fixture
+    <bundle-relative-fixture-path>` for every referenced fixture before
+    deployment.
+11. Promote the same reviewed bundle through staging and production using
+    environment-specific runtime files and secret mounts. Follow the complete
+    [authoring and production-build workflow](deployment-projects/CONFIG.md#authoring-and-production-build-workflow).
+
+The complete projects under
+[`deployment-projects/`](deployment-projects/README.md) are maintained
+executable references, not pseudoconfiguration.
+
+Offline evaluation proves request materialization, extraction, derivation,
+output validation, Evidence construction, ephemeral signing and verification,
+and privacy expectations. It does not start HTTP, authenticate a deployment
+JWT, resolve deployment source credentials, write audit, or contact a provider.
+Use package and HTTP-path tests for those boundaries and staging for the actual
+identity, credential, private-CA, source, audit, and signing bindings.
+
+## Design conclusion
+
+Use a trusted script to render provider-specific query parameters and a JSON
+body. Do not give that script request-execution authority.
+
+```text
+validate and authorize selectors in Rust
+    -> durably accept the access-attempt audit
+    -> prepare(source_required_selectors, adapter_parameters)
+    -> validate RequestParts in Rust
+    -> resolve credentials in Rust
+    -> execute one fixed request in Rust
+    -> parse and bound the response in Rust
+    -> extract(response, adapter_parameters)
+    -> validate LookupResult in Rust
+    -> derive(facts, declared_authorized_selectors, evaluation_context)
+    -> validate minimum-disclosure values in Rust
+```
+
+Preparation and extraction use fresh script state. Extraction does not receive
+the selector bundle or the prepared request. The requirement-specific
+derivation receives only the authorized roles and fields declared by its
+closed selector-input contract so it can evaluate reviewed relational
+semantics against uniquely resolved authoritative facts.
+This supports exact parent-reference membership and other governed
+deterministic comparisons without giving the source adapter a broad candidate
+set or turning Rust into an identity matcher.
+
+This removes the growing YAML placement and interpolation vocabulary. YAML
+continues to declare fixed authority, authentication, resource limits, script
+paths, and reviewed non-secret constants. The preparation script expresses the
+provider's repeated query parameters or nested JSON shape. A new HTTP JSON API
+normally needs another reviewed script plus fixtures, not another Rust request
+operation or a larger public connector DSL.
+
+## What to learn from connector systems
+
+### Airbyte
+
+Airbyte usefully separates a requester, authentication, pagination, response
+selection, and transformation. That decomposition makes each connector concern
+reviewable and independently testable. It also demonstrates the failure mode
+of a declarative connector language: once arbitrary request and response shapes
+must be represented in YAML, request options, selectors, interpolations,
+paginators, partition routers, transformations, and custom-component escape
+hatches accumulate.
+
+Evidence should keep the component separation but not reproduce the component
+catalog. Version 1 needs exactly one evidence-data request, not streams,
+partitions, cursor state, pagination, incremental synchronization, discovery,
+or retries that create additional evidence reads.
+
+Useful references:
+
+- [Airbyte low-code CDK overview](https://docs.airbyte.com/platform/connector-development/config-based/low-code-cdk-overview)
+- [Airbyte requester](https://docs.airbyte.com/platform/connector-development/config-based/understanding-the-yaml-file/requester)
+- [Airbyte record selector](https://docs.airbyte.com/platform/connector-development/config-based/understanding-the-yaml-file/record-selector)
+- [Airbyte custom components](https://docs.airbyte.com/platform/connector-development/config-based/advanced-topics/custom-components)
+
+### n8n
+
+n8n distinguishes declarative REST nodes from programmatic nodes whose
+`execute()` method reads parameters, builds requests, performs I/O, and maps
+responses. The attractive part for Evidence is the authoring model: central
+transport defaults, separately defined credentials, and small operation-owned
+request mappings.
+
+Evidence must not copy the authority of an n8n programmatic node. The adapter
+cannot choose a URL, inject authorization, follow a response-provided next URL,
+or perform the request.
+
+Useful references:
+
+- [n8n node-building approaches](https://docs.n8n.io/connect/create-nodes/plan-your-node/choose-a-node-building-style/)
+- [n8n starter request defaults](https://github.com/n8n-io/n8n-nodes-starter/blob/master/nodes/GithubIssues/GithubIssues.node.ts)
+- [n8n operation routing](https://github.com/n8n-io/n8n-nodes-starter/blob/master/nodes/GithubIssues/resources/issue/getAll.ts)
+- [n8n credential separation](https://github.com/n8n-io/n8n-nodes-starter/blob/master/credentials/GithubIssuesApi.credentials.ts)
+
+### Vector VRL and Redpanda Connect Bloblang
+
+VRL provides the strongest execution model to copy: compile at startup, operate
+on one input, expose no host or network access, keep state local to an
+invocation, and make fallible operations explicit. Bloblang provides the best
+mapper mental model: the script constructs a new result document rather than
+mutating an external source. Evidence supplies isolated per-invocation copies;
+local nested mutation is permitted but cannot escape that invocation. Both
+systems support direct input-to-output fixture tests.
+
+Evidence must use a curated Rhai surface. General Bloblang, JavaScript, or
+Python capabilities such as environment access, files, clocks, randomness,
+plugins, counters, and network helpers are outside this adapter ABI.
+
+Useful references:
+
+- [Vector Remap Language](https://vector.dev/docs/reference/vrl/)
+- [Vector configuration unit tests](https://vector.dev/docs/reference/configuration/unit-tests/)
+- [Bloblang mapping model](https://docs.redpanda.com/connect/guides/bloblang/about/)
+- [Redpanda Connect mapping tests](https://docs.redpanda.com/connect/configuration/unit_testing/)
+
+## Version 1 ABI
+
+One reviewed source definition uses two scripts with separate inputs, entry
+points, and result validators. Each requirement has one derivation script:
+
+```text
+prepare(authorized_selectors, adapter_parameters) -> RequestParts
+extract(source_response, adapter_parameters) -> LookupResult
+derive(facts, declared_authorized_selectors, evaluation_context)
+    -> array<DerivedConceptValue>
+```
+
+`authorized_selectors` contains only complete selector profiles that Rust has
+already resolved, validated, and authorized. It has this conceptual shape:
+
+```json
+{
+  "subject": {
+    "profile": "person-demographics-v1",
+    "values": {
+      "given_name": "Synthetic",
+      "family_name": "Subject",
+      "birth_date": "2000-02-29"
+    }
+  }
+}
+```
+
+`adapter_parameters` is trusted, non-secret, startup-only data. It contains
+provider field identifiers, fixed program or event identifiers, fixed
+projection declarations, and other constants needed by both directions of the
+adapter. It contains no credentials or runtime authorization context. A closed
+schema validates its exact keys, types, and bounds at startup.
+
+Each source also declares closed `selectorInputs`: permitted roles, profiles,
+and fields, but no query/body placements. Rust intersects that declaration
+with the already-authorized request and passes only the fields required by the
+selected adapter profile. The script never receives the complete Evidence
+request or surplus authorized selector fields.
+
+The derivation has its own closed `selectorInputs`, independent of source
+request inputs. This distinction lets a source request resolve a child record
+using the child's reference while derivation receives only the candidate
+parent reference needed to compare with the complete parent-reference set. The
+candidate reference need not be sent to the source, and the child selector
+need not be exposed to derivation.
+
+`RequestParts` is a closed result:
+
+```text
+RequestParts {
+  query: ordered list of {name: string, value: string},
+  body: null or one JSON value
+}
+```
+
+The ordered query-pair list is intentional. It preserves repeated parameters
+such as DHIS2 `filter` without inventing map-to-array encoding rules.
+
+Rust rejects every other result member, including:
+
+```text
+url, origin, path, method, headers, credentials, authentication,
+timeout, redirect, retry, pagination, next_request, source
+```
+
+Rust also rejects empty query names, CR or LF, unsupported Rhai values,
+non-finite numbers, excessive nesting, excessive collections, too many query
+pairs, and an oversized normalized request. Query names and values remain
+logical raw strings; Rust percent-encodes both exactly once while preserving
+pair order and repetition.
+
+## Script capability surface
+
+Trusting the deployment bundle changes the review model, not the execution
+boundary. Preparation needs a small additional set of deterministic language
+operations so that provider request formats can be expressed without growing a
+second YAML interpolation language:
+
+- bounded string concatenation;
+- bounded literal replacement for provider-specific escaping;
+- bounded array construction and append;
+- map construction, indexing, membership, and length;
+- integer arithmetic and integer, string, and exact JSON-type comparisons;
+- local functions within the same startup-compiled script.
+
+The preparation engine still exposes no environment, filesystem, network,
+logger, clock, randomness, dynamic evaluation, imports, modules, plugins, or
+credential handles. Rust applies global operation, call-depth, expression-
+depth, string, array, map, input, and output limits independently of any checks
+written in the script.
+
+Version 1 permits statically named same-file helper functions but forbids
+function pointers, data-derived
+dispatch, anonymous functions, closures, interpolated strings, raw string
+literals, and block or `if` expressions in operand position. It should
+not enable Rhai's full standard package.
+
+## Rust-owned request policy
+
+The source definition still fixes:
+
+- HTTPS origin;
+- HTTP method;
+- normalized path;
+- whether a query and/or JSON body is permitted;
+- generic Basic, static Bearer, or OAuth client-credentials authentication;
+- permitted content type and core-owned headers;
+- one evidence-data request;
+- denied redirects;
+- timeout;
+- maximum response bytes;
+- per-source concurrency;
+- acquisition posture;
+- adapter script and parameters.
+
+The trusted script owns provider semantics inside the permitted query/body. A
+generic runtime cannot know that `pageSize`, `limit`, or a provider-specific
+filter means what the provider documents. That guarantee comes from the
+reviewed adapter, exact request fixtures, and mock contract, just as it comes
+from reviewed fixed YAML today. Rust still enforces the bounds it can know:
+one request, no page traversal, fixed transport authority, bounded output, and
+bounded response parsing.
+
+## Reference layouts
+
+The paired references use the same Version 1 ABI:
+
+```text
+dhis2-tracker/
+  source.yaml
+  prepare.rhai
+  extract.rhai
+  parameters.schema.yaml
+  facts.schema.yaml
+  prepare-input.json
+  expected-request-parts.json
+  response-match.json
+  response-malformed-count.json
+  expected-lookup-result.json
+
+opencrvs-event-search/
+  source.yaml
+  prepare.rhai
+  extract.rhai
+  parameters.schema.yaml
+  facts.schema.yaml
+  prepare-input.json
+  expected-request-parts.json
+  response-match.json
+  response-malformed-count.json
+  expected-lookup-result.json
+```
+
+Each `response-malformed-count.json` is a negative fixture. Its fractional
+provider count must produce `source_protocol_error`, never `match` or
+`ambiguous`.
+
+The focused source YAML files are small conformance fragments rather than full
+deployment bundles. `selectorInputs` is the placement-free Version 1 source
+input contract. The configuration and executable fixture vocabularies are defined in
+[`deployment-projects/CONFIG.md`](deployment-projects/CONFIG.md) and
+[`deployment-projects/FIXTURES.md`](deployment-projects/FIXTURES.md).
+
+## DHIS2 reference
+
+The DHIS2 example exercises the collection endpoint rather than a dynamic URL.
+The preparation script supports two closed, separately authorized profiles:
+
+- one tracked-entity UID rendered as `trackedEntities`;
+- one compound selector rendered as repeated exact attribute `filter` pairs.
+
+The example fixes the program, organisation-unit boundary, field projection,
+page one, and a page size of two. Rust sends one request and never follows a
+page. The extraction script interprets `pager`, `trackedEntities`, and nested
+attributes, returning only `no_match`, `ambiguous`, or one status fact.
+
+The provider, not Evidence, evaluates the attribute filters. The script does
+not compare returned candidates to the selector values.
+
+DHIS2 documents the tracked-entity collection, attribute filters, `fields`, and
+pagination in the [Tracker API 2.43](https://docs.dhis2.org/en/develop/using-the-api/dhis-core-version-243/tracker.html).
+
+## OpenCRVS reference
+
+The deployment-shaped OpenCRVS project uses a uniquely resolved registered
+birth event as an authoritative record. It demonstrates three independent
+requirements:
+
+- adult status from the event date;
+- whether a separately authorized candidate reference is one of the complete
+  registered-parent references on that event; and
+- the bounded set of registered parents as audience-scoped entity references.
+
+Preparation sends only the child's configured tracking ID. Extraction
+validates zero, one, or ambiguous event cardinality and
+returns only the facts required by the selected source. For the relationship
+source those facts are a complete bounded parent-reference set. The
+relationship derivation declares the child reference for returned-record
+binding and the candidate-parent reference for exact membership. The
+identification derivation converts each raw source
+reference to an opaque `EntityReferenceSeed`; Rust then produces
+audience-scoped references. Raw parent references do not leave the evaluation
+pipeline.
+
+The fact schema also requires `relationship_set_complete: true`, an exact
+reference namespace, and a versioned relationship-set contract identifier.
+Derivation validates all three before it can return `false` or emit parent
+references. Bundle review must establish that absence of each configured
+parent slot means authoritatively absent, rather than omitted or unavailable.
+
+OpenCRVS event declarations are country-configured. The example parameterizes
+the exact declaration field identifiers that hold stable parent references.
+An operator must replace those illustrative field identifiers with fields
+whose uniqueness, namespace, completeness, and parent-role meaning are
+governed for that deployment. If the country configuration contains only
+names and dates, it may use a separately reviewed deterministic attribute rule
+and an accurately named concept, or it may expose a governed decision facade.
+Evidence must not silently treat a fuzzy search hit as legal parentage.
+
+The reference deliberately calls the portable assertion
+`registered-parent-relationship`. A jurisdiction may rename it to
+`legal-parent-relationship` only when its law and data governance establish
+that the configured record fields and exact matching rule carry that meaning.
+Similarly, `registered parent` does not silently mean biological parent,
+guardian, or current parental responsibility.
+
+Primary implementation references:
+
+- [OpenCRVS SearchQuery schema](https://github.com/opencrvs/opencrvs-core/blob/ff6a21ae39d16cc113714346ccf73bb76a23e2fb/packages/commons/src/events/EventIndex.ts)
+- [OpenCRVS Event Search route](https://github.com/opencrvs/opencrvs-core/blob/ff6a21ae39d16cc113714346ccf73bb76a23e2fb/packages/events/src/router/event/index.ts)
+- [Farajaland birth advanced-search configuration](https://github.com/opencrvs/opencrvs-farajaland/blob/4865495d28e3a62d8ee979503fb8139b41439c2c/src/events/birth/advancedSearch.ts)
+- [OpenCRVS client query construction](https://github.com/opencrvs/opencrvs-core/blob/ff6a21ae39d16cc113714346ccf73bb76a23e2fb/packages/client/src/v2-events/features/events/Search/utils.ts)
+
+A signed negative is valid only after the child event was uniquely resolved,
+the configured parent-reference fields were present and complete, and exact
+membership returned false. Zero events, multiple events, absent relationship
+fields, malformed declaration data, or a source that does not guarantee a
+complete parent set stop before derivation. They never become `false`.
+
+OpenCRVS Event Search currently returns an EventIndex result that can include a
+broader country-configured declaration. The reference's extended JSON Pointer
+projection is client-side pruning before Rhai, not provider-side field
+selection. The broader record therefore crosses the wire and enters bounded
+JSON parsing even when extraction receives only the event date or two parent
+references. This is honest `record-transformed` compatibility, not
+field-projected acquisition. A governed decision endpoint or provider-side
+result projection is preferable where available.
+
+The reference bootstraps its client credentials in the token request body,
+which the provider accepts and which RFC 6749 section 2.3.1 requires. No
+credential reaches the token URL, so upstream URL logs, proxies, and tracing
+have nothing to capture. This placement applies only to the token request;
+Rust sends the resulting access token to `/events/search` in the
+`Authorization: Bearer` header. The provider's own token response returns no
+`expires_in`, so the bundle states `assumedLifetimeSeconds` and the cache
+stays clamped to `maximumCacheSeconds`. External provider logging remains a
+deployment risk that this adapter design cannot eliminate.
+
+For the simpler adult-status compatibility case, the same preparation ABI can
+render the already tested tracking-ID request:
+
+```json
+{
+  "query": {
+    "type": "and",
+    "clauses": [
+      {
+        "eventType": "birth",
+        "status": {"type": "exact", "term": "REGISTERED"},
+        "trackingId": {"type": "exact", "term": "<authorized selector>"}
+      }
+    ]
+  },
+  "limit": 2,
+  "offset": 0
+}
+```
+
+The full deployment-shaped configuration and scripts are under
+[`deployment-projects/opencrvs-family-evidence/`](deployment-projects/opencrvs-family-evidence/).
+
+## Required adapter tests
+
+Every preparation adapter should have tests in these groups.
+
+### Startup contract
+
+- The script compiles at startup.
+- `prepare`, `extract`, and `derive` exist with the approved arities.
+- The bundle contract version selects the supported adapter ABI; a source does
+  not declare an independent version unless coexistence is later required.
+- Parameters and result schemas are closed.
+- Function pointers, anonymous functions, closures, interpolated strings, raw
+  string literals, block or `if` expressions in operand position, and top-level
+  executable statements are rejected.
+
+### Exact preparation fixtures
+
+- Sanitized ordinary and hostile-character inputs map structurally to their
+  normalized `RequestParts` fixtures.
+- Repeated query keys and order are preserved.
+- Object-member order and fixture whitespace are ignored; query-pair order is
+  significant.
+- The same input produces byte-equivalent normalized transport output
+  repeatedly.
+- Missing or unknown roles, profiles, fields, or parameters fail closed.
+- No failure includes a selector value.
+
+### Output boundary
+
+- URL, path, method, header, credential, retry, or next-request members fail.
+- Excessive depth, string size, collection size, query-pair count, and body
+  size fail.
+- Unsupported or non-JSON values fail.
+- A preparation failure occurs after the durable access-attempt audit but
+  before credential acquisition and source access.
+
+### Encoding and injection
+
+- `&`, `=`, `%`, `+`, `/`, `:`, `,`, Unicode, empty strings, and CR/LF are
+  covered.
+- Rust percent-encodes every query name and value exactly once.
+- Selector content cannot change origin, path, method, headers, or the number
+  of requests.
+- Credential fields cannot be overwritten through query or body data.
+
+### Execution and extraction
+
+- Exactly one request reaches the sanitized mock.
+- Redirect, timeout, response-size, and concurrency limits remain Rust-owned.
+- Zero, one, two, and provider totals above two map safely.
+- No second page or response-provided URL is followed.
+- Malformed envelopes, wrong container types, fractional counts, integers
+  outside the signed 64-bit range, and count inconsistencies fail as
+  `source_protocol_error` or before script invocation, as specified.
+- Facts exist only on a unique match.
+- Relationship negatives require schema-validated completeness, namespace, and
+  relationship-set contract facts; missing or mismatched facts stop without a
+  signed boolean.
+
+### Privacy and resource bounds
+
+- Preparation receives no credentials, requester identity, authority object,
+  audit handle, logger, filesystem, environment, clock, randomness, or network.
+- Extraction receives no selectors or prepared request.
+- Derivation receives only validated facts, its declared authorized selector
+  inputs, and the closed evaluation context.
+- A derivation cannot access an authorized role or field omitted from its
+  `selectorInputs` declaration.
+- Every invocation has fresh state.
+- Operation, call-depth, collection, string, and output limits terminate
+  expensive scripts with a safe typed error.
+- No test failure artifact prints raw selectors, source facts, credentials, or
+  tokens.
+
+Deployment-specific decisions remain bundle review inputs rather than open ABI
+questions. In particular, operators must identify the exact provider fields
+that carry stable and complete relationship references, document their legal
+meaning, and encode that agreement in source parameters, the fact schema,
+requirement parameters, and fixtures.
diff --git a/products/evidence/reference/request-adapter/deployment-projects/CONFIG.md b/products/evidence/reference/request-adapter/deployment-projects/CONFIG.md
new file mode 100644
index 000000000..38c768abf
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/CONFIG.md
@@ -0,0 +1,690 @@
+# Evidence Version 1 configuration reference
+
+Status: Implemented Version 1 configuration contract
+
+Evidence starts from two closed, startup-only inputs:
+
+1. `bundle/evidence.yaml` and its referenced bundle files define governed
+   evidence semantics and source authority.
+2. `runtime.yaml` binds that bundle to one process, filesystem, listener, audit
+   destination, secret mount, and local TLS trust files.
+
+Both inputs are reviewed, validated completely before readiness, mounted
+read-only, and immutable for the process lifetime. Evidence computes stable
+bundle and runtime revisions at startup; audit events carry the governed bundle
+revision. Runtime configuration is not an override layer. It cannot
+change a source origin, request, credential kind, requirement, authority,
+selector, disclosure rule, rate limit, signing policy, or audit fail-closed
+policy.
+
+Unknown keys are rejected at every level. All names below are exact and
+case-sensitive unless the field explicitly says otherwise.
+
+## What an adopter normally edits
+
+Most adopters should need to edit only:
+
+- deployment URIs, hosts, identifiers, purposes, authority tags, and selector
+  field names in `evidence.yaml`;
+- one small preparation script and one extraction script per distinct provider
+  request/response shape;
+- one derivation script per requirement;
+- the closed parameter and fact schemas beside those scripts;
+- sanitized fixtures;
+- process-local paths and listener settings in `runtime.yaml`; and
+- secret and private-CA files outside the project.
+
+Changing Rust, defining a source-product plugin, or adding a product-specific
+configuration variant is not part of ordinary adoption.
+
+## Provider prerequisites
+
+Decide compatibility before authoring scripts. A Version 1 provider must:
+
+- expose one bounded lookup at one fixed origin over HTTPS, except numeric
+  loopback HTTP used only by deterministic local tests;
+- accept one fixed `GET` or `POST` and return JSON with media type
+  `application/json` or `application/graphql-response+json`;
+- let one response distinguish zero, one, and multiple matches, either through
+  a trustworthy total count plus at most one minimized result, or through a
+  caller-controlled hard result limit of at least two;
+- not require page traversal, a response-provided next URL, a retry, or a
+  second evidence-data request to establish uniqueness;
+- support a query/body/path lookup narrow enough that Evidence does not fetch
+  a broad candidate set; and
+- provide the complete facts and relationship-set completeness needed by the
+  requirement, or expose a governed intermediary that does.
+
+An unbounded array without a trustworthy count or hard result limit is not
+adaptable in Version 1. Neither is a provider that requires broad retrieval and
+local candidate selection. Use or build a governed bounded-lookup facade
+outside Evidence rather than weakening the one-request and no-matcher boundary.
+
+The hard result limit itself is governed adapter policy. Its value, such as
+`resultLimit: 2` in the source's `adapterParameters`, is declared by the
+reviewed source configuration and rendered into the request by that source's
+preparation script. Rust enforces the generic one-request, projection, and
+response bounds around it and holds no domain rule about a two-result ceiling.
+The number is not a property of any source product; a different reviewed
+configuration may declare a different limit as long as one response still
+distinguishes zero, one, and multiple matches.
+
+## Governed bundle
+
+The governed file is `bundle/evidence.yaml`.
+
+### Top-level sections
+
+| Key | Required | Meaning |
+|---|---|---|
+| `version` | yes | Bundle schema version. Version 1 requires integer `1`. |
+| `assuranceProfile` | yes | Explicitly `local`, `production`, or `evidence-grade`. Runtime configuration cannot override it. |
+| `service` | yes | Evidence provider identity and trust domain. |
+| `issuer` | yes | Issuer identity placed in evidence. |
+| `authentication` | yes | Closed inbound OIDC access-token verification policy. |
+| `audit` | yes | Audit format, pseudonymization key reference/version, and fail-closed policy. Storage location is runtime-owned. |
+| `subjectBinding` | yes | Audience-scoped subject-binding key reference/version. |
+| `rateLimits` | yes | Governed anti-enumeration and request limits. |
+| `signing` | yes | Evidence/JWS format, algorithm, key references, validity, JWKS path, and rollover policy. |
+| `responseFormats` | no | Response formats the whole deployment permits. Omission means `[signed-jws]`. Declare it explicitly in production bundles. |
+| `selectorProfiles` | yes | Closed caller/grant/context selector shapes. |
+| `sources` | yes | Fixed source authorities, transport policy, scripts, schemas, and bounds. |
+| `authorityProfiles` | yes | Who may request which requirement, purpose, audience, roles, profiles, and value origins. |
+| `requirements` | yes | Evidence semantics, source, derivation, concepts, fixtures, and disclosure family. |
+
+`local` is an authoring profile. A local requirement may omit `fixtures` while
+the provider contract is still being written. This does not disable any other
+runtime boundary: the bundle and runtime remain immutable, inbound
+authentication and authorization remain required, source requests remain fixed
+and bounded, signing and both audit gates remain fail-closed, and assertions
+are visibly marked `local`. Local Mint may use only the exact canonical issuer origin
+`http://127.0.0.1:<non-zero-port>` and the same origin's
+`/.well-known/jwks.json`; other authentication URLs remain HTTPS.
+
+`production` and `evidence-grade` are deployable profiles. Every requirement
+must reference a fixture suite, and the existing complete coverage validation
+must pass before the bundle loads. No receipt, certification command, build
+artifact, or alternate evaluator is introduced by the assurance profile.
+
+### Service, issuer, and inbound authentication
+
+| Section or key | Required | Meaning |
+|---|---|---|
+| `service.providerId` | yes | Technical Evidence provider URI placed in evidence. |
+| `service.trustDomain` | yes | One operator-controlled trust-domain URI for the process. |
+| `issuer.id` | yes | Legal issuer URI placed in evidence. Governance must authorize the provider to act for it. |
+| `authentication.kind` | yes | Exactly `oidc-access-token`. |
+| `authentication.issuer`, `authentication.jwksUri` | yes | Exact HTTPS token issuer and JWKS endpoint. Path-based issuers are supported. The fixed JWKS endpoint may resolve to a public or private HTTPS address; DNS is pinned for each fetch, ambient proxies are disabled, and cloud-metadata destinations remain prohibited. |
+| `authentication.audiences` | yes | Non-empty exact audience allowlist. |
+| `authentication.tokenTypes` | yes | Non-empty allowlist containing only `at+jwt` and/or `application/at+jwt`. |
+| `authentication.algorithms` | yes | Non-empty allowlist containing only `EdDSA`, `ES256`, and/or `RS256`. No algorithm fallback is permitted. |
+| `authentication.principalClaim` | yes | The only claim used for the principal. Its absence denies; `client_id`, `azp`, request data, and proxy headers are not fallbacks. |
+| `authentication.requesterTagsClaim` | yes | Claim containing the requester tags matched against an authority profile. |
+| `authentication.evidenceAudienceClaim` | yes | Claim containing the exact evidence audience. The public request cannot choose another audience. |
+| `authentication.grantIdClaim`, `authentication.grantAuthorityClaim` | yes | Claims used only when an `authenticated-grant` origin is selected. The authority must equal the matched authority-profile id. |
+| `authentication.actorClaim` | no | Optional verified actor claim. Omission does not enable a fallback actor source. |
+
+### Audit, subject binding, rates, and signing
+
+| Section | Required fields and rule |
+|---|---|
+| `audit` | `format: keyed-jsonl`, file-only `hashSecretRef`, positive `hashKeyVersion`, and `failClosed: true`. The referenced file contains at least 32 raw secret bytes. The runtime file owns storage location. |
+| `subjectBinding` | File-only `secretRef` and positive `keyVersion`. The referenced file contains at least 32 raw secret bytes. Rust derives audience-and-purpose-scoped bindings over the complete canonical role/profile/value bundle, never per-field hashes. |
+| `rateLimits` | Positive `requestsPerPrincipalPerMinute`, `burstPerPrincipal`, and `failedSelectorAttemptsPerPrincipalAuthorityPerMinute`. Raw selector values never become rate-limit labels. |
+| `signing` | Exact keys are `format: flattened-jws-json`, `algorithm: EdDSA`, `activeKeyId`, file-only `activeKeyRef`, `retiredPublicJwkFiles`, fixed `jwksPath`, `maximumAssertionValiditySeconds`, and `verifierClockSkewSeconds`. Missing signing material fails readiness; there is no unsigned fallback. |
+| `responseFormats` | Closed unique list of 1 through 3 entries drawn from `signed-jws`, `unsigned-json`, and `sd-jwt-vc`. `signed-jws` must always be present; a bundle that omits it is rejected at startup. Every other format additionally requires the matched grant to permit it, and signing material must still be ready even for an unsigned response. |
+
+### Selector profiles
+
+Each `selectorProfiles.<id>` declares `maximumAggregateBytes` and one exact
+`fields` map of 1 through 16 deployment-defined fields. Field names are opaque
+to Rust. A profile is not an identity type and possession of its values is not
+authority.
+
+| Field type | Required declaration |
+|---|---|
+| `string` | `minimumBytes`, `maximumBytes` |
+| `date` | Canonical `YYYY-MM-DD` |
+| `integer` | Inclusive `minimum`, `maximum` within the safe integer bound |
+| `boolean` | No additional keys |
+| `controlled-code` | `codelist`, `codelistVersion`, `maximumBytes` |
+
+Alternative sufficient field sets and sets with an extra disambiguator are
+different named profiles. Rust does no case folding, Unicode normalization,
+transliteration, phonetics, tokenization, name-order parsing, partial-date
+matching, fuzzy scoring, or candidate selection.
+
+### Authority profiles
+
+An authority profile has a `kind` of `statutory`, `organizational`, `consent`,
+`delegated`, or `explicit-request`, non-empty `requesterTags`, and grants.
+Each grant binds one exact `requirement`, `purpose`,
+`audienceFrom: authenticated-requester`, an optional `responseFormats` list,
+and the complete subject-role set. A grant's `responseFormats` follows the same
+closed rule as the bundle-level list: 1 through 3 unique entries that must
+include `signed-jws`, defaulting to `[signed-jws]` when omitted. Unsigned output
+and the SD-JWT VC serialization each require both the bundle and the one
+complete matched grant to permit them, so a production grant that says nothing
+permits only signed JWS.
+Every grant subject fixes `role`, `selectorProfile`, and one `valueOrigin`:
+
+- `request` requires values in the closed public request and prohibits
+  `valueClaims`;
+- `authenticated-context` requires an exact field-to-verified-claim
+  `valueClaims` map and rejects caller values; and
+- `authenticated-grant` requires the same exact map, rejects caller values,
+  and additionally requires the configured grant id and grant authority. The
+  authenticated authority value must equal the matched authority-profile id.
+
+Claim paths are resolved only from the strictly verified access token. A
+caller-supplied grant reference, selector, consent reference, or approval value
+cannot create authority. The runtime authorizes the principal, optional actor,
+requirement revision, purpose, audience, authority profile, and every
+role/profile/origin tuple as one decision before credentials or source access.
+
+A profile matches only when every tag in its `requesterTags` is present in the
+verified claim, so adding a tag narrows the profile. Access is per requester
+class rather than per client identity: two clients carrying the same tags have
+the same access, and differentiated requirements, purposes, or `valueClaims`
+are expressed by issuing different tags. To bind purpose to the token issuer
+instead of the caller's choice, give each purpose its own tag and its own
+profile. Exactly one authority path may match a request; two profiles covering
+the same requirement, purpose, and subject tuple are denied at request time and
+are not rejected at startup.
+
+### Requirements and concepts
+
+Each requirement declares these fields:
+
+| Key | Required | Meaning |
+|---|---|---|
+| `id`, `kind` | yes | Stable requirement URI and one of `criterion`, `information-requirement`, or `constraint`. |
+| `source` | yes | One configured source id. Version 1 does not perform multi-source fulfillment. |
+| `purposes` | yes | Closed purpose codes that authority grants may select. |
+| `subjectRoles` | yes | Complete role set, `cardinality: one`, and permitted selector profile ids. Public subject array order is not semantic; roles are resolved uniquely and canonicalized to declaration order. |
+| `referenceFrameworks`, `evidenceType` | yes | Governed legal/procedural framework URIs and the exact Evidence Type URI. |
+| `observationTimezone` | no | Valid IANA timezone used for `legal_local_date` and `legal_local_time`. Omission uses UTC. Declare it explicitly whenever local legal time can affect a result. |
+| `validitySeconds` | yes | Positive assertion lifetime no greater than the signing maximum. |
+| `derivation` | yes | Script, optional minimized `selectorInputs`, and closed typed parameters. |
+| `concepts` | yes | 1 through 16 exact outputs, each with `id`, `form`, `required`, and closed form-specific `constraints`. |
+| `fixtures` | conditional | Bundle-relative sanitized project fixture referenced by exactly one requirement. It may be omitted only under `assuranceProfile: local`; production and evidence-grade require it and complete coverage. |
+| `disclosureGuard.families` | yes | Non-empty reviewed disclosure-family URI set. Reuse across enabled requirements is rejected; distinct labels still require human combined-disclosure review. |
+| `existenceDisclosure` | yes | Exactly `collapse-unresolved` in Version 1. |
+
+Supported concept forms are `boolean`, `controlled-code`,
+`controlled-category`, `bounded-integer`, `bounded-decimal`, `date-bucket`,
+`time-bucket`, `audience-scoped-entity-reference`, `controlled-code-list`,
+`entity-reference-list`, and `reviewed-structured-value`. Constraint keys use
+bundle camelCase, including `codelistVersion`, `maximumBytes`, `categoryScheme`,
+`schemeVersion`, `maximumScale`, `bucketScheme`, `minimumItems`, `maximumItems`,
+`maximumSerializedBytes`, and `unique`, with the exact set determined by the
+selected form. Codelist declarations and reviewed structured schemas are
+bundle-relative, closed, versioned artifacts validated at startup.
+
+`observed_at` is a runtime-supplied instant normalized to UTC. Rust resolves
+the legal local date and time from `observationTimezone`; without the optional
+field it uses UTC. Fixtures supply only `observed_at`, never derived local
+values, so timezone boundary behavior uses the production path.
+
+Derivation parameters are limited to bounded strings, safe integers, booleans,
+typed canonical decimals shaped as `{type: decimal, value: "..."}`, and arrays
+of typed decimal bucket boundaries. Adapter parameters use their separately
+closed JSON Schema and the narrower conversion described in
+[`ADAPTER-API.md`](../ADAPTER-API.md#inputs). Neither parameter map may contain
+secrets or runtime authority.
+
+### Source
+
+```yaml
+sources:
+  source-a:
+    transport: http-json
+    baseUrl: https://registry.gov.example
+    posture: record-transformed
+    tlsTrustProfile: government-internal-pki
+    authentication:
+      kind: static-bearer
+      tokenRef: secret:file/source-token
+    request: {}
+    responseSchema: schemas/source-a-response.schema.yaml
+    extractScript: adapters/source-a-extract.rhai
+    factSchema: schemas/source-a-facts.schema.yaml
+```
+
+| Key | Required | Meaning |
+|---|---|---|
+| `transport` | yes | Exactly `http-json` in Version 1. |
+| `baseUrl` | yes | Fixed HTTPS origin, except for the `kind: none` local loopback boundary below. No path, query, fragment, user information, wildcard, or runtime substitution. |
+| `posture` | yes | `source-derived`, `field-projected`, or `record-transformed`, describing what crosses the source wire. |
+| `tlsTrustProfile` | no | Logical profile name bound by `runtime.yaml`. Omission uses configured system roots only. |
+| `authentication` | yes | One closed source-authentication profile below. `kind: none` is restricted to explicit local authoring at a numeric-loopback origin. |
+| `request` | yes | One fixed evidence-data request plan. |
+| `responseSchema` | yes | Bundle-relative closed JSON Schema for the projected source response. Checked before `extract/2` runs. |
+| `extractScript` | yes | Bundle-relative Rhai script implementing `extract/2`. |
+| `factSchema` | yes | Bundle-relative closed JSON Schema for match facts. |
+
+`responseSchema` states the shape the adapter was reviewed against, so the
+script never has to prove it by hand. A response outside that shape is a
+source-protocol failure and no script runs. Two rules differ from the fact and
+adapter-parameter roles, because the projected tree is not the wire response:
+
+- A response schema may require fewer members than it declares properties.
+  Projection drops a selected leaf the record did not carry, and a page decided
+  ambiguous is never read record by record, so a record on that page need not
+  be complete.
+- A response schema node may write its type as the pair `[T, "null"]`. A source
+  that reports an explicit null where it holds no value has that null carried
+  through projection verbatim; the script reads it with `is_missing`, exactly as
+  it reads an absent leaf. This is the only union the subset admits.
+
+What stays with the script is what a shape cannot state: how a reported total
+agrees with the records returned, page-count arithmetic, uniqueness across
+fields, and which values must agree with the closed adapter parameters.
+
+### Source authentication
+
+All secret references are logical. Rust resolves them only after authorization,
+durable access audit, and complete request-parts validation. No secret is passed
+to Rhai.
+
+```yaml
+# No outbound credential, for local authoring only
+authentication:
+  kind: none
+
+# HTTP Basic
+authentication:
+  kind: basic
+  usernameRef: secret:file/source-username
+  passwordRef: secret:file/source-password
+
+# Authorization: Bearer <secret>
+authentication:
+  kind: static-bearer
+  tokenRef: secret:file/source-token
+
+# A provider-specific API-key header
+authentication:
+  kind: static-api-key
+  headerName: X-API-Key
+  valueRef: secret:file/source-api-key
+
+# OAuth 2.0 client credentials
+authentication:
+  kind: oauth2-client-credentials
+  tokenEndpoint: https://auth.registry.gov.example/token
+  clientIdRef: secret:file/source-client-id
+  clientSecretRef: secret:file/source-client-secret
+  scope: recordsearch
+  credentialPlacement: basic-header
+  maximumCacheSeconds: 300
+```
+
+`kind: none` is accepted only when the bundle declares
+`assuranceProfile: local` and `baseUrl` is an exact canonical
+`http://<numeric-loopback>:<non-zero-port>` origin. It accepts no other
+members, cannot use `tlsTrustProfile`, and sends no `Authorization` or other
+authentication header. Hostnames such as `localhost`, omitted or noncanonical
+ports, user information, paths, queries, fragments, HTTPS origins, and
+non-loopback addresses are rejected. Production and evidence-grade bundles
+reject this kind.
+
+`static-api-key.headerName` cannot be `Authorization`, `Host`, `Cookie`,
+`Set-Cookie`, `Content-Length`, `Content-Type`, `Transfer-Encoding`, a
+hop-by-hop header, forwarding/proxy header, or tracing header. Names are
+validated as HTTP field names. Secret values are bounded and reject controls,
+CR, and LF.
+
+OAuth `credentialPlacement` is one of `basic-header` or `form-body`. RFC 6749
+section 2.3.1 requires the client identifier and secret to travel in the
+Authorization header or the request body and never in the request URI, so
+Version 1 offers no query-string placement and no credential can reach a token
+URL log. Token redirects are denied and token responses are bounded. The token
+request is credential bootstrap, not a second evidence-data lookup.
+
+Secret files are byte strings, not base64 fields. Do not base64-encode the
+audit or subject-binding key unless those encoded ASCII bytes are intentionally
+the key. Generate independent random values of at least 32 bytes and store the
+raw bytes in their owner-only files. Source usernames, passwords, tokens,
+client ids, and client secrets use their provider-defined lexical form and the
+runtime's generic secret bounds.
+
+For inbound access tokens, `tokenTypes: [at+jwt]` requires a protected JWT
+header with `typ: at+jwt`; `application/at+jwt` requires that exact alternative.
+A sanitized shape for the reference projects is:
+
+```json
+{"alg":"EdDSA","kid":"deployment-key-id","typ":"at+jwt"}
+{"iss":"https://identity.example","aud":"registry-evidence","exp":2000000000,"sub":"service-client","evidence_tags":["approved-requester"],"evidence_audience":"https://consumer.example"}
+```
+
+These are decoded shapes, not usable tokens. The configured issuer, audience,
+algorithm, token type, principal claim, requester-tag claim, and evidence
+audience claim must all match. Grant-derived selectors additionally require
+the configured grant id and authority claims.
+
+### Request
+
+```yaml
+request:
+  method: POST
+  path: /v1/search
+  fixedHeaders:
+    - {name: Accept, value: application/fhir+json}
+    - {name: X-API-Version, value: "2026-01"}
+  selectorInputs:
+    - role: subject
+      alternatives:
+        - {profile: record-reference-v1, fields: [record_reference]}
+  prepareScript: adapters/source-a-prepare.rhai
+  adapterParameters: {resultLimit: 2}
+  adapterParametersSchema: schemas/source-a-parameters.schema.yaml
+  preparationLimits:
+    query: forbidden
+    jsonBody: required
+    maximumJsonDepth: 12
+    maximumCollectionItems: 32
+    maximumStringBytes: 512
+    maximumNormalizedBytes: 8192
+  projection:
+    - /total
+    - /results/*/status
+  redirects: deny
+  timeoutMilliseconds: 3000
+  maximumResponseBytes: 65536
+  concurrencyLimit: 8
+```
+
+| Key | Required | Meaning |
+|---|---|---|
+| `method` | yes | Fixed `GET` or `POST`. |
+| `path` | conditional | Fixed absolute path. Exactly one of `path` or `pathTemplate` is required. |
+| `pathTemplate` | conditional | Fixed absolute path with complete-segment placeholders resolved by Rust. |
+| `pathBindings` | with template | Closed placeholder-to-selector bindings. |
+| `fixedHeaders` | no | Ordered non-secret constants. Names are unique after ASCII case folding. |
+| `selectorInputs` | yes | Exact minimized authorized selector alternatives visible to `prepare`. |
+| `prepareScript` | yes | Bundle-relative Rhai script implementing `prepare/2`. |
+| `adapterParameters` | yes | Closed non-secret JSON parameters shared by preparation and extraction. `{}` is valid. |
+| `adapterParametersSchema` | yes | Closed bundle-relative JSON Schema for those parameters. |
+| `preparationLimits` | yes | Per-channel policy and stricter output bounds. |
+| `projection` | yes | Non-empty Rust-enforced response allowlist defined by `ADAPTER-API.md`. |
+| `redirects` | yes | Exactly `deny` in Version 1. |
+| `timeoutMilliseconds` | yes | Positive source-request timeout within the global ceiling. |
+| `maximumResponseBytes` | yes | Positive pre-projection response limit within the global ceiling. |
+| `concurrencyLimit` | yes | Positive per-source request concurrency limit. |
+
+Fixed headers cannot set authentication, host/routing, cookies, body framing,
+content length/type, connection, forwarding, proxy, or tracing headers. Rust
+sets `Content-Type: application/json` when a JSON body is present and owns all
+authentication headers. Scripts cannot add, remove, or change a header.
+
+Query components in `RequestParts` are lexical strings even if a provider
+interprets them as numbers or booleans. Write query constants as `"2"` and
+`"true"`. JSON body parameters retain JSON types, so body constants may be `2`
+and `true`. Rust performs no implicit conversion.
+
+### Path templates
+
+Use a path template only when the provider lacks a safe query/body lookup:
+
+```yaml
+request:
+  method: GET
+  pathTemplate: /api/records/{record_reference}
+  pathBindings:
+    record_reference:
+      role: subject
+      profile: record-reference-v1
+      field: record_reference
+```
+
+Each placeholder occupies one complete path segment and has exactly one closed
+binding. Rust reads the value directly from an already validated and authorized
+selector. Scripts do not return path values. A value must be non-empty bounded
+UTF-8 and cannot contain `/`, `\`, `%`, controls, `.` or `..`. Rust
+percent-encodes it exactly once. Templates cannot contain a scheme, authority,
+query, fragment, empty segment, or dot segment. Exact expanded-path fixtures
+are required.
+
+### Preparation limits
+
+`query` and `jsonBody` are independently `required`, `allowed`, or `forbidden`.
+The remaining keys are optional stricter limits beneath the ABI hard ceilings:
+
+- `maximumQueryPairs`
+- `maximumQueryNameBytes`
+- `maximumQueryValueBytes`
+- `maximumJsonDepth`
+- `maximumCollectionItems`
+- `maximumStringBytes`
+- `maximumNormalizedBytes`
+
+At least one output channel must be usable. `required` means non-empty. For a
+JSON body, JSON `null` is absent; an empty object or array is present.
+
+### Requirement derivation selector inputs
+
+`requirements[].derivation.selectorInputs` is optional. Omission means the
+derivation receives an empty selector map. When present, every alternative must
+be an exact subset of the selected requirement's declared subject roles and
+profiles. This is independent of `request.selectorInputs`.
+
+Rust supplies only that minimized map to `derive/3`. A relationship requirement
+can retrieve a child record with a request-derived selector while comparing a
+candidate reference obtained from an authenticated grant. The preparation
+script never sees the candidate, and the derivation never sees the child's
+lookup selector unless it explicitly declares it.
+
+## Referenced bundle artifacts
+
+All referenced paths are bundle-relative and captured in the immutable bundle
+revision. Scripts end in `.rhai`. Parameter, fact, and reviewed-value schemas
+are closed JSON Schema 2020-12 documents; fact and reviewed-value schemas close
+every reachable object and bound every reachable string, array, and number.
+Fixtures use the exact contract in [`FIXTURES.md`](FIXTURES.md).
+
+Codelists under `codelists/` use one of two closed YAML shapes:
+
+```yaml
+# Exact code set
+id: urn:gov:example:codelist:status
+version: '1'
+codes: [active, inactive]
+
+# Exact source-to-output mapping
+id: urn:gov:example:codelist:region-map
+version: '1'
+entries: {SOURCE-A: REGION-NORTH, SOURCE-B: REGION-SOUTH}
+allowed_outputs: [REGION-NORTH, REGION-SOUTH]
+```
+
+Each document has 1 through 4,096 unique bounded codes. A mapping output must
+appear in `allowed_outputs`. Referencing configuration repeats the exact
+artifact version and startup rejects a mismatch. Retired public keys live only
+under `public-keys/` as public JWK JSON files; active private key material is a
+secret and never a bundle artifact.
+
+## Runtime configuration
+
+`runtime.yaml` contains only process-local bindings:
+
+```yaml
+version: 1
+bundleDirectory: /etc/registry-evidence/bundle
+listener:
+  bindHost: 127.0.0.1
+  port: 8080
+  tlsTermination: operator-controlled-upstream
+  trustProxyIdentityHeaders: false
+  maximumRequestBytes: 65536
+  maximumConcurrentRequests: 64
+  requestTimeoutMilliseconds: 10000
+  shutdownGraceMilliseconds: 30000
+secretProviders:
+  file:
+    root: /run/secrets/registry-evidence
+auditStorage:
+  path: /var/lib/registry-evidence/audit/evidence.jsonl
+  maximumFileBytes: 1073741824
+outboundTls:
+  systemRoots: true
+  trustProfiles:
+    government-internal-pki:
+      caBundleFile: /etc/registry-evidence/ca/government-internal.pem
+```
+
+| Key | Required | Meaning and Version 1 bounds |
+|---|---|---|
+| `version` | yes | Literal integer `1`. |
+| `bundleDirectory` | yes | Absolute path to the single governed bundle directory. No alternate, overlay, or fallback bundle exists. |
+| `listener.bindHost` | yes | Numeric loopback, RFC 1918 private IPv4, or RFC 4193 unique-local IPv6 address, 2 through 64 bytes. Hostnames, public, unspecified, and multicast addresses are rejected. Production TLS terminates at the operator-controlled upstream. |
+| `listener.port` | yes | TCP port 1 through 65535. |
+| `listener.tlsTermination` | yes | Literal `operator-controlled-upstream`. |
+| `listener.trustProxyIdentityHeaders` | yes | Literal `false`; proxy headers never supply authenticated identity or authority. |
+| `listener.maximumRequestBytes` | yes | 1,024 through 1,048,576 bytes. |
+| `listener.maximumConcurrentRequests` | yes | 1 through 4,096. |
+| `listener.requestTimeoutMilliseconds` | yes | 1 through 30,000 milliseconds for admission, concurrency queueing, and request-body collection. Once protected evaluation starts, this timer does not cancel it; source and OIDC boundaries have their own bounds, and the runtime preserves fail-closed audit and release ordering. |
+| `listener.shutdownGraceMilliseconds` | yes | 1 through 120,000 milliseconds. |
+| `secretProviders.file.root` | yes | Absolute root for logical `secret:file/...` references. Only regular, non-symlink, owner-only files below this root are accepted. |
+| `auditStorage.path` | yes | Absolute keyed-JSONL audit path on operator-owned durable storage. |
+| `auditStorage.maximumFileBytes` | yes | 1,048,576 through 1,099,511,627,776 bytes. Reaching the closed bound fails audit writes and therefore fails closed. |
+| `outboundTls.systemRoots` | yes | Literal `true`. |
+| `outboundTls.trustProfiles` | yes | Closed map of at most 64 logical profile ids. It may be empty when no source names a private trust profile. |
+| `outboundTls.trustProfiles.<id>.caBundleFile` | for each profile | Absolute path to one bounded PEM CA file. Profile names must exactly match bundle `tlsTrustProfile` references. |
+
+`bundleDirectory`, secret roots, audit destinations, and CA files must be
+absolute paths. The runtime rejects symlinks, insecure ownership/modes, missing
+required logical bindings, mutable files, and files outside the configured
+roots according to the operator contract.
+
+A bundle source may name one `tlsTrustProfile`. The corresponding bounded PEM
+file is loaded and validated at startup. Hostname verification and source-origin
+checks remain mandatory. There is no `insecure`, `skipVerification`, or
+`trustAll` setting. Changing a trust file requires restart and changes the
+runtime digest.
+
+Version 1 has no application-level HTTP proxy and ignores `HTTP_PROXY`,
+`HTTPS_PROXY`, `ALL_PROXY`, and `NO_PROXY`. Deployments needing mediated egress
+use network routing or a local sidecar while preserving end-to-end source TLS
+verification. This avoids ambient environment state silently redirecting
+credentials to another authority.
+
+## Maintenance rules
+
+- Keep scripts small and provider-shaped. Extraction, not Rust, validates
+  provider count/collection consistency and maps it to the closed lookup union.
+- Reuse one script across sources when the selector role and provider shape can
+  be parameterized without adding a string expression language.
+- Do not add a declarative uniqueness or response-mapping DSL. Reviewed Rhai is
+  the escape hatch for API differences.
+- Prefer literal map/array traversal. Dots in provider keys are literal. If a
+  deployment must parameterize a nested path, pass a bounded array of literal
+  segments and implement a bounded same-file helper.
+- Keep one governed bundle per evidence policy revision and one runtime file per
+  environment. Never use environment variables or command arguments to
+  override governed fields.
+- Run every fixture before accepting either input and again before deploying a
+  changed bundle, runtime file, script, schema, codelist, CA file, or secret
+  binding.
+
+## Authoring and production-build workflow
+
+Treat an editable project like reviewed source code. `evidencectl new` creates
+empty `selectors/`, `sources/`, `adapters/`, `schemas/`, `questions/`,
+`derivations/`, and `fixtures/` directories. It creates no deployment input.
+While authoring, use only synthetic responses and selectors. Add the smallest
+provider-shaped `prepare/2`, `extract/2`, and requirement `derive/3` scripts,
+then add exact positive, legitimate-false, boundary, unresolved,
+malformed-provider, transport-failure, and privacy-canary cases.
+
+The compact local question format may omit `governance`. When it is present,
+local development uses the declared requirement semantics but retains its
+explicit local assurance and authentication. A production build requires that
+block, stable concept identifiers, and exactly one project-relative
+`fixtures/<name>.yaml` regular file for every question. It never derives or
+invents requirement, framework, Evidence Type, concept, or disclosure-family
+URIs.
+
+Create one explicit `deployment-targets/production/` directory containing
+`governance.yaml` and `runtime.yaml`. `governance.yaml` is closed, has
+`version: 1` and `assuranceProfile: production`, and supplies the existing
+bundle-shaped service, issuer, authentication, audit, subject-binding,
+rate-limit, signing, response-format, and authority-profile values. It may not
+contain selectors, sources, or requirements, which the compiler obtains from
+the editable project. It permits logical `secret:file/<name>` references only,
+never secret values or absolute secret paths. `runtime.yaml` is the ordinary
+closed runtime document; the build copies its bytes unchanged and the target
+host remains authoritative for path, owner, permission, secret, and private-CA
+validation.
+
+Run the create-only compiler with explicit target and output paths:
+
+```sh
+evidencectl build \
+  --project <editable-project> \
+  --target <editable-project>/deployment-targets/production \
+  --output <new-candidate-directory>
+```
+
+The compiler follows no authored symlink, accepts no reference outside allowed
+project directories, rejects unreferenced generated artifacts, and removes only
+its own failed private staging. It requires authenticated HTTPS sources,
+complete authority, resolved review markers, complete governance, and complete
+fixtures. It validates the unpublished bundle with private temporary secrets
+through the real `evidence` binary, runs every fixture, and publishes nothing
+on failure. It makes no identity-provider, source-data, or Mint call; opens no
+listener; and writes no production audit event. The editable project and
+`.evidence` local state remain unchanged.
+
+The candidate contains `runtime.yaml` and `bundle/`, including only referenced
+adapters, derivations, schemas, codelists, fixtures, and public keys. Given
+identical authoring files, target governance, runtime bytes, and toolset
+release, bundle bytes and revision are identical. The copied runtime is
+environment-specific and has its own revision; it is not part of the bundle
+revision or signed `configurationRevision`.
+
+After approval, transfer the exact candidate, provision independent owner-only
+secrets under the configured secret root, make bundle and runtime non-writable
+to the service identity, and run the grouped handoff once whenever candidate
+bytes, runtime bindings, trust files, or secrets change:
+
+```sh
+evidencectl doctor --project '<candidate>'
+evidencectl fixtures run --project '<candidate>'
+evidence --runtime '<candidate>/runtime.yaml' serve
+```
+
+Then route only after `/ready`, retain one authorized synthetic-subject
+response, verify it under independently prepared production policy and trusted
+keys, and verify the audit chain. A provider API or governance change produces
+a newly reviewed bundle revision and reruns the fixture matrix.
+
+When no suitable OIDC issuer exists, author Mint separately and run
+`mint check --config <mint.yaml>`. The optional
+`evidencectl doctor --project <candidate> --mint-config <mint.yaml>` check is
+read-only: it compares issuer, derived JWKS URI, audiences, allowed signing
+algorithm, `at+jwt` admission, and configured principal, requester-tag,
+evidence-audience, grant-id, grant-authority, and optional actor claim names.
+It does not infer legal basis, create authority profiles, register callers, or
+copy Mint configuration into the candidate. Mint's replay cache is memory-only
+and clears on restart; Version 1 makes no multi-instance or high-availability
+claim.
+
+Docker Compose is a documented adapter rather than build output. It mounts the
+candidate bundle unchanged and read-only; mounts a distinct container runtime,
+secrets, and persistent audit storage separately; binds Evidence privately; and
+keeps TLS and public routing operator-controlled. The Compose runtime has its
+own revision while assertions continue to carry the unchanged bundle revision.
+When Mint shares that network, retain its public HTTPS issuer and JWKS URI;
+internal plain-HTTP service names do not replace them.
+
+After those checks, publish the static token-acquisition, legal context,
+endpoint-trust, and verifier guidance for each approved consumer class using
+the workflow in
+[`OPERATOR-CONTRACT.md`](../../../OPERATOR-CONTRACT.md#discovery-of-available-evidence).
+The consumer then calls authenticated `GET /v1/evidence-definitions` and uses
+one returned complete requirement, purpose, concept, role, selector, and value
+origin shape. The endpoint does not publish the whole bundle, source internals,
+authority tags, secrets, selector values, or unrelated definitions. A change
+to an offered contract changes the returned `configurationRevision` and needs
+a coordinated rollout; clients do not infer alternatives from runtime errors.
diff --git a/products/evidence/reference/request-adapter/deployment-projects/FIXTURES.md b/products/evidence/reference/request-adapter/deployment-projects/FIXTURES.md
new file mode 100644
index 000000000..ae79b3fdb
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/FIXTURES.md
@@ -0,0 +1,218 @@
+# Evidence Version 1 project fixture contract
+
+Status: Implemented Version 1 executable fixture contract
+
+Project fixtures are sanitized inputs to the production bundle loader, script
+runtime, request materializer, source projection, output gate, evidence
+construction, signer, verifier, and privacy checks. Evaluation does not start
+the HTTP server, authenticate a JWT, write audit, resolve source credentials,
+or contact a provider. Those boundaries are covered by package and HTTP-path
+tests. Fixtures are not illustrative prose. Unknown keys, unknown mutation
+names, and an expectation the harness cannot execute fail fixture evaluation.
+
+Focused adapter directories may keep separate JSON input/output files. Complete
+deployment projects use this YAML format so an adopter can review one case
+matrix beside the requirement.
+
+A requirement may omit its fixture reference only while its immutable bundle
+declares `assuranceProfile: local`. Local serving still uses the ordinary
+authenticated, authorized, source-bounded, minimum-disclosure, signed, and
+fail-closed audit path. Production and evidence-grade bundles retain this
+document's complete fixture-coverage requirement and fail to load when a
+reference is absent or its captured suite is incomplete.
+
+For production compilation, each editable question names one regular,
+project-relative `fixtures/<name>.yaml` file. The build copies that file into
+the candidate bundle and delegates its execution to `evidence evaluate`; it
+does not reinterpret fixture semantics or manufacture cases. Missing,
+symlinked, outside-project, duplicate, or incomplete fixture references stop
+the build before publication. The build's private validation secrets and
+runtime are not fixture inputs and never appear in the candidate.
+
+## File shape
+
+```yaml
+fixture: registry.evidence.reference.example/v1
+synthetic_only: true
+common:
+  observed_at: "2026-08-02T00:00:00Z"
+  selectors: {}
+  derivationSelectorInputs: {}
+  expectedRequestParts:
+    query: []
+    body: null
+  expectedTransport:
+    path: /v1/search
+    fixedHeaders:
+      - {name: Accept, value: application/json}
+cases: []
+privacyExpectation:
+  evidenceContains: []
+  evidenceExcludes: []
+  diagnosticsExclude: []
+```
+
+| Key | Required | Meaning |
+|---|---|---|
+| `fixture` | yes | Unique fixture contract identifier ending in `/v1`. |
+| `synthetic_only` | yes | Must be literal `true`. Live values are forbidden. |
+| `common` | yes | Deterministic inputs inherited by every case. |
+| `cases` | yes | Non-empty ordered array with unique case ids. |
+| `privacyExpectation` | yes | Tokens/canaries that must be present or absent at public and diagnostic boundaries. |
+
+`observed_at` is required and may be overridden by a case. Rust derives
+`legal_local_date` and `legal_local_time` from that instant and the requirement's
+configured IANA timezone exactly as it does in production. A fixture cannot
+inject those derived values. Boundary cases choose an observation instant that
+produces the required local date or time.
+
+`selectors` contains the complete authorized role map for the requirement.
+`derivationSelectorInputs`, when present, states the exact minimized role map
+the harness expects Rust to supply to `derive/3`. It must equal the bundle's
+closed derivation selector-input declaration. Omit it when derivation receives
+an empty map.
+
+`purpose` names which of the requirement's declared purposes a case exercises,
+and may be stated in `common`, in a case, or in both. A requirement declaring
+exactly one purpose may omit it. A requirement declaring more than one must
+state it, so offline evaluation reaches every authorized purpose and none is
+silently skipped. An omitted declaration is a fixture contract failure, not an
+authorization denial. A declared purpose the requirement does not list is
+denied exactly as the served path denies it.
+
+`common.expectedRequestParts` is compared structurally after ABI
+normalization. Query-pair order is significant; JSON object order and source
+whitespace are not. The harness then passes those parts and the resolved
+authorized selectors through the production request materializer and compares
+the path, encoded query, and JSON body. There is no case-level
+`expectedRequestParts` override.
+
+`common.expectedTransport` contains the exact fixed path or expanded path and
+the exact configured non-secret headers. Authentication and Rust-owned framing
+headers are checked by dedicated redacted transport assertions, never copied
+into fixture YAML. A case-level `expected.expectedTransport` may add an exact
+encoded query and normalized body for an encoding-focused case.
+
+## Case input vocabulary
+
+Every case has a required `id` and exactly one of these seven tagged forms:
+
+- `response`: raw provider JSON returned by the local mock. Rust applies the
+  configured projection before extraction. The fixture never pre-projects or
+  synthesizes an envelope.
+- `sourceFailure`: one closed mock failure, currently `timeout`,
+  `connection-refused`, `invalid-media-type`, `oversized`, or `malformed-json`.
+- `bundleMutation`: one named startup mutation below.
+- `requestMutation`: one named authorization/request mutation below.
+- `derivationMutation`: one named script-output mutation below.
+- `derivationParameterMutation`: one closed mutation of a disposable copy of
+  the requirement's derivation parameters before startup validation.
+- `selectorOverrides`: one closed selector-input replacement that exercises
+  preparation rejection or exact transport materialization.
+
+The optional inputs shared by applicable forms are:
+
+- `observed_at`;
+- `purpose`, which selects one of the requirement's declared purposes and
+  overrides any `common.purpose`.
+
+The closed mutation names used by these projects are:
+
+| Field and name | Exact harness action |
+|---|---|
+| `bundleMutation: duplicate-disclosure-family` | Give two enabled requirements the same unsafe disclosure family and require startup rejection. |
+| `requestMutation: swap-subject-roles` | Exchange the child and candidate-parent role assignments without changing their profiles or origins. |
+| `requestMutation: supply-grant-derived-candidate` | Add caller material for a role whose configured origin is the authenticated grant. |
+| `derivationMutation: return-raw-reference` | Replace the disposable fixture derivation with one that returns the synthetic raw reference as a public value. |
+
+Mutation cases never alter the reviewed project files on disk.
+
+## Expected vocabulary
+
+Each case has a required `expected` object. Unknown keys and keys irrelevant to
+the selected tagged form are rejected. Success, unresolved, and failure cases
+must state their exact lookup, derivation, signing, and public outcome where
+those stages apply. Omission is not treated as a wildcard.
+
+| Key | Value | Assertion |
+|---|---|---|
+| `lookup` | `match`, `no_match`, or `ambiguous` | Exact closed extraction outcome. |
+| `facts` | JSON object | Exact complete fact object after fact-schema validation, never a partial match. |
+| `value` | supported scalar | Exact value of the requirement's only concept. Use only for a one-concept requirement. |
+| `values` | concept map | Exact complete set of disclosed concepts, keyed by concept id. Use for a requirement disclosing more than one concept. |
+| `entityReferenceCount` | integer | Exact number of audience-scoped entity references in the public value. |
+| `rawReferencesDisclosed` | boolean | Whether any configured raw reference appears in evidence; these projects require `false`. |
+| `signed` | boolean | Whether a flattened JWS success is returned. A valid `false` concept still requires `true`. |
+| `publicProblem` | problem code | Exact safe public failure code. |
+| `error` | adapter signal | Exact value-free internal fixture signal: `adapter_input_error`, `source_protocol_error`, or `derivation_input_error`. |
+| `derivationRuns` | boolean | Whether `derive/3` is invoked. |
+| `bundle` | `accepted` or `rejected` | Startup bundle result. |
+| `outputGate` | `accepted` or `rejected` | Derived-value gate result. |
+| `rejectedBefore` | `credential`, `source`, `derivation`, or `signing` | Latest boundary that must not be crossed. |
+| `sourceRequestCount` | integer | Exact number of evidence-data requests. Version 1 permits only `0` or `1`. |
+| `expectedTransport` | object | Exact expanded path, encoded query string, and normalized body bytes for a transport-focused case. |
+
+`expectedTransport` is accepted only for the `selectorOverrides` form.
+Successful `response` cases require `lookup: match`, `derivationRuns: true`,
+and `signed: true`. The harness creates a fresh in-memory Ed25519 key for the
+evaluation, signs the constructed Evidence, and verifies the JWS and exact
+payload policy. The private key is never read from deployment secrets, written
+to disk, or included in output. Unresolved and failing cases require
+`signed: false` and the exact `derivationRuns` value.
+
+Every `facts` expectation is exact. If a test cares about only two of four
+facts, it must still list all four. This prevents fixtures from silently
+accepting a new or leaked fact.
+
+`value` and `values` are mutually exclusive, and `values` is exact in the same
+way: it states every concept the requirement discloses, so a new or leaked
+concept cannot pass unnoticed.
+
+## Error classes and public problems
+
+Fixtures distinguish unresolved evidence from a broken dependency or bundle
+contract. Do not choose a public code based only on the stage where a value was
+noticed.
+
+| Internal outcome or signal | Public result | Fixture use |
+|---|---|---|
+| `no_match` | `evidence_not_available`, HTTP 422 | Authoritative lookup found no unique record. |
+| `ambiguous` | `evidence_not_available`, HTTP 422 | Authoritative lookup found multiple records; no candidate is selected. |
+| Host-private `required_fact_missing` | `evidence_not_available`, HTTP 422 | A uniquely matched record legitimately lacks a requirement fact that the derivation marks required. |
+| `adapter_input_error` | `service_unavailable`, HTTP 503 | Trusted preparation or its closed inputs violate the adapter contract. Credential acquisition and source access must not occur. |
+| `source_protocol_error` | `dependency_unavailable`, HTTP 503 | The projected provider response violates its protocol, type, count, completeness, or fact-shape contract. |
+| `derivation_input_error` | `evidence_not_available`, HTTP 422 | Matched facts, returned-subject binding, governed namespace/contract, or derivation parameters are inconsistent. A returned-child mismatch is this class. It collapses publicly with the unresolved classes so a caller cannot learn that a record exists, and it is never an authoritative no-match or a signed `false`. |
+| Source transport failure | `dependency_unavailable`, HTTP 503 | Credential, concurrency, timeout, redirect, status, media type, size, JSON, projection, or source transport failure stopped the lookup. |
+| Audit, signing, output-gate, or other script failure | `service_unavailable`, HTTP 503 | Evidence failed closed within the Evidence service or one of its required release dependencies. A script fault raised while derivation is running reports the internal `derivation_input_error` category and stays in this public class. |
+
+Each 503 class is pinned by the fixture's exact `publicProblem` expectation.
+Both 503 codes share the safe title and disclose no provider, selector, fact,
+script, or comparison detail. `no_match`, `ambiguous`, the host-private
+required-value outcome, and derivation-input inconsistency over a uniquely
+found record all collapse into the same 422 public shape, so a fixture can
+never make the status code an existence oracle. A script must not throw
+`source_protocol_error` merely to represent an ordinary missing optional fact,
+and it must not convert malformed or incomplete provider data into `no_match`.
+
+## Harness-wide assertions
+
+The harness applies these assertions to every case whether or not they appear
+under `expected`:
+
+- preparation is after authorization and durable access audit, and before
+  credential acquisition;
+- no request-parts failure acquires credentials or reaches the source;
+- zero or multiple provider results never run derivation or sign evidence;
+- no case performs more than one evidence-data request, follows pagination,
+  redirects, retries, or response-provided URLs;
+- an error, failed audit, failed output gate, or failed signing never returns an
+  unsigned success;
+- expected facts and values are compared with redacted failure messages;
+- selector values, source facts, supported values, secrets, and privacy canaries
+  never appear in test names, snapshots, panic output, logs, audit, metrics,
+  traces, HTTP problems, or diff diagnostics; and
+- the privacy expectation is checked against the verified JWS payload and every
+  captured diagnostic sink.
+
+The harness may report the case id, stage, expected type, actual type, and a
+value-free mismatch code. It must not print the mismatching protected value.
diff --git a/products/evidence/reference/request-adapter/deployment-projects/README.md b/products/evidence/reference/request-adapter/deployment-projects/README.md
new file mode 100644
index 000000000..cfb8de55e
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/README.md
@@ -0,0 +1,95 @@
+# Deployment-shaped Evidence projects
+
+Status: Implemented Version 1 deployment references
+
+These projects show the complete immutable bundle an operator would deploy,
+not only a connector fragment. They include runtime security settings, source
+authentication references, authority grants, selector profiles, requirement
+definitions, scripts, schemas, and sanitized contract cases.
+
+The projects use the Version 1 script contract:
+
+```text
+prepare(source_required_selectors, adapter_parameters) -> RequestParts
+extract(source_response, adapter_parameters) -> LookupResult
+derive(facts, authorized_requirement_selectors, evaluation_context)
+    -> array<DerivedConceptValue>
+```
+
+They are conformance inputs for the implemented product contract and runtime,
+not pseudoconfiguration that silently falls back to fixed selector placements.
+The Evidence package tests load both runtime files and complete bundle
+configurations, capture every referenced artifact, and compile every script
+through the production ABI. Offline evaluation executes every fixture case
+through production request materialization, lookup, derivation, output
+validation, Evidence construction, ephemeral signing, JWS verification,
+privacy, and failure contracts. It intentionally does not authenticate a JWT,
+resolve deployment credentials, write audit, start HTTP, or contact the source;
+package and HTTP-path tests cover those runtime boundaries. An adopter must run
+the same fixtures with `evidence evaluate` before deployment.
+
+## Projects
+
+- [`dhis2-tracker-evidence/`](dhis2-tracker-evidence/) resolves one tracked
+  entity by an exact reference and supports adult status from the configured
+  date-of-birth attribute and professional licence status as an active-licence
+  boolean plus a bounded expiry category.
+- [`opencrvs-family-evidence/`](opencrvs-family-evidence/) resolves one
+  registered birth event and supports adult status, exact registered-parent
+  confirmation, and bounded registered-parent identification.
+- [`relay-protected-read-evidence/`](relay-protected-read-evidence/) resolves
+  one record through a protected, scoped, read-only registry API of the shape
+  Registry Relay presents, and supports residence region as a coarse
+  controlled code mapped from the register's own code.
+
+Every hostname, issuer, identifier, and fixture value is synthetic. `.example`
+hosts must be replaced during deployment. Secret files are referenced only by
+logical names and must be independent, owner-only files beneath the configured
+secret root. No credential value belongs in a bundle, command argument, test
+fixture, snapshot, or diagnostic.
+
+Follow the [authoring and production-build workflow](CONFIG.md#authoring-and-production-build-workflow)
+when adapting a project. Use these complete bundles as reference material, not
+as local state to copy or promote. An editable project gains its own reviewed
+governance metadata and fixtures, then `evidencectl build` produces one closed
+candidate. Keep that candidate bundle unchanged across environments and bind
+each environment through its own runtime file and secret mounts.
+
+## Security boundary
+
+Rust still owns authentication, authorization, durable access audit, fixed
+transport authority, credentials, one evidence-data request, limits, output
+validation, audience-scoped entity references, signing, and disclosure audit.
+Scripts are reviewed and trusted but remain deterministic and unable to
+perform I/O.
+
+Every project declares `responseFormats: [signed-jws]` at the bundle level and
+on every grant, so they release only signed flattened JWS. That is the
+production-shaped default: unsigned output is a development convenience that a
+deployment must enable deliberately in both places.
+
+Relationship derivation may compare one authorized candidate with a complete
+relationship set from one uniquely resolved authoritative record. It may not
+retrieve a broad candidate set, score candidates, choose a best match, or turn
+an unresolved or partial result into `false`.
+
+The family project's `reference_namespace` and
+`relationship_set_contract` facts come from closed source adapter parameters.
+Comparing them with closed requirement parameters proves startup agreement
+between two reviewed bundle sections. It does not prove that the provider
+returned either value. Governance must separately establish that returned
+references belong to the declared namespace and that the configured fields are
+complete for the declared relationship contract. If a provider's namespace or
+contract varies by record, extraction must derive and validate that value from
+projected provider data instead of copying a bundle constant.
+
+Before copying a project, apply the
+[provider prerequisites](CONFIG.md#provider-prerequisites). A source that cannot
+distinguish zero, one, and multiple matches in one bounded request is not a
+Version 1 integration even if its JSON can otherwise be mapped by Rhai.
+
+[`CONFIG.md`](CONFIG.md) defines the Version 1 configuration vocabulary,
+ownership split, enumerations, and optionality. [`FIXTURES.md`](FIXTURES.md)
+defines the executable fixture vocabulary and exact comparison rules. Those
+two references are normative for these projects; the project READMEs explain
+only deployment-specific choices.
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/README.md b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/README.md
new file mode 100644
index 000000000..d0efab66b
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/README.md
@@ -0,0 +1,127 @@
+# DHIS2 Tracker deployment project
+
+This complete target bundle uses two DHIS2 Tracker programmes for two separate
+minimum-disclosure requirements:
+
+- adult status from the configured date-of-birth attribute; and
+- professional licence status as an active-licence boolean plus a bounded
+  expiry category.
+
+The two requirements are independent. Each has its own source, extraction
+script, fact schema, derivation, authority profile, purpose, validity period,
+disclosure family, and fixtures. A caller authorized for one learns nothing
+about the other.
+
+The reviewed governance bundle is under `bundle/`. Process-local paths,
+listener settings, and the private-CA file binding are in `runtime.yaml`.
+Deployments review and mount both files read-only, but staging and production
+may use different runtime files without changing evidence semantics.
+
+Before deployment, the operator changes only:
+
+- `.example` OIDC and DHIS2 hosts;
+- the DHIS2 programme, organisation unit, attribute, and programme-stage UIDs;
+- issuer, provider, trust-domain, framework, evidence-type, and concept URIs;
+- authority tags and purposes;
+- the referenced secret files; and
+- the runtime paths, listener binding, and private-CA bundle file.
+
+## Shared lookup shape
+
+Both sources reuse `adapters/prepare.rhai`. It reads only the closed
+`program`, `organisationUnit`, `providerFields`, `pageSize`, `page`, and
+`totalPages` parameters, so the same reviewed preparation renders both
+requests and neither requirement can widen the other's query. Extraction stays
+separate because the two sources validate and emit different facts.
+
+Each source performs one page-one lookup for exactly one tracked-entity
+reference with `pageSize=2`. A second page is never followed. That two-result
+ceiling is governed adapter policy declared by this reviewed bundle and
+rendered by its preparation script so one bounded response separates a unique
+match from ambiguity. It is not a Rust domain rule and not a DHIS2 property.
+Both extractions require the complete `page`, `pageSize`, `total`, and
+`pageCount` pager, check that the page count agrees with the total and the page
+size, and check that the returned collection agrees with the total. A truncated
+or inconsistent pager is a protocol failure rather than a silently smaller
+result set.
+
+Because a Tracker response can carry attributes and enrollments beyond the ones
+consumed by an adapter, both sources honestly declare `record-transformed`
+posture. Extraction carries the returned `trackedEntity` only as a transient
+fact, and each derivation requires its exact equality with the authorized
+subject selector before evaluating anything else. A returned-record mismatch
+fails closed as the internal `derivation_input_error` category and collapses
+publicly into the same `evidence_not_available` problem as an unresolved
+lookup, so the caller cannot learn that a record was found. The raw tracked
+entity reference is never included in evidence.
+
+`pageSize`, `page`, and `totalPages` are strings because they become lexical
+URL query values. In contrast, the OpenCRVS project's JSON body keeps numeric
+and boolean constants typed.
+
+## Adult status
+
+One tracked entity is resolved by exact reference and one boolean is derived
+from the configured date-of-birth attribute against the requirement's
+`minimum_age_years`. The date of birth is never disclosed. A record whose
+configured attribute is absent, duplicated, or not a string is unresolved or a
+protocol failure, never a signed `false`.
+
+## Professional licence status
+
+The licence source projects the nested
+`enrollments[program,status,events[programStage,status]]` shape. Extraction
+selects the single enrollment in the configured licence programme, rejects a
+duplicate enrollment in that programme as a protocol failure, and reads the
+restriction programme stage from that enrollment's events. A restriction is
+recorded only when an event in the configured stage carries the configured
+completed status; a scheduled or otherwise incomplete restriction event is not
+a restriction in force.
+
+The derivation signs an active-licence boolean and an expiry category. The
+boolean requires the configured active enrollment state, no recorded
+restriction, and a legal local date inside the validity window. The category
+comes from `bucket_number` over the closed `expiry_buckets` parameter, so a
+verifier learns how soon the licence lapses without learning the date. A
+validity window that ends before it starts is an inconsistent record and is
+rejected as `derivation_input_error` rather than signed as expired.
+
+The `absentRestrictionEventMeansUnrestricted` adapter parameter is a
+governance declaration, not a convenience default. When the deployment sets it
+`true`, as here, an enrollment recording no restriction event at all is read as
+unrestricted, and that reading is reviewed bundle policy rather than an
+inference from DHIS2 behavior. When a deployment cannot make that statement it
+sets the parameter `false`, extraction omits `restriction_recorded`, the fact
+schema rejects the incomplete fact set, and the requirement is unresolved.
+Evidence has no third state to sign: a missing signal must either be governed
+into a definite reading or stop the assertion.
+
+## Secrets
+
+Required secret files beneath `/run/secrets/registry-evidence`, each owned by
+the service identity with mode `0600`, are:
+
+```text
+signing-ed25519-private-jwk
+audit-hmac-key
+subject-binding-hmac-key
+dhis2-username
+dhis2-password
+```
+
+Both sources authenticate with the same credential files. A deployment whose
+licence programme is served by a separate DHIS2 instance or a separate service
+account gives that source its own `baseUrl` and its own secret references.
+
+The audit and subject-binding files must contain independently generated raw
+key material of at least 32 bytes each; they are not base64-decoded. The
+signing file contains one private Ed25519 JWK. No secret value is stored in
+this project.
+
+Author with synthetic fixtures first, then promote the same reviewed `bundle/`
+bytes through staging and production. Bind environment-specific runtime paths,
+credentials, private CA, and signing key in each environment. Staging must
+verify the configured `at+jwt` header and claims, readiness, one approved
+synthetic source lookup per requirement, audit durability, and JWS
+verification. See the
+[authoring and production-build workflow](../CONFIG.md#authoring-and-production-build-workflow).
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/adapters/adult-status-extract.rhai b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/adapters/adult-status-extract.rhai
new file mode 100644
index 000000000..978ec7825
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/adapters/adult-status-extract.rhai
@@ -0,0 +1,52 @@
+// The response schema has already refused any envelope outside the declared
+// pager and record shape. What is left is the part a shape cannot state:
+// requiring the page count to agree with the total, so a truncated or
+// inconsistent envelope is not read as an authoritative no-match or unique
+// match, and matching the one attribute this requirement names.
+fn extract(source_response, parameters) {
+    let pager = source_response["pager"];
+    let records = source_response["trackedEntities"];
+    let total = pager["total"];
+    if pager["pageCount"] != (total + pager["pageSize"] - 1) / pager["pageSize"] {
+        throw("source_protocol_error");
+    }
+
+    if total == 0 {
+        if records.len != 0 { throw("source_protocol_error"); }
+        return #{outcome: "no_match"};
+    }
+    if total > 1 {
+        if records.len != 2 { throw("source_protocol_error"); }
+        return #{outcome: "ambiguous"};
+    }
+    if records.len != 1 { throw("source_protocol_error"); }
+
+    let record = records[0];
+    // The shape cannot require this of every record, because the ambiguous
+    // page is decided from the pager before any record is read. A single
+    // matched record with no reference of its own is a source this adapter
+    // does not understand. attributes needs no check: it carries projected
+    // children, so a record without it never survives projection.
+    if is_missing(record["trackedEntity"]) {
+        throw("source_protocol_error");
+    }
+
+    // The attribute is named by an adapter parameter, and a register that
+    // reports it twice has no single value to read, so this loop stays.
+    let date_of_birth = ();
+    let matches = 0;
+    for attribute in record["attributes"] {
+        if attribute["attribute"] == parameters["dateOfBirthAttribute"] {
+            date_of_birth = attribute["value"];
+            matches += 1;
+        }
+    }
+    if matches > 1 { throw("source_protocol_error"); }
+
+    let facts = #{record_reference: record["trackedEntity"]};
+    if matches == 1 {
+        facts["date_of_birth"] = date_of_birth;
+    }
+
+    #{outcome: "match", facts: facts}
+}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/adapters/prepare.rhai b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/adapters/prepare.rhai
new file mode 100644
index 000000000..1721e4b1c
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/adapters/prepare.rhai
@@ -0,0 +1,15 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"];
+    #{
+        query: [
+            #{name: "program", value: parameters["program"]},
+            #{name: "orgUnits", value: parameters["organisationUnit"]},
+            #{name: "trackedEntities", value: subject["values"]["record_reference"]},
+            #{name: "fields", value: parameters["providerFields"]},
+            #{name: "pageSize", value: parameters["pageSize"]},
+            #{name: "page", value: parameters["page"]},
+            #{name: "totalPages", value: parameters["totalPages"]}
+        ],
+        body: ()
+    }
+}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/adapters/professional-licence-extract.rhai b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/adapters/professional-licence-extract.rhai
new file mode 100644
index 000000000..dd8c42d01
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/adapters/professional-licence-extract.rhai
@@ -0,0 +1,126 @@
+// The licence register nests the governing state one level deeper than the
+// population register: the tracked entity carries the licence validity dates,
+// its enrollment in the licence programme carries the licence state, and that
+// enrollment's events carry any recorded practice restriction. The response
+// schema states that nesting, so this script reads it without re-checking it,
+// and keeps only the readings a shape cannot express.
+
+fn licence_enrollments(record, parameters) {
+    let selected = [];
+    // A tracked entity with no enrollment at all is a record carrying no
+    // licence state, not a malformed response, so absence is read as an empty
+    // selection.
+    let enrollments = get_path(record, "/enrollments");
+    if is_missing(enrollments) {
+        return selected;
+    }
+    for enrollment in enrollments {
+        if enrollment["program"] == parameters["program"] {
+            selected.push(enrollment);
+        }
+    }
+    selected
+}
+
+// An enrollment recording no restriction event at all is read as unrestricted
+// only because the deployment declares that reading. A deployment whose
+// programme does not record restrictions positively sets the declaration to
+// false, and the absent fact leaves the requirement unresolved instead of
+// silently asserting an unrestricted licence.
+fn unrecorded_restriction(parameters) {
+    if parameters["absentRestrictionEventMeansUnrestricted"] {
+        return false;
+    }
+    ()
+}
+
+fn restriction_recorded(enrollment, parameters) {
+    let events = get_path(enrollment, "/events");
+    if is_missing(events) {
+        return unrecorded_restriction(parameters);
+    }
+    let stage_present = false;
+    for event in events {
+        if event["programStage"] == parameters["restrictionStage"] {
+            if event["status"] == parameters["completedEventStatus"] {
+                return true;
+            }
+            stage_present = true;
+        }
+    }
+    if stage_present {
+        return false;
+    }
+    unrecorded_restriction(parameters)
+}
+
+fn extract(source_response, parameters) {
+    let pager = source_response["pager"];
+    let records = source_response["trackedEntities"];
+    let total = pager["total"];
+    if pager["pageCount"] != (total + pager["pageSize"] - 1) / pager["pageSize"] {
+        throw("source_protocol_error");
+    }
+
+    if total == 0 {
+        if records.len != 0 { throw("source_protocol_error"); }
+        return #{outcome: "no_match"};
+    }
+    if total > 1 {
+        if records.len != 2 { throw("source_protocol_error"); }
+        return #{outcome: "ambiguous"};
+    }
+    if records.len != 1 { throw("source_protocol_error"); }
+
+    let record = records[0];
+    // The shape cannot require this of every record, because the ambiguous
+    // page is decided from the pager before any record is read. A single
+    // matched record with no reference of its own is a source this adapter
+    // does not understand. attributes needs no check: it carries projected
+    // children, so a record without it never survives projection.
+    if is_missing(record["trackedEntity"]) {
+        throw("source_protocol_error");
+    }
+
+    // The validity attributes are named by adapter parameters, and a register
+    // that reports one of them twice has no single value to read, so this loop
+    // stays.
+    let valid_from = ();
+    let valid_until = ();
+    let from_matches = 0;
+    let until_matches = 0;
+    for attribute in record["attributes"] {
+        if attribute["attribute"] == parameters["validFromAttribute"] {
+            valid_from = attribute["value"];
+            from_matches += 1;
+        }
+        if attribute["attribute"] == parameters["validUntilAttribute"] {
+            valid_until = attribute["value"];
+            until_matches += 1;
+        }
+    }
+    if from_matches > 1 || until_matches > 1 {
+        throw("source_protocol_error");
+    }
+
+    let facts = #{record_reference: record["trackedEntity"]};
+    if from_matches == 1 { facts["valid_from"] = valid_from; }
+    if until_matches == 1 { facts["valid_until"] = valid_until; }
+
+    // Two enrollments in one programme leave no reviewed rule for which one
+    // governs the licence, so the record is not read at all.
+    let enrollments = licence_enrollments(record, parameters);
+    if enrollments.len > 1 {
+        throw("source_protocol_error");
+    }
+    if enrollments.len == 1 {
+        let enrollment = enrollments[0];
+        facts["licence_state"] = enrollment["status"];
+        let restricted = restriction_recorded(enrollment, parameters);
+        if type_of(restricted) == "bool" {
+            facts["restriction_recorded"] = restricted;
+        }
+    }
+
+    #{outcome: "match", facts: facts}
+}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/codelists/licence-expiry-categories.yaml b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/codelists/licence-expiry-categories.yaml
new file mode 100644
index 000000000..6f7b99b56
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/codelists/licence-expiry-categories.yaml
@@ -0,0 +1,3 @@
+id: urn:gov:example:scheme:professional-licence-expiry
+version: '1'
+codes: [expired, within-30-days, within-90-days, later]
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/derivations/adult-status.rhai b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/derivations/adult-status.rhai
new file mode 100644
index 000000000..2232883b3
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/derivations/adult-status.rhai
@@ -0,0 +1,18 @@
+fn derive(facts, selectors, evaluation_context) {
+    if facts["record_reference"] !=
+       selectors["subject"]["values"]["record_reference"] {
+        throw("derivation_input_error");
+    }
+    let date_of_birth = parse_date(required(
+        facts["date_of_birth"],
+        "required_fact_missing"
+    ));
+    let threshold = add_calendar_years(
+        date_of_birth,
+        evaluation_context["parameters"]["minimum_age_years"]
+    );
+    [#{
+        concept_id: "urn:gov:example:concept:adult-status",
+        value: compare_dates(evaluation_context["legal_local_date"], threshold) >= 0
+    }]
+}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/derivations/professional-licence.rhai b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/derivations/professional-licence.rhai
new file mode 100644
index 000000000..2b2d90f69
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/derivations/professional-licence.rhai
@@ -0,0 +1,36 @@
+fn derive(facts, selectors, evaluation_context) {
+    if facts["record_reference"] !=
+       selectors["subject"]["values"]["record_reference"] {
+        throw("derivation_input_error");
+    }
+    let starts = parse_date(required(facts["valid_from"], "required_fact_missing"));
+    let ends = parse_date(required(facts["valid_until"], "required_fact_missing"));
+    let state = required(facts["licence_state"], "required_fact_missing");
+    let restricted = required(facts["restriction_recorded"], "required_fact_missing");
+    // A validity window that ends before it starts is an inconsistent record
+    // rather than an expired licence.
+    if compare_dates(ends, starts) < 0 {
+        throw("derivation_input_error");
+    }
+    let current = evaluation_context["legal_local_date"];
+    let active =
+        state == evaluation_context["parameters"]["active_state"] &&
+        !restricted &&
+        compare_dates(current, starts) >= 0 &&
+        compare_dates(current, ends) <= 0;
+    let remaining_days = integer_to_decimal(days_between(current, ends));
+    let category = bucket_number(
+        remaining_days,
+        evaluation_context["parameters"]["expiry_buckets"]
+    );
+    [
+        #{
+            concept_id: "urn:gov:example:concept:professional-licence-active",
+            value: active
+        },
+        #{
+            concept_id: "urn:gov:example:concept:professional-licence-expiry-category",
+            value: category
+        }
+    ]
+}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/evidence.yaml b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/evidence.yaml
new file mode 100644
index 000000000..12178e6d9
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/evidence.yaml
@@ -0,0 +1,287 @@
+version: 1
+assuranceProfile: evidence-grade
+service:
+  providerId: urn:gov:example:evidence:dhis2
+  trustDomain: urn:gov:example:trust-domain:social-protection
+issuer:
+  id: urn:gov:example:issuer:population-authority
+authentication:
+  kind: oidc-access-token
+  issuer: https://identity.gov.example
+  audiences: [registry-evidence]
+  tokenTypes: [at+jwt]
+  algorithms: [EdDSA]
+  jwksUri: https://identity.gov.example/.well-known/jwks.json
+  principalClaim: sub
+  requesterTagsClaim: evidence_tags
+  evidenceAudienceClaim: evidence_audience
+  grantIdClaim: evidence_grant_id
+  grantAuthorityClaim: evidence_authority
+audit:
+  format: keyed-jsonl
+  hashSecretRef: secret:file/audit-hmac-key
+  hashKeyVersion: 1
+  failClosed: true
+subjectBinding:
+  secretRef: secret:file/subject-binding-hmac-key
+  keyVersion: 1
+rateLimits:
+  requestsPerPrincipalPerMinute: 60
+  burstPerPrincipal: 10
+  failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 10
+signing:
+  format: flattened-jws-json
+  algorithm: EdDSA
+  activeKeyId: evidence-signing-2026-01
+  activeKeyRef: secret:file/signing-ed25519-private-jwk
+  retiredPublicJwkFiles: []
+  jwksPath: /.well-known/evidence/jwks.json
+  maximumAssertionValiditySeconds: 86400
+  verifierClockSkewSeconds: 30
+responseFormats: [signed-jws]
+
+selectorProfiles:
+  tracked-entity-reference-v1:
+    maximumAggregateBytes: 64
+    fields:
+      record_reference:
+        type: string
+        minimumBytes: 11
+        maximumBytes: 64
+sources:
+  population-tracker:
+    transport: http-json
+    baseUrl: https://dhis2.gov.example
+    posture: record-transformed
+    tlsTrustProfile: government-internal-pki
+    authentication:
+      kind: basic
+      usernameRef: secret:file/dhis2-username
+      passwordRef: secret:file/dhis2-password
+    request:
+      method: GET
+      path: /api/tracker/trackedEntities
+      fixedHeaders:
+        - name: Accept
+          value: application/json
+      selectorInputs:
+        - role: subject
+          alternatives:
+            - profile: tracked-entity-reference-v1
+              fields: [record_reference]
+      prepareScript: adapters/prepare.rhai
+      adapterParameters:
+        program: Prg00000001
+        organisationUnit: Org00000001
+        providerFields: trackedEntity,attributes[attribute,value]
+        pageSize: "2"
+        page: "1"
+        totalPages: "true"
+        dateOfBirthAttribute: Dob00000001
+      adapterParametersSchema: schemas/adult-status-adapter-parameters.schema.yaml
+      preparationLimits:
+        query: required
+        jsonBody: forbidden
+        maximumQueryPairs: 8
+        maximumQueryNameBytes: 64
+        maximumQueryValueBytes: 1024
+        maximumNormalizedBytes: 4096
+      projection:
+        - /pager/page
+        - /pager/pageSize
+        - /pager/total
+        - /pager/pageCount
+        - /trackedEntities/*/trackedEntity
+        - /trackedEntities/*/attributes/*/attribute
+        - /trackedEntities/*/attributes/*/value
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 8
+    # Shape contract for the projected response, checked before extraction runs.
+    responseSchema: schemas/adult-status-response.schema.yaml
+    extractScript: adapters/adult-status-extract.rhai
+    factSchema: schemas/adult-status-facts.schema.yaml
+  professional-licence-register:
+    transport: http-json
+    baseUrl: https://dhis2.gov.example
+    posture: record-transformed
+    tlsTrustProfile: government-internal-pki
+    authentication:
+      kind: basic
+      usernameRef: secret:file/dhis2-username
+      passwordRef: secret:file/dhis2-password
+    request:
+      method: GET
+      path: /api/tracker/trackedEntities
+      fixedHeaders:
+        - name: Accept
+          value: application/json
+      selectorInputs:
+        - role: subject
+          alternatives:
+            - profile: tracked-entity-reference-v1
+              fields: [record_reference]
+      prepareScript: adapters/prepare.rhai
+      adapterParameters:
+        program: Prg00000002
+        organisationUnit: Org00000001
+        providerFields: trackedEntity,attributes[attribute,value],enrollments[program,status,events[programStage,status]]
+        pageSize: "2"
+        page: "1"
+        totalPages: "true"
+        validFromAttribute: Vfr00000001
+        validUntilAttribute: Vun00000001
+        restrictionStage: Rst00000001
+        completedEventStatus: COMPLETED
+        absentRestrictionEventMeansUnrestricted: true
+      adapterParametersSchema: schemas/professional-licence-adapter-parameters.schema.yaml
+      preparationLimits:
+        query: required
+        jsonBody: forbidden
+        maximumQueryPairs: 8
+        maximumQueryNameBytes: 64
+        maximumQueryValueBytes: 1024
+        maximumNormalizedBytes: 4096
+      projection:
+        - /pager/page
+        - /pager/pageSize
+        - /pager/total
+        - /pager/pageCount
+        - /trackedEntities/*/trackedEntity
+        - /trackedEntities/*/attributes/*/attribute
+        - /trackedEntities/*/attributes/*/value
+        - /trackedEntities/*/enrollments/*/program
+        - /trackedEntities/*/enrollments/*/status
+        - /trackedEntities/*/enrollments/*/events/*/programStage
+        - /trackedEntities/*/enrollments/*/events/*/status
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 8
+    # Shape contract for the projected response, checked before extraction runs.
+    responseSchema: schemas/professional-licence-response.schema.yaml
+    extractScript: adapters/professional-licence-extract.rhai
+    factSchema: schemas/professional-licence-facts.schema.yaml
+authorityProfiles:
+  eligibility-caseworker-v1:
+    kind: statutory
+    requesterTags: [eligibility-caseworker]
+    grants:
+      - requirement: urn:gov:example:requirement:adult-status:v1
+        purpose: benefit-eligibility
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects:
+          - role: subject
+            selectorProfile: tracked-entity-reference-v1
+            valueOrigin: request
+  licence-verifier-v1:
+    kind: statutory
+    requesterTags: [licence-verifier]
+    grants:
+      - requirement: urn:gov:example:requirement:professional-licence-status:v1
+        purpose: professional-registration-verification
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects:
+          - role: subject
+            selectorProfile: tracked-entity-reference-v1
+            valueOrigin: request
+requirements:
+  - id: urn:gov:example:requirement:adult-status:v1
+    kind: criterion
+    source: population-tracker
+    purposes: [benefit-eligibility]
+    subjectRoles:
+      - role: subject
+        cardinality: one
+        selectorProfiles: [tracked-entity-reference-v1]
+    referenceFrameworks: [urn:gov:example:framework:age-of-majority:v1]
+    evidenceType: urn:gov:example:evidence-type:adult-status:v1
+    observationTimezone: Asia/Bangkok
+    validitySeconds: 86400
+    derivation:
+      script: derivations/adult-status.rhai
+      selectorInputs:
+        - role: subject
+          alternatives:
+            - profile: tracked-entity-reference-v1
+              fields: [record_reference]
+      parameters: {minimum_age_years: 18}
+    concepts:
+      - id: urn:gov:example:concept:adult-status
+        form: boolean
+        required: true
+        constraints: {}
+    fixtures: fixtures/adult-status-cases.yaml
+    disclosureGuard:
+      families: [urn:gov:example:disclosure-family:adult-status]
+    existenceDisclosure: collapse-unresolved
+  - id: urn:gov:example:requirement:professional-licence-status:v1
+    kind: criterion
+    source: professional-licence-register
+    purposes: [professional-registration-verification]
+    subjectRoles:
+      - role: subject
+        cardinality: one
+        selectorProfiles: [tracked-entity-reference-v1]
+    referenceFrameworks: [urn:gov:example:framework:professional-practice-licence:v1]
+    evidenceType: urn:gov:example:evidence-type:professional-licence-status:v1
+    observationTimezone: Asia/Bangkok
+    validitySeconds: 43200
+    derivation:
+      script: derivations/professional-licence.rhai
+      selectorInputs:
+        - role: subject
+          alternatives:
+            - profile: tracked-entity-reference-v1
+              fields: [record_reference]
+      parameters:
+        active_state: ACTIVE
+        expiry_buckets:
+          - minimumInclusive:
+              type: decimal
+              value: '-365000'
+            maximumExclusive:
+              type: decimal
+              value: '0'
+            code: expired
+          - minimumInclusive:
+              type: decimal
+              value: '0'
+            maximumExclusive:
+              type: decimal
+              value: '31'
+            code: within-30-days
+          - minimumInclusive:
+              type: decimal
+              value: '31'
+            maximumExclusive:
+              type: decimal
+              value: '91'
+            code: within-90-days
+          - minimumInclusive:
+              type: decimal
+              value: '91'
+            maximumExclusive:
+              type: decimal
+              value: '365001'
+            code: later
+    concepts:
+      - id: urn:gov:example:concept:professional-licence-active
+        form: boolean
+        required: true
+        constraints: {}
+      - id: urn:gov:example:concept:professional-licence-expiry-category
+        form: controlled-category
+        required: true
+        constraints:
+          categoryScheme: urn:gov:example:scheme:professional-licence-expiry
+          schemeVersion: '1'
+          maximumBytes: 32
+          codelist: codelists/licence-expiry-categories.yaml
+    fixtures: fixtures/professional-licence-cases.yaml
+    disclosureGuard:
+      families: [urn:gov:example:disclosure-family:professional-licence]
+    existenceDisclosure: collapse-unresolved
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/fixtures/adult-status-cases.yaml b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/fixtures/adult-status-cases.yaml
new file mode 100644
index 000000000..57a1dac78
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/fixtures/adult-status-cases.yaml
@@ -0,0 +1,299 @@
+fixture: registry.evidence.reference.dhis2-adult-status/v1
+synthetic_only: true
+common:
+  observed_at: "2026-08-02T00:00:00Z"
+  selectors:
+    subject:
+      profile: tracked-entity-reference-v1
+      values: {record_reference: Tei00000001}
+  derivationSelectorInputs:
+    subject:
+      profile: tracked-entity-reference-v1
+      values: {record_reference: Tei00000001}
+  expectedRequestParts:
+    query:
+      - name: program
+        value: Prg00000001
+      - name: orgUnits
+        value: Org00000001
+      - name: trackedEntities
+        value: Tei00000001
+      - name: fields
+        value: "trackedEntity,attributes[attribute,value]"
+      - name: pageSize
+        value: "2"
+      - name: page
+        value: "1"
+      - name: totalPages
+        value: "true"
+    body: null
+  expectedTransport:
+    path: /api/tracker/trackedEntities
+    fixedHeaders:
+      - name: Accept
+        value: application/json
+cases:
+  - id: positive
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes:
+            - attribute: Dob00000001
+              value: "2000-01-01"
+            - attribute: Oth00000001
+              value: SOURCE-UNRELATED-CANARY
+    expected:
+      lookup: match
+      derivationRuns: true
+      signed: true
+      facts:
+        record_reference: Tei00000001
+        date_of_birth: "2000-01-01"
+      value: true
+
+  - id: negative-false-is-success
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes:
+            - attribute: Dob00000001
+              value: "2010-01-01"
+    expected:
+      lookup: match
+      derivationRuns: true
+      facts:
+        record_reference: Tei00000001
+        date_of_birth: "2010-01-01"
+      value: false
+      signed: true
+
+  - id: boundary-on
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes:
+            - attribute: Dob00000001
+              value: "2008-08-02"
+    expected:
+      lookup: match
+      derivationRuns: true
+      signed: true
+      facts:
+        record_reference: Tei00000001
+        date_of_birth: "2008-08-02"
+      value: true
+
+  - id: missing-fact
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes:
+            - attribute: Oth00000001
+              value: SOURCE-UNRELATED-CANARY
+    expected:
+      publicProblem: evidence_not_available
+      derivationRuns: false
+      signed: false
+
+  - id: no-match
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 0
+        pageCount: 0
+      trackedEntities: []
+    expected:
+      lookup: no_match
+      publicProblem: evidence_not_available
+      derivationRuns: false
+      signed: false
+
+  - id: ambiguous
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 2
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes: []
+        # The second record carries no reference of its own, only the
+        # attribute list the projection insists on. The pager decides this page
+        # before any record is read, so a response shape that demanded a
+        # complete record here would turn an ordinary ambiguous lookup into a
+        # source-protocol failure.
+        - attributes: []
+    expected:
+      lookup: ambiguous
+      publicProblem: evidence_not_available
+      derivationRuns: false
+      signed: false
+
+  # A tracker page whose envelope is truncated, inconsistent, or wrongly typed is
+  # never read as an authoritative no-match, unique match, or duplicate.
+  - id: truncated-pager
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes: []
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+
+  - id: pager-count-mismatch
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 2
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes: []
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+
+  - id: total-collection-mismatch
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities: []
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+
+  - id: fractional-total
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1.5
+        pageCount: 1
+      trackedEntities: []
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+
+  # One tracked entity carrying the configured attribute twice, or carrying it
+  # with a non-string value, is a provider or configuration fault rather than a
+  # record that legitimately lacks a date of birth.
+  - id: duplicate-configured-attribute
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes:
+            - attribute: Dob00000001
+              value: "2000-01-01"
+            - attribute: Dob00000001
+              value: "2010-01-01"
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+
+  - id: non-string-attribute-value
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes:
+            - attribute: Dob00000001
+              value: 20000101
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+
+  - id: returned-subject-mismatch
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000002
+          attributes:
+            - attribute: Dob00000001
+              value: "2000-01-01"
+    expected:
+      lookup: match
+      error: derivation_input_error
+      publicProblem: evidence_not_available
+      derivationRuns: true
+      signed: false
+
+  - id: source-failure
+    sourceFailure: timeout
+    expected:
+      publicProblem: dependency_unavailable
+      signed: false
+
+  # An expired provider session answers a JSON request with an HTML sign-in page.
+  - id: source-html-sign-in-page
+    sourceFailure: invalid-media-type
+    expected:
+      publicProblem: dependency_unavailable
+      signed: false
+
+  - id: hostile-reference
+    selectorOverrides:
+      subject:
+        values: {record_reference: "X&fields=*%0D%0AInjected:yes"}
+    expected:
+      sourceRequestCount: 1
+      expectedTransport:
+        path: /api/tracker/trackedEntities
+        query: "program=Prg00000001&orgUnits=Org00000001&trackedEntities=X%26fields%3D%2A%250D%250AInjected%3Ayes&fields=trackedEntity%2Cattributes%5Battribute%2Cvalue%5D&pageSize=2&page=1&totalPages=true"
+        body: null
+
+  - id: anti-reconstruction
+    bundleMutation: duplicate-disclosure-family
+    expected: {bundle: rejected}
+privacyExpectation:
+  evidenceContains: [urn:gov:example:concept:adult-status]
+  evidenceExcludes: [date_of_birth, record_reference, tracked-entity-reference-v1, Tei00000001, Tei00000002]
+  diagnosticsExclude: [Tei00000001, Tei00000002, "2000-01-01", SOURCE-UNRELATED-CANARY]
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/fixtures/professional-licence-cases.yaml b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/fixtures/professional-licence-cases.yaml
new file mode 100644
index 000000000..b02f4072b
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/fixtures/professional-licence-cases.yaml
@@ -0,0 +1,455 @@
+fixture: registry.evidence.reference.dhis2-professional-licence/v1
+synthetic_only: true
+common:
+  observed_at: "2026-08-02T00:00:00Z"
+  selectors:
+    subject:
+      profile: tracked-entity-reference-v1
+      values: {record_reference: Tei00000001}
+  derivationSelectorInputs:
+    subject:
+      profile: tracked-entity-reference-v1
+      values: {record_reference: Tei00000001}
+  expectedRequestParts:
+    query:
+      - name: program
+        value: Prg00000002
+      - name: orgUnits
+        value: Org00000001
+      - name: trackedEntities
+        value: Tei00000001
+      - name: fields
+        value: "trackedEntity,attributes[attribute,value],enrollments[program,status,events[programStage,status]]"
+      - name: pageSize
+        value: "2"
+      - name: page
+        value: "1"
+      - name: totalPages
+        value: "true"
+    body: null
+  expectedTransport:
+    path: /api/tracker/trackedEntities
+    fixedHeaders:
+      - name: Accept
+        value: application/json
+cases:
+  - id: positive
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes:
+            - attribute: Vfr00000001
+              value: "2025-01-01"
+            - attribute: Vun00000001
+              value: "2026-08-20"
+            - attribute: Oth00000001
+              value: LICENCE-UNRELATED-CANARY
+          enrollments:
+            - program: Prg00000002
+              status: ACTIVE
+              events:
+                - programStage: Rev00000001
+                  status: COMPLETED
+    expected:
+      lookup: match
+      derivationRuns: true
+      signed: true
+      facts:
+        record_reference: Tei00000001
+        licence_state: ACTIVE
+        valid_from: "2025-01-01"
+        valid_until: "2026-08-20"
+        restriction_recorded: false
+      values:
+        urn:gov:example:concept:professional-licence-active: true
+        urn:gov:example:concept:professional-licence-expiry-category: within-30-days
+
+  # A completed restriction event withholds the active licence without changing
+  # the enrollment state, so the two signals are read together.
+  - id: restricted-licence-is-not-active
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes:
+            - attribute: Vfr00000001
+              value: "2025-01-01"
+            - attribute: Vun00000001
+              value: "2026-12-31"
+          enrollments:
+            - program: Prg00000002
+              status: ACTIVE
+              events:
+                - programStage: Rst00000001
+                  status: COMPLETED
+    expected:
+      lookup: match
+      derivationRuns: true
+      signed: true
+      facts:
+        record_reference: Tei00000001
+        licence_state: ACTIVE
+        valid_from: "2025-01-01"
+        valid_until: "2026-12-31"
+        restriction_recorded: true
+      values:
+        urn:gov:example:concept:professional-licence-active: false
+        urn:gov:example:concept:professional-licence-expiry-category: later
+
+  # A restriction event that exists but is not completed is a restriction that
+  # has not been recorded, not a restriction in force.
+  - id: scheduled-restriction-is-not-recorded
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes:
+            - attribute: Vfr00000001
+              value: "2025-01-01"
+            - attribute: Vun00000001
+              value: "2026-09-15"
+          enrollments:
+            - program: Prg00000002
+              status: ACTIVE
+              events:
+                - programStage: Rst00000001
+                  status: SCHEDULE
+    expected:
+      lookup: match
+      derivationRuns: true
+      signed: true
+      facts:
+        record_reference: Tei00000001
+        licence_state: ACTIVE
+        valid_from: "2025-01-01"
+        valid_until: "2026-09-15"
+        restriction_recorded: false
+      values:
+        urn:gov:example:concept:professional-licence-active: true
+        urn:gov:example:concept:professional-licence-expiry-category: within-90-days
+
+  - id: negative-cancelled-enrollment-is-success
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes:
+            - attribute: Vfr00000001
+              value: "2025-01-01"
+            - attribute: Vun00000001
+              value: "2026-10-01"
+          enrollments:
+            - program: Prg00000002
+              status: CANCELLED
+              events: []
+    expected:
+      lookup: match
+      derivationRuns: true
+      signed: true
+      facts:
+        record_reference: Tei00000001
+        licence_state: CANCELLED
+        valid_from: "2025-01-01"
+        valid_until: "2026-10-01"
+        restriction_recorded: false
+      values:
+        urn:gov:example:concept:professional-licence-active: false
+        urn:gov:example:concept:professional-licence-expiry-category: within-90-days
+  - id: boundary-last-valid-day
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes:
+            - attribute: Vfr00000001
+              value: "2025-01-01"
+            - attribute: Vun00000001
+              value: "2026-08-02"
+          enrollments:
+            - program: Prg00000002
+              status: ACTIVE
+              events: []
+    expected:
+      lookup: match
+      derivationRuns: true
+      signed: true
+      facts:
+        record_reference: Tei00000001
+        licence_state: ACTIVE
+        valid_from: "2025-01-01"
+        valid_until: "2026-08-02"
+        restriction_recorded: false
+      values:
+        urn:gov:example:concept:professional-licence-active: true
+        urn:gov:example:concept:professional-licence-expiry-category: within-30-days
+  - id: boundary-first-expired-day
+    observed_at: "2026-08-03T00:00:00Z"
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes:
+            - attribute: Vfr00000001
+              value: "2025-01-01"
+            - attribute: Vun00000001
+              value: "2026-08-02"
+          enrollments:
+            - program: Prg00000002
+              status: ACTIVE
+              events: []
+    expected:
+      lookup: match
+      derivationRuns: true
+      signed: true
+      facts:
+        record_reference: Tei00000001
+        licence_state: ACTIVE
+        valid_from: "2025-01-01"
+        valid_until: "2026-08-02"
+        restriction_recorded: false
+      values:
+        urn:gov:example:concept:professional-licence-active: false
+        urn:gov:example:concept:professional-licence-expiry-category: expired
+  # A tracked entity with no enrollment in the licence programme legitimately
+  # carries no licence state, which is unresolved rather than a denied licence.
+  - id: missing-fact
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes:
+            - attribute: Vfr00000001
+              value: "2025-01-01"
+            - attribute: Vun00000001
+              value: "2026-08-20"
+          enrollments:
+            - program: Prg00000001
+              status: ACTIVE
+              events: []
+    expected:
+      publicProblem: evidence_not_available
+      derivationRuns: false
+      signed: false
+
+  - id: no-match
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 0
+        pageCount: 0
+      trackedEntities: []
+    expected:
+      lookup: no_match
+      publicProblem: evidence_not_available
+      derivationRuns: false
+      signed: false
+
+  - id: ambiguous
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 2
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes: []
+          enrollments: []
+        # The second record carries no reference of its own, only the lists
+        # the projection insists on. The pager decides this page before any
+        # record is read, so a response shape that demanded a complete record
+        # here would turn an ordinary ambiguous lookup into a source-protocol
+        # failure.
+        - attributes: []
+          enrollments: []
+    expected:
+      lookup: ambiguous
+      publicProblem: evidence_not_available
+      derivationRuns: false
+      signed: false
+
+  # Two enrollments in one programme leave no reviewed rule for which one
+  # governs the licence, and an event without a status cannot be read at all.
+  - id: duplicate-programme-enrollment
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes:
+            - attribute: Vfr00000001
+              value: "2025-01-01"
+            - attribute: Vun00000001
+              value: "2026-08-20"
+          enrollments:
+            - program: Prg00000002
+              status: ACTIVE
+              events: []
+            - program: Prg00000002
+              status: CANCELLED
+              events: []
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+
+  - id: event-without-status
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes:
+            - attribute: Vfr00000001
+              value: "2025-01-01"
+            - attribute: Vun00000001
+              value: "2026-08-20"
+          enrollments:
+            - program: Prg00000002
+              status: ACTIVE
+              events:
+                - programStage: Rst00000001
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+
+  - id: truncated-pager
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes: []
+          enrollments: []
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+
+  # A validity window that ends before it starts is an inconsistent record, and
+  # it collapses publicly with the unresolved classes rather than signing false.
+  - id: inverted-validity-window
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000001
+          attributes:
+            - attribute: Vfr00000001
+              value: "2026-12-01"
+            - attribute: Vun00000001
+              value: "2026-01-01"
+          enrollments:
+            - program: Prg00000002
+              status: ACTIVE
+              events: []
+    expected:
+      lookup: match
+      error: derivation_input_error
+      publicProblem: evidence_not_available
+      derivationRuns: true
+      signed: false
+
+  - id: returned-subject-mismatch
+    response:
+      pager:
+        page: 1
+        pageSize: 2
+        total: 1
+        pageCount: 1
+      trackedEntities:
+        - trackedEntity: Tei00000002
+          attributes:
+            - attribute: Vfr00000001
+              value: "2025-01-01"
+            - attribute: Vun00000001
+              value: "2026-08-20"
+          enrollments:
+            - program: Prg00000002
+              status: ACTIVE
+              events: []
+    expected:
+      lookup: match
+      error: derivation_input_error
+      publicProblem: evidence_not_available
+      derivationRuns: true
+      signed: false
+
+  - id: source-failure
+    sourceFailure: connection-refused
+    expected:
+      publicProblem: dependency_unavailable
+      signed: false
+
+  - id: hostile-reference
+    selectorOverrides:
+      subject:
+        values: {record_reference: "X&fields=*%0D%0AInjected:yes"}
+    expected:
+      sourceRequestCount: 1
+      expectedTransport:
+        path: /api/tracker/trackedEntities
+        query: "program=Prg00000002&orgUnits=Org00000001&trackedEntities=X%26fields%3D%2A%250D%250AInjected%3Ayes&fields=trackedEntity%2Cattributes%5Battribute%2Cvalue%5D%2Cenrollments%5Bprogram%2Cstatus%2Cevents%5BprogramStage%2Cstatus%5D%5D&pageSize=2&page=1&totalPages=true"
+        body: null
+
+  - id: anti-reconstruction
+    bundleMutation: duplicate-disclosure-family
+    expected: {bundle: rejected}
+privacyExpectation:
+  evidenceContains:
+    - urn:gov:example:concept:professional-licence-active
+    - urn:gov:example:concept:professional-licence-expiry-category
+  evidenceExcludes:
+    - licence_state
+    - valid_from
+    - valid_until
+    - restriction_recorded
+    - record_reference
+    - tracked-entity-reference-v1
+    - Tei00000001
+    - Tei00000002
+    - ACTIVE
+    - CANCELLED
+  diagnosticsExclude: [Tei00000001, Tei00000002, "2026-08-20", ACTIVE, LICENCE-UNRELATED-CANARY]
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/adult-status-adapter-parameters.schema.yaml b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/adult-status-adapter-parameters.schema.yaml
new file mode 100644
index 000000000..6e54dac2a
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/adult-status-adapter-parameters.schema.yaml
@@ -0,0 +1,27 @@
+type: object
+additionalProperties: false
+required:
+  - program
+  - organisationUnit
+  - providerFields
+  - pageSize
+  - page
+  - totalPages
+  - dateOfBirthAttribute
+properties:
+  program:
+    type: string
+    minLength: 1
+    maxLength: 128
+  organisationUnit:
+    type: string
+    minLength: 1
+    maxLength: 128
+  providerFields: {const: "trackedEntity,attributes[attribute,value]"}
+  pageSize: {const: "2"}
+  page: {const: "1"}
+  totalPages: {const: "true"}
+  dateOfBirthAttribute:
+    type: string
+    minLength: 1
+    maxLength: 128
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/adult-status-facts.schema.yaml b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/adult-status-facts.schema.yaml
new file mode 100644
index 000000000..86e970c59
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/adult-status-facts.schema.yaml
@@ -0,0 +1,11 @@
+type: object
+additionalProperties: false
+required: [record_reference, date_of_birth]
+properties:
+  record_reference:
+    type: string
+    minLength: 11
+    maxLength: 64
+  date_of_birth:
+    type: string
+    format: date
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/adult-status-response.schema.yaml b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/adult-status-response.schema.yaml
new file mode 100644
index 000000000..184d03f48
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/adult-status-response.schema.yaml
@@ -0,0 +1,67 @@
+# Shape of the projected tracker response, checked before extraction runs.
+# The prepared request asks for page 1 of size 2, so the pager echo is a
+# constant here rather than a comparison the script has to repeat. Whether the
+# page count agrees with the total stays with the script: that is arithmetic
+# between fields, not a shape.
+type: object
+additionalProperties: false
+required: [pager, trackedEntities]
+properties:
+  pager:
+    type: object
+    additionalProperties: false
+    required: [page, pageSize, total, pageCount]
+    properties:
+      page:
+        type: integer
+        const: 1
+      pageSize:
+        type: integer
+        const: 2
+      total:
+        type: integer
+        minimum: 0
+        maximum: 1000000
+      pageCount:
+        type: integer
+        minimum: 0
+        maximum: 1000000
+  trackedEntities:
+    type: array
+    minItems: 0
+    maxItems: 2
+    items:
+      type: object
+      additionalProperties: false
+      # No projected leaf can be required of every record. Projection drops a
+      # leaf the record did not carry, and an ambiguous page is decided from
+      # the pager before any record is read, so a record on that page need not
+      # be complete. What a single matched record must carry stays with the
+      # script. attributes is not listed either: projection rejects a record
+      # missing an intermediate its children hang from, so saying so here would
+      # only repeat the projection.
+      required: []
+      properties:
+        trackedEntity:
+          type: string
+          minLength: 1
+          maxLength: 64
+        attributes:
+          # A closed schema must bound every array. This ceiling is a shape
+          # limit on one tracked entity's attribute list, well above what the
+          # programme records, not a statement about which attributes matter.
+          type: array
+          minItems: 0
+          maxItems: 64
+          items:
+            type: object
+            additionalProperties: false
+            required: [attribute, value]
+            properties:
+              attribute:
+                type: string
+                minLength: 1
+                maxLength: 64
+              value:
+                type: string
+                maxLength: 512
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/professional-licence-adapter-parameters.schema.yaml b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/professional-licence-adapter-parameters.schema.yaml
new file mode 100644
index 000000000..c585c09bc
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/professional-licence-adapter-parameters.schema.yaml
@@ -0,0 +1,45 @@
+type: object
+additionalProperties: false
+required:
+  - program
+  - organisationUnit
+  - providerFields
+  - pageSize
+  - page
+  - totalPages
+  - validFromAttribute
+  - validUntilAttribute
+  - restrictionStage
+  - completedEventStatus
+  - absentRestrictionEventMeansUnrestricted
+properties:
+  program:
+    type: string
+    minLength: 1
+    maxLength: 128
+  organisationUnit:
+    type: string
+    minLength: 1
+    maxLength: 128
+  providerFields:
+    const: "trackedEntity,attributes[attribute,value],enrollments[program,status,events[programStage,status]]"
+  pageSize: {const: "2"}
+  page: {const: "1"}
+  totalPages: {const: "true"}
+  validFromAttribute:
+    type: string
+    minLength: 1
+    maxLength: 128
+  validUntilAttribute:
+    type: string
+    minLength: 1
+    maxLength: 128
+  restrictionStage:
+    type: string
+    minLength: 1
+    maxLength: 128
+  completedEventStatus:
+    type: string
+    minLength: 1
+    maxLength: 32
+  absentRestrictionEventMeansUnrestricted: {type: boolean}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/professional-licence-facts.schema.yaml b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/professional-licence-facts.schema.yaml
new file mode 100644
index 000000000..3408b6c56
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/professional-licence-facts.schema.yaml
@@ -0,0 +1,19 @@
+type: object
+additionalProperties: false
+required: [record_reference, licence_state, valid_from, valid_until, restriction_recorded]
+properties:
+  record_reference:
+    type: string
+    minLength: 11
+    maxLength: 64
+  licence_state:
+    type: string
+    minLength: 1
+    maxLength: 32
+  valid_from:
+    type: string
+    format: date
+  valid_until:
+    type: string
+    format: date
+  restriction_recorded: {type: boolean}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/professional-licence-response.schema.yaml b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/professional-licence-response.schema.yaml
new file mode 100644
index 000000000..b17a3debd
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/bundle/schemas/professional-licence-response.schema.yaml
@@ -0,0 +1,105 @@
+# Shape of the projected tracker response, checked before extraction runs.
+# The prepared request asks for page 1 of size 2, so the pager echo is a
+# constant here rather than a comparison the script has to repeat. Whether the
+# page count agrees with the total stays with the script: that is arithmetic
+# between fields, not a shape.
+type: object
+additionalProperties: false
+required: [pager, trackedEntities]
+properties:
+  pager:
+    type: object
+    additionalProperties: false
+    required: [page, pageSize, total, pageCount]
+    properties:
+      page:
+        type: integer
+        const: 1
+      pageSize:
+        type: integer
+        const: 2
+      total:
+        type: integer
+        minimum: 0
+        maximum: 1000000
+      pageCount:
+        type: integer
+        minimum: 0
+        maximum: 1000000
+  trackedEntities:
+    type: array
+    minItems: 0
+    maxItems: 2
+    items:
+      type: object
+      additionalProperties: false
+      # No projected leaf can be required of every record. Projection drops a
+      # leaf the record did not carry, and an ambiguous page is decided from
+      # the pager before any record is read, so a record on that page need not
+      # be complete. attributes and enrollments are not listed either, for a
+      # different reason: projection rejects a record missing an intermediate
+      # its children hang from, so saying so here would only repeat the
+      # projection.
+      required: []
+      properties:
+        trackedEntity:
+          type: string
+          minLength: 1
+          maxLength: 64
+        attributes:
+          # A closed schema must bound every array. This ceiling is a shape
+          # limit on one tracked entity's attribute list, well above what the
+          # programme records, not a statement about which attributes matter.
+          type: array
+          minItems: 0
+          maxItems: 64
+          items:
+            type: object
+            additionalProperties: false
+            required: [attribute, value]
+            properties:
+              attribute:
+                type: string
+                minLength: 1
+                maxLength: 64
+              value:
+                type: string
+                maxLength: 512
+        enrollments:
+          type: array
+          minItems: 0
+          maxItems: 16
+          items:
+            type: object
+            additionalProperties: false
+            # The projection selects program and status for every enrollment,
+            # so an enrollment returned without either is a source shape this
+            # adapter does not understand. events is optional: an enrollment
+            # that recorded none is the case the restriction reading covers.
+            required: [program, status]
+            properties:
+              program:
+                type: string
+                minLength: 1
+                maxLength: 64
+              status:
+                type: string
+                minLength: 1
+                maxLength: 64
+              events:
+                type: array
+                minItems: 0
+                maxItems: 64
+                items:
+                  type: object
+                  additionalProperties: false
+                  required: [programStage, status]
+                  properties:
+                    programStage:
+                      type: string
+                      minLength: 1
+                      maxLength: 64
+                    status:
+                      type: string
+                      minLength: 1
+                      maxLength: 64
diff --git a/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/runtime.yaml b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/runtime.yaml
new file mode 100644
index 000000000..0bb1dd4c2
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/dhis2-tracker-evidence/runtime.yaml
@@ -0,0 +1,22 @@
+version: 1
+bundleDirectory: /etc/registry-evidence/bundle
+listener:
+  bindHost: 127.0.0.1
+  port: 8080
+  tlsTermination: operator-controlled-upstream
+  trustProxyIdentityHeaders: false
+  maximumRequestBytes: 65536
+  maximumConcurrentRequests: 64
+  requestTimeoutMilliseconds: 10000
+  shutdownGraceMilliseconds: 30000
+secretProviders:
+  file:
+    root: /run/secrets/registry-evidence
+auditStorage:
+  path: /var/lib/registry-evidence/audit/evidence.jsonl
+  maximumFileBytes: 1073741824
+outboundTls:
+  systemRoots: true
+  trustProfiles:
+    government-internal-pki:
+      caBundleFile: /etc/registry-evidence/ca/government-internal.pem
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/README.md b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/README.md
new file mode 100644
index 000000000..dea7589b5
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/README.md
@@ -0,0 +1,126 @@
+# OpenCRVS family-evidence deployment project
+
+Status: deployment-shaped for a country configuration with governed stable
+parent references; not a generic OpenCRVS capability claim
+
+This complete target bundle uses one uniquely resolved registered birth event
+for three separate minimum-disclosure requirements:
+
+- adult status from `dateOfEvent`;
+- exact registered-parent confirmation against a separately authorized
+  candidate reference; and
+- identification of the registered parents as one or two audience-scoped
+  entity references.
+
+The reviewed governance bundle is under `bundle/`. Process-local paths and
+listener settings are in `runtime.yaml`. Deployments review and mount both
+inputs read-only, but staging and production may use different runtime files
+without changing evidence semantics.
+
+Both OpenCRVS sources reuse `birth-event-prepare.rhai`; the closed
+`selectorRole` parameter selects the already validated `subject` or `child`
+role. Extraction remains separate because the two sources validate and emit
+different facts.
+
+The event lookup sends only the child tracking ID. Extraction retains the
+returned tracking ID as a narrow fact, and each derivation requires it to equal
+the independently authorized child selector before producing a value. The
+candidate-parent reference comes from the authenticated grant and is supplied
+only to the relationship derivation. Raw parent references enter transient extraction and
+derivation but never production evidence, audit, logs, errors, metrics, traces,
+or failure artifacts. Sanitized synthetic references are intentionally present
+in local contract fixtures.
+
+## Deployment decisions
+
+Replace the separate `.example` OIDC, OpenCRVS authorization, and OpenCRVS
+Event Search hosts and every `urn:gov:example:*` identifier. Confirm the exact
+client capability or scope assigned by that deployment. In the family source,
+replace these illustrative declaration field identifiers:
+
+```text
+mother.personReference
+father.personReference
+```
+
+They must name the target country configuration's complete set of stable,
+opaque parent references from the same namespace used by the
+`civil-person-reference-v1` candidate selector. If the OpenCRVS deployment
+does not return such fields, this exact-reference configuration is not
+deployable unchanged.
+
+The example's closed source contract also states that:
+
+- `urn:gov:example:opencrvs:registered-parent-set:v1` identifies the reviewed
+  country-specific relationship-set semantics;
+- `urn:gov:example:opencrvs:person` is the shared candidate and source-reference
+  namespace;
+- absence of either configured declaration field authoritatively means no
+  registered parent in that slot, rather than unreturned or unavailable data;
+  and
+- at least one registered parent reference is required for this project.
+
+Those statements are trusted deployment governance, enforced through adapter
+parameters, fact schema constants, and derivation checks. They are not inferred
+from generic OpenCRVS behavior.
+
+A country may instead review a deterministic tuple comparison over returned
+attributes, such as an authoritative identifier plus date of birth. That is a
+different versioned derivation and selector profile. Fuzzy search, candidate
+ranking, and silent fallback from missing identifiers to names are not part of
+this example.
+
+The portable concepts say `registered parent`. Rename them to `legal parent`
+only when the jurisdiction explicitly governs the configured record fields and
+matching rule as proof of legal parentage. Registered parent, biological
+parent, guardian, and current parental responsibility are not interchangeable.
+
+## Negative evidence
+
+The relationship derivation may return `false` only when all of these are
+true:
+
+1. exactly one registered birth event was resolved;
+2. its returned tracking ID exactly matches the authorized child selector;
+3. the configured fields constitute the complete authoritative parent set;
+4. every present reference is valid and references are unique; and
+5. exact membership found no candidate match.
+
+No event, multiple events, missing declaration data, an empty parent set, a
+wrong type, or a namespace mismatch stops without a signed negative.
+
+## OAuth and secrets
+
+This example places the client credentials in the token request body, so no
+credential reaches a URL that an authorization server, proxy, or ingress may
+log. `form-body` and `basic-header` are the only placements Version 1 offers.
+Locally, the complete token URL, body, response, and debug output must be
+stripped or redacted, redirects denied, and token responses bounded.
+
+The token endpoint returns only `access_token` and `token_type`. RFC 6749
+section 5.1 makes `expires_in` recommended rather than required, so the bundle
+states `assumedLifetimeSeconds` and the cache stays clamped to
+`maximumCacheSeconds`.
+
+Required secret files beneath `/run/secrets/registry-evidence`, each owned by
+the service identity with mode `0600`, are:
+
+```text
+signing-ed25519-private-jwk
+audit-hmac-key
+subject-binding-hmac-key
+opencrvs-client-id
+opencrvs-client-secret
+```
+
+The audit and subject-binding files must contain independently generated raw
+key material of at least 32 bytes each; they are not base64-decoded. The
+signing file contains one private Ed25519 JWK. No credential or live subject
+identifier is stored in this project.
+
+Author with synthetic fixtures first, then promote the same reviewed `bundle/`
+bytes through staging and production. Bind environment-specific runtime paths,
+credentials, private CA, and signing key in each environment. Staging must
+verify the configured `at+jwt` header and claims, OAuth bootstrap, readiness,
+one approved synthetic source lookup, audit durability, and JWS verification.
+See the [authoring and production-build workflow](../CONFIG.md#authoring-and-production-build-workflow).
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/adapters/birth-adult-extract.rhai b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/adapters/birth-adult-extract.rhai
new file mode 100644
index 000000000..aef626d56
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/adapters/birth-adult-extract.rhai
@@ -0,0 +1,37 @@
+// The response schema has already refused anything outside the declared shape,
+// so what remains here is what a shape cannot state: how total relates to the
+// records returned, and which values must agree with the adapter parameters.
+fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    let results = source_response["results"];
+    if results.len > parameters["resultLimit"] { throw("source_protocol_error"); }
+
+    if total == 0 {
+        if results.len != 0 { throw("source_protocol_error"); }
+        return #{outcome: "no_match"};
+    }
+    if total > 1 {
+        if results.len < 2 { throw("source_protocol_error"); }
+        return #{outcome: "ambiguous"};
+    }
+    if results.len != 1 { throw("source_protocol_error"); }
+
+    let result = results[0];
+    // The shape cannot require these of every record, because the ambiguous
+    // page is decided before any record is read. The date field is named by an
+    // adapter parameter, so its presence is parameter-dependent besides.
+    if result["type"] != parameters["eventType"] ||
+       result["status"] != parameters["registeredStatus"] ||
+       is_missing(result["trackingId"]) ||
+       !result.contains(parameters["dateField"]) {
+        throw("source_protocol_error");
+    }
+
+    #{
+        outcome: "match",
+        facts: #{
+            record_tracking_id: result["trackingId"],
+            date_of_birth: result[parameters["dateField"]]
+        }
+    }
+}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/adapters/birth-event-prepare.rhai b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/adapters/birth-event-prepare.rhai
new file mode 100644
index 000000000..dbcbb93b4
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/adapters/birth-event-prepare.rhai
@@ -0,0 +1,18 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors[parameters["selectorRole"]];
+    #{
+        query: [],
+        body: #{
+            query: #{
+                type: "and",
+                clauses: [#{
+                    eventType: parameters["eventType"],
+                    status: #{type: "exact", term: parameters["registeredStatus"]},
+                    trackingId: #{type: "exact", term: subject["values"]["tracking_id"]}
+                }]
+            },
+            limit: parameters["resultLimit"],
+            offset: parameters["resultOffset"]
+        }
+    }
+}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/adapters/birth-parents-extract.rhai b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/adapters/birth-parents-extract.rhai
new file mode 100644
index 000000000..c810fa14e
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/adapters/birth-parents-extract.rhai
@@ -0,0 +1,60 @@
+// The response schema has already refused anything outside the declared shape,
+// so what remains here is what a shape cannot state: how total relates to the
+// records returned, which values must agree with the adapter parameters, and
+// how many distinct parent references a registered record must carry.
+fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    let results = source_response["results"];
+    if results.len > parameters["resultLimit"] { throw("source_protocol_error"); }
+
+    if total == 0 {
+        if results.len != 0 { throw("source_protocol_error"); }
+        return #{outcome: "no_match"};
+    }
+    if total > 1 {
+        if results.len < 2 { throw("source_protocol_error"); }
+        return #{outcome: "ambiguous"};
+    }
+    if results.len != 1 { throw("source_protocol_error"); }
+
+    let result = results[0];
+    // The shape cannot require these of every record, because the ambiguous
+    // page is decided before any record is read. A single matched record that
+    // omits one is a source this adapter does not understand. declaration is
+    // not checked here: it carries projected children, so a record without it
+    // never survives projection.
+    if result["type"] != parameters["eventType"] ||
+       result["status"] != parameters["registeredStatus"] ||
+       is_missing(result["trackingId"]) {
+        throw("source_protocol_error");
+    }
+
+    // The reference fields are named by an adapter parameter, and two named
+    // fields must not resolve to the same person, so this loop stays.
+    let parent_references = [];
+    for field in parameters["parentReferenceFields"] {
+        if result["declaration"].contains(field) {
+            let reference = result["declaration"][field];
+            if list_contains(parent_references, reference) {
+                throw("source_protocol_error");
+            }
+            parent_references.push(reference);
+        }
+    }
+
+    if parent_references.len < parameters["minimumParentReferences"] ||
+       parent_references.len > parameters["maximumParentReferences"] {
+        throw("source_protocol_error");
+    }
+
+    #{
+        outcome: "match",
+        facts: #{
+            record_tracking_id: result["trackingId"],
+            parent_references: parent_references,
+            reference_namespace: parameters["parentReferenceNamespace"],
+            relationship_set_contract: parameters["relationshipSetContract"],
+            relationship_set_complete: true
+        }
+    }
+}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/derivations/adult-status.rhai b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/derivations/adult-status.rhai
new file mode 100644
index 000000000..7c40ab498
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/derivations/adult-status.rhai
@@ -0,0 +1,18 @@
+fn derive(facts, selectors, evaluation_context) {
+    if facts["record_tracking_id"] !=
+       selectors["subject"]["values"]["tracking_id"] {
+        throw("derivation_input_error");
+    }
+    let date_of_birth = parse_date(required(
+        facts["date_of_birth"],
+        "required_fact_missing"
+    ));
+    let threshold = add_calendar_years(
+        date_of_birth,
+        evaluation_context["parameters"]["minimum_age_years"]
+    );
+    [#{
+        concept_id: "urn:gov:example:concept:adult-status",
+        value: compare_dates(evaluation_context["legal_local_date"], threshold) >= 0
+    }]
+}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/derivations/registered-parent-references.rhai b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/derivations/registered-parent-references.rhai
new file mode 100644
index 000000000..e7bfbbeaa
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/derivations/registered-parent-references.rhai
@@ -0,0 +1,37 @@
+fn derive(facts, selectors, evaluation_context) {
+    if facts["record_tracking_id"] !=
+       selectors["child"]["values"]["tracking_id"] {
+        throw("derivation_input_error");
+    }
+    let parent_references = required(
+        facts["parent_references"],
+        "required_fact_missing"
+    );
+    let complete = required(
+        facts["relationship_set_complete"],
+        "required_fact_missing"
+    );
+    let namespace = required(
+        facts["reference_namespace"],
+        "required_fact_missing"
+    );
+    let contract = required(
+        facts["relationship_set_contract"],
+        "required_fact_missing"
+    );
+    if complete != true ||
+       namespace != evaluation_context["parameters"]["reference_namespace"] ||
+       contract != evaluation_context["parameters"]["relationship_set_contract"] {
+        throw("derivation_input_error");
+    }
+    let seeds = [];
+    for reference in parent_references {
+        seeds.push(entity_reference_seed(
+            namespace + ":" + reference
+        ));
+    }
+    [#{
+        concept_id: "urn:gov:example:concept:registered-parent-references",
+        value: seeds
+    }]
+}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/derivations/registered-parent-relationship.rhai b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/derivations/registered-parent-relationship.rhai
new file mode 100644
index 000000000..7e67227f3
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/derivations/registered-parent-relationship.rhai
@@ -0,0 +1,40 @@
+fn derive(facts, selectors, evaluation_context) {
+    if evaluation_context["parameters"]["matching_policy"] !=
+       "exact-opaque-reference-v1" {
+        throw("derivation_input_error");
+    }
+
+    let candidate = selectors["candidate-parent"];
+    if facts["record_tracking_id"] !=
+       selectors["child"]["values"]["tracking_id"] {
+        throw("derivation_input_error");
+    }
+    let parent_references = required(
+        facts["parent_references"],
+        "required_fact_missing"
+    );
+    let complete = required(
+        facts["relationship_set_complete"],
+        "required_fact_missing"
+    );
+    let namespace = required(
+        facts["reference_namespace"],
+        "required_fact_missing"
+    );
+    let contract = required(
+        facts["relationship_set_contract"],
+        "required_fact_missing"
+    );
+    if complete != true ||
+       namespace != evaluation_context["parameters"]["candidate_reference_namespace"] ||
+       contract != evaluation_context["parameters"]["relationship_set_contract"] {
+        throw("derivation_input_error");
+    }
+    [#{
+        concept_id: "urn:gov:example:concept:registered-parent-relationship-confirmed",
+        value: list_contains(
+            parent_references,
+            candidate["values"]["person_reference"]
+        )
+    }]
+}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/evidence.yaml b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/evidence.yaml
new file mode 100644
index 000000000..e3ab68c52
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/evidence.yaml
@@ -0,0 +1,318 @@
+version: 1
+assuranceProfile: evidence-grade
+service:
+  providerId: urn:gov:example:evidence:opencrvs
+  trustDomain: urn:gov:example:trust-domain:civil-registration
+issuer:
+  id: urn:gov:example:issuer:civil-registration-authority
+authentication:
+  kind: oidc-access-token
+  issuer: https://identity.gov.example
+  audiences: [registry-evidence]
+  tokenTypes: [at+jwt]
+  algorithms: [EdDSA]
+  jwksUri: https://identity.gov.example/.well-known/jwks.json
+  principalClaim: sub
+  requesterTagsClaim: evidence_tags
+  evidenceAudienceClaim: evidence_audience
+  grantIdClaim: evidence_grant_id
+  grantAuthorityClaim: evidence_authority
+audit:
+  format: keyed-jsonl
+  hashSecretRef: secret:file/audit-hmac-key
+  hashKeyVersion: 1
+  failClosed: true
+subjectBinding:
+  secretRef: secret:file/subject-binding-hmac-key
+  keyVersion: 1
+rateLimits:
+  requestsPerPrincipalPerMinute: 60
+  burstPerPrincipal: 10
+  failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 10
+signing:
+  format: flattened-jws-json
+  algorithm: EdDSA
+  activeKeyId: evidence-signing-2026-01
+  activeKeyRef: secret:file/signing-ed25519-private-jwk
+  retiredPublicJwkFiles: []
+  jwksPath: /.well-known/evidence/jwks.json
+  maximumAssertionValiditySeconds: 86400
+  verifierClockSkewSeconds: 30
+responseFormats: [signed-jws]
+
+selectorProfiles:
+  opencrvs-tracking-id-v1:
+    maximumAggregateBytes: 64
+    fields:
+      tracking_id:
+        type: string
+        minimumBytes: 1
+        maximumBytes: 64
+  civil-person-reference-v1:
+    maximumAggregateBytes: 128
+    fields:
+      person_reference:
+        type: string
+        minimumBytes: 1
+        maximumBytes: 128
+sources:
+  registered-birth-date:
+    transport: http-json
+    baseUrl: https://events.opencrvs.gov.example
+    posture: record-transformed
+    authentication:
+      kind: oauth2-client-credentials
+      tokenEndpoint: https://auth.opencrvs.gov.example/token
+      clientIdRef: secret:file/opencrvs-client-id
+      clientSecretRef: secret:file/opencrvs-client-secret
+      scope: recordsearch
+      # The token endpoint accepts client credentials in the request body,
+      # so they never reach a URL that a proxy or ingress may log.
+      credentialPlacement: form-body
+      maximumCacheSeconds: 300
+      # OpenCRVS returns only access_token and token_type. RFC 6749 section
+      # 5.1 permits the omission, so the assumed lifetime is stated here and
+      # still clamped by maximumCacheSeconds.
+      assumedLifetimeSeconds: 600
+    request:
+      method: POST
+      path: /events/search
+      fixedHeaders:
+        - name: Accept
+          value: application/json
+      selectorInputs:
+        - role: subject
+          alternatives:
+            - profile: opencrvs-tracking-id-v1
+              fields: [tracking_id]
+      prepareScript: adapters/birth-event-prepare.rhai
+      adapterParameters:
+        selectorRole: subject
+        eventType: birth
+        registeredStatus: REGISTERED
+        resultLimit: 2
+        resultOffset: 0
+        dateField: dateOfEvent
+      adapterParametersSchema: schemas/birth-adult-parameters.schema.yaml
+      preparationLimits:
+        query: forbidden
+        jsonBody: required
+        maximumJsonDepth: 12
+        maximumCollectionItems: 32
+        maximumStringBytes: 512
+        maximumNormalizedBytes: 8192
+      projection:
+        - /total
+        - /results/*/type
+        - /results/*/status
+        - /results/*/trackingId
+        - /results/*/dateOfEvent
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 262144
+      concurrencyLimit: 8
+    # Shape contract for the projected response, checked before extraction runs.
+    responseSchema: schemas/birth-adult-response.schema.yaml
+    extractScript: adapters/birth-adult-extract.rhai
+    factSchema: schemas/birth-adult-facts.schema.yaml
+  registered-birth-parents:
+    transport: http-json
+    baseUrl: https://events.opencrvs.gov.example
+    posture: record-transformed
+    authentication:
+      kind: oauth2-client-credentials
+      tokenEndpoint: https://auth.opencrvs.gov.example/token
+      clientIdRef: secret:file/opencrvs-client-id
+      clientSecretRef: secret:file/opencrvs-client-secret
+      scope: recordsearch
+      # The token endpoint accepts client credentials in the request body,
+      # so they never reach a URL that a proxy or ingress may log.
+      credentialPlacement: form-body
+      maximumCacheSeconds: 300
+      # OpenCRVS returns only access_token and token_type. RFC 6749 section
+      # 5.1 permits the omission, so the assumed lifetime is stated here and
+      # still clamped by maximumCacheSeconds.
+      assumedLifetimeSeconds: 600
+    request:
+      method: POST
+      path: /events/search
+      fixedHeaders:
+        - name: Accept
+          value: application/json
+      selectorInputs:
+        - role: child
+          alternatives:
+            - profile: opencrvs-tracking-id-v1
+              fields: [tracking_id]
+      prepareScript: adapters/birth-event-prepare.rhai
+      adapterParameters:
+        selectorRole: child
+        eventType: birth
+        registeredStatus: REGISTERED
+        resultLimit: 2
+        resultOffset: 0
+        parentReferenceFields: [mother.personReference, father.personReference]
+        minimumParentReferences: 1
+        maximumParentReferences: 2
+        parentReferenceNamespace: urn:gov:example:opencrvs:person
+        relationshipSetContract: urn:gov:example:opencrvs:registered-parent-set:v1
+        relationshipSetComplete: true
+        absentConfiguredFieldMeansNoRegisteredParent: true
+      adapterParametersSchema: schemas/birth-parents-parameters.schema.yaml
+      preparationLimits:
+        query: forbidden
+        jsonBody: required
+        maximumJsonDepth: 12
+        maximumCollectionItems: 32
+        maximumStringBytes: 512
+        maximumNormalizedBytes: 8192
+      projection:
+        - /total
+        - /results/*/type
+        - /results/*/status
+        - /results/*/trackingId
+        - /results/*/declaration/mother.personReference
+        - /results/*/declaration/father.personReference
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 262144
+      concurrencyLimit: 8
+    # Shape contract for the projected response, checked before extraction runs.
+    responseSchema: schemas/birth-parents-response.schema.yaml
+    extractScript: adapters/birth-parents-extract.rhai
+    factSchema: schemas/birth-parents-facts.schema.yaml
+authorityProfiles:
+  civil-registration-caseworker-v1:
+    kind: statutory
+    requesterTags: [civil-registration-caseworker]
+    grants:
+      - requirement: urn:gov:example:requirement:adult-status-from-birth:v1
+        purpose: eligibility-assessment
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects:
+          - role: subject
+            selectorProfile: opencrvs-tracking-id-v1
+            valueOrigin: request
+      - requirement: urn:gov:example:requirement:registered-parent-relationship:v1
+        purpose: family-relationship-verification
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects:
+          - role: child
+            selectorProfile: opencrvs-tracking-id-v1
+            valueOrigin: request
+          - role: candidate-parent
+            selectorProfile: civil-person-reference-v1
+            valueOrigin: authenticated-grant
+            valueClaims:
+              person_reference: grant.candidate_parent.person_reference
+      - requirement: urn:gov:example:requirement:identify-registered-parents:v1
+        purpose: family-case-record
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects:
+          - role: child
+            selectorProfile: opencrvs-tracking-id-v1
+            valueOrigin: request
+requirements:
+  - id: urn:gov:example:requirement:adult-status-from-birth:v1
+    kind: criterion
+    source: registered-birth-date
+    purposes: [eligibility-assessment]
+    subjectRoles:
+      - role: subject
+        cardinality: one
+        selectorProfiles: [opencrvs-tracking-id-v1]
+    referenceFrameworks: [urn:gov:example:framework:age-of-majority:v1]
+    evidenceType: urn:gov:example:evidence-type:adult-status:v1
+    observationTimezone: Asia/Bangkok
+    validitySeconds: 86400
+    derivation:
+      script: derivations/adult-status.rhai
+      selectorInputs:
+        - role: subject
+          alternatives:
+            - profile: opencrvs-tracking-id-v1
+              fields: [tracking_id]
+      parameters: {minimum_age_years: 18}
+    concepts:
+      - id: urn:gov:example:concept:adult-status
+        form: boolean
+        required: true
+        constraints: {}
+    fixtures: fixtures/adult-status-cases.yaml
+    disclosureGuard:
+      families: [urn:gov:example:disclosure-family:adult-status]
+    existenceDisclosure: collapse-unresolved
+  - id: urn:gov:example:requirement:registered-parent-relationship:v1
+    kind: criterion
+    source: registered-birth-parents
+    purposes: [family-relationship-verification]
+    subjectRoles:
+      - role: child
+        cardinality: one
+        selectorProfiles: [opencrvs-tracking-id-v1]
+      - role: candidate-parent
+        cardinality: one
+        selectorProfiles: [civil-person-reference-v1]
+    referenceFrameworks: [urn:gov:example:framework:civil-registration-parent-record:v1]
+    evidenceType: urn:gov:example:evidence-type:registered-parent-relationship:v1
+    validitySeconds: 86400
+    derivation:
+      script: derivations/registered-parent-relationship.rhai
+      selectorInputs:
+        - role: child
+          alternatives:
+            - profile: opencrvs-tracking-id-v1
+              fields: [tracking_id]
+        - role: candidate-parent
+          alternatives:
+            - profile: civil-person-reference-v1
+              fields: [person_reference]
+      parameters:
+        matching_policy: exact-opaque-reference-v1
+        candidate_reference_namespace: urn:gov:example:opencrvs:person
+        relationship_set_contract: urn:gov:example:opencrvs:registered-parent-set:v1
+    concepts:
+      - id: urn:gov:example:concept:registered-parent-relationship-confirmed
+        form: boolean
+        required: true
+        constraints: {}
+    fixtures: fixtures/registered-parent-relationship-cases.yaml
+    disclosureGuard:
+      families: [urn:gov:example:disclosure-family:registered-parent-relationship]
+    existenceDisclosure: collapse-unresolved
+  - id: urn:gov:example:requirement:identify-registered-parents:v1
+    kind: information-requirement
+    source: registered-birth-parents
+    purposes: [family-case-record]
+    subjectRoles:
+      - role: child
+        cardinality: one
+        selectorProfiles: [opencrvs-tracking-id-v1]
+    referenceFrameworks: [urn:gov:example:framework:civil-registration-parent-record:v1]
+    evidenceType: urn:gov:example:evidence-type:registered-parent-references:v1
+    validitySeconds: 86400
+    derivation:
+      script: derivations/registered-parent-references.rhai
+      selectorInputs:
+        - role: child
+          alternatives:
+            - profile: opencrvs-tracking-id-v1
+              fields: [tracking_id]
+      parameters:
+        reference_namespace: urn:gov:example:opencrvs:person
+        relationship_set_contract: urn:gov:example:opencrvs:registered-parent-set:v1
+    concepts:
+      - id: urn:gov:example:concept:registered-parent-references
+        form: entity-reference-list
+        required: true
+        constraints:
+          minimumItems: 1
+          maximumItems: 2
+          unique: true
+    fixtures: fixtures/registered-parent-references-cases.yaml
+    disclosureGuard:
+      families: [urn:gov:example:disclosure-family:registered-parent-references]
+    existenceDisclosure: collapse-unresolved
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/fixtures/adult-status-cases.yaml b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/fixtures/adult-status-cases.yaml
new file mode 100644
index 000000000..dea35de27
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/fixtures/adult-status-cases.yaml
@@ -0,0 +1,150 @@
+fixture: registry.evidence.reference.opencrvs-adult-status/v1
+synthetic_only: true
+common:
+  observed_at: "2026-08-02T00:00:00Z"
+  selectors:
+    subject:
+      profile: opencrvs-tracking-id-v1
+      values: {tracking_id: TRACKING-SYNTHETIC-001}
+  derivationSelectorInputs:
+    subject:
+      profile: opencrvs-tracking-id-v1
+      values: {tracking_id: TRACKING-SYNTHETIC-001}
+  expectedRequestParts:
+    query: []
+    body:
+      query:
+        type: and
+        clauses:
+          - eventType: birth
+            status:
+              type: exact
+              term: REGISTERED
+            trackingId:
+              type: exact
+              term: TRACKING-SYNTHETIC-001
+      limit: 2
+      offset: 0
+  expectedTransport:
+    path: /events/search
+    fixedHeaders:
+      - name: Accept
+        value: application/json
+cases:
+  - id: positive
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-001
+          dateOfEvent: "2000-01-01"
+          declaration: {unrelated: SOURCE-UNRELATED-CANARY}
+    expected:
+      lookup: match
+      value: true
+      derivationRuns: true
+      signed: true
+  - id: negative-false-is-success
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-001
+          dateOfEvent: "2010-01-01"
+    expected:
+      lookup: match
+      value: false
+      derivationRuns: true
+      signed: true
+  - id: boundary-on
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-001
+          dateOfEvent: "2008-08-02"
+    expected:
+      lookup: match
+      value: true
+      derivationRuns: true
+      signed: true
+  - id: missing-fact
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-001
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+  - id: no-match
+    response:
+      total: 0
+      results: []
+    expected:
+      lookup: no_match
+      publicProblem: evidence_not_available
+      derivationRuns: false
+      signed: false
+  - id: ambiguous
+    response:
+      total: 2
+      results:
+        - type: birth
+          status: REGISTERED
+        - type: birth
+          status: REGISTERED
+    expected:
+      lookup: ambiguous
+      publicProblem: evidence_not_available
+      derivationRuns: false
+      signed: false
+  - id: fractional-total
+    response:
+      total: 0.5
+      results: []
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+  - id: wrong-status
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: DECLARED
+          dateOfEvent: "2000-01-01"
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+  - id: returned-subject-mismatch
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-OTHER
+          dateOfEvent: "2000-01-01"
+    expected:
+      lookup: match
+      error: derivation_input_error
+      derivationRuns: true
+      signed: false
+  - id: source-failure
+    sourceFailure: timeout
+    expected:
+      publicProblem: dependency_unavailable
+      signed: false
+  - id: anti-reconstruction
+    bundleMutation: duplicate-disclosure-family
+    expected: {bundle: rejected}
+privacyExpectation:
+  evidenceContains: [urn:gov:example:concept:adult-status]
+  evidenceExcludes: [date_of_birth, tracking_id, opencrvs-tracking-id-v1]
+  diagnosticsExclude: [TRACKING-SYNTHETIC-001, "2000-01-01", SOURCE-UNRELATED-CANARY]
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/fixtures/registered-parent-references-cases.yaml b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/fixtures/registered-parent-references-cases.yaml
new file mode 100644
index 000000000..f0aa2bc45
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/fixtures/registered-parent-references-cases.yaml
@@ -0,0 +1,157 @@
+fixture: registry.evidence.reference.opencrvs-registered-parent-references/v1
+synthetic_only: true
+common:
+  observed_at: "2026-08-02T00:00:00Z"
+  selectors:
+    child:
+      profile: opencrvs-tracking-id-v1
+      values: {tracking_id: TRACKING-SYNTHETIC-001}
+  derivationSelectorInputs:
+    child:
+      profile: opencrvs-tracking-id-v1
+      values: {tracking_id: TRACKING-SYNTHETIC-001}
+  expectedRequestParts:
+    query: []
+    body:
+      query:
+        type: and
+        clauses:
+          - eventType: birth
+            status:
+              type: exact
+              term: REGISTERED
+            trackingId:
+              type: exact
+              term: TRACKING-SYNTHETIC-001
+      limit: 2
+      offset: 0
+  expectedTransport:
+    path: /events/search
+    fixedHeaders:
+      - name: Accept
+        value: application/json
+cases:
+  - id: positive
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-001
+          declaration: {mother.personReference: PERSON-SYNTHETIC-A}
+    expected:
+      lookup: match
+      entityReferenceCount: 1
+      rawReferencesDisclosed: false
+      derivationRuns: true
+      signed: true
+  - id: boundary-two-parents
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-001
+          declaration:
+            mother.personReference: PERSON-SYNTHETIC-A
+            father.personReference: PERSON-SYNTHETIC-B
+            unrelated.field: SOURCE-UNRELATED-CANARY
+    expected:
+      lookup: match
+      entityReferenceCount: 2
+      rawReferencesDisclosed: false
+      derivationRuns: true
+      signed: true
+  - id: missing-parent-set
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-001
+          declaration: {}
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+  - id: no-match
+    response:
+      total: 0
+      results: []
+    expected:
+      lookup: no_match
+      publicProblem: evidence_not_available
+      derivationRuns: false
+      signed: false
+  - id: ambiguous-child
+    # The second record carries no leaf at all, only the declaration the
+    # projection insists on. An ambiguous page is refused before any record is
+    # read, so a response shape that demanded a complete record here would turn
+    # an ordinary ambiguous lookup into a source-protocol failure.
+    response:
+      total: 2
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-001
+          declaration: {mother.personReference: PERSON-SYNTHETIC-A}
+        - declaration: {}
+    expected:
+      lookup: ambiguous
+      publicProblem: evidence_not_available
+      derivationRuns: false
+      signed: false
+  - id: negative-matched-record-without-tracking-id
+    # The other side of the same rule: what a page need not carry, a single
+    # matched record must, and the script is what says so.
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          declaration: {mother.personReference: PERSON-SYNTHETIC-A}
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+  - id: negative-duplicate-parent-reference
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-001
+          declaration:
+            mother.personReference: PERSON-SYNTHETIC-A
+            father.personReference: PERSON-SYNTHETIC-A
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+  - id: source-failure
+    sourceFailure: timeout
+    expected:
+      publicProblem: dependency_unavailable
+      signed: false
+  - id: returned-child-mismatch
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-OTHER
+          declaration: {mother.personReference: PERSON-SYNTHETIC-A}
+    expected:
+      lookup: match
+      error: derivation_input_error
+      derivationRuns: true
+      signed: false
+  - id: anti-reconstruction
+    derivationMutation: return-raw-reference
+    expected:
+      outputGate: rejected
+      signed: false
+privacyExpectation:
+  evidenceContains: [urn:gov:example:concept:registered-parent-references]
+  evidenceExcludes: [parent_references, tracking_id, person_reference, relationship_set_contract]
+  diagnosticsExclude: [TRACKING-SYNTHETIC-001, PERSON-SYNTHETIC-A, PERSON-SYNTHETIC-B, SOURCE-UNRELATED-CANARY]
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/fixtures/registered-parent-relationship-cases.yaml b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/fixtures/registered-parent-relationship-cases.yaml
new file mode 100644
index 000000000..ef5a70bc5
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/fixtures/registered-parent-relationship-cases.yaml
@@ -0,0 +1,213 @@
+fixture: registry.evidence.reference.opencrvs-registered-parent-relationship/v1
+synthetic_only: true
+common:
+  observed_at: "2026-08-02T00:00:00Z"
+  selectors:
+    child:
+      profile: opencrvs-tracking-id-v1
+      values: {tracking_id: TRACKING-SYNTHETIC-001}
+    candidate-parent:
+      profile: civil-person-reference-v1
+      values: {person_reference: PERSON-SYNTHETIC-A}
+  derivationSelectorInputs:
+    child:
+      profile: opencrvs-tracking-id-v1
+      values: {tracking_id: TRACKING-SYNTHETIC-001}
+    candidate-parent:
+      profile: civil-person-reference-v1
+      values: {person_reference: PERSON-SYNTHETIC-A}
+  verified_token_claims:
+    evidence_grant_id: synthetic-parentage-grant-001
+    evidence_authority: civil-registration-caseworker-v1
+    grant:
+      candidate_parent: {person_reference: PERSON-SYNTHETIC-A}
+  expectedRequestParts:
+    query: []
+    body:
+      query:
+        type: and
+        clauses:
+          - eventType: birth
+            status:
+              type: exact
+              term: REGISTERED
+            trackingId:
+              type: exact
+              term: TRACKING-SYNTHETIC-001
+      limit: 2
+      offset: 0
+  expectedTransport:
+    path: /events/search
+    fixedHeaders:
+      - name: Accept
+        value: application/json
+cases:
+  - id: positive
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-001
+          declaration:
+            mother.personReference: PERSON-SYNTHETIC-A
+            father.personReference: PERSON-SYNTHETIC-B
+            unrelated.field: SOURCE-UNRELATED-CANARY
+    expected:
+      lookup: match
+      value: true
+      derivationRuns: true
+      signed: true
+  - id: negative-false-is-success
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-001
+          declaration: {father.personReference: PERSON-SYNTHETIC-B}
+    expected:
+      lookup: match
+      derivationRuns: true
+      facts:
+        record_tracking_id: TRACKING-SYNTHETIC-001
+        parent_references: [PERSON-SYNTHETIC-B]
+        reference_namespace: urn:gov:example:opencrvs:person
+        relationship_set_contract: urn:gov:example:opencrvs:registered-parent-set:v1
+        relationship_set_complete: true
+      value: false
+      signed: true
+  - id: boundary-one-parent
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-001
+          declaration: {mother.personReference: PERSON-SYNTHETIC-A}
+    expected:
+      lookup: match
+      value: true
+      derivationRuns: true
+      signed: true
+  - id: no-match
+    response:
+      total: 0
+      results: []
+    expected:
+      lookup: no_match
+      publicProblem: evidence_not_available
+      derivationRuns: false
+      signed: false
+  - id: ambiguous-child
+    # The second record carries no leaf at all, only the declaration the
+    # projection insists on. An ambiguous page is refused before any record is
+    # read, so a response shape that demanded a complete record here would turn
+    # an ordinary ambiguous lookup into a source-protocol failure.
+    response:
+      total: 2
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-001
+          declaration: {mother.personReference: PERSON-SYNTHETIC-A}
+        - declaration: {}
+    expected:
+      lookup: ambiguous
+      publicProblem: evidence_not_available
+      derivationRuns: false
+      signed: false
+  - id: matched-record-without-tracking-id
+    # The other side of the same rule: what a page need not carry, a single
+    # matched record must, and the script is what says so.
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          declaration: {mother.personReference: PERSON-SYNTHETIC-A}
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+  - id: missing-parent-set
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-001
+          declaration: {unrelated.field: SOURCE-UNRELATED-CANARY}
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+  - id: duplicate-parent-reference
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-001
+          declaration:
+            mother.personReference: PERSON-SYNTHETIC-A
+            father.personReference: PERSON-SYNTHETIC-A
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+  - id: wrong-parent-reference-type
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-001
+          declaration: {mother.personReference: 123}
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+  - id: namespace-mismatch
+    derivationParameterMutation: {candidate_reference_namespace: urn:gov:example:other:person}
+    expected:
+      signed: false
+      error: derivation_input_error
+      derivationRuns: true
+  - id: returned-child-mismatch
+    response:
+      total: 1
+      results:
+        - type: birth
+          status: REGISTERED
+          trackingId: TRACKING-SYNTHETIC-OTHER
+          declaration: {mother.personReference: PERSON-SYNTHETIC-A}
+    expected:
+      lookup: match
+      error: derivation_input_error
+      derivationRuns: true
+      signed: false
+  - id: swapped-roles
+    requestMutation: swap-subject-roles
+    expected:
+      rejectedBefore: source
+      sourceRequestCount: 0
+      signed: false
+  - id: caller-candidate-substitution
+    requestMutation: supply-grant-derived-candidate
+    expected:
+      rejectedBefore: source
+      sourceRequestCount: 0
+      signed: false
+  - id: source-failure
+    sourceFailure: timeout
+    expected:
+      publicProblem: dependency_unavailable
+      signed: false
+  - id: anti-reconstruction
+    bundleMutation: duplicate-disclosure-family
+    expected: {bundle: rejected}
+privacyExpectation:
+  evidenceContains: [urn:gov:example:concept:registered-parent-relationship-confirmed]
+  evidenceExcludes: [parent_references, tracking_id, person_reference, relationship_set_contract]
+  diagnosticsExclude: [TRACKING-SYNTHETIC-001, PERSON-SYNTHETIC-A, PERSON-SYNTHETIC-B, SOURCE-UNRELATED-CANARY]
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-adult-facts.schema.yaml b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-adult-facts.schema.yaml
new file mode 100644
index 000000000..0cd3d0153
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-adult-facts.schema.yaml
@@ -0,0 +1,11 @@
+type: object
+additionalProperties: false
+required: [record_tracking_id, date_of_birth]
+properties:
+  record_tracking_id:
+    type: string
+    minLength: 1
+    maxLength: 64
+  date_of_birth:
+    type: string
+    format: date
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-adult-parameters.schema.yaml b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-adult-parameters.schema.yaml
new file mode 100644
index 000000000..3440c14fb
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-adult-parameters.schema.yaml
@@ -0,0 +1,10 @@
+type: object
+additionalProperties: false
+required: [selectorRole, eventType, registeredStatus, resultLimit, resultOffset, dateField]
+properties:
+  selectorRole: {const: subject}
+  eventType: {const: birth}
+  registeredStatus: {const: REGISTERED}
+  resultLimit: {const: 2}
+  resultOffset: {const: 0}
+  dateField: {const: dateOfEvent}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-adult-response.schema.yaml b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-adult-response.schema.yaml
new file mode 100644
index 000000000..c5b42eba8
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-adult-response.schema.yaml
@@ -0,0 +1,39 @@
+# Shape of the projected event-search response, checked before extraction runs.
+# maxItems states the same page ceiling the request asks for, so an oversized
+# page is refused before any record reaches the script.
+type: object
+additionalProperties: false
+required: [total, results]
+properties:
+  total:
+    type: integer
+    minimum: 0
+    maximum: 1000000
+  results:
+    type: array
+    minItems: 0
+    maxItems: 2
+    items:
+      type: object
+      additionalProperties: false
+      # No projected leaf can be required of every record. Projection drops a
+      # leaf the record did not carry, and an ambiguous page is decided before
+      # any record is read, so a record on that page need not be complete.
+      # Which leaves a single matched record must carry stays with the script.
+      required: []
+      properties:
+        type:
+          type: string
+          minLength: 1
+          maxLength: 64
+        status:
+          type: string
+          minLength: 1
+          maxLength: 64
+        trackingId:
+          type: string
+          minLength: 1
+          maxLength: 64
+        dateOfEvent:
+          type: string
+          format: date
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-parents-facts.schema.yaml b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-parents-facts.schema.yaml
new file mode 100644
index 000000000..60e2b7551
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-parents-facts.schema.yaml
@@ -0,0 +1,25 @@
+type: object
+additionalProperties: false
+required:
+  - record_tracking_id
+  - parent_references
+  - reference_namespace
+  - relationship_set_contract
+  - relationship_set_complete
+properties:
+  record_tracking_id:
+    type: string
+    minLength: 1
+    maxLength: 64
+  parent_references:
+    type: array
+    minItems: 1
+    maxItems: 2
+    uniqueItems: true
+    items:
+      type: string
+      minLength: 1
+      maxLength: 128
+  reference_namespace: {const: urn:gov:example:opencrvs:person}
+  relationship_set_contract: {const: urn:gov:example:opencrvs:registered-parent-set:v1}
+  relationship_set_complete: {const: true}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-parents-parameters.schema.yaml b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-parents-parameters.schema.yaml
new file mode 100644
index 000000000..dee78e4c7
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-parents-parameters.schema.yaml
@@ -0,0 +1,36 @@
+type: object
+additionalProperties: false
+required:
+  - selectorRole
+  - eventType
+  - registeredStatus
+  - resultLimit
+  - resultOffset
+  - parentReferenceFields
+  - minimumParentReferences
+  - maximumParentReferences
+  - parentReferenceNamespace
+  - relationshipSetContract
+  - relationshipSetComplete
+  - absentConfiguredFieldMeansNoRegisteredParent
+properties:
+  selectorRole: {const: child}
+  eventType: {const: birth}
+  registeredStatus: {const: REGISTERED}
+  resultLimit: {const: 2}
+  resultOffset: {const: 0}
+  parentReferenceFields:
+    type: array
+    minItems: 1
+    maxItems: 2
+    uniqueItems: true
+    items:
+      type: string
+      minLength: 1
+      maxLength: 128
+  minimumParentReferences: {const: 1}
+  maximumParentReferences: {const: 2}
+  parentReferenceNamespace: {const: urn:gov:example:opencrvs:person}
+  relationshipSetContract: {const: urn:gov:example:opencrvs:registered-parent-set:v1}
+  relationshipSetComplete: {const: true}
+  absentConfiguredFieldMeansNoRegisteredParent: {const: true}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-parents-response.schema.yaml b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-parents-response.schema.yaml
new file mode 100644
index 000000000..f1808d22c
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/bundle/schemas/birth-parents-response.schema.yaml
@@ -0,0 +1,56 @@
+# Shape of the projected event-search response, checked before extraction runs.
+# maxItems states the same page ceiling the request asks for, so an oversized
+# page is refused before any record reaches the script.
+type: object
+additionalProperties: false
+required: [total, results]
+properties:
+  total:
+    type: integer
+    minimum: 0
+    maximum: 1000000
+  results:
+    type: array
+    minItems: 0
+    maxItems: 2
+    items:
+      type: object
+      additionalProperties: false
+      # No projected leaf can be required of every record. Projection drops a
+      # leaf the record did not carry, and an ambiguous page is decided before
+      # any record is read, so a record on that page need not be complete.
+      # Which leaves a single matched record must carry stays with the script.
+      # declaration is the one member a record cannot omit, because projection
+      # rejects a record missing an intermediate its children hang from, so
+      # saying so here would only repeat the projection.
+      required: []
+      properties:
+        type:
+          type: string
+          minLength: 1
+          maxLength: 64
+        status:
+          type: string
+          minLength: 1
+          maxLength: 64
+        trackingId:
+          type: string
+          minLength: 1
+          maxLength: 64
+        declaration:
+          type: object
+          additionalProperties: false
+          # Either parent reference may be absent from a registered record, so
+          # neither is required here. How many must be present, and whether the
+          # two may repeat one person, stays with the script: both are relations
+          # between fields that a shape cannot state.
+          required: []
+          properties:
+            mother.personReference:
+              type: string
+              minLength: 1
+              maxLength: 128
+            father.personReference:
+              type: string
+              minLength: 1
+              maxLength: 128
diff --git a/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/runtime.yaml b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/runtime.yaml
new file mode 100644
index 000000000..c50586401
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/opencrvs-family-evidence/runtime.yaml
@@ -0,0 +1,20 @@
+version: 1
+bundleDirectory: /etc/registry-evidence/bundle
+listener:
+  bindHost: 127.0.0.1
+  port: 8080
+  tlsTermination: operator-controlled-upstream
+  trustProxyIdentityHeaders: false
+  maximumRequestBytes: 65536
+  maximumConcurrentRequests: 64
+  requestTimeoutMilliseconds: 10000
+  shutdownGraceMilliseconds: 30000
+secretProviders:
+  file:
+    root: /run/secrets/registry-evidence
+auditStorage:
+  path: /var/lib/registry-evidence/audit/evidence.jsonl
+  maximumFileBytes: 1073741824
+outboundTls:
+  systemRoots: true
+  trustProfiles: {}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/README.md b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/README.md
new file mode 100644
index 000000000..2b406ee38
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/README.md
@@ -0,0 +1,124 @@
+# Protected-read deployment project
+
+This complete target bundle reads a protected, scoped, read-only registry API
+rather than a registry product's own API, and supports one minimum-disclosure
+requirement: residence region as a coarse controlled code.
+
+It is the pattern to copy when the registry data already sits behind an API
+that projects fields, filters by an exact reference, and reports whether a
+result page is complete. Registry Relay presents sources that way, so a Relay
+deployment is the worked example, but nothing in this bundle names Relay or
+depends on it. Any protected read with the same three properties fits.
+
+The reviewed governance bundle is under `bundle/`. Process-local paths and
+listener settings are in `runtime.yaml`. Deployments review and mount both
+files read-only, but staging and production may use different runtime files
+without changing evidence semantics.
+
+Before deployment, the operator changes only:
+
+- `.example` token-issuer and registry-API hosts;
+- the dataset, entity, and field names in the request path and
+  `providerFields`;
+- issuer, provider, trust-domain, framework, evidence-type, and concept URIs;
+- the codelist entries and disclosed region codes;
+- authority tags and purposes;
+- the referenced secret files; and
+- the runtime paths and listener binding.
+
+## Lookup shape
+
+The source performs one collection read filtered to exactly one record
+reference, projected to the two fields the requirement needs, with a page
+bound of two. A second page is never followed. That two-result ceiling is
+governed adapter policy declared by this reviewed bundle and rendered by
+`adapters/prepare.rhai`, so one bounded response separates a unique match from
+ambiguity. It is not a Rust domain rule and not a property of any registry
+product.
+
+This envelope reports no total count, only a page of records and a flag saying
+whether further pages exist. Uniqueness is therefore decided from both signals
+together: exactly one record and no further pages is a unique match, more than
+one record or a claim of further pages is ambiguous, and an empty page that
+still claims further pages contradicts itself and fails as a protocol error.
+That is the general shape for cursor-paginated collections; a provider that
+reports a total instead is read the way the tracker project reads its pager.
+
+A source that cannot distinguish zero, one, and multiple matches in one bounded
+request is not a Version 1 integration. See the
+[provider prerequisites](../CONFIG.md#provider-prerequisites).
+
+Because the protected read already restricts the response to the requested
+fields, the source declares `field-projected` posture. Extraction carries the
+returned record identifier only as a transient fact, and the derivation
+requires its exact equality with the authorized subject selector before
+evaluating anything else. A returned-record mismatch fails closed as the
+internal `derivation_input_error` category and collapses publicly into the same
+`evidence_not_available` problem as an unresolved lookup, so the caller cannot
+learn that a record was found.
+
+`providerFields` and `resultLimit` are strings because they become lexical URL
+query values, and both are pinned by the adapter-parameter schema: the field
+list is the projection this requirement is entitled to, and the page bound is
+the ambiguity signal, so neither is an operator dial.
+
+## Purpose declaration
+
+The registry API requires a declared purpose on every request. It is pinned as
+a fixed header in the reviewed bundle, so no caller and no script can widen the
+purpose the registry sees or record. The purpose the registry logs is the same
+purpose the authority profile grants and the assertion carries.
+
+## Residence region
+
+One record is resolved by exact reference and one controlled code is signed.
+The register's own region code never leaves the service: `codelists/`
+maps several register codes onto each disclosed region, and only the codes in
+`allowed_outputs` can pass the output gate. A register code with no reviewed
+mapping leaves the requirement unresolved rather than passing the precise code
+through, and a record carrying no region at all is refused by the fact schema
+before derivation runs, so an absent region can never be read as a region.
+
+## Authentication
+
+Inbound callers present access tokens from the deployment's own issuer. A
+deployment with no identity provider runs Registry Mint as that issuer:
+Evidence verifies Mint-issued tokens exactly the way it verifies any other OIDC
+issuer, and the protected registry API in front of the source data is pointed
+at the same issuer. Neither service depends on the other.
+
+Outbound, the source authenticates to the registry API with the OAuth 2.0
+client-credentials grant against that same issuer, placing the credentials in
+the form body and caching the token for at most a minute. A deployment whose
+registry API accepts a different credential kind changes only the source's
+`authentication` block.
+
+The registry API here is presented over ordinary public TLS, so `runtime.yaml`
+declares no private trust profile and the source names none. A deployment whose
+registry API sits behind an internal CA adds a profile to `outboundTls` and
+names it on the source, the way the other reference projects do.
+
+## Secrets
+
+Required secret files beneath `/run/secrets/registry-evidence`, each owned by
+the service identity with mode `0600`, are:
+
+```text
+signing-ed25519-private-jwk
+audit-hmac-key
+subject-binding-hmac-key
+registry-api-client-id
+registry-api-client-secret
+```
+
+The audit and subject-binding files must contain independently generated raw
+key material of at least 32 bytes each; they are not base64-decoded. The
+signing file contains one private Ed25519 JWK. No secret value is stored in
+this project.
+
+Author with synthetic fixtures first, then promote the same reviewed `bundle/`
+bytes through staging and production. Bind environment-specific runtime paths,
+credentials, and signing key in each environment. Staging must verify the
+configured `at+jwt` header and claims, readiness, one approved synthetic source
+lookup, audit durability, and JWS verification. See the
+[authoring and production-build workflow](../CONFIG.md#authoring-and-production-build-workflow).
diff --git a/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/adapters/prepare.rhai b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/adapters/prepare.rhai
new file mode 100644
index 000000000..afd0b834a
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/adapters/prepare.rhai
@@ -0,0 +1,11 @@
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"];
+    #{
+        query: [
+            #{name: "id", value: subject["values"]["record_reference"]},
+            #{name: "fields", value: parameters["providerFields"]},
+            #{name: "limit", value: parameters["resultLimit"]}
+        ],
+        body: ()
+    }
+}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/adapters/residence-region-extract.rhai b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/adapters/residence-region-extract.rhai
new file mode 100644
index 000000000..f81addd38
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/adapters/residence-region-extract.rhai
@@ -0,0 +1,42 @@
+// The protected read returns a page of matching records and a pagination
+// envelope that says whether further pages exist. It carries no total count,
+// so uniqueness is decided from the page itself: how many records came back,
+// and whether the provider claims more. The prepared request asks for a page
+// of two against an exact reference filter, which is the smallest page that
+// can still distinguish one match from several.
+
+fn extract(source_response, parameters) {
+    let records = source_response["data"];
+    let has_more = source_response["pagination"]["has_more"];
+
+    if records.len == 0 {
+        // An empty page that still claims further pages contradicts itself.
+        // Reading it as no match would turn a broken provider into a clean
+        // negative answer.
+        if has_more {
+            throw("source_protocol_error");
+        }
+        return #{outcome: "no_match"};
+    }
+    if records.len > 1 || has_more {
+        return #{outcome: "ambiguous"};
+    }
+
+    let record = records[0];
+    // The shape cannot require this of every record, because an ambiguous page
+    // is decided before any record is read. A single matched record with no
+    // reference of its own is a source this adapter does not understand.
+    if is_missing(record["id"]) {
+        throw("source_protocol_error");
+    }
+
+    let facts = #{record_reference: record["id"]};
+    // A record that carries no region is a record this requirement cannot
+    // answer from. The fact schema refuses it, which leaves the requirement
+    // unresolved rather than letting derivation invent a region.
+    if !is_missing(record["region"]) {
+        facts["official_residence_code"] = record["region"];
+    }
+
+    #{outcome: "match", facts: facts}
+}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/codelists/residence-regions.yaml b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/codelists/residence-regions.yaml
new file mode 100644
index 000000000..3b7b512d4
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/codelists/residence-regions.yaml
@@ -0,0 +1,11 @@
+id: urn:gov:example:codelist:residence-regions
+version: '2026-01'
+# Several register codes map onto one disclosed region. The mapping is the
+# minimization: the disclosed code is coarser than the code the register holds,
+# and only the outputs listed here can ever leave the service.
+entries:
+  R-101: REGION-NORTH
+  R-102: REGION-NORTH
+  R-201: REGION-SOUTH
+  R-202: REGION-SOUTH
+allowed_outputs: [REGION-NORTH, REGION-SOUTH]
diff --git a/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/derivations/residence-region.rhai b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/derivations/residence-region.rhai
new file mode 100644
index 000000000..320d72d72
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/derivations/residence-region.rhai
@@ -0,0 +1,19 @@
+fn derive(facts, selectors, evaluation_context) {
+    if facts["record_reference"] !=
+       selectors["subject"]["values"]["record_reference"] {
+        throw("derivation_input_error");
+    }
+    // The register's own region code is never disclosed. It is mapped to a
+    // coarser reviewed code, and a source code with no mapping leaves the
+    // requirement unresolved rather than passing the precise code through.
+    let mapped = codelist_lookup(
+        evaluation_context["codelists"]["residence-regions"],
+        required(facts["official_residence_code"], "required_fact_missing")
+    );
+    [
+        #{
+            concept_id: "urn:gov:example:concept:residence-region",
+            value: required(mapped, "unknown_controlled_code")
+        }
+    ]
+}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/evidence.yaml b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/evidence.yaml
new file mode 100644
index 000000000..2569af2e6
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/evidence.yaml
@@ -0,0 +1,155 @@
+version: 1
+assuranceProfile: evidence-grade
+service:
+  providerId: urn:gov:example:evidence:residence
+  trustDomain: urn:gov:example:trust-domain:social-protection
+issuer:
+  id: urn:gov:example:issuer:residence-authority
+# Inbound callers present access tokens from the deployment's own issuer. A
+# deployment with no identity provider runs Registry Mint as that issuer:
+# Evidence verifies Mint-issued tokens exactly the way it verifies any other
+# OIDC issuer, and the protected registry API in front of the source data is
+# pointed at the same issuer. Neither service depends on the other.
+authentication:
+  kind: oidc-access-token
+  issuer: https://tokens.gov.example
+  audiences: [registry-evidence]
+  tokenTypes: [at+jwt]
+  algorithms: [EdDSA]
+  jwksUri: https://tokens.gov.example/.well-known/jwks.json
+  principalClaim: sub
+  requesterTagsClaim: evidence_tags
+  evidenceAudienceClaim: evidence_audience
+  grantIdClaim: evidence_grant_id
+  grantAuthorityClaim: evidence_authority
+audit:
+  format: keyed-jsonl
+  hashSecretRef: secret:file/audit-hmac-key
+  hashKeyVersion: 1
+  failClosed: true
+subjectBinding:
+  secretRef: secret:file/subject-binding-hmac-key
+  keyVersion: 1
+rateLimits:
+  requestsPerPrincipalPerMinute: 60
+  burstPerPrincipal: 10
+  failedSelectorAttemptsPerPrincipalAuthorityPerMinute: 10
+signing:
+  format: flattened-jws-json
+  algorithm: EdDSA
+  activeKeyId: evidence-signing-2026-01
+  activeKeyRef: secret:file/signing-ed25519-private-jwk
+  retiredPublicJwkFiles: []
+  jwksPath: /.well-known/evidence/jwks.json
+  maximumAssertionValiditySeconds: 86400
+  verifierClockSkewSeconds: 30
+responseFormats: [signed-jws]
+
+selectorProfiles:
+  residence-record-v1:
+    maximumAggregateBytes: 96
+    fields:
+      record_reference:
+        type: string
+        minimumBytes: 1
+        maximumBytes: 64
+sources:
+  residence-register:
+    transport: http-json
+    baseUrl: https://registry-api.gov.example
+    # The protected read already restricts the response to the fields named in
+    # the request, and this deployment's projection keeps only two of them.
+    posture: field-projected
+    authentication:
+      kind: oauth2-client-credentials
+      tokenEndpoint: https://tokens.gov.example/oauth2/token
+      clientIdRef: secret:file/registry-api-client-id
+      clientSecretRef: secret:file/registry-api-client-secret
+      scope: registry.read
+      credentialPlacement: form-body
+      maximumCacheSeconds: 60
+    request:
+      method: GET
+      path: /v1/datasets/residence-register/entities/residence-record/records
+      fixedHeaders:
+        - name: Accept
+          value: application/json
+        # The protected read requires a declared purpose on every request. It
+        # is pinned here as reviewed bundle policy, so no caller and no script
+        # can widen the purpose the registry sees.
+        - name: Data-Purpose
+          value: https://relying.gov.example/purpose/residence-verification
+      selectorInputs:
+        - role: subject
+          alternatives:
+            - profile: residence-record-v1
+              fields: [record_reference]
+      prepareScript: adapters/prepare.rhai
+      adapterParameters:
+        providerFields: id,region
+        resultLimit: "2"
+      adapterParametersSchema: schemas/residence-region-adapter-parameters.schema.yaml
+      preparationLimits:
+        query: required
+        jsonBody: forbidden
+        maximumQueryPairs: 8
+        maximumQueryNameBytes: 64
+        maximumQueryValueBytes: 1024
+        maximumNormalizedBytes: 4096
+      projection:
+        - /data/*/id
+        - /data/*/region
+        - /pagination/has_more
+      redirects: deny
+      timeoutMilliseconds: 3000
+      maximumResponseBytes: 65536
+      concurrencyLimit: 8
+    # Shape contract for the projected response, checked before extraction runs.
+    responseSchema: schemas/residence-region-response.schema.yaml
+    extractScript: adapters/residence-region-extract.rhai
+    factSchema: schemas/residence-region-facts.schema.yaml
+authorityProfiles:
+  residence-verifier-v1:
+    kind: statutory
+    requesterTags: [residence-verifier]
+    grants:
+      - requirement: urn:gov:example:requirement:residence-region:v1
+        purpose: residence-verification
+        audienceFrom: authenticated-requester
+        responseFormats: [signed-jws]
+        subjects:
+          - role: subject
+            selectorProfile: residence-record-v1
+            valueOrigin: request
+requirements:
+  - id: urn:gov:example:requirement:residence-region:v1
+    kind: information-requirement
+    source: residence-register
+    purposes: [residence-verification]
+    subjectRoles:
+      - role: subject
+        cardinality: one
+        selectorProfiles: [residence-record-v1]
+    referenceFrameworks: [urn:gov:example:framework:residence-region:v1]
+    evidenceType: urn:gov:example:evidence-type:residence-region:v1
+    validitySeconds: 86400
+    derivation:
+      script: derivations/residence-region.rhai
+      selectorInputs:
+        - role: subject
+          alternatives:
+            - profile: residence-record-v1
+              fields: [record_reference]
+      parameters: {}
+    concepts:
+      - id: urn:gov:example:concept:residence-region
+        form: controlled-code
+        required: true
+        constraints:
+          codelist: codelists/residence-regions.yaml
+          codelistVersion: '2026-01'
+          maximumBytes: 32
+    fixtures: fixtures/residence-region-cases.yaml
+    disclosureGuard:
+      families: [urn:gov:example:disclosure-family:residence-region]
+    existenceDisclosure: collapse-unresolved
diff --git a/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/fixtures/residence-region-cases.yaml b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/fixtures/residence-region-cases.yaml
new file mode 100644
index 000000000..8cebd5c17
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/fixtures/residence-region-cases.yaml
@@ -0,0 +1,286 @@
+fixture: registry.evidence.reference.relay-residence-region/v1
+synthetic_only: true
+common:
+  observed_at: "2026-08-02T00:00:00Z"
+  selectors:
+    subject:
+      profile: residence-record-v1
+      values: {record_reference: REC-0001}
+  derivationSelectorInputs:
+    subject:
+      profile: residence-record-v1
+      values: {record_reference: REC-0001}
+  expectedRequestParts:
+    query:
+      - name: id
+        value: REC-0001
+      - name: fields
+        value: "id,region"
+      - name: limit
+        value: "2"
+    body: null
+  expectedTransport:
+    path: /v1/datasets/residence-register/entities/residence-record/records
+    fixedHeaders:
+      - name: Accept
+        value: application/json
+      - name: Data-Purpose
+        value: https://relying.gov.example/purpose/residence-verification
+cases:
+  # The record carries a field this requirement never asked for. The declared
+  # projection drops it before any script runs, so it cannot reach a fact, a
+  # derivation, or the signed assertion.
+  - id: positive
+    response:
+      data:
+        - id: REC-0001
+          region: R-101
+          area_geometry: SOURCE-UNRELATED-CANARY
+      pagination:
+        has_more: false
+        next_cursor: null
+    expected:
+      lookup: match
+      derivationRuns: true
+      signed: true
+      facts:
+        record_reference: REC-0001
+        official_residence_code: R-101
+      value: REGION-NORTH
+
+  # A second register code mapping to the same disclosed region proves the
+  # mapping is a real narrowing rather than a rename.
+  - id: boundary-second-source-code-same-region
+    response:
+      data:
+        - id: REC-0001
+          region: R-102
+      pagination:
+        has_more: false
+        next_cursor: null
+    expected:
+      lookup: match
+      derivationRuns: true
+      signed: true
+      value: REGION-NORTH
+
+  - id: boundary-other-region
+    response:
+      data:
+        - id: REC-0001
+          region: R-201
+      pagination:
+        has_more: false
+        next_cursor: null
+    expected:
+      lookup: match
+      derivationRuns: true
+      signed: true
+      value: REGION-SOUTH
+
+  # A register code with no reviewed mapping leaves the requirement unresolved.
+  # Disclosing the unmapped code, or guessing a region for it, would both cross
+  # the minimization boundary this codelist exists to hold.
+  - id: negative-unmapped-source-code
+    response:
+      data:
+        - id: REC-0001
+          region: R-999
+      pagination:
+        has_more: false
+        next_cursor: null
+    expected:
+      lookup: match
+      publicProblem: evidence_not_available
+      derivationRuns: true
+      signed: false
+
+  # A record with no region at all is refused by the fact schema, before
+  # derivation, so an absent region can never be read as a region.
+  - id: missing-fact
+    response:
+      data:
+        - id: REC-0001
+      pagination:
+        has_more: false
+        next_cursor: null
+    expected:
+      publicProblem: evidence_not_available
+      derivationRuns: false
+      signed: false
+
+  - id: no-match
+    response:
+      data: []
+      pagination:
+        has_more: false
+        next_cursor: null
+    expected:
+      lookup: no_match
+      publicProblem: evidence_not_available
+      derivationRuns: false
+      signed: false
+
+  # Two records on one page is the ordinary ambiguity signal.
+  - id: ambiguous-page
+    response:
+      data:
+        - id: REC-0001
+          region: R-101
+        - id: REC-0002
+          region: R-201
+      pagination:
+        has_more: true
+        next_cursor: CURSOR-SYNTHETIC-002
+    expected:
+      lookup: ambiguous
+      publicProblem: evidence_not_available
+      derivationRuns: false
+      signed: false
+
+  # This envelope reports no total, so a single record on a page that claims
+  # further pages is still ambiguous. A provider that paginates an exact
+  # reference filter has not proved the match is unique, and Version 1 makes
+  # exactly one evidence-data request, so the further pages are never fetched.
+  - id: ambiguous-further-pages
+    response:
+      data:
+        - id: REC-0001
+          region: R-101
+      pagination:
+        has_more: true
+        next_cursor: CURSOR-SYNTHETIC-002
+    expected:
+      lookup: ambiguous
+      publicProblem: evidence_not_available
+      derivationRuns: false
+      signed: false
+
+  - id: empty-page-claiming-more
+    response:
+      data: []
+      pagination:
+        has_more: true
+        next_cursor: CURSOR-SYNTHETIC-002
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+
+  - id: record-without-identifier
+    response:
+      data:
+        - region: R-101
+      pagination:
+        has_more: false
+        next_cursor: null
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+
+  - id: non-string-region
+    response:
+      data:
+        - id: REC-0001
+          region: 101
+      pagination:
+        has_more: false
+        next_cursor: null
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+
+  # A provider that ignores the requested page bound is a provider whose
+  # ambiguity signal cannot be trusted, so the page is not read at all.
+  - id: oversized-page
+    response:
+      data:
+        - id: REC-0001
+          region: R-101
+        - id: REC-0002
+          region: R-201
+        - id: REC-0003
+          region: R-202
+      pagination:
+        has_more: false
+        next_cursor: null
+    expected:
+      error: source_protocol_error
+      derivationRuns: false
+      signed: false
+
+  # A record returned under a different reference than the authorized one is an
+  # inconsistent input. It collapses publicly with the unresolved classes rather
+  # than signing a region for a record nobody asked about.
+  - id: returned-subject-mismatch
+    response:
+      data:
+        - id: REC-0002
+          region: R-201
+      pagination:
+        has_more: false
+        next_cursor: null
+    expected:
+      lookup: match
+      error: derivation_input_error
+      publicProblem: evidence_not_available
+      derivationRuns: true
+      signed: false
+
+  - id: source-failure
+    sourceFailure: timeout
+    expected:
+      publicProblem: dependency_unavailable
+      signed: false
+
+  # A protected read that answers with a sign-in page instead of JSON is a
+  # dependency failure, not evidence of anything about the subject.
+  - id: source-sign-in-page
+    sourceFailure: invalid-media-type
+    expected:
+      publicProblem: dependency_unavailable
+      signed: false
+
+  # The reference is caller-supplied. Rust materializes the transport, so a
+  # reference carrying query and header syntax lands percent-encoded inside one
+  # query value and cannot add a parameter, widen the field projection, or
+  # inject a header.
+  - id: hostile-reference
+    selectorOverrides:
+      subject:
+        values: {record_reference: "X&fields=*%0D%0AInjected:yes"}
+    expected:
+      sourceRequestCount: 1
+      expectedTransport:
+        path: /v1/datasets/residence-register/entities/residence-record/records
+        query: "id=X%26fields%3D%2A%250D%250AInjected%3Ayes&fields=id%2Cregion&limit=2"
+        body: null
+
+  - id: output-gate-refuses-a-raw-reference
+    derivationMutation: return-raw-reference
+    expected:
+      outputGate: rejected
+      signed: false
+
+  - id: anti-reconstruction
+    bundleMutation: duplicate-disclosure-family
+    expected: {bundle: rejected}
+privacyExpectation:
+  evidenceContains:
+    - urn:gov:example:concept:residence-region
+    - REGION-NORTH
+    - REGION-SOUTH
+  evidenceExcludes:
+    - official_residence_code
+    - record_reference
+    - residence-record-v1
+    - REC-0001
+    - REC-0002
+    - R-101
+    - R-102
+    - R-201
+    - area_geometry
+    - SOURCE-UNRELATED-CANARY
+  diagnosticsExclude: [REC-0001, REC-0002, R-101, R-201, SOURCE-UNRELATED-CANARY]
diff --git a/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/schemas/residence-region-adapter-parameters.schema.yaml b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/schemas/residence-region-adapter-parameters.schema.yaml
new file mode 100644
index 000000000..45315fa62
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/schemas/residence-region-adapter-parameters.schema.yaml
@@ -0,0 +1,9 @@
+type: object
+additionalProperties: false
+required: [providerFields, resultLimit]
+properties:
+  # Both parameters are pinned. The field list is the projection the protected
+  # read applies, and the page size is the smallest one that can still tell a
+  # unique match from an ambiguous one, so neither is an operator dial.
+  providerFields: {const: "id,region"}
+  resultLimit: {const: "2"}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/schemas/residence-region-facts.schema.yaml b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/schemas/residence-region-facts.schema.yaml
new file mode 100644
index 000000000..c69a313e8
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/schemas/residence-region-facts.schema.yaml
@@ -0,0 +1,12 @@
+type: object
+additionalProperties: false
+required: [record_reference, official_residence_code]
+properties:
+  record_reference:
+    type: string
+    minLength: 1
+    maxLength: 64
+  official_residence_code:
+    type: string
+    minLength: 1
+    maxLength: 32
diff --git a/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/schemas/residence-region-response.schema.yaml b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/schemas/residence-region-response.schema.yaml
new file mode 100644
index 000000000..c0f025bc3
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/bundle/schemas/residence-region-response.schema.yaml
@@ -0,0 +1,35 @@
+# Shape of the projected collection response, checked before extraction runs.
+# The prepared request asks for a page of two, so a third record is a provider
+# that ignored the bound rather than an ambiguous lookup. Whether the page and
+# the further-pages flag agree stays with the script: that is a reading across
+# fields, not a shape.
+type: object
+additionalProperties: false
+required: [data, pagination]
+properties:
+  data:
+    type: array
+    minItems: 0
+    maxItems: 2
+    items:
+      type: object
+      additionalProperties: false
+      # No projected leaf can be required of every record. Projection drops a
+      # leaf the record did not carry, and an ambiguous page is decided before
+      # any record is read, so a record on that page need not be complete.
+      required: []
+      properties:
+        id:
+          type: string
+          minLength: 1
+          maxLength: 64
+        region:
+          type: string
+          minLength: 1
+          maxLength: 32
+  pagination:
+    type: object
+    additionalProperties: false
+    required: [has_more]
+    properties:
+      has_more: {type: boolean}
diff --git a/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/runtime.yaml b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/runtime.yaml
new file mode 100644
index 000000000..6d1cf4e77
--- /dev/null
+++ b/products/evidence/reference/request-adapter/deployment-projects/relay-protected-read-evidence/runtime.yaml
@@ -0,0 +1,24 @@
+version: 1
+bundleDirectory: /etc/registry-evidence/bundle
+listener:
+  bindHost: 127.0.0.1
+  port: 8080
+  tlsTermination: operator-controlled-upstream
+  trustProxyIdentityHeaders: false
+  maximumRequestBytes: 65536
+  maximumConcurrentRequests: 64
+  requestTimeoutMilliseconds: 10000
+  shutdownGraceMilliseconds: 30000
+secretProviders:
+  file:
+    root: /run/secrets/registry-evidence
+auditStorage:
+  path: /var/lib/registry-evidence/audit/evidence.jsonl
+  maximumFileBytes: 1073741824
+# The registry API this project reads is presented over ordinary public TLS,
+# so no private trust profile is declared and the source names none. A
+# deployment whose registry API sits behind an internal CA adds a profile here
+# and names it on the source, the way the other reference projects do.
+outboundTls:
+  systemRoots: true
+  trustProfiles: {}
diff --git a/products/evidence/reference/request-adapter/dhis2-tracker/expected-lookup-result.json b/products/evidence/reference/request-adapter/dhis2-tracker/expected-lookup-result.json
new file mode 100644
index 000000000..b84ee6330
--- /dev/null
+++ b/products/evidence/reference/request-adapter/dhis2-tracker/expected-lookup-result.json
@@ -0,0 +1,6 @@
+{
+  "outcome": "match",
+  "facts": {
+    "status_code": "SYNTHETIC-ACTIVE"
+  }
+}
diff --git a/products/evidence/reference/request-adapter/dhis2-tracker/expected-request-parts.json b/products/evidence/reference/request-adapter/dhis2-tracker/expected-request-parts.json
new file mode 100644
index 000000000..b7f4e5cf0
--- /dev/null
+++ b/products/evidence/reference/request-adapter/dhis2-tracker/expected-request-parts.json
@@ -0,0 +1,14 @@
+{
+  "query": [
+    {"name": "program", "value": "Prg00000001"},
+    {"name": "orgUnits", "value": "Org00000001"},
+    {"name": "fields", "value": "trackedEntity,attributes[attribute,value]"},
+    {"name": "pageSize", "value": "2"},
+    {"name": "page", "value": "1"},
+    {"name": "totalPages", "value": "true"},
+    {"name": "filter", "value": "Gvn00000001:EQ:Synthetic"},
+    {"name": "filter", "value": "Fam00000001:EQ:Subject"},
+    {"name": "filter", "value": "Dob00000001:EQ:2000-02-29"}
+  ],
+  "body": null
+}
diff --git a/products/evidence/reference/request-adapter/dhis2-tracker/extract.rhai b/products/evidence/reference/request-adapter/dhis2-tracker/extract.rhai
new file mode 100644
index 000000000..90be5ed38
--- /dev/null
+++ b/products/evidence/reference/request-adapter/dhis2-tracker/extract.rhai
@@ -0,0 +1,53 @@
+// Extraction runs with fresh state and receives no selectors or request parts.
+// The response schema has already refused any envelope outside the declared
+// pager and record shape, so what remains is the part a shape cannot state:
+// the page count agreeing with the total, and the one attribute this
+// requirement names.
+
+fn extract(source_response, parameters) {
+    let pager = source_response["pager"];
+    let records = source_response["trackedEntities"];
+
+    let expected_page_count =
+        (pager["total"] + pager["pageSize"] - 1) / pager["pageSize"];
+    if pager["pageCount"] != expected_page_count {
+        throw("source_protocol_error");
+    }
+
+    if pager["total"] == 0 {
+        if records.len != 0 {
+            throw("source_protocol_error");
+        }
+        return #{outcome: "no_match"};
+    }
+
+    if pager["total"] > 1 {
+        if records.len != 2 {
+            throw("source_protocol_error");
+        }
+        return #{outcome: "ambiguous"};
+    }
+
+    if records.len != 1 {
+        throw("source_protocol_error");
+    }
+
+    let record = records[0];
+    let found_status = false;
+    let status_code = ();
+    for attribute in record["attributes"] {
+        if attribute["attribute"] == parameters["statusAttribute"] {
+            if found_status {
+                throw("source_protocol_error");
+            }
+            found_status = true;
+            status_code = attribute["value"];
+        }
+    }
+
+    if !found_status {
+        throw("source_protocol_error");
+    }
+
+    #{outcome: "match", facts: #{status_code: status_code}}
+}
diff --git a/products/evidence/reference/request-adapter/dhis2-tracker/facts.schema.yaml b/products/evidence/reference/request-adapter/dhis2-tracker/facts.schema.yaml
new file mode 100644
index 000000000..a46e863f8
--- /dev/null
+++ b/products/evidence/reference/request-adapter/dhis2-tracker/facts.schema.yaml
@@ -0,0 +1,8 @@
+type: object
+additionalProperties: false
+required: [status_code]
+properties:
+  status_code:
+    type: string
+    minLength: 1
+    maxLength: 64
diff --git a/products/evidence/reference/request-adapter/dhis2-tracker/parameters.schema.yaml b/products/evidence/reference/request-adapter/dhis2-tracker/parameters.schema.yaml
new file mode 100644
index 000000000..fa6c23c89
--- /dev/null
+++ b/products/evidence/reference/request-adapter/dhis2-tracker/parameters.schema.yaml
@@ -0,0 +1,27 @@
+type: object
+additionalProperties: false
+required:
+  - program
+  - organisationUnit
+  - projection
+  - pageSize
+  - page
+  - totalPages
+  - attributes
+  - statusAttribute
+properties:
+  program: {type: string, minLength: 1, maxLength: 64}
+  organisationUnit: {type: string, minLength: 1, maxLength: 64}
+  projection: {type: string, minLength: 1, maxLength: 1024}
+  pageSize: {const: "2"}
+  page: {const: "1"}
+  totalPages: {const: "true"}
+  attributes:
+    type: object
+    additionalProperties: false
+    required: [given_name, family_name, birth_date]
+    properties:
+      given_name: {type: string, minLength: 1, maxLength: 64}
+      family_name: {type: string, minLength: 1, maxLength: 64}
+      birth_date: {type: string, minLength: 1, maxLength: 64}
+  statusAttribute: {type: string, minLength: 1, maxLength: 64}
diff --git a/products/evidence/reference/request-adapter/dhis2-tracker/prepare-input.json b/products/evidence/reference/request-adapter/dhis2-tracker/prepare-input.json
new file mode 100644
index 000000000..80f7845c7
--- /dev/null
+++ b/products/evidence/reference/request-adapter/dhis2-tracker/prepare-input.json
@@ -0,0 +1,26 @@
+{
+  "selectors": {
+    "subject": {
+      "profile": "person-demographics-v1",
+      "values": {
+        "given_name": "Synthetic",
+        "family_name": "Subject",
+        "birth_date": "2000-02-29"
+      }
+    }
+  },
+  "parameters": {
+    "program": "Prg00000001",
+    "organisationUnit": "Org00000001",
+    "projection": "trackedEntity,attributes[attribute,value]",
+    "pageSize": "2",
+    "page": "1",
+    "totalPages": "true",
+    "attributes": {
+      "given_name": "Gvn00000001",
+      "family_name": "Fam00000001",
+      "birth_date": "Dob00000001"
+    },
+    "statusAttribute": "Sta00000001"
+  }
+}
diff --git a/products/evidence/reference/request-adapter/dhis2-tracker/prepare.rhai b/products/evidence/reference/request-adapter/dhis2-tracker/prepare.rhai
new file mode 100644
index 000000000..bdeb02f9f
--- /dev/null
+++ b/products/evidence/reference/request-adapter/dhis2-tracker/prepare.rhai
@@ -0,0 +1,59 @@
+// Exploratory trusted request preparation. Rust supplies only authorized
+// selectors and non-secret parameters from the immutable bundle.
+
+fn dhis2_filter_value(value) {
+    // DHIS2 uses slash escaping inside filter expressions. Rust performs URL
+    // encoding on the complete raw query value after preparation.
+    let escaped = value;
+    escaped.replace("/", "//");
+    escaped.replace(":", "/:");
+    escaped.replace(",", "/,");
+    escaped
+}
+
+fn exact_filter(attribute, value) {
+    attribute + ":EQ:" + dhis2_filter_value(value)
+}
+
+fn prepare(selectors, parameters) {
+    let subject = selectors["subject"];
+    let query = [
+        #{name: "program", value: parameters["program"]},
+        #{name: "orgUnits", value: parameters["organisationUnit"]},
+        #{name: "fields", value: parameters["projection"]},
+        #{name: "pageSize", value: parameters["pageSize"]},
+        #{name: "page", value: parameters["page"]},
+        #{name: "totalPages", value: parameters["totalPages"]}
+    ];
+
+    let values = subject["values"];
+    if subject["profile"] == "tracked-entity-id-v1" {
+        query.push(#{name: "trackedEntities", value: values["record_reference"]});
+    } else if subject["profile"] == "person-demographics-v1" {
+        query.push(#{
+            name: "filter",
+            value: exact_filter(
+                parameters["attributes"]["given_name"],
+                values["given_name"]
+            )
+        });
+        query.push(#{
+            name: "filter",
+            value: exact_filter(
+                parameters["attributes"]["family_name"],
+                values["family_name"]
+            )
+        });
+        query.push(#{
+            name: "filter",
+            value: exact_filter(
+                parameters["attributes"]["birth_date"],
+                values["birth_date"]
+            )
+        });
+    } else {
+        throw("adapter_input_error");
+    }
+
+    #{query: query, body: ()}
+}
diff --git a/products/evidence/reference/request-adapter/dhis2-tracker/response-malformed-count.json b/products/evidence/reference/request-adapter/dhis2-tracker/response-malformed-count.json
new file mode 100644
index 000000000..f6bf469e4
--- /dev/null
+++ b/products/evidence/reference/request-adapter/dhis2-tracker/response-malformed-count.json
@@ -0,0 +1,16 @@
+{
+  "pager": {
+    "page": 1,
+    "pageSize": 2,
+    "total": 0.5,
+    "pageCount": 1
+  },
+  "trackedEntities": [
+    {
+      "trackedEntity": "Tes00000002",
+      "attributes": [
+        {"attribute": "Sta00000001", "value": "SYNTHETIC-ACTIVE"}
+      ]
+    }
+  ]
+}
diff --git a/products/evidence/reference/request-adapter/dhis2-tracker/response-match.json b/products/evidence/reference/request-adapter/dhis2-tracker/response-match.json
new file mode 100644
index 000000000..5d4991952
--- /dev/null
+++ b/products/evidence/reference/request-adapter/dhis2-tracker/response-match.json
@@ -0,0 +1,16 @@
+{
+  "pager": {
+    "page": 1,
+    "pageSize": 2,
+    "total": 1,
+    "pageCount": 1
+  },
+  "trackedEntities": [
+    {
+      "trackedEntity": "Tes00000001",
+      "attributes": [
+        {"attribute": "Sta00000001", "value": "SYNTHETIC-ACTIVE"}
+      ]
+    }
+  ]
+}
diff --git a/products/evidence/reference/request-adapter/dhis2-tracker/response.schema.yaml b/products/evidence/reference/request-adapter/dhis2-tracker/response.schema.yaml
new file mode 100644
index 000000000..fba4b7291
--- /dev/null
+++ b/products/evidence/reference/request-adapter/dhis2-tracker/response.schema.yaml
@@ -0,0 +1,44 @@
+# Shape of the projected tracker response, checked by Rust before extract/2
+# runs. The prepared request asks for page 1 of size 2, so the pager echo is a
+# constant here rather than a comparison the script repeats.
+type: object
+additionalProperties: false
+required: [pager, trackedEntities]
+properties:
+  pager:
+    type: object
+    additionalProperties: false
+    required: [page, pageSize, total, pageCount]
+    properties:
+      page: {type: integer, const: 1}
+      pageSize: {type: integer, const: 2}
+      total: {type: integer, minimum: 0, maximum: 1000000}
+      pageCount: {type: integer, minimum: 0, maximum: 1000000}
+  trackedEntities:
+    type: array
+    minItems: 0
+    maxItems: 2
+    items:
+      type: object
+      additionalProperties: false
+      # No projected leaf can be required of every record. Projection drops a
+      # leaf the record did not carry, and an ambiguous page is decided from
+      # the pager before any record is read, so a record on that page need not
+      # be complete. What a single matched record must carry stays with the
+      # script. attributes is not listed either: projection rejects a record
+      # missing an intermediate its children hang from, so saying so here would
+      # only repeat the projection.
+      required: []
+      properties:
+        trackedEntity: {type: string, minLength: 1, maxLength: 64}
+        attributes:
+          type: array
+          minItems: 0
+          maxItems: 64
+          items:
+            type: object
+            additionalProperties: false
+            required: [attribute, value]
+            properties:
+              attribute: {type: string, minLength: 1, maxLength: 64}
+              value: {type: string, maxLength: 512}
diff --git a/products/evidence/reference/request-adapter/dhis2-tracker/source.yaml b/products/evidence/reference/request-adapter/dhis2-tracker/source.yaml
new file mode 100644
index 000000000..d4d74aea1
--- /dev/null
+++ b/products/evidence/reference/request-adapter/dhis2-tracker/source.yaml
@@ -0,0 +1,55 @@
+# Focused executable DHIS2 adapter fragment. For a deployable governed bundle
+# and runtime binding, use deployment-projects/dhis2-tracker-evidence/.
+transport: http-json
+baseUrl: https://tracker.example.invalid
+posture: record-transformed
+authentication:
+  kind: basic
+  usernameRef: secret:file/tracker-username
+  passwordRef: secret:file/tracker-password
+request:
+  method: GET
+  path: /api/tracker/trackedEntities
+  fixedHeaders:
+    - {name: Accept, value: application/json}
+  selectorInputs:
+    - role: subject
+      alternatives:
+        - {profile: tracked-entity-id-v1, fields: [record_reference]}
+        - {profile: person-demographics-v1, fields: [given_name, family_name, birth_date]}
+  prepareScript: prepare.rhai
+  adapterParameters:
+    program: Prg00000001
+    organisationUnit: Org00000001
+    projection: trackedEntity,attributes[attribute,value]
+    pageSize: "2"
+    page: "1"
+    totalPages: "true"
+    attributes:
+      given_name: Gvn00000001
+      family_name: Fam00000001
+      birth_date: Dob00000001
+    statusAttribute: Sta00000001
+  adapterParametersSchema: parameters.schema.yaml
+  preparationLimits:
+    query: allowed
+    jsonBody: forbidden
+    maximumQueryPairs: 16
+    maximumQueryNameBytes: 64
+    maximumQueryValueBytes: 1024
+    maximumNormalizedBytes: 8192
+  projection:
+    - /pager/page
+    - /pager/pageSize
+    - /pager/total
+    - /pager/pageCount
+    - /trackedEntities/*/trackedEntity
+    - /trackedEntities/*/attributes/*/attribute
+    - /trackedEntities/*/attributes/*/value
+  redirects: deny
+  timeoutMilliseconds: 3000
+  maximumResponseBytes: 65536
+  concurrencyLimit: 4
+responseSchema: response.schema.yaml
+extractScript: extract.rhai
+factSchema: facts.schema.yaml
diff --git a/products/evidence/reference/request-adapter/opencrvs-event-search/expected-lookup-result.json b/products/evidence/reference/request-adapter/opencrvs-event-search/expected-lookup-result.json
new file mode 100644
index 000000000..c5c071523
--- /dev/null
+++ b/products/evidence/reference/request-adapter/opencrvs-event-search/expected-lookup-result.json
@@ -0,0 +1,10 @@
+{
+  "outcome": "match",
+  "facts": {
+    "record_tracking_id": "EVT-SYNTHETIC-001",
+    "parent_references": ["PERSON-SYNTHETIC-A", "PERSON-SYNTHETIC-B"],
+    "reference_namespace": "urn:gov:example:opencrvs:person",
+    "relationship_set_contract": "urn:gov:example:opencrvs:registered-parent-set:v1",
+    "relationship_set_complete": true
+  }
+}
diff --git a/products/evidence/reference/request-adapter/opencrvs-event-search/expected-request-parts.json b/products/evidence/reference/request-adapter/opencrvs-event-search/expected-request-parts.json
new file mode 100644
index 000000000..cf9b78ba7
--- /dev/null
+++ b/products/evidence/reference/request-adapter/opencrvs-event-search/expected-request-parts.json
@@ -0,0 +1,17 @@
+{
+  "query": [],
+  "body": {
+    "query": {
+      "type": "and",
+      "clauses": [
+        {
+          "eventType": "birth",
+          "status": {"type": "exact", "term": "REGISTERED"},
+          "trackingId": {"type": "exact", "term": "EVT-SYNTHETIC-001"}
+        }
+      ]
+    },
+    "limit": 2,
+    "offset": 0
+  }
+}
diff --git a/products/evidence/reference/request-adapter/opencrvs-event-search/extract.rhai b/products/evidence/reference/request-adapter/opencrvs-event-search/extract.rhai
new file mode 100644
index 000000000..e1a42f85e
--- /dev/null
+++ b/products/evidence/reference/request-adapter/opencrvs-event-search/extract.rhai
@@ -0,0 +1,62 @@
+// Extraction validates one exact child-event result and returns only the
+// configured complete parent-reference set. Relationship comparison belongs
+// to the selector-aware requirement derivation.
+//
+// The response schema has already refused anything outside the declared shape,
+// so what remains is the part a shape cannot state: how total relates to the
+// records returned, which values must agree with the adapter parameters, and
+// how many distinct parent references a registered record must carry.
+
+fn extract(source_response, parameters) {
+    let total = source_response["total"];
+    let results = source_response["results"];
+    if results.len > parameters["resultLimit"] { throw("source_protocol_error"); }
+
+    if total == 0 {
+        if results.len != 0 { throw("source_protocol_error"); }
+        return #{outcome: "no_match"};
+    }
+    if total > 1 {
+        if results.len < 2 { throw("source_protocol_error"); }
+        return #{outcome: "ambiguous"};
+    }
+    if results.len != 1 { throw("source_protocol_error"); }
+
+    let result = results[0];
+    // The shape cannot require these of every record, because the ambiguous
+    // page is decided before any record is read. A single matched record that
+    // omits one is a source this adapter does not understand. declaration is
+    // not checked here: it carries projected children, so a record without it
+    // never survives projection.
+    if result["type"] != parameters["eventType"] ||
+       result["status"] != parameters["registeredStatus"] ||
+       is_missing(result["trackingId"]) {
+        throw("source_protocol_error");
+    }
+
+    let parent_references = [];
+    for field in parameters["parentReferenceFields"] {
+        if result["declaration"].contains(field) {
+            let reference = result["declaration"][field];
+            if list_contains(parent_references, reference) {
+                throw("source_protocol_error");
+            }
+            parent_references.push(reference);
+        }
+    }
+    if parent_references.len < parameters["minimumParentReferences"] ||
+       parent_references.len > parameters["maximumParentReferences"] {
+        throw("source_protocol_error");
+    }
+
+    #{
+        outcome: "match",
+        facts: #{
+            record_tracking_id: result["trackingId"],
+            parent_references: parent_references,
+            reference_namespace: parameters["parentReferenceNamespace"],
+            relationship_set_contract: parameters["relationshipSetContract"],
+            relationship_set_complete: true
+        }
+    }
+}
diff --git a/products/evidence/reference/request-adapter/opencrvs-event-search/facts.schema.yaml b/products/evidence/reference/request-adapter/opencrvs-event-search/facts.schema.yaml
new file mode 100644
index 000000000..a6771e182
--- /dev/null
+++ b/products/evidence/reference/request-adapter/opencrvs-event-search/facts.schema.yaml
@@ -0,0 +1,19 @@
+type: object
+additionalProperties: false
+required:
+  - record_tracking_id
+  - parent_references
+  - reference_namespace
+  - relationship_set_contract
+  - relationship_set_complete
+properties:
+  record_tracking_id: {type: string, minLength: 1, maxLength: 64}
+  parent_references:
+    type: array
+    minItems: 1
+    maxItems: 2
+    uniqueItems: true
+    items: {type: string, minLength: 1, maxLength: 128}
+  reference_namespace: {const: urn:gov:example:opencrvs:person}
+  relationship_set_contract: {const: urn:gov:example:opencrvs:registered-parent-set:v1}
+  relationship_set_complete: {const: true}
diff --git a/products/evidence/reference/request-adapter/opencrvs-event-search/parameters.schema.yaml b/products/evidence/reference/request-adapter/opencrvs-event-search/parameters.schema.yaml
new file mode 100644
index 000000000..9fea49e97
--- /dev/null
+++ b/products/evidence/reference/request-adapter/opencrvs-event-search/parameters.schema.yaml
@@ -0,0 +1,31 @@
+type: object
+additionalProperties: false
+required:
+  - eventType
+  - registeredStatus
+  - resultLimit
+  - resultOffset
+  - parentReferenceFields
+  - minimumParentReferences
+  - maximumParentReferences
+  - parentReferenceNamespace
+  - relationshipSetContract
+  - relationshipSetComplete
+  - absentConfiguredFieldMeansNoRegisteredParent
+properties:
+  eventType: {const: birth}
+  registeredStatus: {const: REGISTERED}
+  resultLimit: {const: 2}
+  resultOffset: {const: 0}
+  parentReferenceFields:
+    type: array
+    minItems: 1
+    maxItems: 2
+    uniqueItems: true
+    items: {type: string, minLength: 1, maxLength: 128}
+  minimumParentReferences: {const: 1}
+  maximumParentReferences: {const: 2}
+  parentReferenceNamespace: {const: urn:gov:example:opencrvs:person}
+  relationshipSetContract: {const: urn:gov:example:opencrvs:registered-parent-set:v1}
+  relationshipSetComplete: {const: true}
+  absentConfiguredFieldMeansNoRegisteredParent: {const: true}
diff --git a/products/evidence/reference/request-adapter/opencrvs-event-search/prepare-input.json b/products/evidence/reference/request-adapter/opencrvs-event-search/prepare-input.json
new file mode 100644
index 000000000..0fd4800e1
--- /dev/null
+++ b/products/evidence/reference/request-adapter/opencrvs-event-search/prepare-input.json
@@ -0,0 +1,24 @@
+{
+  "selectors": {
+    "child": {
+      "profile": "opencrvs-tracking-id-v1",
+      "values": {"tracking_id": "EVT-SYNTHETIC-001"}
+    }
+  },
+  "parameters": {
+    "eventType": "birth",
+    "registeredStatus": "REGISTERED",
+    "resultLimit": 2,
+    "resultOffset": 0,
+    "parentReferenceFields": [
+      "mother.personReference",
+      "father.personReference"
+    ],
+    "minimumParentReferences": 1,
+    "maximumParentReferences": 2,
+    "parentReferenceNamespace": "urn:gov:example:opencrvs:person",
+    "relationshipSetContract": "urn:gov:example:opencrvs:registered-parent-set:v1",
+    "relationshipSetComplete": true,
+    "absentConfiguredFieldMeansNoRegisteredParent": true
+  }
+}
diff --git a/products/evidence/reference/request-adapter/opencrvs-event-search/prepare.rhai b/products/evidence/reference/request-adapter/opencrvs-event-search/prepare.rhai
new file mode 100644
index 000000000..b27b08f7c
--- /dev/null
+++ b/products/evidence/reference/request-adapter/opencrvs-event-search/prepare.rhai
@@ -0,0 +1,21 @@
+// Exploratory exact OpenCRVS child-event request preparation. It has no
+// credentials, transport authority, or network access.
+
+fn prepare(selectors, parameters) {
+    let child = selectors["child"];
+    #{
+        query: [],
+        body: #{
+            query: #{
+                type: "and",
+                clauses: [#{
+                    eventType: parameters["eventType"],
+                    status: #{type: "exact", term: parameters["registeredStatus"]},
+                    trackingId: #{type: "exact", term: child["values"]["tracking_id"]}
+                }]
+            },
+            limit: parameters["resultLimit"],
+            offset: parameters["resultOffset"]
+        }
+    }
+}
diff --git a/products/evidence/reference/request-adapter/opencrvs-event-search/response-malformed-count.json b/products/evidence/reference/request-adapter/opencrvs-event-search/response-malformed-count.json
new file mode 100644
index 000000000..013dd570a
--- /dev/null
+++ b/products/evidence/reference/request-adapter/opencrvs-event-search/response-malformed-count.json
@@ -0,0 +1,10 @@
+{
+  "results": [
+    {
+      "id": "00000000-0000-4000-8000-000000000002",
+      "type": "birth",
+      "status": "REGISTERED"
+    }
+  ],
+  "total": 0.5
+}
diff --git a/products/evidence/reference/request-adapter/opencrvs-event-search/response-match.json b/products/evidence/reference/request-adapter/opencrvs-event-search/response-match.json
new file mode 100644
index 000000000..1ae9c7a05
--- /dev/null
+++ b/products/evidence/reference/request-adapter/opencrvs-event-search/response-match.json
@@ -0,0 +1,17 @@
+{
+  "results": [
+    {
+      "id": "00000000-0000-4000-8000-000000000001",
+      "trackingId": "EVT-SYNTHETIC-001",
+      "type": "birth",
+      "status": "REGISTERED",
+      "dateOfEvent": "2015-04-03",
+      "declaration": {
+        "mother.personReference": "PERSON-SYNTHETIC-A",
+        "father.personReference": "PERSON-SYNTHETIC-B",
+        "unrelated.field": "SOURCE-UNRELATED-CANARY"
+      }
+    }
+  ],
+  "total": 1
+}
diff --git a/products/evidence/reference/request-adapter/opencrvs-event-search/response.schema.yaml b/products/evidence/reference/request-adapter/opencrvs-event-search/response.schema.yaml
new file mode 100644
index 000000000..b9a2d6b67
--- /dev/null
+++ b/products/evidence/reference/request-adapter/opencrvs-event-search/response.schema.yaml
@@ -0,0 +1,35 @@
+# Shape of the projected event-search response, checked by Rust before
+# extract/2 runs. Neither parent reference is required: a registered record may
+# name one parent or two, and how many suffice is a requirement decision the
+# script keeps.
+type: object
+additionalProperties: false
+required: [total, results]
+properties:
+  total: {type: integer, minimum: 0, maximum: 1000000}
+  results:
+    type: array
+    minItems: 0
+    maxItems: 2
+    items:
+      type: object
+      additionalProperties: false
+      # No projected leaf can be required of every record. Projection drops a
+      # leaf the record did not carry, and an ambiguous page is decided before
+      # any record is read, so a record on that page need not be complete.
+      # Which leaves a single matched record must carry stays with the script.
+      # declaration is the one member a record cannot omit, because projection
+      # rejects a record missing an intermediate its children hang from, so
+      # saying so here would only repeat the projection.
+      required: []
+      properties:
+        type: {type: string, minLength: 1, maxLength: 64}
+        status: {type: string, minLength: 1, maxLength: 64}
+        trackingId: {type: string, minLength: 1, maxLength: 64}
+        declaration:
+          type: object
+          additionalProperties: false
+          required: []
+          properties:
+            mother.personReference: {type: string, minLength: 1, maxLength: 128}
+            father.personReference: {type: string, minLength: 1, maxLength: 128}
diff --git a/products/evidence/reference/request-adapter/opencrvs-event-search/source.yaml b/products/evidence/reference/request-adapter/opencrvs-event-search/source.yaml
new file mode 100644
index 000000000..06db7da48
--- /dev/null
+++ b/products/evidence/reference/request-adapter/opencrvs-event-search/source.yaml
@@ -0,0 +1,65 @@
+# Focused executable OpenCRVS adapter fragment. For a deployable governed
+# bundle and runtime binding, use deployment-projects/opencrvs-family-evidence/.
+transport: http-json
+baseUrl: https://events.opencrvs.example.invalid
+posture: record-transformed
+authentication:
+  kind: oauth2-client-credentials
+  tokenEndpoint: https://auth.opencrvs.example.invalid/token
+  clientIdRef: secret:file/events-client-id
+  clientSecretRef: secret:file/events-client-secret
+  scope: recordsearch
+  # The token endpoint accepts client credentials in the request body, so
+  # they never reach a URL that a proxy or ingress may log. The evidence-data
+  # request still uses Authorization: Bearer.
+  credentialPlacement: form-body
+  maximumCacheSeconds: 300
+  # OpenCRVS returns only access_token and token_type. RFC 6749 section
+  # 5.1 permits the omission, so the assumed lifetime is stated here and
+  # still clamped by maximumCacheSeconds.
+  assumedLifetimeSeconds: 600
+request:
+  method: POST
+  path: /events/search
+  fixedHeaders:
+    - {name: Accept, value: application/json}
+  selectorInputs:
+    - role: child
+      alternatives:
+        - {profile: opencrvs-tracking-id-v1, fields: [tracking_id]}
+  prepareScript: prepare.rhai
+  adapterParameters:
+    eventType: birth
+    registeredStatus: REGISTERED
+    resultLimit: 2
+    resultOffset: 0
+    parentReferenceFields: [mother.personReference, father.personReference]
+    minimumParentReferences: 1
+    maximumParentReferences: 2
+    parentReferenceNamespace: urn:gov:example:opencrvs:person
+    relationshipSetContract: urn:gov:example:opencrvs:registered-parent-set:v1
+    relationshipSetComplete: true
+    absentConfiguredFieldMeansNoRegisteredParent: true
+  adapterParametersSchema: parameters.schema.yaml
+  preparationLimits:
+    query: forbidden
+    jsonBody: required
+    maximumJsonDepth: 16
+    maximumCollectionItems: 128
+    maximumStringBytes: 1024
+    maximumNormalizedBytes: 16384
+  # Client-side allowlist, not provider-side EventIndex field selection.
+  projection:
+    - /total
+    - /results/*/type
+    - /results/*/status
+    - /results/*/trackingId
+    - /results/*/declaration/mother.personReference
+    - /results/*/declaration/father.personReference
+  redirects: deny
+  timeoutMilliseconds: 3000
+  maximumResponseBytes: 262144
+  concurrencyLimit: 4
+responseSchema: response.schema.yaml
+extractScript: extract.rhai
+factSchema: facts.schema.yaml
diff --git a/products/evidence/scripts/check-contracts.sh b/products/evidence/scripts/check-contracts.sh
new file mode 100755
index 000000000..c36d833fb
--- /dev/null
+++ b/products/evidence/scripts/check-contracts.sh
@@ -0,0 +1,28 @@
+#!/bin/sh
+set -eu
+
+repository_root=$(CDPATH= cd -- "$(dirname -- "$0")/../../.." && pwd)
+committed_root="$repository_root/products/evidence/generated"
+temporary_root=$(mktemp -d)
+trap 'rm -rf "$temporary_root"' EXIT HUP INT TERM
+generated_root="$temporary_root/generated"
+
+if [ ! -d "$committed_root" ]; then
+  echo "Evidence generated contract directory is missing: $committed_root" >&2
+  exit 1
+fi
+
+cd "$repository_root"
+CARGO_INCREMENTAL=0 CARGO_PROFILE_DEV_DEBUG=0 CARGO_PROFILE_TEST_DEBUG=0 \
+  cargo test --locked --quiet -p registry-evidence --test security_contract_traceability
+CARGO_INCREMENTAL=0 CARGO_PROFILE_DEV_DEBUG=0 CARGO_PROFILE_TEST_DEBUG=0 \
+  cargo run --locked --quiet -p registry-evidence --example evidence-contracts -- \
+  --output "$generated_root"
+
+if ! diff -ru "$committed_root" "$generated_root"; then
+  echo 'Evidence generated contracts differ from the committed artifacts.' >&2
+  echo 'Regenerate into a separate directory and review the complete contract diff.' >&2
+  exit 1
+fi
+
+echo 'Evidence generated contracts reproduce exactly.'
diff --git a/products/evidence/scripts/check-source-neutrality.sh b/products/evidence/scripts/check-source-neutrality.sh
new file mode 100755
index 000000000..561a5c431
--- /dev/null
+++ b/products/evidence/scripts/check-source-neutrality.sh
@@ -0,0 +1,155 @@
+#!/bin/sh
+set -eu
+
+repository_root=$(CDPATH= cd -- "$(dirname -- "$0")/../../.." && pwd)
+temporary_root=$(mktemp -d)
+trap 'rm -rf "$temporary_root"' EXIT HUP INT TERM
+production_text="$temporary_root/production-rust.txt"
+
+: >"$production_text"
+for source_file in $(
+  rg --files \
+    "$repository_root/crates/registry-evidence/src" \
+    "$repository_root/crates/registry-evidencectl/src" \
+    -g '*.rs' | sort
+); do
+  case "$source_file" in
+    *_tests.rs) continue ;;
+  esac
+  python3 - "$source_file" >>"$production_text" <<'PY'
+import re
+import sys
+
+source = open(sys.argv[1], encoding="utf-8").read()
+masked = list(source)
+i = 0
+block_depth = 0
+while i < len(source):
+    if block_depth:
+        if source.startswith("/*", i):
+            masked[i:i + 2] = "  "
+            block_depth += 1
+            i += 2
+        elif source.startswith("*/", i):
+            masked[i:i + 2] = "  "
+            block_depth -= 1
+            i += 2
+        else:
+            if source[i] != "\n":
+                masked[i] = " "
+            i += 1
+        continue
+    if source.startswith("//", i):
+        end = source.find("\n", i)
+        end = len(source) if end < 0 else end
+        masked[i:end] = " " * (end - i)
+        i = end
+        continue
+    if source.startswith("/*", i):
+        masked[i:i + 2] = "  "
+        block_depth = 1
+        i += 2
+        continue
+    raw = re.match(r'(?:b?r)(?P<hashes>#{0,255})"', source[i:])
+    if raw:
+        marker = '"' + raw.group("hashes")
+        start = i
+        i += raw.end()
+        end = source.find(marker, i)
+        i = len(source) if end < 0 else end + len(marker)
+        for position in range(start, i):
+            if source[position] != "\n":
+                masked[position] = " "
+        continue
+    prefix = 1 if source.startswith('"', i) else 2 if source.startswith('b"', i) else 0
+    if prefix:
+        start = i
+        i += prefix
+        while i < len(source):
+            if source[i] == "\\":
+                i += 2
+            elif source[i] == '"':
+                i += 1
+                break
+            else:
+                i += 1
+        for position in range(start, min(i, len(source))):
+            if source[position] != "\n":
+                masked[position] = " "
+        continue
+    char_prefix = 2 if source.startswith("b'", i) else 1 if source.startswith("'", i) else 0
+    if char_prefix:
+        start = i
+        cursor = i + char_prefix
+        if cursor < len(source) and source[cursor] == "\\":
+            cursor += 2
+        else:
+            cursor += 1
+        if cursor < len(source) and source[cursor] == "'":
+            i = cursor + 1
+            for position in range(start, i):
+                if source[position] != "\n":
+                    masked[position] = " "
+            continue
+    i += 1
+
+code = "".join(masked)
+spans = []
+for match in re.finditer(r'#\s*\[\s*cfg\s*\(\s*test\s*\)\s*\]', code):
+    start = match.start()
+    cursor = match.end()
+    opener = None
+    while cursor < len(code):
+        if code[cursor] in "{;":
+            opener = code[cursor]
+            break
+        cursor += 1
+    if opener is None or opener == ";":
+        end = min(cursor + 1, len(code))
+    else:
+        depth = 0
+        while cursor < len(code):
+            if code[cursor] == "{":
+                depth += 1
+            elif code[cursor] == "}":
+                depth -= 1
+                if depth == 0:
+                    cursor += 1
+                    break
+            cursor += 1
+        end = cursor
+    spans.append((start, end))
+
+cursor = 0
+for start, end in spans:
+    if start < cursor:
+        continue
+    sys.stdout.write(source[cursor:start])
+    cursor = end
+sys.stdout.write(source[cursor:])
+PY
+done
+
+if rg -n -i 'dhis2|opencrvs' \
+  "$production_text" \
+  "$repository_root/crates/registry-evidence/Cargo.toml" \
+  "$repository_root/crates/registry-evidencectl/Cargo.toml" \
+  "$repository_root/Cargo.toml"; then
+  echo 'Evidence production code, adopter tooling, or Cargo metadata contains a prohibited source-product name.' >&2
+  exit 1
+fi
+
+if rg -n -i 'adult|age[_ -]?at|residence|licen[cs]e|parentage|legal[_ -]?parent|given_name|family_name|birth_date|national[_ -]?identifier' \
+  "$production_text"; then
+  echo 'Evidence production Rust or adopter tooling contains acceptance-case or jurisdiction-specific vocabulary.' >&2
+  exit 1
+fi
+
+generated_root="$repository_root/products/evidence/generated"
+contract_root="$repository_root/products/evidence/contracts"
+if rg -n -i 'dhis2|opencrvs' "$generated_root" "$contract_root"; then
+  echo 'Evidence public configuration or generated contracts contain a prohibited source-product name.' >&2
+  exit 1
+fi
+
+echo 'Evidence source-product and domain neutrality checks passed.'
diff --git a/products/evidence/scripts/sd-jwt-vc-demo.sh b/products/evidence/scripts/sd-jwt-vc-demo.sh
new file mode 100755
index 000000000..c7a86b4ed
--- /dev/null
+++ b/products/evidence/scripts/sd-jwt-vc-demo.sh
@@ -0,0 +1,274 @@
+#!/usr/bin/env bash
+# Run the Evidence SD-JWT VC demo end to end with curl.
+#
+# The demo is deterministic and credential-free: a local mock stands in for the
+# upstream source and an in-memory test JWKS authenticates the requester. No
+# DHIS2, OpenCRVS, or other live provider is called and nothing is written
+# outside products/evidence/.sd-jwt-vc-demo/.
+#
+# The steps are the ones a relying party actually performs: request the signed
+# default, request the same assertion as an SD-JWT VC, fetch the issuer's keys
+# from the published metadata route, and re-verify the stored credential
+# offline against a policy built from the accepted transaction.
+set -euo pipefail
+
+repository_root=$(CDPATH= cd -- "$(dirname -- "$0")/../../.." && pwd)
+state_root="$repository_root/products/evidence/.sd-jwt-vc-demo"
+# The demo runs from the repository root, so the printed commands use paths
+# relative to it and can be pasted into another terminal unchanged.
+state_relative=${state_root#"$repository_root"/}
+harness_log="$state_root/harness.log"
+base_url="http://127.0.0.1:18081"
+readiness_timeout_seconds=600
+harness_pid=
+
+for tool in cargo curl jq; do
+  if ! command -v "$tool" >/dev/null 2>&1; then
+    printf 'The demo needs %s on PATH.\n' "$tool" >&2
+    exit 1
+  fi
+done
+
+# Decode one unpadded base64url segment read from standard input. jq is already
+# required above, so the demo needs no GNU-only coreutils.
+decode_base64url() {
+  jq -Rr '
+    (gsub("-"; "+") | gsub("_"; "/")) as $standard
+    | ((4 - ($standard | length) % 4) % 4) as $padding
+    | (if $padding == 0 then $standard else $standard + ("=" * $padding) end)
+    | @base64d
+  '
+}
+
+# Print a curl invocation in copy-pasteable flag form and then run it.
+#
+# The configuration is fed to curl on standard input so the bearer token never
+# reaches a command line or a process listing. The printed form preserves that
+# guarantee: an Authorization header is always rendered as the shell variable
+# name, never as its value.
+run_curl() {
+  local config=$1
+  local prefix="$repository_root/"
+  local line key value url=
+  local -a rendered=()
+  while IFS= read -r line; do
+    [[ -n "$line" ]] || continue
+    if [[ "$line" != *" = "* ]]; then
+      rendered+=("--$line")
+      continue
+    fi
+    key=${line%% = *}
+    value=${line#* = }
+    value=${value#\"}
+    value=${value%\"}
+    value=${value//"$prefix"/}
+    case "$key" in
+      url)
+        url=$value
+        continue
+        ;;
+      header)
+        if [[ "$value" == Authorization:* ]]; then
+          # shellcheck disable=SC2016 # the variable name is the output, not its value
+          value='Authorization: Bearer $EVIDENCE_ACCESS_TOKEN'
+        fi
+        ;;
+    esac
+    rendered+=("--$key '$value'")
+  done <<<"$config"
+
+  printf '   $ curl'
+  for line in "${rendered[@]}"; do
+    printf ' \\\n       %s' "$line"
+  done
+  printf ' \\\n       %s\n' "$url"
+
+  curl --config - <<<"$config"
+}
+
+# cargo spawns the test binary as a child, so terminating cargo alone would
+# leave the server holding the port. Job control puts the harness in its own
+# process group, and the group is what gets signalled.
+cleanup() {
+  if [[ -n "$harness_pid" ]] && kill -0 "$harness_pid" 2>/dev/null; then
+    kill -TERM -- -"$harness_pid" 2>/dev/null || kill -TERM "$harness_pid" 2>/dev/null || true
+    wait "$harness_pid" 2>/dev/null || true
+  fi
+  unset EVIDENCE_ACCESS_TOKEN
+}
+trap cleanup EXIT HUP INT PIPE TERM
+
+cd "$repository_root"
+mkdir -p "$state_root"
+chmod 700 "$state_root"
+rm -f "$harness_log"
+
+if curl --silent --output /dev/null --max-time 2 "$base_url/health"; then
+  printf 'Something is already serving %s. Stop it before running the demo.\n' "$base_url" >&2
+  exit 1
+fi
+
+printf 'Starting the deterministic Evidence demo server. The first run compiles the crate.\n'
+set -m
+CARGO_INCREMENTAL=0 \
+  CARGO_PROFILE_DEV_DEBUG=0 \
+  CARGO_PROFILE_TEST_DEBUG=0 \
+  cargo test --locked -p registry-evidence \
+  sd_jwt_vc_demo_serves_a_credential_for_curl \
+  -- --ignored --nocapture >"$harness_log" 2>&1 &
+harness_pid=$!
+set +m
+
+waited=0
+until grep -q 'demo server is ready' "$harness_log" 2>/dev/null; do
+  if ! kill -0 "$harness_pid" 2>/dev/null; then
+    printf 'The demo server exited before it was ready:\n' >&2
+    cat "$harness_log" >&2
+    exit 1
+  fi
+  if ((waited >= readiness_timeout_seconds)); then
+    printf 'The demo server was not ready within %ss.\n' "$readiness_timeout_seconds" >&2
+    cat "$harness_log" >&2
+    exit 1
+  fi
+  sleep 2
+  waited=$((waited + 2))
+done
+printf 'Server ready at %s\n\n' "$base_url"
+
+# The short-lived synthetic bearer token stays in shell memory and is passed to
+# curl through standard input, never on a command line and never in the log.
+set -a
+# shellcheck source=/dev/null
+. "$state_root/session.env"
+set +a
+
+printf '1. Fetch the issuer keys from the published metadata route (no token)\n'
+run_curl "$(
+  cat <<CURL_CONFIG
+url = "$base_url/.well-known/jwt-vc-issuer"
+header = "Accept: application/json"
+output = "$state_root/issuer-metadata.json"
+write-out = "   HTTP %{http_code} %{content_type}\n"
+silent
+show-error
+fail-with-body
+CURL_CONFIG
+)"
+jq '{keys: .jwks.keys}' "$state_root/issuer-metadata.json" >"$state_root/trusted.jwks.json"
+printf '   issuer: %s\n' "$(jq -r .issuer "$state_root/issuer-metadata.json")"
+
+printf '2. Request the signed default (Accept: application/jose+json)\n'
+run_curl "$(
+  cat <<CURL_CONFIG
+url = "$base_url/v1/evidence"
+request = "POST"
+header = "Authorization: Bearer $EVIDENCE_ACCESS_TOKEN"
+header = "Content-Type: application/json"
+header = "Accept: application/jose+json"
+data-binary = "@$state_root/request.json"
+output = "$state_root/response.jws.json"
+write-out = "   HTTP %{http_code} %{content_type}\n"
+silent
+show-error
+fail-with-body
+CURL_CONFIG
+)"
+
+printf '3. Request the same assertion as an SD-JWT VC (Accept: application/dc+sd-jwt)\n'
+run_curl "$(
+  cat <<CURL_CONFIG
+url = "$base_url/v1/evidence"
+request = "POST"
+header = "Authorization: Bearer $EVIDENCE_ACCESS_TOKEN"
+header = "Content-Type: application/json"
+header = "Accept: application/dc+sd-jwt"
+data-binary = "@$state_root/request.json"
+output = "$state_root/credential.txt"
+write-out = "   HTTP %{http_code} %{content_type}\n"
+silent
+show-error
+fail-with-body
+CURL_CONFIG
+)"
+
+unset EVIDENCE_ACCESS_TOKEN
+printf '\n'
+
+# The harness verifies the credential against the signed transaction, checks
+# minimization and audit, writes the policy document, and then exits.
+if ! wait "$harness_pid"; then
+  harness_pid=
+  printf 'The demo server did not pass its own checks:\n' >&2
+  cat "$harness_log" >&2
+  exit 1
+fi
+harness_pid=
+grep '^PASS:' "$harness_log"
+printf '\n'
+
+printf '4. The credential: an issuer-signed JWT, one root disclosure for this value,\n'
+printf '   and a trailing tilde where a key-binding JWT would go\n'
+credential=$(cat "$state_root/credential.txt")
+IFS='~' read -r -a segments <<<"$credential"
+if [[ "${credential: -1}" != '~' ]]; then
+  printf 'The credential does not end with a tilde, so it is not the issued form.\n' >&2
+  exit 1
+fi
+printf '   %s disclosure(s), no key-binding JWT\n' "$((${#segments[@]} - 1))"
+printf '   protected header: %s\n' "$(printf '%s' "${segments[0]%%.*}" | decode_base64url)"
+printf '   disclosures (salt, claim name, claim value):\n'
+for disclosure in "${segments[@]:1}"; do
+  printf '     %s\n' "$(printf '%s' "$disclosure" | decode_base64url)"
+done
+printf '\n'
+
+printf '5. Re-verify the stored credential offline, no network and no server\n'
+# One array, printed and executed, so the shown command cannot drift from the
+# one that actually runs.
+verify_command=(
+  cargo run --locked --quiet -p registry-evidence -- verify
+  --sd-jwt-vc "$state_relative/credential.txt"
+  --jwks "$state_relative/trusted.jwks.json"
+  --policy "$state_relative/verification-policy.yaml"
+)
+printf '   $ %s\n' "${verify_command[*]}"
+"${verify_command[@]}"
+
+printf '\n6. Tamper with one disclosure and re-verify: selective disclosure is not\n'
+printf '   an invitation to edit the claim after issuance\n'
+disclosure="${segments[1]}"
+if [[ "${disclosure: -1}" == 'A' ]]; then replacement='B'; else replacement='A'; fi
+tampered_segments=("${segments[@]}")
+tampered_segments[1]="${disclosure%?}$replacement"
+printf '%s~' "${tampered_segments[@]}" >"$state_root/tampered-credential.txt"
+tamper_command=(
+  cargo run --locked --quiet -p registry-evidence -- verify
+  --sd-jwt-vc "$state_relative/tampered-credential.txt"
+  --jwks "$state_relative/trusted.jwks.json"
+  --policy "$state_relative/verification-policy.yaml"
+)
+printf '   $ %s\n' "${tamper_command[*]}"
+if "${tamper_command[@]}" >/dev/null 2>"$state_root/tampered.stderr"; then
+  printf 'A tampered credential verified. That is a defect, not a demo.\n' >&2
+  exit 1
+fi
+printf '   rejected: %s\n' "$(cat "$state_root/tampered.stderr")"
+
+cat <<SUMMARY
+
+Done. The demo artifacts are gitignored and kept for inspection in
+products/evidence/.sd-jwt-vc-demo/:
+
+  request.json              the exact request, including its single-use requestNonce
+  response.jws.json         the signed flattened JWS default
+  credential.txt            the SD-JWT VC
+  issuer-metadata.json      the published issuer identity and key set
+  trusted.jwks.json         the pinned key set the offline verifier used
+  verification-policy.yaml  expectations taken from the accepted transaction
+  tampered-credential.txt   the same credential with one edited disclosure
+  harness.log               the demo server's own checks
+
+session.env holds only the short-lived synthetic bearer token. Do not paste it
+anywhere. Walkthrough and explanation: products/evidence/SD-JWT-VC-DEMO.md
+SUMMARY
diff --git a/products/manifest/README.md b/products/manifest/README.md
index 266572f36..7c66e0cfd 100644
--- a/products/manifest/README.md
+++ b/products/manifest/README.md
@@ -8,7 +8,7 @@ Registry Manifest is the commons contract and schema kernel for registry
 metadata. It is a portable set of Rust crates for modeling, validating, and
 rendering standards-facing registry metadata without running Registry Relay.
 
-It owns metadata manifests, compiled metadata models, validation, vocabulary prefix expansion, and pure renderers for catalog JSON, DCAT JSON-LD, BRegDCAT-AP JSON-LD, CPSV-AP JSON-LD, SHACL, JSON Schema Draft 2020-12, form JSON Schema, OGC API Records item collections, policy documents, evidence-offering metadata, embedded SKOS-shaped codelist metadata, and public federation metadata for Registry Notary delegated evaluation.
+It owns metadata manifests, compiled metadata models, validation, vocabulary prefix expansion, and pure renderers for catalog JSON, DCAT JSON-LD, BRegDCAT-AP JSON-LD, CPSV-AP JSON-LD, SHACL, JSON Schema Draft 2020-12, form JSON Schema, OGC API Records item collections, policy documents, evidence-offering metadata, and embedded SKOS-shaped codelist metadata.
 
 ## Monorepo layout
 
@@ -97,7 +97,7 @@ scripts/check-contract-kernel.sh
 ```
 
 Consumer manifests can be passed as arguments. Each file is validated and
-published into `target/contract-kernel/` so Relay, Notary, and adopter demos can
+published into `target/contract-kernel/` so Relay and adopter demos can
 exercise the same schema and renderer contract before a commons release:
 
 ```sh
@@ -132,30 +132,31 @@ claim boundary and known BRegDCAT-AP warning behavior.
 - `form-json-schema` with `--form <id>`
 - `ogc-records`
 
-## Registry Notary Federation Metadata
+## Evidence Offering Metadata
 
-Registry Manifest can publish public metadata that helps a partner configure the
-Registry Notary delegated-evaluation MVP:
+Registry Manifest can publish public metadata that helps a partner find and
+connect to a service that answers evidence requests:
 
-- top-level `federation` metadata with `node_id`, `issuer`, `jwks_uri`,
-  `federation_api`, and `supported_protocol_versions`;
 - top-level `evaluation_profiles` that bind public profile IDs and `ruleset`
-  IDs to Notary claim IDs and subject ID types, optionally with `evidence_pack`
+  IDs to public claim IDs and subject ID types, optionally with `evidence_pack`
   policy identity metadata;
 - top-level `ecosystem_bindings` that publish governed evidence binding IDs,
   versions, profiles, and ODRL enforcement metadata for runtime PDP selection;
-- `registry-notary` evidence offerings whose `access.ruleset` references one
-  of those evaluation profile rulesets.
+- evidence offerings whose `access.ruleset` references one of those evaluation
+  profile rulesets.
+
+The `access.kind` vocabulary is open. Registry Manifest checks endpoint shape
+for one kind, `registry-evidence`, because that kind names a service whose shape
+this repository defines. Any other kind is left to the runtime that consumes it.
 
 This metadata is discovery and documentation only. It does not grant runtime
-access; the serving Notary still enforces its local `federation.peers` policy,
-request signature checks, purpose allowlist, replay protection, and audit
-behavior.
+access; the service that answers the offering still enforces its own
+authentication, authorization, purpose handling, and audit behavior.
 
 ## Boundary
 
 Registry Manifest must stay portable. `registry-manifest-core` must not depend on
-Registry Relay, Registry Notary, Axum, DataFusion, Postgres, auth, audit,
+Registry Relay, Axum, DataFusion, Postgres, auth, audit,
 observability, runtime row access, secret handling, `utoipa`, or `clap`.
 
 Registry Relay may publish these artifacts over HTTP and scope them for callers, but those runtime concerns stay outside this repository.
diff --git a/products/manifest/docs/overview.md b/products/manifest/docs/overview.md
index d19225c52..8c1564bf9 100644
--- a/products/manifest/docs/overview.md
+++ b/products/manifest/docs/overview.md
@@ -2,8 +2,8 @@
 
 Registry Manifest is a portable Rust workspace that takes one `metadata.yaml` file and
 derives every standards-facing artifact other systems need to find, understand, and connect
-to a registry. It can also publish public Registry Notary federation metadata that helps
-partners configure static-peer delegated evaluation.
+to a registry. It can also publish public evidence-offering metadata that helps partners find
+the service that answers an evidence request.
 It does not serve HTTP, does not talk to databases, and does not handle credentials.
 You can run it on a laptop, in a CI pipeline, or in a static hosting workflow with no
 server required.
@@ -29,8 +29,7 @@ No renderer makes network calls or reads files beyond the manifest input.
 | Evidence offerings collection JSON | `evidence-offerings` |
 | Single evidence offering JSON | `evidence-offering` |
 
-Federation metadata appears inside the catalog and evidence-offering JSON outputs. It is not a
-separate render format. Codelists are emitted as embedded SKOS-shaped nodes inside the SHACL
+Codelists are emitted as embedded SKOS-shaped nodes inside the SHACL
 and DCAT/BRegDCAT-shaped linked-data outputs; there is not yet a standalone SKOS artifact.
 
 Not yet implemented: GovStack Digital Registries Building Block (DR BB), Social
@@ -62,8 +61,8 @@ If you need runtime metadata served over HTTP with per-caller scoping and author
 that is Registry Relay's job.
 Relay uses Registry Manifest's renderers internally.
 Metadata manifests and pure renderers live in this workspace; HTTP publication, runtime
-source binding, authentication, authorization, and audit behavior live in Registry Relay
-or Registry Notary.
+source binding, authentication, authorization, and audit behavior live in the runtime that
+serves them.
 
 ## A minimal manifest
 
@@ -105,9 +104,9 @@ forms: []
 ```
 
 A manifest must not contain runtime bindings such as source file paths, table names,
-database scopes, backend credentials, peer allowlists, federation signing keys, replay stores,
+database scopes, backend credentials, caller allowlists, signing keys, replay stores,
 or pairwise subject hash secrets.
-Those live in Registry Relay or Registry Notary configuration; the manifest is portable and
+Those live in runtime configuration; the manifest is portable and
 runtime-independent.
 
 A full working example is at
@@ -117,7 +116,7 @@ A full working example is at
 
 The top-level struct is `MetadataManifest`, which groups catalog, dataset,
 entity, service, form, evidence offering, dataset policy, requirement, evidence
-type, codelist, federation, evaluation profile, and ecosystem binding metadata.
+type, codelist, evaluation profile, and ecosystem binding metadata.
 Full field-by-field documentation is in [Registry Manifest reference](./reference.md).
 
 Grouped evidence is explicit.
@@ -125,14 +124,12 @@ An `evidence_type_lists` entry under a requirement is one option group; all evid
 in that list are required together.
 Multiple lists on the same requirement are alternatives.
 
-Federated evaluation metadata is explicit too.
-The top-level `federation` block advertises the publishing Notary node id, issuer, JWKS URL,
-federation API URL, and supported protocol versions.
-The top-level `evaluation_profiles` list binds public profile ids and ruleset ids to Notary
+Evaluation metadata is explicit too.
+The top-level `evaluation_profiles` list binds public profile ids and ruleset ids to public
 claim ids and subject id types.
-A `registry-notary` evidence offering must reference one of those ruleset ids through
-`access.ruleset`.
-Registry Manifest validates that link, but Registry Notary still decides which peers may call it.
+An evidence offering references one of those ruleset ids through `access.ruleset`.
+Registry Manifest validates that link, but the service that answers the offering still
+decides who may call it.
 
 ## Validation
 
@@ -149,9 +146,10 @@ before any rendering occurs:
 6. Validates per-dataset entities, fields, relationships, identifiers, codelists,
    cardinality strings, and ODRL policy terms.
 7. Validates evidence-offering references.
-8. Validates Registry Notary federation metadata when `registry-notary` access is declared:
-   HTTPS URLs, `did:web` issuer binding, protocol version, unique evaluation profile ids, unique
-   rulesets, and `access.ruleset` references.
+8. Validates evaluation profile metadata: unique evaluation profile ids, unique rulesets, and
+   `access.ruleset` references. When an offering declares `registry-evidence` access, also
+   validates that it names a response profile in `conforms_to` and HTTPS endpoint and
+   discovery URLs.
 9. Rejects runtime-only keys such as source paths, table names, scopes, backend bindings,
    visibility rules, and capability declarations.
 
diff --git a/products/manifest/docs/reference.md b/products/manifest/docs/reference.md
index 1fe981819..fa2112c97 100644
--- a/products/manifest/docs/reference.md
+++ b/products/manifest/docs/reference.md
@@ -91,8 +91,7 @@ Source:
 | `data_services` | list of `DataServiceManifest` | No | DCAT data services referenced by services and evidence offerings. |
 | `forms` | list of `FormManifest` | No | Local form-profile records linked from public services and channels. |
 | `codelists` | list of `CodelistManifest` | No | Enumerated value schemes with concept URIs. |
-| `federation` | `FederationManifest` | No | Public Registry Notary federation metadata for delegated evaluation. |
-| `evaluation_profiles` | list of `EvaluationProfileManifest` | No | Public profile-to-ruleset bindings for Registry Notary delegated evaluation. |
+| `evaluation_profiles` | list of `EvaluationProfileManifest` | No | Public profile-to-ruleset bindings for delegated evaluation. |
 | `ecosystem_bindings` | list of `EcosystemBindingManifest` | No | Ecosystem-specific integration bindings, such as governed-evidence gateway metadata. See [Ecosystem binding keys](#ecosystem-binding-keys). |
 
 ### CatalogManifest keys
@@ -145,39 +144,37 @@ Source:
 | `forms[].sections[].fields[].supports_requirement` | Requirement ID supported by the field. |
 | `forms[].sections[].fields[].fulfillment` | Manual input, file upload, registry lookup, evidence exchange, self-declaration, or already-known mode metadata. |
 
-### Federation metadata keys
+### Evidence offering access keys
 
-Registry Manifest federation metadata supports Registry Notary static-peer delegated evaluation.
-It is public discovery metadata, not an access grant.
-
-Fields of `FederationManifest`.
-
-| Key | Required | Description |
-| --- | --- | --- |
-| `node_id` | Yes | Publishing Notary node id. MVP validation requires `did:web`. |
-| `issuer` | Yes | HTTPS issuer URL. Host must bind to the `did:web` node id. |
-| `jwks_uri` | Yes | HTTPS JWKS URL partners use to verify signed federation responses. Host must bind to the issuer host. |
-| `federation_api` | Yes | HTTPS federation API base URL. Host must bind to the issuer host. |
-| `supported_protocol_versions` | Yes | Must include `registry-notary-federation/v0.1`. |
+An evidence offering's `access` block is public discovery metadata, not an access grant. The
+`kind` vocabulary is open: a manifest may name any access kind, and the runtime that consumes
+the manifest decides which kinds it can serve. Registry Manifest checks the endpoint shape of
+one kind, `registry-evidence`, because that kind names a service whose shape this repository
+defines.
 
 Fields of `EvaluationProfileManifest`.
 
 | Key | Required | Description |
 | --- | --- | --- |
 | `id` | Yes | Public profile id. Must be unique. |
-| `ruleset` | Yes | Public ruleset id. Must be unique and referenced by `registry-notary` offerings. |
-| `claim_id` | Yes | Notary claim id evaluated for the profile. |
+| `ruleset` | Yes | Public ruleset id. Must be unique and referenced by `registry-evidence` offerings. |
+| `claim_id` | Yes | Public claim id evaluated for the profile. |
 | `subject_id_type` | Yes | Subject id type the profile accepts. |
-| `max_source_observed_age_seconds` | No | Optional public freshness hint. Runtime enforcement is in Registry Notary config. |
+| `max_source_observed_age_seconds` | No | Optional public freshness hint. Runtime enforcement belongs to the service that answers the offering, not to the manifest. |
 | `evidence_pack` | No | Optional `EvidencePackMetadata` object. Shares its shape with `ecosystem_bindings[].evidence_pack`. See [Ecosystem binding keys](#ecosystem-binding-keys). |
 
-For `EvidenceOfferingAccessManifest` with `kind: registry-notary`:
+For `EvidenceOfferingAccessManifest` with `kind: registry-evidence`:
+
+- `conforms_to` must be present and non-blank. It names the response profile the endpoint
+  returns, for example `registry.assertion-evidence/v1`. The manifest layer does not pin a
+  particular profile version, so it is not required to be a URI.
+- `endpoint_url` is required and must be HTTPS.
+- `discovery_url` is required and must be HTTPS. It points at the document a relying party
+  reads to verify what the endpoint returns, for example an issuer JWKS.
+- `ruleset`, when set, must reference an existing `evaluation_profiles[].ruleset`.
 
-- `conforms_to` must be `registry-notary-federation/v0.1`.
-- `endpoint_url` must be HTTPS.
-- `discovery_url` must be HTTPS.
-- `ruleset` must reference an existing `evaluation_profiles[].ruleset`.
-- A top-level `federation` block is required.
+For every other `kind`, `conforms_to` is validated as an ordinary optional URI and the rest of
+the `access` block is left to the consuming runtime.
 
 ### Ecosystem binding keys
 
@@ -250,7 +247,7 @@ Source:
 
 The following keys must not appear in a portable manifest.
 Their presence causes `validate`, `publish`, and `validate-profiles` to fail.
-They belong in Registry Relay or Registry Notary runtime configuration, not in a metadata manifest.
+They belong in a service's runtime configuration, such as Registry Relay's, not in a metadata manifest.
 
 `admin_bind`, `admin_listener`, `audit`, `auth`, `bind`, `bindings`, `capabilities`,
 `column`, `config_trust`, `file_path`, `listener`, `listeners`, `peer_allowlist`,
diff --git a/products/manifest/docs/validate-and-render.md b/products/manifest/docs/validate-and-render.md
index d594e2872..8aabf3bd1 100644
--- a/products/manifest/docs/validate-and-render.md
+++ b/products/manifest/docs/validate-and-render.md
@@ -295,5 +295,5 @@ Run `validate` first to confirm the manifest is clean before running `publish`.
 ### Validation rejects a key like `source`, `table`, or `scope`
 
 Portable manifests cannot include runtime binding keys. Move data-source locations, database
-tables, caller scopes, credentials, peer allowlists, signing keys, and replay-store settings to
-Registry Relay or Registry Notary runtime configuration.
+tables, caller scopes, credentials, caller allowlists, signing keys, and replay-store settings to
+runtime configuration.
diff --git a/products/notary/.cargo/config.toml b/products/notary/.cargo/config.toml
deleted file mode 100644
index d61b87e8f..000000000
--- a/products/notary/.cargo/config.toml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Local-dev linker tuning. Linux CI is unaffected; the Binary Release
-# workflow's macOS jobs neutralize this via a set-but-empty RUSTFLAGS,
-# since hosted runners do not ship Homebrew's lld.
-#
-# On Apple Silicon, dev/test builds spend most of their wall time in the
-# linker because each integration test binary statically pulls in axum and the
-# workspace crates. The system `ld` (`ld64`) is single-threaded; LLVM's
-# `ld64.lld` (Mach-O port) is parallel and is a drop-in replacement for the
-# workloads this workspace produces.
-#
-# Requires: `brew install lld`, which puts `ld64.lld` on PATH at
-# `/opt/homebrew/bin/ld64.lld`. Contributors without lld installed will
-# see a linker-not-found error pointing at this file.
-#
-# Override locally by exporting `CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER`
-# or by deleting this file in your worktree.
-[target.aarch64-apple-darwin]
-linker = "clang"
-rustflags = ["-C", "link-arg=-fuse-ld=/opt/homebrew/bin/ld64.lld"]
diff --git a/products/notary/.dockerignore b/products/notary/.dockerignore
deleted file mode 100644
index d920ffcf7..000000000
--- a/products/notary/.dockerignore
+++ /dev/null
@@ -1,14 +0,0 @@
-/target/
-/.git/
-/.github/
-/.idea/
-/.vscode/
-**/.DS_Store
-demo/var/
-.env
-.env.*
-*.env
-*.env.*
-*.pem
-*.key
-*.p12
diff --git a/products/notary/.github/dependabot.yml b/products/notary/.github/dependabot.yml
deleted file mode 100644
index f60ead5c7..000000000
--- a/products/notary/.github/dependabot.yml
+++ /dev/null
@@ -1,26 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: cargo
-    directory: "/"
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
-    groups:
-      rust-patch-and-minor:
-        update-types:
-          - patch
-          - minor
-  - package-ecosystem: github-actions
-    directory: "/"
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
-    groups:
-      github-actions:
-        patterns:
-          - "*"
-  - package-ecosystem: docker
-    directory: "/"
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
diff --git a/products/notary/.gitignore b/products/notary/.gitignore
deleted file mode 100644
index b79533fb4..000000000
--- a/products/notary/.gitignore
+++ /dev/null
@@ -1,16 +0,0 @@
-/target/
-node_modules/
-demo/var/
-/.security-review/
-/.release-review/
-/internal/security-reviews/
-
-# Python bytecode (perf scripts and stub)
-__pycache__/
-*.py[cod]
-
-# Perf testing: secrets, stub runtime output, and Python virtual env
-perf/.env
-perf/.env.*
-perf/.venv/
-perf/.pytest_cache/
diff --git a/products/notary/.gitleaks.toml b/products/notary/.gitleaks.toml
deleted file mode 100644
index 5203a21ed..000000000
--- a/products/notary/.gitleaks.toml
+++ /dev/null
@@ -1,20 +0,0 @@
-title = "registry-notary gitleaks config"
-
-[[allowlists]]
-description = "Generated and local build output are not source review surfaces."
-paths = [
-  '''^target/''',
-  '''^demo/var/''',
-]
-
-# Path-scoped allowlist for synthetic SD-JWT VC test fixtures.
-# All JWTs, JWKs, and private key material under this directory are
-# throwaway test-only material generated by `cargo run -p xtask --
-# gen-sd-jwt-vc-fixtures`. They carry no trust outside the test suite.
-# Reviewed and waived: registry-notary#10.
-[[allowlists]]
-description = "Synthetic SD-JWT VC fixtures for verifier compatibility harness."
-paths = [
-  '''^tests/fixtures/sd_jwt_vc/''',
-  '''^xtask/src/main\.rs''',
-]
diff --git a/products/notary/.gitleaksignore b/products/notary/.gitleaksignore
deleted file mode 100644
index 4fb682948..000000000
--- a/products/notary/.gitleaksignore
+++ /dev/null
@@ -1,4 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-#
-# Baseline file for reviewed false positives. Keep entries path-scoped and add
-# rationale in the surrounding commit message or security waiver.
diff --git a/products/notary/.mise.toml b/products/notary/.mise.toml
deleted file mode 100644
index 6e0a112d5..000000000
--- a/products/notary/.mise.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-[tools]
-rust = "1.95.0"
diff --git a/products/notary/.semgrep.yml b/products/notary/.semgrep.yml
deleted file mode 100644
index 1f37cd4bc..000000000
--- a/products/notary/.semgrep.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-rules:
-  - id: registry-notary.no-full-env-dump
-    message: Do not collect or log the full process environment.
-    severity: ERROR
-    languages: [rust]
-    pattern: std::env::vars()
-
-  - id: registry-notary.no-danger-invalid-certs
-    message: Do not disable TLS certificate validation outside a reviewed local test helper.
-    severity: ERROR
-    languages: [rust]
-    pattern: danger_accept_invalid_certs(true)
-    paths:
-      exclude:
-        - /crates/**/tests/**
-
-  - id: registry-notary.no-write-all-actions
-    message: GitHub Actions must not use write-all permissions.
-    severity: ERROR
-    languages: [yaml]
-    pattern: |
-      permissions: write-all
-
-  - id: registry-notary.no-secret-copy-in-dockerfile
-    message: Dockerfiles must not copy secrets, env files, private keys, or JWK material.
-    severity: ERROR
-    languages: [generic]
-    paths:
-      include:
-        - Dockerfile
-        - Dockerfile.openfn-sidecar
-    pattern-regex: '(?i)\\bCOPY\\b.*(\\.env|\\.pem|\\.key|\\.p12|jwk|secret|credential)|"d"\\s*:'
diff --git a/products/notary/AGENTS.md b/products/notary/AGENTS.md
deleted file mode 100644
index c9e885e7c..000000000
--- a/products/notary/AGENTS.md
+++ /dev/null
@@ -1,19 +0,0 @@
-# registry-notary Agent Notes
-
-Follow the workspace guidance in `../AGENTS.md` first. These notes add
-repo-specific CI discipline for Registry Notary.
-
-## CI Preflight
-
-Before opening or updating a PR that changes Rust code, Cargo features,
-`Cargo.toml`, `Cargo.lock`, Dockerfiles, root GitHub workflows, or perf config:
-
-- Run `just ci-preflight`.
-- The preflight runs from the registry-stack monorepo root and uses the root
-  workspace lockfile.
-- If changing path dependencies or feature flags, regenerate and commit
-  `Cargo.lock` when the locked graph changes.
-- If the preflight cannot be run, say exactly why in the handoff or PR notes.
-
-This preflight exists to catch lockfile drift before the heavyweight Docker,
-perf, and security jobs fail on first push.
diff --git a/products/notary/CHANGELOG.md b/products/notary/CHANGELOG.md
deleted file mode 100644
index 6e166c661..000000000
--- a/products/notary/CHANGELOG.md
+++ /dev/null
@@ -1,764 +0,0 @@
-# Changelog
-
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [Unreleased]
-
-## [0.16.3] - 2026-08-01
-
-- No user-visible Registry Notary changes. The v0.16.2 workflow stopped at an
-  unpublished draft before public image promotion. Install v0.16.3.
-
-## [0.16.2] - 2026-08-01
-
-- No user-visible Registry Notary changes. This release fixes forward from the
-  v0.16.1 tag workflow, which stopped after creating an unpublished empty
-  draft. Install v0.16.2; no final v0.16.1 images, assets, or documentation
-  were published.
-
-## [0.16.1] - 2026-08-01
-
-- No user-visible Registry Notary changes. This release fixes forward from the
-  v0.16.0 tag workflow, which failed before any job or public write. Install
-  v0.16.1; no final v0.16.0 images, assets, or documentation were published.
-
-## [0.16.0] - 2026-08-01
-
-### Removed
-
-- Removed the `self_attested` evidence mode. Every configured claim now
-  requires exactly one compiler-pinned Registry Relay consultation. Subject
-  access remains authorization only. The former `delegated_attestation` wire
-  value and `evidence:self_attest` scope are replaced by
-  `delegated_subject_access` and `evidence:subject_access`.
-
-### Added
-
-- Registry-backed direct Relay claims can now carry bounded closed object and
-  array values through evaluation storage, OID4VCI Type Metadata, SD-JWT
-  issuance, and verification. Top-level structured claims remain one selective
-  disclosure; nested disclosure is not supported.
-- Authenticated registry clients can create a short-lived pre-authorized
-  OID4VCI offer from a fresh caller-owned stored evaluation through
-  `POST /oid4vci/offers`. Exact retries return one stored response, the
-  required transaction-code value remains outside the offer URI, and the
-  wallet ceremony remains bound to one immutable transaction.
-- This release advances the PostgreSQL state-plane catalog. Stop all Notary
-  writers, take a verified backup, then run the target release's `state
-  install` and `state doctor` commands before admitting traffic. The installer
-  upgrades only the immediately preceding attested v1 catalog; older or
-  drifted schemas require a sequential upgrade, a matching backup and binary,
-  or a fresh installation.
-- Added Registryctl-authored OID4VCI representative credential issuance with
-  identity-provider authentication, closed target selection, registry-backed
-  relationship proof, committed dependency closure, proof-bounded
-  transactions, pseudonymous wallet-token bindings, holder binding, and
-  required credential status.
-
-### Fixed
-
-- Delegated registry-backed consultations must consume the compiler-pinned
-  target instead of permitting requester-only policy dependencies.
-- Delegated Relay results are checked for expiry again after the Relay call
-  returns, before evaluation continues.
-
-## [0.15.2] - 2026-07-28
-
-- No user-visible Registry Notary changes. This release fixes forward from the
-  incomplete v0.15.1 publication.
-
-## [0.15.1] - 2026-07-28
-
-- No user-visible Registry Notary changes. This release fixes forward from the
-  failed v0.15.0 publication workflow.
-
-## [0.15.0] - 2026-07-28
-
-### Added
-
-- Added optional 1 to 65536-byte UTF-8 result bounds for string claims.
-  Evaluation accepts exact-bound and nullable results, rejects over-bound
-  values with the existing value-free rule-failure classification, and keeps
-  direct configurations without the field backward compatible.
-- Added product-owned, value-free activation diagnostics and stateful Config
-  Bundle verification with explicit anti-rollback state. Startup and doctor
-  boundaries retain stable classifications without exposing sensitive
-  configuration values or paths.
-
-### Fixed
-
-- CEL startup preflight now uses type-correct string previews that honor claim
-  and Relay output byte bounds below nine bytes. Evaluated values retain the
-  configured runtime byte-bound enforcement.
-- CEL worker activation now gives each worker one fixed protocol probe within
-  the pool-wide spawn-and-probe deadline, then verifies live capacity without a
-  duplicate protocol round trip. Initial activation remains all-or-nothing.
-
-## [0.13.0] - 2026-07-25
-
-### Changed
-
-- BREAKING: The closed Relay-result decoder now matches the reduced pre-1.0
-  `registry.relay.consultation-result.v1` contract and rejects the retired
-  `provenance.consent` member as unknown. Registry-backed issuance still
-  requires compiler-pinned Relay evidence; source-free declarations remain
-  evaluation-only and cannot be issued as credentials. Consent verification,
-  policy enforcement, legal-basis handling, and authorization are unchanged.
-- BREAKING: Replace deployment-waiver `reason` with a required validated
-  `reference` and an optional validated `summary`. Strict configuration parsing
-  rejects the retired field. Restricted posture and boot warnings expose only
-  the new metadata, default posture continues to omit waiver metadata, and
-  hard startup/readiness gates remain non-waivable.
-
-## [0.12.2] - 2026-07-20
-
-- No new Notary product features or public API contract changes. This release
-  fixes forward from the incomplete v0.12.1 publication with a canonical
-  reproducible release-build path for binaries and runtime images.
-- Isolated the single-use eSignet authorization-code exchange on short-lived
-  DNS-pinned transport. Redirects and proxies remain denied, timeouts remain
-  bounded, and the non-idempotent exchange is not transparently retried. No
-  public route or authentication contract changed.
-
-## [0.12.1] - 2026-07-20
-
-### Security
-
-- Bound time-bounded reviews of the three non-fixable Debian 13 `libc6`
-  findings to the ordered runtime root filesystem layer digest. Fixable,
-  expired, mismatched, and unreviewed findings fail the image advisory gate.
-
-## [0.12.0] - 2026-07-19
-
-### Added
-
-- Added a complete source-tested registry-backed OID4VCI journey for EdDSA and
-  ES256 issuer profiles with EdDSA `did:jwk` holder proof, exact generated
-  metadata assertions, client verification, replay and provenance checks, and
-  unsupported-profile denial.
-- Added registryctl authoring for the issuer signing algorithm and transaction
-  code mode. EdDSA and a required transaction code are secure defaults. An
-  explicit no-PIN profile retains the 300-second compiler ceiling.
-- Added the bounded batch evaluation v1 contract. Batch evaluation has an
-  immutable 100-member platform ceiling with lower-only global and per-claim
-  configuration, client and OpenAPI bounds, and pre-side-effect HTTP 413
-  rejection using `batch.too_large`.
-- Added the committed Draft 2020-12 Registry Notary runtime configuration
-  schema at `schemas/registry-notary.config.schema.json`. `registry-notary
-  schema`, `just config-schema-generate`, and the schema drift check all use
-  the production `StandaloneRegistryNotaryConfig` deserialization graph.
-  The operator reference now has a bidirectional key-path contract check.
-
-### Changed
-
-- BREAKING: the Registry Notary 1.0 wallet facade now supports only
-  issuer-initiated pre-authorized code backed by a stored registry transaction.
-  `GET /oid4vci/credential-offer` and `POST /oid4vci/nonce` are removed, and
-  issuer metadata no longer advertises `nonce_endpoint`. Credential responses
-  no longer expose `c_nonce` or `c_nonce_expires_in`.
-  The Rust, Node.js, and Python client helpers for those removed routes are
-  removed as well.
-  Start at `GET /oid4vci/offer/start`, complete the identity-provider callback,
-  redeem the rendered offer at `POST /oid4vci/token`, and use that token
-  response's transaction-bound proof nonce. The identity provider's
-  authorization code is internal to Notary and is not a wallet grant.
-- Status-bearing credentials now require fail-closed client verification from
-  the configured exact HTTPS status origin. The reserved top-level `status`
-  claim cannot be selectively disclosable.
-- OID4VCI remains limited to EdDSA or ES256 issuer signing and EdDSA `did:jwk`
-  holder proof. No EUDI, HAIP, PAR, DPoP, wallet-attestation, ES256-holder, or
-  external conformance claim is made without frozen candidate evidence.
-- Maintained Notary runtime images now use Debian 13 distroless. Release checks
-  enforce the expected base and vulnerability policy before publication.
-
-## [0.11.0] - 2026-07-18
-
-### Added
-
-- Added `registry-notary audit quarantine` as an offline recovery path for an
-  inconsistent file-backed audit chain. The command takes the existing
-  single-writer lock, retains the corrupt chain under a timestamped suffix,
-  and starts a keyed `audit.chain.break` segment linked to the last verified
-  local record.
-- Registry-backed Relay consultations can now bind bounded scalar inputs from
-  `request.target.attributes.<stable-name>`. Notary preserves string, boolean,
-  and integer types through single and batch evaluation and Relay requests.
-  Target attributes remain caller-supplied context and cannot satisfy an
-  authenticated target-identifier requirement for delegated subject access.
-
-### Changed
-
-- BREAKING: direct and OID4VCI credential issuance now accept only newly
-  evaluated, non-delegated registry-backed claims with one exact compiler pin
-  for every claim in each selected root's dependency closure and one normalized
-  record per unique Relay execution. A deterministic SHA-256 binding now
-  cross-checks every pin against its execution and claim provenance before
-  signer access. Restricted Relay identifiers are retained only for evaluations
-  whose selected roots share a validated credential profile. Source-free,
-  delegated, and registry-backed evaluation-only claims cannot be
-  configured for credential issuance. Existing stored evaluations remain
-  readable and renderable but must be re-evaluated before issuance. No database
-  migration or correctness-state schema change is required.
-- BREAKING: configuration `${VAR}` expansion now rejects environment variables
-  that are unset or empty. `${VAR:-fallback}` uses its fallback for either
-  state, `${VAR:-}` explicitly expands to empty, and `${VAR:?message}` reports
-  its message for either state. Whitespace-only values remain non-empty.
-- Notary now verifies its retained audit chain during runtime activation.
-  Confirmed chain forks and verification failures latch `/ready` at `503` with
-  the bounded code `audit.chain.inconsistent` until offline recovery and a
-  process restart. `/healthz` remains `200`; transient I/O, JSON, secret, and
-  other operational failures do not permanently poison readiness. Governed
-  signed-bundle acceptance remains write-before-persist and write-before-serve.
-  Embedders must now await `standalone_router`; all router construction paths
-  reject runtimes that have not attempted retained-chain verification.
-- Omitted claim `formats` now defaults to the canonical
-  `application/vnd.registry-notary.claim-result+json` evaluation response
-  format. An explicitly empty `formats: []` is rejected at configuration load
-  with the claim id and remediation. Explicit lists must include the canonical
-  format and may otherwise contain only `application/ld+json; profile="cccev"`.
-  SD-JWT VC is a credential-profile issuance format, not a claim evaluation
-  renderer. Subject-access `allowed_formats` now follows the same evaluation
-  boundary and no longer needs to repeat the credential profile's output
-  format.
-- Requests that present more than one primary credential channel now fail
-  before candidate parsing or validation with `auth.multiple_credentials`.
-  The public response and restricted audit record remain candidate-neutral and
-  do not reveal which credential, if any, was valid.
-- The registryctl local Notary tutorial now exercises a live registry-backed
-  claim through an exact compiler-pinned Relay consultation. It is an
-  evaluation-only tutorial and does not claim credential issuance, wallet
-  interoperability, or OID4VCI interoperability.
-
-## [0.10.0] - 2026-07-17
-
-### Added
-
-- Release distributions now publish `registry-notary-cel-worker` as a
-  standalone Linux amd64 binary. CEL-enabled standalone installations keep it
-  beside `registry-notary` under its canonical executable name; the Notary
-  image carries the same isolated worker.
-
-### Changed
-
-- BREAKING: all deployable Notary correctness state now uses one typed,
-  Notary-owned PostgreSQL state contract with separate private and API schemas,
-  configured by the top-level `state` block.
-  Removed Redis and per-domain storage configuration is rejected without
-  aliases. Explicit single-process local development may use `in_memory`.
-- BREAKING: authentication no longer uses a mode selector, and a present
-  `auth.mode` is rejected. API keys may coexist with
-  OIDC for distinct service and citizen or wallet callers, while each request
-  must present exactly one credential type. Static bearer tokens and OIDC
-  remain mutually exclusive because both use `Authorization: Bearer`.
-- Project authoring now emits only PostgreSQL settings that identify a secret
-  consumer or reflect an authored deployment choice. Connection-pool and
-  timeout policy follow the Notary runtime defaults instead of becoming
-  implementer-owned generated configuration.
-- The embedded server activation API is now
-  `NotaryRuntimeSnapshot::activate()`. The synchronous `standalone_router`
-  helper is limited to explicit local in-memory state; PostgreSQL callers use
-  the compile, activate, then build-router sequence. Router builders now name
-  their exposure explicitly: `notary_public_router_from_runtime`,
-  `notary_shared_router_from_runtime`, or `notary_routers_from_runtime` for
-  separate public and admin listeners.
-- Signed pre-authorized codes now bind the exact offer's transaction-code
-  requirement. Restart or configuration changes cannot remove or add the PIN
-  requirement for a live offer.
-- Pre-authorized-code replay identity now uses the verified Notary issuer and
-  stable Notary replay hashes. Redeemed no-PIN codes remain spent across
-  sensitive-state key rotation, unrelated service configuration changes,
-  process or database restart, and logical restore.
-- PostgreSQL now derives effective credential status from database time, so
-  skewed replicas agree on expiry. Revocation remains terminal, and credential
-  expiry supersedes valid or suspended status.
-- Added `registry-notary state install` and `registry-notary state doctor`,
-  startup and readiness schema attestation, PostgreSQL 16 through 18 support,
-  and active-active transaction semantics for replay, nonce, evaluation,
-  idempotency, credential status, quotas, and preauthorization.
-- Documented clean pre-1.0 cutover, backup and restore, stale-restore
-  quarantine, forward upgrades, sensitive-state key handling, and the
-  local-to-production implementer journey.
-- BREAKING: Registry-backed claims now use only authenticated,
-  compiler-pinned Registry Relay consultations. Notary no longer accepts
-  direct source connections, DCI/FHIR connectors, source adapter sidecars,
-  source credentials, or transitional evidence modes.
-- Notary validates the complete Relay consultation semantics and
-  `contract_hash` before serving and at readiness. A mismatch fails before
-  Relay can access the registry source.
-- Relay outcomes and typed outputs remain separate from Notary claims,
-  disclosure, and credential issuance. One consultation can supply several
-  direct and CEL claims without exposing raw Relay errors.
-- Relay-only, self-attested Notary-only, and combined deployments are modeled
-  independently. Combined deployments use the project's single Relay
-  connection.
-- BREAKING: a combined deployment may connect Notary to its paired Relay
-  through an explicitly enabled HTTP IP-loopback origin in any deployment
-  profile. The obsolete `notary.relay.insecure_url` posture finding is removed;
-  remote HTTP Relay origins remain invalid, so no cleartext hop crosses the
-  shared network namespace.
-- Project authoring keeps the Relay's public catalog origin separate from the
-  Notary-to-Relay connection URL. Only the paired internal connection may use
-  an explicitly enabled literal IP-loopback HTTP origin; public or remote
-  Relay origins still require HTTPS.
-- BREAKING: registry-backed claim rules are now named
-  `consultation_output { consultation, output }` and
-  `consultation_matched { consultation }`. The unreleased `extract`/`exists`
-  and `source`/`field` forms are rejected without aliases.
-- BREAKING: public claim provenance is now
-  `registry-notary-claim-provenance/v2` with one
-  `relay_consultation_count`; the misleading `source_count` and unused
-  `source_versions` fields are removed. Audit records use the same Relay
-  consultation terminology.
-- BREAKING: federation configuration uses `evaluation_scopes` and
-  `max_claim_result_age_seconds`, and signed federation responses use
-  `claim_result_issued_at` plus `federation.stale_claim_result`. Federation
-  profiles remain source-free in this version.
-
-### Removed
-
-- Removed production Notary Redis code, dependencies, configuration, and
-  current operator documentation. The standalone Solmara Lab consumes the new
-  PostgreSQL state contract in its owning repository.
-- Removed the Notary source-adapter sidecar image, routes, security inventory,
-  direct DCI/FHIR/OpenSPP demo configurations, OpenFn caller demo, and the
-  direct-source performance harness.
-
-## [0.9.0] - 2026-07-10
-
-### Added
-
-- New deployment gate `notary.signer_custody.unapproved`: keys used by
-  credential issuance, access-token issuance, or federation signing require
-  explicit `deployment.evidence.signer_custody_approved: true` under
-  `production` and `evidence_grade`. Provider kind, including `pkcs11`, is not
-  treated as proof because PKCS#11 modules may be hardware- or software-backed.
-  The gate is unbound for `local` and `hosted_lab`, reports `readiness_fail`
-  under `production`, and blocks startup under `evidence_grade`. `/ready` now
-  exposes typed custody-specific provider and surface counts without publishing
-  the deployment profile, complete finding list, or secret-bearing provider
-  fields.
-- `registry-notary doctor` now warns (`notary.source_binding.no_matching_policy`)
-  when a claim source binding declares no matching policy (no `policy_id`, no
-  context constraints), naming each affected binding. A matching new
-  deployment gate surfaces the same condition as a `finding_warn` under
-  `production` and a `finding_error` under `evidence_grade`; `hosted_lab` and
-  `local` stay quiet. Claim resolution behavior is unchanged: such bindings
-  already fell back to unrestricted, identifier-only resolution per spec
-  RS-DM-CLAIM; this only adds visibility so operators can accept that
-  knowingly or declare a matching policy.
-- New deployment gate `notary.audit.retention_local_only`: fires when the
-  audit sink is `file` or `jsonl` and `deployment.evidence.audit_offhost_shipping`
-  is not declared, because a local file sink caps retention and an attacker
-  with host access can destroy the evidence. `stdout` and `syslog` sinks are
-  exempt. Bound `finding_warn` under `production` and `startup_fail` under
-  `evidence_grade`; unbound under `local` and `hosted_lab`. Operators can
-  clear the finding by declaring `deployment.evidence.audit_offhost_shipping:
-  true` once audit events are shipped off-host. `startup_fail` is a hard gate
-  and hard gates cannot be waived: a config carrying a `deployment.waivers`
-  entry for this finding under `evidence_grade` now fails to load
-  (`HardGateNotWaivable`). Migration: remove the waiver, then either ship
-  audit events off-host and declare
-  `deployment.evidence.audit_offhost_shipping: true`, or switch to a
-  `stdout`/`syslog` sink to clear the local-retention gate. An
-  `evidence_grade` deployment must also configure
-  `deployment.evidence.audit_ack_cursor_path` for every sink type.
-- `registry-notary doctor`'s JSON report
-  (`registry.config.diagnostic_report.v1`) now carries an `audit_shipping`
-  object (`sink_type`, `shipping_target_configured`, `shipping_target`) when
-  the config parses, mirroring the posture `audit` shipping fields. The
-  existing "audit file/jsonl sink is local-chain-only" warning now fires only
-  when off-host shipping has not been declared.
-- Added `evidence.machine_quota`, a per-principal quota for machine
-  `evaluate` and `batch_evaluate` traffic. The budget is counted in subjects
-  (a single evaluate costs 1, a batch costs `items.len()`) over a fixed
-  one-minute window per `principal_id`, so request rate and batch fan-out
-  share one limit instead of being controlled independently. Exhaustion
-  returns `429` with the stable code `evaluation.quota_exceeded` and a
-  `Retry-After` header. Disabled by default (`enabled: false`); enabling it
-  does not affect the existing self-attestation rate limiters or the
-  per-request `max_subjects` cap.
-- `deployment.evidence.audit_ack_cursor_path` and
-  `deployment.evidence.audit_ack_max_age_secs` config fields: point Notary at
-  the local state file an off-host audit shipper writes on each successful
-  hand-off (`registry.audit.ack_cursor.v1`), and set how old the cursor's
-  `acked_at` timestamp may get before it reads as stale (defaults to 900s).
-  Config load rejects `audit_ack_max_age_secs` set without
-  `audit_ack_cursor_path` (`AuditAckMaxAgeWithoutCursor`), and rejects
-  `audit_ack_cursor_path` set on a local file audit sink that has not
-  declared `audit_offhost_shipping` (`AuditAckCursorWithoutShippingDeclared`);
-  a `stdout`/`syslog` sink may carry a cursor without that declaration.
-- Two new deployment gates read the ack cursor's observed health:
-  `notary.audit.shipping_unverified` (a shipping target is configured but no
-  ack cursor is configured; `finding_warn` under `production`,
-  `startup_fail` under `evidence_grade`, unbound under `hosted_lab`) and
-  `notary.audit.shipping_stale` (a cursor is configured but its observed
-  health is not `ok`, including a watermark that differs from the live keyed
-  chain tail; `finding_error` under `production`, `readiness_fail`
-  (non-waivable) under `evidence_grade`, unbound under `hosted_lab`).
-- Notary readiness and posture re-evaluate audit shipping gates on each request,
-  so a fresh ack cursor that becomes stale after startup now makes an
-  `evidence_grade` instance not ready without requiring a restart.
-- Runtime cursor reads use one blocking worker with a 500 ms deadline. A slow
-  or stalled cursor filesystem fails readiness without blocking async request
-  workers or accumulating additional blocked cursor readers. The cursor must
-  be a regular file of at most 16 KiB and must be replaced atomically by the
-  shipper.
-- `registry-notary doctor`'s `audit_shipping` object and the admin
-  `GET /admin/v1/posture` `posture.audit` block both gain `shipping_health`
-  (`ok`, `stale`, `missing`, `invalid`, `unverified`, or `null`) and
-  `shipping_observed_at` (an RFC3339 timestamp, or `null`), the observed
-  freshness of off-host audit shipping read from the ack cursor. Both are
-  `null` whenever `shipping_target_configured` is `false`. Runtime `ok`
-  requires a fresh cursor bound to the current keyed chain tail; offline doctor
-  output remains `unverified`. Tail equality establishes a zero local backlog
-  for the trusted shipper's claim, not cryptographic proof of remote receipt.
-  The committed OpenAPI example for `GET /admin/v1/posture`
-  is regenerated to include both fields.
-- A signed-bundle boot writes `config.bundle_accepted` before the service begins
-  serving. Evidence-grade readiness remains `503` until the independent shipper
-  acknowledges that new tail. Offline `registry-notary doctor` cannot perform
-  live tail binding, so a fresh cursor remains `unverified` and the offline
-  evidence-grade check reports the hard shipping gate.
-
-### Changed
-
-- **BREAKING: `deployment.profile` is required.** Set it explicitly to one of
-  `local`, `hosted_lab`, `production`, or `evidence_grade`. Notary does not
-  infer a profile and refuses startup when it is absent.
-- **BREAKING: the TUF-era live config-apply HTTP surface is removed.**
-  `/admin/v1/config/verify`, `/admin/v1/config/dry-run`, and
-  `/admin/v1/config/apply` are no longer served, and the CLI
-  `config apply-bundle` command is removed. First run
-  `registryctl bundle verify` for stateless signature and binding verification,
-  then place the signed Registry Config Bundle v1 on the Notary node. For a
-  genuinely absent, version-specific antirollback state path, start Notary with
-  `--initialize-state`; that boot verifies the bundle and initializes state.
-  Notary's read-only `config verify-bundle` command remains, but it requires
-  accepted state to exist, so use it only for later candidate validation and
-  restarts. Replace retired TUF-era fields inside `config_trust` with current
-  Config Bundle v1 trust fields because strict parsing rejects the old schema.
-  There is no current hot-apply path. Back up the durable
-  `config_trust.antirollback_state_path` state before upgrading and keep
-  release-specific restore sets. A rollback must restore the state belonging
-  to that release; never delete or reinitialize antirollback state to force an
-  older bundle to load.
-- **BREAKING: source-adapter sidecar configuration rejects unknown keys.**
-  Remove misspelled, retired, or wrapper-only fields before upgrading instead
-  of relying on them to be ignored.
-- Production and evidence-grade operators must review custody for credential,
-  access-token, and federation signing roles. Set
-  `deployment.evidence.signer_custody_approved: true` only when retained review
-  evidence supports the approval; it is an attestation, not a gate bypass.
-- **BREAKING: claim configuration is now validated at load time (#170).**
-  Startup rejects a duplicate claim `id` (REQ-DM-CLAIM-001), a
-  `disclosure.default` outside the claim's allowed disclosure set
-  (REQ-DM-CLAIM-008), and an `extract`/`exists` rule whose `source` does not
-  name a declared source binding (REQ-DM-CLAIM-006), with an error naming the
-  offending claim and field. Configurations that previously loaded with one
-  of these inconsistencies fail to load until corrected; behavior for
-  consistent configurations is unchanged.
-- `extract` and `exists` rule results are now checked against the claim's
-  declared `value.type` at evaluation time (REQ-DM-CLAIM-009), the same
-  enforcement CEL rules already had. A source value that does not conform
-  fails that claim's evaluation instead of flowing into disclosure and
-  credential issuance; claims with `value.type: unknown` (or no declared
-  type) are exempt.
-- The `file` audit sink now takes a process-lifetime advisory single-writer
-  lock on `<path>.lock`, and each append verifies the on-disk tail before
-  writing. A second Notary process pointed at the same audit file fails at
-  startup instead of silently interleaving writes and forking the hash
-  chain, and a write that would extend a diverged chain fails closed.
-
-### Fixed
-
-- Federation denials after request-signature verification now retain the
-  redacted peer, source-scope, profile, purpose, request-JTI, claim, and
-  subject-reference audit context already available at the denial point.
-  Federation response-signing failures retain the same context. Raw peer ids,
-  request JTIs, and subject identifiers do not enter audit records.
-
-## [0.8.4] - 2026-07-04
-
-### Fixed
-
-- Corrected the `GET /admin/v1/posture` OpenAPI example to include the
-  `deployment` and `audit` sections that the live default-tier posture
-  document already returns.
-
-### Changed
-
-- **BREAKING: credential profiles now default to holder binding.** When
-  `holder_binding` is omitted, Registry Notary defaults to `mode: did` with
-  `allowed_did_methods: [did:jwk]`, so direct SD-JWT VC issuance requires a
-  holder DID before it can mint a credential. Deployments that intentionally
-  issue unbound, bearer-style credentials must set `holder_binding.mode: none`
-  explicitly; `registry-notary doctor` now warns on those profiles.
-- Renamed the binary package from `registry-notary-bin` to `registry-notary`
-  so the Cargo package, executable, release artifact, and visible version output
-  use the same user-facing command name.
-- **BREAKING: removed OpenFn sidecar naming from the current source-adapter
-  path.** Claim provenance, config connector values, batch-mode values,
-  examples, Dockerfile naming, metrics, security inventories, and operator docs
-  now use `source_adapter_sidecar` naming instead of the retired OpenFn sidecar
-  name. Operators must update Notary YAML from `connector: openfn_sidecar` to
-  `connector: source_adapter_sidecar`, update sidecar batch connections from
-  `bulk_mode: openfn_sidecar_batch` to
-  `bulk_mode: source_adapter_sidecar_batch`, rebuild any dashboards or alerts that use the
-  old `registry_notary_openfn_sidecar_*` Prometheus metric names, re-render and
-  re-sign governed runtime targets with the
-  `registry.notary.source_adapter_sidecar.runtime.v1` schema id, and update
-  deployment environment variables such as
-  `REGISTRY_NOTARY_SOURCE_ADAPTER_SIDECAR_CONFIG`.
-- **BREAKING: removed the ignored source-adapter sidecar `--jobs-root` CLI
-  flag.** Built-in adapter manifests are self-contained; wrappers that still
-  pass `--jobs-root` must drop it.
-
-## [0.6.2] - 2026-06-22
-
-### Fixed
-
-- **Federated evaluation policy context compatibility**: federation evaluation
-  profiles now pass legal basis, consent, jurisdiction, and assurance context to
-  source matching without presenting that context as a per-transaction
-  authorization scope. This fixes beta-4 lab delegated federation evaluations
-  that depend on governed source-policy gates.
-
-## [0.6.1] - 2026-06-22
-
-### Fixed
-
-- **Static credential policy context compatibility**: static credentials can
-  again carry configured legal basis, consent, jurisdiction, and assurance
-  context for source matching PDP gates without being treated as exact
-  per-transaction authorization scopes. OIDC/RAR authorization details remain
-  fail-closed unless they include transaction scope fields.
-
-## [0.5.0] - 2026-06-21
-
-### Added
-
-- **Dependent source lookups for civil-registration evidence packs**: claim
-  evaluation can precompute source lookup dependencies needed by the OpenCRVS
-  certificate evidence path.
-- **OpenCRVS Notary onboarding documentation**: operator-facing guidance now
-  covers the standalone OpenCRVS DCI claim path used by the beta-3 tutorials.
-- **Built-in DHIS2 health-programme and civil source-adapter examples**: the
-  source-adapter sidecar gains `http_json` manifests
-  (`examples/dhis2-health-sidecar.yaml`, `examples/civil-http-json-sidecar.yaml`)
-  that reproduce the retired OpenFn DHIS2 health and civil jobs through the
-  built-in engine plus CEL collection macros, a live DHIS2 health canary
-  (`scripts/smoke-http-json-dhis2-health-sidecar.sh`), and a parity gate note
-  (`docs/dhis2-health-parity.md`).
-
-### Changed
-
-- **Crosswalk input alignment**: advanced the Crosswalk input to the `0.2.0`
-  release ref used by the beta-3 train.
-- **Platform input alignment**: advanced the Registry Platform input to the
-  `0.3.1` release ref used by the beta-3 train.
-
-### Removed
-
-- **BREAKING: retired the `engine: openfn` source-adapter execution engine.**
-  The source-adapter sidecar no longer runs the pinned OpenFn Node worker pool.
-  All sources now run through the built-in `http_json`, `http_flow`, and `fhir`
-  engines. Removed the manifest `openfn`, `worker`, `jobs_root`, and per-source
-  `workflow` fields (and their governed-target schema fields), the OpenFn
-  worker-pool lifecycle and version-pin/expression-hash checks, the
-  `config print-expression-hashes` CLI subcommand (and the `--jobs-root` flag is
-  now accepted for compatibility but ignored), the Node worker assets and
-  OpenFn smoke scripts, and the `OpenFn DHIS2 Canary` workflow. The sidecar
-  image (`Dockerfile.openfn-sidecar`) is now a pure-Rust distroless image; its
-  filename and built image name/tag conventions, the `openfn_sidecar` Notary
-  source-connector name, and the `registry_notary_openfn_sidecar_*` metric
-  prefix are intentionally kept stable this round (a cosmetic rename is a
-  deferred follow-up). The OpenFn-as-caller integration
-  (`demo/openfn-notary-caller/`, `docs/openfn-notary-caller-guide.md`, and the
-  `@registry/notary-openfn` caller adaptor) is unchanged and still supported.
-
-  GOVERNED-CONFIG IMPACT: dropping the `openfn`/`worker`/`jobs_root` fields
-  changes the governed runtime target's field set, so its `config_hash` changes
-  even though the target schema id is unchanged. Deploying this version requires
-  a coordinated governed-config apply: re-render and re-sign the runtime target,
-  and update the `expected_sidecar.config_hash` that Notary pins for each
-  source connection, before rollout.
-
-### Security
-
-- **Hardened security checks**: tightened token replay handling, forwarded-host
-  trust, and approval-reference checks.
-- **Gated sidecar metrics**: gated source-adapter sidecar metrics behind optional
-  bearer-token auth.
-- **Egress-hardening guidance**: tightened OpenFn egress-hardening guidance while
-  the integration remains available as a caller-side path.
-
-## [0.4.0] - 2026-06-13
-
-### Added
-
-- **Deployment profile gates and audit assurance posture** (#205–#209, PR #218):
-  profile-aware startup and readiness gates with expiring waivers, plus deployment
-  and audit-assurance posture blocks. A `doctor` command reports gate status (PR #219).
-- **SD-JWT VC compatibility conformance harness** (#10, PR #218): fixture-driven
-  verifier conformance suite with stable verification error codes.
-- **Explicit credential verifier** (#77, PRs #215, #216): standalone SD-JWT VC
-  verifier with stable error codes; accepts credentials issued without
-  selective-disclosure arrays.
-- **Parser fuzz regression coverage and authentication hardening** (#132, #173,
-  #175, #177, PR #213).
-- **Durable break-glass approvals** (#221, PR #223): emergency approvals backed by
-  a durable multi-approver store; the default tier emits a `configuration.emergency`
-  posture block carrying no reason or identity material.
-- **Zero-trust source adapter sidecar** (PR #227): out-of-process source adapter with
-  hardened egress, including SSRF and cloud-metadata (IMDS, including IPv6
-  `fd00:ec2::254`) blocking and a bounded per-source LRU cache (PR #232).
-- **`http_flow` sidecar engine** (PR #228): declarative HTTP flow engine with `when`
-  guards, nullable flow bindings, default 404 not-found behavior, and explicit
-  `on_status` actions.
-- **Transaction-token enforcement** (PR #233): per-evaluation transaction-token
-  authorization-details parsing and enforcement across core and server paths;
-  rejects scope broadening against targetless self-attestation bodies before source
-  reads, enforces `jti` replay protection and subject-binding, and fails closed on
-  `cnf` tokens pending sender-proof validation. Supports Assisted Access proving a
-  user-authorized claim without exposing raw eSignet tokens.
-
-### Changed
-
-- **Relationships scoped by purpose** (#92, PR #214): relationship resolution now
-  honors the declared purpose.
-
-### Fixed
-
-- **Release tag ancestry check** (PRs #234, #235, #238): compare release tags against
-  the protected `main` SHA before publishing.
-- **Doctor gate alignment** (PRs #234, #235, #238): align `doctor` deployment gates
-  with runtime behavior and make readiness gates non-waivable.
-- **Source provenance and workflow integrations** (PRs #234, #235, #238): carry source
-  runtime provenance through derived claims; honor OpenFn native workflow batches;
-  apply published config with antirollback accept; resolve bundled approval
-  integration.
-
-### Security
-
-- **SD-JWT holder-proof challenge binding** (PRs #234, #235, #238): bind SD-JWT holder
-  proofs to the verifier key-binding challenge.
-- **Workflow credential hardening** (PRs #234, #235, #238): isolate container OIDC from
-  pull-request workflows, enforce workflow security hardening, drop persisted
-  credentials in the fuzz workflow, and modernize gitleaks allowlists.
-
-## [0.3.0] - 2026-06-12
-
-### Added
-
-- **Image signing and supply-chain hardening** (#121/#95, PR #183): release images are
-  signed via Cosign; published image aliases and signatures verified in CI;
-  stable and snapshot image channels defined (#124).
-- **Binary release workflow** (#123): automated binary build and release pipeline.
-- **OID4VCI pre-authorized-code flow** (PRs #98–#101, #107–#111): pre-auth config,
-  token-signing and rate-limit primitives; pre-auth endpoints and self-issuance trust
-  anchor; issuer metadata and OpenAPI docs; eSignet userinfo subject-binding resolution;
-  RS256 eSignet RP client-assertion key support; wallet display metadata; optional
-  preauth `tx_code`; eSignet `userinfo` without `exp` accepted.
-- **SD-JWT VC Type Metadata** (PRs #93–#94): served at `/.well-known/vct` and
-  VCT URL paths; CCCEV evidence type metadata exposed.
-- **source-adapter sidecar** (PRs #102, #150–#152, #159): batch matching; governed assurance
-  with antirollback; idempotent antirollback restarts; scalable batch controls;
-  Notary sidecar adaptor and perf smoke.
-- **Registry Notary client SDK** (#73): client SDK with documented API.
-- **Governed configuration apply and signing rotation** (#129, PRs #141–#144):
-  admin surface aligned; remote TUF apply config capabilities; credential rotation support.
-- **Atomic runtime governed-config snapshot** (#133, PR #186): governed apply now
-  publishes the runtime snapshot atomically from the locked base.
-- **Notary Trust Ops posture endpoint** (#125): posture endpoint with shared tier filter.
-- **Perf threshold gate** (#160, PR #184): CI now enforces notary perf thresholds;
-  aiohttp perf harness upgraded to 3.14.1 (PR #191, clears Dependabot moderates).
-- **OpenAPI contract gate** (#163, PR #185): committed OpenAPI artifact checked in;
-  CI rejects divergence between generated and committed spec; breaking-change diff
-  against base ref available via `OPENAPI_CONTRACT_BASE_REF`.
-- **Remote TUF config source operator allowlist, fail-closed** (#172, PR #193):
-  remote TUF sources are constrained to an explicit operator allowlist; requests
-  for unlisted sources are rejected.
-- **Claim provenance and `on_behalf_of` contracts frozen for beta** (#182).
-- **OpenSPP and OpenCRVS credential support** (#83, #87): stabilized client contract;
-  attribute credential queries.
-- **Evidence request subject model** (#85).
-- **Hosted lab product image support** (#89).
-- **PKCS#11 signing production-ready** (#113): CEL production runtime hardened (#115);
-  CEL worker boundary packaged (#116); published as single CEL PKCS#11 image (#120).
-- **Security assurance gates** (#96, #104): Grype advisory ratchet gates scoped by
-  image subject; reviewed advisory baselines.
-- **Signing key providers** (#61).
-
-### Changed
-
-- **Admin listener split topology** (#143): Notary admin listener separated from
-  public surface.
-- **Renamed cel-mapping to crosswalk** (#168): all internal references updated.
-- **Userinfo subject binding** (#147): `userinfo` subject-binding claims requested
-  in preauth redirects.
-- **OpenAPI auth surface aligned** (#146): auth declarations consistent across routes.
-- **Admin route security declarations** (#174, PR #190): explicit per-route security
-  declared on all admin routes in the frozen OpenAPI contract.
-- **VCT wildcard catch-all semantics** (#166): machine-visible in spec and check.
-- **Bare VCT routes frozen as deliberate exceptions** (#167): protocol rationale
-  documented.
-- **Dependency: aiohttp bumped to 3.14.1** (PR #191): clears Dependabot moderate
-  advisories in the perf harness lockfile.
-- Documentation overhaul (#158): persona-routed information architecture; admin API
-  client matrix corrected; release-readiness diagrams added.
-
-### Fixed
-
-- **file_watch signing provider SHA-256 content identity** (#130, PR #192):
-  same-mtime key-file replacement now detected via content hash; provider no longer
-  misses key rotations when mtime is unchanged.
-- **Rejected governed applies recorded in posture** (#136, PR #194): rejected
-  apply outcomes are now persisted to the posture store.
-- **Notary consistency surfaces** (#153): request IDs injected at early boundary;
-  sidecar accept loop hardened; API key header canonicalized; discovery API key
-  header canonicalized; problem details returned for readiness failures; HTTP
-  duration histogram emitted; request IDs minted server-side; metrics read scope
-  enforced and labels aligned; notary OIDC config canonicalized.
-- **Nonce throttling and credential validity edge cases** (#157): OID4VCI nonce
-  issuance throttled on public surface; overflowing credential validity rejected;
-  spoofable forwarding headers ignored for public throttles.
-- **OpenAPI nullable syntax** (#157): OpenAPI 3.1 `nullable` syntax corrected in
-  claim result schemas.
-- **CEL startup preflight** (#119): date helpers allowed in startup preflight.
-- **Governed posture config polish** (#138): `previous_config` hash normalization
-  (#137); JWKS discovery made public (#165); governed auth changes validated (#149).
-- **Beta security blockers** (#78): auth handling hardened (#72); metrics endpoint
-  hardened (#79).
-- **zlib1g CVE-2023-45853** (#122): reclassified as false positive in Grype advisory
-  baseline.
-- **eSignet id_token without `typ` header** (#105): accepted in pre-auth callback.
-- **CI lockfile and drift** (various): crosswalk lock refreshed; CI test tooling
-  aligned; lockfile graph restored.
-
-### Security
-
-- **Admin route security declarations** (#174, PR #190): all admin API routes in the
-  frozen OpenAPI contract now carry explicit security declarations, preventing
-  unauthenticated access through missing auth annotations.
-- **Remote TUF allowlist, fail-closed** (#172): operator allowlist gates remote TUF
-  config sources; missing allowlist entry is a hard rejection, not a fallback.
-- **Reject overflowing credential validity** (#157): prevents crafted validity windows
-  from bypassing expiry enforcement.
-- **Ignore spoofable forwarding headers for public throttles** (#157): `X-Forwarded-For`
-  and similar headers no longer influence rate-limit key derivation on the public
-  surface.
-- **Wildcard allowlist segment boundaries enforced** (#149): CEL frame limit aligned.
-- **Cross-origin redirect stripping** (#149): SDK auth stripped on cross-origin
-  redirects; body headers dropped on converted redirects.
-- **Governed auth change validation** (#149): mixed governed auth changes rejected.
-
-## [0.2.1]
-
-See [release tag v0.2.1](https://github.com/jeremi/registry-notary/releases/tag/v0.2.1).
-
-## [0.2.0]
-
-See [release tag v0.2.0](https://github.com/jeremi/registry-notary/releases/tag/v0.2.0).
diff --git a/products/notary/CODEOWNERS b/products/notary/CODEOWNERS
deleted file mode 100644
index 7e1280b27..000000000
--- a/products/notary/CODEOWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-* @PublicSchema/maintainers
-/security/auth-none-allowlist.yml @PublicSchema/maintainers
-/security/exposure-manifest.json @PublicSchema/maintainers
-/Dockerfile @PublicSchema/maintainers
diff --git a/products/notary/Dockerfile b/products/notary/Dockerfile
deleted file mode 100644
index ce66e484d..000000000
--- a/products/notary/Dockerfile
+++ /dev/null
@@ -1,52 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-
-# syntax=docker/dockerfile:1.7
-
-# Keep the tag for humans and the digest for reproducible pulls.
-FROM rust:1.95-trixie@sha256:f49565f188ee00bc2a18dd418183f2c5f23ef7d6e691890517ed341a598f67c3 AS builder
-
-WORKDIR /workspace/registry-notary
-COPY --from=registry-platform Cargo.toml README.md LICENSE /workspace/registry-platform/
-COPY --from=registry-platform crates /workspace/registry-platform/crates
-COPY --from=crosswalk Cargo.toml /workspace/crosswalk/
-COPY --from=crosswalk crates /workspace/crosswalk/crates
-COPY . .
-
-ARG REGISTRY_NOTARY_FEATURES="registry-notary-cel,pkcs11"
-RUN --mount=type=cache,target=/usr/local/cargo/registry \
-    --mount=type=cache,target=/workspace/target \
-    if [ -n "$REGISTRY_NOTARY_FEATURES" ]; then \
-        CARGO_TARGET_DIR=/workspace/target cargo build --release --locked -p registry-notary --features "$REGISTRY_NOTARY_FEATURES"; \
-    else \
-        CARGO_TARGET_DIR=/workspace/target cargo build --release --locked -p registry-notary; \
-    fi \
-    && mkdir -p /workspace/out \
-    && cp /workspace/target/release/registry-notary /workspace/out/registry-notary \
-    && case ",$REGISTRY_NOTARY_FEATURES," in \
-        *,registry-notary-cel,*) \
-            CARGO_TARGET_DIR=/workspace/target cargo build --release --locked -p registry-notary-server --bin registry-notary-cel-worker --features "$REGISTRY_NOTARY_FEATURES" \
-            && cp /workspace/target/release/registry-notary-cel-worker /workspace/out/registry-notary-cel-worker ;; \
-        *) true ;; \
-    esac \
-    && mkdir -p \
-        /workspace/runtime-root/etc/registry-notary \
-        /workspace/runtime-root/var/lib/registry-notary \
-        /workspace/runtime-root/var/log/registry-notary \
-    && chown -R 65532:65532 /workspace/runtime-root
-
-# Runtime policy: the main Notary image is a distroless Rust service image.
-# Keep the runtime shell-free, non-root, and compatible with binary healthchecks
-# and JSON-array entrypoints. CI enforces this policy.
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:d97bc0a941b8d4be647dc0ee75b264ddbb772f1ac5ba690a4309c00723b23775 AS runtime
-
-COPY --from=builder --chown=65532:65532 /workspace/runtime-root/ /
-COPY --from=builder /workspace/out/ /usr/local/bin/
-
-ENV REGISTRY_NOTARY_BIND=0.0.0.0:8080
-EXPOSE 8080
-
-HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD ["/usr/local/bin/registry-notary", "healthcheck"]
-
-WORKDIR /var/lib/registry-notary
-ENTRYPOINT ["/usr/local/bin/registry-notary"]
-CMD ["--config", "/etc/registry-notary/config.yaml"]
diff --git a/products/notary/LICENSE b/products/notary/LICENSE
deleted file mode 100644
index faff09a76..000000000
--- a/products/notary/LICENSE
+++ /dev/null
@@ -1,158 +0,0 @@
-Apache License
-Version 2.0, January 2004
-http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-"License" shall mean the terms and conditions for use, reproduction, and
-distribution as defined by Sections 1 through 9 of this document.
-
-"Licensor" shall mean the copyright owner or entity authorized by the
-copyright owner that is granting the License.
-
-"Legal Entity" shall mean the union of the acting entity and all other
-entities that control, are controlled by, or are under common control with that
-entity. For the purposes of this definition, "control" means (i) the power,
-direct or indirect, to cause the direction or management of such entity,
-whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or
-more of the outstanding shares, or (iii) beneficial ownership of such entity.
-
-"You" (or "Your") shall mean an individual or Legal Entity exercising
-permissions granted by this License.
-
-"Source" form shall mean the preferred form for making modifications,
-including but not limited to software source code, documentation source, and
-configuration files.
-
-"Object" form shall mean any form resulting from mechanical transformation or
-translation of a Source form, including but not limited to compiled object
-code, generated documentation, and conversions to other media types.
-
-"Work" shall mean the work of authorship, whether in Source or Object form,
-made available under the License, as indicated by a copyright notice that is
-included in or attached to the work.
-
-"Derivative Works" shall mean any work, whether in Source or Object form, that
-is based on or derived from the Work and for which the editorial revisions,
-annotations, elaborations, or other modifications represent, as a whole, an
-original work of authorship. For the purposes of this License, Derivative Works
-shall not include works that remain separable from, or merely link (or bind by
-name) to the interfaces of, the Work and Derivative Works thereof.
-
-"Contribution" shall mean any work of authorship, including the original
-version of the Work and any modifications or additions to that Work or
-Derivative Works thereof, that is intentionally submitted to Licensor for
-inclusion in the Work by the copyright owner or by an individual or Legal
-Entity authorized to submit on behalf of the copyright owner. For the purposes
-of this definition, "submitted" means any form of electronic, verbal, or
-written communication sent to the Licensor or its representatives, including
-but not limited to communication on electronic mailing lists, source code
-control systems, and issue tracking systems that are managed by, or on behalf
-of, the Licensor for the purpose of discussing and improving the Work, but
-excluding communication that is conspicuously marked or otherwise designated in
-writing by the copyright owner as "Not a Contribution."
-
-"Contributor" shall mean Licensor and any individual or Legal Entity on behalf
-of whom a Contribution has been received by Licensor and subsequently
-incorporated within the Work.
-
-2. Grant of Copyright License. Subject to the terms and conditions of this
-License, each Contributor hereby grants to You a perpetual, worldwide,
-non-exclusive, no-charge, royalty-free, irrevocable copyright license to
-reproduce, prepare Derivative Works of, publicly display, publicly perform,
-sublicense, and distribute the Work and such Derivative Works in Source or
-Object form.
-
-3. Grant of Patent License. Subject to the terms and conditions of this
-License, each Contributor hereby grants to You a perpetual, worldwide,
-non-exclusive, no-charge, royalty-free, irrevocable patent license to make,
-have made, use, offer to sell, sell, import, and otherwise transfer the Work,
-where such license applies only to those patent claims licensable by such
-Contributor that are necessarily infringed by their Contribution alone or by
-combination of their Contribution with the Work to which such Contribution was
-submitted. If You institute patent litigation against any entity alleging that
-the Work or a Contribution incorporated within the Work constitutes direct or
-contributory patent infringement, then any patent licenses granted to You under
-this License for that Work shall terminate as of the date such litigation is
-filed.
-
-4. Redistribution. You may reproduce and distribute copies of the Work or
-Derivative Works thereof in any medium, with or without modifications, and in
-Source or Object form, provided that You meet the following conditions:
-
-(a) You must give any other recipients of the Work or Derivative Works a copy
-of this License; and
-
-(b) You must cause any modified files to carry prominent notices stating that
-You changed the files; and
-
-(c) You must retain, in the Source form of any Derivative Works that You
-distribute, all copyright, patent, trademark, and attribution notices from the
-Source form of the Work, excluding those notices that do not pertain to any
-part of the Derivative Works; and
-
-(d) If the Work includes a "NOTICE" text file as part of its distribution, then
-any Derivative Works that You distribute must include a readable copy of the
-attribution notices contained within such NOTICE file, excluding those notices
-that do not pertain to any part of the Derivative Works, in at least one of the
-following places: within a NOTICE text file distributed as part of the
-Derivative Works; within the Source form or documentation, if provided along
-with the Derivative Works; or within a display generated by the Derivative
-Works, if and wherever such third-party notices normally appear. The contents
-of the NOTICE file are for informational purposes only and do not modify the
-License. You may add Your own attribution notices within Derivative Works that
-You distribute, alongside or as an addendum to the NOTICE text from the Work,
-provided that such additional attribution notices cannot be construed as
-modifying the License.
-
-You may add Your own copyright statement to Your modifications and may provide
-additional or different license terms and conditions for use, reproduction, or
-distribution of Your modifications, or for any such Derivative Works as a
-whole, provided Your use, reproduction, and distribution of the Work otherwise
-complies with the conditions stated in this License.
-
-5. Submission of Contributions. Unless You explicitly state otherwise, any
-Contribution intentionally submitted for inclusion in the Work by You to the
-Licensor shall be under the terms and conditions of this License, without any
-additional terms or conditions. Notwithstanding the above, nothing herein shall
-supersede or modify the terms of any separate license agreement you may have
-executed with Licensor regarding such Contributions.
-
-6. Trademarks. This License does not grant permission to use the trade names,
-trademarks, service marks, or product names of the Licensor, except as required
-for reasonable and customary use in describing the origin of the Work and
-reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty. Unless required by applicable law or agreed to in
-writing, Licensor provides the Work on an "AS IS" BASIS, WITHOUT WARRANTIES OR
-CONDITIONS OF ANY KIND, either express or implied, including, without
-limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT,
-MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely
-responsible for determining the appropriateness of using or redistributing the
-Work and assume any risks associated with Your exercise of permissions under
-this License.
-
-8. Limitation of Liability. In no event and under no legal theory, whether in
-tort (including negligence), contract, or otherwise, unless required by
-applicable law (such as deliberate and grossly negligent acts) or agreed to in
-writing, shall any Contributor be liable to You for damages, including any
-direct, indirect, special, incidental, or consequential damages of any character
-arising as a result of this License or out of the use or inability to use the
-Work (including but not limited to damages for loss of goodwill, work stoppage,
-computer failure or malfunction, or any and all other commercial damages or
-losses), even if such Contributor has been advised of the possibility of such
-damages.
-
-9. Accepting Warranty or Additional Liability. While redistributing the Work or
-Derivative Works thereof, You may choose to offer, and charge a fee for,
-acceptance of support, warranty, indemnity, or other liability obligations
-and/or rights consistent with this License. However, in accepting such
-obligations, You may act only on Your own behalf and on Your sole
-responsibility, not on behalf of any other Contributor, and only if You agree
-to indemnify, defend, and hold each Contributor harmless for any liability
-incurred by, or claims asserted against, such Contributor by reason of your
-accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
diff --git a/products/notary/README.md b/products/notary/README.md
deleted file mode 100644
index 89af2095e..000000000
--- a/products/notary/README.md
+++ /dev/null
@@ -1,82 +0,0 @@
-# Registry Notary
-
-> **Experimental:** This product is pre-1.0. Its configuration and API may change before the first stable release.
-
-Registry Notary evaluates purpose-bound claims, applies disclosure policy, and
-issues credentials. Registry-backed evidence enters Notary only through an
-authenticated, compiler-pinned Registry Relay consultation. Notary does not
-hold registry destinations or source credentials and does not execute source
-adapters.
-
-A Registry Stack project may deploy:
-
-- Relay only, for governed source access, materialization, or records APIs;
-- Notary without configured claims, for an empty control-plane deployment; or
-- Relay and Notary, for claims derived from Relay consultation outcomes and outputs.
-
-Every evaluable claim must derive from exactly one compiler-pinned Relay
-consultation. Credential issuance is available only from a freshly executed
-Relay-backed evaluation with the exact required provenance.
-
-Notary keeps independent authority over caller authentication, purpose,
-service policy, claim evaluation, disclosure, credential issuance, and its own
-audit chain. Relay keeps independent authority over source acquisition,
-normalization, protocol verification, typed outputs, and its audit chain.
-
-The evidence consumer determines how returned evidence is used. The decision
-owner remains accountable for requirements, eligibility, qualification,
-prioritization, approval, referral, payment, workflow, and action policy.
-Notary may attest a decision that an authoritative source already made when
-the claim is named and documented as source-owned, but Notary does not
-recompute consumer policy.
-
-See [`docs/README.md`](docs/README.md) for product documentation. Use
-Registry Stack project authoring and `registryctl` to generate deployable
-Relay and Notary inputs. Do not hand-author source access inside Notary.
-
-## Layout
-
-- `crates/registry-notary-core`: domain, configuration, claim, disclosure,
-  audit, and credential contracts.
-- `crates/registry-notary-server`: HTTP routes, strict Relay client, claim
-  evaluation, credential issuance, federation, and operational surfaces.
-- `crates/registry-notary-client`: typed Rust client and local credential verification.
-- `crates/registry-notary`: process startup, diagnostics, config verification,
-  and OpenAPI generation.
-- `bindings/python` and `bindings/node`: application client bindings.
-- `docs`: integrator and operator references.
-- `specs`: implementation records and design history.
-
-## Local run
-
-Generate or build a Registry Stack project first, then pass the resulting
-Notary configuration explicitly:
-
-```bash
-just run config=/absolute/path/to/generated/notary.yaml
-```
-
-The binary fails closed when caller authentication is not configured. A
-Registry-backed configuration also fails startup and readiness when its Relay
-semantic contract or hash does not match the compiled expectation.
-
-## Verification
-
-From the Registry Stack monorepo root, use the product preflight and workspace
-gates documented in `AGENTS.md`. Product-local focused checks include:
-
-```bash
-just ci-preflight
-just openapi-check
-just exposure-check
-python3 -m unittest discover -s tests -p '*_test.py'
-```
-
-## Distribution and security
-
-The product crates are not published to crates.io. Consume the Registry Notary
-container using a release tag or immutable digest. Report vulnerabilities
-through GitHub Security Advisories as described in the repository security
-policy.
-
-Apache-2.0. See [`LICENSE`](LICENSE).
diff --git a/products/notary/agent-skills/README.md b/products/notary/agent-skills/README.md
deleted file mode 100644
index 6e2d8c864..000000000
--- a/products/notary/agent-skills/README.md
+++ /dev/null
@@ -1,11 +0,0 @@
-# Registry Notary Agent Skills
-
-Registry Notary Codex skills are now maintained in the public
-`registry-skills` plugin repository.
-
-Canonical skills:
-
-- `registry-notary-config-author`
-- `registry-notary-config-review`
-
-Use the `registry-skills` plugin instead of editing repo-local copies here.
diff --git a/products/notary/archive/specs/evidence-request-subject-model-spec.md b/products/notary/archive/specs/evidence-request-subject-model-spec.md
deleted file mode 100644
index 4766c2d78..000000000
--- a/products/notary/archive/specs/evidence-request-subject-model-spec.md
+++ /dev/null
@@ -1,1645 +0,0 @@
-# Evidence Request Subject Model Spec
-
-> **Status: Archived (2026-05-31).** This is a historical design record and is not
-> the source of truth. Parts of it diverge from the shipped code (see the
-> divergence note below); do not implement from this document. For current
-> behavior see the code and docs/.
->
-> **Current boundary:** Registry Notary does not support self-attested or
-> source-free claim evidence. Identity-derived subject context is authorization
-> only. Every configured claim requires a compiler-pinned Relay consultation.
-
-## Divergence from shipped code (2026-05-31)
-
-- The breaking request-model work this spec frames as future has shipped: see EvaluateRequest/BatchEvaluateRequest at model.rs:580 and 912, BatchItemResponse at model.rs:947, and api.rs:2229.
-- The "empty-context audit hash" path this spec describes as current was replaced by `audit_reference_hash(class, scope, canonical_input)` (registry-platform-audit/src/lib.rs:680).
-- OpenAPI request-envelope schema names drift: this spec's `EvidenceEvaluateRequest`, `EvidenceBatchEvaluateRequest`, and `EvidenceBatchItemRequest` are emitted by the code as `EvaluateRequest`, `BatchEvaluateRequest`, and `BatchEvaluateItemRequest` (openapi.rs:588). The other Evidence-prefixed schema names (EvidenceEntity, EvidenceIdentifier, etc.) do match the code.
-- All self-attestation design material below is retired. It is preserved only
-  as historical context and must not be treated as product direction.
-
-## Status
-
-Draft. Do not freeze this schema until the contract blockers called out in this
-spec are resolved or explicitly deferred with replacement behavior. In
-particular, the request break must land with matching response, audit,
-self-attestation, and federation decisions.
-
-## Purpose
-
-Define the breaking Registry Notary request model for evidence evaluation when
-the caller does not already know the provider's local subject identifier.
-
-The current API centers evaluation on:
-
-```json
-{
-  "subject": {
-    "id": "NID-1001",
-    "id_type": "national_id"
-  }
-}
-```
-
-That shape is too narrow for provider-side identity and record matching. It
-also makes non-person evidence awkward: land parcels, animals, businesses,
-farms, licenses, facilities, and households are not people, even when a person
-is requesting evidence about them.
-
-This spec replaces the identifier-only subject shape with an evidence request
-context made of:
-
-- `requester`: the authenticated actor or party on whose behalf the request is
-  made.
-- `target`: the entity, record, or resource the requested evidence is about.
-- `relationship`: the asserted or requested relationship between requester and
-  target, when relevant.
-- `on_behalf_of`: reserved optional representation context for future
-  multi-party authorization profiles.
-- `claims`: the claims to evaluate.
-- `purpose`: the declared purpose for the evaluation.
-
-## Delivery Commons Principle Alignment
-
-This spec is a design record for the Registry Notary `evaluation` layer, with
-handoffs to the `credential` and `federation` layers where evaluation output is
-issued or delegated. It deliberately keeps Registry Notary in the minimized
-evidence role: Notary evaluates configured claims and returns disclosure-filtered
-results, not general registry rows, candidate records, eligibility decisions, or
-source browsing APIs.
-
-The public contract changes are product-owned application API changes under
-`/v1`, with federation kept as a separate `/federation/v1` compatibility or
-migration decision and wallet-facing behavior kept behind OID4VCI-owned
-protocol surfaces. The canonical handoffs are typed request and response
-schemas, OpenAPI artifacts, SDK bindings, claim/profile configuration, redacted
-audit events, and optional signed credentials.
-
-The weakest sufficient disclosure level for this surface is a claim result or
-credential. The API must not expose raw source rows, corrected registry values,
-candidate matches, near-match diagnostics, raw identifiers in logs or audit, or
-private source binding details in public artifacts. Examples in this spec are
-synthetic documentation values and must not be replaced with production data.
-
-Standards usage is explicit:
-
-- W3C VC, DID, PROV, DPV, and PublicSchema are references or vocabulary
-  mappings for the native Notary model, not claims that evaluation requests are
-  JSON-LD, Verifiable Credentials, or RDF.
-- OOTS and eIDAS are reference or profile inputs only. Core does not claim OOTS
-  interoperability.
-- OID4VCI and SD-JWT VC remain protocol-owned credential surfaces where those
-  standards control route, proof, media type, and holder-binding behavior.
-- HTTP errors use Problem Details as the product error envelope, except where a
-  protocol-owned surface requires its own error shape.
-
-Before implementation, the unresolved profile config, audit pseudonym,
-federation, and retention decisions in this spec must be recorded here or linked
-as reviewed design notes. Implementation is complete only when validation,
-OpenAPI, SDK, redaction, stale-contract, and focused behavior tests prove the
-contract.
-
-## Design Direction
-
-Registry Notary should take inspiration from OOTS identity and record matching,
-especially the idea that the evidence provider performs final matching under
-its own policy. Registry Notary must not copy OOTS or eIDAS as its core model.
-Those frameworks carry EU-specific authentication, level-of-assurance, and
-identifier constraints that do not apply cleanly to every deployment country or
-registry sector.
-
-The core API should instead be W3C-inspired:
-
-- Use the W3C Verifiable Credentials Data Model as conceptual inspiration for
-  claims about arbitrary subjects, not only people.
-- Allow, but do not require, W3C Decentralized Identifiers.
-- Use W3C PROV concepts for provenance and audit vocabulary where useful.
-- Treat privacy and purpose metadata as extensible, with W3C DPV as a useful
-  vocabulary option where deployments need machine-readable privacy semantics.
-
-Primary standards references:
-
-- W3C Verifiable Credentials Data Model 2.0:
-  <https://www.w3.org/TR/vc-data-model/>
-- W3C Decentralized Identifiers 1.0:
-  <https://www.w3.org/TR/did-core/>
-- W3C PROV-O:
-  <https://www.w3.org/TR/prov-o/>
-
-Related references:
-
-- OOTS Identity and Record Matching v2.0.0:
-  <https://ec.europa.eu/digital-building-blocks/sites/spaces/TDD/pages/952470336/2.1+-+Identity+and+Record+Matching+v2.0.0+March+2026>
-- W3C Data Privacy Vocabulary:
-  <https://w3c.github.io/dpv/2.3/dpv/>
-- OpenID Connect Core standard claims:
-  <https://openid.net/specs/openid-connect-core-1_0-18.html#StandardClaims>
-- PublicSchema:
-  <https://publicschema.org/>
-
-Future policy references:
-
-- W3C ODRL Information Model:
-  <https://www.w3.org/TR/odrl-model/>
-
-This request model is not a Verifiable Credential and is not JSON-LD. The rough
-mapping is:
-
-- VC `credentialSubject` is closest to Registry Notary `target`.
-- VC issuer is closest to the eventual Notary credential issuer, not the
-  requester. For holder-bound SD-JWT VC issuance, the credential holder subject
-  can be the holder DID while the matched evidence target remains represented
-  by a separate claim or reference.
-- `requester`, `relationship`, `identifiers[]`, and `assurance` are request
-  context fields with no direct VC equivalent.
-- Registry Notary treats `id` as an opaque string. DID resolution happens only
-  when an explicit profile requires it.
-
-## Goals
-
-- Support provider-side identity and record matching without turning OpenSPP or
-  another requester into a central identifier-mapping hub.
-- Support evidence about people and non-person targets with one coherent model.
-- Let providers receive the minimum context needed to match a target and decide
-  whether the requester is allowed to receive evidence about it.
-- Preserve strong privacy defaults: no raw identity bundles in logs, no raw
-  target identifiers in audit by default, and stable public error codes.
-- Make batch evaluation use the same per-item request model as single
-  evaluation.
-- Provide an implementation path that can start with one demo provider matching
-  a person by name and birth date.
-
-## Non-Goals
-
-- Implement the full OOTS wire protocol.
-- Require eIDAS, DIDs, JSON-LD processing, RDF, ODRL policy engines, or VC
-  issuance for evaluation requests.
-- Define a global ontology for every registry sector.
-- Define fuzzy matching algorithms in Registry Notary core.
-- Expose candidate records, near matches, or raw matching diagnostics to
-  requesters.
-- Support guardianship, multi-hop delegation, joint ownership, customary group
-  rights, household membership, or organization-officer representation in the
-  first implementation. Those need a separate multi-party authorization model.
-
-## Conceptual Model
-
-```mermaid
-flowchart LR
-  Requester["requester: actor or represented party"]
-  Target["target: evidence subject"]
-  Relationship["relationship: asserted link"]
-  Policy["provider matching and access policy"]
-  Source["registry source"]
-  Claim["claim evaluation"]
-  Result["signed or unsigned result"]
-
-  Requester --> Policy
-  Target --> Policy
-  Relationship --> Policy
-  Policy --> Source
-  Source --> Claim
-  Claim --> Result
-```
-
-### Requester
-
-The `requester` is the actor, organization, or represented party whose identity
-or authority matters to the evidence request.
-
-Examples:
-
-- a citizen requesting evidence about themselves;
-- a caseworker acting under delegated program authority;
-- a farmer requesting evidence about a farm holding;
-- a legal representative acting for a cooperative;
-- an upstream government service making a machine-to-machine request.
-
-### Target
-
-The `target` is the entity the requested claim is about.
-
-Examples:
-
-- a person in a civil registry;
-- a land parcel in a cadastral registry;
-- an animal in a livestock registry;
-- a household in a social registry, after a dedicated group profile exists;
-- a business in a company registry;
-- a license, credential, facility, farm, vehicle, or program enrollment.
-
-For person-centered evidence, `requester` and `target` may refer to the same
-person, but the API should still model them separately so non-person evidence
-does not become a special-case patch later.
-
-### Relationship
-
-The `relationship` describes why the requester is allowed to ask about the
-target, or what relationship the provider should verify.
-
-Examples:
-
-- `self`;
-- `owner`;
-- `guardian`;
-- `holder`;
-- `representative`;
-- `caseworker`;
-- `program_authority`.
-
-Relationship verification is provider policy. Registry Notary core validates
-shape and routes context to adapters. It does not decide that a person owns a
-parcel or represents a company unless a configured adapter or upstream service
-returns that result under policy.
-
-## HTTP API Changes
-
-This is a breaking change.
-
-### Public Contract Versus V1 Semantics
-
-Because this API is still pre-adoption, the wire contract should be shaped for
-the cases we can already see: person matching, non-person targets, wallet
-self-attestation, and later representation. That does not mean the first
-implementation has to support every semantic path.
-
-The public request envelope is:
-
-- `requester`: optional entity object. Present when the caller needs to supply
-  requester context beyond the authenticated principal. Wallet and ordinary
-  machine-client flows may derive requester from authentication instead.
-- `target`: entity object. Machine-client evaluation requires it. Citizen
-  self-attestation omits it by default because Registry Notary derives the
-  target from the verified token binding.
-- `relationship`: optional object. Kept as an object, not a string, so later
-  profiles can add evidence, validity windows, or relationship-specific
-  attributes without another wire break.
-- `on_behalf_of`: optional object reserved for future representation,
-  guardianship, legal-person officer, and delegated-authority profiles. V1
-  profiles should reject it with `profile.unsupported`.
-- `claims`: required claim reference list. This keeps the existing name and
-  existing string-or-versioned-object `ClaimRef` semantics.
-- `purpose`: required effective purpose, either per request or per batch item.
-
-V1 implementation may support only:
-
-- one `target` per item;
-- no caller-supplied requester matching;
-- relationship types without relationship evidence;
-- no `on_behalf_of` semantics;
-- person name and birthdate matching demo;
-- land parcel identifier matching demo;
-- wallet self-attestation where requester and target are derived from trusted
-  token claims.
-
-Fields that are present in the public schema but unsupported by a configured
-profile must fail closed. Precedence is:
-
-- structural JSON, type, unknown-field, content-type, and missing required body
-  failures return `request.invalid`;
-- unsupported profile, unsupported public-envelope fields for that profile, or
-  unsupported target/requester types return `profile.unsupported`;
-- disallowed purpose returns `purpose.not_allowed`;
-- matching, target state, and relationship outcomes return the profile's
-  granular or collapsed matching code.
-
-Clients should treat `evidence.not_available` as the portable superset for
-non-disclosing matching, state, and relationship failures. Do not silently
-ignore unsupported requester, relationship, `on_behalf_of`, assurance, or
-attribute fields.
-
-### Single Evaluation
-
-`POST /v1/evaluations` request body becomes:
-
-```json
-{
-  "requester": {
-    "type": "Person",
-    "identifiers": [
-      {
-        "scheme": "national_id",
-        "value": "NID-1001",
-        "issuer": "civil_registry"
-      }
-    ],
-    "attributes": {
-      "given_name": "Amina",
-      "family_name": "Diallo",
-      "birthdate": "1984-02-10"
-    },
-    "assurance": {
-      "method": "national_eid",
-      "level_scheme": "local",
-      "level": "substantial",
-      "verified_at": "2026-05-31T10:00:00Z"
-    }
-  },
-  "target": {
-    "type": "Person",
-    "attributes": {
-      "given_name": "Amina",
-      "family_name": "Diallo",
-      "birthdate": "1984-02-10"
-    }
-  },
-  "relationship": {
-    "type": "self"
-  },
-  "claims": ["person-is-alive"],
-  "purpose": "benefit_eligibility_check",
-  "disclosure": "predicate",
-  "format": "application/vnd.registry-notary.claim-result+json"
-}
-```
-
-The old `subject`, `subject.id`, and `subject.id_type` fields are removed from
-the canonical request. `claims` remains the canonical claim list. If subject
-aliases are wanted for SDK ergonomics, they belong in client helpers, not the
-wire contract.
-
-### Batch Evaluation
-
-`POST /v1/batch-evaluations` request body becomes:
-
-```json
-{
-  "items": [
-    {
-      "requester": {
-        "type": "Person",
-        "attributes": {
-          "given_name": "Amina",
-          "family_name": "Diallo",
-          "birthdate": "1984-02-10"
-        }
-      },
-      "target": {
-        "type": "LandParcel",
-        "identifiers": [
-          {
-            "scheme": "cadastral_reference",
-            "value": "PARCEL-8891",
-            "issuer": "land_registry"
-          }
-        ]
-      },
-      "relationship": {
-        "type": "owner"
-      },
-      "purpose": "benefit_eligibility_check"
-    }
-  ],
-  "claims": ["land-parcel-is-registered"],
-  "disclosure": "predicate"
-}
-```
-
-Each item has the same requester, target, relationship, and purpose shape as a
-single evaluation. A batch-level `purpose` MAY act as a default, but each item
-must resolve to exactly one effective purpose. If both item and batch purpose
-are present, they must match exactly or the item fails with `request.invalid`.
-If neither is present, the item fails with `request.invalid` before policy or
-source reads. Purpose values are exact strings; no case folding, whitespace
-normalization, or alias substitution is applied by core.
-
-`claims` preserves the existing claim reference semantics: each entry
-may be a plain claim id string or a version-pinned object.
-
-The public route path may remain `/v1/evaluations` and
-`/v1/batch-evaluations` even though the body shape breaks. The route cleanup
-record already treats `/v1` as the stable operation family, not a promise that
-request bodies never change before production adoption.
-
-Malformed JSON, wrong content type, unknown fields, or old request shapes must
-produce RFC 9457 Problem Details with `code = request.invalid` using the shared
-product convention for `type`, `title`, `status`, `detail`, `code`, and
-`request_id` or `trace_id`. Axum's default JSON extractor currently rejects
-these before handlers run, so implementation should use a custom extractor or
-equivalent rejection mapper for syntax, content-type, and deserialize failures.
-Bare plaintext 400, 415, or 422 responses are not acceptable final contracts.
-
-### Idempotency And Retry Semantics
-
-The request model break must preserve or explicitly replace existing
-retry-safety behavior. Any route that persists an evaluation result, starts a
-render, issues a credential, or records a durable batch operation must document
-whether retries return the existing result, create a new artifact, or fail with
-a conflict while work is in flight.
-
-Where `Idempotency-Key` is supported, records must be scoped by caller, route,
-method, and a fingerprint over the canonical request shape, including
-`requester`, `target`, `relationship`, `on_behalf_of`, `claims`, `purpose`,
-`disclosure`, and `format` after profile-controlled derivation. Unsupported
-idempotency keys must fail explicitly rather than being silently ignored.
-
-## Data Structures
-
-### EvidenceEntity
-
-`requester` and `target` both use the same base entity shape.
-
-```json
-{
-  "type": "Person",
-  "id": "urn:example:person:123",
-  "identifiers": [
-    {
-      "scheme": "national_id",
-      "value": "NID-1001",
-      "issuer": "civil_registry",
-      "country": "ML"
-    }
-  ],
-  "attributes": {
-    "given_name": "Amina",
-    "family_name": "Diallo",
-    "birthdate": "1984-02-10"
-  },
-  "assurance": {
-    "method": "national_eid",
-    "level_scheme": "local",
-    "level": "substantial",
-    "verified_at": "2026-05-31T10:00:00Z"
-  },
-  "profile": "openspp-demo-v1"
-}
-```
-
-Fields:
-
-- `type`: required. A compact type such as `Person`, `Organization`,
-  `LandParcel`, `Animal`, `FarmHolding`, `Vehicle`, or
-  deployment-defined value. Future JSON-LD profiles may use IRIs.
-- `id`: optional. A stable identifier for the entity when the requester has one.
-  DIDs are allowed but not required.
-- `identifiers`: optional. Domain identifiers that can be used for matching.
-- `attributes`: optional. Attribute bundle used for matching or policy.
-- `assurance`: optional. How the attributes or identifiers were obtained or
-  verified.
-- `profile`: optional. Names the profile used to interpret type, identifiers,
-  and attributes.
-
-At least one of `id`, `identifiers`, or `attributes` MUST be present for
-`target`. An empty target fails with `target.attributes_insufficient` unless a
-more specific profile error applies. An id-only target is valid JSON but may
-still fail profile validation when the configured provider does not accept that
-id.
-
-For `requester`, the object SHOULD be present, but the identity bundle may be
-empty for machine-to-machine clients when authorization is fully represented by
-the authenticated credential and configured policy.
-
-### EvidenceIdentifier
-
-```json
-{
-  "scheme": "cadastral_reference",
-  "value": "PARCEL-8891",
-  "issuer": "land_registry",
-  "country": "ML"
-}
-```
-
-Fields:
-
-- `scheme`: required. Local or profile-defined identifier scheme.
-- `value`: required. Identifier value.
-- `issuer`: optional. Issuer, registry, or authority responsible for the
-  identifier.
-- `country`: optional ISO 3166-1 alpha-2 code when relevant.
-
-Identifier values are sensitive. They MUST NOT be logged raw.
-The `country` field is only country-level context. It must not be used for
-subdivisions, districts, or eIDAS cross-border prefixes embedded inside an
-identifier value.
-
-### EvidenceAssurance
-
-```json
-{
-  "method": "national_eid",
-  "level_scheme": "local",
-  "level": "substantial",
-  "verified_at": "2026-05-31T10:00:00Z",
-  "issuer": "identity_provider",
-  "evidence": [
-    {
-      "type": "document",
-      "method": "in_person"
-    }
-  ]
-}
-```
-
-Fields:
-
-- `method`: optional. Authentication or verification method.
-- `level_scheme`: optional. Scheme for interpreting `level`, such as `local`,
-  `acr`, `eidas`, or another profile-defined token.
-- `level`: optional. Opaque assurance level within `level_scheme`. Core must
-  not compare levels across schemes unless a profile defines the mapping.
-- `verified_at`: optional RFC 3339 timestamp.
-- `issuer`: optional. Identity provider or authority.
-- `evidence`: optional. Redacted assurance evidence metadata using closed
-  profile-defined enums and bounded strings. Raw documents, biometric material,
-  access tokens, URLs to raw documents, and free-form blob fields MUST NOT be
-  embedded in evaluation requests.
-
-### EvidenceRelationship
-
-```json
-{
-  "type": "owner",
-  "attributes": {
-    "basis": "self_declared"
-  }
-}
-```
-
-Fields:
-
-- `type`: required when `relationship` is present.
-- `attributes`: optional relationship-specific matching or policy context.
-
-The presence of a relationship in the request is an assertion or requested
-relationship check, not proof. Providers decide whether the relationship is
-accepted, rejected, or requires stronger evidence.
-
-If `relationship` is absent, the request is accepted only when the configured
-profile declares a self-derivation rule that structurally establishes
-requester-target sameness from shared identifiers or trusted token claims.
-Otherwise the request fails with `relationship.not_established` or the
-profile's collapsed public error. Core must not run fuzzy or attribute-based
-matching merely to infer that relationship.
-
-`owner` and `holder` are distinct relationship types. `owner` means title,
-legal ownership, or registry ownership according to the target profile. `holder`
-means custody, possession, or operational responsibility without necessarily
-implying title.
-
-For land profiles, `owner` MAY mean "one of the registered owners" when the
-upstream can prove membership in the owner set. Customary, collective, disputed,
-or inherited rights beyond registry membership require a richer land-rights
-profile.
-
-### EvidenceOnBehalfOf
-
-`on_behalf_of` is reserved for future multi-party authorization. V1 treats it
-as an opaque object and configured profiles should reject it with
-`profile.unsupported`. It is present in the public envelope now to avoid another
-top-level wire break when representation, guardianship, legal-person officer,
-or delegated-authority profiles are designed.
-
-## Profiles
-
-Profiles define how deployments interpret `type`, `identifiers`,
-`attributes`, `assurance`, and `relationship`.
-
-Registry Notary core should ship only general validation and demo profiles.
-Production deployments SHOULD define profile documentation for each provider or
-claim family.
-
-Each profile or claim binding MUST declare:
-
-- allowed requester and target `type` values;
-- sufficient input groups, expressed as alternative sets of opaque paths such as
-  `target.identifiers[national_id]` OR
-  `target.attributes.given_name + target.attributes.family_name +
-  target.attributes.birthdate`;
-- maximum allowed input paths that may be forwarded to the adapter;
-- allowed relationship types, or that no relationship is accepted;
-- allowed purposes;
-- whether public errors may reveal matching cardinality.
-
-Core may enforce sufficient-input and over-provision checks from this
-declaration before source reads. Core must not interpret field values or
-implement fuzzy matching. Adapters remain responsible for the actual matching
-policy and final acceptance threshold.
-
-Profiles SHOULD reuse existing public vocabularies before inventing local field
-names. PublicSchema is a good default vocabulary for social protection and
-public-service domains because it gives common names for people, identifiers,
-households, programs, enrollments, benefits, and payments without requiring the
-evaluation request to become JSON-LD or a Verifiable Credential.
-
-PublicSchema is a vocabulary source, not a registry-notary dependency. Profiles
-that use PublicSchema terms SHOULD pin the referenced revision or URL set in
-profile documentation. Local DCI identifiers such as `UIN` or `NATIONAL_ID` are
-not competing standards; they are profile-specific identifier schemes that may
-map to PublicSchema concepts.
-
-Wire field names in the base API use snake_case. Profiles may map those names
-to OIDC, PublicSchema, schema.org, OOTS, or local vocabulary terms, but the
-canonical JSON body stays snake_case unless a future JSON-LD profile explicitly
-changes that rule.
-
-Group-like targets such as `Household` are out of the first implementation
-unless a dedicated group profile defines membership, head, time window, and
-group-vs-member claim semantics. Do not ship `Household` as a bare type with no
-profile.
-
-### Recommended Built-In Demo Profiles
-
-`openspp-person-demo-v1`
-
-- `target.type = Person`
-- Matching inputs:
-  - `attributes.given_name`
-  - `attributes.family_name`
-  - `attributes.birthdate`
-- Demonstrates:
-  - unique match success;
-  - no match;
-  - ambiguous match.
-
-The name and birthdate demo validates API plumbing, not production-grade human
-matching. It does not attempt transliteration, partial dates, common-name
-disambiguation, or demographic matching.
-
-`openspp-land-demo-v1`
-
-- `target.type = LandParcel`
-- Matching inputs:
-  - `identifiers[].scheme = cadastral_reference`
-  - optional `attributes.district`
-- Relationship input:
-  - `relationship.type = owner`
-- Demonstrates target matching separately from requester authorization.
-
-### OOTS-Inspired Profile
-
-An OOTS profile MAY map eIDAS attributes into this model:
-
-```json
-{
-  "profile": "oots-eidas-inspired-v1",
-  "type": "Person",
-  "identifiers": [
-    {
-      "scheme": "person_identifier",
-      "value": "ES/AT/02635542Y",
-      "issuer": "eidas"
-    }
-  ],
-  "attributes": {
-    "family_name": "Garcia",
-    "given_name": "Maria",
-    "birthdate": "1984-02-10"
-  },
-  "assurance": {
-    "method": "eidas",
-    "level_scheme": "eidas",
-    "level": "substantial"
-  }
-}
-```
-
-This profile is informative. Core must not require eIDAS attribute names,
-eIDAS levels of assurance, or eIDAS unique identifier handling.
-
-An OOTS-inspired profile SHOULD explicitly declare mandatory and optional input
-sets. For a natural person profile, that may include `family_name`,
-`given_name`, `birthdate`, and a profile-specific person identifier where the
-provider can lawfully use it. The eIDAS person identifier prefix embedded in
-values such as `ES/AT/02635542Y` is not the same thing as the `country` field
-on `EvidenceIdentifier`.
-
-Full OOTS interoperability is not a goal of the base Registry Notary API. An
-OOTS deployment profile may choose stricter mandatory datasets than the generic
-model requires.
-
-## Matching Responsibility
-
-Registry Notary core is responsible for:
-
-- request schema validation;
-- problem code taxonomy;
-- routing request context to configured claims and providers;
-- enforcing request body size limits;
-- rejecting unsupported profiles or missing required fields before source reads
-  when the missing fields are known from static config;
-- rejecting request inputs outside the profile's maximum allowed input set
-  before routing to adapters;
-- validating purpose against deployment and claim allow-lists;
-- minimizing request context to the provider-configured input paths before
-  calling source adapters or upstream evidence services;
-- redacted audit and metrics;
-- stable SDK and OpenAPI contracts.
-
-Provider adapters or upstream evidence services are responsible for:
-
-- identity and record matching;
-- fuzzy, phonetic, transliteration, normalization, or confidence logic;
-- relationship verification;
-- deciding whether attributes are sufficient;
-- deciding whether stronger authentication or reauthentication is required;
-- avoiding raw-value logging and not reintroducing, deriving, or forwarding
-  fields that Registry Notary stripped from the adapter context.
-
-OpenSPP or another Evidence Requester is responsible for:
-
-- sending the minimum context needed for the configured claim or provider;
-- respecting its own privacy and consent/legal-authority rules;
-- not becoming a central mapping database unless that is an explicit product
-  decision outside Registry Notary.
-
-Purpose is policy input, not a free-form note. Deployments MUST configure an
-allow-list of accepted purpose values, and claims or credential profiles MAY
-further restrict that list. Values MAY be compact deployment strings or DPV
-IRIs, but they must be stable enough for audit and policy review. Purpose values
-should be granular enough to correspond to one lawful basis or program use case;
-avoid broad values that hide materially different uses behind one string.
-
-## Wallet And Self-Attestation Flows
-
-Wallet issuance has a stricter trust boundary than machine-to-machine
-evaluation. A wallet-facing OpenID4VCI credential request should not let the
-wallet choose arbitrary `requester` or `target` fields. The requester context
-must be derived from the verified authorization token, configured UserInfo
-claims, or another trusted identity source controlled by Notary policy.
-
-For citizen self-attestation, the safe default is:
-
-- `requester` is derived by Registry Notary from the authenticated subject and
-  configured verified token claims.
-- `target` is derived from the authenticated subject binding claim, not merely
-  from arbitrary descriptive claims, unless a configured wallet credential
-  profile explicitly permits a separate target.
-- `relationship.type` defaults to `self`.
-- conflicting caller-supplied `target`, `requester`, `relationship`, or
-  `on_behalf_of` context is rejected with `self_attestation.subject_mismatch`
-  before source reads.
-- batch evaluation remains disabled.
-- credential issuance stays holder-bound through the wallet proof key.
-
-Delegation, act-as, aggregated UserInfo, or representation tokens are out of
-scope for self-attestation until the multi-party authorization model exists.
-
-The wallet proof key and the requester identity are separate concepts:
-
-- the wallet proof shows control of the holder key that will bind the issued
-  credential;
-- the verified token claims identify or describe the requester;
-- the target identifies what evidence is being requested;
-- provider matching decides whether the target can be uniquely resolved.
-
-Holder binding MUST NOT be treated as proof that the wallet DID is the same
-identifier as the requester or target.
-
-### Wallet Self-Attestation Example
-
-The wallet sends the OpenID4VCI credential request:
-
-```json
-{
-  "format": "dc+sd-jwt",
-  "credential_configuration_id": "person_is_alive_sd_jwt",
-  "proof": {
-    "proof_type": "jwt",
-    "jwt": "eyJ..."
-  }
-}
-```
-
-Registry Notary derives the internal evaluation request from configuration and
-verified token claims:
-
-```json
-{
-  "requester": {
-    "type": "Person",
-    "identifiers": [
-      {
-        "scheme": "national_id",
-        "value": "<verified token claim>",
-        "issuer": "identity_provider"
-      }
-    ],
-    "attributes": {
-      "given_name": "<verified token claim>",
-      "family_name": "<verified token claim>",
-      "birthdate": "<verified token claim>"
-    },
-    "assurance": {
-      "method": "oidc",
-      "level_scheme": "acr",
-      "level": "<verified token assurance>",
-      "verified_at": "<token auth time>"
-    }
-  },
-  "target": {
-    "type": "Person",
-    "identifiers": [
-      {
-        "scheme": "national_id",
-        "value": "<same verified token claim>",
-        "issuer": "identity_provider"
-      }
-    ]
-  },
-  "relationship": {
-    "type": "self"
-  },
-  "claims": ["person-is-alive"],
-  "purpose": "wallet_credential_issuance",
-  "format": "application/dc+sd-jwt"
-}
-```
-
-The internal request MUST NOT be logged with raw values.
-
-### Wallet Requests About Non-Person Targets
-
-Wallet requests about non-person targets, such as land parcels or animals, are
-not part of the safe self-attestation default. They require an explicit
-credential profile because the request must answer both questions:
-
-- Can the target be uniquely matched?
-- Is the requester allowed to receive evidence about that target?
-
-If enabled, the target may come from one of these policy-controlled sources:
-
-- a prior verifiable credential held by the wallet and presented as input;
-- a QR code or deep link generated by the provider for a specific target;
-- a server-populated target identifier allow-list in a portal session;
-- token or UserInfo claims that already include the target relationship.
-
-The wallet MUST NOT be allowed to type an arbitrary parcel id, ear tag,
-household id, or organization id into the credential request unless the
-credential profile explicitly permits that input and applies enumeration
-controls.
-
-Required additional controls for non-person wallet targets:
-
-- require stronger requester assurance;
-- require `relationship.type` to be configured per credential profile;
-- rate limit failed target and relationship matching separately;
-- return generic denials for authorization failures;
-- avoid exposing whether the target exists when relationship policy fails.
-
-### Impact On Existing Wallet Specs
-
-The self-attestation and OpenID4VCI implementations derive requester and target
-context from trusted token binding for the default person self-attestation
-profile. Their specs should describe that behavior directly: the guard compares
-trusted token claims against the derived `requester` and `target` context, not
-against a caller-supplied `subject.id`. Non-person wallet targets and delegated
-or `on_behalf_of` flows remain future profile work until their authorization
-model is specified and tested.
-
-## Problem Codes
-
-Problem codes have two disclosure levels:
-
-- public codes returned to callers;
-- audit codes recorded in keyed audit for operators.
-
-Granular matching codes are useful for OpenSPP policy mapping, but they can
-also become an enumeration oracle. Each profile must declare whether public
-errors may reveal target matching cardinality. When disclosure is not allowed,
-the public response must collapse to `evidence.not_available` while audit keeps
-the granular code. If a profile does not explicitly allow public cardinality or
-state disclosure, the default is to collapse.
-
-Stable public codes:
-
-- `request.invalid`
-- `purpose.not_allowed`
-- `profile.unsupported`
-- `evidence.not_available`
-- `requester.reauthentication_required`
-- `requester.matching_policy_rejected`
-- `target.not_found`
-- `target.match_ambiguous`
-- `target.identifier_missing`
-- `target.attributes_insufficient`
-- `target.matching_policy_rejected`
-- `target.not_in_valid_state`
-- `target.match_low_confidence`
-- `relationship.not_established`
-- `relationship.match_ambiguous`
-- `relationship.attributes_insufficient`
-- `relationship.policy_rejected`
-- `source.unavailable`
-- `claim.not_found`
-- `claim.version_not_found`
-- `claim.format_not_supported`
-- `batch.too_large`
-
-Optional requester-resolution profiles MAY also use these audit and public
-codes when the requester itself is matched against a provider registry:
-
-- `requester.not_found`
-- `requester.match_ambiguous`
-- `requester.identifier_missing`
-- `requester.attributes_insufficient`
-
-Default self-attestation and machine-client flows do not use requester matching
-codes because the requester is authenticated, not record-matched.
-
-Guidance:
-
-- Use `target.not_found` when matching completed and no target record matched
-  and the profile allows that disclosure.
-- Use `target.match_ambiguous` only when matching produced two or more distinct
-  target entities. Duplicate rows for the same entity are a registry quality or
-  state problem, not necessarily ambiguity.
-- Use `target.not_in_valid_state` when the target exists but is deceased,
-  archived, superseded, merged, inactive, or otherwise invalid for the claim.
-  Profiles that expose this code should distinguish follow-the-pointer states
-  such as merged or superseded from terminal states such as deceased or
-  archived in audit, while collapsing publicly unless state disclosure is
-  explicitly allowed.
-- Use `target.match_low_confidence` only when exactly one candidate is found but
-  is below the provider's acceptance threshold. A sub-threshold candidate MUST
-  NOT be returned as a successful match.
-- Use `target.identifier_missing` when a profile requires a target identifier
-  from a specific scheme and the request omits it.
-- Use `target.attributes_insufficient` when the request did not contain enough
-  target data to run the provider's configured matching policy.
-- Use `target.matching_policy_rejected` when the target input is structurally
-  valid but violates provider matching policy, such as a disallowed identifier
-  issuer, geography, target type, or profile-specific eligibility gate.
-- Use `requester.reauthentication_required` when the provider requires stronger
-  identity evidence from the requester.
-- Use requester matching codes only for profiles that explicitly record-match
-  the requester against a provider registry. Authenticated-principal failures
-  should stay in the authentication or authorization code family.
-- Use `relationship.not_established` when requester and target were resolved,
-  but the requested relationship is absent.
-- Use `relationship.match_ambiguous` when relationship evidence resolves to
-  more than one materially different relationship edge and policy cannot choose
-  one.
-- Use `relationship.attributes_insufficient` when the request omits attributes
-  required to verify the requester-target relationship.
-- Use `relationship.policy_rejected` when the target may or may not exist but
-  the requester is not allowed to receive evidence about it.
-- Use `source.unavailable` only for transport, upstream availability, timeout,
-  or malformed upstream response failures.
-
-Existing `source.not_found` and `source.ambiguous` are implementation-era codes
-for source read results. The migration should map adapter matching outcomes to
-the new target or relationship codes, while retaining `source.*` only for
-legacy compatibility and low-level connector failures during the transition.
-
-## Response Model
-
-The request break must include a response break. Existing response fields such
-as `subject_ref` and `id_type` cannot represent attribute-only matching or
-non-person targets.
-
-Single and batch claim results SHOULD expose redacted references:
-
-```json
-{
-  "requester_ref": {
-    "type": "Person",
-    "handle": "rnref:v1:..."
-  },
-  "target_ref": {
-    "type": "LandParcel",
-    "handle": "rnref:v1:...",
-    "identifier_schemes": ["cadastral_reference"]
-  }
-}
-```
-
-Rules:
-
-- `target_ref` replaces `subject_ref` in evaluation and batch responses.
-- `id_type` is removed from response views. Identifier schemes may be returned
-  only when they were supplied by the caller or explicitly disclosed by profile.
-- `profile` MAY be returned only when the profile allows it. Do not echo a
-  profile value when it would reveal registry membership.
-- Response references are pseudonymous handles, not public proofs of identity.
-- `handle` is an opaque versioned string. Its internal construction is not part
-  of the public API and must not be assumed to be a raw `hmac-sha256:` value.
-- Matching metadata attaches per claim result or per batch item result, not as
-  one request-level field, because different claims may use different adapters
-  and policies.
-
-Evaluation responses SHOULD include redacted matching metadata when available:
-
-```json
-{
-  "matching": {
-    "policy_id": "openspp-person-name-birthdate-v1",
-    "method": "exact_name_birthdate",
-    "confidence": "high",
-    "score": null
-  }
-}
-```
-
-Rules:
-
-- `policy_id` SHOULD be stable and non-sensitive.
-- `method` SHOULD describe the broad matching method, not expose provider
-  internals.
-- `confidence` is an enum such as `high`, `medium`, or `low`.
-- `score` MAY be present as a separate numeric value only when the provider
-  contract defines its meaning.
-- Candidate records, near matches, and raw comparison diagnostics MUST NOT be
-  returned in public errors.
-- Failed matches SHOULD NOT return matching metadata to callers. The audit path
-  may record policy id and method.
-
-### EvidenceEntityRef
-
-`EvidenceEntityRef` is the response reference shape for requester and target
-entities:
-
-- `type`: entity type, such as `Person` or `LandParcel`.
-- `handle`: opaque versioned pseudonymous handle, such as `rnref:v1:...`.
-- `identifier_schemes`: optional scheme names. Include only schemes supplied by
-  the caller or allowed for public disclosure by profile.
-- `profile`: optional profile id. Include only when disclosure is allowed.
-
-`requester_ref` often omits `identifier_schemes` because the requester is
-usually represented by the authenticated principal rather than provider-side
-record matching. Profiles that resolve the requester against a registry may
-include allowed requester identifier scheme names.
-
-## Privacy And Audit
-
-Requests contain sensitive identifiers and attributes. The implementation MUST:
-
-- avoid logging raw request bodies;
-- avoid logging raw requester or target identifiers;
-- hash identifiers in audit using a domain-separated keyed pseudonym that binds
-  at least role, entity type, scheme, issuer, country, optional purpose scope,
-  and raw value before HMAC. Missing optional fields must canonicalize to
-  explicit empty values;
-- record request profile, claims hash, purpose, matching policy id,
-  matching method, and public problem code;
-- for batch evaluation, record per-item target/requester pseudonyms and
-  matching outcomes rather than only request-level metadata;
-- preserve the granular audit problem code when a public response collapses to
-  `evidence.not_available`;
-- avoid recording raw names, birth dates, addresses, parcel ids, ear tags,
-  document numbers, or sector identifiers in audit JSONL;
-- never record per-field attribute hashes for low-entropy attributes such as
-  birth dates, names, districts, or species;
-- keep Problem Details `detail` free of raw identity and target values;
-- treat `attributes` as sensitive even when individual fields look harmless;
-- treat the requester-to-target edge as sensitive, because a query relationship
-  may reveal social protection status, health status, land ownership, or program
-  interest even when both endpoints are pseudonymous;
-- document which fields each provider adapter forwards upstream.
-
-Identifier HMACs are correlation pseudonyms under a secret-key assumption. They
-are not one-way commitments if the secret is later exposed, especially for
-enumerable values such as national identifiers, parcel references, and ear
-tags. The audit design must document the retention window, key rotation plan,
-and erasure approach. For append-only hash chains, erasure normally requires a
-crypto-shredding or key-destruction plan for the affected pseudonym scope, which
-must be reconciled with investigation requirements.
-
-Deployments may need two pseudonym classes:
-
-- a purpose-scoped handle for privacy-preserving routine audit views;
-- a broader investigation handle for access-controlled investigations that need
-  to pivot across purposes.
-
-The broader handle must be protected by stricter access controls and should use
-a non-exfiltratable KMS or HSM-backed key where available. The final pseudonym
-design must replace the current empty-context audit hash path and align with
-federation pairwise-hash construction.
-
-Attribute bundles SHOULD usually be absent from audit. If a deployment needs
-correlation over an attribute bundle, it may record one domain-separated keyed
-hash over the canonicalized complete bundle for a specific policy and purpose.
-It must not record separate hashes for individual quasi-identifiers.
-
-Audit should align conceptually with W3C PROV:
-
-- requester or machine client is the responsible agent;
-- evaluation is the activity;
-- provider matching is a distinct activity when a target is resolved;
-- registry source observations are entities used by the activity;
-- claim result is the generated entity.
-
-The implementation does not need to serialize PROV-O.
-
-## OpenAPI And SDK Requirements
-
-OpenAPI MUST expose schemas for:
-
-- `EvidenceEvaluateRequest`;
-- `EvidenceBatchEvaluateRequest`;
-- `EvidenceBatchItemRequest`;
-- `EvidenceEntity`;
-- `EvidenceIdentifier`;
-- `EvidenceAssurance`;
-- `EvidenceRelationship`;
-- `EvidenceOnBehalfOf`;
-- `EvidenceEntityRef`;
-- `MatchingMetadata`;
-- updated claim result and batch item response schemas using `target_ref` and
-  optional `requester_ref`.
-
-Python SDK SHOULD provide helpers for:
-
-- person requester;
-- person target;
-- identifier target;
-- name and birthdate target;
-- batch item construction.
-
-The SDK MUST still allow raw canonical request mappings so deployments can use
-profile-specific attributes before helpers exist.
-
-Node and Rust clients SHOULD mirror the same canonical wire names. Avoid
-language-specific casing on the wire.
-
-Hand-written OpenAPI paths, examples, and response schemas must be updated in
-addition to derive-generated component schemas.
-
-## Implementation Workstreams
-
-These stages describe workstreams, not independently shippable commits. The
-first compile-safe implementation tranche must include contract plumbing,
-response/audit/error changes, adapter trait changes, self-attestation migration,
-and a federation shim decision together. Replacing `EvaluateRequest.subject`
-breaks too many live call paths to land as a small isolated step.
-
-### Stage 1: Contract Plumbing
-
-- Replace `EvaluateRequest.subject` with `requester`, `target`,
-  `relationship`, and `claims`.
-- Replace `BatchEvaluateRequest.subjects` with `items`.
-- Add model structs for entities, identifiers, assurance, relationship,
-  reserved on-behalf-of context, entity references, and matching metadata.
-- Add purpose allow-list validation and profile-level sufficient-input and
-  maximum-input checks.
-- Add a JSON rejection path that maps old or malformed request shapes to
-  Problem Details with `request.invalid`.
-- Update derive-generated and hand-written OpenAPI schemas and examples.
-- Update Python, Node, and Rust clients and bindings.
-- Keep serde `deny_unknown_fields` on public request structs.
-
-### Stage 2: Response, Audit, And Error Taxonomy
-
-- Replace `subject_ref` response fields with `target_ref` and optional
-  `requester_ref`.
-- Remove `id_type` from response views.
-- Add matching metadata at the claim result or batch item level.
-- Add new public and audit problem codes with disclosure collapse to
-  `evidence.not_available` where configured.
-- Add audit fields for profile, purpose, matching policy id, matching method,
-  target type, requester type, per-item batch outcomes, granular audit code,
-  and domain-separated pseudonyms.
-- Update stored evaluation metadata used by render and credential issuance.
-
-### Stage 3: Provider Matching Contract
-
-- Redesign source/provider adapter traits so adapters receive the full request
-  context needed for matching.
-- Add adapter-level field minimization config.
-- Enforce adapter minimization before source calls, including requester and
-  relationship input paths where profiles allow them.
-- Add matching outcome mapping to stable requester, target, and relationship
-  problem codes.
-- Add matching metadata to successful responses where adapters provide it.
-- Update `SourceLookupConfig` or replace it with a profile binding that can
-  express identifiers and multi-attribute matching.
-- Revisit bulk `read_many`, which currently assumes one lookup value per
-  subject.
-
-### Stage 4: Self-Attestation And Wallet Migration
-
-- Rewrite the self-attestation subject-binding guard so it derives and compares
-  trusted `requester` and `target` context instead of caller-supplied
-  `subject.id`.
-- Update OpenID4VCI facade internals to construct the new evaluation context
-  from token claims and credential configuration.
-- Keep wallet self-attestation single-target and non-batch by default.
-
-### Stage 5: Demo Providers
-
-- Add one demo person provider using `given_name + family_name + birthdate`.
-- Add fixtures for unique match, ambiguous match, and no match.
-- Add a land parcel identifier demo as the first non-person provider.
-- Document owner vs holder semantics for land and livestock examples.
-
-### Stage 6: Federation Decision
-
-Federation is not automatically covered by this request-model break. Before
-shipping the break, either:
-
-- add a concrete federation shim that accepts the old signed request profile,
-  maps it into the new target model internally, and emits the old signed
-  response only for federation v0.1; or
-- update federated evaluation specs and code in lockstep to use `target_ref`,
-  remove `id_type`, and define pairwise hashes for attribute-matched targets.
-
-Either path must define pairwise hash input for the new target model. For
-attribute-only matching, the handle must not expose raw attributes or become a
-cross-peer correlation handle.
-
-## Contract Tests
-
-Required tests before the API break is considered complete:
-
-- identifier-only target succeeds through the new `identifiers[]` shape;
-- person target with `given_name + family_name + birthdate` produces a unique
-  match success;
-- person target with duplicated name and birthdate produces
-  `target.match_ambiguous`;
-- person target with no matching row produces `target.not_found`;
-- duplicate rows for one target entity do not produce `target.match_ambiguous`;
-- invalid target state produces `target.not_in_valid_state`;
-- one sub-threshold candidate produces `target.match_low_confidence` or a
-  collapsed public `evidence.not_available`, never a successful match;
-- missing required matching attributes produces `target.attributes_insufficient`;
-- empty target produces `target.attributes_insufficient`;
-- profile over-provision rejects or strips unallowed input before adapter
-  routing, according to configured policy;
-- source adapters receive only the minimized configured context, including
-  requester and relationship fields when configured;
-- HTTP and file source lookups can address configured target, requester, and
-  relationship paths without raw request forwarding;
-- disallowed purpose produces `purpose.not_allowed`;
-- requester requiring stronger assurance produces
-  `requester.reauthentication_required`;
-- relationship rejection produces `relationship.policy_rejected`;
-- profiles configured to hide cardinality collapse not-found, ambiguous, and
-  relationship rejection, target state, and low-confidence outcomes to public
-  `evidence.not_available` while audit records the granular code;
-- batch evaluation supports mixed target types and preserves per-item errors;
-- batch audit records per-item target/requester pseudonyms, matching outcome,
-  matching method, matching policy id, and granular audit code when public
-  errors are collapsed;
-- credential issuance audit for wallet/self-attestation links to the stored
-  evaluation target and requester references, not to caller-supplied fields;
-- old `{ subject: { id, id_type }, claims: [...] }` request fails with
-  RFC 9457 Problem Details and `request.invalid`, not a bare 422 body;
-- retry-sensitive POST behavior is tested or explicitly documented, including
-  canonical request fingerprinting for any supported `Idempotency-Key`;
-- version-pinned claims keep the existing ClaimRef object behavior;
-- successful responses expose `target_ref` and do not expose `subject_ref` or
-  `id_type`;
-- matching metadata is per result or per batch item;
-- audit output does not contain raw names, birth dates, identifiers, parcel ids,
-  ear tags, request bodies, or Problem Details `detail`;
-- audit output treats the requester-target edge as sensitive and uses
-  domain-separated pseudonyms;
-- routine and investigation pseudonym behavior is tested or explicitly disabled
-  by config;
-- OpenAPI includes the new schemas and no longer exposes the old subject schema
-  on evaluation routes;
-- Python client can send canonical identity bundle requests without lossy
-  transformation.
-
-## Example Requests
-
-### Person Evidence
-
-```json
-{
-  "requester": {
-    "type": "Person",
-    "attributes": {
-      "given_name": "Amina",
-      "family_name": "Diallo",
-      "birthdate": "1984-02-10"
-    },
-    "assurance": {
-      "method": "national_eid",
-      "level_scheme": "local",
-      "level": "substantial"
-    }
-  },
-  "target": {
-    "type": "Person",
-    "attributes": {
-      "given_name": "Amina",
-      "family_name": "Diallo",
-      "birthdate": "1984-02-10"
-    }
-  },
-  "relationship": {
-    "type": "self"
-  },
-  "claims": ["person-is-alive"],
-  "purpose": "benefit_eligibility_check"
-}
-```
-
-### Land Parcel Evidence
-
-```json
-{
-  "requester": {
-    "type": "Person",
-    "identifiers": [
-      {
-        "scheme": "national_id",
-        "value": "NID-1001",
-        "issuer": "civil_registry"
-      }
-    ]
-  },
-  "target": {
-    "type": "LandParcel",
-    "identifiers": [
-      {
-        "scheme": "cadastral_reference",
-        "value": "PARCEL-8891",
-        "issuer": "land_registry"
-      }
-    ],
-    "attributes": {
-      "district": "North"
-    }
-  },
-  "relationship": {
-    "type": "owner"
-  },
-  "claims": ["land-parcel-is-registered"],
-  "purpose": "benefit_eligibility_check"
-}
-```
-
-### Animal Evidence
-
-This example assumes the organization requester is directly authenticated as a
-machine or service principal. It does not model a human officer acting for the
-organization; that requires the future multi-party authorization profile.
-
-```json
-{
-  "requester": {
-    "type": "Organization",
-    "identifiers": [
-      {
-        "scheme": "registration_number",
-        "value": "COOP-123",
-        "issuer": "company_registry"
-      }
-    ]
-  },
-  "target": {
-    "type": "Animal",
-    "identifiers": [
-      {
-        "scheme": "ear_tag",
-        "value": "ML-03499122",
-        "issuer": "livestock_registry"
-      }
-    ],
-    "attributes": {
-      "species": "cattle"
-    }
-  },
-  "relationship": {
-    "type": "holder"
-  },
-  "claims": ["animal-vaccination-current"],
-  "purpose": "agriculture_support"
-}
-```
-
-## Open Questions
-
-Resolved by this draft:
-
-1. Batch items must resolve to exactly one effective purpose. A batch default is
-   allowed only when it does not conflict with item purpose.
-2. `requester` should be present, but its identity bundle may be empty for
-   machine-authorized back-office evaluation.
-3. `type` remains open at schema level and constrained by profile or claim
-   config at runtime.
-4. Matching metadata is returned on successful results only; failed-match
-   details stay in keyed audit.
-5. The first non-person demo target should be land parcel.
-
-Resolve before the first implementation tranche:
-
-1. What exact domain-separated audit pseudonym function replaces the current
-   identifier HMAC path?
-2. Which config surface declares profile sufficient-input groups and maximum
-   allowed input paths?
-3. Which source/provider implementors are in the first adapter trait redesign?
-4. Is federation migrated in the same breaking release, or bridged with a
-   concrete v0.1 compatibility shim?
-5. Are attribute bundle hashes ever allowed in audit, or should attributes be
-   categorically absent from audit?
-6. What audit retention window and erasure mechanism apply to pseudonymous but
-   still personal audit records?
-
-Deferred to a future spec:
-
-1. Multi-party authorization semantics for `on_behalf_of`.
-2. Household and group target profiles.
-3. Non-person wallet targets beyond server-populated, profile-controlled pilots.
-
-## Definition Of Done
-
-This work is done only when all criteria below are satisfied and reviewed:
-
-- Public request models compile with `requester`, `target`, `relationship`,
-  reserved `on_behalf_of`, `claims`, `purpose`, `disclosure`, and `format`.
-- Old `subject.id` / `subject.id_type` evaluation requests return RFC 9457
-  Problem Details with `code = request.invalid`; no JSON rejection returns a
-  bare 400, 415, or 422 body.
-- OpenAPI exposes the new request, response, entity, identifier, assurance,
-  relationship, `on_behalf_of`, entity-ref, and matching-metadata schemas, and
-  no evaluation route example uses the old subject shape.
-- Python, Node, and Rust clients can send canonical replacement evaluation and
-  batch evaluation requests, including version-pinned claim refs.
-- Runtime evaluates identifier-only targets, person name-and-birthdate targets,
-  and land-parcel identifier targets through configured profiles.
-- Profile validation enforces allowed target/requester types, sufficient-input
-  groups, maximum input paths, allowed relationship types, and allowed purposes
-  before source reads.
-- Public error precedence is tested: structural errors, profile unsupported,
-  purpose denied, then granular or collapsed matching errors.
-- Retry-sensitive POST behavior is documented and tested; any supported
-  `Idempotency-Key` is caller-scoped and bound to the canonical request
-  shape.
-- Matching outcomes cover unique match, no match, ambiguous distinct entities,
-  duplicate rows for one entity, low-confidence single candidate, invalid target
-  state, missing inputs, relationship rejection, and reauthentication required.
-- Response bodies expose `target_ref` and optional `requester_ref`, never
-  `subject_ref` or `id_type`; response handles are opaque versioned strings.
-- Audit output contains no raw request bodies, names, birth dates, target
-  identifiers, requester identifiers, parcel ids, ear tags, Problem Details
-  `detail`, access tokens, holder keys, or source rows.
-- Batch audit includes per-item pseudonyms and granular audit codes for matching
-  failures without leaking raw requester, target, or relationship values.
-- Audit pseudonyms use the approved domain-separated construction, with routine
-  and investigation behavior either implemented and tested or explicitly
-  disabled by config.
-- Wallet self-attestation derives requester and target from authenticated token
-  binding, rejects arbitrary wallet-selected targets by default, and remains
-  single-target and non-batch.
-- Federation either has a tested v0.1 compatibility shim or has been migrated
-  to the new target model with updated signed request/response tests.
-- Focused contract tests, security/privacy tests, client tests, OpenAPI tests,
-  and relevant Rust test packages pass in CI.
-- Documentation and examples in `docs/`, `specs/`, perf scripts, and demo
-  configs are updated so no supported path teaches the old subject contract.
-
-## Delivery Waves
-
-Wave 0: Freeze Entry Decisions
-
-- Work can run in parallel across security, config/API, federation, and client
-  owners.
-- Decide pseudonym construction, audit retention/erasure approach, profile
-  config shape, adapter implementor scope, and federation shim versus migration.
-- DoD: decisions are recorded in this spec or linked design notes; no "Resolve
-  before the first implementation tranche" item remains unanswered.
-- Review checkpoint: security, API, and federation reviewers approve the entry
-  decisions before model code changes begin.
-
-Wave 1: Contract Skeleton
-
-- Parallel lanes: core models/errors, OpenAPI examples, client type surfaces,
-  and JSON rejection extractor.
-- Implement new request/response structs, `target_ref`, optional
-  `requester_ref`, opaque handles, public problem codes, and request-invalid
-  mapping.
-- DoD: old-shape requests produce RFC 9457 `request.invalid`; OpenAPI no longer
-  exposes old evaluation subjects; Rust, Python, and Node compile against the
-  new canonical shape.
-- Review checkpoint: API contract review validates schemas, examples, response
-  refs, and client ergonomics before runtime matching work starts.
-
-Wave 2: Profile Gate And Adapter Contract
-
-- Parallel lanes: profile config validation, adapter trait redesign, demo
-  in-memory fixtures, and source connector migration.
-- Implement sufficient-input groups, maximum input paths, allowed types,
-  relationship policy, purpose allow-lists, and adapter matching outcomes.
-- DoD: tests prove pre-read rejection for missing/disallowed inputs and source
-  reads occur only after profile gates pass.
-- Review checkpoint: domain and implementation reviewers validate that core
-  performs presence/minimization only, while adapters own matching decisions.
-
-Wave 3: Demo Matching Paths
-
-- Parallel lanes: person demo, land parcel demo, response metadata, and error
-  collapse tests.
-- Implement person name-and-birthdate matching and land parcel identifier
-  matching with unique, no-match, ambiguous, duplicate-row, low-confidence, and
-  invalid-state fixtures.
-- DoD: all matching outcome codes and `evidence.not_available` collapse rules
-  are covered by contract tests.
-- Review checkpoint: security reviewer confirms no public oracle is introduced;
-  product/domain reviewer confirms demos match OpenSPP needs.
-
-Wave 4: Wallet, Audit, And Federation
-
-- Parallel lanes: self-attestation/OID4VCI migration, audit pseudonym/redaction,
-  and federation shim or migration.
-- Rewrite wallet self-attestation derivation, add audit fields and redaction
-  tests, and land the federation decision from Wave 0.
-- DoD: wallet issuance cannot choose arbitrary targets; credential issuance
-  audit links to stored requester and target refs; batch audit records per-item
-  matching outcomes; audit redaction tests pass; federation signed
-  request/response tests pass under the selected path.
-- Review checkpoint: security and federation reviewers approve before any
-  release candidate is cut.
-
-Wave 5: Clients, Docs, And CI Hardening
-
-- Parallel lanes: SDK helpers, docs/examples/perf updates, demo configs, and CI
-  matrix cleanup.
-- Update all user-facing docs and scripts, add client contract tests, and run
-  the relevant full verification set.
-- DoD: CI passes for core/server/client/bindings; docs search shows no
-  supported old-shape evaluation examples; release notes call out the breaking
-  change.
-- Review checkpoint: final code review verifies the Definition Of Done line by
-  line. No feature is marked complete until its implementation, tests, docs,
-  and security review are all merged.
-
-## Follow-Up Definition Of Done
-
-Audit pseudonym implementation work must follow the accepted
-[Audit Pseudonym Redesign ADR](adr-audit-pseudonym-redesign.md).
-
-The audit pseudonym and self-attestation derivation follow-up is done only when
-all criteria below are satisfied:
-
-- A short audit pseudonym ADR is committed and reviewed before audit hash code
-  changes land.
-- The ADR defines versioned hash domains for routine matched references,
-  matching attempts, and investigation-only references, including role, entity
-  type, purpose scope, and canonical input fields.
-- Identifier hash inputs are stable: identifiers are sorted, missing
-  `issuer` and `country` are canonicalized to explicit empty values, and the
-  canonical input includes role, entity type, scheme, issuer, country, value,
-  purpose scope, and pseudonym version.
-- Pure no-match failures do not emit a long-lived attribute-derived entity
-  pseudonym. If repeat-probe correlation is enabled, it is explicitly
-  configured as a short-lived, purpose-scoped matching-attempt pseudonym.
-- Audit retention, key rotation, erasure, and hash-chain crypto-shredding
-  limits are documented in the ADR or deployment hardening guide.
-- The audit design is reconciled with federation pairwise subject hashes:
-  federation and audit use separate secrets and domains, and tests prove the
-  two handles are not interchangeable.
-- Self-attestation `/v1/evaluations` derives `target`, `requester`, and
-  `relationship: { "type": "self" }` from the verified token binding.
-- Self-attestation request bodies no longer need to provide target identity;
-  any conflicting supplied `target`, `requester`, or `relationship` is rejected
-  with a deliberate, documented public problem code.
-- Machine-client evaluation still requires caller-supplied `target`.
-- OID4VCI and non-wallet self-attestation describe the same identity-derivation
-  rule in specs, OpenAPI, client docs, and examples.
-- Tests scan serialized audit output and logs for representative raw values,
-  including names, dates of birth, national identifiers, parcel ids, and animal
-  ear tags, and fail if any are present.
-- Focused tests for audit pseudonyms, self-attestation derivation, conflict
-  rejection, machine-client target validation, OpenAPI schema shape, client
-  examples, and the request-body-limit regression pass locally.
-- `cargo fmt --all -- --check`, `cargo clippy --workspace --all-targets
-  --all-features -- -D warnings`, and `cargo test --workspace --all-features`
-  pass before the work is marked complete.
-
-## Follow-Up Implementation Plan
-
-Wave 0: Design Freeze
-
-- Parallel work: one worker drafts the audit pseudonym ADR while another drafts
-  the self-attestation derivation spec patch.
-- DoD: the ADR answers hash domains, canonical input, no-match behavior,
-  retention, rotation, erasure, and federation alignment; the spec patch states
-  the self-attestation derivation and conflict rule.
-- Review checkpoint: security, API, and federation reviewers approve both
-  documents before implementation starts.
-
-Wave 1: Self-Attestation Contract
-
-- Worker A owns self-attestation request handling, OpenAPI, client docs, and
-  examples.
-- DoD: self-attestation evaluation succeeds without caller-supplied target
-  identity, rejects conflicting identity fields, and machine clients still fail
-  without `target`; focused HTTP and OpenAPI tests pass.
-- Review checkpoint: API review verifies no supported docs or examples teach
-  caller-selected self-attestation targets.
-
-Wave 2: Audit Pseudonym Contract
-
-- Worker B owns audit hash helpers, canonicalization, redaction tests, and
-  deployment guidance.
-- DoD: success audit uses canonical matched refs, no-match audit does not emit
-  durable attribute-derived handles by default, identifiers canonicalize
-  deterministically, federation handles remain separate, and raw-value scan
-  tests pass.
-- Review checkpoint: security review validates the ADR line by line against the
-  implementation and tests before any feature is marked complete.
-
-Wave 3: Integration And Regression Closure
-
-- Worker C owns docs/spec consistency, request-body-limit regression coverage,
-  and final search cleanup while the main integrator reviews code from Workers
-  A and B.
-- DoD: all changed docs agree on the self-attestation and audit models, the
-  request-body-limit regression is fixed or explicitly documented as unrelated,
-  and focused plus full workspace verification commands pass.
-- Review checkpoint: final review checks the Follow-Up Definition Of Done item
-  by item; unresolved items are listed as blockers, not carried as implicit
-  follow-up work.
diff --git a/products/notary/archive/specs/federated-notary-manifest-spec.md b/products/notary/archive/specs/federated-notary-manifest-spec.md
deleted file mode 100644
index c3de7738c..000000000
--- a/products/notary/archive/specs/federated-notary-manifest-spec.md
+++ /dev/null
@@ -1,1837 +0,0 @@
-# Federated Notary Manifest Spec
-
-> **Status: Archived (2026-05-31).** This is a historical design record and is not
-> the source of truth. Parts of it diverge from the shipped code (see the
-> divergence note below); do not implement from this document. For current
-> behavior see the code and docs/.
-
-## Divergence from shipped code (2026-05-31)
-
-- The `FederationManifest` struct in code (registry-manifest-core/src/lib.rs:122-131) has only: node_id, issuer, jwks_uri, federation_api, supported_protocol_versions. The spec's `discovery_url`, `trust_bundles`, `credential_profiles`, top-level `trust:` block, `status`, and `audit_checkpoints_url` do not exist; what the spec calls `protocol_versions` is `supported_protocol_versions` in code. Manifests use `deny_unknown_fields`, so a manifest written from this spec fails to parse.
-- Only one federation route exists: `POST /federation/v1/evaluations` (federation/mod.rs:43). The other routes documented here (the well-known node doc, /federation/v1/node, /capabilities, /trust-bundle, /audit/checkpoints/latest, GET evaluation by id, /credentials, /credential-offers, POST audit checkpoints) do not exist.
-- The signing-algorithm allowlist is EdDSA-only in code (federation/mod.rs:122), not ES256/ES384/EdDSA as this spec states.
-
-For the first implementation slice, see
-[`federated-evaluation-mvp-spec.md`](federated-evaluation-mvp-spec.md). This
-document is the broader protocol and roadmap spec.
-
-## Purpose
-
-Define how Registry Notary nodes federate with each other while using
-Registry Manifest as the portable metadata and discovery layer.
-
-The design keeps the responsibilities separate:
-
-- `registry-manifest` declares public capabilities, evidence offerings,
-  service endpoints, credential profiles, and public trust coordinates.
-- `registry-notary` performs peer authentication, authorization, claim
-  evaluation, credential issuance, replay protection, audit, and policy
-  enforcement.
-- `registry-platform` provides shared HTTP, auth, OIDC, SD-JWT, DID/JWK, JCS,
-  and audit primitives.
-- `registry-relay` may publish or aggregate manifests, but does not own Notary
-  federation runtime behavior.
-
-Federation must exchange signed, policy-scoped facts and credentials. It must
-not create a shared mutable registry database, unrestricted cross-node source
-access, or implicit trust between discoverable nodes.
-
-```mermaid
-flowchart LR
-  Manifest["registry-manifest\npublic metadata"]
-  Notary["registry-notary\nruntime enforcement"]
-  Platform["registry-platform\nshared primitives"]
-  Relay["registry-relay\noptional publisher"]
-
-  Manifest -->|"declares capabilities"| Notary
-  Platform -->|"crypto, auth, audit, HTTP"| Notary
-  Relay -.->|"hosts or aggregates metadata"| Manifest
-  Notary -->|"signed facts and credentials"| Notary
-```
-
-## Background
-
-Registry Notary is designed to evaluate configured claims against authorized
-source connectors and issue holder-bound credentials. Registry Manifest already
-models portable registry metadata, standards-facing catalogs, data services,
-evidence offerings, policies, and static discovery artifacts. It can therefore
-serve as the control-plane artifact for a federated Notary network.
-
-The missing pieces are:
-
-1. Manifest fields that describe a Notary node, its federation endpoint,
-   credential/evaluation profiles, protocol versions, public signing keys, and
-   trust anchors.
-2. A signed manifest or signed federation document that peers can verify before
-   relying on published capabilities.
-3. Notary runtime support for consuming peer metadata, validating trust,
-   enforcing local allow policies, accepting delegated evaluation requests,
-   sending delegated evaluation requests, composing signed peer evaluations into
-   local claim workflows, and returning signed results.
-4. Audit checkpoint publication so peers can verify continuity without seeing
-   raw audit logs.
-
-## Design Principles
-
-- Discovery is not trust. A discovered node is untrusted until its metadata,
-  signatures, trust chain, expiry, and local policy are accepted.
-- Trust is scoped. A peer may be trusted for one profile and denied for another.
-- Results are durable artifacts. Federation responses must be signed so they can
-  be verified after transport.
-- Credentials are preferred over raw evidence. Cross-node flows should exchange
-  signed evaluations or credentials, not upstream registry rows.
-- Local policy wins. A remote manifest can advertise capability, but the local
-  Notary decides whether to call it or accept results from it.
-- Sensitive configuration stays out of Manifest. API keys, bearer tokens,
-  private keys, peer-specific secrets, and deployment-only rate limits belong in
-  Notary config or secret stores.
-- Audit sharing is checkpoint-based by default. Nodes publish signed chain heads,
-  not raw audit events.
-
-## V1 Protocol Decisions
-
-These decisions are normative for `registry-notary-federation/v0.1` and remove
-ambiguity from later stages:
-
-- V1 defines Registry Notary JWT profiles. It does not claim that the signed
-  federation document is an OpenID Federation entity statement.
-- V1 signed metadata uses `typ = registry-notary-federation-metadata+jwt`.
-- V1 signed peer requests use `typ = registry-notary-request+jwt`.
-- V1 signed peer responses use `typ = registry-notary-response+jwt`.
-- V1 signed audit checkpoints use `typ = registry-notary-audit-checkpoint+jwt`.
-- The only allowed JWS algorithms are `ES256`, `ES384`, and `EdDSA`.
-  Implementations must deny `none`, all `HS*`, all `RS*`, and any algorithm not
-  explicitly configured in the local allowlist.
-- `jwks_uri` advertised for the `iss` node is the authoritative V1 key source.
-  `did:web` is used as a stable node identifier, but V1 does not resolve DID
-  documents for keys.
-- `kid` is scoped to the issuer's configured or discovered JWKS. A `kid` match
-  in any other key set is irrelevant.
-- JCS canonicalization is used for digest inputs only. Compact JWS/JWT payloads
-  are not pre-canonicalized before signing.
-- `metadata_digest` uses Subresource Integrity syntax:
-  `sha256-<base64-standard-with-padding>` over the JCS-canonicalized unsigned
-  federation JSON document.
-- Peer-specific signed federation documents must include `aud`. Public
-  well-known discovery documents and public metadata JWTs may omit `aud`.
-- Top-level `credential_profiles` and `evaluation_profiles` are the V1 shape.
-  Nested profile definitions are out of scope.
-- `/.well-known/registry-notary` is an unregistered private bootstrap pointer
-  in V1. Registration can be pursued later if the protocol stabilizes.
-- `application/dc+sd-jwt` is the credential media type used by current Notary
-  SD-JWT VC issuance because that is the target wallet and verifier ecosystem
-  for this project. Other SD-JWT VC media types can be added by future profiles.
-- `node_id` may be `did:web` or an HTTPS URL. For `did:web`, V1 treats it as a
-  stable identifier string only; key material still comes from `jwks_uri`.
-
-## Glossary
-
-| Term | Meaning |
-| --- | --- |
-| Evidence offering | Manifest declaration that a node can provide evidence for a dataset/entity through a named access mechanism |
-| Evaluation profile | Public profile for a signed claim-evaluation output, including output format, subject entity, lookup keys, and `ruleset` |
-| Credential profile | Public profile for an issued credential output, including `vct`, output format, holder-binding requirements, and `ruleset` |
-| User-presented proof | A credential, SD-JWT disclosure, or verifiable presentation supplied by a holder or client to a Notary for local verification and rule evaluation |
-| Ruleset | Public stable identifier that binds an offering/profile to private Notary runtime claim configuration |
-| Outbound composition | A Notary workflow that calls trusted peer Notaries for signed evaluations and uses those verified results as local rule inputs |
-| Peer | A configured Notary node allowed or denied by local policy |
-| Trust bundle | Signed public statement that can help validate peer metadata in later stages; not an allowlist by itself |
-
-## Actors
-
-| Actor | Responsibility |
-| --- | --- |
-| Publishing Notary | Publishes a Registry Manifest federation profile and serves federation APIs |
-| Consuming Notary | Discovers peer metadata, validates trust, requests evaluations or credentials |
-| Registry Manifest | Defines the portable metadata schema, validation, and renderers |
-| Registry Platform | Supplies reusable crypto, auth, HTTP, audit, and test-fixture primitives |
-| Trust Anchor | Signs or publishes trust-bundle statements for participating nodes |
-| Registry Relay | Optionally hosts or aggregates published metadata artifacts |
-| Holder or Client | Presents a proof or requests a local Notary workflow that may depend on remote evidence |
-
-## Non-Goals
-
-- Open federation where any internet node can request evaluations.
-- Shared storage, CRDT state replication, or Matrix-style global room state.
-- Raw registry-row federation.
-- Cross-node writes to upstream registries.
-- Peer-to-peer secret exchange.
-- Replacing SD-JWT VC issuance or OpenID4VCI wallet flows.
-- Solving consent, guardianship, or legal representation. Those require separate
-  policy and authorization specs.
-- Mandatory blockchain anchoring. Transparency anchoring can be added later.
-
-## Registry Manifest Changes
-
-Registry Manifest should gain an optional top-level `federation` block. The
-block is public metadata and must be safe to publish.
-
-```yaml
-federation:
-  node_id: did:web:social-protection.example.gov
-  issuer: https://social-protection.example.gov
-  federation_api: https://social-protection.example.gov/federation/v1
-  jwks_uri: https://social-protection.example.gov/.well-known/jwks.json
-  discovery_url: https://social-protection.example.gov/.well-known/registry-notary
-  protocol_versions:
-    - registry-notary-federation/v0.1
-  audit_checkpoints_url: https://social-protection.example.gov/federation/v1/audit/checkpoints
-  trust_bundles:
-    - id: national-social-protection-network
-      url: https://trust.example.gov/bundles/social-protection.jwt
-  status:
-    environment: production
-    lifecycle: active
-```
-
-### Field Semantics
-
-| Field | Required | Meaning |
-| --- | --- | --- |
-| `node_id` | yes | Stable node identifier. V1 supports `did:web` and HTTPS URL identifiers |
-| `issuer` | yes | Issuer identifier used in signed federation artifacts |
-| `federation_api` | yes | Base URL for privileged server-to-server federation APIs |
-| `jwks_uri` | yes | Public keys for verifying node signatures |
-| `discovery_url` | yes | Public discovery document URL |
-| `protocol_versions` | yes | Supported federation protocol versions |
-| `audit_checkpoints_url` | no | URL for signed audit chain checkpoints |
-| `trust_bundles` | no | Public trust-bundle documents relevant to this node |
-| `status` | no | Non-secret lifecycle and environment hints |
-
-Production URLs must be HTTPS. Development fixtures may allow loopback HTTP
-only when rendered or validated in an explicit dev mode.
-
-`node_id` and `issuer` are intentionally separate. `node_id` is the stable
-federation subject used in policy. `issuer` is the JWT issuer and key-discovery
-authority. For `did:web` node ids they are often derivable from the same host,
-but V1 still requires both fields so deployments can use HTTPS URL node ids or
-separate issuer origins without changing the wire shape.
-
-The discovery document example later in this spec intentionally omits optional
-`audit_checkpoints_url`, `trust_bundles`, and `status` fields to keep the
-bootstrap pointer small. Consumers must fetch the signed federation document for
-complete metadata.
-
-## Evidence Offering Extension
-
-Registry Manifest already supports `datasets[*].evidence_offerings[*].access`.
-Federated Notary should use that existing shape with a new `kind` value:
-
-```yaml
-datasets:
-  - id: social-registry
-    title: Social Registry
-    evidence_offerings:
-      - id: disability_status_evaluation
-        title: Disability status evaluation
-        evidence_type: disability_status_evidence
-        issuing_authority:
-          id: social-protection-agency
-          name: Social Protection Agency
-          country: TH
-        entity: person
-        lookup_keys:
-          - national_id
-        access:
-          kind: registry-notary
-          conforms_to: registry-notary-federation/v0.1
-          endpoint_url: https://social-protection.example.gov/federation/v1
-          discovery_url: https://social-protection.example.gov/.well-known/registry-notary
-          ruleset: disability-status-v1
-        policy:
-          purpose:
-            - https://purpose.example.gov/social-protection/service-delivery
-```
-
-`access.kind = registry-notary` means the offering is served through a
-Registry Notary federation endpoint. It does not mean every peer may call it.
-Runtime access is still controlled by local Notary peer policy.
-
-For `access.kind = registry-notary`, `ruleset` is a public stable identifier
-for the Notary runtime rules used to produce the advertised output. It is the
-binding between an evidence offering and the profile declarations below.
-
-Resolution rules:
-
-1. `access.ruleset` must match at least one `credential_profiles[*].ruleset` or
-   `evaluation_profiles[*].ruleset`.
-2. A profile may share a ruleset with another profile only when both profiles
-   are different renderings of the same runtime evaluation result.
-3. A peer request selects a profile id. The serving Notary resolves that
-   profile to its `ruleset` and checks that the selected evidence offering also
-   advertises the same `ruleset`.
-4. Local Notary config maps the public `ruleset` id to private claim
-   configuration, CEL expressions, source connections, and disclosure policy.
-   Those private details are not published in Registry Manifest.
-
-`access.conforms_to` grammar is:
-
-```text
-registry-notary-federation/v<major>.<minor>
-experimental:registry-notary-federation/v<major>.<minor>/<label>
-```
-
-Unknown non-experimental values are validation errors. Experimental values may
-be rendered, but consuming Notary nodes must deny them unless local policy
-explicitly opts in.
-
-## Credential And Evaluation Profiles
-
-Registry Manifest should add a profile declaration for the outputs a Notary can
-evaluate or issue. This can be top-level in V1 so multiple datasets can
-reference it.
-
-```yaml
-credential_profiles:
-  - id: disability_status_sd_jwt
-    version: "1"
-    ruleset: disability-status-v1
-    vct: https://social-protection.example.gov/credentials/disability-status/v1
-    evidence_type: disability_status_evidence
-    subject_entity: person
-    lookup_keys:
-      - national_id
-    output_formats:
-      - application/dc+sd-jwt
-    holder_binding:
-      methods:
-        - did:jwk
-      required: true
-    status:
-      credential_status_supported: false
-```
-
-```yaml
-evaluation_profiles:
-  - id: disability_status_predicate
-    version: "1"
-    ruleset: disability-status-v1
-    evidence_type: disability_status_evidence
-    subject_entity: person
-    lookup_keys:
-      - national_id
-    output_formats:
-      - application/vnd.registry-notary.evaluation+json
-    disclosure:
-      modes:
-        - predicate
-```
-
-The manifest profile describes what the node can do. It must not embed CEL
-expressions, source tokens, private source URLs, or deployment-only policy.
-
-Profile ids are scoped by the publishing node id. When a globally stable string
-is needed, use:
-
-```text
-<node_id>#<profile_id>
-```
-
-The fragment separator is `#`. Profile ids themselves must not contain `#`.
-
-`vct` is a stable credential type identifier. It may be dereferenceable, but
-dereferenceability is not required for V1 verification.
-
-```mermaid
-flowchart TD
-  Offering["Evidence offering"]
-  EvalProfile["Evaluation profile"]
-  CredProfile["Credential profile"]
-  Ruleset["Ruleset"]
-  Runtime["Private Notary runtime config"]
-  Source["Registry source"]
-  EvalResult["Signed evaluation result"]
-  Credential["Issued credential"]
-
-  Offering --> Ruleset
-  EvalProfile --> Ruleset
-  CredProfile --> Ruleset
-  Ruleset --> Runtime
-  Runtime --> Source
-  Runtime --> EvalResult
-  Runtime --> Credential
-```
-
-## Trust Metadata
-
-Registry Manifest may publish public trust coordinates:
-
-```yaml
-trust:
-  trust_anchors:
-    - id: national-social-protection-network
-      entity_id: did:web:trust.example.gov
-      jwks_uri: https://trust.example.gov/.well-known/jwks.json
-      trust_bundle_url: https://trust.example.gov/bundles/social-protection.jwt
-  accepted_statement_types:
-    - registry-notary-trust-bundle+jwt
-```
-
-This is not an allowlist. It only tells consumers which public trust framework
-the node claims to participate in. A consuming Notary must still validate the
-trust chain and local policy.
-
-V1 should support static local trust first, then
-`registry-notary-trust-bundle+jwt`. OpenID Federation-style entity statements
-are a useful reference model because they provide signed metadata, trust
-anchors, expiry, key ids, and trust chains, but OpenID Federation conformance is
-not part of V1.
-
-## Published Artifacts
-
-Registry Manifest should render these artifacts:
-
-```text
-/.well-known/api-catalog
-/.well-known/registry-manifest.json
-/.well-known/registry-notary
-/metadata/index.json
-/metadata/evidence-offerings.json
-/metadata/federation.json
-/metadata/federation.jwt
-/metadata/trust-bundle.json
-```
-
-`federation.json` is the unsigned, debuggable document. `federation.jwt` is the
-signed form peers should verify.
-
-`/.well-known/registry-notary` should be a small discovery document that points
-to the canonical manifest and signed federation document:
-
-```json
-{
-  "node_id": "did:web:social-protection.example.gov",
-  "issuer": "https://social-protection.example.gov",
-  "federation_api": "https://social-protection.example.gov/federation/v1",
-  "jwks_uri": "https://social-protection.example.gov/.well-known/jwks.json",
-  "manifest_url": "https://social-protection.example.gov/metadata/index.json",
-  "federation_document_url": "https://social-protection.example.gov/metadata/federation.jwt",
-  "protocol_versions": ["registry-notary-federation/v0.1"]
-}
-```
-
-The signed federation document should include:
-
-- protected header `typ = registry-notary-federation-metadata+jwt`.
-- protected header `alg` from the V1 algorithm allowlist.
-- protected header `kid`.
-- `iss`: node issuer.
-- `sub`: node id.
-- `aud`: required for peer-specific metadata, omitted only for public metadata.
-- `iat`, `nbf`, `exp`.
-- `jti`.
-- `metadata_digest`: digest of the rendered manifest or federation JSON.
-- `federation`: the public federation block.
-- `evidence_offerings`: the federated evidence offerings.
-- `credential_profiles` and `evaluation_profiles`.
-
-Example peer-specific claims:
-
-```json
-{
-  "iss": "https://social-protection.example.gov",
-  "sub": "did:web:social-protection.example.gov",
-  "aud": "did:web:district-a.example.gov",
-  "iat": 1779878400,
-  "nbf": 1779878400,
-  "exp": 1779882000,
-  "jti": "01J...",
-  "metadata_digest": "sha256-AbCdEf0123456789=="
-}
-```
-
-The signing key used for `federation.jwt` is configured by the publishing
-Notary or publisher. `registry-manifest-core` must not load private keys or sign
-documents. Signing belongs in the CLI, publisher, or Notary runtime, using
-`registry-platform-crypto` where available.
-
-## Manifest Validation Requirements
-
-Registry Manifest must reject invalid federation metadata:
-
-- `federation.node_id` must be a supported DID or HTTPS URL.
-- `federation.issuer`, `federation_api`, `jwks_uri`, and `discovery_url` must be
-  valid URLs.
-- Production federation URLs must use HTTPS.
-- `protocol_versions` must not be empty.
-- `access.kind = registry-notary` requires `conforms_to`, `endpoint_url`,
-  `discovery_url`, and `ruleset`.
-- `access.conforms_to` must match the grammar in this spec.
-- `credential_profiles[*].evidence_type` must reference an existing evidence
-  type.
-- `evaluation_profiles[*].evidence_type` must reference an existing evidence
-  type.
-- `credential_profiles[*].ruleset` and `evaluation_profiles[*].ruleset` must
-  not be empty.
-- `access.ruleset` for `registry-notary` offerings must resolve to at least
-  one credential or evaluation profile.
-- `subject_entity` must exist in a dataset that can serve the referenced
-  evidence type.
-- `lookup_keys` must reference identifiers or fields on the subject entity.
-- profile ids must be unique across credential and evaluation profiles unless
-  namespaced.
-- public trust URLs must be HTTPS outside dev fixtures.
-- no manifest field may contain private keys, API keys, bearer tokens, or
-  source tokens. Static validators can catch obvious key names and PEM/JWK
-  private-key shapes, but final secret scanning belongs in CI.
-
-`MetadataManifest` uses `#[serde(deny_unknown_fields)]`, so `federation`,
-`trust`, `credential_profiles`, and `evaluation_profiles` must be added to the
-typed manifest model before fixtures can use them. They cannot be treated as
-late-bound extension fields.
-
-`EvidenceOfferingAccessManifest.ruleset` is currently a required string for all
-access kinds. If the implementation wants `ruleset` to be conditionally
-required only for `kind = registry-notary`, that is a schema migration and must
-check existing non-Notary fixtures before changing serde behavior.
-
-## Notary Runtime Config
-
-Notary should add an optional `federation` runtime config block. It is disabled
-by default.
-
-```yaml
-evidence:
-  signing_keys:
-    federation-document:
-      provider: local_jwk_env
-      alg: EdDSA
-      kid: notary-fed-2026-05
-      status: active
-      private_jwk_env: REGISTRY_NOTARY_FEDERATION_JWK
-    federation-request:
-      provider: local_jwk_env
-      alg: EdDSA
-      kid: notary-request-2026-05
-      status: active
-      private_jwk_env: REGISTRY_NOTARY_FEDERATION_REQUEST_JWK
-
-federation:
-  enabled: true
-  node_id: did:web:district-a.example.gov
-  issuer: https://district-a.example.gov
-  signing:
-    federation_document_signing_key: federation-document
-    request_signing_key: federation-request
-  metadata:
-    manifest_path: /etc/registry-notary/metadata.yaml
-    signed_federation_document_ttl_seconds: 3600
-    public_document_cache_control: "max-age=300, must-revalidate"
-  peer_policy:
-    default: deny
-    peers:
-      - node_id: did:web:district-b.example.gov
-        jwks_uri: https://district-b.example.gov/.well-known/jwks.json
-        allowed_protocol_versions:
-          - registry-notary-federation/v0.1
-        allowed_actions:
-          - evaluate
-          - issue_credential
-        allowed_profiles:
-          - disability_status_predicate
-          - disability_status_sd_jwt
-        allowed_purposes:
-          - https://purpose.example.gov/social-protection/service-delivery
-        max_batch_size: 100
-        max_source_observed_age_seconds: 3600
-        require_signed_request: true
-        require_trust_chain: false
-  replay:
-    store: redis
-    url_env: REGISTRY_NOTARY_REPLAY_REDIS_URL
-    max_request_lifetime_seconds: 300
-    clock_leeway_seconds: 60
-    request_nonce_ttl_seconds: 300
-    idempotency_key_ttl_seconds: 600
-    reject_process_local_store_in_multi_instance: true
-  jwks:
-    cache_ttl_seconds: 600
-    negative_cache_ttl_seconds: 60
-    unknown_kid_refresh_cooldown_seconds: 30
-    max_document_bytes: 1048576
-  rate_limits:
-    per_peer_per_minute: 60
-    per_peer_batch_subjects_per_hour: 10000
-  response_shaping:
-    minimum_denial_latency_ms: 50
-  audit:
-    publish_checkpoints: true
-    checkpoint_interval_seconds: 300
-  emergency_denylist:
-    node_ids: []
-    key_ids: []
-```
-
-Local peer policy is authoritative. Published peer manifests cannot grant
-themselves access.
-
-The replay store must be shared by all active Notary instances in a deployment.
-Process-local replay storage is allowed only for single-process development and
-must be rejected by production config validation when multi-instance deployment
-is declared. This is a net-new subsystem unless a shared replay store already
-exists in the deployment platform.
-
-Notary must reject signed requests where `exp - iat` exceeds
-`max_request_lifetime_seconds`. `jti` entries are retained until
-`exp + clock_leeway_seconds`. `idempotency_key` entries are retained until the
-earlier of `idempotency_key_ttl_seconds` or `exp + clock_leeway_seconds`.
-
-If Redis is used for the shared replay store, the Redis client dependency should
-live behind a small Notary replay abstraction first. Promote it to a shared
-`registry-platform-replay` crate only when a second consumer needs the same
-subsystem.
-
-Discovery documents, signed federation documents, and JWKS responses should be
-served with `Cache-Control: max-age=300, must-revalidate`, strong `ETag`, and
-`Vary: Accept`. Consumers should use conditional requests when cached documents
-approach expiry. JWKS may use a shorter `max-age` during key rotation. Unknown
-`kid` lookups must use negative caching and refresh cooldowns so attackers
-cannot force unbounded JWKS fetches.
-
-For key rotation, an outgoing public key must remain in JWKS for at least:
-
-```text
-max(signed_federation_document_ttl, request_nonce_ttl, maximum_request_expiry)
-```
-
-after the last object signed by that key can be accepted.
-
-`emergency_denylist` is a local V1 key-compromise stopgap. A matching node id or
-key id causes trust validation to fail before profile or action checks on this
-Notary instance. It is not a network-wide revocation channel; coordinated
-revocation remains future trust-bundle work.
-
-The signing block intentionally mirrors the existing credential issuer pattern:
-key material is loaded from an environment variable and key ids are explicit.
-Implementation may collapse request and federation-document signing onto one
-configured key only if the operator accepts the blast-radius tradeoff.
-
-## Federation API Surface
-
-Federation APIs are mounted under the configured `federation_api` base. V1 uses
-HTTP JSON with signed request and response envelopes.
-
-### Public Discovery
-
-```text
-GET /.well-known/registry-notary
-GET /federation/v1/node
-GET /federation/v1/capabilities
-GET /federation/v1/trust-bundle
-GET /federation/v1/audit/checkpoints/latest
-```
-
-Public endpoints must not expose source connection ids, source tokens, private
-upstream URLs, raw subject identifiers, internal claim expressions, or local peer
-allowlists.
-
-`GET /federation/v1/capabilities` returns public advertised capabilities only:
-
-```json
-{
-  "node_id": "did:web:social-protection.example.gov",
-  "issuer": "https://social-protection.example.gov",
-  "protocol_versions": ["registry-notary-federation/v0.1"],
-  "evaluation_profiles": [
-    {
-      "id": "disability_status_predicate",
-      "ruleset": "disability-status-v1",
-      "output_formats": ["application/vnd.registry-notary.evaluation+json"]
-    }
-  ],
-  "credential_profiles": []
-}
-```
-
-`GET /federation/v1/trust-bundle` returns either one
-`registry-notary-trust-bundle+jwt` or a JSON collection of such JWTs:
-
-```json
-{
-  "trust_bundles": ["eyJ..."],
-  "next_cursor": null
-}
-```
-
-V1 public collection endpoints use `limit` and `cursor` query parameters when a
-collection can grow. `limit` defaults to 100 and must be capped by the server.
-`GET /federation/v1/audit/checkpoints/latest` returns only the latest checkpoint
-and is not paginated. `GET /federation/v1/evaluations/{evaluation_id}` fetches
-one evaluation by id and is not paginated; a collection listing endpoint is out
-of scope for V1.
-
-### Privileged Peer Endpoints
-
-```text
-POST /federation/v1/evaluations
-GET  /federation/v1/evaluations/{evaluation_id}
-POST /federation/v1/credentials
-POST /federation/v1/credential-offers
-POST /federation/v1/audit/checkpoints
-```
-
-All privileged endpoints require:
-
-- peer authentication;
-- signed request envelope;
-- accepted protocol version;
-- known peer node id;
-- local policy allow for the action and profile;
-- replay check;
-- bounded request body;
-- audit event for allow and deny decisions.
-
-`POST /federation/v1/audit/checkpoints` is optional in V1. When enabled, it is a
-push endpoint for a peer to submit its latest signed checkpoint for monitoring.
-The receiver verifies the signature and stores the checkpoint observation. It
-must not merge the peer checkpoint into its own audit chain.
-
-### Denial Responses
-
-Federation denial responses use RFC 9457 Problem Details JSON with a stable reason class
-and no subject-existence detail.
-
-| Case | Status | `type` |
-| --- | --- | --- |
-| malformed JSON or JWT | `400` | `https://id.registrystack.org/problems/registry-notary/federation/bad-request` |
-| missing or invalid authentication | `401` | `https://id.registrystack.org/problems/registry-notary/federation/unauthorized` |
-| known peer denied by local policy | `403` | `https://id.registrystack.org/problems/registry-notary/federation/forbidden` |
-| unsupported protocol or profile | `422` | `https://id.registrystack.org/problems/registry-notary/federation/unsupported` |
-| replayed `jti` or nonce | `409` | `https://id.registrystack.org/problems/registry-notary/federation/replay` |
-| rate limit | `429` | `https://id.registrystack.org/problems/registry-notary/federation/rate-limited` |
-| source or issuer unavailable | `503` | `https://id.registrystack.org/problems/registry-notary/federation/temporarily-unavailable` |
-
-Example:
-
-```json
-{
-  "type": "https://id.registrystack.org/problems/registry-notary/federation/forbidden",
-  "title": "Federation request denied",
-  "status": 403,
-  "detail": "The request is not permitted by local federation policy.",
-  "instance": "urn:ulid:01J..."
-}
-```
-
-Denial responses are not signed in V1. They are transport errors, not durable
-federation artifacts. Both peers rely on local audit events for denial evidence.
-
-Notary may add a constant-time response floor for denial classes that could
-otherwise reveal subject existence through timing. V1 requires a configurable
-minimum denial latency. Operators should set the floor at or above the observed
-95th-percentile source-read latency for the protected profile. If operators set
-it to zero or below source-read latency, subject-existence timing is a known
-accepted risk and must be documented in deployment notes.
-
-`instance` values may be ULIDs for local supportability. Cross-organization
-incident reports should redact or replace `instance` values because ULIDs reveal
-approximate event time.
-
-## Signed Request Envelope
-
-Privileged requests use a JWS envelope in V1. Compact JWS is preferred for
-transport. JCS is not applied to the JWT payload before signing.
-
-The examples in this section intentionally show the federation v0.1 legacy
-shim. That shim signs the historical `subject` request shape and returns
-`subject_ref` handles inside the federation envelope while the public evaluation
-API migrates to `target`, `items`, and `target_ref`.
-
-Protected header:
-
-```json
-{
-  "typ": "registry-notary-request+jwt",
-  "alg": "ES256",
-  "kid": "notary-request-2026-05"
-}
-```
-
-```json
-{
-  "iss": "did:web:district-a.example.gov",
-  "sub": "did:web:district-a.example.gov",
-  "aud": "did:web:district-b.example.gov",
-  "iat": 1779878400,
-  "nbf": 1779878400,
-  "exp": 1779878700,
-  "jti": "01J...",
-  "nonce": "01J...",
-  "idempotency_key": "01J...",
-  "protocol": "registry-notary-federation/v0.1",
-  "action": "evaluate",
-  "profile": "disability_status_predicate",
-  "purpose": "https://purpose.example.gov/social-protection/service-delivery",
-  "request": {
-    "subject": {
-      "id": "redacted-example",
-      "id_type": "national_id"
-    },
-    "claims": ["disability_status"]
-  }
-}
-```
-
-`jti`, `nonce`, and `idempotency_key` have distinct meanings:
-
-- `jti` uniquely identifies the signed request object and must be rejected on
-  replay until request expiry plus clock leeway.
-- `nonce` is issued by the serving Notary when a flow requires a freshness
-  challenge. It is consumed once.
-- `idempotency_key` lets the caller retry the same operation after transport
-  failure. It is scoped by `(iss, aud, action, profile, idempotency_key)` and may
-  return the stored response while still rejecting a different payload under the
-  same key.
-
-The transport may also use mTLS or bearer tokens, but transport auth is not a
-replacement for signed request objects. Notary must verify the durable object
-signature before executing privileged work.
-
-The selected `protocol` in the signed envelope must be present in the signed
-federation document for both peers and allowed by local policy. Implementations
-must not select protocol versions from the unauthenticated discovery document.
-
-```mermaid
-flowchart TD
-  Req["Signed request JWT"]
-  Verify["Verify typ, alg, kid, signature, aud, time"]
-  Replay["Reject replayed jti or nonce"]
-  Policy["Intersect signed metadata with local peer policy"]
-  Source["Read source"]
-  Evaluate["Evaluate ruleset"]
-  Sign["Sign response JWT"]
-  Deny["Deny before source read"]
-
-  Req --> Verify --> Replay --> Policy
-  Verify -- "invalid" --> Deny
-  Replay -- "replay" --> Deny
-  Policy -- "not allowed" --> Deny
-  Policy -- "allowed" --> Source --> Evaluate --> Sign
-```
-
-### Batched Evaluation Request
-
-When local policy allows batching, the request payload uses `subjects`. A
-request must include either `subject` or `subjects`, not both.
-
-This is also part of the federation v0.1 legacy shim. Public batch evaluation
-examples outside this federation envelope should use `items`.
-
-```json
-{
-  "subjects": [
-    {
-      "id": "redacted-example-1",
-      "id_type": "national_id"
-    },
-    {
-      "id": "redacted-example-2",
-      "id_type": "national_id"
-    }
-  ],
-  "claims": ["disability_status"]
-}
-```
-
-The serving Notary must reject the request when `subjects.len()` exceeds local
-peer policy `max_batch_size`. Batched responses preserve subject order and use
-per-item success or error objects. One subject error must not be represented as a
-successful claim result for that subject.
-
-Batched response result shape:
-
-```json
-{
-  "results": [
-    {
-      "index": 0,
-      "ok": true,
-      "evaluation_id": "eval_...",
-      "subject_ref": {
-        "hash": "hmac-sha256:...",
-        "id_type": "national_id"
-      },
-      "claims": {
-        "disability_status": {
-          "satisfied": true,
-          "disclosure": "predicate"
-        }
-      }
-    },
-    {
-      "index": 1,
-      "ok": false,
-      "error": {
-        "type": "https://id.registrystack.org/problems/registry-notary/federation/temporarily-unavailable",
-        "title": "Evaluation unavailable"
-      }
-    }
-  ]
-}
-```
-
-## Delegated Evaluation Response
-
-The response is also signed. It uses protected header
-`typ = registry-notary-response+jwt`.
-
-Signed response claims must include `iss`, `sub`, `aud`, `iat`, `nbf`, `exp`,
-`jti`, `request_jti`, `protocol`, `action`, and `profile`.
-
-```json
-{
-  "iss": "did:web:district-b.example.gov",
-  "sub": "did:web:district-b.example.gov",
-  "aud": "did:web:district-a.example.gov",
-  "iat": 1779878401,
-  "nbf": 1779878401,
-  "exp": 1779879001,
-  "jti": "01J...",
-  "request_jti": "01J...",
-  "protocol": "registry-notary-federation/v0.1",
-  "action": "evaluate",
-  "profile": "disability_status_predicate",
-  "result": {
-    "evaluation_id": "eval_...",
-    "subject_ref": {
-      "hash": "hmac-sha256:...",
-      "id_type": "national_id"
-    },
-    "claims": {
-      "disability_status": {
-        "satisfied": true,
-        "disclosure": "predicate"
-      }
-    },
-    "source_observed_at": "2026-05-27T10:00:00Z",
-    "policy": {
-      "ruleset": "disability-status-v1",
-      "purpose": "https://purpose.example.gov/social-protection/service-delivery"
-    }
-  }
-}
-```
-
-`subject_ref.hash` is an issuer-generated pairwise correlation handle, not a
-consumer-verifiable proof. It is computed as:
-
-```text
-hmac-sha256:<base64url-no-pad HMAC>
-
-HMAC input = JCS({
-  "aud": "<consuming node id>",
-  "issuer": "<publishing node id>",
-  "profile": "<profile id>",
-  "id_type": "<normalized id type>",
-  "subject_id": "<normalized subject id>"
-})
-```
-
-The JCS reference here is the same digest-input canonicalization rule from the
-V1 Protocol Decisions section.
-
-The HMAC key is an issuer-owned secret scoped to federation subject references.
-It must not be shared with consumers or reused for audit hashing. This prevents
-cross-peer correlation when the same subject is evaluated by the same issuer for
-different consuming peers. Consumers verify the response signature and policy,
-not the HMAC itself.
-
-Including `profile` in the HMAC input prevents a consuming peer from correlating
-the same subject across profiles. It also means the issuer cannot use the
-published handle alone for cross-profile audit deduplication. Issuer-side audit
-deduplication should use a separate internal redacted identifier, not the
-federation handle.
-
-The default response must not include raw source records. If a future profile
-allows raw evidence disclosure, it must be opt-in at the profile and peer-policy
-levels, use an elevated audit event type, and have separate privacy review.
-
-`source_observed_at` must satisfy the serving profile's
-`max_source_observed_age_seconds` policy. Stale source observations are denied
-or returned as per-subject errors in batch responses.
-
-## Outbound Delegated Evaluation And Composition
-
-Delegated evaluation has two runtime directions:
-
-1. Inbound serving: a Notary accepts a signed peer request, evaluates a local
-   ruleset against its own source connectors, and returns a signed response.
-2. Outbound composition: a Notary signs requests to trusted peer Notaries,
-   verifies their signed responses, and exposes the verified result to its own
-   local claim graph as a typed input.
-
-Outbound composition must be modeled as a Notary source connector, not as raw
-HTTP inside a rule expression. A future connector shape should be explicit about
-the peer, profile, purpose, subject mapping, and failure policy:
-
-```yaml
-source_bindings:
-  civil_alive:
-    connector: registry_notary_federation
-    peer: civil-notary
-    profile: civil_alive_predicate
-    purpose: https://purpose.example.gov/social-protection/service-delivery
-    subject:
-      input: subject_id
-      id_type: national_id
-    result:
-      claim: person-is-alive
-      disclosure: predicate
-    on_denial: evaluation_error
-    on_timeout: evaluation_error
-```
-
-The composing Notary must verify each peer response before rule evaluation:
-
-- response `typ`, `alg`, `iss`, `sub`, `aud`, `iat`, `nbf`, `exp`, and
-  `request_jti`;
-- response signature against the serving peer's configured or discovered JWKS;
-- selected protocol against signed metadata and local peer policy;
-- profile, purpose, action, and ruleset mapping against local policy;
-- `source_observed_at` freshness for the selected profile;
-- denial or error semantics before the peer result is exposed to CEL bindings.
-
-Peer evaluation results become local runtime facts. They must not be treated as
-raw registry rows, and they must not bypass the local disclosure, audit,
-purpose, or credential-profile checks of the composing Notary.
-
-```mermaid
-sequenceDiagram
-  participant S as Shared Eligibility Notary
-  participant C as Civil Notary
-  participant P as Social Protection Notary
-  participant H as Health Notary
-
-  S->>C: Signed request for civil_alive_predicate
-  C-->>S: Signed predicate result
-  S->>P: Signed request for beneficiary_active_predicate
-  P-->>S: Signed predicate result
-  S->>H: Signed request for health_service_available_predicate
-  H-->>S: Signed predicate result
-  S->>S: Verify peer responses and compose final claim
-```
-
-Audit must distinguish:
-
-- inbound federated evaluations served to peers;
-- outbound federated evaluations requested from peers;
-- local composed evaluations that used one or more peer-signed inputs.
-
-If a composed workflow later issues a credential, the credential represents the
-composing Notary's decision. It must retain audit links to the remote
-evaluation response ids or request ids without embedding raw remote source
-facts.
-
-## User-Presented Proof As Evidence
-
-User-presented proof is a separate federation-adjacent flow from delegated
-evaluation and federated credential issuance. In this flow, the holder or client
-brings an existing credential, SD-JWT disclosure, or verifiable presentation to
-a consuming Notary. The consuming Notary verifies the proof locally and maps
-accepted claims into its own claim graph.
-
-The issuing Notary is not necessarily online during the presentation. It is
-contacted only when the selected proof profile requires fresh metadata, status,
-revocation, or trust material.
-
-```mermaid
-sequenceDiagram
-  participant H as Holder or Client
-  participant C as Consuming Notary
-  participant I as Issuing Notary
-
-  H->>C: Present credential, SD-JWT disclosure, or VP
-  C->>C: Verify signature, holder binding, audience, nonce, expiry
-  C->>I: Optional status or trust-material fetch
-  I-->>C: Verification material
-  C->>C: Apply status policy
-  C->>C: Map verified claims into local rule inputs
-```
-
-User-presented proof profiles must be explicit. Ordinary claim evaluation must
-not accept arbitrary remote credentials just because their issuer is known. A
-profile must define:
-
-- accepted issuer or trust framework;
-- accepted `vct`, schema, or credential profile id;
-- required disclosures and claim paths;
-- holder-binding requirement and allowed DID methods;
-- presentation `aud`, nonce, `iat`, `nbf`, `exp`, and replay rules;
-- credential status and freshness policy;
-- mapping from verified proof claims to local typed rule inputs;
-- redaction rules for audit and logs.
-
-Representation is a separate boundary from holder binding. Possession of a
-credential about a subject does not prove the presenter is authorized to act for
-that subject. Until representation profiles are implemented, a Notary proof
-profile must reject presentations where the actor or holder is not the evidence
-subject, unless an upstream authorization layer has already made and audited the
-representation decision outside Notary.
-
-Profiles that support parent, guardian, power-of-attorney, case-worker, or
-household-representative flows must define:
-
-- `actor_ref`: the presenter or requester;
-- `subject_ref`: the represented person, household, group, cooperative,
-  organization, asset, or legal entity the evidence is about;
-- `subject_kind`: the represented subject class, such as `person`,
-  `household`, `group`, `farm`, `cooperative`, `organization`, `asset`, or
-  `legal_entity`;
-- `representation_ref`: the credential, capability, assignment, or policy
-  record that authorizes the actor to act for the subject;
-- accepted representation issuers or trust frameworks;
-- accepted relationship or authority types, such as `parent`,
-  `legal_guardian`, `case_worker_assignment`, `power_of_attorney`, or
-  `household_representative`;
-- member-scoping rules when a collective subject contains people whose evidence
-  may be used by the workflow;
-- scope and purpose matching rules;
-- expiry, status, and revocation requirements for the representation proof;
-- privacy-preserving audit fields for actor, subject, and representation
-  references.
-
-Accepted proof claims become local runtime facts. They must not bypass the
-consuming Notary's local purpose, disclosure, rule, credential-profile, or
-audit policies.
-
-Audit records for user-presented proof must record issuer, profile, proof type,
-status-policy result, presentation id or nonce hash, and redacted subject hash.
-They must not log compact proof tokens, full SD-JWT disclosures, bearer tokens,
-holder private material, or raw credential payloads unless a profile explicitly
-allows raw evidence capture and the deployment enables elevated audit controls.
-
-## Federated Credential Issuance
-
-Credential issuance builds on delegated evaluation. A peer may request a
-credential only when local policy allows `issue_credential` for the selected
-credential profile.
-
-V1 does not allow a consuming Notary to act as a trust proxy for a wallet
-holder proof. Holder proof verification is end-to-end with the issuing Notary.
-The consuming Notary has two allowed roles:
-
-1. Discovery and handoff: the consuming Notary discovers the issuing Notary
-   and returns or forwards a credential offer so the holder can call the issuing
-   Notary directly.
-2. Transparent byte relay: the consuming Notary forwards the holder's request bytes
-   without modifying the proof, nonce, holder key, or audience. The issuing
-   Notary remains responsible for nonce issuance and proof verification.
-
-The consuming Notary must not substitute a holder key, mint an issuer nonce,
-rewrite proof `aud`, or claim to have verified an issuer nonce. If the consuming
-Notary needs a server-held credential for its own workflow, that must be a
-separate credential profile where the consuming Notary is the holder and the
-proof is addressed directly to the issuing Notary.
-
-Credential issuance profiles must define the holder-binding ceremony before
-they are enabled. The ceremony definition must specify who creates `c_nonce`,
-which issuer or endpoint appears in the holder proof `aud`, how nonce replay is
-detected, which bytes a transparent relay may forward, and how holder DID,
-proof JWT, nonce, and credential offer identifiers are redacted from logs.
-
-The issuing Notary returns an SD-JWT VC or an OpenID4VCI-compatible credential
-response, depending on the profile. The credential issuer remains the issuing
-Notary, not the consuming Notary. Verifier trust configuration must therefore
-include all issuing Notary nodes whose credentials may be presented.
-
-Transparent byte relay creates a metadata-collection surface: the relaying
-Notary can observe which holder proof identifiers request which credential
-profiles and when. Relay deployments must minimize logs and redact holder DID,
-proof nonce, and proof JWT material from audit and operator logs.
-
-Status policy defines how the consuming Notary treats credential status and
-freshness when it later accepts a remote credential. For profiles with
-`credential_status_supported: false`, status policy must either reject remote
-credentials for workflows that require revocation awareness or explicitly accept
-short-lived credentials without revocation checking.
-
-```mermaid
-sequenceDiagram
-  participant H as Holder
-  participant C as Consuming Notary
-  participant I as Issuing Notary
-
-  C->>I: Discover credential profile and offer metadata
-  alt Discovery and handoff
-    C-->>H: Return issuer offer
-    H->>I: Present holder proof directly to issuer
-  else Transparent byte relay
-    H->>C: Credential request bytes for issuer
-    C->>I: Forward bytes without rewriting proof, nonce, key, or aud
-  end
-  I->>I: Verify holder proof and issue credential
-  I-->>H: Credential response
-```
-
-Credential issuance must preserve current Notary invariants:
-
-- holder binding is required when the profile declares it;
-- `vct` is profile-controlled;
-- signing `kid` is explicit;
-- replay protection applies to holder proof and federation request envelope;
-- credential validity is bounded;
-- audit records distinguish local issuance from federated issuance.
-
-The in-process replay store is single-instance only for the MVP; see the
-operator guide's "Replay Limitation" section before enabling privileged
-federation traffic.
-
-## Audit Checkpoints
-
-Notary should publish signed audit checkpoints instead of raw audit logs. V1
-checkpoints commit to a Merkle structure even though inclusion proofs ship
-later.
-
-Leaf hash:
-
-```text
-leaf_hash = SHA-256(0x00 || JCS(audit_envelope))
-```
-
-The `audit_envelope` input is the JCS-canonicalized `AuditEnvelope` produced by
-`registry-platform-audit`: envelope id, timestamp, previous record hash when
-present, typed record value, and record hash. Implementations must hash the
-persisted envelope bytes after redaction, not an application-specific preimage.
-
-Interior node hash:
-
-```text
-node_hash = SHA-256(0x01 || left_hash || right_hash)
-```
-
-The checkpoint `root_hash` is the binary Merkle root encoded as
-`sha256-<base64-standard-with-padding>`. A single-leaf tree root is its leaf
-hash. The rightmost unpaired node at each level is promoted unchanged. Empty
-audit ranges must not emit a checkpoint; the first checkpoint's
-`previous_root_hash` is `null`.
-
-`previous_root_hash` links the current checkpoint to the prior checkpoint's
-`root_hash`. `sequence` is the latest monotonic audit sequence included in this
-checkpoint. `record_count` is the number of records covered by the Merkle tree.
-They are equal only when the deployment never compacts, skips, or scopes audit
-records; both fields are present so scoped checkpointing can be added without
-renaming the wire shape.
-
-```json
-{
-  "iss": "did:web:district-b.example.gov",
-  "sub": "did:web:district-b.example.gov",
-  "iat": 1779878400,
-  "nbf": 1779878400,
-  "exp": 1779882000,
-  "jti": "01J...",
-  "checkpoint": {
-    "sequence": 128817,
-    "root_hash": "sha256-...",
-    "previous_root_hash": "sha256-...",
-    "record_count": 128817,
-    "started_at": "2026-05-27T09:55:00Z",
-    "ended_at": "2026-05-27T10:00:00Z"
-  }
-}
-```
-
-Peers may store and compare checkpoints to detect discontinuity. Later versions
-may add transparency-log inclusion proofs or peer notarization, but V1 only
-requires signed chain-head publication.
-
-```mermaid
-flowchart LR
-  A1["Audit envelope 1"]
-  A2["Audit envelope 2"]
-  A3["Audit envelope 3"]
-  L1["Leaf hash 1"]
-  L2["Leaf hash 2"]
-  L3["Leaf hash 3"]
-  N12["Interior hash"]
-  Root["Merkle root_hash"]
-  Checkpoint["Signed checkpoint"]
-
-  A1 --> L1
-  A2 --> L2
-  A3 --> L3
-  L1 --> N12
-  L2 --> N12
-  N12 --> Root
-  L3 --> Root
-  Root --> Checkpoint
-```
-
-## Trust Resolution
-
-V1 should support two trust modes:
-
-1. Static local trust: the operator configures peer node ids, JWKS URIs, and
-   allowed profiles.
-2. Signed trust bundle: the operator configures a trust anchor and accepts
-   signed statements binding peer node ids to metadata and capabilities.
-
-Trust resolution order:
-
-1. Fetch peer discovery document.
-2. Fetch signed federation document.
-3. Fetch and snapshot the issuer JWKS from the `iss` node's configured or
-   discovered `jwks_uri`.
-4. Verify document signature using only that JWKS snapshot.
-5. Validate `typ`, `alg`, `kid`, `iss`, `sub`, `aud`, `iat`, `nbf`, `exp`, and
-   `jti`.
-6. Validate document digest against rendered metadata when present.
-7. Validate trust chain if required by local policy.
-8. Intersect advertised capabilities with local peer policy.
-9. Cache accepted metadata until the earlier of document expiry or local TTL.
-
-Unknown `kid` should trigger bounded JWKS refresh with negative caching to avoid
-key-id probing.
-
-JWKS fetches, discovery fetches, federation document fetches, and trust-bundle
-fetches must all use bounded response bodies, decompression limits, redirect
-denial, timeout budgets, and SSRF protection. Metadata fetches must not accept
-gzip or other compressed responses unless the decompressed size limit is enforced
-before allocation growth can become unbounded.
-
-When both peers support multiple protocol versions, the requester proposes the
-newest version present in the intersection of its local policy and the peer's
-signed metadata. Operators may pin a lower version per peer. The serving Notary
-must reject a signed request whose `protocol` is not present in that same
-intersection.
-
-```mermaid
-sequenceDiagram
-  participant C as Consuming Notary
-  participant P as Peer Metadata Endpoint
-  participant J as Peer JWKS
-  participant L as Local Peer Policy
-
-  C->>P: Fetch discovery document
-  C->>P: Fetch signed federation document
-  C->>J: Fetch issuer JWKS snapshot
-  C->>C: Verify metadata JWT with issuer-scoped kid
-  C->>L: Intersect capabilities with local policy
-  L-->>C: Accepted profiles and protocol versions
-  C->>C: Cache until document expiry or local TTL
-```
-
-## Failure Semantics
-
-Federation must fail closed:
-
-- missing or invalid federation config disables federation routes;
-- unsupported protocol version is denied;
-- unsigned privileged requests are denied;
-- expired metadata is denied unless local policy explicitly permits stale
-  metadata for diagnostics;
-- trust-chain failures are denied;
-- peer policy mismatch is denied before source reads;
-- replayed `jti` or nonce is denied;
-- source errors do not produce successful signed evaluations;
-- denials are audited without logging raw tokens, private keys, or raw source
-  records.
-
-Externally visible denial responses should be generic enough to avoid subject or
-capability probing. Detailed reasons belong in redacted audit events and
-operator logs.
-
-## Threat Model Notes
-
-V1 mitigates the core integrity risks with signed request and response objects,
-static peer policy, replay rejection, bounded metadata fetches, and issuer-scoped
-key resolution.
-
-Known residual risks:
-
-- subject-existence timing can still leak when response shaping is configured
-  below real source-read latency;
-- local emergency denylists do not provide coordinated network-wide key
-  revocation;
-- signed denial bodies are out of scope, so denial evidence relies on each
-  node's local audit trail;
-- audit checkpoints without inclusion proofs can detect some discontinuities but
-  do not fully prevent audit equivocation;
-- user-presented proof creates a replay and over-disclosure surface unless
-  presentation nonce, `aud`, status policy, and audit redaction are enforced;
-- transparent byte relay for credential issuance exposes holder-interaction
-  metadata to the relaying Notary and needs strict log minimization.
-
-## Implementation Stages
-
-```mermaid
-flowchart LR
-  S0["Stage 0: Spec and fixtures"]
-  S1["Stage 1: Manifest metadata"]
-  S2["Stage 2: Signed metadata"]
-  S3["Stage 3: Peer discovery"]
-  S3b["Stage 3b: Shared replay"]
-  S4["Stage 4: Delegated evaluation"]
-  S5["Stage 5: User-presented proof"]
-  S6["Stage 6: Credential issuance"]
-  S7["Stage 7: Audit checkpoints"]
-
-  S0 --> S1 --> S2 --> S3
-  S3 --> S3b --> S4
-  S4 --> S5
-  S5 --> S6
-  S4 --> S7
-```
-
-### Stage 0: Spec And Fixture Alignment
-
-Add manifest fixtures that describe a federated Notary node and a consuming
-Notary fixture that references it.
-
-Definition of Done:
-
-- `registry-manifest` has a sample federated Notary manifest fixture.
-- `registry-notary` has a sample federation runtime config.
-- fixture docs identify what is public metadata versus local runtime policy.
-- fixture docs state that signing happens in CLI, publisher, or Notary runtime,
-  not in `registry-manifest-core`.
-
-### Stage 1: Manifest Metadata And Rendering
-
-Add federation metadata structs, validation, and renderers to
-`registry-manifest`.
-
-Definition of Done:
-
-- manifest validation enforces the requirements in this spec;
-- `render_catalog` includes federation-safe capability links;
-- a dedicated federation JSON renderer exists;
-- CLI can render `federation` format;
-- golden tests cover public discovery, evidence offering access, credential
-  profiles, evaluation profiles, and invalid URL/profile references.
-- golden tests cover `ruleset` resolution, `conforms_to` grammar, profile id
-  namespace validation, and missing top-level profile references.
-
-### Stage 2: Signed Federation Documents
-
-Add signing support for federation documents. Prefer shared platform crypto
-primitives if available; otherwise keep signing outside `registry-manifest-core`
-and in the CLI or publisher so the core crate stays portable.
-
-If the CLI signs documents, it must add `registry-platform-crypto` or an
-equivalent signing dependency. `registry-manifest-core` remains dependency-light
-and does not load private key material.
-
-Definition of Done:
-
-- signed federation document includes issuer, subject, expiry, key id, document
-  digest, capabilities, profiles, `typ`, `alg`, and `aud` when peer-specific;
-- verification test rejects modified payloads, expired documents, wrong
-  audience, wrong `typ`, denied `alg`, and unknown key ids;
-- `metadata_digest` is tested as SRI-formatted SHA-256 over JCS-canonicalized
-  unsigned federation JSON;
-- no private key material enters `registry-manifest-core` data models.
-
-### Stage 3: Notary Peer Discovery And Trust Cache
-
-Registry Notary can fetch and validate a peer discovery document and signed
-federation document, then cache accepted capabilities.
-
-Trust-bundle validation is a net-new subsystem unless a compatible validator
-already exists in `registry-platform`.
-
-Definition of Done:
-
-- federation is disabled by default;
-- invalid peer metadata fails closed;
-- static local trust works without a trust bundle;
-- trust-bundle-required mode rejects peers without a valid chain;
-- cache respects document expiry and local TTL;
-- metadata and JWKS fetches use shared bounded-body, decompression, timeout,
-  redirect-deny, and SSRF policy helpers;
-- JWKS snapshots are used atomically for document verification;
-- unknown `kid` refresh uses negative cache TTL and cooldown bounds;
-- protocol negotiation is based on signed metadata, not public discovery.
-
-### Stage 3b: Shared Replay Store
-
-Add a shared replay and idempotency store before privileged active-active
-federation routes can be enabled in production.
-
-Redis support is a concrete deployment option, not a platform requirement. Start
-with a Notary-local replay abstraction; extract a `registry-platform-replay`
-crate only when another registry service needs it.
-
-Definition of Done:
-
-- production config rejects process-local replay storage for multi-instance
-  deployments;
-- `jti`, nonce, and idempotency-key semantics are tested independently;
-- two Notary instances sharing the store reject replay across instances;
-- idempotent retry returns the prior response only for byte-identical payloads.
-
-### Stage 4: Delegated Evaluation
-
-Registry Notary can accept and send delegated evaluation requests.
-
-Definition of Done:
-
-- signed request envelope verification is required;
-- local peer policy gates action, purpose, profile, and batch size;
-- source reads occur only after peer policy succeeds;
-- outbound delegated evaluation uses a dedicated `registry_notary_federation`
-  source connector or equivalent runtime abstraction, not ad hoc HTTP inside
-  rule expressions;
-- outbound requests are signed with the consuming Notary federation key and
-  response JWTs are verified before results enter local rule evaluation;
-- local claim rules can compose at least two verified peer evaluation results
-  into one signed local evaluation result;
-- peer denial, timeout, stale source, and unsupported-profile responses map to
-  deterministic local evaluation errors or denials according to config;
-- signed evaluation responses contain no raw source rows by default;
-- replayed requests are rejected;
-- audit records distinguish local evaluation, inbound federated evaluation,
-  outbound federated evaluation, and composed evaluation;
-- integration tests cover allow, deny, replay, expired request, unknown peer,
-  batch allow, batch limit denial, subject-hash pairwise scoping, outbound
-  response verification failure, and composed-evaluation failure mapping.
-
-### Stage 5: User-Presented Proof As Evidence
-
-Registry Notary can verify holder-presented credentials, SD-JWT disclosures, or
-verifiable presentations as explicit evidence inputs in local workflows.
-
-Definition of Done:
-
-- proof profiles are explicit and ordinary claim evaluation rejects remote
-  credentials unless a profile opts in;
-- presentation `aud`, nonce, expiry, holder binding, issuer trust, status
-  policy, and replay checks are enforced before rule evaluation;
-- actor-not-subject presentations are rejected unless an explicit
-  representation profile validates actor, subject, subject kind, authority,
-  scope, expiry, status, and purpose;
-- verified proof claims map into typed local rule inputs without exposing raw
-  credential payloads to CEL expressions;
-- audit records include issuer, profile, presentation id or nonce hash, status
-  result, and redacted actor, subject, and representation hashes when
-  representation is used;
-- tests cover wrong audience, replayed presentation, expired proof, missing
-  disclosure, untrusted issuer, stale or rejected status, missing
-  representation authority, wrong represented subject, wrong subject kind,
-  expired or revoked representation, collective-subject member-scope denial,
-  and successful proof mapping.
-
-### Stage 6: Federated Credential Issuance
-
-Registry Notary can help a holder obtain a credential from an allowed issuing
-Notary without breaking holder-binding or nonce ownership.
-
-Definition of Done:
-
-- holder binding and credential profile constraints are enforced;
-- issued credentials use the remote issuer identity;
-- consuming Notary does not proxy or rewrite holder proof material except as a
-  transparent byte relay;
-- audit records bind issuance to peer id, request id, profile, and redacted
-  subject hash;
-- tests cover profile mismatch, untrusted issuer, wrong holder proof audience,
-  nonce replay, substituted holder key, expired credential, and relay redaction.
-
-### Stage 7: Audit Checkpoints
-
-Registry Notary publishes signed audit checkpoints and can monitor configured
-peer checkpoints.
-
-The Merkle builder should live in `registry-platform-audit` so audit sinks and
-checkpoint publishers share one tree construction.
-
-Definition of Done:
-
-- checkpoint includes sequence, Merkle root hash, time window, issuer, expiry, and key
-  id;
-- checkpoint signing key is discoverable through node metadata;
-- peer monitor detects root regression, sequence regression, or unexpected
-  discontinuity;
-- raw audit records are never exposed by checkpoint endpoints.
-
-## Security And Privacy Requirements
-
-- Federation routes must have inbound body limits.
-- Metadata fetches must use strict outbound URL policy.
-- Production federation must deny redirects and private network SSRF targets.
-- Metadata fetches must enforce decompressed response size limits.
-- Peer signatures must use the V1 algorithm allowlist: `ES256`, `ES384`, and
-  `EdDSA` only.
-- All signed objects must include `kid`.
-- Signed requests must include `aud`, `iat`, `exp`, `jti`, action, profile, and
-  protocol version.
-- Signed requests with `exp - iat` above local policy must be denied.
-- Peer-specific signed metadata must include `aud`.
-- Signed objects must include the expected `typ` header for their object class.
-- Subject identifiers in logs and audit must be redacted or HMAC-hashed.
-- Federation response subject hashes must use issuer-owned pairwise HMAC keys
-  scoped by audience and profile.
-- Manifest renderers must not publish source tokens, bearer tokens, API keys,
-  private JWK fields, PEM private keys, or source credentials.
-- Batch federation must have per-peer and per-source concurrency limits.
-- Federation errors must not reveal whether a subject exists.
-- Purpose values should be HTTPS URIs. Compact purpose ids are allowed only when
-  both peers configure the same local vocabulary mapping.
-- Operators must be able to disable federation without changing claim
-  definitions.
-- Key compromise must be mitigable through local node-id and key-id denylist
-  config before metadata expiry.
-
-## Observability
-
-Notary should emit metrics for:
-
-- accepted and rejected peer requests by action and reason class;
-- peer metadata fetch latency and failures;
-- trust-chain validation failures;
-- federation request latency;
-- replay denials;
-- per-peer rate-limit denials;
-- remote evaluation result age;
-- audit checkpoint freshness and discontinuity.
-
-Metric labels must avoid raw subject ids, tokens, or high-cardinality request
-ids.
-
-## Compatibility
-
-Existing Notary APIs must continue to work when federation is disabled.
-Existing Registry Manifest files must continue to validate when the new
-federation fields are absent.
-
-`access.kind` remains open to non-Notary values. Existing `evidence-server`,
-`partner-api`, and other portable access kinds must not change behavior.
-
-## Open Questions
-
-1. Should V1 use compact JWS, general JSON serialization, or both for signed
-   request envelopes?
-2. Should trust bundles follow OpenID Federation entity statements exactly, or
-   define a smaller Registry Notary JWT profile first?
-3. Do we need a public status endpoint for temporary suspension of a profile, or
-   is signed metadata expiry enough for V1?
-4. Stage 5 decision: remote credentials are accepted as evidence only by
-   explicit user-presented proof profiles, not by ordinary claim evaluation.
-5. Stage 7 deferred: V1 has pull-latest plus optional push observation. Do we
-   need paginated historical checkpoint exchange?
-6. Should the pairwise subject-ref HMAC include a deployment-specific salt
-   version so issuers can rotate the subject-ref key while preserving a bounded
-   continuity window?
-
-## Recommended MVP
-
-The first implementation should be deliberately small:
-
-1. Registry Manifest renders unsigned federation metadata for one Notary node.
-2. Registry Notary configures a static peer allowlist.
-3. Registry Notary accepts a signed single-subject delegated evaluation request
-   from an allowed peer.
-4. Registry Notary returns a signed evaluation response with predicate/value
-   disclosure only, no raw source rows.
-
-Signed public federation documents, outbound composition, user-presented proof,
-audit checkpoints, trust bundles, batching, and federated credential issuance
-should come after the delegated evaluation path is working and covered by
-conformance tests. User-presented proof should land before federated credential
-issuance because it verifies credentials the holder already has, without adding
-issuer nonce ownership or transparent-relay holder-proof semantics.
-
-## Definition Of Done For This Work
-
-This federation work is done only when all applicable criteria below are true
-and verified in CI or by named local commands:
-
-- Registry Manifest validates and renders `federation`, `evaluation_profiles`,
-  and `registry-notary` evidence offerings with unresolved `ruleset` fixtures
-  rejected by tests.
-- Registry Notary starts with federation disabled and does not mount
-  `/federation/v1/evaluations`.
-- Registry Notary starts with federation enabled only when `node_id`,
-  `issuer`, signing key, pairwise subject hash secret, replay config, peer
-  policy, and evaluation profiles validate.
-- `POST /federation/v1/evaluations` accepts only compact JWS requests with the
-  expected `typ`, allowed `alg`, configured peer `iss` and `sub`, correct `aud`,
-  valid `iat`, `nbf`, `exp`, ULID `jti`, allowed purpose, allowed profile, and
-  non-replayed `jti`.
-- Allowed delegated evaluation returns a compact JWS response with the expected
-  `typ`, serving Notary `iss` and `sub`, requesting peer `aud`, `request_jti`,
-  no raw source rows, and a pairwise `subject_ref.hash`.
-- Denied delegated evaluation returns the specified RFC 9457 Problem Details envelope
-  and never performs a source read before peer policy succeeds.
-- Audit records are emitted for allowed, denied, replayed, stale-source, and
-  audit-write-failure paths, with peer id and subject redacted or hashed.
-- Registry Lab has a runnable federation demo or smoke path that signs a request
-  to a peer Notary, verifies the signed response, writes artifacts under
-  `output/`, and proves at least one denial or replay case.
-- Documentation and Registry Docs identify delegated evaluation as the MVP,
-  outbound composition and user-presented proof as planned follow-on work, and
-  federated credential issuance as later work with holder-binding constraints.
-- Verification commands pass: focused Manifest tests, focused Notary federation
-  tests, Registry Lab federation smoke, Registry Docs generation/checks when
-  docs or catalog surfaces change, and `git diff --check` in each touched repo.
-
-## Wave Implementation Plan
-
-- [ ] Wave 0: Review checkpoint and fixtures.
-  - Worker A: align this spec, MVP spec, operator guide, README, and Registry
-    Legend wording so the same scope appears everywhere.
-  - Worker B: add or update deterministic federation fixtures for Manifest,
-    Notary config, request JWT, response JWT, denial, and replay cases.
-  - Done when fixture files are committed, docs name the same stage boundaries,
-    `git diff --check` passes, and code review confirms no fixture contains
-    private keys, bearer tokens, or raw subject identifiers outside test-only
-    material.
-
-- [ ] Wave 1: Manifest metadata.
-  - Worker A: implement or tighten Manifest structs, validation, and catalog
-    rendering for `federation` and `evaluation_profiles`.
-  - Worker B: update CLI/rendering tests and docs examples.
-  - Done when valid fixtures render federation metadata, invalid `ruleset`,
-    invalid HTTPS URL, invalid protocol, duplicate profile id, and invalid
-    `did:web` binding tests fail closed, and reviewer signs off before Notary
-    runtime work starts.
-
-- [ ] Wave 2: Inbound delegated evaluation MVP.
-  - Worker A: implement config validation, route mounting, request verification,
-    peer policy, replay, and denial shaping.
-  - Worker B: implement response signing, pairwise subject hash, stale-source
-    handling, and audit emission.
-  - Done when focused Notary tests cover disabled route, allowed request,
-    unknown peer, bad `typ`, bad `alg`, bad `aud`, expired request, replay,
-    unsupported purpose, unsupported profile, stale source, and audit failure.
-    Code review must confirm source reads happen only after peer policy passes.
-
-- [ ] Wave 3: Registry Lab federation proof.
-  - Worker A: configure demo Notary peers, federation signing keys, pairwise
-    hash secrets, and evaluation profiles.
-  - Worker B: add `scripts/demo-federated-flow.py`, `scripts/smoke-federation.sh`,
-    and a `just federated` recipe.
-  - Done when the smoke signs a request, receives and verifies a signed response,
-    verifies denial or replay behavior, writes artifacts under `output/`, and
-    `scripts/release-check.sh` or a documented narrower release-equivalent check
-    passes.
-
-- [ ] Wave 4: Outbound composition.
-  - Worker A: design and implement a `registry_notary_federation` source
-    connector or equivalent runtime abstraction.
-  - Worker B: implement response verification, failure mapping, audit events,
-    and composed-rule tests.
-  - Done when one local claim composes at least two verified peer evaluations,
-    bad peer signatures never enter rule evaluation, denial and timeout mapping
-    are deterministic, and code review confirms no ad hoc HTTP calls are embedded
-    inside rule expressions.
-
-- [ ] Wave 5: User-presented proof.
-  - Worker A: implement explicit proof profiles, SD-JWT or VP verification,
-    holder binding, `aud`, nonce, expiry, replay, issuer trust, and status
-    policy checks.
-  - Worker B: map verified proof claims into typed rule inputs and audit
-    redacted proof metadata.
-  - Done when tests cover wrong audience, replay, expired proof, missing
-    disclosure, untrusted issuer, stale or rejected status, and successful proof
-    mapping. Code review must confirm ordinary claim evaluation rejects remote
-    credentials unless an explicit proof profile opts in.
-
-- [ ] Wave 6: Federated credential issuance.
-  - Worker A: define and implement discovery/handoff and transparent-byte-relay
-    ceremonies with issuer-owned `c_nonce`.
-  - Worker B: test holder proof audience, nonce replay, substituted holder key,
-    issuer identity, credential profile constraints, and relay redaction.
-  - Done when holder proof verification remains end-to-end with the issuing
-    Notary, the consuming Notary cannot mint nonce or rewrite proof material,
-    and verifier trust documentation covers remote issuer identities.
-
-- [ ] Wave 7: Audit checkpoints and trust hardening.
-  - Worker A: implement signed Merkle checkpoints and peer checkpoint monitoring.
-  - Worker B: implement trust-bundle validation, key-rotation overlap tests,
-    cache freshness, unknown-`kid` negative caching, and emergency denylist
-    scenarios.
-  - Done when checkpoint regression, sequence regression, root discontinuity,
-    compromised `kid` denial, metadata expiry, and JWKS refresh tests pass.
-
-Between waves, no feature is marked complete until a reviewer has checked the
-diff against this spec, the wave's tests and smoke commands are named in the
-review note, and any skipped check has an explicit blocker and owner.
-
-## Default Registry Lab Federation Demo Definition Of Done
-
-The default non-agricultural Registry Lab federation demo is done only when all
-criteria below are true and verified by named commands:
-
-- `civil-notary` serves federated profiles for `civil_age_band_value` and
-  `civil_alive_predicate`.
-- `social-protection-notary` serves federated profiles for
-  `beneficiary_active_predicate` and `household_eligibility_band_value`.
-- `age-band` is computed from Civil `birth_date` and returns only one of the
-  documented values: `child`, `youth`, `adult`, or `elderly`.
-- The demo benefits peer signs compact JWS requests with
-  `typ = registry-notary-request+jwt` and verifies compact JWS responses with
-  `typ = registry-notary-response+jwt`.
-- The demo writes artifacts under `registry-lab/output/federation/` for each
-  request payload, verified response payload, replay denial,
-  unsupported-purpose denial, and composed support decision.
-- The composed decision uses only verified federated response payloads. It must
-  not read Relay rows or embed raw source records.
-- The smoke proves replay denial with HTTP `409` and unsupported-purpose denial
-  with HTTP `403`.
-- Existing default commands still pass: `just smoke` and `just client`.
-- Existing agricultural federation remains green: `just agri-federation`.
-- `git diff --check` passes in every touched repository.
-
-`is_woman` is not part of this DoD until an explicit `sex` or `gender` fixture
-field exists. It must not be inferred from names.
-
-## Default Registry Lab Federation Demo Implementation Plan
-
-- [ ] Wave D0: Claim and fixture review.
-  - Worker A: inspect Civil and Social source fields and confirm the exact
-    source for `age-band`, `person-is-alive`, `beneficiary-active`, and
-    `household-eligibility-band`.
-  - Worker B: review existing default smoke/client artifacts and identify where
-    the federation artifacts should be added without changing existing output
-    names.
-  - Done when the review note names the source field for each claim, the output
-    artifact names, and whether a separate health Notary is deferred.
-  - Code-review checkpoint: reviewer confirms no demographic predicate is
-    inferred from names or undocumented fixture semantics.
-
-- [ ] Wave D1: Civil and Social Notary profiles.
-  - Worker A: add `age-band` claim and Civil federation profiles in
-    `registry-lab/config/notary/civil-notary.yaml`.
-  - Worker B: add or expose Social federation profiles in
-    `registry-lab/config/notary/social-protection-notary.yaml`.
-  - Done when both Notary configs validate at startup, profile ids resolve to
-    existing claim ids, allowed purposes are HTTPS URIs, and focused local
-    evaluations return the expected values for at least `NID-1001` and one
-    non-child or inactive case.
-  - Code-review checkpoint: reviewer confirms profile ids, rulesets, claim ids,
-    subject id types, and source scopes match the local config.
-
-- [ ] Wave D2: Default federation demo client and smoke.
-  - Worker A: add `scripts/demo-federation.py` to sign requests, call Civil and
-    Social federation endpoints, verify response JWTs, and compose the support
-    decision.
-  - Worker B: add `scripts/smoke-federation.sh`, `just federation`, and readiness
-    checks for the peer JWKS and serving Notaries.
-  - Done when `just federation` writes all required artifacts, verifies response
-    signatures, proves replay and unsupported-purpose denials, and rejects any
-    artifact containing configured raw secrets.
-  - Code-review checkpoint: reviewer confirms compact JWS verification happens
-    before composition and that artifacts contain no raw source rows.
-
-- [ ] Wave D3: Metadata and docs alignment.
-  - Worker A: update static metadata and evidence offerings so the default demo
-    advertises the Civil and Social federation profiles.
-  - Worker B: update `registry-lab/README.md` and any Registry Docs pages that
-    describe the default demo.
-  - Done when static metadata generation passes, the advertised `ruleset` values
-    resolve to evaluation profiles, docs name delegated evaluation as the demo
-    scope, and docs explicitly defer outbound Notary composition, user-presented
-    proof, and federated credential issuance.
-  - Code-review checkpoint: reviewer confirms generated metadata was produced
-    through the documented generator and no generated-only source was hand edited.
-
-- [ ] Wave D4: Regression and release check.
-  - Worker A: run the default checks: `just smoke`, `just client`, and
-    `just federation`.
-  - Worker B: run the cross-demo guard checks: `just agri-federation` and the
-    relevant script syntax or fixture-generation checks.
-  - Done when all commands pass from a clean generated local environment, or any
-    skipped command has a named external blocker and exact rerun command.
-  - Code-review checkpoint: no feature is marked done until the review note
-    lists command outputs, changed files, known pitfalls, and remaining risks.
diff --git a/products/notary/archive/specs/scalability-spec.md b/products/notary/archive/specs/scalability-spec.md
deleted file mode 100644
index 8c1c824d6..000000000
--- a/products/notary/archive/specs/scalability-spec.md
+++ /dev/null
@@ -1,156 +0,0 @@
-# Registry Notary Scalability Spec
-
-> **Status: Archived (2026-07-13).** This direct-source scalability plan was
-> superseded when Registry-backed evidence moved behind Relay. Its connectors,
-> runtime paths, and product-local load harness were removed before 1.0. This
-> file is retained only as historical design context and is not current
-> implementation or operator guidance.
-
-## Purpose
-
-Define the work needed to make `registry-notary` serve both synchronous credential issuance and batch backfills against third-party registries without the current single-threaded fan-out becoming the bottleneck. The fan-out diagnosis is provisional, to be confirmed by the Stage 0 load harness before Stage 1 ships.
-
-## Background
-
-Today the evaluation pipeline is strictly sequential at every level: `runtime::batch_evaluate` iterates batch items in a `for` loop (`crates/registry-notary-server/src/runtime.rs:362-421`); inside one target, claims are evaluated in order; inside one claim, source bindings are read one at a time via `SourceReader::read_one`. Both connector backends (`registry_data_api`, `dci` in `crates/registry-notary-server/src/standalone.rs:459-537`) do one upstream HTTP request per (claim, target, binding).
-
-This is fine for one-off issuance, breaks down under any meaningful load, and ignores bulk capabilities the upstream Registry Data API and DCI search envelope already expose.
-
-## Goals
-
-- Parallelize the evaluation pipeline within a single request.
-- Avoid duplicate upstream fetches inside one `batch_evaluate`.
-- Use bulk upstream operations when the connector backend supports them, without breaking arbitrary third-party REST upstreams.
-- Cap outbound concurrency per `source_connection` across **all** concurrent notary requests (process-global), so the notary cannot DOS an upstream regardless of inbound load.
-- Establish measurable performance targets and a load-test harness to prevent regressions.
-
-## Non-Goals
-
-- Cross-request shared cache (Stage 4, gated on an explicit audit/freshness design pass).
-- Connector-level streaming or pagination semantics (claim bindings remain single-record by design).
-- Distinguishing transient vs. permanent upstream errors as a general hardening item; see Cross-Cutting Concerns for the minimum retry policy required once concurrency lands.
-- Schema or contract changes to the public notary HTTP API.
-
-## Stages
-
-Each stage is independently shippable. Definition of Done is per stage.
-
-### Stage 0: Load harness in `perf/`
-
-**Change.** Establish a reproducible load harness in `perf/` with a mock upstream that supports configurable median latency, jitter, and concurrent-request counting. Scenarios: single-target sync issuance, `batch_evaluate` at sizes 10/100/1000, and a sustained-rate scenario across two concurrent inbound requests.
-
-**Why.** Every later stage's DoD references measurements. Without the harness, "verified by load test" is decorative. Also validates that the bottleneck is fan-out before committing Stages 1-3 to that diagnosis; CEL evaluation (`runtime.rs:733-799`) and JSON projection on large records may dominate for some claim shapes.
-
-**Definition of Done.**
-
-- `perf/` contains a runnable scenario set with a documented invocation in this spec or `perf/README.md`.
-- Baseline numbers captured for current (pre-Stage-1) code: per-scenario p50/p99 latency, sustained throughput, peak outbound concurrency per source connection.
-- Mock upstream surfaces "max-observed concurrent in-flight requests" as a test assertion, not just a metric.
-
-### Stage 1: Parallel evaluation inside one request
-
-**Change.** Replace the sequential item loop in `runtime::batch_evaluate` with a bounded `JoinSet`. Inside one `evaluate`, run independent claims (no `depends_on` edges between them) concurrently; later DAG levels run after their predecessors complete. Inside one claim, fan out source bindings concurrently. Rework the `prior` map (`runtime.rs:487-561`, esp. the mut borrow at 491) so concurrent sibling claims at the same DAG level publish results without data races; either an `Arc<Mutex<BTreeMap<...>>>` or per-claim `OnceCell` in a level-keyed structure.
-
-Add a per-`source_connection` outbound semaphore as a **process-global** `Arc<Semaphore>` keyed by `connection_id`, owned by `HttpEvidenceSources` and shared across all concurrent notary requests.
-
-Provide a kill switch: `concurrency.items=1` and `concurrency.bindings=1` reproduce today's strictly-sequential behavior exactly.
-
-**Why.** Highest leverage, no connector contract change, works for every backend including arbitrary third-party REST.
-
-**Definition of Done.**
-
-- New config keys: `concurrency.items` (default 16), `concurrency.bindings` (default 8), per-source `max_in_flight` (default 8); kill-switch behavior documented.
-- Process-global cap test: two concurrent `batch_evaluate` calls against the same `source_connection` observe a combined inbound concurrency at the mock upstream capped at `max_in_flight`. Drives Goal "cannot DOS upstream" to a positive verification.
-- Positive overlap test: two independent claims at the same DAG level, each with a 200ms mock upstream, complete a single-target `evaluate` in roughly 200ms (not 400ms) at `concurrency.bindings>=2`. Tolerance documented.
-- DAG correctness test: claim B with `depends_on: [A]` never starts before A completes, including under high `concurrency.bindings`.
-- Unhappy-path test: one target's read panics inside the `JoinSet`; remaining items complete; the panic surfaces as a request-level error; no futures leaked, semaphore permits returned.
-- Numeric DoD against Stage 0 baseline: `batch_evaluate` of 100 items against a mock upstream at 100ms median completes in under `1.5 * ceil(100 / concurrency.items) * 100ms` end-to-end. Failure indicates concurrency is not actually overlapping.
-
-### Stage 2: Per-request fetch memoization
-
-**Change.** Inside one `batch_evaluate`, dedup upstream calls keyed on a **hash of the canonical serialized upstream request** (connection_id, dataset, entity, lookup_field, lookup_op, lookup_value, projected_fields_set, purpose; for DCI also query_type, registry_type, record_type, field_paths). Equivalent formulation: hash the bytes that *would* be sent on the wire.
-
-Memoize at **`batch_evaluate` scope**, not per-target `evaluate` scope, so items sharing a binding share both the read **and** the `iat` baseline. Lift `now` for memoized siblings to the timestamp of the original upstream read; emit one audit event with redacted target handles rather than one per target.
-
-Cache only successful results. Errors are not memoized: a transient flake must not poison every target in the batch.
-
-**Why.** Two claims that share a binding for the same target currently fetch twice. Without lifting `now`, batch siblings would carry different `iat` values for credentials derived from the same upstream observation, making the audit story inconsistent.
-
-**Definition of Done.**
-
-- Positive test: one target, two claims sharing one binding: exactly one upstream HTTP request.
-- Batch dedup test: 50 items across 3 claims sharing 1 binding by lookup value: exactly 50 upstream calls, not 150.
-- Negative tests: two claims with different `lookup_op`, OR different `projected_fields_set`, OR different `purpose` do **not** share the memoized read. Run all three variants.
-- DCI negative test: two claims with different `query_type` against the same connection do not memoize together.
-- Error-not-cached test: first call returns 500; a subsequent call for the same key proceeds to a new upstream request.
-- `iat` consistency test: items sharing a memoized read produce credentials with identical `iat`; the audit log records one source-read event listing all affected target handles.
-
-### Stage 3: Bulk `read_many` with per-connection capability config
-
-**Change.** Add `SourceReader::read_many(Vec<(SourceBindingConfig, EvidenceTarget)>) -> Vec<Result<Value, EvidenceError>>` with a default impl that runs `read_one` concurrently. Add per-`source_connection` `bulk_mode` config:
-
-- `none` (default, safe for arbitrary third-party REST).
-- `rda_in_filter` (relay-shaped RDA upstreams that support `EntityFilterOp::In`).
-- `dci_batched_search` (DCI-spec upstreams accepting multi-entry `message.search_request[]`).
-
-**RDA specialization.** One collection GET with `lookup_field=in:v1,v2,...&limit=N+1`. Per-target ambiguity cannot be derived from a flat row count if multiple targets share a lookup value. Resolution:
-
-- Config-validation precondition: `rda_in_filter` requires `lookup.cardinality: one` AND operator attestation `bulk_mode_lookup_unique: true` on the connection.
-- Runtime fail-safe: if total response rows exceed `N`, fall back to per-target `read_one` for the entire batch on this connection. Emit a `bulk_collision_fallback` metric so operators see the precondition is being violated.
-
-**DCI specialization.** One POST with N `search_request[]` entries, each with its own `reference_id`. The current `records_path` (`config.rs:415`) is hardcoded to index `0` and cannot express per-entry projection: `read_many` for DCI **ignores `records_path`** and walks `message.search_response[]`, matching each entry's `reference_id` back to the originating target. `records_path` continues to govern `read_one` for backward compatibility. `dci.max_results` (config.rs:418-420, default 2) is overridden to `max(max_results, N)` when in batched mode so page_size scales with the batch.
-
-**Why.** Bulk on relay-shaped or DCI-compliant upstreams turns N upstream calls into 1. Default `read_many` keeps arbitrary REST correct via concurrent `read_one`.
-
-**Definition of Done.**
-
-- `bulk_mode` config validates: unknown variants rejected at load time; `rda_in_filter` requires `bulk_mode_lookup_unique: true` and `lookup.cardinality: one`; defaults to `none`.
-- RDA bulk integration test: 100 targets with unique lookup values produce 1 upstream HTTP request; results match a per-target reference run row-for-row.
-- RDA collision-fallback test: a batch where two targets share a lookup value triggers per-target fallback; emits `bulk_collision_fallback`; results are correct for every target.
-- DCI bulk integration test: 100 targets produce 1 POST with `message.search_request.len() == 100`; request body `page_size >= 100`; responses split by `reference_id`; results match a per-target reference run.
-- DCI missing-record test: one target's `reference_id` is absent from the response; that target gets `target.not_found`; other targets are unaffected.
-- `bulk_mode: none` cassette test: recorded wire bytes for a representative scenario match today's per-target sequence exactly.
-- Backward-compatibility: `records_path` still drives `read_one` for DCI; the existing `read_one` test stays green.
-
-### Stage 4: Short-TTL raw-record cache (gated)
-
-**Change.** Optional cross-request cache of raw upstream JSON keyed identically to Stage 2. TTL configurable per `source_connection`. Claim evaluation always recomputes from cached or fresh records.
-
-**Why.** Repeat reads of the same target within seconds (revocation polling, retry loops, parallel verifier traffic) bypass upstream.
-
-**Pre-condition.** Separate design pass on cache vs. audit/freshness: what does `iat` mean for a credential issued from a cached record? Likely answer: cap max staleness per source connection, expose freshness as a per-profile policy, refuse cache for claims marked freshness-sensitive.
-
-**Definition of Done.** Deferred until the design pass lands. Not in scope for the first push.
-
-## Cross-Cutting Concerns
-
-These apply across stages and have their own DoD bullets in the stage that introduces them.
-
-- **Retry / backoff.** With Stage 1 concurrency, a flaky upstream multiplies failure surface linearly. Introduce a bounded retry (max 1 retry on transport error or 5xx, exponential backoff with jitter). Retries hold `max_in_flight` permits for their full duration. Required as part of Stage 1.
-- **Timeout budget.** Per-call timeout (`standalone.rs:473, 516`) is unchanged for `read_one`. Under `read_many`, the per-call budget scales with batch size up to a configurable cap `source_connection.bulk_timeout_max`. Required as part of Stage 3.
-- **Observability.** Per-`source_connection` in-flight gauge, outbound-latency histogram, batch-size histogram, memoization hit rate, bulk-vs-fallback counter, retry counter. Gauge and retry counter in Stage 1; memo hit rate in Stage 2; batch and fallback counters in Stage 3.
-- **Feature flagging.** `concurrency.items=1` and `concurrency.bindings=1` reproduce today's behavior. `bulk_mode: none` reproduces today's wire behavior. Operators can disable Stages 1 and 3 per-deployment without code changes.
-- **Config reload.** On hot reload, the per-connection semaphore is replaced atomically; outstanding permits drain naturally. `concurrency.*` changes take effect for new requests only; in-flight `JoinSet` sizes are not retroactively resized. Documented behavior, not enforced via DoD.
-- **Target mapping cost.** `load_sources` maps the request target into each source binding (`runtime.rs:720`). Stage 1 parallelizes target mapping with `read_one`. Stage 3 invokes target mapping N times before issuing the single upstream call. Profiled as a follow-up if Stage 0 shows it is significant; not a Stage 1 DoD item.
-
-## Performance Targets
-
-To be locked down via Stage 0 measurements before Stage 1 lands. Proposed starting bar, revisable:
-
-- **Sync issuance (p99)**: single target, one claim, one binding, upstream median 100ms: under 300ms end-to-end.
-- **Batch backfill (sustained)** at the **default** `max_in_flight=8`: 3 claims, 1 binding each, RDA upstream at 100ms median: at least 50 targets per second per notary instance after Stage 1.
-- **Batch backfill (stretch, tuned)** with `max_in_flight=16`: at least 100 targets per second per notary instance after Stage 1. This number is conditional on operators tuning `max_in_flight` upward against a tolerant upstream and does not contradict the default-politeness goal.
-- **Outbound politeness**: process-global concurrent outbound calls per `source_connection` never exceed `max_in_flight`, verified across multiple concurrent inbound notary requests.
-
-## Open Questions
-
-1. Are the third-party upstreams we expect to integrate against mostly relay-shaped (RDA collection + `in:`) and DCI-spec compliant, or mostly arbitrary bespoke REST? Decides how much value Stage 3 actually delivers.
-2. Concrete example registries to design `bulk_mode` against, so we are not abstracting over hypothetical API shapes.
-3. Stage 0 harness location: standalone `perf/` in this repo, or shared infrastructure with `registry-relay/perf/`?
-4. For RDA `rda_in_filter`: is operator-attested `bulk_mode_lookup_unique: true` acceptable, or should the notary verify uniqueness by inspecting the upstream entity schema response?
-
-## Out of Scope
-
-- Horizontal scaling of the notary itself (multiple instances, leader election). Stateless per request today; horizontal scale is a deployment concern, not a code change.
-- Async issuance / job queue model. Current spec assumes synchronous request/response.
-- Upstream contract negotiation. We adapt to what upstreams expose; we do not propose new upstream APIs here.
diff --git a/products/notary/archive/specs/source-adapter-sidecar-source-spec.md b/products/notary/archive/specs/source-adapter-sidecar-source-spec.md
deleted file mode 100644
index c0c9f18f1..000000000
--- a/products/notary/archive/specs/source-adapter-sidecar-source-spec.md
+++ /dev/null
@@ -1,271 +0,0 @@
-# Synchronous Adaptor Source Sidecar Spec
-
-> **Status: Archived and removed before 1.0 (2026-07-13).** This file preserves
-> the historical source-adapter sidecar design only. Registry Notary no longer
-> ships or accepts this execution path. Registry-backed evidence uses
-> authenticated, compiler-pinned Registry Relay consultations. Source-free and
-> self-attested claim evidence are not supported. Do not read the sidecar, OpenFn,
-> `http_json`, `http_flow`, FHIR, or Rhai engine language below as current
-> behavior.
-
-## Goal
-
-Provide a small synchronous source sidecar that lets Registry Notary evaluate a
-single-target claim using OpenFn adaptors. The first implementation uses
-OpenFn, but the contract is a synchronous Registry Data API-shaped source
-contract, not an OpenFn-specific Notary connector.
-
-## Architecture
-
-Registry Notary calls the sidecar through the existing `registry_data_api`
-source connector:
-
-```text
-GET /datasets/{dataset}/{entity}?{lookup_field}={lookup_value}&fields=a,b&limit=2
-Authorization: Bearer <notary-to-sidecar-token>
-Data-Purpose: <purpose>
-```
-
-The sidecar normalizes the target service response and returns:
-
-```json
-{ "data": [] }
-```
-
-or:
-
-```json
-{ "data": [{ "field": "value" }] }
-```
-
-It may return two records only to signal ambiguity. Registry Notary remains the
-attestation authority: it owns caller auth, scopes, purpose, claim rules,
-disclosure, provenance, audit, and credential issuance.
-
-The production topology is sidecar-to-Notary over a private pod network or
-localhost. The v1 channel uses a sidecar bearer token; token rotation is a known
-deployment responsibility. Do not expose the sidecar publicly.
-
-## V1 Execution Decision
-
-Use a sidecar-owned, bounded pool of long-lived Node worker processes. Each
-worker loads pinned OpenFn code and receives one request state at a time over a
-private process channel. A subprocess-per-request CLI wrapper is acceptable only
-for local proof-of-concept work.
-
-Credentials never traverse a network socket; they stay within the sidecar
-process tree.
-
-OpenFn Lightning webhooks, work orders, and queued runs are not in the Notary
-request path.
-
-The sidecar owns concurrency:
-
-- `max_workers` caps simultaneous OpenFn executions.
-- Requests beyond capacity return `503` with `Retry-After`, not an unbounded
-  in-memory queue.
-- Each worker has a wall-clock timeout, memory limit, stdout/stderr byte limit,
-  and forced kill path. The wrapper timeout must kill hung workers even if the
-  OpenFn job timeout fails.
-- Liveness restarts the sidecar if requests are arriving and no worker has
-  completed a request within the configured liveness window.
-
-## Historical Credential And Job Loading
-
-Target-service credentials are injected into the per-request OpenFn state as
-`state.configuration` over the private worker channel. They must not be written
-to per-request disk files. If a disk-backed fallback is ever added, it must use
-mode `0600`, a per-request directory, and best-effort cleanup on timeout and
-crash.
-
-In the original OpenFn design, workflow expression files, adaptor versions, and
-credential schemas were declared in a sidecar manifest bundled into the sidecar
-image:
-
-```yaml
-openfn:
-  cli_build_tool: 1.2.5
-  runtime: 1.9.3
-limits:
-  max_workers: 4
-  worker_timeout_ms: 10000
-  max_worker_memory_mb: 512
-sources:
-  source_adapter_crvs:
-    dataset: civil_registry
-    entity: civil_person
-    workflow:
-      start: prepare_request
-      steps:
-        - id: prepare_request
-          expression: jobs/prepare-person-request.js
-          adaptors:
-            - "@openfn/language-common@3.2.3"
-          next:
-            fetch_person: true
-        - id: fetch_person
-          expression: jobs/fetch-person.js
-          adaptors:
-            - "@openfn/language-http@7.2.0"
-          next:
-            normalize_response: true
-        - id: normalize_response
-          expression: jobs/normalize-person-response.js
-          adaptors:
-            - "@openfn/language-common@3.2.3"
-    credential_env: OPENCRVS_READER_CREDENTIAL_JSON
-```
-
-The historical OpenFn design expected startup to verify installed OpenFn
-compiler/build tool, runtime, and adaptor versions against the manifest. The
-shipped sidecar does not enforce installed OpenFn runtime or adaptor version
-pins as part of startup. Current startup validates the local manifest, compiles
-the configured runtime material, requires credentials, runs smoke lookups before
-readiness, and can expose local sidecar assurance for Notary-side pins.
-
-## Historical Requirements
-
-These requirements are the original design record. Current shipped behavior is
-documented in the sidecar README and tests.
-
-- The sidecar must answer synchronously within a configured timeout.
-- Current governed runtime material must be anchored by the TUF-verified
-  whole-target `config_hash`; this archived OpenFn design's runtime/adaptor
-  version-pinning requirement is not a current shipped guarantee.
-- Adaptors must be preinstalled or warmed before readiness succeeds.
-- The sidecar must enforce `limit <= 2`, one lookup predicate, max output bytes,
-  and max execution duration.
-- The sidecar must enforce max request bytes and max single-query-parameter
-  length before dispatching to a worker.
-- The sidecar must pass `Data-Purpose` and correlation headers to downstream
-  calls when the target adaptor supports it.
-- The sidecar must emit structured logs and metrics with the inbound correlation
-  ID, source id, outcome, duration, and worker id.
-- The sidecar must not log or return credentials, raw secrets, credential
-  lengths, credential hashes, or full environment dumps, including during
-  startup and readiness checks.
-- The sidecar must map outcomes to the RDA `data` array contract:
-  not found `[]`, exact match `[record]`, ambiguous `[record1, record2]`.
-- The sidecar trims extra fields from successful records before responding.
-- If the target returns more than two matching records, the sidecar returns two
-  records to preserve Notary's existing ambiguous-source behavior.
-
-## HTTP Outcomes
-
-| Cause | Sidecar status | Body shape |
-| --- | --- | --- |
-| Exact match | `200` | `{ "data": [record] }` |
-| Not found | `200` | `{ "data": [] }` |
-| Ambiguous | `200` | `{ "data": [record1, record2] }` |
-| Missing or malformed sidecar token | `401` plus `WWW-Authenticate` | Problem Details |
-| Well-formed but rejected sidecar token | `403` | Problem Details |
-| Missing `Data-Purpose` | `400` | Problem Details |
-| Invalid lookup, projection, or `limit > 2` | `400` | Problem Details |
-| Worker pool saturated | `503` | Problem Details plus `Retry-After` |
-| Target auth failure | `502` | Problem Details with operator-visible code |
-| Target rate limit | `503` | Problem Details plus `Retry-After` when known |
-| OpenFn worker crash or non-zero execution failure | `502` | Problem Details |
-| Invalid or truncated OpenFn output | `502` | Problem Details |
-| Worker wall-clock timeout | `504` | Problem Details |
-| Oversized OpenFn output | `502` | Problem Details |
-
-## Non-Goals
-
-- Do not use OpenFn Lightning webhooks or queued runs for the synchronous Notary
-  lookup path.
-- Do not let OpenFn decide claim satisfaction or disclosure.
-- Do not add a new Registry Notary connector until the RDA facade is proven
-  insufficient. Trigger signals include needing typed source errors in Notary,
-  needing request bodies instead of RDA query parameters, or needing Notary to
-  participate in target-service OAuth flows.
-- Do not support batch lookups in the first implementation.
-- Do not retry OpenFn execution failures in v1; target reads may not be
-  idempotent.
-
-## Historical Definition Of Done
-
-The original implementation plan used the checklist below. It is retained as
-history, not as the current assurance checklist; current behavior is documented
-in crates/registry-notary-source-adapter-sidecar/README.md and the sidecar tests.
-
-- A runnable sidecar exposes one RDA-shaped source endpoint and returns only the
-  documented `{ "data": [...] }` success shape.
-- Governed runtime material is anchored by the TUF-verified whole-target
-  `config_hash`; startup rejects missing credentials, invalid configuration,
-  unavailable workers, and failed smoke lookups.
-- Startup/readiness fails until required adaptors are installed, credentials are
-  present, the worker pool is available, and every configured source can execute
-  a smoke lookup.
-- Liveness distinguishes process health from readiness and remains responsive
-  when workers are saturated or a worker is killed.
-- A Registry Notary config points at the sidecar using `connector:
-  registry_data_api` and evaluates one claim end to end through the sidecar.
-- Automated tests cover exact match, not found, ambiguous result, invalid OpenFn
-  output, timeout with worker kill, oversized output, missing purpose, bad
-  sidecar token, worker-pool saturation, missing adaptor at boot, concurrent
-  requests, truncated stdout, and no retry on OpenFn failure.
-- Credential non-disclosure is verified on success and error paths, including an
-  adaptor failure that writes state-like content to stderr.
-- Logs, metrics, and HTTP responses are checked to confirm no configured
-  credentials, target-service credentials, OpenFn environment secrets, or full
-  request state are disclosed.
-- Focused sidecar tests, affected `registry-notary-server` tests, formatter,
-  linter, and build checks pass in CI or an equivalent local verification run.
-- Implementation docs include local run instructions, manifest fields, expected
-  deployment topology, and the exact verification commands used.
-- A final reviewer pass confirms every DoD bullet with linked test, command, or
-  code evidence before the work is called complete.
-
-## Implementation Plan (historical)
-
-Wave 0: Design Freeze And Review
-
-- Lead: parent agent.
-- Work: freeze this spec, list open product decisions, and create review
-  checklist from the DoD.
-- Review gate: one reviewer signs off that credential injection, concurrency,
-  error mapping, readiness, and non-disclosure requirements are unambiguous.
-
-Wave 1: Contract Harness
-
-- Worker A owns sidecar HTTP contract tests and mock OpenFn worker fixtures.
-- Worker B owns Registry Notary integration config and end-to-end test harness.
-- Work can run in parallel because Worker A stays in the sidecar package and
-  Worker B stays in Notary test/config surfaces.
-- Review gate: tests fail against an empty sidecar and cover every HTTP outcome
-  in the spec.
-
-Wave 2: Sidecar Core
-
-- Worker A owns manifest loading, version checks, route binding, and
-  readiness/liveness.
-- Worker C owns worker-pool lifecycle, per-request state injection, timeout,
-  kill, output-size enforcement, and saturation behavior.
-- Shared rule: no worker edits the same module without parent coordination.
-- Review gate: code review checks process isolation, no credential files,
-  bounded concurrency, and deterministic startup failure modes.
-
-Wave 3: OpenFn Execution And Normalization
-
-- Worker C owns pinned OpenFn worker execution.
-- Worker D owns RDA normalization, field trimming, ambiguity handling, and error
-  mapping.
-- Review gate: reviewer validates the sidecar never returns OpenFn-native output
-  directly and all failures map to the status table.
-
-Wave 4: Security, Observability, And Negative Tests
-
-- Worker E owns redaction tests, stderr/log leak tests, correlation IDs, metrics,
-  and structured logs.
-- Worker B extends Notary end-to-end tests for success and source failure.
-- Review gate: security review verifies no secrets in logs, responses, temp
-  files, process args, or failed worker output.
-
-Wave 5: Final Integration
-
-- Parent agent integrates branches, resolves conflicts, runs full focused
-  verification, and updates docs.
-- A reviewer performs a final diff review against the DoD checklist.
-- Completion requires every DoD bullet to be marked with evidence. Partial
-  implementation is not accepted unless the remaining item is listed as a
-  blocker with an exact reason and the feature is not presented as done.
diff --git a/products/notary/bindings/node/.gitignore b/products/notary/bindings/node/.gitignore
deleted file mode 100644
index ddedbd19a..000000000
--- a/products/notary/bindings/node/.gitignore
+++ /dev/null
@@ -1,3 +0,0 @@
-node_modules/
-coverage/
-*.tgz
diff --git a/products/notary/bindings/node/package-lock.json b/products/notary/bindings/node/package-lock.json
deleted file mode 100644
index c931c988e..000000000
--- a/products/notary/bindings/node/package-lock.json
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  "name": "@registry-notary/client",
-  "version": "0.1.0",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "@registry-notary/client",
-      "version": "0.1.0",
-      "devDependencies": {
-        "typescript": "^5.9.3"
-      },
-      "engines": {
-        "node": ">=18.17"
-      }
-    },
-    "node_modules/typescript": {
-      "version": "5.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=14.17"
-      }
-    }
-  }
-}
diff --git a/products/notary/bindings/node/package.json b/products/notary/bindings/node/package.json
deleted file mode 100644
index f1ec90dea..000000000
--- a/products/notary/bindings/node/package.json
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "name": "@registry-notary/client",
-  "version": "0.1.0",
-  "description": "Promise-based Node.js client for Registry Notary",
-  "type": "module",
-  "main": "./src/index.js",
-  "types": "./src/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./src/index.d.ts",
-      "default": "./src/index.js"
-    }
-  },
-  "files": [
-    "src"
-  ],
-  "scripts": {
-    "test": "node --test test/*.test.js",
-    "check:types": "tsc --noEmit"
-  },
-  "engines": {
-    "node": ">=18.17"
-  },
-  "devDependencies": {
-    "typescript": "^5.9.3"
-  }
-}
diff --git a/products/notary/bindings/node/src/case.js b/products/notary/bindings/node/src/case.js
deleted file mode 100644
index 9d7197bed..000000000
--- a/products/notary/bindings/node/src/case.js
+++ /dev/null
@@ -1,53 +0,0 @@
-const UPPERCASE = /[A-Z]/g;
-const SNAKE_SEGMENT = /_([a-zA-Z0-9])/g;
-
-/**
- * @param {string} key
- */
-export function camelToSnakeKey(key) {
-  return key.replace(UPPERCASE, (letter) => `_${letter.toLowerCase()}`);
-}
-
-/**
- * @param {string} key
- */
-export function snakeToCamelKey(key) {
-  return key.replace(SNAKE_SEGMENT, (_match, letter) => letter.toUpperCase());
-}
-
-/**
- * Recursively converts plain object keys. Values that are not JSON containers
- * are returned as-is so AbortSignal and other host objects are not traversed.
- *
- * @param {unknown} value
- * @param {(key: string) => string} convertKey
- * @returns {unknown}
- */
-export function convertJsonKeys(value, convertKey) {
-  if (Array.isArray(value)) {
-    return value.map((item) => convertJsonKeys(item, convertKey));
-  }
-
-  if (!isPlainObject(value)) {
-    return value;
-  }
-
-  /** @type {Record<string, unknown>} */
-  const converted = {};
-  for (const [key, item] of Object.entries(value)) {
-    converted[convertKey(key)] = convertJsonKeys(item, convertKey);
-  }
-  return converted;
-}
-
-/**
- * @param {unknown} value
- * @returns {value is Record<string, unknown>}
- */
-function isPlainObject(value) {
-  if (value === null || typeof value !== "object") {
-    return false;
-  }
-  const prototype = Object.getPrototypeOf(value);
-  return prototype === Object.prototype || prototype === null;
-}
diff --git a/products/notary/bindings/node/src/client.js b/products/notary/bindings/node/src/client.js
deleted file mode 100644
index 77c2a5b0f..000000000
--- a/products/notary/bindings/node/src/client.js
+++ /dev/null
@@ -1,949 +0,0 @@
-import { camelToSnakeKey, convertJsonKeys, snakeToCamelKey } from "./case.js";
-import { NotaryError, NotaryProblemError, NotaryTransportError } from "./errors.js";
-
-const CLAIM_RESULT_JSON = "application/vnd.registry-notary.claim-result+json";
-const APPLICATION_JWT = "application/jwt";
-const PROBLEM_JSON = "application/problem+json";
-const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
-const JWKS_TTL_MS = 10 * 60 * 1000;
-const MAX_REDIRECTS = 10;
-/** @type {RequestRedirect} */
-const MANUAL_REDIRECT = "manual";
-
-const DEFAULT_RETRY_POLICY = Object.freeze({
-  maxAttempts: 1,
-  baseDelayMs: 50,
-  maxDelayMs: 1000,
-  retryTransportErrors: false,
-  retryRateLimited: false,
-  retryUnavailable: false,
-});
-
-/**
- * Promise-based Registry Notary Node.js client.
- */
-export class RegistryNotaryClient {
-  #apiKey;
-  #baseUrl;
-  #bearerToken;
-  #defaultPurpose;
-  #fetch;
-  /** @type {{ body: unknown, expiresAt: number } | undefined} */
-  #jwksCache;
-  /** @type {ReturnType<typeof normalizeRetryPolicy>} */
-  #retryPolicy;
-  #userAgent;
-
-  /**
-   * @param {{
-   *   baseUrl: string,
-   *   bearerToken?: string,
-   *   apiKey?: string,
-   *   defaultPurpose?: string,
-   *   userAgent?: string,
-   *   retryPolicy?: Partial<typeof DEFAULT_RETRY_POLICY>,
-   *   fetch?: typeof fetch
-   * }} options
-   */
-  constructor(options) {
-    if (!options || typeof options.baseUrl !== "string" || options.baseUrl.length === 0) {
-      throw new NotaryError("baseUrl is required", { code: "invalid_base_url" });
-    }
-    if (options.bearerToken !== undefined && options.apiKey !== undefined) {
-      throw new NotaryError("only one auth mode can be configured", { code: "multiple_auth_modes" });
-    }
-
-    this.#baseUrl = normalizeBaseUrl(options.baseUrl);
-    this.#bearerToken = options.bearerToken;
-    this.#apiKey = options.apiKey;
-    this.#defaultPurpose = options.defaultPurpose;
-    this.#userAgent = options.userAgent;
-    this.#retryPolicy = normalizeRetryPolicy(options.retryPolicy);
-    this.#fetch = options.fetch;
-    this.#jwksCache = undefined;
-  }
-
-  /**
-   * High-level evaluate API. Accepts camelCase object keys and returns response
-   * object keys converted to camelCase.
-   *
-   * @param {Record<string, unknown> & { signal?: AbortSignal }} request
-   * @param {{ purpose?: string, requestId?: string, traceparent?: string, signal?: AbortSignal }} [options]
-   * @returns {Promise<unknown>}
-   */
-  async evaluate(request, options = {}) {
-    const { signal: requestSignal, ...bodyRequest } = request;
-    const body = /** @type {Record<string, unknown>} */ (convertJsonKeys(bodyRequest, camelToSnakeKey));
-    const response = await this.evaluateRequest(body, {
-      ...options,
-      signal: options.signal ?? requestSignal,
-      camelCaseResponse: true,
-    });
-    return response;
-  }
-
-  /**
-   * Low-level evaluate API. Request JSON is the canonical snake_case wire shape.
-   *
-   * @param {Record<string, unknown>} request
-   * @param {{
-   *   purpose?: string,
-   *   requestId?: string,
-   *   request_id?: string,
-   *   traceparent?: string,
-   *   signal?: AbortSignal,
-   *   camelCaseResponse?: boolean
-   * }} [options]
-   * @returns {Promise<unknown>}
-   */
-  async evaluateRequest(request, options = {}) {
-    rejectEvaluateOnlyOptions(options);
-    const bodyPurpose = stringProperty(request, "purpose");
-    const headerPurpose = options.purpose ?? this.#defaultPurpose;
-    assertPurposeCompatible(bodyPurpose, headerPurpose);
-
-    const body = await this.requestJson("/v1/evaluations", request, {
-      accept: CLAIM_RESULT_JSON,
-      purpose: headerPurpose,
-      requestId: options.requestId ?? options.request_id,
-      traceparent: options.traceparent,
-      signal: options.signal,
-      retryKind: "post_no_retry",
-    });
-
-    if (options.camelCaseResponse === true) {
-      return convertJsonKeys(body, snakeToCamelKey);
-    }
-    return body;
-  }
-
-  /**
-   * High-level batch evaluation API. Accepts camelCase object keys and returns
-   * response object keys converted to camelCase.
-   *
-   * @param {Record<string, unknown> & { signal?: AbortSignal }} request
-   * @param {{ purpose?: string, requestId?: string, traceparent?: string, idempotencyKey?: string, signal?: AbortSignal }} [options]
-   * @returns {Promise<unknown>}
-   */
-  async batchEvaluate(request, options = {}) {
-    const { signal: requestSignal, ...bodyRequest } = request;
-    const body = /** @type {Record<string, unknown>} */ (convertJsonKeys(bodyRequest, camelToSnakeKey));
-    const response = await this.batchEvaluateRequest(body, {
-      ...options,
-      signal: options.signal ?? requestSignal,
-      camelCaseResponse: true,
-    });
-    return response;
-  }
-
-  /**
-   * Low-level batch evaluation API. Request JSON is the canonical snake_case
-   * wire shape.
-   *
-   * @param {Record<string, unknown>} request
-   * @param {{
-   *   purpose?: string,
-   *   requestId?: string,
-   *   request_id?: string,
-   *   traceparent?: string,
-   *   idempotencyKey?: string,
-   *   idempotency_key?: string,
-   *   signal?: AbortSignal,
-   *   camelCaseResponse?: boolean
-   * }} [options]
-   * @returns {Promise<unknown>}
-   */
-  async batchEvaluateRequest(request, options = {}) {
-    const bodyPurpose = stringProperty(request, "purpose");
-    const headerPurpose = options.purpose ?? this.#defaultPurpose;
-    assertPurposeCompatible(bodyPurpose, headerPurpose);
-
-    const body = await this.requestJson("/v1/batch-evaluations", request, {
-      accept: CLAIM_RESULT_JSON,
-      purpose: headerPurpose,
-      requestId: options.requestId ?? options.request_id,
-      traceparent: options.traceparent,
-      idempotencyKey: options.idempotencyKey ?? options.idempotency_key,
-      signal: options.signal,
-      retryKind: "post_batch",
-    });
-
-    if (options.camelCaseResponse === true) {
-      return convertJsonKeys(body, snakeToCamelKey);
-    }
-    return body;
-  }
-
-  /**
-   * @param {{ requestId?: string, signal?: AbortSignal }} [options]
-   * @returns {Promise<unknown>}
-   */
-  async listClaims(options = {}) {
-    return await this.getJson("/v1/claims", {
-      accept: "application/json",
-      requestId: options.requestId,
-      signal: options.signal,
-    });
-  }
-
-  /**
-   * @param {string} claimId
-   * @param {{ requestId?: string, signal?: AbortSignal }} [options]
-   * @returns {Promise<unknown>}
-   */
-  async getClaim(claimId, options = {}) {
-    return await this.getJson(`/v1/claims/${encodeURIComponent(claimId)}`, {
-      accept: "application/json",
-      requestId: options.requestId,
-      signal: options.signal,
-    });
-  }
-
-  /**
-   * Render evidence from canonical snake_case JSON.
-   *
-   * `evaluation_id` is required in the request object and is used as the route
-   * path parameter. It is not sent in the request body.
-   *
-   * @param {Record<string, unknown>} request
-   * @param {{ requestId?: string, traceparent?: string, signal?: AbortSignal }} [options]
-   * @returns {Promise<unknown>}
-   */
-  async renderRequest(request, options = {}) {
-    if (request === null || request === undefined || typeof request !== "object" || Array.isArray(request)) {
-      throw new NotaryError("render request requires a request object", {
-        kind: "client",
-        code: "request.invalid_type",
-      });
-    }
-    const evaluationId = stringProperty(request, "evaluation_id");
-    if (evaluationId === undefined || evaluationId.length === 0) {
-      throw new NotaryError("render request requires evaluation_id", {
-        kind: "client",
-        code: "request.missing_evaluation_id",
-      });
-    }
-    const { evaluation_id: _evaluationId, ...body } = request;
-    return await this.requestJson(`/v1/evaluations/${encodeURIComponent(evaluationId)}/render`, body, {
-      accept: "application/json",
-      requestId: options.requestId,
-      traceparent: options.traceparent,
-      signal: options.signal,
-      retryKind: "post_no_retry",
-    });
-  }
-
-  /**
-   * @param {Record<string, unknown>} request
-   * @param {{ requestId?: string, traceparent?: string, signal?: AbortSignal }} [options]
-   * @returns {Promise<unknown>}
-   */
-  async issueCredentialRequest(request, options = {}) {
-    return await this.requestJson("/v1/credentials", request, {
-      accept: "application/json",
-      requestId: options.requestId,
-      traceparent: options.traceparent,
-      signal: options.signal,
-      retryKind: "post_no_retry",
-    });
-  }
-
-  /**
-   * @param {string} credentialId
-   * @param {{ requestId?: string, signal?: AbortSignal }} [options]
-   * @returns {Promise<unknown>}
-   */
-  async credentialStatus(credentialId, options = {}) {
-    return await this.getJson(`/v1/credentials/${encodeURIComponent(credentialId)}/status`, {
-      accept: "application/json",
-      requestId: options.requestId,
-      signal: options.signal,
-    });
-  }
-
-  /**
-   * @param {{ requestId?: string, signal?: AbortSignal }} [options]
-   * @returns {Promise<unknown>}
-   */
-  async serviceDocument(options = {}) {
-    return await this.getJson("/.well-known/evidence-service", {
-      accept: "application/json",
-      requestId: options.requestId,
-      signal: options.signal,
-    });
-  }
-
-  /**
-   * @param {{ requestId?: string, signal?: AbortSignal }} [options]
-   * @returns {Promise<unknown>}
-   */
-  async issuerJwks(options = {}) {
-    if (options.requestId === undefined && this.#jwksCache !== undefined && this.#jwksCache.expiresAt > Date.now()) {
-      return this.#jwksCache.body;
-    }
-    return await this.refreshJwks(options);
-  }
-
-  /**
-   * @param {{ requestId?: string, signal?: AbortSignal }} [options]
-   * @returns {Promise<unknown>}
-   */
-  async refreshJwks(options = {}) {
-    const body = await this.rawIssuerJwks(options);
-    this.#jwksCache = { body, expiresAt: Date.now() + JWKS_TTL_MS };
-    return body;
-  }
-
-  /**
-   * @param {{ requestId?: string, signal?: AbortSignal }} [options]
-   * @returns {Promise<unknown>}
-   */
-  async rawIssuerJwks(options = {}) {
-    return await this.getJson("/.well-known/evidence/jwks.json", {
-      accept: "application/json",
-      requestId: options.requestId,
-      signal: options.signal,
-    });
-  }
-
-  /**
-   * @param {string} kid
-   * @param {{ requestId?: string, signal?: AbortSignal }} [options]
-   * @returns {Promise<Record<string, unknown> | undefined>}
-   */
-  async getJwk(kid, options = {}) {
-    const cached = await this.issuerJwks(options);
-    const found = findJwk(cached, kid);
-    if (found !== undefined) {
-      return found;
-    }
-    const refreshed = await this.refreshJwks(options);
-    return findJwk(refreshed, kid);
-  }
-
-  /**
-   * @param {{ requestId?: string, signal?: AbortSignal }} [options]
-   * @returns {Promise<unknown>}
-   */
-  async oid4vciIssuerMetadata(options = {}) {
-    return await this.getJson("/.well-known/openid-credential-issuer", {
-      accept: "application/json",
-      requestId: options.requestId,
-      signal: options.signal,
-      errorKind: "oid4vci",
-    });
-  }
-
-  /**
-   * @param {Record<string, unknown>} request
-   * @param {{ requestId?: string, traceparent?: string, signal?: AbortSignal }} [options]
-   * @returns {Promise<unknown>}
-   */
-  async oid4vciCredential(request, options = {}) {
-    return await this.requestJson("/oid4vci/credential", request, {
-      accept: "application/json",
-      requestId: options.requestId,
-      traceparent: options.traceparent,
-      signal: options.signal,
-      retryKind: "post_no_retry",
-      errorKind: "oid4vci",
-    });
-  }
-
-  /**
-   * @param {string} compactJws
-   * @param {{ requestId?: string, traceparent?: string, signal?: AbortSignal }} [options]
-   * @returns {Promise<string>}
-   */
-  async federationEvaluateJws(compactJws, options = {}) {
-    return await this.requestText("/federation/v1/evaluations", compactJws, {
-      accept: APPLICATION_JWT,
-      contentType: APPLICATION_JWT,
-      requestId: options.requestId,
-      traceparent: options.traceparent,
-      signal: options.signal,
-      retryKind: "post_no_retry",
-    });
-  }
-
-  /**
-   * @param {string} path
-   * @param {{ accept: string, requestId?: string, signal?: AbortSignal, errorKind?: string }} options
-   */
-  async getJson(path, options) {
-    const headers = this.headersFor(options);
-    const response = await this.sendWithRetry("get", undefined, options.signal, async () => {
-      return await this.sendOnce(path, {
-        method: "GET",
-        headers,
-        signal: options.signal,
-      });
-    });
-
-    return await parseJsonResponse(response, options.errorKind);
-  }
-
-  /**
-   * @param {string} path
-   * @param {Record<string, unknown>} request
-   * @param {{ accept: string, purpose?: string, requestId?: string, traceparent?: string, idempotencyKey?: string, signal?: AbortSignal, retryKind?: string, errorKind?: string }} options
-   */
-  async requestJson(path, request, options) {
-    const headers = this.headersFor(options);
-    const response = await this.sendWithRetry(options.retryKind ?? "post_no_retry", options.idempotencyKey, options.signal, async () => {
-      return await this.sendOnce(path, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(request),
-        signal: options.signal,
-      });
-    });
-
-    return await parseJsonResponse(response, options.errorKind);
-  }
-
-  /**
-   * @param {string} path
-   * @param {string} request
-   * @param {{ accept: string, contentType: string, requestId?: string, traceparent?: string, signal?: AbortSignal, retryKind?: string }} options
-   */
-  async requestText(path, request, options) {
-    const headers = this.headersFor({ ...options, accept: options.accept });
-    headers.set("content-type", options.contentType);
-    const response = await this.sendWithRetry(options.retryKind ?? "post_no_retry", undefined, options.signal, async () => {
-      return await this.sendOnce(path, {
-        method: "POST",
-        headers,
-        body: request,
-        signal: options.signal,
-      });
-    });
-
-    return await parseTextResponse(response);
-  }
-
-  /**
-   * @param {string} retryKind
-   * @param {string | undefined} idempotencyKey
-   * @param {AbortSignal | undefined} signal
-   * @param {() => Promise<Response>} sendOnce
-   * @returns {Promise<Response>}
-   */
-  async sendWithRetry(retryKind, idempotencyKey, signal, sendOnce) {
-    const attempts = allowedAttempts(this.#retryPolicy, retryKind, idempotencyKey);
-    for (let attempt = 1; ; attempt += 1) {
-      try {
-        const response = await sendOnce();
-        if (response.ok) {
-          return response;
-        }
-        if (attempt < attempts && shouldRetryResponse(this.#retryPolicy, response)) {
-          await sleep(retryDelayMs(this.#retryPolicy, attempt, response), signal);
-          continue;
-        }
-        return response;
-      } catch (error) {
-        const mapped = mapTransportError(error);
-        if (attempt < attempts && this.#retryPolicy.retryTransportErrors && mapped.retryable) {
-          await sleep(retryDelayMs(this.#retryPolicy, attempt), signal);
-          continue;
-        }
-        throw mapped;
-      }
-    }
-  }
-
-  /**
-   * @param {string} path
-   * @param {RequestInit} init
-   */
-  async sendOnce(path, init) {
-    const fetchImpl = this.#fetch ?? globalThis.fetch;
-    if (typeof fetchImpl !== "function") {
-      throw new NotaryTransportError({ code: "fetch_unavailable", retryable: false });
-    }
-    let url = new URL(path.replace(/^\//, ""), this.#baseUrl);
-    /** @type {RequestInit & { headers: Headers }} */
-    let requestInit = { ...init, headers: new Headers(init.headers), redirect: MANUAL_REDIRECT };
-    for (let redirectCount = 0; ; redirectCount += 1) {
-      const response = await fetchImpl(url, requestInit);
-      if (!isRedirectResponse(response)) {
-        return response;
-      }
-      const location = response.headers.get("location");
-      if (location === null) {
-        return response;
-      }
-      if (redirectCount >= MAX_REDIRECTS) {
-        throw new NotaryTransportError({ code: "redirect_loop", retryable: false });
-      }
-      const nextUrl = new URL(location, url);
-      const headers = new Headers(requestInit.headers);
-      if (nextUrl.origin !== url.origin) {
-        headers.delete("authorization");
-        headers.delete("x-api-key");
-      }
-      requestInit = redirectInitForNextRequest(requestInit, headers, response.status);
-      url = nextUrl;
-    }
-  }
-
-  /**
-   * @param {{ accept: string, purpose?: string, requestId?: string, traceparent?: string, idempotencyKey?: string }} options
-   */
-  headersFor(options) {
-    const headers = new Headers({
-      accept: options.accept,
-      "content-type": "application/json",
-    });
-    if (this.#bearerToken !== undefined) {
-      headers.set("authorization", `Bearer ${this.#bearerToken}`);
-    }
-    if (this.#apiKey !== undefined) {
-      headers.set("x-api-key", this.#apiKey);
-    }
-    if (this.#userAgent !== undefined) {
-      headers.set("user-agent", this.#userAgent);
-    }
-    if (options.purpose !== undefined) {
-      headers.set("data-purpose", options.purpose);
-    }
-    if (options.requestId !== undefined) {
-      headers.set("x-request-id", options.requestId);
-    }
-    if (options.traceparent !== undefined) {
-      headers.set("traceparent", options.traceparent);
-    }
-    if (options.idempotencyKey !== undefined) {
-      headers.set("Idempotency-Key", options.idempotencyKey);
-    }
-    return headers;
-  }
-}
-
-/**
- * @param {Response} response
- */
-function isRedirectResponse(response) {
-  return [301, 302, 303, 307, 308].includes(response.status);
-}
-
-/**
- * @param {RequestInit & { headers: Headers }} init
- * @param {Headers} headers
- * @param {number} status
- * @returns {RequestInit & { headers: Headers }}
- */
-function redirectInitForNextRequest(init, headers, status) {
-  const method = (init.method ?? "GET").toUpperCase();
-  if (status === 303 || ((status === 301 || status === 302) && method === "POST")) {
-    headers.delete("content-type");
-    headers.delete("content-length");
-    const next = { ...init, method: "GET", headers, redirect: MANUAL_REDIRECT };
-    delete next.body;
-    return next;
-  }
-  return { ...init, headers, redirect: MANUAL_REDIRECT };
-}
-
-/**
- * @param {Response} response
- * @param {string | undefined} requestId
- */
-async function problemErrorFromResponse(response, requestId, errorKind = "problem") {
-  const contentType = response.headers.get("content-type") ?? "";
-  let payload = undefined;
-  if (contentType.toLowerCase().startsWith(PROBLEM_JSON) || contentType.toLowerCase().includes("json")) {
-    try {
-      payload = JSON.parse(await readBoundedText(response, requestId));
-    } catch {
-      payload = undefined;
-    }
-  }
-
-  if (errorKind === "oid4vci" && isRecord(payload)) {
-    const status = response.status;
-    return new NotaryProblemError({
-      kind: "oid4vci",
-      status,
-      code: stringProperty(payload, "error") ?? `http.${status}`,
-      title: "OID4VCI request failed",
-      retryable: isRetryableStatus(status),
-      requestId,
-      retryAfter: parseRetryAfter(response.headers.get("retry-after")),
-    });
-  }
-
-  if (isRecord(payload)) {
-    const status = numberProperty(payload, "status") ?? response.status;
-    return new NotaryProblemError({
-      kind: stringProperty(payload, "kind") ?? "problem",
-      status,
-      code: stringProperty(payload, "code") ?? `http.${status}`,
-      title: stringProperty(payload, "title") ?? response.statusText,
-      retryable: booleanProperty(payload, "retryable") ?? isRetryableStatus(status),
-      requestId: stringProperty(payload, "request_id") ?? requestId,
-      retryAfter: parseRetryAfter(response.headers.get("retry-after")),
-      problemType: stringProperty(payload, "type"),
-    });
-  }
-
-  return new NotaryProblemError({
-    kind: "http",
-    status: response.status,
-    code: `http.${response.status}`,
-    title: response.statusText,
-    retryable: isRetryableStatus(response.status),
-    requestId,
-    retryAfter: parseRetryAfter(response.headers.get("retry-after")),
-  });
-}
-
-/**
- * @param {string} baseUrl
- */
-function normalizeBaseUrl(baseUrl) {
-  let url;
-  try {
-    url = new URL(baseUrl);
-  } catch (error) {
-    throw new NotaryError("invalid baseUrl", { code: "invalid_base_url", cause: error });
-  }
-  if (!url.pathname.endsWith("/")) {
-    url.pathname = `${url.pathname}/`;
-  }
-  if (url.protocol === "http:" && !isLoopbackHost(url.hostname)) {
-    throw new NotaryError("baseUrl must use https unless the host is loopback", { code: "insecure_base_url" });
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new NotaryError("invalid baseUrl", { code: "invalid_base_url" });
-  }
-  return url;
-}
-
-/**
- * @param {Response} response
- * @param {string | undefined} errorKind
- */
-async function parseJsonResponse(response, errorKind = "problem") {
-  const requestId = response.headers.get("x-request-id") ?? undefined;
-  if (!response.ok) {
-    throw await problemErrorFromResponse(response, requestId, errorKind);
-  }
-
-  try {
-    return JSON.parse(await readBoundedText(response, requestId));
-  } catch (error) {
-    if (error instanceof NotaryProblemError) {
-      throw error;
-    }
-    throw new NotaryProblemError({
-      kind: "decode",
-      status: response.status,
-      code: "decode_error",
-      title: "Failed to decode response body",
-      retryable: false,
-      requestId,
-      cause: error,
-    });
-  }
-}
-
-/**
- * @param {Response} response
- */
-async function parseTextResponse(response) {
-  const requestId = response.headers.get("x-request-id") ?? undefined;
-  if (!response.ok) {
-    throw await problemErrorFromResponse(response, requestId);
-  }
-
-  try {
-    return await readBoundedText(response, requestId);
-  } catch (error) {
-    if (error instanceof NotaryProblemError) {
-      throw error;
-    }
-    throw new NotaryProblemError({
-      kind: "decode",
-      status: response.status,
-      code: "decode_error",
-      title: "Failed to decode response body",
-      retryable: false,
-      requestId,
-      cause: error,
-    });
-  }
-}
-
-/**
- * @param {Response} response
- * @param {string | undefined} requestId
- */
-async function readBoundedText(response, requestId) {
-  const contentLength = response.headers.get("content-length");
-  if (contentLength !== null) {
-    const parsed = Number.parseInt(contentLength, 10);
-    if (Number.isFinite(parsed) && parsed > MAX_RESPONSE_BYTES) {
-      throw bodyTooLargeError(response.status, requestId);
-    }
-  }
-
-  if (response.body === null || typeof response.body.getReader !== "function") {
-    const text = await response.text();
-    if (new TextEncoder().encode(text).byteLength > MAX_RESPONSE_BYTES) {
-      throw bodyTooLargeError(response.status, requestId);
-    }
-    return text;
-  }
-
-  const reader = response.body.getReader();
-  const chunks = [];
-  let total = 0;
-  for (;;) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    total += value.byteLength;
-    if (total > MAX_RESPONSE_BYTES) {
-      try {
-        await reader.cancel();
-      } catch {
-        // Nothing useful to add if cancellation itself fails.
-      }
-      throw bodyTooLargeError(response.status, requestId);
-    }
-    chunks.push(value);
-  }
-
-  const body = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    body.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return new TextDecoder().decode(body);
-}
-
-/**
- * @param {number} status
- * @param {string | undefined} requestId
- */
-function bodyTooLargeError(status, requestId) {
-  return new NotaryProblemError({
-    kind: "body_too_large",
-    status,
-    code: "body.too_large",
-    title: "Response body exceeded configured size limit",
-    retryable: false,
-    requestId,
-  });
-}
-
-/**
- * @param {string} hostname
- */
-function isLoopbackHost(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
-}
-
-/**
- * @param {Record<string, unknown>} options
- */
-function rejectEvaluateOnlyOptions(options) {
-  if (options.idempotencyKey !== undefined || options.idempotency_key !== undefined) {
-    throw new NotaryError("idempotency keys are not supported for evaluate", {
-      code: "unsupported_idempotency_key",
-    });
-  }
-}
-
-/**
- * @param {string | undefined} bodyPurpose
- * @param {string | undefined} headerPurpose
- */
-function assertPurposeCompatible(bodyPurpose, headerPurpose) {
-  if (bodyPurpose !== undefined && headerPurpose !== undefined && bodyPurpose !== headerPurpose) {
-    throw new NotaryError("request purpose conflicts with header purpose", {
-      code: "purpose_conflict",
-    });
-  }
-}
-
-/**
- * @param {unknown} value
- */
-function isAbortError(value) {
-  return isRecord(value) && value.name === "AbortError";
-}
-
-/**
- * @param {number} status
- */
-function isRetryableStatus(status) {
-  return [408, 425, 429, 500, 502, 503, 504].includes(status);
-}
-
-/**
- * @param {Partial<typeof DEFAULT_RETRY_POLICY> | undefined} policy
- */
-function normalizeRetryPolicy(policy) {
-  return {
-    ...DEFAULT_RETRY_POLICY,
-    ...(policy ?? {}),
-  };
-}
-
-/**
- * @param {typeof DEFAULT_RETRY_POLICY} policy
- * @param {string} retryKind
- * @param {string | undefined} idempotencyKey
- */
-function allowedAttempts(policy, retryKind, idempotencyKey) {
-  if (retryKind === "get") {
-    return Math.max(1, policy.maxAttempts);
-  }
-  if (retryKind === "post_batch" && idempotencyKey !== undefined) {
-    return Math.max(1, policy.maxAttempts);
-  }
-  return 1;
-}
-
-/**
- * @param {typeof DEFAULT_RETRY_POLICY} policy
- * @param {Response} response
- */
-function shouldRetryResponse(policy, response) {
-  return (
-    (response.status === 429 && policy.retryRateLimited) ||
-    (response.status === 503 && policy.retryUnavailable)
-  );
-}
-
-/**
- * @param {typeof DEFAULT_RETRY_POLICY} policy
- * @param {number} attempt
- * @param {Response | undefined} response
- */
-function retryDelayMs(policy, attempt, response = undefined) {
-  const retryAfter = response === undefined ? undefined : response.headers.get("retry-after");
-  if (retryAfter !== null && retryAfter !== undefined && /^[0-9]+$/.test(retryAfter.trim())) {
-    return Math.min(Number.parseInt(retryAfter.trim(), 10) * 1000, policy.maxDelayMs);
-  }
-  if (retryAfter !== null && retryAfter !== undefined) {
-    const parsed = Date.parse(retryAfter);
-    if (Number.isFinite(parsed)) {
-      const serverDate = response === undefined ? undefined : response.headers.get("date");
-      const parsedServerDate = serverDate === null || serverDate === undefined ? NaN : Date.parse(serverDate);
-      const referenceNow = Number.isFinite(parsedServerDate) ? parsedServerDate : Date.now();
-      return Math.min(Math.max(0, parsed - referenceNow), policy.maxDelayMs);
-    }
-  }
-  return Math.min(policy.baseDelayMs * 2 ** Math.max(0, attempt - 1), policy.maxDelayMs);
-}
-
-/**
- * @param {string | null} value
- * @returns {number | string | undefined}
- */
-function parseRetryAfter(value) {
-  if (value === null) {
-    return undefined;
-  }
-  const trimmed = value.trim();
-  if (/^[0-9]+$/.test(trimmed)) {
-    return Number.parseInt(trimmed, 10);
-  }
-  return Number.isFinite(Date.parse(trimmed)) ? trimmed : undefined;
-}
-
-/**
- * @param {number} delayMs
- * @param {AbortSignal | undefined} signal
- */
-async function sleep(delayMs, signal) {
-  if (delayMs <= 0) {
-    return;
-  }
-  if (signal?.aborted === true) {
-    throw new NotaryTransportError({ kind: "abort", code: "aborted", retryable: false });
-  }
-  await new Promise((resolve, reject) => {
-    /** @type {ReturnType<typeof setTimeout> | undefined} */
-    let timeout;
-    const cleanup = () => {
-      if (timeout !== undefined) {
-        clearTimeout(timeout);
-      }
-      signal?.removeEventListener("abort", onAbort);
-    };
-    const onAbort = () => {
-      cleanup();
-      reject(new NotaryTransportError({ kind: "abort", code: "aborted", retryable: false }));
-    };
-    timeout = setTimeout(() => {
-      cleanup();
-      resolve(undefined);
-    }, delayMs);
-    signal?.addEventListener("abort", onAbort, { once: true });
-  });
-}
-
-/**
- * @param {unknown} error
- */
-function mapTransportError(error) {
-  if (error instanceof NotaryError) {
-    return error;
-  }
-  if (isAbortError(error)) {
-    return new NotaryTransportError({ kind: "abort", code: "aborted", retryable: false, cause: error });
-  }
-  return new NotaryTransportError({ cause: error });
-}
-
-/**
- * @param {unknown} jwks
- * @param {string} kid
- * @returns {Record<string, unknown> | undefined}
- */
-function findJwk(jwks, kid) {
-  if (!isRecord(jwks) || !Array.isArray(jwks.keys)) {
-    return undefined;
-  }
-  return jwks.keys.find((key) => isRecord(key) && key.kid === kid);
-}
-
-/**
- * @param {unknown} value
- * @returns {value is Record<string, unknown>}
- */
-function isRecord(value) {
-  return value !== null && typeof value === "object";
-}
-
-/**
- * @param {Record<string, unknown>} value
- * @param {string} key
- */
-function stringProperty(value, key) {
-  const item = value[key];
-  return typeof item === "string" ? item : undefined;
-}
-
-/**
- * @param {Record<string, unknown>} value
- * @param {string} key
- */
-function numberProperty(value, key) {
-  const item = value[key];
-  return typeof item === "number" ? item : undefined;
-}
-
-/**
- * @param {Record<string, unknown>} value
- * @param {string} key
- */
-function booleanProperty(value, key) {
-  const item = value[key];
-  return typeof item === "boolean" ? item : undefined;
-}
diff --git a/products/notary/bindings/node/src/errors.js b/products/notary/bindings/node/src/errors.js
deleted file mode 100644
index b2d59e872..000000000
--- a/products/notary/bindings/node/src/errors.js
+++ /dev/null
@@ -1,105 +0,0 @@
-/**
- * Base class for Registry Notary client errors.
- */
-export class NotaryError extends Error {
-  /**
-   * @param {string} message
-   * @param {{ kind?: string, code?: string, retryable?: boolean, requestId?: string, retryAfter?: number | string, cause?: unknown }} [options]
-   */
-  constructor(message, options = {}) {
-    super(message, options.cause === undefined ? undefined : { cause: options.cause });
-    this.name = "NotaryError";
-    this.kind = options.kind ?? "client";
-    this.code = options.code;
-    this.retryable = options.retryable ?? false;
-    this.requestId = options.requestId;
-    this.retryAfter = options.retryAfter;
-  }
-
-  toJSON() {
-    /** @type {{ kind: string, code?: string, retryable: boolean, request_id?: string, retry_after?: number | string, title: string }} */
-    const json = {
-      kind: this.kind,
-      code: this.code,
-      retryable: this.retryable,
-      request_id: this.requestId,
-      title: this.message,
-    };
-    if (this.retryAfter !== undefined) {
-      json.retry_after = this.retryAfter;
-    }
-    return json;
-  }
-}
-
-/**
- * Transport-level error such as a network failure or caller abort.
- */
-export class NotaryTransportError extends NotaryError {
-  /**
-   * @param {{ kind?: string, code?: string, retryable?: boolean, requestId?: string, retryAfter?: number | string, cause?: unknown }} [options]
-   */
-  constructor(options = {}) {
-    super("registry notary transport error", {
-      kind: options.kind ?? "transport",
-      code: options.code ?? "transport_error",
-      retryable: options.retryable ?? true,
-      requestId: options.requestId,
-      retryAfter: options.retryAfter,
-      cause: options.cause,
-    });
-    this.name = "NotaryTransportError";
-  }
-}
-
-/**
- * Error mapped from Registry Notary Problem Details or response decoding.
- */
-export class NotaryProblemError extends NotaryError {
-  /**
-   * @param {{
-   *   kind?: string,
-   *   status?: number,
-   *   code?: string,
-   *   title?: string,
-   *   retryable?: boolean,
-   *   requestId?: string,
-   *   retryAfter?: number | string,
-   *   problemType?: string,
-   *   cause?: unknown
-   * }} options
-   */
-  constructor(options) {
-    const title = options.title ?? "Registry Notary request failed";
-    const code = options.code ?? (options.status === undefined ? "notary_problem" : `http.${options.status}`);
-    const statusPrefix = options.status === undefined ? "" : `${options.status} `;
-    super(`registry notary problem (${statusPrefix}${code}): ${title}`, {
-      kind: options.kind ?? "problem",
-      code,
-      retryable: options.retryable ?? false,
-      requestId: options.requestId,
-      retryAfter: options.retryAfter,
-      cause: options.cause,
-    });
-    this.name = "NotaryProblemError";
-    this.status = options.status;
-    this.title = title;
-    this.problemType = options.problemType;
-  }
-
-  toJSON() {
-    /** @type {{ kind: string, status?: number, code?: string, title: string, retryable: boolean, request_id?: string, retry_after?: number | string }} */
-    const json = {
-      kind: this.kind,
-      status: this.status,
-      code: this.code,
-      title: this.title,
-      retryable: this.retryable,
-      request_id: this.requestId,
-    };
-    if (this.retryAfter !== undefined) {
-      json.retry_after = this.retryAfter;
-    }
-    return json;
-  }
-}
diff --git a/products/notary/bindings/node/src/index.d.ts b/products/notary/bindings/node/src/index.d.ts
deleted file mode 100644
index 5429eab57..000000000
--- a/products/notary/bindings/node/src/index.d.ts
+++ /dev/null
@@ -1,237 +0,0 @@
-export interface RegistryNotaryClientOptions {
-  baseUrl: string;
-  bearerToken?: string;
-  apiKey?: string;
-  defaultPurpose?: string;
-  userAgent?: string;
-  retryPolicy?: Partial<RetryPolicy>;
-  fetch?: typeof fetch;
-}
-
-export interface RetryPolicy {
-  maxAttempts: number;
-  baseDelayMs: number;
-  maxDelayMs: number;
-  retryTransportErrors: boolean;
-  retryRateLimited: boolean;
-  retryUnavailable: boolean;
-}
-
-export interface RequestOptions {
-  purpose?: string;
-  requestId?: string;
-  traceparent?: string;
-  signal?: AbortSignal;
-}
-
-export interface BatchRequestOptions extends RequestOptions {
-  idempotencyKey?: string;
-}
-
-export interface GetRequestOptions {
-  requestId?: string;
-  signal?: AbortSignal;
-}
-
-export interface EvidenceIdentifier {
-  scheme: string;
-  value: string;
-  issuer?: string;
-  country?: string;
-}
-
-export interface EvidenceAssurance {
-  method?: string;
-  levelScheme?: string;
-  level?: string;
-  verifiedAt?: string;
-  issuer?: string;
-  evidence?: Array<Record<string, unknown>>;
-}
-
-export interface EvidenceEntity {
-  type: string;
-  id?: string;
-  identifiers?: EvidenceIdentifier[];
-  attributes?: Record<string, unknown>;
-  assurance?: EvidenceAssurance;
-  profile?: string;
-}
-
-export interface EvidenceRelationship {
-  type: string;
-  attributes?: Record<string, unknown>;
-}
-
-export interface EvaluateRequest {
-  requester?: EvidenceEntity;
-  target: EvidenceEntity;
-  relationship?: EvidenceRelationship;
-  onBehalfOf?: Record<string, unknown>;
-  claims: Array<string | { id: string; version?: string }>;
-  disclosure?: string;
-  format?: string;
-  purpose?: string;
-  signal?: AbortSignal;
-}
-
-export interface RawEvidenceIdentifier {
-  scheme: string;
-  value: string;
-  issuer?: string;
-  country?: string;
-}
-
-export interface RawEvidenceAssurance {
-  method?: string;
-  level_scheme?: string;
-  level?: string;
-  verified_at?: string;
-  issuer?: string;
-  evidence?: Array<Record<string, unknown>>;
-}
-
-export interface RawEvidenceEntity {
-  type: string;
-  id?: string;
-  identifiers?: RawEvidenceIdentifier[];
-  attributes?: Record<string, unknown>;
-  assurance?: RawEvidenceAssurance;
-  profile?: string;
-}
-
-export interface RawEvidenceRelationship {
-  type: string;
-  attributes?: Record<string, unknown>;
-}
-
-export interface RawEvaluateRequest {
-  requester?: RawEvidenceEntity;
-  target: RawEvidenceEntity;
-  relationship?: RawEvidenceRelationship;
-  on_behalf_of?: Record<string, unknown>;
-  claims: Array<string | { id: string; version?: string }>;
-  disclosure?: string;
-  format?: string;
-  purpose?: string;
-  [key: string]: unknown;
-}
-
-export interface BatchEvaluateItemRequest {
-  requester?: EvidenceEntity;
-  target: EvidenceEntity;
-  relationship?: EvidenceRelationship;
-  onBehalfOf?: Record<string, unknown>;
-  purpose?: string;
-}
-
-export interface BatchEvaluateRequest {
-  items: BatchEvaluateItemRequest[];
-  claims: Array<string | { id: string; version?: string }>;
-  disclosure?: string;
-  format?: string;
-  purpose?: string;
-  signal?: AbortSignal;
-}
-
-export interface RawBatchEvaluateItemRequest {
-  requester?: RawEvidenceEntity;
-  target: RawEvidenceEntity;
-  relationship?: RawEvidenceRelationship;
-  on_behalf_of?: Record<string, unknown>;
-  purpose?: string;
-}
-
-export interface RawBatchEvaluateRequest {
-  items: RawBatchEvaluateItemRequest[];
-  claims: Array<string | { id: string; version?: string }>;
-  disclosure?: string;
-  format?: string;
-  purpose?: string;
-  [key: string]: unknown;
-}
-
-export class RegistryNotaryClient {
-  constructor(options: RegistryNotaryClientOptions);
-  evaluate(request: EvaluateRequest, options?: RequestOptions): Promise<unknown>;
-  evaluateRequest(request: RawEvaluateRequest, options?: RequestOptions): Promise<unknown>;
-  batchEvaluate(request: BatchEvaluateRequest, options?: BatchRequestOptions): Promise<unknown>;
-  batchEvaluateRequest(request: RawBatchEvaluateRequest, options?: BatchRequestOptions): Promise<unknown>;
-  listClaims(options?: GetRequestOptions): Promise<unknown>;
-  getClaim(claimId: string, options?: GetRequestOptions): Promise<unknown>;
-  serviceDocument(options?: GetRequestOptions): Promise<unknown>;
-  issuerJwks(options?: GetRequestOptions): Promise<unknown>;
-  refreshJwks(options?: GetRequestOptions): Promise<unknown>;
-  rawIssuerJwks(options?: GetRequestOptions): Promise<unknown>;
-  getJwk(kid: string, options?: GetRequestOptions): Promise<Record<string, unknown> | undefined>;
-  renderRequest(request: Record<string, unknown>, options?: RequestOptions): Promise<unknown>;
-  issueCredentialRequest(request: Record<string, unknown>, options?: RequestOptions): Promise<unknown>;
-  credentialStatus(credentialId: string, options?: GetRequestOptions): Promise<unknown>;
-  oid4vciIssuerMetadata(options?: GetRequestOptions): Promise<unknown>;
-  oid4vciCredential(request: Record<string, unknown>, options?: RequestOptions): Promise<unknown>;
-  federationEvaluateJws(compactJws: string, options?: RequestOptions): Promise<string>;
-}
-
-export class NotaryError extends Error {
-  constructor(
-    message: string,
-    options?: {
-      kind?: string;
-      code?: string;
-      retryable?: boolean;
-      requestId?: string;
-      retryAfter?: number | string;
-      cause?: unknown;
-    },
-  );
-  readonly kind: string;
-  readonly code?: string;
-  readonly retryable: boolean;
-  readonly requestId?: string;
-  readonly retryAfter?: number | string;
-  toJSON(): {
-    kind: string;
-    code?: string;
-    retryable: boolean;
-    request_id?: string;
-    retry_after?: number | string;
-    title: string;
-  };
-}
-
-export class NotaryTransportError extends NotaryError {
-  constructor(options?: {
-    kind?: string;
-    code?: string;
-    retryable?: boolean;
-    requestId?: string;
-    retryAfter?: number | string;
-    cause?: unknown;
-  });
-}
-
-export class NotaryProblemError extends NotaryError {
-  constructor(options: {
-    kind?: string;
-    status?: number;
-    code?: string;
-    title?: string;
-    retryable?: boolean;
-    requestId?: string;
-    retryAfter?: number | string;
-    problemType?: string;
-    cause?: unknown;
-  });
-  readonly status?: number;
-  readonly title: string;
-  readonly problemType?: string;
-  toJSON(): {
-    kind: string;
-    status?: number;
-    code?: string;
-    title: string;
-    retryable: boolean;
-    request_id?: string;
-    retry_after?: number | string;
-  };
-}
diff --git a/products/notary/bindings/node/src/index.js b/products/notary/bindings/node/src/index.js
deleted file mode 100644
index 2cfbb8da2..000000000
--- a/products/notary/bindings/node/src/index.js
+++ /dev/null
@@ -1,2 +0,0 @@
-export { RegistryNotaryClient } from "./client.js";
-export { NotaryError, NotaryProblemError, NotaryTransportError } from "./errors.js";
diff --git a/products/notary/bindings/node/test/client.test.js b/products/notary/bindings/node/test/client.test.js
deleted file mode 100644
index 4f35e7929..000000000
--- a/products/notary/bindings/node/test/client.test.js
+++ /dev/null
@@ -1,699 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-
-import {
-  NotaryError,
-  NotaryProblemError,
-  NotaryTransportError,
-  RegistryNotaryClient,
-} from "../src/index.js";
-
-test("evaluate converts camelCase request fields and response fields", async () => {
-  const calls = [];
-  const controller = new AbortController();
-  const request = {
-    target: {
-      type: "Person",
-      identifiers: [{ scheme: "NATIONAL_ID", value: "subj-0000001" }],
-    },
-    claims: [{ id: "date-of-birth", version: "2026-05-29" }],
-    signal: controller.signal,
-  };
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    bearerToken: "test-token",
-    defaultPurpose: "benefits_eligibility",
-    fetch: async (url, init) => {
-      calls.push({ url, init });
-      return jsonResponse({
-        evaluation_id: "eval-1",
-        results: [{ claim_id: "date-of-birth", issued_at: "2026-05-29T00:00:00Z" }],
-      });
-    },
-  });
-
-  const result = await client.evaluate(request);
-
-  assert.deepEqual(result, {
-    evaluationId: "eval-1",
-    results: [{ claimId: "date-of-birth", issuedAt: "2026-05-29T00:00:00Z" }],
-  });
-  assert.equal(calls.length, 1);
-  assert.equal(String(calls[0].url), "https://notary.example/v1/evaluations");
-  assert.equal(calls[0].init.method, "POST");
-  assert.equal(calls[0].init.signal, controller.signal);
-  assert.deepEqual(JSON.parse(calls[0].init.body), {
-    target: {
-      type: "Person",
-      identifiers: [{ scheme: "NATIONAL_ID", value: "subj-0000001" }],
-    },
-    claims: [{ id: "date-of-birth", version: "2026-05-29" }],
-  });
-  assert.equal(calls[0].init.headers.get("accept"), "application/vnd.registry-notary.claim-result+json");
-  assert.equal(calls[0].init.headers.get("authorization"), "Bearer test-token");
-  assert.equal(calls[0].init.headers.get("data-purpose"), "benefits_eligibility");
-  assert.equal(request.target.identifiers[0].scheme, "NATIONAL_ID");
-});
-
-test("evaluateRequest preserves snake_case request and response shapes", async () => {
-  const calls = [];
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    apiKey: "key-1",
-    fetch: async (url, init) => {
-      calls.push({ url, init });
-      return jsonResponse({
-        evaluation_id: "eval-raw",
-        results: [{ claim_id: "date-of-birth" }],
-      });
-    },
-  });
-
-  const result = await client.evaluateRequest(
-    {
-      target: {
-        type: "Person",
-        identifiers: [{ scheme: "NATIONAL_ID", value: "subj-0000001" }],
-      },
-      claims: ["date-of-birth"],
-      purpose: "benefits_eligibility",
-    },
-    { purpose: "benefits_eligibility", requestId: "req-1" },
-  );
-
-  assert.deepEqual(result, {
-    evaluation_id: "eval-raw",
-    results: [{ claim_id: "date-of-birth" }],
-  });
-  assert.deepEqual(JSON.parse(calls[0].init.body), {
-    target: {
-      type: "Person",
-      identifiers: [{ scheme: "NATIONAL_ID", value: "subj-0000001" }],
-    },
-    claims: ["date-of-birth"],
-    purpose: "benefits_eligibility",
-  });
-  assert.equal(calls[0].init.headers.get("x-api-key"), "key-1");
-  assert.equal(calls[0].init.headers.get("x-request-id"), "req-1");
-});
-
-test("evaluateRequest rejects idempotency keys on non-idempotent evaluate route", async () => {
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    fetch: async () => jsonResponse({ results: [] }),
-  });
-
-  await assert.rejects(
-    client.evaluateRequest(
-      { target: { type: "Person", id: "subj-0000001" }, claims: ["date-of-birth"] },
-      { idempotencyKey: "ignored-by-server" },
-    ),
-    (error) => error instanceof NotaryError && error.code === "unsupported_idempotency_key",
-  );
-});
-
-test("batchEvaluateRequest sends Idempotency-Key when supplied", async () => {
-  const calls = [];
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    fetch: async (url, init) => {
-      calls.push({ url, init });
-      return jsonResponse({ batch_id: "batch-1", status: "completed" });
-    },
-  });
-
-  const result = await client.batchEvaluateRequest(
-    {
-      items: [
-        {
-          target: {
-            type: "Person",
-            identifiers: [{ scheme: "NATIONAL_ID", value: "subj-1" }],
-          },
-        },
-      ],
-      claims: ["age"],
-    },
-    { idempotencyKey: "batch-key" },
-  );
-
-  assert.equal(result.batch_id, "batch-1");
-  assert.equal(String(calls[0].url), "https://notary.example/v1/batch-evaluations");
-  assert.equal(calls[0].init.headers.get("Idempotency-Key"), "batch-key");
-});
-
-test("batchEvaluate converts camelCase request and response fields", async () => {
-  const calls = [];
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    fetch: async (url, init) => {
-      calls.push({ url, init });
-      return jsonResponse({ batch_id: "batch-1", summary: { succeeded: 1, failed: 0 } });
-    },
-  });
-
-  const result = await client.batchEvaluate({
-    items: [
-      {
-        target: {
-          type: "Person",
-          identifiers: [{ scheme: "NATIONAL_ID", value: "subj-1" }],
-        },
-      },
-    ],
-    claims: ["age"],
-  });
-
-  assert.deepEqual(JSON.parse(calls[0].init.body).items, [
-    {
-      target: {
-        type: "Person",
-        identifiers: [{ scheme: "NATIONAL_ID", value: "subj-1" }],
-      },
-    },
-  ]);
-  assert.deepEqual(result, { batchId: "batch-1", summary: { succeeded: 1, failed: 0 } });
-});
-
-test("core helper methods cover claims, render, issue, and credential status", async () => {
-  const calls = [];
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    fetch: async (url, init) => {
-      calls.push({ url, init });
-      if (String(url).endsWith("/v1/claims")) return jsonResponse({ data: [{ id: "age" }] });
-      if (String(url).endsWith("/v1/claims/claim%20one")) return jsonResponse({ id: "claim one" });
-      if (String(url).endsWith("/v1/evaluations/eval-1/render")) return jsonResponse({ document: { ok: true } });
-      if (String(url).endsWith("/v1/credentials")) return jsonResponse({ credential_id: "cred-1" });
-      return jsonResponse({ credential_id: "cred-1", status: "valid" });
-    },
-  });
-
-  assert.deepEqual(await client.listClaims(), { data: [{ id: "age" }] });
-  assert.deepEqual(await client.getClaim("claim one"), { id: "claim one" });
-  assert.deepEqual(await client.renderRequest({ evaluation_id: "eval-1", format: "json" }), {
-    document: { ok: true },
-  });
-  assert.deepEqual(await client.issueCredentialRequest({ evaluation_id: "eval-1" }), {
-    credential_id: "cred-1",
-  });
-  assert.deepEqual(await client.credentialStatus("cred-1"), {
-    credential_id: "cred-1",
-    status: "valid",
-  });
-  assert.equal(calls[0].init.method, "GET");
-  assert.equal(calls[2].init.method, "POST");
-  assert.equal(String(calls[4].url), "https://notary.example/v1/credentials/cred-1/status");
-  assert.deepEqual(JSON.parse(calls[2].init.body), { format: "json" });
-});
-
-test("renderRequest rejects missing request object", async () => {
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    fetch: async () => jsonResponse({}),
-  });
-
-  await assert.rejects(
-    client.renderRequest(null),
-    (error) => error instanceof NotaryError && error.code === "request.invalid_type",
-  );
-});
-
-test("constructor rejects unsafe base configuration", () => {
-  assert.throws(
-    () => new RegistryNotaryClient({ baseUrl: "http://notary.example" }),
-    (error) => error instanceof NotaryError && error.code === "insecure_base_url",
-  );
-  assert.throws(
-    () => new RegistryNotaryClient({ baseUrl: "https://notary.example", bearerToken: "token", apiKey: "key" }),
-    (error) => error instanceof NotaryError && error.code === "multiple_auth_modes",
-  );
-});
-
-test("AbortSignal is passed to fetch and abort maps to NotaryTransportError", async () => {
-  const controller = new AbortController();
-  controller.abort();
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    fetch: async (_url, init) => {
-      assert.equal(init.signal, controller.signal);
-      throw new DOMException("The operation was aborted", "AbortError");
-    },
-  });
-
-  await assert.rejects(
-    client.evaluate({
-      target: { type: "Person", id: "subj-0000001" },
-      claims: ["date-of-birth"],
-      signal: controller.signal,
-    }),
-    (error) =>
-      error instanceof NotaryTransportError &&
-      error.kind === "abort" &&
-      error.code === "aborted" &&
-      error.retryable === false,
-  );
-});
-
-test("Problem Details errors are mapped and detail is redacted by default", async () => {
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    fetch: async () =>
-      jsonResponse(
-        {
-          type: "https://id.registrystack.org/problems/registry-notary/target/not-found",
-          title: "Target not found",
-          status: 404,
-          detail: "secret target subj-0000001 was not found",
-          code: "target.not_found",
-        },
-        {
-          status: 404,
-          statusText: "Not Found",
-          headers: { "content-type": "application/problem+json", "x-request-id": "req-123" },
-        },
-      ),
-  });
-
-  await assert.rejects(
-    client.evaluateRequest({ target: { type: "Person", id: "subj-0000001" }, claims: ["date-of-birth"] }),
-    (error) => {
-      assert.ok(error instanceof NotaryProblemError);
-      assert.equal(error.status, 404);
-      assert.equal(error.code, "target.not_found");
-      assert.equal(error.title, "Target not found");
-      assert.equal(error.requestId, "req-123");
-      assert.equal(error.problemType, "https://id.registrystack.org/problems/registry-notary/target/not-found");
-      assert.equal(error.detail, undefined);
-      assert.equal(error.message.includes("secret target"), false);
-      assert.deepEqual(error.toJSON(), {
-        kind: "problem",
-        status: 404,
-        code: "target.not_found",
-        title: "Target not found",
-        retryable: false,
-        request_id: "req-123",
-      });
-      return true;
-    },
-  );
-});
-
-test("decode and oversized response errors are redacted", async () => {
-  const decodeClient = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    fetch: async () =>
-      new Response("not-json-with-subj-secret", {
-        status: 200,
-        headers: { "x-request-id": "req-decode" },
-      }),
-  });
-
-  await assert.rejects(decodeClient.listClaims(), (error) => {
-    assert.ok(error instanceof NotaryProblemError);
-    assert.equal(error.kind, "decode");
-    assert.equal(error.requestId, "req-decode");
-    assert.equal(error.message.includes("subj-secret"), false);
-    return true;
-  });
-
-  const oversizedClient = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    fetch: async () =>
-      new Response("x".repeat(8 * 1024 * 1024 + 1), {
-        status: 200,
-        headers: { "x-request-id": "req-large" },
-      }),
-  });
-
-  await assert.rejects(oversizedClient.listClaims(), (error) => {
-    assert.ok(error instanceof NotaryProblemError);
-    assert.equal(error.kind, "body_too_large");
-    assert.equal(error.code, "body.too_large");
-    assert.equal(error.requestId, "req-large");
-    return true;
-  });
-
-  let textRead = false;
-  const fallbackOversizedClient = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    fetch: async () => ({
-      ok: true,
-      status: 200,
-      headers: new Headers({
-        "content-length": String(8 * 1024 * 1024 + 1),
-        "x-request-id": "req-large-header",
-      }),
-      body: null,
-      text: async () => {
-        textRead = true;
-        return "{}";
-      },
-    }),
-  });
-
-  await assert.rejects(fallbackOversizedClient.listClaims(), (error) => {
-    assert.ok(error instanceof NotaryProblemError);
-    assert.equal(error.kind, "body_too_large");
-    assert.equal(error.requestId, "req-large-header");
-    return true;
-  });
-  assert.equal(textRead, false);
-});
-
-test("purpose conflicts fail before sending", async () => {
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    defaultPurpose: "benefits_eligibility",
-    fetch: async () => {
-      throw new Error("fetch should not be called");
-    },
-  });
-
-  await assert.rejects(
-    client.evaluateRequest({
-      target: { type: "Person", id: "subj-0000001" },
-      claims: ["date-of-birth"],
-      purpose: "another_purpose",
-    }),
-    (error) => error instanceof NotaryError && error.code === "purpose_conflict",
-  );
-});
-
-test("retry policy retries GET and idempotent batch only", async () => {
-  const listCalls = [];
-  const listClient = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    retryPolicy: {
-      maxAttempts: 2,
-      baseDelayMs: 0,
-      maxDelayMs: 0,
-      retryUnavailable: true,
-    },
-    fetch: async (url, init) => {
-      listCalls.push({ url, init });
-      if (listCalls.length === 1) {
-        return jsonResponse({ code: "busy", title: "Busy" }, { status: 503, headers: { "retry-after": "0" } });
-      }
-      return jsonResponse({ data: [{ id: "age" }] });
-    },
-  });
-
-  assert.deepEqual(await listClient.listClaims(), { data: [{ id: "age" }] });
-  assert.equal(listCalls.length, 2);
-
-  const batchCalls = [];
-  const batchClient = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    retryPolicy: {
-      maxAttempts: 2,
-      baseDelayMs: 0,
-      maxDelayMs: 0,
-      retryUnavailable: true,
-    },
-    fetch: async (url, init) => {
-      batchCalls.push({ url, init });
-      if (batchCalls.length === 1) {
-        return jsonResponse({ code: "busy", title: "Busy" }, { status: 503 });
-      }
-      return jsonResponse({ batch_id: "batch-1" });
-    },
-  });
-
-  assert.deepEqual(
-    await batchClient.batchEvaluateRequest(
-      { items: [{ target: { type: "Person", id: "subj-1" } }], claims: ["age"] },
-      { idempotencyKey: "batch-key" },
-    ),
-    { batch_id: "batch-1" },
-  );
-  assert.equal(batchCalls.length, 2);
-  assert.equal(batchCalls[0].init.headers.get("Idempotency-Key"), "batch-key");
-
-  const evaluateCalls = [];
-  const evaluateClient = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    retryPolicy: {
-      maxAttempts: 2,
-      baseDelayMs: 0,
-      maxDelayMs: 0,
-      retryUnavailable: true,
-    },
-    fetch: async () => {
-      evaluateCalls.push({});
-      return jsonResponse({ code: "busy", title: "Busy" }, { status: 503 });
-    },
-  });
-
-  await assert.rejects(
-    evaluateClient.evaluateRequest({ target: { type: "Person", id: "subj-1" }, claims: ["age"] }),
-    (error) => error instanceof NotaryProblemError && error.status === 503,
-  );
-  assert.equal(evaluateCalls.length, 1);
-});
-
-test("HTTP-date Retry-After uses server Date header", async () => {
-  const originalNow = Date.now;
-  Date.now = () => Date.parse("Wed, 31 Dec 2098 00:00:00 GMT");
-  try {
-    const calls = [];
-    const client = new RegistryNotaryClient({
-      baseUrl: "https://notary.example",
-      retryPolicy: {
-        maxAttempts: 2,
-        baseDelayMs: 1000,
-        maxDelayMs: 1000,
-        retryUnavailable: true,
-      },
-      fetch: async () => {
-        calls.push({});
-        if (calls.length === 1) {
-          return jsonResponse(
-            { code: "busy", title: "Busy" },
-            {
-              status: 503,
-              headers: {
-                date: "Wed, 31 Dec 2099 00:00:00 GMT",
-                "retry-after": "Wed, 31 Dec 2099 00:00:00 GMT",
-              },
-            },
-          );
-        }
-        return jsonResponse({ data: [{ id: "age" }] });
-      },
-    });
-
-    const started = performance.now();
-    assert.deepEqual(await client.listClaims(), { data: [{ id: "age" }] });
-
-    assert.equal(calls.length, 2);
-    assert.equal(performance.now() - started < 100, true);
-  } finally {
-    Date.now = originalNow;
-  }
-});
-
-test("retry sleep removes abort listener after timeout", async () => {
-  const calls = [];
-  let addedListener;
-  let removedListener;
-  const signal = {
-    aborted: false,
-    addEventListener: (_event, listener) => {
-      addedListener = listener;
-    },
-    removeEventListener: (_event, listener) => {
-      removedListener = listener;
-    },
-  };
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    retryPolicy: {
-      maxAttempts: 2,
-      baseDelayMs: 50,
-      maxDelayMs: 1,
-      retryUnavailable: true,
-    },
-    fetch: async () => {
-      calls.push({});
-      if (calls.length === 1) {
-        return jsonResponse({ code: "busy", title: "Busy" }, { status: 503, headers: { "retry-after": "1" } });
-      }
-      return jsonResponse({ data: [{ id: "age" }] });
-    },
-  });
-
-  assert.deepEqual(await client.listClaims({ signal }), { data: [{ id: "age" }] });
-  assert.equal(calls.length, 2);
-  assert.equal(typeof addedListener, "function");
-  assert.equal(removedListener, addedListener);
-});
-
-test("JWKS helpers cache, refresh, and force refresh on unknown kid", async () => {
-  const calls = [];
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    fetch: async (url, init) => {
-      calls.push({ url, init });
-      if (calls.length === 1) return jsonResponse({ keys: [{ kid: "key-1", kty: "EC" }] });
-      if (calls.length === 2) return jsonResponse({ keys: [{ kid: "key-2", kty: "EC" }] });
-      return jsonResponse({ keys: [{ kid: "key-3", kty: "EC" }] });
-    },
-  });
-
-  assert.deepEqual(await client.issuerJwks(), { keys: [{ kid: "key-1", kty: "EC" }] });
-  assert.deepEqual(await client.issuerJwks(), { keys: [{ kid: "key-1", kty: "EC" }] });
-  assert.equal(calls.length, 1);
-  assert.deepEqual(await client.getJwk("key-2"), { kid: "key-2", kty: "EC" });
-  assert.equal(calls.length, 2);
-  assert.deepEqual(await client.refreshJwks(), { keys: [{ kid: "key-3", kty: "EC" }] });
-  assert.equal(String(calls[0].url), "https://notary.example/.well-known/evidence/jwks.json");
-});
-
-test("OID4VCI and federation helpers use route-specific wire shapes", async () => {
-  const calls = [];
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    fetch: async (url, init) => {
-      calls.push({ url, init });
-      if (String(url).endsWith("/.well-known/openid-credential-issuer")) {
-        return jsonResponse({ credential_issuer: "https://issuer.example" });
-      }
-      if (String(url).endsWith("/oid4vci/credential")) {
-        return jsonResponse({ format: "dc+sd-jwt", credential: "credential-secret" });
-      }
-      return new Response("response.jws.compact", {
-        status: 200,
-        headers: { "content-type": "application/jwt" },
-      });
-    },
-  });
-
-  assert.deepEqual(await client.oid4vciIssuerMetadata(), { credential_issuer: "https://issuer.example" });
-  assert.deepEqual(await client.oid4vciCredential({ proof: { jwt: "holder-proof-secret" } }), {
-    format: "dc+sd-jwt",
-    credential: "credential-secret",
-  });
-  assert.equal(await client.federationEvaluateJws("request.jws.compact"), "response.jws.compact");
-
-  assert.equal(String(calls[1].url), "https://notary.example/oid4vci/credential");
-  assert.deepEqual(JSON.parse(calls[1].init.body), { proof: { jwt: "holder-proof-secret" } });
-  assert.equal(calls[2].init.body, "request.jws.compact");
-  assert.equal(calls[2].init.headers.get("content-type"), "application/jwt");
-  assert.equal(calls[2].init.headers.get("accept"), "application/jwt");
-});
-
-test("OID4VCI errors redact descriptions and credential material", async () => {
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    fetch: async () =>
-      jsonResponse(
-        {
-          error: "invalid_proof",
-          error_description: "holder proof includes c_nonce nonce-secret",
-        },
-        {
-          status: 400,
-          headers: { "content-type": "application/json", "x-request-id": "req-oid" },
-        },
-      ),
-  });
-
-  await assert.rejects(client.oid4vciCredential({ proof: { jwt: "holder-proof-secret" } }), (error) => {
-    assert.ok(error instanceof NotaryProblemError);
-    assert.equal(error.kind, "oid4vci");
-    assert.equal(error.code, "invalid_proof");
-    assert.equal(error.requestId, "req-oid");
-    assert.equal(error.message.includes("nonce-secret"), false);
-    assert.equal(JSON.stringify(error).includes("holder-proof-secret"), false);
-    return true;
-  });
-});
-
-test("cross-origin redirects strip SDK auth headers", async () => {
-  const calls = [];
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    apiKey: "secret-api-key",
-    fetch: async (url, init) => {
-      calls.push({ url, init });
-      if (calls.length === 1) {
-        return new Response("", {
-          status: 302,
-          headers: { location: "https://redirect.example/v1/claims" },
-        });
-      }
-      return jsonResponse({ data: [] });
-    },
-  });
-
-  await client.listClaims();
-
-  assert.equal(String(calls[0].url), "https://notary.example/v1/claims");
-  assert.equal(String(calls[1].url), "https://redirect.example/v1/claims");
-  assert.equal(calls[0].init.redirect, "manual");
-  assert.equal(calls[0].init.headers.get("x-api-key"), "secret-api-key");
-  assert.equal(calls[1].init.headers.get("x-api-key"), null);
-  assert.equal(calls[1].init.headers.get("authorization"), null);
-});
-
-test("same-origin redirects preserve SDK auth headers", async () => {
-  const calls = [];
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    bearerToken: "secret-bearer",
-    fetch: async (url, init) => {
-      calls.push({ url, init });
-      if (calls.length === 1) {
-        return new Response("", {
-          status: 302,
-          headers: { location: "/v1/claims?redirected=true" },
-        });
-      }
-      return jsonResponse({ data: [] });
-    },
-  });
-
-  await client.listClaims();
-
-  assert.equal(String(calls[1].url), "https://notary.example/v1/claims?redirected=true");
-  assert.equal(calls[0].init.headers.get("authorization"), "Bearer secret-bearer");
-  assert.equal(calls[1].init.headers.get("authorization"), "Bearer secret-bearer");
-});
-
-test("POST redirects converted to GET drop body headers", async () => {
-  const calls = [];
-  const client = new RegistryNotaryClient({
-    baseUrl: "https://notary.example",
-    fetch: async (url, init) => {
-      calls.push({ url, init });
-      if (calls.length === 1) {
-        init.headers.set("content-length", "64");
-        return new Response("", {
-          status: 303,
-          headers: { location: "/v1/claims" },
-        });
-      }
-      return jsonResponse({ data: [] });
-    },
-  });
-
-  await client.evaluateRequest({ target: { type: "Person", id: "subj-0000001" }, claims: ["age"] });
-
-  assert.equal(calls[0].init.method, "POST");
-  assert.equal(calls[1].init.method, "GET");
-  assert.equal(calls[1].init.body, undefined);
-  assert.equal(calls[1].init.headers.get("content-type"), null);
-  assert.equal(calls[1].init.headers.get("content-length"), null);
-});
-
-function jsonResponse(body, init = {}) {
-  return new Response(JSON.stringify(body), {
-    status: init.status ?? 200,
-    statusText: init.statusText ?? "OK",
-    headers: {
-      "content-type": "application/json",
-      ...init.headers,
-    },
-  });
-}
diff --git a/products/notary/bindings/node/test/types.ts b/products/notary/bindings/node/test/types.ts
deleted file mode 100644
index bbfa38c56..000000000
--- a/products/notary/bindings/node/test/types.ts
+++ /dev/null
@@ -1,90 +0,0 @@
-import {
-  NotaryError,
-  NotaryProblemError,
-  NotaryTransportError,
-  RegistryNotaryClient,
-  RetryPolicy,
-} from "../src/index.js";
-
-const retryPolicy: Partial<RetryPolicy> = {
-  maxAttempts: 2,
-  retryUnavailable: true,
-};
-
-const client = new RegistryNotaryClient({
-  baseUrl: "https://notary.example",
-  bearerToken: "token",
-  defaultPurpose: "benefits_eligibility",
-  retryPolicy,
-});
-
-const highLevel: Promise<unknown> = client.evaluate({
-  target: {
-    type: "Person",
-    identifiers: [{ scheme: "NATIONAL_ID", value: "subj-0000001" }],
-  },
-  claims: [{ id: "date-of-birth", version: "2026-05-29" }],
-});
-
-const raw: Promise<unknown> = client.evaluateRequest(
-  {
-    target: {
-      type: "Person",
-      identifiers: [{ scheme: "NATIONAL_ID", value: "subj-0000001" }],
-    },
-    claims: ["date-of-birth"],
-  },
-  { purpose: "benefits_eligibility" },
-);
-
-const batch: Promise<unknown> = client.batchEvaluate(
-  {
-    items: [
-      {
-        target: {
-          type: "Person",
-          identifiers: [{ scheme: "NATIONAL_ID", value: "subj-0000001" }],
-        },
-      },
-    ],
-    claims: ["date-of-birth"],
-  },
-  { idempotencyKey: "batch-2026-05-29-001" },
-);
-
-const claims: Promise<unknown> = client.listClaims({ requestId: "req-1" });
-const claim: Promise<unknown> = client.getClaim("date-of-birth");
-const rendered: Promise<unknown> = client.renderRequest({ evaluation_id: "eval-1", format: "json" });
-const issued: Promise<unknown> = client.issueCredentialRequest({ evaluation_id: "eval-1" });
-const status: Promise<unknown> = client.credentialStatus("cred-1");
-const serviceDocument: Promise<unknown> = client.serviceDocument();
-const jwks: Promise<unknown> = client.issuerJwks();
-const refreshedJwks: Promise<unknown> = client.refreshJwks();
-const jwk: Promise<Record<string, unknown> | undefined> = client.getJwk("key-1");
-const oidMetadata: Promise<unknown> = client.oid4vciIssuerMetadata();
-const oidCredential: Promise<unknown> = client.oid4vciCredential({ proof: { jwt: "jwt" } });
-const federation: Promise<string> = client.federationEvaluateJws("request.jws.compact");
-
-const errors: NotaryError[] = [
-  new NotaryError("client-side failure"),
-  new NotaryTransportError(),
-  new NotaryProblemError({ status: 404, code: "target.not_found", title: "Target not found" }),
-  new NotaryProblemError({ status: 400, code: "deployment.custom_problem", title: "Custom server problem" }),
-];
-
-void highLevel;
-void raw;
-void batch;
-void claims;
-void claim;
-void rendered;
-void issued;
-void status;
-void serviceDocument;
-void jwks;
-void refreshedJwks;
-void jwk;
-void oidMetadata;
-void oidCredential;
-void federation;
-void errors;
diff --git a/products/notary/bindings/node/tsconfig.json b/products/notary/bindings/node/tsconfig.json
deleted file mode 100644
index 6eabd8ac8..000000000
--- a/products/notary/bindings/node/tsconfig.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "compilerOptions": {
-    "allowJs": true,
-    "checkJs": true,
-    "declaration": false,
-    "exactOptionalPropertyTypes": false,
-    "lib": ["ES2022", "DOM"],
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "noEmit": true,
-    "strict": true,
-    "target": "ES2022"
-  },
-  "include": ["src/**/*.js", "src/**/*.d.ts", "test/types.ts"]
-}
diff --git a/products/notary/bindings/python/pyproject.toml b/products/notary/bindings/python/pyproject.toml
deleted file mode 100644
index 4eb94c92e..000000000
--- a/products/notary/bindings/python/pyproject.toml
+++ /dev/null
@@ -1,17 +0,0 @@
-[build-system]
-requires = ["setuptools>=68"]
-build-backend = "setuptools.build_meta"
-
-[project]
-name = "registry-notary"
-version = "0.1.0"
-description = "Python client bindings for Registry Notary"
-requires-python = ">=3.10"
-license = { text = "Apache-2.0" }
-authors = [{ name = "Registry Notary contributors" }]
-
-[tool.setuptools]
-packages = ["registry_notary"]
-
-[tool.setuptools.package-data]
-registry_notary = ["py.typed"]
diff --git a/products/notary/bindings/python/registry_notary/__init__.py b/products/notary/bindings/python/registry_notary/__init__.py
deleted file mode 100644
index 440bdd23e..000000000
--- a/products/notary/bindings/python/registry_notary/__init__.py
+++ /dev/null
@@ -1,12 +0,0 @@
-"""Python client bindings for Registry Notary."""
-
-from .client import RegistryNotaryClient, RetryPolicy
-from .errors import NotaryError, NotaryProblemError, NotaryTransportError
-
-__all__ = [
-    "NotaryError",
-    "NotaryProblemError",
-    "NotaryTransportError",
-    "RegistryNotaryClient",
-    "RetryPolicy",
-]
diff --git a/products/notary/bindings/python/registry_notary/client.py b/products/notary/bindings/python/registry_notary/client.py
deleted file mode 100644
index f79f52847..000000000
--- a/products/notary/bindings/python/registry_notary/client.py
+++ /dev/null
@@ -1,897 +0,0 @@
-"""Dictionary-friendly Registry Notary client."""
-
-from __future__ import annotations
-
-import asyncio
-import datetime
-import email.utils
-import json
-import socket
-import time
-from collections.abc import Iterable, Mapping
-from dataclasses import dataclass
-from http.client import HTTPResponse
-from typing import Any
-from urllib.error import HTTPError, URLError
-from urllib.parse import quote, urlsplit
-from urllib.request import HTTPRedirectHandler, Request, build_opener
-
-from .errors import NotaryError, NotaryProblemError, NotaryTransportError
-
-CLAIM_RESULT_JSON = "application/vnd.registry-notary.claim-result+json"
-APPLICATION_JWT = "application/jwt"
-JSON = "application/json"
-MAX_RESPONSE_BYTES = 8 * 1024 * 1024
-JWKS_TTL_SECONDS = 10 * 60
-
-
-@dataclass(frozen=True)
-class _Response:
-    status: int
-    headers: Mapping[str, str]
-    body: bytes
-
-
-@dataclass(frozen=True)
-class RetryPolicy:
-    """Route-aware retry configuration.
-
-    Retries are applied to GET requests and batch evaluation requests that
-    include an Idempotency-Key. Non-deduplicated POST routes are never retried.
-    """
-
-    max_attempts: int = 1
-    base_delay: float = 0.05
-    max_delay: float = 1.0
-    retry_transport_errors: bool = False
-    retry_rate_limited: bool = False
-    retry_unavailable: bool = False
-
-
-class RegistryNotaryClient:
-    """Synchronous and asyncio-friendly Registry Notary HTTP client."""
-
-    def __init__(
-        self,
-        *,
-        base_url: str,
-        bearer_token: str | None = None,
-        api_key: str | None = None,
-        default_purpose: str | None = None,
-        timeout: float = 30.0,
-        user_agent: str | None = None,
-        retry_policy: RetryPolicy | Mapping[str, Any] | None = None,
-        transport: Any | None = None,
-        allow_insecure_internal_http: bool = False,
-    ) -> None:
-        parsed = urlsplit(base_url)
-        if parsed.scheme not in {"http", "https"} or not parsed.netloc:
-            raise NotaryError(kind="build", code="build.invalid_url", title="Invalid base URL")
-        if (
-            parsed.scheme == "http"
-            and not _is_loopback_host(parsed.hostname)
-            and not allow_insecure_internal_http
-        ):
-            raise NotaryError(
-                kind="build",
-                code="build.insecure_base_url",
-                title=(
-                    "Base URL must use https unless the host is loopback or "
-                    "allow_insecure_internal_http is enabled"
-                ),
-            )
-        if bearer_token and api_key:
-            raise NotaryError(
-                kind="build",
-                code="build.multiple_auth_modes",
-                title="Only one authentication mode can be configured",
-            )
-        self._base_url = base_url.rstrip("/")
-        self._bearer_token = bearer_token
-        self._api_key = api_key
-        self._default_purpose = default_purpose
-        self._timeout = timeout
-        self._user_agent = user_agent
-        self._retry_policy = _coerce_retry_policy(retry_policy)
-        self._transport = transport
-        self._jwks_cache: tuple[float, dict[str, Any]] | None = None
-
-    def __repr__(self) -> str:
-        return (
-            "RegistryNotaryClient("
-            f"base_url={self._base_url!r}, "
-            f"default_purpose={self._default_purpose!r}, "
-            f"timeout={self._timeout!r})"
-        )
-
-    def evaluate(
-        self,
-        *,
-        target_id: str,
-        identifier_scheme: str,
-        claims: Iterable[str | Mapping[str, Any]],
-        target_type: str = "Person",
-        purpose: str | None = None,
-        request_id: str | None = None,
-        traceparent: str | None = None,
-        accept: str | None = None,
-    ) -> dict[str, Any]:
-        """Evaluate claims for one identifier target using Pythonic argument names."""
-
-        request = {
-            "target": {
-                "type": target_type,
-                "identifiers": [{"scheme": identifier_scheme, "value": target_id}],
-            },
-            "claims": _claim_list(claims),
-        }
-        return self.evaluate_request(
-            request,
-            purpose=purpose,
-            request_id=request_id,
-            traceparent=traceparent,
-            accept=accept,
-        )
-
-    async def aevaluate(
-        self,
-        *,
-        target_id: str,
-        identifier_scheme: str,
-        claims: Iterable[str | Mapping[str, Any]],
-        target_type: str = "Person",
-        purpose: str | None = None,
-        request_id: str | None = None,
-        traceparent: str | None = None,
-        accept: str | None = None,
-    ) -> dict[str, Any]:
-        """Async counterpart to :meth:`evaluate`."""
-
-        request = {
-            "target": {
-                "type": target_type,
-                "identifiers": [{"scheme": identifier_scheme, "value": target_id}],
-            },
-            "claims": _claim_list(claims),
-        }
-        return await self.aevaluate_request(
-            request,
-            purpose=purpose,
-            request_id=request_id,
-            traceparent=traceparent,
-            accept=accept,
-        )
-
-    def evaluate_request(
-        self,
-        request: Mapping[str, Any],
-        *,
-        purpose: str | None = None,
-        request_id: str | None = None,
-        traceparent: str | None = None,
-        accept: str | None = None,
-    ) -> dict[str, Any]:
-        """Send canonical snake_case evaluate JSON without case conversion."""
-
-        effective_purpose = self._effective_purpose(request, purpose)
-        response = self._post_json(
-            "/v1/evaluations",
-            request,
-            purpose=effective_purpose,
-            request_id=request_id,
-            traceparent=traceparent,
-            accept=accept or CLAIM_RESULT_JSON,
-            retry_kind="post_no_retry",
-        )
-        return self._decode_json_response(response)
-
-    def batch_evaluate_request(
-        self,
-        request: Mapping[str, Any],
-        *,
-        purpose: str | None = None,
-        request_id: str | None = None,
-        traceparent: str | None = None,
-        idempotency_key: str | None = None,
-        accept: str | None = None,
-    ) -> dict[str, Any]:
-        """Send canonical snake_case batch evaluate JSON."""
-
-        effective_purpose = self._effective_purpose(request, purpose)
-        response = self._post_json(
-            "/v1/batch-evaluations",
-            request,
-            purpose=effective_purpose,
-            request_id=request_id,
-            traceparent=traceparent,
-            idempotency_key=idempotency_key,
-            accept=accept or CLAIM_RESULT_JSON,
-            retry_kind="post_batch",
-        )
-        return self._decode_json_response(response)
-
-    def render_request(
-        self,
-        request: Mapping[str, Any],
-        *,
-        request_id: str | None = None,
-        traceparent: str | None = None,
-        accept: str | None = None,
-    ) -> dict[str, Any]:
-        """Render evidence from canonical snake_case JSON.
-
-        ``evaluation_id`` is required in the request mapping and is used as the
-        route path parameter. It is not sent in the request body.
-        """
-
-        if not isinstance(request, Mapping):
-            raise NotaryError(
-                kind="client",
-                code="request.invalid_type",
-                title="request must be a mapping",
-            )
-        evaluation_id = request.get("evaluation_id")
-        if not isinstance(evaluation_id, str) or not evaluation_id:
-            raise NotaryError(
-                kind="client",
-                code="request.missing_evaluation_id",
-                title="render request requires evaluation_id",
-            )
-        body = dict(request)
-        body.pop("evaluation_id", None)
-        response = self._post_json(
-            f"/v1/evaluations/{quote(evaluation_id, safe='')}/render",
-            body,
-            purpose=None,
-            request_id=request_id,
-            traceparent=traceparent,
-            idempotency_key=None,
-            accept=accept or JSON,
-            retry_kind="post_no_retry",
-        )
-        return self._decode_json_response(response)
-
-    def issue_credential_request(
-        self,
-        request: Mapping[str, Any],
-        *,
-        request_id: str | None = None,
-        traceparent: str | None = None,
-        accept: str | None = None,
-    ) -> dict[str, Any]:
-        """Issue a credential from canonical snake_case JSON."""
-
-        response = self._post_json(
-            "/v1/credentials",
-            request,
-            purpose=None,
-            request_id=request_id,
-            traceparent=traceparent,
-            idempotency_key=None,
-            accept=accept or JSON,
-            retry_kind="post_no_retry",
-        )
-        return self._decode_json_response(response)
-
-    def list_claims(self, *, request_id: str | None = None) -> dict[str, Any]:
-        return self._decode_json_response(self._get("/v1/claims", request_id=request_id))
-
-    def get_claim(self, claim_id: str, *, request_id: str | None = None) -> dict[str, Any]:
-        return self._decode_json_response(
-            self._get(f"/v1/claims/{quote(claim_id, safe='')}", request_id=request_id)
-        )
-
-    def credential_status(
-        self,
-        credential_id: str,
-        *,
-        request_id: str | None = None,
-    ) -> dict[str, Any]:
-        return self._decode_json_response(
-            self._get(
-                f"/v1/credentials/{quote(credential_id, safe='')}/status",
-                request_id=request_id,
-            )
-        )
-
-    def service_document(self, *, request_id: str | None = None) -> dict[str, Any]:
-        return self._decode_json_response(
-            self._get("/.well-known/evidence-service", request_id=request_id)
-        )
-
-    def issuer_jwks(self, *, request_id: str | None = None) -> dict[str, Any]:
-        if request_id is None and self._jwks_cache is not None:
-            expires_at, body = self._jwks_cache
-            if expires_at > time.monotonic():
-                return body
-        return self.refresh_jwks(request_id=request_id)
-
-    def refresh_jwks(self, *, request_id: str | None = None) -> dict[str, Any]:
-        body = self.raw_issuer_jwks(request_id=request_id)
-        self._jwks_cache = (time.monotonic() + JWKS_TTL_SECONDS, body)
-        return body
-
-    def raw_issuer_jwks(self, *, request_id: str | None = None) -> dict[str, Any]:
-        return self._decode_json_response(
-            self._get("/.well-known/evidence/jwks.json", request_id=request_id)
-        )
-
-    def get_jwk(self, kid: str, *, request_id: str | None = None) -> dict[str, Any] | None:
-        jwks = self.issuer_jwks(request_id=request_id)
-        found = _find_jwk(jwks, kid)
-        if found is not None:
-            return found
-        return _find_jwk(self.refresh_jwks(request_id=request_id), kid)
-
-    def oid4vci_issuer_metadata(self, *, request_id: str | None = None) -> dict[str, Any]:
-        return self._decode_json_response(
-            self._get("/.well-known/openid-credential-issuer", request_id=request_id),
-            error_kind="oid4vci",
-        )
-
-    def oid4vci_credential(
-        self,
-        request: Mapping[str, Any],
-        *,
-        request_id: str | None = None,
-        traceparent: str | None = None,
-    ) -> dict[str, Any]:
-        response = self._post_json(
-            "/oid4vci/credential",
-            request,
-            purpose=None,
-            request_id=request_id,
-            traceparent=traceparent,
-            accept=JSON,
-            retry_kind="post_no_retry",
-        )
-        return self._decode_json_response(response, error_kind="oid4vci")
-
-    def federation_evaluate_jws(
-        self,
-        compact_jws: str,
-        *,
-        request_id: str | None = None,
-        traceparent: str | None = None,
-    ) -> str:
-        response = self._post_raw(
-            "/federation/v1/evaluations",
-            compact_jws.encode("utf-8"),
-            content_type=APPLICATION_JWT,
-            accept=APPLICATION_JWT,
-            request_id=request_id,
-            traceparent=traceparent,
-            retry_kind="post_no_retry",
-        )
-        return self._decode_text_response(response)
-
-    async def aevaluate_request(
-        self,
-        request: Mapping[str, Any],
-        *,
-        purpose: str | None = None,
-        request_id: str | None = None,
-        traceparent: str | None = None,
-        accept: str | None = None,
-    ) -> dict[str, Any]:
-        """Async counterpart to :meth:`evaluate_request`."""
-
-        return await asyncio.to_thread(
-            self.evaluate_request,
-            request,
-            purpose=purpose,
-            request_id=request_id,
-            traceparent=traceparent,
-            accept=accept,
-        )
-
-    async def abatch_evaluate_request(
-        self,
-        request: Mapping[str, Any],
-        *,
-        purpose: str | None = None,
-        request_id: str | None = None,
-        traceparent: str | None = None,
-        idempotency_key: str | None = None,
-        accept: str | None = None,
-    ) -> dict[str, Any]:
-        return await asyncio.to_thread(
-            self.batch_evaluate_request,
-            request,
-            purpose=purpose,
-            request_id=request_id,
-            traceparent=traceparent,
-            idempotency_key=idempotency_key,
-            accept=accept,
-        )
-
-    async def arender_request(
-        self,
-        request: Mapping[str, Any],
-        *,
-        request_id: str | None = None,
-        traceparent: str | None = None,
-        accept: str | None = None,
-    ) -> dict[str, Any]:
-        return await asyncio.to_thread(
-            self.render_request,
-            request,
-            request_id=request_id,
-            traceparent=traceparent,
-            accept=accept,
-        )
-
-    async def aissue_credential_request(
-        self,
-        request: Mapping[str, Any],
-        *,
-        request_id: str | None = None,
-        traceparent: str | None = None,
-        accept: str | None = None,
-    ) -> dict[str, Any]:
-        return await asyncio.to_thread(
-            self.issue_credential_request,
-            request,
-            request_id=request_id,
-            traceparent=traceparent,
-            accept=accept,
-        )
-
-    def _post_json(
-        self,
-        path: str,
-        body: Mapping[str, Any],
-        *,
-        purpose: str | None,
-        request_id: str | None,
-        traceparent: str | None,
-        accept: str = JSON,
-        idempotency_key: str | None = None,
-        retry_kind: str,
-    ) -> _Response:
-        payload = json.dumps(body, separators=(",", ":")).encode("utf-8")
-        headers = {
-            "Accept": accept,
-            "Content-Type": JSON,
-        }
-        self._add_common_headers(
-            headers,
-            purpose=purpose,
-            request_id=request_id,
-            traceparent=traceparent,
-        )
-        return self._send_with_retry(
-            retry_kind,
-            idempotency_key,
-            lambda: self._send_once("POST", path, headers, payload, idempotency_key),
-        )
-
-    def _post_raw(
-        self,
-        path: str,
-        body: bytes,
-        *,
-        content_type: str,
-        accept: str,
-        request_id: str | None,
-        traceparent: str | None,
-        retry_kind: str,
-    ) -> _Response:
-        headers = {
-            "Accept": accept,
-            "Content-Type": content_type,
-        }
-        self._add_common_headers(
-            headers,
-            purpose=None,
-            request_id=request_id,
-            traceparent=traceparent,
-        )
-
-        return self._send_with_retry(
-            retry_kind,
-            None,
-            lambda: self._send_once("POST", path, headers, body, None),
-        )
-
-    def _send_once(
-        self,
-        method: str,
-        path: str,
-        headers: Mapping[str, str],
-        body: bytes | None,
-        idempotency_key: str | None,
-    ) -> _Response:
-        headers = dict(headers)
-        if idempotency_key:
-            headers["Idempotency-Key"] = idempotency_key
-        try:
-            if self._transport is not None:
-                return self._transport.request(
-                    method,
-                    f"{self._base_url}{path}",
-                    headers=headers,
-                    body=body,
-                    timeout=self._timeout,
-                )
-            if method == "GET":
-                return _stdlib_get(f"{self._base_url}{path}", headers, self._timeout)
-            return _stdlib_post(f"{self._base_url}{path}", headers, body or b"", self._timeout)
-        except NotaryError:
-            raise
-        except (HTTPError, URLError, OSError, TimeoutError, socket.timeout) as exc:
-            raise NotaryTransportError(title="Transport error") from exc
-
-    def _get(self, path: str, *, request_id: str | None = None) -> _Response:
-        headers = {"Accept": JSON}
-        self._add_common_headers(
-            headers,
-            purpose=None,
-            request_id=request_id,
-            traceparent=None,
-        )
-
-        return self._send_with_retry(
-            "get",
-            None,
-            lambda: self._send_once("GET", path, headers, None, None),
-        )
-
-    def _add_common_headers(
-        self,
-        headers: dict[str, str],
-        *,
-        purpose: str | None,
-        request_id: str | None,
-        traceparent: str | None,
-    ) -> None:
-        if self._user_agent:
-            headers["User-Agent"] = self._user_agent
-        if self._bearer_token:
-            headers["Authorization"] = f"Bearer {self._bearer_token}"
-        if self._api_key:
-            headers["X-Api-Key"] = self._api_key
-        if purpose:
-            headers["data-purpose"] = purpose
-        if request_id:
-            headers["x-request-id"] = request_id
-        if traceparent:
-            headers["traceparent"] = traceparent
-
-    def _send_with_retry(
-        self,
-        retry_kind: str,
-        idempotency_key: str | None,
-        send_once: Any,
-    ) -> _Response:
-        attempts = _allowed_attempts(self._retry_policy, retry_kind, idempotency_key)
-        attempt = 0
-        while True:
-            attempt += 1
-            try:
-                response = send_once()
-                if response.status < 400:
-                    return response
-                error = _problem_error_from_response(
-                    response,
-                    _header(response.headers, "x-request-id"),
-                )
-                if attempt < attempts and _should_retry(self._retry_policy, error):
-                    time.sleep(_retry_delay(self._retry_policy, attempt, error.retry_after))
-                    continue
-                return response
-            except NotaryTransportError as exc:
-                if attempt < attempts and _should_retry(self._retry_policy, exc):
-                    time.sleep(_retry_delay(self._retry_policy, attempt, None))
-                    continue
-                raise
-
-    def _decode_json_response(
-        self,
-        response: _Response,
-        *,
-        error_kind: str = "problem",
-    ) -> dict[str, Any]:
-        request_id = _header(response.headers, "x-request-id")
-        if response.status >= 400:
-            raise _problem_error_from_response(response, request_id, error_kind=error_kind)
-        try:
-            decoded = json.loads(response.body.decode("utf-8"))
-        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-            raise NotaryProblemError(
-                kind="decode",
-                status=response.status,
-                code="decode.failed",
-                title="Failed to decode response body",
-                retryable=False,
-                request_id=request_id,
-            ) from exc
-        if not isinstance(decoded, dict):
-            raise NotaryProblemError(
-                kind="decode",
-                status=response.status,
-                code="decode.failed",
-                title="Failed to decode response body",
-                retryable=False,
-                request_id=request_id,
-            )
-        return decoded
-
-    def _decode_text_response(self, response: _Response) -> str:
-        request_id = _header(response.headers, "x-request-id")
-        if response.status >= 400:
-            raise _problem_error_from_response(response, request_id)
-        try:
-            return response.body.decode("utf-8")
-        except UnicodeDecodeError as exc:
-            raise NotaryProblemError(
-                kind="decode",
-                status=response.status,
-                code="decode.failed",
-                title="Failed to decode response body",
-                retryable=False,
-                request_id=request_id,
-            ) from exc
-
-    def _effective_purpose(self, request: Mapping[str, Any], purpose: str | None) -> str | None:
-        body_purpose = request.get("purpose")
-        if body_purpose is not None and not isinstance(body_purpose, str):
-            raise NotaryError(
-                kind="build",
-                code="request.invalid_purpose",
-                title="Request purpose must be a string",
-            )
-        effective = purpose if purpose is not None else self._default_purpose
-        if effective is None:
-            effective = body_purpose
-        if body_purpose is not None and effective != body_purpose:
-            raise NotaryError(
-                kind="build",
-                code="request.purpose_conflict",
-                title="Request purpose conflicts with request body purpose",
-            )
-        return effective
-
-
-def _stdlib_post(
-    url: str,
-    headers: Mapping[str, str],
-    body: bytes,
-    timeout: float,
-) -> _Response:
-    request = Request(url, data=body, headers=dict(headers), method="POST")
-    try:
-        with _REDIRECT_OPENER.open(request, timeout=timeout) as response:
-            return _response_from_stdlib(response)
-    except HTTPError as exc:
-        try:
-            return _Response(
-                status=exc.code,
-                headers=dict(exc.headers.items()),
-                body=_read_bounded(exc, exc.code, dict(exc.headers.items())),
-            )
-        finally:
-            exc.close()
-
-
-def _stdlib_get(
-    url: str,
-    headers: Mapping[str, str],
-    timeout: float,
-) -> _Response:
-    request = Request(url, headers=dict(headers), method="GET")
-    try:
-        with _REDIRECT_OPENER.open(request, timeout=timeout) as response:
-            return _response_from_stdlib(response)
-    except HTTPError as exc:
-        try:
-            return _Response(
-                status=exc.code,
-                headers=dict(exc.headers.items()),
-                body=_read_bounded(exc, exc.code, dict(exc.headers.items())),
-            )
-        finally:
-            exc.close()
-
-
-class _AuthStrippingRedirectHandler(HTTPRedirectHandler):
-    def redirect_request(
-        self,
-        req: Request,
-        fp: Any,
-        code: int,
-        msg: str,
-        headers: Any,
-        newurl: str,
-    ) -> Request | None:
-        redirected = super().redirect_request(req, fp, code, msg, headers, newurl)
-        if redirected is not None and _url_origin(req.full_url) != _url_origin(
-            redirected.full_url
-        ):
-            _remove_request_header(redirected, "authorization")
-            _remove_request_header(redirected, "x-api-key")
-        return redirected
-
-
-def _url_origin(url: str) -> tuple[str, str]:
-    parsed = urlsplit(url)
-    return (parsed.scheme.lower(), parsed.netloc.lower())
-
-
-def _remove_request_header(request: Request, name: str) -> None:
-    normalized = name.lower()
-    for header_map in (request.headers, request.unredirected_hdrs):
-        for key in list(header_map):
-            if key.lower() == normalized:
-                del header_map[key]
-
-
-_REDIRECT_OPENER = build_opener(_AuthStrippingRedirectHandler)
-
-
-def _response_from_stdlib(response: HTTPResponse) -> _Response:
-    headers = dict(response.headers.items())
-    return _Response(
-        status=int(response.status),
-        headers=headers,
-        body=_read_bounded(response, int(response.status), headers),
-    )
-
-
-def _read_bounded(
-    response: HTTPResponse | HTTPError,
-    status: int,
-    headers: Mapping[str, str],
-) -> bytes:
-    body = response.read(MAX_RESPONSE_BYTES + 1)
-    if len(body) > MAX_RESPONSE_BYTES:
-        raise NotaryProblemError(
-            kind="body_too_large",
-            status=status,
-            code="body.too_large",
-            title="Response body exceeded configured size limit",
-            retryable=False,
-            request_id=_header(headers, "x-request-id"),
-        )
-    return body
-
-
-def _problem_error_from_response(
-    response: _Response,
-    request_id: str | None,
-    *,
-    error_kind: str = "problem",
-) -> NotaryProblemError:
-    problem: dict[str, Any] = {}
-    try:
-        decoded = json.loads(response.body.decode("utf-8"))
-        if isinstance(decoded, dict):
-            problem = decoded
-    except (UnicodeDecodeError, json.JSONDecodeError):
-        # Fall back to status-derived problem fields when the server body is not JSON.
-        pass
-
-    if error_kind == "oid4vci":
-        kind = "oid4vci"
-        code = _optional_str(problem.get("error")) or f"http.{response.status}"
-        title = "OID4VCI request failed"
-    else:
-        kind = str(problem.get("kind") or "problem")
-        code = _optional_str(problem.get("code")) or f"http.{response.status}"
-        title = _optional_str(problem.get("title")) or "Registry Notary problem"
-    retryable = (
-        bool(problem.get("retryable"))
-        if "retryable" in problem
-        else response.status in {429, 503}
-    )
-    return NotaryProblemError(
-        kind=kind,
-        status=response.status,
-        code=code,
-        title=title,
-        retryable=retryable,
-        request_id=request_id,
-        retry_after=_parse_retry_after(response.headers),
-    )
-
-
-def _header(headers: Mapping[str, str], name: str) -> str | None:
-    lowered = name.lower()
-    for key, value in headers.items():
-        if key.lower() == lowered:
-            return value
-    return None
-
-
-def _optional_str(value: Any) -> str | None:
-    return value if isinstance(value, str) and value else None
-
-
-def _is_loopback_host(hostname: str | None) -> bool:
-    return hostname in {"localhost", "127.0.0.1", "::1"}
-
-
-def _coerce_retry_policy(policy: RetryPolicy | Mapping[str, Any] | None) -> RetryPolicy:
-    if policy is None:
-        return RetryPolicy()
-    if isinstance(policy, RetryPolicy):
-        return policy
-    return RetryPolicy(**dict(policy))
-
-
-def _claim_list(claims: Iterable[str | Mapping[str, Any]]) -> list[str | Mapping[str, Any]]:
-    if isinstance(claims, str) or isinstance(claims, Mapping):
-        raise NotaryError(
-            kind="client",
-            code="request.invalid_claims",
-            title="claims must be an iterable of claim strings or claim reference mappings",
-        )
-    return list(claims)
-
-
-def _allowed_attempts(policy: RetryPolicy, retry_kind: str, idempotency_key: str | None) -> int:
-    if retry_kind == "get":
-        return max(1, policy.max_attempts)
-    if retry_kind == "post_batch" and idempotency_key:
-        return max(1, policy.max_attempts)
-    return 1
-
-
-def _should_retry(policy: RetryPolicy, error: NotaryError) -> bool:
-    if isinstance(error, NotaryTransportError):
-        return policy.retry_transport_errors
-    if isinstance(error, NotaryProblemError):
-        return (
-            error.status == 429
-            and policy.retry_rate_limited
-            or error.status == 503
-            and policy.retry_unavailable
-        )
-    return False
-
-
-def _retry_delay(policy: RetryPolicy, attempt: int, retry_after: float | None) -> float:
-    if isinstance(retry_after, (int, float)):
-        return min(float(retry_after), policy.max_delay)
-    delay = policy.base_delay * (2 ** max(0, attempt - 1))
-    return min(delay, policy.max_delay)
-
-
-def _parse_retry_after(headers: Mapping[str, str]) -> float | None:
-    value = _header(headers, "retry-after")
-    if value is None:
-        return None
-    stripped = value.strip()
-    if stripped.isdigit():
-        return float(stripped)
-    try:
-        parsed = email.utils.parsedate_to_datetime(stripped)
-    except (TypeError, ValueError):
-        return None
-    if parsed is None:
-        return None
-
-    ref_value = _header(headers, "date")
-    ref_parsed = None
-    if ref_value:
-        try:
-            ref_parsed = email.utils.parsedate_to_datetime(ref_value.strip())
-        except (TypeError, ValueError):
-            ref_parsed = None
-
-    ref_dt = ref_parsed or datetime.datetime.now(datetime.timezone.utc)
-    if parsed.tzinfo is None:
-        parsed = parsed.replace(tzinfo=datetime.timezone.utc)
-    if ref_dt.tzinfo is None:
-        ref_dt = ref_dt.replace(tzinfo=datetime.timezone.utc)
-    return max(0.0, (parsed - ref_dt).total_seconds())
-
-
-def _find_jwk(jwks: Mapping[str, Any], kid: str) -> dict[str, Any] | None:
-    keys = jwks.get("keys")
-    if not isinstance(keys, list):
-        return None
-    for key in keys:
-        if isinstance(key, dict) and key.get("kid") == kid:
-            return key
-    return None
diff --git a/products/notary/bindings/python/registry_notary/errors.py b/products/notary/bindings/python/registry_notary/errors.py
deleted file mode 100644
index 06a9b83ec..000000000
--- a/products/notary/bindings/python/registry_notary/errors.py
+++ /dev/null
@@ -1,53 +0,0 @@
-"""Registry Notary Python exception hierarchy."""
-
-from __future__ import annotations
-
-
-class NotaryError(Exception):
-    """Base class for all Registry Notary client exceptions."""
-
-    def __init__(
-        self,
-        *,
-        kind: str,
-        title: str,
-        status: int | None = None,
-        code: str | None = None,
-        retryable: bool = False,
-        request_id: str | None = None,
-        retry_after: float | str | None = None,
-    ) -> None:
-        super().__init__(title)
-        self.kind = kind
-        self.status = status
-        self.code = code
-        self.title = title
-        self.retryable = retryable
-        self.request_id = request_id
-        self.retry_after = retry_after
-
-    def __str__(self) -> str:
-        parts = []
-        if self.code:
-            parts.append(f"code={self.code}")
-        if self.status is not None:
-            parts.append(f"status={self.status}")
-        if self.request_id:
-            parts.append(f"request_id={self.request_id}")
-        return f"{self.title} ({', '.join(parts)})" if parts else self.title
-
-
-class NotaryTransportError(NotaryError):
-    """Raised when the client cannot complete the HTTP exchange."""
-
-    def __init__(self, *, title: str = "Transport error") -> None:
-        super().__init__(
-            kind="transport",
-            title=title,
-            code="transport.failed",
-            retryable=True,
-        )
-
-
-class NotaryProblemError(NotaryError):
-    """Raised for safe Registry Notary problem envelopes and decode failures."""
diff --git a/products/notary/bindings/python/registry_notary/py.typed b/products/notary/bindings/python/registry_notary/py.typed
deleted file mode 100644
index 8b1378917..000000000
--- a/products/notary/bindings/python/registry_notary/py.typed
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/products/notary/bindings/python/tests/test_client.py b/products/notary/bindings/python/tests/test_client.py
deleted file mode 100644
index 3809cb854..000000000
--- a/products/notary/bindings/python/tests/test_client.py
+++ /dev/null
@@ -1,618 +0,0 @@
-from __future__ import annotations
-
-import asyncio
-import json
-from pathlib import Path
-import sys
-import threading
-import unittest
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from typing import Any
-
-sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
-
-from registry_notary import RegistryNotaryClient, RetryPolicy
-from registry_notary.client import _parse_retry_after
-from registry_notary.errors import NotaryError, NotaryProblemError
-
-
-class _Recorder:
-    requests: list[dict[str, Any]]
-
-    def __init__(
-        self,
-        status: int = 200,
-        body: dict[str, Any] | None = None,
-        raw_body: bytes | None = None,
-        responses: list[tuple[int, dict[str, Any] | bytes, dict[str, str] | None]] | None = None,
-    ) -> None:
-        self.status = status
-        self.body = (
-            body if body is not None else {"results": [{"claim_id": "age", "value": True}]}
-        )
-        self.raw_body = raw_body
-        self.responses = responses or []
-        self.requests = []
-
-    def response(self) -> tuple[int, bytes, dict[str, str]]:
-        if self.responses:
-            status, body, headers = self.responses.pop(0)
-            payload = body if isinstance(body, bytes) else json.dumps(body).encode("utf-8")
-            return status, payload, headers or {}
-        payload = self.raw_body or json.dumps(self.body).encode("utf-8")
-        return self.status, payload, {}
-
-
-class _Handler(BaseHTTPRequestHandler):
-    recorder: _Recorder
-
-    def do_POST(self) -> None:
-        length = int(self.headers.get("content-length", "0"))
-        raw_body = self.rfile.read(length)
-        try:
-            body = json.loads(raw_body.decode("utf-8"))
-        except (UnicodeDecodeError, json.JSONDecodeError):
-            body = raw_body.decode("utf-8", errors="replace")
-        self.recorder.requests.append(
-            {
-                "path": self.path,
-                "headers": dict(self.headers.items()),
-                "body": body,
-            }
-        )
-        status, payload, extra_headers = self.recorder.response()
-        self.send_response(status)
-        self.send_header("content-type", "application/json")
-        self.send_header("x-request-id", "req-test-1")
-        for key, value in extra_headers.items():
-            self.send_header(key, value)
-        self.send_header("content-length", str(len(payload)))
-        self.end_headers()
-        self.wfile.write(payload)
-
-    def do_GET(self) -> None:
-        self.recorder.requests.append(
-            {
-                "path": self.path,
-                "headers": dict(self.headers.items()),
-                "body": None,
-            }
-        )
-        status, payload, extra_headers = self.recorder.response()
-        self.send_response(status)
-        self.send_header("content-type", "application/json")
-        self.send_header("x-request-id", "req-test-1")
-        for key, value in extra_headers.items():
-            self.send_header(key, value)
-        self.send_header("content-length", str(len(payload)))
-        self.end_headers()
-        self.wfile.write(payload)
-
-    def log_message(self, _format: str, *args: object) -> None:
-        return
-
-
-class Server:
-    def __init__(self, recorder: _Recorder) -> None:
-        handler = type("RecorderHandler", (_Handler,), {"recorder": recorder})
-        self.server = ThreadingHTTPServer(("127.0.0.1", 0), handler)
-        self.thread = threading.Thread(target=self.server.serve_forever)
-        self.thread.daemon = True
-
-    def __enter__(self) -> str:
-        self.thread.start()
-        host, port = self.server.server_address
-        return f"http://{host}:{port}"
-
-    def __exit__(self, *_exc: object) -> None:
-        self.server.shutdown()
-        self.server.server_close()
-        self.thread.join(timeout=2)
-
-
-class RegistryNotaryClientTests(unittest.TestCase):
-    def test_constructor_rejects_multiple_auth_modes_and_cleartext_non_loopback(self) -> None:
-        with self.assertRaises(NotaryError) as multiple:
-            RegistryNotaryClient(
-                base_url="https://notary.example",
-                bearer_token="token",
-                api_key="key",
-            )
-        self.assertEqual(multiple.exception.code, "build.multiple_auth_modes")
-
-        with self.assertRaises(NotaryError) as cleartext:
-            RegistryNotaryClient(base_url="http://notary.example")
-        self.assertEqual(cleartext.exception.code, "build.insecure_base_url")
-
-        client = RegistryNotaryClient(
-            base_url="http://registry-notary:8080",
-            allow_insecure_internal_http=True,
-        )
-        self.assertIn("http://registry-notary:8080", repr(client))
-
-    def test_high_level_evaluate_uses_target_args_and_wire_snake_case(self) -> None:
-        recorder = _Recorder()
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url, default_purpose="benefits")
-            result = client.evaluate(target_id="subj-1", identifier_scheme="NATIONAL_ID", claims=["age"])
-
-        self.assertEqual(result["results"][0]["claim_id"], "age")
-        self.assertEqual(recorder.requests[0]["path"], "/v1/evaluations")
-        self.assertEqual(
-            recorder.requests[0]["body"],
-            {
-                "target": {
-                    "type": "Person",
-                    "identifiers": [{"scheme": "NATIONAL_ID", "value": "subj-1"}],
-                },
-                "claims": ["age"],
-            },
-        )
-        self.assertNotIn("idType", json.dumps(recorder.requests[0]["body"]))
-        self.assertEqual(
-            recorder.requests[0]["headers"]["Accept"],
-            "application/vnd.registry-notary.claim-result+json",
-        )
-        self.assertEqual(recorder.requests[0]["headers"]["Data-Purpose"], "benefits")
-
-    def test_raw_evaluate_request_passes_snake_case_through(self) -> None:
-        recorder = _Recorder()
-        raw_request = {
-            "target": {"type": "Person", "identifiers": [{"scheme": "NATIONAL_ID", "value": "subj-2"}]},
-            "claims": ["age"],
-            "purpose": "eligibility",
-        }
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url)
-            client.evaluate_request(raw_request)
-
-        self.assertEqual(recorder.requests[0]["body"], raw_request)
-        self.assertEqual(recorder.requests[0]["headers"]["Data-Purpose"], "eligibility")
-
-    def test_high_level_evaluate_rejects_single_claim_string_or_mapping(self) -> None:
-        client = RegistryNotaryClient(base_url="https://notary.example")
-
-        with self.assertRaises(NotaryError) as string_error:
-            client.evaluate(
-                target_id="subj-1",
-                identifier_scheme="NATIONAL_ID",
-                claims="age",  # type: ignore[arg-type]
-            )
-        self.assertEqual(string_error.exception.code, "request.invalid_claims")
-
-        with self.assertRaises(NotaryError) as mapping_error:
-            client.evaluate(
-                target_id="subj-1",
-                identifier_scheme="NATIONAL_ID",
-                claims={"id": "age", "version": "2026-05"},  # type: ignore[arg-type]
-            )
-        self.assertEqual(mapping_error.exception.code, "request.invalid_claims")
-
-    def test_async_evaluate_returns_response(self) -> None:
-        recorder = _Recorder()
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url)
-            result = asyncio.run(
-                client.aevaluate(target_id="subj-3", identifier_scheme="NATIONAL_ID", claims=["age"])
-            )
-
-        self.assertEqual(result["results"][0]["value"], True)
-        self.assertEqual(
-            recorder.requests[0]["body"]["target"]["identifiers"][0]["scheme"],
-            "NATIONAL_ID",
-        )
-
-    def test_batch_evaluate_sends_idempotency_key(self) -> None:
-        recorder = _Recorder(body={"batch_id": "batch-1", "status": "completed"})
-        request = {
-            "items": [{"target": {"type": "Person", "identifiers": [{"scheme": "NATIONAL_ID", "value": "subj-1"}]}}],
-            "claims": ["age"],
-        }
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url, default_purpose="benefits")
-            result = client.batch_evaluate_request(request, idempotency_key="batch-key")
-
-        self.assertEqual(result["batch_id"], "batch-1")
-        self.assertEqual(recorder.requests[0]["path"], "/v1/batch-evaluations")
-        self.assertEqual(recorder.requests[0]["headers"]["Idempotency-Key"], "batch-key")
-        self.assertEqual(recorder.requests[0]["headers"]["Data-Purpose"], "benefits")
-
-    def test_async_batch_render_and_issue_methods_return_responses(self) -> None:
-        recorder = _Recorder(body={"batch_id": "batch-1"})
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url)
-            batch = asyncio.run(
-                client.abatch_evaluate_request(
-                    {"items": [{"target": {"type": "Person", "id": "subj-1"}}], "claims": ["age"]},
-                    idempotency_key="batch-key",
-                )
-            )
-        self.assertEqual(batch["batch_id"], "batch-1")
-        self.assertEqual(recorder.requests[0]["headers"]["Idempotency-Key"], "batch-key")
-
-        recorder = _Recorder(body={"rendered": True})
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url)
-            rendered = asyncio.run(client.arender_request({"evaluation_id": "eval-1"}))
-        self.assertTrue(rendered["rendered"])
-
-        recorder = _Recorder(body={"credential_id": "cred-1"})
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url)
-            issued = asyncio.run(client.aissue_credential_request({"evaluation_id": "eval-1"}))
-        self.assertEqual(issued["credential_id"], "cred-1")
-
-    def test_core_route_helpers_cover_get_render_issue_and_status(self) -> None:
-        recorder = _Recorder(body={"data": [{"id": "age"}]})
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url)
-            listed = client.list_claims()
-
-        self.assertEqual(listed["data"][0]["id"], "age")
-        self.assertEqual(recorder.requests[0]["path"], "/v1/claims")
-
-        recorder = _Recorder(body={"document": {"ok": True}})
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url)
-            rendered = client.render_request({"evaluation_id": "eval-1", "format": "json"})
-
-        self.assertEqual(rendered["document"]["ok"], True)
-        self.assertEqual(recorder.requests[0]["path"], "/v1/evaluations/eval-1/render")
-        self.assertNotIn("evaluation_id", recorder.requests[0]["body"])
-
-        recorder = _Recorder(body={"credential_id": "cred-1"})
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url)
-            issued = client.issue_credential_request({"evaluation_id": "eval-1"})
-
-        self.assertEqual(issued["credential_id"], "cred-1")
-        self.assertEqual(recorder.requests[0]["path"], "/v1/credentials")
-
-        recorder = _Recorder(body={"credential_id": "cred-1", "status": "valid"})
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url)
-            status = client.credential_status("cred-1")
-
-        self.assertEqual(status["status"], "valid")
-        self.assertEqual(recorder.requests[0]["path"], "/v1/credentials/cred-1/status")
-
-        recorder = _Recorder(body={"id": "claim one"})
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url)
-            claim = client.get_claim("claim one")
-
-        self.assertEqual(claim["id"], "claim one")
-        self.assertEqual(recorder.requests[0]["path"], "/v1/claims/claim%20one")
-
-    def test_cross_origin_redirect_strips_sdk_auth_headers(self) -> None:
-        redirector = _Recorder()
-        target = _Recorder(body={"data": []})
-        with Server(target) as target_url:
-            with Server(redirector) as base_url:
-                redirector.responses = [
-                    (302, b"", {"Location": f"{target_url}/v1/claims"}),
-                ]
-                client = RegistryNotaryClient(base_url=base_url, api_key="secret-api-key")
-                client.list_claims()
-
-        self.assertEqual(redirector.requests[0]["headers"]["X-Api-Key"], "secret-api-key")
-        self.assertEqual(target.requests[0]["path"], "/v1/claims")
-        self.assertNotIn("X-Api-Key", target.requests[0]["headers"])
-        self.assertNotIn("Authorization", target.requests[0]["headers"])
-
-    def test_same_origin_redirect_preserves_sdk_auth_headers(self) -> None:
-        recorder = _Recorder(body={"data": []})
-        with Server(recorder) as base_url:
-            recorder.responses = [
-                (302, b"", {"Location": f"{base_url}/v1/claims?redirected=true"}),
-            ]
-            client = RegistryNotaryClient(base_url=base_url, bearer_token="secret-bearer")
-            client.list_claims()
-
-        self.assertEqual(recorder.requests[0]["headers"]["Authorization"], "Bearer secret-bearer")
-        self.assertEqual(recorder.requests[1]["path"], "/v1/claims?redirected=true")
-        self.assertEqual(recorder.requests[1]["headers"]["Authorization"], "Bearer secret-bearer")
-
-    def test_render_request_rejects_invalid_request_type(self) -> None:
-        client = RegistryNotaryClient(base_url="https://notary.example")
-
-        with self.assertRaises(NotaryError) as error:
-            client.render_request(None)  # type: ignore[arg-type]
-
-        self.assertEqual(error.exception.code, "request.invalid_type")
-
-    def test_problem_error_mapping_redacts_detail(self) -> None:
-        recorder = _Recorder(
-            status=404,
-            body={
-                "type": "https://id.registrystack.org/problems/registry-notary/target/not-found",
-                "title": "Target not found",
-                "status": 404,
-                "detail": "target subj-secret was not found",
-                "code": "target.not_found",
-            },
-        )
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url)
-            with self.assertRaises(NotaryProblemError) as raised:
-                client.evaluate(target_id="subj-secret", identifier_scheme="NATIONAL_ID", claims=["age"])
-
-        error = raised.exception
-        self.assertEqual(error.kind, "problem")
-        self.assertEqual(error.status, 404)
-        self.assertEqual(error.code, "target.not_found")
-        self.assertEqual(error.title, "Target not found")
-        self.assertFalse(error.retryable)
-        self.assertEqual(error.request_id, "req-test-1")
-        self.assertNotIn("target subj-secret", str(error))
-        self.assertFalse(hasattr(error, "detail"))
-
-    def test_decode_and_oversized_response_errors_are_redacted(self) -> None:
-        recorder = _Recorder(raw_body=b"not-json-containing-subj-secret")
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url)
-            with self.assertRaises(NotaryProblemError) as decoded:
-                client.list_claims()
-
-        self.assertEqual(decoded.exception.kind, "decode")
-        self.assertNotIn("subj-secret", str(decoded.exception))
-
-        recorder = _Recorder(raw_body=b"x" * (8 * 1024 * 1024 + 1))
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url)
-            with self.assertRaises(NotaryProblemError) as oversized:
-                client.list_claims()
-
-        self.assertEqual(oversized.exception.kind, "body_too_large")
-        self.assertNotIn("xxx", str(oversized.exception))
-
-    def test_purpose_conflict_is_client_side_error(self) -> None:
-        client = RegistryNotaryClient(base_url="http://127.0.0.1:1", default_purpose="one")
-        with self.assertRaises(NotaryError) as raised:
-            client.evaluate_request(
-                {
-                    "target": {"type": "Person", "identifiers": [{"scheme": "NATIONAL_ID", "value": "subj-4"}]},
-                    "claims": ["age"],
-                    "purpose": "two",
-                }
-            )
-        self.assertEqual(raised.exception.code, "request.purpose_conflict")
-
-    def test_retry_policy_retries_get_and_batch_only_when_safe(self) -> None:
-        policy = RetryPolicy(
-            max_attempts=2,
-            base_delay=0,
-            max_delay=0,
-            retry_rate_limited=True,
-            retry_unavailable=True,
-        )
-        recorder = _Recorder(
-            responses=[
-                (503, {"code": "busy", "title": "Busy"}, {"retry-after": "0"}),
-                (200, {"data": [{"id": "age"}]}, None),
-            ]
-        )
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url, retry_policy=policy)
-            listed = client.list_claims()
-
-        self.assertEqual(listed["data"][0]["id"], "age")
-        self.assertEqual(len(recorder.requests), 2)
-
-        recorder = _Recorder(
-            responses=[
-                (503, {"code": "busy", "title": "Busy"}, None),
-                (200, {"batch_id": "batch-1"}, None),
-            ]
-        )
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url, retry_policy=policy)
-            batch = client.batch_evaluate_request(
-                {"items": [{"target": {"type": "Person", "id": "subj-1"}}], "claims": ["age"]},
-                idempotency_key="batch-key",
-            )
-
-        self.assertEqual(batch["batch_id"], "batch-1")
-        self.assertEqual(len(recorder.requests), 2)
-
-        recorder = _Recorder(
-            responses=[
-                (503, {"code": "busy", "title": "Busy"}, None),
-                (200, {"results": []}, None),
-            ]
-        )
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url, retry_policy=policy)
-            with self.assertRaises(NotaryProblemError):
-                client.evaluate(target_id="subj-1", identifier_scheme="NATIONAL_ID", claims=["age"])
-
-        self.assertEqual(len(recorder.requests), 1)
-
-    def test_http_date_retry_after_uses_server_date_header(self) -> None:
-        delay = _parse_retry_after(
-            {
-                "date": "Wed, 31 Dec 2099 00:00:00 GMT",
-                "retry-after": "Wed, 31 Dec 2099 00:00:02 GMT",
-            }
-        )
-
-        self.assertEqual(delay, 2.0)
-
-    def test_discovery_jwks_oid4vci_and_federation_helpers(self) -> None:
-        recorder = _Recorder(
-            responses=[
-                (200, {"keys": [{"kid": "key-1"}]}, None),
-                (200, {"keys": [{"kid": "key-2"}]}, None),
-                (200, {"keys": [{"kid": "key-3"}]}, None),
-            ]
-        )
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url)
-            first = client.issuer_jwks()
-            second = client.issuer_jwks()
-            jwk = client.get_jwk("key-2")
-            refreshed = client.refresh_jwks()
-
-        self.assertEqual(first, {"keys": [{"kid": "key-1"}]})
-        self.assertEqual(second, first)
-        self.assertEqual(jwk, {"kid": "key-2"})
-        self.assertEqual(refreshed, {"keys": [{"kid": "key-3"}]})
-        self.assertEqual([request["path"] for request in recorder.requests], [
-            "/.well-known/evidence/jwks.json",
-            "/.well-known/evidence/jwks.json",
-            "/.well-known/evidence/jwks.json",
-        ])
-
-        recorder = _Recorder(
-            responses=[
-                (200, {"credential_issuer": "https://issuer.example"}, None),
-                (200, {"format": "dc+sd-jwt", "credential": "credential-secret"}, None),
-                (200, b"response.jws.compact", {"content-type": "application/jwt"}),
-            ]
-        )
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url)
-            metadata = client.oid4vci_issuer_metadata()
-            credential = client.oid4vci_credential({"proof": {"jwt": "holder-proof-secret"}})
-            jws = client.federation_evaluate_jws("request.jws.compact")
-
-        self.assertEqual(metadata["credential_issuer"], "https://issuer.example")
-        self.assertEqual(credential["credential"], "credential-secret")
-        self.assertEqual(jws, "response.jws.compact")
-        self.assertEqual(recorder.requests[1]["path"], "/oid4vci/credential")
-        self.assertEqual(recorder.requests[1]["body"], {"proof": {"jwt": "holder-proof-secret"}})
-        self.assertEqual(recorder.requests[2]["body"], "request.jws.compact")
-        self.assertEqual(recorder.requests[2]["headers"]["Content-Type"], "application/jwt")
-
-    def test_openspp_contract_routes_versioned_refs_retries_jwks_and_problem_codes(self) -> None:
-        retry_policy = RetryPolicy(
-            max_attempts=2,
-            base_delay=0,
-            max_delay=0,
-            retry_unavailable=True,
-        )
-        versioned_ref = {"id": "eligibility.open_spp", "version": "2026-05"}
-        recorder = _Recorder(
-            responses=[
-                (200, {"data": [{"id": "eligibility.open_spp", "version": "2026-05"}]}, None),
-                (200, {"id": "eligibility.open_spp", "version": "2026-05"}, None),
-                (
-                    200,
-                    {
-                        "evaluation_id": "eval-1",
-                        "results": [
-                            {
-                                "claim_id": "eligibility.open_spp",
-                                "claim_version": "2026-05",
-                                "satisfied": True,
-                            }
-                        ],
-                    },
-                    None,
-                ),
-                (503, {"code": "evidence.not_available", "title": "Evidence not available"}, None),
-                (200, {"batch_id": "batch-1", "status": "completed"}, None),
-                (200, {"keys": [{"kid": "key-1"}]}, None),
-                (200, {"credential_id": "cred-1"}, None),
-                (200, {"status": "valid"}, None),
-                (404, {"code": "claim.version_not_found", "title": "Claim version not found"}, None),
-            ]
-        )
-
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(
-                base_url=base_url,
-                default_purpose="openspp.eligibility",
-                retry_policy=retry_policy,
-            )
-            claims = client.list_claims()
-            claim = client.get_claim("eligibility.open_spp")
-            evaluation = client.evaluate(
-                target_id="beneficiary-1",
-                identifier_scheme="openspp_id",
-                claims=[versioned_ref],
-            )
-            batch = client.batch_evaluate_request(
-                {
-                    "items": [{"target": {"type": "Person", "identifiers": [{"scheme": "openspp_id", "value": "beneficiary-1"}]}}],
-                    "claims": [versioned_ref],
-                },
-                idempotency_key="openspp-batch-1",
-            )
-            jwks = client.issuer_jwks()
-            issued = client.issue_credential_request({"evaluation_id": "eval-1"})
-            status = client.credential_status("cred-1")
-            with self.assertRaises(NotaryProblemError) as missing_version:
-                client.evaluate_request({
-                    "target": {"type": "Person", "identifiers": [{"scheme": "openspp_id", "value": "beneficiary-1"}]},
-                    "claims": [{"id": "eligibility.open_spp", "version": "missing"}],
-                })
-
-        self.assertEqual(claims["data"][0]["id"], "eligibility.open_spp")
-        self.assertEqual(claim["version"], "2026-05")
-        self.assertEqual(evaluation["results"][0]["claim_version"], "2026-05")
-        self.assertEqual(batch["batch_id"], "batch-1")
-        self.assertEqual(jwks["keys"][0]["kid"], "key-1")
-        self.assertEqual(issued["credential_id"], "cred-1")
-        self.assertEqual(status["status"], "valid")
-        self.assertEqual(missing_version.exception.code, "claim.version_not_found")
-        self.assertEqual([request["path"] for request in recorder.requests], [
-            "/v1/claims",
-            "/v1/claims/eligibility.open_spp",
-            "/v1/evaluations",
-            "/v1/batch-evaluations",
-            "/v1/batch-evaluations",
-            "/.well-known/evidence/jwks.json",
-            "/v1/credentials",
-            "/v1/credentials/cred-1/status",
-            "/v1/evaluations",
-        ])
-        self.assertEqual(recorder.requests[2]["body"]["claims"], [versioned_ref])
-        self.assertEqual(recorder.requests[2]["headers"]["Accept"], "application/vnd.registry-notary.claim-result+json")
-        self.assertEqual(recorder.requests[3]["headers"]["Idempotency-Key"], "openspp-batch-1")
-        self.assertEqual(recorder.requests[4]["headers"]["Idempotency-Key"], "openspp-batch-1")
-
-    def test_openspp_problem_codes_are_preserved_for_policy_mapping(self) -> None:
-        stable_codes = [
-            "target.not_found",
-            "target.match_ambiguous",
-            "evidence.not_available",
-            "claim.not_found",
-            "claim.version_not_found",
-            "claim.format_not_supported",
-            "auth.purpose_required",
-            "auth.missing_credential",
-            "idempotency.conflict",
-            "batch.too_large",
-            "deployment.custom_problem",
-        ]
-
-        for code in stable_codes:
-            with self.subTest(code=code):
-                recorder = _Recorder(status=400, body={"code": code, "title": "Contract problem"})
-                with Server(recorder) as base_url:
-                    client = RegistryNotaryClient(base_url=base_url)
-                    with self.assertRaises(NotaryProblemError) as raised:
-                        client.list_claims()
-                self.assertEqual(raised.exception.code, code)
-
-    def test_oid4vci_errors_redact_description_and_nonce(self) -> None:
-        recorder = _Recorder(
-            status=400,
-            body={
-                "error": "invalid_proof",
-                "error_description": "holder proof includes c_nonce nonce-secret",
-            },
-        )
-        with Server(recorder) as base_url:
-            client = RegistryNotaryClient(base_url=base_url)
-            with self.assertRaises(NotaryProblemError) as raised:
-                client.oid4vci_credential({"proof": {"jwt": "holder-proof-secret"}})
-
-        self.assertEqual(raised.exception.kind, "oid4vci")
-        self.assertEqual(raised.exception.code, "invalid_proof")
-        self.assertNotIn("nonce-secret", str(raised.exception))
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/products/notary/docs/README.md b/products/notary/docs/README.md
deleted file mode 100644
index 4a9db4c56..000000000
--- a/products/notary/docs/README.md
+++ /dev/null
@@ -1,48 +0,0 @@
-# Registry Notary documentation
-
-Registry Notary evaluates claims and issues evidence from authenticated, typed
-Registry Relay consultation results. Every claim must reference a
-compiler-pinned Relay consultation. It never connects directly to a registry
-source.
-
-## Understand
-
-- [Architecture overview](architecture-overview.md)
-- [Capability matrix](notary-capability-matrix.md)
-- [Consultation identity and outcomes](identity-and-record-matching.md)
-- [Scenario patterns](notary-scenario-patterns.md)
-- [Source and claim modeling](source-claim-modeling-guide.md)
-
-## Integrate
-
-- [Client SDK guide](client-sdk-guide.md)
-- [API reference](api-reference.md)
-- [Wallet interop with OID4VCI](oid4vci-wallet-interop.md)
-- [Representative credential issuance](representative-credential-issuance.md)
-- [SD-JWT VC conformance](sd-jwt-vc-conformance-profile.md)
-
-## Operate
-
-- [Operator configuration reference](operator-config-reference.md)
-- [Subject access](subject-access-operator-guide.md)
-- [Federated evaluation](federated-evaluation-operator-guide.md)
-- [Credential lifecycle and status](credential-lifecycle-status.md)
-- [Credential issuance trust-boundary migration](credential-issuance-migration.md)
-- [Signing key providers](signing-key-provider.md)
-- [Configuration trust](configuration-trust-and-integrity.md)
-- [Deployment hardening](deployment-hardening-runbook.md)
-- [Security assurance](security-assurance.md)
-
-## Maintain
-
-- [Product layout](../README.md#layout)
-- [Design records](../specs/README.md)
-- [Release notes](release-notes.md)
-- [Security policy](../../../SECURITY.md)
-
-Registry source adaptation belongs to Relay and Registry Stack project
-authoring. Rhai is Relay's reviewed `script` capability and CEL is Notary's
-evidence-claim policy language. Product and version metadata never selects
-either runtime. The evidence consumer determines how returned evidence is
-used, and the decision owner remains accountable for requirements, decisions,
-workflow, and actions. CEL is not a general-purpose consumer decision engine.
diff --git a/products/notary/docs/api-reference.md b/products/notary/docs/api-reference.md
deleted file mode 100644
index 3ca649eda..000000000
--- a/products/notary/docs/api-reference.md
+++ /dev/null
@@ -1,93 +0,0 @@
-# Registry Notary API reference
-
-The committed OpenAPI document and the running service's `/openapi.json`
-response are authoritative for routes and schemas. This page records the
-product boundaries that clients must preserve.
-
-## Main surfaces
-
-| Surface | Purpose |
-| --- | --- |
-| `GET /healthz`, `GET /ready` | Liveness and dependency readiness |
-| `GET /.well-known/evidence-service` | Protected evidence-service discovery |
-| `GET /v1/claims`, `GET /v1/claims/{id}` | Claim discovery |
-| `POST /v1/evaluations` | Purpose-bound claim evaluation |
-| `POST /v1/batch-evaluations` | Bounded independently authorized evaluations |
-| `POST /v1/evaluations/{id}/render` | Render an evaluation in an allowed format |
-| `POST /v1/credentials` | Issue an allowed credential |
-| OID4VCI routes | Wallet-facing issuance profile |
-| `POST /federation/v1/evaluations` | Signed static-peer delegated evaluation |
-| `/admin/v1/*`, `/metrics` | Restricted operator surfaces |
-
-Notary exposes no registry-source, adapter, or sidecar API. Relay consultations
-are private product-to-product calls governed by compiler-produced contracts.
-
-## Bounded batch evaluation
-
-`POST /v1/batch-evaluations` repeats one claim set over an ordered list of
-targets. It is the only batch surface. Notary does not expose Relay batch,
-batch credential issuance, or OID4VCI batch credential routes.
-
-The hard platform ceiling is 100 items. Operators may lower it globally with
-`evidence.inline_batch_limit` and per selected claim with
-`operations.batch_evaluate.max_subjects`. The effective limit is the lowest of
-100 and every applicable configured limit. A larger request returns HTTP 413
-with `batch.too_large` before quota, idempotency, Relay, source, or retained
-state changes.
-
-Processing has two phases. Notary first validates and plans every item without
-side effects. An authorization, purpose, identity, format, claim, or
-consultation-planning error rejects the whole request. After admission, items
-execute with bounded concurrency and return an ordered HTTP 200 response. Each
-item is independently `succeeded` or `failed`, and failures contain only closed
-value-free errors.
-
-Registry-backed batches require a caller-scoped `Idempotency-Key`. If a request
-is cancelled or its response is lost, retry the identical body with the same
-key. Cancellation returns no partial response and retains no partial
-evaluations, although Relay may have observed work already dispatched. A
-completed replay returns the stored response without another source dispatch.
-
-The 100-item limit composes with the 1 MiB inbound request limit, 64 KiB
-per-Relay-result limit, 256 consultation-group limit, 25 second Relay deadline,
-30 second default outer deadline, default concurrency of 16 items and 8 Relay
-operations, and the Rust client's 16 MiB response-read limit. Use smaller
-batches for large member results. There is no separate aggregate Relay byte
-counter.
-
-Each member preserves the authorization, purpose, consent, minimization,
-provenance, and value-free audit rules of single evaluation. A successful
-member may be used only through the normal one-evaluation issuance flow.
-
-## Client behavior
-
-Use the Rust, Python, or Node client for bounded response reads, problem
-decoding, route-aware retries, and credential verification. Map policy on the
-stable Problem Details `code`, not on human-readable prose. Safe log fields
-are `status`, `code`, `title`, `retryable`, and `request_id`.
-
-Never log subject identifiers, authorization details, Relay consultation
-inputs or outputs, credential material, or raw upstream errors.
-
-## Problem categories
-
-The API uses closed problem codes grouped by category, including:
-
-- `auth.*`, `purpose.*`, and `request.*` for admission;
-- `requester.*`, `target.*`, and `relationship.*` for evidence context;
-- `delegated.*` for delegated authorization or proof;
-- `claim.*`, `evaluation.*`, and `evidence.*` for evaluation;
-- `credential.*`, `holder_binding.*`, and `signature.*` for issuance;
-- `idempotency.*`, `batch.*`, and `replay.*` for request state; and
-- `consultation.*` for invalid Relay consultation inputs; and
-- `evidence.*` for unavailable evidence, including Relay consultation failures.
-
-An internal Relay failure does not become a claim result or `no_match`.
-Unknown codes must be handled conservatively by category.
-
-## Discovery privacy
-
-Evidence-service and claim discovery may expose bounded target-input metadata
-for form construction. It must not expose Relay origins, profile credentials,
-source product configuration, registry field names, scripts, or private
-environment bindings.
diff --git a/products/notary/docs/architecture-overview.md b/products/notary/docs/architecture-overview.md
deleted file mode 100644
index c6eaffd91..000000000
--- a/products/notary/docs/architecture-overview.md
+++ /dev/null
@@ -1,74 +0,0 @@
-# Architecture overview
-
-Registry Notary is the Registry Stack evidence product. It authenticates the
-caller, enforces service policy, evaluates claims, applies disclosure, and can
-issue a credential. It is not a registry, source connector, or integration
-runtime.
-
-## Deployment topologies
-
-A Registry Stack project represents one registry trust domain. One environment
-may activate at most one logical Relay and one logical Notary, with identical
-replicas and coordinated replacement generations permitted.
-
-- A Relay-only deployment exposes governed source capabilities without Notary.
-- A Notary deployment may start without claims, but it cannot evaluate evidence
-  until it is connected to its project's Relay.
-- A combined deployment lets Notary derive claims from its project's single Relay.
-
-When both products are present, Notary receives no registry destination or
-credential. It invokes compiler-produced Relay consultation profiles and
-verifies their full semantic contract before serving.
-
-## Registry-backed request lifecycle
-
-1. Notary authenticates the caller and checks scope, purpose, relationship,
-   and service policy before any Relay call.
-2. Notary maps the closed request grammar to one compiler-pinned consultation.
-3. Relay validates its workload token, purpose, inputs, and `contract_hash`
-   before source access.
-4. Relay returns `match`, `no_match`, or `ambiguous`, plus typed minimized
-   outputs only on `match` and closed acquisition provenance.
-5. Notary derives direct and CEL evidence claims, applies disclosure, and
-   either returns the result or issues an allowed credential.
-6. The evidence consumer determines how the returned evidence is used. The
-   decision owner applies any requirement, decision, workflow, or action
-   policy.
-7. Each product writes its own redacted audit record. The evaluation id and
-   consultation id support restricted cross-service reconciliation.
-
-```mermaid
-flowchart LR
-  Consumer[Evidence consumer<br/>use, decision input, action] --> Notary[Registry Notary<br/>evidence, disclosure, issuance]
-  Notary --> Relay[Registry Relay<br/>acquisition, normalization, outputs]
-  Relay --> Source[(Registry source)]
-  Relay --> Notary
-  Notary --> Consumer
-```
-
-Notary never treats a Relay failure as `no_match`. Ambiguity, denial, source,
-verification, availability, or contract failure aborts the affected
-consultation group. Raw Relay errors are not exposed as claim values.
-
-## Subject and delegated access
-
-OIDC identity and delegated authorization decide who may request evidence and
-for which subject. They are not evidence sources. Every resulting claim still
-derives from a compiler-pinned Relay consultation. Where a delegated
-relationship is proved by Relay, Notary pins the exact proof and evidence
-consultations and performs all authorization checks before invoking them.
-
-## Product boundaries
-
-Relay owns source authentication, network policy, HTTP and protocol helpers,
-Rhai source adaptation, typed outputs, and acquisition provenance. Notary owns
-caller authentication, purpose and legal basis, consent policy, reusable
-evidence claims, CEL evidence derivation, disclosure, credential profiles,
-signing, and issuance. The evidence consumer determines how returned evidence is
-used, and the decision owner remains accountable for requirements, eligibility,
-qualification, prioritization, approval, referral, payment, workflow, and
-action policy. Their state and audit authority remain separate.
-
-Notary may attest a decision that an authoritative source has already made.
-That claim is a source-owned decision and must be named and documented as such;
-Notary does not recompute it as consumer policy.
diff --git a/products/notary/docs/client-sdk-guide.md b/products/notary/docs/client-sdk-guide.md
deleted file mode 100644
index d11d46418..000000000
--- a/products/notary/docs/client-sdk-guide.md
+++ /dev/null
@@ -1,1198 +0,0 @@
-# Registry Notary Client SDK Guide
-
-> **Page type:** How-to · **Product:** Registry Notary · **Layer:** consultation, evaluation, credential · **Audience:** integrator
-
-Registry Notary ships a typed Rust client plus Python and Node.js wrappers. Use
-these clients instead of hand-written HTTP calls when application code needs the
-Notary wire contract, purpose handling, bounded response reads, route-aware
-retry behavior, JWKS refresh behavior, and redacted error mapping.
-
-This guide starts with the first integration path: discover a claim, evaluate it
-for one target, read the result, and handle errors safely. Later sections cover
-batch evaluation, rendering, credential issuance, OID4VCI, federation, and
-Rust-only verifier helpers.
-
-## Start here
-
-Before the first SDK call, collect these values from the deployment operator or
-from your own application workflow.
-
-| Need | Example | Where it comes from |
-| --- | --- | --- |
-| Service base URL | `https://notary.example.gov` | Registry Notary operator |
-| Auth credential | `REGISTRY_NOTARY_CLIENT_TOKEN` | Registry Notary operator |
-| Claim id | `person-is-alive` | `list_claims` or operator docs |
-| Target identifier | `person_id` and a locally valid identifier | Your application or case record |
-| Purpose | `service-delivery` | Your product, policy, or workflow |
-
-Use `list_claims` first when you are unsure which claim ids your credential can
-see. A later `403` on evaluation usually means the credential lacks the
-`required_scope` for one of the requested claims.
-
-Export the values provided by the deployment operator:
-
-```bash
-export REGISTRY_NOTARY_BASE_URL="<service URL>"
-export REGISTRY_NOTARY_API_KEY="<client token>"
-export REGISTRY_NOTARY_PURPOSE="<allowed purpose>"
-```
-
-### Key terms
-
-- **Claim:** A named question Notary can evaluate, such as
-  `person-is-alive`.
-- **Target:** The person, organization, or record being evaluated.
-- **Requester:** The actor asking for the evaluation.
-- **Relationship:** Why the requester may ask about the target, such as `self`.
-- **Purpose:** The reason for processing, sent in request metadata and usually
-  recorded in audit evidence.
-- **Disclosure:** The detail level requested in the response. `predicate`
-  asks for a minimized true, false, or unknown style result.
-
-## Packages
-
-| Runtime | Package | Surface |
-| --- | --- | --- |
-| Rust | `registry-notary-client` | Primary typed client and optional JSON facade |
-| Python | `registry-notary` | Dictionary-friendly sync and async wrapper |
-| Node.js | `@registry-notary/client` | Promise client with TypeScript declarations |
-
-The Rust crate is the source of truth. Python and Node expose the main
-application, discovery, OID4VCI, and federation helpers, but keep JSON as
-dictionaries or plain objects. Rust additionally exposes operational, admin,
-format, and explicit SD-JWT VC verifier helpers.
-
-The packages are not currently published to public package registries. Pin
-integrations to a release tag or commit.
-
-```toml
-[dependencies]
-registry-notary-client = { git = "https://github.com/registrystack/registry-stack", tag = "vX.Y.Z" }
-registry-notary-core = { git = "https://github.com/registrystack/registry-stack", tag = "vX.Y.Z" }
-```
-
-```bash
-python -m pip install "git+https://github.com/registrystack/registry-stack.git@vX.Y.Z#subdirectory=products/notary/bindings/python"
-```
-
-```bash
-pnpm add "github:registrystack/registry-stack#vX.Y.Z&path:products/notary/bindings/node"
-```
-
-npm does not support installing from a subdirectory of a git repository. With
-npm, install the Node package from a checkout pinned to a release tag or
-commit:
-
-```bash
-npm install ./bindings/node
-```
-
-From an app that depends on a local Registry Notary checkout, use path installs
-instead:
-
-```toml
-[dependencies]
-registry-notary-client = { path = "/path/to/registry-notary/crates/registry-notary-client" }
-registry-notary-core = { path = "/path/to/registry-notary/crates/registry-notary-core" }
-```
-
-```bash
-python -m pip install -e /path/to/registry-notary/bindings/python
-pnpm add /path/to/registry-notary/bindings/node
-```
-
-### Verifying a workspace checkout
-
-```bash
-cargo test -p registry-notary-client
-cargo test -p registry-notary-client --features json-facade,oid4vci,federation
-cargo doc -p registry-notary-client --no-deps --all-features
-python3 -m unittest discover -s bindings/python/tests
-npm test --prefix bindings/node
-npm run check:types --prefix bindings/node
-```
-
-## First evaluation
-
-This quickstart asks a configured Notary service to evaluate the
-`person-is-alive` claim for a target identifier. Notary authorizes the request,
-executes the claim's compiler-pinned Relay consultation, and returns only the
-configured minimized result.
-
-The examples set `default_purpose` or `defaultPurpose` on the client. You can
-also set purpose per call when different workflows share the same client.
-
-### Python
-
-```python
-import os
-
-from registry_notary import RegistryNotaryClient
-from registry_notary.errors import NotaryProblemError, NotaryTransportError
-
-client = RegistryNotaryClient(
-    base_url=os.environ["REGISTRY_NOTARY_BASE_URL"],
-    api_key=os.environ["REGISTRY_NOTARY_API_KEY"],
-    default_purpose=os.environ["REGISTRY_NOTARY_PURPOSE"],
-    user_agent="benefits-api/1.0",
-)
-
-claims = client.list_claims()
-print([claim["id"] for claim in claims.get("data", [])])
-
-try:
-    result = client.evaluate_request({
-        "target": {
-            "type": "Person",
-            "identifiers": [{
-                "scheme": "person_id",
-                "value": "example-person",
-            }],
-        },
-        "relationship": {"type": "self"},
-        "claims": ["person-is-alive"],
-        "disclosure": "predicate",
-        "purpose": os.environ["REGISTRY_NOTARY_PURPOSE"],
-    })
-except NotaryProblemError as exc:
-    print(exc.status, exc.code, exc.request_id)
-except NotaryTransportError:
-    print("transport failure")
-else:
-    first = result["results"][0]
-    print(first["claim_id"], first.get("satisfied"))
-```
-
-What this does:
-
-- `list_claims` confirms which claim ids this credential can see.
-- `target` identifies the entity being evaluated.
-- `relationship` tells Notary why this requester may ask about the target.
-- `claims` names the claim ids to evaluate.
-- `disclosure` asks for a minimized claim answer.
-- `purpose` must match the configured default purpose when both are present.
-
-Python also has a shorter helper for the common one-target case:
-
-```python
-result = client.evaluate(
-    target_id="example-person",
-    identifier_scheme="person_id",
-    target_type="Person",
-    claims=["person-is-alive"],
-)
-```
-
-Use `evaluate_request` when you need the full canonical wire shape, including
-relationship context, version-pinned claim references, `disclosure`, `format`,
-or explicit `purpose`.
-
-### Node.js
-
-```js
-import {
-  NotaryProblemError,
-  NotaryTransportError,
-  RegistryNotaryClient,
-} from "@registry-notary/client";
-
-const client = new RegistryNotaryClient({
-  baseUrl: process.env.REGISTRY_NOTARY_BASE_URL,
-  apiKey: process.env.REGISTRY_NOTARY_API_KEY,
-  defaultPurpose: process.env.REGISTRY_NOTARY_PURPOSE,
-  userAgent: "benefits-api/1.0",
-});
-
-const claims = await client.listClaims();
-console.log(claims.data?.map((claim) => claim.id) ?? []);
-
-try {
-  const result = await client.evaluate({
-    target: {
-      type: "Person",
-      identifiers: [{ scheme: "person_id", value: "example-person" }],
-    },
-    relationship: { type: "self" },
-    claims: ["person-is-alive"],
-    disclosure: "predicate",
-    purpose: process.env.REGISTRY_NOTARY_PURPOSE,
-  });
-
-  const first = result.results[0];
-  console.log(first.claimId, first.satisfied);
-} catch (error) {
-  if (error instanceof NotaryProblemError) {
-    console.log(error.status, error.code, error.requestId);
-  } else if (error instanceof NotaryTransportError) {
-    console.log("transport failure");
-  } else {
-    throw error;
-  }
-}
-```
-
-The high-level Node helpers accept camelCase object keys and return camelCase
-response keys. Use `evaluateRequest` when you want to send canonical snake_case
-wire JSON and receive snake_case response JSON.
-
-```js
-const result = await client.evaluateRequest({
-  target: {
-    type: "Person",
-    identifiers: [{ scheme: "person_id", value: "example-person" }],
-  },
-  relationship: { type: "self" },
-  claims: ["person-is-alive"],
-  disclosure: "predicate",
-  purpose: process.env.REGISTRY_NOTARY_PURPOSE,
-});
-```
-
-### Rust
-
-```rust
-use registry_notary_client::RegistryNotaryClient;
-
-let base_url = std::env::var("REGISTRY_NOTARY_BASE_URL")?;
-let api_key = std::env::var("REGISTRY_NOTARY_API_KEY")?;
-let purpose = std::env::var("REGISTRY_NOTARY_PURPOSE")?;
-
-let client = RegistryNotaryClient::builder(base_url)
-    .api_key(api_key)
-    .default_purpose(purpose.clone())
-    .user_agent("benefits-api/1.0")
-    .build()?;
-
-let claims = client.list_claims(Default::default()).await?;
-
-let response = client
-    .evaluate_target("Person")
-    .target_identifier("person_id", "example-person")
-    .relationship("self")
-    .claims(["person-is-alive"])
-    .disclosure("predicate")
-    .purpose(purpose.clone())
-    .send()
-    .await?;
-
-if let Some(result) = response.body.result_for("person-is-alive") {
-    println!("satisfied: {:?}", result.satisfied);
-}
-```
-
-Rust returns `NotaryResponse<T>`, so response metadata is available next to the
-decoded body:
-
-```rust
-println!("status: {}", response.status);
-println!("request id: {:?}", response.request_id);
-```
-
-## Understanding the request
-
-The SDKs protect the same wire model. Most integration confusion comes from the
-request fields, not from the language syntax.
-
-### Target, requester, relationship
-
-The target is the entity being evaluated. Most application calls include a
-target with one or more identifiers:
-
-```json
-{
-  "target": {
-    "type": "Person",
-    "identifiers": [
-      {
-        "scheme": "national_id",
-        "value": "person-1",
-        "issuer": "civil_registry"
-      }
-    ]
-  }
-}
-```
-
-Requester context is optional. Include it when the caller is asking about a
-different target or acting on behalf of someone else. Use `relationship` to
-explain the permission context, such as `self`, `guardian`, `case_worker`, or a
-deployment-specific value.
-
-For token-bound subject access flows, omit identity fields and let the server
-derive the requester, target, and `self` relationship from the verified token
-binding:
-
-```python
-result = client.evaluate_request({
-    "claims": [{"id": "person-is-alive", "version": "2026-05"}],
-    "disclosure": "predicate",
-})
-```
-
-### Claims and scopes
-
-Claim references may be plain strings or pinned objects with `id` and
-`version`. The same versioned claim reference shape is supported for single
-evaluation and batch evaluation.
-
-```json
-{
-  "claims": [
-    "person-is-alive",
-    { "id": "age-over-18", "version": "2026-05" }
-  ]
-}
-```
-
-The credential behind your auth mode carries a `scopes` list, and every claim
-declares its required scopes as part of the evidence service policy. Scope strings are
-operator-defined `<namespace>:<operation>` values, for example
-`civil_registry:evidence_verification` or `registry_notary:credential_issue`.
-There is no fixed global registry of scope names.
-
-When you connect to a deployment you do not operate, ask the operator which
-scopes the claims you need require. `GET /v1/claims`, exposed as `list_claims`
-or `listClaims`, confirms which claims your credential can see before the first
-evaluation.
-
-### Purpose
-
-Evaluation routes can carry a data purpose in the `Data-Purpose` header and in
-the request body `purpose` field. If both are present, they must match exactly.
-The client rejects mismatches before sending the request.
-
-Set a client default purpose when most calls share one purpose. Override per
-call through request options when needed.
-
-### Disclosure and format
-
-Use `disclosure` to request the amount of detail your workflow is allowed to
-receive. `predicate` is the common minimized answer for policy gates. Other
-disclosure modes and formats are deployment-specific and should be selected
-from operator guidance or claim metadata.
-
-## Understanding the response
-
-Successful Python and Node helpers return the decoded response body directly.
-Rust returns `NotaryResponse<T>` with the decoded body plus metadata.
-
-A single evaluation response is an object with `results`. Each result represents
-one claim answer. This example is abbreviated because real responses include
-provenance and matching metadata.
-
-```json
-{
-  "results": [
-    {
-      "evaluation_id": "eval-1",
-      "claim_id": "person-is-alive",
-      "claim_version": "2026-05",
-      "target_ref": {
-        "type": "Person",
-        "handle": "target-1",
-        "identifier_schemes": ["national_id"]
-      },
-      "value": null,
-      "satisfied": true,
-      "disclosure": "predicate",
-      "format": "application/vnd.registry-notary.claim-result+json",
-      "issued_at": "2026-05-29T00:00:00Z",
-      "expires_at": null,
-      "provenance": {}
-    }
-  ]
-}
-```
-
-Inspect these fields first:
-
-- `evaluation_id`: save this if you plan to render or issue a credential later.
-- `claim_id`: identifies which requested claim this result belongs to.
-- `satisfied`: `true`, `false`, or absent when the claim does not map to a
-  boolean predicate.
-- `value`: a minimized value when the requested disclosure and claim format
-  allow it.
-- `provenance`: evidence metadata. Do not log it blindly.
-
-## Which method should I use?
-
-| Task | Rust | Python | Node.js |
-| --- | --- | --- | --- |
-| See claims available to my credential | `list_claims` | `list_claims` | `listClaims` |
-| Evaluate one target with helper fields | `evaluate_target(...).send()` | `evaluate` | `evaluate` |
-| Send canonical wire JSON | `evaluate_request` | `evaluate_request` | `evaluateRequest` |
-| Evaluate many targets safely | `batch_evaluate_request` | `batch_evaluate_request` | `batchEvaluate` or `batchEvaluateRequest` |
-| Render an evaluation | `render_request` | `render_request` | `renderRequest` |
-| Issue a credential | `issue_credential_request` | `issue_credential_request` | `issueCredentialRequest` |
-| Check credential status | `credential_status` | `credential_status` | `credentialStatus` |
-| Read issuer JWKS | `issuer_jwks` | `issuer_jwks` | `issuerJwks` |
-| Verify SD-JWT VC material | verifier feature | not exposed | not exposed |
-
-Use the high-level helpers when your app is doing the common thing. Use the raw
-or request-shaped helpers when you need exact wire JSON, versioned claim
-references, route-shaped request bodies, or language binding code.
-
-## Common recipes
-
-### Create a client
-
-Configure exactly one auth mode:
-
-- Bearer token, sent as `Authorization: Bearer <token>`.
-- API key, sent as `X-Api-Key`.
-- Rust only: dynamic `AuthProvider`.
-
-Supplying more than one auth mode is a client construction error. Debug output
-redacts configured auth material.
-
-```rust
-let client = RegistryNotaryClient::builder("https://notary.example.gov")
-    .bearer_token("access-token")
-    .build()?;
-```
-
-```rust
-let client = RegistryNotaryClient::builder("https://notary.example.gov")
-    .api_key("service-key")
-    .build()?;
-```
-
-```python
-client = RegistryNotaryClient(
-    base_url="https://notary.example.gov",
-    bearer_token="access-token",
-)
-```
-
-```js
-const client = new RegistryNotaryClient({
-  baseUrl: "https://notary.example.gov",
-  bearerToken: "access-token",
-});
-```
-
-### Send a full canonical evaluation
-
-Use the canonical request shape when the high-level helper hides fields your
-workflow cares about. The Python and Node raw helpers preserve canonical
-snake_case JSON.
-
-In these examples, `benefits_eligibility` identifies the authorized purpose
-for evidence access and audit. It does not define the evidence consumer's
-eligibility rule or transfer decision ownership to Notary.
-
-```python
-result = client.evaluate_request(
-    {
-        "target": {
-            "type": "Person",
-            "identifiers": [{
-                "scheme": "national_id",
-                "value": "person-1",
-                "issuer": "civil_registry",
-            }],
-        },
-        "relationship": {"type": "self"},
-        "claims": [{"id": "person-is-alive", "version": "2026-05"}],
-        "disclosure": "predicate",
-        "purpose": "benefits_eligibility",
-    },
-    request_id="req-123",
-    traceparent="00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01",
-)
-```
-
-```js
-const result = await client.evaluateRequest(
-  {
-    target: {
-      type: "Person",
-      identifiers: [{ scheme: "national_id", value: "person-1", issuer: "civil_registry" }],
-    },
-    relationship: { type: "self" },
-    claims: [{ id: "person-is-alive", version: "2026-05" }],
-    disclosure: "predicate",
-    purpose: "benefits_eligibility",
-  },
-  {
-    requestId: "req-123",
-    traceparent: "00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01",
-  },
-);
-```
-
-Rust callers can also construct core DTOs directly. This is most useful inside
-the Registry Notary workspace or when the application already depends on
-`registry-notary-core`.
-
-```rust
-use registry_notary_client::RequestOptions;
-use registry_notary_core::{
-    ClaimRef, EvidenceEntity, EvidenceIdentifier, EvidenceRelationship, EvaluateRequest,
-};
-
-let request = EvaluateRequest {
-    requester: None,
-    target: Some(EvidenceEntity {
-        entity_type: "Person".to_string(),
-        id: None,
-        identifiers: vec![EvidenceIdentifier {
-            scheme: "national_id".to_string(),
-            value: "person-1".to_string(),
-            issuer: Some("civil_registry".to_string()),
-            country: None,
-        }],
-        attributes: Default::default(),
-        assurance: None,
-        profile: None,
-    }),
-    relationship: Some(EvidenceRelationship {
-        relationship_type: "self".to_string(),
-        attributes: Default::default(),
-    }),
-    on_behalf_of: None,
-    claims: vec![ClaimRef::new("person-is-alive")],
-    disclosure: Some("predicate".to_string()),
-    format: None,
-    purpose: Some("benefits_eligibility".to_string()),
-};
-
-let options = RequestOptions::builder()
-    .purpose("benefits_eligibility")
-    .request_id("req-123")
-    .traceparent("00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01")
-    .build();
-
-let response = client.evaluate_request(request, options).await?;
-```
-
-### Batch with retry
-
-Use batch evaluation when several targets share the same claim set. Batch
-evaluation is the only POST route that accepts `Idempotency-Key` through the
-client. Retries are allowed for this route only when an idempotency key is
-supplied. `POST /v1/evaluations`, `POST /v1/evaluations/{evaluation_id}/render`,
-and `POST /v1/credentials` reject a request that carries `Idempotency-Key`
-with `400 Bad Request`; do not send that header outside batch evaluation.
-
-One request may contain at most 100 items, and the deployment or any selected
-claim may advertise a lower limit. The Rust typed client rejects more than 100
-items before transport. All clients surface a server-side lower-limit rejection
-as HTTP 413 with `batch.too_large`.
-
-For a high-volume workload, split targets into stable ordered slices of no more
-than 100, or smaller slices when member results are large. Assign one unique
-idempotency key to each slice and persist that key with the slice definition.
-Every retry after a timeout, cancellation, process restart, or lost response
-must send the identical slice with the same key. Do not reuse a key for the
-next slice. Items in the HTTP 200 response remain in request order and may be a
-mix of `succeeded` and `failed`; retrying a completed slice replays that result
-instead of dispatching its registry consultations again.
-
-```python
-from registry_notary import RetryPolicy
-
-client = RegistryNotaryClient(
-    base_url="https://notary.example.gov",
-    bearer_token="access-token",
-    retry_policy=RetryPolicy(
-        max_attempts=3,
-        base_delay=0.1,
-        max_delay=2.0,
-        retry_transport_errors=True,
-        retry_rate_limited=True,
-        retry_unavailable=True,
-    ),
-)
-
-result = client.batch_evaluate_request(
-    {
-        "items": [{
-            "target": {
-                "type": "Person",
-                "identifiers": [{
-                    "scheme": "national_id",
-                    "value": "person-1",
-                    "issuer": "civil_registry",
-                }],
-            },
-            "relationship": {"type": "self"},
-        }],
-        "claims": ["person-is-alive"],
-        "purpose": "benefits_eligibility",
-    },
-    idempotency_key="batch-2026-05-29-001",
-)
-```
-
-```js
-const controller = new AbortController();
-
-const client = new RegistryNotaryClient({
-  baseUrl: "https://notary.example.gov",
-  bearerToken: "access-token",
-  retryPolicy: {
-    maxAttempts: 3,
-    baseDelayMs: 100,
-    maxDelayMs: 2000,
-    retryTransportErrors: true,
-    retryRateLimited: true,
-    retryUnavailable: true,
-  },
-});
-
-const result = await client.batchEvaluate(
-  {
-    items: [{
-      target: {
-        type: "Person",
-        identifiers: [{ scheme: "national_id", value: "person-1", issuer: "civil_registry" }],
-      },
-      relationship: { type: "self" },
-    }],
-    claims: ["person-is-alive"],
-    purpose: "benefits_eligibility",
-  },
-  {
-    idempotencyKey: "batch-2026-05-29-001",
-    signal: controller.signal,
-  },
-);
-```
-
-```rust
-use registry_notary_client::{RequestOptions, RetryPolicy};
-use registry_notary_core::{
-    BatchEvaluateItemRequest, BatchEvaluateRequest, ClaimRef, EvidenceEntity,
-    EvidenceIdentifier, EvidenceRelationship,
-};
-use std::time::Duration;
-
-let client = RegistryNotaryClient::builder("https://notary.example.gov")
-    .retry_policy(RetryPolicy {
-        max_attempts: 3,
-        base_delay: Duration::from_millis(100),
-        max_delay: Duration::from_secs(2),
-        retry_transport_errors: true,
-        retry_rate_limited: true,
-        retry_unavailable: true,
-    })
-    .build()?;
-
-let request = BatchEvaluateRequest {
-    items: vec![BatchEvaluateItemRequest {
-        requester: None,
-        target: EvidenceEntity {
-            entity_type: "Person".to_string(),
-            id: None,
-            identifiers: vec![EvidenceIdentifier {
-                scheme: "national_id".to_string(),
-                value: "person-1".to_string(),
-                issuer: Some("civil_registry".to_string()),
-                country: None,
-            }],
-            attributes: Default::default(),
-            assurance: None,
-            profile: None,
-        },
-        relationship: Some(EvidenceRelationship {
-            relationship_type: "self".to_string(),
-            attributes: Default::default(),
-        }),
-        on_behalf_of: None,
-        purpose: None,
-    }],
-    claims: vec![ClaimRef::new("person-is-alive")],
-    disclosure: None,
-    format: None,
-    purpose: Some("benefits_eligibility".to_string()),
-};
-
-let options = RequestOptions::builder()
-    .purpose("benefits_eligibility")
-    .idempotency_key("batch-2026-05-29-001")
-    .build();
-
-let response = client.batch_evaluate_request(request, options).await?;
-println!("succeeded: {}", response.body.summary.succeeded);
-```
-
-### Render an evaluation
-
-Render when you already have an `evaluation_id` and need a configured evidence
-format for display, export, or downstream exchange.
-
-Rust accepts the core `RenderRequest` DTO and moves `evaluation_id` into
-`/v1/evaluations/{evaluation_id}/render` before sending the body. Python and
-Node raw helpers accept canonical snake_case JSON, require a mapping or object,
-extract `evaluation_id`, and send the remaining fields as the route body.
-
-```python
-rendered = client.render_request({
-    "evaluation_id": "eval-1",
-    "format": "application/vnd.registry-notary.claim-result+json",
-    "disclosure": "predicate",
-})
-```
-
-```js
-const rendered = await client.renderRequest({
-  evaluation_id: "eval-1",
-  format: "application/vnd.registry-notary.claim-result+json",
-  disclosure: "predicate",
-});
-```
-
-```rust
-use registry_notary_core::RenderRequest;
-
-let rendered = client
-    .render_request(
-        RenderRequest {
-            evaluation_id: "eval-1".to_string(),
-            format: "application/vnd.registry-notary.claim-result+json".to_string(),
-            disclosure: Some("predicate".to_string()),
-            claims: None,
-            purpose: Some("benefits_eligibility".to_string()),
-        },
-        RequestOptions::default(),
-    )
-    .await?;
-```
-
-### Issue a credential
-
-Issue a credential when a successful evaluation should become a credential
-artifact, such as an SD-JWT VC. Credential bodies are sensitive. Do not log
-them, and note that Rust redacts credential bodies from `Debug`.
-
-The evaluation must be newly created from non-delegated registry-backed claims
-and retain an exact compiler pin for every claim in each selected root's
-dependency closure, plus one execution record for every unique Relay
-consultation ULID. Delegated and older stored evaluations remain renderable but
-are not issuable unless the configured representative ceremony applies.
-Re-evaluate after upgrading before calling
-either the direct issuance or OID4VCI credential endpoint.
-
-```python
-credential = client.issue_credential_request({
-    "evaluation_id": "eval-1",
-    "credential_profile": "person_is_alive_sd_jwt",
-})
-```
-
-```js
-const credential = await client.issueCredentialRequest({
-  evaluation_id: "eval-1",
-  credential_profile: "person_is_alive_sd_jwt",
-});
-```
-
-```rust
-use registry_notary_core::CredentialIssueRequest;
-
-let credential = client
-    .issue_credential_request(
-        CredentialIssueRequest {
-            evaluation_id: "eval-1".to_string(),
-            credential_profile: None,
-            format: None,
-            claims: None,
-            disclosure: None,
-            holder: None,
-        },
-        RequestOptions::builder()
-            .purpose("benefits_eligibility")
-            .build(),
-    )
-    .await?;
-```
-
-### Discovery and JWKS
-
-Use discovery for claim catalogs, service metadata, and issuer keys. The JWKS
-helpers use a short in-process cache when called without request options.
-`raw_issuer_jwks` or `rawIssuerJwks` bypasses that cache.
-
-```python
-claims = client.list_claims()
-claim = client.get_claim("person-is-alive")
-service = client.service_document()
-jwks = client.issuer_jwks()
-client.refresh_jwks()
-key = client.get_jwk("key-1")
-```
-
-```js
-const claims = await client.listClaims();
-const claim = await client.getClaim("person-is-alive");
-const service = await client.serviceDocument();
-const jwks = await client.issuerJwks();
-await client.refreshJwks();
-const key = await client.getJwk("key-1");
-```
-
-```rust
-let service = client.service_document(RequestOptions::default()).await?;
-let jwks = client.issuer_jwks(RequestOptions::default()).await?;
-
-// Force refresh after an unknown kid during verification.
-let refreshed = client.refresh_jwks(RequestOptions::default()).await?;
-```
-
-### Credential status
-
-```python
-status = client.credential_status("credential-1")
-```
-
-```js
-const status = await client.credentialStatus("credential-1");
-```
-
-```rust
-let status = client
-    .credential_status("credential-1", RequestOptions::default())
-    .await?;
-
-let updated = client
-    .update_credential_status("credential-1", "revoked", RequestOptions::default())
-    .await?;
-```
-
-### OID4VCI
-
-The client wraps issuer metadata and the credential endpoint. It does not start
-the browser login, redeem a pre-authorized code, generate holder proofs, or
-manage holder keys. Start the issuer-initiated journey at
-`/oid4vci/offer/start` and let the wallet redeem the rendered offer. Call the
-credential helper only after the wallet has a Notary access token and the
-transaction-bound proof nonce returned by the token response.
-
-```python
-metadata = client.oid4vci_issuer_metadata()
-credential = client.oid4vci_credential({
-    "credential_configuration_id": "person_is_alive_sd_jwt",
-    "proof": {"proof_type": "jwt", "jwt": "eyJ..."},
-})
-```
-
-```js
-const metadata = await client.oid4vciIssuerMetadata();
-const credential = await client.oid4vciCredential({
-  credential_configuration_id: "person_is_alive_sd_jwt",
-  proof: { proof_type: "jwt", jwt: "eyJ..." },
-});
-```
-
-In Rust, enable the `oid4vci` feature:
-
-```toml
-registry-notary-client = {
-  git = "https://github.com/registrystack/registry-stack",
-  tag = "vX.Y.Z",
-  features = ["oid4vci"]
-}
-```
-
-```rust
-let metadata = client
-    .oid4vci_issuer_metadata(RequestOptions::default())
-    .await?;
-```
-
-### Federation
-
-The client submits an already-signed JWT. It does not mint or sign federation
-requests.
-
-```python
-response_jws = client.federation_evaluate_jws("eyJ...")
-```
-
-```js
-const responseJws = await client.federationEvaluateJws("eyJ...");
-```
-
-In Rust, enable the `federation` feature:
-
-```toml
-registry-notary-client = {
-  git = "https://github.com/registrystack/registry-stack",
-  tag = "vX.Y.Z",
-  features = ["federation"]
-}
-```
-
-```rust
-let compact_response_jws = client
-    .federation_evaluate_jws("eyJ...", RequestOptions::default())
-    .await?;
-```
-
-## Production checklist
-
-### Base URL
-
-Use the service root URL. A path prefix is allowed and is preserved when routes
-are joined.
-
-Clients require HTTPS for non-loopback hosts. Rust allows HTTP loopback only in
-debug or `test-support` builds. Python and Node local workflows may use
-`http://127.0.0.1`, `http://localhost`, or `http://[::1]`.
-
-Python also exposes an explicit lab/internal escape hatch for Docker Compose
-and private service-network deployments:
-
-```python
-client = RegistryNotaryClient(
-    base_url="http://registry-notary:8080",
-    default_purpose="benefits_eligibility",
-    allow_insecure_internal_http=True,
-)
-```
-
-Use `allow_insecure_internal_http=True` only when transport is already
-protected by the deployment boundary or a local development network. Production
-service URLs should remain HTTPS.
-
-### Request metadata
-
-Request options support:
-
-- `purpose`, mapped to `Data-Purpose`.
-- `request_id` or `requestId`, mapped to `X-Request-Id`.
-- `traceparent`, mapped to W3C trace context.
-- `idempotency_key` or `idempotencyKey`, mapped to `Idempotency-Key` only for
-  batch evaluation.
-- `accept`, for Rust, JSON facade, and selected Python request helpers that
-  need an explicit `Accept`. Node does not expose a public accept override.
-
-### Retry contract
-
-Retries are disabled by default. When enabled, they are route-aware:
-
-- GET routes may retry transport errors, 429, or 503 according to the policy.
-- `POST /v1/batch-evaluations` may retry only when an `Idempotency-Key` is
-  supplied.
-- Evaluation, render, credential issuance, OID4VCI credential, and federation
-  submission are never retried because those POST routes are not deduplicated by
-  the server.
-
-`Retry-After` seconds are honored. Rust, Python, and Node also handle HTTP-date
-`Retry-After` by using the response `Date` header as the reference clock when it
-is present.
-
-### Response metadata
-
-All typed Rust methods return `NotaryResponse<T>` with:
-
-- `body`: decoded response body.
-- `status`: HTTP status returned by the server.
-- `request_id`: server `X-Request-Id`, when present.
-- `retry_after`: server `Retry-After`, when present.
-
-Python and Node expose equivalent fields on errors. Successful Python and Node
-helpers return the response body directly.
-
-### Error handling and redaction
-
-Rust returns `NotaryClientError`. Python and Node expose:
-
-- `NotaryError`
-- `NotaryTransportError`
-- `NotaryProblemError`
-
-Safe fields for logs are `status`, `code`, `title`, `retryable`, and
-`request_id`. Do not log raw request bodies, requester or target identifiers,
-holder proofs, credential bodies, SD-JWT disclosures, nonces, Authorization,
-`X-Api-Key`, or Problem Details `detail`.
-
-Problem detail strings are not exposed by the Python wrapper. The Rust
-`portable()` error envelope is intended for language bindings and FFI. It
-intentionally excludes sensitive detail strings.
-
-The stable application problem `code` categories for policy mapping live in the
-[problem categories in the API reference](api-reference.md#problem-categories).
-
-### Troubleshooting
-
-| Symptom | Likely cause | Check |
-| --- | --- | --- |
-| `401` | Missing, expired, or wrong auth credential | Token/API key source and configured auth mode |
-| `403` | Credential lacks a claim's `required_scope` | `list_claims`, operator scope mapping |
-| Client rejects before send | Body `purpose` and header/default purpose differ | Request body and client options |
-| Batch did not retry | Missing idempotency key or retry policy disabled | `idempotency_key`/`idempotencyKey`, retry settings |
-| Render request fails | `evaluation_id` missing or empty | Use an id from a previous evaluation result |
-| Unknown signing key | JWKS cache does not have the `kid` | `refresh_jwks`/`refreshJwks` or Rust verifier refresh path |
-
-## Runtime reference
-
-### Rust features
-
-Enable optional routes only when needed:
-
-```toml
-registry-notary-client = {
-  git = "https://github.com/registrystack/registry-stack",
-  tag = "vX.Y.Z",
-  features = ["oid4vci", "federation", "json-facade"]
-}
-```
-
-In a workspace checkout, the same feature selection can use path dependencies:
-
-```toml
-registry-notary-client = {
-  path = "crates/registry-notary-client",
-  features = ["oid4vci", "federation", "json-facade"]
-}
-```
-
-### Rust JSON facade
-
-Enable `json-facade` when building language wrappers. The facade accepts and
-returns canonical wire JSON with snake_case fields.
-
-```rust
-use registry_notary_client::facade::NotaryClientHandle;
-
-let handle = NotaryClientHandle::new(client);
-let response = handle
-    .evaluate_json(
-        serde_json::json!({
-            "target": {
-                "type": "Person",
-                "identifiers": [{
-                    "scheme": "national_id",
-                    "value": "person-1",
-                    "issuer": "civil_registry"
-                }]
-            },
-            "relationship": { "type": "self" },
-            "claims": ["person-is-alive"],
-            "purpose": "benefits_eligibility"
-        }),
-        serde_json::json!({})
-    )
-    .await?;
-```
-
-### Rust credential verification
-
-Enable the Rust `verifier` feature when relying-party or wallet code needs to
-verify SD-JWT VC credential material. Verification is explicit and opt-in:
-transport methods continue to return decoded response bodies without hidden
-network refreshes or trust-policy decisions.
-
-```toml
-registry-notary-client = {
-  git = "https://github.com/registrystack/registry-stack",
-  tag = "vX.Y.Z",
-  features = ["verifier"]
-}
-```
-
-```rust
-use registry_notary_client::{HolderBindingPolicy, VerifyOptions};
-
-let options = VerifyOptions::new("did:web:notary.example")
-    .expected_vct("https://credentials.example/vct/person-is-alive")
-    .holder_binding(HolderBindingPolicy::Required);
-
-let verified = client
-    .verify_credential_response(&credential.body, options)
-    .await?;
-```
-
-The verifier resolves the JWS `kid` only from trusted issuer JWKS, reuses the
-client's short JWKS TTL cache, and forces one refresh on `key.unknown`. It does
-not loop indefinitely. `VerifyOptions` lets callers set expected issuer,
-accepted algorithms, expected `vct`, clock skew, and holder-binding policy.
-
-Selective-disclosure presentations may include a subset of disclosures. Each
-presented disclosure must hash to a digest in the credential. When a
-presentation includes a key-binding JWT, the verifier separates it from
-disclosures and verifies its holder proof signature against the credential
-`cnf.jwk`. When required holder binding is paired with
-`VerifyOptions::key_binding_challenge`, the trailing key-binding JWT is
-mandatory and must match the expected audience and nonce.
-
-Verifier errors are redacted and safe for policy mapping by code. Stable codes
-include `signature.invalid`, `key.unknown`, `algorithm.disallowed`,
-`claim.issuer_mismatch`, `claim.vct_mismatch`, `claim.time_invalid`,
-`disclosure.digest_mismatch`, `holder_binding.required`,
-`holder_binding.kid_mismatch`, and `holder_binding.proof_invalid`.
-
-Python and Node do not expose verifier wrappers. Callers in
-those runtimes should use the Rust verifier through their application boundary
-or perform verification in wallet-specific code.
-
-### Python async helpers
-
-Async evaluation helpers are prefixed with `a`, for example `aevaluate` and
-`aevaluate_request`. The package also exposes async forms for batch evaluation,
-rendering, and credential issuance:
-
-```python
-result = await client.aevaluate_request({
-    "claims": ["person-is-alive"],
-    "disclosure": "predicate",
-})
-```
-
-### Node abort signals
-
-Node request helpers accept `signal` in request options. The high-level
-`evaluate` and `batchEvaluate` helpers also accept `signal` on the request
-object for convenience.
-
-```js
-const controller = new AbortController();
-
-const result = await client.evaluate({
-  target: { type: "Person", identifiers: [{ scheme: "national_id", value: "person-1" }] },
-  claims: ["person-is-alive"],
-  signal: controller.signal,
-});
-```
-
-### Discovery, status, OID4VCI, federation
-
-```js
-const claims = await client.listClaims();
-const claim = await client.getClaim("person-is-alive");
-const jwks = await client.issuerJwks();
-await client.refreshJwks();
-const key = await client.getJwk("key-1");
-const status = await client.credentialStatus("credential-1");
-
-const metadata = await client.oid4vciIssuerMetadata();
-
-const responseJws = await client.federationEvaluateJws("eyJ...");
-```
-
-### Node errors
-
-```js
-import { NotaryProblemError, NotaryTransportError } from "@registry-notary/client";
-
-try {
-  await client.evaluate({
-    target: { type: "Person", identifiers: [{ scheme: "national_id", value: "person-1" }] },
-    relationship: { type: "self" },
-    claims: ["person-is-alive"],
-  });
-} catch (error) {
-  if (error instanceof NotaryProblemError) {
-    console.log(error.status, error.code, error.requestId);
-  } else if (error instanceof NotaryTransportError) {
-    console.log("transport failure");
-  }
-}
-```
-
-## API method matrix
-
-The route families used by each runtime are listed under
-[main surfaces in the API reference](api-reference.md#main-surfaces).
diff --git a/products/notary/docs/configuration-trust-and-integrity.md b/products/notary/docs/configuration-trust-and-integrity.md
deleted file mode 100644
index 8b7406423..000000000
--- a/products/notary/docs/configuration-trust-and-integrity.md
+++ /dev/null
@@ -1,69 +0,0 @@
-# Configuration trust and integrity
-
-Registry-backed evidence relies on two related checks: semantic contract
-agreement between Relay and Notary, and deployment integrity for the files an
-operator activates.
-
-## Semantic consultation agreement
-
-The project compiler produces one public Relay consultation contract and one
-public `contract_hash`. The contract covers purpose, inputs, outcomes, outputs,
-provenance, runtime requirements, and applicable limits. Notary independently
-validates the complete expected contract during startup and readiness, then
-includes the exact hash on every execute request. Relay rejects a mismatch
-before source access.
-
-The hash is not a substitute for semantic validation. It is a content identity
-for the compiler-produced contract, not an author-maintained version or a
-product-specific adapter digest.
-
-## Runtime credentials
-
-Notary holds only its Relay workload credential. Keep the token in an
-owner-readable file and rotate it by atomically replacing that file. Registry
-destinations, source credentials, private CA material, mTLS keys, and protocol
-credentials belong to Relay's private environment binding.
-
-Never place secret values in authored project files, generated review reports,
-diagnostics, logs, audit records, fixture traces, or deployment manifests.
-
-## Deployment activation
-
-Relay and Notary use separate product bundles. Build, sign, verify, and track
-anti-rollback state for each product bundle independently. At boot, each
-runtime verifies and activates only its own bundle. Current source does not
-produce or verify a signed project-root bundle, and no Registry Stack
-coordinator atomically activates both products.
-
-Use compatible staged activation for a combined topology:
-
-1. Verify the Relay bundle and the Notary bundle independently, including each
-   signature, product identity, sequence, and anti-rollback state.
-2. Start or stage Relay without admitting caller traffic. Require its health,
-   readiness, audit, and deployment-posture checks to pass.
-3. Start or stage Notary against that Relay. Require Notary startup and
-   readiness to validate its complete expected Relay consultation contract,
-   then require Notary health, audit, and deployment-posture checks to pass.
-4. Admit caller traffic only after both products are ready and the Notary-to-
-   Relay contract check succeeds.
-
-This is not atomic project activation. The deployment platform controls traffic
-admission around two product-owned boot boundaries. During execute, Notary
-sends the exact `contract_hash`; an execute-time contract mismatch is rejected
-by Relay before source access.
-
-A future project-root packaging or coordination mechanism remains deferred
-under [registry-stack issue #361](https://github.com/registrystack/registry-stack/issues/361).
-Do not claim root-signature verification or a project activation coordinator
-that current runtimes cannot prove.
-
-## Review checklist
-
-- Review the generated semantic delta and effective authority.
-- Verify Relay and Notary expect the same contract and platform requirements.
-- Keep service policy and source authority in their owning products.
-- Verify secret references without reading or printing their values.
-- Keep caller traffic blocked while Relay and Notary are staged separately.
-- Admit traffic only after both products report ready and Notary validates its
-  Relay contract.
-- Preserve separate Relay and Notary audit keys and chains.
diff --git a/products/notary/docs/credential-issuance-migration.md b/products/notary/docs/credential-issuance-migration.md
deleted file mode 100644
index da1fdd71c..000000000
--- a/products/notary/docs/credential-issuance-migration.md
+++ /dev/null
@@ -1,123 +0,0 @@
-# Credential issuance trust-boundary migration
-
-> **Page type:** How-to · **Product:** Registry Notary · **Layer:** credential · **Audience:** operator, integrator
-
-Registry Notary now issues credentials only from a stored evaluation whose
-selected claims were produced by fresh, exact compiler-pinned Registry Relay
-consultations. This applies to `POST /v1/credentials` and
-`POST /oid4vci/credential`.
-
-## Removal of caller-provided evidence
-
-The `self_attested` evidence mode has been removed. It is not an
-evaluation-only compatibility mode. Configuration containing
-`evidence_mode.type: self_attested` is rejected.
-
-To migrate:
-
-1. Remove claims that have no authoritative evidence source.
-2. For retained claims, declare exactly one compiler-pinned Relay
-   consultation and derive the result only from its typed outputs.
-3. Rename the authorization wire value `delegated_attestation` to
-   `delegated_subject_access`.
-4. Rename the access scope `evidence:self_attest` to
-   `evidence:subject_access`.
-5. Regenerate configuration and restart Notary.
-
-OIDC identity, authorization details, subject binding, and representative
-policy remain access controls. They must not be treated as claim provenance.
-
-The OID4VCI surface also changes to issuer-initiated pre-authorized code only.
-Remove integrations that call the former credential-offer or public nonce
-routes, or that treat an identity-provider authorization code as a wallet
-grant. The corresponding Rust `oid4vci_credential_offer` and `oid4vci_nonce`,
-Node.js `oid4vciCredentialOffer` and `oid4vciNonce`, and Python
-`oid4vci_credential_offer` and `oid4vci_nonce` client helpers are also removed.
-Start the browser journey at `GET /oid4vci/offer/start`, import the offer
-rendered after the callback, redeem its pre-authorized code at
-`POST /oid4vci/token`, and use the proof nonce from that token response. The
-issuer metadata no longer contains `nonce_endpoint`, and the credential
-response no longer returns a next nonce.
-
-## Configuration changes
-
-Before upgrading, inspect every credential profile, every
-`subject_access.allowed_claims` entry used by credential capability, and every
-OID4VCI projection:
-
-- Each selected claim must use `registry_backed` evidence.
-- A profile and its claims must name each other consistently.
-- OID4VCI claims and projections must resolve through those same
-  registry-backed profile bindings.
-- Remove claims without compiler-pinned Relay evidence.
-- Remove legacy `credential_profiles` entries from delegated relationships.
-  Representative OID4VCI issuance is configured on the credential
-  configuration instead and requires the digitally authenticated
-  representative ceremony, one named relationship, and live credential
-  status.
-- Keep other delegated claims evaluation-only. Direct issuance and OID4VCI
-  configurations without the representative ceremony reject delegated
-  evaluations.
-
-Configuration load rejects a mixed or one-sided binding. The diagnostic names
-the invalid credential claim binding and the required remediation.
-
-## Stored evaluation compatibility
-
-Existing stored evaluations remain readable and renderable. Records without
-the private issuance provenance and per-claim execution binding introduced by
-this release cannot be used to issue a credential. Re-evaluate the
-registry-backed claim under the active configuration, then retry issuance with
-the new evaluation id.
-
-Notary retains this restricted provenance only when all selected roots share a
-mutually validated credential profile. Registry-backed evaluation-only claims
-remain evaluatable and renderable but store no private Relay consultation ids
-or acquisition times.
-
-For every claim in each selected root's executed registry-backed dependency
-closure, the new evaluation stores one private compiler-pin record containing
-the claim id and version, Relay profile id and contract hash, canonical purpose,
-and executed consultation ULID. A separate normalized execution record stores
-each unique consultation ULID and acquisition time once, including when one
-coalesced Relay execution supports several claims. Each claim pin also carries
-an unkeyed SHA-256 execution binding over the compiler pin, execution ULID and
-acquisition time, evaluation and result time, and exact claim provenance. Each public root result's
-`relay_consultation_count` must equal the number of unique executed ULIDs in
-that root's closure. Missing, duplicate, extra, stale, or modified claim pins or
-execution records are denied before signer access, signing, credential
-identifiers, or status writes.
-Direct issuance performs this check before holder-proof replay mutation. The
-OID4VCI callback creates the registry-backed transaction and completes the
-Relay evaluation before it renders an offer. The credential endpoint rejects
-incomplete Relay provenance, consumes the transaction-bound proof nonce, reloads
-the stored transaction and evaluation, and verifies exact provenance before
-signer access.
-
-The execution binding detects partial stored-record mutation, including a
-changed acquisition time or consultation ids swapped between claims. It is not
-a keyed authenticity proof and does not protect against an operator who can
-rewrite every committed field and recompute the digest. Protect the evaluation
-store with the deployment's database access controls, audit, and backup
-controls.
-
-This is an application-data compatibility change only. It introduces no
-database migration, DDL change, or correctness-state schema fingerprint
-change.
-
-## Rollout
-
-1. Regenerate the project configuration and correct any credential-binding
-   validation errors.
-2. Remove claims without Relay evidence. Retain delegated credential journeys
-   only when they use the representative OID4VCI ceremony.
-3. Deploy compatible Relay and Notary configuration from one project
-   generation.
-4. Re-evaluate claims used by in-progress credential journeys.
-5. Replace wallet authorization-code, public nonce, and next-nonce assumptions
-   with the pre-authorized transaction flow.
-6. Exercise both direct and OID4VCI issuance and confirm the Relay receives the
-   exact configured profile, purpose, and contract hash.
-
-Do not copy provenance from an old evaluation or retry with an edited stored
-record. Re-evaluation is the supported recovery path.
diff --git a/products/notary/docs/credential-lifecycle-status.md b/products/notary/docs/credential-lifecycle-status.md
deleted file mode 100644
index bd0521a58..000000000
--- a/products/notary/docs/credential-lifecycle-status.md
+++ /dev/null
@@ -1,255 +0,0 @@
-# Credential lifecycle and status
-
-> **Page type:** How-to · **Product:** Registry Notary · **Layer:** credential · **Audience:** operator
-
-Registry Notary issues SD-JWT VC credentials with explicit expiry. Live
-credential status is optional. This guide explains the default lifecycle, when
-to enable status, what status means, and how to run it.
-
-## Default lifecycle
-
-By default, issued credentials are status-free:
-
-- No `status` claim is added to the SD-JWT VC payload.
-- No revocation list or status-list profile is published.
-- Verifiers rely on issuer trust, holder binding, and credential expiry.
-- Credential profiles default to 600 seconds of validity when
-  `validity_seconds` is omitted; set an explicit validity period that matches
-  the use case for wallet-facing profiles.
-
-The top-level `evidence.max_credential_validity_seconds` sets the issuing
-agency's local ceiling, and profile validity must be between 1 second and that
-maximum. Subject access profiles are also bounded by
-`subject_access.token_policy.max_credential_validity_seconds`.
-
-This lets operators keep offer codes, access tokens, proofs, and evidence
-freshness short while issuing wallet-held credentials with a practical validity
-window. Enable live status or another revocation/lifecycle surface for
-deployments that need longer-lived credentials.
-
-## When to enable status
-
-Enable credential status when verifiers need to check a live lifecycle state
-after issuance, for example:
-
-- A credential may need temporary suspension.
-- A credential may need revocation before its expiry.
-- A verifier policy requires live issuer status.
-- An operator wants a bounded audit trail for lifecycle actions.
-
-Do not enable status only because it is familiar from other credential systems.
-It adds an online dependency for verifiers and creates an operational store that
-must be kept available for the retention window.
-
-Representative OID4VCI issuance requires status because Registry Notary does
-not re-run relationship evidence during wallet redemption. Status is the
-compensating control for relationship changes after issuance. Operators can
-revoke a credential now; automatic source relationship change delivery is
-tracked by [GH#568](https://github.com/registrystack/registry-stack/issues/568).
-Status configuration alone does not create that delivery path.
-
-## Configuration
-
-```yaml
-credential_status:
-  enabled: true
-  base_url: https://notary.example.gov
-  retention_seconds: 86400
-```
-
-Fields:
-
-- `enabled`: adds status records during issuance and includes a status claim in
-  issued credentials.
-- `base_url`: public HTTPS origin used to build status URLs. Use plain HTTP only
-  for local or lab deployments.
-- `retention_seconds`: how long status records are retained.
-
-Credential status uses the global `state` backend. Production and
-multi-instance deployments use the Notary-owned PostgreSQL state schema. An
-explicit local, single-instance configuration can use `state.storage:
-in_memory`, which loses status rows on restart.
-
-## Credential payload
-
-When status is enabled, issued SD-JWT VC payloads include the IETF Token Status
-List `status.status_list` claim. The status-list URI is anchored at the public
-base URL:
-
-```json
-{
-  "status": {
-    "status_list": {
-      "idx": 0,
-      "uri": "https://notary.example.gov/v1/credentials/urn:ulid:01HX.../status"
-    }
-  }
-}
-```
-
-Registry Notary uses one status-list token per credential in this profile. The
-same URL returns a signed `application/statuslist+jwt` token when requested with
-`Accept: application/statuslist+jwt`, and retains the JSON lifecycle response
-for operational compatibility.
-
-`status` is a reserved top-level credential claim. It cannot be configured as a
-selectively disclosable OID4VCI projection, so a holder cannot remove the live
-status requirement while presenting the credential.
-
-## Status values
-
-The public status response can report:
-
-| Status | Meaning |
-| --- | --- |
-| `valid` | The credential has an active status record and is not expired. |
-| `suspended` | The operator has temporarily disabled the credential. |
-| `revoked` | The operator has permanently revoked the credential. |
-| `expired` | The credential lifetime has passed. This can be derived from the stored expiry. |
-
-Only `valid`, `suspended`, and `revoked` are mutable lifecycle states. `expired`
-is derived from time.
-
-```mermaid
-stateDiagram-v2
-  [*] --> valid: issuance creates status record
-  valid --> suspended: admin suspend
-  suspended --> valid: admin reinstate
-  valid --> revoked: admin revoke
-  suspended --> revoked: admin revoke
-  valid --> expired: validity window passes
-  suspended --> expired: validity window passes
-  revoked --> [*]
-  expired --> [*]
-
-  note right of revoked
-    Permanent, no return path
-  end note
-  note right of expired
-    Derived from stored expiry,
-    not an admin action
-  end note
-```
-
-*Credential status lifecycle. Admin mutation moves a credential between `valid`,
-`suspended`, and `revoked`; `expired` is derived from the stored expiry rather
-than set by an operator.*
-
-## Privacy boundary
-
-Status records intentionally contain lifecycle metadata only:
-
-- Credential id.
-- Issuer or service metadata needed by Notary.
-- Credential profile id.
-- Issued-at and expires-at timestamps.
-- Last-updated timestamp.
-- Current lifecycle status.
-
-Status records must not contain:
-
-- Subject ids.
-- Holder DIDs or holder public keys.
-- Claim values.
-- SD-JWT disclosures.
-- Source rows.
-- Raw access tokens or proof JWTs.
-
-This lets a verifier check lifecycle state without turning the status store into
-a second registry of personal data.
-
-## Status operations
-
-Status operations are exposed as:
-
-- Public status retrieval at the credential's status URL.
-- Admin status mutation for operators with `registry_notary:admin`.
-
-Use the SDK methods where possible so your integration does not depend on route
-names directly:
-
-- Rust: `credential_status(...)` and `update_credential_status(...)`.
-- Node.js and Python wrappers expose only the read-only status lookup
-  (`credentialStatus` / `credential_status`); the admin status mutation is
-  available via Rust or HTTP only.
-
-Admin mutation accepts a new status value of `valid`, `suspended`, or
-`revoked`.
-
-## Operational model
-
-Credential issuance creates the status record after the credential id and
-expiry are known. If the status store cannot write the record, issuance fails
-closed: Notary returns an issuance error instead of a credential that
-references a missing live status URL.
-
-Treat status retrieval as public verifier traffic. Status mutation is an
-admin operation; limit it to trusted operator tooling.
-
-Readiness fails when the PostgreSQL state backend is unavailable or its schema,
-role, write authority, or durability contract cannot be attested. That is
-preferable to issuing status-bearing credentials that cannot be checked or
-updated reliably.
-
-## Retention
-
-Set `retention_seconds` to cover:
-
-- Maximum credential validity.
-- Expected verifier clock skew.
-- Any grace period required by the relying party.
-- Audit or dispute window for lifecycle actions.
-
-For the current 600-second credential ceiling, 24 hours is usually enough for
-test and pilot deployments. Production policies may require longer status
-retention even though the credential itself is short lived.
-
-Do not shorten retention while outstanding credentials still reference status
-URLs unless verifiers have agreed to treat missing status records as expired or
-invalid.
-
-## Verifier policy
-
-Make verifier policy explicit:
-
-- Accept status-free credentials only from profiles that are expected to be
-  status-free.
-- For status-bearing credentials, fetch the `status.status_list.uri` with
-  `Accept: application/statuslist+jwt` only when its origin exactly matches the
-  verifier's configured trusted HTTPS status origin. Validate the signed token,
-  issuer, type, lifetime, index, and require the indexed value to be `0x00`
-  (`VALID`).
-- Fail closed on `0x01` (`INVALID`), `0x02` (`SUSPENDED`), missing status,
-  malformed status, an untrusted origin, or network failure. A status-bearing
-  credential is not valid when its live status cannot be verified.
-- Apply credential expiry even when status returns `valid`.
-
-Registry Notary does not currently publish aggregated status lists or external
-revocation-list profiles. The supported status profile is documented in
-[`sd-jwt-vc-conformance-profile.md`](sd-jwt-vc-conformance-profile.md).
-
-## Rollout checklist
-
-- Confirm every credential profile that needs status is issued by a deployment
-  with `credential_status.enabled: true`.
-- Confirm `credential_status.base_url` is the public issuer URL verifiers can
-  reach.
-- Install and attest the Notary-owned PostgreSQL state schema before serving.
-- Back up status rows with the rest of the Notary correctness state.
-- Confirm `/ready` fails when the status backend is unavailable.
-- Run one credential issuance and verify the payload has a status URL.
-- Fetch that status URL and confirm `valid`.
-- Mutate a test credential to `suspended` or `revoked` with an admin credential.
-- Confirm audit records exist for issuance and mutation without raw personal
-  data.
-
-## Troubleshooting
-
-| Symptom | Likely cause | Check |
-| --- | --- | --- |
-| Issued credential has no status claim | `credential_status.enabled` is false in the issuing deployment | Check expanded config |
-| Status URL points at localhost | `credential_status.base_url` was copied from a local config | Set public HTTPS base URL |
-| Status is missing after restart | `state.storage: in_memory` was used | Install and use PostgreSQL correctness state |
-| Admin update is unauthorized | Missing `registry_notary:admin` scope | Check caller scopes or OIDC scope mapping |
-| Verifier sees `expired` quickly | Profile validity is short or clocks differ | Check `validity_seconds`, verifier clock, and expiry policy |
-| Readiness fails after enabling status | PostgreSQL is unavailable or state attestation failed | Run `registry-notary state doctor` and check the named state configuration field |
diff --git a/products/notary/docs/deployment-hardening-runbook.md b/products/notary/docs/deployment-hardening-runbook.md
deleted file mode 100644
index 6d2aadf49..000000000
--- a/products/notary/docs/deployment-hardening-runbook.md
+++ /dev/null
@@ -1,142 +0,0 @@
-# Deployment hardening runbook
-
-## Before deployment
-
-- Generate product inputs from one reviewed Registry Stack project.
-- Confirm the topology is Relay-only, Notary-only, or combined as intended.
-- For combined deployments, verify Notary and Relay expect the same semantic
-  consultation contracts and hashes.
-- Build, sign, and verify the Relay and Notary product bundles separately.
-  Preserve separate anti-rollback state and signed-bundle acceptance evidence
-  for each product.
-- Keep source destinations and credentials only in Relay's private environment.
-- Keep the Notary workload token, signing keys, audit secret, and store
-  credentials in mounted secret files or an approved secret manager.
-
-## Network boundary
-
-Expose only the public Notary listener to application callers. Put admin routes
-and metrics on the dedicated operator listener, restrict it at the network
-layer, and require the configured operator scopes. A combined deployment
-permits Notary to reach only its project's Relay. Notary requires no path to a
-registry source.
-
-For a private Relay, admit only exact reviewed CIDRs and retain the platform's
-always-denied metadata, loopback, link-local, multicast, and unspecified
-address protections. Use TLS in deployed environments.
-
-## Authentication and authorization
-
-- Configure one supported caller authentication mode and fail closed on missing
-  credentials.
-- Review purpose, legal basis, scopes, relationship, and disclosure together.
-- For subject access, pin issuer, audience, client, algorithm, token lifetime,
-  and exact subject binding.
-- For delegated requests, require exact authorization details and proof policy
-  before any Relay call.
-
-## State
-
-Install the typed Notary-owned PostgreSQL correctness-state schema for every
-production or multi-instance deployment. Run `state doctor` with the restricted
-runtime role before admitting traffic. Back up the complete database, role
-provisioning, migration set, and sensitive-state key version with their owning
-release. Do not share Relay tables, Notary schemas, audit keys, or audit chains.
-
-## Audit and diagnostics
-
-Ship Notary's redacted keyed audit chain to the approved retention system. Keep
-access to Notary and Relay audit sinks restricted. Correlate them only through
-the bounded evaluation and consultation identifiers.
-
-Review diagnostics and logs for accidental disclosure. They must not contain
-tokens, secret paths, selectors, request bodies, source responses, claim
-values, credential material, or script values.
-
-### Recover an inconsistent audit chain
-
-Registry Notary verifies the retained audit chain during runtime activation.
-A confirmed chain fork or verification failure keeps `/ready` at `503` with
-the code `audit.chain.inconsistent`; `/healthz` remains a process-liveness
-probe. The readiness response does not expose audit records, paths, hashes, or
-verification details.
-
-Recovery is an offline operator action. Registry Notary does not repair the
-chain automatically at startup.
-
-1. Stop the Registry Notary process and confirm that no replacement process
-   holds the audit volume's single-writer lock.
-2. Preserve the audit volume and the off-host copy according to the incident
-   evidence procedure.
-3. Run the quarantine command with the same configuration and secret sources
-   used by the stopped process:
-
-   ```sh
-   registry-notary audit quarantine \
-     --config <generated-notary.yaml> \
-     --reason "<incident-or-change-reference>" \
-     --operator "<operator-id>"
-   ```
-
-4. Retain every file named with the reported `corrupt-<timestamp>` suffix.
-   The command moves the retained chain aside and starts a new segment with a
-   keyed `audit.chain.break` record linked to the last verified local record.
-5. Start Registry Notary, then verify `/ready` before admitting traffic.
-
-The command refuses to run against `stdout` or `syslog`, and it refuses to run
-while the server owns the file sink lock. A signed-bundle acceptance record
-must still be written before bundle state is persisted or traffic is served.
-An audit failure during that write aborts the governed boot.
-
-## Signing keys
-
-Approve custody for every credential, access-token, or federation signing role
-before declaring production readiness. Provider kind is not proof of custody.
-Rotate with a new key id and governed project/configuration change unless a
-documented same-identity file refresh is specifically supported.
-
-## Rollout
-
-Combined rollout is compatible staging across two product-owned bundle
-boundaries, not atomic project activation. Current source has no signed
-project-root deployment bundle and no coordinator that activates Relay and
-Notary together.
-
-1. Verify both signed product bundles and their independent anti-rollback
-   state before starting either replacement.
-2. Start or stage Relay without admitting caller traffic. Require Relay health,
-   readiness, audit, and deployment-posture checks to pass.
-3. Start or stage Notary against the ready Relay. Require Notary startup and
-   readiness to validate its complete expected Relay consultation contract,
-   and require every configured CEL worker to pass its pool-wide bounded
-   protocol probe and remain live through activation. Then require Notary
-   health, audit, and deployment-posture checks to pass.
-4. Admit caller traffic only after both products are ready and the contract
-   check succeeds.
-
-For drain-and-restart, stop new traffic and drain active work before the same
-ordered restart. A contract mismatch during execute is rejected by Relay
-before source access. Do not restore traffic merely because both processes are
-live. `notary.cel.worker_unavailable` means the adjacent worker artifact,
-execution permission, supported platform, resource ceiling, or protocol must
-be corrected before traffic returns.
-
-Run:
-
-```sh
-registry-notary explain-config --config generated-notary.yaml
-registry-notary doctor --config generated-notary.yaml
-registry-notary --config generated-notary.yaml state doctor
-registry-notary doctor --config generated-notary.yaml --live
-```
-
-Then execute the project's offline fixtures and approved end-to-end journey.
-Never load secrets through command-line values or retain them in test evidence.
-
-## Incident response
-
-If a workload credential, signing key, caller credential, or audit secret may
-be exposed, revoke or rotate it first, stop affected traffic, preserve redacted
-audit evidence, verify and stage compatible Relay and Notary product bundles,
-and restore traffic only after both are ready. Do not restore a direct source
-path as a recovery mechanism.
diff --git a/products/notary/docs/federated-evaluation-operator-guide.md b/products/notary/docs/federated-evaluation-operator-guide.md
deleted file mode 100644
index 6556b144a..000000000
--- a/products/notary/docs/federated-evaluation-operator-guide.md
+++ /dev/null
@@ -1,195 +0,0 @@
-# Federated evaluation operator guide
-
-> **Page type:** How-to · **Product:** Registry Notary · **Layer:** federation · **Audience:** operator
-
-This guide shows the minimum static-peer setup for delegated evaluation.
-It covers static peer configuration, inbound request verification, and the
-documented limits of the current implementation: no outbound Notary connector,
-no dynamic trust registration, and explicit in-memory state suitable for local,
-single-process development only.
-
-## What this enables
-
-One trusted Notary can call another trusted Notary:
-
-```text
-Agency B -> signed request JWT -> Agency A /federation/v1/evaluations
-Agency B <- signed response JWT <- Agency A
-```
-
-The serving Notary verifies the request, enforces local peer policy, evaluates
-an admitted registry-backed claim only after policy passes, emits audit, and
-returns a signed result.
-
-```mermaid
-sequenceDiagram
-  participant B as Agency B (requesting Notary)
-  participant A as Agency A (serving Notary)
-  participant Relay as Registry Relay
-  participant Audit as Audit sink
-
-  B->>A: POST /federation/v1/evaluations (signed request JWT)
-  A->>A: Verify signature, audience, time window, profile, purpose, replay, denylist, body limit
-  A->>Relay: Evaluate admitted registry-backed claim using request jti
-  Relay-->>A: Minimized evidence
-  A->>Audit: Chained audit record
-  A-->>B: Signed response JWT, or signed error, or Problem Details denial
-```
-
-*The delegated evaluation exchange. Every check runs before claim evaluation,
-and an audit write failure prevents a successful signed response.*
-
-## Required environment
-
-Set these before starting the serving Notary:
-
-```bash
-export REGISTRY_NOTARY_AUDIT_HASH_SECRET='change-me-audit-hash-secret'
-export REGISTRY_NOTARY_FEDERATION_RESPONSE_JWK='{"kty":"OKP","crv":"Ed25519","d":"...","x":"...","alg":"EdDSA"}'
-export REGISTRY_NOTARY_PAIRWISE_SUBJECT_HASH_SECRET='change-me-pairwise-secret'
-```
-
-Do not reuse the pairwise subject hash secret for audit hashing, cookies,
-credential signing, or federation response signing. Federation response
-signing references a named key from `evidence.signing_keys`, so the same local
-JWK and PKCS#11 providers are used for evidence and federation signatures.
-
-## Minimal config shape
-
-```yaml
-evidence:
-  signing_keys:
-    federation-response:
-      provider: local_jwk_env
-      alg: EdDSA
-      kid: agency-a-fed-1
-      status: active
-      private_jwk_env: REGISTRY_NOTARY_FEDERATION_RESPONSE_JWK
-
-federation:
-  enabled: true
-  node_id: did:web:agency-a.example.gov
-  issuer: https://agency-a.example.gov
-  jwks_uri: https://agency-a.example.gov/federation/jwks.json
-  federation_api: https://agency-a.example.gov/federation/v1
-  supported_protocol_versions:
-    - registry-notary-federation/v0.1
-  inbound_body_limit_bytes: 16384
-  max_request_lifetime_seconds: 300
-  clock_leeway_seconds: 60
-  signing:
-    signing_key: federation-response
-  pairwise_subject_hash:
-    secret_env: REGISTRY_NOTARY_PAIRWISE_SUBJECT_HASH_SECRET
-  response_shaping:
-    minimum_denial_latency_ms: 250
-  emergency_denylist:
-    node_ids: []
-    kids: []
-  peers:
-    - node_id: did:web:agency-b.example.gov
-      issuer: https://agency-b.example.gov
-      jwks_uri: https://agency-b.example.gov/.well-known/jwks.json
-      # Local Compose demos may use allow_insecure_private_network: true with
-      # an HTTP service URL. Production peer JWKS URLs must use HTTPS.
-      allowed_protocol_versions:
-        - registry-notary-federation/v0.1
-      allowed_purposes:
-        - https://purpose.example.gov/social-protection/service-delivery
-      allowed_profiles:
-        - disability_status_predicate
-      evaluation_scopes:
-        - disability_registry:evidence_verification
-  evaluation_profiles:
-    - id: disability_status_predicate
-      ruleset: disability-status-v1
-      claim_id: disability_status
-      subject_id_type: national_id
-      max_claim_result_age_seconds: 3600
-```
-
-The local `peers` block is authoritative. Manifest metadata helps partners
-configure each other, but it does not grant access.
-
-`evaluation_scopes` are the scopes assigned to the authenticated federation
-principal when authorizing the selected local claim. For every allowed profile,
-the list must include each `required_scopes` entry from the selected claim and
-its dependency closure. Registry Notary rejects incomplete peer policy at
-startup. These scopes do not grant registry or Relay source access.
-`max_claim_result_age_seconds` bounds the age of the local claim result's
-`issued_at` timestamp.
-
-The federation endpoint can select only a claim with
-`evidence_mode.type: registry_backed`. The verified federation request `jti`
-is passed to Relay as the bounded audit correlation id. Notary has no direct
-registry-source or caller-input evidence fallback.
-Every Relay consultation input in the selected claim and its dependency
-closure must map to
-`request.target.identifiers.<evaluation_profile.subject_id_type>`.
-Configuration is rejected at startup when a federation profile could consume
-another request path.
-
-`allow_insecure_private_network` is a development and lab escape hatch for
-private Compose networks. It allows HTTP peer JWKS fetches through the shared
-bounded-fetch policy while still blocking cloud metadata targets. Do not enable
-it for production federation.
-
-## Request requirements
-
-Send `POST /federation/v1/evaluations` with:
-
-- `Content-Type: application/jwt`
-- compact JWS serialization
-- protected header `typ = registry-notary-request+jwt`
-- `alg = EdDSA`
-- `kid` present in the configured peer JWKS
-- payload claims `iss`, `sub`, `aud`, `iat`, `nbf`, `exp`, `jti`, `protocol`,
-  `action`, `profile`, `purpose`, and `request`
-
-The serving Notary rejects the request before claim evaluation when signature,
-audience, time window, profile, purpose, replay, emergency denylist, or body
-limit checks fail.
-
-## Response requirements
-
-Successful responses are compact signed JWTs with:
-
-- protected header `typ = registry-notary-response+jwt`
-- `iss` and `sub` for the serving Notary
-- `aud` for the requesting peer node id
-- `request_jti` copied from the request
-- `result.subject_ref.hash` as a pairwise `hmac-sha256:` handle
-
-Stale claim results return HTTP 200 with a signed top-level `error` object.
-Transport denials use RFC 9457 Problem Details JSON and do not prove whether
-the subject exists.
-
-## Correctness state
-
-Replay protection uses the global Notary correctness-state backend. Production
-and multi-instance deployments use the Notary-owned PostgreSQL schema. Local,
-single-process development can select in-memory state explicitly:
-
-```yaml
-deployment:
-  profile: local
-  multi_instance: false
-state:
-  storage: in_memory
-```
-
-Do not run active-active federation with in-memory state. Install the
-PostgreSQL schema and run `registry-notary state doctor` before enabling
-privileged federation traffic. See
-[`postgresql-state-operations.md`](postgresql-state-operations.md) for role,
-installation, backup, restore, and upgrade procedures.
-
-## Verification checklist
-
-Also confirm:
-
-- federation routes are absent when `federation.enabled` is false;
-- the peer JWKS contains the request signing `kid`;
-- raw subject identifiers do not appear in audit JSONL;
-- audit write failure prevents a successful signed response;
-- replaying the same request `jti` returns a denial.
diff --git a/products/notary/docs/identity-and-record-matching.md b/products/notary/docs/identity-and-record-matching.md
deleted file mode 100644
index 65626d540..000000000
--- a/products/notary/docs/identity-and-record-matching.md
+++ /dev/null
@@ -1,103 +0,0 @@
-# Consultation identity and outcomes
-
-Notary does not search registry records itself. A Registry-backed claim maps
-the authenticated evidence request to a named Relay consultation. Relay owns
-selector canonicalization, source access, protocol verification, cardinality,
-and output normalization.
-
-## Inputs
-
-Each consultation input is compiler-defined and closed. Selector inputs
-identify the target record; parameter inputs carry other bounded request
-values admitted by the evidence service. Notary maps only the approved request
-grammar, such as `request.target.identifiers.<name>`, into those inputs.
-
-Caller scope, purpose, requester identity, target identity, relationship, and
-authorization details are checked before Relay is invoked. A failed binding or
-scope check must produce zero Relay calls.
-
-## Outcomes
-
-Relay returns a closed outcome union:
-
-- `match`: declared typed outputs are present.
-- `no_match`: outputs are absent. Notary exposes `matched: false` and nulls in
-  its evaluation-only view so policy can derive an explicit predicate.
-- `ambiguous`: evaluation stops. Notary cannot choose one candidate.
-
-Denial, source, verification, contract, and availability failures are not
-outcomes. They abort the consultation group and cannot be converted into
-`no_match` or a claim value.
-
-## Claims
-
-One consultation may supply several claims. A direct output claim reads one
-declared output. A CEL claim may combine the consultation's outcome and
-allowed outputs with request-bound variables. CEL cannot acquire source data,
-change the consultation, or inspect raw Relay errors.
-
-## Structured direct outputs
-
-A direct output claim may preserve one schema-declared object or array value.
-The Relay public contract and the matching Notary consultation expectation use
-the same recursive tagged shape. Objects declare every field as
-`{ required, schema }`; arrays declare one `items` schema and `max_items`.
-Each object and array also declares `max_bytes`, the maximum canonical
-serialized size of that value.
-
-The recursive contract is closed and bounded:
-
-- No more than 32 top-level outputs or fields in one object
-- No more than 256 items in one array
-- No more than 8 schema levels, 256 schema nodes, or 4,096 expanded nodes
-- No more than 128 UTF-8 bytes in one output or field name
-- No more than 65,536 canonical serialized bytes in one structured value
-
-Unknown object keys, missing required fields, wrong nested types, excessive
-arrays, and values over a serialized-size bound fail without becoming claim
-values. CEL claim rules remain scalar-only. Use a direct output rule when the
-credential must preserve a structured Relay output.
-
-For example, the synthetic OpenCRVS fixture releases this minimized value:
-
-```json
-{
-  "parents": [
-    {
-      "type": "mother",
-      "name": "Mira Example",
-      "identifier": "PARENT-0001"
-    },
-    {
-      "type": "father",
-      "name": "Noah Example",
-      "identifier": "PARENT-0002"
-    }
-  ]
-}
-```
-
-The source fixture also contains a source-only parent reference. The reviewed
-adapter constructs each output object field by field, so that reference is not
-released.
-
-Registry Notary stores the exact validated result and binds its canonical
-content into issuance provenance. Issuance reloads and revalidates that stored
-value against the active compiler-pinned contract. A request cannot provide or
-replace an object field or array item.
-
-In a Selective Disclosure JSON Web Token (SD-JWT) credential, `parents` is one
-top-level disclosure. A holder can disclose or withhold the complete array.
-Nested fields and individual array items are not independently disclosable.
-Type Metadata publishes `registry_notary_value_schema` for a direct Relay
-output so wallets and verifiers can understand the closed value shape without
-implying nested disclosure.
-
-Diagnostics, logs, metrics, and audit events may record bounded claim names,
-outcome classes, and commitments. They must not record the structured value,
-source record, civil identifier, or disclosure content.
-
-For delegated requests, relationship authorization remains Notary policy. A
-configured Relay proof consultation can prove exactly the delegated edge it
-was compiled for, but it does not expand the caller's scopes or source
-authority.
diff --git a/products/notary/docs/notary-capability-matrix.md b/products/notary/docs/notary-capability-matrix.md
deleted file mode 100644
index c054136da..000000000
--- a/products/notary/docs/notary-capability-matrix.md
+++ /dev/null
@@ -1,90 +0,0 @@
-# Registry Notary capability matrix
-
-> **Page type:** Concept · **Product:** Registry Notary · **Layer:** all · **Audience:** integrator, operator
-
-Use this page to decide what Registry Notary can do today: read the status
-labels, the personas and systems vocabulary, then scan the scenario matrix for
-the support level and main gap of each flow.
-
-This catalog describes practical places where Registry Notary can help. It is
-not a protocol spec. It is a product and demo guide for deciding which flows are
-already supported, which are demo-only, and which need more runtime work.
-
-The scenarios use five status labels:
-
-| Status | Meaning |
-| --- | --- |
-| Supported | Works in Registry Notary runtime and has focused tests or existing product coverage |
-| Lab-supported | Can be shown with demo scripts or config, but is not a complete runtime feature |
-| Partial | Important pieces exist, but named product gaps remain |
-| Planned | Not yet implemented |
-| Out of scope | Not a Registry Notary responsibility |
-
-## Personas
-
-The worked scenarios and their recurring example cast live in [Notary
-scenario patterns](notary-scenario-patterns.md).
-
-| Persona | What they need | Examples |
-| --- | --- | --- |
-| Citizen or resident | Share only the proof needed to access a service | Parent applying for child support, farmer applying for a voucher |
-| Case worker | Make an evidence-backed decision without seeing unnecessary registry data | Benefits officer, enrollment officer |
-| Service or procedure owner | Define requirements, decision policy, and acceptable issuers | Social protection ministry, university admissions office, licensing authority |
-| Registry steward | Protect source registry data while answering authorized evidence questions | Civil registry, farmer registry, health facility registry |
-| Auditor or oversight body | Verify evidence evaluations and data exchanges were lawful, minimized, and replay-protected | Internal audit, data protection authority |
-| Wallet or client app operator | Help users present proofs or receive credentials | Mobile wallet, service portal, case-management app |
-
-## Systems
-
-| System | Role |
-| --- | --- |
-| Source registry | Operational system of record. It is not exposed directly to consumers |
-| Registry Relay | Read-only gateway and metadata publisher for source registry data |
-| Registry Notary | Evaluates reusable claims from compiler-pinned Relay consultations, signs results, issues credentials only from exact Relay-backed evaluation provenance, enforces evidence policy, and emits audit |
-| Registry Manifest | Public metadata and discovery artifact for capabilities, profiles, and evidence offerings |
-| Registry Platform | Shared crypto, HTTP, OIDC, SD-JWT, DID/JWK, replay, and audit primitives |
-| Service portal or case system | Acts as an evidence consumer; the operating institution remains the decision owner |
-| Holder wallet or client app | Stores credentials, presents proofs, and receives issued credentials |
-| Trust bundle or trust registry | Signed trust metadata; not yet supported. Peer trust today is a static allowlist |
-| Audit store | Local audit trail for evaluations, issuance, denials, and federation exchanges |
-
-## Scenario matrix
-
-The supported scenarios return evidence. The evidence consumer determines how
-the evidence is used, and the decision owner remains accountable for any
-eligibility, qualification, entitlement, payment, referral, workflow, or
-action decision. A Notary claim may attest a source-owned decision, but Notary
-does not recompute that decision as consumer policy.
-
-| # | Scenario | Pattern | Status | Main gap |
-| --- | --- | --- | --- | --- |
-| 1 | Civil alive predicate | Relay-backed evaluation | Supported | None for a compiler-pinned Relay consultation |
-| 2 | Age or date-of-birth evidence | Relay-backed evaluation | Supported | None for a compiler-pinned Relay consultation |
-| 3 | Programme enrollment active | Relay-backed evaluation | Supported | None for a compiler-pinned Relay consultation |
-| 4 | Health facility service available | Relay-backed evaluation | Supported | None for a compiler-pinned Relay consultation |
-| 5 | Farmer registration and landholding evidence | Relay-backed evaluation | Supported | None for a compiler-pinned Relay consultation |
-| 6 | Livestock identity and movement-status evidence | Relay-backed evaluation | Supported | None for a compiler-pinned Relay consultation |
-| 7 | Benefits agency asks Civil Notary for alive predicate | Delegated evaluation | Planned | Inbound federation can evaluate an admitted Relay-backed claim, but no outbound Notary client ships |
-| 8 | Benefits agency asks Social Notary for active beneficiary predicate | Delegated evaluation | Planned | Inbound federation can evaluate an admitted Relay-backed claim, but no outbound Notary client ships |
-| 9 | Health-linked child support across civil, social, and health | Outbound composition | Planned | No outbound Notary client or peer-result composition runtime ships yet; you cannot compose signed peer results across authorities in one flow |
-| 10 | Municipality verifies residency with a national registry steward | Delegated evaluation | Planned | Inbound federation can evaluate an admitted Relay-backed claim, but no outbound client or demo wiring ships |
-| 11 | Citizen presents civil-status proof to a benefits service | User-presented proof | Planned | No proof profiles or verifier runtime ship yet; you cannot accept this user-presented civil-status proof |
-| 12 | Farmer presents landholding or farmer-registration proof | User-presented proof | Planned | No proof profiles or status/freshness policy ship yet; you cannot accept a user-presented landholding or farmer-registration proof |
-| 13 | Health worker presents professional credential for workforce assignment | User-presented proof | Planned | No proof profiles or issuer trust policy ship yet; you cannot accept the presented professional evidence |
-| 14 | Parent or guardian requests a service for a child or dependent | Representative issuance plus registry proof | Supported | The browser ceremony authenticates the representative and requires the configured Relay-backed relationship proof before issuing for the selected subject |
-| 15 | Another individual representative requests a service for a represented subject | Representative issuance plus registry proof | Supported | The authoring contract is relationship-neutral, but each Registryctl OID4VCI binding selects exactly one relationship and proof policy |
-| 16 | Civil Notary issues date-of-birth or alive credential | Credential issuance | Supported | Full EdDSA and ES256 source-tested pre-authorized flow exists; external wallet evidence remains candidate-only |
-| 17 | Agriculture Notary issues farmer-registration or landholding credential | Credential issuance | Supported | Full EdDSA and ES256 source-tested pre-authorized flow exists; external wallet evidence remains candidate-only |
-| 18 | Shared evidence service issues combined-support evidence credential | Credential issuance plus composition | Partial | Relay-backed credential issuance exists, but peer-result composition is missing |
-| 19 | Consuming service helps holder obtain credential from remote Notary | Federated credential issuance | Planned | No holder-binding ceremony, nonce ownership, or relay rules ship yet; you cannot help a holder obtain a credential from a remote Notary through this service |
-| 20 | Replay and emergency peer/key denial | Governance | Supported | Active-active deployments require the typed Notary-owned PostgreSQL state schema |
-| 21 | Auditor verifies minimized evidence exchange | Governance | Partial | Signed results and audit exist, checkpoints are planned |
-| 22 | Peer audit checkpoint monitoring | Governance | Planned | No checkpoint publisher, Merkle builder, or peer monitor ships yet; you cannot independently verify peer audit checkpoints |
-
-Each Relay authority uses one Notary authority, with Notary-owned PostgreSQL
-correctness state for production and multi-instance deployment. Wallet-facing
-issuance supports only issuer-initiated pre-authorized code, EdDSA `did:jwk`
-holder proof, and EdDSA or ES256 issuer signing. This matrix makes no EUDI,
-HAIP, PAR, DPoP, wallet-attestation, ES256-holder, or external wallet/verifier
-conformance claim. Those claims require frozen candidate artifacts and recorded
-external evidence.
diff --git a/products/notary/docs/notary-scenario-patterns.md b/products/notary/docs/notary-scenario-patterns.md
deleted file mode 100644
index fdc042c46..000000000
--- a/products/notary/docs/notary-scenario-patterns.md
+++ /dev/null
@@ -1,79 +0,0 @@
-# Registry Notary scenario patterns
-
-## Registry-backed evaluation
-
-```mermaid
-sequenceDiagram
-  participant Consumer as Evidence consumer
-  participant Notary as Registry Notary
-  participant Relay as Registry Relay
-  participant Source as Registry source
-
-  Consumer->>Notary: Evaluate evidence claims for purpose
-  Notary->>Notary: Authenticate and authorize
-  Notary->>Relay: Execute pinned consultation
-  Relay->>Source: Governed read
-  Source-->>Relay: Bounded response
-  Relay-->>Notary: Outcome, outputs, provenance
-  Notary->>Notary: Claims, disclosure, issuance policy
-  Notary-->>Consumer: Minimized evidence or credential
-  Consumer->>Consumer: Use evidence under applicable policy
-```
-
-One consultation can support several direct and CEL evidence claims. Relay
-returns typed outputs, Notary owns evidence meaning and disclosure, and the
-evidence consumer determines how the evidence is used. The decision owner
-remains accountable for requirements, decisions, workflow, and actions.
-
-## Subject-bound evaluation
-
-```mermaid
-sequenceDiagram
-  participant Holder as Authenticated holder
-  participant Notary as Registry Notary
-  participant Relay as Registry Relay
-
-  Holder->>Notary: Evidence request
-  Notary->>Notary: Validate token and subject binding
-  Notary->>Relay: Execute pinned evidence consultation
-  Relay-->>Notary: Minimized evidence
-  Notary-->>Holder: Allowed result or credential
-```
-
-The identity token authorizes subject-bound access. It does not provide claim
-evidence or establish consumer eligibility. Claim evidence comes from the
-declared Relay consultation.
-
-## Delegated evaluation
-
-```mermaid
-sequenceDiagram
-  participant Caller as Delegated caller
-  participant Notary as Registry Notary
-  participant Relay as Registry Relay
-
-  Caller->>Notary: Request for represented target
-  Notary->>Notary: Validate exact authorization details
-  Notary->>Relay: Pinned relationship-proof consultation
-  Relay-->>Notary: Boolean proof outcome
-  Notary->>Relay: Pinned evidence consultation
-  Relay-->>Notary: Minimized evidence
-  Notary-->>Caller: Policy-limited result
-```
-
-The proof consultation proves only the configured requester-target edge. It
-does not add scopes or grant source authority. Binding or scope failure must
-make zero Relay calls.
-
-## Credential issuance
-
-Credential issuance reuses an allowed evaluation. The credential profile owns
-claim membership, format, holder binding, validity, and disclosure. A direct
-output claim is not issued on `no_match`; ambiguity or failure never issues.
-
-## Unsupported composition
-
-A project does not join independent registry trust domains. Cross-registry
-composition requires separately governed projects and explicit federation or
-an external workflow. Notary does not execute source adapters or general
-orchestration.
diff --git a/products/notary/docs/oid4vci-wallet-interop.md b/products/notary/docs/oid4vci-wallet-interop.md
deleted file mode 100644
index 022da8881..000000000
--- a/products/notary/docs/oid4vci-wallet-interop.md
+++ /dev/null
@@ -1,331 +0,0 @@
-# OID4VCI wallet interoperability
-
-> **Page type:** How-to · **Product:** Registry Notary · **Layer:** credential · **Audience:** operator, integrator
-
-Registry Notary exposes an issuer-initiated pre-authorized code flow for
-issuing registry-backed `dc+sd-jwt` credentials to holder wallets. A
-credential configuration can also select the digitally authenticated
-representative ceremony for one registry-proven relationship. Identity-provider
-and wallet inputs authorize and bind the flow; they do not become evidence.
-
-## Supported 1.0 profile
-
-The wallet facade supports:
-
-- registry-backed claims whose exact compiler-pinned Relay execution is stored
-  in a Notary transaction;
-- bounded closed object and array claims from direct Relay outputs;
-- `dc+sd-jwt` credentials;
-- EdDSA or ES256 issuer signing, selected by the credential profile;
-- EdDSA JWT holder proof with `did:jwk` binding;
-- an issuer-initiated pre-authorized code grant;
-- a representative-authenticated target-selection ceremony when explicitly
-  configured;
-- one credential per immediate response.
-
-It does not support wallet-facing authorization-code grants, a public nonce
-route, response next nonces, ES256 holder proof, credential issuance from
-caller-provided evidence, EUDI or HAIP profiles, PAR, DPoP, or wallet
-attestation.
-
-The eSignet authorization code used during the browser callback is internal to
-Notary's identity-provider login. The wallet never receives or redeems it.
-
-## Topology and prerequisites
-
-Deploy one Notary for each Relay authority. Notary owns its transaction,
-pre-authorized code, proof replay, evaluation, audit, and credential-status
-state. Use the Notary-owned PostgreSQL schema for production or multiple
-instances. In-memory state is for explicit local single-process use only.
-
-Before enabling the wallet facade:
-
-- configure the Relay connection and compile the claim consultation pins;
-- configure `subject_access` for the identity-provider binding claim;
-- bind every OID4VCI configuration to one mutually valid registry-backed claim
-  and credential profile;
-- configure separate signing keys for identity-provider client assertions,
-  Notary access tokens, and credentials;
-- expose HTTPS issuer, callback, token, credential, and Type Metadata URLs;
-- set the Notary state backend and rate limits.
-
-See the [operator configuration reference](operator-config-reference.md) and
-[credential issuance migration](credential-issuance-migration.md). For a
-representative flow, use
-[representative credential issuance](representative-credential-issuance.md).
-
-## Create an offer from a registrar evaluation
-
-An authorized registry client can create an offer after it evaluates the
-authoritative record through `POST /v1/evaluations`. This path does not use the
-citizen browser or identity-provider callback.
-
-Generated projects admit registrar OIDC clients explicitly:
-
-```yaml
-oid4vci:
-  public_base_url: https://notary.example.gov
-  registrar_clients: [opencrvs-registrar]
-```
-
-Registryctl keeps these clients on the same pinned authorization server and
-JWKS as the citizen client, but requires the Notary `public_base_url` as the
-machine resource audience. The signed `JWT` access token needs a stable `sub`
-that matches the evaluation owner, an admitted `azp` or `client_id`,
-`registry_notary:credential_offer_create`, the selected credential
-configuration's scope, and exact Registry Notary `authorization_details`.
-Those details must permit `create_credential_offer` for the target, complete
-claim set, value disclosure, claim-result format, purpose, service, and
-machine access mode. Identify the target with the evaluated primary
-identifier's scheme and value. When an entity has only a top-level
-`target.id`, use the reserved authorization `id_type` value `id`; this keeps
-typed identifiers distinct from the untyped top-level ID.
-
-An admitted registrar client with the machine resource audience needs only
-the access token; citizen userinfo and ID-token assurance are not required.
-Any citizen client or citizen audience signal still selects the citizen path,
-so mixed client/audience tokens cannot retain machine authority. A
-Notary-issued wallet access token is not accepted.
-
-Send only the stored evaluation identifier and configured credential type:
-
-```http
-POST /oid4vci/offers HTTP/1.1
-Host: notary.example.gov
-Authorization: Bearer <machine-client-token>
-Idempotency-Key: <stable-retry-key>
-Content-Type: application/json
-
-{
-  "evaluation_id": "<evaluation-id>",
-  "credential_configuration_id": "birth_certificate_sd_jwt"
-}
-```
-
-The request cannot contain a target, purpose, claim value, Relay result, or
-provenance. Registry Notary reloads those values from the fresh caller-owned
-evaluation and active reviewed configuration. It rejects denied, stale,
-incompletely provenanced, mismatched, foreign, or already consumed evaluations before
-creating an issuance transaction.
-
-A successful response is:
-
-```json
-{
-  "credential_offer_uri": "<sensitive-openid-credential-offer-uri>",
-  "tx_code": "<separate-numeric-pin>",
-  "expires_at": "2026-07-29T12:05:00Z"
-}
-```
-
-Registrar-created offers always require `tx_code`, independent of the citizen
-self-service transaction-code setting. The offer URI describes that
-requirement but never contains the numeric PIN. The API separates the two
-values but does not create a second communications channel. The registrar
-integration must deliver the PIN separately from the QR code, link, message,
-or device that carries the offer URI.
-
-Treat the complete response as secret-adjacent. Every response uses
-`Cache-Control: no-store` and `Pragma: no-cache`. Do not log the response,
-offer URI, transaction code, target, raw evaluation values, or holder
-identifiers.
-
-Use the same `Idempotency-Key` only for an exact retry of the same request.
-An exact retry returns the stored response and does not mint a second
-transaction. Reusing the key for another request, using another key for an
-evaluation already reserved for issuance, or racing two requests returns
-`409`. A client-scoped quota can return `429`. Retry a lost response with the
-original key; do not start another evaluation or invent a second key.
-Exact replays, known idempotency conflicts, and consumed-evaluation preflights
-do not call the signer. A genuinely new attempt consumes client quota before
-signer work, so signer failures still count toward abuse protection.
-
-The wallet then redeems the offer through `/oid4vci/token` and
-`/oid4vci/credential`. The pre-authorized code, access token, proof nonce,
-holder proof, and credential remain bound to the same immutable transaction.
-
-## Check the citizen browser flow
-
-1. Open this URL in the citizen's browser:
-
-   ```text
-   https://notary.example.gov/oid4vci/offer/start?credential_configuration_id=<id>
-   ```
-
-2. Complete the configured identity-provider login.
-3. After the callback succeeds, scan or paste the rendered
-   `openid-credential-offer://` URI into the wallet.
-4. Enter the separately displayed numeric PIN when the wallet asks for the
-   `tx_code`.
-5. Confirm that the wallet redeems the offer at `/oid4vci/token` and calls
-   `/oid4vci/credential` with an EdDSA `did:jwk` proof.
-6. Verify the returned credential with the issuer JWKS and the expected holder
-   binding.
-
-A successful check establishes all of these observations:
-
-- issuer metadata is reachable at
-  `/.well-known/openid-credential-issuer`;
-- Type Metadata is reachable at `/.well-known/vct/{vct_path}`;
-- metadata advertises `dc+sd-jwt`, `did:jwk`, EdDSA holder proof, and the
-  configured EdDSA or ES256 issuer algorithm;
-- metadata has a `/oid4vci/token` endpoint and no nonce endpoint;
-- the offer contains exactly the
-  `urn:ietf:params:oauth:grant-type:pre-authorized_code` grant;
-- the default offer contains a numeric `tx_code` description;
-- the token response supplies the proof nonce bound to that transaction;
-- the credential response has no next-nonce fields;
-- the SD-JWT VC has the expected `iss`, `vct`, EdDSA `did:jwk` holder binding,
-  and registry-backed disclosures.
-
-```mermaid
-sequenceDiagram
-    autonumber
-    actor Citizen
-    participant Browser
-    participant Notary as Registry Notary
-    participant IdP as Identity provider
-    participant Relay as Registry Relay
-    participant Wallet
-
-    Citizen->>Browser: Open offer start URL
-    Browser->>Notary: Start configured credential transaction
-    Notary-->>Browser: Redirect to identity provider
-    Browser->>IdP: Authenticate citizen
-    IdP-->>Browser: Return internal authorization code
-    Browser->>Notary: Callback with code and state
-    Notary->>IdP: Exchange code and validate subject
-    Notary->>Relay: Execute compiler-pinned consultation
-    Relay-->>Notary: Typed registry evidence
-    Notary-->>Browser: Render pre-authorized offer and PIN
-    Citizen->>Wallet: Transfer offer and enter PIN
-    Wallet->>Notary: Redeem pre-authorized code and PIN
-    Notary-->>Wallet: Access token and proof nonce
-    Wallet->>Notary: Submit EdDSA did:jwk proof
-    Notary-->>Wallet: Holder-bound dc+sd-jwt
-```
-
-## Transaction code modes
-
-The secure default is:
-
-```yaml
-oid4vci:
-  pre_authorized_code:
-    enabled: true
-    pre_authorized_code_ttl_seconds: 300
-    tx_code:
-      required: true
-      input_mode: numeric
-      length: 6
-```
-
-Codes are short-lived and single-use. Wrong PIN attempts are bounded per offer,
-and invalid-code attempts are rate limited per client address.
-
-Some wallet versions, including the Walt compatibility profile, cannot present
-a transaction code. Make that weaker mode explicit:
-
-```yaml
-oid4vci:
-  pre_authorized_code:
-    enabled: true
-    pre_authorized_code_ttl_seconds: 300
-    tx_code:
-      required: false
-```
-
-The TTL must be no more than 300 seconds in this mode. An offer without a PIN is
-bearer credential material until redemption. A person who steals the
-unredeemed offer can use it during that window. Keep the offer out of logs,
-analytics, screenshots, browser synchronization, and support messages. The
-code remains single-use and redemption remains rate limited.
-
-## Metadata and Type Metadata
-
-Issuer metadata is derived from active Notary configuration. Wallets should
-assert exact values rather than infer capability from permissive schema fields:
-
-- `credential_issuer` equals the configured public issuer;
-- `token_endpoint` equals the Notary token endpoint;
-- every credential configuration has `format: dc+sd-jwt`;
-- `cryptographic_binding_methods_supported` is exactly `[did:jwk]`;
-- JWT `proof_signing_alg_values_supported` is exactly `[EdDSA]`;
-- the issuer algorithm is exactly the active profile algorithm;
-- `vct` is the configured public HTTPS identifier;
-- no nonce endpoint is advertised.
-
-Notary serves Type Metadata at both the configured `vct` URL and the
-`/.well-known/vct/{vct_path}` form used by wallets. It describes each projected
-claim and its selective-disclosure behavior. `status` is a reserved top-level
-claim and cannot be projected as a selectively disclosable value.
-
-For a direct structured Relay output, each claim also includes the namespaced
-`registry_notary_value_schema` member. The member publishes the exact closed
-recursive value contract, including required object fields, item schemas, and
-byte and item bounds. It does not define nested disclosure. A top-level object
-or array claim is one SD-JWT disclosure: the holder discloses or withholds the
-complete value.
-
-## Credential request and response
-
-The wallet sends one proof using either the supported single-proof shape or the
-single-entry proof-array shape. Multiple proofs and mixed shapes are rejected.
-The proof must be fresh, have the Notary issuer as audience, contain the
-transaction-bound nonce from the token response, use EdDSA, and identify the
-holder as `did:jwk`.
-
-The response contains the immediate credential in its compatibility envelope.
-It does not return a new proof nonce. The wallet or verifier should check:
-
-- issuer signature and configured issuer algorithm;
-- expected `vct` and credential lifetime;
-- exact EdDSA `did:jwk` holder binding;
-- SD-JWT disclosure hashes;
-- live status when the credential contains a status claim.
-
-For a status-bearing credential, verification fails closed on an unavailable,
-untrusted, malformed, expired, suspended, revoked, or otherwise invalid status
-response. Status retrieval is restricted to the configured exact HTTPS trusted
-origin.
-
-## Security invariants
-
-- Notary creates the offer only after the identity binding and registry-backed
-  evaluation succeed, or after an authorized registrar selects an existing
-  fresh caller-owned registry-backed evaluation.
-- In representative mode, the relationship proof runs before its dependent
-  credential claims. Offer and token expiry cannot exceed proof expiry.
-- The credential endpoint reloads the stored transaction and verifies the
-  active claim, profile, purpose, contract hash, Relay ULID, acquisition time,
-  and claim provenance before signer access.
-- Wallet input cannot select a free-form subject or replace stored evidence.
-- The credential endpoint performs no new Relay consultation. Representative
-  lifecycle changes after issuance require credential revocation.
-- Pre-authorized codes, access tokens, proof nonces, and transaction bindings
-  are time bounded and replay protected.
-- Identity-provider codes, wallet grants, access tokens, proof JWTs, subjects,
-  registry rows, and disclosures must not appear in logs.
-
-## Compatibility evidence
-
-Record the wallet and verifier product, exact version, configuration override,
-artifact digest, and observed result for every external run. Local source tests
-cover EdDSA and ES256 issuer variants with an EdDSA `did:jwk` holder. External
-wallet, verifier, OIDF, EUDI, or HAIP conformance remains candidate-only until a
-frozen candidate artifact and immutable evidence are published.
-
-## Troubleshooting
-
-| Symptom | Likely cause | Check |
-| --- | --- | --- |
-| OID4VCI routes are unavailable | The facade or pre-authorized flow is disabled | Expanded config and startup diagnostics |
-| Configuration is rejected | A claim lacks a Relay consultation, a profile binding is one-sided, or delegated issuance lacks the representative ceremony | Claim evidence mode, representative policy, profile bindings, and OID4VCI projections |
-| Offer is not rendered | Identity binding, Relay execution, or stored transaction creation failed | Sanitized audit records and Relay availability |
-| Wallet asks for a different grant | Wallet does not support issuer-initiated pre-authorized code | Wallet version and imported offer |
-| PIN is rejected | Wrong, expired, replayed, or locked offer | Offer age and rate-limit diagnostics |
-| Wallet cannot send a PIN | Compatibility profile needs explicit bearer-offer mode | `tx_code.required: false` and TTL no more than 300 seconds |
-| Proof is rejected | Unsupported algorithm or binding, stale proof, wrong audience, or nonce mismatch | Wallet proof header and claims |
-| Credential is denied after token redemption | Stored registry transaction is missing, stale, or does not match active compiler pins | Re-run the browser journey under one project generation |
-| Wallet cannot verify | Issuer JWKS, `kid`, algorithm, `vct`, holder binding, or status mismatch | Active signing profile and verifier diagnostics |
-| Multiple instances disagree | In-memory correctness state is in use | Install and select Notary-owned PostgreSQL state |
diff --git a/products/notary/docs/operator-config-reference.md b/products/notary/docs/operator-config-reference.md
deleted file mode 100644
index f7f7cef8b..000000000
--- a/products/notary/docs/operator-config-reference.md
+++ /dev/null
@@ -1,915 +0,0 @@
-# Operator configuration reference
-
-Registry Notary configuration describes caller authentication, service policy,
-claims, disclosure, issuance, state, and operations. Registry-backed source
-access is represented only by one Relay connection plus compiler-produced
-consultation expectations. Direct registry connections and adapter runtimes
-are not valid Notary configuration.
-
-The complete deserialization-oriented Draft 2020-12 schema is committed at
-[`schemas/registry-notary.config.schema.json`](../../../schemas/registry-notary.config.schema.json).
-Reproduce it with `just config-schema-generate`, verify drift with `just
-config-schema-check`, or print the exact same bytes with `registry-notary
-schema`. The schema checks document structure, closed objects, tagged
-variants, scalar types, and key paths. JSON Schema deliberately leaves custom
-duration, socket-address, CIDR, and consultation-input grammars to the same
-runtime parsers that deserialize them, avoiding a narrower duplicate grammar.
-`registry-notary doctor` remains authoritative for environment and secret
-availability, filesystem and Relay access, deployment gates, and cross-field
-runtime validation.
-
-## Bounded batch settings
-
-The batch platform ceiling is 100 items and cannot be raised. Set
-`evidence.inline_batch_limit` to lower the service-wide limit, then use
-`evidence.claims[].operations.batch_evaluate.max_subjects` to lower it for an
-individual claim. Both fields accept only integers from 1 through 100. Notary
-rejects zero or values above 100 at configuration load.
-
-For a request, the effective limit is the lowest of 100, the global value, and
-the value of every selected claim. A request above that limit is rejected
-before quota, idempotency, Relay, source, or retained-state side effects.
-
-`evidence.concurrency.subjects` controls parallel member work and defaults to
-16. Relay concurrency is independently bounded by the Relay client and
-defaults to 8. Keep the outer `server.request_timeout` at least five seconds
-above the 25 second Relay operation deadline for registry-backed evaluation;
-the default is 30 seconds. These controls compose with the 1 MiB inbound body,
-64 KiB per-Relay-result, and 256 consultation-group limits. They do not replace
-the 100-member ceiling.
-
-## OID4VCI 1.0 profile
-
-Enabled OID4VCI configuration requires
-`oid4vci.pre_authorized_code.enabled: true`. The only wallet-facing grant is
-issuer-initiated pre-authorized code. `oid4vci.nonce.enabled` controls the
-transaction-bound proof nonce returned by the token response; it does not mount
-a public nonce route. `oid4vci.nonce_endpoint` must be omitted, and
-`oid4vci.offer_endpoint` has no route effect in the 1.0 profile.
-
-`oid4vci.pre_authorized_code.tx_code.required` defaults to `true`. An explicit
-`false` setting, including the Walt compatibility profile, requires
-`pre_authorized_code_ttl_seconds` of no more than 300. The no-PIN offer is
-single-use bearer credential material until redemption and must remain covered
-by rate limits and disclosure controls.
-
-## CEL worker lifecycle
-
-Registry Notary starts a CEL worker pool only when at least one configured
-claim uses CEL. Before listener binding, every initial worker must answer one
-fixed, value-free CEL protocol probe and remain live through activation. One
-10-second wall-clock deadline covers the complete concurrent spawn-and-probe
-batch; it is not a separate allowance for each worker. The bound is
-product-owned and is not a configuration field. A missing, non-executable,
-sleeping, resource-constrained, exited, or wrong-protocol worker fails
-activation with `notary.cel.worker_unavailable`. Timed-out or rejected worker
-process groups are terminated before they can be admitted.
-
-Only workers that pass the probe count toward readiness. A replacement starts
-in the background and does not receive work until the same probe passes. A
-healthy replacement is installed even when another worker in its concurrent
-replacement batch fails; initial activation still requires the complete
-configured capacity. Readiness remains false while required capacity is
-missing or warming. The failed evaluation is not retried and does not wait for
-replacement startup.
-
-`cel.eval_timeout_ms` applies only after a proven worker receives an
-evaluation. Its default is 2,000 ms and its accepted range is 1 through
-30,000 ms. The startup wall-clock deadline and evaluation deadline are
-independent; neither consumes or multiplies the other.
-
-The remaining CEL controls have these defaults and accepted bounds:
-
-| Field | Default | Accepted values |
-| --- | ---: | --- |
-| `cel.worker_count` | 2 | 1 through 16 |
-| `cel.allow_regex` | `false` | Boolean |
-| `cel.max_expression_bytes` | 8,192 | 1 through 262,144 |
-| `cel.max_binding_json_bytes` | 65,536 | 1 through 1,048,576 |
-| `cel.max_result_json_bytes` | 16,384 | 1 through 1,048,576 |
-| `cel.max_string_bytes` | 16,384 | 1 through 262,144 |
-| `cel.max_list_items` | 1,024 | 1 through 100,000 |
-| `cel.max_object_depth` | 16 | 1 through 64 |
-| `cel.max_object_keys` | 256 | 1 through 2,048 |
-| `cel.worker_memory_bytes` | 134,217,728 | 33,554,432 through 1,073,741,824 |
-| `cel.worker_stderr_bytes` | 1,024 | 1 through 65,536 |
-
-The worker subprocess receives a cleared environment plus the platform's
-minimal process environment. Registry Notary does not expose probe requests,
-responses, CEL expressions, bindings, stderr, paths, or environment values
-through readiness or the public activation failure.
-
-{/* registry-notary-config-key-paths:start */}
-```text
-audit
-audit.hash_secret_env
-audit.max_files
-audit.max_size_mb
-audit.path
-audit.sink
-audit.syslog_socket_path
-auth
-auth.access_token_signing
-auth.access_token_signing.access_token_ttl_seconds
-auth.access_token_signing.allowed_algorithms
-auth.access_token_signing.allowed_algorithms[]
-auth.access_token_signing.audiences
-auth.access_token_signing.audiences[]
-auth.access_token_signing.enabled
-auth.access_token_signing.issuer
-auth.access_token_signing.signing_key_id
-auth.access_token_signing.token_typ
-auth.access_token_signing.verification_key_ids
-auth.access_token_signing.verification_key_ids[]
-auth.api_keys
-auth.api_keys[]
-auth.api_keys[].authorization_details
-auth.api_keys[].authorization_details.access_mode
-auth.api_keys[].authorization_details.actions
-auth.api_keys[].authorization_details.actions[]
-auth.api_keys[].authorization_details.assisted_access_context
-auth.api_keys[].authorization_details.assisted_access_context.channel
-auth.api_keys[].authorization_details.assurance_level
-auth.api_keys[].authorization_details.claims
-auth.api_keys[].authorization_details.claims[]
-auth.api_keys[].authorization_details.claims[].id
-auth.api_keys[].authorization_details.claims[].version
-auth.api_keys[].authorization_details.consent_ref
-auth.api_keys[].authorization_details.disclosure
-auth.api_keys[].authorization_details.format
-auth.api_keys[].authorization_details.jurisdiction
-auth.api_keys[].authorization_details.legal_basis_ref
-auth.api_keys[].authorization_details.locations
-auth.api_keys[].authorization_details.locations[]
-auth.api_keys[].authorization_details.purpose
-auth.api_keys[].authorization_details.relationship
-auth.api_keys[].authorization_details.relationship.proof_claim
-auth.api_keys[].authorization_details.relationship.relationship_type
-auth.api_keys[].authorization_details.schema_version
-auth.api_keys[].authorization_details.subject
-auth.api_keys[].authorization_details.subject.binding_claim
-auth.api_keys[].authorization_details.subject.id_type
-auth.api_keys[].authorization_details.target
-auth.api_keys[].authorization_details.target.id
-auth.api_keys[].authorization_details.target.id_type
-auth.api_keys[].authorization_details.type
-auth.api_keys[].fingerprint
-auth.api_keys[].fingerprint.name
-auth.api_keys[].fingerprint.path
-auth.api_keys[].fingerprint.provider
-auth.api_keys[].id
-auth.api_keys[].scopes
-auth.api_keys[].scopes[]
-auth.bearer_tokens
-auth.bearer_tokens[]
-auth.bearer_tokens[].authorization_details
-auth.bearer_tokens[].authorization_details.access_mode
-auth.bearer_tokens[].authorization_details.actions
-auth.bearer_tokens[].authorization_details.actions[]
-auth.bearer_tokens[].authorization_details.assisted_access_context
-auth.bearer_tokens[].authorization_details.assisted_access_context.channel
-auth.bearer_tokens[].authorization_details.assurance_level
-auth.bearer_tokens[].authorization_details.claims
-auth.bearer_tokens[].authorization_details.claims[]
-auth.bearer_tokens[].authorization_details.claims[].id
-auth.bearer_tokens[].authorization_details.claims[].version
-auth.bearer_tokens[].authorization_details.consent_ref
-auth.bearer_tokens[].authorization_details.disclosure
-auth.bearer_tokens[].authorization_details.format
-auth.bearer_tokens[].authorization_details.jurisdiction
-auth.bearer_tokens[].authorization_details.legal_basis_ref
-auth.bearer_tokens[].authorization_details.locations
-auth.bearer_tokens[].authorization_details.locations[]
-auth.bearer_tokens[].authorization_details.purpose
-auth.bearer_tokens[].authorization_details.relationship
-auth.bearer_tokens[].authorization_details.relationship.proof_claim
-auth.bearer_tokens[].authorization_details.relationship.relationship_type
-auth.bearer_tokens[].authorization_details.schema_version
-auth.bearer_tokens[].authorization_details.subject
-auth.bearer_tokens[].authorization_details.subject.binding_claim
-auth.bearer_tokens[].authorization_details.subject.id_type
-auth.bearer_tokens[].authorization_details.target
-auth.bearer_tokens[].authorization_details.target.id
-auth.bearer_tokens[].authorization_details.target.id_type
-auth.bearer_tokens[].authorization_details.type
-auth.bearer_tokens[].fingerprint
-auth.bearer_tokens[].fingerprint.name
-auth.bearer_tokens[].fingerprint.path
-auth.bearer_tokens[].fingerprint.provider
-auth.bearer_tokens[].id
-auth.bearer_tokens[].scopes
-auth.bearer_tokens[].scopes[]
-auth.oidc
-auth.oidc.allow_insecure_localhost
-auth.oidc.allowed_algorithms
-auth.oidc.allowed_algorithms[]
-auth.oidc.allowed_clients
-auth.oidc.allowed_clients[]
-auth.oidc.allowed_token_types
-auth.oidc.allowed_token_types[]
-auth.oidc.audiences
-auth.oidc.audiences[]
-auth.oidc.issuer
-auth.oidc.jwks_url
-auth.oidc.leeway
-auth.oidc.principal_claim
-auth.oidc.scope_claim
-auth.oidc.scope_map
-auth.oidc.scope_map.*
-auth.oidc.scope_map.*[]
-auth.oidc.scope_separator
-auth.oidc.userinfo_endpoint
-auth.oidc.userinfo_issuers
-auth.oidc.userinfo_issuers[]
-cel
-cel.allow_regex
-cel.eval_timeout_ms
-cel.max_binding_json_bytes
-cel.max_expression_bytes
-cel.max_list_items
-cel.max_object_depth
-cel.max_object_keys
-cel.max_result_json_bytes
-cel.max_string_bytes
-cel.mode
-cel.worker_count
-cel.worker_memory_bytes
-cel.worker_stderr_bytes
-config_trust
-config_trust.antirollback_state_path
-config_trust.break_glass_override_path
-config_trust.bundle_path
-config_trust.trust_anchor_path
-credential_status
-credential_status.base_url
-credential_status.enabled
-credential_status.retention_seconds
-deployment
-deployment.evidence
-deployment.evidence.audit_ack_cursor_path
-deployment.evidence.audit_ack_max_age_secs
-deployment.evidence.audit_offhost_shipping
-deployment.evidence.signer_custody_approved
-deployment.multi_instance
-deployment.profile
-deployment.waivers
-deployment.waivers[]
-deployment.waivers[].expires
-deployment.waivers[].finding
-deployment.waivers[].reference
-deployment.waivers[].summary
-evidence
-evidence.allowed_purposes
-evidence.allowed_purposes[]
-evidence.api_base_url
-evidence.api_version
-evidence.claims
-evidence.claims[]
-evidence.claims[].cccev
-evidence.claims[].cccev.evidence_type
-evidence.claims[].cccev.evidence_type_iri
-evidence.claims[].cccev.requirement_type
-evidence.claims[].credential_profiles
-evidence.claims[].credential_profiles[]
-evidence.claims[].depends_on
-evidence.claims[].depends_on[]
-evidence.claims[].disclosure
-evidence.claims[].disclosure.allowed
-evidence.claims[].disclosure.allowed[]
-evidence.claims[].disclosure.default
-evidence.claims[].disclosure.downgrade
-evidence.claims[].evidence_mode
-evidence.claims[].evidence_mode.consultations
-evidence.claims[].evidence_mode.consultations.*
-evidence.claims[].evidence_mode.consultations.*.inputs
-evidence.claims[].evidence_mode.consultations.*.inputs.*
-evidence.claims[].evidence_mode.consultations.*.outputs
-evidence.claims[].evidence_mode.consultations.*.outputs.*
-evidence.claims[].evidence_mode.consultations.*.outputs.*.fields
-evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*
-evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*.required
-evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*.schema
-evidence.claims[].evidence_mode.consultations.*.outputs.*.items
-evidence.claims[].evidence_mode.consultations.*.outputs.*.max_bytes
-evidence.claims[].evidence_mode.consultations.*.outputs.*.max_items
-evidence.claims[].evidence_mode.consultations.*.outputs.*.maximum
-evidence.claims[].evidence_mode.consultations.*.outputs.*.minimum
-evidence.claims[].evidence_mode.consultations.*.outputs.*.nullable
-evidence.claims[].evidence_mode.consultations.*.outputs.*.type
-evidence.claims[].evidence_mode.consultations.*.profile
-evidence.claims[].evidence_mode.consultations.*.profile.contract_hash
-evidence.claims[].evidence_mode.consultations.*.profile.id
-evidence.claims[].evidence_mode.type
-evidence.claims[].formats
-evidence.claims[].formats[]
-evidence.claims[].id
-evidence.claims[].inputs
-evidence.claims[].inputs[]
-evidence.claims[].inputs[].name
-evidence.claims[].inputs[].type
-evidence.claims[].oots
-evidence.claims[].oots.authentication_level_of_assurance
-evidence.claims[].oots.enabled
-evidence.claims[].oots.evidence_type_classification
-evidence.claims[].oots.evidence_type_list
-evidence.claims[].oots.languages
-evidence.claims[].oots.languages[]
-evidence.claims[].oots.reference_framework
-evidence.claims[].oots.requirement
-evidence.claims[].operations
-evidence.claims[].operations.batch_evaluate
-evidence.claims[].operations.batch_evaluate.enabled
-evidence.claims[].operations.batch_evaluate.max_subjects
-evidence.claims[].operations.evaluate
-evidence.claims[].operations.evaluate.enabled
-evidence.claims[].purpose
-evidence.claims[].required_scopes
-evidence.claims[].required_scopes[]
-evidence.claims[].rule
-evidence.claims[].rule.consultation
-evidence.claims[].rule.expression
-evidence.claims[].rule.output
-evidence.claims[].rule.type
-evidence.claims[].semantics
-evidence.claims[].semantics.concept
-evidence.claims[].semantics.derived_from
-evidence.claims[].semantics.derived_from[]
-evidence.claims[].semantics.predicate
-evidence.claims[].semantics.property
-evidence.claims[].semantics.value_mapping
-evidence.claims[].semantics.vocabulary
-evidence.claims[].subject_type
-evidence.claims[].title
-evidence.claims[].value
-evidence.claims[].value.max_bytes
-evidence.claims[].value.nullable
-evidence.claims[].value.type
-evidence.claims[].value.unit
-evidence.claims[].version
-evidence.claims_url
-evidence.concurrency
-evidence.concurrency.subjects
-evidence.credential_profiles
-evidence.credential_profiles.*
-evidence.credential_profiles.*.allowed_claims
-evidence.credential_profiles.*.allowed_claims[]
-evidence.credential_profiles.*.disclosure
-evidence.credential_profiles.*.disclosure.allowed
-evidence.credential_profiles.*.disclosure.allowed[]
-evidence.credential_profiles.*.format
-evidence.credential_profiles.*.holder_binding
-evidence.credential_profiles.*.holder_binding.allowed_did_methods
-evidence.credential_profiles.*.holder_binding.allowed_did_methods[]
-evidence.credential_profiles.*.holder_binding.mode
-evidence.credential_profiles.*.holder_binding.proof_of_possession
-evidence.credential_profiles.*.issuer
-evidence.credential_profiles.*.signing_key
-evidence.credential_profiles.*.validity_seconds
-evidence.credential_profiles.*.vct
-evidence.enabled
-evidence.formats_url
-evidence.inline_batch_limit
-evidence.machine_quota
-evidence.machine_quota.enabled
-evidence.machine_quota.subjects_per_minute
-evidence.max_credential_validity_seconds
-evidence.relay
-evidence.relay.allow_insecure_localhost
-evidence.relay.allow_insecure_private_network
-evidence.relay.allowed_private_cidrs
-evidence.relay.allowed_private_cidrs[]
-evidence.relay.base_url
-evidence.relay.max_in_flight
-evidence.relay.root_certificate_path
-evidence.relay.token_file
-evidence.relay.workload_client_id
-evidence.service_id
-evidence.signing_keys
-evidence.signing_keys.*
-evidence.signing_keys.*.alg
-evidence.signing_keys.*.key_id_hex
-evidence.signing_keys.*.key_label
-evidence.signing_keys.*.kid
-evidence.signing_keys.*.module_path
-evidence.signing_keys.*.password_env
-evidence.signing_keys.*.path
-evidence.signing_keys.*.pin_env
-evidence.signing_keys.*.private_jwk_env
-evidence.signing_keys.*.provider
-evidence.signing_keys.*.public_jwk_env
-evidence.signing_keys.*.publish_until_unix_seconds
-evidence.signing_keys.*.status
-evidence.signing_keys.*.token_label
-evidence.variables
-evidence.variables.*
-evidence.variables.*.from
-evidence.variables.*.type
-federation
-federation.clock_leeway_seconds
-federation.emergency_denylist
-federation.emergency_denylist.kids
-federation.emergency_denylist.kids[]
-federation.emergency_denylist.node_ids
-federation.emergency_denylist.node_ids[]
-federation.enabled
-federation.evaluation_profiles
-federation.evaluation_profiles[]
-federation.evaluation_profiles[].assurance_level
-federation.evaluation_profiles[].claim_id
-federation.evaluation_profiles[].consent_ref
-federation.evaluation_profiles[].disclosure
-federation.evaluation_profiles[].id
-federation.evaluation_profiles[].jurisdiction
-federation.evaluation_profiles[].legal_basis_ref
-federation.evaluation_profiles[].max_claim_result_age_seconds
-federation.evaluation_profiles[].ruleset
-federation.evaluation_profiles[].subject_id_type
-federation.federation_api
-federation.inbound_body_limit_bytes
-federation.issuer
-federation.jwks_uri
-federation.max_request_lifetime_seconds
-federation.node_id
-federation.pairwise_subject_hash
-federation.pairwise_subject_hash.secret_env
-federation.peers
-federation.peers[]
-federation.peers[].allow_insecure_localhost
-federation.peers[].allow_insecure_private_network
-federation.peers[].allowed_profiles
-federation.peers[].allowed_profiles[]
-federation.peers[].allowed_protocol_versions
-federation.peers[].allowed_protocol_versions[]
-federation.peers[].allowed_purposes
-federation.peers[].allowed_purposes[]
-federation.peers[].evaluation_scopes
-federation.peers[].evaluation_scopes[]
-federation.peers[].issuer
-federation.peers[].jwks_uri
-federation.peers[].node_id
-federation.response_shaping
-federation.response_shaping.minimum_denial_latency_ms
-federation.signing
-federation.signing.signing_key
-federation.supported_protocol_versions
-federation.supported_protocol_versions[]
-instance
-instance.environment
-instance.id
-instance.jurisdiction
-instance.owner
-instance.public_base_url
-oid4vci
-oid4vci.accepted_token_audiences
-oid4vci.accepted_token_audiences[]
-oid4vci.authorization
-oid4vci.authorization.require_pkce_method
-oid4vci.authorization_servers
-oid4vci.authorization_servers[]
-oid4vci.credential_configurations
-oid4vci.credential_configurations.*
-oid4vci.credential_configurations.*.claim_id
-oid4vci.credential_configurations.*.claims
-oid4vci.credential_configurations.*.claims[]
-oid4vci.credential_configurations.*.claims[].display_name
-oid4vci.credential_configurations.*.claims[].id
-oid4vci.credential_configurations.*.claims[].output_path
-oid4vci.credential_configurations.*.claims[].output_path[]
-oid4vci.credential_configurations.*.claims[].sd
-oid4vci.credential_configurations.*.credential_profile
-oid4vci.credential_configurations.*.cryptographic_binding_methods_supported
-oid4vci.credential_configurations.*.cryptographic_binding_methods_supported[]
-oid4vci.credential_configurations.*.display
-oid4vci.credential_configurations.*.display.background_color
-oid4vci.credential_configurations.*.display.background_image
-oid4vci.credential_configurations.*.display.background_image.alt_text
-oid4vci.credential_configurations.*.display.background_image.uri
-oid4vci.credential_configurations.*.display.background_image.url
-oid4vci.credential_configurations.*.display.description
-oid4vci.credential_configurations.*.display.locale
-oid4vci.credential_configurations.*.display.logo
-oid4vci.credential_configurations.*.display.logo.alt_text
-oid4vci.credential_configurations.*.display.logo.uri
-oid4vci.credential_configurations.*.display.logo.url
-oid4vci.credential_configurations.*.display.secondary_image
-oid4vci.credential_configurations.*.display.secondary_image.alt_text
-oid4vci.credential_configurations.*.display.secondary_image.uri
-oid4vci.credential_configurations.*.display.secondary_image.url
-oid4vci.credential_configurations.*.display.text_color
-oid4vci.credential_configurations.*.display_name
-oid4vci.credential_configurations.*.format
-oid4vci.credential_configurations.*.proof_signing_alg_values_supported
-oid4vci.credential_configurations.*.proof_signing_alg_values_supported[]
-oid4vci.credential_configurations.*.representative_issuance
-oid4vci.credential_configurations.*.representative_issuance.ceremony
-oid4vci.credential_configurations.*.representative_issuance.relationship
-oid4vci.credential_configurations.*.scope
-oid4vci.credential_configurations.*.vct
-oid4vci.credential_endpoint
-oid4vci.credential_issuer
-oid4vci.display
-oid4vci.display[]
-oid4vci.display[].locale
-oid4vci.display[].logo
-oid4vci.display[].logo.alt_text
-oid4vci.display[].logo.uri
-oid4vci.display[].logo.url
-oid4vci.display[].name
-oid4vci.enabled
-oid4vci.nonce
-oid4vci.nonce.enabled
-oid4vci.nonce.ttl_seconds
-oid4vci.nonce_endpoint
-oid4vci.offer_endpoint
-oid4vci.pre_authorized_code
-oid4vci.pre_authorized_code.enabled
-oid4vci.pre_authorized_code.esignet
-oid4vci.pre_authorized_code.esignet.allow_insecure_localhost
-oid4vci.pre_authorized_code.esignet.authorize_url
-oid4vci.pre_authorized_code.esignet.client_id
-oid4vci.pre_authorized_code.esignet.client_signing_key_id
-oid4vci.pre_authorized_code.esignet.issuer
-oid4vci.pre_authorized_code.esignet.jwks_uri
-oid4vci.pre_authorized_code.esignet.login_state_ttl_seconds
-oid4vci.pre_authorized_code.esignet.redirect_uri
-oid4vci.pre_authorized_code.esignet.scopes
-oid4vci.pre_authorized_code.esignet.scopes[]
-oid4vci.pre_authorized_code.esignet.token_url
-oid4vci.pre_authorized_code.esignet.userinfo_url
-oid4vci.pre_authorized_code.pre_authorized_code_ttl_seconds
-oid4vci.pre_authorized_code.tx_code
-oid4vci.pre_authorized_code.tx_code.input_mode
-oid4vci.pre_authorized_code.tx_code.length
-oid4vci.pre_authorized_code.tx_code.required
-oid4vci.proof
-oid4vci.proof.max_age_seconds
-oid4vci.proof.max_clock_skew_seconds
-server
-server.admin_listener
-server.admin_listener.bind
-server.admin_listener.mode
-server.bind
-server.cors
-server.cors.allowed_origins
-server.cors.allowed_origins[]
-server.http1_header_read_timeout
-server.max_connections
-server.openapi_requires_auth
-server.request_body_timeout
-server.request_timeout
-server.trusted_proxy_ips
-server.trusted_proxy_ips[]
-state
-state.postgresql
-state.postgresql.connect_timeout_ms
-state.postgresql.max_connections
-state.postgresql.operation_timeout_ms
-state.postgresql.root_certificate_path
-state.postgresql.sensitive_state_key_env
-state.postgresql.url_env
-state.storage
-subject_access
-subject_access.allowed_claims
-subject_access.allowed_claims[]
-subject_access.allowed_disclosures
-subject_access.allowed_disclosures[]
-subject_access.allowed_formats
-subject_access.allowed_formats[]
-subject_access.allowed_operations
-subject_access.allowed_operations.batch_evaluate
-subject_access.allowed_operations.evaluate
-subject_access.allowed_operations.issue_credential
-subject_access.allowed_operations.render
-subject_access.allowed_purposes
-subject_access.allowed_purposes[]
-subject_access.allowed_wallet_origins
-subject_access.allowed_wallet_origins[]
-subject_access.citizen_clients
-subject_access.citizen_clients.allowed_audiences
-subject_access.citizen_clients.allowed_audiences[]
-subject_access.citizen_clients.allowed_client_ids
-subject_access.citizen_clients.allowed_client_ids[]
-subject_access.credential_profiles
-subject_access.credential_profiles[]
-subject_access.delegation
-subject_access.delegation.allowed_relationships
-subject_access.delegation.allowed_relationships[]
-subject_access.delegation.allowed_relationships[].allowed_claims
-subject_access.delegation.allowed_relationships[].allowed_claims[]
-subject_access.delegation.allowed_relationships[].allowed_disclosures
-subject_access.delegation.allowed_relationships[].allowed_disclosures[]
-subject_access.delegation.allowed_relationships[].allowed_formats
-subject_access.delegation.allowed_relationships[].allowed_formats[]
-subject_access.delegation.allowed_relationships[].allowed_purposes
-subject_access.delegation.allowed_relationships[].allowed_purposes[]
-subject_access.delegation.allowed_relationships[].max_proof_age_seconds
-subject_access.delegation.allowed_relationships[].proof_claim
-subject_access.delegation.allowed_relationships[].relationship_type
-subject_access.delegation.allowed_relationships[].target_id_type
-subject_access.delegation.enabled
-subject_access.enabled
-subject_access.rate_limits
-subject_access.rate_limits.credential_issuance_per_principal_per_hour
-subject_access.rate_limits.invalid_token_per_client_address_per_minute
-subject_access.rate_limits.per_holder_per_hour
-subject_access.rate_limits.per_principal_per_minute
-subject_access.rate_limits.subject_mismatch_per_principal_per_hour
-subject_access.rate_limits.tx_code_attempts_per_code_per_minute
-subject_access.required_scopes
-subject_access.required_scopes[]
-subject_access.scope_policy
-subject_access.subject_binding
-subject_access.subject_binding.allow_sub_as_civil_id
-subject_access.subject_binding.claim_source
-subject_access.subject_binding.id_type
-subject_access.subject_binding.normalize
-subject_access.subject_binding.request_field
-subject_access.subject_binding.token_claim
-subject_access.token_policy
-subject_access.token_policy.assurance_claim_source
-subject_access.token_policy.max_access_token_lifetime_seconds
-subject_access.token_policy.max_auth_age_seconds
-subject_access.token_policy.max_clock_leeway_seconds
-subject_access.token_policy.max_credential_validity_seconds
-subject_access.token_policy.max_evaluation_age_seconds
-subject_access.token_policy.required_acr_values
-subject_access.token_policy.required_acr_values[]
-```
-{/* registry-notary-config-key-paths:end */}
-
-## Top-level areas
-
-| Area | Responsibility |
-| --- | --- |
-| `server` | Public and optional dedicated admin listeners and HTTP bounds |
-| `auth` | Configured API-key, static bearer, and OIDC authentication and scope mapping |
-| `deployment` | Deployment profile and assurance evidence |
-| `audit` | Notary-owned redacted audit sink and keyed chain |
-| `config_trust` | Product bundle verification and anti-rollback state |
-| `evidence` | Service identity, Relay connection, claims, signing keys, and credential profiles |
-| `cel` | Isolated claim-policy worker limits |
-| `state` | PostgreSQL or explicit local in-memory correctness state |
-| `credential_status` | Optional credential lifecycle state |
-| `subject_access` | OIDC-bound direct and delegated subject-access policy |
-| `oid4vci` | Wallet-facing issuance facade |
-| `federation` | Static-peer delegated evaluation |
-
-Unknown configuration fields are rejected except forward-compatible metadata
-inside `authorization_details`, as described under Authentication and
-delegation. Use the generated configuration from Registry Stack project
-authoring as the source of truth rather than maintaining a second handwritten
-example.
-
-## Environment expansion
-
-Notary expands `${VAR}` expressions before YAML parsing. `${VAR}` requires
-`VAR` to be set to a non-empty value. `${VAR:-fallback}` uses `fallback` when
-`VAR` is unset or empty, including `${VAR:-}` for an explicit empty result.
-`${VAR:?message}` fails with `message` when `VAR` is unset or empty.
-Whitespace-only values are non-empty. Diagnostics name the variable or use the
-supplied message; they never include the variable value.
-
-## Evidence modes
-
-Every claim uses one sealed evidence mode:
-
-- `registry_backed` names a compiler-produced consultation expectation. It
-  requires the project's Relay connection.
-
-A configuration may start with no claims. If claims are configured, the
-project must also configure exactly one logical Relay connection. Every claim,
-including a claim authorized through subject access or selected by federation,
-must resolve to a compiler-pinned Relay consultation. Identity and request
-inputs authorize or parameterize that consultation; they are not evidence.
-
-## Relay connection
-
-The Relay connection contains the Relay origin and an owner-readable workload
-token file. For an HTTPS Relay using a private trust root,
-`root_certificate_path` names a bounded regular PEM bundle with mode `0400` or
-`0600`, owned by root or the Notary effective user. Exact private CIDRs may be
-admitted when required. Notary does not configure source origins, OAuth token
-endpoints, source credentials, protocol keys, source request limits, or adapter
-scripts.
-
-Notary validates each expected consultation's identity, purpose, input roles
-and schemas, outcome union, output schemas, provenance, runtime requirements,
-and `contract_hash` before serving. Startup and readiness fail closed on a
-semantic or hash mismatch. Every execute request carries the exact hash.
-
-Rotate the workload credential by atomically replacing its regular,
-owner-readable file. Do not rewrite it in place. Diagnostics must report only
-bounded status and never the token, its path, selectors, Relay response body,
-or source details.
-
-## Claims and disclosure
-
-Claims may directly reference a consultation output or use CEL over allowed
-consultation outcome, outputs, and bounded request variables. Direct output
-claims become null on `no_match` in the evaluation view and are not issuable
-as null credential claims. Ambiguity or failure evaluates no claims from that
-consultation.
-
-Consultation outputs use a closed tagged schema. Scalar output variants are
-`boolean`, `integer`, `string`, and `date`. Direct output claims also accept
-recursive `object` and `array` variants:
-
-```yaml
-outputs:
-  parents:
-    type: array
-    nullable: false
-    max_bytes: 1024
-    max_items: 2
-    items:
-      type: object
-      nullable: false
-      max_bytes: 384
-      fields:
-        type:
-          required: true
-          schema:
-            type: string
-            nullable: false
-            max_bytes: 16
-        name:
-          required: true
-          schema:
-            type: string
-            nullable: false
-            max_bytes: 160
-        identifier:
-          required: false
-          schema:
-            type: string
-            nullable: true
-            max_bytes: 64
-```
-
-Objects must declare 1 to 32 fields. Unknown keys are rejected. Arrays must
-declare one item schema and a `max_items` value from 1 through 256. Object and
-array `max_bytes` values are canonical serialized-value limits from 1 through
-65,536 bytes. The complete expected output map permits at most 32 outputs,
-schema depth is at most 8, schema node count is at most 256, expanded node
-count is at most 4,096, and each field name is at most 128 UTF-8 bytes.
-
-Notary requires exact schema agreement with the compiler-pinned Relay public
-contract. A direct structured claim is stored and issued as the exact validated
-JSON value. CEL rules remain scalar-only.
-
-`value.max_bytes` is an optional UTF-8 byte ceiling for a string claim result.
-When present, it must be between 1 and 65536 and `value.type` must be `string`.
-Notary accepts a result exactly at the bound, rejects an over-bound result as a
-value-free rule-evaluation failure, and preserves null for nullable claims.
-Omitting the field preserves the absence of a per-claim ceiling in older direct
-Notary configurations; the global CEL and response safety limits still apply.
-Registry Stack project authoring requires and emits the field for string
-claims.
-
-Disclosure remains a Notary decision. Credential profiles own ordered claim
-membership, issuance format, holder binding, validity, and allowed disclosure.
-Relay outputs are never credentials or public claims by themselves.
-A top-level structured SD-JWT claim is disclosed or withheld as one unit.
-Nested object fields and individual array items are not separate disclosures.
-
-`formats` is optional for each claim. When omitted, Notary uses
-`application/vnd.registry-notary.claim-result+json`, the canonical evaluation
-response format. An explicit list must include that format and may otherwise
-contain only `application/ld+json; profile="cccev"`. Do not set `formats: []`,
-an unknown format, or `application/dc+sd-jwt`: all are invalid configuration.
-SD-JWT VC belongs in a credential profile's issuance `format`, not a claim's
-evaluation response-format list. The same separation applies to
-`subject_access.allowed_formats`: list evaluation renderers there and select
-the credential output through `credential_profiles`.
-
-## Authentication and delegation
-
-Authentication has no mode selector. The configured methods define the
-accepted callers. API keys may be configured alongside OIDC so service callers
-and citizen or wallet flows can use one Notary instance. Each request must
-present exactly one credential type; presenting an API key and a bearer token
-together fails before either credential is authenticated. Static bearer tokens
-cannot be configured alongside OIDC because both use the `Authorization:
-Bearer` transport.
-
-`authorization_details` is a versioned interoperability object shared by
-static configuration and token or OIDC JSON. Known authorization fields,
-including subject, target, relationship, assisted access, and exact claim
-references, are enforced by the authorization checks. Future metadata fields
-at those object levels are accepted and ignored so an additive producer does
-not break an older Notary. Unrecognized metadata never grants authority.
-`ClaimRef` objects remain closed because an extra field there could conceal a
-misspelled claim or version selector.
-
-Citizen and wallet flows use the subject access subject-binding policy.
-Delegated access must bind requester, target, relationship, purpose, and
-authorization details before evaluation. A delegated Relay proof consultation
-proves only its exact compiled edge and does not grant scopes.
-
-An OID4VCI credential configuration can opt into representative issuance with
-`representative_issuance.ceremony:
-digitally_authenticated_representative` and one relationship name. The
-credential root must depend directly on that relationship's registry-backed
-proof claim. The committed delegated capability carries the exact proof and
-dependency closure; evaluation does not recover that closure from mutable
-configuration. Credential status must be enabled. Prefer the compact
-Registryctl authoring surface documented in
-[representative credential issuance](representative-credential-issuance.md)
-over hand-authoring these coupled runtime fields.
-
-Credential issuance additionally requires the stored evaluation to contain one
-exact compiler pin for every registry-backed claim in each selected root's
-dependency closure, plus one normalized execution record for every unique Relay
-consultation ULID. Claim/version, Relay profile and contract hash, canonical
-purpose, ULID, acquisition time, and each root's public unique-consultation
-count must match the active configuration and evaluation. A deterministic
-SHA-256 execution binding cross-binds each claim pin, execution, and exact claim
-provenance. Missing, duplicated,
-extra, legacy, or modified provenance is denied before signer, credential-id,
-or status side effects. Direct issuance checks before holder-proof replay
-mutation. OID4VCI rejects a credential configuration without complete
-Relay-backed provenance, creates and evaluates the registry transaction before
-rendering an offer, consumes the
-transaction-bound proof nonce at the credential endpoint, and checks stored
-provenance before signer access. Delegated subject access is
-evaluation-only unless one credential configuration explicitly selects the
-digitally authenticated representative ceremony. Direct issuance and other
-OID4VCI configurations continue to reject delegated evaluations.
-
-Notary persists these private Relay identifiers only when every selected root
-shares a mutually validated credential profile. Registry-backed
-evaluation-only claims store no private issuance provenance. The execution
-binding detects partial mutation, not a store operator who can rewrite all
-fields and recompute an unkeyed digest; database and audit controls remain the
-authenticity boundary.
-
-## State and operations
-
-Deployment waivers name one finding, a required operator reference, and a mandatory expiry date.
-The reference is 1 to 128 bytes, has no surrounding whitespace, uses only letters, digits, `.`,
-`_`, `:`, and `-`, and cannot contain `..`.
-References cannot start, case-insensitively, with `Bearer:<value>` or `Basic:<value>`, directly or
-after `Authorization:`.
-Use a ticket-style reference such as `OPS-2026-0042`.
-An optional summary is 1 to 256 Unicode characters, already trimmed, contains no control
-characters, and cannot be an authorization value or contain a private-key begin marker.
-Omit `summary` when it is not needed; explicit `null` is invalid.
-Keep credentials and private keys out of both fields.
-These rules implement
-[RS-OP-POSTURE](https://docs.registrystack.org/spec/rs-op-posture/) (REQ-OP-POSTURE-011).
-
-```yaml
-deployment:
-  profile: hosted_lab
-  waivers:
-    - finding: notary.openapi.public
-      reference: OPS-2026-0042
-      summary: Public API catalog is approved for the lab
-      expires: 2026-09-30
-```
-
-Expired waivers stop suppressing their finding and raise `deployment.waiver_expired`.
-`startup_fail` and `readiness_fail` gates are not waivable. The default posture tier omits waiver
-metadata; the restricted tier can report only the validated reference, optional summary, and
-expiry. Boot warnings use the same metadata. Audit records remain minimized to finding IDs.
-
-Use the typed Notary-owned PostgreSQL state schema for multi-instance or
-production deployments. The schema holds replay, nonce, evaluation,
-idempotency, credential-status, quota, and preauthorization state. Explicit
-in-memory state is limited to local, single-instance development. Keep Notary
-and Relay state, audit keys, and chains separate. Protect admin routes with
-their dedicated listener and required operator scopes.
-
-## Validation workflow
-
-Run checks in increasing order of network effect:
-
-```sh
-registry-notary explain-config --config generated-notary.yaml
-registry-notary doctor --config generated-notary.yaml
-registry-notary --config generated-notary.yaml state doctor
-registry-notary doctor --config generated-notary.yaml --live
-```
-
-The live check contacts only the approved Relay dependency. Run a controlled
-project journey separately to exercise source acquisition, claim evaluation,
-disclosure, and issuance. Keep all credentials in process environments or
-mounted secret files and out of command lines and retained logs.
-
-## Rollout
-
-Relay and Notary use separately built, signed, verified, anti-rollback-tracked,
-and boot-activated product bundles. A combined rollout is compatible staged
-activation, not atomic project activation; current source has no signed
-project-root bundle or activation coordinator.
-
-Verify both product bundles first. Start or stage Relay without admitting
-caller traffic and require its health, readiness, audit, and deployment-posture
-checks to pass. Then start or stage Notary, require startup and readiness to
-validate its Relay contract, and require Notary health, audit, and posture
-checks to pass. Admit caller traffic only when both products are ready and the
-contract check succeeds. An execute-time contract mismatch fails at Relay
-before source access.
-
-The complete generated schema, runtime diagnostics, and OpenAPI are
-authoritative for exact field syntax.
diff --git a/products/notary/docs/postgresql-correctness-state-execution-spec.md b/products/notary/docs/postgresql-correctness-state-execution-spec.md
deleted file mode 100644
index 6199d77aa..000000000
--- a/products/notary/docs/postgresql-correctness-state-execution-spec.md
+++ /dev/null
@@ -1,516 +0,0 @@
-# Registry Notary PostgreSQL correctness-state execution specification
-
-**Status:** implementation contract for registry-stack issue #356
-
-**Date:** 2026-07-14
-**Stacked base:** `agent/relay-notary-country-authoring` at `94b378320bff397aa0ca32f7d0d696c6fd4b26c5`
-**Implementation branch:** `agent/notary-postgresql`
-
-## 1. Outcome and boundary
-
-Registry Notary will have one production correctness-state topology: typed,
-Notary-owned PostgreSQL schemas accessed by a restricted Notary runtime role.
-PostgreSQL owns every decision that must survive process restart or be shared
-between identical Notary instances. In-memory implementations remain only for
-focused tests and an explicit single-process local development mode.
-
-One database belongs to one independently configured Notary authority. Only
-replicas of that same Notary trust domain share it. Independent Notary
-services use separate databases and role pairs rather than a generic tenant
-column or caller-selectable namespace.
-
-This change will:
-
-- move replay, nonce, evaluation, idempotency, credential-status, quota, and
-  preauthorization state to PostgreSQL;
-- preserve domain-specific transaction and retention semantics;
-- fail startup and readiness when the database, schema, supported PostgreSQL
-  major, or runtime role is unavailable or incompatible;
-- document installation, forward upgrade, backup, restore, retention, and
-  recovery;
-- make the production path usable by implementers through one configuration
-  block, deterministic install and doctor commands, actionable value-free
-  diagnostics, and a realistic local-to-production journey;
-- remove Notary Redis configuration, code, dependencies, images, services,
-  checks, and current documentation in the same delivery; and
-- prove PostgreSQL 16, 17, and 18 behavior, process restart, multi-instance
-  races, and takeover.
-
-The implementation must not reuse Relay tables, schemas, roles, migrations,
-advisory-lock identifiers, or state semantics. It may reproduce the proven
-mechanics for PostgreSQL URL loading, TLS, bounded certificate reads,
-connection timeouts, driver ownership, role attestation, schema fingerprints,
-and value-free diagnostics.
-
-The implementation must not introduce a reusable state framework, an opaque
-key-value table, a dual Redis/PostgreSQL mode, or unrelated hardening.
-
-### 1.1 Implementer experience contract
-
-Security and implementer usability are joint release requirements. A secure
-state plane that an implementer cannot reliably install, inspect, and recover
-does not produce a usable deployment.
-
-The 1.0-facing path therefore has these acceptance criteria:
-
-- one top-level `state` block configures all Notary correctness domains;
-- configuration rejects removed Redis and per-domain storage selectors with a
-  precise field-level error rather than accepting aliases or silent defaults;
-- `registry-notary state install` applies the product-owned schema with a
-  separately provisioned owner connection, and never grants the runtime role
-  table access;
-- `registry-notary state doctor` exercises the same role, schema, version,
-  fingerprint, read-write, and transaction-function contract used at startup
-  and readiness;
-- diagnostics name the failed invariant and the operator action without
-  exposing database URLs, role names, paths, identifiers, ciphertext, or SQL;
-- the documented journey starts with explicit single-process `in_memory`
-  local development, then changes only the `state` block and secrets to reach
-  the supported PostgreSQL deployment;
-- PostgreSQL 16, 17, and 18 use the same migration artifact and public
-  commands; and
-- adding a future correctness domain requires a typed private table, fixed
-  transaction function, migration, retention rule, recovery rule, focused
-  tests, and an update to this inventory. It does not require a new backend
-  selector or generic storage framework.
-
-An implementer proof must run the documented install, doctor, startup,
-readiness, restart, and multi-instance flow without private SQL or
-repository-internal setup knowledge beyond database and role provisioning.
-
-## 2. State authority inventory
-
-The following table is exhaustive for process-local or Redis-backed Notary
-correctness state at the stacked base.
-
-| Domain | Current implementation | Production authority after this change | Transaction and concurrency requirement | Retention and recovery requirement | Sensitivity |
-| --- | --- | --- | --- | --- | --- |
-| Replay identifiers | `registry-platform-replay` through `ReplayStores`; Redis or in-memory | `registry_notary_private.replay_identifier` | Insert a scoped identifier exactly once. Concurrent inserts across instances produce one winner. An unexpired row always rejects. An expired row may be replaced atomically. Stable, domain-separated Notary hashes keep a spent identifier authoritative across application-secret rotation. | Absolute token or request expiry. Expired rows are pruned in bounded batches. Backup and restore must retain all unexpired rows or the service must remain offline until every token valid at the restore point has expired. | Store only domain-separated hashes of scope and protocol-generated high-entropy identifiers, never raw JWTs, nonces, tenants, issuers, holders, or subjects. |
-| Consumable OID4VCI nonces | `ConsumableNonceStore`; Redis or in-memory | `registry_notary_private.consumable_nonce` | Reserve only when no live reservation or consumed tombstone exists. Every replacement increments a stored generation. Consumption first reads one live generation, then atomically compares that generation while changing the row to consumed. Missing, expired, consumed, or replaced generations fail. A successful consume retains a consumed tombstone for 60 seconds so stale operations and immediate re-reservation cannot reopen the nonce. | Reservation expiry is the configured nonce expiry. A consumed tombstone expires 60 seconds after consumption. Generation, reservation, and tombstone survive restart and restore. | Store only domain-separated hashes plus generation, state, and timestamps. |
-| Evaluation retention | `EvidenceStore.evaluations`, process-local `HashMap` | `registry_notary_private.evaluation` | Insert one complete stored evaluation after evaluation succeeds. Reads return the exact stored record only while unexpired. No partial result is published. | The record's absolute `expires_at`, currently normally 15 minutes or the stricter subject access expiry. Expired rows are deleted in bounded batches. Restore preserves unexpired records and their access-binding metadata. | Results may contain minimized claim values. Use typed identity/time columns plus a versioned JSON record, expose access only through fixed functions, and require encrypted database storage and backups operationally. |
-| Batch idempotency | `EvidenceStore.idempotency`, process-local map plus watch channels | `registry_notary_private.batch_idempotency` | Atomically bind one idempotency-key hash to one request hash and one owner lease. The first owner reservation and its machine-quota debit commit together and set an immutable `quota_charged` marker. Same-hash callers wait and replay the completed response without another debit. A different hash conflicts. Failed or expired ownership can be taken over with a new unguessable owner token without another debit. Only the current owner can complete or fail. Evaluation rows and the completed response publish in one transaction, and a completed response cannot be replaced. | Completed and failed rows remain for 15 minutes. In-flight rows carry a bounded lease and become takeover-eligible after owner loss. Restore retains completed responses and never turns completion into new ownership. | Hash the client idempotency key. The stored response can contain claim values and receives the same controls as evaluations. |
-| Credential status | `CredentialStatusStore`; Redis or in-memory with process-local striped transition locks | `registry_notary_private.credential_status` | Issuance is insert-only and fails on an existing credential id. Status update locks the row and enforces valid, suspended, and terminal revoked transitions in the database transaction. PostgreSQL derives the effective status from database time: revoked remains terminal, expiry supersedes valid or suspended, and replica clocks cannot reopen an expired credential. Concurrent instances cannot reverse revocation, disagree on expiry, or lose a winning transition. | Retain until credential expiry plus `credential_status.retention_seconds`. Restore must preserve revoked and suspended state before issuance resumes. | Credential ids and profile/issuer metadata are restricted operational data. They are never written to logs or diagnostics. |
-| Machine evaluation quota | `MachineQuotaLimiter`, process-local fixed-window map | `registry_notary_private.machine_quota` | Atomically check and debit the whole request cost for one keyed principal. A rejected batch consumes nothing. Concurrent instances share the same fixed one-minute window and limit. | Delete after the one-minute window. Restore preserves a conservative debit or the service waits for the restored window to expire. | Store a keyed audit pseudonym for the principal, not the raw principal id. |
-| Subject access rate limits | `SubjectAccessRateLimiter`, process-local fixed-window map | `registry_notary_private.subject_access_quota` | Check every applicable bucket and debit all applicable buckets in one transaction. If any bucket is exhausted, debit none. Check-only operations do not mutate. Concurrent instances share counters. | Delete when each one-minute or one-hour window ends. Restore preserves a conservative debit or waits for the maximum one-hour window. | Keys are already keyed audit pseudonyms. Store the pseudonym, bucket kind, window, and count only. |
-| Preauthorization login state | `SingleUseStore<LoginState>`, process-local | `registry_notary_private.preauthorization_login_state` | Reserve an opaque state once, subject to the existing 4,096-row abuse bound. Callback atomically deletes and returns one unexpired record. Unknown, duplicate, expired, and already-consumed state fails closed across instances. Capacity check and insertion are one transaction. Login and transaction-code reservations take one fixed Notary-specific advisory lock and reject a different live key id, so competing replicas cannot create mixed live key generations. | Absolute `login_state_ttl_seconds`, at most 600 seconds. Expired rows are deleted. Restore never makes expired rows usable. Activation, doctor, and every readiness probe attest that every live sensitive row matches the configured key id. | PKCE verifier and eSignet nonce are application-encrypted with an operator-supplied 256-bit sensitive-state key before storage. Associated data binds schema version, row kind, key hash, key id, and expiry. Plaintext is zeroized after use. |
-| Preauthorization transaction-code session | `SingleUseStore<TxCodeSession>`, process-local | `registry_notary_private.preauthorization_tx_code` | Reserve by the stable, domain-separated pre-authorized-code JTI hash used for replay. Replay scope is fixed by the verified Notary issuer from the signed token contract, not mutable service or credential-issuer configuration. The signed pre-authorized code binds whether its exact offer requires a transaction code, so restart or reconfiguration cannot weaken or add the PIN requirement for a live offer. Wrong PIN may read without consuming. Correct PIN redemption atomically inserts the stable pre-authorized-code replay marker and deletes the verifier, producing exactly one winner across instances and preserving one-time use after sensitive-key rotation or unrelated configuration changes. Reservation shares the sensitive-key generation lock and rejects a different live key id in either preauthorization table. | Absolute pre-authorized-code expiry, at most 600 seconds. Delete the PIN verifier on successful code use and on expiry, but retain the replay marker until code expiry. Restore and every readiness probe preserve the same live-key attestation as login state. | Store only stable hashes of the verified Notary issuer scope and protocol-generated high-entropy JTI, plus a keyed PIN verifier made with a separate domain-separated MAC subkey, never reversible PIN ciphertext. Raw code, JTI, and PIN are not stored or logged. |
-
-The six subject access bucket kinds remain distinct and closed:
-
-| Bucket | Window | Atomic grouping |
-| --- | --- | --- |
-| Invalid token per client address | 1 minute | Denial debit |
-| Authenticated request per principal | 1 minute | Request, mismatch, and issuance groups as currently defined |
-| Subject mismatch per principal | 1 hour | Principal check plus mismatch denial debit |
-| Credential issuance per holder | 1 hour | Principal and credential-issuance buckets |
-| Credential issuance per principal | 1 hour | Principal and optional holder buckets |
-| Transaction-code attempts per code | 1 minute | One attempt debit |
-
-## 3. Explicitly classified non-authorities
-
-The following process-local values do not decide durable correctness and will
-not move to PostgreSQL:
-
-- signed status-list JWT cache entries, because every request first reads the
-  authoritative credential-status record and the cache key includes its exact
-  status and `updated_at` value;
-- OIDC and JWKS transport caches;
-- Relay readiness results and singleflight caches;
-- signer sessions and file-watch observations;
-- request-local evaluation dependency maps and coalesced Relay calls;
-- metrics counters, semaphores, HTTP client caches, and offline fixture maps.
-
-The following durable authorities already have separate ownership and remain
-outside issue #356:
-
-- the Notary audit chain and shipping acknowledgement cursor remain owned by
-  the configured audit sink and audit policy;
-- governed-config antirollback state and break-glass approval files remain
-  owned by the signed-config workflow; and
-- signing keys remain owned by their configured provider.
-
-These exclusions do not authorize memory-backed alternatives for any domain in
-the state authority inventory.
-
-## 4. PostgreSQL ownership and schema contract
-
-The database contract is product-owned and typed:
-
-```text
-PostgreSQL cluster
-└── Notary database
-    ├── registry_notary_private schema
-    │   ├── schema_metadata
-    │   ├── replay_identifier
-    │   ├── consumable_nonce
-    │   ├── evaluation
-    │   ├── batch_idempotency
-    │   ├── credential_status
-    │   ├── machine_quota
-    │   ├── subject_access_quota
-    │   ├── preauthorization_login_state
-    │   └── preauthorization_tx_code
-    └── registry_notary_api schema
-        └── fixed, typed transaction functions
-```
-
-There are two database roles:
-
-- the owner role applies forward-only migrations and owns the schema; and
-- the runtime role connects from Notary and has schema usage plus execution on
-  the fixed transaction functions in `registry_notary_api`.
-
-The runtime role has no direct privileges on private tables or sequences. It
-must not own either schema, create objects in them, be a
-superuser, bypass row security, create roles or databases, or use Relay roles.
-The owner defines every runtime function as `SECURITY DEFINER`, pins an empty
-or explicit `search_path`, schema-qualifies every object reference, and revokes
-default `PUBLIC` execution before granting the runtime role the exact function
-signatures it needs.
-The metadata row binds schema version, capability id, deterministic schema
-fingerprint, owner role OID, and runtime role OID. Runtime startup verifies
-that metadata and the required positive and negative privileges.
-
-The initial capability is `registry.notary.postgresql-state/v1`. Runtime code
-accepts exactly the compiled schema version and fingerprint. It never applies
-DDL automatically and never serves against a partially upgraded schema.
-
-PostgreSQL server majors 16, 17, and 18 are supported. Other majors fail
-startup with a value-free compatibility diagnostic until explicitly tested.
-
-## 5. Runtime configuration and activation
-
-One top-level state configuration replaces per-domain storage selection:
-
-```yaml
-state:
-  storage: postgresql
-  postgresql:
-    url_env: REGISTRY_NOTARY_POSTGRES_URL
-    root_certificate_path: /run/secrets/notary-postgres-ca.pem
-    connect_timeout_ms: 5000
-    operation_timeout_ms: 2000
-    max_connections: 16
-    sensitive_state_key_env: REGISTRY_NOTARY_SENSITIVE_STATE_KEY
-```
-
-Rules:
-
-- `postgresql` is the only deployable storage value.
-- `in_memory` is accepted only with `deployment.profile: local` and
-  `deployment.multi_instance: false`.
-- A production, evidence-grade, hosted-lab, or multi-instance configuration
-  with `in_memory` fails validation. There is no waiver.
-- `replay.storage`, `replay.redis`, `credential_status.storage`, and
-  `credential_status.redis` are removed rather than aliased.
-- The database URL is loaded only from the named environment variable, held in
-  zeroizing memory, never emitted through `Debug`, posture, doctor, or errors,
-  and parsed with the PostgreSQL client parser.
-- TLS is required for every PostgreSQL connection, including local PostgreSQL
-  testing. The optional root certificate is size-bounded and read without
-  disclosing its path on failure.
-- Each replica owns a Notary-specific pool capped by `max_connections`; values
-  outside 1 through 256 are rejected before allocation. Pool admission waits
-  at most `operation_timeout_ms`. Physical
-  connection establishment remains bounded by `connect_timeout_ms`.
-- A physical connection enters the pool only after complete session setup and
-  schema, role, catalog, server, writeability, and durability attestation. It
-  is reused across typed state operations, then discarded after an operation
-  timeout, query or driver failure, failed readiness attestation, or database
-  URL generation change.
-- The database URL generation is a process-keyed HMAC tag. The pool does not
-  retain or log the URL to detect a generation change. A replacement physical
-  connection reloads the named environment variable and completes full
-  attestation before use.
-- The sensitive-state key is base64url-encoded 32-byte key material. It is
-  required whenever preauthorization is enabled with PostgreSQL. Identical
-  replicas use the same key for the lifetime of any unexpired row. Activation,
-  doctor, and every readiness probe fail closed when any live login or
-  transaction-code row has a different derived key id.
-- Domain-separated subkeys are derived for login-state AEAD, transaction-code
-  PIN verification, and keyed login-state identifiers. Preauthorization replay
-  scope and JTI hashes use the stable Notary replay domains, with scope fixed
-  by the verified token issuer, so a redeemed code remains spent after
-  sensitive-state key rotation or unrelated service configuration changes.
-  The key id is stored with ciphertext and PIN-verifier rows, but key material
-  is never stored. Rotation stops new preauthorization issuance, drains or
-  prunes all rows for at most the 600-second maximum lifetime, then replaces
-  the key before issuance resumes.
-
-Runtime compilation remains side-effect free. Async activation connects to
-PostgreSQL, validates the database contract, installs the state backend, then
-activates Relay where applicable. No listener binds before both state and
-Relay activation succeed.
-
-## 6. Transaction contract
-
-All time comparisons use PostgreSQL `clock_timestamp()` so identical replicas
-share one authority. Application wall clocks do not decide expiry or quota
-windows.
-
-### 6.1 Replay and nonce
-
-- Replay insert is one statement or transaction that inserts when absent or
-  replaces only an expired row. It returns inserted or already seen.
-- Nonce reserve inserts reserved state when absent or expired, but not while a
-  consumed tombstone is live.
-- Nonce consume locks or conditionally updates exactly one reserved,
-  unexpired row to consumed with a 60-second tombstone. No success path deletes
-  the tombstone.
-
-### 6.2 Evaluation and idempotency
-
-- Evaluation publication inserts the complete versioned record and its typed
-  identity and expiry columns together. For a batch, all evaluation rows and
-  the completed idempotency response commit in the same transaction.
-- Idempotency reservation serializes on the key hash. It returns owner, wait,
-  replay, or conflict. Initial ownership and machine-quota debit commit in the
-  same transaction with a permanent `quota_charged` marker. Ownership uses a
-  random token and bounded lease.
-- Waiters poll with a bounded interval and the request deadline. They do not
-  evaluate while a live owner exists.
-- Completion and failure compare key hash, request hash, and owner token.
-  Completion writes the response and terminal status atomically. Owner loss
-  leaves a lease that another instance can take over after expiry without
-  charging quota again.
-
-### 6.3 Credential status
-
-- Issuance inserts the complete initial valid record and rejects any existing
-  credential id instead of overwriting it.
-- Update locks the credential row, validates the transition, changes status
-  and `updated_at`, and returns the committed record in one transaction.
-- Revoked is terminal. Expiry is derived from the stored credential expiry and
-  does not rewrite the explicit status.
-
-### 6.4 Quotas
-
-- Machine quota locks one principal bucket, resets only after its fixed window,
-  and applies the complete subject cost or no cost.
-- Subject access quota locks all applicable bucket rows in deterministic
-  bucket/key order, checks them all, then debits them all. Any denial rolls the
-  whole transaction back.
-- Database or transaction uncertainty fails closed. It is never treated as an
-  unused quota.
-
-### 6.5 Preauthorization
-
-- Login state reserve and consume are one-winner operations.
-- Transaction-code peek returns one unexpired encrypted value without mutation
-  so a wrong PIN does not burn the offer.
-- The token path verifies scope and authorization details and verifies the PIN
-  before mutation. It then atomically inserts the pre-authorized-code replay
-  identifier and deletes the matching PIN verifier in one database
-  transaction. No second token can win.
-- PIN verification uses a constant-time keyed MAC comparison with a dedicated
-  derived subkey. The PIN is not decryptable from database state.
-- Ciphertext includes a fresh random AEAD nonce. Associated-data mismatch,
-  decryption failure, missing key material, or unknown format fails closed and
-  does not reveal which field failed.
-
-## 7. Retention maintenance
-
-Every table has an indexed absolute expiry column where applicable. Every
-serving Notary instance begins maintenance once per minute. One transaction
-deletes at most 1,000 expired rows from each typed table in deterministic,
-skip-locked batches and returns both the aggregate deletion count and whether
-any individual table filled its batch. A filled per-table batch starts another
-bounded transaction after an internal, bounded backoff. The worker releases
-its pooled session between transactions and repeats until every table returns
-a short batch. This catch-up behavior is fixed runtime policy, not an operator
-configuration surface, and concurrent maintenance remains safe.
-
-Logical expiry checks remain authoritative between transactions and scheduled
-passes. A transient maintenance failure ends the current catch-up sequence and
-the next scheduled pass retries. Maintenance failure makes readiness fail only
-when it also proves the database contract or runtime operation is unavailable;
-ordinary transient cleanup contention does not stop serving valid state.
-
-No retention operation deletes an unexpired replay row, nonce tombstone,
-idempotency completion, revocation record, quota window, or preauthorization
-row. Operators may lower future retention settings, but existing rows keep the
-absolute expiry assigned when they were written.
-
-## 8. Migration and upgrade
-
-This pre-1.0 cutover is a clean PostgreSQL installation, not an online Redis
-adapter migration. The old Redis records do not have a complete typed schema
-or an authenticated export contract, and retaining an importer would preserve
-the prohibited compatibility dependency.
-
-The final v1 fingerprint also fixes pre-authorized-code replay identity to the
-verified Notary issuer and stable replay hashes. A prerelease database created
-from an earlier development commit cannot transform its keyed markers because
-raw JTIs are intentionally absent. Stop issuance, drain outstanding codes, and
-install a fresh schema. Do not accept the earlier fingerprint or reuse that
-database with the final v1 binary.
-
-The cutover procedure is therefore:
-
-1. stop all Notary writers;
-2. confirm credential status is disabled or the existing store contains no
-   records that must survive, because revocation or suspension state must not
-   be discarded;
-3. wait for the maximum configured lifetime of outstanding replay, nonce,
-   evaluation, idempotency, quota, and preauthorization records, up to the
-   one-hour subject access window;
-4. install the PostgreSQL owner/runtime roles and schema with the owner role;
-5. start one Notary replica, confirm startup and readiness attestation, then
-   start the remaining identical replicas; and
-6. remove the Redis service, volume, secret, monitoring, and backup job only
-   after the PostgreSQL-backed smoke and restart checks pass.
-
-If step 2 finds credential-status data that must survive, the upgrade is
-blocked. Do not reinitialize or silently mark credentials valid. This clean
-cutover policy is acceptable only while Registry Stack remains pre-1.0 with no
-production status data. Once that assumption changes, a separately reviewed
-typed export/import migration is mandatory before cutover.
-
-Future PostgreSQL upgrades are forward-only owner migrations. The documented
-sequence is backup, stop writers, apply the next migration, attest the new
-fingerprint and role, start one replica, verify readiness, then roll out
-identical replicas. Runtime binaries refuse old, new, or partially applied
-schemas, so application rollback also requires restoring the matching database
-backup and preauthorization key material.
-
-After a logical restore into a fresh cluster, role OIDs can legitimately
-change. `state install` may rebind only the metadata owner/runtime OIDs and
-reapply the fixed runtime grants when the capability, schema version, semantic
-fingerprint, complete catalog, and object ownership already match the released
-contract. The rebind and full attestation are one transaction. Any other drift
-rolls the transaction back; the installer does not repair it.
-
-## 9. Backup, restore, and recovery
-
-A recoverable backup set contains:
-
-- the complete Notary database at one consistent PostgreSQL recovery point;
-- owner and runtime role definitions or reproducible role provisioning;
-- the exact schema migration set and application version;
-- the sensitive-state key through the deployment secret manager,
-  never inside the database backup; and
-- the audit sink and governed-config state through their separate documented
-  backup procedures.
-
-Backup and restore evidence must prove that replay decisions, nonce tombstones,
-completed idempotency responses, credential status, quotas, evaluation expiry,
-and encrypted preauthorization rows retain their semantics after restart.
-
-A restore from a point that might predate an acknowledged one-time consume or
-quota debit must not serve immediately. Keep Notary offline until every token
-and preauthorization value that could have been valid at the recovery point
-has expired and the maximum one-hour quota window has elapsed. Restore of a
-known quiesced, transactionally consistent backup may serve after schema,
-role, key, and semantic conformance checks pass.
-
-If the sensitive-state key is unavailable, keep Notary unavailable until all
-restored preauthorization rows expire, delete those expired rows, provision a
-new key, and then resume. Never weaken decryption or expose ciphertext to make
-the service start.
-
-## 10. Readiness and diagnostics
-
-Startup fails before listener bind for:
-
-- missing or empty URL/key environment variables;
-- invalid URL or forbidden insecure TLS mode;
-- connection timeout or unavailable database;
-- unsupported PostgreSQL major;
-- read-only or recovery-mode database;
-- missing, extra, or incompatible schema metadata;
-- any live preauthorization row whose key id differs from the configured
-  sensitive-state key;
-- schema fingerprint mismatch;
-- connected-role OID mismatch; or
-- missing required or present forbidden privileges.
-
-Every readiness probe performs the complete server, writeability, durability,
-schema, catalog, and role attestation on a bounded pooled session. Startup
-performs the same attestation before listener bind. Startup and `state doctor`
-report the same stable public classification:
-
-- `notary.state.postgresql.database_unavailable` for transport, TLS trust, or
-  service outage;
-- `notary.state.postgresql.database_read_only` for a read-only or recovering
-  database;
-- `notary.state.postgresql.database_unsupported` for an unsupported server
-  major;
-- `notary.state.postgresql.durability_unsafe` for unsafe durability settings;
-- `notary.state.postgresql.schema_incompatible` for schema, catalog,
-  fingerprint, or privilege drift; and
-- `notary.state.postgresql.role_incompatible` for runtime-role contract drift.
-
-Each code renders only its static safe meaning and remediation. Diagnostics do
-not expose table names, role names, paths, URLs, credentials, SQL, or stored
-identifiers.
-
-Readiness recovers after database availability is restored and a fresh
-connection passes complete attestation. Failed or closed sessions are evicted,
-so a stale connection is never reported ready.
-
-## 11. Atomic Redis deletion boundary
-
-The final PostgreSQL checkpoint removes current Notary Redis surfaces from:
-
-- root and crate Cargo manifests and `Cargo.lock`;
-- `registry-platform-cache` and `registry-platform-replay` Redis features and
-  implementations, while preserving focused in-memory test stores;
-- Notary configuration, validation, posture, doctor, explain-config, examples,
-  tests, OpenAPI, and generated fixtures;
-- the standalone Solmara Lab repository's Compose topology, secrets,
-  provisioning, validation, smoke, volumes, and Notary backup guidance;
-- release checks, current product docs, public docs, and current architecture
-  diagrams.
-
-Redis used internally by the separately deployed eSignet examples remains
-because it is eSignet-owned state, not Notary state. Historical release notes,
-archived specifications, and completed upgrade exercises remain accurate
-historical evidence and are not rewritten.
-
-## 12. Verification matrix
-
-Focused and PostgreSQL-backed tests must cover:
-
-- exact replay insert races, expiry, restart, and restored state;
-- nonce reserve/consume races, expiry rejection, retained tombstones, stale
-  generation resistance, restart, and takeover;
-- evaluation insert/read/expiry across two instances and restart;
-- idempotency same-hash wait/replay, different-hash conflict, owner failure,
-  lost acknowledgement, lease takeover, completed-response durability, and
-  restore;
-- valid credential transitions, terminal revocation, concurrent updates,
-  expiry, retention, restart, and restore;
-- machine-quota exact boundary, whole-batch rejection, concurrent debit,
-  restart, and clock behavior;
-- every subject access bucket, multi-bucket all-or-nothing debit,
-  check-only behavior, concurrent instances, restart, and expiry;
-- encrypted login-state and transaction-code reserve, peek, consume, delete,
-  expiry, wrong key, tampering, restart, and secret-absence assertions;
-- sequential physical-connection reuse, the configured per-replica cap,
-  bounded pool admission, failed-session eviction, and same-process recovery
-  after PostgreSQL stop and restart;
-- startup and readiness failures for availability, TLS, server major, schema,
-  fingerprint, role, and permission errors; and
-- a clean backup and restore preserving every domain invariant.
-
-The same conformance test runs against disposable PostgreSQL 16, 17, and 18 in
-local verification and a dedicated read-only GitHub Actions matrix. The final
-gate also runs Notary focused suites, locked workspace check/tests, Clippy with
-warnings denied, cargo-deny, both product OpenAPI checks, Solmara Lab
-PostgreSQL and topology smoke, docs tests/build, release-source checks, image
-builds, DCO, and an independent security and operability review of the final
-diff.
-
-## 13. Required delivery checkpoints
-
-1. This execution specification, committed before implementation.
-2. PostgreSQL schema, role contract, configuration, activation, readiness, and
-   conformance foundation.
-3. Replay, nonce, evaluation, idempotency, status, quota, and preauthorization
-   cutover with focused tests.
-4. Atomic Redis deletion plus standalone Solmara Lab, documentation, recovery,
-   and upgrade guidance.
-5. PostgreSQL 16, 17, and 18, multi-instance, restart, backup/restore, full
-   verification, and independent review.
-6. Rebase onto the latest `origin/main` only after PR #355 merges, followed by
-   complete focused and full verification.
diff --git a/products/notary/docs/postgresql-state-operations.md b/products/notary/docs/postgresql-state-operations.md
deleted file mode 100644
index 36aae59f0..000000000
--- a/products/notary/docs/postgresql-state-operations.md
+++ /dev/null
@@ -1,544 +0,0 @@
-# PostgreSQL state operations
-
-Registry Notary uses one PostgreSQL database for correctness state that must
-survive restart or be shared by identical instances. This includes replay and
-nonce decisions, retained evaluations, batch idempotency, credential status,
-quotas, and OID4VCI preauthorization state. Notary does not use Relay schemas,
-roles, tables, or migrations.
-
-Give each independently configured Notary authority its own database and role
-pair. Only replicas serving the same Notary configuration and trust domain may
-share that database. The fixed functions deliberately do not add a generic
-tenant layer, so pointing unrelated Notary services at one database would mix
-their idempotency, quota, and identifier namespaces.
-
-Use this guide for a first installation, the pre-1.0 Redis cutover, forward
-upgrades, backup, restore, and recovery. Keep the Notary audit sink,
-governed-config state, and signing-key backups in their separately owned
-procedures.
-
-## Prerequisites
-
-Before installation, provide:
-
-- PostgreSQL major 16, 17, or 18 on a writable primary;
-- a dedicated Notary database with encrypted storage and encrypted backups;
-- TLS between every Notary instance and PostgreSQL, including local
-  PostgreSQL testing;
-- a restricted migration login, a distinct `NOLOGIN` owner role conventionally
-  named `registry_notary_owner`, and a restricted login role conventionally
-  named `registry_notary_runtime`;
-- migration and runtime database URLs delivered through the deployment secret
-  manager, never command-line values;
-- a mounted root certificate when the database certificate is not rooted in
-  the host trust store; and
-- when preauthorization is enabled, one base64url-encoded 32-byte
-  sensitive-state key shared by all replicas.
-
-Use the same released `registry-notary` binary and migration set for install,
-doctor, and runtime admission. PostgreSQL tools used for logical backup must
-support the source server major. Keep Notary clocks synchronized for audit and
-token handling, although database expiry and quota decisions use PostgreSQL
-time.
-
-Configure the runtime connection by environment-variable name:
-
-```yaml
-state:
-  storage: postgresql
-  postgresql:
-    url_env: REGISTRY_NOTARY_POSTGRES_URL
-    root_certificate_path: /run/secrets/notary-postgres-ca.pem
-    connect_timeout_ms: 5000
-    operation_timeout_ms: 2000
-    max_connections: 16
-    sensitive_state_key_env: REGISTRY_NOTARY_SENSITIVE_STATE_KEY
-```
-
-`postgresql` is the only deployable storage value. `in_memory` is limited to
-`deployment.profile: local` with `deployment.multi_instance: false`.
-
-`max_connections` is the hard physical-connection cap for one Notary replica,
-not the whole deployment. Reserve at least `replica count × max_connections`,
-then add separate capacity for migrations, doctor, backup, monitoring, and
-platform administration. Start with the default 16 only when that budget is
-available. Smaller authority services can set a lower positive cap. A caller
-waiting for a pooled session fails within `operation_timeout_ms`; opening a new
-physical connection uses `connect_timeout_ms` and completes full runtime
-attestation before serving state. Values above 256 are rejected to prevent a
-configuration typo from preallocating an unsafe per-process resource bound.
-
-Healthy physical connections are reused. A query timeout, query or driver
-failure, failed readiness attestation, or changed database URL generation
-evicts the connection. The next checkout reloads the URL from the named
-environment variable and fully attests the replacement. The generation marker
-is a process-keyed HMAC; URL and credential material are not retained in pool
-metadata or emitted in diagnostics.
-
-## Role separation
-
-The `NOLOGIN` owner role owns `registry_notary_private`,
-`registry_notary_api`, their objects, and the fixed transaction functions. Do
-not grant it direct login. The separate migration login may assume the owner
-role but has no superuser, role-creation, database-creation, replication, or
-`BYPASSRLS` capability. Do not put its URL in a Notary runtime container.
-
-The runtime role receives only schema usage and execution on the exact
-`registry_notary_api` function signatures. It must not:
-
-- own either Notary schema or any private table or sequence;
-- have direct privileges on private tables or sequences;
-- create schemas, objects, roles, or databases;
-- be superuser or have `BYPASSRLS`;
-- inherit the owner role; or
-- receive Relay roles or privileges.
-
-Every runtime function is security-definer code owned by the owner, uses a
-pinned search path, schema-qualifies object references, and is not executable
-by `PUBLIC`. `state doctor` verifies both required and forbidden privileges.
-Do not fix a role failure by granting table access to the runtime role.
-
-Provision role passwords and connection policy with the database platform or
-infrastructure-as-code system. Preserve the provisioning definition with the
-backup evidence. A database dump alone is not a complete role backup.
-
-For a direct PostgreSQL installation, a database administrator can provision
-the roles and database with the following `psql` input. Supply the two generated
-passwords through the process environment, not as command-line arguments, and
-then remove them from the administrator session:
-
-```sh
-NOTARY_MIGRATOR_PASSWORD="$(openssl rand -hex 32)" \
-NOTARY_RUNTIME_PASSWORD="$(openssl rand -hex 32)" \
-psql --set=ON_ERROR_STOP=1 --dbname=postgres <<'SQL'
-\getenv migrator_password NOTARY_MIGRATOR_PASSWORD
-\getenv runtime_password NOTARY_RUNTIME_PASSWORD
-CREATE ROLE registry_notary_owner
-  NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT
-  NOREPLICATION NOBYPASSRLS;
-CREATE ROLE registry_notary_migrator
-  LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT
-  NOREPLICATION NOBYPASSRLS PASSWORD :'migrator_password';
-CREATE ROLE registry_notary_runtime
-  LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT
-  NOREPLICATION NOBYPASSRLS PASSWORD :'runtime_password';
-GRANT registry_notary_owner TO registry_notary_migrator;
-CREATE DATABASE registry_notary OWNER registry_notary_owner;
-REVOKE ALL ON DATABASE registry_notary FROM PUBLIC;
-GRANT CONNECT ON DATABASE registry_notary
-  TO registry_notary_migrator, registry_notary_runtime;
-\connect registry_notary
-REVOKE ALL ON SCHEMA public FROM PUBLIC;
-SQL
-```
-
-In managed PostgreSQL, express the same role attributes, membership, ownership,
-and revocations through the platform's supported provisioning mechanism. The
-installer rejects unsafe owner, migration, or runtime role attributes.
-
-## State commands
-
-Run schema installation and forward migrations with the owner connection:
-
-```sh
-registry-notary --config /etc/registry-notary/notary.yaml state install \
-  --migration-url-env REGISTRY_NOTARY_POSTGRES_MIGRATOR_URL \
-  --owner-role registry_notary_owner \
-  --runtime-role registry_notary_runtime
-```
-
-`state install` reads runtime connection settings from the Notary config. It
-uses the separately named migration URL, verifies that login may assume the
-named `NOLOGIN` owner, and explicitly assumes the owner for DDL and grants. It
-applies only the released, forward migration path and records the schema
-version, capability, deterministic fingerprint, and owner/runtime role
-identities. It does not start a listener or process application requests.
-
-Attest the installed contract through the runtime connection:
-
-```sh
-registry-notary --config /etc/registry-notary/notary.yaml state doctor
-```
-
-`state doctor` connects only with the URL named by
-`state.postgresql.url_env`. It verifies the supported server major, writable
-primary, schema metadata and fingerprint, role identity, required execution
-privileges, forbidden privileges, and a bounded runtime transaction call. A
-nonzero exit blocks startup or rollout.
-
-Both commands keep URLs, credentials, certificate paths, role identifiers,
-SQL, table names, and stored identifiers out of diagnostics. Check that an
-environment variable is present without printing its value.
-
-## First installation
-
-1. Provision the database, migration login, `NOLOGIN` owner, and runtime login.
-2. Inject `REGISTRY_NOTARY_POSTGRES_MIGRATOR_URL` only into the operator job.
-   Inject `REGISTRY_NOTARY_POSTGRES_URL` and, when required,
-   `REGISTRY_NOTARY_SENSITIVE_STATE_KEY` into each Notary replica.
-3. Mount the root certificate read-only when one is configured.
-4. Run `state install` with the released binary.
-5. Run `state doctor`. Stop if it reports any incompatible schema, role,
-   version, TLS, durability, or read-only condition.
-6. Start one Notary replica with no public traffic. Confirm its readiness
-   endpoint succeeds.
-7. Run the restart and state smoke checks below. When preauthorization is
-   enabled, complete a full offer-to-credential canary so the configured
-   sensitive-state key is proven against encrypted state.
-8. Start the remaining replicas from the same image and configuration. Confirm
-   every replica reports ready before admitting traffic.
-
-Do not let the runtime apply DDL automatically. A missing or partially applied
-schema must fail before any listener binds.
-
-## Clean Redis cutover
-
-This pre-1.0 transition is a stopped-writer cutover. There is no Redis importer
-or dual-write mode.
-
-Before scheduling the cutover, inspect credential-status use. Proceed only
-when credential status is disabled or the old store has no suspension or
-revocation record that must survive. If any such record exists, the cutover is
-blocked until a separately reviewed typed migration is available. Never
-discard the store or recreate those credentials as valid.
-
-At the maintenance window:
-
-1. Remove Notary from traffic and stop every Notary writer.
-2. Record the time at which the last writer stopped.
-3. Wait the longest applicable drain interval from that time. Use configured
-   token and request lifetimes when they are longer than the standard periods
-   below.
-4. Provision PostgreSQL, run `state install`, and run `state doctor`.
-5. Start one PostgreSQL-backed replica without traffic and complete the smoke
-   checks, including a process restart.
-6. Start the remaining identical replicas, repeat readiness and
-   multi-instance checks, then admit traffic.
-7. Only after those checks pass, remove the Notary Redis service, volume,
-   credentials, monitoring, and Redis backup job.
-
-Use these minimum drain periods:
-
-| State | Minimum drain from the last writer |
-| --- | --- |
-| Machine quota | 1 minute |
-| OID4VCI nonce and preauthorization state | 10 minutes |
-| Evaluation and batch idempotency | 15 minutes |
-| Subject access quota | 1 hour |
-| Replay identifiers | Longest configured token or request lifetime |
-| Credential status | No timed drain; required records must be absent or migrated |
-
-The cutover wait is the maximum of the applicable periods, not their sum. Keep
-the old Redis data inaccessible during validation and delete it only at the
-final removal step. Redis used by a separately deployed eSignet service is
-eSignet-owned and is not part of this removal.
-
-## Forward upgrades and replica admission
-
-Database upgrades are forward-only and use a stopped-writer boundary:
-
-1. Confirm the target release supports the PostgreSQL server major.
-2. Remove traffic and stop every Notary writer.
-3. Take and verify a database backup, role provisioning record, migration set,
-   application release, and sensitive-state key version.
-4. Run the target release's `state install` command as the owner.
-5. Run the target release's `state doctor` command as the runtime role.
-6. Start one target-release replica without traffic and confirm readiness and
-   the smoke checks.
-7. Start the remaining target-release replicas and admit traffic only after
-   all instances attest the same schema fingerprint.
-
-Do not run old and new binaries concurrently across an incompatible schema
-change. A runtime admits only its exact compiled schema version, capability,
-and fingerprint. A partially upgraded, older, or newer schema remains
-unavailable.
-
-Rolling admission applies only to replicas after the schema migration has
-completed and every old writer is stopped. If the target application must be
-rolled back, restore the matching database backup, role provisioning, and
-sensitive-state key together, then follow stale-restore quarantine. Never run
-an older binary against the forward schema.
-
-For a PostgreSQL server major upgrade, keep every Notary writer stopped and use
-the complete logical `pg_dump` and `pg_restore` procedure below for one
-adjacent supported-major hop. Registry Stack CI exercises 16 to 17 and 17 to
-18 with fresh target roles, changed role OIDs, full catalog reattestation, and
-post-restore behavior for every correctness-state domain. Run `state install`
-to rebind the target roles, run `state doctor`, then use the same one-replica
-admission sequence. Do not skip a major or use the old major's physical data
-directory with a new server binary.
-
-## Retention and maintenance
-
-Notary writes an absolute expiry when each record is created. Lowering a
-future retention setting does not shorten existing rows.
-
-| Domain | Retention |
-| --- | --- |
-| Replay identifier | Protocol token or request expiry |
-| Reserved nonce | Configured nonce expiry |
-| Consumed nonce | 60 seconds after consumption |
-| Stored evaluation | Its absolute expiry, normally 15 minutes or a stricter subject access expiry |
-| Completed or failed batch idempotency | 15 minutes |
-| In-flight batch idempotency | Bounded owner lease, then takeover eligibility |
-| Credential status | Credential expiry plus `credential_status.retention_seconds` |
-| Machine quota | One-minute fixed window |
-| Subject access quota | One-minute or one-hour fixed window by bucket |
-| Preauthorization login state | Configured lifetime, at most 600 seconds |
-| Preauthorization transaction code | Code lifetime, at most 600 seconds, or successful redemption |
-
-Each serving replica begins expiry maintenance every 60 seconds. One
-transaction deletes at most 1,000 expired rows from each typed state table and
-reports whether any table filled that bound. A full per-table batch causes the
-replica to release its pooled session, wait with a short bounded internal
-backoff, and run another bounded transaction until every table returns a short
-batch. The catch-up policy has no operator-facing tuning setting. Multiple
-replicas may run these transactions concurrently because candidates are locked
-with skip-locked semantics.
-
-Logical expiry checks on reads and writes remain authoritative between
-transactions, so a transient cleanup failure does not reopen expired state. A
-failed catch-up transaction is retried by the next scheduled maintenance cycle.
-Transient cleanup contention is not a reason to delete rows manually. Never
-remove an unexpired replay row, nonce tombstone, idempotency completion,
-credential-status record, quota window, or preauthorization row to recover
-capacity.
-
-Monitor database size, transaction latency, pool wait failures, the configured
-per-replica connection cap, database connection saturation, dead tuples,
-autovacuum, backup age, replication or archive lag, and doctor status.
-Do not include row values or identifiers in monitoring labels.
-
-## Logical backup with pg_dump
-
-Stop writers for a simple quiesced backup, or use the database platform's
-transactionally consistent snapshot workflow. Use a restricted PostgreSQL
-service definition and password file so credentials do not appear in process
-arguments. The password file must be owned by the backup operator and have
-mode `0600`:
-
-```ini
-# /run/registry-notary/pg_service.conf
-[registry_notary_migrator]
-host=postgres.example.internal
-port=5432
-dbname=registry_notary
-user=registry_notary_migrator
-sslmode=verify-full
-sslrootcert=/run/secrets/notary-postgres-ca.pem
-```
-
-`registry_notary_migrator` is an operator-defined libpq service name, not a
-built-in Registry Notary setting. Point `PGSERVICEFILE` at its file when it is
-not installed in a standard libpq location:
-
-```sh
-install -d -m 0700 /var/backups/registry-notary
-PGSERVICEFILE=/run/registry-notary/pg_service.conf \
-PGSERVICE=registry_notary_migrator \
-PGPASSFILE=/run/secrets/registry-notary-migrator.pgpass \
-pg_dump --format=custom --no-owner --no-acl \
-  --role=registry_notary_owner \
-  --file=/var/backups/registry-notary/notary-state.dump \
-  --dbname=registry_notary
-sha256sum /var/backups/registry-notary/notary-state.dump \
-  > /var/backups/registry-notary/notary-state.dump.sha256
-```
-
-Encrypt the dump and checksum in the approved backup system. Preserve with
-it:
-
-- the application release and exact migration set;
-- the source PostgreSQL major and backup tool version;
-- reproducible owner/runtime role provisioning;
-- the recovery timestamp and whether writers were quiesced; and
-- the sensitive-state key version through the secret manager, outside the
-  dump.
-
-The database backup must include the whole Notary database at one consistent
-point. Do not back up or restore individual correctness tables.
-
-Restore into an empty, isolated database with no Notary network path:
-
-```sh
-sha256sum -c /var/backups/registry-notary/notary-state.dump.sha256
-PGSERVICEFILE=/run/registry-notary/pg_service.conf \
-PGSERVICE=registry_notary_migrator \
-PGPASSFILE=/run/secrets/registry-notary-migrator.pgpass \
-pg_restore --exit-on-error --single-transaction --no-owner --no-acl \
-  --role=registry_notary_owner \
-  --dbname=registry_notary \
-  /var/backups/registry-notary/notary-state.dump
-registry-notary --config /etc/registry-notary/notary.yaml state install \
-  --migration-url-env REGISTRY_NOTARY_POSTGRES_MIGRATOR_URL \
-  --owner-role registry_notary_owner \
-  --runtime-role registry_notary_runtime
-registry-notary --config /etc/registry-notary/notary.yaml state doctor
-```
-
-Provision the migration, owner, and runtime roles before `pg_restore`. The
-migration login must be able to assume the owner. Restoring with the owner role
-makes every schema object owner explicit while omitting source-cluster ACLs.
-The post-restore `state install` rebinds only the metadata role identities,
-reapplies the complete compiled ACL baseline, and requires the complete
-released schema catalog to attest in the same transaction. It never replaces
-correctness rows, changes object ownership, or repairs schema drift. Do not
-admit traffic until doctor, an applicable preauthorization canary, and the
-quarantine decision all pass.
-
-## WAL archiving and point-in-time recovery
-
-Use physical base backups plus continuous WAL archiving when the recovery
-point objective requires point-in-time recovery. Protect the base backup, WAL
-archive, tablespace mapping, encryption material, and PostgreSQL configuration
-as one recovery set. Test WAL restore through the database platform, not on the
-production primary.
-
-For recovery:
-
-1. Keep every Notary replica stopped and network-blocked from the recovery
-   database.
-2. Restore the complete cluster or Notary database to the selected recovery
-   target and promote it to a writable primary.
-3. Provision or restore the owner/runtime roles. A full physical cluster
-   restore preserves their identities; a logical or cross-cluster restore
-   requires `state install` to reattest them.
-4. Restore the sensitive-state key version corresponding to the recovery
-   point.
-5. Run `state install`, then `state doctor`.
-6. Classify the recovery point as known quiesced or potentially stale.
-7. Complete the required quarantine and smoke checks before traffic admission.
-
-Choosing a WAL target before an acknowledged one-time consume, status update,
-or quota debit can reopen a correctness decision. Successful PostgreSQL
-recovery is not by itself permission to serve.
-
-## Stale-restore quarantine
-
-A backup is potentially stale when writers were not quiesced or when its
-recovery point may predate acknowledged traffic. Keep Notary offline in that
-case.
-
-Before release from quarantine:
-
-1. Determine the latest time at which the old deployment could have
-   acknowledged a write.
-2. Wait until every token, request, nonce, evaluation, idempotency key, and
-   preauthorization value that could be missing from the restore has expired.
-3. Wait through the maximum one-hour subject access quota window. Treat
-   uncertain quota state conservatively.
-4. Reconcile credential status against retained issuance and status evidence.
-   If a suspension or revocation could be missing, keep status and issuance
-   unavailable. Time does not repair a lost revocation.
-5. Run `state doctor` again and complete restart and multi-instance smoke
-   checks.
-
-Use the later of the recovery point and the last possible acknowledged-writer
-time as the start of the maximum applicable drain interval. If that time
-cannot be established, begin the full configured drain at quarantine entry and
-rotate or revoke affected credentials as required by incident policy. Never
-mark unknown status records valid to finish recovery.
-
-A known quiesced and transactionally consistent backup may skip the timed
-quarantine only after schema, role, key, credential-status, and semantic checks
-all pass.
-
-## Sensitive-state key backup and rotation
-
-The sensitive-state key is not stored in PostgreSQL and is not included in
-`pg_dump`, a physical base backup, or WAL. Store it as a versioned secret with
-access restricted to Notary workloads and recovery operators. Record the
-secret version with each database backup without recording key material.
-Every replica must use the same key version while any preauthorization row is
-live. Activation, `state doctor`, and every readiness probe compare the
-configured key id with every live row in both preauthorization tables. A wrong
-backup-matched secret or live mixed-key state therefore remains unavailable.
-Both sensitive reservation transactions also serialize key-generation
-admission and reject a different key while either table has a live row.
-Unexpired replay markers use the verified Notary issuer and stable Notary
-replay hashes rather than this sensitive key or mutable service configuration,
-so an already redeemed pre-authorized code remains spent across the rotation.
-
-Rotate it with a stopped-issuance drain:
-
-1. Stop admission of new OID4VCI preauthorization flows on every replica.
-2. Keep the old key available and wait 600 seconds from the last admitted
-   preauthorization flow.
-3. Confirm expired preauthorization rows have been pruned by normal bounded
-   maintenance.
-4. Stop all replicas. Replace the secret with one new base64url-encoded
-   32-byte key and update every replica atomically.
-5. Start one replica, run `state doctor`, and exercise one complete
-   preauthorization flow.
-6. Start the remaining replicas and resume preauthorization only after all use
-   the same key version.
-
-Do not overlap replicas using different sensitive-state keys. Do not retain
-old keys in application configuration after the drain.
-
-If the recovery key is unavailable, keep Notary unavailable until every
-restored preauthorization row has passed its absolute expiry, with 600 seconds
-as the maximum configured lifetime. Prune the expired rows, provision a new
-key, then use the one-replica admission sequence. Never bypass decryption,
-weaken PIN verification, or expose ciphertext to make startup succeed.
-
-## Restart and multi-instance smoke checks
-
-Run these checks without production traffic and retain only redacted outcomes:
-
-1. Confirm `state doctor` and readiness succeed on replica A.
-2. Create a short-lived replay or nonce decision through replica A, restart A,
-   and verify the duplicate is still rejected.
-3. Create an evaluation through A and retrieve or render it through replica B.
-   Restart both and confirm it remains available only until its expiry.
-4. Race the same replay identifier or nonce consume through A and B. Exactly
-   one request may win.
-5. Race the same idempotent batch through A and B. Both callers must observe
-   one completed response, and quota must be charged once.
-6. When credential status is enabled, update a credential to revoked through A
-   and verify B cannot reverse it before or after restart. Also verify a valid
-   or suspended credential becomes effectively expired at its stored expiry on
-   both replicas; application clock skew must not change that result.
-7. When preauthorization is enabled, redeem one code concurrently through A
-   and B. Exactly one token request may win.
-8. Stop PostgreSQL and confirm every replica becomes not ready. Restore the
-   database and confirm readiness recovers only after a fresh full attestation.
-
-Do not retain tokens, nonces, PINs, identifiers, claim values, database URLs,
-or credentials in smoke-test logs.
-
-## Failure diagnostics
-
-Startup and `state doctor` publish the same closed, value-free diagnostic
-contract. Each code carries a static safe meaning and next action. Runtime
-paths, URLs, credentials, identifiers, SQL, and role names remain private.
-
-| Public code or symptom | Operator action |
-| --- | --- |
-| `notary.state.postgresql.database_unavailable` | Check primary availability, network policy, TLS trust, connection limits, and the configured connect timeout. Do not print the URL or certificate path. |
-| `notary.state.postgresql.database_read_only` | Promote the intended recovery target to a writable primary or correct routing. Never serve correctness state from a read-only replica. |
-| `notary.state.postgresql.database_unsupported` | Move the database to PostgreSQL 16, 17, or 18, then run install and doctor before admission. |
-| `notary.state.postgresql.durability_unsafe` | Restore the documented durability settings, then rerun doctor before admission. |
-| `notary.state.postgresql.schema_incompatible` | Stop all replicas. Use the matching released binary to run `state install`, or restore the matching application and database backup together. |
-| `notary.state.postgresql.role_incompatible` | Compare provisioning with the role-separation contract and rerun install and doctor. Do not grant runtime table access. |
-| Missing URL environment variable | Correct secret injection for the variable name in config. Do not substitute a URL on the command line. |
-| Missing or wrong sensitive-state key | Stop preauthorization, restore the backup-matched secret version, or follow the 600-second key-loss drain. |
-| Fingerprint or role-identity mismatch after restore | Keep the database isolated, run the matching `state install`, then rerun doctor and stale-restore checks. |
-| Cleanup contention | Check transaction latency, locks, autovacuum, and connection pressure. Do not manually delete unexpired rows. |
-| Readiness remains unavailable after recovery | Confirm the database accepts a new TLS connection and has the expected role and schema. The pool evicts failed sessions automatically; if the platform still presents the old endpoint or secret generation, correct that injection and restart the canary before requiring doctor and readiness. |
-
-Diagnostics are intentionally value-free. Use redacted database-platform logs
-and the stable public code to investigate. Do not add SQL, row values,
-identifiers, secrets, paths, URLs, or role names to application diagnostics.
-
-## Supported PostgreSQL versions
-
-Registry Notary supports PostgreSQL server majors 16, 17, and 18. Each release
-tests the full state conformance suite on all three majors. An unlisted major
-is unsupported even when the wire protocol appears compatible, and startup
-must refuse it until that major has dedicated conformance evidence.
-
-After any PostgreSQL minor update, run `state doctor`, readiness, restart, and
-the representative replay, nonce, idempotency, status, quota, and
-preauthorization checks. After a major upgrade, follow the stopped-writer
-forward-upgrade procedure in full.
diff --git a/products/notary/docs/release-notes.md b/products/notary/docs/release-notes.md
deleted file mode 100644
index dd4184896..000000000
--- a/products/notary/docs/release-notes.md
+++ /dev/null
@@ -1,439 +0,0 @@
-# Release Notes
-
-## Unreleased
-
-## 0.16.3
-
-- Registry Notary has no user-visible changes relative to v0.16.2. That
-  workflow stopped at an unpublished draft before public image promotion, so
-  install only v0.16.3.
-
-## 0.16.2
-
-- Registry Notary has no user-visible changes relative to the v0.16.0 and
-  v0.16.1 candidates. The immutable v0.16.1 tag workflow stopped after
-  creating an unpublished empty draft, so install only v0.16.2. No final
-  v0.16.1 images, assets, or documentation were published.
-
-## 0.16.1
-
-- Registry Notary has no user-visible changes relative to the v0.16.0
-  candidate. The immutable v0.16.0 tag workflow failed before any job or public
-  write, so install only v0.16.1. No final v0.16.0 images, assets, or
-  documentation were published.
-
-## 0.16.0
-
-- BREAKING: The `self_attested` evidence mode is removed. Every configured
-  claim must derive from exactly one compiler-pinned Relay consultation.
-  OIDC subject binding and delegated subject access remain authorization
-  controls and never supply claim evidence. Configuration using the removed
-  evidence mode is rejected. Rename `delegated_attestation` to
-  `delegated_subject_access` and `evidence:self_attest` to
-  `evidence:subject_access`. Every batch evaluation now requires an
-  `Idempotency-Key` header.
-- Registry-backed direct Relay claims can preserve bounded closed objects and
-  arrays through stored evaluation and SD-JWT issuance. Type Metadata publishes
-  the namespaced recursive value contract. Each top-level structured claim is
-  disclosed or withheld as one unit.
-- An authenticated registry client can create a pre-authorized OID4VCI offer
-  from a fresh caller-owned evaluation at `POST /oid4vci/offers`. The endpoint
-  accepts no credential facts or target input, requires an idempotency key,
-  returns the exact stored response for an exact retry, and keeps the
-  required transaction-code value outside the offer URI.
-- This release advances the PostgreSQL state-plane catalog. Stop all Notary
-  writers, take a verified backup, then run the target release's `state
-  install` and `state doctor` commands before admitting traffic. The installer
-  upgrades only the immediately preceding attested v1 catalog; older or
-  drifted schemas require a sequential upgrade, a matching backup and binary,
-  or a fresh installation.
-- Registry Notary can issue one OID4VCI credential for a represented subject
-  after authenticating the representative and proving the configured
-  relationship through Registry Relay. The offer, token, and credential reuse
-  one committed proof-bounded transaction, and representative credentials
-  require live status. Wallet-visible tokens carry HMAC handles instead of the
-  representative's raw identifiers.
-- Delegated registry-backed consultations must consume the compiler-pinned
-  target. Requester-only policy dependencies are rejected.
-- Delegated Relay results are checked for expiry again after the Relay call
-  returns, before evaluation continues.
-
-## 0.15.2
-
-- Registry Notary has no user-visible changes. This release fixes forward from
-  the incomplete v0.15.1 publication.
-
-## 0.15.1
-
-- Registry Notary has no user-visible changes. This release fixes forward from
-  the failed v0.15.0 publication workflow.
-
-## 0.15.0
-
-- Registry Notary now requires every configured CEL worker to complete one
-  bounded protocol probe and remain live before listener binding or readiness.
-  Worker startup uses one 10-second wall-clock bound for the complete
-  concurrent batch, evaluations retain their independent 2-second default,
-  and failed evaluations return without waiting for background replacement
-  startup. Healthy members of a mixed replacement batch are retained while
-  initial activation remains all-or-nothing. Startup failures use the
-  value-free `notary.cel.worker_unavailable` category.
-
-## 0.13.0
-
-- BREAKING: The closed Relay-result decoder rejects the retired
-  `provenance.consent` member and accepts only the reduced
-  `registry.relay.consultation-result.v1` contract. Registry-backed issuance
-  still requires compiler-pinned Relay evidence. Consent verification, policy
-  enforcement, legal-basis handling, and authorization are unchanged.
-- BREAKING: Deployment waivers replace `reason` with a required validated
-  `reference` and optional validated `summary`. Strict configuration parsing
-  rejects the retired field. Startup and readiness gates that were
-  non-waivable remain non-waivable.
-
-## 0.12.2
-
-- Registry Notary has no new product features relative to v0.12.1. This
-  release fixes forward from the incomplete v0.12.1 publication with a
-  canonical reproducible release-build path for the Notary binary, CEL worker,
-  and runtime image.
-- The single-use eSignet authorization-code exchange now uses short-lived
-  DNS-pinned transport. Redirects and proxies remain denied, request timeouts
-  remain bounded, and the non-idempotent token exchange is not transparently
-  retried. Public routes and authentication contracts are unchanged.
-
-## 0.12.1
-
-- Registry Notary has no new product features relative to v0.12.0. The release
-  reviews the three non-fixable Debian 13 `libc6` findings and binds that
-  time-bounded accepted risk to the ordered runtime root filesystem layer
-  digest. Fixable, expired, mismatched, and unreviewed findings fail the image
-  advisory gate.
-
-## 0.12.0
-
-- BREAKING: The 1.0 wallet facade supports only issuer-initiated
-  pre-authorized code backed by a stored registry transaction. The former
-  credential-offer and public nonce routes are removed, and the credential
-  response has no next nonce. Start with `/oid4vci/offer/start`, complete the
-  identity-provider callback, redeem the rendered offer at `/oid4vci/token`,
-  and use its transaction-bound proof nonce. The identity provider's
-  authorization code is never a wallet grant.
-- OID4VCI source tests now cover complete issuance and client verification for
-  EdDSA and ES256 issuer keys with an EdDSA `did:jwk` holder. Metadata
-  advertises the exact configured issuer algorithm and only the supported
-  holder profile.
-- `tx_code` remains enabled by default. A no-PIN wallet profile must opt out
-  explicitly and use a pre-authorized-code TTL no longer than 300 seconds. The
-  offer is bearer credential material until its single use, so operators must
-  prevent disclosure and retain redemption rate limits.
-- Source-free claims remain evaluation-only. OID4VCI issuance reloads the
-  registry transaction and exact Relay-backed evaluation provenance before
-  signer access.
-- Status-bearing credentials are verified fail closed from the configured
-  exact HTTPS status origin. The reserved top-level status claim cannot be
-  selectively disclosable.
-- External wallet, verifier, OIDF, EUDI, or HAIP evidence remains
-  candidate-only until recorded against a frozen release artifact.
-- Batch evaluation now has a fixed 100-member platform ceiling with lower
-  operator limits and pre-side-effect `batch.too_large` rejection.
-- Registry Notary publishes a generated Draft 2020-12 runtime configuration
-  schema derived from the production deserialization graph.
-- Maintained Notary runtime images now use Debian 13 distroless. Release checks
-  enforce the expected base and vulnerability policy before publication.
-
-## 0.11.0
-
-- BREAKING: Direct and OID4VCI credential issuance now require a fresh,
-  non-delegated stored evaluation with an exact compiler pin for every claim in
-  each selected root's registry-backed dependency closure and one normalized
-  record per unique Relay execution. Source-free and delegated claims are
-  evaluation-only and cannot be configured for credential issuance. Existing
-  evaluations remain readable and renderable but must be re-evaluated before
-  issuance. See the
-  [credential issuance trust-boundary migration](credential-issuance-migration.md).
-- BREAKING: Configuration `${VAR}` expansion now rejects environment variables
-  that are unset or empty. `${VAR:-fallback}` uses its fallback for either
-  state, `${VAR:-}` explicitly expands to empty, and `${VAR:?message}` reports
-  its message for either state. Whitespace-only values remain non-empty.
-- Registry Notary now verifies the retained audit chain during activation and
-  reports confirmed integrity failures as `audit.chain.inconsistent` on
-  `/ready` without exposing audit contents. Stop the process and use
-  `registry-notary audit quarantine` with the deployed configuration to retain
-  the corrupt files and open a tamper-evident break segment. The single-writer
-  lock prevents online recovery, and signed-bundle acceptance audit failures
-  still prevent bundle persistence and serving.
-- Presenting multiple primary credential channels now returns the generic
-  `auth.multiple_credentials` failure before any candidate is parsed or
-  validated. The result does not reveal whether either candidate was valid.
-- Omitted claim `formats` now defaults to canonical claim-result JSON. Explicit
-  empty, unknown, CCCEV-only, and SD-JWT evaluation-format lists fail
-  configuration validation; SD-JWT remains a credential issuance format.
-- Registry-backed Relay consultations may bind bounded string, boolean, and
-  integer inputs from `request.target.attributes.<stable-name>`. These values
-  remain caller-supplied request context and cannot satisfy authenticated
-  target-identifier requirements for delegated subject access.
-- The local registryctl Notary tutorial evaluates one registry-backed claim
-  through an exact Relay compiler pin. It does not exercise issuance, a
-  wallet, credential presentation, or OID4VCI interoperability.
-
-## 0.10.0
-
-- BREAKING: Notary now has one deployable correctness-state backend: typed,
-  Notary-owned PostgreSQL configured under `state`. Redis and per-domain
-  backend selectors are removed without compatibility aliases. Use explicit
-  `in_memory` only for single-process local development.
-- Operators install and verify the schema with `registry-notary state install`
-  and `registry-notary state doctor`. Startup and readiness verify PostgreSQL
-  version, writability, schema fingerprint, role boundaries, and fixed
-  transaction functions before traffic is admitted.
-- Replay, nonce, evaluation, idempotency, credential status, quota, and
-  preauthorization decisions now survive restart and coordinate identical
-  active-active instances. The operations guide covers PostgreSQL 16 through
-  18, backup and restore, stale-restore quarantine, upgrades, and the clean
-  pre-1.0 cutover.
-- Redeemed pre-authorized codes use stable replay identity bound to the
-  verified Notary issuer, so sensitive-state key rotation and unrelated
-  service configuration changes cannot reopen a live no-PIN code.
-- BREAKING: Registry-backed evidence now uses only authenticated,
-  compiler-pinned Registry Relay consultations. Notary no longer accepts
-  direct registry connections, DCI/FHIR connectors, source adapter sidecars,
-  source credentials, or transitional evidence modes.
-- Notary independently validates the full Relay consultation semantics and
-  `contract_hash` before serving and at readiness. Mismatched purpose, inputs,
-  outcomes, outputs, provenance, runtime requirements, or hash fail before
-  source access.
-- Relay consultation outcomes and typed outputs remain distinct from Notary
-  claims. One consultation may supply several direct and CEL claims;
-  `no_match` is explicit, while ambiguity and failures abort the consultation
-  group and never become claim values.
-- Relay-only, self-attested Notary-only, and combined project deployments are
-  modeled separately. A combined project has one logical Relay connection and
-  Notary receives no registry destination or source credential.
-- BREAKING: authentication has no mode selector, and `auth.mode` is rejected.
-  API keys and OIDC may coexist for distinct service and citizen or wallet
-  callers, but each request presents exactly one credential type. Static
-  bearer tokens and OIDC remain mutually exclusive because both use
-  `Authorization: Bearer`.
-- Combined projects keep the Relay's public catalog origin separate from the
-  internal Notary connection URL. An explicitly enabled literal IP-loopback
-  HTTP origin is allowed only for the paired Relay inside a shared network
-  namespace; remote HTTP remains invalid and public origins still require
-  HTTPS.
-- Registry-backed claim rules now use `consultation_output` and
-  `consultation_matched` with explicit `consultation` and `output` fields.
-  The unreleased source-named rule forms are rejected without aliases.
-- Claim provenance moves atomically to
-  `registry-notary-claim-provenance/v2`, exposing only
-  `relay_consultation_count`; audit records use the same terminology.
-- Federation configuration and signed results use evaluation and claim-result
-  terminology: configure `evaluation_scopes` and
-  `max_claim_result_age_seconds`, and consume `claim_result_issued_at` plus
-  `federation.stale_claim_result`. Federation profiles remain source-free in
-  this version, and Relay-backed federation remains deferred pending
-  cross-service audit correlation.
-- Release distributions include the standalone Linux amd64
-  `registry-notary-cel-worker`. CEL-enabled binary installations must place it
-  beside `registry-notary` under that exact name. The Notary image includes the
-  same isolated worker and `cel.worker_memory_bytes` remains the bounded
-  operator control.
-- The retired sidecar container, listener inventory, direct-source demo
-  configurations, OpenFn caller demo, and direct DCI performance harness are
-  removed.
-
-## 0.9.0
-
-- Production and evidence-grade deployments now fail closed until signer custody
-  is explicitly approved for credential, access-token, and federation signing
-  roles. `/ready` exposes typed, non-secret custody facts, while detailed
-  deployment findings remain on authenticated operator surfaces. Review each
-  role's custody and retain the evidence before setting
-  `deployment.evidence.signer_custody_approved: true`; the attestation is not a
-  gate bypass.
-- BREAKING: `deployment.profile` is required and must be one of `local`,
-  `hosted_lab`, `production`, or `evidence_grade`. Notary refuses startup when
-  it is absent instead of inferring a profile.
-- BREAKING: claim configuration is validated at load time. Duplicate claim ids,
-  invalid default disclosure modes, and rules referring to undeclared source
-  bindings must be corrected before Notary starts.
-- BREAKING: the TUF-era `/admin/v1/config/verify`,
-  `/admin/v1/config/dry-run`, and `/admin/v1/config/apply` endpoints are
-  removed, as is the CLI `config apply-bundle` command. First run
-  `registryctl bundle verify` for stateless signature and binding verification,
-  then place the signed Registry Config Bundle v1 on the Notary node. For a
-  genuinely absent, version-specific antirollback state path, start Notary with
-  `--initialize-state`; that boot verifies the bundle and initializes state.
-  Notary's read-only `config verify-bundle` command remains, but it requires
-  accepted state to exist, so use it only for later candidate validation and
-  restarts. Replace retired TUF-era fields inside `config_trust` with current
-  Config Bundle v1 trust fields because strict parsing rejects the old schema.
-  Hot apply is not supported. Back up the durable
-  `config_trust.antirollback_state_path` state and keep release-specific
-  restore sets. Restore the state belonging to the release during rollback;
-  never delete or reinitialize it to force an older bundle to load.
-- BREAKING: source-adapter sidecar configuration now rejects unknown keys.
-  Remove misspelled, retired, or wrapper-only fields before upgrading.
-- Evidence-grade deployments using audit shipping must configure a fresh
-  acknowledgement cursor. Local-only file retention is a hard gate and cannot
-  be waived.
-- Federation denials after request verification now preserve available redacted
-  peer, source-scope, profile, purpose, JTI, claim, and subject context in audit
-  records, including response-signing failures.
-- Added per-principal machine evaluation quotas and live audit-shipping health
-  in readiness, posture, and doctor output.
-
-## 0.8.4
-
-- BREAKING: Static API-key and bearer-token config no longer accepts
-  `fingerprint.commitment`.
-  Remove that field from Notary YAML.
-  Keep `fingerprint.provider` with `fingerprint.name` or `fingerprint.path`; the
-  referenced value must contain `sha256:<64 lowercase hex chars>`.
-- Static credential rotation is now either a secret-plane update plus restart,
-  or a signed config bundle change to a new immutable or versioned fingerprint
-  reference, placed on the node and activated by restart.
-  OIDC remains the preferred production model for citizen and wallet flows.
-
-## 0.6.2
-
-- Fixed federated evaluation policy-context handling so federation profiles can
-  satisfy source matching gates for legal basis, consent, jurisdiction, and
-  assurance without being treated as scoped transaction authorization details.
-- Restores delegated federation evaluations that use governed source-policy
-  gates.
-
-## 0.6.1
-
-- Fixed static credential policy-context compatibility for source matching:
-  static credentials can again carry configured legal basis, consent,
-  jurisdiction, and assurance context for PDP gates without being treated as
-  exact per-transaction authorization scopes.
-- Kept OIDC/RAR authorization details fail-closed unless transaction scope
-  fields are present.
-
-## 0.6.0
-
-- Added delegated subject access support with explicit requester-side target
-  binding, canonicalized delegated targets, and claim-lookup validation.
-- Bound delegated authorization details to the requested identifier type so a
-  delegated attestation cannot drift across supported identity forms.
-- Hardened authorization-details handling before batch prefetch, credential
-  issuance, render, evaluate, pre-authorization, status-list, and data-route
-  audit paths.
-- Added cache compare-and-set support for credential status transitions and
-  status-list signing so concurrent updates fail closed.
-- Refreshed the Registry Platform pin to the beta-4 platform release.
-
-## 0.3.0
-
-- Added citizen subject access flows, including bearer-token subject binding,
-  rate limiting, denial audit metadata, and SD-JWT VC issuance.
-- Added OpenID4VCI issuer primitives and HTTP routes for credential issuer
-  metadata, SD-JWT VC Type Metadata at configured `vct` URLs, credential offers,
-  nonce creation, and credential issuance.
-- Added the source adapter sidecar path for private source reads, including
-  built-in `http_json`, `http_flow`, and `fhir` engines, source concurrency
-  controls, target rate limits, `Retry-After`
-  backoff handling, bounded result caching, and DHIS2 canary smoke scripts.
-- Kept CEL out of default builds while adding an opt-in CEL production image
-  profile with hardened worker execution, startup expression preflight,
-  declared result-type enforcement, and policy-hash worker protocol checks.
-- Added named SD-JWT VC signing keys under `evidence.signing_keys`, including
-  local JWK signing, publish-only rotation keys with optional bounded
-  publication windows, disabled keys, and optional PKCS#11-backed Ed25519
-  signing.
-- Historical note: 0.3.0 introduced the first governed config prototype with
-  signed TUF bundles, `config verify-bundle`, `config apply-bundle`, and
-  `config_trust`.
-  Current releases use Registry Config Bundle v1 instead: a local directory with
-  `manifest.json`, `manifest.sig.json`, and `config/...`. Before a first boot,
-  `registryctl bundle verify` checks signatures and bindings without product
-  antirollback state. The first boot with genuinely absent state uses
-  `--initialize-state`; after state exists, the read-only product
-  `config verify-bundle` command supports later candidate validation and
-  restarts.
-  There is no current `apply-bundle` command and no hot apply.
-- Added `server.admin_listener` to split admin and public HTTP topology. The
-  `dedicated` mode serves `/admin/v1/*` and `/metrics` on a separate admin bind,
-  `shared_with_public` serves them on the public listener, and `disabled` drops
-  the admin listener entirely. Governed `config_trust` requires `dedicated`.
-- Changed the default `server.admin_listener.mode` from `shared_with_public` to
-  `disabled`; local deployments that intentionally need the old shared topology
-  must set `server.admin_listener.mode: shared_with_public` explicitly.
-- Added bounded HTTP serve defaults: `server.request_timeout: 30s`,
-  `server.request_body_timeout: 10s`, `server.http1_header_read_timeout: 10s`,
-  and `server.max_connections: 1024`. The source adapter sidecar mirrors the same
-  limits with millisecond-suffixed config keys.
-- Changed `auth.api_keys[]` and `auth.bearer_tokens[]` to a committed
-  `fingerprint` reference (`provider`, `name`, `commitment`) in place of
-  `hash_env`, so a signed config bundle can govern caller-credential rotation
-  after restart.
-- Renamed OIDC config fields to the shared Registry service convention:
-  `auth.oidc.jwks_url`, `auth.oidc.leeway`, and
-  `auth.oidc.allowed_token_types`. Legacy aliases fail config load with an error
-  naming the replacement. `auth.oidc.leeway` now uses humantime strings such as
-  `30s`; subject access
-  `token_policy.max_clock_leeway_seconds` still bounds the resolved duration.
-- Removed `server.cors.allow_credentials`; Registry Notary now always disables
-  credentialed CORS on the operator-configured server CORS layer. Remove the
-  field from config rather than setting it to `false`.
-- Renamed `audit.max_size_bytes` to `audit.max_size_mb` and aligned the default
-  active-file rotation to 100 MB with 14 retained files.
-- Added `REGISTRY_NOTARY_LOG_FORMAT=text|json`; the default log filter is plain
-  `info`.
-- Product binaries and container images now compile the PKCS#11 provider by
-  default, while vendor modules, token state, labels, and PIN handling remain
-  operator-supplied runtime configuration.
-- Hardened SD-JWT VC conformance for `dc+sd-jwt`, holder binding, proof
-  validation, and OpenAPI documentation.
-- Replaced fake Problem Details type URLs with
-  `https://id.registrystack.org/problems/registry-notary/...`.
-- Changed subject access subject-binding hashes to keyed HMAC values and
-  stopped recording raw query strings in request spans or audit paths.
-- Known limitations: this release is `dc+sd-jwt` only, does not serve
-  `/.well-known/jwt-vc-issuer`, does not implement PKCS#12 issuer keys, does
-  not certify a vendor HSM, and leaves retention/erasure workflows to the
-  operator.
-
-## 0.2.1
-
-- Added `evidence.source_connections[].allow_insecure_private_network` for
-  Docker Compose and private-network demos that need HTTP source registries.
-  The escape hatch is opt-in, keeps cloud metadata endpoints blocked, and
-  leaves the strict HTTPS policy as the default.
-
-## 0.2.0 (rename)
-
-- Renamed: `evidence-server` → `registry-notary`. No backward compatibility; no aliases.
-  - Crates: `evidence-core` → `registry-notary-core`, `evidence-server` → `registry-notary-server`,
-    `evidence-server-bin` → `registry-notary-bin`.
-  - Binary: `evidence-server` → `registry-notary`.
-  - Media type: `application/vnd.evidence-server.claim-result+json` → `application/vnd.registry-notary.claim-result+json`.
-  - Default audience: `"evidence-server"` → `"registry-notary"`.
-  - Cargo feature: `evidence-server-cel` → `registry-notary-cel`.
-  - Project-labeled env vars: `EVIDENCE_SERVER_API_KEY`, `EVIDENCE_SERVER_BEARER_TOKEN`,
-    `EVIDENCE_SERVER_ISSUER_JWK` → `REGISTRY_NOTARY_API_KEY_HASH`,
-    `REGISTRY_NOTARY_BEARER_TOKEN_HASH`, `REGISTRY_NOTARY_ISSUER_JWK`. The
-    renamed auth variables hold `sha256:<64 hex>` fingerprints, not plaintext
-    tokens.
-  - Demo config: `demo/config/evidence-server.yaml` → `demo/config/registry-notary.yaml`.
-
-## 0.1.0
-
-- Initial Evidence Server repository cut from `registry_relay`.
-- Preserves `evidence-core` and `evidence-server` crate behavior as an
-  independent Cargo workspace.
-- Adds `evidence-server-bin` for standalone config loading, binding, tracing,
-  shutdown, fail-closed API key and bearer-token auth, and redacted audit event
-  output.
-- Adds HTTP Registry Data API and DCI source connectors so claim evaluation can
-  use external source registries without linking Registry Relay.
-- Keeps CEL enabled by default through `cel-mapper-core`, pinned to
-  `PublicSchema/cel-mapping` tag `cel-mapper-core-v0.1.0`.
-- Adds a `cargo run -p evidence-server-bin -- openapi` command for owned
-  Evidence Server OpenAPI output.
-
-Known non-goals for this cut:
-
-- 0.1.0 does not include OIDC/JWKS discovery; the standalone binary supports API keys and
-  static bearer tokens.
diff --git a/products/notary/docs/representative-credential-issuance.md b/products/notary/docs/representative-credential-issuance.md
deleted file mode 100644
index c7d27d76f..000000000
--- a/products/notary/docs/representative-credential-issuance.md
+++ /dev/null
@@ -1,277 +0,0 @@
-# Representative credential issuance
-
-Registryctl can configure one digitally authenticated person to obtain a
-credential for another subject when Registry Relay can prove their exact
-relationship. The relationship can come from any registry or service that a
-reviewed Relay integration can consult. The example on this page uses a parent
-and child, but the authoring contract does not assign meaning to relationship
-names or identifier schemes.
-
-## Use the Registryctl authoring surface
-
-Author the relationship evidence as a registry-backed claim. Its consultation
-must bind both sides of the relationship:
-
-```yaml
-services:
-  civil-credential:
-    kind: evidence
-    version: 1
-    purpose: civil-credential-issuance
-    legal_basis: public-service-delivery
-    consent: not_required
-    access:
-      scopes: [evidence:civil-credential:issue]
-    consultations:
-      parent-link:
-        integration: civil-relationships
-        input:
-          parent_id: request.requester.identifiers.national_id
-          child_id: request.target.identifiers.civil_registration_id
-    claims:
-      parent-link:
-        cel: parent_link.matched
-        disclosure: predicate
-      birth-record:
-        output: parent_link.record
-        disclosure: value
-    credential_profiles:
-      birth-record:
-        format: dc+sd-jwt
-        type: https://notary.example.com/credentials/birth-record/v1
-        validity: 5m
-        claims: [birth-record]
-```
-
-The integration named `civil-relationships` owns the source protocol. It may
-consult a civil registry, social registry, case-management system, or another
-reviewed source. Registry Notary does not connect to that source directly.
-For this browser ceremony, the proof consultation must have exactly the two
-shown inputs. Registryctl rejects extra identifiers, attributes, or variables
-because the target-selection form cannot supply them.
-
-The same input availability rule covers the credential root and every
-registry-backed claim in its transitive dependency closure. Each consultation
-may read the authenticated requester identifier, the selected target
-identifier, or both. Production validation names the claim, consultation,
-input, and expected paths when a hand-authored configuration asks for data
-that this ceremony cannot supply.
-
-The proof claim and credential claim are separate. Do not add a claim
-dependency by hand. Registryctl derives the exact `birth-record ->
-parent-link` dependency when representative issuance selects this profile.
-
-Add the compact representative block to the existing OID4VCI environment
-binding:
-
-```yaml
-oid4vci:
-  public_base_url: https://notary.example.com
-  credential:
-    service: civil-credential
-    profile: birth-record
-  subject:
-    token_claim: individual_id
-    id_type: national_id
-  representative_issuance:
-    relationship: parent
-    proof_claim: parent-link
-    target_id_type: civil_registration_id
-```
-
-`max_proof_age_seconds` is optional and defaults to 300. Its accepted range is
-1 through 600. Registryctl raises the generated instance-wide evaluation age
-ceiling when necessary, but does not lower unrelated evaluation policy when
-this relationship uses a shorter window:
-
-```yaml
-  representative_issuance:
-    relationship: parent
-    proof_claim: parent-link
-    target_id_type: civil_registration_id
-    max_proof_age_seconds: 180
-```
-
-Registryctl v1 supports one OID4VCI binding per environment, selecting one
-credential profile and at most one representative relationship. A second
-credential, a different relationship policy, or a self-service variant
-requires a separate environment and therefore a separate generated Notary
-deployment and issuer endpoint.
-
-That single-credential binding also keeps representative issuance separate
-from `registrar_clients`. The representative flow authenticates a person and
-proves a relationship, while registrar-created offers use a machine authority
-and an existing machine-owned evaluation. Registryctl rejects both fields in
-one environment and points to each field. Use a separate environment and
-Notary deployment when both products are required.
-
-The credential claim root must be exclusive to the selected credential
-profile. Registryctl rejects a shared root because the generated Notary claim
-dependency is claim-wide and must not change another profile's behavior.
-Offering the same real-world payload through both self-service and
-representative paths therefore requires distinct claim roots and dependency
-closures. Keep their shared business logic in the registry implementation,
-and test both profiles so their payloads do not drift.
-
-A hand-authored Notary configuration may combine ordinary subject access and
-delegated access for different claim roots. It must not place a representative
-credential root in the global `subject_access.allowed_claims` list. Production
-validation rejects that configuration because representative roots are
-authorized only by the selected relationship.
-
-Registryctl generates:
-
-- The digitally authenticated representative ceremony
-- The root claim's dependency on the relationship proof claim
-- The exact delegated claim closure
-- A delegation-only root policy, separate from the ordinary subject-bound
-  claim allow-list
-- `subject_access.allowed_operations.evaluate`, which is required to evaluate
-  the relationship proof and credential closure before the offer is minted.
-  It does not make the representative root subject-bound.
-- Credential status at `<public_base_url>/v1/credentials`
-- A production-valid Registry Notary configuration
-
-Run the authoring checks before deployment:
-
-```sh
-registryctl check --project-dir <project> --environment <environment>
-registryctl test --project-dir <project> --environment <environment>
-registryctl build --project-dir <project> --environment <environment>
-```
-
-Synthetic fixtures can include `request.requester` as a governed entity. This
-lets `project test` prove the requester-to-consultation binding without a live
-identity provider or registry:
-
-```yaml
-request:
-  requester:
-    type: Person
-    identifiers:
-      - scheme: national_id
-        value: PARENT-0001
-  target:
-    type: Person
-    identifiers:
-      - scheme: civil_registration_id
-        value: CHILD-0001
-  claims: [birth-record]
-  disclosure: value
-  format: application/vnd.registry-notary.claim-result+json
-  purpose: civil-credential-issuance
-```
-
-Fixture values must remain synthetic.
-
-## Browser and wallet ceremony
-
-1. Open the ordinary offer-start URL for the representative-enabled credential:
-
-   ```text
-   https://notary.example.com/oid4vci/offer/start?credential_configuration_id=<id>
-   ```
-
-2. The representative authenticates with the configured identity provider.
-3. Registry Notary displays a no-store target-selection form.
-4. The representative enters the represented subject identifier.
-5. Registry Notary evaluates the relationship proof first, then the exact
-   committed credential dependency closure.
-6. Registry Notary renders the pre-authorized offer only after the complete
-   evaluation succeeds.
-7. The representative transfers the offer to a wallet and completes the normal
-   transaction-code and holder-proof flow.
-8. The credential endpoint validates the stored transaction and materializes
-   the credential without another Relay call.
-
-The representative, represented subject, and wallet holder are separate roles.
-The invoking client, browser ceremony, and channel remain audit context. They
-are not additional principals.
-
-The relationship evaluation uses the representative's verified identifiers
-inside Registry Notary. Before the offer is minted, Notary replaces them with
-transaction-bound HMAC handles. Neither the pre-authorized code nor the wallet
-access token contains the representative's raw identifiers.
-
-## Where authority comes from
-
-The Relay-backed `proof_claim` is the relationship evidence. The source result
-must prove the configured relationship for the authenticated requester and
-the selected target under the compiled consultation contract.
-
-The authorization details carried in the Notary-signed access token are a
-capability and consistency binding. They bind the relationship name, proof
-claim, target identifier, purpose, and claim closure across the untrusted
-wallet round trip. They do not prove the relationship.
-
-Registry Notary commits the evaluation, authorization binding, result target
-references, credential configuration, profile, signing key metadata, and
-Relay provenance into the existing issuance transaction commitment. For a
-representative ceremony, that binding also covers the resolved relationship
-policy's maximum proof age. The credential endpoint recomputes the commitment
-before signer access.
-
-## Freshness, status, and revocation
-
-The relationship proof expires at `max_proof_age_seconds`. Offer and access
-token expiry cannot extend beyond that proof expiry. Registry Notary does not
-re-run the relationship proof at the credential endpoint. In a hand-authored
-Notary configuration, this value must not exceed
-`subject_access.token_policy.max_evaluation_age_seconds`; Registryctl derives
-a sufficient ceiling from its compact setting.
-
-Representative credentials always include live credential status. If the
-relationship ends after issuance, an operator can revoke the credential
-through the status admin API. Automatic relationship-change-to-revocation
-delivery is tracked by
-[GH#568](https://github.com/registrystack/registry-stack/issues/568). Enabling
-status alone does not connect a source relationship change to revocation.
-
-## Subject pseudonym key epochs
-
-The represented subject becomes the credential `sub` as a keyed pseudonym over
-the target entity reference. Its identity-forming input includes the role,
-configured claim `subject_type`, target ID, identifiers, and attributes. The
-wallet proof key remains the holder binding.
-
-The pseudonym is stable only while the Registry Notary audit pseudonym key
-and those identity-forming inputs stay unchanged. Rotating
-`audit.hash_secret_env`, or changing the credential claim's `subject_type`,
-changes newly computed subject pseudonyms. Credentials issued before and after
-either change will not have equal `sub` values for the same represented
-subject.
-
-Treat audit pseudonym key rotation as a subject-identifier epoch change.
-Before rotation, identify relying parties that compare `sub` across
-credentials and decide whether outstanding credentials must expire, be
-revoked, or be reissued.
-
-The pseudonym input does not include issuer or audience. Cross-issuer
-non-correlation depends on separate audit pseudonym keys for separate Notary
-authorities.
-
-## Unsupported paths
-
-Representative issuance supports only the issuer-initiated OID4VCI browser
-ceremony described on this page. Registry Notary rejects:
-
-- Direct `POST /v1/credentials` representative issuance
-- Machine-created representative offers
-- Assisted-access ceremonies used as representative authority
-- Wallet-selected relationship names, proof claims, or claim closures
-- Credential materialization after the relationship proof expires
-
-## Troubleshooting
-
-| Symptom | Cause | Fix |
-| --- | --- | --- |
-| `proof_claim` does not exist | The environment names a claim outside the selected service | Select a registry-backed claim in the credential service |
-| Proof claim equals credential claim | The relationship proof and issued assertion are not separated | Create a distinct registry-backed proof claim; Registryctl derives the dependency |
-| Credential claim is shared by another profile | The derived proof dependency would also change that profile | Use an exclusive root claim or create a representative-specific claim |
-| Representative binding is missing | The proof consultation does not read the authenticated requester identifier | Map an input from `request.requester.identifiers.<oid4vci subject id_type>` |
-| Represented subject binding is missing | The proof consultation does not read the selected target identifier | Map an input from `request.target.identifiers.<target_id_type>` |
-| Proof consultation has another input | The target-selection ceremony cannot populate it | Keep exactly the requester identifier and target identifier inputs |
-| Credential dependency has another input | The target-selection ceremony cannot populate a root or transitive consultation field | Map only the requester or selected target identifier, or use a different governed ceremony |
-| Offer is not rendered | Authentication, proof evaluation, or a dependency failed | Check value-free Registryctl diagnostics, Notary audit events, and Relay availability |
-| Credential redemption is denied | The transaction expired or no longer matches its commitment | Restart the browser ceremony under the active project generation |
-| Verifier reports revoked or unavailable status | Lifecycle state is not valid or cannot be checked | Restore the status service or inspect the credential's lifecycle record |
diff --git a/products/notary/docs/sd-jwt-vc-conformance-profile.md b/products/notary/docs/sd-jwt-vc-conformance-profile.md
deleted file mode 100644
index 90a0ec5e6..000000000
--- a/products/notary/docs/sd-jwt-vc-conformance-profile.md
+++ /dev/null
@@ -1,194 +0,0 @@
-# Registry Notary SD-JWT VC conformance profile
-
-> **Page type:** Standards conformance · **Product:** Registry Notary · **Layer:** credential · **Audience:** integrator
-
-Registry Notary issues one constrained SD-JWT VC credential format
-(`application/dc+sd-jwt`, EdDSA or ES256 issuer signing, and EdDSA `did:jwk`
-holder proof for OID4VCI); it does not claim full SD-JWT VC or OpenID4VCI conformance. This page documents
-that credential contract and names adjacent ecosystem features that are not
-yet part of the product surface.
-
-## Supported credential format
-
-| Field | Value |
-| --- | --- |
-| Credential media type | `application/dc+sd-jwt` |
-| Compact JWT `typ` header | `dc+sd-jwt` |
-| Signing algorithm | `EdDSA` or `ES256` |
-| Issuer key type | `OKP/Ed25519` or `EC/P-256` |
-| Holder binding DID method | `did:jwk` |
-| Credential status methods | Default: none. Optional IETF Token Status List `status_list` when `credential_status.enabled = true`, with `uri` at `/v1/credentials/{credential_id}/status` and `idx: 0`. Aggregated status lists and external revocation-list profiles are not supported. |
-
-Registry Notary rejects credential profile format aliases such as
-`sd_jwt_vc` and `application/vc+sd-jwt`. Operator configuration must use the
-wire media type `application/dc+sd-jwt`.
-
-## Issuer-signed JWT header
-
-Issued credentials use a compact issuer-signed JWT as the first component of
-the SD-JWT value. The protected header has these Registry Notary invariants:
-
-- `alg` is the credential profile's configured `EdDSA` or `ES256` algorithm.
-- `typ` is `dc+sd-jwt`.
-- `kid` is the `kid` on the credential profile's configured signing key.
-
-Ed25519 keys are used with EdDSA and P-256 keys are used with ES256. Local JWK
-keys are supported for development and tests; supported production signing
-providers are documented separately.
-
-Signing key configuration examples are documented in
-[signing-key-provider.md](signing-key-provider.md).
-
-## Issuer-signed JWT payload
-
-Registry Notary sets these payload claims:
-
-- `iss`: credential profile issuer.
-- `sub`: holder DID for holder-bound credentials, otherwise the evaluation
-  subject reference.
-- `iat`: evaluation issue instant supplied by the caller.
-- `exp`: `iat + credential_profile.validity_seconds`.
-- `vct`: credential profile verifiable credential type URI.
-- `jti`: generated credential identifier.
-- `id`: same generated credential identifier as `jti`.
-- `_sd`: sorted disclosure digest list.
-- `cnf`: holder confirmation for holder-bound credentials.
-
-For citizen-facing holder-bound credentials, `sub` is the holder DID. Registry
-Notary does not claim that the holder DID is the same identifier as the civil
-or registry subject.
-
-## Holder binding
-
-When a credential profile requires holder proof of possession:
-
-- `holder_binding.mode` is `did`.
-- `holder_binding.proof_of_possession` is `required`.
-- `holder_binding.allowed_did_methods` must contain only `did:jwk`.
-- The issuance request must provide a holder DID and proof payload accepted by
-  the server holder-proof validator.
-- The issued credential includes `cnf.kid` equal to the holder DID.
-- The issued credential includes `cnf.jwk` with the public holder JWK only.
-
-Registry Notary does not support `did:key`, `did:web`, CWT proof, or mDoc
-holder binding in this profile.
-
-## Disclosures
-
-Each evaluated claim result becomes one selectively disclosable claim. The
-disclosure payload contains:
-
-- `claim_id`
-- `version`
-- `value`
-- `satisfied`
-- `subject_type`
-- `issued_at`
-
-The issuer-signed JWT stores disclosure digests in sorted order. The raw
-compact SD-JWT value is returned separately from the issuer-signed JWT and
-disclosure list so callers can verify or present the pieces without reparsing
-the whole credential.
-
-## Discovery
-
-`/.well-known/evidence-service` exposes a `credential_capabilities` object with
-the same constants listed in this profile:
-
-- supported credential media types;
-- SD-JWT VC JWT `typ`;
-- signing algorithms;
-- issuer signing key types;
-- holder binding methods;
-- configured credential profiles;
-- unsupported adjacent features.
-
-The metadata is Registry Notary capability metadata. It is not a claim of full
-OpenID4VCI issuer conformance.
-The route is authenticated by default; clients use the same configured Notary
-API key, bearer token, or OIDC credential they use for claim evaluation. Public
-discovery for verifiers and wallets is limited to the issuer JWKS, OID4VCI
-issuer metadata, and SD-JWT VC type-metadata routes.
-
-When OID4VCI is enabled, Registry Notary serves SD-JWT VC Type Metadata at the
-well-known location derived from each configured HTTPS `vct`. Per the SD-JWT VC
-Type Metadata convention, a consumer dereferences an HTTPS `vct` by inserting
-`/.well-known/vct` between the host and the path, so the metadata is served at
-`GET /.well-known/vct/{vct_path}`.
-
-- **Matching.** The handler strips the `/.well-known/vct` prefix and reconstructs
-  the candidate `vct` as `https://{host}/{vct_path}`, then matches it exactly
-  against a configured credential configuration. The route uses a trailing-wildcard
-  capture, so nested configured paths such as
-  `/.well-known/vct/credentials/dhis2/health-status/v1` are supported, not only two
-  segments.
-- **Direct dereference.** The bare `GET /credentials/{vct_path}` route is also
-  served for consumers that dereference the `vct` directly.
-- **Auth and prefixes.** Both routes are public (no authentication) and expect
-  path-prefix deployments to strip the issuer prefix before forwarding to Notary,
-  while preserving the external host and scheme.
-- **Not found.** Both return `404` when OID4VCI is disabled or the reconstructed
-  absolute URL does not exactly match a configured credential configuration `vct`.
-- **Document contents.** The Type Metadata document includes the exact configured
-  `vct`, display metadata, and one claim metadata entry for the OID4VCI
-  configuration's `claim_id`. Notary-issued claim results are always selectively
-  disclosable, so claim metadata uses `sd: "always"`. If the claim declares
-  semantic bindings, the claim metadata also includes the Notary extension
-  `registry_notary_semantics`; this labels the claim with external terms such as
-  PublicSchema URIs but does not change the Notary claim-result payload shape.
-
-The top-level `status` claim is reserved and cannot be projected as a
-selectively disclosable value. A client verifier of a status-bearing credential
-retrieves the signed status token only from its configured exact HTTPS trusted
-origin and fails closed when the status is missing, malformed, untrusted,
-unavailable, suspended, revoked, expired, or otherwise invalid.
-- **CORS.** Browser-based wallets from configured subject access wallet origins
-  receive CORS headers on the `/.well-known/vct/...` metadata surface.
-
-## Verification
-
-Registry Notary ships a verifier compatibility harness that exercises the
-`verify_sd_jwt_vc` path in `registry-notary-client` against a committed set of
-golden fixtures. The harness requires no secret material and no network access.
-
-Run the harness:
-
-```
-cargo test -p registry-notary-server --test sd_jwt_vc_verifier_compat
-```
-
-Or with `cargo-nextest`:
-
-```
-cargo nextest run -p registry-notary-server sd_jwt_vc_verifier_compat
-```
-
-Fixture files live under `tests/fixtures/sd_jwt_vc/`. To regenerate them using
-the server issuance path:
-
-```
-cargo run -p xtask -- gen-sd-jwt-vc-fixtures
-```
-
-The fixture set covers one valid credential, one valid holder-bound credential,
-and seven negative variants: unsupported algorithm, wrong `kid`, wrong `vct`,
-missing `cnf` when holder binding is required, malformed disclosure, expired
-credential, and holder proof mismatch. Each negative fixture is asserted against
-its exact error code from the verifier API.
-
-## Explicit non-support
-
-The following features are out of scope for the current profile:
-
-- `application/vc+sd-jwt` compatibility alias;
-- JSON-LD Verifiable Credential issuance;
-- Data Integrity proofs;
-- external status-list or revocation-list profiles;
-- mDoc/mDL;
-- CWT proof binding;
-- full OpenID4VCI issuer behavior, wallet-facing authorization code, a public
-  nonce endpoint, response next nonce, ES256 holder proof, EUDI, HAIP, PAR,
-  DPoP, or wallet attestation.
-
-These features require separate compatibility, lifecycle, and security design
-before implementation.
diff --git a/products/notary/docs/security-assurance.md b/products/notary/docs/security-assurance.md
deleted file mode 100644
index 4458e1783..000000000
--- a/products/notary/docs/security-assurance.md
+++ /dev/null
@@ -1,290 +0,0 @@
-# Security Assurance
-
-The root monorepo release workflow publishes Registry Notary images from semver
-`vX.Y.Z` release tags to `ghcr.io/registrystack/registry-notary:<tag>`. The
-workflow records the pushed image digests, SBOMs, and Grype reports as GitHub
-Release assets. It does not currently publish moving aliases such as `latest`,
-`vX`, or `vX.Y`, snapshot tags, `sha-<commit-sha>` image tags, or OCI image
-signatures for the container images themselves. Final deployments should pin
-the selected images by digest.
-
-The Registry Notary image is built with CEL and PKCS#11 compiled in. Runtime
-use remains config-gated, and the image is covered by the CEL worker-protocol
-smoke, SBOM, and Grype gate for every fixable finding plus every unreviewed High
-or Critical finding.
-
-## Container runtime policy
-
-The main Registry Notary image is a distroless Rust service image. Its runtime
-stage must remain `gcr.io/distroless/cc-debian13:nonroot` pinned by digest,
-shell-free, package-manager-free, and compatible with a binary healthcheck and
-JSON-array entrypoint. The container CI guard enforces the runtime base,
-`registry-notary healthcheck`, and `ENTRYPOINT ["/usr/local/bin/registry-notary"]`.
-
-Debian 13 receives full Debian support through August 9, 2028 and LTS through
-June 30, 2030. Registry Stack must select a successor base before the applicable
-support window ends. The upstream lifecycle is recorded at
-<https://www.debian.org/releases/trixie/>. The Rust builder, runtime-preparation,
-and Distroless bases are pinned to multi-architecture image-index digests. An
-immutable digest makes a build input repeatable, but it does not make that input
-perpetually current. Release operators refresh all three pins together before
-each release candidate and whenever an upstream security update or scan finding
-requires it, then run:
-
-```sh
-python3 release/scripts/check-debian13-images.py
-```
-
-Changing the builder OS intentionally changes the release build input and may
-change linked binary bytes even when Rust sources and the Rust toolchain version
-do not change. Repeatability is established by two clean builds with the same
-new builder digest and lockfiles, comparing `dist/image-bin/SHA256SUMS`; hashes
-from the retired builder are not the expected comparison.
-
-The failed `v0.12.0` release workflow run `29714784416` scanned exact Notary
-image digest
-`sha256:6d33ff0103608eab186f91c96c5d296d4ffca905334a778fdd9f40b836807577`.
-It confirmed the non-fixable Debian 13 `libc6` findings CVE-2026-5450
-(Critical), CVE-2026-5928 (High), and CVE-2026-5435 (High). Debian classifies
-all three Trixie issues as minor and no-DSA. The exact service's two direct
-AWS-LC `sscanf` call sites use fixed `%lu` and `%lx` numeric formats. Neither
-the service nor its linked libcrypto contains the vulnerable `%mc` conversion.
-Neither the service nor CEL worker imports `ungetwc` or the affected deprecated
-DNS-printing functions. The libstdc++ object that imports `ungetwc` is not in
-either executable dependency closure.
-
-The implementation reviewed for the pre-tag `v0.13.0` candidate is protected-
-main revision `d45761a0104bd3d9c2e4b4db391d4223f289bd44`, which remains an ancestor
-of the release lineage. The versioned candidate was built with the release's
-pinned Linux/amd64 builder and scanned at exact Notary image digest
-`sha256:88583e77ea51ad355554e88e0b5940257bd22bc40471784115f0649dbf35f9fb`.
-Grype 0.114.0 with valid database schema v6.1.9, built July 25, 2026, reported
-the same three non-fixable blocking-severity findings and no fixable finding.
-The reviewed root filesystem digest is
-`sha256:2278147669c7f00534ca8b75f1ff14f00a01fb4719141adbc597d35909b13190`.
-Direct inspection of the candidate service and CEL worker confirmed that they
-do not import `ungetwc` or the affected DNS-printing functions and contain no
-effective `%mc` format string. Neither executable dependency closure contains
-libstdc++. The tagged release must reproduce this root filesystem digest and
-pass the same policy against its exact pushed digest.
-
-The matching accepted-risk entries expire on August 25, 2026. A Trixie fix,
-changed fingerprint, new scanf format or call path, new C++ or wide-character
-input path, or new DNS TSIG debugging or printing path requires earlier review.
-The accepted-risk entries record the evidence image digest and the reachable
-protected-main implementation revision inspected during review. The exact
-candidate OCI revision label is verified separately when the image is built.
-Enforcement binds the review to a digest of the ordered root filesystem layers,
-so a changed package or binary layer requires a new review while a review-only
-commit that changes the OCI revision label does not create a self-referential
-image digest. The next candidate must still produce an exact digest-bound scan;
-this review does not waive fixable findings or a changed package fingerprint.
-External PKCS#11 modules and their dependency closures remain deployment inputs
-and need their own review.
-
-PKCS#11 support remains compiled in but config-gated. A vendor module and any
-vendor-owned shared-library dependencies remain deployment inputs, not image
-layers. Mount them read-only at operator-owned absolute paths and set the
-provider's `module_path` to the mounted module. Do not copy an HSM module, PIN,
-token database, or vendor configuration into the image. Because Distroless has
-no package manager, the exact candidate must prove that the intended external
-module and its dependency closure load on this base.
-
-For each candidate digest, run the Notary container as UID/GID `65532:65532`
-with a read-only root filesystem and only explicitly documented state and audit
-mounts writable. Verify CA-root TLS, binary and CEL-worker execution, PKCS#11
-module loading and signing, filesystem permissions, `registry-notary
-healthcheck`, and readiness. The release workflow must then produce digest-bound
-SBOM, Grype, and capsule evidence. These candidate checks cannot be inferred
-from source-only image-contract tests.
-
-Route exposure waivers, when needed, live on the affected entry in
-`security/exposure-manifest.json` so the review context stays with the route.
-There is no separate `security/waivers.yml` in this repository;
-deployment-gate waivers are runtime configuration and surface through the admin
-posture document.
-
-Reviewed advisory ratchets live in `security/advisory-baseline.json`. The
-initial blocking gates are:
-
-- `zizmor` findings with severity `high` or above.
-- Grype image findings with a known fix, regardless of severity.
-- Grype image findings with severity `high` or above when they do not have a
-  current reviewed disposition.
-
-Fixable findings cannot be dispositioned. Every reviewed non-fixable High or
-Critical finding must include a fingerprint, matching rule and severity, owner,
-reason, review date, expiration date, evidence image digest and revision, and
-the root filesystem layer digest enforced by the checker. Future-dated,
-expired, or rootfs-mismatched entries fail CI while the finding is still active.
-Stale reviewed entries are reported so the baseline can shrink after the
-underlying issue is fixed.
-
-The unauthenticated endpoint allowlist lives in
-`security/auth-none-allowlist.yml`. Additions require maintainer review through
-CODEOWNERS.
-
-GitHub Actions in this repo are SHA-pinned where practical. Any major-version
-pin must include a workflow comment explaining why the tag movement is accepted.
-`zizmor`, the reviewed advisory baseline, and code review enforce
-least-privilege permissions and unsafe event handling.
-
-## OpenAPI comparison strategy
-
-Notary's OpenAPI generator is deterministic:
-
-```sh
-cargo run -p registry-notary -- openapi
-```
-
-CI compares that generated output with
-`openapi/registry-notary.openapi.json`. Any difference is treated as API drift
-and must be committed intentionally with review.
-
-## Image release evidence
-
-The root monorepo release workflow publishes Registry Notary image digests,
-image SBOMs, vulnerability scan reports, release capsules, and keyless cosign
-signatures for GitHub Release assets. The workflow signs the release asset
-files, including image evidence files, but does not yet publish OCI image
-signatures for the container images themselves.
-
-Older product-local workflows used keyless `cosign` for product images under
-the previous GHCR namespace. Treat those records as legacy product-specific
-history, not as evidence that current root monorepo OCI images are signed.
-
-Verify an immutable image digest from the root release capsule:
-
-```sh
-docker buildx imagetools inspect ghcr.io/registrystack/registry-notary@sha256:<digest>
-```
-
-Verify the release capsule, binary assets, SBOMs, and image evidence files with
-the root release verification procedure:
-
-```sh
-less release/VERIFY.md
-```
-
-Previous product-local releases used keyless `cosign` for image tags under the
-old personal GHCR namespace and product-local workflow identities. Treat those
-records as legacy evidence for those historical artifacts only; they do not
-verify current `ghcr.io/registrystack` monorepo images.
-
-## Deliberate route posture exceptions
-
-Some routes deviate from the `/v1/` versioning convention by design. These
-exceptions are recorded in `security/exposure-manifest.json` (per-entry
-`notes`) and `security/auth-none-allowlist.yml` (per-entry `reason`).
-
-### Protected evidence-service discovery
-
-`GET /.well-known/evidence-service` is intentionally unversioned because it is
-a discovery route, but it is not on the unauthenticated allowlist. It exposes
-configured Notary capability metadata and requires normal Notary caller
-credentials. `server.openapi_requires_auth` only controls `/openapi.json`; it
-does not make evidence-service discovery public.
-
-### Bare VCT type-metadata routes
-
-`GET /credentials/{*vct_path}` and `GET /.well-known/vct/{*vct_path}` are
-deliberately unversioned (no `/v1/` prefix):
-
-- **`/credentials/{*vct_path}`**: per SD-JWT VC type-metadata dereference, a
-  client resolves credential type metadata by dereferencing the `vct` claim
-  directly (which is `https://{host}/credentials/{vct_path}`). The server path
-  must match the VCT URL path component exactly. Adding `/v1/` would break
-  dereference for any credential whose `vct` does not include that prefix.
-- **`/.well-known/vct/{*vct_path}`**: per RFC 8615, well-known URI paths are
-  determined by the protocol and cannot be prefixed or versioned.
-
-Both routes serve type metadata only and are unrelated to `POST /v1/credentials`
-(credential issuance). The namespace proximity (`GET /credentials/*` vs
-`POST /v1/credentials`) is a known hazard; it is resolved by documentation and
-the explicit `deliberate freeze exception` notes in the exposure manifest rather
-than by route changes that would violate the protocol constraints above.
-
-## Audit assurance posture
-
-The operations posture report (`GET /admin/v1/posture`) carries an `audit`
-object that describes, in a fixed vocabulary, the assurance properties of the
-running audit pipeline. The object is computed from the resolved audit
-configuration, never inferred from traffic, and always reports the same eight
-fields so operators and reviewers can compare two deployments by reading one
-block.
-
-| Field | Values | Meaning |
-| --- | --- | --- |
-| `write_policy` | `fail_closed_route_families`, `availability_first` | Whether protected route families refuse to serve when the audit write cannot be made durable. Becomes `fail_closed_route_families` once keyed integrity is configured. |
-| `redaction_mode` | `redacted` | Audit records carry redacted payloads; raw disclosure values are never written to the sink. |
-| `hash_chain` | `process_local`, `none` | Whether consecutive records are linked by a per-process hash chain. `process_local` once keyed integrity is configured; `none` otherwise. |
-| `keyed_integrity` | `hmac`, `none` | `hmac` when an HMAC key is supplied through the audit `hash_secret_env` setting, so records carry a keyed integrity tag; `none` when no key is set. |
-| `sink_class` | `file`, `external`, `stdout`, `none` | Where audit records are written. `file` covers file and JSONL sinks; `external` covers syslog; `stdout` is the process stream; `none` means no sink is configured. |
-| `retention_owner` | `operator`, `unspecified` | `operator` when the sink is durable (`file` or `external`), signalling that retention is the operator's responsibility; `unspecified` for non-durable sinks. |
-| `checkpoints` | `unsupported` | Periodic signed checkpoints over the audit chain are not produced by this build. |
-| `anchoring` | `none` | Audit state is not anchored to an external transparency log or ledger. |
-
-The nested `posture.audit` diagnostic block also reports the audit shipping
-target as two fields: `shipping_target_configured` and `shipping_target`, where
-`shipping_target` is `stdout`, `syslog`, `declared_external`, `none`, or
-`unknown`. Both are DECLARED state derived from configuration, the sink type
-plus the operator's `deployment.evidence.audit_offhost_shipping` attestation,
-not observed delivery health: a local file sink counts as having a shipping
-target only when the operator attests that logs are shipped off-host.
-
-When `deployment.evidence.audit_ack_cursor_path` points at the local state
-file an off-host audit shipper writes on each successful hand-off (the
-`registry.audit.ack_cursor.v1` contract: `acked_at`, `last_acked_hash`, an
-optional `writer`), the block adds two more fields: `shipping_health` (`ok`,
-`stale`, `missing`, `invalid`, `unverified`, or `null`) and
-`shipping_observed_at` (the cursor's `acked_at`, or `null`). Both are `null`
-whenever `shipping_target_configured` is `false`; `shipping_health` is
-`unverified` when no cursor is configured or an offline diagnostic cannot bind
-it to a live chain. Runtime `ok` requires both a fresh `acked_at` and a
-`last_acked_hash` equal to the current keyed audit-chain tail, establishing a
-zero local backlog for the trusted shipper's claim. The cursor is unsigned
-local state, so this is not cryptographic proof of remote receipt. A mismatch,
-missing or stale cursor, unsafe file type, cursor larger than 16 KiB, or cursor
-read that exceeds 500 ms fails closed. The shipper must atomically replace the
-cursor, keep it on local storage, and run independently of Notary readiness.
-The signed-bundle acceptance audit advances the tail before Notary serves
-requests, so an evidence-grade instance stays not ready until the shipper
-acknowledges that boot record. Offline `registry-notary doctor` cannot bind to
-the live tail and reports a fresh cursor as `unverified`. Evidence-grade
-deployments require the cursor at startup and recheck it for every readiness
-and posture request.
-
-Note: a running notary always reports `keyed_integrity = hmac` and
-`write_policy = fail_closed_route_families` because startup refuses any
-configuration that omits the `hash_secret_env` HMAC key; the `hmac` and
-`none` rows in the table reflect the vocabulary, not states a live process can
-reach.
-
-Keyed integrity is the pivot. Supplying an HMAC key through the audit
-`hash_secret_env` setting moves `keyed_integrity` to `hmac`, `hash_chain` to
-`process_local`, and `write_policy` to `fail_closed_route_families` together,
-because a keyed, chained audit trail is only meaningful if protected routes stop
-serving rather than silently lose records. Durability of the sink, reported
-through `sink_class` and `retention_owner`, is an independent axis: a keyed
-pipeline can still write to `stdout`, and a durable `file` sink can still run
-without a key.
-
-These properties also feed the deployment profile gates. The
-`notary.audit.sink_missing` gate refuses startup under the `production` and
-`evidence_grade` profiles when no durable sink is configured, and downgrades to
-a waivable finding under `hosted_lab`. See
-[Deployment Profile and Gates](operator-config-reference.md#deployment-profile-and-gates)
-for the full gate catalog and severities.
-
-## Local security command
-
-For contributors working in the repository, run the practical local subset:
-
-```sh
-just security
-```
-
-This validates exposure contracts, Dockerfile secret-copy guardrails, the
-OpenAPI baseline, optional GitHub Actions tooling when installed for workflow
-files in scope, the reviewed `zizmor` high-severity ratchet, gitleaks
-current-tree scanning, and Semgrep rules when installed.
diff --git a/products/notary/docs/signing-key-provider.md b/products/notary/docs/signing-key-provider.md
deleted file mode 100644
index d6cfb8e8b..000000000
--- a/products/notary/docs/signing-key-provider.md
+++ /dev/null
@@ -1,313 +0,0 @@
-# Signing key provider configuration
-
-> **Page type:** How-to · **Product:** Registry Notary · **Layer:** credential · **Audience:** operator
-
-Registry Notary signs SD-JWT VC credentials and federation response JWTs through
-named signing keys under `evidence.signing_keys`. Credential profiles and
-federation config reference those keys by id. This keeps profile policy,
-federation policy, and key storage separate while making rotation explicit.
-
-Credential profile signing supports Ed25519 EdDSA and ES256 over P-256. RS256
-is reserved for the eSignet pre-authorized-code RP client assertion key and is
-rejected for credential profiles, access tokens, and federation responses.
-
-## Runtime contract
-
-- `active` keys can sign new credentials and are published in
-  `/.well-known/evidence/jwks.json`.
-- `publish_only` keys are published in JWKS while
-  `publish_until_unix_seconds` is absent or still in the future, but cannot be
-  used by a credential profile. Use them for old verification keys during
-  rotation.
-- `disabled` keys are ignored by issuance and JWKS publication.
-- Published `kid` values must be unique across active and publish-only keys.
-- Credential profile issuers must match the signing key `kid` DID when the key
-  uses a `did:web` `kid`.
-- Federation response signing uses `federation.signing.signing_key`, which must
-  reference an active named signing key.
-- Private key material is read only at startup for active local keys. Rotated
-  publish-only keys use public JWK material only.
-- Startup fails closed if an active signing provider cannot be constructed or
-  cannot pass its sign/verify self-test.
-- `/ready` reports active provider-kind counts, local JWK/file signer counts,
-  and whether `deployment.evidence.signer_custody_approved` is required and set.
-  Production readiness reports not-ready, and evidence-grade startup fails, when
-  a credential, access-token, or federation signing key lacks that explicit
-  approval. Provider kind is evidence for review, not proof of custody.
-
-The public JWKS endpoint is intentionally unauthenticated for wallet and
-verifier discovery. It publishes public verification keys only; private JWK
-members such as `d` are rejected on public-key inputs and never emitted.
-
-## Provider fields
-
-| Provider | Status | Required fields | Forbidden fields |
-| --- | --- | --- | --- |
-| `local_jwk_env` | `active` | `private_jwk_env`, `alg`, `kid` | PKCS#11 and PKCS#12 fields |
-| `local_jwk_env` | `publish_only` | `public_jwk_env`, `alg`, `kid` | `private_jwk_env`, PKCS#11 and PKCS#12 fields |
-| `file_watch` | `active` | `path`, `alg`, `kid` | env-backed JWK, PKCS#11, and PKCS#12 fields |
-| `pkcs11` | `active` | `module_path`, `token_label`, `pin_env`, `key_label`, `key_id_hex`, `public_jwk_env`, `alg`, `kid` | local JWK and PKCS#12 fields |
-| `pkcs11` | `publish_only` | `public_jwk_env`, `alg`, `kid` | HSM lookup fields, local JWK and PKCS#12 fields |
-| `local_pkcs12_file` | any | none | all runtime use is rejected |
-
-## Local JWK active key
-
-Use this for local development, tests, and simple mounted-secret deployments.
-Local JWK signing remains supported for local and hosted lab profiles. For
-production or evidence-grade profiles, prefer non-exporting custody and declare
-`deployment.evidence.signer_custody_approved: true` only after deployment review
-accepts every configured signing role.
-
-```yaml
-evidence:
-  signing_keys:
-    issuer-2026:
-      provider: local_jwk_env
-      private_jwk_env: REGISTRY_NOTARY_ISSUER_JWK
-      alg: EdDSA
-      kid: did:web:issuer.example#issuer-2026
-      status: active
-  credential_profiles:
-    civil_status_sd_jwt:
-      format: application/dc+sd-jwt
-      issuer: did:web:issuer.example
-      signing_key: issuer-2026
-      vct: https://issuer.example/credentials/civil-status
-      allowed_claims: [person-is-alive]
-```
-
-The private JWK must be an Ed25519 or P-256 private JWK for credential profile
-signing. If it contains `kid` or `alg`, those values must match the configured
-key. Startup signs and verifies a fixed self-test payload before the key is
-accepted.
-
-When RS256 is used for the eSignet RP client assertion key, the private RSA JWK
-must use a 2048-8192-bit modulus and include the full two-prime CRT fields
-`n`, `e`, `d`, `p`, `q`, `dp`, `dq`, and `qi` so the key can be imported into
-AWS-LC.
-
-Generate a local demo key with:
-
-```sh
-registry-notary demo-issuer-key
-```
-
-The generated private JWK belongs in the environment variable named by
-`private_jwk_env`, not inline in the YAML config.
-
-## Local JWK rotation key
-
-Use `publish_only` for old verification keys that must remain in JWKS but must
-not sign new credentials. Publish-only local keys use public metadata only.
-
-```yaml
-evidence:
-  signing_keys:
-    issuer-2025:
-      provider: local_jwk_env
-      public_jwk_env: REGISTRY_NOTARY_ISSUER_2025_PUBLIC_JWK
-      alg: EdDSA
-      kid: did:web:issuer.example#issuer-2025
-      status: publish_only
-      publish_until_unix_seconds: 1772592000
-```
-
-`publish_until_unix_seconds` is optional metadata and valid only for
-`publish_only` keys. Expired publish-only keys are omitted from JWKS and from
-restricted posture `notary.signing_keys.publish_only`. Publish-only keys cannot
-be referenced by `credential_profiles.*.signing_key`.
-
-Governed signed config apply can remove expired publish-only keys with change
-class `signing_key_cleanup` once they are no longer active signing references.
-Cleanup before `publish_until_unix_seconds` has elapsed is rejected before
-anti-rollback advances.
-
-## Federation response signing
-
-Federation response JWTs use the same provider abstraction as credential
-issuance. The federation block references an active key by id:
-
-```yaml
-evidence:
-  signing_keys:
-    federation-response:
-      provider: local_jwk_env
-      private_jwk_env: REGISTRY_NOTARY_FEDERATION_RESPONSE_JWK
-      alg: EdDSA
-      kid: agency-a-fed-1
-      status: active
-
-federation:
-  enabled: true
-  signing:
-    signing_key: federation-response
-```
-
-For HSM-backed federation response signing, configure the referenced key with
-`provider: pkcs11`. The JWT `kid` is taken from the provider's configured
-public key id.
-
-## Rotation procedure
-
-1. Add the new key as `active` with a new `kid`.
-2. Move credential profiles to the new `signing_key`.
-3. Move the old key to `publish_only` and configure only `public_jwk_env`.
-4. Set `publish_until_unix_seconds` to the end of the verifier window, or omit
-   it for an indefinite manual window.
-5. After the verifier window ends, remove the old key with governed
-   `signing_key_cleanup`, or change it to `disabled` during the next local-file
-   deploy when running without signed apply.
-
-Do not reuse a `kid` for new key material. Verifiers cache keys by `kid`, and
-reuse creates ambiguous verification behavior.
-
-```mermaid
-stateDiagram-v2
-  [*] --> active: add key with new kid
-  active --> publish_only: rotate out
-  publish_only --> disabled: old credentials expired, verifier caches cleared
-  disabled --> [*]: remove key and secret material
-
-  note right of active
-    Signs new credentials,
-    published in JWKS
-  end note
-  note right of publish_only
-    Cannot sign,
-    published until window expires
-  end note
-  note right of disabled
-    Ignored by issuance and JWKS
-  end note
-```
-
-*Signing key status through a rotation. The notes restate the runtime contract
-for each status; the numbered steps in the rotation procedure walk the same transitions.*
-
-## PKCS#11 active key
-
-Enable the server feature `pkcs11` to use an HSM-backed Ed25519 signing key.
-Published product binaries and container images compile this feature, but they
-do not bundle vendor PKCS#11 modules or token state.
-
-```yaml
-evidence:
-  signing_keys:
-    issuer-hsm:
-      provider: pkcs11
-      module_path: <path-to-vendor-pkcs11-module>.so
-      token_label: registry-notary
-      pin_env: REGISTRY_NOTARY_PKCS11_PIN
-      key_label: issuer-signing-key
-      key_id_hex: 01ab23cd
-      public_jwk_env: REGISTRY_NOTARY_ISSUER_PUBLIC_JWK
-      alg: EdDSA
-      kid: did:web:issuer.example#issuer-hsm
-      status: active
-```
-
-Startup loads the PKCS#11 module, finds exactly one token by `token_label`,
-checks CKM_EDDSA support, finds exactly one private key by `key_label` and
-`key_id_hex`, then signs and verifies a self-test payload against
-`public_jwk_env`.
-
-Each provider enforces a five-second end-to-end signing timeout and allows only
-one in-flight sign call at a time. These limits affect capacity planning: a slow
-or stuck HSM call blocks subsequent signing requests for that provider until the
-timeout elapses. Startup opens a session, authenticates, locates the private
-key, and runs a bounded sign-and-verify self-test. That session is reused for
-subsequent signatures. If a sign call fails, the provider reopens the session
-and retries once before returning an error. PIN values are read from the
-environment and are not logged.
-
-PKCS#11 module calls cannot be cancelled once the module is executing.
-Production HSM deployments must configure vendor driver network, session, and
-request timeouts below the five-second service-level signing timeout, so a stuck
-module call returns before that deadline. If Registry Notary reaches its own
-timeout first, the provider is marked unhealthy and `/ready` fails for that
-process so traffic can drain while the vendor call finishes or the process is
-restarted.
-
-### SoftHSM smoke setup
-
-`pkcs11` identifies the provider interface, not whether the token is implemented
-in hardware. Production and evidence-grade deployments still require explicit
-`deployment.evidence.signer_custody_approved: true` after reviewing the module,
-token, key generation and export controls, and operating procedures.
-
-The test suite verifies the PKCS#11 path with SoftHSM when `softhsm2-util` and
-`openssl` are available:
-
-```sh
-cargo test -p registry-notary-server --no-default-features --features pkcs11 \
-  pkcs11_signing_key_signs_with_softhsm_when_available -- --nocapture
-```
-
-For local manual setup:
-
-```sh
-export SOFTHSM2_CONF=/path/to/softhsm2.conf
-softhsm2-util --init-token --free \
-  --label registry-notary --so-pin 123456 --pin "$REGISTRY_NOTARY_PKCS11_PIN"
-openssl genpkey -algorithm ED25519 -out issuer-ed25519.pem
-softhsm2-util --import issuer-ed25519.pem \
-  --token registry-notary --pin "$REGISTRY_NOTARY_PKCS11_PIN" \
-  --label issuer-signing-key --id 01ab23cd --force
-```
-
-On a Homebrew-installed macOS setup, `module_path` is typically
-`/opt/homebrew/lib/softhsm/libsofthsm2.so`.
-
-The public JWK in `public_jwk_env` must match the public half of the imported
-key and must contain the configured `kid` and `alg`.
-
-## PKCS#11 rotation key
-
-Old HSM-backed verification keys can be published without HSM access.
-
-```yaml
-evidence:
-  signing_keys:
-    issuer-hsm-2025:
-      provider: pkcs11
-      public_jwk_env: REGISTRY_NOTARY_ISSUER_2025_PUBLIC_JWK
-      alg: EdDSA
-      kid: did:web:issuer.example#issuer-hsm-2025
-      status: publish_only
-      publish_until_unix_seconds: 1772592000
-```
-
-## Disabled keys
-
-Disabled keys are ignored by issuance and JWKS publication.
-
-```yaml
-evidence:
-  signing_keys:
-    retired:
-      provider: local_jwk_env
-      alg: EdDSA
-      kid: did:web:issuer.example#retired
-      status: disabled
-```
-
-## PKCS#12
-
-`local_pkcs12_file` is intentionally rejected. It is present in the config enum
-only to reserve the provider name until a real, tested implementation exists.
-
-## Verification checklist
-
-After changing signing configuration, re-run startup and confirm the self-test
-signs and verifies successfully. Contributors changing provider code should
-also run the test suite as described in
-[Verification in the workspace README](../README.md#verification).
-
-Note: some server tests bind local sockets and may need to run outside strict network sandboxes.
-
-## Limits
-
-- No vendor HSM is certified by this repository yet. SoftHSM verifies the
-  PKCS#11 integration path, not vendor-specific behavior.
-- PKCS#12 is not implemented.
-- Credential issuer signing supports Ed25519 EdDSA and ES256 over P-256.
diff --git a/products/notary/docs/source-claim-modeling-guide.md b/products/notary/docs/source-claim-modeling-guide.md
deleted file mode 100644
index 0c510982d..000000000
--- a/products/notary/docs/source-claim-modeling-guide.md
+++ /dev/null
@@ -1,127 +0,0 @@
-# Source and claim modeling guide
-
-Use this guide to keep source adaptation in Relay, reusable evidence in
-Notary, and consumer decisions in the consuming system.
-
-## Choose the topology
-
-| Need | Project topology | Notary evidence mode |
-| --- | --- | --- |
-| Governed records or materialization only | Relay only | Not applicable |
-| Evidence derived from registry data | Relay and Notary | `registry_backed` |
-
-Authentication can bind an evidence request to the authenticated subject, but
-it is authorization context rather than evidence. Notary does not support
-claims derived only from caller-provided or identity-token data.
-
-A Registry Stack project has one registry trust domain and one logical source
-available to Relay. Separate independent registries require separate projects.
-Do not join them inside one Notary claim.
-
-## Keep evidence separate from consumer decisions
-
-This evidence-versus-decision boundary is normative for 1.0 project
-authoring. Use it for every registry-backed flow:
-
-```text
-Source system
-  -> Registry Relay: source-specific acquisition and typed normalization
-  -> Registry Notary: atomic, precise, reusable evidence statements
-  -> Evidence consumer: use evidence under consumer-owned policy
-  -> Decision owner: remain accountable for requirements and outcomes
-```
-
-The caller, evidence consumer, and decision owner can be the same component or
-separate components. The caller is the technical client that invokes Notary.
-The evidence consumer uses the returned evidence. The decision owner is the
-institution accountable for the requirements, rules, decisions, and actions.
-
-The products and consuming roles have different responsibilities:
-
-| Role | Responsibility |
-| --- | --- |
-| Registry Relay | Source access, bounded acquisition, and source-specific adaptation |
-| Registry Notary | Evidence meaning, caller authorization, disclosure, and credential issuance |
-| Evidence consumer | Evidence use, presentation, routing, and workflow integration |
-| Decision owner | Requirements, eligibility, qualification, prioritization, approval, referral, payment, and action |
-
-Registry Notary may attest a decision already made by an authoritative source.
-Name and document that claim as a source-owned decision, such as
-`social-registry-assessed-eligible`. Do not present it as a decision computed
-by Registry Notary.
-
-## Model the Relay integration
-
-Author an integration with one product-neutral capability:
-
-- `http` for one bounded request and output projection;
-- `script` for reviewed bounded Rhai orchestration and normalization; or
-- `snapshot` for an exact lookup over a Relay-local entity generation.
-
-Product and tested-version metadata is interoperability evidence only. It must
-not select an executor. Rhai availability depends on the `script` capability
-and runtime ABI, never on DHIS2, OpenCRVS, FHIR, OpenSPP, or a version label.
-
-Declare typed inputs, typed minimized outputs, fixtures, source authority, and
-only the operational overrides the integration needs. Authentication,
-destinations, private networks, trust roots, and secrets belong to the private
-environment binding.
-
-Relay outputs describe the source response in a stable typed form. They do not
-encode an evidence consumer's decision or action rules.
-
-## Model the Notary service
-
-An evidence service owns purpose, legal basis, consent policy, caller access,
-consultations, claims, disclosure, and credential profiles. A consultation is
-one named use of a Relay integration. It may feed several direct or CEL claims.
-
-Use a direct output claim for a single Relay output. Use CEL for evidence
-predicates or derived evidence values. CEL is not a source adapter, cannot
-perform I/O, and is not a general-purpose consumer eligibility or decision
-engine.
-Credential profile membership has one authored direction: the profile lists
-its claims.
-
-A claim can be evaluated under purpose-bound authorization while retaining
-evidence semantics that several services or procedures can reuse. The evidence
-consumer determines how the claims are used after Notary returns them, while
-the decision owner remains accountable for any resulting outcome.
-
-## Test each claim design
-
-Before accepting a claim, confirm that:
-
-- The claim states evidence, not an entitlement, payment, referral, outreach,
-  or workflow action.
-- Its `true`, `false`, `null`, and unavailable cases have reviewed meanings.
-- Another service or procedure can reuse the statement without importing the
-  first consumer's decision rules.
-- A claim that reports an authoritative source's decision is named and
-  documented as source-owned.
-
-## Preserve failure semantics
-
-Treat `no_match` as an explicit consultation outcome. Do not model presence as
-an author-declared output. Ambiguity and Relay failures abort the consultation
-group. A credential containing a direct output claim is not issuable on
-`no_match`. Do not turn missing evidence into a negative fact merely to produce
-a boolean. A boolean evidence claim can return `false` from a matched source
-outcome whose declared typed outputs establish the negative fact. An explicitly
-named existence predicate may also map `matched == false` to `false` when its
-reviewed meaning is exactly whether one admissible match exists. This exception
-does not make other claims negative, and ambiguity or failure remains
-unavailable.
-
-## Review checklist
-
-- Caller authorization and purpose are enforced before Relay access.
-- Notary contains no source destination or source credential.
-- The compiler-produced semantic contract and hash are pinned exactly.
-- Inputs map only from the closed request grammar.
-- Outputs are typed, bounded, minimized, and distinct from claims.
-- Claims pass the evidence-versus-decision design test.
-- One consultation is reused for related claims within an evaluation.
-- No raw Relay error becomes a claim.
-- Fixtures cover match, no-match, ambiguity, mismatch where applicable, and
-  country or jurisdiction variations when geographically material.
diff --git a/products/notary/docs/subject-access-operator-guide.md b/products/notary/docs/subject-access-operator-guide.md
deleted file mode 100644
index 5ff6875ee..000000000
--- a/products/notary/docs/subject-access-operator-guide.md
+++ /dev/null
@@ -1,191 +0,0 @@
-# Subject access operator guide
-
-> **Page type:** How-to · **Product:** Registry Notary · **Layer:** evaluation, credential · **Audience:** operator
-
-Subject access lets an authenticated person evaluate, render, or receive
-credentials from policy-approved Registry Relay evidence about themselves.
-The identity token authorizes access. It is not evidence and never supplies a
-claim value.
-
-Every Notary claim must derive from exactly one compiler-pinned Relay
-consultation. Notary does not support caller-authored or source-independent
-claim issuance or evaluation.
-
-## Security goal
-
-An OIDC token can be used only:
-
-- for the exact subject bound by the configured token claim;
-- by an allowed client and audience;
-- for explicitly allowed operations, purposes, claims, formats, disclosures,
-  and credential profiles;
-- with Relay consultation inputs bound to the authenticated requester or
-  target identifiers; and
-- within the configured token, evaluation, and credential age limits.
-
-```mermaid
-flowchart LR
-  Token["OIDC token"] --> Verify["Verify issuer, audience, client, algorithm, and lifetime"]
-  Verify --> Bind["Bind requester and target from the verified token claim"]
-  Bind --> Authorize["Check scopes and subject-access allow-lists"]
-  Authorize --> Relay["Execute compiler-pinned Relay consultation"]
-  Relay --> Evaluate["Evaluate and minimize the claim"]
-  Evaluate --> Output["Render or issue an allowed credential"]
-```
-
-Any failed gate rejects the request. Caller-supplied identity fields cannot
-override the token-bound subject.
-
-## When to use it
-
-Use subject access when:
-
-- a person needs evidence about their own registry record;
-- a wallet flow needs a credential backed by current registry evidence;
-- the identity provider supplies a stable, reviewed subject identifier; and
-- the source owner has approved token-bound access for the configured purpose.
-
-Use machine authentication for caseworker or service access to arbitrary
-subjects. Batch evaluation is a machine-client operation and is unavailable to
-subject-access principals.
-
-## OIDC authentication
-
-Configure the external identity provider:
-
-```yaml
-auth:
-  oidc:
-    issuer: https://idp.example.gov
-    jwks_url: https://idp.example.gov/.well-known/jwks.json
-    audiences: [registry-notary-citizen]
-    allowed_clients: [citizen-portal]
-    allowed_algorithms: [EdDSA]
-    allowed_token_types: [JWT]
-    scope_claim: scope
-    scope_separator: " "
-    scope_map:
-      citizen.evidence:
-        - registry_notary:subject_access
-    principal_claim: sub
-    leeway: 60s
-```
-
-OIDC can coexist with static API keys for machine clients. Static bearer
-tokens cannot coexist with OIDC because both use the `Authorization: Bearer`
-transport.
-
-## Subject binding
-
-Bind the authenticated identity to the registry lookup identifier:
-
-```yaml
-subject_access:
-  enabled: true
-  subject_binding:
-    token_claim: civil_id
-    claim_source: access_token
-    request_field: subject_id
-    id_type: UIN
-    normalize: exact
-```
-
-- Use `userinfo` only when the endpoint and signed response are configured and
-  reviewed.
-- Avoid using `sub` as a civil identifier unless the identity-provider owner
-  confirms that it is appropriate. If selected, set
-  `allow_sub_as_civil_id: true`.
-- Keep `normalize: exact`. Identifier transformations belong at an explicitly
-  reviewed boundary.
-
-## Client and token policy
-
-```yaml
-subject_access:
-  citizen_clients:
-    allowed_client_ids: [citizen-portal]
-    allowed_audiences: [registry-notary-citizen]
-  token_policy:
-    required_acr_values: [urn:example:loa:substantial]
-    assurance_claim_source: access_token
-    max_auth_age_seconds: 600
-    max_access_token_lifetime_seconds: 900
-    max_evaluation_age_seconds: 300
-    max_credential_validity_seconds: 31536000
-    max_clock_leeway_seconds: 60
-```
-
-Keep public-client tokens and stored evaluations short-lived. Credential
-validity is a separate issuer policy and should be paired with credential
-status when long-lived credentials are required.
-
-## Allowed operations
-
-```yaml
-subject_access:
-  allowed_operations:
-    evaluate: true
-    render: true
-    issue_credential: true
-    batch_evaluate: false
-  allowed_purposes: [wallet_credential_issuance]
-  allowed_claims: [birth-record-exists]
-  allowed_formats:
-    - application/vnd.registry-notary.claim-result+json
-  allowed_disclosures: [value, redacted]
-  credential_profiles: [birth_record_sd_jwt]
-  required_scopes: [registry_notary:subject_access]
-  allowed_wallet_origins: [https://wallet.example.gov]
-```
-
-All referenced claims must be Relay-backed. Credential profiles must agree
-with each claim's allow-list and require the configured holder binding and
-proof of possession.
-
-## Delegated subject access
-
-Delegated access lets an authenticated requester act for a configured target
-only after a separate Relay-backed relationship proof passes.
-
-```yaml
-subject_access:
-  delegation:
-    enabled: true
-    allowed_relationships:
-      - relationship_type: guardian
-        proof_claim: guardian-link-established
-        target_id_type: civil_registration_id
-        max_proof_age_seconds: 300
-        allowed_claims: [dependent-birth-record-exists]
-        allowed_purposes: [dependent-record-access]
-        allowed_formats:
-          - application/vnd.registry-notary.claim-result+json
-        allowed_disclosures: [predicate]
-```
-
-The request uses `access_mode: delegated_subject_access`. The requester and
-target identifiers are bound independently, and `proof_claim` must be a
-compiler-pinned Relay-backed boolean claim.
-
-Direct `/v1/credentials` issuance does not accept delegated evaluations.
-Representative credential issuance requires the explicit OID4VCI digitally
-authenticated representative ceremony.
-
-## Operational checks
-
-Before enabling subject access:
-
-1. Run `registry-notary doctor --config <path>`.
-2. Verify every allowed claim references the intended Relay consultation and
-   exact target identifier mapping.
-3. Confirm client, audience, scope, purpose, disclosure, and credential
-   allow-lists with the source and identity-provider owners.
-4. Exercise subject mismatch, stale token, wrong client, wrong audience,
-   disallowed claim, Relay unavailable, and relationship-proof failure paths.
-5. Confirm audit output contains pseudonymous identifiers only.
-6. Confirm rate limits and wallet CORS origins match the deployment posture.
-
-Use [OID4VCI wallet interop](oid4vci-wallet-interop.md) for wallet protocol
-configuration and
-[representative credential issuance](representative-credential-issuance.md)
-for the representative ceremony.
diff --git a/products/notary/fuzz/.gitignore b/products/notary/fuzz/.gitignore
deleted file mode 100644
index f08c9ca1e..000000000
--- a/products/notary/fuzz/.gitignore
+++ /dev/null
@@ -1,4 +0,0 @@
-target
-artifacts
-coverage
-corpus/**/[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]
diff --git a/products/notary/fuzz/Cargo.lock b/products/notary/fuzz/Cargo.lock
deleted file mode 100644
index 35b2bef76..000000000
--- a/products/notary/fuzz/Cargo.lock
+++ /dev/null
@@ -1,2863 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "arbitrary"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
-
-[[package]]
-name = "async-trait"
-version = "0.1.89"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
-]
-
-[[package]]
-name = "atomic-waker"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
-
-[[package]]
-name = "autocfg"
-version = "1.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
-
-[[package]]
-name = "aws-lc-rs"
-version = "1.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00"
-dependencies = [
- "aws-lc-sys",
- "untrusted 0.7.1",
- "zeroize",
-]
-
-[[package]]
-name = "aws-lc-sys"
-version = "0.41.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4"
-dependencies = [
- "cc",
- "cmake",
- "dunce",
- "fs_extra",
-]
-
-[[package]]
-name = "base16ct"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
-
-[[package]]
-name = "base64"
-version = "0.22.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
-
-[[package]]
-name = "base64ct"
-version = "1.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
-
-[[package]]
-name = "bitflags"
-version = "2.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
-
-[[package]]
-name = "block-buffer"
-version = "0.10.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "block-buffer"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
-dependencies = [
- "hybrid-array",
-]
-
-[[package]]
-name = "bumpalo"
-version = "3.20.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
-
-[[package]]
-name = "bytes"
-version = "1.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
-
-[[package]]
-name = "cc"
-version = "1.2.66"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5d6cac793997bd970000024b2934968efe83b382de4fdcf4fcb46b6ee4ad996"
-dependencies = [
- "find-msvc-tools",
- "jobserver",
- "libc",
- "shlex",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
-
-[[package]]
-name = "cfg_aliases"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
-
-[[package]]
-name = "chacha20"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "rand_core 0.10.1",
-]
-
-[[package]]
-name = "cmake"
-version = "0.1.58"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "cmov"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
-
-[[package]]
-name = "combine"
-version = "4.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
-dependencies = [
- "bytes",
- "memchr",
-]
-
-[[package]]
-name = "const-oid"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
-
-[[package]]
-name = "const-oid"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
-
-[[package]]
-name = "core-foundation"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
-name = "core-foundation"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
-name = "core-foundation-sys"
-version = "0.8.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
-
-[[package]]
-name = "cpufeatures"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "cpufeatures"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "critical-section"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
-
-[[package]]
-name = "crossbeam-channel"
-version = "0.5.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d85363c37faeca707aef026efa9f3b34d077bce547e48f770770625c6013679e"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.9.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
-
-[[package]]
-name = "crypto-bigint"
-version = "0.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
-dependencies = [
- "generic-array",
- "rand_core 0.6.4",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "crypto-common"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
-dependencies = [
- "generic-array",
- "typenum",
-]
-
-[[package]]
-name = "crypto-common"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
-dependencies = [
- "hybrid-array",
-]
-
-[[package]]
-name = "ctutils"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
-dependencies = [
- "cmov",
-]
-
-[[package]]
-name = "curve25519-dalek"
-version = "4.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "curve25519-dalek-derive",
- "digest 0.10.7",
- "fiat-crypto",
- "rustc_version",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "curve25519-dalek-derive"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
-]
-
-[[package]]
-name = "data-encoding"
-version = "2.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
-
-[[package]]
-name = "der"
-version = "0.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
-dependencies = [
- "const-oid 0.9.6",
- "pem-rfc7468",
- "zeroize",
-]
-
-[[package]]
-name = "deranged"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
-dependencies = [
- "serde_core",
-]
-
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer 0.10.4",
- "const-oid 0.9.6",
- "crypto-common 0.1.6",
- "subtle",
-]
-
-[[package]]
-name = "digest"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
-dependencies = [
- "block-buffer 0.12.1",
- "const-oid 0.10.2",
- "crypto-common 0.2.2",
- "ctutils",
-]
-
-[[package]]
-name = "displaydoc"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
-]
-
-[[package]]
-name = "dunce"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
-
-[[package]]
-name = "dyn-clone"
-version = "1.0.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
-
-[[package]]
-name = "ecdsa"
-version = "0.16.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
-dependencies = [
- "der",
- "digest 0.10.7",
- "elliptic-curve",
- "rfc6979",
- "signature",
- "spki",
-]
-
-[[package]]
-name = "ed25519"
-version = "2.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
-dependencies = [
- "pkcs8",
- "signature",
-]
-
-[[package]]
-name = "ed25519-dalek"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
-dependencies = [
- "curve25519-dalek",
- "ed25519",
- "rand_core 0.6.4",
- "serde",
- "sha2 0.10.9",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "either"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
-
-[[package]]
-name = "elliptic-curve"
-version = "0.13.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
-dependencies = [
- "base16ct",
- "crypto-bigint",
- "digest 0.10.7",
- "ff",
- "generic-array",
- "group",
- "pem-rfc7468",
- "pkcs8",
- "rand_core 0.6.4",
- "sec1",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "equivalent"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
-
-[[package]]
-name = "errno"
-version = "0.3.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
-dependencies = [
- "libc",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "ff"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
-dependencies = [
- "rand_core 0.6.4",
- "subtle",
-]
-
-[[package]]
-name = "fiat-crypto"
-version = "0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
-
-[[package]]
-name = "find-msvc-tools"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
-
-[[package]]
-name = "form_urlencoded"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
-dependencies = [
- "percent-encoding",
-]
-
-[[package]]
-name = "fs2"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9564fc758e15025b46aa6643b1b77d047d1a56a1aea6e01002ac0c7026876213"
-dependencies = [
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "fs_extra"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
-
-[[package]]
-name = "futures-channel"
-version = "0.3.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
-dependencies = [
- "futures-core",
-]
-
-[[package]]
-name = "futures-core"
-version = "0.3.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
-
-[[package]]
-name = "futures-io"
-version = "0.3.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
-
-[[package]]
-name = "futures-macro"
-version = "0.3.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
-]
-
-[[package]]
-name = "futures-task"
-version = "0.3.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
-
-[[package]]
-name = "futures-util"
-version = "0.3.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
-dependencies = [
- "futures-core",
- "futures-macro",
- "futures-task",
- "pin-project-lite",
- "slab",
-]
-
-[[package]]
-name = "generic-array"
-version = "0.14.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
-dependencies = [
- "typenum",
- "version_check",
- "zeroize",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
-dependencies = [
- "cfg-if",
- "js-sys",
- "libc",
- "wasi",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
-dependencies = [
- "cfg-if",
- "libc",
- "r-efi 5.3.0",
- "wasip2",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
-dependencies = [
- "cfg-if",
- "js-sys",
- "libc",
- "r-efi 6.0.0",
- "rand_core 0.10.1",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "group"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
-dependencies = [
- "ff",
- "rand_core 0.6.4",
- "subtle",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
-
-[[package]]
-name = "hickory-net"
-version = "0.26.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2295ed2f9c31e471e1428a8f88a3f0e1f4b27c15049592138d1eebe9c35b183"
-dependencies = [
- "async-trait",
- "cfg-if",
- "data-encoding",
- "futures-channel",
- "futures-io",
- "futures-util",
- "hickory-proto",
- "idna",
- "ipnet",
- "jni",
- "rand 0.10.2",
- "thiserror",
- "tinyvec",
- "tokio",
- "tracing",
- "url",
-]
-
-[[package]]
-name = "hickory-proto"
-version = "0.26.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bab31817bfb44672a252e97fe81cd0c18d1b2cf892108922f6818820df8c643"
-dependencies = [
- "data-encoding",
- "idna",
- "ipnet",
- "jni",
- "once_cell",
- "prefix-trie",
- "rand 0.10.2",
- "ring",
- "thiserror",
- "tinyvec",
- "tracing",
- "url",
-]
-
-[[package]]
-name = "hickory-resolver"
-version = "0.26.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0d58d28879ceecde6607729660c2667a081ccdc082e082675042793960f178c"
-dependencies = [
- "cfg-if",
- "futures-util",
- "hickory-net",
- "hickory-proto",
- "ipconfig",
- "ipnet",
- "jni",
- "moka",
- "ndk-context",
- "once_cell",
- "parking_lot",
- "rand 0.10.2",
- "resolv-conf",
- "smallvec",
- "system-configuration",
- "thiserror",
- "tokio",
- "tracing",
-]
-
-[[package]]
-name = "hmac"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
-dependencies = [
- "digest 0.10.7",
-]
-
-[[package]]
-name = "hmac"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
-dependencies = [
- "digest 0.11.3",
-]
-
-[[package]]
-name = "http"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
-dependencies = [
- "bytes",
- "itoa",
-]
-
-[[package]]
-name = "http-body"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
-dependencies = [
- "bytes",
- "http",
-]
-
-[[package]]
-name = "http-body-util"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
-dependencies = [
- "bytes",
- "futures-core",
- "http",
- "http-body",
- "pin-project-lite",
-]
-
-[[package]]
-name = "httparse"
-version = "1.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
-
-[[package]]
-name = "humantime"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15cdd26707701c53297e2fa6afb323d55fbc1d0810c3aec078ae3ef0424c3c15"
-
-[[package]]
-name = "humantime-serde"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57a3db5ea5923d99402c94e9feb261dc5ee9b4efa158b0315f788cf549cc200c"
-dependencies = [
- "humantime",
- "serde",
-]
-
-[[package]]
-name = "hybrid-array"
-version = "0.4.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c"
-dependencies = [
- "typenum",
-]
-
-[[package]]
-name = "hyper"
-version = "1.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
-dependencies = [
- "atomic-waker",
- "bytes",
- "futures-channel",
- "futures-core",
- "http",
- "http-body",
- "httparse",
- "itoa",
- "pin-project-lite",
- "smallvec",
- "tokio",
- "want",
-]
-
-[[package]]
-name = "hyper-rustls"
-version = "0.27.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
-dependencies = [
- "http",
- "hyper",
- "hyper-util",
- "rustls",
- "rustls-native-certs",
- "tokio",
- "tokio-rustls",
- "tower-service",
- "webpki-roots",
-]
-
-[[package]]
-name = "hyper-util"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
-dependencies = [
- "base64",
- "bytes",
- "futures-channel",
- "futures-util",
- "http",
- "http-body",
- "hyper",
- "ipnet",
- "libc",
- "percent-encoding",
- "pin-project-lite",
- "socket2",
- "tokio",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "icu_collections"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
-dependencies = [
- "displaydoc",
- "potential_utf",
- "utf8_iter",
- "yoke",
- "zerofrom",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locale_core"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
-dependencies = [
- "displaydoc",
- "litemap",
- "tinystr",
- "writeable",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
-dependencies = [
- "icu_collections",
- "icu_normalizer_data",
- "icu_properties",
- "icu_provider",
- "smallvec",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer_data"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
-
-[[package]]
-name = "icu_properties"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
-dependencies = [
- "icu_collections",
- "icu_locale_core",
- "icu_properties_data",
- "icu_provider",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "icu_properties_data"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
-
-[[package]]
-name = "icu_provider"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
-dependencies = [
- "displaydoc",
- "icu_locale_core",
- "writeable",
- "yoke",
- "zerofrom",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "idna"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
-dependencies = [
- "idna_adapter",
- "smallvec",
- "utf8_iter",
-]
-
-[[package]]
-name = "idna_adapter"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
-dependencies = [
- "icu_normalizer",
- "icu_properties",
-]
-
-[[package]]
-name = "indexmap"
-version = "2.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
-dependencies = [
- "equivalent",
- "hashbrown",
- "serde",
- "serde_core",
-]
-
-[[package]]
-name = "ipconfig"
-version = "0.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d40460c0ce33d6ce4b0630ad68ff63d6661961c48b6dba35e5a4d81cfb48222"
-dependencies = [
- "socket2",
- "widestring",
- "windows-registry",
- "windows-result",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "ipnet"
-version = "2.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "itoa"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
-
-[[package]]
-name = "jni"
-version = "0.22.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
-dependencies = [
- "cfg-if",
- "combine",
- "jni-macros",
- "jni-sys",
- "log",
- "simd_cesu8",
- "thiserror",
- "walkdir",
- "windows-link",
-]
-
-[[package]]
-name = "jni-macros"
-version = "0.22.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
-dependencies = [
- "proc-macro2",
- "quote",
- "rustc_version",
- "simd_cesu8",
- "syn 2.0.118",
-]
-
-[[package]]
-name = "jni-sys"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
-dependencies = [
- "jni-sys-macros",
-]
-
-[[package]]
-name = "jni-sys-macros"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
-dependencies = [
- "quote",
- "syn 2.0.118",
-]
-
-[[package]]
-name = "jobserver"
-version = "0.1.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
-dependencies = [
- "getrandom 0.4.3",
- "libc",
-]
-
-[[package]]
-name = "js-sys"
-version = "0.3.103"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
-dependencies = [
- "cfg-if",
- "futures-util",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "jsonwebtoken"
-version = "10.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eba32bfb4ffdeaca3e34431072faf01745c9b26d25504aa7a6cf5684334fc4fc"
-dependencies = [
- "aws-lc-rs",
- "base64",
- "getrandom 0.2.17",
- "js-sys",
- "serde",
- "serde_json",
- "signature",
- "zeroize",
-]
-
-[[package]]
-name = "libc"
-version = "0.2.186"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
-
-[[package]]
-name = "libfuzzer-sys"
-version = "0.4.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9fd2f41a1cba099f79a0b6b6c35656cf7c03351a7bae8ff0f28f25270f929d2"
-dependencies = [
- "arbitrary",
- "cc",
-]
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
-
-[[package]]
-name = "litemap"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
-
-[[package]]
-name = "lock_api"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
-dependencies = [
- "scopeguard",
-]
-
-[[package]]
-name = "log"
-version = "0.4.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
-
-[[package]]
-name = "lru-slab"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
-
-[[package]]
-name = "memchr"
-version = "2.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
-
-[[package]]
-name = "mio"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
-dependencies = [
- "libc",
- "wasi",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "moka"
-version = "0.12.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "957228ad12042ee839f93c8f257b62b4c0ab5eaae1d4fa60de53b27c9d7c5046"
-dependencies = [
- "crossbeam-channel",
- "crossbeam-epoch",
- "crossbeam-utils",
- "equivalent",
- "parking_lot",
- "portable-atomic",
- "smallvec",
- "tagptr",
- "uuid",
-]
-
-[[package]]
-name = "ndk-context"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
-
-[[package]]
-name = "num-conv"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
-
-[[package]]
-name = "num-traits"
-version = "0.2.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.21.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
-dependencies = [
- "critical-section",
- "portable-atomic",
-]
-
-[[package]]
-name = "openssl-probe"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
-
-[[package]]
-name = "p256"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
-dependencies = [
- "ecdsa",
- "elliptic-curve",
- "primeorder",
- "sha2 0.10.9",
-]
-
-[[package]]
-name = "parking_lot"
-version = "0.12.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
-dependencies = [
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.9.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
-dependencies = [
- "cfg-if",
- "libc",
- "redox_syscall",
- "smallvec",
- "windows-link",
-]
-
-[[package]]
-name = "pem-rfc7468"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
-dependencies = [
- "base64ct",
-]
-
-[[package]]
-name = "percent-encoding"
-version = "2.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
-
-[[package]]
-name = "pin-project-lite"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
-
-[[package]]
-name = "pkcs1"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
-dependencies = [
- "der",
- "pkcs8",
- "spki",
-]
-
-[[package]]
-name = "pkcs8"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
-dependencies = [
- "der",
- "spki",
-]
-
-[[package]]
-name = "portable-atomic"
-version = "1.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
-
-[[package]]
-name = "potential_utf"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
-dependencies = [
- "zerovec",
-]
-
-[[package]]
-name = "powerfmt"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
-
-[[package]]
-name = "ppv-lite86"
-version = "0.2.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
-dependencies = [
- "zerocopy",
-]
-
-[[package]]
-name = "prefix-trie"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cf6e3177f0684016a5c209b00882e15f8bdd3f3bb48f0491df10cd102d0c6e7"
-dependencies = [
- "either",
- "ipnet",
- "num-traits",
-]
-
-[[package]]
-name = "primeorder"
-version = "0.13.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
-dependencies = [
- "elliptic-curve",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.106"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quinn"
-version = "0.11.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
-dependencies = [
- "bytes",
- "cfg_aliases",
- "pin-project-lite",
- "quinn-proto",
- "quinn-udp",
- "rustc-hash",
- "rustls",
- "socket2",
- "thiserror",
- "tokio",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-proto"
-version = "0.11.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
-dependencies = [
- "bytes",
- "getrandom 0.4.3",
- "lru-slab",
- "rand 0.10.2",
- "rand_pcg",
- "ring",
- "rustc-hash",
- "rustls",
- "rustls-pki-types",
- "slab",
- "thiserror",
- "tinyvec",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-udp"
-version = "0.5.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694"
-dependencies = [
- "cfg_aliases",
- "libc",
- "once_cell",
- "socket2",
- "tracing",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.46"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "r-efi"
-version = "5.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
-
-[[package]]
-name = "r-efi"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
-
-[[package]]
-name = "rand"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
-dependencies = [
- "rand_chacha",
- "rand_core 0.9.5",
-]
-
-[[package]]
-name = "rand"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
-dependencies = [
- "chacha20",
- "getrandom 0.4.3",
- "rand_core 0.10.1",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.9.5",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
-dependencies = [
- "getrandom 0.2.17",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
-dependencies = [
- "getrandom 0.3.4",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
-
-[[package]]
-name = "rand_pcg"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
-dependencies = [
- "rand_core 0.10.1",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.5.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
-name = "ref-cast"
-version = "1.0.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d"
-dependencies = [
- "ref-cast-impl",
-]
-
-[[package]]
-name = "ref-cast-impl"
-version = "1.0.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.0",
-]
-
-[[package]]
-name = "registry-notary-core"
-version = "0.16.3"
-dependencies = [
- "base64",
- "humantime-serde",
- "ipnet",
- "registry-platform-authcommon",
- "registry-platform-config",
- "registry-platform-crypto",
- "registry-platform-httputil",
- "registry-platform-oid4vci",
- "registry-platform-ops",
- "registry-platform-sdjwt",
- "schemars",
- "serde",
- "serde_json",
- "sha2 0.11.0",
- "thiserror",
- "time",
- "ulid",
- "url",
- "utoipa",
-]
-
-[[package]]
-name = "registry-notary-fuzz"
-version = "0.0.0"
-dependencies = [
- "libfuzzer-sys",
- "registry-notary-core",
- "serde_json",
-]
-
-[[package]]
-name = "registry-platform-authcommon"
-version = "0.16.3"
-dependencies = [
- "serde",
- "sha2 0.11.0",
- "subtle",
- "thiserror",
- "zeroize",
-]
-
-[[package]]
-name = "registry-platform-cache"
-version = "0.16.3"
-dependencies = [
- "async-trait",
- "sha2 0.11.0",
- "thiserror",
- "time",
-]
-
-[[package]]
-name = "registry-platform-canonical-json"
-version = "0.16.3"
-dependencies = [
- "ryu-js",
- "serde",
- "serde_json",
- "thiserror",
-]
-
-[[package]]
-name = "registry-platform-config"
-version = "0.16.3"
-dependencies = [
- "base64",
- "registry-platform-crypto",
- "rustix",
- "serde",
- "serde_json",
- "sha2 0.11.0",
- "thiserror",
- "time",
-]
-
-[[package]]
-name = "registry-platform-crypto"
-version = "0.16.3"
-dependencies = [
- "async-trait",
- "aws-lc-rs",
- "base64",
- "ed25519-dalek",
- "hmac 0.13.0",
- "p256",
- "pkcs1",
- "registry-platform-canonical-json",
- "serde",
- "serde_json",
- "sha2 0.11.0",
- "subtle",
- "thiserror",
- "url",
- "zeroize",
-]
-
-[[package]]
-name = "registry-platform-httputil"
-version = "0.16.3"
-dependencies = [
- "base64",
- "bytes",
- "hickory-resolver",
- "http",
- "ipnet",
- "registry-platform-canonical-json",
- "registry-platform-crypto",
- "reqwest",
- "rustls-native-certs",
- "serde",
- "serde_json",
- "thiserror",
- "time",
- "tokio",
- "url",
- "uuid",
- "zeroize",
-]
-
-[[package]]
-name = "registry-platform-oid4vci"
-version = "0.16.3"
-dependencies = [
- "base64",
- "registry-platform-crypto",
- "registry-platform-replay",
- "serde",
- "serde_json",
- "thiserror",
- "time",
-]
-
-[[package]]
-name = "registry-platform-ops"
-version = "0.16.3"
-dependencies = [
- "fs2",
- "registry-platform-config",
- "registry-platform-crypto",
- "rustix",
- "serde",
- "serde_json",
- "sha2 0.11.0",
- "time",
- "ulid",
-]
-
-[[package]]
-name = "registry-platform-replay"
-version = "0.16.3"
-dependencies = [
- "async-trait",
- "getrandom 0.4.3",
- "registry-platform-cache",
- "thiserror",
- "time",
-]
-
-[[package]]
-name = "registry-platform-sdjwt"
-version = "0.16.3"
-dependencies = [
- "base64",
- "getrandom 0.4.3",
- "jsonwebtoken",
- "registry-platform-crypto",
- "serde",
- "serde_json",
- "sha2 0.11.0",
- "thiserror",
- "ulid",
-]
-
-[[package]]
-name = "reqwest"
-version = "0.12.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
-dependencies = [
- "base64",
- "bytes",
- "futures-core",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-rustls",
- "hyper-util",
- "js-sys",
- "log",
- "percent-encoding",
- "pin-project-lite",
- "quinn",
- "rustls",
- "rustls-native-certs",
- "rustls-pki-types",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper",
- "tokio",
- "tokio-rustls",
- "tower",
- "tower-http",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
- "webpki-roots",
-]
-
-[[package]]
-name = "resolv-conf"
-version = "0.7.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e061d1b48cb8d38042de4ae0a7a6401009d6143dc80d2e2d6f31f0bdd6470c7"
-
-[[package]]
-name = "rfc6979"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
-dependencies = [
- "hmac 0.12.1",
- "subtle",
-]
-
-[[package]]
-name = "ring"
-version = "0.17.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
-dependencies = [
- "cc",
- "cfg-if",
- "getrandom 0.2.17",
- "libc",
- "untrusted 0.9.0",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "rustc-hash"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
-
-[[package]]
-name = "rustc_version"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
-dependencies = [
- "semver",
-]
-
-[[package]]
-name = "rustix"
-version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
-dependencies = [
- "bitflags",
- "errno",
- "libc",
- "linux-raw-sys",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "rustls"
-version = "0.23.41"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
-dependencies = [
- "once_cell",
- "ring",
- "rustls-pki-types",
- "rustls-webpki",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-native-certs"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
-dependencies = [
- "openssl-probe",
- "rustls-pki-types",
- "schannel",
- "security-framework",
-]
-
-[[package]]
-name = "rustls-pki-types"
-version = "1.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046"
-dependencies = [
- "web-time",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-webpki"
-version = "0.103.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
-dependencies = [
- "ring",
- "rustls-pki-types",
- "untrusted 0.9.0",
-]
-
-[[package]]
-name = "rustversion"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
-
-[[package]]
-name = "ryu"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
-
-[[package]]
-name = "ryu-js"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04d056b875a9d2e6cb9a61d127afee9ac5999b9f87bcb32079d1318e505be714"
-
-[[package]]
-name = "same-file"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "schannel"
-version = "0.1.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
-dependencies = [
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "schemars"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
-dependencies = [
- "dyn-clone",
- "ref-cast",
- "schemars_derive",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "schemars_derive"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d115b50f4aaeea07e79c1912f645c7513d81715d0420f8bc77a18c6260b307f"
-dependencies = [
- "proc-macro2",
- "quote",
- "serde_derive_internals",
- "syn 2.0.118",
-]
-
-[[package]]
-name = "scopeguard"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
-
-[[package]]
-name = "sec1"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
-dependencies = [
- "base16ct",
- "der",
- "generic-array",
- "pkcs8",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "security-framework"
-version = "3.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
-dependencies = [
- "bitflags",
- "core-foundation 0.10.1",
- "core-foundation-sys",
- "libc",
- "security-framework-sys",
-]
-
-[[package]]
-name = "security-framework-sys"
-version = "2.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
-name = "semver"
-version = "1.0.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
-
-[[package]]
-name = "serde"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
-dependencies = [
- "serde_core",
- "serde_derive",
-]
-
-[[package]]
-name = "serde_core"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
-]
-
-[[package]]
-name = "serde_derive_internals"
-version = "0.29.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
-]
-
-[[package]]
-name = "serde_json"
-version = "1.0.150"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
-dependencies = [
- "itoa",
- "memchr",
- "serde",
- "serde_core",
- "zmij",
-]
-
-[[package]]
-name = "serde_urlencoded"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
-dependencies = [
- "form_urlencoded",
- "itoa",
- "ryu",
- "serde",
-]
-
-[[package]]
-name = "sha2"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "digest 0.10.7",
-]
-
-[[package]]
-name = "sha2"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "digest 0.11.3",
-]
-
-[[package]]
-name = "shlex"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
-
-[[package]]
-name = "signal-hook-registry"
-version = "1.4.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
-dependencies = [
- "errno",
- "libc",
-]
-
-[[package]]
-name = "signature"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
-dependencies = [
- "digest 0.10.7",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "simd_cesu8"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94f90157bb87cddf702797c5dadfa0be7d266cdf49e22da2fcaa32eff75b2c33"
-dependencies = [
- "rustc_version",
- "simdutf8",
-]
-
-[[package]]
-name = "simdutf8"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
-
-[[package]]
-name = "slab"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
-
-[[package]]
-name = "smallvec"
-version = "1.15.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
-
-[[package]]
-name = "socket2"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
-dependencies = [
- "libc",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "spki"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
-dependencies = [
- "base64ct",
- "der",
-]
-
-[[package]]
-name = "stable_deref_trait"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
-
-[[package]]
-name = "subtle"
-version = "2.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
-
-[[package]]
-name = "syn"
-version = "2.0.118"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2fac314a64dc9a36e61a9eb4261a5e9bbfbc922b27e518af97bc32b926cf967"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "sync_wrapper"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
-dependencies = [
- "futures-core",
-]
-
-[[package]]
-name = "synstructure"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
-]
-
-[[package]]
-name = "system-configuration"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
-dependencies = [
- "bitflags",
- "core-foundation 0.9.4",
- "system-configuration-sys",
-]
-
-[[package]]
-name = "system-configuration-sys"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
-name = "tagptr"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
-
-[[package]]
-name = "thiserror"
-version = "2.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
-dependencies = [
- "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "2.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
-]
-
-[[package]]
-name = "time"
-version = "0.3.53"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18dfaaeddcb932337b5e7866ee7d0ce9b76d2fd092997146f187ec09b4558a50"
-dependencies = [
- "deranged",
- "num-conv",
- "powerfmt",
- "serde_core",
- "time-core",
- "time-macros",
-]
-
-[[package]]
-name = "time-core"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
-
-[[package]]
-name = "time-macros"
-version = "0.2.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c431b87111666e491a90baa837f914fb45cd5dc3c268591b0220ff5057f2085f"
-dependencies = [
- "num-conv",
- "time-core",
-]
-
-[[package]]
-name = "tinystr"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
-dependencies = [
- "displaydoc",
- "zerovec",
-]
-
-[[package]]
-name = "tinyvec"
-version = "1.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
-[[package]]
-name = "tokio"
-version = "1.52.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
-dependencies = [
- "bytes",
- "libc",
- "mio",
- "pin-project-lite",
- "signal-hook-registry",
- "socket2",
- "tokio-macros",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "tokio-macros"
-version = "2.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
-]
-
-[[package]]
-name = "tokio-rustls"
-version = "0.26.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
-dependencies = [
- "rustls",
- "tokio",
-]
-
-[[package]]
-name = "tower"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
-dependencies = [
- "futures-core",
- "futures-util",
- "pin-project-lite",
- "sync_wrapper",
- "tokio",
- "tower-layer",
- "tower-service",
-]
-
-[[package]]
-name = "tower-http"
-version = "0.6.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
-dependencies = [
- "bitflags",
- "bytes",
- "futures-util",
- "http",
- "http-body",
- "pin-project-lite",
- "tower",
- "tower-layer",
- "tower-service",
- "url",
-]
-
-[[package]]
-name = "tower-layer"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
-
-[[package]]
-name = "tower-service"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
-
-[[package]]
-name = "tracing"
-version = "0.1.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
-dependencies = [
- "pin-project-lite",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-core"
-version = "0.1.36"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
-dependencies = [
- "once_cell",
-]
-
-[[package]]
-name = "try-lock"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
-
-[[package]]
-name = "typenum"
-version = "1.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
-
-[[package]]
-name = "ulid"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "470dbf6591da1b39d43c14523b2b469c86879a53e8b758c8e090a470fe7b1fbe"
-dependencies = [
- "rand 0.9.4",
- "web-time",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
-
-[[package]]
-name = "untrusted"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
-
-[[package]]
-name = "untrusted"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
-
-[[package]]
-name = "url"
-version = "2.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
-dependencies = [
- "form_urlencoded",
- "idna",
- "percent-encoding",
- "serde",
-]
-
-[[package]]
-name = "utf8_iter"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
-
-[[package]]
-name = "utoipa"
-version = "5.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bde15df68e80b16c7d16b9616e80770ad158988daa56a27dccd1e55558b0160"
-dependencies = [
- "indexmap",
- "serde",
- "serde_json",
- "utoipa-gen",
-]
-
-[[package]]
-name = "utoipa-gen"
-version = "5.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba0b99ee52df3028635d93840c797102da61f8a7bb3cf751032455895b52ef8"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
-]
-
-[[package]]
-name = "uuid"
-version = "1.23.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf80a72845275afea99e7f2b434723d3bc7e38470fcd1c7ed39a599c73319a53"
-dependencies = [
- "getrandom 0.4.3",
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "version_check"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
-
-[[package]]
-name = "walkdir"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
-dependencies = [
- "same-file",
- "winapi-util",
-]
-
-[[package]]
-name = "want"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
-dependencies = [
- "try-lock",
-]
-
-[[package]]
-name = "wasi"
-version = "0.11.1+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
-
-[[package]]
-name = "wasip2"
-version = "1.0.4+wasi-0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
-dependencies = [
- "wit-bindgen",
-]
-
-[[package]]
-name = "wasm-bindgen"
-version = "0.2.126"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
-dependencies = [
- "cfg-if",
- "once_cell",
- "rustversion",
- "wasm-bindgen-macro",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-futures"
-version = "0.4.76"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "wasm-bindgen-macro"
-version = "0.2.126"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
-dependencies = [
- "quote",
- "wasm-bindgen-macro-support",
-]
-
-[[package]]
-name = "wasm-bindgen-macro-support"
-version = "0.2.126"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
-dependencies = [
- "bumpalo",
- "proc-macro2",
- "quote",
- "syn 2.0.118",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-shared"
-version = "0.2.126"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "web-sys"
-version = "0.3.103"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "web-time"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "webpki-roots"
-version = "1.0.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
-dependencies = [
- "rustls-pki-types",
-]
-
-[[package]]
-name = "widestring"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
-dependencies = [
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
-[[package]]
-name = "windows-link"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
-
-[[package]]
-name = "windows-registry"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
-dependencies = [
- "windows-link",
- "windows-result",
- "windows-strings",
-]
-
-[[package]]
-name = "windows-result"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-strings"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
-dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.61.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
-dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_gnullvm",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
-
-[[package]]
-name = "wit-bindgen"
-version = "0.57.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
-
-[[package]]
-name = "writeable"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
-
-[[package]]
-name = "yoke"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
-dependencies = [
- "stable_deref_trait",
- "yoke-derive",
- "zerofrom",
-]
-
-[[package]]
-name = "yoke-derive"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
- "synstructure",
-]
-
-[[package]]
-name = "zerocopy"
-version = "0.8.54"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7cbbc0a705a0fd05cc3676525980d2bf5a9bc4adac6d6475209a7887cf59d19"
-dependencies = [
- "zerocopy-derive",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.8.54"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2e817b7b52d0c7358d3246da9d69935ebb18116b2b102b4230dac079b4862f5"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
-]
-
-[[package]]
-name = "zerofrom"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
-dependencies = [
- "zerofrom-derive",
-]
-
-[[package]]
-name = "zerofrom-derive"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
- "synstructure",
-]
-
-[[package]]
-name = "zeroize"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
-dependencies = [
- "zeroize_derive",
-]
-
-[[package]]
-name = "zeroize_derive"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
-]
-
-[[package]]
-name = "zerotrie"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
-dependencies = [
- "displaydoc",
- "yoke",
- "zerofrom",
-]
-
-[[package]]
-name = "zerovec"
-version = "0.11.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
-dependencies = [
- "yoke",
- "zerofrom",
- "zerovec-derive",
-]
-
-[[package]]
-name = "zerovec-derive"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
-]
-
-[[package]]
-name = "zmij"
-version = "1.0.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/products/notary/fuzz/Cargo.toml b/products/notary/fuzz/Cargo.toml
deleted file mode 100644
index e27f38488..000000000
--- a/products/notary/fuzz/Cargo.toml
+++ /dev/null
@@ -1,24 +0,0 @@
-[package]
-name = "registry-notary-fuzz"
-version = "0.0.0"
-publish = false
-edition = "2021"
-
-[package.metadata]
-cargo-fuzz = true
-
-[workspace]
-
-[dependencies]
-libfuzzer-sys = "0.4"
-serde_json = "1"
-
-[dependencies.registry-notary-core]
-path = "../../../crates/registry-notary-core"
-
-[[bin]]
-name = "core_request_bodies"
-path = "fuzz_targets/core_request_bodies.rs"
-test = false
-doc = false
-bench = false
diff --git a/products/notary/fuzz/README.md b/products/notary/fuzz/README.md
deleted file mode 100644
index 9ab667043..000000000
--- a/products/notary/fuzz/README.md
+++ /dev/null
@@ -1,58 +0,0 @@
-# Notary fuzz targets
-
-cargo-fuzz harnesses for untrusted-input parse boundaries in Notary crates.
-This crate declares its own empty `[workspace]` table and is also listed in
-the root `Cargo.toml` `exclude` list, so a broken or slow fuzz build never
-blocks `cargo check --workspace`.
-
-## Targets
-
-- `core_request_bodies` — evaluation, credential-issue, and render request
-  body parsing (`registry-notary-core`).
-Each target fuzzes the crate's real exported entry point directly, never a
-locally re-declared mirror struct that could drift from the product type.
-
-## Running locally
-
-```bash
-cargo +nightly fuzz run --fuzz-dir fuzz <target> -- -max_total_time=60 -rss_limit_mb=1024
-```
-
-Requires the nightly toolchain and `cargo-fuzz` (pinned to 0.13.2 in CI;
-`cargo install cargo-fuzz --version 0.13.2` matches). `fuzz/Cargo.lock` pins
-this crate's dependencies independently of the main workspace lockfile.
-
-## Corpus
-
-`fuzz/corpus/<target>/` holds hand-written seeds (valid and near-valid inputs),
-committed to git under descriptive filenames. The `.gitignore` here also
-excludes libFuzzer's generated 40-hex-character corpus entries; if a
-generated input is worth keeping permanently, copy it into the seed corpus
-under a descriptive name instead of committing the raw generated filename.
-
-## CI wiring
-
-`.github/workflows/nightly-security.yml` runs a smoke pass for every committed
-target when the nightly security workflow runs. The job uses the nightly
-toolchain, `cargo-fuzz` 0.13.2, `-max_total_time=60`, `-rss_limit_mb=1024`, and
-uploads `fuzz/artifacts/` on failure.
-
-Issue #26 tracks the fuller crash/corpus regression pattern (persisted corpus
-plus previous-crash replay) for the manifest fuzz work and shared CI shape. Once
-that pattern lands, the intended shape is:
-
-- **Per-PR smoke** (fast, required): for each target,
-  `cargo +nightly fuzz run --fuzz-dir fuzz <target> -- -max_total_time=60 -rss_limit_mb=1024`
-  against the committed seed corpus only, no persisted state. Catches build
-  breakage and obvious crashes on every PR that touches a fuzzed crate.
-- **Nightly long run** (scheduled, best-effort): each target run for longer
-  (10-30 minutes) against a corpus directory persisted across runs, so
-  coverage accumulates instead of resetting every run. On crash, upload the
-  crash artifact and the minimized failing input as a workflow artifact and
-  fail the run loudly. Do not auto-file public issues from a fuzz crash; a
-  crash in these boundaries may be a security finding and should route
-  through `SECURITY.md` like any other suspected vulnerability.
-
-The nightly smoke is not a replacement for the persisted-corpus regression
-track; it proves the committed targets and corpora keep building and do not
-crash immediately.
diff --git a/products/notary/fuzz/corpus/core_request_bodies/batch_evaluate.json b/products/notary/fuzz/corpus/core_request_bodies/batch_evaluate.json
deleted file mode 100644
index 948ba1633..000000000
--- a/products/notary/fuzz/corpus/core_request_bodies/batch_evaluate.json
+++ /dev/null
@@ -1 +0,0 @@
-{"items":[{"target":{"type":"person","identifiers":[{"scheme":"national_id","value":"NID-1001","country":"RW"}]},"requester":{"type":"case_worker","id":"worker-42"},"relationship":{"type":"self"}},{"target":{"type":"land_parcel","identifiers":[{"scheme":"parcel_id","value":"LP-42"}]},"purpose":"https://purpose.example/land"}],"claims":["eligibility",{"id":"household-member","version":"2026-05"}],"disclosure":"predicate","format":"application/json","purpose":"https://purpose.example/batch"}
diff --git a/products/notary/fuzz/corpus/core_request_bodies/credential_issue.json b/products/notary/fuzz/corpus/core_request_bodies/credential_issue.json
deleted file mode 100644
index ce53a551e..000000000
--- a/products/notary/fuzz/corpus/core_request_bodies/credential_issue.json
+++ /dev/null
@@ -1 +0,0 @@
-{"evaluation_id":"eval-1","credential_profile":"civil_status_sd_jwt","format":"application/dc+sd-jwt","claims":["person-is-alive"],"disclosure":"predicate","holder":{"binding":"did","id":"did:jwk:holder","proof":"eyJhbGciOiJFZERTQSIsInR5cCI6ImtiK2p3dCJ9.payload.signature"}}
diff --git a/products/notary/fuzz/corpus/core_request_bodies/evaluate.json b/products/notary/fuzz/corpus/core_request_bodies/evaluate.json
deleted file mode 100644
index 5eb4e7308..000000000
--- a/products/notary/fuzz/corpus/core_request_bodies/evaluate.json
+++ /dev/null
@@ -1 +0,0 @@
-{"requester":{"type":"person","identifiers":[{"scheme":"national_id","value":"NID-9001","country":"RW"}]},"target":{"type":"person","identifiers":[{"scheme":"national_id","value":"NID-1001"}],"attributes":{"given_name":"Amina","family_name":"Kamanzi","date_of_birth":"1990-01-15"},"assurance":{"method":"oidc","level_scheme":"example-loa","level":"substantial"}},"relationship":{"type":"self"},"on_behalf_of":{"actor":{"type":"service_account","id_hash":"hmac-sha256:0123456789abcdef"},"delegation_ref":"urn:delegation:42"},"claims":["person-is-alive",{"id":"household-member","version":"2026-05"}],"disclosure":"predicate","format":"application/json","purpose":"https://purpose.example/social-protection"}
diff --git a/products/notary/fuzz/corpus/core_request_bodies/holder.json b/products/notary/fuzz/corpus/core_request_bodies/holder.json
deleted file mode 100644
index 85cadd7e7..000000000
--- a/products/notary/fuzz/corpus/core_request_bodies/holder.json
+++ /dev/null
@@ -1 +0,0 @@
-{"binding":"did","id":"did:jwk:holder","proof":"eyJhbGciOiJFZERTQSIsInR5cCI6ImtiK2p3dCJ9.payload.signature"}
diff --git a/products/notary/fuzz/corpus/core_request_bodies/render.json b/products/notary/fuzz/corpus/core_request_bodies/render.json
deleted file mode 100644
index 4cb7e216b..000000000
--- a/products/notary/fuzz/corpus/core_request_bodies/render.json
+++ /dev/null
@@ -1 +0,0 @@
-{"evaluation_id":"eval-1","format":"application/json","disclosure":"predicate","claims":["person-is-alive"],"purpose":"https://purpose.example/render"}
diff --git a/products/notary/fuzz/corpus/core_request_bodies/render_evaluation.json b/products/notary/fuzz/corpus/core_request_bodies/render_evaluation.json
deleted file mode 100644
index 9842f097b..000000000
--- a/products/notary/fuzz/corpus/core_request_bodies/render_evaluation.json
+++ /dev/null
@@ -1 +0,0 @@
-{"format":"application/json","disclosure":"predicate","claims":["person-is-alive"],"purpose":"https://purpose.example/render"}
diff --git a/products/notary/fuzz/fuzz_targets/core_request_bodies.rs b/products/notary/fuzz/fuzz_targets/core_request_bodies.rs
deleted file mode 100644
index 1d490506f..000000000
--- a/products/notary/fuzz/fuzz_targets/core_request_bodies.rs
+++ /dev/null
@@ -1,16 +0,0 @@
-#![no_main]
-
-use libfuzzer_sys::fuzz_target;
-use registry_notary_core::{
-    BatchEvaluateRequest, CredentialIssueRequest, EvaluateRequest, HolderRequest,
-    RenderEvaluationRequest, RenderRequest,
-};
-
-fuzz_target!(|data: &[u8]| {
-    let _ = serde_json::from_slice::<EvaluateRequest>(data);
-    let _ = serde_json::from_slice::<BatchEvaluateRequest>(data);
-    let _ = serde_json::from_slice::<RenderRequest>(data);
-    let _ = serde_json::from_slice::<RenderEvaluationRequest>(data);
-    let _ = serde_json::from_slice::<CredentialIssueRequest>(data);
-    let _ = serde_json::from_slice::<HolderRequest>(data);
-});
diff --git a/products/notary/justfile b/products/notary/justfile
deleted file mode 100644
index 3d2b86272..000000000
--- a/products/notary/justfile
+++ /dev/null
@@ -1,97 +0,0 @@
-# registry-notary task runner. Requires `just` (https://github.com/casey/just).
-
-export CARGO_NET_GIT_FETCH_WITH_CLI := "true"
-
-# Install the Rust toolchain via mise and fetch all dependencies.
-setup:
-    mise install
-    cargo fetch
-
-# Build the release binary.
-build:
-    cargo build --release --workspace --all-features
-
-# Format all source files in place.
-fmt:
-    cargo fmt --all
-
-# Check formatting without modifying files.
-fmt-check:
-    cargo fmt --all -- --check
-
-# Run clippy on all targets and features; treat warnings as errors.
-lint:
-    cargo clippy --workspace --all-targets --all-features -- -D warnings
-
-# Run clippy on the default feature shape.
-lint-default:
-    cargo clippy --workspace --all-targets -- -D warnings
-
-# Run all workspace tests with all features enabled.
-test:
-    cargo test --workspace --all-features
-
-# Run the default feature shape.
-test-default:
-    cargo test --workspace
-
-# Run cargo-deny through the repo-pinned wrapper.
-deny:
-    ./scripts/cargo-deny-check.sh
-
-# Check advisories only.
-audit:
-    ./scripts/cargo-deny-check.sh advisories
-
-# Generate the OpenAPI document to stdout.
-openapi-generate:
-    cargo run -q -p registry-notary -- openapi
-
-# Reproduce the committed Draft 2020-12 runtime configuration schema.
-config-schema-generate:
-    cargo run --quiet --locked -p registry-notary -- schema > ../../schemas/registry-notary.config.schema.json
-
-# Fail when the product-owned runtime schema has drifted from its config graph.
-config-schema-check:
-    tmp_schema="$(mktemp)"; trap 'rm -f "$tmp_schema"' EXIT; cargo run --quiet --locked -p registry-notary -- schema > "$tmp_schema"; cmp -s ../../schemas/registry-notary.config.schema.json "$tmp_schema" || { diff -u ../../schemas/registry-notary.config.schema.json "$tmp_schema"; exit 1; }
-
-# Validate the committed OpenAPI baseline.
-openapi-check:
-    python3 scripts/check_security_assurance.py openapi-baseline
-
-# Validate the committed OpenAPI artifact and, when a base ref is supplied,
-# fail on breaking API diffs while allowing additive changes.
-openapi-contract base_ref="":
-    scripts/check-openapi-contract.sh "{{base_ref}}"
-
-# Validate exposure manifest, route inventory, and Dockerfile secret-copy guardrails.
-exposure-check:
-    python3 scripts/check_security_assurance.py manifest
-
-# Validate Dockerfiles for secret-copy hazards and the non-root runtime contract.
-container-security:
-    python3 scripts/check_security_assurance.py dockerfile-secrets container-runtime
-
-# Run security assurance checks that do not require external services.
-security:
-    ./scripts/check-security.sh
-
-# Run the monorepo CI preflight for Registry Notary crates.
-ci-preflight: config-schema-check
-    ./scripts/ci-preflight.sh
-
-# Run the full local CI gate.
-ci: ci-preflight fmt-check lint-default lint test-default test deny openapi-check openapi-contract exposure-check security
-
-# Run the development server with an explicitly generated config file.
-# Usage: just run config=path/to/generated/notary.yaml
-run config:
-    cargo run -p registry-notary -- --config {{config}}
-
-# Compile the perf benches without running them.
-perf-bench-build:
-    cargo bench --no-run --workspace --all-features
-
-# Run all Criterion microbenchmarks.
-perf-bench:
-    cargo bench --workspace --all-features
diff --git a/products/notary/openapi/oasdiff-err-ignore.txt b/products/notary/openapi/oasdiff-err-ignore.txt
deleted file mode 100644
index 17b294c2b..000000000
--- a/products/notary/openapi/oasdiff-err-ignore.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-# One-time accepted diff for PR #580: every remaining claim is registry-backed,
-# and the batch runtime requires an idempotency key before evaluating one.
-# This pre-1.0 contract break is documented in the release notes. The line below
-# stops matching once the baseline includes it.
-POST /v1/batch-evaluations the 'header' request parameter 'Idempotency-Key' became required
-POST /v1/batch-evaluations the `header` request parameter `idempotency-key` became required
diff --git a/products/notary/openapi/registry-notary.openapi.json b/products/notary/openapi/registry-notary.openapi.json
deleted file mode 100644
index b3ae67cb9..000000000
--- a/products/notary/openapi/registry-notary.openapi.json
+++ /dev/null
@@ -1,5322 +0,0 @@
-{
-  "components": {
-    "schemas": {
-      "AuditChainInconsistentProblem": {
-        "additionalProperties": false,
-        "properties": {
-          "code": {
-            "enum": [
-              "audit.chain.inconsistent"
-            ],
-            "type": "string"
-          },
-          "detail": {
-            "enum": [
-              "the retained audit chain has an integrity failure and requires operator recovery"
-            ],
-            "type": "string"
-          },
-          "request_id": {
-            "maxLength": 128,
-            "type": "string"
-          },
-          "status": {
-            "enum": [
-              503
-            ],
-            "format": "int32",
-            "type": "integer"
-          },
-          "title": {
-            "enum": [
-              "Audit chain inconsistent"
-            ],
-            "type": "string"
-          },
-          "type": {
-            "enum": [
-              "https://id.registrystack.org/problems/registry-notary/audit/chain-inconsistent"
-            ],
-            "format": "uri",
-            "type": "string"
-          }
-        },
-        "required": [
-          "type",
-          "title",
-          "status",
-          "detail",
-          "code",
-          "request_id"
-        ],
-        "type": "object"
-      },
-      "BatchClaimResultView": {
-        "additionalProperties": false,
-        "properties": {
-          "claim_id": {
-            "type": "string"
-          },
-          "claim_version": {
-            "type": "string"
-          },
-          "disclosure": {
-            "type": "string"
-          },
-          "provenance": {
-            "$ref": "#/components/schemas/ClaimProvenance"
-          },
-          "result_id": {
-            "type": "string"
-          },
-          "satisfied": {
-            "type": [
-              "boolean",
-              "null"
-            ]
-          },
-          "value": {
-            "description": "Claim value. The runtime may return any JSON value.",
-            "type": [
-              "object",
-              "array",
-              "string",
-              "number",
-              "integer",
-              "boolean",
-              "null"
-            ]
-          },
-          "value_type": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "result_id",
-          "claim_id",
-          "claim_version",
-          "value_type",
-          "value",
-          "disclosure",
-          "provenance"
-        ],
-        "type": "object"
-      },
-      "BatchEvaluateItemRequest": {
-        "additionalProperties": false,
-        "properties": {
-          "on_behalf_of": {
-            "$ref": "#/components/schemas/EvidenceOnBehalfOf"
-          },
-          "purpose": {
-            "type": "string"
-          },
-          "relationship": {
-            "$ref": "#/components/schemas/EvidenceRelationship"
-          },
-          "requester": {
-            "$ref": "#/components/schemas/EvidenceEntity"
-          },
-          "target": {
-            "$ref": "#/components/schemas/EvidenceEntity"
-          }
-        },
-        "required": [
-          "target"
-        ],
-        "type": "object"
-      },
-      "BatchEvaluateRequest": {
-        "additionalProperties": false,
-        "properties": {
-          "claims": {
-            "items": {
-              "$ref": "#/components/schemas/ClaimRef"
-            },
-            "type": "array"
-          },
-          "disclosure": {
-            "type": "string"
-          },
-          "format": {
-            "type": "string"
-          },
-          "items": {
-            "items": {
-              "$ref": "#/components/schemas/BatchEvaluateItemRequest"
-            },
-            "maxItems": 100,
-            "type": "array"
-          },
-          "purpose": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "items",
-          "claims"
-        ],
-        "type": "object"
-      },
-      "BatchEvaluateResponse": {
-        "additionalProperties": false,
-        "properties": {
-          "batch_id": {
-            "type": "string"
-          },
-          "claims": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "items": {
-            "items": {
-              "$ref": "#/components/schemas/BatchItemResponse"
-            },
-            "type": "array"
-          },
-          "status": {
-            "enum": [
-              "completed"
-            ],
-            "type": "string"
-          },
-          "summary": {
-            "$ref": "#/components/schemas/BatchSummary"
-          }
-        },
-        "required": [
-          "batch_id",
-          "status",
-          "claims",
-          "items",
-          "summary"
-        ],
-        "type": "object"
-      },
-      "BatchItemError": {
-        "additionalProperties": false,
-        "properties": {
-          "code": {
-            "type": "string"
-          },
-          "retryable": {
-            "type": "boolean"
-          },
-          "title": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "code",
-          "title",
-          "retryable"
-        ],
-        "type": "object"
-      },
-      "BatchItemResponse": {
-        "additionalProperties": false,
-        "properties": {
-          "claim_results": {
-            "items": {
-              "$ref": "#/components/schemas/BatchClaimResultView"
-            },
-            "type": "array"
-          },
-          "errors": {
-            "items": {
-              "$ref": "#/components/schemas/BatchItemError"
-            },
-            "type": "array"
-          },
-          "evaluation_id": {
-            "type": "string"
-          },
-          "input_index": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "requester_ref": {
-            "$ref": "#/components/schemas/EvidenceEntityRef"
-          },
-          "status": {
-            "enum": [
-              "succeeded",
-              "failed"
-            ],
-            "type": "string"
-          },
-          "target_ref": {
-            "$ref": "#/components/schemas/TargetRefView"
-          }
-        },
-        "required": [
-          "input_index",
-          "target_ref",
-          "status",
-          "claim_results",
-          "errors"
-        ],
-        "type": "object"
-      },
-      "BatchSummary": {
-        "additionalProperties": false,
-        "properties": {
-          "failed": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "succeeded": {
-            "minimum": 0,
-            "type": "integer"
-          }
-        },
-        "required": [
-          "succeeded",
-          "failed"
-        ],
-        "type": "object"
-      },
-      "ClaimProvenance": {
-        "additionalProperties": false,
-        "description": "Versioned claim provenance (registry-notary-claim-provenance/v2). PROV-mappable but not PROV-O. Requester-side identity (client, actor, subject) is deliberately absent; it lives in restricted audit only.",
-        "properties": {
-          "derived_from": {
-            "description": "Upstream provenance records this result was derived from. Always empty in v1; reserved for additive cross-evaluation linking.",
-            "items": {
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "generated_by": {
-            "$ref": "#/components/schemas/ProvenanceGeneratedBy"
-          },
-          "schema_version": {
-            "enum": [
-              "registry-notary-claim-provenance/v2"
-            ],
-            "type": "string"
-          },
-          "used": {
-            "$ref": "#/components/schemas/ProvenanceUsed"
-          }
-        },
-        "required": [
-          "schema_version",
-          "generated_by",
-          "used",
-          "derived_from"
-        ],
-        "type": "object"
-      },
-      "ClaimRef": {
-        "additionalProperties": false,
-        "description": "Claim reference. Wire requests may also use a plain string claim id.",
-        "properties": {
-          "id": {
-            "type": "string"
-          },
-          "version": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "id"
-        ],
-        "type": "object"
-      },
-      "ClaimResultView": {
-        "additionalProperties": false,
-        "properties": {
-          "claim_id": {
-            "type": "string"
-          },
-          "claim_version": {
-            "type": "string"
-          },
-          "disclosure": {
-            "type": "string"
-          },
-          "evaluation_id": {
-            "type": "string"
-          },
-          "expires_at": {
-            "format": "date-time",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "format": {
-            "type": "string"
-          },
-          "issued_at": {
-            "format": "date-time",
-            "type": "string"
-          },
-          "provenance": {
-            "$ref": "#/components/schemas/ClaimProvenance"
-          },
-          "redacted_fields": {
-            "description": "Claim or top-level field names redacted from the public result. Omitted when no redaction was applied.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "requester_ref": {
-            "$ref": "#/components/schemas/EvidenceEntityRef"
-          },
-          "satisfied": {
-            "type": [
-              "boolean",
-              "null"
-            ]
-          },
-          "subject_type": {
-            "type": "string"
-          },
-          "target_ref": {
-            "$ref": "#/components/schemas/TargetRefView"
-          },
-          "value": {
-            "description": "Claim value. The runtime may return any JSON value.",
-            "type": [
-              "object",
-              "array",
-              "string",
-              "number",
-              "integer",
-              "boolean",
-              "null"
-            ]
-          }
-        },
-        "required": [
-          "evaluation_id",
-          "claim_id",
-          "claim_version",
-          "subject_type",
-          "target_ref",
-          "value",
-          "satisfied",
-          "disclosure",
-          "format",
-          "issued_at",
-          "expires_at",
-          "provenance"
-        ],
-        "type": "object"
-      },
-      "ClaimSemantics": {
-        "additionalProperties": false,
-        "description": "Optional semantic binding for a Notary claim. These fields label the claim output or predicate with external vocabulary terms such as PublicSchema URIs; they do not change the Notary result shape or by themselves prove privacy minimization.",
-        "properties": {
-          "concept": {
-            "description": "External concept URI, for example https://publicschema.org/Person.",
-            "type": "string"
-          },
-          "derived_from": {
-            "description": "External property URIs the predicate or derived value depends on.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "predicate": {
-            "description": "External or local predicate URI/URN for derived boolean claims.",
-            "type": "string"
-          },
-          "property": {
-            "description": "External property URI for raw value claims, for example https://publicschema.org/date_of_birth.",
-            "type": "string"
-          },
-          "value_mapping": {
-            "description": "Operator label for the value mapping/canonicalization applied before returning the claim.",
-            "type": "string"
-          },
-          "vocabulary": {
-            "description": "External vocabulary or value-set URI used by the claim value.",
-            "type": "string"
-          }
-        },
-        "type": "object"
-      },
-      "ClaimSummary": {
-        "additionalProperties": true,
-        "properties": {
-          "cccev": {
-            "oneOf": [
-              {
-                "type": "null"
-              },
-              {
-                "additionalProperties": true,
-                "type": "object"
-              }
-            ]
-          },
-          "disclosure": {
-            "additionalProperties": false,
-            "properties": {
-              "allowed": {
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "default": {
-                "type": "string"
-              },
-              "downgrade": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "default",
-              "allowed",
-              "downgrade"
-            ],
-            "type": "object"
-          },
-          "evidence_type": {
-            "type": "string"
-          },
-          "evidence_type_iri": {
-            "format": "uri",
-            "type": "string"
-          },
-          "formats": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "id": {
-            "type": "string"
-          },
-          "oots": {
-            "oneOf": [
-              {
-                "type": "null"
-              },
-              {
-                "additionalProperties": true,
-                "type": "object"
-              }
-            ]
-          },
-          "operations": {
-            "additionalProperties": false,
-            "properties": {
-              "batch_evaluate": {
-                "type": "boolean"
-              },
-              "evaluate": {
-                "type": "boolean"
-              }
-            },
-            "required": [
-              "evaluate",
-              "batch_evaluate"
-            ],
-            "type": "object"
-          },
-          "semantics": {
-            "$ref": "#/components/schemas/ClaimSemantics"
-          },
-          "subject_type": {
-            "type": "string"
-          },
-          "target_inputs": {
-            "description": "Safe request-input metadata for building evaluation targets. It exposes target-side paths and matching method labels, never upstream connection, dataset, entity, or field details.",
-            "items": {
-              "$ref": "#/components/schemas/ClaimTargetInputMethod"
-            },
-            "type": "array"
-          },
-          "title": {
-            "type": "string"
-          },
-          "version": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "id",
-          "title",
-          "version",
-          "subject_type",
-          "operations",
-          "formats",
-          "disclosure"
-        ],
-        "type": "object"
-      },
-      "ClaimTargetInput": {
-        "additionalProperties": false,
-        "properties": {
-          "kind": {
-            "enum": [
-              "id",
-              "identifier",
-              "attribute"
-            ],
-            "type": "string"
-          },
-          "label": {
-            "type": "string"
-          },
-          "name": {
-            "type": "string"
-          },
-          "path": {
-            "description": "Target-side request path, for example target.identifiers.national_id or target.attributes.birthdate.",
-            "type": "string"
-          }
-        },
-        "required": [
-          "path",
-          "kind",
-          "name",
-          "label"
-        ],
-        "type": "object"
-      },
-      "ClaimTargetInputGroup": {
-        "additionalProperties": false,
-        "properties": {
-          "inputs": {
-            "items": {
-              "$ref": "#/components/schemas/ClaimTargetInput"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "inputs"
-        ],
-        "type": "object"
-      },
-      "ClaimTargetInputMethod": {
-        "additionalProperties": false,
-        "properties": {
-          "confidence": {
-            "description": "Policy-asserted confidence label for this target-input method.",
-            "type": "string"
-          },
-          "groups": {
-            "description": "OR-of-AND input groups. A request needs to satisfy one group.",
-            "items": {
-              "$ref": "#/components/schemas/ClaimTargetInputGroup"
-            },
-            "type": "array"
-          },
-          "method": {
-            "description": "Configured target-matching method label.",
-            "type": "string"
-          },
-          "policy_id": {
-            "description": "Stable target-matching policy identifier when configured.",
-            "type": "string"
-          },
-          "target_type": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "target_type",
-          "method",
-          "confidence",
-          "groups"
-        ],
-        "type": "object"
-      },
-      "CredentialConfigurationMetadata": {
-        "properties": {
-          "credential_signing_alg_values_supported": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "cryptographic_binding_methods_supported": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "display": {
-            "items": {
-              "additionalProperties": true,
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "format": {
-            "type": "string"
-          },
-          "proof_types_supported": {
-            "additionalProperties": true,
-            "type": "object"
-          },
-          "scope": {
-            "type": "string"
-          },
-          "vct": {
-            "format": "uri",
-            "type": "string"
-          }
-        },
-        "required": [
-          "format"
-        ],
-        "type": "object"
-      },
-      "CredentialIssueRequest": {
-        "additionalProperties": false,
-        "properties": {
-          "claims": {
-            "items": {
-              "type": "string"
-            },
-            "type": [
-              "array",
-              "null"
-            ]
-          },
-          "credential_profile": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "disclosure": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "evaluation_id": {
-            "type": "string"
-          },
-          "format": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "holder": {
-            "oneOf": [
-              {
-                "type": "null"
-              },
-              {
-                "$ref": "#/components/schemas/HolderRequest"
-              }
-            ]
-          },
-          "purpose": {
-            "type": [
-              "string",
-              "null"
-            ]
-          }
-        },
-        "required": [
-          "evaluation_id"
-        ],
-        "type": "object"
-      },
-      "CredentialIssuerMetadata": {
-        "properties": {
-          "authorization_servers": {
-            "items": {
-              "format": "uri",
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "credential_configurations_supported": {
-            "additionalProperties": {
-              "$ref": "#/components/schemas/CredentialConfigurationMetadata"
-            },
-            "type": "object"
-          },
-          "credential_endpoint": {
-            "format": "uri",
-            "type": "string"
-          },
-          "credential_issuer": {
-            "format": "uri",
-            "type": "string"
-          },
-          "display": {
-            "items": {
-              "additionalProperties": true,
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "token_endpoint": {
-            "format": "uri",
-            "type": "string"
-          }
-        },
-        "required": [
-          "credential_issuer",
-          "credential_endpoint",
-          "credential_configurations_supported"
-        ],
-        "type": "object"
-      },
-      "CredentialRequest": {
-        "additionalProperties": false,
-        "properties": {
-          "credential_configuration_id": {
-            "type": "string"
-          },
-          "credential_identifier": {
-            "type": "string"
-          },
-          "format": {
-            "example": "dc+sd-jwt",
-            "type": "string"
-          },
-          "proof": {
-            "additionalProperties": false,
-            "properties": {
-              "jwt": {
-                "type": "string"
-              },
-              "proof_type": {
-                "example": "jwt",
-                "type": "string"
-              }
-            },
-            "required": [
-              "proof_type",
-              "jwt"
-            ],
-            "type": "object"
-          },
-          "proofs": {
-            "additionalProperties": false,
-            "properties": {
-              "jwt": {
-                "items": {
-                  "type": "string"
-                },
-                "minItems": 1,
-                "type": "array"
-              }
-            },
-            "type": "object"
-          },
-          "vct": {
-            "format": "uri",
-            "type": "string"
-          }
-        },
-        "type": "object"
-      },
-      "CredentialResponse": {
-        "properties": {
-          "credential": {
-            "type": "string"
-          },
-          "credential_profile": {
-            "type": "string"
-          },
-          "credentials": {
-            "items": {
-              "additionalProperties": true,
-              "properties": {
-                "credential": {
-                  "type": "string"
-                }
-              },
-              "required": [
-                "credential"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "format": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "credential"
-        ],
-        "type": "object"
-      },
-      "CredentialStatus": {
-        "properties": {
-          "credential_id": {
-            "type": "string"
-          },
-          "credential_profile": {
-            "type": "string"
-          },
-          "expires_at": {
-            "format": "date-time",
-            "type": "string"
-          },
-          "issued_at": {
-            "format": "date-time",
-            "type": "string"
-          },
-          "issuer": {
-            "type": "string"
-          },
-          "status": {
-            "enum": [
-              "valid",
-              "suspended",
-              "revoked",
-              "expired"
-            ],
-            "type": "string"
-          },
-          "updated_at": {
-            "format": "date-time",
-            "type": "string"
-          }
-        },
-        "required": [
-          "credential_id",
-          "issuer",
-          "credential_profile",
-          "status",
-          "issued_at",
-          "expires_at",
-          "updated_at"
-        ],
-        "type": "object"
-      },
-      "CredentialStatusUpdateRequest": {
-        "additionalProperties": false,
-        "properties": {
-          "status": {
-            "enum": [
-              "valid",
-              "suspended",
-              "revoked"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "status"
-        ],
-        "type": "object"
-      },
-      "EnabledSignerSurfaceChecks": {
-        "additionalProperties": false,
-        "properties": {
-          "enabled": {
-            "type": "boolean"
-          },
-          "local_software_signing_provider_count": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "signing_provider_count": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "unapproved_signing_provider_count": {
-            "minimum": 0,
-            "type": "integer"
-          }
-        },
-        "required": [
-          "enabled",
-          "signing_provider_count",
-          "local_software_signing_provider_count",
-          "unapproved_signing_provider_count"
-        ],
-        "type": "object"
-      },
-      "EvaluateRequest": {
-        "additionalProperties": false,
-        "properties": {
-          "claims": {
-            "items": {
-              "$ref": "#/components/schemas/ClaimRef"
-            },
-            "type": "array"
-          },
-          "disclosure": {
-            "type": "string"
-          },
-          "format": {
-            "type": "string"
-          },
-          "on_behalf_of": {
-            "$ref": "#/components/schemas/EvidenceOnBehalfOf"
-          },
-          "purpose": {
-            "type": "string"
-          },
-          "relationship": {
-            "$ref": "#/components/schemas/EvidenceRelationship"
-          },
-          "requester": {
-            "$ref": "#/components/schemas/EvidenceEntity"
-          },
-          "target": {
-            "$ref": "#/components/schemas/EvidenceEntity"
-          },
-          "variables": {
-            "additionalProperties": {
-              "format": "date",
-              "maxLength": 10,
-              "minLength": 10,
-              "type": "string"
-            },
-            "maxProperties": 16,
-            "propertyNames": {
-              "maxLength": 96,
-              "pattern": "^[a-z][a-z0-9_]{0,95}$",
-              "type": "string"
-            },
-            "type": "object"
-          }
-        },
-        "required": [
-          "claims"
-        ],
-        "type": "object"
-      },
-      "EvaluationResponse": {
-        "additionalProperties": false,
-        "properties": {
-          "results": {
-            "items": {
-              "$ref": "#/components/schemas/ClaimResultView"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "results"
-        ],
-        "type": "object"
-      },
-      "EvidenceActor": {
-        "additionalProperties": false,
-        "properties": {
-          "assurance": {
-            "description": "Optional assurance level of the actor (for example an acr value).",
-            "type": "string"
-          },
-          "id_hash": {
-            "description": "Keyed-hash identifier of the actor in hmac-sha256:<hex> format. Never a raw principal value.",
-            "type": "string"
-          },
-          "type": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "type",
-          "id_hash"
-        ],
-        "type": "object"
-      },
-      "EvidenceAssurance": {
-        "additionalProperties": false,
-        "properties": {
-          "evidence": {
-            "items": {
-              "additionalProperties": true,
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "issuer": {
-            "type": "string"
-          },
-          "level": {
-            "type": "string"
-          },
-          "level_scheme": {
-            "type": "string"
-          },
-          "method": {
-            "type": "string"
-          },
-          "verified_at": {
-            "format": "date-time",
-            "type": "string"
-          }
-        },
-        "type": "object"
-      },
-      "EvidenceEntity": {
-        "additionalProperties": false,
-        "properties": {
-          "assurance": {
-            "$ref": "#/components/schemas/EvidenceAssurance"
-          },
-          "attributes": {
-            "additionalProperties": true,
-            "type": "object"
-          },
-          "id": {
-            "type": "string"
-          },
-          "identifiers": {
-            "items": {
-              "$ref": "#/components/schemas/EvidenceIdentifier"
-            },
-            "type": "array"
-          },
-          "profile": {
-            "type": "string"
-          },
-          "type": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "type"
-        ],
-        "type": "object"
-      },
-      "EvidenceEntityRef": {
-        "additionalProperties": false,
-        "properties": {
-          "handle": {
-            "type": "string"
-          },
-          "identifier_schemes": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "profile": {
-            "type": "string"
-          },
-          "type": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "type",
-          "handle"
-        ],
-        "type": "object"
-      },
-      "EvidenceIdentifier": {
-        "additionalProperties": false,
-        "properties": {
-          "country": {
-            "type": "string"
-          },
-          "issuer": {
-            "type": "string"
-          },
-          "scheme": {
-            "type": "string"
-          },
-          "value": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "scheme",
-          "value"
-        ],
-        "type": "object"
-      },
-      "EvidenceOnBehalfOf": {
-        "additionalProperties": false,
-        "description": "Frozen minimal actor/delegation envelope. Replaces the previous free-form object; free-form payloads are rejected. Simple deployments omit on_behalf_of entirely. Production-grade delegation (OAuth token exchange / RAR / CIBA) arrives post-1.0 as an additive profile that maps the actor onto OAuth act-claim semantics via the opaque delegation_ref; the shape does not bake in a single-actor assumption.",
-        "properties": {
-          "actor": {
-            "$ref": "#/components/schemas/EvidenceActor"
-          },
-          "delegation_ref": {
-            "description": "Opaque reference to an out-of-band delegation record. Not interpreted by the envelope; the indirection point through which a later OAuth profile resolves an actor chain.",
-            "type": "string"
-          }
-        },
-        "required": [
-          "actor"
-        ],
-        "type": "object"
-      },
-      "EvidenceRelationship": {
-        "additionalProperties": false,
-        "properties": {
-          "attributes": {
-            "additionalProperties": true,
-            "type": "object"
-          },
-          "type": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "type"
-        ],
-        "type": "object"
-      },
-      "HolderRequest": {
-        "additionalProperties": false,
-        "properties": {
-          "binding": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "id": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "proof": {
-            "type": [
-              "string",
-              "null"
-            ]
-          }
-        },
-        "type": "object"
-      },
-      "ListClaimsResponse": {
-        "additionalProperties": false,
-        "properties": {
-          "data": {
-            "items": {
-              "$ref": "#/components/schemas/ClaimSummary"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "data"
-        ],
-        "type": "object"
-      },
-      "Oid4vciError": {
-        "properties": {
-          "error": {
-            "type": "string"
-          },
-          "error_description": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "error"
-        ],
-        "type": "object"
-      },
-      "ProblemDetails": {
-        "additionalProperties": true,
-        "properties": {
-          "code": {
-            "type": "string"
-          },
-          "detail": {
-            "type": "string"
-          },
-          "request_id": {
-            "type": "string"
-          },
-          "status": {
-            "format": "int32",
-            "type": "integer"
-          },
-          "title": {
-            "type": "string"
-          },
-          "type": {
-            "format": "uri",
-            "type": "string"
-          }
-        },
-        "required": [
-          "type",
-          "title",
-          "status",
-          "detail",
-          "code",
-          "request_id"
-        ],
-        "type": "object"
-      },
-      "ProvenanceGeneratedBy": {
-        "additionalProperties": false,
-        "properties": {
-          "claim_id": {
-            "type": "string"
-          },
-          "claim_version": {
-            "type": "string"
-          },
-          "evaluation_id": {
-            "type": "string"
-          },
-          "policy_hash": {
-            "description": "sha256:<hex> digest of the evaluation policy. Public in v1: a hash revealing no policy content, used to correlate the result with a policy evidence-pack.",
-            "type": "string"
-          },
-          "policy_id": {
-            "description": "Evaluation policy identifier under which this result was produced. Present for flows evaluated under a named policy, such as subject-access, and omitted for machine-client flows with no evaluation policy.",
-            "type": "string"
-          },
-          "policy_version": {
-            "type": "string"
-          },
-          "service_id": {
-            "description": "Identifier of the service that produced the result. Replaces the dropped computed_by field; the CCCEV renderer maps its provider agent from here.",
-            "type": "string"
-          },
-          "type": {
-            "enum": [
-              "claim_evaluation"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "type",
-          "service_id",
-          "evaluation_id",
-          "claim_id",
-          "claim_version"
-        ],
-        "type": "object"
-      },
-      "ProvenanceUsed": {
-        "additionalProperties": false,
-        "properties": {
-          "relay_consultation_count": {
-            "minimum": 0,
-            "type": "integer"
-          }
-        },
-        "required": [
-          "relay_consultation_count"
-        ],
-        "type": "object"
-      },
-      "ReadinessCheckProblem": {
-        "additionalProperties": false,
-        "properties": {
-          "checks": {
-            "$ref": "#/components/schemas/ReadinessChecks"
-          },
-          "code": {
-            "enum": [
-              "readiness.not_ready"
-            ],
-            "type": "string"
-          },
-          "detail": {
-            "enum": [
-              "one or more readiness checks are not ready"
-            ],
-            "type": "string"
-          },
-          "readiness_status": {
-            "enum": [
-              "degraded",
-              "not_ready"
-            ],
-            "type": "string"
-          },
-          "request_id": {
-            "maxLength": 128,
-            "type": "string"
-          },
-          "status": {
-            "enum": [
-              503
-            ],
-            "format": "int32",
-            "type": "integer"
-          },
-          "title": {
-            "enum": [
-              "Evidence runtime is not ready"
-            ],
-            "type": "string"
-          },
-          "type": {
-            "enum": [
-              "https://id.registrystack.org/problems/registry-notary/readiness/not-ready"
-            ],
-            "format": "uri",
-            "type": "string"
-          }
-        },
-        "required": [
-          "type",
-          "title",
-          "status",
-          "detail",
-          "code",
-          "request_id",
-          "readiness_status",
-          "checks"
-        ],
-        "type": "object"
-      },
-      "ReadinessChecks": {
-        "additionalProperties": false,
-        "properties": {
-          "degraded": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "failed": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "ok": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "relay": {
-            "additionalProperties": false,
-            "properties": {
-              "failed": {
-                "minimum": 0,
-                "type": "integer"
-              },
-              "ok": {
-                "minimum": 0,
-                "type": "integer"
-              },
-              "total": {
-                "minimum": 0,
-                "type": "integer"
-              }
-            },
-            "required": [
-              "total",
-              "ok",
-              "failed"
-            ],
-            "type": "object"
-          },
-          "signing_providers": {
-            "$ref": "#/components/schemas/SigningProviderReadinessChecks"
-          },
-          "total": {
-            "minimum": 0,
-            "type": "integer"
-          }
-        },
-        "required": [
-          "total",
-          "ok",
-          "degraded",
-          "failed",
-          "signing_providers",
-          "relay"
-        ],
-        "type": "object"
-      },
-      "ReadinessProblem": {
-        "description": "Bounded readiness failures. Audit-chain integrity failures do not expose audit records, paths, hashes, or verification details.",
-        "oneOf": [
-          {
-            "$ref": "#/components/schemas/ReadinessCheckProblem"
-          },
-          {
-            "$ref": "#/components/schemas/AuditChainInconsistentProblem"
-          }
-        ]
-      },
-      "ReadinessResponse": {
-        "additionalProperties": false,
-        "properties": {
-          "checks": {
-            "$ref": "#/components/schemas/ReadinessChecks"
-          },
-          "status": {
-            "enum": [
-              "ready"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "status",
-          "checks"
-        ],
-        "type": "object"
-      },
-      "RegistryClientOfferRequest": {
-        "additionalProperties": false,
-        "properties": {
-          "credential_configuration_id": {
-            "description": "Configured credential type authorized for the evaluation's exact claim set, purpose, and target.",
-            "type": "string"
-          },
-          "evaluation_id": {
-            "description": "Identifier of the fresh registry-backed evaluation owned by the authenticated machine client.",
-            "type": "string"
-          }
-        },
-        "required": [
-          "evaluation_id",
-          "credential_configuration_id"
-        ],
-        "type": "object"
-      },
-      "RegistryClientOfferResponse": {
-        "additionalProperties": false,
-        "properties": {
-          "credential_offer_uri": {
-            "description": "Sensitive standard credential offer URI. It contains the pre-authorized code and describes the tx_code requirement, but never contains the numeric tx_code value.",
-            "format": "uri",
-            "type": "string"
-          },
-          "expires_at": {
-            "description": "Expiry of the pre-authorized code, capped by the stored evaluation expiry.",
-            "format": "date-time",
-            "type": "string"
-          },
-          "tx_code": {
-            "description": "Required sensitive numeric transaction code. Deliver it to the holder through a channel separate from the credential_offer_uri.",
-            "pattern": "^[0-9]+$",
-            "type": "string"
-          }
-        },
-        "required": [
-          "credential_offer_uri",
-          "tx_code",
-          "expires_at"
-        ],
-        "type": "object"
-      },
-      "RelayOutputContract": {
-        "description": "Recursive, closed compiler-pinned Relay output contract. Runtime validation also enforces maximum depth 8, 256 schema nodes, 4096 expanded nodes, and 128-byte field names.",
-        "oneOf": [
-          {
-            "additionalProperties": false,
-            "properties": {
-              "nullable": {
-                "default": false,
-                "type": "boolean"
-              },
-              "type": {
-                "enum": [
-                  "boolean"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "type": "object"
-          },
-          {
-            "additionalProperties": false,
-            "properties": {
-              "maximum": {
-                "format": "int64",
-                "type": "integer"
-              },
-              "minimum": {
-                "format": "int64",
-                "type": "integer"
-              },
-              "nullable": {
-                "default": false,
-                "type": "boolean"
-              },
-              "type": {
-                "enum": [
-                  "integer"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "minimum",
-              "maximum"
-            ],
-            "type": "object"
-          },
-          {
-            "additionalProperties": false,
-            "properties": {
-              "max_bytes": {
-                "maximum": 65536,
-                "minimum": 1,
-                "type": "integer"
-              },
-              "nullable": {
-                "default": false,
-                "type": "boolean"
-              },
-              "type": {
-                "enum": [
-                  "string"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "max_bytes"
-            ],
-            "type": "object"
-          },
-          {
-            "additionalProperties": false,
-            "properties": {
-              "nullable": {
-                "default": false,
-                "type": "boolean"
-              },
-              "type": {
-                "enum": [
-                  "date"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "type": "object"
-          },
-          {
-            "additionalProperties": false,
-            "properties": {
-              "fields": {
-                "additionalProperties": {
-                  "$ref": "#/components/schemas/RelayOutputObjectFieldContract"
-                },
-                "maxProperties": 32,
-                "minProperties": 1,
-                "type": "object"
-              },
-              "max_bytes": {
-                "maximum": 65536,
-                "minimum": 1,
-                "type": "integer"
-              },
-              "nullable": {
-                "default": false,
-                "type": "boolean"
-              },
-              "type": {
-                "enum": [
-                  "object"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "max_bytes",
-              "fields"
-            ],
-            "type": "object"
-          },
-          {
-            "additionalProperties": false,
-            "properties": {
-              "items": {
-                "$ref": "#/components/schemas/RelayOutputContract"
-              },
-              "max_bytes": {
-                "maximum": 65536,
-                "minimum": 1,
-                "type": "integer"
-              },
-              "max_items": {
-                "maximum": 256,
-                "minimum": 1,
-                "type": "integer"
-              },
-              "nullable": {
-                "default": false,
-                "type": "boolean"
-              },
-              "type": {
-                "enum": [
-                  "array"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "max_bytes",
-              "max_items",
-              "items"
-            ],
-            "type": "object"
-          }
-        ]
-      },
-      "RelayOutputObjectFieldContract": {
-        "additionalProperties": false,
-        "properties": {
-          "required": {
-            "type": "boolean"
-          },
-          "schema": {
-            "$ref": "#/components/schemas/RelayOutputContract"
-          }
-        },
-        "required": [
-          "required",
-          "schema"
-        ],
-        "type": "object"
-      },
-      "RenderEvaluationRequest": {
-        "additionalProperties": false,
-        "properties": {
-          "claims": {
-            "items": {
-              "type": "string"
-            },
-            "type": [
-              "array",
-              "null"
-            ]
-          },
-          "disclosure": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "format": {
-            "type": "string"
-          },
-          "purpose": {
-            "type": [
-              "string",
-              "null"
-            ]
-          }
-        },
-        "required": [
-          "format"
-        ],
-        "type": "object"
-      },
-      "SdJwtVcTypeMetadata": {
-        "additionalProperties": true,
-        "properties": {
-          "claims": {
-            "items": {
-              "additionalProperties": true,
-              "properties": {
-                "display": {
-                  "items": {
-                    "additionalProperties": true,
-                    "properties": {
-                      "label": {
-                        "type": "string"
-                      },
-                      "locale": {
-                        "type": "string"
-                      }
-                    },
-                    "required": [
-                      "locale",
-                      "label"
-                    ],
-                    "type": "object"
-                  },
-                  "type": "array"
-                },
-                "mandatory": {
-                  "type": "boolean"
-                },
-                "path": {
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "registry_notary_semantics": {
-                  "$ref": "#/components/schemas/ClaimSemantics"
-                },
-                "registry_notary_value_schema": {
-                  "$ref": "#/components/schemas/RelayOutputContract"
-                },
-                "sd": {
-                  "description": "The complete top-level claim is selectively disclosed as one unit. Nested object fields and array items are not independently disclosable.",
-                  "enum": [
-                    "always"
-                  ],
-                  "type": "string"
-                }
-              },
-              "required": [
-                "path",
-                "display",
-                "sd",
-                "mandatory"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "description": {
-            "type": "string"
-          },
-          "display": {
-            "items": {
-              "additionalProperties": true,
-              "properties": {
-                "locale": {
-                  "type": "string"
-                },
-                "name": {
-                  "type": "string"
-                }
-              },
-              "required": [
-                "locale",
-                "name"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "name": {
-            "type": "string"
-          },
-          "vct": {
-            "format": "uri",
-            "type": "string"
-          }
-        },
-        "required": [
-          "vct",
-          "name",
-          "display",
-          "claims"
-        ],
-        "type": "object"
-      },
-      "SignerCustodyChecks": {
-        "additionalProperties": false,
-        "properties": {
-          "active_provider_counts": {
-            "additionalProperties": {
-              "minimum": 0,
-              "type": "integer"
-            },
-            "description": "Counts by configured provider kind. PKCS#11 identifies an interface, not whether custody is hardware- or software-backed.",
-            "type": "object"
-          },
-          "custody_approval_required": {
-            "type": "boolean"
-          },
-          "custody_approved": {
-            "type": "boolean"
-          },
-          "local_software_signing_provider_count": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "signing_provider_count": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "surfaces": {
-            "$ref": "#/components/schemas/SignerCustodySurfaces"
-          },
-          "unapproved_signing_provider_count": {
-            "minimum": 0,
-            "type": "integer"
-          }
-        },
-        "required": [
-          "active_provider_counts",
-          "signing_provider_count",
-          "local_software_signing_provider_count",
-          "custody_approval_required",
-          "custody_approved",
-          "unapproved_signing_provider_count",
-          "surfaces"
-        ],
-        "type": "object"
-      },
-      "SignerCustodySurfaces": {
-        "additionalProperties": false,
-        "properties": {
-          "access_token_issuance": {
-            "$ref": "#/components/schemas/EnabledSignerSurfaceChecks"
-          },
-          "credential_issuance": {
-            "$ref": "#/components/schemas/SignerSurfaceChecks"
-          },
-          "federation": {
-            "$ref": "#/components/schemas/EnabledSignerSurfaceChecks"
-          }
-        },
-        "required": [
-          "credential_issuance",
-          "access_token_issuance",
-          "federation"
-        ],
-        "type": "object"
-      },
-      "SignerSurfaceChecks": {
-        "additionalProperties": false,
-        "properties": {
-          "local_software_signing_provider_count": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "signing_provider_count": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "unapproved_signing_provider_count": {
-            "minimum": 0,
-            "type": "integer"
-          }
-        },
-        "required": [
-          "signing_provider_count",
-          "local_software_signing_provider_count",
-          "unapproved_signing_provider_count"
-        ],
-        "type": "object"
-      },
-      "SigningProviderReadinessChecks": {
-        "additionalProperties": false,
-        "properties": {
-          "custody": {
-            "$ref": "#/components/schemas/SignerCustodyChecks"
-          },
-          "failed": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "ok": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "total": {
-            "minimum": 0,
-            "type": "integer"
-          }
-        },
-        "required": [
-          "total",
-          "ok",
-          "failed",
-          "custody"
-        ],
-        "type": "object"
-      },
-      "TargetRefView": {
-        "additionalProperties": false,
-        "properties": {
-          "handle": {
-            "type": "string"
-          },
-          "identifier_schemes": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "profile": {
-            "type": "string"
-          },
-          "type": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "handle"
-        ],
-        "type": "object"
-      },
-      "TokenRequest": {
-        "properties": {
-          "grant_type": {
-            "example": "urn:ietf:params:oauth:grant-type:pre-authorized_code",
-            "type": "string"
-          },
-          "pre-authorized_code": {
-            "type": "string"
-          },
-          "tx_code": {
-            "description": "The numeric PIN shown on the offer page. Required when the credential offer includes a tx_code object.",
-            "type": "string"
-          }
-        },
-        "required": [
-          "grant_type",
-          "pre-authorized_code"
-        ],
-        "type": "object"
-      },
-      "TokenResponse": {
-        "properties": {
-          "access_token": {
-            "type": "string"
-          },
-          "c_nonce": {
-            "type": "string"
-          },
-          "c_nonce_expires_in": {
-            "format": "uint64",
-            "type": "integer"
-          },
-          "expires_in": {
-            "format": "uint64",
-            "type": "integer"
-          },
-          "token_type": {
-            "example": "Bearer",
-            "type": "string"
-          }
-        },
-        "required": [
-          "access_token",
-          "token_type"
-        ],
-        "type": "object"
-      }
-    },
-    "securitySchemes": {
-      "apiKeyAuth": {
-        "in": "header",
-        "name": "X-Api-Key",
-        "type": "apiKey"
-      },
-      "bearerAuth": {
-        "scheme": "bearer",
-        "type": "http"
-      }
-    }
-  },
-  "info": {
-    "contact": {
-      "name": "Registry Notary owning team"
-    },
-    "description": "Standalone claim evaluation, rendering, and credential issuance API.",
-    "license": {
-      "identifier": "Apache-2.0",
-      "name": "Apache-2.0"
-    },
-    "summary": "Standalone evidence evaluation, rendering, and credential issuance service.",
-    "title": "Registry Notary API",
-    "version": "0.16.3"
-  },
-  "openapi": "3.1.0",
-  "paths": {
-    "/.well-known/evidence-service": {
-      "get": {
-        "operationId": "getEvidenceService",
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "api_version": "2026-05",
-                  "auth": {
-                    "api_key": {
-                      "header": "X-Api-Key"
-                    },
-                    "audience": "demo.registry-notary",
-                    "bearer": {
-                      "format": "Bearer <token>",
-                      "header": "Authorization",
-                      "scheme": "bearer"
-                    },
-                    "methods": [
-                      "api_key",
-                      "bearer"
-                    ]
-                  },
-                  "base_url": "http://127.0.0.1:4255",
-                  "batch": {
-                    "idempotency_window": "PT15M",
-                    "max_inline_subjects": 20
-                  },
-                  "claims_url": "/v1/claims",
-                  "credential_capabilities": {
-                    "formats": [
-                      "application/dc+sd-jwt"
-                    ],
-                    "sd_jwt_vc": {
-                      "credential_profiles": [
-                        {
-                          "allowed_claims": [
-                            "farmer-under-4ha"
-                          ],
-                          "disclosure": {
-                            "allowed": [
-                              "predicate"
-                            ]
-                          },
-                          "format": "application/dc+sd-jwt",
-                          "holder_binding": {
-                            "allowed_did_methods": [
-                              "did:jwk"
-                            ],
-                            "mode": "did",
-                            "proof_of_possession": "required"
-                          },
-                          "id": "smallholder_sd_jwt",
-                          "issuer": "did:web:agriculture.demo.example.gov",
-                          "validity_seconds": 86400,
-                          "vct": "https://demo.example.gov/credentials/smallholder-farmer/v1"
-                        }
-                      ],
-                      "holder_binding_methods": [
-                        "did:jwk"
-                      ],
-                      "issuer_key_types": [
-                        "OKP/Ed25519"
-                      ],
-                      "jwt_typ": "dc+sd-jwt",
-                      "media_type": "application/dc+sd-jwt",
-                      "openid4vci": {
-                        "support": "not_full_issuer"
-                      },
-                      "signing_algs": [
-                        "EdDSA"
-                      ],
-                      "status_methods": []
-                    },
-                    "unsupported_features": [
-                      "application/vc+sd-jwt",
-                      "json_ld_vc_issuance",
-                      "data_integrity_proofs",
-                      "credential_status",
-                      "delegated_credential_issuance",
-                      "mso_mdoc",
-                      "openid4vci_full_issuer"
-                    ]
-                  },
-                  "formats": [
-                    {
-                      "id": "application/dc+sd-jwt",
-                      "kind": "credential",
-                      "status": "enabled"
-                    },
-                    {
-                      "id": "application/ld+json; profile=\"cccev\"",
-                      "kind": "renderer",
-                      "status": "enabled"
-                    },
-                    {
-                      "id": "application/vnd.registry-notary.claim-result+json",
-                      "kind": "claim_result",
-                      "status": "enabled"
-                    }
-                  ],
-                  "formats_url": "/v1/formats",
-                  "identity": {
-                    "mapper": "common_subject_id",
-                    "production_mapper": false
-                  },
-                  "issuer": {
-                    "id": "did:web:agriculture.demo.example.gov",
-                    "name": "demo.registry-notary"
-                  },
-                  "operations": {
-                    "batch_evaluate": true,
-                    "credential_issue": true,
-                    "evaluate": true,
-                    "render": true
-                  },
-                  "service_id": "demo.registry-notary"
-                }
-              }
-            },
-            "description": "Service document"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.missing_credential",
-                  "detail": "missing authentication credential",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 401,
-                  "title": "Missing credential",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/missing_credential"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Missing or invalid credential"
-          }
-        },
-        "summary": "Discover Registry Notary capabilities"
-      }
-    },
-    "/.well-known/evidence/jwks.json": {
-      "get": {
-        "description": "Returns public issuer verification keys for wallet and verifier discovery. This well-known route is intentionally unauthenticated; it only exposes public JWK members.",
-        "operationId": "getEvidenceJwks",
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "keys": [
-                    {
-                      "alg": "EdDSA",
-                      "crv": "Ed25519",
-                      "kid": "did:web:agriculture.demo.example.gov#registry-notary-demo-key-1",
-                      "kty": "OKP",
-                      "x": "11qYAYKxCrfVS_3XDbXJC2AgYI57qXzcS7P0W5Y9f4Y"
-                    }
-                  ]
-                }
-              }
-            },
-            "description": "Public JWKS"
-          }
-        },
-        "security": [],
-        "summary": "Fetch public issuer verification keys"
-      }
-    },
-    "/.well-known/openid-credential-issuer": {
-      "get": {
-        "description": "Returns the OpenID4VCI issuer metadata for Registry Notary' dc+sd-jwt issuance profile.",
-        "operationId": "getOpenidCredentialIssuer",
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "authorization_servers": [
-                    "https://id.example.gov"
-                  ],
-                  "credential_configurations_supported": {
-                    "person_is_alive_sd_jwt": {
-                      "credential_signing_alg_values_supported": [
-                        "EdDSA"
-                      ],
-                      "cryptographic_binding_methods_supported": [
-                        "did:jwk"
-                      ],
-                      "display": [
-                        {
-                          "background_color": "#0057B8",
-                          "description": "Proof that the civil registry currently records this person as alive.",
-                          "locale": "en-US",
-                          "name": "Person is alive",
-                          "text_color": "#FFFFFF"
-                        }
-                      ],
-                      "format": "dc+sd-jwt",
-                      "proof_types_supported": {
-                        "jwt": {
-                          "proof_signing_alg_values_supported": [
-                            "EdDSA"
-                          ]
-                        }
-                      },
-                      "scope": "person_is_alive",
-                      "vct": "https://issuer.example.gov/credentials/person-is-alive"
-                    }
-                  },
-                  "credential_endpoint": "https://issuer.example.gov/oid4vci/credential",
-                  "credential_issuer": "https://issuer.example.gov",
-                  "display": [
-                    {
-                      "locale": "en-US",
-                      "name": "Civil Registry Notary"
-                    }
-                  ]
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/CredentialIssuerMetadata"
-                }
-              }
-            },
-            "description": "OpenID4VCI credential issuer metadata"
-          },
-          "404": {
-            "description": "OpenID4VCI issuer is disabled"
-          },
-          "500": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "error": "server_error",
-                  "error_description": "credential issuer failed"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "OpenID4VCI issuer failed"
-          }
-        },
-        "security": [],
-        "summary": "Discover OpenID4VCI credential issuer metadata"
-      }
-    },
-    "/.well-known/vct/{vct_path}": {
-      "get": {
-        "description": "Returns public SD-JWT VC Type Metadata at the SD-JWT VC well-known location. Consumers dereference an HTTPS vct by inserting /.well-known/vct between the host and the path; the server strips that prefix and matches the reconstructed vct (https://{host}/{vct_path}) against a configured OID4VCI credential configuration. The path key uses the OpenAPI single-segment form {vct_path} for standard tooling compatibility, but the route is a multi-segment catch-all: vct_path captures the full path remainder (slashes included, not percent-encoded) and may span multiple segments. This route is intentionally unversioned and must remain at /.well-known/vct/{vct_path}: per RFC 8615 well-known URI semantics, the path prefix is determined by the protocol and cannot be changed. Adding a /v1/ prefix would violate the well-known URI convention. This route serves type metadata only and is unrelated to POST /v1/credentials (credential issuance).",
-        "operationId": "getWellKnownSdJwtVcTypeMetadata",
-        "parameters": [
-          {
-            "description": "Full path remainder after /.well-known/vct/ captured as a multi-segment catch-all. The value is the unencoded path suffix of the VCT URL (slashes not percent-encoded) and may contain one or more segments.",
-            "in": "path",
-            "name": "vct_path",
-            "required": true,
-            "schema": {
-              "pattern": "^[^/]+(/[^/]+)*$",
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "claims": [
-                    {
-                      "display": [
-                        {
-                          "label": "Person is alive",
-                          "locale": "en-US"
-                        }
-                      ],
-                      "mandatory": true,
-                      "path": [
-                        "person-is-alive"
-                      ],
-                      "registry_notary_semantics": {
-                        "concept": "https://publicschema.org/Person",
-                        "derived_from": [
-                          "https://publicschema.org/date_of_death"
-                        ],
-                        "predicate": "urn:registry-notary:predicate:person-is-alive"
-                      },
-                      "registry_notary_value_schema": {
-                        "nullable": false,
-                        "type": "boolean"
-                      },
-                      "sd": "always"
-                    }
-                  ],
-                  "display": [
-                    {
-                      "background_color": "#0057B8",
-                      "description": "Proof that the civil registry currently records this person as alive.",
-                      "locale": "en-US",
-                      "name": "Person is alive",
-                      "text_color": "#FFFFFF"
-                    }
-                  ],
-                  "name": "Person is alive",
-                  "vct": "https://issuer.example.gov/credentials/person-is-alive"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/SdJwtVcTypeMetadata"
-                }
-              }
-            },
-            "description": "SD-JWT VC Type Metadata"
-          },
-          "404": {
-            "description": "OpenID4VCI issuer is disabled or no configured vct matches the reconstructed URL"
-          }
-        },
-        "security": [],
-        "summary": "Fetch SD-JWT VC Type Metadata at the well-known location"
-      },
-      "x-registry-notary-catch-all": true
-    },
-    "/admin/v1/capabilities": {
-      "get": {
-        "description": "Returns redacted product capability metadata for posture and supported admin operations.",
-        "operationId": "adminCapabilities",
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "admin_api_version": "v1",
-                  "break_glass": {
-                    "currently_available": false,
-                    "rate_limit_scope": "none",
-                    "supported": false
-                  },
-                  "config": {
-                    "apply": {
-                      "currently_available": false,
-                      "requires_signed_input": true,
-                      "supported": false,
-                      "supported_sources": []
-                    },
-                    "dry_run": {
-                      "currently_available": false,
-                      "supported": false
-                    },
-                    "verify": {
-                      "currently_available": false,
-                      "supported": false
-                    }
-                  },
-                  "hot_swap": {
-                    "components": [],
-                    "currently_available": false,
-                    "supported": false
-                  },
-                  "listeners": {
-                    "admin": {
-                      "mode": "shared_with_public",
-                      "public_admin_routes": true
-                    },
-                    "metrics": {
-                      "mode": "shared_with_public",
-                      "required_scope": "registry_notary:metrics_read",
-                      "requires_admin_scope": false
-                    }
-                  },
-                  "product": "registry-notary",
-                  "reload": {
-                    "config_reload": {
-                      "currently_available": false,
-                      "supported": false
-                    },
-                    "resource_reload": {
-                      "currently_available": false,
-                      "supported": false
-                    },
-                    "table_reload": {
-                      "currently_available": false,
-                      "supported": false
-                    }
-                  },
-                  "root_transition": {
-                    "currently_available": false,
-                    "supported": false
-                  },
-                  "schema": "registry.admin.capabilities.v1",
-                  "supported_posture_tiers": [
-                    "default",
-                    "restricted"
-                  ]
-                }
-              }
-            },
-            "description": "Admin capabilities for this product runtime"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.missing_credential",
-                  "detail": "missing authentication credential",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 401,
-                  "title": "Missing credential",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/missing_credential"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Missing or invalid credential"
-          },
-          "403": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.scope_denied",
-                  "detail": "missing required scope",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 403,
-                  "title": "Scope denied",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/scope_denied"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Caller lacks registry_notary:ops_read scope"
-          }
-        },
-        "security": [
-          {
-            "apiKeyAuth": []
-          },
-          {
-            "bearerAuth": []
-          }
-        ],
-        "summary": "Discover authenticated admin capabilities"
-      }
-    },
-    "/admin/v1/credentials/{credential_id}/status": {
-      "post": {
-        "operationId": "updateCredentialStatus",
-        "parameters": [
-          {
-            "in": "path",
-            "name": "credential_id",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CredentialStatusUpdateRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "credential_id": "urn:ulid:01HX7Y5F2WAJ7ZP0Q4M5K9E8NC",
-                  "credential_profile": "civil_status_sd_jwt",
-                  "expires_at": "2026-05-25T12:10:00Z",
-                  "issued_at": "2026-05-25T12:00:00Z",
-                  "issuer": "did:web:issuer.example",
-                  "status": "revoked",
-                  "updated_at": "2026-05-25T12:00:00Z"
-                }
-              }
-            },
-            "description": "Updated credential status record"
-          },
-          "400": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "credential_status.invalid_status",
-                  "detail": "status must be valid, suspended, or revoked",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 400,
-                  "title": "Invalid credential status",
-                  "type": "https://id.registrystack.org/problems/registry-notary/credential_status/invalid_status"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Invalid status value"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.missing_credential",
-                  "detail": "missing authentication credential",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 401,
-                  "title": "Missing credential",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/missing_credential"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Missing or invalid credential"
-          },
-          "403": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.scope_denied",
-                  "detail": "missing required scope",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 403,
-                  "title": "Scope denied",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/scope_denied"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Caller lacks registry_notary:admin scope"
-          },
-          "404": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "credential_status.not_found",
-                  "detail": "credential status record was not found",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 404,
-                  "title": "Credential status not found",
-                  "type": "https://id.registrystack.org/problems/registry-notary/credential_status/not_found"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Credential status is disabled or not found"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "credential_status.unavailable",
-                  "detail": "credential status store is unavailable",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 503,
-                  "title": "Credential status unavailable",
-                  "type": "https://id.registrystack.org/problems/registry-notary/credential_status/unavailable"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Credential status store is unavailable"
-          }
-        },
-        "security": [
-          {
-            "apiKeyAuth": []
-          },
-          {
-            "bearerAuth": []
-          }
-        ],
-        "summary": "Update credential lifecycle status"
-      }
-    },
-    "/admin/v1/posture": {
-      "get": {
-        "description": "Returns redacted runtime posture for the requested tier. The response body is a registry.ops.posture.v1 document describing instance, configuration, notary, deployment, and audit posture.",
-        "operationId": "adminPosture",
-        "parameters": [
-          {
-            "description": "Redaction tier for the posture document. Defaults to default.",
-            "in": "query",
-            "name": "tier",
-            "required": false,
-            "schema": {
-              "enum": [
-                "default",
-                "restricted"
-              ],
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "audit": {
-                    "anchoring": "none",
-                    "checkpoints": "unsupported",
-                    "hash_chain": "process_local",
-                    "keyed_integrity": "hmac",
-                    "redaction_mode": "redacted",
-                    "retention_owner": "operator",
-                    "sink_class": "file",
-                    "write_policy": "fail_closed_route_families"
-                  },
-                  "build": {
-                    "package": "registry-notary",
-                    "version": "0.1.0"
-                  },
-                  "component": "registry-notary",
-                  "configuration": {
-                    "dynamic_reload_supported": false,
-                    "last_apply_at": null,
-                    "last_apply_result": null,
-                    "last_bundle_id": null,
-                    "last_bundle_sequence": null,
-                    "last_bundle_signer_kids": [],
-                    "last_config_hash": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-                    "restart_required": false,
-                    "source": "local_file"
-                  },
-                  "deployment": {
-                    "findings": [],
-                    "profile": "production"
-                  },
-                  "instance": {
-                    "environment": "production",
-                    "id": "civil-notary-prod",
-                    "jurisdiction": "example-country",
-                    "owner": "Ministry of Interior"
-                  },
-                  "notary": {
-                    "claim_count": 6,
-                    "credential_profile_count": 2,
-                    "credential_status": {
-                      "enabled": true,
-                      "storage": "state"
-                    },
-                    "federation": {
-                      "allowed_profile_count": 3,
-                      "allowed_purpose_count": 4,
-                      "enabled": true,
-                      "peer_count": 2,
-                      "supported_protocol_versions": [
-                        "registry-notary-federation/v0.1"
-                      ]
-                    },
-                    "oid4vci": {
-                      "credential_configuration_count": 1,
-                      "enabled": true
-                    },
-                    "state": {
-                      "ready": true,
-                      "storage": "postgresql"
-                    },
-                    "subject_access": {
-                      "allowed_claim_count": 1,
-                      "allowed_purpose_count": 1,
-                      "credential_profile_count": 1,
-                      "enabled": true,
-                      "rate_limit_mode": "postgresql",
-                      "wallet_origin_count": 1
-                    }
-                  },
-                  "observed_at": "2026-06-04T10:00:00Z",
-                  "posture": {
-                    "audit": {
-                      "checkpoint_status": "unavailable",
-                      "configured": true,
-                      "latest_sequence": null,
-                      "latest_tail_hash": null,
-                      "shipping_health": "ok",
-                      "shipping_observed_at": "2026-06-04T09:59:00Z",
-                      "shipping_target": "declared_external",
-                      "shipping_target_configured": true,
-                      "sink_type": "file",
-                      "verification_status": "not_supported",
-                      "verified_at": null
-                    },
-                    "findings": [],
-                    "warnings": []
-                  },
-                  "runtime": {
-                    "admin_enabled": true,
-                    "auth_methods": [
-                      "oidc",
-                      "notary_access_token"
-                    ],
-                    "auth_mode": "oidc",
-                    "readiness": "ready"
-                  },
-                  "schema": "registry.ops.posture.v1",
-                  "standards_artifacts": {
-                    "evidence_service_discovery": {
-                      "media_type": "application/json",
-                      "observed_status": "available"
-                    },
-                    "jwks": {
-                      "media_type": "application/jwk-set+json",
-                      "observed_status": "available"
-                    }
-                  },
-                  "tier": "default"
-                }
-              }
-            },
-            "description": "Redacted posture for the requested tier"
-          },
-          "400": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "registry.admin.posture.invalid_tier",
-                  "detail": "posture tier must be default or restricted",
-                  "message": "posture tier must be default or restricted",
-                  "request_id": "01J00000000000000000000000",
-                  "schema": "registry.admin.error.v1",
-                  "status": 400,
-                  "title": "Admin posture tier invalid",
-                  "type": "https://id.registrystack.org/problems/registry-notary/registry/admin/posture/invalid_tier"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Posture tier is invalid"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.missing_credential",
-                  "detail": "missing authentication credential",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 401,
-                  "title": "Missing credential",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/missing_credential"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Missing or invalid credential"
-          },
-          "403": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.scope_denied",
-                  "detail": "missing required scope",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 403,
-                  "title": "Scope denied",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/scope_denied"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Caller lacks registry_notary:ops_read scope"
-          },
-          "500": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "posture.filter_failed",
-                  "detail": "admin posture could not be filtered for the requested tier",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 500,
-                  "title": "Admin posture unavailable",
-                  "type": "https://id.registrystack.org/problems/registry-notary/posture/filter_failed"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Posture could not be filtered for the requested tier"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "posture.unavailable",
-                  "detail": "posture state is unavailable",
-                  "message": "posture state is unavailable",
-                  "request_id": "01J00000000000000000000000",
-                  "schema": "registry.admin.error.v1",
-                  "status": 503,
-                  "title": "Admin posture unavailable",
-                  "type": "https://id.registrystack.org/problems/registry-notary/posture/unavailable"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Posture state is unavailable"
-          }
-        },
-        "security": [
-          {
-            "apiKeyAuth": []
-          },
-          {
-            "bearerAuth": []
-          }
-        ],
-        "summary": "Read redacted runtime posture"
-      }
-    },
-    "/admin/v1/reload": {
-      "post": {
-        "description": "Standalone mode does not support runtime configuration reload. Operators should call /admin/v1/capabilities before invoking product-specific reload operations.",
-        "operationId": "adminReload",
-        "responses": {
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.missing_credential",
-                  "detail": "missing authentication credential",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 401,
-                  "title": "Missing credential",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/missing_credential"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Missing or invalid credential"
-          },
-          "403": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.scope_denied",
-                  "detail": "missing required scope",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 403,
-                  "title": "Scope denied",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/scope_denied"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Caller lacks registry_notary:admin scope"
-          },
-          "501": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "registry.admin.capability.not_supported",
-                  "detail": "registry-notary standalone runtime does not support reload",
-                  "message": "registry-notary standalone runtime does not support reload",
-                  "request_id": "01J00000000000000000000000",
-                  "schema": "registry.admin.error.v1",
-                  "status": 501,
-                  "title": "Admin capability not supported",
-                  "type": "https://id.registrystack.org/problems/registry-notary/registry/admin/capability/not_supported"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Runtime configuration reload is not supported"
-          }
-        },
-        "security": [
-          {
-            "apiKeyAuth": []
-          },
-          {
-            "bearerAuth": []
-          }
-        ],
-        "summary": "Report unsupported runtime reload"
-      }
-    },
-    "/credentials/{vct_path}": {
-      "get": {
-        "description": "Returns public SD-JWT VC Type Metadata for a configured OID4VCI credential configuration whose vct exactly matches the requested absolute URL. The path key uses the OpenAPI single-segment form {vct_path} for standard tooling compatibility, but the route is a multi-segment catch-all: vct_path captures the full path remainder after /credentials/ (slashes included, not percent-encoded) and may span multiple segments. This route is intentionally unversioned and must remain at /credentials/{vct_path} (without a /v1/ prefix): per SD-JWT VC type-metadata dereference, a client resolves the credential type by dereferencing the vct claim directly (for example, https://{host}/credentials/{vct_path}), so the server path must match the vct URL path component exactly. Adding a /v1/ prefix would break dereference for any credential whose vct does not include that prefix. This route serves type metadata only and is unrelated to POST /v1/credentials (credential issuance).",
-        "operationId": "getSdJwtVcTypeMetadata",
-        "parameters": [
-          {
-            "description": "Full path remainder after /credentials/ captured as a multi-segment catch-all. The value is the unencoded path suffix of the VCT URL (slashes not percent-encoded) and may contain one or more segments.",
-            "in": "path",
-            "name": "vct_path",
-            "required": true,
-            "schema": {
-              "pattern": "^[^/]+(/[^/]+)*$",
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "claims": [
-                    {
-                      "display": [
-                        {
-                          "label": "Person is alive",
-                          "locale": "en-US"
-                        }
-                      ],
-                      "mandatory": true,
-                      "path": [
-                        "person-is-alive"
-                      ],
-                      "registry_notary_semantics": {
-                        "concept": "https://publicschema.org/Person",
-                        "derived_from": [
-                          "https://publicschema.org/date_of_death"
-                        ],
-                        "predicate": "urn:registry-notary:predicate:person-is-alive"
-                      },
-                      "registry_notary_value_schema": {
-                        "nullable": false,
-                        "type": "boolean"
-                      },
-                      "sd": "always"
-                    }
-                  ],
-                  "display": [
-                    {
-                      "background_color": "#0057B8",
-                      "description": "Proof that the civil registry currently records this person as alive.",
-                      "locale": "en-US",
-                      "name": "Person is alive",
-                      "text_color": "#FFFFFF"
-                    }
-                  ],
-                  "name": "Person is alive",
-                  "vct": "https://issuer.example.gov/credentials/person-is-alive"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/SdJwtVcTypeMetadata"
-                }
-              }
-            },
-            "description": "SD-JWT VC Type Metadata"
-          },
-          "404": {
-            "description": "OpenID4VCI issuer is disabled or no configured vct matches the requested URL"
-          }
-        },
-        "security": [],
-        "summary": "Fetch SD-JWT VC Type Metadata"
-      },
-      "x-registry-notary-catch-all": true
-    },
-    "/federation/v1/evaluations": {
-      "post": {
-        "description": "Accepts a compact JWS request with typ registry-notary-request+jwt. This route is mounted only when federation is enabled and uses body-JWT authentication instead of API key or bearer authentication.",
-        "operationId": "federatedEvaluate",
-        "requestBody": {
-          "content": {
-            "application/jwt": {
-              "schema": {
-                "description": "Compact JWS signed federation evaluation request",
-                "type": "string"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "content": {
-              "application/jwt": {
-                "schema": {
-                  "description": "Compact JWS with typ registry-notary-response+jwt",
-                  "type": "string"
-                }
-              }
-            },
-            "description": "Compact JWS signed federation evaluation response"
-          },
-          "400": {
-            "description": "Invalid federation request"
-          },
-          "401": {
-            "description": "Invalid federation token"
-          },
-          "403": {
-            "description": "Peer, profile, purpose, or requester/target identity path is not allowed"
-          },
-          "409": {
-            "description": "Request replay detected"
-          },
-          "413": {
-            "description": "Request body is too large"
-          },
-          "415": {
-            "description": "Content type is not application/jwt"
-          },
-          "503": {
-            "description": "An operational dependency required for a fail-closed response is unavailable"
-          }
-        },
-        "security": [],
-        "summary": "Evaluate one configured federation profile for a trusted peer"
-      }
-    },
-    "/healthz": {
-      "get": {
-        "operationId": "getHealthz",
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "checks": {
-                    "degraded": 0,
-                    "failed": 0,
-                    "ok": 1,
-                    "total": 1
-                  },
-                  "status": "ok"
-                }
-              }
-            },
-            "description": "Service process is alive"
-          },
-          "4XX": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "request.invalid",
-                  "detail": "the evidence request is invalid",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 400,
-                  "title": "Invalid evidence request",
-                  "type": "https://id.registrystack.org/problems/registry-notary/request/invalid"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Client error"
-          }
-        },
-        "security": [],
-        "summary": "Return the liveness probe"
-      }
-    },
-    "/oid4vci/credential": {
-      "post": {
-        "description": "Materializes at most one dc+sd-jwt credential from the immutable registry-backed evaluation transaction authorized before the issuer-initiated offer. The access token supplies the transaction nonce, holder proof must use EdDSA with did:jwk, and an exact retry returns the cached response without another Relay call or signature. Delegated issuance is accepted only for a credential configuration using the digitally authenticated representative ceremony. Error responses use the OpenID4VCI error envelope, not RFC 9457 Problem Details.",
-        "operationId": "issueOid4vciCredential",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CredentialRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "credential": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRjK3NkLWp3dCJ9.payload.signature~disclosure~",
-                  "format": "dc+sd-jwt"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/CredentialResponse"
-                }
-              }
-            },
-            "description": "Credential response"
-          },
-          "400": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "error": "invalid_proof",
-                  "error_description": "credential proof is invalid"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "Invalid credential request, proof, or type"
-          },
-          "401": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "error": "invalid_token",
-                  "error_description": "credential access token is invalid"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "Invalid credential access token"
-          },
-          "403": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "error": "access_denied",
-                  "error_description": "credential request is denied"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "Credential request is denied"
-          },
-          "429": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "error": "temporarily_unavailable",
-                  "error_description": "credential request is rate limited"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "Credential request is rate limited"
-          },
-          "500": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "error": "server_error",
-                  "error_description": "credential issuer failed"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "OpenID4VCI issuer failed"
-          }
-        },
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "summary": "Issue a credential through OpenID4VCI"
-      }
-    },
-    "/oid4vci/offer/callback": {
-      "get": {
-        "description": "Public and unauthenticated. Consumes the login state, exchanges the eSignet code with private_key_jwt, and validates the id_token. For an ordinary credential configuration, it completes the exact registry-backed Relay evaluation and only then mints one single-use pre-authorized_code bound to that immutable transaction. For a representative configuration, it reserves a fresh single-use target-selection state and returns a no-store form; POST /oid4vci/offer/representative completes the proof-bounded evaluation. Denied, unavailable, malformed, or provenance-invalid evaluations produce no offer. When configured, the offer also includes one numeric tx_code (PIN) shown out-of-band from the QR. Returns 404 when the pre-authorized-code flow is disabled.",
-        "operationId": "completeOid4vciOffer",
-        "parameters": [
-          {
-            "in": "query",
-            "name": "code",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "in": "query",
-            "name": "state",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "content": {
-              "text/html": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            },
-            "description": "Offer page, or a representative target-selection page for a representative configuration"
-          },
-          "400": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "Login state, eSignet code, or id_token is invalid"
-          },
-          "403": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "Registry-backed evaluation or issuance policy denied the transaction"
-          },
-          "404": {
-            "description": "Pre-authorized-code flow is disabled"
-          },
-          "500": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "OpenID4VCI issuer failed"
-          }
-        },
-        "security": [],
-        "summary": "Complete eSignet login for a pre-authorized-code offer"
-      }
-    },
-    "/oid4vci/offer/representative": {
-      "post": {
-        "description": "Public and unauthenticated. Consumes the single-use target-selection state created after identity-provider authentication, verifies the CSRF token, binds the represented subject to the configured identifier type, proves the configured relationship through the exact Registry Relay claim closure, and only then renders a single-use pre-authorized-code offer. The relationship-proof expiry caps the transaction, offer, and access-token expiry. This endpoint is an HTML browser ceremony and accepts only a closed, bounded form body.",
-        "operationId": "completeRepresentativeOid4vciOffer",
-        "requestBody": {
-          "content": {
-            "application/x-www-form-urlencoded": {
-              "schema": {
-                "additionalProperties": false,
-                "properties": {
-                  "csrf_token": {
-                    "minLength": 1,
-                    "type": "string"
-                  },
-                  "selection_state": {
-                    "minLength": 1,
-                    "type": "string"
-                  },
-                  "target_id": {
-                    "maxLength": 256,
-                    "minLength": 1,
-                    "type": "string"
-                  }
-                },
-                "required": [
-                  "selection_state",
-                  "csrf_token",
-                  "target_id"
-                ],
-                "type": "object"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "content": {
-              "text/html": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            },
-            "description": "Offer page with the credential offer URI and optional tx_code PIN"
-          },
-          "400": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "Selection state, CSRF token, or represented subject is invalid"
-          },
-          "403": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "Relationship proof or issuance policy denied the transaction"
-          },
-          "404": {
-            "description": "Representative pre-authorized-code flow is disabled"
-          },
-          "429": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "Representative credential request is rate limited"
-          },
-          "500": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "OpenID4VCI issuer failed"
-          }
-        },
-        "security": [],
-        "summary": "Select a represented subject and render a pre-authorized-code offer"
-      }
-    },
-    "/oid4vci/offer/start": {
-      "get": {
-        "description": "Public and unauthenticated. Begins the eSignet authorization-code login as the confidential RP and 302-redirects the browser to eSignet. Mints no pre-authorized_code or credential material. Returns 404 when the pre-authorized-code flow is disabled. Error responses use the OpenID4VCI error envelope, not RFC 9457 Problem Details.",
-        "operationId": "startOid4vciOffer",
-        "parameters": [
-          {
-            "in": "query",
-            "name": "credential_configuration_id",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "303": {
-            "description": "Redirect to the eSignet authorization endpoint"
-          },
-          "400": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "Invalid or unknown credential configuration"
-          },
-          "404": {
-            "description": "Pre-authorized-code flow is disabled"
-          },
-          "500": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "OpenID4VCI issuer failed"
-          }
-        },
-        "security": [],
-        "summary": "Begin an authenticated pre-authorized-code offer"
-      }
-    },
-    "/oid4vci/offers": {
-      "post": {
-        "description": "Creates one short-lived pre-authorized OID4VCI offer from an existing fresh registry-backed evaluation owned by the authenticated machine client. Representative-enabled credential configurations are reserved for their authenticated browser ceremony and are rejected here. The client supplies only the evaluation id and credential configuration id. Registry Notary reloads the exact stored values, target, purpose, compiler-pinned Relay provenance, credential profile, and configuration fingerprint. The caller must present an external API-key or OIDC machine credential with registry_notary:credential_offer_create, the selected configuration scope, and exact target-scoped authorization_details for create_credential_offer; a Notary-issued wallet access token is not accepted. Idempotency-Key is required. Reusing one key with the same request returns the exact stored response, while changing the request or attempting to create another offer from the consumed evaluation returns 409. The credential_offer_uri describes the required tx_code but never contains its numeric value. The registrar must deliver that value to the holder through a separate channel. Every response is non-storable.",
-        "operationId": "createOid4vciRegistryOffer",
-        "parameters": [
-          {
-            "description": "Caller-generated retry key. Use the same key only for an exact retry of the same request.",
-            "in": "header",
-            "name": "Idempotency-Key",
-            "required": true,
-            "schema": {
-              "maxLength": 256,
-              "minLength": 1,
-              "pattern": "^[\\x21\\x23-\\x5B\\x5D-\\x7E]{1,256}$",
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RegistryClientOfferRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "credential_offer_uri": "openid-credential-offer://?credential_offer=%7B%22credential_issuer%22%3A%22https%3A%2F%2Fissuer.example.gov%22%2C%22credential_configuration_ids%22%3A%5B%22birth_certificate_sd_jwt%22%5D%2C%22grants%22%3A%7B%22urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Apre-authorized_code%22%3A%7B%22pre-authorized_code%22%3A%22fake-example-code%22%2C%22tx_code%22%3A%7B%22input_mode%22%3A%22numeric%22%2C%22length%22%3A6%7D%7D%7D%7D",
-                  "expires_at": "2026-07-29T12:05:00Z",
-                  "tx_code": "123456"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/RegistryClientOfferResponse"
-                }
-              }
-            },
-            "description": "New or exactly replayed credential offer response",
-            "headers": {
-              "Cache-Control": {
-                "description": "Prevents storage of offer, code, and transaction material.",
-                "schema": {
-                  "enum": [
-                    "no-store"
-                  ],
-                  "type": "string"
-                }
-              },
-              "Pragma": {
-                "description": "Compatibility cache directive for sensitive offer responses.",
-                "schema": {
-                  "enum": [
-                    "no-cache"
-                  ],
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "400": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "request.invalid",
-                  "detail": "the offer request or Idempotency-Key is invalid",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 400,
-                  "title": "Invalid evidence request",
-                  "type": "https://id.registrystack.org/problems/registry-notary/request/invalid"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Invalid request or idempotency key",
-            "headers": {
-              "Cache-Control": {
-                "description": "Prevents storage of offer, code, and transaction material.",
-                "schema": {
-                  "enum": [
-                    "no-store"
-                  ],
-                  "type": "string"
-                }
-              },
-              "Pragma": {
-                "description": "Compatibility cache directive for sensitive offer responses.",
-                "schema": {
-                  "enum": [
-                    "no-cache"
-                  ],
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.missing_credential",
-                  "detail": "missing authentication credential",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 401,
-                  "title": "Missing credential",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/missing_credential"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Missing or invalid machine credential",
-            "headers": {
-              "Cache-Control": {
-                "description": "Prevents storage of offer, code, and transaction material.",
-                "schema": {
-                  "enum": [
-                    "no-store"
-                  ],
-                  "type": "string"
-                }
-              },
-              "Pragma": {
-                "description": "Compatibility cache directive for sensitive offer responses.",
-                "schema": {
-                  "enum": [
-                    "no-cache"
-                  ],
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "403": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.scope_denied",
-                  "detail": "missing the offer-create or credential-configuration scope",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 403,
-                  "title": "Scope denied",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/scope_denied"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Caller lacks required authority or selected a representative-only credential configuration",
-            "headers": {
-              "Cache-Control": {
-                "description": "Prevents storage of offer, code, and transaction material.",
-                "schema": {
-                  "enum": [
-                    "no-store"
-                  ],
-                  "type": "string"
-                }
-              },
-              "Pragma": {
-                "description": "Compatibility cache directive for sensitive offer responses.",
-                "schema": {
-                  "enum": [
-                    "no-cache"
-                  ],
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "404": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "evaluation.not_found",
-                  "detail": "the evaluation is unknown, expired, or not owned by this client",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 404,
-                  "title": "Evaluation not found",
-                  "type": "https://id.registrystack.org/problems/registry-notary/evaluation/not_found"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Flow is disabled or the evaluation is unavailable to this caller",
-            "headers": {
-              "Cache-Control": {
-                "description": "Prevents storage of offer, code, and transaction material.",
-                "schema": {
-                  "enum": [
-                    "no-store"
-                  ],
-                  "type": "string"
-                }
-              },
-              "Pragma": {
-                "description": "Compatibility cache directive for sensitive offer responses.",
-                "schema": {
-                  "enum": [
-                    "no-cache"
-                  ],
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "offer_conflict",
-                  "detail": "the idempotency key conflicts or the evaluation was already consumed",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 409,
-                  "title": "Credential offer was not created",
-                  "type": "https://id.registrystack.org/problems/registry-notary/offer_conflict"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Idempotency conflict or evaluation already consumed",
-            "headers": {
-              "Cache-Control": {
-                "description": "Prevents storage of offer, code, and transaction material.",
-                "schema": {
-                  "enum": [
-                    "no-store"
-                  ],
-                  "type": "string"
-                }
-              },
-              "Pragma": {
-                "description": "Compatibility cache directive for sensitive offer responses.",
-                "schema": {
-                  "enum": [
-                    "no-cache"
-                  ],
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "429": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "evaluation.quota_exceeded",
-                  "detail": "the machine offer quota was exceeded for this principal",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 429,
-                  "title": "Machine quota exceeded",
-                  "type": "https://id.registrystack.org/problems/registry-notary/evaluation/quota_exceeded"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Offer creation is rate limited",
-            "headers": {
-              "Cache-Control": {
-                "description": "Prevents storage of offer, code, and transaction material.",
-                "schema": {
-                  "enum": [
-                    "no-store"
-                  ],
-                  "type": "string"
-                }
-              },
-              "Pragma": {
-                "description": "Compatibility cache directive for sensitive offer responses.",
-                "schema": {
-                  "enum": [
-                    "no-cache"
-                  ],
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "offer_unavailable",
-                  "detail": "the offer correctness state is unavailable",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 503,
-                  "title": "Credential offer was not created",
-                  "type": "https://id.registrystack.org/problems/registry-notary/offer_unavailable"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Offer correctness state or another required dependency is unavailable",
-            "headers": {
-              "Cache-Control": {
-                "description": "Prevents storage of offer, code, and transaction material.",
-                "schema": {
-                  "enum": [
-                    "no-store"
-                  ],
-                  "type": "string"
-                }
-              },
-              "Pragma": {
-                "description": "Compatibility cache directive for sensitive offer responses.",
-                "schema": {
-                  "enum": [
-                    "no-cache"
-                  ],
-                  "type": "string"
-                }
-              }
-            }
-          }
-        },
-        "security": [
-          {
-            "apiKeyAuth": []
-          },
-          {
-            "bearerAuth": []
-          }
-        ],
-        "summary": "Create a registrar-initiated pre-authorized offer"
-      }
-    },
-    "/oid4vci/token": {
-      "post": {
-        "description": "Public and unauthenticated OID4VCI token endpoint for the pre-authorized-code grant. Accepts only grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code with a valid, unexpired, single-use pre-authorized_code. A matching tx_code is required when the credential offer includes a tx_code object. Mints a short-TTL Notary-signed access token plus a c_nonce. Returns 404 when the pre-authorized-code flow is disabled. Error responses use the OpenID4VCI error envelope, not RFC 9457 Problem Details.",
-        "operationId": "redeemOid4vciToken",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/TokenRequest"
-              }
-            },
-            "application/x-www-form-urlencoded": {
-              "schema": {
-                "$ref": "#/components/schemas/TokenRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "access_token": "eyJhbGciOiJFZERTQSIsInR5cCI6InJlZ2lzdHJ5LW5vdGFyeS1hY2Nlc3MrancifQ.payload.signature",
-                  "c_nonce": "b64url-nonce",
-                  "c_nonce_expires_in": 300,
-                  "expires_in": 300,
-                  "token_type": "Bearer"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/TokenResponse"
-                }
-              }
-            },
-            "description": "Token response"
-          },
-          "400": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "error": "invalid_grant",
-                  "error_description": "pre-authorized code or tx_code is invalid"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "Invalid request, grant, or tx_code"
-          },
-          "404": {
-            "description": "Pre-authorized-code flow is disabled"
-          },
-          "429": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "error": "slow_down",
-                  "error_description": "too many token requests"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "Too many token attempts (wrong-PIN lockout or random-code flood)"
-          },
-          "500": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "error": "server_error",
-                  "error_description": "token issuance failed"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/Oid4vciError"
-                }
-              }
-            },
-            "description": "Token issuance failed"
-          }
-        },
-        "security": [],
-        "summary": "Redeem a pre-authorized-code for an access token"
-      }
-    },
-    "/openapi.json": {
-      "get": {
-        "operationId": "getOpenApi",
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "info": {
-                    "title": "Registry Notary API",
-                    "version": "0.16.3"
-                  },
-                  "openapi": "3.1.0",
-                  "paths": {
-                    "/v1/evaluations": {}
-                  }
-                }
-              }
-            },
-            "description": "OpenAPI document"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.missing_credential",
-                  "detail": "missing authentication credential",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 401,
-                  "title": "Missing credential",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/missing_credential"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Missing or invalid credential"
-          }
-        },
-        "summary": "Fetch this OpenAPI document"
-      }
-    },
-    "/ready": {
-      "get": {
-        "operationId": "getReady",
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "checks": {
-                    "degraded": 0,
-                    "failed": 0,
-                    "ok": 3,
-                    "relay": {
-                      "failed": 0,
-                      "ok": 1,
-                      "total": 1
-                    },
-                    "signing_providers": {
-                      "custody": {
-                        "active_provider_counts": {
-                          "pkcs11": 1
-                        },
-                        "custody_approval_required": true,
-                        "custody_approved": true,
-                        "local_software_signing_provider_count": 0,
-                        "signing_provider_count": 1,
-                        "surfaces": {
-                          "access_token_issuance": {
-                            "enabled": false,
-                            "local_software_signing_provider_count": 0,
-                            "signing_provider_count": 0,
-                            "unapproved_signing_provider_count": 0
-                          },
-                          "credential_issuance": {
-                            "local_software_signing_provider_count": 0,
-                            "signing_provider_count": 1,
-                            "unapproved_signing_provider_count": 0
-                          },
-                          "federation": {
-                            "enabled": false,
-                            "local_software_signing_provider_count": 0,
-                            "signing_provider_count": 0,
-                            "unapproved_signing_provider_count": 0
-                          }
-                        },
-                        "unapproved_signing_provider_count": 0
-                      },
-                      "failed": 0,
-                      "ok": 1,
-                      "total": 1
-                    },
-                    "total": 3
-                  },
-                  "status": "ready"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ReadinessResponse"
-                }
-              }
-            },
-            "description": "Evidence runtime is ready"
-          },
-          "4XX": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "request.invalid",
-                  "detail": "the evidence request is invalid",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 400,
-                  "title": "Invalid evidence request",
-                  "type": "https://id.registrystack.org/problems/registry-notary/request/invalid"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Client error"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "examples": {
-                  "auditChainInconsistent": {
-                    "summary": "The retained audit chain failed integrity verification",
-                    "value": {
-                      "code": "audit.chain.inconsistent",
-                      "detail": "the retained audit chain has an integrity failure and requires operator recovery",
-                      "request_id": "01J00000000000000000000000",
-                      "status": 503,
-                      "title": "Audit chain inconsistent",
-                      "type": "https://id.registrystack.org/problems/registry-notary/audit/chain-inconsistent"
-                    }
-                  },
-                  "notReady": {
-                    "summary": "A runtime readiness check is not ready",
-                    "value": {
-                      "checks": {
-                        "degraded": 1,
-                        "failed": 1,
-                        "ok": 1,
-                        "relay": {
-                          "failed": 1,
-                          "ok": 0,
-                          "total": 1
-                        },
-                        "signing_providers": {
-                          "custody": {
-                            "active_provider_counts": {
-                              "local_jwk_env": 1
-                            },
-                            "custody_approval_required": true,
-                            "custody_approved": false,
-                            "local_software_signing_provider_count": 1,
-                            "signing_provider_count": 1,
-                            "surfaces": {
-                              "access_token_issuance": {
-                                "enabled": false,
-                                "local_software_signing_provider_count": 0,
-                                "signing_provider_count": 0,
-                                "unapproved_signing_provider_count": 0
-                              },
-                              "credential_issuance": {
-                                "local_software_signing_provider_count": 1,
-                                "signing_provider_count": 1,
-                                "unapproved_signing_provider_count": 1
-                              },
-                              "federation": {
-                                "enabled": false,
-                                "local_software_signing_provider_count": 0,
-                                "signing_provider_count": 0,
-                                "unapproved_signing_provider_count": 0
-                              }
-                            },
-                            "unapproved_signing_provider_count": 1
-                          },
-                          "failed": 0,
-                          "ok": 1,
-                          "total": 1
-                        },
-                        "total": 3
-                      },
-                      "code": "readiness.not_ready",
-                      "detail": "one or more readiness checks are not ready",
-                      "readiness_status": "not_ready",
-                      "request_id": "01J00000000000000000000000",
-                      "status": 503,
-                      "title": "Evidence runtime is not ready",
-                      "type": "https://id.registrystack.org/problems/registry-notary/readiness/not-ready"
-                    }
-                  }
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ReadinessProblem"
-                }
-              }
-            },
-            "description": "Evidence runtime is not ready, is degraded, or has an inconsistent audit chain"
-          }
-        },
-        "security": [],
-        "summary": "Return the readiness probe"
-      }
-    },
-    "/v1/batch-evaluations": {
-      "post": {
-        "operationId": "batchEvaluateClaims",
-        "parameters": [
-          {
-            "description": "Required for every batch. The value is caller-bound and may contain 1 to 256 bytes.",
-            "in": "header",
-            "name": "Idempotency-Key",
-            "required": true,
-            "schema": {
-              "maxLength": 256,
-              "minLength": 1,
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/BatchEvaluateRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "batch_id": "01HX7Y4N6S7ZK0R2T8Q9V1M3PA",
-                  "claims": [
-                    "farmer-under-4ha"
-                  ],
-                  "items": [
-                    {
-                      "claim_results": [
-                        {
-                          "claim_id": "farmer-under-4ha",
-                          "claim_version": "2026-05",
-                          "disclosure": "predicate",
-                          "provenance": {
-                            "derived_from": [],
-                            "generated_by": {
-                              "claim_id": "person_is_alive",
-                              "claim_version": "1",
-                              "evaluation_id": "01HX7Y5F2WAJ7ZP0Q4M5K9E8NC",
-                              "policy_hash": "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
-                              "policy_id": "subject-access",
-                              "policy_version": "v1",
-                              "service_id": "demo.registry-notary",
-                              "type": "claim_evaluation"
-                            },
-                            "schema_version": "registry-notary-claim-provenance/v2",
-                            "used": {
-                              "relay_consultation_count": 1
-                            }
-                          },
-                          "result_id": "01HX7Y5F31M8BZWQ2HY7P6J9FA",
-                          "satisfied": true,
-                          "value": true,
-                          "value_type": "boolean"
-                        }
-                      ],
-                      "errors": [],
-                      "evaluation_id": "01HX7Y5F2WAJ7ZP0Q4M5K9E8NC",
-                      "input_index": 0,
-                      "requester_ref": {
-                        "handle": "rnref:v1:example-requester-ref",
-                        "identifier_schemes": [
-                          "agency_id"
-                        ],
-                        "profile": "benefits",
-                        "type": "Agency"
-                      },
-                      "status": "succeeded",
-                      "target_ref": {
-                        "handle": "rnref:v1:example-target-ref",
-                        "identifier_schemes": [
-                          "national_id"
-                        ],
-                        "profile": "resident",
-                        "type": "Person"
-                      }
-                    }
-                  ],
-                  "status": "completed",
-                  "summary": {
-                    "failed": 0,
-                    "succeeded": 1
-                  }
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/BatchEvaluateResponse"
-                }
-              }
-            },
-            "description": "Per-item claim evaluation results"
-          },
-          "400": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "request.invalid",
-                  "detail": "the evidence request is invalid",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 400,
-                  "title": "Invalid evidence request",
-                  "type": "https://id.registrystack.org/problems/registry-notary/request/invalid"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Invalid request, including a batch without a valid Idempotency-Key or an item that fails whole-batch preflight"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.missing_credential",
-                  "detail": "missing authentication credential",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 401,
-                  "title": "Missing credential",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/missing_credential"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Missing or invalid credential"
-          },
-          "403": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "claim.disclosure_not_allowed",
-                  "detail": "the requested disclosure profile is not allowed",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 403,
-                  "title": "Disclosure not allowed",
-                  "type": "https://id.registrystack.org/problems/registry-notary/claim/disclosure_not_allowed"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Not authorized for requested claim, purpose, disclosure, or format"
-          },
-          "406": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "format.unsupported",
-                  "detail": "the requested claim format is not supported",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 406,
-                  "title": "Claim format not supported",
-                  "type": "https://id.registrystack.org/problems/registry-notary/format/unsupported"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Requested format is not acceptable"
-          },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "request.conflict",
-                  "detail": "the request conflicts with existing state",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 409,
-                  "title": "Request conflict",
-                  "type": "https://id.registrystack.org/problems/registry-notary/request/conflict"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Idempotency key conflicts with another request body"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "batch.too_large",
-                  "detail": "the batch exceeds the platform or configured member limit",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 413,
-                  "title": "Batch too large",
-                  "type": "https://id.registrystack.org/problems/registry-notary/batch/too_large"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "The request exceeds the hard 100-member ceiling or a lower configured batch limit. Rejection occurs before quota, idempotency, Relay, source, or retained-state side effects."
-          },
-          "429": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "subject_access.rate_limited",
-                  "detail": "subject-access request is rate limited",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 429,
-                  "title": "Subject access rate limited",
-                  "type": "https://id.registrystack.org/problems/registry-notary/subject_access/rate_limited"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Subject-access request is rate limited, or the machine evaluation quota was exceeded"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "evidence.not_available",
-                  "detail": "the required evidence or operational dependency is unavailable",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 503,
-                  "title": "Evidence not available",
-                  "type": "https://id.registrystack.org/problems/registry-notary/evidence/not_available"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Required Relay consultation or operational dependency is unavailable"
-          }
-        },
-        "summary": "Evaluate claims for multiple request items inline"
-      }
-    },
-    "/v1/claims": {
-      "get": {
-        "operationId": "listClaims",
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "data": [
-                    {
-                      "cccev": null,
-                      "disclosure": {
-                        "allowed": [
-                          "value",
-                          "redacted"
-                        ],
-                        "default": "value",
-                        "downgrade": "deny"
-                      },
-                      "formats": [
-                        "application/vnd.registry-notary.claim-result+json",
-                        "application/ld+json; profile=\"cccev\""
-                      ],
-                      "id": "date-of-birth",
-                      "oots": null,
-                      "operations": {
-                        "batch_evaluate": false,
-                        "evaluate": true
-                      },
-                      "semantics": {
-                        "concept": "https://publicschema.org/Person",
-                        "property": "https://publicschema.org/date_of_birth",
-                        "value_mapping": "publicschema"
-                      },
-                      "subject_type": "person",
-                      "title": "Date of birth",
-                      "version": "2026-05"
-                    },
-                    {
-                      "cccev": {
-                        "evidence_type": "smallholder_farmer_evidence",
-                        "evidence_type_iri": "https://demo.example.gov/evidence-types/smallholder-farmer",
-                        "requirement_type": "InformationRequirement"
-                      },
-                      "disclosure": {
-                        "allowed": [
-                          "predicate",
-                          "redacted"
-                        ],
-                        "default": "predicate",
-                        "downgrade": "deny"
-                      },
-                      "evidence_type": "smallholder_farmer_evidence",
-                      "evidence_type_iri": "https://demo.example.gov/evidence-types/smallholder-farmer",
-                      "formats": [
-                        "application/vnd.registry-notary.claim-result+json",
-                        "application/ld+json; profile=\"cccev\""
-                      ],
-                      "id": "farmer-under-4ha",
-                      "oots": null,
-                      "operations": {
-                        "batch_evaluate": true,
-                        "evaluate": true
-                      },
-                      "subject_type": "person",
-                      "target_inputs": [
-                        {
-                          "confidence": "high",
-                          "groups": [
-                            {
-                              "inputs": [
-                                {
-                                  "kind": "identifier",
-                                  "label": "Farmer id",
-                                  "name": "farmer_id",
-                                  "path": "target.identifiers.farmer_id"
-                                }
-                              ]
-                            },
-                            {
-                              "inputs": [
-                                {
-                                  "kind": "attribute",
-                                  "label": "Given name",
-                                  "name": "given_name",
-                                  "path": "target.attributes.given_name"
-                                },
-                                {
-                                  "kind": "attribute",
-                                  "label": "Family name",
-                                  "name": "family_name",
-                                  "path": "target.attributes.family_name"
-                                },
-                                {
-                                  "kind": "attribute",
-                                  "label": "Birthdate",
-                                  "name": "birthdate",
-                                  "path": "target.attributes.birthdate"
-                                }
-                              ]
-                            }
-                          ],
-                          "method": "exact_name_birthdate",
-                          "policy_id": "smallholder-demographic-v1",
-                          "target_type": "Person"
-                        }
-                      ],
-                      "title": "Farmer under four hectares",
-                      "version": "2026-05"
-                    }
-                  ]
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ListClaimsResponse"
-                }
-              }
-            },
-            "description": "Visible claims"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.missing_credential",
-                  "detail": "missing authentication credential",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 401,
-                  "title": "Missing credential",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/missing_credential"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Missing or invalid credential"
-          }
-        },
-        "summary": "List claims visible to the caller"
-      }
-    },
-    "/v1/claims/{claim_id}": {
-      "get": {
-        "operationId": "getClaim",
-        "parameters": [
-          {
-            "in": "path",
-            "name": "claim_id",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "cccev": {
-                    "evidence_type": "smallholder_farmer_evidence",
-                    "evidence_type_iri": "https://demo.example.gov/evidence-types/smallholder-farmer",
-                    "requirement_type": "InformationRequirement"
-                  },
-                  "disclosure": {
-                    "allowed": [
-                      "predicate",
-                      "redacted"
-                    ],
-                    "default": "predicate",
-                    "downgrade": "deny"
-                  },
-                  "evidence_type": "smallholder_farmer_evidence",
-                  "evidence_type_iri": "https://demo.example.gov/evidence-types/smallholder-farmer",
-                  "formats": [
-                    "application/vnd.registry-notary.claim-result+json",
-                    "application/ld+json; profile=\"cccev\""
-                  ],
-                  "id": "farmer-under-4ha",
-                  "oots": null,
-                  "operations": {
-                    "batch_evaluate": true,
-                    "evaluate": true
-                  },
-                  "subject_type": "person",
-                  "target_inputs": [
-                    {
-                      "confidence": "high",
-                      "groups": [
-                        {
-                          "inputs": [
-                            {
-                              "kind": "identifier",
-                              "label": "Farmer id",
-                              "name": "farmer_id",
-                              "path": "target.identifiers.farmer_id"
-                            }
-                          ]
-                        },
-                        {
-                          "inputs": [
-                            {
-                              "kind": "attribute",
-                              "label": "Given name",
-                              "name": "given_name",
-                              "path": "target.attributes.given_name"
-                            },
-                            {
-                              "kind": "attribute",
-                              "label": "Family name",
-                              "name": "family_name",
-                              "path": "target.attributes.family_name"
-                            },
-                            {
-                              "kind": "attribute",
-                              "label": "Birthdate",
-                              "name": "birthdate",
-                              "path": "target.attributes.birthdate"
-                            }
-                          ]
-                        }
-                      ],
-                      "method": "exact_name_birthdate",
-                      "policy_id": "smallholder-demographic-v1",
-                      "target_type": "Person"
-                    }
-                  ],
-                  "title": "Farmer under four hectares",
-                  "version": "2026-05"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ClaimSummary"
-                }
-              }
-            },
-            "description": "Claim definition"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.missing_credential",
-                  "detail": "missing authentication credential",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 401,
-                  "title": "Missing credential",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/missing_credential"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Missing or invalid credential"
-          },
-          "404": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "claim.not_found",
-                  "detail": "the requested claim is not available",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 404,
-                  "title": "Claim not found",
-                  "type": "https://id.registrystack.org/problems/registry-notary/claim/not_found"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Claim not found"
-          }
-        },
-        "summary": "Get one claim definition"
-      }
-    },
-    "/v1/credentials": {
-      "post": {
-        "description": "Issues only when a fresh non-delegated registry-backed evaluation has exact compiler pins and normalized unique Relay executions for every selected root's dependency closure, matching the active configuration and public evaluation result. Representative issuance uses the separately configured OpenID4VCI ceremony.",
-        "operationId": "issueCredential",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CredentialIssueRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "credential": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRjK3NkLWp3dCIsImtpZCI6ImRpZDp3ZWI6YWdyaWN1bHR1cmUuZGVtby5leGFtcGxlLmdvdiNyZWdpc3RyeS13aXRuZXNzLWRlbW8ta2V5LTEifQ.eyJpc3MiOiJkaWQ6d2ViOmFncmljdWx0dXJlLmRlbW8uZXhhbXBsZS5nb3YiLCJzdWIiOiJkaWQ6andrOmV5SnJkSGtpT2lKUFMxQWlMQ0pqY25ZaU9pSkZaREkxTlRFNUlpd2llQ0k2SWpFeGNWbEJXVXQ0UTNKbVZsTmZNMWhFWWxoS1F6SkJaMWxKTlRkeFdIcGpVemRRTUZjMVdUbG1ORmtpZlEiLCJpYXQiOjE3Nzk2MjQwMDAsImV4cCI6MTc3OTcxMDQwMCwidmN0IjoiaHR0cHM6Ly9kZW1vLmV4YW1wbGUuZ292L2NyZWRlbnRpYWxzL3NtYWxsaG9sZGVyLWZhcm1lci92MSIsImp0aSI6InVybjpyZWdpc3RyeS13aXRuZXNzOmNyZWRlbnRpYWw6MDFIWDdZNUYyV0FKN1pQMFE0TTVLOUU4TkMiLCJpZCI6InVybjpyZWdpc3RyeS13aXRuZXNzOmNyZWRlbnRpYWw6MDFIWDdZNUYyV0FKN1pQMFE0TTVLOUU4TkMiLCJfc2QiOlsia0ZxYXpKcDdleVhjS1ZIX0tiMzNnQ1lwMGM3dzFDLWd0WjVORkJxbDdYcyJdLCJjbmYiOnsia2lkIjoiZGlkOmp3azpleUpyZEhraU9pSlBTMUFpTENKamNuWWlPaUpGWkRJMU5URTVJaXdpZUNJNklqRXhjVmxCV1V0NFEzSm1WbE5mTTFoRVlsaEtRekpCWjFsSk5UZHhXSHBqVXpkUU1GYzFXVGxtTkZraWZRIiwiandrIjp7Imt0eSI6Ik9LUCIsImNydiI6IkVkMjU1MTkiLCJ4IjoiMTFxWUFZS3hDcmZWU18zWERiWEpDMkFnWUk1N3FYemNTN1AwVzVZOWY0WSJ9fX0.c2lnbmF0dXJl~ZGlzY2xvc3VyZQ~",
-                  "credential_id": "urn:registry-notary:credential:01HX7Y5F2WAJ7ZP0Q4M5K9E8NC",
-                  "credential_profile": "climate_smart_input_voucher_sd_jwt",
-                  "disclosures": [
-                    "ZGlzY2xvc3VyZQ"
-                  ],
-                  "expires_at": "2026-05-25T12:00:00Z",
-                  "format": "application/dc+sd-jwt",
-                  "issuer": "did:web:agriculture.demo.example.gov",
-                  "issuer_signed_jwt": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRjK3NkLWp3dCIsImtpZCI6ImRpZDp3ZWI6YWdyaWN1bHR1cmUuZGVtby5leGFtcGxlLmdvdiNyZWdpc3RyeS13aXRuZXNzLWRlbW8ta2V5LTEifQ.eyJpc3MiOiJkaWQ6d2ViOmFncmljdWx0dXJlLmRlbW8uZXhhbXBsZS5nb3YiLCJzdWIiOiJkaWQ6andrOmV5SnJkSGtpT2lKUFMxQWlMQ0pqY25ZaU9pSkZaREkxTlRFNUlpd2llQ0k2SWpFeGNWbEJXVXQ0UTNKbVZsTmZNMWhFWWxoS1F6SkJaMWxKTlRkeFdIcGpVemRRTUZjMVdUbG1ORmtpZlEiLCJpYXQiOjE3Nzk2MjQwMDAsImV4cCI6MTc3OTcxMDQwMCwidmN0IjoiaHR0cHM6Ly9kZW1vLmV4YW1wbGUuZ292L2NyZWRlbnRpYWxzL3NtYWxsaG9sZGVyLWZhcm1lci92MSIsImp0aSI6InVybjpyZWdpc3RyeS13aXRuZXNzOmNyZWRlbnRpYWw6MDFIWDdZNUYyV0FKN1pQMFE0TTVLOUU4TkMiLCJpZCI6InVybjpyZWdpc3RyeS13aXRuZXNzOmNyZWRlbnRpYWw6MDFIWDdZNUYyV0FKN1pQMFE0TTVLOUU4TkMiLCJfc2QiOlsia0ZxYXpKcDdleVhjS1ZIX0tiMzNnQ1lwMGM3dzFDLWd0WjVORkJxbDdYcyJdLCJjbmYiOnsia2lkIjoiZGlkOmp3azpleUpyZEhraU9pSlBTMUFpTENKamNuWWlPaUpGWkRJMU5URTVJaXdpZUNJNklqRXhjVmxCV1V0NFEzSm1WbE5mTTFoRVlsaEtRekpCWjFsSk5UZHhXSHBqVXpkUU1GYzFXVGxtTkZraWZRIiwiandrIjp7Imt0eSI6Ik9LUCIsImNydiI6IkVkMjU1MTkiLCJ4IjoiMTFxWUFZS3hDcmZWU18zWERiWEpDMkFnWUk1N3FYemNTN1AwVzVZOWY0WSJ9fX0.c2lnbmF0dXJl"
-                }
-              }
-            },
-            "description": "Issued credential"
-          },
-          "400": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "credential.holder_proof_required",
-                  "detail": "holder proof of possession is required",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 400,
-                  "title": "Holder proof required",
-                  "type": "https://id.registrystack.org/problems/registry-notary/credential/holder_proof_required"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Invalid request or disclosure widening attempt"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.missing_credential",
-                  "detail": "missing authentication credential",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 401,
-                  "title": "Missing credential",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/missing_credential"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Missing or invalid credential"
-          },
-          "404": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "evaluation.not_found",
-                  "detail": "the evaluation id is unknown or expired",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 404,
-                  "title": "Evaluation not found",
-                  "type": "https://id.registrystack.org/problems/registry-notary/evaluation/not_found"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Evaluation not found"
-          },
-          "406": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "format.unsupported",
-                  "detail": "the requested claim format is not supported",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 406,
-                  "title": "Claim format not supported",
-                  "type": "https://id.registrystack.org/problems/registry-notary/format/unsupported"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Requested format is not acceptable"
-          },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "request.conflict",
-                  "detail": "the request conflicts with existing state",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 409,
-                  "title": "Request conflict",
-                  "type": "https://id.registrystack.org/problems/registry-notary/request/conflict"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Holder proof replay or Relay ambiguity conflict"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "request.too_large",
-                  "detail": "the request body or batch is too large",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 413,
-                  "title": "Request too large",
-                  "type": "https://id.registrystack.org/problems/registry-notary/request/too_large"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Request body is too large"
-          },
-          "429": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "subject_access.rate_limited",
-                  "detail": "subject-access request is rate limited",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 429,
-                  "title": "Subject access rate limited",
-                  "type": "https://id.registrystack.org/problems/registry-notary/subject_access/rate_limited"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Subject-access request is rate limited"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "evidence.not_available",
-                  "detail": "the required evidence or operational dependency is unavailable",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 503,
-                  "title": "Evidence not available",
-                  "type": "https://id.registrystack.org/problems/registry-notary/evidence/not_available"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Required Relay consultation or operational dependency is unavailable"
-          }
-        },
-        "summary": "Issue a credential from a stored evaluation"
-      }
-    },
-    "/v1/credentials/{credential_id}/status": {
-      "get": {
-        "operationId": "getCredentialStatus",
-        "parameters": [
-          {
-            "in": "path",
-            "name": "credential_id",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "credential_id": "urn:ulid:01HX7Y5F2WAJ7ZP0Q4M5K9E8NC",
-                  "credential_profile": "civil_status_sd_jwt",
-                  "expires_at": "2026-05-25T12:10:00Z",
-                  "issued_at": "2026-05-25T12:00:00Z",
-                  "issuer": "did:web:issuer.example",
-                  "status": "valid",
-                  "updated_at": "2026-05-25T12:00:00Z"
-                }
-              }
-            },
-            "description": "Credential status record"
-          },
-          "404": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "credential_status.not_found",
-                  "detail": "credential status record was not found",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 404,
-                  "title": "Credential status not found",
-                  "type": "https://id.registrystack.org/problems/registry-notary/credential_status/not_found"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Credential status is disabled or not found"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "credential_status.unavailable",
-                  "detail": "credential status store is unavailable",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 503,
-                  "title": "Credential status unavailable",
-                  "type": "https://id.registrystack.org/problems/registry-notary/credential_status/unavailable"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Credential status store is unavailable"
-          }
-        },
-        "security": [],
-        "summary": "Fetch credential lifecycle status"
-      }
-    },
-    "/v1/evaluations": {
-      "post": {
-        "operationId": "evaluateClaims",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/EvaluateRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "results": [
-                    {
-                      "claim_id": "farmer-under-4ha",
-                      "claim_version": "2026-05",
-                      "disclosure": "predicate",
-                      "evaluation_id": "01HX7Y5F2WAJ7ZP0Q4M5K9E8NC",
-                      "expires_at": "2026-05-25T12:00:00Z",
-                      "format": "application/vnd.registry-notary.claim-result+json",
-                      "issued_at": "2026-05-24T12:00:00Z",
-                      "provenance": {
-                        "derived_from": [],
-                        "generated_by": {
-                          "claim_id": "person_is_alive",
-                          "claim_version": "1",
-                          "evaluation_id": "01HX7Y5F2WAJ7ZP0Q4M5K9E8NC",
-                          "policy_hash": "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
-                          "policy_id": "subject-access",
-                          "policy_version": "v1",
-                          "service_id": "demo.registry-notary",
-                          "type": "claim_evaluation"
-                        },
-                        "schema_version": "registry-notary-claim-provenance/v2",
-                        "used": {
-                          "relay_consultation_count": 1
-                        }
-                      },
-                      "requester_ref": {
-                        "handle": "rnref:v1:example-requester-ref",
-                        "identifier_schemes": [
-                          "agency_id"
-                        ],
-                        "profile": "benefits",
-                        "type": "Agency"
-                      },
-                      "satisfied": true,
-                      "subject_type": "person",
-                      "target_ref": {
-                        "handle": "rnref:v1:example-target-ref",
-                        "identifier_schemes": [
-                          "national_id"
-                        ],
-                        "profile": "resident",
-                        "type": "Person"
-                      },
-                      "value": true
-                    }
-                  ]
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/EvaluationResponse"
-                }
-              }
-            },
-            "description": "Claim evaluation result"
-          },
-          "400": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "request.invalid",
-                  "detail": "the evidence request is invalid",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 400,
-                  "title": "Invalid evidence request",
-                  "type": "https://id.registrystack.org/problems/registry-notary/request/invalid"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Invalid request"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.missing_credential",
-                  "detail": "missing authentication credential",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 401,
-                  "title": "Missing credential",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/missing_credential"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Missing or invalid credential"
-          },
-          "403": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.scope_denied",
-                  "detail": "missing required scope",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 403,
-                  "title": "Scope denied",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/scope_denied"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Not authorized for requested claim, purpose, disclosure, or format"
-          },
-          "406": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "format.unsupported",
-                  "detail": "the requested claim format is not supported",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 406,
-                  "title": "Claim format not supported",
-                  "type": "https://id.registrystack.org/problems/registry-notary/format/unsupported"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Requested format is not acceptable"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "request.too_large",
-                  "detail": "the request body or batch is too large",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 413,
-                  "title": "Request too large",
-                  "type": "https://id.registrystack.org/problems/registry-notary/request/too_large"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Request body is too large"
-          },
-          "429": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "subject_access.rate_limited",
-                  "detail": "subject-access request is rate limited",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 429,
-                  "title": "Subject access rate limited",
-                  "type": "https://id.registrystack.org/problems/registry-notary/subject_access/rate_limited"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Subject-access request is rate limited, or the machine evaluation quota was exceeded"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "evidence.not_available",
-                  "detail": "the required evidence or operational dependency is unavailable",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 503,
-                  "title": "Evidence not available",
-                  "type": "https://id.registrystack.org/problems/registry-notary/evidence/not_available"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Required Relay consultation or operational dependency is unavailable"
-          }
-        },
-        "summary": "Evaluate claims for one target"
-      }
-    },
-    "/v1/evaluations/{evaluation_id}/render": {
-      "post": {
-        "operationId": "renderEvidence",
-        "parameters": [
-          {
-            "in": "path",
-            "name": "evaluation_id",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RenderEvaluationRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "results": [
-                    {
-                      "claim_id": "farmer-under-4ha",
-                      "claim_version": "2026-05",
-                      "disclosure": "predicate",
-                      "evaluation_id": "01HX7Y5F2WAJ7ZP0Q4M5K9E8NC",
-                      "expires_at": "2026-05-25T12:00:00Z",
-                      "format": "application/vnd.registry-notary.claim-result+json",
-                      "issued_at": "2026-05-24T12:00:00Z",
-                      "provenance": {
-                        "derived_from": [],
-                        "generated_by": {
-                          "claim_id": "person_is_alive",
-                          "claim_version": "1",
-                          "evaluation_id": "01HX7Y5F2WAJ7ZP0Q4M5K9E8NC",
-                          "policy_hash": "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
-                          "policy_id": "subject-access",
-                          "policy_version": "v1",
-                          "service_id": "demo.registry-notary",
-                          "type": "claim_evaluation"
-                        },
-                        "schema_version": "registry-notary-claim-provenance/v2",
-                        "used": {
-                          "relay_consultation_count": 1
-                        }
-                      },
-                      "requester_ref": {
-                        "handle": "rnref:v1:example-requester-ref",
-                        "identifier_schemes": [
-                          "agency_id"
-                        ],
-                        "profile": "benefits",
-                        "type": "Agency"
-                      },
-                      "satisfied": true,
-                      "subject_type": "person",
-                      "target_ref": {
-                        "handle": "rnref:v1:example-target-ref",
-                        "identifier_schemes": [
-                          "national_id"
-                        ],
-                        "profile": "resident",
-                        "type": "Person"
-                      },
-                      "value": true
-                    }
-                  ]
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/EvaluationResponse"
-                }
-              }
-            },
-            "description": "Rendered evidence artifact"
-          },
-          "400": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "request.invalid",
-                  "detail": "the evidence request is invalid",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 400,
-                  "title": "Invalid evidence request",
-                  "type": "https://id.registrystack.org/problems/registry-notary/request/invalid"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Invalid request or disclosure widening attempt"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.missing_credential",
-                  "detail": "missing authentication credential",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 401,
-                  "title": "Missing credential",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/missing_credential"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Missing or invalid credential"
-          },
-          "404": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "evaluation.not_found",
-                  "detail": "the evaluation id is unknown or expired",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 404,
-                  "title": "Evaluation not found",
-                  "type": "https://id.registrystack.org/problems/registry-notary/evaluation/not_found"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Evaluation not found"
-          },
-          "406": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "format.unsupported",
-                  "detail": "the requested claim format is not supported",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 406,
-                  "title": "Claim format not supported",
-                  "type": "https://id.registrystack.org/problems/registry-notary/format/unsupported"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Requested format is not acceptable"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "request.too_large",
-                  "detail": "the request body or batch is too large",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 413,
-                  "title": "Request too large",
-                  "type": "https://id.registrystack.org/problems/registry-notary/request/too_large"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Request body is too large"
-          },
-          "429": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "subject_access.rate_limited",
-                  "detail": "subject-access request is rate limited",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 429,
-                  "title": "Subject access rate limited",
-                  "type": "https://id.registrystack.org/problems/registry-notary/subject_access/rate_limited"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Subject-access request is rate limited"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "evidence.not_available",
-                  "detail": "the required evidence or operational dependency is unavailable",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 503,
-                  "title": "Evidence not available",
-                  "type": "https://id.registrystack.org/problems/registry-notary/evidence/not_available"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Required Relay consultation or operational dependency is unavailable"
-          }
-        },
-        "summary": "Render a stored evaluation"
-      }
-    },
-    "/v1/formats": {
-      "get": {
-        "operationId": "listFormats",
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "example": {
-                  "formats": [
-                    {
-                      "id": "application/dc+sd-jwt",
-                      "kind": "credential",
-                      "status": "enabled"
-                    },
-                    {
-                      "id": "application/ld+json; profile=\"cccev\"",
-                      "kind": "renderer",
-                      "status": "enabled"
-                    },
-                    {
-                      "id": "application/vnd.registry-notary.claim-result+json",
-                      "kind": "claim_result",
-                      "status": "enabled"
-                    }
-                  ]
-                }
-              }
-            },
-            "description": "Supported formats"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "example": {
-                  "code": "auth.missing_credential",
-                  "detail": "missing authentication credential",
-                  "request_id": "01J00000000000000000000000",
-                  "status": 401,
-                  "title": "Missing credential",
-                  "type": "https://id.registrystack.org/problems/registry-notary/auth/missing_credential"
-                },
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            },
-            "description": "Missing or invalid credential"
-          }
-        },
-        "summary": "List supported output formats"
-      }
-    }
-  },
-  "security": [
-    {
-      "apiKeyAuth": []
-    },
-    {
-      "bearerAuth": []
-    }
-  ]
-}
diff --git a/products/notary/scripts/cargo-deny-check.sh b/products/notary/scripts/cargo-deny-check.sh
deleted file mode 100755
index c416ecfc0..000000000
--- a/products/notary/scripts/cargo-deny-check.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-required_version="0.19.8"
-script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-repo_dir="$(cd -- "$script_dir/.." && pwd)"
-workspace_dir="$(cd -- "$repo_dir/../.." && pwd)"
-tool_root="$repo_dir/target/codex-tools"
-tool_bin="$tool_root/bin/cargo-deny"
-
-installed_version=""
-if [[ -x "$tool_bin" ]]; then
-  installed_version="$("$tool_bin" --version | awk '{print $2}')"
-fi
-
-if [[ "$installed_version" != "$required_version" ]]; then
-  cargo install cargo-deny \
-    --version "$required_version" \
-    --locked \
-    --root "$tool_root"
-fi
-
-cd "$workspace_dir"
-exec "$tool_bin" --all-features check "$@"
diff --git a/products/notary/scripts/check-openapi-contract.sh b/products/notary/scripts/check-openapi-contract.sh
deleted file mode 100755
index c79b1a412..000000000
--- a/products/notary/scripts/check-openapi-contract.sh
+++ /dev/null
@@ -1,66 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$ROOT"
-
-SPEC_PATH="openapi/registry-notary.openapi.json"
-BASE_REF="${1:-${OPENAPI_CONTRACT_BASE_REF:-}}"
-WORK_DIR="target/openapi-contract"
-GENERATED="$WORK_DIR/generated.openapi.json"
-BASELINE="$WORK_DIR/base.openapi.json"
-
-mkdir -p "$WORK_DIR"
-
-cargo run -q -p registry-notary -- openapi > "$GENERATED"
-
-python3 - "$SPEC_PATH" "$GENERATED" <<'PY'
-import json
-import sys
-from pathlib import Path
-
-committed = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
-generated = json.loads(Path(sys.argv[2]).read_text(encoding="utf-8"))
-if committed != generated:
-    raise SystemExit("generated OpenAPI differs from committed baseline")
-PY
-
-if [[ -z "$BASE_REF" ]]; then
-    echo "OPENAPI_CONTRACT_BASE_REF not set; skipped breaking-change diff"
-    exit 0
-fi
-
-if ! command -v oasdiff >/dev/null 2>&1; then
-    echo "oasdiff is required when OPENAPI_CONTRACT_BASE_REF is set" >&2
-    exit 1
-fi
-
-if ! git rev-parse --verify "$BASE_REF^{commit}" >/dev/null 2>&1; then
-    echo "OpenAPI contract base ref '$BASE_REF' is not available" >&2
-    exit 1
-fi
-
-# git's <rev>:<path> object syntax resolves <path> relative to the repo
-# root, not the current working directory. Compute the repo-root-relative
-# form of SPEC_PATH and verify it points at the same file before trusting
-# git's answer for whether that path exists at BASE_REF: a wrong
-# computation must fail loudly here, not be read as "genuinely absent at
-# the base ref" later.
-REPO_PREFIX="$(git rev-parse --show-prefix)"
-REPO_ROOT="$(git rev-parse --show-toplevel)"
-SPEC_PATH_FROM_ROOT="${REPO_PREFIX}${SPEC_PATH}"
-if [[ ! "$REPO_ROOT/$SPEC_PATH_FROM_ROOT" -ef "$SPEC_PATH" ]]; then
-    echo "failed to resolve repo-root-relative path for '$SPEC_PATH' (got '$SPEC_PATH_FROM_ROOT'); refusing to run base-ref comparison" >&2
-    exit 1
-fi
-
-if ! git cat-file -e "$BASE_REF:$SPEC_PATH_FROM_ROOT" 2>/dev/null; then
-    echo "OpenAPI spec did not exist at '$BASE_REF'; skipped breaking-change diff"
-    exit 0
-fi
-
-git show "$BASE_REF:$SPEC_PATH_FROM_ROOT" > "$BASELINE"
-
-# Accepted one-time diffs live in the ignore file; see its header comment.
-oasdiff breaking --fail-on ERR --err-ignore openapi/oasdiff-err-ignore.txt \
-    "$BASELINE" "$GENERATED"
diff --git a/products/notary/scripts/check-security.sh b/products/notary/scripts/check-security.sh
deleted file mode 100755
index 8671696b9..000000000
--- a/products/notary/scripts/check-security.sh
+++ /dev/null
@@ -1,69 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0
-set -euo pipefail
-
-mkdir -p target/security
-
-run_optional() {
-  local name="$1"
-  shift
-  if command -v "$name" >/dev/null 2>&1; then
-    "$@"
-  else
-    echo "security check advisory: $name is not installed; skipped" >&2
-  fi
-}
-
-run_zizmor_ratchet() {
-  if command -v zizmor >/dev/null 2>&1; then
-    zizmor --format json --no-exit-codes . > target/security/zizmor.json
-  elif command -v uvx >/dev/null 2>&1; then
-    uvx zizmor --format json --no-exit-codes . > target/security/zizmor.json
-  else
-    echo "security check advisory: zizmor is not installed; skipped" >&2
-    return
-  fi
-  python3 scripts/check_advisory_baselines.py zizmor target/security/zizmor.json
-}
-
-python3 scripts/check_security_assurance.py
-
-if command -v gitleaks >/dev/null 2>&1; then
-  gitleaks detect --source . --redact --no-banner --no-git --config .gitleaks.toml
-else
-  echo "security check advisory: gitleaks is not installed; skipped" >&2
-fi
-
-run_optional actionlint actionlint
-run_zizmor_ratchet
-
-if command -v hadolint >/dev/null 2>&1; then
-  hadolint --ignore DL3022 Dockerfile
-else
-  echo "security check advisory: hadolint is not installed; skipped" >&2
-fi
-
-if command -v semgrep >/dev/null 2>&1; then
-  semgrep --config .semgrep.yml --error --no-git-ignore \
-    --exclude target --exclude .git --exclude .venv --exclude node_modules .
-elif command -v uvx >/dev/null 2>&1; then
-  uvx semgrep --config .semgrep.yml --error --no-git-ignore \
-    --exclude target --exclude .git --exclude .venv --exclude node_modules .
-else
-  echo "security check advisory: semgrep is not installed; skipped" >&2
-fi
-
-cat > target/security/security-assurance-report.md <<'EOF'
-# Registry Notary Security Assurance Report
-
-- Exposure manifest: checked by `scripts/check_security_assurance.py`.
-- OpenAPI: generated output compared with `openapi/registry-notary.openapi.json`.
-- Secret scan: gitleaks ran when available.
-- GitHub Actions: actionlint and zizmor ran when available.
-- Advisory ratchets: reviewed baseline gates ran for zizmor high findings.
-- Container static checks: Dockerfile secret-copy checks ran; hadolint ran when available.
-- Semgrep: repo-local policy ran when available.
-- Skipped checks: see command output for unavailable local tools.
-EOF
-
-echo "security checks completed"
diff --git a/products/notary/scripts/check_advisory_baselines.py b/products/notary/scripts/check_advisory_baselines.py
deleted file mode 100644
index 4a890d2a3..000000000
--- a/products/notary/scripts/check_advisory_baselines.py
+++ /dev/null
@@ -1,735 +0,0 @@
-#!/usr/bin/env python3
-# SPDX-License-Identifier: Apache-2.0
-"""Fail CI when advisory security tools report unreviewed blocking findings."""
-
-from __future__ import annotations
-
-import argparse
-import datetime as dt
-import json
-import re
-import sys
-from dataclasses import dataclass
-from pathlib import Path
-from typing import Any
-
-
-ROOT = Path(__file__).resolve().parents[1]
-DEFAULT_BASELINE = ROOT / "security" / "advisory-baseline.json"
-
-SEVERITY_ORDER = {
-    "unknown": 0,
-    "undefined": 0,
-    "informational": 0,
-    "negligible": 0,
-    "low": 1,
-    "medium": 2,
-    "moderate": 2,
-    "high": 3,
-    "critical": 4,
-}
-GRYPE_FIX_STATES = {"fixed", "not-fixed", "wont-fix"}
-SHA256_DIGEST_RE = re.compile(r"sha256:[0-9a-f]{64}")
-SEMVER_RE = re.compile(r"[0-9]+\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?")
-SUPPORTED_SYFT_SCHEMA_MAJOR = 16
-REQUIRED_INVALIDATION_TRIGGERS = {
-    "package_version_changed",
-    "fix_available",
-    "expired",
-    "material_finding_changed",
-}
-V3_TOP_LEVEL_FIELDS = {"version", "service", "policies", "exceptions"}
-V3_EXCEPTION_FIELDS = {
-    "vulnerability_id",
-    "package",
-    "installed_version",
-    "severity",
-    "status",
-    "owner",
-    "rationale",
-    "reviewed_at",
-    "expires_at",
-    "invalidation_triggers",
-}
-V3_EXCEPTION_STATUSES = {"accepted_risk", "false_positive", "tool_noise"}
-
-
-@dataclass(frozen=True)
-class Finding:
-    tool: str
-    fingerprint: str
-    rule_id: str
-    severity: str
-    location: str
-    summary: str
-    package: str = ""
-    installed_version: str = ""
-    package_type: str = ""
-    fix_versions: tuple[str, ...] = ()
-    fix_state: str = ""
-    image_digest: str = ""
-
-    @property
-    def fixable(self) -> bool:
-        return bool(self.fix_versions) or self.fix_state == "fixed"
-
-    @property
-    def exception_key(self) -> tuple[str, str, str]:
-        return (self.rule_id, self.package, self.installed_version)
-
-    @property
-    def advisory_key(self) -> tuple[str, str]:
-        return (self.rule_id, self.package)
-
-    def to_json(self) -> dict[str, Any]:
-        return {
-            "tool": self.tool,
-            "vulnerability_id": self.rule_id,
-            "package": self.package,
-            "installed_version": self.installed_version,
-            "severity": self.severity,
-            "location": self.location,
-            "summary": self.summary,
-            "fixable": self.fixable,
-            "fix_versions": list(self.fix_versions),
-            "fix_state": self.fix_state,
-            "image_digest": self.image_digest,
-        }
-
-
-def fail(message: str) -> None:
-    print(f"advisory baseline check failed: {message}", file=sys.stderr)
-    raise SystemExit(1)
-
-
-def display_path(path: Path) -> str:
-    try:
-        return str(path.relative_to(ROOT))
-    except ValueError:
-        return str(path)
-
-
-def load_json(path: Path) -> Any:
-    try:
-        return json.loads(path.read_text(encoding="utf-8"))
-    except FileNotFoundError:
-        fail(f"missing required file: {display_path(path)}")
-    except json.JSONDecodeError as exc:
-        fail(f"{display_path(path)} is not valid JSON: {exc}")
-
-
-def nonblank(value: Any, field: str) -> str:
-    if not isinstance(value, str) or not value.strip():
-        fail(f"{field} must be a non-blank string")
-    return value.strip()
-
-
-def severity_rank(value: Any) -> int:
-    if not isinstance(value, str) or value.casefold() not in SEVERITY_ORDER:
-        fail(f"unknown severity value: {value}")
-    return SEVERITY_ORDER[value.casefold()]
-
-
-def parse_date(value: Any, field: str) -> dt.date:
-    if not isinstance(value, str):
-        fail(f"{field} must be an ISO date")
-    try:
-        return dt.date.fromisoformat(value)
-    except ValueError:
-        fail(f"{field} must be an ISO date: {value}")
-
-
-def normalize_path(value: str | None) -> str:
-    if not value:
-        return "<unknown>"
-    return value[2:] if value.startswith("./") else value
-
-
-def route_key(route: Any) -> str:
-    if not isinstance(route, dict) or not isinstance(route.get("route"), list):
-        return ""
-    parts = []
-    for entry in route["route"]:
-        if isinstance(entry, dict) and "Key" in entry:
-            parts.append(f"k:{entry['Key']}")
-        elif isinstance(entry, dict) and "Index" in entry:
-            parts.append(f"i:{entry['Index']}")
-    return "/".join(parts)
-
-
-def primary_location(locations: Any) -> dict[str, Any]:
-    if not isinstance(locations, list):
-        return {}
-    for location in locations:
-        if not isinstance(location, dict):
-            continue
-        symbolic = location.get("symbolic", {})
-        if isinstance(symbolic, dict) and symbolic.get("kind") == "Primary":
-            return location
-    return locations[0] if locations and isinstance(locations[0], dict) else {}
-
-
-def normalize_zizmor(report: Any) -> list[Finding]:
-    if not isinstance(report, list):
-        fail("zizmor report must be a JSON list")
-    findings: list[Finding] = []
-    for item in report:
-        if not isinstance(item, dict):
-            fail("zizmor findings must be objects")
-        if item.get("ignored"):
-            continue
-        determinations = item.get("determinations")
-        if not isinstance(determinations, dict):
-            fail("zizmor finding determinations must be an object")
-        severity = nonblank(determinations.get("severity"), "zizmor severity").lower()
-        severity_rank(severity)
-        ident = nonblank(item.get("ident"), "zizmor ident")
-        location = primary_location(item.get("locations"))
-        symbolic = location.get("symbolic", {}) if isinstance(location, dict) else {}
-        concrete = location.get("concrete", {}) if isinstance(location, dict) else {}
-        key = symbolic.get("key", {}) if isinstance(symbolic, dict) else {}
-        local = key.get("Local", {}) if isinstance(key, dict) else {}
-        path = normalize_path(
-            local.get("given_path") if isinstance(local, dict) else None
-        )
-        annotation = (
-            str(symbolic.get("annotation", "")) if isinstance(symbolic, dict) else ""
-        )
-        feature = str(concrete.get("feature", "")) if isinstance(concrete, dict) else ""
-        route = route_key(symbolic.get("route") if isinstance(symbolic, dict) else None)
-        detail = (
-            feature if ident == "unpinned-uses" and feature else annotation or feature
-        )
-        findings.append(
-            Finding(
-                tool="zizmor",
-                fingerprint="|".join(["zizmor", ident, path, route, detail]),
-                rule_id=ident,
-                severity=severity,
-                location=path,
-                summary=str(item.get("desc") or annotation or feature or ident),
-            )
-        )
-    return findings
-
-
-def validate_descriptor(report: dict[str, Any], tool: str) -> None:
-    descriptor = report.get("descriptor")
-    if not isinstance(descriptor, dict):
-        fail(f"{tool} report must contain a descriptor object")
-    if descriptor.get("name") != tool:
-        fail(f"unsupported {tool} report descriptor name: {descriptor.get('name')}")
-    version = nonblank(descriptor.get("version"), f"{tool} descriptor version")
-    if SEMVER_RE.fullmatch(version.lstrip("v")) is None:
-        fail(f"{tool} descriptor version is unsupported: {version}")
-    if tool == "syft":
-        schema = report.get("schema")
-        if not isinstance(schema, dict):
-            fail("syft report must contain a schema object")
-        schema_version = nonblank(schema.get("version"), "syft schema version")
-        if (
-            SEMVER_RE.fullmatch(schema_version) is None
-            or int(schema_version.split(".", 1)[0]) != SUPPORTED_SYFT_SCHEMA_MAJOR
-        ):
-            fail(f"unsupported syft schema version: {schema_version}")
-
-
-def image_evidence(report: Any, tool: str, target_key: str) -> str:
-    if not isinstance(report, dict):
-        fail(f"{tool} report must be a JSON object")
-    validate_descriptor(report, tool)
-    source = report.get("source")
-    if not isinstance(source, dict) or source.get("type") != "image":
-        fail(f"{tool} report source must describe an image")
-    target = source.get(target_key)
-    if not isinstance(target, dict):
-        fail(f"{tool} report source must contain image metadata")
-    user_input = target.get("userInput")
-    if not isinstance(user_input, str) or "@" not in user_input:
-        fail(f"{tool} image target must be pinned by digest")
-    digest = user_input.rsplit("@", 1)[1]
-    if SHA256_DIGEST_RE.fullmatch(digest) is None:
-        fail(f"{tool} image target must use a sha256 digest")
-    repo_digests = target.get("repoDigests")
-    if (
-        not isinstance(repo_digests, list)
-        or not any(
-            isinstance(repo_digest, str)
-            and "@" in repo_digest
-            and repo_digest.rsplit("@", 1)[1] == digest
-            for repo_digest in repo_digests
-        )
-    ):
-        fail(f"{tool} image target digest must appear in repoDigests")
-    if target.get("architecture") != "amd64" or target.get("os") != "linux":
-        fail(f"{tool} image target must be linux/amd64")
-    return digest
-
-
-def syft_artifacts(report: Any) -> dict[str, dict[str, Any]]:
-    artifacts = report.get("artifacts") if isinstance(report, dict) else None
-    if not isinstance(artifacts, list):
-        fail("syft report must contain an artifacts list")
-    indexed: dict[str, dict[str, Any]] = {}
-    for artifact in artifacts:
-        if not isinstance(artifact, dict):
-            fail("syft report artifacts must be objects")
-        artifact_id = nonblank(artifact.get("id"), "syft artifact id")
-        if artifact_id in indexed:
-            fail(f"syft report contains duplicate artifact id: {artifact_id}")
-        for field in ("name", "version", "type"):
-            nonblank(artifact.get(field), f"syft artifact {field}")
-        indexed[artifact_id] = artifact
-    return indexed
-
-
-def normalize_grype(
-    report: Any, subject: str, syft_report: Any | None = None
-) -> list[Finding]:
-    if syft_report is None:
-        fail("grype checks require native Syft JSON evidence")
-    image_digest = image_evidence(report, "grype", "target")
-    syft_digest = image_evidence(syft_report, "syft", "metadata")
-    if image_digest != syft_digest:
-        fail("Grype and Syft reports do not describe the same image digest")
-    artifacts = syft_artifacts(syft_report)
-    matches = report.get("matches") if isinstance(report, dict) else None
-    if not isinstance(matches, list):
-        fail("grype report must contain a matches list")
-    findings: list[Finding] = []
-    seen: set[tuple[str, str, str]] = set()
-    for item in matches:
-        if not isinstance(item, dict):
-            fail("grype report matches must be objects")
-        vulnerability = item.get("vulnerability")
-        artifact = item.get("artifact")
-        if not isinstance(vulnerability, dict) or not isinstance(artifact, dict):
-            fail("grype report matches must contain vulnerability and artifact objects")
-        artifact_id = nonblank(artifact.get("id"), "grype artifact id")
-        syft_artifact = artifacts.get(artifact_id)
-        if syft_artifact is None or any(
-            artifact.get(field) != syft_artifact.get(field)
-            for field in ("id", "name", "version", "type")
-        ):
-            fail("grype finding artifact does not match the Syft package model")
-        vulnerability_id = nonblank(
-            vulnerability.get("id"), "grype vulnerability id"
-        )
-        package = nonblank(artifact.get("name"), "grype package name")
-        installed_version = nonblank(
-            artifact.get("version"), "grype installed package version"
-        )
-        package_type = nonblank(artifact.get("type"), "grype package type")
-        severity = nonblank(
-            vulnerability.get("severity"), "grype vulnerability severity"
-        ).lower()
-        severity_rank(severity)
-        fix = vulnerability.get("fix")
-        if not isinstance(fix, dict):
-            fail(f"grype finding {vulnerability_id} must contain a fix object")
-        versions = fix.get("versions")
-        if not isinstance(versions, list) or any(
-            not isinstance(version, str) for version in versions
-        ):
-            fail(f"grype finding {vulnerability_id} has malformed fix versions")
-        fix_versions = tuple(version.strip() for version in versions if version.strip())
-        fix_state = fix.get("state")
-        if (
-            not isinstance(fix_state, str)
-            or fix_state.casefold() not in GRYPE_FIX_STATES
-        ):
-            fail(f"grype finding {vulnerability_id} has unsupported fix state")
-        key = (vulnerability_id, package, installed_version)
-        if key in seen:
-            fail(
-                "grype report contains duplicate stable finding identity: "
-                f"{vulnerability_id} {package} {installed_version}"
-            )
-        seen.add(key)
-        findings.append(
-            Finding(
-                tool="grype",
-                fingerprint="|".join(
-                    [
-                        "grype",
-                        subject,
-                        vulnerability_id,
-                        package,
-                        installed_version,
-                        package_type,
-                    ]
-                ),
-                rule_id=vulnerability_id,
-                severity=severity,
-                location=subject,
-                summary=f"{vulnerability_id} in {package} {installed_version}",
-                package=package,
-                installed_version=installed_version,
-                package_type=package_type,
-                fix_versions=fix_versions,
-                fix_state=fix_state.casefold(),
-                image_digest=image_digest,
-            )
-        )
-    return findings
-
-
-def validate_policies(policies: Any) -> None:
-    if not isinstance(policies, list) or not policies:
-        fail("baseline must contain non-empty policies")
-    seen_tools: set[str] = set()
-    for policy in policies:
-        if not isinstance(policy, dict):
-            fail("baseline policies must be objects")
-        tool = nonblank(policy.get("tool"), "baseline policy tool")
-        expected_fields = {"tool", "minimum_severity", "action"}
-        if tool == "grype":
-            expected_fields.add("block_fixable")
-        if set(policy) != expected_fields:
-            fail(f"baseline policy for {tool} has missing or unknown fields")
-        if tool not in {"zizmor", "grype"} or tool in seen_tools:
-            fail(f"unsupported or duplicate baseline policy tool: {tool}")
-        seen_tools.add(tool)
-        severity_rank(policy["minimum_severity"])
-        if policy["action"] != "block_unreviewed":
-            fail(f"unsupported policy action: {policy['action']}")
-        if tool == "grype" and policy["block_fixable"] is not True:
-            fail("grype policy must set block_fixable to true")
-    if seen_tools != {"zizmor", "grype"}:
-        fail("baseline must define exactly the zizmor and grype policies")
-
-
-def validate_v3_exception(exception: Any) -> None:
-    if not isinstance(exception, dict) or set(exception) != V3_EXCEPTION_FIELDS:
-        fail("v3 advisory exceptions must have the exact stable field set")
-    for field in (
-        "vulnerability_id",
-        "package",
-        "installed_version",
-        "owner",
-        "rationale",
-    ):
-        nonblank(exception.get(field), f"advisory exception {field}")
-    if severity_rank(exception["severity"]) < SEVERITY_ORDER["high"]:
-        fail("advisory exception severity must be high or critical")
-    if exception["status"] not in V3_EXCEPTION_STATUSES:
-        fail(f"unsupported advisory exception status: {exception['status']}")
-    reviewed_at = parse_date(exception["reviewed_at"], "reviewed_at")
-    expires_at = parse_date(exception["expires_at"], "expires_at")
-    if expires_at < reviewed_at:
-        fail("advisory exception expires_at must not precede reviewed_at")
-    triggers = exception["invalidation_triggers"]
-    if (
-        not isinstance(triggers, list)
-        or len(triggers) != len(set(triggers))
-        or set(triggers) != REQUIRED_INVALIDATION_TRIGGERS
-    ):
-        fail(
-            "advisory exception must contain exactly the required invalidation triggers"
-        )
-
-
-def validate_v2_baseline(data: dict[str, Any]) -> None:
-    reviewed = data.get("reviewed_findings")
-    if not isinstance(reviewed, list):
-        fail("v2 baseline reviewed_findings must be a list")
-    for review in reviewed:
-        if not isinstance(review, dict):
-            fail("v2 reviewed findings must be objects")
-        for field in (
-            "tool",
-            "fingerprint",
-            "rule_id",
-            "severity",
-            "status",
-            "owner",
-            "reason",
-            "reviewed_at",
-            "expires_at",
-        ):
-            if field not in review:
-                fail(f"v2 reviewed finding missing field: {field}")
-        for field in ("tool", "fingerprint", "rule_id", "owner", "reason"):
-            nonblank(review[field], f"v2 reviewed finding {field}")
-        severity_rank(review["severity"])
-        reviewed_at = parse_date(review["reviewed_at"], "reviewed_at")
-        expires_at = parse_date(review["expires_at"], "expires_at")
-        if expires_at < reviewed_at:
-            fail("v2 reviewed finding expires_at must not precede reviewed_at")
-
-
-def load_baseline(path: Path) -> dict[str, Any]:
-    data = load_json(path)
-    if not isinstance(data, dict):
-        fail("baseline must be a JSON object")
-    version = data.get("version")
-    if version == 3:
-        if set(data) != V3_TOP_LEVEL_FIELDS:
-            fail("v3 baseline must have the exact top-level field set")
-        nonblank(data.get("service"), "baseline service")
-        validate_policies(data.get("policies"))
-        exceptions = data.get("exceptions")
-        if not isinstance(exceptions, list):
-            fail("v3 baseline exceptions must be a list")
-        seen: set[tuple[str, str, str]] = set()
-        for exception in exceptions:
-            validate_v3_exception(exception)
-            key = exception_key(exception)
-            if key in seen:
-                fail(f"duplicate advisory exception identity: {' '.join(key)}")
-            seen.add(key)
-        return data
-    if version == 2:
-        validate_policies(data.get("policies"))
-        validate_v2_baseline(data)
-        return data
-    fail(f"unsupported baseline version: {version}")
-
-
-def exception_key(exception: dict[str, Any]) -> tuple[str, str, str]:
-    return (
-        str(exception["vulnerability_id"]),
-        str(exception["package"]),
-        str(exception["installed_version"]),
-    )
-
-
-def v2_exception(review: dict[str, Any]) -> dict[str, Any] | None:
-    if review.get("tool") != "grype":
-        return None
-    parts = str(review["fingerprint"]).split("|")
-    if len(parts) != 6 or parts[0] != "grype":
-        fail("v2 grype reviewed finding has an unsupported fingerprint")
-    return {
-        "vulnerability_id": str(review["rule_id"]),
-        "package": parts[3],
-        "installed_version": parts[4],
-        "severity": str(review["severity"]),
-        "status": str(review["status"]),
-        "owner": str(review["owner"]),
-        "rationale": str(review["reason"]),
-        "reviewed_at": str(review["reviewed_at"]),
-        "expires_at": str(review["expires_at"]),
-        "invalidation_triggers": sorted(REQUIRED_INVALIDATION_TRIGGERS),
-    }
-
-
-def baseline_exceptions(baseline: dict[str, Any]) -> list[dict[str, Any]]:
-    if baseline["version"] == 3:
-        return baseline["exceptions"]
-    return [
-        exception
-        for review in baseline["reviewed_findings"]
-        if (exception := v2_exception(review)) is not None
-    ]
-
-
-def policy_threshold(baseline: dict[str, Any], tool: str) -> str:
-    matches = [policy for policy in baseline["policies"] if policy["tool"] == tool]
-    if not matches:
-        fail(f"baseline has no policy for {tool}")
-    return str(matches[0]["minimum_severity"]).lower()
-
-
-def finding_is_blocking(finding: Finding, tool: str, threshold_rank: int) -> bool:
-    return (tool == "grype" and finding.fixable) or severity_rank(
-        finding.severity
-    ) >= threshold_rank
-
-
-def check_grype_findings(
-    findings: list[Finding], baseline: dict[str, Any], today: dt.date
-) -> int:
-    threshold = policy_threshold(baseline, "grype")
-    threshold_rank = severity_rank(threshold)
-    blocking = [
-        finding
-        for finding in findings
-        if finding_is_blocking(finding, "grype", threshold_rank)
-    ]
-    exceptions = baseline_exceptions(baseline)
-    by_key = {exception_key(exception): exception for exception in exceptions}
-    finding_by_key = {finding.exception_key: finding for finding in findings}
-    findings_by_advisory: dict[tuple[str, str], list[Finding]] = {}
-    for finding in findings:
-        findings_by_advisory.setdefault(finding.advisory_key, []).append(finding)
-    reported_version_mismatches: set[tuple[str, str, str]] = set()
-    invalid: list[str] = []
-
-    for exception in exceptions:
-        key = exception_key(exception)
-        advisory_key = key[:2]
-        finding = finding_by_key.get(key)
-        if parse_date(exception["reviewed_at"], "reviewed_at") > today:
-            invalid.append(f"future-dated exception: {' '.join(key)}")
-        if parse_date(exception["expires_at"], "expires_at") < today:
-            invalid.append(f"expired exception: {' '.join(key)}")
-        if finding is None:
-            changed = findings_by_advisory.get(advisory_key, [])
-            if changed:
-                installed_versions = sorted(
-                    {candidate.installed_version for candidate in changed}
-                )
-                reported_version_mismatches.update(
-                    candidate.exception_key for candidate in changed
-                )
-                invalid.append(
-                    "version-mismatched exception: "
-                    f"{key[0]} {key[1]} reviewed={key[2]} "
-                    f"installed={installed_versions}"
-                )
-            else:
-                invalid.append(
-                    "fixed or absent finding still has an exception: " + " ".join(key)
-                )
-            continue
-        if finding.fixable:
-            invalid.append(
-                "fixable finding cannot be excepted: "
-                f"{finding.rule_id} {finding.package} {finding.installed_version}"
-            )
-        if str(exception["severity"]).casefold() != finding.severity.casefold():
-            invalid.append(
-                "material finding change invalidates exception: "
-                f"{finding.rule_id} {finding.package} {finding.installed_version} "
-                f"reviewed_severity={exception['severity']} "
-                f"current_severity={finding.severity}"
-            )
-
-    for finding in blocking:
-        if finding.fixable:
-            if finding.exception_key not in by_key:
-                invalid.append(
-                    "fixable finding blocks: "
-                    f"{finding.rule_id} {finding.package} {finding.installed_version} "
-                    f"fixes={list(finding.fix_versions)}"
-                )
-            continue
-        if finding.exception_key not in by_key:
-            reviewed_versions = [
-                key[2] for key in by_key if key[:2] == finding.advisory_key
-            ]
-            if reviewed_versions:
-                if finding.exception_key not in reported_version_mismatches:
-                    invalid.append(
-                        "version-mismatched finding: "
-                        f"{finding.rule_id} {finding.package} "
-                        f"reviewed={reviewed_versions} "
-                        f"installed={finding.installed_version}"
-                    )
-            else:
-                invalid.append(
-                    "unreviewed blocking finding: "
-                    f"{finding.rule_id} {finding.severity} "
-                    f"{finding.package} {finding.installed_version}"
-                )
-
-    for message in invalid:
-        print(message, file=sys.stderr)
-    print(
-        "advisory baseline: "
-        f"grype image={findings[0].image_digest if findings else '<none>'} "
-        f"threshold={threshold} findings={len(findings)} blocking={len(blocking)} "
-        f"exceptions={len(exceptions)} invalid={len(invalid)}"
-    )
-    return int(bool(invalid))
-
-
-def check_zizmor_findings(
-    findings: list[Finding], baseline: dict[str, Any], today: dt.date
-) -> int:
-    threshold = policy_threshold(baseline, "zizmor")
-    threshold_rank = severity_rank(threshold)
-    blocking = [
-        finding
-        for finding in findings
-        if severity_rank(finding.severity) >= threshold_rank
-    ]
-    legacy_reviews = {}
-    if baseline["version"] == 2:
-        legacy_reviews = {
-            str(review["fingerprint"]): review
-            for review in baseline["reviewed_findings"]
-            if review.get("tool") == "zizmor"
-        }
-    invalid = []
-    for finding in blocking:
-        review = legacy_reviews.get(finding.fingerprint)
-        if review is None:
-            invalid.append(f"unreviewed blocking finding: {finding.fingerprint}")
-        elif parse_date(review["expires_at"], "expires_at") < today:
-            invalid.append(f"expired reviewed finding: {finding.fingerprint}")
-        elif str(review["severity"]).casefold() != finding.severity.casefold():
-            invalid.append(f"reviewed finding changed: {finding.fingerprint}")
-    for message in invalid:
-        print(message, file=sys.stderr)
-    print(
-        "advisory baseline: "
-        f"zizmor threshold={threshold} blocking={len(blocking)} invalid={len(invalid)}"
-    )
-    return int(bool(invalid))
-
-
-def check_findings(
-    tool: str,
-    findings: list[Finding],
-    baseline: dict[str, Any],
-    today: dt.date,
-) -> int:
-    if tool == "grype":
-        return check_grype_findings(findings, baseline, today)
-    return check_zizmor_findings(findings, baseline, today)
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("tool", choices=["zizmor", "grype"])
-    parser.add_argument("report", type=Path)
-    parser.add_argument("--baseline", type=Path, default=DEFAULT_BASELINE)
-    parser.add_argument("--subject", default="image")
-    parser.add_argument("--today", default=dt.date.today().isoformat())
-    parser.add_argument(
-        "--syft-report",
-        type=Path,
-        help="Native Syft JSON for the same digest-bound candidate image.",
-    )
-    parser.add_argument(
-        "--dump-blocking-findings",
-        action="store_true",
-        help="Print normalized findings at or above the configured threshold.",
-    )
-    args = parser.parse_args()
-
-    report = load_json(args.report)
-    baseline = load_baseline(args.baseline)
-    today = parse_date(args.today, "today")
-    if args.tool == "zizmor":
-        if args.syft_report is not None:
-            fail("--syft-report is only valid for grype")
-        findings = normalize_zizmor(report)
-    else:
-        if args.syft_report is None:
-            fail("grype checks require --syft-report native Syft JSON evidence")
-        findings = normalize_grype(
-            report, args.subject, load_json(args.syft_report)
-        )
-
-    if args.dump_blocking_findings:
-        threshold_rank = severity_rank(policy_threshold(baseline, args.tool))
-        print(
-            json.dumps(
-                [
-                    finding.to_json()
-                    for finding in findings
-                    if finding_is_blocking(finding, args.tool, threshold_rank)
-                ],
-                indent=2,
-                sort_keys=True,
-            )
-        )
-        return
-    raise SystemExit(check_findings(args.tool, findings, baseline, today))
-
-
-if __name__ == "__main__":
-    main()
diff --git a/products/notary/scripts/check_security_assurance.py b/products/notary/scripts/check_security_assurance.py
deleted file mode 100755
index c7acda66d..000000000
--- a/products/notary/scripts/check_security_assurance.py
+++ /dev/null
@@ -1,1005 +0,0 @@
-#!/usr/bin/env python3
-# SPDX-License-Identifier: Apache-2.0
-"""Validate Registry Notary security assurance contracts."""
-
-from __future__ import annotations
-
-import argparse
-import json
-import re
-import subprocess
-import sys
-from collections import deque
-from pathlib import Path
-
-
-ROOT = Path(__file__).resolve().parents[1]
-SECURITY_DIR = ROOT / "security"
-# Enforcement test and route-source refs predate (or postdate) the monorepo
-# migration and may be written relative to the product tree (ROOT) or to the
-# monorepo root; MONOREPO_ROOT is the fallback base for the latter.
-MONOREPO_ROOT = ROOT.parents[1]
-
-REQUIRED_ENTRY_FIELDS = {
-    "service",
-    "listener",
-    "method",
-    "path",
-    "feature",
-    "audience",
-    "auth",
-    "scopes",
-    "rate_limit",
-    "audit",
-    "openapi",
-    "stability",
-    "data_classification",
-    "notes",
-    "source",
-    "enforcement_tests",
-    "waiver",
-}
-
-LISTENERS = {"public", "admin", "internal", "metrics", "demo"}
-AUDIENCES = {"external", "operator", "platform", "internal", "demo", "health"}
-AUTHS = {"none", "api_key", "oidc", "api_key_or_oidc", "bearer", "jws", "internal", "mTLS"}
-AUDIT = {"required", "optional", "not_applicable", "suppressed"}
-STABILITY = {"stable", "beta", "experimental", "admin", "demo"}
-DATA = {"none", "operational", "metadata", "personal", "credential", "audit", "secret-adjacent"}
-SOURCES = {"manual", "generated", "mixed"}
-
-SECRET_COPY_RE = re.compile(
-    r"\b(?:COPY|ADD)\b(?=.*(?:\.env|\.pem|\.key|\.p12|jwk|secret|credential))|\"d\"\s*:",
-    re.IGNORECASE,
-)
-CONST_STR_RE = re.compile(r'const\s+([A-Z][A-Z0-9_]*)\s*:\s*&str\s*=\s*"([^"]+)"\s*;')
-MAX_MODULE_FILES = 4096
-MAX_MODULE_DEPTH = 64
-MODULE_DECL_RE = re.compile(
-    r"(?P<attrs>(?:#\s*\[[^\]]*\]\s*)*)"
-    r"(?:(?:pub(?:\s*\([^)]*\))?)\s+)?"
-    r"mod\s+(?P<name>[A-Za-z_][A-Za-z0-9_]*)\s*(?P<delimiter>[;{])",
-    re.MULTILINE,
-)
-PATH_ATTR_RE = re.compile(r'^\s*path\s*=\s*"([^"]+)"\s*$', re.DOTALL)
-INCLUDE_RE = re.compile(r'include!\s*\(\s*"([^"]+)"\s*\)')
-INCLUDE_START_RE = re.compile(r"\binclude!\s*\(")
-
-
-def fail(message: str) -> None:
-    print(f"security assurance check failed: {message}", file=sys.stderr)
-    raise SystemExit(1)
-
-
-def load_json(path: Path) -> object:
-    try:
-        return json.loads(path.read_text(encoding="utf-8"))
-    except FileNotFoundError:
-        fail(f"missing required file: {path.relative_to(ROOT)}")
-    except json.JSONDecodeError as exc:
-        fail(f"{path.relative_to(ROOT)} is not valid JSON: {exc}")
-
-
-def load_allowlist(path: Path) -> set[tuple[str, str, str]]:
-    entries: set[tuple[str, str, str]] = set()
-    current: dict[str, str] = {}
-    for raw in path.read_text(encoding="utf-8").splitlines():
-        line = raw.strip()
-        if not line or line.startswith("#") or line == "allowed:":
-            continue
-        if line.startswith("- "):
-            if current:
-                add_allowlist_entry(entries, current)
-            current = {}
-            line = line[2:].strip()
-        if ":" in line:
-            name, value = line.split(":", 1)
-            current[name.strip()] = value.strip().strip('"')
-    if current:
-        add_allowlist_entry(entries, current)
-    return entries
-
-
-def add_allowlist_entry(
-    entries: set[tuple[str, str, str]], current: dict[str, str]
-) -> None:
-    missing = {"listener", "method", "path"} - current.keys()
-    if missing:
-        fail(f"auth-none-allowlist.yml entry missing required fields: {sorted(missing)}")
-    entries.add((current["listener"], current["method"], current["path"]))
-
-
-def key(entry: dict) -> tuple[str, str, str]:
-    return (entry["listener"], entry["method"], entry["path"])
-
-
-def validate_manifest() -> None:
-    manifest = load_json(SECURITY_DIR / "exposure-manifest.json")
-    inventory = load_json(SECURITY_DIR / "route-inventory.json")
-    allowlist = load_allowlist(SECURITY_DIR / "auth-none-allowlist.yml")
-
-    if not isinstance(manifest, dict) or manifest.get("service") != "registry-notary":
-        fail("exposure-manifest.json must describe service registry-notary")
-    entries = manifest.get("endpoints")
-    if not isinstance(entries, list) or not entries:
-        fail("exposure-manifest.json must contain non-empty endpoints list")
-
-    seen: set[tuple[str, str, str]] = set()
-    by_key: dict[tuple[str, str, str], dict] = {}
-    for entry in entries:
-        if not isinstance(entry, dict):
-            fail("endpoint entries must be objects")
-        missing = REQUIRED_ENTRY_FIELDS - set(entry)
-        if missing:
-            fail(f"{entry.get('path', '<unknown>')} missing fields: {sorted(missing)}")
-        if entry["service"] != "registry-notary":
-            fail(f"{entry['path']} has wrong service {entry['service']}")
-        check_value(entry, "listener", LISTENERS)
-        check_value(entry, "audience", AUDIENCES)
-        check_value(entry, "auth", AUTHS)
-        check_value(entry, "audit", AUDIT)
-        check_value(entry, "stability", STABILITY)
-        check_value(entry, "data_classification", DATA)
-        check_value(entry, "source", SOURCES)
-        if entry["method"] not in {"GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"}:
-            fail(f"{entry['path']} has invalid method {entry['method']}")
-        if not isinstance(entry["scopes"], list):
-            fail(f"{entry['path']} scopes must be a list")
-        if not isinstance(entry["enforcement_tests"], list):
-            fail(f"{entry['path']} enforcement_tests must be a list")
-        k = key(entry)
-        if k in seen:
-            fail(f"duplicate endpoint entry {k}")
-        seen.add(k)
-        by_key[k] = entry
-        if entry["auth"] == "none" and entry["audience"] != "health" and k not in allowlist:
-            fail(f"{k} is auth:none but missing from auth-none allowlist")
-        needs_tests = (
-            entry["auth"] != "none"
-            or bool(entry["scopes"])
-            or entry["audit"] == "required"
-            or entry["listener"] in {"admin", "metrics"}
-            or entry["rate_limit"] is not None
-        )
-        if needs_tests and not (entry["enforcement_tests"] or entry["waiver"]):
-            fail(f"{k} claims security enforcement but has no tests or waiver")
-        for test_ref in entry["enforcement_tests"]:
-            ensure_test_ref_exists(str(test_ref))
-
-    auth_none_keys = {k for k, entry in by_key.items() if entry["auth"] == "none"}
-    stale_allowlist = sorted(allowlist - auth_none_keys)
-    if stale_allowlist:
-        fail(f"auth-none allowlist contains entries that are not auth:none endpoints: {stale_allowlist}")
-
-    if not isinstance(inventory, dict) or not isinstance(inventory.get("routes"), list):
-        fail("route-inventory.json must contain a routes list")
-    inventory_keys: set[tuple[str, str, str]] = set()
-    for route in inventory["routes"]:
-        listener = route["listener"]
-        path = route["path"]
-        for method in route["methods"]:
-            k = (listener, method, path)
-            inventory_keys.add(k)
-            if k not in by_key:
-                fail(f"route inventory entry {k} is missing from exposure manifest")
-    stale = sorted(set(by_key) - inventory_keys)
-    if stale:
-        fail(f"exposure-manifest.json contains endpoints missing from route-inventory.json: {stale}")
-    validate_route_sources(inventory)
-
-
-def check_value(entry: dict, field: str, allowed: set[str]) -> None:
-    if entry[field] not in allowed:
-        fail(f"{entry['path']} has invalid {field}: {entry[field]}")
-
-
-def resolve_repo_path(rel_part: str) -> Path:
-    """Resolve a manifest-relative path against the product tree, falling
-    back to the monorepo root for refs written relative to it."""
-    path = ROOT / rel_part
-    if path.exists():
-        return path
-    return MONOREPO_ROOT / rel_part
-
-
-def ensure_test_ref_exists(ref: str) -> None:
-    file_part, _, symbol = ref.partition("::")
-    if not symbol:
-        fail(f"enforcement test reference must include ::test_name: {ref}")
-    path = resolve_repo_path(file_part)
-    if not path.exists():
-        fail(f"referenced enforcement test file does not exist: {file_part}")
-    text = path.read_text(encoding="utf-8")
-    if not re.search(rf"\b(?:async\s+)?fn\s+{re.escape(symbol)}\s*\(", text):
-        fail(f"referenced enforcement test symbol {symbol} not found in {file_part}")
-
-
-def crates_tree_root() -> Path:
-    """The crates/ tree lives at the monorepo root today, but may live under
-    the product tree (ROOT) in a future or historical layout; prefer
-    whichever actually exists."""
-    return ROOT if (ROOT / "crates").is_dir() else MONOREPO_ROOT
-
-
-def validate_route_sources(inventory: object | None = None) -> None:
-    if inventory is None:
-        inventory = load_json(SECURITY_DIR / "route-inventory.json")
-    if not isinstance(inventory, dict) or not isinstance(inventory.get("routes"), list):
-        fail("route-inventory.json must contain a routes list")
-
-    inventory_by_source: dict[str, set[tuple[str, str]]] = {}
-    crates_base = crates_tree_root()
-    # Only scan registry-notary* crates: the monorepo's crates/ directory also
-    # holds other products' and shared platform crates (e.g. the
-    # registry-platform-testing mock server), which are out of scope for this
-    # product's route inventory.
-    source_roots = sorted(
-        (crate / "src").resolve()
-        for crate in (crates_base / "crates").glob("registry-notary*")
-        if (crate / "src").is_dir()
-    )
-    source_paths: set[Path] = set()
-    source_root_by_path: dict[Path, Path] = {}
-    for source_root in source_roots:
-        for path in sorted(source_root.rglob("*.rs")):
-            resolved = checked_source_path(path, source_root, "discovered Rust source")
-            source_paths.add(resolved)
-            source_root_by_path[resolved] = source_root
-    for route in inventory["routes"]:
-        source = route.get("source")
-        if isinstance(source, str):
-            inventory_by_source.setdefault(source, set())
-            for method in route["methods"]:
-                inventory_by_source[source].add((route["path"], method))
-    for source in sorted(inventory_by_source):
-        if Path(source).is_absolute() or ".." in Path(source).parts:
-            fail(f"route inventory source must be a repository-relative path: {source}")
-        path = ROOT.resolve() / source
-        if not path.exists():
-            path = MONOREPO_ROOT.resolve() / source
-        if not path.exists():
-            fail(f"route inventory references missing source file: {source}")
-        source_root = owning_source_root(path, source_roots)
-        if source_root is None:
-            fail(f"route inventory source is outside a registry-notary src tree: {source}")
-        resolved = checked_source_path(path, source_root, f"route inventory source {source}")
-        source_paths.add(resolved)
-        source_root_by_path[resolved] = source_root
-
-    source_paths, excluded = classify_test_only_sources(
-        source_paths, source_root_by_path
-    )
-
-    extracted_by_source: dict[str, set[tuple[str, str]]] = {}
-    for path in sorted(source_paths):
-        if path in excluded:
-            continue
-        source = str(path.relative_to(crates_base.resolve()))
-        routes = extract_axum_routes(path.read_text(encoding="utf-8"))
-        if routes:
-            extracted_by_source[source] = routes
-
-    for source, routes in extracted_by_source.items():
-        missing = sorted(routes - inventory_by_source.get(source, set()))
-        if missing:
-            fail(f"{source} declares routes missing from route-inventory.json: {missing}")
-    for source, routes in inventory_by_source.items():
-        missing = sorted(routes - extracted_by_source.get(source, set()))
-        if missing:
-            fail(f"route-inventory.json lists routes not found in {source}: {missing}")
-
-
-def extract_axum_routes(text: str) -> set[tuple[str, str]]:
-    text = strip_rust_test_modules(text)
-    comments_masked = mask_rust(text, strings=False)
-    syntax_masked = mask_rust(text, strings=True)
-    consts = {
-        match.group(1): match.group(2)
-        for match in CONST_STR_RE.finditer(comments_masked)
-        if syntax_masked[match.start()] == "c"
-    }
-    routes: set[tuple[str, str]] = set()
-    cursor = 0
-    while True:
-        start = comments_masked.find(".route(", cursor)
-        if start == -1:
-            break
-        if syntax_masked[start] != ".":
-            cursor = start + len(".route(")
-            continue
-        open_paren = start + len(".route(") - 1
-        close_paren = matching_paren(syntax_masked, open_paren)
-        if close_paren is None:
-            break
-        inner = comments_masked[open_paren + 1 : close_paren]
-        syntax_inner = syntax_masked[open_paren + 1 : close_paren]
-        first, _ = split_first_top_level_arg(inner)
-        _, masked_handler = split_first_top_level_arg(syntax_inner)
-        route_path = resolve_route_path(first, consts)
-        if route_path is not None:
-            for method in infer_methods(masked_handler):
-                routes.add((route_path, method))
-        cursor = close_paren + 1
-    return routes
-
-
-def owning_source_root(path: Path, source_roots: list[Path]) -> Path | None:
-    resolved = path.resolve()
-    for source_root in source_roots:
-        if resolved.is_relative_to(source_root):
-            return source_root
-    return None
-
-
-def checked_source_path(path: Path, source_root: Path, context: str) -> Path:
-    """Resolve a module source without permitting missing files, escapes, or
-    symlink aliases. The route inventory is a repository assurance check, so
-    source ownership must be explicit and stable in the checkout."""
-    try:
-        resolved = path.resolve(strict=True)
-    except OSError as exc:
-        fail(f"{context} cannot be resolved: {path} ({exc})")
-    if not resolved.is_file():
-        fail(f"{context} is not a file: {path}")
-    if not resolved.is_relative_to(source_root):
-        fail(f"{context} escapes registry-notary source root {source_root}: {path}")
-    # All callers build paths from an already-resolved source root or source
-    # file. A mismatch therefore means `..` or a symlink changed ownership.
-    if path.absolute() != resolved:
-        fail(f"{context} uses a non-canonical or symlinked source path: {path}")
-    return resolved
-
-
-def module_child_dir(file_path: Path) -> Path:
-    if file_path.name in {"lib.rs", "main.rs", "mod.rs"}:
-        return file_path.parent
-    return file_path.parent / file_path.stem
-
-
-def rust_attributes(attrs: str) -> list[str]:
-    return re.findall(r"#\s*\[([^\]]*)\]", attrs, flags=re.DOTALL)
-
-
-def cfg_requires_test(expression: str) -> bool:
-    """Conservatively decide whether a cfg expression implies `test`.
-
-    `all(test, unix)` is test-only; `any(test, feature = \"x\")` is not.
-    Unknown or malformed predicates return False so the source remains in the
-    production scan.
-    """
-    tokens = re.findall(
-        r'[A-Za-z_][A-Za-z0-9_]*|"(?:\\.|[^"\\])*"|[(),=]', expression
-    )
-    cursor = 0
-
-    def parse() -> bool:
-        nonlocal cursor
-        if cursor >= len(tokens) or not re.match(r"[A-Za-z_]", tokens[cursor]):
-            raise ValueError
-        name = tokens[cursor]
-        cursor += 1
-        if cursor < len(tokens) and tokens[cursor] == "=":
-            cursor += 2
-            return False
-        if cursor >= len(tokens) or tokens[cursor] != "(":
-            return name == "test"
-        cursor += 1
-        children: list[bool] = []
-        while cursor < len(tokens) and tokens[cursor] != ")":
-            children.append(parse())
-            if cursor < len(tokens) and tokens[cursor] == ",":
-                cursor += 1
-            elif cursor >= len(tokens) or tokens[cursor] != ")":
-                raise ValueError
-        if cursor >= len(tokens):
-            raise ValueError
-        cursor += 1
-        if name == "all":
-            return any(children)
-        if name == "any":
-            return bool(children) and all(children)
-        return False
-
-    try:
-        result = parse()
-        return result and cursor == len(tokens)
-    except (IndexError, ValueError):
-        return False
-
-
-def attrs_require_test(attrs: str) -> bool:
-    for attr in rust_attributes(attrs):
-        match = re.fullmatch(r"\s*cfg\s*\((.*)\)\s*", attr, flags=re.DOTALL)
-        if match and cfg_requires_test(match.group(1)):
-            return True
-    return False
-
-
-def path_attribute(attrs: str) -> str | None:
-    for attr in rust_attributes(attrs):
-        match = PATH_ATTR_RE.fullmatch(attr)
-        if match:
-            return match.group(1)
-    return None
-
-
-def mask_rust(text: str, *, strings: bool) -> str:
-    """Mask comments, and optionally literals, while preserving offsets."""
-    chars = list(text)
-    index = 0
-    block_depth = 0
-    while index < len(text):
-        if block_depth:
-            if text.startswith("/*", index):
-                chars[index : index + 2] = "  "
-                block_depth += 1
-                index += 2
-            elif text.startswith("*/", index):
-                chars[index : index + 2] = "  "
-                block_depth -= 1
-                index += 2
-            else:
-                if text[index] != "\n":
-                    chars[index] = " "
-                index += 1
-            continue
-        if text.startswith("//", index):
-            end = text.find("\n", index)
-            end = len(text) if end == -1 else end
-            chars[index:end] = " " * (end - index)
-            index = end
-            continue
-        if text.startswith("/*", index):
-            chars[index : index + 2] = "  "
-            block_depth = 1
-            index += 2
-            continue
-        raw_prefix_end = None
-        if text[index] == "r":
-            raw_prefix_end = index + 1
-        elif (
-            text[index] in {"b", "c"}
-            and index + 1 < len(text)
-            and text[index + 1] == "r"
-        ):
-            raw_prefix_end = index + 2
-        if raw_prefix_end is not None:
-            quote = raw_prefix_end
-            while quote < len(text) and text[quote] == "#":
-                quote += 1
-            if quote >= len(text) or text[quote] != '"':
-                raw_prefix_end = None
-        if raw_prefix_end is not None:
-            hashes = quote - raw_prefix_end
-            marker = '"' + ("#" * hashes)
-            end = text.find(marker, quote + 1)
-            end = len(text) if end == -1 else end + len(marker)
-            if strings:
-                for offset in range(index, end):
-                    if text[offset] != "\n":
-                        chars[offset] = " "
-            index = end
-            continue
-        char_prefix = 1 if text.startswith("b'", index) else 0
-        if text[index + char_prefix : index + char_prefix + 1] == "'":
-            end = index + char_prefix + 1
-            escaped = False
-            closed = False
-            while end < len(text) and text[end] != "\n":
-                char = text[end]
-                end += 1
-                if escaped:
-                    escaped = False
-                elif char == "\\":
-                    escaped = True
-                elif char == "'":
-                    closed = True
-                    break
-            if closed:
-                if strings:
-                    for offset in range(index, end):
-                        chars[offset] = " "
-                index = end
-                continue
-        prefix = 1 if text.startswith(('b"', 'c"'), index) else 0
-        if text[index + prefix : index + prefix + 1] == '"':
-            end = index + prefix + 1
-            escaped = False
-            while end < len(text):
-                char = text[end]
-                end += 1
-                if escaped:
-                    escaped = False
-                elif char == "\\":
-                    escaped = True
-                elif char == '"':
-                    break
-            if strings:
-                for offset in range(index, end):
-                    if text[offset] != "\n":
-                        chars[offset] = " "
-            index = end
-            continue
-        index += 1
-    return "".join(chars)
-
-
-def matching_brace(text: str, open_brace: int) -> int | None:
-    depth = 0
-    for index in range(open_brace, len(text)):
-        if text[index] == "{":
-            depth += 1
-        elif text[index] == "}":
-            depth -= 1
-            if depth == 0:
-                return index
-    return None
-
-
-def module_declarations(text: str) -> list[re.Match[str]]:
-    comments_masked = mask_rust(text, strings=False)
-    syntax_masked = mask_rust(text, strings=True)
-    return [
-        match
-        for match in MODULE_DECL_RE.finditer(comments_masked)
-        if syntax_masked[match.start("delimiter")] == match.group("delimiter")
-    ]
-
-
-def include_references(text: str) -> tuple[list[re.Match[str]], int]:
-    comments_masked = mask_rust(text, strings=False)
-    syntax_masked = mask_rust(text, strings=True)
-    matches = [
-        match
-        for match in INCLUDE_RE.finditer(comments_masked)
-        if syntax_masked[match.start()] == "i"
-    ]
-    starts = sum(
-        1
-        for match in INCLUDE_START_RE.finditer(comments_masked)
-        if syntax_masked[match.start()] == "i"
-    )
-    return matches, starts
-
-
-def inline_test_modules(text: str) -> list[tuple[int, int, str]]:
-    syntax_masked = mask_rust(text, strings=True)
-    modules: list[tuple[int, int, str]] = []
-    for match in module_declarations(text):
-        if match.group("delimiter") != "{" or not attrs_require_test(match.group("attrs")):
-            continue
-        close = matching_brace(syntax_masked, match.end() - 1)
-        if close is None:
-            fail(f"unclosed inline cfg(test) module {match.group('name')}")
-        modules.append((match.start(), close + 1, match.group("name")))
-    return modules
-
-
-def strip_ranges(text: str, ranges: list[tuple[int, int, str]]) -> str:
-    chars = list(text)
-    for start, end, _ in ranges:
-        for index in range(start, end):
-            if chars[index] != "\n":
-                chars[index] = " "
-    return "".join(chars)
-
-
-def strip_rust_test_modules(text: str) -> str:
-    return strip_ranges(text, inline_test_modules(text))
-
-
-def resolve_module_file(
-    file_path: Path,
-    source_root: Path,
-    attrs: str,
-    name: str,
-    child_dir: Path,
-    context: str,
-) -> Path:
-    explicit = path_attribute(attrs)
-    if explicit is not None:
-        return checked_source_path(file_path.parent / explicit, source_root, context)
-    candidates = (child_dir / f"{name}.rs", child_dir / name / "mod.rs")
-    existing = [candidate for candidate in candidates if candidate.exists()]
-    if len(existing) != 1:
-        rendered = ", ".join(str(candidate) for candidate in candidates)
-        fail(f"{context} must resolve to exactly one conventional module file: {rendered}")
-    return checked_source_path(existing[0], source_root, context)
-
-
-def source_references(
-    text: str,
-    file_path: Path,
-    source_root: Path,
-    *,
-    test_context: bool,
-) -> tuple[set[Path], set[Path]]:
-    """Return (production, test-only) external source references."""
-    inline_modules = inline_test_modules(text)
-    production_text = text if test_context else strip_ranges(text, inline_modules)
-    production: set[Path] = set()
-    test_only: set[Path] = set()
-
-    for match in module_declarations(production_text):
-        if match.group("delimiter") != ";":
-            continue
-        is_test = test_context or attrs_require_test(match.group("attrs"))
-        target = resolve_module_file(
-            file_path,
-            source_root,
-            match.group("attrs"),
-            match.group("name"),
-            module_child_dir(file_path),
-            f"module {match.group('name')} declared by {file_path}",
-        )
-        (test_only if is_test else production).add(target)
-
-    include_matches, include_starts = include_references(production_text)
-    if len(include_matches) != include_starts:
-        fail(f"include! in {file_path} must use a direct string literal")
-    for match in include_matches:
-        target = checked_source_path(
-            file_path.parent / match.group(1),
-            source_root,
-            f"include! declared by {file_path}",
-        )
-        (test_only if test_context else production).add(target)
-
-    if not test_context:
-        for start, end, module_name in inline_modules:
-            body = text[start:end]
-            child_dir = module_child_dir(file_path) / module_name
-            for match in module_declarations(body):
-                if match.group("delimiter") != ";":
-                    continue
-                test_only.add(
-                    resolve_module_file(
-                        file_path,
-                        source_root,
-                        match.group("attrs"),
-                        match.group("name"),
-                        child_dir,
-                        f"module {match.group('name')} declared by inline cfg(test) module in {file_path}",
-                    )
-                )
-            include_matches, include_starts = include_references(body)
-            if len(include_matches) != include_starts:
-                fail(
-                    f"include! in inline cfg(test) module in {file_path} "
-                    "must use a direct string literal"
-                )
-            for match in include_matches:
-                test_only.add(
-                    checked_source_path(
-                        file_path.parent / match.group(1),
-                        source_root,
-                        f"include! in inline cfg(test) module in {file_path}",
-                    )
-                )
-    return production, test_only
-
-
-def classify_test_only_sources(
-    initial_sources: set[Path], source_root_by_path: dict[Path, Path]
-) -> tuple[set[Path], set[Path]]:
-    """Exclude only files proven test-only, while retaining any file that also
-    has production ownership. Test ancestry and production ownership are both
-    expanded transitively with explicit bounds."""
-    texts: dict[Path, str] = {}
-    reference_cache: dict[
-        tuple[Path, bool], tuple[set[Path], set[Path]]
-    ] = {}
-
-    def load(path: Path, test_context: bool) -> tuple[set[Path], set[Path]]:
-        source_root = source_root_by_path[path]
-        if path not in texts:
-            try:
-                texts[path] = path.read_text(encoding="utf-8")
-            except (OSError, UnicodeError) as exc:
-                fail(f"Rust source cannot be read as UTF-8: {path} ({exc})")
-        cache_key = (path, test_context)
-        # Test-context references differ because every child inherits test-only
-        # ownership, so cache them separately.
-        if cache_key not in reference_cache:
-            reference_cache[cache_key] = source_references(
-                texts[path], path, source_root, test_context=test_context
-            )
-        for target in reference_cache[cache_key][0] | reference_cache[cache_key][1]:
-            source_root_by_path.setdefault(target, source_root)
-        return reference_cache[cache_key]
-
-    test_candidates: set[Path] = set()
-    pending: deque[tuple[Path, int]] = deque()
-    for path in sorted(initial_sources):
-        _, test_refs = load(path, False)
-        for target in sorted(test_refs):
-            pending.append((target, 1))
-    while pending:
-        path, depth = pending.popleft()
-        if depth > MAX_MODULE_DEPTH:
-            fail(f"cfg(test) source expansion exceeds depth {MAX_MODULE_DEPTH}: {path}")
-        if path in test_candidates:
-            continue
-        test_candidates.add(path)
-        if len(test_candidates) > MAX_MODULE_FILES:
-            fail(f"cfg(test) source expansion exceeds {MAX_MODULE_FILES} files")
-        production_refs, test_refs = load(path, True)
-        for target in sorted(production_refs | test_refs):
-            pending.append((target, depth + 1))
-
-    all_sources = set(initial_sources) | test_candidates
-    production_owned = set(initial_sources - test_candidates)
-    pending = deque((path, 0) for path in sorted(production_owned))
-    while pending:
-        path, depth = pending.popleft()
-        if depth > MAX_MODULE_DEPTH:
-            fail(f"production source expansion exceeds depth {MAX_MODULE_DEPTH}: {path}")
-        production_refs, _ = load(path, False)
-        for target in sorted(production_refs):
-            all_sources.add(target)
-            if target not in production_owned:
-                production_owned.add(target)
-                if len(production_owned) > MAX_MODULE_FILES:
-                    fail(f"production source expansion exceeds {MAX_MODULE_FILES} files")
-                pending.append((target, depth + 1))
-
-    excluded = test_candidates - production_owned
-    return all_sources, excluded
-
-
-def matching_paren(text: str, open_paren: int) -> int | None:
-    depth = 0
-    in_string = False
-    escaped = False
-    for index in range(open_paren, len(text)):
-        char = text[index]
-        if in_string:
-            if escaped:
-                escaped = False
-            elif char == "\\":
-                escaped = True
-            elif char == '"':
-                in_string = False
-            continue
-        if char == '"':
-            in_string = True
-        elif char == "(":
-            depth += 1
-        elif char == ")":
-            depth -= 1
-            if depth == 0:
-                return index
-    return None
-
-
-def split_first_top_level_arg(args: str) -> tuple[str, str]:
-    depth = 0
-    in_string = False
-    escaped = False
-    for index, char in enumerate(args):
-        if in_string:
-            if escaped:
-                escaped = False
-            elif char == "\\":
-                escaped = True
-            elif char == '"':
-                in_string = False
-            continue
-        if char == '"':
-            in_string = True
-        elif char in "([{":
-            depth += 1
-        elif char in ")]}":
-            depth -= 1
-        elif char == "," and depth == 0:
-            return args[:index].strip(), args[index + 1 :].strip()
-    return args.strip(), ""
-
-
-def resolve_route_path(expr: str, consts: dict[str, str]) -> str | None:
-    expr = expr.strip()
-    if expr.startswith('"') and expr.endswith('"'):
-        return expr[1:-1]
-    if expr in consts:
-        return consts[expr]
-    match = re.fullmatch(r'&format!\("([^"]+)"\)', expr, flags=re.S)
-    if match:
-        template = match.group(1)
-        for name, value in consts.items():
-            template = template.replace(f"{{{name}}}", value)
-        return template.replace("{{", "{").replace("}}", "}")
-    return None
-
-
-def infer_methods(handler_expr: str) -> set[str]:
-    methods: set[str] = set()
-    if re.search(r"(?<![A-Za-z0-9_])get\s*\(", handler_expr):
-        methods.add("GET")
-    if re.search(r"(?<![A-Za-z0-9_])post\s*\(|\.post\s*\(", handler_expr):
-        methods.add("POST")
-    if re.search(r"(?<![A-Za-z0-9_])put\s*\(|\.put\s*\(", handler_expr):
-        methods.add("PUT")
-    if re.search(r"(?<![A-Za-z0-9_])patch\s*\(|\.patch\s*\(", handler_expr):
-        methods.add("PATCH")
-    if re.search(r"(?<![A-Za-z0-9_])delete\s*\(|\.delete\s*\(", handler_expr):
-        methods.add("DELETE")
-    if re.search(r"(?<![A-Za-z0-9_])head\s*\(|\.head\s*\(", handler_expr):
-        methods.add("HEAD")
-    return methods
-
-
-def check_dockerfile_secret_patterns() -> None:
-    for path in [ROOT / "Dockerfile"]:
-        if not path.is_file():
-            fail(f"missing required Dockerfile: {path.relative_to(ROOT)}")
-        for lineno, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
-            if SECRET_COPY_RE.search(line):
-                fail(f"{path.name}:{lineno} may copy secret or private JWK material")
-
-
-def check_container_runtime_contract() -> None:
-    path = ROOT / "Dockerfile"
-    if not path.is_file():
-        fail(f"missing required Dockerfile: {path.relative_to(ROOT)}")
-    text = path.read_text(encoding="utf-8")
-    runtime_base = "gcr.io/distroless/cc-debian13:nonroot@sha256:"
-    marker = f"FROM {runtime_base}"
-    marker_at = text.find(marker)
-    if marker_at < 0:
-        fail("Dockerfile must use the pinned Distroless Debian 13 nonroot runtime")
-    runtime = text[marker_at:]
-    first_line = runtime.splitlines()[0]
-    if not re.fullmatch(
-        r"FROM gcr\.io/distroless/cc-debian13:nonroot@sha256:[0-9a-f]{64} AS runtime",
-        first_line,
-    ):
-        fail("Dockerfile runtime base must use an immutable Distroless image digest")
-    required = (
-        'ARG REGISTRY_NOTARY_FEATURES="registry-notary-cel,pkcs11"',
-        'HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD ["/usr/local/bin/registry-notary", "healthcheck"]',
-        'ENTRYPOINT ["/usr/local/bin/registry-notary"]',
-        "COPY --from=builder --chown=65532:65532 /workspace/runtime-root/ /",
-        "WORKDIR /var/lib/registry-notary",
-        "registry-notary-cel-worker",
-    )
-    for needle in required:
-        if needle not in text:
-            fail(f"Dockerfile is missing container runtime contract: {needle}")
-    for forbidden in ("\nRUN ", "apt-get", "/bin/sh", "curl ", "wget "):
-        if forbidden in runtime:
-            fail(f"Dockerfile final runtime contains forbidden dependency: {forbidden.strip()}")
-    if re.search(
-        r"^\s*(?:COPY|ADD)\b[^\n]*(?:\.so\b|pkcs11[^/\s]*module)",
-        text,
-        re.IGNORECASE | re.MULTILINE,
-    ):
-        fail("vendor PKCS#11 modules must remain external read-only mounts")
-
-
-def check_openapi_baseline() -> None:
-    baseline = ROOT / "openapi" / "registry-notary.openapi.json"
-    if not baseline.exists():
-        fail("missing openapi/registry-notary.openapi.json baseline")
-    generated = subprocess.run(
-        ["cargo", "run", "-q", "-p", "registry-notary", "--", "openapi"],
-        cwd=ROOT,
-        check=False,
-        text=True,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE,
-    )
-    if generated.returncode != 0:
-        fail(f"OpenAPI generation failed: {generated.stderr.strip()}")
-    try:
-        expected = json.loads(baseline.read_text(encoding="utf-8"))
-        actual = json.loads(generated.stdout)
-    except json.JSONDecodeError as exc:
-        fail(f"OpenAPI JSON parse failed: {exc}")
-    if actual != expected:
-        fail("generated OpenAPI differs from committed baseline")
-    check_openapi_manifest_coverage(baseline)
-
-
-def check_openapi_manifest_coverage(path: Path) -> None:
-    manifest = load_json(SECURITY_DIR / "exposure-manifest.json")
-    document = load_json(path)
-    if not isinstance(manifest, dict) or not isinstance(document, dict):
-        fail("OpenAPI coverage inputs must be JSON objects")
-    paths = document.get("paths")
-    if paths is None:
-        paths = {}
-    if not isinstance(paths, dict):
-        fail("OpenAPI paths must be an object")
-
-    # Index OpenAPI path items by their normalised shape so we can look them up
-    # by shape while still checking the extension on the original path item.
-    openapi_path_items: dict[tuple[str, str], dict] = {}
-    for openapi_path, path_item in paths.items():
-        if not isinstance(path_item, dict):
-            continue
-        shape = openapi_path_shape(openapi_path)
-        for method in path_item:
-            if method.upper() in {"GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"}:
-                openapi_path_items[(shape, method.upper())] = path_item
-
-    missing = []
-    catch_all_mismatch = []
-    for entry in manifest.get("endpoints", []):
-        if not entry.get("openapi"):
-            continue
-        entry_path = entry["path"]
-        entry_method = entry["method"]
-        shape = openapi_path_shape(entry_path)
-        key = (shape, entry_method)
-        if key not in openapi_path_items:
-            missing.append((entry_method, entry_path))
-            continue
-        path_item = openapi_path_items[key]
-        inventory_is_catch_all = is_catch_all_path(entry_path)
-        spec_is_catch_all = bool(path_item.get("x-registry-notary-catch-all"))
-        if inventory_is_catch_all != spec_is_catch_all:
-            catch_all_mismatch.append(
-                (entry_method, entry_path, inventory_is_catch_all, spec_is_catch_all)
-            )
-
-    if missing:
-        fail(f"manifest endpoints marked openapi:true are missing from OpenAPI: {sorted(missing)}")
-    if catch_all_mismatch:
-        details = "; ".join(
-            f"{m} {p}: inventory catch-all={inv} but spec x-registry-notary-catch-all={spec}"
-            for m, p, inv, spec in catch_all_mismatch
-        )
-        fail(
-            f"catch-all mismatch between route inventory and OpenAPI spec "
-            f"(inventory {{*name}} must map to a spec path item with "
-            f"x-registry-notary-catch-all:true, and plain {{name}} must not): {details}"
-        )
-
-
-def is_catch_all_path(path: str) -> bool:
-    """Return True if any path segment is an axum-style multi-segment wildcard ({*name})."""
-    return bool(re.search(r"\{\*[^}]+\}", path))
-
-
-def openapi_path_shape(path: str) -> str:
-    return re.sub(r"\{\*?[^}]+\}", "{}", path)
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser()
-    parser.add_argument(
-        "checks",
-        nargs="*",
-        choices=[
-            "manifest",
-            "route-sources",
-            "dockerfile-secrets",
-            "container-runtime",
-            "openapi-baseline",
-            "openapi-coverage",
-        ],
-        default=None,
-    )
-    args = parser.parse_args()
-    checks = args.checks or [
-        "manifest",
-        "dockerfile-secrets",
-        "container-runtime",
-        "openapi-baseline",
-    ]
-    if "manifest" in checks:
-        validate_manifest()
-    if "route-sources" in checks:
-        validate_route_sources()
-    if "dockerfile-secrets" in checks:
-        check_dockerfile_secret_patterns()
-    if "container-runtime" in checks:
-        check_container_runtime_contract()
-    if "openapi-baseline" in checks:
-        check_openapi_baseline()
-    if "openapi-coverage" in checks:
-        check_openapi_manifest_coverage(ROOT / "openapi" / "registry-notary.openapi.json")
-
-
-if __name__ == "__main__":
-    main()
diff --git a/products/notary/scripts/ci-preflight.sh b/products/notary/scripts/ci-preflight.sh
deleted file mode 100755
index 4e7005aca..000000000
--- a/products/notary/scripts/ci-preflight.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-product_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-stack_root="$(cd "${product_root}/../.." && pwd)"
-
-fail() {
-  echo "registry-notary CI preflight failed: $*" >&2
-  exit 2
-}
-
-run() {
-  echo "==> registry-notary: $*"
-  "$@"
-}
-
-command -v cargo >/dev/null 2>&1 || fail "cargo is required"
-
-cd "${stack_root}"
-run cargo metadata --locked --format-version 1 >/dev/null
-run cargo check --locked -p registry-notary-server -p registry-notary --all-targets
diff --git a/products/notary/scripts/postgresql-conformance.sh b/products/notary/scripts/postgresql-conformance.sh
deleted file mode 100755
index d22f4a356..000000000
--- a/products/notary/scripts/postgresql-conformance.sh
+++ /dev/null
@@ -1,1243 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0
-set -euo pipefail
-
-postgresql_major="${1:-}"
-case "${postgresql_major}" in
-  16)
-    default_source_image="postgres:16.13-alpine"
-    default_target_image="postgres:16.14-alpine"
-    default_restore_image="postgres:17.10-alpine"
-    restore_major="17"
-    ;;
-  17)
-    default_source_image="postgres:17.9-alpine"
-    default_target_image="postgres:17.10-alpine"
-    default_restore_image="postgres:18.4-alpine"
-    restore_major="18"
-    ;;
-  18)
-    default_source_image="postgres:18.3-alpine"
-    default_target_image="postgres:18.4-alpine"
-    default_restore_image="postgres:18.4-alpine"
-    restore_major="18"
-    ;;
-  *)
-    echo "usage: $0 <16|17|18>" >&2
-    exit 2
-    ;;
-esac
-
-source_image="${NOTARY_POSTGRES_SOURCE_IMAGE:-${default_source_image}}"
-target_image="${NOTARY_POSTGRES_TARGET_IMAGE:-${default_target_image}}"
-restore_image="${NOTARY_POSTGRES_RESTORE_IMAGE:-${default_restore_image}}"
-notary_bin="${NOTARY_BIN:-target/debug/registry-notary}"
-run_id="${GITHUB_RUN_ID:-local}-$$"
-postgres_container="notary-postgres-conformance-${run_id}"
-postgres_data_volume="notary-postgres-data-${run_id}"
-postgres_cert_volume="notary-postgres-certs-${run_id}"
-postgres_port="${NOTARY_POSTGRES_PORT:-$((30000 + ($$ % 8000)))}"
-notary_port_a="${NOTARY_CONFORMANCE_PORT_A:-$((41000 + ($$ % 4000)))}"
-notary_port_b="${NOTARY_CONFORMANCE_PORT_B:-$((45000 + ($$ % 4000)))}"
-notary_negative_port="${NOTARY_CONFORMANCE_NEGATIVE_PORT:-$((50000 + ($$ % 4000)))}"
-relay_port="${NOTARY_CONFORMANCE_RELAY_PORT:-$((54000 + ($$ % 1000)))}"
-unsupported_postgres_image="postgres:15.18-alpine"
-unsupported_postgres_container="${postgres_container}-unsupported"
-work_dir="$(mktemp -d "${TMPDIR:-/tmp}/notary-postgres-conformance.XXXXXX")"
-work_dir="$(cd "${work_dir}" && pwd -P)"
-notary_pid_a=""
-notary_pid_b=""
-lost_ack_pid=""
-negative_listener_pid=""
-relay_pid=""
-
-fail() {
-  echo "notary PostgreSQL conformance failed: $1" >&2
-  exit 1
-}
-
-stop_process() {
-  local pid="${1:-}"
-  if [[ -z "${pid}" ]] || ! kill -0 "${pid}" 2>/dev/null; then
-    return 0
-  fi
-  kill "${pid}" 2>/dev/null || true
-  for _ in {1..20}; do
-    if ! kill -0 "${pid}" 2>/dev/null; then
-      wait "${pid}" 2>/dev/null || true
-      return 0
-    fi
-    sleep 0.25
-  done
-  kill -KILL "${pid}" 2>/dev/null || true
-  wait "${pid}" 2>/dev/null || true
-}
-
-cleanup() {
-  local status=$?
-  trap - EXIT INT TERM
-  set +e
-  stop_process "${notary_pid_a}"
-  stop_process "${notary_pid_b}"
-  stop_process "${lost_ack_pid}"
-  stop_process "${negative_listener_pid}"
-  stop_process "${relay_pid}"
-  docker rm -f "${unsupported_postgres_container}" >/dev/null 2>&1
-  docker rm -f "${postgres_container}" >/dev/null 2>&1
-  docker volume rm -f "${postgres_data_volume}" "${postgres_cert_volume}" >/dev/null 2>&1
-  rm -rf "${work_dir}"
-  exit "${status}"
-}
-trap cleanup EXIT INT TERM
-
-for command in cargo curl docker jq openssl python3; do
-  command -v "${command}" >/dev/null 2>&1 || fail "required command is unavailable"
-done
-[[ -x "${notary_bin}" ]] || fail "registry-notary binary is unavailable"
-"${notary_bin}" build-info | jq --exit-status '.capabilities.cel == true' >/dev/null \
-  || fail "registry-notary binary lacks CEL support"
-[[ "${source_image}" != "${target_image}" ]] || fail "minor-upgrade images must differ"
-
-admin_password="$(openssl rand -hex 24)"
-migrator_password="$(openssl rand -hex 24)"
-runtime_password="$(openssl rand -hex 24)"
-api_key="$(openssl rand -hex 32)"
-audit_secret="$(openssl rand -hex 32)"
-sensitive_state_key="$(openssl rand -base64 32 | tr -d '\n=' | tr '+/' '-_')"
-sensitive_probe_pin="$(python3 -c \
-  'import secrets, string; print("".join(secrets.choice(string.ascii_uppercase) for _ in range(6)))')"
-[[ "${sensitive_probe_pin}" =~ ^[A-Z]{6}$ ]] \
-  || fail "sensitive-state probe PIN generation failed"
-sensitive_state_key_id="$(NOTARY_SENSITIVE_KEY="${sensitive_state_key}" python3 - <<'PY'
-import base64
-import hashlib
-import hmac
-import os
-
-encoded = os.environ["NOTARY_SENSITIVE_KEY"]
-master = base64.urlsafe_b64decode(encoded + "=" * (-len(encoded) % 4))
-fields = [b"registry-notary/preauthorization/kdf/v1", b"key-id"]
-message = b"".join(len(field).to_bytes(8, "big") + field for field in fields)
-print(hmac.new(master, message, hashlib.sha256).hexdigest())
-PY
-)"
-[[ "${sensitive_state_key_id}" =~ ^[0-9a-f]{64}$ ]] \
-  || fail "sensitive-state key identifier derivation failed"
-idempotency_key_a="conformance-a-${run_id}"
-idempotency_key_b="conformance-b-${run_id}"
-idempotency_key_c="conformance-c-${run_id}"
-target_a="per-0001"
-target_b="per-0002"
-target_c="per-0003"
-
-echo "notary PostgreSQL ${postgresql_major} conformance: preparing isolated cluster"
-
-api_key_hash="$(printf '%s\n' "${api_key}" | "${notary_bin}" hash-api-key --stdin --hash-only \
-  2>"${work_dir}/hash-api-key.log")"
-[[ "${api_key_hash}" == sha256:* ]] || fail "API key hash output is invalid"
-
-{
-  openssl req -x509 -newkey rsa:2048 -nodes -days 2 \
-    -subj "/CN=Notary conformance CA" \
-    -addext "basicConstraints=critical,CA:TRUE" \
-    -addext "keyUsage=critical,keyCertSign,cRLSign" \
-    -keyout "${work_dir}/ca.key" -out "${work_dir}/ca.crt"
-  openssl req -newkey rsa:2048 -nodes -subj "/CN=localhost" \
-    -keyout "${work_dir}/server.key" -out "${work_dir}/server.csr"
-  openssl x509 -req -days 2 -in "${work_dir}/server.csr" \
-    -CA "${work_dir}/ca.crt" -CAkey "${work_dir}/ca.key" -CAcreateserial \
-    -extfile <(printf '%s\n' \
-      'subjectAltName=DNS:localhost,IP:127.0.0.1' \
-      'basicConstraints=critical,CA:FALSE' \
-      'keyUsage=critical,digitalSignature,keyEncipherment' \
-      'extendedKeyUsage=serverAuth') \
-    -out "${work_dir}/server.crt"
-  chmod 600 "${work_dir}/server.key"
-  openssl req -x509 -newkey rsa:2048 -nodes -days 2 \
-    -subj "/CN=Untrusted Notary conformance CA" \
-    -addext "basicConstraints=critical,CA:TRUE" \
-    -addext "keyUsage=critical,keyCertSign,cRLSign" \
-    -keyout "${work_dir}/untrusted-ca.key" -out "${work_dir}/untrusted-ca.crt"
-  openssl req -newkey rsa:2048 -nodes -subj "/CN=localhost" \
-    -keyout "${work_dir}/untrusted-server.key" -out "${work_dir}/untrusted-server.csr"
-  openssl x509 -req -days 2 -in "${work_dir}/untrusted-server.csr" \
-    -CA "${work_dir}/untrusted-ca.crt" -CAkey "${work_dir}/untrusted-ca.key" \
-    -CAcreateserial \
-    -extfile <(printf '%s\n' \
-      'subjectAltName=DNS:localhost,IP:127.0.0.1' \
-      'basicConstraints=critical,CA:FALSE' \
-      'keyUsage=critical,digitalSignature,keyEncipherment' \
-      'extendedKeyUsage=serverAuth') \
-    -out "${work_dir}/untrusted-server.crt"
-  chmod 600 "${work_dir}/untrusted-server.key"
-} >"${work_dir}/openssl.log" 2>&1
-
-docker pull "${source_image}" >"${work_dir}/docker-pull.log" 2>&1
-docker pull "${target_image}" >>"${work_dir}/docker-pull.log" 2>&1
-if [[ "${restore_image}" != "${source_image}" && "${restore_image}" != "${target_image}" ]]; then
-  docker pull "${restore_image}" >>"${work_dir}/docker-pull.log" 2>&1
-fi
-if [[ "${postgresql_major}" == "18" ]]; then
-  docker pull "${unsupported_postgres_image}" >>"${work_dir}/docker-pull.log" 2>&1
-fi
-docker volume create "${postgres_data_volume}" >/dev/null
-docker volume create "${postgres_cert_volume}" >/dev/null
-
-install_postgres_certificate() {
-  local stem="$1"
-  docker run --rm --user root \
-    --env "CERTIFICATE_STEM=${stem}" \
-    --mount "type=bind,source=${work_dir},target=/source,readonly" \
-    --mount "type=volume,source=${postgres_cert_volume},target=/certs" \
-    "${source_image}" sh -ec \
-    'cp "/source/${CERTIFICATE_STEM}.crt" /certs/server.crt; \
-     cp "/source/${CERTIFICATE_STEM}.key" /certs/server.key; \
-     chown 70:70 /certs/server.crt /certs/server.key; \
-     chmod 600 /certs/server.key' \
-    >>"${work_dir}/certificate-install.log" 2>&1
-}
-
-install_postgres_certificate server
-
-postgres_ready() {
-  docker exec "${postgres_container}" pg_isready --host 127.0.0.1 \
-    --username postgres --dbname postgres >/dev/null 2>&1 || return 1
-
-  local probe
-  probe="$(docker exec --env "PGPASSWORD=${admin_password}" "${postgres_container}" \
-    psql --host 127.0.0.1 --username postgres --dbname postgres \
-    --tuples-only --no-align --set ON_ERROR_STOP=1 --command 'SELECT 1' 2>/dev/null)" \
-    || return 1
-  [[ "${probe}" == "1" ]]
-}
-
-wait_for_postgres() {
-  local deadline=$((SECONDS + 90))
-  while (( SECONDS < deadline )); do
-    if postgres_ready; then
-      return 0
-    fi
-    sleep 1
-  done
-  fail "PostgreSQL did not become ready"
-}
-
-start_postgres() {
-  local image="$1"
-  docker run --detach --name "${postgres_container}" \
-    --env "POSTGRES_PASSWORD=${admin_password}" \
-    --env "PGDATA=/var/lib/postgresql/pgdata" \
-    --mount "type=volume,source=${postgres_data_volume},target=/var/lib/postgresql" \
-    --mount "type=volume,source=${postgres_cert_volume},target=/certs,readonly" \
-    --publish "127.0.0.1:${postgres_port}:5432" \
-    "${image}" \
-    -c ssl=on \
-    -c ssl_cert_file=/certs/server.crt \
-    -c ssl_key_file=/certs/server.key \
-    -c fsync=on \
-    -c synchronous_commit=on \
-    -c full_page_writes=on >/dev/null
-
-  wait_for_postgres
-}
-
-admin_sql() {
-  local database="$1"
-  local sql="$2"
-  printf '%s\n' "${sql}" | docker exec --interactive "${postgres_container}" \
-    psql --set ON_ERROR_STOP=1 --username postgres --dbname "${database}" \
-    >"${work_dir}/admin-sql.log" 2>&1
-}
-
-admin_scalar() {
-  local database="$1"
-  local sql="$2"
-  docker exec "${postgres_container}" \
-    psql --tuples-only --no-align --set ON_ERROR_STOP=1 \
-      --username postgres --dbname "${database}" --command "${sql}"
-}
-
-runtime_scalar() {
-  local sql="$1"
-  docker exec --env "PGPASSWORD=${runtime_password}" --env PGSSLMODE=require \
-    "${postgres_container}" psql --tuples-only --no-align --set ON_ERROR_STOP=1 \
-      --host 127.0.0.1 --username registry_notary_runtime \
-      --dbname registry_notary --command "${sql}"
-}
-
-role_oid_pair() {
-  docker exec "${postgres_container}" psql --tuples-only --no-align \
-    --username postgres --dbname postgres --command \
-    "SELECT owner_role.oid::text || ':' || runtime_role.oid::text
-       FROM pg_catalog.pg_roles AS owner_role,
-            pg_catalog.pg_roles AS runtime_role
-      WHERE owner_role.rolname = 'registry_notary_owner'
-        AND runtime_role.rolname = 'registry_notary_runtime';"
-}
-
-runtime_connection_count() {
-  docker exec "${postgres_container}" psql --tuples-only --no-align \
-    --username postgres --dbname postgres --command \
-    "SELECT pg_catalog.count(*) FROM pg_catalog.pg_stat_activity
-      WHERE datname = 'registry_notary'
-        AND usename = 'registry_notary_runtime';"
-}
-
-database_session_count() {
-  docker exec "${postgres_container}" psql --tuples-only --no-align \
-    --username postgres --dbname postgres --command \
-    "SELECT sessions FROM pg_catalog.pg_stat_database
-      WHERE datname = 'registry_notary';"
-}
-
-completed_batch_count() {
-  admin_scalar registry_notary \
-    "SELECT pg_catalog.count(*) FROM registry_notary_private.batch_idempotency
-      WHERE state = 'completed';"
-}
-
-provision_roles() {
-  local shifted_oids="$1"
-  local log_file="$2"
-  if [[ "${shifted_oids}" == "true" ]]; then
-    admin_sql postgres 'CREATE ROLE notary_conformance_oid_padding NOLOGIN;'
-  fi
-  docker exec --interactive \
-    --env "NOTARY_MIGRATOR_PASSWORD=${migrator_password}" \
-    --env "NOTARY_RUNTIME_PASSWORD=${runtime_password}" \
-    "${postgres_container}" \
-    psql --set ON_ERROR_STOP=1 --username postgres --dbname postgres \
-    >"${log_file}" 2>&1 <<'SQL'
-\getenv migrator_password NOTARY_MIGRATOR_PASSWORD
-\getenv runtime_password NOTARY_RUNTIME_PASSWORD
-CREATE ROLE registry_notary_owner
-  NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS;
-CREATE ROLE registry_notary_migrator
-  LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS
-  PASSWORD :'migrator_password';
-CREATE ROLE registry_notary_runtime
-  LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS
-  PASSWORD :'runtime_password';
-GRANT registry_notary_owner TO registry_notary_migrator;
-CREATE DATABASE registry_notary OWNER registry_notary_owner;
-REVOKE ALL ON DATABASE registry_notary FROM PUBLIC;
-GRANT CONNECT ON DATABASE registry_notary TO registry_notary_migrator, registry_notary_runtime;
-\connect registry_notary
-REVOKE ALL ON SCHEMA public FROM PUBLIC;
-SQL
-}
-
-start_postgres "${source_image}"
-docker exec "${postgres_container}" sh -ec \
-  'cp "${PGDATA}/pg_hba.conf" "${PGDATA}/pg_hba.conf.conformance"; \
-   { printf "%s\n" "hostssl postgres all 0.0.0.0/0 trust"; \
-     cat "${PGDATA}/pg_hba.conf.conformance"; } >"${PGDATA}/pg_hba.conf"' \
-  >"${work_dir}/postgres-test-auth.log" 2>&1
-docker exec "${postgres_container}" psql --username postgres --dbname postgres \
-  --command 'SELECT pg_catalog.pg_reload_conf();' \
-  >>"${work_dir}/postgres-test-auth.log" 2>&1
-echo "notary PostgreSQL ${postgresql_major} conformance: typed state contracts"
-REGISTRY_NOTARY_STATE_POSTGRES_TEST_URL="postgresql://postgres@localhost:${postgres_port}/postgres?sslmode=require" \
-REGISTRY_NOTARY_STATE_POSTGRES_TEST_CA="${work_dir}/ca.crt" \
-  cargo test --locked -p registry-notary-server --lib \
-    state_plane::migration::tests::postgres_v1_typed_state_contracts_and_drift_rejection \
-    -- --ignored --exact \
-    >"${work_dir}/rust-state-contracts.log" 2>&1 \
-  || { sed -n '1,240p' "${work_dir}/rust-state-contracts.log" >&2; \
-       fail "typed PostgreSQL state contract test failed"; }
-REGISTRY_NOTARY_STATE_POSTGRES_TEST_URL="postgresql://postgres@localhost:${postgres_port}/postgres?sslmode=require" \
-REGISTRY_NOTARY_STATE_POSTGRES_TEST_CA="${work_dir}/ca.crt" \
-  cargo test --locked -p registry-notary-server --lib \
-    state_plane::migration::tests::postgres_v1_logical_restore_rebind_requires_exact_owner_and_catalog \
-    -- --ignored --exact \
-    >"${work_dir}/rust-restore-role-contract.log" 2>&1 \
-  || { sed -n '1,240p' "${work_dir}/rust-restore-role-contract.log" >&2; \
-       fail "logical restore role contract test failed"; }
-docker exec "${postgres_container}" sh -ec \
-  'mv "${PGDATA}/pg_hba.conf.conformance" "${PGDATA}/pg_hba.conf"' \
-  >>"${work_dir}/postgres-test-auth.log" 2>&1
-docker exec "${postgres_container}" psql --username postgres --dbname postgres \
-  --command 'SELECT pg_catalog.pg_reload_conf();' \
-  >>"${work_dir}/postgres-test-auth.log" 2>&1
-provision_roles false "${work_dir}/role-install.log"
-source_role_oids="$(role_oid_pair)"
-[[ "${source_role_oids}" =~ ^[0-9]+:[0-9]+$ ]] || fail "source role identities are unavailable"
-
-runtime_database_url="postgresql://registry_notary_runtime:${runtime_password}@localhost:${postgres_port}/registry_notary?sslmode=require"
-migrator_database_url="postgresql://registry_notary_migrator:${migrator_password}@localhost:${postgres_port}/registry_notary?sslmode=require"
-export REGISTRY_NOTARY_POSTGRES_URL="${runtime_database_url}"
-export REGISTRY_NOTARY_POSTGRES_MIGRATOR_URL="${migrator_database_url}"
-export REGISTRY_NOTARY_SENSITIVE_STATE_KEY="${sensitive_state_key}"
-export REGISTRY_NOTARY_AUDIT_HASH_SECRET="${audit_secret}"
-export NOTARY_CONFORMANCE_API_KEY_HASH="${api_key_hash}"
-
-config_path="${work_dir}/notary.yaml"
-cat >"${config_path}" <<YAML
-deployment:
-  profile: local
-  multi_instance: true
-instance:
-  environment: conformance
-  id: notary-postgres-conformance
-server:
-  bind: 127.0.0.1:${notary_port_a}
-  request_timeout: 30s
-state:
-  storage: postgresql
-  postgresql:
-    url_env: REGISTRY_NOTARY_POSTGRES_URL
-    root_certificate_path: ${work_dir}/ca.crt
-    connect_timeout_ms: 2000
-    operation_timeout_ms: 2000
-    max_connections: 1
-    sensitive_state_key_env: REGISTRY_NOTARY_SENSITIVE_STATE_KEY
-auth:
-  api_keys:
-    - id: conformance-client
-      fingerprint:
-        provider: env
-        name: NOTARY_CONFORMANCE_API_KEY_HASH
-      scopes: [notary:conformance]
-audit:
-  sink: stdout
-  hash_secret_env: REGISTRY_NOTARY_AUDIT_HASH_SECRET
-evidence:
-  enabled: true
-  service_id: notary-postgres-conformance
-  api_base_url: http://localhost
-  inline_batch_limit: 1
-  allowed_purposes: [benefit-status-verification]
-  machine_quota:
-    enabled: true
-    subjects_per_minute: 2
-  relay:
-    base_url: http://127.0.0.1:${relay_port}
-    allow_insecure_localhost: true
-    workload_client_id: registry-notary
-    token_file: ${work_dir}/relay-token
-  claims:
-    - id: conformance-eligible
-      title: Conformance eligible
-      version: "1"
-      subject_type: person
-      evidence_mode:
-        type: registry_backed
-        consultations:
-          person_status:
-            profile:
-              id: synthetic.snapshot.person-status.exact
-              contract_hash: sha256:62132bbde55fcc9885753b322b4b978cf72cd038f773906fb16b98d0c0917786
-            inputs:
-              person_id: target.id
-            outputs:
-              registration_status: { type: string, nullable: false, max_bytes: 32 }
-      value:
-        type: boolean
-        nullable: false
-      purpose: benefit-status-verification
-      required_scopes: [notary:conformance]
-      rule:
-        type: consultation_matched
-        consultation: person_status
-      operations:
-        evaluate:
-          enabled: true
-        batch_evaluate:
-          enabled: true
-          max_subjects: 1
-      disclosure:
-        default: predicate
-        allowed: [predicate, redacted]
-        downgrade: deny
-      formats:
-        - application/vnd.registry-notary.claim-result+json
-YAML
-
-printf '%s\n' 'eyJhbGciOiJub25lIn0.e30.c2ln' >"${work_dir}/relay-token"
-chmod 600 "${work_dir}/relay-token"
-
-NOTARY_CONFORMANCE_RELAY_PORT="${relay_port}" \
-NOTARY_CONFORMANCE_RELAY_CONTRACT="${PWD}/crates/registry-relay/profiles/synthetic-snapshot-exact-person-status/public-contract.json" \
-python3 -c '
-import datetime
-import http.server
-import json
-import os
-import secrets
-import time
-
-contract_hash = "sha256:62132bbde55fcc9885753b322b4b978cf72cd038f773906fb16b98d0c0917786"
-with open(os.environ["NOTARY_CONFORMANCE_RELAY_CONTRACT"], encoding="utf-8") as source:
-    contract = json.load(source)
-
-alphabet = "0123456789ABCDEFGHJKMNPQRSTVWXYZ"
-
-def ulid():
-    value = (int(time.time() * 1000) << 80) | secrets.randbits(80)
-    encoded = []
-    for _ in range(26):
-        encoded.append(alphabet[value & 31])
-        value >>= 5
-    return "".join(reversed(encoded))
-
-class Handler(http.server.BaseHTTPRequestHandler):
-    def log_message(self, _format, *_args):
-        return
-
-    def send_json(self, value):
-        body = json.dumps(value, separators=(",", ":")).encode()
-        self.send_response(200)
-        self.send_header("content-type", "application/json")
-        self.send_header("content-length", str(len(body)))
-        self.end_headers()
-        self.wfile.write(body)
-
-    def do_GET(self):
-        if self.path != "/v1/consultations/synthetic.snapshot.person-status.exact":
-            self.send_error(404)
-            return
-        self.send_json({"contract_hash": contract_hash, "contract": contract})
-
-    def do_POST(self):
-        if self.path != "/v1/consultations/synthetic.snapshot.person-status.exact/execute":
-            self.send_error(404)
-            return
-        length = int(self.headers.get("content-length", "0"))
-        if length:
-            self.rfile.read(length)
-        now = datetime.datetime.now(datetime.timezone.utc).isoformat().replace("+00:00", "Z")
-        self.send_json({
-            "schema": "registry.relay.consultation-result.v1",
-            "consultation_id": ulid(),
-            "notary_evaluation_id": self.headers["registry-notary-evaluation-id"],
-            "profile": {
-                "id": "synthetic.snapshot.person-status.exact",
-                "contract_hash": contract_hash,
-            },
-            "outcome": "match",
-            "outputs": {"registration_status": "active"},
-            "provenance": {
-                "acquired_at": now,
-                "source_observed_at": now,
-                "source_revision": "conformance-v1",
-                "acquisition_class": "materialized_snapshot",
-                "integration": {
-                    "id": "synthetic.snapshot.person-status",
-                    "revision": 1,
-                },
-                "snapshot": {
-                    "generation_id": "conformance-v1",
-                    "published_at": now,
-                },
-            },
-        })
-
-http.server.ThreadingHTTPServer(
-    ("127.0.0.1", int(os.environ["NOTARY_CONFORMANCE_RELAY_PORT"])), Handler
-).serve_forever()
-' >"${work_dir}/relay.log" 2>&1 &
-relay_pid=$!
-relay_deadline=$((SECONDS + 10))
-while [[ "$(curl --silent --output /dev/null --write-out '%{http_code}' \
-  "http://127.0.0.1:${relay_port}/v1/consultations/synthetic.snapshot.person-status.exact" \
-  2>>"${work_dir}/curl.log" || true)" != "200" ]]; do
-  kill -0 "${relay_pid}" 2>/dev/null || fail "conformance Relay fixture exited"
-  (( SECONDS < relay_deadline )) || fail "conformance Relay fixture did not become ready"
-  sleep 0.1
-done
-
-if ! "${notary_bin}" --config "${config_path}" state install \
-  --migration-url-env REGISTRY_NOTARY_POSTGRES_MIGRATOR_URL \
-  --owner-role registry_notary_owner \
-  --runtime-role registry_notary_runtime \
-  >"${work_dir}/state-install.log" 2>&1; then
-  sed -n '1,160p' "${work_dir}/state-install.log" >&2
-  fail "schema installation failed"
-fi
-"${notary_bin}" --config "${config_path}" state doctor \
-  >"${work_dir}/state-doctor.log" 2>&1 || fail "schema attestation failed"
-
-echo "notary PostgreSQL ${postgresql_major} conformance: multi-instance and recovery"
-
-start_notary() {
-  local bind="$1"
-  local log_file="$2"
-  local pid_variable="$3"
-  "${notary_bin}" --config "${config_path}" --bind "${bind}" >"${log_file}" 2>&1 &
-  printf -v "${pid_variable}" '%s' "$!"
-}
-
-NEGATIVE_LISTENER_PORT="${notary_negative_port}" python3 -c '
-import os
-import socket
-import time
-
-listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-listener.bind(("127.0.0.1", int(os.environ["NEGATIVE_LISTENER_PORT"])))
-listener.listen(1)
-print("ready", flush=True)
-while True:
-    time.sleep(60)
-' >"${work_dir}/negative-listener.log" 2>&1 &
-negative_listener_pid=$!
-negative_listener_deadline=$((SECONDS + 10))
-while ! grep --fixed-strings --line-regexp --quiet ready "${work_dir}/negative-listener.log"; do
-  kill -0 "${negative_listener_pid}" 2>/dev/null \
-    || fail "negative startup listener exited"
-  (( SECONDS < negative_listener_deadline )) \
-    || fail "negative startup listener did not become ready"
-  sleep 0.1
-done
-
-assert_postgresql_public_diagnostic() {
-  local label="$1"
-  local log_file="$2"
-  local code="$3"
-  local meaning="$4"
-  local remediation="$5"
-  local expected="${code}: ${meaning}; next action: ${remediation}"
-  local line_count
-  line_count="$(wc -l <"${log_file}" | tr -d '[:space:]')"
-  if [[ "${line_count}" != "1" ]] \
-    || ! grep --fixed-strings --line-regexp --quiet -- "ERROR ${expected}" "${log_file}"; then
-    sed -n '1,120p' "${log_file}" >&2
-    fail "${label} did not report the expected public PostgreSQL diagnostic"
-  fi
-  local forbidden
-  for forbidden in \
-    "${runtime_database_url}" \
-    "${migrator_database_url}" \
-    "${runtime_password}" \
-    "${migrator_password}" \
-    "${admin_password}" \
-    "${sensitive_state_key}" \
-    "${audit_secret}" \
-    "${api_key}" \
-    "${config_path}" \
-    "${work_dir}" \
-    registry_notary_owner \
-    registry_notary_runtime \
-    registry_notary_migrator; do
-    if [[ -n "${forbidden}" ]] && grep --fixed-strings --quiet -- "${forbidden}" "${log_file}"; then
-      sed -n '1,120p' "${log_file}" >&2
-      fail "${label} public PostgreSQL diagnostic exposed a governed path or value"
-    fi
-  done
-}
-
-expect_postgresql_failure() {
-  local label="$1"
-  local code="$2"
-  local meaning="$3"
-  local remediation="$4"
-  local doctor_log="${work_dir}/doctor-${label}.log"
-  local log_file="${work_dir}/startup-${label}.log"
-
-  if RUST_LOG=off REGISTRY_NOTARY_LOG_FORMAT=text \
-    "${notary_bin}" --config "${config_path}" state doctor >"${doctor_log}" 2>&1; then
-    fail "${label} state doctor accepted the failed PostgreSQL posture"
-  fi
-  assert_postgresql_public_diagnostic \
-    "${label} state doctor" "${doctor_log}" "${code}" "${meaning}" "${remediation}"
-
-  if RUST_LOG=off REGISTRY_NOTARY_LOG_FORMAT=text \
-    "${notary_bin}" --config "${config_path}" \
-    --bind "127.0.0.1:${notary_negative_port}" >"${log_file}" 2>&1; then
-    fail "${label} state failure allowed startup"
-  fi
-  assert_postgresql_public_diagnostic \
-    "${label} startup" "${log_file}" "${code}" "${meaning}" "${remediation}"
-  if grep --extended-regexp --quiet -- 'Address already in use|os error (48|98)' "${log_file}"; then
-    fail "${label} reached listener binding before state activation failed"
-  fi
-}
-
-ready_status() {
-  local url="$1"
-  curl --silent --show-error --max-time 8 --output /dev/null --write-out '%{http_code}' \
-    "${url}/ready" 2>>"${work_dir}/curl.log" || true
-}
-
-wait_ready() {
-  local url="$1"
-  local pid="$2"
-  local deadline=$((SECONDS + 90))
-  while (( SECONDS < deadline )); do
-    [[ "$(ready_status "${url}")" == "200" ]] && return 0
-    kill -0 "${pid}" 2>/dev/null || return 1
-    sleep 1
-  done
-  return 1
-}
-
-wait_not_ready() {
-  local url="$1"
-  local deadline=$((SECONDS + 30))
-  while (( SECONDS < deadline )); do
-    [[ "$(ready_status "${url}")" == "503" ]] && return 0
-    sleep 1
-  done
-  return 1
-}
-
-batch_request() {
-  local url="$1"
-  local key="$2"
-  local request_file="$3"
-  local response_file="$4"
-  local expected_status="$5"
-  local status
-  status="$(curl --silent --show-error --max-time 30 \
-    --output "${response_file}" --write-out '%{http_code}' \
-    --header "x-api-key: ${api_key}" \
-    --header "idempotency-key: ${key}" \
-    --header 'content-type: application/json' \
-    --data-binary "@${request_file}" \
-    "${url}/v1/batch-evaluations" 2>>"${work_dir}/curl.log")" || return 1
-  [[ "${status}" == "${expected_status}" ]]
-}
-
-write_batch_request() {
-  local target="$1"
-  local output="$2"
-  jq --null-input --compact-output --arg target "${target}" '{
-    items: [{target: {type: "Person", id: $target}}],
-    claims: ["conformance-eligible"],
-    disclosure: "predicate",
-    format: "application/vnd.registry-notary.claim-result+json",
-    purpose: "benefit-status-verification"
-  }' >"${output}"
-}
-
-run_sensitive_probe() {
-  local mode="$1"
-  REGISTRY_NOTARY_STATE_SENSITIVE_TEST_URL="${runtime_database_url}" \
-  REGISTRY_NOTARY_STATE_POSTGRES_TEST_CA="${work_dir}/ca.crt" \
-  REGISTRY_NOTARY_STATE_SENSITIVE_TEST_KEY="${sensitive_state_key}" \
-  REGISTRY_NOTARY_STATE_SENSITIVE_PROBE_MODE="${mode}" \
-  REGISTRY_NOTARY_STATE_SENSITIVE_PROBE_PIN="${sensitive_probe_pin}" \
-    cargo test --locked -p registry-notary-server --lib \
-      state_plane::migration::tests::postgres_v1_sensitive_restart_restore_probe \
-      -- --ignored --exact \
-      >"${work_dir}/sensitive-${mode}-probe.log" 2>&1 \
-    || { sed -n '1,200p' "${work_dir}/sensitive-${mode}-probe.log" >&2; \
-         fail "${mode} sensitive-state probe failed"; }
-}
-
-machine_quota_window_started_at=""
-
-seed_restart_domain_state() {
-  [[ "$(runtime_scalar "SELECT registry_notary_api.replay_insert_v1(
-    decode(repeat('d1', 32), 'hex'), decode(repeat('d2', 32), 'hex'),
-    pg_catalog.clock_timestamp() + interval '1 day');")" == "t" ]] \
-    || fail "restart replay fixture was not inserted"
-  [[ "$(runtime_scalar "SELECT registry_notary_api.nonce_reserve_v1(
-    decode(repeat('d3', 32), 'hex'), decode(repeat('d4', 32), 'hex'),
-    pg_catalog.clock_timestamp() + interval '1 day');")" == "t" ]] \
-    || fail "restart nonce fixture was not reserved"
-  [[ "$(runtime_scalar "SELECT registry_notary_api.evaluation_insert_v1(
-    'restart-evaluation', decode(repeat('d5', 32), 'hex'),
-    decode(repeat('d6', 32), 'hex'), 'conformance', 2::smallint,
-    '{\"decision\":\"allow\"}'::jsonb, pg_catalog.clock_timestamp(),
-    pg_catalog.clock_timestamp() + interval '1 day');")" == "t" ]] \
-    || fail "restart evaluation fixture was not inserted"
-  [[ "$(runtime_scalar "SELECT registry_notary_api.credential_status_insert_v1(
-    'restart-credential', 'restart-issuer', 'restart-profile',
-    pg_catalog.clock_timestamp(), pg_catalog.clock_timestamp() + interval '1 day', 3600);")" == "t" ]] \
-    || fail "restart credential-status fixture was not inserted"
-  [[ "$(runtime_scalar "SELECT outcome FROM registry_notary_api.credential_status_update_v1(
-    'restart-credential', 'revoked');")" == "updated" ]] \
-    || fail "restart credential-status fixture was not revoked"
-  [[ "$(runtime_scalar "SELECT allowed FROM registry_notary_api.machine_quota_debit_v1(
-    decode(repeat('d7', 32), 'hex'), 10, 3);")" == "t" ]] \
-    || fail "restart machine-quota fixture was not debited"
-  machine_quota_window_started_at="$(admin_scalar registry_notary \
-    "SELECT window_started_at::text FROM registry_notary_private.machine_quota
-      WHERE principal_hash = decode(repeat('d7', 32), 'hex');")"
-  [[ -n "${machine_quota_window_started_at}" ]] \
-    || fail "restart machine-quota window was unavailable"
-  [[ "$(runtime_scalar "SELECT allowed FROM registry_notary_api.subject_access_quota_debit_v1(
-    ARRAY['per_principal']::text[], ARRAY[decode(repeat('d8', 32), 'hex')]::bytea[],
-    ARRAY[1]::integer[], ARRAY[3600]::integer[]);")" == "t" ]] \
-    || fail "restart subject-quota fixture was not debited"
-  run_sensitive_probe seed
-}
-
-assert_restart_domain_state() {
-  local phase="$1"
-  [[ "$(runtime_scalar "SELECT NOT registry_notary_api.replay_insert_v1(
-    decode(repeat('d1', 32), 'hex'), decode(repeat('d2', 32), 'hex'),
-    pg_catalog.clock_timestamp() + interval '1 day');")" == "t" ]] \
-    || fail "${phase} reopened a replay identifier"
-  [[ "$(runtime_scalar "SELECT registry_notary_api.nonce_reservation_generation_v1(
-    decode(repeat('d3', 32), 'hex'), decode(repeat('d4', 32), 'hex'));")" == "1" ]] \
-    || fail "${phase} changed the nonce generation"
-  [[ "$(runtime_scalar "SELECT EXISTS (SELECT 1 FROM registry_notary_api.evaluation_get_v1(
-    'restart-evaluation', decode(repeat('d5', 32), 'hex')));")" == "t" ]] \
-    || fail "${phase} lost the evaluation"
-  [[ "$(runtime_scalar "SELECT EXISTS (SELECT 1 FROM registry_notary_api.credential_status_get_v1(
-    'restart-credential') WHERE status = 'revoked');")" == "t" ]] \
-    || fail "${phase} changed the terminal credential status"
-  [[ "$(runtime_scalar "SELECT outcome FROM registry_notary_api.credential_status_update_v1(
-    'restart-credential', 'valid');")" == "invalid_transition" ]] \
-    || fail "${phase} reopened a terminal credential status"
-  [[ "$(admin_scalar registry_notary "SELECT used FROM registry_notary_private.machine_quota
-    WHERE principal_hash = decode(repeat('d7', 32), 'hex');")" == "3" ]] \
-    || fail "${phase} lost the machine-quota debit"
-  [[ "$(admin_scalar registry_notary "SELECT window_started_at::text
-    FROM registry_notary_private.machine_quota
-    WHERE principal_hash = decode(repeat('d7', 32), 'hex');")" \
-     == "${machine_quota_window_started_at}" ]] \
-    || fail "${phase} changed the machine-quota window"
-  [[ "$(admin_scalar registry_notary "SELECT used FROM registry_notary_private.subject_access_quota
-    WHERE bucket_kind = 'per_principal'
-      AND key_hash = decode(repeat('d8', 32), 'hex');")" == "1" ]] \
-    || fail "${phase} lost the subject-quota debit"
-  [[ "$(runtime_scalar "SELECT registry_notary_api.preauthorization_key_attest_v1(
-    decode('${sensitive_state_key_id}', 'hex'));")" == "t" ]] \
-    || fail "${phase} changed the sensitive-state key generation"
-  run_sensitive_probe "${phase}"
-}
-
-url_a="http://127.0.0.1:${notary_port_a}"
-url_b="http://127.0.0.1:${notary_port_b}"
-start_notary "127.0.0.1:${notary_port_a}" "${work_dir}/notary-a.log" notary_pid_a
-start_notary "127.0.0.1:${notary_port_b}" "${work_dir}/notary-b.log" notary_pid_b
-wait_ready "${url_a}" "${notary_pid_a}" || fail "first Notary instance did not become ready"
-wait_ready "${url_b}" "${notary_pid_b}" || fail "second Notary instance did not become ready"
-[[ "$(runtime_connection_count)" == "2" ]] \
-  || fail "per-replica PostgreSQL connection cap was not enforced"
-
-request_a="${work_dir}/request-a.json"
-request_b="${work_dir}/request-b.json"
-request_c="${work_dir}/request-c.json"
-write_batch_request "${target_a}" "${request_a}"
-write_batch_request "${target_b}" "${request_b}"
-write_batch_request "${target_c}" "${request_c}"
-
-batch_request "${url_a}" "${idempotency_key_a}" "${request_a}" "${work_dir}/response-a1.json" 200 &
-curl_pid_a=$!
-batch_request "${url_b}" "${idempotency_key_a}" "${request_a}" "${work_dir}/response-a2.json" 200 &
-curl_pid_b=$!
-wait "${curl_pid_a}" || fail "first concurrent batch request failed"
-wait "${curl_pid_b}" || fail "second concurrent batch request failed"
-
-batch_id="$(jq --exit-status --raw-output '.batch_id | select(type == "string" and length > 0)' "${work_dir}/response-a1.json")"
-if [[ "$(jq --raw-output '.summary.succeeded' "${work_dir}/response-a1.json")" != "1" ]]; then
-  jq --compact-output \
-    '{summary, items: [.items[] | {input_index, status, error_codes: [.errors[].code]}]}' \
-    "${work_dir}/response-a1.json" >&2 || true
-  jq --compact-output \
-    '{summary, items: [.items[] | {input_index, status, error_codes: [.errors[].code]}]}' \
-    "${work_dir}/response-a2.json" >&2 || true
-  fail "the concurrent batch did not produce one successful evaluation"
-fi
-evaluation_id="$(jq --exit-status --raw-output '.items[0].evaluation_id | select(type == "string" and length > 0)' "${work_dir}/response-a1.json")"
-[[ "$(jq --raw-output '.batch_id' "${work_dir}/response-a2.json")" == "${batch_id}" ]] \
-  || fail "concurrent instances did not observe one batch owner"
-[[ "$(jq --raw-output '.items[0].evaluation_id' "${work_dir}/response-a2.json")" == "${evaluation_id}" ]] \
-  || fail "concurrent instances did not observe one evaluation"
-
-sessions_before_reuse="$(database_session_count)"
-for reuse_attempt in {1..4}; do
-  batch_request "${url_a}" "${idempotency_key_a}" "${request_a}" \
-    "${work_dir}/response-reuse-${reuse_attempt}.json" 200 \
-    || fail "sequential pooled state request failed"
-done
-sessions_after_reuse="$(database_session_count)"
-[[ "${sessions_after_reuse}" == "${sessions_before_reuse}" ]] \
-  || fail "sequential state operations did not reuse the physical connection"
-[[ "$(runtime_connection_count)" == "2" ]] \
-  || fail "state traffic exceeded the configured PostgreSQL connection cap"
-
-seed_restart_domain_state
-stop_process "${notary_pid_a}"
-notary_pid_a=""
-start_notary "127.0.0.1:${notary_port_a}" "${work_dir}/notary-a-restart.log" notary_pid_a
-wait_ready "${url_a}" "${notary_pid_a}" || fail "restarted Notary instance did not become ready"
-assert_restart_domain_state process
-batch_request "${url_a}" "${idempotency_key_a}" "${request_a}" "${work_dir}/response-a-restart.json" 200 \
-  || fail "restart replay failed"
-[[ "$(jq --raw-output '.batch_id' "${work_dir}/response-a-restart.json")" == "${batch_id}" ]] \
-  || fail "restart did not preserve the completed decision"
-
-completed_before_lost_ack="$(completed_batch_count)"
-LOST_ACK_PORT="${notary_port_b}" LOST_ACK_API_KEY="${api_key}" \
-LOST_ACK_IDEMPOTENCY_KEY="${idempotency_key_b}" LOST_ACK_REQUEST="${request_b}" \
-  python3 -c '
-import os
-import socket
-import time
-
-body = open(os.environ["LOST_ACK_REQUEST"], "rb").read()
-port = os.environ["LOST_ACK_PORT"]
-api_key = os.environ["LOST_ACK_API_KEY"]
-idempotency_key = os.environ["LOST_ACK_IDEMPOTENCY_KEY"]
-headers = (
-    "POST /v1/batch-evaluations HTTP/1.1\r\n"
-    f"Host: 127.0.0.1:{port}\r\n"
-    "Connection: close\r\n"
-    f"x-api-key: {api_key}\r\n"
-    f"idempotency-key: {idempotency_key}\r\n"
-    "content-type: application/json\r\n"
-    f"content-length: {len(body)}\r\n\r\n"
-).encode("ascii")
-with socket.create_connection(("127.0.0.1", int(port)), timeout=10) as connection:
-    connection.sendall(headers + body)
-    while True:
-        time.sleep(60)
-' >"${work_dir}/lost-ack-client.log" 2>&1 &
-lost_ack_pid=$!
-completed_after_lost_ack="${completed_before_lost_ack}"
-lost_ack_deadline=$((SECONDS + 30))
-while (( SECONDS < lost_ack_deadline )); do
-  completed_after_lost_ack="$(completed_batch_count)"
-  if (( completed_after_lost_ack > completed_before_lost_ack )); then
-    break
-  fi
-  kill -0 "${lost_ack_pid}" 2>/dev/null || fail "lost-ack request ended before commit"
-  sleep 0.25
-done
-(( completed_after_lost_ack > completed_before_lost_ack )) \
-  || fail "lost-ack request did not commit"
-stop_process "${lost_ack_pid}"
-lost_ack_pid=""
-batch_request "${url_b}" "${idempotency_key_b}" "${request_b}" \
-  "${work_dir}/response-b-retry-1.json" 200 \
-  || fail "lost-ack retry did not replay the committed result"
-batch_request "${url_a}" "${idempotency_key_b}" "${request_b}" \
-  "${work_dir}/response-b-retry-2.json" 200 \
-  || fail "peer lost-ack retry did not replay the committed result"
-[[ "$(jq --raw-output '.batch_id' "${work_dir}/response-b-retry-1.json")" \
-   == "$(jq --raw-output '.batch_id' "${work_dir}/response-b-retry-2.json")" ]] \
-  || fail "lost-ack retry reopened the committed batch"
-[[ "$(jq --raw-output '.items[0].evaluation_id' "${work_dir}/response-b-retry-1.json")" \
-   == "$(jq --raw-output '.items[0].evaluation_id' "${work_dir}/response-b-retry-2.json")" ]] \
-  || fail "lost-ack retry changed the committed evaluation"
-batch_request "${url_a}" "${idempotency_key_c}" "${request_c}" "${work_dir}/response-c-denied.json" 429 \
-  || fail "shared machine quota did not reject excess work"
-
-admin_sql postgres \
-  "ALTER DATABASE registry_notary SET default_transaction_read_only = on;
-   SELECT pg_catalog.pg_terminate_backend(pid)
-     FROM pg_catalog.pg_stat_activity
-    WHERE datname = 'registry_notary'
-      AND usename = 'registry_notary_runtime';"
-wait_not_ready "${url_a}" || fail "read-only PostgreSQL did not fail readiness"
-expect_postgresql_failure \
-  read-only \
-  notary.state.postgresql.database_read_only \
-  "Registry Notary PostgreSQL state database is read-only or recovering" \
-  "restore a writable PostgreSQL primary, run registry-notary state doctor, and retry activation"
-admin_sql postgres 'ALTER DATABASE registry_notary RESET default_transaction_read_only;'
-wait_ready "${url_a}" "${notary_pid_a}" || fail "readiness did not recover after read-only repair"
-"${notary_bin}" --config "${config_path}" state doctor >"${work_dir}/doctor-read-only-recovered.log" 2>&1 \
-  || fail "state doctor did not recover after read-only repair"
-
-admin_sql registry_notary \
-  'ALTER FUNCTION registry_notary_api.replay_insert_v1(bytea, bytea, timestamptz) IMMUTABLE;'
-wait_not_ready "${url_a}" || fail "schema drift did not fail readiness"
-expect_postgresql_failure \
-  catalog-drift \
-  notary.state.postgresql.schema_incompatible \
-  "Registry Notary PostgreSQL state schema contract is incompatible" \
-  "restore or install the matching Registry Notary state schema, run registry-notary state doctor, and retry activation"
-admin_sql registry_notary \
-  'ALTER FUNCTION registry_notary_api.replay_insert_v1(bytea, bytea, timestamptz) VOLATILE;'
-wait_ready "${url_a}" "${notary_pid_a}" || fail "readiness did not recover after schema repair"
-"${notary_bin}" --config "${config_path}" state doctor >"${work_dir}/doctor-schema-recovered.log" 2>&1 \
-  || fail "state doctor did not recover after schema repair"
-
-schema_fingerprint="$(admin_scalar registry_notary \
-  'SELECT schema_fingerprint FROM registry_notary_private.schema_metadata WHERE singleton = TRUE;')"
-[[ "${schema_fingerprint}" =~ ^[0-9a-f]{64}$ ]] \
-  || fail "schema metadata fingerprint was unavailable"
-admin_sql registry_notary \
-  "UPDATE registry_notary_private.schema_metadata
-      SET schema_fingerprint = repeat('0', 64)
-    WHERE singleton = TRUE;"
-wait_not_ready "${url_a}" || fail "metadata fingerprint drift did not fail readiness"
-expect_postgresql_failure \
-  fingerprint-drift \
-  notary.state.postgresql.schema_incompatible \
-  "Registry Notary PostgreSQL state schema contract is incompatible" \
-  "restore or install the matching Registry Notary state schema, run registry-notary state doctor, and retry activation"
-if "${notary_bin}" --config "${config_path}" state install \
-  --migration-url-env REGISTRY_NOTARY_POSTGRES_MIGRATOR_URL \
-  --owner-role registry_notary_owner \
-  --runtime-role registry_notary_runtime \
-  >"${work_dir}/state-install-fingerprint-drift.log" 2>&1; then
-  fail "state install repaired metadata fingerprint drift"
-fi
-[[ "$(admin_scalar registry_notary \
-  'SELECT schema_fingerprint FROM registry_notary_private.schema_metadata WHERE singleton = TRUE;')" \
-   == "$(printf '0%.0s' {1..64})" ]] \
-  || fail "rejected state install changed metadata fingerprint drift"
-admin_sql registry_notary \
-  "UPDATE registry_notary_private.schema_metadata
-      SET schema_fingerprint = '${schema_fingerprint}'
-    WHERE singleton = TRUE;"
-wait_ready "${url_a}" "${notary_pid_a}" \
-  || fail "readiness did not recover after metadata fingerprint repair"
-"${notary_bin}" --config "${config_path}" state doctor \
-  >"${work_dir}/doctor-fingerprint-recovered.log" 2>&1 \
-  || fail "state doctor did not recover after metadata fingerprint repair"
-
-admin_sql registry_notary \
-  'REVOKE EXECUTE ON FUNCTION registry_notary_api.nonce_consume_v1(bytea, bytea, bigint) FROM registry_notary_runtime;'
-wait_not_ready "${url_a}" || fail "runtime permission drift did not fail readiness"
-expect_postgresql_failure \
-  permission-drift \
-  notary.state.postgresql.schema_incompatible \
-  "Registry Notary PostgreSQL state schema contract is incompatible" \
-  "restore or install the matching Registry Notary state schema, run registry-notary state doctor, and retry activation"
-admin_sql registry_notary \
-  'GRANT EXECUTE ON FUNCTION registry_notary_api.nonce_consume_v1(bytea, bytea, bigint) TO registry_notary_runtime;'
-wait_ready "${url_a}" "${notary_pid_a}" || fail "readiness did not recover after permission repair"
-"${notary_bin}" --config "${config_path}" state doctor >"${work_dir}/doctor-permission-recovered.log" 2>&1 \
-  || fail "state doctor did not recover after permission repair"
-
-bound_runtime_role_oid="$(admin_scalar registry_notary \
-  'SELECT runtime_role_oid FROM registry_notary_private.schema_metadata WHERE singleton = TRUE;')"
-[[ "${bound_runtime_role_oid}" =~ ^[0-9]+$ ]] \
-  || fail "bound runtime role identity was unavailable"
-admin_sql registry_notary \
-  "UPDATE registry_notary_private.schema_metadata
-      SET runtime_role_oid = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = 'postgres')
-    WHERE singleton = TRUE;"
-wait_not_ready "${url_a}" || fail "wrong runtime role did not fail readiness"
-expect_postgresql_failure \
-  role-incompatible \
-  notary.state.postgresql.role_incompatible \
-  "Registry Notary PostgreSQL runtime role contract is incompatible" \
-  "restore the documented runtime grants and role binding, run registry-notary state doctor, and retry activation"
-admin_sql registry_notary \
-  "UPDATE registry_notary_private.schema_metadata
-      SET runtime_role_oid = ${bound_runtime_role_oid}
-    WHERE singleton = TRUE;"
-wait_ready "${url_a}" "${notary_pid_a}" \
-  || fail "readiness did not recover after runtime role repair"
-
-if [[ "${postgresql_major}" == "18" ]]; then
-  docker stop --time 20 "${postgres_container}" >/dev/null
-  docker run --detach --name "${unsupported_postgres_container}" \
-    --env "POSTGRES_USER=registry_notary_runtime" \
-    --env "POSTGRES_PASSWORD=${runtime_password}" \
-    --env "POSTGRES_DB=registry_notary" \
-    --mount "type=volume,source=${postgres_cert_volume},target=/certs,readonly" \
-    --publish "127.0.0.1:${postgres_port}:5432" \
-    "${unsupported_postgres_image}" \
-    -c ssl=on \
-    -c ssl_cert_file=/certs/server.crt \
-    -c ssl_key_file=/certs/server.key \
-    -c fsync=on \
-    -c synchronous_commit=on \
-    -c full_page_writes=on >/dev/null
-  unsupported_deadline=$((SECONDS + 90))
-  while (( SECONDS < unsupported_deadline )); do
-    if docker exec "${unsupported_postgres_container}" pg_isready --host 127.0.0.1 \
-      --username registry_notary_runtime --dbname registry_notary >/dev/null 2>&1 \
-      && [[ "$(docker exec --env "PGPASSWORD=${runtime_password}" \
-        "${unsupported_postgres_container}" psql --host 127.0.0.1 \
-        --username registry_notary_runtime --dbname registry_notary --tuples-only --no-align \
-        --set ON_ERROR_STOP=1 --command 'SELECT 1' 2>/dev/null)" == "1" ]]; then
-      break
-    fi
-    sleep 1
-  done
-  (( SECONDS < unsupported_deadline )) \
-    || fail "unsupported PostgreSQL test server did not become ready"
-  wait_not_ready "${url_a}" || fail "unsupported PostgreSQL major did not fail readiness"
-  expect_postgresql_failure \
-    unsupported-major \
-    notary.state.postgresql.database_unsupported \
-    "Registry Notary PostgreSQL server major is unsupported" \
-    "move the state database to a supported PostgreSQL major, run registry-notary state doctor, and retry activation"
-  docker rm -f "${unsupported_postgres_container}" >/dev/null
-  docker start "${postgres_container}" >/dev/null
-  wait_for_postgres
-  wait_ready "${url_a}" "${notary_pid_a}" \
-    || fail "readiness did not recover after supported PostgreSQL restoration"
-fi
-
-docker stop --time 20 "${postgres_container}" >/dev/null
-wait_not_ready "${url_a}" || fail "unavailable PostgreSQL did not fail readiness"
-expect_postgresql_failure \
-  unavailable \
-  notary.state.postgresql.database_unavailable \
-  "Registry Notary PostgreSQL state database is unavailable" \
-  "check PostgreSQL reachability, TLS trust, and service health, then run registry-notary state doctor"
-install_postgres_certificate untrusted-server
-docker start "${postgres_container}" >/dev/null
-wait_for_postgres
-wait_not_ready "${url_a}" || fail "untrusted PostgreSQL certificate did not fail readiness"
-expect_postgresql_failure \
-  tls \
-  notary.state.postgresql.database_unavailable \
-  "Registry Notary PostgreSQL state database is unavailable" \
-  "check PostgreSQL reachability, TLS trust, and service health, then run registry-notary state doctor"
-docker stop --time 20 "${postgres_container}" >/dev/null
-install_postgres_certificate server
-docker start "${postgres_container}" >/dev/null
-wait_for_postgres
-wait_ready "${url_a}" "${notary_pid_a}" \
-  || fail "running Notary did not reconnect after PostgreSQL recovery"
-wait_ready "${url_b}" "${notary_pid_b}" \
-  || fail "running peer Notary did not reconnect after PostgreSQL recovery"
-batch_request "${url_a}" "${idempotency_key_a}" "${request_a}" \
-  "${work_dir}/response-a-outage-recovered.json" 200 \
-  || fail "running Notary could not use state after PostgreSQL recovery"
-assert_restart_domain_state database
-[[ "$(runtime_connection_count)" == "2" ]] \
-  || fail "outage recovery exceeded the configured PostgreSQL connection cap"
-stop_process "${notary_pid_a}"
-stop_process "${notary_pid_b}"
-notary_pid_a=""
-notary_pid_b=""
-
-echo "notary PostgreSQL ${postgresql_major} conformance: minor upgrade"
-
-source_version="$(docker exec "${postgres_container}" psql --tuples-only --no-align --username postgres --dbname postgres --command 'SHOW server_version_num')"
-[[ "${source_version}" =~ ^[0-9]+$ ]] || fail "source PostgreSQL version is unavailable"
-(( source_version / 10000 == postgresql_major )) || fail "source PostgreSQL major does not match the matrix"
-docker stop --time 30 "${postgres_container}" >/dev/null
-docker rm "${postgres_container}" >/dev/null
-start_postgres "${target_image}"
-target_version="$(docker exec "${postgres_container}" psql --tuples-only --no-align --username postgres --dbname postgres --command 'SHOW server_version_num')"
-[[ "${target_version}" =~ ^[0-9]+$ ]] || fail "target PostgreSQL version is unavailable"
-(( target_version / 10000 == postgresql_major )) || fail "target PostgreSQL major does not match the matrix"
-(( target_version > source_version )) || fail "PostgreSQL minor version did not advance"
-"${notary_bin}" --config "${config_path}" state doctor >"${work_dir}/doctor-upgraded.log" 2>&1 \
-  || fail "state attestation failed after the minor upgrade"
-
-start_notary "127.0.0.1:${notary_port_a}" "${work_dir}/notary-a-upgraded.log" notary_pid_a
-wait_ready "${url_a}" "${notary_pid_a}" || fail "Notary did not become ready after the minor upgrade"
-batch_request "${url_a}" "${idempotency_key_a}" "${request_a}" "${work_dir}/response-a-upgraded.json" 200 \
-  || fail "completed decision was unavailable after the minor upgrade"
-[[ "$(jq --raw-output '.batch_id' "${work_dir}/response-a-upgraded.json")" == "${batch_id}" ]] \
-  || fail "minor upgrade reopened a completed decision"
-
-render_status="$(curl --silent --show-error --max-time 30 \
-  --output "${work_dir}/render-upgraded.json" --write-out '%{http_code}' \
-  --header "x-api-key: ${api_key}" \
-  --header 'content-type: application/json' \
-  --data '{"format":"application/vnd.registry-notary.claim-result+json","disclosure":"predicate","claims":["conformance-eligible"],"purpose":"benefit-status-verification"}' \
-  "${url_a}/v1/evaluations/${evaluation_id}/render" 2>>"${work_dir}/curl.log")" \
-  || fail "persisted evaluation render request failed"
-[[ "${render_status}" == "200" ]] || fail "persisted evaluation was unavailable after the minor upgrade"
-
-"${notary_bin}" --config "${config_path}" state doctor \
-  >"${work_dir}/doctor-pre-backup.log" 2>&1 \
-  || fail "state attestation failed before backup"
-
-if [[ "${restore_major}" == "${postgresql_major}" ]]; then
-  echo "notary PostgreSQL ${postgresql_major} conformance: logical backup and restore"
-else
-  echo "notary PostgreSQL ${postgresql_major}->${restore_major} conformance: logical upgrade"
-fi
-  stop_process "${notary_pid_a}"
-  notary_pid_a=""
-  docker exec --env "PGPASSWORD=${migrator_password}" --env PGSSLMODE=require \
-    "${postgres_container}" pg_dump --host 127.0.0.1 \
-    --username registry_notary_migrator --role registry_notary_owner \
-    --dbname registry_notary --format custom --no-acl \
-    --file /tmp/notary-conformance.dump \
-    >"${work_dir}/pg-dump.log" 2>&1
-  docker cp "${postgres_container}:/tmp/notary-conformance.dump" "${work_dir}/notary-conformance.dump" \
-    >"${work_dir}/docker-copy.log" 2>&1
-  docker stop --time 30 "${postgres_container}" >/dev/null
-  docker rm "${postgres_container}" >/dev/null
-  docker volume rm "${postgres_data_volume}" >/dev/null
-  docker volume create "${postgres_data_volume}" >/dev/null
-  start_postgres "${restore_image}"
-  restored_version="$(docker exec "${postgres_container}" psql --tuples-only --no-align \
-    --username postgres --dbname postgres --command 'SHOW server_version_num')"
-  [[ "${restored_version}" =~ ^[0-9]+$ ]] || fail "restore PostgreSQL version is unavailable"
-  (( restored_version / 10000 == restore_major )) || fail "restore PostgreSQL major does not match"
-  provision_roles true "${work_dir}/role-restore-install.log"
-  restored_role_oids="$(role_oid_pair)"
-  [[ "${restored_role_oids}" =~ ^[0-9]+:[0-9]+$ ]] || fail "restored role identities are unavailable"
-  [[ "${restored_role_oids}" != "${source_role_oids}" ]] || fail "fresh-cluster role identities did not change"
-  docker cp "${work_dir}/notary-conformance.dump" "${postgres_container}:/tmp/notary-conformance-restore.dump" \
-    >>"${work_dir}/docker-copy.log" 2>&1
-  docker exec --env "PGPASSWORD=${migrator_password}" --env PGSSLMODE=require \
-    "${postgres_container}" pg_restore --host 127.0.0.1 \
-    --exit-on-error --single-transaction --no-acl --no-owner \
-    --role registry_notary_owner --username registry_notary_migrator \
-    --dbname registry_notary /tmp/notary-conformance-restore.dump \
-    >"${work_dir}/pg-restore.log" 2>&1
-  "${notary_bin}" --config "${config_path}" state install \
-    --migration-url-env REGISTRY_NOTARY_POSTGRES_MIGRATOR_URL \
-    --owner-role registry_notary_owner \
-    --runtime-role registry_notary_runtime \
-    >"${work_dir}/state-install-restored.log" 2>&1 \
-    || fail "schema role binding failed after logical restore"
-  "${notary_bin}" --config "${config_path}" state doctor >"${work_dir}/doctor-restored.log" 2>&1 \
-    || fail "state attestation failed after logical restore"
-  assert_restart_domain_state restore
-  [[ "$(runtime_scalar "SELECT registry_notary_api.nonce_consume_v1(
-    decode(repeat('d3', 32), 'hex'), decode(repeat('d4', 32), 'hex'), 1);")" == "t" ]] \
-    || fail "restored nonce could not be consumed"
-  [[ "$(runtime_scalar "SELECT registry_notary_api.nonce_consume_v1(
-    decode(repeat('d3', 32), 'hex'), decode(repeat('d4', 32), 'hex'), 1);")" == "f" ]] \
-    || fail "restored nonce had more than one consume winner"
-  machine_window_is_live="$(admin_scalar registry_notary \
-    "SELECT window_expires_at > pg_catalog.clock_timestamp()
-       FROM registry_notary_private.machine_quota
-      WHERE principal_hash = decode(repeat('d7', 32), 'hex');")"
-  machine_followup_allowed="$(runtime_scalar \
-    "SELECT allowed FROM registry_notary_api.machine_quota_debit_v1(
-       decode(repeat('d7', 32), 'hex'), 10, 8);")"
-  if [[ "${machine_window_is_live}" == "t" ]]; then
-    [[ "${machine_followup_allowed}" == "f" ]] \
-      || fail "restored live machine-quota window admitted excess cost"
-    [[ "$(admin_scalar registry_notary "SELECT used
-      FROM registry_notary_private.machine_quota
-      WHERE principal_hash = decode(repeat('d7', 32), 'hex');")" == "3" ]] \
-      || fail "rejected restored machine-quota debit changed the counter"
-  else
-    [[ "${machine_followup_allowed}" == "t" ]] \
-      || fail "expired restored machine-quota window did not reopen from database time"
-    [[ "$(admin_scalar registry_notary "SELECT used
-      FROM registry_notary_private.machine_quota
-      WHERE principal_hash = decode(repeat('d7', 32), 'hex');")" == "8" ]] \
-      || fail "expired restored machine-quota window did not reset atomically"
-  fi
-  [[ "$(runtime_scalar "SELECT allowed FROM registry_notary_api.subject_access_quota_check_v1(
-    ARRAY['per_principal']::text[], ARRAY[decode(repeat('d8', 32), 'hex')]::bytea[],
-    ARRAY[1]::integer[], ARRAY[3600]::integer[]);")" == "f" ]] \
-    || fail "restored subject quota reopened its exhausted bucket"
-  start_notary "127.0.0.1:${notary_port_a}" "${work_dir}/notary-a-restored.log" notary_pid_a
-  wait_ready "${url_a}" "${notary_pid_a}" || fail "Notary did not become ready after logical restore"
-  batch_request "${url_a}" "${idempotency_key_a}" "${request_a}" "${work_dir}/response-a-restored.json" 200 \
-    || fail "completed decision was unavailable after logical restore"
-  [[ "$(jq --raw-output '.batch_id' "${work_dir}/response-a-restored.json")" == "${batch_id}" ]] \
-    || fail "logical restore reopened a completed decision"
-
-for output in "${work_dir}"/*.log; do
-  [[ -f "${output}" ]] || continue
-  for forbidden in \
-    "${admin_password}" "${migrator_password}" "${runtime_password}" \
-    "${api_key}" "${api_key_hash}" "${audit_secret}" "${sensitive_state_key}" \
-    "${idempotency_key_a}" "${idempotency_key_b}" "${idempotency_key_c}" \
-    "${target_a}" "${target_b}" "${target_c}" \
-    "restart-process-pkce-secret" "restart-database-pkce-secret" \
-    "restart-restore-pkce-secret" "restart-process-login-nonce" \
-    "restart-database-login-nonce" "restart-restore-login-nonce" \
-    "${sensitive_probe_pin}"; do
-    if grep --fixed-strings --quiet -- "${forbidden}" "${output}"; then
-      fail "a log or diagnostic exposed a synthetic sensitive value"
-    fi
-  done
-done
-for output in "${work_dir}"/response-*.json "${work_dir}"/render-*.json; do
-  [[ -f "${output}" ]] || continue
-  for forbidden in "${target_a}" "${target_b}" "${target_c}"; do
-    if grep --fixed-strings --quiet -- "${forbidden}" "${output}"; then
-      fail "an API response exposed a raw target identifier"
-    fi
-  done
-done
-
-echo "notary PostgreSQL ${postgresql_major} conformance OK"
diff --git a/products/notary/security/advisory-baseline.json b/products/notary/security/advisory-baseline.json
deleted file mode 100644
index 80baa1ee9..000000000
--- a/products/notary/security/advisory-baseline.json
+++ /dev/null
@@ -1,70 +0,0 @@
-{
-  "version": 3,
-  "service": "registry-notary",
-  "policies": [
-    {
-      "tool": "zizmor",
-      "minimum_severity": "high",
-      "action": "block_unreviewed"
-    },
-    {
-      "tool": "grype",
-      "minimum_severity": "high",
-      "action": "block_unreviewed",
-      "block_fixable": true
-    }
-  ],
-  "exceptions": [
-    {
-      "vulnerability_id": "CVE-2026-5450",
-      "package": "libc6",
-      "installed_version": "2.41-12+deb13u3",
-      "severity": "Critical",
-      "status": "accepted_risk",
-      "owner": "@jeremi",
-      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. Registry Notary uses only reviewed fixed-format sscanf conversions and does not contain an effective vulnerable %mc format.",
-      "reviewed_at": "2026-07-28",
-      "expires_at": "2026-08-28",
-      "invalidation_triggers": [
-        "expired",
-        "fix_available",
-        "material_finding_changed",
-        "package_version_changed"
-      ]
-    },
-    {
-      "vulnerability_id": "CVE-2026-5928",
-      "package": "libc6",
-      "installed_version": "2.41-12+deb13u3",
-      "severity": "High",
-      "status": "accepted_risk",
-      "owner": "@jeremi",
-      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. Neither Registry Notary executable directly imports ungetwc.",
-      "reviewed_at": "2026-07-28",
-      "expires_at": "2026-08-28",
-      "invalidation_triggers": [
-        "expired",
-        "fix_available",
-        "material_finding_changed",
-        "package_version_changed"
-      ]
-    },
-    {
-      "vulnerability_id": "CVE-2026-5435",
-      "package": "libc6",
-      "installed_version": "2.41-12+deb13u3",
-      "severity": "High",
-      "status": "accepted_risk",
-      "owner": "@jeremi",
-      "rationale": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed upstream or Trixie version. Neither Registry Notary executable directly imports ns_printrrf, ns_printrr, or fp_nquery.",
-      "reviewed_at": "2026-07-28",
-      "expires_at": "2026-08-28",
-      "invalidation_triggers": [
-        "expired",
-        "fix_available",
-        "material_finding_changed",
-        "package_version_changed"
-      ]
-    }
-  ]
-}
diff --git a/products/notary/security/auth-none-allowlist.yml b/products/notary/security/auth-none-allowlist.yml
deleted file mode 100644
index 3bd734b41..000000000
--- a/products/notary/security/auth-none-allowlist.yml
+++ /dev/null
@@ -1,54 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-allowed:
-  - listener: public
-    method: GET
-    path: /healthz
-    reason: Health probe.
-  - listener: public
-    method: GET
-    path: /ready
-    reason: Readiness probe.
-  - listener: public
-    method: GET
-    path: /docs
-    reason: Public static API docs shell; it does not inline the OpenAPI document.
-  - listener: public
-    method: GET
-    path: /docs/scalar.js
-    reason: Public static Scalar bundle with no generated OpenAPI document or catalog data.
-  - listener: public
-    method: GET
-    path: /.well-known/evidence/jwks.json
-    reason: Public issuer JWKS for wallet and verifier discovery; only public verification keys are emitted.
-  - listener: public
-    method: GET
-    path: /.well-known/openid-credential-issuer
-    reason: Public OID4VCI issuer metadata.
-  - listener: public
-    method: GET
-    path: /oid4vci/offer/start
-    reason: Public OID4VCI pre-authorized-code browser start endpoint.
-  - listener: public
-    method: GET
-    path: /oid4vci/offer/callback
-    reason: Public OID4VCI pre-authorized-code IdP callback endpoint with route-local state validation.
-  - listener: public
-    method: POST
-    path: /oid4vci/offer/representative
-    reason: Public OID4VCI representative target-selection endpoint with single-use state, CSRF, relationship-proof, and rate-limit controls.
-  - listener: public
-    method: POST
-    path: /oid4vci/token
-    reason: Public OID4VCI pre-authorized-code token endpoint with code, PIN, and route-local replay controls.
-  - listener: public
-    method: GET
-    path: /credentials/{*vct_path}
-    reason: "Public SD-JWT VC type metadata. Bare path is protocol-required: the VCT URL path component must be preserved exactly for dereference; adding /v1/ would break any credential whose vct does not include that prefix. Distinct from POST /v1/credentials (credential issuance)."
-  - listener: public
-    method: GET
-    path: /.well-known/vct/{*vct_path}
-    reason: "Public SD-JWT VC Type Metadata well-known route. Bare path is protocol-required per RFC 8615: well-known URI paths are determined by the protocol and cannot be prefixed."
-  - listener: public
-    method: GET
-    path: /v1/credentials/{credential_id}/status
-    reason: Public credential status lookup with opaque credential id.
diff --git a/products/notary/security/exposure-manifest.json b/products/notary/security/exposure-manifest.json
deleted file mode 100644
index 8138a3b7f..000000000
--- a/products/notary/security/exposure-manifest.json
+++ /dev/null
@@ -1,663 +0,0 @@
-{
-  "version": 1,
-  "generated_at": "manual-baseline",
-  "service": "registry-notary",
-  "endpoints": [
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "GET",
-      "path": "/healthz",
-      "feature": null,
-      "audience": "health",
-      "auth": "none",
-      "scopes": [],
-      "rate_limit": null,
-      "audit": "not_applicable",
-      "openapi": false,
-      "stability": "beta",
-      "data_classification": "metadata",
-      "notes": "Intentionally unauthenticated public route with route-local or protocol-specific controls.",
-      "source": "manual",
-      "enforcement_tests": [],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "GET",
-      "path": "/ready",
-      "feature": null,
-      "audience": "health",
-      "auth": "none",
-      "scopes": [],
-      "rate_limit": null,
-      "audit": "not_applicable",
-      "openapi": false,
-      "stability": "beta",
-      "data_classification": "metadata",
-      "notes": "Intentionally unauthenticated public route with route-local or protocol-specific controls.",
-      "source": "manual",
-      "enforcement_tests": [],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "admin",
-      "method": "POST",
-      "path": "/admin/v1/reload",
-      "feature": null,
-      "audience": "operator",
-      "auth": "api_key_or_oidc",
-      "scopes": [
-        "registry_notary:admin"
-      ],
-      "rate_limit": null,
-      "audit": "required",
-      "openapi": true,
-      "stability": "admin",
-      "data_classification": "operational",
-      "notes": "Protected Registry Notary route.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/src/standalone/tests/auth.inc::evidence_service_discovery_is_not_auth_exempt",
-        "crates/registry-notary-server/tests/standalone_http/audit.rs::standalone_server_authenticates_and_audits_registry_evaluation"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "GET",
-      "path": "/docs",
-      "feature": null,
-      "audience": "external",
-      "auth": "none",
-      "scopes": [],
-      "rate_limit": null,
-      "audit": "not_applicable",
-      "openapi": false,
-      "stability": "beta",
-      "data_classification": "metadata",
-      "notes": "Public static Scalar docs shell. It does not inline the OpenAPI document; /openapi.json remains authenticated by default.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/http_contracts.rs::standalone_server_serves_docs_shell_without_auth"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "GET",
-      "path": "/docs/scalar.js",
-      "feature": null,
-      "audience": "external",
-      "auth": "none",
-      "scopes": [],
-      "rate_limit": null,
-      "audit": "not_applicable",
-      "openapi": false,
-      "stability": "beta",
-      "data_classification": "metadata",
-      "notes": "Public static Scalar bundle. It contains no generated OpenAPI document or catalog data.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/http_contracts.rs::standalone_server_serves_docs_shell_without_auth"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "admin",
-      "method": "GET",
-      "path": "/admin/v1/capabilities",
-      "feature": null,
-      "audience": "operator",
-      "auth": "api_key_or_oidc",
-      "scopes": [
-        "registry_notary:ops_read"
-      ],
-      "rate_limit": null,
-      "audit": "required",
-      "openapi": true,
-      "stability": "admin",
-      "data_classification": "operational",
-      "notes": "Read-only capabilities route for discovering supported reload and config trust posture operations.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/admin.rs::admin_capabilities_requires_ops_read_and_reports_notary_surface"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "admin",
-      "method": "GET",
-      "path": "/admin/v1/posture",
-      "feature": null,
-      "audience": "operator",
-      "auth": "api_key_or_oidc",
-      "scopes": [
-        "registry_notary:ops_read"
-      ],
-      "rate_limit": null,
-      "audit": "required",
-      "openapi": false,
-      "stability": "admin",
-      "data_classification": "operational",
-      "notes": "Read-only redacted operations posture route. In dedicated admin mode it is not mounted on the public listener; simple local shared mode still requires registry_notary:ops_read and local network controls.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/admin.rs::admin_posture_requires_ops_read_not_admin_and_ops_cannot_reload"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "GET",
-      "path": "/openapi.json",
-      "feature": null,
-      "audience": "external",
-      "auth": "api_key_or_oidc",
-      "scopes": [],
-      "rate_limit": null,
-      "audit": "required",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "metadata",
-      "notes": "Protected Registry Notary route; route boundary requires an authenticated principal but no fixed scope.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/audit.rs::standalone_server_authenticates_and_audits_registry_evaluation"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "GET",
-      "path": "/.well-known/evidence-service",
-      "feature": null,
-      "audience": "external",
-      "auth": "api_key_or_oidc",
-      "scopes": [
-        "evidence:metadata"
-      ],
-      "rate_limit": null,
-      "audit": "required",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "metadata",
-      "notes": "Protected Registry Notary route.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/audit.rs::standalone_server_authenticates_and_audits_registry_evaluation"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "GET",
-      "path": "/.well-known/evidence/jwks.json",
-      "feature": null,
-      "audience": "external",
-      "auth": "none",
-      "scopes": [],
-      "rate_limit": null,
-      "audit": "not_applicable",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "metadata",
-      "notes": "Intentionally unauthenticated public JWKS well-known route for wallet and verifier discovery; only public issuer verification keys are emitted.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/auth.rs::jwks_is_public_and_contains_no_private_members"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "GET",
-      "path": "/.well-known/openid-credential-issuer",
-      "feature": null,
-      "audience": "external",
-      "auth": "none",
-      "scopes": [],
-      "rate_limit": null,
-      "audit": "not_applicable",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "credential",
-      "notes": "Intentionally unauthenticated public route; auth/audit middleware bypass is exact-match allowlisted and route-local controls apply where relevant.",
-      "source": "manual",
-      "enforcement_tests": [],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "GET",
-      "path": "/credentials/{*vct_path}",
-      "feature": null,
-      "audience": "external",
-      "auth": "none",
-      "scopes": [],
-      "rate_limit": null,
-      "audit": "not_applicable",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "credential",
-      "notes": "Intentionally unauthenticated public route; auth/audit middleware bypass is exact-match allowlisted and route-local controls apply where relevant. Deliberate freeze exception: this route is intentionally bare (no /v1/ prefix) because per SD-JWT VC type-metadata dereference the path must match the VCT URL path component exactly; prefixing would break dereference for any credential whose vct does not include that prefix. Unrelated to POST /v1/credentials (credential issuance).",
-      "source": "manual",
-      "enforcement_tests": [],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "GET",
-      "path": "/.well-known/vct/{*vct_path}",
-      "feature": null,
-      "audience": "external",
-      "auth": "none",
-      "scopes": [],
-      "rate_limit": null,
-      "audit": "not_applicable",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "credential",
-      "notes": "Intentionally unauthenticated public SD-JWT VC Type Metadata well-known route; auth/audit middleware bypass is exact prefix allowlisted. Deliberate freeze exception: this route is intentionally bare (no /v1/ prefix) because per RFC 8615 well-known URI semantics the path prefix is determined by the protocol and cannot be changed. Unrelated to POST /v1/credentials (credential issuance).",
-      "source": "manual",
-      "enforcement_tests": [],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "GET",
-      "path": "/oid4vci/offer/start",
-      "feature": null,
-      "audience": "external",
-      "auth": "none",
-      "scopes": [],
-      "rate_limit": "bounded_login_state",
-      "audit": "not_applicable",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "credential",
-      "notes": "Intentionally unauthenticated public OID4VCI pre-authorized-code browser start route. The route reserves bounded login state and redirects to the configured IdP without minting a credential offer.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/preauth.rs::preauth_offer_start_redirects_to_esignet_and_mints_nothing",
-        "crates/registry-notary-server/tests/standalone_http/preauth.rs::preauth_offer_start_returns_429_when_login_state_store_is_full",
-        "crates/registry-notary-server/tests/standalone_http/preauth.rs::preauth_disabled_exposes_no_wallet_issuance_grant"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "GET",
-      "path": "/oid4vci/offer/callback",
-      "feature": null,
-      "audience": "external",
-      "auth": "none",
-      "scopes": [],
-      "rate_limit": null,
-      "audit": "required",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "secret-adjacent",
-      "notes": "Intentionally unauthenticated public OID4VCI pre-authorized-code callback route. Route-local state, nonce, IdP token exchange, subject binding, and hashed-only audit controls apply. The exact registry-backed Relay evaluation and provenance checks must succeed before any offer is minted.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/preauth.rs::preauth_callback_mints_pre_authorized_offer_with_tx_code",
-        "crates/registry-notary-server/tests/standalone_http/preauth.rs::preauth_callback_and_token_audit_events_carry_only_hashes"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "POST",
-      "path": "/oid4vci/offers",
-      "feature": null,
-      "audience": "external",
-      "auth": "api_key_or_oidc",
-      "scopes": [
-        "registry_notary:credential_offer_create"
-      ],
-      "rate_limit": "machine_client_offer",
-      "audit": "required",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "secret-adjacent",
-      "notes": "Protected registrar integration route. It also requires the selected credential-configuration scope, exact target-scoped authorization_details, a caller-owned fresh registry-backed evaluation, current exact Relay provenance and configuration, and Idempotency-Key. Atomic correctness state binds one evaluation to one transaction, charges the client-scoped quota, and returns the exact stored response for an exact retry. Registrar-created offers always require a separately delivered numeric tx_code. The response is non-storable, and the numeric value is never embedded in the credential_offer_uri.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/src/standalone/tests/auth.inc::registrar_offer_creation_is_not_auth_exempt",
-        "crates/registry-notary-server/src/preauth_state.rs::registry_client_offer_exact_replay_returns_the_cached_response",
-        "crates/registry-notary-server/src/preauth_state.rs::concurrent_idempotency_keys_consume_an_evaluation_once"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "POST",
-      "path": "/oid4vci/offer/representative",
-      "feature": null,
-      "audience": "external",
-      "auth": "none",
-      "scopes": [],
-      "rate_limit": "subject_access_principal",
-      "audit": "required",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "secret-adjacent",
-      "notes": "Intentionally unauthenticated browser continuation after authenticated representative login. The route consumes single-use encrypted state, checks CSRF in constant time, validates one bounded target identifier, applies principal rate limits, proves the configured relationship and exact claim closure through Relay, and emits only hashed audit references before minting an offer.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/src/api/oid4vci/preauth.rs::representative_target_form_is_closed_bounded_and_exact",
-        "crates/registry-notary-server/src/preauth_state.rs::representative_selection_state_is_sensitive_and_single_use",
-        "crates/registry-notary-server/src/runtime/tests/evaluation.rs::delegated_capability_denies_a_registry_dependency_omitted_from_the_committed_closure",
-        "crates/registry-notary-server/src/runtime/tests/evaluation.rs::delegated_capability_allows_the_exact_committed_registry_dependency_closure"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "POST",
-      "path": "/oid4vci/token",
-      "feature": null,
-      "audience": "external",
-      "auth": "none",
-      "scopes": [],
-      "rate_limit": "preauth_token",
-      "audit": "required",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "secret-adjacent",
-      "notes": "Intentionally unauthenticated public OID4VCI pre-authorized-code token route. Route-local code, PIN, replay, flood-throttle, and hashed-only audit controls apply before access-token issuance.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/preauth.rs::preauth_token_endpoint_issues_access_token_and_c_nonce",
-        "crates/registry-notary-server/tests/standalone_http/preauth.rs::preauth_token_rejects_wrong_and_missing_tx_code",
-        "crates/registry-notary-server/tests/standalone_http/preauth.rs::preauth_random_code_flood_is_throttled_per_client_address",
-        "crates/registry-notary-server/tests/standalone_http/preauth.rs::preauth_callback_and_token_audit_events_carry_only_hashes"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "POST",
-      "path": "/oid4vci/credential",
-      "feature": null,
-      "audience": "external",
-      "auth": "bearer",
-      "scopes": [],
-      "rate_limit": "subject_access",
-      "audit": "required",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "credential",
-      "notes": "Protected OID4VCI credential endpoint. The proof precheck requires an EdDSA did:jwk holder proof before bearer-token auth. Issuance is bound to the immutable registry-backed offer transaction, performs no Relay call, materializes at most one credential, and returns the encrypted cached response for an exact retry.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/oid4vci.rs::oid4vci_malformed_proof_is_rejected_before_oidc_auth",
-        "crates/registry-notary-server/tests/standalone_http/preauth.rs::preauth_end_to_end_issues_sd_jwt_vc_bound_to_holder"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "GET",
-      "path": "/v1/claims",
-      "feature": null,
-      "audience": "external",
-      "auth": "api_key_or_oidc",
-      "scopes": [],
-      "rate_limit": null,
-      "audit": "required",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "metadata",
-      "notes": "Protected Registry Notary route; route boundary requires an authenticated principal but no fixed scope.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/audit.rs::standalone_server_authenticates_and_audits_registry_evaluation"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "GET",
-      "path": "/v1/claims/{claim_id}",
-      "feature": null,
-      "audience": "external",
-      "auth": "api_key_or_oidc",
-      "scopes": [],
-      "rate_limit": null,
-      "audit": "required",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "metadata",
-      "notes": "Protected Registry Notary route; route boundary requires an authenticated principal but no fixed scope.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/audit.rs::standalone_server_authenticates_and_audits_registry_evaluation"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "GET",
-      "path": "/v1/formats",
-      "feature": null,
-      "audience": "external",
-      "auth": "api_key_or_oidc",
-      "scopes": [],
-      "rate_limit": null,
-      "audit": "required",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "metadata",
-      "notes": "Protected Registry Notary route; route boundary requires an authenticated principal but no fixed scope.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/audit.rs::standalone_server_authenticates_and_audits_registry_evaluation"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "POST",
-      "path": "/v1/evaluations",
-      "feature": null,
-      "audience": "external",
-      "auth": "api_key_or_oidc",
-      "scopes": [
-        "evidence:evaluate"
-      ],
-      "rate_limit": null,
-      "audit": "required",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "personal",
-      "notes": "Protected Registry Notary route.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/audit.rs::standalone_server_authenticates_and_audits_registry_evaluation"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "POST",
-      "path": "/v1/batch-evaluations",
-      "feature": null,
-      "audience": "external",
-      "auth": "api_key_or_oidc",
-      "scopes": [
-        "evidence:evaluate"
-      ],
-      "rate_limit": null,
-      "audit": "required",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "personal",
-      "notes": "Protected Registry Notary route.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/audit.rs::standalone_server_authenticates_and_audits_registry_evaluation"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "POST",
-      "path": "/v1/evaluations/{evaluation_id}/render",
-      "feature": null,
-      "audience": "external",
-      "auth": "api_key_or_oidc",
-      "scopes": [
-        "evidence:evaluate"
-      ],
-      "rate_limit": null,
-      "audit": "required",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "personal",
-      "notes": "Protected Registry Notary route.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/audit.rs::standalone_server_authenticates_and_audits_registry_evaluation"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "POST",
-      "path": "/v1/credentials",
-      "feature": null,
-      "audience": "external",
-      "auth": "api_key_or_oidc",
-      "scopes": [
-        "credential:issue"
-      ],
-      "rate_limit": "subject_access",
-      "audit": "required",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "credential",
-      "notes": "Protected Registry Notary route.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/audit.rs::standalone_server_authenticates_and_audits_registry_evaluation"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "GET",
-      "path": "/v1/credentials/{credential_id}/status",
-      "feature": null,
-      "audience": "external",
-      "auth": "none",
-      "scopes": [],
-      "rate_limit": null,
-      "audit": "not_applicable",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "credential",
-      "notes": "Intentionally unauthenticated public route; auth/audit middleware bypass is exact-match allowlisted and route-local controls apply where relevant.",
-      "source": "manual",
-      "enforcement_tests": [],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "admin",
-      "method": "POST",
-      "path": "/admin/v1/credentials/{credential_id}/status",
-      "feature": null,
-      "audience": "operator",
-      "auth": "api_key_or_oidc",
-      "scopes": [
-        "registry_notary:admin"
-      ],
-      "rate_limit": null,
-      "audit": "required",
-      "openapi": true,
-      "stability": "admin",
-      "data_classification": "credential",
-      "notes": "Protected Registry Notary route.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/audit.rs::standalone_server_authenticates_and_audits_registry_evaluation"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "public",
-      "method": "POST",
-      "path": "/federation/v1/evaluations",
-      "feature": "federation.enabled",
-      "audience": "external",
-      "auth": "jws",
-      "scopes": [
-        "trusted_peer"
-      ],
-      "rate_limit": null,
-      "audit": "required",
-      "openapi": true,
-      "stability": "beta",
-      "data_classification": "personal",
-      "notes": "Public federation ingress protected by signed peer JWS and replay checks.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/federation.rs::federation_evaluation_returns_signed_response_and_rejects_replay",
-        "crates/registry-notary-server/tests/standalone_http/federation.rs::federation_denial_happens_before_claim_evaluation"
-      ],
-      "waiver": null
-    },
-    {
-      "service": "registry-notary",
-      "listener": "admin",
-      "method": "GET",
-      "path": "/metrics",
-      "feature": null,
-      "audience": "operator",
-      "auth": "api_key_or_oidc",
-      "scopes": [
-        "registry_notary:admin"
-      ],
-      "rate_limit": null,
-      "audit": "required",
-      "openapi": false,
-      "stability": "admin",
-      "data_classification": "operational",
-      "notes": "Admin metrics route mounted on the admin listener in dedicated mode and handler-enforced by admin scope. Simple local shared mode keeps the same admin-scope gate.",
-      "source": "manual",
-      "enforcement_tests": [
-        "crates/registry-notary-server/tests/standalone_http/audit.rs::standalone_server_authenticates_and_audits_registry_evaluation"
-      ],
-      "waiver": null
-    }
-  ]
-}
diff --git a/products/notary/security/route-inventory.json b/products/notary/security/route-inventory.json
deleted file mode 100644
index 7187b4f93..000000000
--- a/products/notary/security/route-inventory.json
+++ /dev/null
@@ -1,250 +0,0 @@
-{
-  "version": 1,
-  "service": "registry-notary",
-  "routes": [
-    {
-      "listener": "public",
-      "path": "/healthz",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/ready",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "admin",
-      "path": "/admin/v1/reload",
-      "methods": [
-        "POST"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "admin",
-      "path": "/admin/v1/capabilities",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "admin",
-      "path": "/admin/v1/posture",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs",
-      "notes": "Read-only redacted operations posture route. In dedicated admin mode it is not mounted on the public listener; simple local shared mode still requires registry_notary:ops_read and local network controls."
-    },
-    {
-      "listener": "public",
-      "path": "/openapi.json",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/docs",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/docs.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/docs/scalar.js",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/docs.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/.well-known/evidence-service",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/.well-known/evidence/jwks.json",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/.well-known/openid-credential-issuer",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/credentials/{*vct_path}",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/.well-known/vct/{*vct_path}",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/oid4vci/offer/start",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/oid4vci/offer/callback",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/oid4vci/offers",
-      "methods": [
-        "POST"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs",
-      "notes": "Machine-authenticated registrar integration route. Requires registry_notary:credential_offer_create, the selected credential-configuration scope, exact target-scoped authorization_details, an existing caller-owned registry-backed evaluation, and Idempotency-Key."
-    },
-    {
-      "listener": "public",
-      "path": "/oid4vci/offer/representative",
-      "methods": [
-        "POST"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/oid4vci/token",
-      "methods": [
-        "POST"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/oid4vci/credential",
-      "methods": [
-        "POST"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/v1/claims",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/v1/claims/{claim_id}",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/v1/formats",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/v1/evaluations",
-      "methods": [
-        "POST"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/v1/batch-evaluations",
-      "methods": [
-        "POST"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/v1/evaluations/{evaluation_id}/render",
-      "methods": [
-        "POST"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/v1/credentials",
-      "methods": [
-        "POST"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/v1/credentials/{credential_id}/status",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "admin",
-      "path": "/admin/v1/credentials/{credential_id}/status",
-      "methods": [
-        "POST"
-      ],
-      "source": "crates/registry-notary-server/src/api.rs"
-    },
-    {
-      "listener": "public",
-      "path": "/federation/v1/evaluations",
-      "methods": [
-        "POST"
-      ],
-      "source": "crates/registry-notary-server/src/federation/mod.rs",
-      "feature": "federation.enabled"
-    },
-    {
-      "listener": "admin",
-      "path": "/metrics",
-      "methods": [
-        "GET"
-      ],
-      "source": "crates/registry-notary-server/src/standalone/assembly.rs",
-      "notes": "Admin metrics route mounted on the admin listener in dedicated mode and handler-enforced by admin scope. Simple local shared mode keeps the same admin-scope gate."
-    }
-  ]
-}
diff --git a/products/notary/specs/README.md b/products/notary/specs/README.md
deleted file mode 100644
index e23b9eb2a..000000000
--- a/products/notary/specs/README.md
+++ /dev/null
@@ -1,42 +0,0 @@
-# Registry Notary Specs
-
-Design specifications and implementation traces live here. Current operator
-guides, tutorials, SDK docs, and release notes stay in `docs/`.
-
-Status tags: `[implemented]` ships in code, `[archived: ...]` is a kept design
-record that no longer drives the code, and `[active: ...]` is a living document
-that still tracks open work.
-
-- [`adr-audit-pseudonym-redesign.md`](adr-audit-pseudonym-redesign.md):
-  accepted design record for versioned audit pseudonym domains, canonical
-  identifier inputs, no-match behavior, retention, key rotation, erasure, and
-  federation pairwise alignment. **[archived: reconciled design record]**
-- [`bounded-batch-evaluation-v1.md`](bounded-batch-evaluation-v1.md):
-  hard limits, two-phase processing, per-member audit, cancellation, replay,
-  and issuance boundaries for the synchronous batch evaluation surface.
-  **[implemented]**
-- [`federated-evaluation-mvp-spec.md`](federated-evaluation-mvp-spec.md):
-  static-peer delegated evaluation MVP. **[implemented]**
-- [`gitb-conformance-suite.md`](gitb-conformance-suite.md):
-  target GITB runtime scenario suite and first runnable slice for Notary
-  interoperability evidence. **[active: suite design]**
-- [`notary-api-v1-route-cleanup-proposal.md`](notary-api-v1-route-cleanup-proposal.md):
-  implemented route cleanup design record for the stable `/v1` REST API
-  surface. **[implemented]**
-- [`openid4vci-wallet-facade-spec.md`](openid4vci-wallet-facade-spec.md):
-  OpenID4VCI wallet facade design and current compatibility profile.
-  **[implemented]**
-- [`source-adapter-sidecar-source-spec.md`](../archive/specs/source-adapter-sidecar-source-spec.md):
-  historical source-adapter sidecar integration contract.
-  **[archived: removed before 1.0]**
-- [`scalability-spec.md`](../archive/specs/scalability-spec.md):
-  historical direct-source scalability goals and performance work plan.
-  **[archived: superseded by Relay-backed execution]**
-- [`notary-capability-gaps.md`](notary-capability-gaps.md):
-  maintainer roadmap of the per-scenario gaps and the rollup of capability gaps
-  surfaced by the Notary scenario catalog. **[active: gap register]**
-
-Archived specs that diverge from the current code moved to `../archive/specs/`:
-
-- [`federated-notary-manifest-spec.md`](../archive/specs/federated-notary-manifest-spec.md)
-- [`evidence-request-subject-model-spec.md`](../archive/specs/evidence-request-subject-model-spec.md)
diff --git a/products/notary/specs/adr-audit-pseudonym-redesign.md b/products/notary/specs/adr-audit-pseudonym-redesign.md
deleted file mode 100644
index 3f097ff3c..000000000
--- a/products/notary/specs/adr-audit-pseudonym-redesign.md
+++ /dev/null
@@ -1,190 +0,0 @@
-# ADR: Audit Pseudonym Redesign
-
-> **Status: Archived (2026-05-31).** Kept as a design record. The load-bearing
-> config and format details below have been reconciled to the shipped code; for
-> current behavior see the code and docs/. Do not treat the broader design
-> narrative as current.
-
-## Status
-
-Accepted for the audit pseudonym follow-up design freeze.
-
-## Context
-
-Registry Notary audit events need stable enough references for security review,
-incident response, and lawful investigation without storing raw identity
-attributes or creating cross-context correlation handles. The evidence request
-subject model also introduces non-person targets, subject access, provider
-matching, and federation pairwise subject hashes, so audit pseudonyms need an
-explicit domain model before implementation changes land.
-
-This ADR originated as a design artifact. The design has since been implemented
-in shipped Rust (audit pseudonym hashing, tests, and the related API and runtime
-paths), so it no longer stands apart from the code.
-
-## Decision
-
-Audit pseudonyms are HMAC-SHA-256 values over Notary-owned canonical JSON inputs
-using the shared `registry-platform-audit` audit reference hash primitive.
-Serialized audit fields use the platform hash encoding, currently
-`hmac-sha256:<digest>`. The pseudonym class and version are bound inside the
-platform HMAC domain-separated input rather than exposed as raw
-personal-data-bearing fields.
-
-```text
-hmac-sha256:<digest>
-```
-
-The HMAC key is an audit-only secret. It must not be reused for federation
-pairwise subject hashes, cookies, source credentials, replay identifiers,
-credential signing, or request signing.
-
-### Versioned Hash Domains
-
-Every pseudonym is bound to a versioned hash domain. Notary passes the domain id
-as the `class` argument to
-`AuditKeyHasher::audit_reference_hash(class, scope, canonical_input)`, and also
-includes it in the canonical JSON input so offline reviewers can identify which
-normalization rules were used.
-
-| Domain id | Event use | Purpose |
-| --- | --- | --- |
-| `matched-reference-v1` | routine successful or policy-denied evaluations after a provider match | Link audit events for the same matched requester or target within the same purpose scope without exposing source identifiers. |
-| `matching-attempt-v1` | failed evaluation attempts | Purpose-scoped correlation of failed matching attempts without retaining raw identifiers. |
-| `investigation-reference-v1` | elevated investigation or abuse-response events | Separately authorized handle for incident review, never emitted by routine evaluation paths. |
-
-The platform hash primitive frames the HMAC input as:
-
-```text
-registry-platform:audit-reference:v1 || len(class) || class || len(scope) || scope || len(canonical_input) || canonical_input
-```
-
-Changing canonical input fields, normalization, retention behavior, or key
-scope requires a new domain id. Implementations may continue reading prior
-domains through their configured retention period, but new writes must use the
-current domain.
-
-### Canonical Identifier Input
-
-The HMAC input is the UTF-8 bytes of a JSON Canonicalization Scheme object.
-
-The durable matched-reference pseudonym hashes the matched `handle` string
-returned by the matching step, not a raw-identifier array. For the matched
-entity being pseudonymized, the canonical object is:
-
-```json
-{
-  "class": "matched-reference-v1",
-  "version": 1,
-  "role": "target",
-  "entity_type": "person",
-  "purpose_scope": "https://purpose.example.gov/social-protection/service-delivery",
-  "handle": "ref-1001"
-}
-```
-
-The raw-identifier-array path is the `matching-attempt-v1` class. It produces a
-purpose-scoped keyed pseudonym for a failed attempt when the request contains a
-target or requester identifier. The canonical input exists only in memory and
-the serialized audit record contains only the HMAC result.
-
-Canonicalization rules:
-
-- `role` is the evidence request role being pseudonymized, for example
-  `requester`, `target`, `relationship_subject`, or `source_record`.
-- `entity_type` is the request entity type, for example `person`, `parcel`,
-  `animal`, `business`, `license`, or a profile-defined value.
-- `purpose_scope` is the normalized policy purpose used for the evaluation when
-  available. Non-evaluation audit paths that cannot recover the original
-  purpose use the explicit empty string as an `unspecified` scope and should be
-  migrated to a concrete purpose when stored evaluation metadata carries it.
-- `handle` is the stable matched-reference handle produced by the matching
-  step. It is normalized by the same profile-specific matching rules that
-  produced the matched reference. If a profile cannot define stable
-  normalization for the handle, it must not be used as a durable pseudonym
-  input.
-- Raw names, dates of birth, animal ear tags, parcel ids, and national
-  identifiers must never appear in serialized audit events or logs. They may
-  appear only inside the in-memory HMAC input during pseudonym generation.
-
-### Failed-Attempt Behavior
-
-Failed single and batch evaluation attempts use `matching-attempt-v1` when the
-request includes a target or requester identifier. The pseudonym is scoped by
-role, entity type, and purpose, and uses a separate domain from matched
-references. An entity without a usable identifier produces no pseudonym.
-
-Routine audit records include request metadata, purpose, authentication
-context, value-free outcome and error codes, and the keyed pseudonym. They do
-not include raw identifiers, claim values, consultation inputs, or consultation
-outputs. The pseudonym is an audit correlation handle, not subject identity and
-not an input to federation or investigation handles.
-
-### Retention, Key Rotation, And Erasure
-
-Audit pseudonym keys are versioned and referenced by key id in protected audit
-metadata. Key ids are not secrets. Rotation creates a new active key id for new
-events while previous key ids remain available only until the longest retention
-period for events written under those keys expires.
-
-Retention classes:
-
-- `matched-reference-v1`: follows the routine audit retention period for the
-  deployment and purpose scope.
-- `matching-attempt-v1`: follows the routine audit retention period for the
-  deployment and purpose scope.
-- `investigation-reference-v1`: expires under the case or legal-hold policy
-  that authorized the investigation event. When no legal hold exists, it must
-  not outlive routine audit retention.
-
-Erasure is implemented by deleting or disabling the key material for affected
-key ids after the required retention period, legal hold, and hash-chain
-verification window end. This crypto-shreds the pseudonym value because stored
-audit records keep only the HMAC output and non-secret key id. Hash-chain
-checkpoints can still prove record order and tamper evidence after crypto-
-shredding, but they cannot recover or relink shredded pseudonyms.
-
-When an individual erasure request applies to audit records that must remain
-for statutory integrity, operators should prefer subject-specific key scoping
-only when the deployment has designed that model up front. Otherwise the system
-must document the limit clearly: erasing one subject's pseudonym may require
-waiting until the retention period for a shared audit key ends.
-
-### Federation Pairwise Alignment
-
-Federation pairwise subject hashes and audit pseudonyms are intentionally
-different handles:
-
-- federation uses federation-only pairwise secrets and federation domains;
-- audit uses audit-only secrets and the audit domains in this ADR;
-- federation inputs include peer audience and profile for cross-peer and
-  cross-profile unlinkability;
-- audit inputs include role, entity type, purpose scope, and canonical matched
-  identifiers for local audit correlation;
-- neither handle is accepted as input for deriving the other.
-
-Federated evaluations may store both a federation response reference and a local
-audit pseudonym in the serving Notary's audit trail, but the values must be
-computed independently with separate keys and domain separators. Tests for the
-implementation follow-up must prove that the same source subject produces
-different, non-interchangeable values for federation and audit.
-
-## Consequences
-
-- Implementations get deterministic matched-reference audit correlation without
-  retaining raw identifiers.
-- Failed-attempt events remain value-free while supporting purpose-scoped
-  correlation through a distinct keyed pseudonym domain.
-- Operators must manage audit pseudonym keys as retention and erasure controls,
-  not only as generic application secrets.
-- Federation remains aligned with the pairwise subject hash design while
-  preserving separate domains, secrets, and review boundaries.
-
-## Implementation Follow-Up
-
-The implementation follow-up must add tests that compare serialized audit
-events and logs against representative raw values, including names, dates of
-birth, national identifiers, parcel ids, and animal ear tags. It must also add
-focused tests for stable identifier ordering, explicit empty `issuer` and
-`country`, no-match behavior, key rotation metadata, and federation/audit handle
-separation.
diff --git a/products/notary/specs/bounded-batch-evaluation-v1.md b/products/notary/specs/bounded-batch-evaluation-v1.md
deleted file mode 100644
index 81a081072..000000000
--- a/products/notary/specs/bounded-batch-evaluation-v1.md
+++ /dev/null
@@ -1,105 +0,0 @@
-# Bounded batch evaluation v1
-
-Status: runtime contract for `POST /v1/batch-evaluations`
-
-## Scope
-
-Batch evaluation is a bounded transport convenience for repeating the existing
-single-evaluation policy over multiple targets. It does not introduce a Relay
-batch protocol, batch credential issuance, or an OID4VCI batch route. Every
-member keeps the authorization, purpose, consent, provenance, minimization,
-and audit requirements of a corresponding single evaluation.
-
-The concrete threat is amplification. An apparently small request can consume
-quota, reserve durable idempotency state, dispatch private consultations, and
-retain results for many targets. The invariant is that admission for the whole
-batch is bounded and side-effect free. Only admitted members may enter the
-side-effecting execution phase.
-
-## Limits
-
-The platform ceiling is 100 members. It is not configurable upward. The
-effective member limit is:
-
-```text
-min(
-  100,
-  evidence.inline_batch_limit,
-  selected_claim_1.operations.batch_evaluate.max_subjects,
-  ...,
-  selected_claim_n.operations.batch_evaluate.max_subjects
-)
-```
-
-Both configurable limits accept only `1..=100`. Configuration loading rejects
-zero and values above 100. A request above the effective limit returns HTTP
-413 with `batch.too_large` before quota debit, idempotency reservation, Relay
-dispatch, source access, or retained evaluation state.
-
-The member limit composes with existing independent bounds:
-
-- the HTTP request body is at most 1 MiB;
-- one Relay result is at most 64 KiB;
-- one batch may form at most 256 consultation groups;
-- one Relay operation has a 25 second deadline;
-- the outer request timeout defaults to 30 seconds and must preserve the Relay
-  deadline plus the runtime reserve;
-- member concurrency defaults to 16 and Relay concurrency defaults to 8; and
-- the Rust client accepts at most a 16 MiB response.
-
-There is intentionally no aggregate byte counter across all Relay results.
-Operators and clients should use smaller batches when member results approach
-the per-result or response-read bounds.
-
-## Two-phase processing
-
-Phase one performs pure admission and planning for every member. It validates
-the member count, claims and versions, operation enablement, authorization,
-purpose, disclosure, format, identity shape, relationship, consultation
-contracts, and consultation-group bound. Any phase-one failure rejects the
-whole request. No member is dispatched.
-
-Phase two performs admitted work with bounded concurrency. The response is an
-ordered HTTP 200 result whose `items` preserve request order. Each item is
-either `succeeded` with its normal minimized claim results or `failed` with a
-closed, value-free error. A member's operational failure does not turn into a
-claim value or `no_match`, and it does not erase the outcomes of other
-members.
-
-## Identity, audit, and replay
-
-Registry-backed batches require one caller-scoped `Idempotency-Key`. The
-runtime derives deterministic child identities from the caller, outer key,
-request digest, and member index. The same caller must retry an interrupted or
-lost-acknowledgement request with the same outer key and identical body.
-Completed requests replay their stored ordered response. A changed body,
-caller scope, or execution-defining configuration conflicts with the existing
-key.
-
-Cancellation returns no partial response and commits no partial retained
-evaluations. Relay work already dispatched before cancellation may have been
-observed by Relay or its source. A retry therefore reuses the deterministic
-child identity while allowing a new transport attempt.
-
-Audit records are value-free. Each member records its input index, outcome,
-requester and target types, keyed requester and target pseudonyms when an
-identifier is available, and consultation evidence. Failed attempts use the
-same keyed-pseudonym construction as successful attempts. Raw identifiers,
-consultation inputs, consultation outputs, and claim values must never enter
-the audit record or ordinary logs.
-
-## Issuance boundary
-
-Batch evaluation produces evaluation responses only. It cannot issue a batch
-credential and it cannot use an OID4VCI batch credential route. A successful
-member may be retained only under the normal single-evaluation retention and
-issuance rules. Any later credential request is a separate authorized action
-over one retained evaluation.
-
-## Release evidence
-
-Before a release candidate is promoted, the frozen candidate must execute
-10,000 repeated bounded batches with exact request and response digests. The
-evidence must cover process restart, a lost acknowledgement, cancellation
-followed by retry, stable child identities, ordered results, and the absence of
-extra Relay dispatch on a completed replay.
diff --git a/products/notary/specs/federated-evaluation-mvp-spec.md b/products/notary/specs/federated-evaluation-mvp-spec.md
deleted file mode 100644
index 6dc055c92..000000000
--- a/products/notary/specs/federated-evaluation-mvp-spec.md
+++ /dev/null
@@ -1,744 +0,0 @@
-# Federated Evaluation MVP Spec
-
-> **Status: Archived (2026-05-31).** This static-peer delegated evaluation MVP has shipped. This file is kept as a
-> design record and is not the source of truth. For current behavior see the code
-> and docs/federated-evaluation-operator-guide.md.
-
-## Purpose
-
-Define the first practical Registry Notary federation slice: one trusted
-Notary asks another trusted Notary for a signed, scoped evaluation result.
-
-This MVP deliberately implements delegated evaluation only. It does not attempt
-full federation, federated credential issuance, trust-chain discovery, audit
-checkpoint exchange, or open network participation.
-
-The goal is a government-ready integration pattern that is simple to operate:
-
-```text
-Agency A Notary -> signed evaluation request -> Agency B Notary
-Agency A Notary <- signed evaluation response <- Agency B Notary
-```
-
-```mermaid
-sequenceDiagram
-  participant A as Agency A Notary
-  participant B as Agency B Notary
-  participant S as Agency B Registry Source
-
-  A->>B: Signed evaluation request JWT
-  B->>B: Verify JWT and local peer policy
-  B->>S: Read source only after policy passes
-  S-->>B: Source facts
-  B->>B: Evaluate ruleset and audit decision
-  B-->>A: Signed evaluation response JWT
-  A->>A: Verify B signature and consume result
-```
-
-Each agency keeps authority over its own registry sources, policies, keys, and
-audit trail.
-
-## Why This Is Enough For V1
-
-Government data-sharing relationships usually start with formal partners,
-written purposes, scoped authority, and auditable exchanges. This MVP fits that
-model:
-
-- no open federation;
-- no raw registry rows shared by default;
-- no central citizen database;
-- explicit peer allowlists;
-- signed requests and responses;
-- local audit on both sides;
-- fail-closed runtime behavior.
-
-The MVP provides a solid base for later credential issuance and trust bundles
-without putting wallet holder-proof semantics or multi-hop trust chains on the
-critical path.
-
-```mermaid
-flowchart LR
-  Manifest["Registry Manifest public metadata"]
-  Policy["Static Notary peer policy"]
-  Request["Signed delegated evaluation"]
-  Result["Signed scoped result"]
-  Audit["Local audit on both nodes"]
-
-  Manifest --> Policy
-  Policy --> Request
-  Request --> Result
-  Request --> Audit
-  Result --> Audit
-```
-
-## In Scope
-
-### Registry Manifest Metadata
-
-Registry Manifest publishes enough public metadata for a partner to configure a
-peer manually:
-
-- `node_id`;
-- `issuer`;
-- `jwks_uri`;
-- `federation_api`;
-- supported protocol versions;
-- `registry-notary` evidence offerings;
-- evaluation profiles;
-- public `ruleset` identifiers.
-
-Manifest metadata is discovery and documentation. It does not grant access.
-
-```mermaid
-flowchart TD
-  Offering["Evidence offering"]
-  Profile["Evaluation profile"]
-  Ruleset["Public ruleset id"]
-  Runtime["Private Notary claim config"]
-  Source["Registry source connection"]
-
-  Offering --> Ruleset
-  Profile --> Ruleset
-  Ruleset --> Runtime
-  Runtime --> Source
-```
-
-### Static Notary Peer Policy
-
-Registry Notary uses static local config for the trusted peer:
-
-```yaml
-evidence:
-  signing_keys:
-    federation-response:
-      provider: local_jwk_env
-      alg: EdDSA
-      kid: notary-fed-2026-05
-      status: active
-      private_jwk_env: REGISTRY_NOTARY_FEDERATION_RESPONSE_JWK
-
-federation:
-  enabled: true
-  node_id: did:web:agency-a.example.gov
-  issuer: https://agency-a.example.gov
-  jwks_uri: https://agency-a.example.gov/federation/jwks.json
-  federation_api: https://agency-a.example.gov/federation/v1
-  supported_protocol_versions:
-    - registry-notary-federation/v0.1
-  inbound_body_limit_bytes: 16384
-  max_request_lifetime_seconds: 300
-  clock_leeway_seconds: 60
-  signing:
-    signing_key: federation-response
-  pairwise_subject_hash:
-    secret_env: REGISTRY_NOTARY_PAIRWISE_SUBJECT_HASH_SECRET
-  peers:
-    - node_id: did:web:agency-b.example.gov
-      issuer: https://agency-b.example.gov
-      jwks_uri: https://agency-b.example.gov/.well-known/jwks.json
-      # Local Compose demos may use allow_insecure_private_network: true with
-      # an HTTP service URL. Production peer JWKS URLs must use HTTPS.
-      allowed_protocol_versions:
-        - registry-notary-federation/v0.1
-      allowed_purposes:
-        - https://purpose.example.gov/social-protection/service-delivery
-      allowed_profiles:
-        - disability_status_predicate
-      evaluation_scopes:
-        - disability_registry:evidence_verification
-  evaluation_profiles:
-    - id: disability_status_predicate
-      ruleset: disability-status-v1
-      claim_id: disability_status
-      subject_id_type: national_id
-      disclosure: predicate
-      max_claim_result_age_seconds: 3600
-  response_shaping:
-    minimum_denial_latency_ms: 250
-  emergency_denylist:
-    node_ids: []
-    kids: []
-```
-
-The local peer policy is authoritative. If Manifest says a profile exists but
-local config does not allow it, the request is denied.
-
-`allow_insecure_private_network` is permitted only as an explicit lab or
-development escape hatch for peer JWKS fetches on private Compose networks. It
-must not be enabled for production federation.
-
-MVP `node_id` and `issuer` are both required and must be bound. When `node_id`
-uses `did:web`, the DID host component must match the `issuer` HTTPS origin
-host. For example, `did:web:agency-a.example.gov` binds to
-`https://agency-a.example.gov`. Separate issuer origins are out of scope for the
-MVP.
-
-The pairwise subject hash secret must be a dedicated secret used only for
-federation subject references. It must not reuse audit, cookie, source-token, or
-credential-signing secrets.
-
-### One Runtime Operation
-
-V1 exposes one privileged peer endpoint:
-
-```text
-POST /federation/v1/evaluations
-```
-
-The endpoint accepts one subject and returns one signed evaluation response.
-Batching is out of scope for the first implementation even though the
-north-star protocol may later support it.
-
-The MVP inbound request body limit is `16384` bytes. Operators may lower it, but
-raising it requires an explicit config change and a focused oversized-body test.
-
-### Signed Request JWT
-
-Requests must be compact JWS signed JWTs using the V1 protocol profile:
-
-- `typ = registry-notary-request+jwt`;
-- compact JWS serialization only;
-- `alg = EdDSA`;
-- `kid` resolves only within the caller issuer's configured JWKS;
-- `iss` is the calling Notary issuer;
-- `sub` is the calling Notary node id;
-- `aud` is the serving Notary node id;
-- `iat`, `nbf`, `exp`, and `jti` are required;
-- `protocol`, `action`, `profile`, and `purpose` are required;
-- `purpose` must be an HTTPS URI. Compact purpose ids are deferred beyond the
-  MVP. Future portable purpose semantics should align with a recognized
-  vocabulary such as W3C DPV instead of local string substitution.
-- requests where `exp - iat` exceeds `max_request_lifetime_seconds` are denied.
-
-`typ = registry-notary-request+jwt` is an unregistered project JWT type for the
-MVP. Registration or migration to a registered media type is deferred until the
-protocol stabilizes.
-
-Example payload:
-
-This payload is the federation v0.1 legacy shim. It intentionally signs the
-historical `subject` request shape and returns `subject_ref` in the signed
-response while the public evaluation API migrates to `target`, `items`, and
-`target_ref`.
-
-```json
-{
-  "iss": "https://agency-a.example.gov",
-  "sub": "did:web:agency-a.example.gov",
-  "aud": "did:web:agency-b.example.gov",
-  "iat": 1779878400,
-  "nbf": 1779878400,
-  "exp": 1779878700,
-  "jti": "01J...",
-  "protocol": "registry-notary-federation/v0.1",
-  "action": "evaluate",
-  "profile": "disability_status_predicate",
-  "purpose": "https://purpose.example.gov/social-protection/service-delivery",
-  "request": {
-    "subject": {
-      "id": "example-subject-id",
-      "id_type": "national_id"
-    },
-    "claims": ["disability_status"]
-  }
-}
-```
-
-The serving Notary verifies the JWT and applies local peer policy before claim
-evaluation. Federation profiles must select a `registry_backed` claim. The
-verified request `jti` becomes the Relay audit correlation id so the federated
-request, local evaluation, and consultation can be reconciled.
-
-`jti` must be a ULID string. Test fixtures should use deterministic ULIDs so
-replay tests can assert exact values.
-
-### Signed Response JWT
-
-Responses must be compact JWS signed JWTs:
-
-- `typ = registry-notary-response+jwt`;
-- compact JWS serialization only;
-- `alg = EdDSA`;
-- `kid` resolves only within the serving issuer's configured JWKS;
-- `iss` is the serving Notary issuer;
-- `sub` is the serving Notary node id;
-- `aud` is the requesting Notary node id;
-- `iat`, `nbf`, `exp`, and `jti` are required;
-- `request_jti` binds the response to the request.
-
-`typ = registry-notary-response+jwt` is an unregistered project JWT type for
-the MVP. Registration or migration to a registered media type is deferred until
-the protocol stabilizes.
-
-Example payload:
-
-```json
-{
-  "iss": "https://agency-b.example.gov",
-  "sub": "did:web:agency-b.example.gov",
-  "aud": "did:web:agency-a.example.gov",
-  "iat": 1779878401,
-  "nbf": 1779878401,
-  "exp": 1779879001,
-  "jti": "01J...",
-  "request_jti": "01J...",
-  "protocol": "registry-notary-federation/v0.1",
-  "action": "evaluate",
-  "profile": "disability_status_predicate",
-  "result": {
-    "evaluation_id": "eval_01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6",
-    "subject_ref": {
-      "hash": "hmac-sha256:...",
-      "id_type": "national_id"
-    },
-    "claims": {
-      "disability_status": {
-        "satisfied": true,
-        "disclosure": "predicate"
-      }
-    },
-    "claim_result_issued_at": "2026-05-27T10:00:00Z",
-    "policy": {
-      "ruleset": "disability-status-v1",
-      "purpose": "https://purpose.example.gov/social-protection/service-delivery"
-    }
-  }
-}
-```
-
-`evaluation_id` must be `eval_` followed by a ULID, for example
-`eval_01J9Z6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6`. Denial `instance` values must be
-`urn:ulid:<ULID>`, but cross-organization incident reports should redact them if
-timing disclosure is a concern.
-
-Stale claim results are returned as signed evaluation errors, not bare
-HTTP denials. The signed response keeps `request_jti`, `profile`, and `purpose`
-auditable even when the claim result is too old:
-
-```json
-{
-  "iss": "https://agency-b.example.gov",
-  "sub": "did:web:agency-b.example.gov",
-  "aud": "did:web:agency-a.example.gov",
-  "iat": 1779878401,
-  "nbf": 1779878401,
-  "exp": 1779879001,
-  "jti": "01J...",
-  "request_jti": "01J...",
-  "protocol": "registry-notary-federation/v0.1",
-  "action": "evaluate",
-  "profile": "disability_status_predicate",
-  "error": {
-    "type": "urn:registry-notary:problem:federation:stale-claim-result",
-    "title": "Claim result is stale",
-    "code": "federation.stale_claim_result"
-  }
-}
-```
-
-### Disclosure Limits
-
-V1 allows only configured predicate or value disclosure. Raw source records are
-out of scope. If `evaluation_profiles[].disclosure` is omitted, the runtime
-uses `predicate`; value disclosures such as age band must opt in explicitly with
-`disclosure: value`.
-
-### Pairwise Subject Reference
-
-`subject_ref.hash` is an issuer-generated pairwise handle. It is not a
-consumer-verifiable proof.
-
-```text
-hmac-sha256:<base64url-no-pad HMAC>
-```
-
-The `hmac-sha256:` prefix is a project-scoped label for this MVP, not a
-registered hash URI scheme. The HMAC key is owned by the serving Notary and
-must not be shared. The input is this JCS-canonicalized JSON object:
-
-```json
-{
-  "aud": "<consuming node id>",
-  "issuer": "<serving node id>",
-  "profile": "<profile id>",
-  "id_type": "<normalized id type>",
-  "subject_id": "<normalized subject id>"
-}
-```
-
-Scoping the input this way prevents the same subject from being correlated
-across different consuming peers by comparing handles.
-
-### Replay Protection
-
-V1 must reject repeated `jti` values within the request expiry window plus clock
-leeway.
-
-Notary rejects requests where `exp - iat` exceeds
-`max_request_lifetime_seconds`. `jti` entries are retained until
-`exp + clock_leeway_seconds`.
-
-For single-instance development, top-level `state.storage = in_memory` is
-acceptable only with the explicit local deployment profile. Production or
-active-active deployments require the typed Notary-owned PostgreSQL state
-schema before federation can be enabled. Runtime readiness must attest the
-schema, restricted role, write authority, and durability settings. Stored
-replay keys hash scope and one-time identifiers rather than expose peer ids,
-holder ids, subjects, nonces, or JWT `jti` values.
-
-### Audit
-
-Both Notary nodes audit:
-
-- peer id;
-- issuer;
-- action;
-- profile;
-- purpose;
-- request `jti`;
-- allow or deny decision;
-- redacted or HMAC-hashed subject reference;
-- result status.
-
-Audit events must not include raw source rows, bearer tokens, private keys,
-private JWK fields, compact JWT strings, or raw source credentials. Parsed JWT
-claims may be logged only after redacting subject identifiers and token ids.
-
-Federation v0.1 composes only with `registry_backed` claims. Configuration
-must reject an evaluation profile unless every Relay consultation input in the
-selected claim and its dependency closure maps to the exact signed subject
-identifier at
-`request.target.identifiers.<evaluation_profile.subject_id_type>`. The
-verified canonical request `jti` is passed to Relay as the consultation audit
-correlation id, while Notary retains its own local evaluation id. This keeps
-the federation and Relay audit records correlatable without accepting
-caller-selected Relay inputs.
-
-## Out Of Scope
-
-- Federated credential issuance.
-- OpenID4VCI holder-proof proxying.
-- Citizen wallet issuance through an intermediary Notary.
-- Trust bundles.
-- OpenID Federation trust chains.
-- Dynamic peer enrollment.
-- Audit checkpoint exchange.
-- Transparency logs or inclusion proofs.
-- Batch evaluation.
-- DID document key resolution.
-- Raw evidence sharing.
-- Cross-node writes.
-- Remote credential acceptance as source evidence.
-- Push-based peer notifications.
-
-## Request Processing Order
-
-The serving Notary must process requests in this order. The federation evaluation endpoint requires `Content-Type: application/jwt` and returns HTTP 415 otherwise.
-
-1. Enforce the `inbound_body_limit_bytes` limit before buffering the full body.
-2. Parse compact JWS without logging token material.
-3. Validate `typ`, `alg`, `kid`, signature, `iss`, `sub`, `aud`, `iat`, `nbf`,
-   `exp`, and `jti`.
-4. Verify the `iss` and `sub` binding against configured peer policy.
-5. Resolve peer by configured `node_id` and `issuer`.
-6. Check emergency denylist for peer `node_id` and `kid`.
-7. Check replay store for `jti`.
-8. Check local peer policy for action, profile, purpose, protocol, and batch
-   size.
-9. Resolve the profile to its public `ruleset`.
-10. Map `ruleset` to local private claim configuration.
-11. Evaluate the admitted registry-backed claim using `jti` as the Relay audit
-    correlation id.
-12. If the claim result `issued_at` is stale, prepare a signed evaluation error.
-13. Write the audit event.
-14. Return signed response JWT or signed evaluation error.
-
-Any failure before step 11 must happen before claim evaluation. Audit is
-write-before-respond: if the audit sink fails after evaluation, the Notary must
-not send a successful signed response. It should return a generic `503` denial
-and emit an operator log without raw subject or token material.
-
-```mermaid
-flowchart TD
-  Start["Receive evaluation request"]
-  Body["Enforce body limit"]
-  Jwt["Parse and verify JWT"]
-  Bind["Check iss and sub binding"]
-  Replay["Check jti replay"]
-  Policy["Check static peer policy"]
-  Ruleset["Resolve profile to ruleset"]
-  Eval["Evaluate claims"]
-  Fresh["Check claim result issued_at freshness"]
-  Audit["Emit audit event"]
-  Sign["Return signed response JWT"]
-  Deny["Deny before claim evaluation"]
-
-  Start --> Body --> Jwt --> Bind --> Replay --> Policy
-  Jwt -- "invalid" --> Deny
-  Bind -- "mismatch" --> Deny
-  Replay -- "replayed" --> Deny
-  Policy -- "denied" --> Deny
-  Policy -- "allowed" --> Ruleset --> Eval --> Fresh --> Audit --> Sign
-```
-
-## Denial Responses
-
-Denials use a small RFC 9457 Problem Details body:
-
-```json
-{
-  "type": "urn:registry-notary:problem:federation:forbidden",
-  "title": "Federation request denied",
-  "status": 403,
-  "detail": "The request is not permitted by local federation policy.",
-  "instance": "urn:ulid:01J..."
-}
-```
-
-Problem `type` values use private, non-resolvable `urn:registry-notary`
-identifiers in the MVP. The response body must not reveal whether a subject
-exists.
-
-`response_shaping.minimum_denial_latency_ms` should be set at or above the
-observed 95th-percentile latency for allowed claim evaluations on the protected
-profile. Setting it lower is allowed only with an explicit deployment note that
-accepts the residual timing side channel.
-
-## Follow-On Work
-
-After this MVP is working, consider these separately:
-
-1. Batch evaluation.
-2. Signed public federation documents.
-3. Audit checkpoints.
-4. Trust bundles.
-5. Federated credential issuance through issuer-direct or transparent-relay
-   flows only.
-
-## Executable Definition Of Done
-
-This section is the implementation gate for the MVP. A feature is not done
-until every applicable item below is satisfied and reviewed.
-
-- Registry Manifest validates a fixture containing `federation`,
-  `evaluation_profiles`, and a `registry-notary` evidence offering with a
-  matching `ruleset`.
-- Registry Manifest rejects fixtures where `access.ruleset` does not resolve to
-  an evaluation profile, `conforms_to` is not
-  `registry-notary-federation/v0.1`, or required federation URLs are invalid.
-- Registry Notary loads federation config with `enabled: false` and serves the
-  existing API exactly as before in the existing test suite.
-- Registry Notary rejects startup config when federation is enabled without
-  `node_id`, `issuer`, peer policy, trusted peer JWKS URI, or signing key
-  configuration.
-- Registry Notary rejects startup config when `node_id` and `issuer` do not
-  satisfy the MVP binding rule.
-- Registry Notary rejects startup config when a federation evaluation profile
-  does not reference a `registry_backed` claim.
-- Registry Notary rejects startup config when a peer's `evaluation_scopes`
-  omit a `required_scopes` entry from an allowed profile's selected claim or
-  dependency closure.
-- `POST /federation/v1/evaluations` is not mounted unless federation is enabled.
-- Request bodies over `inbound_body_limit_bytes` are rejected before full body
-  buffering and before JWT parsing.
-- A valid compact JWS request JWT with required `typ`, `alg = EdDSA`, matching `kid`,
-  valid signature, `iss`, `sub`, `aud`, `iat`, `nbf`, `exp`, and unseen `jti`
-  reaches claim evaluation only after local peer policy passes.
-- A request with unknown peer, unsupported profile, unsupported purpose, bad
-  audience, expired token, future `nbf`, denied algorithm, unknown `kid`, bad
-  signature, `iss`/`sub` mismatch, replayed `jti`, emergency-denied `kid`, or
-  `exp - iat` above policy is denied before claim evaluation. Tests must assert
-  the evaluator was not called.
-- Successful evaluation returns a signed response JWT with required `typ`,
-  `alg = EdDSA`, `kid`, `iss`, `sub`, `aud`, `iat`, `nbf`, `exp`, `jti`,
-  `request_jti`, `protocol`, `action`, `profile`, and a result body.
-- Response verification succeeds using the serving Notary JWKS and fails if the
-  payload or protected header is modified.
-- `subject_ref.hash` is produced with the pairwise HMAC input defined in this
-  spec and differs for the same subject when the consuming peer or profile
-  differs.
-- Raw source rows, bearer tokens, private keys, private JWK fields, compact JWT
-  strings, and source credentials do not appear in federation responses, denial
-  bodies, audit events, or test logs.
-- Audit events are emitted for allowed evaluation, policy denial, signature
-  denial, and replay denial, and include peer id, profile, purpose, request
-  `jti`, decision, and a redacted subject reference.
-- Audit write failure after claim evaluation prevents a successful signed
-  response, with a focused test.
-- A claim result `issued_at` older than `max_claim_result_age_seconds` is returned
-  as a signed evaluation error, with a focused test.
-- In-memory correctness state is bounded for public OID4VCI nonce reservations.
-  PostgreSQL correctness state is required for active-active deployments and
-  fails readiness when its capability contract cannot be attested.
-- The repository commands listed in the project README for formatting, linting,
-  and focused tests pass, or any skipped command is documented with the exact
-  blocker.
-
-## Spec-To-Code Checklist
-
-This is the current MVP trace from this spec to implementation. Keep it updated
-when behavior changes.
-
-| Spec requirement | Implementation | Verification |
-|---|---|---|
-| Manifest declares `federation` and `evaluation_profiles` | `registry-manifest-core/src/lib.rs` federation structs and validation | `federated_evaluation_manifest_validates_and_renders_catalog_fields` |
-| `access.ruleset` resolves to an evaluation profile ruleset | `validate_registry_notary_access` checks `evaluation_profiles[*].ruleset` | `validation_rejects_registry_notary_unresolved_ruleset` |
-| Federation disabled by default and route hidden | `standalone_router` mounts federation router only when enabled | `federation_route_is_not_mounted_until_enabled` |
-| Startup validates node/issuer binding and peer policy | `FederationConfig::validate` | `federation_config_validates_enabled_mvp_shape` and negative config tests |
-| Evaluation profiles permit only Relay inputs derived from the signed subject identifier | `validate_federation_claim_inputs` traverses the selected claim dependency closure | `federation_profile_rejects_relay_inputs_unavailable_from_subject` |
-| Request verification uses compact JWS, EdDSA, `typ`, `kid`, `iss`, `sub`, `aud`, time, and `jti` | `crates/registry-notary-server/src/federation/mod.rs` request handler, with helper logic in `claims.rs`, `signing.rs`, and `runtime.rs` | focused federation request-verification tests |
-| The canonical federation request `jti` becomes the Relay evaluation id | `relay_evaluation_id` selects the verified federation correlation id for Relay consultations | `federation_request_jti_becomes_the_relay_evaluation_id` |
-| Denials before policy pass do not evaluate claims | `handle_federated_evaluate` orders verification before `evaluate_with_capability` | focused denial-order tests |
-| Oversized request bodies are rejected before full buffering | `to_bytes(body, inbound_body_limit_bytes)` in federation handler | focused oversized-body test |
-| Replay retains one-time identifiers through protocol expiry and rejects duplicates | `registry-notary-server/src/replay.rs` and `registry-platform-replay` | replay unit tests and `federation_evaluation_returns_signed_response_and_rejects_replay` |
-| Successful response is signed and bound to `request_jti` | `FederationSignedOutcome::success` | `federation_evaluation_returns_signed_response_and_rejects_replay` |
-| Stale claim result returns signed top-level `error` | `FederationSignedOutcome::evaluation_error` | `signed_outcomes_use_claim_result_terminology` |
-| Audit is write-before-respond | federation audit emission before response return | `federation_audit_write_failure_replaces_signed_success` |
-| Two configured standalone Notaries can complete delegated evaluation | two `standalone_router` instances in one smoke test | `federation_two_standalone_notaries_smoke` |
-
-## Wave Implementation Plan
-
-```mermaid
-flowchart LR
-  W0["Wave 0: Fixtures and contracts"]
-  R0["Review checkpoint"]
-  W1["Wave 1: Manifest schema and validation"]
-  R1["Review checkpoint"]
-  W2["Wave 2: Notary config, JWT verification, replay"]
-  R2["Security review checkpoint"]
-  W3["Wave 3: Delegated evaluation endpoint"]
-  R3["End-to-end review and verification"]
-
-  W0 --> R0 --> W1 --> R1 --> W2 --> R2 --> W3 --> R3
-```
-
-## Registry Platform Work
-
-The MVP should avoid copying shared security primitives into Notary when they
-belong in `registry-platform`.
-
-Push to `registry-platform` before or during the matching wave:
-
-- Wave 0: add federation JWT fixture helpers to `registry-platform-testing`
-  using existing Ed25519 fixtures. Fixtures live in `registry-platform-testing`
-  and are owned by the platform crate maintainers; test-only keys rotate when
-  platform fixture keys rotate.
-- Wave 2: reuse `registry-platform-oidc::JwksFetcher` and JWT verification
-  policy instead of writing a parallel JWKS cache. Layer the MVP `typ`,
-  `alg = EdDSA`, compact-JWS, issuer/audience, and `iss`/`sub` binding checks
-  in Notary if the platform verifier does not expose them directly.
-- Wave 2: use `registry-platform-replay` for local in-memory replay and
-  consumable nonce semantics. Notary owns its typed PostgreSQL replay and nonce
-  transactions, configuration, and route policy.
-- Wave 3: add pairwise HMAC helper and redaction test helpers to
-  `registry-platform-crypto` or `registry-platform-authcommon` only if another
-  service will consume them. Until then, keep the pairwise subject-hash wrapper
-  local to Notary but use platform canonicalization and constant-time
-  primitives.
-- Future audit checkpoint work belongs in `registry-platform-audit`, not this
-  MVP.
-
-### Wave 0: Fixtures And Contracts
-
-Parallel work:
-
-- Worker A: add Registry Manifest valid and invalid federation fixtures.
-- Worker B: add Notary federation config fixtures for disabled mode, valid
-  static peer, and invalid enabled config.
-- Worker C: add signed compact-JWS request/response JWT test fixtures using
-  deterministic Ed25519 test keys from `registry-platform-testing`.
-
-Wave DoD:
-
-- Valid Manifest fixture parses and validates.
-- Invalid Manifest fixtures fail on the expected field paths.
-- Notary config fixtures cover disabled, valid enabled, and missing-required
-  enabled cases.
-- JWT fixtures include `typ`, `kid`, `nbf`, `exp`, `jti`, profile, purpose, and
-  request payload.
-- JWT fixture ids use ULID strings for `jti`, `evaluation_id`, and denial
-  `instance`.
-
-Review checkpoint:
-
-- Code review verifies fixture names, expected failures, and no secret material.
-- No runtime implementation starts until this review is approved.
-
-### Wave 1: Manifest Schema And Validation
-
-Parallel work:
-
-- Worker A: add typed Manifest fields for `federation` and
-  `evaluation_profiles`.
-- Worker B: add validation for `ruleset`, `conforms_to`, URL fields, profile id
-  uniqueness, and entity/lookup references.
-- Worker C: update render/golden tests only after schema and validation tests
-  pass.
-
-Wave DoD:
-
-- `cargo test -p registry-manifest-core` passes.
-- Golden tests prove valid federation metadata renders deterministically.
-- Negative tests prove each invalid fixture fails for the intended reason.
-- Existing non-federation Manifest fixtures still validate.
-
-Review checkpoint:
-
-- Code review confirms serde compatibility, no unrelated renderer churn, and
-  reuse of existing `EvidenceOfferingAccessManifest.ruleset` for the MVP.
-- Wave 2 cannot merge until this checkpoint passes.
-
-### Wave 2: Notary Config, JWT Verification, And Replay
-
-Parallel work:
-
-- Worker A: add Notary federation config structs and fail-closed validation.
-- Worker B: implement JWT verifier by reusing `registry-platform-oidc`
-  JWKS/verifier primitives where possible, with MVP `typ`, compact-JWS,
-  `alg = EdDSA`, and `iss`/`sub` binding checks layered on top.
-- Worker C: implement single-instance replay store abstraction and `jti`
-  retention rules with max-entry eviction.
-
-Wave DoD:
-
-- Federation routes are absent when `enabled: false`.
-- Enabled config without required fields fails at startup.
-- Verifier accepts only valid fixture JWTs.
-- Tests cover bad `typ`, denied `alg`, unknown `kid`, bad signature, wrong
-  `aud`, `iss`/`sub` mismatch, expired `exp`, future `nbf`, long lifetime,
-  emergency-denied `kid`, oversized body, and replayed `jti`.
-- All verification failures happen before claim-evaluator invocation in tests.
-
-Review checkpoint:
-
-- Security-focused review checks fail-closed order, `kid` scoping, replay
-  retention, and absence of token material in logs.
-- Wave 3 cannot start until denial-before-claim-evaluation tests are merged.
-
-### Wave 3: Delegated Evaluation Endpoint
-
-Parallel work:
-
-- Worker A: mount `POST /federation/v1/evaluations` and map verified requests to
-  existing claim evaluation.
-- Worker B: implement signed response JWT generation and response verification
-  tests.
-- Worker C: implement audit events, result-redaction tests, and stale claim
-  result signed-error handling.
-
-Wave DoD:
-
-- Allowed peer/profile/purpose returns a signed response JWT.
-- Unknown peer, unsupported profile, unsupported purpose, replay, stale claim
-  result signed error, audit-write failure, and evaluation error have focused
-  tests.
-- Pairwise subject hash differs across consuming peer and profile test cases.
-- Audit tests cover allow, policy denial, signature denial, and replay denial.
-- Existing Notary evaluation and credential tests still pass.
-
-Review checkpoint:
-
-- Code review validates the end-to-end path against the executable DoD above.
-- The feature is marked complete only after focused tests, relevant package
-  tests, formatting, linting, and README-documented verification commands pass
-  or have documented blockers.
diff --git a/products/notary/specs/gitb-conformance-suite.md b/products/notary/specs/gitb-conformance-suite.md
deleted file mode 100644
index ac66449c5..000000000
--- a/products/notary/specs/gitb-conformance-suite.md
+++ /dev/null
@@ -1,76 +0,0 @@
-# Notary GITB Conformance Suite
-
-> **Status:** active design note
-> **Product:** Registry Notary
-> **Layer:** runtime interoperability
-> **Audience:** maintainer, operator, standards reviewer
-
-This suite is the target shape for testing Registry Notary as a system under
-test through the ISA ITB/GITB stack. It separates hygiene checks from runtime
-interoperability checks so OpenAPI validation or health probes are not mistaken
-for end-to-end conformance.
-
-## Definition of Done
-
-- The suite runs against a disposable Notary instance and disposable Relay
-  consultation fixture, not a shared operator environment.
-- Required credentials are supplied through environment variables or GITB
-  actor/session parameters. No API keys, bearer tokens, issuer keys, Relay
-  workload tokens, or replay secrets are committed.
-- Every scenario records the Notary base URL, selected deployment profile,
-  configured claim IDs, credential profile IDs, and expected auth mode.
-- At least one positive authenticated evaluation and one negative auth case are
-  runnable before any public runtime-conformance claim is made.
-- Results distinguish hygiene checks from runtime interoperability checks.
-- SD-JWT VC verification uses the existing verifier harness logic or an
-  equivalent custom GITB service before credential issuance is marked covered.
-
-## Scenario Set
-
-| ID | Scenario | Type | Done when |
-| --- | --- | --- | --- |
-| `health-live` | `GET /healthz` returns `200` | hygiene | HTTP status and response body are recorded. |
-| `discovery-auth-denied` | unauthenticated `GET /.well-known/evidence-service` returns `401` | runtime auth | The response is RFC 9457-style problem JSON with an auth error code. |
-| `discovery-authenticated` | authenticated `GET /.well-known/evidence-service` returns service metadata | runtime discovery | Response includes `service_id`, configured claims, and credential capabilities. |
-| `claims-authenticated` | authenticated `GET /v1/claims` returns configured claims | runtime discovery | Response includes the configured positive-evaluation claim. |
-| `evaluation-positive` | authenticated `POST /v1/evaluations` succeeds for a compiler-pinned Relay fixture | runtime evaluation | Response contains the expected claim result and no raw Relay output spillover. |
-| `evaluation-auth-denied` | unauthenticated `POST /v1/evaluations` returns `401` | runtime auth | No Relay consultation or claim evaluation is started. |
-| `credential-issue` | authenticated `POST /v1/credentials` issues `application/dc+sd-jwt` | runtime credential | Credential response verifies against the configured public issuer key. |
-| `credential-status` | `GET /v1/credentials/{id}/status` returns the configured status response | runtime status | Enabled status lookup is reachable without exposing unrelated credential data. |
-| `federation-positive` | signed `POST /federation/v1/evaluations` succeeds for one trusted peer | runtime federation | Peer signature, purpose, replay key, and result are checked. |
-| `federation-replay-denied` | repeated signed federation request is denied | runtime federation | Replay denial is deterministic and audited. |
-
-## First Runnable Slice
-
-The first implementation wave should cover only:
-
-- `health-live`
-- `discovery-auth-denied`
-- `discovery-authenticated`
-- `claims-authenticated`
-- `evaluation-positive`
-- `evaluation-auth-denied`
-
-Done for the first slice means:
-
-- a fixture Notary config and its compiler-pinned Relay fixture can be started
-  from a clean checkout;
-- `/.well-known/evidence-service` is intentionally authenticated and returns
-  `401` without credentials;
-- the same route returns metadata with a configured API key or bearer token;
-- one evaluation succeeds against the configured Relay consultation;
-- the unauthenticated evaluation attempt returns `401` and produces no positive
-  result;
-- the test report includes exact request paths, response status codes, and saved
-  redacted response bodies.
-
-Credential issuance, credential status, federation, replay, and SD-JWT VC
-verification are later waves. They must not be described as GITB-covered until
-their scenarios are runnable and produce saved reports.
-
-## Evidence Boundary
-
-OpenAPI 3.1 validation, `/healthz`, and JSON-schema checks are useful hygiene
-evidence. They do not prove runtime interoperability. Public wording must not
-claim Registry Notary GITB conformance until the runtime scenarios above are
-implemented, run, and reviewed.
diff --git a/products/notary/specs/notary-api-v1-route-cleanup-proposal.md b/products/notary/specs/notary-api-v1-route-cleanup-proposal.md
deleted file mode 100644
index 259fa1818..000000000
--- a/products/notary/specs/notary-api-v1-route-cleanup-proposal.md
+++ /dev/null
@@ -1,188 +0,0 @@
-# Registry Notary API V1 Route Cleanup Design Record
-
-## Summary
-
-Status: implemented in the current route surface. This document remains as the
-design record for the breaking route cleanup and intentionally names legacy
-routes in the comparison tables below.
-
-The Notary route surface is implemented and clean of legacy routes. The retired
-monorepo Registry Lab and its smoke scripts have been removed. Current adopter
-demos consume released routes from their own repositories.
-
-Registry Notary is still pre-real-adoption, so we should take the opportunity to
-make the HTTP API more consistent before external clients depend on it. The
-current API is understandable, but several routes are action-oriented or
-inconsistently versioned. This proposal moves the public application API under
-`/v1`, keeps protocol-defined discovery routes where standards expect them, and
-renames action routes into resource-oriented routes.
-
-## Goals
-
-- Establish a stable `/v1` application API before real integrations start.
-- Replace action-style routes such as `/claims/evaluate` and
-  `/credentials/issue` with resource-style routes.
-- Keep standards-driven routes such as `.well-known` and OID4VCI endpoints
-  compatible with wallet/client expectations.
-- Keep operations/admin routes visibly separate from application routes.
-- Update the Rust/Python/Node client method matrix to match the cleaned API.
-
-## Non-Goals
-
-- No compatibility layer for production users. There are no real users yet.
-- No semantic behavior changes to evaluation, rendering, issuance, federation,
-  OID4VCI, auth, audit, retry, or error handling.
-- No signature-verification feature in this cleanup. That is tracked separately
-  in issue #77.
-- No change to request or response JSON shapes unless a route rename requires an
-  OpenAPI operation-id cleanup.
-
-## Current Issues
-
-The pre-cleanup server routes mostly made sense, but they mixed styles:
-
-- Core application routes are unversioned while federation uses
-  `/federation/v1/...`.
-- Several routes encode verbs in the path:
-  - `POST /claims/evaluate`
-  - `POST /claims/batch-evaluate`
-  - `POST /evidence/render`
-  - `POST /credentials/issue`
-- Credential status routes put `status` before the credential id:
-  - `GET /credentials/status/{credential_id}`
-  - `POST /admin/credentials/status/{credential_id}`
-- Operations routes are mixed with application routes at the root.
-
-These are not fatal, but they make the API look less deliberate than it can be
-while the surface is still easy to change.
-
-## Implemented Route Surface
-
-### Stable Public And Operational Routes
-
-These routes should stay unversioned because they are conventional or
-operational:
-
-| Legacy route | Current route | Rationale |
-| --- | --- | --- |
-| `GET /healthz` | keep | Infrastructure convention. |
-| `GET /ready` | keep | Infrastructure convention. |
-| `GET /metrics` | keep | Prometheus convention. |
-| `GET /openapi.json` | keep, but documents v1 routes | Common discovery endpoint. |
-| `GET /.well-known/evidence-service` | keep | Discovery convention. |
-| `GET /.well-known/evidence/jwks.json` | keep | JWKS discovery convention. |
-| `GET /.well-known/openid-credential-issuer` | keep | OID4VCI metadata convention. |
-| `GET /oid4vci/credential-offer` | removed for 1.0 | Superseded by issuer-initiated offers rendered after the authenticated callback. |
-| `POST /oid4vci/nonce` | removed for 1.0 | Proof nonces are transaction-bound and returned by the token response. |
-| `POST /oid4vci/credential` | keep | OID4VCI wallet-facing endpoint. |
-
-### Versioned Application API
-
-Move Notary-specific application routes under `/v1`:
-
-| Legacy route | Current route | Notes |
-| --- | --- | --- |
-| `GET /claims` | `GET /v1/claims` | Same response shape. |
-| `GET /claims/{claim_id}` | `GET /v1/claims/{claim_id}` | Same response shape. |
-| `GET /formats` | `GET /v1/formats` | Same response shape. |
-| `POST /claims/evaluate` | `POST /v1/evaluations` | Creates an evaluation result from target plus claims. |
-| `POST /claims/batch-evaluate` | `POST /v1/batch-evaluations` | Creates a batch evaluation job/result. |
-| `POST /evidence/render` | `POST /v1/evaluations/{evaluation_id}/render` | Renders stored evaluation evidence. |
-| `POST /credentials/issue` | `POST /v1/credentials` | Issues a credential. |
-| `GET /credentials/status/{credential_id}` | `GET /v1/credentials/{credential_id}/status` | Credential id is the resource anchor. |
-
-### Admin API
-
-Keep admin routes separate and versioned:
-
-| Legacy route | Current route | Notes |
-| --- | --- | --- |
-| `POST /admin/reload` | `POST /admin/v1/reload` | Explicit admin API version. |
-| `POST /admin/credentials/status/{credential_id}` | `POST /admin/v1/credentials/{credential_id}/status` | Same body, clearer hierarchy. |
-
-### Federation API
-
-Federation already has a reasonable versioned shape:
-
-| Route | Current route | Notes |
-| --- | --- | --- |
-| `POST /federation/v1/evaluations` | keep | Already versioned and resource-oriented. |
-
-## Client API Impact
-
-The public client method names should remain workflow-oriented and should not
-mirror every path segment:
-
-| Workflow | Rust method | Python method | Node method |
-| --- | --- | --- | --- |
-| Evaluate via builder | `evaluate(...).send()` | `evaluate(...)`, `aevaluate(...)` | `evaluate(...)` |
-| Evaluate with raw request | `evaluate_request(...)` | `evaluate_request(...)`, `aevaluate_request(...)` | `evaluateRequest(...)` |
-| Batch evaluate | `batch_evaluate_request(...)` | `batch_evaluate_request(...)`, `abatch_evaluate_request(...)` | `batchEvaluateRequest(...)` |
-| Render evidence | `render_request(...)` | `render_request(...)`, `arender_request(...)` | `renderRequest(...)` |
-| Issue credential | `issue_credential_request(...)` | `issue_credential_request(...)`, `aissue_credential_request(...)` | `issueCredentialRequest(...)` |
-| Credential status | `credential_status(...)` | `credential_status(...)` | `credentialStatus(...)` |
-| Admin reload | `admin_reload(...)` | not exposed initially | not exposed initially |
-
-The client should update route constants internally. Public method names do not
-need to expose `/v1`.
-
-## Compatibility Position
-
-Because there are no real users yet, the preferred implementation is a breaking
-route cleanup:
-
-- Do not mount legacy aliases by default.
-- Do not document legacy routes.
-- Update adopter demos, smoke tests, OpenAPI, examples, and clients in the same
-  change.
-- If maintainers want a safety net, add legacy aliases only behind a
-  `compat_legacy_routes` test/dev feature and remove it before release.
-
-## Implementation Checklist
-
-- [x] Update `registry-notary-server` route mounting in `api.rs`.
-- [x] Update standalone routing/auth allowlists for the new paths.
-- [x] Update OpenAPI paths, operation ids, examples, and route coverage tests.
-- [x] Update client route constants/calls for Rust.
-- [x] Update Python and Node wrappers if they own route strings.
-- [x] Update docs and tutorials to use `/v1` application routes.
-- [x] Remove the retired registry-lab client usage and smoke scripts.
-- [x] Update federation docs only to confirm no route change.
-- [x] Run a route grep to prove old application routes are gone from source
-  docs/tests, except in this proposal, dated audit artifacts, demo audit logs,
-  or intentional changelog notes.
-
-## Definition Of Done
-
-- [x] `rg "/claims/evaluate|/claims/batch-evaluate|/evidence/render|/credentials/issue|/credentials/status/|/admin/reload|/admin/credentials/status" crates docs bindings` returns no stale route usage outside this proposal, dated audit artifacts, demo audit logs, or intentional changelog notes.
-- [ ] `cargo test -p registry-notary-server` passes.
-- [ ] `cargo test -p registry-notary-client` passes.
-- [ ] `cargo test -p registry-notary-client --features json-facade,oid4vci,federation` passes.
-- [ ] `cargo doc -p registry-notary-client --no-deps --all-features` passes.
-- [ ] Python binding tests pass.
-- [ ] Node binding tests and type checks pass.
-- [x] Retired Registry Lab smoke/e2e callers are removed. External adopter
-  validation belongs to the adopter repository.
-- [x] OpenAPI route coverage test asserts only the current route set.
-
-## Review Checkpoints
-
-1. Route-design review before implementation:
-   - Confirm `/v1` placement.
-   - Confirm OID4VCI and `.well-known` routes remain unversioned.
-   - Confirm no default legacy aliases.
-2. Server review:
-   - Route mounting, auth, body limits, OpenAPI, tests.
-3. Client/bindings review:
-   - Rust/Python/Node route mapping, errors, docs, smoke usage.
-4. Adopter/release review:
-   - Tutorials, adopter flows, release notes, old-route grep, CI.
-
-## Decisions
-
-- Render uses `POST /v1/evaluations/{evaluation_id}/render`; the path carries
-  `evaluation_id`, while the request body carries format and optional claim
-  selection.
-- Batch evaluation uses `POST /v1/batch-evaluations`.
-- Admin routes use `/admin/v1/...` because it keeps administrative APIs
-  visually separate from application APIs.
diff --git a/products/notary/specs/notary-capability-gaps.md b/products/notary/specs/notary-capability-gaps.md
deleted file mode 100644
index fd0f35a05..000000000
--- a/products/notary/specs/notary-capability-gaps.md
+++ /dev/null
@@ -1,146 +0,0 @@
-# Registry Notary Capability Gaps
-
-> **Page type:** Design record · **Product:** Registry Notary · **Layer:** all · **Audience:** maintainer
-
-> **Status: active gap register (2026-05-31).** This is the maintainer roadmap of
-> named product gaps surfaced by the scenario catalog. The scenario stories and
-> diagrams live in `../docs/notary-scenario-patterns.md`; the status-labeled
-> scenario matrix lives in `../docs/notary-capability-matrix.md`.
-
-## Per-Scenario Gaps
-
-The "Missing" bullets below are collected from each scenario in
-`../docs/notary-scenario-patterns.md`. Each group keeps its scenario name so the
-gap can be traced back to its flow.
-
-### 1. Civil Alive Predicate
-
-- No product gap for a compiler-pinned Relay consultation.
-
-### 2. Age Or Date-Of-Birth Evidence
-
-- No product gap for a compiler-pinned Relay consultation.
-
-### 3. Program Enrollment Active
-
-- No product gap for a compiler-pinned Relay consultation.
-
-### 4. Health Facility Service Available
-
-- No product gap for a compiler-pinned Relay consultation.
-
-### 5. Agriculture Voucher Eligibility
-
-- No product gap for a compiler-pinned Relay consultation.
-
-### 6. Livestock Movement Permit Eligibility
-
-- No product gap for a compiler-pinned Relay consultation.
-
-### 7. Benefits Agency Asks Civil Notary For Alive Predicate
-
-- Relay-backed federation with cross-service audit correlation.
-- Product outbound Notary-to-Notary client.
-- Lab client scenario that signs and verifies the full flow end to end.
-
-### 8. Benefits Agency Asks Social Notary For Active Beneficiary
-
-- Relay-backed federation with cross-service audit correlation.
-- Product requester/runtime client.
-- Demo fixture wiring for social federation profile metadata.
-
-### 9. Health-Linked Child Support Across Three Authorities
-
-- Outbound Notary federation client.
-- Runtime mapping of signed peer responses into CEL inputs.
-- Deterministic failure mapping for peer denial, stale claim result, and timeout.
-
-### 10. Municipality Verifies Residency With A National Steward
-
-- Relay-backed federation with cross-service audit correlation.
-- Residency profile fixtures.
-- Outbound requester support in Registry Notary if the municipal service is
-  itself a Notary workflow.
-
-### 11. Citizen Presents Civil-Status Proof To Benefits Service
-
-- User-presented proof verifier profile.
-- Mapping verified disclosures into local rule inputs.
-- Presentation replay and status policy.
-
-### 12. Farmer Presents Landholding Or Registration Proof
-
-- Proof profile for accepted landholding or farmer-registration credentials.
-- Freshness and revocation policy for agricultural proofs.
-
-### 13. Health Worker Presents Professional Credential
-
-- Notary runtime proof intake.
-- Issuer trust policy and status policy for professional credentials.
-
-### 14. Parent Or Guardian Requests A Service For A Child Or Dependent
-
-- Actor and subject separation in request and audit models.
-- Representation proof profiles for parentage, guardianship, power of attorney,
-  case delegation, or social-worker assignment.
-- Policy rules for whether Alice may request, receive, or hold evidence about
-  Charlie.
-- Redacted audit fields that record "Alice acted for Charlie" without exposing
-  raw identifiers.
-
-### 15. Household Or Group Representative Requests A Service
-
-- Collective `subject_ref` model for households, groups, cooperatives, farms,
-  and legal entities.
-- Representation proof profiles for household head, group officer,
-  cooperative representative, business officer, or delegated agent.
-- Policy rules for whether the actor may request, receive, or hold evidence
-  about the collective subject and its members.
-- Audit fields that distinguish actor, collective subject, represented members
-  when relevant, and representation proof without logging raw identifiers.
-
-### 16. Civil Notary Issues Date-Of-Birth Or Alive Credential
-
-- Production wallet interoperability hardening is outside this catalog.
-
-### 17. Agriculture Notary Issues Voucher Eligibility Credential
-
-- Full production wallet ceremony and status profile.
-
-### 18. Shared Eligibility Notary Issues Combined-Support Credential
-
-- Peer-result composition inside Notary runtime.
-- Audit links from issued credential to remote evaluation response ids.
-
-### 19. Service Helps Holder Obtain Credential From Remote Notary
-
-- Holder-binding ceremony for federated issuance.
-- Nonce ownership, transparent relay rules, substitution defenses, and tests.
-
-### 20. Replay And Emergency Peer Or Key Denial
-
-- No remaining correctness-state gap. Active-active deployments use the typed
-  Notary-owned PostgreSQL state schema.
-
-### 21. Auditor Verifies Minimized Decision Evidence
-
-- Signed audit checkpoints and inclusion proofs.
-- Standard audit report shape for cross-organization review.
-
-### 22. Peer Audit Checkpoint Monitoring
-
-- Merkle checkpoint builder.
-- Checkpoint publisher.
-- Peer monitor and historical checkpoint semantics.
-
-## Capability Gaps Surfaced
-
-- Outbound Notary federation client.
-- Mapping verified peer responses into local claim rule inputs.
-- User-presented proof verifier profiles.
-- Representation authority profiles, actor/subject separation, and collective
-  subject support.
-- Credential status and freshness policy for remote proofs.
-- Federated credential issuance holder-binding ceremony.
-- Signed audit checkpoints and peer monitoring.
-- External adopter validation for federation scenarios and fixture metadata.
diff --git a/products/notary/specs/openid4vci-wallet-facade-spec.md b/products/notary/specs/openid4vci-wallet-facade-spec.md
deleted file mode 100644
index 3bd693d7f..000000000
--- a/products/notary/specs/openid4vci-wallet-facade-spec.md
+++ /dev/null
@@ -1,174 +0,0 @@
-# OpenID4VCI wallet facade specification
-
-Status: normative Registry Stack 1.0 profile.
-
-Adoption mode: profiled OpenID4VCI subset.
-
-## Purpose
-
-Registry Notary exposes a narrow wallet facade for issuing holder-bound
-`dc+sd-jwt` credentials from registry-backed evidence. The facade adapts the
-Notary transaction and issuance model to wallets. Identity-provider and wallet
-inputs authorize and bind the transaction; they do not become claim evidence.
-Every issued claim derives from a compiler-pinned Relay consultation.
-
-## Trust and topology
-
-The actors and trust boundaries are:
-
-| Actor | Responsibility |
-| --- | --- |
-| Citizen browser | Completes the identity-provider login and receives the rendered offer |
-| Holder wallet | Redeems the pre-authorized code, proves control of an Ed25519 `did:jwk`, and stores the credential |
-| Identity provider | Authenticates the citizen and returns the configured subject-binding claim to Notary |
-| Registry Notary | Authorizes the transaction, stores its state, validates wallet proof, and issues the credential |
-| Registry Relay | Executes the compiler-pinned registry consultation that supplies issuance evidence |
-
-An authority deploys one Notary for each Relay authority. Notary owns its
-correctness state, including transaction, pre-authorized code, replay,
-evaluation, audit, and credential-status records. Production and multi-instance
-deployments use the Notary-owned PostgreSQL schema.
-
-The identity provider's authorization code is an internal browser-to-Notary
-authentication input. It is never a wallet grant. The only wallet-facing grant
-is an issuer-initiated pre-authorized code.
-
-## Supported profile
-
-Registry Stack 1.0 supports:
-
-- credential format `dc+sd-jwt` and media type `application/dc+sd-jwt`;
-- issuer signing with `EdDSA` or `ES256`, selected in the credential profile;
-- JWT holder proof using `EdDSA` and the `did:jwk` binding method;
-- issuer-initiated pre-authorized code offers;
-- an optional numeric transaction code, enabled by default;
-- immediate credential responses;
-- registry-backed evidence with exact compiler-pinned Relay execution
-  provenance;
-- status-bearing credentials whose status is verified fail closed.
-
-Registry Stack 1.0 does not claim:
-
-- wallet-facing OAuth authorization-code issuance;
-- credential issuance from caller-provided or identity-token data;
-- a public nonce endpoint or credential-response next nonce;
-- ES256 holder proof;
-- PAR, DPoP, wallet attestation, EUDI Wallet, or HAIP conformance;
-- deferred or batch issuance;
-- mDoc, JSON-LD, `vc+sd-jwt`, or CWT proof support;
-- delegated or representative credential issuance.
-
-## Public routes
-
-When OID4VCI and the pre-authorized flow are enabled, Notary exposes:
-
-- `GET /.well-known/openid-credential-issuer`
-- `GET /.well-known/vct/{vct_path}`
-- `GET /credentials/{vct_path}`
-- `GET /oid4vci/offer/start`
-- `GET /oid4vci/offer/callback`
-- `POST /oid4vci/token`
-- `POST /oid4vci/credential`
-
-`GET /oid4vci/credential-offer` and `POST /oid4vci/nonce` are not part of the
-1.0 contract. The credential response does not return `c_nonce` or
-`c_nonce_expires_in`.
-
-## Issuance sequence
-
-1. The citizen opens `GET /oid4vci/offer/start` in a browser.
-2. Notary starts an identity-provider authorization-code login using PKCE.
-3. The provider returns its code to `GET /oid4vci/offer/callback`.
-4. Notary exchanges and validates that code, derives the configured subject,
-   creates a registry transaction, executes the exact compiler-pinned Relay
-   consultation, and stores the resulting evaluation provenance.
-5. Only after those checks succeed, Notary renders an
-   `openid-credential-offer://` URI containing a single-use pre-authorized code.
-6. The wallet redeems the code at `POST /oid4vci/token`, including `tx_code`
-   when the offer requires one.
-7. Notary returns a short-lived access token and one proof nonce.
-8. The wallet calls `POST /oid4vci/credential` with that access token and an
-   EdDSA `did:jwk` proof.
-9. Notary consumes the proof nonce, reloads the bound transaction and stored
-   evaluation, verifies their exact provenance against the active compiled
-   contract, and signs the credential.
-
-No wallet request can choose a free-form subject or substitute a different
-claim, profile, purpose, contract hash, Relay ULID, acquisition time, or
-provenance record.
-
-## Metadata
-
-Issuer metadata is generated from the active configuration. Each credential
-configuration advertises exactly:
-
-- `format: dc+sd-jwt`;
-- its configured HTTPS `vct`;
-- `cryptographic_binding_methods_supported: [did:jwk]`;
-- JWT proof with `proof_signing_alg_values_supported: [EdDSA]`;
-- the issuer algorithm selected by its signing profile, `EdDSA` or `ES256`.
-
-Metadata includes Notary's `/oid4vci/token` endpoint while the flow is enabled.
-Offers contain only
-`urn:ietf:params:oauth:grant-type:pre-authorized_code`. Metadata does not
-advertise a nonce endpoint.
-
-## Transaction code policy
-
-`oid4vci.pre_authorized_code.tx_code.required` defaults to `true`. A required
-transaction code is displayed separately from the offer URI. Missing and wrong
-codes fail, repeated wrong attempts lock the offer, and invalid-code attempts
-are rate limited.
-
-Set `required: false` only when a wallet cannot present a transaction code. The
-Walt compatibility profile uses this explicit setting. Without a transaction
-code, the offer is bearer credential material until redemption, so:
-
-- `pre_authorized_code_ttl_seconds` must be no more than 300 seconds;
-- codes remain single-use;
-- invalid redemption attempts remain rate limited;
-- the offer URI must be protected from logs, screenshots, browser history,
-  analytics, and unintended sharing;
-- a stolen unredeemed offer can be redeemed by its holder within the bounded
-  lifetime.
-
-## Credential and status requirements
-
-The issued SD-JWT VC contains issuer, subject, type, lifetime, holder binding,
-and registry-backed disclosures derived from the stored transaction. The
-top-level `status` claim is reserved by Notary and cannot be configured as a
-selectively disclosable claim.
-
-When a credential contains `status.status_list`, client verification must:
-
-- fetch the signed status-list JWT only from the configured exact HTTPS trusted
-  origin;
-- validate its signature, issuer, type, index, and lifetime;
-- require the indexed value to be valid;
-- fail closed for missing, malformed, untrusted, unavailable, suspended,
-  revoked, or expired status.
-
-Status-free profiles remain explicit profile choices.
-
-## Error and replay behavior
-
-Pre-authorized codes, access tokens, proof nonces, and transaction bindings are
-short-lived and single-use where applicable. A replay, expired artifact, wrong
-transaction code, unsupported algorithm, unsupported binding, missing stored
-evaluation, or provenance mismatch fails without credential issuance.
-
-Errors must not expose raw identity-provider codes, wallet grants, access
-tokens, proof JWTs, subject identifiers, registry rows, disclosures, or signing
-keys.
-
-## Evidence and conformance
-
-Source tests cover the complete browser callback, offer, token, credential, and
-client-verification path for EdDSA and ES256 issuer keys with an EdDSA
-`did:jwk` holder. Tests also cover replay, tampering, denial of configurations
-without Relay-backed evidence, unsupported holder profiles, route removal, and
-status failure behavior.
-
-External wallet, verifier, OIDF suite, or ecosystem conformance is claimed only
-from a frozen candidate artifact with recorded product versions and immutable
-evidence. Until that evidence is published, those rows remain candidate-only.
diff --git a/products/notary/tests/advisory_baseline_check_test.py b/products/notary/tests/advisory_baseline_check_test.py
deleted file mode 100644
index a115a6da6..000000000
--- a/products/notary/tests/advisory_baseline_check_test.py
+++ /dev/null
@@ -1,322 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-import copy
-import importlib.util
-import json
-import sys
-import tempfile
-import unittest
-from pathlib import Path
-
-
-def load_module():
-    path = (
-        Path(__file__).resolve().parents[1] / "scripts" / "check_advisory_baselines.py"
-    )
-    spec = importlib.util.spec_from_file_location("check_advisory_baselines", path)
-    module = importlib.util.module_from_spec(spec)
-    sys.modules[spec.name] = module
-    spec.loader.exec_module(module)
-    return module
-
-
-class AdvisoryBaselineCheckTest(unittest.TestCase):
-    DIGEST = "sha256:" + "a" * 64
-    SUBJECT = "test-image"
-
-    def setUp(self):
-        self.module = load_module()
-        self.tmp = tempfile.TemporaryDirectory()
-        self.baseline_path = Path(self.tmp.name) / "advisory-baseline.json"
-
-    def tearDown(self):
-        self.tmp.cleanup()
-
-    def target(self, digest=None):
-        digest = digest or self.DIGEST
-        image = f"registry.example/test@{digest}"
-        return {
-            "userInput": image,
-            "repoDigests": [image],
-            "architecture": "amd64",
-            "os": "linux",
-        }
-
-    def reports(
-        self,
-        *,
-        vulnerability_id="CVE-2026-0001",
-        package="openssl",
-        installed_version="3.0.0",
-        severity="High",
-        fix=None,
-    ):
-        artifact = {
-            "id": "artifact-1",
-            "name": package,
-            "version": installed_version,
-            "type": "deb",
-        }
-        grype = {
-            "descriptor": {"name": "grype", "version": "0.114.0"},
-            "schema": {"version": "6.0.2"},
-            "source": {"type": "image", "target": self.target()},
-            "matches": [
-                {
-                    "vulnerability": {
-                        "id": vulnerability_id,
-                        "severity": severity,
-                        "fix": fix
-                        or {"versions": [], "state": "not-fixed"},
-                    },
-                    "artifact": copy.deepcopy(artifact),
-                }
-            ],
-        }
-        syft = {
-            "descriptor": {"name": "syft", "version": "1.45.1"},
-            "schema": {"version": "16.1.4"},
-            "source": {"type": "image", "metadata": self.target()},
-            "artifacts": [copy.deepcopy(artifact)],
-        }
-        return grype, syft
-
-    def finding(self, **overrides):
-        grype, syft = self.reports(**overrides)
-        return self.module.normalize_grype(grype, self.SUBJECT, syft)[0]
-
-    def exception(self, finding=None, **overrides):
-        finding = finding or self.finding()
-        value = {
-            "vulnerability_id": finding.rule_id,
-            "package": finding.package,
-            "installed_version": finding.installed_version,
-            "severity": finding.severity,
-            "status": "accepted_risk",
-            "owner": "@maintainers",
-            "rationale": (
-                "The affected behavior is not reachable in the reviewed deployment."
-            ),
-            "reviewed_at": "2026-06-02",
-            "expires_at": "2026-09-01",
-            "invalidation_triggers": sorted(
-                self.module.REQUIRED_INVALIDATION_TRIGGERS
-            ),
-        }
-        value.update(overrides)
-        return value
-
-    def baseline(self, exceptions=None):
-        return {
-            "version": 3,
-            "service": "test-service",
-            "policies": [
-                {
-                    "tool": "zizmor",
-                    "minimum_severity": "high",
-                    "action": "block_unreviewed",
-                },
-                {
-                    "tool": "grype",
-                    "minimum_severity": "high",
-                    "action": "block_unreviewed",
-                    "block_fixable": True,
-                },
-            ],
-            "exceptions": exceptions or [],
-        }
-
-    def write_baseline(self, value):
-        self.baseline_path.write_text(json.dumps(value), encoding="utf-8")
-        return self.module.load_baseline(self.baseline_path)
-
-    def check(self, findings, baseline, today="2026-06-02"):
-        return self.module.check_findings(
-            "grype",
-            findings,
-            baseline,
-            self.module.parse_date(today, "today"),
-        )
-
-    def test_v3_exception_uses_only_stable_identity_and_review_fields(self):
-        finding = self.finding()
-        baseline = self.write_baseline(self.baseline([self.exception(finding)]))
-        self.assertEqual(3, baseline["version"])
-        self.assertNotIn("fingerprint", baseline["exceptions"][0])
-        self.assertNotIn("runtime_base", baseline["exceptions"][0])
-        self.assertNotIn("evidence_revision", baseline["exceptions"][0])
-        self.assertNotIn("exposure_assertion", baseline["exceptions"][0])
-        self.assertEqual(0, self.check([finding], baseline))
-
-    def test_v3_schema_rejects_missing_or_transient_fields(self):
-        exception = self.exception()
-        del exception["owner"]
-        with self.assertRaises(SystemExit):
-            self.write_baseline(self.baseline([exception]))
-        exception = self.exception()
-        exception["component_layer_id"] = "sha256:" + "1" * 64
-        with self.assertRaises(SystemExit):
-            self.write_baseline(self.baseline([exception]))
-
-    def test_invalidation_triggers_are_exact_and_complete(self):
-        exception = self.exception()
-        exception["invalidation_triggers"].remove("fix_available")
-        with self.assertRaises(SystemExit):
-            self.write_baseline(self.baseline([exception]))
-
-    def test_high_or_critical_requires_review(self):
-        for severity in ("High", "Critical"):
-            with self.subTest(severity=severity):
-                finding = self.finding(severity=severity)
-                self.assertEqual(
-                    1, self.check([finding], self.write_baseline(self.baseline()))
-                )
-
-    def test_below_threshold_without_fix_passes(self):
-        finding = self.finding(severity="Medium")
-        self.assertEqual(
-            0, self.check([finding], self.write_baseline(self.baseline()))
-        )
-
-    def test_fixable_finding_cannot_be_excepted(self):
-        low = self.finding(
-            severity="Low",
-            fix={"versions": ["3.0.1"], "state": "fixed"},
-        )
-        self.assertEqual(1, self.check([low], self.write_baseline(self.baseline())))
-        finding = self.finding(
-            severity="High",
-            fix={"versions": ["3.0.1"], "state": "fixed"},
-        )
-        baseline = self.write_baseline(self.baseline([self.exception(finding)]))
-        self.assertEqual(1, self.check([finding], baseline))
-
-    def test_expired_and_future_dated_exceptions_fail(self):
-        finding = self.finding()
-        expired = self.write_baseline(
-            self.baseline(
-                [
-                    self.exception(
-                        finding,
-                        reviewed_at="2026-05-01",
-                        expires_at="2026-06-01",
-                    )
-                ]
-            )
-        )
-        self.assertEqual(1, self.check([finding], expired))
-        future = self.write_baseline(
-            self.baseline([self.exception(finding, reviewed_at="2026-06-03")])
-        )
-        self.assertEqual(1, self.check([finding], future))
-
-    def test_package_version_change_invalidates_exception(self):
-        reviewed = self.finding()
-        baseline = self.write_baseline(self.baseline([self.exception(reviewed)]))
-        changed = self.finding(installed_version="3.0.1")
-        self.assertEqual(1, self.check([changed], baseline))
-
-    def test_second_installed_version_is_not_hidden_by_matching_exception(self):
-        reviewed = self.finding()
-        baseline = self.write_baseline(self.baseline([self.exception(reviewed)]))
-        additional = self.finding(installed_version="3.0.1")
-        self.assertEqual(1, self.check([reviewed, additional], baseline))
-
-    def test_severity_change_is_a_material_change(self):
-        reviewed = self.finding()
-        baseline = self.write_baseline(self.baseline([self.exception(reviewed)]))
-        changed = self.finding(severity="Critical")
-        self.assertEqual(1, self.check([changed], baseline))
-
-    def test_exception_for_absent_or_fixed_finding_fails(self):
-        finding = self.finding()
-        baseline = self.write_baseline(self.baseline([self.exception(finding)]))
-        self.assertEqual(1, self.check([], baseline))
-
-    def test_grype_and_syft_are_bound_to_same_exact_digest(self):
-        grype, syft = self.reports()
-        syft["source"]["metadata"] = self.target("sha256:" + "b" * 64)
-        with self.assertRaises(SystemExit):
-            self.module.normalize_grype(grype, self.SUBJECT, syft)
-
-    def test_unpinned_image_or_wrong_platform_fails_closed(self):
-        grype, syft = self.reports()
-        grype["source"]["target"]["userInput"] = "registry.example/test:latest"
-        with self.assertRaises(SystemExit):
-            self.module.normalize_grype(grype, self.SUBJECT, syft)
-        grype, syft = self.reports()
-        syft["source"]["metadata"]["architecture"] = "arm64"
-        with self.assertRaises(SystemExit):
-            self.module.normalize_grype(grype, self.SUBJECT, syft)
-
-    def test_incomplete_or_unsupported_scanner_reports_fail_closed(self):
-        grype, syft = self.reports()
-        del grype["descriptor"]
-        with self.assertRaises(SystemExit):
-            self.module.normalize_grype(grype, self.SUBJECT, syft)
-        grype, syft = self.reports()
-        syft["descriptor"]["name"] = "not-syft"
-        with self.assertRaises(SystemExit):
-            self.module.normalize_grype(grype, self.SUBJECT, syft)
-        grype, syft = self.reports()
-        syft["schema"]["version"] = "17.0.0"
-        with self.assertRaises(SystemExit):
-            self.module.normalize_grype(grype, self.SUBJECT, syft)
-        grype, syft = self.reports()
-        grype["matches"][0]["vulnerability"]["fix"]["state"] = "unknown"
-        with self.assertRaises(SystemExit):
-            self.module.normalize_grype(grype, self.SUBJECT, syft)
-
-    def test_grype_package_must_match_syft_package_model(self):
-        grype, syft = self.reports()
-        syft["artifacts"][0]["version"] = "3.0.1"
-        with self.assertRaises(SystemExit):
-            self.module.normalize_grype(grype, self.SUBJECT, syft)
-
-    def test_historical_v2_baseline_is_still_parsed(self):
-        finding = self.finding()
-        legacy = self.baseline()
-        legacy["version"] = 2
-        legacy.pop("exceptions")
-        legacy["field_semantics"] = {"historical": "ignored"}
-        legacy["reviewed_findings"] = [
-            {
-                "tool": "grype",
-                "fingerprint": finding.fingerprint,
-                "rule_id": finding.rule_id,
-                "severity": finding.severity,
-                "status": "accepted_risk",
-                "owner": "@maintainers",
-                "reason": "Historical reviewed finding.",
-                "reviewed_at": "2026-06-02",
-                "expires_at": "2026-09-01",
-            }
-        ]
-        baseline = self.write_baseline(legacy)
-        self.assertEqual(0, self.check([finding], baseline))
-
-    def test_zizmor_high_remains_blocking(self):
-        baseline = self.write_baseline(self.baseline())
-        findings = self.module.normalize_zizmor(
-            [
-                {
-                    "ident": "unpinned-uses",
-                    "desc": "action is not pinned",
-                    "determinations": {"severity": "High"},
-                    "locations": [],
-                    "ignored": False,
-                }
-            ]
-        )
-        self.assertEqual(
-            1,
-            self.module.check_findings(
-                "zizmor",
-                findings,
-                baseline,
-                self.module.parse_date("2026-06-02", "today"),
-            ),
-        )
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/algorithm-profile.json b/products/notary/tests/fixtures/sd_jwt_vc/algorithm-profile.json
deleted file mode 100644
index 1d9111975..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/algorithm-profile.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  "credential_configurations": {
-    "fixture_eddsa": {
-      "credential_signing_alg_values_supported": [
-        "EdDSA"
-      ],
-      "cryptographic_binding_methods_supported": [
-        "did:jwk"
-      ],
-      "fixture": "valid-holder-bound.sd-jwt",
-      "private_jwk_fixture": "issuer-eddsa-private.test.jwk.json",
-      "proof_signing_alg_values_supported": [
-        "EdDSA"
-      ]
-    },
-    "fixture_es256": {
-      "credential_signing_alg_values_supported": [
-        "ES256"
-      ],
-      "cryptographic_binding_methods_supported": [
-        "did:jwk"
-      ],
-      "fixture": "valid-es256.sd-jwt",
-      "private_jwk_fixture": "issuer-es256-private.test.jwk.json",
-      "proof_signing_alg_values_supported": [
-        "EdDSA"
-      ]
-    }
-  },
-  "holder_proof": {
-    "cryptographic_binding_methods_supported": [
-      "did:jwk"
-    ],
-    "fixture": "holder-proof-eddsa.jwt",
-    "private_jwk_fixture": "holder-eddsa-private.test.jwk.json",
-    "signing_alg_values_supported": [
-      "EdDSA"
-    ],
-    "unsupported_fixture": "holder-proof-es256-unsupported.jwt"
-  },
-  "note": "All key and token material is synthetic test-only material. Do not use outside tests.",
-  "proof_audience": "https://fixture.test/oid4vci",
-  "proof_nonce": "fixture-transaction-nonce"
-}
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/expired.sd-jwt b/products/notary/tests/fixtures/sd_jwt_vc/expired.sd-jwt
deleted file mode 100644
index b50a67889..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/expired.sd-jwt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJFZERTQSIsImtpZCI6ImRpZDp3ZWI6Zml4dHVyZS50ZXN0I2tleS0xIiwidHlwIjoiZGMrc2Qtand0In0.eyJfc2QiOlsiMFdUd0gyamEyVEpEcFFkem9zTXh5SHJ2RzM3X1R2QTl3SjdiZ0tlT1FOOCJdLCJfc2RfYWxnIjoic2hhLTI1NiIsImV4cCI6MTcwNTI3MzIwMCwiaWF0IjoxNzA1MjY5NjAwLCJpZCI6InVybjp1bGlkOjAxSEcwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIiwiaXNzIjoiZGlkOndlYjpmaXh0dXJlLnRlc3QiLCJqdGkiOiJ1cm46dWxpZDowMUhHMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsInN1YiI6InN1YmplY3QtcmVmIiwidmN0IjoiaHR0cHM6Ly9maXh0dXJlLnRlc3QvY3JlZGVudGlhbHMvcmVnaXN0cnktd2l0bmVzcy92MSJ9.i0ghNyIDlm5FDZAArOwqd9EkDLS67iBWvXfwoU7pq6k762xxnvD1tcNcL_QKqtyzA2lS6gY5CVsYQ_zdAlXWDA~WyJ2aGFDRnIwV0pYaDc0ekVrVTNIbTZRIiwiY2xhaW1fYSIseyJzYXRpc2ZpZWQiOnRydWUsInZhbHVlIjoiZml4dHVyZSJ9XQ~
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/holder-eddsa-private.test.jwk.json b/products/notary/tests/fixtures/sd_jwt_vc/holder-eddsa-private.test.jwk.json
deleted file mode 100644
index 753c2c8cc..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/holder-eddsa-private.test.jwk.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "alg": "EdDSA",
-  "crv": "Ed25519",
-  "d": "f4QIxnAyRWzhuBOmNRgvBTE56mWePdsPL0mvCtl8Gys",
-  "kid": "did:web:fixture.test#holder-key-1",
-  "kty": "OKP",
-  "x": "pv4e_hXHBLN27rcs6VDFV1ED0TiU8M3xy9vsuWFEsec"
-}
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/holder-proof-eddsa.jwt b/products/notary/tests/fixtures/sd_jwt_vc/holder-proof-eddsa.jwt
deleted file mode 100644
index 8337c8a53..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/holder-proof-eddsa.jwt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJFZERTQSIsImtpZCI6ImRpZDpqd2s6ZXlKamNuWWlPaUpGWkRJMU5URTVJaXdpYTNSNUlqb2lUMHRRSWl3aWVDSTZJbkIyTkdWZmFGaElRa3hPTWpkeVkzTTJWa1JHVmpGRlJEQlVhVlU0VFRONGVUbDJjM1ZYUmtWelpXTWlmUSMwIiwidHlwIjoib3BlbmlkNHZjaS1wcm9vZitqd3QifQ.eyJhdWQiOiJodHRwczovL2ZpeHR1cmUudGVzdC9vaWQ0dmNpIiwiZXhwIjoxNzA1Mjc3MTAwLCJpYXQiOjE3MDUyNzY4MDAsIm5vbmNlIjoiZml4dHVyZS10cmFuc2FjdGlvbi1ub25jZSJ9.ZxPLxfPZTlWPMssHaKrNWLiaAfAYmIiGVp88J-N6PKE-0YXWB8AKUcLFA1_vKfftvkAugtl9cw2yBaupIeA9DA
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/holder-proof-es256-unsupported.jwt b/products/notary/tests/fixtures/sd_jwt_vc/holder-proof-es256-unsupported.jwt
deleted file mode 100644
index d5b43d131..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/holder-proof-es256-unsupported.jwt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJFUzI1NiIsImtpZCI6ImRpZDpqd2s6ZXlKcmRIa2lPaUpGUXlJc0ltdHBaQ0k2SW1ScFpEcDNaV0k2Wm1sNGRIVnlaUzUwWlhOMEkzQXlOVFl0YTJWNUxURWlMQ0poYkdjaU9pSkZVekkxTmlJc0ltTnlkaUk2SWxBdE1qVTJJaXdpZUNJNklqTnJjSHBCU3pabVN6WjRlV1p4WW1Sd01FaDJabHBEY1dabmVqZE5ZV3BOZG1sTGVVMDJZbk5PUlRRaUxDSjVJam9pUjJ0VFpGTnVPSGh4WjJVMU1uSndPVk4yTFRSeFVHRjNNVkU1VkVveVpVMVZlVmt5TW1ac1lYWk1WU0o5IzAiLCJ0eXAiOiJvcGVuaWQ0dmNpLXByb29mK2p3dCJ9.eyJhdWQiOiJodHRwczovL2ZpeHR1cmUudGVzdC9vaWQ0dmNpIiwiZXhwIjoxNzA1Mjc3MTAwLCJpYXQiOjE3MDUyNzY4MDAsIm5vbmNlIjoiZml4dHVyZS10cmFuc2FjdGlvbi1ub25jZSJ9.Pt61ZPAazRYMjsdk8sLx6v7xoP2VT9CqPNzPggy7Bj_KbyJvA7feV35U99NQnVAmml22NRIuonsOkYHRaPgQXA
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/holder-proof-mismatch.sd-jwt b/products/notary/tests/fixtures/sd_jwt_vc/holder-proof-mismatch.sd-jwt
deleted file mode 100644
index 5b89bcad5..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/holder-proof-mismatch.sd-jwt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJFZERTQSIsImtpZCI6ImRpZDp3ZWI6Zml4dHVyZS50ZXN0I2tleS0xIiwidHlwIjoiZGMrc2Qtand0In0.eyJfc2QiOlsic0g3V3BEYXg1Mk5zSzVmNHdRb05PY1RZcUxEdWhUQ1JxNjJobUs5cjF2WSJdLCJfc2RfYWxnIjoic2hhLTI1NiIsImNuZiI6eyJqd2siOnsiYWxnIjoiRWREU0EiLCJjcnYiOiJFZDI1NTE5Iiwia2lkIjoiZGlkOndlYjpmaXh0dXJlLnRlc3QjaG9sZGVyLWtleS0xIiwia3R5IjoiT0tQIiwieCI6InB2NGVfaFhIQkxOMjdyY3M2VkRGVjFFRDBUaVU4TTN4eTl2c3VXRkVzZWMifSwia2lkIjoiZGlkOmp3azpleUpqY25ZaU9pSkZaREkxTlRFNUlpd2lhM1I1SWpvaVQwdFFJaXdpZUNJNkluQjJOR1ZmYUZoSVFreE9NamR5WTNNMlZrUkdWakZGUkRCVWFWVTRUVE40ZVRsMmMzVlhSa1Z6WldNaWZRIn0sImV4cCI6MTcwNTI4MDQwMCwiaWF0IjoxNzA1Mjc2ODAwLCJpZCI6InVybjp1bGlkOjAxSEcwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIiwiaXNzIjoiZGlkOndlYjpmaXh0dXJlLnRlc3QiLCJqdGkiOiJ1cm46dWxpZDowMUhHMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsInN1YiI6ImRpZDpqd2s6ZXlKamNuWWlPaUpGWkRJMU5URTVJaXdpYTNSNUlqb2lUMHRRSWl3aWVDSTZJbkIyTkdWZmFGaElRa3hPTWpkeVkzTTJWa1JHVmpGRlJEQlVhVlU0VFRONGVUbDJjM1ZYUmtWelpXTWlmUSIsInZjdCI6Imh0dHBzOi8vZml4dHVyZS50ZXN0L2NyZWRlbnRpYWxzL3JlZ2lzdHJ5LXdpdG5lc3MvdjEifQ.Ng81aheW6nau-rYKIkRS7Cz_X8aq9jNtoBDOuq6oh3r2tP8oxgu3wFpsq9JXoC9teEsMuuH4NucSgCjL5YK3Ag~WyJzUFZOVTF5NXNVcnhzMHphRHlqM3JRIiwiY2xhaW1fYSIseyJzYXRpc2ZpZWQiOnRydWUsInZhbHVlIjoiZml4dHVyZSJ9XQ~eyJhbGciOiJFZERTQSIsInR5cCI6ImtiK2p3dCJ9.eyJpYXQiOjE3MDUyNzY4MDB9.eFvtKcmmkNTzLMtfEqhIsFv12iL8j-4pbuzd1ChsdKTzmLAuNtTkYhdsjSXbvZnRRitz71j4TBFeyE6wKCBEBw
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/holder-public-jwk.json b/products/notary/tests/fixtures/sd_jwt_vc/holder-public-jwk.json
deleted file mode 100644
index 68f10f094..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/holder-public-jwk.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "alg": "EdDSA",
-  "crv": "Ed25519",
-  "kid": "did:web:fixture.test#holder-key-1",
-  "kty": "OKP",
-  "x": "pv4e_hXHBLN27rcs6VDFV1ED0TiU8M3xy9vsuWFEsec"
-}
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/issuer-eddsa-private.test.jwk.json b/products/notary/tests/fixtures/sd_jwt_vc/issuer-eddsa-private.test.jwk.json
deleted file mode 100644
index 0a9500160..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/issuer-eddsa-private.test.jwk.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "alg": "EdDSA",
-  "crv": "Ed25519",
-  "d": "2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw",
-  "kid": "did:web:fixture.test#key-1",
-  "kty": "OKP",
-  "x": "1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc"
-}
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/issuer-es256-private.test.jwk.json b/products/notary/tests/fixtures/sd_jwt_vc/issuer-es256-private.test.jwk.json
deleted file mode 100644
index d938912e9..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/issuer-es256-private.test.jwk.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "alg": "ES256",
-  "crv": "P-256",
-  "d": "MInq88dvxx-e1-MEfmdes4I6Gt2QbsKoEmYyk2j0Oj4",
-  "kid": "did:web:fixture.test#p256-key-1",
-  "kty": "EC",
-  "x": "3kpzAK6fK6xyfqbdp0HvfZCqfgz7MajMviKyM6bsNE4",
-  "y": "GkSdSn8xqge52rp9Sv-4qPaw1Q9TJ2eMUyY22flavLU"
-}
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/issuer-jwks.json b/products/notary/tests/fixtures/sd_jwt_vc/issuer-jwks.json
deleted file mode 100644
index 6a29499dc..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/issuer-jwks.json
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  "keys": [
-    {
-      "alg": "EdDSA",
-      "crv": "Ed25519",
-      "kid": "did:web:fixture.test#key-1",
-      "kty": "OKP",
-      "x": "1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc"
-    },
-    {
-      "alg": "ES256",
-      "crv": "P-256",
-      "kid": "did:web:fixture.test#p256-key-1",
-      "kty": "EC",
-      "x": "3kpzAK6fK6xyfqbdp0HvfZCqfgz7MajMviKyM6bsNE4",
-      "y": "GkSdSn8xqge52rp9Sv-4qPaw1Q9TJ2eMUyY22flavLU"
-    }
-  ]
-}
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/malformed-disclosure.sd-jwt b/products/notary/tests/fixtures/sd_jwt_vc/malformed-disclosure.sd-jwt
deleted file mode 100644
index 8bb611cee..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/malformed-disclosure.sd-jwt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJFZERTQSIsImtpZCI6ImRpZDp3ZWI6Zml4dHVyZS50ZXN0I2tleS0xIiwidHlwIjoiZGMrc2Qtand0In0.eyJfc2QiOlsiRWg0ZV9paW5jVkdNTmhuSFF5WmFQWU1fektEUTZfclg4akx5TGRtemNDZyJdLCJfc2RfYWxnIjoic2hhLTI1NiIsImV4cCI6MTcwNTI4MDQwMCwiaWF0IjoxNzA1Mjc2ODAwLCJpZCI6InVybjp1bGlkOjAxSEcwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIiwiaXNzIjoiZGlkOndlYjpmaXh0dXJlLnRlc3QiLCJqdGkiOiJ1cm46dWxpZDowMUhHMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsInN1YiI6InN1YmplY3QtcmVmIiwidmN0IjoiaHR0cHM6Ly9maXh0dXJlLnRlc3QvY3JlZGVudGlhbHMvcmVnaXN0cnktd2l0bmVzcy92MSJ9.50Uj9azUJ9toDtYyu7wWK-bxtiUZxSXpUl8fLy2mSxaU1opAbva97c1CyD3b5k4Vg8ZrLEsJl_69_DBmUvfLAg~WyJEQ0N5aXRxTEtTVE5wMXZBUGtHVXhnIiwiY2xhaW1fYSIseyJzYXRpc2ZpZWQiOnRydWUsInZhbHVlIjoiZml4dHVyZSJ9XA~
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/meta.json b/products/notary/tests/fixtures/sd_jwt_vc/meta.json
deleted file mode 100644
index 7996a33aa..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/meta.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "es256_key_id": "did:web:fixture.test#p256-key-1",
-  "exp": 1705280400,
-  "holder_did": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6InB2NGVfaFhIQkxOMjdyY3M2VkRGVjFFRDBUaVU4TTN4eTl2c3VXRkVzZWMifQ",
-  "iat": 1705276800,
-  "issuer": "did:web:fixture.test",
-  "key_id": "did:web:fixture.test#key-1",
-  "note": "All key material in this directory is synthetic test-only material. Do not use outside tests.",
-  "vct": "https://fixture.test/credentials/registry-witness/v1"
-}
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/missing-cnf-when-binding-required.sd-jwt b/products/notary/tests/fixtures/sd_jwt_vc/missing-cnf-when-binding-required.sd-jwt
deleted file mode 100644
index 724e95b2e..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/missing-cnf-when-binding-required.sd-jwt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJFZERTQSIsImtpZCI6ImRpZDp3ZWI6Zml4dHVyZS50ZXN0I2tleS0xIiwidHlwIjoiZGMrc2Qtand0In0.eyJfc2QiOlsiejZqcVRYdGdqY1JlM3FlU1pLOWo4ZHhPaVphTEZyemdQc2NoSHE1aFNWbyIsInpRc0MzRUxHU2o3WmZpcDNoRUdkS0VBMm1wR290TU1VN3NkdXk4OUo1dE0iXSwiX3NkX2FsZyI6InNoYS0yNTYiLCJleHAiOjE3MDUyODA0MDAsImlhdCI6MTcwNTI3NjgwMCwiaWQiOiJ1cm46dWxpZDowMUhHMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsImlzcyI6ImRpZDp3ZWI6Zml4dHVyZS50ZXN0IiwianRpIjoidXJuOnVsaWQ6MDFIRzAwMDAwMDAwMDAwMDAwMDAwMDAwMDAiLCJzdWIiOiJzdWJqZWN0LXJlZiIsInZjdCI6Imh0dHBzOi8vZml4dHVyZS50ZXN0L2NyZWRlbnRpYWxzL3JlZ2lzdHJ5LXdpdG5lc3MvdjEifQ.ydkRzxDGmb7CBt1ZRwRiFO2uB3e7_jR_gtbV-_v5z6BtTsGB5W5d1mwunKJ5Fflkvq3mqdqetX7WYZTerynhAQ~WyJuaGdNZzRPRFpQOTFoU0xldHduaHlBIiwiY2xhaW1fYSIseyJzYXRpc2ZpZWQiOnRydWUsInZhbHVlIjoiZml4dHVyZSJ9XQ~WyJUT2FUZkxsSXA2T2RvUG1yRXY1NnBnIiwiY2xhaW1fYiIseyJzYXRpc2ZpZWQiOnRydWUsInZhbHVlIjoiZml4dHVyZSJ9XQ~
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/tampered-disclosure.sd-jwt b/products/notary/tests/fixtures/sd_jwt_vc/tampered-disclosure.sd-jwt
deleted file mode 100644
index 174286ec5..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/tampered-disclosure.sd-jwt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJFZERTQSIsImtpZCI6ImRpZDp3ZWI6Zml4dHVyZS50ZXN0I2tleS0xIiwidHlwIjoiZGMrc2Qtand0In0.eyJfc2QiOlsiejZqcVRYdGdqY1JlM3FlU1pLOWo4ZHhPaVphTEZyemdQc2NoSHE1aFNWbyIsInpRc0MzRUxHU2o3WmZpcDNoRUdkS0VBMm1wR290TU1VN3NkdXk4OUo1dE0iXSwiX3NkX2FsZyI6InNoYS0yNTYiLCJleHAiOjE3MDUyODA0MDAsImlhdCI6MTcwNTI3NjgwMCwiaWQiOiJ1cm46dWxpZDowMUhHMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsImlzcyI6ImRpZDp3ZWI6Zml4dHVyZS50ZXN0IiwianRpIjoidXJuOnVsaWQ6MDFIRzAwMDAwMDAwMDAwMDAwMDAwMDAwMDAiLCJzdWIiOiJzdWJqZWN0LXJlZiIsInZjdCI6Imh0dHBzOi8vZml4dHVyZS50ZXN0L2NyZWRlbnRpYWxzL3JlZ2lzdHJ5LXdpdG5lc3MvdjEifQ.ydkRzxDGmb7CBt1ZRwRiFO2uB3e7_jR_gtbV-_v5z6BtTsGB5W5d1mwunKJ5Fflkvq3mqdqetX7WYZTerynhAQ~WyJuaGdNZzRPRFpQOTFoU0xldHduaHlBIiwiY2xhaW1fYSIseyJzYXRpc2ZpZWQiOmZhbHNlLCJ2YWx1ZSI6InRhbXBlcmVkIn1d~WyJUT2FUZkxsSXA2T2RvUG1yRXY1NnBnIiwiY2xhaW1fYiIseyJzYXRpc2ZpZWQiOnRydWUsInZhbHVlIjoiZml4dHVyZSJ9XQ~
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/unsupported-alg.sd-jwt b/products/notary/tests/fixtures/sd_jwt_vc/unsupported-alg.sd-jwt
deleted file mode 100644
index 771958d8a..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/unsupported-alg.sd-jwt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJSUzI1NiIsImtpZCI6ImRpZDp3ZWI6Zml4dHVyZS50ZXN0I2tleS0xIiwidHlwIjoiZGMrc2Qtand0In0.eyJfc2QiOlsiRWg0ZV9paW5jVkdNTmhuSFF5WmFQWU1fektEUTZfclg4akx5TGRtemNDZyJdLCJfc2RfYWxnIjoic2hhLTI1NiIsImV4cCI6MTcwNTI4MDQwMCwiaWF0IjoxNzA1Mjc2ODAwLCJpZCI6InVybjp1bGlkOjAxSEcwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIiwiaXNzIjoiZGlkOndlYjpmaXh0dXJlLnRlc3QiLCJqdGkiOiJ1cm46dWxpZDowMUhHMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsInN1YiI6InN1YmplY3QtcmVmIiwidmN0IjoiaHR0cHM6Ly9maXh0dXJlLnRlc3QvY3JlZGVudGlhbHMvcmVnaXN0cnktd2l0bmVzcy92MSJ9.50Uj9azUJ9toDtYyu7wWK-bxtiUZxSXpUl8fLy2mSxaU1opAbva97c1CyD3b5k4Vg8ZrLEsJl_69_DBmUvfLAg~WyJEQ0N5aXRxTEtTVE5wMXZBUGtHVXhnIiwiY2xhaW1fYSIseyJzYXRpc2ZpZWQiOnRydWUsInZhbHVlIjoiZml4dHVyZSJ9XQ~
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/valid-es256.sd-jwt b/products/notary/tests/fixtures/sd_jwt_vc/valid-es256.sd-jwt
deleted file mode 100644
index 47ca918ff..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/valid-es256.sd-jwt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJFUzI1NiIsImtpZCI6ImRpZDp3ZWI6Zml4dHVyZS50ZXN0I3AyNTYta2V5LTEiLCJ0eXAiOiJkYytzZC1qd3QifQ.eyJfc2QiOltdLCJfc2RfYWxnIjoic2hhLTI1NiIsImNuZiI6eyJqd2siOnsiYWxnIjoiRWREU0EiLCJjcnYiOiJFZDI1NTE5Iiwia2lkIjoiZGlkOndlYjpmaXh0dXJlLnRlc3QjaG9sZGVyLWtleS0xIiwia3R5IjoiT0tQIiwieCI6InB2NGVfaFhIQkxOMjdyY3M2VkRGVjFFRDBUaVU4TTN4eTl2c3VXRkVzZWMifSwia2lkIjoiZGlkOmp3azpleUpqY25ZaU9pSkZaREkxTlRFNUlpd2lhM1I1SWpvaVQwdFFJaXdpZUNJNkluQjJOR1ZmYUZoSVFreE9NamR5WTNNMlZrUkdWakZGUkRCVWFWVTRUVE40ZVRsMmMzVlhSa1Z6WldNaWZRIn0sImV4cCI6MTcwNTI4MDQwMCwiaWF0IjoxNzA1Mjc2ODAwLCJpZCI6InVybjp1bGlkOjAxSEcwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIiwiaXNzIjoiZGlkOndlYjpmaXh0dXJlLnRlc3QiLCJqdGkiOiJ1cm46dWxpZDowMUhHMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsInN1YiI6ImRpZDpqd2s6ZXlKamNuWWlPaUpGWkRJMU5URTVJaXdpYTNSNUlqb2lUMHRRSWl3aWVDSTZJbkIyTkdWZmFGaElRa3hPTWpkeVkzTTJWa1JHVmpGRlJEQlVhVlU0VFRONGVUbDJjM1ZYUmtWelpXTWlmUSIsInZjdCI6Imh0dHBzOi8vZml4dHVyZS50ZXN0L2NyZWRlbnRpYWxzL3JlZ2lzdHJ5LXdpdG5lc3MvdjEifQ.p-YA4EwxXa1LLBQLm7vUGF8Y2jBHPpneRtOg8ZgC_zq1myfQUa6cPP9aQwActI3zeURcFZBnNuMiAm0bCDHZnA~~
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/valid-holder-bound.sd-jwt b/products/notary/tests/fixtures/sd_jwt_vc/valid-holder-bound.sd-jwt
deleted file mode 100644
index c8c283ef3..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/valid-holder-bound.sd-jwt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJFZERTQSIsImtpZCI6ImRpZDp3ZWI6Zml4dHVyZS50ZXN0I2tleS0xIiwidHlwIjoiZGMrc2Qtand0In0.eyJfc2QiOlsic0g3V3BEYXg1Mk5zSzVmNHdRb05PY1RZcUxEdWhUQ1JxNjJobUs5cjF2WSJdLCJfc2RfYWxnIjoic2hhLTI1NiIsImNuZiI6eyJqd2siOnsiYWxnIjoiRWREU0EiLCJjcnYiOiJFZDI1NTE5Iiwia2lkIjoiZGlkOndlYjpmaXh0dXJlLnRlc3QjaG9sZGVyLWtleS0xIiwia3R5IjoiT0tQIiwieCI6InB2NGVfaFhIQkxOMjdyY3M2VkRGVjFFRDBUaVU4TTN4eTl2c3VXRkVzZWMifSwia2lkIjoiZGlkOmp3azpleUpqY25ZaU9pSkZaREkxTlRFNUlpd2lhM1I1SWpvaVQwdFFJaXdpZUNJNkluQjJOR1ZmYUZoSVFreE9NamR5WTNNMlZrUkdWakZGUkRCVWFWVTRUVE40ZVRsMmMzVlhSa1Z6WldNaWZRIn0sImV4cCI6MTcwNTI4MDQwMCwiaWF0IjoxNzA1Mjc2ODAwLCJpZCI6InVybjp1bGlkOjAxSEcwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIiwiaXNzIjoiZGlkOndlYjpmaXh0dXJlLnRlc3QiLCJqdGkiOiJ1cm46dWxpZDowMUhHMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsInN1YiI6ImRpZDpqd2s6ZXlKamNuWWlPaUpGWkRJMU5URTVJaXdpYTNSNUlqb2lUMHRRSWl3aWVDSTZJbkIyTkdWZmFGaElRa3hPTWpkeVkzTTJWa1JHVmpGRlJEQlVhVlU0VFRONGVUbDJjM1ZYUmtWelpXTWlmUSIsInZjdCI6Imh0dHBzOi8vZml4dHVyZS50ZXN0L2NyZWRlbnRpYWxzL3JlZ2lzdHJ5LXdpdG5lc3MvdjEifQ.Ng81aheW6nau-rYKIkRS7Cz_X8aq9jNtoBDOuq6oh3r2tP8oxgu3wFpsq9JXoC9teEsMuuH4NucSgCjL5YK3Ag~WyJzUFZOVTF5NXNVcnhzMHphRHlqM3JRIiwiY2xhaW1fYSIseyJzYXRpc2ZpZWQiOnRydWUsInZhbHVlIjoiZml4dHVyZSJ9XQ~
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/valid.sd-jwt b/products/notary/tests/fixtures/sd_jwt_vc/valid.sd-jwt
deleted file mode 100644
index 724e95b2e..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/valid.sd-jwt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJFZERTQSIsImtpZCI6ImRpZDp3ZWI6Zml4dHVyZS50ZXN0I2tleS0xIiwidHlwIjoiZGMrc2Qtand0In0.eyJfc2QiOlsiejZqcVRYdGdqY1JlM3FlU1pLOWo4ZHhPaVphTEZyemdQc2NoSHE1aFNWbyIsInpRc0MzRUxHU2o3WmZpcDNoRUdkS0VBMm1wR290TU1VN3NkdXk4OUo1dE0iXSwiX3NkX2FsZyI6InNoYS0yNTYiLCJleHAiOjE3MDUyODA0MDAsImlhdCI6MTcwNTI3NjgwMCwiaWQiOiJ1cm46dWxpZDowMUhHMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsImlzcyI6ImRpZDp3ZWI6Zml4dHVyZS50ZXN0IiwianRpIjoidXJuOnVsaWQ6MDFIRzAwMDAwMDAwMDAwMDAwMDAwMDAwMDAiLCJzdWIiOiJzdWJqZWN0LXJlZiIsInZjdCI6Imh0dHBzOi8vZml4dHVyZS50ZXN0L2NyZWRlbnRpYWxzL3JlZ2lzdHJ5LXdpdG5lc3MvdjEifQ.ydkRzxDGmb7CBt1ZRwRiFO2uB3e7_jR_gtbV-_v5z6BtTsGB5W5d1mwunKJ5Fflkvq3mqdqetX7WYZTerynhAQ~WyJuaGdNZzRPRFpQOTFoU0xldHduaHlBIiwiY2xhaW1fYSIseyJzYXRpc2ZpZWQiOnRydWUsInZhbHVlIjoiZml4dHVyZSJ9XQ~WyJUT2FUZkxsSXA2T2RvUG1yRXY1NnBnIiwiY2xhaW1fYiIseyJzYXRpc2ZpZWQiOnRydWUsInZhbHVlIjoiZml4dHVyZSJ9XQ~
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/wrong-kid.sd-jwt b/products/notary/tests/fixtures/sd_jwt_vc/wrong-kid.sd-jwt
deleted file mode 100644
index 5b617cb02..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/wrong-kid.sd-jwt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJFZERTQSIsImtpZCI6ImRpZDp3ZWI6Zml4dHVyZS50ZXN0I21pc3NpbmciLCJ0eXAiOiJkYytzZC1qd3QifQ.eyJfc2QiOlsiRWg0ZV9paW5jVkdNTmhuSFF5WmFQWU1fektEUTZfclg4akx5TGRtemNDZyJdLCJfc2RfYWxnIjoic2hhLTI1NiIsImV4cCI6MTcwNTI4MDQwMCwiaWF0IjoxNzA1Mjc2ODAwLCJpZCI6InVybjp1bGlkOjAxSEcwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIiwiaXNzIjoiZGlkOndlYjpmaXh0dXJlLnRlc3QiLCJqdGkiOiJ1cm46dWxpZDowMUhHMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsInN1YiI6InN1YmplY3QtcmVmIiwidmN0IjoiaHR0cHM6Ly9maXh0dXJlLnRlc3QvY3JlZGVudGlhbHMvcmVnaXN0cnktd2l0bmVzcy92MSJ9.50Uj9azUJ9toDtYyu7wWK-bxtiUZxSXpUl8fLy2mSxaU1opAbva97c1CyD3b5k4Vg8ZrLEsJl_69_DBmUvfLAg~WyJEQ0N5aXRxTEtTVE5wMXZBUGtHVXhnIiwiY2xhaW1fYSIseyJzYXRpc2ZpZWQiOnRydWUsInZhbHVlIjoiZml4dHVyZSJ9XQ~
\ No newline at end of file
diff --git a/products/notary/tests/fixtures/sd_jwt_vc/wrong-vct.sd-jwt b/products/notary/tests/fixtures/sd_jwt_vc/wrong-vct.sd-jwt
deleted file mode 100644
index bd0bbf41e..000000000
--- a/products/notary/tests/fixtures/sd_jwt_vc/wrong-vct.sd-jwt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJFZERTQSIsImtpZCI6ImRpZDp3ZWI6Zml4dHVyZS50ZXN0I2tleS0xIiwidHlwIjoiZGMrc2Qtand0In0.eyJfc2QiOlsiWmtGc0dTYVhEYUdMOTkzY1VlVHVqazdkZnVvVU13Z0NsVXdXUUF6XzZpSSJdLCJfc2RfYWxnIjoic2hhLTI1NiIsImV4cCI6MTcwNTI4MDQwMCwiaWF0IjoxNzA1Mjc2ODAwLCJpZCI6InVybjp1bGlkOjAxSEcwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIiwiaXNzIjoiZGlkOndlYjpmaXh0dXJlLnRlc3QiLCJqdGkiOiJ1cm46dWxpZDowMUhHMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsInN1YiI6InN1YmplY3QtcmVmIiwidmN0IjoiaHR0cHM6Ly9maXh0dXJlLnRlc3QvY3JlZGVudGlhbHMvb3RoZXItcHJvZmlsZS92MSJ9.MeMwFVVZyarqFpHesuYQnVOQQsQeAwsy6z9lJ4HcOtNyLS8VBzbpnpNCJPEhobqPLpUKqi5mA48T9iNkc4DMAA~WyJfdWQ2Qng3Q0Q4dkFoUWpjX1MtUzJBIiwiY2xhaW1fYSIseyJzYXRpc2ZpZWQiOnRydWUsInZhbHVlIjoiZml4dHVyZSJ9XQ~
\ No newline at end of file
diff --git a/products/notary/tests/security_assurance_check_test.py b/products/notary/tests/security_assurance_check_test.py
deleted file mode 100644
index 233f7adc8..000000000
--- a/products/notary/tests/security_assurance_check_test.py
+++ /dev/null
@@ -1,601 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-import importlib.util
-import json
-import tempfile
-import unittest
-from pathlib import Path
-
-
-def load_module():
-    path = Path(__file__).resolve().parents[1] / "scripts" / "check_security_assurance.py"
-    spec = importlib.util.spec_from_file_location("check_security_assurance", path)
-    module = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(module)
-    return module
-
-
-class SecurityAssuranceCheckTest(unittest.TestCase):
-    def setUp(self):
-        self.module = load_module()
-        self.tmp = tempfile.TemporaryDirectory()
-        self.root = Path(self.tmp.name)
-        (self.root / "security").mkdir()
-        (self.root / "crates" / "registry-notary-server" / "src").mkdir(parents=True)
-        (self.root / "crates" / "registry-notary-server" / "tests").mkdir(parents=True)
-        (self.root / "crates" / "registry-notary-server" / "tests" / "standalone_http.rs").write_text("async fn scope_denied() {}\n")
-        (self.root / "crates" / "registry-notary-server" / "src" / "api.rs").write_text(
-            'use axum::{routing::get, Router};\n'
-            'pub fn router<S>() -> Router<S> { Router::new().route("/x", get(handler)) }\n'
-        )
-        (self.root / "Dockerfile").write_text("FROM scratch\n")
-        (self.root / "openapi").mkdir()
-        (self.root / "openapi" / "registry-notary.openapi.json").write_text(json.dumps({
-            "openapi": "3.0.3",
-            "paths": {"/x": {"get": {}}},
-        }))
-        self.old_root = self.module.ROOT
-        self.old_monorepo_root = self.module.MONOREPO_ROOT
-        self.old_security = self.module.SECURITY_DIR
-        self.module.ROOT = self.root
-        self.module.MONOREPO_ROOT = self.root
-        self.module.SECURITY_DIR = self.root / "security"
-
-    def tearDown(self):
-        self.module.ROOT = self.old_root
-        self.module.MONOREPO_ROOT = self.old_monorepo_root
-        self.module.SECURITY_DIR = self.old_security
-        self.tmp.cleanup()
-
-    def write_contracts(self, manifest_entry):
-        (self.root / "security" / "route-inventory.json").write_text(json.dumps({
-            "version": 1,
-            "service": "registry-notary",
-            "routes": [{
-                "listener": "public",
-                "path": "/x",
-                "methods": ["GET"],
-                "source": "crates/registry-notary-server/src/api.rs",
-            }],
-        }))
-        (self.root / "security" / "auth-none-allowlist.yml").write_text("allowed:\n")
-        (self.root / "security" / "exposure-manifest.json").write_text(json.dumps({
-            "version": 1,
-            "service": "registry-notary",
-            "endpoints": [manifest_entry],
-        }))
-
-    def entry(self, **overrides):
-        base = {
-            "service": "registry-notary",
-            "listener": "public",
-            "method": "GET",
-            "path": "/x",
-            "feature": None,
-            "audience": "external",
-            "auth": "api_key_or_oidc",
-            "scopes": ["evidence:metadata"],
-            "rate_limit": None,
-            "audit": "required",
-            "openapi": True,
-            "stability": "beta",
-            "data_classification": "metadata",
-            "notes": "test",
-            "source": "manual",
-            "enforcement_tests": [
-                "crates/registry-notary-server/tests/standalone_http.rs::scope_denied"
-            ],
-            "waiver": None,
-        }
-        base.update(overrides)
-        return base
-
-    def test_valid_contract_passes(self):
-        self.write_contracts(self.entry())
-        self.module.validate_manifest()
-
-    def test_posture_exposure_documents_admin_listener_boundary(self):
-        manifest = json.loads(
-            (Path(__file__).resolve().parents[1] / "security" / "exposure-manifest.json")
-            .read_text()
-        )
-        posture = next(
-            endpoint
-            for endpoint in manifest["endpoints"]
-            if endpoint["method"] == "GET" and endpoint["path"] == "/admin/v1/posture"
-        )
-
-        self.assertEqual(posture["listener"], "admin")
-        self.assertEqual(posture["audience"], "operator")
-        self.assertEqual(posture["scopes"], ["registry_notary:ops_read"])
-        self.assertIn("dedicated admin mode", posture["notes"])
-        self.assertIn("simple local shared mode", posture["notes"])
-
-    def test_missing_route_manifest_entry_fails(self):
-        self.write_contracts(self.entry(path="/other"))
-        with self.assertRaises(SystemExit):
-            self.module.validate_manifest()
-
-    def test_auth_none_requires_allowlist(self):
-        self.write_contracts(self.entry(auth="none", scopes=[], audit="optional", enforcement_tests=[]))
-        with self.assertRaises(SystemExit):
-            self.module.validate_manifest()
-
-    def test_auth_none_allowlist_rejects_stale_entries(self):
-        self.write_contracts(self.entry())
-        (self.root / "security" / "auth-none-allowlist.yml").write_text(
-            "allowed:\n"
-            "  - listener: public\n"
-            "    method: GET\n"
-            "    path: /x\n"
-            "    reason: stale\n"
-        )
-        with self.assertRaises(SystemExit):
-            self.module.validate_manifest()
-
-    def test_auth_none_allowlist_rejects_missing_required_fields(self):
-        self.write_contracts(self.entry())
-        (self.root / "security" / "auth-none-allowlist.yml").write_text(
-            "allowed:\n"
-            "  - listener: public\n"
-            "    method: GET\n"
-        )
-        with self.assertRaises(SystemExit):
-            self.module.load_allowlist(self.root / "security" / "auth-none-allowlist.yml")
-
-    def test_source_route_missing_from_inventory_fails(self):
-        self.write_contracts(self.entry())
-        (self.root / "security" / "route-inventory.json").write_text(json.dumps({
-            "version": 1,
-            "service": "registry-notary",
-            "routes": [],
-        }))
-        with self.assertRaises(SystemExit):
-            self.module.validate_manifest()
-
-    def test_stale_manifest_entry_fails(self):
-        self.write_contracts(self.entry(path="/stale"))
-        (self.root / "security" / "route-inventory.json").write_text(json.dumps({
-            "version": 1,
-            "service": "registry-notary",
-            "routes": [],
-        }))
-        with self.assertRaises(SystemExit):
-            self.module.validate_manifest()
-
-    def test_enforcement_reference_requires_test_symbol(self):
-        self.write_contracts(self.entry(enforcement_tests=[
-            "crates/registry-notary-server/tests/standalone_http.rs"
-        ]))
-        with self.assertRaises(SystemExit):
-            self.module.validate_manifest()
-
-    def test_openapi_coverage_accepts_catch_all_parameter_shape(self):
-        (self.root / "security" / "exposure-manifest.json").write_text(json.dumps({
-            "version": 1,
-            "service": "registry-notary",
-            "endpoints": [
-                self.entry(path="/credentials/{*vct_path}", method="GET", openapi=True)
-            ],
-        }))
-        (self.root / "openapi" / "registry-notary.openapi.json").write_text(json.dumps({
-            "openapi": "3.0.3",
-            "paths": {"/credentials/{vct_path}": {"get": {}, "x-registry-notary-catch-all": True}},
-        }))
-        self.module.check_openapi_manifest_coverage(self.root / "openapi" / "registry-notary.openapi.json")
-
-    def test_catch_all_inventory_route_without_extension_fails(self):
-        """Route inventory has {*vct_path} but spec path item lacks x-registry-notary-catch-all."""
-        (self.root / "security" / "exposure-manifest.json").write_text(json.dumps({
-            "version": 1,
-            "service": "registry-notary",
-            "endpoints": [
-                self.entry(path="/credentials/{*vct_path}", method="GET", openapi=True)
-            ],
-        }))
-        (self.root / "openapi" / "registry-notary.openapi.json").write_text(json.dumps({
-            "openapi": "3.0.3",
-            "paths": {"/credentials/{vct_path}": {"get": {}}},
-        }))
-        with self.assertRaises(SystemExit):
-            self.module.check_openapi_manifest_coverage(self.root / "openapi" / "registry-notary.openapi.json")
-
-    def test_single_segment_inventory_route_with_extension_fails(self):
-        """Route inventory has a plain {param} but spec path item has x-registry-notary-catch-all."""
-        (self.root / "security" / "exposure-manifest.json").write_text(json.dumps({
-            "version": 1,
-            "service": "registry-notary",
-            "endpoints": [
-                self.entry(path="/v1/claims/{claim_id}", method="GET", openapi=True)
-            ],
-        }))
-        (self.root / "openapi" / "registry-notary.openapi.json").write_text(json.dumps({
-            "openapi": "3.0.3",
-            "paths": {"/v1/claims/{claim_id}": {"get": {}, "x-registry-notary-catch-all": True}},
-        }))
-        with self.assertRaises(SystemExit):
-            self.module.check_openapi_manifest_coverage(self.root / "openapi" / "registry-notary.openapi.json")
-
-    def test_openapi_true_missing_operation_fails(self):
-        self.write_contracts(self.entry(openapi=True))
-        (self.root / "openapi" / "registry-notary.openapi.json").write_text(json.dumps({
-            "openapi": "3.0.3",
-            "paths": {},
-        }))
-        with self.assertRaises(SystemExit):
-            self.module.check_openapi_manifest_coverage(self.root / "openapi" / "registry-notary.openapi.json")
-
-    def test_openapi_paths_must_be_object(self):
-        self.write_contracts(self.entry(openapi=True))
-        (self.root / "openapi" / "registry-notary.openapi.json").write_text(json.dumps({
-            "openapi": "3.0.3",
-            "paths": [],
-        }))
-        with self.assertRaises(SystemExit):
-            self.module.check_openapi_manifest_coverage(self.root / "openapi" / "registry-notary.openapi.json")
-
-    def test_dockerfile_secret_check_covers_add_and_missing_file(self):
-        (self.root / "Dockerfile").write_text("ADD private.pem /app/private.pem\n")
-        with self.assertRaises(SystemExit):
-            self.module.check_dockerfile_secret_patterns()
-        (self.root / "Dockerfile").unlink()
-        with self.assertRaises(SystemExit):
-            self.module.check_dockerfile_secret_patterns()
-
-    def test_container_runtime_contract_accepts_debian13_and_rejects_vendor_module(self):
-        digest = "a" * 64
-        (self.root / "Dockerfile").write_text(
-            f"FROM rust:1.95-trixie@sha256:{digest} AS builder\n"
-            'ARG REGISTRY_NOTARY_FEATURES="registry-notary-cel,pkcs11"\n'
-            "RUN touch /registry-notary-cel-worker\n"
-            f"FROM gcr.io/distroless/cc-debian13:nonroot@sha256:{digest} AS runtime\n"
-            "COPY --from=builder --chown=65532:65532 /workspace/runtime-root/ /\n"
-            "COPY --from=builder /registry-notary-cel-worker /usr/local/bin/registry-notary-cel-worker\n"
-            "WORKDIR /var/lib/registry-notary\n"
-            'HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD ["/usr/local/bin/registry-notary", "healthcheck"]\n'
-            'ENTRYPOINT ["/usr/local/bin/registry-notary"]\n'
-        )
-        self.module.check_container_runtime_contract()
-
-        with (self.root / "Dockerfile").open("a") as dockerfile:
-            dockerfile.write("COPY vendor-pkcs11-module.so /usr/lib/module.so\n")
-        with self.assertRaises(SystemExit):
-            self.module.check_container_runtime_contract()
-
-    def test_container_runtime_contract_rejects_unpinned_runtime(self):
-        (self.root / "Dockerfile").write_text(
-            'ARG REGISTRY_NOTARY_FEATURES="registry-notary-cel,pkcs11"\n'
-            "RUN touch /registry-notary-cel-worker\n"
-            "FROM gcr.io/distroless/cc-debian13:nonroot AS runtime\n"
-            "COPY --from=builder --chown=65532:65532 /workspace/runtime-root/ /\n"
-            "WORKDIR /var/lib/registry-notary\n"
-            'HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD ["/usr/local/bin/registry-notary", "healthcheck"]\n'
-            'ENTRYPOINT ["/usr/local/bin/registry-notary"]\n'
-        )
-        with self.assertRaises(SystemExit):
-            self.module.check_container_runtime_contract()
-
-    def write_route_inventory(self):
-        (self.root / "security" / "route-inventory.json").write_text(json.dumps({
-            "version": 1,
-            "service": "registry-notary",
-            "routes": [{
-                "listener": "public",
-                "path": "/x",
-                "methods": ["GET"],
-                "source": "crates/registry-notary-server/src/api.rs",
-            }],
-        }))
-
-    def test_route_sources_ignores_path_included_external_test_module(self):
-        self.write_route_inventory()
-        src = self.root / "crates" / "registry-notary-server" / "src"
-        (src / "healthcheck.rs").write_text(
-            "pub fn run() {}\n"
-            "#[cfg(test)]\n"
-            '#[path = "healthcheck/tests.rs"]\n'
-            "mod tests;\n"
-        )
-        (src / "healthcheck").mkdir()
-        (src / "healthcheck" / "tests.rs").write_text(
-            'fn mock() { Router::new().route("/test-only", get(handler)); }\n'
-        )
-
-        self.module.validate_route_sources()
-
-    def test_route_sources_ignores_nested_test_children(self):
-        self.write_route_inventory()
-        src = self.root / "crates" / "registry-notary-server" / "src"
-        (src / "widget.rs").write_text("#[cfg(test)]\nmod tests;\n")
-        (src / "widget" / "tests").mkdir(parents=True)
-        (src / "widget" / "tests" / "mod.rs").write_text("mod admin;\n")
-        (src / "widget" / "tests" / "admin.rs").write_text(
-            'fn mock() { Router::new().route("/test-only", get(handler)); }\n'
-        )
-
-        self.module.validate_route_sources()
-
-    def test_route_sources_ignores_transitive_include_shards(self):
-        self.write_route_inventory()
-        src = self.root / "crates" / "registry-notary-server" / "src"
-        (src / "runtime.rs").write_text(
-            "#[cfg(test)]\n"
-            "mod tests {\n"
-            '    include!("runtime/tests/first.inc");\n'
-            "}\n"
-        )
-        (src / "runtime" / "tests").mkdir(parents=True)
-        (src / "runtime" / "tests" / "first.inc").write_text(
-            'include!("second.inc");\n'
-        )
-        (src / "runtime" / "tests" / "second.inc").write_text(
-            'fn mock() { Router::new().route("/test-only", get(handler)); }\n'
-        )
-
-        self.module.validate_route_sources()
-
-    def test_route_sources_retains_file_with_production_owner(self):
-        self.write_route_inventory()
-        src = self.root / "crates" / "registry-notary-server" / "src"
-        (src / "owner.rs").write_text(
-            "mod shared;\n"
-            "#[cfg(test)]\n"
-            '#[path = "owner/shared.rs"]\n'
-            "mod shared_test;\n"
-        )
-        (src / "owner").mkdir()
-        (src / "owner" / "shared.rs").write_text(
-            'fn production() { Router::new().route("/production", get(handler)); }\n'
-        )
-
-        with self.assertRaises(SystemExit):
-            self.module.validate_route_sources()
-
-    def test_string_literal_cannot_spoof_test_only_ownership(self):
-        self.write_route_inventory()
-        src = self.root / "crates" / "registry-notary-server" / "src"
-        (src / "spoof.rs").write_text(
-            'const SPOOF: &str = "#[cfg(test)] mod hidden;";\n'
-        )
-        (src / "spoof" / "hidden.rs").parent.mkdir()
-        (src / "spoof" / "hidden.rs").write_text(
-            'fn production() { Router::new().route("/production", get(handler)); }\n'
-        )
-
-        with self.assertRaises(SystemExit):
-            self.module.validate_route_sources()
-
-    def test_inline_test_module_does_not_hide_later_production_route(self):
-        self.write_route_inventory()
-        src = self.root / "crates" / "registry-notary-server" / "src"
-        (src / "mixed.rs").write_text(
-            "#[cfg(test)]\n"
-            "mod tests {\n"
-            '    fn mock() { Router::new().route("/test-only", get(handler)); }\n'
-            "}\n"
-            'fn production() { Router::new().route("/production", get(handler)); }\n'
-        )
-
-        with self.assertRaises(SystemExit):
-            self.module.validate_route_sources()
-
-    def test_route_sources_fail_closed_on_unresolved_test_module(self):
-        self.write_route_inventory()
-        src = self.root / "crates" / "registry-notary-server" / "src"
-        (src / "missing.rs").write_text("#[cfg(test)]\nmod absent;\n")
-
-        with self.assertRaises(SystemExit):
-            self.module.validate_route_sources()
-
-    def test_route_sources_reject_path_escape(self):
-        self.write_route_inventory()
-        src = self.root / "crates" / "registry-notary-server" / "src"
-        outside = self.root / "crates" / "outside.rs"
-        outside.write_text("fn helper() {}\n")
-        (src / "escape.rs").write_text(
-            "#[cfg(test)]\n"
-            '#[path = "../../outside.rs"]\n'
-            "mod tests;\n"
-        )
-
-        with self.assertRaises(SystemExit):
-            self.module.validate_route_sources()
-
-    def test_route_sources_reject_symlinked_include(self):
-        self.write_route_inventory()
-        src = self.root / "crates" / "registry-notary-server" / "src"
-        outside = self.root / "outside.inc"
-        outside.write_text("fn helper() {}\n")
-        (src / "linked.inc").symlink_to(outside)
-        (src / "symlink.rs").write_text(
-            "#[cfg(test)]\n"
-            "mod tests {\n"
-            '    include!("linked.inc");\n'
-            "}\n"
-        )
-
-        with self.assertRaises(SystemExit):
-            self.module.validate_route_sources()
-
-    def test_route_sources_bounds_test_module_recursion(self):
-        self.write_route_inventory()
-        src = self.root / "crates" / "registry-notary-server" / "src"
-        (src / "bounded.rs").write_text("#[cfg(test)]\nmod tests;\n")
-        (src / "bounded" / "tests").mkdir(parents=True)
-        (src / "bounded" / "tests" / "mod.rs").write_text("mod child;\n")
-        (src / "bounded" / "tests" / "child.rs").write_text("fn helper() {}\n")
-        old_depth = self.module.MAX_MODULE_DEPTH
-        self.module.MAX_MODULE_DEPTH = 1
-        try:
-            with self.assertRaises(SystemExit):
-                self.module.validate_route_sources()
-        finally:
-            self.module.MAX_MODULE_DEPTH = old_depth
-
-    def test_cfg_ownership_requires_test_on_every_enabled_branch(self):
-        self.assertTrue(self.module.cfg_requires_test("test"))
-        self.assertTrue(self.module.cfg_requires_test("all(test, unix)"))
-        self.assertTrue(self.module.cfg_requires_test("any(test, all(test, unix))"))
-        self.assertFalse(self.module.cfg_requires_test('any(test, feature = "dev")'))
-        self.assertFalse(self.module.cfg_requires_test("not(test)"))
-
-    def assert_inert_route_is_ignored(self, inert_source):
-        source = (
-            f"{inert_source}\n"
-            "fn executable_router() {\n"
-            '    Router::new().route("/executable", get(handler));\n'
-            "}\n"
-        )
-        self.assertEqual(
-            self.module.extract_axum_routes(source), {("/executable", "GET")}
-        )
-
-    def test_route_extraction_ignores_raw_string_text(self):
-        self.assert_inert_route_is_ignored(
-            'const DOC: &str = r#"Router::new().route("/raw", get(handler))"#;'
-        )
-
-    def test_route_extraction_ignores_seventeen_hash_raw_string(self):
-        hashes = "#" * 17
-        self.assert_inert_route_is_ignored(
-            f'const DOC: &str = r{hashes}"'
-            'Router::new().route("/raw-17", get(handler))'
-            f'"{hashes};'
-        )
-
-    def test_route_extraction_ignores_large_hash_raw_string(self):
-        hashes = "#" * 257
-        self.assert_inert_route_is_ignored(
-            f'const DOC: &str = r{hashes}"'
-            'Router::new().route("/raw-large", get(handler))'
-            f'"{hashes};'
-        )
-
-    def test_route_extraction_ignores_unterminated_large_hash_raw_string(self):
-        hashes = "#" * 257
-        source = (
-            "fn executable_router() {\n"
-            '    Router::new().route("/executable", get(handler));\n'
-            "}\n"
-            f'const DOC: &str = r{hashes}"'
-            'Router::new().route("/unterminated", post(handler));'
-        )
-        self.assertEqual(
-            self.module.extract_axum_routes(source), {("/executable", "GET")}
-        )
-
-    def test_route_extraction_ignores_ordinary_string_text(self):
-        self.assert_inert_route_is_ignored(
-            'const DOC: &str = "Router::new().route(\\"/ordinary\\", get(handler))";'
-        )
-
-    def test_route_extraction_ignores_block_comment_text(self):
-        self.assert_inert_route_is_ignored(
-            '/* Router::new().route("/block-comment", get(handler)); */'
-        )
-
-    def test_route_extraction_ignores_standalone_line_comment_text(self):
-        self.assert_inert_route_is_ignored(
-            '// Router::new().route("/line-comment", get(handler));'
-        )
-
-    def test_route_extraction_ignores_trailing_inline_comment_text(self):
-        self.assert_inert_route_is_ignored(
-            "fn documented_router() {\n"
-            "    let _router = Router::new(); "
-            '// .route("/trailing-comment", get(handler))\n'
-            "}"
-        )
-
-    def test_route_extraction_ignores_method_names_inside_strings(self):
-        source = '''
-fn router() {
-    Router::new()
-        .route("/post", post(handler).layer(Extension("get(")))
-        .route("/get", get(handler).layer(Extension("post(")));
-}
-'''
-        self.assertEqual(
-            self.module.extract_axum_routes(source),
-            {("/post", "POST"), ("/get", "GET")},
-        )
-
-    def test_route_masking_large_input_does_not_match_allocated_suffixes(self):
-        hashes = "#" * 257
-        source = (
-            ("fn filler() {}\n" * 20_000)
-            + f'const DOC: &str = r{hashes}"'
-            + 'Router::new().route("/inert", get(handler))'
-            + f'"{hashes};\n'
-            + "fn executable_router() {\n"
-            + '    Router::new().route("/executable", post(handler));\n'
-            + "}\n"
-        )
-        original_match = self.module.re.match
-        self.module.re.match = lambda *_args, **_kwargs: self.fail(
-            "mask_rust must not regex-match allocated source suffixes"
-        )
-        try:
-            self.assertEqual(
-                self.module.extract_axum_routes(source), {("/executable", "POST")}
-            )
-        finally:
-            self.module.re.match = original_match
-
-    def test_extracts_literal_const_format_and_chained_methods(self):
-        source = '''
-use axum::{routing::{get, post}, Router};
-const BASE: &str = "/credentials";
-pub fn router<S>() -> Router<S> {
-    Router::new()
-        .route("/literal", get(a).head(a_head))
-        .route(BASE, get(b))
-        .route(&format!("{BASE}/{{*vct_path}}"), get(c).post(d))
-}
-
-#[cfg(test)]
-mod security_tests {
-    fn helper() {
-        Router::new().route("/test-only", get(test));
-    }
-}
-'''
-        self.assertEqual(
-            self.module.extract_axum_routes(source),
-            {
-                ("/literal", "GET"),
-                ("/literal", "HEAD"),
-                ("/credentials", "GET"),
-                ("/credentials/{*vct_path}", "GET"),
-                ("/credentials/{*vct_path}", "POST"),
-            },
-        )
-
-    def test_route_source_scan_ignores_test_only_router_modules(self):
-        self.write_contracts(self.entry())
-        (
-            self.root
-            / "crates"
-            / "registry-notary-server"
-            / "src"
-            / "relay_client.rs"
-        ).write_text("#[cfg(test)]\nmod tests;\n")
-        test_module = (
-            self.root
-            / "crates"
-            / "registry-notary-server"
-            / "src"
-            / "relay_client"
-            / "tests.rs"
-        )
-        test_module.parent.mkdir(parents=True)
-        test_module.write_text(
-            'use axum::{routing::post, Router};\n'
-            'fn fake_upstream() -> Router { '
-            'Router::new().route("/relay-only", post(handler)) }\n'
-        )
-
-        self.module.validate_route_sources()
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/products/notary/xtask/Cargo.toml b/products/notary/xtask/Cargo.toml
deleted file mode 100644
index e1ec1b44c..000000000
--- a/products/notary/xtask/Cargo.toml
+++ /dev/null
@@ -1,17 +0,0 @@
-[package]
-name = "xtask"
-version = "0.1.0"
-edition = "2021"
-license = "Apache-2.0"
-# Internal workspace tooling; not published.
-publish = false
-
-[lints]
-workspace = true
-
-[dependencies]
-base64 = { version = "0.22" }
-registry-platform-crypto = { workspace = true }
-registry-platform-sdjwt = { workspace = true }
-serde_json = { version = "1" }
-tokio = { version = "1", features = ["rt-multi-thread", "macros"] }
diff --git a/products/notary/xtask/src/main.rs b/products/notary/xtask/src/main.rs
deleted file mode 100644
index 4d0f9298c..000000000
--- a/products/notary/xtask/src/main.rs
+++ /dev/null
@@ -1,495 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//! Fixture generator for the SD-JWT VC verifier compatibility harness.
-//!
-//! Run with:
-//!   cargo run -p xtask -- gen-sd-jwt-vc-fixtures
-//!   cargo run -p xtask -- gen-oid4vci-algorithm-fixtures
-//!
-//! Writes synthetic fixtures to tests/fixtures/sd_jwt_vc/.
-//! Keys and timestamps are fixed so the JWTs are reproducible, but
-//! SdJwtIssuer generates random disclosure salts on each call, so re-running
-//! this command will produce byte-for-byte different fixture files even though
-//! the decoded credential content is functionally equivalent. Commit only when
-//! the fixture content has materially changed.
-//! All key material is throwaway and clearly marked as test-only.
-//! Do not use any of the keys or tokens produced here outside of tests.
-
-use std::collections::BTreeMap;
-use std::path::PathBuf;
-
-use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-use base64::Engine;
-use registry_platform_crypto::{did_jwk_from_public_jwk, sign, PrivateJwk};
-use registry_platform_sdjwt::{Disclosure, HolderConfirmation, SdJwtIssuanceInput, SdJwtIssuer};
-use serde_json::{json, Value};
-
-// Deterministic synthetic key pairs. Generated once and hardcoded so fixtures
-// are fully reproducible without a random source at generation time. These keys
-// are test-only material and carry no trust outside of the fixture set.
-const ISSUER_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"did:web:fixture.test#key-1"}"#;
-const ES256_ISSUER_JWK: &str = r#"{"kty":"EC","crv":"P-256","d":"MInq88dvxx-e1-MEfmdes4I6Gt2QbsKoEmYyk2j0Oj4","x":"3kpzAK6fK6xyfqbdp0HvfZCqfgz7MajMviKyM6bsNE4","y":"GkSdSn8xqge52rp9Sv-4qPaw1Q9TJ2eMUyY22flavLU","alg":"ES256","kid":"did:web:fixture.test#p256-key-1"}"#;
-const HOLDER_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"f4QIxnAyRWzhuBOmNRgvBTE56mWePdsPL0mvCtl8Gys","x":"pv4e_hXHBLN27rcs6VDFV1ED0TiU8M3xy9vsuWFEsec","alg":"EdDSA","kid":"did:web:fixture.test#holder-key-1"}"#;
-
-const ISSUER: &str = "did:web:fixture.test";
-const VCT: &str = "https://fixture.test/credentials/registry-witness/v1";
-// Fixed timestamp: 2024-01-15T00:00:00Z. Far enough in the future that the
-// harness can override the verifier clock to match.
-const IAT: i64 = 1_705_276_800;
-const EXP: i64 = 1_705_276_800 + 3600;
-const PROOF_AUDIENCE: &str = "https://fixture.test/oid4vci";
-const PROOF_NONCE: &str = "fixture-transaction-nonce";
-
-#[tokio::main]
-async fn main() {
-    let args: Vec<String> = std::env::args().collect();
-    let cmd = args.get(1).map(String::as_str).unwrap_or("");
-    match cmd {
-        "gen-sd-jwt-vc-fixtures" => generate_fixtures().await,
-        "gen-oid4vci-algorithm-fixtures" => generate_algorithm_fixtures().await,
-        _ => {
-            eprintln!(
-                "usage: cargo run -p xtask -- \
-                 <gen-sd-jwt-vc-fixtures|gen-oid4vci-algorithm-fixtures>"
-            );
-            std::process::exit(1);
-        }
-    }
-}
-
-async fn generate_fixtures() {
-    let workspace_root = workspace_root();
-    let fixture_dir = workspace_root.join("tests/fixtures/sd_jwt_vc");
-    std::fs::create_dir_all(&fixture_dir).expect("fixture dir created");
-
-    let issuer_jwk = PrivateJwk::parse(ISSUER_JWK).expect("issuer jwk parses");
-    let es256_issuer_jwk = PrivateJwk::parse(ES256_ISSUER_JWK).expect("ES256 issuer jwk parses");
-    let holder_jwk = PrivateJwk::parse(HOLDER_JWK).expect("holder jwk parses");
-    let issuer = SdJwtIssuer::from_jwk(issuer_jwk.clone()).expect("issuer builds");
-    let holder_did = did_jwk_from_public_jwk(&holder_jwk.public()).expect("holder did encodes");
-
-    write_algorithm_public_metadata(&fixture_dir, &issuer_jwk, &es256_issuer_jwk, &holder_jwk);
-
-    // 1. Valid credential (positive fixture).
-    let valid = issue(
-        &issuer,
-        ISSUER,
-        IAT,
-        EXP,
-        None,
-        &["claim_a", "claim_b"],
-        None,
-    )
-    .await;
-    write_fixture(&fixture_dir, "valid.sd-jwt", &valid);
-
-    // 2. Valid holder-bound credential (positive fixture).
-    let valid_holder_bound = issue(
-        &issuer,
-        ISSUER,
-        IAT,
-        EXP,
-        Some((&holder_did, &holder_jwk)),
-        &["claim_a"],
-        None,
-    )
-    .await;
-    write_fixture(
-        &fixture_dir,
-        "valid-holder-bound.sd-jwt",
-        &valid_holder_bound,
-    );
-
-    // Write holder JWK (public) for the harness.
-    let holder_public =
-        serde_json::to_value(holder_jwk.public()).expect("holder public serialises");
-    write_fixture(
-        &fixture_dir,
-        "holder-public-jwk.json",
-        &serde_json::to_string_pretty(&holder_public).expect("holder public serialises"),
-    );
-
-    // 3. Wrong vct: issued with a different vct, harness checks vct_mismatch.
-    let wrong_vct = issue(
-        &issuer,
-        ISSUER,
-        IAT,
-        EXP,
-        None,
-        &["claim_a"],
-        Some("https://fixture.test/credentials/other-profile/v1"),
-    )
-    .await;
-    write_fixture(&fixture_dir, "wrong-vct.sd-jwt", &wrong_vct);
-
-    // 4. Expired credential: exp is in the past relative to iat.
-    let expired = issue(
-        &issuer,
-        ISSUER,
-        IAT - 7200,
-        IAT - 3600,
-        None,
-        &["claim_a"],
-        None,
-    )
-    .await;
-    write_fixture(&fixture_dir, "expired.sd-jwt", &expired);
-
-    // 5. Unsupported alg: rewrite the header alg to RS256 (breaks signature
-    //    and triggers algorithm.disallowed before the sig check).
-    let valid_raw = issue(&issuer, ISSUER, IAT, EXP, None, &["claim_a"], None).await;
-    let bad_alg = tamper_header(&valid_raw, |h| {
-        h["alg"] = json!("RS256");
-    });
-    write_fixture(&fixture_dir, "unsupported-alg.sd-jwt", &bad_alg);
-
-    // 6. Wrong kid: rewrite the header kid to a key that does not exist in JWKS.
-    let bad_kid = tamper_header(&valid_raw, |h| {
-        h["kid"] = json!("did:web:fixture.test#missing");
-    });
-    write_fixture(&fixture_dir, "wrong-kid.sd-jwt", &bad_kid);
-
-    // 7. Missing cnf: use a credential issued without holder binding, then
-    //    verify with RequiredKid — harness expects holder_binding.required.
-    //    The file itself is the same as valid.sd-jwt; the harness applies the
-    //    policy. Write a copy so the intent is explicit.
-    write_fixture(
-        &fixture_dir,
-        "missing-cnf-when-binding-required.sd-jwt",
-        &valid,
-    );
-
-    // 8. Malformed disclosure: corrupt the last disclosure segment so that
-    //    base64url decoding fails. The verifier maps this parse failure to
-    //    disclosure.digest_mismatch (the hash-comparison branch is never
-    //    reached because the disclosure cannot even be decoded).
-    let malformed_disc = tamper_last_disclosure(&valid_raw);
-    write_fixture(&fixture_dir, "malformed-disclosure.sd-jwt", &malformed_disc);
-
-    // 9. Tampered disclosure: the disclosure is valid base64url-encoded JSON
-    //    with three elements (salt, claim name, value), so it passes the parse
-    //    checks, but the claim value has been altered so its SHA-256 digest is
-    //    not present in the payload _sd array. This exercises the actual
-    //    hash-comparison branch in the verifier, which is distinct from the
-    //    parse-failure path covered by malformed-disclosure.sd-jwt.
-    let tampered_disc = tamper_disclosure_value(&valid_raw);
-    write_fixture(&fixture_dir, "tampered-disclosure.sd-jwt", &tampered_disc);
-
-    // 10. Holder proof mismatch: valid holder-bound credential but the
-    //     key-binding JWT is signed by the wrong key (the issuer key instead of
-    //     the holder key). The harness expects holder_binding.proof_invalid.
-    let bad_kb = format!(
-        "{valid_holder_bound}{}",
-        bad_key_binding_jwt(&issuer_jwk, IAT)
-    );
-    write_fixture(&fixture_dir, "holder-proof-mismatch.sd-jwt", &bad_kb);
-
-    generate_algorithm_fixtures().await;
-    println!("fixtures written to {}", fixture_dir.display());
-}
-
-/// Generate only the deterministic fixtures for the narrowed Registry Stack
-/// 1.0 algorithm profile. Keeping this command separate avoids rewriting the
-/// older disclosure fixtures, whose random salts are intentionally not stable.
-async fn generate_algorithm_fixtures() {
-    let fixture_dir = workspace_root().join("tests/fixtures/sd_jwt_vc");
-    std::fs::create_dir_all(&fixture_dir).expect("fixture dir created");
-
-    let es256_issuer_jwk = PrivateJwk::parse(ES256_ISSUER_JWK).expect("ES256 issuer jwk parses");
-    let es256_issuer =
-        SdJwtIssuer::from_jwk(es256_issuer_jwk.clone()).expect("ES256 issuer builds");
-    let issuer_jwk = PrivateJwk::parse(ISSUER_JWK).expect("EdDSA issuer jwk parses");
-    let holder_jwk = PrivateJwk::parse(HOLDER_JWK).expect("holder jwk parses");
-    let holder_did = did_jwk_from_public_jwk(&holder_jwk.public()).expect("holder did encodes");
-
-    write_algorithm_public_metadata(&fixture_dir, &issuer_jwk, &es256_issuer_jwk, &holder_jwk);
-
-    // These private keys are synthetic test material already embedded in this
-    // generator. Publishing them as fixtures lets the transaction harness
-    // exercise the same exact key pairs without duplicating constants.
-    for (name, raw) in [
-        ("issuer-eddsa-private.test.jwk.json", ISSUER_JWK),
-        ("issuer-es256-private.test.jwk.json", ES256_ISSUER_JWK),
-        ("holder-eddsa-private.test.jwk.json", HOLDER_JWK),
-    ] {
-        let key: Value = serde_json::from_str(raw).expect("private fixture JWK parses as JSON");
-        write_fixture(
-            &fixture_dir,
-            name,
-            &serde_json::to_string_pretty(&key).expect("private fixture JWK serialises"),
-        );
-    }
-
-    // No selective disclosures are needed for this fixture. That keeps the
-    // compact credential byte-for-byte reproducible while still exercising
-    // issuer signing, cnf holder binding, and verifier algorithm dispatch.
-    let valid_es256 = issue(
-        &es256_issuer,
-        ISSUER,
-        IAT,
-        EXP,
-        Some((&holder_did, &holder_jwk)),
-        &[],
-        None,
-    )
-    .await;
-    write_fixture(&fixture_dir, "valid-es256.sd-jwt", &valid_es256);
-
-    let holder_proof = oid4vci_proof_jwt(&holder_jwk, "EdDSA", &holder_did);
-    write_fixture(&fixture_dir, "holder-proof-eddsa.jwt", &holder_proof);
-
-    let es256_holder_jwk =
-        PrivateJwk::parse(ES256_ISSUER_JWK).expect("ES256 holder fixture key parses");
-    // The platform intentionally refuses to construct an ES256 holder DID.
-    // Encode the synthetic public key directly so the negative fixture proves
-    // that the credential-endpoint validator rejects this out-of-profile proof.
-    let es256_holder_did = format!(
-        "did:jwk:{}",
-        URL_SAFE_NO_PAD.encode(
-            serde_json::to_vec(&es256_holder_jwk.public())
-                .expect("ES256 holder public JWK serialises")
-        )
-    );
-    let unsupported_holder_proof = oid4vci_proof_jwt(&es256_holder_jwk, "ES256", &es256_holder_did);
-    write_fixture(
-        &fixture_dir,
-        "holder-proof-es256-unsupported.jwt",
-        &unsupported_holder_proof,
-    );
-
-    let profile = json!({
-        "credential_configurations": {
-            "fixture_eddsa": {
-                "credential_signing_alg_values_supported": ["EdDSA"],
-                "proof_signing_alg_values_supported": ["EdDSA"],
-                "cryptographic_binding_methods_supported": ["did:jwk"],
-                "fixture": "valid-holder-bound.sd-jwt",
-                "private_jwk_fixture": "issuer-eddsa-private.test.jwk.json"
-            },
-            "fixture_es256": {
-                "credential_signing_alg_values_supported": ["ES256"],
-                "proof_signing_alg_values_supported": ["EdDSA"],
-                "cryptographic_binding_methods_supported": ["did:jwk"],
-                "fixture": "valid-es256.sd-jwt",
-                "private_jwk_fixture": "issuer-es256-private.test.jwk.json"
-            }
-        },
-        "holder_proof": {
-            "signing_alg_values_supported": ["EdDSA"],
-            "cryptographic_binding_methods_supported": ["did:jwk"],
-            "fixture": "holder-proof-eddsa.jwt",
-            "private_jwk_fixture": "holder-eddsa-private.test.jwk.json",
-            "unsupported_fixture": "holder-proof-es256-unsupported.jwt"
-        },
-        "proof_audience": PROOF_AUDIENCE,
-        "proof_nonce": PROOF_NONCE,
-        "note": "All key and token material is synthetic test-only material. Do not use outside tests."
-    });
-    write_fixture(
-        &fixture_dir,
-        "algorithm-profile.json",
-        &serde_json::to_string_pretty(&profile).expect("algorithm profile serialises"),
-    );
-
-    println!("algorithm fixtures written to {}", fixture_dir.display());
-}
-
-async fn issue(
-    issuer: &SdJwtIssuer,
-    iss: &str,
-    iat: i64,
-    exp: i64,
-    holder: Option<(&str, &PrivateJwk)>,
-    claim_names: &[&str],
-    vct_override: Option<&str>,
-) -> String {
-    let vct = vct_override.unwrap_or(VCT).to_string();
-    let cnf = holder.map(|(kid, jwk)| HolderConfirmation {
-        jwk: jwk.public(),
-        kid: Some(kid.to_string()),
-    });
-    let input = SdJwtIssuanceInput {
-        iss: iss.to_string(),
-        sub_ref: holder
-            .map(|(kid, _)| kid.to_string())
-            .unwrap_or_else(|| "subject-ref".to_string()),
-        credential_id: Some("urn:ulid:01HG0000000000000000000000".to_string()),
-        iat,
-        exp,
-        vct,
-        status: None,
-        public_claims: BTreeMap::new(),
-        cnf,
-        disclosures: claim_names
-            .iter()
-            .map(|name| Disclosure {
-                name: name.to_string(),
-                value: json!({"satisfied": true, "value": "fixture"}),
-            })
-            .collect(),
-    };
-    issuer.issue(input).await.expect("fixture issues").jwt
-}
-
-fn tamper_header(compact: &str, mutate: impl FnOnce(&mut Value)) -> String {
-    let (jwt, suffix) = compact
-        .split_once('~')
-        .expect("sd-jwt has disclosure separator");
-    let mut parts: Vec<&str> = jwt.split('.').collect();
-    let mut header: Value = serde_json::from_slice(
-        &URL_SAFE_NO_PAD
-            .decode(parts[0])
-            .expect("header base64 decodes"),
-    )
-    .expect("header json decodes");
-    mutate(&mut header);
-    let new_header =
-        URL_SAFE_NO_PAD.encode(serde_json::to_vec(&header).expect("header serialises"));
-    let new_header_owned = new_header.clone();
-    parts[0] = &new_header_owned;
-    // We need owned strings here since parts holds &str into jwt.
-    let new_jwt = format!("{}.{}.{}", new_header, parts[1], parts[2]);
-    format!("{new_jwt}~{suffix}")
-}
-
-fn tamper_last_disclosure(compact: &str) -> String {
-    let mut parts: Vec<&str> = compact.split('~').collect();
-    // Find last non-empty disclosure part (before trailing empty from trailing ~)
-    let last_disc_idx = parts
-        .iter()
-        .enumerate()
-        .filter(|(_, p)| !p.is_empty() && !p.contains('.'))
-        .map(|(i, _)| i)
-        .next_back()
-        .expect("has disclosure");
-    let mut disc = parts[last_disc_idx].to_string();
-    // Flip the last character to corrupt the base64.
-    let replacement = if disc.ends_with('A') { "B" } else { "A" };
-    disc.pop();
-    disc.push_str(replacement);
-    let disc_owned = disc.clone();
-    parts[last_disc_idx] = &disc_owned;
-    parts.join("~")
-}
-
-/// Re-encode the first disclosure in an SD-JWT compact form with an altered
-/// claim value. The resulting disclosure is valid base64url-encoded JSON with
-/// three elements, so the verifier passes the parse checks and reaches the
-/// hash-comparison step, where it discovers the disclosure digest is not in
-/// the payload _sd array and returns disclosure.digest_mismatch.
-fn tamper_disclosure_value(compact: &str) -> String {
-    let parts: Vec<&str> = compact.split('~').collect();
-    // parts[0] is the issuer JWT; parts[1..] are disclosures (last may be empty).
-    let first_disc_raw = parts
-        .iter()
-        .skip(1)
-        .find(|p| !p.is_empty() && !p.contains('.'))
-        .expect("at least one disclosure");
-
-    // Decode, mutate the value (third element), and re-encode.
-    let decoded = URL_SAFE_NO_PAD
-        .decode(first_disc_raw)
-        .expect("disclosure base64 decodes");
-    let mut arr: Vec<serde_json::Value> =
-        serde_json::from_slice(&decoded).expect("disclosure json decodes");
-    // arr[0] = salt (keep), arr[1] = claim name (keep), arr[2] = value (tamper).
-    arr[2] = json!({"satisfied": false, "value": "tampered"});
-    let new_bytes = serde_json::to_vec(&arr).expect("tampered disclosure serialises");
-    let new_disc = URL_SAFE_NO_PAD.encode(&new_bytes);
-
-    // Rebuild the compact form with the tampered first disclosure.
-    let mut new_parts: Vec<String> = parts.iter().map(|p| p.to_string()).collect();
-    for p in new_parts.iter_mut().skip(1) {
-        if !p.is_empty() && !p.contains('.') {
-            *p = new_disc.clone();
-            break;
-        }
-    }
-    new_parts.join("~")
-}
-
-/// Produce a key-binding JWT signed with the wrong key (issuer key instead of
-/// holder key). The harness verifies this fails with holder_binding.proof_invalid.
-fn bad_key_binding_jwt(wrong_key: &PrivateJwk, iat: i64) -> String {
-    let header = URL_SAFE_NO_PAD.encode(br#"{"alg":"EdDSA","typ":"kb+jwt"}"#);
-    let payload_json = format!(r#"{{"iat":{iat}}}"#);
-    let payload = URL_SAFE_NO_PAD.encode(payload_json.as_bytes());
-    let signing_input = format!("{header}.{payload}");
-    let signature = sign(signing_input.as_bytes(), wrong_key).expect("bad kb jwt signs");
-    format!("{signing_input}.{}", URL_SAFE_NO_PAD.encode(signature))
-}
-
-fn oid4vci_proof_jwt(key: &PrivateJwk, alg: &str, holder_did: &str) -> String {
-    let header = URL_SAFE_NO_PAD.encode(
-        serde_json::to_vec(&json!({
-            "alg": alg,
-            "typ": "openid4vci-proof+jwt",
-            "kid": format!("{holder_did}#0")
-        }))
-        .expect("proof header serialises"),
-    );
-    let payload = URL_SAFE_NO_PAD.encode(
-        serde_json::to_vec(&json!({
-            "aud": PROOF_AUDIENCE,
-            "iat": IAT,
-            "exp": IAT + 300,
-            "nonce": PROOF_NONCE
-        }))
-        .expect("proof payload serialises"),
-    );
-    let signing_input = format!("{header}.{payload}");
-    let signature = sign(signing_input.as_bytes(), key).expect("proof signs");
-    format!("{signing_input}.{}", URL_SAFE_NO_PAD.encode(signature))
-}
-
-fn write_algorithm_public_metadata(
-    fixture_dir: &std::path::Path,
-    issuer_jwk: &PrivateJwk,
-    es256_issuer_jwk: &PrivateJwk,
-    holder_jwk: &PrivateJwk,
-) {
-    // Write the public issuer JWKS so the harness can load it without
-    // embedding raw key material.
-    let public_jwk = serde_json::to_value(issuer_jwk.public()).expect("public jwk serialises");
-    let es256_public_jwk =
-        serde_json::to_value(es256_issuer_jwk.public()).expect("ES256 public jwk serialises");
-    let jwks = json!({ "keys": [public_jwk, es256_public_jwk] });
-    write_fixture(
-        fixture_dir,
-        "issuer-jwks.json",
-        &serde_json::to_string_pretty(&jwks).expect("jwks serialises"),
-    );
-
-    // Write fixture metadata so the harness knows constants without embedding
-    // them as Rust literals.
-    let holder_did = did_jwk_from_public_jwk(&holder_jwk.public()).expect("holder did encodes");
-    let meta = json!({
-        "issuer": ISSUER,
-        "vct": VCT,
-        "iat": IAT,
-        "exp": EXP,
-        "holder_did": holder_did,
-        "key_id": "did:web:fixture.test#key-1",
-        "es256_key_id": "did:web:fixture.test#p256-key-1",
-        "note": "All key material in this directory is synthetic test-only material. Do not use outside tests."
-    });
-    write_fixture(
-        fixture_dir,
-        "meta.json",
-        &serde_json::to_string_pretty(&meta).expect("meta serialises"),
-    );
-}
-
-fn write_fixture(dir: &std::path::Path, name: &str, content: &str) {
-    let path = dir.join(name);
-    std::fs::write(&path, content).expect("fixture write succeeds");
-    println!("  wrote {}", path.display());
-}
-
-fn workspace_root() -> PathBuf {
-    // CARGO_MANIFEST_DIR is xtask/; workspace root is one level up.
-    let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
-    manifest
-        .parent()
-        .expect("workspace root is parent of xtask")
-        .to_path_buf()
-}
diff --git a/products/platform/README.md b/products/platform/README.md
index 82faf0ebf..427621c02 100644
--- a/products/platform/README.md
+++ b/products/platform/README.md
@@ -4,8 +4,8 @@
 
 Release label: pre-1.0 technical release for evaluation and integration pilots.
 
-Shared Rust security and operational primitives for Registry Relay, Registry
-Notary, and related registry services.
+Shared Rust security and operational primitives for Registry Relay, Evidence,
+and related registry services.
 
 The workspace is consumed by applications through a pinned git tag. It centralizes
 the pieces that should behave identically across services: outbound HTTP policy,
@@ -20,22 +20,15 @@ and integration-test fixtures.
 | [`registry-config-report`](crates/registry-config-report/README.md) | Shared configuration diagnostic and explanation report schemas, fixtures, serde types, and redaction helpers. |
 | [`registry-platform-audit`](crates/registry-platform-audit/README.md) | Tamper-evident audit envelopes, async sinks, JSONL verification, and redaction helpers. |
 | [`registry-platform-authcommon`](crates/registry-platform-authcommon/README.md) | Provider-independent authentication helpers for Bearer tokens and API-key fingerprints. |
-| [`registry-platform-cache`](crates/registry-platform-cache/README.md) | Generic cache-store trait, redacted hashed keys, and a bounded in-memory cache for focused tests and local use. |
 | [`registry-platform-config`](crates/registry-platform-config/README.md) | Config Bundle v1 manifests, trust anchors, file-closure verification, and local break-glass override contracts. |
 | [`registry-platform-crypto`](crates/registry-platform-crypto/README.md) | Ed25519 JWK parsing, provider-backed signing, verification, DID validation, and JSON canonicalization. |
 | [`registry-platform-httpsec`](crates/registry-platform-httpsec/README.md) | Axum/Tower HTTP security middleware, CORS policy validation, body limits, and RFC 9457 Problem Details responses. |
 | [`registry-platform-httputil`](crates/registry-platform-httputil/README.md) | Outbound HTTP clients, bounded response reads, URL construction, and SSRF-resistant fetch validation. |
-| [`registry-platform-oid4vci`](crates/registry-platform-oid4vci/README.md) | OID4VCI protocol constants, issuer metadata, holder proof validation, and credential endpoint wire types. |
 | [`registry-platform-oidc`](crates/registry-platform-oidc/README.md) | OIDC discovery, JWKS caching, and JWT verifier configuration shared by registry services. |
 | [`registry-platform-ops`](crates/registry-platform-ops/README.md) | Shared public operations posture schemas, examples, and redaction fixtures. |
-| [`registry-platform-replay`](crates/registry-platform-replay/README.md) | Shared in-memory replay and consumable nonce semantics for focused tests and single-process local use. |
 | [`registry-platform-sdjwt`](crates/registry-platform-sdjwt/README.md) | SD-JWT VC issuance and holder-proof validation helpers. |
 | [`registry-platform-testing`](crates/registry-platform-testing/README.md) | Mock IdP, mock HTTP upstreams, key fixtures, and cross-crate assertions for consumers. |
 
-Parked source retained in this repository: `crates/registry-platform-sts` is not
-a workspace member or release artifact until Assisted Access or the delegation
-profile work promotes a consumer (#298).
-
 ## Design Principles
 
 - Fail closed on malformed security input.
@@ -132,9 +125,8 @@ Secret-provider integrations should follow the
 [`secret-provider-readiness`](docs/secret-provider-readiness.md) contract for
 provider labels, readiness-gated apply, and posture-safe redaction.
 
-The in-memory cache and replay stores are for tests and single-process
-development. Product runtimes own their typed durable correctness state rather
-than selecting a generic platform cache backend.
+Product runtimes own their typed durable correctness state rather than selecting
+a generic platform storage backend.
 
 Report security-sensitive issues privately before opening a public issue.
 
diff --git a/products/platform/fuzz/Cargo.lock b/products/platform/fuzz/Cargo.lock
index c31509c40..0021f69f0 100644
--- a/products/platform/fuzz/Cargo.lock
+++ b/products/platform/fuzz/Cargo.lock
@@ -1442,16 +1442,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "registry-platform-cache"
-version = "0.16.3"
-dependencies = [
- "async-trait",
- "sha2 0.11.0",
- "thiserror",
- "time",
-]
-
 [[package]]
 name = "registry-platform-canonical-json"
 version = "0.16.3"
@@ -1492,7 +1482,6 @@ dependencies = [
  "libfuzzer-sys",
  "registry-platform-authcommon",
  "registry-platform-crypto",
- "registry-platform-oid4vci",
  "registry-platform-oidc",
  "registry-platform-sdjwt",
  "serde",
@@ -1525,19 +1514,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "registry-platform-oid4vci"
-version = "0.16.3"
-dependencies = [
- "base64",
- "registry-platform-crypto",
- "registry-platform-replay",
- "serde",
- "serde_json",
- "thiserror",
- "time",
-]
-
 [[package]]
 name = "registry-platform-oidc"
 version = "0.16.3"
@@ -1553,17 +1529,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "registry-platform-replay"
-version = "0.16.3"
-dependencies = [
- "async-trait",
- "getrandom 0.4.3",
- "registry-platform-cache",
- "thiserror",
- "time",
-]
-
 [[package]]
 name = "registry-platform-sdjwt"
 version = "0.16.3"
diff --git a/products/platform/fuzz/Cargo.toml b/products/platform/fuzz/Cargo.toml
index b93ebf550..e76296dd6 100644
--- a/products/platform/fuzz/Cargo.toml
+++ b/products/platform/fuzz/Cargo.toml
@@ -15,7 +15,6 @@ jsonwebtoken = { version = "10", default-features = false, features = ["aws_lc_r
 libfuzzer-sys = "0.4"
 registry-platform-authcommon = { path = "../../../crates/registry-platform-authcommon" }
 registry-platform-crypto = { path = "../../../crates/registry-platform-crypto" }
-registry-platform-oid4vci = { path = "../../../crates/registry-platform-oid4vci" }
 registry-platform-oidc = { path = "../../../crates/registry-platform-oidc" }
 registry-platform-sdjwt = { path = "../../../crates/registry-platform-sdjwt" }
 serde = { version = "1", features = ["derive"] }
@@ -31,13 +30,6 @@ test = false
 doc = false
 bench = false
 
-[[bin]]
-name = "oid4vci_request_and_proof"
-path = "fuzz_targets/oid4vci_request_and_proof.rs"
-test = false
-doc = false
-bench = false
-
 [[bin]]
 name = "sdjwt_holder_proof"
 path = "fuzz_targets/sdjwt_holder_proof.rs"
diff --git a/products/platform/fuzz/README.md b/products/platform/fuzz/README.md
index 23919208e..29f17467c 100644
--- a/products/platform/fuzz/README.md
+++ b/products/platform/fuzz/README.md
@@ -9,8 +9,6 @@ crates. These live outside the main workspace (see the root `Cargo.toml`
 
 - `authcommon_parsers` — bearer token and API key fingerprint parsing
   (`registry-platform-authcommon`).
-- `oid4vci_request_and_proof` — OID4VCI credential/token request and
-  proof-of-possession JWT parsing (`registry-platform-oid4vci`).
 - `sdjwt_holder_proof` — SD-JWT holder-proof JWT verification
   (`registry-platform-sdjwt`).
 - `sdjwt_issuance` — SD-JWT issuance input parsing (`registry-platform-sdjwt`).
diff --git a/products/platform/fuzz/corpus/oid4vci_request_and_proof/credential-offer-json b/products/platform/fuzz/corpus/oid4vci_request_and_proof/credential-offer-json
deleted file mode 100644
index 70f7deb3b..000000000
--- a/products/platform/fuzz/corpus/oid4vci_request_and_proof/credential-offer-json
+++ /dev/null
@@ -1 +0,0 @@
-{"credential_issuer":"https://issuer.example","credential_configuration_ids":["registry_notary_v1"],"grants":{"authorization_code":{"issuer_state":"opaque-state","authorization_server":"https://auth.example"}}}
diff --git a/products/platform/fuzz/corpus/oid4vci_request_and_proof/credential-request-json b/products/platform/fuzz/corpus/oid4vci_request_and_proof/credential-request-json
deleted file mode 100644
index 9f053837d..000000000
--- a/products/platform/fuzz/corpus/oid4vci_request_and_proof/credential-request-json
+++ /dev/null
@@ -1 +0,0 @@
-{"format":"dc+sd-jwt","credential_configuration_id":"registry_notary_v1","vct":"https://vct.example/test","proof":{"proof_type":"jwt","jwt":"a.b.c"}}
diff --git a/products/platform/fuzz/corpus/oid4vci_request_and_proof/credential_request.json b/products/platform/fuzz/corpus/oid4vci_request_and_proof/credential_request.json
deleted file mode 100644
index 87b657706..000000000
--- a/products/platform/fuzz/corpus/oid4vci_request_and_proof/credential_request.json
+++ /dev/null
@@ -1 +0,0 @@
-{"format":"dc+sd-jwt","credential_definition":{"type":["VerifiableCredential","RegistryNotaryCredential"]},"proof":{"proof_type":"jwt","jwt":"eyJhbGciOiJFZERTQSIsImp3ayI6eyJhbGciOiJFZERTQSIsImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiMWFqX3JMSnNHRmd3LTV2OTI1RU1tZVpqNUpxUDQ0eGVnYWZFS2ZaYmR4YyJ9LCJ0eXAiOiJvcGVuaWQ0dmNpLXByb29mK2p3dCJ9.eyJhdWQiOiJodHRwczovL2lzc3Vlci5leGFtcGxlIiwiaWF0IjoxMDAwLCJub25jZSI6Im4tMSJ9.fIyoaSjcCVbtOuSql0Wj5WfmdKBzYjIDyU26kCixkwXM2QcKiNJicQMp4yBO5mNEsSp3qiDn09Bqbrx0EhMFBg"}}
diff --git a/products/platform/fuzz/corpus/oid4vci_request_and_proof/token_request.txt b/products/platform/fuzz/corpus/oid4vci_request_and_proof/token_request.txt
deleted file mode 100644
index c16208b96..000000000
--- a/products/platform/fuzz/corpus/oid4vci_request_and_proof/token_request.txt
+++ /dev/null
@@ -1 +0,0 @@
-grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code&pre-authorized_code=eyJhbGciOiJFZERTQSJ9.eyJqdGkiOiJmdXp6In0.signature
diff --git a/products/platform/fuzz/corpus/oid4vci_request_and_proof/valid-proof-jwt b/products/platform/fuzz/corpus/oid4vci_request_and_proof/valid-proof-jwt
deleted file mode 100644
index 53bb1e4c7..000000000
--- a/products/platform/fuzz/corpus/oid4vci_request_and_proof/valid-proof-jwt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJFZERTQSIsImp3ayI6eyJhbGciOiJFZERTQSIsImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiMWFqX3JMSnNHRmd3LTV2OTI1RU1tZVpqNUpxUDQ0eGVnYWZFS2ZaYmR4YyJ9LCJ0eXAiOiJvcGVuaWQ0dmNpLXByb29mK2p3dCJ9.eyJhdWQiOiJodHRwczovL2lzc3Vlci5leGFtcGxlIiwiZXhwIjoxMDYwLCJpYXQiOjEwMDAsImlzcyI6ImRpZDpqd2s6ZXlKamNuWWlPaUpGWkRJMU5URTVJaXdpYTNSNUlqb2lUMHRRSWl3aWVDSTZJakZoYWw5eVRFcHpSMFpuZHkwMWRqa3lOVVZOYldWYWFqVktjVkEwTkhobFoyRm1SVXRtV21Ka2VHTWlmUSIsIm5vbmNlIjoibi0xIn0.62yz9lu2HLaS9nTJ5NLv9Uxk8BUZsUTyO794aPC3VHEULJnsxQbUZcOj4L1QM-4ccEJ3Wf0VN9pRNnaoh9V1BA
diff --git a/products/platform/fuzz/fuzz_targets/oid4vci_request_and_proof.rs b/products/platform/fuzz/fuzz_targets/oid4vci_request_and_proof.rs
deleted file mode 100644
index 66502af68..000000000
--- a/products/platform/fuzz/fuzz_targets/oid4vci_request_and_proof.rs
+++ /dev/null
@@ -1,48 +0,0 @@
-#![no_main]
-
-use std::time::Duration;
-
-use libfuzzer_sys::fuzz_target;
-use registry_platform_oid4vci::{
-    validate_proof_jwt, CredentialIssuerMetadata, CredentialOffer, CredentialRequest, NonceRequest,
-    NonceResponse, ProofIssuerPolicy, ProofValidationPolicy, TokenRequest, TokenResponse,
-    WireError,
-};
-
-fuzz_target!(|data: &[u8]| {
-    let Ok(input) = std::str::from_utf8(data) else {
-        return;
-    };
-
-    let bounded = take_chars(input, 8192);
-    fuzz_wire_json(&bounded);
-    fuzz_proof(&bounded);
-});
-
-fn fuzz_wire_json(input: &str) {
-    let _ = serde_json::from_str::<CredentialRequest>(input);
-    let _ = serde_json::from_str::<CredentialOffer>(input);
-    let _ = serde_json::from_str::<CredentialIssuerMetadata>(input);
-    let _ = serde_json::from_str::<NonceRequest>(input);
-    let _ = serde_json::from_str::<NonceResponse>(input);
-    let _ = serde_json::from_str::<TokenRequest>(input);
-    let _ = serde_json::from_str::<TokenResponse>(input);
-    let _ = serde_json::from_str::<WireError>(input);
-    let _ = serde_urlencoded::from_str::<TokenRequest>(input);
-}
-
-fn fuzz_proof(input: &str) {
-    let policy = ProofValidationPolicy {
-        audience: "https://issuer.example",
-        expected_nonce: Some("n-1"),
-        issuer: ProofIssuerPolicy::Optional,
-        max_lifetime: Duration::from_secs(300),
-        future_skew: Duration::from_secs(30),
-        forbidden_holder_keys: &[],
-    };
-    let _ = validate_proof_jwt(input, &policy, 1001);
-}
-
-fn take_chars(input: &str, limit: usize) -> String {
-    input.chars().take(limit).collect()
-}
diff --git a/products/platform/fuzz/fuzz_targets/sdjwt_issuance.rs b/products/platform/fuzz/fuzz_targets/sdjwt_issuance.rs
index a1b417823..0eb315785 100644
--- a/products/platform/fuzz/fuzz_targets/sdjwt_issuance.rs
+++ b/products/platform/fuzz/fuzz_targets/sdjwt_issuance.rs
@@ -5,7 +5,9 @@ use std::sync::OnceLock;
 
 use libfuzzer_sys::fuzz_target;
 use registry_platform_crypto::PrivateJwk;
-use registry_platform_sdjwt::{Disclosure, HolderConfirmation, SdJwtIssuanceInput, SdJwtIssuer};
+use registry_platform_sdjwt::{
+    Disclosure, HolderConfirmation, ObjectDisclosure, SdJwtIssuanceInput, SdJwtIssuer,
+};
 use serde::Deserialize;
 use serde_json::Value;
 
@@ -23,6 +25,7 @@ struct SeedInput {
     status: Option<Value>,
     public_claims: Option<BTreeMap<String, Value>>,
     disclosures: Option<Vec<SeedDisclosure>>,
+    object_disclosures: Option<Vec<SeedObjectDisclosure>>,
     bind_holder: Option<bool>,
 }
 
@@ -32,6 +35,12 @@ struct SeedDisclosure {
     value: Value,
 }
 
+#[derive(Debug, Deserialize)]
+struct SeedObjectDisclosure {
+    name: String,
+    fields: Option<Vec<SeedDisclosure>>,
+}
+
 fuzz_target!(|data: &[u8]| {
     let Ok(input) = std::str::from_utf8(data) else {
         return;
@@ -57,14 +66,15 @@ impl SeedInput {
             status: self.status,
             public_claims: bound_claims(self.public_claims.unwrap_or_default()),
             cnf: self.bind_holder.unwrap_or(false).then(holder_confirmation),
-            disclosures: self
-                .disclosures
+            disclosures: bound_disclosures(self.disclosures.unwrap_or_default()),
+            object_disclosures: self
+                .object_disclosures
                 .unwrap_or_default()
                 .into_iter()
-                .take(8)
-                .map(|disclosure| Disclosure {
-                    name: take_chars(&disclosure.name, 128),
-                    value: disclosure.value,
+                .take(4)
+                .map(|object| ObjectDisclosure {
+                    name: take_chars(&object.name, 128),
+                    fields: bound_disclosures(object.fields.unwrap_or_default()),
                 })
                 .collect(),
         }
@@ -88,6 +98,17 @@ fn bytes_to_issuance_input(data: &[u8]) -> SdJwtIssuanceInput {
             name: format!("claim-{first}"),
             value: Value::String(take_chars(&String::from_utf8_lossy(data), 128)),
         }],
+        object_disclosures: (second % 3 == 0)
+            .then(|| {
+                vec![ObjectDisclosure {
+                    name: format!("object-{second}"),
+                    fields: vec![Disclosure {
+                        name: format!("field-{first}"),
+                        value: Value::String(take_chars(&String::from_utf8_lossy(data), 128)),
+                    }],
+                }]
+            })
+            .unwrap_or_default(),
     }
 }
 
@@ -116,6 +137,17 @@ fn holder_confirmation() -> HolderConfirmation {
     }
 }
 
+fn bound_disclosures(seeds: Vec<SeedDisclosure>) -> Vec<Disclosure> {
+    seeds
+        .into_iter()
+        .take(8)
+        .map(|disclosure| Disclosure {
+            name: take_chars(&disclosure.name, 128),
+            value: disclosure.value,
+        })
+        .collect()
+}
+
 fn bound_claims(claims: BTreeMap<String, Value>) -> BTreeMap<String, Value> {
     claims
         .into_iter()
diff --git a/release/READINESS.md b/release/READINESS.md
index 6a1dbe791..77c890da2 100644
--- a/release/READINESS.md
+++ b/release/READINESS.md
@@ -1,6 +1,6 @@
 # 1.0 Release Readiness
 
-This document tracks the evidence that Registry Relay and Registry Notary are
+This document tracks the evidence that Registry Relay and Evidence are
 ready for a stable release. "Stable" means both semver API stability
 commitments and a production security posture suitable for government
 deployments that self-host the stack.
@@ -34,7 +34,7 @@ client, plus where those guarantees could leak (logs, error messages, audit
 records, caches, timing).
 
 - [ ] Relay threat model written and reviewed.
-- [ ] Notary threat model written and reviewed.
+- [ ] Evidence threat model written and reviewed.
 - [ ] Attack checklist derived from the threat models (drives section 4).
 
 ## 3. Standards conformance
@@ -46,25 +46,21 @@ write.
 - [x] Inventory of standards and specification claims across docs and specs.
       Evidence: [`standards-claims-inventory.md`](notes/standards-claims-inventory.md).
 - [ ] Per-claim evidence recorded (conformance run, test vectors, or interop).
-- [ ] OpenID conformance suite running repeatably against a supported
-      deployment topology (#205). Must not depend on the retired monorepo lab,
-      which was replaced by the standalone
-      [Solmara Lab](https://github.com/registrystack/solmara-lab) (#224).
-      The release-owned [OIDF harness and plan mapping](conformance/openid/README.md)
-      and [Relay OIDC smoke](conformance/relay-oidc/README.md) no longer depend
-      on either lab. The Relay smoke is source-ready and directly runnable
-      against a digest-pinned published candidate, but no reviewed 1.0
-      candidate result exists yet. The OIDF harness's
-      [initial report](conformance/openid/initial-report.md) preserves the
-      historical hosted-lab failures but does not yet prove a pinned release
-      topology.
-- [ ] Credentialing, OID4VCI, and status-list interop proof (#57).
-- [ ] OpenCRVS and DHIS2 project-authored integration proof (#72). The
-      [candidate-neutral source packet](conformance/integrations/README.md)
-      pins both unofficial profiles, closes the public result shape, and
-      validates published candidate assets. It is not live evidence; the
-      external compatibility, instance, source-side audit, and teardown
-      prerequisites remain required for each candidate run.
+- [ ] OpenID conformance evidence for supported surfaces. The release-owned
+      [Relay OIDC smoke](conformance/relay-oidc/README.md) is source-ready and
+      directly runnable against a digest-pinned published candidate, but no
+      reviewed 1.0 candidate result exists yet. The retired Notary OID4VCI
+      wrapper was product-specific and is no longer an active gate; its
+      [initial report](conformance/openid/initial-report.md) remains historical
+      evidence only.
+- [ ] Source-read and field-projection evidence for a published Relay image.
+      The same Relay OIDC smoke now asserts that a row reaches the caller from
+      the mounted source only under the entity's own read scope, and that the
+      returned record carries the authored projection rather than the source
+      column. It is source-ready and unrun, so no release may yet cite it.
+- [ ] OpenCRVS and DHIS2 project-authored integration proof (#72). The prior
+      integration packet was Notary-specific and was retired on 2026-08-03.
+      No current Relay or Evidence interoperability claim replaces it.
 
 ## 4. Adversarial verification
 
@@ -74,13 +70,12 @@ section is about challenging it.
 - [ ] Maintainer adversarial review of the load-bearing crates:
       `registry-platform-pdp`, `registry-platform-sdjwt`,
       `registry-platform-crypto`, `registry-platform-authcommon`, Relay scope
-      enforcement, Notary disclosure policy evaluation. `registry-platform-sts`
-      is parked outside the workspace until a consumer is promoted (#298).
+      enforcement, and Evidence assertion evaluation and signing.
 - [ ] Negative-path test coverage mapped against the attack checklist;
       gaps closed with tests that assert denial and correct audit records.
       Mapping evidence: [`negative-path-coverage-map.md`](notes/negative-path-coverage-map.md).
 - [ ] cargo-fuzz targets for manifest and artifact parsers (#26).
-- [ ] cargo-fuzz targets for token, credential, Relay consultation, and script
+- [ ] cargo-fuzz targets for token, assertion, Relay consultation, and script
       adapter parse boundaries.
 - [ ] Data-minimization leak review across logs, error paths, audit records,
       and caches (maintainer work; #176 is the known open case).
@@ -126,7 +121,7 @@ What 1.0 promises the institutions that run this.
       source-built release-tag images; release-artifact verification,
       credential issuance, metrics, the historical Redis replay/nonce path used
       by that release, and anti-rollback monotonic rejection remain outside this
-      run). Current Notary replay and nonce correctness state is PostgreSQL-backed.
+      run).
       Backup and restore guidance for generated and single-node deployments is
       documented in [`backup-and-restore.mdx`](../docs/site/src/content/docs/operate/backup-and-restore.mdx)
       (#226). The
@@ -159,7 +154,7 @@ What 1.0 promises the institutions that run this.
 
 ## 8. Data protection posture
 
-Notary's pitch is minimization; it will be held to it.
+Evidence's pitch is minimum disclosure; it will be held to it.
 
 - [ ] Behavioral guarantee claims extracted from the docs site and verified
       against implementation. Extraction evidence:
diff --git a/release/REPEATABLE-BUILDS.md b/release/REPEATABLE-BUILDS.md
index b744a4c10..1826c0102 100644
--- a/release/REPEATABLE-BUILDS.md
+++ b/release/REPEATABLE-BUILDS.md
@@ -23,10 +23,10 @@ The workflow:
    release image lock.
 3. Rebuilds the canonical Linux payload with fresh Cargo and target
    directories.
-4. Requires byte equality for the six Linux amd64 payloads.
-5. Rebuilds Registry Notary and Registry Relay images without cache.
-6. Compares image configuration and ordered root filesystem layers with the
-   published digest-bound images.
+4. Requires byte equality for the seven declared Linux amd64 binaries.
+5. Rebuilds the Registry Relay image without cache.
+6. Compares its image configuration and ordered root filesystem layers with
+   the published digest-bound image.
 7. Records a compact result and retains it for 30 days.
 
 The proof excludes native macOS and Linux arm64 Registryctl binaries,
diff --git a/release/VERIFY.md b/release/VERIFY.md
index 6af50ee79..3483d9d12 100644
--- a/release/VERIFY.md
+++ b/release/VERIFY.md
@@ -90,16 +90,17 @@ identity and immutable digest references:
 image_lock="registryctl-${tag}-image-lock.json"
 
 jq -e --arg tag "${tag}" '
-  .schema_version == "registryctl.release_image_lock.v1" and
+  .schema_version == "registryctl.release_image_lock.v3" and
   .release_tag == $tag and
   .platform == "linux/amd64" and
+  ((.images | keys) == ["postgresql", "registry-relay"]) and
   (.images["registry-relay"] |
     test("^ghcr\\.io/registrystack/registry-relay@sha256:[0-9a-f]{64}$")) and
-  (.images["registry-notary"] |
-    test("^ghcr\\.io/registrystack/registry-notary@sha256:[0-9a-f]{64}$"))
+  (.images["postgresql"] |
+    test("^docker\\.io/library/postgres@sha256:[0-9a-f]{64}$"))
 ' "${image_lock}"
 
-for name in registry-notary registry-relay; do
+for name in registry-relay postgresql; do
   ref="$(jq -er --arg name "${name}" '.images[$name]' "${image_lock}")"
   expected="${ref##*@}"
   test "$(crane digest "${ref}")" = "${expected}"
diff --git a/release/conformance/adopter-runtime/README.md b/release/conformance/adopter-runtime/README.md
index 3a5adf245..67dde55a1 100644
--- a/release/conformance/adopter-runtime/README.md
+++ b/release/conformance/adopter-runtime/README.md
@@ -5,11 +5,11 @@ They are not a shipped deployment package and contain no credentials.
 
 The checker proves:
 
-- the ordinary package has four workloads plus three least-authority,
+- the ordinary package has three workloads plus two least-authority,
   networkless secret stagers;
 - all workloads use one ordinary, non-internal Compose runtime network, with
   no namespace-holder service or shared `network_mode`;
-- only Relay public and Notary publish host ports, and both bind IPv4 loopback;
+- only Relay public publishes a host port, and it binds IPv4 loopback;
 - product application traffic is plain HTTP within that Compose network, and
   the operator or platform terminates ingress TLS before the loopback boundary;
 - Relay public needs no staged listener TLS material, while each remaining
@@ -18,7 +18,7 @@ The checker proves:
 - each product lane reuses one operator-owned environment file for serve,
   preparation, and initialization;
 - selecting `compose.initialize.yaml` is required to initialize PostgreSQL and
-  exposes the seven initialization services only in that explicit model;
+  exposes the eleven initialization services only in that explicit model;
 - `docker compose config --no-env-resolution` retains environment-file paths
   without resolving sentinel operator values; and
 - one operator-owned parent file can include the generated package using
@@ -32,10 +32,9 @@ Compose normalization.
 The single first-country release rehearsal supplies the functional proof that
 these inert fixtures cannot. It retains the already tested public HTTP demo,
 builds and signs its `public-demo` environment, starts the generated governed
-package, and sends one authenticated Notary evaluation through the private
-consultation Relay to the bounded source. The retained evidence contains only
-the HTTP status and minimized claim summary, not the caller token or source
-response.
+package, and sends one authenticated Relay consultation to the bounded source.
+The retained evidence contains only the HTTP status and minimized response
+summary, not the caller token or source response.
 
 Run the current and minimum supported Compose implementations:
 
diff --git a/release/conformance/adopter-runtime/deployment-plan.probe.v1.json b/release/conformance/adopter-runtime/deployment-plan.probe.v1.json
index 5c884ecdf..6047a5e05 100644
--- a/release/conformance/adopter-runtime/deployment-plan.probe.v1.json
+++ b/release/conformance/adopter-runtime/deployment-plan.probe.v1.json
@@ -1,6 +1,6 @@
 {
   "schema_id": "io.registrystack.deployment_plan",
-  "schema_version": "1.0",
+  "schema_version": "2.0",
   "single_instance": true,
   "workloads": [
     {
@@ -39,24 +39,6 @@
       "restart_action": "restart",
       "reactivation_action": "verify_state"
     },
-    {
-      "id": "notary",
-      "kind": "product",
-      "product_lane": "notary",
-      "action": "serve",
-      "image_identity": "example.invalid/registrystack/registry-notary@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-      "image_platform": "linux-amd64",
-      "immutable_inputs": ["notary-bundle", "notary-anchor"],
-      "mount_roles": ["bundle", "anchor", "anti-rollback-state", "secret", "audit"],
-      "secret_consumers": ["notary-relay-workload-credential", "notary-signing-key"],
-      "state_roles": ["notary-anti-rollback", "notary-audit"],
-      "endpoint_classes": ["public-application", "administration", "posture"],
-      "network_relationships": ["runtime"],
-      "dependencies": ["relay-consultation", "postgresql-state-plane"],
-      "health_semantics": "notary-health",
-      "restart_action": "restart",
-      "reactivation_action": "verify_state"
-    },
     {
       "id": "postgresql-state-plane",
       "kind": "supporting",
@@ -77,24 +59,19 @@
     {"id": "bootstrap-postgresql-state-plane", "workload": "postgresql-state-plane", "action": "bootstrap_state_plane"},
     {"id": "prepare-relay-public-state", "workload": "relay-public", "action": "prepare_state_store"},
     {"id": "prepare-relay-consultation-state", "workload": "relay-consultation", "action": "prepare_state_store"},
-    {"id": "prepare-notary-state", "workload": "notary", "action": "prepare_state_store"},
     {"id": "initialize-relay-public", "workload": "relay-public", "action": "initialize_state"},
     {"id": "initialize-relay-consultation", "workload": "relay-consultation", "action": "initialize_state"},
-    {"id": "initialize-notary", "workload": "notary", "action": "initialize_state"},
     {"id": "preview-relay-public-state", "workload": "relay-public", "action": "preview_state"},
     {"id": "preview-relay-consultation-state", "workload": "relay-consultation", "action": "preview_state"},
-    {"id": "preview-notary-state", "workload": "notary", "action": "preview_state"},
     {"id": "accept-relay-public-state", "workload": "relay-public", "action": "accept_state"},
     {"id": "accept-relay-consultation-state", "workload": "relay-consultation", "action": "accept_state"},
-    {"id": "accept-notary-state", "workload": "notary", "action": "accept_state"},
     {"id": "verify-relay-public-state", "workload": "relay-public", "action": "verify_state"},
-    {"id": "verify-relay-consultation-state", "workload": "relay-consultation", "action": "verify_state"},
-    {"id": "verify-notary-state", "workload": "notary", "action": "verify_state"}
+    {"id": "verify-relay-consultation-state", "workload": "relay-consultation", "action": "verify_state"}
   ],
   "recovery_consistency_groups": [
     {
       "id": "consultation-state",
-      "members": ["relay-consultation", "notary", "postgresql-state-plane"]
+      "members": ["relay-consultation", "postgresql-state-plane"]
     },
     {
       "id": "relay-public-state",
@@ -104,7 +81,6 @@
   "exposure_requirements": [
     {"endpoint_class": "public-application", "exposure": "operator-bound"},
     {"endpoint_class": "private-application", "exposure": "private-network-only"},
-    {"endpoint_class": "administration", "exposure": "private-network-only"},
     {"endpoint_class": "posture", "exposure": "private-network-only"}
   ]
 }
diff --git a/release/conformance/adopter-runtime/package/generated/compose.initialize.yaml b/release/conformance/adopter-runtime/package/generated/compose.initialize.yaml
index 32fb85b04..71175cc8f 100644
--- a/release/conformance/adopter-runtime/package/generated/compose.initialize.yaml
+++ b/release/conformance/adopter-runtime/package/generated/compose.initialize.yaml
@@ -50,25 +50,6 @@ services:
       - source: registry-postgresql-tls-certificate
         target: postgresql-tls-certificate
 
-  registry-notary-actions-stage-secrets:
-    image: example.invalid/registrystack/postgresql@sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
-    platform: linux/amd64
-    entrypoint: ["/bin/sh", "-ceu"]
-    command: ["umask 077\nexit 0\n"]
-    user: "0:0"
-    read_only: true
-    cap_drop: [ALL]
-    cap_add: [CHOWN, DAC_READ_SEARCH]
-    security_opt: [no-new-privileges:true]
-    tmpfs: [/tmp]
-    network_mode: none
-    restart: "no"
-    volumes:
-      - registry-operator-files-notary-prepare:/registryctl-stage/output/notary-prepare
-    secrets:
-      - source: registry-postgresql-tls-certificate
-        target: postgresql-tls-certificate
-
   registry-postgres-bootstrap:
     image: example.invalid/registrystack/postgresql@sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
     platform: linux/amd64
@@ -162,42 +143,6 @@ services:
       - registry-relay-consultation-audit:/var/lib/registry/audit
       - registry-operator-files-relay-consultation-prepare:/run/secrets:ro
 
-  registry-notary-prepare-state:
-    image: example.invalid/registrystack/registry-notary@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
-    platform: linux/amd64
-    command: [product-action, prepare_state_store]
-    user: "65532:65532"
-    read_only: true
-    cap_drop: [ALL]
-    security_opt: [no-new-privileges:true]
-    tmpfs: [/tmp]
-    logging:
-      driver: local
-      options: {max-size: 10m, max-file: "3"}
-    restart: "no"
-    networks: [registry-runtime]
-    depends_on:
-      registry-postgres:
-        condition: service_healthy
-      registry-notary-actions-stage-secrets:
-        condition: service_completed_successfully
-    env_file: [../operator/secrets/notary-environment]
-    volumes:
-      - type: bind
-        source: ./bundles/notary
-        target: /run/registry/bundle
-        read_only: true
-        bind:
-          create_host_path: false
-      - type: bind
-        source: ./anchors/notary
-        target: /run/registry/anchor
-        read_only: true
-        bind:
-          create_host_path: false
-      - registry-notary-audit:/var/lib/registry/audit
-      - registry-operator-files-notary-prepare:/run/secrets:ro
-
   registry-relay-public-initialize:
     image: example.invalid/registrystack/registry-relay@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
     platform: linux/amd64
@@ -266,37 +211,6 @@ services:
       - registry-relay-consultation-audit:/var/lib/registry/audit
       - registry-operator-files-relay-consultation-initialize:/run/secrets:ro
 
-  registry-notary-initialize:
-    image: example.invalid/registrystack/registry-notary@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
-    platform: linux/amd64
-    command: [product-action, initialize_state]
-    user: "65532:65532"
-    read_only: true
-    cap_drop: [ALL]
-    security_opt: [no-new-privileges:true]
-    tmpfs: [/tmp]
-    logging:
-      driver: local
-      options: {max-size: 10m, max-file: "3"}
-    restart: "no"
-    network_mode: none
-    env_file: [../operator/secrets/notary-environment]
-    volumes:
-      - type: bind
-        source: ./bundles/notary
-        target: /run/registry/bundle
-        read_only: true
-        bind:
-          create_host_path: false
-      - type: bind
-        source: ./anchors/notary
-        target: /run/registry/anchor
-        read_only: true
-        bind:
-          create_host_path: false
-      - registry-notary-state:/var/lib/registry/state
-      - registry-notary-audit:/var/lib/registry/audit
-
   registry-relay-public-preview-state:
     image: example.invalid/registrystack/registry-relay@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
     platform: linux/amd64
@@ -355,35 +269,6 @@ services:
           create_host_path: false
       - registry-relay-consultation-state:/var/lib/registry/state:ro
 
-  registry-notary-preview-state:
-    image: example.invalid/registrystack/registry-notary@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
-    platform: linux/amd64
-    command: [product-action, preview_state]
-    user: "65532:65532"
-    read_only: true
-    cap_drop: [ALL]
-    security_opt: [no-new-privileges:true]
-    tmpfs: [/tmp]
-    logging:
-      driver: local
-      options: {max-size: 10m, max-file: "3"}
-    restart: "no"
-    network_mode: none
-    volumes:
-      - type: bind
-        source: ./bundles/notary
-        target: /run/registry/bundle
-        read_only: true
-        bind:
-          create_host_path: false
-      - type: bind
-        source: ./anchors/notary
-        target: /run/registry/anchor
-        read_only: true
-        bind:
-          create_host_path: false
-      - registry-notary-state:/var/lib/registry/state:ro
-
   registry-relay-public-accept-state:
     image: example.invalid/registrystack/registry-relay@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
     platform: linux/amd64
@@ -446,37 +331,6 @@ services:
       - registry-relay-consultation-state:/var/lib/registry/state
       - registry-relay-consultation-audit:/var/lib/registry/audit
 
-  registry-notary-accept-state:
-    image: example.invalid/registrystack/registry-notary@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
-    platform: linux/amd64
-    command: [product-action, accept_state]
-    user: "65532:65532"
-    read_only: true
-    cap_drop: [ALL]
-    security_opt: [no-new-privileges:true]
-    tmpfs: [/tmp]
-    logging:
-      driver: local
-      options: {max-size: 10m, max-file: "3"}
-    restart: "no"
-    network_mode: none
-    env_file: [../operator/secrets/notary-environment]
-    volumes:
-      - type: bind
-        source: ./bundles/notary
-        target: /run/registry/bundle
-        read_only: true
-        bind:
-          create_host_path: false
-      - type: bind
-        source: ./anchors/notary
-        target: /run/registry/anchor
-        read_only: true
-        bind:
-          create_host_path: false
-      - registry-notary-state:/var/lib/registry/state
-      - registry-notary-audit:/var/lib/registry/audit
-
   registry-relay-public-verify-state:
     image: example.invalid/registrystack/registry-relay@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
     platform: linux/amd64
@@ -535,37 +389,7 @@ services:
           create_host_path: false
       - registry-relay-consultation-state:/var/lib/registry/state:ro
 
-  registry-notary-verify-state:
-    image: example.invalid/registrystack/registry-notary@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
-    platform: linux/amd64
-    command: [product-action, verify_state]
-    user: "65532:65532"
-    read_only: true
-    cap_drop: [ALL]
-    security_opt: [no-new-privileges:true]
-    tmpfs: [/tmp]
-    logging:
-      driver: local
-      options: {max-size: 10m, max-file: "3"}
-    restart: "no"
-    network_mode: none
-    volumes:
-      - type: bind
-        source: ./bundles/notary
-        target: /run/registry/bundle
-        read_only: true
-        bind:
-          create_host_path: false
-      - type: bind
-        source: ./anchors/notary
-        target: /run/registry/anchor
-        read_only: true
-        bind:
-          create_host_path: false
-      - registry-notary-state:/var/lib/registry/state:ro
-
 volumes:
   registry-operator-files-postgresql-bootstrap:
   registry-operator-files-relay-consultation-prepare:
   registry-operator-files-relay-consultation-initialize:
-  registry-operator-files-notary-prepare:
diff --git a/release/conformance/adopter-runtime/package/generated/compose.yaml b/release/conformance/adopter-runtime/package/generated/compose.yaml
index 51a463fec..2d5aae694 100644
--- a/release/conformance/adopter-runtime/package/generated/compose.yaml
+++ b/release/conformance/adopter-runtime/package/generated/compose.yaml
@@ -53,18 +53,6 @@ services:
       - source: registry-postgresql-tls-certificate
         target: postgresql-tls-certificate
 
-  registry-notary-stage-secrets:
-    <<: *stager-hardening
-    volumes:
-      - registry-operator-files-notary-serve:/registryctl-stage/output/notary-serve
-    secrets:
-      - source: registry-notary-relay-workload-credential
-        target: notary-relay-workload-credential
-      - source: registry-notary-signing-key
-        target: notary-signing-key
-      - source: registry-postgresql-tls-certificate
-        target: postgresql-tls-certificate
-
   registry-postgres:
     image: example.invalid/registrystack/postgresql@sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
     platform: linux/amd64
@@ -161,43 +149,6 @@ services:
       - registry-relay-consultation-audit:/var/lib/registry/audit
       - registry-operator-files-relay-consultation-serve:/run/secrets:ro
 
-  registry-notary:
-    <<: *product-hardening
-    image: example.invalid/registrystack/registry-notary@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
-    restart: unless-stopped
-    command: [product-action, serve]
-    networks: [registry-runtime]
-    ports:
-      - target: 8081
-        published: "4255"
-        host_ip: 127.0.0.1
-        protocol: tcp
-        mode: ingress
-    depends_on:
-      registry-postgres:
-        condition: service_healthy
-      registry-relay-consultation:
-        condition: service_healthy
-      registry-notary-stage-secrets:
-        condition: service_completed_successfully
-    env_file: [../operator/secrets/notary-environment]
-    volumes:
-      - type: bind
-        source: ./bundles/notary
-        target: /run/registry/bundle
-        read_only: true
-        bind:
-          create_host_path: false
-      - type: bind
-        source: ./anchors/notary
-        target: /run/registry/anchor
-        read_only: true
-        bind:
-          create_host_path: false
-      - registry-notary-state:/var/lib/registry/state:ro
-      - registry-notary-audit:/var/lib/registry/audit
-      - registry-operator-files-notary-serve:/run/secrets:ro
-
 networks:
   registry-runtime:
 
@@ -212,19 +163,10 @@ volumes:
     name: registry-adopter-probe_registry-relay-consultation-state
   registry-relay-consultation-audit:
     name: registry-adopter-probe_registry-relay-consultation-audit
-  registry-notary-state:
-    name: registry-adopter-probe_registry-notary-state
-  registry-notary-audit:
-    name: registry-adopter-probe_registry-notary-audit
   registry-operator-files-postgresql-serve:
   registry-operator-files-relay-consultation-serve:
-  registry-operator-files-notary-serve:
 
 secrets:
-  registry-notary-signing-key:
-    file: ../operator/secrets/notary-signing-key
-  registry-notary-relay-workload-credential:
-    file: ../operator/secrets/notary-relay-workload-credential
   registry-postgresql-tls-certificate:
     file: ../operator/secrets/postgresql-tls-certificate
   registry-postgresql-tls-private-key:
diff --git a/release/conformance/adopter-runtime/package/operator/secrets/notary-environment b/release/conformance/adopter-runtime/package/operator/secrets/notary-environment
deleted file mode 100644
index ebd16e5d0..000000000
--- a/release/conformance/adopter-runtime/package/operator/secrets/notary-environment
+++ /dev/null
@@ -1 +0,0 @@
-REGISTRY_CONFORMANCE_SENTINEL=notary-value-must-not-enter-compose
diff --git a/release/conformance/integrations/README.md b/release/conformance/integrations/README.md
deleted file mode 100644
index 3dc7fce81..000000000
--- a/release/conformance/integrations/README.md
+++ /dev/null
@@ -1,193 +0,0 @@
-# External integration evidence
-
-This directory defines the release-owned evidence boundary for Registry Stack's
-OpenCRVS and DHIS2 integration profiles. It lets an approved operator prepare a
-repeatable run and publish a bounded result without publishing source records,
-credentials, infrastructure details, or raw logs.
-
-Both profiles are **Registry Stack-supported unofficial integration profiles**.
-They prove one reviewed read operation against one exact upstream baseline.
-They are not product certification or general conformance claims.
-An integration pilot alone does not close the separate Country ready or
-First-country success gates.
-
-## Evidence boundary
-
-The checked-in profiles, schema, and runner are a source packet, not live
-evidence. A passing public result also requires all of these external inputs:
-
-- A published Registry Stack candidate and its complete signed release assets.
-- An owner-approved non-production source instance with stable test records.
-- Owner-attested metadata, source routes, identifiers, and credentials.
-- A source-side audit or request-counter probe that can distinguish zero from
-  one data-operation call for every case.
-- Approved restricted evidence storage, retention, redaction, and teardown.
-
-For OpenCRVS, the `/registry/sync/search` compatibility probe must pass against
-the exact pinned DCI adapter, core, and Farajaland tuple before the live run.
-The current starter's synthetic route is not evidence that the real operation
-is compatible.
-
-For DHIS2, the instance owner must attest every metadata UID used by the
-authored adapter, including the child programme and BCG, OPV, and measles
-programme-stage UIDs. The `DEMO_*` values in the starter are examples and
-cannot appear in a live evidence project.
-
-The DHIS2 starter's offline fixtures are the deterministic acceptance path for
-claim semantics and failure behavior. Record live public-demo or operator-owned
-compatibility only through this release evidence flow. Public demo uptime,
-credentials, and mutable records are not offline acceptance dependencies.
-
-Do not simulate either prerequisite. Do not convert fixture output, a dry run,
-or application-only logs into candidate evidence.
-
-## Inspect the plan
-
-Validate the checked-in packet:
-
-```sh
-python3 release/scripts/integration-e2-runner.py validate
-```
-
-Inspect either profile as a readable plan:
-
-```sh
-python3 release/scripts/integration-e2-runner.py plan \
-  --profile opencrvs-dci-v1.9
-```
-
-Use `dry-run` for the same bounded contract as JSON:
-
-```sh
-python3 release/scripts/integration-e2-runner.py dry-run \
-  --profile dhis2-tracker-2.41.9 > integration-plan.json
-```
-
-The JSON has `candidate_evidence: false` and
-`status: planned_not_executed`. It includes input names, not values.
-
-## Run the operator-owned journey
-
-The approved operator wrapper must execute these stages in order and within
-the profile limits:
-
-1. Download the candidate assets listed in `release/VERIFY.md` into a fresh,
-   dedicated directory.
-2. Use the public runner to validate checksums, signatures, provenance,
-   capsule lineage, image locks, and digest files. The runner copies the exact
-   closed asset set through no-follow file descriptors into a fresh owner-only
-   temporary snapshot. It makes every snapshot file non-writable, verifies
-   and authenticates only snapshot files, then executes only the snapshot
-   binary for its self-reported version. It removes the snapshot after success
-   or failure. The source-directory binary is never executed.
-3. Have the approved operator wrapper create its own authenticated,
-   non-writable snapshot and initialize the profile's starter only from that
-   snapshot. A completed candidate-only validation does not make the mutable
-   source directory safe for later execution.
-4. Apply only the reviewed authored changes listed in the selected profile.
-   Do not edit generated YAML.
-5. Run the offline project `test`, `check`, and `build` commands. Inspect the
-   generated project, then record hashes of authored inputs, the build review,
-   and both generated closures.
-6. Deploy one candidate-digest Registry Relay, Registry Notary, and PostgreSQL
-   set per authority.
-7. Query the approved source-side probe before and after every closed test
-   case. The five trust denials must prove no data-operation contact.
-8. Retain raw evidence only in the approved restricted location. Publish only
-   safe result codes, timings, contact classifications, correlation hashes,
-   and evidence hashes.
-9. Seed restricted-value canaries. Scan restricted evidence before producing
-   the public artifact, then re-hash generated files and compare them with the
-   reviewed build hashes. The public runner separately scans the supplied
-   public result for the same canaries.
-10. Attempt scoped teardown from a `finally` path, even after a failed case.
-    Record its start and completion times, bounded duration, outcome, and
-    sanitized evidence hash.
-
-`source_data_access` counts only the profile's reviewed data operation. For
-OpenCRVS, OAuth or JSON Web Key Set (JWKS) traffic does not count as a
-`/registry/sync/search` call. The source-side evidence still has to account for
-that supporting traffic.
-
-The operator wrapper owns product credentials, network access, deployment
-details, project inspection, source probe invocation, restricted evidence
-inspection and storage, generated-file comparisons, and cleanup. A maintainer
-must compare the public hashes and flags with that restricted evidence. Those
-instance-specific operations are intentionally not embedded in this public
-runner.
-
-Run the candidate-only validation before creating the project:
-
-```sh
-python3 release/scripts/integration-e2-runner.py validate \
-  --candidate-dir /restricted/candidate-assets \
-  --tag v1.0.0
-```
-
-## Validate candidate evidence
-
-Create an owner-only canary file with one unique 8 to 128 character ASCII value
-per line. Canary values can contain letters, digits, `.`, `_`, `:`, `@`, and
-`-`. Seed the same values into the restricted test inputs so the scan can
-detect accidental disclosure. Do not pass canary values on the command line.
-
-```sh
-chmod 0600 /restricted/run-72.canaries
-
-python3 release/scripts/integration-e2-runner.py validate \
-  --profile opencrvs-dci-v1.9 \
-  --candidate-dir /restricted/candidate-assets \
-  --tag v1.0.0 \
-  --result /restricted/sanitized-run-result.json \
-  --canary-file /restricted/run-72.canaries
-```
-
-This validation requires `cosign` and `slsa-verifier`. The runner independently
-rejects missing or extra candidate assets, symlinks, wrong checksums, invalid
-signatures or provenance, capsule and image-lock disagreements, an unbounded
-result, an unknown public field, a public-result canary match, inconsistent
-timestamps or durations, a passed case without the required recorded
-source-contact classification, over-time recorded teardown, and a `passed`
-status paired with failed recorded teardown.
-
-Candidate validation always uses a disposable private snapshot. Replacing a
-file in the supplied candidate directory during or after validation cannot
-change the executable path used for the version check. The runner removes the
-snapshot in its cleanup path and never returns the snapshot path as an
-operator artifact.
-
-The public runner receives neither the generated project nor restricted raw
-evidence. It validates the closed flags, hashes, timings, and classifications
-in the sanitized result, but it cannot independently re-hash the project,
-inspect source-side audit records, or confirm the restricted redaction report.
-The operator wrapper performs those checks, and a maintainer reviews their
-restricted evidence before treating the result as proof.
-
-The result schema is
-[`schema/run-result.schema.json`](schema/run-result.schema.json). It is closed:
-raw responses, request bodies, headers, tokens, source identifiers, hostnames,
-and credentials have no public fields. A failed run can remain as honest
-non-closing evidence. The validator accepts `status: passed` only when every
-applicable case and teardown is recorded as passed; maintainer review still
-establishes whether the recorded hashes correspond to the restricted evidence.
-
-After an independent operator completes the frozen journey, use
-[`pilot-report.template.md`](pilot-report.template.md) to publish the bounded
-outcome, findings, and public triage links without copying restricted evidence
-into the repository. A plan or dry run is not evidence, and one pilot is not
-proof of broad production readiness.
-
-## Review the source packet
-
-- [`profiles/opencrvs-dci-v1.9.profile.json`](profiles/opencrvs-dci-v1.9.profile.json)
-  pins the OpenCRVS tuple and signed exact-UIN search.
-- [`profiles/dhis2-tracker-2.41.9.profile.json`](profiles/dhis2-tracker-2.41.9.profile.json)
-  pins DHIS2 2.41.9 and the singleton tracked-entity read.
-- [`schema/run-result.schema.json`](schema/run-result.schema.json) defines the
-  only public result shape.
-
-Review raw evidence and the owner attestation outside the public repository.
-Commit only the sanitized result after a maintainer compares its hashes and
-flags with the generated project, source audit records, redaction report, and
-teardown evidence. Candidate identity is the part the public runner verifies
-directly.
diff --git a/release/conformance/integrations/pilot-report.template.md b/release/conformance/integrations/pilot-report.template.md
deleted file mode 100644
index 497cdfc35..000000000
--- a/release/conformance/integrations/pilot-report.template.md
+++ /dev/null
@@ -1,86 +0,0 @@
-# External integration pilot report
-
-Use this template only after an independent operator has completed the frozen
-pilot journey. Publish a concise account of the outcome and link the validated,
-sanitized result. Do not include credentials, network origins, operator or
-source identifiers, record identifiers, raw audits, private evidence, or links
-to restricted evidence.
-
-Plans, dry runs, fixture runs, and source-built branch runs are not pilot
-evidence. One completed pilot is not proof of broad production readiness.
-An integration pilot alone does not close Country ready or First-country
-success.
-
-## Closing evidence
-
-- Sanitized run result: [link to the public result accepted by
-  `python3 release/scripts/integration-e2-runner.py validate`]
-- Frozen Registry Stack candidate: [link to the published release]
-- Independent operator: [confirmed or not confirmed; do not identify the
-  operator]
-- Owner-approved non-production source: [confirmed or not confirmed; do not
-  identify the owner or source]
-- Integration profile and reviewed operation: [safe public summary; the exact
-  values remain in the sanitized result]
-- Supported topology and journey: [safe public summary]
-- Generated Registry YAML edited by hand: [no, or explain why the pilot does
-  not close]
-- Maintainer comparison of public hashes and flags with restricted evidence:
-  [confirmed or not confirmed; do not identify the maintainer or expose
-  restricted evidence]
-- Overall outcome: [passed, failed, or incomplete]
-
-Issue closure still requires a frozen published candidate, an independent
-operator, an owner-approved source, and a confirmed maintainer comparison of
-the public hashes and flags with the generated project, source audit records,
-redaction report, and teardown evidence. A plan or maintainer-run substitute
-cannot satisfy any of these requirements.
-
-## What the pilot did and did not prove
-
-The pilot showed: [summarize only the bounded journey completed from published
-artifacts, including offline checks and the selected Relay and, when
-applicable, Notary flow].
-
-The pilot did not show: [summarize excluded versions, operations, topologies,
-scale, availability, recovery, or other support claims]. It is not upstream
-product certification, general country-system conformance, a security audit,
-or evidence that Registry Stack is broadly production-ready.
-
-## Findings and triage
-
-Use safe summaries and public issue or pull-request links. Record `not
-exercised` rather than inferring success.
-
-| Area | Exercised | Sanitized outcome | Public triage links |
-|---|---|---|---|
-| Operator handoff and independence | [yes/no] | [summary] | [links or none] |
-| Install or deployment | [yes/no] | [summary] | [links or none] |
-| Configuration and environment binding | [yes/no] | [summary] | [links or none] |
-| Diagnostics and ordinary source failures | [yes/no] | [summary] | [links or none] |
-| Upgrade or rollback | [yes/no] | [summary] | [links or none] |
-| Restart, teardown, and other operations | [yes/no] | [summary] | [links or none] |
-| Security boundaries and redaction | [yes/no] | [summary] | [links or none] |
-| Documentation and operator journey | [yes/no] | [summary] | [links or none] |
-
-### Blocking findings
-
-List each blocker with its public triage issue, fix, and independent
-re-verification link. Unresolved blockers keep the pilot open.
-
-- [none, or safe finding summary and links]
-
-### Accepted limitations and narrowed support
-
-List each owner-approved limitation or narrowed support claim with its public
-decision, operator-guidance update, support-wording update, and review trigger.
-Do not use this section to waive a blocker silently.
-
-- [none, or safe limitation summary and links]
-
-## Conclusion
-
-[State whether the bounded pilot closes the external-pilot gate, remains
-blocked, or requires a narrower support claim. It cannot close unless the
-maintainer comparison above is confirmed. Reiterate any unexercised area that
-affects the conclusion.]
diff --git a/release/conformance/integrations/profiles/dhis2-tracker-2.41.9.profile.json b/release/conformance/integrations/profiles/dhis2-tracker-2.41.9.profile.json
deleted file mode 100644
index b74e88f7f..000000000
--- a/release/conformance/integrations/profiles/dhis2-tracker-2.41.9.profile.json
+++ /dev/null
@@ -1,85 +0,0 @@
-{
-  "schema_version": "registry.release.integration_e2_profile.v1",
-  "profile_id": "dhis2-tracker-2.41.9",
-  "support_status": "Registry Stack-supported unofficial integration profile",
-  "starter": "dhis2-tracker",
-  "source": {
-    "product": "dhis2-tracker",
-    "baseline": [
-      {
-        "component": "dhis2",
-        "version": "2.41.9",
-        "commit": "ce6404687f6a5806e2661cffe4bc7a1d9b2ad2ed"
-      }
-    ],
-    "operations": [
-      {
-        "id": "tracked-entity-read",
-        "role": "data",
-        "method": "GET",
-        "path": "/api/tracker/trackedEntities/{uid}",
-        "selector": "exact tracked entity UID",
-        "field_projection": "trackedEntity,attributes[attribute,value],enrollments[program,status,events[programStage,status]]",
-        "max_calls": 1
-      }
-    ]
-  },
-  "authored_contract": {
-    "integration_alias": "health-record",
-    "generated_yaml_edits_allowed": false,
-    "reviewed_changes": [
-      "Replace every DEMO_* metadata UID in the authored Rhai adapter with an owner-attested instance value.",
-      "Keep the exact singleton trackedEntities resource path, reviewed field projection, and echoed UID comparison.",
-      "Bind the owner-attested source origin and Basic authentication through the reviewed environment input.",
-      "Keep source origins, metadata UIDs, selectors, and credentials out of the checked-in profile and public result."
-    ]
-  },
-  "dynamic_inputs": [
-    { "env": "DHIS2_SOURCE_ORIGIN", "classification": "restricted", "purpose": "source origin" },
-    { "env": "DHIS2_USERNAME", "classification": "secret", "purpose": "Basic authentication username" },
-    { "env": "DHIS2_PASSWORD", "classification": "secret", "purpose": "Basic authentication password" },
-    { "env": "DHIS2_CHILD_PROGRAM_UID", "classification": "restricted", "purpose": "child programme metadata" },
-    { "env": "DHIS2_MATERNAL_PROGRAM_UID", "classification": "restricted", "purpose": "maternal programme metadata" },
-    { "env": "DHIS2_TB_PROGRAM_UID", "classification": "restricted", "purpose": "tuberculosis programme metadata" },
-    { "env": "DHIS2_CHILD_VISIT_STAGE_UID", "classification": "restricted", "purpose": "child visit stage metadata" },
-    { "env": "DHIS2_BCG_BIRTH_STAGE_UID", "classification": "restricted", "purpose": "BCG birth-dose stage metadata" },
-    { "env": "DHIS2_OPV_BIRTH_STAGE_UID", "classification": "restricted", "purpose": "OPV birth-dose stage metadata" },
-    { "env": "DHIS2_MEASLES_STAGE_UID", "classification": "restricted", "purpose": "measles-dose stage metadata" },
-    { "env": "DHIS2_FIRST_NAME_ATTRIBUTE_UID", "classification": "restricted", "purpose": "first-name attribute metadata" },
-    { "env": "DHIS2_LAST_NAME_ATTRIBUTE_UID", "classification": "restricted", "purpose": "last-name attribute metadata" },
-    { "env": "DHIS2_BIRTH_DATE_ATTRIBUTE_UID", "classification": "restricted", "purpose": "birth-date attribute metadata" },
-    { "env": "DHIS2_RECONCILIATION_ATTRIBUTE_UID", "classification": "restricted", "purpose": "reconciliation attribute metadata" },
-    { "env": "DHIS2_MATCH_TRACKED_ENTITY", "classification": "subject", "purpose": "match selector" },
-    { "env": "DHIS2_NO_MATCH_TRACKED_ENTITY", "classification": "subject", "purpose": "no-match selector" },
-    { "env": "DHIS2_MISMATCH_TRACKED_ENTITY", "classification": "subject", "purpose": "selector-mismatch selector" },
-    { "env": "REGISTRY_INTEGRATION_E2_SOURCE_PROBE", "classification": "restricted", "purpose": "source-side audit probe path" },
-    { "env": "REGISTRY_INTEGRATION_E2_CANARY_FILE", "classification": "restricted", "purpose": "redaction canary file path" }
-  ],
-  "cases": [
-    { "id": "authorized-match", "expected_result_code": "match", "expected_source_data_access": "contacted_once" },
-    { "id": "authorized-no-match", "expected_result_code": "no-match", "expected_source_data_access": "contacted_once" },
-    { "id": "ambiguity", "expected_result_code": "not-applicable", "expected_source_data_access": "not_applicable" },
-    { "id": "invalid-selector", "expected_result_code": "invalid-selector", "expected_source_data_access": "not_contacted" },
-    { "id": "wrong-caller", "expected_result_code": "denied-wrong-caller", "expected_source_data_access": "not_contacted" },
-    { "id": "missing-scope", "expected_result_code": "denied-missing-scope", "expected_source_data_access": "not_contacted" },
-    { "id": "wrong-purpose", "expected_result_code": "denied-wrong-purpose", "expected_source_data_access": "not_contacted" },
-    { "id": "stale-contract", "expected_result_code": "denied-stale-contract", "expected_source_data_access": "not_contacted" },
-    { "id": "subject-mismatch", "expected_result_code": "subject-mismatch", "expected_source_data_access": "contacted_once" },
-    { "id": "source-authorization-failure", "expected_result_code": "source-authorization-failure", "expected_source_data_access": "contacted_once" },
-    { "id": "deadline-enforced", "expected_result_code": "deadline-exceeded", "expected_source_data_access": "contacted_once" }
-  ],
-  "prerequisites": [
-    "A frozen published Registry Stack 1.0 candidate with independently verified assets.",
-    "An owner-approved non-production DHIS2 2.41.9 instance provides stable match, no-match, mismatch, authorization-failure, and delayed-response cases.",
-    "Every DEMO_* value in the starter is replaced by an owner-attested metadata UID before project test, check, and build.",
-    "Source-side audit or request-counter access can prove whether the tracked entity operation was contacted for every case.",
-    "Restricted raw-evidence storage, retention, redaction review, and scoped teardown are approved."
-  ],
-  "limits": {
-    "case_timeout_seconds": 30,
-    "run_timeout_seconds": 1200,
-    "raw_evidence_bytes": 8388608,
-    "public_result_bytes": 1048576,
-    "teardown_timeout_seconds": 300
-  }
-}
diff --git a/release/conformance/integrations/profiles/opencrvs-dci-v1.9.profile.json b/release/conformance/integrations/profiles/opencrvs-dci-v1.9.profile.json
deleted file mode 100644
index bc2b54959..000000000
--- a/release/conformance/integrations/profiles/opencrvs-dci-v1.9.profile.json
+++ /dev/null
@@ -1,104 +0,0 @@
-{
-  "schema_version": "registry.release.integration_e2_profile.v1",
-  "profile_id": "opencrvs-dci-v1.9",
-  "support_status": "Registry Stack-supported unofficial integration profile",
-  "starter": "opencrvs-dci",
-  "source": {
-    "product": "opencrvs",
-    "baseline": [
-      {
-        "component": "dci-adapter",
-        "version": "v1.9.0-rc.1",
-        "commit": "5e31d1e381d4bd8c7c74112d714fd49d263c6df7"
-      },
-      {
-        "component": "core",
-        "version": "v1.9.5",
-        "commit": "7243ccb79eb84254420878ff5146c6e50f084554"
-      },
-      {
-        "component": "farajaland",
-        "version": "v1.9.5",
-        "commit": "3c1a5612d8d7bebddd43463682860b38ef14bcb4"
-      }
-    ],
-    "operations": [
-      {
-        "id": "oauth-token",
-        "role": "credential",
-        "method": "POST",
-        "path": "owner-attested",
-        "max_calls": 1
-      },
-      {
-        "id": "jwks",
-        "role": "verification",
-        "method": "GET",
-        "path": "owner-attested",
-        "max_calls": 1
-      },
-      {
-        "id": "signed-uin-search",
-        "role": "data",
-        "method": "POST",
-        "path": "/registry/sync/search",
-        "selector": "exact UIN",
-        "max_calls": 1
-      }
-    ]
-  },
-  "authored_contract": {
-    "integration_alias": "birth-record",
-    "generated_yaml_edits_allowed": false,
-    "reviewed_changes": [
-      "Replace the synthetic /dci/v1/birth/search path with /registry/sync/search only after the compatibility probe passes.",
-      "Bind the owner-attested OAuth, JWKS, sender, receiver, registry, and record identifiers through the reviewed project inputs.",
-      "Keep the signed DCI helper and exact UIN selector verification in the authored integration and Rhai adapter.",
-      "Keep source origins and all live values out of the checked-in profile and public result."
-    ]
-  },
-  "dynamic_inputs": [
-    { "env": "OPENCRVS_SOURCE_ORIGIN", "classification": "restricted", "purpose": "source origin" },
-    { "env": "OPENCRVS_OAUTH_ORIGIN", "classification": "restricted", "purpose": "OAuth origin" },
-    { "env": "OPENCRVS_OAUTH_PATH", "classification": "restricted", "purpose": "OAuth token path" },
-    { "env": "OPENCRVS_JWKS_ORIGIN", "classification": "restricted", "purpose": "JWKS origin" },
-    { "env": "OPENCRVS_JWKS_PATH", "classification": "restricted", "purpose": "JWKS path" },
-    { "env": "OPENCRVS_SENDER_ID", "classification": "restricted", "purpose": "DCI sender" },
-    { "env": "OPENCRVS_RECEIVER_ID", "classification": "restricted", "purpose": "DCI receiver" },
-    { "env": "OPENCRVS_CLIENT_ID", "classification": "secret", "purpose": "OAuth client id" },
-    { "env": "OPENCRVS_CLIENT_SECRET", "classification": "secret", "purpose": "OAuth client secret" },
-    { "env": "OPENCRVS_MATCH_UIN", "classification": "subject", "purpose": "match selector" },
-    { "env": "OPENCRVS_NO_MATCH_UIN", "classification": "subject", "purpose": "no-match selector" },
-    { "env": "OPENCRVS_AMBIGUOUS_UIN", "classification": "subject", "purpose": "ambiguity selector" },
-    { "env": "OPENCRVS_MISMATCH_UIN", "classification": "subject", "purpose": "selector-mismatch selector" },
-    { "env": "REGISTRY_INTEGRATION_E2_SOURCE_PROBE", "classification": "restricted", "purpose": "source-side audit probe path" },
-    { "env": "REGISTRY_INTEGRATION_E2_CANARY_FILE", "classification": "restricted", "purpose": "redaction canary file path" }
-  ],
-  "cases": [
-    { "id": "authorized-match", "expected_result_code": "match", "expected_source_data_access": "contacted_once" },
-    { "id": "authorized-no-match", "expected_result_code": "no-match", "expected_source_data_access": "contacted_once" },
-    { "id": "ambiguity", "expected_result_code": "ambiguous", "expected_source_data_access": "contacted_once" },
-    { "id": "invalid-selector", "expected_result_code": "invalid-selector", "expected_source_data_access": "not_contacted" },
-    { "id": "wrong-caller", "expected_result_code": "denied-wrong-caller", "expected_source_data_access": "not_contacted" },
-    { "id": "missing-scope", "expected_result_code": "denied-missing-scope", "expected_source_data_access": "not_contacted" },
-    { "id": "wrong-purpose", "expected_result_code": "denied-wrong-purpose", "expected_source_data_access": "not_contacted" },
-    { "id": "stale-contract", "expected_result_code": "denied-stale-contract", "expected_source_data_access": "not_contacted" },
-    { "id": "subject-mismatch", "expected_result_code": "subject-mismatch", "expected_source_data_access": "contacted_once" },
-    { "id": "source-authorization-failure", "expected_result_code": "source-authorization-failure", "expected_source_data_access": "not_contacted" },
-    { "id": "deadline-enforced", "expected_result_code": "deadline-exceeded", "expected_source_data_access": "contacted_once" }
-  ],
-  "prerequisites": [
-    "A frozen published Registry Stack 1.0 candidate with independently verified assets.",
-    "The /registry/sync/search compatibility probe passes against the exact owner-attested tuple.",
-    "An owner-approved non-production instance provides stable match, no-match, ambiguity, mismatch, authorization-failure, and delayed-response cases.",
-    "Source-side audit or request-counter access can prove whether /registry/sync/search was contacted for every case.",
-    "Restricted raw-evidence storage, retention, redaction review, and scoped teardown are approved."
-  ],
-  "limits": {
-    "case_timeout_seconds": 60,
-    "run_timeout_seconds": 1800,
-    "raw_evidence_bytes": 8388608,
-    "public_result_bytes": 1048576,
-    "teardown_timeout_seconds": 300
-  }
-}
diff --git a/release/conformance/integrations/schema/run-result.schema.json b/release/conformance/integrations/schema/run-result.schema.json
deleted file mode 100644
index b47653c85..000000000
--- a/release/conformance/integrations/schema/run-result.schema.json
+++ /dev/null
@@ -1,259 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://registrystack.org/schemas/release/integration-e2-run-result-v1.json",
-  "title": "Registry Stack integration E2 public run result",
-  "description": "Closed, redaction-safe public evidence for one published-candidate OpenCRVS or DHIS2 integration run. Raw source evidence is intentionally excluded.",
-  "type": "object",
-  "additionalProperties": false,
-  "required": [
-    "schema_version",
-    "record_kind",
-    "run_id",
-    "profile_id",
-    "support_status",
-    "status",
-    "started_at",
-    "completed_at",
-    "release",
-    "source",
-    "project",
-    "cases",
-    "redaction",
-    "teardown",
-    "limitations"
-  ],
-  "properties": {
-    "schema_version": { "const": "registry.release.integration_e2_run_result.v1" },
-    "record_kind": { "const": "candidate_evidence" },
-    "run_id": { "$ref": "#/$defs/slug" },
-    "profile_id": {
-      "enum": ["opencrvs-dci-v1.9", "dhis2-tracker-2.41.9"]
-    },
-    "support_status": {
-      "const": "Registry Stack-supported unofficial integration profile"
-    },
-    "status": { "enum": ["passed", "failed"] },
-    "started_at": { "$ref": "#/$defs/timestamp" },
-    "completed_at": { "$ref": "#/$defs/timestamp" },
-    "release": { "$ref": "#/$defs/release" },
-    "source": { "$ref": "#/$defs/source" },
-    "project": { "$ref": "#/$defs/project" },
-    "cases": {
-      "type": "array",
-      "minItems": 11,
-      "maxItems": 11,
-      "items": { "$ref": "#/$defs/case" }
-    },
-    "redaction": { "$ref": "#/$defs/redaction" },
-    "teardown": { "$ref": "#/$defs/teardown" },
-    "limitations": {
-      "type": "array",
-      "minItems": 4,
-      "maxItems": 6,
-      "uniqueItems": true,
-      "items": {
-        "enum": [
-          "unofficial-integration-profile",
-          "single-pinned-product-version",
-          "single-reviewed-read-operation",
-          "non-production-instance",
-          "not-product-certification",
-          "not-general-country-system-conformance"
-        ]
-      }
-    }
-  },
-  "$defs": {
-    "slug": {
-      "type": "string",
-      "pattern": "^[a-z0-9][a-z0-9._-]{0,127}$"
-    },
-    "sha256": {
-      "type": "string",
-      "pattern": "^sha256:[0-9a-f]{64}$"
-    },
-    "commit": {
-      "type": "string",
-      "pattern": "^[0-9a-f]{40}$"
-    },
-    "timestamp": {
-      "type": "string",
-      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{3})?Z$"
-    },
-    "image": {
-      "type": "string",
-      "pattern": "^ghcr\\.io/registrystack/registry-(?:relay|notary)@sha256:[0-9a-f]{64}$"
-    },
-    "baseline": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["component", "version", "commit"],
-      "properties": {
-        "component": { "$ref": "#/$defs/slug" },
-        "version": { "type": "string", "pattern": "^[0-9A-Za-z][0-9A-Za-z.+-]{0,63}$" },
-        "commit": { "$ref": "#/$defs/commit" }
-      }
-    },
-    "release": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "tag",
-        "version",
-        "source_commit",
-        "registryctl_asset_sha256",
-        "image_lock_sha256",
-        "release_capsule_sha256",
-        "relay_image",
-        "notary_image",
-        "candidate_assets_verified",
-        "authenticity_verified"
-      ],
-      "properties": {
-        "tag": { "type": "string", "pattern": "^v[0-9]+\\.[0-9]+\\.[0-9]+$" },
-        "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
-        "source_commit": { "$ref": "#/$defs/commit" },
-        "registryctl_asset_sha256": { "$ref": "#/$defs/sha256" },
-        "image_lock_sha256": { "$ref": "#/$defs/sha256" },
-        "release_capsule_sha256": { "$ref": "#/$defs/sha256" },
-        "relay_image": { "$ref": "#/$defs/image" },
-        "notary_image": { "$ref": "#/$defs/image" },
-        "candidate_assets_verified": { "const": true },
-        "authenticity_verified": { "const": true }
-      }
-    },
-    "source": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["product", "baseline", "operation_id", "method", "path", "owner_attestation_sha256"],
-      "properties": {
-        "product": { "enum": ["opencrvs", "dhis2-tracker"] },
-        "baseline": {
-          "type": "array",
-          "minItems": 1,
-          "maxItems": 3,
-          "items": { "$ref": "#/$defs/baseline" }
-        },
-        "operation_id": { "$ref": "#/$defs/slug" },
-        "method": { "enum": ["GET", "POST"] },
-        "path": {
-          "enum": ["/registry/sync/search", "/api/tracker/trackedEntities/{uid}"]
-        },
-        "owner_attestation_sha256": { "$ref": "#/$defs/sha256" }
-      }
-    },
-    "project": {
-      "type": "object",
-      "description": "Operator-attested project hashes and generated-file comparison. The public validator validates this shape but does not receive the project files.",
-      "additionalProperties": false,
-      "required": [
-        "starter",
-        "starter_content_digest",
-        "authored_inputs_sha256",
-        "build_review_sha256",
-        "relay_closure_sha256",
-        "notary_closure_sha256",
-        "generated_files_unchanged"
-      ],
-      "properties": {
-        "starter": { "enum": ["opencrvs-dci", "dhis2-tracker"] },
-        "starter_content_digest": { "$ref": "#/$defs/sha256" },
-        "authored_inputs_sha256": { "$ref": "#/$defs/sha256" },
-        "build_review_sha256": { "$ref": "#/$defs/sha256" },
-        "relay_closure_sha256": { "$ref": "#/$defs/sha256" },
-        "notary_closure_sha256": { "$ref": "#/$defs/sha256" },
-        "generated_files_unchanged": {
-          "description": "Operator and maintainer attestation backed by restricted comparison evidence.",
-          "const": true
-        }
-      }
-    },
-    "case": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "case_id",
-        "outcome",
-        "started_at",
-        "completed_at",
-        "duration_ms",
-        "result_code",
-        "source_data_access",
-        "source_data_access_evidence_sha256",
-        "audit_correlation_sha256",
-        "evidence_sha256"
-      ],
-      "properties": {
-        "case_id": {
-          "enum": [
-            "authorized-match",
-            "authorized-no-match",
-            "ambiguity",
-            "invalid-selector",
-            "wrong-caller",
-            "missing-scope",
-            "wrong-purpose",
-            "stale-contract",
-            "subject-mismatch",
-            "source-authorization-failure",
-            "deadline-enforced"
-          ]
-        },
-        "outcome": { "enum": ["passed", "failed", "not_applicable"] },
-        "started_at": { "$ref": "#/$defs/timestamp" },
-        "completed_at": { "$ref": "#/$defs/timestamp" },
-        "duration_ms": { "type": "integer", "minimum": 0, "maximum": 1800000 },
-        "result_code": { "$ref": "#/$defs/slug" },
-        "source_data_access": {
-          "enum": ["not_contacted", "contacted_once", "not_applicable", "unknown"]
-        },
-        "source_data_access_evidence_sha256": { "$ref": "#/$defs/sha256" },
-        "audit_correlation_sha256": { "$ref": "#/$defs/sha256" },
-        "evidence_sha256": { "$ref": "#/$defs/sha256" }
-      }
-    },
-    "redaction": {
-      "type": "object",
-      "description": "Operator-attested restricted-evidence scan summary. The public runner independently scans only the supplied public result for canaries.",
-      "additionalProperties": false,
-      "required": [
-        "passed",
-        "scanned_artifacts",
-        "scanned_bytes",
-        "seeded_canaries",
-        "forbidden_values_found",
-        "restricted_raw_evidence_bytes",
-        "raw_evidence_retained_restricted",
-        "report_sha256"
-      ],
-      "properties": {
-        "passed": { "const": true },
-        "scanned_artifacts": { "type": "integer", "minimum": 1, "maximum": 4096 },
-        "scanned_bytes": { "type": "integer", "minimum": 1, "maximum": 67108864 },
-        "seeded_canaries": { "type": "integer", "minimum": 1, "maximum": 128 },
-        "forbidden_values_found": { "const": 0 },
-        "restricted_raw_evidence_bytes": {
-          "type": "integer",
-          "minimum": 1,
-          "maximum": 8388608
-        },
-        "raw_evidence_retained_restricted": { "const": true },
-        "report_sha256": { "$ref": "#/$defs/sha256" }
-      }
-    },
-    "teardown": {
-      "type": "object",
-      "description": "Operator-attested scoped teardown result with validator-cross-checked public timing fields.",
-      "additionalProperties": false,
-      "required": ["attempted", "status", "started_at", "duration_ms", "completed_at", "evidence_sha256"],
-      "properties": {
-        "attempted": { "const": true },
-        "status": { "enum": ["completed", "failed"] },
-        "started_at": { "$ref": "#/$defs/timestamp" },
-        "duration_ms": { "type": "integer", "minimum": 0, "maximum": 1800000 },
-        "completed_at": { "$ref": "#/$defs/timestamp" },
-        "evidence_sha256": { "$ref": "#/$defs/sha256" }
-      }
-    }
-  }
-}
diff --git a/release/conformance/openid/README.md b/release/conformance/openid/README.md
deleted file mode 100644
index 239c170a1..000000000
--- a/release/conformance/openid/README.md
+++ /dev/null
@@ -1,286 +0,0 @@
-# OpenID conformance suite
-
-This directory owns Registry Stack's wrapper for the OpenID Foundation
-conformance suite. It stays with the release surface so conformance work does
-not depend on a mutable hosted environment or on the separately maintained
-[Solmara Lab](https://github.com/registrystack/solmara-lab).
-
-The wrapper pins the upstream suite checkout to `release-v5.2.0`
-(`dee9a25160e789f0f80517674693ef7989ab9fa1`) and overlays the upstream Compose
-files with digest-pinned MongoDB, Maven, Nginx, and Java images. The suite JAR
-cache is bound to the checked-out commit, and the suite's Python helpers install
-from the checked-in fully hashed lock only when its upstream requirements still
-match the reviewed input. A different suite ref can be supplied for
-investigation, but results from an override are not evidence for the checked-in
-mapping until the image, Python, and JAR pins are reviewed with it.
-
-## Evidence boundary
-
-The checked-in runner, plan map, and non-secret configuration template make
-the suite invocation repeatable. They are not external conformance evidence by
-themselves:
-
-- The supported Registry Notary topology must use a frozen release-candidate
-  image pinned by digest and checked-in non-secret configuration.
-- The owner-only `submit-offer` adapter can send the real issuer-initiated
-  pre-authorized offer to the suite's `/credential_offer` callback without
-  exposing it in process arguments or command output.
-- The upstream full-plan shape currently selects DPoP. Registry Notary 1.0 does
-  not support or claim DPoP, wallet attestation, PAR, EUDI, HAIP, an
-  authorization-code wallet grant, or ES256 holder proof.
-- Registry Relay uses the separate
-  [candidate-neutral Relay and Zitadel smoke](../relay-oidc/README.md) with
-  `auth.mode: oidc`. The OIDF suite has no generic resource-server plan for
-  that surface.
-
-Development and historical demo runs are not release evidence. A reviewed
-result becomes evidence only when it records the candidate image digest, suite
-commit, exact plan variants, configuration digest, start and completion times,
-and unmodified result status without retaining secrets.
-
-`promote-evidence` provides that source-side boundary for the metadata-only
-slice. It authenticates the referenced published candidate through the same
-signed image lock, release capsule, provenance, checksums, local tag target, and
-manifest binding used by the other conformance tooling. Candidate fields are
-derived, not supplied individually. The OIDF export cannot prove that the
-tested endpoint ran that candidate image, so the summary marks that association
-as operator-attested and pending review. The command creates a new, closed JSON
-summary for separate maintainer review. It does not make the summary
-certification evidence by itself.
-
-## Plan mapping
-
-[`plan-map.json`](plan-map.json) is the machine-readable mapping.
-
-- `notary-oid4vci-issuer-metadata` is a candidate-only slice for Registry
-  Notary's registry-backed OID4VCI issuer. It runs
-  `oid4vci-1_0-issuer-test-plan` with only
-  `oid4vci-1_0-issuer-metadata-test`.
-- `notary-oid4vci-issuer-full` is mapped but blocked until the suite path
-  matches the supported Registry Notary profile. The offer adapter closes only
-  the callback transport gap; it does not add DPoP, attestation, batch,
-  notification, or other unsupported product behavior.
-
-The suite's `sender_constrain=dpop` selector is required by the upstream plan
-shape. The metadata-only module does not exercise DPoP, and the selector must
-not be reported as product support.
-
-The map also records why Relay OIDC bearer validation and third-party OpenID
-Providers are outside the available OIDF plan set. That exclusion is not a
-substitute for exercising Relay's OIDC path. The release-owned Relay smoke is
-directly runnable against a published image digest, but its output remains
-unreviewed until a maintainer binds it to the release candidate.
-
-## Prerequisites
-
-- Python 3.11 or later
-- Git
-- Docker with Docker Compose
-- A Registry Notary issuer whose image is pinned by digest and whose issuer URL
-  is reachable from the conformance-suite container
-
-## Run the candidate metadata slice
-
-List the mapped scenarios, prepare the pinned suite, and start it:
-
-```bash
-release/scripts/openid-conformance-runner.py list
-release/scripts/openid-conformance-runner.py prepare
-release/scripts/openid-conformance-runner.py up
-```
-
-Start the frozen Registry Notary candidate topology separately. Its configured credential
-issuer URL must exactly match its metadata and be reachable from the suite
-container. Then run:
-
-```bash
-REGISTRY_OPENID_CONFORMANCE_ISSUER_URL="https://issuer.example.test" \
-  release/scripts/openid-conformance-runner.py run \
-  notary-oid4vci-issuer-metadata
-```
-
-Candidate-only scenarios are directly runnable. `--allow-blocked` is reserved
-for deliberate investigation of scenarios whose status is explicitly blocked;
-it does not turn their output into release evidence.
-
-For an issuer-initiated suite module, store the exact
-`openid-credential-offer` URI rendered after Notary completes its authenticated
-`/oid4vci/offer/callback` in an owner-only file. After `up`, export the exact
-self-signed certificate generated for the suite's Nginx service from
-`/etc/ssl/certs/nginx-selfsigned.crt`, then submit the offer:
-
-```bash
-release/scripts/openid-conformance-runner.py export-suite-ca \
-  --output target/openid-conformance/conformance-suite-ca.pem
-
-chmod 600 /private/path/notary-offer.txt
-release/scripts/openid-conformance-runner.py submit-offer \
-  --offer-file /private/path/notary-offer.txt \
-  --issuer-url https://issuer.example.test \
-  --suite-offer-endpoint 'https://localhost.emobix.co.uk:8443/<module>/credential_offer' \
-  --suite-ca-certificate target/openid-conformance/conformance-suite-ca.pem
-```
-
-The adapter accepts only an inline Notary offer with the pre-authorized-code
-grant, sends it once to the pinned suite origin without proxies or redirects,
-and prints no offer content. TLS uses normal hostname and certificate
-validation. The checked-in certificate recipe covers
-`localhost.emobix.co.uk`, `localhost`, `127.0.0.1`, and `::1`. The optional CA
-file is read once without following symlinks and adds only that explicitly
-captured local trust anchor. The export command refuses to overwrite an
-existing output. A fabricated offer is not candidate evidence.
-
-Set `REGISTRY_OPENID_CONFORMANCE_AUTHORIZATION_SERVER` when the authorization
-server differs from the issuer. Set
-`REGISTRY_OPENID_CONFORMANCE_CREDENTIAL_CONFIGURATION_ID` when the topology
-does not use the default `person_is_alive_sd_jwt` identifier.
-
-Use `--dry-run` to render configuration and inspect the exact suite command
-without starting a test plan:
-
-```bash
-REGISTRY_OPENID_CONFORMANCE_ISSUER_URL="https://issuer.example.test" \
-  release/scripts/openid-conformance-runner.py run \
-  notary-oid4vci-issuer-metadata --dry-run
-```
-
-Stop the suite when finished:
-
-```bash
-release/scripts/openid-conformance-runner.py down
-```
-
-The checkout, Python environment, Maven cache, rendered configuration, and
-exported suite artifacts live under `target/openid-conformance/`, which Git
-ignores.
-
-## Promote a result for review
-
-Keep the raw plan export outside the repository and make it owner-only. Download
-the candidate's `registryctl-<tag>-image-lock.json`, its `.sig` and `.pem`, the
-release capsule and its `.sig` and `.pem`, release provenance, and
-`SHA256SUMS` into one private directory. Fetch the immutable release tag and
-install `cosign` and `slsa-verifier`.
-
-While the same suite instance used for the run is still running, capture its
-generated CA and `/jwks` signing-key response through the runner's authenticated
-HTTPS path:
-
-```bash
-release/scripts/openid-conformance-runner.py export-suite-ca \
-  --output /private/oidf/suite-ca.pem
-
-release/scripts/openid-conformance-runner.py export-suite-jwks \
-  --conformance-server https://localhost.emobix.co.uk:8443 \
-  --suite-ca-certificate /private/oidf/suite-ca.pem \
-  --output /private/oidf/suite-jwks.json
-```
-
-The JWKS command disables proxies and redirects, validates a closed RSA signing
-key shape, and refuses to overwrite its owner-only output. Do not restart or
-replace the suite after this capture. Run the metadata slice with an explicit
-private output directory:
-
-```bash
-mkdir -m 700 /private/oidf/metadata-run
-
-REGISTRY_OPENID_CONFORMANCE_ISSUER_URL="https://issuer.example.test" \
-  release/scripts/openid-conformance-runner.py run \
-  notary-oid4vci-issuer-metadata \
-  --output-dir /private/oidf/metadata-run
-```
-
-The wrapper passes that directory to the pinned upstream runner as
-`--export-dir`. The completed directory contains the rendered configuration
-and exactly one plan-export ZIP for this one-module slice. There is no separate
-UI download step. Keep the same suite instance running until the command
-finishes, then identify the ZIP and make it owner-only:
-
-```bash
-find /private/oidf/metadata-run -maxdepth 1 -type f -name '*.zip' -print
-chmod 600 /private/oidf/metadata-run/<plan-export>.zip
-
-release/scripts/openid-conformance-runner.py promote-evidence \
-  --suite-export /private/oidf/metadata-run/<plan-export>.zip \
-  --suite-jwks /private/oidf/suite-jwks.json \
-  --release-manifest release/manifests/registry-stack-<release-id>.yaml \
-  --image-lock /private/release/registryctl-<tag>-image-lock.json \
-  --output /private/review/openid-metadata-evidence.json
-```
-
-The command refuses to overwrite the output. It accepts only the single
-`oid4vci-1_0-issuer-metadata-test` JSON export and its matching signature,
-rejects unsafe or unexpected ZIP entries, and verifies the Base64URL
-SHA256withRSA signature over the exact JSON bytes against exactly one captured
-suite key. The filename run identifier must match `testInfo._id`,
-`testInfo.testId`, and every considered log entry.
-
-The authoritative module status must be `FINISHED`. Its `PASSED`, `FAILED`,
-`WARNING`, `REVIEW`, `SKIPPED`, or `UNKNOWN` result is copied unchanged. The
-archive does not contain a plan verdict or runner exit status. Completion time
-comes from the matching terminal log event. Condition identifiers and messages
-are not copied. The summary retains only aggregate informational, successful,
-review, warning, and failure counts.
-
-The summary records:
-
-- the authenticated release tag target, manifest source ref, signed capsule,
-  image-lock hashes, and exact Registry Notary image digest;
-- the exact issuer URL from the signed runtime configuration and its explicit
-  operator-attested association with the candidate deployment;
-- the pinned 40-character suite commit, release tag, signed export's matching
-  reported version and origin, exact scenario, expected plan, module, variants,
-  and the explicit operator-attested plan and commit associations;
-- the canonical SHA-256 digest of the captured suite JWKS and successful
-  exact-byte export signature verification;
-- SHA-256 digests of the checked-in plan map and configuration template;
-- a digest of the effective runtime configuration after replacing only
-  `vci.static_tx_code` with the fixed `<redacted>` marker; and
-- the suite start time, terminal-log completion time, terminal status,
-  unmodified result, and condition outcome counts.
-
-The transaction code is not copied or hashed because a digest of a
-low-entropy code would be brute-forceable. The public summary includes no raw
-export hash, plan or module instance id, free-form message, request, response,
-token, proof, credential, civil identifier, or suite log. Its committed shape
-is [`evidence-summary.schema.json`](evidence-summary.schema.json), which the
-command validates before writing output. Review the candidate deployment
-evidence, suite checkout and runtime, and summary separately before committing
-it as release evidence.
-
-When advancing the suite ref, compare its `scripts/requirements.txt` with
-`python-requirements.in`. After review, regenerate the hashed lock with the
-command recorded at the top of `python-requirements.txt`. Dependabot scans that
-pip-compile lock weekly, while the runner keeps its direct input byte-bound to
-the pinned suite. Review the four image tags and refresh their immutable digests
-through the matching Dependabot Dockerfile and Docker Compose updates.
-`prepare` reuses the suite JAR only while its recorded source ref, builder
-override digest, and artifact digest still match.
-
-## Sensitive result handling
-
-Do not commit a raw result export. Full-flow output may include bearer tokens,
-proof JWTs, issued credentials, transaction codes, or seeded civil identifiers.
-The promotion command reads the private export only to validate the selected
-module, terminal record, safe runtime-configuration shape, and condition
-counts. It constructs the public summary
-from an explicit allowlist and checks that sensitive raw values did not cross
-that boundary. A failed, warned, skipped, review, or unknown result remains
-visible and is never upgraded to a pass.
-
-A promoted summary is still unreviewed candidate output until a maintainer
-checks the authenticated candidate assets, the recorded issuer URL's
-operator-attested candidate association, the expected plan association, and
-the result. The full issuer scenario remains explicitly
-unsupported because the upstream profile requires behavior outside Registry
-Notary 1.0. The offer adapter is no longer a blocker; it closes only the
-callback transport gap.
-
-The first metadata-only run and its known failures are recorded in
-[`initial-report.md`](initial-report.md). It is historical context only. It is
-not evidence for the current candidate, any wallet, any verifier, or the full
-issuer profile.
-
-The Rust SD-JWT verifier is a caller-invoked library, not an OID4VP endpoint.
-Its library and fixture tests therefore do not support an OID4VP verifier
-conformance claim.
diff --git a/release/conformance/openid/docker-compose-builder.override.yaml b/release/conformance/openid/docker-compose-builder.override.yaml
deleted file mode 100644
index 856ee40c7..000000000
--- a/release/conformance/openid/docker-compose-builder.override.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-services:
-  builder:
-    image: maven:3-eclipse-temurin-21@sha256:2b4496088e7b80ae10a8c9f74e574ea21380325a006ec684532ad6bad5bc7273
diff --git a/release/conformance/openid/docker-compose.override.yaml b/release/conformance/openid/docker-compose.override.yaml
deleted file mode 100644
index 1dc1f9eb2..000000000
--- a/release/conformance/openid/docker-compose.override.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-services:
-  mongodb:
-    image: mongo:6.0.13@sha256:b415b12f638e2685d06c58ab7fb5943577c50fadec6d9340ef67d21aeac72070
-  nginx:
-    build:
-      context: ./nginx
-      dockerfile: ${REGISTRY_OPENID_CONFORMANCE_CONFIG_DIR:?runner must set config directory}/nginx.Dockerfile
-  server:
-    build:
-      context: ./server-dev
-      dockerfile: ${REGISTRY_OPENID_CONFORMANCE_CONFIG_DIR:?runner must set config directory}/server-dev.Dockerfile
diff --git a/release/conformance/openid/evidence-summary.schema.json b/release/conformance/openid/evidence-summary.schema.json
deleted file mode 100644
index b119b818d..000000000
--- a/release/conformance/openid/evidence-summary.schema.json
+++ /dev/null
@@ -1,375 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://registrystack.org/schemas/release/openid-conformance-evidence-v1.json",
-  "title": "Registry Stack OpenID conformance candidate evidence summary",
-  "description": "Closed, redaction-safe review summary for the Registry Notary OID4VCI metadata-only suite slice. Candidate assets are authenticated while the tested-endpoint association remains operator-attested and pending review. Raw suite logs are intentionally excluded.",
-  "type": "object",
-  "additionalProperties": false,
-  "required": [
-    "schema_version",
-    "classification",
-    "review_required",
-    "contains_sensitive_material",
-    "raw_suite_export_included",
-    "candidate",
-    "deployment",
-    "suite",
-    "scenario",
-    "configuration",
-    "run",
-    "unsupported_scenarios"
-  ],
-  "properties": {
-    "schema_version": {
-      "const": "registry.release.openid_conformance_evidence.v1"
-    },
-    "classification": {
-      "const": "unreviewed-candidate-evidence-summary"
-    },
-    "review_required": {
-      "const": true
-    },
-    "contains_sensitive_material": {
-      "const": false
-    },
-    "raw_suite_export_included": {
-      "const": false
-    },
-    "candidate": {
-      "$ref": "#/$defs/candidate"
-    },
-    "deployment": {
-      "$ref": "#/$defs/deployment"
-    },
-    "suite": {
-      "$ref": "#/$defs/suite"
-    },
-    "scenario": {
-      "$ref": "#/$defs/scenario"
-    },
-    "configuration": {
-      "$ref": "#/$defs/configuration"
-    },
-    "run": {
-      "$ref": "#/$defs/run"
-    },
-    "unsupported_scenarios": {
-      "const": [
-        {
-          "scenario_id": "notary-oid4vci-issuer-full",
-          "status": "blocked-by-suite-profile"
-        }
-      ]
-    }
-  },
-  "$defs": {
-    "commit": {
-      "type": "string",
-      "pattern": "^[0-9a-f]{40}$"
-    },
-    "sha256": {
-      "type": "string",
-      "pattern": "^sha256:[0-9a-f]{64}$"
-    },
-    "timestamp": {
-      "type": "string",
-      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{1,9})?Z$"
-    },
-    "candidate": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "release_id",
-        "version",
-        "source_repo",
-        "source_ref",
-        "source_tag",
-        "tag_target",
-        "manifest_sha256",
-        "image_lock_sha256",
-        "release_capsule_sha256",
-        "notary_image",
-        "release_assets_authenticity_verified"
-      ],
-      "properties": {
-        "release_id": {
-          "type": "string",
-          "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$"
-        },
-        "version": {
-          "type": "string",
-          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[0-9A-Za-z.-]+)?$"
-        },
-        "source_repo": {
-          "const": "registrystack/registry-stack"
-        },
-        "source_ref": {
-          "$ref": "#/$defs/commit"
-        },
-        "source_tag": {
-          "type": "string",
-          "pattern": "^v[0-9]+\\.[0-9]+\\.[0-9]+(?:-[0-9A-Za-z.-]+)?$"
-        },
-        "tag_target": {
-          "$ref": "#/$defs/commit"
-        },
-        "manifest_sha256": {
-          "$ref": "#/$defs/sha256"
-        },
-        "image_lock_sha256": {
-          "$ref": "#/$defs/sha256"
-        },
-        "release_capsule_sha256": {
-          "$ref": "#/$defs/sha256"
-        },
-        "notary_image": {
-          "type": "string",
-          "pattern": "^ghcr\\.io/registrystack/registry-notary@sha256:[0-9a-f]{64}$"
-        },
-        "release_assets_authenticity_verified": {
-          "const": true
-        }
-      }
-    },
-    "deployment": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "issuer_url",
-        "candidate_association"
-      ],
-      "properties": {
-        "issuer_url": {
-          "type": "string",
-          "format": "uri",
-          "maxLength": 2048,
-          "pattern": "^https://(?:\\[[0-9A-Fa-f:.]+\\]|[A-Za-z0-9][A-Za-z0-9.-]*)(?::(?:[0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?(?:/[^\\s\\x00-\\x1f\\x7f\\\\?#]*)?$"
-        },
-        "candidate_association": {
-          "const": "operator-attested-pending-review"
-        }
-      }
-    },
-    "suite": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "repository",
-        "commit",
-        "release_tag",
-        "reported_version",
-        "exported_from",
-        "commit_association",
-        "jwks_sha256",
-        "export_signature_verified"
-      ],
-      "properties": {
-        "repository": {
-          "const": "https://gitlab.com/openid/conformance-suite.git"
-        },
-        "commit": {
-          "$ref": "#/$defs/commit"
-        },
-        "release_tag": {
-          "const": "release-v5.2.0"
-        },
-        "reported_version": {
-          "const": "5.2.0"
-        },
-        "exported_from": {
-          "const": "https://localhost.emobix.co.uk:8443"
-        },
-        "commit_association": {
-          "const": "operator-attested-pending-review"
-        },
-        "jwks_sha256": {
-          "$ref": "#/$defs/sha256"
-        },
-        "export_signature_verified": {
-          "const": true
-        }
-      }
-    },
-    "scenario": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "scenario_id",
-        "expected_plan",
-        "plan_association",
-        "modules",
-        "variants"
-      ],
-      "properties": {
-        "scenario_id": {
-          "const": "notary-oid4vci-issuer-metadata"
-        },
-        "expected_plan": {
-          "const": "oid4vci-1_0-issuer-test-plan"
-        },
-        "plan_association": {
-          "const": "operator-attested-pending-review"
-        },
-        "modules": {
-          "const": [
-            "oid4vci-1_0-issuer-metadata-test"
-          ]
-        },
-        "variants": {
-          "type": "object",
-          "additionalProperties": false,
-          "required": [
-            "client_auth_type",
-            "sender_constrain",
-            "fapi_profile",
-            "fapi_request_method",
-            "authorization_request_type",
-            "credential_format",
-            "vci_credential_encryption",
-            "vci_grant_type",
-            "vci_authorization_code_flow_variant"
-          ],
-          "properties": {
-            "client_auth_type": {
-              "const": "private_key_jwt"
-            },
-            "sender_constrain": {
-              "const": "dpop"
-            },
-            "fapi_profile": {
-              "const": "vci"
-            },
-            "fapi_request_method": {
-              "const": "unsigned"
-            },
-            "authorization_request_type": {
-              "const": "simple"
-            },
-            "credential_format": {
-              "const": "sd_jwt_vc"
-            },
-            "vci_credential_encryption": {
-              "const": "plain"
-            },
-            "vci_grant_type": {
-              "const": "pre_authorization_code"
-            },
-            "vci_authorization_code_flow_variant": {
-              "const": "issuer_initiated"
-            }
-          }
-        }
-      }
-    },
-    "configuration": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "plan_map_sha256",
-        "template_sha256",
-        "redacted_runtime_configuration_sha256",
-        "redacted_fields"
-      ],
-      "properties": {
-        "plan_map_sha256": {
-          "$ref": "#/$defs/sha256"
-        },
-        "template_sha256": {
-          "$ref": "#/$defs/sha256"
-        },
-        "redacted_runtime_configuration_sha256": {
-          "$ref": "#/$defs/sha256"
-        },
-        "redacted_fields": {
-          "const": [
-            "vci.static_tx_code"
-          ]
-        }
-      }
-    },
-    "run": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "started_at",
-        "completed_at",
-        "terminal_status",
-        "result",
-        "conditions"
-      ],
-      "properties": {
-        "started_at": {
-          "$ref": "#/$defs/timestamp"
-        },
-        "completed_at": {
-          "$ref": "#/$defs/timestamp",
-          "description": "Timestamp carried by the matching terminal module log event; this is not a plan verdict timestamp."
-        },
-        "terminal_status": {
-          "const": "FINISHED"
-        },
-        "result": {
-          "description": "Authoritative testInfo module result copied unchanged; the archive contains no plan verdict.",
-          "enum": [
-            "PASSED",
-            "FAILED",
-            "WARNING",
-            "REVIEW",
-            "SKIPPED",
-            "UNKNOWN"
-          ]
-        },
-        "conditions": {
-          "$ref": "#/$defs/conditions"
-        }
-      }
-    },
-    "conditions": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "counts"
-      ],
-      "properties": {
-        "counts": {
-          "type": "object",
-          "additionalProperties": false,
-          "required": [
-            "info",
-            "success",
-            "review",
-            "warning",
-            "failure"
-          ],
-          "properties": {
-            "info": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 100000
-            },
-            "success": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 100000
-            },
-            "review": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 100000
-            },
-            "warning": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 100000
-            },
-            "failure": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 100000
-            }
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/release/conformance/openid/initial-report.md b/release/conformance/openid/initial-report.md
index 9ef11b856..4c8225fda 100644
--- a/release/conformance/openid/initial-report.md
+++ b/release/conformance/openid/initial-report.md
@@ -64,14 +64,14 @@ The raw suite export is not committed because future full-flow runs may contain
 bearer tokens, proof JWTs, issued credentials, transaction codes, or seeded
 civil identifiers.
 
-## Current reproduction path
+## Retirement note
 
-The release-owned runner, mapping, configuration template, and pinned Compose
-override are documented in [`README.md`](README.md). A current metadata run
-uses `REGISTRY_OPENID_CONFORMANCE_ISSUER_URL` and writes ignored artifacts under
-`target/openid-conformance/`.
+Registry Notary and its OID4VCI-only conformance runner were retired on
+2026-08-03. The operational runner, mapping, configuration template, and
+pinned Compose assets no longer form part of the current release surface.
+This report remains as historical evidence of the 2026-07-09 run; it is not a
+reproduction procedure for Registry Relay or Evidence.
 
-The next reviewed run must use a pinned release topology. The full OIDF issuer
-plan also remains blocked by a flow mismatch: the OIDF issuer tests wait for an
-issuer-initiated credential offer callback into the suite, while the available
-Registry Notary smoke flow pulls the offer endpoint directly.
+Registry Relay's supported OpenID check is the separate release-owned Relay
+OIDC smoke. Evidence authentication is covered by its frozen contracts and
+ordinary product tests, not by the retired OID4VCI issuer plan.
diff --git a/release/conformance/openid/nginx.Dockerfile b/release/conformance/openid/nginx.Dockerfile
deleted file mode 100644
index fe87e108a..000000000
--- a/release/conformance/openid/nginx.Dockerfile
+++ /dev/null
@@ -1,11 +0,0 @@
-FROM nginx:1.27.3@sha256:bc2f6a7c8ddbccf55bdb19659ce3b0a92ca6559e86d42677a5a02ef6bda2fcef
-
-RUN openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
-        -keyout /etc/ssl/private/nginx-selfsigned.key \
-        -out /etc/ssl/certs/nginx-selfsigned.crt \
-        -subj "/CN=localhost.emobix.co.uk" \
-        -addext "subjectAltName=DNS:localhost.emobix.co.uk,DNS:localhost,IP:127.0.0.1,IP:::1" \
-        -addext "basicConstraints=critical,CA:TRUE" \
-        -addext "keyUsage=critical,digitalSignature,keyEncipherment,keyCertSign" \
-        -addext "extendedKeyUsage=serverAuth"
-COPY nginx.conf /etc/nginx/nginx.conf
diff --git a/release/conformance/openid/plan-map.json b/release/conformance/openid/plan-map.json
deleted file mode 100644
index 681bb972b..000000000
--- a/release/conformance/openid/plan-map.json
+++ /dev/null
@@ -1,105 +0,0 @@
-{
-  "schema_version": "registry.release.openid_conformance_plan_map.v1",
-  "suite": {
-    "repo": "https://gitlab.com/openid/conformance-suite.git",
-    "ref": "dee9a25160e789f0f80517674693ef7989ab9fa1",
-    "release_tag": "release-v5.2.0",
-    "base_url": "https://localhost.emobix.co.uk:8443",
-    "local_base_url": "https://localhost.emobix.co.uk:8443",
-    "mtls_base_url": "https://localhost.emobix.co.uk:8444"
-  },
-  "scenarios": [
-    {
-      "id": "notary-oid4vci-issuer-metadata",
-      "surface": "Registry Notary registry-backed OID4VCI issuer metadata",
-      "status": "candidate-only",
-      "suite_plan": "oid4vci-1_0-issuer-test-plan",
-      "suite_modules": [
-        "oid4vci-1_0-issuer-metadata-test"
-      ],
-      "variants": {
-        "client_auth_type": "private_key_jwt",
-        "sender_constrain": "dpop",
-        "fapi_profile": "vci",
-        "fapi_request_method": "unsigned",
-        "authorization_request_type": "simple",
-        "credential_format": "sd_jwt_vc",
-        "vci_credential_encryption": "plain",
-        "vci_grant_type": "pre_authorization_code",
-        "vci_authorization_code_flow_variant": "issuer_initiated"
-      },
-      "config_template": "registry-notary-oid4vci-issuer.template.json",
-      "default_parameters": {
-        "issuer_url_env": "REGISTRY_OPENID_CONFORMANCE_ISSUER_URL",
-        "authorization_server_env": "REGISTRY_OPENID_CONFORMANCE_AUTHORIZATION_SERVER",
-        "credential_configuration_id_env": "REGISTRY_OPENID_CONFORMANCE_CREDENTIAL_CONFIGURATION_ID",
-        "default_credential_configuration_id": "person_is_alive_sd_jwt"
-      },
-      "requires": [
-        "A frozen Registry Notary release-candidate image pinned by digest and configured with checked-in, non-secret topology configuration.",
-        "An issuer URL reachable from the OIDF conformance-suite server container that exactly matches the credential issuer metadata.",
-        "A reviewed result export bound to the candidate image digest, suite commit, plan variants, and configuration digest.",
-        "No bearer tokens, proof JWTs, issued credentials, transaction codes, or civil identifiers committed from generated results."
-      ],
-      "notes": [
-        "This repeatable suite slice exercises issuer metadata only and is not a wallet, verifier, or full issuer conformance claim.",
-        "The suite requires the sender_constrain=dpop plan selector, but the metadata-only module does not exercise DPoP and Registry Notary does not support or claim DPoP.",
-        "No external result is release evidence until it is captured from the frozen candidate artifact with the required immutable identifiers.",
-        "The submit-offer adapter closes the callback transport gap. The full OID4VCI issuer plan remains blocked only by suite profile requirements outside Registry Notary 1.0."
-      ]
-    },
-    {
-      "id": "notary-oid4vci-issuer-full",
-      "surface": "Registry Notary registry-backed OID4VCI issuer",
-      "status": "blocked-by-suite-profile",
-      "suite_plan": "oid4vci-1_0-issuer-test-plan",
-      "suite_modules": [],
-      "variants": {
-        "client_auth_type": "private_key_jwt",
-        "sender_constrain": "dpop",
-        "fapi_profile": "vci",
-        "fapi_request_method": "unsigned",
-        "authorization_request_type": "simple",
-        "credential_format": "sd_jwt_vc",
-        "vci_credential_encryption": "plain",
-        "vci_grant_type": "pre_authorization_code",
-        "vci_authorization_code_flow_variant": "issuer_initiated"
-      },
-      "config_template": "registry-notary-oid4vci-issuer.template.json",
-      "offer_adapter": {
-        "command": "release/scripts/openid-conformance-runner.py submit-offer",
-        "input": "The owner-only openid-credential-offer URI rendered only after Registry Notary completes its authenticated /oid4vci/offer/callback and registry-backed evaluation.",
-        "output": "One no-redirect GET to the pinned suite module's exposed /credential_offer endpoint with the unchanged inline credential_offer value."
-      },
-      "requires": [
-        "A frozen Registry Notary release-candidate topology with a suite-reachable issuer URL.",
-        "The candidate-neutral submit-offer adapter must receive the real owner-only Notary offer URI produced after the authenticated callback; a fabricated offer does not qualify.",
-        "A reviewed suite path that does not require DPoP, wallet attestation, PAR, an authorization-code wallet grant, ES256 holder proof, EUDI, or HAIP behavior outside Registry Notary 1.0."
-      ],
-      "notes": [
-        "Registry Notary supports issuer-initiated pre-authorized code only. The identity provider's authorization code is internal to Notary and is not a wallet grant.",
-        "The pinned suite accepts issuer-initiated pre-authorized offers at its exposed /credential_offer endpoint. The adapter now closes that transport gap without adding a Registry Notary product endpoint.",
-        "The checked-in sender_constrain=dpop variant is required by this upstream suite plan shape and does not represent Registry Notary DPoP support.",
-        "The full plan remains blocked because its current module and variant roster exercises unsupported DPoP, attestation, batch, notification, and other behavior outside the Registry Notary 1.0 profile.",
-        "Do not treat this blocked mapping, a development topology, or historical wallet smoke output as certification evidence."
-      ]
-    }
-  ],
-  "non_oidf_surfaces": [
-    {
-      "surface": "Registry Relay OIDC bearer validation",
-      "evidence": "The release-owned candidate-neutral Relay and Zitadel smoke is directly runnable against a published Relay image digest. Its live output requires candidate binding and maintainer review before it becomes release evidence.",
-      "reason": "The OIDF suite does not publish a generic resource-server conformance plan for a Relay-style protected API. The separate release topology verifies discovery, signature, audience, token type, and native Zitadel role-object scope mapping."
-    },
-    {
-      "surface": "Registry Notary Rust SD-JWT verifier",
-      "evidence": "Rust library and fixture interoperability tests only; no OIDF OID4VP verifier-plan result applies to this surface.",
-      "reason": "The Rust SD-JWT verifier is a caller-invoked verification library, not an OID4VP endpoint. Registry Stack 1.0 therefore makes no OID4VP verifier conformance claim for it."
-    },
-    {
-      "surface": "Third-party OpenID Providers used by demonstration topologies",
-      "evidence": "Out of Registry Stack conformance scope.",
-      "reason": "Registry Stack consumes these providers and does not claim OpenID Provider certification for them."
-    }
-  ]
-}
diff --git a/release/conformance/openid/python-requirements.in b/release/conformance/openid/python-requirements.in
deleted file mode 100644
index c491c56b2..000000000
--- a/release/conformance/openid/python-requirements.in
+++ /dev/null
@@ -1,2 +0,0 @@
-httpx
-pyparsing
diff --git a/release/conformance/openid/python-requirements.txt b/release/conformance/openid/python-requirements.txt
deleted file mode 100644
index de62d8f6a..000000000
--- a/release/conformance/openid/python-requirements.txt
+++ /dev/null
@@ -1,38 +0,0 @@
-# This file was autogenerated by uv via the following command:
-#    uv pip compile release/conformance/openid/python-requirements.in --python-version 3.11 --generate-hashes --universal --no-emit-index-url --output-file release/conformance/openid/python-requirements.txt
-anyio==4.14.2 \
-    --hash=sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494 \
-    --hash=sha256:cfa139f3ed1a23ee8f88a145ddb5ac7605b8bbfd8592baacd7ce3d8bb4313c7f
-    # via httpx
-certifi==2026.6.17 \
-    --hash=sha256:024c88eeec92ca068db80f02b8b07c9cef7b9fe261d1d535abfd5abd6f6af432 \
-    --hash=sha256:2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db
-    # via
-    #   httpcore
-    #   httpx
-h11==0.16.0 \
-    --hash=sha256:4e35b956cf45792e4caa5885e69fba00bdbc6ffafbfa020300e549b208ee5ff1 \
-    --hash=sha256:63cf8bbe7522de3bf65932fda1d9c2772064ffb3dae62d55932da54b31cb6c86
-    # via httpcore
-httpcore==1.0.9 \
-    --hash=sha256:2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55 \
-    --hash=sha256:6e34463af53fd2ab5d807f399a9b45ea31c3dfa2276f15a2c3f00afff6e176e8
-    # via httpx
-httpx==0.28.1 \
-    --hash=sha256:75e98c5f16b0f35b567856f597f06ff2270a374470a5c2392242528e3e3e42fc \
-    --hash=sha256:d909fcccc110f8c7faf814ca82a9a4d816bc5a6dbfea25d6591d6985b8ba59ad
-    # via -r release/conformance/openid/python-requirements.in
-idna==3.18 \
-    --hash=sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2 \
-    --hash=sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848
-    # via
-    #   anyio
-    #   httpx
-pyparsing==3.3.2 \
-    --hash=sha256:850ba148bd908d7e2411587e247a1e4f0327839c40e2e5e6d05a007ecc69911d \
-    --hash=sha256:c777f4d763f140633dcb6d8a3eda953bf7a214dc4eff598413c070bcdc117cbc
-    # via -r release/conformance/openid/python-requirements.in
-typing-extensions==4.16.0 ; python_full_version < '3.13' \
-    --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \
-    --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5
-    # via anyio
diff --git a/release/conformance/openid/registry-notary-oid4vci-issuer.template.json b/release/conformance/openid/registry-notary-oid4vci-issuer.template.json
deleted file mode 100644
index 832085dd2..000000000
--- a/release/conformance/openid/registry-notary-oid4vci-issuer.template.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "alias": "registry-stack-notary-oid4vci-issuer",
-  "description": "Registry Stack Notary OID4VCI issuer conformance slice",
-  "vci": {
-    "credential_issuer_url": "${issuer_url}",
-    "authorization_server": "${authorization_server}",
-    "credential_configuration_id": "${credential_configuration_id}",
-    "credential_proof_type_hint": "jwt",
-    "static_tx_code": "${static_tx_code}"
-  },
-  "client": {
-    "client_id": "${client_id}"
-  },
-  "client2": {
-    "client_id": "${client2_id}"
-  }
-}
diff --git a/release/conformance/openid/server-dev.Dockerfile b/release/conformance/openid/server-dev.Dockerfile
deleted file mode 100644
index 6f2de45ee..000000000
--- a/release/conformance/openid/server-dev.Dockerfile
+++ /dev/null
@@ -1,6 +0,0 @@
-# Mirrors the pinned suite's development server image while fixing its base.
-FROM eclipse-temurin:21@sha256:da9d3a4f7650db39b918fc5a2c3da76556fb8cc8e5f3767cdea0bb409286951a
-
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends redir=3.3-1build1 \
-    && rm -rf /var/lib/apt/lists/*
diff --git a/release/conformance/relay-oidc/README.md b/release/conformance/relay-oidc/README.md
index 7b82188d1..d4566a8d8 100644
--- a/release/conformance/relay-oidc/README.md
+++ b/release/conformance/relay-oidc/README.md
@@ -65,10 +65,33 @@ It then requires these exact results:
 - the valid Zitadel role token returns `200` and exposes the synthetic dataset;
 - a structurally valid token with a changed signature returns
   `401 auth.token_signature_invalid`;
+- the metadata-scoped token is refused at the entity records route with
+  `403 auth.scope_denied`;
+- the same token, remapped to the entity's `smoke_registry:rows` read scope,
+  returns `200` at that route;
+- the record it returns is exactly the authored projection, so the source
+  column `person_id` is absent and only `id` and `display_name` appear;
 - an audience mismatch returns `401 auth.audience_mismatch`;
 - an unaccepted JOSE token type returns `401 auth.malformed_credential`; and
 - a role-object organization-key mismatch returns `403 auth.scope_denied`.
 
+## Source-read evidence
+
+The two `source-read-records` and `source-read-minimized-projection` results
+are the release's only end-to-end proof that a published Relay image reads a
+real source and discloses only what the authored entity declares. The row comes
+from the mounted `records.csv` through the `people_table` snapshot, so a pass
+covers source materialization, the read-scope gate, and field projection
+together.
+
+The projection result names the offending field when it fails and never
+republishes the record, so a failing report stays inside the same evidence
+boundary as a passing one.
+
+Scope separation is the reason the run restarts Relay between the metadata and
+row stages: a single token that carried both scopes could not show that the
+read scope is independently enforced.
+
 Zitadel, the helper, and Relay share Zitadel's network namespace. This keeps the
 HTTP issuer and discovery URL on loopback, which is the only insecure fetch
 form Relay permits for local development. The Relay API is published separately
diff --git a/release/conformance/relay-oidc/relay.template.yaml b/release/conformance/relay-oidc/relay.template.yaml
index 4d1446002..20ac3070f 100644
--- a/release/conformance/relay-oidc/relay.template.yaml
+++ b/release/conformance/relay-oidc/relay.template.yaml
@@ -30,7 +30,7 @@ auth:
     leeway: 60s
     scope_claim: $scope_claim
     scope_map:
-      "registry-smoke-reader": "smoke_registry:metadata"
+      "registry-smoke-reader": $mapped_scope
     scope_object_required_keys:
       - $required_org
     allowed_clients:
diff --git a/release/contracts/selected-metrics.json b/release/contracts/selected-metrics.json
index 43851d683..115cc0773 100644
--- a/release/contracts/selected-metrics.json
+++ b/release/contracts/selected-metrics.json
@@ -91,96 +91,6 @@
         "resource_id": "Configured resource identifier; cardinality is bounded by configured resources."
       },
       "source": "crates/registry-relay/src/observability.rs"
-    },
-    {
-      "product": "registry-notary",
-      "name": "registry_notary_http_requests_total",
-      "type": "counter",
-      "meaning": "Completed HTTP requests grouped by bounded request attributes.",
-      "labels": {
-        "endpoint_kind": "Bounded route family, never a raw request path.",
-        "error_code": "Released machine error code, or none for a successful response.",
-        "method": "Normalized HTTP method.",
-        "status_class": "HTTP status class.",
-        "status_code": "HTTP response status code."
-      },
-      "source": "crates/registry-notary-server/src/metrics.rs"
-    },
-    {
-      "product": "registry-notary",
-      "name": "registry_notary_http_request_duration_seconds",
-      "type": "histogram",
-      "meaning": "HTTP request duration in seconds grouped by bounded request attributes.",
-      "labels": {
-        "endpoint_kind": "Bounded route family, never a raw request path.",
-        "error_code": "Released machine error code, or none for a successful response.",
-        "method": "Normalized HTTP method.",
-        "status_class": "HTTP status class.",
-        "status_code": "HTTP response status code."
-      },
-      "source": "crates/registry-notary-server/src/metrics.rs"
-    },
-    {
-      "product": "registry-notary",
-      "name": "registry_notary_audit_events_total",
-      "type": "counter",
-      "meaning": "Audit write attempts grouped by bounded outcome.",
-      "labels": {
-        "outcome": "Bounded audit write outcome."
-      },
-      "source": "crates/registry-notary-server/src/metrics.rs"
-    },
-    {
-      "product": "registry-notary",
-      "name": "registry_notary_replay_events_total",
-      "type": "counter",
-      "meaning": "Replay-store decisions grouped by protocol flow and bounded outcome.",
-      "labels": {
-        "flow": "Bounded replay-protected protocol flow.",
-        "outcome": "Bounded replay decision outcome."
-      },
-      "source": "crates/registry-notary-server/src/metrics.rs"
-    },
-    {
-      "product": "registry-notary",
-      "name": "registry_notary_credential_issuance_total",
-      "type": "counter",
-      "meaning": "Credential issuance attempts grouped by protocol and bounded outcome.",
-      "labels": {
-        "outcome": "Bounded credential issuance outcome.",
-        "protocol": "Credential issuance protocol."
-      },
-      "source": "crates/registry-notary-server/src/metrics.rs"
-    },
-    {
-      "product": "registry-notary",
-      "name": "registry_notary_cel_evaluations_total",
-      "type": "counter",
-      "meaning": "CEL worker evaluations grouped by bounded outcome.",
-      "labels": {
-        "outcome": "Bounded CEL evaluation outcome."
-      },
-      "source": "crates/registry-notary-server/src/metrics.rs"
-    },
-    {
-      "product": "registry-notary",
-      "name": "registry_notary_cel_evaluation_duration_ms_total",
-      "type": "counter",
-      "meaning": "Accumulated CEL evaluation duration in milliseconds grouped by bounded outcome.",
-      "labels": {
-        "outcome": "Bounded CEL evaluation outcome."
-      },
-      "source": "crates/registry-notary-server/src/metrics.rs"
-    },
-    {
-      "product": "registry-notary",
-      "name": "registry_notary_cel_worker_pool",
-      "type": "gauge",
-      "meaning": "Current CEL worker-pool state value.",
-      "labels": {
-        "state": "Bounded worker-pool state name."
-      },
-      "source": "crates/registry-notary-server/src/metrics.rs"
     }
   ]
 }
diff --git a/release/docker/Dockerfile.registry-notary b/release/docker/Dockerfile.registry-notary
deleted file mode 100644
index 4fb4db39e..000000000
--- a/release/docker/Dockerfile.registry-notary
+++ /dev/null
@@ -1,39 +0,0 @@
-# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
-
-# SPDX-License-Identifier: Apache-2.0
-
-ARG SOURCE_DATE_EPOCH=0
-
-FROM debian:trixie-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd AS runtime-root
-ARG SOURCE_DATE_EPOCH
-
-RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
-    mkdir -p \
-        /workspace/runtime-root/etc/registry-notary \
-        /workspace/runtime-root/usr/local/bin \
-        /workspace/runtime-root/var/lib/registry/audit \
-        /workspace/runtime-root/var/lib/registry/state \
-        /workspace/runtime-root/var/lib/registry-notary \
-        /workspace/runtime-root/var/log/registry-notary \
-    && install -m 0755 /workspace/image-bin/registry-notary /workspace/runtime-root/usr/local/bin/registry-notary \
-    && install -m 0755 /workspace/image-bin/registry-notary-cel-worker /workspace/runtime-root/usr/local/bin/registry-notary-cel-worker \
-    && chown -R 65532:65532 \
-        /workspace/runtime-root/etc/registry-notary \
-        /workspace/runtime-root/var/lib/registry \
-        /workspace/runtime-root/var/lib/registry-notary \
-        /workspace/runtime-root/var/log/registry-notary \
-    && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +
-
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:d97bc0a941b8d4be647dc0ee75b264ddbb772f1ac5ba690a4309c00723b23775 AS runtime
-
-COPY --from=runtime-root /workspace/runtime-root/ /
-
-WORKDIR /var/lib/registry-notary
-
-ENV REGISTRY_NOTARY_BIND=0.0.0.0:8080
-EXPOSE 8080
-
-HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD ["/usr/local/bin/registry-notary", "healthcheck"]
-
-ENTRYPOINT ["/usr/local/bin/registry-notary"]
-CMD ["--config", "/etc/registry-notary/config.yaml"]
diff --git a/release/exercises/README.md b/release/exercises/README.md
index 4a2c1d55f..fb570b71c 100644
--- a/release/exercises/README.md
+++ b/release/exercises/README.md
@@ -102,12 +102,19 @@ If the candidate coordinate, manifest, product inputs, trust generation,
 activation generation, or retained evidence changes, discard the result and
 repeat the lifecycle against the new exact digests.
 
-## Upgrade lifecycle
+## Historical Notary-era upgrade lifecycle
+
+The `registry-stack.upgrade-exercise/v1` contract is retained to validate
+committed Notary-era upgrade records whose target version is earlier than
+v0.17.0. The validator rejects v0.17.0 and later targets before reading any
+Notary-era schema, image, or release-input path. Post-Notary upgrades require
+a successor contract; do not repurpose v1 by removing its Notary fields.
 
 ## Candidate-neutral preparation
 
 `upgrade-exercise-v1.template.json` defines the machine-validated evidence
-record for a Registry Stack stable upgrade. The template is preparation only.
+record for a historical Registry Stack stable upgrade. The template is
+preparation only.
 Its `record_kind` is `template`, every result is `not_run`, and both candidate
 attestations are `false`. Every result's observation and evidence fields are
 null. A validated template contains zero candidate evidence and does not
diff --git a/release/manifests/registry-stack-beta-27.yaml b/release/manifests/registry-stack-beta-27.yaml
new file mode 100644
index 000000000..e0272b995
--- /dev/null
+++ b/release/manifests/registry-stack-beta-27.yaml
@@ -0,0 +1,29 @@
+stack:
+  release: beta-27
+  version: 0.17.0
+  source_repo: registrystack/registry-stack
+  source_tag: v0.17.0
+
+artifacts:
+  registry-relay: 0.17.0
+  registry-relay-rhai-worker: 0.17.0
+  registry-manifest-cli: 0.17.0
+  registryctl: 0.17.0
+  registryctl-image-lock: 0.17.0
+  registryctl-installer: 0.17.0
+  registry-docs: 0.17.0
+  evidence: 0.17.0
+  evidencectl: 0.17.0
+  mint: 0.17.0
+  evidencectl-installer: 0.17.0
+
+external:
+  crosswalk:
+    repo: PublicSchema/crosswalk
+    ref: 1d44ec735fdc8a7c719264b339574371e8330337
+    status: tested external input
+
+warnings:
+  - code: notary-retired
+    classification: breaking-product-retirement
+    detail: Registry Notary is absent from this release. Historical Notary manifests and evidence remain immutable; operators must preserve any records they still require and rebuild current deployment projects with Registryctl rather than carrying retired Notary services forward.
diff --git a/release/notes/behavioral-guarantee-claims.md b/release/notes/behavioral-guarantee-claims.md
index d98668478..554bd09b1 100644
--- a/release/notes/behavioral-guarantee-claims.md
+++ b/release/notes/behavioral-guarantee-claims.md
@@ -6,6 +6,8 @@ This is the extraction pass for behavioral guarantees in the public docs site.
 It does not verify the claims against implementation.
 Generated product docs were refreshed locally with `npm run generate`; rows for generated product pages link to the tracked source files that feed those pages.
 
+Registry Notary was retired after this inventory was taken. Its rows are kept as the historical record of what was claimed, and their `Page and heading` links point at the retired documents as they stood at tag `v0.16.3`, the last release that shipped them. Those rows are not verification work for a maintained product.
+
 | Product | Claim (verbatim) | Page and heading | Suggested verification | Overlap |
 | --- | --- | --- | --- | --- |
 | Notary | "A Notary caller never sends the value it is asking about and never receives the underlying record as the answer." | [records-stay-home.mdx](../../docs/site/src/content/docs/explanation/records-stay-home.mdx), "A question goes in, an answer comes out" | New evaluation/rendering test that asserts request inputs and response bodies never carry source values for representative claim types. | None |
@@ -53,12 +55,12 @@ Generated product docs were refreshed locally with `npm run generate`; rows for
 | Both | "Known product gaps: No revocation flow is specified (though an optional, off-by-default credential-status surface can be enabled to mark a credential `revoked`), there is no `/.well-known/jwt-vc-issuer` endpoint, and no built-in data-subject erasure workflow in this version." | [threat-model.mdx](../../docs/site/src/content/docs/explanation/threat-model.mdx), "Residual risks and what is left to the operator" | Route inventory and docs review for revocation, issuer metadata, and erasure surfaces. | None |
 | Both | "A deployment using software keys, local JWK files, or demo-generated keys can be reachable and internally consistent yet not production-secure." | [threat-model.mdx](../../docs/site/src/content/docs/explanation/threat-model.mdx), "Residual risks and what is left to the operator" | Readiness/posture tests for signer custody facts and explicit production gates. | None |
 | Both | "Secret and key provisioning, key custody and rotation, audit retention and storage, tenant isolation, TLS termination and certificates, edge rate limiting, deployment configuration, and incident response are operator responsibilities, not behavior the model defines." | [threat-model.mdx](../../docs/site/src/content/docs/explanation/threat-model.mdx), "Residual risks and what is left to the operator" | Code inspection and docs review; this is a non-guarantee boundary. | None |
-| Notary | "Registry-backed evidence enters Notary only through an authenticated, compiler-pinned Registry Relay consultation." | [README.md](../../products/notary/README.md), product introduction | Notary configuration and dependency inspection plus Relay-client integration tests that reject missing or mismatched contracts before Relay dispatch. | None |
-| Notary | "When both products are present, Notary receives no registry destination or credential." | [architecture-overview.md](../../products/notary/docs/architecture-overview.md), "Deployment topologies" | Configuration-schema and generated-artifact inspection proving registry destinations and source credentials exist only in Relay private inputs. | None |
-| Notary | "Notary never treats a Relay failure as `no_match`." | [architecture-overview.md](../../products/notary/docs/architecture-overview.md), "Registry-backed request lifecycle" | Relay-client and claim-evaluation tests covering explicit no-match, ambiguity, denial, source, verification, availability, and contract failures. | None |
-| Notary | "The handle is a hash, not the source id, so the response does not expose the raw source identifier." | [identity-and-record-matching.md](../../products/notary/docs/identity-and-record-matching.md), "What the response tells you" | Existing target reference serialization tests or new test against a source id fixture. | None |
-| Notary | "The core guarantee is that a citizen token can only authorize a request for the exact self or dependent subject allowed by policy. It never supplies claim evidence, which remains Relay-backed." | [subject-access-operator-guide.md](../../products/notary/docs/subject-access-operator-guide.md), "Security goal" | Existing subject-access authorization-details and delegated subject-binding tests. | None |
-| Notary | "It is not acceptable for active-active serving because two processes cannot see the same nonce or proof replay decisions." | [operator-config-reference.md](../../products/notary/docs/operator-config-reference.md), "Replay store" | Readiness/deployment-gate tests for in-memory replay under production-style profiles. | None |
+| Notary | "Registry-backed evidence enters Notary only through an authenticated, compiler-pinned Registry Relay consultation." | [README.md](https://github.com/registrystack/registry-stack/blob/v0.16.3/products/notary/README.md), product introduction | Notary configuration and dependency inspection plus Relay-client integration tests that reject missing or mismatched contracts before Relay dispatch. | None |
+| Notary | "When both products are present, Notary receives no registry destination or credential." | [architecture-overview.md](https://github.com/registrystack/registry-stack/blob/v0.16.3/products/notary/docs/architecture-overview.md), "Deployment topologies" | Configuration-schema and generated-artifact inspection proving registry destinations and source credentials exist only in Relay private inputs. | None |
+| Notary | "Notary never treats a Relay failure as `no_match`." | [architecture-overview.md](https://github.com/registrystack/registry-stack/blob/v0.16.3/products/notary/docs/architecture-overview.md), "Registry-backed request lifecycle" | Relay-client and claim-evaluation tests covering explicit no-match, ambiguity, denial, source, verification, availability, and contract failures. | None |
+| Notary | "The handle is a hash, not the source id, so the response does not expose the raw source identifier." | [identity-and-record-matching.md](https://github.com/registrystack/registry-stack/blob/v0.16.3/products/notary/docs/identity-and-record-matching.md), "What the response tells you" | Existing target reference serialization tests or new test against a source id fixture. | None |
+| Notary | "The core guarantee is that a citizen token can only authorize a request for the exact self or dependent subject allowed by policy. It never supplies claim evidence, which remains Relay-backed." | [subject-access-operator-guide.md](https://github.com/registrystack/registry-stack/blob/v0.16.3/products/notary/docs/subject-access-operator-guide.md), "Security goal" | Existing subject-access authorization-details and delegated subject-binding tests. | None |
+| Notary | "It is not acceptable for active-active serving because two processes cannot see the same nonce or proof replay decisions." | [operator-config-reference.md](https://github.com/registrystack/registry-stack/blob/v0.16.3/products/notary/docs/operator-config-reference.md), "Replay store" | Readiness/deployment-gate tests for in-memory replay under production-style profiles. | None |
 | Relay | "It does not log raw query strings, request bodies, auth headers, or row values." | [ops.md](../../crates/registry-relay/docs/ops.md), "Audit sink and rotation" | Existing operational log redaction tests or new request-log fixture assertions. | None |
 | Relay | "The audit record stores the approval reference, emergency change class, expiry, rate-limit identity, and hashes of approver identity and free-text `reason`. It does not store raw reason text or raw approver identity." | [api.md](../../crates/registry-relay/docs/api.md), "Listeners and surfaces" | Break-glass audit tests for hashed approver identity/reason and absence of raw values; verify against post-#314 admin route shape. | [#314](https://github.com/registrystack/registry-stack/issues/314) |
 | Relay | "The initial Records surface has one collection, `datasets`, where each item is a record describing a visible `dcat:Dataset`. It uses the same metadata scopes as `/metadata/catalog`; it does not expose row data, bypass required filters, or claim searchable-catalog conformance." | [api.md](../../crates/registry-relay/docs/api.md), "Metadata, catalog, and OpenAPI" | Existing records API tests plus required-filter denial tests. | None |
@@ -70,12 +72,12 @@ Generated product docs were refreshed locally with `npm run generate`; rows for
 | Relay | "The runtime view MUST be filtered by the caller's `metadata` scope, so a caller whose scope covers one dataset does not receive metadata for datasets it cannot read." | [rs-pr-relay.mdx](../../docs/site/src/content/docs/spec/rs-pr-relay.mdx), "6. Metadata publication" | Existing metadata-scope tests. | None |
 | Relay | "Relay does not expose a current CPSV-AP runtime metadata route." | [rs-pr-relay.mdx](../../docs/site/src/content/docs/spec/rs-pr-relay.mdx), "6. Metadata publication" | Route inventory check and OpenAPI/route scan. | None |
 | Relay | "Relay v1 does not by itself track cumulative disclosure across repeated or overlapping aggregate queries." | [rs-pr-relay.mdx](../../docs/site/src/content/docs/spec/rs-pr-relay.mdx), "5. Aggregate routes" | Code inspection of aggregate execution and absence of disclosure-budget state. | None |
-| Notary | "records and honors the disclosure mode, and never leaks a redacted value (REQ-PR-NOTARY-008, REQ-PR-NOTARY-009, REQ-PR-NOTARY-010);" | [rs-pr-notary.mdx](../../docs/site/src/content/docs/spec/rs-pr-notary.mdx), "Conformance" | Existing disclosure tests plus #176 CCCEV redaction regression. | None |
+| Notary | "records and honors the disclosure mode, and never leaks a redacted value (REQ-PR-NOTARY-008, REQ-PR-NOTARY-009, REQ-PR-NOTARY-010);" | [rs-pr-notary.mdx](https://github.com/registrystack/registry-stack/blob/v0.16.3/docs/site/src/content/docs/spec/rs-pr-notary.mdx), "Conformance" | Existing disclosure tests plus #176 CCCEV redaction regression. | None |
 | Both | "Publishing a dataset, schema, policy, evidence offering, ecosystem binding, or federation relationship in a discovery artifact MUST NOT be construed as granting access to it, as enforcing it, or as asserting that any particular record exists or satisfies it." | [rs-arc-g.mdx](../../docs/site/src/content/docs/spec/rs-arc-g.mdx), "5. Architectural invariants" | Manifest renderer inspection plus Relay/Notary authorization and PDP boundary tests. | None |
 | Manifest | "Registry Manifest MUST reject an evidence type that proves no requirement and an evidence-type-list entry that names an unknown evidence type or one that does not prove the owning requirement." | [rs-dm-manifest.mdx](../../docs/site/src/content/docs/spec/rs-dm-manifest.mdx), "5. Requirements and grouped evidence" | Existing manifest validation tests or new negative fixtures. | None |
 | Manifest | "The `registry-manifest/v1` manifest and its generated `*/v1` formats MUST reject a key that is not modeled at its nesting depth, at parse time, and MUST name the offending key by its dotted field path in the resulting error." | [rs-dm-manifest.mdx](../../docs/site/src/content/docs/spec/rs-dm-manifest.mdx), "10. Compatibility and evolution" | Existing unknown-key rejection tests. | None |
-| Notary | "The admin reload route returns a no-op in the standalone router; key and configuration changes still require a service restart." | [registry-notary.mdx](../../docs/site/src/content/docs/reference/apis/registry-notary.mdx), "What the specification does not cover" | Code inspection and API test for HTTP 501 `registry.admin.capability.not_supported`; wording overlaps a known docs mismatch. | [#16](https://github.com/registrystack/registry-stack/issues/16), [#314](https://github.com/registrystack/registry-stack/issues/314) |
-| Notary | "Every evaluated request emits an `EvidenceAuditEvent` in a Registry Platform audit envelope to a configured sink (stdout, file, or JSONL)." | [registry-notary.mdx](../../docs/site/src/content/docs/reference/apis/registry-notary.mdx), "Behavior the schema cannot express" | Audit emission tests plus sink-list correction for syslog. | [#16](https://github.com/registrystack/registry-stack/issues/16) |
+| Notary | "The admin reload route returns a no-op in the standalone router; key and configuration changes still require a service restart." | [registry-notary.mdx](https://github.com/registrystack/registry-stack/blob/v0.16.3/docs/site/src/content/docs/reference/apis/registry-notary.mdx), "What the specification does not cover" | Code inspection and API test for HTTP 501 `registry.admin.capability.not_supported`; wording overlaps a known docs mismatch. | [#16](https://github.com/registrystack/registry-stack/issues/16), [#314](https://github.com/registrystack/registry-stack/issues/314) |
+| Notary | "Every evaluated request emits an `EvidenceAuditEvent` in a Registry Platform audit envelope to a configured sink (stdout, file, or JSONL)." | [registry-notary.mdx](https://github.com/registrystack/registry-stack/blob/v0.16.3/docs/site/src/content/docs/reference/apis/registry-notary.mdx), "Behavior the schema cannot express" | Audit emission tests plus sink-list correction for syslog. | [#16](https://github.com/registrystack/registry-stack/issues/16) |
 | Relay | "A route that only exists when a non-default feature or config block enables it (for example the OGC namespaces, the SP DCI adapter, or attribute release) is covered by its feature tests and product docs, not by presence in the default OpenAPI artifact. When the deployment enables it, it behaves as documented, but its availability depends on the deployment's build features and configuration." | [api-stability.mdx](../../docs/site/src/content/docs/reference/api-stability.mdx), "Covered surfaces" | Feature/config route inventory tests. | [#210](https://github.com/registrystack/registry-stack/issues/210) |
 | Relay | "Registry Manifest emits CPSV-AP service catalogue JSON-LD. Registry Relay does not expose a current CPSV-AP runtime metadata route." | [glossary.mdx](../../docs/site/src/content/docs/reference/glossary.mdx), "Page introduction" | Route inventory check and OpenAPI/route scan; Manifest renderer check for CPSV-AP output. | None |
 
diff --git a/release/notes/negative-path-coverage-map.md b/release/notes/negative-path-coverage-map.md
index 0e02ade45..77790a70d 100644
--- a/release/notes/negative-path-coverage-map.md
+++ b/release/notes/negative-path-coverage-map.md
@@ -8,6 +8,19 @@ Citation refresh: 2026-07-17. This refresh verified that the named public
 anchors resolve in the current tree; it did not rerun the historical evidence
 collection behind this map.
 
+Retirement refresh: 2026-08-03. Registry Notary was retired from this
+repository, and the parked `registry-platform-sts` crate was removed with it.
+Rows whose evidence lived in those crates are kept rather than deleted, because
+deleting them would erase the record of what was once claimed and of what is
+now unproven. They are restated as `Retired evidence`, their anchors are named
+as they stood at tag
+[`v0.16.3`](https://github.com/registrystack/registry-stack/tree/v0.16.3), the
+last release that shipped them, and their recorded findings are labelled
+historical. Rows with both maintained and retired anchors keep only the
+maintained anchors as current evidence, and a row that loses its
+product-surface evidence to the retirement is downgraded, never left claiming
+coverage it no longer has.
+
 This is the public release-readiness map for negative-path coverage. It maps
 the internal checklist row identifiers to public evidence or disposition without
 copying adversarial scenario detail into the public repository.
@@ -22,25 +35,31 @@ public evidence or disposition.
 - `Partial`: current tests cover part of the row, but more route, audit, or
   product-surface coverage is needed before release sign-off.
 - `Gap`: the row still needs a linked test PR or maintainer-approved deferral.
+- `Retired evidence`: the row's anchors lived in a product or crate that has
+  since been retired, so the row proves nothing about a maintained product. The
+  state it held before the retirement is shown in parentheses. It counts as
+  neither coverage nor an open gap until someone re-scopes the scenario against
+  a maintained product.
 
 ## Map
 
 - `NP-01`: Partial.
   Public anchors: `crates/registry-relay/src/auth/oidc/provider.rs`,
-  `crates/registry-notary-server/tests/sd_jwt_vc_verifier_compat.rs`,
   `crates/registry-platform-crypto/src/lib.rs`, and
   `crates/registry-platform-sdjwt/src/lib.rs`.
+  Retired anchor (`v0.16.3`):
+  `crates/registry-notary-server/tests/sd_jwt_vc_verifier_compat.rs`.
   Disposition: keep open for complete product-surface audit parity.
 - `NP-02`: Partial.
-  Public anchors: `crates/registry-relay/src/auth/oidc/provider.rs`,
-  and `crates/registry-notary-server/src/api.rs`.
+  Public anchor: `crates/registry-relay/src/auth/oidc/provider.rs`.
+  Retired anchor (`v0.16.3`): `crates/registry-notary-server/src/api.rs`.
   Disposition: keep open for remaining active product-surface audit assertions.
-  The parked STS source is outside the release surface until #298 promotes a
-  named consumer.
+  The parked STS source referenced here left the tree with the retirement; see
+  `NP-23`.
 - `NP-03`: Partial.
-  Public anchors: `crates/registry-relay/src/auth/oidc/provider.rs`,
-  `crates/registry-platform-sdjwt/src/lib.rs`, and
-  `crates/registry-notary-server/src/api.rs`.
+  Public anchors: `crates/registry-relay/src/auth/oidc/provider.rs` and
+  `crates/registry-platform-sdjwt/src/lib.rs`.
+  Retired anchor (`v0.16.3`): `crates/registry-notary-server/src/api.rs`.
   Disposition: keep open for route-level denial and audit parity.
 - `NP-04`: Partial.
   Public anchors: `crates/registry-relay/src/auth/oidc/provider.rs` and
@@ -76,12 +95,15 @@ public evidence or disposition.
   backend detail disclosure.
 - `NP-10`: Covered.
   Public anchors:
-  `crates/registry-relay/src/server.rs::body_limit_layer_returns_problem_details_and_audit_code`,
-  `crates/registry-relay/src/server.rs::uri_length_layer_returns_problem_details_and_audit_code`,
-  and `crates/registry-notary-server/tests/standalone_http.rs`.
-  Disposition: Relay asserts denial plus audit for this middleware path; Notary
-  asserts stable early-boundary problem responses, server-owned request ids, and
-  non-disclosure where the audited route layer has not run.
+  `crates/registry-relay/src/server.rs::body_limit_layer_returns_problem_details_and_audit_code`
+  and `crates/registry-relay/src/server.rs::uri_length_layer_returns_problem_details_and_audit_code`.
+  Retired anchor (`v0.16.3`):
+  `crates/registry-notary-server/tests/standalone_http.rs`.
+  Disposition: Relay asserts denial plus audit for this middleware path, and
+  that alone carries the row on the maintained surface. The retired anchor
+  additionally asserted stable early-boundary problem responses, server-owned
+  request ids, and non-disclosure where the audited route layer had not run;
+  that evidence is historical.
 - `NP-11`: Partial.
   Public anchors:
   `crates/registry-relay/src/connector/mod.rs::postgres_sslmode_rejects_default_prefer`,
@@ -95,13 +117,14 @@ public evidence or disposition.
   Disposition: validation-limit coverage exists; runtime load and serving-state
   side effects remain to be closed or deferred.
 - `NP-13`: Covered.
-  Public anchors: `crates/registry-relay/tests/deployment_profile_gates.rs`,
-  `crates/registry-relay/src/api/admin.rs`,
+  Public anchors: `crates/registry-relay/tests/deployment_profile_gates.rs` and
+  `crates/registry-relay/src/api/admin.rs`.
+  Retired anchors (`v0.16.3`):
   `crates/registry-notary-server/src/standalone.rs`,
   `crates/registry-notary-server/tests/standalone_http.rs`, and
   `crates/registry-notary-server/src/api.rs`.
-  Disposition: active Relay and Notary product paths cover audit-failure abort
-  behavior.
+  Disposition: the active Relay product path covers audit-failure abort
+  behavior. The Notary paths that shared this row are historical.
 - `NP-14`: Covered.
   Public anchors:
   `crates/registry-relay/tests/admin_auth_extraction_contract.rs::admin_handlers_use_required_scoped_extractors`,
@@ -126,92 +149,103 @@ public evidence or disposition.
   Public anchor: internal checklist only.
   Disposition: deferred to a maintainer-owned follow-up bundle;
   public scenario detail remains intentionally omitted.
-- `NP-19`: Covered.
-  Public anchors:
+- `NP-19`: Retired evidence (was Covered).
+  Retired anchors (`v0.16.3`):
   `crates/registry-notary-server/src/api/tests/credentials.rs::issue_credential_rejects_purpose_mismatch`
   and `crates/registry-notary-server/tests/standalone_http/credentials.rs::direct_credential_purpose_mismatch_denial_is_audited_and_redacted`.
-  Disposition: purpose mismatch is denied before credential signing, and the
+  Historical disposition: purpose mismatch is denied before credential signing, and the
   direct `/v1/credentials` product route now returns a stable problem response,
   emits a redacted `credential_denied` audit record with subject-access
   mode and hashed identifiers, and produces no `credential_issued` event.
-- `NP-20`: Covered.
-  Public anchors:
-  `crates/registry-platform-sdjwt/src/lib.rs::holder_proof_rejects_wrong_type_and_dangerous_headers`,
-  `crates/registry-notary-server/src/api/tests/credentials.rs::strict_credential_issue_rejects_oid4vci_proof_shape`,
+- `NP-20`: Partial.
+  Public anchor:
+  `crates/registry-platform-sdjwt/src/lib.rs::holder_proof_rejects_wrong_type_and_dangerous_headers`.
+  Retired anchors (`v0.16.3`):
+  `crates/registry-notary-server/src/api/tests/credentials.rs::strict_credential_issue_rejects_oid4vci_proof_shape`
   and `crates/registry-notary-server/tests/standalone_http/credentials.rs::strict_credentials_issue_rejects_oid4vci_proof_at_http_boundary`.
-  Disposition: platform holder-proof validation and the direct
-  `/v1/credentials` product route both reject the wrong proof class, return the
-  stable `credential.holder_proof_required` problem, emit a redacted
+  Disposition: platform holder-proof validation still rejects the wrong proof
+  class. The product-surface half of this row lived on the retired
+  `/v1/credentials` route, which historically returned the stable
+  `credential.holder_proof_required` problem, emitted a redacted
   `credential_denied` audit record with profile and holder-binding metadata,
-  and return no credential material.
-- `NP-21`: Covered.
-  Public anchors:
-  `crates/registry-platform-sdjwt/src/lib.rs::holder_proof_enforces_audience_lifetime_and_bindings`,
-  `crates/registry-notary-server/tests/sd_jwt_vc_verifier_compat.rs::missing_cnf_when_holder_binding_required_fails_with_holder_binding_required`,
+  and returned no credential material. No maintained product surface asserts
+  that today, so the row is downgraded from `Covered` and stays open.
+- `NP-21`: Partial.
+  Public anchor:
+  `crates/registry-platform-sdjwt/src/lib.rs::holder_proof_enforces_audience_lifetime_and_bindings`.
+  Retired anchors (`v0.16.3`):
+  `crates/registry-notary-server/tests/sd_jwt_vc_verifier_compat.rs::missing_cnf_when_holder_binding_required_fails_with_holder_binding_required`
   and `crates/registry-notary-server/tests/sd_jwt_vc_verifier_compat.rs::holder_proof_mismatch_fails_with_holder_binding_proof_invalid`.
-  Disposition: holder-binding failure coverage cites named Notary verifier and
-  platform holder-proof tests for required confirmation and proof-mismatch
-  denial behavior.
-- `NP-22`: Covered.
-  Public anchors:
+  Disposition: the platform holder-proof test still covers audience, lifetime,
+  and binding enforcement. The required-confirmation and proof-mismatch
+  verifier evidence was Notary's, so the row is downgraded from `Covered` and
+  stays open for a maintained verifier surface.
+- `NP-22`: Retired evidence (was Covered).
+  Retired anchors (`v0.16.3`):
   `crates/registry-notary-server/src/standalone/tests/auth.inc::notary_transaction_token_auth_consumes_jti_once`,
   `crates/registry-notary-server/src/standalone/tests/auth.inc::consume_notary_token_jti_rejects_missing_jti_for_transaction_typ`,
   and `crates/registry-notary-server/tests/standalone_http/preauth.rs::preauth_transaction_token_jti_denials_are_stable_and_redacted`.
-  Disposition: single-use transaction-token `jti` enforcement, missing-`jti`
+  Historical disposition: single-use transaction-token `jti` enforcement, missing-`jti`
   fail-closed behavior, replay denial, product-surface HTTP audit parity, and
   response/audit redaction are covered.
-- `NP-23`: Gap.
-  Public anchor: parked source under `crates/registry-platform-sts`.
-  Disposition: maintainer-approved deferral recorded by #246 and #334. STS has
+- `NP-23`: Retired evidence (was Gap).
+  Retired anchor (`v0.16.3`): parked source under `crates/registry-platform-sts`.
+  Historical disposition: maintainer-approved deferral recorded by #246 and #334. STS has
   no promoted release-surface consumer and is parked outside workspace CI and
   release artifacts. Revisit denial-audit parity only when #298 promotes a
   named consumer, then restore the crate's fuzz and adversarial-review coverage
   before treating it as release evidence.
+  Retirement note: the crate was removed from the tree by the Notary
+  retirement, so there is no parked source left to promote. If transaction-token
+  exchange returns to the stack, this row needs fresh evidence rather than the
+  recorded deferral.
 - `NP-24`: Partial.
-  Public anchors:
+  Public anchor:
+  `crates/registry-relay/src/auth/api_key.rs::authorization_header_wins_over_x_api_key`.
+  Retired anchors (`v0.16.3`):
   `crates/registry-notary-server/src/standalone/tests/auth.inc::static_auth_rejects_multiple_credential_headers`,
   `crates/registry-notary-server/src/standalone/tests/auth.inc::static_auth_rejects_api_key_with_malformed_authorization_header`,
-  `crates/registry-notary-server/tests/standalone_http/preauth.rs::preauth_transaction_token_jti_denials_are_stable_and_redacted`,
-  and `crates/registry-relay/src/auth/api_key.rs::authorization_header_wins_over_x_api_key`.
-  Disposition: Notary rejects API-key plus Bearer credentials and API-key plus
-  malformed Authorization as multiple credentials before choosing or falling
-  back to either source. The API-key-plus-Bearer HTTP path returns the stable
-  `auth.multiple_credentials` denial, emits a matching redacted audit record,
-  and does not disclose raw credential values. The malformed-Authorization
-  plus-valid-API-key case is unit-only and still needs equivalent HTTP response
-  and audit evidence. Relay currently diverges: when both credential headers
-  are present, Authorization takes precedence over `x-api-key`. That product
-  difference remains open for release sign-off or follow-up.
-- `NP-25`: Covered.
-  Public anchors: `crates/registry-notary-core/src/deployment.rs` and
+  and `crates/registry-notary-server/tests/standalone_http/preauth.rs::preauth_transaction_token_jti_denials_are_stable_and_redacted`.
+  Disposition: the multiple-credentials rejection evidence was Notary's and is
+  historical. Historically Notary rejected API-key plus Bearer and API-key plus
+  malformed Authorization before choosing or falling back to either source,
+  with a stable `auth.multiple_credentials` denial and a matching redacted
+  audit record. What remains on the maintained surface is Relay's documented
+  behavior: when both credential headers are present, Authorization takes
+  precedence over `x-api-key` rather than being rejected as multiple
+  credentials. The row stays open for a decision on whether Relay should reject
+  instead, and for the HTTP response and audit evidence that would go with it.
+- `NP-25`: Retired evidence (was Covered).
+  Retired anchors (`v0.16.3`): `crates/registry-notary-core/src/deployment.rs` and
   `crates/registry-notary-server/src/standalone/tests/deployment_gates.rs`.
-  Disposition: current Notary startup gates require an explicit deployment
-  profile, keep `local` as the development opt-out, and reject unknown profile
-  values.
-- `NP-26`: Partial.
-  Public anchors:
+  Historical disposition: Notary startup gates required an explicit deployment
+  profile, kept `local` as the development opt-out, and rejected unknown
+  profile values.
+- `NP-26`: Retired evidence (was Partial).
+  Retired anchors (`v0.16.3`):
   `crates/registry-notary-core/src/config/evidence/relay.rs`,
   `crates/registry-notary-core/src/config/tests/relay.rs::relay_connection_requires_https_origin_or_explicit_loopback`,
   `crates/registry-notary-core/src/config/tests/relay.rs::relay_token_file_and_private_cidrs_are_exact_and_bounded`,
   `crates/registry-notary-server/src/relay_client.rs`,
   and `crates/registry-notary-server/src/relay_client/tests.rs::status_size_redirect_and_retry_behavior_is_closed`.
-  Disposition: the retired direct-source and sidecar network model is not
-  release evidence. The active Relay consultation boundary validates one
-  configured HTTPS origin with an explicit loopback exception, bounds the
-  private CIDR exception list and both metadata and result response bodies, and
-  rejects redirects without retrying. Keep open for release sign-off against
-  the redesigned Notary-to-Relay ownership split.
-- `NP-27`: Covered.
-  Public anchors:
+  Historical disposition: the direct-source and sidecar network model was
+  already out of release evidence when this row was written. The Notary-to-Relay
+  consultation boundary that replaced it validated one configured HTTPS origin
+  with an explicit loopback exception, bounded the private CIDR exception list
+  and both metadata and result response bodies, and rejected redirects without
+  retrying. That boundary retired with the product; Relay's own outbound
+  posture is not covered by this row.
+- `NP-27`: Retired evidence (was Covered).
+  Retired anchors (`v0.16.3`):
   `crates/registry-notary-server/src/runtime/tests/evaluation.rs::registry_backed_preflight_denial_makes_zero_relay_calls`,
   `crates/registry-notary-server/src/runtime/tests/evaluation.rs::evaluate_denies_missing_scope`,
   and `crates/registry-notary-server/src/api/tests/audit.rs::pdp_pre_evaluation_denial_audit_records_zero_consultations_and_no_forward`.
-  Disposition: the runtime and API audit boundaries cover pre-evaluation
+  Historical disposition: the runtime and API audit boundaries cover pre-evaluation
   denial, stable PDP problem shape, zero Relay consultations,
   `relay_consultation_count = 0`,
   `forwarded = false`, and response/audit redaction.
-- `NP-28`: Covered.
-  Public anchors:
+- `NP-28`: Retired evidence (was Covered).
+  Retired anchors (`v0.16.3`):
   `crates/registry-notary-server/tests/standalone_http/credentials.rs::direct_credential_pre_evaluation_denials_are_audited_and_redacted`,
   `crates/registry-notary-server/tests/standalone_http/credentials.rs::direct_credential_operation_denial_is_audited_and_preserves_denial_code`,
   `crates/registry-notary-server/tests/standalone_http/credentials.rs::direct_credential_rate_limit_is_audited_with_stored_context`,
@@ -223,7 +257,7 @@ public evidence or disposition.
   `crates/registry-notary-server/src/api/tests/evaluations.rs::evaluation_access_uses_stored_claim_version_scope`,
   `crates/registry-notary-server/src/runtime/tests/render.rs::credential_profile_for_rejects_profile_not_listed_in_claim`,
   and `crates/registry-notary-server/src/api/tests/credentials.rs::issue_credential_fails_closed_when_status_record_write_fails`.
-  Disposition: caller-triggered pre-evaluation request, classification, and
+  Historical disposition: caller-triggered pre-evaluation request, classification, and
   lookup denials emit a minimal `credential_denied` event without recording an
   untrusted evaluation id. Evaluation-bound binding, stored-access, policy,
   proof, and replay denials share redacted stored-evaluation context and
@@ -237,8 +271,8 @@ public evidence or disposition.
   Tests assert stable problem responses, no unintended
   credential issuance, no credential material, redacted audit records,
   `relay_consultation_count = 0`, and `forwarded = false` on credential denial paths.
-- `NP-29`: Covered.
-  Public anchors:
+- `NP-29`: Retired evidence (was Covered).
+  Retired anchors (`v0.16.3`):
   `crates/registry-notary-server/tests/standalone_http/federation.rs::federation_evaluation_returns_signed_response_and_rejects_replay`,
   `crates/registry-notary-server/tests/standalone_http/federation.rs::federation_auth_exempt_route_still_requires_valid_jws`,
   `crates/registry-notary-server/tests/standalone_http/federation.rs::federation_denial_happens_before_claim_evaluation`,
@@ -247,7 +281,7 @@ public evidence or disposition.
   `crates/registry-notary-server/tests/standalone_http/federation.rs::federation_request_claims_must_match_profile_before_claim_evaluation`,
   `crates/registry-notary-server/tests/standalone_http/federation.rs::federation_stale_claim_result_returns_signed_evaluation_error`,
   and `crates/registry-notary-server/src/federation/mod.rs::federation_response_signing_failure_emits_denial_audit_with_context`.
-  Disposition: pre-verification signature and emergency-denylist denials omit
+  Historical disposition: pre-verification signature and emergency-denylist denials omit
   untrusted request context. After signature verification, denial records retain
   the configured issuer and peer evaluation scopes plus the request profile and
   purpose, hash the peer id and request JTI, and include a pairwise
@@ -264,3 +298,6 @@ This map records the current state; it does not close every release gap. Before
 checking the release-readiness item, each row marked `Partial` or `Gap` must
 have either a linked test PR that asserts denial plus audit-record correctness,
 or a maintainer-approved deferral with rationale.
+Each row marked `Retired evidence` must be re-scoped against a maintained
+product and then covered, deferred, or explicitly declared out of scope. A
+retired row must never be counted as coverage.
diff --git a/release/registry-release-lock-payload.v1.schema.json b/release/registry-release-lock-payload.v1.schema.json
index 2a572c55f..b63ae5ddc 100644
--- a/release/registry-release-lock-payload.v1.schema.json
+++ b/release/registry-release-lock-payload.v1.schema.json
@@ -21,7 +21,7 @@
       "const": "io.registrystack.registry_release_lock"
     },
     "schema_version": {
-      "const": "1.0"
+      "const": "2.0"
     },
     "release": {
       "$ref": "#/$defs/release"
@@ -39,16 +39,12 @@
       "additionalProperties": false,
       "required": [
         "relay",
-        "notary",
         "postgresql_state_plane"
       ],
       "properties": {
         "relay": {
           "$ref": "#/$defs/image"
         },
-        "notary": {
-          "$ref": "#/$defs/image"
-        },
         "postgresql_state_plane": {
           "$ref": "#/$defs/image"
         }
@@ -60,7 +56,6 @@
       "required": [
         "relay_public",
         "relay_consultation",
-        "notary",
         "postgresql_state_plane",
         "operator_files"
       ],
@@ -71,16 +66,13 @@
         "relay_consultation": {
           "$ref": "#/$defs/product_runtime"
         },
-        "notary": {
-          "$ref": "#/$defs/product_runtime"
-        },
         "postgresql_state_plane": {
           "$ref": "#/$defs/postgresql_runtime"
         },
         "operator_files": {
           "type": "array",
-          "minItems": 9,
-          "maxItems": 9,
+          "minItems": 6,
+          "maxItems": 6,
           "items": {
             "$ref": "#/$defs/operator_file"
           }
@@ -502,8 +494,6 @@
             "dotenv",
             "pem_certificate",
             "pem_private_key",
-            "json_web_key",
-            "compact_jwt",
             "opaque"
           ]
         },
@@ -542,8 +532,7 @@
         "config_signature_schema",
         "trust_anchor_schema",
         "anchor_transition_schema",
-        "relay_config_schema",
-        "notary_config_schema"
+        "relay_config_schema"
       ],
       "properties": {
         "config_bundle_schema": {
@@ -560,9 +549,6 @@
         },
         "relay_config_schema": {
           "const": "https://id.registrystack.org/schemas/registry-relay/registry-relay.config.schema.json"
-        },
-        "notary_config_schema": {
-          "const": "https://id.registrystack.org/schemas/registry-notary/registry-notary.config.schema.json"
         }
       }
     },
diff --git a/release/registry-release-lock.v1.schema.json b/release/registry-release-lock.v1.schema.json
index 66c614e06..183879946 100644
--- a/release/registry-release-lock.v1.schema.json
+++ b/release/registry-release-lock.v1.schema.json
@@ -15,7 +15,7 @@
       "const": "io.registrystack.registry_release_lock"
     },
     "schema_version": {
-      "const": "1.0"
+      "const": "2.0"
     },
     "signed_payload": {
       "description": "Standard-base64 encoding of the exact RFC 8785 canonical RegistryReleaseLockV1 payload bytes signed by sigstore_bundle.",
diff --git a/release/scripts/build-release-binaries.sh b/release/scripts/build-release-binaries.sh
index 86b6c18fa..6b0b83de9 100755
--- a/release/scripts/build-release-binaries.sh
+++ b/release/scripts/build-release-binaries.sh
@@ -80,21 +80,12 @@ docker run --rm \
     cp target/release/registry-relay-rhai-worker dist/image-bin/registry-relay-rhai-worker
 
     cargo build --release --locked \
-      -p registry-notary \
-      --features registry-notary/registry-notary-cel
-    cp target/release/registry-notary "dist/bin/registry-notary-${RELEASE_TAG}-linux-amd64"
-
-    cargo build --release --locked \
-      -p registry-notary \
-      --features registry-notary/registry-notary-cel,registry-notary/pkcs11
-    cp target/release/registry-notary dist/image-bin/registry-notary
-
-    cargo build --release --locked \
-      -p registry-notary-server \
-      --bin registry-notary-cel-worker \
-      --features registry-notary-server/registry-notary-cel
-    cp target/release/registry-notary-cel-worker "dist/bin/registry-notary-cel-worker-${RELEASE_TAG}-linux-amd64"
-    cp target/release/registry-notary-cel-worker dist/image-bin/registry-notary-cel-worker
+      -p registry-evidence \
+      -p registry-evidencectl \
+      -p registry-mint
+    cp target/release/evidence "dist/bin/evidence-${RELEASE_TAG}-linux-amd64"
+    cp target/release/evidencectl "dist/bin/evidencectl-${RELEASE_TAG}-linux-amd64"
+    cp target/release/mint "dist/bin/mint-${RELEASE_TAG}-linux-amd64"
   '
 
 printf '%s\n' "${release_builder_image}" > "${repo_root}/dist/image-bin/RELEASE_BUILDER_IMAGE"
@@ -103,19 +94,19 @@ chmod 0755 \
   "${repo_root}/dist/bin/registry-manifest-${tag}-linux-amd64" \
   "${repo_root}/dist/bin/registry-relay-${tag}-linux-amd64" \
   "${repo_root}/dist/bin/registry-relay-rhai-worker-${tag}-linux-amd64" \
-  "${repo_root}/dist/bin/registry-notary-${tag}-linux-amd64" \
-  "${repo_root}/dist/bin/registry-notary-cel-worker-${tag}-linux-amd64" \
-  "${repo_root}/dist/image-bin/registry-notary" \
-  "${repo_root}/dist/image-bin/registry-notary-cel-worker" \
+  "${repo_root}/dist/bin/evidence-${tag}-linux-amd64" \
+  "${repo_root}/dist/bin/evidencectl-${tag}-linux-amd64" \
+  "${repo_root}/dist/bin/mint-${tag}-linux-amd64" \
   "${repo_root}/dist/image-bin/registry-relay" \
   "${repo_root}/dist/image-bin/registry-relay-rhai-worker"
 
 (
   cd -- "${repo_root}/dist/bin"
   sha256sum -- \
+    "evidence-${tag}-linux-amd64" \
+    "evidencectl-${tag}-linux-amd64" \
+    "mint-${tag}-linux-amd64" \
     "registry-manifest-${tag}-linux-amd64" \
-    "registry-notary-${tag}-linux-amd64" \
-    "registry-notary-cel-worker-${tag}-linux-amd64" \
     "registry-relay-${tag}-linux-amd64" \
     "registry-relay-rhai-worker-${tag}-linux-amd64" \
     "registryctl-${tag}-linux-amd64" \
@@ -125,8 +116,6 @@ chmod 0755 \
   cd -- "${repo_root}/dist/image-bin"
   sha256sum -- \
     RELEASE_BUILDER_IMAGE \
-    registry-notary \
-    registry-notary-cel-worker \
     registry-relay \
     registry-relay-rhai-worker \
     > SHA256SUMS
diff --git a/release/scripts/build-release-image.sh b/release/scripts/build-release-image.sh
index 96ef60727..b6891522c 100755
--- a/release/scripts/build-release-image.sh
+++ b/release/scripts/build-release-image.sh
@@ -24,7 +24,7 @@ release_image_context="${RELEASE_IMAGE_CONTEXT:-${repo_root}}"
 created_builder=false
 
 case "${name}" in
-  registry-notary|registry-relay)
+  registry-relay)
     dockerfile="${repo_root}/release/docker/Dockerfile.${name}"
     ;;
   *)
diff --git a/release/scripts/check-debian13-images.py b/release/scripts/check-debian13-images.py
index 59c3739ca..f501d20ae 100755
--- a/release/scripts/check-debian13-images.py
+++ b/release/scripts/check-debian13-images.py
@@ -27,40 +27,47 @@
     "a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e"
 )
 
+# The runtime reference without its digest, used to recognise a Distroless stage
+# even when its base is unpinned, so an unpinned base is reported rather than
+# quietly dropping the stage out of the scan that follows.
+DISTROLESS_REPOSITORY = DISTROLESS_RUNTIME.split("@", 1)[0]
+
 DOCKERFILES = (
     Path("crates/registry-relay/Dockerfile"),
     Path("crates/registry-relay/Dockerfile.demo"),
-    Path("products/notary/Dockerfile"),
-    Path("release/docker/Dockerfile.registry-notary"),
     Path("release/docker/Dockerfile.registry-relay"),
 )
 
+# Adopter and development images. They build from source like the per-product
+# Dockerfiles above, but one file produces two binaries as two targets, so there
+# is no single stage named `runtime` and no HEALTHCHECK (Distroless has no shell
+# and neither binary has a healthcheck subcommand; both serve GET /health for
+# HTTP probes instead). The Debian 13 boundary and the digest pins still bind
+# them, so they are checked here under their own shape rather than left
+# uncovered for not fitting the release one.
+ADOPTER_DOCKERFILES = (Path("docker/Dockerfile"),)
+
 # These are the maintained image and image-policy surfaces. Historical release
 # notes are immutable evidence and intentionally are not rewritten by this gate.
-MAINTAINED_TEXT_PATHS = DOCKERFILES + (
+MAINTAINED_TEXT_PATHS = DOCKERFILES + ADOPTER_DOCKERFILES + (
     Path(".github/workflows/release-candidate.yml"),
     Path(".github/workflows/release.yml"),
     Path("release/scripts/build-release-binaries.sh"),
     Path("crates/registry-relay/docs/ops.md"),
     Path("crates/registry-relay/docs/security-assurance.md"),
     Path("crates/registry-relay/scripts/check_docker_build_contract.py"),
-    Path("crates/registry-relay/scripts/run-live-consultation-journey.sh"),
-    Path("products/notary/docs/security-assurance.md"),
 )
 
-RUST_BUILDER_DOCKERFILES = DOCKERFILES[:3]
-PREPARATION_DOCKERFILES = DOCKERFILES[3:]
+RUST_BUILDER_DOCKERFILES = DOCKERFILES[:2]
+PREPARATION_DOCKERFILES = DOCKERFILES[2:]
 RELAY_DOCKERFILES = (
     Path("crates/registry-relay/Dockerfile"),
     Path("crates/registry-relay/Dockerfile.demo"),
     Path("release/docker/Dockerfile.registry-relay"),
 )
-NOTARY_DOCKERFILES = (
-    Path("products/notary/Dockerfile"),
-    Path("release/docker/Dockerfile.registry-notary"),
-)
 
 FROM_RE = re.compile(r"^FROM\s+(?:--platform=\S+\s+)?(\S+)", re.MULTILINE)
+STAGE_NAME_RE = re.compile(r"^FROM\s+\S+\s+AS\s+(\S+)", re.MULTILINE | re.IGNORECASE)
 DIGEST_PIN_RE = re.compile(r"@sha256:[0-9a-f]{64}$")
 RETIRED_DEBIAN_RE = re.compile(
     r"\b(?:bookworm|debian[\s_:-]*v?[\s_:-]*12)\b",
@@ -94,6 +101,29 @@ def runtime_stage(text: str) -> str:
     return text[offset:] if offset >= 0 else ""
 
 
+def distroless_stages(text: str) -> list[tuple[str, str]]:
+    """Every stage built on the Distroless runtime, as (base, stage text).
+
+    Release images name that stage `runtime`, so `runtime_stage` can find it by
+    name. An image that builds more than one binary names one stage per binary,
+    so these are found by their base instead. Matching the repository rather
+    than the full pinned reference keeps an unpinned base visible here, where it
+    is reported, instead of silently dropping the stage from the scan.
+    """
+    stages = []
+    for segment in re.split(r"^FROM ", text, flags=re.MULTILINE)[1:]:
+        base = segment.split(maxsplit=1)[0] if segment.split() else ""
+        if not base.startswith(DISTROLESS_REPOSITORY):
+            continue
+        # Comments are scanned out so that a stage may say in prose why it has
+        # no shell or curl without the words themselves reading as a violation.
+        instructions = "\n".join(
+            line for line in segment.splitlines() if not line.lstrip().startswith("#")
+        )
+        stages.append((base, f"\n{instructions}"))
+    return stages
+
+
 def check_repository(root: Path = ROOT) -> list[str]:
     failures: list[str] = []
     texts = {
@@ -184,69 +214,72 @@ def check_repository(root: Path = ROOT) -> list[str]:
             failures,
         )
 
-    for relative in RELAY_DOCKERFILES:
+    for relative in ADOPTER_DOCKERFILES:
         text = texts[relative]
+        if not text.startswith(f"# syntax={DOCKERFILE_FRONTEND}\n"):
+            failures.append(
+                f"{relative}: pinned Dockerfile frontend must be the first line"
+            )
+        bases = FROM_RE.findall(text)
+        if not bases:
+            failures.append(f"{relative}: no FROM instruction found")
+        # A multi-target image builds most of its stages on earlier stages of the
+        # same file. Only the bases that come from outside the file are upstream
+        # images, and only those can carry a digest.
+        local_stages = set(STAGE_NAME_RE.findall(text))
+        for base in bases:
+            if base in local_stages:
+                continue
+            if not DIGEST_PIN_RE.search(base):
+                failures.append(
+                    f"{relative}: upstream base is not pinned by immutable digest: {base}"
+                )
         require(
             text,
-            "/usr/local/bin/registry-relay-rhai-worker",
+            f"FROM {RUST_BUILDER} AS chef",
             relative,
-            "Relay worker binary",
+            "pinned Debian 13 Rust builder",
             failures,
         )
         require(
-            runtime_stage(text),
-            'ENTRYPOINT ["/usr/local/bin/registry-relay"]',
+            text,
+            "chown -R 65532:65532",
             relative,
-            "absolute Relay entrypoint",
+            "numeric nonroot-owned runtime directories",
             failures,
         )
+        stages = distroless_stages(text)
+        if not stages:
+            failures.append(
+                f"{relative}: no stage runs on the Distroless Debian 13 non-root runtime"
+            )
+        for base, stage in stages:
+            if base != DISTROLESS_RUNTIME:
+                failures.append(
+                    f"{relative}: Distroless runtime is not the pinned base: {base}"
+                )
+            for forbidden in ("\nRUN ", "apt-get", "/bin/sh", "curl ", "wget "):
+                if forbidden in stage:
+                    failures.append(
+                        f"{relative}: Distroless runtime contains {forbidden.strip()!r}"
+                    )
 
-    product_notary = texts[Path("products/notary/Dockerfile")]
-    require(
-        product_notary,
-        'ARG REGISTRY_NOTARY_FEATURES="registry-notary-cel,pkcs11"',
-        Path("products/notary/Dockerfile"),
-        "PKCS#11-enabled product build",
-        failures,
-    )
-    for relative in NOTARY_DOCKERFILES:
+    for relative in RELAY_DOCKERFILES:
         text = texts[relative]
         require(
             text,
-            "registry-notary-cel-worker",
-            relative,
-            "Notary CEL worker binary",
-            failures,
-        )
-        require(
-            runtime_stage(text),
-            'ENTRYPOINT ["/usr/local/bin/registry-notary"]',
-            relative,
-            "absolute Notary entrypoint",
-            failures,
-        )
-        require(
-            text,
-            "chown -R 65532:65532",
+            "/usr/local/bin/registry-relay-rhai-worker",
             relative,
-            "numeric nonroot-owned Notary runtime directories",
+            "Relay worker binary",
             failures,
         )
         require(
             runtime_stage(text),
-            "WORKDIR /var/lib/registry-notary",
+            'ENTRYPOINT ["/usr/local/bin/registry-relay"]',
             relative,
-            "Notary working directory",
+            "absolute Relay entrypoint",
             failures,
         )
-        if re.search(
-            r"^\s*(?:COPY|ADD)\b[^\n]*(?:\.so\b|pkcs11[^/\s]*module)",
-            text,
-            re.IGNORECASE | re.MULTILINE,
-        ):
-            failures.append(
-                f"{relative}: vendor PKCS#11 modules must remain external read-only mounts"
-            )
 
     candidate_workflow = texts[Path(".github/workflows/release-candidate.yml")]
     release_workflow = texts[Path(".github/workflows/release.yml")]
@@ -258,6 +291,15 @@ def check_repository(root: Path = ROOT) -> list[str]:
         "pinned Debian 13 release builder",
         failures,
     )
+    # The workflow passes the builder in, and the recipe refuses anything but
+    # its own default, so both ends have to carry the same pin.
+    require(
+        binary_recipe,
+        f'default_builder_image="{RUST_BUILDER}"',
+        Path("release/scripts/build-release-binaries.sh"),
+        "pinned Debian 13 release builder",
+        failures,
+    )
     for forbidden in (
         "RELEASE_BUILDER_IMAGE:",
         "release/scripts/build-release-binaries.sh",
@@ -270,25 +312,6 @@ def check_repository(root: Path = ROOT) -> list[str]:
                 ".github/workflows/release.yml: promotion workflow must not "
                 f"rebuild candidate artifacts: {forbidden!r}"
             )
-    require(
-        binary_recipe,
-        "--features registry-notary/registry-notary-cel,registry-notary/pkcs11",
-        Path("release/scripts/build-release-binaries.sh"),
-        "PKCS#11-enabled release build",
-        failures,
-    )
-
-    live_journey = texts[
-        Path("crates/registry-relay/scripts/run-live-consultation-journey.sh")
-    ]
-    require(
-        live_journey,
-        RUST_BUILDER,
-        Path("crates/registry-relay/scripts/run-live-consultation-journey.sh"),
-        "pinned Debian 13 live-journey builder",
-        failures,
-    )
-
     return failures
 
 
diff --git a/release/scripts/check-gates-inventory.py b/release/scripts/check-gates-inventory.py
index 1a33f4de1..5de2bd7d4 100644
--- a/release/scripts/check-gates-inventory.py
+++ b/release/scripts/check-gates-inventory.py
@@ -59,22 +59,10 @@
         "actionlint workflow lint",
         '"${RUNNER_TEMP}/bin/actionlint"',
     ),
-    (
-        "Advisory checker byte identity",
-        "run: python3 release/scripts/check_advisory_checker_copies.py",
-    ),
-    (
-        "Notary advisory checker tests",
-        "python3 -m unittest products/notary/tests/advisory_baseline_check_test.py",
-    ),
     (
         "Relay advisory checker tests",
         "python3 -m unittest crates/registry-relay/tests/advisory_baseline_check_test.py",
     ),
-    (
-        "Advisory checker identity guard tests",
-        "run: python3 -m unittest release/scripts/test_check_advisory_checker_copies.py",
-    ),
     (
         "Debian 13 image contract",
         "run: python3 release/scripts/check-debian13-images.py",
@@ -162,10 +150,15 @@
         "Platform fuzz directory",
         "cargo +nightly fuzz run --fuzz-dir fuzz",
     ),
-    ("Notary OpenAPI baseline", "run: just openapi-check"),
-    ("Notary OpenAPI contract", "name: Notary OpenAPI contract"),
-    ("Notary exposure check", "name: Notary exposure check"),
-    ("Notary exposure command", "run: just exposure-check"),
+    ("Evidence contract gate", "evidence-contracts:"),
+    (
+        "Evidence contract reproduction",
+        "run: products/evidence/scripts/check-contracts.sh",
+    ),
+    (
+        "Evidence source neutrality",
+        "run: products/evidence/scripts/check-source-neutrality.sh",
+    ),
     ("Relay OpenAPI contract", "name: Relay OpenAPI contract"),
     ("Relay OpenAPI command", "run: just openapi-contract"),
     ("Relay exposure check", "name: Relay exposure check"),
@@ -237,14 +230,6 @@
         "OpenID conformance runner tests",
         "run: python3 -m unittest release/scripts/test_openid_conformance_runner.py",
     ),
-    (
-        "External integration evidence runner tests",
-        "run: python3 -m unittest release/scripts/test_integration_e2_runner.py",
-    ),
-    (
-        "External integration evidence packet",
-        "run: python3 release/scripts/integration-e2-runner.py validate",
-    ),
     (
         "Relay OIDC smoke tests",
         "run: python3 -m unittest release/scripts/test_relay_oidc_smoke.py",
diff --git a/release/scripts/check-release-source-model.sh b/release/scripts/check-release-source-model.sh
index d95735929..40d05686f 100755
--- a/release/scripts/check-release-source-model.sh
+++ b/release/scripts/check-release-source-model.sh
@@ -59,8 +59,10 @@ stack_dirty="$(dirty_count "${stack_root}")"
 require_cargo_repo "registry-stack" "${stack_root}"
 require_path "registry-platform crates" "${stack_root}/crates/registry-platform-authcommon"
 require_path "registry-manifest crates" "${stack_root}/crates/registry-manifest-core"
-require_path "registry-notary crates" "${stack_root}/crates/registry-notary-server"
 require_path "registry-relay crate" "${stack_root}/crates/registry-relay"
+require_path "registry-evidence crate" "${stack_root}/crates/registry-evidence"
+require_path "registry-evidencectl crate" "${stack_root}/crates/registry-evidencectl"
+require_path "registry-mint crate" "${stack_root}/crates/registry-mint"
 require_path "registryctl crate" "${stack_root}/crates/registryctl"
 if [[ "${stack_git_root}" != "${stack_root}" ]]; then
 	echo "release source model failed: registry-stack source dir must be the monorepo root, got ${stack_root} inside ${stack_git_root}" >&2
diff --git a/release/scripts/check-stable-surface-compatibility.py b/release/scripts/check-stable-surface-compatibility.py
index d0ef6e2fd..ebb2cc0b9 100644
--- a/release/scripts/check-stable-surface-compatibility.py
+++ b/release/scripts/check-stable-surface-compatibility.py
@@ -19,7 +19,26 @@
 ERROR_REFERENCE = Path("docs/site/src/content/docs/reference/errors.mdx")
 OPENAPI_SPECS = {
     "registry-relay": Path("crates/registry-relay/openapi/registry-relay.openapi.json"),
-    "registry-notary": Path("products/notary/openapi/registry-notary.openapi.json"),
+}
+MAINTAINED_RELEASE_PRODUCTS = frozenset({"registry-relay"})
+HISTORICAL_RELEASE_PRODUCTS = frozenset({"registry-notary"})
+KNOWN_RELEASE_PRODUCTS = MAINTAINED_RELEASE_PRODUCTS | HISTORICAL_RELEASE_PRODUCTS
+HISTORICAL_DIAGNOSTIC_PRODUCTS = frozenset({"registry_notary"})
+# Codes a released catalog carried and a maintained product no longer emits.
+# Keyed by the exact (family, product, code) so the exemption reaches one code
+# and never the product's other codes, which stay guarded. A retirement is a
+# published-surface decision, so each one states why here rather than in a
+# commit message a reader of this file will not see.
+RETIRED_DIAGNOSTIC_CODES: dict[tuple[str, str, str], str] = {
+    (
+        "fixture_execution",
+        "registryctl_relay_offline_harness",
+        "authorization.denied",
+    ): (
+        "The offline fixture harness reached this code only through Notary's "
+        "standalone authentication, which was removed with the product. The "
+        "harness itself is maintained and its other codes still stand."
+    ),
 }
 DIAGNOSTIC_CATALOGS = {
     "authoring": (
@@ -223,6 +242,8 @@ def compare_diagnostic_contracts(
     errors: list[str] = []
     for key, old in sorted(base.items()):
         family, product, code = key
+        if product in HISTORICAL_DIAGNOSTIC_PRODUCTS or key in RETIRED_DIAGNOSTIC_CODES:
+            continue
         new = current.get(key)
         label = f"{family} {product} {code}"
         if new is None:
@@ -267,11 +288,21 @@ def parse_error_registry(text: str) -> dict[str, ErrorContract]:
         entries.setdefault(code, (meaning, set()))[1].add(product)
 
     if not entries:
-        raise ContractError("error reference contains no Registry Relay or Registry Notary codes")
-    return {
-        code: ErrorContract(meaning, frozenset(products))
-        for code, (meaning, products) in entries.items()
-    }
+        raise ContractError(
+            "error reference contains no maintained Registry Relay codes "
+            "and no historical Registry Notary codes"
+        )
+    current_entries: dict[str, ErrorContract] = {}
+    for code, (meaning, products) in entries.items():
+        maintained_products = products & MAINTAINED_RELEASE_PRODUCTS
+        if maintained_products:
+            current_entries[code] = ErrorContract(
+                meaning,
+                frozenset(maintained_products),
+            )
+    if not current_entries:
+        raise ContractError("error reference contains no maintained Registry Relay codes")
+    return current_entries
 
 
 def compare_error_contracts(
@@ -325,8 +356,8 @@ def validate_metrics_contract(data: Any, root: Path = ROOT) -> dict[tuple[str, s
         meaning = metric["meaning"]
         labels = metric["labels"]
         source = metric["source"]
-        if product not in {"registry-relay", "registry-notary"}:
-            raise ContractError(f"{label}.product is not a released product")
+        if product not in MAINTAINED_RELEASE_PRODUCTS:
+            raise ContractError(f"{label}.product is not a maintained product")
         if not isinstance(name, str) or re.fullmatch(r"[a-z_:][a-z0-9_:]*", name) is None:
             raise ContractError(f"{label}.name is not a Prometheus metric name")
         if metric_type not in {"counter", "gauge", "histogram", "summary", "untyped"}:
@@ -373,6 +404,8 @@ def compare_metrics_contracts(
     for key, old in sorted(base.items()):
         new = current.get(key)
         product, name = key
+        if product in HISTORICAL_RELEASE_PRODUCTS:
+            continue
         if new is None:
             errors.append(f"selected metric removed: {product} {name}")
             continue
@@ -574,7 +607,7 @@ def _validate_metrics_shape_only(data: Any) -> dict[tuple[str, str], dict[str, A
                 metric[field]
         except (KeyError, TypeError) as error:
             raise ContractError(f"{label} is missing a protected field") from error
-        if product not in {"registry-relay", "registry-notary"}:
+        if product not in KNOWN_RELEASE_PRODUCTS:
             raise ContractError(f"{label}.product is not a released product")
         if not isinstance(name, str) or re.fullmatch(r"[a-z_:][a-z0-9_:]*", name) is None:
             raise ContractError(f"{label}.name is not a Prometheus metric name")
diff --git a/release/scripts/check_adopter_compose_contract.py b/release/scripts/check_adopter_compose_contract.py
index 35d8ba29a..7b6f05eca 100644
--- a/release/scripts/check_adopter_compose_contract.py
+++ b/release/scripts/check_adopter_compose_contract.py
@@ -33,21 +33,18 @@
         "registry-postgres",
         "registry-relay-public",
         "registry-relay-consultation",
-        "registry-notary",
     }
 )
 STAGER_SERVICES = frozenset(
     {
         "registry-postgresql-stage-secrets",
         "registry-relay-consultation-stage-secrets",
-        "registry-notary-stage-secrets",
     }
 )
 ACTION_STAGER_SERVICES = frozenset(
     {
         "registry-postgresql-actions-stage-secrets",
         "registry-relay-consultation-actions-stage-secrets",
-        "registry-notary-actions-stage-secrets",
     }
 )
 ORDINARY_SERVICES = WORKLOAD_SERVICES | STAGER_SERVICES
@@ -56,19 +53,14 @@
         "registry-postgres-bootstrap",
         "registry-relay-public-prepare-state",
         "registry-relay-consultation-prepare-state",
-        "registry-notary-prepare-state",
         "registry-relay-public-initialize",
         "registry-relay-consultation-initialize",
-        "registry-notary-initialize",
         "registry-relay-public-preview-state",
         "registry-relay-consultation-preview-state",
-        "registry-notary-preview-state",
         "registry-relay-public-accept-state",
         "registry-relay-consultation-accept-state",
-        "registry-notary-accept-state",
         "registry-relay-public-verify-state",
         "registry-relay-consultation-verify-state",
-        "registry-notary-verify-state",
     }
 )
 
@@ -76,14 +68,11 @@
     {
         "relay-public-environment",
         "relay-consultation-environment",
-        "notary-environment",
         "postgresql-bootstrap-environment",
     }
 )
 OPERATOR_SECRET_FILES = frozenset(
     {
-        "notary-relay-workload-credential",
-        "notary-signing-key",
         "postgresql-admin-password",
         "postgresql-tls-certificate",
         "postgresql-tls-private-key",
@@ -94,7 +83,6 @@
 LANE_ENVIRONMENTS = {
     "registry-relay-public": "relay-public-environment",
     "registry-relay-consultation": "relay-consultation-environment",
-    "registry-notary": "notary-environment",
 }
 ORDINARY_COMMANDS = {
     "registry-postgres": ["postgres"],
@@ -104,7 +92,6 @@
         "relay-consultation",
         "serve",
     ],
-    "registry-notary": ["product-action", "serve"],
 }
 POSTGRESQL_ORDINARY_ENTRYPOINT = [
     "/bin/bash",
@@ -138,11 +125,6 @@
         "registry-postgres": "service_healthy",
         "registry-relay-consultation-stage-secrets": ("service_completed_successfully"),
     },
-    "registry-notary": {
-        "registry-postgres": "service_healthy",
-        "registry-relay-consultation": "service_healthy",
-        "registry-notary-stage-secrets": "service_completed_successfully",
-    },
 }
 INITIALIZATION_COMMANDS = {
     "registry-postgres-bootstrap": ["postgresql-action", "bootstrap"],
@@ -156,10 +138,6 @@
         "relay-consultation",
         "prepare_state_store",
     ],
-    "registry-notary-prepare-state": [
-        "product-action",
-        "prepare_state_store",
-    ],
     "registry-relay-public-initialize": [
         "product-action",
         "relay-public",
@@ -170,7 +148,6 @@
         "relay-consultation",
         "initialize_state",
     ],
-    "registry-notary-initialize": ["product-action", "initialize_state"],
     "registry-relay-public-preview-state": [
         "product-action",
         "relay-public",
@@ -181,7 +158,6 @@
         "relay-consultation",
         "preview_state",
     ],
-    "registry-notary-preview-state": ["product-action", "preview_state"],
     "registry-relay-public-accept-state": [
         "product-action",
         "relay-public",
@@ -192,7 +168,6 @@
         "relay-consultation",
         "accept_state",
     ],
-    "registry-notary-accept-state": ["product-action", "accept_state"],
     "registry-relay-public-verify-state": [
         "product-action",
         "relay-public",
@@ -203,7 +178,6 @@
         "relay-consultation",
         "verify_state",
     ],
-    "registry-notary-verify-state": ["product-action", "verify_state"],
 }
 INITIALIZATION_METADATA = {
     "registry-relay-public-prepare-state": (
@@ -216,11 +190,6 @@
         "relay-consultation",
         "prepare",
     ),
-    "registry-notary-prepare-state": (
-        "registry-notary",
-        "notary",
-        "prepare",
-    ),
     "registry-relay-public-initialize": (
         "registry-relay-public",
         "relay-public",
@@ -231,11 +200,6 @@
         "relay-consultation",
         "initialize",
     ),
-    "registry-notary-initialize": (
-        "registry-notary",
-        "notary",
-        "initialize",
-    ),
     "registry-relay-public-preview-state": (
         "registry-relay-public",
         "relay-public",
@@ -246,11 +210,6 @@
         "relay-consultation",
         "preview",
     ),
-    "registry-notary-preview-state": (
-        "registry-notary",
-        "notary",
-        "preview",
-    ),
     "registry-relay-public-accept-state": (
         "registry-relay-public",
         "relay-public",
@@ -261,11 +220,6 @@
         "relay-consultation",
         "accept",
     ),
-    "registry-notary-accept-state": (
-        "registry-notary",
-        "notary",
-        "accept",
-    ),
     "registry-relay-public-verify-state": (
         "registry-relay-public",
         "relay-public",
@@ -276,11 +230,6 @@
         "relay-consultation",
         "verify",
     ),
-    "registry-notary-verify-state": (
-        "registry-notary",
-        "notary",
-        "verify",
-    ),
 }
 INITIALIZATION_DEPENDENCIES = {
     "registry-relay-public-prepare-state": {},
@@ -297,20 +246,12 @@
             "service_completed_successfully"
         ),
     },
-    "registry-notary-prepare-state": {
-        "registry-postgres": "service_healthy",
-        "registry-notary-actions-stage-secrets": "service_completed_successfully",
-    },
-    "registry-notary-initialize": {},
     "registry-relay-public-preview-state": {},
     "registry-relay-public-accept-state": {},
     "registry-relay-consultation-preview-state": {},
     "registry-relay-consultation-accept-state": {},
-    "registry-notary-preview-state": {},
-    "registry-notary-accept-state": {},
     "registry-relay-public-verify-state": {},
     "registry-relay-consultation-verify-state": {},
-    "registry-notary-verify-state": {},
 }
 
 STAGER_COMMAND = ["umask 077\nexit 0\n"]
@@ -335,16 +276,6 @@
             "registry-postgresql-tls-certificate",
         },
     },
-    "registry-notary-stage-secrets": {
-        "outputs": {
-            "notary-serve": "registry-operator-files-notary-serve",
-        },
-        "secrets": {
-            "registry-notary-relay-workload-credential",
-            "registry-notary-signing-key",
-            "registry-postgresql-tls-certificate",
-        },
-    },
 }
 
 ACTION_STAGER_SPECS = {
@@ -368,12 +299,6 @@
         },
         "secrets": {"registry-postgresql-tls-certificate"},
     },
-    "registry-notary-actions-stage-secrets": {
-        "outputs": {
-            "notary-prepare": "registry-operator-files-notary-prepare",
-        },
-        "secrets": {"registry-postgresql-tls-certificate"},
-    },
 }
 
 ORDINARY_STAGER_RUNTIME_ACTIONS = {
@@ -383,9 +308,6 @@
     "registry-relay-consultation-stage-secrets": [
         ("relay-consultation-serve", "relay_consultation", "serve"),
     ],
-    "registry-notary-stage-secrets": [
-        ("notary-serve", "notary", "serve"),
-    ],
 }
 
 ACTION_STAGER_RUNTIME_ACTIONS = {
@@ -404,9 +326,6 @@
             "initialize_state",
         ),
     ],
-    "registry-notary-actions-stage-secrets": [
-        ("notary-prepare", "notary", "prepare_state_store"),
-    ],
 }
 
 DURABLE_VOLUMES = frozenset(
@@ -416,8 +335,6 @@
         "registry-relay-public-audit",
         "registry-relay-consultation-state",
         "registry-relay-consultation-audit",
-        "registry-notary-state",
-        "registry-notary-audit",
     }
 )
 ORDINARY_STAGED_SECRET_VOLUMES = frozenset(
@@ -487,37 +404,6 @@
         "restart_action": "restart",
         "reactivation_action": "verify_state",
     },
-    "notary": {
-        "kind": "product",
-        "product_lane": "notary",
-        "action": "serve",
-        "immutable_inputs": ["notary-bundle", "notary-anchor"],
-        "mount_roles": [
-            "bundle",
-            "anchor",
-            "anti-rollback-state",
-            "secret",
-            "audit",
-        ],
-        "secret_consumers": [
-            "notary-relay-workload-credential",
-            "notary-signing-key",
-        ],
-        "state_roles": ["notary-anti-rollback", "notary-audit"],
-        "endpoint_classes": [
-            "public-application",
-            "administration",
-            "posture",
-        ],
-        "network_relationships": ["runtime"],
-        "dependencies": [
-            "relay-consultation",
-            "postgresql-state-plane",
-        ],
-        "health_semantics": "notary-health",
-        "restart_action": "restart",
-        "reactivation_action": "verify_state",
-    },
     "postgresql-state-plane": {
         "kind": "supporting",
         "recipe": "postgresql_state_plane",
@@ -550,11 +436,6 @@
         "workload": "relay-consultation",
         "action": "prepare_state_store",
     },
-    {
-        "id": "prepare-notary-state",
-        "workload": "notary",
-        "action": "prepare_state_store",
-    },
     {
         "id": "initialize-relay-public",
         "workload": "relay-public",
@@ -565,11 +446,6 @@
         "workload": "relay-consultation",
         "action": "initialize_state",
     },
-    {
-        "id": "initialize-notary",
-        "workload": "notary",
-        "action": "initialize_state",
-    },
     {
         "id": "preview-relay-public-state",
         "workload": "relay-public",
@@ -580,11 +456,6 @@
         "workload": "relay-consultation",
         "action": "preview_state",
     },
-    {
-        "id": "preview-notary-state",
-        "workload": "notary",
-        "action": "preview_state",
-    },
     {
         "id": "accept-relay-public-state",
         "workload": "relay-public",
@@ -595,11 +466,6 @@
         "workload": "relay-consultation",
         "action": "accept_state",
     },
-    {
-        "id": "accept-notary-state",
-        "workload": "notary",
-        "action": "accept_state",
-    },
     {
         "id": "verify-relay-public-state",
         "workload": "relay-public",
@@ -610,18 +476,12 @@
         "workload": "relay-consultation",
         "action": "verify_state",
     },
-    {
-        "id": "verify-notary-state",
-        "workload": "notary",
-        "action": "verify_state",
-    },
 ]
 EXPECTED_RECOVERY_GROUPS = [
     {
         "id": "consultation-state",
         "members": [
             "relay-consultation",
-            "notary",
             "postgresql-state-plane",
         ],
     },
@@ -636,10 +496,6 @@
         "endpoint_class": "private-application",
         "exposure": "private-network-only",
     },
-    {
-        "endpoint_class": "administration",
-        "exposure": "private-network-only",
-    },
     {
         "endpoint_class": "posture",
         "exposure": "private-network-only",
@@ -685,7 +541,6 @@ def runtime_contract_from_payload(path: Path) -> dict[str, Any]:
         products = {
             "registry-relay-public": runtime["relay_public"],
             "registry-relay-consultation": runtime["relay_consultation"],
-            "registry-notary": runtime["notary"],
         }
         postgresql = runtime["postgresql_state_plane"]
     except (OSError, UnicodeError, json.JSONDecodeError, KeyError, TypeError) as error:
@@ -707,9 +562,6 @@ def runtime_contract_from_payload(path: Path) -> dict[str, Any]:
                 "prepare_state_store"
             ]["command"]
         ),
-        "registry-notary-prepare-state": (
-            products["registry-notary"]["prepare_state_store"]["command"]
-        ),
         "registry-relay-public-initialize": (
             products["registry-relay-public"]["initialize_state"]["command"]
         ),
@@ -718,36 +570,24 @@ def runtime_contract_from_payload(path: Path) -> dict[str, Any]:
                 "initialize_state"
             ]["command"]
         ),
-        "registry-notary-initialize": (
-            products["registry-notary"]["initialize_state"]["command"]
-        ),
         "registry-relay-public-preview-state": (
             products["registry-relay-public"]["preview_state"]["command"]
         ),
         "registry-relay-consultation-preview-state": (
             products["registry-relay-consultation"]["preview_state"]["command"]
         ),
-        "registry-notary-preview-state": (
-            products["registry-notary"]["preview_state"]["command"]
-        ),
         "registry-relay-public-accept-state": (
             products["registry-relay-public"]["accept_state"]["command"]
         ),
         "registry-relay-consultation-accept-state": (
             products["registry-relay-consultation"]["accept_state"]["command"]
         ),
-        "registry-notary-accept-state": (
-            products["registry-notary"]["accept_state"]["command"]
-        ),
         "registry-relay-public-verify-state": (
             products["registry-relay-public"]["verify_state"]["command"]
         ),
         "registry-relay-consultation-verify-state": (
             products["registry-relay-consultation"]["verify_state"]["command"]
         ),
-        "registry-notary-verify-state": (
-            products["registry-notary"]["verify_state"]["command"]
-        ),
     }
     health_probes = {
         name: recipe["health_probe"] for name, recipe in products.items()
@@ -1226,18 +1066,17 @@ def validate_plan(path: Path) -> dict[str, str]:
         not isinstance(plan, dict)
         or set(plan) != expected_root_fields
         or plan.get("schema_id") != "io.registrystack.deployment_plan"
-        or plan.get("schema_version") != "1.0"
+        or plan.get("schema_version") != "2.0"
         or plan.get("single_instance") is not True
     ):
         raise ContractError("deployment plan probe has the wrong closed schema")
     workloads = plan.get("workloads")
-    if not isinstance(workloads, list) or len(workloads) != 4:
-        raise ContractError("deployment plan must contain exactly four workloads")
+    if not isinstance(workloads, list) or len(workloads) != 3:
+        raise ContractError("deployment plan must contain exactly three workloads")
     images: dict[str, str] = {}
     services = {
         "relay-public": "registry-relay-public",
         "relay-consultation": "registry-relay-consultation",
-        "notary": "registry-notary",
         "postgresql-state-plane": "registry-postgres",
     }
     observed_ids = set()
@@ -1293,7 +1132,7 @@ def assert_ordinary_model(
     services = _services(model)
     if set(services) != ORDINARY_SERVICES:
         raise ContractError(
-            "ordinary model must contain four workloads and three secret stagers"
+            "ordinary model must contain three workloads and two secret stagers"
         )
     if INITIALIZATION_SERVICES.intersection(services):
         raise ContractError("ordinary model exposes initialization services")
@@ -1322,7 +1161,6 @@ def assert_ordinary_model(
     for name in (
         "registry-relay-public",
         "registry-relay-consultation",
-        "registry-notary",
     ):
         _assert_product_hardening(
             name,
@@ -1364,7 +1202,6 @@ def assert_ordinary_model(
     for name, lane in (
         ("registry-relay-public", "relay-public"),
         ("registry-relay-consultation", "relay-consultation"),
-        ("registry-notary", "notary"),
     ):
         _assert_product_mounts(
             name,
@@ -1383,15 +1220,6 @@ def assert_ordinary_model(
                 "target": 8080,
             }
         ],
-        "registry-notary": [
-            {
-                "host_ip": "127.0.0.1",
-                "mode": "ingress",
-                "protocol": "tcp",
-                "published": "4255",
-                "target": 8081,
-            }
-        ],
     }
     for name, service in services.items():
         if service.get("ports") != expected_ports.get(name):
@@ -1497,7 +1325,7 @@ def assert_initialization_model(
         requires_postgresql = (
             lane == "relay-consultation"
             and action in {"prepare", "initialize"}
-        ) or (lane == "notary" and action == "prepare")
+        )
         expected_environment_files = (
             [package_root / "operator/secrets" / environment]
             if action in {"prepare", "initialize", "accept"}
diff --git a/release/scripts/check_advisory_checker_copies.py b/release/scripts/check_advisory_checker_copies.py
deleted file mode 100644
index cdef4f7ec..000000000
--- a/release/scripts/check_advisory_checker_copies.py
+++ /dev/null
@@ -1,47 +0,0 @@
-#!/usr/bin/env python3
-# SPDX-License-Identifier: Apache-2.0
-"""Reject drift between the two product-owned advisory checker copies."""
-
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-
-
-ROOT = Path(__file__).resolve().parents[2]
-NOTARY_CHECKER = ROOT / "products/notary/scripts/check_advisory_baselines.py"
-RELAY_CHECKER = ROOT / "crates/registry-relay/scripts/check_advisory_baselines.py"
-
-
-def display_path(path: Path) -> str:
-    try:
-        return str(path.relative_to(ROOT))
-    except ValueError:
-        return str(path)
-
-
-def check_identical(left: Path, right: Path) -> str | None:
-    try:
-        left_bytes = left.read_bytes()
-        right_bytes = right.read_bytes()
-    except OSError as exc:
-        return f"cannot read advisory checker copy: {exc}"
-    if left_bytes != right_bytes:
-        return (
-            "advisory checker copies differ: "
-            f"{display_path(left)} != {display_path(right)}"
-        )
-    return None
-
-
-def main() -> int:
-    error = check_identical(NOTARY_CHECKER, RELAY_CHECKER)
-    if error:
-        print(error, file=sys.stderr)
-        return 1
-    print("advisory checker copies are byte-identical")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
diff --git a/release/scripts/conformance_candidate.py b/release/scripts/conformance_candidate.py
index 26a342096..16ba17c93 100644
--- a/release/scripts/conformance_candidate.py
+++ b/release/scripts/conformance_candidate.py
@@ -20,7 +20,7 @@
 
 from registryctl_image_lock import (
     PLATFORM as IMAGE_LOCK_PLATFORM,
-    PRODUCT_IMAGE_REPOSITORIES,
+    repositories_for_schema,
     schema_for_release_version,
     validate_images,
 )
@@ -33,7 +33,6 @@
 IMAGE_LOCK_FILE = re.compile(
     r"^registryctl-(v[A-Za-z0-9][A-Za-z0-9._+-]*)-image-lock\.json$"
 )
-IMAGE_REPOSITORIES = PRODUCT_IMAGE_REPOSITORIES
 CAPSULE_REPOSITORY = "registrystack/registry-stack"
 SLSA_SOURCE_URI = "github.com/registrystack/registry-stack"
 RELEASE_WORKFLOW = (
@@ -594,18 +593,19 @@ def _load_candidate_snapshot(
         raise CandidateError(
             "release manifest does not identify one immutable candidate"
         )
+    try:
+        expected_image_lock_schema = schema_for_release_version(version)
+        image_repositories = repositories_for_schema(expected_image_lock_schema)
+    except ValueError as exc:
+        raise CandidateError(str(exc)) from None
+    product_components = set(image_repositories) - {"postgresql"}
     artifacts = manifest.get("artifacts")
     if not isinstance(artifacts, dict) or any(
-        artifacts.get(component) != version for component in IMAGE_REPOSITORIES
+        artifacts.get(component) != version for component in product_components
     ):
         raise CandidateError(
             "release manifest product artifacts do not match its version"
         )
-
-    try:
-        expected_image_lock_schema = schema_for_release_version(version)
-    except ValueError as exc:
-        raise CandidateError(str(exc)) from None
     if (
         not isinstance(lock, dict)
         or image_lock_path.name != f"registryctl-v{version}-image-lock.json"
@@ -645,7 +645,7 @@ def _load_candidate_snapshot(
             raise CandidateError("Solmara topology requires one exact source commit")
     elif topology != "release-owned" or solmara_source_ref is not None:
         raise CandidateError("Solmara must be explicitly selected and commit-pinned")
-    return {
+    candidate = {
         "release_id": release_id,
         "version": version,
         "source_repo": stack["source_repo"],
@@ -656,11 +656,13 @@ def _load_candidate_snapshot(
         "manifest_sha256": f"sha256:{hashlib.sha256(manifest_bytes).hexdigest()}",
         "image_lock_sha256": f"sha256:{image_lock_sha256}",
         "release_capsule_sha256": f"sha256:{capsule_sha256}",
-        "notary_image": images["registry-notary"],
         "relay_image": images["registry-relay"],
         "topology": topology,
         "solmara_source_ref": solmara_source_ref,
     }
+    if "registry-notary" in images:
+        candidate["notary_image"] = images["registry-notary"]
+    return candidate
 
 
 def load_candidate(
diff --git a/release/scripts/integration-e2-runner.py b/release/scripts/integration-e2-runner.py
deleted file mode 100755
index aaa4e1a92..000000000
--- a/release/scripts/integration-e2-runner.py
+++ /dev/null
@@ -1,1271 +0,0 @@
-#!/usr/bin/env python3
-# SPDX-License-Identifier: Apache-2.0
-"""Prepare and validate candidate-neutral external integration evidence.
-
-This tool deliberately does not drive an unreviewed live product instance. It
-closes the portable plan, candidate trust checks, and public evidence boundary
-while leaving instance-specific orchestration to an approved operator wrapper.
-"""
-
-from __future__ import annotations
-
-import argparse
-import datetime as dt
-import hashlib
-import json
-import os
-import re
-import shutil
-import stat
-import subprocess
-import sys
-import tempfile
-from contextlib import contextmanager
-from pathlib import Path
-from typing import Any, Callable, Iterator
-
-from closed_json_schema import (
-    SchemaValidationError,
-    validate_against_schema as validate_closed_schema,
-)
-from registryctl_image_lock import (
-    PLATFORM as IMAGE_LOCK_PLATFORM,
-    schema_for_release_version,
-    validate_images,
-)
-
-
-ROOT = Path(__file__).resolve().parents[2]
-CONFIG_DIR = ROOT / "release" / "conformance" / "integrations"
-PROFILE_DIR = CONFIG_DIR / "profiles"
-SCHEMA_PATH = CONFIG_DIR / "schema" / "run-result.schema.json"
-PROFILE_SCHEMA = "registry.release.integration_e2_profile.v1"
-RESULT_SCHEMA = "registry.release.integration_e2_run_result.v1"
-SUPPORT_STATUS = "Registry Stack-supported unofficial integration profile"
-CAPSULE_REPOSITORY = "registrystack/registry-stack"
-SLSA_SOURCE_URI = "github.com/registrystack/registry-stack"
-RELEASE_WORKFLOW = (
-    "https://github.com/registrystack/registry-stack/.github/workflows/"
-    "release.yml@refs/tags/{tag}"
-)
-PROFILE_FILES = {
-    "opencrvs-dci-v1.9": "opencrvs-dci-v1.9.profile.json",
-    "dhis2-tracker-2.41.9": "dhis2-tracker-2.41.9.profile.json",
-}
-CASE_IDS = (
-    "authorized-match",
-    "authorized-no-match",
-    "ambiguity",
-    "invalid-selector",
-    "wrong-caller",
-    "missing-scope",
-    "wrong-purpose",
-    "stale-contract",
-    "subject-mismatch",
-    "source-authorization-failure",
-    "deadline-enforced",
-)
-TAG = re.compile(r"^v([0-9]+\.[0-9]+\.[0-9]+)$")
-COMMIT = re.compile(r"^[0-9a-f]{40}$")
-MAX_ASSET_BYTES = 128 * 1024 * 1024
-SAFE_CANARY = re.compile(rb"^[A-Za-z0-9._:@-]{8,128}$")
-REQUIRED_LIMITATIONS = {
-    "unofficial-integration-profile",
-    "single-pinned-product-version",
-    "single-reviewed-read-operation",
-    "non-production-instance",
-    "not-product-certification",
-    "not-general-country-system-conformance",
-}
-EXPECTED_PROFILE_BINDINGS = {
-    "opencrvs-dci-v1.9": {
-        "starter": "opencrvs-dci",
-        "product": "opencrvs",
-        "baseline": [
-            ("dci-adapter", "v1.9.0-rc.1", "5e31d1e381d4bd8c7c74112d714fd49d263c6df7"),
-            ("core", "v1.9.5", "7243ccb79eb84254420878ff5146c6e50f084554"),
-            ("farajaland", "v1.9.5", "3c1a5612d8d7bebddd43463682860b38ef14bcb4"),
-        ],
-        "operations": [
-            ("oauth-token", "credential", "POST", "owner-attested", 1),
-            ("jwks", "verification", "GET", "owner-attested", 1),
-            ("signed-uin-search", "data", "POST", "/registry/sync/search", 1),
-        ],
-        "inputs": (
-            "OPENCRVS_SOURCE_ORIGIN",
-            "OPENCRVS_OAUTH_ORIGIN",
-            "OPENCRVS_OAUTH_PATH",
-            "OPENCRVS_JWKS_ORIGIN",
-            "OPENCRVS_JWKS_PATH",
-            "OPENCRVS_SENDER_ID",
-            "OPENCRVS_RECEIVER_ID",
-            "OPENCRVS_CLIENT_ID",
-            "OPENCRVS_CLIENT_SECRET",
-            "OPENCRVS_MATCH_UIN",
-            "OPENCRVS_NO_MATCH_UIN",
-            "OPENCRVS_AMBIGUOUS_UIN",
-            "OPENCRVS_MISMATCH_UIN",
-            "REGISTRY_INTEGRATION_E2_SOURCE_PROBE",
-            "REGISTRY_INTEGRATION_E2_CANARY_FILE",
-        ),
-        "case_access": (
-            "contacted_once",
-            "contacted_once",
-            "contacted_once",
-            "not_contacted",
-            "not_contacted",
-            "not_contacted",
-            "not_contacted",
-            "not_contacted",
-            "contacted_once",
-            "not_contacted",
-            "contacted_once",
-        ),
-        "result_codes": (
-            "match",
-            "no-match",
-            "ambiguous",
-            "invalid-selector",
-            "denied-wrong-caller",
-            "denied-missing-scope",
-            "denied-wrong-purpose",
-            "denied-stale-contract",
-            "subject-mismatch",
-            "source-authorization-failure",
-            "deadline-exceeded",
-        ),
-        "limits": (60, 1800, 8388608, 1048576, 300),
-    },
-    "dhis2-tracker-2.41.9": {
-        "starter": "dhis2-tracker",
-        "product": "dhis2-tracker",
-        "baseline": [
-            ("dhis2", "2.41.9", "ce6404687f6a5806e2661cffe4bc7a1d9b2ad2ed"),
-        ],
-        "operations": [
-            (
-                "tracked-entity-read",
-                "data",
-                "GET",
-                "/api/tracker/trackedEntities/{uid}",
-                1,
-            ),
-        ],
-        "inputs": (
-            "DHIS2_SOURCE_ORIGIN",
-            "DHIS2_USERNAME",
-            "DHIS2_PASSWORD",
-            "DHIS2_CHILD_PROGRAM_UID",
-            "DHIS2_MATERNAL_PROGRAM_UID",
-            "DHIS2_TB_PROGRAM_UID",
-            "DHIS2_CHILD_VISIT_STAGE_UID",
-            "DHIS2_BCG_BIRTH_STAGE_UID",
-            "DHIS2_OPV_BIRTH_STAGE_UID",
-            "DHIS2_MEASLES_STAGE_UID",
-            "DHIS2_FIRST_NAME_ATTRIBUTE_UID",
-            "DHIS2_LAST_NAME_ATTRIBUTE_UID",
-            "DHIS2_BIRTH_DATE_ATTRIBUTE_UID",
-            "DHIS2_RECONCILIATION_ATTRIBUTE_UID",
-            "DHIS2_MATCH_TRACKED_ENTITY",
-            "DHIS2_NO_MATCH_TRACKED_ENTITY",
-            "DHIS2_MISMATCH_TRACKED_ENTITY",
-            "REGISTRY_INTEGRATION_E2_SOURCE_PROBE",
-            "REGISTRY_INTEGRATION_E2_CANARY_FILE",
-        ),
-        "case_access": (
-            "contacted_once",
-            "contacted_once",
-            "not_applicable",
-            "not_contacted",
-            "not_contacted",
-            "not_contacted",
-            "not_contacted",
-            "not_contacted",
-            "contacted_once",
-            "contacted_once",
-            "contacted_once",
-        ),
-        "result_codes": (
-            "match",
-            "no-match",
-            "not-applicable",
-            "invalid-selector",
-            "denied-wrong-caller",
-            "denied-missing-scope",
-            "denied-wrong-purpose",
-            "denied-stale-contract",
-            "subject-mismatch",
-            "source-authorization-failure",
-            "deadline-exceeded",
-        ),
-        "limits": (30, 1200, 8388608, 1048576, 300),
-    },
-}
-
-
-class RunnerError(RuntimeError):
-    """A user-actionable integration evidence error."""
-
-
-def load_json(path: Path, *, max_bytes: int = 1024 * 1024) -> Any:
-    require_regular_file(path, max_bytes=max_bytes)
-    try:
-        return json.loads(path.read_text(encoding="utf-8"))
-    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
-        raise RunnerError(f"could not read valid JSON from {path}: {exc}") from exc
-
-
-def require_regular_file(path: Path, *, max_bytes: int) -> None:
-    try:
-        info = path.lstat()
-    except OSError as exc:
-        raise RunnerError(f"required file is unavailable: {path}: {exc}") from exc
-    if stat.S_ISLNK(info.st_mode) or not stat.S_ISREG(info.st_mode):
-        raise RunnerError(f"required path must be a regular, non-symlink file: {path}")
-    if info.st_size <= 0 or info.st_size > max_bytes:
-        raise RunnerError(
-            f"file size for {path} must be between 1 and {max_bytes} bytes"
-        )
-
-
-def sha256(path: Path) -> str:
-    digest = hashlib.sha256()
-    with path.open("rb") as handle:
-        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
-            digest.update(chunk)
-    return digest.hexdigest()
-
-
-def require_object(value: Any, label: str, keys: set[str]) -> dict[str, Any]:
-    if not isinstance(value, dict):
-        raise RunnerError(f"{label} must be an object")
-    missing = keys - set(value)
-    unknown = set(value) - keys
-    if missing or unknown:
-        details = []
-        if missing:
-            details.append("missing " + ", ".join(sorted(missing)))
-        if unknown:
-            details.append("unknown " + ", ".join(sorted(unknown)))
-        raise RunnerError(f"{label} has invalid fields: {'; '.join(details)}")
-    return value
-
-
-def load_profile(profile_id: str) -> dict[str, Any]:
-    try:
-        path = PROFILE_DIR / PROFILE_FILES[profile_id]
-    except KeyError as exc:
-        raise RunnerError(f"unknown integration profile: {profile_id}") from exc
-    profile = load_json(path)
-    validate_profile(profile, path.name)
-    if profile["profile_id"] != profile_id:
-        raise RunnerError(f"{path.name} declares the wrong profile_id")
-    return profile
-
-
-def validate_profile(value: Any, label: str) -> None:
-    profile = require_object(
-        value,
-        label,
-        {
-            "schema_version",
-            "profile_id",
-            "support_status",
-            "starter",
-            "source",
-            "authored_contract",
-            "dynamic_inputs",
-            "cases",
-            "prerequisites",
-            "limits",
-        },
-    )
-    if profile["schema_version"] != PROFILE_SCHEMA:
-        raise RunnerError(f"{label} has an unsupported schema_version")
-    if profile["profile_id"] not in PROFILE_FILES:
-        raise RunnerError(f"{label} has an unknown profile_id")
-    expected = EXPECTED_PROFILE_BINDINGS[profile["profile_id"]]
-    if profile["support_status"] != SUPPORT_STATUS:
-        raise RunnerError(f"{label} must use the reviewed support wording")
-    if profile["starter"] != expected["starter"]:
-        raise RunnerError(f"{label} has the wrong pinned starter")
-    authored = require_object(
-        profile["authored_contract"],
-        f"{label}.authored_contract",
-        {"integration_alias", "generated_yaml_edits_allowed", "reviewed_changes"},
-    )
-    if authored["generated_yaml_edits_allowed"] is not False:
-        raise RunnerError(f"{label} must prohibit generated YAML edits")
-    if (
-        not isinstance(authored["integration_alias"], str)
-        or not isinstance(authored["reviewed_changes"], list)
-        or not authored["reviewed_changes"]
-    ):
-        raise RunnerError(
-            f"{label}.authored_contract must contain reviewed authored changes"
-        )
-
-    source = require_object(
-        profile["source"], f"{label}.source", {"product", "baseline", "operations"}
-    )
-    if source["product"] != expected["product"]:
-        raise RunnerError(f"{label} has the wrong pinned source product")
-    baseline = source["baseline"]
-    if not isinstance(baseline, list):
-        raise RunnerError(f"{label}.source.baseline must be an array")
-    baseline_tuples = []
-    for index, item in enumerate(baseline):
-        entry = require_object(
-            item,
-            f"{label}.source.baseline[{index}]",
-            {"component", "version", "commit"},
-        )
-        baseline_tuples.append((entry["component"], entry["version"], entry["commit"]))
-    if baseline_tuples != expected["baseline"]:
-        raise RunnerError(f"{label} does not use the exact reviewed upstream baseline")
-    operations = source["operations"]
-    if not isinstance(operations, list):
-        raise RunnerError(f"{label}.source.operations must be an array")
-    operation_tuples = []
-    for index, item in enumerate(operations):
-        if not isinstance(item, dict):
-            raise RunnerError(f"{label}.source.operations[{index}] must be an object")
-        allowed = {
-            "id",
-            "role",
-            "method",
-            "path",
-            "max_calls",
-            "selector",
-            "field_projection",
-        }
-        required = {"id", "role", "method", "path", "max_calls"}
-        if set(item) - allowed or required - set(item):
-            raise RunnerError(f"{label}.source.operations[{index}] has invalid fields")
-        operation_tuples.append(
-            (item["id"], item["role"], item["method"], item["path"], item["max_calls"])
-        )
-        expected_keys = required | (
-            {"selector", "field_projection"}
-            if item["id"] == "tracked-entity-read"
-            else {"selector"}
-            if item["id"] == "signed-uin-search"
-            else set()
-        )
-        if set(item) != expected_keys:
-            raise RunnerError(
-                f"{label}.source.operations[{index}] has unexpected optional fields"
-            )
-    if operation_tuples != expected["operations"]:
-        raise RunnerError(f"{label} does not use the exact reviewed source operations")
-    data_operation = next(item for item in operations if item["role"] == "data")
-    if data_operation.get("selector") not in {"exact UIN", "exact tracked entity UID"}:
-        raise RunnerError(
-            f"{label} data operation must use the reviewed exact selector"
-        )
-    if (
-        profile["profile_id"].startswith("dhis2")
-        and data_operation.get("field_projection")
-        != "trackedEntity,attributes[attribute,value],enrollments[program,status,events[programStage,status]]"
-    ):
-        raise RunnerError(f"{label} does not use the reviewed DHIS2 field projection")
-
-    dynamic = profile["dynamic_inputs"]
-    if not isinstance(dynamic, list) or not dynamic:
-        raise RunnerError(f"{label}.dynamic_inputs must be a non-empty list")
-    env_names = []
-    for index, item in enumerate(dynamic):
-        entry = require_object(
-            item,
-            f"{label}.dynamic_inputs[{index}]",
-            {"env", "classification", "purpose"},
-        )
-        if (
-            entry["classification"] not in {"restricted", "secret", "subject"}
-            or not isinstance(entry["purpose"], str)
-            or not entry["purpose"]
-        ):
-            raise RunnerError(
-                f"{label}.dynamic_inputs[{index}] has an invalid classification or purpose"
-            )
-        env_names.append(entry["env"])
-    if tuple(env_names) != expected["inputs"]:
-        raise RunnerError(
-            f"{label}.dynamic_inputs does not match the reviewed input names"
-        )
-    cases = profile["cases"]
-    if not isinstance(cases, list):
-        raise RunnerError(f"{label}.cases must be an array")
-    for index, case in enumerate(cases):
-        require_object(
-            case,
-            f"{label}.cases[{index}]",
-            {"id", "expected_result_code", "expected_source_data_access"},
-        )
-    if [case["id"] for case in cases] != list(CASE_IDS):
-        raise RunnerError(f"{label}.cases must contain the closed ordered case set")
-    allowed_access = {"not_contacted", "contacted_once", "not_applicable"}
-    if any(
-        case.get("expected_source_data_access") not in allowed_access for case in cases
-    ):
-        raise RunnerError(
-            f"{label}.cases contains an invalid source access expectation"
-        )
-    if (
-        tuple(case["expected_source_data_access"] for case in cases)
-        != expected["case_access"]
-    ):
-        raise RunnerError(
-            f"{label}.cases does not match the reviewed source access contract"
-        )
-    if (
-        tuple(case["expected_result_code"] for case in cases)
-        != expected["result_codes"]
-    ):
-        raise RunnerError(
-            f"{label}.cases does not match the reviewed safe result codes"
-        )
-    prerequisites = profile["prerequisites"]
-    if (
-        not isinstance(prerequisites, list)
-        or len(prerequisites) < 5
-        or any(not isinstance(item, str) or not item for item in prerequisites)
-    ):
-        raise RunnerError(
-            f"{label}.prerequisites must make external ownership explicit"
-        )
-    limits = require_object(
-        profile["limits"],
-        f"{label}.limits",
-        {
-            "case_timeout_seconds",
-            "run_timeout_seconds",
-            "raw_evidence_bytes",
-            "public_result_bytes",
-            "teardown_timeout_seconds",
-        },
-    )
-    if any(not isinstance(item, int) or item <= 0 for item in limits.values()):
-        raise RunnerError(f"{label}.limits must contain positive integers")
-    actual_limits = tuple(
-        limits[name]
-        for name in (
-            "case_timeout_seconds",
-            "run_timeout_seconds",
-            "raw_evidence_bytes",
-            "public_result_bytes",
-            "teardown_timeout_seconds",
-        )
-    )
-    if actual_limits != expected["limits"]:
-        raise RunnerError(
-            f"{label}.limits does not match the reviewed bounded contract"
-        )
-
-
-def validate_packet() -> None:
-    schema = load_json(SCHEMA_PATH)
-    if schema.get("$schema") != "https://json-schema.org/draft/2020-12/schema":
-        raise RunnerError("run result schema must use JSON Schema draft 2020-12")
-    if schema.get("additionalProperties") is not False:
-        raise RunnerError("run result schema must be closed")
-    assert_closed_schema(schema)
-    for profile_id in PROFILE_FILES:
-        load_profile(profile_id)
-
-
-def assert_closed_schema(value: Any, label: str = "schema") -> None:
-    if isinstance(value, dict):
-        if (
-            value.get("type") == "object"
-            and value.get("additionalProperties") is not False
-        ):
-            raise RunnerError(f"{label} contains an open object schema")
-        for name, item in value.items():
-            assert_closed_schema(item, f"{label}.{name}")
-    elif isinstance(value, list):
-        for index, item in enumerate(value):
-            assert_closed_schema(item, f"{label}[{index}]")
-
-
-def parse_checksums(path: Path) -> dict[str, str]:
-    require_regular_file(path, max_bytes=1024 * 1024)
-    checksums: dict[str, str] = {}
-    for line_number, line in enumerate(
-        path.read_text(encoding="utf-8").splitlines(), 1
-    ):
-        match = re.fullmatch(r"([0-9a-f]{64})  \*?([^/\x00]+)", line)
-        if match is None:
-            raise RunnerError(f"SHA256SUMS line {line_number} has an unsafe format")
-        digest, name = match.groups()
-        if name in checksums:
-            raise RunnerError(f"SHA256SUMS contains duplicate entry {name}")
-        checksums[name] = digest
-    return checksums
-
-
-def signed_subject_names(tag: str) -> tuple[str, ...]:
-    binary = f"registryctl-{tag}-linux-amd64"
-    image_lock = f"registryctl-{tag}-image-lock.json"
-    return (
-        binary,
-        image_lock,
-        f"{image_lock}.spdx.json",
-        f"registry-stack-{tag}-release-capsule.json",
-        "registry-relay.digest",
-        "registry-notary.digest",
-    )
-
-
-def required_asset_names(tag: str) -> set[str]:
-    subjects = signed_subject_names(tag)
-    return {
-        *subjects,
-        *(f"{name}.sig" for name in subjects),
-        *(f"{name}.pem" for name in subjects),
-        "SHA256SUMS",
-        f"registry-stack-{tag}-release-provenance.intoto.jsonl",
-    }
-
-
-def run_authenticity_command(command: list[str]) -> None:
-    result = subprocess.run(command, text=True, capture_output=True, check=False)
-    if result.returncode != 0:
-        detail = (result.stderr or result.stdout).strip().splitlines()
-        suffix = f": {detail[-1]}" if detail else ""
-        raise RunnerError(f"authenticity command failed ({command[0]}){suffix}")
-
-
-def verify_authenticity(
-    asset_dir: Path,
-    tag: str,
-    *,
-    command_runner: Callable[[list[str]], None] = run_authenticity_command,
-) -> None:
-    cosign = shutil.which("cosign")
-    slsa = shutil.which("slsa-verifier")
-    if not cosign or not slsa:
-        missing = [
-            name
-            for name, path in (("cosign", cosign), ("slsa-verifier", slsa))
-            if not path
-        ]
-        raise RunnerError(
-            "candidate authenticity verification requires installed "
-            + " and ".join(missing)
-        )
-    provenance = asset_dir / f"registry-stack-{tag}-release-provenance.intoto.jsonl"
-    identity = RELEASE_WORKFLOW.format(tag=tag)
-    for name in signed_subject_names(tag):
-        subject = asset_dir / name
-        command_runner(
-            [
-                cosign,
-                "verify-blob",
-                str(subject),
-                "--signature",
-                str(asset_dir / f"{name}.sig"),
-                "--certificate",
-                str(asset_dir / f"{name}.pem"),
-                "--certificate-oidc-issuer",
-                "https://token.actions.githubusercontent.com",
-                "--certificate-identity",
-                identity,
-            ]
-        )
-        command_runner(
-            [
-                slsa,
-                "verify-artifact",
-                str(subject),
-                "--provenance-path",
-                str(provenance),
-                "--source-uri",
-                SLSA_SOURCE_URI,
-                "--source-tag",
-                tag,
-            ]
-        )
-
-
-def exact_digest_file(path: Path, repository: str) -> str:
-    require_regular_file(path, max_bytes=1024)
-    value = path.read_text(encoding="utf-8").strip()
-    expected = re.compile(
-        rf"^ghcr\.io/registrystack/{re.escape(repository)}@sha256:[0-9a-f]{{64}}$"
-    )
-    if expected.fullmatch(value) is None:
-        raise RunnerError(
-            f"{path.name} must contain one digest-bound {repository} reference"
-        )
-    return value
-
-
-def find_named(items: Any, name: str, label: str) -> dict[str, Any]:
-    if not isinstance(items, list):
-        raise RunnerError(f"release capsule {label} must be an array")
-    matches = [
-        item for item in items if isinstance(item, dict) and item.get("name") == name
-    ]
-    if len(matches) != 1:
-        raise RunnerError(
-            f"release capsule must contain exactly one {label} entry for {name}"
-        )
-    return matches[0]
-
-
-def verify_file_sbom(path: Path, subject_name: str, subject_sha256: str) -> None:
-    document = load_json(path, max_bytes=16 * 1024 * 1024)
-    if not isinstance(document, dict):
-        raise RunnerError(f"{path.name} must be an SPDX JSON object")
-    described = document.get("documentDescribes")
-    packages = document.get("packages")
-    if not isinstance(described, list) or not isinstance(packages, list):
-        raise RunnerError(f"{path.name} must contain SPDX subjects and packages")
-    described_ids = {item for item in described if isinstance(item, str)}
-    for package in packages:
-        if not isinstance(package, dict) or package.get("SPDXID") not in described_ids:
-            continue
-        if (
-            package.get("name") != subject_name
-            and package.get("packageFileName") != subject_name
-        ):
-            continue
-        checksums = package.get("checksums")
-        if isinstance(checksums, list) and any(
-            isinstance(item, dict)
-            and item.get("algorithm") == "SHA256"
-            and item.get("checksumValue") == subject_sha256
-            for item in checksums
-        ):
-            return
-    raise RunnerError(
-        f"{path.name} does not describe {subject_name} at its actual SHA-256"
-    )
-
-
-def require_candidate_directory(path: Path) -> None:
-    try:
-        info = path.lstat()
-    except OSError as exc:
-        raise RunnerError(
-            f"candidate asset directory is unavailable: {path}: {exc}"
-        ) from exc
-    if stat.S_ISLNK(info.st_mode) or not stat.S_ISDIR(info.st_mode):
-        raise RunnerError(
-            "candidate asset directory must be a real, non-symlink directory"
-        )
-
-
-@contextmanager
-def candidate_asset_snapshot(asset_dir: Path, tag: str) -> Iterator[Path]:
-    """Copy the closed candidate set through no-follow descriptors and remove it."""
-    require_candidate_directory(asset_dir)
-    no_follow = getattr(os, "O_NOFOLLOW", None)
-    directory_flag = getattr(os, "O_DIRECTORY", None)
-    if no_follow is None or directory_flag is None:
-        raise RunnerError("candidate snapshotting requires O_NOFOLLOW and O_DIRECTORY")
-    directory_fd = None
-    try:
-        directory_fd = os.open(
-            asset_dir,
-            os.O_RDONLY | os.O_CLOEXEC | no_follow | directory_flag,
-        )
-        required = required_asset_names(tag)
-        actual = set(os.listdir(directory_fd))
-        missing = required - actual
-        unknown = actual - required
-        if missing or unknown:
-            details = []
-            if missing:
-                details.append("missing " + ", ".join(sorted(missing)))
-            if unknown:
-                details.append("unexpected " + ", ".join(sorted(unknown)))
-            raise RunnerError(
-                "candidate asset set is not closed: " + "; ".join(details)
-            )
-
-        with tempfile.TemporaryDirectory(
-            prefix="registry-integration-e2-candidate-"
-        ) as temporary:
-            snapshot = Path(temporary)
-            snapshot.chmod(0o700)
-            binary_name = f"registryctl-{tag}-linux-amd64"
-            for name in sorted(required):
-                source_fd = None
-                destination_fd = None
-                try:
-                    source_fd = os.open(
-                        name,
-                        os.O_RDONLY | os.O_CLOEXEC | os.O_NONBLOCK | no_follow,
-                        dir_fd=directory_fd,
-                    )
-                    source_info = os.fstat(source_fd)
-                    if not stat.S_ISREG(source_info.st_mode):
-                        raise RunnerError(
-                            f"candidate asset must be a regular, non-symlink file: {name}"
-                        )
-                    if (
-                        source_info.st_size <= 0
-                        or source_info.st_size > MAX_ASSET_BYTES
-                    ):
-                        raise RunnerError(
-                            f"candidate asset size for {name} must be between 1 and {MAX_ASSET_BYTES} bytes"
-                        )
-                    destination = snapshot / name
-                    destination_fd = os.open(
-                        destination,
-                        os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC | no_follow,
-                        0o600,
-                    )
-                    with os.fdopen(source_fd, "rb") as source_handle:
-                        source_fd = None
-                        with os.fdopen(destination_fd, "wb") as destination_handle:
-                            destination_fd = None
-                            shutil.copyfileobj(source_handle, destination_handle)
-                    if destination.stat().st_size != source_info.st_size:
-                        raise RunnerError(
-                            f"candidate asset changed while snapshotting: {name}"
-                        )
-                    destination.chmod(0o500 if name == binary_name else 0o400)
-                finally:
-                    if source_fd is not None:
-                        os.close(source_fd)
-                    if destination_fd is not None:
-                        os.close(destination_fd)
-            snapshot.chmod(0o500)
-            try:
-                yield snapshot
-            finally:
-                snapshot.chmod(0o700)
-    except OSError as exc:
-        raise RunnerError(
-            f"could not create private candidate snapshot: {exc}"
-        ) from exc
-    finally:
-        if directory_fd is not None:
-            os.close(directory_fd)
-
-
-def verify_candidate_assets(
-    asset_dir: Path,
-    tag: str,
-    *,
-    authenticate: Callable[[Path, str], None] = verify_authenticity,
-    binary_runner: Callable[..., subprocess.CompletedProcess[str]] = subprocess.run,
-) -> dict[str, str]:
-    tag_match = TAG.fullmatch(tag)
-    if tag_match is None:
-        raise RunnerError("candidate tag must be a stable vMAJOR.MINOR.PATCH tag")
-    with candidate_asset_snapshot(asset_dir, tag) as snapshot:
-        return verify_candidate_snapshot(
-            snapshot,
-            tag,
-            authenticate=authenticate,
-            binary_runner=binary_runner,
-        )
-
-
-def verify_candidate_snapshot(
-    asset_dir: Path,
-    tag: str,
-    *,
-    authenticate: Callable[[Path, str], None],
-    binary_runner: Callable[..., subprocess.CompletedProcess[str]],
-) -> dict[str, str]:
-    tag_match = TAG.fullmatch(tag)
-    if tag_match is None:
-        raise RunnerError("candidate tag must be a stable vMAJOR.MINOR.PATCH tag")
-    require_candidate_directory(asset_dir)
-    required = required_asset_names(tag)
-    actual = {path.name for path in asset_dir.iterdir()}
-    missing = required - actual
-    unknown = actual - required
-    if missing or unknown:
-        details = []
-        if missing:
-            details.append("missing " + ", ".join(sorted(missing)))
-        if unknown:
-            details.append("unexpected " + ", ".join(sorted(unknown)))
-        raise RunnerError("candidate asset set is not closed: " + "; ".join(details))
-    for name in sorted(required):
-        require_regular_file(asset_dir / name, max_bytes=MAX_ASSET_BYTES)
-
-    binary_name = f"registryctl-{tag}-linux-amd64"
-    image_lock_name = f"registryctl-{tag}-image-lock.json"
-    capsule_name = f"registry-stack-{tag}-release-capsule.json"
-    checksums = parse_checksums(asset_dir / "SHA256SUMS")
-    for name in (binary_name, image_lock_name):
-        if checksums.get(name) != sha256(asset_dir / name):
-            raise RunnerError(f"{name} does not match its SHA256SUMS entry")
-
-    binary = asset_dir / binary_name
-    lock = require_object(
-        load_json(asset_dir / image_lock_name),
-        image_lock_name,
-        {
-            "schema_version",
-            "release_tag",
-            "manifest_source_ref",
-            "tag_target",
-            "platform",
-            "images",
-        },
-    )
-    try:
-        expected_image_lock_schema = schema_for_release_version(tag_match.group(1))
-    except ValueError as exc:
-        raise RunnerError(str(exc)) from None
-    if (
-        lock["schema_version"] != expected_image_lock_schema
-        or lock["release_tag"] != tag
-    ):
-        raise RunnerError("candidate image lock has the wrong schema or release tag")
-    if lock["platform"] != IMAGE_LOCK_PLATFORM:
-        raise RunnerError("candidate image lock must target linux/amd64")
-    if not COMMIT.fullmatch(str(lock["manifest_source_ref"])) or not COMMIT.fullmatch(
-        str(lock["tag_target"])
-    ):
-        raise RunnerError("candidate image lock source refs must be full commits")
-    try:
-        images = validate_images(expected_image_lock_schema, lock["images"])
-    except ValueError as exc:
-        raise RunnerError(str(exc)) from None
-    relay = exact_digest_file(asset_dir / "registry-relay.digest", "registry-relay")
-    notary = exact_digest_file(asset_dir / "registry-notary.digest", "registry-notary")
-    if images["registry-relay"] != relay or images["registry-notary"] != notary:
-        raise RunnerError("candidate digest files do not match the image lock")
-
-    capsule = load_json(asset_dir / capsule_name, max_bytes=8 * 1024 * 1024)
-    if not isinstance(capsule, dict):
-        raise RunnerError("release capsule must be an object")
-    if capsule.get("release_tag") != tag or capsule.get("version") != tag_match.group(
-        1
-    ):
-        raise RunnerError("release capsule identity does not match the candidate tag")
-    if capsule.get("repository") != CAPSULE_REPOSITORY:
-        raise RunnerError(f"release capsule repository must be {CAPSULE_REPOSITORY}")
-    source = capsule.get("source")
-    if (
-        not isinstance(source, dict)
-        or source.get("source_tag") != tag
-        or source.get("source_ref") != lock["manifest_source_ref"]
-        or source.get("source_commit") != lock["tag_target"]
-    ):
-        raise RunnerError(
-            "release capsule source lineage does not match the image lock"
-        )
-    lineage = source.get("lineage")
-    expected_lineage_keys = {
-        "tag_matches_source_tag",
-        "head_matches_tag_target",
-        "source_ref_ancestor_or_equal",
-        "default_branch_reachable",
-    }
-    if (
-        not isinstance(lineage, dict)
-        or set(lineage) != expected_lineage_keys
-        or any(value is not True for value in lineage.values())
-    ):
-        raise RunnerError("release capsule does not prove every source lineage check")
-    binary_entry = find_named(capsule.get("binaries"), binary_name, "binaries")
-    lock_entry = find_named(
-        capsule.get("release_files"), image_lock_name, "release_files"
-    )
-    if binary_entry.get("sha256") != sha256(binary):
-        raise RunnerError(
-            "release capsule binary hash does not match the candidate asset"
-        )
-    if lock_entry.get("kind") != "registryctl-release-image-lock" or lock_entry.get(
-        "sha256"
-    ) != sha256(asset_dir / image_lock_name):
-        raise RunnerError(
-            "release capsule image-lock classification or hash is invalid"
-        )
-    lock_sbom_name = f"{image_lock_name}.spdx.json"
-    lock_sbom = asset_dir / lock_sbom_name
-    verify_file_sbom(lock_sbom, image_lock_name, sha256(asset_dir / image_lock_name))
-    expected_sbom = {
-        "asset_name": lock_sbom_name,
-        "subject": image_lock_name,
-        "format": "spdx-json",
-        "sha256": sha256(lock_sbom),
-    }
-    if lock_entry.get("sbom") != expected_sbom:
-        raise RunnerError("release capsule image-lock SBOM binding is invalid")
-    capsule_image_items = capsule.get("images")
-    if not isinstance(capsule_image_items, list):
-        raise RunnerError("release capsule images must be an array")
-    capsule_image_names = [
-        item.get("name") for item in capsule_image_items if isinstance(item, dict)
-    ]
-    if (
-        len(capsule_image_names) != len(images)
-        or set(capsule_image_names) != set(images)
-    ):
-        raise RunnerError(
-            "release capsule images must contain exactly the image-lock images"
-        )
-    for name, digest_ref in images.items():
-        image = find_named(capsule_image_items, name, "images")
-        if image.get("digest_ref") != digest_ref:
-            raise RunnerError(
-                "release capsule images do not match the candidate image lock"
-            )
-        expected_role = (
-            "supporting-runtime-image"
-            if name == "postgresql"
-            else "released-product-image"
-        )
-        if image.get("role") != expected_role:
-            raise RunnerError(
-                f"release capsule {name} image must be a {expected_role}"
-            )
-    relay_entry = find_named(capsule_image_items, "registry-relay", "images")
-    notary_entry = find_named(capsule_image_items, "registry-notary", "images")
-    if (
-        relay_entry.get("digest_ref") != relay
-        or notary_entry.get("digest_ref") != notary
-    ):
-        raise RunnerError(
-            "release capsule images do not match the candidate digest files"
-        )
-
-    signed_subject_hashes = {
-        name: sha256(asset_dir / name) for name in signed_subject_names(tag)
-    }
-    # Candidate-controlled code must remain passive until every local binding
-    # and both external authenticity mechanisms have accepted the assets.
-    authenticate(asset_dir, tag)
-    if any(
-        sha256(asset_dir / name) != digest
-        for name, digest in signed_subject_hashes.items()
-    ):
-        raise RunnerError("a signed candidate subject changed during verification")
-    binary.chmod(binary.stat().st_mode | stat.S_IXUSR)
-    version_result = binary_runner(
-        [str(binary), "--version"],
-        text=True,
-        capture_output=True,
-        check=False,
-        timeout=10,
-    )
-    if (
-        version_result.returncode != 0
-        or version_result.stdout.strip() != f"registryctl {tag_match.group(1)}"
-    ):
-        raise RunnerError(
-            f"{binary_name} does not self-report registryctl {tag_match.group(1)}"
-        )
-    return {
-        "tag": tag,
-        "version": tag_match.group(1),
-        "source_commit": lock["tag_target"],
-        "registryctl_asset_sha256": f"sha256:{signed_subject_hashes[binary_name]}",
-        "image_lock_sha256": f"sha256:{signed_subject_hashes[image_lock_name]}",
-        "release_capsule_sha256": f"sha256:{signed_subject_hashes[capsule_name]}",
-        "relay_image": relay,
-        "notary_image": notary,
-    }
-
-
-def validate_against_schema(
-    value: Any, rule: dict[str, Any], schema: dict[str, Any], label: str = "result"
-) -> None:
-    try:
-        validate_closed_schema(value, rule, schema, label)
-    except SchemaValidationError as exc:
-        raise RunnerError(str(exc)) from None
-
-
-def read_canaries(path: Path) -> list[bytes]:
-    require_regular_file(path, max_bytes=64 * 1024)
-    mode = path.stat().st_mode
-    if mode & (stat.S_IRWXG | stat.S_IRWXO):
-        raise RunnerError("canary file must not grant group or other permissions")
-    canaries = []
-    for line_number, line in enumerate(path.read_bytes().splitlines(), 1):
-        if SAFE_CANARY.fullmatch(line) is None:
-            raise RunnerError(
-                f"canary file line {line_number} must contain 8 to 128 safe ASCII bytes"
-            )
-        canaries.append(line)
-    if not canaries or len(canaries) > 128 or len(set(canaries)) != len(canaries):
-        raise RunnerError("canary file must contain 1 to 128 unique values")
-    return canaries
-
-
-def parse_timestamp(value: str) -> dt.datetime:
-    return dt.datetime.fromisoformat(value.removesuffix("Z") + "+00:00")
-
-
-def elapsed_milliseconds(started: dt.datetime, completed: dt.datetime) -> int:
-    elapsed = completed - started
-    return (
-        elapsed.days * 86_400_000
-        + elapsed.seconds * 1000
-        + elapsed.microseconds // 1000
-    )
-
-
-def validate_result(
-    path: Path, profile: dict[str, Any], canary_file: Path
-) -> dict[str, Any]:
-    limit = profile["limits"]["public_result_bytes"]
-    require_regular_file(path, max_bytes=limit)
-    public_bytes = path.read_bytes()
-    canaries = read_canaries(canary_file)
-    if any(canary in public_bytes for canary in canaries):
-        raise RunnerError("public result contains a seeded restricted-value canary")
-    result = load_json(path, max_bytes=limit)
-    schema = load_json(SCHEMA_PATH)
-    validate_against_schema(result, schema, schema)
-    if result["profile_id"] != profile["profile_id"]:
-        raise RunnerError(
-            "public result profile_id does not match the selected profile"
-        )
-
-    data_operation = next(
-        item for item in profile["source"]["operations"] if item["role"] == "data"
-    )
-    expected_source = {
-        "product": profile["source"]["product"],
-        "baseline": profile["source"]["baseline"],
-        "operation_id": data_operation["id"],
-        "method": data_operation["method"],
-        "path": data_operation["path"],
-    }
-    for key, expected in expected_source.items():
-        if result["source"][key] != expected:
-            raise RunnerError(
-                f"public result source.{key} does not match the pinned profile"
-            )
-    if result["project"]["starter"] != profile["starter"]:
-        raise RunnerError("public result starter does not match the pinned profile")
-    if set(result["limitations"]) != REQUIRED_LIMITATIONS:
-        raise RunnerError("public result must retain every profile limitation")
-
-    cases = result["cases"]
-    if [case["case_id"] for case in cases] != list(CASE_IDS):
-        raise RunnerError("public result cases must use the closed ordered case set")
-    expectations = {item["id"]: item for item in profile["cases"]}
-    all_passed = True
-    run_started = parse_timestamp(result["started_at"])
-    run_completed = parse_timestamp(result["completed_at"])
-    if run_completed < run_started:
-        raise RunnerError("public result completes before it starts")
-    latest_case_completion = run_started
-    for case in cases:
-        expectation = expectations[case["case_id"]]
-        expected_access = expectation["expected_source_data_access"]
-        if (
-            case["outcome"] == "passed"
-            and case["source_data_access"] != expected_access
-        ):
-            raise RunnerError(
-                f"{case['case_id']} passed without expected source-side access evidence {expected_access}"
-            )
-        if (
-            case["outcome"] in {"passed", "not_applicable"}
-            and case["result_code"] != expectation["expected_result_code"]
-        ):
-            raise RunnerError(
-                f"{case['case_id']} does not use the reviewed safe result code"
-            )
-        if expected_access == "not_applicable":
-            if (
-                case["outcome"] != "not_applicable"
-                or case["source_data_access"] != "not_applicable"
-            ):
-                raise RunnerError(
-                    f"{case['case_id']} must record the profile's not-applicable proof"
-                )
-        elif case["outcome"] != "passed":
-            all_passed = False
-        case_started = parse_timestamp(case["started_at"])
-        case_completed = parse_timestamp(case["completed_at"])
-        if case_completed < case_started:
-            raise RunnerError(f"{case['case_id']} completes before it starts")
-        case_elapsed_ms = elapsed_milliseconds(case_started, case_completed)
-        if case["duration_ms"] != case_elapsed_ms:
-            raise RunnerError(
-                f"{case['case_id']} duration_ms does not match its timestamps"
-            )
-        if case_elapsed_ms > profile["limits"]["case_timeout_seconds"] * 1000:
-            raise RunnerError(f"{case['case_id']} exceeds the profile case timeout")
-        if case_started < run_started or case_completed > run_completed:
-            raise RunnerError(f"{case['case_id']} falls outside the recorded run")
-        latest_case_completion = max(latest_case_completion, case_completed)
-    run_ms = elapsed_milliseconds(run_started, run_completed)
-    if run_ms > profile["limits"]["run_timeout_seconds"] * 1000:
-        raise RunnerError("public result exceeds the profile run timeout")
-    if result["redaction"]["seeded_canaries"] != len(canaries):
-        raise RunnerError(
-            "public result seeded_canaries does not match the protected canary file"
-        )
-    if result["redaction"]["scanned_bytes"] < len(public_bytes):
-        raise RunnerError(
-            "redaction scan byte count does not include the public result"
-        )
-    if (
-        result["redaction"]["restricted_raw_evidence_bytes"]
-        > profile["limits"]["raw_evidence_bytes"]
-    ):
-        raise RunnerError("restricted raw evidence exceeds the profile byte limit")
-    teardown_started = parse_timestamp(result["teardown"]["started_at"])
-    teardown_completed = parse_timestamp(result["teardown"]["completed_at"])
-    if teardown_completed < teardown_started:
-        raise RunnerError("teardown completes before it starts")
-    teardown_elapsed_ms = elapsed_milliseconds(teardown_started, teardown_completed)
-    if result["teardown"]["duration_ms"] != teardown_elapsed_ms:
-        raise RunnerError("teardown duration_ms does not match its timestamps")
-    if teardown_elapsed_ms > profile["limits"]["teardown_timeout_seconds"] * 1000:
-        raise RunnerError("teardown exceeds the profile timeout")
-    if teardown_started < latest_case_completion:
-        raise RunnerError("teardown starts before the recorded test cases complete")
-    if teardown_started < run_started:
-        raise RunnerError("teardown starts before the recorded run")
-    if teardown_completed > run_completed:
-        raise RunnerError("public result completion must include the teardown attempt")
-    complete = all_passed and result["teardown"]["status"] == "completed"
-    if (result["status"] == "passed") != complete:
-        raise RunnerError(
-            "public result status is inconsistent with cases and teardown"
-        )
-    return result
-
-
-def plan_document(profile: dict[str, Any]) -> dict[str, Any]:
-    return {
-        "schema_version": "registry.release.integration_e2_plan.v1",
-        "profile_id": profile["profile_id"],
-        "support_status": profile["support_status"],
-        "candidate_evidence": False,
-        "status": "planned_not_executed",
-        "executor": "approved_operator_wrapper",
-        "starter": profile["starter"],
-        "pinned_source": profile["source"]["baseline"],
-        "source_operations": profile["source"]["operations"],
-        "authored_contract": profile["authored_contract"],
-        "required_input_names": [item["env"] for item in profile["dynamic_inputs"]],
-        "cases": profile["cases"],
-        "prerequisites": profile["prerequisites"],
-        "limits": profile["limits"],
-        "stages": [
-            "Copy the closed candidate assets without following symlinks, then verify and version-check only the private non-writable snapshot.",
-            "Have the operator wrapper create its own authenticated non-writable snapshot and initialize the pinned starter only from that snapshot.",
-            "Apply only the profile's reviewed authored inputs; never edit generated YAML.",
-            "Run the offline project test, check, build, and generated-file hash review.",
-            "Deploy one digest-pinned Relay, Notary, and PostgreSQL set per authority within the approved run timeout.",
-            "Probe source-side audit or request counters before and after every closed test case.",
-            "Capture bounded restricted evidence and emit only hashes, timings, safe codes, and source-contact classifications.",
-            "Scan the public result for seeded canaries and forbidden values.",
-            "Re-hash generated project outputs and reject hand edits.",
-            "Attempt scoped teardown in a finally path and record its sanitized evidence hash.",
-        ],
-    }
-
-
-def print_plan(profile: dict[str, Any], *, as_json: bool) -> None:
-    plan = plan_document(profile)
-    if as_json:
-        print(json.dumps(plan, indent=2, sort_keys=True))
-        return
-    print(f"{plan['profile_id']}: {plan['support_status']}")
-    print("Status: planned, not executed; this is not candidate evidence.")
-    print(
-        "Executor: approved operator wrapper; the public runner does not run live stages."
-    )
-    print("Prerequisites:")
-    for item in plan["prerequisites"]:
-        print(f"  - {item}")
-    print("Stages:")
-    for index, item in enumerate(plan["stages"], 1):
-        print(f"  {index}. {item}")
-
-
-def parser() -> argparse.ArgumentParser:
-    common = argparse.ArgumentParser(add_help=False)
-    common.add_argument("--profile", choices=sorted(PROFILE_FILES), required=True)
-    root = argparse.ArgumentParser(description=__doc__)
-    commands = root.add_subparsers(dest="command", required=True)
-    plan = commands.add_parser(
-        "plan", parents=[common], help="show prerequisites and bounded stages"
-    )
-    plan.add_argument("--json", action="store_true")
-    commands.add_parser(
-        "dry-run",
-        parents=[common],
-        help="emit the non-evidence orchestration plan as JSON",
-    )
-    validate = commands.add_parser(
-        "validate", help="validate the source packet and optional real evidence"
-    )
-    validate.add_argument("--profile", choices=sorted(PROFILE_FILES))
-    validate.add_argument("--candidate-dir", type=Path)
-    validate.add_argument("--tag")
-    validate.add_argument("--result", type=Path)
-    validate.add_argument("--canary-file", type=Path)
-    return root
-
-
-def main(argv: list[str] | None = None) -> int:
-    args = parser().parse_args(argv)
-    try:
-        validate_packet()
-        if args.command == "plan":
-            print_plan(load_profile(args.profile), as_json=args.json)
-        elif args.command == "dry-run":
-            print_plan(load_profile(args.profile), as_json=True)
-        else:
-            candidate_requested = args.candidate_dir is not None or args.tag is not None
-            if candidate_requested and (args.candidate_dir is None or args.tag is None):
-                raise RunnerError(
-                    "candidate validation requires --candidate-dir and --tag together"
-                )
-            result_requested = args.result is not None or args.canary_file is not None
-            if result_requested and not candidate_requested:
-                raise RunnerError(
-                    "public result validation also requires --candidate-dir and --tag"
-                )
-            if result_requested and (
-                args.profile is None or args.result is None or args.canary_file is None
-            ):
-                raise RunnerError(
-                    "result validation requires --profile, --result, and --canary-file together"
-                )
-            candidate = None
-            result = None
-            if candidate_requested:
-                candidate = verify_candidate_assets(args.candidate_dir, args.tag)
-            if result_requested:
-                profile = load_profile(args.profile)
-                result = validate_result(args.result, profile, args.canary_file)
-            elif args.profile is not None:
-                load_profile(args.profile)
-            if candidate is not None and result is not None:
-                expected_release = {
-                    **candidate,
-                    "candidate_assets_verified": True,
-                    "authenticity_verified": True,
-                }
-                if result["release"] != expected_release:
-                    raise RunnerError(
-                        "public result release identity does not match verified candidate assets"
-                    )
-            if candidate is not None and result is not None:
-                print("integration E2 candidate result validation passed")
-            elif candidate is not None:
-                print("integration E2 candidate asset validation passed")
-            elif args.profile is not None:
-                print(f"integration E2 profile validation passed: {args.profile}")
-            else:
-                print("integration E2 source packet validation passed")
-    except (RunnerError, OSError, subprocess.SubprocessError, ValueError) as exc:
-        print(f"error: {exc}", file=sys.stderr)
-        return 1
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
diff --git a/release/scripts/openid-conformance-runner.py b/release/scripts/openid-conformance-runner.py
deleted file mode 100755
index 24c6ce20f..000000000
--- a/release/scripts/openid-conformance-runner.py
+++ /dev/null
@@ -1,1685 +0,0 @@
-#!/usr/bin/env python3
-# SPDX-License-Identifier: Apache-2.0
-"""Run mapped OpenID Foundation conformance-suite slices for Registry Stack."""
-
-from __future__ import annotations
-
-import argparse
-import base64
-import binascii
-import datetime as dt
-import hashlib
-import hmac
-import io
-import json
-import os
-import re
-import shutil
-import ssl
-import stat
-import subprocess
-import sys
-import tempfile
-import time
-import urllib.error
-import urllib.parse
-import urllib.request
-import zipfile
-import zlib
-from collections import Counter
-from pathlib import Path
-from string import Template
-from typing import Any
-
-from closed_json_schema import SchemaValidationError, validate_against_schema
-
-
-REPO_ROOT = Path(__file__).resolve().parents[2]
-CONFIG_DIR = REPO_ROOT / "release" / "conformance" / "openid"
-PLAN_MAP_PATH = CONFIG_DIR / "plan-map.json"
-EVIDENCE_SCHEMA_PATH = CONFIG_DIR / "evidence-summary.schema.json"
-COMPOSE_OVERRIDE_PATH = CONFIG_DIR / "docker-compose.override.yaml"
-BUILDER_COMPOSE_OVERRIDE_PATH = CONFIG_DIR / "docker-compose-builder.override.yaml"
-SUITE_REQUIREMENTS_INPUT_PATH = CONFIG_DIR / "python-requirements.in"
-SUITE_REQUIREMENTS_LOCK_PATH = CONFIG_DIR / "python-requirements.txt"
-DEFAULT_WORK_ROOT = REPO_ROOT / "target" / "openid-conformance"
-DEFAULT_CACHE_DIR = DEFAULT_WORK_ROOT / "cache"
-DEFAULT_OUTPUT_ROOT = DEFAULT_WORK_ROOT / "results"
-DEFAULT_SUITE_JWKS_PATH = DEFAULT_WORK_ROOT / "conformance-suite-jwks.json"
-SCHEMA_VERSION = "registry.release.openid_conformance_plan_map.v1"
-EVIDENCE_SCHEMA_VERSION = "registry.release.openid_conformance_evidence.v1"
-EVIDENCE_SCENARIO_ID = "notary-oid4vci-issuer-metadata"
-EVIDENCE_CLASSIFICATION = "unreviewed-candidate-evidence-summary"
-EVIDENCE_ASSOCIATION = "operator-attested-pending-review"
-EVIDENCE_UNSUPPORTED_SCENARIOS = (
-    ("notary-oid4vci-issuer-full", "blocked-by-suite-profile"),
-)
-SUITE_JAR = "target/fapi-test-suite.jar"
-SUITE_JAR_STAMP = "target/fapi-test-suite.jar.registry-stack-source-ref"
-COMPOSE_CONFIG_DIR_ENV = "REGISTRY_OPENID_CONFORMANCE_CONFIG_DIR"
-SUITE_CA_CONTAINER_PATH = "/etc/ssl/certs/nginx-selfsigned.crt"
-DEFAULT_SUITE_CA_PATH = DEFAULT_WORK_ROOT / "conformance-suite-ca.pem"
-MAX_SUITE_EXPORT_BYTES = 64 * 1024 * 1024
-MAX_SUITE_EXPORT_ENTRIES = 2
-MAX_SUITE_EXPORT_COMPRESSION_RATIO = 100
-MAX_SUITE_JWKS_BYTES = 1024 * 1024
-MAX_SUITE_SIGNATURE_BYTES = 16 * 1024
-SUITE_RESULTS = {"PASSED", "FAILED", "WARNING", "REVIEW", "SKIPPED", "UNKNOWN"}
-CONDITION_RESULTS = {"INFO", "SUCCESS", "REVIEW", "WARNING", "FAILURE"}
-KEY_ID = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$")
-TEST_ID = re.compile(r"^[A-Za-z0-9]{15}$")
-COMMIT = re.compile(r"^[0-9a-f]{40}$")
-SHA256 = re.compile(r"^sha256:[0-9a-f]{64}$")
-SHA256_DIGEST_INFO_PREFIX = bytes.fromhex(
-    "3031300d060960864801650304020105000420"
-)
-FORBIDDEN_PUBLIC_KEYS = {
-    "access_token",
-    "authorization",
-    "credential",
-    "credentials",
-    "civil_id",
-    "date_of_birth",
-    "family_name",
-    "given_name",
-    "id_token",
-    "logs",
-    "message",
-    "messages",
-    "msg",
-    "national_id",
-    "pre-authorized_code",
-    "pre_authorized_code",
-    "proof",
-    "raw",
-    "refresh_token",
-    "request",
-    "response",
-    "results",
-    "subject_id",
-    "static_tx_code",
-    "token",
-    "transaction_code",
-    "tx_code",
-}
-SENSITIVE_RAW_KEYS = FORBIDDEN_PUBLIC_KEYS - {
-    "logs",
-    "messages",
-    "raw",
-    "request",
-    "response",
-    "results",
-}
-
-
-class RunnerError(RuntimeError):
-    """A user-actionable conformance runner failure."""
-
-
-class NoRedirect(urllib.request.HTTPRedirectHandler):
-    def redirect_request(self, request, file_pointer, code, message, headers, url):
-        return None
-
-
-def load_plan_map(path: Path = PLAN_MAP_PATH) -> dict[str, Any]:
-    with path.open(encoding="utf-8") as handle:
-        plan_map = json.load(handle)
-    if plan_map.get("schema_version") != SCHEMA_VERSION:
-        raise RunnerError(f"unsupported plan map schema: {plan_map.get('schema_version')}")
-    scenarios = plan_map.get("scenarios")
-    if not isinstance(scenarios, list) or not scenarios:
-        raise RunnerError("plan map must include at least one scenario")
-    ids = [scenario.get("id") for scenario in scenarios]
-    if any(not scenario_id for scenario_id in ids):
-        raise RunnerError("every plan map scenario must have an id")
-    if len(ids) != len(set(ids)):
-        raise RunnerError("plan map scenario ids must be unique")
-    return plan_map
-
-
-def find_scenario(plan_map: dict[str, Any], scenario_id: str) -> dict[str, Any]:
-    for scenario in plan_map["scenarios"]:
-        if scenario.get("id") == scenario_id:
-            return scenario
-    raise RunnerError(f"unknown OpenID conformance scenario: {scenario_id}")
-
-
-def scenario_plan_arg(scenario: dict[str, Any]) -> str:
-    plan = scenario["suite_plan"]
-    variants = scenario.get("variants") or {}
-    variant_args = "".join(f"[{key}={value}]" for key, value in variants.items())
-    modules = scenario.get("suite_modules") or []
-    module_arg = ":" + ",".join(modules) if modules else ""
-    return f"{plan}{variant_args}{module_arg}"
-
-
-def default_params(scenario: dict[str, Any], args: argparse.Namespace) -> dict[str, str]:
-    defaults = scenario.get("default_parameters") or {}
-    issuer_env = defaults.get(
-        "issuer_url_env", "REGISTRY_OPENID_CONFORMANCE_ISSUER_URL"
-    )
-    issuer_url = args.issuer_url or os.environ.get(issuer_env)
-    if not issuer_url:
-        raise RunnerError(
-            f"issuer URL is required; pass --issuer-url or set {issuer_env}"
-        )
-    authorization_server = (
-        args.authorization_server
-        or os.environ.get(defaults.get("authorization_server_env", ""))
-        or issuer_url
-    )
-    credential_configuration_id = (
-        args.credential_configuration_id
-        or os.environ.get(defaults.get("credential_configuration_id_env", ""))
-        or defaults.get("default_credential_configuration_id")
-    )
-    if not credential_configuration_id:
-        raise RunnerError("credential configuration id is required")
-    return {
-        "issuer_url": issuer_url,
-        "authorization_server": authorization_server,
-        "credential_configuration_id": credential_configuration_id,
-        "static_tx_code": args.static_tx_code,
-        "client_id": args.client_id,
-        "client2_id": args.client2_id,
-    }
-
-
-def render_config(scenario: dict[str, Any], params: dict[str, str]) -> str:
-    template_path = CONFIG_DIR / scenario["config_template"]
-    rendered = Template(template_path.read_text(encoding="utf-8")).substitute(params)
-    json.loads(rendered)
-    return rendered
-
-
-def write_rendered_config(
-    scenario: dict[str, Any], output_dir: Path, params: dict[str, str]
-) -> Path:
-    path = output_dir / f"{scenario['id']}.config.json"
-    return write_new_file(
-        path,
-        (render_config(scenario, params) + "\n").encode("utf-8"),
-    )
-
-
-def suite_settings(plan_map: dict[str, Any], args: argparse.Namespace) -> dict[str, str]:
-    suite = plan_map["suite"]
-    return {
-        "repo": args.suite_repo or suite["repo"],
-        "ref": args.suite_ref or suite["ref"],
-        "base_url": args.conformance_server or suite["base_url"],
-        "local_base_url": args.conformance_server_local or suite["local_base_url"],
-        "mtls_base_url": args.conformance_server_mtls or suite["mtls_base_url"],
-    }
-
-
-def suite_dir(args: argparse.Namespace) -> Path:
-    if args.suite_dir:
-        return Path(args.suite_dir).expanduser().resolve()
-    return Path(args.cache_dir).expanduser().resolve() / "conformance-suite"
-
-
-def run_checked(
-    command: list[str], cwd: Path | None = None, env: dict[str, str] | None = None
-) -> None:
-    result = subprocess.run(command, cwd=cwd, env=env, text=True, check=False)
-    if result.returncode != 0:
-        raise RunnerError(f"command failed ({result.returncode}): {' '.join(command)}")
-
-
-def ensure_suite_checkout(plan_map: dict[str, Any], args: argparse.Namespace) -> Path:
-    settings = suite_settings(plan_map, args)
-    checkout = suite_dir(args)
-    checkout.parent.mkdir(parents=True, exist_ok=True)
-    git = shutil.which("git")
-    if not git:
-        raise RunnerError("git is required to prepare the OpenID conformance suite")
-    if checkout.exists():
-        status = subprocess.run(
-            [git, "status", "--porcelain"],
-            cwd=checkout,
-            text=True,
-            capture_output=True,
-            check=False,
-        )
-        if status.returncode != 0:
-            raise RunnerError(status.stderr.strip() or "could not inspect suite checkout")
-        if status.stdout.strip():
-            raise RunnerError(f"suite checkout has local changes: {checkout}")
-        run_checked([git, "fetch", "--tags", "origin"], cwd=checkout)
-    else:
-        run_checked([git, "clone", settings["repo"], str(checkout)])
-        run_checked([git, "fetch", "--tags", "origin"], cwd=checkout)
-    run_checked([git, "checkout", "--detach", settings["ref"]], cwd=checkout)
-    actual = subprocess.check_output(
-        [git, "rev-parse", "HEAD"], cwd=checkout, text=True
-    ).strip()
-    expected = settings["ref"]
-    if len(expected) == 40 and actual != expected:
-        raise RunnerError(f"suite checkout is at {actual}, expected {expected}")
-    return checkout
-
-
-def compose_command(
-    checkout: Path, args: argparse.Namespace, *compose_args: str
-) -> list[str]:
-    command = ["docker", "compose", "-f", str(checkout / "docker-compose.yml")]
-    if COMPOSE_OVERRIDE_PATH.exists():
-        command += ["-f", str(COMPOSE_OVERRIDE_PATH)]
-    command += list(compose_args)
-    return command
-
-
-def builder_command(checkout: Path, *compose_args: str) -> list[str]:
-    return [
-        "docker",
-        "compose",
-        "-f",
-        str(checkout / "builder-compose.yml"),
-        "-f",
-        str(BUILDER_COMPOSE_OVERRIDE_PATH),
-        *compose_args,
-    ]
-
-
-def suite_checkout_ref(checkout: Path) -> str:
-    git = shutil.which("git")
-    if not git:
-        raise RunnerError("git is required to inspect the OpenID conformance suite")
-    result = subprocess.run(
-        [git, "rev-parse", "HEAD"],
-        cwd=checkout,
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-    actual = result.stdout.strip()
-    if result.returncode != 0 or len(actual) != 40:
-        raise RunnerError(result.stderr.strip() or "could not resolve suite checkout ref")
-    return actual
-
-
-def file_sha256(path: Path) -> str:
-    return hashlib.sha256(path.read_bytes()).hexdigest()
-
-
-def canonical_sha256(value: Any) -> str:
-    encoded = json.dumps(
-        value, ensure_ascii=False, separators=(",", ":"), sort_keys=True
-    ).encode("utf-8")
-    return f"sha256:{hashlib.sha256(encoded).hexdigest()}"
-
-
-def read_owner_only_file(path: Path, *, max_bytes: int, label: str) -> bytes:
-    path = path.expanduser()
-    nofollow = getattr(os, "O_NOFOLLOW", None)
-    cloexec = getattr(os, "O_CLOEXEC", None)
-    if nofollow is None or cloexec is None or not hasattr(os, "geteuid"):
-        raise RunnerError("secure private result handling is unavailable")
-    descriptor: int | None = None
-    try:
-        descriptor = os.open(path, os.O_RDONLY | cloexec | nofollow)
-        before = os.fstat(descriptor)
-        if (
-            not stat.S_ISREG(before.st_mode)
-            or before.st_uid != os.geteuid()
-            or before.st_mode & 0o077
-            or not 0 < before.st_size <= max_bytes
-        ):
-            raise RunnerError(f"{label} must be an owner-only, bounded regular file")
-        with os.fdopen(descriptor, "rb", closefd=True) as handle:
-            descriptor = None
-            content = handle.read(max_bytes + 1)
-            after = os.fstat(handle.fileno())
-    except OSError:
-        raise RunnerError(f"{label} could not be opened securely") from None
-    finally:
-        if descriptor is not None:
-            os.close(descriptor)
-    if (
-        len(content) != before.st_size
-        or len(content) > max_bytes
-        or (
-            before.st_dev,
-            before.st_ino,
-            before.st_size,
-            before.st_mtime_ns,
-            before.st_ctime_ns,
-        )
-        != (
-            after.st_dev,
-            after.st_ino,
-            after.st_size,
-            after.st_mtime_ns,
-            after.st_ctime_ns,
-        )
-    ):
-        raise RunnerError(f"{label} changed while it was read")
-    return content
-
-
-def base64url_decode(value: Any, label: str, *, allow_padding: bool) -> bytes:
-    if not isinstance(value, str) or not value or len(value) > 16_384:
-        raise RunnerError(f"{label} is invalid")
-    if allow_padding:
-        if re.fullmatch(r"[A-Za-z0-9_-]+={0,2}", value) is None:
-            raise RunnerError(f"{label} is invalid")
-        unpadded = value.rstrip("=")
-        if len(value) - len(unpadded) != (-len(unpadded)) % 4:
-            raise RunnerError(f"{label} is invalid")
-    else:
-        if re.fullmatch(r"[A-Za-z0-9_-]+", value) is None:
-            raise RunnerError(f"{label} is invalid")
-        unpadded = value
-    try:
-        return base64.urlsafe_b64decode(unpadded + "=" * (-len(unpadded) % 4))
-    except (ValueError, binascii.Error):
-        raise RunnerError(f"{label} is invalid") from None
-
-
-def validate_suite_jwks(value: Any) -> dict[str, Any]:
-    if not isinstance(value, dict) or set(value) != {"keys"}:
-        raise RunnerError("suite JWKS has an unsupported shape")
-    keys = value.get("keys")
-    if not isinstance(keys, list) or not 0 < len(keys) <= 8:
-        raise RunnerError("suite JWKS must contain a bounded key list")
-    for key in keys:
-        if (
-            not isinstance(key, dict)
-            or set(key) != {"alg", "e", "kid", "kty", "n", "use"}
-            or key.get("alg") != "RS256"
-            or key.get("kty") != "RSA"
-            or key.get("use") != "sig"
-            or not isinstance(key.get("kid"), str)
-            or KEY_ID.fullmatch(key["kid"]) is None
-        ):
-            raise RunnerError("suite JWKS contains an unsupported signing key")
-        modulus_bytes = base64url_decode(
-            key.get("n"), "suite JWKS RSA modulus", allow_padding=False
-        )
-        exponent_bytes = base64url_decode(
-            key.get("e"), "suite JWKS RSA exponent", allow_padding=False
-        )
-        if (
-            not modulus_bytes
-            or modulus_bytes[0] == 0
-            or not 2048 <= int.from_bytes(modulus_bytes).bit_length() <= 8192
-            or int.from_bytes(modulus_bytes) % 2 == 0
-            or not exponent_bytes
-            or exponent_bytes[0] == 0
-        ):
-            raise RunnerError("suite JWKS contains an invalid RSA signing key")
-        exponent = int.from_bytes(exponent_bytes)
-        if not 3 <= exponent <= 2_147_483_647 or exponent % 2 == 0:
-            raise RunnerError("suite JWKS contains an invalid RSA signing key")
-    return value
-
-
-def parse_suite_jwks(content: bytes) -> dict[str, Any]:
-    try:
-        parsed = json.loads(content)
-    except (UnicodeDecodeError, json.JSONDecodeError, RecursionError):
-        raise RunnerError("suite JWKS is not valid JSON") from None
-    return validate_suite_jwks(parsed)
-
-
-def load_suite_jwks(path: Path) -> tuple[dict[str, Any], str]:
-    content = read_owner_only_file(
-        path,
-        max_bytes=MAX_SUITE_JWKS_BYTES,
-        label="suite JWKS",
-    )
-    jwks = parse_suite_jwks(content)
-    return jwks, canonical_sha256(jwks)
-
-
-def rsa_key_verifies(content: bytes, signature: bytes, key: dict[str, Any]) -> bool:
-    modulus = int.from_bytes(
-        base64url_decode(key["n"], "suite JWKS RSA modulus", allow_padding=False)
-    )
-    exponent = int.from_bytes(
-        base64url_decode(key["e"], "suite JWKS RSA exponent", allow_padding=False)
-    )
-    encoded_size = (modulus.bit_length() + 7) // 8
-    if len(signature) != encoded_size:
-        return False
-    signature_number = int.from_bytes(signature)
-    if signature_number <= 0 or signature_number >= modulus:
-        return False
-    digest_info = SHA256_DIGEST_INFO_PREFIX + hashlib.sha256(content).digest()
-    padding_size = encoded_size - len(digest_info) - 3
-    if padding_size < 8:
-        return False
-    expected = b"\x00\x01" + b"\xff" * padding_size + b"\x00" + digest_info
-    recovered = pow(signature_number, exponent, modulus).to_bytes(encoded_size)
-    return hmac.compare_digest(recovered, expected)
-
-
-def verify_suite_export_signature(
-    content: bytes, encoded_signature: bytes, jwks: dict[str, Any]
-) -> None:
-    try:
-        signature_text = encoded_signature.decode("ascii")
-    except UnicodeDecodeError:
-        raise RunnerError("suite export signature is invalid") from None
-    signature = base64url_decode(
-        signature_text, "suite export signature", allow_padding=True
-    )
-    matching_keys = [
-        key for key in jwks["keys"] if rsa_key_verifies(content, signature, key)
-    ]
-    if len(matching_keys) != 1:
-        raise RunnerError(
-            "suite export signature must verify with exactly one trusted suite key"
-        )
-
-
-def load_suite_export(
-    path: Path, module_id: str, suite_jwks: dict[str, Any]
-) -> dict[str, Any]:
-    raw = read_owner_only_file(
-        path,
-        max_bytes=MAX_SUITE_EXPORT_BYTES,
-        label="suite export",
-    )
-    try:
-        archive = zipfile.ZipFile(io.BytesIO(raw))
-    except zipfile.BadZipFile:
-        raise RunnerError("suite export is not a valid ZIP archive") from None
-    try:
-        with archive:
-            entries = archive.infolist()
-            names = [entry.filename for entry in entries]
-            if len(entries) != MAX_SUITE_EXPORT_ENTRIES or len(names) != len(
-                set(names)
-            ):
-                raise RunnerError(
-                    "suite export must contain one module JSON and one signature"
-                )
-            json_pattern = re.compile(
-                rf"^test-log-{re.escape(module_id)}-([A-Za-z0-9]{{15}})\.json$"
-            )
-            json_matches = [
-                (name, match)
-                for name in names
-                if (match := json_pattern.fullmatch(name)) is not None
-            ]
-            if len(json_matches) != 1:
-                raise RunnerError("suite export does not contain the expected module")
-            json_name, filename_match = json_matches[0]
-            filename_test_id = filename_match.group(1)
-            signature_name = f"{json_name.removesuffix('.json')}.sig"
-            expected_names = {
-                json_name,
-                signature_name,
-            }
-            if set(names) != expected_names:
-                raise RunnerError("suite export contains unexpected files")
-
-            total_size = 0
-            for entry in entries:
-                mode = entry.external_attr >> 16
-                if (
-                    entry.is_dir()
-                    or "/" in entry.filename
-                    or "\\" in entry.filename
-                    or stat.S_ISLNK(mode)
-                    or entry.flag_bits & 0x1
-                    or entry.compress_type
-                    not in {zipfile.ZIP_STORED, zipfile.ZIP_DEFLATED}
-                    or entry.file_size <= 0
-                    or entry.file_size > MAX_SUITE_EXPORT_BYTES
-                    or (
-                        entry.filename == signature_name
-                        and entry.file_size > MAX_SUITE_SIGNATURE_BYTES
-                    )
-                ):
-                    raise RunnerError("suite export contains an unsafe ZIP entry")
-                total_size += entry.file_size
-                if total_size > MAX_SUITE_EXPORT_BYTES:
-                    raise RunnerError("suite export uncompressed size is too large")
-                if entry.file_size > 1024 * 1024 and (
-                    entry.compress_size <= 0
-                    or entry.file_size
-                    > entry.compress_size * MAX_SUITE_EXPORT_COMPRESSION_RATIO
-                ):
-                    raise RunnerError(
-                        "suite export contains a suspicious compression ratio"
-                    )
-
-            content: dict[str, bytes] = {}
-            for name in expected_names:
-                entry = archive.getinfo(name)
-                with archive.open(entry) as handle:
-                    content[name] = handle.read(entry.file_size + 1)
-                if len(content[name]) != entry.file_size:
-                    raise RunnerError("suite export ZIP entry has an invalid size")
-    except (EOFError, zipfile.BadZipFile, zlib.error):
-        raise RunnerError("suite export contains invalid compressed data") from None
-    encoded = content[json_name]
-    verify_suite_export_signature(encoded, content[signature_name], suite_jwks)
-    try:
-        exported = json.loads(encoded)
-    except (UnicodeDecodeError, json.JSONDecodeError, RecursionError):
-        raise RunnerError("suite export module is not valid JSON") from None
-    if not isinstance(exported, dict):
-        raise RunnerError("suite export module must be a JSON object")
-    expected_keys = {
-        "exportedAt",
-        "exportedBy",
-        "exportedFrom",
-        "exportedVersion",
-        "results",
-        "testInfo",
-    }
-    if set(exported) != expected_keys:
-        raise RunnerError("suite export module has an unsupported shape")
-    results = exported.get("results")
-    if (
-        not isinstance(results, list)
-        or not results
-        or len(results) > 20_000
-        or any(not isinstance(entry, dict) for entry in results)
-    ):
-        raise RunnerError("suite export results have an unsupported shape")
-    test_info = exported.get("testInfo")
-    if (
-        not isinstance(test_info, dict)
-        or test_info.get("_id") != filename_test_id
-        or test_info.get("testId") != filename_test_id
-        or not isinstance(test_info.get("planId"), str)
-        or not 0 < len(test_info["planId"]) <= 128
-    ):
-        raise RunnerError("suite export run identifiers do not match")
-    return exported
-
-
-def validate_suite_timestamp(value: Any) -> tuple[str, dt.datetime]:
-    if (
-        not isinstance(value, str)
-        or re.fullmatch(
-            r"[0-9]{4}-[0-9]{2}-[0-9]{2}T"
-            r"[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]{1,9})?Z",
-            value,
-        )
-        is None
-    ):
-        raise RunnerError("suite run start timestamp is invalid")
-    try:
-        parsed = dt.datetime.fromisoformat(value.removesuffix("Z") + "+00:00")
-    except ValueError:
-        raise RunnerError("suite run start timestamp is invalid") from None
-    return value, parsed
-
-
-def completion_timestamp(
-    results: list[dict[str, Any]],
-    module_id: str,
-    suite_result: str,
-    started: dt.datetime,
-) -> str:
-    terminal = [
-        entry
-        for entry in results
-        if entry.get("src") == module_id
-        and entry.get("result") == "FINISHED"
-        and entry.get("testmodule_result") == suite_result
-    ]
-    if len(terminal) != 1:
-        raise RunnerError(
-            "suite export must contain one matching terminal module record"
-        )
-    epoch_ms = terminal[0].get("time")
-    if (
-        isinstance(epoch_ms, bool)
-        or not isinstance(epoch_ms, int)
-        or not 0 < epoch_ms < 32_503_680_000_000
-    ):
-        raise RunnerError("suite run completion timestamp is invalid")
-    completed = dt.datetime.fromtimestamp(epoch_ms / 1000, tz=dt.UTC)
-    if completed < started:
-        raise RunnerError("suite run completes before it starts")
-    return completed.isoformat(timespec="milliseconds").replace("+00:00", "Z")
-
-
-def validate_considered_log_bindings(
-    results: list[dict[str, Any]], module_id: str, test_id: str
-) -> None:
-    for entry in results:
-        considered = entry.get("result") in CONDITION_RESULTS or (
-            entry.get("src") == module_id and entry.get("result") == "FINISHED"
-        )
-        if considered and entry.get("testId") != test_id:
-            raise RunnerError("suite export log entry does not match the selected run")
-
-
-def validate_https_url(value: Any, label: str) -> str:
-    if (
-        not isinstance(value, str)
-        or len(value) > 2048
-        or "\\" in value
-        or any(
-            character.isspace()
-            or ord(character) < 0x20
-            or ord(character) == 0x7F
-            for character in value
-        )
-    ):
-        raise RunnerError(f"suite runtime configuration {label} is invalid")
-    try:
-        parsed = urllib.parse.urlsplit(value)
-        port = parsed.port
-    except ValueError:
-        raise RunnerError(
-            f"suite runtime configuration {label} is invalid"
-        ) from None
-    hostname = parsed.hostname
-    if (
-        parsed.scheme != "https"
-        or not hostname
-        or parsed.username is not None
-        or parsed.password is not None
-        or parsed.query
-        or parsed.fragment
-        or (
-            re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9.-]*", hostname) is None
-            and re.fullmatch(r"[0-9A-Fa-f:.]+", hostname) is None
-        )
-    ):
-        raise RunnerError(f"suite runtime configuration {label} is invalid")
-    normalized_host = (
-        f"[{hostname.lower()}]" if ":" in hostname else hostname.lower()
-    )
-    if port is not None:
-        normalized_host = f"{normalized_host}:{port}"
-    return urllib.parse.urlunsplit(
-        ("https", normalized_host, parsed.path, "", "")
-    )
-
-
-def redacted_runtime_configuration_sha256(
-    config: Any, template: dict[str, Any], module_id: str
-) -> str:
-    expected_top_level = {"alias", "description", "vci", "client", "client2"}
-    expected_vci = {
-        "authorization_server",
-        "credential_configuration_id",
-        "credential_issuer_url",
-        "credential_proof_type_hint",
-        "static_tx_code",
-    }
-    if (
-        not isinstance(config, dict)
-        or set(config) != expected_top_level
-        or not isinstance(config.get("vci"), dict)
-        or set(config["vci"]) != expected_vci
-        or not isinstance(config.get("client"), dict)
-        or set(config["client"]) != {"client_id"}
-        or not isinstance(config.get("client2"), dict)
-        or set(config["client2"]) != {"client_id"}
-        or config.get("alias") != template.get("alias")
-        or config.get("description")
-        not in {
-            template.get("description"),
-            f"{template.get('description')} [{module_id}]",
-        }
-    ):
-        raise RunnerError("suite runtime configuration has an unsupported shape")
-    validate_https_url(config["vci"].get("credential_issuer_url"), "issuer URL")
-    validate_https_url(
-        config["vci"].get("authorization_server"), "authorization server"
-    )
-    string_fields = (
-        config["vci"].get("credential_configuration_id"),
-        config["vci"].get("credential_proof_type_hint"),
-        config["vci"].get("static_tx_code"),
-        config["client"].get("client_id"),
-        config["client2"].get("client_id"),
-    )
-    if any(
-        not isinstance(value, str) or not value or len(value) > 256
-        for value in string_fields
-    ):
-        raise RunnerError("suite runtime configuration contains an invalid value")
-    redacted = json.loads(json.dumps(config))
-    redacted["vci"]["static_tx_code"] = "<redacted>"
-    return canonical_sha256(redacted)
-
-
-def condition_summary(results: list[dict[str, Any]]) -> dict[str, Any]:
-    counts = Counter(
-        entry.get("result")
-        for entry in results
-        if entry.get("result") in CONDITION_RESULTS
-    )
-    return {
-        "counts": {
-            "info": counts["INFO"],
-            "success": counts["SUCCESS"],
-            "review": counts["REVIEW"],
-            "warning": counts["WARNING"],
-            "failure": counts["FAILURE"],
-        }
-    }
-
-
-def collect_sensitive_raw_values(value: Any) -> set[str]:
-    sensitive: set[str] = set()
-
-    def collect_scalars(item: Any) -> None:
-        if isinstance(item, str) and len(item) >= 8:
-            sensitive.add(item)
-        elif isinstance(item, dict):
-            for nested in item.values():
-                collect_scalars(nested)
-        elif isinstance(item, list):
-            for nested in item:
-                collect_scalars(nested)
-
-    def visit(item: Any) -> None:
-        if isinstance(item, dict):
-            for key, nested in item.items():
-                if key.lower() in SENSITIVE_RAW_KEYS:
-                    collect_scalars(nested)
-                else:
-                    visit(nested)
-        elif isinstance(item, list):
-            for nested in item:
-                visit(nested)
-
-    visit(value)
-    return sensitive
-
-
-def assert_public_summary_safe(
-    summary: dict[str, Any], sensitive_values: set[str]
-) -> bytes:
-    expected_top_level = {
-        "candidate",
-        "classification",
-        "configuration",
-        "contains_sensitive_material",
-        "deployment",
-        "raw_suite_export_included",
-        "review_required",
-        "run",
-        "scenario",
-        "schema_version",
-        "suite",
-        "unsupported_scenarios",
-    }
-    if set(summary) != expected_top_level:
-        raise RunnerError("evidence summary contains non-allowlisted fields")
-
-    def check_keys(value: Any) -> None:
-        if isinstance(value, dict):
-            for key, nested in value.items():
-                if key.lower() in FORBIDDEN_PUBLIC_KEYS:
-                    raise RunnerError(
-                        f"evidence summary contains forbidden field {key}"
-                    )
-                check_keys(nested)
-        elif isinstance(value, list):
-            for nested in value:
-                check_keys(nested)
-
-    check_keys(summary)
-    encoded = (
-        json.dumps(summary, ensure_ascii=False, indent=2, sort_keys=True) + "\n"
-    ).encode("utf-8")
-    text = encoded.decode("utf-8")
-    if any(secret in text for secret in sensitive_values):
-        raise RunnerError("evidence summary contains sensitive suite material")
-    if "openid-credential-offer://" in text or re.search(
-        r"(?<![A-Za-z0-9_-])[A-Za-z0-9_-]{16,}\."
-        r"[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])",
-        text,
-    ):
-        raise RunnerError("evidence summary contains credential or token material")
-    return encoded
-
-
-def candidate_evidence_summary(candidate: dict[str, Any]) -> dict[str, Any]:
-    keys = (
-        "release_id",
-        "version",
-        "source_repo",
-        "source_ref",
-        "source_tag",
-        "tag_target",
-        "manifest_sha256",
-        "image_lock_sha256",
-        "release_capsule_sha256",
-        "notary_image",
-    )
-    try:
-        selected = {key: candidate[key] for key in keys}
-    except KeyError:
-        raise RunnerError("authenticated candidate result is incomplete") from None
-    selected["release_assets_authenticity_verified"] = True
-    return selected
-
-
-def build_evidence_summary(
-    plan_map: dict[str, Any],
-    scenario: dict[str, Any],
-    exported: dict[str, Any],
-    candidate: dict[str, Any],
-    suite_jwks_sha256: str,
-) -> tuple[dict[str, Any], set[str]]:
-    modules = scenario.get("suite_modules")
-    if modules != ["oid4vci-1_0-issuer-metadata-test"]:
-        raise RunnerError("evidence scenario must select only the metadata module")
-    suite_ref = plan_map.get("suite", {}).get("ref")
-    if not isinstance(suite_ref, str) or COMMIT.fullmatch(suite_ref) is None:
-        raise RunnerError("evidence suite ref must be one pinned commit")
-    suite_release_tag = plan_map.get("suite", {}).get("release_tag")
-    suite_base_url = plan_map.get("suite", {}).get("base_url")
-    release_match = (
-        re.fullmatch(r"release-v([0-9]+\.[0-9]+\.[0-9]+)", suite_release_tag)
-        if isinstance(suite_release_tag, str)
-        else None
-    )
-    if release_match is None or not isinstance(suite_base_url, str):
-        raise RunnerError("evidence suite release identity is invalid")
-    suite_version = release_match.group(1)
-    if (
-        not isinstance(suite_jwks_sha256, str)
-        or SHA256.fullmatch(suite_jwks_sha256) is None
-    ):
-        raise RunnerError("suite JWKS digest is invalid")
-    test_info = exported.get("testInfo")
-    results = exported["results"]
-    if (
-        not isinstance(test_info, dict)
-        or test_info.get("testName") != modules[0]
-        or test_info.get("variant") != scenario.get("variants")
-        or test_info.get("status") != "FINISHED"
-        or test_info.get("result") not in SUITE_RESULTS
-        or test_info.get("version") != suite_version
-        or exported.get("exportedVersion") != suite_version
-        or exported.get("exportedFrom") != suite_base_url
-    ):
-        raise RunnerError(
-            "suite export identity, version, selection, or terminal status does not match"
-        )
-    started_at, started = validate_suite_timestamp(test_info.get("started"))
-    test_id = test_info["testId"]
-    if not isinstance(test_id, str) or TEST_ID.fullmatch(test_id) is None:
-        raise RunnerError("suite export run identifier is invalid")
-    validate_considered_log_bindings(results, modules[0], test_id)
-    completed_at = completion_timestamp(
-        results, modules[0], test_info["result"], started
-    )
-    template_path = CONFIG_DIR / scenario["config_template"]
-    try:
-        template = json.loads(template_path.read_text(encoding="utf-8"))
-    except (OSError, json.JSONDecodeError):
-        raise RunnerError(
-            "checked-in suite configuration template is invalid"
-        ) from None
-    runtime_config_sha256 = redacted_runtime_configuration_sha256(
-        test_info.get("config"), template, modules[0]
-    )
-    issuer_url = validate_https_url(
-        test_info["config"]["vci"]["credential_issuer_url"], "issuer URL"
-    )
-    unsupported = [
-        {
-            "scenario_id": item["id"],
-            "status": item["status"],
-        }
-        for item in plan_map["scenarios"]
-        if item.get("status") not in {"applicable", "candidate-only"}
-    ]
-    expected_unsupported = [
-        {"scenario_id": scenario_id, "status": status}
-        for scenario_id, status in EVIDENCE_UNSUPPORTED_SCENARIOS
-    ]
-    if unsupported != expected_unsupported:
-        raise RunnerError("plan map unsupported scenario contract changed")
-    summary = {
-        "schema_version": EVIDENCE_SCHEMA_VERSION,
-        "classification": EVIDENCE_CLASSIFICATION,
-        "review_required": True,
-        "contains_sensitive_material": False,
-        "raw_suite_export_included": False,
-        "candidate": candidate_evidence_summary(candidate),
-        "deployment": {
-            "issuer_url": issuer_url,
-            "candidate_association": EVIDENCE_ASSOCIATION,
-        },
-        "suite": {
-            "repository": plan_map["suite"]["repo"],
-            "commit": suite_ref,
-            "release_tag": suite_release_tag,
-            "reported_version": suite_version,
-            "exported_from": suite_base_url,
-            "commit_association": EVIDENCE_ASSOCIATION,
-            "jwks_sha256": suite_jwks_sha256,
-            "export_signature_verified": True,
-        },
-        "scenario": {
-            "scenario_id": scenario["id"],
-            "expected_plan": scenario["suite_plan"],
-            "plan_association": EVIDENCE_ASSOCIATION,
-            "modules": modules,
-            "variants": scenario["variants"],
-        },
-        "configuration": {
-            "plan_map_sha256": f"sha256:{file_sha256(PLAN_MAP_PATH)}",
-            "template_sha256": f"sha256:{file_sha256(template_path)}",
-            "redacted_runtime_configuration_sha256": runtime_config_sha256,
-            "redacted_fields": ["vci.static_tx_code"],
-        },
-        "run": {
-            "started_at": started_at,
-            "completed_at": completed_at,
-            "terminal_status": test_info["status"],
-            "result": test_info["result"],
-            "conditions": condition_summary(results),
-        },
-        "unsupported_scenarios": unsupported,
-    }
-    return summary, collect_sensitive_raw_values(exported)
-
-
-def expected_suite_artifact_stamp(checkout: Path, jar: Path) -> dict[str, str]:
-    return {
-        "source_ref": suite_checkout_ref(checkout),
-        "builder_override_sha256": file_sha256(BUILDER_COMPOSE_OVERRIDE_PATH),
-        "jar_sha256": file_sha256(jar),
-    }
-
-
-def ensure_suite_artifact(checkout: Path, args: argparse.Namespace) -> Path:
-    jar = checkout / SUITE_JAR
-    stamp = checkout / SUITE_JAR_STAMP
-    if jar.exists() and stamp.exists() and not args.rebuild_suite:
-        try:
-            stamped = json.loads(stamp.read_text(encoding="utf-8"))
-        except json.JSONDecodeError:
-            stamped = None
-        if stamped == expected_suite_artifact_stamp(checkout, jar):
-            return jar
-    if not shutil.which("docker"):
-        raise RunnerError("docker is required to build the OpenID conformance suite")
-    maven_cache = Path(args.maven_cache_dir).expanduser().resolve()
-    maven_cache.mkdir(parents=True, exist_ok=True)
-    env = os.environ.copy()
-    env["MAVEN_CACHE"] = str(maven_cache)
-    run_checked(
-        builder_command(checkout, "run", "--rm", "builder"),
-        cwd=checkout,
-        env=env,
-    )
-    if not jar.exists():
-        raise RunnerError(f"OpenID conformance suite build did not create {jar}")
-    stamp.write_text(
-        json.dumps(expected_suite_artifact_stamp(checkout, jar), sort_keys=True)
-        + "\n",
-        encoding="utf-8",
-    )
-    return jar
-
-
-def requirements_digest(*requirements_paths: Path) -> str:
-    digest = hashlib.sha256()
-    for path in requirements_paths:
-        digest.update(path.name.encode("utf-8"))
-        digest.update(b"\0")
-        digest.update(path.read_bytes())
-        digest.update(b"\0")
-    return digest.hexdigest()
-
-
-def suite_python(args: argparse.Namespace) -> Path:
-    digest = requirements_digest(
-        SUITE_REQUIREMENTS_INPUT_PATH, SUITE_REQUIREMENTS_LOCK_PATH
-    )
-    cache_key = f"py{sys.version_info.major}.{sys.version_info.minor}-{digest[:16]}"
-    venv_dir = Path(args.python_venv_dir).expanduser().resolve() / cache_key
-    if os.name == "nt":
-        return venv_dir / "Scripts" / "python.exe"
-    return venv_dir / "bin" / "python"
-
-
-def ensure_suite_python(checkout: Path, args: argparse.Namespace) -> Path:
-    requirements_path = checkout / "scripts" / "requirements.txt"
-    if not requirements_path.exists():
-        raise RunnerError(f"missing suite Python requirements: {requirements_path}")
-    if requirements_path.read_bytes() != SUITE_REQUIREMENTS_INPUT_PATH.read_bytes():
-        raise RunnerError(
-            "suite Python requirements differ from the checked-in locked input; "
-            "review and regenerate release/conformance/openid/python-requirements.txt"
-        )
-    python = suite_python(args)
-    venv_dir = python.parents[1]
-    digest = requirements_digest(
-        SUITE_REQUIREMENTS_INPUT_PATH, SUITE_REQUIREMENTS_LOCK_PATH
-    )
-    stamp = venv_dir / ".requirements.sha256"
-    cache_matches = (
-        python.exists()
-        and stamp.exists()
-        and stamp.read_text(encoding="utf-8").strip() == digest
-    )
-    if venv_dir.exists() and not cache_matches:
-        shutil.rmtree(venv_dir)
-    if not python.exists():
-        run_checked([sys.executable, "-m", "venv", str(venv_dir)])
-        run_checked(
-            [
-                str(python),
-                "-m",
-                "pip",
-                "install",
-                "--disable-pip-version-check",
-                "--require-hashes",
-                "--only-binary=:all:",
-                "-r",
-                str(SUITE_REQUIREMENTS_LOCK_PATH),
-            ]
-        )
-        stamp.write_text(digest + "\n", encoding="utf-8")
-    return python
-
-
-def wait_for_suite(base_url: str, timeout_seconds: int) -> None:
-    url = base_url.rstrip("/") + "/api/runner/available"
-    # The pinned suite's local development endpoint uses a self-signed certificate.
-    context = ssl._create_unverified_context()
-    deadline = time.time() + timeout_seconds
-    last_error = ""
-    while time.time() < deadline:
-        try:
-            with urllib.request.urlopen(url, timeout=5, context=context) as response:
-                if response.status == 200:
-                    return
-        except (urllib.error.URLError, TimeoutError) as exc:
-            last_error = str(exc)
-        time.sleep(2)
-    raise RunnerError(f"conformance suite did not become ready at {url}: {last_error}")
-
-
-def read_offer(path: Path, issuer_url: str) -> str:
-    nofollow = getattr(os, "O_NOFOLLOW", None)
-    cloexec = getattr(os, "O_CLOEXEC", None)
-    if nofollow is None or cloexec is None or not hasattr(os, "geteuid"):
-        raise RunnerError("secure offer input handling is unavailable")
-    descriptor: int | None = None
-    try:
-        descriptor = os.open(path, os.O_RDONLY | cloexec | nofollow)
-        info = os.fstat(descriptor)
-        if (
-            not stat.S_ISREG(info.st_mode)
-            or info.st_uid != os.geteuid()
-            or info.st_mode & 0o077
-        ):
-            raise RunnerError("offer input must be an owner-only regular file")
-        if not 0 < info.st_size <= 65_536:
-            raise RunnerError("offer input has an invalid size")
-        with os.fdopen(descriptor, "rb", closefd=True) as handle:
-            descriptor = None
-            raw = handle.read(65_537)
-    except OSError:
-        raise RunnerError("offer input could not be opened securely") from None
-    finally:
-        if descriptor is not None:
-            os.close(descriptor)
-    if len(raw) != info.st_size:
-        raise RunnerError("offer input changed while it was read")
-    try:
-        offer_uri = raw.decode("utf-8").strip()
-    except UnicodeDecodeError:
-        raise RunnerError("offer input is not valid UTF-8") from None
-    parsed = urllib.parse.urlsplit(offer_uri)
-    try:
-        query = urllib.parse.parse_qs(parsed.query, strict_parsing=True)
-    except ValueError:
-        raise RunnerError("offer input has a malformed query") from None
-    if (
-        parsed.scheme != "openid-credential-offer"
-        or parsed.netloc
-        or parsed.path
-        or parsed.fragment
-        or set(query) != {"credential_offer"}
-        or len(query["credential_offer"]) != 1
-    ):
-        raise RunnerError("offer input is not one inline credential offer URI")
-    inline = query["credential_offer"][0]
-    offer = json.loads(inline)
-    grant = "urn:ietf:params:oauth:grant-type:pre-authorized_code"
-    if (
-        not isinstance(offer, dict)
-        or offer.get("credential_issuer") != issuer_url.rstrip("/")
-        or not isinstance(offer.get("grants"), dict)
-        or set(offer["grants"]) != {grant}
-        or not isinstance(offer["grants"][grant], dict)
-        or not isinstance(offer["grants"][grant].get("pre-authorized_code"), str)
-    ):
-        raise RunnerError("offer is not the expected Notary pre-authorized offer")
-    return inline
-
-
-def read_suite_ca_certificate(path: Path) -> bytes:
-    path = path.expanduser()
-    nofollow = getattr(os, "O_NOFOLLOW", 0)
-    cloexec = getattr(os, "O_CLOEXEC", 0)
-    descriptor: int | None = None
-    before: os.stat_result | None = None
-    try:
-        if not nofollow:
-            before = path.lstat()
-            if stat.S_ISLNK(before.st_mode):
-                raise RunnerError(
-                    "suite CA certificate could not be opened securely"
-                )
-        descriptor = os.open(path, os.O_RDONLY | nofollow | cloexec)
-        info = os.fstat(descriptor)
-        if before is not None and (
-            before.st_dev != info.st_dev or before.st_ino != info.st_ino
-        ):
-            raise RunnerError("suite CA certificate changed while it was opened")
-        if (
-            not stat.S_ISREG(info.st_mode)
-            or not 0 < info.st_size <= 1024 * 1024
-        ):
-            raise RunnerError(
-                "suite CA certificate must be a bounded regular file"
-            )
-        with os.fdopen(descriptor, "rb", closefd=True) as handle:
-            descriptor = None
-            certificate = handle.read(1024 * 1024 + 1)
-    except OSError:
-        raise RunnerError(
-            "suite CA certificate could not be opened securely"
-        ) from None
-    finally:
-        if descriptor is not None:
-            os.close(descriptor)
-    if len(certificate) != info.st_size:
-        raise RunnerError("suite CA certificate changed while it was read")
-    return certificate
-
-
-def add_suite_ca(context: ssl.SSLContext, certificate: bytes) -> None:
-    try:
-        text = certificate.decode("ascii")
-    except UnicodeDecodeError:
-        cadata: str | bytes = certificate
-    else:
-        cadata = text if "-----BEGIN CERTIFICATE-----" in text else certificate
-    try:
-        context.load_verify_locations(cadata=cadata)
-    except (OSError, ValueError):
-        raise RunnerError("suite CA certificate could not be loaded") from None
-
-
-def suite_tls_context(ca_certificate: Path | None) -> ssl.SSLContext:
-    if ca_certificate is None:
-        return ssl.create_default_context()
-    context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
-    add_suite_ca(context, read_suite_ca_certificate(ca_certificate))
-    return context
-
-
-def suite_https_opener(context: ssl.SSLContext):
-    return urllib.request.build_opener(
-        urllib.request.ProxyHandler({}),
-        urllib.request.HTTPSHandler(context=context),
-        NoRedirect(),
-    )
-
-
-def suite_jwks_url(base_url: str) -> str:
-    parsed = urllib.parse.urlsplit(base_url)
-    if (
-        parsed.scheme != "https"
-        or not parsed.hostname
-        or parsed.username is not None
-        or parsed.password is not None
-        or parsed.path not in {"", "/"}
-        or parsed.query
-        or parsed.fragment
-    ):
-        raise RunnerError("conformance server must be one HTTPS origin")
-    return urllib.parse.urlunsplit(parsed._replace(path="/jwks"))
-
-
-def cmd_export_suite_jwks(args: argparse.Namespace) -> int:
-    url = suite_jwks_url(args.conformance_server)
-    context = suite_tls_context(args.suite_ca_certificate)
-    opener = suite_https_opener(context)
-    try:
-        with opener.open(url, timeout=args.timeout_seconds) as response:
-            if not 200 <= response.status < 300:
-                raise RunnerError(
-                    f"suite JWKS endpoint returned HTTP {response.status}"
-                )
-            content = response.read(MAX_SUITE_JWKS_BYTES + 1)
-    except urllib.error.HTTPError as exc:
-        raise RunnerError(f"suite JWKS endpoint returned HTTP {exc.code}") from None
-    except (OSError, urllib.error.URLError):
-        raise RunnerError("suite JWKS fetch failed") from None
-    if not 0 < len(content) <= MAX_SUITE_JWKS_BYTES:
-        raise RunnerError("suite JWKS response has an invalid size")
-    jwks = parse_suite_jwks(content)
-    encoded = (
-        json.dumps(jwks, ensure_ascii=False, indent=2, sort_keys=True) + "\n"
-    ).encode("utf-8")
-    output = write_new_file(args.output, encoded)
-    print(output)
-    return 0
-
-
-def cmd_submit_offer(args: argparse.Namespace) -> int:
-    inline = read_offer(args.offer_file, args.issuer_url)
-    base = urllib.parse.urlsplit(args.conformance_server)
-    endpoint = urllib.parse.urlsplit(args.suite_offer_endpoint)
-    if (
-        (endpoint.scheme, endpoint.netloc) != (base.scheme, base.netloc)
-        or endpoint.scheme != "https"
-        or not endpoint.path.endswith("/credential_offer")
-        or endpoint.query
-        or endpoint.fragment
-    ):
-        raise RunnerError(
-            "suite offer endpoint must use HTTPS on the pinned suite origin"
-        )
-    url = urllib.parse.urlunsplit(
-        endpoint._replace(query=urllib.parse.urlencode({"credential_offer": inline}))
-    )
-    context = suite_tls_context(args.suite_ca_certificate)
-    opener = suite_https_opener(context)
-    try:
-        with opener.open(url, timeout=args.timeout_seconds) as response:
-            if not 200 <= response.status < 300:
-                raise RunnerError(f"suite offer endpoint returned HTTP {response.status}")
-    except urllib.error.HTTPError as exc:
-        raise RunnerError(f"suite offer endpoint returned HTTP {exc.code}") from None
-    except (OSError, urllib.error.URLError):
-        raise RunnerError("suite offer submission failed") from None
-    print("credential offer submitted")
-    return 0
-
-
-def write_new_file(path: Path, content: bytes) -> Path:
-    path = path.expanduser()
-    path.parent.mkdir(parents=True, exist_ok=True)
-    flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL
-    flags |= getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_CLOEXEC", 0)
-    descriptor: int | None = None
-    try:
-        descriptor = os.open(path, flags, 0o600)
-        with os.fdopen(descriptor, "wb", closefd=True) as handle:
-            descriptor = None
-            handle.write(content)
-    except OSError:
-        raise RunnerError("output could not be created") from None
-    finally:
-        if descriptor is not None:
-            os.close(descriptor)
-    return path
-
-
-def cmd_export_suite_ca(args: argparse.Namespace) -> int:
-    checkout = suite_dir(args)
-    if not checkout.is_dir():
-        raise RunnerError("suite checkout is unavailable; run prepare first")
-    output = Path(args.output).expanduser()
-    output.parent.mkdir(parents=True, exist_ok=True)
-    env = os.environ.copy()
-    env[COMPOSE_CONFIG_DIR_ENV] = str(CONFIG_DIR)
-    with tempfile.TemporaryDirectory(
-        prefix=".openid-suite-ca-", dir=output.parent
-    ) as tmp:
-        copied = Path(tmp) / "nginx-selfsigned.crt"
-        run_checked(
-            compose_command(
-                checkout,
-                args,
-                "cp",
-                f"nginx:{SUITE_CA_CONTAINER_PATH}",
-                str(copied),
-            ),
-            env=env,
-        )
-        certificate = read_suite_ca_certificate(copied)
-        validation_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
-        add_suite_ca(validation_context, certificate)
-        write_new_file(output, certificate)
-    print(output)
-    return 0
-
-
-def output_dir_for(args: argparse.Namespace, scenario_id: str) -> Path:
-    if args.output_dir:
-        return Path(args.output_dir).expanduser().resolve()
-    stamp = dt.datetime.now(dt.UTC).strftime("%Y%m%dT%H%M%SZ")
-    return DEFAULT_OUTPUT_ROOT / f"{scenario_id}-{stamp}"
-
-
-def build_run(
-    plan_map: dict[str, Any],
-    scenario: dict[str, Any],
-    args: argparse.Namespace,
-    python_executable: str | None = None,
-) -> tuple[Path, dict[str, str], list[str]]:
-    settings = suite_settings(plan_map, args)
-    checkout = suite_dir(args)
-    output_dir = output_dir_for(args, scenario["id"])
-    params = default_params(scenario, args)
-    config_path = write_rendered_config(scenario, output_dir, params)
-    env = os.environ.copy()
-    env["CONFORMANCE_SERVER"] = settings["base_url"]
-    env["CONFORMANCE_SERVER_LOCAL"] = settings["local_base_url"]
-    env["CONFORMANCE_SERVER_MTLS"] = settings["mtls_base_url"]
-    if not env.get("CONFORMANCE_TOKEN"):
-        env["CONFORMANCE_DEV_MODE"] = "1"
-    command = [
-        python_executable or sys.executable,
-        str(checkout / "scripts" / "run-test-plan.py"),
-        "--export-dir",
-        str(output_dir),
-        scenario_plan_arg(scenario),
-        str(config_path),
-    ]
-    return output_dir, env, command
-
-
-def cmd_list(args: argparse.Namespace) -> int:
-    plan_map = load_plan_map(args.plan_map)
-    for scenario in plan_map["scenarios"]:
-        print(f"{scenario['id']}\t{scenario['status']}\t{scenario_plan_arg(scenario)}")
-    return 0
-
-
-def cmd_prepare(args: argparse.Namespace) -> int:
-    plan_map = load_plan_map(args.plan_map)
-    checkout = ensure_suite_checkout(plan_map, args)
-    ensure_suite_artifact(checkout, args)
-    ensure_suite_python(checkout, args)
-    print(checkout)
-    return 0
-
-
-def cmd_up(args: argparse.Namespace) -> int:
-    plan_map = load_plan_map(args.plan_map)
-    checkout = ensure_suite_checkout(plan_map, args)
-    ensure_suite_artifact(checkout, args)
-    env = os.environ.copy()
-    env[COMPOSE_CONFIG_DIR_ENV] = str(CONFIG_DIR)
-    run_checked(compose_command(checkout, args, "up", "-d", "--build"), env=env)
-    settings = suite_settings(plan_map, args)
-    wait_for_suite(settings["base_url"], args.wait_seconds)
-    print(settings["base_url"])
-    return 0
-
-
-def cmd_down(args: argparse.Namespace) -> int:
-    checkout = suite_dir(args)
-    env = os.environ.copy()
-    env[COMPOSE_CONFIG_DIR_ENV] = str(CONFIG_DIR)
-    run_checked(compose_command(checkout, args, "down"), env=env)
-    return 0
-
-
-def cmd_render_config(args: argparse.Namespace) -> int:
-    plan_map = load_plan_map(args.plan_map)
-    scenario = find_scenario(plan_map, args.scenario)
-    output_dir = output_dir_for(args, scenario["id"])
-    config_path = write_rendered_config(
-        scenario, output_dir, default_params(scenario, args)
-    )
-    print(config_path)
-    return 0
-
-
-def cmd_run(args: argparse.Namespace) -> int:
-    plan_map = load_plan_map(args.plan_map)
-    scenario = find_scenario(plan_map, args.scenario)
-    if scenario.get("status") not in {"applicable", "candidate-only"} and not args.allow_blocked:
-        raise RunnerError(
-            f"scenario {scenario['id']} is {scenario.get('status')}; "
-            "pass --allow-blocked to run it anyway"
-        )
-    if not args.no_prepare:
-        ensure_suite_checkout(plan_map, args)
-    checkout = suite_dir(args)
-    python = suite_python(args) if args.dry_run else ensure_suite_python(checkout, args)
-    output_dir, env, command = build_run(plan_map, scenario, args, str(python))
-    if args.dry_run:
-        print(json.dumps({"output_dir": str(output_dir), "command": command}, indent=2))
-        return 0
-    wait_for_suite(env["CONFORMANCE_SERVER"], args.wait_seconds)
-    result = subprocess.run(command, cwd=checkout, env=env, text=True, check=False)
-    if result.returncode != 0:
-        raise RunnerError(
-            f"OpenID conformance run failed with status {result.returncode}; "
-            f"output: {output_dir}"
-        )
-    print(output_dir)
-    return 0
-
-
-def cmd_promote_evidence(args: argparse.Namespace) -> int:
-    plan_map = load_plan_map()
-    scenario = find_scenario(plan_map, EVIDENCE_SCENARIO_ID)
-    modules = scenario.get("suite_modules")
-    if not isinstance(modules, list) or len(modules) != 1:
-        raise RunnerError("evidence scenario must select exactly one suite module")
-    suite_jwks, suite_jwks_sha256 = load_suite_jwks(args.suite_jwks)
-    exported = load_suite_export(args.suite_export, modules[0], suite_jwks)
-    candidate = load_authenticated_candidate(args.release_manifest, args.image_lock)
-    try:
-        summary, sensitive_values = build_evidence_summary(
-            plan_map,
-            scenario,
-            exported,
-            candidate,
-            suite_jwks_sha256,
-        )
-        encoded = assert_public_summary_safe(summary, sensitive_values)
-    except RecursionError:
-        raise RunnerError("suite export is too deeply nested") from None
-    try:
-        schema = json.loads(EVIDENCE_SCHEMA_PATH.read_text(encoding="utf-8"))
-    except (OSError, json.JSONDecodeError):
-        raise RunnerError("checked-in evidence schema is invalid") from None
-    if (
-        schema.get("properties", {}).get("schema_version", {}).get("const")
-        != EVIDENCE_SCHEMA_VERSION
-    ):
-        raise RunnerError("checked-in evidence schema version is invalid")
-    try:
-        validate_against_schema(summary, schema, schema, "evidence summary")
-    except SchemaValidationError as exc:
-        raise RunnerError(f"evidence summary does not match its schema: {exc}") from None
-    output = write_new_file(args.output, encoded)
-    print(output)
-    return 0
-
-
-def load_authenticated_candidate(
-    release_manifest: Path, image_lock: Path
-) -> dict[str, Any]:
-    try:
-        from conformance_candidate import CandidateError, load_candidate
-    except ModuleNotFoundError as exc:
-        dependency = exc.name or "the candidate validation dependency"
-        raise RunnerError(
-            f"promote-evidence requires {dependency}; install the release tooling dependencies"
-        ) from None
-    try:
-        return load_candidate(release_manifest, image_lock)
-    except CandidateError as exc:
-        raise RunnerError(str(exc)) from None
-
-
-def add_common(parser: argparse.ArgumentParser) -> None:
-    parser.add_argument("--plan-map", type=Path, default=PLAN_MAP_PATH)
-    parser.add_argument("--cache-dir", default=str(DEFAULT_CACHE_DIR))
-    parser.add_argument("--suite-dir")
-    parser.add_argument("--suite-repo")
-    parser.add_argument("--suite-ref")
-    parser.add_argument("--conformance-server")
-    parser.add_argument("--conformance-server-local")
-    parser.add_argument("--conformance-server-mtls")
-    parser.add_argument("--maven-cache-dir", default=str(DEFAULT_CACHE_DIR / "maven"))
-    parser.add_argument("--python-venv-dir", default=str(DEFAULT_CACHE_DIR / "python"))
-    parser.add_argument("--rebuild-suite", action="store_true")
-
-
-def add_config_args(parser: argparse.ArgumentParser) -> None:
-    parser.add_argument("scenario")
-    parser.add_argument("--issuer-url")
-    parser.add_argument("--authorization-server")
-    parser.add_argument("--credential-configuration-id")
-    parser.add_argument("--static-tx-code", default="0000")
-    parser.add_argument("--client-id", default="registry-stack-openid-conformance-client")
-    parser.add_argument(
-        "--client2-id", default="registry-stack-openid-conformance-client-2"
-    )
-    parser.add_argument("--output-dir")
-
-
-def parse_args(argv: list[str]) -> argparse.Namespace:
-    parser = argparse.ArgumentParser(description=__doc__)
-    subparsers = parser.add_subparsers(dest="command", required=True)
-
-    list_parser = subparsers.add_parser("list")
-    add_common(list_parser)
-    list_parser.set_defaults(func=cmd_list)
-
-    prepare_parser = subparsers.add_parser("prepare")
-    add_common(prepare_parser)
-    prepare_parser.set_defaults(func=cmd_prepare)
-
-    up_parser = subparsers.add_parser("up")
-    add_common(up_parser)
-    up_parser.add_argument("--wait-seconds", type=int, default=180)
-    up_parser.set_defaults(func=cmd_up)
-
-    down_parser = subparsers.add_parser("down")
-    add_common(down_parser)
-    down_parser.set_defaults(func=cmd_down)
-
-    export_ca_parser = subparsers.add_parser("export-suite-ca")
-    export_ca_parser.add_argument("--cache-dir", default=str(DEFAULT_CACHE_DIR))
-    export_ca_parser.add_argument("--suite-dir")
-    export_ca_parser.add_argument(
-        "--output",
-        type=Path,
-        default=DEFAULT_SUITE_CA_PATH,
-        help="new file that receives the running suite's generated certificate",
-    )
-    export_ca_parser.set_defaults(func=cmd_export_suite_ca)
-
-    export_jwks_parser = subparsers.add_parser(
-        "export-suite-jwks",
-        help="capture the suite export-signing keys over authenticated HTTPS",
-    )
-    export_jwks_parser.add_argument(
-        "--conformance-server",
-        default=load_plan_map()["suite"]["base_url"],
-    )
-    export_jwks_parser.add_argument(
-        "--suite-ca-certificate",
-        type=Path,
-        help="PEM or DER trust anchor captured from the local suite",
-    )
-    export_jwks_parser.add_argument(
-        "--output",
-        type=Path,
-        default=DEFAULT_SUITE_JWKS_PATH,
-        help="new owner-only file that receives the validated suite JWKS",
-    )
-    export_jwks_parser.add_argument("--timeout-seconds", type=int, default=10)
-    export_jwks_parser.set_defaults(func=cmd_export_suite_jwks)
-
-    render_parser = subparsers.add_parser("render-config")
-    add_common(render_parser)
-    add_config_args(render_parser)
-    render_parser.set_defaults(func=cmd_render_config)
-
-    run_parser = subparsers.add_parser("run")
-    add_common(run_parser)
-    add_config_args(run_parser)
-    run_parser.add_argument("--allow-blocked", action="store_true")
-    run_parser.add_argument("--dry-run", action="store_true")
-    run_parser.add_argument("--no-prepare", action="store_true")
-    run_parser.add_argument("--wait-seconds", type=int, default=180)
-    run_parser.set_defaults(func=cmd_run)
-
-    offer_parser = subparsers.add_parser("submit-offer")
-    offer_parser.add_argument("--offer-file", type=Path, required=True)
-    offer_parser.add_argument("--issuer-url", required=True)
-    offer_parser.add_argument("--suite-offer-endpoint", required=True)
-    offer_parser.add_argument(
-        "--conformance-server",
-        default=load_plan_map()["suite"]["base_url"],
-    )
-    offer_parser.add_argument(
-        "--suite-ca-certificate",
-        type=Path,
-        help="PEM or DER trust anchor captured from the local suite",
-    )
-    offer_parser.add_argument("--timeout-seconds", type=int, default=10)
-    offer_parser.set_defaults(func=cmd_submit_offer)
-
-    promote_parser = subparsers.add_parser(
-        "promote-evidence",
-        help="create a closed candidate-referenced summary from one private suite export",
-    )
-    promote_parser.add_argument(
-        "--suite-export",
-        type=Path,
-        required=True,
-        help="owner-only OIDF plan export ZIP kept outside the repository",
-    )
-    promote_parser.add_argument(
-        "--suite-jwks",
-        type=Path,
-        required=True,
-        help="owner-only JWKS captured from the authenticated suite origin",
-    )
-    promote_parser.add_argument(
-        "--release-manifest",
-        type=Path,
-        required=True,
-        help="checked-in release manifest for the published candidate",
-    )
-    promote_parser.add_argument(
-        "--image-lock",
-        type=Path,
-        required=True,
-        help="downloaded signed registryctl release image lock",
-    )
-    promote_parser.add_argument(
-        "--output",
-        type=Path,
-        required=True,
-        help="new JSON file for the allowlisted review summary",
-    )
-    promote_parser.set_defaults(func=cmd_promote_evidence)
-
-    return parser.parse_args(argv)
-
-
-def main(argv: list[str] | None = None) -> int:
-    args = parse_args(argv or sys.argv[1:])
-    try:
-        return int(args.func(args))
-    except (
-        OSError,
-        json.JSONDecodeError,
-        KeyError,
-        RunnerError,
-    ) as exc:
-        print(f"openid-conformance-runner: {exc}", file=sys.stderr)
-        return 2
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
diff --git a/release/scripts/registry-release b/release/scripts/registry-release
index 6abde7785..b0699664c 100755
--- a/release/scripts/registry-release
+++ b/release/scripts/registry-release
@@ -22,6 +22,7 @@ from registryctl_image_lock import (
     PLATFORM as RELEASE_IMAGE_LOCK_PLATFORM,
     PRODUCT_IMAGE_REPOSITORIES,
     SCHEMA_V2 as RELEASE_IMAGE_LOCK_SCHEMA_V2,
+    SCHEMA_V3 as RELEASE_IMAGE_LOCK_SCHEMA_V3,
     read_reviewed_postgresql_image_ref,
     schema_for_release_version,
     validate_images,
@@ -38,6 +39,7 @@ SEMVER_TAG = re.compile(r"^v[0-9]+\.[0-9]+\.[0-9]+$")
 IMAGE_DIGEST_REF = re.compile(r"^([^@]+)@(sha256:[0-9a-f]{64})$")
 RELEASE_IMAGE_LOCK_MINIMUM_VERSION = (0, 9, 0)
 EXACT_ARTIFACT_INVENTORY_MINIMUM_VERSION = (0, 10, 0)
+NOTARY_RETIREMENT_MINIMUM_VERSION = (0, 17, 0)
 REGISTRYCTL_INSTALLER_MINIMUM_VERSION = (0, 14, 0)
 EXACT_ARTIFACT_INVENTORY = {
     "registry-notary",
@@ -49,8 +51,19 @@ EXACT_ARTIFACT_INVENTORY = {
     "registryctl-image-lock",
     "registry-docs",
 }
+POST_NOTARY_ARTIFACT_INVENTORY = EXACT_ARTIFACT_INVENTORY - {
+    "registry-notary",
+    "registry-notary-cel-worker",
+}
 OPTIONAL_EXACT_ARTIFACTS = {
     "registryctl-installer",
+    # The Evidence toolset joins the release channel as optional artifacts
+    # until the first release ships it end to end; then these move into the
+    # exact inventory at a minimum version, like registryctl-installer did.
+    "evidence",
+    "evidencectl",
+    "mint",
+    "evidencectl-installer",
 }
 RELEASE_PLAN_SCHEMA = "registry-release.plan.v1"
 CURRENT_DOCS_VERSION = "main source (unreleased)"
@@ -128,9 +141,14 @@ def artifact_inventory_errors(version: str, artifacts: dict[Any, Any]) -> list[s
         and parsed_version >= EXACT_ARTIFACT_INVENTORY_MINIMUM_VERSION
     ):
         artifact_names = set(artifacts)
-        missing = sorted(EXACT_ARTIFACT_INVENTORY - artifact_names)
+        expected_inventory = (
+            POST_NOTARY_ARTIFACT_INVENTORY
+            if parsed_version >= NOTARY_RETIREMENT_MINIMUM_VERSION
+            else EXACT_ARTIFACT_INVENTORY
+        )
+        missing = sorted(expected_inventory - artifact_names)
         unexpected = sorted(
-            artifact_names - EXACT_ARTIFACT_INVENTORY - OPTIONAL_EXACT_ARTIFACTS
+            artifact_names - expected_inventory - OPTIONAL_EXACT_ARTIFACTS
         )
         if missing or unexpected:
             details = []
@@ -213,7 +231,7 @@ def read_release_image_digest(path: Path, image_name: str) -> str:
 def render_registryctl_image_lock(
     manifest_path: Path,
     relay_digest_path: Path,
-    notary_digest_path: Path,
+    notary_digest_path: Path | None,
     postgresql_ref_path: Path | None,
     tag_target: str,
     source_sha: str | None,
@@ -266,16 +284,29 @@ def render_registryctl_image_lock(
             raise ValueError(f"image lock output must be a regular file path: {output}")
 
         relay_digest = read_release_image_digest(relay_digest_path, "registry-relay")
-        notary_digest = read_release_image_digest(notary_digest_path, "registry-notary")
         schema_version = schema_for_release_version(version)
-        images = {
-            "registry-relay": relay_digest,
-            "registry-notary": notary_digest,
-        }
-        if schema_version == RELEASE_IMAGE_LOCK_SCHEMA_V2:
+        images = {"registry-relay": relay_digest}
+        if schema_version != RELEASE_IMAGE_LOCK_SCHEMA_V3:
+            if notary_digest_path is None:
+                raise ValueError(
+                    "historical registryctl release image locks require --notary-digest"
+                )
+            images["registry-notary"] = read_release_image_digest(
+                notary_digest_path,
+                "registry-notary",
+            )
+        elif notary_digest_path is not None:
+            raise ValueError(
+                "registryctl release image lock v3 does not accept --notary-digest"
+            )
+        if schema_version in {
+            RELEASE_IMAGE_LOCK_SCHEMA_V2,
+            RELEASE_IMAGE_LOCK_SCHEMA_V3,
+        }:
             if postgresql_ref_path is None:
                 raise ValueError(
-                    "registryctl release image lock v2 requires --postgresql-ref-file"
+                    "registryctl release image lock v2 or later requires "
+                    "--postgresql-ref-file"
                 )
             images["postgresql"] = read_reviewed_postgresql_image_ref(
                 postgresql_ref_path
@@ -411,17 +442,22 @@ def stage_capsule_backfill_assets(asset_dir: Path, tag: str, binary_dir: Path, i
         f"registryctl-{tag}-linux-amd64",
         f"registry-manifest-{tag}-linux-amd64",
         f"registry-relay-{tag}-linux-amd64",
-        f"registry-notary-{tag}-linux-amd64",
         "SHA256SUMS",
     ]
+    if parsed_version < NOTARY_RETIREMENT_MINIMUM_VERSION:
+        binary_names.append(f"registry-notary-{tag}-linux-amd64")
     optional_binary_names = [
         f"registryctl-{tag}-macos-arm64",
         f"registryctl-{tag}-linux-arm64",
     ]
-    worker_binary_names = [
-        f"registry-relay-rhai-worker-{tag}-linux-amd64",
-        f"registry-notary-cel-worker-{tag}-linux-amd64",
-    ]
+    for evidence_binary in ("evidence", "evidencectl", "mint"):
+        for platform_label in ("linux-amd64", "linux-arm64", "macos-arm64"):
+            optional_binary_names.append(f"{evidence_binary}-{tag}-{platform_label}")
+    worker_binary_names = [f"registry-relay-rhai-worker-{tag}-linux-amd64"]
+    if parsed_version < NOTARY_RETIREMENT_MINIMUM_VERSION:
+        worker_binary_names.append(
+            f"registry-notary-cel-worker-{tag}-linux-amd64"
+        )
     if parsed_version >= EXACT_ARTIFACT_INVENTORY_MINIMUM_VERSION:
         binary_names.extend(worker_binary_names)
     else:
@@ -436,10 +472,9 @@ def stage_capsule_backfill_assets(asset_dir: Path, tag: str, binary_dir: Path, i
         required_release_file_names.append(image_lock_name)
     else:
         optional_release_file_names.append(image_lock_name)
-    image_names = [
-        "registry-notary",
-        "registry-relay",
-    ]
+    image_names = ["registry-relay"]
+    if parsed_version < NOTARY_RETIREMENT_MINIMUM_VERSION:
+        image_names.append("registry-notary")
 
     staged_optional: list[str] = []
     staged_release_files: list[str] = []
@@ -1103,6 +1138,7 @@ def render_capsule(
         expected_image_lock_name = f"registryctl-v{version}-image-lock.json"
         expected_docs_archive_name = f"registry-docs-v{version}.tar.gz"
         expected_installer_name = f"registryctl-v{version}-install.sh"
+        expected_evidencectl_installer_name = f"evidencectl-v{version}-install.sh"
         for path in sorted(binary_dir.iterdir()) if binary_dir.exists() else []:
             if not path.is_file() or path.name == "SHA256SUMS":
                 continue
@@ -1118,6 +1154,10 @@ def render_capsule(
                 raise ValueError(
                     f"unexpected registryctl installer filename {path.name}; expected {expected_installer_name}"
                 )
+            if path.name.startswith("evidencectl-v") and path.name.endswith("-install.sh") and path.name != expected_evidencectl_installer_name:
+                raise ValueError(
+                    f"unexpected evidencectl installer filename {path.name}; expected {expected_evidencectl_installer_name}"
+                )
             file_sha256 = verified_binary_sha256(path, checksums)
             sbom = binary_sbom_dir / f"{path.name}.spdx.json"
             if not sbom.is_file():
@@ -1145,6 +1185,9 @@ def render_capsule(
             elif path.name == expected_installer_name:
                 file_evidence["kind"] = "registryctl-installer"
                 release_files.append(file_evidence)
+            elif path.name == expected_evidencectl_installer_name:
+                file_evidence["kind"] = "evidencectl-installer"
+                release_files.append(file_evidence)
             else:
                 binaries.append(file_evidence)
 
@@ -3342,7 +3385,7 @@ def main() -> int:
     image_lock_parser = subparsers.add_parser("render-registryctl-image-lock")
     image_lock_parser.add_argument("manifest", type=Path)
     image_lock_parser.add_argument("--relay-digest", type=Path, required=True)
-    image_lock_parser.add_argument("--notary-digest", type=Path, required=True)
+    image_lock_parser.add_argument("--notary-digest", type=Path)
     image_lock_parser.add_argument("--postgresql-ref-file", type=Path)
     image_lock_parser.add_argument("--tag-target", required=True)
     image_lock_parser.add_argument("--source-sha")
diff --git a/release/scripts/registry_release_lock.py b/release/scripts/registry_release_lock.py
index 33381ca4a..b1be6ce33 100644
--- a/release/scripts/registry_release_lock.py
+++ b/release/scripts/registry_release_lock.py
@@ -15,7 +15,9 @@
 
 ROOT = Path(__file__).resolve().parents[2]
 SCHEMA_ID = "io.registrystack.registry_release_lock"
-SCHEMA_VERSION = "1.0"
+# Version 2.0: the Registry Notary retirement removed the Notary image,
+# runtime recipe, and config-schema members from the signed payload.
+SCHEMA_VERSION = "2.0"
 REPOSITORY = "registrystack/registry-stack"
 WORKFLOW = ".github/workflows/release.yml"
 HEX40 = re.compile(r"^[0-9a-f]{40}$")
@@ -176,12 +178,13 @@ def secret_projection(
     }
 
 
-def product_recipe(product: str, lane: str | None = None) -> dict[str, Any]:
-    assert lane is not None
-    health_port = 8080 if product == "registry-relay" else 8081
-    prefix = ["product-action"]
-    if product == "registry-relay":
-        prefix.append(lane)
+def product_recipe(product: str, lane: str) -> dict[str, Any]:
+    if product != "registry-relay" or lane not in {
+        "relay-public",
+        "relay-consultation",
+    }:
+        raise ValueError("release lock product runtime is unsupported")
+    prefix = ["product-action", lane]
     common_mounts = [
         runtime_mount("bundle", "/run/registry/bundle", True),
         runtime_mount("anchor", "/run/registry/anchor", True),
@@ -207,17 +210,8 @@ def product_recipe(product: str, lane: str | None = None) -> dict[str, Any]:
         serve_secrets = [database_ca]
     else:
         preparation_secrets = [database_ca]
-        initialization_secrets = []
-        serve_secrets = [
-            database_ca,
-            secret_projection(
-                "notary-relay-workload-credential",
-                "/run/secrets/relay-workload-token",
-            ),
-            secret_projection(
-                "notary-signing-key", "/run/secrets/notary-signing-key.jwk"
-            ),
-        ]
+        initialization_secrets = [database_ca]
+        serve_secrets = [database_ca]
     def action(
         name: str,
         mounts: list[dict[str, Any]],
@@ -227,7 +221,7 @@ def action(
         environment: bool = True,
     ) -> dict[str, Any]:
         command_prefix = ["development-action"] if development else prefix
-        if development and product == "registry-relay":
+        if development:
             command_prefix.append(lane)
         return {
             "command": [*command_prefix, name],
@@ -292,7 +286,7 @@ def action(
             f"/usr/local/bin/{product}",
             "healthcheck",
             "--url",
-            f"http://127.0.0.1:{health_port}/ready",
+            "http://127.0.0.1:8080/ready",
         ],
     }
 
@@ -302,10 +296,6 @@ def action(
     "REGISTRY_RELAY_RUNTIME_PASSWORD",
     "REGISTRY_RELAY_MAINTENANCE_PASSWORD",
     "REGISTRY_RELAY_READER_PASSWORD",
-    "REGISTRY_NOTARY_MIGRATOR_PASSWORD",
-    "REGISTRY_NOTARY_RUNTIME_PASSWORD",
-    "REGISTRY_NOTARY_MAINTENANCE_PASSWORD",
-    "REGISTRY_NOTARY_READER_PASSWORD",
 ]
 
 
@@ -322,10 +312,6 @@ def action(
 \getenv relay_runtime_password REGISTRY_RELAY_RUNTIME_PASSWORD
 \getenv relay_maintenance_password REGISTRY_RELAY_MAINTENANCE_PASSWORD
 \getenv relay_reader_password REGISTRY_RELAY_READER_PASSWORD
-\getenv notary_migrator_password REGISTRY_NOTARY_MIGRATOR_PASSWORD
-\getenv notary_runtime_password REGISTRY_NOTARY_RUNTIME_PASSWORD
-\getenv notary_maintenance_password REGISTRY_NOTARY_MAINTENANCE_PASSWORD
-\getenv notary_reader_password REGISTRY_NOTARY_READER_PASSWORD
 SELECT 'CREATE ROLE registry_relay_owner NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS'
 WHERE NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'registry_relay_owner') \gexec
 SELECT format('CREATE ROLE registry_relay_migrator LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS PASSWORD %L', :'relay_migrator_password')
@@ -347,31 +333,8 @@ def action(
 ALTER DATABASE registry_relay OWNER TO registry_relay_owner;
 REVOKE ALL ON DATABASE registry_relay FROM PUBLIC;
 GRANT CONNECT ON DATABASE registry_relay TO registry_relay_migrator, registry_relay_runtime, registry_relay_maintenance, registry_relay_reader;
-SELECT 'CREATE ROLE registry_notary_owner NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS'
-WHERE NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'registry_notary_owner') \gexec
-SELECT format('CREATE ROLE registry_notary_migrator LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS PASSWORD %L', :'notary_migrator_password')
-WHERE NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'registry_notary_migrator') \gexec
-SELECT format('CREATE ROLE registry_notary_runtime LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS PASSWORD %L', :'notary_runtime_password')
-WHERE NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'registry_notary_runtime') \gexec
-SELECT format('CREATE ROLE registry_notary_maintenance LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS PASSWORD %L', :'notary_maintenance_password')
-WHERE NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'registry_notary_maintenance') \gexec
-SELECT format('CREATE ROLE registry_notary_reader LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS PASSWORD %L', :'notary_reader_password')
-WHERE NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'registry_notary_reader') \gexec
-ALTER ROLE registry_notary_owner NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS;
-ALTER ROLE registry_notary_migrator LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS PASSWORD :'notary_migrator_password';
-ALTER ROLE registry_notary_runtime LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS PASSWORD :'notary_runtime_password';
-ALTER ROLE registry_notary_maintenance LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS PASSWORD :'notary_maintenance_password';
-ALTER ROLE registry_notary_reader LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS PASSWORD :'notary_reader_password';
-GRANT registry_notary_owner TO registry_notary_migrator WITH INHERIT FALSE, SET TRUE;
-SELECT 'CREATE DATABASE registry_notary OWNER registry_notary_owner'
-WHERE NOT EXISTS (SELECT 1 FROM pg_catalog.pg_database WHERE datname = 'registry_notary') \gexec
-ALTER DATABASE registry_notary OWNER TO registry_notary_owner;
-REVOKE ALL ON DATABASE registry_notary FROM PUBLIC;
-GRANT CONNECT ON DATABASE registry_notary TO registry_notary_migrator, registry_notary_runtime, registry_notary_maintenance, registry_notary_reader;
 \connect registry_relay
 REVOKE ALL ON SCHEMA public FROM PUBLIC;
-\connect registry_notary
-REVOKE ALL ON SCHEMA public FROM PUBLIC;
 SQL"""
 
 
@@ -468,7 +431,7 @@ def postgresql_recipe() -> dict[str, Any]:
 def operator_files() -> list[dict[str, Any]]:
     files: list[dict[str, Any]] = []
     product_owners = ["root:root", "65532:65532"]
-    for lane in ["relay-public", "relay-consultation", "notary"]:
+    for lane in ["relay-public", "relay-consultation"]:
         files.append(
             {
                 "id": f"{lane}-environment",
@@ -479,8 +442,6 @@ def operator_files() -> list[dict[str, Any]]:
             }
         )
     for file_id, file_format, owners in [
-        ("notary-signing-key", "json_web_key", product_owners),
-        ("notary-relay-workload-credential", "compact_jwt", product_owners),
         (
             "postgresql-tls-certificate",
             "pem_certificate",
@@ -542,13 +503,11 @@ def create_payload(args: argparse.Namespace) -> int:
     images = image_lock.get("images")
     if not isinstance(images, dict) or set(images) != {
         "registry-relay",
-        "registry-notary",
         "postgresql",
     }:
         raise ValueError("legacy image lock image roster is not closed")
 
     relay, relay_index_digest = image(images["registry-relay"], "Relay")
-    notary, notary_index_digest = image(images["registry-notary"], "Notary")
     postgresql, postgresql_index_digest = image(
         images["postgresql"], "PostgreSQL"
     )
@@ -557,11 +516,6 @@ def create_payload(args: argparse.Namespace) -> int:
         "Relay",
         relay_index_digest,
     )
-    notary_manifest_digest = read_platform_manifest_from_index(
-        args.notary_image_index,
-        "Notary",
-        notary_index_digest,
-    )
     postgresql_manifest_digest = read_platform_manifest_from_index(
         args.postgresql_image_index,
         "PostgreSQL",
@@ -608,7 +562,6 @@ def locked_image(identity: str, manifest_digest: str) -> dict[str, Any]:
         "registryctl_artifacts": registryctl_artifacts,
         "images": {
             "relay": locked_image(relay, relay_manifest_digest),
-            "notary": locked_image(notary, notary_manifest_digest),
             "postgresql_state_plane": locked_image(
                 postgresql, postgresql_manifest_digest
             ),
@@ -618,7 +571,6 @@ def locked_image(identity: str, manifest_digest: str) -> dict[str, Any]:
             "relay_consultation": product_recipe(
                 "registry-relay", "relay-consultation"
             ),
-            "notary": product_recipe("registry-notary", "notary"),
             "postgresql_state_plane": postgresql_recipe(),
             "operator_files": operator_files(),
         },
@@ -633,10 +585,6 @@ def locked_image(identity: str, manifest_digest: str) -> dict[str, Any]:
                 "https://id.registrystack.org/schemas/"
                 "registry-relay/registry-relay.config.schema.json"
             ),
-            "notary_config_schema": (
-                "https://id.registrystack.org/schemas/"
-                "registry-notary/registry-notary.config.schema.json"
-            ),
         },
         "embedded_starters": [
             starter_binding(starter_id, STARTERS[starter_id], args.version)
@@ -702,7 +650,6 @@ def parser() -> argparse.ArgumentParser:
     create.add_argument("--asset-dir", required=True, type=Path)
     create.add_argument("--image-lock", required=True, type=Path)
     create.add_argument("--relay-image-index", required=True, type=Path)
-    create.add_argument("--notary-image-index", required=True, type=Path)
     create.add_argument("--postgresql-image-index", required=True, type=Path)
     create.add_argument("--output", required=True, type=Path)
     create.set_defaults(handler=create_payload)
diff --git a/release/scripts/registryctl_image_lock.py b/release/scripts/registryctl_image_lock.py
index 5a72a5b38..5189a536c 100644
--- a/release/scripts/registryctl_image_lock.py
+++ b/release/scripts/registryctl_image_lock.py
@@ -13,8 +13,10 @@
 POSTGRESQL_IMAGE_REF_PATH = ROOT / "release" / "registryctl-postgresql-image.ref"
 SCHEMA_V1 = "registryctl.release_image_lock.v1"
 SCHEMA_V2 = "registryctl.release_image_lock.v2"
+SCHEMA_V3 = "registryctl.release_image_lock.v3"
 PLATFORM = "linux/amd64"
 V2_MINIMUM_VERSION = (0, 14, 0)
+V3_MINIMUM_VERSION = (0, 17, 0)
 SEMVER = re.compile(r"^[0-9]+\.[0-9]+\.[0-9]+$")
 PRODUCT_IMAGE_REPOSITORIES = {
     "registry-relay": "ghcr.io/registrystack/registry-relay",
@@ -30,6 +32,8 @@ def schema_for_release_version(version: str) -> str:
             f"got {version!r}"
         )
     parsed = tuple(int(part) for part in version.split("."))
+    if parsed >= V3_MINIMUM_VERSION:
+        return SCHEMA_V3
     return SCHEMA_V2 if parsed >= V2_MINIMUM_VERSION else SCHEMA_V1
 
 
@@ -41,9 +45,14 @@ def repositories_for_schema(schema_version: str) -> dict[str, str]:
             **PRODUCT_IMAGE_REPOSITORIES,
             "postgresql": POSTGRESQL_IMAGE_REPOSITORY,
         }
+    if schema_version == SCHEMA_V3:
+        return {
+            "registry-relay": PRODUCT_IMAGE_REPOSITORIES["registry-relay"],
+            "postgresql": POSTGRESQL_IMAGE_REPOSITORY,
+        }
     raise ValueError(
         "registryctl release image lock schema_version must be "
-        f"{SCHEMA_V1!r} or {SCHEMA_V2!r}"
+        f"{SCHEMA_V1!r}, {SCHEMA_V2!r}, or {SCHEMA_V3!r}"
     )
 
 
@@ -123,7 +132,7 @@ def validate_images(schema_version: str, images: Any) -> dict[str, str]:
                 f"{repository}@sha256:<64 lowercase hex>"
             )
     if (
-        schema_version == SCHEMA_V2
+        schema_version in {SCHEMA_V2, SCHEMA_V3}
         and images["postgresql"] != reviewed_postgresql_image_ref()
     ):
         raise ValueError(
diff --git a/release/scripts/relay-oidc-smoke.py b/release/scripts/relay-oidc-smoke.py
index 175651a15..c9f46ef36 100755
--- a/release/scripts/relay-oidc-smoke.py
+++ b/release/scripts/relay-oidc-smoke.py
@@ -44,10 +44,20 @@
     "missing-credential",
     "valid-zitadel-role-mapping",
     "tampered-signature",
+    "source-read-scope-denied",
+    "source-read-records",
+    "source-read-minimized-projection",
     "audience-mismatch",
     "token-type-denied",
     "organization-role-scope-denied",
 )
+METADATA_SCOPE = "smoke_registry:metadata"
+READ_SCOPE = "smoke_registry:rows"
+SOURCE_READ_PATH = "/v1/datasets/smoke_registry/entities/person/records"
+# The entity projects `person_id` to `id` and republishes `display_name`. A
+# response carrying any other key means the released image disclosed more of
+# the source row than the authored entity declares.
+SOURCE_READ_RECORD = {"id": "person-001", "display_name": "Registry Smoke Person"}
 
 
 class NoRedirectHandler(urllib.request.HTTPRedirectHandler):
@@ -140,7 +150,8 @@ def validate_assets() -> dict[str, Any]:
         "mode: oidc",
         "discovery_url: http://localhost:8080/.well-known/openid-configuration",
         "scope_claim: $scope_claim",
-        '"registry-smoke-reader": "smoke_registry:metadata"',
+        '"registry-smoke-reader": $mapped_scope',
+        f"read_scope: {READ_SCOPE}",
         "$audience",
         "$required_org",
         "$allowed_client",
@@ -405,9 +416,11 @@ def render_relay_config(
     audience: str | None = None,
     required_org: str | None = None,
     allowed_token_type: str | None = None,
+    mapped_scope: str | None = None,
 ) -> str:
     params = {
         "base_url": json.dumps(f"http://127.0.0.1:{host_port}"),
+        "mapped_scope": json.dumps(mapped_scope or METADATA_SCOPE),
         "audience": json.dumps(audience or require_string(token_profile, "audience")),
         "required_org": json.dumps(
             required_org or require_string(token_profile, "required_org")
@@ -424,6 +437,27 @@ def render_relay_config(
     return rendered
 
 
+def source_read_result(body: dict[str, Any]) -> tuple[str, str]:
+    """Judge a records response against the entity's declared projection.
+
+    Returns ``(result, detail)``. The detail names the first departure from the
+    declared projection using field names only, so a failing report says what
+    the response carried without republishing the row itself.
+    """
+    data = body.get("data")
+    if not isinstance(data, list) or len(data) != 1:
+        return "fail", "records response did not carry exactly one record"
+    record = data[0]
+    if not isinstance(record, dict):
+        return "fail", "records response entry is not an object"
+    undeclared = sorted(set(record) - set(SOURCE_READ_RECORD))
+    if undeclared:
+        return "fail", f"record carries undeclared field {undeclared[0]}"
+    if record != SOURCE_READ_RECORD:
+        return "fail", "record does not match the synthetic fixture row"
+    return "pass", "record matches the declared entity projection"
+
+
 def tamper_signature(token: str) -> str:
     parts = token.split(".")
     if len(parts) != 3 or not parts[2]:
@@ -812,6 +846,50 @@ def execute_live(args: argparse.Namespace) -> Path:
             code="auth.token_signature_invalid",
         )
 
+        stage = "source-read-scope-check"
+        records_endpoint = f"{base_url}{SOURCE_READ_PATH}"
+        expected_response(
+            report["checks"],
+            "source-read-scope-denied",
+            http_json(records_endpoint, token, guard),
+            status=403,
+            code="auth.scope_denied",
+        )
+
+        stage = "source-read-check"
+        read_grant = render_relay_config(
+            token_profile,
+            host_port=host_port,
+            mapped_scope=READ_SCOPE,
+        )
+        report["configuration_digests"]["source_read"] = start_relay(
+            config_path,
+            read_grant,
+            base_url=base_url,
+            env=env,
+            project=project,
+            guard=guard,
+        )
+        records_body = expected_response(
+            report["checks"],
+            "source-read-records",
+            http_json(records_endpoint, token, guard),
+            status=200,
+        )
+        projection_result, projection_detail = source_read_result(records_body)
+        report["checks"].append(
+            {
+                "id": "source-read-minimized-projection",
+                "expected_status": None,
+                "actual_status": None,
+                "expected_code": "declared entity projection",
+                "actual_code": projection_detail,
+                "result": projection_result,
+            }
+        )
+        if projection_result != "pass":
+            raise CheckFailure(projection_detail)
+
         stage = "audience-mismatch-check"
         wrong_audience = render_relay_config(
             token_profile,
diff --git a/release/scripts/release_candidate.py b/release/scripts/release_candidate.py
index 0155d2934..55dd39ebb 100644
--- a/release/scripts/release_candidate.py
+++ b/release/scripts/release_candidate.py
@@ -46,7 +46,9 @@
 DIGEST = re.compile(r"^sha256:[0-9a-f]{64}$")
 VERSION = re.compile(r"^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$")
 RELEASE_ID = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$")
-IMAGE_NAMES = {"registry-notary", "registry-relay"}
+LEGACY_IMAGE_NAMES = {"registry-notary", "registry-relay"}
+CURRENT_IMAGE_NAMES = {"registry-relay"}
+NOTARY_RETIREMENT_MINIMUM_VERSION = (0, 17, 0)
 ATTEMPT_ARTIFACT_PREFIXES = {
     "registry-stack-candidate-build-a",
     "registry-stack-candidate-macos-arm64",
@@ -108,20 +110,22 @@
     "syft",
     "grype",
 }
-SECURITY_EVIDENCE_REQUIRED_FILES = {
+SECURITY_EVIDENCE_COMMON_REQUIRED_FILES = {
     "images/postgresql.digest",
-    "image-sbom/registry-notary.spdx.json",
-    "image-sbom/registry-relay.spdx.json",
     "image-sbom/postgresql.spdx.json",
-    "syft/registry-notary.syft.json",
-    "syft/registry-relay.syft.json",
     "syft/postgresql.syft.json",
-    "grype/registry-notary.grype.json",
-    "grype/registry-relay.grype.json",
     "grype/postgresql.grype.json",
     "grype/grype-db-status.json",
     "advisory-verdict.json",
 }
+SECURITY_EVIDENCE_REQUIRED_FILES = SECURITY_EVIDENCE_COMMON_REQUIRED_FILES | {
+    f"{directory}/registry-relay.{suffix}.json"
+    for directory, suffix in (
+        ("image-sbom", "spdx"),
+        ("syft", "syft"),
+        ("grype", "grype"),
+    )
+}
 POSTGRESQL_DIGEST_REF = re.compile(
     r"^docker\.io/library/postgres@sha256:[0-9a-f]{64}$"
 )
@@ -131,6 +135,28 @@ class CandidateError(ValueError):
     """A candidate cannot be trusted for promotion."""
 
 
+def _candidate_image_names(version: str) -> set[str]:
+    parsed = tuple(int(part) for part in version.split("."))
+    if parsed >= NOTARY_RETIREMENT_MINIMUM_VERSION:
+        return CURRENT_IMAGE_NAMES
+    return LEGACY_IMAGE_NAMES
+
+
+def _security_evidence_required_files(
+    product_image_names: Iterable[str],
+) -> set[str]:
+    required = set(SECURITY_EVIDENCE_COMMON_REQUIRED_FILES)
+    for image in product_image_names:
+        required.update(
+            {
+                f"image-sbom/{image}.spdx.json",
+                f"syft/{image}.syft.json",
+                f"grype/{image}.grype.json",
+            }
+        )
+    return required
+
+
 def read_json(path: Path) -> Any:
     try:
         return json.loads(path.read_text(encoding="utf-8"))
@@ -729,6 +755,7 @@ def validate_security_evidence_archive(
     ):
         raise CandidateError("security evidence archive size exceeds its bound")
 
+    required_files = _security_evidence_required_files(product_image_refs)
     seen: set[str] = set()
     top_level: set[str] = set()
     contents: dict[str, bytes] = {}
@@ -773,7 +800,7 @@ def validate_security_evidence_archive(
                     raise CandidateError(
                         f"security evidence archive has non-regular entry {name!r}"
                     )
-                if name not in SECURITY_EVIDENCE_REQUIRED_FILES:
+                if name not in required_files:
                     raise CandidateError(
                         f"security evidence archive has unexpected member {name!r}"
                     )
@@ -806,7 +833,7 @@ def validate_security_evidence_archive(
             f"cannot inspect security evidence archive: {exc}"
         ) from exc
 
-    missing = SECURITY_EVIDENCE_REQUIRED_FILES - set(contents)
+    missing = required_files - set(contents)
     if missing:
         raise CandidateError(
             f"security evidence archive is incomplete: missing {sorted(missing)!r}"
@@ -906,11 +933,8 @@ def validate_security_evidence_archive(
         raise CandidateError("security evidence Grype database status is empty")
 
     advisory = _security_evidence_json(contents, "advisory-verdict.json")
-    expected_subjects = {
-        "registry-notary-image",
-        "registry-relay-image",
-        "postgresql-runtime",
-    }
+    expected_subjects = {"postgresql-runtime"}
+    expected_subjects.update(f"{name}-image" for name in product_image_refs)
     subjects = advisory.get("subjects")
     if (
         advisory.get("schema_version") != "registry-stack.advisory-verdict.v2"
@@ -1140,9 +1164,10 @@ def validate_candidate_manifest(
         candidate_refs.add(candidate_ref)
         final_refs.add(final_ref)
         product_image_refs[name] = candidate_ref
-    if image_names != IMAGE_NAMES:
+    expected_image_names = _candidate_image_names(version)
+    if image_names != expected_image_names:
         raise CandidateError(
-            f"image inventory must be exactly {sorted(IMAGE_NAMES)!r}"
+            f"image inventory must be exactly {sorted(expected_image_names)!r}"
         )
 
     for kind in ("docs", "sbom"):
@@ -1538,7 +1563,7 @@ def _validate_images(
             },
         )
         name = require_nonempty_string(image["name"], f"{label}.name")
-        if name not in IMAGE_NAMES or name in seen:
+        if name not in LEGACY_IMAGE_NAMES or name in seen:
             raise CandidateError(f"{label}.name is unexpected or duplicated: {name!r}")
         seen.add(name)
         expected_repository = f"ghcr.io/registrystack/{name}-candidate"
@@ -1691,8 +1716,10 @@ def _validate_images(
             raise CandidateError(
                 f"{label}.comparison does not match the candidate build mode"
             )
-    if seen != IMAGE_NAMES:
-        raise CandidateError(f"image inventory must be exactly {sorted(IMAGE_NAMES)!r}")
+    if seen != LEGACY_IMAGE_NAMES:
+        raise CandidateError(
+            f"image inventory must be exactly {sorted(LEGACY_IMAGE_NAMES)!r}"
+        )
 
 
 def validate_receipt(
@@ -2047,7 +2074,7 @@ def validate_promotion_state(
     public_images = require_object(
         state["public_images"],
         "promotion state.public_images",
-        IMAGE_NAMES,
+        LEGACY_IMAGE_NAMES,
     )
     expected_digests = {
         image["name"]: image["index_digest"] for image in receipt["images"]
@@ -2100,7 +2127,7 @@ def validate_promotion_state(
 
     if phase == "prewrite":
         if release_state["exists"] or any(
-            public_images[name] is not None for name in IMAGE_NAMES
+            public_images[name] is not None for name in LEGACY_IMAGE_NAMES
         ):
             raise CandidateError(
                 "prewrite promotion state is not empty; partial publication or replay "
diff --git a/release/scripts/runtime_parity_payload.py b/release/scripts/runtime_parity_payload.py
index 529da0e23..1d3b8859f 100755
--- a/release/scripts/runtime_parity_payload.py
+++ b/release/scripts/runtime_parity_payload.py
@@ -43,7 +43,6 @@ def create_payload(output: Path) -> None:
         image_identities = {}
         for name, repository, digest_character in [
             ("relay", "example.invalid/registrystack/registry-relay", "d"),
-            ("notary", "example.invalid/registrystack/registry-notary", "e"),
             ("postgresql", "example.invalid/registrystack/postgresql", "f"),
         ]:
             index_path = root / f"{name}.index.json"
@@ -80,7 +79,6 @@ def create_payload(output: Path) -> None:
                     "tag_target": TAG_TARGET,
                     "images": {
                         "registry-relay": image_identities["relay"],
-                        "registry-notary": image_identities["notary"],
                         "postgresql": image_identities["postgresql"],
                     },
                 },
@@ -100,7 +98,6 @@ def create_payload(output: Path) -> None:
                     asset_dir=assets,
                     image_lock=image_lock,
                     relay_image_index=image_indexes["relay"],
-                    notary_image_index=image_indexes["notary"],
                     postgresql_image_index=image_indexes["postgresql"],
                     output=output,
                 )
diff --git a/release/scripts/select-release-proof-level.py b/release/scripts/select-release-proof-level.py
index dd68667f1..672f108a3 100755
--- a/release/scripts/select-release-proof-level.py
+++ b/release/scripts/select-release-proof-level.py
@@ -28,9 +28,6 @@
     "crates/registry-relay/release/**",
     "crates/registry-relay/scripts/check_advisory_baselines.py",
     "crates/registry-relay/security/advisory-baseline*.json",
-    "products/notary/release/**",
-    "products/notary/scripts/check_advisory_baselines.py",
-    "products/notary/security/advisory-baseline*.json",
 )
 BUILDER_FIELDS = {
     "binary_image",
diff --git a/release/scripts/smoke-release-image-oci-labels.sh b/release/scripts/smoke-release-image-oci-labels.sh
index 9e03c8151..c53dc9fb2 100755
--- a/release/scripts/smoke-release-image-oci-labels.sh
+++ b/release/scripts/smoke-release-image-oci-labels.sh
@@ -6,7 +6,7 @@ repo_root="$(cd -- "${script_dir}/../.." && pwd)"
 checker="${script_dir}/check-release-image-oci-labels.py"
 image_builder="${script_dir}/build-release-image.sh"
 layout_comparator="${script_dir}/compare-release-image-layouts.py"
-images=(registry-notary registry-relay)
+images=(registry-relay)
 relay_dockerfile="${repo_root}/release/docker/Dockerfile.registry-relay"
 
 source_label="https://github.com/registrystack/registry-stack"
@@ -32,8 +32,6 @@ if [[ ! -x "${true_binary}" ]]; then
 fi
 cp "${true_binary}" "${context_dir}/dist/image-bin/registry-relay"
 cp "${true_binary}" "${context_dir}/dist/image-bin/registry-relay-rhai-worker"
-cp "${true_binary}" "${context_dir}/dist/image-bin/registry-notary"
-cp "${true_binary}" "${context_dir}/dist/image-bin/registry-notary-cel-worker"
 cp "${repo_root}/LICENSE" "${context_dir}/LICENSE"
 
 docker buildx create \
@@ -102,8 +100,6 @@ for image in "${images[@]}"; do
   touch -t 200001010101 \
     "${context_dir}/dist/image-bin/registry-relay" \
     "${context_dir}/dist/image-bin/registry-relay-rhai-worker" \
-    "${context_dir}/dist/image-bin/registry-notary" \
-    "${context_dir}/dist/image-bin/registry-notary-cel-worker" \
     "${context_dir}/LICENSE"
   build_layout "${image}" "${first_layout}" "${revision_label}" "${version_label}"
   expected_label_args=()
@@ -121,8 +117,6 @@ for image in "${images[@]}"; do
   touch -t 203001010101 \
     "${context_dir}/dist/image-bin/registry-relay" \
     "${context_dir}/dist/image-bin/registry-relay-rhai-worker" \
-    "${context_dir}/dist/image-bin/registry-notary" \
-    "${context_dir}/dist/image-bin/registry-notary-cel-worker" \
     "${context_dir}/LICENSE"
   build_layout "${image}" "${second_layout}" "${revision_label}" "${version_label}"
   python3 "${layout_comparator}" "${first_layout}" "${second_layout}"
diff --git a/release/scripts/test_check_adopter_compose_contract.py b/release/scripts/test_check_adopter_compose_contract.py
index 5b9e587cc..12a1a39e5 100644
--- a/release/scripts/test_check_adopter_compose_contract.py
+++ b/release/scripts/test_check_adopter_compose_contract.py
@@ -24,7 +24,6 @@ def expected_images() -> dict[str, str]:
     return {
         "registry-relay-public": "example.invalid/relay@sha256:" + "a" * 64,
         "registry-relay-consultation": ("example.invalid/relay@sha256:" + "a" * 64),
-        "registry-notary": "example.invalid/notary@sha256:" + "b" * 64,
         "registry-postgres": "example.invalid/postgres@sha256:" + "c" * 64,
     }
 
@@ -180,7 +179,6 @@ def ordinary_model() -> dict:
     for name, lane in (
         ("registry-relay-public", "relay-public"),
         ("registry-relay-consultation", "relay-consultation"),
-        ("registry-notary", "notary"),
     ):
         services[name] = {
             **product_hardening(),
@@ -204,15 +202,6 @@ def ordinary_model() -> dict:
             "target": 8080,
         }
     ]
-    services["registry-notary"]["ports"] = [
-        {
-            "host_ip": "127.0.0.1",
-            "mode": "ingress",
-            "protocol": "tcp",
-            "published": "4255",
-            "target": 8081,
-        }
-    ]
     return {
         "name": CHECKER.PROJECT_NAME,
         "services": services,
@@ -282,7 +271,7 @@ def initialization_model(ordinary: dict) -> dict:
         requires_postgresql = (
             lane == "relay-consultation"
             and action in {"prepare", "initialize"}
-        ) or (lane == "notary" and action == "prepare")
+        )
         if requires_postgresql:
             service["networks"] = {CHECKER.NETWORK_RUNTIME: {}}
         else:
@@ -327,7 +316,7 @@ def test_ordinary_model_rejects_namespace_holder(self) -> None:
         model["services"]["registry-private-namespace"] = {}
         with self.assertRaisesRegex(
             CHECKER.ContractError,
-            "four workloads and three secret stagers",
+            "three workloads and two secret stagers",
         ):
             assert_ordinary(model)
 
@@ -342,22 +331,22 @@ def test_ordinary_model_excludes_action_stagers_and_scratch_volumes(self) -> Non
         model["services"][action_stager] = stager(action_stager, action=True)
         with self.assertRaisesRegex(
             CHECKER.ContractError,
-            "four workloads and three secret stagers",
+            "three workloads and two secret stagers",
         ):
             assert_ordinary(model)
 
     def test_ordinary_model_requires_each_closed_runtime_field(self) -> None:
         mutations = {
-            "workload-image": lambda model: model["services"]["registry-notary"].pop(
+            "workload-image": lambda model: model["services"]["registry-relay-public"].pop(
                 "image"
             ),
-            "workload-command": lambda model: model["services"]["registry-notary"].pop(
+            "workload-command": lambda model: model["services"]["registry-relay-public"].pop(
                 "command"
             ),
             "hardening": lambda model: model["services"]["registry-relay-public"].pop(
                 "read_only"
             ),
-            "publication": lambda model: model["services"]["registry-notary"].pop(
+            "publication": lambda model: model["services"]["registry-relay-public"].pop(
                 "ports"
             ),
             "unauthorized-publication": lambda model: model["services"][
@@ -394,20 +383,20 @@ def test_ordinary_model_requires_each_closed_runtime_field(self) -> None:
             "anchor": lambda model: model["services"]["registry-relay-public"][
                 "volumes"
             ].pop(1),
-            "state": lambda model: model["services"]["registry-notary"]["volumes"].pop(
+            "state": lambda model: model["services"]["registry-relay-consultation"]["volumes"].pop(
                 2
             ),
-            "audit": lambda model: model["services"]["registry-notary"]["volumes"].pop(
+            "audit": lambda model: model["services"]["registry-relay-consultation"]["volumes"].pop(
                 3
             ),
             "staged-secret": lambda model: model["services"]["registry-postgres"][
                 "volumes"
             ].pop(),
             "volume-inventory": lambda model: model["volumes"].pop(
-                "registry-notary-state"
+                "registry-relay-consultation-state"
             ),
             "operator-secret": lambda model: model["secrets"].pop(
-                "registry-notary-signing-key"
+                "registry-postgresql-tls-certificate"
             ),
         }
         for name, mutate in mutations.items():
@@ -499,7 +488,7 @@ def test_ordinary_requires_every_protected_workload_mount(self) -> None:
     def test_ordinary_publications_are_exact_and_private_services_stay_private(
         self,
     ) -> None:
-        for service_name in ("registry-relay-public", "registry-notary"):
+        for service_name in ("registry-relay-public",):
             with self.subTest(service=service_name, mutation="missing"):
                 model = ordinary_model()
                 model["services"][service_name].pop("ports")
@@ -512,7 +501,6 @@ def test_ordinary_publications_are_exact_and_private_services_stay_private(
                     assert_ordinary(model)
         for service_name in CHECKER.ORDINARY_SERVICES - {
             "registry-relay-public",
-            "registry-notary",
         }:
             with self.subTest(service=service_name, mutation="published"):
                 model = ordinary_model()
@@ -534,7 +522,6 @@ def test_product_inputs_must_be_owned_by_the_exact_lane_and_package(
         lanes = {
             "registry-relay-public": "relay-public",
             "registry-relay-consultation": "relay-consultation",
-            "registry-notary": "notary",
         }
         for service_name, lane in lanes.items():
             other_lane = next(
@@ -580,8 +567,8 @@ def add_cross_lane_input(model: dict) -> None:
                 "secrets"
             ].append(
                 {
-                    "source": "registry-notary-signing-key",
-                    "target": "/run/secrets/notary-signing-key",
+                    "source": "registry-postgresql-admin-password",
+                    "target": "/run/secrets/postgresql-admin-password",
                 }
             )
 
@@ -590,7 +577,7 @@ def add_cross_lane_output(model: dict) -> None:
                 "volumes"
             ].append(
                 volume(
-                    "registry-operator-files-notary-serve",
+                    "registry-operator-files-postgresql-serve",
                     "/registryctl-stage/cross-lane",
                 )
             )
@@ -674,8 +661,8 @@ def test_each_stager_requires_its_closed_isolated_contract(self) -> None:
 
     def test_operator_files_must_stay_under_operator_directory(self) -> None:
         model = ordinary_model()
-        model["secrets"]["registry-notary-signing-key"]["file"] = (
-            "/fixture/generated/notary-signing-key"
+        model["secrets"]["registry-postgresql-tls-certificate"]["file"] = (
+            "/fixture/generated/postgresql-tls-certificate"
         )
         with self.assertRaisesRegex(
             CHECKER.ContractError,
@@ -685,8 +672,8 @@ def test_operator_files_must_stay_under_operator_directory(self) -> None:
 
     def test_value_free_model_rejects_resolved_sentinel(self) -> None:
         model = ordinary_model()
-        model["services"]["registry-notary"]["environment"] = {
-            "REGISTRY_CONFORMANCE_SENTINEL": ("notary-value-must-not-enter-compose")
+        model["services"]["registry-relay-public"]["environment"] = {
+            "REGISTRY_CONFORMANCE_SENTINEL": ("relay-value-must-not-enter-compose")
         }
         with self.assertRaisesRegex(CHECKER.ContractError, "sentinel value"):
             assert_ordinary(model)
@@ -765,7 +752,7 @@ def test_state_checks_are_non_mutating_and_accept_has_only_lane_environment(
     ) -> None:
         ordinary = ordinary_model()
         initialized = initialization_model(ordinary)
-        for lane in ("relay-public", "relay-consultation", "notary"):
+        for lane in ("relay-public", "relay-consultation"):
             accept_name = f"registry-{lane}-accept-state"
             accept = initialized["services"][accept_name]
             self.assertEqual(
@@ -796,16 +783,16 @@ def test_state_checks_are_non_mutating_and_accept_has_only_lane_environment(
                 )
 
         changed = initialization_model(ordinary)
-        changed["services"]["registry-notary-accept-state"]["env_file"] = [
-            "/fixture/package/operator/secrets/relay-public-environment"
+        changed["services"]["registry-relay-public-accept-state"]["env_file"] = [
+            "/fixture/package/operator/secrets/relay-consultation-environment"
         ]
         with self.assertRaises(CHECKER.ContractError):
             assert_initialization(changed, ordinary)
 
         changed = initialization_model(ordinary)
-        changed["services"]["registry-notary-accept-state"]["volumes"].append(
+        changed["services"]["registry-relay-public-accept-state"]["volumes"].append(
             volume(
-                "registry-operator-files-notary-serve",
+                "registry-operator-files-relay-consultation-serve",
                 "/run/secrets",
                 read_only=True,
             )
@@ -837,9 +824,6 @@ def test_preparation_and_bootstrap_use_only_action_stagers(self) -> None:
             "registry-relay-consultation-initialize": (
                 "registry-relay-consultation-actions-stage-secrets"
             ),
-            "registry-notary-prepare-state": (
-                "registry-notary-actions-stage-secrets"
-            ),
         }
         for service_name, stager_name in expected.items():
             dependencies = initialized["services"][service_name]["depends_on"]
@@ -870,13 +854,13 @@ def test_initialization_requires_exact_postgresql_delta(self) -> None:
     def test_initialization_requires_each_closed_action_field(self) -> None:
         mutations = {
             "service": lambda model: model["services"].pop(
-                "registry-notary-initialize"
+                "registry-relay-consultation-initialize"
             ),
-            "image": lambda model: model["services"]["registry-notary-initialize"].pop(
+            "image": lambda model: model["services"]["registry-relay-consultation-initialize"].pop(
                 "image"
             ),
             "command": lambda model: model["services"][
-                "registry-notary-initialize"
+                "registry-relay-consultation-initialize"
             ].pop("command"),
             "hardening": lambda model: model["services"][
                 "registry-postgres-bootstrap"
@@ -885,7 +869,7 @@ def test_initialization_requires_each_closed_action_field(self) -> None:
                 "registry-relay-consultation-prepare-state"
             ].pop("networks"),
             "dependency": lambda model: model["services"][
-                "registry-notary-prepare-state"
+                "registry-relay-consultation-prepare-state"
             ]["depends_on"].pop("registry-postgres"),
             "restart": lambda model: model["services"][
                 "registry-relay-public-initialize"
@@ -896,17 +880,17 @@ def test_initialization_requires_each_closed_action_field(self) -> None:
             "bundle": lambda model: model["services"][
                 "registry-relay-public-prepare-state"
             ]["volumes"].pop(0),
-            "anchor": lambda model: model["services"]["registry-notary-initialize"][
+            "anchor": lambda model: model["services"]["registry-relay-consultation-initialize"][
                 "volumes"
             ].pop(1),
-            "state": lambda model: model["services"]["registry-notary-initialize"][
+            "state": lambda model: model["services"]["registry-relay-consultation-initialize"][
                 "volumes"
             ].pop(2),
-            "audit": lambda model: model["services"]["registry-notary-initialize"][
+            "audit": lambda model: model["services"]["registry-relay-consultation-initialize"][
                 "volumes"
             ].pop(3),
             "staged-secret": lambda model: model["services"][
-                "registry-notary-initialize"
+                "registry-relay-consultation-initialize"
             ]["volumes"].pop(),
         }
         ordinary = ordinary_model()
@@ -951,7 +935,6 @@ def test_initialization_requires_each_command_restart_network_and_dependency(
                     metadata[1] == "relay-consultation"
                     and metadata[2] in {"prepare", "initialize"}
                 )
-                or (metadata[1] == "notary" and metadata[2] == "prepare")
             )
             network_field = "networks" if requires_postgresql else "network_mode"
             for field in ("command", "restart", network_field):
@@ -1030,10 +1013,10 @@ def test_initialization_services_are_unpublished_and_keep_every_mount(
     def test_initialization_delta_cannot_change_ordinary_service(self) -> None:
         ordinary = ordinary_model()
         initialized = initialization_model(ordinary)
-        initialized["services"]["registry-notary"]["command"] = ["changed"]
+        initialized["services"]["registry-relay-public"]["command"] = ["changed"]
         with self.assertRaisesRegex(
             CHECKER.ContractError,
-            "changed ordinary service registry-notary",
+            "changed ordinary service registry-relay-public",
         ):
             assert_initialization(initialized, ordinary)
 
@@ -1200,8 +1183,8 @@ def test_parent_include_rejects_renamed_durable_volume(self) -> None:
             parent["volumes"][name] = {"name": f"{parent_name}_{name}"}
         for name in parent["secrets"]:
             parent["secrets"][name]["name"] = f"{parent_name}_{name}"
-        parent["volumes"]["registry-notary-state"] = {
-            "name": f"{parent_name}_registry-notary-state"
+        parent["volumes"]["registry-relay-public-state"] = {
+            "name": f"{parent_name}_registry-relay-public-state"
         }
         parent["services"]["parent-runtime-client"] = {
             "image": (
@@ -1211,7 +1194,7 @@ def test_parent_include_rejects_renamed_durable_volume(self) -> None:
         }
         with self.assertRaisesRegex(
             CHECKER.ContractError,
-            "renamed durable volume registry-notary-state",
+            "renamed durable volume registry-relay-public-state",
         ):
             CHECKER.assert_parent_include(parent, ordinary)
 
diff --git a/release/scripts/test_check_advisory_checker_copies.py b/release/scripts/test_check_advisory_checker_copies.py
deleted file mode 100644
index 9db4e390e..000000000
--- a/release/scripts/test_check_advisory_checker_copies.py
+++ /dev/null
@@ -1,59 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-import importlib.util
-import sys
-import tempfile
-import unittest
-from pathlib import Path
-
-
-def load_module():
-    path = Path(__file__).with_name("check_advisory_checker_copies.py")
-    spec = importlib.util.spec_from_file_location("check_advisory_checker_copies", path)
-    module = importlib.util.module_from_spec(spec)
-    sys.modules[spec.name] = module
-    spec.loader.exec_module(module)
-    return module
-
-
-class AdvisoryCheckerCopiesTest(unittest.TestCase):
-    def setUp(self):
-        self.module = load_module()
-        self.tmp = tempfile.TemporaryDirectory()
-        self.root = Path(self.tmp.name)
-        self.left = self.root / "left.py"
-        self.right = self.root / "right.py"
-
-    def tearDown(self):
-        self.tmp.cleanup()
-
-    def test_identical_copies_pass(self):
-        self.left.write_bytes(b"same\n")
-        self.right.write_bytes(b"same\n")
-        self.assertIsNone(self.module.check_identical(self.left, self.right))
-
-    def test_drift_fails(self):
-        self.left.write_bytes(b"notary\n")
-        self.right.write_bytes(b"relay\n")
-        self.assertIn(
-            "advisory checker copies differ",
-            self.module.check_identical(self.left, self.right),
-        )
-
-    def test_missing_copy_fails(self):
-        self.left.write_bytes(b"present\n")
-        self.assertIn(
-            "cannot read advisory checker copy",
-            self.module.check_identical(self.left, self.right),
-        )
-
-    def test_repository_checker_copies_match(self):
-        self.assertIsNone(
-            self.module.check_identical(
-                self.module.NOTARY_CHECKER,
-                self.module.RELAY_CHECKER,
-            )
-        )
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/release/scripts/test_check_gates_inventory.py b/release/scripts/test_check_gates_inventory.py
index cb141fd3d..cee3502b5 100644
--- a/release/scripts/test_check_gates_inventory.py
+++ b/release/scripts/test_check_gates_inventory.py
@@ -626,46 +626,16 @@ def test_missing_actionlint_pin_or_checksum_is_reported(self) -> None:
                 text = self.workflow.replace(snippet, replacement)
                 self.assertIn(gate, self.module.missing_gates(text))
 
-    def test_missing_advisory_checker_identity_gate_is_reported(self) -> None:
+    def test_missing_relay_advisory_checker_tests_are_reported(self) -> None:
+        path = "crates/registry-relay/tests/advisory_baseline_check_test.py"
         text = self.workflow.replace(
-            "run: python3 release/scripts/check_advisory_checker_copies.py",
-            "run: true",
-        )
-        self.assertIn(
-            "Advisory checker byte identity",
-            self.module.missing_gates(text),
-        )
-
-    def test_missing_advisory_checker_identity_tests_are_reported(self) -> None:
-        text = self.workflow.replace(
-            "run: python3 -m unittest release/scripts/test_check_advisory_checker_copies.py",
-            "run: true",
-        )
-        self.assertIn(
-            "Advisory checker identity guard tests",
-            self.module.missing_gates(text),
-        )
-
-    def test_missing_advisory_checker_tests_are_reported(self) -> None:
-        for path, gate in (
-            (
-                "products/notary/tests/advisory_baseline_check_test.py",
-                "Notary advisory checker tests",
-            ),
-            (
-                "crates/registry-relay/tests/advisory_baseline_check_test.py",
-                "Relay advisory checker tests",
+            path,
+            path.replace(
+                "advisory_baseline_check_test.py",
+                "disabled_advisory_test.py",
             ),
-        ):
-            with self.subTest(path=path):
-                text = self.workflow.replace(
-                    path,
-                    path.replace(
-                        "advisory_baseline_check_test.py",
-                        "disabled_advisory_test.py",
-                    ),
-                )
-                self.assertIn(gate, self.module.missing_gates(text))
+        )
+        self.assertIn("Relay advisory checker tests", self.module.missing_gates(text))
 
     def test_missing_relay_all_features_shard_is_reported(self) -> None:
         classifier = self.classifier.replace(
@@ -720,8 +690,6 @@ def test_missing_secret_scan_redaction_is_reported(self) -> None:
 
     def test_root_secret_scan_names_all_synthetic_platform_jwt_fixtures(self) -> None:
         for fixture_path in (
-            r"^products/platform/fuzz/corpus/oid4vci_request_and_proof/credential_request\.json$",
-            r"^products/platform/fuzz/corpus/oid4vci_request_and_proof/valid-proof-jwt$",
             r"^products/platform/fuzz/corpus/sdjwt_holder_proof/holder_proof\.jwt$",
             r"^products/platform/fuzz/corpus/sdjwt_holder_proof/valid-holder-proof-jwt$",
         ):
@@ -788,16 +756,6 @@ def test_missing_openid_conformance_runner_tests_are_reported(self) -> None:
             "OpenID conformance runner tests", self.module.missing_gates(text)
         )
 
-    def test_missing_external_integration_runner_tests_are_reported(self) -> None:
-        text = self.workflow.replace(
-            "python3 -m unittest release/scripts/test_integration_e2_runner.py",
-            "python3 release/scripts/integration-e2-runner.py dry-run",
-        )
-        self.assertIn(
-            "External integration evidence runner tests",
-            self.module.missing_gates(text),
-        )
-
     def test_release_tool_runs_conformance_candidate_binding_tests(self) -> None:
         release_tool = self.workflow[
             self.workflow.index("  release-tool:\n") : self.workflow.index(
@@ -819,16 +777,6 @@ def test_missing_first_country_release_form_runner_tests_are_reported(self) -> N
             self.module.missing_gates(text),
         )
 
-    def test_missing_external_integration_packet_validation_is_reported(self) -> None:
-        text = self.workflow.replace(
-            "python3 release/scripts/integration-e2-runner.py validate",
-            "python3 release/scripts/integration-e2-runner.py plan",
-        )
-        self.assertIn(
-            "External integration evidence packet",
-            self.module.missing_gates(text),
-        )
-
     def test_missing_relay_oidc_smoke_tests_are_reported(self) -> None:
         text = self.workflow.replace(
             "python3 -m unittest release/scripts/test_relay_oidc_smoke.py",
diff --git a/release/scripts/test_check_release_image_oci_labels.py b/release/scripts/test_check_release_image_oci_labels.py
index 33019be84..6c177e024 100644
--- a/release/scripts/test_check_release_image_oci_labels.py
+++ b/release/scripts/test_check_release_image_oci_labels.py
@@ -519,7 +519,7 @@ def test_reused_builder_rejects_nonstandard_container_shape(self) -> None:
 
 
 class ReleaseImageOciLabelsSmokeTest(unittest.TestCase):
-    def test_smoke_builds_both_release_dockerfiles_via_shared_wrapper(self) -> None:
+    def test_smoke_builds_relay_release_dockerfile_via_shared_wrapper(self) -> None:
         with tempfile.TemporaryDirectory() as temporary:
             fake_bin = Path(temporary) / "bin"
             fake_bin.mkdir()
@@ -601,7 +601,7 @@ def read_calls(path: Path) -> list[list[str]]:
             build_calls = [
                 call for call in read_calls(docker_log) if call[:2] == ["buildx", "build"]
             ]
-            self.assertEqual(6, len(build_calls))
+            self.assertEqual(4, len(build_calls))
             dockerfiles = []
             for call in build_calls:
                 self.assertEqual(["buildx", "build"], call[:2])
@@ -626,17 +626,10 @@ def read_calls(path: Path) -> list[list[str]]:
 
             self.assertEqual(
                 {
-                    str(ROOT / "release/docker/Dockerfile.registry-notary"),
                     str(ROOT / "release/docker/Dockerfile.registry-relay"),
                 },
                 set(dockerfiles),
             )
-            self.assertEqual(
-                2,
-                dockerfiles.count(
-                    str(ROOT / "release/docker/Dockerfile.registry-notary")
-                ),
-            )
             self.assertEqual(
                 4,
                 dockerfiles.count(
@@ -653,7 +646,6 @@ def read_calls(path: Path) -> list[list[str]]:
             }
             self.assertEqual(
                 {
-                    "correct-registry-notary-first",
                     "correct-registry-relay-first",
                 },
                 {
@@ -681,7 +673,7 @@ def read_calls(path: Path) -> list[list[str]]:
                 for call in python_calls
                 if call and call[0].endswith("compare-release-image-layouts.py")
             ]
-            self.assertEqual(3, len(comparisons))
+            self.assertEqual(2, len(comparisons))
             self.assertEqual(1, sum("--rootfs-only" in call for call in comparisons))
 
 
diff --git a/release/scripts/test_check_release_source_model.py b/release/scripts/test_check_release_source_model.py
index edbaecd9c..55e639a69 100644
--- a/release/scripts/test_check_release_source_model.py
+++ b/release/scripts/test_check_release_source_model.py
@@ -55,6 +55,14 @@ def test_monorepo_mode_passes_without_lab_directory(self) -> None:
         self.assertIn("release-source registry-stack", result.stdout)
         self.assertNotIn("lab", result.stdout)
 
+    def test_monorepo_mode_passes_without_retired_notary_crates(self) -> None:
+        with MonorepoFixture() as stack_root:
+            shutil.rmtree(stack_root / "crates" / "registry-notary-server")
+
+            result = run_monorepo_validator(stack_root)
+
+        self.assertEqual(0, result.returncode, result.stderr)
+
     def test_monorepo_mode_rejects_legacy_vendor_mode(self) -> None:
         with MonorepoFixture() as stack_root:
             result = run_validator(stack_root, "vendor")
@@ -245,6 +253,9 @@ def __enter__(self) -> Path:
             "crates/registry-manifest-core",
             "crates/registry-notary-server",
             "crates/registry-relay",
+            "crates/registry-evidence",
+            "crates/registry-evidencectl",
+            "crates/registry-mint",
             "crates/registryctl",
         ):
             (stack_root / crate_dir).mkdir(parents=True)
diff --git a/release/scripts/test_check_stable_surface_compatibility.py b/release/scripts/test_check_stable_surface_compatibility.py
index d907501f0..b2d8b330c 100644
--- a/release/scripts/test_check_stable_surface_compatibility.py
+++ b/release/scripts/test_check_stable_surface_compatibility.py
@@ -39,6 +39,26 @@ def test_error_registry_requires_one_stack_wide_meaning(self) -> None:
         with self.assertRaisesRegex(self.module.ContractError, "stack-wide meaning"):
             self.module.parse_error_registry(text)
 
+    def test_retired_notary_errors_do_not_enter_the_current_contract(self) -> None:
+        text = """\
+## Registry Notary
+| Code | Meaning | Cause |
+| --- | --- | --- |
+| `notary.retired` | historical Notary error | x |
+## Registry Relay
+| Code | Meaning | Cause |
+| --- | --- | --- |
+| `relay.active` | maintained Relay error | x |
+"""
+        self.assertEqual(
+            {
+                "relay.active": self.module.ErrorContract(
+                    "maintained Relay error", frozenset({"registry-relay"})
+                )
+            },
+            self.module.parse_error_registry(text),
+        )
+
     def test_error_additions_are_allowed_but_removal_and_change_are_not(self) -> None:
         old = {
             "request.invalid": self.module.ErrorContract(
@@ -78,7 +98,7 @@ def test_metric_contract_is_anchored_in_source(self) -> None:
                 "release_line": 1,
                 "metrics": [
                     {
-                        "product": "registry-notary",
+                        "product": "registry-relay",
                         "name": "product_requests_total",
                         "type": "counter",
                         "meaning": "Completed requests.",
@@ -88,11 +108,58 @@ def test_metric_contract_is_anchored_in_source(self) -> None:
                 ],
             }
             validated = self.module.validate_metrics_contract(contract, root)
-            self.assertIn(("registry-notary", "product_requests_total"), validated)
+            self.assertIn(("registry-relay", "product_requests_total"), validated)
             contract["metrics"][0]["labels"] = {"route": "Raw route."}
             with self.assertRaisesRegex(self.module.ContractError, "selected label"):
                 self.module.validate_metrics_contract(contract, root)
 
+    def test_current_stable_surfaces_accept_only_maintained_products(self) -> None:
+        self.assertEqual({"registry-relay"}, set(self.module.OPENAPI_SPECS))
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            source = root / "metrics.rs"
+            source.write_text("# TYPE retired_total counter\n", encoding="utf-8")
+            contract = {
+                "schema": "registry-stack.selected-metrics/v1",
+                "release_line": 1,
+                "metrics": [
+                    {
+                        "product": "registry-notary",
+                        "name": "retired_total",
+                        "type": "counter",
+                        "meaning": "A retired metric.",
+                        "labels": {},
+                        "source": "metrics.rs",
+                    }
+                ],
+            }
+            with self.assertRaisesRegex(self.module.ContractError, "maintained product"):
+                self.module.validate_metrics_contract(contract, root)
+
+    def test_historical_notary_metrics_do_not_block_current_retirement(self) -> None:
+        relay = {
+            "product": "registry-relay",
+            "name": "relay_requests_total",
+            "type": "counter",
+            "meaning": "Completed Relay requests.",
+            "labels": {},
+            "source": "relay.rs",
+        }
+        notary = {
+            "product": "registry-notary",
+            "name": "notary_requests_total",
+            "type": "counter",
+            "meaning": "Completed Notary requests.",
+            "labels": {},
+            "source": "notary.rs",
+        }
+        base = {
+            (relay["product"], relay["name"]): relay,
+            (notary["product"], notary["name"]): notary,
+        }
+        current = {(relay["product"], relay["name"]): relay}
+        self.assertEqual([], self.module.compare_metrics_contracts(base, current))
+
     def test_metric_additions_are_allowed_but_protected_fields_do_not_change(self) -> None:
         metric = {
             "product": "registry-relay",
@@ -206,6 +273,48 @@ def test_diagnostic_additions_are_allowed_but_removal_and_semantic_drift_are_not
             errors = self.module.compare_diagnostic_contracts(old, changed)
             self.assertTrue(any(f"changed {field}" in error for error in errors))
 
+    def test_historical_notary_diagnostics_do_not_block_current_retirement(self) -> None:
+        key = ("notary_activation", "registry_notary", "registry_notary.retired")
+        base = {
+            key: self.module.DiagnosticContract(
+                "registry_notary",
+                "The retired Notary activation failed.",
+                "the historical activation must satisfy the retired rule",
+                "/reference/diagnostics/operator/#registry_notary--retired",
+            )
+        }
+        self.assertEqual([], self.module.compare_diagnostic_contracts(base, {}))
+
+    def test_a_retired_code_is_skipped_and_its_siblings_stay_protected(self) -> None:
+        retired = ("fixture_execution", "registryctl_relay_offline_harness",
+                   "authorization.denied")
+        sibling = ("fixture_execution", "registryctl_relay_offline_harness",
+                   "authorization.allowed")
+        contract = self.module.DiagnosticContract(
+            "registryctl",
+            "The offline harness refused the request.",
+            "the harness must refuse an unauthorized request",
+            "/reference/diagnostics/fixture/#registryctl--authorization.denied",
+        )
+        base = {retired: contract, sibling: contract}
+
+        errors = self.module.compare_diagnostic_contracts(base, {})
+
+        self.assertEqual(
+            [f"diagnostic code removed: {' '.join(sibling)}"],
+            errors,
+            "only the recorded code is exempt; every other code under the same "
+            "family and product is still guarded",
+        )
+
+    def test_every_retirement_record_states_why_the_code_went_away(self) -> None:
+        for key, reason in self.module.RETIRED_DIAGNOSTIC_CODES.items():
+            with self.subTest(code=key):
+                self.assertEqual(3, len(key), "a record names family, product and code")
+                self.assertTrue(
+                    reason.strip(), f"{' '.join(key)} was retired without a reason"
+                )
+
     def test_diagnostic_catalog_rejects_shape_duplicates_reordering_and_lifecycle_drift(
         self,
     ) -> None:
diff --git a/release/scripts/test_conformance_candidate.py b/release/scripts/test_conformance_candidate.py
index 59f0288fd..40203570c 100644
--- a/release/scripts/test_conformance_candidate.py
+++ b/release/scripts/test_conformance_candidate.py
@@ -52,38 +52,42 @@ def make_binding_fixture(
     ) -> tuple[dict[str, object], dict[str, object], Path, str, Path]:
         candidate = self.root / candidate_name
         candidate.mkdir()
-        images = {
-            "registry-relay": self.relay,
-            "registry-notary": self.notary,
-        }
-        if schema_version == image_lock.SCHEMA_V2:
+        tag = "v0.17.0" if schema_version == image_lock.SCHEMA_V3 else self.tag
+        version = tag.removeprefix("v")
+        images = {"registry-relay": self.relay}
+        if schema_version != image_lock.SCHEMA_V3:
+            images["registry-notary"] = self.notary
+        if schema_version in {image_lock.SCHEMA_V2, image_lock.SCHEMA_V3}:
             images["postgresql"] = self.postgresql
         lock = {
             "schema_version": schema_version,
-            "release_tag": self.tag,
+            "release_tag": tag,
             "manifest_source_ref": "4" * 40,
             "tag_target": "1" * 40,
             "platform": image_lock.PLATFORM,
             "images": images,
         }
-        lock_name = f"registryctl-{self.tag}-image-lock.json"
+        lock_name = f"registryctl-{tag}-image-lock.json"
         lock_path = candidate / lock_name
         self.write_json(lock_path, lock)
         lock_sha256 = hashlib.sha256(lock_path.read_bytes()).hexdigest()
-        capsule_path = candidate / f"registry-stack-{self.tag}-release-capsule.json"
+        capsule_path = candidate / f"registry-stack-{tag}-release-capsule.json"
         capsule_images = [
             {
                 "name": "registry-relay",
                 "role": "released-product-image",
                 "digest_ref": self.relay,
             },
-            {
-                "name": "registry-notary",
-                "role": "released-product-image",
-                "digest_ref": self.notary,
-            },
         ]
-        if schema_version == image_lock.SCHEMA_V2:
+        if schema_version != image_lock.SCHEMA_V3:
+            capsule_images.append(
+                {
+                    "name": "registry-notary",
+                    "role": "released-product-image",
+                    "digest_ref": self.notary,
+                }
+            )
+        if schema_version in {image_lock.SCHEMA_V2, image_lock.SCHEMA_V3}:
             capsule_images.append(
                 {
                     "name": "postgresql",
@@ -94,11 +98,11 @@ def make_binding_fixture(
         self.write_json(
             capsule_path,
             {
-                "release_tag": self.tag,
-                "version": self.version,
+                "release_tag": tag,
+                "version": version,
                 "repository": self.module.CAPSULE_REPOSITORY,
                 "source": {
-                    "source_tag": self.tag,
+                    "source_tag": tag,
                     "source_ref": lock["manifest_source_ref"],
                     "source_commit": lock["tag_target"],
                     "lineage": {
@@ -122,7 +126,7 @@ def make_binding_fixture(
             f"{lock_sha256}  {lock_name}\n", encoding="utf-8"
         )
         return (
-            {"version": self.version},
+            {"version": version},
             lock,
             lock_path,
             lock_sha256,
@@ -157,6 +161,62 @@ def test_v2_capsule_binds_postgresql_from_validated_image_lock(self) -> None:
 
         self.assertRegex(capsule_sha256, r"^[0-9a-f]{64}$")
 
+    def test_v3_capsule_binds_relay_and_postgresql_without_notary(self) -> None:
+        stack, lock, lock_path, lock_sha256, _capsule_path = self.make_binding_fixture(
+            schema_version=image_lock.SCHEMA_V3
+        )
+
+        capsule_sha256 = self.verify_fixture(stack, lock, lock_path, lock_sha256)
+
+        self.assertRegex(capsule_sha256, r"^[0-9a-f]{64}$")
+        self.assertEqual({"registry-relay", "postgresql"}, set(lock["images"]))
+
+    def test_v3_candidate_loader_returns_relay_without_notary(self) -> None:
+        manifest_path = self.root / "release/manifests/registry-stack-beta-27.yaml"
+        manifest_path.parent.mkdir(parents=True)
+        image_lock_path = self.root / "registryctl-v0.17.0-image-lock.json"
+        manifest = {
+            "stack": {
+                "release": "beta-27",
+                "version": "0.17.0",
+                "source_repo": "registrystack/registry-stack",
+                "source_ref": "4" * 40,
+                "source_tag": "v0.17.0",
+                "status": "released",
+            },
+            "artifacts": {"registry-relay": "0.17.0"},
+        }
+        lock = {
+            "schema_version": image_lock.SCHEMA_V3,
+            "release_tag": "v0.17.0",
+            "manifest_source_ref": "4" * 40,
+            "tag_target": "1" * 40,
+            "platform": image_lock.PLATFORM,
+            "images": {
+                "registry-relay": self.relay,
+                "postgresql": self.postgresql,
+            },
+        }
+
+        with (
+            mock.patch.object(self.module, "REPO_ROOT", self.root),
+            mock.patch.object(self.module, "verify_git_binding"),
+            mock.patch.object(
+                self.module,
+                "verify_release_asset_binding",
+                return_value="5" * 64,
+            ),
+        ):
+            candidate = self.module._load_candidate_snapshot(
+                manifest_path,
+                image_lock_path,
+                json.dumps(manifest).encode(),
+                json.dumps(lock).encode(),
+            )
+
+        self.assertEqual(self.relay, candidate["relay_image"])
+        self.assertNotIn("notary_image", candidate)
+
     def test_v2_capsule_rejects_missing_drifted_extra_or_wrong_role_image(self) -> None:
         mutations = (
             (
diff --git a/release/scripts/test_first_country_release_form.py b/release/scripts/test_first_country_release_form.py
index 5f700f26f..91991b7dd 100644
--- a/release/scripts/test_first_country_release_form.py
+++ b/release/scripts/test_first_country_release_form.py
@@ -1029,7 +1029,7 @@ def operation(command: list[str]) -> str:
                 return "up"
             if "ps" in command:
                 return "ps"
-            self.fail(f"unexpected governed-start command: {command}")
+            raise AssertionError(f"unexpected governed-start command: {command}")
 
         self.assertEqual(
             [operation(command) for command in commands],
diff --git a/release/scripts/test_integration_e2_runner.py b/release/scripts/test_integration_e2_runner.py
deleted file mode 100644
index 54b7fe6c8..000000000
--- a/release/scripts/test_integration_e2_runner.py
+++ /dev/null
@@ -1,962 +0,0 @@
-#!/usr/bin/env python3
-from __future__ import annotations
-
-import hashlib
-import importlib.util
-import io
-import json
-import os
-import shlex
-import stat
-import subprocess
-import sys
-import tempfile
-from contextlib import redirect_stderr
-from pathlib import Path
-from unittest import TestCase, main, mock
-
-
-ROOT = Path(__file__).resolve().parents[2]
-SCRIPT = ROOT / "release" / "scripts" / "integration-e2-runner.py"
-sys.path.insert(0, str(SCRIPT.parent))
-import registryctl_image_lock as image_lock  # noqa: E402
-
-
-def load_module():
-    spec = importlib.util.spec_from_file_location("integration_e2_runner", SCRIPT)
-    if spec is None or spec.loader is None:
-        raise ImportError(f"could not load module spec from {SCRIPT}")
-    module = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(module)
-    return module
-
-
-class IntegrationE2RunnerTest(TestCase):
-    def setUp(self) -> None:
-        self.module = load_module()
-        self.temporary = tempfile.TemporaryDirectory()
-        self.root = Path(self.temporary.name)
-        self.tag = "v0.13.0"
-        self.commit = "1" * 40
-        self.relay = "ghcr.io/registrystack/registry-relay@sha256:" + "2" * 64
-        self.notary = "ghcr.io/registrystack/registry-notary@sha256:" + "3" * 64
-
-    def tearDown(self) -> None:
-        self.temporary.cleanup()
-
-    @staticmethod
-    def write_json(path: Path, value: object) -> None:
-        path.write_text(json.dumps(value, sort_keys=True) + "\n", encoding="utf-8")
-
-    def make_candidate(
-        self,
-        *,
-        candidate_name: str = "candidate",
-        include_postgresql: bool = True,
-        postgresql_ref: str | None = None,
-    ) -> Path:
-        candidate = self.root / candidate_name
-        candidate.mkdir()
-        version = self.tag.removeprefix("v")
-        binary_name = f"registryctl-{self.tag}-linux-amd64"
-        lock_name = f"registryctl-{self.tag}-image-lock.json"
-        capsule_name = f"registry-stack-{self.tag}-release-capsule.json"
-        (candidate / binary_name).write_text(
-            f"#!/bin/sh\nprintf 'registryctl {version}\\n'\n",
-            encoding="utf-8",
-        )
-        schema_version = self.module.schema_for_release_version(version)
-        images = {
-            "registry-relay": self.relay,
-            "registry-notary": self.notary,
-        }
-        if schema_version == image_lock.SCHEMA_V2 and include_postgresql:
-            images["postgresql"] = (
-                postgresql_ref or image_lock.reviewed_postgresql_image_ref()
-            )
-        lock = {
-            "schema_version": schema_version,
-            "release_tag": self.tag,
-            "manifest_source_ref": "4" * 40,
-            "tag_target": self.commit,
-            "platform": "linux/amd64",
-            "images": images,
-        }
-        self.write_json(candidate / lock_name, lock)
-        lock_sha = hashlib.sha256((candidate / lock_name).read_bytes()).hexdigest()
-        lock_sbom_name = f"{lock_name}.spdx.json"
-        lock_subject_id = "SPDXRef-lock-subject"
-        self.write_json(
-            candidate / lock_sbom_name,
-            {
-                "documentDescribes": [lock_subject_id],
-                "packages": [
-                    {
-                        "SPDXID": lock_subject_id,
-                        "name": lock_name,
-                        "packageFileName": lock_name,
-                        "checksums": [
-                            {"algorithm": "SHA256", "checksumValue": lock_sha}
-                        ],
-                    }
-                ],
-            },
-        )
-        (candidate / "registry-relay.digest").write_text(
-            self.relay + "\n", encoding="utf-8"
-        )
-        (candidate / "registry-notary.digest").write_text(
-            self.notary + "\n", encoding="utf-8"
-        )
-        capsule = {
-            "release_tag": self.tag,
-            "version": version,
-            "repository": self.module.CAPSULE_REPOSITORY,
-            "source": {
-                "source_tag": self.tag,
-                "source_ref": "4" * 40,
-                "source_commit": self.commit,
-                "lineage": {
-                    "tag_matches_source_tag": True,
-                    "head_matches_tag_target": True,
-                    "source_ref_ancestor_or_equal": True,
-                    "default_branch_reachable": True,
-                },
-            },
-            "binaries": [
-                {
-                    "name": binary_name,
-                    "sha256": hashlib.sha256(
-                        (candidate / binary_name).read_bytes()
-                    ).hexdigest(),
-                }
-            ],
-            "release_files": [
-                {
-                    "name": lock_name,
-                    "kind": "registryctl-release-image-lock",
-                    "sha256": lock_sha,
-                    "sbom": {
-                        "asset_name": lock_sbom_name,
-                        "subject": lock_name,
-                        "format": "spdx-json",
-                        "sha256": hashlib.sha256(
-                            (candidate / lock_sbom_name).read_bytes()
-                        ).hexdigest(),
-                    },
-                }
-            ],
-            "images": [
-                {
-                    "name": "registry-relay",
-                    "role": "released-product-image",
-                    "digest_ref": self.relay,
-                },
-                {
-                    "name": "registry-notary",
-                    "role": "released-product-image",
-                    "digest_ref": self.notary,
-                },
-                *(
-                    [
-                        {
-                            "name": "postgresql",
-                            "role": "supporting-runtime-image",
-                            "digest_ref": images["postgresql"],
-                        }
-                    ]
-                    if (
-                        schema_version == image_lock.SCHEMA_V2
-                        and "postgresql" in images
-                    )
-                    else []
-                ),
-            ],
-        }
-        self.write_json(candidate / capsule_name, capsule)
-        binary_sha = hashlib.sha256((candidate / binary_name).read_bytes()).hexdigest()
-        (candidate / "SHA256SUMS").write_text(
-            f"{binary_sha}  {binary_name}\n{lock_sha}  {lock_name}\n",
-            encoding="utf-8",
-        )
-        for name in self.module.signed_subject_names(self.tag):
-            self.assertTrue((candidate / name).exists())
-            (candidate / f"{name}.sig").write_text(
-                "fixture signature\n", encoding="utf-8"
-            )
-            (candidate / f"{name}.pem").write_text(
-                "fixture certificate\n", encoding="utf-8"
-            )
-        (
-            candidate / f"registry-stack-{self.tag}-release-provenance.intoto.jsonl"
-        ).write_text("fixture provenance\n", encoding="utf-8")
-        self.assertEqual(
-            self.module.required_asset_names(self.tag),
-            {path.name for path in candidate.iterdir()},
-        )
-        return candidate
-
-    def binary_result(self, *_args, **_kwargs):
-        return subprocess.CompletedProcess(
-            [],
-            0,
-            f"registryctl {self.tag.removeprefix('v')}\n",
-            "",
-        )
-
-    def candidate_metadata(self, candidate: Path) -> dict[str, str]:
-        return self.module.verify_candidate_assets(
-            candidate,
-            self.tag,
-            authenticate=lambda _directory, _tag: None,
-            binary_runner=self.binary_result,
-        )
-
-    def make_canary_file(self) -> Path:
-        path = self.root / "canaries"
-        path.write_text("registry-secret-canary-72\n", encoding="utf-8")
-        path.chmod(0o600)
-        return path
-
-    def make_result(self, profile_id: str, candidate: Path) -> dict[str, object]:
-        profile = self.module.load_profile(profile_id)
-        operation = next(
-            item for item in profile["source"]["operations"] if item["role"] == "data"
-        )
-        hash_value = "sha256:" + "a" * 64
-        cases = []
-        for expected in profile["cases"]:
-            not_applicable = expected["expected_source_data_access"] == "not_applicable"
-            cases.append(
-                {
-                    "case_id": expected["id"],
-                    "outcome": "not_applicable" if not_applicable else "passed",
-                    "started_at": "2026-07-19T01:00:00Z",
-                    "completed_at": "2026-07-19T01:00:01Z",
-                    "duration_ms": 1000,
-                    "result_code": expected["expected_result_code"],
-                    "source_data_access": expected["expected_source_data_access"],
-                    "source_data_access_evidence_sha256": hash_value,
-                    "audit_correlation_sha256": hash_value,
-                    "evidence_sha256": hash_value,
-                }
-            )
-        candidate_metadata = self.candidate_metadata(candidate)
-        return {
-            "schema_version": self.module.RESULT_SCHEMA,
-            "record_kind": "candidate_evidence",
-            "run_id": "candidate-1",
-            "profile_id": profile_id,
-            "support_status": self.module.SUPPORT_STATUS,
-            "status": "passed",
-            "started_at": "2026-07-19T01:00:00Z",
-            "completed_at": "2026-07-19T01:03:00Z",
-            "release": {
-                **candidate_metadata,
-                "candidate_assets_verified": True,
-                "authenticity_verified": True,
-            },
-            "source": {
-                "product": profile["source"]["product"],
-                "baseline": profile["source"]["baseline"],
-                "operation_id": operation["id"],
-                "method": operation["method"],
-                "path": operation["path"],
-                "owner_attestation_sha256": hash_value,
-            },
-            "project": {
-                "starter": profile["starter"],
-                "starter_content_digest": hash_value,
-                "authored_inputs_sha256": hash_value,
-                "build_review_sha256": hash_value,
-                "relay_closure_sha256": hash_value,
-                "notary_closure_sha256": hash_value,
-                "generated_files_unchanged": True,
-            },
-            "cases": cases,
-            "redaction": {
-                "passed": True,
-                "scanned_artifacts": 1,
-                "scanned_bytes": 65536,
-                "seeded_canaries": 1,
-                "forbidden_values_found": 0,
-                "restricted_raw_evidence_bytes": 4096,
-                "raw_evidence_retained_restricted": True,
-                "report_sha256": hash_value,
-            },
-            "teardown": {
-                "attempted": True,
-                "status": "completed",
-                "started_at": "2026-07-19T01:01:59Z",
-                "duration_ms": 1000,
-                "completed_at": "2026-07-19T01:02:00Z",
-                "evidence_sha256": hash_value,
-            },
-            "limitations": [
-                "unofficial-integration-profile",
-                "single-pinned-product-version",
-                "single-reviewed-read-operation",
-                "non-production-instance",
-                "not-product-certification",
-                "not-general-country-system-conformance",
-            ],
-        }
-
-    def write_result(self, result: dict[str, object]) -> Path:
-        path = self.root / "public-result.json"
-        self.write_json(path, result)
-        return path
-
-    def test_checked_in_packet_is_closed_and_valid(self) -> None:
-        self.module.validate_packet()
-
-    def test_pilot_report_template_preserves_the_public_contract(self) -> None:
-        readme = (self.module.CONFIG_DIR / "README.md").read_text(encoding="utf-8")
-        template = (
-            self.module.CONFIG_DIR / "pilot-report.template.md"
-        ).read_text(encoding="utf-8")
-        normalized_template = " ".join(template.split())
-        self.assertIn("(pilot-report.template.md)", readme)
-        self.assertIn(
-            "Do not include credentials, network origins, operator or source "
-            "identifiers, record identifiers, raw audits, private evidence, or "
-            "links to restricted evidence.",
-            normalized_template,
-        )
-        self.assertNotIn("Solmara", template)
-        self.assertIn(
-            "python3 release/scripts/integration-e2-runner.py validate",
-            normalized_template,
-        )
-        self.assertNotIn("schema-valid public result", normalized_template)
-        self.assertIn(
-            "Issue closure still requires a frozen published candidate, an "
-            "independent operator, an owner-approved source, and a confirmed "
-            "maintainer comparison of the public hashes and flags with the "
-            "generated project, source audit records, redaction report, and "
-            "teardown evidence.",
-            normalized_template,
-        )
-        self.assertIn(
-            "It cannot close unless the maintainer comparison above is confirmed.",
-            normalized_template,
-        )
-        for text in (
-            "Sanitized run result:",
-            "Plans, dry runs",
-            "One completed pilot is not proof of broad production readiness.",
-            "Frozen Registry Stack candidate:",
-            "Independent operator:",
-            "Owner-approved non-production source:",
-            "Maintainer comparison of public hashes and flags with restricted "
-            "evidence:",
-            "### Blocking findings",
-            "### Accepted limitations and narrowed support",
-            "Operator handoff and independence",
-            "Install or deployment",
-            "Configuration and environment binding",
-            "Diagnostics and ordinary source failures",
-            "Upgrade or rollback",
-            "Restart, teardown, and other operations",
-            "Security boundaries and redaction",
-            "Documentation and operator journey",
-        ):
-            self.assertIn(text, template)
-
-    def test_nested_result_objects_must_remain_closed(self) -> None:
-        schema = self.module.load_json(self.module.SCHEMA_PATH)
-        schema["$defs"]["case"]["additionalProperties"] = True
-        with self.assertRaisesRegex(self.module.RunnerError, "open object schema"):
-            self.module.assert_closed_schema(schema)
-
-    def test_profile_rejects_a_drifted_upstream_pin(self) -> None:
-        profile = self.module.load_profile("opencrvs-dci-v1.9")
-        profile["source"]["baseline"][0]["commit"] = "0" * 40
-        with self.assertRaisesRegex(
-            self.module.RunnerError, "exact reviewed upstream baseline"
-        ):
-            self.module.validate_profile(profile, "tampered profile")
-
-    def test_dry_run_is_explicitly_not_evidence_and_hides_values(self) -> None:
-        profile = self.module.load_profile("opencrvs-dci-v1.9")
-        plan = self.module.plan_document(profile)
-        self.assertFalse(plan["candidate_evidence"])
-        self.assertEqual("planned_not_executed", plan["status"])
-        self.assertEqual("approved_operator_wrapper", plan["executor"])
-        self.assertIn("OPENCRVS_CLIENT_SECRET", plan["required_input_names"])
-        self.assertEqual(
-            self.module.CASE_IDS, tuple(case["id"] for case in plan["cases"])
-        )
-        self.assertIn(
-            "/registry/sync/search",
-            [operation["path"] for operation in plan["source_operations"]],
-        )
-        serialized = json.dumps(plan)
-        self.assertNotIn("secret value", serialized)
-        self.assertTrue(
-            any("compatibility probe" in item for item in plan["prerequisites"])
-        )
-
-    def test_dhis2_plan_includes_reviewed_child_health_metadata(self) -> None:
-        profile = self.module.load_profile("dhis2-tracker-2.41.9")
-        plan = self.module.plan_document(profile)
-        required = set(plan["required_input_names"])
-        self.assertTrue(
-            {
-                "DHIS2_CHILD_PROGRAM_UID",
-                "DHIS2_CHILD_VISIT_STAGE_UID",
-                "DHIS2_BCG_BIRTH_STAGE_UID",
-                "DHIS2_OPV_BIRTH_STAGE_UID",
-                "DHIS2_MEASLES_STAGE_UID",
-            }.issubset(required)
-        )
-        self.assertTrue(
-            {
-                "DHIS2_MATERNAL_PROGRAM_UID",
-                "DHIS2_TB_PROGRAM_UID",
-                "DHIS2_FIRST_NAME_ATTRIBUTE_UID",
-                "DHIS2_BIRTH_DATE_ATTRIBUTE_UID",
-            }.issubset(required)
-        )
-
-    def test_candidate_assets_cross_validate_all_release_bindings(self) -> None:
-        candidate = self.make_candidate()
-        metadata = self.candidate_metadata(candidate)
-        self.assertEqual(self.relay, metadata["relay_image"])
-        self.assertEqual(self.commit, metadata["source_commit"])
-
-    def test_candidate_assets_accept_v2_with_reviewed_postgresql(self) -> None:
-        self.tag = "v0.14.0"
-        candidate = self.make_candidate()
-
-        metadata = self.candidate_metadata(candidate)
-
-        self.assertEqual(self.relay, metadata["relay_image"])
-        self.assertEqual("0.14.0", metadata["version"])
-
-    def test_candidate_assets_reject_v2_without_reviewed_postgresql(self) -> None:
-        self.tag = "v0.14.0"
-        missing = self.make_candidate(include_postgresql=False)
-        with self.assertRaisesRegex(self.module.RunnerError, "must contain exactly"):
-            self.candidate_metadata(missing)
-
-        drifted = self.make_candidate(
-            candidate_name="drifted-candidate",
-            postgresql_ref="docker.io/library/postgres@sha256:" + "9" * 64,
-        )
-        with self.assertRaisesRegex(
-            self.module.RunnerError,
-            "reviewed release-tooling pin",
-        ):
-            self.candidate_metadata(drifted)
-
-    def test_candidate_assets_reject_v2_capsule_missing_postgresql(self) -> None:
-        self.tag = "v0.14.0"
-        candidate = self.make_candidate()
-        capsule_path = candidate / f"registry-stack-{self.tag}-release-capsule.json"
-        capsule = json.loads(capsule_path.read_text(encoding="utf-8"))
-        capsule["images"] = [
-            image for image in capsule["images"] if image["name"] != "postgresql"
-        ]
-        self.write_json(capsule_path, capsule)
-
-        with self.assertRaisesRegex(self.module.RunnerError, "image-lock images"):
-            self.candidate_metadata(candidate)
-
-    def test_candidate_assets_rejects_v2_capsule_postgresql_drift_or_role(self) -> None:
-        self.tag = "v0.14.0"
-        for mutation, message in (
-            (
-                lambda image: image.__setitem__(
-                    "digest_ref", "docker.io/library/postgres@sha256:" + "9" * 64
-                ),
-                "do not match the candidate image lock",
-            ),
-            (
-                lambda image: image.__setitem__("role", "released-product-image"),
-                "supporting-runtime-image",
-            ),
-        ):
-            with self.subTest(message=message):
-                candidate = self.make_candidate(candidate_name=message)
-                capsule_path = (
-                    candidate / f"registry-stack-{self.tag}-release-capsule.json"
-                )
-                capsule = json.loads(capsule_path.read_text(encoding="utf-8"))
-                postgresql = next(
-                    image
-                    for image in capsule["images"]
-                    if image["name"] == "postgresql"
-                )
-                mutation(postgresql)
-                self.write_json(capsule_path, capsule)
-
-                with self.assertRaisesRegex(self.module.RunnerError, message):
-                    self.candidate_metadata(candidate)
-
-    def test_candidate_assets_rejects_extra_v2_capsule_image(self) -> None:
-        self.tag = "v0.14.0"
-        candidate = self.make_candidate()
-        capsule_path = candidate / f"registry-stack-{self.tag}-release-capsule.json"
-        capsule = json.loads(capsule_path.read_text(encoding="utf-8"))
-        capsule["images"].append(
-            {
-                "name": "unreviewed-image",
-                "digest_ref": "docker.io/example/unreviewed@sha256:" + "9" * 64,
-            }
-        )
-        self.write_json(capsule_path, capsule)
-
-        with self.assertRaisesRegex(self.module.RunnerError, "image-lock images"):
-            self.candidate_metadata(candidate)
-
-    def test_candidate_assets_rejects_wrong_product_image_role(self) -> None:
-        self.tag = "v0.14.0"
-        for component in ("registry-relay", "registry-notary"):
-            with self.subTest(component=component):
-                candidate = self.make_candidate(candidate_name=component)
-                capsule_path = (
-                    candidate / f"registry-stack-{self.tag}-release-capsule.json"
-                )
-                capsule = json.loads(capsule_path.read_text(encoding="utf-8"))
-                image = next(
-                    item for item in capsule["images"] if item["name"] == component
-                )
-                image["role"] = "supporting-runtime-image"
-                self.write_json(capsule_path, capsule)
-
-                with self.assertRaisesRegex(
-                    self.module.RunnerError, "released-product-image"
-                ):
-                    self.candidate_metadata(candidate)
-
-    def test_authenticity_precedes_candidate_binary_execution(self) -> None:
-        candidate = self.make_candidate()
-        events = []
-
-        def authenticate(directory, _tag):
-            self.assertNotEqual(candidate, directory)
-            events.append("authenticated")
-
-        def execute(*_args, **_kwargs):
-            self.assertEqual(["authenticated"], events)
-            events.append("executed")
-            return self.binary_result()
-
-        self.module.verify_candidate_assets(
-            candidate,
-            self.tag,
-            authenticate=authenticate,
-            binary_runner=execute,
-        )
-        self.assertEqual(["authenticated", "executed"], events)
-
-    def test_authenticity_failure_prevents_candidate_binary_execution(self) -> None:
-        candidate = self.make_candidate()
-        events = []
-        snapshots = []
-
-        def reject_authenticity(directory, _tag):
-            snapshots.append(directory)
-            events.append("authenticity-rejected")
-            raise self.module.RunnerError("invalid signature fixture")
-
-        def execute(*_args, **_kwargs):
-            events.append("executed")
-            return self.binary_result()
-
-        with self.assertRaisesRegex(self.module.RunnerError, "invalid signature"):
-            self.module.verify_candidate_assets(
-                candidate,
-                self.tag,
-                authenticate=reject_authenticity,
-                binary_runner=execute,
-            )
-        self.assertEqual(["authenticity-rejected"], events)
-        self.assertEqual(1, len(snapshots))
-        self.assertFalse(snapshots[0].exists())
-
-    def test_subject_change_during_authenticity_prevents_binary_execution(self) -> None:
-        candidate = self.make_candidate()
-        events = []
-
-        def mutate_during_authenticity(directory, _tag):
-            binary = directory / f"registryctl-{self.tag}-linux-amd64"
-            binary.chmod(0o700)
-            binary.write_bytes(b"changed-after-passive-checks")
-            events.append("mutated")
-
-        def execute(*_args, **_kwargs):
-            events.append("executed")
-            return self.binary_result()
-
-        with self.assertRaisesRegex(self.module.RunnerError, "changed during"):
-            self.module.verify_candidate_assets(
-                candidate,
-                self.tag,
-                authenticate=mutate_during_authenticity,
-                binary_runner=execute,
-            )
-        self.assertEqual(["mutated"], events)
-
-    def test_original_binary_replacement_after_final_hash_never_executes(self) -> None:
-        candidate = self.make_candidate()
-        original_binary = candidate / f"registryctl-{self.tag}-linux-amd64"
-        replacement_marker = self.root / "replacement-executed"
-        snapshots = []
-
-        def authenticate(directory, _tag):
-            snapshots.append(directory)
-            self.assertEqual(0o500, stat.S_IMODE(directory.stat().st_mode))
-            self.assertEqual(os.geteuid(), directory.stat().st_uid)
-            for asset in directory.iterdir():
-                self.assertEqual(0, asset.stat().st_mode & 0o222)
-
-        def replace_original_then_execute(command, **kwargs):
-            self.assertNotEqual(original_binary, Path(command[0]))
-            original_binary.write_text(
-                "#!/bin/sh\n"
-                f": > {shlex.quote(str(replacement_marker))}\n"
-                f"printf 'registryctl {self.tag.removeprefix('v')}\\n'\n",
-                encoding="utf-8",
-            )
-            original_binary.chmod(0o700)
-            return subprocess.run(command, **kwargs)
-
-        self.module.verify_candidate_assets(
-            candidate,
-            self.tag,
-            authenticate=authenticate,
-            binary_runner=replace_original_then_execute,
-        )
-        self.assertFalse(replacement_marker.exists())
-        self.assertEqual(1, len(snapshots))
-        self.assertFalse(snapshots[0].exists())
-
-    def test_late_passive_binding_failure_prevents_binary_execution(self) -> None:
-        candidate = self.make_candidate()
-        capsule_path = candidate / f"registry-stack-{self.tag}-release-capsule.json"
-        capsule = json.loads(capsule_path.read_text(encoding="utf-8"))
-        capsule["images"][1]["digest_ref"] = (
-            "ghcr.io/registrystack/registry-notary@sha256:" + "9" * 64
-        )
-        self.write_json(capsule_path, capsule)
-        events = []
-
-        def authenticate(_directory, _tag):
-            events.append("authenticated")
-
-        def execute(*_args, **_kwargs):
-            events.append("executed")
-            return self.binary_result()
-
-        with self.assertRaisesRegex(self.module.RunnerError, "capsule images"):
-            self.module.verify_candidate_assets(
-                candidate,
-                self.tag,
-                authenticate=authenticate,
-                binary_runner=execute,
-            )
-        self.assertEqual([], events)
-
-    def test_candidate_rejects_an_unexpected_asset(self) -> None:
-        candidate = self.make_candidate()
-        (candidate / "unreviewed-output.txt").write_text("no\n", encoding="utf-8")
-        with self.assertRaisesRegex(self.module.RunnerError, "asset set is not closed"):
-            self.candidate_metadata(candidate)
-
-    def test_candidate_rejects_digest_not_bound_by_image_lock(self) -> None:
-        candidate = self.make_candidate()
-        (candidate / "registry-relay.digest").write_text(
-            "ghcr.io/registrystack/registry-relay@sha256:" + "9" * 64 + "\n",
-            encoding="utf-8",
-        )
-        with self.assertRaisesRegex(
-            self.module.RunnerError, "do not match the image lock"
-        ):
-            self.candidate_metadata(candidate)
-
-    def test_candidate_rejects_an_image_lock_sbom_for_the_wrong_subject(self) -> None:
-        candidate = self.make_candidate()
-        sbom = candidate / f"registryctl-{self.tag}-image-lock.json.spdx.json"
-        document = json.loads(sbom.read_text(encoding="utf-8"))
-        document["packages"][0]["checksums"][0]["checksumValue"] = "0" * 64
-        self.write_json(sbom, document)
-        with self.assertRaisesRegex(self.module.RunnerError, "does not describe"):
-            self.candidate_metadata(candidate)
-
-    def test_candidate_authenticity_cannot_silently_skip_missing_tools(self) -> None:
-        candidate = self.make_candidate()
-        with mock.patch.object(self.module.shutil, "which", return_value=None):
-            with self.assertRaisesRegex(self.module.RunnerError, "requires installed"):
-                self.module.verify_authenticity(candidate, self.tag)
-
-    def test_candidate_authenticity_binds_every_subject_to_tagged_workflow(
-        self,
-    ) -> None:
-        candidate = self.make_candidate()
-        commands = []
-        with mock.patch.object(
-            self.module.shutil,
-            "which",
-            side_effect=["/tools/cosign", "/tools/slsa-verifier"],
-        ):
-            self.module.verify_authenticity(
-                candidate, self.tag, command_runner=commands.append
-            )
-        self.assertEqual(12, len(commands))
-        cosign_commands = [
-            command for command in commands if command[0].endswith("cosign")
-        ]
-        self.assertEqual(6, len(cosign_commands))
-        identity = self.module.RELEASE_WORKFLOW.format(tag=self.tag)
-        self.assertTrue(
-            all(
-                command[command.index("--certificate-identity") + 1] == identity
-                for command in cosign_commands
-            )
-        )
-
-    def test_cli_rejects_symlink_candidate_directory_before_normalization(self) -> None:
-        candidate = self.make_candidate()
-        candidate_link = self.root / "candidate-link"
-        candidate_link.symlink_to(candidate, target_is_directory=True)
-        stderr = io.StringIO()
-        with redirect_stderr(stderr):
-            status = self.module.main(
-                [
-                    "validate",
-                    "--candidate-dir",
-                    str(candidate_link),
-                    "--tag",
-                    self.tag,
-                ]
-            )
-        self.assertEqual(1, status)
-        self.assertIn("non-symlink directory", stderr.getvalue())
-
-    def test_json_const_does_not_accept_integer_for_true(self) -> None:
-        with self.assertRaisesRegex(self.module.RunnerError, "must equal True"):
-            self.module.validate_against_schema(1, {"const": True}, {})
-
-    def test_json_boolean_enum_does_not_accept_integer(self) -> None:
-        with self.assertRaisesRegex(self.module.RunnerError, "closed allowed set"):
-            self.module.validate_against_schema(1, {"enum": [True, False]}, {})
-
-    def test_full_result_rejects_integer_for_boolean_attestation(self) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("opencrvs-dci-v1.9", candidate)
-        result["project"]["generated_files_unchanged"] = 1
-        with self.assertRaisesRegex(self.module.RunnerError, "must equal True"):
-            self.module.validate_result(
-                self.write_result(result),
-                self.module.load_profile("opencrvs-dci-v1.9"),
-                self.make_canary_file(),
-            )
-
-    def test_valid_opencrvs_result_passes(self) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("opencrvs-dci-v1.9", candidate)
-        path = self.write_result(result)
-        validated = self.module.validate_result(
-            path, self.module.load_profile("opencrvs-dci-v1.9"), self.make_canary_file()
-        )
-        self.assertEqual("passed", validated["status"])
-
-    def test_valid_dhis2_result_records_singleton_ambiguity_as_not_applicable(
-        self,
-    ) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("dhis2-tracker-2.41.9", candidate)
-        path = self.write_result(result)
-        self.module.validate_result(
-            path,
-            self.module.load_profile("dhis2-tracker-2.41.9"),
-            self.make_canary_file(),
-        )
-
-    def test_pre_source_denial_cannot_pass_after_source_contact(self) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("opencrvs-dci-v1.9", candidate)
-        invalid_selector = next(
-            case for case in result["cases"] if case["case_id"] == "invalid-selector"
-        )
-        invalid_selector["source_data_access"] = "contacted_once"
-        with self.assertRaisesRegex(
-            self.module.RunnerError, "expected source-side access evidence"
-        ):
-            self.module.validate_result(
-                self.write_result(result),
-                self.module.load_profile("opencrvs-dci-v1.9"),
-                self.make_canary_file(),
-            )
-
-    def test_passed_case_requires_the_reviewed_safe_result_code(self) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("opencrvs-dci-v1.9", candidate)
-        result["cases"][0]["result_code"] = "unexpected-result"
-        with self.assertRaisesRegex(
-            self.module.RunnerError, "reviewed safe result code"
-        ):
-            self.module.validate_result(
-                self.write_result(result),
-                self.module.load_profile("opencrvs-dci-v1.9"),
-                self.make_canary_file(),
-            )
-
-    def test_unknown_public_raw_evidence_field_is_rejected(self) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("opencrvs-dci-v1.9", candidate)
-        result["raw_output"] = "must never be public"
-        with self.assertRaisesRegex(self.module.RunnerError, "unknown fields"):
-            self.module.validate_result(
-                self.write_result(result),
-                self.module.load_profile("opencrvs-dci-v1.9"),
-                self.make_canary_file(),
-            )
-
-    def test_seeded_canary_in_public_result_is_rejected_before_schema_validation(
-        self,
-    ) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("opencrvs-dci-v1.9", candidate)
-        result["run_id"] = "registry-secret-canary-72"
-        with self.assertRaisesRegex(
-            self.module.RunnerError, "seeded restricted-value canary"
-        ):
-            self.module.validate_result(
-                self.write_result(result),
-                self.module.load_profile("opencrvs-dci-v1.9"),
-                self.make_canary_file(),
-            )
-
-    def test_canary_file_must_be_owner_only(self) -> None:
-        canaries = self.make_canary_file()
-        canaries.chmod(0o644)
-        with self.assertRaisesRegex(self.module.RunnerError, "group or other"):
-            self.module.read_canaries(canaries)
-
-    def test_failed_run_is_accepted_as_honest_non_closing_evidence(self) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("opencrvs-dci-v1.9", candidate)
-        result["status"] = "failed"
-        result["cases"][0]["outcome"] = "failed"
-        result["cases"][0]["source_data_access"] = "unknown"
-        self.module.validate_result(
-            self.write_result(result),
-            self.module.load_profile("opencrvs-dci-v1.9"),
-            self.make_canary_file(),
-        )
-
-    def test_passed_status_requires_successful_teardown(self) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("opencrvs-dci-v1.9", candidate)
-        result["teardown"]["status"] = "failed"
-        with self.assertRaisesRegex(self.module.RunnerError, "status is inconsistent"):
-            self.module.validate_result(
-                self.write_result(result),
-                self.module.load_profile("opencrvs-dci-v1.9"),
-                self.make_canary_file(),
-            )
-
-    def test_case_duration_must_match_timestamps(self) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("opencrvs-dci-v1.9", candidate)
-        result["cases"][0]["duration_ms"] = 999
-        with self.assertRaisesRegex(
-            self.module.RunnerError, "duration_ms does not match"
-        ):
-            self.module.validate_result(
-                self.write_result(result),
-                self.module.load_profile("opencrvs-dci-v1.9"),
-                self.make_canary_file(),
-            )
-
-    def test_case_duration_supports_millisecond_timestamp_precision(self) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("opencrvs-dci-v1.9", candidate)
-        result["cases"][0]["completed_at"] = "2026-07-19T01:00:00.250Z"
-        result["cases"][0]["duration_ms"] = 250
-        self.module.validate_result(
-            self.write_result(result),
-            self.module.load_profile("opencrvs-dci-v1.9"),
-            self.make_canary_file(),
-        )
-
-    def test_case_timestamp_elapsed_time_must_respect_profile_bound(self) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("opencrvs-dci-v1.9", candidate)
-        result["cases"][0]["completed_at"] = "2026-07-19T01:01:01Z"
-        result["cases"][0]["duration_ms"] = 61000
-        with self.assertRaisesRegex(self.module.RunnerError, "profile case timeout"):
-            self.module.validate_result(
-                self.write_result(result),
-                self.module.load_profile("opencrvs-dci-v1.9"),
-                self.make_canary_file(),
-            )
-
-    def test_teardown_started_at_is_required_by_closed_schema(self) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("opencrvs-dci-v1.9", candidate)
-        del result["teardown"]["started_at"]
-        with self.assertRaisesRegex(self.module.RunnerError, "started_at"):
-            self.module.validate_result(
-                self.write_result(result),
-                self.module.load_profile("opencrvs-dci-v1.9"),
-                self.make_canary_file(),
-            )
-
-    def test_teardown_duration_must_match_timestamps(self) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("opencrvs-dci-v1.9", candidate)
-        result["teardown"]["duration_ms"] = 999
-        with self.assertRaisesRegex(self.module.RunnerError, "teardown duration_ms"):
-            self.module.validate_result(
-                self.write_result(result),
-                self.module.load_profile("opencrvs-dci-v1.9"),
-                self.make_canary_file(),
-            )
-
-    def test_teardown_timestamp_elapsed_time_must_respect_profile_bound(self) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("opencrvs-dci-v1.9", candidate)
-        result["teardown"]["completed_at"] = "2026-07-19T01:07:00Z"
-        result["teardown"]["duration_ms"] = 301000
-        result["completed_at"] = "2026-07-19T01:08:00Z"
-        with self.assertRaisesRegex(self.module.RunnerError, "teardown exceeds"):
-            self.module.validate_result(
-                self.write_result(result),
-                self.module.load_profile("opencrvs-dci-v1.9"),
-                self.make_canary_file(),
-            )
-
-    def test_teardown_cannot_start_before_cases_complete(self) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("opencrvs-dci-v1.9", candidate)
-        result["teardown"]["started_at"] = "2026-07-19T01:00:00Z"
-        result["teardown"]["completed_at"] = "2026-07-19T01:00:01Z"
-        with self.assertRaisesRegex(
-            self.module.RunnerError, "before.*test cases complete"
-        ):
-            self.module.validate_result(
-                self.write_result(result),
-                self.module.load_profile("opencrvs-dci-v1.9"),
-                self.make_canary_file(),
-            )
-
-    def test_public_result_must_retain_all_claim_limitations(self) -> None:
-        candidate = self.make_candidate()
-        result = self.make_result("opencrvs-dci-v1.9", candidate)
-        result["limitations"].remove("non-production-instance")
-        with self.assertRaisesRegex(
-            self.module.RunnerError, "every profile limitation"
-        ):
-            self.module.validate_result(
-                self.write_result(result),
-                self.module.load_profile("opencrvs-dci-v1.9"),
-                self.make_canary_file(),
-            )
-
-
-if __name__ == "__main__":
-    main()
diff --git a/release/scripts/test_openid_conformance_runner.py b/release/scripts/test_openid_conformance_runner.py
index 1f5723f16..d35f99868 100755
--- a/release/scripts/test_openid_conformance_runner.py
+++ b/release/scripts/test_openid_conformance_runner.py
@@ -1,2030 +1,35 @@
 #!/usr/bin/env python3
 # SPDX-License-Identifier: Apache-2.0
+"""Retirement contract for the Notary-only OpenID conformance wrapper."""
+
 from __future__ import annotations
 
-import base64
-import hashlib
-import importlib.util
-import io
-import json
-import re
-import shlex
-import shutil
-import socket
-import ssl
-import stat
-import subprocess
-import sys
-import tempfile
-import threading
-import urllib.parse
-import warnings
-import zipfile
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import unittest
 from pathlib import Path
-from unittest import TestCase, main
-from unittest.mock import MagicMock, patch
-
-
-SCRIPT_DIR = Path(__file__).resolve().parent
-RUNNER_PATH = SCRIPT_DIR / "openid-conformance-runner.py"
-NGINX_DOCKERFILE = SCRIPT_DIR.parent / "conformance" / "openid" / "nginx.Dockerfile"
-TEST_RSA_N = int(
-    "db2a64f46dd9923ff3b52759ded5af43f36ac62ed1c71e889156ea8359d894"
-    "cb80734c311c42dfac407feb6c2cb34c28e2906dd4c5af7b5ee2146e60eb5"
-    "77f786c5ab5fbbe05171cd5214cb4cc7ac9eed3706c74d376beb4cb1404692"
-    "95ace0d72a1fb8024f9978132e3943142314b8e2ed1f2af28df57f1e48955"
-    "5ff59056637bafe88fe5e77074d61f2e9a7e89b93d765e2ca59b93e1b47c"
-    "6662b2dbb7faf37610102e01fc3560555799785afe3963f63939e8cd2654a"
-    "2587fd4828b54724eb7714830dba1e784cd0729e2d90cc8c54da61771022e"
-    "4af010de8aa45555c9eca47f6b757c358bb5b0e5a0bffe0d26aa17ff1e0f"
-    "571c9ade855064cb9d1bfb3f",
-    16,
-)
-TEST_RSA_D = int(
-    "02cffb75ab87343a3fdd5e40e7fc2400a23a078b08441edf2fc646c222c005"
-    "c0cac82ffd1d58ba581287d1b494aa445aedf55e837179fc024eb2666c35f8"
-    "ec78d6231fdcb82686926725c33f3ab484acdce7bf6c8c5e24ba5b34c98db"
-    "3eb2763c2c9d35964a01352a41d89844c4e27a30e74c141802bc58c241ba3"
-    "0dd52fe1fbe4c0ca9876497f1bf7d623c9dc0f58fd6089b45746c6799b9da"
-    "cb42b01fe5b964127d92e7c1d20bb8fee227a835e5b524d26debd01f5139a"
-    "a8ce3cfa571b5284bf8332df8c94e65ba1173c33113d47f40a653d408f427"
-    "a70573a7e77dbfd31f5c0d1caf1e53acc5cbae17e2de2b36ba7a7382987e7"
-    "3277ad8105aeb575a680c9",
-    16,
-)
-sys.path.insert(0, str(SCRIPT_DIR))
-
-
-def load_runner():
-    spec = importlib.util.spec_from_file_location(
-        "openid_conformance_runner", RUNNER_PATH
-    )
-    if not spec or not spec.loader:
-        raise RuntimeError(f"could not load {RUNNER_PATH}")
-    module = importlib.util.module_from_spec(spec)
-    sys.modules[spec.name] = module
-    spec.loader.exec_module(module)
-    return module
-
-
-def nginx_certificate_command(certificate: Path, private_key: Path) -> list[str]:
-    dockerfile = NGINX_DOCKERFILE.read_text(encoding="utf-8")
-    recipe = dockerfile.split("RUN ", 1)[1].split("\nCOPY ", 1)[0]
-    command = shlex.split(recipe.replace("\\\n", " "))
-    command[command.index("-out") + 1] = str(certificate)
-    command[command.index("-keyout") + 1] = str(private_key)
-    return command
 
 
-class EmptyHttpsHandler(BaseHTTPRequestHandler):
-    def do_GET(self) -> None:
-        self.send_response(204)
-        self.end_headers()
+ROOT = Path(__file__).resolve().parents[2]
 
-    def log_message(self, _format: str, *_args) -> None:
-        return
 
-
-class OpenIdConformanceRunnerTest(TestCase):
-    @classmethod
-    def setUpClass(cls) -> None:
-        cls.runner = load_runner()
-        cls.plan_map = cls.runner.load_plan_map()
-
-    def offer_uri(
-        self, issuer: str = "https://issuer.example.test"
-    ) -> tuple[str, str]:
-        grant = "urn:ietf:params:oauth:grant-type:pre-authorized_code"
-        inline = json.dumps(
-            {
-                "credential_issuer": issuer,
-                "credential_configuration_ids": ["person_is_alive_sd_jwt"],
-                "grants": {grant: {"pre-authorized_code": "owner-only-code"}},
-            }
-        )
-        return inline, "openid-credential-offer://?" + urllib.parse.urlencode(
-            {"credential_offer": inline}
+class RetiredOpenIdConformanceRunnerTest(unittest.TestCase):
+    def test_notary_oid4vci_wrapper_is_absent(self) -> None:
+        self.assertFalse(
+            (ROOT / "release/scripts/openid-conformance-runner.py").exists()
         )
-
-    def suite_jwks(self) -> dict[str, object]:
-        def encoded_integer(value: int) -> str:
-            raw = value.to_bytes((value.bit_length() + 7) // 8, "big")
-            return base64.urlsafe_b64encode(raw).decode("ascii").rstrip("=")
-
-        return {
-            "keys": [
-                {
-                    "alg": "RS256",
-                    "e": encoded_integer(65_537),
-                    "kid": "suite-test-key",
-                    "kty": "RSA",
-                    "n": encoded_integer(TEST_RSA_N),
-                    "use": "sig",
-                }
-            ]
+        operational_assets = {
+            path.name
+            for path in (ROOT / "release/conformance/openid").iterdir()
+            if path.name != "initial-report.md"
         }
-
-    def sign_suite_export(self, content: bytes) -> str:
-        encoded_size = (TEST_RSA_N.bit_length() + 7) // 8
-        digest_info = (
-            self.runner.SHA256_DIGEST_INFO_PREFIX + hashlib.sha256(content).digest()
-        )
-        padding_size = encoded_size - len(digest_info) - 3
-        encoded = b"\x00\x01" + b"\xff" * padding_size + b"\x00" + digest_info
-        signature = pow(int.from_bytes(encoded), TEST_RSA_D, TEST_RSA_N).to_bytes(
-            encoded_size, "big"
-        )
-        return base64.urlsafe_b64encode(signature).decode("ascii")
-
-    def suite_jwks_sha256(self) -> str:
-        return self.runner.canonical_sha256(self.suite_jwks())
-
-    def write_private_jwks(self, directory: Path) -> Path:
-        path = directory / "suite-jwks.json"
-        path.write_text(json.dumps(self.suite_jwks()), encoding="utf-8")
-        path.chmod(0o600)
-        return path
-
-    def candidate(self) -> dict[str, object]:
-        return {
-            "release_id": "beta-17",
-            "version": "1.0.0",
-            "source_repo": "registrystack/registry-stack",
-            "source_ref": "a" * 40,
-            "source_tag": "v1.0.0",
-            "tag_target": "b" * 40,
-            "manifest_sha256": f"sha256:{'c' * 64}",
-            "image_lock_sha256": f"sha256:{'d' * 64}",
-            "release_capsule_sha256": f"sha256:{'e' * 64}",
-            "notary_image": (
-                "ghcr.io/registrystack/registry-notary@sha256:" + "f" * 64
-            ),
-            "relay_image": ("ghcr.io/registrystack/registry-relay@sha256:" + "1" * 64),
-            "topology": "release-owned",
-            "solmara_source_ref": None,
-        }
-
-    def suite_export(
-        self,
-        *,
-        result: str = "FAILED",
-        terminal_result: str | None = None,
-        secret: str = "RS_OPENID_SECRET_CANARY_6d5a1f0bc2",
-        transaction_code: str | None = None,
-        warning_source: str = "CredentialMetadataWarning",
-        test_info_version: str = "5.2.0",
-        exported_version: str = "5.2.0",
-        exported_from: str = "https://localhost.emobix.co.uk:8443",
-        issuer_url: str = "https://issuer.example.test",
-    ) -> tuple[str, bytes]:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        module = scenario["suite_modules"][0]
-        test_id = "Ab3dE5fG7hI9jK1"
-        terminal_result = terminal_result or result
-        payload = {
-            "testInfo": {
-                "_id": test_id,
-                "testId": test_id,
-                "testName": module,
-                "variant": scenario["variants"],
-                "started": "2026-07-25T04:00:00.123456Z",
-                "config": {
-                    "alias": "registry-stack-notary-oid4vci-issuer",
-                    "description": (
-                        "Registry Stack Notary OID4VCI issuer conformance slice "
-                        f"[{module}]"
-                    ),
-                    "vci": {
-                        "credential_issuer_url": issuer_url,
-                        "authorization_server": "https://issuer.example.test",
-                        "credential_configuration_id": "person_is_alive_sd_jwt",
-                        "credential_proof_type_hint": "jwt",
-                        "static_tx_code": transaction_code or secret,
-                    },
-                    "client": {"client_id": "client-a"},
-                    "client2": {"client_id": "client-b"},
-                },
-                "description": "private suite description",
-                "alias": "registry-stack-notary-oid4vci-issuer",
-                "owner": {"sub": "private-owner"},
-                "planId": "private-plan-id",
-                "status": "FINISHED",
-                "version": test_info_version,
-                "summary": "private suite summary",
-                "publish": "private",
-                "result": result,
-            },
-            "exportedFrom": exported_from,
-            "exportedBy": {"sub": "private-owner"},
-            "exportedVersion": exported_version,
-            "exportedAt": "Jul 25, 2026, 4:01:00 AM",
-            "results": [
-                {
-                    "src": "MetadataCondition",
-                    "result": "SUCCESS",
-                    "testId": test_id,
-                    "time": 1_784_952_001_000,
-                },
-                {
-                    "src": "MetadataContext",
-                    "result": "INFO",
-                    "testId": test_id,
-                    "time": 1_784_952_001_500,
-                },
-                {
-                    "src": "CredentialMetadataFailure",
-                    "result": "FAILURE",
-                    "testId": test_id,
-                    "msg": "private failure message",
-                    "access_token": secret,
-                    "time": 1_784_952_002_000,
-                },
-                {
-                    "src": warning_source,
-                    "result": "WARNING",
-                    "testId": test_id,
-                    "proof": f"{secret}.proof.payload",
-                    "civil_id": secret,
-                    "time": 1_784_952_003_000,
-                },
-                {
-                    "src": "CredentialMetadataReview",
-                    "result": "REVIEW",
-                    "testId": test_id,
-                    "msg": "private review message",
-                    "time": 1_784_952_004_000,
-                },
-                {
-                    "src": module,
-                    "result": "FINISHED",
-                    "testId": test_id,
-                    "testmodule_result": terminal_result,
-                    "time": 1_784_952_060_000,
-                },
-            ],
-        }
-        encoded_payload = json.dumps(payload).encode("utf-8")
-        json_name = f"test-log-{module}-{test_id}.json"
-        buffer = io.BytesIO()
-        with zipfile.ZipFile(buffer, "w", compression=zipfile.ZIP_DEFLATED) as archive:
-            archive.writestr(json_name, encoded_payload)
-            archive.writestr(
-                json_name.removesuffix(".json") + ".sig",
-                self.sign_suite_export(encoded_payload),
-            )
-        return json_name, buffer.getvalue()
-
-    def write_private_export(self, directory: Path, content: bytes) -> Path:
-        path = directory / "suite-export.zip"
-        path.write_bytes(content)
-        path.chmod(0o600)
-        return path
-
-    def test_plan_map_has_unique_scenarios_and_pinned_suite_ref(self) -> None:
-        scenarios = self.plan_map["scenarios"]
-        self.assertEqual(len(scenarios), len({scenario["id"] for scenario in scenarios}))
-        suite = self.plan_map["suite"]
-        self.assertEqual(40, len(suite["ref"]))
-        self.assertEqual(
-            "https://gitlab.com/openid/conformance-suite.git", suite["repo"]
-        )
-        self.assertEqual(
-            "registry.release.openid_conformance_plan_map.v1",
-            self.plan_map["schema_version"],
-        )
-
-    def test_release_defaults_do_not_reference_retired_lab_paths(self) -> None:
-        self.assertEqual(
-            self.runner.REPO_ROOT / "release" / "conformance" / "openid",
-            self.runner.CONFIG_DIR,
-        )
+        self.assertEqual(set(), operational_assets)
         self.assertTrue(
-            self.runner.DEFAULT_OUTPUT_ROOT.is_relative_to(
-                self.runner.REPO_ROOT / "target"
-            )
-        )
-        serialized = json.dumps(self.plan_map)
-        self.assertNotIn("REGISTRY_LAB_", serialized)
-        self.assertNotIn("blocked-by-lab", serialized)
-
-    def test_list_does_not_require_candidate_yaml_dependencies(self) -> None:
-        result = subprocess.run(
-            [sys.executable, "-S", str(RUNNER_PATH), "list"],
-            cwd=self.runner.REPO_ROOT,
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-
-        self.assertEqual(0, result.returncode, result.stderr)
-        self.assertIn("notary-oid4vci-issuer-metadata", result.stdout)
-
-    def test_readme_documents_the_required_suite_jwks_trust_flow(self) -> None:
-        readme = (
-            self.runner.CONFIG_DIR / "README.md"
-        ).read_text(encoding="utf-8")
-        self.assertIn("export-suite-jwks", readme)
-        self.assertIn("--suite-ca-certificate", readme)
-        self.assertIn("--suite-jwks", readme)
-        self.assertIn("/jwks", readme)
-        self.assertIn("canonical", readme)
-        self.assertIn("signature", readme)
-        self.assertIn("--output-dir", readme)
-        self.assertIn("--export-dir", readme)
-        self.assertIn("operator-attested", readme)
-        self.assertIn("no separate\nUI download step", readme)
-
-    def test_evidence_schema_matches_the_builder_contract(self) -> None:
-        schema = json.loads(
-            self.runner.EVIDENCE_SCHEMA_PATH.read_text(encoding="utf-8")
-        )
-        properties = schema["properties"]
-        self.assertEqual(
-            self.runner.EVIDENCE_SCHEMA_VERSION,
-            properties["schema_version"]["const"],
-        )
-        self.assertEqual(
-            self.runner.EVIDENCE_CLASSIFICATION,
-            properties["classification"]["const"],
-        )
-        self.assertEqual(
-            self.runner.SUITE_RESULTS,
-            set(schema["$defs"]["run"]["properties"]["result"]["enum"]),
-        )
-        self.assertEqual(
-            [
-                {"scenario_id": scenario_id, "status": status}
-                for scenario_id, status in self.runner.EVIDENCE_UNSUPPORTED_SCENARIOS
-            ],
-            properties["unsupported_scenarios"]["const"],
-        )
-        scenario = self.runner.find_scenario(
-            self.plan_map, self.runner.EVIDENCE_SCENARIO_ID
-        )
-        scenario_schema = schema["$defs"]["scenario"]["properties"]
-        self.assertEqual(scenario["id"], scenario_schema["scenario_id"]["const"])
-        self.assertEqual(
-            scenario["suite_plan"], scenario_schema["expected_plan"]["const"]
-        )
-        self.assertEqual(
-            scenario["suite_modules"], scenario_schema["modules"]["const"]
-        )
-        self.assertEqual(
-            scenario["variants"],
-            {
-                name: definition["const"]
-                for name, definition in scenario_schema["variants"][
-                    "properties"
-                ].items()
-            },
-        )
-        self.assertEqual(
-            self.plan_map["suite"]["repo"],
-            schema["$defs"]["suite"]["properties"]["repository"]["const"],
-        )
-        suite_properties = schema["$defs"]["suite"]["properties"]
-        self.assertEqual(
-            self.plan_map["suite"]["release_tag"],
-            suite_properties["release_tag"]["const"],
-        )
-        self.assertEqual(
-            self.plan_map["suite"]["release_tag"].removeprefix("release-v"),
-            suite_properties["reported_version"]["const"],
-        )
-        self.assertEqual(
-            self.plan_map["suite"]["base_url"],
-            suite_properties["exported_from"]["const"],
-        )
-        self.assertEqual(
-            self.runner.EVIDENCE_ASSOCIATION,
-            schema["$defs"]["deployment"]["properties"][
-                "candidate_association"
-            ]["const"],
-        )
-        self.assertEqual(
-            self.runner.EVIDENCE_ASSOCIATION,
-            scenario_schema["plan_association"]["const"],
-        )
-        self.assertEqual(
-            self.runner.EVIDENCE_ASSOCIATION,
-            schema["$defs"]["suite"]["properties"]["commit_association"]["const"],
-        )
-    def test_notary_mapping_is_candidate_only_and_matches_the_1_0_profile(self) -> None:
-        metadata = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        full = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-full"
-        )
-
-        self.assertEqual("candidate-only", metadata["status"])
-        self.assertEqual(
-            "pre_authorization_code", metadata["variants"]["vci_grant_type"]
-        )
-        self.assertIn("registry-backed", metadata["surface"])
-        metadata_notes = " ".join(metadata["notes"])
-        self.assertIn("does not support or claim DPoP", metadata_notes)
-        self.assertIn("frozen candidate artifact", metadata_notes)
-
-        self.assertEqual("blocked-by-suite-profile", full["status"])
-        self.assertEqual(
-            "pre_authorization_code", full["variants"]["vci_grant_type"]
-        )
-        full_contract = " ".join(full["requires"] + full["notes"])
-        self.assertIn("pre-authorized offer", full_contract)
-        self.assertIn("is not a wallet grant", full_contract)
-        self.assertIn("adapter now closes that transport gap", full_contract)
-        self.assertNotIn(
-            "blocked by the suite callback adapter", json.dumps(self.plan_map)
-        )
-        self.assertNotIn(
-            "policy decision on whether the first full run targets",
-            full_contract,
-        )
-        verifier = next(
-            item
-            for item in self.plan_map["non_oidf_surfaces"]
-            if item["surface"] == "Registry Notary Rust SD-JWT verifier"
-        )
-        self.assertIn("not an OID4VP endpoint", verifier["reason"])
-
-    def test_promote_evidence_emits_only_candidate_bound_allowlisted_summary(
-        self,
-    ) -> None:
-        secret = "RS_OPENID_SECRET_CANARY_6d5a1f0bc2"
-        _, raw_export = self.suite_export(secret=secret)
-        with tempfile.TemporaryDirectory() as tmp:
-            root = Path(tmp)
-            suite_export = self.write_private_export(root, raw_export)
-            suite_jwks = self.write_private_jwks(root)
-            output = root / "review" / "summary.json"
-            manifest = (
-                self.runner.REPO_ROOT / "release" / "manifests" / "candidate.yaml"
-            )
-            image_lock = root / "registryctl-v1.0.0-image-lock.json"
-            args = self.runner.parse_args(
-                [
-                    "promote-evidence",
-                    "--suite-export",
-                    str(suite_export),
-                    "--suite-jwks",
-                    str(suite_jwks),
-                    "--release-manifest",
-                    str(manifest),
-                    "--image-lock",
-                    str(image_lock),
-                    "--output",
-                    str(output),
-                ]
-            )
-            candidate = self.candidate()
-            with patch.object(
-                self.runner, "load_authenticated_candidate", return_value=candidate
-            ) as load_candidate:
-                with patch("builtins.print"):
-                    self.assertEqual(0, self.runner.cmd_promote_evidence(args))
-
-            load_candidate.assert_called_once_with(manifest, image_lock)
-            summary_bytes = output.read_bytes()
-            summary = json.loads(summary_bytes)
-            self.assertEqual(0o600, output.stat().st_mode & 0o777)
-            self.assertEqual("FAILED", summary["run"]["result"])
-            self.assertEqual("FINISHED", summary["run"]["terminal_status"])
-            self.assertEqual(
-                "2026-07-25T04:00:00.123456Z", summary["run"]["started_at"]
-            )
-            self.assertEqual("2026-07-25T04:01:00.000Z", summary["run"]["completed_at"])
-            self.assertEqual(
-                {
-                    "info": 1,
-                    "success": 1,
-                    "review": 1,
-                    "warning": 1,
-                    "failure": 1,
-                },
-                summary["run"]["conditions"]["counts"],
-            )
-            self.assertEqual(
-                candidate["tag_target"], summary["candidate"]["tag_target"]
-            )
-            self.assertEqual(
-                candidate["notary_image"], summary["candidate"]["notary_image"]
-            )
-            self.assertTrue(
-                summary["candidate"]["release_assets_authenticity_verified"]
-            )
-            self.assertEqual(
-                "https://issuer.example.test",
-                summary["deployment"]["issuer_url"],
-            )
-            self.assertEqual(
-                self.runner.EVIDENCE_ASSOCIATION,
-                summary["deployment"]["candidate_association"],
-            )
-            self.assertEqual(self.plan_map["suite"]["ref"], summary["suite"]["commit"])
-            self.assertEqual(
-                self.plan_map["suite"]["release_tag"],
-                summary["suite"]["release_tag"],
-            )
-            self.assertEqual("5.2.0", summary["suite"]["reported_version"])
-            self.assertEqual(
-                self.runner.EVIDENCE_ASSOCIATION,
-                summary["suite"]["commit_association"],
-            )
-            self.assertEqual(
-                self.suite_jwks_sha256(), summary["suite"]["jwks_sha256"]
-            )
-            self.assertTrue(summary["suite"]["export_signature_verified"])
-            self.assertEqual(
-                "oid4vci-1_0-issuer-test-plan",
-                summary["scenario"]["expected_plan"],
-            )
-            self.assertEqual(
-                self.runner.EVIDENCE_ASSOCIATION,
-                summary["scenario"]["plan_association"],
-            )
-            self.assertEqual(
-                ["oid4vci-1_0-issuer-metadata-test"],
-                summary["scenario"]["modules"],
-            )
-            self.assertEqual(
-                [
-                    {
-                        "scenario_id": "notary-oid4vci-issuer-full",
-                        "status": "blocked-by-suite-profile",
-                    }
-                ],
-                summary["unsupported_scenarios"],
-            )
-            schema = json.loads(
-                self.runner.EVIDENCE_SCHEMA_PATH.read_text(encoding="utf-8")
-            )
-            self.assertFalse(schema["additionalProperties"])
-            self.assertEqual(set(schema["required"]), set(summary))
-            for definition, field in (
-                ("candidate", "candidate"),
-                ("deployment", "deployment"),
-                ("suite", "suite"),
-                ("scenario", "scenario"),
-                ("configuration", "configuration"),
-                ("run", "run"),
-            ):
-                self.assertEqual(
-                    set(schema["$defs"][definition]["required"]),
-                    set(summary[field]),
-                )
-            self.assertEqual(
-                set(schema["$defs"]["conditions"]["required"]),
-                set(summary["run"]["conditions"]),
-            )
-            self.assertEqual(
-                set(
-                    schema["$defs"]["conditions"]["properties"]["counts"]["required"]
-                ),
-                set(summary["run"]["conditions"]["counts"]),
-            )
-            self.assertEqual(
-                set(
-                    schema["$defs"]["scenario"]["properties"]["variants"][
-                        "required"
-                    ]
-                ),
-                set(summary["scenario"]["variants"]),
-            )
-            self.assertNotIn(secret.encode(), summary_bytes)
-            self.assertNotIn(b"private failure message", summary_bytes)
-            self.assertNotIn(b"private review message", summary_bytes)
-            self.assertNotIn(b"Ab3dE5fG7hI9jK1", summary_bytes)
-            self.assertNotIn(b"private-plan-id", summary_bytes)
-            self.assertFalse(summary["raw_suite_export_included"])
-            self.assertFalse(summary["contains_sensitive_material"])
-
-    def test_promote_evidence_reports_excessive_nesting_as_runner_error(self) -> None:
-        _, raw_export = self.suite_export()
-        with tempfile.TemporaryDirectory() as tmp:
-            root = Path(tmp)
-            args = self.runner.parse_args(
-                [
-                    "promote-evidence",
-                    "--suite-export",
-                    str(self.write_private_export(root, raw_export)),
-                    "--suite-jwks",
-                    str(self.write_private_jwks(root)),
-                    "--release-manifest",
-                    str(root / "candidate.yaml"),
-                    "--image-lock",
-                    str(root / "image-lock.json"),
-                    "--output",
-                    str(root / "summary.json"),
-                ]
-            )
-            with patch.object(
-                self.runner,
-                "load_authenticated_candidate",
-                return_value=self.candidate(),
-            ):
-                with patch.object(
-                    self.runner,
-                    "collect_sensitive_raw_values",
-                    side_effect=RecursionError,
-                ):
-                    with self.assertRaisesRegex(
-                        self.runner.RunnerError, "too deeply nested"
-                    ):
-                        self.runner.cmd_promote_evidence(args)
-
-    def test_promote_evidence_rejects_schema_invalid_generated_summary(
-        self,
-    ) -> None:
-        _, raw_export = self.suite_export()
-        with tempfile.TemporaryDirectory() as tmp:
-            root = Path(tmp)
-            output = root / "summary.json"
-            args = self.runner.parse_args(
-                [
-                    "promote-evidence",
-                    "--suite-export",
-                    str(self.write_private_export(root, raw_export)),
-                    "--suite-jwks",
-                    str(self.write_private_jwks(root)),
-                    "--release-manifest",
-                    str(root / "candidate.yaml"),
-                    "--image-lock",
-                    str(root / "image-lock.json"),
-                    "--output",
-                    str(output),
-                ]
-            )
-            build_summary = self.runner.build_evidence_summary
-
-            def schema_invalid_summary(*arguments):
-                summary, sensitive = build_summary(*arguments)
-                summary["run"]["conditions"]["counts"]["failure"] = -1
-                return summary, sensitive
-
-            with patch.object(
-                self.runner,
-                "load_authenticated_candidate",
-                return_value=self.candidate(),
-            ):
-                with patch.object(
-                    self.runner,
-                    "build_evidence_summary",
-                    side_effect=schema_invalid_summary,
-                ):
-                    with self.assertRaisesRegex(
-                        self.runner.RunnerError, "does not match its schema"
-                    ):
-                        self.runner.cmd_promote_evidence(args)
-            self.assertFalse(output.exists())
-
-    def test_promote_evidence_preserves_each_terminal_suite_result(self) -> None:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        for suite_result in sorted(self.runner.SUITE_RESULTS):
-            with self.subTest(suite_result=suite_result):
-                _, raw_export = self.suite_export(result=suite_result)
-                with tempfile.TemporaryDirectory() as tmp:
-                    suite_export = self.write_private_export(Path(tmp), raw_export)
-                    exported = self.runner.load_suite_export(
-                        suite_export,
-                        scenario["suite_modules"][0],
-                        self.suite_jwks(),
-                    )
-                    summary, _ = self.runner.build_evidence_summary(
-                        self.plan_map,
-                        scenario,
-                        exported,
-                        self.candidate(),
-                        self.suite_jwks_sha256(),
-                    )
-                self.assertEqual(suite_result, summary["run"]["result"])
-
-    def test_promote_evidence_rejects_mismatched_suite_provenance(self) -> None:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        cases = {
-            "testInfo.version": {"test_info_version": "5.2.1"},
-            "exportedVersion": {"exported_version": "5.2.1"},
-            "exportedFrom": {"exported_from": "https://other.example.test"},
-        }
-        for label, overrides in cases.items():
-            with self.subTest(label=label):
-                _, raw_export = self.suite_export(**overrides)
-                with tempfile.TemporaryDirectory() as tmp:
-                    suite_export = self.write_private_export(Path(tmp), raw_export)
-                    exported = self.runner.load_suite_export(
-                        suite_export,
-                        scenario["suite_modules"][0],
-                        self.suite_jwks(),
-                    )
-                with self.assertRaisesRegex(
-                    self.runner.RunnerError, "version|identity"
-                ):
-                    self.runner.build_evidence_summary(
-                        self.plan_map,
-                        scenario,
-                        exported,
-                        self.candidate(),
-                        self.suite_jwks_sha256(),
-                    )
-
-    def test_issuer_url_runtime_and_schema_reject_the_same_unsafe_shapes(
-        self,
-    ) -> None:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        schema = json.loads(
-            self.runner.EVIDENCE_SCHEMA_PATH.read_text(encoding="utf-8")
-        )
-        _, valid_raw_export = self.suite_export()
-        with tempfile.TemporaryDirectory() as tmp:
-            exported = self.runner.load_suite_export(
-                self.write_private_export(Path(tmp), valid_raw_export),
-                scenario["suite_modules"][0],
-                self.suite_jwks(),
-            )
-        valid_summary, _ = self.runner.build_evidence_summary(
-            self.plan_map,
-            scenario,
-            exported,
-            self.candidate(),
-            self.suite_jwks_sha256(),
-        )
-
-        for unsafe_url in (
-            "https://user:secret@issuer.example.test",
-            "https://issuer.example.test/path\ninjected",
-            "https://issuer.example.test/path\\confused",
-            "https://issuer.example.test:65536",
-            "https://[:::]/path",
-            "https://issuer.example.test/" + ("a" * 2048),
-        ):
-            with self.subTest(unsafe_url=repr(unsafe_url)):
-                _, raw_export = self.suite_export(issuer_url=unsafe_url)
-                with tempfile.TemporaryDirectory() as tmp:
-                    exported = self.runner.load_suite_export(
-                        self.write_private_export(Path(tmp), raw_export),
-                        scenario["suite_modules"][0],
-                        self.suite_jwks(),
-                    )
-                with self.assertRaisesRegex(
-                    self.runner.RunnerError, "issuer URL is invalid"
-                ):
-                    self.runner.build_evidence_summary(
-                        self.plan_map,
-                        scenario,
-                        exported,
-                        self.candidate(),
-                        self.suite_jwks_sha256(),
-                    )
-
-                invalid_summary = json.loads(json.dumps(valid_summary))
-                invalid_summary["deployment"]["issuer_url"] = unsafe_url
-                with self.assertRaises(self.runner.SchemaValidationError):
-                    self.runner.validate_against_schema(
-                        invalid_summary,
-                        schema,
-                        schema,
-                        "evidence summary",
-                    )
-
-        ipv6_summary = json.loads(json.dumps(valid_summary))
-        ipv6_summary["deployment"]["issuer_url"] = (
-            "https://[2001:db8::1]:443/issuer"
-        )
-        self.runner.validate_against_schema(
-            ipv6_summary,
-            schema,
-            schema,
-            "evidence summary",
-        )
-
-    def test_promote_evidence_rejects_changed_terminal_result(self) -> None:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        _, raw_export = self.suite_export(result="FAILED", terminal_result="PASSED")
-        with tempfile.TemporaryDirectory() as tmp:
-            suite_export = self.write_private_export(Path(tmp), raw_export)
-            exported = self.runner.load_suite_export(
-                suite_export,
-                scenario["suite_modules"][0],
-                self.suite_jwks(),
-            )
-        with self.assertRaisesRegex(
-            self.runner.RunnerError, "matching terminal module record"
-        ):
-            self.runner.build_evidence_summary(
-                self.plan_map,
-                scenario,
-                exported,
-                self.candidate(),
-                self.suite_jwks_sha256(),
-            )
-
-    def test_suite_export_rejects_invalid_signature(self) -> None:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        module = scenario["suite_modules"][0]
-        json_name, raw_export = self.suite_export()
-        signature_name = json_name.removesuffix(".json") + ".sig"
-        with zipfile.ZipFile(io.BytesIO(raw_export)) as source:
-            payload = source.read(json_name)
-            signature = bytearray(source.read(signature_name))
-        signature[0] = ord("A") if signature[0] != ord("A") else ord("B")
-        buffer = io.BytesIO()
-        with zipfile.ZipFile(buffer, "w", compression=zipfile.ZIP_DEFLATED) as archive:
-            archive.writestr(json_name, payload)
-            archive.writestr(signature_name, signature)
-
-        with tempfile.TemporaryDirectory() as tmp:
-            path = self.write_private_export(Path(tmp), buffer.getvalue())
-            with self.assertRaisesRegex(
-                self.runner.RunnerError, "exactly one trusted suite key"
-            ):
-                self.runner.load_suite_export(path, module, self.suite_jwks())
-
-    def test_suite_jwks_rejects_invalid_rsa_key(self) -> None:
-        jwks = self.suite_jwks()
-        jwks["keys"][0]["e"] = "Ag"
-        with tempfile.TemporaryDirectory() as tmp:
-            path = Path(tmp) / "suite-jwks.json"
-            path.write_text(json.dumps(jwks), encoding="utf-8")
-            path.chmod(0o600)
-            with self.assertRaisesRegex(
-                self.runner.RunnerError, "invalid RSA signing key"
-            ):
-                self.runner.load_suite_jwks(path)
-
-    def test_suite_export_rejects_nonmatching_valid_shape_key(self) -> None:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        module = scenario["suite_modules"][0]
-        _, raw_export = self.suite_export()
-        jwks = self.suite_jwks()
-        nonmatching_modulus = TEST_RSA_N - 2
-        raw_modulus = nonmatching_modulus.to_bytes(
-            (nonmatching_modulus.bit_length() + 7) // 8, "big"
-        )
-        jwks["keys"][0]["n"] = (
-            base64.urlsafe_b64encode(raw_modulus).decode("ascii").rstrip("=")
-        )
-        with tempfile.TemporaryDirectory() as tmp:
-            root = Path(tmp)
-            export_path = self.write_private_export(root, raw_export)
-            jwks_path = root / "nonmatching-jwks.json"
-            jwks_path.write_text(json.dumps(jwks), encoding="utf-8")
-            jwks_path.chmod(0o600)
-            validated_jwks, _ = self.runner.load_suite_jwks(jwks_path)
-            with self.assertRaisesRegex(
-                self.runner.RunnerError, "exactly one trusted suite key"
-            ):
-                self.runner.load_suite_export(
-                    export_path, module, validated_jwks
-                )
-
-    def test_suite_export_rejects_multiple_matching_jwks_keys(self) -> None:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        module = scenario["suite_modules"][0]
-        _, raw_export = self.suite_export()
-        jwks = self.suite_jwks()
-        duplicate = dict(jwks["keys"][0])
-        duplicate["kid"] = "duplicate-suite-test-key"
-        jwks["keys"].append(duplicate)
-        with tempfile.TemporaryDirectory() as tmp:
-            path = self.write_private_export(Path(tmp), raw_export)
-            with self.assertRaisesRegex(
-                self.runner.RunnerError, "exactly one trusted suite key"
-            ):
-                self.runner.load_suite_export(path, module, jwks)
-
-    def test_suite_export_binds_run_identifiers_and_considered_logs(self) -> None:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        module = scenario["suite_modules"][0]
-        json_name, raw_export = self.suite_export()
-        signature_name = json_name.removesuffix(".json") + ".sig"
-        with zipfile.ZipFile(io.BytesIO(raw_export)) as source:
-            original = json.loads(source.read(json_name))
-
-        def repack(payload: dict[str, object]) -> bytes:
-            encoded = json.dumps(payload).encode("utf-8")
-            buffer = io.BytesIO()
-            with zipfile.ZipFile(
-                buffer, "w", compression=zipfile.ZIP_DEFLATED
-            ) as archive:
-                archive.writestr(json_name, encoded)
-                archive.writestr(signature_name, self.sign_suite_export(encoded))
-            return buffer.getvalue()
-
-        changed_id = json.loads(json.dumps(original))
-        changed_id["testInfo"]["_id"] = "Zm9xN8pL2rS4tV6"
-        long_plan_id = json.loads(json.dumps(original))
-        long_plan_id["testInfo"]["planId"] = "p" * 129
-        for label, payload in {
-            "mismatched test id": changed_id,
-            "oversized plan id": long_plan_id,
-        }.items():
-            with self.subTest(label=label), tempfile.TemporaryDirectory() as tmp:
-                path = self.write_private_export(Path(tmp), repack(payload))
-                with self.assertRaisesRegex(
-                    self.runner.RunnerError, "run identifiers do not match"
-                ):
-                    self.runner.load_suite_export(path, module, self.suite_jwks())
-
-        changed_log = json.loads(json.dumps(original))
-        changed_log["results"][0]["testId"] = "Zm9xN8pL2rS4tV6"
-        with tempfile.TemporaryDirectory() as tmp:
-            path = self.write_private_export(Path(tmp), repack(changed_log))
-            exported = self.runner.load_suite_export(
-                path, module, self.suite_jwks()
-            )
-        with self.assertRaisesRegex(
-            self.runner.RunnerError, "log entry does not match"
-        ):
-            self.runner.build_evidence_summary(
-                self.plan_map,
-                scenario,
-                exported,
-                self.candidate(),
-                self.suite_jwks_sha256(),
-            )
-
-    def test_suite_export_zip_rejects_unsafe_or_unexpected_entries(self) -> None:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        module = scenario["suite_modules"][0]
-        json_name, raw_export = self.suite_export()
-
-        def mutate(
-            entries: list[tuple[zipfile.ZipInfo | str, bytes | str]],
-            *,
-            compression: int = zipfile.ZIP_DEFLATED,
-        ) -> bytes:
-            buffer = io.BytesIO()
-            with warnings.catch_warnings():
-                warnings.simplefilter("ignore", UserWarning)
-                with zipfile.ZipFile(buffer, "w", compression=compression) as archive:
-                    for name, content in entries:
-                        archive.writestr(name, content)
-            return buffer.getvalue()
-
-        with zipfile.ZipFile(io.BytesIO(raw_export)) as archive:
-            payload = archive.read(json_name)
-        signature_name = json_name.removesuffix(".json") + ".sig"
-        symlink = zipfile.ZipInfo(signature_name)
-        symlink.create_system = 3
-        symlink.external_attr = stat.S_IFLNK << 16
-        cases = {
-            "path traversal": mutate(
-                [(json_name, payload), ("../" + signature_name, "signature")]
-            ),
-            "symlink": mutate([(json_name, payload), (symlink, "target")]),
-            "duplicate": mutate(
-                [
-                    (json_name, payload),
-                    (json_name, payload),
-                ]
-            ),
-            "unexpected": mutate(
-                [
-                    (json_name, payload),
-                    (signature_name, "signature"),
-                    ("raw.log", "private"),
-                ]
-            ),
-        }
-        encrypted = bytearray(raw_export)
-        local_header = encrypted.find(b"PK\x03\x04")
-        central_header = encrypted.find(b"PK\x01\x02")
-        self.assertNotEqual(-1, local_header)
-        self.assertNotEqual(-1, central_header)
-        encrypted[local_header + 6] |= 0x01
-        encrypted[central_header + 8] |= 0x01
-        cases["encrypted"] = bytes(encrypted)
-
-        for label, content in cases.items():
-            with self.subTest(label=label), tempfile.TemporaryDirectory() as tmp:
-                path = self.write_private_export(Path(tmp), content)
-                with self.assertRaises(self.runner.RunnerError):
-                    self.runner.load_suite_export(path, module, self.suite_jwks())
-
-    def test_suite_export_zip_rejects_corrupt_member_data_as_runner_error(self) -> None:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        module = scenario["suite_modules"][0]
-        json_name, raw_export = self.suite_export()
-        signature_name = json_name.removesuffix(".json") + ".sig"
-        with zipfile.ZipFile(io.BytesIO(raw_export)) as source:
-            payload = source.read(json_name)
-            signature = source.read(signature_name)
-        buffer = io.BytesIO()
-        with zipfile.ZipFile(buffer, "w", compression=zipfile.ZIP_STORED) as archive:
-            archive.writestr(json_name, payload)
-            archive.writestr(signature_name, signature)
-        stored = buffer.getvalue()
-        for target_name in (json_name, signature_name):
-            with self.subTest(target_name=target_name):
-                corrupt = bytearray(stored)
-                with zipfile.ZipFile(io.BytesIO(corrupt)) as archive:
-                    entry = archive.getinfo(target_name)
-                name_size = int.from_bytes(
-                    corrupt[
-                        entry.header_offset + 26 : entry.header_offset + 28
-                    ],
-                    "little",
-                )
-                extra_size = int.from_bytes(
-                    corrupt[
-                        entry.header_offset + 28 : entry.header_offset + 30
-                    ],
-                    "little",
-                )
-                data_offset = entry.header_offset + 30 + name_size + extra_size
-                corrupt[data_offset] ^= 0x01
-
-                with tempfile.TemporaryDirectory() as tmp:
-                    path = self.write_private_export(Path(tmp), bytes(corrupt))
-                    with self.assertRaisesRegex(
-                        self.runner.RunnerError, "invalid compressed data"
-                    ):
-                        self.runner.load_suite_export(
-                            path, module, self.suite_jwks()
-                        )
-
-    def test_suite_export_zip_rejects_size_and_compression_bombs(self) -> None:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        module = scenario["suite_modules"][0]
-        json_name, _ = self.suite_export()
-        signature_name = json_name.removesuffix(".json") + ".sig"
-
-        aggregate = io.BytesIO()
-        with zipfile.ZipFile(aggregate, "w") as archive:
-            archive.writestr(json_name, "{}" + " " * 70)
-            archive.writestr(signature_name, "s" * 70)
-        with tempfile.TemporaryDirectory() as tmp:
-            path = self.write_private_export(Path(tmp), aggregate.getvalue())
-            with patch.object(
-                self.runner,
-                "read_owner_only_file",
-                return_value=aggregate.getvalue(),
-            ):
-                with patch.object(self.runner, "MAX_SUITE_EXPORT_BYTES", 100):
-                    with self.assertRaisesRegex(
-                        self.runner.RunnerError, "uncompressed size"
-                    ):
-                        self.runner.load_suite_export(path, module, self.suite_jwks())
-
-        compressed = io.BytesIO()
-        with zipfile.ZipFile(
-            compressed, "w", compression=zipfile.ZIP_DEFLATED
-        ) as archive:
-            archive.writestr(json_name, " " * (2 * 1024 * 1024))
-            archive.writestr(signature_name, "signature")
-        with tempfile.TemporaryDirectory() as tmp:
-            path = self.write_private_export(Path(tmp), compressed.getvalue())
-            with self.assertRaisesRegex(
-                self.runner.RunnerError, "suspicious compression ratio"
-            ):
-                self.runner.load_suite_export(path, module, self.suite_jwks())
-
-    def test_evidence_summary_rejects_unsupported_scenario_contract_drift(self) -> None:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        _, raw_export = self.suite_export()
-        with tempfile.TemporaryDirectory() as tmp:
-            suite_export = self.write_private_export(Path(tmp), raw_export)
-            exported = self.runner.load_suite_export(
-                suite_export,
-                scenario["suite_modules"][0],
-                self.suite_jwks(),
-            )
-        changed_plan_map = json.loads(json.dumps(self.plan_map))
-        changed_plan_map["scenarios"].append(
-            {"id": "unreviewed-scenario", "status": "blocked"}
-        )
-        with self.assertRaisesRegex(
-            self.runner.RunnerError, "unsupported scenario contract changed"
-        ):
-            self.runner.build_evidence_summary(
-                changed_plan_map,
-                scenario,
-                exported,
-                self.candidate(),
-                self.suite_jwks_sha256(),
-            )
-
-    def test_public_summary_guard_rejects_raw_sensitive_fields(self) -> None:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        _, raw_export = self.suite_export()
-        with tempfile.TemporaryDirectory() as tmp:
-            suite_export = self.write_private_export(Path(tmp), raw_export)
-            exported = self.runner.load_suite_export(
-                suite_export,
-                scenario["suite_modules"][0],
-                self.suite_jwks(),
-            )
-        summary, sensitive = self.runner.build_evidence_summary(
-            self.plan_map,
-            scenario,
-            exported,
-            self.candidate(),
-            self.suite_jwks_sha256(),
-        )
-        summary["run"]["access_token"] = "copied-private-token"
-        with self.assertRaisesRegex(self.runner.RunnerError, "forbidden field"):
-            self.runner.assert_public_summary_safe(summary, sensitive)
-
-    def test_public_summary_omits_condition_identifiers_and_transaction_code(
-        self,
-    ) -> None:
-        transaction_code = "LeakyCode123"
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        _, raw_export = self.suite_export(
-            transaction_code=transaction_code,
-            warning_source=transaction_code,
-        )
-        with tempfile.TemporaryDirectory() as tmp:
-            suite_export = self.write_private_export(Path(tmp), raw_export)
-            exported = self.runner.load_suite_export(
-                suite_export,
-                scenario["suite_modules"][0],
-                self.suite_jwks(),
-            )
-        summary, sensitive = self.runner.build_evidence_summary(
-            self.plan_map,
-            scenario,
-            exported,
-            self.candidate(),
-            self.suite_jwks_sha256(),
-        )
-        self.assertEqual(1, summary["run"]["conditions"]["counts"]["warning"])
-        self.assertNotIn(transaction_code, json.dumps(summary))
-        self.assertIn(transaction_code, sensitive)
-        self.runner.assert_public_summary_safe(summary, sensitive)
-
-    def test_export_suite_jwks_uses_authenticated_origin_and_owner_only_output(
-        self,
-    ) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            root = Path(tmp)
-            output = root / "suite-jwks.json"
-            ca_certificate = root / "suite-ca.pem"
-            args = self.runner.parse_args(
-                [
-                    "export-suite-jwks",
-                    "--conformance-server",
-                    "https://suite.example.test",
-                    "--suite-ca-certificate",
-                    str(ca_certificate),
-                    "--output",
-                    str(output),
-                ]
-            )
-            response = MagicMock()
-            response.status = 200
-            response.read.return_value = json.dumps(self.suite_jwks()).encode("utf-8")
-            response.__enter__.return_value = response
-            opener = MagicMock()
-            opener.open.return_value = response
-            tls_context = MagicMock()
-            with patch.object(
-                self.runner,
-                "suite_tls_context",
-                return_value=tls_context,
-            ) as suite_tls_context:
-                with patch.object(
-                    self.runner.urllib.request,
-                    "build_opener",
-                    return_value=opener,
-                ) as build_opener:
-                    with patch("builtins.print"):
-                        self.assertEqual(0, self.runner.cmd_export_suite_jwks(args))
-
-            suite_tls_context.assert_called_once_with(ca_certificate)
-            opener.open.assert_called_once_with(
-                "https://suite.example.test/jwks", timeout=10
-            )
-            handlers = build_opener.call_args.args
-            self.assertEqual({}, handlers[0].proxies)
-            self.assertIsInstance(handlers[1], self.runner.urllib.request.HTTPSHandler)
-            self.assertIsInstance(handlers[2], self.runner.NoRedirect)
-            response.read.assert_called_once_with(
-                self.runner.MAX_SUITE_JWKS_BYTES + 1
-            )
-            self.assertEqual(self.suite_jwks(), json.loads(output.read_bytes()))
-            self.assertEqual(0o600, output.stat().st_mode & 0o777)
-
-    def test_submit_offer_forwards_only_the_real_notary_preauthorized_offer(
-        self,
-    ) -> None:
-        issuer = "https://issuer.example.test"
-        inline, offer_uri = self.offer_uri(issuer)
-        with tempfile.TemporaryDirectory() as tmp:
-            offer_file = Path(tmp) / "offer.txt"
-            offer_file.write_text(offer_uri, encoding="utf-8")
-            offer_file.chmod(0o600)
-            args = self.runner.parse_args(
-                [
-                    "submit-offer",
-                    "--offer-file",
-                    str(offer_file),
-                    "--issuer-url",
-                    issuer,
-                    "--suite-offer-endpoint",
-                    "https://suite.example.test/run/credential_offer",
-                    "--conformance-server",
-                    "https://suite.example.test",
-                ]
-            )
-            response = MagicMock()
-            response.__enter__.return_value.status = 204
-            opener = MagicMock()
-            opener.open.return_value = response
-            tls_context = MagicMock()
-            with patch.object(
-                self.runner.ssl,
-                "create_default_context",
-                return_value=tls_context,
-            ) as create_context:
-                with patch.object(
-                    self.runner.ssl,
-                    "_create_unverified_context",
-                    side_effect=AssertionError("unverified TLS must not be used"),
-                ):
-                    with patch.object(
-                        self.runner.urllib.request,
-                        "build_opener",
-                        return_value=opener,
-                    ) as build_opener:
-                        with patch("builtins.print") as printed:
-                            self.assertEqual(0, self.runner.cmd_submit_offer(args))
-
-            submitted = urllib.parse.urlsplit(opener.open.call_args.args[0])
-            self.assertEqual(
-                [inline],
-                urllib.parse.parse_qs(submitted.query)["credential_offer"],
-            )
-            create_context.assert_called_once_with()
-            https_handler = next(
-                handler
-                for handler in build_opener.call_args.args
-                if isinstance(handler, self.runner.urllib.request.HTTPSHandler)
-            )
-            self.assertIs(tls_context, https_handler._context)
-            printed.assert_called_once_with("credential offer submitted")
-
-            opener.open.side_effect = self.runner.urllib.error.URLError(inline)
-            with patch.object(
-                self.runner.urllib.request, "build_opener", return_value=opener
-            ):
-                with self.assertRaisesRegex(
-                    self.runner.RunnerError, "submission failed"
-                ) as caught:
-                    self.runner.cmd_submit_offer(args)
-            self.assertNotIn("owner-only-code", str(caught.exception))
-
-    def test_submit_offer_rejects_untrusted_remote_tls(self) -> None:
-        issuer = "https://issuer.example.test"
-        inline, offer_uri = self.offer_uri(issuer)
-        with tempfile.TemporaryDirectory() as tmp:
-            offer_file = Path(tmp) / "offer.txt"
-            offer_file.write_text(offer_uri, encoding="utf-8")
-            offer_file.chmod(0o600)
-            args = self.runner.parse_args(
-                [
-                    "submit-offer",
-                    "--offer-file",
-                    str(offer_file),
-                    "--issuer-url",
-                    issuer,
-                    "--suite-offer-endpoint",
-                    "https://suite.example.test/run/credential_offer",
-                    "--conformance-server",
-                    "https://suite.example.test",
-                ]
-            )
-            opener = MagicMock()
-            opener.open.side_effect = self.runner.urllib.error.URLError(
-                self.runner.ssl.SSLCertVerificationError(
-                    1, "self-signed certificate"
-                )
-            )
-            with patch.object(
-                self.runner.urllib.request, "build_opener", return_value=opener
-            ):
-                with self.assertRaisesRegex(
-                    self.runner.RunnerError, "submission failed"
-                ) as caught:
-                    self.runner.cmd_submit_offer(args)
-
-            self.assertNotIn(inline, str(caught.exception))
-
-    def test_submit_offer_accepts_an_explicit_local_suite_ca(self) -> None:
-        issuer = "https://issuer.example.test"
-        _, offer_uri = self.offer_uri(issuer)
-        with tempfile.TemporaryDirectory() as tmp:
-            offer_file = Path(tmp) / "offer.txt"
-            offer_file.write_text(offer_uri, encoding="utf-8")
-            offer_file.chmod(0o600)
-            suite_ca = Path(tmp) / "suite-ca.pem"
-            suite_ca.write_text("local test CA", encoding="utf-8")
-            args = self.runner.parse_args(
-                [
-                    "submit-offer",
-                    "--offer-file",
-                    str(offer_file),
-                    "--issuer-url",
-                    issuer,
-                    "--suite-offer-endpoint",
-                    "https://localhost.emobix.co.uk:8443/run/credential_offer",
-                    "--conformance-server",
-                    "https://localhost.emobix.co.uk:8443",
-                    "--suite-ca-certificate",
-                    str(suite_ca),
-                ]
-            )
-            response = MagicMock()
-            response.__enter__.return_value.status = 204
-            opener = MagicMock()
-            opener.open.return_value = response
-            tls_context = MagicMock()
-            with patch.object(
-                self.runner.ssl,
-                "SSLContext",
-                return_value=tls_context,
-            ) as create_context:
-                with patch.object(
-                    self.runner.urllib.request,
-                    "build_opener",
-                    return_value=opener,
-                ):
-                    with patch("builtins.print"):
-                        self.assertEqual(0, self.runner.cmd_submit_offer(args))
-
-            create_context.assert_called_once_with(
-                self.runner.ssl.PROTOCOL_TLS_CLIENT
-            )
-            tls_context.load_verify_locations.assert_called_once_with(
-                cadata=b"local test CA"
-            )
-
-    def test_suite_ca_read_holds_one_descriptor_across_path_replacement(
-        self,
-    ) -> None:
-        original = (
-            b"-----BEGIN CERTIFICATE-----\n"
-            b"captured-original\n"
-            b"-----END CERTIFICATE-----\n"
-        )
-        replacement = (
-            b"-----BEGIN CERTIFICATE-----\n"
-            b"replacement\n"
-            b"-----END CERTIFICATE-----\n"
-        )
-        with tempfile.TemporaryDirectory() as tmp:
-            ca_path = Path(tmp) / "suite-ca.pem"
-            replacement_path = Path(tmp) / "replacement.pem"
-            ca_path.write_bytes(original)
-            replacement_path.write_bytes(replacement)
-            real_open = self.runner.os.open
-
-            def open_then_replace(path, flags):
-                descriptor = real_open(path, flags)
-                self.runner.os.replace(replacement_path, ca_path)
-                return descriptor
-
-            tls_context = MagicMock()
-            with patch.object(
-                self.runner.os, "open", side_effect=open_then_replace
-            ) as secure_open:
-                with patch.object(
-                    self.runner.ssl,
-                    "SSLContext",
-                    return_value=tls_context,
-                ):
-                    self.runner.suite_tls_context(ca_path)
-
-            self.assertEqual(replacement, ca_path.read_bytes())
-            secure_open.assert_called_once()
-            flags = secure_open.call_args.args[1]
-            for required_flag in ("O_NOFOLLOW", "O_CLOEXEC"):
-                value = getattr(self.runner.os, required_flag, 0)
-                if value:
-                    self.assertEqual(value, flags & value)
-            tls_context.load_verify_locations.assert_called_once_with(
-                cadata=original.decode("ascii")
-            )
-
-    def test_suite_ca_loader_preserves_der_bytes(self) -> None:
-        tls_context = MagicMock()
-        certificate = b"\x30\x82\x01\x00\xff"
-
-        self.runner.add_suite_ca(tls_context, certificate)
-
-        tls_context.load_verify_locations.assert_called_once_with(
-            cadata=certificate
-        )
-
-    def test_suite_ca_read_rejects_symlink(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            target = Path(tmp) / "suite-ca.pem"
-            target.write_text("certificate", encoding="utf-8")
-            link = Path(tmp) / "suite-ca-link.pem"
-            link.symlink_to(target)
-
-            with self.assertRaisesRegex(
-                self.runner.RunnerError, "opened securely"
-            ):
-                self.runner.read_suite_ca_certificate(link)
-
-    def test_exported_certificate_recipe_authenticates_documented_suite_host(
-        self,
-    ) -> None:
-        openssl = shutil.which("openssl")
-        if not openssl:
-            self.skipTest("openssl is required for the checked-in certificate recipe")
-        issuer = "https://issuer.example.test"
-        _, offer_uri = self.offer_uri(issuer)
-        with tempfile.TemporaryDirectory() as tmp:
-            work = Path(tmp)
-            certificate = work / "recipe.crt"
-            private_key = work / "recipe.key"
-            command = nginx_certificate_command(certificate, private_key)
-            self.assertEqual(openssl, shutil.which(command[0]))
-            self.assertIn(
-                (
-                    "subjectAltName=DNS:localhost.emobix.co.uk,DNS:localhost,"
-                    "IP:127.0.0.1,IP:::1"
-                ),
-                command,
-            )
-            subprocess.run(
-                command,
-                check=True,
-                capture_output=True,
-                text=True,
-            )
-
-            suite_dir = work / "suite"
-            suite_dir.mkdir()
-            exported = work / "conformance-suite-ca.pem"
-            export_args = self.runner.parse_args(
-                [
-                    "export-suite-ca",
-                    "--suite-dir",
-                    str(suite_dir),
-                    "--output",
-                    str(exported),
-                ]
-            )
-            compose_commands: list[list[str]] = []
-
-            def copy_container_certificate(
-                compose_command: list[str], **_kwargs
-            ) -> None:
-                compose_commands.append(compose_command)
-                Path(compose_command[-1]).write_bytes(certificate.read_bytes())
-
-            with patch.object(
-                self.runner,
-                "run_checked",
-                side_effect=copy_container_certificate,
-            ):
-                with patch("builtins.print"):
-                    self.assertEqual(0, self.runner.cmd_export_suite_ca(export_args))
-
-            self.assertEqual(certificate.read_bytes(), exported.read_bytes())
-            self.assertEqual(0o600, exported.stat().st_mode & 0o777)
-            self.assertEqual(
-                f"nginx:{self.runner.SUITE_CA_CONTAINER_PATH}",
-                compose_commands[0][-2],
-            )
-
-            offer_file = work / "offer.txt"
-            offer_file.write_text(offer_uri, encoding="utf-8")
-            offer_file.chmod(0o600)
-            server = ThreadingHTTPServer(("127.0.0.1", 0), EmptyHttpsHandler)
-            server_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-            server_context.minimum_version = ssl.TLSVersion.TLSv1_2
-            server_context.load_cert_chain(certificate, private_key)
-            server.socket = server_context.wrap_socket(
-                server.socket, server_side=True
-            )
-            thread = threading.Thread(target=server.serve_forever, daemon=True)
-            thread.start()
-            host = "localhost.emobix.co.uk"
-            port = server.server_port
-            submit_args = self.runner.parse_args(
-                [
-                    "submit-offer",
-                    "--offer-file",
-                    str(offer_file),
-                    "--issuer-url",
-                    issuer,
-                    "--suite-offer-endpoint",
-                    f"https://{host}:{port}/run/credential_offer",
-                    "--conformance-server",
-                    f"https://{host}:{port}",
-                    "--suite-ca-certificate",
-                    str(exported),
-                ]
-            )
-            real_getaddrinfo = socket.getaddrinfo
-
-            def loopback_suite(hostname, *args, **kwargs):
-                if hostname == host:
-                    hostname = "127.0.0.1"
-                return real_getaddrinfo(hostname, *args, **kwargs)
-
-            try:
-                with patch.object(
-                    socket, "getaddrinfo", side_effect=loopback_suite
-                ):
-                    with patch("builtins.print"):
-                        self.assertEqual(
-                            0, self.runner.cmd_submit_offer(submit_args)
-                        )
-            finally:
-                server.shutdown()
-                server.server_close()
-                thread.join(timeout=2)
-
-    def test_submit_offer_rejects_cleartext_suite_endpoint(self) -> None:
-        issuer = "https://issuer.example.test"
-        _, offer_uri = self.offer_uri(issuer)
-        with tempfile.TemporaryDirectory() as tmp:
-            offer_file = Path(tmp) / "offer.txt"
-            offer_file.write_text(offer_uri, encoding="utf-8")
-            offer_file.chmod(0o600)
-            args = self.runner.parse_args(
-                [
-                    "submit-offer",
-                    "--offer-file",
-                    str(offer_file),
-                    "--issuer-url",
-                    issuer,
-                    "--suite-offer-endpoint",
-                    "http://suite.example.test/run/credential_offer",
-                    "--conformance-server",
-                    "http://suite.example.test",
-                ]
-            )
-            with patch.object(
-                self.runner.urllib.request, "build_opener"
-            ) as build_opener:
-                with self.assertRaisesRegex(self.runner.RunnerError, "HTTPS"):
-                    self.runner.cmd_submit_offer(args)
-
-            build_opener.assert_not_called()
-
-    def test_read_offer_uses_one_no_follow_descriptor(self) -> None:
-        issuer = "https://issuer.example.test"
-        inline, offer_uri = self.offer_uri(issuer)
-        with tempfile.TemporaryDirectory() as tmp:
-            offer_file = Path(tmp) / "offer.txt"
-            offer_file.write_text(offer_uri, encoding="utf-8")
-            offer_file.chmod(0o600)
-            real_open = self.runner.os.open
-            with patch.object(Path, "read_text", side_effect=AssertionError):
-                with patch.object(
-                    self.runner.os, "open", wraps=real_open
-                ) as secure_open:
-                    self.assertEqual(
-                        inline, self.runner.read_offer(offer_file, issuer)
-                    )
-
-        secure_open.assert_called_once_with(
-            offer_file,
-            self.runner.os.O_RDONLY
-            | self.runner.os.O_CLOEXEC
-            | self.runner.os.O_NOFOLLOW,
-        )
-
-    def test_read_offer_rejects_symlink(self) -> None:
-        issuer = "https://issuer.example.test"
-        _, offer_uri = self.offer_uri(issuer)
-        with tempfile.TemporaryDirectory() as tmp:
-            target = Path(tmp) / "offer.txt"
-            target.write_text(offer_uri, encoding="utf-8")
-            target.chmod(0o600)
-            link = Path(tmp) / "offer-link.txt"
-            link.symlink_to(target)
-            with self.assertRaisesRegex(
-                self.runner.RunnerError, "could not be opened securely"
-            ):
-                self.runner.read_offer(link, issuer)
-
-    def test_builder_override_pins_maven_image_by_digest(self) -> None:
-        override = self.runner.BUILDER_COMPOSE_OVERRIDE_PATH.read_text(
-            encoding="utf-8"
-        )
-        self.assertIn("maven:3-eclipse-temurin-21@sha256:", override)
-        self.assertIn(
-            str(self.runner.BUILDER_COMPOSE_OVERRIDE_PATH),
-            self.runner.builder_command(Path("/suite"), "run", "builder"),
-        )
-
-    def test_dependency_inputs_are_dependabot_discoverable(self) -> None:
-        compose_filename = re.compile(
-            r"(docker-)?compose(-[\w]+)?(?:\.[\w-]+)?\.ya?ml",
-            re.IGNORECASE,
-        )
-        self.assertIsNotNone(
-            compose_filename.fullmatch(
-                self.runner.BUILDER_COMPOSE_OVERRIDE_PATH.name
-            )
-        )
-        self.assertEqual(".txt", self.runner.SUITE_REQUIREMENTS_LOCK_PATH.suffix)
-        dependabot_path = self.runner.REPO_ROOT / ".github" / "dependabot.yml"
-        dependabot = dependabot_path.read_text(encoding="utf-8")
-        self.assertIn("package-ecosystem: docker-compose", dependabot)
-        self.assertIn("package-ecosystem: pip", dependabot)
-
-    def test_runtime_override_pins_built_image_bases(self) -> None:
-        override = self.runner.COMPOSE_OVERRIDE_PATH.read_text(encoding="utf-8")
-        nginx = (self.runner.CONFIG_DIR / "nginx.Dockerfile").read_text(
-            encoding="utf-8"
-        )
-        server = (self.runner.CONFIG_DIR / "server-dev.Dockerfile").read_text(
-            encoding="utf-8"
-        )
-        self.assertIn("REGISTRY_OPENID_CONFORMANCE_CONFIG_DIR", override)
-        self.assertIn("nginx:1.27.3@sha256:", nginx)
-        self.assertIn("eclipse-temurin:21@sha256:", server)
-
-    def test_metadata_scenario_cli_selects_single_oid4vci_module(self) -> None:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        plan_arg = self.runner.scenario_plan_arg(scenario)
-        self.assertTrue(plan_arg.startswith("oid4vci-1_0-issuer-test-plan["))
-        self.assertIn("[client_auth_type=private_key_jwt]", plan_arg)
-        self.assertIn("[sender_constrain=dpop]", plan_arg)
-        self.assertIn("[fapi_profile=vci]", plan_arg)
-        self.assertIn("[fapi_request_method=unsigned]", plan_arg)
-        self.assertIn("[authorization_request_type=simple]", plan_arg)
-        self.assertIn("[credential_format=sd_jwt_vc]", plan_arg)
-        self.assertIn("[vci_credential_encryption=plain]", plan_arg)
-        self.assertTrue(plan_arg.endswith(":oid4vci-1_0-issuer-metadata-test"))
-
-    def test_rendered_config_is_valid_json_and_uses_supplied_issuer(self) -> None:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        rendered = self.runner.render_config(
-            scenario,
-            {
-                "issuer_url": "https://issuer.example.test",
-                "authorization_server": "https://issuer.example.test/auth",
-                "credential_configuration_id": "person_is_alive_sd_jwt",
-                "static_tx_code": "1234",
-                "client_id": "client-a",
-                "client2_id": "client-b",
-            },
-        )
-        config = json.loads(rendered)
-        self.assertEqual(
-            "registry-stack-notary-oid4vci-issuer", config["alias"]
-        )
-        self.assertEqual(
-            "https://issuer.example.test", config["vci"]["credential_issuer_url"]
-        )
-        self.assertEqual(
-            "person_is_alive_sd_jwt",
-            config["vci"]["credential_configuration_id"],
-        )
-        self.assertEqual("client-a", config["client"]["client_id"])
-        self.assertNotIn("${", rendered)
-
-    def test_build_run_uses_export_dir_and_conformance_environment(self) -> None:
-        scenario = self.runner.find_scenario(
-            self.plan_map, "notary-oid4vci-issuer-metadata"
-        )
-        with tempfile.TemporaryDirectory() as tmp:
-            args = self.runner.parse_args(
-                [
-                    "run",
-                    "notary-oid4vci-issuer-metadata",
-                    "--issuer-url",
-                    "https://issuer.example.test",
-                    "--output-dir",
-                    tmp,
-                    "--suite-dir",
-                    str(Path(tmp) / "suite"),
-                    "--no-prepare",
-                    "--dry-run",
-                ]
-            )
-            output_dir, env, command = self.runner.build_run(
-                self.plan_map, scenario, args
-            )
-            self.assertEqual(Path(tmp).resolve(), output_dir)
-            self.assertEqual(
-                self.plan_map["suite"]["base_url"], env["CONFORMANCE_SERVER"]
-            )
-            self.assertEqual("1", env["CONFORMANCE_DEV_MODE"])
-            self.assertIn("--export-dir", command)
-            self.assertIn(str(output_dir), command)
-            self.assertIn("oid4vci-1_0-issuer-metadata-test", " ".join(command))
-            self.assertTrue(
-                (output_dir / "notary-oid4vci-issuer-metadata.config.json").exists()
-            )
-            self.assertEqual(
-                0o600,
-                (
-                    output_dir / "notary-oid4vci-issuer-metadata.config.json"
-                ).stat().st_mode
-                & 0o777,
-            )
-
-    def test_suite_artifact_build_uses_docker_builder_and_maven_cache(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            checkout = Path(tmp) / "suite"
-            jar = checkout / self.runner.SUITE_JAR
-            jar.parent.mkdir(parents=True)
-            args = self.runner.parse_args(
-                [
-                    "prepare",
-                    "--suite-dir",
-                    str(checkout),
-                    "--maven-cache-dir",
-                    str(Path(tmp) / "maven"),
-                ]
-            )
-            calls = []
-
-            def fake_run_checked(command, cwd=None, env=None):
-                calls.append((command, cwd, env))
-                jar.write_text("jar", encoding="utf-8")
-
-            with patch.object(shutil, "which", return_value="/usr/bin/docker"):
-                with patch.object(self.runner, "suite_checkout_ref", return_value="a" * 40):
-                    with patch.object(
-                        self.runner, "run_checked", side_effect=fake_run_checked
-                    ):
-                        self.runner.ensure_suite_artifact(checkout, args)
-
-            self.assertEqual(
-                self.runner.builder_command(checkout, "run", "--rm", "builder"),
-                calls[0][0],
-            )
-            self.assertEqual(checkout, calls[0][1])
-            self.assertEqual(
-                str((Path(tmp) / "maven").resolve()), calls[0][2]["MAVEN_CACHE"]
-            )
-            stamp = json.loads(
-                (checkout / self.runner.SUITE_JAR_STAMP).read_text(encoding="utf-8")
-            )
-            self.assertEqual("a" * 40, stamp["source_ref"])
-            self.assertEqual(
-                self.runner.file_sha256(jar), stamp["jar_sha256"]
-            )
-            self.assertEqual(
-                self.runner.file_sha256(
-                    self.runner.BUILDER_COMPOSE_OVERRIDE_PATH
-                ),
-                stamp["builder_override_sha256"],
-            )
-
-    def test_existing_suite_artifact_skips_build_by_default(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            checkout = Path(tmp) / "suite"
-            jar = checkout / self.runner.SUITE_JAR
-            jar.parent.mkdir(parents=True)
-            jar.write_text("jar", encoding="utf-8")
-            stamp = checkout / self.runner.SUITE_JAR_STAMP
-            with patch.object(self.runner, "suite_checkout_ref", return_value="a" * 40):
-                stamp.write_text(
-                    json.dumps(
-                        self.runner.expected_suite_artifact_stamp(checkout, jar),
-                        sort_keys=True,
-                    )
-                    + "\n",
-                    encoding="utf-8",
-                )
-            args = self.runner.parse_args(["prepare", "--suite-dir", str(checkout)])
-
-            with patch.object(self.runner, "suite_checkout_ref", return_value="a" * 40):
-                with patch.object(self.runner, "run_checked") as run_checked:
-                    self.runner.ensure_suite_artifact(checkout, args)
-
-            run_checked.assert_not_called()
-
-    def test_suite_artifact_rebuilds_when_checkout_ref_changes(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            checkout = Path(tmp) / "suite"
-            jar = checkout / self.runner.SUITE_JAR
-            jar.parent.mkdir(parents=True)
-            jar.write_text("old", encoding="utf-8")
-            stamp = checkout / self.runner.SUITE_JAR_STAMP
-            with patch.object(self.runner, "suite_checkout_ref", return_value="a" * 40):
-                stamp.write_text(
-                    json.dumps(
-                        self.runner.expected_suite_artifact_stamp(checkout, jar),
-                        sort_keys=True,
-                    )
-                    + "\n",
-                    encoding="utf-8",
-                )
-            args = self.runner.parse_args(["prepare", "--suite-dir", str(checkout)])
-
-            def fake_run_checked(command, cwd=None, env=None):
-                jar.write_text("new", encoding="utf-8")
-
-            with patch.object(shutil, "which", return_value="/usr/bin/docker"):
-                with patch.object(
-                    self.runner, "suite_checkout_ref", return_value="b" * 40
-                ):
-                    with patch.object(
-                        self.runner, "run_checked", side_effect=fake_run_checked
-                    ) as run_checked:
-                        self.runner.ensure_suite_artifact(checkout, args)
-
-            run_checked.assert_called_once()
-            self.assertEqual("new", jar.read_text(encoding="utf-8"))
-            self.assertEqual(
-                "b" * 40,
-                json.loads(stamp.read_text(encoding="utf-8"))["source_ref"],
-            )
-
-    def test_suite_python_venv_installs_requirements_and_records_digest(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            checkout = Path(tmp) / "suite"
-            requirements = checkout / "scripts" / "requirements.txt"
-            requirements.parent.mkdir(parents=True)
-            requirements.write_bytes(
-                self.runner.SUITE_REQUIREMENTS_INPUT_PATH.read_bytes()
-            )
-            venv_dir = Path(tmp) / "venv"
-            args = self.runner.parse_args(
-                [
-                    "prepare",
-                    "--suite-dir",
-                    str(checkout),
-                    "--python-venv-dir",
-                    str(venv_dir),
-                ]
-            )
-
-            calls = []
-
-            def fake_run_checked(command, cwd=None, env=None):
-                calls.append(command)
-                if command[1:3] == ["-m", "venv"]:
-                    Path(command[-1]).mkdir(parents=True)
-
-            with patch.object(
-                self.runner, "run_checked", side_effect=fake_run_checked
-            ):
-                python = self.runner.ensure_suite_python(checkout, args)
-
-            self.assertEqual(venv_dir.resolve(), python.parents[2])
-            self.assertTrue(python.parent.parent.name.startswith("py"))
-            self.assertEqual(
-                [sys.executable, "-m", "venv", str(python.parents[1])], calls[0]
-            )
-            self.assertEqual(str(python), calls[1][0])
-            self.assertIn("--require-hashes", calls[1])
-            self.assertIn("--only-binary=:all:", calls[1])
-            self.assertEqual("-r", calls[1][-2])
-            self.assertEqual(
-                str(self.runner.SUITE_REQUIREMENTS_LOCK_PATH), calls[1][-1]
-            )
-            self.assertEqual(
-                self.runner.requirements_digest(
-                    self.runner.SUITE_REQUIREMENTS_INPUT_PATH,
-                    self.runner.SUITE_REQUIREMENTS_LOCK_PATH,
-                ),
-                (python.parents[1] / ".requirements.sha256")
-                .read_text(encoding="utf-8")
-                .strip(),
-            )
-
-    def test_suite_python_cache_key_changes_with_lock_digest(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            args = self.runner.parse_args(
-                ["prepare", "--python-venv-dir", str(Path(tmp) / "venvs")]
-            )
-            first = self.runner.suite_python(args)
-            with patch.object(
-                self.runner, "requirements_digest", return_value="b" * 64
-            ):
-                second = self.runner.suite_python(args)
-            self.assertNotEqual(first, second)
-
-    def test_suite_python_recreates_incomplete_digest_cache(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            checkout = Path(tmp) / "suite"
-            requirements = checkout / "scripts" / "requirements.txt"
-            requirements.parent.mkdir(parents=True)
-            requirements.write_bytes(
-                self.runner.SUITE_REQUIREMENTS_INPUT_PATH.read_bytes()
-            )
-            args = self.runner.parse_args(
-                [
-                    "prepare",
-                    "--suite-dir",
-                    str(checkout),
-                    "--python-venv-dir",
-                    str(Path(tmp) / "venvs"),
-                ]
-            )
-            python = self.runner.suite_python(args)
-            python.parent.mkdir(parents=True)
-            python.touch()
-            stale = python.parents[1] / "stale-package"
-            stale.touch()
-
-            def fake_run_checked(command, cwd=None, env=None):
-                if command[1:3] == ["-m", "venv"]:
-                    Path(command[-1]).mkdir(parents=True)
-
-            with patch.object(
-                self.runner, "run_checked", side_effect=fake_run_checked
-            ):
-                self.runner.ensure_suite_python(checkout, args)
-
-            self.assertFalse(stale.exists())
-            self.assertTrue(
-                (python.parents[1] / ".requirements.sha256").is_file()
-            )
-
-    def test_suite_python_rejects_changed_upstream_requirements(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            checkout = Path(tmp) / "suite"
-            requirements = checkout / "scripts" / "requirements.txt"
-            requirements.parent.mkdir(parents=True)
-            requirements.write_text("httpx\npyparsing\nunreviewed\n", encoding="utf-8")
-            args = self.runner.parse_args(
-                ["prepare", "--suite-dir", str(checkout)]
-            )
-
-            with self.assertRaisesRegex(
-                self.runner.RunnerError, "differ from the checked-in locked input"
-            ):
-                self.runner.ensure_suite_python(checkout, args)
-
-    def test_blocked_full_scenario_requires_explicit_override(self) -> None:
-        args = self.runner.parse_args(
-            [
-                "run",
-                "notary-oid4vci-issuer-full",
-                "--issuer-url",
-                "https://issuer.example.test",
-                "--no-prepare",
-                "--dry-run",
-            ]
+            (ROOT / "release/conformance/openid/initial-report.md").is_file()
         )
-        with self.assertRaisesRegex(
-            self.runner.RunnerError, "blocked-by-suite-profile"
-        ):
-            self.runner.cmd_run(args)
 
-    def test_candidate_only_metadata_scenario_runs_without_blocked_override(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            args = self.runner.parse_args(
-                [
-                    "run",
-                    "notary-oid4vci-issuer-metadata",
-                    "--issuer-url",
-                    "https://issuer.example.test",
-                    "--output-dir",
-                    tmp,
-                    "--suite-dir",
-                    str(Path(tmp) / "suite"),
-                    "--no-prepare",
-                    "--dry-run",
-                ]
-            )
-            with patch("builtins.print") as printed:
-                self.assertEqual(0, self.runner.cmd_run(args))
-            invocation = json.loads(printed.call_args.args[0])
-            self.assertIn(
-                "oid4vci-1_0-issuer-metadata-test", " ".join(invocation["command"])
-            )
+    def test_relay_oidc_smoke_remains_the_supported_openid_check(self) -> None:
+        self.assertTrue((ROOT / "release/scripts/relay-oidc-smoke.py").is_file())
+        self.assertTrue((ROOT / "release/conformance/relay-oidc/README.md").is_file())
 
 
 if __name__ == "__main__":
-    main()
+    unittest.main()
diff --git a/release/scripts/test_postgresql_runtime_recipe.py b/release/scripts/test_postgresql_runtime_recipe.py
index 378f44d6d..beba1549f 100644
--- a/release/scripts/test_postgresql_runtime_recipe.py
+++ b/release/scripts/test_postgresql_runtime_recipe.py
@@ -443,8 +443,8 @@ def test_empty_volume_tls_roles_databases_and_restart(self) -> None:
                     "--command=\"SELECT ssl FROM pg_stat_ssl "
                     "WHERE pid=pg_backend_pid(); "
                     "SELECT datname || ':' || pg_get_userbyid(datdba) "
-                    "FROM pg_database WHERE datname IN "
-                    "('registry_relay','registry_notary') ORDER BY datname; "
+                    "FROM pg_database WHERE datname LIKE 'registry_%' "
+                    "ORDER BY datname; "
                     "SELECT rolname || ':' || rolcanlogin || ':' || rolsuper "
                     "FROM pg_roles WHERE rolname LIKE 'registry_%' "
                     "ORDER BY rolname;\""
@@ -464,8 +464,10 @@ def test_empty_volume_tls_roles_databases_and_restart(self) -> None:
                 )
                 lines = {line.strip() for line in query.splitlines() if line.strip()}
                 self.assertIn("t", lines)
-                self.assertIn("registry_notary:registry_notary_owner", lines)
                 self.assertIn("registry_relay:registry_relay_owner", lines)
+                self.assertFalse(
+                    any(line.startswith("registry_notary") for line in lines)
+                )
                 expected_roles = {
                     "registry_stack_bootstrap:true:true",
                     "registry_relay_owner:false:false",
@@ -473,11 +475,6 @@ def test_empty_volume_tls_roles_databases_and_restart(self) -> None:
                     "registry_relay_runtime:true:false",
                     "registry_relay_maintenance:true:false",
                     "registry_relay_reader:true:false",
-                    "registry_notary_owner:false:false",
-                    "registry_notary_migrator:true:false",
-                    "registry_notary_runtime:true:false",
-                    "registry_notary_maintenance:true:false",
-                    "registry_notary_reader:true:false",
                 }
                 self.assertFalse(
                     expected_roles - lines,
diff --git a/release/scripts/test_registry_release.py b/release/scripts/test_registry_release.py
index 80561457a..3a73884df 100755
--- a/release/scripts/test_registry_release.py
+++ b/release/scripts/test_registry_release.py
@@ -2,11 +2,13 @@
 from __future__ import annotations
 
 import importlib.util
+import io
 import json
 import stat
 import subprocess
 import sys
 import tempfile
+from contextlib import redirect_stderr, redirect_stdout
 from importlib.machinery import SourceFileLoader
 from pathlib import Path
 from unittest import TestCase, main, mock
@@ -312,6 +314,10 @@ def test_registryctl_image_lock_schema_boundary_preserves_historical_v1(
             image_lock.SCHEMA_V2,
             image_lock.schema_for_release_version("0.14.0"),
         )
+        self.assertEqual(
+            image_lock.SCHEMA_V3,
+            image_lock.schema_for_release_version("0.17.0"),
+        )
 
     def test_registryctl_image_lock_validates_v1_and_reviewed_v2_images(
         self,
@@ -340,6 +346,15 @@ def test_registryctl_image_lock_validates_v1_and_reviewed_v2_images(
             image_lock.validate_images(image_lock.SCHEMA_V2, v2_images),
         )
 
+        v3_images = {
+            "registry-relay": product_images["registry-relay"],
+            "postgresql": image_lock.reviewed_postgresql_image_ref(),
+        }
+        self.assertEqual(
+            v3_images,
+            image_lock.validate_images(image_lock.SCHEMA_V3, v3_images),
+        )
+
         without_postgresql = dict(v2_images)
         del without_postgresql["postgresql"]
         with self.assertRaisesRegex(ValueError, "must contain exactly"):
@@ -447,7 +462,7 @@ def test_required_rust_context_aggregates_path_gated_shards(self) -> None:
                 "rust-policy",
                 "rust-quality",
                 "rust-tests",
-                "notary-contracts",
+                "evidence-contracts",
                 "relay-contracts",
             },
             set(rust_result["needs"]),
@@ -498,6 +513,66 @@ def test_debian13_contract_rejects_retired_base_and_unpinned_base(self) -> None:
                 any("not pinned by immutable digest" in failure for failure in failures)
             )
 
+    def test_debian13_contract_covers_the_adopter_image(self) -> None:
+        # The adopter image builds two binaries from one file, so it has no
+        # single `AS runtime` stage and no HEALTHCHECK (distroless has no shell
+        # and neither binary has a healthcheck subcommand). It is still bound to
+        # the same Debian 13 boundary and the same digest pins, so it is checked
+        # here rather than left uncovered for not fitting the release shape.
+        module = load_debian13_image_check()
+        adopter = Path("docker/Dockerfile")
+        self.assertIn(adopter, module.ADOPTER_DOCKERFILES)
+        self.assertIn(adopter, module.MAINTAINED_TEXT_PATHS)
+        self.assertEqual(
+            [],
+            [
+                failure
+                for failure in module.check_repository(ROOT)
+                if str(adopter) in failure
+            ],
+        )
+
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            for relative in module.MAINTAINED_TEXT_PATHS:
+                destination = root / relative
+                destination.parent.mkdir(parents=True, exist_ok=True)
+                destination.write_text(
+                    (ROOT / relative).read_text(encoding="utf-8"),
+                    encoding="utf-8",
+                )
+
+            adopter_path = root / adopter
+            text = adopter_path.read_text(encoding="utf-8")
+            # Unpin the final runtime base and give one runtime stage a shell
+            # command: both are exactly what the boundary exists to catch.
+            text = text.replace(
+                module.DISTROLESS_RUNTIME,
+                "gcr.io/distroless/cc-debian13:nonroot",
+            )
+            text = text.replace(
+                'ENTRYPOINT ["/usr/local/bin/mint"]',
+                'RUN ["/bin/sh", "-c", "true"]\nENTRYPOINT ["/usr/local/bin/mint"]',
+                1,
+            )
+            adopter_path.write_text(text, encoding="utf-8")
+
+            failures = module.check_repository(root)
+            self.assertTrue(
+                any(
+                    str(adopter) in failure and "not pinned by immutable digest" in failure
+                    for failure in failures
+                ),
+                failures,
+            )
+            self.assertTrue(
+                any(
+                    str(adopter) in failure and "/bin/sh" in failure
+                    for failure in failures
+                ),
+                failures,
+            )
+
     def test_debian13_contract_binds_builder_to_candidate_workflow(self) -> None:
         module = load_debian13_image_check()
         with tempfile.TemporaryDirectory() as directory:
@@ -585,7 +660,6 @@ def test_release_image_packaging_uses_release_dockerfiles(self) -> None:
             encoding="utf-8"
         )
         release_dockerfiles = [
-            "release/docker/Dockerfile.registry-notary",
             "release/docker/Dockerfile.registry-relay",
         ]
 
@@ -1350,40 +1424,23 @@ def test_relay_packaging_includes_dedicated_rhai_worker(self) -> None:
         )
         self.assertIn(f"dist/image-bin/{worker}", binary_recipe)
 
-    def test_notary_packaging_includes_dedicated_cel_worker(self) -> None:
+    def test_release_packaging_excludes_retired_notary(self) -> None:
         binary_recipe = (ROOT / "release/scripts/build-release-binaries.sh").read_text(
             encoding="utf-8"
         )
-        worker = "registry-notary-cel-worker"
-
-        product_dockerfile = (ROOT / "products/notary/Dockerfile").read_text(
+        image_recipe = (ROOT / "release/scripts/build-release-image.sh").read_text(
             encoding="utf-8"
         )
-        self.assertIn(worker, product_dockerfile)
-
-        self.assertIn(
-            f'"dist/bin/{worker}-${{RELEASE_TAG}}-linux-amd64"',
-            binary_recipe,
-        )
-        self.assertIn(f"dist/image-bin/{worker}", binary_recipe)
-        self.assertIn(
-            f"--bin {worker}",
-            binary_recipe,
-        )
-        release_dockerfile = (
-            ROOT / "release/docker/Dockerfile.registry-notary"
-        ).read_text(encoding="utf-8")
-        self.assertIn(
-            f"install -m 0755 /workspace/image-bin/{worker} "
-            f"/workspace/runtime-root/usr/local/bin/{worker}",
-            release_dockerfile,
+        self.assertNotIn("registry-notary", binary_recipe)
+        self.assertNotIn("registry-notary", image_recipe)
+        self.assertFalse(
+            (ROOT / "release/docker/Dockerfile.registry-notary").exists()
         )
-        self.assertIn(f"dist/image-bin/{worker}", binary_recipe)
 
     def test_release_product_images_preown_managed_audit_and_state_directories(
         self,
     ) -> None:
-        for product in ("relay", "notary"):
+        for product in ("relay",):
             dockerfile = (
                 ROOT / f"release/docker/Dockerfile.registry-{product}"
             ).read_text(encoding="utf-8")
@@ -2224,6 +2281,70 @@ def test_validate_requires_registryctl_installer_for_v0_14_and_later(self) -> No
         )
         self.assertEqual(0, accepted.returncode, accepted.stderr)
 
+    def test_validate_accepts_declared_evidence_toolset_artifacts(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            manifest = write_manifest(
+                Path(tmp),
+                version="0.17.0",
+                include_evidence_toolset=True,
+            )
+            result = run_tool("validate", str(manifest))
+
+        self.assertEqual(0, result.returncode, result.stderr)
+
+    def test_validate_accepts_post_notary_v0_17_artifact_inventory(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            manifest = write_manifest(
+                Path(tmp),
+                version="0.17.0",
+                include_evidence_toolset=True,
+                include_retired_notary=False,
+            )
+            accepted = run_tool("validate", str(manifest))
+
+            data = yaml.safe_load(manifest.read_text(encoding="utf-8"))
+            data["artifacts"]["registry-notary"] = "0.17.0"
+            manifest.write_text(yaml.safe_dump(data, sort_keys=False), encoding="utf-8")
+            rejected = run_tool("validate", str(manifest))
+
+        self.assertEqual(0, accepted.returncode, accepted.stderr)
+        self.assertNotEqual(0, rejected.returncode)
+        self.assertIn("unexpected registry-notary", rejected.stderr)
+
+    def test_beta_27_manifest_is_the_notary_free_current_inventory(self) -> None:
+        manifest = ROOT / "release/manifests/registry-stack-beta-27.yaml"
+        result = run_tool("validate", str(manifest))
+        data = yaml.safe_load(manifest.read_text(encoding="utf-8"))
+
+        self.assertEqual(0, result.returncode, result.stderr)
+        self.assertEqual("beta-27", data["stack"]["release"])
+        self.assertEqual("0.17.0", data["stack"]["version"])
+        self.assertNotIn("registry-notary", data["artifacts"])
+        self.assertNotIn("registry-notary-cel-worker", data["artifacts"])
+        self.assertLessEqual(
+            {"registry-relay", "evidence", "evidencectl", "mint"},
+            set(data["artifacts"]),
+        )
+
+    def test_validate_still_rejects_unknown_artifacts_beside_the_evidence_toolset(
+        self,
+    ) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            manifest = write_manifest(
+                Path(tmp),
+                version="0.17.0",
+                include_evidence_toolset=True,
+            )
+            contents = manifest.read_text(encoding="utf-8")
+            contents = contents.replace(
+                "evidencectl-installer:", "registry-lab: '0.17.0'\n  evidencectl-installer:"
+            )
+            manifest.write_text(contents, encoding="utf-8")
+            rejected = run_tool("validate", str(manifest))
+
+        self.assertNotEqual(0, rejected.returncode)
+        self.assertIn("unexpected registry-lab", rejected.stderr)
+
     def test_render_registryctl_image_lock_from_exact_release_evidence(self) -> None:
         with tempfile.TemporaryDirectory() as tmp:
             root = Path(tmp)
@@ -2266,6 +2387,69 @@ def test_render_registryctl_image_lock_from_exact_release_evidence(self) -> None
             document,
         )
 
+    def test_render_post_notary_v3_image_lock_without_notary_input(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            manifest = write_manifest(
+                root,
+                version="0.17.0",
+                include_evidence_toolset=True,
+                include_retired_notary=False,
+            )
+            data = yaml.safe_load(manifest.read_text(encoding="utf-8"))
+            data["stack"].pop("source_ref")
+            data["stack"].pop("status")
+            manifest.write_text(yaml.safe_dump(data, sort_keys=False), encoding="utf-8")
+            relay_digest = root / "registry-relay.digest"
+            relay_ref = f"ghcr.io/registrystack/registry-relay@{IMAGE_DIGEST}"
+            relay_digest.write_text(f"{relay_ref}\n", encoding="utf-8")
+            output = root / "registryctl-v0.17.0-image-lock.json"
+
+            rendered = run_tool(
+                "render-registryctl-image-lock",
+                str(manifest),
+                "--relay-digest",
+                str(relay_digest),
+                "--postgresql-ref-file",
+                str(ROOT / "release/registryctl-postgresql-image.ref"),
+                "--tag-target",
+                "b" * 40,
+                "--source-sha",
+                "b" * 40,
+                "--output",
+                str(output),
+            )
+            document = json.loads(output.read_text(encoding="utf-8"))
+
+            notary_digest = root / "registry-notary.digest"
+            notary_digest.write_text(
+                f"ghcr.io/registrystack/registry-notary@{IMAGE_DIGEST}\n",
+                encoding="utf-8",
+            )
+            rejected = run_tool(
+                "render-registryctl-image-lock",
+                str(manifest),
+                "--relay-digest",
+                str(relay_digest),
+                "--notary-digest",
+                str(notary_digest),
+                "--postgresql-ref-file",
+                str(ROOT / "release/registryctl-postgresql-image.ref"),
+                "--tag-target",
+                "b" * 40,
+                "--source-sha",
+                "b" * 40,
+                "--output",
+                str(output),
+            )
+
+        self.assertEqual(0, rendered.returncode, rendered.stderr)
+        self.assertEqual("registryctl.release_image_lock.v3", document["schema_version"])
+        self.assertEqual({"postgresql", "registry-relay"}, set(document["images"]))
+        self.assertEqual(relay_ref, document["images"]["registry-relay"])
+        self.assertNotEqual(0, rejected.returncode)
+        self.assertIn("does not accept --notary-digest", rejected.stderr)
+
     def test_active_manifest_validates_and_renders_image_lock_from_explicit_source(
         self,
     ) -> None:
@@ -2460,7 +2644,7 @@ def test_render_registryctl_image_lock_v2_requires_postgresql_ref(
             )
 
         self.assertNotEqual(0, result.returncode)
-        self.assertIn("v2 requires --postgresql-ref-file", result.stderr)
+        self.assertIn("v2 or later requires --postgresql-ref-file", result.stderr)
 
     def test_render_registryctl_image_lock_rejects_pre_0_9_release(self) -> None:
         with tempfile.TemporaryDirectory() as tmp:
@@ -3625,6 +3809,89 @@ def legacy_stage_capsule_backfill_assets_rejects_missing_release_asset(self) ->
         self.assertNotEqual(0, result.returncode)
         self.assertIn("missing release asset registry-relay.digest", result.stderr)
 
+    def test_stage_capsule_backfill_assets_excludes_retired_notary_from_v0_17(
+        self,
+    ) -> None:
+        registry_release = load_registry_release()
+        for include_retired_assets in (False, True):
+            with (
+                self.subTest(include_retired_assets=include_retired_assets),
+                tempfile.TemporaryDirectory() as tmp,
+            ):
+                root = Path(tmp)
+                asset_dir = write_release_asset_fixture(
+                    root,
+                    tag="v0.17.0",
+                    include_image_lock=True,
+                )
+                if not include_retired_assets:
+                    for retired_name in (
+                        "registry-notary-v0.17.0-linux-amd64",
+                        "registry-notary-cel-worker-v0.17.0-linux-amd64",
+                        "registry-notary.digest",
+                    ):
+                        (asset_dir / retired_name).unlink()
+                binary_dir = root / "staged-bin"
+                image_dir = root / "staged-images"
+
+                with redirect_stdout(io.StringIO()):
+                    result = registry_release.stage_capsule_backfill_assets(
+                        asset_dir,
+                        "v0.17.0",
+                        binary_dir,
+                        image_dir,
+                    )
+
+                self.assertEqual(0, result)
+                self.assertTrue(
+                    (
+                        binary_dir / "registry-relay-rhai-worker-v0.17.0-linux-amd64"
+                    ).is_file()
+                )
+                self.assertTrue((image_dir / "registry-relay.digest").is_file())
+                self.assertFalse(
+                    (binary_dir / "registry-notary-v0.17.0-linux-amd64").exists()
+                )
+                self.assertFalse(
+                    (
+                        binary_dir / "registry-notary-cel-worker-v0.17.0-linux-amd64"
+                    ).exists()
+                )
+                self.assertFalse((image_dir / "registry-notary.digest").exists())
+
+    def test_stage_capsule_backfill_assets_keeps_beta_26_notary_requirements(
+        self,
+    ) -> None:
+        registry_release = load_registry_release()
+        for missing_name in (
+            "registry-notary-v0.16.3-linux-amd64",
+            "registry-notary-cel-worker-v0.16.3-linux-amd64",
+            "registry-notary.digest",
+        ):
+            with (
+                self.subTest(missing_name=missing_name),
+                tempfile.TemporaryDirectory() as tmp,
+            ):
+                root = Path(tmp)
+                asset_dir = write_release_asset_fixture(
+                    root,
+                    tag="v0.16.3",
+                    include_image_lock=True,
+                )
+                (asset_dir / missing_name).unlink()
+
+                error = io.StringIO()
+                with redirect_stderr(error):
+                    result = registry_release.stage_capsule_backfill_assets(
+                        asset_dir,
+                        "v0.16.3",
+                        root / "staged-bin",
+                        root / "staged-images",
+                    )
+
+                self.assertEqual(1, result)
+                self.assertIn(f"missing release asset {missing_name}", error.getvalue())
+
     def test_bind_spdx_subject_adds_digest_bound_described_package(self) -> None:
         with tempfile.TemporaryDirectory() as tmp:
             root = Path(tmp)
@@ -3764,6 +4031,8 @@ def write_manifest(
     version: str = "0.8.0",
     include_registryctl_image_lock: bool | None = None,
     include_registryctl_installer: bool | None = None,
+    include_evidence_toolset: bool = False,
+    include_retired_notary: bool | None = None,
 ) -> Path:
     if source_tag is None:
         source_tag = f"v{version}"
@@ -3794,6 +4063,16 @@ def write_manifest(
         include_registryctl_installer = version_tuple >= (0, 14, 0)
     if include_registryctl_installer:
         artifacts["registryctl-installer"] = version
+    if include_evidence_toolset:
+        artifacts["evidence"] = version
+        artifacts["evidencectl"] = version
+        artifacts["mint"] = version
+        artifacts["evidencectl-installer"] = version
+    if include_retired_notary is None:
+        include_retired_notary = version_tuple < (0, 17, 0)
+    if not include_retired_notary:
+        artifacts.pop("registry-notary", None)
+        artifacts.pop("registry-notary-cel-worker", None)
     manifest = {
         "stack": {
             "release": "beta-6",
diff --git a/release/scripts/test_registry_release_lock.py b/release/scripts/test_registry_release_lock.py
index 4a945f075..25a208d88 100644
--- a/release/scripts/test_registry_release_lock.py
+++ b/release/scripts/test_registry_release_lock.py
@@ -21,6 +21,23 @@
 
 
 class RegistryReleaseLockTests(unittest.TestCase):
+    def test_schema_version_matches_the_post_retirement_shape(self) -> None:
+        # The Registry Notary retirement removed the Notary image, runtime
+        # recipe, and config-schema members from the signed payload. Both
+        # published schemas and the producer have to name the shape they
+        # actually describe, so version 1.0 cannot keep standing for both.
+        self.assertEqual(release_lock.SCHEMA_VERSION, "2.0")
+        for schema_file in (
+            "release/registry-release-lock.v1.schema.json",
+            "release/registry-release-lock-payload.v1.schema.json",
+        ):
+            schema = json.loads((ROOT / schema_file).read_text(encoding="utf-8"))
+            self.assertEqual(
+                schema["properties"]["schema_version"]["const"],
+                release_lock.SCHEMA_VERSION,
+                schema_file,
+            )
+
     def test_create_payload_generates_complete_closed_example(self) -> None:
         with tempfile.TemporaryDirectory() as temporary:
             root = Path(temporary)
@@ -52,7 +69,6 @@ def test_create_payload_generates_complete_closed_example(self) -> None:
             application_digests = {}
             for name, repository, value in [
                 ("relay", "ghcr.io/registrystack/registry-relay", "d"),
-                ("notary", "ghcr.io/registrystack/registry-notary", "e"),
                 ("postgresql", "docker.io/library/postgres", "f"),
             ]:
                 application_digest = f"sha256:{value * 64}"
@@ -91,7 +107,6 @@ def test_create_payload_generates_complete_closed_example(self) -> None:
                         "tag_target": tag_target,
                         "images": {
                             "registry-relay": image_identities["relay"],
-                            "registry-notary": image_identities["notary"],
                             "postgresql": image_identities["postgresql"],
                         },
                     }
@@ -111,7 +126,6 @@ def test_create_payload_generates_complete_closed_example(self) -> None:
                             asset_dir=assets,
                             image_lock=image_lock,
                             relay_image_index=image_indexes["relay"],
-                            notary_image_index=image_indexes["notary"],
                             postgresql_image_index=image_indexes["postgresql"],
                             output=output,
                         )
@@ -141,7 +155,7 @@ def test_create_payload_generates_complete_closed_example(self) -> None:
             )
             self.assertEqual(
                 set(payload["images"]),
-                {"relay", "notary", "postgresql_state_plane"},
+                {"relay", "postgresql_state_plane"},
             )
             self.assertEqual(
                 set(payload["images"]),
@@ -159,16 +173,22 @@ def test_create_payload_generates_complete_closed_example(self) -> None:
                     ],
                 },
             )
-            self.assertEqual(
-                payload["images"]["notary"]["platforms"][0]["manifest_digest"],
-                application_digests["notary"],
-            )
             self.assertEqual(
                 payload["images"]["postgresql_state_plane"]["platforms"][0][
                     "manifest_digest"
                 ],
                 application_digests["postgresql"],
             )
+            self.assertEqual(
+                set(payload["supported_contracts"]),
+                {
+                    "config_bundle_schema",
+                    "config_signature_schema",
+                    "trust_anchor_schema",
+                    "anchor_transition_schema",
+                    "relay_config_schema",
+                },
+            )
             self.assertEqual(
                 set(schema["properties"]["runtime"]["required"]),
                 set(schema["properties"]["runtime"]["properties"]),
@@ -180,6 +200,15 @@ def test_create_payload_generates_complete_closed_example(self) -> None:
                     payload["runtime"]
                 )
             )
+            self.assertEqual(
+                set(payload["runtime"]),
+                {
+                    "relay_public",
+                    "relay_consultation",
+                    "postgresql_state_plane",
+                    "operator_files",
+                },
+            )
             self.assertEqual(
                 set(payload["runtime"]),
                 set(schema["properties"]["runtime"]["required"]),
@@ -262,19 +291,10 @@ def test_create_payload_generates_complete_closed_example(self) -> None:
                     "preparation": ["postgresql-tls-certificate"],
                     "serve": ["postgresql-tls-certificate"],
                 },
-                "notary": {
-                    "preparation": ["postgresql-tls-certificate"],
-                    "serve": [
-                        "postgresql-tls-certificate",
-                        "notary-relay-workload-credential",
-                        "notary-signing-key",
-                    ],
-                },
             }
             for lane, product in [
                 ("relay-public", "registry-relay"),
                 ("relay-consultation", "registry-relay"),
-                ("notary", "registry-notary"),
             ]:
                 recipe = payload["runtime"][lane.replace("-", "_")]
                 prefix = ["product-action"]
@@ -421,7 +441,7 @@ def test_create_payload_generates_complete_closed_example(self) -> None:
                 hashlib.sha256(
                     postgresql["bootstrap"]["command"][2].encode()
                 ).hexdigest(),
-                "cbad443afb9700702df52be6513cf8afd95b97747d75a0a417df4fd079a2e79c",
+                "02515ab47034a241554bc13f616de00c14b42a36139d6d07a1a53e52c6c28f0e",
             )
             bootstrap_file = next(
                 file
@@ -435,15 +455,12 @@ def test_create_payload_generates_complete_closed_example(self) -> None:
             product_environment_ids = {
                 "relay-public-environment",
                 "relay-consultation-environment",
-                "notary-environment",
             }
             operator_files = payload["runtime"]["operator_files"]
             self.assertEqual(
                 {file["id"] for file in operator_files},
                 product_environment_ids
                 | {
-                    "notary-signing-key",
-                    "notary-relay-workload-credential",
                     "postgresql-tls-certificate",
                     "postgresql-tls-private-key",
                     "postgresql-admin-password",
diff --git a/release/scripts/test_registry_release_plans.py b/release/scripts/test_registry_release_plans.py
index 8f92efb86..d93b3da83 100644
--- a/release/scripts/test_registry_release_plans.py
+++ b/release/scripts/test_registry_release_plans.py
@@ -17,8 +17,6 @@
 EXACT_ARTIFACT_INVENTORY = (
     "registry-docs",
     "registry-manifest-cli",
-    "registry-notary",
-    "registry-notary-cel-worker",
     "registry-relay",
     "registry-relay-rhai-worker",
     "registryctl",
diff --git a/release/scripts/test_relay_oidc_smoke.py b/release/scripts/test_relay_oidc_smoke.py
index 430e080fe..c2e14209d 100644
--- a/release/scripts/test_relay_oidc_smoke.py
+++ b/release/scripts/test_relay_oidc_smoke.py
@@ -265,6 +265,86 @@ def test_plan_declares_authenticity_network_and_no_live_evidence(self) -> None:
         self.assertEqual("candidate-neutral-harness-plan", plan["classification"])
         self.assertEqual(candidate, plan["candidate"])
 
+    def test_plan_declares_the_source_read_and_minimization_checks(self) -> None:
+        plan = self.runner.plan_document(
+            {"release_id": "beta-17", "source_ref": "a" * 40, "topology": "release"}
+        )
+
+        self.assertIn("source-read-scope-denied", plan["checks"])
+        self.assertIn("source-read-records", plan["checks"])
+        self.assertIn("source-read-minimized-projection", plan["checks"])
+
+    def test_template_pins_the_separate_entity_read_scope(self) -> None:
+        self.runner.validate_assets()
+        template = self.runner.TEMPLATE_PATH.read_text(encoding="utf-8")
+
+        self.assertIn("read_scope: smoke_registry:rows", template)
+        self.assertIn('"registry-smoke-reader": $mapped_scope', template)
+
+    def test_source_read_config_grants_the_declared_entity_read_scope(self) -> None:
+        token = fake_token(role_claim={"registry-smoke-reader": {"org-1": "active"}})
+        profile = self.runner.inspect_token(token, self.topology())
+
+        metadata_only = self.runner.render_relay_config(profile, host_port=19191)
+        read_grant = self.runner.render_relay_config(
+            profile, host_port=19191, mapped_scope="smoke_registry:rows"
+        )
+
+        self.assertIn(
+            '"registry-smoke-reader": "smoke_registry:metadata"', metadata_only
+        )
+        self.assertIn('"registry-smoke-reader": "smoke_registry:rows"', read_grant)
+        self.assertNotIn("$", read_grant)
+
+    def test_source_read_result_rejects_undeclared_and_altered_records(self) -> None:
+        declared = {
+            "data": [{"id": "person-001", "display_name": "Registry Smoke Person"}],
+            "pagination": {"has_more": False},
+        }
+        self.assertEqual("pass", self.runner.source_read_result(declared)[0])
+
+        leaked = {
+            "data": [
+                {
+                    "id": "person-001",
+                    "display_name": "Registry Smoke Person",
+                    "person_id": "person-001",
+                }
+            ]
+        }
+        leaked_result, leaked_detail = self.runner.source_read_result(leaked)
+        self.assertEqual("fail", leaked_result)
+        self.assertIn("person_id", leaked_detail)
+
+        altered = {"data": [{"id": "person-001", "display_name": "Someone Else"}]}
+        altered_result, altered_detail = self.runner.source_read_result(altered)
+        self.assertEqual("fail", altered_result)
+        self.assertNotIn("Someone Else", altered_detail)
+
+        for malformed in ({"data": []}, {}, {"data": ["person-001"]}):
+            self.assertEqual("fail", self.runner.source_read_result(malformed)[0])
+
+    def test_expected_record_is_derived_from_the_pinned_fixture(self) -> None:
+        header, row = self.runner.FIXTURE_PATH.read_text(
+            encoding="utf-8"
+        ).splitlines()[:2]
+        source_row = dict(zip(header.split(","), row.split(",")))
+
+        self.assertEqual(
+            {
+                "id": source_row["person_id"],
+                "display_name": source_row["display_name"],
+            },
+            self.runner.SOURCE_READ_RECORD,
+        )
+        self.assertNotIn("person_id", self.runner.SOURCE_READ_RECORD)
+
+    def test_readme_states_the_source_read_evidence(self) -> None:
+        readme = (self.runner.CONFIG_DIR / "README.md").read_text(encoding="utf-8")
+
+        self.assertIn("smoke_registry:rows", readme)
+        self.assertIn("person_id", readme)
+
     def test_solmara_live_run_cannot_emit_evidence_from_metadata(self) -> None:
         args = Namespace(
             topology="solmara",
diff --git a/release/scripts/test_release_candidate.py b/release/scripts/test_release_candidate.py
index 69480e9af..7c75bae84 100644
--- a/release/scripts/test_release_candidate.py
+++ b/release/scripts/test_release_candidate.py
@@ -45,10 +45,12 @@ def json_bytes(value: object) -> bytes:
     return json.dumps(value, sort_keys=True, separators=(",", ":")).encode() + b"\n"
 
 
-def security_evidence_members() -> dict[str, bytes]:
+def security_evidence_members(
+    image_names: tuple[str, ...] = ("registry-relay",),
+) -> dict[str, bytes]:
     refs = {
         name: f"ghcr.io/registrystack/{name}-candidate@{IMAGE_DIGEST}"
-        for name in ("registry-notary", "registry-relay")
+        for name in image_names
     }
     refs["postgresql"] = POSTGRESQL_REF
     members = {
@@ -58,11 +60,10 @@ def security_evidence_members() -> dict[str, bytes]:
             {
                 "schema_version": "registry-stack.advisory-verdict.v2",
                 "verdict": "passed",
-                "subjects": [
-                    "registry-notary-image",
-                    "registry-relay-image",
-                    "postgresql-runtime",
-                ],
+                "subjects": sorted(
+                    [f"{name}-image" for name in image_names]
+                    + ["postgresql-runtime"]
+                ),
             }
         ),
     }
@@ -966,16 +967,13 @@ def replace_security_evidence(
         return path
 
     def make_v2_candidate(self) -> tuple[dict, Path, Path, dict]:
-        bundle_root = self.root.parent / "v2-bundle"
+        bundle_root = self.root / "v2-bundle"
         evidence_members = security_evidence_members()
         evidence_name = "registry-stack-v1.2.3-security-evidence.tar.gz"
         files = {
             "registryctl-v1.2.3-linux-amd64": b"registryctl",
             "registry-docs-v1.2.3.tar.gz": b"docs",
             "registry-stack-v1.2.3.sbom.spdx.json": b"sbom",
-            "security/registry-notary.grype.json": evidence_members[
-                "grype/registry-notary.grype.json"
-            ],
             "security/registry-relay.grype.json": evidence_members[
                 "grype/registry-relay.grype.json"
             ],
@@ -990,7 +988,7 @@ def make_v2_candidate(self) -> tuple[dict, Path, Path, dict]:
             path = bundle_root / name
             path.parent.mkdir(parents=True, exist_ok=True)
             path.write_bytes(payload)
-        bundle_path = self.root.parent / "registry-stack-v1.2.3-candidate.tar.gz"
+        bundle_path = self.root / "registry-stack-v1.2.3-candidate.tar.gz"
         with tarfile.open(bundle_path, "w:gz") as archive:
             for name in sorted(files):
                 archive.add(bundle_root / name, arcname=name)
@@ -1040,7 +1038,7 @@ def make_v2_candidate(self) -> tuple[dict, Path, Path, dict]:
                     "digest": IMAGE_DIGEST,
                     "final_ref": f"ghcr.io/registrystack/{name}:v1.2.3",
                 }
-                for name in ("registry-notary", "registry-relay")
+                for name in ("registry-relay",)
             ],
             "docs": {
                 "name": "registry-docs-v1.2.3.tar.gz",
@@ -1059,7 +1057,7 @@ def make_v2_candidate(self) -> tuple[dict, Path, Path, dict]:
                     "sha256": sha256(files[f"security/{name}.grype.json"]),
                     "status": "passed",
                 }
-                for name in ("registry-notary", "registry-relay")
+                for name in ("registry-relay",)
             ],
             "advisory": {
                 "name": "security/advisory-verdict.json",
@@ -1113,6 +1111,123 @@ def test_v2_candidate_requires_source_to_equal_workflow_revision(self) -> None:
                 now=self.now,
             )
 
+    def test_v2_candidate_image_inventory_is_version_aware(self) -> None:
+        current, _, _, _ = self.make_v2_candidate()
+        self.module.validate_candidate_manifest(current, now=self.now)
+
+        historical = copy.deepcopy(current)
+        historical["release"]["version"] = "0.16.3"
+        historical["release"]["tag"] = "v0.16.3"
+        historical_evidence = next(
+            item
+            for item in historical["payloads"]
+            if item["kind"] == "security-evidence"
+        )
+        historical_evidence["name"] = (
+            "registry-stack-v0.16.3-security-evidence.tar.gz"
+        )
+        historical["bundle"]["name"] = (
+            "registry-stack-v0.16.3-candidate.tar.gz"
+        )
+        historical["images"][0]["final_ref"] = (
+            "ghcr.io/registrystack/registry-relay:v0.16.3"
+        )
+
+        with self.assertRaisesRegex(
+            self.module.CandidateError,
+            "image inventory must be exactly.*registry-notary",
+        ):
+            self.module.validate_candidate_manifest(historical, now=self.now)
+
+        historical["images"].append(
+            {
+                "name": "registry-notary",
+                "candidate_ref": (
+                    "ghcr.io/registrystack/registry-notary-candidate@"
+                    f"{CONFIG_DIGEST}"
+                ),
+                "digest": CONFIG_DIGEST,
+                "final_ref": "ghcr.io/registrystack/registry-notary:v0.16.3",
+            }
+        )
+        historical["scans"].append(
+            {
+                "image": "registry-notary",
+                "name": "security/registry-notary.grype.json",
+                "sha256": ARCHIVE_SHA,
+                "status": "passed",
+            }
+        )
+        self.module.validate_candidate_manifest(historical, now=self.now)
+
+    def test_v2_security_evidence_members_follow_candidate_images(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            current_path = root / "current.tar.gz"
+            current_members = security_evidence_members()
+            current_path.write_bytes(
+                security_evidence_tar(sorted(current_members.items()))
+            )
+            current_refs = {
+                "registry-relay": (
+                    "ghcr.io/registrystack/registry-relay-candidate@"
+                    f"{IMAGE_DIGEST}"
+                )
+            }
+            self.module.validate_security_evidence_archive(
+                current_path,
+                product_image_refs=current_refs,
+                product_scan_sha256={
+                    "registry-relay": sha256(
+                        current_members["grype/registry-relay.grype.json"]
+                    )
+                },
+                advisory_sha256=sha256(
+                    current_members["advisory-verdict.json"]
+                ),
+            )
+
+            historical_refs = {
+                **current_refs,
+                "registry-notary": (
+                    "ghcr.io/registrystack/registry-notary-candidate@"
+                    f"{IMAGE_DIGEST}"
+                ),
+            }
+            with self.assertRaisesRegex(
+                self.module.CandidateError,
+                "security evidence archive is incomplete",
+            ):
+                self.module.validate_security_evidence_archive(
+                    current_path,
+                    product_image_refs=historical_refs,
+                    product_scan_sha256={},
+                    advisory_sha256=sha256(
+                        current_members["advisory-verdict.json"]
+                    ),
+                )
+
+            historical_path = root / "historical.tar.gz"
+            historical_members = security_evidence_members(
+                ("registry-notary", "registry-relay")
+            )
+            historical_path.write_bytes(
+                security_evidence_tar(sorted(historical_members.items()))
+            )
+            self.module.validate_security_evidence_archive(
+                historical_path,
+                product_image_refs=historical_refs,
+                product_scan_sha256={
+                    name: sha256(
+                        historical_members[f"grype/{name}.grype.json"]
+                    )
+                    for name in historical_refs
+                },
+                advisory_sha256=sha256(
+                    historical_members["advisory-verdict.json"]
+                ),
+            )
+
     def test_v2_candidate_allows_only_current_in_progress_run_before_oidc(
         self,
     ) -> None:
@@ -1346,12 +1461,12 @@ def test_v2_security_evidence_archive_rejects_unbound_contents(self) -> None:
         unbound_spdx["image-sbom/postgresql.spdx.json"] = json_bytes(spdx)
 
         unbound_syft = dict(base)
-        syft = json.loads(unbound_syft["syft/registry-notary.syft.json"])
+        syft = json.loads(unbound_syft["syft/registry-relay.syft.json"])
         syft["source"]["metadata"]["userInput"] = (
-            "ghcr.io/registrystack/registry-notary-candidate@sha256:"
+            "ghcr.io/registrystack/registry-relay-candidate@sha256:"
             + "9" * 64
         )
-        unbound_syft["syft/registry-notary.syft.json"] = json_bytes(syft)
+        unbound_syft["syft/registry-relay.syft.json"] = json_bytes(syft)
 
         incomplete_verdict = dict(base)
         verdict = json.loads(incomplete_verdict["advisory-verdict.json"])
@@ -1359,15 +1474,15 @@ def test_v2_security_evidence_archive_rejects_unbound_contents(self) -> None:
         incomplete_verdict["advisory-verdict.json"] = json_bytes(verdict)
 
         substituted_scan = dict(base)
-        scan = json.loads(substituted_scan["grype/registry-notary.grype.json"])
+        scan = json.loads(substituted_scan["grype/registry-relay.grype.json"])
         scan["substituted"] = True
-        substituted_scan["grype/registry-notary.grype.json"] = json_bytes(scan)
+        substituted_scan["grype/registry-relay.grype.json"] = json_bytes(scan)
 
         for members, message in (
             (invalid_digest, "PostgreSQL digest is not canonical or immutable"),
             (unreviewed_digest, "does not match the reviewed release image"),
             (unbound_spdx, "PostgreSQL SPDX subject is not bound"),
-            (unbound_syft, "registry-notary.syft.json.*is not bound"),
+            (unbound_syft, "registry-relay.syft.json.*is not bound"),
             (incomplete_verdict, "does not cover every runtime"),
             (substituted_scan, "does not match its scan payload"),
         ):
@@ -1500,7 +1615,7 @@ def test_v2_candidate_rejects_scan_advisory_image_and_bundle_substitution(
             (("advisory", "verdict"), "failed", "verdict must be passed"),
             (
                 ("images", 0, "final_ref"),
-                "ghcr.io/registrystack/registry-notary:v9.9.9",
+                "ghcr.io/registrystack/registry-relay:v9.9.9",
                 "final_ref",
             ),
             (("bundle", "sha256"), "9" * 64, "bundle sha256 mismatch"),
diff --git a/release/scripts/test_release_workflow_structure.py b/release/scripts/test_release_workflow_structure.py
index 5e3398a92..f5e6bda45 100644
--- a/release/scripts/test_release_workflow_structure.py
+++ b/release/scripts/test_release_workflow_structure.py
@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import json
+import importlib.util
 import subprocess
 import tempfile
 import unittest
@@ -48,6 +49,39 @@ def verify_latest_release_fixture(metadata: dict, expected_tag: str) -> subproce
 
 
 class CandidateWorkflowStructureTest(unittest.TestCase):
+    def test_current_release_pipeline_has_no_retired_notary_surface(self) -> None:
+        paths = (
+            WORKFLOWS / "release-candidate.yml",
+            WORKFLOWS / "release.yml",
+            WORKFLOWS / "release-canary.yml",
+            ROOT / "release/scripts/build-release-binaries.sh",
+            ROOT / "release/scripts/build-release-image.sh",
+        )
+        for path in paths:
+            with self.subTest(path=path.relative_to(ROOT)):
+                self.assertNotIn(
+                    "registry-notary",
+                    path.read_text(encoding="utf-8").lower(),
+                )
+        self.assertFalse((ROOT / "release/docker/Dockerfile.registry-notary").exists())
+
+        repeatability = (WORKFLOWS / "release-repeatability.yml").read_text(
+            encoding="utf-8"
+        )
+        self.assertIn('.images | keys[] | select(startswith("registry-"))', repeatability)
+        self.assertNotIn("for name in registry-notary registry-relay", repeatability)
+
+        module_path = ROOT / "release/scripts/release_candidate.py"
+        spec = importlib.util.spec_from_file_location("release_candidate", module_path)
+        self.assertIsNotNone(spec)
+        self.assertIsNotNone(spec.loader)
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+        self.assertEqual({"registry-relay"}, module.CURRENT_IMAGE_NAMES)
+        self.assertFalse(
+            any("registry-notary" in name for name in module.SECURITY_EVIDENCE_REQUIRED_FILES)
+        )
+
     def test_keeps_one_candidate_pipeline_with_narrow_permissions(self) -> None:
         _, document = workflow("release-candidate.yml")
         self.assertEqual(
@@ -92,6 +126,25 @@ def test_builds_once_scans_exact_images_and_attests_the_candidate(self) -> None:
         self.assertIn("Reverify all bytes before requesting OIDC", text)
         self.assertIn("Attest manifest and bundle after re-verification", text)
 
+    def test_release_embeds_evidencectl_tag_and_publishes_latest_alias(self) -> None:
+        _, document = workflow("release-candidate.yml")
+        assemble = step_run(
+            document,
+            "assemble",
+            "Assemble public payload and validate version-appropriate install inputs",
+        )
+        self.assertIn('$0 == "default_version=\\\"\\\""', assemble)
+        self.assertIn('version="${{ needs.validate.outputs.tag }}"', assemble)
+        self.assertIn(
+            'cp "candidate/bundle-root/${evidencectl_installer}" \\\n'
+            "  candidate/bundle-root/evidencectl-install.sh",
+            assemble,
+        )
+        self.assertIn(
+            "chmod 0755 candidate/bundle-root/evidencectl-install.sh",
+            assemble,
+        )
+
     def test_reuses_cache_with_seven_day_validity_and_storage_margin(self) -> None:
         text, document = workflow("release-candidate.yml")
         cache = next(
diff --git a/release/scripts/test_validate_upgrade_exercise.py b/release/scripts/test_validate_upgrade_exercise.py
index a41968ea2..270a7ecce 100644
--- a/release/scripts/test_validate_upgrade_exercise.py
+++ b/release/scripts/test_validate_upgrade_exercise.py
@@ -307,6 +307,28 @@ def test_candidate_must_be_a_forward_version_upgrade(self) -> None:
         with self.assertRaisesRegex(self.module.ExerciseError, "must be newer"):
             self.validate_record(record, allow_template=False)
 
+    def test_v1_rejects_post_notary_target_before_historical_path_binding(
+        self,
+    ) -> None:
+        record = self.candidate()
+        record["target_release"]["version"] = "v0.17.0"
+        del record["target_release"]["notary_image_digest"]
+        self.module.load_candidate.reset_mock()
+
+        with mock.patch.object(
+            self.module,
+            "git_bytes",
+            side_effect=AssertionError("historical paths must not be read"),
+        ) as git_bytes:
+            with self.assertRaisesRegex(
+                self.module.ExerciseError,
+                "historical Notary-era contract.*before v0.17.0",
+            ):
+                self.validate_record(record, allow_template=False)
+
+        git_bytes.assert_not_called()
+        self.module.load_candidate.assert_not_called()
+
     def test_prerelease_version_order_uses_semver_precedence(self) -> None:
         for lower, higher in (
             ("v1.0.0-rc.1", "v1.0.0-rc.2"),
diff --git a/release/scripts/validate-upgrade-exercise.py b/release/scripts/validate-upgrade-exercise.py
index d7fa10445..fad6a4401 100644
--- a/release/scripts/validate-upgrade-exercise.py
+++ b/release/scripts/validate-upgrade-exercise.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Validate a redaction-safe Registry Stack upgrade exercise record."""
+"""Validate a historical Notary-era Registry Stack upgrade exercise record."""
 
 from __future__ import annotations
 
@@ -24,6 +24,7 @@
 
 
 SCHEMA = "registry-stack.upgrade-exercise/v1"
+POST_NOTARY_VERSION = "v0.17.0"
 SOLMARA_REPOSITORY = "registrystack/solmara-lab"
 STACK_REPOSITORY = "registrystack/registry-stack"
 CONFIG_SCHEMAS = {
@@ -235,6 +236,22 @@ def version_order(
     return core_order, tuple(identifiers)
 
 
+def reject_post_notary_v1_target(value: Any) -> None:
+    if not isinstance(value, dict):
+        return
+    version = value.get("version")
+    if (
+        isinstance(version, str)
+        and VERSION.fullmatch(version) is not None
+        and version_order(version) >= version_order(POST_NOTARY_VERSION)
+    ):
+        raise ExerciseError(
+            f"{SCHEMA} is a historical Notary-era contract and accepts only "
+            f"target_release.version values before {POST_NOTARY_VERSION}; "
+            "post-Notary upgrades require a successor contract"
+        )
+
+
 def validate_config_schemas(
     value: Any, *, template: bool, root: Path, target_commit: str | None
 ) -> None:
@@ -734,6 +751,7 @@ def validate_record(
         raise ExerciseError("--template accepts only a template record")
     bounded_string(record["exercise_id"], "exercise_id", SLUG, template=template)
     bounded_string(record["recorded_at"], "recorded_at", TIMESTAMP, template=template)
+    reject_post_notary_v1_target(record["target_release"])
     validate_release(record["source_release"], "source_release", template=template)
     validate_release(record["target_release"], "target_release", template=template)
     if not template and version_order(record["target_release"]["version"]) <= version_order(